joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e10
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x402fa6
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402f9f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
mov eax, edx
jmp 0x402ea1
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 0xc]
mov eax, 0x15b0
je 0x402f9f
xor edx, edx
cmp eax, 8
mov dword [esp + 8], esi
jb 0x402f15
mov edx, eax
and edx, 0x1ff8
mov dword [esp], edx
mov edx, 7
nop dword [eax]
mov ebx, eax
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + 7]
add edi, eax
mov eax, ebx
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x402ec0
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov ebx, eax
sub ebx, edx
mov dword [esp + 0xc], eax
jbe 0x402e68
mov dword [esp], edx
not edx
add edx, eax
mov dword [esp + 4], edx
mov edx, eax
and edx, 3
mov dword [esp + 0x10], ebx
je 0x402f54
neg edx
xor eax, eax
mov ebx, ebp
nop
movzx esi, byte [ebx]
inc ebx
add edi, esi
add ecx, edi
dec eax
cmp edx, eax
jne 0x402f40
mov edx, dword [esp]
sub edx, eax
jmp 0x402f59
mov ebx, ebp
mov edx, dword [esp]
mov eax, dword [esp + 4]
cmp eax, 3
jb 0x402e60
mov eax, dword [esp + 0xc]
sub eax, edx
xor edx, edx
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x402f70
jmp 0x402e60
shl ecx, 0x10
or ecx, edi
jmp 0x402fab
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4169b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov edx, eax
xor edx, 0xfffffffc
mov ecx, eax
or ecx, 3
and ecx, edx
je 0x4169e3
cmp ecx, 2
jne 0x4169f3
shr eax, 1
mov ecx, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
jmp 0x416b0d
shr eax, 2
mov ecx, eax
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
jmp 0x416b0d
test eax, eax
je 0x416b0d
cmp eax, 8
jb 0x416a7e
mov ecx, edi
sub ecx, ebx
cmp ecx, 0x20
jb 0x416a86
xor ebp, ebp
cmp eax, 0x20
jb 0x416a4d
mov ebp, eax
and ebp, 0xffffffe0
xor ecx, ecx
nop word [eax + eax]
movups xmm0, xmmword [ebx + ecx]
movups xmm1, xmmword [ebx + ecx + 0x10]
movups xmmword [edi + ecx], xmm0
movups xmmword [edi + ecx + 0x10], xmm1
add ecx, 0x20
cmp ebp, ecx
jne 0x416a20
cmp ebp, eax
je 0x416b0d
test al, 0x18
je 0x416b16
mov edi, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xfffffff8
lea edx, [ebx + ecx]
lea esi, [edi + ecx]
and eax, 7
nop dword [eax + eax]
movsd xmm0, qword [ebx + ebp]
movsd qword [edi + ebp], xmm0
add ebp, 8
cmp ecx, ebp
jne 0x416a60
cmp ecx, dword [esp + 0x1c]
mov edi, eax
jne 0x416a8c
jmp 0x416b0d
mov edx, ebx
mov esi, dword [esp + 0x14]
jmp 0x416a8a
mov edx, ebx
mov esi, edi
mov edi, eax
lea ebp, [edi - 1]
mov ebx, edi
and ebx, 7
je 0x416ab2
xor eax, eax
nop dword [eax + eax]
movzx ecx, byte [edx + eax]
mov byte [esi + eax], cl
inc eax
cmp ebx, eax
jne 0x416aa0
add edx, eax
add esi, eax
sub edi, eax
cmp ebp, 7
jb 0x416b0d
xor ecx, ecx
nop dword [eax]
movzx eax, byte [edx + ecx]
mov byte [esi + ecx], al
movzx eax, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], al
movzx eax, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], al
movzx eax, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], al
movzx eax, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], al
movzx eax, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], al
movzx eax, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], al
movzx eax, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], al
add ecx, 8
cmp edi, ecx
jne 0x416ac0
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret
and eax, 0x1f
mov ecx, dword [esp + 0x14]
lea esi, [ecx + ebp]
add ebx, ebp
mov edx, ebx
jmp 0x416a8a
Function at 0x4174e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx edx, word [edi]
test dx, dx
je 0x4175fe
lea eax, [edi + 2]
xor ebx, ebx
mov ecx, 1
nop word [eax + eax]
movzx esi, dx
xor edx, edx
cmp esi, 0x800
setb dl
xor edx, 3
cmp esi, 0x80
cmovb edx, ecx
add ebx, edx
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0x417510
lea ebp, [ebx + 1]
push ebp
call fcn.0044bb80
add esp, 4
mov esi, eax
test ebx, ebx
jle 0x41760c
add ebx, esi
add ebp, esi
mov eax, esi
mov dword [esp + 8], ebp
jmp 0x417578
mov byte [eax], dl
mov ebp, 1
add edi, 2
add eax, ebp
cmp eax, ebx
mov ebp, dword [esp + 8]
jae 0x41760e
movzx edx, word [edi]
test dx, dx
je 0x41760e
cmp dx, 0x7f
jbe 0x417560
mov ecx, eax
not ecx
add ecx, ebp
movzx ebp, dx
cmp ebp, 0x7ff
ja 0x4175c0
xor ebp, ebp
cmp ecx, 2
jb 0x417567
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov ebp, 2
jmp 0x417567
mov dword [esp + 4], ebp
xor ebp, ebp
cmp ecx, 3
jb 0x417567
mov ebp, dword [esp + 4]
mov ecx, ebp
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
shr ebp, 6
mov ecx, ebp
not ecx
or ecx, 0x3f
add ecx, ebp
add cl, 0x81
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov ebp, 3
jmp 0x417567
push 1
call fcn.0044bb80
add esp, 4
mov esi, eax
jmp 0x41760e
mov eax, esi
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x417637
mov eax, ebx
mov byte [esp + ecx + 0xc], al
inc ecx
movzx ebx, byte [esi + ecx]
mov al, 0x2f
cmp ebx, 0x5c
je 0x417632
test ebx, ebx
jne 0x417630
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.0040e540
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4495d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [ebp + 0xc]
mov eax, dword [0x480750]
test eax, eax
jne 0x449616
movaps xmm0, xmmword [0x4751f0]
xorps xmm0, xmmword [0x45dbb0]
movaps xmmword [0x475210], xmm0
mov eax, dword [0x475200]
lea ecx, [eax + eax]
and ecx, 0x6ae60654
neg ecx
add eax, ecx
add eax, 0xb573032a
mov dword [0x475220], eax
mov eax, dword [ebp + 8]
mov dword [0x480750], 1
push eax
sub esp, 0x10
mov esi, esp
sub esp, 0x40
mov edi, esp
sub esp, 0x40
mov dword [ebp - 0x1c], esp
mov ecx, dword [0x475220]
mov dword [esi + 0x10], ecx
movaps xmm0, xmmword [0x475210]
mov dword [ebp - 0x10], esi
movups xmmword [esi], xmm0
cmp edx, 0x40
jae 0x449653
mov esi, eax
jmp 0x4496c3
shr edx, 6
mov dword [ebp - 0x14], edx
xor ecx, ecx
nop dword [eax + eax]
mov dword [ebp - 0x18], ecx
mov esi, eax
xor ebx, ebx
nop word [eax + eax]
movzx eax, byte [esi + ebx]
mov dword [edi + ebx], eax
movzx ecx, byte [esi + ebx + 1]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx], ecx
movzx eax, byte [esi + ebx + 2]
shl eax, 0x10
or eax, ecx
mov dword [edi + ebx], eax
movzx ecx, byte [esi + ebx + 3]
shl ecx, 0x18
or ecx, eax
mov dword [edi + ebx], ecx
add ebx, 4
cmp ebx, 0x40
jne 0x449670
push edi
push dword [ebp - 0x10]
call fcn.0044a2b0
add esp, 8
mov ecx, dword [ebp - 0x18]
inc ecx
lea eax, [esi + ebx]
cmp ecx, dword [ebp - 0x14]
jne 0x449660
add esi, ebx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
xorps xmm0, xmm0
movups xmmword [ecx + 0x30], xmm0
movups xmmword [ecx + 0x20], xmm0
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx], xmm0
and edx, 0x3f
mov edi, ecx
je 0x449729
mov ecx, esi
xor esi, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
nop dword [eax]
mov eax, edi
movzx edi, byte [ecx + esi]
mov ebx, esi
and ebx, 0xfffffffc
mov edx, esi
or edx, 3
mov ecx, esi
xor ecx, 0x1c
and ecx, edx
mov edx, dword [eax + ebx]
shl ecx, 3
shl edi, cl
mov ecx, edi
and ecx, edx
add edi, edx
add ecx, ecx
sub edi, ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + ebx], edi
mov edi, eax
mov edx, dword [ebp - 0x18]
inc esi
cmp edx, esi
jne 0x4496f0
mov edx, dword [ebp + 0xc]
lea ebx, [edx*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, edx
and ecx, 0x3c
xor dword [edi + ecx], eax
mov esi, dword [ebp + 0x10]
mov eax, edx
not eax
test al, 0x38
jne 0x449774
push edi
push dword [ebp - 0x10]
call fcn.0044a2b0
mov edx, dword [ebp + 0xc]
add esp, 8
xor eax, eax
mov esi, edi
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov edi, esi
mov esi, dword [ebp + 0x10]
mov dword [edi + 0x38], ebx
shr edx, 0x1d
mov dword [edi + 0x3c], edx
push edi
mov edi, dword [ebp - 0x10]
push edi
call fcn.0044a2b0
add esp, 8
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4063c0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4063ff
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4063ff
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4063ff
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4063ff
cmp dword [ecx + 0x74], 0xe
jbe 0x4063ff
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40bf53
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40bff0
push ebx
push esi
call fcn.0040bf1c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040beb0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40bf9d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bfef
push edi
push eax
call fcn.0040cb70
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40bfbd
call fcn.0040aa11
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bfee
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040beb0
add esp, 0x20
test eax, eax
jne 0x40bfdc
push edi
call fcn.0040aa11
jmp 0x40bfe4
push ebx
call fcn.0040aa11
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d2ed
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46ea08
push 0x46ea00
push str.FlsAlloc
push 0x1f
call fcn.0040d1ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d321
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
jmp 0x40d327
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d36b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46ea18
push 0x46ea10
push str.FlsGetValue
push 0x21
call fcn.0040d1ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d3a2
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d3aa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46ea20
push 0x46ea18
push str.FlsSetValue
push 0x22
call fcn.0040d1ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d3e4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x412840
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41286d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41286d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x3d7a2aa6
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, str.__c
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x247c07d3
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4579ae
Capabilities:
Encode data using xor

Disassembly:
fisubr dword [edi + eax*4]
mov dword [0xe22eef01], eax
or dword [edi + ecx + 0x3c], ecx
in eax, dx
mov eax, dword [0x832e3672]
adc eax, 0xd9f83572
in eax, dx
dec edx
push ss
and eax, 0xfba28351
xchg ebp, eax
xor eax, 0xb9dfa5b4
mov ah, 0xa5
fistp qword [ecx - 0x76a0c263]
push es
jecxz 0x4579ee
xchg edi, eax
out 0x19, eax
xchg ecx, eax
mov ah, 0xa5
fistp qword [ecx - 0x76a0c263]
push es
jecxz 0x4579ee
xchg edi, eax
out 0x19, eax
xchg ecx, eax
push ds
sbb dword [esi - 0xee00d2e], esi
stc
mov esp, 0xa60ee88f
push ds
cmc
sbb bh, byte [edx + 0x7a]
sbb dword [ecx - 0x1e], edx
movsd dword es:[edi], dword [esi]
jl 0x45798d
salc
pushal
lodsb al, byte [esi]
ja 0x457a2e
sub dh, ah
adc al, 0xdb
or esi, dword [eax + 0x29]
invalid
add esi, dword [ebx - 0x11]
ret 0xe26d
test eax, 0xa26fe03c
cld
cmc
or ch, byte [ebx - 0x4a]
inc eax
add dl, byte [esi - 0x2b9ede1a]
mov eax, 0x1eb661bb
mov dh, 0x8f
js 0x457a3b
movsb byte es:[edi], byte [esi]
bnd retf 0x49b5
lahf
mov edi, 0xf5bd6958
inc ebx
mov edx, dword [eax - 0x75]
pop edi
add dword [esi + 0xf28b9e9], ecx
pop ss
mov ebx, 0x1a42fc51
mov ah, ch
sbb bh, al
mov esp, 0xc393acfa
or byte [edx - 0x5a], ch
adc eax, 0xd6e9fdf0
xor edi, dword [esi - 0x66c3479f]
sti
add bl, byte [edi]
jle 0x457a30
pop eax
imul edi, dword [ebp + 0x508b43f5], 0x8e015f8b
jmp 0x1754a2f9
mov al, 0xe6
std
loopne 0x4579f4
test eax, 0xab049490
int 0xca
out dx, al
xchg edi, eax
adc eax, 0xf7f18d9f
mov dl, 0xd3
mov al, 0xe
or eax, dword [eax]
adc dword [ecx - 0x34], edi
mov dh, al
cmp dword [ebx + 0x1aec4ece], ecx
pop esi
push ebp
mov cl, 0xcd
bound esp, qword [0xcd909567]
dec ecx
and bl, byte [esi + 0x26]
mov ah, 0xd
and eax, 0x3cd5302d
push edx
invalid
Function at 0x468776
Capabilities:
Authenticate hmac

Disassembly:
push 0x65
in al, 0xe1
nop
cdq
into
fstp qword [esi]
lds esi, [eax + 0x2095e111]
inc dword [ebp + 0x54]
invalid
push es
call dword [0x60dbc284]
add eax, 0x11a44c1f
not dword [esi]
in al, 0x59
and dword [ecx - 0x3477bbd6], edx
dec edx
leave
mov dl, bh
jge 0x4687d3
jge 0x46875e
salc
and eax, 0xe865984b
out 0x72, eax
ja 0x4687fa
out dx, al
loopne 0x4687e9
sbb bh, byte [ebx + 0x73]
wait
mov eax, dword [0x8855e404]
popfd
mov eax, dword [0x2645c068]
pop esp
mov dh, 0xf0
mov eax, dword [0xd75bc4d8]
shl ecx, 1
xchg ebp, eax
bound esp, qword [edi]
rcr byte [edx + esi*4 + 0x502a70f0], cl
push 0xe1115948
in al, 0x45
inc ebp
push eax
pushal
push 0x5c
lodsb al, byte [esi]
test dword [ebx - 0x4d5475d9], edi
mov byte [ebx], cl
sar byte [eax], 1
inc esp
and al, 2
daa
mov ch, byte [ebx - 0x2ff4774e]
cmp byte [esp + 2], al
mov gs, word [ebp + 0xf]
cmc
push esi
mov dword [edi + 0x41e385fe], edi
mov ecx, dword [eax + 0x186da3af]
push es
mov dword [0xa4a4f116], eax
lcall 0x9aee, 0xbbe8e5cd
xor edi, esi
xor dword [ebx + 0x22cba978], esp
pop edx
and eax, 0x8d56f017
sbb dword [edx], esp
sub al, 0xc1
xor eax, 0xa74450bf
adc dword [ebx - 0x3f], 0x41e1413e
mov edi, 0x5427bdba
cmp byte [ebx], cl
sar ebp, 0x5b
pop ebx
lea eax, [esp + ebx*8 - 0x4b]
shr byte [edi], 0x2f
je 0x468875
out dx, al
lcall 0x781d, 0x2431f731
test eax, 0x255a22cb
pop ss
invalid
xor edx, eax
pop ecx
jecxz 0x4687cb
mov eax, 0x6b1de875
adc eax, 0xecdee1cb
popfd
inc ecx
cmp dword [edi - 0x2a], esp
jne 0x46889b
neg dword [ebp + 0x1140a048]
rol byte [edx], cl
sbb al, byte [ebp - 0x7e]
and dword [esi + esi - 0x3612205f], 3
rdmsr
jns 0x468897
and dword [ecx - 0x2c2920d0], edi
mov dl, 0x89
jl 0x468831
add al, 0x23
xchg esi, eax
pop ecx
cmc
sar byte [ebp - 0x7f5d11f3], 1
aad 0x35
fstp dword [ebp + 0x50]
out dx, al
mov byte [0xd935d580], al
pop ebp
push eax
invalid
lds edx, [edi]
aaa
in eax, 0x2f
das
inc edi
pop esp
dec esp
clc
lds ebp, [esi - 0x7f]
mov esp, 0xefd279c0
or dword [edi + 0x35], 0x7dbc55f6
rol dword [0x3b0e0f5], 0xff
mov cl, 0xc4
and dword [esi + eax*4 - 0x662a4653], esi
push dword [ecx - 0x794bde3c]
lodsd eax, dword [esi]
mov ecx, 0x1bc99d5
cmp al, 0xa2
xchg byte [ebp - 0x43662a47], ch
add dword [edx], edi
mov esp, 0x7ea23c01
cli
jle 0x4688bf
out dx, al
call 0x2a3dbb55
shr dword [eax], 1
scasb al, byte es:[edi]
je 0x46886f
mov byte [0xb18d9de8], al
in al, 1
pop ss
rcl dword [esp + ebp*4]
lodsb al, byte [esi]
sar dword [edx + 0x34], 0x51
out dx, eax
mov al, 0x81
jle 0x4688ba
dec ebp
in al, 0xe2
salc
sbb al, 0xe3
jecxz 0x4688da
inc esp
cli
xchg ah, ch
sal byte [edx], 0x51
jl 0x468949
int 0xb6
xor dword [edi - 0x37878f80], eax
out 0x82, eax
enter 0x3939, 0xffffffffffffffc1
mov bh, 0x7c
jge 0x4688b5
cmp byte [ecx], dl
rep insb byte es:[edi], dx
jmp 0x468946
loope 0x468952
xor al, 0x38
cwde
or al, 0xa9
xor al, 0xb2
cmp byte [eax - 0x4dcb56f4], bl
inc dword [esp + eax*2]
xchg edi, eax
mov ebp, 0x366adff8
inc esi
pop ss
invalid
Function at 0x46f01e
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x272c4644
cmp eax, 0xe086eaba
movsb byte es:[edi], byte [esi]
das
lcall 0x808f, 0xd32e82fe
pop edi
or dword [ecx + 0x2c], 0xb8602271
invalid
Function at 0x494bc2
Capabilities:
Packed with generic packer

Disassembly:
mov edi, 0xa24095
add ah, dh
inc dword [eax]
xchg esi, eax
inc eax
add byte [eax], al
add ah, dh
inc dword [ebx]
add byte [eax + eax*4], dl
add byte [ecx + 0x73], ch
je 0x494c17
push ebx
jns 0x494c51
add byte [eax], al
insd dword es:[edi], dx
jae 0x494c58
jb 0x494c53
add byte [edi + 0x3e], ah
add byte es:[esp + edi*2 + 0x43000040], dl
jb 0x494c58
popal
je 0x494c36
add byte [eax], al
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], al
dec eax
xchg esi, eax
inc eax
add byte [eax], al
or al, 0
push ebx
insb byte es:[edi], dx
add al, byte [eax]
add al, byte [eax]
add byte [eax], al
or al, 0x7d
inc eax
add cl, bl
add byte [edx + 0x65], dh
jb fcn.00494c7e
popal
je 0x494c81
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
or byte [eax], al
add al, al
add byte [esi + 0x40], dl
add al, 0x53
add byte [eax], al
add al, byte [eax]
or bh, byte [ebx + ebp + 0x20000]
add byte [eax], al
add al, byte [eax]
or dword [ecx + 0x43], eax
outsd dx, dword [esi]
add byte [eax], al
popal
jb 0x494ca8
jb 0x494c47
jb 0x494c47
add byte [edx], bh
add byte [eax + 0x407d], ah
add byte [edx + 0x65], dh
popal
popal
je 0x494cba
dec ebx
add byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [edx], al
add byte [eax], al
xchg esi, eax
inc eax
add byte [eax], al
add byte [eax + 0x666c6500], al
add al, byte [eax]
or byte [eax + 0x2000000], bh
add byte [edx], cl
inc ebx
cmp dword [eax], eax
insb byte es:[edi], dx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [edi], ah
add byte [edx], dh
add byte [eax + 0x7e], ah
inc eax
add byte [edx], al
or byte [eax], cl
add byte [eax], al
add byte [eax], al
add al, 0x53

Function at 0x4982e2
Capabilities:
Encode data using xor

Disassembly:
and byte [edi], ch
outsd dx, dword [esi]
adc dword [ebp - 0x48], 0x485e7ca3
add edx, 0x16914eb6
mov gs, word [ebx - 0x1683c464]
add edi, dword [ebp + ebx*4 - 0x47]
sti
invalid
jmp 0xd87c54b9
je 0x4982d0
xchg ecx, eax
ficomp word [eax + 0x6ae9b163]
pop edi
cdq
jle 0x498297
mov ebx, 0x3918bd78
jo 0x498366
adc al, 0x97
invalid
mov dl, 0x8f
adc dword [esi - 0x12937363], esi
xor byte [ebp - 0x17], 0x53
arpl bx, dx
sbb dword [eax - 0x73cc29c0], edi
popfd
jae 0x498352
dec esi
adc al, 0x4d
mov dh, 9
insb byte es:[edi], dx
outsb dx, byte [esi]
or edi, dword [ebx + 0x44]
fisubr dword [ecx]
aas
les ebp, [esi + 0x57fe775c]
or ecx, edi
imul dword [esi]
wait
cmc
mov al, byte [0xd99e9738]
and al, 0xfd
mov esi, 0x4e5149f8
idiv dword [ecx]
xchg esi, eax
pop edx
clc
shr ch, cl
scasb al, byte es:[edi]
mov ebx, 0x9eff6e2e
add byte [ecx + 0x4c], cl
dec ecx
dec esp
or eax, 0x1dc4483e
mov ch, 0xb8
scasd eax, dword es:[edi]
dec eax
or dword [eax + 0x795afa11], ebp
cmp eax, 0x91090714
lcall 0xbfe2, 0x98fc1a7
sbb al, 0x90
mov eax, dword ds:[ecx - 0x2e]
sar eax, 1
ficom dword [ecx - 0x562324ef]
xchg esp, eax
test eax, 0x8d9881e1
dec eax
cmp cl, cl
xchg esi, eax
fsub qword [ecx - 0x4233787]
mov cl, 0xde
jmp 0x49839c
Function at 0x4ac662
Capabilities:
Packed with generic packer

Disassembly:
popal
je 0x4ac6ca
dec ebx
add byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [edx], al
add byte [eax], al
xchg esi, eax
inc eax
add byte [eax], al
add byte [eax + 0x666c6500], al
add al, byte [eax]
or byte [eax + 0x2000000], bh
add byte [edx], cl
inc ebx
cmp dword [eax], eax
insb byte es:[edi], dx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [edx], al
or byte [eax], cl
add byte [eax], al
add byte [eax], al
add al, 0x53
Function at 0x4b6c0a
Capabilities:
Encode data using xor

Disassembly:
dec ebp
push cs
nop
add al, 0xfb
xchg edi, eax
pop ebx
movsd dword es:[edi], dword [esi]
invalid
ret 0x5218
cwde
cmp dword [ebx - 0x6a24f7dc], eax
pop edi
pop esi
pop ebp
in eax, dx
jle 0x4b6c35
leave
mov byte [ebp + 0x3d], bl
out 0x53, eax
or byte [edx], 0xad
imul edi, dword [eax], 0xffffff90
fcomp st(0)
jnp 0x4b6bb4
xchg esi, eax
aad 0xbb
int 0xdc
push ebx
imul ebp, dword [ebp + 0x743c2e2a], 0x23
xchg edi, eax
pop esi
cmp byte [bx + 0xa], cl
sub dl, bh
sub al, 0xc9
lea ebx, [ecx + 0x33]
dec edx
and al, 0x12
dec ebx
cmp byte [edi + 0x1714f169], 0xf8
jg 0x4b6bd6
aam 0x64
push edx
loope 0x4b6cbe
xor eax, 0x66b4388e
test ecx, esi
xor al, 0x87
rol dword [ecx - 0x61c2e567], 0x77
mov esi, 0x35be90db
int3
pop ds
mov eax, 0x4adbdc1f
dec edx
aam 0x3a
xchg esp, eax
div ebx
enter 0x1d02, 0x57
sub bh, bl
mov dword [0x7dfc41df], eax
cld
mov ebx, 0xa8d0da79
push cs
lodsb al, byte [esi]
test al, 0x4e
les ebp, [esi + 3]
push esi
sbb dword [ecx - 7], edx
sbb dword [0x7cd4c0af], edi
dec esp
arpl word [edi + edi - 0x75], sp
adc ch, byte [ebp + 0x7d]
fistp qword [0x3953e1a5]
outsb dx, byte [esi]
inc ecx
mov cl, 0x8f
xor eax, 0x78180c3b
jne 0x4b6cc3
das
mov dh, 0x7e
adc dword [edx + ebp*4], eax
add al, 0xaa
xchg esi, eax
jg 0x4b6d2c
adc byte [edi - 0x1b35571f], dl
stosb byte es:[edi], al
ljmp 0x80d8
add dword [edi], ebp
cmp eax, dword [edx - 0x31e47f28]
mov bh, 0xb
nop
mov ebp, 0xaa407912
and byte [ecx], bl
invalid
adc eax, 0x845bd0f6
rcr byte [ebx - 0x7c], 1
dec esp
adc byte [ecx], bh
jb 0x4b6d7e
movsd dword es:[edi], dword [esi]
test al, 0xf7
bound edx, qword [eax - 0xc9d9536]
sub byte [ebp - 0x16], dl
inc ecx
popal
fild word [edx - 0x3f]
mov ch, 0x22
inc eax
cld
jns 0x4b6d2a
jp 0x4b6d72
fidivr dword [edi]
xlatb
in eax, 0xb2
dec esi
or al, 0xc2
enter 0x3a67, 0xffffffffffffffb5
or byte [edx], dl
sal byte [edx - 0x49], cl
mov ch, 8
adc dl, dl
jb 0x4b6d16
push esp
pop ds
add ebp, dword cs:[esi + 0x701f9c8b]
pop es
mov edx, dword [edx - 0xf83f80]
out 0x9c, al
stosd dword es:[edi], eax
cli
cmpsd dword [esi], dword es:[edi]
xchg edx, eax
push edx
mov eax, dword [0x9a752e4]
loope 0x4b6d09
mov bh, byte [ecx + 0x31]
jns 0x4b6db2
sahf
cmp byte gs:[esp + ebx*8], bh
mov byte [ecx], bh
test eax, 0x7bd771e7
dec esi
ja 0x4b6d59
ret
push edx
pop esp
rcr dword [0x67b3b216], 1
ret 0xb8f0