joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4097e1
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], esi
in al, 0x84
out dx, al
add bl, cl
cld
leave
lea edi, [0xea0edef2]
push ecx
inc edx
sbb eax, dword [edx - 0xc8c3be1]
mov esp, 0x88325fe4
mov eax, 0xa2c8ed7b
lodsd eax, dword [esi]
loopne 0x4097c4
sub dword [ebx - 0x1513c963], 0x7e23221b
insb byte es:[edi], dx
xor byte [ecx], 0xf0
sbb dword [edx], ebp
or dword [edi + 0x60133d09], ebx
pushfd
sahf
invalid

Function at 0x417c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4c6b5c]
push ebx

Function at 0x417c19
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
call dword [sym.imp.USER32.dll_HideCaret]
mov ecx, dword [0x4c6b5c]
or eax, 0x4c6b5c
push ecx
call sub.WINSPOOL.DRV_StartPagePrinter
sbb cl, byte [edx]
add byte [ebp - 0x44f7dbac], cl
add dword [eax], eax
add byte [eax], al

Function at 0x417c31
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
call dword [sym.imp.USER32.dll_HideCaret]
mov ecx, dword [0x4c6b5c]
or eax, 0x4c6b5c
push ecx
call sub.WINSPOOL.DRV_StartPagePrinter
sbb cl, byte [edx]
add byte [ebp - 0x44f7dbac], cl
add dword [eax], eax
add byte [eax], al

Function at 0x417c39
Capabilities:
Query or enumerate registry value

Disassembly:
push str.CLSID4be8a061_c73b_4f23_8114_317aae3e8698InProcServer32
push 0x80000000
add byte [eax + 0x1c2444c7], al
add byte [eax], al
add byte [eax], al

Function at 0x417c49
Capabilities:
Query or enumerate registry value

Disassembly:
push str.CLSID4be8a061_c73b_4f23_8114_317aae3e8698InProcServer32
push 0x80000000
add byte [eax + 0x1c2444c7], al
add byte [eax], al
add byte [eax], al

Function at 0x417c51
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [0x4c7f8c], eax
mov eax, dword [0x4c6b5c]
push eax
call dword [sym.imp.GDI32.dll_GetBkMode]
mov dword [esp + 4], eax
mov eax, dword [0x4c7f8c]
test eax, eax
jne 0x417cdc
push 0x4c6c6c
mov dword [esp + 8], 0
add byte [eax], al
add bh, al
inc esp
and al, 0x10
or byte [edx], al
add byte [eax], al
call fcn.004b96c4
add esp, 4
test eax, eax
je 0x417c97
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push 0x4c6c6c
push edx
push 0
push 0
add byte [eax - 1], dl
adc eax, sym.imp.ADVAPI32.dll_RegQueryValueExW
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c7f8c]
test ecx, ecx
jne 0x417cff
test eax, eax
jle 0x417cfa
and eax, 0xffff
or eax, 0x80070000
mov dword [0x4c7f8c], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret

Function at 0x417c79
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [eax], al
add bh, al
inc esp
and al, 0x10
or byte [edx], al
add byte [eax], al
Function at 0x431117
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub dword [ecx], ecx
push 0x8dcdc857
movsd dword es:[edi], dword [esi]
mov byte [edx + 0x21], dh
sub eax, 0x6af29bb8
inc edx
fdivr dword [ebp - 0x2d43538b]
xchg ebp, ecx
ficom dword [edi]
inc eax
outsb dx, byte [esi]
sub dword [edx], esi
shl byte [ebx], 1
adc cl, ch
sbb al, 0xa
cmp al, byte ss:[esp + eax*4 - 0x21b03a2]

Function at 0x431147
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
ljmp 0x8583:0x37607009
push edx
mov ah, 0xdb
imul esi, dword [ebx - 6], 5
scasd eax, dword es:[edi]
mov esp, 0x381abdf1
jae 0x4310dd
add eax, 0xbdf1bcaf
sbb bh, byte [eax]
cmp al, byte [esi]
cwde
cmc
sbb eax, dword [edi + 0x63ee4a15]
fistp dword [ebx - 0x34]
xchg edi, eax
mov edx, 0x5cd881c7
jmp 0x431082
or dh, byte [esi]
cmp al, byte [esp + eax*4 - 0x21b03a2]
mov ecx, 0x20cc0752
xor byte [ebx + 0x7a], cl
xchg esp, eax
and byte [eax], dh
dec ebx
jp 0x4310e1
add ah, ch
xchg ecx, eax
mov byte [ebp - 0x218dca09], bh
mov eax, dword [0xf53cbf7f]
sub al, 0x14
arpl word [edx - 0x4dd91197], ax
push ds
jnp 0x43113b
mov ch, dl

Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bd8c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd8c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test bl, bl
je 0x44b86d
or dword [esi], 0x6572a0
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x47bb88
Capabilities:
Encode data using xor

Disassembly:
sbb esi, dword [eax - 0x6d]
arpl si, dx
cmp ebx, esi
in eax, dx
or al, 0xad
imul ebp, dword [ebx - 0x6b9e007], 0xa6a37185
mov bl, 0x35
jb 0x47bbf4
test al, 0xa6
or al, 0x68
aaa
fist word [edx + 0x228173aa]
xchg dword [ecx], ebp
test byte ds:[0x69b8d17f], ah
jecxz 0x47bbee
cmp al, 0xa3
cmpsd dword [esi], dword es:[edi]
stosw word es:[edi], ax
inc ebx
wait
out dx, al
retf 0x3a03
salc
stc
and eax, 0xfe3f5b02
fst dword [esi]
cmp bl, ch
cli
mov ds, eax
xchg ecx, eax
cld
std
xchg esi, eax
sub dl, byte [ebp + ebp*8 + 0x5532b60c]
loop 0x47bc68
invalid
xor al, byte [edi + 0x22]
pushfd
lodsb al, byte [esi]
test esp, esi
mov dl, 0xf2
js 0x47bc70
jp 0x47bc48
sbb al, 0xa7
adc eax, 0xa54b4ced
push esp
aad 0xec
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
inc edx
sub ah, byte [ebx + 0x53]
push ebx
rcr dword [edx - 0x4c], 1
pop ecx
scasd eax, dword es:[edi]
ret
or ah, byte [esi]
or al, 0x59
adc dh, dl
xor dh, byte [esi - 0x74]
xor dh, byte [esi - 0x74]
into
js 0x47bcad
clc
and dword [ebx], ebx
aam 6
out 0xcc, eax
daa
jb 0x47bc90
stosd dword es:[edi], eax
mov dh, 0x42
push cs
push 0x3d1e7d56
stc
stosb byte es:[edi], al
add eax, 0xb5ed9dd7
mov edx, 0x6c890330
sbb byte [edx - 0x402d6f25], al
invalid
mov ch, 0xba
xor byte [ebx], al
mov dword [eax + ebx - 0x7e], ebp
fist dword [eax - 0x730f402e]
sal byte [0x82f646b6], cl
pop es
insb byte es:[edi], dx
or al, 0xbe
cmp esi, ebx
sub al, 0x4f
sub al, 0xe9
lodsb al, byte [esi]
out dx, eax
dec esp
cmpsd dword [esi], dword es:[edi]
pop esp
insb byte es:[edi], dx
jg 0x47bcbc
imul eax, dword [esi], 0xa
ja 0x47bc87
push es
or dh, byte [edi - 0xd]
or esp, dword [0x4788467a]
jl 0x47bcf1
cmp dh, byte [ebp + 0x37]
dec ebp
or edx, dword [ebx + edx - 0x6340997b]
dec edx
test eax, 0x71c31b93
in eax, 0x32
cwde
and al, 0x7f
pop esp
push es
fnstsw word [esi]
ja 0x47bc49
js 0x47bc43
rcr byte [ebp + 0x72], 1
lea ebp, [edx - 0x7f]
pop ebp
jb 0x47bc4c
push 0xffffffffffffff81
jae 0x47bce0
fnstcw word [esi + 0x548d2a5c]
popal
add al, 0x53
invalid
dec esp
inc ecx
or edx, dword [edi + 0x72b74043]
mov bh, 0x72
xor al, 0xc
clc
std
push ebx
invalid
push ebp
stc
jae 0x47bcda
sub edx, dword [0xd3b2da3c]
sbb al, 0xe6
or ch, byte [eax + 0x5c]
cmc
in al, dx
enter 0x699, 0xfffffffffffffff6
pop eax
sub eax, 0xc1ba8c77
and esi, dword [eax - 0x273e5fc2]
mov al, byte [0xf55fc826]
sti
jbe 0x47bd91
xchg dword [ecx + 0x3d], edx
salc
or eax, 0x51fb1622
xchg byte [ecx - 0x42], cl
mov word cs:[edx + 0x41], fs
dec byte [0x4a31b0fc]
into
cmp al, 0x63
pop esp
movsd dword es:[edi], dword [esi]
fdivr dword [ebx - 0x71]
call 0xdf75ab7d
and dword [ecx], 0x61
inc ebx
arpl word [eax - 0x6b], bx
invalid
retf

Function at 0x4b91b4
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x889465d2
and al, 0x56
test ch, bl
invalid
Function at 0x4d2ff5
Capabilities:
Encode data using xor

Disassembly:
push ds
pop ss
pop edi
wait
out dx, al
shl byte [edx - 0x56749df6], 1
sbb byte [esp + esi*4 + 0x783e693e], 0x9b
mov dword [0xa8fd9cb6], eax
xchg ebp, eax
std
test al, 0x95
fldcw word [esi]
mov ah, dl
sbb bl, byte [edi]
push 0xc21e74b9
movhps xmm5, qword [esi + 0x61]
cmp bl, bh
test byte [edi + ebx - 0x5e], al
and esi, dword [eax - 0x2c]
salc
or dh, 0xd7
lodsd eax, dword [esi]
lds ebx, [edx + 0x3c6406e3]
push edi
mov word [edi + 0x50], fs
lodsb al, byte [esi]
mov bh, 0x84
mov byte [0x18246d14], al
xor al, 0xc4
mov bl, 0xb9
in eax, dx
cmp eax, 0x9ea2703f
test al, 0xff
jl 0x4d300d
js 0x4d3083
cwde
jo 0x4d30c7
mov cl, 0x66
mov al, 0x44
push ds
xchg edx, eax
pop esp
call 0x11043be
sub eax, 0xa9824f06
test dword [ebp + edi*4 - 0x444f0e52], eax
call dword [eax - 0x26]
cmp cl, byte [esi + 0x36]
idiv byte [edi + 0x72]
xchg ecx, eax
mov bh, 0x25
into
mov ch, 0x26
inc edi
push ebp
sub dword [esi + 0x6af4df25], eax
je 0x4d300c
out dx, eax
mov esi, 0x4b36c573
cmp al, 0xac
stosd dword es:[edi], eax
mov ss, word [edi + ebp*4]
mov ch, 0xf0
fmul qword [esi]
push 0xffffffffffffff87
jae 0x4d3111
xchg dword [ebx + 0x79], esi
mov al, byte [0xcd4a619b]
xchg dword [ebp - 0x16], ebp
dec byte [eax + ebx*4]
ror byte [esi + 0x2fe5b9cf], 1
sti
invalid
xor cl, dh
cdq
stosb byte es:[edi], al
js 0x4d3135
cmp ah, bl
push ds
aam 0x6c
cmp bh, byte [esi]
out dx, eax
sbb ebp, dword ss:[eax - 0x3eda30fc]
xor bl, byte [ecx - 0x25]
mov al, 0xf3
push edi
mov eax, dword [0xf3269a8c]
mov ebp, 0xfeb8de4e
lodsd eax, dword [esi]
jmp 0x4d3095
push ds
mov bl, 0xa8
add byte [eax + ebx - 0x165a2e53], ch
push ds
ret 0x201c
test dword [esi], edx
sbb dh, 0xfc
sbb dword [ecx - 0x4d], ebx
in al, 0x7a
salc
mov cs, word [esi + 0x6a]
cld
pushal
leave
dec edi
jne 0x4d319d
invalid
aam 0x4e
push ecx
and al, 0x1a
add al, 0xc1
ljmp 0xa02a
Function at 0x4e5514
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x864
mov eax, dword [0x4a2f50]
xor eax, esp
mov dword [esp + 0x860], eax
push ebp
push 0x46
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.005342f4
add esp, 0xc
push 0x104
lea ecx, [esp + 0x260]
push ecx
push 0
call dword [fcn.00475410]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x274]
push edx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x4e559c
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x860]
xor ecx, esp
call fcn.005314bb
add esp, 0x864
ret
push ebx
push esi
push edi
push 0
push 0
push 0
push ebp
call dword [fcn.00475404]
call fcn.004e5444
mov ebx, dword [0x475408]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x47c]
push ecx
push ebp
or esi, 0xffffffff
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
jne 0x4e5697
shr edx, 2
je 0x4e5662
lea esp, [esp]
mov ecx, dword [edi]
mov eax, ecx
xor eax, esi
and eax, 0xff
mov dword [esp + 0x10], eax
mov eax, esi
mov esi, dword [esp + 0x10]
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 8
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 0x10
xor esi, eax
shr eax, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x4a65f0]
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 4
test edx, edx
mov esi, eax
jne 0x4e55f4
sub edx, 1
push 0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x47c]
push eax
push ebp
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
je 0x4e55e8
test edx, edx
je 0x4e56c3
jmp 0x4e56a4
movzx ecx, byte [edi]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 1
test edx, edx
jne 0x4e56a4
sub edx, 1
mov dword [esp + 0x10], edx
push 0x104
lea edx, [esp + 0x64]
push edx
call dword [fcn.00475400]
push 0x47da8c
lea eax, [esp + 0x64]
push eax
call dword [fcn.00475424]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x78]
push ecx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4e5715
mov eax, 1
jmp 0x4e576a
push 0
push 0
push 0x690
push ebp
call dword [fcn.00475404]
push 0
lea edx, [esp + 0x14]
push edx
push 0x48
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
lea ebx, [esp + 0x18]
mov edi, 0x47daa8
mov eax, ebx
call fcn.004e0e94
mov ecx, dword [esp + 0x14]
mov edi, dword [fcn.00475414]
push ecx
call edi
push ebp
call edi
mov edx, ebx
push edx
call fcn.00531967
xor ecx, ecx
add esp, 4
cmp eax, esi
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.005314bb
add esp, 0x864
ret
Function at 0x5130f6
Capabilities:
Authenticate hmac

Disassembly:
fldlg2
push esi
invalid
adc byte [esi - 0x24d3a6f5], 0x19
ljmp 0xb7aa
pop ecx
sub al, 0xdb
sbb edx, ebp
cmpsb byte [esi], byte es:[edi]
mov cl, 0xbf
stosb byte es:[edi], al
mov bh, 0x94
mov dh, 0xc5
je 0x5130f3
jne 0x5130d5
sub al, 0x1f
or ebx, dword [edx - 0x60]
in al, dx
leave
enter 0xffffffffffffdbdb, 0x14
jecxz 0x51313b
sahf
xchg esi, eax
push 0x6f
imul edx, dword [ecx - 0xf9842a7], 0xca8cd820
fistp dword [ecx - 0x954993e]
outsb dx, byte [esi]
outsb dx, byte [esi]
or al, 0x4e
int 0xa2
adc al, 0x9b
or dword [edx + ebp*8 - 0x29], 0x9a0d425f
jl 0x513153
invalid
pop esp
loope 0x51311d
mov dh, 0xe8
aad 0xaa
out dx, al
insd dword es:[edi], dx
inc edi
lodsb al, byte [esi]
das
cmp al, 0xf6
pop edi

Function at 0x554364
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
adc al, 0x6d
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
add dword [edx - 0xed7ea3b], edx
adc dword [ecx + 0x22], ebp
clc
xor cl, ah
adc eax, 0x54ebe83
invalid

Function at 0x564b3b
Capabilities:
Encode data using xor

Disassembly:
or dword [edi + 0x4d], 0x60b0785e
jnp 0x564af8
mov esp, 0xbae0c446
xchg dword [eax], ebp
push ebx
or edi, dword [ebp + 4]
mov bl, 6
mov ebp, 0xee752408
rep outsb dx, byte [esi]
imul byte [esi]
and cl, byte [ecx + edx*4]
mov edi, 0x181f3c5e
inc esp
in al, 0xd
stosd dword es:[edi], eax
mov al, 0x71
mov bh, byte [esi]
fst qword [esi]
cli
xor dword [ebx - 0x34ef3e01], ebx
mov di, 0x692f
aad 0x1b
and al, 6
add al, bh
dec edi
and edx, dword [esi - 0x22712158]
pop esi
out dx, eax
jecxz 0x564bdb
inc esi
invalid
mov ebp, 0xbd1b019e
and bl, byte [edi]
rcr eax, 1
mov ebp, 0xd8d11f22
cmpsb byte [esi], byte es:[edi]
out dx, al
jl 0x564b3a
invalid
sub al, 0x6c
cli
mov word [0x4ed26c9c], ds
cmovo eax, esi
not ecx
dec ebp
sub al, 0xbd
js 0x564b84
push cs
pop es
and cl, dh
adc dword [ebp - 0x44], ecx
inc edi
lahf
test eax, 0x2b9d8bfc
enter 0x3736, 5
xor byte [eax - 0x80], al
mov edi, edi
xchg byte [esi + 0x48], dh
jae 0x564bf0
mov ebx, dword [ebp + 0x3736c82b]
add eax, 0x89804030
inc dword [esi - 0x108cb78a]
jnp 0x564bd2
xchg ebp, eax
inc edi
jle 0x564c04
push cs
add cl, byte [ecx]
fimul word [edi - 0x54]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
cld
sbb bh, byte [eax - 0x2bc3e08a]
jns 0x564bd4
dec edi
sub eax, 0x709c14b4
mov bl, 0x24
dec ecx
aas
or dword [edi + 0x382b9827], eax
rcr byte [edx + 0xcfae5d], 1
push esp
xor ax, 0xb4f
inc esi
sbb byte [ebx + 0x414f89fb], ah
jnp 0x564c23
invalid
Function at 0x56763f
Capabilities:
Encode data using xor

Disassembly:
push 0xc
scasb al, byte es:[edi]
or dword [esi + 0x1ced692d], esp
pop esp
dec ecx
in eax, dx
mov ch, 0xb3
out dx, al
pop edx
fcomp qword [esi + 0x7a6422c6]
sahf
sahf
fmul st(6), st(0)
add al, 0x4d
xchg dword [eax - 0x69], esp
ror dword [ecx + 0x682aea95], cl
mov ecx, 0x5a0178
outsd dx, dword ss:[esi]
and eax, 0x81692762
push ecx
popal
mov ebp, 0x881e7f3f
push esp
mov edi, 0x69e8947
dec eax
jno 0x56764c
sahf
invalid
mov al, byte [0x325f5f8f]
lahf
inc ebp
fsub st(1), st(0)
xor byte [esi], 0xdf
aam 0x1f
pop ds
popfd
jl 0x567591
mov byte [0x835eae31], al
sub ecx, dword [ecx]
arpl word [edx - 0x11], ax
mov eax, dword [0x963f9a2f]
xchg esi, eax
popfd
fidivr dword [esi - 0x1d62be85]
pop ebx
inc ecx
popfd
loop 0x567656
insb byte es:[edi], dx
xchg ebp, eax
ja 0x5675a2
and eax, 0x8c0f56f1
mov dl, byte [ecx]
pop esp
adc byte [ebx - 0x2c], dl
mov ebx, dword [edi + 0x1b8e7c5f]
fldcw word [ecx + esi*4 + 0x2b1b895f]
push esi
scasb al, byte es:[edi]
outsd dx, dword [esi]
sub eax, 0xbc6dcf2f
xchg esp, eax
jbe 0x5675f7
movsb byte es:[edi], byte [esi]
mov ecx, 0x8e74b4ef
push esi
and esi, edx
or byte [ebp - 0x4f], cl
scasb al, byte es:[edi]
lea ebp, [eax - 0x9b13da5]
sub al, byte [esi + 0x57]
inc eax
or ecx, dword [eax + 0xa]
cld
inc ebp
jecxz 0x5675f9
fistp qword [ebx + 0x371387cb]
mov dh, 0x22
inc ecx
jg 0x5676bf
in al, dx
jbe 0x5675df
jge 0x567675
or byte [esi - 0x7e], ch
push cs
mov byte [0x2bef944], al
int1
jnp 0x5676ab
inc esp
stc
mov esi, 0x4e7bf102
dec esi
cmpsd dword [esi], dword es:[edi]
sbb al, 0x59
mov esp, 0xb69c8fa7
jb 0x56767d
dec esp
invalid
ja 0x5676ab
xchg esi, eax
sub ebx, dword [esi]
ja 0x5676ca
bound ebp, qword [eax]
invalid
sub byte [edx - 0x26], ah
xchg ebx, eax
sar byte [edi - 0x75827b55], cl
xor dword [ebp + 0x48], ebx
sbb bl, byte [ebp + ebp*8 + 0x4c]
idiv byte [ebx - 0x60d743d2]
rol ecx, cl
shr esi, 1
dec edx
in eax, dx
in al, dx
push es
test eax, 0xbb765637
jbe 0x56765c
sbb al, 0x5b
pop ecx
xor byte [edx], dh
xor ebx, dword [eax - 0x35]
sbb byte [edi - 0x73ab30e2], 0x8c
outsb dx, byte [esi]
test dword [0x1f7526d1], ecx
fdivp st(6)
mov ebx, dword [esi + ebx*8 - 0x326211c4]
je 0x56769f
push ds
iretd
int 0x74
invalid
scasd eax, dword es:[edi]
pmaxsw mm4, qword [ebx]
mov esi, 0x13142e4f
xor dword [ecx + 0x2c98a0a2], 0xe1eafc8f
push eax
invalid
adc eax, dword [ecx - 0x675f5d4f]
sub al, 0x8f
cld
ljmp 0x4e95
Function at 0x5e82e4
Capabilities:
Encode data using xor

Disassembly:
sbb eax, esi
mov ch, 0xbe
or esp, dword [ebp + 0x5adcc3]
int1
sbb byte [ebx + 0x3b], dh
push edx
in al, 0x9e
sbb edi, dword [edx]
lodsd eax, dword [esi]
and ch, byte [eax - 0x3d]
rcr ch, 0xdb
push 0xdbddc0c3
sar byte [ecx], cl
xor edx, ebx
test byte ss:[ebx + 0x401ca5fd], ch
stosd dword es:[edi], eax
add bl, ch
push edx
daa
jne 0x5e8314
adc eax, 0x91127ea
and cl, cl
mov esi, 0xb840c1d7
shr byte [ecx - 0x32f9456f], cl
lodsd eax, dword [esi]
invalid
jns 0x5e82ac
aaa
and byte [ebx + 6], bl
dec ebp
in eax, dx
cmp ah, byte [eax]
sub esi, edx
sbb byte [eax + 0x3f1bf20], dl
jo 0x5e8297
lahf
mov ecx, 0x2a1eac40
sbb dword [eax + 0x3336a5c0], 0x2d6d5e45
push edx
or eax, 0xd0706292
inc ebx
xor edx, dword [eax - 0x6837b08]
out 0xc6, eax
or dword [esi], ecx
lcall 0x680e, 0x10258ab2
xor byte [eax + 0x2a3039b4], bh
cwde
pmaxub mm4, qword [ecx + 0x31]
or dword [edx + 0x13], edx
xchg esi, eax
pop ebp
xor edx, ecx
jno 0x5e8314
and dword [ebx - 0x59], esi
popal
imul edi, ebp, 0xe2c6516a
jo 0x5e8378
sbb byte [edi], bl
insb byte es:[edi], dx
invalid
lcall 0x19c2, 0x8a6ce80e
adc al, 0x62
mov byte [ecx + ecx*4 - 0x18], bh
add cl, byte [ecx + edx*4]
dec eax
jne 0x5e82f7
inc ecx
cdq
push eax
retf 0xc1a1
sbb edi, dword [ebp - 0x20]
out 0x5f, eax
mov esp, 0xe13dd132
push eax
in eax, dx
in al, 0x76
jbe 0x5e83a5
clc
and eax, 0x426fdb09
dec edx
jge 0x5e835a
add ch, cl
clc
or dh, byte [ebx + 0x62acc4d6]
inc edx
loopne 0x5e83e6
in eax, 0xaa
adc byte [eax + 0x70], cl
push eax
inc esi
leave
cmp cl, dh
mov word [ebx - 0x4ffc2d1d], es
ret 0x5086
jp 0x5e8388
test al, 0xe4
punpckldq mm5, dword [ecx + 0x3d]
or al, 9
adc ah, bh
retf
Function at 0x610ec4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x864
mov eax, dword [0x4a2f50]
xor eax, esp
mov dword [esp + 0x860], eax
push ebp
push 0x46
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call 0x65fca4
add esp, 0xc
push 0x104
lea ecx, [esp + 0x260]
push ecx
push 0
call dword [fcn.00475410]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x274]
push edx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x610f4c
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x860]
xor ecx, esp
call 0x65ce6b
add esp, 0x864
ret
push ebx
push esi
push edi
push 0
push 0
push 0
push ebp
call dword [fcn.00475404]
call fcn.00610df4
mov ebx, dword [0x475408]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x47c]
push ecx
push ebp
or esi, 0xffffffff
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
jne 0x611047
shr edx, 2
je 0x611012
lea esp, [esp]
mov ecx, dword [edi]
mov eax, ecx
xor eax, esi
and eax, 0xff
mov dword [esp + 0x10], eax
mov eax, esi
mov esi, dword [esp + 0x10]
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 8
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 0x10
xor esi, eax
shr eax, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x4a65f0]
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 4
test edx, edx
mov esi, eax
jne 0x610fa4
sub edx, 1
push 0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x47c]
push eax
push ebp
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
je 0x610f98
test edx, edx
je 0x611073
jmp 0x611054
movzx ecx, byte [edi]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 1
test edx, edx
jne 0x611054
sub edx, 1
mov dword [esp + 0x10], edx
push 0x104
lea edx, [esp + 0x64]
push edx
call dword [fcn.00475400]
push 0x47da8c
lea eax, [esp + 0x64]
push eax
call dword [fcn.00475424]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x78]
push ecx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x6110c5
mov eax, 1
jmp 0x61111a
push 0
push 0
push 0x690
push ebp
call dword [fcn.00475404]
push 0
lea edx, [esp + 0x14]
push edx
push 0x48
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
lea ebx, [esp + 0x18]
mov edi, 0x47daa8
mov eax, ebx
call fcn.0060c844
mov ecx, dword [esp + 0x14]
mov edi, dword [fcn.00475414]
push ecx
call edi
push ebp
call edi
mov edx, ebx
push edx
call 0x65d317
xor ecx, ecx
add esp, 4
cmp eax, esi
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call 0x65ce6b
add esp, 0x864
ret
Function at 0x6276d4
Capabilities:
Encode data using xor

Disassembly:
aas
sbb edx, edx
xor dword [ebp + 0xd], edi
in al, 0x91
pop ss
test eax, 0x43786d81
insd dword es:[edi], dx
js 0x62771a
insd dword es:[edi], dx
js 0x62771a
cmp dword [esi], ebx
div byte [edx]
aad 0x77
outsb dx, byte [esi]
sti
jp 0x6276c8
test dword [esp + esi*8], edx
ret 0xdec5
arpl word [esi], di
adc dword [0xe5b1967b], 0xa054e3a1
fcom qword [esi + esi*4]
test byte [ebx + 0x4e9ba5f9], al
add esi, dword gs:[ecx - 0x6404525d]
cli
hlt

Function at 0x635084
Capabilities:
Encode data using xor

Disassembly:
mov byte [ecx + eax*8 + 0x75d5d5b6], al
ret
cmpsb byte [esi], byte es:[edi]
clc
push eax
push ebp
jge 0x635030
add al, 0x2c
push esi
dec ebp
or bl, byte [eax + esi*8 - 0x724f0ebc]
invalid
add byte [esp + edx - 0x7032c0a1], al
mov cx, 0x6976
jbe 0x6350ea
popal
and eax, 0xd768d615
salc
push 0xefb367d7
adc eax, 0x67d768d6
mov bl, 0xef
salc
push 0xefb367d7
mov ebp, 0xe35f0e01
nop
shl dword [ebp - 0x468edfa0], 0xed
inc ebp
adc byte [ebp + 0x10142c2c], dh
adc al, 0xe0
pop ecx
adc ch, byte [ebp + 0x38]
xor cl, 0x11
out 0x36, al
shl byte [ebx + 0x25], 1
insb byte es:[edi], dx
xchg ebx, eax
mov dword [edx + ebp + 0x4598e98], 0x98c3957f
push ebx
mov dh, 0x13
pop eax
js 0x635076
jecxz 0x635136
sbb ah, byte [edx - 4]
pop es
sbb dword [esi + 0x4a], ebp
adc byte [ecx + 0x62916069], al
jg 0x635060
or eax, dword [ecx - 0x3b]
sub dword [eax - 0x553d7666], eax
loop 0x6350da
clc
or byte [di - 0x3088], dl
call 0xe5bf3f6d
popal
test eax, 0x3b67dcba
fsub qword [edi + 0x3b]
jbe 0x63507f
cmp dword [eax], eax
movsb byte es:[edi], byte [esi]
imul ebx, dword [ecx], 0x62
mov dh, 0x62
aad 0x26
in al, 0x2b
pop edx
test eax, 0xa5b37b11
jbe 0x635083
into
add eax, 0xe73e828a
cld
popal
cmc
adc ebp, dword [eax]
xchg ebx, eax
ja 0x6350af
jne 0x635166
mov dword [0xee1fbfd5], eax
xor al, dh
shr ebp, 1
ret
scasb al, byte es:[edi]
pop esi
adc eax, 0x1ecc7562
cld
mov eax, dword [0x502551e1]
xchg ebx, eax
invalid
sal byte [ebx + eax*8], 1
cld
div dword [ecx - 0x34]
fld dword [esi + 0x1b6c1d42]
sub dword [eax], esi
dec esp
aaa
mov esp, 0x2ff2b49a
and ebp, edx
loop 0x63517d
ljmp 0x7dc6:0xf1e5fde2
in eax, 0xf1
invalid