joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022de0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10022e12
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x10022f50
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
push ebp
mov ebp, dword [esp + 8]
test ecx, ecx
je 0x10022f71
mov edx, dword [esi + 0x134]
push edx
push ebx
push ebp
push eax
push esi
call ecx
add esp, 0x14
pop ebp
ret
test eax, eax
jl 0x10022fa7
cmp eax, 2
jg 0x10022fa7
mov ecx, dword [esi + 0x130]
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fwrite]
push ecx
push 1
lea edx, [eax + eax*2 + 0x1003dc30]
push 2
push edx
call edi
mov eax, dword [esi + 0x130]
push eax
push 1
push ebx
push ebp
call edi
add esp, 0x20
pop edi
xor eax, eax
pop ebp
ret

Function at 0x100232b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + eax*4 + 0x154]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x1002332d
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x10023304
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.10027ba0
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.10023130
mov ecx, dword [esi]
add esp, 0x14
mov dword [ecx + 0x860c], ebp
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10026e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [ebp + 8]
call fcn.10026b09
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.10026b44
mov dword [0x8d80b192], eax
inc ebp
call 0x60eacc3a
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10026b54
push eax
push esi
push dword [ebp + 8]
call fcn.10026b09
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10026b54
push eax
push esi
push dword [ebp + 8]
call fcn.10026b09
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
pop ecx

Function at 0x10027080
Capabilities:
Inspect section memory permissions

Disassembly:
adc byte [eax], al
add bh, bh
jne 0x10027061
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x1002733d
test bh, dl
add al, byte [eax]
add bh, bh
mov ch, 0x4c
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.10026ab5
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x100270b4
invalid
xor ecx, dword [edi]
mov bh, 0x45
or al, 0x8b
dec ebp
mov esp, 0xff80048d
je 0x1002704f
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.10026ab5
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
inc edi
push es
adc byte [ebp + 0x488bc104], cl
adc al, 0x8b
inc eax
or al, 3
dec ebp
adc byte [ebx], al
invalid
jb 0x10027081
call fcn.10026b44
pop edx
push 0x5e
mov edi, dword gs:[esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100270b0
Capabilities:
Inspect section memory permissions

Disassembly:
adc byte [eax], al
add bh, bh
jne 0x10027061
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x1002733d
test bh, dl
add al, byte [eax]
add bh, bh
mov ch, 0x4c
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.10026ab5
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x100270b4
invalid
xor ecx, dword [edi]
mov bh, 0x45
or al, 0x8b
dec ebp
mov esp, 0xff80048d
je 0x1002704f
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.10026ab5
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
inc edi
push es
adc byte [ebp + 0x488bc104], cl
adc al, 0x8b
inc eax
or al, 3
dec ebp
adc byte [ebx], al
invalid
jb 0x10027081
call fcn.10026b44
pop edx
push 0x5e
mov edi, dword gs:[esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002a5f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x10039a44
push ecx
call fcn.100230a0
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.10029790
test eax, eax
jne 0x1002a620
mov eax, esi
jmp fcn.10029c30
ret
Function at 0x100331b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push eax
call fcn.10033190
add esp, 4
mov dword [esp + 0xc], eax
jmp dword [sym.imp.MSVCR90.dll__read]

Function at 0x100371f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push edi
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x5a
cmp eax, edi
jne 0x10037215
xor eax, eax
pop edi
add esp, 0x10
ret
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp ebp, edi
je 0x100373b9
mov esi, dword [esp + 0x28]
cmp esi, edi
je 0x100373b9
push ebx
push 0x1003a564
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
mov ebx, eax
add esp, 8
mov dword [esp + 0x24], ebx
cmp ebx, edi
jne 0x10037256
pop ebx
pop esi
pop ebp
mov eax, 0x5a
pop edi
add esp, 0x10
ret
push 2
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fseek]
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x10037381
push ebx
call dword [sym.imp.MSVCR90.dll_ftell]
push 0
mov ebx, eax
mov eax, dword [esp + 0x2c]
push 0
push eax
call edi
add esp, 0x10
test eax, eax
jne 0x10037381
cmp ebx, 0x100000
ja 0x10037381
mov eax, ebx
cdq
push edx
push eax
call fcn.10033190
mov ebx, eax
add esp, 8
cmp esi, ebx
ja 0x10037381
lea ecx, [ebx + 1]
push ecx
call dword [0x10044008]
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x10037381
mov edx, dword [esp + 0x24]
push edx
push 1
push ebx
push eax
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x10037381
cmp esi, ebx
jne 0x1003730e
mov ecx, dword [esp + 0x10]
mov eax, esi
mov edi, ebp
cmp esi, 4
jb 0x10037355
mov edx, dword [edi]
cmp edx, dword [ecx]
jne 0x10037381
sub eax, 4
add ecx, 4
add edi, 4
cmp eax, 4
jae 0x100372f4
jmp 0x10037355
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
mov byte [ebx + eax], 0
push edx
mov ebx, eax
call fcn.10037120
add esp, 8
test eax, eax
jne 0x10037381
cmp esi, dword [esp + 0x1c]
jne 0x10037381
mov ecx, dword [esp + 0x14]
mov eax, esi
mov edi, ebp
cmp esi, 4
jb 0x10037355
mov edx, dword [edi]
cmp edx, dword [ecx]
jne 0x10037381
sub eax, 4
add ecx, 4
add edi, 4
cmp eax, 4
jae 0x10037341
test eax, eax
je 0x10037379
mov dl, byte [ecx]
cmp dl, byte [edi]
jne 0x10037381
cmp eax, 1
jbe 0x10037379
mov dl, byte [ecx + 1]
cmp dl, byte [edi + 1]
jne 0x10037381
cmp eax, 2
jbe 0x10037379
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x10037381
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x1004400c]
mov edx, dword [esp + 0x18]
push edx
call dword [0x1004400c]
mov eax, dword [esp + 0x2c]
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.MSVCR90.dll_fclose]
mov eax, dword [esp + 0x24]
add esp, 0xc
pop ebx
pop esi
pop ebp
pop edi
add esp, 0x10
ret
pop esi
pop ebp
mov eax, 0x5a
pop edi
add esp, 0x10
ret

Function at 0x100377a6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10044054]
jne 0x100377b0
repz ret
jmp fcn.10037ecf
Function at 0x421570
Capabilities:
Encode data using xor

Disassembly:
wait
push 0xffffffffffffffca
jge 0x4215c2
lds ebx, [esi]
jg 0x42152b
and bl, 5
bound ecx, qword [esi + 0x64bbc4e7]
retf
dec eax
lahf
invalid

Function at 0x421bb4
Capabilities:
Encode data using xor

Disassembly:
inc edx
mov eax, 0xd2d20c2b
adc al, 4
mov edi, 0x7d77e8c2
sahf
mov eax, 0x9bedb311
dec esi
xor cl, al
mov bh, byte [ebx - 0x5b]
invalid

Function at 0x428e30
Capabilities:
Encode data using xor

Disassembly:
push ds
inc eax
call 0xa2fe3a74
cmp edx, dword [esi]
dec esp
aad 0x32
xor dword [edx - 0x4eb4a0d3], edi
insb byte es:[edi], dx
out 0x8c, eax
sub byte [eax], bl
jo 0x428e1b
invalid

Function at 0x429084
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x12
mov bh, 0x4a
test ah, dl
ret
fsubr qword [eax]
add bl, byte [ebx]
push 0x4b
jg 0x428ff8
invalid
sti
jne 0x429038
and byte [eax + 0x5f], 0xe5
adc dword [esi + 0x464f6984], edi
movsd dword es:[edi], dword [esi]
dec ebp
mov edi, 0x3fdf4f8a
rcr dword [edi + 0x26], 1
fcom qword ss:[esi - 0x33]
fcom qword ss:[esi - 0x33]
sbb esi, edx
fdiv st(2)
dec dword [edi + 0x70db3a90]
les edi, [edi + ecx]
push cs
insb byte es:[edi], dx
or dword [eax - 0x5a30e8fd], ecx
daa
push edi
adc byte [eax], cl
dec ecx
or al, 0xf3
pushal
adc eax, dword [0xffff9f6f]
lea esi, [ebp + 0x242140b8]
xor cl, byte [edx + 0x60c03303]
stc
stc
bnd je 0x42908c
into
mov ebx, 0x7117f5b
jg 0x429052
je 0x4290f9
xor byte [ecx + 0x1d0649a], ah
jle sym.DDZ.exe__Suitabcontrol_TsuiTab__bctr_qqrp18Classes_TComponent
leave
insb byte es:[edi], dx
pop ebp
or eax, 0xefb83411
xchg esi, eax
outsd dx, dword [esi]
aad 0xc8
mov edx, 0x2f69c174
shr dword [edx + 0x45], 1
cmpsd dword [esi], dword es:[edi]
xchg esi, eax
and al, 0
invalid
inc esi
push ecx
test eax, 0x6d9d0685
jecxz 0x4290f1
adc bh, cl
and edx, edx
mov esi, 0x4d65df6a
int 0x10
inc ecx
shr dword [ebx], 0x31
insd dword es:[edi], dx
sti
mov dword [0x7bf01f82], eax
jb 0x429122
inc ebx
xchg byte [ecx], al
or ecx, dword [ecx]
inc byte [esi - 0x40b1208]
cmp byte [esi + 0x65d5045f], dl
xor ebx, dword [ebp + 0x3c744379]
add al, 0xd5
xor ebx, dword gs:[ebp + 0x3c744379]
insd dword es:[edi], dx
push es
push 0xb5837c81
invalid
Function at 0x430f94
Capabilities:
Encode data using xor

Disassembly:
jb 0x430f49
pop eax
dec esp
mov esi, 0x30566426
lcall 0x5d58, 0xe017a20e
pop ss
loopne 0x430fa1
pop ebp
add eax, dword [esi - 0x945aa2]
mov eax, 0x11f398a8
sbb bl, bh
xor eax, 0x460cb7ab
push esi
imul ebp, dword [edx - 0x14], 0x80632a67
sar dword [ecx + eax*2], 0x9d
jne 0x430f3a
into
or edi, dword [edi - 0x7fe31038]
cmp dword [edx], 0x58
jge 0x430fac
xor byte [edi - 0x67], 0xae
sub ebp, dword [edi]
mov al, bl
outsb dx, byte [esi]
ja 0x430f10
or al, 0xbe
fstp st(0)
das
jo sym.DDZ.exe__Suiradiogroup_TsuiCheckGroup_SetChecked_qqrixo
cmp dl, byte [edi + 0x5e55164e]
or dword [ecx + 0x20], esp
lock xchg dword [edi + ebp*4], edi
scasd eax, dword es:[edi]
pushal
mov ds, word [esp + ecx*4 + 0x341f1c8c]
imul ebx, dword [0x2c4ddd36], 0x54
dec ebp
sub al, 0x54
cmp ah, dh
push ebp
fstp xword [ebx]
xchg edx, eax
mov ah, 0xb
add byte [ecx - 0x7154390f], bh
push 0x54e3bc8b
jo 0x430f46
add bh, cl
aam 0x65
dec eax
not byte [ebx + ebp - 0x5157c80a]
shr byte [eax - 0x24], 1
adc byte [0xd44547a6], ah
aad 0x59
cmc
stosb byte es:[edi], al
pushal
retf 0xcb50

Function at 0x431a6c
Capabilities:
Encode data using xor

Disassembly:
invalid
inc edi
or al, 0xa2
push ebp
cwde
adc dword [edi + 0x4de4f6c8], 0x98ce0d71
jge 0x431a39
mov ebx, 0xc43479b5
mov ch, 0x79
xor al, 0xc4
xchg edx, eax
xchg esi, eax
inc esi
xlatb
xor dword [eax - 0x4d], ebx
mov bh, 0xde
lds ebp, [esi - 0x10b4bdb4]
sub al, 0x45
adc esp, esi
loope 0x431a7d
int 0xa4
inc ecx
push ds
fisttp qword [ebx + 0x2ccf628e]
pop esi
mov cl, 0x49
and dl, byte [edx - 0x58bebcc8]
pop ds
fnstcw word [ebx]
shr byte [eax], 0x14
js 0x431af7
jmp dword [edx + 5]
xlatb
cmpsd dword [esi], dword es:[edi]
fidivr dword [eax - 0x6603db55]
fisttp qword [edi - 5]
dec edi
dec edi
mov ebp, 0x71475ac8
invalid

Function at 0x43638c
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x778d73a9
inc ebp
daa
push esp
and dword [ecx], eax
mov esp, 0x82353924
xchg dword [edi - 0x48f87b46], esi
jbe 0x436378
xchg edx, eax
pop ds
in eax, 0xee
xchg ebp, eax
mov ebp, dword [edx]
adc al, dh
push ecx
sti
pop es
xor dl, dl
inc ecx
cmp ebx, esp
mov bl, 0xc1
inc edx
dec ebp
cwde
sbb eax, 0x92db3ca4
ficom word cs:[esi]
invalid

Function at 0x4370bc
Capabilities:
Encode data using xor

Disassembly:
xor cl, ah
jl 0x43711c
invalid
adc eax, 0x5a6256f
invalid

Function at 0x43a8cc
Capabilities:
Encode data using xor

Disassembly:
das
jae 0x43a8cd
invalid
mov esp, 0x1ca857b9
mov ch, 0xc7
movsd dword es:[edi], dword [esi]
or eax, 0xaec85754
or esi, dword [ebp - 0x2b]
sbb al, byte [edi - 0xe0fecb0]
mov ebp, 0x842b114d
mov dword [0xe5afeffd], eax
dec edx
inc dword [esi - 0x7a]
sub dword [esi + 0x7187447b], ebp
inc esp
invalid
invalid
inc esp
xchg dword [ecx + 0x37], esi
aaa
mov dl, 0x6b
scasd eax, dword es:[edi]
lock xor word [0x763d8e6], ax
jno 0x43a8cf
lodsb al, byte [esi]
cmp dword [edi - 0x476a3083], ebp
cmp dword [edi - 0x7e], eax
cli
cmp bh, byte [esi - 0x6b]
outsb dx, byte [esi]
push ss
jns 0x43a8a2
mov cl, dh
ret 0x771e
Function at 0x43b844
Capabilities:
Encode data using xor

Disassembly:
push edi
sbb byte [eax - 0x2d], dh
ja 0x43b8a1
adc bh, byte [esi - 0x2d08ccfe]
mov edi, 0x4650f59f
xor byte [ebx + ebx*4 + 0x47772dae], bl
pop ebp
mov bh, 0x1b
pop ebp
mov bh, 0xba
add al, 0x9d
dec edi
mov ebx, 0xf5caf657
popfd
and byte [ebx + 0x769312b6], 0xae
cmpsb byte [esi], byte es:[edi]
in eax, 0x74
xchg byte [ecx - 0x12a8ab15], cl
retf
invalid
inc ebp
cmp cl, bh
call 0x45934bb7
mov ah, 0xe0
jo 0x43b88b
or byte [esi], dl
mov edx, 0x7cd30fd3
ret 0xc85a

Function at 0x43c784
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x8ca0d474
fstp qword [ebx + 0x329c9558]
add dword [edi - 0xa430f10], esp
scasb al, byte es:[edi]
push ebx
xor dword [esi - 0x25], 0x78
sub al, 0xb8
push ebx
clc
pop edx
xchg ebp, eax
jbe 0x43c75f
or dword [0x746b75e5], 0x3d
push esi
adc dl, ch
arpl word [ebx + 0x6e08b5a7], bx
fbstp tbyte [ebx - 0x5ec39840]
cmp dword [esi - 0x2988cd82], esp
cwde
mov ch, dl
jb 0x43c753
xor byte [edx], 0x38
xchg esp, eax
cmp eax, 0x3c849894
xor ebx, dword [ebx + esi*8 + 0x9fdd138]
xchg dword [ebx], ebx
sub dword [eax - 0x3918238b], ebx
adc al, 0xc5
adc byte [ecx], ch
enter 0xfffffffffffffe44, 0xffffffffffffffd0
fld xword [ecx]
add ebp, dword [ecx + 0x296a4eb2]
stosd dword es:[edi], eax
jge 0x43c80c
invalid
cmp byte [ebx + 0x7aa46c1b], bh
ret 0x3066

Function at 0x43d3f4
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov ebx, 0x911451c3
dec ebp
das
fbld tbyte [esi + 0x10faacf6]
in eax, 0x71
xchg esp, eax
adc dword [ebx], 0xef051088
xor dword [esi + 0x1b], ebx
xchg dword [edx - 4], esp
xor eax, 0xf5fec299
dec ebx
xchg dword [esi + 0x60], edx
mov edi, 0x629ac726
mov cl, 0x42
xchg ecx, eax
out 0x8e, al
mov bh, 0xda
lds esi, [ebx]
wait
xor dword [esi - 0xd], 0x469b49d7
cmp bl, byte [edx + 0x61]
push cs
jge 0x43d3e3
invalid
insb byte es:[edi], dx
invalid

Function at 0x43d4d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
inc ebx
loop 0x43d4c0
cmp ebx, esp
add byte [ebp + ebx + 0x53], 0xc1
mov byte [ebp + 0x67], 0x1f
sub dword [esi], esp
sar byte [eax], 0xe
jbe 0x43d4e6
out 0xec, al
cmpxchg dword [eax + edi*2 - 0x2f], ebp
push ss
sub dh, byte [esi]
add eax, 0x7dac1c03
add eax, 0x7dac1c03
shl dword [esi], 1
mov bl, 0xfb
mov dword [0xc7955ca2], eax
inc ecx
out dx, eax
movsd dword es:[edi], dword [esi]
inc edx
dec ebx
movsb byte es:[edi], byte gs:[esi]
movsb byte es:[edi], byte [esi]
jb 0x43d49f
invd
in al, 0x10
stosb byte es:[edi], al
rcl dword [ebx + eax*4 + 0x2cc996e2]
sbb al, 0xc2
jbe 0x43d50c
push 0xffffffffffffffbb
js 0x43d54c
xchg esp, eax
sub byte [esi + 0x323aaf4a], ch
imul ebp, dword [edi - 0x68], 0x544abe58
mov esp, 0xebd44eb7
mov bh, 0x4e
aam 0xeb
adc eax, 0xf50c17ab
xor byte [ebp + 0x4d], al
jne 0x43d50b
push eax
push 0x20
invalid
arpl word [edi - 0x1d], bx
and al, 0xff
out dx, eax
cmpsd dword [esi], dword es:[edi]
fucomi st(2)
test eax, 0xf9b4e26
mov ch, 0x84
imul ecx, dword [ebp + 0x6bb05a86], 0xf351bb7c
adc dword [ebx - 0x5e], ebx
ja 0x43d59a
sub dl, byte [esi]
cwde
sub ah, byte [eax - 0x62]
cwde
bound edi, qword [ecx + ebp*2 - 0x31]
clc
ret
invalid
Function at 0x43eefc
Capabilities:
Encode data using xor

Disassembly:
arpl word [edx - 0x7b618f6b], sp
inc eax
and dl, ch
add eax, 0xa6c3ea7
fisubr word [ebp + eax*4 + 0x2f]
add ch, al
salc
push eax
fdivr dword [ecx]
jp 0x43ee6e
jne 0x43ee86
ljmp 0x42a8:0xf794caf4

Function at 0x43fac8
Capabilities:
Encode data using xor

Disassembly:
xlatb
push edx
sbb eax, 0xfaa9085e
arpl word [ebx], bx
xchg edx, eax
xor eax, 0x930b5281
sbb edx, dword [edx + 0xb528135]
xchg ebx, eax
push edi
dec ebp
xor edx, dword [edi - 0x4fbc52f4]
mov cl, 0x61
xor dh, bh
ror byte [eax - 0x5c], 1
ror byte [edx - 0x38], 0x9a
jecxz 0x43fad0
out dx, eax
pop eax
push edx
wait
pushfd
aaa
sti
invalid

Function at 0x442804
Capabilities:
Encode data using xor

Disassembly:
and byte [eax + 0x16], 0xa0
movsb byte es:[edi], byte [esi]
fsub qword [ebx + 0x72e9b3aa]
sub cl, byte [edi - 0x6994f591]
sub ch, byte [eax + 0x440a92fe]
xchg ecx, eax
cld
and ch, byte [ecx]
adc eax, 0xf16b8c92
xchg edx, eax
mov word [ebx - 0xf], gs
ret
imul ebx, ecx, 0xfffffffe
mov al, 0x1b
aaa
mov esp, 0xd31d2bec
mov word [ebp + esi*8 - 0x2ba03927], gs
dec dword [ecx + 0x2ade1111]
std
jg 0x4427f6
adc eax, 0xafa6b8b6
cmc
lahf
inc ebp
push ebx
pop ebx
add eax, 0x5d539fe0
mov byte [edi], bl
mov dh, 0xea
aas
xlatb
push edx
or byte [edi + 0x76], ah
jns 0x442875
adc byte [ebp - 0x35], 0x59
jl 0x4427d9
movsd dword es:[edi], dword [esi]
pop edi
sal byte [eax - 0x5e], 1
jp 0x44288b
insb byte es:[edi], dx
sal dh, 0xf7
jge 0x4428ae
xchg edi, eax
sub al, 0xe8
push esi
mov word [ecx], cs
adc al, 0xf9
enter 0x2e21, 0x69
fcom dword [edx]
pop esi
mov ebp, 0x632ded5e
add ch, byte [esi + 0x4e]
arpl word [edx], ax
outsb dx, byte [esi]
dec esi
jo 0x4427fe
mov al, 0xa4
xchg edi, eax
mov ebp, 0xf5a737e6
ficomp dword [esi - 0x3c5c4c48]
mov bl, 0x3e
and dl, bl
sahf
mov eax, 0xb3c3a3b3
and dl, bl
rcl dword [ebp + 0x3fbeaca5], cl
xchg ebx, eax
fadd dword [ecx + ecx*2 + 0x7ec5e842]
fistp qword [ebp + 0x15]
loope 0x44286d
xchg ebp, eax
movsd dword es:[edi], dword [esi]
lodsb al, byte [esi]
mov esi, 0x84d8933f
dec ecx
inc edx
call 0x7e23a74a
adc eax, 0xa7d1e5e1
jle 0x4428a2
shl dword [edi - 0x2e23e982], 1
mov byte [ebp + edx*2 - 0x7b], bl
adc eax, 0x508b78c8
test ebx, eax
pop eax
push esp
dec esi
adc al, 0xca
jo 0x4428d8
push ss
invalid
loope 0x4428a4
fldenv [ebx + 0x64964652]
or ebx, dword [edx + 0x4f]
push edx
inc esi
xchg esi, eax
or ebx, dword fs:[edx + 0x4f]
sub esi, dword [esi + 0x5db3b09e]
mov al, 0xb3
pop ebp
mov bl, 0x5d
or dword [ecx], edx
jge 0x4428dd
xor ecx, dword [ecx - 0x69]
mov ch, 0x80
xor dh, byte [edi + esi*2 - 0x64]
sub edi, dword [edx]
popal
mov al, byte [ebx + 0x74]
jbe 0x4428af
adc bh, bl
in eax, 2
inc eax
loop 0x44285e
fisubr dword [edi - 0x40]
imul ebx, dword [edi + 0x40bf193f], 0xffffffd5
add al, 0x31
xchg edx, eax
in eax, 0xf9
dec edi
xor dword [edx - 0x67b0061b], edx
cwde
ljmp 0x6e13:0x4176a51a
Function at 0x445944
Capabilities:
Encode data using xor

Disassembly:
inc edx
rcl eax, 1
jg 0x445966
sal byte [esp + ebx*8], cl
push ds
or byte [edi - 0x32a77338], al
mov dh, 0x4d
sbb bh, 0x23
rcl byte [eax + 0x58]
test dword [esi - 0x41be37b8], esi
inc ebp
mov dword fs:[0xc2333932], eax
and esi, dword [ebp - 0x78]
jne 0x4458ce
out dx, al
pop es
mov eax, 0xe894efec
scasb al, byte es:[edi]
bound ecx, qword [eax*4 + 0x6ec65a0c]
fnstsw word [eax + ecx]
and eax, 0xccef411a
stosd dword es:[edi], eax
arpl word [0x387823a0], sp
sub edi, dword [edi]
out dx, eax
xchg esp, eax
call 0x8550bbff
or al, 0x5a
invalid
add eax, 0x521a9513
xor dword [edi + 0x28f54654], ebx
inc eax
and ebp, dword [ebp - 0x62402743]
jge 0x44594a
std
salc
jge 0x445924
cmpsd dword [esi], dword es:[edi]
cmp ebp, dword [edx - 1]
bound edi, qword [esi - 0x1be85ad5]
and byte [eax], ch
scasd eax, dword es:[edi]
cld
push cs
jmp 0x4459a5
iretd

Function at 0x445cc0
Capabilities:
Encode data using xor

Disassembly:
test ebx, ecx
dec edx
fmul dword [esi]
sub al, 0x8c
sub edi, edx
mov dl, 0x2e
mov edx, 0x2177c00e
pop edx
mov eax, 0x541ede93
jns 0x445cf8
dec ecx
inc ebx
imul esi, ebx, 0xd
out 0x90, al
xchg edx, eax
mov al, 0x43
test eax, 0x59cb3844
jg 0x445d5b
lcall 0x3a38, 0xf57220fc
adc byte [ecx + 0x24722186], 0x46
xchg ecx, eax
xchg byte [ecx], ah
jb 0x445d1c
inc esi
fiadd dword [ebx*4 + 0x79c95e6d]
mov esi, 0xf1f14ae5
xor eax, 0xfe1d954d
mov ebp, eax
cwde
mov ebx, 0x79095d96
leave
nop
sbb bl, ah
mov eax, 0x7aca5556
push es
inc ebp
rol byte [eax + 0x43838ae], cl
call 0xa40cd239
push 0x68a53518
cmc
xchg edi, eax
sbb eax, dword [esi]
cmp dword [edx + 2], ecx
fnstsw word [edi + 0x43]
xchg byte [eax - 0x7b], cl
push esi
fcomp qword [ebx + 0x24]
dec ebp
xchg edx, eax
outsd dx, dword [esi]
jle 0x445cf3
mov cl, 0x32
cmc
outsb dx, byte [esi]
pop edx
add cl, bh
mov edi, 0xe0f2486f
mov dl, 0x4a
outsd dx, dword [esi]
add dh, ah
int1
enter 0x34ef, 0x11
push edi
push dword [edi]
mov eax, 0xaed63baa
xor bl, 0xbb
dec esi
and esp, 0x7b233ef2
pop ebx
push edi
invalid