joyce8/EMBER2024-capa huggingface dataset:
Function at 0x506f84
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [esp + 0x60], 0xffffffff
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov ebx, dword [esp + 0x78]
jne 0x506fb3
call fcn.004dccc9
mov dword [ebx], 0x2719
jmp 0x506fd0
cmp edi, 0xa5100000
sete dl
cmp esi, 2
jne 0x506fdb
test dl, dl
je 0x506fdb
call fcn.004dccc9
mov dword [ebx], 0x2726
mov dword [ebx + 4], eax
or eax, 0xffffffff
jmp 0x50707d
cmp esi, 1
jne 0x507013
test dl, dl
je 0x507013
cmp dword [esp + 0x74], 4
jne 0x506fc5
cmp dword [ebp], 0
je 0x506ff6
or byte [eax], 4
jmp 0x506ff9
and byte [eax], 0xfb
lea ecx, [esp + 0x38]
call fcn.0062d0ac
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], edx
jmp 0x50707d
cmp edi, 0xffff
jne 0x507026
cmp esi, 0x80
jne 0x507026
or byte [eax], 8
call fcn.00614c34
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_setsockopt]
sub esp, 0x14
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00614c10
test eax, eax
jne 0x50707d
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], eax
call fcn.0062d0ac
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
mov dword [ebx], esi
mov dword [ebx + 4], edi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x507aa0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x58]
mov ebx, dword [esp + 0x5c]
cmp ebp, 0xffffffff
jne 0x507acb
call fcn.004dccc9
mov dword [ebx], 0x2719
mov dword [ebx + 4], eax
or eax, 0xffffffff
jmp 0x507b24
call fcn.00614c34
mov eax, dword [edi]
lea esi, [esp + 0x28]
mov dword [esp], ebp
mov dword [esp + 8], esi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_getsockname]
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [edi], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00614c10
test eax, eax
jne 0x507b24
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.0062d0ac
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 4], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x50974c
Capabilities:
Create thread

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
sub esp, 0x10
test eax, eax
mov esi, eax
mov dword [ebx + 4], eax
jne 0x5097ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
call fcn.004dccc9
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], 0x739ae1
mov dword [esp + 0x28], ebp
mov dword [esp], eax
call fcn.00614ee8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 4], eax
sub esp, 0x10
mov dword [ebx + 8], eax
cmp dword [edi + 4], 0
jne 0x50981e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
call fcn.004dccc9
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], 0x739af4
mov dword [esp + 0x28], ebp
mov dword [esp], eax
call fcn.00614ee8
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x501bbc
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x54]
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
test eax, eax
mov dword [edi], eax
jne 0x5098ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test esi, esi
je 0x50987a
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov eax, dword [edi + 4]
test eax, eax
je 0x50988b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call fcn.004dccc9
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], 0x739b06
mov dword [esp + 0x28], ebp
mov dword [esp], eax
call fcn.00614ee8
test esi, esi
je 0x5098cd
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push eax
push eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x50eab6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, ecx
sub esp, 0x50
cmp dword [ecx + 0x24], 0
jne 0x50eb6a
lea esi, [ecx + 8]
mov dword [esp + 4], 0
mov dword [esp], 0x5c
mov ecx, esi
call fcn.0064af60
push edx
push edx
inc eax
lea ecx, [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.0064b1c0
lea eax, [ebp - 0x24]
sub esp, 0xc
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x28]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea ecx, [ebp - 0x20]
sub esp, 0x14
mov esi, eax
call fcn.006bfc70
test esi, esi
je 0x50eb48
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x24], eax
imul eax, dword [ebp - 0x30]
mov dword [ebx + 0x28], eax
jmp 0x50eb6a
mov dword [ebx + 0x24], 0x200
mov dword [ebx + 0x28], 0x1000
jmp 0x50eb6a
mov eax, dword [ebx + 0x24]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x50eb74
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x9c
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x70]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
push ecx
push ecx
je 0x50eca6
lea esi, [ebp - 0x4c]
mov ecx, esi
call fcn.005f8384
cmp dword [ebp - 0x3c], 0
je 0x50ec5f
mov eax, dword [ebp - 0x70]
cmp byte [ebp - 0x7c], 0
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x58], eax
mov eax, 0
mov dword [esp + 0x14], 0x20
cmovne eax, esi
mov dword [ebp - 0x54], edx
mov dword [esp + 0xc], 0x10
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x74]
mov dword [esp + 4], 0x940cf
mov dword [esp], edi
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x38]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x60]
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
sub esp, 0x20
test eax, eax
sete bl
and bl, byte [ebp - 0x7c]
je 0x50ec44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x50ec79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, 1
jmp 0x50ec5f
test eax, eax
je 0x50ec3a
cmp dword [ebp - 0x74], 0x10
jne 0x50ec40
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
xor edx, dword [ebp - 0x30]
xor eax, dword [ebp - 0x2c]
or edx, eax
setne bl
mov ecx, esi
call fcn.0050df7c
jmp 0x50eca6
mov dword [ebp - 0x68], 0
call fcn.004dccc9
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x68]
mov dword [esp], edi
mov ecx, esi
mov dword [esp + 4], eax
call int.005f82ec
cmp dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
push edx
push edx
jne 0x50ec5f
jmp 0x50ec48
lea esp, [ebp - 0xc]
mov al, bl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x50f9ce
Capabilities:
Get file size

Disassembly:
push esi
push ebx
sub esp, 0x24
lea eax, [esp + 0x18]
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
push edx
push edx
jne 0x50fa0a
call fcn.004dccc9
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
or eax, 0xffffffff
mov dword [ebx + 4], esi
mov edx, eax
jmp 0x50fa12
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add esp, 0x24
pop ebx
pop esi
ret 4
Function at 0x5313c4
Capabilities:
Encode data using xor

Disassembly:
add ecx, 0x108
jmp fcn.005fe34c
Function at 0x589778
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x857f30]
test eax, eax
jne 0x5897a8
sub esp, 0x4c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push eax
mov eax, dword [esp + 0x20]
mov edx, 0x1000
test eax, eax
cmovle eax, edx
mov dword [0x857f30], eax
add esp, 0x4c
ret

Function at 0x58e013
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 4]
add ebx, dword [edi]
cmp eax, ebx
je 0x58e108
sub ebx, eax
mov edx, 3
mov byte [ebp - 0x1f], 0
cmp ebx, 3
mov byte [ebp - 0x1e], 0
mov byte [ebp - 0x1d], 0
cmovge ebx, edx
xor edx, edx
lea edi, [eax + ebx]
mov dword [ebp - 0x2c], edi
mov ecx, ebx
sub ecx, edx
test ecx, ecx
jle 0x58e077
mov cl, byte [eax + edx]
mov byte [ebp + edx - 0x1f], cl
inc edx
jmp 0x58e065
mov dl, byte [ebp - 0x1f]
xor edi, edi
mov al, dl
shl edx, 4
shr al, 2
and edx, 0x30
mov byte [ebp - 0x1c], al
mov al, byte [ebp - 0x1e]
mov cl, al
shl eax, 2
shr cl, 4
and eax, 0x3c
or edx, ecx
mov byte [ebp - 0x1b], dl
mov dl, byte [ebp - 0x1d]
mov cl, dl
and edx, 0x3f
shr cl, 6
mov byte [ebp - 0x19], dl
or eax, ecx
mov byte [ebp - 0x1a], al
cmp edi, ebx
jle 0x58e0c1
mov eax, 3
xor edi, edi
sub eax, ebx
mov ebx, eax
jmp 0x58e0eb
movzx eax, byte [edi + ebp - 0x1c]
mov ecx, esi
movsx eax, byte [eax + 0x7415a0]
mov dword [esp], eax
call fcn.006bf180
inc edi
push edx
jmp 0x58e0b0
mov dword [esp], 0x3d
mov ecx, esi
call fcn.006bf180
push eax
inc edi
cmp edi, ebx
mov eax, dword [ebp - 0x2c]
jl 0x58e0db
jmp 0x58e034
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5a288a
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea eax, [ecx + 0x4a0]
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x250]
lea edi, [ebp - 0x2ac]
sub esp, 0x31c
mov dword [esp], eax
call fcn.0062de44
lea eax, [ebp - 0x250]
push ecx
lea ecx, [ebp - 0x2f0]
mov dword [esp], eax
call fcn.005a0548
lea ecx, [ebp - 0x24c]
push esi
call fcn.005a079a
mov ecx, edi
call fcn.0058e9ce
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax + 0xa0]
add eax, 0x100
mov dword [ebp - 0x304], eax
mov eax, dword [ebx + 0x650]
add eax, 0xc0
mov dword [ebp - 0x300], eax
call fcn.00510b9a
and eax, 0x1ff
mov ecx, edi
mov dword [ebp - 0x2fc], eax
call fcn.0058ea60
mov dword [esp + 4], 4
mov dword [esp], 0x742339
mov ecx, edi
call fcn.0058ea0c
mov eax, dword [ebp - 0x300]
push edx
mov ecx, edi
push edx
mov dword [esp + 4], 0x60
mov dword [esp], eax
call fcn.0058ea0c
lea esi, [ebp - 0x2e8]
push eax
push eax
mov ecx, esi
mov dword [esp], edi
call fcn.0058ea34
mov ecx, 5
push eax
lea edi, [ebp - 0x250]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2ac]
mov ecx, esi
call fcn.0058ea60
mov dword [esp + 4], 4
mov dword [esp], 0x74233e
mov ecx, esi
call fcn.0058ea0c
push eax
push eax
mov ecx, esi
mov eax, dword [ebp - 0x304]
mov dword [esp + 4], 0x14
mov dword [esp], eax
call fcn.0058ea0c
push eax
push eax
lea ecx, [ebp - 0x2d4]
mov dword [esp], esi
call fcn.0058ea34
push eax
mov ecx, esi
call fcn.0058ea60
mov dword [esp + 4], 4
mov dword [esp], 0x742343
mov ecx, esi
call fcn.0058ea0c
push eax
push eax
mov ecx, esi
mov eax, dword [ebp - 0x300]
mov dword [esp + 4], 0x60
mov dword [esp], eax
call fcn.0058ea0c
push edi
push edi
lea ecx, [ebp - 0x2c0]
mov dword [esp], esi
call fcn.0058ea34
push ecx
xor eax, eax
mov dl, byte [ebp + eax - 0x2c0]
xor dl, byte [eax + ebp - 0x2d4]
lea esi, [ebp - 0x2c0]
mov byte [ebp + eax - 0x2c0], dl
inc eax
cmp eax, 0x14
jne 0x5a2a01
lea eax, [ebp - 0x23c]
mov ecx, 5
mov edi, eax
mov eax, dword [ebp - 0x304]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x300]
mov dword [esp], eax
call fcn.005a2008
push edx
push edx
lea edi, [ebp - 0x228]
mov eax, dword [ebx + 0x650]
mov dword [ebx + 0x650], 0
mov dword [esp + 4], 0x134
mov dword [esp], eax
call fcn.006eb350
mov eax, dword [ebp - 0x2fc]
mov edx, 3
mov ecx, ebx
lea esi, [eax + 0x10]
mov eax, dword [ebx + 0x108]
movzx eax, byte [eax + 0x18fe]
mov dword [esp + 4], esi
mov dword [esp], edi
test al, 3
cmove eax, edx
mov edx, dword [ebp - 0x2fc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call fcn.005a275c
mov ecx, dword [ebx + 0x654]
sub esp, 0x10
mov eax, dword [ecx]
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [eax + 8]
push eax
push eax
mov ecx, ebx
mov eax, dword [ebp - 0x2fc]
mov edx, dword [ebx]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
add eax, 0x38
mov dword [esp + 4], eax
lea eax, [ebp - 0x250]
mov dword [esp], eax
call dword [edx + 0x34]
lea ecx, [ebp - 0x2ec]
sub esp, 0x14
call fcn.005a07a6
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5ad870
Capabilities:
Encode data using xor

Disassembly:
invalid
jne 0x5ad824
pushfd
pushal
mov al, byte [0x1d0f47ac]
vminps xmm0, xmm4, xmmword [edi + 0x6b7dd9d]
push 0x537d0251
or dl, byte [esi]
stosd dword es:[edi], eax
aaa
test eax, 0x6547f16d
sbb edx, dword [ebx + 0x51aac314]
mov byte [0x508b0696], al
and esp, dword [edi - 8]
pop esi
lodsd eax, dword [esi]
push esi
test eax, 0x2be49c02
stc
nop
inc ebp
dec ebx
mov eax, dword [edi]
mov cl, 0x25
fidiv word [edi - 0x55]
mov ah, byte [edi + 0x73]
invalid

Function at 0x5b2418
Capabilities:
Encode data using xor

Disassembly:
and dword [esi], esi
scasd eax, dword es:[edi]
xchg edi, eax
pop es
pop esp
or byte [ebx + 0x39e22905], bl
sar ebx, 1
and byte [ebx + esi], ch
lcall 0x89c0, 0xee06c34a
inc ecx
push eax
je 0x5b249a
out dx, al
lodsb al, byte [esi]
cmp dword [edx + 0x1a9f78b9], edx
push 0xffffffffffffffb4
jp 0x5b2450
mov dl, 0x37
daa
mov byte [0xdfdc1d37], al
inc esp
shr bl, 1
outsd dx, dword [esi]
fcmovnu st(0), st(5)
xor al, 0xd0
mov edx, 0x41ad5cc3
hlt
mov ch, 0x6f
inc edi
lcall 0xf019, 0x5021d25c
lodsb al, byte [esi]
pop ebp
invalid
pop es
cmp ebp, ebp
mov bh, 0xac
xchg edx, eax
stosb byte es:[edi], al
lodsb al, byte [esi]
call 0x68af0da6
mov edx, 0xdd0911b4
dec esi
adc esi, ecx
lahf
loope 0x5b245d
ret

Function at 0x5b6b93
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
enter 0x27f1, 0x70
mov dh, 0x74
ret
mov dl, byte [ecx + 0x4e]
and eax, edx
mov dl, 0xfe
and al, byte [ecx]
mov ch, 0x10
arpl word [edi + 0x62], cx
xchg edi, eax
js 0x5b6b8c
je 0x5b6b8f
mov eax, 0xf33a855e
xor eax, 0x9200fe19
inc ecx
fiadd dword [esi - 0xf6e121f]
lea esp, [edi + ebx*2]
xor edx, dword [ebp - 0x2a13d1e3]
jl 0x5b6bb1
out 0xc, al
jmp 0x5b6b43

Function at 0x5d4d40
Capabilities:
Encode data using xor

Disassembly:
inc ebp
jle 0x5d4da7
shl dword [ebx], 1
ja 0x5d4d9b
jl 0x5d4d7e
ficomp dword [edx]
sti
pop ds
into
inc dword [edx]
invalid
xor byte [ebx], dh
imul ecx, ecx, 0xffffff90
sbb ch, dl
cmp bh, dh
mov eax, dword [0x346b9b90]
inc ebx
dec ecx
push ebx
xor eax, 0xb069ded2
or dword [ecx - 0x2a0b988f], esi
inc byte [ecx - 0x45]
jnp 0x5d4d78
jno 0x5d4de1
hlt
mov ebx, 0x59c5f77b
inc edx
lds ebx, [ecx + 0x42]
sbb dl, bh
inc ebx
sub al, 0x80
pop edx
pop ds
test dl, ch
xchg ebx, eax
jb 0x5d4d5f
xor byte [esp + esi - 0x17ec7fd6], bh
call 0xcd2744f7
pop edi
invalid
Function at 0x5f80e0
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
and ebp, dword [ebx + 0x2735d1c5]
pop ecx
aad 0xe4
lodsb al, byte [esi]
adc ecx, edi
outsd dx, dword [esi]
shl byte [edx + 0x5b2a69b5], 1
push edx
sub bl, byte [ebx + 0x52]
cmp al, 0x95
stosd dword es:[edi], eax
adc al, 1
in al, dx
xchg esi, eax
test byte [ecx + 0x3b], dh
fbstp tbyte [ebp + 0x14]
xchg edi, eax
call [ebp + 0x52]
add byte [ecx + 0x4d], 0x7b
or cl, byte [ebx + edi*4 - 0x533a774f]
cmpsd dword [esi], dword es:[edi]
bound ebp, qword [ecx + 0x20]
dec eax
dec edi
mov ah, 0xea
loopne 0x5f80f2
xchg byte [esi - 0x2a], bh
and eax, 0x17ba894e
xor al, 0xb4
jle 0x5f80a9
sbb byte [ecx], bl
sub al, 0x3d
inc edx
mov dh, 0x51
movsd dword es:[edi], dword [esi]
popal
lodsb al, byte [esi]
loop 0x5f8160
dec ecx
test al, 0x85
push ebx
scasd eax, dword es:[edi]
aad 0x63
lcall 0x51ab, 0x5ebde4d1
jge 0x5f8102
push ss
push 0x81213567
cmp ah, byte [eax + 0x67]
mov edi, 0xb3bc7dc9
and dword [ecx + 0x6567603a], eax
mov edi, 0xb3bc7dc9
mov bl, byte [eax]
arpl word [edi], bx
jmp 0x5f81af
sbb ecx, dword [eax]
mov esp, 0x127c9956
dec bh
invalid
jb 0x5f8147
xchg ecx, eax
outsb dx, byte [esi]
mov al, byte [0x60282fe9]
jmp 0x5f8222
xchg esp, eax
xchg byte [edi], bh
notrack jmp 0x760664d9
push edx
inc eax
imul ebp, dword [ecx + 0x57], 0x604a050f
test bl, dl
dec edi
jbe 0x5f81de
xor al, 0x3a
sub eax, 0x1f75ff6c
push 0xffffffffffffff9f
into
push edx
invalid

Function at 0x608810
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x47
push 0xd7c72888
push ebp
dec ebp
les edi, [ebp - 0x33c832fb]
sbb bl, al
wait
jae 0x60881f
cld
inc esp
invalid

Function at 0x61d928
Capabilities:
Encode data using xor

Disassembly:
pop edi
shl dword [edi - 0x7908ee58], cl
push es
push cs
jge 0x61d9aa
std
dec esi
push cs
cmpsb byte [esi], byte es:[edi]
jne 0x61d954
in al, dx
popal
add ebp, esi
adc dword [ecx], ebx
mov ebx, 0x40c8b6
ficom word [ecx]
xchg ebx, eax
imul ebp, dword [esi + 0x47], 0x78
imul edx, dword [ebx], 0x6d7b3779
jae 0x61d9c5
and edx, dword [edx + esi*8 + 0x321436d2]
xchg esp, eax
sal byte [esi], cl
adc al, 0x32
mov ch, 0x77
aas
mov byte [0x3f52a55c], al
mov edx, 0x41119ec4
dec edx
das
aaa
lodsd eax, dword [esi]
push ebx
or dword [edi], esi
and al, 0xc4
dec edx
int 0xa2
mov dh, 0xe8
cld
mov dh, byte [edi + eax]
push cs
fldl2e
push esi
inc esp
test byte [eax - 0x50], 0xf7
and ah, byte [edi + 0x7a2b374d]
sub eax, 0x5ff0fd76
cmp ch, ah
dec eax
push ecx
push cs
enter 0x76cc, 0x1a
dec ebp
invalid
les ebp, [ebp - 0x34]
mov cs, word [eax - 0x51a1067d]
cmp byte [esi + 0x22b34ac1], al
Function at 0x62bae0
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
cmp al, 0x1e
loopne 0x62bb5b
retf 0xcea3
in al, 0x94
call 0xbea703a9
dec edx
iretd
dec edx
dec eax
inc esp
mov esi, 0x690ccf4a
out 0x11, eax
lahf
adc al, 0xd4
xor byte [esi - 0x70fbfd14], bh
fld qword [esi - 0x2d]
inc ecx
or byte [ebp + 0x528c0cac], 0x60
push es
jb 0x62bb58
lcall 0xbde1, 0x19479ef8
pop ds
imul esp, dword [eax], 0xffffffbb
mov eax, dword [0xd9d16c4a]
sub dh, ch
mov ebp, 0xf2cbc4fc
xchg ecx, eax
in al, 0x55
mov ch, 0x2b
mul dword [esi + 0x11]
and edx, dword [ebx + 0x61]
cwde
rol edx, 1
or dword [ecx - 0x555a9e0b], 0x27
or eax, 0xf0a09b88
into
insb byte es:[edi], dx
aas
inc edi
test byte [ebp + 0x585be090], dh
sahf
pop es
cmc
xchg dl, bh
ret 0xfe81

Function at 0x62f534
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov eax, 0x89c3714d
or ch, byte [eax + 0x660d3451]
xchg ebp, eax
adc al, 0x73
xchg ecx, eax
mov edx, ss
pop ebx
in al, 0x6d
jno 0x62f4f3
or edi, ecx
sbb dword [edx + 0x47], esp
js 0x62f537
jo 0x62f536
mov dword [esi], 0xba3a4b53
xchg ebx, eax
mov eax, 0xa85ab345
leave
push ebx
mov bl, 0xc2
ljmp 0x8270
mov dword [ebx + esi*8 + 0x78], ebx
push ss
push esi
rcl dword [edx], 0
push ebx
inc ecx
cmp byte [eax + 0x290d0ade], al
mov dl, 8
je 0x62f4ac
loope 0x62f563
adc byte [ecx + ebx*4], bl
mov eax, dword [0x7040382]
add al, 0xec
aad 0x9a
loopne 0x62f4ef
sahf
inc edi
enter 0xffffffffffff89ed, 0x21
in eax, dx
mov dword [ecx], esp
and dword [edx], esp
cmp ah, byte [esi - 0x13]
and bh, byte [edx]
in ax, dx
test dword [ecx], edx
add ecx, dword [edx + 0x55]
sub ch, byte [ebp + ebp*2 - 0x25]
fsubr dword [edi]
sbb byte [esi], bl
shr dword [esi + 0x14], cl
or dh, al
std
xor byte [edx - 0x51f3e952], bl
jle 0x62f5c1
sahf
fcmove st(0), st(6)
aam 0x6a
dec eax
xchg esp, eax
stc
xor dword [edx - 0x364ab15f], esi
dec esi
mov ch, 0xc9
jnp 0x62f55c
pop edx
mov ebx, 0x7291c997
out dx, al
fisttp qword [ebx]
mov cl, 0x33
cdq
invalid
pop esp
and eax, 0x9c1f8098
sub al, 0x85
xchg edx, eax
scasb al, byte es:[edi]
mov eax, dword [0xbeb7c742]
sub dword [esi + 0xf], ebp
insb byte es:[edi], dx
or al, 0xe1
sbb al, byte [edi]
dec ebp
push es
sub byte [esi + 0x59], ch
insd dword es:[edi], dx
dec eax
xchg ah, dh
mov bl, 0xf9
loop 0x62f5fe
mov dl, 0xf9
test dword [edi], eax
out dx, eax
sub al, dl
stosd dword es:[edi], eax
adc eax, 0x20cd60d0
stc
mov al, 0xc2
or al, 0xc0
sar byte [eax], 0xbd
push 0xffffffffffffff88
cmp al, dh
invalid
Function at 0x630e0c
Capabilities:
Encode data using xor

Disassembly:
jnp 0x630e70
and edi, dword [edx + edx + 0x7e2f24f3]
test byte [edx + 0x1c], 0x5d
das
jle 0x630e05
dec edx
sbb al, 0x5d
ror dword [eax + 0x20430f68], 1
pop ds
lodsd eax, dword [esi]
shl byte [edx - 0x7f0c585c], cl
pop esi
mov byte [0xd11fc5f], al
pop ebp
pop es
sti
rcr edx, cl
pop esp
sub byte [edi + 0x79f1a5fc], bh
add eax, 0x9407983a
dec esp
movsd dword es:[edi], dword [esi]
int1
jns fcn.00630e38
cmp bl, byte [eax - 0x53b36bf9]
popal
wait
inc esi
sub dh, byte [ebp - 0x66985d6e]
cdq
mov ebp, 0x59bb0431
xor al, dh
cmpsb byte [esi], byte es:[edi]
xor bl, byte [eax - 0x6ab01e70]
cwde
nop
loope 0x630ec3
xchg ebp, eax
inc esi
scasb al, byte es:[edi]
fiadd dword [edi + 0x32]
popal
pop eax
or ebx, dword [edi - 0x4e]
mov gs, word [bp - 0x2a75]
dec esp
aad 0xa0
inc esp
wait
push edx
add al, 0xcd
lodsd eax, dword [esi]
loopne 0x630e5d
lodsb al, byte [esi]
jb 0x630e2f
push ecx
js 0x630efc
sbb al, 0x92
int 0xb5
and al, 0xd9
wait
dec edx
loopne 0x630e9b
fstp dword [ebx + 0xbfbe04a]
rcr dword [ebx + 0x18], 1
rol ecx, 0xa4
adc byte [esi], dl
fbld tbyte [edi - 0x56]
dec esi
or edx, ecx
pop ebx
sbb cl, al
shl dword [eax + edx - 0x559820ea], 0x4e
adc byte [edx], 0xad
xchg eax, ecx
sbb esp, 0x13
out dx, al
push edx
pop ss
aam 2
ljmp 0x5e9c
xor dword [ebp + 0xf], ebp
cmpsd dword [esi], dword es:[edi]
inc ebx
dec ecx
retf 0x3871
fimul word [ebp + 0x65]
int1
or ch, ah
add eax, 0xf81cb038
out dx, al
push cs
pop eax
and dl, byte [eax]
jg 0x630f3b
add ah, bh
pushal
push ds
aas
pop es
mov ebp, 0x938119ea
xor edx, esi
sal dword [esi - 0x50a99d], 0x66
jp 0x630f86
invalid
ror edi, 0x2e

Function at 0x6322c8
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx + ebp*4 - 0x64185eca], dh
scasb al, byte es:[edi]
adc cl, byte [edi]
or al, 0x6a
sbb ebx, esi
add dword [ebp - 0x49], edx
pop edi
sbb eax, 0x649dd281
jno fcn.0063225c
rcr byte [ebp + 0x7b8c7164], cl
stc
jnp 0x6322cb
jl 0x632339
test eax, 0xd03b49b7
adc al, 0xe6
aaa
fucomp st(0)
push es
stosd dword es:[edi], eax
sub byte [ebp - 0x1b], 0xa2
cdq
mov esi, ds
cmp byte [ebx + 0x7b6405aa], cl
mov dword [0xf91322b6], eax
jns 0x63228f
arpl word [esp + edx - 0xf], sp
mov ecx, 0xc8e139b7
mov dl, 0x7d

Function at 0x639724
Capabilities:
Encode data using xor

Disassembly:
sbb esi, dword [eax - 0x2fcd0de8]
jns 0x63977d
pop eax
pop eax
cmp ah, ch
xchg edx, eax
test al, 0x43
mov eax, dword [0x70b2e078]
xor al, 0xb1
mov ebp, 0x80371e82
mov dl, 7
ja 0x6397ab
jns 0x63971d
aaa
sbb byte gs:[ecx + 0x1a], cl
mov ah, 0x9c
push ss
popal
push 0xffffffffffffffde
dec eax
pop edi
in al, 0x19
invalid