joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014149
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x10029b0d
call fcn.100151ea
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, edi
mov dword [ebp - 0x30], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10014168
sub eax, ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.1000282f
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], esi
jbe 0x1001426d
jmp 0x10014199
mov edi, dword [ebp + 0xc]
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x1002f278]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x100141ad
cmp al, 0xff
je 0x10014199
cmp al, 0xff
je 0x1001426d
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x1002f278]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x100141cd
cmp cl, 0xff
je 0x100141b5
cmp cl, 0xff
je 0x1001426d
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.1000ce9b
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1001426d
movsx eax, al
mov al, byte [eax + 0x1002f278]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x1001420d
cmp al, 0xff
je 0x100141ed
cmp al, 0xff
je 0x1001426d
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.1000ce9b
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1001426d
movsx eax, al
mov cl, byte [eax + 0x1002f278]
cmp esi, dword [ebp - 0x30]
jae 0x1001424b
cmp cl, 0xff
je 0x1001422d
cmp cl, 0xff
je 0x1001426d
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
lea edi, [ebp - 0x2c]
call fcn.1000ce9b
cmp esi, dword [ebp - 0x30]
jb 0x10014196
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.1000207c
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.1000247b
mov eax, dword [ebp - 0x38]
call fcn.1001526d
ret

Function at 0x10014392
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10035060]
jne 0x1001439c
repz ret
jmp fcn.1001528b
Function at 0x1001bc89
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10015cf2
and dword [ebp - 4], 0
cmp dword [0x10037db4], 0
mov ebx, eax
jne 0x1001bd3a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001bdeb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001bdeb
push eax
call fcn.10015c80
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10037db4], eax
call esi
push eax
call fcn.10015c80
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10037db8], eax
call esi
push eax
call fcn.10015c80
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10037dbc], eax
call esi
push eax
call fcn.10015c80
pop ecx
mov dword [0x10037dc4], eax
test eax, eax
je 0x1001bd3a
push 0x1002cb5c
push edi
call esi
push eax
call fcn.10015c80
pop ecx
mov dword [0x10037dc0], eax
mov eax, dword [0x10037dc0]
cmp eax, ebx
je 0x1001bd92
cmp dword [0x10037dc4], ebx
je 0x1001bd92
push eax
call fcn.10015cfb
push dword [0x10037dc4]
mov esi, eax
call fcn.10015cfb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001bd92
test edi, edi
je 0x1001bd92
call esi
test eax, eax
je 0x1001bd89
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001bd89
test byte [ebp - 0xc], 1
jne 0x1001bd92
or dword [ebp + 0x10], 0x200000
jmp 0x1001bdcb
mov eax, dword [0x10037db8]
cmp eax, ebx
je 0x1001bdcb
push eax
call fcn.10015cfb
pop ecx
test eax, eax
je 0x1001bdcb
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001bdcb
mov eax, dword [0x10037dbc]
cmp eax, ebx
je 0x1001bdcb
push eax
call fcn.10015cfb
pop ecx
test eax, eax
je 0x1001bdcb
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10037db4]
call fcn.10015cfb
pop ecx
test eax, eax
je 0x1001bdeb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001bded
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x15006
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
mov esi, edx
mov dword [ebp - 0x134], eax
xor eax, eax
push 0x18
pop ebx
mov word [ebp - 0x138], ax
lea eax, [ebp - 0x138]
push eax
push 0xa
push ecx
mov word [ebp - 0x136], bx
call dword [sym.imp.ntoskrnl.exe_RtlIntegerToUnicodeString]
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x124]
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x16c]
push 0x153a4
push eax
mov dword [ebp - 0x130], 0x1000000
call edi
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
js 0x151d7
lea eax, [ebp - 0x130]
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], eax
xor ecx, ecx
lea eax, [ebp - 0x164]
mov dword [ebp - 0x160], ecx
push eax
push 0x20019
lea eax, [ebp - 0x128]
mov dword [ebp - 0x158], 0x240
push eax
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x150], ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x151d7
push 0x15424
lea eax, [ebp - 0x174]
push eax
call edi
push 4
pop ebx
push ebx
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x13c], esi
mov esi, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push eax
push ebx
push 0
lea eax, [ebp - 0x174]
push eax
push dword [ebp - 0x128]
call esi
push 0x15440
lea eax, [ebp - 0x17c]
push eax
call edi
mov eax, dword [ebp + 8]
and dword [ebp - 0x144], 0
push 8
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x144]
push eax
push 3
push 0
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 0x128]
call esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x18c]
push 0x15460
push eax
call edi
push 8
lea eax, [ebp - 0x14c]
push eax
push 3
push 0
lea eax, [ebp - 0x18c]
push eax
push dword [ebp - 0x128]
call esi
push 0x15492
lea eax, [ebp - 0x184]
push eax
call edi
push ebx
lea eax, [ebp + 0x10]
push eax
push ebx
push 0
lea eax, [ebp - 0x184]
push eax
push dword [ebp - 0x128]
call esi
push dword [ebp - 0x128]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0001107c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403ebf
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405120
push 0x404db6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push dword [0x4066a8]
push dword [0x406778]
call fcn.004016a1
pop ecx
pop ecx
cmp dword [0x409864], 0x12b
jne 0x403f22
cmp dword [0x409860], 0x68
jne 0x403f22
push 0xa
push 0x50
push 0x4068e8
mov ecx, dword [sym.imp.MSVCP60.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::getline_char___int__char_]
push dword [0x4066a8]
push dword [0x406778]
call fcn.004016a1
pop ecx
pop ecx
xor ecx, ecx
mov eax, dword [0x409860]
cmp byte [eax + 0x4068e8], cl
je 0x403f52
inc eax
cmp byte [eax + 0x4068e8], cl
jne 0x403f44
mov dword [0x409860], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x20], 0x68cff5e4
push ebx
mov dword [ebp - 0x1c], 0xeffebaf6
mov eax, 0x564d5868
mov dword [ebp - 0x20], 0x4fc85afd
mov ebx, 0x8685d465
mov ecx, 0xa
mov dword [ebp - 0x20], 0xa6f83792
mov dx, 0x5658
mov dword [ebp - 0x20], 0x106095b2
in eax, dx
mov dword [ebp - 0x20], 0xf7bed9f7
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0x94302928
pop ebx
mov dword [ebp - 0x20], 0x3919a2ef
or dword [ebp - 4], 0xffffffff
xor eax, eax
cmp dword [ebp - 0x24], 0x564d5868
sete al
jmp 0x404065
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414ba0
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [ebp - 0x3f000828]
xor al, 0x38
call edi
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
and esi, edi
mov ch, 0x2f
clc
invalid
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5f7128]
xor ecx, dword [ecx + ecx*4 + 0x458bfc45]
aas
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x3f]
mov ecx, dword [ebp - 0x46]
push ebx
imul ebx, eax, 0xc20
push esi
xchg dword [eax + 0x7d], esp
or byte [ecx - 0x76a81fbb], cl
jge 0x414bad
mov esp, 0x838bc94d
mov dword [edi - 0x4c74ff90], esi
loope 0x414bef
pop edi
add byte [ecx + 0x15ffe845], cl
in al, dx
jnp 0x414c38
jg 0x414b6d
mov esi, dword [eax + ebp*8 - 0x48937c65]
pop edi
add byte [edi], cl
invalid
mov ah, 0xe8
wait
sub dword [edi + esi*4 + 0x5f], 0
jl 0x414d2d
add byte [ebx], bh
aas
cmp edi, dword [edi]
jo 0x414bab
pop edi
inc ecx
seto byte [ebx + 1]
add byte [esi + edx*2 + 0x50], bh
inc ecx
jne 0x414be1
lea ebp, [edx - 0x17c9a834]
lds eax, [eax + eax]
add byte [ebx + 0x308b14c4], al
mov eax, ebp
dec ebx
add esi, 2
movsb byte es:[edi], byte [esi]
dec eax
add al, 0x89
dec ebp
invalid
mov dword [ebp - 0x14], esi
call dword [0xf058262c]
push dword [ebp - 8]
xor edi, eax
push dword [ebp - 0xc]
mov dword [ecx], eax
mov dh, 0xff
jne 0x414c3f
pop eax
invalid
push dword [ebp - 0x14]
push edi
add al, 0x15
cmp al, 0x21
pop eax
pop ebx
stc
inc ebp
lock add bl, byte [eax]
mov bl, 0x96
mov dl, 0x5f
sub dword [ebx - 0x7cfd4d93], eax
insd dword es:[edi], dx
hlt
push edi
mov dword [0x5f25f0], edx
inc ebx
dec ebp
cld
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052881d
mov esp, ebp
imul eax, ebx, 0xcccccc69
int3

Function at 0x41a290
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
jnp 0x41a222
sal dword [ebx], 1
test byte [ebx - 0x367ae335], 0x74
adc eax, 0x8b0c578b
pop edx
ror dword [ebx + 0xc583902], cl
leave
je 0x41a2b6
mov edx, dword [edi + 0xc]
mov ebx, dword [edx - 0x2d]
mov eax, dword [edx]
cmp dword [eax + 0xc], ebx
je 0x41a29e
lcall 0x72f1, 0x3b04c283
int1
or esi, 0xffffffff
mov eax, dword [edi + 0x10]
in al, 0x47
or al, 0xb6
clc
add bh, dh
invalid

Function at 0x426ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564d31
js 0x426aed
xor dword [ebp + 0x56], ecx
add byte [eax + edi*2], ah
add byte [edi - 0x137cb000], bl
pop esp
mov eax, dword [0x5f7128]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmpsb byte [esi], byte es:[edi]
push edi
push eax
lea eax, [ecx + 0xa36456]
add al, bh
add byte [ebx - 0x5ddcf783], cl
mov al, byte [0x893e758b]
jge 0x426ae6
invalid

Function at 0x427a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
clc
salc
pop ss
push edi
add byte [ecx], ah
inc dword [eax]
add byte [edi], dh
push ecx
push ebx
push esi
push edi
shr dword [eax], 0x6e
sbb al, 0
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
dec ebp
mov dword [0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
lea edx, [ebx + 4]
invalid
Function at 0x434370
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c4fd
mov eax, dword fs:[0x11000000]
push eax
push ecx
cmp ecx, dword [ecx]
mov eax, dword [0x5f7128]
xor ebx, dword [edx]
push eax
lea eax, [ebp - 0xc]
fbld tbyte [ebx + 0x680024]
mov edi, ecx
mov dword [ebp - 0x10], edi
pop ebp
mul ecx
add byte [eax], al
add byte [esi + 0x847c7], dl
add byte [edi], al
mov dword [edi + 0xc], 0x77
mov dword [edi], vtable.StaticDialog.0
mov dword [ebp - 4], 0x42
xor eax, eax
pop ebp
pop es
adc al, 5
pop ecx
add bh, al
inc edi
dec esp
pop es
add byte [esi], bh
mov dword [edi + 0x48], 0
add word [edi + 0x38], ax
mov byte [ebp + 0x54], 0x6a
mov dword [eax + ebx*4 + 0x12000000], 0x6c7b0000
cmp ebx, dword [eax + eax + 0x20000]
add bh, ah
mov dword [edi + 0x59], 3
mov dword [edi + 0x5500a4], 0x653d03
mov dword [edi + 0xb0], eax
mov dword [ebx], edx
mov ah, 0x1e
add bh, dl
mov dword [edi + 0xa1b8], eax
invalid

Function at 0x44c63f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc edx
in eax, dx
add dword [eax], eax
invalid
fimul word [ebx - 0x74a86014]
stc
mov ecx, dword [edi]
test ecx, ecx
je 0x44c694
out 0xd9, eax
push 0
push 0x850
call fcn.0040dbd0
dec eax
neg eax
das
rol byte [eax - 0x7c], 0xc0
fistp qword [edi]
mov ecx, dword [edi]
test ecx, ecx
je 0x44c694
mov ah, 0
push 0
push 0x609a
call 0x9dbd0
cmp edi, esi
fcomp dword [ebx]
rol byte [eax - 0x7c], 0xc0
je 0x44c60a
cmp byte [edi - 0x7c], 0
je 0x44c694
cmpsb byte [esi], byte es:[edi]
pminub mm3, qword [esi]
push 0
push 0x899
call fcn.0040dbd0
inc ecx
inc edi
pop edx
add bh, al
inc edi
inc eax
add byte [eax], al
add byte [eax], al
push dword [ebp + 8]
cmpsd dword [esi], dword es:[edi]
inc ebp
or byte [eax + 0x47892477], cl
add al, 0xc7
inc edi
inc eax
add byte [eax], al
add byte [ebx + 0x4447c7], dl
jge 0x44c6ff
add byte [ecx + 0xc47], dh
add byte [eax], al
add byte [eax], al
and al, 0xff
jbe 0x44c6ab
push dword [esi]
arpl ax, dx
call 0x6d0c6c1
mov dword [esi + 0x3f], eax
mov dword [edi + 0x3c], 0
mov esi, dword [esi + 0x3a5a6018]
fbstp tbyte es:[eax]
imul eax, dword [edi + 0x34], 0xe88177ff
cwde
mov esp, 0xc4bf000d
adc al, 0xc7
inc edi
pop ebp
or esi, dword [edi]
add byte [eax], al
pop edi
pop esi
pop ebp
ret 4
lcall 0, 0xdc6a8190
add byte [ecx + 0x5f6528], ah
xor eax, ebx
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0xd400], eax
pop ecx
int1
mov dword [ebp - 0x38], 0x67000000
cmp dword [esi + 0x69], 0
je 0x44c6b1
mov edi, 0x8b000004
dec esi
or edi, dword [eax - 0x44555555]
mov ebx, dword [esi - 0x23]
sub ecx, ebx
mov edi, dword [esi + 0x40]
test dword [edi - 0x40], 0xc1c2b0fa
call 0x3c06dad0
invalid

Function at 0x44d0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
in al, dx
or bh, bh
ja 0x44d0df
add edi, ebp
add ah, byte [eax - 0x68a3f7c]
mov dh, 0xd1
mov dword [ebp - 0x18], edx
invalid
dec ebp
Function at 0x499430
Capabilities:
Encode data using xor

Disassembly:
invalid
push ebp
mov ebp, esp
push 0x2b
ficomp dword [eax + 0x64005753]
mov eax, dword [pe_dos_header]
push eax
mov eax, 0xb7f61f0c
call 0x1c528860
arpl word [eax], bp
jno 0x4994ae
add byte [ebx], dh
jge 0x4993fa
inc ebp
invalid
add byte [eax], al
add byte [eax - 0x39], dl
test esp, esp
stosd dword es:[edi], eax
invalid

Function at 0x4cae70
Capabilities:
Encode data using xor

Disassembly:
call fcn.004d597c
test al, al
je 0x4d1fa2
push dword [ebp - 0x4b0fbc]
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
sub eax, 0xefff1012
sub al, 0x21
or al, 0
push 0xffffff
push dword [esi + 0x10]
adc byte [0x8d2124], 0xf
mov dh, 0x49
push esp
neg eax
cmpsd dword [esi], dword es:[edi]
or byte [0xb65f0100], ah
pop ds
ror byte [eax], 0x50
push dword [esi + 0x10]
dec esp
adc eax, 0x9b5820c8
mov edi, dword [ebp - 0x28000fcc]
mov ecx, dword [ebp - 0xf37]
xor byte [ebp - 0x1c0f55], al
mov edi, dword [ebx - 0x67]
sub edi, edi
or al, 0xa8
jg 0x4caea6
invalid
push 0
call fcn.0053fc46
int3

Function at 0x4cdf20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sbb edi, edi
push 0x579bf7
aad 0xa1
mov byte [0x2f000000], al
sub esp, 0x2c
mov eax, dword [0x5f7128]
xor eax, ebp
and eax, dword [ebp - 0x1a]
push ebx
xchg byte [edi + 0x50], dl
lea eax, [ebp - 0xc]
bt dword [eax], eax
add byte [eax], al
add byte [ebx - 0x6d8a7427], cl
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
xchg edx, eax
jne 0x4cdf25
call fcn.005282c0
cmp dword [eax - 0x37f5adfc], 0xffffffc7
inc ebp
cld
add byte [eax], al
add bh, dl
test eax, eax
je 0x4cdf7a
push esi
mov ecx, eax
call fcn.004ea1a0
mov edi, eax
pop esp
inc ebp
int3
xor edi, edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], 0xffffffff
or cl, bh
call 0xa34eb650
mov byte [ebp - 0x29], al
xlatb
test byte [esi - 0x7aec8b], dl
test edi, edi
je 0x4cdfa0
mov ebp, ecx
mov ecx, edi
sahf
sub edi, edi
adc byte [edx], dh
sal byte [edi + ecx*2], 1
cmp eax, dword [eax]
and byte [di + 0x20], al
add byte [ebx - 0x2e3a1701], cl
add dword [eax], eax
xor al, al
xor al, 0x4f
add dword [ebx], edi
add byte [edi + 0x20], ah
inc ebp
and byte [eax], al
mov edi, edi
call fcn.004eb178
test eax, eax
je 0x4cdf94
push 0x5aa54b
mov ecx, eax
mov ah, 0xad
rol dword [ecx], cl
push eax
mov esi, eax
mov esi, esi
je 0x4cdfec
call edi
fucomi st(5)
adc eax, 0x42582464
test eax, eax
je 0x4cdf8f
lea ecx, [ebx + 0x64]
call fcn.004fcef0
arpl word [ebp - 0x30], si
xor byte [ebx + 0xd00b4], cl
call fcn.004aad80
call 0xa440bbb0
push 0x5b6d13
push 0x1b79f0
push 0xa96ae8
lea ecx, [ebp - 3]
push ecx
mov ecx, dword [eax + 0x234ac]
call fcn.0045ec20
mov dword [ebp - 4], 0xfd0001
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x6b]
jae 0x4ce03e
out 0x45, al
int3
add dword [ebp + 4], esi
mov ecx, esi
jmp 0x4ce047
push 0
push 0x12
push eax
push 0x585860
mov ebx, 0x18baa
push eax
lea ecx, [ebx + 0x64]
call fcn.004f49c0
inc ebx
push esi
sbb al, 0xcb
or bh, al
in eax, 0xd0
jmp [eax - 0x30]
Function at 0x4eb370
Capabilities:
Encode data using xor

Disassembly:
pop ebx
push ebp
jo 0x4eb35f
push esi
popfd
jne 0x4eb37f
push esi
call fcn.004eb170
test eax, eax
je 0x4eb334
xor byte [eax + 0x10], bh
call 0x28c885fd
enter 0x71e8, 3
add byte [eax], al
test eax, eax
jne 0x4eb381

Function at 0x507aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xchg ebx, eax
mov esi, dword [ecx + 4]
stosb byte es:[edi], al
jle 0x507ac6
add byte [esi + 0x5d84534e], dh
or byte [ebx - 0x2ca8e33a], al
movsb byte es:[edi], byte [esi]
and al, 0
jb 0x507abf
add byte [ebx + 0x74d18506], cl
sub eax, 0x15ff5371
je 0x507ad2
jno 0x507b1b
call dword [0x390f0674]
rol al, cl
je 0x507af3
invalid
lea edi, [esi - 0x14]
push edi
push eax
call dword [0xb22425ac]
mov ebp, ebp
mov ecx, dword [esi - 0x75]
mov dword [edi], ebp
adc byte [ebp + 0x5350f845], cl
mov dword [ebp - 4], ecx
call dword [0x8c58257c]
xor dword [esi + 0x24], 0x66
inc ebp
insb byte es:[edi], dx
cld
mov ecx, 0x5b02c375
sub dword [ebx + 0x1ac24357], ecx
add ah, cl
invalid

Function at 0x52611d
Capabilities:
Encode data using xor

Disassembly:
dec edi
out 0x52, al
pop ecx
stosd dword es:[edi], eax
lea ebx, [ecx - 1]
invalid
call 0x592e3f91
mov eax, dword [ebx]
mov byte [ebp - 4], 3
mov edi, dword [eax - 0x23]
mov ecx, esi
call fcn.00529035
add byte [eax], al
mov ecx, ebx
call esi
cdq
mov edi, eax
xor edi, edx
sub edi, edx
mov dword [ebp - 6], edi
cmp dword [ebp + 0x34], edi
ja 0x5260eb
stosd dword es:[edi], eax
mov ch, 0x78
jbe 0x5260a2
jge 0x5260dd
adc byte [edi + 0x45], cl
test al, 0x8b
enter 0xffffffffffff8773, 0xffffffffffffff8d
dec ebp
test al, 0x80
pushfd
sub esi, dword [ebp + edi*2 - 0x7d]
jge 0x5260f0
adc byte [ebx + 3], dh
lea eax, [ebp - 0x58]
sbb byte [ebx - 0x746b8200], 3
mov esi, dword [eax + 0x10]
mov ecx, esi
call 0x52da35
retf
Function at 0x52774b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
insb byte es:[edi], dx
inc ebp
adc al, 0x83
xor dword [ebx + 0x53], ebp
push esi
xor ebx, ebx
push edi
test eax, eax
je 0x52775c
mov dword [edx - 0x75], esp
inc ebp
or byte [ebx + 0xb60ff0], cl
mov eax, dword [ebp + 8]
mov esi, eax
movzx eax, byte [eax]
jmp 0x52776a
inc esi
movzx eax, byte [0xc56ee850]
lodsd eax, dword [esi]
push ds
push eax
call 0x1f003cde
pop ecx
test eax, eax
jne 0x527766
mov al, byte [esi]
mov byte [ebp - 1], al
cmp al, 0xe1
je 0x527788
cmp al, 0x2b
je 0x527788
mov byte [ebp - 1], 0x2b
jmp 0x527789
jnp 0x318829
mov ebx, dword [ebx - 0x90020f0]
mov dl, bh
add byte [ebp + 0x1ffcae7], dh
test byte [eax - 0x184aff06], 0xca
inc dword [ecx]
je 0x1a63788e
adc dword [edx], ebx
cmp edi, 0x24
shrd dword [edx], ebx, cl
add byte [eax], al
test edi, edi
jle 0x52779b
or ebx, 0xffffffd0
jne 0x527825
cmp byte [esi], 0xdb
outsb dx, byte [esi]
sub al, 0x11
inc esi
add dword [eax + edi*2], edi
je 0x52774c
cmp al, 0x58
jne 0x5277e0
jmp 0x5277dd
add esi, 0x19
mov dword [ebx + 0x460116f4], ebx
sbb ch, 0x9d
je 0x52783e
out 0x75, al
invalid
movsx eax, byte [esi]
hlt
jmp 0x5277f1
cmp dword [ebp + 0xf167fc9], eax
mov esi, 0x2bcb8b7f
fidivr word [ebx]
fld dword [ecx - 0x742dccf5]
sal edi, 0xf7
mov ch, 0x1f
mov eax, 0x22e81f74
pop edi
add al, byte [eax]
mov dword [eax], 0x75
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x527871
mov dword [eax], 1
or ebx, 0xffffffff
mov al, 0x2b
jmp 0x52787b
and al, 0x2d
xchg edi, eax
add dh, bh
fisttp dword [ecx + 0x4d]
or al, 0x85
leave
je 0x52788a
mov dword [ecx], esi
mov esi, ebp
jmp 0x52789c
pop edi
pop esi
pop ebx
mov esp, ebp
test bl, 0x55
mov eax, ebx
push ecx
push ebx
push esi
test al, 0xae

Function at 0x52941d
Capabilities:
Encode data using xor

Disassembly:
clc
and eax, 6
xor ebp, dword [esi - 0x7d]
clc
push 0x75
xor eax, dword [ebp - 0x5ed0ea37]
xor byte [ebx + 0x5f], bh
add byte [edx], dl
adc cl, al
or bh, al
add eax, 0x9860be64
add eax, dword [eax]
add byte [ebx], bh
mov edi, 0xa3208c11
xor byte [ecx], ch
pop edi
mov dword [0xf2831274], eax
and bh, al
shl byte [esi + ecx*8 + 0x60], 1
add bl, bh
add byte [eax], al
add byte [ebx + 0x5f7130], ah
je 0x529409
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52b8bb
Capabilities:
Encode data using xor

Disassembly:
aam 0xce
pushal
add byte [edi], cl
or byte [edi + edi*8 - 1], 0xff
call 0xffa8b14c
cmp byte [0x60cec4], 0
je 0x52b91e
xor esi, esi
xor dword [edi + 0x18], 0xc9334d76
xor ecx, dword [eax]
or edx, dword [edi + 0x14]
jbe 0x52b8dc
mov byte [0x7efc4847], al
add dword [ecx + ecx*4], ecx
pop ebp
in al, dx
jmp 0x45ddfcf9
ret 0xe80c
inc esi
fcmovb st(0), st(1)
sub byte [ebx], bh
rcr dword [eax], 1
jb 0x52b90e
pop edi
imul ebx, dword [ebx - 0x75], 0x55c35de5
mov ebp, esp
sub esp, 0x10
adc dh, al
push ebx
mov dword [ebp - 0x10], eax
mov ebx, dword [eax - 0x33]
test dword [eax + 0x74], ecx
add eax, 0xeb185b8b
add cl, byte [edx + 0x740d85db]
dec ecx
push esi
sub ebx, dword [ecx]
inc ebx
js 0x52b964
jnp 0x52b95c
and dword [ebp - 0xc], 0x3b
and al, 0x65
into
add byte [eax*2 - 0x3ba72ae], al
add al, 0x45
push edx
lea eax, [ebp - 4]
mov edx, edi
push eax
lea eax, [ebp - 8]
push eax
jno 0x52b9b9
add al, 0x8d
inc ebp
hlt
les ebx, [eax]
jmp 0x52ba10
setne dl
xor ecx, ecx
mov dword [ebp - 0x18], ecx
test edi, edi
je 0x52bb0b
add byte [eax], al
invalid
cmp dword [ebp - 0xc], 0
seta bl
and cl, al
mov byte [ebp - 0x74], dl
push ebp
mov word [esi + 0x64], ds
mov eax, dword [ebp + 0x55]
pop esi
mov eax, dword fs:[ebp + 0x55]
lea edx, [ecx + 0x31]
mov dword [ebp + 0x5c], ecx
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x28], eax
imul eax, eax, 0x77
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
cmp edx, edi
jae 0x52bac2
push 0xfffffffffffffffc
clc
mov ebx, ecx
jl 0x52ba2a
or dl, byte [esi + edx*4]
xor al, 3
inc ebp
in al, dx
mov dword [ebp - 0x24], eax
mov edx, dword [edx + 0x1c]
cmp eax, dword [ecx - 0x77]
jbe 0x52ba68
mov ecx, dword [ebp - 0x24]
mov ebx, edx
inc edx
cmp edx, edi
jb 0x52ba51
or ecx, dword [ebp - 0x18]
cmp eax, dword [ebx]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x20]
je 0x52bacb
mov edx, dword [ebp - 0x47]
mov eax, dword [ebp - 8]
mov edi, dword [eax]
clc
call 0x4dc4a8f
loope 0x52ba18
inc ebp
fdiv dword [ebx + 4]
xchg edi, eax
mov edx, dword [ebp - 8]
jae 0x52bafc
fadd dword [eax]
imul edi, dword [edx + ecx*4], 0x34
jge 0x52bb1c
in al, dx
or dword [edx + 0x532c7604], 0xffffff8b
pop ebp
fdiv dword [ebx]
daa
mov dword [ebp - 0x10], ecx
mov eax, edi
xor byte [ebx + 0x7501084c], al
add eax, 0x8f7d83
jne 0x52babc
cmp dword [ebp - 0x71], 0
jbe 0x52bae7
sub cl, byte [ebx - 0x74eba1bc]
mov eax, dword [esi + ebx*2 + 0x14]
mov ecx, esi
into
out dx, al
add byte [ebx + 0x67], dl
cmp eax, 0xacc3e800
lodsb al, byte [esi]
push 0xf4458600
jmp 0x52bab5
les eax, [ebx + 0x4d8934c1]
inc ecx
mov bh, byte [esi - 0x17b20c01]
cmp ecx, edi
push es
adc byte [0x5fffffff], 0x8b
xchg byte [eax + eax - 0x79ceff44], al
pop edi
mov eax, dword [esi + 0xbc0084]
xor dword [esi + 0x80], eax
jne 0x52babd
add byte [eax], 0
add byte [ebp - 0x5d], dh
push 0
mov ecx, ebx
call 0xb5538dca
mov edx, dword [ebx]
add bl, byte [esp - 0x3629e744]
sbb dh, dl
leave