joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100dca3d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x101380d8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100dca7d
cmp byte [ebx], 0xa
jne 0x100dca7d
or byte [edi + eax + 0x28], 4
jmp 0x100dca82
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x100dcb81
mov dl, byte [eax]
cmp dl, 0x1a
je 0x100dcb64
inc eax
cmp dl, 0xd
je 0x100dcaae
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x100dcad4
cmp eax, ecx
jae 0x100dcae2
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x100dca96
jmp 0x100dcb81
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100dcb5f
cmp dword [ebp - 0x10], 0
je 0x100dcb5f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x101380d8]
test byte [eax + edi + 0x28], 0x48
je 0x100dcb39
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100dcb24
mov byte [esi], dl
jmp 0x100dcb35
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x101380d8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100dcb81
cmp byte [ebp - 1], 0xa
jne 0x100dcb48
cmp esi, ebx
jne 0x100dcb48
mov byte [esi], 0xa
jmp 0x100dcb80
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100cc30d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100dcb81
mov byte [esi], 0xd
jmp 0x100dcb80
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x101380d8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100dcb7e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100dcb81
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100dcb8a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x101380d8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100dcbd0
cmp word [ebx], dx
jne 0x100dcbd0
or byte [eax + edi + 0x28], 4
jmp 0x100dcbd5
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x100dcd38
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x100dcd18
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x100dcc16
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x100dcc4c
cmp eax, edx
jae 0x100dcc5a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100dcbf1
jmp 0x100dcd38
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100dcd13
cmp dword [ebp - 0x18], 0
je 0x100dcd13
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x101380d8]
test byte [eax + edi + 0x28], 0x48
je 0x100dcce9
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100dccad
mov word [esi], cx
jmp 0x100dcce4
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x101380d8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x101380d8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x101380d8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x100dcd38
pop eax
cmp word [ebp - 4], ax
jne 0x100dccf9
cmp esi, ebx
jne 0x100dccf9
mov word [esi], ax
jmp 0x100dcd35
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100cc30d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x100dcd38
push 0xd
pop eax
jmp 0x100dccf4
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x101380d8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x100dcd32
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x100dcd38
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100dee3b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100deed8
push ebx
push esi
call fcn.100dee04
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100db805
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100dee85
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100deed7
push edi
push eax
call fcn.100d706b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100deea5
call fcn.100d6f95
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100deed6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100db805
add esp, 0x20
test eax, eax
jne 0x100deec4
push edi
call fcn.100d6f95
jmp 0x100deecc
push ebx
call fcn.100d6f95
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100deedb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100deeec
pop esi
ret
push ebx
push edi
push esi
call fcn.100dee04
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100d706b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100def14
push ebx
push esi
push edi
call fcn.100bc2e0
add esp, 0xc
push 0
call fcn.100d6f95
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100df2e4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100def29

Function at 0x100e1adc
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100d5588
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100e1b4b
cmp esi, dword [ebp - 4]
je 0x100e1b46
cmp dword [ebp + 0xc], 0
je 0x100e1b46
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100e1b23
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100e162e
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100e1b4d
xor eax, eax
inc eax
jmp 0x100e1b4d
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100e1bb2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10130fc4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100d5588
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100d5588
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100e1c29
cmp word [ecx], dx
je 0x100e1c29
mov eax, dword [0x10111784]
push edi
dec eax
push eax
push 0x10111670
call fcn.100e1b51
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100e1c9c
cmp word [eax], dx
je 0x100e1c9c
mov eax, dword [edi]
test eax, eax
je 0x100e1c4d
cmp word [eax], dx
je 0x100e1c4d
lea eax, [ebp - 0x10]
push eax
call fcn.100e1534
jmp 0x100e1c56
lea eax, [ebp - 0x10]
push eax
call fcn.100e15cf
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100e1cc6
mov eax, dword [0x1011166c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10111360
call fcn.100e1b51
add esp, 0xc
test al, al
je 0x100e1cc6
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100e1c91
cmp word [eax], di
je 0x100e1c91
lea eax, [ebp - 0x10]
push eax
call fcn.100e1534
pop ecx
jmp 0x100e1cc8
lea eax, [ebp - 0x10]
push eax
call fcn.100e15cf
jmp 0x100e1c8e
mov eax, dword [edi]
test eax, eax
je 0x100e1cb3
cmp word [eax], dx
je 0x100e1cb3
lea eax, [ebp - 0x10]
push eax
call fcn.100e14e9
pop ecx
jmp 0x100e1cc6
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100e1d91
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100e19d6
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100e1d91
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100e1d91
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100e1d91
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100e1d1e
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100d88c1
test ebx, ebx
je 0x100e1d8c
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100d88c1
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100e1d91
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100e1d91
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100e46fe
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100e1d93
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a242e
leave
ret
Function at 0x100e6f80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.100e70b0
add esp, 8
test al, al
je 0x100e6fa5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x100e6fa5
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x100e70b0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x100e7430
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100e745b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100e745b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4177d5
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x4177e0
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x41789b
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x461720]
inc edx
sub edi, 8
dec esi
jne 0x417800
pop ebx
test edi, edi
je 0x4178b4
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x461720]
inc edx
dec edi
jne 0x41789f
pop edi
not eax
pop esi
ret

Function at 0x42c651
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x42c676
cmp eax, edi
jge 0x42c66e
mov eax, esi
call fcn.0042c005
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x42c698
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x42c67d
cmp ecx, 4
jge 0x42c6b7
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x42c6a5
xor eax, eax
jmp 0x42c6ad
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x42c69b
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x42c6e9
mov eax, 0x463c10
call fcn.00429c22
jmp 0x42c724
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x42c6f9
mov eax, 0x463bfc
jmp 0x42c6e2
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x42c70e
mov ecx, edi
call fcn.0042c030
test eax, eax
je 0x42c724
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00449e70
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x44695b
Capabilities:
Encode data using xor

Disassembly:
sbb byte [edi + edi + 0x2c], ah
sub eax, 0x71d7b4d4
call 0x1bffc27
les edi, [edi + 0x3ee871]
mov esi, 0xc4017b92
mov edi, 0x3ee871
mov bl, 0xfd
mov ah, 0xed
sbb byte [edi + edi*4 + 0x2e], ah
call 0x71c4ad8a
call 0xfdf73dbf
xor al, 0xfd
sbb byte [edi + edi*4 - 0x71], ah
call 0x309aad9a
and byte [esi - 0x4b909405], bh
and eax, 0xdebf7cd9
dec ecx
mov edx, 0x2030cd44
mov esi, 0x346f6bce
and cl, bl
jl 0x446965
mov edi, 0x44ba49f7
test dword [esi - 0x43979b41], 0x3504ef34
test dword [ecx - 0x46], 0x3504f744
mov edi, 0x34bc6864
out dx, eax
add al, 0x35
mov edi, 0x44ebe610
out dx, eax
add al, 0x35
mov edi, 0xb4bc683e
clc
add al, 0x35
mov edi, 0x44ebe602
or esp, dword [edx]
aas
cmpsd dword [esi], dword es:[edi]
add dword [edi + 0x33e61736], esp
aas
loop 0x4469a5
les ebp, [ecx + 0x49b33f36]
xchg dword [ebp + 0x3f33e678], esi
mov cl, 0xe2
int3
Function at 0x446e28
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x70bf3622
inc ebp
add esp, 0xffffffcd
in eax, 0x33
aas
salc
mov esp, 0x2254b6bc
mov edi, 0xc4834732
mov ebp, 0xbbbf3504
adc ecx, dword [esi + 0x35052936]
aas
mov cl, 0x91
movsb byte es:[edi], byte [esi]
inc esp
test dword [esi - 0x78b79441], 0x3504f037
aas
daa
xchg ebx, eax
movsb byte es:[edi], byte [esi]
inc esp
and eax, 0x9dbf7cd9
test dword [ebx + 0x34], eax
dec ebx
xor byte [eax], ah
pop ecx
shr byte [eax*2 - 0x408326e3], cl
mov word [ebp + 0x3118b443], es
fnstcw word [edi + edi*4 - 0x74]
test dword [ebx - 0x4c], eax
sbb byte [ecx], dh
and byte [esi], bh
inc ecx
shr byte [eax*2 + 0x3f641906], cl
aas
mov bh, byte [eax - 0x26]
xor eax, 0xbee8715e
mov dh, 0x7b
jnp 0x446e1a
invalid
mov esi, 0xc4017bb6
and byte [ecx], bl
aas
inc esp
ja 0x446dfb
mov ch, 0xf8
jo 0x446e0d
mov esi, 0xc4017ca1
pop eax
jno 0x446e15
std
stc
std
xor eax, dword [edi]
sbb dword [edi + edi*4 - 0x5c], esp
call 0x7187b24a
call 0xfe3e347f
mov bl, 0xd
sbb dword [edi + edi*4 - 0x52], esp
call 0x30bfb25a
and byte [esi - 0x4ac9aa58], bh
and ebx, ecx
jl 0x446e15
fimul word [ecx - 0x46]
inc esp
adc eax, 0x33be2031
push ebp
xor eax, 0xbf7cd91d
adc dword [edx - 0x46], ecx
inc esp
popfd
add al, 0x35
mov edi, 0xb6915601
dec ecx
add eax, 0xe5acbf35
jmp 0x446ebe
ficom dword [ecx + 0x32683640]
and byte [esi], bh
adc al, byte [edi - 0x56]
les esp, [ebx - 0x20]
xchg edi, eax
xor al, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax - 0x65cfff41], al
inc esp
cmpsb byte [esi], byte es:[edi]
ficom word [edi + 0xb2]
add byte [eax], al
add byte [eax - 0x65cfff41], al
inc esp
add byte [eax], al
cmp byte [edi], 0xcb
aaa
add byte ss:[eax], al
add byte [eax], al
add ah, al
pop edi
popfd
les eax, [eax]
add byte [eax + 0x6924413f], al
mov dh, 0
add byte [eax], al
add byte [eax - 0x63], cl
les ebx, [edi + 0xb29854]
add byte [eax], al
add byte [eax], al
add byte [eax - 0x2abffdc1], al
inc ebx
adc byte [esi - 0x68], 0x32
add byte [eax], al
add byte [eax], al
add byte [eax], al
cmp byte [edi], 0xff
aas
aad 0x43
add byte [eax], al
cmp byte [edi - 0x49e232aa], 0
add byte [eax], al
add dh, ah
outsd dx, dword [esi]
inc ebp
add byte [eax], al
cmp byte [edi + 0x37023762], 0
add byte [eax], al
add byte [ebp + 0x70], dl
inc ebp
mov edi, 0x37023762
add byte [eax], al
add byte [eax], al
push ebp
jo 0x446f7f
inc ebp
push cs
sbb dword [edi + edi - 0x2e], esp
mov cl, 0x83
xor eax, 0x3ee8713e
cdq
jno 0x446f3d
cdq
sub eax, 0x1913c45c
aas
fnstenv [ecx + 0x712cb583]
call 0x5c725ea7
les esi, [eax + 0x71]
out dx, eax
sub eax, 0x7170c45c
call 0x2bc286af
xor eax, 0x3f641901
fistp word [esi]
adc bl, al
xchg ebx, eax
jno 0x446f65
aas
jle 0x446fac
mov ch, 0xf8
sbb byte [edi + edi + 0xc], ah
and byte [eax], dl
ret
xor eax, 0x852d7fbf
mov ch, 0xbc
add al, 0x35
aas
inc edi
mov esp, dword [ebp + 0x35054b44]
mov edi, 0x35852d95
pushfd
add al, 0x35
aas
jge 0x446f53
movsd dword es:[edi], dword [esi]
inc esp
daa
fnstcw word [edi + edi*4 - 0x23]
adc byte [edi + 0x203029b5], ah
pop esi
ljmp 0xbf7c
Function at 0x446f8a
Capabilities:
Encode data using xor

Disassembly:
xlatb
das
and byte [esi + 0x334f7362], bh
sub bl, cl
jl 0x446fd5
stosb byte es:[edi], al
mov byte [esi], ch
inc esp
scasb al, byte es:[edi]
das
and byte [esi - 0x4cb08ca9], bh
sub ebx, ecx
jl 0x446fe5
cdq
mov byte [esi], ch
inc esp
sub al, byte [0x2d7fbf35]
test dword [ebp + 0x3f3504bc], esi
mov gs, edx
mov edx, 0x202f9044
invalid
Function at 0x4479da
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0xc51c693f
into
fisub dword [esi + 0x1bf140be]
mov ah, 0x48
inc ebx
pushfd
mov bl, 0x17
xchg esp, eax
jg 0x447975
push ecx
outsb dx, byte [esi]
les ebp, [ebx - 0x2f]
mov edi, 0xb4
add byte [eax], al
add byte [eax - 0x1a6ff941], al
les esi, [edi - 0x2f]
mov edi, 0x34
xor al, 0
add byte [eax], al
add byte [eax], al
add byte [eax - 0x1a700441], al
les ebx, [edx]
sbb bl, byte [esi + 0x3c]
mov edi, 0x340b06de
and bl, byte [ebp + ebp - 0x41]
je 0x447a04
mov edi, 0x340b06de
and bl, byte [ebp + ebp - 0x41]
je 0x447a04
lds edx, [ebx]
pop esi
cmp al, 0xbf
call 0x2af884f9
pop esp
sub eax, 0x1b7465bf
lds edx, [eax + 0x51bf7426]
cdq
xchg ebx, eax
xor edx, dword [edi + 0x71be99f7]
add al, 1
lds ecx, [eax - 0x76408bda]
cdq
xchg ebx, eax
mov bl, 0xc7
neg dword [ecx + 0x10479be]
lds edx, [ebx + 0x28]
jge 0x4479dd
cdq
mov esi, 0xc5010471
mov byte [esi], ah
je 0x4479cd
mov dword [ecx - 0x8384c6d], ebx
cdq
mov esi, 0xc5010479
push ebx
sub byte [ebp - 0x41], bh
sub esi, edi
invalid

Function at 0x449d12
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
cmp byte [edi + 0x4501199f], 0x8a
in eax, dx
in al, 0xb5
add byte [eax], al
add byte [eax], al
add byte [eax], al
cmp byte [edi + 0x45011976], 0
add byte [eax], al
add byte [eax], al
add byte [eax + 0x82971bf], al
mov ch, 0xa9
fidivr word [edx + eax*2]
add byte [eax], al
cmp byte [edi + 0x35082983], 0x97
fnstsw word [edx + eax*2 + 0x3f800000]
add byte [edx + 0xb53e], dl
add byte [eax], al
shr bl, 0x37
inc ebp
add byte [eax], al
cmp byte [edi], 0x30
nop
xor eax, 0
shr bl, 0x37
inc ebp
or edx, ebp
jb 0x449da2
add byte [eax], al
cmp byte [edi], 0x39
sahf
push ecx
xor al, 0xa5
fsub dword [ecx]
inc edx
jmp 0x791068
add byte [eax], al
add byte [eax], al
insb byte es:[edi], dx
jge 0x449dd8
lds ecx, [ebp + 0xb5ce0c]
add byte [eax], al
add byte [eax], al
add byte [eax + 0x384f6ebf], al
lds edx, [ecx + 0x35ce0c]
add byte [eax], al
add byte [eax], al
add byte [eax + 0x384f6bbf], al
lds eax, [eax]
add byte [eax], al
add byte [eax], al
add byte [eax - 0x4fc86241], al
and al, 0x6b
mov al, 0x36
and al, 0x6b
adc eax, 0x44
add byte [eax], al
add byte [eax - 0x4fc86041], al
mov dh, 0x28
imul edx, dword [0x80000044], 0xe8a3e23f
mov bl, 0
add byte [eax], al
add byte [edx + 0x43b34b], dl
add byte [eax - 0x175f0dc1], al
xor eax, dword [eax]
add byte [eax], al
add byte [esi + 0x43b34b], cl
add byte [eax], al
add byte [eax], al
add byte [eax - 0x7e93c7c1], al
mov dh, 0x5d
scasd eax, dword es:[edi]
call int.00449ee0
add byte [eax], al
add byte [eax - 0x7e93c9c1], al
jb 0x449dd4
call 0x80449ef0
mov edi, 0x33da42ba
add byte [eax], al
add byte [eax], al
arpl word [edx + 0x62], cx
ret