joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461a15
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00461991
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x461b8d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x461b8d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x461b3c
jg 0x461a6e
test eax, eax
je 0x461b32
push 1
push 0x1000
call fcn.00458568
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x461a94
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x461b29
push 0x8000
push ebx
call fcn.004564c2
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x461ac0
jg 0x461abb
cmp ecx, 0x1000
jb 0x461ac0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00459c42
add esp, 0x10
cmp eax, 0xffffffff
je 0x461b05
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x461abb
jl 0x461aec
test ecx, ecx
jne 0x461aad
push dword [ebp - 0xc]
push ebx
call fcn.004564c2
push esi
call fcn.0045736b
add esp, 0xc
xor edi, edi
jmp 0x461b9e
cmp byte [edi + 0x24], 0
je 0x461b1c
cmp dword [edi + 0x20], 5
jne 0x461b1c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x461b27
mov edi, dword [edi + 0x18]
jmp 0x461b29
xor edi, edi
push esi
call fcn.0045736b
pop ecx
jmp 0x461b9e
test ecx, ecx
jg 0x461afe
jl 0x461b3c
test eax, eax
jae 0x461afe
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00460045
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x461b5f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x461afe
jmp 0x461b96
push ebx
call fcn.0045c489
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x461afe
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x461b9e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x461b9b
mov edi, dword [edi + 0x18]
jmp 0x461b9e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00460045
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403847
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
adc al, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
add dword [eax], eax
cmp ebx, 0x40
jle 0x4038b2
lea eax, [ebp]
add ecx, ecx
mov edx, 0x2c000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff413897
cmp ebx, 0x40
jle 0x403859
add dh, al
mov edx, dword [ebp - 4]
call 0x1403b8f
call fcn.0040d327
adc dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x403843
add bl, bl
jle 0x4038eb
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x85406c83
add byte [ebp - 4], al
call fcn.00406927
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call 0x3f399f
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
jle 0x4038e3
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
sub byte fs:[eax], al
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
into
add cl, ch
ja 0x403926
add byte [eax], al
jmp 0x4038f8
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
cdq
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xcc
lea eax, [ebp - 4]
call fcn.0041397b
mov eax, dword [ebp + 8]
mov ebx, edi
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x4cfc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x2ed3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.00406367
add byte [ecx], al
loopne 0x403977
in eax, dx
pop ds
add bh, ah
add dh, ch
pop ecx
pop ebp
ret
Function at 0x44e487
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
adc al, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
add dword [eax], eax
cmp ebx, 0x40
jle 0x44e4f2
lea eax, [ebp]
add ecx, ecx
mov edx, 0x2c000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff45e4d7
cmp ebx, 0x40
jle 0x44e499
add dh, al
mov edx, dword [ebp - 4]
call 0x144e7cf
call fcn.00457f67
adc dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x44e483
add bl, bl
jle 0x44e52b
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x854518c3
add byte [ebp - 4], al
call fcn.00451567
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0043e5df
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
jle 0x44e523
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
sub byte fs:[eax], al
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
into
add cl, ch
ja 0x44e566
add byte [eax], al
jmp 0x44e538
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
cdq
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xcc
lea eax, [ebp - 4]
call fcn.0045e5bb
mov eax, dword [ebp + 8]
mov ebx, edi
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x4cfc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x2ed3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.00450fa7
add byte [ecx], al
loopne 0x44e5b7
in eax, dx
pop ds
add bh, ah
add dh, ch
pop ecx
pop ebp
ret
Function at 0x4570eb
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
sbb ch, byte cs:[edx - 0x527d525b]
push eax
enter 0xffffffffffffc7b6, 0xffffffffffffffe6
fadd st(0)
dec ecx
xchg edx, eax
test eax, 0x2f10c93c
invalid
stosb byte es:[edi], al
test byte [edx - 0x36a7e77a], 0xb5
sub al, 0xe4
sbb al, 0x87
pop esi
xor al, 0xfb
sbb byte [eax - 0x37], bl
mov ch, 0x2c
in al, 0x1c
xchg dword [esi + 0x34], ebx
sti
test dword [esp + edi*4], edi
insd dword es:[edi], dx
insd dword es:[edi], dx
das
jb 0x456fab
movsd dword es:[edi], dword [esi]
mov eax, 0xad440d17
rcr byte [ebx], 0xd1
adc eax, 0xc110e84
push ecx
xchg ebp, eax
add ecx, dword [eax + edx - 0x73]
popal
dec esp
jo 0x456f5e
sub al, 0x7b
inc eax
dec edx
pop eax
invalid
popfd
xchg ebx, eax
mov cl, 0x56
pop esp
cwde
leave
sti
jnp 0x456faf
push 0x78
add edi, dword [edi + 0x2abf65e8]
pop ds
xor eax, 0x3ef3443e
sbb al, 0x68
cvtps2pi mm3, qword [ecx + 5]
pop esp
hlt
loopne 0x457021
sub byte [ebp - 0x1a], ah
test al, 0xd8
sti
bsr esi, dword [edx - 0x69665c84]
inc ebx
sbb dword [ebx + 0x2ac9d66d], ebp
or edi, dword [ecx + 0x36]
mov eax, 0xb2611b3c
inc edi
sbb eax, 0xcec60fe8
iretd
xor ch, byte [ecx - 0xfeb97da]
sub eax, 0x12ce22bd
sub dword [ebp + 8], esp
adc al, 0x22
pop ebp
jl 0x457027
sahf
cwde
mov dh, cl
dec edx
sar dword [ebx + 0x4cdcbbbe], 1
mov esp, 0x3c428b73
pushal
popal
or eax, 0x712d7f5a
dec esp
pop ebp
pop edi
jae 0x4570ae
loope 0x457060
jecxz 0x457090
cmc
lodsd eax, dword [esi]
add al, 0x9f
imul edx, dword [edi], 0xc88b4a1
pop esi
push dword [esi + 0x6d]
inc eax
invalid
jns 0x457090
add bl, 0x58
clc
ret 0x3942
Function at 0x498f87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
adc al, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
add dword [eax], eax
cmp ebx, 0x40
jle 0x498ff2
lea eax, [ebp]
add ecx, ecx
mov edx, 0x2c000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff4a8fd7
cmp ebx, 0x40
jle 0x498f99
add dh, al
mov edx, dword [ebp - 4]
call 0x14992cf
call fcn.004a2a67
adc dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x498f83
add bl, bl
jle 0x49902b
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x8549c3c3
add byte [ebp - 4], al
call fcn.0049c067
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.004890df
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
jle 0x499023
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
sub byte fs:[eax], al
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
into
add cl, ch
ja 0x499066
add byte [eax], al
jmp 0x499038
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
cdq
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xcc
lea eax, [ebp - 4]
call 0x4a90bb
mov eax, dword [ebp + 8]
mov ebx, edi
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x4cfc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x2ed3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.0049baa7
add byte [ecx], al
loopne 0x4990b7
in eax, dx
pop ds
add bh, ah
add dh, ch
pop ecx
pop ebp
ret
Function at 0x4e3be7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
adc al, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
add dword [eax], eax
cmp ebx, 0x40
jle 0x4e3c52
lea eax, [ebp]
add ecx, ecx
mov edx, 0x2c000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff4f3c37
cmp ebx, 0x40
jle 0x4e3bf9
add dh, al
mov edx, dword [ebp - 4]
call 0x14e3f2f
call fcn.004ed6c7
adc dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x4e3be3
add bl, bl
jle 0x4e3c8b
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x854e7023
add byte [ebp - 4], al
call fcn.004e6cc7
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.004d3d3f
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
jle 0x4e3c83
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
sub byte fs:[eax], al
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
into
add cl, ch
ja 0x4e3cc6
add byte [eax], al
jmp 0x4e3c98
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
cdq
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xcc
lea eax, [ebp - 4]
call 0x4f3d1b
mov eax, dword [ebp + 8]
mov ebx, edi
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x4cfc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x2ed3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.004e6707
add byte [ecx], al
loopne 0x4e3d17
in eax, dx
pop ds
add bh, ah
add dh, ch
pop ecx
pop ebp
ret
Function at 0x52eb57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
adc al, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
add dword [eax], eax
cmp ebx, 0x40
jle 0x52ebc2
lea eax, [ebp]
add ecx, ecx
mov edx, 0x2c000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff53eba7
cmp ebx, 0x40
jle 0x52eb69
add dh, al
mov edx, dword [ebp - 4]
call 0x152ee9f
call fcn.00538637
adc dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x52eb53
add bl, bl
jle 0x52ebfb
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x85531f93
add byte [ebp - 4], al
call fcn.00531c37
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0051ecaf
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
jle 0x52ebf3
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
sub byte fs:[eax], al
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
into
add cl, ch
ja 0x52ec36
add byte [eax], al
jmp 0x52ec08
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
cdq
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xcc
lea eax, [ebp - 4]
call fcn.0053ec8b
mov eax, dword [ebp + 8]
mov ebx, edi
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x4cfc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x2ed3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.00531677
add byte [ecx], al
loopne 0x52ec87
in eax, dx
pop ds
add bh, ah
add dh, ch
pop ecx
pop ebp
ret
Function at 0x579967
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
adc al, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
add dword [eax], eax
cmp ebx, 0x40
jle 0x5799d2
lea eax, [ebp]
add ecx, ecx
mov edx, 0x2c000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff5899b7
cmp ebx, 0x40
jle 0x579979
add dh, al
mov edx, dword [ebp - 4]
call 0x1579caf
call fcn.00583447
adc dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x579963
add bl, bl
jle 0x579a0b
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x8557cda3
add byte [ebp - 4], al
call fcn.0057ca47
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.00569abf
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
jle 0x579a03
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
sub byte fs:[eax], al
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
into
add cl, ch
ja 0x579a46
add byte [eax], al
jmp 0x579a18
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
cdq
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xcc
lea eax, [ebp - 4]
call fcn.00589a9b
mov eax, dword [ebp + 8]
mov ebx, edi
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x4cfc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x2ed3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.0057c487
add byte [ecx], al
loopne 0x579a97
in eax, dx
pop ds
add bh, ah
add dh, ch
pop ecx
pop ebp
ret
Function at 0x5b53af
Capabilities:
Encode data using xor

Disassembly:
pop ecx
xchg ebp, eax
mov edi, 0x9a2c7226
jb 0x5b53c7
nop
invalid
inc ebx
popfd
pop ecx
pushfd
fsubr dword [eax]
leave
push esp
bound ecx, qword [ebx - 0x47644f7c]
sal al, 0xee
sub al, 0xc2
outsd dx, dword [esi]
out 0xb0, al
idiv byte [edx + ebp*8 + 0x7a]
mov ah, byte [edx - 0x1c]
inc ebp
mov bh, dl
adc byte [edx + 0x665cb2c3], cl
and bl, byte [edi + 0x39]
push esp
cwde
in eax, 0xa1
inc ebx
aad 0xe4
dec ecx
xor eax, 0xf287a906
jb 0x5b53f5
test dword [edi + 0x3e], edx
xchg dword [ecx], ebp
jo 0x5b5424
pop eax
das
sub dh, byte [edi + 0x31]
dec ebx
mov edi, ebp
dec eax
mul cl
push eax
adc al, 0x4c
outsd dx, dword [esi]
mov al, 0x22
dec ebp
cmpsb byte [esi], byte es:[edi]
pop esp
dec eax
sti
adc bl, al
lahf
add dword [ecx], esi
push cs
les esp, [eax + 0x2a4cdf02]
in al, dx
add bl, bh
dec esp
sub ch, ah
lodsd eax, dword [esi]
out 0x74, eax
nop
jp 0x5b549b
inc edi
imul ebx, dword [ecx - 0x4c], 0xef5d81ea
push edi
dec esp
daa
add al, byte [ebx + ebp*8]
add dh, byte [eax - 0x1bbbf0ee]
xor esi, ebx
movsd dword es:[edi], dword [esi]
xor al, 0x61
adc bl, byte [eax - 0x27]
add byte [ebx + 0x74], bh
mov ebx, 0xd91ff444
inc edi
mov eax, dword [0x90d411ba]
test al, 0xd6
test dword [edx - 0x7c], esp
push 0x64
or dword [eax + 0x45], esi
inc edx
jle 0x5b5488
or eax, 0x81b48b14
pop esp
cdq
adc al, 0x19
inc edi
popal
cmc
cmp eax, 0xb4c9e8f0
dec edi
or byte [ecx - 0x41], bh
mov dl, 0xd8
ja 0x5b54f8
sbb byte [eax], ah
cmp eax, ecx
ljmp 0x3e6
and al, 0x66
out 3, al
pushal
inc edi
jp 0x5b5498
inc esp
lcall 0xd586, 0xfbd7e4a4
mov word [ecx], cs
sub ebp, ecx
or ecx, dword [esi - 0x65]
mov al, 0xcb
invalid
jmp 0xb0f6a2ab
mov word [eax - 0x2b1335a1], fs
popfd
fldcw word [ebp - 0x1d]
imul ebx, dword [edx + 0x4f0dde41], 0xffffffa4
sub esp, dword [esi]
je 0x5b551d
ret 0x5902
pop ebx
dec ecx
sbb cl, dl
sub dh, byte [eax + ebx*2 - 0x76]
mov eax, 0x9b216256
invalid
Function at 0x5c5257
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
adc al, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
add dword [eax], eax
cmp ebx, 0x40
jle 0x5c52c2
lea eax, [ebp]
add ecx, ecx
mov edx, 0x2c000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff5d52a7
cmp ebx, 0x40
jle 0x5c5269
add dh, al
mov edx, dword [ebp - 4]
call 0x15c559f
call fcn.005ced37
adc dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x5c5253
add bl, bl
jle 0x5c52fb
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x855c8693
add byte [ebp - 4], al
call fcn.005c8337
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.005b53af
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
jle 0x5c52f3
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
sub byte fs:[eax], al
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
into
add cl, ch
ja 0x5c5336
add byte [eax], al
jmp 0x5c5308
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
cdq
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xcc
lea eax, [ebp - 4]
call fcn.005d538b
mov eax, dword [ebp + 8]
mov ebx, edi
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x4cfc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x2ed3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.005c7d77
add byte [ecx], al
loopne 0x5c5387
in eax, dx
pop ds
add bh, ah
add dh, ch
pop ecx
pop ebp
ret
Function at 0x6100e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
adc al, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
add dword [eax], eax
cmp ebx, 0x40
jle 0x610152
lea eax, [ebp]
add ecx, ecx
mov edx, 0x2c000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
lodsd eax, dword [esi]
add byte [edx + 0x40], bh
call 0xff620137
cmp ebx, 0x40
jle 0x6100f9
add dh, al
mov edx, dword [ebp - 4]
call 0x161042f
call fcn.00619bc7
adc dword [eax], eax
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x6100e3
add bl, bl
jle 0x61018b
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x85613523
add byte [ebp - 4], al
call fcn.006131c7
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0060023f
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
jle 0x610183
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
sub byte fs:[eax], al
push 0x409057
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
into
add cl, ch
ja 0x6101c6
add byte [eax], al
jmp 0x610198
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
cdq
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xcc
lea eax, [ebp - 4]
call fcn.0062021b
mov eax, dword [ebp + 8]
mov ebx, edi
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x4cfc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x2ed3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
lea eax, [eax]
inc ebp
cld
call fcn.00612c07
add byte [ecx], al
loopne 0x610217
in eax, dx
pop ds
add bh, ah
add dh, ch
pop ecx
pop ebp
ret
Function at 0x6599ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662398
cmp edx, dword [eax]
je 0x6599cf
add eax, 8
inc ecx
cmp eax, 0x662428
jl 0x6599c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662398]
jne 0x659afd
mov eax, dword [0xa5f0fc]
cmp eax, 1
je 0x659ad7
test eax, eax
jne 0x659a00
cmp dword [0x6622c4], 1
je 0x659ad7
cmp edx, 0xfc
je 0x659afd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
fsub st(2)
invalid
invalid
test eax, eax
jne 0x659a37
lea eax, [ebp - 0x1a4]
push 0x65eab0
push eax
call fcn.0065a390
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a820
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659a7a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a820
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65eaac
push edi
call fcn.0065c6f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ea90
push eax
call fcn.0065a390
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a3a0
lea eax, [ebp - 0xa0]
push 0x65ea8c
push eax
call fcn.0065a3a0
push dword [esi + 0x66239c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a3a0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65ea64
push eax
call fcn.0065c664
add esp, 0x2c
pop edi
jmp 0x659afd
lea eax, [ebp + 8]
lea esi, [esi + 0x66239c]
push 0
push eax
push dword [esi]
call fcn.0065a820
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret