joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407850
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
test edx, edx
je 0x407890
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 1]
cmp ecx, 0x3a
jne 0x407890
mov edx, dword [ebp + 8]
add edx, 2
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x4078a4
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x407923
push 0x5c
mov edx, dword [ebp + 8]
push edx
call fcn.00407800
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4078cf
cmp dword [ebp + 0xc], 0
jne 0x4078cd
jmp 0x407923
jmp 0x4078d5
mov eax, dword [ebp - 8]
mov byte [eax], 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x407904
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407904
cmp dword [ebp - 8], 0
je 0x407900
mov eax, dword [ebp - 8]
mov byte [eax], 0x5c
xor eax, eax
jmp 0x407928
cmp dword [ebp - 8], 0
jne 0x40790c
jmp 0x407923
mov ecx, dword [ebp - 8]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov dword [ebp + 8], eax
jmp 0x4078a4
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x407980
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test edx, edx
je 0x4079c0
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 2]
cmp ecx, 0x3a
jne 0x4079c0
mov edx, dword [ebp + 8]
add edx, 4
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x4079d4
mov edx, dword [ebp + 8]
add edx, 2
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x407a66
push 0x5c
mov edx, dword [ebp + 8]
push edx
call fcn.00407930
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x407a03
cmp dword [ebp + 0xc], 0
jne 0x407a01
jmp 0x407a66
jmp 0x407a0b
xor eax, eax
mov ecx, dword [ebp - 8]
mov word [ecx], ax
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407a3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407a3f
cmp dword [ebp - 8], 0
je 0x407a3b
mov ecx, 0x5c
mov edx, dword [ebp - 8]
mov word [edx], cx
xor eax, eax
jmp 0x407a6b
cmp dword [ebp - 8], 0
jne 0x407a47
jmp 0x407a66
mov eax, 0x5c
mov ecx, dword [ebp - 8]
mov word [ecx], ax
mov edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov dword [ebp + 8], eax
jmp 0x4079d4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4143fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42fe70]
jne 0x414405
repz ret
jmp fcn.00418817

Function at 0x41dff0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00418226
and dword [ebp - 4], 0
cmp dword [0x433a60], 0
mov ebx, eax
jne 0x41e0a1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41e152
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41e152
push eax
call fcn.004181b4
mov dword [esp], 0x427b60
push edi
mov dword [0x433a60], eax
call esi
push eax
call fcn.004181b4
mov dword [esp], 0x427b4c
push edi
mov dword [0x433a64], eax
call esi
push eax
call fcn.004181b4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x433a68], eax
call esi
push eax
call fcn.004181b4
pop ecx
mov dword [0x433a70], eax
test eax, eax
je 0x41e0a1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004181b4
pop ecx
mov dword [0x433a6c], eax
mov eax, dword [0x433a6c]
cmp eax, ebx
je 0x41e0f9
cmp dword [0x433a70], ebx
je 0x41e0f9
push eax
call fcn.0041822f
push dword [0x433a70]
mov esi, eax
call fcn.0041822f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41e0f9
test edi, edi
je 0x41e0f9
call esi
test eax, eax
je 0x41e0f0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41e0f0
test byte [ebp - 0xc], 1
jne 0x41e0f9
or dword [ebp + 0x10], 0x200000
jmp 0x41e132
mov eax, dword [0x433a64]
cmp eax, ebx
je 0x41e132
push eax
call fcn.0041822f
pop ecx
test eax, eax
je 0x41e132
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41e132
mov eax, dword [0x433a68]
cmp eax, ebx
je 0x41e132
push eax
call fcn.0041822f
pop ecx
test eax, eax
je 0x41e132
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433a60]
call fcn.0041822f
pop ecx
test eax, eax
je 0x41e152
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41e154
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x57188e
Capabilities:
Encode data using xor

Disassembly:
salc
out 0xba, al
int3
mov ah, 0x69
mov word [edx - 0x20], ds
cmp edi, dword [ecx]
xchg esp, eax
pop edi
mov esp, 0x125577bd
dec esp
sti
xor al, 0x99
imul ecx, dword [edx + ebx*2 - 0x6bc6c420], 0x77bdbc5f
push ebp
adc cl, byte [ebx + edi*8 + 0x34]
cdq
jns 0x571841
sahf
cli
jle 0x5717f6
mov bl, 0xb7
push cs
mov bh, 0xe
test dword [ebx], esi
movsb byte es:[edi], byte [esi]
jp 0x57185a
int3
sbb esi, ebp
mov ebp, edx
cmp edi, dword [esi - 0x41]
add dword [esi], ebp
sub eax, 0xc865a607
cmp ah, dl
aaa
fbld tbyte [edx + 0x7a]
or dword [ebx + edx*8 + 0x20], ebp
test eax, 0xf8e4788a
js 0x571874
clc
js 0x571874
clc
sbb ch, byte [edx + eax*8]
jecxz 0x571842
xlatb
rcr byte [ebx - 0x5ff86809], cl
fsubr qword [edi + 0x6d]
inc ecx
in al, dx
cmc
invalid

Function at 0x5bb33e
Capabilities:
Encode data using xor

Disassembly:
xor byte [edx + 0x6f], 0x96
outsd dx, dword [esi]
xchg esi, eax
mov al, 0xf7
or al, 0x9b
mov al, 0xd1
add edx, ebx
loop 0x5bb3a1
sbb eax, 0xe7df1893
mov ebx, 0xb219cca3
out dx, eax
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
xor byte [ecx - 0x7dbdf304], dl
xor byte [0x621097fc], al
movsd dword es:[edi], dword [esi]
sbb dword [edx + 0x30a697ef], esi
xchg ecx, eax
cld
or al, 0x42
xor byte [eax], 5
cld
xchg edi, eax
adc byte [edx - 0x5b], ah
ja 0x5bb354
push ebx
and esi, dword [edx + 0x43]
mov al, 0x56
xchg edx, eax
lds edi, [ebx]
dec ecx
dec esi
cmpsd dword [esi], dword es:[edi]
js 0x5bb340
and dword [ebx + 0x4e56ccd9], edx
push es
fadd st(2), st(0)
inc ebx
ljmp 0x9502
xchg esi, eax
mov bl, 0x79
out 0x34, eax
inc ebx
mov esi, dword [ebx + 0x5266b068]
xchg dl, dl
inc eax
mov dword [0x82723fa3], eax
push es
jecxz 0x5bb35c
xchg ebp, eax
sbb bl, byte [ebx - 0x73d97310]
cld
add al, 0xc3
leave
int3

Function at 0x605cce
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cdq
wait
lcall 0x51fb, 0x13a13a4a
outsb dx, byte [esi]
mov dword [edi - 0x67], edi
inc ebp
das
mov bl, 0xa6
iretd
aam 0x2d
xchg esi, eax
cmp dl, byte [edx + 0x5e9c0c58]
loope 0x605c74
xor byte [edi + 0x619d7c79], bh
rcr dword [ebx - 0x47], cl
aas
sbb dword [esi + ecx*8 + 0x59], ebp
rep outsd dx, dword gs:[esi]
lodsb al, byte [esi]
add bh, ah
cmp ebx, dword [ebx]
pop ds
sbb al, 0x76
fmul st(4)
xchg edi, edx
invalid
loopne 0x605d25
inc ebp
setl byte [ebp + 0x5a]
or eax, 0xc0ca7f71
pop edx
shr dword [eax], 0x99
scasd eax, dword es:[edi]
mov bh, byte [ebp + 0x6f]
in eax, 0x78
test al, 0xb9
xor byte [ecx + 0x157bb80e], ch
inc edi
jns 0x605d08
leave
inc ebp
scasd eax, dword es:[edi]
leave
add ebx, dword [ebp + 0xc657dca]
sbb dword [ecx + ebx], ebp
mov dword [ebx], edx
jnp 0x605d6c
add dl, bl
pop ds
xchg byte [esi - 0x1163503a], bl
pushfd
out dx, al
dec esi
imul ecx, ecx, 0x198f2801
clc
into
cmp eax, 0xfa06b30c
jecxz 0x605c9b
pop ecx
imul byte [ebx]
inc esp
sub ebp, dword [edi]
lodsd eax, dword [esi]
sbb dword [ecx + 0xb6c632e], edi
adc al, 0x8b
insb byte es:[edi], dx
or edx, dword [ebx + ecx*4]
and dword [eax - 0x6ca31ef9], ebp
mov dword [ebx], ecx
invalid
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x401443
pop dword [ebp - 0x4c]
mov eax, 0xd177dfb0
sub eax, 0xd137cb6d
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x9860b49
add dword [ebp - 0x5c], 0x44cc3a02
mov dword [ebp - 0x58], 0x7527934a
add dword [ebp - 0x58], 0xbd0bb8fb
mov dword [ebp - 0x54], 0x9d11bc20
sub dword [ebp - 0x54], 0x50c577f2
mov dword [ebp - 0x50], 0xa8cfa376
sub dword [ebp - 0x50], 0xa8cfa376
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xc7e5112f
sub eax, 0xc7a4902b
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xfcd5d782
add dword [ebp - 0x5c], 0x779c91d4
mov dword [ebp - 0x58], 0x5b5c6ab9
add dword [ebp - 0x58], 0xe60ff6bc
mov dword [ebp - 0x54], 0x3f1d1866
sub dword [ebp - 0x54], 0xdbadabfa
mov dword [ebp - 0x50], 0x26595b4c
add dword [ebp - 0x50], 0xd9a6a4b4
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3cbaa
push 0
call eax
mov ecx, 0x22fe728
sub ecx, 0x22f8d67
mov esi, eax
mov edx, 0x2d1ef7e8
add edx, 0xd327ec18
add edx, dword [ebp - 0x4c]
mov ebx, 0xae10a379
sub ebx, 0xe131c9ac
mov edi, dword [edx]
add edi, ebx
add dword [ebp - 0x18], ebx
mov dword [esi], edi
xor dword [ebp - 0x34], 0x319493b
add esi, 0x33ab29ea
add esi, 0xcc54d61a
add edx, 0x4879e05f
add edx, 0xb7861fa5
loop 0x401560
add eax, 0xa4b48c8f
sub eax, 0xa4b332b8
mov ebx, eax
add eax, 0xe9973864
add eax, 0x1668c7a1
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10005071
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push 0x50
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10005161
xor ecx, ecx
mov dword [esi + 8], 0x100151b0
mov dword [esi + 0xc], ecx
xor eax, eax
mov dword [esi + 0x10], ecx
inc eax
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 4], eax
mov dword [esi], 0x400
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x24], 7
mov dword [esi + 0x28], 0x100151b8
mov dword [esi + 0x20], 0x2000
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov ecx, 0x10003324
call 0x10020d47
test eax, eax
jne 0x1000514d
mov ecx, 0x1000333c
call 0x10020d47
test eax, eax
jne 0x1000514d
mov ecx, 0x10003354
call 0x10020d47
test eax, eax
jne 0x1000514d
mov ecx, 0x1000336c
call fcn.10004f40
test eax, eax
jne 0x1000514d
mov ecx, 0x1000337c
call fcn.10004f40
test eax, eax
jne 0x1000514d
mov ecx, 0x10003394
call fcn.10004f40
test eax, eax
je 0x10005136
or dword [esi + 0x44], 0x1000000
jmp 0x10005154
mov ecx, 0x100033b0
call fcn.10004f40
test eax, eax
je 0x10005154
or dword [esi + 0x44], 0x10000
jmp 0x10005154
or dword [esi + 0x44], 0x100000
push esi
push dword [0x100151dc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
lea eax, [esi - 0x7ff8fff2]
pop esi
ret

Function at 0x10005310
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100151d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [0x100151dc]
mov dword [ebp - 0x18], esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10005352
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x100053e2
push ebx
push dword [0x100151dc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 0x40]
mov eax, dword [ebp + 0xc]
sub eax, edi
je 0x1000538b
sub eax, 1
je 0x1000537f
sub eax, 1
jne 0x100053df
push dword [ebp + 8]
mov ecx, ebx
call fcn.100063c3
jmp 0x10005387
push dword [ebp + 8]
call fcn.10006348
mov edi, eax
jmp 0x100053df
push 1
push 0x10
push esi
mov esi, dword [0x100156d0]
mov ecx, esi
call dword [0x10016308]
call esi
mov esi, eax
lea edi, [ebp - 0x14]
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100061d5
push eax
call sym.OLETHK32.dll_TransformHRESULT_3216
mov esi, dword [0x100156d0]
mov edi, eax
push 1
push 0x10
push dword [ebp - 0x18]
mov ecx, esi
call dword [0x10016308]
call esi
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100132f0
leave
ret 0xc
Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [esi], 0
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b83c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b84b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov eax, dword [0x65bd7c]
push eax
call sub.IMM32.dll_ImmGetContext
test bl, bl
mov dword [0x65bd7c], eax
je 0x44b86d
or dword [esi], 0x657630
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x484a42
Capabilities:
Encode data using xor

Disassembly:
test dword [0x83dd766e], 0xbf08a370
add dword [edx - 0x6a7eff67], 0x5e
mov dl, 0xd3
dec eax
fild qword [eax + esi + 0x2e401dd2]
in al, 0xb8
sahf
popal
cmpsb byte [esi], byte es:[edi]
xchg ecx, eax
mov dh, 0x51
push ds
jnp 0x484ad3
fucom st(0)
add eax, 0x102596b1
aaa
and byte [edx - 0x384f3c8a], 2
xchg edx, eax
inc esp
mov al, 0x35
mov eax, dword [0xc1cdcc8c]
sti
cwde
insd dword es:[edi], dx
mov dword [edi - 0x74f0a48d], ebx
mov ah, 0x8f
xor al, 0x67
xor byte [edi], cl
lahf
inc ebp
mov esi, 0xf757cb57
push esp
xchg esp, eax
cwde
push ecx
dec ebp
dec ecx
out 0xbb, eax
xchg edi, eax
xor eax, dword [ebx + 0x3d]
pop esi
dec ebx
loop 0x484ad5

Function at 0x4861ef
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
loop 0x486233
in al, 0x8e
add esp, dword [esi - 0x40]
fdiv qword [ebp - 0x50850d14]
push ds
adc byte [edi - 0x63], al
jb 0x486214
cmc
retf
xchg esp, eax
lodsb al, byte [esi]
mov al, 0x47
mov al, byte [0x76b0e094]
std
shr bl, cl
sahf
xor esi, ecx
mov ecx, dword [edx + 0x5c]
loope 0x486215
ja 0x4862b8
hlt
stc
test al, 0x14
inc esp
sbb eax, 0x2c38e123
invalid
sub byte [edi - 0x19], ah
aaa
and byte [esi], dh
loope 0x4862c4
jno 0x486263
sbb dword [ebp + 0x641b551], ebp
push ecx
mov ch, 0x41
push es
sub dword [ebp - 0x2e6f5ee4], ebp
daa
stc
and dword [ecx], ebp
scasb al, byte es:[edi]
aad 0x78
sbb dword [eax + 0x2a], ecx
jle 0x486306
jno 0x486331
invalid
rol ecx, 0xc7
cmpsb byte [esi], byte es:[edi]
enter 0x6e44, 0x5d
mov al, 0xdf
stc
fdiv qword [edx + 0x1eb5b841]
adc dword [ebp + 0x22], edi
lodsd eax, dword [esi]
test dword [edx + 0x6d], esi
add byte [esp + edx*4 + 0x5a52213f], ah
ljmp 0xc71a
jl 0x486357
mov eax, dword [0x54686483]
xchg edi, eax
arpl word [ecx - 0x791a7b44], bp
push ss
test dword [ecx], esi
jno 0x486339
dec ecx
lds ecx, [edx]
aad 0x2a
imul edi, dword [ecx], 0xffffffb4
jnp 0x4862d0
push ss
inc edi
loop 0x48636d
aam 4
rcr byte [ebx - 0x42], 1
and dword [esi - 0x41], eax
push eax
shl ecx, cl
cmp esp, dword [ecx]
pop edx
insd dword es:[edi], dx
in eax, 0x15
hlt
push edx
invalid
Function at 0x48876c
Capabilities:
Encode data using xor

Disassembly:
aaa
and bl, dh
adc dword [ebx - 0x58b82aee], eax
sbb dword [esi + 0x17], ebx
mov ch, 0x31
xor dword [edi - 0x32b14323], esi
xchg ebx, eax
and dword ss:[edi + 0x6491c4ea], eax
xor dword [edi - 0x32b14323], esi
xchg ebx, eax
and dword ss:[edi + 0x6491c4ea], eax
mov edi, 0xde115535
xchg ebx, eax
cmove ebx, dword [edi + 0x75]
in al, 0x25
cmp ah, byte [eax - 0x3f]
stosd dword es:[edi], eax
pop es
xchg ebp, eax
loopne 0x48875f
push ss
xor eax, 0x566f770
mul dword [esi + 5]
cmc
xor dword [edx + 0x65], edx
and cl, byte [ebx]
inc edi
adc eax, 0x7b320142
cmc
push esi
pop es
mov ch, dh
loopne 0x488792
movd dword [edi], mm0
pop ebp
pushal
mov al, 0xa6
invalid

Function at 0x4c754b
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
ror eax, 0x82
lea ebp, [edi - 0x1f019702]
inc edi
int1
cld
invalid
xchg byte [ecx - 0x7e760998], dh
mov ss, word [eax - 0x14896b98]
push ebp
ret 0x1166
and dword [edx], eax
adc eax, 0xb676a826
mov byte [0xfbb7469e], al
sal dword [edi - 0xf], 0xf7
ja 0x4c753e
imul ecx
insd dword es:[edi], dx
cmp dh, byte [eax + 0x60]
ja 0x4c753e
imul ecx
insd dword es:[edi], dx
cmp dh, byte [eax + 0x60]
dec esi
and al, 0xb6
je 0x4c74dd
xchg byte [edx + 0x53], dh
adc al, 0x9f
lahf
mov edx, 0x8efd321e
test eax, 0xeff2a587
std
mov gs, word [ecx - 0x100d5a79]
mov bh, 0xa4
mov ah, 0xf0
xor byte [edx + ebx*4 + 0x18c78552], bh
and eax, 0xb73418e0
dec edi
add dword [esi + 0x5444c97c], edx
leave
inc esp
push esp
cmpsd dword [esi], dword es:[edi]
js 0x4c7562
mov dh, 0x1e
mov eax, 0xc838c331
call 0x2b18153f
das
das
inc esp
push ss
cdq
add al, 0x16
loope 0x4c75ac
retf
push 0x45c86248
jg 0x4c7521
push edi
invalid
sal byte [edx - 0x28], 0x56
or byte [edx + eax*4 + 0xdbe33b4], bl
inc esi
jo 0x4c75cc
mov esi, 0x1270460d
pushal
jle 0x4c758d
pop esi
add eax, 0x31f03011
salc
xor esi, edx
lodsb al, byte [esi]
xchg edi, eax
xchg esp, eax
jle 0x4c75b5
sti
mov ds, ecx
jecxz 0x4c7563
popfd
or cl, dl
cmpsd dword [esi], dword es:[edi]
xor eax, 0x7341d7c6
js 0x4c75c2
je 0x4c757d
xchg ebx, eax
aad 0x53
inc edi
add dh, byte [ebp - 0x5f6ee0ac]
mov dword [0x1fa7d4e1], eax
cmp bl, dh
inc esi
insd dword es:[edi], dx
mov ecx, 0x5351f277
shl dword ss:[esi], 0xa0
cdq
invalid

Function at 0x4d02ac
Capabilities:
Encode data using xor

Disassembly:
shl dword [esi - 0x3f], 0x94
enter 0x2334, 0x76
sbb edx, dword [esi + 0x6cb1b69b]
jae 0x4d030e
scasd eax, dword es:[edi]
mov edx, 0xa2d6c130
cmc

Function at 0x4d13b1
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
mov ch, 0x9a
cmpsb byte [esi], byte es:[edi]
push ss
push ds
invalid
Function at 0x4f560b
Capabilities:
Encode data using xor

Disassembly:
pop ds
push ecx
stc
insd dword es:[edi], dx
mov bl, byte [edx + 0x1d]
jno 0x4f560e
or byte [ecx - 0x28], dl
pop ecx
scasb al, byte es:[edi]
int 4
rcl byte [eax - 0x7dfa7b5b], cl
aad 0x66
or byte [ecx - 0x46debe6], 0xe2
and eax, 0xcf5fb7c7
jecxz 0x4f5666
sbb edx, ebp
push edx
cmpsb byte [esi], byte es:[edi]
xor esi, dword [ecx + 0x40]
mov bh, 0x2d
in al, dx
jmp 0x4f5659
loop 0x4f55cb
dec eax
pop esi
mov esi, 0x46d6dddd
test byte [eax - 0x44], bh
lds ebp, [edx - 0x69]
xor dword [esi - 0x6568db5f], edx
xor eax, dword [eax*2 - 0x266fcc2]
push edx
mov esi, 0x8962a458
pop ebx
cmp al, 0x75
xor ch, byte [eax + 0x1e]
mul bh
xchg esi, eax
loope 0x4f560e
clc
adc al, 0xb5
cli
cmpsd dword [esi], dword es:[edi]
fbld tbyte [ecx]
mov edx, 0x4741f5de
inc ecx
dec ecx
iretd
test dword [edx + edx*8 - 7], esp
mov ebx, 0xf613260e
sbb dword [ebx + 0x4c], 0x12
xchg byte [edi - 0x2de757c3], dh
adc cl, bh
adc al, byte [esi + 0x18a83db7]
rcl byte [eax], cl
stc
sti
adc al, byte [edi - 0x25]
add dx, si
das
stosb byte es:[edi], al
xchg ebx, eax
xchg dword [ebx + eax*8 - 0x31950fd8], edi
ficomp word [ebx + 0x7b]
popal
push 0xfffffffffffffffd
push esi
insd dword es:[edi], dx
xor ah, 0xb1
dec ebp
inc eax
test dh, ch
cld
ljmp 0x139d
Function at 0x55d047
Capabilities:
Encode data using xor

Disassembly:
and dword [edi], 0x4cd952e9
test byte [edi - 0x3ce653ee], bl
and dword [edi + 0x3f], edi
cmp dword [ecx + 0x364e3796], esi
inc edx
inc edi
les eax, [edi - 0x5e]
invalid
cmp dl, byte [edi + 0x3f]
mov dword [0xf1418e8a], eax
pop ecx
xor dl, bh
mov dword [0x80c955e4], eax
ffree st(6)
in eax, dx
pop ebx
or dh, byte [edx - 0x6c880ce8]
imul esp, edx, 0x434c1255
mov cl, 0x54
jae 0x55cfe6
pop esp
cmp dword [edi + 0x36], ecx
mov esp, 0x220727a9
mov esp, 0x220727a9
and bl, byte [ecx + 0x7b6291e]
scasb al, byte es:[edi]
sub ch, byte [eax]
sbb dh, bh
sub eax, 0xd9b47584
loop 0x55d0d7
mov dl, 0x79
mov byte [0x3cac4e93], al
mov dword [ecx + 0x78], eax
loop 0x55d020
aad 0xd9
int 0xcf
sub byte [bp + si - 0x7d], dh
or al, ah
add bh, byte [ebx - 0xe]
sbb eax, 0x78e12cf2
mov ebp, 0x45b8a8aa
cli
xchg dl, ch
aam 0xbe
cld
aam 0x6f
mov ecx, 0xdf71096d
jmp 0x55d0c3
pop esi
inc ebx
fmul dword [eax - 0x434f16f2]
clc
cmp dword [ebp + 0x56], edi
movsb byte es:[edi], byte [esi]
rcr dword [ecx - 0x48], 0xb8
cmp ebp, dword [ebp - 0x5a187a6]
xor eax, 0xce066945
ret
mov eax, dword [0x46e578d9]
pop edi
pop edi
add al, 0xbc
or bl, byte [edi - 0x70d80827]
jns 0x55d066
push esp
push ebx
dec edx
mov gs, word [esi + 0x549e1b1e]
push ecx
ffreep st(3)
movsb byte es:[edi], byte [esi]
rcr byte [ebx - 0x7e8d45e5], cl
xor cl, byte [ecx + 0x5c]
cli
out 0x93, eax
push eax
fsubrp st(6)
mov bh, 0x12
sbb al, 0x92
mov dword [edi + 0x7f], edi
loop 0x55d091
cmp dword [eax - 0x5823ac0f], esi
sub al, 0x42
mov fs, ebx
insb byte es:[edi], dx
nop
cdq
lcall 0x19d2, 0x14eb52d7
int1
stosb byte es:[edi], al
pop ecx
pop edx
shr byte [ecx], 1
push cs
or eax, 0x98c56291
rol esp, 0x69
or dword [ecx - 0x7c16fca], esi
daa
mov dword [0x8869948d], eax
push es
loope 0x55d0d2
mov esp, 0x54a8f612
mov dh, 0x8d
mov dword [edx], eax
ja 0x55d13d
rol dword [edi - 0x40eb8751], cl
xor al, 0x79
fdivr qword [ebx + 0x59]
lahf
and al, 0x8b
fst dword [edx + 0xd82a799]
xor byte [edi], dl
xor dl, bl
cmp al, 0x6c
cld
loope 0x55d1c0
mov esi, edx
out 0xe9, al
push ss
jp 0x55d1ab
mov edi, 0x2308d16b
hlt
xor dword [ecx + 0x420e8701], edi
mov eax, 0x9919bfad
lodsb al, byte [esi]
dec edx
mov dh, 0xfc
mov dword [0xa4096a2f], eax
dec eax
jae 0x55d18f
mov al, byte [0xebf41563]
jg 0x55d1a0
inc esp
invalid
movsb byte es:[edi], byte [esi]
push 0xfffffffffffffff9
xchg ecx, eax
inc esp
jecxz 0x55d1fa
jmp 0xfd1efb17
cld
inc eax
xchg edx, eax
invalid
sub ebx, dword [edi - 0x2c70d721]
mov ecx, 0x99813feb
imul esp, dword [eax - 0x592a2e23], 0xfffffffc
outsb dx, byte [esi]
mov dl, 0x50
mov dh, 0x1e
dec edi
jno 0x55d170
test dword ds:[ecx + 0x59], ecx
add ah, byte [edx + 0x48595811]
clc
rol byte [edi], cl
bound ebp, qword [edx + 0x4e]
fisttp qword [esi]
jmp 0x19b9c1ca
iretd