joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443c80
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x230
push ebx
push edi
mov ecx, 0x4b
xor eax, eax
lea edi, [esp + 0xc]
push 0xff
rep stosd dword es:[edi], eax
lea eax, [esp + 0x13c]
xor ebx, ebx
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea ecx, [esp + 0x138]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
mov dword [esp + 8], eax
je 0x443d1f
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_strncpy]
push esi
lea esi, [esp + 0x14]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + ebx*4]
test eax, eax
je 0x443d05
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, eax
test edx, edx
je 0x443d05
mov ecx, 7
xor eax, eax
mov edi, esi
push 0x1d
rep stosd dword es:[edi], eax
push edx
push esi
stosw word es:[edi], ax
call ebp
mov eax, dword [esp + 0x1c]
add esp, 0xc
inc ebx
add esi, 0x1e
jmp 0x443ccc
pop esi
pop ebp
test ebx, ebx
jle 0x443d1f
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
pop edi
pop ebx
add esp, 0x230
ret
pop edi
xor eax, eax
pop ebx
add esp, 0x230
ret

Function at 0x44804f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
or eax, 0xffffffff
mov esi, edx
dec edx
test esi, esi
je 0x448082
push edi
inc edx
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x49ba68]
xor eax, esi
inc ecx
dec edx
jne 0x448064
pop edi
not eax
pop esi
ret

Function at 0x44ab30
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov di, word [esp + 0x2c]
mov esi, ecx
mov word [esi + 8], di
call fcn.0044ac10
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x44abf1
lea ecx, [esp + 0x2c]
push 4
push ecx
push 4
mov ebx, 1
push 0xffff
push eax
mov dword [esp + 0x40], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [esi + 4]
lea edx, [esp + 0x10]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [esp + 0x28]
mov ebx, dword [sym.imp.WS2_32.dll_bind]
mov ebp, dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x16], di
mov dword [esp + 0x18], ecx
mov word [esp + 0x14], 2
xor edi, edi
mov eax, dword [esi + 4]
lea edx, [esp + 0x14]
push 0x10
push edx
push eax
call ebx
cmp eax, 0xffffffff
jne 0x44abe5
mov ecx, dword [esp + 0x16]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
inc eax
push eax
call ebp
inc edi
mov word [esp + 0x16], ax
cmp edi, 0x64
jb 0x44abb7
jmp 0x44abea
cmp edi, 0x64
jb 0x44abf1
mov ecx, esi
call fcn.0044ac10
mov ecx, dword [esi + 4]
xor eax, eax
pop edi
cmp ecx, 0xffffffff
pop esi
pop ebp
setne al
pop ebx
add esp, 0x14
ret 8
Function at 0x44ac30
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x44ac74
mov ecx, dword [esp + 0x14]
mov dx, word [esp + 0x18]
mov dword [esp + 4], ecx
lea ecx, [esp]
mov word [esp + 2], dx
mov edx, dword [esp + 0x20]
push 0x10
push ecx
mov ecx, dword [esp + 0x24]
push 0
push edx
push ecx
push eax
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_sendto]
add esp, 0x10
ret 0x10
xor eax, eax
add esp, 0x10
ret 0x10

Function at 0x4634f6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
or eax, 0xffffffff
mov esi, edx
dec edx
test esi, esi
je 0x463529
push edi
inc edx
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x49c74c]
xor eax, esi
inc ecx
dec edx
jne 0x46350b
pop edi
not eax
pop esi
ret

Function at 0x4635db
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x4970f3
call fcn.004903c0
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov ax, word [ebp + 8]
mov esi, dword [ebp + 0xc]
lea edi, [ebx + 2]
mov word [ebx], ax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [ebx + 0xc]
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00413e15
mov dword [esi], 0x49a6b4
lea esi, [ebx + 0x1c]
lea eax, [ebp + 0x20]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00413eae
mov dword [esi], 0x49a6b8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and byte [ebx + 0x38], 0
and byte [ebp - 4], 0
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 0x30]
lea ecx, [ebp + 0x14]
mov dword [ebx + 0x34], eax
mov dword [ebp + 0x10], 0x49a6d8
mov dword [ebp + 0x14], 0x49a6d4
call fcn.00413e48
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
mov dword [ebp + 0x20], 0x49a694
mov dword [ebp + 0x24], 0x49a690
call fcn.00413ef7
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x30

Function at 0x463d35
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x4971b3
call fcn.004903c0
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov cx, word [eax]
push edi
lea esi, [eax + 2]
lea edi, [ebx + 2]
mov word [ebx], cx
add eax, 0xc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [ebx + 0xc]
push eax
mov ecx, esi
mov dword [ebp - 0x10], ebx
call fcn.00413e15
mov dword [esi], 0x49a6b4
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea edi, [ebx + 0x1c]
lea eax, [esi + 0x1c]
mov ecx, edi
push eax
call fcn.00413eae
mov dword [edi], 0x49a6b8
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
pop edi
mov dword [ebx + 0x34], eax
mov al, byte [esi + 0x38]
mov byte [ebx + 0x38], al
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x46b721
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10c4
call fcn.004905b0
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx], 0
je 0x46b7aa
lea eax, [ebp - 4]
mov dword [ebp - 0x10c4], 0x19c
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c4]
push eax
mov dword [ebp - 0xc], 0x1018
call dword [0x4b0310]
test eax, eax
jne 0x46b7aa
xor esi, esi
cmp dword [ebp - 4], esi
jbe 0x46b802
jle 0x46b7aa
lea edi, [ebp - 0x10c0]
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], 0xa0
push eax
push dword [edi]
call dword [0x4b0308]
test eax, eax
jne 0x46b7aa
cmp dword [ebp - 0xa8], 0x2000
je 0x46b7b1
inc esi
add edi, 0x19c
cmp esi, dword [ebp - 4]
jl 0x46b775
xor al, al
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0xa0]
push eax
call fcn.004903aa
cmp eax, 0x20
pop ecx
jb 0x46b7ca
and byte [ebp - 0x81], 0
lea eax, [ebp - 0xa0]
push str.isdn
push eax
call fcn.0049039e
pop ecx
test eax, eax
pop ecx
jne 0x46b7e5
mov byte [ebx + 8], 1
lea eax, [ebp - 0xa0]
push str.moden
push eax
call fcn.0049039e
pop ecx
test eax, eax
pop ecx
jne 0x46b828
mov byte [ebx + 8], 2
jmp 0x46b828
lea eax, [ebp - 8]
push esi
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x46b7aa
test byte [ebp - 8], 2
je 0x46b81e
mov byte [ebx + 8], 3
test byte [ebp - 8], 1
je 0x46b828
mov byte [ebx + 8], 1
mov al, 1
jmp 0x46b7ac
Function at 0x46e0b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1ac
push ebx
push esi
push edi
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x7f]
mov byte [ebp - 0x80], 0
mov ebx, dword [ebp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], esp
stosb byte es:[edi], al
mov edi, dword [ebp + 0x18]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc0]
push 0x40
push ecx
push ebx
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x46e112
cmp dword [ebp - 0x14], 0x40
je 0x46e129
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x2c]
push 0x4a7ea8
push edx
mov dword [ebp - 0x2c], eax
call fcn.004905e0
cmp word [ebp - 0xc0], 0x5a4d
sete al
test al, al
jne 0x46e150
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push 0x4a7ea8
push eax
call fcn.004905e0
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1b8]
push 0xf8
add eax, ebx
push edx
push eax
push esi
call edi
test eax, eax
je 0x46e179
cmp dword [ebp - 0x14], 0xf8
je 0x46e190
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x30]
push 0x4a7ea8
push ecx
mov dword [ebp - 0x30], eax
call fcn.004905e0
cmp dword [ebp - 0x1b8], 0x4550
jne 0x46e1b2
cmp word [ebp - 0x1b4], 0x14c
jne 0x46e1b2
cmp word [ebp - 0x1a0], 0x10b
je 0x46e1c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x1c]
push 0x4a7ea8
push edx
mov dword [ebp - 0x1c], eax
call fcn.004905e0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x18], 0
lea ebx, [eax + ebx + 0xf8]
mov eax, dword [ebp - 0x1b2]
and eax, 0xffff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x18], eax
jae 0x46e28f
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x58]
push ecx
push 0x28
push edx
push ebx
push esi
call edi
test eax, eax
je 0x46e20c
cmp dword [ebp - 0x14], 0x28
je 0x46e223
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push 0x4a7ea8
push eax
call fcn.004905e0
add ebx, 0x28
mov ecx, 0xa
lea edi, [ebp - 0x80]
lea esi, [ebp - 0x58]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x46e28f
mov eax, dword [ebp - 0x34]
and eax, 0x20000020
cmp eax, 0x20000020
jne 0x46e274
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp + 0xc]
lea eax, [ecx + edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
add eax, edx
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
jmp 0x46e1eb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4756c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
lea eax, [ebp - 4]
push dword [ebp + 8]
mov ebx, ecx
push eax
call fcn.00478a35
mov eax, dword [ebp - 4]
cmp eax, dword [ebx + 4]
je 0x4756fc
cmp byte [eax + 0x1c], 0
jne 0x4756ea
xor al, al
jmp 0x47578c
cmp byte [ebx + 0x20], 0
jne 0x4756fc
push eax
lea eax, [ebp - 8]
push eax
mov ecx, ebx
call fcn.0047874d
cmp byte [ebx + 0x20], 0
push esi
push edi
lea esi, [ebp + 0x10]
jne 0x47574a
lea edi, [ebp - 0x20]
mov al, byte [ebp + 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and byte [ebp - 0x14], 0
mov byte [ebp - 0x13], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push 6
lea esi, [ebp - 0x20]
mov eax, dword [eax]
pop ecx
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
lea edi, [ebp - 0x38]
push eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x14]
mov ecx, ebx
push eax
call fcn.004786af
jmp 0x475788
lea edi, [ebp - 0x20]
mov al, byte [ebp + 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and byte [ebp - 0x14], 0
mov byte [ebp - 0x13], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push 6
lea esi, [ebp - 0x20]
mov eax, dword [eax]
pop ecx
lea edi, [ebp - 0x38]
mov dword [ebp - 0x3c], eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3c]
lea ecx, [ebx + 0x10]
push eax
call fcn.00483c59
pop edi
mov al, 1
pop esi
pop ebx
leave
ret 0x18
Function at 0x4809b7
Capabilities:
Encode data using xor

Disassembly:
mov bh, byte [ecx]
mov ah, 0xa2
pop esp
xor dh, byte [esi + eax*4 + 0x3c91e6a1]
sbb dword [ecx + 0x5c3aeb16], 0xffffffbc
outsb dx, byte [esi]
sub bh, byte [esi]
std
sub bh, cl
test ch, ah
lahf
mov cl, 0x2e
or edi, dword [ebx]
mov ebp, 0xfd0cf813
push 0xffffffffffffffd4
insb byte es:[edi], dx
pushal
inc edx
iretd
or al, 0x6b
stosd dword es:[edi], eax
jecxz 0x480a15
das
sti
nop
aad 0xe1
je 0x480950
and al, 0xe8
xchg ebp, eax
cmp dword [ebp - 0x65], ebx
and ebp, edi
adc ebp, ecx
sbb ebx, dword [0x3707f3dc]
and bh, bh
call 0x2e977321
pop esp
mov byte [edi + ebp*2 - 0x25cdf6dd], dh
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
lea ebp, [edi + eax]
sub eax, 0xb5990499
lds eax, [edx + 0xa]
mov cl, 0x64
inc esi
out 0x56, al
or ebp, dword [edi - 0x60a8a002]
push edi
lahf
push ds
jbe 0x480aa3
pushfd
in eax, dx
pop edx
pop ebp
push eax
sbb bl, byte [ecx - 0x26]
fucom st(6)
dec edi
fcomp qword [ecx + 0x43]
arpl word [eax + eax*4 - 0x34], si
movsb byte es:[edi], byte [esi]
rcr byte [ecx + ebp*4 - 0x75], 1
loope 0x480aac
and byte [ecx], 0xce
lds eax, [edi + 0x65]
outsd dx, dword [esi]
mov word [ebx + 0x54], fs
enter 0x61a8, 0xffffffffffffffbc
xchg ecx, eax
ficomp dword [ebx]
mov cl, 0xd4
add eax, 0xc8f87136
fsubp st(0)
sbb eax, 0x449f9518
add edi, dword [edx - 0xd]
cdq
mov edx, dword [ecx + ecx*2 + 0x55]
pushfd
ror byte [esi + ecx*2 - 0x6e8cc47c], 0x2a
or byte [edx + 0xd9f9bd0], bl
xchg edi, eax
pop esi
in al, 0x82
pop ebp
xor dword [edx - 4], esp
test eax, 0xe2d2f3de
fdivrp st(3)
shl dl, cl
imul esi, edx, 0x569fb5b3
cdq
test eax, 0xbb29fb2d
pxor mm7, qword [ecx - 0x31]
sti
jge 0x480a84
outsb dx, byte [esi]
in al, dx
idiv dword [ecx + edi*2]
jns 0x480b1c
jns 0x480aa4
inc dword [ebx - 0x202fb502]
cmp esi, 0x4a
rcr bh, 1
push ecx
hlt
xchg edi, eax
invalid
push eax
mov ch, byte [edx + 0x5590519e]
mov dl, byte [eax - 0x41a5cf1b]
aas
fnstcw word [ecx + 0x39672d18]
add byte [ebx - 0x1abfdd92], cl
imul byte [esi - 0x6c]
imul ebp, dword [ecx - 0x2654f373], 0x72
mov dh, byte [edi]
mov ebx, 0xb556cfc3
push ecx
mov dword [ecx + 0x22], edx
adc dword cs:[edi + 0x54], ebp
mov dl, 0x3d
das
retf 0xc44b
aaa
dec edi
sub byte [edx - 0x28], 0x66
ror dword [ebp - 0x78], 1
stosb byte es:[edi], al
mov eax, 0x98aab63d
in al, 0xbc
pop edi
dec ebx
mov ecx, 0x93178a29
fmul qword [ecx]
sub dword [edx + 0x9dc9317], ecx
lds esp, [esp + edx]
sets byte [ebx + edx + 0xd4e24c7]
inc esi
mov dword [ebp + 0xd4e6c4], ebp
xlatb
int1
dec edx
jae 0x480ac3
dec ebp
mov edi, esp
pop ss
or ah, byte [esp + eax*8 + 0x577a1f10]
inc ebp
insb byte es:[edi], dx
push ss
popfd
loope 0x480b07
pop ds
invalid
Function at 0x48319f
Capabilities:
Encode data using xor

Disassembly:
retf
fdiv st(4)
stosd dword es:[edi], eax
inc ecx
popfd
mov esp, 0xc6b09353
cmpsd dword [esi], dword es:[edi]
dec esp
ret 0xf680
sub ebp, dword [edx]
push eax
cwde
add al, 0x8b
lds esp, [edx + 0x36]
bound esi, qword [esi]
bound esi, qword [esi]
xor dword ss:[0x937205c5], esp
xor dword [0x937205c5], esp
mov al, byte [0x4983e533]
enter 0x73b7, 0x56
stc
inc edx
ror dl, 1
jecxz 0x483198
jo 0x483228
jbe 0x483155
mov ecx, 0x93464410
test eax, 0x5e024c18
inc ebp
mov dword [0x838a979d], eax
sub esp, dword [edx]
dec ebx
dec esp
mov edx, 0x312f5f10
sbb ch, dh
test dword [esi], edx
jl 0x4831a0
mov bl, 0xa4
push esi
cwde
jbe 0x48316b
add edx, eax
push cs
sub esi, dword [ecx]
or dword [ecx + 0x6b3375e2], edi
mov cl, 0x9b
sub eax, 0x66a92812
adc esp, dword [esi + ebx*8 - 0x62]
xor byte [ecx], cl
xchg edx, eax
salc
mov dh, 0xd8
sbb al, 0x6c
inc edx
insb byte es:[edi], dx
dec edi
push 0xffffffffffffffc8
or dword [edi + 0x12177058], ebx
xor byte [edi], ah
mov dword [ecx - 0x3a9a1ea9], esi
and esi, edi
int1
mov dword [ebp + 0xe15b27c], esp
dec ecx
sub al, 0xeb
pop ss
adc al, 0x4e
cld
jecxz 0x4831b1
dec ecx
shl byte [0xd884e6c9], 1
insb byte es:[edi], dx
dec ebx
adc al, 0x8b
mov ch, ah
push edx
lea esp, fs:[esi + 0x6d5b6240]
mov ebx, 0x73361a38
Function at 0x483c59
Capabilities:
Encode data using xor

Disassembly:
xlatb
stc
int 0x28
cmp eax, dword [ebp - 0x25a43c41]
pop ebx
adc eax, 0xf82c4bf
pop ebx
or byte [edi], 0x5b
push ecx
in eax, dx
ror byte [ebx + 0x7b2b0556], cl
das
fcomp qword [esi - 0x6a0a43fd]
jae 0x483c5b
cmpsb byte [esi], byte es:[edi]
or ebx, esi
push edi
stosd dword es:[edi], eax
jle 0x483c7a
lodsd eax, dword [esi]
cli
push edi
std
adc dword [edx], eax
mov dl, 2
invalid
and byte [ecx + 0x31], 0xdb
add dh, byte [edx + 0x31618202]
invalid
add al, byte [edx - 0x5e24ce9f]
push ebp
add edi, ebp
mov ah, 0xf6
lodsb al, byte [esi]
cmp al, 0x6e
sbb dword [ebx - 0x69d5480c], edi
or byte [eax + 0x47], ch
jecxz 0x483c57
popal
xor ebx, ebx
mov eax, dword [0xb4ef0155]
imul byte [esp + edi + 0x23bc196e]
hlt
push 0x60e4e347
pushal
popfd
sal eax, 3
salc
cmp bh, ah
cld
sbb ch, 0x9c
and dword [eax], 0x1739b0e5
and ecx, esi
add al, byte [esi]
out dx, eax
xor al, 0x4c
loop 0x483cdf
sbb al, 0x69
mov bh, 0x66
aas
sbb ah, byte [esi]
jno 0x483d0d
xchg byte [eax], cl
jae 0x483c28
popfd
test byte [ebp + ecx + 0x130e0239], ch
mov edx, 0x42d67142
jecxz 0x483c36
or eax, 0x7382579c
aaa
movsb byte es:[edi], byte [esi]
fiadd word [esi + ecx - 0x2e]
or dl, al
cmpsd dword [esi], dword es:[edi]
mov ecx, 0x4ac80aad
dec edx
add ebx, ebp
pop ebx
jae 0x483d14
mov bl, byte [esi - 0x20]
push ss
adc dword [ebx], eax
inc esi
pushfd
lds edx, [edx - 0x7437f8e3]
xor dword [edx - 0x73], eax
jae 0x483c6f
enter 0xffffffffffffd3b2, 0xffffffffffffffd8
daa
xor al, al
out dx, eax
mov eax, 0xdce49738
xchg edi, eax
in al, 0xdc
fdiv qword [esi - 0x230dd6c7]
pushfd
cwde
xor ah, byte [ebx - 0x7d]
fcomp qword [esp + eax*8]
mov dh, 0x39
sub edx, esi
fcomp qword [eax + ebx*4 - 0x237c9cce]
sbb al, 0xc4
popal
push ds
out 0xe0, eax
cmp al, 0x8f
or dword [ecx - 0x1b4928c7], edi
pop es
lds edx, [esp + ebp*4 - 0x1b8e4dee]
loopne 0x483ce1
xor eax, 0x737214a
out 0xf0, eax
mov byte [ecx - 0x191824c4], bh
mov ecx, 0xe6e7db3c
enter 0xffffffffffff9473, 0x20
stosd dword es:[edi], eax
or dl, dh
mov word [edx + 0x49e4b726], cs
xchg esp, eax
and byte [ebx - 0x75730df8], ch
mov bh, 0xe4
dec ecx
test dword [ebx], ecx
xchg dword [ecx], edi
mov bh, 0x90
jno 0x483d4b
in al, 0x1c
inc ecx
jle 0x483cbc
nop
daa
cmc
pushfd
sar dword [ecx + 0x52], 0x4f
std
push 0x28e7ac25
retf 0x1ec1
xor ebp, dword [edi + 0x3bdad88a]
nop
sub eax, 0xb5739b5
push 0xffffffffffffff90
outsd dx, dword [esi]
test dword [ecx - 0x53f4e8d], eax
push esi
fcomp dword [0xcb10e07e]
xchg esp, eax
mov bh, 0x2a
cmp byte [edi + 0x11], dh
pop ebx
dec edx
add byte [edi - 0x38], cl
invalid
Function at 0x48768d
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx - 0x40], dl
imul esp, dword [edi + ebp - 0x767b714e], 0x16
push 0x581683ed
push ss
pop eax
push ss
pop eax
xchg edx, eax
inc eax
dec ebx
ror dword ds:[edi + ebx*4 + 4], 1
pop eax
pop es
jae 0x48767f
pop edx
jns 0x487711
ljmp 0x9ef:0x76dd7953
dec edi
pop ss
add byte [esi], dl
xlatb
shl byte [ecx - 0x3e], 0xa4
test byte [ecx - 0x37], cl
sbb ecx, dword [ebx]
and byte [eax], bl
mov esp, eax
sbb byte [ecx], bl
cmp dword [ebp + 0x4e], ecx
fidiv word [edx - 0x1a2eb1f8]
adc esi, dword [edi - 0x6d]
inc byte [ebx]
jg 0x48779c
out dx, al
cmp dword [eax - 0x64], edi
in eax, dx
xchg esp, eax
xor dword [esi], ecx
adc byte [eax + 0x10], 5
test ebx, 0x71d8c09
loope 0x48778a
mov dh, 0x94
adc al, 0x84
rcl dl, 1
pop ecx
adc ecx, dword [esi - 0x40]
xchg ecx, eax
in al, dx
cmp byte [edi - 0x25702c5f], al
lcall 0x3d9, 0x3799ff58
mov esp, 0x4444ecbc
cmp al, 0xf3
popfd
push ebp
stc
push edx
mov esi, 0xd6d83a5b
jp 0x487794
cmpsb byte [esi], byte es:[edi]
jge 0x4877d5
mov edx, 0xa55c7da6
sub al, 0x9a
jbe 0x48776b
div byte [ecx - 0x68]
ljmp 0x37c7
invalid
mov edi, 0xeb1c414b
idiv esi
push ss
push ss
int 0x4f
inc esi
jae 0x487774
cld
insb byte es:[edi], dx
xor al, 0x3f
sbb ebp, ecx
iretd
salc
mov bh, 0x3e
salc
cmpsd dword [esi], dword es:[edi]
xlatb
jg 0x4877e0
je 0x487822
inc ecx
sub dword [ecx + 0x5ced9c78], 0xdb1a6f4d
sbb dword [esi], esi
ror dword [esi + 0x20], 0xc4
mov cl, 0x4d
pushfd
mov ah, byte [eax - 0x6dda1594]
pop ss
into
push ebp
and dh, byte [eax]
ljmp 0x506a
pop edx
push eax
movsb byte es:[edi], byte [esi]
sbb ecx, dword [edi - 0x70]
retf
mov al, 0x54
adc al, 0x27
aas
add ecx, ebp
inc esi
dec edx
and eax, 0x7827e210
xchg ecx, eax
inc ebp
push esp
and ebx, ecx
push edx
jp 0x487816
into
cdq
cmp dword [ebx], eax
xor ecx, esp
pushal
invalid

Function at 0x490398
Capabilities:
Encode data using xor

Disassembly:
fisubr word [esi + 0x10574db6]
mov al, 0x8a
push edi
lds ecx, [esi + 0x34]
xor al, 0x2f
Function at 0x480600
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x45e015
lea edi, [esi - 0x5d015]
push edi
or ebp, 0xffffffff
jmp 0x480622
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x480629
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x480618
mov eax, 1
add ebx, ebx
jne 0x48063b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48064c
jne 0x48065c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48065c
dec eax
add ebx, ebx
jne 0x480658
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x480630
xor ecx, ecx
sub eax, 3
jb 0x480674
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4806e6
sar eax, 1
mov ebp, eax
jmp 0x48067f
add ebx, ebx
jne 0x48067f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x48068c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4806b0
inc ecx
add ebx, ebx
jne 0x48069c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x480691
jne 0x4806ad
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x480691
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4806d0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4806c1
jmp 0x48061e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4806d0
add edi, ecx
jmp 0x48061e
pop esi
mov edi, esi
mov ecx, 0x21b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4806ee
cmp byte [edi], 2
jne 0x4806ee
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4806f3
lea edi, [esi + 0x7e000]
mov eax, dword [edi]
or eax, eax
je 0x48076b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x80be4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x80c20]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x480720
mov ecx, edi
jns 0x48074f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x80c24]
or eax, eax
je 0x480765
mov dword [ebx], eax
add ebx, 4
jmp 0x48073d
call dword [esi + 0x80c28]
popal
jmp 0x401e44