joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7d18
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4a7d2a
add esp, 0xfffffff0
call fcn.004053a4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00446370
mov eax, dword [0x4b5eec]
mov dword [eax + 4], ebx
mov dword [eax], 0x4a8154
mov eax, dword [0x4b5ef8]
mov dword [eax + 4], ebx
mov dword [eax], 0x4a8160
mov eax, ebx
call fcn.004a816c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x42ec54]
call fcn.00404e5c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x42ec54]
call fcn.00404e5c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x42ec54]
call fcn.00404e5c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x42ec54]
call fcn.00404e5c
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x42ec54]
call fcn.00404e5c
mov dword [ebx + 0x78], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x44], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x5c]
push eax
mov eax, 0x4a2b90
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x44d3d4]
call fcn.00452668
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x44d3d4]
call fcn.00452668
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x44d3d4]
call fcn.00452668
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x44d3d4]
call fcn.00452668
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x44d3d4]
call fcn.00452668
mov dword [ebx + 0x8c], eax
mov eax, ebx
call fcn.004a86c4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4a8534
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4a8534
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4a8534
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4a8534
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4a8534
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4a7ea1
call fcn.004053fc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a82d4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a847f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4a8460
mov dl, 1
mov eax, dword [0x431430]
call fcn.0043dae0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
call fcn.004068e0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4a844f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0047af30
test al, al
je 0x4a8442
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4a8490
lea eax, [ebp - 0x394]
call fcn.0041bcb8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a8442
xor eax, eax
push ebp
push 0x4a843b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4a8500
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a8424
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.004072b0
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4a8424
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.004072b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8442
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4a8345
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.0043da1c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8486
lea eax, [ebp - 0x3a0]
call fcn.004068e0
ret

Function at 0x4a8fdc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4bc250]
cmp byte [eax + 0xad], 0
jne 0x4a904e
cmp dword [0x4bc268], 0
jne 0x4a900e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4b5dcc]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4bc268], eax
cmp dword [0x4bc264], 0
jne 0x4a9029
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4bc264], eax
cmp dword [0x4bc26c], 0
jne 0x4a904e
push esp
push 0
push 0
mov eax, dword [0x4b5dc8]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4bc26c], eax
pop edx
ret
Function at 0x4a9364
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4a937b
add esp, 0xfffffff0
call fcn.004053a4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00446370
mov eax, dword [0x4b5e30]
cmp byte [eax], 0
jne 0x4a93a8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4b6064]
cmp word [eax + 2], 0
jne 0x4a93c2
mov eax, dword [0x4b6064]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004ab42c
mov eax, dword [0x4b6134]
cmp word [eax + 2], 0
jne 0x4a93dc
mov eax, dword [0x4b6134]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004ab630
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44d3d4]
call fcn.00452668
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4abba8
mov dl, 1
mov eax, dword [0x42ec54]
call fcn.00404e5c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x42ec54]
call fcn.00404e5c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x450ccc]
call fcn.004594b0
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4a95bc
mov eax, dword [0x4b5f64]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00459944
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4abe90
mov dl, 1
mov eax, dword [0x42ec54]
call fcn.00404e5c
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4b5f64]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0041bae0
test eax, eax
je 0x4a94ed
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0041b894
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0041bac4
test eax, eax
je 0x4a9505
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.004072b0
push ebx
push 0x4aae18
call fcn.0049f174
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4b5e30]
cmp byte [eax], 0
jne 0x4a9556
mov eax, ebx
call fcn.004a9730
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004ac0bc
mov eax, ebx
call fcn.004accec
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4a95b3
call fcn.004053fc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a99fc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4a9a9e
cmp dword [ebx + 0x94], 0
jne 0x4a9a98
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4a9948
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4a9a98
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4a9a5e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4a9a98
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00439fc0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4a9a6d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4a9cbc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4bc250]
cmp dword [eax + 0x170], 0
je 0x4a9e21
test bl, bl
jne 0x4a9d6f
cmp dword [esi + 0x9c], 0
jne 0x4a9d64
mov eax, esi
call fcn.004acb3c
push eax
push 0x4a9bc8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4a9d35
mov eax, dword [0x4bc250]
cmp byte [eax + 0xd3], 0
je 0x4a9d35
mov eax, dword [esi + 0xd8]
call fcn.00408190
mov edi, eax
cmp edi, 0
jl 0x4a9d35
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a9d1e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a9d64
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00439fc0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a9d44
inc dword [esi + 0x9c]
jmp 0x4a9e21
cmp dword [esi + 0x9c], 0
jle 0x4a9e21
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4a9e21
cmp dword [esi + 0x44], 0
je 0x4a9dcc
mov eax, dword [0x4bc250]
cmp byte [eax + 0xd3], 0
je 0x4a9dcc
mov eax, dword [esi + 0xd8]
call fcn.00408190
mov edi, eax
cmp edi, 0
jl 0x4a9dcc
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a9db5
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a9dfb
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00439fc0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a9ddb
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x49d04c]
call fcn.00408350
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4aaa64
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4aaacf
cmp byte [ebx + 0xd3], 0
jne 0x4aaacf
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406a48
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4aaabc
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4aaadc
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406ca0
jmp 0x4aaadc
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406ca0
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4ac2a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4ac312
mov eax, esi
call fcn.004750c4
test al, al
je 0x4ac312
mov eax, dword [ebx + 0x84]
call fcn.00474d44
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4ac312
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4ac306
push 0
mov eax, dword [ebx + 0x84]
call fcn.00474d44
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0046bd78
jmp 0x4ac312
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004ac0dc
pop esi
pop ebx
ret

Function at 0x4ad690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ad767
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x3a4], 0
jne 0x4ad74c
lea eax, [ebx + 0x3a5]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404870
mov dword [ebx + 0x3a5], 0x3c
mov dword [ebx + 0x3a9], 0x40
mov eax, dword [0x4b6110]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
mov dword [ebx + 0x3ad], eax
mov eax, 0x4ad774
mov dword [ebx + 0x3b5], eax
mov eax, 0x4ad780
mov dword [ebx + 0x3b9], eax
lea edx, [ebp - 8]
mov eax, dword [0x4b6110]
mov eax, dword [eax]
call fcn.004abb20
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0041b694
mov eax, dword [ebp - 4]
call fcn.00407224
mov dword [ebx + 0x3bd], eax
xor eax, eax
mov dword [ebx + 0x3c1], eax
lea eax, [ebx + 0x3a5]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebx + 0x3a4], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad76e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406940
ret
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x31a32062
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x3be07951
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40c4d2
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
pop es
xchg dword [esi], esp
fisttp dword [ebp - 0x50e8a6d0]
ja 0x40c4f0
or eax, 0x82287e2e
mov ah, 0x20
add al, 0xef
lahf
arpl dx, bx
mov bh, 0x91
jecxz 0x40c4c0
mov eax, dword [0x4f50c396]
cmp dword [ebx - 0x5c], esi
sbb eax, 0x2a7760db
leave
jb 0x40c4e9
add dl, cl
jecxz 0x40c4a6
dec eax
mov al, 0xc7
xchg ebx, eax
sal edx, 0x1a
cld
xchg edi, eax
aam 0xed
popfd
loope 0x40c46a
xor dword [ebp + 0x44e02d75], 0x2f3ba427
sub byte [edi], al
wait
xlatb
or byte [eax], bl
mov eax, 0x67929488
lahf
sti
scasb al, byte es:[edi]
add byte [ecx - 0x63], 0x23
xchg edx, eax
xor byte [ebp + 0x25a98cd2], 0x66
xor dl, byte [ecx + esi - 0x24]
ror byte [ecx + 1], 0xc1
dec ecx
add ecx, eax
mov ah, 0x63
push ss
cmp ebp, ebp
loop 0x40c54e
not dword [edx + 0x5b6f7d0]
mov dh, 5
cmp eax, 0x4ae5d8dd
and al, dh
or esi, dword [ebx]
not cl
dec ebp
mov ah, 0x7f
xor byte [eax], dl
push esp
aas
and dh, byte [edi]
jg 0x40c522
adc byte [edi + edi + 0x22], dl
aaa
push esp
adc ebp, esp
sal dword [ebp + esi*8 + 0x4484c69f], 1
fdiv st(0)
call 0x847ef5de
mov eax, dword [0xce589393]
xor al, byte [edx + 0x1e]
add ch, byte fs:[ecx + 0x2b]
xor al, 0x15
cmpsd dword [esi], dword es:[edi]
popfd
test byte [ebp + esi*8 - 0xf], 0xb2
je 0x40c53f
adc eax, 0x44f69da7
cmc
int1
mov dl, 0x74
and byte [ebp - 0x485e2b2b], bl
retf
popfd
aad 0xd4
mov eax, dword [0xa7a2cbb7]
nop
ret 0x7981
rcl esi, 0x58
salc
pop eax
daa
sbb al, 3
lodsb al, byte [esi]
push cs
rcl ch, 0
scasd eax, dword es:[edi]
jp 0x40c540
jo 0x40c515
invalid
push ecx
push ebx
pop eax
push ss
push esp
insb byte es:[edi], dx
aam 0x87
pushal
loop 0x40c5ab
jecxz 0x40c4e0
xchg ebp, ebx
mov ebp, 0xa2848810
in eax, 0xca
adc byte [eax + 0x73344372], 0xa3
inc ebx
adc byte [ecx + 0x25], ah
nop
jb 0x40c5ae
xor al, 0x73
mov dword [0x25611043], eax
jge 0x40c568
invalid
mov byte [0x75852245], al
movsd dword es:[edi], dword [esi]
test dword [ebp - 0x5b], esi
movsb byte es:[edi], byte [esi]
pop esi
outsb dx, byte [esi]
jb 0x40c5cb
and eax, 0xf407c772
dec esi
lodsd eax, dword [esi]
xchg ebp, eax
invalid
retf 0x48c0
Function at 0x40fdd0
Capabilities:
Encode data using xor

Disassembly:
sahf
inc esp
cmp byte [edi], bh
add bh, byte [ecx]
pop esp
sbb ch, byte [edx - 0x38]
in al, 0xad
xchg esi, eax
mov bh, 0x46
sbb ebx, dword [edi + 0x61147b84]
rcr dword [ecx], 0xf9
and dl, 0xec
add cl, al
inc eax
jae 0x40fe4d
and al, 0x19
xchg ebx, eax
jne 0x40fe36
add eax, 0xacc784aa
cmpsb byte [esi], byte es:[edi]
popfd
not dword [edx + 0xcc64464]
movsb byte es:[edi], byte [esi]
loope 0x40fe20
cmc
dec esi
push 0x2a6794df
xchg ecx, eax
inc eax
mov dh, 0x9b
sbb al, 0xc7
pop ss
cli
rol dword [eax], 0xd9
lodsd eax, dword [esi]
aad 0x44
into
cli
invalid
invalid
stosd dword es:[edi], eax
xchg esp, eax
and eax, 0xeca969d2
add eax, 0xb72046e5
adc dword [edi], esi
rol byte [ebx + 1], 1
loop 0x40fe55
fnstcw word [eax - 0x7543c500]
push ss
and ebx, esi
add byte [ebx], bh
mov esp, 0xf321168a
sub dh, byte [edi - 0x7f]
mov bh, 0xfc
or al, 0xf2
mov edx, 0xb4ab7aee
jne 0x40fe11
push es
arpl word [eax - 0x6b], sp
pushal
xchg ebp, eax
leave
mov ebp, 0x38beda0f
je 0x40fe9e
pop ebp
invalid
les edi, [ebx + edi*8 - 0x6a]
aad 6
fld qword [ebp - 0x75]
out 0x6e, al
and al, 0xb1
outsd dx, dword [esi]
and dword [edx], ebx
invalid

Function at 0x42c8e6
Capabilities:
Encode data using xor

Disassembly:
push esp
inc esi
push ecx
dec ebx
out 7, al
pop es
div edx
aaa
in eax, dx
scasd eax, dword es:[edi]
xchg ebx, eax
jbe 0x42c85d
xlatb
mov esp, ebx
pop edx
mov byte [ebx + ecx*2], bl
stosd dword es:[edi], eax
dec esp
in al, dx
inc edi
mov fs, word [ebx]
mov edx, 0x1d37ca20
invalid
aaa
sbb eax, 0x896b25c7
push ss
das
aad 0xe
cmp byte [0xf3b0c4e0], al
inc esi
add ch, byte [ecx - 0x10]
ja 0x42c8cb
pop ebp
clc
aaa
test al, 0x4a
fimul dword [edi]
inc esp
push si
adc byte [ebx + 0x2b], 0x55
cmp edi, ecx
and byte [esi + 0x462f8649], 0x18
xor dword [edx - 0x28], edi
salc
pushfd
mov cl, 0x16
test al, 0xfb
xchg edi, eax
adc al, ch
sub byte [edx + 0x7c], dh
jb 0x42c858
or eax, ebp
adc dh, byte [esi - 0x17adfeed]
dec esp
wait
jb 0x42c910
lcall 0x3f16, 0x8ba484f5
std
ja 0x42c939
dec ebx
cmc
and eax, 0x6bd48e6
inc edx
je 0x42c856
mov ah, 0x61
cmpsd dword [esi], dword es:[edi]
invalid
sti
xor byte [esi], ah
insd dword es:[edi], dx
push ss
jo 0x42c876
jno 0x42c903
push edx
mov ebx, 0x900c4864
push esi
sti
dec dword [ecx - 0x44598228]
shl dword [edx - 0x7b], cl
and dl, byte [eax + 0x5cb2a232]
push eax
xor byte [eax], dl
mov ebp, 0xaebc781d
nop
xor ah, byte [edx + 0x30505cb2]
adc byte [ebp - 0x514387e3], bh
add si, word [ebx]
cmp edi, dword [ebx]
add eax, 0x84665f7f
loop 0x42c8ad
inc esi
and byte [ebp + 0x5c], ch
pop edi
iretd
adc eax, 0x9b179164
out 0x9d, al
xchg ecx, eax
loope 0x42c8c9
xchg esi, eax
jne 0x42c9a6
mov ch, al
invalid
sbb ch, byte es:[edx + 0x26d56546]
mov eax, dword [0xf417f933]
dec ebx
invalid
Function at 0x45e69a
Capabilities:
Encode data using xor

Disassembly:
and cl, ch
pop esp
movsb byte es:[edi], byte [esi]
sbb eax, 0xf964cf8a
cmp al, 0xc5
add byte [ebx + 0x1fc461f6], 0x95
sub al, dl
adc byte [edx], ch
pop esp
cmp dword [eax + 0x12248fd6], eax
imul esp, esi, 0xffffffb9
das
xor ch, byte [esi]
test eax, 0xf51f7a07
pop dword [ebp - 0x2b814a8d]
popal
les ecx, [ecx + edx - 0x6d]
cmp byte [eax + 0x65], bl
jno 0x45e6ac
dec esp
adc edx, eax
lock adc ebx, dword [ebx - 0x4ad845f1]
aas
pop esp
shl byte [edi - 0x5c91176d], 0x1e
dec ebx
lahf
sub cl, ah
adc eax, 0x5d228857
cmp eax, 0x763b50e2
fisttp dword [esi - 0x4b]
and byte [ecx], bl
in eax, dx
xor eax, 0x9a4e8a15
shr byte [edi + edi - 0x6f], cl
mov al, byte [0x9e8a5e75]
push ds
mov dword [eax], ecx
invalid

Function at 0x535cf1
Capabilities:
Encode data using xor

Disassembly:
dec ebp
cmc
inc edx
rcl dword [ecx], 0xb9
sub eax, 0x61b61dfa
aad 0x32
and ebx, dword [edx]
jl 0x535d08
movsb byte es:[edi], byte [esi]
rcl dword [esi + ebx*8 + 0x3d4ea558], 0x37
rcr dword [ecx], 1
jge 0x535d1d
dec esi
cmp eax, 0x7d19d137
push cs
mov ebp, 0xb166a6cd
invalid
ror byte [ecx + 0x23], 1
dec esi
jle 0x535d48
movsb byte es:[edi], byte [esi]
dec ebx
inc esp
cmc
invalid
dec edi
ret
adc eax, 0xdc003ead
inc eax
arpl word ss:[ecx - 0x4f], si
test al, 0x46
mov dl, 0x5a
test eax, 0x5405b325
mov dl, 0x41
aad 0xeb
arpl word [esi + 0x2393417f], dx
mov ch, 0x68
cmc
jno 0x535d43
push es
adc byte [ebp + 0x7c60891], 0xa6
loope 0x535d87
rol dword [edx - 0x5b], 0x20
cmc
movsb byte es:[edi], byte [esi]
in eax, dx
xchg ebp, eax
salc
push ebp
mov dh, 0x45
inc ebp
aam 0xbf
push 0xb5a412d8
aaa
xor eax, 0x304067e
xchg esp, eax
jge 0x535d7f
inc ebx
cmc
pop es
aad 0x91
invalid

Function at 0x537ea8
Capabilities:
Encode data using xor

Disassembly:
clc
adc ebp, edi
in eax, dx
inc bh
cmp ah, byte [ebp - 0x5e703ce9]
adc eax, 0x9d302c42
or al, 0xc7
mov ebp, 0xb6f91730
mov bh, 0x6c
xor byte [ebp + 0x30bdc70c], bl
pop ss
stc
mov dh, 0xb7
insb byte es:[edi], dx
pop esp
cmp byte [esi + 0x54a12ee8], 0x4b
add eax, 0x43a895b8
test byte [eax*4 + 0x19488ce4], dl
fdiv st(5)
mov cl, 0xc7
cmp ebp, 5
push ebp
arpl word gs:[ecx + edi*2], si
nop
xchg ebp, eax
adc eax, 0x64dc4477
leave
adc al, 0xe4
jne 0x537eb7
leave
ret 0xcbdd

Function at 0x538395
Capabilities:
Encode data using xor

Disassembly:
std
fadd dword [eax]
xchg esp, eax
push 0x4ad0db6e
inc esp
invalid