joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b660
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x503f91
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x55c658]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor edi, edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], fcn.004e4902
mov dword [esi + 0x30], fcn.004e54b2
mov dword [esi + 0x34], fcn.004e4825
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
lea ebx, [esi + 0x40]
mov dword [esp + 0x1c], edi
push ebx
mov dword [esi], 0x542d60
call fcn.0043b7b0
lea ebp, [esi + 0x94]
push ebp
mov byte [esp + 0x20], 1
call fcn.0043b7b0
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], 0xa
mov dword [esi + 0xfc], fcn.004e4902
mov dword [esi + 0x100], fcn.004e54b2
mov dword [esi + 0x104], fcn.004e4825
mov dword [esi + 0x108], edi
lea eax, [edi + 1]
mov byte [esp + 0x1c], 3
call fcn.0044d0d0
lea eax, [edi + 1]
mov ebx, ebp
call fcn.0044d0d0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4

Function at 0x43b7b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x503883
mov eax, dword fs:[0]
push eax
mov eax, dword [0x55c658]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov edx, fcn.004e4825
mov dword [eax + 0x10], fcn.004e4902
mov dword [eax + 0x14], fcn.004e54b2
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], fcn.004e4902
mov dword [eax + 0x30], fcn.004e54b2
mov dword [eax + 0x34], edx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], fcn.004e4902
mov dword [eax + 0x4c], fcn.004e54b2
mov dword [eax + 0x50], edx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x440e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x508348
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x55c658]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4c]
xor ebx, ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], 0xff
mov byte [esp + 0x34], 1
mov byte [esp + 0x35], bl
mov eax, dword [esp + 0x48]
lea esi, [esp + 0xc]
mov dword [esp + 0x40], ebx
call fcn.00440f10
cmp byte [esp + 0x34], bl
jne 0x440eee
mov eax, dword [esp + 0x10]
push eax
call dword [0x513090]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x38
ret 0x14
Function at 0x45c230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50b193
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x55c658]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
mov dword [edi + 4], eax
xor eax, eax
mov byte [edi + 8], 0
mov byte [edi + 9], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov byte [edi + 0x21], 1
mov byte [edi + 0x20], 1
mov dword [esp + 0x1c], eax
lea ebx, [edi + 0x38]
mov ecx, ebx
mov dword [edi], 0x544730
mov dword [edi + 0x34], 1
call fcn.00415d50
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov byte [esp + 0x1c], 1
mov dword [edi + 0x164], eax
movzx eax, ax
push ebp
lea esi, [edi + 0x24]
push eax
mov dword [edi + 0x168], ecx
mov dword [edi + 0x16c], edx
call fcn.0043ed30
movzx ecx, word [esp + 0x34]
push ebp
lea esi, [edi + 0x28]
push ecx
call fcn.0043ed30
movzx edx, word [esp + 0x40]
push ebp
lea esi, [edi + 0x2c]
push edx
call fcn.0043ed30
add esp, 0x18
push 0x7f89
push 0
call dword [0x513468]
mov esi, dword [esp + 0x3c]
mov dword [edi + 0x30], eax
mov eax, esi
mov edx, ebx
call fcn.00415f10
mov eax, dword [esp + 0x44]
mov dword [edi + 0x160], eax
test esi, esi
je 0x45c337
mov ecx, dword [esp + 0x40]
push ecx
push 0xc
mov esi, 0x5437c4
call fcn.0045d9f0
add esp, 8
mov dword [edi + 0x15c], eax
jmp 0x45c341
mov dword [edi + 0x15c], 0
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x24

Function at 0x471700
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5043d2
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x55c658]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
push 1
mov eax, edi
call fcn.00405a40
lea esi, [edi + 0x58]
mov dword [esp + 0x14], 0
push esi
mov edx, 0x545944
mov dword [edi], 0x5459d0
call fcn.004059a0
mov dword [esi], 0x5459dc
lea eax, [edi + 0x20]
mov dword [esi + 0x28], eax
mov ecx, 0x53f258
mov byte [esi + 0x30], 0
mov dword [esi + 0x34], 0x5450a8
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x2c], 0x52ec0c
push eax
lea esi, [edi + 0x98]
mov byte [esp + 0x18], 1
call fcn.00471800
mov ecx, edi
mov byte [esp + 0x14], 2
call fcn.004717b0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x4816e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
mov eax, dword [0x55c658]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
push esi
push edi
mov esi, edx
push 0x1c
push esi
lea eax, [esp + 0x14]
mov edi, ecx
call fcn.00428090
add esp, 8
mov eax, 0x10
lea ecx, [esi + 0x1c]
lea edx, [esp + 0xc]
mov ebp, dword [edx]
cmp ebp, dword [ecx]
jne 0x481737
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x481710
cmp dword [esi], 1
je 0x48179a
mov ecx, ebx
call fcn.00414da0
push 0x546b68
jmp 0x481777
movzx ebp, byte [ecx]
movzx eax, byte [edx]
sub eax, ebp
jne 0x481763
movzx eax, byte [edx + 1]
movzx ebp, byte [ecx + 1]
sub eax, ebp
jne 0x481763
movzx eax, byte [edx + 2]
movzx ebp, byte [ecx + 2]
sub eax, ebp
jne 0x481763
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
je 0x481724
mov ecx, ebx
call fcn.00414da0
push 0x546b5c
push 0x53f504
mov edx, eax
call fcn.00416630
add esp, 8
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004e409a
add esp, 0x14
ret
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.004e409a
add esp, 0x14
ret
Function at 0x4944c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x509f08
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x55c658]
xor eax, esp
mov dword [esp + 0x14], eax
push ebp
push esi
push edi
mov eax, dword [0x55c658]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x54a75c]
mov esi, ecx
mov edi, edx
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x54a764
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.00494430
cmp eax, 0xffffffff
jne 0x494555
mov eax, dword [esp + 0x14]
test eax, eax
je 0x494545
push eax
call fcn.004e446a
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x513390]
or eax, 0xffffffff
jmp 0x4945c5
push edi
mov eax, esi
lea ecx, [esp + 0x14]
call fcn.00493e60
mov ebp, eax
cmp ebp, 1
jne 0x4945a7
push 0x64
call dword [0x51339c]
lea eax, [esp + 0x10]
call fcn.00494430
cmp eax, 0xffffffff
jne 0x49458c
lea esi, [esp + 0x10]
call fcn.00494490
or eax, 0xffffffff
jmp 0x4945c5
push edi
mov eax, esi
lea ecx, [esp + 0x14]
call fcn.00493e60
lea esi, [esp + 0x10]
mov edi, eax
call fcn.00494490
mov eax, edi
jmp 0x4945c5
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4945b8
push eax
call fcn.004e446a
add esp, 4
mov edx, dword [esp + 0x10]
push edx
call dword [0x513390]
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004e409a
add esp, 0x24
ret

Function at 0x498310
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5022e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x55c658]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.00422f20
mov dword [esp + 0x18], 0x513b5c
mov edi, dword [esp + 0x30]
push 0x5637e0
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00422f60
mov ebx, dword [esp + 0x34]
test al, al
je 0x4983bd
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.004979b0
test eax, eax
je 0x49839a
mov eax, dword [eax + 4]
test eax, eax
jne 0x4983a7
push ebx
push edi
mov ecx, esi
call fcn.00498000
test eax, eax
je 0x4983bd
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
push edi
mov ecx, eax
call fcn.00497310
test al, al
jne 0x4983fe
push ebx
push 0x513f48
push edi
call fcn.00414e50
add esp, 0xc
lea ecx, [esp + 0x18]
mov bl, al
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], 0x513b5c
call fcn.00422f40
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], 0x513b5c
call fcn.00422f40
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x498430
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5022e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x55c658]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.00422f20
mov dword [esp + 0x18], 0x513b5c
mov edi, dword [esp + 0x30]
push 0x5637e0
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00422f60
mov ebx, dword [esp + 0x34]
test al, al
je 0x4984dd
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.004979b0
test eax, eax
je 0x4984ba
mov eax, dword [eax + 4]
test eax, eax
jne 0x4984c7
push ebx
push edi
mov ecx, esi
call fcn.00498000
test eax, eax
je 0x4984dd
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
push edi
mov ecx, eax
call fcn.004975e0
test al, al
jne 0x49851e
push ebx
push 0x513f88
push edi
call fcn.00414e50
add esp, 0xc
lea ecx, [esp + 0x18]
mov bl, al
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], 0x513b5c
call fcn.00422f40
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], 0x513b5c
call fcn.00422f40
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10

Function at 0x49e7c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x503050
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x55c658]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.00422f20
mov dword [esp + 0x18], 0x514420
mov esi, dword [esp + 0x30]
push 0x563a18
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00422f60
test al, al
je 0x49e857
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.00422f20
mov dword [esp + 0x10], 0x514418
push 0x563c48
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00422f60
test al, al
jne 0x49e87f
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00422f40
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.00422f40
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
push 0
push esi
lea ecx, [edi + 0x144]
call fcn.0041c0a0
test al, al
je 0x49e849
push 0
push esi
lea ecx, [edi + 0x3fc]
call fcn.0041c0a0
test al, al
je 0x49e849
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
mov ecx, edi
call fcn.0049e1e0
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x28], 0
call fcn.00422f40
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.00422f40
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x49e900
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x503050
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x55c658]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.00422f20
mov dword [esp + 0x18], 0x514420
mov esi, dword [esp + 0x30]
push 0x563a18
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00422f60
test al, al
je 0x49e997
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.00422f20
mov dword [esp + 0x10], 0x514418
push 0x563c48
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00422f60
test al, al
jne 0x49e9bf
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00422f40
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.00422f40
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
push 0
push esi
lea ecx, [edi + 0x144]
call fcn.0041c0a0
test al, al
je 0x49e989
push 0
push esi
lea ecx, [edi + 0x3fc]
call fcn.0041c0a0
test al, al
je 0x49e989
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
mov ecx, edi
call fcn.0049e490
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x28], 0
call fcn.00422f40
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.00422f40
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x4a80b0
Capabilities:
Parse pe header

Disassembly:
push esi
aaa
dec ebx
push esi
xor dword [edi], 0x3703574c
Function at 0x4a9870
Capabilities:
Encode data using xor

Disassembly:
imul esi, dword [ebp + 0x4e], 0x6a4e7669
ja 0x4a98c8
imul edi, dword [eax + 0x4f], 0x6c

Function at 0x4e39d0
Capabilities:
Encode data using xor

Disassembly:
dec ecx
insb byte es:[edi], dx
ja 0x4e3a1d
imul esi, dword [edi + 0x48], 0x6b
jbe 0x4e3a22
push 0x76
test byte [0x5c81423d], ch
xchg ebp, eax
mov bh, 0x81
push ebx
adc byte [esp + eax*4 + 0x1353125], 0x25
xor dword [esi], esi
and eax, 0x26823632
xor dh, byte [esi]
add byte [esi], ah
add dword [0x32253631], esp
and byte ss:[esi], 0x32
add byte ss:[esi], ah
xor dh, byte [edi]
and byte [esi], 0x33
aaa
and dword [esi], 0x26013833
xor al, 0x38
daa
xor al, 0x38
and byte [edi], 0x34
cmp dword [ecx - 0x7cc6cad9], eax
daa
xor eax, 0x3627003a
cmp eax, dword [ebx - 0x7cc4c9d8]
sub byte [edi], dh
cmp al, 0x81
cmp eax, dword [ebx - 0x7ec3c8d8]
sub dword [eax], 0x28823d37
cmp byte [0x3e382800], bh
sub byte [edi], dh
cmp eax, 0x3d382882
add byte [eax], ch
cmp byte [esi], bh
sub dword [ecx], 0x29813e38
cmp dword [esi], edi
sub dword [ecx], 0x39
aas
add byte [ecx], ch
cmp bh, byte [edi]
sub dword [ecx], 0x3a
inc eax
add byte [ecx], ch
cmp al, byte [ecx - 0x7f]
sub dword [ebx], edi
inc ecx
sub dword [edx], 0x2a00413b
cmp eax, dword [edx - 0x7d]
sub bh, byte [edx + eax*2]
test byte [esi], ah
xor dword [0x3b352884], esi
sub dword [eax], 0x28825f4f
push eax
pushal
test byte [ebx], bh
ja 0x4e39ec
inc ebp
pop ebp
imul eax, dword [0x44695d44], 0x5c44695c
push 0x43685c43
pop ebx
push 0x82675b43
inc edx
pop edx
add byte [bx + di + 0x59], 0x66
add dword [eax + 0x58], 0x65
add dword [ebp + 0x60], 0x6044016e
outsb dx, byte [esi]
inc esp
pop edi
outsb dx, byte [esi]
add dword [edi + ebx*2 + 0x6d], 0x6d5e4300
add dword [ebx + 0x5e], 0x5d42006c
insb byte es:[edi], dx
add byte [edx + 0x5d], 0x6b
add dword [ecx + 0x5c], 0x5b41006a
push 0xffffffffffffff81
inc eax
pop ebx
imul eax, dword [ebx], 0x8122201a
sbb ah, byte [ecx]
and eax, dword [eax]

Function at 0x4e3b70
Capabilities:
Encode data using xor

Disassembly:
bound ebp, qword [edx - 0x549d7e0f]
int1
add byte [ebx - 0x55], ah
and dword [ebx - 0x54], 0xac6400f2
and byte [ebp + ebp*4 - 0xd], 0
jae 0x4e3b72
cmp byte [ebx + 0x73], ah
cmp dword [eax], 0x63
je 0x4e3afb
dec ecx
insb byte es:[edi], dx
ja 0x4e3b7e
dec ecx
imul esi, dword [edi - 0x7f], 0x48
ja 0x4e3b03
dec eax
Function at 0x4e409a
Capabilities:
Encode data using xor

Disassembly:
js 0x4e401d
dec ecx
imul esi, dword [edi - 0x7c], 0x2c
cmp al, 0x41
inc ecx
sbb dword [esp + edx*4 - 0x49], 0x94805381
and byte [eax + esi], 0x34
and byte [0x25833430], 0x31
xor eax, 0x36312501
and eax, 0x26813632
xor dh, byte [esi]
and dword [esi], 0x26823732
xor esi, dword [edi]
and dword [esi], 0x26813833
xor al, 0x38
and dword [edi], 0x34
cmp dword [eax], eax
daa
xor eax, 0x35278339
cmp al, byte [ebx + 0x13b3627]
sub byte [esi], dh
cmp ebp, dword [eax]
cmp al, 0x82
sub byte [edi], dh
cmp al, 0x81
sub byte [edi], dh
cmp eax, 0x3d382882
sub byte [eax], 0x38
add dword ds:[eax], ebp
cmp dword [esi], edi
sub dword [ecx], edi
sub dword ds:[ecx], 0x39
cmp dword [esi], edi
sub dword [ecx], 0x39
aas
test byte [ecx], ch
cmp al, byte [eax - 0x7c]
sub dword [ebx], edi
inc ecx
test byte [0x2784332f], ah
xor edi, dword [ecx]
sub dword [eax], 0x28825d4e
dec esi
pop esi
test byte [esi], bh
ja 0x4e40a2
inc edx
pop edx
add byte [edx + 0x59], al
add word [ecx + 0x59], 0x66
inc ecx
pop eax
add dword gs:[eax + 0x58], 0x58400065
cmp dword fs:[edi], 0x3f016457
push edi
arpl word [edi], di
push esi
arpl word [ecx + 0x63563e], ax
push ebp
bound eax, qword [ecx - 0x7e9daac3]
inc edx
pop esp
imul eax, dword [edx], 0x42
pop esp
push 0x3f
pop edx
imul edi, dword [ebx], 0x39826757
push ebp
add byte gs:[ecx], bh
push esp
cmp byte gs:[ecx], 0x54
add dword fs:[eax], edi
push esp
cmp byte fs:[ebx - 0x7d], dl
cmp byte [ebx + 0x63], dl
sub dword [edx], 0x30006e59
popal
je 0x4e40fe
push 0x7b
Function at 0x4e4475
Capabilities:
Encode data using xor

Disassembly:
and al, 0x30
xor al, 0x82
and eax, 0x25833430
xor dword [0x36312500], esi
and byte [0x26013632], 0x32
xor dh, byte es:[edi]
xor dh, byte [edi]
and byte [esi], 0x33
aaa
and byte [esi], 0x33
cmp byte [ecx + 0x383426], al
xor al, 0x39
and dword [edi], 0x27003934
daa
xor eax, 0x35278439
cmp al, byte [ebx + 0x3b3627]
daa
cmp al, 0x83
sub byte [edi], dh
cmp al, 0x81
sub byte [edi], dh
cmp eax, 0x3d382881
sub dword [eax], 0x38
add byte ds:[eax], ch
cmp dword [esi], edi
sub dword [eax], 0x29813f39
cmp dword [edi], edi
test byte [ecx], ch
cmp al, byte [eax]
sub dword [edx], edi
inc ecx
sub dword [ecx], 0x2484413b
test byte [esi + ebp], ah
xor al, byte [edi + 0x28813832]
dec ebp
pop esp
sub byte [eax], 0x4d
pop ebp
cmp dword [edi], 0x663c8277
ja 0x4e4404
inc ecx
pop eax
add al, 0x40
pop eax
inc eax
pop eax
inc eax
push edi
aas
push edi
aas
push edi
arpl word [ecx + 0x63563f], ax
push esi
arpl word [ecx + 0x162553e], ax
cmp eax, 0x553d6255
popal
cmp dword [0x3c816154], 0x41816154
pop ebx
bound edi, qword [0x3d816155]
push esp
popal
cmp dword [esp + edx*2], 0x5b418161
imul eax, dword [eax + eax*2], 0x593e695a
cmp dl, byte [di + 0x65]
cmp byte [esp + 0x38], dl
push esp
cmp byte fs:[ebx + 0x64], dl
cmp dword [eax], 0x53
arpl word [ecx + 0x625338], ax
cmp byte [edx + 0x62], dl
xor dword [edi], 0x52
bound eax, qword [ecx + 0x6d5829]
sub al, 0x5c
outsb dx, byte [esi]
xor dword [eax], 0x827160
add byte [eax], al
cmp dword [ecx], 0x39015951
push eax
pop ecx
cmp byte [eax + 0x59], dl
cmp dword [eax], 0x50
pop eax
add byte [eax], bh
dec edi
pop eax
cmp byte [eax], 0x4f
push edi
cmp dword [eax], 0x38005d50
dec edi
pop ebp
xor dword [edi], 0x50815d4f
jns 0x4e44a5
add byte [eax + 0x66], cl
js 0x4e4492
inc edx
pop eax
popal
add al, 0
add byte [eax], al
aaa
dec esi
pop eax
pop esp
jo 0x4e456d
sub byte [ebx + ebx*2 + 0x5f81df9e], 0xa7
in eax, dx
add byte [eax - 0x59], ah
out dx, al
and dword [eax - 0x58], 0xa86100ee
out dx, eax
and dword [ecx - 0x57], 0xa96207ef
out dx, eax
popal
test eax, 0xeea860ef
pop esi
cmpsb byte [esi], byte es:[edi]
in eax, dx
pop esi
cmpsb byte [esi], byte es:[edi]
in al, dx
inc esi
push 0xffffffffffffff82
inc esi
push 0xffffffffffffff83
pop esi
lcall 0x83f6, 0xb26b84d0
imul esi, dword [ebx - 0x4c937b0a], 0xfffffff6
add byte [edx + esi*4 - 0xa], ch
xchg ecx, eax
add byte [eax], al
add byte [ecx - 0x7d8a96bb], al
inc ebp
push 0x221a8275
sbb byte [edx], 0x22
and al, 0x81
sbb ah, byte [edx]
and eax, 0xb6905a81
add byte [ecx - 0x71], bl
mov dh, 0x81
pop ecx
invalid
Function at 0x4e44c0
Capabilities:
Encode data using xor

Disassembly:
and al, 0x30
xor al, 0x82
and eax, 0x25833430
xor dword [0x36312500], esi
and byte [0x26013632], 0x32
xor dh, byte es:[edi]
xor dh, byte [edi]
and byte [esi], 0x33
aaa
and byte [esi], 0x33
cmp byte [ecx + 0x383426], al
xor al, 0x39
and dword [edi], 0x27003934
daa
xor eax, 0x35278439
cmp al, byte [ebx + 0x3b3627]
daa
cmp al, 0x83
sub byte [edi], dh
cmp al, 0x81
sub byte [edi], dh
cmp eax, 0x3d382881
sub dword [eax], 0x38
add byte ds:[eax], ch
cmp dword [esi], edi
sub dword [eax], 0x29813f39
cmp dword [edi], edi
test byte [ecx], ch
cmp al, byte [eax]
sub dword [edx], edi
inc ecx
sub dword [ecx], 0x2484413b
test byte [esi + ebp], ah
xor al, byte [edi + 0x28813832]
dec ebp
pop esp
sub byte [eax], 0x4d
pop ebp
cmp dword [edi], 0x663c8277
ja 0x4e4404
inc ecx
pop eax
add al, 0x40
pop eax
inc eax
pop eax
inc eax
push edi
aas
push edi
aas
push edi
arpl word [ecx + 0x63563f], ax
push esi
arpl word [ecx + 0x162553e], ax
cmp eax, 0x553d6255
popal
cmp dword [0x3c816154], 0x41816154
pop ebx
bound edi, qword [0x3d816155]
push esp
popal
cmp dword [esp + edx*2], 0x5b418161
imul eax, dword [eax + eax*2], 0x593e695a
cmp dl, byte [di + 0x65]
cmp byte [esp + 0x38], dl
push esp
cmp byte fs:[ebx + 0x64], dl
cmp dword [eax], 0x53
arpl word [ecx + 0x625338], ax
cmp byte [edx + 0x62], dl
xor dword [edi], 0x52
bound eax, qword [ecx + 0x6d5829]
sub al, 0x5c
outsb dx, byte [esi]
xor dword [eax], 0x827160
add byte [eax], al
cmp dword [ecx], 0x39015951
push eax
pop ecx
cmp byte [eax + 0x59], dl
cmp dword [eax], 0x50
pop eax
add byte [eax], bh
dec edi
pop eax
cmp byte [eax], 0x4f
push edi
cmp dword [eax], 0x38005d50
dec edi
pop ebp
xor dword [edi], 0x50815d4f
jns 0x4e44a5
add byte [eax + 0x66], cl
js 0x4e4492
inc edx
pop eax
popal
add al, 0
add byte [eax], al
aaa
dec esi
pop eax
pop esp
jo 0x4e456d
sub byte [ebx + ebx*2 + 0x5f81df9e], 0xa7
in eax, dx
add byte [eax - 0x59], ah
out dx, al
and dword [eax - 0x58], 0xa86100ee
out dx, eax
and dword [ecx - 0x57], 0xa96207ef
out dx, eax
popal
test eax, 0xeea860ef
pop esi
cmpsb byte [esi], byte es:[edi]
in eax, dx
pop esi
cmpsb byte [esi], byte es:[edi]
in al, dx
inc esi
push 0xffffffffffffff82
inc esi
push 0xffffffffffffff83
pop esi
lcall 0x83f6, 0xb26b84d0
imul esi, dword [ebx - 0x4c937b0a], 0xfffffff6
add byte [edx + esi*4 - 0xa], ch
xchg ecx, eax
add byte [eax], al
add byte [ecx - 0x7d8a96bb], al
inc ebp
push 0x221a8275
sbb byte [edx], 0x22
and al, 0x81
sbb ah, byte [edx]
and eax, 0xb6905a81
add byte [ecx - 0x71], bl
mov dh, 0x81
pop ecx
invalid