joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49fed0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a00e9
sub esp, 0x48
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 2]
movzx edx, word [eax + 8]
movzx ebx, word [eax + 0xa]
movzx ebp, word [eax + 0xc]
mov esi, dword [esp + 0x4c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0
mov ecx, dword [0x7005a4]
mov dword [esp + 0x1c], ecx
call fcn.0049d030
lea esi, [esp + 0x20]
lea edi, [esp + 0x34]
call fcn.00459f6e
mov edi, esp
lea esi, [esp + 0x34]
call fcn.00459f6e
call fcn.0049b910
mov eax, dword [esp + 0x14]
add eax, 0x15180
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.004518e0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x4a00cb
lea edx, [ecx + 7]
movzx ebp, word [ebx + 6]
lea esi, [ebp - 1]
cmp esi, 4
jge 0x4a0047
lea ecx, [ebp + ebp*2]
lea ecx, [ebp + ecx*2]
lea ecx, [edx + ecx - 6]
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
test ebx, 0x80000000
je 0x4a003d
shl ebx, 1
mov ebp, edx
shr edx, 0x1f
or edx, ebx
shl ebp, 1
mov ebx, edx
shl edx, 1
shr ebp, 0x1f
or edx, ebp
mov ebp, edx
add edx, 0xd7b17f80
shr ebx, 0x1f
add ebp, 0xd7b17f80
adc ebx, 0xd
lea eax, [ecx - 1]
mov ecx, 0x15180
mov ebp, edx
mov esi, eax
mul ecx
mov ecx, eax
add eax, ebp
mov edi, eax
add eax, 0x886e0900
mov dword [esp + 0x54], eax
sar esi, 0x1f
imul esi, esi, 0x15180
add edx, esi
add ecx, ebp
adc edx, ebx
add edi, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov edx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
jmp 0x4a0000
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x4a00c5
mov ebx, dword [esp + 0x4c]
test ebx, 3
jne 0x4a00bf
mov ecx, eax
mov eax, 0x51eb851f
mov ebp, edx
imul ebx
mov esi, ebx
sar ebx, 0x1f
mov edi, edx
sar edx, 5
sub edx, ebx
imul edx, edx, 0x64
cmp esi, edx
je 0x4a0092
mov eax, 0x1d
lea ecx, [ebp + 0x1d]
cmp ecx, eax
jle 0x49ffc8
lea ecx, [ebp + 0x16]
jmp 0x49ffc8
sar edi, 7
sub edi, ebx
imul edx, edi, 0x190
cmp esi, edx
je 0x4a007a
cmp ecx, 0xd
jae 0x4a00dc
lea edx, [0x628b80]
mov ebx, dword [edx + ecx*4]
lea eax, [ecx - 1]
cmp eax, 0xd
jae 0x4a00d2
sub ebx, dword [edx + ecx*4 - 4]
mov eax, ebx
jmp 0x4a007f
mov ecx, eax
mov ebp, edx
jmp 0x4a00a1
mov ecx, eax
mov ebp, edx
jmp 0x4a00a1
mov edx, ecx
jmp 0x49ffac
mov ecx, 0xd
call fcn.004598d0
mov eax, ecx
mov ecx, 0xd
call fcn.004598d0
nop
call fcn.00458300
jmp fcn.0049fed0
Function at 0x4c7450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c75ba
sub esp, 0x40
mov eax, dword [esp + 0x70]
cmp eax, 4
jne 0x4c75b1
mov ecx, dword [esp + 0x6c]
cmp dword [ecx], 0x6c616964
je 0x4c7556
mov edx, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x5c], edx
mov ebp, dword [esp + 0x4c]
mov dword [esp], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x54]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004c7290
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], eax
call fcn.004cb7e0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], edx
add esp, 0x40
ret
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x60]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4c757c
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x4c7486
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x60]
mov dword [esp], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x50]
mov dword [esp + 8], edx
call eax
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x4c748e
mov ecx, dword [esp + 0x6c]
jmp 0x4c7486
call fcn.00458300
jmp fcn.004c7450
Function at 0x4ded80
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4def9d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x4dee37
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x4deeb0
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x4dee18
cmp ecx, 0xf
jne 0x4def29
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x4dee18
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x4dee18
call fcn.00458300
jmp fcn.004ded80
Function at 0x4e3140
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e31e8
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4e31af
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x4e3199
call fcn.00458300
jmp fcn.004e3140
Function at 0x4e80d0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e8285
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x4e80f9
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x4e80f3
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x4e80f3
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x4e8277
cmp al, 0x2c
ja 0x4e8254
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x4e812d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x4e8127
cmp al, 0x26
jae 0x4e8127
cmp al, 0x2f
ja 0x4e821a
cmp al, 0x26
ja 0x4e81f2
cmp al, 0x24
jne 0x4e81e7
cmp ecx, 2
jg 0x4e81ab
cmp ecx, 1
je 0x4e81a0
cmp ecx, 2
jne 0x4e8182
cmp al, 0x2f
jne 0x4e8170
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
je 0x4e8166
cmp al, 0x2c
je 0x4e8166
cmp al, 0x3f
sete al
jmp 0x4e816b
cmp ecx, 7
jne 0x4e819a
cmp al, 0x21
jne 0x4e8192
mov byte [esp + 0xc], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x4e818c
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x4e81d1
cmp al, 0x40
jne 0x4e81bf
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
je 0x4e81b5
cmp al, 0x3f
je 0x4e81b5
cmp al, 0x3a
sete al
jmp 0x4e81ba
cmp ecx, 6
je 0x4e81e1
cmp ecx, 7
jne 0x4e8182
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x4e8152
jmp 0x4e8182
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x4e8152
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x4e820c
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x4e8152
jmp 0x4e8182
cmp al, 0x3d
ja 0x4e8239
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x4e8152
cmp al, 0x3d
je 0x4e8152
jmp 0x4e8182
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x4e8152
cmp al, 0x5f
je 0x4e8206
cmp al, 0x7e
je 0x4e8206
jmp 0x4e8182
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x4e8127
cmp al, 0x5b
je 0x4e8127
cmp al, 0x5d
je 0x4e8127
jmp 0x4e8137
cmp ecx, 4
je 0x4e8116
jmp 0x4e8137
call fcn.00458300
jmp fcn.004e80d0
Function at 0x1002c5cd
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002c60c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002c60c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002c60c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002c60c
cmp dword [ecx + 0x74], 0xe
jbe 0x1002c60c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1002f2bd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002f35a
push ebx
push esi
call fcn.1002f286
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002f21a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002f307
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002f359
push edi
push eax
call fcn.1002d25d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002f327
call fcn.1002d2ab
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002f358
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002f21a
add esp, 0x20
test eax, eax
jne 0x1002f346
push edi
call fcn.1002d2ab
jmp 0x1002f34e
push ebx
call fcn.1002d2ab
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002f5c7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036668
push 0x10036660
push str.FlsAlloc
push 0x1f
call fcn.1002f4e3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002f5fb
push dword [ebp + 8]
mov ecx, esi
call dword [0x10035120]
call esi
jmp 0x1002f601
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002f645
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036678
push 0x10036670
push str.FlsGetValue
push 0x21
call fcn.1002f4e3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002f67c
push dword [ebp + 8]
mov ecx, esi
call dword [0x10035120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002f684
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036680
push 0x10036678
push str.FlsSetValue
push 0x22
call fcn.1002f4e3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002f6be
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10035120]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10034cf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10034d1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10034d1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xf3c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00f3c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf3c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf3c06a
add dl, dl
jne 0xf3c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf3c0dc
xor eax, eax
add dl, dl
jne 0xf3c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf3c17d
add dl, dl
jne 0xf3c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf3c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf3c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf3c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf3c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf3c075
mov eax, 1
add dl, dl
jne 0xf3c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf3c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf3c0e1
sub eax, ebx
mov ebx, 1
jne 0xf3c128
mov ecx, 1
add dl, dl
jne 0xf3c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf3c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf3c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf3c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf3c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf3c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf3c136
cmp eax, 0x7d00
jae 0xf3c16d
cmp eax, 0x500
jb 0xf3c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf3c075
cmp eax, 0x7f
ja 0xf3c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf3c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf3c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf3c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40b0fd
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
cmc
xchg ebx, eax
out dx, al
mov ecx, 0x4541c4d7
xor dword [0x165dc9c4], ebx
clc
inc ebx
pop ecx
sbb al, byte [eax - 0x3d]
xlatb
adc byte [bp + di - 0x628b], 0xee
jb 0x40b158
or al, 0xa6
dec ebp
cmc
loop 0x40b198
pop ebx
clc
popfd
sahf
sub dword [eax + 0x3b9ab8ed], edi
invalid
or esp, edx
push ebx
sub al, 0xef
and al, 0x9f
add dword [ecx - 0x5d], edi
cmp eax, 0x7be632bc
test byte [ecx + 0x1e425969], ch
mov byte [esi + esi*2 + 0x3e], dh
dec edi
je 0x40b1d0
dec edi
shr byte es:[eax - 0x74], 0xff
pushfd
push ebx
std
stc
sub ebx, dword [edi]
invalid
xchg esp, eax
aam 0x54
nop
test byte [eax + 0x4704a063], al
inc ebp
pushal
or dword [ecx + 0xcc62135], 0xffffffe4
and al, 0x44
xchg ecx, eax
push 0xa85e68b1
jae 0x40b142
sbb dl, bh
and al, 0xc2
cmc
out dx, eax
jl 0x40b198
jge 0x40b185
cmp byte [ebp + 0x59], dl
push eax
adc ch, dl
add byte [esi + esi - 0xa], dh
xchg ebp, eax
in eax, 0xb5
hlt
xchg esp, eax
xchg edi, eax
add eax, 0x3160bdb2
inc edx
test dword cs:[ecx - 0x41], eax
mov ebp, 0x616cd031
je 0x40b1fe
mov ah, 0xd1
xor ah, byte [eax + 0x7b982067]
mov dword [0x609724f2], eax
xor byte [ebp + 0xb3c9052], al
xchg esp, eax
out 0x85, eax
push es
lea esi, [ebp + 0x12]
scasd eax, dword es:[edi]
inc eax
sbb eax, 0xbc1abf8d
mov sp, 0xdacb
add al, 0xc4
shl dword [ebp + esi*4 + 0x50], 1
cwde
dec ecx
arpl cx, ax
push es
sub byte [eax], dh
inc esp
xor ecx, eax
mov ebx, 0xe035d545
stc
adc dword [esi + 0x4e88b507], ecx
popal
xchg byte [eax + 0x10], ah
mov cs, word [edi]
pop eax
invalid
invalid

Function at 0x421a3d
Capabilities:
Encode data using xor

Disassembly:
xchg esi, esi
dec esp
and dword [eax + 0x48c3f003], 0xeb16ba03
test al, 0xa6
test ebx, edi
pop ebx
mov dl, 0xb1
xchg edi, eax
mov cl, 0x97
popal
aaa
mov edi, 0xc77bd037
xchg esi, eax
xor eax, dword [eax - 0x12]
sbb al, dl
add byte [eax], ah
jl 0x421a51
push cs
movsd dword es:[edi], dword [esi]
jne 0x421ac6
into
jmp 0x94a4e2eb
xchg esi, eax
sbb dl, byte [edi + ebx*4 - 0x5b]
mov al, byte [0xeb70df85]
test eax, 0xb40efb39
fstp dword [ecx + 0x22cf0233]
and al, 0x7c
pop edx
outsb dx, byte [esi]
push cs
or dh, byte [ebx + ebx*2]
int3

Function at 0x42201d
Capabilities:
Encode data using xor

Disassembly:
enter 0x3c12, 0xffffffffffffff9f
shr dword es:[ecx - 0xa91d655], cl
add eax, 0xe7fd52f0
adc dword [edx], ebx
jnp 0x4220a2
scasd eax, dword es:[edi]
push dword [eax]
xchg byte [ecx + 0x7dc5b881], dh
add dword [esi + ebp*4], edx
pop ebp
push es
xchg edx, eax
sub dword [ebx + 0x67aaaa89], esp
hlt
Function at 0x44ff6d
Capabilities:
Encode data using xor

Disassembly:
test byte [eax + edx*8], bl
dec edx
invalid
jae 0x44ff6a
cmp eax, 0xf155ed32
xchg edx, eax
lds ebx, [edx - 0xb]
jno 0x44ffaa
mov ch, byte [ebp - 0x68]
fimul dword [ebp + 9]
or al, byte [edx + eax - 0x18]
movsd dword es:[edi], dword [esi]
test dword [edx + 0x7bcf954d], esp
hlt
adc al, 0x27
jge 0x44ffe1
stc
outsd dx, dword [esi]
add dword [esi + 0x18], 0xa60da503
and ebx, edx
inc ecx
fiadd dword [ecx + 0x6a]
fisttp word [eax]
insb byte es:[edi], dx
xchg dh, bh
push 0xffffffffffffffdf
or byte [esi + eax*4 - 2], ch
jo 0x44ff1b
nop
imul edx, ebx, 0xe8b18165
mov edi, 0x16391101
push ss
out 0, al
jg 0x44ff78
test dword [ebx], 0x4719d917
fdiv dword [eax - 0x4e]
mov al, byte [0x4e918391]
test dword [ecx + 0x2f0302b9], 0x713bc6ab
jne 0x44ff82
jno 0x450021
aad 0x73
adc eax, 0x9e2d0212
hlt
jae 0x44ffc4
adc al, byte [edx]
sub eax, 0x1d12f49e
invalid
dec edi
push ebp
call 0x92982311
xor al, 0xac
lodsb al, byte [esi]
jg 0x44ffcc
fild word [esi + 0x31b3b2b8]
daa
mov dl, 0xb3
xor dword [edi], esp
jge 0x450017
inc eax
inc edi
popfd
jbe 0x44ffd2
xor eax, 0x7201d80b
mov al, byte [0x134149d3]
cmp dword [eax - 0x54fe1e3a], esp
jb 0x44ff83
ror dword [ecx + 0x41], cl
dec ecx
inc ecx
adc edi, dword [ecx]
mov al, byte [0xab01e1c6]
fistp qword [edx + 0x37]
leave
pop ss
dec ecx
aad 0x79
cld
imul edi, edi, 0x4b
push ebx
mov byte [ebp - 0x1a], cl
mov bh, 0xd5
int1
push ds
cdq
dec esp
push es
loope 0x44ffcd
imul ebx, dword [ebx], 0xbbbc6d6e
adc esi, 0xffffff97
insd dword es:[edi], dx
mov ebx, 0x6d97d683
mov edx, 0x2fcef61b
das
sub dl, 0x23
insb byte es:[edi], dx
adc esi, dword [ebp + 0x6919a3b2]
push 0xdb1414fd
add al, 0x8b
jbe 0x45000e
imul ebp, dword [eax - 3], 0x4db1414
mov esi, dword [esi - 0x1d]
mov esi, 0x1667bb42
mov edi, 0x42a16766
cmp al, 0x62
push ecx
wait
ja 0x44ffdd
js 0x44ffe4
mov ch, 0xf0
push cs
ret 0x8f70

Function at 0x450746
Capabilities:
Encode data using xor

Disassembly:
sbb ch, byte [esi - 0x57]
jg 0x450704
retf 0x44ce
sub edi, ebp
out dx, eax
loope 0x45073d
into
push ecx
test eax, 0x18b51f35
cmpsb byte [esi], byte es:[edi]
pop es
pop ds
movsd dword es:[edi], dword [esi]
cdq
ror byte [edi + 0x3f15a0cc], 1
mov cl, 0xd
rcl dword [eax + esi*8 - 0x67bdd503], cl
loope 0x45079b
xor ah, byte [ebp + 0x1e]
call [esi - 0xf]
popal
add eax, 0x27fc36de
sahf
je 0x4506f9
cmp dword [esi + 0x7b110c36], ecx
out 0x42, eax
scasb al, byte es:[edi]
inc eax
mov bh, 0x9d
xlatb
ret 0x3c81
ja 0x450703
leave
fst st(6)
mov eax, 0x1647d060
rol byte [edi + 0x16], 1
in al, 0x6b
dec edi
dec ebp
dec edi
pushal
ja 0x4507b5
nop
sbb dword [edi + 0x5f11870b], ebp
or dword [edx], edx
and dword [0x28f03bcf], ebx
sahf
mov edx, 0x575eac5e
shl byte [edi - 0x37], 1
dec ebx
xor eax, 0x2e8b6f59
ror bh, 0xf2
and esi, esi
invalid
push 0x67
lds edx, [edx + 0x66dbd756]
retf
invalid
Function at 0x466fcd
Capabilities:
Encode data using xor

Disassembly:
dec edi
daa
cmp esp, ecx
test al, 0x2c
sal byte [eax], cl
push eax
scasb al, byte es:[edi]
jno 0x466f92
enter 0xffffffffffffbeed, 0xffffffffffffffe9
pop es
stosd dword es:[edi], eax
sbb dl, byte [esi - 0x43df6049]
lds ebp, [eax]
pop ebx
pushfd
ror bh, 0xfc
adc bl, byte [ebx + 0x1c]
and eax, 0x50db2717
das
adc al, 0xd0
sub eax, 0x4196bce5
mov edi, dword [ebp - 0x78]
inc esi
hlt
popfd
jno 0x466f84
and ecx, dword [edx]
js 0x466f13
mov ah, 0x53
and dword [ebx + 0x2c], esp
ret
push 0x5a
mov edx, 0x80516372
jno 0x466f14
fst dword fs:[0x99cf0ea6]
adc byte [esi], 0x35
popfd
jns 0x466fbe
les esp, [edx - 0x7f]
adc dl, ch
cmp esp, edi
xor esp, dword [esi]
or eax, 0x21766897
inc esp
cmp al, 0xe5
or dword [eax], ecx
cmp dword [esp - 0x80], edi
or dl, byte [edi - 0x22f551a7]
xchg edi, eax
pop ecx
scasb al, byte es:[edi]
or bl, ch
cld
aam 0xb5
popal
jecxz 0x467022
pop esp
mov bl, 0xd2
push es
out 0x46, eax
inc esi
xchg ah, ch
xor al, byte [ebx + 0x23]
pop ecx
xchg ah, cl
fdiv dword [ebp + 0x7192979]
push ebx
jecxz 0x466f9c
fstp qword [esp + eax*2]
sbb al, 0x44
push edi
jbe 0x466f6f
stosb byte es:[edi], al
add al, 0xa2
popal
jne 0x466f53
mov eax, dword [0xa2880189]
or ch, bl
test dword [ebx + 0x7c], ecx
in eax, dx
jp 0x46703c
mov byte [0x67ed81ff], al
xchg esp, eax
add cl, byte [edi - 0x11]
cwde
add dword [edx + 0x63], eax
or al, 0xa2
fisubr word [edi - 0x2147f60d]
mov al, byte [0x186da022]
jb 0x466ffc
stosb byte es:[edi], al
enter 0x4540, 0xffffffffffffff8b
pop ds
cmp esp, dword [eax - 0x76db922f]
sar dword [eax], cl
mov edx, 0x1cd37154
shr dword [ebp + 0x24], 1
mov ebx, edx
cmp byte [edx + 0x1cd37154], bh
xchg ebx, eax
out 0x4c, al
js 0x46702d
sti
shufps xmm5, xmmword [eax - 0x599eb76c], 0xdc
fidiv dword [eax]
dec ebp
cmp bh, byte [esi*8 - 0x601ead7e]
inc esi
push esp
cmp dword [ebp - 0x77], 0xffffffbd
aas
lodsd eax, dword [esi]
fcomp st(5)
jge 0x466fad
mov ebp, 0xddd8ad3f
mov al, byte [eax + edi*4 - 0x6662716b]
mov ds, word [ebp - 0x4dd4aa67]
add esi, dword [ecx]
inc edi
jl 0x46702d