joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437d66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x468850]
jne 0x437d70
repz ret
jmp fcn.0043f064

Function at 0x448640
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043ea73
and dword [ebp - 4], 0
cmp dword [0x46c994], 0
mov ebx, eax
jne 0x4486f1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4487a2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4487a2
push eax
call fcn.0043ea01
mov dword [esp], 0x457948
push edi
mov dword [0x46c994], eax
call esi
push eax
call fcn.0043ea01
mov dword [esp], 0x457934
push edi
mov dword [0x46c998], eax
call esi
push eax
call fcn.0043ea01
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46c99c], eax
call esi
push eax
call fcn.0043ea01
pop ecx
mov dword [0x46c9a4], eax
test eax, eax
je 0x4486f1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043ea01
pop ecx
mov dword [0x46c9a0], eax
mov eax, dword [0x46c9a0]
cmp eax, ebx
je 0x448749
cmp dword [0x46c9a4], ebx
je 0x448749
push eax
call fcn.0043ea7c
push dword [0x46c9a4]
mov esi, eax
call fcn.0043ea7c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x448749
test edi, edi
je 0x448749
call esi
test eax, eax
je 0x448740
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x448740
test byte [ebp - 0xc], 1
jne 0x448749
or dword [ebp + 0x10], 0x200000
jmp 0x448782
mov eax, dword [0x46c998]
cmp eax, ebx
je 0x448782
push eax
call fcn.0043ea7c
pop ecx
test eax, eax
je 0x448782
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x448782
mov eax, dword [0x46c99c]
cmp eax, ebx
je 0x448782
push eax
call fcn.0043ea7c
pop ecx
test eax, eax
je 0x448782
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46c994]
call fcn.0043ea7c
pop ecx
test eax, eax
je 0x4487a2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4487a4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x1a633f13
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x52b51959
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401100
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x1b4
mov eax, dword [0x4130a0]
xor eax, esp
mov dword [esp + 0x1ac], eax
push esi
push edi
lea eax, [esp + 0x20]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x401151
push 0x410c40
call fcn.00402be4
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.00402600
add esp, 0x1b4
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401191
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x410c58
call fcn.00402be4
add esp, 8
or eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.00402600
add esp, 0x1b4
ret
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x1005
push 0xffff
push esi
mov dword [esp + 0x20], 0x7530
call edi
push 4
lea edx, [esp + 0x10]
push edx
push 0x1006
push 0xffff
push esi
mov dword [esp + 0x20], 0x7530
call edi
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, 2
push str.www.igo19.com
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x401228
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Error_at_gethostbyname__:__d_n
call fcn.00402be4
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.00402600
add esp, 0x1b4
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push 0x50
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea ecx, [esp + 0x14]
push ecx
push esi
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jge 0x401280
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Error_at_connect__:__d_n
call fcn.00402be4
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.00402600
add esp, 0x1b4
ret
mov ecx, dword [esp + 0x1b4]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00402600
add esp, 0x1b4
ret
Function at 0x4012a0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
sub esp, 0x42c
mov eax, dword [0x4130a0]
xor eax, esp
mov dword [esp + 0x424], eax
push esi
push edi
call fcn.00401100
mov esi, eax
test esi, esi
jl 0x4012dc
push 0
push 0x44
push str.GET__idserver_service_getMachineId_HTTP_1.1_r_nHOST:_www.igo19.com_r_n_r_n
push esi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x4012f6
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.00402600
add esp, 0x42c
ret
push 0x400
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00406ce0
add esp, 0xc
push 0
push 0x400
lea ecx, [esp + 0x30]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
test edi, edi
jle 0x4012dc
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x10]
call fcn.00401e00
cmp dword [esp + 0x24], 0x10
mov esi, dword [esp + 0x10]
jae 0x401347
lea esi, [esp + 0x10]
push 2
lea eax, [esp + 0x10]
push eax
call fcn.00401f50
cmp dword [esp + 0x24], 0x10
lea esi, [eax + esi + 5]
mov ecx, 8
mov edi, 0x414bb8
rep movsd dword es:[edi], dword [esi]
jb 0x401377
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00402d84
add esp, 4
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00402600
add esp, 0x42c
ret

Function at 0x401390
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x110
mov eax, dword [0x4130a0]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
push 0x104
lea eax, [esp + 8]
push 0
push eax
call fcn.00406ce0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x4014a0
lea eax, [esp + 4]
lea edx, [eax + 1]
jmp 0x4013e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013e0
sub eax, edx
mov edx, 0x104
sub edx, eax
push str.igoAssistantigosn.eac
push edx
lea eax, [esp + eax + 0xc]
push eax
call fcn.004029ed
add esp, 0xc
lea ecx, [esp + 4]
push 0x410d1c
push ecx
call fcn.00402d6d
mov esi, eax
add esp, 8
test esi, esi
je 0x40144a
push esi
push 0x20
push 0x414bb8
call fcn.00402a9c
add esp, 0xc
push esi
call fcn.004030b8
add esp, 4
pop esi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00402600
add esp, 0x110
ret
call fcn.004012a0
test eax, eax
je 0x401470
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0x3e8
call esi
call fcn.004012a0
test eax, eax
jne 0x401460
lea edx, [esp + 4]
push 0x410d20
push edx
call fcn.00402d6d
mov esi, eax
add esp, 8
test esi, esi
je 0x4014a0
push esi
push 1
push 0x20
push 0x414bb8
call fcn.00402f6e
push esi
call fcn.004030b8
add esp, 0x14
mov ecx, dword [esp + 0x110]
pop esi
xor ecx, esp
call fcn.00402600
add esp, 0x110
ret
Function at 0x4014c0
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x1b0
mov eax, dword [0x4130a0]
xor eax, esp
mov dword [esp + 0x1a8], eax
push esi
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40150f
push str.Error_at_WSAStartup___n
call fcn.00402be4
add esp, 4
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00402600
add esp, 0x1b0
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40154e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Error_at_socket__:__d_n
call fcn.00402be4
add esp, 8
or eax, esi
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00402600
add esp, 0x1b0
ret
xor eax, eax
mov ecx, 2
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push 0x232b
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0xc], cx
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 0xc]
push edx
push esi
mov word [esp + 0x16], ax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4015c5
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Error_at_bind__:__d_n
call fcn.00402be4
add esp, 8
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00402600
add esp, 0x1b0
ret
push 0x80
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x40160a
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Error_at_listen__:__d_n
call fcn.00402be4
add esp, 8
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00402600
add esp, 0x1b0
ret
mov ecx, dword [esp + 0x1ac]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00402600
add esp, 0x1b0
ret

Function at 0x401630
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
cmp byte [0x414bd8], 0
je 0x401645
mov eax, 0x414bd8
add esp, 0xc
ret
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareIGo
push reloc.WS2_32.dll_accept
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401672
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp]
push esi
lea ecx, [esp + 8]
push ecx
push 0x414bd8
lea edx, [esp + 0x14]
push edx
push 0
push str.Location
push eax
mov dword [esp + 0x24], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
not eax
and eax, 0x414bd8
pop esi
add esp, 0xc
ret
Function at 0x4016c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x4130a0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.00401630
push eax
push str._s_s
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004029ed
add esp, 0x14
push 0
lea ecx, [esp + 4]
push ecx
mov byte [esp + eax + 8], 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x104]
xor edx, edx
cmp eax, 0x1f
setg dl
xor ecx, esp
dec edx
mov eax, edx
call fcn.00402600
add esp, 0x108
ret
Function at 0x401ca0
Capabilities:
Create thread
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0x65
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.004014c0
mov esi, eax
test esi, esi
jge 0x401ce8
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00401390
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x401c40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 0x10]
or eax, 0xffffffff
push ecx
lea edx, [esp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
push esi
push edx
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 1
mov dword [esp + 0x1c], esi
call fcn.004019a0
add esp, 0xc
test eax, eax
jne 0x401dca
jmp 0x401d50
mov edx, dword [esp + 8]
mov ecx, 1
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ecx
test edx, edx
jle 0x401d85
xor eax, eax
cmp dword [esp + eax*4 + 0x1c], edx
je 0x401d73
inc eax
cmp eax, 1
jb 0x401d67
cmp eax, 1
jne 0x401d85
mov ecx, 2
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 4]
test edx, edx
jle 0x401daf
xor eax, eax
test ecx, ecx
jbe 0x401d9e
cmp dword [esp + eax*4 + 0x1c], edx
je 0x401d9e
inc eax
cmp eax, ecx
jb 0x401d93
cmp eax, ecx
jne 0x401daf
cmp ecx, 0x40
jae 0x401daf
mov dword [esp + eax*4 + 0x1c], edx
inc dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 8]
push esi
push ecx
lea eax, [esp + 0x24]
call fcn.004019a0
add esp, 0xc
test eax, eax
je 0x401d50
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
mov eax, dword [esp + 4]
test eax, eax
jle 0x401dde
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
jle 0x401de9
push eax
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402600
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4130a0]
jne 0x40260a
repz ret
jmp fcn.0040387a
Function at 0x409fae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408529
and dword [ebp - 4], 0
cmp dword [0x414a54], 0
mov ebx, eax
jne 0x40a05f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a110
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a110
push eax
call fcn.004084b7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x414a54], eax
call esi
push eax
call fcn.004084b7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x414a58], eax
call esi
push eax
call fcn.004084b7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x414a5c], eax
call esi
push eax
call fcn.004084b7
pop ecx
mov dword [0x414a64], eax
test eax, eax
je 0x40a05f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004084b7
pop ecx
mov dword [0x414a60], eax
mov eax, dword [0x414a60]
cmp eax, ebx
je 0x40a0b7
cmp dword [0x414a64], ebx
je 0x40a0b7
push eax
call fcn.00408532
push dword [0x414a64]
mov esi, eax
call fcn.00408532
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a0b7
test edi, edi
je 0x40a0b7
call esi
test eax, eax
je 0x40a0ae
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a0ae
test byte [ebp - 0xc], 1
jne 0x40a0b7
or dword [ebp + 0x10], 0x200000
jmp 0x40a0f0
mov eax, dword [0x414a58]
cmp eax, ebx
je 0x40a0f0
push eax
call fcn.00408532
pop ecx
test eax, eax
je 0x40a0f0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a0f0
mov eax, dword [0x414a5c]
cmp eax, ebx
je 0x40a0f0
push eax
call fcn.00408532
pop ecx
test eax, eax
je 0x40a0f0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x414a54]
call fcn.00408532
pop ecx
test eax, eax
je 0x40a110
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a112
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4591cc
Capabilities:
Encode data using xor

Disassembly:
push ecx
enter 0x38d1, 0x58
mov esp, 0x87d2a881
test al, 0xd2
xchg dword [esi - 0x23], ebx
xor eax, 0x527edd7f
test al, 0xd2
xchg dword [esi - 0x23], ebx
xor eax, 0x527edd7f
xor byte [ebx + 0x2cacf3a], bl
mov ch, 0x23
movsd dword es:[edi], dword [esi]
push esi
loop 0x4591c5
hlt

Function at 0x5350cc
Capabilities:
Encode data using xor

Disassembly:
call 0x78498fca
add dword [eax + 0x28faa8ad], edi
in eax, dx
movsb byte es:[edi], byte [esi]
mov gs, word [esi - 0x764e221d]
insb byte es:[edi], dx
sbb byte [ebx + 0x2e904802], dh
loop 0x535147
sti
or eax, 0xc70e22f3
das
inc edx
push es
shl dword [edi], 1
adc dword [eax + 0x413ccba3], eax
shr byte [ebp + 0x5e], cl
xchg esi, eax
cdq
shr byte [esp + eax*8 + 0x32], 1
test al, 0x81
inc esp
sub eax, 0x30b19c13
pushfd
mov cl, 0x30
sal byte [eax - 0x1a65ae0c], 0x61
scasd eax, dword es:[edi]
or dword gs:[ebp + 0x165e3701], eax
arpl ax, ax
sub ebx, 0xf
pop esi
adc eax, 0x75149e49
aaa
adc ecx, ebp
je 0x535107
les edx, [esi - 0x40]
dec ecx
fldlg2
adc dword [edi + 0x32349821], 0x1320d40c
aaa
cmove ecx, dword [eax + 0x1fa8f7cb]
movsb byte es:[edi], byte [esi]
and ah, byte [edx + edx*2 - 0x36]
jmp 0x53515d
scasd eax, dword es:[edi]
adc ah, byte [ebp + 0x24]
adc eax, 0x64828468
inc esi
mov al, 0x27
frstor dword [eax - 8]
xor eax, 0x69a1cc9b
sbb eax, 0x4f8c270
stosd dword es:[edi], eax
xor dword [edi - 0xbc05cea], ecx
adc dh, byte [0x9448844d]
invalid

Function at 0x5d40a8
Capabilities:
Encode data using xor

Disassembly:
call 0xcde282ca
scasd eax, dword es:[edi]
xor dword [esi], 0xcd8ddc4c
cmp ebp, 0x6332878d
xchg ecx, eax
sahf
xor byte [ebx + 0x38], al
cmp bl, byte [esi + ecx + 0x173e30c0]
xor al, 0x12
wait
mov ebp, 0x7e6dc3bd
sti
invalid
Function at 0x5d8110
Capabilities:
Encode data using xor

Disassembly:
pop esp
lcall 0xebb, 0xe4d36de
lcall 0xb217, 0x24964e3d
add dword [edx + 0x5df78009], ebp
pop ebp
shl dword [edx + 0x57], cl
loope 0x5d813d
ljmp 0xd98a:0x9d62d3b5
jae 0x5d8174
sbb byte [edi], cl
sbb al, 0xaf
sbb esp, ebx
mov word [edx], cs
pop ebp
jo 0x5d815c
ja 0x5d81ae
sbb byte [ebp - 0x47cfb86d], cl
cmp al, 0xc8
jnp 0x5d8124
pop esp
or dword [ecx], eax
imul esp, dword [edi + 0x6f84723b], 0x4240e832
cmp esi, dword [edx - 0x7c]
outsd dx, dword [esi]
xor ch, al
inc eax
inc edx
mov byte [0x90939216], al
nop
add eax, 0x39ab5a9a
popal
xchg edx, eax
invalid
out dx, al
xor dword [ebx + 0x5d19e96a], ebx
or bl, byte [ecx]
xchg edx, eax
dec eax
push es
mov eax, dword [0xffe0f876]
pop esi
cli
jp 0x5d8168
test eax, 0x6ddbad19
xor byte [ebp + 0x4b], bh
loop 0x5d81a1
rcl byte [ebp + 0x6518bf22], cl
mov eax, 0xd8283fc0
loopne 0x5d81e2
fbld tbyte [ecx + eax + 4]
cmc
xchg ebx, eax
dec edi
adc byte [ebx + 0x7ba798f3], 0xb1
add dword fs:[esi*8 - 0x6c7db06d], eax
cwde
cmpsd dword [esi], dword es:[edi]
jnp 0x5d815f
lodsb al, byte [esi]
sub al, 4
dec ecx
adc al, 0x87
scasb al, byte es:[edi]
pop esp
jl 0x5d8204
xchg dword [esi - 0x7ab383a4], ebp
fmul qword [eax + 0xe]
test esp, ebx
dec eax
push cs
and ch, 0x12
fst qword [ecx + 0x1b8e2eeb]
loop 0x5d8162
scasd eax, dword es:[edi]
mov word [edx - 0x456cb384], ss
mul edx
or byte [edx - 0x45751970], bl
xchg ecx, eax
dec edi
sbb eax, 0xdb2317dd
xchg ecx, eax
invalid
pop edi
mov byte [0xe49b6f97], al
mov ecx, 0xf9b51d02
mov dh, 0x5c
adc byte [ebx + 0x4e], 0x19
xor dword [ebx - 0x38], esp
sbb ebx, ebx
enter 0xffffffffffffde3c, 0xffffffffffffffcd
loope 0x5d81b3
sti
daa
outsd dx, dword [esi]
inc ecx
xchg ecx, eax
nop
out 0x89, eax
rcl bl, 0x53
hlt
Function at 0x5d940c
Capabilities:
Get number of processors

Disassembly:
lahf
outsd dx, dword [esi]
and al, cl
mov dl, 0xed
aam 0x27
jnp 0x5d941a
or dword [ebx + 0x6d], 0xffffff92
mov eax, dword [0xb593a594]
clc
rcl dword [edx + 0x425ce07d]
mov cl, 0xc1
mov bl, 0x94
adc bl, bl
mov byte [0xed128760], al
cmp eax, 0xb88b29f2
arpl word [esi - 0x26410e58], dx
mov esi, 0x6954c58
cmp byte [esi + 0x30], 0x85
invalid
mov word [eax], gs
mov dword [0xd3e394f3], eax
in eax, dx
out 0x89, al
or eax, dword [ebp - 0x7d138ddd]
fld qword [ebp + 0x48593921]
pop edi
and ah, byte fs:[edx + 0x17]
in al, dx
cld
pop ds
cmp al, 0x2c
popfd
xor dword [ebp + edx*8 - 0xf04ad0d], edx
xchg edx, eax
or dword [esi + 0x6225b39c], edx
clc
mov al, 0xd0
dec edx
insd dword es:[edi], dx
jp 0x5d9471
mov dl, 0x63
push edx
jne 0x5d939e
mov ebx, edx
mov eax, 0x40d0ac21
outsd dx, dword [esi]
rcl dh, 4
mov esi, 0x832acf2
jns 0x5d93dd
jge 0x5d942f
les esi, [eax]
stosb byte es:[edi], al
aad 0x30
js 0x5d9496
add eax, dword [0xfddc9d9a]
and ebp, ebp
mov edi, 0x915d0d46
or al, byte [esi + 0x4c1302dd]
push ds
and eax, dword [edx + edx*8]
xor byte [edi], cl
xor eax, 0x4eaff0c6
ja 0x5d94a0
test byte [ecx*4 - 0x3d625e84], dl
in eax, dx
daa
pop ebx
mov byte [0x7322e10c], bh
clc
popfd
mov word [ecx + 0x33ee682], sp
les ebx, [0xb11d3341]
das
arpl word [edx], si
and ebp, dword [esi - 0x3d]
mov ebx, 0x55c2eb28
cmp byte [ecx + 0x32], bh
fisubr dword [ebx + 0x6fdab367]
inc eax
wait
mov byte [ebp + 0x4f], 0x64
outsb dx, byte [esi]
ret

Function at 0x5d94cc
Capabilities:
Encode data using xor

Disassembly:
popfd
inc ebp
dec ebx
pop edx
ret 0xc4d
or eax, 0x2278f8f0
push ss
rol byte [edx], cl
in al, dx
stc
loop 0x5d9466
xchg ebx, eax
cld
inc esp
mov esp, dword [edx + 0x6c]
xchg ecx, eax
mov dh, 0xaf
sar byte [ebx], cl
mov al, 0x4c
xchg byte [ebx - 0x3e], ah
retf
inc edx
or eax, 0x923d1c2b
and byte [ebx], ch
ljmp 0xc0ef
das
jp 0x5d9514
sahf
scasd eax, dword es:[edi]
jle 0x5d9478
in eax, dx
loopne 0x5d94b7
dec edx
jge 0x5d94e2
xor cl, byte [0x2d62eeaf]
mov dword [0xb2d7a26c], eax
lodsb al, byte [esi]
xlatb
mov dl, 0xac
lcall 0xd415, 0xa35ed4de
test eax, 0xc0156e24
dec edi
dec esi
xor dh, byte [edi + 0x7d]
ret
dec ebx
call [ebp + 0x76b805ae]
inc ecx
cmp eax, 0x540da366
add al, 0xc7
dec ebp
mov byte [edi + 0x5d447be3], cl
jnp 0x5d955a
pop ebp
test ch, al
xor al, byte [ecx]
scasd eax, dword es:[edi]
mov bl, bh
sub eax, 0x5ef11621
out 0xe5, al
sar byte [edx - 0x62cd11fe], cl
loopne 0x5d9501
stosb byte es:[edi], al
dec eax
fisub word [ecx]
push eax
sbb byte [edx + 0x22300285], dl
and dword [eax + 0x18], edx
xchg edx, eax
test dword [edx], eax
xor byte [edx], ah
outsb dx, byte [esi]
and edi, ebp
and al, 0x6b
fiadd dword [ecx + 0x32623d1d]
add al, 0x4a
dec ebx
fnsave dword [ecx - 0x73]
mov ah, byte [ebx - 0x43]
jmp 0x5d955c
Function at 0x5db35c
Capabilities:
Encode data using xor

Disassembly:
and al, 0x13
sub eax, 0x2f33a761
add esp, dword [ecx]
sar dword [ecx], cl
lahf
lodsb al, byte [esi]
adc byte [ebp + 0x40], al
lea eax, [edx - 0x61e79634]
dec edi
pop eax
pop esi
das
sub byte [edi], cl
add eax, 0x472d0694
inc edx
aas
sti
syscall
xchg esp, eax
push es
sub eax, 0xfb3f4247
imul esi, dword [edx + 0x5af14676], 0xd0555327
mov bh, 0xa7
dec ebp
lea eax, [ebx + 0x735cfbdf]
mov dword [0x818b7851], eax
rcr ebp, 1
xor ch, byte [edx + ecx*4 + 0x45bd6a29]
test eax, 0x12ad4b93
jl 0x5db378
xchg esp, eax
lahf
ret 0x60a2

Function at 0x5fb6b0
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx + 0x7b]
sar byte [esi], 1
outsd dx, dword [esi]
jp 0x5fb6d5
out dx, eax
and ah, bl
sub dh, byte [edx - 0x6a2d828e]
popfd
push es
in al, dx
xchg ebx, eax
jo 0x5fb70b
dec edx
push ds
mov ebp, edx
aam 0xc6
out dx, eax
dec esp
inc edi
das
or esi, 0xffffff9d
aad 0xd4
invalid
popfd
sub eax, 0xed528c81
pushfd
scasd eax, dword es:[edi]
push edx
cmp al, 0xde
xor ebx, dword [0xfdd880b2]
push edx
les ebx, [ecx - 0x7eb3cd]
push ds
and esi, edi
push ds
jle 0x5fb6cb
push edi
and dword [edx - 0x20139193], ebp
outsd dx, dword [esi]
leave
arpl word [ecx + ebx*8], ax
adc al, 0xc9
cmc
xor cl, byte [esp + ebp*8 - 0x701d5e51]
ja 0x5fb762
aad 0xff
insd dword es:[edi], dx
cwde
invalid