joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10362764
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
jmp 0x1029f1ca
call fcn.1005dcf4
add esp, 0x24
cwd
cdq
movzx edx, di
lea ecx, [ebp - 0x520]
push ecx
lea edx, [ebp - 0xa58]
jmp 0x1031fe88
push 0x104
jmp 0x1034075a
push ebx
jmp 0x10297eee
push edx
call fcn.1005dc8c
lea esp, [esp + 0xc]
cmc
neg ah
add al, 0xcf
push 1
movzx eax, bx
xor esi, esi
xchg ah, al
lea eax, [ebp - 0x520]
jmp loc.1000bdf0
push 0x12204710
call fcn.1036a8cc
push ebx
push ebx
lea eax, [ebp - 0x520]
jmp 0x1032b7a7

Function at 0x1036c1a8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
jmp 0x102e8519
push ebx
jmp 0x1040755f
call fcn.1040877d
push ebx
jmp 0x103a984f
push 0x834e977f
call fcn.102df9e1
call fcn.10346d29
add esp, 4
jmp 0x102eab33
push ebx
jmp 0x102dc067
push 0xffffffffffffffff
jmp loc.1000158a

Function at 0x1037ce61
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x92bb43f6
call fcn.103e904f
Function at 0x1038fe1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
call fcn.100273b0
add esp, 0x18
jmp 0x103a272d
push 0x1231008f
call fcn.1036a8cc
je 0x103a272d
lea edx, [ebp - 0x520]
movzx cx, cl
cwde
jmp 0x1043b923
push ebx
lea esi, [ebp - 0x60]
cmovge ax, cx
lea eax, [ebp - 0x520]
jmp 0x10012f11
push edx
lea eax, [ebp - 0x950]
xchg ecx, edx
push eax
mov dh, 0x10
movsx edx, sp
lea ecx, [ebp - 0x850]
movsx edx, dx
xchg dh, dl
movzx edx, ax
push ecx
mov dh, dl
push 3
seta dl
not dx
lea edx, [ebp - 0x18]
push 0x4d
jmp 0x101b5536

Function at 0x10390e36
Capabilities:
Check for software breakpoints

Disassembly:
jbe 0x1017bf91
call fcn.1005bdd8
mov eax, dword [0x1011d550]
and cx, di
mov ecx, dword [0x1011d54c]
cmc
cmp ah, 0xcc
test ebx, ebx
je 0x103364ae
cmp ebx, dword [0x1011d540]
jmp 0x103364a8
je 0x10456977
add esi, 4
cmp esi, edi
jmp 0x10456971
jbe 0x1029a2b0
call fcn.1005bdd8
mov eax, dword [0x1011d550]
movzx cx, cl
mov ecx, dword [0x1011d54c]
add ebx, 0x7b614bd2
mov ebx, dword [0x1011d540]
cmp sp, bx
mov dword [ebp - 8], ebx
cmc
mov dword [ebp - 4], esi
cmp di, di
cmp edi, 0x57fc16dc
cmp esi, edi
jmp 0x10438aa7
test edi, edi
jmp 0x102fed83
je 0x103e38b1
mov ebx, ecx
cmp ecx, eax
jbe 0x102fed98
call fcn.1005bdd8
mov eax, dword [ebp - 8]
test ch, 0x78
cmp ebx, esp
test eax, eax
je 0x103e389a
cmp eax, dword [0x1011d540]
jmp 0x103e3894
sub esp, 8
push ebx
cmc
push esi
cmp ebx, ebp
test cx, 0x4ea4
push edi
bt edi, ebp
bswap di
mov edi, eax
cmp cx, si
clc
cmp ecx, eax
jmp 0x10395ca4
setne dl
and di, cx
mov edi, edx
jmp 0x102dba7d
je 0x103364cb
call fcn.1005bdd8
mov eax, dword [0x1011d550]
sbb ecx, 0x39b2993
neg cx
mov ecx, dword [0x1011d54c]
stc
test cx, bx
sub edx, edx
sal dl, cl
xadd dl, dl
cmp esi, edi
not dl
jmp 0x103327bc
push ebp
cmp ebx, 0x7cfa7f4e
mov ebp, esp
bswap ax
mov eax, dword [0x1011d550]
add cl, 0x16
rcr ecx, 0x33
mov ecx, dword [0x1011d54c]
jmp 0x103265fd
jbe 0x10395cc0
call fcn.1005bdd8
mov eax, dword [0x1011d550]
btc cx, ax
mov ecx, dword [0x1011d54c]
sub esi, edi
mov esi, ecx
stc
jmp 0x103a39b3
cmp ecx, eax
jmp 0x1029a290
ret
je 0x103e389f
call fcn.1005bdd8
mov eax, dword [ebp + 0xc]
clc
test dl, dh
sub esi, ebx
sar esi, 2
bswap bx
xchg bl, bl
mov dword [eax], esi
mov eax, edi
not bx
movsx bx, ah
pop edi
movsx ebx, di
movzx esi, di
pop esi
pop ebx
mov esp, ebp
pop ebp
jmp 0x103d3550
je 0x10456977
mov edx, dword [ebp + 8]
clc
cmp dword [esi], edx
jmp 0x101a624a
jne 0x10438aad
mov edi, eax
cmp ecx, eax
jmp 0x1017bf74
Function at 0x103cad5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1005b430
lea esp, [esp + 8]
cmp edx, 0x17ae19ca
cmp dx, cx
test eax, eax
jne 0x103af717
lea ecx, [ebp - 0x1a4]
cdq
push ecx
lea edx, [ebp - 0x520]
push edx
jmp 0x1042e20e
call fcn.1031aeb9
add esp, 0x18
jmp 0x10367d9e
push 0x1001ac40
jmp 0x103712e8
call esi
lea ecx, [ebp - 0x3c8]
mov edx, 0x55623835
jmp 0x10316f4b
call esi
lea edx, [ebp - 0x19c]
push edx
lea eax, [ebp - 0x520]
push eax
jmp 0x101ce216
push ecx
lea edx, [ebp - 0x950]
jmp 0x100012ce
push 0x4d
jmp 0x103a97af
push ebx
push ebx
push ebx
jmp 0x1024b883
push ebx
push ebx
jmp 0x103d35b5
push eax
jmp 0x10239337
je 0x102e3ac0
lea eax, [ebp - 0x520]
push eax
not cl
xchg dl, ah
lahf
lea ecx, [ebp - 0x950]
cbw
not edx
jmp 0x103da13d
push 0x122ec00c
call fcn.1036a8cc
push eax
jmp 0x103d6e4a
call 0x1012a4cb
push eax
jmp 0x102e3abe
call 0x1037cce7
push edi
jmp 0x10312b7b
push ecx
lea edx, [ebp - 0x850]
bswap ax
push edx
push 6
mov ah, bl
cmovle eax, esi
movsx eax, ax
lea eax, [ebp - 0x18]
jmp 0x10352117
call fcn.1005b430
lea esp, [esp + 8]
cmp dh, bh
jmp 0x1044c636
test eax, eax
jmp 0x103af711
Function at 0x41b5da
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423448]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f080
and dword [ebp - 0x14], 0
cmp dword [0x43aed4], 0
mov dword [ebp - 0x18], eax
jne 0x41b68d
push 0x4042b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41b735
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4042a4
push ebx
call edi
test eax, eax
je 0x41b735
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x404294
push ebx
mov dword [0x43aed4], eax
call edi
push eax
call esi
push 0x404280
push ebx
mov dword [0x43aed8], eax
call edi
push eax
call esi
push 0x404264
push ebx
mov dword [0x43aedc], eax
call edi
push eax
call esi
mov dword [0x43aee4], eax
test eax, eax
je 0x41b68d
push 0x40424c
push ebx
call edi
push eax
call esi
mov dword [0x43aee0], eax
mov eax, dword [0x43aee0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41b6e6
cmp dword [0x43aee4], ecx
je 0x41b6e6
push eax
call esi
push dword [0x43aee4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41b6e6
test ebx, ebx
je 0x41b6e6
call edi
test eax, eax
je 0x41b6dd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41b6dd
test byte [ebp - 8], 1
jne 0x41b6e6
or dword [ebp + 0x10], 0x200000
jmp 0x41b719
mov eax, dword [0x43aed8]
cmp eax, dword [ebp - 0x18]
je 0x41b719
push eax
call esi
test eax, eax
je 0x41b719
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41b719
mov eax, dword [0x43aedc]
cmp eax, dword [ebp - 0x18]
je 0x41b719
push eax
call esi
test eax, eax
je 0x41b719
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43aed4]
call esi
test eax, eax
je 0x41b735
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41b737
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a4d0
leave
ret
Function at 0x41eca0
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1b08
call fcn.0041c480
cmp dword [0x8e5344], 0x37
push esi
jne 0x41ed9a
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
lea ecx, [esp + 0x30c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
call esi
push 0x4043e4
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
lea eax, [esp + 0xb0c]
push eax
push 0x404448
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea ecx, [esp + 0x130c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0xe8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
call esi
push 0x404490
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x28], 0
call fcn.00411cc0
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov edx, dword [0x8e7aa8]
mov dword [esp + 8], edx
mov eax, 0x5d1
add dword [esp + 8], eax
mov eax, dword [esp + 8]
mov cl, byte [eax + edi]
mov edx, dword [0x8e3b30]
mov byte [edx + edi], cl
pop esi
add esp, 0x1b08
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x6922047a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x57aa2a94
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul eax
not edi
rcl eax, 0xc6
rcr edx, 0xa4
ror ebx, 0xe2
rcr eax, 0x17
inc edx
dec esi
imul esi
bswap esi
add eax, 2
mov ebx, 0x82
inc esi
and edx, 0x1e
and edi, 0xac
not edi
bswap edx
imul ebx
dec edi
inc eax
dec edi
not edx
ror edi, 0x1c
dec esi
imul ebx
imul edx
neg ebx
not ebx
sbb esi, 0x34
inc edx
dec esi
rol edx, 0x6e
or esi, 0x6f
not esi
not esi
inc ebx
not eax
bswap edx
neg esi
bswap edi
inc eax
inc eax
neg esi
neg ebx
sub edi, 0x76
not esi
or eax, 0x18
rcr eax, 0x91
add edx, 0x8f
bswap edx
xor ecx, ecx
xor edi, edi
rol eax, 0xc
and eax, 0x36
add edi, 0xe0
not edi
imul ebx
not edi
sbb edi, 0x64
dec edx
sbb esi, 0xfa
bswap ebx
rol edi, 0xb7
neg esi
neg ebx
add edi, 0x9c
mov edx, 0xdd
rcl ebx, 0xba
rcr edi, 0xc3
not esi
inc eax
bswap edi
sbb eax, 0x7a
and esi, 0xd5
rcl edx, 0x29
inc edx
mov ebx, 0x43
neg ebx
ror edi, 0x4f
imul esi
rol eax, 0x4f
sub esi, 0xe6
rcr ebx, 0xe6
and esi, 0xe1
sbb esi, 0x89
or ebx, 0xec
inc eax
dec edi
ror esi, 0x17
inc eax
not eax
sbb eax, 0x4e
or edx, 0x44
imul ebx
sub ebx, 0x76
dec eax
neg edx
neg ebx
sbb edi, 0xc0
add ebx, 6
neg edx
dec eax
mov ecx, dword [ebp + 0xc]
imul eax
ror esi, 0xf5
ror eax, 0x9a
not edi
inc ebx
dec esi
sub ebx, 0xa8
rcl esi, 0xbb
and eax, 0xf2
dec esi
dec ebx
not edx
add edi, 0x91
rcl edi, 0xbb
add edx, 0xfc
dec ebx
dec esi
imul esi
rol ebx, 0x8f
neg eax
rcl eax, 0x26
bswap esi
neg esi
sub eax, 0xda
imul ebx
rcr ebx, 0xe7
inc eax
inc eax
neg edi
inc eax
sbb edi, 0x2b
sub eax, 0x83
rcl ebx, 0x58
add eax, 0xc9
inc esi
dec ebx
not ebx
sub edi, 9
bswap eax
sbb esi, 0xd9
imul edi
add eax, 0x5d
not edx
rol edx, 0x24
dec eax
neg ebx
rcl ebx, 0x13
inc edx
imul esi
rcr ebx, 0x75
mov edi, dword [ebp + 8]
xor eax, esi
mov eax, esi
xor ebx, eax
not byte [edi]
mov ebx, eax
xor eax, ebx
mov eax, esi
xor esi, esi
mov ebx, ebx
xor esi, eax
xor eax, eax
mov ebx, eax
xor eax, ebx
add byte [edi], 0x37
mov ebx, eax
mov eax, ebx
mov eax, esi
xor esi, ebx
xor esi, eax
xor ebx, esi
mov esi, ebx
xor ebx, esi
mov esi, eax
sub byte [edi], 0x75
xor ebx, eax
mov eax, eax
mov ebx, esi
xor ebx, ebx
xor eax, eax
mov eax, esi
mov ebx, eax
xor ebx, ebx
mov ebx, esi
imul byte [edi]
inc edi
loop 0x4013bd
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4060e3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404fce
and dword [ebp - 4], 0
cmp dword [0x463c60], 0
mov ebx, eax
jne 0x406194
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406245
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406245
push eax
call fcn.00404f5c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x463c60], eax
call esi
push eax
call fcn.00404f5c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x463c64], eax
call esi
push eax
call fcn.00404f5c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x463c68], eax
call esi
push eax
call fcn.00404f5c
pop ecx
mov dword [0x463c70], eax
test eax, eax
je 0x406194
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404f5c
pop ecx
mov dword [0x463c6c], eax
mov eax, dword [0x463c6c]
cmp eax, ebx
je 0x4061ec
cmp dword [0x463c70], ebx
je 0x4061ec
push eax
call fcn.00404fd7
push dword [0x463c70]
mov esi, eax
call fcn.00404fd7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061ec
test edi, edi
je 0x4061ec
call esi
test eax, eax
je 0x4061e3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061e3
test byte [ebp - 0xc], 1
jne 0x4061ec
or dword [ebp + 0x10], 0x200000
jmp 0x406225
mov eax, dword [0x463c64]
cmp eax, ebx
je 0x406225
push eax
call fcn.00404fd7
pop ecx
test eax, eax
je 0x406225
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406225
mov eax, dword [0x463c68]
cmp eax, ebx
je 0x406225
push eax
call fcn.00404fd7
pop ecx
test eax, eax
je 0x406225
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x463c60]
call fcn.00404fd7
pop ecx
test eax, eax
je 0x406245
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406247
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407f4e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x463408]
jne 0x407f58
repz ret
jmp fcn.00409675

Function at 0x408978
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
mov edx, dword [esp]
add esp, 4
call fcn.004089a7
sub esi, eax
or eax, eax
xor dword [edi], edx
inc edi
sub esi, 1
sub esi, 1
cmp edi, ebx
jne fcn.00408978
sub esi, eax
ret
Function at 0x40be73
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xa962b966
aaa
pop ebp
mov eax, 0xf135a8fb
imul edi, esp, 0x3b
inc ecx
mov edx, 0xc0e14380
jno 0x40bee2
imul byte [ecx + edx*4 + 0x14be6d2f]
mov esp, 0xc84e01d
invalid
sar dword [edx], cl
clc
sbb al, 0xc8
adc dword [ebx - 0x80], ecx
bound ecx, qword [ebx - 0x5f]
arpl word [eax + 0x2e], ax
inc ecx
mov al, byte [0x4c139993]
mov ch, 0x6c
popal
pop eax
movsb byte es:[edi], byte [esi]
std
dec esp
sbb eax, 0xc7e9d080
sbb edx, dword [edx + 0x51493dda]
call 0xf8637dab
cmp dword [edi - 0x738c2f87], 0x57
lds edi, [esi - 0x407c07de]
jns 0x40beba
jae 0x40be78
push edi
jl 0x40bf21
push ds
test dword [edx + esi*4 - 0x1e65b152], ecx
cwde
sbb ebp, ecx
jns 0x40bf36
stc
and dword [ecx], edi
push eax
invalid
cmp byte [0x35dd61c7], dl
mov eax, dword [esi]
mov byte [0x4fe1713e], al
int1
in eax, dx
mov edi, 0x49b13bba
adc esp, edx
xor edx, dword [eax - 0x29]
invalid

Function at 0x418c50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x4c5ef4
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x418c6d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDEA92A799_267E_4DF5_A6ED_6A7E0684BB8AVersionIndependentProgID
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0x4c71fc], eax
jne 0x418cea
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x4c5ef4
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0x4c71fc], eax
jne 0x418cd2
cmp dword [esp + 8], ebx
je 0x418cd4
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x418cea
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c71fc]
test ecx, ecx
jne 0x418d0d
test eax, eax
jle 0x418d08
and eax, 0xffff
or eax, 0x80070000
mov dword [0x4c71fc], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret

Function at 0x4285bb
Capabilities:
Encode data using xor

Disassembly:
push cs
push 0xffffffffffffff91
xchg ebx, eax
mov esi, 0x90b4a6b3
jecxz 0x4285d6
invalid
mov esi, 0x31d70a9f
or bh, byte [ebx - 0x56eccb32]
loope 0x428614
dec esp
xchg edi, eax
adc eax, 0x233c488a
cmp bh, byte [ecx - 0x1c492252]
pop ebx
xor dl, byte [esi - 0x29]
push esi
xlatb
jge 0x4285c7
xor al, 0xa3
adc dword [edi], ebp
das
repe scasb al, byte es:[edi]
popfd
fisttp word [eax - 0x7a]
sub eax, 0x1aeb90e7
pop eax
cmp dword [eax + 0x73252ff0], 0x51
int1
pop edx
aad 0x3b
pop edx
outsb dx, byte [esi]
in al, 0xf2
xor al, 0xab
aaa
jne 0x428582
inc eax
and ebp, dword [ecx]
in al, 0xce
invalid
cmp dh, byte [edx - 0x44]
dec esp
dec ebp
sub ch, byte [edx + 0x5ba7ba49]
insd dword es:[edi], dx
jae 0x42860f
cmp eax, 0xd17f99c3
mov byte [esi + 0x7c], dl
inc eax
mov ecx, ss
sti
int3
Function at 0x42c4c7
Capabilities:
Encode data using xor

Disassembly:
retf 0xfb2d
inc edx
push ecx
invalid
sti
loopne 0x42c492
dec edi
cmp bh, bl
jae 0x42c467
pop esi
pop ebx
adc ebx, dword [esi - 0x7267e337]
cmpsd dword [esi], dword es:[edi]
or esp, eax
dec esp
orps xmm6, xmmword [eax + edi*8 - 0x6b]
sal byte [ebx - 0x53b54402], 0xc5
pop ds
pop es
pushfd
mov ss, edi
mov al, 0xa1
jo 0x42c4e3
invalid
movsd dword es:[edi], dword [esi]
test al, 0x11
pop ebx
cmp dword [edi - 0x34], eax
aam 0x6b
add esp, edx
xlatb
int 0x8b
push ss
inc esp
xchg byte [esi + 0x54], ch
cmp dword [esi - 0x35ddff64], 0xd7488ac3
insd dword es:[edi], dx
sahf
adc eax, 0x8b8a1e36
hlt

Function at 0x46b8e3
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
in al, dx
push ds
sbb eax, 0x3a2ed202
mov dword [0x73557a45], eax
leave
in eax, 0xb6
inc eax
sub cl, dh
invalid
sbb bl, dl
outsd dx, dword ss:[esi]
mov edi, 0xe901eb72
outsd dx, dword [esi]
out dx, eax
dec edx
lcall 0xf39e, 0x5a75903
sbb al, 0xcb
aad 0x69
cli
mov eax, dword [0x8f597a5b]
xor bh, byte [edi - 0x1f]
and al, byte [esi]
pop edi
scasd eax, dword es:[edi]
mov edx, 0xe7b798e7
mov dh, 0x6f
leave
adc ch, byte [eax]
and eax, 0x5c048a6c
add al, 0x57
nop
nop
mov edx, gs
jp 0x46b8c1
sahf
dec esp
add al, 0x86
shr dword [esp + eax*8 - 0x14], 0x44
mov word [eax + 0x2e4088ac], cs
mov eax, dword [0x2c444cec]
or dh, al
or byte [esi - 0x5f7bd2b0], ah
dec ebp
fadd dword [edi + ebp*2 + 0x3bf17f04]
inc ebx
js 0x46b9a3
invalid
adc dword [esi], ebx
daa
push edi
cmp al, 0x63
xor ebx, edx
int1
fcom qword [0xb448d4f3]
pop ds
push es
xchg esp, eax
push 0x5fb41f6d
mov byte [edi], bl
test byte [ebx - 0x69], al
dec ebx
das
or al, 5
sbb byte [eax], dl
pop ebx
add al, 0x28
in al, 0x8c
xchg dword [ecx - 0x10], edx
iretd
Function at 0x470b56
Capabilities:
Encode data using xor

Disassembly:
or byte [eax], 0xab
ja 0x470b7c
test byte [ecx - 0x1f], ch
clc
imul esp, esp, 0x754897ff
and edi, dword [edi + 0x1472b6f3]
sub dword [edx + 0x2d08a18c], eax
les ebx, [esi]
lahf
add eax, 0x5db5f33d
das
mov ecx, 0x32ae36e6
sbb dword [edi - 0x1e43de35], edx
mov dl, 0x6f
or byte [eax - 0x27c27a64], bh
jge 0x470b84
add byte [esi], ch
hlt
loopne 0x470bd3
push 0xd0734a85
test eax, 0x945b3c8d
xchg ebx, edi
xor byte [eax + 0x3d], dh
movsb byte es:[edi], byte [esi]
mov ch, 0x46
out dx, eax
sti
aam 0x8a
aam 0xa4
mov cl, 0x4d
jle 0x470b87
insb byte es:[edi], dx
in al, dx
cmp al, 0x93
jnp 0x470b84
pop ds
and dword [edi + 0x7b], esi
ja 0x470bf9
ja 0x470b0d
adc eax, 0x5f443076
pop edi
sub eax, 0x9540fdbe
std
inc eax
xchg ebp, eax
add eax, 0x8d2113b6
dec ebx
nop
xchg ecx, eax
inc ebx
out 0x79, eax
xchg esi, eax
xchg ebx, eax
mov dword [esi - 0x17d17169], edi
xor dl, byte [ebx - 0x23f72d36]
popfd
shl ah, 1
test al, 0xcc
ror byte [eax], cl
fcomp qword [ebp - 0x33571b30]
pop es
fcmovne st(0), st(7)
dec edx
test al, 0x1d
cmc
sbb eax, 0x4d831a2e
xor al, 0xdb
imul ebp, dword [ecx + edx*2 - 0x505f1941], 0x3f
mov ch, cl
cld
jbe 0x470ba1
or bl, byte [eax + edi*2 - 0x7e]
leave
xlatb
dec eax
push dword [edx + 0x60]
fyl2x
adc dword [edx + 0xd], edi
das
jg 0x470c2f
or eax, 0xe3587f2f
sbb eax, 0xd3f47ea0
lodsd eax, dword [esi]
jecxz 0x470bf6
mov al, byte [0xadd3f47e]
int1
lcall 0x53aa, 0x50563027
std
xor eax, 0xf7b0827d
invalid
lodsb al, byte [esi]
cmc
or eax, 0xb0c25518
lahf
sbb byte [ebp - 0x3e], dl
mov al, 0x9f
sub eax, 0x2f5bedc
push cs
xor al, 0xdb
mov bh, 0x82
sbb eax, 0xbef92f86
cmp eax, 0x30648784
salc
cmp edi, dword [esi - 0x682db883]
mov edi, 0x13192d52
cmp eax, 0xca969366
imul eax, dword [ebx + eax*2 - 0x12a9d32c], 0x21245eed
push eax
sub dword [edi + 0x7b99c7ca], 0xe21a0a23
cli
xchg esi, eax
jnp 0x470cb8
sbb dh, dh
test al, 0xa4
and byte [ebx + 0x63213c73], 0x79
scasd eax, dword es:[edi]
mov ebp, 0x19acb09a
inc ecx
pop dword [edi + 0x1b471b9f]
cdq
sub eax, 0xc61b5ab4
or bl, byte [edi]
adc byte [eax - 0x1e], bh
sub al, 0x2b
invalid
inc ecx
inc esi
xchg byte [esp + esi*8], ah
sub eax, 0x69e686e1
out dx, eax
int3

Function at 0x488445
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x2c89aca8]
pop ds
mov al, byte [0xc5eb79a6]
inc esi
sbb byte [esi + 0x7553f2ba], ah
jb 0x4883db
add dword [edx + eax*8 - 0x1a], 0xc7a0bbae
invalid
Function at 0x48b0df
Capabilities:
Encode data using xor

Disassembly:
dec eax
jecxz 0x48b157
dec esp
rol dl, 0x66
sbb byte [edx - 0x4e0e809e], dh
add byte [edx], dl
mov eax, 0x5c5ace49
sti
push ebx
push 0xa3bc386b
pop ebp
inc edi
or eax, 0xf3c5eda8
push ds
ficomp dword [eax + 0xf7f4425]
inc esp
jg 0x48b118
pop ecx
out dx, al
xchg ebx, eax
mov ecx, 0xd25db8d0
inc ebx
mov dword [ecx - 0x5ee5fb2d], ebx
mov ebx, 0xa899cc08
jge 0x48b106
arpl word [edx + 0x67], dx
xchg ecx, eax
xor byte [edx], al
xchg edx, eax
and al, 0xd2
sub al, 0xd2
sbb al, 0xbe
xchg ecx, eax
in al, dx
movsd dword es:[edi], dword [esi]
aad 0xd9
add al, 0x6b
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
aad 0xab
rcl dword [edx + 0x68], cl
pushal
push edx
inc edx
push ebx
not ebx
dec edx
salc
leave
stosd dword es:[edi], eax
pop ds
jecxz 0x48b1ba
popfd
mov word [ecx], es
mov ecx, 0x16fdb1c8
inc ecx
pop ebp
std
mov dword [esi - 0x38], ebx
test dword [ecx], edx
or al, 0xaa
adc dword [edx + ebp*4], ecx
inc ecx
cmp edx, dword [edi + esi*2 - 0x33706398]
jge 0x48b172
ja 0x48b1c7
pushfd
invalid
pop ebp
jecxz 0x48b14b
and cl, bh
fld st(0)
or dword fs:[esi + ebp*4 + 0x5092acd1], ebx
push eax
fdiv qword [ebp + 0x5e]
test ebp, esi
lodsb al, byte [esi]
pushfd
invalid
aaa
adc edi, dword [esp + ebx*2]
stosb byte es:[edi], al
xor dword [eax - 0x76bdd363], edi
add dl, al
or esp, dword [eax + 0x188c50b4]
inc ch
mov dword [eax + ebx + 0x66], edi
sub dl, ch
mov dh, 0x24
loope 0x48b211
jl 0x48b15d
invalid
jmp 0x8f927410