joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a4d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
call fcn.004583ac
push 0x20
xor ecx, ecx
mov edx, 0x258
mov eax, 0x320
call fcn.0045a1a4
test al, al
jne 0x45a59c
xor eax, eax
jmp 0x45a5ae
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x45a53e
cmp dword [ebp - 0x18], 0x12
jne 0x45a52a
mov bl, 1
jmp 0x45a59c
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x45a59c
inc dword [0x55e6f8]
mov esi, dword [0x562730]
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
mov dword [0x562730], eax
push 0
push 2
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [0x562730]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
call fcn.00405668
mov dword [0x562730], eax
call fcn.00459afc
mov eax, dword [0x562628]
push eax
call sub.gdi32.dll_SwapBuffers
cmp byte [0x56264b], 0
je 0x45a597
mov bl, 1
jmp 0x45a59c
call fcn.00459d48
test bl, bl
je 0x45a50b
xor eax, eax
call fcn.00459fec
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x97a2b8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0097a408
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x97a2de
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x97a2ca
add dl, dl
jne 0x97a2e9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x97a33c
xor eax, eax
add dl, dl
jne 0x97a2f6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x97a3dd
add dl, dl
jne 0x97a305
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x97a310
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x97a31b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x97a326
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x97a332
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x97a2d5
mov eax, 1
add dl, dl
jne 0x97a34a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x97a355
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x97a341
sub eax, ebx
mov ebx, 1
jne 0x97a388
mov ecx, 1
add dl, dl
jne 0x97a36e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x97a379
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x97a365
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x97a2d5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x97a39f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x97a3aa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x97a396
cmp eax, 0x7d00
jae 0x97a3cd
cmp eax, 0x500
jb 0x97a3c8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x97a2d5
cmp eax, 0x7f
ja 0x97a3d0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x97a2d5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x97a3fe
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x97a2d5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x9147bc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x9147c6
pushal
call 0x9147cc
pop ebp
sub ebp, 0x10
sub ebp, 0x5147bc
jmp 0x9147e2
mov eax, 0x5147bc
add eax, ebp
add eax, 0x4c
mov ecx, 0x609
mov edx, 0x7c176dd3
xor byte [eax], dl
inc eax
dec ecx
jne 0x9147f9
jmp 0x91480c
pop eax
push ds
pop eax
pop edx
out dx, eax
rcl ebx, cl
rcl dword [edx + 0x12], cl
sub edx, ebx
rcl ebx, cl
rcr byte [esi], 1
imul edx, ebp, 0xffffffd3
rcl ebx, cl
imul edi, ebx, 0x24d3d3d3
xor eax, edx
sbb ebx, dword [eax + 0x52]
invalid
Function at 0x40ab66
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xc0
and dword [ebx], ebx
lcall 0x5b9e, 0xf7ef3c11
dec esi
mov eax, dword [0xe77e40e8]
sub al, 0x71
cmc
xor eax, esp
arpl word [eax], bx
dec ebx
jb 0x40abc5
call 0x1293efa5
stc
push ss
sar byte [eax - 0x47c209c0], 0x3c
mov esi, dword [edi]
xchg edx, eax
add dword [ebp - 0x10], esi
movsd dword es:[edi], dword [esi]
xor eax, 0x7a84004a
pop edi
aam 0x57
push ds
xchg ecx, eax
std
arpl cx, cx
and eax, 0x84114294
cld
aad 0xf
out 0xd8, eax
mov cl, 0x84
xor al, 0xc1
hlt
fldenv [eax]
test eax, 0x406c666c
mov eax, 0xbaba4186
test ch, ch
xlatb
and eax, ebp
add al, byte [eax]
adc esi, dword [esi]
aad 0x13
aaa
jge 0x40ac01
loope 0x40ac02
and edx, dword [eax + 0x615071d6]
fld xword [edi]
and eax, 0xfcb7b03b
loopne 0x40abeb
cmp esi, dword [eax - 0x1f990349]
stc
sub al, 0x98
mov edi, 0x6e63fa3
out 0x96, al
jo 0x40ac3c
sbb byte [ecx], cl
and dword [ebx + ecx*2], esi
dec ebx
sub al, 0xf3
add dword [eax + edx*4 - 0x1a], 0xb073640b
arpl word [ebp - 0x695ec9b2], cx
xlatb
add eax, dword [ecx - 0x22]
clc
aam 0x83
inc ecx
add eax, 0xb2137173
invalid
sal byte [eax], 1
mov eax, dword [0xc3991227]
ja 0x40ac89
pop edx
and eax, 0xc4e2f09e
pop gs
mov cl, dh
mov byte [0xf7ee92ac], al
pop ebp
dec edx
jp 0x40ac4f
and byte es:[edi + 0x1b3c45d4], dh
and byte [edi + 0x1b3c45d4], dh
or dword [ecx - 0x6f], ebp
add ah, al
pop ebp
scasd eax, dword es:[edi]
xor al, 0x33
in eax, 0x83
pop esi
and byte [esi], dl
mov es, word [ebp - 0x297d71bf]
pop esi
jnp 0x40ac5a
inc esi
and al, 0x86
int1
aaa
in eax, 0xb3
into
push es
cmp al, 0x97
add al, al
and al, 0x76
sti
jle 0x40acfa
ret 0xdf08
jbe 0x40ad1c
sub eax, 0x6234a542
sub esi, esi
add bh, byte [edx]

Function at 0x40c4de
Capabilities:
Encode data using xor

Disassembly:
push ebp
push eax
cmpsd dword [esi], dword es:[edi]
fstp xword [edi + 0x3e]
inc edi
lodsb al, byte [esi]
adc byte [esi], 0xa9
aad 0x54
aaa
test byte [ebx - 0x96d66ea], ch
neg cl
adc cl, 0xf6
test dword [edi + 0x37], 0x203d1316
mov byte es:[0x304a167a], al
xchg edx, eax
fsub dword [esi]
inc edi
xor dword [ebp - 6], esi
sub byte [eax - 0x5f7d435c], dl
invalid
Function at 0x459625
Capabilities:
Encode data using xor

Disassembly:
jg 0x45968c
mov bl, 0xcc
cmp edi, 0x3b
or dh, ch
cmp ecx, dword [eax]
out dx, al
inc ecx
pop ebx
inc esi
iretd
outsb dx, byte [esi]
je 0x459708
lodsd eax, dword [esi]
or dword [ebx + 0x79], eax
or eax, 0xe17633c3
xor esi, dword [esi - 0x1f]
loope 0x45962b
xchg edx, eax
pop es
jns 0x4596fc
std
xor byte [esi - 0x558e6612], dl
jnp 0x459697
cmp dword [eax + 0x40], 0x1e
sahf
mov al, byte [0x4ca2ede1]
cmp al, 0x6f
sbb ecx, dword [ecx + 0x6d]
inc ebx
pop ebp
sahf
std
insd dword es:[edi], dx
mov bl, 0x2f
sbb esp, ecx
jge 0x4596b8
ret
mov byte [esi + 0x45], dh
push 0xffffffffffffff8d
mov edx, 0x4c8ed755
jp 0x459695
mov cs, word [edx + edi*2 - 0x55]
mov ebx, 0x386f95af
dec edi
jns 0x4596e6
jns 0x4596ff
ljmp 0x3c26:0x43520c6a
sbb al, byte [ecx + esi + 0x42a24d7a]
movsd dword es:[edi], dword [esi]
adc ecx, 0x39
pop edi
jp 0x45974e
mov byte [0xd183a542], al
cmp dword [edi + 0xc], ebx
scasd eax, dword es:[edi]
or al, 0xaf
dec esi
or ebx, dword [ecx + 0x2b]
pop esp
push ds
out dx, al
xchg ch, dh
jbe 0x459739
jno 0x4596de
jmp dword [ebp + 0x21]
push edi
jns 0x45979a
aaa
mov ebx, 0xb5278c56
das
dec ebx
cmp eax, 0x935aaec6
pop ds
rol esi, 0xd2
push ebx
invalid
sbb dword [edx], ebp
inc eax
movsb byte es:[edi], byte [esi]
mov ebx, 0x24a67f3c
jp 0x45974b
imul ebx, dword [ecx + 0x7a], 0xffffffdd
out dx, al
retf
adc eax, 0xce399229
mov edx, 0xcef5058b
mov bh, ch
fucompi st(3)
movsb byte es:[edi], byte [esi]
mov al, byte [esi - 0x51]
mov al, byte [0x5e7f0c40]
mov dl, 0x6e
jns 0x459806
imul ecx, dword [esi], 0xde3d7e9c
sahf
dec ecx
inc ecx
lodsb al, byte [esi]
mov ecx, 0x45a2bfc5
sub dword [ebx], ebx
je 0x459810
mov ecx, edi
dec edi
cmp dl, cl
push 0xfffffffffffffffb
add dword [0xedaf35c8], ebp
fdiv st(4), st(0)
xchg esp, eax
and eax, 0x2c13ebd1
stosd dword es:[edi], eax
sahf
iretd
inc byte [eax - 0x1ed7d074]
insd dword es:[edi], dx
mov dl, 0x22
test dword [ebx - 0x78c6df6b], ecx
push 0xc84618dc
mov word [esi], ss
dec esp
mov edx, dword [ebp + 0x68873920]
fcomp qword [eax]
inc esi
enter 0x168c, 0x4c
outsd dx, dword [esi]
pop esp
sbb al, 0x93
mov esi, 0xad82eb3f
invalid
Function at 0x4a08e7
Capabilities:
Encode data using xor

Disassembly:
or byte [ecx], ah
lcall 0xa872, 0xc5e0b443
invalid
pop ss
dec ecx
inc edx
push ebp
aam 0x31
push ds
adc dh, byte [esi]
imul eax, dword [edx], 0xffffff88
inc edi
add dword [ebx + ecx - 0x15], 0x31de8e98
loope 0x4a0876
ja 0x4a0849
dec ecx
test byte [ebx], cl
mov gs, word [edi + 2]
sbb al, 0xa6
sahf
nop
push esp
movsb byte es:[edi], byte [esi]
ja 0x4a0879
movsb byte es:[edi], byte [esi]
pop esp
pop edx
wait
cmp ebx, dword [eax + 0x3232a444]
rcl ebp, cl
wait
mov byte [0x2072ad07], al
xor edx, dword [esi + ebp]
cmp ch, byte [ebp + 0x25]
cmp ch, byte cs:[ebp + 0x25]
inc edi
xor al, 0x40
inc ecx
push eax
adc eax, 0x8f5a71c3
pushfd
jle 0x4a08ae
mov ch, 0x93
pop ds
adc eax, ebp
push ecx
inc dword [edx]
in al, 0xd7
out 0x2f, eax
test byte [ecx + 0x5d], ah
adc esp, dword [eax - 0x36f3f08f]
enter 0x5b4c, 0xffffffffffffffda
out 0x71, eax
loope 0x4a0871
arpl word [ebp - 0x7a418213], ax
pop ebx
xchg edx, ebp
aam 0xd9
movsd dword es:[edi], dword [esi]
sar byte [esi + 0x15708f73], 0x58
cmp eax, 0x7d3bdc8b
out 0x6e, al
jle 0x4a095d
mov esp, 0x22e6313d
out 0x51, al
test ebp, ebx
mov dl, 0xe1
outsb dx, byte [esi]
rcl cl, cl
mov bh, 0xcb
clc
push ecx
xor eax, dword [esi]
retf
movsb byte es:[edi], byte [esi]
mov byte [0x6ba6df65], al
movsd dword es:[edi], dword [esi]
jecxz 0x4a08b3
ret
add dword [0x63247d3], esi
xchg esi, eax
invalid
mov dl, byte [eax]
invalid

Function at 0x4a48e0
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
adc dword [esi + 0x73bbf383], 0xffffffa1
inc edi
or byte [ebx], dh
xor al, 0xb2
jno 0x4a491d
add eax, 0x4b920f01
dec eax
pop esp
retf 0xdb63
jp 0x4a497d
and al, 0x82
push esi
or al, 0xcc
inc edx
aad 0x84
inc eax
hlt
outsb dx, byte [esi]
aad 0xc5
hlt
pop ds
and ch, al
out 0x78, al
xor byte [ebx - 0x5261aa71], bh
xor eax, 0x15c65172
pushfd
aas
inc ebx
dec ebp
sbb eax, 0x34c6f083
loopne 0x4a4963
mov eax, cs
cli
fbstp tbyte [ebx - 0xa]
sahf
cmpsd dword [esi], dword es:[edi]
pop edi
mov al, 0xfe
enter 0xffffffffffffd5a2, 0xffffffffffffffef
rcl dword [edx], 0x17
aaa
pop ss
pop es
and eax, 0xfa589dc7
insd dword es:[edi], dx
popfd
mov dh, 0x75
test dword [esi], esp
lds ecx, [esi + esi*8 - 0x1d]
mov dword [ebp + 0x55], esi
popal
out 0x72, eax
mov edx, 0x80d325a0
xchg ebx, eax
push ds
mov bl, 0xd1
out 0xd3, al
pop edx
mov ebp, 0xf192639b
adc eax, 0x77c40a74
aaa
outsb dx, byte [esi]
adc byte [ecx + ebp*8], 0xe2
xor ebx, dword [ecx]
jae 0x4a49cc
xchg ebx, eax
rcr byte [edi - 0x75], 1
lodsd eax, dword [esi]
sbb dh, byte [edi]
mov dh, 0x7c
je 0x9c4e4c37
jbe 0x4a4a42
push eax
inc ecx
fst qword [ebx]
and al, 0xb3
xchg edi, eax
xor eax, dword [edi + 0x354d6c96]
ret
mov byte [0x5b0063b5], al
xor eax, 0x399ee5c3
pop esi
pop ss
push ebx
push ebp
jo 0x4a4ab4
xchg ebp, eax
dec esp
ret
push ebx
mov ebp, 0x29513943
mov al, 0xfb
movsd dword es:[edi], dword [esi]
adc al, 0x85
mov ch, 0xa8
cmpsb byte [esi], byte es:[edi]
in al, 0xb8
sahf
int3
Function at 0x4a538f
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0xcb
and ecx, ebx
and ecx, ebx
int 0x11
or eax, 0x792089e6
pop ebp
push ss
dec edx
push ds
or al, 0x6c
pushfd
inc esi
sub eax, 0xa9d5868c
lahf
mov edx, 0x8b1585f0
popal
sbb byte [esi + 0x62], dl
fdivr st(2)
or eax, eax
mov edi, 0x65058cff
push ebx
mov byte [0xc37f3544], al
jmp 0x4a5341
cmp byte [ebx], al
mov al, 0x3c
aam 0x76
dec ebx
push edx
and al, 0x44
dec ebx
jle 0x4a5344
lahf
xor byte [eax + esi*4 - 0x6a20084e], 0x68
push ebx
pop ds
pop ss
xchg esi, eax
pop esp
fmul st(4)
sub al, 0xfb
fdiv qword [ebp + 3]
cmp dword [eax + 0x17f8af69], edi
mov ah, 0x52
jb 0x4a5427
insb byte es:[edi], dx
adc eax, 0x7483f730
invalid

Function at 0x4a8f7d
Capabilities:
Encode data using xor

Disassembly:
adc byte [esi], bh
inc esi
cmpsb byte [esi], byte es:[edi]
push es
dec esi
pop es
mov edi, 0x9f272379
hlt
dec ebp
mov esp, 0xf3c181d3
fldenv [ecx]
loop 0x4a8f33
xchg edi, eax
jp 0x4a8f57
cld
in al, 0x4e
push esi
jbe 0x4a8fb8
pushal
bound ebp, qword [0xe6f4b4c3]
arpl word [ebp + esi*4 - 0x28ba346f], si
fsub dword [esi + eax*8 - 0x43]
cmp eax, 0x83e32ba6
adc byte [0x526e35f9], ah
dec edi
fscale
cmc
or byte [edi - 0x737d9a0f], 0x99
mov word [ecx + 0x17bf71a3], ds
adc esp, dword [ebx - 0x2b]
mov ah, 0xb5
xchg ecx, eax
retf
mov word [ecx + 0x17bf71a3], ds
adc esp, dword [ebx - 0x2b]
cmp ch, bh
lds edx, [edi + 0x6c129602]
sti
sbb ecx, eax
xor eax, 0xb2a9173
push edx
scasb al, byte es:[edi]
jnp 0x4a8f5f
out 0xd, al
mov bl, 0x2a
rcr dword [ecx - 0x74], cl
xchg ebp, eax
push ds
mov edx, 0x1431b65f
xchg bh, ch
xor dword [ebp + ebx*8 + 0x424c1062], esp
jmp 0x4a8f44
inc ebp
dec edx
scasd eax, dword es:[edi]
sar byte [esi], cl
salc
iretd

Function at 0x4be3e4
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x83a29a1b
cdq
xchg ebx, eax
xor eax, 0x6893ca8a
inc esp
fmul qword [edx + eax*2]
mov cl, dl
xchg ebx, eax
push 0x420cdc44
mov dword [eax + eax*8], eax
out dx, eax
aad 0xf3
shl dword [ebx], cl
rol esp, cl
bound esi, qword [ebp - 0x2bcf9a2d]
xor byte [edx - 0x3662f0bb], 0x74
mov ch, 0xe
jno 0x4be394
cmp al, 0x70
adc al, 0x9b
pop es
mov cl, 0xb3
ja 0x4be38c
xchg ecx, eax
aad 0x25
out dx, al
ror ecx, cl
not ah
ret 0x2da
xchg ah, dl
in al, 0xfc
out dx, al
cmp eax, 0xd7639f35
sub bh, dh
mov dh, 0x9b
mov dword [edx], 0x21c3ac48
jne 0x4be38c
cmpsb byte [esi], byte es:[edi]
mov esp, 0x30f1bfaa
mov bl, 0xf0
mov eax, dword [0xd4c85698]
int1
and bl, cl
mov ah, 3
fist word [ecx + 0x43be06e2]
inc edi
add bl, al
sbb byte [ebp + edx*8 - 0x6df267b1], dh
adc byte [edx - 0x4910c97d], dl
out 0x52, eax
ret

Function at 0x4f01e5
Capabilities:
Encode data using xor

Disassembly:
sub byte [ebp - 0x4e], 0x42
xchg edx, eax
xor eax, dword [0xa89c6367]
mov al, 0x63
jae 0x4f024a
loope 0x4f01e0
inc edi
sbb al, 0x13
or byte [eax], cl
or al, 0x39
salc
sar byte [0x58f66a9], 1
inc eax
dec esp
std
cmp esi, ebx
popal
invalid
or eax, dword [ecx]
in eax, 0x8a
out 0xd0, eax
sbb al, byte [eax + 0x26]
cwde
push ebx
adc edi, dword [edi]
adc dword [ebp + 0x6a37779b], esp
scasd eax, dword es:[edi]
ror byte [ebp - 0x79], cl
ret
Function at 0x508def
Capabilities:
Encode data using xor

Disassembly:
push eax
cli
dec esi
dec ebp
mov cl, 0xe2
enter 0xffffffffffffc7ac, 0xffffffffffffffe5
dec eax
add ecx, dword [esp]
mov bl, 0xef
inc esp
retf
push ss
add esp, dword [eax]
sal byte [edi], cl
and cl, byte [eax + 0x3b]
adc dword [edx - 0xc12891a], esp
cmp edx, dword [ecx]
mov byte [0xf3ed76e6], al
sal ebx, 0xbf
dec eax
sub bl, byte [ebx]
and ah, byte [ecx + 0x5497dac0]
mov ebx, 0x6303dda1
add esp, dword [ebx - 0x3d]
add esp, dword [ebx - 0x3d]
sbb byte [eax + 7], bh
add dl, byte [esi]
rcl byte [esi], cl
mov bh, 0xe7
cmp edx, dword [edi]
lodsb al, byte [esi]
push esi
fsub st(1), st(0)
pop edi
jb 0x508e67
in eax, 0x76
rcl dword [ebp - 0x59], 0x9e
xchg ebx, eax
jecxz 0x508dd9
imul edx, dword es:[ecx - 0x385b47fa], 0x42
adc dword [0x582f1360], ebx
jbe 0x508dd1
push ecx
cmpsd dword [esi], dword es:[edi]
push eax
xchg esi, eax
mov bh, 0xa5
jl 0x508dac
inc ebp
inc esp
xchg ebp, eax
adc dword [edi], 0xffffffb3
ret 0xee9e
add ebx, dword [edx + 0x22]
lodsd eax, dword [esi]
cmp esi, dword fs:[ebx + 0x8f67267]
mov bh, 0xce
jb 0x508e5f
or byte [edi + 0x428f9ce], dh
push esi
stc
sub byte [esi + edx*2], al
inc ebx
jae 0x508e6c
invalid
Function at 0x52c501
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.00535510
mov dword [esp + 0x28], 0
test esi, esi
jne 0x52c547
xor eax, eax
jmp 0x52c54a
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.00535b45
lea eax, [edi + 0x7c]
test eax, eax
je 0x52c565
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.00535eaa
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x52c5a3
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.00535eaa
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0053522a
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00535bc6
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5359b9
Capabilities:
Encode data using xor

Disassembly:
nop
pushfd
jmp edi
cwde
mov ebp, dword [ebx - 0x1b940497]
or byte [esp + ebp*8], dh
jns 0x53596d
insb byte es:[edi], dx
sbb eax, 0x691c964a
lodsd eax, dword [esi]
js 0x535a3a
enter 0xffffffffffffc141, 0xffffffffffffffac
call 0xb6fd64d3
scasb al, byte es:[edi]
call 0xa84a093c
push ebx
sbb edi, edx
inc ecx
shr dword [eax + 0x4d732b72], 1
mov esi, 0x51a3f74b
fldl2e
or ah, byte [ebx]
dec esp
pop ecx
out 0xba, eax
sub byte [ecx - 0x32], al
xchg ebp, eax
or eax, 0x4bb72589
int3
repz ret 0xd3ec
ja 0x535aa5
js 0x535a5d
jne 0x535a35
and byte [esi], bh
scasd eax, dword es:[edi]
sub edi, dword [ecx - 0x731d672c]
les ecx, [ebp - 0x74d63dc]
in eax, dx
fmul dword [ecx + 0x55]
xor eax, 0x591b1339
mov byte [edx - 0x52b70b08], al
lodsd eax, dword [esi]
rcr cl, 1
jecxz 0x535a42
pop edx
test byte [0x4082bd5], ah
xchg edx, eax
jg 0x535a99
std
ret 0x2047
cmpsb byte [esi], byte es:[edi]
push ebp
lodsb al, byte [esi]
popal
push edi
or edx, ecx
aas
sbb eax, 0x86b9b7bc
adc ebp, dword [0x9ef09804]
xchg byte [ebx], dl
sub eax, 0x9ef09804
sub byte [edx], al
nop
sbb byte [edx - 0xf], bl
je 0x535abd
retf 0x9ec4
int 0x59
wait
inc ecx
imul byte [esi]
mov eax, 0x3c580e4f
xchg esp, eax
invalid

Function at 0x537d8b
Capabilities:
Encode data using xor

Disassembly:
pop di
push eax
xchg ecx, eax
leave
add ch, al
mov dword [0x19fa02dc], eax
invalid
sti
jnp 0x537d7c
fisubr dword [edx + edi*2 + 0x43]
invalid

Function at 0x53d35d
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x905d8aa6
sbb byte [esi - 0x112443ce], cl
movsd dword es:[edi], dword [esi]
pop ebp
sub eax, esi
movsd dword es:[edi], dword [esi]
loopne 0x53d307
xchg dword [edx + 0x6c2fa9dd], ebx
test eax, 0xc588d66c
salc
mov ch, al
adc ebp, dword [edx + 0x68]
scasd eax, dword es:[edi]
add edx, dword [eax]
invalid
cmp eax, 0xddc5a651
jl 0x53d2ed
mov esp, 0x2e4ce9f6
or al, 0xa8
jl 0x53d3b2
pop ebp
fist word [edi - 0xc]
mov gs, esp
sub al, 0x91
scasb al, byte es:[edi]
push edx
or ch, ch
xchg ebx, eax
jns 0x53d38e
call 0x55f17f5e
les eax, [edx]
dec esi
sub byte [ebx], ch
nop
push ecx
or eax, 0xa3a6f948
jmp 0x53d36d
ficomp word [esi + ecx*8]
test al, 0x51
std
adc byte [edx + 0x3e], cl
xchg esp, eax
sub bl, al
imul ebp, dword [esi], 0xa67611d
dec eax
sal byte [eax], cl
cmp ebp, ebp
popal
or cl, byte [bx + si - 0x2e]
or cl, byte [eax - 0x2e]
xor byte [ebx], bh
in eax, dx
fstp xword [edi]
adc dword [edx], esi
and eax, 0x4af8b0eb
fdivr qword [edx + 0x239fd35d]
sbb byte es:[esi], 0xc2
lahf
and esp, dword [esi]
sbb byte [esi], 0xc2
lodsb al, byte [esi]
test dword [ebx - 0x4a], ebp
shl al, cl
mov bl, byte [edx - 0x535359de]
sbb dword [edx - 0x2e], esi
call dword [edi + 0x1325d3f4]
push 0xfffffffffffffff7
xlatb
loopne 0x53d39f
stc
or dword [edx - 2], 0x7952961e
nop
or dword [edi - 0x1264f740], ebp
into
mov edx, 0x74edbc1b
xchg edi, eax
salc
rcl dword [ebx + 0x1d], cl
and eax, 0xfc85d86c
in eax, dx
sub ch, ch
jns 0x53d39d
enter 0xa46, 0xffffffffffffff9f
sub byte [ecx - 0x6f14b4f8], ah
push edi
invalid
Function at 0x542b5d
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
insb byte es:[edi], dx
sub dword [esi - 0x51], esi
fld xword [edx + ecx - 3]
invalid
popfd
xchg ebx, eax
xor eax, 0xe5fe28f8
push ecx
test eax, 0x2ab31658
push es
or cl, dh
sub dword [esi - 0x1ff66364], ecx
loopne 0x542bc6
pop ds
loopne 0x542bc6
pop ds
stosd dword es:[edi], eax
in al, dx
mov dh, 0x6c
call 0xbdc7e499
in al, dx
push edx
fsubp st(2)
clc
cdq
stc
xchg edx, eax
dec edi
cmp ch, byte [ebp - 0x6dd66bf7]
jp 0x542b02
cmp al, 0x3f
jle 0x542b47
loope 0x542b9d
insb byte es:[edi], dx
in eax, dx
mov ah, 0x8c
xor byte [ebx + 0x3c7884b9], 0xa8
retf
mov ebp, dword [esi + edi*8 - 0x4e478464]
lcall 0x81e0, 0xa4d7be0d
jle 0x542c00
bound edi, qword [ecx]
pop es
cmp dword [esi], edi
pop es
sub al, 0x32
insb byte es:[edi], dx
cli
inc eax
sub eax, 0x71d9c0e
cmp edi, esp
sbb eax, 0x107855d9
sbb bh, byte [esp + edx*2 + 0x2a9810dc]
jg 0x542b8e
cld
cmp byte [ebx - 0x2fb76750], dh
punpcklwd mm5, dword [eax - 0x10e296c0]
aam 0xf8
or edi, ebx
insd dword es:[edi], dx
movlps xmm3, qword [edx]
jecxz 0x542bf3
imul ebx, dword [0xbf8d4ef], 0x120f6dfb
sbb ah, bl
and byte [ebp + 1], bl
xchg ebx, eax
test al, 0x9d
adc byte [ebp - 0x78], al
sbb eax, 0xed38a8f1
pop ebp
add dword [ebx + 0x45109da8], edx
mov byte [0xed38a8f1], bl
dec eax
sub eax, 0x7b831c9e
sub dword [ebp + 0x20cd2db3], ebx
xor dword [ecx + 0x28], ebp
xor byte [edi + 0x78bd4e55], 0x4e
fcompi st(3)
mov ebp, 0xf3df4e78
dec ebp
imul ebx, dword [edx - 0x4f0fdae8], 0x39
inc esi
int3
Function at 0x576f0c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0057ff1b
mov dword [esp + 0x28], 0
test esi, esi
jne 0x576f52
xor eax, eax
jmp 0x576f55
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.00580550
lea eax, [edi + 0x7c]
test eax, eax
je 0x576f70
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.005808b5
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x576fae
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.005808b5
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call 0x57fc35
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005805d1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret