joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c04f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x432ca8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c08f
cmp byte [ebx], 0xa
jne 0x41c08f
or byte [eax + edi + 0x28], 4
jmp 0x41c094
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41c192
mov al, byte [edx]
cmp al, 0x1a
je 0x41c174
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41c0c3
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41c0e8
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41c0f2
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41c0a5
jmp 0x41c192
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c16f
cmp dword [ebp - 0xc], 0
je 0x41c16f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x432ca8]
test byte [eax + edi + 0x28], 0x48
je 0x41c149
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41c134
mov byte [esi], dl
jmp 0x41c145
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x432ca8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41c192
cmp byte [ebp - 1], 0xa
jne 0x41c158
cmp esi, ebx
jne 0x41c158
mov byte [esi], 0xa
jmp 0x41c191
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041cbcf
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41c192
mov byte [esi], 0xd
jmp 0x41c191
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x432ca8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41c18e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41c192
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41c19b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x432ca8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c1de
cmp word [esi], dx
jne 0x41c1de
or byte [edi + eax + 0x28], 4
jmp 0x41c1e3
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41c336
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41c316
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41c225
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41c25b
cmp eax, edx
jae 0x41c267
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41c1fd
jmp 0x41c336
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c312
cmp dword [ebp - 0x14], 0
je 0x41c312
mov eax, dword [ebx*4 + 0x432ca8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41c2ea
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41c2b3
mov word [esi], cx
jmp 0x41c2e6
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x432ca8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x432ca8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x432ca8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41c336
pop ebx
cmp word [ebp - 4], bx
jne 0x41c2fb
cmp esi, dword [ebp + 0xc]
jne 0x41c2fb
mov word [esi], bx
jmp 0x41c333
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041cbcf
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41c336
push 0xd
jmp 0x41c32f
mov ecx, dword [ebx*4 + 0x432ca8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41c32d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41c336
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41d6ca
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x431040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x41d715
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0041d869
test al, al
jne 0x41d70f
sub edx, 2
cmp edx, edi
jne 0x41d6f5
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x41d737
lea eax, [edi + 2]
cmp edx, eax
je 0x41d737
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0041d616
add esp, 0x10
jmp 0x41d831
push esi
lea ecx, [ebp - 0x255]
call fcn.0041d869
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41d77a
push dword [ebp - 0x25c]
jmp 0x41d727
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x41d7b7
cmp word [ebp - 0x226], 0
je 0x41d7d8
cmp word [ebp - 0x226], ax
jne 0x41d7b7
cmp word [ebp - 0x224], 0
je 0x41d7d8
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0041d616
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x41d824
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x41d791
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x41d80c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41d831
push 0x41d446
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00422e20
add esp, 0x10
jmp 0x41d801
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040943f
leave
ret

Function at 0x4249e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x424a0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x424a0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40fb04
Capabilities:
Encode data using xor

Disassembly:
dec ebp
pop es
mov edi, 0xdae72270
push ds
test byte [ecx - 0x5d], bl
mov eax, 0x2b798380
call [ebp + eax*4 + 0x264ea2ae]
rol byte [ecx + 5], cl
cld
mov ebx, 0xb163e132
arpl word [ecx - 0x2ca16adf], si
xchg ebx, eax
cmp bh, al
arpl word [ecx - 0x2ca16adf], si
xchg ebx, eax
cmp bh, al
pushfd
xor ch, byte [0x95822a8b]
xor al, ah
mov ebp, 0x12dbcd18
xor bh, al
movsd dword es:[edi], dword [esi]
jbe 0x40fae6
stosd dword es:[edi], eax
dec edx
invalid

Function at 0x4143a4
Capabilities:
Encode data using xor

Disassembly:
pop ebp
pop es
xor eax, 0x66d776e9
cdq
in al, dx
jbe 0x4143a3
sbb dl, dl
dec eax
aaa
adc dh, byte [ebx - 0x6504f5fd]
push esp
dec ebp
add ecx, dword [edx + 0x31]
ficom word gs:[ebx + 0x24d66ee6]
pushfd
salc
jle 0x414390
mov ch, 0x60
or al, byte [eax + 0x7b]
invalid

Function at 0x415080
Capabilities:
Encode data using xor

Disassembly:
aaa
xor byte [esi + 0x596dd0f7], bh
pop ecx
pop ecx
push ds
sub esp, dword [edi + 0x78]
dec esi
or eax, 0x21e56ad2
xlatb
cmp al, 0x3b
inc eax
das
dec edi
adc byte [edi], al
dec eax
loopne 0x41507a
mov ds, word [edi - 8]

Function at 0x415984
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [esi - 5]
mov cl, 0xc3
sar dword [edi], 0xca
popal
push 0x63bd0854
mov eax, dword [0xa029e0e4]
arpl word [ecx - 0x5fd61f1c], sp
pushfd
dec ebp
dec edi
add eax, 0x4e235c31
cmpsb byte [esi], byte es:[edi]
inc edi
jae 0x4158ff
int1
bound edi, qword [ecx - 0x7e7fdbe9]
wait
cdq
and eax, edx
wait
shr dword [eax + 0x1f], 1
push 0x38622a1f
cmp byte [edx - 0x31cf9512], bh
mov edx, 0xce306aee
xchg ebp, eax
loop 0x4159c9
jns 0x415962
mov word [esi], cs
or byte [edx + 0x43edb6c6], dl
aad 0x93
cli
cli
or al, 0xf7
js 0x415988
out 0x30, eax
jne 0x4159cc
mov word [edi - 0x7c3e8c15], fs
jl 0x4159d2
rol dword [ebx - 0x456cdc84], 0x38
xor ah, dh
nop
xchg ebx, eax
mov edx, 0x90f43038
add al, 0xd4
inc ebx
jg 0x4159ab
ror ebx, cl
pop ecx
ja 0x41595d
outsb dx, byte [esi]
push ds
and ebp, dword [edx + 0x69]
jge 0x4159ee
inc esi
shr dword [ebp + ebp*8 - 0x72], 0x68
cmp ebx, 0xd84fafe7
imul edi, ebp, 0xf43b628e
cld
mov word [ebx + 0x22], gs
mov dword [ebx - 0x15f5db99], edx
xchg edi, eax
mov dword [0x7f050b68], eax
jno 0x415a1b
insb byte es:[edi], dx
in eax, dx
mov gs, word [eax - 0x7f]
sti
out 0xaf, eax
push 0xafe7fb81
dec edi
fsubr dword [ecx - 3]
mov fs, word [edx + 0x3b]
hlt
or eax, dword [0xe72f717f]
push ebp
out 0xff, eax
cmc
jne 0x4159e7
int3
mov ebp, 0xdc82c3c1
adc byte [esi + edi*4 + 0x1b3afa0], 0x57
fcomi st(1)
mov dh, 0x8d
scasb al, byte es:[edi]
xchg esp, eax
and dword [ecx + 0x6604a754], ebp
retf

Function at 0x419e9c
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xc7a93884
mov ch, 7
sub byte [edx + 0x10], dl
bound esi, qword [edx]
test dword [ebx - 0x557bfd62], esi
push ebp
das
mov eax, 0xc970f59f
sar bh, 0x6a
push 0xe8380f68
mov bl, 0xbf
push cs
Function at 0x41a60c
Capabilities:
Encode data using xor

Disassembly:
cmc
mov ebx, 0x2be63da1
or ecx, eax
mov bh, 0xf0
push 0x25
sub ch, al
hlt
sti
loope 0x41a5b4
jns 0x41a61a
inc edx
mov ecx, 0x1399ff5b
bound edx, qword [ebx + 0x6089e248]
out dx, al
in eax, 0x80
xchg ebp, eax
sub byte [edx], 0xd3
and eax, 0x29ce7c58
lcall 0xc927, 0x9d72edfb
stosd dword es:[edi], eax
in al, 0x28
cmc
cmp byte [edx], ah
sub byte [edx], bh
and esi, dword [ecx]
adc al, byte [ecx]
add dword [ebp + ecx + 0x2d], ecx
xor bh, byte [eax]
and byte [edx + 2], 0xee
xor edx, ebp
pop ebx
push es
push ebp
jnp 0x41a637
int 0xbb
out dx, eax
out dx, eax
sbb ebx, dword [esi - 0x3f]
out 0xe, al
jp 0x41a5bc
inc edx
mov cl, byte [ebx]
dec esp
adc dl, dh
sbb edi, ecx
sti
or eax, 0x3594a041
pop ebx
stc
insd dword es:[edi], dx
jg 0x41a65b
inc ecx
wait
push eax
mov ch, 0xd2
mov esi, ebx
cmp cl, byte [esi + 2]
adc eax, 0x23e8fc8f
push esi
xchg ecx, eax
imul ecx, dword [esi + ebp - 0x2eefa57c], 0xc0b0fa0d
inc esp
xor bh, byte [ebx + 0x77]
cwde
in eax, 0xd7
xlatb
sbb al, 0xea
or byte [ebp + 0x62eaeef3], ch
and ebx, esi
inc ecx
bound eax, qword [esi + 0x4f]
adc dword [esi], edi
xlatb
xchg byte [ebx - 0x3de7fe7b], dl
loope 0x41a698
test byte [ebx], bh
out 0xd6, eax
shr byte [edi - 0x72], 0x17
ret 0xe31d
mov al, byte [0x47911f20]
inc esp
xchg esi, eax
js 0x41a65d
xchg esi, eax
inc ebx
out dx, al
or eax, 0x461956bf
mov ebp, 0x9c4dd9f1
aaa
invalid

Function at 0x41ebc8
Capabilities:
Encode data using xor

Disassembly:
lcall 0x7512, 0x48f4e9e
out 0xc2, eax
arpl bp, ax
sub byte [edi + 0x71d4e192], 0xec
dec ebp
rcr dword [ecx + 0x1c], 0xa9
push esi
and byte [eax - 0x47], dh
pop ds
pop ss
imul ebx, dword [edx - 0x70d48732], 0x4d6b60c7
pushal
imul ecx, dword [ebp - 0x7b], 0xffffffab
outsb dx, byte [esi]
mov ch, 0xfa
or byte cs:[ebx + ebx*4 + 0x155cbdd9], dl
invalid
test byte [eax - 5], al
inc ebp
sub ecx, dword ss:[edx - 4]
xor eax, dword [esi - 0x6b]
mov eax, dword [0x23fb1e6a]
js 0x41ebc7
or dl, ch
cmp byte [ebx + ecx*8 - 0x26], bh
div ecx
jns 0x41eb80
ret

Function at 0x41fb44
Capabilities:
Encode data using xor

Disassembly:
push ebx
cmp ah, byte [edx]
push es
push es
push es
adc al, 0x7c
pop ss
pcmpeqd mm0, qword [0x642e16b6]
sar edx, 1
daa
call ebx
sbb ecx, esp
popfd
and dword [edi + ecx*4 - 0x3f], ecx
mov ah, 0x3c
xor al, 0xa0
dec esi
out dx, eax
xchg ebx, eax
jg 0x41fb40
and al, 0xbb
pop eax

Function at 0x41fff0
Capabilities:
Encode data using xor

Disassembly:
inc eax
sub al, bh
movsb byte es:[edi], byte [esi]
or bh, bl
adc dword [edi + 0x7b54ae54], edi
or ebp, dword [ebx + 0x14b9da1c]
sub ecx, dword [edi]
mov al, byte [0xe4919436]
or al, 0x7b
in eax, dx
scasb al, byte es:[edi]
push esp
jnp 0x420008
stosd dword es:[edi], eax
sbb al, 0xda
mov ecx, 0xa00f2b14
xchg esp, eax
xchg ecx, eax
in al, 0xc
jnp 0x41fff9
or al, 0x6e
mov ecx, 0x622e166d
and edx, ebx
call 0x78e6698f
sbb byte [edi + 0x17], bl
add ah, byte [ebp + 0x4d488812]
mov esp, 0x12be288d
sbb eax, 0x49e72e23
xor eax, 0xf479e20b
mov al, 0x6f
jae 0x41fff9
ret 0x3115
Function at 0x420190
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x2406f5f6
xchg esp, eax
in eax, dx
rol byte [ecx], cl
fucomp st(2)
mov edx, 0x90589237
out dx, al
mov ebx, 0xd373127
aaa
or eax, 0x579ee45c
jo 0x42015d
invalid
invalid
invalid
invalid

Function at 0x422204
Capabilities:
Encode data using xor

Disassembly:
invalid
inc edi
jns 0x4221ad
wait
inc ecx
ficomp dword [ebx]
adc eax, 0x9d76c258
mov esp, ecx
sub dh, byte [ebp + 0x48]
lodsd eax, dword [esi]
pop ss
cmp al, 0x32
xor esp, dword [ebx - 0x529f0145]
pop ecx
outsd dx, dword [esi]
jns 0x42220d
ret 0x9d76
sahf

Function at 0x42307c
Capabilities:
Authenticate hmac

Disassembly:
imul ebp, dword [edi*2 - 0xb012ac5], 0x7d
push es
mov dh, 0xa
pop eax
ja 0x4230f9
mov bh, al
movsb byte es:[edi], byte [esi]
adc al, 0xc5
adc eax, 0x9111eedf
mov ebx, 0x6b5fe676
push 0xdd5c9db1
push 0x34
jg 0x42312a
adc bl, byte [eax - 0x60]
lodsd eax, dword [esi]
lodsb al, byte [esi]
jne 0x4230a1
cld
movsb byte es:[edi], byte [esi]
sub ebp, esi
sbb edx, esi
lds esi, [eax - 0x114c97dd]
sbb ebp, dword [ebp - 0x23d69569]
xor eax, 0x11fcd882
sub byte [eax + 0x617dce8c], dl
cmp al, al
aad 0x8c
jb 0x423152
and ecx, dword [edx]
inc ebx
xchg edi, eax
pushal
xor al, 0x9d
in al, 0x7d
cmp byte [ebx - 0x35d1a2a6], ch
mov edi, 0xf31743d8
stosd dword es:[edi], eax
adc al, 0x93
invalid
aas
mov bl, 0x1a
mov al, 0x66
or eax, 0xa510f222
lcall 0xc568, 0x87c6e32b
ja 0x4230a1
xchg ebp, eax
out 0x2c, al
pop eax
xlatb
mov ch, 0xd4
cmp dl, ch
push 0xffffffffffffffce
movsb byte es:[edi], byte [esi]
adc bh, bl
out dx, eax
aam 0xa9
aaa
jmp 0x4230b8
pop ebp
adc dh, 0
fild qword [ebx - 0x10]
call 0x4b30aa50
mov edi, 0xb9056dd1
sub al, 0x5c
sub eax, 0xd0d98404
mov dword [eax - 0x473b7f9], esi
adc dword [edx], ebx
stosb byte es:[edi], al
mov al, 0x47
lodsd eax, dword [esi]
invalid
mov eax, 0x1fad1580
mov bh, 6
lahf
sub ch, dh
jns 0x42310b
adc al, 0xbe
xchg ecx, eax
or eax, 0xe15cd447
not byte [esi + 0x18f88ca0]
jb 0x423190
sbb al, 0x18
retf
push esp
mov ch, byte [ecx + ebp*4]
stc
xchg edi, eax
sbb bl, byte [esi - 0x13]
in eax, dx
jb 0x4231b4
or ebx, dword [esi - 0x16de088d]
fdivr qword [edi]
push ebx
dec esi
lcall 0x97d0, 0x9f32ffd5
xchg edx, eax
pop esp
sti
in eax, 0x36
movsb byte es:[edi], byte [esi]
fisubr word [esi - 0xcdc9037]
mov eax, cs
xchg esi, eax
fdivr qword [esi + 0x36]
jle 0x4231ec
lodsd eax, dword [esi]
fstpnce st(0), st(0)
arpl word [eax], sp
in eax, 0x7f
loopne 0x42321c
cwde
xchg edx, eax
add eax, 0x248d5728
salc
stosb byte es:[edi], al
imul ecx, dword [ebx], 0x30
pop edx
push ds
fcomp qword [edx - 0x23]
jne 0x4231d4
out dx, al
fidiv word [ecx - 0x4e]
jno 0x423188
jno 0x4231f5
lcall 0xeabb, 0x9872c505
inc edi
xchg byte [edx - 0x22883832], ah
mov bh, 0x99
jl 0x42324a
pop ebp
dec ebp
inc edx
fsub qword [edx]
mov bl, 0x86
lodsd eax, dword [esi]
std
fist dword [edi + 0x47344b1d]
test dword [ecx], eax
out 0x55, al
invalid
in al, 0xdc
sub al, 0x64
invalid
xor al, 0x3f
lodsd eax, dword [esi]
pop ecx
daa
or al, 0x27
int3
outsd dx, dword [esi]
push ecx
or eax, 0x7428088f
jl 0x42320a
xchg ebx, eax
push edi
push ss
mov bl, 1
xor dword [edx], 0xffffff98
inc edi
jbe 0x423243
mov bh, 0xbe
push ss
invalid
Function at 0x42309c
Capabilities:
Authenticate hmac

Disassembly:
xchg ecx, eax
and dword [esp + ebp*2 - 0x19894477], edx
pop edi
imul ebp, dword [eax - 0x4f], 0xffffff9d
pop esp
invalid

Function at 0x423228
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
fimul word [eax*4 - 0x7e0e1e9d]
inc esp
outsd dx, dword [esi]
test byte [edi], cl
pop ebx
stosd dword es:[edi], eax
push 0xffffffffffffffdf
sub eax, 0x4a5015ed
in al, 0x86
xchg byte [edx + 0xd516ff5], bh
invalid

Function at 0x42572c
Capabilities:
Encode data using xor

Disassembly:
pushfd
push 0x24
sahf
mov ebp, 0xcbc1c016
mov cl, ah
dec edx
imul edx, dword [eax + 0x5c], 0x5fc1f4cc
mov ecx, 0x7b645fa2
mov byte [0x587b645f], al
int3
fist dword [ebx + 0x1cbf59ac]
sal dl, 1
dec esi
and al, 0xbc
shl dh, 0x58
popal
insd dword es:[edi], dx
push ebx
shl dword [ebp + 0x1e], 0x1d
mov ah, 0xd7
xor dh, ah
or eax, dword [esi - 0x1a39bbba]
lea ebx, [ecx]
aam 0x41
inc ecx
lcall 0x175, 0xade2dd65
xor ah, 0xb8
test al, 0x1b
pop edx
xor eax, 0xdca31fd7
mov al, 0xd5
and eax, 0x79d2ea57
sti
adc esp, esi
add byte [ecx], 0x80
xchg byte [ecx - 0x3eee2ee7], ah
jle 0x425753
push es
push 0x4a
movsd dword es:[edi], dword [esi]
imul edi, dword [eax - 0x12], 0x9e27efdf
add eax, 0xb27c114f
add ebx, dword [ebp + 0x2b370290]
xchg dword [ebp + edi*4 + 0x4f], ebp
jb 0x425727
inc esp
int3

Function at 0x42dd7c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
and byte [esi - 0x6df713ef], 0x25
mov dl, 0xd7
fsubr dword [ecx + 0x4c]
cmp byte [eax + esi*4], ch
xor eax, 0x877e3142
inc ecx
add ecx, eax
aas
mov dl, 0xfd
inc dl
pop ebp
push ebp
xchg edi, eax
sbb ebx, dword [eax + 0x65e9a3ef]
push es
push es
dec edi
out dx, al
pop ebp
pop esp
in eax, 0xa8
mov bl, 0x14
xor bh, byte [esi]
jne 0x42dda1
push edx
push edx
scasb al, byte es:[edi]
jbe 0x42ddae
pop edi
fbld tbyte [edx]
lock xor byte [edx - 0x51fafeda], 0x46
pop eax
out dx, al
fimul dword [eax + 0x644e9e2f]
dec ebx
loope sym.wIFR.exe__Ovccolor_TOvcColors_DefineProperties_qqrp14Classes_TFiler
sub al, 0xf4
retf

Function at 0x42ddd8
Capabilities:
Authenticate hmac

Disassembly:
popfd
lahf
out 0xe5, eax
mov word [eax], ds
dec ecx
test dword [esi], edx
fimul dword [ebx - 0x78]
add edi, dword [ebp - 0x448f0d86]
lodsd eax, dword [esi]
das
mov al, 0xd2
xor bh, byte [esi]
sar edi, 0x79
test byte [ebp - 7], dh
sbb al, 0x6a
invalid

Function at 0x42de18
Capabilities:
Authenticate hmac

Disassembly:
out 0x83, eax
or dword [esi - 0x18c8aaa], edi
xlatb
dec edi
pop es
test dword [edi + 0x11c81fd9], ebp
stosb byte es:[edi], al
sti

Function at 0x42de34
Capabilities:
Authenticate hmac

Disassembly:
inc esi
sbb bl, ah
call 0x107ae8a9
push ebx
rol dword [eax + 0x3d], 0x36
jns 0x42de78
inc eax
cmp eax, 0xb1357936
xor eax, 0xb5c973b1
xor dword [ebx], 0x6fde729e
wait
mov cl, 0x73
leave
mov ch, 0x81
xor ebx, dword [esi - 0x6490218e]
sbb byte [edi], 0xb0
xor al, 0xc0
je 0x42de8d
sbb eax, 0x8885bf4f
sar dword [edx], 0x52
sahf
adc ebp, ebx
rcl dword [esi + 0x4c], cl
invalid
Function at 0x42de44
Capabilities:
Authenticate hmac

Disassembly:
inc esi
sbb bl, ah
call 0x107ae8a9
push ebx
rol dword [eax + 0x3d], 0x36
jns 0x42de78
inc eax
cmp eax, 0xb1357936
xor eax, 0xb5c973b1
xor dword [ebx], 0x6fde729e
wait
mov cl, 0x73
leave
mov ch, 0x81
xor ebx, dword [esi - 0x6490218e]
sbb byte [edi], 0xb0
xor al, 0xc0
je 0x42de8d
sbb eax, 0x8885bf4f
sar dword [edx], 0x52
sahf
adc ebp, ebx
rcl dword [esi + 0x4c], cl
invalid

Function at 0x42deac
Capabilities:
Authenticate hmac

Disassembly:
insd dword es:[edi], dx
or bh, byte [eax]
adc byte [ebx - 0x3f], dl
cmp dword [edx], edi
inc edi
jecxz 0x42de38
inc ecx
fidiv word [ebp + 0x55c3c29c]
push esp
shr dword [eax], cl
lodsd eax, dword [esi]
xchg ebx, eax
invalid

Function at 0x42dedc
Capabilities:
Authenticate hmac

Disassembly:
pushal
mov byte [edi + 0x4a1234ad], bh
lodsd eax, dword [esi]
stc
or dl, al

Function at 0x42dee8
Capabilities:
Authenticate hmac

Disassembly:
cli
add cl, dl
invalid
and esp, edi
loopne 0x42de8d
or al, 0x44
sbb ebp, ebx
mov edx, 0xf41c34a4
aam 0x8e
inc edx
cli
int3

Function at 0x431f08
Capabilities:
Encode data using xor

Disassembly:
rol esp, 0x9f
mov es, word [eax + 0x3670aa00]
pop es
dec ebx
push esi
and al, 0x8d
movsd dword es:[edi], dword [esi]
aas
aas
outsd dx, dword es:[esi]
rol esi, 1
push esi
wait
xor dword [esi - 0xa14f54a], 0xffffffcc
wait
cld
ror byte [esp + edi*4 - 0x3d5a29f5], 1
jle 0x431f18
jmp 0x431ed8

Function at 0x432030
Capabilities:
Encode data using xor

Disassembly:
jno 0x43204a
sub edx, dword [edx + 0x1e46b65d]
xchg edx, eax
sub dword [edx + 0x405db60b], ecx
cmp al, 0x34

Function at 0x432210
Capabilities:
Encode data using xor

Disassembly:
call dword [edx + 0x612ec703]
jecxz 0x4321fd
mov dl, 0x5c
popal
push esp
inc esp
shr ebp, cl
salc
mov ch, byte [ebx - 0xc]
dec edx
mov esi, 0xd29c4b9a
sti
inc ebx
int 0x47
inc edi
ja 0x432226
imul edi, dword [esi], 0x38
cmp al, 0x23
pop ecx
std
mov bl, 0x30
mov dword [ebx - 0x35], ebp
sub eax, 0x83226a2d
out 0xd1, al
imul edx, ebx, 0x6c
ficom word [edi + 0x4a]
push edi
dec edx
dec esi
mov al, 0x4d
movsd dword es:[edi], dword [esi]
adc eax, 0xb5d963b8
imul edi, dword [ebp + esi - 1], 0xffffff8b
cmp al, 0x2d
js 0x432232
pushal
xor ch, al
cmc
cmp byte [ebp - 0x20], dl
call 0xe0985b20
invalid
rcr byte [eax - 0x6a], cl
aad 0x2e
jle 0x432224
xlatb
adc dl, ch
invalid

Function at 0x43452c
Capabilities:
Authenticate hmac

Disassembly:
sti
add eax, 0x420fa118
mov esi, 0x6a6f2ab0
pop ds
div dword [eax]
xchg byte [ecx], bh
inc edi
or cl, byte [eax]
invalid