joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401bfb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401bf4
test esi, esi
je 0x401bf4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401bd0
mov dword [esp], 0x407044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401de0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401e30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401f08
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401e6e
cmp eax, 4
jne 0x401e90
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401e7e
cmp edx, 4
je 0x401e7e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401de0
Function at 0x401750
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c14
call fcn.005e5590
mov eax, dword [0x6c35d0]
xor eax, esp
mov dword [esp + 0x2c10], eax
mov eax, dword [esp + 0x2c18]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x4018bb
cmp dword [esp + 0x2c20], edi
je 0x4018bb
push ebx
push ebp
mov ebp, dword [0x649494]
push esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ebx, [ebx]
push ebx
push 0x67e2ac
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.004396d0
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push edi
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x401894
xor eax, eax
push 0x2710
lea edx, [esp + 0x514]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.005e2ad0
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x51c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [0x649170]
test eax, eax
je 0x401887
push 0x3e8
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.005e2ad0
mov edx, dword [esp + 0x534]
lea ecx, [esp + 0x134]
push ecx
push 1
push edx
lea eax, [esp + 0x528]
push eax
call fcn.00402e70
mov edx, dword [esp + 0x2c48]
mov eax, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x128]
push ecx
push edx
push eax
call fcn.00401070
test eax, eax
jne 0x401887
mov dword [esp + 0x10], 1
push esi
call dword [0x649438]
cmp dword [esp + 0x10], edi
jne 0x40189e
inc ebx
cmp ebx, 0x10
jl 0x4017a0
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x2c10]
xor ecx, esp
call fcn.005e50e9
add esp, 0x2c14
ret
mov ecx, dword [esp + 0x2c14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.005e50e9
add esp, 0x2c14
ret

Function at 0x408000
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov byte [ecx + 0x10], al
push 0x40
push 0
mov edx, dword [ebp - 4]
add edx, 0x30
push edx
call fcn.005e2ad0
add esp, 0xc
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x28], 0
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x28], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x18], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x18], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x18], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x18], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x413580
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63dc63
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x6c35d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x2c
push 0x2c
lea eax, [ebp - 0x14]
push eax
call fcn.00409610
add esp, 0xc
mov ecx, eax
call fcn.0040f190
movzx ecx, ax
push ecx
push 1
mov ecx, dword [ebp - 0x10]
call fcn.00427b20
mov dword [ebp - 4], 0
push 0x22
push 0x22
lea edx, [ebp - 0x18]
push edx
call fcn.00409610
add esp, 0xc
mov ecx, eax
call fcn.0040f190
movzx eax, ax
push eax
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00427b20
mov byte [ebp - 4], 1
push 0x5c
push 0x5c
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00409610
add esp, 0xc
mov ecx, eax
call fcn.0040f190
movzx edx, ax
push edx
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00427b20
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x48], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x42dd40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63f1db
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6c35d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00428870
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
call fcn.00428870
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00428870
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
call fcn.00428870
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 3
call fcn.00428870
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.00428870
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 5
call fcn.0040f680
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 6
call fcn.00428870
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 7
call fcn.00428870
lea ecx, [esi + 0xcc]
mov byte [ebp - 4], 8
call fcn.00428870
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 9
call fcn.00428870
lea ecx, [esi + 0xfc]
mov byte [ebp - 4], 0xa
call fcn.00428870
lea ecx, [esi + 0x114]
mov byte [ebp - 4], 0xb
call fcn.00428870
lea ecx, [esi + 0x12c]
mov byte [ebp - 4], 0xc
call fcn.00428870
lea ecx, [esi + 0x144]
mov byte [ebp - 4], 0xd
call fcn.00428870
lea ecx, [esi + 0x160]
mov byte [ebp - 4], 0xe
call fcn.00428870
lea ecx, [esi + 0x178]
mov byte [ebp - 4], 0xf
call fcn.00428870
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431d80
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63f9c6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6c35d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0042bc40
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.0042bc40
mov byte [ebp - 4], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00428870
mov dword [esi + 0x30], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436290
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64015e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6c35d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
call fcn.00428420
mov esi, dword [ebp + 0xc]
lea edi, [ebx + 0x18]
mov dword [ebp - 4], 0
lea ecx, [edi + 8]
mov dword [ebp + 8], edi
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
lea eax, [esi + 8]
push eax
call fcn.0042ae30
lea eax, [esi + 0xc]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0xc]
call fcn.0042ae30
mov byte [ebp - 4], 2
lea ecx, [edi + 0x18]
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [esi + 0x18]
push eax
call fcn.0042a0c0
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x438500
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64032b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6c35d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0042a0c0
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x18]
call fcn.0042a0c0
lea eax, [esi + 0x30]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x30]
call fcn.0042a0c0
lea eax, [esi + 0x48]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x48]
call fcn.0042a0c0
lea eax, [esi + 0x60]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x60]
call fcn.0042a0c0
lea eax, [esi + 0x78]
mov byte [ebp - 4], 4
push eax
lea ecx, [edi + 0x78]
call fcn.0042a0c0
lea eax, [esi + 0x90]
mov byte [ebp - 4], 5
push eax
lea ecx, [edi + 0x90]
call fcn.00416b10
lea eax, [esi + 0x9c]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x9c]
call fcn.0042a0c0
lea eax, [esi + 0xb4]
mov byte [ebp - 4], 7
push eax
lea ecx, [edi + 0xb4]
call fcn.0042a0c0
lea eax, [esi + 0xcc]
mov byte [ebp - 4], 8
push eax
lea ecx, [edi + 0xcc]
call fcn.0042a0c0
lea eax, [esi + 0xe4]
mov byte [ebp - 4], 9
push eax
lea ecx, [edi + 0xe4]
call fcn.0042a0c0
lea eax, [esi + 0xfc]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [edi + 0xfc]
call fcn.0042a0c0
lea eax, [esi + 0x114]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [edi + 0x114]
call fcn.0042a0c0
lea eax, [esi + 0x12c]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [edi + 0x12c]
call fcn.0042a0c0
lea eax, [esi + 0x144]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [edi + 0x144]
call fcn.0042a0c0
mov byte [ebp - 4], 0xe
lea ecx, [edi + 0x160]
mov al, byte [esi + 0x15c]
mov byte [edi + 0x15c], al
lea eax, [esi + 0x160]
push eax
call fcn.0042a0c0
lea eax, [esi + 0x178]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [edi + 0x178]
call fcn.0042a0c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x439490
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64015e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6c35d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
push edi
call fcn.00428420
mov dword [ebp - 4], 0
lea esi, [ebx + 0x18]
mov eax, dword [edi + 0x18]
lea ecx, [esi + 8]
mov dword [esi], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 4], eax
lea eax, [edi + 0x20]
push eax
mov dword [ebp + 8], esi
call fcn.0042ae30
lea eax, [edi + 0x24]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0xc]
call fcn.0042ae30
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
mov eax, dword [edi + 0x28]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x30]
push eax
call fcn.0042a0c0
mov eax, dword [edi + 0x48]
mov dword [esi + 0x30], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4398e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6404d8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6c35d0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x6c35d0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea edi, [esp + 0x18]
xor eax, eax
mov dword [esp + 0x14], 0
xor ecx, ecx
mov byte [esp + 0x3c], 0
cpuid
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
lea ecx, [esp + 0x18]
mov dword [edi + 0xc], edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x30]
push eax
call fcn.00428720
lea eax, [esp + 0x18]
mov dword [esp + 0x50], 0
push eax
push esi
call fcn.004283f0
add esp, 8
lea ecx, [esp + 0x18]
call fcn.00429160
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005e50e9
mov esp, ebp
pop ebp
ret

Function at 0x43aa80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640878
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6c35d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], 0x67805c
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x69c7b8
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.004286e0
mov dword [esi + 0x30], 0
mov eax, esi
mov byte [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43c590
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640d8b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6c35d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], 0x67805c
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x69c7b8
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.004286e0
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
lea ecx, [esi + 0x40]
mov dword [ebp - 4], 1
push ecx
mov byte [esi + 0x3c], 0
call fcn.0043cd30
push 1
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 2
call fcn.00426610
push 0
push 0
push 0
push 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
call dword [0x64942c]
mov dword [esi + 0x38], eax
mov eax, esi
mov dword [esi + 0x10], 0x43c890
mov dword [esi + 0xc], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x481590
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
cmpsb byte [esi], byte es:[edi]
inc esi
in al, dx
pop esi
and al, 0x32
mov dl, 0xc7
insb byte es:[edi], dx
xchg ecx, eax
inc eax
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
inc esi
lds edx, [ebp + 0x2a]
test al, 0xc3
mov dl, 0xa4
push ebx
push ebp
sub ch, byte [eax + 0x53a4b2c3]
dec ebp
cmp dword [edx + ebx*4 - 0xa], edi
adc bh, cl
jno 0x4813ed
iretd
xchg ebp, eax
mov edx, 0x93b336f0
sti
sub dword [edi - 0x33], esp
arpl word [eax + 0x4d63d9a], bp
mov ch, byte [esi + 0x1c57d8a3]
popal
cmp dh, byte [ebx - 0x6f7ab15f]
js 0x48140a
mov dl, 0x91
mov edx, 0xad45d51e
rcr dword [eax - 0x29f31552], 1
loope 0x4814ae
rcl byte [ebx + ebx + 0x13]
fsubr dword [ebp + 9]
ror byte [esp + ecx], cl
pushal
push ds
salc
int1
pop es
in eax, dx
xor dword [edi - 0x5e], esi
int1
xor dh, byte [eax + 0x44]
in al, 0x53
stosb byte es:[edi], al
and al, byte [edi + 0x2f97d753]
and edx, ebp
pop ecx
cmp eax, 0xbaf2c6cc
out dx, eax
sbb dword [ecx - 0x22], 0xfffffff3
mov edx, 0xde5983ef
sub dl, byte [edi - 0x37e935d6]
fdivrp st(3)
sub dl, byte [edi - 0x37e935d6]
test eax, 0xedfe523a
js 0x4813fd
jno 0x481466
inc edi
xchg ebx, eax
inc esp
xor esp, dword [edx - 0x64f5d42b]
xor bh, byte [ecx - 0x48]
mov eax, edx
mov al, 0xb7
inc esp
push cs
push es
cld
ror byte [ebp - 0x4917ca67], 0
push ecx
outsb dx, byte [esi]
adc esp, edi
wait
push eax
sbb bl, cl
int 0xe6
adc byte [esi], bh
scasd eax, dword es:[edi]
salc
enter 0x111b, 0x6a
mov eax, dword [0x47e577c2]
jmp 0x481445
jno 0x481492
jnp 0x4814b5
pop ecx
pop ecx
sub ebx, dword [ecx - 0x635b0637]
cdq
leave
stc
movsb byte es:[edi], byte [esi]
pushfd
add al, byte [ebx + 0x12]
jmp 0x481503
inc ebx
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
jno 0x481462
add dl, byte [eax - 0xc]
sbb ah, byte [ecx]
push ss
push 0x6a
jns 0x481520
fist word [edx - 0x2d025695]
arpl word [edi], cx
out dx, eax
dec eax
jb 0x48147a
out dx, al
stosb byte es:[edi], al
xchg ebp, eax
push ss
cli
mov dword [0xe8609027], eax
daa
nop
pushal
call 0x810bf66
cmc
sub byte [edx - 0x5378ab40], cl
leave
fdivr qword [esi]
cmc
cmp esp, ebp
pop edi
stosb byte es:[edi], al
enter 0xfffffffffffff507, 0x28
mov al, al
push esp
xchg dword [ecx + ecx*8 + 0x39f53edc], ebp
in al, dx
xor byte [0x5457efb4], ch
sub eax, 0x1ac8657d
mov esi, dword [ebx]
test eax, 0xad05de0d
xor ebp, dword [ecx - 0x52fa21f3]
xor eax, dword [edx - 0x50]
add al, 0x3a
jne 0x481504
push ebp
push ecx
xchg edi, eax
cld
xor al, 0xc3
cwde
wait
stc
pop eax
imul edx, dword [0x6954e8d4], 0x487f0cd6
call 0xd1e7e95
jg 0x48158b
cli
loopne 0x48153c
adc al, 0x97
pop ecx
leave
jo 0x481549
loopne 0x4814dd
out dx, al
jne 0x4814fa
pop esi
in al, 0xb4
inc ebp
jbe 0x4814ff
ret 0xca5d
iretd
xor al, 0x23
sal dl, 0x1b
add byte [esi + ebx*2 + 0x64d78b3c], dh
test al, 0x37
and dword [0x83885a55], esp
sar byte [edi + 0x64], cl
push ss
test dword [ebx], eax
jne 0x4815b2
mov eax, 0x9e66f2c8
mov dh, 0x96
js 0x481533
sbb byte [ecx - 0x548ea4aa], bh
push esi
pop ebx
jno 0x481561
into
ret
Function at 0x53a230
Capabilities:
Encode data using xor

Disassembly:
sub ebp, dword [edi + 0x5a]
jl 0x53a1a2
cmpsd dword [esi], dword es:[edi]
retf
stosb byte es:[edi], al
push ss
jo 0x53a1ee
clc
mov ebp, 0xa771935b
cmc
hlt
ror ecx, 1
adc byte [edx], 0xd6
xor byte [eax + edi*8 - 0x42], cl
pop es
mov dword [eax + 0xf4f9019], ecx
fst dword [eax + 0x27]
mov word [esi + 0x10], cs
add byte [edx], ch
rcr byte [edx], cl
adc eax, 0xadf9b52c
aaa
jp 0x53a21c
pop ebp
test dword [edi - 0x29d43366], eax
cmc
sub al, 0x40
and byte [eax - 0x62], cl
push ebx
jg 0x53a23c
inc ecx
dec esi
popal
mov al, 0x4f
sub cl, ch
aam 0x8d
iretd
jno 0x53a17b
jae 0x53a1f0
xchg dword [eax + edi*2 - 0x73], edx
js 0x53a183
fcomp dword [edi]
mov dword [0x874be0e5], eax
lodsd eax, dword [esi]
in al, dx
idiv dword [ebp + 0x3f]
lahf
lcall 0x9221, 0x9a12c8c2
lcall 0x1cee, 0x2d8d0034
in eax, 0x7f
test dword [eax + 0x2e965137], 0x955b62eb
xchg esi, eax
jmp 0x53a27d
xchg ebp, eax
xor eax, 0xa0f4bf50
pop esi
js 0x53a1f4
mov ch, 0xdf
jne 0x53a28d
jno 0x53a25c
sbb eax, 0xd5f267ff
xor esi, dword [ebx]
xchg esp, eax
rcr byte [ebx + 0x31], 0x33
aad 0x33
xor edx, dword [eax + eax*8 - 0x3ecccea5]
lcall 0xd3d5, 0xff3d7752
sbb dl, bh
xor dword [ebx], esi
rcr dword [edx - 0xc288ae], 0xd5
rcr dword [edx], cl
cmp eax, 0x1ad3d5ff
xlatb
push ebp
cmc
jle 0x53a236
dec ebp
rcr al, cl
and eax, 0xd2dde309
loop 0x53a21d
jo 0x53a296
add eax, 0xe987500e
and al, 0xb1
aaa
lcall 0x5785, 0x169809ad
shr dword [ecx + esi*2 + 0x4d65c74], cl
pushfd
lodsd eax, dword [esi]
or dword [eax - 0x2ca87aea], ebx
lodsb al, byte [esi]
jno 0x53a2da
pop esp
salc
add al, 0x9c
insd dword es:[edi], dx
dec esi
add byte [esi - 0x12], dl
jge 0x53a285
test byte fs:[edi + 0x3ccf43ad], ch
test byte [edi + 0x3ccf43ad], ch
xor ch, dl
invalid
xchg ebp, eax
lea edx, [esi]
dec esp
loopne 0x53a2cd
dec eax
test byte [esi - 0x2a718829], dl
hlt
xchg esi, eax
xlatb
ja 0x53a217
aad 0xf4
clc
or esi, edi
pop ebp
salc
mov al, 0x41
invalid
invalid
pop ds
aad 0x7f
mov ch, 0x7f
retf
jp 0x53a2af
ljmp 0xcb62:0xd7826ff6
invalid
sbb al, 0xb
ja 0x53a273
sbb al, bl
push ds
xlatb
xchg dword [esi], eax
in al, dx
invalid
adc dl, byte [ebx + 0x75]
movsd dword es:[edi], dword [esi]
lcall 0xf674, 0x94cfc7f0
cli
scasd eax, dword es:[edi]
push 0xffffffffffffff93
mov eax, dword [0x8b490f06]
stc
and eax, 0x1330a6f8
inc ecx
mov ah, 0xae
or eax, 0x2e59843b
nop
jg 0x53a2a8
inc ecx
test dword [edx - 0x57c3bea2], ecx
jbe 0x53a305
test al, 0x76
std
outsb dx, byte [esi]
outsb dx, byte [esi]
movsd dword es:[edi], dword [esi]
int3
Function at 0x5546a0
Capabilities:
Encode data using xor

Disassembly:
je 0x5546bc
ret
popfd
pop edi
jl 0x554706
aad 0xb5
xor al, 0xd4
invalid
sbb al, 0xb6
dec eax
shr esi, cl
sbb ah, 0xbb
inc ebp
sub bl, al
mov ss, word [eax + 0x69dd9ae7]
mov bl, 0xd6
push 0xffffffffffffff86
invalid
out 0xb4, eax
fistp qword [esp + ecx*2]
test dword [edx + 0x4187aa47], edx
dec esi
or byte [esi], bh
jae 0x55474b
fld qword [ecx - 0x124f2179]
mov ch, 0x7f
dec ecx
wait
and al, 0x73
xchg ebp, eax
inc byte [0x48717715]
xor byte [ebp + 0x45b05804], dl
pop edi
das
popfd
or byte [esi + 0x6f], al
xchg ebx, edi
inc esp
out dx, eax
xchg ebx, eax
arpl word [edx + 0xf], dx
xchg ecx, eax
pop edx
mov word [eax], cs
in eax, dx
jno 0x5546d9
bound edx, qword [ebx - 0xe31fc33]
int1
adc byte [ebx + 0x43], ch
sbb eax, 0x22cd50b
and dword [edx - 0xf], eax
invalid

Function at 0x5dd870
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x677b07c3
imul byte [eax + 0x15857b9c]
rcr byte [eax], 1
out dx, al
pushal
scasd eax, dword es:[edi]
sub byte [edx - 0x6bc6fa43], ch
jp 0x5dd89c
rol byte ds:[edx + 0x3b2f8e48], 0xb0
stosd dword es:[edi], eax
sbb dword [ebx], esi
sbb bl, byte [eax + edi*2 - 0x1c]
adc eax, 0x97c13ecc
pop ebx
pop edx
cmpsd dword [esi], dword es:[edi]
or al, 0x80
sbb dh, byte [esi + 0x40ab25ca]
rcl byte [edi]
and eax, 0x17d040ab
xor al, 0x37
xchg ebx, eax
adc eax, 0x2b972402
jb 0x5dd8a4
push edi
test byte [esi - 0x80], cl
int3

Function at 0x5de320
Capabilities:
Encode data using xor

Disassembly:
popfd
popfd
mov ecx, 0xc86031d3
movsb byte es:[edi], byte [esi]
push ebx
push ecx
inc edx
add dl, cl
stosd dword es:[edi], eax
imul esp, dword [esi - 0x3987e083], 8
les eax, [edx + 0x2ce04672]
push 0xc
and ecx, 0xfebe8d03
lea edi, [esi - 0x40dbd902]
jl 0x5de36a
mov edx, 0x9600fd5c
movsd dword es:[edi], dword [esi]
invalid
xlatb
insd dword es:[edi], dx
push ss
lcall 0x71ca, 0xc3973066
pop ebp
pop ebx
cmpsd dword [esi], dword es:[edi]
cmp al, 0x7d
rol dword [0x38268fed], cl
adc byte [edx + 4], 0x65
inc esi
xchg dword [ebp - 0x6a], ebp
push esi
invalid

Function at 0x5e0240
Capabilities:
Encode data using xor

Disassembly:
and al, 0xa7
xor ah, dl
insd dword es:[edi], dx
pop sp
add eax, ecx
lcall 0x12d5, 0x61fbb2ab
mov al, 0x82
stc
cmp esi, dword [edi + 0x3c20e589]
sbb ecx, dword [esi - 0x5a]
or eax, 0x524b45e
mov byte [0xc8f8cb8c], al
mov ebx, cs
clc
enter 0xffffffffffffa9af, 0xfffffffffffffffa
mov byte [0x319308a3], al
pop edi
mov ebx, cs
clc
enter 0xffffffffffffa9af, 0xfffffffffffffffa
mov byte [0x319308a3], al
pop edi
pop edi
or dword [esi], ecx
cmp ch, cl
lahf
jle 0x5e021e
retf 0xd0e3