joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4550f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x45524a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0043a630
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x45521c
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x4551a3
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x45520f
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x4551da
mov eax, dword [eax]
cmp eax, ecx
je 0x4551d2
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x45520f
cmp ebx, eax
je 0x4551ec
nop
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x455225
cmp ebx, eax
jne 0x4551e0
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x455152
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x45520f
push 0x594ffc
call fcn.00502543
int3
Function at 0x455260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x10], ebx
mov eax, esi
shl eax, cl
push edi
cmp edx, eax
ja 0x4553e0
lea eax, [edx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 4], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.0043a810
mov ecx, dword [ebp - 4]
lea eax, [esi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov eax, edi
cmp edi, ecx
je 0x4553b8
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov eax, dword [eax]
mov ebx, dword [edx + 0x10]
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
jb 0x4552e1
mov esi, dword [edx]
mov dword [ebp - 8], esi
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ebp - 0xc], edx
jbe 0x45530a
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx esi, byte [edx + ecx]
inc edx
xor esi, ebx
imul ebx, esi, 0x1000193
cmp edx, eax
jb 0x4552f3
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
and ebx, dword [edx + 0x18]
mov edx, dword [edx + 0xc]
lea edx, [edx + ebx*8]
mov dword [ebp - 8], edx
cmp dword [edx], ecx
jne 0x455327
mov dword [edx], edi
mov dword [edx + 4], edi
jmp 0x4553ae
mov esi, dword [edx + 4]
lea ebx, [edi + 8]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00433b80
add esp, 8
test al, al
je 0x455367
mov ecx, dword [esi]
mov eax, dword [ebp + 8]
cmp ecx, edi
je 0x45535f
mov ebx, dword [edi + 4]
mov dword [ebx], eax
mov esi, dword [eax + 4]
mov dword [esi], ecx
mov edx, dword [ecx + 4]
mov dword [edx], edi
mov dword [ecx + 4], esi
mov dword [eax + 4], ebx
mov dword [edi + 4], edx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], edi
jmp 0x4553ab
mov eax, dword [ebp - 8]
cmp dword [eax], esi
je 0x45538b
nop
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00433b80
add esp, 8
test al, al
jne 0x4553c1
mov eax, dword [ebp - 8]
cmp dword [eax], esi
jne 0x455370
mov ebx, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov edx, dword [eax + 4]
mov dword [edx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov dword [esi + 4], edx
mov dword [eax + 4], ebx
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
mov edi, eax
cmp eax, ecx
jne 0x4552c5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x4553ab
push 0x594ffc
call fcn.00502543
int3
Function at 0x456557
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x5531f8]
test eax, eax
je 0x456596
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x456596
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x456596
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x456596
cmp dword [ecx + 0x74], 0xe
jbe 0x456596
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x45d250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a5a5
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 0xc], 0
lea eax, [esi + 8]
mov edx, dword [ebp + 8]
mov dword [esi], 0x42ff0000
mov dword [esi + 0x10], 0
mov dword [eax], 0
mov dword [esi + 0x28], eax
lea eax, [esi + 0x30]
mov dword [esi + 0x2c], eax
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x30], edx
mov dword [eax], 0
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
je 0x45d3f8
xor ecx, ecx
test eax, eax
jle 0x45d3c9
mov ebx, eax
nop
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + ecx*8]
mov eax, dword [eax + ecx*8 + 4]
mov dword [ebp - 0x38], edi
cmp edi, 0x80000000
jne 0x45d31c
cmp eax, 0x7fffffff
je 0x45d348
cmp edi, 0x80000000
mov edx, eax
cmovne edx, eax
test edi, edi
js 0x45d413
cmp edi, eax
jge 0x45d413
mov edi, dword [ebp - 0x30]
mov eax, dword [edi + 0x28]
cmp edx, dword [eax + ecx*4]
jg 0x45d413
jmp 0x45d34b
mov edi, dword [ebp - 0x30]
inc ecx
cmp ecx, ebx
jl 0x45d300
push edi
mov ecx, esi
call fcn.0044daf0
mov eax, ebx
xor ecx, ecx
mov ebx, dword [ebp + 0xc]
nop
mov edx, dword [ebx + ecx*8]
mov edi, dword [ebx + ecx*8 + 4]
mov dword [ebp - 0x38], edx
cmp edx, 0x80000000
jne 0x45d37a
cmp edi, 0x7fffffff
je 0x45d3c2
mov eax, dword [esi + 0x28]
cmp edx, 0x80000000
mov ebx, edi
cmovne ebx, edi
lea eax, [eax + ecx*4]
mov dword [ebp - 0x34], eax
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, edi
cmovne eax, edi
test edx, edx
jne 0x45d3a3
mov eax, ebx
cmp edi, dword [ebp - 0x30]
je 0x45d3bc
mov edi, dword [ebp - 0x34]
sub eax, edx
mov dword [edi], eax
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + ecx*4]
imul eax, edx
add dword [esi + 0x10], eax
or dword [esi], 0x8000
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2c]
inc ecx
cmp ecx, eax
jl 0x45d360
jmp 0x45d3d1
push edx
mov ecx, esi
call fcn.0044daf0
mov ecx, esi
call fcn.0045f720
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004560fd
mov esp, ebp
pop ebp
ret 8
push 0x554df0
lea ecx, [ebp - 0x28]
call fcn.00435eb0
mov dword [ebp - 4], 0
push 0x1ff
jmp 0x45d42c
push 0x554df8
lea ecx, [ebp - 0x28]
call fcn.00435eb0
mov dword [ebp - 4], 1
push 0x203
push 0x554998
push 0x59f4f8
lea eax, [ebp - 0x28]
push eax
push 0xffffff29
call fcn.004765a0
int3
Function at 0x464490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b0a5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x10]
lea ecx, [esi + 8]
mov eax, edi
mov dword [esi + 0x18], 0
and eax, 0xfff
mov dword [esi + 0x1c], 0
add eax, 0x42ff0000
mov dword [esi + 4], 2
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea eax, [esi + 0x30]
mov dword [esi + 0x28], ecx
mov ecx, esi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
call fcn.0044dc90
test eax, eax
je 0x464536
cmp dword [esi + 0x10], 0
je 0x4645eb
mov ebx, dword [ebp + 0x18]
mov ecx, edi
and ecx, 7
sar edi, 3
shl ecx, 2
mov eax, 0x28442211
sar eax, cl
and edi, 0x1ff
and eax, 0xf
inc edi
imul edi, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0xc]
imul eax, edi
mov dword [ebp - 0x30], eax
test ebx, ebx
jne 0x4645b2
mov ebx, eax
mov eax, dword [esi + 0x2c]
mov dword [eax], ebx
mov eax, dword [esi + 0x2c]
mov dword [eax + 4], edi
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0x14]
imul edx, ebx
add ecx, edx
mov dword [esi + 0x1c], ecx
sub ecx, ebx
add ecx, dword [ebp - 0x30]
mov dword [esi + 0x18], ecx
mov ecx, esi
call fcn.0045f720
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004560fd
mov esp, ebp
pop ebp
ret 0x14
xor edx, edx
mov eax, ebx
div dword [ebp - 0x2c]
test edx, edx
je 0x46456a
push 0x59f528
lea ecx, [ebp - 0x28]
call fcn.00435eb0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x28]
push 0x25b
push 0x5539b0
push 0x59f4f8
push eax
push 0xfffffffffffffff3
call fcn.004765a0
push 0x59f508
lea ecx, [ebp - 0x28]
call fcn.00435eb0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 0x24d
push 0x5539b0
push 0x59f4f8
push eax
push 0xffffff29
call fcn.004765a0
int3

Function at 0x472470
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
movss xmm0, dword [ebp + 8]
movss dword [ebp + 8], xmm0
mov edx, dword [ebp + 8]
and edx, 0x80000000
push esi
mov esi, edx
xor esi, dword [ebp + 8]
mov dword [ebp + 8], esi
cmp esi, 0x47800000
jb 0x4724bc
mov eax, 0x7f800000
cmp eax, esi
pop esi
sbb eax, eax
shr edx, 0x10
and eax, 0x200
add eax, 0x7c00
movzx eax, ax
or edx, eax
mov eax, ecx
mov word [ecx], dx
pop ebp
ret 4
cmp esi, 0x38800000
jae 0x4724e9
movss xmm0, dword [ebp + 8]
addss xmm0, dword [0x557370]
shr edx, 0x10
pop esi
movss dword [ebp + 8], xmm0
movzx eax, word [ebp + 8]
or edx, eax
mov eax, ecx
mov word [ecx], dx
pop ebp
ret 4
mov eax, esi
shr edx, 0x10
shr eax, 0xd
and eax, 1
add eax, 0xc8000fff
add eax, esi
shr eax, 0xd
movzx eax, ax
or edx, eax
mov eax, ecx
mov word [ecx], dx
pop esi
pop ebp
ret 4
Function at 0x4ff380
Capabilities:
Encode data using xor

Disassembly:
pop ebp
sub al, 0x46
xor dword [ecx], 0x431acb14
hlt
mov edi, 0xb5260e1b
fadd dword [edx]
xchg esp, eax
mov dh, byte [edx - 0x2264bec]
xor byte [edi - 0x7a76ddb1], ch
mov eax, dword [0xdc3dfebb]
test dword [ecx - 0x23c20145], esp
or edi, ebx
outsd dx, dword [esi]
aaa
push ebx
les ecx, [esi]
jns 0x4ff2d6
enter 0xffffffffffffe2f0, 0xffffffffffffffc0
loop 0x4ff2bc
mov ch, 0x5a
sub dword [ecx + 0x488872c3], 0xffffff81
mov esi, 0x163fdb35
das
jle 0x4ff304
cmp dword [esi + 0x163fdb35], 0x96f77e2f
xchg esi, eax
mov gs, word [ebp + 0x11]
xor dword [edi + 0x47], esi
mov ch, 0x62
dec esp
xchg esp, eax
inc esi
jge 0x4ff2fa
ffreep st(5)
sbb ah, byte [ecx - 0x12]
lds ebx, [edx]
popal
out dx, al
inc edx
xor byte [0x3c3e253d], al
pop esp
sbb dl, ch
jns 0x4ff2de
jp 0x4ff31a
idiv ah
xor dword [ebx + 0x7a66e190], esp
mov bl, 0x26
scasd eax, dword es:[edi]
jp 0x4ff2e9
scasd eax, dword es:[edi]
push 0xffffffffffffffb7
mov edi, 0x9a2e82ef
xor dl, byte [0x1080e4db]
iretd
sbb dh, bh
sbb al, 0x62
inc ebp
push cs
lahf
sbb eax, 0x2185a0e1
lodsd eax, dword [esi]
sub dword [ebx + 0x66d10e0d], 0xffffffc7
mov eax, ebx
jg 0x4ff334
invalid
push 0xffffffffffffff8a
push edi
pop ds
jp 0x4ff3a9
invalid
jp 0x4ff3a5
mov dword [edx + 0x754e7ba8], ecx
lodsb al, byte [esi]
cmp byte [edx], ah
push 0x465057b3
mov dh, 0x1b
aad 0x92
jns 0x4ff35c
test byte [esi - 0x73], 3
scasd eax, dword es:[edi]
dec edx
inc edi
outsd dx, dword [esi]
aaa
stosd dword es:[edi], eax
cmp dword [edx + edx*4 - 0x70], eax
pushal
mov cl, 0x72
loope 0x4ff369
scasd eax, dword es:[edi]
out 0x60, al
jmp 0x4ff349
enter 0x1607, 0xffffffffffffffbc
lodsb al, byte [esi]
nop
outsd dx, dword [esi]
fbstp tbyte [edx + 0x40]
enter 0xffffffffffff92cb, 0x22
inc eax
jae 0x4ff401
or al, 0x74
xor eax, 0x805687bd
fidiv dword [eax + 0x56]
adc eax, 0xec0835b2
or ah, ch
sbb bl, byte [edx]
push 0xffffffffffffffcb
xor bh, 0x2d
wait
push edx
idiv byte [ebp + 0x674b0886]
sbb al, 0xbe
jno 0x4ff3c3
sub al, 0x3a
loopne 0x4ff393
cmpsb byte [esi], byte es:[edi]
ror byte [ebp + 0x77d560fd], 0x19
mov gs, esi
push edx
mov ds, word [ecx]
test al, 0xd3
iretd
sti
enter 0xcf0, 0x74
sbb byte [ebp + 0xedf9fe2], dl
jmp 0xc00bafeb

Function at 0x502563
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
push edx
xor ebp, esi
mov esi, 0xa2a1c65
insb byte es:[edi], dx
add byte [eax - 0x38f84a9c], ch
cmp dword [esi + 0x1e], 0x9dd67aac
dec edx
xchg esp, eax
Function at 0x401e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e07c]
jne 0x401e1f
repz ret
jmp fcn.00402b82

Function at 0x40845a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43e07c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405f0d
and dword [ebp - 0x14], 0
cmp dword [0x4417ac], 0
mov dword [ebp - 0x18], eax
jne 0x40850d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4085b5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4085b5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4417ac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4417b0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4417b4], eax
call edi
push eax
call esi
mov dword [0x4417bc], eax
test eax, eax
je 0x40850d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4417b8], eax
mov eax, dword [0x4417b8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408566
cmp dword [0x4417bc], ecx
je 0x408566
push eax
call esi
push dword [0x4417bc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408566
test ebx, ebx
je 0x408566
call edi
test eax, eax
je 0x40855d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40855d
test byte [ebp - 8], 1
jne 0x408566
or dword [ebp + 0x10], 0x200000
jmp 0x408599
mov eax, dword [0x4417b0]
cmp eax, dword [ebp - 0x18]
je 0x408599
push eax
call esi
test eax, eax
je 0x408599
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408599
mov eax, dword [0x4417b4]
cmp eax, dword [ebp - 0x18]
je 0x408599
push eax
call esi
test eax, eax
je 0x408599
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4417ac]
call esi
test eax, eax
je 0x4085b5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4085b7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401e15
leave
ret
Function at 0x4a7a54
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x93
lea ebx, [esi + 0x44]
mov ebx, 0x789aa99e
aaa
cmp al, 0xa5
xor al, 0x59
mov al, byte [0x33a78610]
sbb esi, dword [edi - 0x3d]
cmpsd dword [esi], dword es:[edi]
xor esi, ebx
sbb esi, dword [edi - 0x3d]
clc
inc esp
or dword [ebx + 0x58], ebx
mov bh, 0x1c
outsd dx, dword [esi]
call 0x1f060147
ja 0x4a7a80
or byte [eax], al
inc byte [edi + 0x63]
dec esp
mov ch, 0x3d
arpl word [ebp + esi*4 + 0x3d], cx
test al, 0x78
loopne 0x4a7a85
js 0x4a7a67
std
imul eax, dword [edi + eax], 7
inc ebp
sub ebx, dword [0xef17f3dd]
idiv dword [ebx]
ja 0x4a7ae3
xor byte [ecx], al
cmpsd dword [esi], dword es:[edi]
dec esi
outsd dx, dword [esi]
add dword [ebp - 0x58df3e2b], esi
cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
jnp 0x4a7b1e
mov dh, 0x3e
or bh, bl
cld
pop ebx
mov al, 0xb2
dec eax
or dl, byte [ecx + edi]
jmp 0xc1eeca62
sub esp, dword [edx]
jp 0x4a7aa1
add ch, byte [edx]
sbb edx, dword [esi - 0x4e]
mov dh, 0xa2
push ebx
sub ah, byte [eax - 0x1f]
or al, 0xca
out 0x4f, al
xchg esi, eax
xor eax, 0xec11995f
shr byte [ebp - 0x45], 0xb3
repe scasd eax, dword es:[edi]
pop ds
aas
in al, dx
movsb byte es:[edi], byte [esi]
scasd eax, dword es:[edi]
or bh, byte [ecx - 0x17]
jo 0x4a7aef
mov esi, 0xcb69fa24
sti
cmp byte [edi - 0x43e4ad0c], al
push edx
xor byte [esi], 0xb8
movsb byte es:[edi], byte [esi]
or al, 0x30
lcall 0x6da4, 0x60a9436a
xor byte [esi], dh
lcall 0x6da4, 0x60a9436a
push es
into
call 0x15b0d6a6
neg dword [ecx + 0x67]
push ss
pop esi
dec ebx
dec eax
fidivr word [eax - 0x58a2c248]
cmpsd dword [esi], dword es:[edi]
sub ah, byte [edx - 0x5f02e24b]
jl 0x4a7b3b
adc byte [ebp + 0x47e747f7], bl
mov ss, word [ebx + 0x50]
or eax, 0xffffffdb
rcr byte [eax + 0x64], 0x57
invalid

Function at 0x4abb94
Capabilities:
Encode data using xor

Disassembly:
nop
jmp 0x3ab3c8b9
call 0x13a9966f
pop edi
pop ds
inc ecx
dec esi
and dword [edx], esp
mov ebp, 0x9c5874a1
or eax, 0xf99e4505
invalid
rcr dl, 0x7e
imul ebx, ebp, 9
jle 0x4abbf1
fisttp qword [ecx]
mov eax, es
adc dword [0xff903b91], ebx
out 0x8c, eax
imul eax, dword [ecx - 0x75], 0xffffff81
mov eax, dword [ecx + 0xff8853]
push edi
test eax, 0x76a6f645
xor eax, 0x7587cd4a
fist dword [esi - 0x4ddaa196]
cld
arpl word [ebx + 0x14], di
je 0x4abb82
xlatb
jecxz 0x4abb5d
int1
pop ds
cmpsd dword [esi], dword es:[edi]
inc edi
add ebx, dword [edx + ebx - 0x365f6d7d]
jle 0x4abb45
sbb al, byte [ebx + 0x7ec9a092]
sub dword [ebp + 0x4b5a03b8], 0xffffff9c
lodsd eax, dword [esi]
mov eax, 0x9c4b5a03
aam 0x44
mov ebx, 0x620bb8c6
fnstsw word [edx + 0xfc40b0e]
call 0x41b51c5
int3
lodsd eax, dword [esi]
cmc
wait
push ecx
fdivr qword [esi + 0x4c72d296]
mov ah, 8
lds ebx, [edi]
mov eax, 0x1d930a7e
cmp byte [edi + 0x3e], bl
rol ch, 0xc7
pop ds
jb 0x4abbbb
dec esp
xchg ebp, eax
xor byte [esi + 0x5a39a309], 0xce
test al, 0x8d
and ebp, dword [edi]
aas
invalid
Function at 0x4bfbcc
Capabilities:
Encode data using xor

Disassembly:
enter 0xffffffffffffc335, 0x4c
bound edx, qword [esi - 0x19bee8af]
out 0xb1, al
invalid
invalid
push edx
xchg byte [edi], dh
fcom dword [esi - 0xbd0e1f9]
xor bh, al
stosd dword es:[edi], eax
int 5
ficom word [eax + ebx*4 - 0x31f3013d]
cli
cmp bh, byte [esi + 0x2af24785]
daa
sub ah, byte [edi]
cwde
jmp 0x4bfb26
pop es
mov cl, 0x22
inc ecx
xchg ebx, eax
stc
loop 0x4bfb74
fisubr dword [edx - 0x45399971]
xor eax, dword [edi - 0x7d256393]
aas
add dword [ebp - 4], eax
cld
inc ebx
pushal
adc dh, byte [eax + edi*2]
js 0x4bfbb0
invalid
js 0x4bfbb0
mov edi, 0xea27c30
xor byte [edx + 0xe], bh
sub dword [edx + 0x5d], edi
cmc
sbb al, 0xc7
mov ch, 0x6f
jecxz 0x4bfbc7
sahf
mov ah, 0x17
fadd dword [ebp - 0x6afed7b2]
std
sub ch, byte [esi]
cli
mov dword [edi], ebp
in al, dx
add eax, 0xd07631ad
jle 0x4bfc3a
shl byte [edi + 0x25], 1
bnd jbe 0x4bfc43
out 0xa6, eax
enter 0xffffffffffffebb5, 0x44
pop ss
shl byte [edi], 0x8a
invalid
invalid
cmp dh, byte [ebp + 0x69ded81f]
sbb ebx, dword [ebx + 0x694aa87]
stosb byte es:[edi], al
xchg esp, eax
push es
insd dword es:[edi], dx
push ebx
jne 0x4bfbee
xchg edi, eax
push ebp
mov ch, 0x51
outsd dx, dword [esi]
xor bh, byte [eax + 0x2d2d6d62]
mov eax, 0x2d2d6d62
jecxz 0x4bfc17
loope sym.RikEKonc.exe__Dbgrideh_TColumnEh_GetKeykList_qqrv
mov edx, dword [eax + 0x1c]
invalid
into
dec edi
invalid

Function at 0x4c3ba4
Capabilities:
Encode data using xor

Disassembly:
sbb ah, byte [edi - 0x47]
or byte [edi + 0x6dd159b7], bh
insd dword es:[edi], dx
pushal
dec bx
invalid
mov cl, 0xfa
insd dword es:[edi], dx
push ebx
test byte [ecx + edi + 0x7cd3a648], ch
fistp word [0x86cd9d0]
sbb ebp, dword [eax + 0x5165a3d4]
test byte [eax + 0x30], bh
jg 0x4c3b3f
hlt
jae 0x4c3b56
adc edi, dword [ebp + ebp - 0x62f76d1d]
ja 0x4c3b47
push eax
xchg ecx, eax
mov ah, 0x5a
cmp eax, 0xa9f0b48d
adc eax, 0x93e15209
push 0x54
sbb al, 0x16
fdiv dword [ebx]
imul ecx, dword [eax - 0x14], 0x70321296
or bh, ch
daa
or eax, 0x31b1ec72
test dh, bh
sub eax, 0x6ef8002e
aas
or esi, dword [esi]
pop esi
shl byte [ebp - 0x3934669f], 0x3c
dec edx
push es
add byte [ebp + ebp + 0x63], cl
mov dword [esi - 0x329208b7], edx
lodsd eax, dword [esi]
lodsb al, byte [esi]
invalid