joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30809222
Capabilities:
Enumerate process modules

Disassembly:
push 0x24
mov eax, 0x3081af3b
call fcn.30801ee1
xor ebx, ebx
push 8
pop esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
push ebx
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.30815701
push 0x20
pop edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 1
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x30]
call sub.psapi.dll_EnumProcesses
test eax, eax
je 0x3080928c
mov eax, dword [ebp - 0x18]
cmp eax, edi
jb 0x30809285
push ebx
add esi, esi
push esi
lea ecx, [ebp - 0x30]
call fcn.30815701
mov edi, esi
shl edi, 2
jmp 0x30809294
shr eax, 2
mov esi, eax
jmp 0x30809291
xor esi, esi
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
jne 0x3080925a
cmp dword [ebp - 0x14], ebx
je 0x308092c8
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.30815701
cmp esi, ebx
jbe 0x308092c8
mov ebx, dword [ebp - 0x30]
push ebx
mov ecx, edi
call fcn.30815701
add ebx, 4
dec esi
jne 0x308092ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.30806a0c
mov eax, dword [ebp - 0x14]
call fcn.30801fc6
ret

Function at 0x30815701
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x30815710
pop dword [ebp - 0x24]
mov eax, 0x30815710
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x900372a2
add dword [ebp - 0x34], 0xbe4ed2a9
mov dword [ebp - 0x30], 0xf1ed9573
add dword [ebp - 0x30], 0x4045b6d2
mov dword [ebp - 0x2c], 0x6295971e
sub dword [ebp - 0x2c], 0x164952f0
mov dword [ebp - 0x28], 0x6731e502
sub dword [ebp - 0x28], 0x6731e502
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xf897bf13
add dword [ebp - 0x34], 0x7bdaaa43
mov dword [ebp - 0x30], 0x8a3ba1
add dword [ebp - 0x30], 0x40e225d4
mov dword [ebp - 0x2c], 0x18fe09dd
sub dword [ebp - 0x2c], 0xb58e9d71
mov dword [ebp - 0x28], 0x48ba1f4f
sub dword [ebp - 0x28], 0x48ba1f4f
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xc5d4e0d0
add eax, 0x6aacefec
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3d953
push 0
call eax
mov ecx, 0x9b145fd6
add ecx, 0x64ebe9f2
xor edx, edx
add edx, eax
mov esi, 0x972b5d7b
add esi, 0x99579485
add esi, dword [ebp - 0x24]
mov ebx, 0xddc6542e
sub ebx, 0xa70db861
sub dword [ebp - 8], ecx
mov edi, dword [esi]
sub dword [ebp - 0x20], 0xcc9b5e6d
xor edi, ebx
sub dword [ebp - 8], ecx
mov dword [edx], edi
add dword [ebp - 0x20], edi
add edx, 0xbd70b3
sub edx, 0xbd70af
add esi, 4
loop 0x3081582a
add eax, 0xfa0dd7a6
add eax, 0x5f3424d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x30800000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x192310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x19233c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x192364
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x19236a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1923d2
jg 0x192381
test esi, esi
je 0x1923d2
test ecx, ecx
jl 0x1923cd
jg 0x19238b
test eax, eax
je 0x1923cd
cmp edi, ecx
jg 0x19239f
jl 0x192395
cmp esi, eax
jae 0x19239f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1923d5
mov ecx, dword [ebp + 8]
jmp 0x1923df
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1923f9
jg 0x1923df
test esi, esi
je 0x1923f9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1923f9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x192410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x192434
jl 0x192429
test ecx, ecx
jne 0x192434
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x19244e
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x19249a
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x1924a0
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1924a0
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x192516
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1924cc
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x192504
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x192516
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1924e0
test edi, edi
je 0x192516
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x192890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x198040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1928c0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00193b6f
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1928fc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1928fc
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00193b6f
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1929d3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x192924
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x192930
movsx eax, bl
jmp 0x192968
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x192992
sub eax, 1
je 0x192992
sub eax, 2
jne 0x1929d3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00193b6f
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1929b0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1929d3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00193b6f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00193b6f
mov esp, ebp
pop ebp
ret 4
Function at 0x192f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x198040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x192ffc
cmp byte [esi + 0x3d], 0
je 0x192ffc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x192fea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x192fb1
sub eax, 1
je 0x192fb5
sub eax, 2
jne 0x192fea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00193b6f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x192fd3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x192fea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00193b6f
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00193b6f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00193b6f
mov esp, ebp
pop ebp
ret

Function at 0x194665
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1946a4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1946a4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1946a4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1946a4
cmp dword [ecx + 0x74], 0xe
jbe 0x1946a4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4325dd
Capabilities:
Check for software breakpoints

Disassembly:
popal
fcmovnbe st(0), st(1)
push cs
push ebp
pushal
fimul dword [edi]
sub ebx, ecx
shr byte [esp + edi], 0xc9
sahf
nop
sub al, 0xbf
mov cl, 0xb4
add esp, esp
jns 0x432552
xlatb
enter 0xffffffffffff9471, 0xffffffffffffffb3
add dh, byte [esi + ebp]
scasd eax, dword es:[edi]
mov al, 0xd6
cmpsb byte [esi], byte es:[edi]
inc edx
daa
into
xor eax, 0x1e2aa06c
dec ebp
pushal
aas
dec edx
xor eax, 0xf1b8ce98
invalid
mov eax, 0xdbb08ff1
insd dword es:[edi], dx
clc
adc al, 0xc3
xchg ebp, eax
mov ch, dh
sub dh, byte [eax + 0x43bbd0b8]
call 0x27c688d0
mov eax, dword [0x8fae0f63]
daa
fisub dword [eax - 0x4ae916c6]
jno 0x43260c
inc edx
lea edx, [eax - 0x50]
xchg ebx, eax
loope 0x432558
invalid
push 0x832a4735
movsd dword es:[edi], dword [esi]
or al, 0xa8
hlt
loopne 0x4325dc
add eax, 0xc3b7a21d
ret
and eax, edx
daa
js 0x4325ea
test dword [eax], ecx
push ss
aas
mov ebp, dword [ecx]
xor ah, bl
sahf
push ebx
jecxz 0x432585
dec ecx
add byte [ebp + 0x20], dh
popal
mov esp, 0x8dec4eb9
and eax, 0x24ae2ab3
mov al, 0xc1
imul ecx, ebx, 0xc174e074
jno 0x4325b7
inc ecx
dec esi
xchg esp, eax
sub ebx, 0x7f223dc8
bound ecx, qword [ecx + 0x7696d316]
xor byte [ecx - 0x39], dh
jle 0x43262c
jmp 0x4325d6
das
push 0xd8c02bfd
xchg ecx, eax
invalid
mov dl, 0x7b
jge 0x432676
push ss
adc eax, 0x985e76db
dec edx
or byte [ecx + 0x10], ah
sbb eax, 0x4310f139
stosd dword es:[edi], eax
mov gs, word [ecx - 0x7d357d9c]
mov dword [ebp*8 - 0x166e275b], eax
and dword [ecx + edi - 0x2b], edx
aad 0xbd
push 0xfdb420ad
jae 0x43265b
add dword [eax + 0x6f60dc49], esp
mov al, byte [0x6f60dc49]
dec ecx
fsub qword [eax + 0x6f]
cli
stosd dword es:[edi], eax
in eax, 0x8e
sal ecx, cl
adc eax, 0xffffffb3
mov al, byte [0x9bca6da]
push ecx
pop ss
and ebp, esi
loopne 0x43260c
mov eax, 0x61b81928
mov edx, 0x784ae03b
fst qword [ebx + 0xd]
sbb dword [eax - 0x1fc4459f], edi
dec edx
js 0x43265c
push esp
jecxz 0x43268f
rcr ebp, 0xb3
sal dword [eax - 0x2f54d39], 1
cmp byte [ecx], 0xcc
invalid
div byte [ebp - 2]
outsd dx, dword [esi]
push si
sbb byte [eax], ah
sbb dword [edx], eax
mov eax, 0xe244ac18
pop esp
dec eax
xchg edi, eax
mov ah, 0x17
ja 0x432699
mov word [0x3de1d33f], ax
ljmp 0x8e57
Function at 0x432651
Capabilities:
Check for software breakpoints

Disassembly:
popal
fcmovnbe st(0), st(1)
push cs
push ebp
pushal
fimul dword [edi]
sub ebx, ecx
shr byte [esp + edi], 0xc9
sahf
nop
sub al, 0xbf
mov cl, 0xb4
add esp, esp
jns 0x432552
xlatb
enter 0xffffffffffff9471, 0xffffffffffffffb3
add dh, byte [esi + ebp]
scasd eax, dword es:[edi]
mov al, 0xd6
cmpsb byte [esi], byte es:[edi]
inc edx
daa
into
xor eax, 0x1e2aa06c
dec ebp
pushal
aas
dec edx
xor eax, 0xf1b8ce98
invalid
mov eax, 0xdbb08ff1
insd dword es:[edi], dx
clc
adc al, 0xc3
xchg ebp, eax
mov ch, dh
sub dh, byte [eax + 0x43bbd0b8]
call 0x27c688d0
mov eax, dword [0x8fae0f63]
daa
fisub dword [eax - 0x4ae916c6]
jno 0x43260c
inc edx
lea edx, [eax - 0x50]
xchg ebx, eax
loope 0x432558
invalid
push 0x832a4735
movsd dword es:[edi], dword [esi]
or al, 0xa8
hlt
loopne 0x4325dc
add eax, 0xc3b7a21d
ret
and eax, edx
daa
js 0x4325ea
test dword [eax], ecx
push ss
aas
mov ebp, dword [ecx]
xor ah, bl
sahf
push ebx
jecxz 0x432585
dec ecx
add byte [ebp + 0x20], dh
popal
mov esp, 0x8dec4eb9
and eax, 0x24ae2ab3
mov al, 0xc1
imul ecx, ebx, 0xc174e074
jno 0x4325b7
inc ecx
dec esi
xchg esp, eax
sub ebx, 0x7f223dc8
bound ecx, qword [ecx + 0x7696d316]
xor byte [ecx - 0x39], dh
jle 0x43262c
jmp 0x4325d6
das
push 0xd8c02bfd
xchg ecx, eax
invalid
mov dl, 0x7b
jge 0x432676
push ss
adc eax, 0x985e76db
dec edx
or byte [ecx + 0x10], ah
sbb eax, 0x4310f139
stosd dword es:[edi], eax
mov gs, word [ecx - 0x7d357d9c]
mov dword [ebp*8 - 0x166e275b], eax
and dword [ecx + edi - 0x2b], edx
aad 0xbd
push 0xfdb420ad
jae 0x43265b
add dword [eax + 0x6f60dc49], esp
mov al, byte [0x6f60dc49]
dec ecx
fsub qword [eax + 0x6f]
cli
stosd dword es:[edi], eax
in eax, 0x8e
sal ecx, cl
adc eax, 0xffffffb3
mov al, byte [0x9bca6da]
push ecx
pop ss
and ebp, esi
loopne 0x43260c
mov eax, 0x61b81928
mov edx, 0x784ae03b
fst qword [ebx + 0xd]
sbb dword [eax - 0x1fc4459f], edi
dec edx
js 0x43265c
push esp
jecxz 0x43268f
rcr ebp, 0xb3
sal dword [eax - 0x2f54d39], 1
cmp byte [ecx], 0xcc
invalid
div byte [ebp - 2]
outsd dx, dword [esi]
push si
sbb byte [eax], ah
sbb dword [edx], eax
mov eax, 0xe244ac18
pop esp
dec eax
xchg edi, eax
mov ah, 0x17
ja 0x432699
mov word [0x3de1d33f], ax
ljmp 0x8e57

Function at 0x439d0b
Capabilities:
Encode data using xor

Disassembly:
aad 0x53
cli
sub esi, dword [edx + 0x59fc28f0]
out 0x38, al
pushal
mov dl, 0xde
insb byte es:[edi], dx
movsb byte es:[edi], byte [esi]
push ecx
out dx, al
fst dword [edi]
arpl di, di
sbb edx, dword [esi]
xchg ebx, eax
mov dword [ebx - 0x71de5dd7], esi
sub esp, esi
lahf
clc
shl ebp, cl
xor cl, cl
dec eax
xor eax, 0x307eaafb
and ecx, dword [0xd95ba083]
mov al, byte [0xdd878931]
insb byte es:[edi], dx
shr dword [eax + 0x41], 0xcb
rcl dword [eax + edi*4 - 0x333bed74], cl
xor dword [ecx - 0x3e932279], ecx
push 0x94d3cb41
mov eax, 0xccc4128c
adc al, 0x4d
pop edx
in al, dx
xchg edi, eax
push ebp
dec ebp
xchg esp, eax
push edx
and al, 0x42
les ebp, [eax + 4]
jg 0x439d3f
and cl, byte es:[ecx]
dec edx
mov eax, dword [0x852185f6]
insd dword es:[edi], dx
invalid
Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bd9c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd9c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test bl, bl
je 0x44b86d
or dword [esi], 0x657590
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x48a262
Capabilities:
Encode data using xor

Disassembly:
fsubr qword [edx - 0x7df82f97]
pop edi
add dword [eax + 0x3c], ebp
xchg byte [esi + 0x4d766ec3], dh
xor bh, al
adc eax, 0xb57e125e
sbb eax, 0x8e513915
dec ebx
rol esp, 1
inc edi
and dword [esp - 0x27], edx
xor dh, byte [eax - 0x48be622f]
mov edx, dword [edx + 0x29]
pop eax
xor al, 0x8b
lodsd eax, dword cs:[esi]
add dword [ebx + edi*8], ebx
push ds
push 0x704dfc9a
dec ecx
pop ds
loope 0x48a26f
ret
mov ebp, 0xc362c3fd
jne 0x48a30c
std
ret
mov dword [0x5c222bc0], eax
adc dword [edx - 0x6bea134b], esi
add dword [edx + 0x61], edx
and dword [eax - 0x4c2de041], ebx
movsd dword es:[edi], dword [esi]
adc dword [0x7c874a9b], ecx
jns 0x48a2a4
fnstsw word [edi + 0xe]
jg 0x48a2d7
fst dword [ebp - 0x325c091c]
pop esp
or dword [esi + 6], edx
fstp qword [edx]
cdq
push eax
outsd dx, dword [esi]
mov eax, dword [0x1c8343a4]
mov dl, 0xa9
lds esp, [ebx - 0x6ce94282]
invalid
cld
repne cmpsb byte [esi], byte es:[edi]
test eax, 0xb83c262c
lodsb al, byte [esi]
mov esi, 0x9ce944ae
pop ecx
and eax, 0x131c4225
pop ebp
jecxz 0x48a2c6
movsd dword es:[edi], dword [esi]
in eax, dx
and cl, dl
invalid

Function at 0x512521
Capabilities:
Encode data using xor

Disassembly:
or bl, byte [ebx]
ffreep st(6)
push 0xb88b16d0
sub byte [eax - 0x5e4cfb3e], ch
jo 0x512523
xchg dl, bl
int1
pop esi
sbb byte [esi], dh
jl 0x51245c
jns 0x5124ab

Function at 0x514bd0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x8ca776b
cli
inc ebp
inc ebp
xor eax, 0xc26051f0
mov bh, 0x59
jg 0x514c22
call 0xa9190ed5
xchg esi, eax
pop es
mov ebp, 0xe5cb3a7a
clc
hlt
das
xchg esp, eax
xor byte [ecx], 0xd7
push edx
xlatb
cmpsd dword [esi], dword es:[edi]
shr cl, cl
sub byte [ebx + ecx - 0x37], 0xf0
sal byte [edx + 0x2f], 1
mov eax, dword [0x50379a1d]
scasb al, byte es:[edi]
and dword [esi], esi
pop es
xor byte [0x6bb124ae], cl
daa
shl dword [edx + 0x5b], 0xec
and ah, ch
xchg edx, eax
mov ebp, dword [eax]
invalid
Function at 0x51f22a
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x90
invalid
pop ds
mov ah, 0xf
pop edx
add ah, al
adc eax, 0x6826cd11
loopne 0x51f1cb
or ecx, dword [esi - 0x4a961b16]
mov eax, 0x2bcd529
leave
aad 0xbc
add cl, cl
cld
iretd
mov ah, 0xdd
stc
mov bl, 0xe0
jp 0x51f245
bound eax, qword [ebx - 0x279f6daa]
dec ecx
scasb al, byte es:[edi]
and eax, eax
movsb byte es:[edi], byte [esi]
dec ebp
cwde
xchg esi, eax
sti
pop eax
push eax
mov ebp, 0x28b53deb
mov al, byte [0x217821f1]
jge 0x51f1f1
or byte [ebx + 0xb], cl
je 0x51f206
js 0x51f283
loop 0x51f25a
invalid
outsb dx, byte [esi]
mov dl, 0x8f
cmp al, 0xb6
cmpsd dword [esi], dword es:[edi]
sub esi, esi
test al, 0x30
std
mov cl, 0xf8
pop esp
xchg ecx, eax
cmp dword [ecx], ecx
fisub word [eax + 0x6a]
xor dword [ecx - 0x55], 0xffffffe0
push ss
xchg edx, eax
or byte [0x6309b099], dh
popal
popfd
imul eax, dword [edx - 0x66], 0xbe23dfb2
jg 0x51f283
mov eax, 0x1508dffa
and al, 1
and al, 0xd5
bound eax, qword [ecx]
scasb al, byte es:[edi]
xor byte [ebx - 0x40], bl
sub esi, 0x39
aam 0x99
neg dword [edi - 0x293ee72f]
push ebp
aam 0xae
sal byte [ebx + 0x4c1270b8], cl
cmp dword [edi + 0x48], edi
dec eax
push eax
mov byte [ebp + 0x544bc6e5], bl
loopne 0x51f30d
ljmp 0xcbb2:0x1c766a39
retf
push esp
loope 0x51f369
xchg byte [ecx], cl
xchg ecx, eax
outsd dx, dword [esi]
cwde
mov al, al
adc edi, dword fs:[eax + ebp*2 - 8]
jl 0x51f377
clc
insb byte es:[edi], dx
adc byte [esp + edx], dh
dec eax
jmp 0x51f348
sub ah, byte [esi + edi - 0x48]
mov dword [0x966e27a2], eax
jns 0x51f2e3
mov ah, 0xb
jb 0x51f301
clc
dec eax
jge 0x51f2d3
mov al, byte [0xc1ef5fd9]
pop eax
mov ch, cl
invalid
mov ecx, 0x30233860
push ebx
in al, dx
and ebx, dword [eax]
insb byte es:[edi], dx
push es
push ebx
pushfd
inc ecx
xlatb
and eax, 0xf240a51a
jne 0x51f38f
wait
or dword [0x5f4f78ca], 0xfffffff3
sub al, 0x58
rcl dword [eax], cl
test al, 0x9c
into
inc eax
add byte [ecx + 0x7d], ah
in eax, 0x1d
inc edx
adc byte [0x20252f52], dh
pop edx
add bh, byte [ecx]
jne 0x51f409
loopne 0x51f336
test byte [esi + 0xe], 0x89
pop ebp
enter 0x2e88, 0xffffffffffffffdc
out 0xc1, eax
or al, 0xa4
lodsd eax, dword [esi]
sbb dl, byte [0x28919530]
jnp 0x51f419
mov ah, 0x8d
rcl byte [edx], cl
enter 0x4921, 0xfffffffffffffffb
sti
retf
push edx
mov ah, 0x8e
xchg esp, eax
sbb byte [edi + edx], dl
jae 0x51f46b
aaa
sbb dword [eax + esi*8 + 0x6c], edx
retf
jns 0x51f3c0
push 0xd6b688e6
or al, 0x6d
push ds
add dh, byte [edx]
stosb byte es:[edi], al
adc al, 0xa9
ret 0xb59e
cwde
cdq
jl 0x51f480
sub byte [eax - 0x17], ah
das
fnstcw word [esi]
pop eax
sahf
mov al, byte [0x2bed697e]
jmp 0x914dbe49
sti
nop
rcl ch, 0x51
out 0xee, al
xor ebp, edi
mov al, byte [ebx - 0x521237d6]
adc al, 0xe3
stosb byte es:[edi], al
cmpsd dword [esi], dword es:[edi]
fnstcw word [esi - 0x17]
push esi
lds ebx, [ebx + 0x17]
invalid

Function at 0x5b0d2a
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x828a3c8
xchg ebx, eax
test al, 0x28
dec edi
sub esp, dword [ebp + 0x1edde639]
outsd dx, dword [esi]
call 0xe5df3e3a
js 0x5b0cf5
jns 0x5b0d53
dec edx
stosb byte es:[edi], al
pushfd
and eax, 0xdccbd12e
shr ebp, 0xf8
out 0xbe, eax
push ss
mov dh, 0x28
Function at 0x5f80be
Capabilities:
Encode data using xor

Disassembly:
add al, 0xb7
pop esi
sbb byte [edx + 0x47], ch
in eax, 0
jnp fcn.005f80be
inc esi
inc eax
jl 0x5f8136
dec eax
scasd eax, dword es:[edi]
adc al, 0xa0
push ebx
sub esi, edi
cmp dword [ebp + ebx + 0x61e3a19b], 0x5e3977ac
sti
xchg byte [0x40435911], dl
push edi
push 0xffffffffffffffdc
or edx, dword [eax - 0x55]
xor ebx, esp
imul eax
mov cl, 0xf6
cmp al, 0xe2
adc al, dh
lea ecx, [ecx - 0x249b51d0]
ror byte [ebx], 0xb9
invalid
jbe 0x5f816d
and dword [ebx + ecx*8 + 0x63], esi
sbb ah, byte [ebx]
invalid
xchg edi, eax
int1
sbb dword [esi], ebx
dec edi
or eax, 0xa6aba03
push eax
wait
imul ch
ljmp 0x824d