joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101dccf
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [ebp + 8], 2
push ebx
push esi
push edi
jne 0x101dd09
xor ebx, ebx
cmp dword [ebp + 0xc], 1
jne 0x101dcf3
mov esi, dword [ecx + 0x78]
mov edi, dword [ecx + 0x7c]
mov dword [ecx + 0x78], ebx
mov dword [ecx + 0x7c], ebx
jmp 0x101dd29
lea eax, [ecx + 0x80]
mov esi, dword [eax]
and dword [eax], ebx
lea edx, [ecx + 0x84]
mov edi, dword [edx]
and dword [edx], ebx
jmp 0x101dd29
xor eax, eax
cmp byte [ebp + 8], al
jne 0x101dd3a
lea eax, [ecx + 0x88]
mov esi, dword [eax]
and dword [eax], 0
lea edx, [ecx + 0x8c]
mov edi, dword [edx]
and dword [edx], 0
lea ebx, [ebp + 0x10]
push ebx
push edi
push dword [ebp + 0xc]
push 0xff
push dword [ecx + 0x68]
call esi
jmp 0x101dd55
push eax
push 0x10061f8
push eax
push eax
push eax
push 0x1006108
push dword [0x102e5ac]
push 4
call fcn.0102c428
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x101df2f
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], 1
mov esi, ecx
jne 0x101df7c
lea ecx, [esi + 0x94]
mov ebx, dword [ecx]
push ebx
lea eax, [esi + 0x90]
mov edx, dword [eax]
push edi
push edi
mov dword [eax], edi
mov dword [ecx], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
call edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push 4
lea edx, [ebp + 0x10]
push edx
push dword [ebp + 0xc]
mov dword [ebp + 0x10], edi
call dword [eax + 0x1c]
jmp 0x101dfea
cmp dword [ebp + 0x10], edi
jne 0x101dfcf
cmp dword [esi + 0xa4], edi
lea eax, [esi + 0x98]
mov ebx, dword [eax]
mov dword [eax], edi
sete al
movzx eax, al
push eax
push 0x1006940
push edi
push edi
push edi
lea ecx, [esi + 0x9c]
mov edx, dword [ecx]
push 0x1006860
mov dword [ecx], edi
push dword [0x102e5ac]
mov dword [ebp + 8], edx
push 4
call fcn.0102c428
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [esi + 0xa4], eax
call ebx
jmp 0x101dfea
push edi
push 0x1006838
push edi
push edi
push edi
push 0x1006758
push dword [0x102e5ac]
push 4
call fcn.0102c428
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x101e29b
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ebx, edi
setne al
movzx eax, al
push eax
push 0x10047b4
push edi
push edi
push edi
push 0x1006c28
push dword [0x102e5ac]
mov esi, ecx
push 4
call fcn.0102c428
cmp dword [ebp + 0xc], edi
setne al
movzx eax, al
push eax
push 0x1006c0c
push edi
push edi
push edi
push 0x1006b48
push dword [0x102e5ac]
push 4
call fcn.0102c428
mov ecx, dword [esi + 0x18]
xor eax, eax
test ecx, ecx
jbe 0x101e30e
mov ecx, dword [esi + 0x10]
cmp ebx, dword [ecx + edi + 8]
je 0x101e31a
mov ecx, dword [esi + 0x18]
inc eax
add edi, 0x20
cmp eax, ecx
jb 0x101e2fa
mov eax, 0x80004005
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
jmp 0x101e313
Function at 0x101e328
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, dword [edi + 0x44]
setb al
movzx eax, al
push eax
push 0x1006dc4
xor eax, eax
push eax
push eax
push eax
push 0x1006cf0
push dword [0x102e5ac]
push 4
call fcn.0102c428
mov eax, dword [edi + 0x10]
shl esi, 5
mov eax, dword [esi + eax + 4]
pop edi
pop esi
pop ebp
ret 4

Function at 0x101e36f
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
sete al
movzx eax, al
push eax
push 0x1006ec8
push 0
push 0
push 0
push 0x1006df0
push dword [0x102e5ac]
push 4
call fcn.0102c428
mov eax, dword [ebp + 8]
and dword [esi + 8], 0
mov dword [esi + 4], eax
mov dword [esi], 1
pop esi
pop ebp
ret 4

Function at 0x101e3e6
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, ecx
cmp edi, eax
setne cl
movzx ecx, cl
push ecx
push 0x1005300
push eax
push eax
push eax
push 0x1006ee0
push dword [0x102e5ac]
push 4
call fcn.0102c428
mov dword [esi + 0xa4], edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x101e8e2
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x101e9c0
push esi
push edi
push dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
call fcn.0101e328
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add eax, 0xe4
mov ecx, dword [eax]
xor edx, edx
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
cmp ecx, edx
jne 0x101e97b
cmp dword [edi + 0xe8], edx
jne 0x101e97b
cmp dword [edi + 0xd8], edx
jne 0x101e947
cmp dword [edi + 0xdc], edx
jne 0x101e947
mov al, 1
jmp 0x101e949
xor al, al
push eax
push 0x10074b8
push edx
push edx
push edx
push 0x10073c8
push dword [0x102e5ac]
push 4
call fcn.0102c428
add edi, 0xe4
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
add edi, 0xd8
jmp 0x101e9ad
mov esi, dword [ebp - 0x10]
lea ecx, [edi + 0xd8]
mov edx, dword [ecx]
cmp esi, edx
ja 0x101e9ab
mov edx, dword [ebp - 0xc]
jne 0x101e997
cmp edx, dword [edi + 0xdc]
ja 0x101e9ab
mov ecx, dword [eax]
cmp esi, ecx
jb 0x101e9a7
jne 0x101e9b3
cmp edx, dword [edi + 0xe8]
jae 0x101e9b3
mov edi, eax
jmp 0x101e9ad
mov edi, ecx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebx + 0x14]
test ebx, ebx
jne 0x101e8fb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1022060
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov al, byte [esi + 0x1c]
test al, al
jne 0x1022075
mov byte [esi + 0x1c], 8
jmp 0x102209b
cmp al, 9
sete al
movzx eax, al
push eax
push 0x100280c
push 0
push 0
push 0
push 0x100ae28
push dword [0x102e5ac]
push 4
call fcn.0102c428
mov eax, dword [ebp + 8]
test eax, eax
je 0x10220a7
mov eax, dword [eax]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10220b3
mov eax, dword [eax]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10220bf
mov eax, dword [eax]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10220cb
mov eax, dword [eax]
mov dword [esi + 0x34], eax
pop esi
pop ebp
ret 0x10

Function at 0x102226c
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 0x70], 0
mov dword [esi], 0x100a108
mov dword [esi + 0xf8], 0x100a018
je 0x10222a5
lea ecx, [esi + 0x6c]
mov eax, dword [ecx + 0xc]
dec eax
push eax
call fcn.0101903f
cmp byte [eax + 0x1c], 1
jne 0x10222a5
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10222a5
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
lea eax, [esi + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, esi
pop esi
jmp fcn.0101e495
Function at 0x1025975
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x8c]
mov eax, dword [edi]
mov dword [esi], 0x100def8
mov dword [esi + 0x34], 0x100dbec
test eax, eax
je 0x102599b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
lea edi, [esi + 0x90]
mov eax, dword [edi]
test eax, eax
je 0x10259b0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
pop edi
mov ecx, esi
pop esi
jmp fcn.01025169

Function at 0x10259e4
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.01018e4e
mov edi, eax
mov eax, dword [ebp + 8]
mov al, byte [eax]
xor ebx, ebx
cmp al, 7
je 0x1025a08
cmp al, 6
je 0x1025a08
xor al, al
jmp 0x1025a0b
xor eax, eax
inc eax
push eax
push 0x100e1f0
push ebx
push ebx
push ebx
push 0x100e110
push dword [0x102e5ac]
push 4
call fcn.0102c428
push dword [esi + 0x3c]
mov ecx, edi
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call fcn.01019fb9
cmp dword [esi + 0xa4], ebx
setne al
movzx eax, al
push eax
push 0x100e0e4
push ebx
push ebx
push ebx
push 0x100e008
push dword [0x102e5ac]
push 4
call fcn.0102c428
mov eax, dword [esi + 0xa4]
push edi
mov ecx, 0x102e080
mov dword [edi + 0xa4], eax
mov dword [edi + 0x13c], 1
call fcn.010262d6
push dword [esi + 0x90]
mov ecx, dword [esi + 0x38]
push edi
push dword [esi + 0xa8]
call fcn.0101cea2
mov eax, dword [edi]
push edi
call dword [eax + 0x2c]
cmp eax, ebx
setge al
movzx eax, al
push eax
push 0x100dfe4
push ebx
push ebx
push ebx
push 0x100df08
push dword [0x102e5ac]
push 4
call fcn.0102c428
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1025c47
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push esi
xor eax, eax
mov esi, ecx
cmp dword [esi + 0xa0], eax
setne cl
movzx ecx, cl
push ecx
push 0x100e318
push eax
push eax
push eax
push 0x100e240
push dword [0x102e5ac]
push 4
call fcn.0102c428
mov ecx, esi
call fcn.01025c0b
mov ecx, esi
call fcn.010256ad
test eax, eax
je 0x1025cc9
mov eax, dword [0x102e010]
cmp eax, 0x102e010
je 0x1025cc1
test dword [eax + 0x9c], 0x4000
je 0x1025cc1
cmp byte [eax + 0x99], 4
jb 0x1025cc1
push esi
push 0x100dee8
push 0xb
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.010164b8
mov ecx, esi
pop esi
jmp fcn.010257c5
mov ecx, esi
pop esi
jmp fcn.01025b6f
Function at 0x409d10
Capabilities:
Encode data using xor

Disassembly:
dec ecx
aaa
push ss
leave
or ebx, dword [ecx + 0x610dc93f]
pop edi
dec ebx
call 0x743bce7d
lcall 0x1d89, 0xfcfd47d0
sbb byte [ecx + eax*4 - 0x73], 7
pop edi
shl dword [esi - 0x3f97ea6a], 0x71
sbb edx, eax
imul edx, dword [edx - 0x3a], 0x98409b3a
pushal
xchg esp, eax
cmp bl, byte [ebx - 0x6b9f67c0]
cmp al, 0xc0
mov eax, 0x3bd595e0
cwde
xor eax, 0xda7e1b87
nop
fldenv [esi - 0x7e667de8]
cwde
salc
pop esp
mov edx, 0x4516fde3
insb byte es:[edi], dx
jo 0x409d3b
rcr byte [eax], 0x98
hlt

Function at 0x40e6af
Capabilities:
Encode data using xor

Disassembly:
add al, 0xf
adc ch, byte [esi]
pushal
adc al, 0xc6
mov eax, 0x557d789b
mov ecx, 0x2342e81c
push 0x9796
insb byte es:[edi], dx
xchg ecx, eax
sal dword [0x89ad9f3b], 1
invalid

Function at 0x41479f
Capabilities:
Encode data using xor

Disassembly:
xor al, byte [esi]
inc ebp
cli
int3
popal
cmp al, 0xbd
fbld tbyte [esi]
je 0x4147f8
and dword [eax + 0x1c668898], 0x58
xchg ebx, eax
lds ebp, [edi - 0x63]
cmp esp, dword [ebx - 0x2ca779a]
pushfd
push ecx
popfd
jle 0x414811
cmp al, 0xee
sub eax, 0xe8ad0390
aaa
sub al, 0x46
bound eax, qword [edi + 0x43453d12]
cmp byte [esi - 0x5f351db4], dh
xchg ecx, eax
popal
cmp byte [edi - 0x4876a2b7], dl
shr byte [eax + 0x62230282], cl
cmp dword [esp + ecx*2], 0xfffffff0
mov al, 0
ficomp dword [ebp + ebp*4 - 0x225a3984]
pop ebp
dec ecx
mov esi, 0x2742fa8e
aaa
mov esi, 0xb6677e0c
push edx
mov dh, 0x52
dec edx
cmp al, 0x87
mov esi, 0x2bc19412
cli
dec eax
shr byte [esi + eax*2 + 0x79], 1
inc eax
jo 0x414793
clc
leave
fcomp dword [edi + 0x2c]
mov eax, dword [0x1e276ccc]
bound ecx, qword [ebx - 0x20]
rcr dword [edx], cl
cmp eax, 0x7edb5c9f
mov ecx, dword [edx]
salc
aas
cpuid
pop ebp
jecxz 0x414859
int3
or bh, byte [esp + edx*2 + 0x2b23e5eb]
xchg ebp, eax
xor eax, 0x2f734ff
lodsd eax, dword [esi]
test byte [ebx - 0x53], bh
rol byte [edi + 0x25c77aa4], cl
adc byte [edi - 0x1fe7fef1], bh
outsd dx, dword [esi]
mov al, 4
xor dword [edx + 0x8117ac], esp
js 0x4148db
clc
bound ebp, qword [ebp + 0x43]
int3
inc esp
mov bh, byte [ecx - 0x2e]
mov cl, 0x17
cli
nop
mov ah, 0x26
mov ecx, 0xb8c92ee7
xchg edx, eax
cmp ebx, dword [edi - 0x59]
imul ecx, esp, 0x7a
dec ecx
movsd dword es:[edi], dword [esi]
mov al, 0x52
mov ebp, 0xf43ab2d4
xor dword [ebx + 0xd80b4f0], esi
imul eax
aas
pushfd
jnp 0x4148fa
pop esi
test cl, ah
invalid
Function at 0x418010
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
mov dl, byte [0x4c3044]
and al, dl
mov edx, dword [0x4c3038]
or al, 0x5e
sub esp, 0xc
mov byte [0x4c3044], al
mov eax, dword [0x4c303c]
mov ecx, eax
push esi
shl ecx, 4
and edx, ecx
xor ecx, ecx
mov cl, byte [0x4c3045]
mov dword [0x4c3038], edx
mov edx, dword [0x4c3034]
xor esi, esi
and edx, 8
imul edx, ecx
or eax, edx
lea edx, [esp + 4]
push edx
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
mov dword [0x4c303c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and byte [eax], dl
dec esp
invalid
test eax, eax
je 0x418085
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov al, byte [0x4c3049]
mov cl, byte [0x4c3048]
xor cl, al
mov eax, dword [esp + 0x14]
mov byte [0x4c3048], cl
mov cl, byte [0x4c3043]
or cl, 8
lea edx, [esp + 0xc]
shr cl, 3
and ecx, 0xff
push edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 8]
fild dword [esp + 0xc]
push eax
push 0
push 0
push str.ThreadingModel
fdivr qword [0x4c6990]
push ecx
mov dword [esp + 0x24], 0x104
fadd qword [0x4c3050]
fstp qword [0x4c6980]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4180f3
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret 4

Function at 0x418074
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
mov dl, byte [0x4c3044]
and al, dl
mov edx, dword [0x4c3038]
or al, 0x5e
sub esp, 0xc
mov byte [0x4c3044], al
mov eax, dword [0x4c303c]
mov ecx, eax
push esi
shl ecx, 4
and edx, ecx
xor ecx, ecx
mov cl, byte [0x4c3045]
mov dword [0x4c3038], edx
mov edx, dword [0x4c3034]
xor esi, esi
and edx, 8
imul edx, ecx
or eax, edx
lea edx, [esp + 4]
push edx
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
mov dword [0x4c303c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and byte [eax], dl
dec esp
invalid
test eax, eax
je 0x418085
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov al, byte [0x4c3049]
mov cl, byte [0x4c3048]
xor cl, al
mov eax, dword [esp + 0x14]
mov byte [0x4c3048], cl
mov cl, byte [0x4c3043]
or cl, 8
lea edx, [esp + 0xc]
shr cl, 3
and ecx, 0xff
push edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 8]
fild dword [esp + 0xc]
push eax
push 0
push 0
push str.ThreadingModel
fdivr qword [0x4c6990]
push ecx
mov dword [esp + 0x24], 0x104
fadd qword [0x4c3050]
fstp qword [0x4c6980]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4180f3
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret 4
Function at 0x418406
Capabilities:
Encode data using xor

Disassembly:
ljmp 0xfaa:0x529ab3ca
push esp
jae 0x418378
fstp dword [ebx - 0x3a]
or byte [edi + 0xaeffd87], ch
cmpsb byte [esi], byte es:[edi]
js 0x4183a9
and edx, ecx
push cs
adc al, 0x8c
xor eax, 0x8aaf087
or eax, 0x1245c4d5
and al, 0x48
cmp esp, ebp
invalid
jge 0x4183c9
push cs
pop ebx
xor ecx, esi
das
call 0xae15f23
frstor dword [ecx - 0x3e8889f]
xor eax, 0x24cf9172
adc byte [edx + 0x47], cl
salc
hlt
pushal
adc dword [ebp - 0x5bd8b7b9], edx
inc ebp
in al, dx
loop 0x418387
les edx, [edi - 0x2a]
jbe 0x41839a
clc
into
out dx, al
jmp 0x418419
daa
loopne 0x41844f
push ss
fcmovnu st(0), st(4)
mov byte [0xcf458117], al
jmp 0x418398
je 0x4183dc
dec ebx
pop edi
sar dword [esi], cl
test al, 0x49
dec ecx
fild qword [edx + 0x4e84ba3c]
outsd dx, dword [esi]
cli
adc ax, 0xcfa2
rol byte [edx + 0x78], 0x3a
add bl, byte [edx + eax*4 - 0x18]
inc ebp
mov bh, 0xf5
sub al, 0x38
salc
stc
or ch, byte [edx]
push ecx
push ebx
not dword [edx - 8]
sub eax, 0x6ef77168
shr byte [ebp + 0x23c215be], 0xed
and ebp, ebp
in eax, dx
salc
adc al, 0xf3
ficom word [ebp - 0x78eb0253]
sub al, 0x96
or byte [edx - 0x39], dl
pushfd
salc
stosb byte es:[di], al
inc edx
sar dword [ebx - 0x4eac893], 0xda
call 0x5f5c555
sub eax, edx
xor al, 0xd
jge 0x418420
fldenv [edi - 0x4b93b788]
test dword [ebx], ebx
in eax, 0x2e
sbb eax, 0x797baa98
mulps xmm0, xmm1
pop esp
or ecx, dword [edx - 0x24763f77]
mov ebx, ebx
mov ebx, ebx
mov ecx, ecx
mov esi, esi
mov ebx, ebx
mov ebx, ebx
mov ebx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x425a92
Capabilities:
Encode data using xor

Disassembly:
and esi, edi
sti
sub ah, dh
xchg ebx, eax
dec ebx
mov ch, 0xf8
pushfd
jno 0x425a1d
je 0x425acf
sub dl, byte [eax + 0x23]
jns 0x425b12
scasb al, byte es:[edi]
mov cl, 0xf2
jp 0x425acc
dec eax
test al, 0x7d
or eax, 0x5ac5b610
mov dh, 0xc5
pop edx

Function at 0x42f926
Capabilities:
Encode data using xor

Disassembly:
and ebx, 0xfe569bb2
mov al, 0x71
xor byte [ebp + ebp*2 - 0x58340994], ch
insb byte es:[edi], dx
test bl, 0xa7
insb byte es:[edi], dx
test bl, 0xa7
pop edi
pop ebp
pop edx
fld dword [ebx]
mov ebp, dword [ebp - 0x4feb8e69]
outsb dx, byte [esi]
or eax, 0x24664330
push ss
jge 0x42f91b
add cl, byte [edx - 0x6a401cb9]
shl dword [ebx - 0x69a0f653], cl
and ebx, 0x20b95b0a
aas
cld
and dword [ebx + 0x24], ebp
nop
imul edi, dword [eax - 0x417bbb54], 9
fild qword [ebx - 0x225e8098]
rol byte [ecx], cl
cmpsd dword [esi], dword es:[edi]
mov ebp, 0x8caf6b97
pop es
mov dword [edx + 0x71bce3ac], ebp
aad 0x26
insd dword es:[edi], dx
inc ecx
inc ebx
xor dword [ebx], edx
push ecx
iretd
Function at 0x4561ef
Capabilities:
Encode data using xor

Disassembly:
inc edx
js 0x456178
pop esp
cwde
mov al, byte [0x29787d4a]
insb byte es:[edi], dx
push ss
fcom dword [eax + 0x7b8e4e06]
test al, 0xa0
lea ebp, [edi]
xchg esp, eax
mov byte [0x2f7e1f54], al
das
les edi, [eax]
inc ebx
mov edi, 0x9c0371d
cdq
dec ebx
push cs
cmc
or edx, edx
adc edi, dword [ebp - 0x13]
jge 0x456167
fild qword [eax - 0x34]
mov edi, 0x2bae3955
cmp al, byte [edi + 0x468e1873]
push ds
jnp 0x45614b
shl dh, 0x7f
out 0x7f, al
mov eax, dword [0xe3b4998d]
cmp al, 0x7b
out 0x98, eax
or eax, dword [ecx]
adc esi, dword [edi - 0x4140f8ec]
call 0x1137eb51
push esi
sub edx, dword [ecx - 0x76e2ea9d]
out dx, eax
ljmp 0x3c4f
insd dword es:[edi], dx
jecxz 0x456189
adc dword [ebx], eax
dec eax
add al, 0x39
das
adc eax, 0x5a4fe17e
xor eax, dword [edx]
invalid
dec ecx
add dword [ecx + 0x7dac5951], edx
dec edi
push ecx
pop ecx
lodsb al, byte [esi]
jge 0x45623b
dec edi
jle 0x45618a
rcl byte ss:[edi], 0x2e
pop ebx
insb byte es:[edi], dx
or byte [edi], dl
jbe 0x4561ff
jle 0x4561e7
outsd dx, dword [esi]
clc
mov ecx, 0x79367874
dec edi
js 0x456237
jns 0x456252
mov edx, dword [ebx + 0x71]
fld qword [esi - 0x3b]
xor edi, esi
pop ecx
ror ebx, cl
sub eax, 0x3d6c9f38
jno 0x4561e4
inc esi
lds esi, [ebx]
invalid
or al, 0xe9
xchg byte [edi], dh
pushfd
push ebp
je 0x4561be
inc esi
jno 0x456213
push esi
add dl, byte [di]
jmp 0x456245
add al, 0x71
bound ecx, qword [ebx + 0x58a48efd]
mov al, 0x55
sbb ebp, esp
std
mov fs, word [eax + ebx*2 - 0x13e4aa50]
retf 0x4859
dec eax
int3
sbb esi, dword [ebp - 0x6adde9f1]
adc dword [edi], esi
leave
sub dh, byte [ecx - 0x5794d77b]
test dword [eax], ebp
mov dword [ecx - 0x39db5d4b], 0x525943a2
scasd eax, dword es:[edi]
nop
mov bl, 0xd
mov dword cs:[0x65b4480c], eax
loopne 0x456205
retf 0x2530

Function at 0x482591
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x34541531
pop ebx
push ds
inc eax
popfd
jp 0x4825c9
sub esi, eax
inc esi
rcr byte [edi + 0x3918cb8f], 1
test al, 0x89
mov al, byte [0xe5c09f87]
xor bl, ah
outsb dx, byte [esi]
sbb byte [ebp - 0x643a8ec8], cl
fsub dword [edx + 0x72bf8d29]
xchg esi, eax
invalid
lcall 0xdc4b, 0xf450af4e
out dx, eax
sbb dword [esi], ebp
push eax
inc eax
cdq
bound esi, qword [eax]
inc esp
pop ebp
jbe 0x4825e7
scasd eax, dword es:[edi]
push eax
hlt
rol dword [edi + edi*2], 1
add byte [ecx - 0x13628672], al
sar dword [ebp + 0x72e1e066], cl
daa
loopne 0x4825cb
jb 0x482613
mul byte [ecx]
rcl dword [edi + edi*8 + 0x6e7cd920], cl
or byte [edi + 0x536e569c], 0x93
and edx, dword [ecx]
cmp al, dl
fsub dword fs:[edx*4 - 0x3cdedfe7]
out 0xdb, eax
and eax, 0x21be1154
imul esi, dword [edx - 0x4b720c88], 0x595dd5c
sahf
lea esi, [esp + ebx*2 - 0x61fa6a23]
push 0x2f
xchg dword [ebx], ecx
jo 0x4825fe
fisub word [ecx + 0x24]
int3
popal
and al, 0xcc
add eax, 0x8d0100c2
inc esi
add al, 0x43
mov bl, 0xbd
enter 0x4da7, 0x42
cmp dword [eax], ebp
xor esp, ecx
push edx
fdivr qword [eax + 0x742c5f47]
and al, 0x5c
add dword [0x14014021], edi
movsb byte es:[edi], byte [esi]
js 0x48261f
invalid
Function at 0x482e37
Capabilities:
Encode data using xor

Disassembly:
sar dword [eax], cl
fdiv dword [ebx + 0x47]
nop
out 0x49, al
pop esi
add al, 0x93
shl byte [eax + 0x65], cl
mov ebp, 0x2052dfb
mov cl, 0x61
out dx, eax
call 0x920f49b0
adc eax, 0x322a9efa
push edx
test esp, eax
xchg edx, eax
dec edx
xchg edx, eax
fild qword [esi + 0x7f]
xor eax, dword es:[ecx + ebx*8 + 0x6ff71789]
xor dl, byte [edx - 0x7b]
les eax, [edi - 0x206db53e]
outsb dx, byte [esi]
jg 0x482e88
xor eax, dword [ecx + ebx*8 + 0x6ff71789]
push ebp
pop esi
in al, 0xb3
xor edx, eax
xor al, 0x18
sahf
mov edx, 0x9aa690a9
lodsd eax, dword [esi]
mov cl, 0xc9
out dx, al
xchg byte [ebp - 0x2aee256], ch
std
in al, 0x49
pop ds
mov byte [esi + esi*2 + 0x13ea4860], cl
and al, 0x32
dec ebx
or bl, byte [edi + 0x59]
jle 0x482e56
dec eax
ljmp 0xaf2
idiv dword [ecx + eax*4 - 0x28700cc8]
sub ch, dl
xchg esi, eax
sbb byte [eax + 0x77], 0xe2
cmc
out dx, eax
xor al, 0x5b
sbb byte [ebx + 0x7ebf0d79], 0x74
scasb al, byte es:[edi]
inc ebp
fild word [ecx - 0x26]
out 0x9e, al
lcall 0x6dc5, 0x14dc0c49
mov ebx, 0xec871d7b
push ebx
outsd dx, dword [esi]
lds ebp, [edx + 0x2771396b]
xchg byte [ebx + ebp*8], dh
add dword [ecx], esp
xchg ecx, eax
mov al, byte [0x2237dd38]
and ecx, dword [ebp + 0x55]
dec esi
or eax, esp
and al, 0xb3
push eax
inc ecx
aam 0x7f
loope 0x482e80
and byte [edi + 0x16], dh
cli
fidiv dword [ebx - 0x28899e7f]
frstor dword [edx + 0x2947a6da]
mov byte [0x2947a6da], al
mov eax, 0x2a27dc71
dec edx
lahf
jnp 0x482efe
in eax, dx
idiv dword [edx]
and ah, byte [ebx]
mov ch, 0x76
pop ebx
shl dword [eax - 0x1b87f11e], 1
cmp ah, byte [edx]
and esi, dword [ebp - 0x5f2ea48a]
loop 0x482f16
js 0x482eee
invalid
sub eax, 0xc400a4
insd dword es:[edi], dx
fsub qword [edi + 0x4accd3df]
mov al, 0x23
add ebx, esi
or al, 0x1c
insb byte es:[edi], dx
and dword [esi - 0x5b7878c7], 0x1e
pop eax
inc edi
movups xmm3, xmm0
pop edi
cmp esi, dword [esi + eax*8]
scasd eax, dword es:[edi]
sbb ebx, 0xfffffff1
out dx, eax
jmp 0x14c34fff

Function at 0x48be3f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x48bf14
int3
cmp eax, 0x361a27dd
xchg byte [ebp - 0x58], dl
loopne 0x48be83
popal
jge 0x48becc
out dx, eax
neg dword [ecx + 0x1e]
sal byte [esi + ebp - 0x34], cl
movsd dword es:[edi], dword [esi]
mov ecx, 0xfcf78da9
cld
or byte [edx], dh
jne 0x48bed5
jge 0x48befb
dec edx
test al, 0x4d
mov bl, 0x6a
lodsb al, byte [esi]
fild dword [0x1f0ce504]
fistp dword [edi - 0x36]
xchg byte [ecx], al
stosd dword es:[edi], eax
retf 0x3fed
invalid
leave
inc eax
jne 0x48beb3
outsb dx, byte [esi]
add byte [0x5c24], dh
xchg ecx, eax
invalid

Function at 0x49c6de
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xa8
mov cl, 0xd8
cmp eax, edi
call dword [edi + 0x66]
cmp eax, 0x833fd26d
inc ebx
aad 0x90
pop edi
invalid

Function at 0x4bc211
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3390
cmp edx, dword [eax]
je 0x4bc233
add eax, 8
inc ecx
cmp eax, 0x4c3420
jl 0x4bc224
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3390]
jne 0x4bc361
add byte [eax], al