joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ccb48
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov edx, 0x41ea950
lea eax, [ebp - 0x100]
call fcn.041cc9cc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x14]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x41ea850]
xor esi, ecx
movzx esi, byte [esi + 0x41ea850]
xor esi, edx
mov esi, dword [esi*4 + 0x41eaa50]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x41ccb82
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
mov edx, 0x41ea950
lea eax, [ebp - 0x100]
call fcn.041cc9cc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x13]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x41ea950]
xor esi, ecx
movzx esi, byte [esi + 0x41ea850]
xor esi, edx
mov esi, dword [esi*4 + 0x41eae50]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0x400], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x41ccbe1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x10
mov edx, 0x41ea850
lea eax, [ebp - 0x100]
call fcn.041cc9cc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x12]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x41ea850]
xor esi, ecx
movzx esi, byte [esi + 0x41ea950]
xor esi, edx
mov esi, dword [esi*4 + 0x41eb250]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0x800], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x41ccc44
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x18
mov edx, 0x41ea850
lea eax, [ebp - 0x100]
call fcn.041cc9cc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x11]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x41ea950]
xor esi, ecx
movzx esi, byte [esi + 0x41ea950]
xor esi, edx
mov esi, dword [esi*4 + 0x41eb650]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0xc00], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x41ccca7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41cd4f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x16]
lea eax, [ebp - 4]
mov ecx, 4
call sub.rtl60.bpl__System_Move_qqrpxvpvi
lea edx, [ebp - 0x12]
lea eax, [ebp - 8]
mov ecx, 4
call sub.rtl60.bpl__System_Move_qqrpxvpvi
mov ebx, dword [0x41f62ec]
mov ebx, dword [ebx]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16]
mov ecx, 2
call ebx
mov byte [ebp - 0xd], 8
mov dword [ebp - 0x24], 0x41ebc50
lea ebx, [ebp - 0x1e]
push ebp
xor edx, edx
mov dl, byte [ebp - 0x16]
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
call fcn.041cd4b8
pop ecx
mov byte [ebx], al
mov byte [ebp - 0xe], 7
mov eax, dword [ebp - 0x24]
lea esi, [eax + 1]
lea edi, [ebp - 0x15]
push ebp
xor edx, edx
mov dl, byte [edi]
xor eax, eax
mov al, byte [esi]
call fcn.041cd4b8
pop ecx
xor byte [ebx], al
inc edi
inc esi
dec byte [ebp - 0xe]
jne 0x41cd56f
inc ebx
add dword [ebp - 0x24], 8
dec byte [ebp - 0xd]
jne 0x41cd54e
xor eax, eax
mov al, byte [ebp - 0x1e]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0xd], 7
lea eax, [ebp - 0x1d]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
shl edx, 8
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
shr ecx, 0x18
or edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shl edx, 8
xor ecx, ecx
mov cl, byte [eax]
xor edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], edx
inc eax
dec byte [ebp - 0xd]
jne 0x41cd5aa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41cd5e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov eax, 0x41ebc90
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], 5
mov ebx, dword [edx]
xor dword [ecx], ebx
mov ebx, dword [edx + 4]
xor dword [ecx + 4], ebx
add edx, 8
mov esi, dword [ecx + 4]
shr esi, 0x17
and esi, 0x1fe
mov esi, dword [eax + esi*4]
mov edi, dword [ecx + 4]
shr edi, 0xf
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x800]
mov edi, dword [ecx + 4]
shr edi, 7
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x1000]
mov edi, dword [ecx + 4]
add edi, edi
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x1800]
mov ebx, dword [ecx]
mov edi, ebx
shr edi, 0x17
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x2000]
mov edi, ebx
shr edi, 0xf
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x2800]
mov edi, ebx
shr edi, 7
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x3000]
mov edi, ebx
add edi, edi
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x3800]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 4]
shr esi, 0x17
and esi, 0x1fe
or esi, 1
mov esi, dword [eax + esi*4]
mov edi, dword [ecx + 4]
shr edi, 0xf
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x800]
mov edi, dword [ecx + 4]
shr edi, 7
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x1000]
mov edi, dword [ecx + 4]
add edi, edi
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x1800]
mov edi, dword [ecx]
shr edi, 0x17
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x2000]
mov edi, dword [ecx]
shr edi, 0xf
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x2800]
mov edi, ebx
shr edi, 7
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x3000]
add ebx, ebx
and ebx, 0x1fe
or ebx, 1
xor esi, dword [eax + ebx*4 + 0x3800]
mov dword [ecx + 4], esi
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
dec dword [ebp - 0x10]
jne 0x41cd606
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
xor dword [ecx + 4], eax
add edx, 8
mov eax, dword [ecx]
mov ebx, eax
shr ebx, 0x18
and ebx, 0xff
movzx ebx, byte [ebx + 0x41eba50]
shl ebx, 0x18
mov esi, eax
shr esi, 0x10
and esi, 0xff
movzx esi, byte [esi + 0x41eba50]
shl esi, 0x10
xor ebx, esi
mov esi, eax
shr esi, 8
and esi, 0xff
movzx esi, byte [esi + 0x41eba50]
shl esi, 8
xor ebx, esi
and eax, 0xff
movzx eax, byte [eax + 0x41eba50]
xor ebx, eax
mov dword [ecx], ebx
mov eax, dword [ecx + 4]
mov ebx, eax
shr ebx, 0x18
and ebx, 0xff
movzx ebx, byte [ebx + 0x41eba50]
shl ebx, 0x18
mov esi, eax
shr esi, 0x10
and esi, 0xff
movzx esi, byte [esi + 0x41eba50]
shl esi, 0x10
xor ebx, esi
mov esi, eax
shr esi, 8
and esi, 0xff
movzx esi, byte [esi + 0x41eba50]
shl esi, 8
xor ebx, esi
and eax, 0xff
movzx eax, byte [eax + 0x41eba50]
xor ebx, eax
mov dword [ecx + 4], ebx
mov eax, dword [edx]
xor eax, dword [ecx]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [edx + 4]
xor eax, dword [ecx + 4]
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ce264
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
jmp 0x41ce276
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
cmp edx, dword [eax]
jne 0x41ce272
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41ce2cd
xor eax, eax
push ebp
push 0x41ce2c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ce2cd
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x41d2cd4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41d2dbe
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.041d2bc0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrLAsg_qqrpvpxv
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrLen_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrLen_qqrx17System_AnsiString
pop edx
xchg edx, eax
mov ecx, edx
cdq
idiv ecx
mov esi, eax
test esi, esi
jl 0x41d2d51
inc esi
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrCat_qqrv
dec esi
jne 0x41d2d43
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrLen_qqrx17System_AnsiString
mov esi, eax
test esi, esi
jle 0x41d2d96
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx - 1]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
xor al, dl
mov byte [ebp - 0xd], al
cmp ebx, 0x1c8
lea eax, [ebp - 0x18]
mov dl, byte [ebp - 0xd]
call sub.rtl60.bpl__System__LStrFromChar_qqrr17System_AnsiStringc
mov edx, dword [ebp - 0x18]
mov eax, edi
call sub.rtl60.bpl__System__LStrCat_qqrv
inc ebx
dec esi
jne 0x41d2d64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d2dc5
lea eax, [ebp - 0x18]
mov edx, 2
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x41d5444
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call sub.rtl60.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
add esp, 0x108
pop ebx
ret
Function at 0x41d644c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41d6548
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x41d6560
call sub.rtl60.bpl__System__LStrLAsg_qqrpvpxv
lea eax, [ebp - 0x14]
mov ecx, 0x41d6580
mov edx, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrCat3_qqrv
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call sub.rtl60.bpl__System_Utf8ToAnsi_qqrx17System_AnsiString
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrLen_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrLen_qqrx17System_AnsiString
pop edx
xchg edx, eax
mov ecx, edx
cdq
idiv ecx
mov esi, eax
test esi, esi
jl 0x41d64dc
inc esi
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrCat_qqrv
dec esi
jne 0x41d64ce
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrLen_qqrx17System_AnsiString
mov esi, eax
test esi, esi
jle 0x41d6520
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx - 1]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx]
xor al, dl
mov byte [ebp - 0xd], al
cmp ebx, 0x1c8
lea eax, [ebp - 0x18]
mov dl, byte [ebp - 0xd]
call sub.rtl60.bpl__System__LStrFromChar_qqrr17System_AnsiStringc
mov edx, dword [ebp - 0x18]
mov eax, edi
call sub.rtl60.bpl__System__LStrCat_qqrv
inc ebx
dec esi
jne 0x41d64ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d654f
lea eax, [ebp - 0x18]
mov edx, 2
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x41dbe70
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x41dbe78
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x41dbfd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x344]
call sub.dbrtl60.bpl__Db_TDataSet_GetActive_qqrv
test al, al
jne 0x41dbeab
mov eax, dword [ebx + 0x344]
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x3a4]
call sub.vcl60.bpl__Controls_TControl_GetText_qqrv
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call sub.rtl60.bpl__Sysutils_Trim_qqrx17System_AnsiString
cmp dword [ebp - 4], 0
jne 0x41dbee7
mov eax, ebx
call fcn.041dce44
lea edx, [ebp - 0xc]
call fcn.0419f1ec
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x3a4]
call sub.vcl60.bpl__Controls_TControl_SetText_qqrx17System_AnsiString
mov eax, ebx
call fcn.041dce44
call fcn.0419f1cc
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x41dbfe8
mov edx, dword [ebx + 0x3dc]
mov eax, dword [0x41993a8]
call fcn.04199918
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x10]
call sub.rtl60.bpl__System__VarToLStr_qqrr17System_AnsiStringrx14System_Variant
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x3ac]
call sub.vcl60.bpl__Controls_TControl_SetText_qqrx17System_AnsiString
mov eax, ebx
call fcn.041dce44
call fcn.0419f1cc
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0
mov eax, ebx
call fcn.041dce44
call fcn.0419f1ac
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
lea eax, [ebp - 0x4c]
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x41dc018
mov edx, dword [ebx + 0x3dc]
mov eax, dword [0x41993a8]
call fcn.04199918
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x2c]
call sub.rtl60.bpl__System__VarToLStr_qqrr17System_AnsiStringrx14System_Variant
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x3b0]
call sub.vcl60.bpl__Controls_TControl_SetText_qqrx17System_AnsiString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dbfda
lea eax, [ebp - 0x3c]
call sub.rtl60.bpl__System__VarClr_qqrr14System_Variant
lea eax, [ebp - 0x2c]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x20]
call sub.rtl60.bpl__System__VarClr_qqrr14System_Variant
lea eax, [ebp - 0x10]
mov edx, 2
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 8]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x4148bf
Capabilities:
Encode data using xor

Disassembly:
pop ecx
pushal
call 0x87564113
and dword [edx - 0x45], 0xffffffa8
ja 0x41483c
bound edi, qword [ebx - 0x6f048858]
nop
pop esi
push edx
mov eax, 0x25442d9c
xor eax, 0x80680001
pop edx
mov al, 0xde
push 0xdeb05a80
out dx, al
dec eax
mov byte [0xcfcabd5a], al
popal
movsb byte es:[edi], byte [esi]
cwde
out 0xe9, al
pop eax
cmp ecx, edx
push eax
pop edi
push esp
add byte [0xce68270f], ah
stosb byte es:[edi], al
pop es
sti
xchg edx, eax
push cs
out dx, al
sbb dword [ebx + 0x70], edi
jnp 0x4148e9
and dh, byte [ecx + 0x4c]
in eax, 0x80
cli
jecxz 0x414849
js 0x4148f6
cmp bl, ah
cdq
dec esp
jb 0x414834
adc esi, dword [esi - 0x2d]
cmp byte [eax + 0xaa5359], bl
ret 0xe202
loop 0x4148c8
dec ecx
cmp al, 7
push ebp
cli
ficomp dword [ebx + 0x47]
fld xword [esi]
jle 0x414853
aad 0x4a
sub bl, dh
mov edi, 0x4243c07b
add eax, 0xb8e0522b
xor eax, 0x6b869e67
mov al, 0x98
retf 0xd84b
push edi
test bl, 0xeb
xor byte [ebx - 0x69877d1e], cl
js 0x414860
cli
cdq
jae 0x414877
test al, 0x23
arpl cx, cx
inc edx
sub bl, bl
and al, 0x18
test dword [eax], esp
pop eax
dec edx
mov esi, 0x1e650fa6
cmpsb byte [esi], byte es:[edi]
pcmpgtw mm3, qword [esi]
adc dh, dl
fisubr dword [eax]
jp 0x414894
mov cl, 0x5d
push cs
mov ah, 0x50
inc ecx
jg 0x4148dd
rol dword [ebp - 0x61], 0x62
pop ss
xor dword [eax + 8], ebp
clc
pop eax
mov esp, 0x1d2e6aaf
adc edx, edi
xchg edi, eax
add ch, byte [0x6afe17aa]
push 0xbc58f808
scasd eax, dword es:[edi]
push 0x2e
sbb eax, 0x297fa11
sub eax, 0x6afe17aa
cmp al, 0xc4
lahf
in al, dx
inc ecx
ret

Function at 0x41a5a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor ebp, ebp
fbld tbyte [ebp - 0x3bec1e2c]
and edx, dword [ecx + ecx*8 + 0x2756f47]
loope 0x41a506
les esp, [ebx]
xchg esp, eax
leave
inc edi
outsd dx, dword [esi]
jne 0x41a4fd
jb 0x41a4ec
inc esi
ret 0x8bf1
mov ebx, dword [esi - 9]
jmp 0x41a546
sbb byte [0xd6c1dff3], ah
fcmovnu st(0), st(6)
fiadd word [edi + 0x5c]
pop esp
pop esp
mov cl, 0x82
salc
ret
jns 0x41a510
lodsb al, byte [si]
add byte [eax], bl
xchg ebp, eax
push ds
loop 0x41a500
pop ebp
fisub word [ebp - 0x70]
stosd dword es:[edi], eax
stc
push 0xcc4410af
adc byte [esp + ecx*8 + 0x2e], al
jle 0x41a5a1
xchg esi, eax
adc ah, byte [edi]
test eax, ebx
nop
add al, 0x23
jbe 0x41a4f1
nop
mov edi, 0x6f397b77
std
sti
imul edi, edx, 0x49afd42c
popal
fcomp qword [ebx - 0x3c]
test al, 0x89
or eax, 0x72491e03
movsb byte es:[edi], byte [esi]
sub esi, edi
pop edi
loopne 0x41a5b4
push edx
xchg edx, eax
and byte [ebp - 0x5387a60e], 0xff
hlt
fild dword [edi - 0x6ab66531]
lodsd eax, dword [esi]
je 0x41a534
pushal
cmc
and ch, byte [ebx - 0x337e9a0d]
adc eax, 0xf2130c1
loope 0x41a543
xor byte [ecx], ah
psraw mm1, qword [edx + 0x36cb577f]
sti
xlatb
inc dword [0x68564289]
dec edi
xor dword [0x6f29bf7b], ebx
invalid
jg 0x41a612
retf
invalid
Function at 0x525027
Capabilities:
Encode data using xor

Disassembly:
xor eax, esi
mov dword [0x37fa2297], eax
and bh, dl
aaa
and bh, dl
aaa
xor dword [ecx], ebp
sar byte ss:[ebx - 9], 1
ja 0x525023
jp 0x525069
add ebx, dword [edx - 0x2f63c4a7]
sbb dh, bh
mov dl, ah
inc ebx
or eax, dword [ebp - 8]
sbb al, 0xbb
pop ebx
pop ss
or dword [0x9bcada7b], ebx
mov dword [0x3caaebb8], eax
sub byte [ebx - 0x44], al
push ds
invalid

Function at 0x5266b2
Capabilities:
Encode data using xor

Disassembly:
push ds
cwde
sbb esp, dword [edx]
xor dword [ebp + 0x2e], ecx
and eax, 0x5abf376e
pop edx
imul edx, dword [edi - 0x2f], 0x15
jns 0x52667c
outsd dx, dword [esi]
push edi
mov edi, 0xedcc3e08
mul byte [edi + 0x20c0ba8f]
test al, 0x73
sbb ah, byte [esi - 0xe]
pop dword [eax + 0x68a72d68]
pop esi
sbb ebp, dword [edi]
imul dword [edx - 0x6b]
adc dh, bh
insb byte es:[edi], dx
loopne 0x5266f1
push esi
mov bl, 0x72
stosd dword es:[edi], eax
mov byte [0x26bdc47b], dh
cmp eax, dword [0xebf8a207]
cmpsb byte [esi], byte es:[edi]
sbb dword es:[eax - 0x3b584561], esi
aas
add eax, 0xcf647d73
push ebp
mov ah, 0x96
pop edx
inc esp
dec ebx
out 0xed, al
fnstenv [ebx - 0xc733ed3]
sbb bh, byte [ebx + 0x5112aa08]
push ebx
sbb esp, dword [edx]
xor byte [edi], ch
pop ebx
jno 0x526688
rol dword [0x1d46f491], 1
mov bh, 0x42
add byte [edi - 0x1123df3c], bh
inc esi
sbb eax, 0xbf0042b7
les esp, [eax]
fsub st(6), st(0)
pop ss
mov bh, 0xd5
adc byte [ebx + 0x57], ch
xor ebp, edx
mov byte [0xf9ac7836], al
cmc
cld
mov bl, 0x20
or dh, byte [edi + 0x37]
imul ebp, dword [ecx - 0x6a77b88a], 0x64f9e610
cmc
insb byte es:[edi], dx
stosd dword es:[edi], eax
invalid
Function at 0x5278b3
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xd7e0e6b1
sar byte [ecx], 1
lds ecx, [ecx - 0x357f96ec]
fcom qword [ebx + 0x46ff1f9c]
push eax
xchg ebx, eax
pushfd
pop ds
inc dword [esi + 0x50]
pop ebx
jg 0x527817
out dx, al
ljmp 0xb1e8
sub ebx, dword [ebp + 0x1309e8eb]
enter 0x6fe0, 0xffffffffffffffad
adc ecx, eax
loopne 0x527852
lodsd eax, dword [esi]
loope 0x527861
mov ah, 0xed
jno 0x5277e9
jmp dword [edx + ecx]
and al, 0xa
cld
pop edx
cmc
sahf
jb 0x5277c3
sti
call 0x16bba626
inc ecx
fadd dword [ecx + edi*2]
mov dword [edi - 0x32b6f511], ebx
aad 0xdb
and byte [esi - 0x41], bh
inc ebx
push edi
and ch, ch
bound edx, qword [ebp + 0x6926a56b]
mov eax, 0x9ce4864f
add al, 0x92
fild word [esp + eax*2 - 0x33]
cmp bl, dh
jecxz 0x52786c
xor dword [eax - 0x78c8ee1e], edi
mov byte [0x3a7ea587], al
jno 0x5277da
xchg dword [ebp - 0x538ec582], esp
cmc
test dword [esi], edx
into
jns 0x5277b5
push ecx
jl 0x527828
insb byte es:[edi], dx
sub eax, 0x47a0bc4c
mov byte [0xe4bac69a], al
aad 0x4d
mov ebx, 0xabf75219
mov ebp, dword [esi]
jge 0x5277e1
jge 0x5277e1
ftst
les edx, [edi]
in al, dx
sbb ecx, dword [esi]
scasd eax, dword es:[edi]
mov ebx, 0x75d2e99
test byte [edi + 0x4a9d951a], cl
cmp bl, byte [ecx + 0xe]
push esp
sbb al, 0x9f
mov dl, 0x69
and dword [esi + 0x1ed0eba6], edx
enter 0x983, 0x5b
jnp 0x5277f8
jmp 0x52783e
sbb eax, 0x1bbeb2d8
xchg edx, eax
out dx, al
push ebx
and dword [ebx - 0x16], esi
adc al, 0xf5
stc
or al, 0x73
cli
push esp
xor ebp, eax
or dword [eax + 0x24dcc6cb], eax
push 0x1dccffb7
aam 0x9d
bound esp, qword [ecx + 0x18]
aad 5
lodsb al, byte [esi]
sub eax, 0xd140124c
arpl word [eax - 0x1dc9186c], bp
insd dword es:[edi], dx
sahf
insd dword es:[edi], dx
dec edi
loopne 0x527877
mov dl, 0xbe
sbb edx, dword [edx + 0x732153ee]
ljmp 0xfa73
loopne 0x527928
jo 0x5278d9
jp 0x52784b
mov eax, 0xbcb17e37
inc ebp
sub al, 0x47
or eax, 0x8f9b0dd8
pop ecx
sbb dword [edi + 0x5e], 0x26500c0e
jno 0x527941
or al, 0x50
jno 0x527941
hlt
sbb al, 0xa2
invalid
push cs
xchg byte [ecx], ch
push ecx
sub dword [eax + 0x2b], ecx
mov cl, 0xe9
shr byte [edi - 0x52c45609], cl
inc ecx
std
bound eax, qword [edx - 0x34008c0d]
xor bl, 0x73
dec ebx
dec edx
mov edi, 0xcbd2560e
or dh, 0xca
jl 0x5278c7
out dx, eax
push esi
inc ecx
pop edx
adc dword [0x6e4c744], 0x6a
or byte [edx + 0x76], ch
jbe 0x527981
xor cl, byte [edi]
push ecx
and al, byte [ebp + 0x13]
cmp edx, eax
ret
mov bl, 0x1f
push ebx
push es
jno 0x527953
jb 0x5279c8
inc eax
jp 0x527900
fld dword [ecx]
xchg ch, al
cdq
pop cx
cmp bl, byte [eax + eax*2 - 0x7b]
dec ecx
mov byte [0x16b70e25], al
std
push 0xffffffffffffffea
push es
xchg edx, eax
jb 0x527912
mov cl, 0x93
inc ebp
push ss
stc
push esi
invalid
or esp, dword [ecx]
mov bh, byte [0x70b6eb68]
aad 0x72
adc dl, byte [esi]
mov al, byte [0x4dc94228]
sub eax, 0x2a79cfaf
rol dword [ebx - 0x21], cl
imul esi, dword [edx], 0xffffffcf
or eax, 0xa21e98bb
add byte [eax + 0x47b2da27], 0x81
test byte [ebp + 0x71e41748], cl
xlatb
lodsb al, byte [esi]
pop esi
pushal
xchg ecx, eax
int3
and dl, byte [esi + 0x7f]
retf