joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424de0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5546f0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5cf97c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x56fd70
call fcn.005253fc
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0051082d
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43ce20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
mov ebx, ecx
je 0x43cf25
cmp dword [ebp + 0xc], 1
jl 0x43cf25
push esi
push edi
xor eax, eax
nop
mov byte [ebx + eax + 1], al
inc eax
cmp eax, 0x100
jl 0x43ce40
mov esi, dword [ebp + 8]
lea edi, [ebx + 1]
mov word [ebx + 0x201], 0
mov dword [ebp - 4], 0x100
nop dword [eax]
nop word [eax + eax]
movzx eax, byte [ebx + 0x201]
lea ecx, [ebx + 1]
mov dword [ebx + 0x204], edi
xor edx, edx
movzx eax, byte [eax + esi]
add al, byte [edi]
add byte [ebx + 0x202], al
movzx eax, byte [ebx + 0x202]
add ecx, eax
mov dword [ebx + 0x208], ecx
movzx eax, byte [edi]
mov byte [ebx + 0x20c], al
movzx eax, byte [ecx]
mov byte [edi], al
inc edi
mov ecx, dword [ebx + 0x208]
movzx eax, byte [ebx + 0x20c]
mov byte [ecx], al
movzx eax, byte [ebx + 0x201]
inc eax
div dword [ebp + 0xc]
sub dword [ebp - 4], 1
mov byte [ebx + 0x201], dl
jne 0x43ce70
lea eax, [ebx + 0x101]
lea esi, [ebx + 1]
test eax, eax
je 0x43cefe
test esi, esi
je 0x43ceee
mov ecx, 0x40
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x43cf0e
push 0x100
push 0
push eax
call fcn.005274c0
add esp, 0xc
call fcn.0052fe11
mov dword [eax], 0x16
call fcn.0052fd13
pop edi
pop esi
mov word [ebx + 0x201], 0
mov al, 1
mov byte [ebx], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43d0e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
test edx, edx
je 0x43d22e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43d22e
mov ecx, dword [ebp + 0x10]
cmp ecx, 1
jb 0x43d22e
cmp dword [esi + 0x218], 0
je 0x43d22e
cmp dword [esi + 0x21c], 0
je 0x43d22e
test ecx, ecx
jle 0x43d222
sub edx, eax
push ebx
mov dword [ebp + 8], edx
push edi
nop word [eax + eax]
mov ebx, dword [esi + 0x21c]
mov edx, ebx
mov ecx, dword [esi + 0x210]
mov edi, dword [esi + 0x218]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edx
test ecx, ecx
jle 0x43d1b3
nop dword [eax + eax]
mov ecx, esi
call fcn.0043cf30
mov byte [edi], al
lea edi, [edi + 1]
mov ecx, esi
call fcn.0043cf30
mov byte [ebx], al
lea ebx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ecx, dword [esi + 0x210]
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
cmp eax, ecx
jl 0x43d170
mov ebx, dword [esi + 0x21c]
mov edx, ebx
mov edi, dword [esi + 0x218]
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
dec ecx
mov eax, dword [ebp + 0xc]
mov al, byte [ebx + eax]
mov ebx, dword [esi + 0x214]
add edx, ebx
test ecx, ecx
jle 0x43d1f7
mov ecx, dword [ebp - 0x10]
sub ecx, ebx
sub ecx, dword [ebp - 8]
dec ecx
add ecx, edx
sub ebx, edx
lea esi, [ebx + edi]
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
sub al, byte [edx]
lea edx, [edx - 1]
xor al, byte [ebx + edx + 1]
dec ecx
test ecx, ecx
jg 0x43d1e2
mov ecx, dword [ebp - 4]
mov edx, edi
jmp 0x43d1fd
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
sub al, byte [ecx]
xor al, byte [esi + 0x221]
mov ecx, dword [ebp + 0xc]
xor al, byte [edx]
mov byte [ecx], al
inc ecx
xor byte [esi + 0x221], al
sub dword [ebp + 0x10], 1
mov dword [ebp + 0xc], ecx
jne 0x43d140
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43d240
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb0
mov eax, dword [0x5cf97c]
xor eax, esp
mov dword [esp + 0xac], eax
push esi
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
je 0x43d3ec
cmp edx, 1
jb 0x43d3ec
test edi, edi
je 0x43d3ec
push edx
push ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.0043d410
mov edx, dword [esp + 0x14]
mov ecx, 0x78
mov eax, dword [esp + 0x18]
mov dword [esp + 0xb4], edx
mov dword [esp + 0xb8], eax
mov eax, 0x38
shr edx, 3
and edx, 0x3f
sub eax, edx
sub ecx, edx
cmp edx, 0x38
cmovae eax, ecx
push eax
lea eax, [esp + 0x18]
push 0x5d1718
push eax
call fcn.0043d410
add esp, 0x18
lea eax, [esp + 0x22]
xor esi, esi
nop dword [eax]
movzx edx, byte [eax + 1]
lea eax, [eax + 4]
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 6]
shl edx, 8
or edx, ecx
mov dword [esp + esi*4 + 0x70], edx
inc esi
cmp esi, 0xe
jb 0x43d300
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0043d4d0
movzx eax, byte [esp + 0x18]
add esp, 8
mov byte [esp + 0x60], al
movzx eax, byte [esp + 0x11]
mov byte [esp + 0x61], al
movzx eax, byte [esp + 0x12]
mov byte [esp + 0x62], al
movzx eax, byte [esp + 0x13]
mov byte [esp + 0x63], al
movzx eax, byte [esp + 0x14]
mov byte [esp + 0x64], al
movzx eax, byte [esp + 0x15]
mov byte [esp + 0x65], al
movzx eax, byte [esp + 0x16]
mov byte [esp + 0x66], al
movzx eax, byte [esp + 0x17]
mov byte [esp + 0x67], al
movzx eax, byte [esp + 0x18]
mov byte [esp + 0x68], al
movzx eax, byte [esp + 0x19]
mov byte [esp + 0x69], al
movzx eax, byte [esp + 0x1a]
mov byte [esp + 0x6a], al
movzx eax, byte [esp + 0x1b]
mov byte [esp + 0x6b], al
movzx eax, byte [esp + 0x1c]
mov byte [esp + 0x6c], al
movzx eax, byte [esp + 0x1d]
mov byte [esp + 0x6d], al
movzx eax, byte [esp + 0x1e]
mov byte [esp + 0x6e], al
movzx eax, byte [esp + 0x1f]
mov byte [esp + 0x6f], al
xor eax, eax
movups xmm0, xmmword [esp + 0x60]
movups xmmword [edi], xmm0
pop edi
pop esi
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.005251e5
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xb4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.005251e5
mov esp, ebp
pop ebp
ret
Function at 0x441c60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556af4
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5cf97c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0
mov dword [esi], 0x58c88c
mov dword [esi + 0x78], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x70], 0x5747e4
mov dword [ebp - 4], 0
mov eax, dword [esi]
mov dword [ebp - 0x18], 1
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x5747ec
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ebx, dword [eax + 4]
add ebx, esi
mov ecx, ebx
call fcn.00421a50
mov eax, dword [ebx + 0x30]
lea edi, [esi + 0x10]
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], 0
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.00443560
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov edx, dword [edx + 0x20]
call edx
mov byte [ebp - 4], 1
mov ecx, esi
mov edx, dword [esi]
mov byte [ebp - 0xd], al
call dword [edx + 8]
test eax, eax
je 0x441d5f
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
cmp dword [ebx + 0x38], 0
mov al, byte [ebp - 0xd]
mov byte [ebx + 0x40], al
jne 0x441d7b
mov eax, dword [ebx + 0xc]
mov ecx, ebx
push 0
or eax, 4
push eax
call fcn.004219d0
mov dword [ebp - 4], 3
mov edx, dword [ebp - 0x14]
push 8
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], 0x58c898
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], edi
lea eax, [ecx - 0x70]
mov dword [ecx + edx - 4], eax
mov dword [edi], 0x57480c
call fcn.005253fc
mov esi, eax
push 1
mov byte [ebp - 4], 4
call fcn.0051082d
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x14]
lea edx, [edi + 8]
mov dword [ebp - 0x18], ebx
lea ecx, [eax + 0x28]
mov ebx, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x14]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx + 0x10], 0x57dce4
lea esi, [eax + 0x34]
mov byte [ebx + 0x58], 0
add eax, 0x38
mov byte [ebx + 0x4d], 0
mov ebx, dword [ebp - 0x18]
mov dword [edx + 0x1c], ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x3c], esi
mov ebx, dword [ebp - 0x18]
mov dword [edx], 0
mov edx, dword [ebp - 0x14]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [edx + 0x5c], 0
mov eax, dword [0x5dda30]
mov ecx, dword [0x5dda34]
mov dword [edx + 0x50], eax
mov eax, edx
mov dword [edx + 0x54], ecx
mov dword [edx + 0x48], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4427e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5546f0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5cf97c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x57480c
call fcn.005253fc
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0051082d
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477ed0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
inc eax
push ebx
dec eax
sub esp, 0x20
inc ebp
mov edx, eax
dec esp
mov ebx, edx
dec eax
mov ebx, ecx
dec eax
test edx, edx
je 0x47804f
inc ecx
cmp eax, 1
jl 0x47804f
dec esp
lea ecx, [ecx + 1]
dec eax
mov dword [esp + 0x30], edi
dec ecx
mov ecx, ecx
xor eax, eax
mov byte [ecx], al
dec eax
lea ecx, [ecx + 1]
inc eax
cmp eax, 0x100
jl 0x477f00
mov word [ebx + 0x201], 0
dec ebp
mov eax, ecx
mov edi, 0x100
movzx eax, byte [ebx + 0x201]
xor edx, edx
dec esp
mov dword [ebx + 0x208], eax
inc edx
movzx ecx, byte [eax + ebx]
inc ecx
add cl, byte [eax]
add byte [ebx + 0x202], cl
dec eax
lea ecx, [ebx + 1]
movzx eax, byte [ebx + 0x202]
dec eax
add ecx, eax
dec eax
mov dword [ebx + 0x210], ecx
inc ecx
movzx eax, byte [eax]
mov byte [ebx + 0x218], al
movzx eax, byte [ecx]
inc ecx
mov byte [eax], al
dec ecx
inc eax
movzx eax, byte [ebx + 0x218]
dec eax
mov ecx, dword [ebx + 0x210]
mov byte [ecx], al
movzx eax, byte [ebx + 0x201]
inc eax
inc ecx
div edx
mov byte [ebx + 0x201], dl
dec eax
sub edi, 1
jne 0x477f20
dec eax
mov edi, dword [esp + 0x30]
dec eax
lea ecx, [ebx + 0x101]
dec eax
test ecx, ecx
je 0x47802b
dec ebp
test ecx, ecx
je 0x47801e
mov eax, 2
dec eax
lea ecx, [ecx + 0x80]
inc ecx
movups xmm0, xmmword [ecx]
dec ebp
lea ecx, [ecx + 0x80]
movups xmmword [ecx - 0x80], xmm0
inc ecx
movups xmm1, xmmword [ecx - 0x70]
movups xmmword [ecx - 0x70], xmm1
inc ecx
movups xmm0, xmmword [ecx - 0x60]
movups xmmword [ecx - 0x60], xmm0
inc ecx
movups xmm1, xmmword [ecx - 0x50]
movups xmmword [ecx - 0x50], xmm1
inc ecx
movups xmm0, xmmword [ecx - 0x40]
movups xmmword [ecx - 0x40], xmm0
inc ecx
movups xmm1, xmmword [ecx - 0x30]
movups xmmword [ecx - 0x30], xmm1
inc ecx
movups xmm0, xmmword [ecx - 0x20]
movups xmmword [ecx - 0x20], xmm0
inc ecx
movups xmm1, xmmword [ecx - 0x10]
movups xmmword [ecx - 0x10], xmm1
dec eax
sub eax, 1
jne 0x477fb1
mov word [ebx + 0x201], ax
mov al, 1
mov byte [ebx], 1
dec eax
add esp, 0x20
pop ebx
ret
xor edx, edx
inc ecx
mov eax, 0x100
call fcn.00562af0
call 0x56f964
mov dword [eax], 0x16
call fcn.005672cc
mov al, 1
mov word [ebx + 0x201], 0
mov byte [ebx], 1
dec eax
add esp, 0x20
pop ebx
ret
xor al, al
dec eax
add esp, 0x20
pop ebx
ret
Function at 0x50ba50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x53796c
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x86600906
dec eax
add dword [ebp + 3], esp
add al, 2
add dword [0xc381a000], eax
xor byte [ecx], dl
push es
or ch, byte [edx]
xchg byte [eax - 0x7a], cl
test dword [0x4190901], 0x1020331
add dword [eax], esi
sbb dword [esi], eax
or dword [edx], ebp
xchg byte [eax - 0x7a], cl
test dword [0x31030901], 0x2b0a060c
add dword [ecx], ecx
add esi, dword [ecx]
or al, 6
or ch, byte [ebx]
add dword [ecx], ecx
add esi, dword [ecx]
or al, 6
or ch, byte [ebx]
push es
add dword [ecx + eax], eax
xor byte [edi], 2
add dword [eax + esi], eax
sbb al, 6
xor byte [esi + eax], bl
or ch, byte [ebx]
push es
add dword [ecx + eax], eax
xor byte [edi], 2
add dword [ebx], ecx
xor dword [esi], ecx
xor byte [esi + eax], cl
or ch, byte [ebx]
push es
add dword [ecx + eax], eax
xor byte [edi], 2
add dword [0x9062f30], edx
sub al, byte [esi + 0xdf78648]
add dword [ecx], ecx
add al, 0x31
and al, byte [eax]
cmp ebp, dword [ecx - 0x71]
sub edx, dword [edi]
jae 0x53797d
jge 0x53793e
xor bl, byte [edi + 0x1e87fe6b]
and edx, esi
dec edi
mov esp, 0x1ae6d1f8
test byte gs:[ecx + 0x73b11328], dh
jne 0x5379fd
inc esp
push es
or ch, byte [ebx]
push es
add dword [ecx + eax], eax
xor byte [edi], 2
add dword [ecx + esi], ecx
xor byte ss:[eax], dh
sbb byte [eax + 0x4d0016], al
arpl word [eax], ax
inc ecx
add byte [esi], ah
add byte gs:[ebp], ah
sub al, 0
add byte gs:[eax + eax], ch
and byte [eax], al
dec esp
add byte [eax + eax + 0x43], cl
mov eax, dword [0x68168018]
je 0x537a73
jo 0x537a3b
das
das
ja 0x537a7c
ja 0x537a35
insd dword es:[edi], dx
arpl word [ecx + 0x66], sp
arpl word cs:[edi + 0x6d], bp
and byte [eax], dh
or eax, 0x862a0906
dec eax
xchg bh, dh
or eax, 0x5010101
add byte [edx + eax*4], al
add dword [eax], eax
jb 0x5379ed
sbb ecx, dword [ebp - 0x5e2b2f94]
pop ebp
shr byte [ecx], cl
push edx
pop esp
add byte [edx], cl
jmp 0x537a30
cli
xchg ebx, eax
in eax, 2
mov cl, 0x6d
push eax
movsb byte es:[edi], byte [esi]
pop edi
sub eax, 0xb4409c8c
mov dh, 0xd7
lodsd eax, dword [esi]
js 0x537a80
invalid
mov ch, 8
pop edx
pop ebx
repne insb byte es:[edi], dx
sub cl, byte [ebx + 0x35]
cmp al, 1
fsub st(3), st(0)
cmp al, 0x66
jmp 0xddec526a
Function at 0x538ab1
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x862a0906
dec eax
xchg bh, dh
or eax, 0x5010101
add byte [ebx], al
add byte [edx], 0xf
add byte [eax], dh
add byte [edx], 0xa
add al, byte [edx - 0x6afffefe]
pop es
call 0xf9ba5483
in al, dx
adc al, 0xca
jnp 0x538a51
test dword [0x45b4f108], 0xb4822c0b
dec eax
invalid
xchg esi, ebp
dec ebp
cmp dl, byte [0x6664ed06]
or edx, dword [edx - 0x21bb3580]
jae 0x5389ed
dec esi
repe cmpsd dword [esi], dword es:[edi]
mov dword [edi + 0x4f], edi
js 0x538ac4
or al, cl
adc dl, byte [eax + 0x6d]
inc edx
das
dec ebp
mov ecx, 0x524d2879
sbb cl, byte [edx + 0x19b7801a]
or dword [esi], 0xbc8ac47e
dec esp
and dword [ebx + eax*2], ebx
push 0x8a3c3dd7
cmp al, 0x8a
in al, 0xf
jns 0x538a9f
jnp fcn.00538a9a
mov esp, 0x536dbb93
loop 0x538b02
jl 0x538a48
adc byte [edi], al
cmp bh, bh
mov dl, 0x77
popal
jle 0x538aa6
ljmp 0xf6a4:0xb4aa3c8c
mov dl, 0x39
in al, 0xac
and al, 0x36
mov bh, 0xf0
out dx, eax
mov dh, 0x1c
adc edx, dword [edi - 0x6d]
mov dh, 0xde
mov dl, 0xf8
loop 0x538a9c
mov bh, 0x73
mov byte [0x45aa35b8], al
loopne 0x538abe
mov eax, dword ss:[0xf18a546f]
jb 0x538b7f
push esi
outsb dx, byte [esi]
mov ch, al
push ecx
inc edx
inc esp
adc eax, 0xc5a3ee94
cmp byte [esi + 0x5a4e4e9b], dl
or eax, dword [edi - 0xd]
push es
dec ecx
ja 0x538b73
mov esp, 0xa6e53771
in al, dx
and dword [eax], ecx
jne 0x538b49
out 0x61, al
push ss
aas
ja 0x538b28
fst dword [ecx + 0x6c0a8497]
aam 2
dec ebp
je 0x538b1e
adc al, 0xed
std
cmp ebx, edi
xor edx, 0x5e
adc al, 0xa1
add al, 0xb0
or ebp, ecx
invalid
or byte [ebx + 0x6a096661], dh
mov cl, 6
cmp ah, byte [ebp - 0x6a]
pop ecx
sal al, 0x35
std
leave
fisubr dword [eax]
lea ebx, [edx]
adc dword [edi - 0x57f57e90], eax
lcall 0x586, 0x3a9e1d75
add byte [esi + 0x25d680db], bl
xchg dword [eax - 0x7f], esi
or ch, byte [eax - 0x61e28a66]
cmp al, byte [esi - 0x2461fffb]
adc dh, 0x25
stc
fadd qword [0x4c59279e]
jbe 0x538bdd
pop ebx
ljmp 0xf83
mov dh, 0xbf
mov word [ebx + 0xde913dc], ds
outsd dx, dword [esi]
mov eax, 0x6e67dc2e
leave
mov edx, dword [ecx]
mov ch, 0x84
adc al, 0x8a
add byte [ecx], bl
jo 0x538b79
jns 0x538b89
xchg edi, eax
xchg ecx, eax
aam 0x1a
daa
mov edi, 0x7321e37
fcom dword [ebx]
cmp al, 0x28
dec esp
scasd eax, dword es:[edi]
add al, byte [ebx]
add dword [eax], eax
add dword [ebx + 0x30260182], esp
add byte [ecx], 0x22
xor byte [esi], cl
push es
add edx, dword [ebp + 0x1d]
sgdt [ecx]
inc dword [esp + eax]
add eax, dword [edx]
add dword [esi], eax
xor byte [edi], cl
push es
add edx, dword [ebp + 0x1d]
adc eax, dword [ecx]
add edi, edi
add al, 5
xor byte [ebx], al
add dword [ecx], eax
push dword [eax]
sbb eax, 0x1d550306
push cs
add al, 0x16
add al, 0x14
scasb al, byte es:[edi]
insb byte es:[edi], dx
add eax, 0xe21393a3
mov byte [0x1cd7e2e7], al
salc
invalid
Function at 0x538f28
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
push ebx
imul esp, dword [edi + 0x6e], 0x22018230
xor byte [0x862a0906], cl
dec eax
xchg bh, dh
or eax, 0x5010101
add byte [ebx], al
add byte [ecx], 0xf
add byte [eax], dh
add byte [ecx], 0xa
add al, byte [edx - 0x33fffeff]
and eax, 0x6799076
nop
jns 0x538f5e
js 0x538f7c
push ss
cmc
rol byte [ebx + 0x28ca84b6], 0x9e
std
add eax, 0xadc51176
mov byte [edx - 4], dh
inc esi
add al, byte [ebx - 0x39]
mov dl, 0x8a
popfd
add al, 0x5f
and al, 0xcb
dec ebx
loope 0x538fdb
mov dh, 0x84
retf 0x9e28
add byte [esi - 0x1f], 0x52
inc esi
loope 0x538fd1
stosd dword es:[edi], eax
or al, 0x81
inc edi
jo 0x538ff1
frstor dword [ecx + edx*8 - 0x15]
shr ebx, 1
cmc
sub al, 0xa3
jb 0xae7e9bcf
xchg edi, eax
xlatb
mov dh, 0x14
xchg byte [eax], dl
jns 0x538f55
cmp edx, dword [ebx]
xor byte [edi - 0x74], 8
loope 0x538feb
shr byte [edx + 0x62], cl
das
pop ds
pop esi
cli
xchg esi, eax
push 0x952789df
cmp byte [edi - 0x36c128fa], bl
retf
cmpsb byte [esi], byte es:[edi]
sub dh, dh
imul edi, dword [ebx], 0x28c8cbf6
xchg ecx, eax
in eax, 0x9d
mov ah, byte [ecx + 0x57]
aaa
retf
lodsb al, byte [esi]
je 0x538ff2
fdiv qword [eax + 0x3a]
out dx, al
jb 0x539014
pushfd
sti
sar byte [ebx + 0x3df5bf], 1
loope 0x538ff6
mov edi, 0xe1003df5
push es
cmc
cmp eax, 0x3306e100
xor ebp, eax
call 0x5401bb78
sub byte [ebx], 0xae
push ebx
cmpsb byte [esi], byte es:[edi]
cmp dl, byte [esi]
jae 0x538f87
fld qword [ecx + 0xe]
and byte [edx], bh
sal byte [edi + 0x4fb2e9a1], 0x90
xor ah, byte cs:[eax - 0x17]
push edi
retf
cmp byte [esi], ah
pushal
jne 0x538fcb
lahf
ja 0x53901b
call dword [ecx + 0x20aeef14]
dec ecx
cld
xchg ecx, eax
adc al, 0xef
scasb al, byte es:[edi]
and byte [ecx - 4], cl
lodsd eax, dword [esi]
inc eax
adc eax, 0x3102d148
popal
sbb dword [esi - 0x48], ebx
xchg edi, eax
out dx, eax
lodsd eax, dword [esi]
ja 0x538fea
lcall 0xef13, 0xc15fbf7a
wait
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4012ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x403550
in al, dx
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00402671
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.004026a3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402658
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00402693
in eax, dx
mov byte [0x468a3a5], al
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid