joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c3c0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
xor ebp, ebp
push esi
push edi
lea esi, [ebp + 1]
push esi
push ebp
call dword [0x4a8008]
mov edi, eax
add esp, 8
test edi, edi
je 0x46c417
nop word [eax + eax]
push esi
push edi
push dword [esp + 0x1c]
mov ebp, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x46c42f
cmp esi, ebx
je 0x46c42f
cmp esi, 0x8000
ja 0x46c42f
cmp esi, ebx
jb 0x46c428
push esi
push edi
call dword [0x4a8008]
mov edi, eax
add esp, 8
test edi, edi
jne 0x46c3e0
push ebp
call dword [0x4a8004]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [0x4a8004]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x471cb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
mov eax, dword [0x4a8040]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
or esi, 0xffffffff
push eax
mov ebx, dword [edi + 0xc]
mov ebp, dword [ebx + 0x14c]
push ebp
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x471d13
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x80
push eax
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push ebp
push ebx
push edi
call fcn.004552e0
add esp, 0xc
cmp esi, 0xffffffff
jne 0x471d38
push str.Error_accept__ing_server_connect
push edi
call fcn.004548a0
add esp, 8
mov eax, 0x1e
jmp 0x471da8
push str.Connection_accepted_from_server
push edi
call fcn.00454970
push 1
push esi
mov byte [ebx + 0x266], 0
mov dword [ebx + 0x14c], esi
call fcn.00480fb0
add esp, 0x10
mov byte [ebx + 0x279], 1
cmp dword [edi + 0x1b8], 0
je 0x471da6
push 1
push edi
call fcn.00444cf0
mov eax, dword [edi + 0x1b8]
push 1
push esi
push dword [edi + 0x1bc]
call eax
push 0
push edi
mov esi, eax
call fcn.00444cf0
add esp, 0x1c
test esi, esi
je 0x471da6
push ebx
push edi
call fcn.00472240
add esp, 8
mov eax, 0x2a
jmp 0x471da8
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048f4f0
add esp, 0x88
ret
Function at 0x47b860
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x4a8040]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
push ebp
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x438]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi + 0x13c]
push 0
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x130], 0
mov dword [edi + 0x134], eax
jne 0x47b8e6
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [edi + 0xb0]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x130], eax
mov esi, dword [edi + 0x134]
cmp esi, 4
jge 0x47b921
push str.Received_too_short_packet
push ebx
call fcn.004548a0
add esp, 8
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048f4f0
add esp, 0x88
ret
mov edx, dword [edi + 0x148]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x47b940.1
jmp dword [ecx*4 + 0x47ba4c]
cmp esi, 4
jle case.0x47b940.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x47b940.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebx
call fcn.004547e0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47b99b
push 5
push edi
call fcn.0047c370
add esp, 8
mov eax, esi
jmp 0x47b908
mov eax, dword [edi + 0x134]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.00464970
jmp 0x47ba21
movzx ecx, byte [edx + 2]
lea ebp, [edx + 4]
movzx eax, byte [edx + 3]
add esi, 0xfffffffc
shl ecx, 8
or ecx, eax
push esi
push ebp
mov dword [edi + 8], ecx
call fcn.0047c3e0
add esp, 8
cmp eax, esi
jae case.0x47b940.4
push ebp
push str.TFTP_error:__s
push ebx
call fcn.00454970
jmp 0x47ba21
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.0047b5f0
add esp, 0xc
test eax, eax
je case.0x47b940.4
jmp 0x47b908
push str.Internal_error:_Unexpected_packet
push 0x49f098
push ebx
call fcn.004548a0
add esp, 0xc
push ebx
call fcn.00464d70
add esp, 4
test eax, eax
je 0x47b906
push 5
push edi
call fcn.0047c370
add esp, 8
mov eax, 0x2a
jmp 0x47b908
Function at 0x486cf0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x4a8040]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x486d70
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00440440
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.004548a0
push esi
call dword [0x4a8004]
add esp, 0x20
lea eax, [ebx + 0x4d]
jmp 0x486ed0
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x486dca
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00440440
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.004548a0
push 0
mov esi, 0x4d
call dword [0x4a8004]
add esp, 0x20
jmp 0x486ec1
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x486e0a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00440440
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.004548a0
add esp, 0x1c
mov esi, 0x4d
jmp 0x486ead
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x486e38
jg 0x486e1e
cmp edi, 0x100000
jbe 0x486e38
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.004548a0
add esp, 0xc
mov esi, 0x4d
jmp 0x486ead
lea eax, [edi + 1]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x486e50
lea esi, [eax + 0x1b]
jmp 0x486ead
test edi, edi
je 0x486e94
nop dword [eax]
nop dword [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x486eed
mov eax, dword [esp + 0x10]
test eax, eax
je 0x486ee9
add esi, eax
cmp esi, edi
jb 0x486e60
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.00486af0
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x4a8004]
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048f4f0
add esp, 0x120
ret
mov edi, esi
jmp 0x486e94
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00440440
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.004548a0
add esp, 0x1c
mov esi, 0x4d
jmp 0x486ead
Function at 0x490761
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4907a0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4907a0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4907a0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4907a0
cmp dword [ecx + 0x74], 0xe
jbe 0x4907a0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x9bfc05
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9bfc2c
call fcn.00962138
mov dword [eax], esi
call fcn.00962125
push 0x16
pop esi
mov dword [eax], esi
call fcn.00962d7a
mov eax, esi
jmp 0x9bfc81
test dword [ebp + 0xc], 0xfffffff9
jne 0x9bfc12
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9bfc59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0096214b
pop ecx
call fcn.00962125
mov eax, dword [eax]
jmp 0x9bfc81
test al, 0x10
jne 0x9bfc7f
test al, 1
je 0x9bfc7f
test byte [ebp + 0xc], 2
je 0x9bfc7f
call fcn.00962138
mov dword [eax], 5
call fcn.00962125
mov dword [eax], 0xd
jmp 0x9bfc50
xor eax, eax
pop esi
pop ebp
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219

Function at 0x438c83
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
or edi, edx
call fcn.00438cb9
add edx, 1
dec edx
xor dword [eax], ecx
dec edi
push 0x5f60d6a4
pop edx
add eax, 1
inc edi
cmp eax, ebx
jne fcn.00438c83
or edi, edx
push edi
pop edx
sub edx, edx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1e82036a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..tls
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x290319ed
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4169e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x4169e7
lcall 0x5de5, 0x8b10c483
jmp loc.0096a75c
Function at 0x40f33a
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
dec ebx
sbb esi, dword [ebx + 0x1d]
test eax, 0x489dcc32
mov eax, dword [0xffb1052b]
neg dword [ecx - 0x7536f432]
add ebp, dword [ecx - 0x64cad832]
test byte [ecx - 0x2947bdb9], cl
rcr byte [ebx], cl
xchg esi, eax
adc byte [esi + ecx], cl
jo 0x40f3b5
and dword [edx], edx
mov byte [ebx - 0x6f63869e], dl
adc cl, byte [eax - 0x63869d6d]
nop
sub dl, byte [ebp + 0x278dc130]
ret
imul edi, ebp, 0xededd8cb
wait
xor ah, dl
xlatb
jge 0x40f3b6
std
retf
loopne 0x40f36b
fisttp qword [edi]
pop eax
ror cl, cl
ja 0x40f364
jle 0x40f3f5
cmp al, 0x2f
pop esp
xor al, 0x2c
mov ah, 0x2b
xchg ecx, eax
rcr esp, 1
sbb ebp, ecx
invalid
or al, 0xbf
shr ecx, 0x2f
lodsb al, byte [esi]
invalid

Function at 0x416dd9
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
pop ds
test dword [esi + 0x78da7598], 0xfd0a2fbb
lodsb al, byte [esi]
or bl, byte [ecx + 0x34b844a2]
xchg esp, eax
pop edi
call dword [edx + 0x8c99ccd]
dec ebx
wrmsr
daa
Function at 0x43b2e8
Capabilities:
Encode data using xor

Disassembly:
push esi
out 0x46, eax
pop ss
push esp
sal byte [esi + 0x75], cl
not byte [edi - 0x2c294c5c]
test edi, esp
xchg byte [0x4045f7a8], dh
xor byte [edi + 0x785454e6], al
and al, ah
in eax, 0xc2
in eax, 0x2a
pop esp
adc al, byte [esi + 0x69925155]
bound eax, qword [edx]
mov ah, 0x6d
xor ch, ch
mov byte [0x988011a4], al
ret
xchg esp, eax
inc esp
int1
in eax, 0xa3
pop es
adc al, 0x52
mov dl, 0x65
pop ebp
dec esi
popfd
mov dword [0xf0b1d477], eax
lodsb al, byte [esi]
stc
les ecx, [edx + 0x48e8eb8e]
loop 0x43b229
call 0x92d594e1
xchg edx, eax
cmp al, 0x72
jbe 0x43b2a7
popal
and eax, 0x41
imul esp, esi, 0xffffffbd
add ah, byte [esi]
mov cl, 0xd2
sar byte [edx - 4], cl
jp 0x43b2a6
jp 0x43b2e4
lahf
fidiv dword [ebx]
out 0x46, eax
imul edx, dword [ebp - 0x4c], 0xffffffd2
inc edi
mov dl, 0x6b
cli
add bl, byte [edx]
add dword [edx + 0x6a], esi
and edi, esp
sti
sub byte [edx + eax*4 + 0x7fe265dd], al
sbb ch, 0x65
loop 0x43b347
dec edi
aas
jne 0x43b2cf
pop ebx
jne 0x43b27c
fcom dword [ecx + 0x62291e25]
mov ebx, 0x1343647d
xor ebx, dword [edi]
ret 0x7fa1
adc al, 0xdd
adc dword ds:[edx], esp
and ah, ah
and cl, byte [eax]
sar dword [edx], cl
cwde
mov ebp, 0xb56cf262
jne 0x43b309
dec ebp
inc ebp
cmp esp, dword [edi - 0x402ffd45]
popal
std
or dword [edi], ebp
jne 0x43b2c3
mov edi, 0x8a74a04e
je 0x43b294
mov dh, dh
not al
mov edi, dword [eax]
mov edx, 0x2769435b
pop ecx
sar byte [ebx], cl
sbb al, 0x31
adc bh, byte [eax]
pop ecx
ror byte [ebx + 0x435bba38], 1
imul esp, dword [edi], 0x1c3bd259
xor dword [edx], edx
cmp byte [esi], bh
pop ecx
push ebx
xor byte [ebx + 0x2af5238], cl
xchg esp, eax
jae 0x43b30b
in eax, 0x60
pushal
outsb dx, byte [esi]
cwde
stc
das
adc byte [eax - 0x10], dl
sbb byte [esi + 0x4b], 0xd4
sub dword [edi - 0x41], esp
fcompi st(2)
loope 0x43b325
mov edi, 0xece1f2df
loope 0x43b325
adc eax, 0x7552e712
mov dword [0xf48e075e], eax
add bh, byte fs:[ebp + 0x68bf79a2]
mov dl, 0xf6
jl 0x43b326
jns 0x43b308
push 0xd87cf6b2
inc edx
jnp 0x43b339
test esp, edi
jge 0x43b3b1
push 0x49050538
out dx, eax
add eax, 0xef2e4905
push edx
sub al, 0x47
cmc
pop ebx
jae 0x43b382
xor eax, 0x24fab412
ja 0x43b357
pop ebp
sub dl, 4
mov bh, 0xea
adc dl, byte [ebp - 0x4939a68]
and ebx, dword [eax]
pop esp
xor eax, 0x38af35af
xor eax, dword [0xb0e3d973]
jecxz 0x43b334
jg 0x43b336
inc edi
fbstp tbyte gs:[0xcc13649f]
hlt
int3
arpl word [edi], si
ja 0x43b38d
fstp xword [edi + 0x2218d01c]
mov edi, 0x2218d01c
stosd dword es:[edi], eax
inc ebx
cmp al, 0x9e
stosd dword es:[edi], eax
push esp
sub byte [ebp + 4], bl
jno 0x43b424
lahf
push edi
loop 0x43b416
jae 0x43b3ae
pop ds
mov dh, byte [eax + 0x63]
dec ebp
cmp dword [ecx + edx*4], ebp
dec ebp
adc bh, byte [ecx]
sub esi, esi
jne 0x43b454
cmovae esp, eax
iretd
leave
adc al, 0xf
pop esp
sbb byte [ebp + 0x4109546], al
pop ss
call 0x68dd8dc4
fimul dword [eax - 0x314a1208]
mov ecx, 0xbd8534fa
invalid
or dword [ebp - 0x6b099b9b], eax
sub byte [ecx - 0x14ca53bf], cl
xchg ebp, eax
xchg dh, ch
call 0x3528f868
push ss
invalid
Function at 0x454188
Capabilities:
Authenticate hmac

Disassembly:
sbb al, 0xf7
cmp eax, 0x9895a72d
retf
stosb byte es:[edi], al
cmp bl, cl
xchg byte [ebx + edi*8], dh
xor al, 0xa9
clc
imul ebx, dword [ebx + 0x1a848f1a], 0x5c
sti
sub ebp, ebp
ror byte ss:[edx], 1
mov ebp, 0xd9233ce8
mov bl, byte [edx + 0x91276ee]
test eax, 0xc77b98d6
popal
inc eax
and esi, dword [ecx]
imul esi, dword [edx], 0xffffff94
and eax, 0x46d823df
and al, 0x6f
jge 0x45413d
cmc
jmp 0x461c83
scasd eax, dword es:[edi]
sbb al, 0xa8
test dword [edi], 0x79f8a91d
sti
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
sbb dword [ebx - 0x75], eax
les eax, [ebp + ebx*4 + 0x4d]
aad 0x75
push 0x1c
adc byte [edi + 0x3c], dh
pop eax
mov ebp, dword [ebp + 0x60]
add dword [ebp - 0x29991764], esp
push ebx
jbe 0x4541a3
jnp 0x45421c
push ds
stosb byte es:[edi], al
jge 0x45414a
stc
adc eax, 0x64697a9b
cmp al, 0xc
dec esp
daa
popal
cli
cmp ecx, dword [edx + 0x4a941331]
call 0x34a690bb
cmp eax, ecx
lodsd eax, dword ds:[esi]
invalid
add byte [esi - 6], ch
add ch, byte [edx - 0x350a1fac]
xchg ecx, eax
ror byte [esi - 0x692e2976], 0x4b
pop ss
push ebx
movsx esp, dx
jbe 0x454228
mov dl, dh
rcl dword [esi + 0xf53174b]
mov edi, 0xe8f476e2
xchg ecx, eax
xchg edi, eax
pop edi
add dword [si], edx
jmp edi
call 0x67a4d9ca
add dword [edi + edi*8], edx
out 0x10, eax
add byte [ebx - 0x1d7c5616], ah
cli
rcr byte [esi], cl
lcall 0x17a8, 0x52fcd4ca
invalid
push eax
add byte [eax], al
or byte [ebx + 0xe3fe8ce], cl
add dword [eax], eax
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x46feac
Capabilities:
Encode data using xor

Disassembly:
or al, 0xda
imul eax, dword [esi + ebp*2], 0xe186c70
push ecx
sub eax, 0x110ca659
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
xchg edi, eax
inc eax
pop esp
pop ds
sub ecx, dword [ecx + ebx*8 - 0x33]
push eax
scasd eax, dword es:[edi]
lcall 0x8eec, 0xe1e27fc2
inc esp
xor byte [ecx + 0xa], bh
sub ebx, dword [ebx - 0x75914d2]
and al, 9
mov ebp, 0x7bdeca24
aas
push esi
aas
aas
adc ah, byte [eax + ecx*8 + 0x7d]
outsd dx, dword [esi]
push edx
mov ecx, 0x7f356f8a
fmul qword [edi]
ja 0x46ff64
ret
in eax, 0xb
lcall 0xe636, 0xa87c713a
push ecx
add al, 0x8b
jbe 0x46ffdc
aam 0xbb
scasb al, byte es:[edi]
por mm0, mm3
invalid
mov dword [ecx], esi
mov ebp, 0xffba92fe
inc bx
rol byte [ebx*4 - 0x42f865c9], cl
xchg byte [eax + 0x14], cl
pop edx
xor ecx, edi
cli
sub dword [edi - 0x3a], ecx
mov cl, 0x54
invalid
Function at 0x41445f
Capabilities:
Encode data using xor

Disassembly:
les eax, [edx]
cmpsd dword [esi], dword es:[edi]
push edx
out dx, al
pushal
pop ecx
xlatb
mov esi, 0x7bae31a4
in eax, dx
fsub dword [0x937ce2ef]
mov al, byte [0xe1af2f70]
xchg edi, eax
fsub qword [0xa2514698]
js 0x41442e
pop eax
cmc
pop es
das
inc ebp
xchg ecx, eax
imul esi, dword [ebx], 0xffffffa0
loopne 0x4144b7
jbe 0x4144fb
cmp byte [edi + 0x7f], 0x8e
inc byte [esi]
mov bl, byte [eax + edx*4 + 0x7000ee56]
pop ebx
mov cs, word [ebx + ebp*8 + 0x78]
xchg ebp, eax
xor dword [edi - 0x284e1f05], esp
push eax
jp 0x41448b
jg 0x41450c
invalid
sbb eax, 0x4c7614d7
adc ebx, ecx
imul ecx, dword [edx - 0x293e9711], 0xffffffb2
mov byte [0x6c617b61], al
popal
insb byte es:[edi], dx
xor dh, byte [edi - 0x11ae14c9]
das
loope 0x4144f1
int 0x41
inc ecx
cmp al, 0x13
dec edx
inc edx
inc esp
mov edi, 0xaca121f5
test eax, 0xa4d14bc1
mov ebx, 0x5f4efe5e
pop edi
insd dword es:[edi], dx
xchg dword [edi + 0x39a4529a], ecx
mov al, byte [0x2365df60]
and cl, bl
adc edx, eax
sub al, 0x70
sal byte [esi - 0x50], cl
mov byte [0xf0910fd8], al
adc ecx, edx
cwde
scasb al, byte es:[edi]
loop 0x414528
invalid
xor edx, dword [ebp - 0x54]
push ecx
mov al, 0xce
pop edi
and eax, 0x15fa376c
jg 0x4144d7
xor byte [ecx], bh
ja 0x41452a
add al, 0xcb
in eax, dx
invalid
ja 0x4144c3
or dword [eax + 0x47a9f0bc], ebx
iretd

Function at 0x605909
Capabilities:
Encode data using xor

Disassembly:
add dword [edx + 0x7e], eax
pop bp
mov dword [0xf596f008], eax
invalid
mov dh, 0xa0
out 0xa9, eax
pushal
push es
shr byte [ebx + eax*8 - 0x6a], 0xad
xor bh, byte [edx - 0x2d]
shr byte [edx + 0x1f], 0xe2
int1
invalid
lahf
adc byte [edx], dl
jno 0x60592d
lodsb al, byte [esi]
or dword [ebp + 0xbb43ddf], esp
mov edi, 0x282bf2f1
xchg byte [esi + 0x52467e], bl
dec ecx
stosd dword es:[edi], eax
push 0x6d1f9df2
invalid
shr dword [edi + 0x71cdbdcb], 1
push edi
xor ebx, dword [edi]
mov bh, dl
sbb al, byte [ebp - 0x3e]
dec esp
jb 0x6058d4
jg 0x605958
adc byte [ecx - 0x30c58ca], al
cmpsd dword ss:[esi], dword es:[edi]
cld
jnp 0x6058ee
loop 0x6058a4
ror byte [esi - 0x45], cl
or byte [ebx + 0x69b0051d], bh
shr esp, 0xb
fsubr qword [edi]
das
stosd dword es:[edi], eax
aam 0x74
sbb esp, dword [ebp + 0x56]
mov eax, 0x8815897b
jae 0x6058b2
xor dl, byte [edx + ecx*4 - 0x4ecc0a]
cdq
xchg esp, eax
jbe 0x605987
xchg esp, eax
mov dh, dh
xor esi, dword [ecx + 0x769499ff]
push eax
adc bl, ah
xchg ebx, eax
jno 0x6058f4
les esp, [0x3e90d8c9]
sub edi, dword [ebp - 0x57]
mov edx, 0x94939b3c
retf 0x2e8b
cwde
jecxz 0x60591e
push ebp
or byte [ebx], cl
mov ebx, 0x11219a4d
and esi, dword [ebp + 0xc]
adc dword [ebx], esp
jne 0x605972
sti
dec esp
xchg ebx, eax
insb byte es:[edi], dx
sar byte [esi + 0x52], 1
pop eax
mov bh, 0x2e
in al, dx
add al, 0xa1
xlatb
pushfd
xor al, 0x8e
pop ecx
scasb al, byte es:[edi]
adc al, 0xb3
das
loopne 0x605962
or bl, dl
invalid
pop esi
sahf
sub dh, al
add byte [ecx], ah
cli
leave
test eax, 0xf638c915
inc edx
je 0x6059dc
out dx, eax
dec ecx
inc ebp
xlatb
retf
shl esi, cl
cli
mul dword [edi + 0x6f]
into
invalid
Function at 0x6079e9
Capabilities:
Encode data using xor

Disassembly:
pmulhw mm7, qword [edx + 0x361a6be8]
leave
enter 0x10c8, 0xb
xor dword [esi - 0x65], ebx
jae 0x6079a5
jbe 0x607a4d
mov byte [ecx - 0x45], 0xd7
xchg edi, eax
and dword [esi], 0x26
cmp eax, 0x7b58dac8
or byte [esi - 0x788b66ae], bl
lea edx, [edx]
and eax, dword [ebp + 0x7186dc0a]
inc ebp
jb 0x6079c3
jge 0x6079b4
push edx
push 0xffffffffffffffa0
push edx
bound esi, qword [ebx - 0x385ed18]
mov dword [edx + 0x3a3ad985], 0x4719c76d
xor dh, 0x28
xor dword [ecx + 0x66392961], ecx
push 0x8619776b
inc esi
fsubp st(4)
jns 0x607a74
pop ss
fisubr dword [ebx - 0x6a]
mov word [eax + 0x4d], fs
shl byte [edx + 0x7d], cl
inc ecx
shl dword [ebp - 0x68], 1
mov al, byte [0x1a703291]
insd dword es:[edi], dx
mov dh, 0x68
test ebp, edi
dec edi
sti
jno 0x607a31
push dword [esi + 0x7d7164fb]
mov dh, 0xfb
jno 0x607ab4
feni8087_nop
add al, 0x49
mov ah, byte [edx]
mov byte [0x463d170b], al
mov bl, 0x21
aad 0xa8
sub byte [edx + 0x7f], 0xe
cwde
not dword [ecx - 0x40]
cdq
leave
outsd dx, dword [esi]
in al, 0x77
mov edx, 0xef985a90
push ecx
rcr byte [ecx + 0x77e46fc9], 0xba
nop
pop edx
cwde
out dx, eax
ljmp 0x94b3:0xbf682a39
inc eax
adc edi, dword [ebx + 0x10ff12c5]
xor ebx, dword [ebp + 0x61]
cmp al, 0xbd
mul dword [edi - 0x38]
mov ch, 0x77
mov byte [0x83ad4caf], al
mov eax, dword [0x7016719e]
test al, 0xe5
jb 0x607a97
cli
cmp cl, byte [edi - 0x2925d968]
cwde
fcmovbe st(0), st(6)
invalid
ret 0x950f

Function at 0x627cf1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303c0
cmp edx, dword [eax]
je 0x627d13
add eax, 8
inc ecx
cmp eax, 0x630450
add al, 0x63
invalid
jl 0x627d04
push esi