joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417de0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x422870
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x456048]
test eax, eax
je 0x417eee
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x417e31
cmp dword [eax + 4], 0
jne 0x417ed5
mov eax, dword [0x456048]
test eax, eax
je 0x417efd
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x417eda
test eax, eax
jne 0x417ea2
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x456048
xor ecx, ecx
mov edx, 0xc
movzx eax, byte [0x456aa4]
call fcn.00420260
test eax, eax
je 0x417f21
mov ecx, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [eax + 8], ecx
movsd qword [eax], xmm0
mov ecx, dword [0x456048]
test ecx, ecx
je 0x417f0c
dec ecx
push eax
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
test edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [eax + 4], 1
mov dword [eax + 8], 0
je 0x417ed5
test ecx, ecx
je 0x417ed5
lock dec dword [ecx]
jne 0x417ed5
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.00417f60
mov eax, esi
add eax, 8
jmp 0x417edc
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x456048
call fcn.00441da0
jmp 0x417e1b
mov ecx, 0x456048
call fcn.00441da0
jmp 0x417e3f
mov ecx, 0x456048
mov esi, eax
call fcn.00441da0
mov ecx, eax
mov eax, esi
jmp 0x417e96
mov ecx, 4
mov edx, 0xc
mov dword [ebp - 0x10], 0
call fcn.00441430
ud2

Function at 0x418750
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x456058]
test eax, eax
je 0x4187ce
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x41876d
cmp byte [eax + 4], 0
jne 0x4187c5
mov eax, dword [0x456058]
test eax, eax
je 0x4187da
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4187ca
test eax, eax
jne 0x4187bf
movzx eax, byte [0x456aa4]
xor ecx, ecx
mov edx, 8
call fcn.00420260
test eax, eax
je 0x4187f8
mov dword [eax], 0x456058
mov byte [eax + 4], 0
mov ecx, dword [0x456058]
test ecx, ecx
je 0x4187e6
dec ecx
push eax
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov word [eax + 4], 1
add eax, 5
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x456058
call fcn.00441da0
jmp 0x41875b
mov ecx, 0x456058
call fcn.00441da0
jmp 0x418777
mov ecx, 0x456058
mov esi, eax
call fcn.00441da0
mov ecx, eax
mov eax, esi
jmp 0x4187b3
mov ecx, 4
mov edx, 8
call fcn.00441430
int3
Function at 0x419630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x456038]
test eax, eax
je 0x4196c8
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x419656
cmp dword [eax + 4], 0
je 0x419656
add eax, 8
pop esi
ret
mov eax, dword [0x456038]
test eax, eax
je 0x4196d7
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4196c4
test eax, eax
jne 0x4196ab
movzx eax, byte [0x456aa4]
xor ecx, ecx
mov edx, 0x10
call fcn.00420260
test eax, eax
je 0x4196f8
mov dword [eax], 0x456038
mov dword [eax + 4], 0
mov ecx, dword [0x456038]
test ecx, ecx
je 0x4196e6
dec ecx
push eax
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
mov ecx, eax
mov dword [eax + 4], 1
add eax, 8
mov dword [ecx + 8], 0
mov byte [ecx + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x456038
call fcn.00441da0
jmp 0x41963f
mov ecx, 0x456038
call fcn.00441da0
jmp 0x419660
mov ecx, 0x456038
mov esi, eax
call fcn.00441da0
mov ecx, eax
mov eax, esi
jmp 0x41969f
mov ecx, 4
mov edx, 0x10
call fcn.00441430
int3
Function at 0x41ec40
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x41ec8d
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x41ec9d
mov dword [esi + 4], 0
jmp 0x41ecaf
cmp eax, 0x103
je 0x41ecc7
test eax, eax
js 0x41ecb8
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x41ecb2
mov eax, esp
mov dword [esp + 0x1c], 0x447850
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
call fcn.004179b0
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00417b10
mov ecx, 7
int 0x29
ud2

Function at 0x42466d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
not ebx
push edi
cmp esi, 8
jbe 0x42472d
jmp 0x42469d
movzx eax, byte [edx]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x449150]
inc edx
dec esi
test dl, 7
jne 0x424689
mov edi, esi
and edi, 0xfffffff8
add edi, edx
and esi, 7
jmp 0x424729
xor ebx, dword [edx]
add edx, 4
mov dword [ebp + 0x10], edx
add dword [ebp + 0x10], 4
mov edx, dword [edx]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x449550]
xor ecx, dword [eax*4 + 0x449950]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x44a550]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x44a950]
mov eax, edx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x449150]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x44a150]
movzx eax, dl
mov edx, dword [ebp + 0x10]
xor ecx, dword [eax*4 + 0x449d50]
movzx eax, bl
xor ecx, dword [eax*4 + 0x44ad50]
mov ebx, ecx
cmp edx, edi
jb 0x4246ae
test esi, esi
je 0x424749
movzx eax, byte [edx]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x449150]
inc edx
sub esi, 1
jne 0x424731
pop edi
not ebx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x424752
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x1c]
not ebx
push edi
mov edi, dword [esp + 0x18]
not esi
cmp edi, 4
jbe 0x42481a
mov dword [esp + 0x18], edx
test dl, 3
je 0x4247a4
movzx eax, byte [edx]
movzx ecx, bl
shrd ebx, esi, 8
xor ecx, eax
shr esi, 8
xor ebx, dword [ecx*8 + 0x44b150]
xor esi, dword [ecx*8 + 0x44b154]
inc edx
dec edi
test dl, 3
jne 0x42477c
mov dword [esp + 0x18], edx
mov ebp, edi
and ebp, 0xfffffffc
add ebp, edx
and edi, 3
jmp 0x424816
mov edx, dword [edx]
xor edx, ebx
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov ebx, dword [ecx*8 + 0x44b950]
mov ecx, dword [ecx*8 + 0x44b954]
xor ebx, dword [eax*8 + 0x44c150]
xor ecx, dword [eax*8 + 0x44c154]
mov eax, edx
shr eax, 0x18
xor ebx, dword [eax*8 + 0x44b150]
xor ecx, dword [eax*8 + 0x44b154]
movzx eax, dl
mov edx, dword [esp + 0x18]
xor ebx, dword [eax*8 + 0x44c950]
xor ecx, dword [eax*8 + 0x44c954]
xor ebx, esi
xor ecx, 0
add edx, 4
mov esi, ecx
mov dword [esp + 0x18], edx
cmp edx, ebp
jb 0x4247b0
test edi, edi
je 0x424841
movzx eax, byte [edx]
movzx ecx, bl
shrd ebx, esi, 8
xor ecx, eax
shr esi, 8
xor ebx, dword [ecx*8 + 0x44b150]
xor esi, dword [ecx*8 + 0x44b154]
inc edx
sub edi, 1
jne 0x42481e
not esi
not ebx
pop edi
mov edx, esi
mov eax, ebx
pop esi
pop ebp
pop ebx
ret

Function at 0x42495a
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x20
push 0x448b20
lea eax, [esi + 0x40]
push eax
call fcn.0042c230
and dword [esi + 0x60], 0
add esp, 0xc
and dword [esi + 0x64], 0
pop esi
ret
Function at 0x42bc71
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42bcb0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42bcb0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42bcb0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42bcb0
cmp dword [ecx + 0x74], 0xe
jbe 0x42bcb0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x434d6f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00434cf1
Function at 0x436f5d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x436ffa
push ebx
push esi
call fcn.00436f26
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00436eba
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x436fa7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x436ff9
push edi
push eax
call fcn.00434399
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x436fc7
call fcn.0043435f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x436ff8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00436eba
add esp, 0x20
test eax, eax
jne 0x436fe6
push edi
call fcn.0043435f
jmp 0x436fee
push ebx
call fcn.0043435f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4385a6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44f6d0
push 0x44f6c8
push str.FlsAlloc
push 0x1f
call fcn.004383e5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4385da
push dword [ebp + 8]
mov ecx, esi
call dword [0x4431b8]
call esi
jmp 0x4385e0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x438624
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44f6e0
push 0x44f6d8
push str.FlsGetValue
push 0x21
call fcn.004383e5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43865b
push dword [ebp + 8]
mov ecx, esi
call dword [0x4431b8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x438663
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44f6e8
push 0x44f6e0
push str.FlsSetValue
push 0x22
call fcn.004383e5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43869d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4431b8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x440d10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x440d3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x440d3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x441da0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x441e13
lea edi, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x441e4a
cmp dword [esp + 4], 0
je 0x441e31
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x441e5d
mov ebx, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x456a60]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x456a60], esi
jne 0x441df0
mov byte [0x456a5c], 1
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov eax, ebx
jmp 0x441e43
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x441e9e
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x441e35
mov eax, dword [esp]
jmp 0x441e43
mov eax, dword [esi]
jmp 0x441e42
push dword [esp]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, esi
dec eax
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00441ee0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x447c20
mov dword [esp + 8], 0x447be4
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str.___rustc_a4472498d7e88041f6206faf4503eb1f246fd427librarycore_srcio_borrowed_buf.rs
mov dword [esp + 0x14], 0
call fcn.004414f0
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x447be4
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str.___rustc_a4472498d7e88041f6206faf4503eb1f246fd427librarycore_srcio_borrowed_buf.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00441f10
int3
Function at 0x46e36c
Capabilities:
Encode data using xor

Disassembly:
push ds
push esp
jge 0x46e3dd
out 0x2a, eax
cmp esp, dword [ebp + edx*2 + 0x4064c536]
sub al, 0xa9
lahf
lea esi, [ebx]
adc dword [esp], eax
lds ebp, [edx - 0x5213a467]
invalid
aam 0x3d
inc edi
cld
stosb byte es:[edi], al
sub edi, 0x6e
iretd

Function at 0x482bfc
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x735cf196
push ebp
imul ecx, dword [edx - 0x31], 0x1c
lodsd eax, dword [esi]
int3
sbb eax, 0x11fc7e99
xor ah, byte [ecx + 0x48]
call [ecx - 0x5cae9cb9]
out dx, eax
xchg edx, eax
cld
inc eax
jecxz 0x482bb8
int3
outsd dx, dword [esi]
test al, 0
xor al, 0x5e
cmp al, 0x69
in eax, 0xce
mov cl, 0xd0
cmp al, 0x8c
sub esi, eax
sbb ah, cl
popfd
popfd
sbb al, 0xa5
jecxz 0x482bca
push eax
xchg esp, eax
xchg ebp, eax
lodsb al, byte [esi]
push edi
inc ebp
scasd eax, dword es:[edi]
xchg esp, eax
sbb byte [ecx], bl
lahf
sub bl, bh
jno 0x482c38
int 0x4f
fisub dword [eax + 0x67]
jbe 0x482bde
add al, 0x55
into
pop ds
sbb dword [ebx], eax
mov fs, word [ebp + 0x4e]
sbb eax, 0xe23fbcdf
pop ebx
aas
loop 0x482c96
rcr dword [edi - 0x110b3210], cl
sbb al, 0xea
mov bl, 0x71
dec esp
push ebx
mov ebp, 0x8357f11d
ljmp 0x1dbd:0x534c71b3
fidivr word [esi]
jb 0x482c4c
in eax, dx
outsd dx, dword [esi]
std
insb byte es:[edi], dx
int 0x7f
push fs
scasd eax, dword es:[edi]
sbb byte [eax + ebp*4], dl
out dx, eax
mov dword [0xa256117b], esp
jbe 0x482c0f
or esi, ebx
push edx
arpl word [edx + 0x38], sp
pop ebx
sub eax, 0x3b6d6f4f
adc dword [eax], 0xffffffaf
outsb dx, byte [esi]
dec esp
and al, 0x8e
lahf
sbb al, 0xfa
jnp 0x482c9d
xor ebx, edi
jb 0x482c42
add ebx, dword [edi + 0x312ad3b4]
sub al, 0x34
int3
mov ebp, 0x30c16716
cmp eax, 0x4ae8c5d2
dec ebp
mov dword [0xa811df62], eax
adc byte [ecx], ah
mov ebx, 0xae6764a5
pushfd
fisttp word [esi]
ja 0x482d05
invalid
dec ebx
mov al, 0xb3
pushfd
add dword [ebx], esi
mov ebp, 0xb0b2c88c
in eax, dx
out dx, al
enter 0xfffffffffffff34e, 0x6f
or dword [ebx + 0x2dd5d95f], ecx
inc ebp
imul byte [esi + 0x1d]
lodsb al, byte [esi]
pop ds
out 0x80, al
out 0x63, eax
int1
test dword cs:[ebx], esi
scasb al, byte es:[edi]
mov dh, 7
sahf
mov byte [0x62ee3283], al
jnp 0x482d3c
mov ah, 0x3f
test byte [0x6ce57e48], cl
hlt
dec esi
aaa
add ecx, ebx
xchg ebx, eax
aas
xchg ebp, eax
inc ecx
xchg edi, eax
push eax
or eax, 0xbd3a9896
lahf
or eax, 0xd50a1945
lea esp, gs:[eax - 0x656b9ad1]
lea esp, [eax - 0x656b9ad1]
daa
adc dword [0xf4f23499], ecx
sbb al, 0xb2
popal
sub ch, byte [ebx]
pop esp
aas
test dword [ebp + ebp*8 - 0x5bf28a70], esp
invalid
lea ebx, [edx + 0x6d50b89d]
imul ebx, dword [ecx - 0x65], 0x5b
mov edi, dword [edi]
xor dword [ecx], ebp
mov esp, 0x6848bb24
dec ebx
push cs
insd dword es:[edi], dx
or eax, 0xce4cf0e8
loope 0x482d1b
push ds
aas
dec esp
std
hlt
Function at 0x486a3c
Capabilities:
Encode data using xor

Disassembly:
dec ecx
lahf
sub eax, 0xfa8fcf1c
xchg ebx, eax
sub byte [esi + edi*2 - 0x58], ch
mov dword [0xefa5a61f], eax
sub al, 0x31
sbb al, 0x4a
hlt
mov bl, 0xd0
jns 0x4869c2
aas
add eax, 0x68deaaef
dec ebx
inc ebx
mov eax, 0x1e5a2e2e
cld
and al, 0xc9
fistp word [eax - 0x2a040be1]
enter 0xffffffffffff9e79, 0xffffffffffffff9d
mov ebx, dword [edx + 0x56a42c6d]
mov dh, 0xe8
out 0xb8, al
mov cl, 0x48
sbb dword [0xa449ef1d], 0x62
mov bl, 0xf
cmc
repne stosd dword es:[edi], eax
mov ebp, 0x6fd6dad9
jp 0x486a7a
fdiv qword [ebx + 0x2b]
jae 0x486aa7
lahf
and al, 0x82
xlatb
or byte [esi + 7], ch
ficomp dword [ebx + 0x2c208d62]
cmc
aaa
or bl, byte [esi - 0x482ed178]
imul ecx, dword [ebp - 0x44], 0xffffffff
xchg esi, eax
fucompi st(0)
inc eax
add al, 0xe
push cs
mov ebx, dword [edi + 0x6f348ec9]
xor eax, 0xe74f8f3f
dec edi
pop ds
scasd eax, dword es:[edi]
cmp bh, byte [edi]
je 0x486a9a
sbb dword [edi], esi
or eax, 0x1db7acc7
out dx, eax
lodsd eax, dword [esi]
inc esp
fsub qword [ebp - 0x41]
and eax, 0x1f338884
sbb edi, edx
insd dword es:[edi], dx
fist word [edi + ecx*2 - 0x7cd390b1]
invalid

Function at 0x517cda
Capabilities:
Encode data using xor

Disassembly:
daa
je 0x517cb8
out 0xdd, al
xor ch, byte [esi - 0x4bec2293]
sub edx, edi
cmp ecx, dword [edx + 0x2558d37]
loop 0x517cdf
sub ah, byte [ebx + 0x6151bb26]
nop
jne 0x517d63
sbb al, 0x26
cmp bl, byte [eax]
mov eax, edx
sub ecx, dword [edx*8 + 0x3065bd7a]
jmp 0x517d77
stosd dword es:[edi], eax
pop ebp
sal byte [ebx + 0x64], 1
jp 0x517df7
int3
xchg esp, eax
lodsb al, byte [esi]
xchg ebp, eax
pop edi
xchg byte [edx + 0x76c36760], bl
test al, 0x65
dec esi
salc
pop ebx
retf 0x5aee
mov cs, word [edx + eax*2 - 0xd6c5e9c]
jae 0x517d94
mov eax, dword fs:[0x9473f293]
xchg byte [edx + 0x7a], cl
jmp 0x517e64
mov dword [0x83a2f4f1], eax
xchg ecx, eax
imul esi, esi, 0xffffffc1
in al, dx
js 0x517dfa
imul ch
sub eax, dword [edx + 0x4aff93e8]
mov eax, 0x3c02a13a
jp 0x517eec
and dword [ebx - 0x53], edi
sub ch, byte [edx + ebp*8 - 0xc]
cdq
shl byte [eax + 0xb], 1
pop edx
popfd
sti
inc edi
sbb dword [esi + 0x2d36a20b], edi
sub eax, 0xa1975f0
or dword [esi - 0x66], ecx
stosd dword es:[edi], eax
and dword [esp], 0xffffffdd
mov cl, 0xf4
invalid
pop eax
cmp byte [0x633b4370], cl
push ss
imul esi, edx, 0xffffffa1
invalid
Function at 0x5308bc
Capabilities:
Encode data using xor

Disassembly:
pop ebx
adc byte [ecx + 0x79], dh
mov ax, 0x562d
popal
test ch, 0x19
insb byte es:[edi], dx
jnp 0x5308c5
mov eax, 0xf2c7c1cb
aas
rdmsr
push ss
push cs
add dword [ebx - 0x10609bcf], edx
mov ch, 0x39
xchg ebp, eax
fiadd dword [edx]
mov bl, 0x91
invalid
mov ecx, 0xd79d31e0
mul byte [edi + 0x1a09fce6]
outsd dx, dword [esi]
add al, 0x38
and al, 0x24
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
cdq
push cs
cmp byte [esi - 0x43], ch
outsb dx, byte [esi]
mov ebp, 0xd53a5e2f
outsb dx, byte [esi]
mov ebp, 0xd53a5e2f
pop esi
and al, byte [ecx + 0x59d92def]
leave
dec ebp
out dx, eax
sub eax, 0x4dc959d9
jns 0x5308cc
inc dword [eax - 5]
inc eax
sti
cld
and dword [ebx + 0x20aeb1a0], 0x544bb637
aaa
mov dh, 0x4b
push esp
jl 0x530878
por mm5, qword [ecx + edi*2 - 0x28]
out 0xbe, eax
mov fs, word [edi]
ror dword [esi - 0x4d66725a], 0xcc
stosb byte es:[edi], al
mov ah, dl
in al, 0x2a
clc
dec esi
in eax, 0xef
xor al, 0xf8
xlatb
loope 0x5308d6
jp 0x5308a7
pop edx
invalid

Function at 0x578e7c
Capabilities:
Encode data using xor

Disassembly:
fisubr dword [edx - 0x5aa72358]
imul eax, dword [edi], 0x17ffd5dd
xchg esi, eax
pop edx
div esi
pop edi
arpl word [edx + eax - 0x5c], dx
xor dword [edi - 0x38], 0xd556bf8f
push 0x2a4f071
mov es, word [0xbb06aa77]
adc esi, dword [ecx + 0x6acc1d27]
mov al, byte [0x2f561942]
test eax, 0x65bea76e
xor byte [ebp - 5], bl
sub dh, byte [esp + eax*2]
clc
push esp
dec edi
jg 0x578e9d
pop edi
mov dword [edi + ebp - 0x74], ebx
mov bh, 0xd8
mov ebp, 0xea3dfba3
call [edi + 0x45]
popal
mov edx, dword [eax + ebp*8 - 0x6a]
xchg edx, eax
fcmovb st(0), st(2)
invalid

Function at 0x5e821c
Capabilities:
Encode data using xor

Disassembly:
sub byte [esi], ch
or dh, dh
mov byte [edi - 0x60], dh
mov ch, 0xf5
cli
insb byte es:[edi], dx
aas
pop edx
cwde
invalid
pop ebx
xchg ebp, eax
sbb bl, dh
cmp dl, byte [ecx + edi*4 - 0x2978f8ba]
push 0xffffffffffffffb6
or esi, ebp
push es
movsd dword es:[edi], dword [esi]
sbb ch, bh
sbb ebx, dword [ebp + edx*2 + 0x78]
ja 0x5e81d1
in al, dx
inc eax
loop 0x5e8271
in eax, 0x2f
shl byte [edi - 0x42], cl
sub byte [ecx + edx*4], ah
push ecx
add eax, 0x6b16c746
inc edi
aaa
mov bh, 0xe8
pop edx
push 0xb2f588fb
xlatb
pop ds
lahf
mov byte [0xc05fea5f], al
jge 0x5e82c1
call 0xe899f218
invalid
sub dword [ecx], ebx
sbb dword [esi - 0x69035d1], ebp
xchg esi, eax
pop edx
adc al, 0xda
push es
mov gs, word [edi + 0x48b24671]
jbe 0x5e820d
xchg byte [eax + 0x56], bl
pop eax
push esi
push 0x4931802
push es
add al, 6
push esp
inc ecx
mov ah, 0x26
les edx, [esi]
enter 0x39bc, 5
lds eax, [edx + ecx*8]
imul ecx, dword [edi + 0x48b64ab4], 0x48c97cba
jmp 0x5e8286
in eax, dx
mov bh, 0xb2
pushal
js 0x5e828d
test byte [ebx], 0xf3
cmpsd dword [esi], dword es:[edi]
and dh, bh
add eax, 0xc836e501
xchg edx, eax
fidiv dword [ebp - 0x44]
invalid
Function at 0x62aeec
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
add dword [ebp + eax*4 + 0x179d66ac], 0x46de6036
pop ss
test byte [ebp + 0x179d66ac], al
pushal
fiadd word [esi + 0x17]
out 0x3c, al
xor eax, 0x7ca3335c
sub al, 0x2e
sbb bh, bl
and dword [0x98fc048e], ebp
jo 0x62aeee
cmc
pop ecx
mov ebp, 0xc67f1d11
cli
hlt

Function at 0x63964c
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xb0
mov ch, 0x9e
les ebx, [esi + ebp*4]
dec byte [esi + 0xb3d5f9a]
lcall 0x3476, 0x6b0b3d5f
jo 0x639643
lcall 0x3476, 0x6b0b3d5f
jo 0x639643
lahf
invalid

Function at 0x63e82c
Capabilities:
Encode data using xor

Disassembly:
dec edx
out 0xaf, eax
mov eax, dword [0x577e673e]
lodsb al, byte [esi]
pushfd
fldcw word [edi + 0x3d1625c7]
cmp dword [ebp + 0x54], ebp
xor cl, byte [ecx + 0x519a93de]
pop esi
test dword [esi + 0x42020aa7], edx
stc
cmpsb byte [esi], byte es:[edi]
mov ah, 0x14
mov dword [0xcdcc89ba], eax
inc dword [ebx + 0x94e7750]
jns 0x63e837
or byte [ecx + ebx], dl
mov dh, 0x6f
int 0x14
cmpsb byte [esi], byte es:[edi]
sbb ebx, dword [ecx]
mov dh, cl
cdq
cdq
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx