joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x402ea8
mov edi, dword [0x407084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x402db7
test byte [0x403018], 8
jne 0x402e50
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x403028], 8
jne 0x402e10
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402d59
cmp esi, 3
jbe 0x402dc8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x402d6a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4058a8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x402d59
mov dword [esp], 0x403028
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x402d30
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x402d30
mov dword [esp], 0x403018
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x402d1b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x402d23
mov eax, 0xffffffff
jmp 0x402db7

Function at 0x402f20
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x808004]
jne 0x40100a
repz ret
jmp fcn.00401264

Function at 0x40343b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x808004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040243c
and dword [ebp - 0x14], 0
cmp dword [0x80a58c], 0
mov dword [ebp - 0x18], eax
jne 0x4034ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403596
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x403596
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x80a58c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x80a590], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x80a594], eax
call edi
push eax
call esi
mov dword [0x80a59c], eax
test eax, eax
je 0x4034ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x80a598], eax
mov eax, dword [0x80a598]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403547
cmp dword [0x80a59c], ecx
je 0x403547
push eax
call esi
push dword [0x80a59c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403547
test ebx, ebx
je 0x403547
call edi
test eax, eax
je 0x40353e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40353e
test byte [ebp - 8], 1
jne 0x403547
or dword [ebp + 0x10], 0x200000
jmp 0x40357a
mov eax, dword [0x80a590]
cmp eax, dword [ebp - 0x18]
je 0x40357a
push eax
call esi
test eax, eax
je 0x40357a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40357a
mov eax, dword [0x80a594]
cmp eax, dword [ebp - 0x18]
je 0x40357a
push eax
call esi
test eax, eax
je 0x40357a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x80a58c]
call esi
test eax, eax
je 0x403596
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403598
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x4021e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408184
call sym._EnterCriticalSection_4
mov ebx, dword [0x40817c]
sub esp, 4
test ebx, ebx
je 0x40222b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402224
test esi, esi
je 0x402224
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402200
mov dword [esp], 0x408184
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402410
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402460
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402534
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x40249e
cmp eax, 4
jne 0x4024c0
test esi, esi
je 0x4024b2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x4024a4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x4024ff
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x4024f1
cmp ecx, 0x40
je 0x4024b2
cmp ecx, 4
je 0x4024b2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402410
lea esi, [esi]
Function at 0x401750
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Best_Application
push str.Clariot
push 0
mov dword [0x405102], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x401797
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret

Function at 0x401f51
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x405364]
test eax, eax
je 0x401f6a
call eax
test eax, eax
jne 0x401f6a
push 0xfffffffffffffffe
jmp 0x401f84
push 1
push 0x405010
push 0x405008
call fcn.00401b81
add esp, 0xc
test eax, eax
je 0x401f8a
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x405004
push section..data
call fcn.00401b81
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x401fb0
mov esi, 0x404a7e
mov cl, 0x20
jmp 0x401fb9
cmp al, 0x20
ja 0x401fc3
inc esi
mov al, byte [esi]
test al, al
jne 0x401fb4
cmp al, 0x20
jbe 0x401fda
mov al, byte [esi]
cmp al, 0x22
jne 0x401fcc
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x401fc5
jmp 0x401fda
cmp al, cl
ja 0x401fe0
inc esi
mov al, byte [esi]
test al, al
jne 0x401fd5
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x402009
movzx eax, word [ebp - 0x14]
jmp 0x40200c
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00402041
pop ecx
pop esi
leave
ret

Function at 0x402041
Capabilities:
Terminate process

Disassembly:
call fcn.0040208b
push 0
push 0x405018
push 0x405014
call fcn.00401b81
push 0
push 0x405020
push 0x40501c
call fcn.00401b81
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40c02d
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xc0
out dx, al
cmp esp, 0xffffffa8
xlatb
cld
xlatb
imul ebx, dword [edi - 0x5c], 0x6dff658c
salc
loop 0x40c03f
call dword [ebp - 5]
push ebp
sti
push ebx
xor dword ds:[edi - 0x2811692e], esp
dec esp
push ebp
pop es
push es
idiv bh
jnp 0x40c0a5
jp 0x40c057
and eax, 0x6d7d8e12
jge 0x40c0c6
jno 0x40c0ca
out dx, eax
int 0x53
lodsb al, byte [esi]
and eax, 0xf39e802
sub byte [esi + ebp + 0x20c67603], 0x2c
inc esi
and edi, edi
pop edi
cmp edx, ebp
loopne 0x40c0e6
mov ebx, 0xe449b4ef
in eax, 0xd7
dec ecx
in al, 0xe5
xlatb
out dx, eax
loop 0x40c0c0
stc
mov byte [0x872f1053], al
dec edx
xlatb
das
xchg dword [edx - 0x29], ecx
xor dl, al
xchg edi, eax
xor dword [edi + 0x7f7c3be5], eax
or al, 0x12
out 0x8a, eax
js 0x40c0c1
ja 0x40c0f8
sti
loopne 0x40c145
cmp esp, dword [ecx - 0x66686854]
xchg edi, eax
cdq
cmp ah, byte [edi + edi - 0x79]
push ds
imul dh
mov eax, dword [0xf4d7d3d]
pop es
add al, byte [ecx + esi*2 + 0x1f]
pop ds
mov al, bh
aas
stc
pushal
jno 0x40c0b5
lock sub byte [ecx], ah
add ecx, dword [ebx]
pop ebp

Function at 0x45946e
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
push eax
fnstcw word [0x6415c606]
sub bl, cl
mov al, byte [0x509bc986]
sub byte [eax - 0x20], bh
cmp esp, edi
cmp eax, 0x1fa334b1
xor al, 0xa3
pop ds
sub byte ds:[ecx + 0x5675eb2d], dl
out dx, al
sub eax, 0xee5675eb
push esi
push ebp
lcall 0x296a, 0x5e0cc242
push 0x29
cmp dword [edi], esi
lcall 0x27d8, 0x2e8e5c2
imul edx, dword [eax + 0x7004b32b], 0xfffffff8
in eax, dx
call 0x6b6d6ca6
nop
sub esi, dword [ebx - 0x12078ffc]
jecxz 0x459485
mov dh, 0x42
dec edx
push 0x988232d6
sub ecx, edx
lds edx, [ebx]
mov esp, 0x9a6ba663
loope 0x459498
sbb byte [eax + 0x13c5d129], 0xbc
arpl word [esi - 0x271e6595], sp
cmpsb byte [esi], byte es:[edi]
imul ebx, dword [edx - 0x139c271f], 0xffffffe3
imul dword [ebp - 0x4c6f9b69]
jae 0x4594b3
arpl sp, bp
jecxz 0x4594bb
lodsd eax, dword [esi]
xchg edi, eax
nop
mov bl, 0x73
call 0x4b86048b
adc byte [esi + 0xf], bh
mov esp, 0x104b406f
jle 0x4594e1
mov dl, dl
mov al, 0xf
jl 0x45949f
into
and dword [esp + ecx - 0x38], 0xffffffed
jns 0x45948b
jg 0x4594c2
loopne 0x459505
and cl, byte [ecx]
in eax, dx
or ebp, ebp
mov ch, 0x95
pop ebp
xor dword [eax], edx
shr esp, 0xbd
movsd dword es:[edi], dword [esi]
dec edi
sbb al, 9
cwde
adc al, 0xd
jns 0x459490
push ss
mov al, 0xbd
outsd dx, dword [esi]
or ebp, esi
aad 0x88
cdq
in eax, dx
xor ebp, dword [eax]
mov esp, 0xf9d80f1
xlatb
and al, 0x4e
jb 0x459531
sbb byte [ebp + 0x4e24d70f], 0x72
and al, 0x18
idiv bh
mov ch, al
push ecx
pop ds
salc
sbb dh, dh
dec dword [edx - 0x29e0ae18]
inc esp
invalid
jmp 0x54bdcb3b
Function at 0x4692e3
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
shl dword [edx - 0x1e], cl
outsd dx, dword [esi]
sbb byte [ebx - 0xa], dh
xor eax, 0x3d3d4db
adc esp, dword [ecx + 0x6f92c302]
add edx, dword [ebx]
mov eax, dword [0x6f92c302]
xor ebp, dword [edi + 0x13]
sbb ecx, dword [eax - 0x4232b18d]
int 0xbd
xor byte [edx + 3], 0x72
out 0x92, al
jb 0x46930b
outsd dx, dword [esi]
adc dword [ebx - 0x7f], edi
pop edi
push ebx
repne outsb dx, byte [esi]
mov ch, 0xf6
stc
xor dh, byte [edx + 0x643921c5]
bound ecx, qword fs:[edx]
bound ecx, qword fs:[edx]
xor ebp, dword [edi + 0x326efd51]
and al, byte [edx]
xchg edx, eax
mov dl, 0xd3
jb 0x4692db
mov dl, 0xdb
sub bl, dh
push ebx
jg 0x4692ae
sub dl, dl
xchg edx, eax
jmp 0x4692bb
out dx, eax
ret 0x3ef7
Function at 0x4702ce
Capabilities:
Encode data using xor

Disassembly:
in al, 0x9c
insb byte es:[edi], dx
push esp
lahf
cmp al, 0xd5
cmp eax, 0xc302ca6c
stosd dword es:[edi], eax
push esp
in al, dx
fistp word [ecx + 0x13]
dec edi
rcl ebp, 0xb4
out 0x5a, eax
sub ebx, 0x3c4c5c25
and eax, ecx
pop edx
inc esi
in al, 0xdc
jo 0x470228
outsd dx, dword [esi]
int 0xa8
dec esp
xchg esi, edx
mov ch, 0xb4
mov eax, 0xcb288688
dec esi
xchg dword [edi + edx*8 + 6], ebp
mov word es:[ebp + 0x7a], es
into
insb byte es:[edi], dx
iretd
and dword [esi], ecx
loop 0x4701bb
add dword [ebp - 0x63], edx
xor al, 0x3b
xchg ebp, eax
dec ebp
pop ds
cld
sub ah, ch
cmp edx, dword [ebp + 0x28fc1f4d]
in al, dx
mov byte [esi], bl
push ds
out 0xc0, al
push 0xa88e083a
shr byte [eax + 0x3a], 8
mov gs, word [eax + 0x32fcf21c]
ja 0x470220
sbb al, 0xf2
cld
xor dh, byte [edi - 0x1e]
mov dh, ah
lea esp, [edx]
push 0x271d8843
mov ebx, 0x9d42b5cd
inc esi
jnp 0x470238
sbb edi, dword [esi]
xchg esp, eax
dec edi
and edi, dword [esi + 9]
jge 0x4701e4
cmpsd dword [esi], dword es:[edi]
mov bh, dh
adc byte [edx], ah
and eax, 0x1782ef49
inc ecx
insb byte es:[edi], dx
psubsw mm3, qword [ebx]
fdiv dword [ebp + 0x2fbc6e63]
imul edi, dword [edi + 0x64ff5b19], 0xcb8470f8
test bl, cl
shl dword [eax + edi*2], cl
jg 0x470232
mov ch, 0x9a
dec esp
ja 0x47025b
lcall 0x31e5, 0x4cda774c
dec esp
in eax, 0x31
pop edi
pop eax
je 0x470230
sti
fimul word fs:[ecx]
mov byte [0x12fa217e], al
mov ecx, 0xa42c69f
or dword [edx], esi
sub al, 0xe1
push edi
mov dword [0x47462aa4], eax
frstor dword [0x46fdbcf3]
push esi
mov ds, word [eax + 0x7e]
mov dh, 0xe1
pop ebx
jmp 0x470276
wait
xchg edx, eax
movsd dword es:[edi], dword [esi]
out 0xce, al
sub ecx, dword [ebp - 0x2a]
xchg esp, eax
dec ecx
fstp dword [ebp + 0x25726bb5]
jb 0x4702f5
jb 0x4702f5
ja 0x470262
mov dword [0x805d1fb6], ebx
xor eax, 0x34677943
outsb dx, byte [esi]
mov word [edi], ds
sahf
loope 0x47027c
std
pop edi
int 0x7b
insb byte es:[edi], dx
call 0x83427758
nop
outsd dx, dword [esi]
sbb dword [esp + ebx + 0x137163eb], 0xffffffb4
movsd dword es:[edi], dword [esi]
call dword [ecx - 0x29]
jns 0xf762865d
adc esi, dword [ebp + 0xfd751ff]
mov dword [ebx + eax*4 + 0x1b], ebx
div dword [ecx + 0xc5d8f7c]
jle 0x4702c0
mov cl, 0x7c
invalid
xor byte [ebp + 0x5c], 0xcd
mov dl, 0x17
das
cmp ecx, dword [eax]
sub bh, ch
not ecx
shl dh, 1
ficomp dword [edx + 0x36147561]
lodsb al, byte [esi]
stc
and ebx, 0x5475c8db
add eax, 0xe6545a75
movhps qword [esi - 0x6d6645fb], xmm6
mov bl, 0x55
sub al, 0x8e
in al, 0xeb
push edi
inc esi
sub byte [esi], ah
adc dword [esi + 0x3315ab6f], esi
fisttp qword [edx - 0x27]
sbb byte [edi - 0x4bc79a9a], al
invalid
Function at 0x486fe0
Capabilities:
Check http status code

Disassembly:
sbb ch, bl
dec esp
fcmovu st(0), st(6)
push ss
ret
inc ecx
mov ebp, 0xd45140d9
salc
retf 0x587d
dec edx
push esi
mov dl, 0x72
pop es
mov ds, word [esi - 0x55e5d871]
pop ds
aad 0x63
pop ds
daa
sbb ch, byte [edx + 0x1f63d51f]
cmp edi, dword [ebx + ecx*2 + 7]
enter 0x5105, 0x60
push ebp
cmp al, 0x8d
jp 0x487067
pop ebx
lahf
rcl dword [edi + 0x1d], cl
pop ds
add byte [ecx - 0x1e], ch
jo 0x48707b
sub al, 0xeb
loopne 0x486fbb
je 0x486faa
push ss
xor al, ch
mov ch, 0x17
pop esi
xchg ecx, eax
movsd dword es:[edi], dword [esi]
mov bl, 0x8b
int1
invalid
cmc
jecxz 0x486fad
mov ebx, dword [esi - 4]
mov bh, 0xa9
fmul st(3)
cmp ebx, eax
aad 0xc8
inc ecx
jne 0x487030
loop 0x48701e
loop 0x48701e
xlatb
pop edx
cmp al, 0x85
push eax
je 0x48706d
leave
rcr dword [edi + ebx*2 - 0x48cc0f3], cl
inc edi
cmp dword [edx + edx*2 + 0x86bcabc], ebp
dec edx
salc
mov ch, bh
lcall 0xaa46, 0x6dcfacd3
xchg dword [edi], eax
jp 0x486fe8
cmp al, 0xc8
mov bl, 0xd7
mov eax, 0x4ef715bb
mov cl, 0xc8
xchg edi, ebp
out 0x70, eax
stosb byte es:[edi], al
adc byte [ebx], cl
jmp 0x48707f
int 0x95
adc edx, ebp
cmpsb byte [esi], byte es:[edi]
push esi
fisttp dword [ebp - 0x2c300145]
mov eax, dword [0x71130cce]
mov byte [0x60ff976e], al
bound ecx, qword [eax + 0x5d]
fsub qword [edx]
xchg edx, eax
mov cl, 0x15
and eax, 0x60d62e50
and bl, 0xf
cli
push edi
cmp byte [esi + ebp - 0x2064ccf8], 0xac
das
jl 0x487065
or al, 0x13
jno 0x487021
outsb dx, byte [esi]
xchg edi, eax
jmp dword [eax + 0x62]
or edi, dword [eax]
pop ecx
aad 0x10
push ebx
and dword [eax - 0x42], esp
jmp 0x7785c73b
Function at 0x49744d
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
pushal
or edx, ebp
into
lahf
push ss
arpl word [edx + 0x35], dx
arpl word [esi], di
mov bl, 0xee
dec ebp
outsb dx, byte [esi]
push 0xffffffffffffffa9
out dx, eax
cmpsb byte [esi], byte es:[edi]
invalid
mov bh, 0x6f
cmp eax, 0xf5079b22
mov esi, 0xcb480882
xlatb
jmp dword [esi + 0x48]
ja 0x4973f5
jbe 0x4973af
xor eax, 0x92242e36
insb byte es:[edi], dx
cmpsd dword [esi], dword es:[edi]
dec esp
outsd dx, dword [esi]
mov bh, 0xa8
sbb byte [edi], ch
xlatb
jne 0x49739c
sbb ax, 0xf133
xor esi, ecx
jg 0x497388
cld
js 0x4973ed
sub esi, dword [esi - 0xf2c2683]
jb 0x49742e
mov dh, 0x7d
invalid
dec edx
push edx
invalid
shl esp, 0xfb
xor eax, ebx
mov byte [0xbdfed8fc], al
invalid
mov ebp, 0xdbf6038
xor ch, byte [edi]
invalid
pop ds
and byte es:[esi], al
mov byte [0xe6db3ed8], al
out 0x81, al
mov dword [bp - 0x6a60], ecx
and dword [edi - 0x77], 0x2495a08e
mov bh, 0x91
xchg ebp, eax
and al, 0xb7
xchg ecx, eax
jae 0x4974b1
dec esp
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
sbb dword [esi + 0x20], 0xcb7da55d
mov dh, 0x76
and bl, byte [edx - 0x7f86bc3e]
ja 0x4973d5
jecxz 0x497415
neg byte [ebp + esi*2 + 0x7b9ce6f5]
outsb dx, byte [esi]
mov esp, 0x97ab3fb3
inc ebx
push esi
out 0xad, al
cwde
out 0x67, eax
loope 0x49742f
test byte [edi + 0x28b7686e], ah
cmp al, 0x3d
add al, 0xdb
push edi
aas
cmpsb byte [esi], byte es:[edi]
xor byte [ebx - 0x7d5e4635], ch
xor al, 0xdc
mov dword [0x9666573], eax
xor ebx, ebx
loopne 0x4974b2
dec esp
test byte [edx - 0x4363a6d8], al
shl al, 1
or al, 0x6c
loopne 0x497434
in eax, 0x16
mov al, byte [0x4e5cbb80]
or esp, dword [ebp - 0x3faa546c]
push esi
add al, 0x93
mov eax, dword [0xc6a6f3]
stc
push ebx
inc ebx
or dword [0xf2477b7b], edx
lodsb al, byte [esi]
lea ebp, [ebx*8 + 0x6fc862b]
salc
inc ecx
sub al, 0xdd
sub eax, dword [esi + 0x41d606fc]
and eax, 0x480b68da
cmp dh, byte [edi]
dec eax
push esi
and esp, dword [ebx - 0x79]
dec esi
push 0xffffffffffffffcc
imul eax, dword [eax + 0x695ca540], 0x15012df2
push es
into
add edi, dword [edx + 0x95ddf7]
mov edx, dword [ebx + 0x1a]
invalid
Function at 0x49754d
Capabilities:
Encode data using xor

Disassembly:
dec eax
jns 0x497534
lds ebp, [esi - 0x4bcb4b45]
push cs
dec esi
add byte [ecx], dh
mov edi, 0x6b35cb84
xor cl, dh
stosd dword es:[edi], eax
div cl
retf
and byte [edx + 0x624bfde7], al
xor eax, ebp
jnp 0x497565
mov eax, dword [0x40e21604]
cli
sub al, 0x8c
pop edi
xchg byte [edx + esi*4 + 0x42], dh
ror dh, 0x46
inc esi
inc esi
jb 0x497559
mov bh, 0x7d
add eax, 0xe9221142
xchg ecx, eax
and al, 0x17
pop ss
jo 0x497514
pop ss
mov ecx, 0x3795ad57
and al, 0xd1
jp 0x4975c2
push ss
inc esi
adc dword [eax + ebp + 0x3b628851], eax
arpl word [ebx - 0x458aea91], bp
xor byte [ebp + 0x15967267], ch
add dword [ebx], esp
sbb eax, 0x88c3b04e
push ebx
and ah, bl
pop ecx
scasb al, byte es:[edi]
xor dword [esi + 0x5a65f3fd], eax
push esi
cmp eax, 0x3889faf3
mov bl, 0xdb
push edx
pop ecx
pushfd
xchg esi, eax
jae 0x497583
xlatb
sub dword [edi + 0x25], esi
int1
inc ebx
or byte [ebx], al
popal
test eax, ecx
or dword [ebx], 0xfffffff7
push ss
xor edi, ebp
push edx
cmpsb byte [esi], byte es:[edi]
cmp al, 0x15
test dword [esi + 0x4ec5c54b], ebp
int3
jecxz 0x4975f6
xor edi, edx
cli
in eax, dx
inc ebx
mov ecx, 0x859c5c1f
in al, dx
xlatb
sbb edi, esi
jbe 0x497600
insb byte es:[edi], dx
sbb eax, 0x55c02ec3
add esp, dword [esi + ecx*2]
rcl byte cs:[ebp + 3], 0x24
dec esi
or al, 0x73
mov ch, 0x10
outsb dx, byte [esi]
and ch, byte [ebx - 0xe684465]
lodsb al, byte [esi]
jno 0x4975c1
xchg ebp, eax
push 0xb99092b5
or edx, dword [eax + 0xbea12f3]
sahf
cmp eax, 0xae9f8c83
ret
clc
or dword [edi + ebx*4 + 0x3f59c3ae], 0x77
aas
ja 0x497659
jae 0x4975d4
xchg ebx, eax
add cl, 0x35
sub eax, dword [ebx + ecx*4 + 0x3522bb25]
adc dword [edx - 0x16dc77fd], esp
aam 0x2b
std
mov esp, 0x7be9666
mov esp, 0x8e765d3b
int1
cmp al, 0xab
psubsw mm4, qword [ebx - 3]
sar ebp, 1
ret

Function at 0x49e85b
Capabilities:
Encode data using xor

Disassembly:
pop ebp
in eax, dx
fcompi st(5)
cmc
cmc
imul edi, dword [0x21f87d51], 0xffffffeb
test al, 4
sub ch, byte [ebx + 0x12]
mov eax, 0x2303580d
cwde
aaa
test dword [eax + 0x27d272e3], ebx
mov byte [0xf1d418ea], al
sub cl, byte [eax + 0x60eae03e]
wait
sbb byte [ecx + 0x4893d1e8], bh
mov eax, 0xe307591e
std
cdq
pushal
jb 0x49e858
sbb dword [esi - 0xbd7b960], ebp
jbe 0x49e8c5
and byte [ebp - 0x32e18eda], ah
pop esi
add eax, 0x9c307d92
push ds
scasb al, byte es:[edi]
enter 0xfffffffffffff093, 0xfffffffffffffff3
or ecx, dword [0x6d160526]
xor byte [esi + ebx - 0xf6c3752], bl
or ecx, dword [0x6d160526]
pop edx
out 0x6a, al
cmp eax, 0x279a8380
jle 0x49e8a4
push ebp
lahf
ret
sub eax, 0x936a944d
add ecx, dword [ebp + 0x69]
sal byte [edx + 0x5c3dbb55], 1
jo 0x49e94a
rcr dword [ebx + 0x79c8fe81], cl
invalid
and esi, dword ds:[edi + 0x40]
std
aad 0x98
adc byte [esi], ch
retf