joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x5018af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x51e348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x51e348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x51d178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5018b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x4025ef
Capabilities:
Terminate process

Disassembly:
jmp 0x41a215
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x41a226
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00403ae4
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40268f
Capabilities:
Query environment variable

Disassembly:
jmp 0x441c6f
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x441c83
xor edi, edi
jmp 0x441cba
push ebx
push esi
call fcn.00441b79
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00402bdf
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x441caa
push ebx
push esi
push edi
call fcn.00403995
add esp, 0xc
push 0
call fcn.00404007
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x403a08
Capabilities:
Parse pe header

Disassembly:
jmp 0x40d013
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40d053
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d053
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d053
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40d053
cmp dword [ecx + 0x74], 0xe
jbe 0x40d053
cmp dword [ecx + 0xe8], 0
je 0x40d053
mov al, 1
ret
xor al, al
ret
Function at 0x408570
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464725
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x474004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 1
mov word [ebp - 0x28], 0
cmp dword [eax + 0x14], 0x10
mov ecx, eax
mov dword [ebp - 4], 1
jb 0x4085cb
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
push 0
lea ecx, [ebp - 0x28]
call fcn.00404264
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 0x10
jb 0x408650
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
mov byte [ebp - 4], 4
cmp edx, 0x1000
jb 0x408642
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086ec
push edx
push ecx
call fcn.004015b9
add esp, 8
mov byte [ebp - 4], 3
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], 0
cmovae eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
mov eax, 0x614
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x60], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov edx, dword [ebp - 0x2c]
test eax, eax
mov dword [ebp - 4], 0xffffffff
sete al
mov byte [ebp - 0x41], al
cmp edx, 0x10
jb 0x4086d3
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
mov dword [ebp - 4], 5
cmp edx, 0x1000
jb 0x4086c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086f1
push edx
push ecx
call fcn.004015b9
mov al, byte [ebp - 0x41]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004022c0
mov esp, ebp
pop ebp
ret
call fcn.0040307b
call fcn.0040307b
int3
Function at 0x408760
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0
movlpd qword [ebp - 0x1c], xmm0
cmp dword [eax + 0x14], 0x10
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
jb 0x4087a4
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 0x10
jb 0x4087b2
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x20], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x408803
mov eax, dword [ebp - 4]
test eax, eax
je 0x408803
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop esi
je 0x408803
cmp dword [ebp + 8], 0
sete al
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4089b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4647c0
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x474004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x23
push 0
mov dword [ebp - 0x130], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x408afa
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x11c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408a30
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.0040227f
push 8
push str.icinga2
lea ecx, [ebp - 0x12c]
mov dword [ebp - 4], 0
call fcn.00401ea6
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
mov dword [ebp - 4], 0xffffffff
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x408ade
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
mov dword [ebp - 4], 1
cmp edx, 0x1000
jb 0x408ad4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b1b
push edx
push ecx
call fcn.004015b9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004022c0
mov esp, ebp
pop ebp
ret
push str.SHGetFolderPath_failed
lea ecx, [ebp - 0x13c]
call fcn.00403314
push 0x472ccc
lea eax, [ebp - 0x13c]
push eax
call fcn.00404250
call fcn.0040307b
int3
Function at 0x408cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464840
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x474004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push eax
push 0x201
push 0
push str.SOFTWAREIcinga_Development_TeamICINGA2
push 0x80000002
mov dword [ebp - 0x120], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408da6
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x103
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408d9a
cmp dword [ebp - 0x120], 1
jne 0x408d9a
mov eax, dword [ebp - 0x118]
cmp eax, 0x104
jae 0x408de3
lea ecx, [ebp - 0x114]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0xf
mov byte [ebp + eax - 0x114], 0
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408d80
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
mov ecx, esi
call fcn.0040227f
jmp 0x408dc7
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004022c0
mov esp, ebp
pop ebp
ret
call fcn.0040130c
int3
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431000
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430fd9
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4cee23
Capabilities:
Encode data using xor

Disassembly:
dec edx
xor esp, dword [edi + 0x47e8c166]
shr ax, 0x47
mov al, byte [eax + edx - 0x4d9600af]
adc ebp, 2
mov word [ebp], ax
lea esp, [esp + 4]
jmp fcn.0048e19a
add dword [esp], 0xc2d43
mov esi, 0x4816db1
call fcn.0059e961
call fcn.005d6bac
fisttp qword [edi + 0x5c26504d]
dec ecx
pop ecx
push esp
mov byte [eax + ebx*2], ah
xchg edi, eax
out dx, al
mov eax, 0x7de6556a
bound edx, qword [esi + 0x4ce271c2]
adc byte [esi + ebp*4 + 0xf], bl
aad 8
pop esp
scasb al, byte es:[edi]
pmullw mm1, qword [eax]
cmp bl, byte [ebp + 0x6e7f4dcc]
xlatb
xor dword [ecx + 0x55], esp
mov dword [0x10107a14], eax
popfd
or al, 5
jle 0x4cee54
jle 0x4cee01
in al, 0xfb
sbb ch, byte [ecx + 0x7cc24f62]
test eax, 0x7cc24f62
add eax, 0x6c6240f3
dec edi
sbb al, 0xbf
jne 0x4cee72
invalid

Function at 0x4e3e9f
Capabilities:
Encode data using xor

Disassembly:
or dword [esp + 0x10], 0x9cb6f0ac
neg byte [esp + 0x10]
mov dword [esp + 0x14], 0x9628d936
lea ebx, [ebx + 0xd90c00e]
push esi
and dword [esp + 0x14], 0x74ad6d26
sub byte [esp + 0x18], 0x83
call fcn.0059ee80
jg 0x597f3e
add al, 0x9d
push ebx
jecxz 0x4e3efd
xchg edi, eax
mov ss, word [ecx + 0x15]
punpckldq mm2, dword [eax + 0x4dff7b87]
mov esp, 0x5e7b4ba8
test al, 0x4b
jnp 0x4e3f45
scasd eax, dword es:[edi]
out 0x1a, al
xor eax, 0x9769bac1
inc ebp
cmc
sub al, 0x97
mov dword [0xdff022fe], eax
mov byte [0x63fad613], al
test byte [edi - 0x3f56ff5a], dl
cli
arpl word [edi + edx*4 - 0x3f56ff5a], ax
shl dword [edx + ebp], 1
pop ebp
inc esp
cmp esp, dword [ebp - 0x65]
jp 0x4e3ee8
sti
shl byte [esi - 0x323f5700], 0x74
jp 0x4e3f67
push edi
das
cwde
pop edx
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
add byte [ecx + 0x69bdcbc0], ch
lahf
sahf
scasd eax, dword es:[edi]
jmp 0x4e3ee3
sbb al, 0x19
lodsb al, byte [esi]
sub eax, 0x1b8dd5b0
rcl byte [ecx - 0x55a9f64d], 0xc2
sbb dword [ebp + 0x5abc012d], 0xffffffaf
aad 0x8a
mov ch, 0x81
xlatb
aad 0xd1
dec eax
cmp al, 0xa5
or eax, dword [eax]
test eax, 0x95041e9f
sub al, 0x76
popal
stosd dword es:[edi], eax
and dword cs:[eax - 0xcd6d26c], ecx
and al, 0x5d
and al, 0x5d
stc
rol byte [ecx*8 - 0x953e47f], 0xe1
pop ebx
fdivr st(6), st(0)
test eax, 0x91ed0430
imul byte [ecx - 0x6e12fbd0]
mov byte [ebp + esi*2 - 0x67], bh
inc eax
inc esp
pop ds
jecxz 0x4e3f27
xlatb
into
rep lodsd eax, dword [esi]
je 0x4e3f87
mov eax, 0xdbc7f667
insb byte es:[edi], dx
pop eax
xchg ebx, eax
or dword [esi + 0x6d42be5d], 0x39
mov bl, byte [edx - 0x19]
fucomi st(7)
push edx
in al, dx
cwde
add edx, eax
jl 0x4e3fa0
invalid
jbe 0x4e3f91
test dword [edi], ecx
and al, 8
stosd dword es:[edi], eax
mov esp, 0x508ae18
sar bl, 1
pop ecx
pop es
int 0xea
dec ebx
push esi
jo 0x4e3f79
std
in al, 0x10
mov edx, 0x21d81c25
inc ebp
iretd
Function at 0x519172
Capabilities:
Encode data using xor

Disassembly:
pop ebx
push ebx
mov ebx, 0x7a31e7bd
pushfd
cmp bx, 0x5701
push edx
movsx ebx, bx
mov ebx, dword [esp + 8]
xchg dword [esp + 0xc], ebx
jo 0x695f4d
mov edx, 0xdcbb2f13
or edx, 0x7b83dfbd
mov dword [esp + edx + 0x440049], edx
mov byte [esp + edx + 0x440049], 0x8b
mov dword [esp + 8], ebx
jbe 0x5929d8
cmp dl, 0x86
push ebp
push esi
xchg byte [ebp + 0x56], dl
call fcn.00559958
sub eax, edx
or al, 0x8a
jo 0x5191b7
sub eax, 0x8d405ff
ret 0xb138
not word [esp + 4]
call fcn.0060fc7b

Function at 0x51b1e9
Capabilities:
Check for software breakpoints

Disassembly:
seta byte [esp + esi + 0x7f48]
xor byte [esp + esi + 0x7f3c], 0xbe
test word [esp + esi + 0x7f48], 0x9225
mov esi, dword [esp + esi + 0x7f14]
jg 0x51b200
add byte [0x34b48b92], ah
adc al, 0x7f
add byte [eax], al
not dword [esp + 0x40]
call fcn.0052f9ad
insd dword es:[edi], dx
and ah, byte [0x15b43b29]
dec esp
push cs
inc esp
daa
aad 0x98
je 0x51b243
mov byte [0x3c44e13b], al
lodsd eax, dword [esi]
rol dword [ebx + 0x4b], 1
pop ss
or byte [edx - 0x2e], 0x81
mov al, 0x4d
movsd dword es:[edi], dword [esi]
adc byte [ebp - 0x6279ca0e], ch
cmc
inc edx
cmp al, 0xcc
cld
fld xword [edx + 0x9acfbfc]
imul ebx, dword [edi - 0x67a660ce], 0x91082545
fdiv qword [ebx + 0x46ab9638]
lodsb al, byte [esi]
or dword [ecx - 0x61], ebp
xor bl, byte [edi + 0x25459859]
or byte [ecx - 0x69c74c24], dl
stosd dword es:[edi], eax
inc esi
xor eax, 0x5d0269e
cdq
push ecx
push 0x54
nop
enter 0x64fc, 0xffffffffffffff97
mov edi, 0x21f3f15f
leave
sal esp, 0x56
jae 0x51b1fe
std
iretd
Function at 0x54e314
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [esp + ebp + 0x725c44fd]
mov dword [esp + 0xc], 0xe6f39668
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.00617fda
salc
or ah, byte [esi + 0x52fee514]
loop 0x54e361
salc
lahf
add byte [ebp*8 - 0x489937a5], dl
salc
and al, 0x85
pop edx
mov dword [edi - 0x35], esi
pop ds
inc ebx
movsb byte es:[edi], byte [esi]
push eax
sub esi, esi
xchg byte [esi], dl
wait
jne 0x54e398
sub byte [ecx + 0x78b31f12], ah
mov dl, 0x39
sbb byte [eax], bl
loopne 0x54e3cc
insb byte es:[edi], dx
bswap ebp
pop ecx
aas
and ah, byte [edx]
test ah, ch
lodsd eax, dword [esi]
popfd
pushal
repne insd dword es:[edi], dx
insb byte es:[edi], dx
pushfd
add eax, 0x5957f65b
aas
and dl, byte [edx]
stc
leave
or al, 0xbb
int 0x95
mov dl, 0xa3
lodsb al, byte [esi]
pop ss
mov ah, 0x10
lodsb al, byte [esi]
pop eax
pop ecx
aas
and bl, byte [esi]
mul dword [ebx - 0x33]
loopne 0x54e3a3
add al, bh
retf
out 0x5d, al
jmp 0x54e38c
push ebp
sbb al, 0x80
sbb dword [eax - 0x19c314cf], ecx
mov eax, dword [0x31]
insb byte es:[edi], dx
idiv byte [edx + eax*8 + 0x7e]
sub byte [esi - 0x10], ah
mov cl, 0x9c
aas
jmp 0xb23c3fa5
jle 0x54e3de
invalid
pop ss
mov ch, 0x9c
andnps xmm3, xmmword [eax + esi*4]
push ebp
sbb al, 0xb0
lodsd eax, dword [esi]
loop 0x54e3b4
adc eax, 0xf1c69e47
wait
arpl word [ecx], sp
cdq
mov dh, 0x16
adc byte [eax - 0x44f3698d], dh
bound esi, qword [esi]
lodsb al, byte [esi]
sbb eax, edx
xchg esi, eax
or al, 0xbb
bound ebp, qword [ecx - 0x567595e9]
ja 0x54e3d0
cmp eax, 0xd68c890c
salc
adc al, 0xd4
pop ebx
and al, 0xfa
ja 0x54e43c
sbb byte [eax - 0x616c2874], bl
xchg ebx, eax
sahf
push 0xbf50622b
sbb al, 0x9a
cmpsd dword [esi], dword es:[edi]
push edi
pop esi
dec eax
cwde
pop edi
fdiv dword [eax - 0x168cbb0f]
pop esi
xchg eax, edi
pop esp
push esp
fiadd dword [ebx - 0x2634ccec]
pop edx
xor edx, edi
jne 0x54e40a
mov ch, 2
xor eax, 0x4b6524b5
retf 0x2e9a
mov byte [0x8cdb47dc], al
mov al, byte [0x3df29274]
mov eax, dword [0x23ae8aad]
invalid
Function at 0x567863
Capabilities:
Encode data using xor

Disassembly:
ja 0x65deda
mov bx, 0x54c5
cdq
mov esp, 0x633bd4
sub esp, eax
push 0x6d
lea eax, [eax]
mov dword [eax - 0x74], edi
jne 0x5678e5
inc byte [ecx]
inc ecx
pop ds
in al, dx
or bh, cl
fcmovnu st(0), st(6)
cmpsd dword [esi], dword es:[edi]
insd dword es:[edi], dx
add al, 0x23
jbe 0x567892
push ds
fnsave dword [esi - 0x23]
aam 0xc4
or al, dh
push ss
mov al, byte [0x79875ba2]
jns 0x5678d9
imul ebp, dword [edx - 0x1c], 0xb28b8ae5
enter 0x40e6, 0xffffffffffffffdf
int3
mov eax, 0xbb6036f7
invalid
sub al, 0xd5
call 0xd54b6f0d
push cs
call 0x5756c011
and esi, dword [edx + edx*2 + 0x6d]
movsd dword es:[edi], dword [esi]
sbb al, 0x5d
nop
popfd
xor eax, 0xa2b6ab19
push ebp
push eax
outsb dx, byte [esi]
movsd dword es:[edi], dword [esi]
sbb al, 0x25
call 0x247fa868
sbb byte [esi], bh
jnp 0x567951
and edi, dword [eax - 0x4b]
pop ss
fimul word [ecx]
rcl dh, cl
retf
dec edx
insb byte es:[edi], dx
mov dword [0xf7552789], eax
adc al, 0x92
ja 0x567904
mov byte [0x371456f4], al
add eax, 0x244481a1
add byte [ebp + 0x77], cl
stosb byte es:[edi], al
push edi
inc esp
and al, 0xc
stosb byte es:[edi], al
enter 0x31b9, 0xffffffffffffff8d
wait
sbb al, 0x67
pushfd
retf
push esi
mov esi, dword [esp + 0xc]
xchg dword [esp + esi - 0x58aa5b21], eax
push edx
jno 0x68e4ec
mov edx, esi
or dword [esp + esi - 0x58aa5b25], edx
movsx si, dl
shl dl, 0xf2
mov dword [esp + 0x14], eax
call fcn.0068f414
sbb dl, ah
mov ah, 0x4c
dec esp
jno 0x68e508
pop ebp
mov dword [0xf06a3ec2], eax
pop edi
pop edi
lahf
or edi, dword [edx + ebp*4]
test al, 0x20
dec ebp
jecxz 0x68e54a
test bh, bl
jae 0x68e52e
sar byte [edi], 1
mov esi, 0xce3f6657
leave
push edx
xor al, 0xc8
ja 0x68e520
aas
mov edi, 0x97827b59
jb 0x68e510
aad 0x87
jb 0x68e4f5
dec ecx
sub eax, 0x4ac2ef28
mov eax, 0xf148fe11
push ds
nop
stosb byte es:[edi], al
xlatb
dec ebx
dec ebx
cwde
into
and eax, esp
cwde
sbb ah, byte [ebx + ecx*2 + 0x68]
invalid
Function at 0x5a028d
Capabilities:
Encode data using xor

Disassembly:
jbe 0x579bd1
mov dword [edi], eax
jmp 0x54c3c7
setae cl
jne 0x48b4d2
lea esp, [esp + 8]
jmp fcn.00503db7
neg ecx
xchg dword [esp + 0x20], ebp
mov esi, dword [esp + esi + 0x30f24e51]
and ecx, ecx
movzx ecx, cx
add ecx, dword [esp + 0x10]
call fcn.00658b72
mov dword [ebp], edx
mov ebx, dword [esp + 8]
jmp 0x5dffb6
mov dword [esp + ecx + 0x7d7455fa], ecx
add dword [esp + ecx + 0x7d7455f2], 0x1524830c
xor dword [esp + ecx + 0x7d7455f2], 0xeb005681
cmp dword [esp + ecx + 0x7d7455f2], 0xb1a27716
lea ebp, [ebp + 0x4d00f7ba]
jg 0x5328e4
mov si, word [ebp]
mov cl, byte [ebp + 2]
push 0xb53c1f12
add ebp, 2
shr si, cl
not word [esp + 2]
mov word [ebp], si
lea esp, [esp + 4]
jmp fcn.005e39c8
push esi
pushfd
mov esi, 0x2cb7970a
xor esi, 0x2b8a1214
mov eax, dword [esp + esi - 0x73d850e]
mov esi, 0xff9e5e13
push esi
and dword [esp], 0xcb9d0506
test dword [esp], esi
push ecx
push ebx
lea eax, [eax + 1]
push 0x7f2e50a6
jbe 0x599595
or word [esp], 0x323
mov ebx, esi
cmovbe ebx, dword [esp]
mov ecx, ebx
push ebp
mov dword [esp + 0x24], eax
not ecx
mov esi, dword [esp + 4]
mov ebx, ecx
shl dword [esp + ebx*2 - 0xc343c8], cl
add dword [esp + 0x1c], 0xfff1f403
movzx ebx, word [esp + ecx - 0x61a1dc]
sub byte [esp + ebx*2 - 0x3ffc], 0x99
and esi, esi
mov ebp, dword [esp + ecx*2 - 0xc343c8]
xor word [esp + ebx*2 - 0x3ffc], cx
add word [esp + 0x10], 0x4410
mov eax, dword [esp + ebx - 0x1fe4]
mov eax, dword [eax]
setne byte [esp + esi - 0x7f2e5397]
and ecx, dword [esp + 0x10]
call fcn.0069b2fb
lea esp, [esp + 0xc]
jmp fcn.005464d5

Function at 0x60e3a2
Capabilities:
Encode data using xor

Disassembly:
call fcn.005cf5b4
mov ecx, 0x8ab27b04
movzx ecx, byte [ebp]
add ebp, 1
push 0xf9104098
shr dword [esp], 0x11
xor cl, bl
ror dword [esp], 0xd5
rol cl, 1
sar dword [esp], 0x72
sbb cl, 0x9a
inc word [esp + 2]
not cl
sub cl, 0xba
neg cl
call fcn.0058dc53
mov edx, 0xc6208e36
jmp 0x4fcd93
mov edx, dword [esi]
mov ecx, 0xc4874d1f
jmp 0x590b76
jle 0x49757e
mov dword [ebp + 8], ebx
call fcn.004904c3
dec ebp
jno 0x60e3f2
cmp byte [esi], dh
int 0xf9
stosd dword es:[edi], eax
je 0x60e3da
in al, 0xb8
pop edi
jo 0x60e39d
dec ebp
mov edi, 0x958ee7b5
cmp dword [esp + eax*4 - 0x28f16308], esp
outsb dx, byte [esi]
mov byte [ebx], bh
mov ebp, 0xbeff8d6e
and eax, 0x6d8142c3
mov ah, 0xf4
mov byte [0x19806d2b], al
push esp
add dword [eax], 0x93cf1c57
sbb dword [ecx + eax*4], edx
push edi
sbb al, 0xcf
xchg ebx, eax
movsb byte es:[edi], byte [esi]
xor eax, 0xc2074c40
mov byte [0xa3f3e34a], al
fsubr qword [edx + 0x68]
jg 0x60e3d4
xor eax, 0x360ead16
mov ebx, 0xc969af11
adc byte [eax + 0x20078a7f], bh
jns 0x60e3d4
jg 0x60e38a
pop es
and byte [ecx - 0x30], bh
push esi
pop ebp
xchg edx, eax
adc dword [eax], ecx
and bl, byte [ebp - 0x32]
jne 0x60e3fe
invalid