Function at 0x48ae9e
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0xd5
cli
ljmp 0xa4bd
or al, byte [ecx]
inc ebx
mov ebp, 0xc2c743a1
or ebp, ebp
inc edx
push 0x6635aad
add byte [ecx], dl
xchg dword [ecx + 0x2baf23cd], esi
call 0x43039268
xor edx, eax
inc edi
loop 0x48af24
pop ebx
les edi, [0x5d717672]
xchg ebp, eax
outsb dx, byte [esi]
rcr dword [ecx + 0xa2d1fb5], 0xa
ja 0x48ae52
bound eax, qword [ebx]
and dword [ebp + 0x62], ebp
scasd eax, dword es:[edi]
add ebx, esp
mov byte [edi - 0x4d7ec48f], 0x8e
hlt
aas
and eax, 0x8082a991
mov byte [0x95813daa], al
jb 0x48af9b
xchg ebp, eax
outsb dx, byte [esi]
cmp eax, 0x3969068c
jns 0x48af58
jb 0x48afa0
push 0x6f
and byte [0x19830770], bh
salc
jb 0x48af77
mov byte [0x20f26670], al
invalid
cmpsd dword [esi], dword es:[edi]
sub al, 0xd4
sbb eax, 0x51c2be25
clc
xor eax, 0x13129821
inc ebx
mov cl, byte [ecx]
invalid
mov esi, 0x35f851c2
and dword [eax - 0x75bcecee], ebx
adc eax, dword [ebx - 0x76]
or dword [edi + 0x6c36e2b1], ecx
insb byte es:[edi], dx
push ecx
jmp 0x48af97
push edi
xchg ebx, eax
mov al, 0x69
jbe 0x48af52
xchg esp, eax
add ah, byte [eax + ebx*8 - 0x23]
fcomi st(0)
mov bl, 0x84
inc edx
xor eax, 0x79f1b842
fiadd dword [ecx + 0x170fe2e7]
loop 0x48af87
int1
in eax, 0xe2
mov edx, 0xcc49f1a3
lodsd eax, dword [esi]
frstor dword [0xf6d847e2]
loop 0x48af60
ret 0xf1a3
int1
dec ecx
int3
and eax, 0xf6d847e2
jg 0x48afc7
add dh, byte [edx - 0x13168e8f]
cmc
rcr byte [edi + 0x77], 0x52
cdq
sbb al, 0x9a
pop ebx
xor byte [edx + 0x7c98fc65], 0x33
scasd eax, dword es:[edi]
mov al, byte [0x3e449234]
in eax, 0x2d
salc
xor dl, ah
pop esp
aam 0x5c
and al, 0xd2
xchg ecx, eax
adc al, 0xdd
invalid

Function at 0x4999a5
Capabilities:
Encode data using xor

Disassembly:
pushal
loopne 0x4999d8
or eax, dword [edi + edi]
inc esi
arpl word [edx + edi], bp
adc eax, 0xaa879d3f
insb byte es:[edi], dx
invalid
sub dword [0x883b27b6], esi
or dword [ebx - 4], ebx
in al, dx
out dx, eax
test dword [ebx - 0x29], esp
dec ecx
cmpsd dword [esi], dword es:[edi]
add dword [edx + 0x72bd554], eax
pop ebp
mov esi, dword [edx]
xor eax, ebx
cmp bh, bh
dec ebp
invalid

Function at 0x49df20
Capabilities:
Encode data using xor

Disassembly:
pop esp
xchg ebx, eax
aas
jo 0x49dfa2
iretd
and byte [edx], al
fsubp st(3)
invalid
mov eax, 0x48e4af7d
sbb eax, 0x3d6d443
popal
jp 0x49df4e
test esp, ecx
cmpsd dword [esi], dword es:[edi]
add ebx, dword [ecx - 0x71]
mov byte [0x4323dceb], al
invalid

Function at 0x4b7a03
Capabilities:
Check for vm using instruction vpcext

Disassembly:
movsd dword es:[edi], dword [esi]
sbb dword [esi + 0x4e], esi
mov word [ebx + 0x3d], es
pop edx
stosb byte es:[edi], al
sub al, 0xdc
pop es
inc ecx
pop es
push cs
fistp dword [edi - 0x23]
ljmp 0x38ea
ja 0x4b7989
lea eax, [0x1763cee8]
push eax
pop edi
push edi
or byte [edi - 0xc], dl
and esp, edi
jno 0x4b7a8d
jne 0x4b7a81
ror dl, 1
imul ecx, dword [edi], 0x43
inc ebp
int3
or eax, 0x32aaafc4
xor dword [edi - 0x6d5fa299], edx
lcall 0xd6f7, 0x3e326eea
pop edi
in eax, 0x29
jb 0x4b7abe
ljmp 0x5fd6:0xf73e326e
xchg dword [edi + 0x7c47b6cb], eax
push cs
push ds
std
invalid
movsb byte es:[edi], byte [esi]
test byte [esi], ah
wait
fisub word [ecx + ebx*8]
in al, 0x77
invalid