joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a54f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c93b7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4ed310]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004a38d0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004a38d0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004a38d0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004a4cd0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004a4cd0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004a4cd0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4af4de
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x4af563
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004b3fc0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4af526
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4af548
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4af5be
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.004af2ac
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x4af5aa
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x4af5be
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4af4e7
pop esi
pop ebx
leave
ret
Function at 0x4b4695
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ed310]
jne 0x4b469f
repz ret
jmp fcn.004bacc1

Function at 0x4bb5d8
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4ed610]
je 0x4bb5f3
inc edi
cmp edi, 0x17
jb 0x4bb5e4
cmp edi, 0x17
jae 0x4bb773
push ebp
push 3
call fcn.004c1a94
cmp eax, 1
pop ecx
je 0x4bb73f
push 3
call fcn.004c1a94
test eax, eax
pop ecx
jne 0x4bb627
cmp dword [0x4ed450], 1
je 0x4bb73f
cmp ebx, 0xfc
je 0x4bb772
push 0x4f427c
mov ebx, 0x314
push ebx
mov ebp, 0x4fd1b8
push ebp
call fcn.004bb46c
add esp, 0xc
test eax, eax
je 0x4bb65d
push esi
push esi
push esi
push esi
push esi
call fcn.004b68bb
add esp, 0x14
push 0x104
mov esi, 0x4fd1d1
push esi
push 0
mov byte [0x4fd2d5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb6a1
push 0x4f4264
push 0x2fb
push esi
call fcn.004bb46c
add esp, 0xc
test eax, eax
je 0x4bb6a1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004b68bb
add esp, 0x14
push esi
call fcn.004b6390
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4bb6e6
push esi
call fcn.004b6390
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4fd4cc
push 0x4f4260
sub ecx, eax
push ecx
push eax
call fcn.004c05e8
add esp, 0x14
test eax, eax
je 0x4bb6e6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004b68bb
add esp, 0x14
jmp 0x4bb6e8
xor esi, esi
push 0x4eeaf8
push ebx
push ebp
call fcn.004c0577
add esp, 0xc
test eax, eax
je 0x4bb708
push esi
push esi
push esi
push esi
push esi
call fcn.004b68bb
add esp, 0x14
push dword [edi*8 + 0x4ed614]
push ebx
push ebp
call fcn.004c0577
add esp, 0xc
test eax, eax
je 0x4bb72a
push esi
push esi
push esi
push esi
push esi
call fcn.004b68bb
add esp, 0x14
push 0x12010
push 0x4f4238
push ebp
call fcn.004c18d7
add esp, 0xc
jmp 0x4bb772
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4bb772
cmp ebp, 0xffffffff
je 0x4bb772
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4ed614]
push dword [esi]
call fcn.004b6390
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4c18d7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004bae9f
xor ebx, ebx
cmp dword [0x4fd898], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4c19ad
push 0x4f538c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4c1a8d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4f5380
push edi
call esi
cmp eax, ebx
je 0x4c1a8d
push eax
call fcn.004bae31
mov dword [esp], 0x4f5370
push edi
mov dword [0x4fd898], eax
call esi
push eax
call fcn.004bae31
mov dword [esp], 0x4f535c
push edi
mov dword [0x4fd89c], eax
call esi
push eax
call fcn.004bae31
mov dword [0x4fd8a0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004b6bf0
test eax, eax
pop ecx
pop ecx
je 0x4c197b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004b68bb
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4c19ad
push 0x4f5340
push edi
call esi
push eax
call fcn.004bae31
cmp eax, ebx
pop ecx
mov dword [0x4fd8a8], eax
je 0x4c19ad
push 0x4f5328
push edi
call esi
push eax
call fcn.004bae31
pop ecx
mov dword [0x4fd8a4], eax
mov eax, dword [0x4fd8a4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4c1a32
cmp dword [0x4fd8a8], ecx
je 0x4c1a32
push eax
call fcn.004baea8
push dword [0x4fd8a8]
mov esi, eax
call fcn.004baea8
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4c1a32
cmp edi, ebx
je 0x4c1a32
call esi
cmp eax, ebx
je 0x4c19ff
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4c19ff
test byte [ebp - 0x18], 1
jne 0x4c1a32
lea eax, [ebp - 0x10]
push eax
call fcn.004b6c27
test eax, eax
pop ecx
je 0x4c1a1a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004b68bb
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4c1a29
or dword [ebp + 0x10], 0x200000
jmp 0x4c1a6d
or dword [ebp + 0x10], 0x40000
jmp 0x4c1a6d
mov eax, dword [0x4fd89c]
cmp eax, dword [ebp - 8]
je 0x4c1a6d
push eax
call fcn.004baea8
cmp eax, ebx
pop ecx
je 0x4c1a6d
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4c1a6d
mov eax, dword [0x4fd8a0]
cmp eax, dword [ebp - 8]
je 0x4c1a6d
push eax
call fcn.004baea8
cmp eax, ebx
pop ecx
je 0x4c1a6d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4fd898]
call fcn.004baea8
cmp eax, ebx
pop ecx
je 0x4c1a8d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4c1a8f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e228
Capabilities:
Encode data using xor

Disassembly:
ja 0x41e25e
std
sub al, 0x7e
xor dword [eax], ebp
sub byte [eax + 0xde608a4], bh
sub byte [eax + 0xde608a4], bh
inc edi
sar dword [ebx + 0x47c059e1], 1
xchg edx, eax
push ss
mov esi, 0xfbeab872
xchg ebx, eax
sbb al, 0x2a
in al, 0x15
std
push ecx
mov esi, 0x1433fb7d
sal dword [ebx + 0x25], 0x4d
push es
cmp dword [eax + 0x51], edi
mov dh, 0xf5
jge 0x41e224
loope 0x41e1fb
sahf
inc ecx
adc al, 0xc2
or dl, byte [eax]
inc esp
mov eax, dword [0x1c578504]
push edi
sbb al, 0x57
add al, 0x85

Function at 0x42ea1c
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x41
xor ecx, ebx
test byte [ebx - 0x62488012], dh
mov es, word [ebp - 0x58]
or eax, 0xc754e31
test dword [esi + 0x7e615b8a], eax
inc edx
pop ebx
popal
jle 0x42ea77
push ds
test al, 0xbc
cmc
add eax, 0xba658ae8
jae fcn.0042ea1c
lodsd eax, dword [esi]
mov esi, 0x598b055
or byte gs:[ebp - 0x71fc262a], 0x49
nop
call 0xf5eab8e4
fcomp qword [edi - 0x4b]
sbb bl, bl
mov bh, 0xae
inc ecx
sbb ch, al
sbb eax, 0xe45391fa
stosb byte es:[edi], al
scasb al, byte es:[edi]
jno 0x42ea31
sub esp, dword [esi + eax*8 - 0x1a4456a3]
sbb eax, 0xe74edefb
jae 0x42ea7e
pushfd
arpl word gs:[eax + 0x4c], cx
arpl word [eax + 0x4c], cx
sub al, 0x16
jno 0x42eaf0
mov ch, 0x5b
inc byte [esp - 0x45]
stosd dword es:[edi], eax
push eax
jns 0x42ea99
add esp, ecx
insb byte es:[edi], dx
adc cl, byte [edx - 0x2d]
mov bl, 0x9d
mov dl, 0x8c
push ds
mov esi, 0x5fe62b7c
not dword [edi + 0x15]
fmul dword [ecx]
mov ch, 0xce
xchg ecx, eax
push eax
ljmp 0x6af0
add bl, ah
push 0x76b443cc
dec ebp
adc esp, dword [0x6fcbd3da]
invalid
ret
xchg esp, eax
cmpsb byte [esi], byte es:[edi]
jg 0x42ead5
push ebx
mov ch, 0x26
aas
in al, dx
add al, 0xb1
fnop
sbb bl, byte [esi - 0x6e]
mov byte [0x5c1fd8ee], al
aam 0xd4
loope 0x42eaad
and al, 0xf2
invalid
Function at 0x430388
Capabilities:
Encode data using xor

Disassembly:
dec ebx
sbb esi, dword [esi + 0x1d]
jno 0x4303ee
pushal
cld
and esp, dword [edx - 0x4e]
sub byte [ebp - 0x65], dl
lodsd eax, dword [esi]
xor eax, 0x853606af
and al, 0xa3
sbb edx, edx
and dh, byte [eax + 0x67fec3fa]
sbb edi, eax
lodsd eax, dword [esi]
xor byte [esi + 0x60], 0x4f
wait
cwde
shl byte [esi + 0x3b3cd264], cl
jmp 0x43038d
inc edi
sahf
retf
sub byte [edi], bl
mov ah, 0x1b
aam 0x44
aam 0x44
rcr byte [0x92458c84], cl
xchg esp, eax
pop edi
xor esi, dword [esi]
mov dword [edx], esp
dec ecx
and eax, 0x5f09168f
xchg ebx, eax
pop ecx
add al, 0x4c
ja 0x4303ee
imul eax, dword [ebp + ebx*2 + 0x14], 0x17
pop ecx
xor ah, byte [edi + 0x2f8e9fb8]
jne 0x4303e9
cmp al, 0x83
add byte [edx + eax*2], dl
or byte [ecx + ebp - 0x13], bl
std
mov ebx, dword [eax + eax - 0x5f]
fcom dword [eax]
jecxz 0x4303cc
fidiv dword [edx]
fxch st(4)
lodsd eax, dword [esi]
das
dec edi
dec edi
jno 0x43047b
push ecx
xchg ebx, eax
push edi
push ss
push ecx
fist dword [ebp - 0x2f]
jne 0x430486
mov ebx, 0xe48ed3a
dec eax
push cs
popfd
xchg dword [ebx + 0x34ebf620], edi
ret
arpl sp, ax
push ebp
pop edi
out dx, eax
sub al, 0x89
mov ebx, 0x82363074
sar dword [ebp - 0x5f96f1fa], 0x89
fild dword cs:[eax + 0x46]
and dword [esi + 0x40f08059], ebx
add cl, 0xbd
push es
push cs
imul esp, dword [eax + 0x40db2e89], 0x599e2146
xor al, 0x40
or dh, bh
fcomp dword [ecx - 0x34]
pushfd
sub al, 0xeb
xor eax, dword [esi]
sbb dword [edi - 0x26e04650], edx
adc al, 0xb1
lcall 0x6d0e, 0xc14930c0
dec ebx
mov eax, dword [0xfaaf1e0e]
test byte [esi + edi*8], bh
loop 0x43043f
popal
test dword [ebx - 0x4009c835], eax
retf
Function at 0x433870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x433a21
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404a84
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x433a38
call fcn.004046e0
mov eax, ebx
call fcn.00424bc4
mov edi, eax
dec edi
test edi, edi
jl 0x433928
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00424b98
mov edx, dword [0x44c0f0]
call fcn.00403700
test al, al
je 0x433924
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00424b98
lea edx, [ebp - 0x14]
call fcn.004574a4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404a84
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404754
inc esi
dec edi
jne 0x4338d6
mov al, byte [0x433a3c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x433a48
mov eax, dword [ebp - 0xc]
call fcn.0040f26c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.0040445c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004574a4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x433a38
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.004574a4
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x433a38
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x433a38
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x433a54
call fcn.0040acf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433a28
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004043e8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004043e8
lea eax, [ebp - 0x14]
call fcn.004043c4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004043e8
ret
Function at 0x456eec
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xa1408996]
or al, 0x37
leave
in eax, dx
mov dl, 0x67
cmpsd dword [esi], dword es:[edi]
test eax, 0x58890eab
invalid
mov eax, dword [0x5dacdaa4]
in eax, 0xc2
inc ecx
arpl word [edi + 0x7a], dx
invalid
fxam
test byte [0x208d422f], ah
xchg ebp, eax
push ecx
xor dh, byte [edi - 0x4e295d90]
lea ebp, [ebx - 0x51]
cmp byte [edi - 0x4de0af48], ah
jae 0x456eab
aaa
or al, 0x11
rcl byte [edi]
adc bl, ch
inc edi
pushal
cmp dword [ebp - 0x16d83b92], ebx
cmp ch, ah
in al, dx
popfd
outsb dx, byte [esi]
les esp, [edi]
jmp 0x67ef5b29
in al, dx
invalid
invalid
test eax, 0x200e9a67
jl 0x456e94
push 0x2f3d9d93
mov bh, 0xaa
lodsb al, byte [esi]
xor dword [edi], ebp
xchg edx, eax
jb 0x456ee6
pop ecx
jmp dword [edx]

Function at 0x456fe8
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x3460cb84
add cl, dh
jge 0x45702f
xlatb
je 0x456ffc
inc esp
adc ecx, ebx
inc ebx
fiadd dword [edi + 0x7adb37e5]
sahf
fstp xword [edx - 0x62]
inc edx
xchg ebx, eax
push ebp
jb 0x457079
insd dword es:[edi], dx
adc al, al
invalid
cdq
outsb dx, byte [esi]
mov dword [0x4f4490d3], eax
mov ch, 0xb7
jns 0x457088
lodsb al, byte [esi]
cmp ebp, eax
dec edi
push 0x1a
out dx, al
mov dl, 0x10
or eax, 0xdb19130b
adc byte [0xdb19130b], cl
mov cl, 0x30
sub dh, byte [ebx + 0x3b]
cmp ch, byte [ecx + 0x476990c4]
loope 0x457081
cmpsd dword [esi], dword es:[edi]
add dword [ebp - 0x5d], 0x3794e9ad
xchg edi, eax
pop eax
dec edx
inc ecx
sub ch, al
mov esp, dword [ebp + 0x46767857]
dec eax

Function at 0x458d34
Capabilities:
Encode data using xor

Disassembly:
aas
add ecx, edx
sbb al, 0x87
xor dh, byte [ecx + 0x7bde3368]
sub ebp, dword [ebx]
xchg ecx, eax
sub dword [edi + eax*4], 0x358bd5aa
cli
or al, 0xac
movsb byte es:[edi], byte [esi]
xchg dword [edx], esi
mov cl, 0x68
xor ebx, esi
jnp 0x458cfc
sub edx, dword [ecx - 0x5578d37f]
aad 0x8b
xor eax, 0xa4ac0cfa
jo 0x458cc9
sbb bl, byte [0x8f3fd4a9]
push es
loopne 0x458d2f
dec ebp
pop esi
and dword [ebx - 0x12], ecx
into
leave
xchg bl, dh
mov ch, 0xcb
add ebx, dword [0x2374009c]
and al, 0x4d
or dword [esi - 0x6c], 0x13c8db90
dec edx
pop ds
cli
fistp dword [edi - 0x76]
push ecx
mov ds, word [edi + 0x61c33cb9]
xor cl, byte [edi + 0x303bab56]
xor bh, byte [edx + ecx*8 - 0x6162be15]
pop edx
pop ss
fcomp qword [ebx - 0x213eeb3f]
dec edi
adc ch, dh
or byte [edx - 0x33ce80b1], cl
xchg ecx, eax
in al, dx
mov eax, dword [0xa21b82d5]
mov byte [0x1d67f05], al
jmp 0x458cc5
int 0x26
inc ebp
lodsd eax, dword [esi]
inc ecx
mov dh, 0x75
retf 0x28de
mov byte [0x1d67f05], al
jmp 0x458cc5
Function at 0x459388
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
fstp xword [eax + 0x12]
nop
fisub dword [eax]
add byte [edi], ch
les edi, [edx + 0x7a8c1164]
jmp 0x45938c
xchg ebx, eax
push 0xfffffffffffffff3
aaa
mov ah, 0xef
int1
lcall 0x2842, 0x4f35f68
mov al, byte [0x352b2233]
push cs
dec ecx
pushfd
adc byte [eax + 0x3d], bl
and eax, 0xc9d609fc
pop es
test byte [edi + 0x627ff0f3], 0x57
invalid
xchg byte [eax - 0x38ef848e], bh
je 0x45933c
inc byte [ebx + 0x72f37c50]
xchg ecx, eax
jb 0x45931c
loopne 0x459399
or al, 0xdd
xchg ecx, eax
mov ecx, 0xfacff7b9
fst qword [ecx - 0x30084647]
cli
mov edi, 0xe95c1356
or byte [esi - 0x79], ah
cmp eax, 0xe11603b
inc eax
jb 0x4593c8
jmp 0x3dccf9a6
and ecx, dword [ebx + 0x6c]
dec ebx
insb byte es:[edi], dx
daa
call 0x7a2aea97
and edi, dword [ebp - 0x10]
jno 0x459336
or eax, 0xb3c288f2
dec ebx
xor al, 0x50
jo 0x4593b2
movsb byte es:[edi], byte [esi]
aaa
dec eax
cwde
jp 0x45937c
cwde
out dx, eax
into
leave
cmp eax, 0x87b2e9e3
xor cl, byte [ebx - 0x6a]
test byte [ebp + 0x47], 0x98
dec ebp
sub eax, 0xc67c31b3
or ebx, ebx
pop ebp
xor bl, al
jo 0x4593a4
jmp 0x4b781b7f
adc bl, byte [ebx - 0x36e3300]
or eax, 0xde6a01b6
or ch, 0x45
sbb eax, 0x3b2ccf48
sbb al, 0x52
dec edi
pop eax
dec ebp
xor dword [edi], 0xffffffa6
jmp 0x459452
into
ret 0xf00

Function at 0x45cca0
Capabilities:
Encode data using xor

Disassembly:
fadd qword [edx]
sbb dword [edx - 0x1b7c96fd], 0xffffff91
test dword [ebx - 0x15], 0x2842b0dc
inc esp
xchg esp, eax
or dword [ecx + 0x55d14b9f], ebx
enter 0xffffffffffffa45e, 0xffffffffffffffb9
dec edx
out dx, eax
dec eax
push ecx
inc edx
sub byte [esp + edx*4 + 9], al
cdq
lahf
dec ebx
rcl dword [ebp - 0x38]
pop esi
movsb byte es:[edi], byte [esi]
mov ecx, 0x5148ef4a
adc al, 0x49
adc eax, 0xc00d53d
or al, 0x46
cmp dl, byte [edx - 0x4b]
pushfd
dec esi
ffree st(6)
xchg ebp, eax
xor al, 9
adc al, 0xb4
call 0xe6983a32
sub esp, ecx
jns 0x45cc59
inc ebx
mov esi, 0xdb2be07a
loopne 0x45ccad
invalid
std
movsd dword es:[edi], dword [esi]
and ebx, ecx
and dword [ecx + 0x1b], ecx
out 3, eax
xor esp, esi
xor bl, dl
pop eax
sub esp, dword [eax - 0x3a]
add byte [eax - 0x6f], 0x2e
push cs
jge 0x45cc3f
add edi, esi
xor eax, 0x4528515c
sub byte [ebp + 0x6f], al
sub byte [ebp + 0x6f], al
cmp byte [ecx], 0x90
or bl, ch
sub byte [ebx], dh
mov ch, 0x13
add dword [ecx], ebx
sal byte [edx - 0x68], 1
lcall 0x9f23, 0x760669a1
loop 0x45cc4d
cmp dword [esi + 0xd870b58], edx
and eax, 0xbd341329
test esp, ebx
sub byte [esi + eax + 0x2cf96cc4], dh
push es
jmp 0xa067c375

Function at 0x490ec0
Capabilities:
Encode data using xor

Disassembly:
popal
jle 0x490ed6
or edi, dword [eax]
push edx
inc eax
sbb ecx, dword [edx - 0x313ce6b8]
push edi
sbb ecx, dword [esi]
iretd
add esi, dword fs:[ebx - 0x103310f7]
insd dword es:[edi], dx
pop edx
mov ebx, 0xb341252f
jno 0x490e61
ja 0x490f44
lodsd eax, dword [esi]
inc eax
add dword [esi + esi + 0x2f0d9c1a], edi
invalid
pushfd
invalid
das
mov esp, 0xd9c1a36
das
mov ebp, 0x494bfad4
in eax, 0x45
mov eax, 0x661ae51c
cmc
invalid
Function at 0x4b036c
Capabilities:
Encode data using xor

Disassembly:
ret 0xc92e
mov esi, 0xfb614c76
fcomp qword [edx + 4]
mov edx, 0x53b80c26
cmp dword [ebp + 0x2b], edi
xor dh, ah
push ebp
mov ebx, 0x5be6311b
sub al, 0x71
les eax, [eax + 0x7e]
jne 0x4b02bf
adc ebp, ebp
nop
sub al, 0x91
and esi, dword [eax - 0x2fad360]
mov al, 0xa0
sub al, 5
std
lahf
or eax, 0x1f89e63f
cmpsd dword [esi], dword es:[edi]
cli
std
test al, 0xb3
mov bh, 0x7e
dec eax
jle 0x4b0383
and byte [esi - 0xa3b96a9], dh
in eax, 0x2e
jl 0x4b035d
aaa
mov bh, 0x2d
into
jp 0x4b0346
pop eax
jbe 0x4b0326
xchg ecx, eax
sub byte [ecx + ebx*2 - 0x5d], dl
wait
daa
rol byte [edx - 0x43], 0x35
dec edi
pop edx
jecxz 0x4b03d1
jae 0x4b0391
xor cl, byte [ecx + 0x62]
sub byte [edx - 0x1d], 0x79
inc byte [ebx + 0x6c]
dec ecx
bound eax, qword [eax - 0x1861c96]
inc ebx
insb byte es:[edi], dx
push ecx
jmp 0x4b0300
in al, dx
jle 0x4b0339
sbb al, 0xd5
add byte [edx - 0x24], ah
jmp 0x4b03a9
pop ecx
fist dword [esi + 0x6e]
and byte [edx - 0x15], cl
pop ecx
dec edx
ret 0x24bc
xchg esi, eax
xlatb
stc
dec ebx
cmpsd dword [esi], dword es:[edi]
or eax, dword [edx]
or byte [edi - 0x16], dh
mov ecx, dword [ebx]
pop edx
cmp dword [edi], edi
hlt
and eax, 0x16eab29c
inc ebp
cmp eax, 0xe43f704
add al, 0xf7
inc ebx
push cs
dec ecx
xor al, 0x50
mov cl, 0xfc
outsb dx, byte [esi]
push edx
dec edi
jbe 0x4b03a2
daa
mov dword [0x1b8c72ea], eax
adc byte [edi + 0x20], al
pop ss
dec esp
in al, dx
mov al, byte [0x3c869701]
adc dl, byte [esi - 0x60]
invalid
std
int3
loope 0x4b03f4
aam 0xb9
cwde
frstor dword [ebx - 0x23]
jl 0x4b0412
or al, byte gs:[esi]
jmp 0x4b041a
push ds
sar byte [ebp + 0x19], 1
jge 0x4b0411
and byte [ebp - 0x5f], 0xe3
ror byte [edi + 0x49], 1
salc
inc ebx
pop esp
dec eax
jo 0x4b03f6
rcr byte [edx], 0xb
je 0x4b0460
sub eax, 0x8c2f7468
jo 0x4b03cd
imul esp, esp, 0xe5166bdf
in al, 0xdf
imul edx, dword [esi], 0xffffffe5
jp 0x4b03db
adc dh, ah
push ds
out 0x1e, al
inc eax
inc ebx
sub dword [ebp + 0x2eb6be7a], edx
or dh, bh
fistp dword [edi - 0x42a02985]
xlatb
invalid
int 0xa4
pop esi
inc edi
mov esp, 0xb73bcafe
enter 0x4d97, 0x72
ror dword [esi + 0x42d51279], cl
dec ebx
cli
and byte [eax + 0x3a510f9a], bh
lodsd eax, dword [esi]
lodsd eax, dword [esi]
shr dword [eax + 0x293ebfb2], cl
in al, dx
mov ecx, 0xbe96a319
in eax, dx
loop 0x4b04de
sbb al, 0x18
push cs
stosd dword es:[edi], eax
invalid
adc al, 0x63
and dword [ecx + 0x5ca39c2a], ebp
xor eax, 0x7e9c245
aad 0xcc
push edx
inc esp
jnp 0x4b0474
xor eax, 0x3c3fd93d
fxch st(5)
inc esp
out 0xc8, al
fsub qword [edi + eax*8]
cmp al, 0x4e
movsb byte es:[edi], byte [esi]
hlt