joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021fa
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x2710
push esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov edi, 0x1388
mov dword [ebp - 8], ebx
call fcn.0100cb82
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x1002234
xor eax, eax
jmp 0x100235e
push esi
call fcn.0100cb82
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x100224c
lea eax, [ebp - 4]
push eax
call fcn.0100cf75
jmp 0x100222d
push dword [ebp - 4]
call fcn.0100cc2b
cmp eax, ebx
mov ecx, dword [ebp - 4]
je 0x1002261
mov byte [ecx], bl
inc ecx
dec eax
jne 0x100225b
push dword [ebp - 8]
call fcn.0100cc2b
cmp eax, ebx
mov ecx, dword [ebp - 8]
je 0x1002276
mov byte [ecx], bl
inc ecx
dec eax
jne 0x1002270
mov dword [ebp - 0xc], esi
push dword [ebp + 8]
push edi
push dword [ebp - 4]
push 0x1001340
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
lea eax, [edi - 2]
cmp esi, eax
jne 0x10022f3
add dword [ebp - 0xc], 0xc8
add edi, 0x64
cmp dword [ebp - 4], ebx
je 0x10022b3
lea eax, [ebp - 4]
push eax
call fcn.0100cf75
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call fcn.0100cb82
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10022e2
cmp dword [ebp - 8], ebx
je 0x10022d3
lea eax, [ebp - 8]
push eax
call fcn.0100cf75
mov dword [ebp - 8], ebx
push dword [ebp - 0xc]
call fcn.0100cb82
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x1002279
lea eax, [ebp - 4]
push eax
call fcn.0100cf75
lea eax, [ebp - 8]
jmp 0x1002244
call fcn.0100e976
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x10022e2
cmp esi, ebx
jbe 0x1002349
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
add eax, eax
mov cx, word [eax + ecx]
inc dword [ebp - 0x10]
mov word [edx + edi*2], cx
mov ecx, dword [ebp - 4]
cmp word [eax + ecx], bx
jne 0x1002341
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x18]
call fcn.0100ed38
push ebx
push dword [ebp - 8]
call fcn.0100c981
test eax, eax
je 0x1002365
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jb 0x1002303
lea eax, [ebp - 4]
push eax
call fcn.0100cf75
lea eax, [ebp - 8]
push eax
call fcn.0100cf75
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 4]
push eax
call fcn.0100cf75
lea eax, [ebp - 8]
push eax
call fcn.0100cf75
lea eax, [ebp - 0x18]
push eax
call fcn.0100e9eb
jmp 0x100222d
Function at 0x100276a
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x1002779
xor eax, eax
jmp 0x10027c4
test byte [0x10134a0], 1
je 0x100278b
or dword [0x10134a0], 0x21
jmp 0x1002792
or dword [0x10134a0], 0x20
push dword [0x10134a0]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x10027c1
push 0x8d
call fcn.0100e8a3
push eax
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x40
push eax
call fcn.0100e4e5
jmp 0x1002775
xor eax, eax
inc eax
pop ebp
ret 4

Function at 0x1002b84
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, 0x1388
push 0x2710
call fcn.0100cb82
test eax, eax
mov dword [ebp - 4], eax
jne 0x1002bb4
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.0100c752
jmp 0x1002c32
push dword [ebp + 8]
push esi
push eax
push 0x10013fc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esi - 2]
cmp eax, ecx
jne 0x1002bed
add esi, 0x64
cmp dword [ebp - 4], 0
je 0x1002be7
lea eax, [ebp - 4]
push eax
call fcn.0100cf75
and dword [ebp - 4], 0
lea eax, [esi + esi]
push eax
jmp 0x1002b99
push 0
push dword [ebp - 4]
call fcn.0100c981
mov ecx, 0xfe
cmp eax, ecx
ja 0x1002c19
push ecx
push dword [ebp - 4]
push dword [ebp + 0x14]
call fcn.0100d336
lea eax, [ebp - 4]
push eax
call fcn.0100cf75
xor eax, eax
jmp 0x1002c35
lea eax, [ebp - 4]
push eax
call fcn.0100cf75
push 0xe80
call fcn.0100e8a3
push eax
call fcn.0100c6eb
xor eax, eax
inc eax
pop esi
leave
ret 0x10
Function at 0x1010996
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov esi, eax
cmp esi, 1
jne 0x1010a0b
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp eax, esi
jne 0x1010a00
cmp dword [ebp - 0x14], esi
je 0x1010a02
xor esi, esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100c0cd
leave
ret
Function at 0x1010b19
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa08
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x9e4], eax
push 7
xor eax, eax
cmp dword [ebp - 0x9e4], esi
pop ecx
lea edi, [ebp - 0xa04]
mov dword [ebp - 0xa08], esi
mov dword [ebp - 0x9e8], edx
mov dword [ebp - 0x9e0], esi
mov dword [ebp - 0x9dc], esi
rep stosd dword es:[edi], eax
mov word [ebp - 0x46], si
je 0x1010c9b
cmp ebx, esi
je 0x1010c9b
mov eax, dword [ebx]
cmp eax, esi
je 0x1010b96
cmp eax, 2
jb 0x1010c9b
cmp edx, esi
je 0x1010c9b
cmp dword [0x101338c], esi
jne 0x1010bca
lea eax, [ebp - 0x9d8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1010bc0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
jmp 0x1010ca7
mov dword [0x101338c], 1
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 0xa08]
push eax
push esi
push dword [ebp - 0x9e4]
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x1010cad
mov esi, dword [ebp - 0x9dc]
xor edi, edi
jmp 0x1010c35
push 4
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x401
lea eax, [ebp - 0x848]
push eax
mov word [ebp - 0x848], di
push dword [esi + 0x10]
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_GetNameInfoW]
cmp eax, edi
je 0x1010c3b
cmp eax, 0x2afc
jne 0x1010c32
cmp word [ebp - 0x848], di
jne 0x1010c3b
mov esi, dword [esi + 0x1c]
cmp esi, edi
jne 0x1010bf7
jmp 0x1010c87
cmp dword [ebp + 0x14], edi
lea esi, [ebp - 0x848]
jne 0x1010c58
mov eax, esi
push 0x1001a20
push eax
call dword [sym.imp.msvcrt.dll_wcstok]
pop ecx
pop ecx
mov esi, eax
push edi
push esi
call fcn.0100c981
mov ecx, dword [ebx]
inc eax
cmp ecx, eax
jae 0x1010c74
mov dword [ebx], eax
mov dword [ebp - 0x9e0], 1
jmp 0x1010c87
push ecx
push esi
push dword [ebp - 0x9e8]
call fcn.0100d336
mov dword [ebp - 0x9e0], eax
push dword [ebp - 0x9dc]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, dword [ebp - 0x9e0]
jmp 0x1010caf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1010cad
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100c0cd
leave
ret 0x10
Function at 0x10110c9
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x1011224
push esi
call fcn.01010e8f
cmp eax, 1
je 0x1011224
push esi
mov dword [ebp + 8], esi
call fcn.01010a20
cmp eax, 1
jne 0x1011103
add esi, 4
mov dword [ebp + 8], esi
push dword [ebp + 8]
call fcn.01010ff7
test eax, eax
jne 0x101111f
call fcn.0100c752
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1011258
cmp dword [ebp + 0x14], ebx
je 0x1011148
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1011148
push dword [ebp + 0x14]
push dword [ebp + 8]
push 0x1001a40
push 2
call fcn.0100d91a
add esp, 0x10
jmp 0x101115a
push dword [ebp + 8]
push 0x1001a24
push 1
call fcn.0100d91a
add esp, 0xc
test eax, eax
jne 0x101117d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1011170
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.0100c752
push 8
pop eax
jmp 0x1011258
call fcn.0100c6bf
cmp eax, ebx
jne 0x101118f
push 0x12
call fcn.0100c64e
jmp 0x1011199
push ebx
push ebx
push eax
push 0x12
call fcn.0100d62a
mov edx, eax
cmp edx, ebx
je 0x101115e
push edi
push 8
pop ecx
push ebx
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 0x10]
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edx
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
cmp esi, ebx
pop edi
je 0x10111ea
cmp esi, 0x4b8
je 0x10111e3
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.0100c752
jmp 0x1011252
call fcn.0100d9ac
jmp 0x1011252
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
call fcn.01010cc5
push eax
call fcn.0100c89a
test eax, eax
jne 0x1011252
push dword [ebp + 8]
call fcn.010110ac
push 0x1580
call fcn.0100e8a3
push eax
call fcn.0100c6eb
mov esi, 0x4b8
jmp 0x1011252
cmp dword [ebp + 0xc], ebx
je 0x1011256
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1011256
push 0x157e
call fcn.0100e8a3
push eax
call fcn.0100c6eb
mov esi, 0xa0010001
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x1011258
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x1011284
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
call ebx
mov edi, dword [ebp + 8]
test edi, edi
je 0x101140e
push 0
push edi
call fcn.0100c981
test eax, eax
je 0x101140e
xor esi, esi
inc esi
cmp dword [ebp + 0x1c], esi
jne 0x10112ed
cmp dword [ebp + 0xc], 0
je 0x10112d3
cmp dword [ebp + 0x10], 2
jb 0x10112d3
cmp dword [ebp + 0x14], 0
je 0x10112d3
cmp dword [ebp + 0x18], 2
jae 0x10112ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10112e1
push 0x57
call ebx
call fcn.0100c752
xor eax, eax
jmp 0x1011411
push edi
mov dword [ebp - 4], edi
call fcn.01010a20
cmp eax, esi
jne 0x1011300
lea eax, [edi + 4]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], esi
jne 0x1011331
cmp dword [ebp + 0x14], 0
je 0x1011331
push 0
push esi
push 0x10015b4
push dword [ebp + 0x14]
call fcn.0100c9a2
test eax, eax
jne 0x1011331
push dword [ebp - 4]
call fcn.01010ff7
test eax, eax
jne 0x1011425
jmp 0x10112e1
push dword [ebp - 4]
and dword [ebp - 8], 0
call fcn.01010ff7
test eax, eax
je 0x10112e1
cmp dword [ebp + 0xc], 0
je 0x1011376
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1011376
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push edi
call fcn.01011263
cmp dword [ebp + 0x1c], esi
mov edi, eax
jne 0x1011385
mov dword [ebp - 8], esi
jmp 0x1011385
push 0
push 0
push edi
mov dword [ebp - 8], esi
call fcn.01011263
mov edi, eax
cmp edi, 0x55
jne 0x1011395
push 0x50010001
call ebx
mov eax, esi
jmp 0x1011411
test edi, edi
jne 0x10113a1
cmp dword [ebp - 8], esi
je 0x101138a
push edi
jmp 0x101138f
mov eax, 0x4c3
cmp edi, eax
ja 0x10113ce
je 0x10113cb
cmp edi, 0x34
je 0x10114bd
cmp edi, 0x56
je 0x1011418
cmp edi, 0x4be
je 0x10114bd
jmp 0x10112e1
push eax
jmp 0x101138f
cmp edi, 0x4cf
jb 0x10112e1
cmp edi, 0x4d1
jbe 0x10114bd
cmp edi, 0x52e
je 0x1011418
mov esi, 0xa0010001
cmp edi, esi
jne 0x10112e1
push 0x157e
call fcn.0100e8a3
push eax
call fcn.0100c6eb
push esi
call ebx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x18
cmp dword [ebp + 0x1c], 0
je 0x10112e6
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1011448
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x10112e1
push dword [ebp + 0xc]
push 0x157d
call fcn.0100e8a3
push eax
push esi
push esi
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x20
push eax
call fcn.0100e750
add esp, 0x14
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0100d3bc
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call fcn.01011263
mov edi, eax
test edi, edi
je 0x1011391
cmp edi, 0x34
je 0x10114bd
cmp edi, 0x4be
je 0x10114bd
mov eax, 0x4c3
cmp edi, eax
je 0x10113cb
cmp edi, 0x4ce
jbe 0x10112e1
cmp edi, 0x4d1
ja 0x10113ee
push 0x4c6
call ebx
call fcn.0100c752
push edi
call ebx
jmp 0x10112e6
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40301c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x403028
push 0x403024
push 0x403020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x403028]
push dword [0x403024]
push dword [0x403020]
mov dword [0x403014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.004019dd
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
mov eax, dword [fcn.00401a44]
mov edx, dword [0x4030dc]
sub edx, eax
push edx
push dword [0x4030d8]
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x40132d
push edi
call fcn.004018c5
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.0040191f
mov eax, edi
add eax, 0x1ce00
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x88]
mov edx, edi
inc edx
imul eax, edx
push eax
lea eax, [0x4030e4]
mov edx, edi
dec edx
and eax, edx
push eax
call fcn.00401a44
add esp, 0x18
xor eax, eax
pop edi
leave
ret

Function at 0x4019dd
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
xor esi, esi
mov edi, esi
mov edi, 0xfffffffb
mov dword [ebp - 0x114], 0xa
mov byte [ebp - 0x10e], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xa]
push eax
push 1
push 1
lea eax, [ebp - 0x10e]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringA
lea eax, [ebp - 0xa]
push eax
call sub.KERNEL32.dll_GetModuleHandleA
movsx eax, byte [ebp - 0xa]
sub eax, 0x41
pop edi
pop esi
leave
ret
Function at 0x805dec
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805df2
pop ebp
sub ebp, 6
sub ebp, 0x405dec
jmp 0x805e50
jmp 0x805e59
mov eax, 0x405dec
add eax, ebp
add eax, 0x93
mov ecx, 0x62f
mov edx, 0x49a6aa35
xor byte [eax], dl
inc eax
dec ecx
jne 0x805e70
jmp 0x805e83
pop edi
jne 0x805ee3
xor eax, 0x5d353525
xor eax, 0xb43519f9
lds esp, [esi - 0x4b0cc6cf]
lds esp, [esi + 0x6f33931]
cmc
retf 0x35a0
fcomp qword [0x60353535]
popal
push 0x353db0be
xor eax, 0x39a0be35
xor eax, 0xb8be3535
and eax, 0xf4353535
fdiv qword [edi]
add al, 0x37
mov dh, 0xf7
xor dword [edx + edi - 0x50], edi
ror edx, 0xca
retf 0xf768