joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1c77
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x549978
call fcn.0054565c
sub esp, 0xc4
push ebx
push esi
mov esi, edx
push edi
mov dword [ebp - 0x20], esi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xb
ja 0x4d1e9f
loope 0x4d1ca9
cmp byte [esp + edi*4], 0xa1
jno 0x4d1d1e
cmp eax, 0x7d9f00d3
and ch, byte [esp + edx]
rol dword [eax], cl
lahf
jge 0x4d1cd0
sub al, 0x14
ja 0x4d1d1a
neg byte [0x145cd662]
aas
cmp cl, byte [ecx + 0x497eaeca]
add eax, 0xa30fbf71
retf
xor byte [0xdfb4acaa], dh
inc edi
dec eax
int 0x16
popal
cli
in eax, dx
dec edi
sub dword [edi - 0x323cfb24], eax
or dh, byte [ebp + 0x2d24ef3f]
retf
fcmovb st(0), st(6)
in al, dx
xor cl, dh
int1
cmc
inc ecx
ret
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp dword [esi + 8], ecx
jle 0x4d1ffa
mov eax, dword [esi + 0xc]
mov edx, 0x55cfd8
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x24], eax
mov ecx, dword [eax]
call fcn.004c4983
test eax, eax
jne 0x4d1ee3
cmp byte [ebx + 0x2c], al
je 0x4d1fea
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x2c], al
mov eax, dword [ecx]
push 1
push 0
call dword [eax + 4]
jmp 0x4d1fea
mov esi, dword [ebp + 8]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
push 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call fcn.0040de7a
mov ecx, dword [ebp - 0x24]
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x4c]
call fcn.004d200f
pop ecx
test al, al
je 0x4d2009
cmp dword [ebp - 0x14], 0
jne 0x4d1f44
cmp byte [ebx + 0x2c], 0
je 0x4d1fda
mov eax, dword [ebx + 0x24]
push 7
mov edi, dword [eax]
add edi, 0x64
pop ecx
lea esi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
jmp 0x4d1fda
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
cmp ax, 0x21
jne 0x4d2009
lea ecx, [ebp - 0xd0]
call fcn.0040eb91
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.0040e610
push 1
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00410498
mov byte [ebp - 4], 3
cmp dword [ebp - 0x2c], 0
je 0x4d2009
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0xd0]
call fcn.0040ebec
push 7
pop ecx
lea esi, [ebp - 0x4c]
lea edi, [ebp - 0x6c]
lea eax, [ebp - 0xd0]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x18]
call fcn.00410d2a
push dword [ebp - 0x30]
call fcn.00418a9a
pop ecx
lea ecx, [ebp - 0xc4]
call fcn.0040e76c
push dword [ebp - 0xd0]
call fcn.00418a9a
pop ecx
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x18]
call fcn.00418a9a
mov esi, dword [ebp - 0x20]
pop ecx
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [esi + 8]
jl 0x4d1ead
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
call int.004d41c2
int3
Function at 0x4d2de6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x5499d0
call fcn.0054565c
sub esp, 0x2c
push ebx
push esi
mov ebx, edx
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x2b
ja 0x4d300c
shrd dword [edx], edi, 0x8e
pop es
jmp 0x190e5f65
xor esi, esi
mov dword [ebp - 0x18], esi
cmp dword [ebx + 8], esi
jle 0x4d3115
mov eax, dword [ebx + 0xc]
xor edi, edi
mov ebx, dword [eax + esi*4]
cmp dword [ebx + 4], 2
jl 0x4d3124
mov eax, dword [ebx]
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
cmp ax, 0x52
jne 0x4d307d
push 0x55cf14
lea ecx, [ebp - 0x34]
inc edi
call fcn.0040e479
mov ecx, dword [ebx]
push 0
movzx ecx, word [ecx + 2]
push ecx
mov ecx, eax
call fcn.00410570
mov esi, eax
push dword [ebp - 0x34]
call fcn.00418a9a
pop ecx
mov ecx, esi
call fcn.004d3f9b
test esi, esi
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
js 0x4d3083
push 2
pop edi
jmp 0x4d3083
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [edi + 2]
cmp dword [ebx + 4], eax
jl 0x4d3124
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
call fcn.00410498
and dword [ebp - 4], 0
mov eax, dword [ebx]
cmp word [eax + edi*2], 0x21
jne 0x4d30be
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 8]
lea edx, [ebp - 0x28]
call fcn.004d3ac7
jmp 0x4d30f6
cmp word [eax + edi*2], 0x40
jne 0x4d30de
push dword [ebp + 0x10]
mov edx, dword [ebp - 0x28]
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.004d3812
add esp, 0xc
jmp 0x4d30f8
cmp word [eax + edi*2], 0x23
jne 0x4d3124
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 8]
lea edx, [ebp - 0x28]
call fcn.004d312a
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x28]
call fcn.00418a9a
mov ebx, dword [ebp - 0x1c]
inc esi
pop ecx
mov dword [ebp - 0x18], esi
cmp esi, dword [ebx + 8]
jl 0x4d301a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
call int.004d41c2
int3
Function at 0x4d41c2
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x1c
ja 0x4d43d0
in eax, dx
fdivrp st(4)
push 0x234a5d95
and cx, word [edx - 0x686b5013]
out 0xa0, al
insb byte es:[edi], dx
dec esp
push ecx
add ah, byte [ebp - 0x65da6835]
adc cl, byte [edi - 0x32f93e7]
and byte [ebp + 0x1b645876], ah
nop
shl dh, 1
sbb byte [esi - 0x71], dl
mov bh, 0xb7
jle 0x4d4240
push 0xffffffffffffff91
push ebp
int 0xc9
cdq
push cs
insd dword es:[edi], dx
mov dword [ebp + 0x5a], 0x39efb6df
invalid
fcompi st(4)
mov ecx, 0x933d0f8e
and ebp, dword [0xcd0fce90]
les edi, [edx]
not ecx
shr byte [esi + 0x25], 0x2f
xor ebp, dword [edi + 0x1385f5d8]
fimul word [edx + 0x3665e50d]
test byte [edi + ecx - 0x1c], cl
mov ecx, 0x87274428
cmp eax, 0x93047ccc
popfd
iretd
mov ecx, str.Incorrect_command_line
jmp fcn.004d43da
Function at 0x4d51fd
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3a
ja 0x4d540e
cld
dec ecx
test eax, 0x3c7b9823
invalid
mov ecx, dword [esi]
pop esi
sub ecx, 3
je 0x4d541d
push 2
pop eax
sub ecx, eax
jne 0x4d541f
xor eax, eax
ret

Function at 0x4d5df4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x42
ja 0x4d6012
jg 0x4d5e27
out 0xeb, eax
invalid
jno 0x4d5e57
add byte [ebx - 0x7eb730fc], bl
pop ebx
jmp 0x4d5e04
inc ebp
mov bl, byte [edx + 0x3d]
or esi, esi
sub eax, 0x95ace1bd
sub esp, esi
invalid
xor eax, eax
mov edx, eax
mov edi, eax
cmp dword [ebp + 0xc], eax
je 0x4d60d9
mov esi, dword [ebp + 8]
mov cl, byte [edi + esi]
inc edi
cmp cl, 0x80
jae 0x4d603e
test ebx, ebx
je 0x4d6038
movzx eax, cl
mov word [ebx + edx*2], ax
inc edx
jmp 0x4d60d0
cmp cl, 0xc0
jb 0x4d60e6
xor esi, esi
inc esi
cmp cl, byte [esi + 0x557db8]
jb 0x4d6058
inc esi
cmp esi, 5
jl 0x4d604a
movzx eax, byte [esi + 0x557db7]
mov ebx, dword [ebp + 8]
movzx ecx, cl
sub ecx, eax
cmp edi, dword [ebp + 0xc]
je 0x4d6086
mov ah, byte [edi + ebx]
mov al, ah
sub al, 0x80
inc edi
cmp al, 0x3f
ja 0x4d6086
movzx eax, ah
add eax, 0xffffff80
shl ecx, 6
or ecx, eax
dec esi
jne 0x4d6067
mov ebx, dword [ebp - 4]
mov eax, 0x10000
cmp ecx, eax
jae 0x4d609d
test ebx, ebx
je 0x4d609a
mov word [ebx + edx*2], cx
inc edx
jmp 0x4d60cd
sub ecx, eax
cmp ecx, 0x100000
jae 0x4d60e6
test ebx, ebx
je 0x4d60ca
mov eax, ecx
shr eax, 0xa
sub eax, 0x2800
and ecx, 0x3ff
sub ecx, 0x2400
mov word [ebx + edx*2], ax
mov word [ebx + edx*2 + 2], cx
add edx, 2
mov esi, dword [ebp + 8]
cmp edi, dword [ebp + 0xc]
jne 0x4d6024
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [ecx], edx
pop ebx
leave
ret
xor eax, eax
jmp 0x4d60dc
Function at 0x4d6959
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x9d2b1c1f
pop esp
push cs
xchg esi, eax
rcr byte [edi + 0x29074deb], 1
add byte [ebx], dh
and esp, dword [eax + 0x3607ede2]
cmpsd dword [esi], dword es:[edi]
or byte [ecx - 0x6db32a7], bh
and dword [edi], ebx
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3d
ja 0x4d6b72
jae 0x4d69f2
jp 0x4d691f
popal
pop ecx
mov ebp, 0x3ea82380
rcl dword [ebp + 0x6e], 0x18
ljmp 0xc56d
invalid
sbb esp, dword [edi - 0x4335be2a]
je 0x4d6a06
jns 0x4d6a53
stosb byte es:[edi], al
inc eax
jecxz 0x4d69ad
sub dh, byte [ecx + 0x79]
mov esp, 0x69562611
js 0x4d69e7
jne 0x4d6a24
inc ebp
retf
cmp al, 0xae
pop ecx
cmp ecx, 0x67
cwde
enter 0xffffffffffffc761, 0xfffffffffffffff2
mov ch, dh
in al, dx
pushal
in eax, dx
add byte [eax - 0x29], cl
pop ds
fcomp qword [edx + 0x1df4eb70]
invalid
mov al, byte [0xd114cebe]
sbb ebp, dword [edi]
int3
neg dword [edi]
push ds
in al, dx
xchg ebx, eax
sbb al, byte [ebx]
sti
push 0xffffffffffffffc6
cmpsd dword [esi], dword es:[edi]
pop ebx
test eax, 0xcbc2932
mov dh, 0xd8
inc edi
jmp 0x707fba30
or al, 0x44
jno 0x4d6a36
push edi
and dword [ebx - 0x42], edx
push 0xffffffffffffffcf
rcl edi, cl
mov word [ebx - 0x6b], ds
mov dword [0xfa7f6838], eax
xor eax, 0xbb8e31af
cwde
inc ebp
and bh, dl
or edx, ebp
hlt
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
test edx, edx
je 0x4d6b9b
test cl, 3
je 0x4d6b98
movzx eax, byte [ecx]
xor eax, ebx
and eax, 0xff
shr ebx, 8
xor ebx, dword [esi + eax*4]
inc ecx
dec edx
jne 0x4d6b7f
mov dword [ebp - 4], ecx
cmp edx, 4
jb 0x4d6bed
push edi
mov edi, edx
shr edi, 2
xor ebx, dword [ecx]
sub edx, 4
mov ecx, ebx
shr ecx, 8
and ecx, 0xff
mov eax, ebx
mov ecx, dword [esi + ecx*4 + 0x800]
shr eax, 0x10
and eax, 0xff
xor ecx, dword [esi + eax*4 + 0x400]
movzx eax, bl
shr ebx, 0x18
xor ecx, dword [esi + eax*4 + 0xc00]
xor ecx, dword [esi + ebx*4]
mov ebx, ecx
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
dec edi
jne 0x4d6ba6
pop edi
test edx, edx
je 0x4d6c05
movzx eax, byte [ecx]
xor eax, ebx
and eax, 0xff
shr ebx, 8
xor ebx, dword [esi + eax*4]
inc ecx
dec edx
jne 0x4d6bf1
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x4d730f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], ecx
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
cpuid
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 7
rcl byte fs:[eax + eax - 0x7d]
clc
pop es
ja 0x4d738f
jns 0x4d72da
pushal
add al, 0xe5
enter 0xffffffffffff8bb8, 0xffffffffffffffd7
xchg edi, eax
sahf
daa
bound ebx, qword [ebx]
loopne 0x4d7384
stc
dec edi
sahf
daa
fidiv word [edi + 0x44dc3c5f]
pop esi
lea edi, [ecx]
js 0x4d7382
push ecx
out 0xca, eax
pop ebp
pop ecx
cli
dec esp
in eax, 0xdd
pop edi
mov esp, dword [ecx]
jnp 0x4d7335
retf 0x595d
mov bh, 0x95
jge 0x4d735f
add al, 0xb2
pop ebx
test dword [edi - 0x11], 0x1c052a80
push ecx
inc ecx
rep insb byte es:[edi], dx
add dword [ecx + esi*8], esi
sub eax, 0x7764cad1
dec ebp
ror edx, 1
ja 0x4d73d4
mov al, ah
mov cl, 0xce
mov edi, 0x8b480e46
inc ebp
clc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
pop esi

Function at 0x4da168
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x5f
ja 0x4da379
dec edi
clc
xor ah, 0x1f
neg byte [ebp + 0x59a49d94]
dec edi
fmulp st(3)
loop 0x4da1c8
lodsb al, byte [esi]
adc ebp, dword [ecx]
mov ch, 0x9e
imul esp, edx, 0xb375f89b
invalid
stc
insd dword es:[edi], dx
pop ss
mov dh, 0xf5
sbb dh, byte [ecx - 0x3d]
mov eax, 0x8e05a64c
xor al, 0xf0
pop esi
and edx, esp
hlt
mov ecx, dword [esi + 0x34]
push str.Scanning
call fcn.004b9adc
xor eax, eax
pop esi
ret

Function at 0x4db41f
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x47
ja 0x4db62d
invalid
call fcn.004bb96e
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x80004004
ret
Function at 0x4e2b93
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x24
ja 0x4e2daa
push ecx
sahf
sbb byte [esi], dh
sub byte [ecx - 0xee0534a], ah
add byte gs:[0xbc39ff8b], bh
int 0x3b
sal byte [edx - 0xeea8b78], 0x56
lodsd eax, dword [esi]
shr dword [ebx], 0x2e
ror dword [edx + ebx*2 + 0x5eef4135], cl
xlatb
xor eax, 0xd75eef41
mov cl, ah
call 0x98ab9def
and edi, dword [0x2d2c626b]
sal byte [esi], 0x74
inc esi
fsubrp st(0)
test eax, 0x712df154
das
add ecx, dword [edi + 0x46]
outsd dx, dword ds:[esi]
add byte [edx + edi + 0x34c0f098], 0xda
rcr byte [edx + ebx*8 - 0x3f], cl
fstp dword [eax - 0xa]
jns 0x4e2bcc
imul esi, dword [edi], 0xffffff86
jb 0x4e2c58
xor al, 0xb5
mov dl, 0x69
scasb al, byte es:[edi]
push ebx
stc
js 0x4e2c23
pushfd
fmul st(7), st(0)
dec esi
jbe 0x4e2c13
call dword [ebp + 0x5d3560b4]
pop ebp
movsd dword es:[edi], dword [esi]
call 0xbd23cb1a
xchg ebp, eax
mov ah, 0x60
xor eax, 0xe8a55d5d
cli
sahf
aad 0xbc
xchg ebp, eax
sal dword [ebp + 0x6f], 1
outsd dx, dword [esi]
std
push ebp
test byte [edi + 0x7420e4d7], 0xd0
pushal
mov ah, 0xe1
dec edi
rcr ah, 1
stc
aad 7
dec edi
dec esi
jle 0x4e2c95
mov edx, 0x194dbb2e
wait
adc al, 0x9f
dec esi
rcr byte [edx + 0x1e321669], 0x8c
loop 0x4e2cc5
mov byte [0xdc5e251], al
push eax
bound ecx, qword [ebx]
and edx, dword [ecx - 0xd4cc9a7]
or eax, 0x230b6250
xchg ecx, eax
pop ecx
mov bl, 0xf2
aas
lodsd eax, dword [esi]
adc cl, al
and byte [0x7cefc9c9], bl
mov ebp, dword [edx]
sbb al, 0x48
push 4
push 0xf9fc4a10
xchg ebp, eax
and ebp, dword [ecx - 0x5be4cf0d]
wait
scasb al, byte es:[edi]
jl 0x4e2caf
and eax, esp
jne 0x4e2c52
shl eax, 1
std
loopne 0x4e2c80
mov bh, 0x87
xchg ecx, eax
scasd eax, dword es:[edi]
invalid
mov eax, 0x858ede6
salc
mov esi, 0x9cb8983a
push ebp
imul ebx, dword [ecx], 0x2f
mov edi, 0x4ddff008
ret
pushfd
or ch, byte [esi]
add eax, 0x4e2b6243
pushfd
add dl, byte [ebx - 0x29eaff7e]
test ebx, edx
inc esi
cmp edx, 0x3f
call 0x38168fff
ret 0x278a
cmp word [esi], 0x40
jne 0x4e2e01
add esi, 8
mov ecx, esi
call fcn.004e2e17
test eax, eax
jne 0x4e2def
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
jne 0x4e2dd6
mov dword [ebp - 4], str.FileTimeToLocalFileTime_error
jmp 0x4e2e08
push ecx
push ecx
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0xc]
call fcn.005191e4
pop ecx
pop ecx
test al, al
je 0x4e2def
lea eax, [ebp - 0x2c]
push eax
jmp 0x4e2df4
push 0x55defc
mov ecx, 0x578890
call fcn.004b9adc
pop esi
leave
ret
mov dword [ebp - 4], str.incorrect_item
push 0x564d10
lea eax, [ebp - 4]
push eax
call fcn.0041f140
int3
Function at 0x4e8608
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x1b
ja 0x4e881b
test ebp, esp
push esi
add esi, eax
jle 0x4e866a
inc ebp
sub eax, 0xc4246ffc
xlatb
cmp al, bh
inc dword [esp + edx*8 - 0x4a]
aam 0xb6
dec ebp
or bh, al
in al, 0x8a
cmpsb byte [esi], byte es:[edi]
xlatb
stosb byte es:[edi], al
sub eax, 0xdc56911e
aaa
or edx, edx
out 0xda, eax
push ds
ficomp dword [esi]
in al, 0xd
xchg edx, eax
mov edx, 0xd88fda0e
mov bl, 0x33
invalid
xlatb
and esp, dword [edx + 0x6d]
ficom dword [ebp - 0x71]
dec edi
jbe 0x4e862e
cld
jge 0x4e8642
cmp si, word [eax]
mov byte [0xfa459c46], al
mov edx, 0x396eb811
aas
cmp edx, ebp
sbb ebx, eax
push ebp
sbb eax, 0xd1a59ebe
stc
das
jo 0x4e86c5
fcmovne st(0), st(4)
or cl, byte [edi - 0xe]
arpl si, si
mov ch, 0x82
mov cl, 0x4f
and edx, dword [edx]
mov ch, 0x66
mov al, 0x2a
lodsd eax, dword gs:[esi]
push ds
pop esp
lahf
aam 0x69
and dword [edx + 0x31], 0x653e459c
call 0xf78b90a0
cmp ah, dl
salc
or dword [0xd6d438f7], edi
jle 0x4e86ac
sbb eax, 0x47131205
cmc
cmp al, 0xde
inc edi
adc cl, bh
test al, 0x9f
jns 0x4e8705
nop
ret 0x3d99
inc ebx
not ebp
pop es
jl 0x4e86b7
mov byte [bx + 0x13c7], dl
invalid
cmp dword [ebx + 0x3bca8], 0
jne 0x4e8832
mov ecx, ebx
call int.004e9de2
mov ecx, ebx
call fcn.004ea136
mov ecx, dword [ebx + 0x325a0]
mov eax, dword [ebx + 0x31934]
xor edi, edi
inc edi
mov edx, edi
shl edx, cl
dec eax
lea esi, [ebx + 0x30ea0]
push esi
lea ecx, [ebx + 0x32c14]
mov dword [ebx + 0x3bc60], eax
mov dword [ebx + 0x37418], eax
call int.004ed194
mov ecx, dword [ebx + 0x325a0]
shl edi, cl
push esi
lea ecx, [ebx + 0x3745c]
mov edx, edi
call int.004ed194
pop ecx
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x4ed429
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push esi
movzx esi, word [ecx]
mov eax, esi
shr eax, 4
mov dword [ebp - 8], ecx
mov eax, dword [ebx + eax*4]
movzx ecx, word [ecx + 2]
mov dword [ebp + 0x10], eax
mov eax, ecx
mov dword [ebp - 4], edx
mov edx, 0x7f0
shr eax, 4
xor esi, edx
mov eax, dword [ebx + eax*4]
shr esi, 4
xor ecx, edx
add eax, dword [ebx + esi*4]
shr ecx, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + ecx*4]
add eax, dword [ebx + esi*4]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x4b
ja 0x4ed680
add byte [ebp + 0x7f343c9d], ah
stc
movsd dword es:[edi], dword [esi]
popfd
cmp al, 0x34
jg 0x4ed480
lodsb al, byte [esi]
popfd
pop edx
invalid
xor esi, esi
cmp esi, dword [ebp + 8]
jae 0x4ed724
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push ebx
push esi
shl eax, 4
add ecx, 4
push 3
add ecx, eax
pop edx
call fcn.004edcb8
add eax, dword [ebp + 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, 8
jb 0x4ed682
cmp esi, 0x10
jae 0x4ed6f2
mov ecx, dword [ebp - 4]
shl ecx, 4
mov dword [ebp - 4], ecx
cmp esi, dword [ebp + 8]
jae 0x4ed724
push ebx
lea eax, [esi - 8]
push eax
mov eax, dword [ebp - 8]
add eax, 0x104
push 3
add ecx, eax
pop edx
call fcn.004edcb8
add eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx + esi*4], eax
mov ecx, dword [ebp - 4]
inc esi
cmp esi, 0x10
jb 0x4ed6c2
cmp esi, dword [ebp + 8]
jae 0x4ed724
mov ecx, dword [ebp - 8]
add ecx, 0x204
mov dword [ebp + 0x10], ecx
push ebx
lea eax, [esi - 0x10]
push eax
push 8
pop edx
call fcn.004edcb8
add eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx + esi*4], eax
mov ecx, dword [ebp + 0x10]
inc esi
cmp esi, dword [ebp + 8]
jb 0x4ed703
pop esi
pop ebx
leave
ret
Function at 0x4edcb8
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0xc
js 0x4edc21
ret 0xd8f7
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, ecx
inc eax
mov ecx, edx
push esi
mov esi, dword [ebp + 8]
shl eax, cl
push edi
xor edi, edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x62
ja 0x4ededc
sahf
jp 0x4edd13
or esp, dword [ebx + ebp*8 + 0x50b1ff97]
add ebp, dword [edx]
and ebx, dword [ebp - 0x17]
xchg byte [esi], bl
jl 0x4edc92
pop esp
fcmovne st(0), st(3)
popal
bound eax, qword [ebx + 0x63]
mov bp, 0x74e0
mov al, 0x44
push ds
test byte [ebx - 0x44], ah
inc eax
mov ebx, 0x9af78625
rcl byte [edx + 1], 0x75
xchg dword [edi + ebp*8], esi
cmp al, 0xfb
sub al, 2
xor dword [esi - 0x4851f3c5], edi
add dh, byte [ecx]
mov esi, 0xb7ae0c3b
inc eax
imul edx, dword [ebx + 0x3e14c254], 0xafd3af8c
jo 0x4edcc7
push 0xffffffffffffffea
add bl, byte [edi + 0xe]
popfd
dec ecx
cmpsd dword [esi], dword es:[edi]
sbb al, 3
movsd dword es:[edi], dword [esi]
sub cl, byte [ebx]
or byte [ecx - 0x28], ah
mov al, byte [0x605f87ae]
scasd eax, dword es:[edi]
clc
out dx, al
dec ebx
mov ebx, 0x96e5c73f
aam 0xdb
jb 0x4edd25
sbb dword [ebp - 0x11d57aee], 0x64ce8379
das
push esp
les ecx, [eax + 0x4245d4ef]
dec esi
push esi
sub edx, dword [ecx + 0x7ff8f29d]
mov edx, dr3
push ebp
pop ds
xchg dword [esi + 0xb], ebp
sub al, 0xf
add al, byte [edx]
cmp ax, 0xf61f
out dx, al
rol byte [edi - 0x4b8c6d2], 0xf5
mov dh, 0x96
add byte [esi - 0x50], cl
invalid
cmp esi, 1
je 0x4edf06
mov eax, dword [ebp + 0xc]
mov edx, esi
and esi, 1
shr edx, 1
neg esi
movzx ecx, word [ebx + edx*2]
sar esi, 4
and esi, 0x7f
shr ecx, 4
xor ecx, esi
mov esi, edx
add edi, dword [eax + ecx*4]
cmp esi, 1
jne 0x4edee4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4edf0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
inc ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x50
ja 0x4ee12b
movsd dword es:[edi], dword [esi]
je 0x4edf8c
push eax
pop esi
mov ch, 0xa0
mov edi, 0xb05926b0
retf
rol dword [0xf44e6e98], cl
loop 0x4edfc5
sbb dword [edx + 0x115122bc], ebp
wait
invalid
lodsb al, byte [esi]
mov ah, byte [ecx + 0x73f7fdfb]
jb 0x4edfa2
cmpsb byte [esi], byte es:[edi]
or al, 0xfa
mov ebx, 0xadccde09
cmp ebp, dword [edi - 0x1a]
cmp dword [ebp + ebx*2 - 1], ecx
xchg cl, bl
lahf
shr dh, 0xdf
or eax, 0x23d0a731
pop ebp
inc dword [esi - 0x113f6027]
fisttp word [0x23d0a731]
jb 0x4edf54
out 2, eax
stosd dword es:[edi], eax
mov ah, 0xb9
mov bh, 0x45
hlt
push edx
add cl, byte [esi]
push cs
push es
ja 0x4edfce
jmp 0x4edfc3
mov ebp, 0x4207a3e0
adc byte [edi], dl
fidivr dword [ebp - 0x7e]
lcall 0x8698, 0x892ff60b
sbb al, 0x2c
mov ch, 0x5e
inc esp
frstor dword [ebx + 0x4c]
shr byte [ebp + 0x44], cl
cmp dl, byte [ebx + eax*8 - 0x39520752]
invalid
mov edi, dword [ebp + 8]
test edi, edi
jle 0x4ee15b
mov eax, dword [ebp + 0xc]
push esi
Function at 0x4ee3ad
Capabilities:
Encode data using xor

Disassembly:
push dword [ebp - 0x23]
pop esi
pop edi
pop ebx
leave
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], ecx
xor ebx, ebx
mov edi, pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x27
ja 0x4ee5ce
add al, 0xb
loope 0x4ee3a5
adc eax, 0xfb8673b9
add al, 0x5b
cmp dword [esi + 0x3d], edi
retf 0x437d
mov edx, dword [ebp + 8]
or esi, edi
add edx, edx
mov ecx, edi
and ecx, edx
add ecx, edi
mov eax, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, esi
shr eax, 7
and eax, 1
neg eax
shr ecx, 4
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add esi, esi
add ebx, dword [eax + ecx*4]
mov ecx, esi
xor ecx, edx
not ecx
and edi, ecx
cmp esi, 0x10000
jb 0x4ee5d3
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x4eeac8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, pe_nt_image_headers32
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
or esi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x46
ja 0x4eecee
out dx, al
inc ebx
dec eax
mov eax, dword [0x8116520d]
iretd
mov ebx, dword [ebp + 0xc]

Function at 0x4f163a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x31
ja 0x4f1851
or eax, 0x930d063f
and byte [edx - 0x36], cl
push dword [ecx]
pop esp
pop es
xor bl, byte [esi]
dec eax
outsd dx, dword [esi]
mov bh, 0x93
adc eax, 0x9ea4f9ba
das
mov bl, 0x6d
popfd
test eax, 0x965309f5
pop ecx
mov byte [0xca266581], al
lcall 0x9f35, 0x309606a3
and eax, 0x30b846b6
rol byte [ebp + ebx*4 - 0x3a73311d], 1
jmp 0x4f1700
and eax, 0xc9106cb0
push ds
dec ebx
xor ch, byte [eax + 0x79]
fnclex
jbe 0x4f173a
push 0x589ac48d
dec esi
or al, 0x61
popal
push esi
retf
add bh, byte [ecx + 0x40d40910]
ret 0x854
push ecx
push ecx
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.004e8145
add esp, 0xc
test eax, eax
jne 0x4f1873
mov edx, dword [ebp + 0xc]
mov ecx, esi
pop edi
pop esi
pop ebp
jmp fcn.004e7a34
pop edi
pop esi
pop ebp
ret