joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cde08
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
xchg edx, eax
mov al, 0x56
movsd dword es:[edi], dword [esi]
dec ecx
jl 0x4cde3c
loope 0x4cde4b
jo 0x4cde61
add byte [eax - 0x1e], cl
jne 0x4cde61
leave
adc al, 0xa2
jecxz 0x4cddf7
sar byte [edi - 0x4d3d2a9d], 1
lodsd eax, dword [esi]
sbb ebx, edx
push ebx
mov ebp, 0xf15766bd
sbb bl, byte [edx]
jnp 0x4cde71
mov edx, 0xff944245
cld
cli
pop esp
and eax, 0x2af7f675
dec esi
pop ecx
jne 0x4cddce
jmp 0x4cde7e
ret
sbb ebp, dword [eax - 0x79]
pop esi
pop ecx
scasb al, byte es:[edi]
jge 0x4cde4e
sub eax, 0x317199b9
add ecx, dword [edi]
jne 0x4cded4
or eax, 0x824c7dbd
jecxz 0x4cdeda
sbb al, byte [edi]
mov ebx, 0x7334e71d
adc byte [edi - 0x100de5f9], 0xb5
mov ch, 0xcf
cmp byte [edi], dl
xchg ebp, eax
mov ebx, 0xf89b47f0
in eax, dx
sbb eax, 0xb5ec852d
push edx
iretd
in al, dx
mov ch, 0x52
add al, 0x72
xchg eax, esi
movsb byte es:[edi], byte [esi]
xor ecx, dword [edx - 0x1da63dde]
loope 0x4cde70
inc esp
xchg ebp, eax
js 0x4cdf03
dec eax
cmp dword [0xa66e58b9], esp
pushal
add esi, ebx
test byte [ebx + 0x692add43], cl
ror esp, 1
push eax
sbb bh, byte [ecx]
and dword [0xca674262], 0xad6916c8
clc
mov cl, 0xbd
out dx, eax
iretd
int3
pop eax
xchg esi, eax
test cl, dl
pushfd
mov cl, dl
iretd
push edi
mov esp, fs
invalid

Function at 0x4ce358
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
movsb byte es:[di], byte [si]
mov ds, word [eax + 0x60e057ec]
adc edi, dword [ebp - 0x63527902]
mov byte [0x3046181e], al
test al, 0xff
or ah, byte [0xe0e9ea51]
jnp 0x4ce303
mov al, byte [0xb51ea902]
pushal
push edx
stosb byte es:[edi], al
inc ebx
invalid

Function at 0x4d0a14
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0xa455cdf3
xor dl, 0x5b
sub eax, 0xd62a25e9
cmp byte [edx + 0x4392f744], 0x95
push ecx
movsd dword es:[di], dword [si]
adc edi, ebx
or al, 0x67
xor al, 0x2f
cmpsd dword [esi], dword es:[edi]
stosb byte es:[edi], al
cmpsd dword [esi], dword es:[edi]
and al, 0xb0
xor ecx, dword [0x45d352e9]
mov ecx, dword [edi + 0x44]
cmp al, 0x4c
mov byte [ebp - 0x34], ah
pop ds
dec ebx
add eax, 0xa4826ab7
xchg ebp, eax
adc cl, byte [edx]
mov ch, 0xa1
lcall 0xc48f, 0x5dd3b29e
stc
or edx, dword [edx]
xor eax, 0xfa0cc69b
jge 0x4d0a0c
scasd eax, dword es:[edi]
test ecx, ebx
xlatb
pushal
xchg ecx, eax
pop ss
adc edi, eax
daa
or al, 0xd7
out 0xed, al
push es
leave
frstor dword [edx - 0x605c77ab]
xor al, 0xc7
xchg ebx, eax
rcl dword [ecx + 0x3d]
mov eax, dword [0xc7020af2]
xor al, 0x77
clc
sbb ah, al
int 0x12
mov dl, 0x29
les edi, [ecx - 0x4486a89f]
stosb byte es:[edi], al
push ebx
xor bh, cl
and esp, dword [ebx - 0x13]
mov esp, 0xbc0da1f4
movsb byte es:[edi], byte [esi]
test bh, ah
pushfd
xor byte [esp + edx*4 - 0x59afe763], ah
push ds
pop eax
fnsave dword [edi - 0x1df89f4]
add ah, byte [ebp - 0x3fe0dd9]
push eax
movsb byte es:[edi], byte [esi]
inc eax
out 0x9f, eax
push ebp
nop
cwde
Function at 0x4d3570
Capabilities:
Execute syscall

Disassembly:
sbb al, 0x45
xor byte [edi], bl
pop ds
push eax
pushfd
daa
leave
test al, 4
add bh, dl
inc eax
or eax, dword [eax]
xchg ebx, eax
scasd eax, dword es:[edi]
cmp dword [ecx - 0x26e836df], edx
das
mov ecx, 0x7dea13fd
wait
sub byte [edi + edi*4], al
add al, 0xbf
and cl, byte [eax + 0x2b]
aam 0xa4
sbb eax, 0xef5fd970
mov al, byte [0x52382a82]
mov esi, 0x84a4dc3b
push ds
mov dl, 0x50
jg 0x4d356e
in al, 0xe8
scasd eax, dword es:[edi]
cwde
xor ebx, dword [edx]
ljmp 0x5351
std
mov dword [0x3e2b182a], eax
in eax, 0x2b
outsb dx, byte [esi]
and eax, 0x541da9f2
cmp esi, dword cs:[esi + 1]
std
sbb dword [edx - 0x5827bfa5], ebp
aam 0xc
jno 0x4d359d
jno 0x4d35d8
fst qword [eax + 0x1b]
int1
dec esi
lds esp, [ecx + 0x1165ec5c]
adc dword gs:[esp + edi*2 - 0x69e02e00], edi
in eax, 0x15
add dword [eax + 0x55d99dc8], esp
cld
xchg edx, eax
jbe 0x4d35fa
lds edx, [ecx]
loope 0x4d3546
fisubr dword [edi - 0x5d]
mov ah, bh
cld
push 0xffffffffffffffe0
salc
xor al, 0xec
cmp al, dh
mov edx, 0x277be713
out 0x7b, eax
daa
add ah, ch
insd dword es:[edi], dx
xchg esp, eax
pop esi
sub byte [ecx], al
dec ebp
mov cl, 0x50
add dword [ebp - 0x4f], ecx
push eax
sub eax, 0xd31ec50c
adc dword [edx - 0x48b79940], 0xffffff8e
jp 0x4d35d2
sub dword [ecx], ebp
add byte [0x2fc1ab93], 0xda
sar dword [ebx + ebx*4 - 0x79192a01], cl
cmp ah, byte [edx]
mov bh, 0x46
mov di, 0x821c
adc byte [ebx + 0x287feec3], 0x76
or byte [edi + 0x43], bh
jbe 0x4d35e2
jg 0x4d361f
int3
adc dword [edx - 0xf], 0x51206d08
sub al, 0x91
ret 0xc7bf
add byte [esi], ah
sti
stosd dword es:[edi], eax
jg 0x4d358a
jae 0x4d3631
syscall
imul esp, dword [ecx], 0xffffffde
and dword cs:[ebp + 0x1eb5dbe9], esp
sbb al, 0x16
cmp eax, 0xa37d2862
ret
rol byte [eax + edx*8], 0x1d
lcall 0xfd9e, 0xd5d8b44b
imul esp, dword [esi + 0x1cb3394e], 0xffffff96
mov ah, byte [edx]
ret

Function at 0x4d5750
Capabilities:
Encode data using xor

Disassembly:
dec edi
mov edx, 0x9888594c
xchg byte [0x3989230e], dh
outsd dx, dword [esi]
xchg dh, bl
daa
inc esp
cmpsd dword [esi], dword es:[edi]
rcr dword [edi], cl
add ecx, dword [edx - 0x251a1fb3]
lahf
xchg ebx, eax
xchg ebx, eax
adc esi, dword [ebp + 0x75]
invalid
Function at 0x4d967c
Capabilities:
Encode data using xor

Disassembly:
inc edx
mov bh, 6
sahf
out dx, eax
add al, 0xc5
mov bh, 0x66
add ch, al
mov edx, 0x671bb105
push esi
or al, 0xe
dec edx
jo 0x4d95f6
movsd dword es:[edi], dword [esi]
and al, 0x4c
aam 0x5f
sbb eax, eax
mov eax, dword [0x1731a9a0]
xor byte [eax + ecx + 0x2d5d7b7d], dl
adc edx, dword [eax]
popal
clc
retf 0x5366
into
jnp 0x4d9589
add edx, dword [edx]
pop ebp
out dx, al
sbb cl, dh
int1
sti
stosd dword es:[edi], eax
wait
cmpsb byte [esi], byte es:[edi]
salc
sbb ecx, dword [esi - 0x4d5de44a]
lea ecx, [edx]
salc
mov dl, 0x8d
or dl, dh
sub ebx, edi
cmove edx, dword [ecx + 0x10bfec91]
and edi, dword [ebp - 0x11]
jge 0x4d95e7
pop eax
iretd
pop eax
inc esi
mov cl, 0x20
jle 0x4d95d4
invalid
pushal
push ss
loop 0x4d9656
pop edx
xchg cl, bl
jecxz 0x4d95dc
adc ebx, dword [0x474ba91d]
dec dl
pop esi
mov eax, dword [0xc58c3380]
push ds
push ss
cmc
ljmp 0x5361
and byte [ebp - 0x4e58a9d7], dh
dec ebp
shr dword [edx + esi*4 - 0x42], 1
mov dl, 0xbe
mov dl, 0xbe
xor al, 0x49
sti
jge 0x4d9673
invalid
leave
movsb byte es:[edi], byte [esi]
push ecx
bound ecx, qword [ebp + 0x62998748]
sub dword [ecx + ebx*4 + 0x26], esi
je 0x4d963c
stosb byte es:[edi], al
push cs
mov eax, dword [0x3130f41b]
std
stosb byte es:[edi], al
mov ch, 0x44
dec ebp
cmp edx, edx
jne 0x4d9644
sub al, 0x1e
mov al, 0x18
fdivr dword [esi + 0x63]
pop ds
adc al, 0xbd
stosd dword es:[edi], eax
inc edx
jl 0x4d9691
jmp 0x4d96bc
adc ebp, dword [eax - 0x36]
scasd eax, dword es:[edi]
ja 0x4d973d
retf 0x77af
sub eax, 0x3379f6e9
mov byte [0xbf3d004c], al
lodsd eax, dword [esi]
push esp
ficom word [ebx + 0x5114ec6f]
xchg edi, eax
dec ecx
cmp ebp, dword [esi]
jnp 0x4d96ef
xchg ebx, eax
std
jne 0x4d9758
mov dl, 0xf7
and esi, esp
push esp
test byte [edx + esi + 0x3f], ch
loope sym.RikEKonc.exe__Dbgridehimpexp_ReadDBGridEhFromImportStream_qqrp17System_TMetaClassp24Dbgrideh_TCustomDBGridEhp15Classes_TStream
loop 0x4d9682
jp 0x4d96be
inc ebp
push ss
out 0xb, al
dec edi
mov ebx, 0x20d72e62
sub dl, byte [ecx + 0x5b]
mov ecx, 0xbc64c9fc
jne 0x4d9701
retf 0xffc7
push edi
mov eax, 0x9c250d66
inc edi
jmp 0xf95d0cc2
jge 0x4d97b2
pop esp
adc ch, byte [ecx + 0x26]
invalid
invalid
sar dword [edx - 0x2e], cl
jge 0x4d96ed
popfd
scasd eax, dword es:[edi]
outsd dx, dword [esi]
test eax, 0xacc6ac08
out 0xbc, al
movsd dword es:[edi], dword [esi]
xor dword [ecx + 0x2b720511], ebx
scasb al, byte es:[edi]
adc al, 0
jl 0x4d9712
sub esp, dword [0x4a2dfb1e]
push esi
jb 0x4d97d4
aaa
jmp 0x4d9743
sub al, 9
retf
ja 0x4d97d5
cmp dword [ebx], ebx
mov edx, 0xce0c32b0
iretd
jg 0x4d97a6
shl dl, 1
pop ebx
loop 0x4d9833
sub byte [ecx + 0x6e], dh
jo 0x4d9844
outsb dx, byte [esi]
dec ecx
push edx
ret 0x4ab9
pop esp
jecxz 0x4d9866
enter 0xffffffffffff800b, 0xffffffffffffffa0
cmp dword [0xe8b50e1], esi
test byte [edi - 0x35136fd4], cl
out dx, al
invalid
in al, dx
retf 0x8dee
xor edx, dword [edx + 0x204ba319]
push edx
mov edx, fs
fadd qword [esi + 0x743aa2eb]
ljmp 0xe259
Function at 0x4ddc6c
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x3df8ee9e
les ebx, [edi + 0x67db3064]
adc eax, 0xaae137a7
aad 0xea
cwde
xor eax, 0x98e175cc
out 0x6f, eax
mov bh, 0x20
cmp dl, 0x9e
daa
in al, dx
enter 0xffffffffffffb085, 0x59
mov dword [0x7c847045], eax
mov byte [edi + 0x5dd13458], ch
rol dword gs:[ebp + 0x1dba4d2a], 1
jbe 0x4ddc7e
invalid

Function at 0x4df248
Capabilities:
Encode data using xor

Disassembly:
sbb edx, dword [esi]
adc al, 0x64
loopne 0x4df215
adc al, 0xf3
das
cmpsb byte [esi], byte es:[edi]
imul dword [eax + eax*4 + 0x5e15fa6b]
adc bh, ah
cmp eax, 0x5a9c94c6
fdivr dword [eax - 0x7b]
dec edx
mov al, byte [0x85e4bfa4]
retf

Function at 0x4df920
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0xd8f2368
add dword [ecx - 0x5d07edda], ecx
cmc
mov dword [eax], ebx
pop esi
aad 0xf8
add ch, byte cs:[eax - 0x50]
jp 0x4df974
mov esi, 0x6547bf84
not dword [edx - 0x78]
inc edi
not dword gs:[edx - 0x78]
cmp byte [edx + 0x5b3914c5], dl
clc
cmp al, 0x53
out 0x5b, eax
adc ebx, dword [ecx + 0x63df10e8]
mov edi, 0x5f96efe
xor esi, dword ds:[edx + 0x23]
adc byte [ecx + 0x43bd6959], dh
loop 0x4df92c
into
cmc
add dword [ebp + 0x32], esp
das
jp 0x4df912
in eax, 0x7e
retf 0xe05e
cmpsd dword [esi], dword es:[edi]
cmp eax, 0x28f68630
mov dword [0x20d84b0b], eax
mov edx, 0x33966728
and dword [edx + 0x3c], 0xffffffdd
or byte [edx - 0x71], ah
xchg dword [edx - 0xc2d66f3], ebx
inc ecx
retf

Function at 0x4dfd78
Capabilities:
Encode data using xor

Disassembly:
push cs
std
in al, 0xd8
sub byte [edi + ebx*2 + 0x40], ah
call 0x689ac9
or byte [esi + 0x7cd6808f], ah
retf 0x35fa
jge 0x4dfcd6
mov al, 0x4e
fdiv st(4)
imul eax, dword [ebp + 0x5c], 0x5a
aaa
iretd
je 0x4dfde5
xor byte [esi + ebx*8 - 0x13], ah
mov ecx, 0xe245ec0f
rol dword [eax - 0x75], 1
test al, 0x46
pop eax
jno 0x4dfd1c
inc esp
adc eax, 0x2d88e3e6
push ds
into
mov dword [ebp - 0x55], ecx
scasd eax, dword es:[edi]
ljmp 0x274c
js 0x4dfdf5
int3
movsb byte es:[edi], byte [esi]
daa
cmp al, 0x9a
or eax, 0x3ff89d18
cmp al, 0x62
invalid
Function at 0x4e0184
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x8a38f084], al
cmp esp, dword [0xfc4583e5]
adc byte [ebp - 0x3007c934], dl
rcl bl, 0xef
inc ebx
mov edi, 0x275bb882
ljmp 0x15d4
sbb byte [ebx - 0x481c9c7c], bl
fldenv [eax + 0x8f76fa7]
inc ebx
inc eax
je 0x4e0128
xchg dword [esi + 0x22c09fb1], edi
ficom word [esi]
fsubr st(7)
fld qword [eax + 0x4b]
jl 0x4e01c1
scasb al, byte es:[edi]
ljmp 0x9fcf
mul dword [ebp + 0x13]
in al, dx
adc eax, 0x120d21e2
jl 0x4e0212
mov edi, 0xa4d36eab
sbb dword [ebx - 0x335e51e], eax
salc
mov dh, 0x45
pushal
jo 0x4e024e
jp 0x4e0241
setl byte [ebx - 0x2c793e6f]
and eax, 0xc70f469f
test byte [edi - 0x2d], bl
adc al, 0xcd
fcmovne st(0), st(2)
or eax, 0xe1333f40
xor esp, ecx
mov eax, 0x3a92cbdc
dec ebp
std
call 0x644d1352
cdq
out 2, al
jne 0x4e01f5
loop 0x4e01cc
adc ecx, dword [ebx + 0x73]
or ebp, ecx
mov ebp, dword [edi + 0x7b]
xor eax, 0xff4337d1
invalid
jnp 0x4e0249
sal dword [edi], 1
inc ebx
dec dword [esp + edi*8 + 0xa62e2c4]
or esi, dword [esi - 0x2380603f]
mov dl, 0x35
movsd dword es:[edi], dword [esi]
invalid
test esp, 0xbfec4977
stc
xchg edi, eax
inc eax
sub edi, esi
scasd eax, dword es:[edi]
xor al, 0xaa
stosb byte es:[edi], al
aam 0xb5
rcl byte [edx + edx*4 + 0x16], cl
lodsd eax, dword [esi]
add esp, dword [ecx + ebp - 0x30153de]
inc ebp
push ss
fst dword [ebx - 0x71]
mov dh, 0x8f
test al, 0x5d
retf

Function at 0x4e0430
Capabilities:
Encode data using xor

Disassembly:
or ebp, esp
jmp 0x4e0405
pop ecx
int1
xor cl, byte [edi - 0x1a5f00d3]
sahf
cdq
cmp ebx, dword [eax + 0x2c7b27b]
out 0x26, al
or dword [eax], 0x53
cli
mov cl, 0x3f
xor bl, byte [edx + 0x74]
adc dh, cl
insd dword es:[edi], dx
mov es, eax
outsb dx, byte [esi]
push 0x66
inc edi
int 0x8c
push ds
jl 0x4e0405
cmp byte [edi - 0x2c], 0xca
test eax, 0x8943ffae
jne 0x4e03f0
insd dword es:[edi], dx
jl 0x4e03d8
mov ch, 0x28
lodsd eax, dword [esi]
fadd qword [eax - 0x68]
sub al, bl
sti
inc bp
imul esp, dword [edx], 0x5b4e20d
pushfd
sbb byte [0xf3d8c082], bl
pop edi
cmp byte [0x5f12a6], ch
sub ch, cl
xor eax, 0x50eca31f
rol byte [edi + 0x672cb65f], cl
jae 0x4e042a
sahf
mov dword [0xca70f939], eax
jo 0x4e03fa
cmp eax, 0x1e0f3810
in eax, dx
mov bl, 0x96
cmpsb byte [esi], byte es:[edi]
imul edi, ebx, 0x2379311c
imul esp, dword [edi - 0x4c6b35f7], 0xfffffffa
sub bl, ah
imul esi, esp, 0xf07b775f
and ebx, edx
adc byte [ebx + 0x60], dh
stosd dword es:[edi], eax
adc ebp, ecx
sbb eax, 0x2a9803be
mov ebx, 0x93c65131
test al, 0x42
ror esi, 1
jmp 0x4e04ba
retf 0xb394
and dword [eax + 0x7ad6e21d], 0xffffffad
dec esi
loop 0x4e0471
xchg edx, eax
cld
cli
test eax, 0x91bfe4cd
popfd
mov esi, 0x665e9867
insd dword es:[edi], dx
and byte [ebp + 0x5a], ah
sub dh, byte [ecx + 0x415c630]
inc esp
aad 0x54
popal
or esi, ebp
cmp byte [ecx - 0x5eac35ca], cl
push ebp
fistp qword [edi*2 + 0x5066a367]
cld
hlt
Function at 0x4e5340
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xe5
sbb edi, dword [eax]
mov bl, byte [ebx + ebx*2 - 0x24]
out 0x5e, al
pop es
add esp, edx
in eax, 0x5b
jle 0x4e53b4
imul ebx, esp, 0x1bf2aff5
xchg dword [0x29e3ff5f], edx
sub eax, 0xa75cabfe
dec ebx
xor al, dh
push ecx
mov word [edx], ds
test eax, 0xc4838c5a
pop eax
sbb dl, bh
adc dword [ebx + 0x4d], ecx
and eax, 0xbccf6865
scasb al, byte es:[edi]
out dx, eax
out dx, al
adc byte [edx], ch
and eax, 0x76124b7
sub byte [ebp - 0x60d2dfb0], dh
xor byte [esi - 0x4f2ff112], bh
mov dword [ecx], edi
xor dword [ecx], edx
sahf
into
ret 0x6a26
sbb eax, 0x3bd41f19
aam 0x3b
shr byte [0x2d8a9635], 7
das
stosd dword es:[edi], eax
lahf
mov ch, 0x65
xchg esi, eax
cwde
xor edx, 0x55
mov bl, 0xc4
mov dword [0xbc23f1fc], eax
movsb byte es:[edi], byte fs:[esi]
sbb dword [ecx + 0x5c90cf2f], 0xe975a2db
fisttp dword [ebx + edx*4]
daa
sub byte [ebp + esi*8 + 0x3d39e1c7], cl
or edi, ebp
push 0x5e
push ds
push es
cmpsb byte cs:[esi], byte es:[edi]
or dword ds:[esi + 0x740e3c29], esp
push eax
inc edx
mov esp, dword [ebp + 0x37]
jbe 0x4e53b7
mov cl, 0xba
not dword [eax + 0x4c]
sbb eax, 0xc61eba1b
cmc
cwde
invalid

Function at 0x4e8184
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x3c
push esi
sbb eax, 0xf4b5bf8e
invalid
mov ch, 0xf4
leave

Function at 0x4e84f8
Capabilities:
Encode data using xor

Disassembly:
mov word [edi + 0x70], fs
mov ebp, 0x3bc149bb
inc edi
out dx, eax
mov cs, word [esi - 0x23]
cmp edx, edx
arpl word [eax - 0x13cd09ff], bx
add esi, esi
xor ch, ah
scasb al, byte es:[edi]
fldenv [eax + 0xdec0c9b]
mov byte [0xdd8678f], al
wait
jp 0x4e8509
invalid

Function at 0x4e9060
Capabilities:
Encode data using xor

Disassembly:
and byte [ebp - 0x78], cl
adc dword [ecx + 0x39bc4493], eax
or byte [ebx + 0x2c], 0xc1
inc eax
add edx, edx
sbb al, 0x56
mov edx, 0x3c94c6a
enter 0x6806, 0x1d
mov bh, 0x93
insb byte es:[edi], dx
loop 0x4e9046
in al, 0xc6
jo 0x4e902c
pop dword [ebp - 0x3223892c]
pop es
mov edx, 0x23330e8a
sti
in eax, dx

Function at 0x4e9408
Capabilities:
Encode data using xor

Disassembly:
fstp dword [eax - 0xfa75ad2]
mov esi, ebx
out 0xa0, al
push ebx
sbb esi, dword cs:[edx - 4]
cmp ebx, ebx
mov cx, word [esi - 0xc]
dec esi
hlt
stosd dword es:[edi], eax
bound edi, qword [eax + esi - 0x5df219e0]
in eax, dx
cmpsb byte [esi], byte es:[edi]
adc al, 0x42
inc edi
fsubr dword [ebx - 0x79]
out dx, al
mov edx, 0x4a6e5015
push eax
outsb dx, byte [esi]
dec edx
xor byte [ebx], 0x76
in al, dx
push ebx
jnp 0x4e93e5
mov ebx, 0xf4f8e081
frstor dword [ebx + 0x8534f3]
jecxz 0x4e9401
bnd jne 0x4e9447
adc byte [ecx - 0x19b0aeb3], 0xc6
dec ebp
push ecx
dec edi
out 0xc6, al
xchg edi, eax
mov ch, 0x3e
jb 0x4e93bc
jb 0x4e93bc
int 0x5a
invalid
retf
sbb ebp, dword [ebp + 0x39f9d83e]
add ebx, dword [esi - 0x6fcef001]
rdtsc
nop
sub eax, 0xe35f5c4e
fidiv word [edi]
les edi, [ecx - 0x63]
inc ecx
outsd dx, dword [esi]
xor byte [edx], bl
out dx, eax
xchg ecx, eax
xchg edi, eax
jb 0x4e943e
jnp 0x4e941d
mov es, word [eax]
hlt
Function at 0x4e98a0
Capabilities:
Encode data using xor

Disassembly:
add bl, bl
inc edx
cmpsb byte [esi], byte es:[edi]
fidivr word [ecx + 0x7c7fbbb7]
mov ebx, 0xd84b7c7f
mov dh, 0x49
and esi, ebx
sub al, 0x62
push cs
dec esi
sub al, 0xbb
or al, 2
jbe 0x4e97dd
js 0x4e98b0
and ebx, dword [edi - 0x350f3fc4]
dec edx
ror bl, 0x26
invalid
push edx
push cs
cli
cmpsb byte [esi], byte es:[edi]
js 0x4e97ef
mov word [ebx + 0x78], gs
add ebp, dword [edi + 0x1da4ff0b]
adc dword [edx], 0xc4b8c516
sub ch, byte [edi + 0x2a]
scasd eax, dword es:[edi]
or edi, edi
movsb byte es:[edi], byte [esi]
sbb eax, 0xc5161281
mov eax, 0x2a6f2ac4
pushal
push cs
xlatb
sar byte [ecx - 0x2b], 1
xor byte [eax - 0x1c17073b], bh
cmc
aaa
or bh, byte [edi]
mov dword [0x5bc66259], eax
add eax, 0x943e7bca
adc byte [eax - 0x641373f5], 0x46
wait
inc esi
mov esp, 0x7ccf4e6f
push ebx
aad 0xc7
inc edx
ja 0x4e9869
dec ebp
adc dword [edx - 0x7397b5e5], ebx
in al, dx
sbb ecx, dword [edx + 0x68]
mov esp, gs
add esp, dword [eax - 0x3f]
loope 0x4e98d0
ret 0x3f10
test byte [0x36351d3a], dh
jle 0x4e9873
ror byte fs:[edx], 1
xchg ebp, eax
xchg ecx, eax
mov dl, 0xc6
jo 0x4e98c4
jl 0x4e9916
imul esi, dword [edx - 0x5d], 0x64
push es
out dx, eax
push ss
movsd dword es:[edi], dword [esi]
retf
push ss
pop es
hlt

Function at 0x4e9c18
Capabilities:
Encode data using xor

Disassembly:
jg 0x4e9be5
add ebx, edx
ret
wait
int3
adc al, 0xca
jnp 0x4e9c7f
sub dh, ch
outsd dx, dword [esi]
and dword [edx + 0x36a73ba1], ecx
inc esi
adc edx, dword [edx - 0x7afdf259]
pushal
xlatb
clc
dec ecx
js 0x4e9bd8
rcl esp, cl
jnp 0x4e9c45
aam 0x7b
xadd bh, ch
shl dword [eax - 0x1f559984], 5
out 0xad, eax
ret
shr bh, 0xc1
mov al, byte [0xe0aa667c]
add eax, 0x35c3ade7
pushfd
push 0xda2152ed
in eax, dx
push edx
and edx, ebx
dec ebp
imul ebx, dword [eax + esi + 0x3dfb35c5], 0xffffffb8
add eax, dword [ebx - 0x29]
mov byte [esi], bl
add edi, dword [esi + ebx*8]
js 0x4e9c33
or ebx, esp
int3
hlt
Function at 0x4f1fd8
Capabilities:
Encode data using xor

Disassembly:
and dword [ecx], ecx
ja 0x4f2050
xor eax, 0xf785d06d
rol byte [edx + 0x71], 0x59
add byte [esi + 0x3103d7e4], 0x15
adc eax, esp
mov bh, 0xff
cmp al, 0x5d
xor dh, 0x32
das
jnp 0x4f1f99
mov al, byte [0xdb8ca702]
add byte [edx], 0xe3
dec eax
xor dword fs:[edx - 0x57], ecx
xchg byte [ebx + edi - 0x53], bh
add byte [eax + 0x49], ch
lea ebx, [ebx + edx*8]
cmpsb byte [esi], byte es:[edi]
cmp byte [ebx + 0x63885724], bl
sahf
or al, 0x12
pop ds
retf
stosd dword es:[edi], eax
mov ah, byte [eax - 0x33bcb6fe]
test dword [esi - 0x739296a6], 0x76856dc5
xor cl, bh
sub ebp, ebp
je 0x4f20cc
jnp 0x4f203a
call 0x190ea18a
into
sub byte [eax + 0x666cf218], 0x35
adc bl, byte [eax]
xor al, 0x81
mov edi, 0xa880ce18
sbb dl, dh
insb byte es:[edi], dx
xor ax, 0x1812
add dword [ebx - 0xa], ecx
jns 0x4f207d
idiv byte [ecx + 0x18]
movsb byte es:[edi], byte [esi]
mov edi, 0x1162ddb
aad 0x34
sti
test dword [edi - 0x25480223], ecx
daa
invalid
int 1
or dword [eax - 0x53], ebx
add edx, ecx
add eax, 0x9a77c384
sbb ah, byte cs:[ebp + ecx*2 + 0x184334b8]
xor esi, dword [ebp + 0x56]
and al, 6
pop es
in eax, 5
scasd eax, dword es:[edi]
bound ebp, qword [eax + ecx*8 + 0x24553004]
js 0x4f2062
cmp bl, byte [eax]
insb byte es:[edi], dx
imul edi, dword [edx], 0x8886f6a0
lds esi, [ecx - 0x5c5658b9]
inc ecx
push esp
sbb byte [ecx + 0x67], 0xe3
add ah, 0xa4
pop ss
jne 0x4f20ea
xchg edi, eax
xor bh, byte [ecx - 0x76c5bd98]
sahf
inc edi
invalid
test al, 0xaf
xor esi, ebp

Function at 0x4f2130
Capabilities:
Encode data using xor

Disassembly:
shr dword [edx + ecx + 0x55], cl
je 0x4f2183
pop ecx
jns 0x4f2102
or byte [eax], bl
dec dword [eax - 0x70ce186]
jmp 0x411ec57d
fmul dword [eax]
dec edi
stc
test byte [edi], 0x40
insb byte es:[edi], dx
sub byte [ebp - 0x6b], dh
or byte [ebx - 0x77], 0x79
cmp byte [0x34e4579a], 0xa0
xor dword [edi - 0x70], edi
test byte [esi - 0x68], bl

Function at 0x4f2c8c
Capabilities:
Encode data using xor

Disassembly:
daa
ja 0x4f2cf1
inc esi
scasd eax, dword es:[edi]
sbb al, 0x79
mov byte [edx], dl
xor ecx, ebp
mov ebx, 0x9784075c
sal byte [edi + 0x28], 1
dec ebx
xchg byte [eax], bh
loop 0x4f2c3f
lds esp, [esi + 0x46]
xor dword [ecx], 0xdc83cf46
jbe 0x4f2cfa
sti
add cl, byte [edx + esi + 0x13d3f319]
add byte [eax], cl
arpl word [ebx + 0x20], cx
jmp dword [ecx]
mov byte [0xb44499a0], al
ljmp 0x896d
xor ch, byte [ebp - 0x77]
test al, 0x14
push edi
loop 0x4f2d5e
mov eax, 0xf6cd1dce
add bl, byte [ecx + 0x2d]
sub eax, 0xaf4ff151
aaa
add byte [ecx + edi*8], ch
mov dl, al
mov byte [esi + 5], bh
fdivr qword [edx]
invalid
retf 0x7539

Function at 0x4f4aa0
Capabilities:
Encode data using xor

Disassembly:
jge 0x4f4a84
int 0x76
stosb byte es:[edi], al
test edi, esp
dec esi
xchg byte [edx - 0x43], dl
and ecx, esp
pushfd
inc ebx
mov ss, word [edx - 0x56de1fed]
salc
je 0x4f4a5d
clc
or byte [ecx], ch
adc eax, dword [ebp + 0x463364b2]
pushal
xchg ebx, eax
mov ch, 0xc9
daa
mul byte [esi]
add al, bh
dec eax
hlt
jbe 0x4f4a39
push ds
push eax
clc
in al, dx
push esi
sub ebp, dword [esi - 0x7d]
popfd
invalid
Function at 0x4f8c54
Capabilities:
Encode data using xor

Disassembly:
loope 0x4f8c8b
add byte [ebx], ah
aam 0x13
pop eax
mov ah, 0x3c
in al, 0xd5
and al, 0xf
mov ebp, 0xbd0edebb
dec ecx
invalid
invalid

Function at 0x4f9158
Capabilities:
Encode data using xor

Disassembly:
push ds
insb byte es:[edi], dx
xchg esi, eax
pop esi
fnstcw word [ebx - 0x52]
mov eax, 0x4da86eca
mov fs, ecx
fnstsw word [eax]
mov bl, 0xb2
add byte [ebp + 0x5960816e], cl
popal
sbb dword [eax], ebx
outsb dx, byte [esi]
xor dword [esi + 0x46204081], 0x10111d80
mul esi
inc edx
pop ecx
and al, 0x79
inc edi
je 0x4f90a8
retf 0xa86e
fsubp st(4)
rcl ch, 1
sahf
jmp 0xc136a790
mov ch, 0x16
out 0xc0, eax
push esi
imul edx, eax, 0x8810edfd
jno 0x4f910f
or byte [eax], ch
push ds
out 0x56, eax
and bl, byte [edx + eax*8]
sbb bh, byte [eax]
cmp dword [esi - 0x23], ecx
or esp, dword [ebp + edi*2 + 0x25]
dec eax
xchg edi, eax
adc al, 0x3c
js 0x4f9178
sub byte [edx - 4], dl
mov al, 0xd7
jg 0x4f90a0
movsb byte es:[edi], byte [esi]
mov word [ecx + 0x59], fs
cmp al, dh
mov esp, 0xf879be09
les ebp, [esi - 0x4ad6a05f]
jg 0x4f915b
mov eax, dword [0x7fb5295f]
inc esi
fdiv qword [ecx]
jge 0x4f916f
or al, 0x85
stosb byte es:[edi], al
rcr dword [ecx], cl
adc bl, byte [edx + 0x7cae0a6f]
jle 0x4f90f1
test byte [eax - 0x51], bl
les eax, [ebx]
mov ecx, 0x3223beae
push ebx
cmp eax, 0xca93b4d9
je 0x4f90d7
test al, 0xdc
ljmp 0x1d99
lodsd eax, dword [esi]
test eax, 0x5e39984f
wait
cwde
cmp dword [esi - 0x65], ebx
shr byte [ebx], 0x15
jp 0x4f911c
invalid
xchg edi, eax
xor ebx, dword [ecx + 0x4b411c2]
rcl byte [ebp + 0x6c3e7288], cl
mov byte [edx + 0x3e], dh
insb byte es:[edi], dx
inc ecx
mov edi, 0xa954a4b4
wait
clc
movsb byte es:[edi], byte [esi]
xor byte [esi - 0x65], 0xe7
jae 0x4f91db
mov ds, word [ebp + 0x7e5e1c02]
mov esi, 0x2c7c8faa
invalid
daa
rcl dword [ebx]
add byte [esi - 0x4d3255e2], dl
pop edx
add eax, 0x5b9aec72
push edi
aam 7
xor byte [eax], ch
xchg dword [esi - 0x66f6df79], ebp
test byte [edx + ecx], cl
mov ebp, 0x60910b7b
call 0x82bea7ba
popal
leave
xchg esp, eax
xor cl, byte [edi]
cld
mov esp, edx
lock xchg byte [esi - 0x29f69517], ah
dec edi
mov eax, 0x8d0fd9e7
jecxz 0x4f921e
mov dh, 0xed
xchg esi, eax
push ebp
ret 0x38d6

Function at 0x4f94a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x7e38593a
or ebx, dword [ecx + 0x51720d05]
retf