joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e0b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x474442
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov eax, dword [0x4c60a0]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], 0
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov dword [esp + 0xc], esi
mov word [esi + 4], ax
push 1
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x230], eax
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x10]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e130
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x14]
call fcn.0040a970
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00462039
add esp, 0x220
ret

Function at 0x40e170
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x474442
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov eax, dword [0x4c60a0]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], 0
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov dword [esp + 0xc], esi
mov word [esi + 4], ax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x228], eax
push 0x104
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e1f0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x14]
call fcn.0040a970
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00462039
add esp, 0x220
ret

Function at 0x40e230
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x474442
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov eax, dword [0x4c60a0]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], 0
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov dword [esp + 0xc], esi
mov word [esi + 4], ax
push 1
push 0x17
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x230], eax
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e2b0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x14]
call fcn.0040a970
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00462039
add esp, 0x220
ret
Function at 0x40e740
Capabilities:
Set registry value

Disassembly:
push ecx
push edi
xor edi, edi
push edi
lea eax, [esp + 8]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40e79d
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e764
mov ecx, dword [esp + 0xc]
sub eax, edx
mov edx, dword [esp + 4]
sar eax, 1
add eax, eax
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40e792
lea edi, [eax + 1]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ecx
ret

Function at 0x40e7b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x218]
push ebx
push esi
mov esi, edx
lea edx, [esp + 8]
push edx
push 0xf003f
xor ebx, ebx
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e854
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.00464770
mov ecx, dword [esp + 0x14]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push edi
push ecx
mov dword [esp + 0x24], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e849
lea ebx, [eax + 1]
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e830
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x14]
call fcn.0040a970
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x218]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00462039
add esp, 0x214
ret
Function at 0x40ee60
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4742a8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
mov eax, dword [0x4c60a0]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x9c]
mov esi, ecx
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x70], cx
push ecx
lea ecx, [esp + 0x70]
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], 0
call fcn.0040a460
mov dword [esp + 0x94], 0
cmp dword [esi + 0x14], 0
jbe 0x40eef8
push 3
mov eax, 0x49bc54
lea ecx, [esp + 0x6c]
call fcn.0040a380
push 0
push esi
or eax, 0xffffffff
lea esi, [esp + 0x70]
call fcn.0040a2c0
push 0x40
lea edx, [esp + 0x24]
push 0
push edx
call fcn.00464770
xor eax, eax
add esp, 0xc
cmp dword [esp + 0x80], 8
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], 0x44
jae 0x40ef39
lea eax, [esp + 0x6c]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40ef6b
push eax
call ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40ef83
push 0x64
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [esp + 0xc]
push eax
call ebx
cmp dword [esp + 0x80], 8
jb 0x40ef9a
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.0046202e
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00462039
add esp, 0x8c
ret

Function at 0x40efc0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x474272
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push edi
mov eax, dword [0x4c60a0]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], 0
lea edi, [esi + 4]
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov dword [esp + 0x10], esi
mov word [edi], ax
push 1
push 5
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x234], eax
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40f043
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x18]
call fcn.0040a970
push 0xc
mov eax, 0x49bc5c
mov ecx, esi
call fcn.0040a380
cmp dword [esi + 0x18], 8
jb 0x40f074
mov eax, dword [edi]
jmp 0x40f076
mov eax, edi
push 0
push eax
call fcn.0046272a
add esp, 8
test eax, eax
je 0x40f096
cmp dword [esi + 0x18], 8
jb 0x40f08d
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00462039
add esp, 0x220
ret
Function at 0x414bb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x414bd2
push 0x1c2
push 0x49f19c
push 0x49f49c
call fcn.00462c96
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x414c1f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x414c1f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, dword [ebx]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [esi + 8]
push eax
mov ecx, ebx
call edx
pop edi
pop esi
mov eax, 1
pop ebx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4181a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4181b7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4181e8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4181e4
cmp esi, eax
jae 0x4181e8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4181d4
cmp esi, eax
jb 0x4181ee
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x418e50
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 4]
mov esi, ecx
cmp eax, 0x100
je 0x418e6d
cmp eax, 0x104
jne 0x418f32
mov eax, dword [edi]
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x1c]
call eax
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x418e8f
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
cmp dword [edi], eax
jne 0x418ef3
cmp dword [edi + 8], 0x1b
jne 0x418eab
mov edx, dword [esi]
mov eax, dword [edx + 0x110]
mov ecx, esi
call eax
pop edi
mov eax, 1
pop esi
ret 4
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push 0xa4
call ebx
push 0xa5
movzx ebp, ax
call ebx
test ebp, 0x8000
pop ebp
movzx eax, ax
pop ebx
jne 0x418ed8
test eax, 0x8000
je 0x418ef3
cmp dword [edi + 8], 0x73
jne 0x418ef3
mov edx, dword [esi]
mov eax, dword [edx + 0x7c]
push 1
mov ecx, esi
call eax
pop edi
mov eax, 1
pop esi
ret 4
mov ecx, dword [edi]
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x418f32
mov ecx, dword [edi + 8]
mov edx, dword [edi]
push edi
push ecx
push 0x87
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x418f32
cmp dword [edi + 8], 9
jne 0x418f32
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
mov ecx, esi
call edx
mov dword [edi], eax
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x419bd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x474198
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x4c60a0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x20], 0xd
jne 0x419ce6
mov eax, dword [esi + 0xb8]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x88]
mov eax, dword [edx + 0x4c]
test eax, eax
je 0x419ce6
mov dword [ecx + 0x30], 1
mov eax, dword [esi + 0xb8]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0xa8]
mov edi, dword [ecx + 0x15c]
mov edx, dword [esi + 0xb8]
mov dword [edx + 0x88], 3
mov eax, dword [esi + 0xb8]
mov ecx, dword [eax + 0x10]
call sym.SH7zInstaller.exe_public:_void___thiscall_shui::CSHSearchListBox::Hide_void_
test edi, edi
jl 0x419cd2
mov ecx, dword [esi + 0xb8]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0xa8]
mov eax, dword [eax + 0x154]
dec eax
cmp edi, eax
jg 0x419cd2
mov ecx, dword [esi + 0xdc]
sub ecx, dword [esi + 0xd8]
test ecx, 0xfffffffc
je 0x419ce6
mov dword [esp + 0xc], sym.SH7zInstaller.exe_const_shui::CSHListSignalArgs::vftable
mov dword [esp + 0x48], 0
mov edx, dword [esi]
mov edx, dword [edx + 0x7c]
or eax, 0xffffffff
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0xc]
push eax
push esi
mov ecx, esi
mov dword [esp + 0x34], edi
call edx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x40
push 0x49f6b8
push 0x49f6e8
call fcn.00462c96
add esp, 0xc
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4289b0
Capabilities:
Encode data using xor

Disassembly:
push es
mov cl, 0x2c
pop ebp
lcall 0x124a, 0xadf73636
fcomp st(5)
dec edx
add byte [ebp + 0x40f30dfa], ch
inc eax
add cl, byte [ecx - 0x5fa28395]
stc
je 0x428a22
sub dword [ecx + 0x42], ebx
or al, 0x99
fld qword [esi - 0x33efb770]
nop
dec eax
adc ah, cl
mov esi, 0xb912eaa4
loop 0x4289fa
pavgw mm5, qword [edi - 0x1a9eac9d]
push edi
cmp esi, ebx
sbb dword [ecx - 0x7fd22641], 0xffffffc0
xor al, 0xa2
sbb edx, esp
sub byte [ecx - 0x68], 0xbf
sub dword [edi - 0x65255dd9], edx
stc
mov ch, 0x9d
xchg edi, eax
daa
mov byte [0xb5f99ada], al
popfd
lcall 0xcc44, 0x839db5f9
cmp al, byte [ebx + 0x2c]
mov edx, dword [esp + eax*8 + 0x32]
add dword [esp + ecx*8 + 0x3a], 0x43
sub al, 0x8b
push esp
les esi, [edx]
fist dword [edi]
arpl word [esi - 0x10a7220c], sp
and byte [ebx], cl
mov ecx, 0x9942c520
mov ecx, dword [edi]
xchg esp, eax
salc
dec ecx
shr dword [edi + 0x3a], cl
dec eax
sub dword [ebp + edi*4 + 0x67], edx
jne 0x428a8f
outsd dx, dword [esi]
cmp cl, byte [eax + 0x29]
push esp
mov ebp, 0x5a647567
pop edx
inc esp
jmp 0x53cd91db
jmp 0x4289d5
xchg byte [ebx], ah
aam 0xc6
add byte [ebp - 0x13], 0x15
aad 0x74
adc edi, edx
mov esi, 0x895a3230
stosd dword es:[edi], eax
wait
rcl dword [eax - 0x47e0380a], cl
sar esp, 0xa0
mov cs, ebp
int3
cld
mov al, byte [0xa2cccd8e]
xchg edi, eax
stosb byte es:[edi], al
push eax
xor al, 0x53
inc edi
in eax, dx
in al, 0xa
adc dword [esi - 0x57], ebx
pop esi
test eax, 0x7e4fe519
xchg esi, eax
sbb ebp, esp
dec edi
jle 0x4289fe
ror byte [edi + 0x30a4f780], 0x72
imul esp, dword [ebx], 0xc3140eab
or dl, al
int 0x8b
cmpsb byte [esi], byte es:[edi]
aas
je 0x428ae4
pop esi
in eax, 0x56
loopne 0x428a51
xchg ebp, eax
je 0x428a63
invalid
and al, 0xee
fldenv [ebx - 0xd]
inc ecx
ret 0xac60
lodsb al, byte [esi]
cmc
in al, 0x90
les esi, [ebx]
movsd dword es:[edi], dword [esi]
xor eax, 0xd50f6a38
dec edx
daa
mov al, 0x5b
cli
push ss
dec ebx
loop 0x428a61
inc esp
xlatb
jae 0x428a37
div byte [ecx]
loop 0x428a32
nop
or byte [edx + 0x6a], bh
push ss
jp 0x428a49
fcom qword [eax]
jne 0x428b1b
sub cl, byte [edx]
cmp byte [edi + 0x123931ed], bh
or bh, byte [eax]
mov edi, 0x123931ed
xor eax, 0x4fe9304c
mov esp, 0x7296a308
sub dword [ebp - 0x2018622a], ebp
xor ebx, ebx
mov bl, byte [esi - 0x3b1595a7]
jnp 0x428a5e
test dword fs:[esi], eax
jne 0x428a60
xchg edi, eax
dec eax
add edx, dword [ecx + 0x12620497]
clc
add al, 0x62
adc bh, al
imul ecx, dword [esp + edx*2 - 0x1b], 0x8c475ba5
je 0x428ab8
call 0xa6255d6a
ljmp 0xb6c4
les esi, [esi + 0x46ef1350]
jns 0x428a87
mov byte [0xc7740a8b], al
mov eax, 0x7709efa1
mov edx, 0x44e3b406
mov ah, 0xfa
mov cs, word [eax - 0x5006f6b4]
outsb dx, byte [esi]
jl 0x428afc
fiadd dword [edi - 0x1a34e6a8]
js 0x428aaa
add eax, 0x5870e6f4
or al, 0xd7
ja 0x428acf
mov edi, 0x5ef1b516
sub al, 0xde
xchg edx, eax
jle 0x428adf
push eax
ror dword [eax], 1
sub byte [edx], al
sbb dword [esi], 0xffffffe1
adc ch, bl
xor ch, bl
adc eax, 0xbb91fab6
neg dword [ecx + 0x60]
adc byte [ebx - 2], al
cwde
retf
Function at 0x42f1f7
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xbd
mov edx, 0xa419ed73
dec eax
cwde
add eax, 0xcc6c7b94
add byte ds:[eax + 0x437db6c7], ch
add byte [eax + 0x437db6c7], ch
add byte [eax + 0x437db6c7], ch
xor dword [0xe6e0286e], esi
mov fs, esp
sar ebx, 1
fsub qword [eax - 0x6d3a9083]
sti
inc ecx
js 0x42f1e8
salc
ror byte [ecx], 0xc
push esp
aad 0x93
leave
fisubr word [edi - 0x52]
invalid

Function at 0x434c44
Capabilities:
Encode data using xor

Disassembly:
dec ebx
sub dh, byte [esi + ebp*2 + 0x670dcf3f]
sal byte [edi + 0x1d], cl
add byte [edx + esi*8], dl
in al, dx
mov byte [ebx + 0x35], 0x47
insb byte es:[edi], dx
fistp dword [ebp + 0x562fb1b]
push 0xffffffffffffffba
mov esp, 0x7575557
dec edi
inc edx
xchg dword [ebp + 0xd], edx
test dword [edx + edx + 0x5c110a78], esp
js 0x434be2
adc dword [ecx + esi - 0x55], ebx
xchg al, cl
pop ecx
xchg ebx, eax
arpl word [edx], sp
mov edi, 0xedbc159d
fild word [ebp - 0x4c1b5bdf]
adc al, 0x75
cld
adc eax, 0x85dfedbc
and dword [esp - 0x38aeb4d], esp
mov dl, 0xdf
pop ebx
or cl, byte [edx - 0x30]
mov edi, 0x74d48bdc
dec edx
frstor dword [ecx]
push ecx
outsb dx, byte [esi]
inc ecx
lahf
mov edx, 0xca779ff
jns 0x434bad
or al, 0xfd
adc al, 0x5d
in al, 0x47
nop
xor byte [ebp + 0x4265a587], bh
int1
add al, 0x7c
jl 0x434bad
cmp eax, 0xe9669d30
insb byte es:[edi], dx
sar ecx, 0x6c
mov byte [edx], 0xbb
and byte [edx + 0xc1086a5], cl
pmulhw mm3, qword [ecx - 0x5b007034]
adc ebx, dword [ebp - 0x7b3890cc]
xor al, 0x6f
mov dword [esi + ebp*2 - 0x56c86297], 0x6ea8243d
invalid
invalid
push ecx
imul ecx, dword [ecx - 0x59745227], 0xfffffffd
insb byte es:[edi], dx
test dl, al
dec ebx
inc esi
inc ebx
push esi
inc al
jne 0x434cab
mov dword [0xa847a7e5], eax
xchg ebx, eax
sub bh, cl
jne 0x434c60
sub dl, byte [ecx]
js 0x434be4
and eax, 0xd7a27c96
pop edi
and al, 0x4f
and dword [ebp + 0x12], eax
int1
push eax
push edx
retf
and ch, byte [edi]
sub eax, 0xce373e67
mov byte [eax], ah
mov esi, 0xee4e3658
popfd
mov esp, 0x4e168b0c
mov eax, 0x50f5f168
xchg edx, ecx
test byte [ebx + edi*2 + 0x48c61d15], cl
jle 0x434d38
push 0x8750f5f1
retf 0x8c84
scasb al, byte es:[edi]
rcr byte [edx + 0x52], 0xde
xor byte [eax + eax*8 + 0x10], bh
aad 0x98
sub ebx, 0xffffffad
jge 0x434cc0
add edx, ebx
aad 0x83
ljmp 0x73d
aad 0xb1
invalid

Function at 0x439ade
Capabilities:
Encode data using xor

Disassembly:
cdq
test eax, 0x9d9c80be
salc
salc
out dx, eax
sbb al, 0x56
shr byte gs:[esi + edx*4 - 0xf], 1
fsubrp st(1)
xor dword [eax], ebp
jb 0x439ac7
pop ebp
rol byte [ecx + 0x76], 1
daa
cmc
or eax, dword [eax - 0x510a2977]
sbb al, 0xe7
push ebx
push ds
and byte [edi - 0x4467a166], dl
push eax
invalid

Function at 0x43fdc1
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x22
into
stc
out dx, eax
mov eax, 0x4e1cade1
push 0xa381ab0
test eax, 0x9eaa00fa
lahf
pop es
inc edx
popal
pop ebp
dec ecx
les edx, [eax]
test dword [edx - 0x42], ecx
jge 0x43fd79
inc ebx
int 1
cld
push edx
adc dword [edi + 0x47], 0x9eebe677
Function at 0x4403d9
Capabilities:
Encode data using xor

Disassembly:
dec ebx
mov ch, byte [esi - 0x7e75f81a]
mov bl, 0xbc
push esp
cdq
int3
aad 0xfb
jge 0x440369
sbb byte [esi - 0x36f48fef], ch
loopne 0x44044c
aaa
fisub word [ebx + 0x51b9a6b4]
xor edx, dword [esi + 0x472c4f63]
bound ebx, qword [esi]
cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
xchg esp, eax
imul bh
and dword [eax], edx
mov al, byte [0x9e62d803]
mov edx, 0x91b99f8d
inc eax
mov byte [0x39fe20b8], al
popfd
out 0x43, al
fstp xword [esi]
stosb byte es:[edi], al
scasd eax, dword es:[edi]
fist word cs:[edi + 0x79f7836]
movsd dword es:[edi], dword [esi]
imul esi, dword [0x6722ca6e], 0xccd6bca5
or dword [esi], esi
pcmpeqd mm1, qword [ebp - 0x76114244]
sub dh, bl
mov ebp, 0xde2889ee
cmp eax, 0xe7f04bd1
pop eax
xchg dword [esp + edx*4], edi
push edi
fmul qword [edx + 0x21c14bf9]
invalid
mov al, 0x56
mov eax, 0x8cd4fc8d
pushal
add byte [ebx], cl
sti
lcall 0xfca1, 0xd506ec
outsd dx, dword [esi]
xor eax, 0xb9911c46
push ax
pop ebp
enter 0xffffffffffffa3ed, 0xffffffffffffffeb
dec esp
xlatb
xchg dword [edx], edi
push ecx
lodsb al, byte [esi]
mov al, 0xbc
fstp st(1)
mov bl, 0xad
push edx
or eax, 0x17043b81
cld
mov dword [0x223d3625], eax
xor ch, 0xba
jnp 0x44042b
salc
mov esi, 0x7ada60aa
dec ecx
sti
aas
sub eax, 0xf68cecd1
mul dword [esi - 0x7d0c239e]
shr byte [ebx + 0x30433b2a], cl
push 0x8429abe9
xchg ebx, eax
invalid

Function at 0x442339
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xab
and eax, 0xef092ea7
fdivr qword [eax + edx*8]
shr dword [eax], 1
xchg edx, eax
test dword [edx - 0x7f], 0xcd32c475
xchg edi, eax
mov byte [0xbbc73e8], al
outsd dx, dword [esi]
xor cl, dl
mov eax, 0x24b2c579
pop eax
xlatb
push 0xffffffffffffffe5
add al, 0xd4
je 0x442345
call 0x54cc4585
sbb ebp, dword [eax + eax*4 - 0x67]
cmpsb byte [esi], byte es:[edi]
inc ecx
mov ebx, 0x75ce4131
xor byte [ecx - 0x4ab7d5b1], dl
sbb eax, 0x3f113fc6
cmp dword [eax], eax
inc ecx
lodsb al, byte [esi]
fiadd word [edi + 3]
inc edx
popal
enter 0xffffffffffffc6d7, 0x47
pop esi
inc edx
sub al, 0xa3
call 0x151d04ed
adc dl, dl
jae 0x442409
add al, dl
salc
sub ecx, dword [ecx]
ror dword [eax - 0x36f8f25], 1
sbb byte [edi - 0x5f], dl
xchg ebx, eax
mov dword [esi - 0x1f1a3096], 0x726a26d5
in al, 0x26
int3
inc edx
stosb byte es:[edi], al
inc eax
jae 0x44240e
invalid
cmp byte [ebp - 0x7ee3b8ed], bl
int3
Function at 0x446303
Capabilities:
Encode data using xor

Disassembly:
and bh, 0xa4
jo 0x446342
cmp edx, dword [esp + 0x60a59215]
int1
push ds
sub eax, 0xf00583f5
mov al, byte [0x203ce385]
push ecx
leave
mov eax, 0xe89ffb34
sal edx, 1
mov ch, 0xa5
stc
dec di
call 0x1afa2209
mov bl, 0x5d
ljmp 0x430a
mov esp, dword [ecx - 0x3a]
dec esi
xchg dword [ebp - 0x7b8e900a], esi
mov ebx, 0x57d87525
stosb byte es:[edi], al
mov eax, 0x366606c0
cmp byte [esi], ch
stosb byte es:[edi], al
in al, 0x52
jb 0x4462c9
jo 0x446397
imul dword [eax + 0x19]
pop esp
fist dword [ecx]
fbld tbyte [edx - 0x38]
inc esp
cmp bl, byte [ebx]
mov gs, word [eax - 0x22]
rcr dword fs:[ecx + 0x321c30a5], 1
xchg ecx, eax
xlatb
mov esp, 0x5ce22452
out 0xd0, al
sahf
mov ch, 0xad
lodsd eax, dword [esi]
cdq
retf 0xec3
loope 0x4463d9
or dword [ebx + 0x3cffcfce], 0xffffff9f
cli
inc ecx
rcr dword [ebx + 0x6f], 1
push dword [edi]
fsubr dword [ecx - 0xf407a4a]
sbb al, 0x6f
js 0x4463e4
xor byte [ecx + 0x9c33b1d], dl
out dx, al
pushal
mov edx, dword [ecx]
adc al, 0x9b
out 0x30, eax
cmc
mov dh, byte [edi - 9]
xor byte [ecx + 0x7fc60e5d], 0x37
cli
mov al, byte [0x31ae3add]
pop edi
test eax, 0xd42f2827
inc esi
insd dword es:[edi], dx
xor dword [ebp - 0x4e], edx
scasd eax, dword es:[edi]
push ebp
mov dl, 0xaf
sub byte [ebx + 0x69337d88], cl
jecxz 0x4463b7
xchg ebp, eax
invalid

Function at 0x44710e
Capabilities:
Encode data using xor

Disassembly:
xchg dword [eax - 0x63], ebx
lcall 0x378, 0x892e99eb
jbe 0x447110
and dword [edx - 0x47], esp
sbb byte [edi + 0x5f], dh
pop eax
aam 0xe4
fdivr qword [eax]
xor al, bh
sub bl, byte [ebx - 0x62]
lodsb al, byte [esi]
add ecx, dword [0x7096470a]
inc edx
sahf
ja 0x4470b4
xchg esp, eax
in eax, 0x16
push cs
pop edx
or dl, byte [ecx - 0x16]
push esp
push ebx
dec edx
add eax, 0x9fe60faf
pop ecx
rcl dword [esi + 0x6b36012f], 5
scasb al, byte es:[edi]
jbe 0x447117
xor al, 0x1d
pop ss
sbb eax, 0x12de6517
ficom word gs:[edx]
jge 0x4470e2
jge 0x4470a1
invalid
cmp bl, bh
pop ebx
sbb al, 0x74
pop es
adc esp, dword [ebx + ebx*4 + 1]
add dword [ecx], edi
jmp 0x4470cd
add dword [ecx], eax
cmp ebx, ebp
mov cl, 0x6c
and ebx, dword [ebp - 0x60aeac02]
mov dh, 0x8d
push edx
mov ebp, 0xff489ddd
arpl word [ecx - 0x64], si
mov edx, 0xbd66696a
ror dword cs:[edi - 0x264d4aa3], 1
dec esi
invalid

Function at 0x4531b2
Capabilities:
Encode data using xor

Disassembly:
out 0xb7, al
dec esi
xchg byte [ecx], ah
aad 0xd6
jo 0x4531fb
aam 0xec
lodsd eax, dword [esi]
wait
xor ebp, dword [ebx]
pop esi
leave
loope 0x4531bb
sub al, 0x38
mov edi, 0x2e87d6de
stosd dword es:[edi], eax
adc eax, dword [edi + 0x56]
insb byte es:[edi], dx
dec edx
invalid

Function at 0x45b93b
Capabilities:
Encode data using xor

Disassembly:
stc
cmp eax, eax
jno 0x45b8c1
mov eax, dword [0x4c8f6975]
inc esi
cmp eax, 0x30103452
xor al, 0x10
xor byte [esi], al
wait
jne 0x45b90b
add eax, 0xec7cb885
invalid