joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e74a
Capabilities:
Encode data using xor

Disassembly:
cmp edx, esi
mov ecx, edx
jb 0x529990
pop esi
pop ebp
ret 8
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
lea esi, [edx + ecx]
and ecx, 0xfffffffc
xor eax, eax
add ecx, edx
cmp edx, ecx
jae 0x49e69b
xor eax, dword [edx]
add edx, 4
rol eax, 3
jmp 0x49e760
movzx edx, byte [ecx]
xor eax, edx
inc ecx
rol eax, 3
cmp ecx, esi
jb 0x529990
jmp 0x49e6a5

Function at 0x49f0fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x10
push 0x415570
call fcn.0040bea3
mov byte [ebp - 0x19], 0
mov esi, dword [ebp + 8]
mov byte [esi], 6
mov byte [esi + 2], 0x70
lea eax, [esi + 8]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [esi + 0x10]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [esi + 0x78]
push 4
pop ecx
mov dword [eax], esi
add eax, 0x18
dec ecx
jne 0x49f12b
mov edi, dword [ebp + 0x24]
mov al, byte [edi + 0x64]
mov byte [esi + 0x167], al
mov byte [esi + 0x141], 1
mov byte [esi + 0x12a], 1
mov dword [esi + 0xe0], 0x48b520
lea eax, [esi + 0x34]
mov dword [esi + 0x138], eax
lea ecx, [esi + 0x14c]
mov dword [esi + 0x13c], ecx
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [esi + 0x3c]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [esi + 0x44], edi
mov byte [esi + 0x166], 1
xor ebx, ebx
push ebx
push ebx
push 0x4230e1
push 0x4322cd
push 0x4230d9
push ebx
push esi
lea eax, [esi + 0x16c]
push eax
call fcn.0040ec99
push 2
push ebx
lea eax, [esi + 0x19c]
push eax
call fcn.004118f1
lea ebx, [esi + 0xf0]
push ebx
call fcn.004154fb
lea eax, [esi + 0xb8]
mov dword [eax + 0xc], ebx
mov word [eax + 0x14], 0x102
mov word [eax + 0x16], 1
add ebx, 8
mov dword [eax], ebx
mov dword [eax + 4], ebx
lea eax, [esi + 0xe8]
push eax
call fcn.0040b417
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x20], eax
mov al, byte [edi + 0x66]
mov edi, dword [edi + 0x5c]
and edi, dword [0x484a50]
movzx ecx, al
mov eax, dword [ecx*4 + 0x48b3c0]
mov eax, dword [eax + 0x4d0]
not eax
and eax, edi
jne 0x501dfa
push edi
push ecx
call fcn.004157e8
mov bl, al
mov byte [esi + 0xdf], 0
mov eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, edi
jne 0x49f240
push edi
push edi
call fcn.004155b9
cmp eax, edi
je 0x52216a
mov byte [ebp - 0x19], 1
mov dword [esi + 0x18], eax
mov dword [esi + 0x168], eax
add eax, 0xffffd000
mov dword [esi + 0x1c], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call fcn.00415639
or dword [ebp - 4], 0xffffffff
mov byte [esi + 0x2d], 0
mov byte [esi + 0x1ba], bl
xor eax, eax
call fcn.0040bede
ret 0x20
mov edi, eax
jmp 0x49f214
mov eax, 0xc000009a
jmp 0x49f276
Function at 0x4b4fa3
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x6274624f
push 0x44
push 1
call fcn.0047a005
mov esi, eax
test esi, esi
je 0x4b5054
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4b4fd9
push 0x44
push ebx
call fcn.0041f327
test eax, eax
jl 0x53a64e
push edi
push 0x11
pop ecx
push 0x1000
xor eax, eax
mov edi, esi
push ebx
rep stosd dword es:[edi], eax
call fcn.004b742d
test eax, eax
je 0x53a65d
push 4
pop edx
lea ecx, [eax + 4]
mov dword [esi], eax
mov edi, edx
mov ebx, ecx
mov dword [ebx], edi
add edi, edx
add ebx, 8
cmp edi, 0x804
jb 0x4b5002
mov dword [ecx], 0xfffffffe
xor ecx, ecx
mov dword [eax + 0xffc], ecx
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edx
mov dword [esi + 0x38], 0x800
mov dword [esi + 4], eax
mov eax, dword fs:[0x124]
mov eax, dword [eax + 0x44]
mov eax, dword [eax + 0x84]
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x40], ecx
lea edi, [esi + 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi + 0x24], ecx
mov eax, esi
pop edi
pop ebx
pop esi
pop ebp
ret 4
push 0
push esi
call fcn.0047a1e6
xor eax, eax
jmp 0x4b5053
push eax
push esi
call fcn.0047a1e6
test ebx, ebx
je 0x53a670
push 0x44
push ebx
call fcn.0041f0b9
xor eax, eax
jmp 0x4b5052

Function at 0x4b7144
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0040306b
lea eax, [ebp - 0x10]
xor ebx, ebx
push edi
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x16], 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call fcn.00411430
mov dword [ebp + 8], eax
movsx eax, byte [eax + 0x30]
push ebx
push eax
call fcn.00413fbd
mov esi, eax
cmp esi, ebx
je 0x519e70
mov dword [esi + 0x64], edi
mov eax, dword fs:[0x124]
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x50], eax
lea eax, [ebp - 0x18]
mov dword [esi + 0x2c], eax
lea eax, [ebp - 8]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 8], 0x1004
sub eax, 0x24
mov byte [esi + 0x20], bl
mov dword [esi + 0x30], ebx
mov byte [eax], 5
mov dword [eax + 0x18], edi
or dword [esi + 8], 0x10
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
mov cl, 1
call dword [fcn.0040102c]
mov edx, dword [esi + 0x50]
add edx, 0x210
lea edi, [esi + 0x10]
mov cl, al
mov eax, dword [edx]
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [eax + 4], edi
mov dword [edx], edi
call dword [fcn.00401030]
mov ecx, dword [ebp + 8]
mov edx, esi
call fcn.0040a3b9
cmp eax, 0x103
je 0x519e81
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
pop edi
pop esi
pop ebx
leave
ret 0x14
mov ecx, edi
call fcn.0040a930
mov eax, 0xc000009a
jmp 0x4b7219
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call fcn.00405400
mov eax, dword [ebp - 8]
jmp 0x4b7211
Function at 0x4c44fa
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
xor ecx, ecx
mov edx, dword [ebp + 8]
xor eax, dword [edx + ecx*4]
inc ecx
cmp ecx, 0x7f
jb 0x4c4503
cmp eax, 0xffffffff
je 0x543f90
test eax, eax
je 0x543f98
pop ebp
ret 4
push 0xfffffffffffffffe
pop eax
jmp 0x4c4518
inc eax
jmp 0x4c4520

Function at 0x4cfa47
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
test byte [0x490948], 1
jne 0x4cfab2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
push ebx
push esi
push edi
push eax
mov dword [ebp + 8], eax
call fcn.00423366
mov ebx, eax
movzx eax, word [ebx + 0x14]
movzx ecx, word [ebx + 6]
lea edi, [eax + ebx + 0x18]
xor eax, eax
xor esi, esi
test ecx, ecx
jbe 0x4cfaaf
mov dword [ebp - 4], ecx
mov ecx, dword [edi]
cmp ecx, 0x45474150
je 0x4d4b38
cmp ecx, 0x6164652e
je 0x4d4b38
test eax, eax
jne 0x4cfab6
add edi, 0x28
dec dword [ebp - 4]
jne 0x4cfa81
test eax, eax
jne 0x52502a
pop edi
pop esi
pop ebx
leave
ret 4
push 0
push esi
push eax
call fcn.0042f7b1
xor eax, eax
jmp 0x4cfa9f
test eax, eax
jne 0x4d4b56
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp + 8]
lea eax, [eax + ecx + 0xfff]
shr eax, 0xa
and eax, 0x3ffffc
sub eax, 0x40000000
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 8]
cmp ecx, edx
jb 0x525023
mov edx, dword [ebx + 0x38]
add edx, dword [edi + 0xc]
add edx, ecx
mov ecx, dword [ebp + 8]
lea esi, [edx + ecx - 0x1001]
shr esi, 0xa
and esi, 0x3ffffc
sub esi, 0x40000000
jmp 0x4cfa9f
mov ecx, edx
jmp 0x4d4b64
push 0
push esi
push eax
call fcn.0042f7b1
jmp 0x4cfaaf

Function at 0x4d0714
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x18]
mov eax, dword [eax + 0x20]
mov ecx, edi
shr ecx, 0xa
shr eax, 0xc
and ecx, 0x3ffffc
push edi
lea esi, [ecx + eax*4 - 0x40000000]
call fcn.00423366
movzx ecx, word [eax + 6]
movzx edx, word [eax + 0x14]
add edx, eax
lea ebx, [ecx + ecx*4]
lea edx, [edx + ebx*8 + 0x18]
xor eax, eax
xor ebx, ebx
test ecx, ecx
jbe 0x4d07bc
sub edx, 0x28
test byte [edx + 0x27], 2
je 0x4d0769
inc ebx
cmp ebx, ecx
mov eax, edx
jb 0x4d0759
test eax, eax
je 0x4d07bc
mov eax, dword [eax + 0xc]
lea eax, [edi + eax + 0xfff]
shr eax, 0xa
push 0
and eax, 0x3ffffc
sub eax, 0x40000000
push 0
push dword [0x40f970]
sub esi, eax
sar esi, 2
push esi
push eax
call fcn.00419c11
mov esi, eax
push 0x12
push esi
call fcn.0042eec8
mov eax, esi
neg eax
mov ecx, eax
mov edx, 0x4909c8
lock xadd dword [edx], ecx
mov ecx, 0x48c540
lock xadd dword [ecx], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4f5b8b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0040306b
lea eax, [ebp - 0x10]
xor ebx, ebx
push edi
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x16], 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call fcn.00411430
mov dword [ebp + 8], eax
movsx eax, byte [eax + 0x30]
push ebx
push eax
call fcn.00413fbd
mov esi, eax
cmp esi, ebx
je 0x544fe9
mov dword [esi + 0x64], edi
mov eax, dword fs:[0x124]
mov cl, byte [ebp + 0xc]
mov dword [esi + 0x50], eax
lea eax, [ebp - 0x18]
mov dword [esi + 0x2c], eax
lea eax, [ebp - 8]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x60]
sub eax, 0x24
mov byte [esi + 0x20], bl
mov dword [esi + 8], 4
mov dword [esi + 0x30], ebx
mov dword [eax + 0x18], edi
mov byte [eax], 0x1b
mov byte [eax + 1], 0x16
xor edi, edi
mov dword [esi + 0x18], 0xc00000bb
mov dword [esi + 0xc], ebx
inc edi
push esi
mov byte [eax + 4], cl
mov dword [eax + 8], edi
call fcn.00427b68
push edi
call fcn.004d8b3e
mov ecx, dword [ebp + 8]
mov edx, esi
call fcn.0040a3b9
mov esi, eax
cmp esi, 0x103
jne 0x4f5c4e
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call fcn.00405400
mov esi, dword [ebp - 8]
push edi
call fcn.004d8b01
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
mov byte [0x24240b09], al
int1
xchg ebp, eax
insd dword es:[edi], dx
scasd eax, dword es:[edi]
or dword [edx], ecx
xor edi, dword [ecx - 0x3c]
invalid

Function at 0x502547
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
not eax
jbe 0x502577
mov edx, dword [ebp + 0xc]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x502580]
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x502558
not eax
pop ebp
ret 0xc
Function at 0x504308
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword fs:[0x124]
mov eax, dword [eax + 0x44]
cmp dword [eax + 0x158], 0
jne 0x50431d
xor eax, eax
ret
push ebp
mov ebp, esp
sub esp, 0x38
pushal
lea esi, [0x714]
push esi
call fcn.0056d3bf
test eax, 8
je 0x504364
mov ebx, 0x10
cmp word [ebp + 8], 0xc
je 0x50434f
mov ebx, 7
cmp word [ebp + 8], 0xd
jne 0x504364
test eax, 0x4000
je 0x5044cf
jmp 0x5044ed
test eax, 0x10
je 0x5043ad
mov ebx, 5
cmp word [ebp + 8], 1
jne 0x50438c
test eax, 0x4000
je 0x504489
jmp 0x5044ed
mov ebx, 6
cmp word [ebp + 8], 3
jne 0x5043ad
test eax, 0x4000
je 0x5044ae
jmp 0x5044ed
mov esi, dword [ebp]
cmp word [esi + 0x6c], 0x1b
je 0x504478
cmp word [ebp + 8], 0xb
jne 0x5043c9
inc dword ss:[0x5c41a8]
mov dword [ebp - 0x24], esi
mov eax, dword [esi + 0x78]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0x2c], eax
lea esi, [ebp - 0x38]
call fcn.0050485a
test al, 0xff
je 0x504484
mov eax, dword [esi]
call fcn.005048de
test al, 0xff
je 0x504484
mov ecx, dword [ebp + 8]
call fcn.00504a90
test al, 0xff
je 0x504484
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x74], eax
xor bl, bl
test dword [esi + 0x70], 0x20000
jne 0x504427
mov bl, 7
mov eax, dword [ebp - 0x38]
or al, bl
mov dword [esi + 0x78], eax
mov eax, dword [ebp - 0x30]
push dword [esi + 0x70]
mov dword [esi + 0x70], eax
xor eax, dword [esp]
test eax, 0x20000
pop eax
je 0x504449
push esi
call fcn.00405db7
mov eax, dword [ebp - 0x2c]
or al, bl
cmp eax, 8
jae 0x504461
test dword [esi + 0x70], 0x20000
jne 0x504461
mov eax, 0x1b
mov dword [esi + 0x6c], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x68], eax
cmp word [ebp + 8], 1
jne 0x504478
and dword [esi + 0x70], 0xfffffeff
popal
mov eax, 1
mov esp, ebp
pop ebp
ret 4
popal
xor eax, eax
jmp 0x50447e
mov eax, dword [ebp]
and dword [eax + 0x70], 0xfffffeff
mov eax, dword [ebp + 0x68]
push 0
push 0
push 0
push 0
push eax
push 0x80000004
push dword [ebp]
call fcn.005046c4
jmp 0x504478
mov eax, 0
mov ebx, dword [ebp]
mov ebx, dword [ebx + 0x68]
dec ebx
push edx
push ecx
push eax
push 3
push ebx
push 0x80000003
push dword [ebp]
call fcn.005046c4
jmp 0x504478
mov eax, dword [ebp]
mov eax, dword [eax + 0x68]
push 0
push 0xffffffffffffffff
push 0
push 2
push eax
push 0xc0000005
push dword [ebp]
call fcn.005046c4
jmp 0x504478
mov eax, dword [ebp]
cmp ebx, 5
jne 0x5044fc
and dword [eax + 0x70], 0xfffffeff
mov eax, dword [eax + 0x68]
push 0
push 0
push ebx
push 1
push eax
push 0x40000005
push dword [ebp]
call fcn.005046c4
jmp 0x504478
Function at 0x54f018
Capabilities:
Encode data using xor

Disassembly:
or edi, edi
or dword [ebx], ecx
add dword [edx], ebx
inc edi
mov dword [0xb090478], eax
inc ecx
push esp
push 0xffffffffffffffc7
and dword [esi], esi
or dword [ebx], ecx
pop ebp
fimul word [esi + ebp*8]
xor dword [ebx + 9], esp
or edx, edi
sti
pop edx
stc
jns 0x54f02c
or dword [ebx], ecx
enter 0x5618, 0x4f
xchg edi, eax
lodsd eax, dword [esi]
or dword [ebx], ecx
sub ebp, dword [ebp - 0x51b5c819]
or dword [ebx], ecx
sub esi, dword [ecx]
xchg esi, eax
jae 0x54f02a
les ecx, [ecx]
or edx, dword [eax + ebp*8]
pushfd
xor dword [esi - 0x5af4f6f9], 0xfe29d18f
xchg dword [ecx], ecx
or ebp, dword [edi + 0x4b50b7f2]
ljmp 0x2e79

Function at 0x54f1af
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0xb094a4a]
push ebx
and al, 0x73
inc esi
pop ds
jl 0x54f1c4
or eax, ecx
add dword [ebp + ebp*4 + 0xb09f6af], edx
mov esi, 0x686fc5ca
cld
or dword [edx], ecx
adc ebx, esp
push edx
lcall 0xa9b9, 0xb0981bb
xor eax, dword [edx - 0x5c]
fmul qword [ecx]
or edi, dword [esi + 0x54]
xor al, al
fldenv [ebp - 0xd1ff4f7]
lcall 0xd0b, 0x9bac55f
cmp dh, byte [edx]
cvtps2pd xmm3, xmm0
or dword [ebx], ecx
dec edx
push ebx
cmp al, 0xf0
les edx, [ecx + ecx + 8]
shr dword [edi], 0x4d
inc byte [0x3e0b0979]
add eax, 0x3e0b0979
js 0x54f1ca
cmp byte [eax], bh
fmul qword [ecx]
or esp, dword [ecx]
push ebx
jae 0x54f200
test byte [ecx], 0xb
xor dword [ebp - 0x35], esi
push es
imul eax, dword [esi + 9], 0x26f990b
xor cl, byte [ebp + 0x4b]
or dword [ebx], ecx
xor esi, 0x9ee9f84
or esp, dword [eax]
sar eax, 1
or ah, ah
hlt

Function at 0x554f57
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xcf
mov cl, byte [ecx]
or edx, dword [edi + 0x6d]
imul edx, edx, 0xffffff86
cmpsd dword [esi], dword es:[edi]
or dword [ebx], ecx
sub dl, byte [edx + esi*4 + 0x900e551]
or ebx, dword [esi + 0xd]
aad 0x79
push ds
and cl, byte [ecx]
or ecx, dword [ebx + 0x70bac266]
push edi
or dword [ebx], ecx
cmp dword [ebx], edx
dec esi
add ebp, ecx
xor al, 9
or esi, dword [ebp + 0x16]
jl 0x554f59
cwde
adc eax, 0xf78b0a09
cwde
in al, dx
arpl word [ecx + ecx], sp
or byte [edx + 0x53], dh
mov ah, 0xee
aad 0x31
or dword [ebx], ecx
and ah, byte [ecx]
jno 0x554fa4
pop esi
jb 0x554fac
or ecx, dword [eax - 0x69b2d122]
mov dh, bl
dec ebp
xchg esi, eax
mov dh, 9
or byte [esi - 0x11], dl
push esi
out dx, eax
Function at 0x55670c
Capabilities:
Encode data using xor

Disassembly:
or dword [ebx], ecx
cld
inc edx
fsub dword [0xb09b8dd]
outsb dx, byte [esi]
sub dl, byte es:[ebp + 0xa09153e]
jb 0x556706
in al, dx
or eax, dword [esi + 9]
or ebp, esp
or dword [ebx], ecx
in al, dx
dec ebx
stosb byte es:[edi], al
jns 0x5566aa
stosb byte es:[edi], al
or dword [ebx], ecx
std
mov ebx, 0x49769bc6
or dword [ebx], ecx
pop ebx
invalid
scasd eax, dword es:[edi]
cmp dword [edx + 0x6a0a09a8], ebp
push 0xffffffffffffff8d
mov ebp, 0x9d03113
push 0xffffffffffffff8d
mov ebp, 0x9d03113
or esp, dword [ecx + 0x5488b967]
or eax, 0xd9000b09
cmp al, 8
mov ecx, 0x90d5488
or eax, dword [eax]
fnstcw word [eax + ecx]
xor dh, byte [edx + 9]
or esi, ebx
stosb byte es:[edi], al
push ebp
mov eax, 0xb09cd73
jne 0x556716
jno 0x55673e
test dh, dh
or dword [ebx], ecx
popfd
xor al, 0xc2
je 0x5566c2
pushfd
or dword [edx], ecx
leave
aaa
sub dword [ebx - 0x43], esp
int1
or dword [ebx], ecx
mov al, byte [0x376d4531]
dec esi
or dword [ebx], ecx
in eax, dx
shr cl, 1
cmp al, 0xa7
outsb dx, byte [esi]
or dword [edx], ecx
inc esi
pushfd
xor edi, ebp
sbb cl, byte [edx + 0x13610b09]
add al, 0x21
cmp dword [ecx + ecx], 0xb
pop esi
cmp al, 0x21
iretd
Function at 0x56fb14
Capabilities:
Encode data using xor

Disassembly:
popfd
iretd
daa
or dword [edx], ecx
lahf
xor al, 0xe
jle 0x56fae7
inc eax
or dword [eax], ecx
or byte [eax], dh
mov bh, 0x78
mov dword [edi - 0x2982f4f7], eax
pop ebp
iretd
or bh, byte [ebp - 0x35]
jge 0x56fae1
mov dl, 0x6c
cmp eax, esi
or dword [ebx], ecx
adc dword [esi - 0x442c3651], esi
or dword [ebx], ecx
jo 0x56faa6
cmp byte [esi + edx*4 + 0x1e0b09fc], dl
or al, 0xdf
add byte [eax + 0x120b096d], 0x3e
pushfd
xchg edx, eax
jo 0x56fb44
or eax, dword [edx - 0x5f]
int1
inc esp
cmp bl, byte [ecx + ecx - 0x24754ffc]
jnp 0x56fb13
mov al, 0x8a
fstp xword [ebx - 0x36]
mov al, byte [0x62dd0b09]
mov dword [ebp + edi*2 - 0x3f4f64f], ebp
cld
inc edi
jle 0x56fb78
or dword [ebx], ecx
pop ebp
push 0xffffffffffffffe8
shl byte [eax + ecx*2 - 0x659ef4f7], cl
cdq
dec ebp
and dword [ecx + 9], ecx
or esp, edi
xor byte [0x9248465], al
or esi, dword [eax + 1]
pop es
sub dword [esi + 0x32], edi
jle 0x56fbac
or dword [ebx], ecx
sub al, 0x47
aaa
out 0xbc, al
mov ch, 9
or esp, edx
std
cli
jne 0x56fb5a
pop esi
or dword [edx], ecx
xor al, byte [edi]
invalid
sub dword [eax + 0x6d], 0xffffffae
adc dword [ebx + 0x2f490b09], esi
xchg edx, eax
inc dh
dec eax
or dword [ebx], ecx
popfd
mov edx, 0x9eb7cb2
or dh, byte [eax]
mov al, byte [0x64e04a63]
or dword [ebx], ecx
into
das
add byte [edi + 0xa09ac4e], al
mov bh, byte [ebx - 0x7483db9b]
or dword [ebx], ecx
mov dword [0x39ee4f51], eax
stosb byte es:[edi], al
or dword [ebx], ecx
sbb esp, ecx
sal edx, 0xf4
insd dword es:[edi], dx
or dword [ebx], ecx
mov eax, dword [0x35b88d6]
mov ah, 9
or al, byte [edx - 0x26]
ficomp dword [esi + 0x4e]
add esi, dword [ecx + ecx - 0x2525bdf6]
pop esi
dec esi
inc ebp
or dword [ebx], ecx
mov esi, ecx
loop 0x56fbf0
mov ecx, dword [edx + 9]
or bh, byte [ebp - 0x1038b3e8]
lcall 0xbaf, 0xda7e0809
int 0xc8
or dword [ebx], ecx
add ecx, edx
mov dh, 0x8c
or eax, dword [esi]
or dword [ebx], ecx
jne 0x56fc89
mov bh, 9
imul ecx, dword [edx + 9], 0xb
xor byte [edi + 0xe], cl
pop esi
mov ah, 0xc8
or dword [edx], ecx
sub eax, 0xb4515416
enter 0xa09, 0x74
out 0x29, eax
test dword [eax + ecx*8 + 0x4e350a09], esi
imul esp, dword [ecx + 0xa09c8b4], 0x2b
invalid
add eax, 0x63ed0b09
clc
and ah, byte [eax]
mov esp, 0x7b360b09
salc
cmpsb byte [esi], byte es:[edi]
fisubr dword [ebx]
or dword [ebx], ecx
cmc
mov eax, dword [0xa18c8f8]
or dword [edx], ecx
invalid
Function at 0x576bcf
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x576bd8
ja 0x576bdc
or ch, byte [edi - 0x53]
xor eax, 0x99b44c5
or ebx, dword [ecx + 4]
enter 0x3566, 0xfffffffffffffff5
or dword [ebx], ecx
jnp 0x576c62
inc esp
wait
or dword [ebx], ecx
pop ecx
add al, 0xc8
xor ax, 0x9f5
or edi, dword [ebx + 0x7c]
out 0x6b, al
or al, 0x23
or dword [ebx], ecx
inc edx
or al, 0xf4
pop ebp
xchg dword [ecx + ecx + 0xb], edx
movsd dword es:[edi], dword [esi]
sub ch, byte [edx - 9]
in eax, 0x1c
or dword [ebx], ecx
test al, 0x16
jge 0x576c40
lodsd eax, dword [esi]
inc ecx
or dword [edx], ecx
add dword [ebx], ebx
pushfd
test al, 0x2d
scasb al, byte es:[edi]
or dword [ebx], ecx
sub dword [esi], esi
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
add dl, bl
or dword [ebx], ecx
aas
push ecx
mov al, byte [0x93fd885]
or eax, dword [edi + esi*2]
fistp word [ecx]
mov cl, bh
or dword [ebx], ecx
test byte [ebp - 0x39], al
wait
fst qword [0x823c0b09]
out dx, eax
xchg ebx, eax
push esi
les ecx, [ecx]
or ecx, dword [esi - 0x56fb195c]
lodsd eax, dword [esi]
or dword [ebx], ecx
outsd dx, dword [esi]
lds esi, [ecx]
mov eax, 0xb092213
adc esp, dword [edx]
or dword [ebx], ecx
in eax, dx
add dword [eax - 0x23], esi
inc ebx
das
fld qword [ebx + 0x2f]
or dword [ebx], ecx
fidivr dword [ecx - 0xc]
dec edx
dec ebp
dec ebp
or dword [edx], ecx
movsd dword es:[edi], dword [esi]
add al, 0x3d
lcall 0xc33c, 0xa090505
mov fs, esi
push 0x110b0924
xor al, byte [edx + esi*8 + 0x40926c1]
xchg ecx, eax
or dword [ebx], ecx
adc dword [edx], esi
test dl, dh
shl dword [esi], 9
add al, 0x91
sti
cli
test ecx, eax
or dword es:[eax], ecx
jecxz 0x576c47
push 0x97061e2
or eax, dword [esi - 0x7582f901]
push edx
or dword [ebx], ecx
out 0xc7, al
sbb al, 0xdc
into
pop ebp
or dword [ebx], ecx
aas
pop ecx
xor dword [ebx + 0x69], ebx
sbb cl, byte [ecx]
or ecx, dword [ecx + 0x11]
inc ebp
xchg edx, eax
xchg byte [edi], bh
or dword [ebx], ecx
pop ebp
out dx, al
fnstcw word [ecx]
jbe 0x576d01
or dword [edx], ecx
ffreep st(1)
pop ebp
xchg esi, eax
jbe 0x576d09
or dword [ebx], ecx
mov word [ebp - 0x9ad8035], ds
or dword [ebx], ecx
popal
or eax, dword [esi]
pop ecx
dec edi
dec ebp
or dword [ebx], ecx
ror ebx, 1
mov edx, 0x97f2f86
or ah, bh
cmp byte [edx], 0xe
adc eax, 0xaa0b09d5
mov edi, ss
int 0x3d
push eax
or dword [ebx], ecx
mov eax, dword [0xd18bee86]
insb byte es:[edi], dx
or dword [ebx], ecx
mov dword [ecx + 0x21], 0x92c72ac
or bh, byte [edi + 0x4a]
cwde
adc al, 0x72
sub al, 9
or ecx, dword [edx - 0x14]
lea edx, [edi]
bts dword [ecx], ecx
or ebx, edx
mov dh, 0x57
dec ebp
cmp dword [ebx - 0x898f5f7], 0xf69ce1e4
or dword [ebx], ecx
test byte [ecx], 0xb
iretd
ror dword [ecx], 0xa
push eax
inc esp
invalid
Function at 0x5ae1e8
Capabilities:
Encode data using xor

Disassembly:
xlatb
fimul word [ecx]
or eax, dword [ebx + edi + 0x229ab54d]
or dword [edx], ecx
out 0xa4, eax
and cl, byte [ecx]
or ah, bh
movsb byte es:[edi], byte [esi]
xchg byte [edi], al
pop ecx
dec byte [ecx]
or ah, byte [esi]
xor eax, 0x7ea88c71
or dword [ebx], ecx
cmp ch, byte [eax - 0x502a4b28]
or dword [ebx], ecx
mov eax, 0x83b06430
mov ebp, 0x19d60a09
sub ch, 0x6c
xor byte [ecx], cl
or edx, dword [ebx - 0x426aa37f]
dec edx
or dword [ebx], ecx
inc ecx
or cl, byte [esi]
jae 0x5ae1f1
in al, dx
or dword [ebx], ecx
pop ds
inc esi
lea esi, [edx - 0x6f]
invalid

Function at 0x5d94bd
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
or byte [eax - 0x7eb6b145], al
xor dword [edx + 0x15d48010], edi
push 0x1368a380
sub al, 0x28
invalid

Function at 0x5ebabf
Capabilities:
Encode data using xor

Disassembly:
add dl, 0x37
sbb byte [eax - 0x7fec47a8], al
test dword [edi + ecx], ebx
add byte [edx - 0x3d], 0x18
sbb byte [eax + 0x55], 0x12
cmp al, 0xc9
add al, 0x80
dec esp
mov esp, 0xade480e6
sub eax, dword [eax - 0x7ffa1649]
salc
and byte [edi], ah
add dword [eax + 0xc800d4a], 0xb180029a
scasd eax, dword es:[edi]
add eax, 0x2f86d180
adc byte [eax + eax*8], 0
xor dword [edx - 0x55], 0x373800a
or al, byte [eax - 0x7fff1165]
inc ebp
inc edi
jo 0x807231ab
sbb dword [eax + 0x48cd8003], edi
sub al, byte [eax - 0x7fec5e58]
invalid