joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc630
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push 0x400
push 1
push edi
mov eax, dword [edi + 4]
mov esi, dword [edi + 0x1c0]
call dword [eax]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 4]
push 0x400
push 1
push edi
call dword [ecx]
mov dword [esi + 0x14], eax
mov edx, dword [edi + 4]
push 0x400
push 1
push edi
call dword [edx]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 4]
push 0x400
push 1
push edi
call dword [eax]
add esp, 0x30
mov dword [esi + 0x1c], eax
xor eax, eax
mov dword [esp + 0x14], 0x5b6900
mov edi, 0xff1daf00
mov edx, 0xff4d0b80
mov ecx, 0x2c8d00
mov ebp, dword [esi + 0x10]
mov ebx, edx
sar ebx, 0x10
mov dword [eax + ebp], ebx
mov ebp, dword [esi + 0x14]
mov ebx, edi
add edx, 0x166e9
sar ebx, 0x10
mov dword [eax + ebp], ebx
mov ebp, dword [esi + 0x18]
mov ebx, dword [esp + 0x14]
add edi, 0x1c5a2
mov dword [eax + ebp], ebx
mov ebp, dword [esi + 0x1c]
sub ebx, 0xb6d2
mov dword [eax + ebp], ecx
sub ecx, 0x581a
add eax, 4
cmp ecx, 0xffd4cb1a
mov dword [esp + 0x14], ebx
jge 0x4bc69a
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4c4b20
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4c4bc3
test eax, eax
jbe 0x4c4bc3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4c4bc3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4c4b6e
xor esi, esi
jmp 0x4c4b74
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4c4b9f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004c87d0
add esi, eax
push esi
mov ebx, esi
call fcn.004c87d0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4c4b80
pop ebp
test edi, edi
pop edi
jne 0x4c4bc3
test ebx, ebx
je 0x4c4bc3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004e4010
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4c4ce5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4c4dfd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4c4dfd
mov eax, dword [esi + 0x3c]
push eax
call fcn.004f5d3d
mov esi, eax
test esi, esi
je 0x4c4dfd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4c4dfd
mov ecx, esi
call fcn.004c4c70
cmp edi, eax
jge 0x4c4dfd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4c4d83
mov dword [esp + 0x34], 1
jmp 0x4c4dde
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4c4dfd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004c34e0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4ce590
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x65aa7c]
xor edx, edx
cmp eax, edx
jne 0x4ce5b6
xor eax, eax
mov byte [eax + 0x65a97c], al
inc eax
cmp eax, 0x100
jl 0x4ce59e
mov dword [0x65aa7c], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x65a97c
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4ce647
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4ce61a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4ce5e8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4ce6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4ce713
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4ce6fa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d50c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5042be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004d59e0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x609f14
call fcn.004f4054
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4d5153
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004f4054
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4d514c
push 0
mov ecx, eax
call fcn.004cc1c0
mov dword [esi + 0xc], eax
jmp 0x4d5155
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4d5155
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4f66e1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4f6719
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004f476e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004f4746
jmp 0x4f6725
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4f7dd2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4f7e14
call fcn.004fdfb6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4f7e14
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4f7e0b
xor eax, eax
jmp 0x4f7e1c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004f7e22
pop edi
pop esi
pop ebx
ret 4
Function at 0x4fe4e6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4fe514
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4fe532
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004fe44c
jmp 0x4fe532
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4fe532
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004fe44c
test edi, edi
mov eax, edi
jne 0x4fe51c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x724510
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x601015
lea edi, [esi - 0x200015]
push edi
jmp 0x72452a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x724531
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x724520
mov eax, 1
add ebx, ebx
jne 0x724543
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x724554
jne 0x724573
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x724573
dec eax
add ebx, ebx
jne 0x724560
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x724538
add ebx, ebx
jne 0x72456f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7245c5
xor ecx, ecx
sub eax, 3
jb 0x72458b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7245fa
sar eax, 1
mov ebp, eax
jmp 0x724596
add ebx, ebx
jne 0x724596
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x724564
inc ecx
add ebx, ebx
jne 0x7245a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x724564
add ebx, ebx
jne 0x7245b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7245a6
jne 0x7245c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7245a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7245e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7245d6
jmp 0x724526
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7245e4
add edi, ecx
jmp 0x724526
pop esi
mov edi, esi
mov ecx, 0x9783
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x724602
cmp byte [edi], 0x38
jne 0x724602
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x724607
lea edi, [esi + 0x322000]
mov eax, dword [edi]
or eax, eax
je 0x724676
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x324000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x324050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x724634
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x324058]
or eax, eax
je 0x724670
mov dword [ebx], eax
add ebx, 4
jmp 0x724651
call dword [esi + 0x324054]
mov ebp, dword [esi + 0x32405c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7246aa
sub esp, 0xffffff80
jmp 0x44c6d0
Function at 0x42466b
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xab
push 0xffffffffffffff80
sbb dword [ecx + 0x2a], esp
xor byte [eax], bh
xor edx, dword [edi]
shr byte [ebp - 0xb202ce3], 0xaf
cwde
cdq
and eax, 0x604066fa
in al, 0x93
cdq
sal byte [ecx + 0x6773f9e2], cl
inc ebx
or edx, dword [ebx + 0x27]
in al, dx
imul esi, dword [ebx], 7
xor eax, dword [edi]
xor eax, dword [edi]
ror dword [edi - 0x62], 0x91
pop ds
enter 0xfffffffffffff2f7, 0xffffffffffffffc3
pop ebx
repne stosd dword es:[edi], eax
mov bh, 0x7b
xor ecx, dword [ebx + 0x29975f07]
stosb byte es:[edi], al
jg 0x424642
inc edi
xlatb
push ds
cmp dword [ecx - 0x4e], 0xffffff8e
xchg esi, eax
inc ebx
add bl, byte [0x5ce1e712]
rep outsb dx, byte [esi]
std
invalid

Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
add byte [eax], al
mov eax, dword [0x65bd8c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd8c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge fcn.0044b85b
or dword [esi], 0x4000000

Function at 0x488aa9
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x33
mov cl, 0x74
mov eax, 0xafb7664
call 0x495fe73e
mov byte [0x24927d9], al
mov ecx, 0x19981308
dec ecx
add bh, byte [ecx + 0x19981308]
or ch, bh
jb 0x488aba
aam 0x27
dec ebx
fxch st(7)
fcomp st(3)
invalid

Function at 0x50445b
Capabilities:
Encode data using xor

Disassembly:
enter 0x2f95, 0xfffffffffffffff5
jle 0x50441c
mov bl, 0xfc
push esp
sbb dh, byte [edx + eax*2]
arpl word [ecx], si
mov eax, dword [eax]
cmpsd dword [esi], dword es:[edi]
sbb al, 0xf3
xchg edi, eax
mov al, 0x8d
cdq
salc
or eax, 0xd1de2be5
std
mov cl, 0x38
sahf
outsb dx, byte [esi]
add dword [edi], ebx
mov dword [0xb26e8372], eax
pop ds
xchg ebp, eax
retf
mov edi, 0x5fe384b3
adc dl, byte [edi]
loop 0x5043c3
shl byte [ecx], cl
jbe 0x504485
lodsd eax, dword [esi]
sub byte [esi + esi*2 - 0x60], bh
aad 0x69
cmp esp, edx
invalid
in eax, dx
cli
sbb eax, 0x821f83d5
mov ebx, 0xce8a9825
and al, 0xe4
xor al, bh
lodsd eax, dword es:[esi]
push 0x6e
and ah, byte [ecx + 0x7a]
mov esp, 0xc76e507d
jecxz 0x50443e
invalid
loop 0x50440f
mov dl, 0xad
lodsd eax, dword [esi]
xor bl, byte [ecx + 0x4bb7e2cb]
push edx
ja 0x50446e
retf
xchg dword [edx + 0x4f], esi
dec ebx
shr byte [edi + 0x47], cl
inc edi
insd dword es:[edi], dx
sub byte [edx + 0x27dd9f8a], ah
leave
wait
mov ecx, 0x967160d3
ror dword [edx + 0x3f], 1
jns 0x504491
bound ebx, qword [edi]
push edx
sbb byte [esi + 0x7f], 0xe1
jmp 0x6663c160
loopne 0x5044b3
pop edi
sti
lodsd eax, dword [esi]
iretd
mov ebp, 0xfba2cf72
mov dl, 0xe3
pushfd
jp 0x50444e
mov al, byte [0xf493abcc]
aam 0x63
add byte [eax - 0x60191100], ah
outsd dx, dword [esi]
sub byte [edx - 0x1d8e1b34], ch
jno 0x504497
jno 0x5044bd
inc eax
loop 0x504460
movsb byte es:[edi], byte [esi]
iretd
or byte [edi], dh
int3
Function at 0x5db24b
Capabilities:
Encode data using xor

Disassembly:
leave
or al, 0x86
mov al, byte [esi + 0x2845be0a]
je 0x5db17f
pop esi
fdiv st(6), st(0)
fst qword [edi]
lds ebx, [0x1dc16739]
mul byte [0x815c4815]
invalid
jns 0x5db183
invalid
sub dl, byte [ecx - 0x3f]
and dword [esp + eax*8 + 0x55], 0x7e
les edx, fs:[ebp + 0x7e]
int 0x9d
popfd
push ds
movsd dword es:[edi], dword [esi]
sub esp, dword [eax - 0x9c1cbbd]
lodsb al, byte [esi]
rol byte [esp + edi*4], cl
sub ebx, dword [ebp + 1]
sub esi, dword [eax]
ror byte [0x244843f9], 1
popal
lds edx, [edx]
xor eax, 0x50b20df8
inc edx
jge 0x5db12e
mov dword [0x67e6946], eax
push 0x79
aad 0x1e
jns 0x5db189
push ds
dec eax
retf 0xd266
rol byte [ecx - 0x4aa24584], cl
jmp 0x4be5b97
out dx, eax
daa
sub al, 0x28
bound eax, qword [edi + 0x6683d47d]
mov bh, 0xed
popal
jne 0x5db1b2
cld
test eax, 0x1d65f507
adc ah, 0x88
sub eax, dword [esi + 0xc90c715]
xor bl, byte [eax]
aaa
cmc
sbb eax, 0x2b88d480
xchg byte [0x320c90c7], dl
sbb byte [edi], dh
add al, 0x67
rol edx, 0x1c
test byte [edi], dh
mov dh, byte [edi + esi*4 - 0x3a8d85cd]
jne 0x5db1c9
jp 0x5db26a
lds esi, [ebp - 0x32]
sub bh, byte [edi + 0x25]
sub al, byte [ecx - 0x318d3413]
and eax, 0x44b7c4fa
xchg dword [0xc715588], ecx
xlatb
pushfd
ja 0x5db1da
ret
jae 0x5db1dc
sbb al, 0xf4
wait
ja 0x5db1b7
rcr al, 0x61
push edx
outsb dx, byte [esi]
bound ebx, qword [ecx]
add eax, 0xfff670d7
mov ah, 0xf9
push edi
xor esp, dword [0xf02306bb]
jl 0x5db24a
aas
lodsb al, byte [esi]
loope 0x5db1f6
xchg ebx, eax
inc eax
popal
retf
push ds
out dx, eax
xchg esp, eax
lea ebx, ds:[0x1f94595]
popfd
jge 0x5db22c
sbb eax, 0x46631d98
invalid
Function at 0x625edb
Capabilities:
Encode data using xor

Disassembly:
mul byte [ebx - 0x4e]
jp 0x625eee
pop ss
jg 0x625f53
cmp eax, 0x277f26cb
int1
push ebp
cmpsb byte [esi], byte es:[edi]
pop edi
jge 0x625f56
adc byte [bp + di + 0x4e], dh
adc byte [ebx + 0x4e], dh
xchg ecx, eax
xor eax, 0x1d272a02
shl byte [edi - 0x59], 0x40
cmp al, 0xcd
pop eax
sti
and al, 0x34
push cs
test al, 0xef
and byte [edx], dl
or esp, dword [eax + 0x5f4a457b]
test eax, 0x7adfc957
stosb byte es:[edi], al
xor al, ah
and eax, dword es:[0x7e65894]
ja 0x625ee3
inc edi
xor al, 0x1d
add eax, 0x75e83864
mov cl, 0xd4
inc ebx
movsd dword es:[edi], dword [esi]
aaa
mov esi, 0xdbea0278
push ebx
jne 0x625f3c
mov ch, cl
movsd dword es:[edi], dword [esi]
pop ds
retf
cmp byte [eax - 0x64], 0xfc
invalid
adc byte [esi - 0x374aa0fc], al
pop edi
mov ch, 0xc8
call 0x3876d63c
test al, 0x45
and eax, dword [ebx]
jg 0x625fc6
and bl, byte [edi]
cmp al, 7
jne 0x625f6d
adc byte [ebp - 0x50], ah
lcall 0xf825, 0x444d651
mov al, 0x9a
push ecx
salc
inc esp
add al, 0x25
clc
int1
scasd eax, dword es:[edi]
lds edi, [esi]
pop ds
rcl dword [esi - 0x32], 0x79
daa
bts dword [edi + 0x2c565214], eax
cmp edx, dword [edx - 0x75]
inc ecx
add eax, 0x796594cd
invalid
cld
cmc
bound esp, qword [ebp - 0x7f3b0b5d]
adc edx, dword [ecx + 0x75761a98]
test eax, 0x12c99bf4
and byte [eax], bh
in eax, dx
add eax, dword [eax + 0x48]
push eax
lodsb al, byte [esi]
push esp
xchg esi, eax
mov cl, byte [edi + 0x708717bf]
or byte [esi + esi*4 - 0x2e], cl
or cl, bh
in eax, 0x64
aad 0x94
or bh, ch
or byte [ebx], al
sbb al, 0xa9
salc
mov dword [ebx], esi
adc byte [edx], ch
adc byte [ebx + 0x7f19f609], dl
sbb dh, dh
adc eax, 0x9baaa588
sub dl, byte [eax]
xchg ebx, eax
or esi, esi
sbb dword [edi + 0x1a], edi
not byte [0x9baaa588]
xor bl, dl
jp 0x625fb0
mov byte [0x83dc9262], al
insd dword es:[edi], dx
push ebp
nop dword [esi - 0x52]
ja 0x625fe8
jo 0x62603a
adc ah, byte [esp + eax*2]
push esi
jp 0x62603b
dec ebp
or bh, byte [esi + 0x5a]
insb byte es:[edi], dx
cli
cmp byte [esp + edi*8], dh
rol dword [esi + 0x57df8bdb], 1
daa
ret
das
xchg ebp, eax
outsb dx, byte [esi]
add eax, 0x3e66875
dec esp
add eax, 0x25df3533
push edi
pop ecx
rol byte [ebp - 9], 0x65
add eax, 0x96b19695
mov byte [0x1bd9b509], al
aad 0x15
iretd

Function at 0x63df82
Capabilities:
Encode data using xor

Disassembly:
salc
push es
xchg dword [ebx + esi + 0x61504be5], esp
mov bh, 0x47
push esp
xor al, 0x54
fst dword [esi - 0x49289b65]
stosd dword es:[edi], eax
rcr byte [eax - 0x232080eb], cl
std
inc esi
push eax
rol dword [eax + ebx*8], cl
or byte [ecx], bl
fstp xword [edi - 0x13]
pushfd
test dword [ebx + 0x7b], ebx
invalid

Function at 0x649aa9
Capabilities:
Encode data using xor

Disassembly:
or dword [eax - 0x6d], 0xffffffd7
inc eax
test dword [esi + 0x43], eax
Function at 0x64b1e7
Capabilities:
Encode data using xor

Disassembly:
enter 0x46da, 0xffffffffffffffb5
pop es
mov cl, 0x33
les ecx, [0xc31b78ea]
xor eax, esp
or eax, 0xc31b78ea
js 0x64b1ff
ret
sub al, 0xd5
aaa
pushfd
test ebx, edi
stosb byte es:[edi], al
loopne 0x64b1de
mov cl, 0x32
xchg dword [edi], esi
out 0x37, al
cmp dword [ebx + esi*4 + 0x301582b5], esp
in al, 0xea
cdq
jle 0x64b219
sbb esp, ebp
in al, dx
aad 0x27
out 0x9c, eax
sub byte [edi], al
pop es
mov ebx, 0xe4f52244
out dx, al
scasd eax, dword es:[edi]
jo 0x64b1e2
mov dh, 0xf5
das
out dx, al
inc ebp
leave
pop eax
add dword [eax + 0x21], esp
xlatb
pushal
and edi, edx
xor byte fs:[eax - 0x7ae5ce4f], cl
cwde
jns 0x64b1d8
or ch, byte [ebx]
mov bl, 0x74
je 0x64b200
mov dword [0xb459347d], eax
out 0xc5, eax
xor dword [eax - 3], 0xd7a6f50f
cwde
aam 0xf
cli
adc eax, 0x22fd44f5
push edx
aaa
sub byte [ecx - 0x3d], 0xd5
dec esp
jg 0x64b206
in al, dx
dec ebx
pop ds
imul ecx, ecx, 0xffffff86
add eax, 0xd79d5a98
xor al, 0x46
and al, 0xde
or dword [eax + 0x51e3b3c3], 0x7f
pushfd
xchg ecx, eax
aaa
xor al, 0xbe
xor dword [ebx + eax + 0x70405e0a], ebp
inc ebp
rcl dword [edx], 0x3f
cli
dec esi
shl byte [edx - 0x1bb55519], cl
xchg ecx, eax
and eax, 0xc1dbeae5
lcall 0xbe41, 0x86347e05
invalid
Function at 0x10221df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp ecx, 0
sete dl
cmp eax, 0
sete dh
and dl, dh
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x15], dl
mov eax, 0xffffffff
mov cl, byte [ebp - 0x15]
test cl, 1
mov dword [ebp - 0x1c], eax
jne 0x10221eb4
jmp 0x10221ebf
mov dword [0x10246378], 0x667
mov eax, dword [ebp - 0x20]
add eax, 1
mov ecx, dword [ebp - 0x24]
cmp eax, ecx
mov dword [ebp - 0x28], eax
jae 0x10221fb0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x20], eax
mov word [ebp - 0x2e], dx
mov word [ebp - 0x30], di
jb 0x10221e88
mov ax, word [ebp - 0x2e]
mov word [ebp - 0x30], ax
mov ax, word [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov byte [ebp - 0x31], bl
jne 0x10221fb0
jmp 0x10221e34
mov eax, dword [ebp - 0x1c]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [0x1024637c], 0x25ed
mov dword [0x10246378], 0x14fc
mov ecx, dword fs:[0x18]
mov dword [0x10246378], 0xffffeafc
mov eax, dword [ecx + 0x30]
mov dword [0x1024637c], 0xffffd3cf
mov eax, dword [eax + 0xc]
add eax, 0x14
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
setne dl
mov esi, eax
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x39], dl
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [eax]
mov edx, dword [ebp - 0x38]
cmp eax, edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], ecx
je 0x10221eb4
mov dword [0x10246378], 0xe77
mov eax, dword [ebp - 0x44]
add eax, 0x24
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x10]
cmp ecx, edx
sete bl
mov bh, byte [ebp - 0x39]
and bh, bl
test bh, 1
mov dword [ebp - 0x4c], ecx
jne 0x10221f5f
jmp 0x10221f6f
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff8
mov dword [ebp - 0x1c], eax
jmp 0x10221eb4
mov eax, dword [ebp - 0x48]
mov cx, word [eax]
mov dword [0x10246378], 0x26b6
shr cx, 1
movzx edx, cx
cmp cx, 0
sete bl
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x4d], bl
xor eax, eax
mov cl, byte [ebp - 0x4d]
test cl, 1
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], edx
jne 0x10221f10
jmp 0x10221e54
mov al, byte [ebp - 0x31]
test al, 1
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
jne 0x10221fc2
jmp 0x10221f10
mov dword [0x1024637c], 0xffffc994
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
jmp 0x10221eb4