joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fc5a
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x44fc82
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x44fc74
pop edi
pop esi
pop ebp
ret 4

Function at 0x4562be
Capabilities:
Encode data using xor

Disassembly:
aas
xchg dword [edx + 0x685f0f2a], ebx
xchg esi, eax
jp 0x4562da
invalid
jae 0x4562c8
popfd
adc byte [edi], dh
cmc
mov ebx, 0xd38577bf
pop ss
iretd
jno 0x456289
in eax, 0xd
je 0x456263
or eax, 0x99bd173a
cdq
mov edx, 0x48da53b7
sbb al, ah
invalid
out 0xe6, eax
mov edi, 0x83e41ee4
scasb al, byte es:[edi]
imul ebp, dword [ebp - 7], 0xef7b3cca
sub dword [esi - 0x35069297], 0x3c
jnp 0x4562d2
pop edx
pop ss
dec edx
mov dword [ebx + 0x44], ebx
fimul word [ecx]
nop
xlatb
fdiv dword [0xb6b823b7]
pop esi
push ss
and dword [edx - 0x26], eax
pop ebp
sahf
pop edx
sti
cdq
xor al, 0xb6
aad 0x86
invalid

Function at 0x498aa1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
test edi, edi
je 0x498b10
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp ebx, dword [ecx + 4]
jae 0x498b10
cmp edi, 0xffffffff
jne 0x4d71a4
mov edi, dword [ecx + 4]
sub edi, ebx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
cmp eax, 1
jg 0x4d71b5
mov eax, dword [esi + 4]
mov ecx, esi
add eax, edi
push eax
call fcn.0049ccb5
mov ecx, dword [esi]
lea eax, [edi + edi]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea eax, [eax + ebx*2]
push eax
mov eax, dword [esi + 4]
lea eax, [ecx + eax*2]
push eax
call int.004b354e
add dword [esi + 4], edi
add esp, 0xc
mov ecx, dword [esi + 4]
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
mov dword [ecx - 8], ebx
jle 0x4d7133
cmp al, 0x90
lcall 0x1ed3, 0xa9f11a23
inc eax
jbe 0x4d7215
push ecx
pop esi
push ds
mov bl, 0x84
invalid
push ebx

Function at 0x49906a
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x499092
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x499084
pop edi
pop esi
pop ebp
ret 4
Function at 0x4e1f01
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
test edi, edi
je 0x4e1f70
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp ebx, dword [ecx + 4]
jae 0x4e1f70
cmp edi, 0xffffffff
jne 0x520604
mov edi, dword [ecx + 4]
sub edi, ebx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
cmp eax, 1
jg 0x520615
mov eax, dword [esi + 4]
mov ecx, esi
add eax, edi
push eax
call fcn.004e6115
mov ecx, dword [esi]
lea eax, [edi + edi]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea eax, [eax + ebx*2]
push eax
mov eax, dword [esi + 4]
lea eax, [ecx + eax*2]
push eax
call fcn.004fc9ae
add dword [esi + 4], edi
add esp, 0xc
mov ecx, dword [esi + 4]
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
ljmp 0x2fc1:0x83cd9758

Function at 0x4e24ca
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x4e24f2
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x4e24e4
pop edi
pop esi
pop ebp
ret 4

Function at 0x4e6251
Capabilities:
Encode data using xor

Disassembly:
aaa
xchg ebp, eax
jp 0x4e6274
or al, 0x56
out dx, al
dec esi
xchg ecx, eax
push edi
sub dword [ebx - 0x122c0299], eax
sub al, 0x3d
std
push ss
sub al, 0x4d
popfd
push ebp
adc bh, 0x1e
xor dword [ebx], eax
cwde
stosb byte es:[edi], al
fcomp qword [edi + 0x2127a12d]
js 0x4e6230
js 0x4e6230
js 0x4e6230
xchg edx, eax
rol ah, cl
xor esp, 0xffffffc3
or eax, 0x83044c49
div dword [ecx + 0x22246727]
mov cl, 0x27
and al, 0x22
cli
xlatb
jb 0x4e625f
pop esp
dec edx
mov ebx, 0x7fefbe5c
scasd eax, dword es:[edi]
and cl, dl
sbb cl, 0x9f
lahf
lodsb al, byte [esi]
cmp al, 0xec
jle 0x4e61fa
clc
jmp 0xc64e1a82
Function at 0x52bbfa
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x52bc22
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x52bc14
pop edi
pop esi
pop ebp
ret 4

Function at 0x54026a
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ebp + 0x4e], 0x9c
jge 0x5402bb
pushfd
or al, 0x7a
call 0x27265f0c
mov cl, 0x2b
xor eax, 0xdc42031a
push 0x6f
sbb dword [eax + 0x42], eax
cld
push edx
add bl, byte [ebp - 0x42]
jbe 0x54026b
xlatb
lodsd eax, dword [esi]
jmp 0xda402005
or dl, dh
dec edi
inc eax
and al, 0x99
pop ss
adc dword [0x818505d], esi
ret
Function at 0x545376
Capabilities:
Encode data using xor

Disassembly:
or bh, byte [ebx]
test esp, esi
sbb byte [edi + esi*8 + 0x71d2ba2f], al
jb 0x545380
jns 0x5453ac
mov dl, 0x2b
mov al, 0x1c
sbb al, 8
and esp, dword [eax*2 + 0x78c03e52]
jle 0x545364
sbb al, 8
and esp, dword [eax*2 + 0x78c03e52]
jle 0x545364
jecxz 0x5453f1
outsd dx, dword [esi]
or byte [esi + edx*2], dl
mov ebp, 0x32402957
push edi
inc ecx
push ss
std
push ecx
js 0x5453e9
out 0x4a, eax
in al, 0xb8
enter 0xffffffffffffe56d, 0xffffffffffffffab
daa
leave
sub edi, dword [eax + 0x2b]
std
add al, al
or bh, dh
fisttp dword [edx]
salc
stosb byte es:[edi], al
xor edx, ebp
jecxz 0x545423
insd dword es:[edi], dx
aas
insd dword es:[edi], dx
clc
retf 0xe307
or eax, 0x9cc3ca48
sbb byte [edx + ebx*2], bl
mov bl, 0xd0
nop
pop ebp
wait
or eax, 0xeb09b361
sbb byte [edi], 0xef
outsd dx, dword [esi]
pop ds
mov al, byte [0x6609b7ce]
mov esp, 0x7950ace7
xor byte [ebx - 0x14cf5380], ah
pushfd
and al, 0x55
loope 0x5453f6
push ds
pop esp
jno 0x5453ad
insb byte es:[edi], dx
pop ds
clc
loop 0x545455
mov dl, 0xa
mov eax, 0x8503ffe2
test byte [edi - 0x7685c54], bh
loop 0x545424
inc dword [ebx]
test dword [edi + edi*4 - 0x7685c54], eax
add eax, dword [ebp - 0x5c53407c]
xchg edi, eax
clc
loop 0x545494
pop edx
xchg edx, eax
jmp 0x545430
cmpsd dword [esi], dword es:[edi]
retf
sbb eax, 0xd07c516b
ret 0xf8a8
Function at 0x574c41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
test edi, edi
je 0x574cb0
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp ebx, dword [ecx + 4]
jae 0x574cb0
cmp edi, 0xffffffff
jne 0x5b3344
mov edi, dword [ecx + 4]
sub edi, ebx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
cmp eax, 1
jg 0x5b3355
mov eax, dword [esi + 4]
mov ecx, esi
add eax, edi
push eax
call fcn.00578e55
mov ecx, dword [esi]
lea eax, [edi + edi]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea eax, [eax + ebx*2]
push eax
mov eax, dword [esi + 4]
lea eax, [ecx + eax*2]
push eax
call int.0058f6ee
add dword [esi + 4], edi
add esp, 0xc
mov ecx, dword [esi + 4]
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
out dx, al
sti
xor ebx, dword [ebx]

Function at 0x57520a
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x575232
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x575224
pop edi
pop esi
pop ebp
ret 4

Function at 0x58c329
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
jno 0x58c2dc
pop eax
jg 0x58c30c
stosb byte es:[edi], al
cmp eax, 0xf6a51f15
popal
push ss
pushal
inc eax
lcall 0x285c, 0xd5914c9f
ret
sub eax, 0xbbfbd5f
jg 0x58c2e6
lcall 0x64b2, 0x7619eb2b
je 0x58c30a
sbb dword [esi - 0x4e], esi
je 0x58c30a
loope 0x58c2d0
mov ah, byte [ebx]
aad 0x4d
adc cl, byte [ebx - 0x550351ce]
aas
mov ah, 0x6e
xchg esp, eax
sbb dword [edx + 3], ecx
enter 0x1dfe, 0x6f
cdq
stc
enter 0x59a3, 0xffffffffffffffb1
invalid
fisubr word [esi + 0x1dd075f]
pop edi
pop es
fld qword [ecx]
pop edi
mov esi, 0x36dff8e
dec ebx
jge 0x58c33a
pushfd
daa
popfd
push ds
invalid
mov ebp, 0x1ebc8c4a
lodsd eax, dword [esi]
and ebp, dword [ebx - 0x22]
dec ebp
pushal
jecxz 0x58c2c4
adc ebx, esi
pop eax
dec eax
loope 0x58c2ee
pushfd
out 0x8a, eax
xchg ecx, eax
fstp dword [edi + 0x41aac5f9]
stosb byte es:[edi], al
lodsb al, byte [esi]
cmp dword [ebp - 0x63], ebx
invalid
Function at 0x58e3ef
Capabilities:
Encode data using xor

Disassembly:
js 0x58e409
stc
jae 0x58e3a8
outsd dx, dword [esi]
sub byte [ecx], 0x59
adc al, 0x29
rcr ebp, 1
invalid
push es
cwde
dec ebx
iretd
stosb byte es:[edi], al
je 0x58e3a8
enter 0x8fb, 0xffffffffffffffde
ror dword [eax + ebx*4], 0xa0
dec edx
loop 0x58e44b
mov edi, 0xffa1234
stosd dword es:[edi], eax
out dx, eax
popfd
adc ebp, dword [esi + 0x39f5ba2a]
mov ebp, 0x1432c88
cmc
cmp dword [ebp + 0x1432c88], edi
mov eax, dword [0x5d8d075d]
inc ecx
push eax
ror byte [edi], 0xd7
pcmpgtb mm2, mm0
loop 0x58e3b8
xor eax, 0x50d18bc5
scasb al, byte es:[edi]
rcl dword [eax - 0x52]
test byte [edx - 0x23], 0x3b
scasd eax, dword es:[edi]
fcomp dword [ebp + ecx*2 + 0x65]
push cs
push edi
and al, 0x3f
fnstsw word [ebx - 0x41]
popal
stosb byte es:[edi], al
cld
pop esp
mov dh, 0x12
push ecx
mov ebx, gs
enter 0xffffffffffffc4e2, 0xffffffffffffffef
xor ecx, esp
jns 0x58e423
push ebx
xor ebx, dword [ebx]
sbb edx, dword [edi + 0x49]
push edi
dec ecx
push ds
mov edx, 0x8dce521f
rol dword [edx - 0x13], 1
add cl, ch
adc eax, 0x77a820e8
sub eax, dword [eax]
cwde
mov ebx, 0x182bbe3
jmp 0xb08a1051

Function at 0x5bbbed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0x2c
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x30
push 0
push eax
mov edi, ecx
call fcn.005dacbe
mov eax, dword [ebp + 0x14]
add esp, 0xc
mov ecx, dword [edi + 0x9d0]
xor esi, esi
mov dword [ebp - 4], ecx
push 8
pop ebx
push 1
pop edx
sub eax, 0x200
jne 0x5fb819
push 0x40
pop esi
push 0xfffffffffffffff5
mov ecx, edi
call fcn.005bbc4a
test dword [edi + 0xc], esi
jne 0x5fb8e2
pop edi
pop esi
pop ebx
leave
ret 0x10
invalid
xor ch, cl
outsb dx, byte [esi]
jnp 0x5fb85b
test dword [edi + edx*4], edi
mov edi, 0xc6b3bd41
mov cl, 0xb5
jns 0x5fb83a
jle 0x5fb893
scasd eax, dword es:[edi]
xor byte [edi + edx*4 + 0x6233f514], dl
mov bl, 0xce
jp 0x5fb809
mov dh, 0x8e
inc ebx
jae 0x5fb818
push ebx
dec ebx
clc
mov dword [0xba91b2e8], eax
jecxz 0x5fb878
xor eax, 0x5934074
inc edi
out dx, al
adc bh, al
inc eax
nop
pop fs
pop ds
inc ecx
cmp ebx, dword [esi]
mov eax, dword [0x7d75af29]
in al, dx
push es
inc ebp
out 0x83, al
invalid
out 0xf9, eax
Function at 0x5bcc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [fcn.0049c864]
test eax, eax
js 0x5bcc58
push edi
push 0
push 0x49cbb8
push 0xa
push dword [esi + 0xc]
call dword [fcn.0049c27c]
mov edi, eax
test edi, edi
jne 0x5fbf38
pop edi
pop esi
pop ebx
leave
ret
loop 0x5fbeea
dec ebp
pop esi
inc ebp
xor edx, esp
je 0x5fbfba
arpl cx, sp
push ecx
in al, dx
nop
movsd dword es:[edi], dword [esi]
sbb ecx, dword [edi - 0xc3f3fd0]
lock and edi, dword [edi - 0xfc9e983]
or eax, 0xead64ebf
pushal
scasd eax, dword es:[edi]
xor eax, 0x4f5e005f
push cs
and eax, dword [edi]
pop es
in eax, dx
xlatb
loopne 0x5fbf5a
mov cl, 0xa1
push 0x8f5942e
mov ah, 0x96
jl 0x5fbf62
xchg edi, eax
shr dword [eax], 0xe0
aaa
add al, 0xa5
sub ebx, dword [edx + 0x523d6c10]
mov ebp, 0xadac4f28
lodsd eax, dword [esi]
in al, 7
add byte [esi + ecx*8 - 0x5b73e95b], dl
invalid
sub ebp, dword ss:[ecx - 0x3b058b92]
xchg edx, eax
push cs
invalid
outsb dx, byte [esi]
je 0x5fbfb7
les edx, [edx + 0x3a2b8f0e]
mov ch, 0xd9
nop
sal dword [ebx + 0x47546b6], 0x97
inc eax
adc cl, dh
and edx, edx
mov dword [0x46b53a00], eax
invalid

Function at 0x5bf2ba
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x5bf2e2
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x5bf2d4
pop edi
pop esi
pop ebp
ret 4

Function at 0x5c2185
Capabilities:
Encode data using xor

Disassembly:
pop ds
test al, 0x82
ror ecx, 1
rcr ebp, 0xfb
div bh
xor byte [esi + 0x49], dl
adc eax, 0x68502114
and dword [ebp + 0x7ce0b474], ecx
das
bound esi, qword [eax - 0x64]
mov ss, esp
adc byte [ecx + eax], 0x11
pop es
ror dword [eax - 0x3f32363b], 1
adc dword [edi + 0x1542c5d0], ebp
xor ebx, esi
rcl dword [edi + 0x4b], 0x44
enter 0xffffffffffffd990, 0x68
imul ebp, edx, 0x1a
push ss
sahf
adc byte [esi + 0x452143fe], dh
cmpsb byte [esi], byte es:[edi]
inc byte [ebx + 0x21]
inc ebp
cmpsb byte [esi], byte es:[edi]
inc byte [ebx + 0x21]
inc ebp
lodsb al, byte [esi]
fucomi st(5)
dec esp
mov al, 0x84
push esi
rcr dword [ebx - 0x6eb7163f], 1
push esi
or byte [ecx], cl
and word [edi + 0x2e], 0x2d
aad 0x10
inc edi
ror cl, 0xa0
inc ecx
out 0x64, eax
in al, 0xe5
and bl, byte [ecx + 0x200443a5]
mov al, byte [0x23cc5980]
sub dword [edi + 0x13210f05], 0x90710a2e
je 0x5c2145
cmc
adc byte [esi], bl
inc ebx
fcmovbe st(0), st(2)
adc ah, byte [ebx + 0x48e0020e]
mov dword [0x48e0020e], eax
fist dword [esi]
sub eax, 0x41517704
cmp esp, dword gs:[edi - 0x5f]
out dx, eax
pushal
loop 0x5c2241
inc ecx
adc dword [ecx], edx
stosd dword es:[edi], eax
fld st(4)
xor dword [eax], esp
jne 0x5c21ca
xchg edi, eax
enter 0xffffffffffffc4e5, 0x77
stc
sub eax, 0xf7e6484
push es
push edx
push 0xda05fb40
adc byte [ebp + 8], 0xe3
push eax
mov ebp, 0xdce8a1d0
adc byte [edi + 0x12707618], dl
adc cl, dl
popfd
Function at 0x5c2631
Capabilities:
Encode data using xor

Disassembly:
add dword [edi], esp
daa
xor dword [ebp - 0x50], edi
aam 0xb8
sub dword [eax - 1], edx
cmp dword [edi + 0x60], 0x806b0665
arpl word [eax - 0x67192f67], cx
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
pushfd
jno 0x5c2632
jo 0x5c267d
ret 0x1e31
pushal
adc dh, byte [edi]
add byte [eax + 0x10d19bd2], al
lodsd eax, dword [esi]
int1
int1
cmp al, 0xeb
dec ebp
out 0x96, eax
test eax, 0xc8c1fc62
xor edi, dword [esi + 0x5696c212]
dec eax
jno 0x5c2704
rcr dword [esi - 0x2b], 0x62
mul byte [eax + esi*8 - 0x2c7f4d17]
jo 0x5c26c6
adc byte [edx], cl
enter 0xffffffffffff8271, 0xffffffffffffffe9
jo 0x5c272b
je 0x5c26c0
mov edi, 0xcda1dfe3
pop ebp
fdivr qword [esi + 0x49]
jo 0x5c2727
dec esi
push 0xffffffffffffff92
xchg edx, eax
shl byte [edx + 0x1f], cl
push ebx
or ebp, dword [eax]
sub al, 0x20
xor eax, 0xbe3a4521
inc ebp
bound edi, qword [0xf1f30d00]
jg 0x5c26f9
aas
iretd
mov bl, 0x90
sbb ah, dh
adc byte [edx], dl
shr dword [edi], cl
xchg esp, eax
jecxz 0x5c2688
dec ebx
invalid
or dword [eax + edi + 0x6f], esi
mov dl, 0xfa
loopne 0x5c2762
xor eax, 0xc099e369
arpl word [edx], dx
ror byte [eax + eax*8 + 0x1d141e9], cl
ja 0x5c26de
cdq
shl byte [ebx + 0x12], 0xd2
mov eax, es
jmp 0x775df851
call [ebp - 0x53d9ae16]
add ecx, 0x49
mov byte [eax + esi*2], dh
pushal
out 0x95, eax
cmp eax, 0xa1771153
cmpsd dword [esi], dword es:[edi]
fcmovbe st(0), st(1)
jno 0x5c2778
push edx
or esp, edi
hlt
out 0x1f, eax
pop ds
pop ecx
ret 0x6fa6
xchg ecx, eax
inc eax
lodsb al, byte [esi]
push eax
jnp 0x5c2763
in al, dx
dec ebx
or ecx, esi
mov ebp, 0xbef44f04
invalid

Function at 0x5c398e
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x31cb10ec]
adc byte [esi], cl
adc dword [0x3c01759f], 0x4c
adc eax, 0x3c01759f
dec esp
imul edx, dword [ecx - 0x1d], 0x4bd45170
lcall 0xacd, 0xf96aabf5
fst qword [ebx]
xor eax, 0xdbca2a1
mov byte [0x30800dbc], al
or al, 0x32
push eax
cmp eax, 0x70944d30
insd dword es:[edi], dx
mov byte [0x30800dbc], al
or al, 0x32
push eax
cmp eax, 0x70944d30
insd dword es:[edi], dx
push ebx
cmp eax, 0x4b4ad607
xchg ebp, eax
nop
mov cl, ah
xchg edi, eax
or cl, 0xc2
bnd jecxz 0x5c3976
pushal
jno 0x5c3a05
inc edx
jne 0x5c39e6
shr dword [esi], 0x33
push ebp
and al, byte [ebx + eax]
jno 0x5c396e
mov ecx, 0x197f0360
pop ss
insb byte es:[edi], dx
mov cl, 0xf6
mov ebx, 0x3028339a
mov ch, 0x51
scasb al, byte es:[edi]
and bl, byte [ebx]
in al, dx
add ah, bh
push 0x26
stc
bound edi, qword [edx]
and dword [esi + 0x768777], eax
cmp byte [edx + 0x59ace178], dl
pop ecx
dec esi
pop eax
popal
sub esi, dword [edx - 0x66]
pop edx
test al, 0xde
call [edx]
pushal
mov cl, 0xe6
outsd dx, dword [esi]
sti
adc dl, 0xca
sal dword [esi - 0x3249de78], cl
dec edi
test dword [eax], ebx
cmp edi, 0xc21191a0
in eax, dx
rcr ch, cl
arpl word [esp + esi*8 + 0x1ca68913], si
mov ch, 0x22
sbb al, 0x93
ljmp 0xf44d
jmp dword [eax - 0x123dee6f]
ret 0xd2ed
Function at 0x5d8792
Capabilities:
Encode data using xor

Disassembly:
push eax
jmp 0x17b35f4d
sub eax, 0x8599293b
std
inc ecx
inc esi
adc al, 0xc1
test eax, 0x86fe80cf
lds esi, [edi + 0x39]
push cs
xchg esp, eax
xchg ecx, eax
call 0x306ce2c7
sbb al, 0xb0
sar edi, 1
loope 0x5d87d2
adc al, byte [esi + 0x31]
jnp 0x5d876e
aam 0xe3
inc esp
shl esi, 1
pop ebx
inc eax
stosd dword es:[edi], eax
jecxz 0x5d8823
clc
stosb byte es:[edi], al
retf 0x8120
mov esp, 0xc02e1ef
dec ebp
xor eax, 0x1afba4
and dword [ecx - 0x1bc23c81], esi
adc al, 0xc
xchg ebx, eax
in al, 0x14
or al, 0x93
xor dword [edi], 0x39c7c0d9
dec ebp
push eax
inc ebx
in eax, 0x2a
jbe 0x5d87e2
xor dword [ebp - 0x68], eax
arpl word [eax + 0x9a04154], bp
adc dword [esi + 0x25], 0x9327d595
dec ebp
xchg esp, eax
mov eax, dword [0x842750e0]
dec esp
pop ds
ucomiss xmm6, dword [eax + 0x1e7e3422]
xchg byte [ecx + 0x15], dl
and esi, dword [ecx - 0x4f9a3235]
mov edi, 0x21a7f194
iretd
in al, 0xf2
inc esp
mov eax, dword [0xb9862316]
in eax, dx
mov dword [0x6922ceba], eax
or dword [edx - 0x2eaaebed], eax
mov ch, 0xbb
and al, 0x2f
add byte [edx + 0x70ce7b97], bh
int 0x87
out dx, al
int3

Function at 0x5e7242
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx], bl
mov dword [0xd0825f60], eax
inc edx
xor bh, byte [eax]
pop eax
movsb byte es:[edi], byte [esi]
pushal
pop es
or ch, bh
and dword [ecx], esi
mov byte [0xd780990f], al
pop ecx
push ecx
lodsb al, byte [esi]
pop eax
mov dword gs:[esi + 0x31244f70], edi
mov ch, 0xa3
fisttp word [eax + 0x6f8c6d02]
out 0xf1, eax
nop
and ebp, ecx
add eax, 0xdef2eb5b
je 0x5e72ca
pop esp
add al, 0x47
mov cl, 0x5c
and al, 0x75
jmp dword [ecx - 0x2ad736b]
mul dword [edx - 0x39]
rcl ecx, 0x10
adc dl, byte [0xa5e0110f]
out 0x53, al
lodsd eax, dword [esi]
scasb al, byte es:[edi]
loope 0x5e730f
shl byte [ecx - 0x45], 0xab
jg 0x5e72ca
stosd dword es:[edi], eax
enter 0x4ec1, 0xffffffffffffff8e
pop ds
ror dword [esi - 0x72], 0x1f
xor byte [edx], bl
loopne 0x5e72e6
cmp bl, 0xd5
add byte [esi + edx - 0x5e6cd934], dh
hlt
ret

Function at 0x60383c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x164]
cmp dword [edi], ebx
jne 0x603872
lea ecx, [esi + 0x17c]
call fcn.006037e3
lea edi, [esi + 0x170]
cmp dword [edi], ebx
jne 0x60387b
cmp dword [esi + 0x18c], ebx
jne 0x6446ab
pop edi
pop esi
pop ebx
ret
mov ecx, edi
call fcn.00604854
jmp 0x603849
mov ecx, edi
call 0x68761f
jmp 0x60385e
stosb byte es:[edi], al
pop ds
fsubr dword cs:[ebx]
adc eax, eax
mov ebp, 0xd95d9ecb
add eax, 0x6e2f4394
Function at 0x6057d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 8], eax
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], edi
lea edx, [edi - 1]
test edi, edi
je 0x60583d
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [ebp - 4], eax
xor ebx, ebx
xor ecx, ecx
test ax, ax
je 0x605834
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov eax, dword [eax]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, ax
cmp word [ebp - 0xc], ax
je 0x605842
inc ebx
movzx eax, word [edi + ebx*2]
test ax, ax
jne 0x605819
mov edi, dword [ebp - 0x10]
test ecx, ecx
jne 0x645355
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret 4
or eax, 0xffffffff
jmp 0x605836
inc ecx
jmp 0x60581f
pop es
fdivr dword [ebx]
test eax, 0xf07339f6
adc eax, 0x7f7c45d3
mov edi, 0x7b205027
sub bh, cl
in eax, 0xa8
inc ecx
pop ecx
cmpsb byte es:[esi], byte es:[edi]
fbstp tbyte [eax - 0x4361b8c6]
aam 0xaf
scasd eax, dword es:[edi]
mov al, byte [0xb855520a]
jg 0x6452dc
sub al, 0xfe
jp 0x64537d
fadd dword [eax - 0x62]
mov al, 0xa1
cwde
test eax, 0x1c9032d6
pushfd
jmp 0x982efce4
leave
cmp bh, bh
mov esp, 0x66566024
xchg ecx, eax
xchg esi, eax
in eax, 0x46
das
or al, 0x1c
xchg esi, eax
aad 0xd0
into
push 0xfffffffffffffff7
or dword [eax - 0x30], 0xf
adc eax, 0xfbb2800c
pop ecx
lodsd eax, dword [esi]
lodsd eax, dword [esi]
fisubr dword [edx]
sub byte [edi - 0x18], bl
add eax, 0x10fb6945
add byte [edi], 0x3a
sbb al, ah
test eax, 0x99638780
adc bl, ah
cmp bh, al
dec eax
test dword [ebx], edx
test eax, 0x151ddf37
push ebx
or dword [eax + 0x2b], ecx
jae 0x6452fe
insb byte es:[edi], dx
adc dword [edx - 0x34], esi
xor ebx, dword [ecx]
and byte [edx + 0x37d4a4b4], bl
sbb eax, 0xc0c3769d
stc
mov dh, 1
mov esi, 0x9e09818e
out 0x50, al
adc esi, edx
outsb dx, byte [esi]
or dword [ecx], 0x1350e69e
repne outsb dx, byte [esi]
sti
aaa
bound ebx, qword [eax]
scasb al, byte es:[edi]
cmp dh, byte [ebx - 0x37]
jle 0x645320
wait
faddp st(4)
sbb dword [edx + 0x36612620], esi
or ecx, dword [esi]
mov gs, word [eax + 0xc]
out dx, al
retf

Function at 0x60894a
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x608972
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x608964
pop edi
pop esi
pop ebp
ret 4
Function at 0x64d92d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656388
cmp edx, dword [eax]
je 0x64d94f
add eax, 8
inc ecx
cmp eax, 0x656418
jl 0x64d940
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656388]
jne 0x64da7d
mov eax, dword [0xa59ce0]
cmp eax, 1
je 0x64da57
test eax, eax
jne 0x64d980
cmp dword [0x6562b4], 1
je 0x64da57
cmp edx, 0xfc
je 0x64da7d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d9b7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e310
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e7a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d9fa
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e7a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652abc
push edi
call fcn.00650670
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064e310
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064e320
lea eax, [ebp - 0xa0]
push 0x652a9c
push eax
call fcn.0064e320
push dword [esi + 0x65638c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064e320
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.006505e4
add esp, 0x2c
pop edi
jmp 0x64da7d
lea eax, [ebp + 8]
lea esi, [esi + 0x65638c]
push 0
push eax
push dword [esi]
call fcn.0064e7a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret