joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42123c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x42125e
movzx eax, word [esp]
jmp 0x421260
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x421f48
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x42206d
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00421d50
mov esi, eax
mov eax, dword [0x530398]
cmp byte [eax], 0
je 0x422015
mov eax, dword [0x5301ec]
call fcn.00406f64
call fcn.00406830
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x421f18]
call fcn.0040ac9c
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x422088
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x422051
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x5301ac]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x533c48]
call fcn.0040afb8
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422074
lea eax, [ebp - 4]
mov edx, dword [0x421f18]
call fcn.0040adc0
ret

Function at 0x423968
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004091bc
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c910
mov edi, eax
cmp edi, 0x104
jbe 0x42390f
mov eax, edi
add eax, eax
call fcn.004066dc
mov esi, eax
jmp 0x423911
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c910
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42394c
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x423936
mov eax, esp
cmp esi, eax
je 0x423959
mov eax, esi
call fcn.004066f8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x423994
cmp bl, 0
je 0x423990
cmp bl, 0x41
jl 0x42398b
cmp bl, 0x5a
jg 0x42398b
or bl, 0x20
xor al, bl
inc esi
jmp 0x42396f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4238d0
Function at 0x4241f0
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040997c
add esp, 0x800
pop ebx
ret

Function at 0x43440c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x43445e
test eax, edx
je 0x434461
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x434421
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x434447
add ecx, 4
js 0x434437
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x434444
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x43446d
test edx, edx
jne 0x434414
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x4078d3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407912
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407912
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407912
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407912
cmp dword [ecx + 0x74], 0xe
jbe 0x407912
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41e980
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41e9ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41e9ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x403e59
pop dword [ebp - 0x24]
mov eax, 0x9a9f587
sub eax, 0x969b72e
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x704273a4
sub dword [ebp - 0x34], 0x21f02e59
mov dword [ebp - 0x30], 0x96513f78
add dword [ebp - 0x30], 0x9be20ccd
mov dword [ebp - 0x2c], 0xc796382d
add dword [ebp - 0x2c], 0x84b60c01
mov dword [ebp - 0x28], 0x4e9c0c83
add dword [ebp - 0x28], 0xb163f37d
lea eax, [ebp - 0x34]
push eax
mov eax, 0xcf4af74e
sub eax, 0xcf0a76c2
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xab3cd374
sub dword [ebp - 0x34], 0x36ca6a1e
mov dword [ebp - 0x30], 0xa0a9e89c
add dword [ebp - 0x30], 0xa0c278d9
mov dword [ebp - 0x2c], 0x829aaf15
sub dword [ebp - 0x2c], 0x1f2b42a9
mov dword [ebp - 0x28], 0x569ba901
sub dword [ebp - 0x28], 0x569ba901
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xbbf27ec6
add eax, 0x444e020e
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x354ad
push 0
call eax
mov ecx, 0x422e
xor edx, edx
add edx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x24]
mov ebx, 0x9225327f
sub ebx, 0xfb605b77
sub dword [ebp - 0xc], 0x75bab999
mov edi, dword [esi]
add dword [ebp - 4], 0x8fc059ba
add edi, ebx
xor dword [ebp - 0x18], ecx
mov dword [edx], edi
sub dword [ebp - 4], 0xd7e6ae7a
add edx, 0x4ac5cc4a
sub edx, 0x4ac5cc46
add esi, 4
loop 0x403f71
add eax, 0x3324c785
sub eax, 0x3323cbfa
mov ebx, eax
add eax, 5
mov ecx, 0x90dec1a
add ecx, 0xf73213e6
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x412281
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x412290
pop dword [ebp - 0x44]
mov eax, 0x4731bf22
add eax, 0xb90f636e
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x36ad2
push 0
mov eax, 0x3bc789a0
sub eax, 0x3b84f974
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x3e85
xor esi, esi
add esi, eax
mov edx, 0x436e00
add edx, dword [ebp - 0x44]
mov edi, 0x79f08a07
add dword [ebp - 0x3c], ebx
mov ebx, dword [edx]
add dword [ebp - 0x14], edi
xor ebx, edi
add dword [ebp - 0x24], 0xd434c07f
mov dword [esi], ebx
xor dword [ebp - 0x14], 0x10a1b77
add esi, 4
add edx, 0xf8054973
add edx, 0x7fab691
loop 0x4122df
add eax, 0xd056d60c
sub eax, 0xd055e925
xor ebx, ebx
add ebx, eax
add eax, 0xea96c182
add eax, 0x15693e83
mov ecx, 0xaa4059d5
sub ecx, 0xaa0059d5
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4bc450
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x88000]
push edi
or ebp, 0xffffffff
jmp 0x4bc472
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4bc479
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bc468
mov eax, 1
add ebx, ebx
jne 0x4bc48b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4bc49c
jne 0x4bc4bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bc4bb
dec eax
add ebx, ebx
jne 0x4bc4a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4bc480
add ebx, ebx
jne 0x4bc4b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4bc50d
xor ecx, ecx
sub eax, 3
jb 0x4bc4d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4bc542
sar eax, 1
mov ebp, eax
jmp 0x4bc4de
add ebx, ebx
jne 0x4bc4de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bc4ac
inc ecx
add ebx, ebx
jne 0x4bc4ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bc4ac
add ebx, ebx
jne 0x4bc4f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4bc4ee
jne 0x4bc50a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4bc4ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4bc52c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4bc51e
jmp 0x4bc46e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4bc52c
add edi, ecx
jmp 0x4bc46e
pop esi
mov edi, esi
mov ecx, 0x3b68
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4bc54a
cmp byte [edi], 0x19
jne 0x4bc54a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4bc54f
lea edi, [esi + 0xb8000]
mov eax, dword [edi]
or eax, eax
je 0x4bc5be
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc3c4c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc3d14]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4bc57c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc3d18]
or eax, eax
je 0x4bc5b8
mov dword [ebx], eax
add ebx, 4
jmp 0x4bc599
call dword [esi + 0xc3d28]
mov ebp, dword [esi + 0xc3d1c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4bc5f2
sub esp, 0xffffff80
jmp 0x47f820

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401443
pop dword [ebp - 0x24]
mov eax, 0x401443
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xbbda1fa5
sub dword [ebp - 0x34], 0x6d87da5a
mov dword [ebp - 0x30], 0xd6d325b5
add dword [ebp - 0x30], 0x5b602690
mov dword [ebp - 0x2c], 0xb5ff91a8
sub dword [ebp - 0x2c], 0x69b34d7a
mov dword [ebp - 0x28], 0x23b10cac
sub dword [ebp - 0x28], 0x23b10cac
lea eax, [ebp - 0x34]
push eax
mov eax, 0x93dde6a1
add eax, 0x6c628aa3
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x5def19d6
sub dword [ebp - 0x34], 0xe97cb080
mov dword [ebp - 0x30], 0x9c73956d
add dword [ebp - 0x30], 0xa4f8cc08
mov dword [ebp - 0x2c], 0xed2ca031
add dword [ebp - 0x2c], 0x7642cc3b
mov dword [ebp - 0x28], 0xdb2536a8
sub dword [ebp - 0x28], 0xdb2536a8
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xc949caad
add eax, 0x36f6a663
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3a819
push 0
call eax
mov ecx, 0x13b26bf9
add ecx, 0xec4de5ac
xor esi, esi
add esi, eax
mov edx, 0xd88a31ca
sub edx, 0xd846d1ca
add edx, dword [ebp - 0x24]
mov ebx, 0x14ff415
add ebx, 0xcdb85ba5
mov dword [ebp - 0x20], 0x95c19d27
mov edi, dword [edx]
add dword [ebp - 0xc], ecx
xor edi, ebx
add dword [ebp - 4], 0x89827d2a
mov dword [esi], edi
add dword [ebp - 8], 0xedd0bed9
add esi, 4
add edx, 0xfaed9059
sub edx, 0xfaed9055
loop 0x401562
add eax, 0xfccba490
add eax, 0x33594d7
xor ebx, ebx
add ebx, eax
add eax, 0xa19d2d64
sub eax, 0xa19d2d5f
mov ecx, 0x54fb356c
add ecx, 0xab44ca94
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x402a69
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x424010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402afd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402aba
cmp dword [ebp + 0x10], ebx
jne 0x402af1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402acc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402aa1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.004060b1
cmp eax, ebx
je 0x402b04
push ebx
push dword [0x424010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424010], ebx
jne 0x402afa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402afa
jmp 0x402afd
Function at 0x50d94a
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
arpl cx, di
mov eax, 0xa6214ba3
lcall 0x31b3, 0x9f8758a9
test esp, 0x7a269d05
les eax, [0xc57a269d]

Function at 0x5136b1
Capabilities:
Encode data using xor

Disassembly:
push ecx
inc ecx
pushal
mov eax, dword [0x398b1f87]
cdq
add dword [eax + 0x1630fe31], eax
rol byte [ebx], 1
inc edx
and eax, 0x83059481
in eax, 0x21
loope 0x51373f
scasb al, byte es:[edi]
rol byte [eax - 0x125b2faf], 1
mov dl, 0x78
in al, 0xaf
cmp esi, dword [ebx - 0x52]
daa
movnti dword [eax - 0x2c13300f], edi
shr dl, 4
add dword [bp + di], esi
in al, dx
ja 0x513710
rol eax, cl
ljmp 0x77ec
pop esi
mov dword [ecx - 0x15f26118], eax
mov dword [0x70adf624], eax
leave
and eax, 0xd1f111ed
sub eax, edx
or al, 0xd8
dec ecx
xlatb
adc byte [eax - 0x1f], 0x26
invalid
ljmp 0xc970:0xadf624a3
or eax, 0x60a04395
add byte [0xed8720f7], 0x75
inc eax
pop es
xchg ebp, eax
inc ebx
mov al, byte [0xf7058260]
and byte [edi + 0x74075ed], al
loop 0x5136f1
jo 0x513711
test eax, 0xb64571ae
lds eax, [ebx + 0x78b10141]
inc ebp
mov cl, 0xb1
fisub dword [edi]
call 0xd1577ea4
cmp ebx, ebp
idiv dword [edi + esi*8]
stosb byte es:[edi], al
push esi
push 0xd52b392b
sub edi, dword [ecx]
sub edx, ebp
lodsb al, byte [esi]
fmul qword [eax]
jp 0x51374a
cmp dword [ecx + 0x56607ffd], 0x37697781
std
jg 0x5137ad
push esi
xor dword [edi + 0x69], 0x34c2d137
test ecx, esp
mov edi, edi
xchg dword [ecx - 0x3a191319], ebx
adc dh, byte [edx + 0x29df5412]
ja 0x5137ba
aaa
rol edx, 1
xor al, 0x85
loope 0x5136e1
inc dword [edi - 0x19131867]
lds edx, [edx]
mov dl, 0x12
push esp
fild qword [ecx]
dec eax
mov edi, 0x9b0e8c
loop 0x51374f
inc edi
into
imul esp, dword [edx], 0x691613b1
xchg esi, eax
pop esi
dec ecx
xor ebx, esp
pop ebx
ljmp 0xeab2
mov ss, word [edi + 0x76b76466]
pushal
cmp byte [ebx], 0x64
mov eax, dword [0x3d0411af]
lds ecx, [eax]
ret 0x1b21
adc dword [edi + 0x21c208c5], eax
sbb eax, dword [edx - 0x705b2a94]
cmp dword [ecx + 0x3b], esi
daa
mov dx, 0x7e35
dec ebx
cmc
mov dword [0x4db07e9e], eax
mov ebp, 0x56193867
int1
adc al, 0x7f
invalid

Function at 0x51416f
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x5141c6
and dword [ebp + 0x751a051], edx
neg byte [edx + edx]
or al, 0x4a
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
jb 0x51421d
inc edx
push esi
mov ecx, 0x81919157
jmp 0x6665de7a
out 0x8f, eax
stc
xor edx, dword [esi]
xchg ebp, eax
and eax, 0xa6e1d5d5
and eax, 0xa6e1d5d5
push ecx
aad 0xd0
add eax, 0x624e1d63
xchg ecx, eax
test eax, 0xee914d0a
jb 0x514216
add byte [edi + 0x44], 0xa3
mov dword [ebp + 0x59e1e039], ecx
pushal
popfd
cld
mov ebp, dword [ecx - 1]
rol bh, cl
mov byte [edi - 0x14fa59ca], dl
xor ebp, edx
jb 0x514261
cmp byte [esi], dl
xchg dword [ebp - 0x32], edi
sbb esp, 0x196351ce
sbb dword [eax - 0x5e], edi
imul byte [edi - 0x4d]
nop
invalid
test al, 0xc1
invalid

Function at 0x51532b
Capabilities:
Encode data using xor

Disassembly:
fdivr qword [esi + edx + 0x76d493ad]
inc edx
invalid
Function at 0x55b450
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
add al, 0xff
cmp al, byte [edx - 0x5b0b8904]
out dx, eax
test eax, 0x584741da
mov bh, 0x8b
xchg edx, eax
push ebp
inc esi
invalid
lea esi, [edi]
push ebp
dec ebx
inc dword [esi + 0x1f]
div ch
xor byte [ecx - 0x4a67bc6a], cl
mov dh, 0x69
bnd jb 0x55b434
test ah, dh
sal dh, 1
insd dword es:[edi], dx
xor dword [esi - 0x565b5853], edi
loop 0x55b487
lahf
mov ch, 0x40
mov dl, byte [esi - 0xb821814]
xchg byte [eax], ah
in al, 0x39
pop edi
invalid
jmp 0x55b4a3
and esi, dword [edi - 0x145b8905]
and dh, dh
dec esp
in al, dx
mov dword [ecx], esi
mov ecx, 0x36d8a92d
salc
cmpsd dword [esi], dword es:[edi]
push 0x1d
jl 0x55b4e0
push edi
mov dh, 0x4a
cmpsb byte [esi], byte es:[edi]
pop ecx
not byte [ecx]
and dword [edx - 0x27], edx
mov esp, dword [edi - 0x7614d191]
fild dword [ecx + 0x3f]
cwde
and al, 0xae
hlt
mov ah, 0x2b
mov dh, 0x73
jmp 0xa813a359

Function at 0x5a64db
Capabilities:
Encode data using xor

Disassembly:
popal
mov ebx, 0x14ed1557
xor edi, dword es:[ecx - 0x159a0e16]
adc al, 0x26
xor edi, dword [ecx - 0x159a0e16]
imul edi, dword [0xfb6b1025], 0x36db648e
sti
mov fs, word [ebx + ebx*8 + 0x36]
xchg edx, eax
mov dh, 0x16
lea edx, [edi + 0xc]
push ebx
jnp 0x5a653c
jge 0x5a64ed
dec ebx
inc ebp
popfd
in eax, dx
mov bl, byte [edi]
movsd dword es:[edi], dword [esi]
cwde
adc al, 0x3c
loope 0x5a652f
adc byte [edi], ah
cmp eax, 0xd5d13115
mov al, byte [0x84c68504]
xchg edi, eax
dec ebp
loope 0x5a6500
fld dword [ebp - 0x385ef2f1]
push eax
inc eax
xor eax, 0x8cd65dd1
leave
js 0x5a64e0
loope 0x5a6582
push 0x3d5cbae
xor al, 0x99
hlt
retf
add eax, 0x2f14bf44
invalid
add ebp, dword [eax]
inc ecx
xchg ebp, eax
stc
jmp 0x6eeb782b
inc ecx
push ebp
popfd
mov esp, 0x80191672
or byte [ebx - 0x2b], bh
inc ecx
sub esi, dword cs:[edi + 0x56]
jns 0x5a6557
shr bl, 1
test dword [eax + edx + 6], ebp
adc byte [esi], al
xor dh, al
aam 0xa5
cmp esi, esp
push ebx
cmp eax, 0xd013528d
xchg edi, eax
pop esp
push edi
pop ds
add edi, dword [edi + 0x3f9ed679]
out 0xd5, eax
mov ch, pe_nt_image_headers32
test eax, esp
mov al, byte [0xfc8590f2]
mov ah, 0x31
push eax
sar dword [edi + 0x26], 1
ja 0x5a6599
jne 0x5a6552
push cs
sbb ebp, dword [eax]
adc byte [esi + ebp*2], ah
invalid
Function at 0x5b72c6
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x22
invalid
mov dword [edi], ebp
pop ds
mov bh, 0xdc
xchg esi, eax
mov dh, 0x1e
sbb esi, dword [0x63c35638]
pop ecx
dec ecx
xor byte [ecx + 0x36], dl
adc eax, 0x42b6e1ef
or dword [ebp + 0x4a2e366d], esi
mov eax, dword [0x72161f71]
jge 0x5b7298
lea edx, [eax]
fimul dword [edx]
jo 0x5b7235
pop ss
loope 0x5b72c2
jp 0x5b725d
aas
pop ds
out 0x71, al
mov ecx, 0xcdb233ed
jno 0x5b72a5
mov cl, 0x12
or byte [ebx], ch
push ebp
inc ebx
xchg edx, eax
movsb byte es:[edi], byte [esi]
lcall 0x695e, 0x8ffbe959
loope 0x5b7211
cmp eax, 0x3646f634
sub eax, 0xdeb79e3b
inc esi
sub eax, 0xdeb79e3b
int 0xfb
out 0xaf, eax
jg 0x5b729d
mov edx, 0x89c5daaa
xor eax, 0x50607ad7
mov dword [0x50607ad7], esi
push eax
inc ebx
daa
lcall 0x431, 0x10d33083
pop ecx
xor dword [ecx + ebx*2], eax
adc al, 0xdf
cmpsd dword [esi], dword es:[edi]
wait
cmp edx, ecx
dec esp
xor byte [eax + 0x68b7662f], dh
pop edi
inc ecx
mov eax, dword [0x11146942]
or al, 8
jne 0x5b7264
jns 0x5b7340
xchg ebx, eax
sbb eax, 0xbd7447b6
mov dh, 0x47
je 0x5b7287
mov dh, 0x47
je 0x5b7287
invalid
enter 0xffffffffffff89d1, 0xffffffffffffff96
pop esi
add al, ch
cwde
mov esi, dword [ebx + 0x59]
or eax, 0x19b1f029
sub eax, esi
mov cl, 0x19
movsd dword es:[edi], dword [esi]
xor edi, 0xffffff80
fidivr word [0xb7807ecd]
push 0x3e
call 0x7336bea
sub ch, byte [ecx]
inc ebp
jb 0x5b731b
aaa
adc byte [ecx], cl
jb 0x5b731c
xchg dword [edx - 0x20], esi
fidiv dword [ebx + 0x1462fab6]
mov eax, dword [0xdd964f56]
add dl, byte [ebp + 0x17]
mov dh, 0xfa
bound edx, qword [ecx]
push esi
dec edi
xchg esi, eax
fld qword [edx]
push ebp
pop ss
cli
mov al, 0x3c
salc
je 0x5b7372
mov cl, 0x9b
pop edi
pop ebx
push ss
insb byte es:[edi], dx
xchg dword [edi + 0x6f], ebp
sbb ebp, dword [ebp + 0x716793f]
lodsd eax, dword [esi]
aas
jns 0x5b7376
pop es
adc eax, 0x5a7da0d
push 0x5d
push 0xd
cli
jnp 0x5b73d6
mov al, byte [0xbdbdc934]
jp 0x5b73cf
inc ecx
jno 0x5b7310
cdq
jne 0x5b73d5
insd dword es:[edi], dx
push esi
and dword [0x3de6ac67], eax
cmp ecx, esi
int 0x88
mov byte [ecx - 0x5082220c], ch
push ecx
into
ret
loopne 0x5b73a8
jle 0x5b73c2
imul eax, dword [edi], 0xdf567c4
call 0xbf201ce
inc eax
jo 0x5b73f4
invalid
ljmp 0xb3c4:0x289b5b4c
inc ebp
mov eax, dword [0x7e9ff469]
fisubr word [edx - 0x15114f37]
loop 0x5b735c
cdq
loope 0x5b738e
adc edi, ecx
push esp
invalid
xchg edx, eax
rcr byte [edi + 0x393ed15d], cl
cmp edx, ebx
pop ds
ficomp dword [edi]
pushal
sub byte [eax + ebx + 0x281ef1cb], dh
dec edi
push es
out dx, eax
inc ecx
mov ebx, es
cwde
xchg edi, eax
jl 0x5b73ed
aam 0x34
adc al, byte [ebx]
dec eax
or dword [ebp - 0x1c], ebx
mov ecx, 0x510548e
add ecx, dword [eax + 9]
pop ebp
in al, 0xb9
mov ss, word [eax + edx + 5]
push esp
adc byte [0x95fddce8], al
push 0x28
mov eax, 0x594b9e0a
call 0x6af171d8
sub bh, al
ror byte [edx], 0x9e
dec ebx
pop ecx
fcom qword cs:[ebx]
std
cbw
adc dl, dh
dec esp
jecxz 0x5b73b5
invalid
Function at 0x5be326
Capabilities:
Encode data using xor

Disassembly:
fsub qword [ecx]
in eax, dx
inc ebp
dec ebp
push 0x8320eef
sar byte [esp + ebx], cl
ret 0xa82e
fisttp dword [ebx + ebp*2 + 0x355efb8a]
je 0x5be2d4
aaa
cdq
xchg esp, eax
mov dh, 0x11
pushfd
sbb eax, 0xfc409dca
in al, dx
push 0xe9c102bb
dec ecx
xor dword [ecx], esp
sub al, 0xe4
xor eax, 0xaae95c0c
invalid

Function at 0x63c2c0
Capabilities:
Encode data using xor

Disassembly:
xlatb
lahf
xor dword [ebx + 0x22f28c26], edi
movsb byte es:[edi], byte [esi]
fild word [ebx - 0x2ac159ce]
sbb al, 0x69
xor ah, byte [esi + 0x691cd53e]
aaa
invalid
nop
test eax, 0xcb84fd51
test bl, cl
test bl, cl
xor ah, bh
or cl, dh
pop eax
arpl word [esi + 0x552c280e], cx
out dx, eax
sub byte [0xf2f94813], 0xd6
fild dword [edx - 0x1c]
mov dl, 0x73
cmpsb byte [esi], byte es:[edi]
jl 0x63c2bc
push esi
loop 0x63c28b
jp 0x63c349
das
out dx, eax
ror dword [ebx - 0x4a93410c], 1
xlatb
sub dh, cl
xchg bh, cl
jne 0x63c36d
jl 0x63c280
daa
adc al, 0x8f
test al, 0xa7
cmpsb byte [esi], byte es:[edi]
out dx, eax
aas
mov ch, 0xc6
ret
or al, 0x55
jno 0x63c2f7
jmp 0x4a191254
lcall 0xf51, 0x375fd396
sub eax, 0xfb20210d
sar byte [ebx + 0x65d577b0], cl
std
shr esi, 0xdc
and eax, 0x59ed17e2
sar cl, 0x96
int1
or byte [eax + ecx - 0x26], bl
arpl bx, si
push edx
mov bl, 0x67
invalid