joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d2d5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0041d251
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x41d444
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x41d444
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x41d3f9
jg 0x41d331
test eax, eax
je 0x41d3ef
push 1
push 0x1000
call fcn.00411ace
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x41d354
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x41d3e6
push 0x8000
push ebx
call fcn.0041108b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x41d37d
jg 0x41d378
cmp ecx, 0x1000
jb 0x41d37d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00414f14
add esp, 0x10
cmp eax, 0xffffffff
je 0x41d3c2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x41d378
jl 0x41d3a9
test ecx, ecx
jne 0x41d36a
push dword [ebp - 0xc]
push ebx
call fcn.0041108b
push esi
call fcn.00411b2b
add esp, 0xc
xor ebx, ebx
jmp 0x41d452
cmp byte [edi + 0x24], 0
je 0x41d3d9
cmp dword [edi + 0x20], 5
jne 0x41d3d9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x41d3e4
mov ebx, dword [edi + 0x18]
jmp 0x41d3e6
xor ebx, ebx
push esi
call fcn.00411b2b
pop ecx
jmp 0x41d452
test ecx, ecx
jg 0x41d3bb
jl 0x41d3f9
test eax, eax
jae 0x41d3bb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004160a8
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x41d419
cmp byte [edi + 0x1c], 0
je 0x41d3bb
jmp 0x41d44a
push ebx
call fcn.00410688
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x41d3bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x41d452
cmp byte [edi + 0x1c], 0
je 0x41d44f
mov ebx, dword [edi + 0x18]
jmp 0x41d452
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004160a8
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41ea30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ea5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ea5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10010530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1001053f
pop dword [ebp - 0x1c]
mov eax, 0x1001053f
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xdd474f69
sub dword [ebp - 0x2c], 0x8ef50a1e
mov dword [ebp - 0x28], 0xc65f8507
sub dword [ebp - 0x28], 0x942c38c2
mov dword [ebp - 0x24], 0x872334bc
sub dword [ebp - 0x24], 0x3ad6f08e
mov dword [ebp - 0x20], 0x6459975f
add dword [ebp - 0x20], 0x9ba668a1
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x67e9ccba
sub dword [ebp - 0x2c], 0xf3776364
mov dword [ebp - 0x28], 0x367daad4
sub dword [ebp - 0x28], 0xf511495f
mov dword [ebp - 0x24], 0x646cc49e
sub dword [ebp - 0x24], 0xfd5832
mov dword [ebp - 0x20], 0xc1385f8
sub dword [ebp - 0x20], 0xc1385f8
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xade091c0
add eax, 0x6221bebc
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ded9
push 0
call eax
mov ecx, 0x61a1fade
add ecx, 0x9e5e5713
mov edi, eax
mov edx, 0x3668ff75
sub edx, 0x2665f375
add edx, dword [ebp - 0x1c]
mov esi, 0xb779fba
sub esi, 0xef3f0650
add dword [ebp - 0x14], eax
mov ebx, dword [edx]
sub dword [ebp - 0x18], 0xedaa2cac
xor ebx, esi
add dword [ebp - 0x18], 0x34a11ca4
mov dword [edi], ebx
xor dword [ebp - 8], 0x2a750fec
add edi, 4
add edx, 0xd7c4ec2a
add edx, 0x283b13da
loop 0x10010657
add eax, 0xf12f95dd
sub eax, 0xf12e5b46
mov ebx, eax
add eax, 5
mov ecx, 0xd3665282
sub ecx, 0xc3665282
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001cc10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001cc38
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cc52
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct_ANGLEAXIS_const__
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022930
leave
ret 4

Function at 0x1001ce20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001ce56
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001ceb5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct_ANGLEAXIS_const__
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct_ANGLEAXIS_const__
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct_ANGLEAXIS_const__
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022930
leave
ret 0x10

Function at 0x1001ced0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cefc
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cf2d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cf2b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct_ANGLEAXIS_const__
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cf2d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022930
leave
ret 8
Function at 0x49f62c
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x49f59f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x49f5bd
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x49f61b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x49f602
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x49f60b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x49f615
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x49f5f7
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x49f581
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x49f684
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x49f668
dec eax
je 0x49f65f
sub eax, 3
je 0x49f656
mov dword [ebp - 4], 0x40
jmp 0x49f685
mov dword [ebp - 4], 4
jmp 0x49f66b
mov dword [ebp - 4], 0x20
jmp 0x49f66b
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x49f6b7
invalid
xor cl, byte [ebx - 0xab7b]
inc dword [ecx]
inc ebp
or byte [edi + 0x3b], al
mov ebp, 0xffffff74
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x49f637
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0049eec8
cmc
js 0x49f6ef
outsd dx, dword [esi]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x49f6c3
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
fiadd dword [eax - 0x3505b]
inc dword [eax]
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0049eed8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0049ee8d
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
invalid
invalid
int 0xfc
Function at 0x40b8a8
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004050f0
mov eax, dword [0x40f440]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x40ffa4]
mov dword [ebp - 4], eax
jae 0x40b9eb
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x40ffc0]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x40b9eb
push 1
push esi
push ebx
call fcn.00408132
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x40b9f5
push 2
push esi
push ebx
call fcn.00408132
add esp, 0xc
cmp eax, 0xffffffff
je 0x40b9f5
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x40b995
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00408c00
push 0x8000
push ebx
call fcn.0040ba04
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x40b954
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.00407744
add esp, 0xc
cmp eax, 0xffffffff
je 0x40b972
sub edi, eax
test edi, edi
jg 0x40b949
jmp 0x40b988
cmp dword [0x40fb44], 5
jne 0x40b985
mov dword [0x40fb40], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.0040ba04
pop ecx
pop ecx
jmp 0x40b9d5
jge 0x40b9d5
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00408132
push ebx
call fcn.0040aaec
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x40b9d5
mov dword [0x40fb40], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x40fb44], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.00408132
add esp, 0xc
mov eax, esi
pop edi
jmp 0x40b9f8
mov dword [0x40fb40], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.00404bac
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x5200d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xda000]
push edi
or ebp, 0xffffffff
jmp 0x5200f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5200f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5200e8
mov eax, 1
add ebx, ebx
jne 0x52010b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52011c
jne 0x52013b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52013b
dec eax
add ebx, ebx
jne 0x520128
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x520100
add ebx, ebx
jne 0x520137
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52018d
xor ecx, ecx
sub eax, 3
jb 0x520153
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5201c2
sar eax, 1
mov ebp, eax
jmp 0x52015e
add ebx, ebx
jne 0x52015e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52012c
inc ecx
add ebx, ebx
jne 0x52016c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52012c
add ebx, ebx
jne 0x520179
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52016e
jne 0x52018a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52016e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5201ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52019e
jmp 0x5200ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5201ac
add edi, ecx
jmp 0x5200ee
pop esi
mov edi, esi
mov ecx, 0x2209
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5201ca
cmp byte [edi], 0xa
jne 0x5201ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5201cf
lea edi, [esi + 0x11c000]
mov eax, dword [edi]
or eax, eax
je 0x520247
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x167c68]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x167e44]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5201fc
mov ecx, edi
jns 0x52022b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x167e4c]
or eax, eax
je 0x520241
mov dword [ebx], eax
add ebx, 4
jmp 0x520219
call dword [esi + 0x167e48]
mov ebp, dword [esi + 0x167e50]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52027b
sub esp, 0xffffff80
jmp 0x430be6
Function at 0x492578
Capabilities:
Encode data using xor

Disassembly:
out dx, al
popfd
sub eax, 0x7a5d053d
sbb al, ch
sbb byte [ebp - 0x3d3e9b85], al
invalid

Function at 0x4c02e8
Capabilities:
Encode data using xor

Disassembly:
add ebp, dword [ebp + 0x26814604]
and dh, byte [ebx + 0x34]
ffree st(4)
cmp ah, byte [edx - 0x7e]
mov edi, 0x4893af1f
lodsd eax, dword [esi]
add al, 0x46
and dword [esi], 0xdd347322
les edi, [edx]
bound eax, qword [edx - 0x6c50e041]
dec eax
xchg dword [ebp + ebx*4 - 0x629f72d6], edx
mov cl, 0x6e
shr byte [0x69fe9d60], cl
add dword [esi + ebp*8], eax
xchg ecx, eax
stosd dword es:[edi], eax
loope 0x4c02d3
invalid
push 0xffffffffffffffe3
jmp 0x5d19096
or ecx, edi
adc edi, ecx
inc edx
fsubr dword [ecx - 0x535ec6a]
jcxz 0x4c0287
mov byte [0x96900260], al
dec ebp
jae 0x4c0286
frstor dword es:[ecx - 0x1f]
push es
insb byte es:[edi], dx
xchg ebx, eax
push ss
out 0x41, al
iretd

Function at 0x4c97de
Capabilities:
Encode data using xor

Disassembly:
rol al, 1
out dx, eax
lds ebp, [ebx]
retf 0x1f01
je 0x4c96aa
xchg edi, eax
arpl word [eax - 0x40], bx
mov cl, 0x3f
pop ss
into
aas
push edi
xor cl, bh
ret 0x800a
mov word [edx - 0x4a3f22dd], es
ja 0x4c9701
xchg ebx, eax
retf
std
shl byte [edx], cl
popal
stosd dword es:[edi], eax
jecxz 0x4c974c
add eax, 0xcbf495c5
retf
xchg ebx, eax
out dx, eax
mov bh, 0xd2
adc al, 0xa9
add byte [eax], cl
add ecx, dword [0x1f2114c7]
jb 0x4c979f
invalid
rcr dword [ebp - 0x2a], 0xf4
push edx
mov al, 0x69
cmc
push esp
and byte [eax - 0xe5f04b2], cl
rcl dword [ecx + 0x5620537a], cl
or al, 8
push edx
out 3, eax
in eax, 0xc9
jb 0x4c9860
mov ebp, 0x9741856b
inc ebx
fsubr dword [ebp - 0x77123075]
sti
aad 0x97
sal byte [edx - 0x48a23c1d], cl
jl 0x4c9836
test al, 0xc7
inc esi
loopne 0x4c97b7
or eax, 0xaa5883fd
or al, 0xe9
fldcw word [esp + ecx*4]
jmp 0x4c9888
mov bh, 0x53
push ebx
xlatb
salc
ret
popal
push ebp
mov ebx, 0x3c7593e3
or eax, 0xa86d4487
jecxz 0x4c98c6
mov eax, 0xd3965913
arpl word [edx - 0x19a23df9], si
ja 0x4c98f4
inc ebx
sar dword [ebp + 0x5b], cl
movsb byte es:[edi], byte [esi]
adc ebx, dword [edi - 0x30a71b5c]
jl 0x4c988b
add al, byte [eax - 0x5163130b]
xor ch, 0xec
in al, dx
pushfd
scasb al, byte es:[edi]
aaa
enter 0xffffffffffff9887, 0x7e
arpl di, cx
ret
jae 0x4c9925
lodsb al, byte [esi]
or dl, byte [edx]
cmp eax, 0xbc74e67e
rcl dword [esi + 0x73], 0x2e
invalid
adc bh, byte [ecx]
ret
jmp 0x4c993d
Function at 0x4cbcbd
Capabilities:
Encode data using xor

Disassembly:
or dword [ebx], esi
push ebp
fcomp st(0)
popfd
call 0xaedcf4ac
inc eax
cmp ecx, esp
push ecx
and esi, ecx
sbb ebp, dword [esp + edx*2 - 0x58caebdb]
pop es
add al, 0x7b
sub ebp, dword [ebp + 0x24]
wait
inc eax
lodsd eax, dword [esi]
sbb eax, 0x872697fc
test al, 0xa7
inc ebp
movsd dword es:[edi], dword [esi]
xchg ebp, eax
scasd eax, dword es:[edi]
pop es
lodsd eax, dword [esi]
inc esp
mov byte [eax], 0xfd
invalid
xor ebp, 0x32
push ebx
out 0xf8, eax
or cl, ch
cdq
jecxz 0x4cbbf5
pop ebp
pushfd
ret 0x61c5
scasb al, byte es:[edi]
and dword [edi], ebp
pop esp
or eax, 0x4992bc6a
mov ebp, 0xd6cae234
invalid
mov ebx, dword [ebp + 0x3dbbced3]
in eax, dx
xor al, 0xa3
mov al, byte [0xdd73a24]
fcom qword [edi]
ret 0xc62d
dec edi
leave
dec esp
or al, 0x91
call 0x13eda81b
mov dword [0xdbfc015e], eax
scasd eax, dword es:[edi]
dec edi
invalid
js 0x4cbc42
jge 0x4cbc73
fdiv qword [0x5bcdbba3]
xor eax, 0x5bcdbba3
je 0x4cbd3c
popfd
sub eax, dword [ecx - 0x39]
xor sp, bp
enter 0x733c, 8
jg 0x4cbcc2
cmp ch, byte [eax]
sbb byte [0xa335436b], 0xd1
sbb ah, 0x6c
push edx
jne 0x4cbc84
arpl di, sp
rcr eax, 1
leave
mul byte [ecx + 0x1f25ecdd]
add dword [eax], edx
add dword [esi], ebx
in al, dx
ror dword [edx], cl
xchg bh, cl
xchg byte [0xb2315195], al
fisubr word [eax]
add al, 0xac
jecxz 0x4cbca2
invalid
ret 0x6808

Function at 0x515e70
Capabilities:
Encode data using xor

Disassembly:
retf 0xb858
in eax, dx
jg 0x515e5b
xor dword [edi - 0x4c8ffe81], edx
xchg edx, eax
dec dword [esi]
xchg ecx, eax
and dh, byte [ecx]
add bh, byte [ecx - 2]
cdq
sbb ch, byte [esi]
invalid