joyce8/EMBER2024-capa huggingface dataset:
Function at 0x524f4c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xffffffb8
mov ebx, eax
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebx + 0x44]
push eax
lea ecx, [ebx + 0xc]
lea edx, [ebx + 0x34]
mov eax, dword [ebx + 0x38]
call fcn.00510500
mov eax, dword [ebx + 0x68]
call fcn.005357f8
cmp byte [ebx + 0x78], 0
jne 0x525083
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x50]
mov edx, dword [ebx + 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x50]
mov edx, dword [ebx + 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [esp + 0x14]
mov eax, dword [ebx + 0x38]
call fcn.005359f4
mov esi, dword [ebx + 0x68]
mov eax, esi
call fcn.00535fcc
and eax, 0x7f
push eax
lea edx, [esp + 0x3c]
lea eax, [ebx + 0x3c]
call fcn.00555e24
lea eax, [esp + 0x3c]
push eax
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x50]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x30]
mov cl, 1
mov eax, esi
call fcn.0050598c
mov eax, ebx
call fcn.0052508c
mov eax, ebx
call fcn.00525630
mov edx, eax
mov eax, ebx
call fcn.00525478
movsx edx, ax
mov eax, ebx
call fcn.005255b4
mov eax, dword [ebx + 0x38]
push eax
call sub.user32.dll_IsWindowEnabled
test eax, eax
jne 0x525083
cmp byte [esp + 0x34], 0
je 0x525065
lea edx, [esp + 4]
lea eax, [ebx + 0x3c]
call fcn.00555e24
mov ecx, dword [esp + 0x1c]
add ecx, dword [ebx + 0x48]
mov edx, dword [esp + 0x18]
add edx, dword [ebx + 0x44]
lea eax, [esp + 4]
call fcn.004081a8
mov eax, dword [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [0x56b324]
movzx eax, byte [eax]
push eax
push 0xff00ff
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x50]
xor ecx, ecx
xor edx, edx
call fcn.00508e48
jmp 0x525083
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov edx, dword [0x56b324]
movzx edx, byte [edx]
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x50]
mov ecx, dword [esp]
call fcn.00509088
add esp, 0x48
pop esi
pop ebx
ret
Function at 0x52de5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov ebx, eax
mov esi, dword [ebx + 4]
mov eax, esi
mov edx, dword [0x5617bc]
call fcn.00403ed0
test al, al
je 0x52df9e
mov eax, esi
call fcn.0044f000
call fcn.004362c0
test al, al
jne 0x52de9a
mov eax, esi
call fcn.0044f000
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
mov dword [esp + 0x38], eax
mov eax, esi
call fcn.0044f000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov edi, dword [ebx + 0x18]
mov eax, dword [edi + 0x94]
mov dword [esp + 4], eax
mov eax, edi
call fcn.005363e8
mov dword [esp + 0x3c], eax
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x50]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x44]
mov eax, ebx
call fcn.0052e010
push esi
lea esi, [esp + 0x48]
lea edi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov eax, esi
call fcn.0044f00c
and eax, 0x7f
mov dword [esp + 8], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x4c]
mov byte [esp + 0x16], al
xor eax, eax
mov dword [esp], eax
movzx eax, byte [esi + 0x1b0]
mov byte [esp + 0x14], al
mov eax, ebx
call fcn.0052dc30
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
jne 0x52df55
mov eax, dword [ebx + 0x18]
call fcn.005363e8
test eax, eax
je 0x52df55
mov eax, dword [ebx + 0x18]
call fcn.005363e8
mov eax, dword [eax + 0x9c]
cmp byte [eax + 7], 0
je 0x52df55
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.00536f9c
test al, al
jne 0x52df59
xor eax, eax
jmp 0x52df5b
mov al, 1
mov byte [esp + 0x15], al
movzx eax, byte [0x52dfa8]
mov byte [esp + 0x40], al
mov byte [esp + 0x17], 0
cmp byte [esp + 0x15], 0
je 0x52df97
mov eax, dword [ebx + 0x18]
call fcn.005363e8
mov eax, dword [eax + 0x78bc]
mov edx, dword [esp + 4]
mov ecx, edx
shl edx, 5
sub edx, ecx
mov eax, dword [eax + edx*8 + 0x1c]
mov dword [esp + 0x34], eax
mov eax, esp
call fcn.004b2c94
add esp, 0x54
pop edi
pop esi
pop ebx
ret

Function at 0x53b1f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53b296
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
lea eax, [ebp - 4]
lea edx, [esi + esi*4]
mov ecx, dword [ebx + 0x1fc]
mov edx, dword [ecx + edx*4 + 0x10]
call fcn.004058d0
cmp word [ebx + 0x20a], 0
je 0x53b247
lea eax, [ebp - 5]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, dword [ebx + 0x20c]
call dword [ebx + 0x208]
cmp dword [ebp - 4], 0
setne al
and al, byte [ebp - 5]
je 0x53b280
movzx eax, byte [ebx + 0x200]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405908
push eax
push 0x53b2a4
mov eax, dword [0x56b194]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53b29d
lea eax, [ebp - 4]
call fcn.0040586c
ret
Function at 0x559178
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405864
xor eax, eax
push ebp
push 0x5591ec
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x2b4], eax
push pe_nt_image_headers32
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405908
push eax
call sub.shell32.dll_SHGetFileInfoW
mov edx, dword [ebp - 0x2b8]
mov eax, ebx
call fcn.00437d74
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5591f3
lea eax, [ebp - 4]
call fcn.0040586c
ret

Function at 0x559d94
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd7c
xor edx, edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405864
lea eax, [ebp - 0x278]
mov edx, dword [0x409c88]
call fcn.00406234
xor eax, eax
push ebp
push 0x559ec6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x27c]
mov ecx, 0x559ee0
mov edx, dword [ebp - 4]
call fcn.00405c50
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.0040c488
test eax, eax
jne 0x559e84
mov eax, dword [ebp - 0x264]
mov edx, 0x559ef4
call fcn.00405ec8
je 0x559e75
mov eax, dword [ebp - 0x264]
mov edx, 0x559f04
call fcn.00405ec8
je 0x559e75
lea edx, [ebp - 0x280]
mov eax, dword [ebp - 0x264]
call fcn.0040b2c4
mov eax, dword [ebp - 0x280]
mov edx, 0x559f18
call fcn.00405ec8
jne 0x559e75
mov ecx, 0x559f18
lea eax, [ebp - 0x284]
mov edx, dword [ebp - 4]
call fcn.00405c50
mov eax, dword [ebp - 0x284]
call fcn.00405908
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x559e84
lea eax, [ebp - 0x278]
call fcn.0040c4d8
test eax, eax
je 0x559e08
lea eax, [ebp - 0x278]
call fcn.0040c4fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x559ecd
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.00405874
lea eax, [ebp - 0x278]
mov edx, dword [0x409c88]
call fcn.0040630c
lea eax, [ebp - 4]
call fcn.0040586c
ret

Function at 0x55add4
Capabilities:
Hide graphical window

Disassembly:
test al, al
je 0x55ade3
mov eax, dword [0x56b194]
mov eax, dword [eax]
mov byte [eax + 0x57], 0
mov eax, dword [0x56b194]
mov eax, dword [eax]
cmp byte [eax + 0xcf], 0
je 0x55ae18
mov eax, dword [0x56b194]
mov eax, dword [eax]
cmp dword [eax + 0x40], 0
je 0x55ae18
push 0
mov eax, dword [0x56b194]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
call fcn.00472ce0
push eax
call sub.user32.dll_ShowWindow
ret
push 0
mov eax, dword [0x56b194]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x55cac8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd70
push ebx
xor edx, edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405864
lea eax, [ebp - 0x280]
mov edx, dword [0x409c88]
call fcn.00406234
xor eax, eax
push ebp
push 0x55cc82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040c2cc
test al, al
je 0x55cc36
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004058d0
lea eax, [ebp - 0x288]
mov edx, dword [ebp - 0xc]
call fcn.00405af8
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x284]
mov edx, 1
call fcn.00409aec
mov eax, dword [ebp - 0x284]
mov edx, 0x55cc94
call fcn.00405774
je 0x55cb7a
lea eax, [ebp - 0xc]
mov edx, 0x55cca4
call fcn.00405bd0
lea eax, [ebp - 0x28c]
mov ecx, 0x55ccb4
mov edx, dword [ebp - 0xc]
call fcn.00405c50
mov eax, dword [ebp - 0x28c]
lea ecx, [ebp - 0x280]
mov edx, 0x1ff
call fcn.0040c488
test eax, eax
jne 0x55cc23
mov eax, dword [ebp - 0x26c]
mov edx, 0x55ccc4
call fcn.00405ec8
je 0x55cc14
mov eax, dword [ebp - 0x26c]
mov edx, 0x55ccd4
call fcn.00405ec8
je 0x55cc14
test byte [ebp - 0x270], 0x10
je 0x55cbf5
lea eax, [ebp - 0x290]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 0xc]
call fcn.00405c50
mov eax, dword [ebp - 0x290]
call fcn.0055cac8
jmp 0x55cc14
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 0xc]
call fcn.00405c50
mov eax, dword [ebp - 8]
call fcn.00405908
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x280]
call fcn.0040c4d8
test eax, eax
je 0x55cba7
lea eax, [ebp - 0x280]
call fcn.0040c4fc
mov eax, dword [ebp - 0xc]
call fcn.0040cad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cc89
lea eax, [ebp - 0x290]
mov edx, 2
call fcn.00405874
lea eax, [ebp - 0x288]
mov edx, 2
call fcn.004054f8
lea eax, [ebp - 0x280]
mov edx, dword [0x409c88]
call fcn.0040630c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405874
ret
Function at 0x55d000
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405864
xor eax, eax
push ebp
push 0x55d0b3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040c6cc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.00405908
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.004068d0
call fcn.004068d0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0
push 0x400
push 0
push 0x400
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004068f4
call fcn.004068f4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d0ba
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405874
ret
Function at 0x55d5e4
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x420], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x418], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x55d7b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20c]
push eax
push 0x103
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 4]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00405a7c
push 0
push 0x400
push 0
push 0x400
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.004068f4
call fcn.004068f4
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
call fcn.0055d000
cdq
cmp edx, dword [ebp + 0xc]
jne 0x55d679
cmp eax, dword [ebp + 8]
jae 0x55d6df
jmp 0x55d67b
jge 0x55d6df
mov bx, 0x43
lea eax, [ebp - 0x418]
mov edx, ebx
call fcn.004059e8
lea eax, [ebp - 0x418]
mov edx, 0x55d7d4
call fcn.00405bd0
mov eax, dword [ebp - 0x418]
call fcn.0055d000
cdq
cmp edx, dword [ebp + 0xc]
jne 0x55d6b4
cmp eax, dword [ebp + 8]
jbe 0x55d6d8
jmp 0x55d6b6
jle 0x55d6d8
lea eax, [ebp - 0x41c]
mov edx, ebx
call fcn.004059e8
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 4]
mov ecx, 0x55d7e4
call fcn.00405c50
jmp 0x55d6df
inc ebx
cmp bx, 0x5b
jne 0x55d67f
lea eax, [ebp - 0x414]
push eax
push 0
push 0x55d7ec
mov eax, dword [ebp - 4]
call fcn.00405908
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
je 0x55d720
lea eax, [ebp - 4]
lea edx, [ebp - 0x414]
mov ecx, 0x104
call fcn.00405a7c
mov eax, dword [ebp - 4]
call fcn.00405908
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x424]
mov edx, dword [ebp - 4]
call fcn.00405af8
mov eax, dword [ebp - 0x424]
lea ecx, [ebp - 0x420]
mov edx, 1
call fcn.00409aec
mov eax, dword [ebp - 0x420]
mov edx, 0x55d7f8
call fcn.00405774
je 0x55d763
lea eax, [ebp - 4]
mov edx, 0x55d808
call fcn.00405bd0
mov eax, dword [ebp - 4]
call fcn.0040c2cc
test al, al
jne 0x55d777
mov eax, dword [ebp - 4]
call fcn.0040c2f0
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040587c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d7be
lea eax, [ebp - 0x424]
mov edx, 2
call fcn.004054f8
lea eax, [ebp - 0x41c]
mov edx, 2
call fcn.00405874
lea eax, [ebp - 4]
call fcn.0040586c
ret
Function at 0x40af6f
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push esp
pushaw
imul esp, dword [ebx], 0x5c6876e9
arpl cx, di
push 0x7031d3a2
pushal
nop
adc dl, byte [eax + ebx*2 + 0x5b]
push edx
mov bh, byte [0x7ca2c942]
mov ch, 0x51
test eax, 0xd0c7870
jae 0x40af96
mov ebx, dword [ecx]
arpl word [ecx], ax
cmp esp, eax
inc esi
stosb byte es:[edi], al
adc eax, 0x302c6165
popal
sub al, 0x30
cmp ch, ch
xlatb
shr dword [edx - 0x3b], 0xa3
sbb eax, 0xe067945a
jmp 0x40af4c
or dh, al
jbe 0x40af1a
push edx
mov eax, dword [0x4140359b]
inc ecx
inc ecx
pushfd
loopne 0x40afb3
ja 0x40afca
push ebx
jo 0x40af66
xor ah, byte [esi]
pop eax
je 0x40afed
pop eax
shl dword [0xd6f002de], 1
outsd dx, dword [esi]
pop esp
imul eax, dword [edi], 0x3b
fistp word [esi + 0x4c82407e]
std
fadd qword [ebx]
push 0x7b01e330
insd dword es:[edi], dx
jnp 0x40b005
inc esp
fisttp dword fs:[eax]
imul esi, dword [edx + 0x62b86a5b], 0x4fc0e0c8
popal
int1
invalid
scasb al, byte es:[edi]
cli
outsd dx, dword [esi]
xor byte [esi], 0x31
rcl byte [ecx - 0x4e], cl
popal
and al, byte [edi]
arpl word [esi], ax
imul eax, dword [edx], 0x37
js 0x40b038
arpl word [ecx - 0x3c2438fd], si
fcmovnb st(0), st(3)
and eax, 0xb35b3961
arpl word [ebx + 0x63970170], cx
jmp dword [ebx + 0x60]
and eax, 0xe8366050
or al, 0x55
cmp eax, 0x71afdb63
scasd eax, dword es:[edi]
jno 0x40b015
daa
pop ebp
pop ebx
call 0x80272ce8
bound esi, qword [eax - 0x15]
xor bl, byte [esi + 0x44b6e68]
inc eax
adc ah, dh
pop ss
mov al, byte [0x6ca3657d]
mov dword [0xe76cff6c], eax
pushal
pshufw mm6, qword [ebx], 0x74
or esi, dword [eax - 0x51]
push ebx
std
std
jnp 0x40afee
out 0x36, al
ja 0x40afeb
jne 0x40b060
stosb byte es:[edi], al
inc dword [esi + 0x4253a4b1]
scasd eax, dword es:[edi]
dec esp
salc
jns 0x40afe1
stosd dword es:[edi], eax
aam 0xaf
Function at 0x40b096
Capabilities:
Check for vm using instruction vpcext

Disassembly:
insb byte es:[edi], dx
jmp [edi + 0x60]
mov bl, 0x10
mov ebx, 0x3fce004a
jb 0x40b006
imul esp, esp, 0x14d75557
adc byte [ecx - 0x5459862a], bl
adc edi, dword [ebx]
xor byte [eax + 0x2c], ah
cdq
aaa
pop ss
xchg edi, eax
div byte [eax + esi*4 - 0xb]
jns 0x40b07d
cmp al, 0x72
push eax
imul eax, dword [ebx + 0x1af97f8f], 0x16
pop ss
mov esi, 0x30294edf
adc dword [esi], edx
dec ecx
mov word [esp + edx*8 - 0x51], ds
xor al, 0x1a
dec edx
aas
and ebx, ebx
or byte [edi], 0x15
pop ss
adc ebx, dword [ebp + 4]
pop es
fild dword [edx + 0x1317150f]
pop ebp
add al, 0x36
pop es
pushfd
push ss
loopne 0x40b0f0
adc byte [0x9b3ce6a9], dl
je 0x40b0de
ret 0x1fe9
jg 0x40b068
sub eax, ecx
rcr dword [ecx], 1
push es
jae 0x40b027
hlt
aam 0x69
dec esp
pop edi
ja 0x40b126
or eax, 0x19510e56
and dword [esi + 0x16], eax
push ecx
sbb dword [ecx], esp
inc esi
push ss
push cs
jae 0x40b0d5
xor dword [eax + 0x2213caa6], ebx
fistp qword [ecx]
invalid
aas
ret 0x90fe
cmp dword [ebx + ebp*4 + 0x6d], ecx
test byte [edi + esi*8], dl
sal dword [esi], 0x8c
dec edx
cmp dword [edx - 4], ecx
adc al, 0x2d
or al, 0x46
into
cmp eax, 0xe78d111c
or al, 0x28
std
aaa
push ds
adc al, 0x30
call dword [eax]
lahf
dec esp
in al, dx
add dl, byte [edx + edi]
cmp bl, byte [ecx + ecx*8]
loope 0x40b0df
mov bh, 0x17
adc edx, esp
mov ah, 0x6d
aaa
mov edx, edi
outsd dx, dword [esi]
pop esi
inc ebx
insb byte es:[edi], dx
jmp 0x40b1e1
int 0xc2
xchg ebx, eax
cmp bh, byte [esi + edi*4 - 0x2a56f6b6]
sbb ecx, dword [0xc7693144]
aad 0x1b
or eax, 0xc7693144
clc
lcall 0xba98, 0x5a1fd093
mov ecx, 0x954a6ec5
clc
add al, 0xb
js 0x40b225
adc dl, ch
xor al, 0x45
push cs
jnp 0x40b1d8
cld
add esp, dword [edi + 0x22fe3a76]
mov al, byte [0x924d6c3b]
mov edx, 0x86b43aa0
rcl dword [ebp + 0x316b4e73]
push ebx
mov ecx, 0xba8c2336
dec edx
fstp dword [edi + 0x33]
mov edx, 0x335fd94a
sbb esp, dword [esi - 0x2b]
cmp dword [edi], 0xffffff93
aad 0x83
aas
xchg ebx, eax
xchg ecx, eax
dec ebx
xor ecx, ecx
leave
push 0x46
cmp byte [ebp + 8], dh
push es
out dx, eax
or ebx, 0x6a6d6fbd
push cs
leave
fmul dword [esi - 0x6c]
fild qword [ebp - 0x78]
dec edi
fcomp qword [edx]
call 0x6888dc5c
mov dl, 0x6c
mov ebp, 0x90076011
lodsb al, byte [esi]
xor bl, bl
mov bl, 0x12
jne 0x40b21e
pop esi
and al, 0x86
arpl word [ecx - 0x63573305], dx
mov bh, ch
shl dword [edi], cl
movsb byte es:[edi], byte [esi]
pop ebp
add byte [eax + 0x18], dh
salc
ljmp 0xfa8f

Function at 0x440d12
Capabilities:
Encode data using xor

Disassembly:
seta ah
les ecx, [edx + 0xa]
and dword [eax + edi - 0x63], ebp
sub al, ah
add al, 0x7b
and eax, 0x783e62d7
mov byte [eax + eax - 0x5a], ah
push ebp
or byte ds:[edx + 0x69726f8e], cl
nop
invalid
Function at 0x45b3e2
Capabilities:
Encode data using xor

Disassembly:
add edi, dword [ebp + 0xf]
lcall 0x82a4, 0xe6f9eb79
jg 0x45b45a
pop ecx
inc ebx
cwde
and dword [edx - 0x62], 0x37
and bl, byte [edi]
inc ecx
bound ebx, qword [esi + 0x411f2237]
fidivr dword [edi]
jnp 0x45b437
jmp 0x45b382
or dword [edi + 0x1e1e60f1], ecx
mov cl, 0x2a
cmp dword [0x1edc671a], ebx
mov edi, 0xb578f788
sbb dword [edi + 0x1d], ebp
inc ebx
mov al, byte [0x1f633b52]
xor eax, 0x54e9070a
out 0x38, al
mov edi, 0xfbd0fc72
aam 0x48
push cs
mov esi, 0x8bbc9850
sal byte [eax - 0x20], 1
mov esp, 0xe070d08b
mov bl, 0xdf
cmp dh, byte [edi + 0x1aec2d18]
jge 0x45b409
push 0xef6ab942
push 0xaabf2d01
xlatb
xlatb
pop ds
push edi
out 0x20, eax
mov dword [0x3511], eax
xchg dword [eax + 0x4c], ebx
bound edi, qword [edi - 0x56]
mov ebx, 0x74e3a68f
mov ds, esp
xlatb
jle 0x45b4e0
push edi
dec eax
dec esi
jecxz 0x45b3f2
jno 0x45b4b9
iretd
movsb byte es:[edi], byte [esi]
shr dword [ebx], 1
push edi
push ebx
sub edx, dword [edi + 0x53]
sub dh, byte [eax + 0x34ad90a3]
outsb dx, byte [esi]
jmp 0x45b4bb
out 0xc3, eax
add esi, dword [ebp - 0x5452ea49]
xor ebp, dword [ebx + 0x75f249ca]
or bl, dh
add eax, 0xe376623d
and al, byte [ebp + 0xa]
add cl, byte [esi - 0x4f]
jecxz 0x45b4ba
and cl, byte [esi + edi*2]
popal
imul esi, dword [ecx + 0x24], 0x19237171
salc
mov ebx, 0xe2562dcd
add dword [ecx - 0x51], ecx
push edi
in al, 0x70
inc eax
xchg ecx, eax
sub dh, 0xa0
push dword [edi]
cmp bh, byte [edx]
shl ebx, 1
adc esp, dword [eax - 0x7fb7fd9]
out dx, eax
dec ecx
nop
ror byte [esi + 0x28], cl
sub esi, dword [edx]
mov edx, 0x304955cf
xlatb
aad 0x98
mov ecx, 0x555f5850
and dword [ebx + 0x2324a84c], ebx
pushfd
mov eax, dword [esi]
ljmp 0xb7c4
Function at 0x4692cf
Capabilities:
Encode data using xor

Disassembly:
das
sub ebx, dword [esi - 0x12]
adc dword [esi], eax
mov al, 0xc4
salc
xchg esp, eax
in eax, 0x20
xchg ebp, eax
movsd dword es:[edi], dword [esi]
imul dword [0xb7542691]
std
lea esp, [esp + edx*8]
lahf
lcall 0x5b6, 0x66400f06
cmpsb byte [esi], byte es:[edi]
xor dword [esi + 0x6f9d3ae7], edi
outsd dx, dword [esi]
outsd dx, dword [esi]
jae 0x4692a9
movsb byte es:[edi], byte [esi]
cmp eax, 0x2955cfd0
sbb ch, 0x8d
mov ah, 0x53
nop
daa
mov eax, dword [0x51e7ce05]
vpmulhuw xmm7, xmm5, xmmword [eax - 0x37c14cfb]
xor eax, 0x1500cd7b
jle 0x4692ee
int 0
adc eax, 0x3591fb7e
xchg dword [ebp - 0x20], eax
out dx, al
xchg ecx, eax
xor eax, 0xeee04587
aad 0x71
jb 0x469342
sub al, 0x71
insb byte es:[edi], dx
jno 0x46936c
movsd dword es:[edi], dword [esi]
mov ebx, 0xa61be815
inc ebp
mov bh, 0xc0
invalid
jecxz 0x4692fe
ret
imul byte gs:[edi - 0xfa6cada]
pop esi
rcl byte [eax + esi + 0x633f692], 0x79
xchg byte [esi], al
or dh, byte [edi - 0x5c]
leave
clc
aaa
in eax, 0x7e
lea edi, [edi - 0x6b]
jns 0x4693fc
push es
push 0xffffffffffffffe3
pop ss
call 0xea4d142c
mov al, byte [0xda8bb4f5]
out dx, eax
test al, 0x81
popfd
cmc
xchg esi, eax
popfd
stosd dword es:[edi], eax
ret 0xee32
push esp
push esp
mov ecx, 0xcddddfdb
popal
not byte [edx + 0x126fd8b1]
pop edi
pop dword [ebx]
loope 0x469460
sbb esi, dword [ebx - 0x1c2c9c66]
cmp byte [ebx], ah
test dword [esi - 0x2ced68f3], ebx
mov ebx, 0x732d12fc
arpl word [edx + 0x7bd3989f], bx
invalid
rcl bh, cl
push eax
loope 0x4694da
dec ebx
pop edi
fstp xword [eax]
cmc
xor al, 0xe2
enter 0x2684, 0x68
invalid
stosb byte es:[edi], al
xor dword [edi + edi - 0x76], 0xb5b52bfb
sahf
push 0xffffffffffffffd0
and al, 0x7e
or edi, dword gs:[edi + 0x3e]
cmc
mov esi, 0xee75efe1
salc
into
adc ebp, esi
invalid

Function at 0x472992
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx - 0x571adf67], esi
in eax, 5
hlt
fld xword [edx - 0x32713ac0]
jo 0x472918
push ds
sub dword [ecx + 0x92f9a87], esi
nop
sub ah, byte [edi - 0x1f]
enter 0xffffffffffffa27d, 0xffffffffffffffd0
sbb dword [ebp + 0x31], 0xffffffbd
sbb byte [ecx + 0x75], 0xc
fiadd dword [esi - 0x70]
mov edx, 0x12b85789
jge 0x4729e7
out dx, eax
lea edx, [edi + edx*2 + 0x336201b]
bound edx, qword [edx + 0x24]
ja 0x472983
xchg esp, eax
push edi
sbb esp, dword [eax]
add esp, dword ss:[edx + 0x52]
and al, 0x77
enter 0xffffffffffffba18, 0xffffffffffffffa9
mov bl, byte [edi - 0x36e37d82]
and dword [esi + 0x2c], eax
dec edi
sbb byte [edx + 0x7e9f8aa9], bh
sbb byte [ecx + ecx*8], 0x21
inc esi
sub al, 0x4f
or eax, 0x17e4067b
test ebp, edx
nop
sub eax, 0x34413535
mov al, byte [0x846ed72e]
dec ebx
xor dword [ecx - 0x2558e230], edi
mov ecx, 0xdaa71dd0
inc ecx
scasd eax, dword es:[edi]
sbb esi, dword [edx]
mov dword [0x1677610a], eax
popal
ja 0x472a00
invalid
test byte [eax + 0x692552b1], al
mov edx, 0x88afad01
xlatb
stosd dword es:[edi], eax
loop 0x4729b0
and eax, 0x868b52aa
jnp 0x472a70
jle 0x4729dc
scasb al, byte es:[edi]
sub cl, byte [eax]
scasb al, byte es:[edi]
push 0xffffffffffffffe1
dec esp
inc edx
jns 0x472a73
or dword [edx - 0x54], esp
invalid
test byte [eax + 0x4e], cl
idiv dword [esi]
rcl eax, 0x1d
invalid