joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432978
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x453b10]
cmp dword [eax + 0x30], 0
je 0x432a22
cmp dword [ebx + 0x94], 0
jne 0x432a1c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x432908
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x432a1c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4329e2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x432a1c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413df0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4329f1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x433580
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4335b5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004044e0
jmp 0x4335c2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404444
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x434550
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x434591
mov eax, esi
call fcn.004484d0
test al, al
je 0x434591
mov eax, dword [ebx + 0x84]
call fcn.00448270
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x434591
push 0
mov eax, dword [ebx + 0x84]
call fcn.00448270
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4374d0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004043f0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43751f
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404660
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f70c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x453b90], 0
je 0x43f85b
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x45277c]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x43f85b
mov eax, dword [0x453b94]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x453b90]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43f82a
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x453b90]
call fcn.00413df0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43f822
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x43f822
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43f822
mov eax, dword [ebp - 0x14]
call fcn.00448270
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43f822
push ebp
call fcn.0043f6c8
pop ecx
test al, al
jne 0x43f822
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x43f7de
mov eax, dword [ebp - 0x14]
call fcn.00446da0
dec eax
jle 0x43f822
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403884
cmp byte [ebp - 1], 0
je 0x43f822
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43f822
mov edx, dword [ebp - 0x14]
mov eax, dword [0x453b94]
call fcn.0043ee94
inc edi
dec ebx
jne 0x43f771
mov eax, dword [0x453b94]
cmp dword [eax + 8], 0
jle 0x43f842
mov eax, dword [0x453b94]
call fcn.0043ef24
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43f85b
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043f530
pop ecx
test al, al
jne 0x43f85b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442df4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x442e40
mov eax, esi
call fcn.0042acc4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x442e40
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x442e40
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x442f7f
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x442e80
cmp eax, 0x108
ja 0x442e80
mov eax, esi
call fcn.0042acc4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x442f76
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x442f7f
jmp 0x442f76
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x442f5f
cmp eax, 0x20a
ja 0x442f5f
test byte [esi + 0x50], 0x80
jne 0x442eb2
sub eax, 0x203
je 0x442eaf
sub eax, 3
je 0x442eaf
sub eax, 3
jne 0x442eb2
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x442ec6
dec eax
je 0x442edb
dec eax
je 0x442ef8
dec eax
je 0x442edb
jmp 0x442eff
mov ecx, ebx
mov eax, dword [0x45277c]
mov eax, dword [eax]
mov edx, esi
call fcn.00434408
jmp 0x442f76
cmp byte [esi + 0x5d], 1
jne 0x442ef1
mov eax, esi
mov si, 0xffed
call fcn.00403884
jmp 0x442f7f
or word [esi + 0x54], 1
jmp 0x442f76
and word [esi + 0x54], 0xfffe
jmp 0x442f76
mov eax, dword [0x453b4c]
cmp byte [eax + 0x20], 0
je 0x442f76
mov eax, dword [0x453b4c]
cmp dword [eax + 0x1c], 0
je 0x442f76
mov eax, dword [ebx]
mov edx, dword [0x453b4c]
cmp eax, dword [edx + 0x1c]
jne 0x442f76
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0042ac08
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403884
jmp 0x442f7f
cmp eax, 0xb00b
jne 0x442f76
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0044175c
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446400
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x44641c
cmp dword [esi + 4], 0
je 0x446449
test byte [ebx + 0x55], 1
jne 0x44643b
mov eax, ebx
call fcn.0044500c
test eax, eax
jne 0x44643b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x446559
mov edx, esi
mov eax, ebx
call fcn.00445f24
jmp 0x446559
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x446552
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00448270
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00442d28
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00446400
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00448270
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446559
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c968
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x452954]
cmp byte [eax + 0xc], 0
je 0x44cad5
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44cace
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x453ba0], 0
jne 0x44c9bc
push 0x44cadc
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44cae4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453ba0], eax
cmp dword [0x451d24], 0
jne 0x44cab7
push 0x44caf4
call sub.kernel32.dll_LoadLibraryA
mov dword [0x451d24], eax
cmp dword [0x451d24], 0
je 0x44cab7
push 0x44cb00
mov eax, dword [0x451d24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453ba4], eax
push 0x44cb10
mov eax, dword [0x451d24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453ba8], eax
push 0x44cb24
mov eax, dword [0x451d24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453bac], eax
push 0x44cb3c
mov eax, dword [0x451d24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453bb0], eax
push 0x44cb54
mov eax, dword [0x451d24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453bb4], eax
push 0x44cb68
mov eax, dword [0x451d24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453bb8], eax
push 0x44cb80
mov eax, dword [0x451d24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453bbc], eax
push 0x44cb98
mov eax, dword [0x451d24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453bc0], eax
push 0x44cbb4
mov eax, dword [0x451d24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453bc4], eax
push 0x44cbc0
mov eax, dword [0x451d24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x453bc8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44cad5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x44ebec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44ed6c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403094
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x4523cc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4523d0], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4523d4], eax
mov eax, dword [0x452944]
cmp dword [eax], 2
sete byte [0x451fac]
push 0x44ed78
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.0044f0e4
cmp byte [0x451fac], 0
jne 0x44ec78
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0044f114
test al, al
je 0x44ec78
mov eax, dword [ebp - 0x4c]
mov dword [0x453c38], eax
jmp 0x44ec7f
xor eax, eax
mov dword [0x453c38], eax
call fcn.0044ea84
and eax, 0x7f
cmp eax, 0xc
ja case.0x44ec90.0
jmp dword [eax*4 + 0x44ec97]
mov byte [0x451f98], 1
jmp case.0x44ec90.0
mov byte [0x451f9c], 1
jmp case.0x44ec90.0
mov byte [0x451fa0], 1
jmp case.0x44ec90.0
mov byte [0x451fa4], 1
jmp case.0x44ec90.0
mov byte [0x451fa8], 1
jmp case.0x44ec90.0
mov byte [0x451fb0], 1
mov byte [0x451fb4], 1
jmp case.0x44ec90.0
mov byte [0x451fb0], 1
mov byte [0x451fb8], 1
jmp case.0x44ec90.0
mov byte [0x451fb0], 1
mov byte [0x451fb8], 1
mov byte [0x451fbc], 1
jmp case.0x44ec90.0
mov byte [0x451fc0], 1
jmp case.0x44ec90.0
mov byte [0x451fc4], 1
jmp case.0x44ec90.0
mov byte [0x451fc8], 1
jmp case.0x44ec90.0
mov byte [0x451fcc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ed73
lea eax, [ebp - 4]
call fcn.004043f0
ret

Function at 0x44f114
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x44f1bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.004048b0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x44f1a5
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404a3c
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.004048b0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x44f1a5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x44f1cc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x44f1a5
cmp dword [ebp - 8], 0x34
jne 0x44f1a5
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f1c2
lea eax, [ebp - 0x10]
call fcn.004043f0
ret
Function at 0x402040
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408048
call sym._EnterCriticalSection_4
mov ebx, dword [0x408040]
sub esp, 4
test ebx, ebx
je 0x40208b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402084
test esi, esi
je 0x402084
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402060
mov dword [esp], 0x408048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402270
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4022c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402398
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4022fe
cmp eax, 4
jne 0x402320
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40230e
cmp edx, 4
je 0x40230e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402270
Function at 0x45c51e
Capabilities:
Encode data using xor

Disassembly:
push ds
std
out 0xcd, al
push edi
scasd eax, dword es:[edi]
xchg esp, eax
pushfd
mov byte [esi - 0x69], bl
pop ecx
add ah, byte ds:[ecx + 0x1ffe9ae4]
pop ds
mov ah, 0xa1
mov edi, fs
invalid

Function at 0x533ebe
Capabilities:
Encode data using xor

Disassembly:
invalid
xchg esi, eax
jnp 0x533eee
add dword gs:[0xdbaca83a], 0xc7a0ff0e
adc bl, byte gs:[esp + edi*4 - 0x50e7bd85]
add eax, 0xdbaca83a
push cs
jmp dword [eax - 0x63ed9a39]
wait
lea ebx, [edx + 0x75]
invalid
leave
sub eax, 0xfc3d3d90
cli
rcr dword [ecx + 0x6e7aaee9], 1
adc ebx, dword [edx]
sbb byte [edi + 0x2a], ch
ja 0x533ea4
jp 0x533f60
push ds
dec edi
mov bl, 0x11
dec edx
das
cmp eax, 0xfce69757
lodsb al, byte [esi]
out 0xf9, al
jnp 0x533e9d
pop esp
shr dword [eax + 0x66abcced], 1
shl dword [ebx + 0xa73daf3], 1
fidiv dword [ebx + 0xa]
ror dword [ecx], 1
jne 0x533f3e
invalid
adc ecx, edi
jns 0x533ee1
loop 0x533ec4
jge 0x533f0a
push 0x7e
mov byte [ecx + 0x28], 0xca
lahf
cld
pavgw mm7, qword [edi - 0x5ef92059]
or dword [eax - 0x58ab75d], edi
mov ah, 3
imul esp, dword [eax + 0x16bce337], 0x5abb6a5f
aaa
jecxz 0x533f1f
push ss
pop edi
push 0xffffffffffffffbb
pop edx
and esp, dword [ebp - 0x3f0c7ab9]
add edi, dword [edx]
das
cdq
push ecx
xchg edx, eax
fnstcw word [edx]
lahf
pushfd
mov dl, 0xc2
xor esi, dword [eax - 0x159e6f6b]
jbe 0x533f5e
invalid

Function at 0x5647c9
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x35e35833
js 0x564848
sahf
invalid
cmp byte [esi - 0x4e], ch
cli
js 0x564813
bnd retf
retf
add dword [eax + 0x18bfccea], ebp
movsd dword es:[edi], dword [esi]
ja 0x564841
ja 0x564840
imul ebp, ebx, 0xb821f81b
pop ss
ficomp dword [eax]
invalid
mov byte [0x164292a6], al
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
inc edx
push ss
sub eax, ebp
xchg edi, eax
dec edi
inc ebx
xor esi, dword [ecx - 0x67fec28a]
or ecx, dword [ecx]
adc ah, dh
xchg ebx, eax
jb 0x564826
sti
and ebx, edx
jbe 0x56480c
adc edx, dword [ecx + edi + 0x1da67462]
test eax, 0xf5c3a533
mov bl, 0xa2
or eax, 0xe23ce36a
push 0xffffffffffffffe3
cmp al, 0xe2
pop esp
push esp
popal
inc edx
stosb byte es:[edi], al
cmp eax, 0x9194ed61
in eax, dx
xchg esp, eax
xchg ecx, eax
xor eax, 0x489bade0
mov bl, 0x19
jns 0x56486b
cli
les edx, [ebp + 0x23d157c2]
jno 0x56481b
mov esp, 0x3b92f8c9
clc
jne 0x564876
or edx, dword [ebx + 0x6f]
fistp dword [ecx - 0x5461de24]
add byte [edx], dh
lea ecx, [edx + 0x12983a2d]
push edx
pop edi
adc eax, 0xa24999d4
jp 0x564840
invalid

Function at 0x583c47
Capabilities:
Encode data using xor

Disassembly:
pop ecx
in al, 0xa9
or eax, 0x22dd30ed
xor bh, byte [edi + 0x2d]
jg 0x583c7f
inc eax
sbb eax, 0xcde00720
fist word [esi - 0x3dcdac73]
xor ch, cl
clc
stosb byte es:[edi], al
wait
outsb dx, byte [esi]
jo 0x583c50
add dh, cl
push cs
loop 0x583c86
sub ebp, edx
popal
cmp bl, bh
mov dword [0x26d1e931], eax
in al, 0x38
int1
ret
sbb al, 0x57
scasd eax, dword es:[edi]
invalid
push ds
cmpsb byte [esi], byte es:[edi]
cmp dword [edx + esi - 0x5b], ebx
inc ebp
xchg dx, ax
iretd
Function at 0x59ce33
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xe2
or esp, ebp
xchg esp, eax
adc byte [edi], bl
sti
add edi, esp
pop edx
pop ebp
inc esp
daa
mov ebp, 0x5da9614b
sbb eax, 0x945592c
stosd dword es:[edi], eax
or ebx, dword [ebp + 0x4afae445]
cli
dec edx
adc edi, dword [0xf26cdea0]
inc ecx
lcall 0x8c26, 0x1850e901
lds ebp, [ebp - 0x40]
in eax, dx
xor byte [ebp + 0x60], ch
push es
pop es
sub eax, 0x9d0e52aa
cld
loope 0x59ce50
retf

Function at 0x5b0b21
Capabilities:
Encode data using xor

Disassembly:
wait
xchg ebp, eax
mov edx, 0x116da1e4
invalid
jge 0x5b0ae3
popal
mov ebx, 0x1c8d1837
cmp eax, 0x1f96eb0d
pushal
or eax, 0x4db0f1d0
dec ebp
xor ch, bl
and ch, cl
nop
mov cl, 0x5d
lodsd eax, dword [esi]
mov esp, 0x5cedac5d
mov bh, 0x57
std
xor byte [0xf3604160], cl
inc eax
sub eax, 0x1208125
sal cl, 1
or dh, cl
jo 0x5b0b33
in al, dx
int 0xb0
cmp dword [ebp*8 + 0x42ac5db0], eax
pop esp
mov bh, 0x80
movsd dword es:[edi], dword [esi]
mov esp, 0xda41fd99
xor edx, ecx
xor dword [eax + 0x10c72c1d], esp
popal
sub byte [0x64af1f0], 0xbd
cmp eax, 0xfdb0344d
cmp cl, byte [ebp - 0x7e768ea4]
aam 0xed
and byte [ecx + 0x10], al
inc ecx
adc byte [esi], cl
sub cl, 0xad
adc edx, ebp
cmp byte [eax - 0x3126783], ch
ja 0x5b0bbe
and dword [eax + 0x1a6d80bd], edx
push ecx
mov eax, 0x827d908d
invalid
outsb dx, byte [esi]
sub al, ch
ror byte [ebp + ebp*2 - 0x50], 1
int 0xce
jne 0x5b0b59
sub ecx, eax
sal dword [eax], 1
sub eax, 0x35f0c4f4
cmp ch, ch
ror byte [ecx], 0x29
aad 0xe8
mov ebp, 0x58bcad8c
je 0x5b0c2d
invalid
sub al, 0xe4
mov ch, byte [edx]
out 0xdc, al
popfd
xchg ebx, eax
xchg ecx, eax
daa
adc al, 0x3c
loopne 0x5b0c3a
invalid

Function at 0x5b1ea6
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7dca7b13
jb 0x5b1e33
mov ebx, dword [esp + edi*8]
sbb al, 0xfc
cld
out dx, al
pop ebp
loope 0x5b1ea9
aas
out dx, eax
fisub word [ebx - 0x7fc31e3d]
lahf
outsb dx, byte [esi]
push eax
mov eax, 0xff8ca87f
pop edi
jne 0x5b1f11
and byte [eax], dl
loop 0x5b1ec3
xchg dword [ebx - 0x700e6743], edx
shr edi, cl
loop 0x5b1ea7
mov ebp, 0xcaae1a2c
invalid
movsb byte es:[edi], byte [esi]
pop ebp
shr ebp, 1
dec ebp
push cs
add eax, dword [esi - 9]
sub al, 0x33
xor al, dl
xor byte [ebx + 0x3c3422f0], al
sal byte [eax], 1
xor eax, 0x22
xor al, 0x3c
outsd dx, dword [esi]
mov dh, 0xd0
add byte [ecx], dl
jle 0x5b1f05
or dword [esi + 0x4d], esi
mov edx, 0xcf133f2b
mov dl, 0x8e
sub eax, 0xc72cd804
mov esi, 0x6e02d22b
pushal
invalid