joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x429650
cmp dword [edi], 0
jne 0x41d29c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x42964c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4284f0
mov ecx, 2
call fcn.0040270c
mov edx, 0x41d1f8
lea eax, [esi + 5]
call fcn.0041d218
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041d218
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41d271
mov dword [0x42964c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41d3a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41d3f0]
test si, 4
je 0x41d3b4
or bl, 1
test si, 8
je 0x41d3be
or bl, 4
test si, 1
je 0x41d3c8
or bl, 8
test si, 2
je 0x41d3d2
or bl, 0x10
test si, 0x10
je 0x41d3dc
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41d3eb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x421330
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x429628]
cmp byte [eax + 0x7f], 0
jne 0x421383
cmp dword [0x429654], 0
jne 0x42135f
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x4212ec
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x429654], eax
cmp dword [0x429658], 0
jne 0x421383
push esp
push 0
push 0
push 0x42129c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x429658], eax
pop edx
ret

Function at 0x421388
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x429654], 0
je 0x42139c
mov eax, dword [0x429654]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [0x429654], eax
cmp dword [0x429658], 0
je 0x4213b9
push 0
mov eax, dword [0x429658]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [0x429658], eax
ret
Function at 0x421458
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x42146f
add esp, 0xfffffff0
call fcn.00402c24
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0040d3ec
mov dl, 1
mov eax, 0x407b14
call fcn.00402a24
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, 0x407b14
call fcn.00402a24
mov dword [ebx + 0x80], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x3c], 0x80000018
mov dword [ebx + 0x54], 0x1f4
mov dword [ebx + 0x58], 0x32
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, 0x417c7c
call fcn.0041b850
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x4215b0
mov eax, dword [0x429014]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041bbdc
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x4227e0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x429014]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00405a04
test eax, eax
je 0x42154c
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00405918
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.004059e4
test eax, eax
je 0x421560
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403450
cmp byte [0x429034], 0
jne 0x421590
mov eax, ebx
call fcn.00421640
mov byte [ebx + 0x39], 1
mov byte [ebx + 0x3a], 1
cmp byte [ebp - 1], 0
je 0x4215a8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422048
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x7e], 0
je 0x42207a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x20]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004033d4
jmp 0x422084
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.00403388
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4229b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x4229f0
mov eax, esi
call fcn.00415848
test al, al
je 0x4229f0
mov eax, dword [ebx + 0x60]
call fcn.004156d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4229f0
push 0
mov eax, dword [ebx + 0x60]
call fcn.004156d4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x423094
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040362c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4230eb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, 0xf0bd
mov dl, 1
mov eax, 0x422cbc
call fcn.004065d8
call fcn.00403010
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00422d60
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x427354
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4275b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4275d0
call fcn.00403388
call fcn.004272c4
mov ebx, eax
xor edx, edx
push ebp
push 0x42757e
push dword fs:[edx]
mov dword fs:[edx], esp
cmp bl, 0x40
je 0x4274fa
lea eax, [ebp - 4]
call fcn.00403638
mov byte [eax], bl
xor ecx, ecx
mov dl, 1
mov eax, 0x426d3c
call fcn.0041e008
mov dword [0x429694], eax
xor eax, eax
push ebp
push 0x4274f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4275e8
lea eax, [ebp - 8]
call fcn.00403388
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403404
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00403470
lea eax, [ebp - 8]
mov edx, 0x427638
call fcn.00403470
lea eax, [ebp - 8]
mov edx, 0x427680
call fcn.00403470
mov edx, dword [ebp - 8]
mov eax, dword [0x429694]
mov eax, dword [eax + 0x1b0]
call fcn.00412050
lea edx, [ebp - 0xc]
mov eax, dword [0x429628]
call fcn.0042262c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004057c0
mov edx, dword [ebp - 8]
mov eax, dword [0x429694]
mov eax, dword [eax + 0x1b8]
call fcn.00424fb8
mov eax, dword [0x429694]
call fcn.00420cac
jmp 0x4274c4
mov eax, dword [ebp - 4]
call fcn.00405778
test al, al
je 0x427490
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403404
lea eax, [ebp - 8]
mov edx, 0x4276a0
call fcn.00403470
mov eax, dword [ebp - 8]
call fcn.00405778
test al, al
je 0x427490
push 3
mov eax, dword [ebp - 4]
call fcn.0040362c
push eax
call sub.kernel32.dll_WinExec
call fcn.00406514
jmp 0x4274ba
mov eax, ebx
sub al, 0x41
inc eax
call fcn.00405854
inc eax
jle 0x4274ba
push 0x2040
push 0x4276ac
push 0x4276c8
mov eax, dword [0x429628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, dword [0x429694]
call fcn.00420cac
mov eax, dword [0x429694]
cmp dword [eax + 0x128], 1
je 0x42744a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427574
mov eax, dword [0x429694]
call fcn.00420ea8
call fcn.00406514
ret
xor ecx, ecx
mov dl, 1
mov eax, 0x427034
call fcn.0041e008
mov dword [0x429698], eax
xor eax, eax
push ebp
push 0x42756d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x429628]
call fcn.0042262c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004057c0
mov edx, dword [ebp - 8]
mov eax, dword [0x429698]
mov eax, dword [eax + 0x1b8]
call fcn.00424fb8
mov eax, dword [0x429698]
call fcn.00420cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427574
mov eax, dword [0x429698]
call fcn.00420ea8
call fcn.00406514
ret
Function at 0x4277e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4278da
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0042770c
cmp dword [ebp - 8], 0
jne 0x42784e
lea eax, [ebp - 4]
mov edx, 0x4278f0
call fcn.00403388
lea eax, [ebp - 4]
mov edx, 0x427930
call fcn.00403470
push 0x2024
push 0x427954
mov eax, dword [ebp - 4]
call fcn.0040362c
push eax
mov eax, dword [0x429628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_MessageBoxA_1
cmp ax, 6
jne 0x4278bf
call fcn.00427354
jmp 0x4278bf
mov eax, dword [ebp - 8]
call fcn.00405778
test al, al
jne 0x4278af
lea eax, [ebp - 4]
mov edx, 0x427978
call fcn.00403388
push dword [ebp - 4]
push 0x4279c0
push 0x427a10
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403528
push 0x2024
push 0x427954
mov eax, dword [ebp - 4]
call fcn.0040362c
push eax
mov eax, dword [0x429628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_MessageBoxA_1
cmp ax, 6
jne 0x4278bf
call fcn.00427354
jmp 0x4278bf
push 3
mov eax, dword [ebp - 8]
call fcn.0040362c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4278e1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403314
ret
Function at 0x401000
Capabilities:
Create process on windows
Enumerate processes
Read .ini file

Disassembly:
sub esp, 0x414
lea ecx, [esp + 4]
push ebx
call fcn.004013da
lea ecx, [esp + 0x10]
call fcn.004013da
lea ecx, [esp + 0xc]
call fcn.004013da
lea ecx, [esp + 4]
call fcn.004013da
lea ecx, [esp + 0x14]
call fcn.004013da
lea eax, [esp + 0x314]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea ecx, [esp + 0x218]
push 0
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x320]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator
lea edx, [esp + 0x214]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator
lea eax, [esp + 0x10]
push str.TaskFile.ini
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x28]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea eax, [esp + 0x24]
push eax
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14c]
push ecx
push 0xc8
push edx
push 0x403050
push 0x40302c
push 0x403020
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x14c]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::operator
mov ebx, dword [sym.imp.MSVCRT.dll__mbscmp]
push 0x403050
mov ecx, dword [esp + 8]
push ecx
call ebx
add esp, 8
test eax, eax
jne 0x401154
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
xor eax, eax
pop ebx
add esp, 0x414
ret 0x10
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call edi
push 0x2710
call edi
push 0x2710
call edi
push 0x2710
call edi
push 0x2710
call edi
push 0x2710
call edi
push 0
push 2
mov dword [esp + 0x34], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4011ec
lea edx, [esp + 0x2c]
push edx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4011dd
lea eax, [esp + 0x50]
lea ecx, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CString::operator
push str.MP860RunPro.exe
mov ecx, dword [esp + 0x20]
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40117f
lea edx, [esp + 0x2c]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4011ad
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x40117f
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x414
ret 0x10
Function at 0x4220c2
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x64
stosb byte es:[edi], al
push ebx
cmc
arpl word [eax - 0x4f0f0b15], ax
std
mov dh, 0x7c
cdq
xlatb
outsb dx, byte [esi]
cdq
cli
pop ecx
mov edi, dword [esi]
mov edx, 0x24ac5885
jecxz 0x4220a0
xchg ebx, eax
fcomp dword [edi + esi*8 + 0x12bed49f]
mov bl, 0x64
cmovnp eax, esp
or ebp, ebx
mov cl, ch
stosb byte es:[edi], al
cmp dl, ah
pushfd
push ebp
inc ecx
xchg dword [eax], esi
mov eax, dword [0xee30d5ba]
daa
and dword [edx + 0x7c], esi
in al, dx
mov word ss:[esi], fs
pop edx
mov eax, dword [0x31086613]
test eax, 0xb1d59c63
movsb byte es:[edi], byte [esi]
mov cl, 0x6b
mov esp, 0x20ff71ae
mov dword [edi - 0x12], edi
or al, 0xe7
invalid

Function at 0x44d7c2
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44d80e
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44d7f3
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44d803
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44d81e
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44d85d
test ebx, ebx
je 0x44d832
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44d827
cmp ecx, 0xfff1
jb 0x44d840
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44d948
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44d882
Function at 0x4a2f72
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
clc
mov bl, 0x79
or dword [edx + esi*4 - 0x699763e4], 0x7fbf91bb
fsub dword [edi + eax + 0x14]
sub al, 0xf0
jle 0x4a2f71
hlt
sahf
stc
inc eax
test eax, 0xd2667988
rcl byte [ebx], cl
sbb al, byte [ebp + 0x22]
call dword [ebx - 0x2b]
jge 0x4a2f7e
sbb eax, 0x9e291a91
jns 0x4a2fd9
rcl byte [ebx], cl
rcl byte [ebx], cl
sbb al, byte [ebp + 0x22]
call dword [ebx - 0x2b]
jge 0x4a2f7e
sbb eax, 0x9e291a91
xchg ecx, eax
sbb ch, byte [ecx]
sahf
or ebx, esi
sub esp, edi
cmp al, 0x43
scasb al, byte es:[edi]
je 0x4a2fa1
ljmp 0x9b0a:0x9345f069
movsb byte es:[edi], byte [esi]
cwde
adc esi, edi
jle 0x4a2f3f
xor dword [esi + 0x28c65911], eax
mov edi, 0x449d2d63
sub byte [edi + 0x449d2d63], bh
mov dword [eax], ebx
or cl, byte [esi]
xchg ebp, eax
inc edx
daa
pop edi
dec edx
xor ah, al
aad 0xc8
pop ecx
jg 0x4a3029
mov dh, 0x8d
sal dword [ecx - 0x38fe90c7], 0x47
fld dword [edi + 0x1c8b561d]
sal dword [edi - 0x65d887cf], 0x3f
invalid
fdiv st(3)
pop ecx
jg 0x4a2f6c
mov edi, eax
arpl word [eax], bx
imul edx, esp, 0xa0393c7e
and dword [ebp + 0x706a2852], eax
jnp 0x4a2fac
jno 0x4a3001
jo 0x4a3070
sub dword [0x69491476], 0xffffffca
dec ebp
salc
dec esp
je 0x4a3054
sbb byte [ecx - 0x1dc3c7e6], 0xfa
cdq
sbb bh, byte [eax]
cmp al, 0xe2
cli
test dword [edx - 0x2d], esp
cdq
in eax, dx
scasd eax, dword es:[edi]
sbb eax, 0x18a52646
or edi, edi
mov ebx, 0xe95e4a8f
xor al, 0xa6
jl 0x4a300c
lea ecx, [ebx - 0x26]
xchg ecx, eax
leave
pop esi
les ebx, [ebp + 8]
mov cl, byte [ecx + 0x2ed732c6]
jnp 0x4a307d
xor dl, bh
jnp 0x4a307d
test eax, 0x61c788db
push edx
mov eax, dword [0xaa6cf747]
inc edx
mov ebx, dword [esi - 0x65]
in eax, 0x7d
mov esp, 0xae0ded74
mov esp, 0xd82763d
sub byte [0xff284228], 0xa5
push esp
xor byte [ecx], ah
fcom dword [eax]
stc
dec ecx
dec esi
dec eax
push edx
invalid
test al, 0x18
mov ds, word [edi + 0x6b94e45d]
shr dword [ecx + ebx - 0x78], 1
jecxz 0x4a309f
and dword [0xe86782b4], esp
and eax, 0xe86782b4
inc byte [edx]
in eax, dx
movsd dword es:[edi], dword [esi]
in eax, dx
mov esi, 0x37188dfd
invalid
xor edi, ebx
lea edi, [eax - 0x4543f972]
imul eax, dword [ebp + 0x34], 0x6b88c70d
popal
sub ebx, dword [ecx - 0x62e2acf8]
fdivr dword [ebx + 0x3a]
int 0x7d
invalid
Function at 0x4e2802
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e284e
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e2833
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e2843
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e285e
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e289d
test ebx, ebx
je 0x4e2872
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e2867
cmp ecx, 0xfff1
jb 0x4e2880
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e2988
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e28c2
Function at 0x4f6ac2
Capabilities:
Encode data using xor

Disassembly:
jp 0x4f6ad8
dec esp
sar byte [ecx + ecx*4 + 0x65], 1
pushfd
or byte [ecx + 0x5853c69e], ch
ret 0x2e81
jbe 0x4f6b2c
push 0x989dac9
push ecx
ja 0x4f6a75
mov ch, cl
sub dl, bl
lahf
clc
and al, 0xa8
sbb eax, dword [0x690ef969]
mov ebp, 0x574a6356
xor dword [ecx], ecx
movzx ebp, cl
xchg esi, eax
test al, 0x89
wait
adc ebx, eax
fistp qword [eax + 0x1b38360d]
sbb ebp, dword [edx + 0x6ae2f6b3]
dec eax
stc
push cs
imul edi, dword [ebp + 0x574a6356], 0xb60f0931
jmp 0x9bd9137f
push 0x48
cmp dword [ebx + 0x2b], ebx
call 0x1388939a
mov ebp, ecx
popfd
sti
xor dword [bx + 0x60], ebp
jl 0x4f6af6
push es
sub byte [ebp + 0x2a], dh
dec dword [eax + ebx*2 + 0x48083c3a]
push cs
into
push cs
dec byte [edx]
xor dword [eax + 0x676fc67d], edx
popal
cli
int1
out 0x9e, eax
fistp word [eax - 0x165d0454]
cmp dword [edx - 0x135d360c], edi
mov edx, 0xeca2c9f4
sti
test al, 0xc6
cmp al, 0x9c
retf 0x3e0b

Function at 0x4f8e52
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0xac49fab0
mov dword [0x2fe87aca], eax
cdq
inc esi
pop es
stc
std
mov esp, 0xb098099
add al, 0xe4
test dword [ecx + 0x311cd7b6], ebp
int 0xb8
sub byte [ecx], ah
or byte [eax + 0x2144cfe9], bl
adc edi, dword [esi]
mov dl, 0x68
mov eax, dword [0x81c6fd93]
fcomi st(6)
stosd dword es:[edi], eax
mov bl, 0x88
jae 0x4f8dbb
xchg al, ch
cmp byte [ebp - 0x42399646], 0x68
sub al, 0xf9
lodsd eax, dword [esi]
mov word [ebx], cs
imul edx, ebx, 0xaa09ae82
dec ecx
or byte [eax + 0x1c], dl
push 0xf419bda2
mov bl, 0x83
xor cl, dh
rcl byte [ecx], 0x61
sal dword [eax + ebp*4], 1
aad 0xd0
imul ebx, dword [ebx], 0x23bbd00
cmc
cld
test al, 0xd5
shr byte [ecx + 0x1b], 1
add byte [ebp - 0x30afdc5], bh
js 0x4f8d13
fisttp dword [ecx - 0x60cde5da]
aam 0xc4
mov eax, ebp
xor bl, byte [edi - 0x17763b2c]
jnp 0x4f8d80
or byte [ecx - 0x251515b9], bh
into
mul dword [ebp + 0x68cb90c5]
pop ss
sbb byte [edx - 0x7f039365], ch
mov dword [ecx], esp
sub dword [esi - 5], edx
mov edi, 0x9acd69ad
jmp 0x4f8d47
jle 0x4f8dc3
inc esi
add esp, dword [ecx + 0x29]
fst dword [esi - 0x2a]
xchg ebp, eax
retf
jle 0x4f8d6f
mov ebx, 0xd437acf9
mov eax, 0x24594d9c
inc ecx
pushal
add byte [edx + 0x1e], bh
jg 0x4f8e1e
jns 0x4f8dfe
mov bh, dl
rol ecx, 1
dec ecx
or dword [ebx - 0x71], ecx
js 0x4f8db8
dec ebx
invalid
mov ebp, 0xd8b3ed6
inc esp
jmp 0xd03457ea
test al, 0x2a
cmp al, 0xba
imul eax, eax, 0xf9b873b3
jb 0x4f8e20
pop ds
xor byte [edx - 0x15], dh
aaa
pop ss
adc cl, al
push ss
push ecx
sub byte [eax + 1], bl
dec ebx
arpl word [eax], bp
and eax, 0x57f77380
push eax
invalid
inc esi
jne 0x4f8de2
cmp al, ah
stosb byte es:[edi], al
inc esp
sal byte [edx + ecx*2], 1
sbb cl, dl
jmp 0xe7278ba7
Function at 0x501952
Capabilities:
Encode data using xor

Disassembly:
into
stc
adc al, 0xfc
retf 0x291b
imul ebp, eax, 0x59ff94da
jbe 0x50192c
imul eax, dword [esi + 0x15a89529], 0x3758411b
mov esp, 0x998e96f9
aas
in eax, dx
cld
loope 0x5019d4
loop 0x5019cf
and byte [ebx], ah
push ss
lahf
test eax, 0x29111515
sub eax, 0xdda2eeaa
sub dword [0xdda2eeaa], ebp
invalid
cmp dword [esi - 0x6b91d9d3], 0x7845a4e8
jge 0x5019eb
xchg esp, eax
call 0x7dc85f7e
adc byte [ebx + 0x78], ch
popfd
pop ecx
imul edi, dword [eax - 0x63], 0x59
mov ebx, 0xb888758c
inc ecx
jbe 0x501978
int3
scasb al, byte es:[edi]
xlatb
invalid
Function at 0x541632
Capabilities:
Encode data using xor

Disassembly:
enter 0x4696, 0x6f
or al, 0x2a
mov ebx, 0xb6ca9403
inc esi
ljmp 0x44f3
xlatb
xor ebp, edi
out dx, eax
out dx, eax
aas
test eax, 0x1b17e6ce
jne 0x541630
inc esi
sub dword [edx + 0x5dea6aea], edx
les esp, [ebp + 0x336ffd3f]
jne 0x5415ff
pop edx
lodsd eax, dword [esi]
xchg edi, eax
push cs
invalid
Function at 0x58c042
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
xchg ebp, ebp
pushal
insb byte es:[edi], dx
mov ebp, 0xb2f80324
nop
invalid
add edx, edi
dec edx
xor ah, al
pushal
cmp al, 0xef
jge 0x58c06d
pop edi
mov al, 0xde
xchg ebx, eax
xor dh, byte [ebx + 0x2a33d41d]
insd dword es:[edi], dx
mov esp, 0x63124676
cmp eax, 0x3dbc6d
inc ebx
mov ebx, dword [ebx + ebp*4 + 0x53583417]
lea edi, [eax - 0xce6625e]
mov ebp, 0x31f27272
shl dword [edx - 0x1e], 0x3f
js 0x58c0ae
outsd dx, dword [esi]
int3
cld
aas
mov ecx, 0x7e7dfd73
jle 0x58bfde
leave
mov ch, 0x65
dec edi
add al, 0x59
jle 0x58bfde
leave
mov ch, 0x65
dec edi
add al, 0x59
pop ss
and ecx, ecx
cmp eax, 0x34142aad
or edx, dword [edx + 0x30ed40cb]
mov byte [edx - 0x7e], dl
inc ebx
jl 0x58bff7
mov cl, 0x71
xchg esi, eax
mov ecx, 0xa29d92fd
jo 0x58c0ca
jecxz 0x58c03c
push ds
rol edx, 1
sub byte [0xd00fd862], 0x87
bnd retf
dec edx
mov ah, byte [edx - 0x53ff01dd]
sbb dword [bx + di + 0xfb6], edx
xchg edx, eax
shl dword [edx - 0x4e], cl
lcall 0x687d, 0x107fad6f
mov bl, 1
add al, 0xc1
jbe 0x58c130
mov dh, 0x28
mov dh, 0x28
or eax, 0x7829d799
cmc
xchg esi, eax
sbb ch, al
sbb ah, ch
sub dh, byte [ebx + 0x47bed5bc]
fadd dword [eax - 0x45d30ce8]
xchg edx, eax
mov ss, word [ebp + 0x7a5b5184]
xlatb
jp 0x58c113
jp 0x58c113
and al, byte [eax + 0x4c]
inc eax
dec esp
xor esp, edi
jle 0x58c0ef
jae 0x58c171
nop
xchg esi, eax
out dx, al
in al, 0x61
jne 0x58c0f0
xchg byte [ecx - 0xd], cl
insb byte es:[edi], dx
invalid
sbb al, 0xb0
in al, 2
arpl word [ebp - 0x30bf05ba], cx
cmp al, 0xc3
or dword cs:[esi + 0x68], ebx
fdivr st(4), st(0)
invalid
cmp al, 0x28
popfd
push ds
xchg ebp, eax
daa
popal
and dword [esi], ebp
and dword [ebp - 0x360f532f], edi
mov al, byte [0x82399052]
cmp dword [edx - 0x6a990d5a], eax
scasb al, byte es:[edi]
sbb byte [edi + 0xfce1126], cl
mov esp, dword [eax]
invalid