joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409783
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x2ddfda65
jmp 0x4097c0
mov ebx, 0xbd2a8948
lds ecx, [edi + 0x33]
cmc
mov cl, 0xc
sar cl, 0x13
mov bh, 0xa2
fldenv [ecx - 0x59]
in al, 0xc8
mov ch, 0x52
mov ebp, 0xaa1941b1
rcl esi, cl
adc edi, dword [ebx + 0x47]
push ecx
pop edi
mov dword [0x92d45a17], eax
test byte [eax], al
sbb edx, dword [edi - 0x60]
fisttp word [ecx - 0x24d9544]
mov eax, dword [0xc2893355]
mov byte [ebx + 0x3155b3a5], dh
imul ebp, dword [ebx], 0x13
mov bl, 0x55
xor ebx, esi
imul ebp, dword [ebx], 0x13
inc ebx
adc eax, 0xf08f05bf
rcl dword [edi + 3]
aad 0xc3
and al, 0
jecxz 0x4097ed
test eax, 0x73b58070
arpl word [esi + 0x57e0a5a0], si
cli
push ebp
aam 0xa4
xchg ecx, eax
aad 0xad
jbe 0x40976e
and dword [edi + 0x6524a771], eax
jno 0x409796
and al, 0x65
pop edi
xchg ebp, esi
or al, 0x90
push ecx
jecxz 0x40985e
xchg ebx, eax
scasd eax, dword es:[edi]
jmp 0x409870
mov dword [0x68350461], eax
inc ecx
inc ebx
mov eax, dword [0xd062b3a3]
xor ch, dh
push edi
salc
pop ebx
cmp dword [ebx], esi
or bl, byte [ebp - 0x2d]
ret 0xbced
push eax
inc eax
xchg ecx, eax
pop es
int1
arpl word [esi - 0x68fd59f9], dx
and dword [ecx + eax + 0x3930081], esp
xor eax, 0xdc00edb
inc esi
cmc
inc ebp
sub dword [eax + 0x78], 0x4200603
sub byte [ebp + 0x7135d4bb], al
xchg esp, eax
aam 0x35
jno 0x40981b
dec edx
out 0xc6, al
mov eax, dword [0xba9783f5]
mov byte [edi], al
fld1
inc ecx
inc esi
cmc
push ds
test dword [edi + 0x1d], edi
push edi
adc byte [esi - 0x4b], al
xor dh, byte [eax + 0x45e579b6]
push eax
in al, 0x2c
jne 0x409883
mov eax, dword [0x42cae503]
inc ecx
jnp 0x4098b2
xor dword [edi + ecx*2], edx
int1
sti
inc edi
jg 0x4098a7
outsd dx, dword [esi]
ret

Function at 0x421b63
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebp + 0x33], ebp
cwde
int3
xchg ecx, eax
sub al, byte ds:[eax]
mov edx, 0xf479bdef
mov cl, 0x55
xor eax, 0x58eb0846
dec ecx
xchg byte [ebp + 0x40], bl
lahf
lahf
lodsd eax, dword [esi]
sub byte [edx], dh
jo 0x421bc7
mov ch, 0x73
aad 0x31
pcmpeqb mm3, qword [ecx]
jle 0x421b99
mov edx, 0xd59fc0a7
rol byte ds:[esi - 0x1a5775a], 1
sub al, 0x48
dec edx
lahf
lcall 0x76fd, 0x5d97581c
dec ecx
sbb al, 0x58
xchg edi, eax
pop ebp
std
jbe 0x421be9
jae 0x421b24
and dword [eax], esp
lcall 0xbe68, 0x68f84901
add dword [ecx + 0x721d8334], 0x69
or dword [edi + 0x6c], ebx
xor al, 0x83
sbb eax, 0x5f096972
insb byte es:[edi], dx
aam 0xf
push eax
lea ebx, [0x5cd940fb]
push ebp
jo 0x421bad
or dword [esi - 0x26], ebx
xchg al, ch
xchg ecx, eax
adc bl, dl
or dword [esi + 0x7e], edi
or eax, 0x423dc8c1
push cs
jns 0x421bdc
pop edi
stosb byte es:[edi], al
popal
cmp byte [eax - 0x2c21a517], ch
mov dword [0xe813a5c4], eax
shl dword [ebx - 0x17ec5a3c], cl
insb byte es:[edi], dx
add byte [edi + 0x5a], dl
and eax, 0x6d868cb6
xchg esp, eax
xchg byte [ebp - 0x6c], ch
jmp 0xe157c6e1
Function at 0x422dc3
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, ebx
xchg ebp, ebx
and ebp, dword [ebp - 0x78]
xor al, 0xcd
in eax, 0x80
out 0xc, al
push 0x33
std
cmpsd dword [esi], dword es:[edi]
mov esp, 0xddfcb69c
push esp
and edx, dword [ebp - 0x285a6715]
add al, byte [ebx - 0x88e3c3c]
mov edi, 0x7308a37
in al, 0xef
mov ecx, 0x4ea5816b
xor dh, ah
xor dword [eax], esp
mov esp, 0x32e47f34
xchg dword [eax], ebx
or eax, 0xd7c8822a
rcr dword [edx - 0x457a6fb8], cl
and eax, 0x25b519d5
rcl byte [ebp + 0x31], cl
in eax, 0xac
and al, 0xa0
frstor dword [eax - 0x50a89cdb]
jge 0x422dc2
adc al, 0x95
or al, 0x1b
and al, 0xd2
fdivrp st(2)
sbb dword [ecx - 0x5ff94275], edi
xor ah, byte [ebp - 0x59aa59e7]
pop es
scasd eax, dword es:[edi]
in eax, 0xb6
scasb al, byte es:[edi]
mov edx, 0x52310c25
mov edi, 0x20d64143
mov ecx, 0xb2648379
pop ss
ljmp 0xd351

Function at 0x438803
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
or eax, 0xf9cf225d
imul byte gs:[eax]
lodsd eax, dword [esi]
xchg esp, eax
xor al, 0xec
in al, 0x4a
pop es
add bl, byte [edi - 0x70]
pop ss
movsb byte es:[edi], byte [esi]
sti
cmp dword ss:[edx + 0x71], eax
scasd eax, dword es:[edi]
dec ecx
add ah, byte [ebp + 0x43ff5c6a]
sub dh, byte [esi]
sub al, 0x39
daa
push es
inc esp
and dword [eax + 0x2c], ecx
nop dword [esi + esi + 0x646b4073]
jb 0x438809
invalid

Function at 0x4516c3
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x78e7d1ef
cmpsd dword [esi], dword es:[edi]
push esi
jne 0x451728
pop esp
and edx, dword [ebx - 0x2c]
aaa
and ebx, ebp
jne 0x4516cc
add eax, 0x6c826e60
xchg byte [ecx + 0x7799b553], dh
add al, 0x3f
fldenv [ebp - 0x57380615]
in eax, 0xc4
xor al, 0xba
push esi
inc edx
aaa
lds edx, [esi + 0x55]
dec esp
out dx, al
cmp edx, dword [ebp + 0x57]
sal ebx, 0xe6
out 0x35, eax
cmc
jge 0x45175e
shl dword [esi - 0x5c], 1
pop ebp
stosd dword es:[edi], eax
pushal
push ds
adc al, 0x86
push 0x16
movzx ebp, word [esi + 0x35f717f9]
rol dword [edi], 0xb6
cmpsd dword [esi], dword es:[edi]
jp 0x45176e
jnp 0x45177b
pop edi
loop 0x451751
cmpsd dword [esi], dword es:[edi]
retf
out dx, eax
inc ebp
mov ebp, 0xe212a734
or eax, 0xa63789db
aaa
cmpsb byte [esi], byte es:[edi]
jb 0x4517b3
lahf
lea ebp, [ebx + ecx*2 - 0x3b]
pop ecx
mov bh, 0x9c
cwde
rcr dword [esi], 1
inc esi
pop eax
test dword [0x4dd39386], esi
aad 0x8b
xchg esi, eax
movsb byte es:[edi], byte [esi]
push eax
push ebp
pushal
jno 0x451732
push esp
jmp 0xfffc667c
out 0xae, al
push esi
js 0x4517ae
inc edi
dec ecx
and al, 0xad
invalid
and al, 0x35
sub dword cs:[esp + ebx*8], eax
mov bh, 0x9a
test byte [esi], ah
xor al, 0x19
movzx edi, di
mov bh, 0xff
and esi, 0xffffffe4
mov dh, 0x3f
leave
pop ebp
mov ecx, 0xe4ad7242
xchg ebp, eax
call 0xe7eafea3
lea esp, [edi]
jo 0x451776
adc al, 0x8c
aad 0xcd
rol dword [ecx], 1
fcom st(3)
push ecx
adc bh, byte [ecx - 0x5a]
ljmp 0x17cd
scasb al, byte es:[edi]
mov ecx, 0xf357d557
mov byte [0x696124b4], al
mov byte [0x696124b4], al
ficomp dword [edi]
xchg edi, eax
mov edi, 0x36e5c998
ret 0x64b6
invalid
Function at 0x452a55
Capabilities:
Encode data using xor

Disassembly:
pop edi
mov edi, 0x7de45c25
pop esp
in al, 0x7d
fist dword [edx - 0x55]
xor ch, byte [edx - 0x108e17af]
push edi
mov bh, 0x2d
push esp
in al, dx
jne 0x452a40
pop edx
mov dword [0xe15ba23b], eax
js 0x452a3c
pop ecx
daa
mov esi, 0x42e55f26
pop edi
in eax, 0x42
fist dword [ebx - 0x57]
xor byte [eax - 0x108917af], ch
push edi
mov bh, 0x2d
push esp
in eax, dx
jne 0x452a60
push ebp
mov dword [0xe25ba33a], eax
jnp 0x452a5d
pop eax
and byte [ecx + 0x7ce55f27], bh
in eax, 0x7c
in al, 0x62
wait
xor ch, byte [edx - 0x178f16ad]
push edi
mov ah, 0x2c
pop ebx
out 0x42, al
jecxz 0x452af0
mov eax, dword [0xe759a038]
mov al, byte [0xe57ce759]
jl 0x452a81
bound ebx, qword [ebx]
mov cl, 0x28
push ecx
call 0xae9c1a1c
aaa
scasb al, byte es:[edi]
push edi
out dx, al
ja 0x452a9a
push edi
sub eax, 0xec542db4
jne 0x452a97
pop ebx
mov al, byte [0xe65fa039]
jl 0x452aa1
pop ebp
and al, 0x82
sub edx, dword [edx - 0x16]
jae 0x452aad
mov cl, 0x68
jg 0x452ad6
sbb dword [edi + 0x3a], ebp
dec ebp
adc al, 0x63
cmc
adc byte [edi], 0x66
xor byte [edi + 0x12], al
jb 0x452add
jb 0x452add
adc esp, dword [ebp + 0x2c]
dec edx
sbb eax, 0x1888fd6b
outsd dx, dword [esi]
cmp eax, dword [ebx + 0x17]
imul edi, ebp, 0xffffff88
sbb byte [edi + 0x3b], ch
inc ebx
pop ss
popal
ja 0x452ae9
adc byte [esi + 0x30], ah
inc edi
adc dword [edi - 0xf], esp
xor byte [edi + 0x11], al
int1
test byte [ebx], dl
push 0x3c
adc ebp, dword [edx + 0x3c]
dec edx
sbb al, 0x6b
jge 0x452b00
push ds
imul edi, dword [edi], 0xf96e184e
invalid
sbb dword [edi + 0x3b], ebp
inc ebx
adc eax, 0x10067761
xor bh, byte [bp + si]
sbb al, 0x6a
cld
mov ebx, dword [0x1e483e6b]
push 0x6c19097e
xor al, 0x43
push ss
pushal
test byte [eax + 0x4a5c6417], 0x1d
push 0x6f1f097e
cmp dword [ebx + ebx + 0x6d], ecx
sti
adc byte [esi], 0x61
xor byte [esi + 0x11], al
jb 0x452b3c
adc ebx, dword [edx + 0x3c]
dec ebx
sbb ebp, dword [ebp - 9]
adc dword [edx], 0x1cfa392a
push 0x7d
or ebx, dword [0x1e483e6b]
imul edi, edi, 0x386e1f89
dec esi
sbb byte [esi + 0x79], ch
or al, 0x1a
insb byte es:[edi], dx
cmp ecx, dword [ebp + 0x1b]
insd dword es:[edi], dx
hlt
Function at 0x453139
Capabilities:
Encode data using xor

Disassembly:
pop ebx
js 0x453184
psadbw mm4, qword [ecx + 0x643e7981]
sub eax, 0x66347e25
bound edi, qword [0x6034617e]
cli
and byte [ecx + 0x6c7acdc4], cl
sti
aaa
aaa
enter 0xffffffffffff87ff, 5
and bh, byte ss:[eax + 0x43]
das
cmp eax, 0xb2e5dbe
mov al, byte [0x9c718d67]
jae 0x4531e8
mov word [eax - 0x5c], cs
pop ebp
pop es
adc eax, 0x488d4189
wait
xlatb
hlt
push ds
xlatb
add al, 0x24
invalid
and esp, ebp
push esp
cld
or eax, 0xa7339f9e
xor al, 0x74
cmp bl, byte [ebp + 0x10897f5c]
mov al, byte [0xa307a601]
xchg ecx, eax
salc
aad 0xb2
pop ebx
invalid
sahf
jp 0x453240
push ds
mov ebx, 0x692b5462
shr ah, cl
sbb dword [edi], ebp
sbb al, 0x1b
xchg edi, eax
xchg edi, eax
call 0x82df604a
mov dl, 0xfa
jp 0x4531b3
or al, 0xb5
or eax, 0xf1d00c2
and al, 0xe0
fstp qword [esi + edx*4 + 0x3a]
invalid
clc
mov bh, byte [esi - 0x2e5e6479]
insd dword es:[edi], dx
sub ebx, dword [esi - 0x237e84eb]
or ebx, dword [eax - 0x53bb6594]
push ds
xchg ebp, eax
out dx, al
in al, 0x73
insb byte es:[edi], dx
std
into
jns 0x453281
pop ebp
inc esi
dec ebx
loope 0x453261
mov cl, 0x84
wait
mov esi, ebp
sub bh, byte [edx - 0x6a16d7cf]
popal
cli
inc edx
imul byte [ecx + ecx*2 + 0x6e]
in eax, 0xf
lodsb al, byte [esi]
mov dh, 0x24
aam 0xc7
neg dword [ecx]
dec ebp
int 7
pop es
nop
fist dword [edx + 0x66]
cmpsd dword [esi], dword es:[edi]
int3
Function at 0x4654c3
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x3634303f
aas
xor byte [esi + esi], dh
sti
out dx, al
sub dh, byte [eax - 0x66]
xor byte [eax - 0x3407c43e], dl
clc
cmp byte [edx - 0x23966251], cl
pop esi
pop ss
mov eax, 0x6e9c6f57
push edi
outsd dx, dword [esi]
pushfd
outsb dx, byte [esi]
in al, dx
mov bh, 0x10
jp 0x465426
aad 0x6e
xlatb
mov dh, 0x1f
sub byte [edi - 0x3325d840], cl
clc
outsb dx, byte [esi]
pushfd
push edi
jno 0x465427
dec edx
sar al, 0xf
cmpsb byte [esi], byte es:[edi]
pop ebp
invalid
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
xor eax, 0x607e6cb5
xor al, 0x27
inc ebx
inc ebx
dec edx
cmp dword [edi + 0x21], edi
or al, dh
sbb dword [edi], eax
dec edi
jg 0x46549e
dec ebp
cmp dl, byte [eax]
mov ebx, 0x2f1c9a1a
adc ebx, dword [esi - 0x65]
or ecx, eax
sub eax, 0x515bfee6
or byte [edx - 0x1bcad1d8], al
sub dword [esi], ebp
and al, 0xbf
inc esi
out dx, al
js 0x465480
shr dword [0x515bfee6], 8
sub byte [eax], 0x2e
xor eax, 0x242e29e4
mov edi, 0xca78ee46
cwde
leave
loop 0x465480
inc ecx
push edx
jnp 0x465440
test eax, 0xcd8e9692
xchg edx, eax
mov byte [ebp + ebp + 0x3b], cl
xchg ebp, eax
jbe 0x4654a2
adc ecx, esp
sbb al, 0x1d
push cs
fsubr st(4)
cmp byte [edi], ch
test byte cs:[edi], 0xc0
int 0x7e
lodsd eax, dword [esi]
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
mov al, byte [0x49bc5cc8]
mov bl, 0xba
adc ecx, edx
arpl word [eax - 0x4dff1267], bp
sahf
mov esi, 0xcaf07a9e
salc
call 0xaacd45d7
sar byte [eax], cl
pop ds
fidiv dword [esi + 0x6ee68cae]
inc esp
rcr ch, 0x6c
test dword [edi], edi
out 0x16, al
adc dword [edx - 0x2d], ecx
add dword [ebp - 0x37b8e6bf], 0xffffffb1
test eax, 0x907eec9e
mov es, word [eax - 0x5c54c965]
or dword [eax - 0x72], 0xc6b431da
jp 0x465550
jl 0x465559
insd dword es:[edi], dx
push cs
mov bh, cl
mov byte [ebp - 0x4e9e09ff], ch
stc
shr byte [ebp + 0x287fb7a6], cl
fdivr qword [ecx]
fadd st(1)
pop es
xchg edx, eax
or ah, dh
pop eax
dec ebx
cmp eax, 0x8dbcb8a2
invalid
int 0x52
mov ecx, ecx
retf 0xd8df
fsubr dword [esi - 0xd]
sbb eax, 0x8fb94eb8
das
add edx, dword [esi + 0x5e]
dec eax
mov edx, 0x261d7219
sub cl, byte [esi]
pop eax
push ss
insd dword es:[edi], dx
push cs
adc esp, esi
fistp word [ecx]
push eax
mov ebp, 0xa169ef21
cmp byte [eax + 0x66b8f3d4], ah
sbb eax, 0x1c79509e
in eax, dx
pushal
xlatb
jl 0x465556
adc al, 0x34
daa
cmp cl, byte [eax - 0x4a631055]
mov bh, 0xc7
lea eax, [eax - 0x2c31ed6a]
int 0xb4
jge 0x46556a
adc edx, dword [eax]
pop ds
push esp
sbb esi, dword [edx + 0x350e6d3c]
invalid

Function at 0x465863
Capabilities:
Encode data using xor

Disassembly:
aaa
xchg dword es:[esi + 0x7e84db09], ecx
jle 0x4658c5
jle 0x4658c5
cwde
xor al, bl
xchg ecx, eax
sub byte [ebp + 0x5a], al
aas
jp 0x46585c
pop esp
stc
sub byte [esi + 0x392bf3fc], ch
cmp bh, byte [edx - 0x20]
jno 0x46589a
popal
push ss
test al, 0x74
xchg ecx, eax
mov bh, 0x2e
imul ebx, esp, 0x39
invalid
test dword [eax], esi
int1
push esp
invalid
Function at 0x46b9e2
Capabilities:
Encode data using xor

Disassembly:
jb 0x46b93b
jge 0x46b994
push esi
aad 0xc5
adc dword [ebx + esi*8], esi
adc al, 0xed
cmp al, 0x80
add ah, byte [eax]
sti
fstp dword [ebp + 0x4ba1bd4f]
xchg dh, bl
pop es
pop ebp
mov dl, 0xd1
in eax, dx
pop esp
xchg ecx, eax
mov esp, 0xca5fb7ad
les ebp, [ebx - 0x44]
xchg ebx, eax
sal dword [ecx], cl
imul edi, dword [eax], 0xd24feda4
mov cl, 0x5d
pop eax
scasd eax, dword es:[edi]
mov edx, 0xb4bdc880
add dh, byte [ebp + 0x42f39d6f]
xor eax, 0x884d9174
push ecx
xor byte [ebp + 0x3c7ae568], bl
pop ebx
sub eax, 0x92114339
salc
mov ecx, 0x8cb2fc29
ror esi, cl
rcl byte [esi + 0x31]
fstp st(0)
dec ecx
xchg ecx, eax
ret 0x876a
dec ecx
xor dword [esi - 0x7fe8237a], edi
fistp word [eax + ebx*2 - 0x43]
mov cl, 0xea
loop 0x46b921
pop eax
mov ebp, 0x87e2eab1
jae 0x46b9f9
sbb al, 0x86
mov edi, 0x86fd005a
sub esi, 0x68
mov cl, 0xdb
inc ecx
mov ecx, 0x4a2e4bb5
arpl word fs:[ebp - 0x646ba843], bx
pop eax
leave
int3
aaa
call 0x7798f109
mov bh, 0x8d
mov dl, 9
rep lodsb al, byte [esi]
das
push edx
ja 0x46b97c
lea esi, [edx + 0x2facf309]
push 0xfffffffffffffff2
jbe 0x46b9be
fild word es:[ebp - 0x452e7f00]
jo 0x46b9d3
adc ecx, 0xbffb70ba
mov ebp, 0xb7f2f26
jno 0x46ba3a
mov edi, 0x7f2f26bd
or esi, dword [ecx + 0x5a]
cmp byte [edx - 0x4f], ah
sub eax, 0xeeb76358
fstp xword [ebp - 0x424ae704]
retf 0x104f
mov cl, 0x2d
pop eax
arpl word [edi - 0x3422412], si
sbb byte [ebp + 0x104fcabd], dh
xor bx, word [ebp + 0x1c]
mov ebp, 0x66104fca
xor ebx, dword [ebp + 0x1c]
mov ebp, 0x7b7fca58
jae 0x46b98b
jnp 0x46ba6e
invalid
adc cl, bh
rcl byte [esi + 0x7bd30375]
mov ebp, 0xffdd5646
stosb byte es:[edi], al
xchg ecx, eax
in eax, dx
mov bh, 0x4e
insd dword es:[edi], dx
jp 0x46b9ed
add edx, ebx
jnp 0x46b9c2
inc esi
push esi
invalid
aas
insb byte es:[edi], dx
sbb al, byte [ecx]
mov bl, 0xb8
popfd
and esi, dword [esi - 0x6218529b]
mov esi, 0x333fdbc7
mov bl, 0xbf
cdq
loope 0x46ba01
invalid
fadd st(5), st(0)
sbb esp, dword [ebp - 0x5cb6fbba]
stosb byte es:[edi], al
arpl word [eax - 8], di
dec edx
cmp dword [ebx], ebx
mov al, 0x29
push es
xor al, ah
aaa
or esi, esi
invalid
popfd
shr byte [edi], 0x13
inc esp
add ebp, dword ds:[ecx]
invalid
pop esi
cmpsb byte [esi], byte es:[edi]
jmp 0x46ba60
Function at 0x4967f3
Capabilities:
Encode data using xor

Disassembly:
invalid
clc
out dx, eax
pop ss
xchg ebp, eax
pop es
mov ah, 0x5c
insd dword es:[edi], dx
sub eax, 0x4c3e8128
scasd eax, dword es:[edi]
inc esi
nop
sub bl, ch
jl 0x496834
aad 0xdd
insb byte es:[edi], dx
and al, 0xbd
jl 0x4967a8
stc
ret 0x8c54
push ebx
or dword [edx], 0xffffffc0
lea ebx, [ebp + 0xe]
cmp eax, 0x6900d755
sbb eax, 0xb4d9ef6
pushal
fimul dword [edx + 0x3d67bd1b]
inc esp
dec eax
xlatb
add byte [ecx + 0x1d], ch
neg byte [esi - 0x259ff4b3]
mov bl, byte [ebx]
mov ebp, 0x48443d67
xor al, 0xcd
out dx, eax
jbe 0x496820
cmp eax, 0xdae58d59
add al, 0xa0
xchg ah, cl
push es
loopne 0x496880
in eax, dx
dec ecx
sub eax, 0xeda3164
popal
xor al, byte [esi + 0xcd533e8]
mov ebx, 0xddfbe0fb
cmc
enter 0x6e72, 0x34
pushfd
pop ds
pcmpeqb mm7, qword [ebp - 0x61778aa0]
out 0x39, eax
loop 0x49682a
jl 0x4968ec
test byte [ebp + 0x5e625984], bh
or al, 0x2c
adc esp, esp
cmp eax, 0x8cbcea0d
cmp al, 5
dec ecx
mov esp, 0x49053c8c
adc al, 0x29
test dword [esi + eax*2 - 0x6bc6ee75], ebp
out dx, al
cli
int1
or al, 0x3e
and byte [ecx + 0x3ccb3545], ch
inc ecx
jne 0x4968ed
sbb eax, 0xbe0a3e09
jae 0x4968f6
and dword [ecx], ebx
cmp dword [edi + 0x201e253c], edi
pop ds
rol dword [eax], 0x40
mov eax, 0x8bbeca3
aad 0xb9
test al, 0x9c
js 0x4968eb
xor dword [ecx + 0xc163565], edx
shr byte [ecx + 0x2d], 1
pop es
adc byte [esi + ebp - 0x67ed6181], dh
mov al, 0x60
mov dword [esi], ecx
and eax, 0x40bf2329
mov dword [0x396f6a8c], eax
inc esp
adc al, 0x2d
invalid
sbb byte [ebp - 0x34], ch
cmp eax, 0xf85419ec
sbb ecx, dword [esi]
insd dword es:[edi], dx
int3
push cs
jecxz 0x4968f4
std
in al, dx
in eax, 0x34
cmp al, 0x29
aad 0x81
pop ecx
mov ah, 0x1d
popfd
rol dword [ebx + edi], cl
fldenv [ebx + 0x30231e21]
add al, 0xc8
int1
daa
mov esi, 0x2624be36
and bl, cl
daa
add ch, dh
sbb dword [edi + eax*4], esp
test byte [ebp + ecx*8 + 0x155c3410], ah
dec esi
add edx, ebp
xor esi, edx
sti
mov eax, dword [0x5bb70398]
pop ebp
retf
Function at 0x4aafe3
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x8d1f0073
inc ebx
insb byte es:[edi], dx
outsb dx, byte [esi]
cmp ebx, dword [edi - 0x10f85a65]
mov ebx, 0x1fbc0e8f
nop
add eax, 0x7ebd176f
xchg edx, eax
inc edi
std
pop ss
mov ebp, 0x3647927e
std
dec ebx
sbb bh, byte [edi + 0x1ce937a5]
lea esi, [esi]
sbb al, 0x8d
aas
aas
jne 0x4aaff9
push ss
je 0x4ab018
and byte [edi + 0x25], 0xe4
jns 0x4ab06f
lcall 0xc7bf, 0xc375
in al, 0x5a
enter 0xffffffffffffc6ce, 0xfffffffffffffffc
jbe 0x4ab009
ret
out dx, al
jae 0x4ab006
hlt
lahf
xor al, 0xd2
sub al, 0x19
hlt
inc esi
jg 0x4ab0c8
jnp 0x4ab05c
into
xchg edi, eax
xchg esi, edi
xor cl, byte [ebx - 0x3c8d120a]
loopne 0x4ab087
dec ecx
mov bh, 0x2b
or eax, 0x68e63bee
out 0x68, al
jb 0x4ab08a
call dword [esi]
push ss
sbb bl, byte [ecx + ebx*4]
cmpsb byte [esi], byte es:[edi]
inc esi
cmpsd dword [esi], dword es:[edi]
insb byte es:[edi], dx
sahf
jb 0x4ab0fe
pop edi
or dword [edi - 0x26], esp
shr cl, 0x5e
mov ds, word [esi + 0x79]
mov al, 0x30
xor al, 0x3e
leave
nop
mov word [ecx], es
mov word [eax - 0x68785971], cs
push edi
test dword [edi + 0x77], esi
lodsb al, byte [esi]
lahf
add eax, dword [esi - 0x5a5069e2]
js 0x4ab099
fcmovb st(0), st(0)
jmp 0x79a93efe
loopne 0x4ab089
psadbw mm1, qword [ebp + ebx*8 - 0x1622d811]
int 0x1f
mov edi, 0x27437b60
cmp edi, 0x51
jg 0x4ab08b
ljmp 0x68ad:0x63fc3aa1
cmp al, 0x6a
lodsb al, byte [esi]
cmp eax, 0xd95d902
xor byte [esi], bh
jp 0x4ab138
mov dh, 0xdf
adc al, 0x23
mov dword [edx - 0x3648590e], edi
sub eax, 0x7126491e
out 0x45, al
inc ebx
salc
bswap edx
sbb esi, dword [edx + 0x57]
pop ebx
xor byte [eax], 0xcf
dec eax
mov al, 0xf6
fldenv [esi - 0x2b]
and eax, edx
push es
out 0xe2, eax
dec ebp
pop ebx
cmc
dec edi
cmpsd dword [esi], dword es:[edi]
lodsd eax, dword ds:[esi]
jno 0x4ab154
xchg dword [esi - 0x39], esp
out dx, al
mov dword [0x1603efad], eax
push ss
pop ss
cmp ah, byte es:[ecx + 0x23a063e0]
mov edx, dword [edx]
bound edx, qword [esi - 0x594b517d]
mov ah, 0xa6
mov fs, eax
call dword [ebx]
out 0x47, eax
sbb eax, 0xff51c792
mov ebp, 0x70cbe8e6
call 0xc6122233
pop es
in al, 0xb7
Function at 0x4ac263
Capabilities:
Encode data using xor

Disassembly:
xchg byte ss:[ebp - 0x79e4ca46], bh
les ecx, [ebp - 0xe1d9c1d]
push esi
cmp eax, 0x31084de8
pushal
add al, byte [esi]
mov edx, 0xedd46a0a
stosb byte es:[edi], al
pop esi
salc
jmp 0x4ac2f2
or byte [ecx + 0x3bd0713], 0x85
jno 0x4ac32d
out 0x82, eax
cmp byte [eax], ah
xchg ebp, eax
sti
adc byte [ebx], al
div ecx
test al, 0xf1
fidiv word [eax + 0x39aae2a7]
nop
cmpsd dword [esi], dword es:[edi]
rcr dword [ebp + edx - 0x75], cl
mov al, 0x3c
inc esp
aam 0x79
stosb byte es:[edi], al
cmp dword [eax + 0x155cd3a7], edx
mov esi, dword [eax + 0x79d4443c]
test esp, esi
xor edx, dword [esp + ecx*4 - 0x3c]
in eax, dx
pushfd
mov ah, 0x4c
mov bh, 0x6e
je 0x4ac30c
inc edi
cli
sub dword [esi + 0x41b73652], 0x748eaf56
leave
cmp byte [ecx + eax*2 - 0x75], 0x1f
sub al, 0x13
cmp edx, dword [eax + 0x18]
mov esi, 0x2f50ee38
lahf
call dword [edx - 0xc]
enter 0xa56, 0x24
int 0x6f
push es
dec dword [esi + 0x392428c4]
les ebx, [ebx + 0x55]
push ecx
add eax, 0x5312143d
pop edx
mov cl, 0x3c
dec edx
prefetch byte [esi - 0x574f2cab]
arpl si, di
das
shr dh, 1
push ebx
cmp ch, 0x1a
cwde
sub bh, byte [0xf6294d5d]
jl 0x4ac3f3
mov bh, 0x41
push esi
scasd eax, dword es:[edi]
invalid
sal dword [ebp - 0x6212692f], 0x19
fdiv dword [esi - 0x7e7f268e]
ret 0x2e0a
mov al, byte [0xe1d9b52]
cmp ah, byte [ebx - 0x33]
test esi, ecx
lodsb al, byte [esi]
call 0x9fff7a5d
inc ebx
sbb eax, 0xadadbeff
mov dword [0xaa01f27f], eax
mov ebx, 0x87274f13
popfd
lahf
cdq
hlt
sbb al, 0xb8
out 0x7e, al
push esp
pop ds
mov bh, 0xfc
adc byte [ebx], ah
mov eax, esp
inc eax
lahf
push eax
jae 0x4ac39c
aam 0xc1
nop
pushfd
and byte [esi + ebp*8 - 0x5a79b759], dh
ja 0x4ac3f8
and ebx, dword [edx + edi - 0x5a]
inc ebp
int 0xec
sbb al, 0x60
and eax, dword [edi]
dec eax
imul eax, ecx, 0xffffff8b
aad 0x60
bound eax, qword [ecx - 0x29d5b317]
dec eax
scasb al, byte es:[edi]
outsb dx, byte [esi]
ror dword [eax - 0x6da8d8c7], cl
jo 0x4ac416
sbb ebx, eax
iretd

Function at 0x4adab3
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x5b
shr byte [0x4b08fd3b], 1
xchg esp, eax
and dword es:[esi], ecx
and eax, edi
sub dword [esi - 0x42795c10], edi
insd dword es:[edi], dx
retf
jp 0x4adac1
mov edx, 0x96109240
loop 0x4ada07
pop ebp
sub ecx, dword [0xdf327e08]
xor dl, byte [ecx + 0x4c]
mov ecx, 0xd44ee80b
cmp dword [esp + ebx*8 - 0x27d9ed5c], ebp
popfd
or ax, 0xd564
pop ebx
cmp al, 0x1a
test dword [edx - 0x4b], ecx
wait
push ecx
sbb al, byte [ebp + 0x519bb54a]
popfd
mov dh, 0x1c
xchg ebp, eax
jge 0x4ada95
loopne 0x4adb0a
jmp 0x4ada63
aaa
jno 0x4ada89
sar dword [edx + 0x5ae1c55d], 1
push eax
pop esi
pushal
fst qword [esi]
mov dl, 0x14
aam 0x32
dec esi
insb byte es:[edi], dx
sub dword [0xef65f950], esi
invalid
mov byte [ebp - 0x42], bh
mov dh, 0x21
or eax, 0x3f893247
jno 0x4adb85
push cs
push 0x1fe672ca
fdivr dword cs:[eax - 0x7a66e827]
fidiv dword [edi - 0x5741afce]
pushfd
salc
sal ch, 0x44
or al, 0x9f
or edi, 0x1d
dec edi
ret
Function at 0x4ae997
Capabilities:
Encode data using xor

Disassembly:
dec esi
push es
retf 0x44a5
inc esi
jle 0x4ae979
push edi
xchg ebx, eax
push esi
mov dl, 0x2c
adc ebp, edx
aam 0x1f
or eax, 0x67296db2
add byte [edx + 0x7281ca6f], ah
xor al, 0x64
inc esi
enter 0x3fb2, 0xfffffffffffffff8
mov al, 0x26
js 0x4ae99b
out dx, eax
test byte [0xade3821c], bl
or eax, 0x17daf4be
adc edx, dword [ebx + 0x17]
pop es
fistp qword [eax]
dec esi
mov al, 0xd8
mov eax, 0x129ab95a
mov bl, 0xf7
out 0x76, al
or eax, 0xdd981246
sahf
dec edx
stosb byte es:[edi], al
inc esi
test dword [eax + 7], 0xa10ebd5d
push es
pop edx
pop es
pop ebp
mov ebp, 0x5a06a10e
cmp bh, byte [edx]
adc ebx, dword [edi - 5]
cmp byte [edi - 0x68a1993e], bh
xchg esi, eax
mov bl, 0xb7
sub eax, dword [esi - 0x76]
jp 0x4ae9e2
mov dh, 0xb9
test esp, 0xcb66b6d7
fidivr dword [esi + 0x2ea643f6]
mov byte [eax - 0x295c298b], dh
inc edi
cwde
int3

Function at 0x4bb37d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3338
cmp edx, dword [eax]
je 0x4bb39f
add eax, 8
inc ecx
cmp eax, 0x4c33c8
jl 0x4bb390
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3338]
jne 0x4bb4cd
mov eax, dword [0x4c7cbc]
cmp eax, 1
je 0x4bb4a7
test eax, eax
jne 0x4bb3d0
cmp dword [0x4c3264], 1
je 0x4bb4a7
cmp edx, 0xfc
je 0x4bb4cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb407
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bbd60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc1f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb44a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc1f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c089c
push edi
call fcn.004be0c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bbd60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbd70
lea eax, [ebp - 0xa0]
push 0x4c087c
push eax
call fcn.004bbd70
push dword [esi + 0x4c333c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbd70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be034
add esp, 0x2c
pop edi
jmp 0x4bb4cd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c333c]
push 0
push eax
push dword [esi]
call fcn.004bc1f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret