joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bf289
Capabilities:
Encode data using xor

Disassembly:
iretd
xchg ecx, eax
mov al, byte [0xb6740fa0]
fnstsw word [ebx + ebp*4]
dec ebp
aaa
mov bl, ah
push es
je 0x4bf266
inc esi
dec ebp
imul ebp, dword [edi - 0x6c], 0x1480302e
scasd eax, dword es:[edi]
popfd
rcl dword [esp + ebx*8 + 0x7a]
cmp al, 0x55
push esp
fdivr qword [edx + 0x3c]
push ebp
sub al, 0xe3
xchg dh, cl
cmpsb byte [esi], byte es:[edi]
and edx, dword [eax + 0x4f]
mov al, 0x6b
ja 0x4bf22c
dec ebx
jnp 0x4bf2e9
sbb al, byte [ebx + 0x3c5b3ffd]
mov ecx, 0xadda9102
popfd
mov dword [esi + 0x2d], ebx
loop 0x4bf28d
jo 0x4bf2e7
pop ecx
sub eax, 0x39f84032
and eax, dword [ecx]
scasd eax, dword es:[edi]
or al, 0xab
xor byte [ecx*2 + 0x52bfe9b6], bl
jge 0x4bf296
cmc
lodsb al, byte [esi]
ficomp dword [ebp + 0x43]
sal al, 0xb8
adc al, 0x85
loop 0x4bf248
inc esp
popal
sbb esi, dword [ebp + esi - 0x70c0b2e9]
pop edx
mov word [edx], gs
loopne 0x4bf30e
sti
adc bh, byte [ebp - 0x1530a8d2]
mov al, byte [0x19f5fc49]
cmp byte [edi - 0x77834f30], 0xda
into
in al, dx
push esi
sbb dh, ch
jnp 0x4bf32e
and eax, 0x8e0274cd
cmp dword es:[eax + ebx*8], eax
and byte [esi], dl
sub eax, 0x8f61fffe
in al, dx
mov ah, bh
xchg ebp, eax
fisub word [ebx + 0x20]
xchg byte [esi - 0x6982c1d6], al
scasb al, byte es:[edi]
adc dword [edx + 0x1257a40c], eax
jle 0x4bf32e
out 0x66, al
inc edi
std
rcl byte [ebx - 0x3902d850], cl
or byte [eax], bl
ljmp 0x4830
dec eax
jle 0x4bf365
pop eax
and ebp, dword [ebx - 0x1f97e03b]
jl 0x4bf2b8
daa
das
mov ebx, 0x1db84a3c
out 0x95, eax
invalid
shr byte [eax + 0x31], 0x4f
dec ecx
lds ebp, [eax]
pop esi
cmp al, 0xf4
mov edi, 0x87d1aeb
inc esi
or cl, byte [ebx]
cmp ah, ah
in al, dx
xchg ebx, ebp
call 0xe04ab219
jmp 0x4bf2df
push ebx
wait
xchg esp, eax
clc
sbb eax, 0xf94100e1
cmpsb byte [esi], byte es:[edi]
mov ebx, ebp
xchg ebp, eax
and al, 0xe1
sbb al, 0xc5
arpl word [esi], bp
pop ebp
mov edi, 0x11bd40d2
jns 0x4bf364
jbe 0x4bf3b5
in al, dx
xchg esi, eax
rcl byte [ebp + 0x27], 4
xor eax, 0x4fc72a81
mov ecx, ebx
pop es
sub ch, byte [ebx + 0x41a7023b]
pop esi
xor esi, 0xee86f060
dec ebx
mov al, byte [0xae78]
mov ch, 0x5b
out dx, al
bound esp, qword [eax]
push cs
lahf
movsd dword es:[edi], dword [esi]
cmp al, 0x40
adc bh, bl
lcall 0xef31, 0x73d82eb5
out dx, eax
adc ecx, esi
jnp 0x4bf3cc
clc
inc ecx
jne 0x4bf3f2
push ebp
jp 0x4bf3b8
jge 0x4bf43b
add eax, 0xf1f78e64
stosb byte es:[edi], al
mov dl, byte [edx]
inc esi
adc sp, word [0xd6f1d441]
pop ebp
xchg ecx, eax
scasb al, byte es:[edi]
mov ch, 6
push ds
inc esp
invalid
add edi, dword [ecx + 0x54]
fild dword [edx + edx + 0x16a981b7]
dec edx
mov al, byte [0xff7d3367]
cmpsb byte [esi], byte es:[edi]
hlt
mov word [esi + 0x10], gs
hlt
Function at 0x4ee83b
Capabilities:
Encode data using xor

Disassembly:
jae 0x4ee838
lds esp, [edi - 0x4c]
cmpsd dword [esi], dword es:[edi]
out dx, eax
in al, 0x94
retf
cmc
mov byte [0x27868c7], al
neg byte [eax + 0x69dc920d]
stosd dword es:[edi], eax
xchg edx, eax
fsubr qword [ecx - 0x55]
std
sub ecx, 0xffffffbe
mov dh, 0xb2
sub eax, esp
push 0x67
xor byte [ebp + 0xe], ah
neg dword [ebx + 0x40]
jbe 0x4ee7df
push edx
sub ecx, edx
add bl, dh
push 0xffffffffffffffe2
and bl, bl
add dl, dl
jne 0x4ee7ee
mov ah, 0xb6
mov eax, dword [0x550f0b0]
pushal
scasd eax, dword es:[edi]
leave
sbb byte [ebx - 0x53], 0x9a
and eax, 0x37364af0
dec edx
leave
popal
rol dh, 1
and ebx, ecx
stosd dword es:[edi], eax
inc ebx
imul ebp, dword [esi - 0x6da59994], 0x517f1579
pop edx
xchg edx, eax
jns 0x4ee854
jg 0x4ee892
scasb al, byte es:[edi]
insb byte es:[edi], dx
pop dx
pop edx
pop edx
xchg edx, eax
jns 0x4ee854
jg 0x4ee892
test cl, bl
mov eax, 0x5b4b48a9
test al, 0x27
ja 0x4ee896
cmp eax, 0x4181e175
aas
jecxz 0x4ee889
or al, 9
jmp 0x4ee7f8
dec edx
mov al, 4
fiadd dword [eax]
push ecx
pop ss
and edx, dword [edi]
push edx
cmp dword [eax], 0xfffffff2
scasb al, byte es:[edi]
sub al, 0xe6
std
cmp dword [edi], esi
aaa
lahf
cmp dword [edx + 0x3f], eax
inc esp
loop 0x4ee8d7
mov dword [ebx + 0x2e], esp
sbb dword [esi + 0x5b], edx
push ds
inc edi
mov eax, dword [0xa6f60fb8]
loope 0x4ee8db
adc dword [eax - 0x7acb1efa], esp
jmp 0x4ee895
jl 0x4ee880
imul ebp, dword [esi + 0x767466bc], 0x67
mov esp, 0x67767466
sub ebp, ecx
mov esp, 0x491b5687
and eax, 0x9875ef73
pop dword ds:[edx + 0x32]
jmp 0xbd688dca

Function at 0x4f7425
Capabilities:
Encode data using xor

Disassembly:
js 0x4f7435
scasb al, byte es:[edi]
iretd
xchg esi, eax
jb 0x4f73da
adc cl, bh
add eax, 0x25788c30
lds ecx, [edi - 0xa096ee8]
xor byte [eax + edi*2 + 0x188fc525], cl
xchg ecx, eax
div ch
cmc
pop ebp
in al, 0xbd
lahf
lea ecx, [ecx - 9]
pop ecx
stc
pop ebp
jae 0x4f742c
or dword [esi + 0x31], 0xa7b7b9c5
mov al, byte [0x63a00d53]
cmp bh, bh
fdivr st(6)
sub dword [edx], 0x65e11696
pop esp
insb byte es:[edi], dx
invalid

Function at 0x4f7cf8
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x20
test byte [esi + 0x11d961bf], dl
out dx, eax
cmc
mov bh, 0x74
mov edx, 0xe2bd9779
add dword [edx], ebp
inc eax
xor al, 0x94
pop ecx
mov ah, 0xcd
movsd dword es:[edi], dword cs:[esi]
in al, dx
adc eax, 0x84b81468
call 0x1717e6bb
add eax, 0xa2559431
add ecx, dword [esi]
push di
daa
pop es
cmc
invalid
Function at 0x5273c4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.005303d3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x52740a
xor eax, eax
jmp 0x52740d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.00530a08
lea eax, [edi + 0x7c]
test eax, eax
je 0x527428
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.00530d6d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x527466
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.00530d6d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.005300ed
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call int.00530a89
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5303d3
Capabilities:
Encode data using xor

Disassembly:
maskmovq mm4, mm3
aas
and bh, byte [edx + 0x61c2d05e]
bound ebp, qword [ebp + 0x415c2c6e]
imul edx, dword [eax + 0x19b396bf], 0xc4825338
shr byte [edi - 0x36ec489a], cl
rol ecx, 1
mov edx, 0xb24122dd
xchg ecx, eax
test eax, esi
std
lodsb al, byte [esi]
jae 0x530430
std
add al, 0xee
sub ecx, edi
sub byte [ebp - 0x215da60f], bh
movsd dword es:[edi], dword [esi]
jns 0x53041b
sbb al, 0x12
mov al, 0x47
cmc
sbb esp, edi
sub eax, 0x1d5a47da
mov eax, dword [0x658277fd]
xchg esi, eax
sbb eax, 0x8277fda1
xchg esi, eax
inc eax
sub al, 0xf0
or eax, 0xc2c0bd75
xchg ecx, eax
sub al, byte [ebp + 0x52]
imul ebp, ebp, 0xc3f4a2c6
stosb byte es:[edi], al
cli
insb byte es:[edi], dx
scasd eax, dword es:[edi]
sbb byte [edx - 0x47], 0x6e
out 0x7b, eax
xor dword [ecx - 0x41], esp
mov dword [0xf0416ff1], eax
add eax, 0x162d06fe
shr dword [ebp - 0x4b], cl
inc ebp
or dword [eax], ecx
mov byte [0x494f03aa], al
xor al, 0xf7
mov gs, ecx
mov esp, 0x3f31a1f4
mov word [eax], gs
aas
mov eax, ds
xor esi, edx
popal
mov dword [0xcfc9d8d7], eax
movsb byte es:[edi], byte [esi]
mov cl, 0xfb
movsd dword es:[edi], dword [esi]
stosd dword es:[edi], eax
lea esi, [edx]
mov dword [0xdefb9ccd], eax
mov ch, 0xc2
mov dword [0xa243c0da], eax
mov bl, 0x45
fcom qword [ebx]
jo 0x5304f2
invalid
cmp byte [ecx], bl
mov al, byte [0xd33d4700]
aas
fimul dword [edi - 0x32854f2b]
shr dh, cl
pop ebx
arpl word [ebx + esi + 0x48], sp
dec ecx
adc esp, dword [edx + 0x6a]
or dword [ebx + 0x5c], esp
xor dword [edx - 0x11], 0xabbd67a4
sbb bl, dl
scasb al, byte es:[edi]
mov dh, 0xce
shl dword [edx + esi*4], cl
pushal
mov dl, 0x60
sbb eax, 0x2d38b53a
xor byte [edi], al
pop eax
xchg esi, eax
ret
push ecx
stosd dword es:[edi], eax
invalid
outsb dx, byte [esi]
cmp al, byte [ecx]
sbb dl, cl
and edx, ebp
mov dl, 0x2d
push 0x2a
jbe 0x5304af
call 0xc48c3f8d
inc edx
daa
jno 0x530567
nop
out dx, eax
stc
add eax, 0xe3b412c0
inc ebp
xchg edx, eax
imul edx, dword [edx - 0x17f21b19], 0xffffff80
xor byte [ecx + 0x23], dh
cmc
or eax, 0x713080e8
and esi, ebp
xor byte [edx + 0x4589ac80], dh
xchg esp, eax
jo 0x530508
shl byte [esi], 1
dec esp
pushal
jg 0x53054a
jno 0x530516
jp 0x530530
sub dword [ebp + edx*4 + 0x67], esi
std
sub eax, 0x11c096a8
cmp eax, 0xb162b652
dec edx
adc ecx, edx
jg 0x530504
pop ebp
adc dword [ecx - 0x1c], esi
jno 0x5304e6
fild dword [ecx + 0x39]
inc dword [ecx]
imul dword [eax]
ljmp 0x82b6
inc edx
jno 0xdae9bc81
inc edi
mov byte [0x10e498a1], al
mov eax, dword [0xd706863e]
imul esp, ecx, 0x25126322
xor eax, 0x9f9c47d3
rol dword [edi - 0x64], cl
lahf
and al, 0x3b
sub ah, ah
imul ebx, dword [eax + edx], 0xce134d9
loope 0x530580
pop ss
xchg esi, eax
inc esi
call 0x7c002867
jmp dword [ecx - 0x4f84d135]
Function at 0x5414ca
Capabilities:
Encode data using base64

Disassembly:
push edx
iretd
lodsb al, byte [esi]
sbb ecx, esp
and dl, dh
jns 0x541520
scasb al, byte es:[edi]
mov ch, 0xe1
pop edx
int1
inc eax
cmp ecx, dword [edi + 0x20]
jo 0x541533
jl 0x541448
out 0xbd, eax
mov al, 0xf2
mov cl, 0x6c
or dword [eax], ebx
sbb esp, dword [edx]
or al, 0x8c
popfd
or ebp, esp
jno 0x5414b3
xchg edx, eax
insd dword es:[edi], dx
pop ebp
in eax, 0xa2
test al, 0x4f
xor byte [edx - 0x564a257e], cl
aad 0x4f
rcr byte [eax + edi*8 + 0x1d693286], cl
mov cl, 0xed
mov bl, 0xa5
ja 0x5414fd
ret 0x3a75
inc eax
sahf
inc ebp
out 0xdb, al
and bh, ah
dec ebx
dec esp
jne 0x541532
xor esi, dword ds:[edx + 0x2f]
xchg esi, eax
adc ebp, dword [ecx + edi*8 + 0x33cf3765]
pop ebx
jb 0x5414bc
xor dword [esi + 0x52], ebp
lodsb al, byte [esi]
inc ebx
push esi
jp 0x541527
push es
mov bl, 0xae
add eax, 0xb643d5f6
add eax, edi
mov dh, 1
clc
or dword [eax], 0x3d
inc esi
sti
stc
int1
cwde
inc esp
sub esi, ebp
lodsb al, byte [esi]
push ds
jo 0x541599
loope 0x54157e
xchg ebx, eax
sub eax, 0xa1b8b459
adc ecx, dword [edi - 0x70]
stosd dword es:[edi], eax
xchg esi, eax
mov dword [esi], eax
and bl, bh
fsub qword [esi]
push 0x76ca7b3
dec ebx
invalid
mov dh, 0x51
inc ebp
jp 0x5415d6
sal dword [ebx + 0x18], cl
sti
sbb al, byte [eax - 0x26accbae]
jge 0x541527
pop edx
loop 0x5415a3
shl dword [edi], 0x50
and dword [ebx + 0x2383e696], edx
out 0x83, al
invalid
cwde
and dword [ebx], 0xffffff98
xchg al, ch
dec edx
add edx, dword [esi - 0x5f2abd88]
aad 0xa0
cmp eax, edx
mov byte [0x8713e10d], al
sar dword [edi - 0xc], 1
or dh, byte [ecx]
pop ds
xor al, 0x13
cld
mov byte [0xc68333d6], al
jne 0x5415fe
xor esi, dword [ecx - 0x53]
cmpsb byte [esi], byte es:[edi]
into
ror byte [esi - 0x597ecc97], 0xfb
adc dword [edx], 0xffffffe2
in eax, dx
invalid
and dword [eax - 0x2b46b320], 0x17
lcall 0xbd13, 0x12f4672e
popfd
push edi
popal
cmp esi, ebx
jo 0x5415dd
fadd st(0), st(0)
cli
sub dh, dl
retf
rol dword [edx + 0x2672d6ad], 1
pop ds
loop 0x541630
pop edx
jg 0x541643
dec ebx
mov esp, 0xeb511a1e
wait
push ebx
not dword [edx]
lcall 0xc0d7, 0x173d1c77
xchg esp, eax
inc esi
add al, 0x58
lodsd eax, dword [esi]
jno 0x541620
jle 0x541696
pop ebx
push ecx
dec esi
mov dword [0xb2387b01], eax
fldenv [edi]
wait
or edi, dword [ecx]
mov dh, 0x38
xor byte [edi + ebp - 0x5ae7d2e], 0xf2
bound esp, qword [ebp - 0x230e8ec8]
mov bl, 0x86
sti
ror byte [edi + esi*2 + 0x6d], 0xdf
loope 0x5416b3
lodsb al, byte [esi]
aam 0xea
jl 0x5416a2
fldcw word [ebx + 0x3d7126a]
retf
aas
shr dword [edi + edx], 1
loop 0x541623
xchg ecx, eax
les esp, [esi - 0x1cd0aa6f]
jmp 0x5416d8
invalid
push eax
xchg edi, eax
mov ah, 0x35
adc ebx, dword [ebp - 8]
pop ss
or al, 0x2c
int 0xe5
add dl, byte [ebx]
salc
push cs
js 0x54167f
scasb al, byte es:[edi]
stc
stosd dword es:[edi], eax
pushfd
sub byte [edi], dh
outsd dx, dword [esi]
add bh, byte [eax + 0x111c0922]
mov byte [0x7cb5211], al
mov ebx, 0x9b32c655
xor bh, ch
sal byte [ebx - 0x4f], 0x48
enter 0xffffffffffffa6c9, 0xffffffffffffff88
shr dword [ebx + ebp], cl
sbb al, ah
invalid
Function at 0x57cc41
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
frstor dword [edx - 0x30]
push ecx
fcmovb st(0), st(3)
sbb al, 0xff
rcl dword [edx - 0x1c]
xchg ebx, eax
cld
inc ebp
sub eax, 0xed4375a3
rcl byte [ecx - 0x26]
ret
inc ebx
in eax, dx
cwde
mov dword [0xb8e89a0e], eax
push edi
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
in eax, 0xc9
div bl
or dword [ebx - 0x5d4c7885], eax
xor eax, dword [edi + 0x5f]
add cl, ah
pop ebx
mov al, byte [0x2d626abf]
sti
cwde
jb 0x57cb8e
mov bl, 0xa9
and esp, dword [edx - 0x3f2e2df7]
outsb dx, byte [esi]
and esi, dword [di - 0x3002]
jecxz 0x57cb8c
inc ebx
mov bh, 0x3d
pushal
popal
sbb bh, ch
test dword [ebp + 0x2c524b2e], edi
push ecx
push edx
sti
popfd
and al, 0x94
or dword [0x36dbc5d8], ecx
sar byte [esi], 1
and dh, al
cdq
mov bl, 0x67
hlt
sub byte [ebp + 0x12a3193], 3
popfd
pop eax
inc ecx
arpl cx, sp
jg 0x57cb9d
inc esi
insd dword es:[edi], dx
mov ebp, 0xe3db58dc
rcr byte [esi - 0x22], 0x91
daa
xchg edi, eax
mov al, byte [0x1ed1b3a9]
cdq
jae 0x57cc79
int 0x32
sti
leave
xchg dword [edx - 0x5e], edx
rol byte [edx - 0x1b], cl
lodsd eax, dword [esi]
fsubrp st(2)
fucom st(3)
inc ebp
aam 0xef
adc esp, dword [esi + edx*2]
and byte [eax - 0x2b114c7d], dl
mov bl, 0xee
aam 0xc8
pop es
movsd dword es:[edi], dword [esi]
or edx, ebx
xchg ebx, eax
cmp al, 0xe0
jecxz 0x57cc05
mov bl, 0xee
aam 0xc8
pop es
movsd dword es:[edi], dword [esi]
or edx, ebx
xchg ebx, eax
cmp al, 0xe0
jecxz 0x57cc05
mov bh, 3
sar dword [ebp + 0x46], cl
add edx, ebx
jge 0x57cc98
loope 0x57cc77
push edi
cmp al, 0xcc
add dword [edx + 0x11], eax
out dx, al
xor dh, ah
add byte [eax + ebp*2 - 0xb], al
and byte [eax + 0x5ca60373], bh
or al, 0x38
mov gs, word [0x4c531dff]
cmp byte [esi + 0x531dff2d], cl
dec esp
jecxz 0x57cc68
ret
pop ss
shl dword [edx - 0x5a], 1
push ebp
fmul qword [edi + 0x1c]
bound esp, qword [esi + 0x1c4fdc55]
inc edx
mov eax, 0x4befc577
iretd
sbb al, 0x14
pop ecx
jo 0x57cc77
fiadd dword [eax + 0x6b48874d]
fisubr word [edx + 0x5a]
jae 0x57cc4d
or al, 0xbf
sub dh, dh
insd dword es:[edi], dx
mov al, cl
push ss
or eax, 0x15abfe59
aad 0x10
fmul qword [ebp + 0x55]
cdq
enter 0xfffffffffffff145, 0xffffffffffffffc3
mov dword [0x4051b3f9], eax
dec ebp
wait
cdq
jecxz 0x57cc67
push ecx
hlt
Function at 0x583141
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xede8b2b2
xchg esp, eax
mul byte [ebx]
cmp al, 0xea
pop ebp
sti
mov al, byte [0xfbc8b6d2]
push cs
loop 0x583118
adc byte [ecx], 0xcd
adc cl, byte [ebp + 0x6f]
push 0xbdf90370
and ebx, dword [edi - 0x145f91ac]
dec ebp
xchg ecx, eax
jbe 0x583105
cmp esp, dword [ebx - 0x661d3663]
xchg ebx, eax
aas
dec ebp
bound ebx, qword [edx + 0x42]
cmp esp, 0xdc32fc32
cld
xor bh, ah
xor bl, ah
inc edi
mov esp, 0xbfa28e4f
cwde
invalid
jo 0x5830e0
sub dword [ebp + 0x2053ad43], 0xffffffee
add dh, cl
or al, 0x6a
sbb ah, byte [ecx]
adc esi, dword [ecx - 0x3d]
sal byte [ecx], 0x72
adc ebx, dword [ebx + 0x7b86e625]
xor esi, dword [edx - 0x4b]
or eax, 0x4db19ef1
ror dword [ebp - 0x5d], cl
pmaxub mm3, qword [ecx + 0x6cc32cdc]
pop es
insd dword es:[edi], dx
xchg ebp, eax
and dl, byte [ecx]
lds esi, [eax]
or al, 0xdd
push ebp
push cs
lodsd eax, dword [esi]
push edx
bound esp, qword [edx]
mov dword [edx + 0x35328da5], edi
lcall 0xbed, 0xd6234c4e
rep stosb byte es:[edi], al
int 0xf
shl dword [ecx - 0x6d], 0xe7
ret

Function at 0x5baf94
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.005c3fa3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x5bafda
xor eax, eax
jmp 0x5bafdd
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.005c45d8
lea eax, [edi + 0x7c]
test eax, eax
je 0x5baff8
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.005c493d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x5bb036
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.005c493d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.005c3cbd
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005c4659
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x604474
Capabilities:
Encode data using xor

Disassembly:
inc ebx
push esi
and byte [eax], ah
pop edx
fisttp dword [ebp + edi*8 + 0x26e2df32]
xchg edx, eax
invalid

Function at 0x604a24
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0060da33
mov dword [esp + 0x28], 0
test esi, esi
jne 0x604a6a
xor eax, eax
jmp 0x604a6d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call int.0060e068
lea eax, [edi + 0x7c]
test eax, eax
je 0x604a88
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0060e3cd
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x604ac6
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0060e3cd
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0060d74d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0060e0e9
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61d714
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [edi - 0x64ea546d]
push edx
sub esi, esi
add edi, 0x14
pop edi
stc
cmp ch, byte [ebx]
or cl, byte [ebx + 0x36]
or edx, dword [esi + 0x4d]
sub ecx, dword [edx]
dec ebx
or edx, dword ss:[esi + 0x4d]
add eax, 0x5a599ca0
xor eax, 0xa74711d5
xchg esp, eax
push ebx
movsd dword es:[edi], dword [esi]
add byte [ecx], dh
xor eax, edx
aad 0xa9
pop ss
in al, dx
sub al, 0x2a
xor eax, edx
aad 0xa9
pop ss
in al, dx
sub al, 0x2a
xor eax, 0xdb5694db
pop edx
push esi
sbb ebx, dword [ecx + 0x3ea93c6d]
dec edx
in al, 0x45
test eax, 0x45e44a3e
jne 0x61d6f0
push esp
xor edx, dword [edi - 0x58fdf14b]
adc eax, ecx
jp 0x61d727
dec ecx
lodsb al, byte [esi]
in eax, dx
and edi, esp
xchg ebx, eax
adc dl, byte [0x23331c33]
cmp dl, byte [eax + ebp*8]
loop 0x61d7a8
and dword [edx + 0x75528b2], ebp
jp 0x61d6ff
mov ebp, 0x9805440d
push es
in eax, dx
sar ah, 0xf0
movsd dword es:[edi], dword [esi]
cdq
out dx, al
test ah, 0xc9
sub al, 0x47
mov ch, 0x52
movsb byte es:[edi], byte [esi]
dec edx
in eax, dx
push es
outsb dx, byte [esi]
pop ds
push ecx
dec ebp
cmp dword [ecx], 0xffffffe6
out dx, al
sahf
cwde
mov bl, 0xeb
les esi, [esi - 0x4c38dcf1]
adc edx, esp
lcall 0x823c, 0x34248b0a
adc al, bh
xchg esp, eax
push edx
dec esi
dec edi
invalid
cli
push edx
into
push esi
in al, 0x65
inc esi
mov ebx, 0x711e9a84
pop edx
add byte [eax + 0x775a2383], 0xa7
sbb byte [edx - 0xb66a73d], bh
xchg ecx, eax
inc eax
fnsave dword [edi - 0xe853433]
jne 0x61d837
xchg esi, eax
sbb dword [edx - 0xfe688b6], esi
jmp 0xbc13a24f
imul ebx, dword [ebx + 0x4b], 0xdcbe5be6
xadd byte [ebx], al
mov dh, 0xd5
stosd dword es:[edi], eax
loop 0x61d806
scasb al, byte es:[edi]
lcall 0xb7c4, 0x36f84ea4
xor eax, 0x420d2549
cmp edx, dword [eax + 0x1d]
xchg ebx, eax
cmp ah, byte [esi - 0x26]
push eax
jae 0x61d84b
add dword [ecx - 0x2750849e], eax
ret 0x7753
invalid
into
dec ebx
outsb dx, byte [esi]
and dword [esi - 0x38], edi
jl 0x61d7e8
mov dword [edi - 0x45], ebx
xbegin 0x40681a92
test eax, 0xc542e8ee
and al, 0xff
adc al, 0xfa
and edx, dword [ecx - 0x11]
pop edx
mov dword [esi - 0x6c], ecx
mov dh, 6
jns 0x61d87a
invalid
jge 0x61d8f7
jne 0x61d8f4
cmc
and al, 0x86
and dword [eax - 0x6c], ebp
dec edx
cli
dec edx
jmp 0x61d8f4
rcr byte [edi + 0x3a9b8495], 0xc2
pop ecx
sub ebx, ecx
les ebp, [eax + edx*8 + 0x5103afda]
dec esp
test byte [ebx + 0x2b59c23a], bl
fld st(4)
lodsb al, byte [esi]
rcr dl, 1
scasd eax, dword es:[edi]
add edx, dword [ecx + 0x4c]
add al, 0xa0
fisttp dword [edi + 0x64]
or eax, esp
je 0x61d90b
insd dword es:[edi], dx
cli
xchg edi, eax
xlatb
popal
cmp al, 0xb5
mov byte [ecx - 0xc], al
lcall 0x5f97, 0xc541d2b5
lodsd eax, dword [esi]
ret