joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d8fb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bb08
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1019bc84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x100d9184
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100d9005
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x100d9184
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100d9023
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x100d9184
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100d9041
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x100d9184
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100d905f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x100d9184
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100d9184
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x100d9084
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x100d90b7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x100d90cf
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x100d910d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10022eb0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.100e37c0
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x1016d3f4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100d9f90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100d913b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x100d9174
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x100d9174
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10010530
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.100106a0
lea ecx, [ebp - 0x28]
call fcn.100106a0
lea ecx, [ebp - 0x34]
call fcn.100d87e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009de58
mov esp, ebp
pop ebp
ret 4
Function at 0x100d9af0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bca7
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1019bc84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x100d9b3a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d9b46
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.100125f0
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x100d9bb3
push 0x48
call fcn.1009e3f9
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x100d9ba7
push 0x48
push 0
push ebx
call fcn.100e3030
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.100d85d0
jmp 0x100d9ba9
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d9be0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.100125f0
push 3
push 0x1016d3f4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10023080
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100d9c2f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x100d9c7e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x100d9c7e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.100125f0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.100106a0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x100d9cb4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100d9caa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d9cf1
push edx
push ecx
call fcn.1009de6e
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x100d9cd3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009de58
mov esp, ebp
pop ebp
ret 0x14
call fcn.100ffdb3
int3
Function at 0x100da3b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bdd8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1019bc84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1009e3f9
mov edi, eax
add esp, 4
test edi, edi
je 0x100da453
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1007c375
add esp, 4
mov dword [edi + 4], eax
jmp 0x100da455
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.100205f0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x100da4b5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x100da4b5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x100da4d9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100da4fb
cmp byte [ebp + 0xc], 0
je 0x100da4e8
push esi
call fcn.1007d4f3
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x100da507
mov esi, str.ios_base::badbit_set
jmp 0x100da517
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.10023840
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.10020f30
push 0x101828b8
lea eax, [ebp - 0x30]
push eax
call fcn.100e32c7
int3
Function at 0x100dc7e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1019bc84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x21c], ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x218], esi
test ebx, ebx
je 0x100dc9b0
cmp dword [ebx], 2
jne 0x100dc9b0
cmp dword [esi + 0x14], 8
jb 0x100dc826
mov esi, dword [esi]
mov dword [ebp - 0x218], esi
cmp dword [ebx + 0x10], 0
je 0x100dc840
xor esi, esi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009de58
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100dc82c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100dc85b
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x100dc82c
mov ecx, dword [ebx + 0x20]
mov eax, 0x532ae21d
push edi
mov edi, dword [ebx + 0x1c]
mov esi, 1
sub ecx, edi
mov dword [ebp - 0x210], 0
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x100dc99d
mov dword [ebp - 0x214], 0
nop dword [eax]
nop dword [eax + eax]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100e3030
mov eax, dword [ebp - 0x214]
add esp, 0xc
add eax, 4
add eax, edi
push eax
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100dc8e0
sub eax, edx
xor ecx, ecx
sar eax, 1
je 0x100dc91e
lea ebx, [ecx + 0x5c]
nop word [eax + eax]
cmp word [ebp + ecx*2 - 0x20c], 0x2f
jne 0x100dc913
mov word [ebp + ecx*2 - 0x20c], bx
inc ecx
cmp ecx, eax
jb 0x100dc900
mov ebx, dword [ebp - 0x21c]
mov eax, dword [ebx + 0x1c]
mov edi, dword [ebp - 0x214]
mov eax, dword [eax + edi]
test byte [eax + 0x26], 0x10
je 0x100dc941
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
jmp 0x100dc966
test esi, esi
je 0x100dc964
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
push dword [ebp - 0x210]
call fcn.100dcbc0
test eax, eax
je 0x100dc964
mov esi, 1
jmp 0x100dc966
xor esi, esi
mov ecx, dword [ebx + 0x20]
add edi, 0x314
inc dword [ebp - 0x210]
mov eax, 0x532ae21d
mov dword [ebp - 0x214], edi
mov edi, dword [ebx + 0x1c]
sub ecx, edi
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp dword [ebp - 0x210], ecx
jb 0x100dc8a0
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009de58
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1009de58
mov esp, ebp
pop ebp
ret
Function at 0x100dd310
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bf8f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1019bc84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x58
call fcn.1009e3f9
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x100dd367
push 0x58
push 0
push esi
call fcn.100e3030
add esp, 0xc
mov ecx, esi
call fcn.100daf90
mov esi, eax
jmp 0x100dd369
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 8
jb 0x100dd37b
mov edi, dword [edi]
test edi, edi
je 0x100dd418
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100dd418
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x100dd418
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x100dd418
push 0
push 0
push 0
push 2
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x100dd418
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x100dd418
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.100dc1c0
test eax, eax
je 0x100dd418
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100dd42e
mov ecx, esi
call fcn.100db110
push 0x58
push esi
call fcn.1009de6e
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100debb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x100decaf
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100decaf
or eax, 0xffffffff
cmp esi, 8
jb 0x100dec87
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1016ee68]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1016ee68]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1016ee68]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1016ee68]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1016ee68]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1016ee68]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1016ee68]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1016ee68]
sub edi, 1
jne 0x100debe0
pop edi
test esi, esi
je 0x100decaa
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1016ee68]
sub esi, 1
jne 0x100dec90
not eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x101260fa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10125cff

Function at 0x10126105
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10125e80

Function at 0x1012d08a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1012c864

Function at 0x1012d095
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1012ca9f

Function at 0x101360ca
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10135e51
Function at 0x417810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push str.Shell32.lib
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov ebx, eax
call edi
test ax, ax
jge 0x41783f
or dword [esi], 0x2000000
push str.SetCurrentProcessExplicitAppUserModelID
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x11
call edi
test ax, ax
jge 0x41785a
or dword [esi], 0x4000000
push 0x12
call edi
test ax, ax
jge 0x417869
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x422c1e
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
and dword [ebp + ecx*8 - 0x7e1a5d2b], eax
add eax, 0xd9d37a9d
xchg edx, eax
js 0x422c8e
insb byte es:[edi], dx
inc ecx
in al, 0x84
sub esi, eax
add eax, 0xec8247a
mov al, byte [0xd1723efd]
rol ecx, 1
inc ecx
inc esp
xor byte [eax + 0x63], bh
xchg edi, eax
aam 0x8c
pop ds
pop edi
sbb ebx, esi
cmpsd dword [esi], dword es:[edi]
in eax, 0x82
invalid
xlatb
outsb dx, byte [esi]
pop ds
mov dl, 0xfb
xchg esi, eax
shl dword [edx], 1
or dl, byte [edx]
in al, 0xdb
mov ah, 0x9b
xor byte [ebx], ah
xlatb
mov ebx, 0x4b970968
mov cl, 0x68
cmpsd dword [esi], dword es:[edi]
pop eax
or byte [ebx + 0x12], cl
in al, 0x62
cli
inc ebp
dec ecx
xchg ebx, eax
add edi, dword [esi + 0x14]
dec eax
inc edx
fisttp dword [esi + ebp + 0x19d084f3]
fadd st(0)
dec edx
pop ds
pop esp
sub ch, byte [ecx]
sub eax, 0x9c4c0eb1
jnp 0x422caf
adc dword [edx - 0x2427294f], ebp
lahf
out 0x80, eax
test eax, 0xa81fd38c
adc ah, byte ds:[edi - 0x1b]
jbe 0x422c50
scasw ax, word es:[edi]
mov ecx, 0x88dee2b2
lahf
push esi
mov eax, dword [0x6c6b6119]
cld
inc ebp
div eax
mov edx, 0x7d98d132
mov eax, esi
insd dword es:[edi], dx
wait
add dword [ecx + ebp*8], esi
mov ecx, cs
xor edi, dword [edx]
sbb dword [esi], esp
dec dword [ebp - 0x7f78e818]
call 0x79f3b10a
cld
mov esi, 0x48379809
mov dword [edi + 0x1f4b4841], edi
cmp al, 0x37
enter 0xffffffffffff85f8, 0xffffffffffffff86
salc
sub dword [ebp + 0x1630a1f5], esi
xor byte [ecx + ebx], bh
pushal
fdiv st(7)
fdivp st(5)
or byte [esi], dh
jl 0x422caf
imul ebp, dword [esp + edi*8 + 0x45], 0xfffffff7
invalid
test eax, 0x467b5808
sbb byte [ebp - 0x47], bl
cmp byte [ecx - 0x77], dh
cdq
mov eax, 0xaf42457f
sub al, 0x3d
push 0x5c2a29db
cwde
or cl, al
test ah, 0x49
cmp eax, 0xed7ab1cf
fidiv word [esi]
imul esp, dword [ecx], 0xc088de74
ja 0x422d2c
jmp 0xd96946be
jnp 0x422d47
call 0xe21e297c
test dword [edx - 0x75], ebx
mov eax, 0x8bf9e981
ror eax, cl
cmp ch, dl
xchg edx, eax
arpl word [0xb89fb870], sp
stosd dword es:[edi], eax
inc ecx
or dword [eax + 0x38ed54b6], ecx

Function at 0x4246ee
Capabilities:
Encode data using xor

Disassembly:
leave
lodsd eax, dword [esi]
lcall 0x6050, 0x77526652
mov eax, dword [edx + 0x47c7e04c]
inc edi
inc edi
inc ebx
loop 0x4246e0
inc esi
xlatb
movsb byte es:[edi], byte [esi]
xor eax, 0x6717688d
pop edx
invalid
Function at 0x42c300
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
mov cl, 0xed
and edi, dword [edx - 0x10302a7c]
mov edx, 0xefcfd584
mov edx, 0xefcfd584
xlatb
xor dword [ecx], 0x258474a6
movsd dword es:[edi], dword [esi]
arpl word [edi - 0x1d], ax
jo 0x42c2fc
les esp, [eax - 0x1c]
fisttp dword [ebx + 0x34]
cwde
mov ecx, 0xa27b573a
mov cl, 0x2a
inc edx
cmpsd dword [esi], dword es:[edi]
cmp ah, byte [ecx + 0x71efc89a]
adc eax, 0xe730e588
inc esi
mov cl, 0xf7
xchg esp, eax
mov dh, 0xc
sbb byte [edx], ch
inc eax
mov dword [0xf1d2da0], eax
xchg edi, eax
scasb al, byte es:[edi]
dec esi
aas
lea edi, [esi + 0x47]
inc eax
adc cl, byte [ebp - 0x30a9917f]
iretd

Function at 0x437fe8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop ds
mov bl, 0x69
cmp edi, dword [ebx - 0x5fd4f0f9]
lodsd eax, dword [esi]
sbb dword [ebp + 0x76], edx
sub byte [edi + 0x6d], bh
push ebx
push cs
jecxz 0x437fe5
cld
invalid
clc
jg 0x438061
inc esi
sub al, 0x66
fisubr word [ecx + 0x15]
in al, dx
or ebp, dword [edx - 0x2a]
lahf
inc dword [edi + 0x44]
and ch, byte [edi - 0x1011ae3d]
sub eax, 0x84a8eb91
jne 0x437fa7
pop ss
psubsw mm3, qword [edi + edi*8 - 0x1aa551b]
sbb cl, byte [ecx + 5]
lock and byte [ebx], 0x85
jb 0x438053
invalid
sub al, 0xe1
dec ebp
popal
adc bh, 0x85
adc esp, dword [edi]
fild word [ebp - 0x5b]
lodsd eax, dword [esi]
mov edx, 0xfc65638e
cld
or al, 0xf
fimul word [edi - 0x12e69901]
mov esi, 0xdbe87cc4
rol dh, cl
adc edi, dword [edi + ebp*2 + 0xaab8c20]
cmp al, 0x28
fist word [eax]
sub ebx, dword [ecx + ecx*2]
push ecx
pop edx
mov bl, dl
sbb ebp, ebx
test eax, 0xa091c62b
dec eax
call 0x17b77c13
cli
push edx
push eax
jb 0x4380d2
into
push eax
jl 0x438042
clc
stosd dword es:[edi], eax
sbb bl, dh
add al, 0xf6
mov eax, dword [0xa9db381e]
mov ecx, 0xd6770e93
adc eax, 0x84fa4319
xlatb
imul esi, edi, 0xfc06be9e
imul ebx
daa
xchg ebp, eax
stosd dword es:[edi], eax
mov byte [0x1a6b3538], al
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
ljmp 0xcde
out dx, eax
popal
invalid
Function at 0x43e482
Capabilities:
Encode data using xor

Disassembly:
loope 0x43e4ef
insd dword es:[edi], dx
in eax, dx
js 0x43e4ab
je 0x43e48d
cdq
mov ecx, 0x397d8816
pop esi
out dx, eax
xchg ebp, eax
loop 0x43e4c6
jle 0x43e4fc
das
adc esp, dword [edx - 0x5ad44d6f]
invalid
imul ebx, ecx, 0xaf5174ec
fldlg2
je 0x43e501
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
sal byte [edi - 0x2e], cl
sbb eax, 0x8df6557b
inc edx
loope 0x43e4ac
lahf
and edi, dword [eax + eax]
outsd dx, dword [esi]
jo 0x43e4eb
add eax, 0xaa8a2fab
inc edi
insd dword es:[edi], dx
inc ecx
das
mov ch, byte [edx + 0x12416d47]
cmp dword [edi - 0x474aa292], esp
adc bh, byte [ecx]
cmpsd dword [esi], dword es:[edi]
outsb dx, byte [esi]
pop ebp
mov ch, 0xb8
and dword [ebx + 0x4cbf8157], ecx
jbe 0x43e4eb
cmc
sub ch, byte [esi + 0x31]
wait
stosd dword es:[edi], eax
mov cl, 0xda
mov ss, word [esi + 0x41]
stosb byte es:[edi], al
lodsd eax, dword [esi]
lds edi, [ecx + 0x7d0bd0a8]
cmp dword [ecx + 0x78], eax
daa
ror byte [ebx], 1
jge 0x43e528
inc ecx
js 0x43e519
out dx, eax
jne 0x43e4cc
sub byte [ecx + 0x641139d6], ch
jge 0x43e526
cmp dword [edi - 0x5603c1af], ebx
sbb byte [edi], 0x4c
xchg ebx, eax
cld
test eax, 0x934c1f82
popal
invalid
mov bh, 0xd1
and byte [esi - 0xd], dl
push esp
xor byte [ebp - 0x28], ah
xor byte [edx], ah
adc eax, 0x4dc592b8
xchg edx, eax
lds ecx, [ebp - 0x26]
invalid
dec ebp
fcmovb st(0), st(7)
ja 0x43e4e0
dec esp
wait
lock and dword [ebx - 0x66], edx
scasb al, byte es:[edi]
movsd dword es:[edi], dword [esi]
invalid
Function at 0x459790
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x6a
sub al, 0xb1
add al, byte [edx]
push eax
ljmp 0xb56
mov edx, 0x7b0b3a2c
mov eax, 0xaeb67a17
jo 0x4595d5
xchg ebx, eax
push edx
sbb eax, 0xd73b3a36
and byte [eax + 0x63], bh
push edx
rcl edx, 0xb6
sub al, 0x48
mov dh, 0xdc
arpl word [edx - 0x3f], dx
sal byte [esi - 0x2349b7d4], cl
push ebx
jb 0x459641
aam 0x78
jb 0x4596a1
lahf
scasb al, byte es:[edi]
pop dword [edx]
push edi
xchg edx, eax
jge 0x4596b9
xchg edi, eax
les ebp, [ecx]
mov ebx, 0x336e4d26
invalid
adc eax, dword [ecx]
push esi
pushfd
mov dword [0xcc985601], eax
jns 0x459656
lodsb al, byte ds:[esi]
dec esi
xor bh, 0xfa
mov ebx, 0x665224cc
ud2
and ch, byte [edx]
invalid
push ds
ror esp, 1
jnp 0x45969f
inc ebx
mov ebp, edx
push ecx
xchg dword [esi - 0x78e7e9f3], ebp
or ah, byte [eax + 0x36]
out dx, al
and byte [ebx], dh
jae 0x4596bd
fcmovb st(0), st(0)
sub ebp, edx
invalid
push 0x1c
fsubp st(3)
dec esp
push edi
daa
in al, dx
clc
jp 0x45975e
jns 0x45971c
cmp edx, ebx
stc
ja 0x4596bc
invalid
cmpsb byte [esi], byte es:[edi]
invalid
loopne 0x4597a3
or al, 0x69
daa
mov word [ebp + ebp*4 + 0x6f], ss
dec eax
or eax, 0x258950e3
aaa
mov bh, 0xb8
mov al, 0xd8
cmpsb byte [esi], byte es:[edi]
mov byte [0xf517df14], al
aad 0xb7
jae 0x459755
and dword [ebx - 0x3a], edx
or al, 0x1a
mov dword [eax + edi*4 + 0x17], ebx
add al, 0xbb
mov word [edx], es
and eax, 0x486af885
inc ecx
loop 0x459723
inc edi
sub dh, ah
dec ebp
mov ecx, dword [edi - 0x16]
or eax, 0xcde400c9
or al, al
jmp 0x4597af
push cs
out 0x4c, al
mov al, byte [eax - 0x18]
or dword [eax - 0x67], edi
pop ds
and eax, 0x3c86f02b
and eax, 0x3c86f02b
xor eax, 0xb7f0cbf6
add eax, 0x61e54f5
push cs
ror byte [eax + 0x9b33e52], cl
idiv ebx
pop ebx
call 0xa8700ebb
movsb byte es:[edi], byte [esi]
cwde

Function at 0x48302e
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov cl, 0x19
and ch, byte [ebx]
mov esi, 0x5c98f3b4
pushfd
mov cl, byte [ecx]
push eax
salc
cmp al, 0x5e
push esp
mov dword [ebp - 0xf], eax
invalid

Function at 0x495d4e
Capabilities:
Execute syscall

Disassembly:
mov bh, 0xdf
xchg dword [ebp - 0x245b1c29], esi
aaa
fist word [eax - 0x22]
enter 0x6ee0, 0xffffffffffffff82
dec edx
xor eax, 0x89812f3e
int 0x2e
and esi, dword [edx + 0x39cd465f]
mov dword [0x1bf8d6ea], eax
enter 0xffffffffffffe68e, 0xfffffffffffffff0
test eax, 0x7b1afe22
aaa
add dword [ebp - 0x7658c866], 0x36
push 0x9e176f2a
nop
mov ebp, 0x351a047b
bnd ret 0xcd1c

Function at 0x4b4d59
Capabilities:
Encode data using xor

Disassembly:
jg 0x4b4d85
cmp dh, byte [esi + 0x7653162f]
and eax, 0x220c8335
cmpsd dword [esi], dword es:[edi]
invalid
sbb dword [edi + 0x1a], eax
and edi, esp
cmpsd dword [esi], dword es:[edi]
pop eax
call dword [eax]
add eax, 0xc1cc479c
push ds
add edi, edi
popal
xor eax, 0x4423e22e
pop edi
or dword [edx + 0x16820d56], edx
insd dword es:[edi], dx
adc eax, 0x35982265
invalid