joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x58], 3
mov dword [ebp - 0x54], 0x41c2d0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x44], eax
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x44e8bc
mov dword [ebp - 0x34], str.Splash
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.USER32.dll_RegisterClassW]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x166
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov dword [0x466368], eax
push 0x46636c
push 0x18
mov edx, dword [0x466368]
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [0x466374]
push ecx
mov edx, dword [0x466370]
push edx
mov eax, dword [ebp - 8]
sub eax, dword [0x466374]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [0x466370]
cdq
sub eax, edx
sar eax, 1
push eax
push SysReAllocString
push 0x44e924
mov eax, dword [ebp - 0x34]
push eax
push 0x8000028
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0x24], eax
push 0xa
push 0x3d6
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41c620
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x2c], eax
push 1
mov eax, dword [ebp - 0x20]
push eax
call fcn.0042f5a5
add esp, 8
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0042ca90
add esp, 0xc
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 0x30], eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_SetWindowRgn]
cmp dword [ebp - 0x18], 0
je 0x41c620
mov edx, dword [ebp - 0x18]
push edx
call fcn.0042f5b0
add esp, 4
push 4
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret
Function at 0x41d7e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447dc0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], 0
push 0x4503b8
lea ecx, [ebp - 0x28]
call fcn.00403550
mov dword [ebp - 4], 0
mov dword [ebp - 0x50], 0x466af4
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x50]
call fcn.00421770
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x50]
call fcn.00422270
jmp 0x41d84c
lea ecx, [ebp - 0x44]
call fcn.004050c0
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x44]
call fcn.00404f00
movzx eax, al
test eax, eax
je 0x41d8be
lea ecx, [ebp - 0x44]
call fcn.00405080
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
call fcn.00421840
push eax
call fcn.0042fb85
add esp, 4
mov ecx, dword [ebp - 0x48]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x48], edx
push 0
mov eax, dword [ebp - 0x54]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.004017e0
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x60], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405180
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004046b0
jmp 0x41d844
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41d909
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.00421840
push eax
push 7
push 0
push 0x4503d4
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004046b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret

Function at 0x41df80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0x465fac
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
Function at 0x41e220
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41e241
jmp 0x41e390
mov edx, dword [ebp - 8]
push edx
call fcn.00429e30
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, 1
imul edx, ecx, 0
add edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x41e28b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
push 1
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00429e22
add esp, 8
mov dword [ebp - 8], 0x34
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
push 0x452844
mov ecx, 1
imul edx, ecx, 0
add edx, dword [ebp - 0xc]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x41e2c8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push 1
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00429e22
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x41e326
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [0x466b00], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
and eax, 0xffff
movzx ecx, ax
mov dword [0x466b04], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [0x466b08], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
and eax, 0xffff
movzx ecx, ax
mov dword [0x466b0c], ecx
jmp 0x41e37c
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [0x466b10], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
and eax, 0xffff
movzx ecx, ax
mov dword [0x466b14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [0x466b18], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
and eax, 0xffff
movzx ecx, ax
mov dword [0x466b1c], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x20], edx
push 1
mov eax, dword [ebp - 0x20]
push eax
call fcn.00429e22
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x41e3a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jl 0x41e3ce
push 0
mov eax, dword [0x466a24]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.Rating
push 0x46699c
call fcn.0042fb63
add esp, 8
call fcn.00419940
xor eax, eax
pop ebp
ret 0xc
Function at 0x41e3e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x10], 0
jbe 0x41e479
push 0
imul eax, dword [ebp + 0xc], 0x64
xor edx, edx
div dword [ebp + 0x10]
push eax
push 0x402
mov eax, dword [0x466a24]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
imul eax, dword [ebp + 0xc], 0x64
xor edx, edx
div dword [ebp + 0x10]
push eax
push str._u__
push 0x46699c
call fcn.00427870
add esp, 0xc
cmp dword [0x466a20], 0x2b1
jne 0x41e479
mov dword [ebp - 0x14], 0xc9
mov dword [ebp - 0x10], 0x1b
mov dword [ebp - 0xc], 0x110
mov dword [ebp - 8], 0x30
push 1
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0x4663ec]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41f100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x41f140
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x41f14c
mov al, 1
jmp 0x41f2ef
mov dword [ebp - 0x48], 8
call fcn.004222d0
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.004222d0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00422320
add esp, 8
movzx eax, al
test eax, eax
je 0x41f18f
xor al, al
jmp 0x41f2ef
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00403360
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x28]
call fcn.00421650
mov ecx, eax
call fcn.00405080
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.004260c0
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.00421650
mov ecx, eax
call fcn.00405080
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.00426940
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x41f20a
cmp dword [ebp - 0x38], 1
je 0x41f211
cmp dword [ebp - 0x38], 3
je 0x41f2ab
jmp 0x41f2c3
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00421650
mov ecx, eax
call fcn.00405080
mov edx, dword [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x41f274
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00421650
mov ecx, eax
call fcn.00405080
push eax
call fcn.004329ff
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x41f274
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404660
mov al, byte [ebp - 0x2d]
jmp 0x41f2ef
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x41f297
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404660
mov al, byte [ebp - 0x2e]
jmp 0x41f2ef
cmp dword [ebp - 0x34], 0
jne 0x41f2a9
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00420fa0
jmp 0x41f2db
mov byte [ebp - 0x2f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404660
mov al, byte [ebp - 0x2f]
jmp 0x41f2ef
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404660
mov al, byte [ebp - 0x30]
jmp 0x41f2ef
jmp 0x41f1a2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret
Function at 0x4266b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0042a310
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x452d04]
mov word [ebp - 0x804], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x802]
push ecx
call fcn.0042d590
add esp, 0xc
mov edx, dword [0x452dac]
mov dword [ebp - 0x1004], edx
push 0x7fc
push 0
lea eax, [ebp - 0x1000]
push eax
call fcn.0042d590
add esp, 0xc
lea ecx, [ebp - 0x804]
push ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x1004]
push edx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Cls.lnk
lea eax, [ebp - 0x804]
push eax
call fcn.0042faf2
add esp, 8
push str.Cls.exe
lea ecx, [ebp - 0x1004]
push ecx
call fcn.0042faf2
add esp, 8
push 0x452f04
mov edx, dword [0x4497dc]
push edx
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x4531fc
mov eax, dword [str.DirectoryBackground_shell]
push eax
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x45326c
push str.exefile_shellScan_with_Cls
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x452fa4
push str.exefile_shell
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x4534ec
push str.Drive_shellScan_with_Cls
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x453564
push str.Drive_shell
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push str.command
push 0x4535dc
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push str.Scan_with_Cls
push 0x453650
push SysReAllocString
call fcn.00408f40
add esp, 0xc
lea ecx, [ebp - 0x804]
push ecx
call fcn.0040d580
add esp, 4
cmp eax, 0x2b9
jne 0x42683e
lea edx, [ebp - 0x804]
push edx
call fcn.004088e0
add esp, 4
push 0x4663bc
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
test eax, eax
je 0x42686b
lea eax, [ebp - 0x1004]
push eax
call fcn.004088e0
add esp, 4
mov ecx, dword [0x4663bc]
push ecx
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x42687a
lea edx, [ebp - 0x1004]
push edx
call fcn.004088e0
add esp, 4
push 1
push 0
mov eax, dword [0x466a60]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
call fcn.0041a7e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret
Function at 0x427c70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x10325476
pop ebp
ret
Function at 0x43ae1e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043ac9d

Function at 0x43f163
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043ee23
Function at 0x40c201
Capabilities:
Encode data using xor

Disassembly:
adc dword [eax + 0x52], edx
xchg esp, eax
sub dword [esi + 0x34fc26c6], ebx
pop es
dec esp
mov eax, 0xfc273838
daa
cld
cmp esi, dword [ebx]
cld
xor eax, 0x4728145f
adc byte [esp + esi*4], 0xa4
stosb byte es:[edi], al
jecxz 0x40c210
xchg ebp, eax
xlatb
out 0xb0, al
dec ecx
js 0x40c238
invalid
adc al, 0x59
jae 0x40c269
adc al, 0x4e
or ebx, dword [ebp*8 - 0x70d7817]
jo 0x40c2c5
fisttp word [ecx]
xor al, 0x61
popal
adc al, 0xd
xor eax, 0x2198d749
sal dword [edi + 0x78], 1
fdivr dword [eax + 0x58e08b0f]
pop edx
or eax, 0xa3495934
sub edi, edi
ror dword [esi], 0xc3
cmp edx, dword [ecx + 0x69]
sahf
dec esp
add al, 0x5a
jle 0x40c24b
imul ebx, dword [esi - 0xca5fbb4], 0xb7cdda7e
int 0xb7
cmp al, 0xf3
cmp al, 0x74
test eax, 0xebf97ab2
xchg edi, eax
mov dh, 0xc5
cmp eax, 0xf8d3b553
hlt
sbb ebp, 0x4d
dec ebx
jmp 0xe01d22ab

Function at 0x43ba4e
Capabilities:
Encode data using xor

Disassembly:
and byte [ebp + 2], ch
xor esi, dword [0xc8115805]
add eax, 0x10c81158
inc ebp
inc ecx
pop eax
adc eax, ecx
adc byte [ebp + 0x41], al
sub byte [0x54b1450d], al
and ecx, ecx
mov byte [0x3474550b], al
xor eax, 0xd474ca3
push ecx
fnstenv [ebx - 0x1d]
inc esp
ja 0x43ba15
mov cl, 0xe6
push ecx
shl dword [ebx + eax*2 + 0x58], 0x62
jbe 0x43ba99
dec esp
cmp al, 0x45
lodsd eax, dword [esi]
adc byte [ecx + 0x11], al
inc ebx
fnstenv [ecx]
push 0x2ede625
dec ebp
xor al, 0xe3
xchg esp, eax
sbb al, 0x52
sahf
and al, 0xc3
jb 0x43ba7a
push ebp
inc esp
push ds
or eax, 0x5515235
loope 0x43baae
xchg edx, eax
bnd jecxz 0x43ba14
in eax, 0x10
mov al, 0x14
or byte [ecx + 0x6039233d], dh
pop es
rcr byte [edx + ecx], 0x99
jne 0x43bacd
jl 0x43ba0f
cmp dword gs:[eax + 0x48], esp
pop ss
mov ch, 0xb2
fisttp qword [eax]
push ebp
mov ah, 0x68
push 0x66e4d437
push ss
inc esi
imul esp, dword [ebx], 0xffffffd2
xor al, 0xd2
call 0xf0acc040
test dl, bl
les eax, [esi - 0x48df9fdc]
pop es
aaa
pop es
mov bh, 0x1d
and al, 0xdd
hlt
fcmovb st(0), st(4)
test byte [esi], ah
and al, 0x60
and byte [edi - 0x48f8c8f9], dh
sbb eax, 0x56f4dd24
scasb al, byte es:[edi]
sbb dl, ah
sbb dword [ecx + 0x1aa3e198], 0xc1ce30b8
jns 0x43ba72
scasb al, byte es:[edi]
call 0xc9ccf43a
movsb byte es:[edi], byte [esi]
test dword [ecx], 0xedccc4cf
stosb byte es:[edi], al
or al, 0xe4
xor byte [eax - 0x52], bl
and ebx, 0xa4366430
add eax, 0x596f54a5
retf
Function at 0x46a27d
Capabilities:
Encode data using xor

Disassembly:
invalid
mov esi, 0x17f479a4
adc eax, 0xe9907535
mov es, word [eax + 0x47]
pop edi
clc
sbb al, 0xd1
jl 0x46a2af
push 0x41
push edi
inc edi
pop edi
test dword [edx + 0x7926dc80], ebp
xchg esp, eax
cli
push ds
mov eax, dword [edi]
jl 0x46a273
xor eax, 0x9a461162
mov ah, byte [esi - 0x40103314]
mov esi, 0xbd249c9d
and byte [ebp - 0x26ab8131], 0x9e
or eax, 0x793dd9d5
sub edi, edi
pop ebx
mov al, byte [0x6eb74b2b]
xchg edx, eax
and dword [esi + 0x3236aa7c], ebp
xor byte [ebp - 0x17], 0x30
jb 0x46a314
in al, dx
adc dword [eax], ecx
add byte [bx + di + 0x6226], bl
enter 0x460, 0x15
fdivr qword [ebp + 0x734f7873]
and ebx, dword [eax + 0x27ada869]
sub bl, ah
mov esi, 0xf062e915
xor ch, byte [ebp + edx*4 - 0x2c]
xor dword [edi - 0x7d], 0x35
and eax, 0x25f814ed
div dword [ebp + 0x7d]
sahf
dec ebp
sub cl, 0x46
jne 0x46a388
push ebp
stosb byte es:[edi], al
nop
cmp dword [ebx - 0x6bd69d2c], 0x4a
xchg esp, eax
dec edx
lodsd eax, dword [esi]
adc bh, byte [eax]
inc ecx
aad 0xae
jge 0x46a301
cmp edi, ebp
aas
dec ebp
add al, 7
and esi, edx
jl 0x46a30c
mov esi, 0xdd7e8344
lahf
adc dl, ch
invalid
jo 0x46a3a5
push edi
push ss
xor esp, ecx
invalid
sbb cl, byte [esi - 0x6b]
je 0x46a353
and ebx, dword [ebp - 0x46]
jae 0x46a3b8
xor edi, esi
add ah, dl
pop es
sub byte gs:[ebp - 0x2f], bh
ja 0x46a392
xor dword [esi], esi
shr dword [ecx], cl
stosb byte es:[edi], al
rcr bh, 0x45
out dx, eax
fild word [ebp - 0x11]
push ebp
popfd
xor dword [edi + 0x32c8f5f], esp
shr dword cs:[edi], 1
ljmp 0x9946
inc esi
cdq
pushfd
and eax, 0xb6a3cfa
popfd
push ds
movsd dword es:[edi], dword [esi]
insb byte es:[edi], dx
call dword [eax]
rcl dword [eax], cl
mov byte [0xc3927cc9], al
jb 0x46a3ff
popfd
inc ebx
sti
sti
fisub dword [edi + 0x4d]
std
sub eax, 0xff9c5c25
jle 0x46a444
salc
ret
scasb al, byte es:[edi]
loop 0x46a3d4
and eax, 0x743b67ec
push ebp
mov cl, 0x31
cwde
pop es
movsd dword es:[edi], dword [esi]
invalid
xor eax, 0x83a787bf
adc byte [0x7ba975f], bh
cmp dword ds:[edi + eax*4 + 0x18], 0x35
mov esp, 0x9ac5ff2b
sbb ch, byte [esp + ebp*2]
inc edx
push esp
sbb al, 7
push eax
test byte [edx], al
pop ss
xor bl, byte [edi - 0x70]
in al, dx
inc edx
fisubr dword gs:[ebp + 0x6dd77d5a]
xchg ebx, eax
wait
daa
xor eax, dword [esi]
mov al, byte [0x9f0cc9cf]
test byte [edx - 0x51fdc42c], ah
jbe 0x46a4f1
push edi
pop ecx
ja 0x46a460
in eax, dx
lodsb al, byte [esi]
add eax, 0xc5c8ab6
dec eax
add dword [esi + eax*8 + 0x57], esp
or eax, 0x55bd4dde
cmpsd dword [esi], dword es:[edi]
pop es
cld
mov al, byte [ebp - 0x72]
mov esp, 0xdd06acd9
mov eax, dword [0xe2b110da]
mov bh, 0x38
mov word [0xa60f1b54], es
adc ebp, dword [eax]
cmp byte [ecx], dl
cmp byte gs:[ebp + 0x28b60d68], ch
sub al, 0xc1
xchg ebx, eax
aam 0x71
push esp
insd dword es:[edi], dx
in al, 4
cmp al, byte [edx]
cmp cl, 0xdc
salc
fadd qword [edi - 0x394a6042]
cli
add al, 0xcc
lahf
sub al, 0xa2
in al, dx
fistp qword [ebx - 0x4612c15c]
in al, 0x6b
scasd eax, dword es:[edi]
sbb byte [edx + ecx*8 - 0x67fc7a9c], dh
ror dword [edx], 1
xor eax, 0xad5bada4
clc
retf
Function at 0x48025f
Capabilities:
Encode data using xor

Disassembly:
dec eax
cld
pop es
ljmp 0x6112
cmpsb byte [esi], byte es:[edi]
daa
dec edx
js 0x4802a5
and al, byte [ecx - 0x5e]
stosb byte es:[edi], al
and eax, 0x75057904
cld
invalid
clc
cld
jno 0x480244
arpl word [ecx], si
out 0x63, al
arpl word [edx], bp
push esp
rcr dword [esi - 0x7e6b2c26], 1
and byte [ebp - 0x6e060e79], bh
xor ah, byte [edx]
movsb byte es:[edi], byte [esi]
out dx, al
or dh, byte [eax]
pushal
xor al, 0x3d
xor eax, edx
je 0x4802ad
and eax, 0x105c2f4c
sub byte [edi], ah
fsub qword [esi + 0x3f21092]
mov al, 0xe4
cli
xchg byte [esi + 0x24], dh
aas
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
adc eax, 0xb1472407
loope 0x48034b
mov edi, dword [edi + ebx*8 + 2]
and byte [edi + esi*8 + 0x20], ch
fld qword [esi + 0x3cdab4d6]
mov dh, 0x23
arpl word [edx + 0x31], dx
scasd eax, dword es:[edi]
aad 0x64
bound esp, qword [eax - 0x5a]
aaa
add eax, 0xeedfbb44
test dword [eax + 0x2a23e619], edx
sbb eax, 0xc984e9cd
xor cl, bl
xchg ch, dh
div esp
test dword [ebx + edi*8], esi
test dword [ebx - 0x786355cc], edi
or byte [edx - 0x60], cl
jp 0x480380
std
outsd dx, dword [esi]
sbb dword [ebx + esi*4], 0xffffffa9
fidiv word [ebx + 0x53]
rcl dh, cl
push ebp
sahf
cdq
call 0x47e4253c
xchg esi, eax
push ss
xchg byte [ebp + 0x2e], al
invalid
adc esi, edx
aas
cmp byte [esi + 0x48], ah
xchg esi, eax
mov ah, 0x99
cmpsd dword [esi], dword es:[edi]
cmp ch, byte [si + 0x13df]
add bh, 0x24
mov al, byte [0xe7d38727]
xor eax, 0xafa6f780
mov byte [edi + 0x1b6006db], bl
sahf
add eax, 0x2d0ab2fd
mov esi, 0x95681bd5
adc eax, 0x7f5c0586
cmpsb byte [esi], byte es:[edi]
sbb byte [eax], bl
jbe 0x4803c9
sbb byte [esi + 0x46], dh
mov bh, 0x7e
fldl2e
jns 0x48039d
fmul dword [esi + ecx*2 + 0x72c1070d]
dec ebp
jmp 0x3bca578
mov ebx, 0x430ee839
push cs
inc ebx
pop ebp
inc ebp
xchg edx, eax
sbb al, 0x26
and eax, 0x6ed1764c
add eax, 0x6866437e
int1
push 0xffffffffffffffd6
xchg esp, eax
ja 0x480411
movsd dword es:[edi], dword [esi]
js 0x48033a
cmp dword [ebp - 0x693c68a3], edx
pop edx
inc esp
push ebx
or al, 0x24
adc dl, ch
pop ecx
in eax, dx
add esi, dword [edi + edi + 0x50]
dec ebx
fldenv [esi + 0x38]
cwde
jmp 0x34ecd820
pushfd
mov esp, 0xa3f85406
ja 0x480462
push es
je 0x4803a0
lcall 0xddbe, 0xe7b11f65
sbb al, 0x34
invalid
jns 0x4804d3
jmp 0x5976463a
sub bh, byte [edx]
push ecx
mov cl, 0xce
imul edi, dword [esi + eax*4], 0xfffffffa
push es
in al, dx
adc edx, 0x64b3f70e
xlatb
jne 0x480456
inc esp
and dl, byte [ebp - 0x4bcf6542]
push ds
push ecx
lahf
push ebp
xor ch, byte [esp + eax*8 + 0x772a8381]
pop eax
adc dword [esi + 0x3b539f06], ebx
out dx, al
aam 3
cmp dl, bh
inc esi
invalid
in eax, 0xdc
xor al, 0x5c
pop edi
push esi
mov bh, 0x23
and dword [ecx + esi + 0xd], edi
mov dh, 0x96
insd dword es:[edi], dx
mov eax, 0xa7a6a7e6
mov eax, dword [0x77273de6]
push ebp
xor edx, ecx
cmp eax, 0x698c3cca
nop
stosb byte es:[edi], al
ja 0x480561
pop ebx
push edi
xchg esi, eax
push 0x56
aas
or byte [edi], ch
mov dh, 0xd7
not bh
xchg ecx, eax
hlt
cmpsd dword [esi], dword es:[edi]
invalid