joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42afe0
Capabilities:
Clear file content
Create pipe

Disassembly:
mov eax, dword [0x43c650]
sub esp, 0xc
push esi
mov esi, dword [0x43b368]
push edi
mov edi, eax
cmp eax, 0x5dd
jne 0x42b001
push 0
call dword [sym.imp.KERNEL32.dll_LocalHandle]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push ecx
call fcn.0042aef0
add esp, 4
cmp dword [0x43c650], 0x2f
jne 0x42b078
xor eax, eax
xor edx, edx
mov word [esp + 0x12], ax
xor ecx, ecx
mov word [esp + 0xa], dx
lea eax, [esp + 8]
push eax
mov word [esp + 0xc], cx
mov ecx, dword [esp + 0xc]
push ecx
mov word [esp + 0x18], dx
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.sokuxu
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call fcn.0042af60
add esp, 4
cmp dword [0x43c650], 0x568
pop edi
pop esi
jne 0x42b099
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add esp, 0xc
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, reloc.winmm.dll_timeGetTime
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4172b3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4172f2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4172f2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4172f2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4172f2
cmp dword [ecx + 0x74], 0xe
jbe 0x4172f2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x429590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4295bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4295bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6c8e2f7e
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x388429d6
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401270
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434008]
jne 0x40127a
repz ret
jmp fcn.00402118

Function at 0x413af8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409a51
and dword [ebp - 4], 0
cmp dword [0x436d9c], 0
mov ebx, eax
jne 0x413ba9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413c5a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413c5a
push eax
call fcn.004099df
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x436d9c], eax
call esi
push eax
call fcn.004099df
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x436da0], eax
call esi
push eax
call fcn.004099df
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x436da4], eax
call esi
push eax
call fcn.004099df
pop ecx
mov dword [0x436dac], eax
test eax, eax
je 0x413ba9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004099df
pop ecx
mov dword [0x436da8], eax
mov eax, dword [0x436da8]
cmp eax, ebx
je 0x413c01
cmp dword [0x436dac], ebx
je 0x413c01
push eax
call fcn.00409a5a
push dword [0x436dac]
mov esi, eax
call fcn.00409a5a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c01
test edi, edi
je 0x413c01
call esi
test eax, eax
je 0x413bf8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413bf8
test byte [ebp - 0xc], 1
jne 0x413c01
or dword [ebp + 0x10], 0x200000
jmp 0x413c3a
mov eax, dword [0x436da0]
cmp eax, ebx
je 0x413c3a
push eax
call fcn.00409a5a
pop ecx
test eax, eax
je 0x413c3a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413c3a
mov eax, dword [0x436da4]
cmp eax, ebx
je 0x413c3a
push eax
call fcn.00409a5a
pop ecx
test eax, eax
je 0x413c3a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x436d9c]
call fcn.00409a5a
pop ecx
test eax, eax
je 0x413c5a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413c5c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x426f60
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov dword [esp], 0x20
add dword [esp], 0x20
mov al, 0x65
mov byte [0x436e89], al
mov byte [0x436e8c], al
mov al, 0x6c
push 0x436e88
mov byte [0x436e88], 0x6b
mov byte [0x436e8a], 0x72
mov byte [0x436e8b], 0x6e
mov byte [0x436e8d], al
mov byte [0x436e8e], 0x33
mov byte [0x436e8f], 0x32
mov byte [0x436e90], 0x2e
mov byte [0x436e91], 0x64
mov byte [0x436e92], al
mov byte [0x436e93], al
mov byte [0x436e94], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x438678]
mov edx, dword [0x43738c]
lea eax, [esp + 4]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
ret
Function at 0x4270f0
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x438678], 0x930
jne 0x427110
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
push 0
call esi
push 0
push 0
call esi
pop esi
cmp dword [0x438678], 0x114e
mov eax, dword [esp + 4]
mov dword [0x43737c], eax
jne 0x427130
push str.dimamehay
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rol edi, 0x86
bswap edi
rcl edi, 0x8b
ror eax, 0xdb
inc ebx
bswap esi
neg edi
ror edx, 0x82
or ebx, 0xf2
rol esi, 0x59
not edi
and ebx, 0x68
bswap ebx
bswap edi
and eax, 0xd8
ror edi, 0x4a
neg edi
neg edi
bswap ebx
imul ebx
bswap ebx
neg ebx
imul eax
add eax, 0x63
or edi, 0x15
sbb ebx, 0xe2
sbb edx, 0xe0
sub ebx, 0x79
bswap ebx
sbb esi, 0x6c
ror ebx, 0x6b
neg edx
and edi, 0x3d
rcl esi, 0x81
not esi
inc ebx
not esi
imul ebx
not edi
rcl edi, 0x42
dec eax
not edx
dec esi
rol edi, 0xaf
sub edi, 7
bswap ebx
not edx
mov ebx, 0xf6
sbb ebx, 0x80
and eax, 0x16
xor ecx, ecx
xor edi, edi
bswap eax
ror edx, 0x17
dec edx
rcr edx, 0x35
inc eax
rcr ebx, 0xc7
rcr edx, 0x6e
neg edx
rol eax, 0x11
rcl ebx, 3
or eax, 0x77
inc eax
rcr esi, 0x8a
rol eax, 0x69
ror esi, 0xc8
rcl esi, 0x96
bswap edx
ror eax, 0x2a
bswap edi
inc edi
not eax
not esi
not ebx
sbb ebx, 0xef
rcr ebx, 0x64
mov ebx, 0x49
inc ebx
sbb edi, 2
bswap esi
inc edx
rcr edi, 0x79
add ebx, 0x7d
dec edx
imul esi
inc edx
imul esi
dec ebx
neg esi
bswap ebx
neg edx
add ebx, 0x91
and esi, 0xa2
bswap edx
mov edi, 0x6a
add esi, 0x84
dec eax
add ebx, 0xfb
not esi
rcr edi, 0xcc
rcl edi, 0x24
mov ecx, dword [ebp + 0xc]
ror edi, 0xff
and eax, 0xe2
sbb eax, 0x7a
sbb eax, 0xd0
neg esi
add eax, 0x80
rcl esi, 0xb
sub edx, 0x23
sub ebx, 0xff
bswap esi
inc edi
and ebx, 0x98
dec eax
neg eax
bswap esi
or esi, 0xd1
add edi, 0xe6
rcl ebx, 0x8d
sub edi, 6
imul edx
ror edi, 0x8f
dec eax
dec ebx
dec eax
add ebx, 0x36
mov ebx, 0xa0
rol esi, 0xa1
imul edx
bswap edi
bswap esi
sbb edx, 0x14
inc edx
imul edx
bswap eax
rcl edi, 0x28
neg edx
rcr eax, 0x30
or edi, 0x7c
rol esi, 0x53
rcl edx, 0xd9
inc eax
inc eax
imul edi
inc eax
bswap edx
and eax, 0xd6
ror esi, 0xcd
inc edi
imul edx
sub edx, 0xd4
mov edi, dword [ebp + 8]
xor esi, esi
xor esi, ebx
mov ebx, eax
not byte [edi]
mov ebx, esi
xor esi, ebx
mov eax, ebx
xor ebx, ebx
xor ebx, esi
mov eax, esi
mov esi, ebx
mov esi, esi
xor eax, eax
add byte [edi], 0x37
xor eax, eax
xor esi, eax
xor eax, ebx
mov esi, esi
xor eax, esi
xor eax, esi
mov eax, esi
mov ebx, esi
mov eax, esi
sub byte [edi], 0x75
mov esi, esi
mov eax, esi
xor ebx, esi
mov esi, eax
xor eax, ebx
mov eax, esi
mov esi, esi
xor ebx, eax
mov esi, ebx
imul byte [edi]
inc edi
loop 0x4013d1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4060e3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404fce
and dword [ebp - 4], 0
cmp dword [0x437060], 0
mov ebx, eax
jne 0x406194
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406245
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406245
push eax
call fcn.00404f5c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x437060], eax
call esi
push eax
call fcn.00404f5c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x437064], eax
call esi
push eax
call fcn.00404f5c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x437068], eax
call esi
push eax
call fcn.00404f5c
pop ecx
mov dword [0x437070], eax
test eax, eax
je 0x406194
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404f5c
pop ecx
mov dword [0x43706c], eax
mov eax, dword [0x43706c]
cmp eax, ebx
je 0x4061ec
cmp dword [0x437070], ebx
je 0x4061ec
push eax
call fcn.00404fd7
push dword [0x437070]
mov esi, eax
call fcn.00404fd7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061ec
test edi, edi
je 0x4061ec
call esi
test eax, eax
je 0x4061e3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061e3
test byte [ebp - 0xc], 1
jne 0x4061ec
or dword [ebp + 0x10], 0x200000
jmp 0x406225
mov eax, dword [0x437064]
cmp eax, ebx
je 0x406225
push eax
call fcn.00404fd7
pop ecx
test eax, eax
je 0x406225
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406225
mov eax, dword [0x437068]
cmp eax, ebx
je 0x406225
push eax
call fcn.00404fd7
pop ecx
test eax, eax
je 0x406225
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x437060]
call fcn.00404fd7
pop ecx
test eax, eax
je 0x406245
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406247
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407f4e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436808]
jne 0x407f58
repz ret
jmp fcn.00409675
Function at 0x4012a4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0040a2b3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4012ea
xor eax, eax
jmp 0x4012ed
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0040a8e8
lea eax, [edi + 0x7c]
test eax, eax
je 0x401308
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0040ac4d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x401346
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0040ac4d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.00409fcd
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0040a969
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44aba4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.00453bb3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x44abea
xor eax, eax
jmp 0x44abed
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.004541e8
lea eax, [edi + 0x7c]
test eax, eax
je 0x44ac08
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0045454d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x44ac46
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0045454d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call int.004538cd
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00454269
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a4c8
Capabilities:
Encode data using xor

Disassembly:
rcr byte [ebx + 0x2d905ec1], cl
inc edx
mov al, byte [0xd4710fbd]
ret 0xe7cb
dec ebx
sal dword [ebx + edx*4 - 0x5f432b50], 0x5a
xlatb
pop ds
cmp byte [edx + 0x7f], 0xd1
and eax, 0x1178db95
xchg edi, eax
loopne 0x45a4cc
push 0xc01efc7e
inc ebp
mov eax, dword [0x249fef57]
cli
cwde
cmp al, 0x4d
mov edx, 0x9390caa3
inc esi
mov dword [0x469390ca], eax
or byte [ebp + 0x252e2f1b], ah
sbb dword [esi - 0x36], eax
xor al, 0x9b
sti
sal byte [eax], 1
lahf
setp dl
wait
add dword [ebx], 0xdd54a124
jecxz 0x45a48a
adc dword [edx - 0x37], esp
xchg esi, eax
push edi
pop esp
mov bh, 0xf3
jo 0x45a4a5
push ebx
pop edx
ror dword [ebp - 0x4ca2c25d], cl
or al, dh
cld
wait
das
stosb byte es:[edi], al
mov bh, 0x76
in al, dx
imul esi, dword [edx + ebx*4], 0xffffffff
cmp esi, ebx
mov bh, 0x8d
movsb byte es:[edi], byte [esi]
xchg edi, eax
shr byte [eax + 0x4a], cl
loopne 0x45a595
adc byte [eax + 0x60], ch
push ebx
cdq
mov ebp, 0xbba27124
ror bl, 1
in al, 0xbf
dec edi
or dword [ecx - 0x5e], esp
invalid
pushal
pop es
adc al, 0xc
or al, 0x35
jl 0x45a5ac
or al, 0x50
outsd dx, dword [esi]
pop ebx
inc ecx
test byte [esi - 0x2362b09d], ch
push edi
sub al, 0x66
xchg esp, eax
pushal
add bh, byte [ecx + 0x190fac88]
sbb eax, 0x1fdbefdf
pop es
add ah, ah
xchg ecx, eax
in al, 0x91
std
sbb al, 0xb6
xchg esp, eax
xchg ecx, eax
xor ebx, edi
dec edx
je 0x45a598
popfd
js 0x45a570
in eax, 0x13
test dword [edx - 0x465a3b90], 0x1c7e26a4
movsb byte es:[edi], byte [esi]
jle 0x45a5cc
add byte [eax], al
mov ch, 0x2a
xchg ebx, eax
cmp edi, eax
fnstcw word [ebp - 0xdb6daa5]
pop es
cmp edx, dword [ebx + ecx*8]
scasd eax, dword es:[edi]
xchg byte [ebx - 0x1c], cl
jp 0x45a5fe
test eax, 0x6645aee2
dec edi
bound ebp, qword [edx + ecx*8 + 0x7c]
mov edi, dword [esp + eax*2 - 0x51]
fisubr word [esi + 0x31]
rol dword [ebp + 0x36], 0x53
mov al, 0x44
and byte [ebx - 0x3b], bh
fst dword [ecx + 0x3c7319d8]
mov dh, 0xb2
fsubrp st(7)
movsd dword es:[edi], dword [esi]
dec edi
stosb byte es:[edi], al
dec ecx
sbb dword [esi], eax
push ds
sahf
imul ebp, dword [edi + eax*4 + 0x42], 0x78
sbb dword [edi + 0x6be10d24], 0x87d2d235
cld
and al, 0xd
loope 0x45a669
xor eax, 0xfc87d2d2
idiv byte gs:[edx + 0x78]
jno 0x45a5ac
aas
bound ebp, qword [esi + 0x52]
adc ebx, dword [ebx - 0x14]
inc esp
cmpxchg dword [ebp + esi*2 + 0x54b81861], edi
dec ebx
mov bl, 0x40
cmp al, 0xbb
rol byte [ebp - 0x305d641b], 1
and dword [eax - 0xd], ebp
ja 0x45a5fa
retf 0xeea1
add ebp, dword [ecx - 9]
stosd dword es:[edi], eax
jmp 0x45a60a
Function at 0x49d493
Capabilities:
Encode data using xor

Disassembly:
test dword [edx - 0x695ade49], edi
mov edx, 0x96a521b7
push ecx
add esp, dword [edi + 0x2e]
inc esi
xchg ecx, ebp
adc edi, dword [ecx - 0xd0b55a2]
insb byte es:[edi], dx
scasd eax, dword es:[edi]
sub eax, 0xad011a55
das
insb byte es:[edi], dx
push esi
mov esi, dword [eax - 0x48e57c74]
sub cl, cl
inc ecx
out 0xf, al
sahf
xor eax, 0x5e
movsb byte es:[edi], byte [esi]
jne 0x49d501
shr dword cs:[esi], 1
xor dl, ah
sub al, 0x63
pop ebp
jg 0x49d4a7
sub edi, esi
xlatb
xchg edx, eax
invalid
add edx, dword [esi - 0x71]
cmp ch, byte [esi + 0x2f]
inc edi
mov word [edx], es
pop es
sub dh, bl
inc edi
insb byte es:[edi], dx
xor byte [ebp + 0x7e], bh
push ss
push ebx
retf 0xc45c
loopne 0x49d54c
stosb byte es:[edi], al
je 0x49d492
neg esp
push edi
pushfd
inc edx
push 0x35
das
imul edx, dword [ecx + 0x3c198bac], 0x4cf3cdec
xor eax, 0xac91692f
mov ebx, dword [ecx]
cmp al, 0xec
int 0xf3
dec esp
cmpsd dword [esi], dword es:[edi]
lodsb al, byte [esi]
aam 0x28
jl 0x49d50c
in eax, 0xfd
test esi, 0xe1a84e92
inc esi
jo 0x49d542
loop 0x49d4e4
and eax, 0x75f7d1ae
mov edx, 0x4c5e4217
xchg edi, eax
mov bl, byte [ebp + 5]
out dx, al
invalid
xchg edi, eax
and bh, byte [eax]
mov ecx, 0xac54962f
pop ecx
je 0x49d4f2
movsd dword es:[edi], dword [esi]
dec esp
das
invalid
Function at 0x49de2d
Capabilities:
Encode data using xor

Disassembly:
pop ebp
jg 0x49de7e
sbb ah, 0xa
std
cmc
sbb ebx, dword [0x6d2c7c5e]
in eax, 0xe3
sbb al, 0x9e
aad 0x40
invalid
add dword [esi + 0x22], eax
pop ss
pushal
fstp dword [esi + esi*2 + 0x5c]
mov dl, 0x48
pop ss
pop ss
shl byte [edx + eax*4], 0xdc
jns 0x49deae
ja 0x49de0f
invalid
jne 0x49deb1
adc byte [0x3ee5d98d], bl
jge 0x49de9c
in eax, 0x8d
fxam
jge 0x49de9c
and bh, ch
test byte [edi + 0x6a0ecebd], bl
and edx, 0xfd39f82
xor ebp, dword [ecx - 0x492b240d]
les eax, [ebp + ecx*4 - 0x1a]
mov byte [0x7f351006], al
out 0xf2, al
mov byte [0x7f351006], al
lodsd eax, dword [esi]
loopne 0x49df09
invalid
and ecx, ecx
jns 0x49de7a
enter 0x208f, 0xffffffffffffffd1
invalid
or esi, dword [edi]
dec edx
and bl, byte [esi - 0x206a6c9b]
push edi
popfd
pop ss
jo 0x49deb5
mov eax, dword [0xbe3b50d7]
mov ch, byte [ebx - 0x3e862ea7]
dec byte [edi - 0x67]
sub ebp, dword [esi + edi*4 - 0x6ec3b502]
jno 0x49df3a
sub eax, 0x1c80857
push ecx
in al, dx
push es
rol dword [esi + 0x21], 1
mov eax, ss
rol dword [esi + 0x72], cl
cld
mov ah, 0xca
xchg ebx, eax
cli
outsb dx, byte [esi]
xor edi, dword [esi - 0x1d]
xchg esi, eax
out 0x68, al
fld qword [ecx]
sbb cl, byte [0xcf351b7]
mov esp, 0xf232885d
push edi
xchg edi, eax
out 0xaf, eax
dec eax
outsd dx, dword [esi]
in al, 0x64
sahf
test al, 0x7b
movsb byte es:[edi], byte [esi]
sbb esp, dword [edi + 0x6f15bfc4]
pop eax
mov bh, 0xda
cmpsd dword [esi], dword es:[edi]
invalid
pop edx
arpl word [ebp + ebp + 0x64], dx
dec esi
leave
push edi
mov bl, 0xcf
call 0xf1907ba8
bound sp, dword [esi + 0xa1477cd]
fld dword [esi + 0x4cd57e1d]
pop ebp
and al, 0xf3
xlatb
mov byte [0x433a38f5], al
ficomp dword [edx - 0x31441a79]
mov bh, 0x49
pop ebx
mov esp, 0xacb7cc53
xchg ebp, eax
mov ecx, 0x75963c6d
xchg edi, eax
in eax, dx
xchg ebx, eax
add edx, dword [ebp + 0x1e]
add al, 0xc1
xor eax, dword [ecx - 0x2bb953ef]
idiv ah
mov bh, 0xc1
stc
mov bh, 0xa7
jne 0x49df41
int 0x7e
mov ebp, ss
or dword [edi], 0x52
cmpsd dword [esi], dword es:[edi]
insb byte es:[edi], dx
xchg edi, eax
inc esp
mov dword [ebp + 0x52], edx
cmp eax, 0xe2661d4a
js 0x49dfbb
dec esp
mov ch, 0x96
mov esp, 0x1221cac3
lea edx, [esi]
invalid
push ds
mov edi, 0x1d0388a2
dec ebp
xchg edx, eax
sub edi, esp
dec ebp
idiv dword [esi + eax*8]
mov eax, 0x5a2fee44
push 0xc61c7795
int 0x48
mov al, byte [0x3197983c]
sti
invalid
Function at 0x4a3da8
Capabilities:
Encode data using xor

Disassembly:
hlt
invalid
test byte [ebp - 0x7f], cl
jo 0x4a3ce8
outsb dx, byte [esi]
jl 0x4a3d38
scasb al, byte es:[edi]
in eax, dx
fdiv qword [0x1b236249]
cld
cmc
dec ebp
cwde
ljmp 0x4c2f
sub al, 0x71
jae 0x4a3db7
inc ecx
das
nop
invalid
lcall 0x628b, 0x47b8a20a
loop 0x4a3e21
cmp ebp, ebp
sete byte [ebx]
cmp al, 0xe3
xor al, 0x11
lodsb al, byte [esi]
jg 0x4a3d52
test byte [eax + 0x2e], ch
xchg edi, eax
invalid
out dx, eax
sub eax, dword [ecx - 0x32db035a]
push eax
push esi
jecxz 0x4a3e72
inc edx
insd dword es:[edi], dx
and dword [ebp - 0x5f], edi
mov word [edx + 0x62d91a6a], ss
pop esp
fild dword [edi]
in al, 0xed
in eax, 3
ror byte [edx - 0x4e], 1
in al, dx
mov dl, 0xec
add dl, byte [edx + esi + 0x4855d5cc]
mov edx, 0x7fbbb8e7
and eax, 0xd0bc8b40
xor dword [edx + 0x38497633], 0x2d
daa
sub al, 0x5e
add byte [edi + 0x3f], dl
das
mov dl, 0xe7
sti
jg 0x4a3e40
xor dl, byte [edi + 0x50]
jmp 0x4a3e6e
outsd dx, dword [esi]
inc ebx
mov esp, 0x7a7c2ac3
fldenv [ebp + ebx*2 + 0x26576736]
fstpnce st(1), st(0)
sub bh, byte [edx + edi*2 - 0x27]
movsb byte es:[edi], byte [esi]
pop ebp
push edi
fstpnce st(1), st(0)
stosb byte es:[edi], al
imul ebp, dword [edx + 0x365c17a9], 0x8c0de081
pop edx
xchg edx, eax
mov ecx, 0x9c310c77
aam 0x22
inc esi
mov dh, byte [ecx - 0x64]
mov dword [ebp - 0x45dfcf26], 0x4d11bac4
adc dword [edx + esi*4], ebp
cmp al, 0xfe
or al, 0xc9
sub ch, byte [ecx - 0x54]
pop esp
lds edi, [0x96b04880]
insb byte es:[edi], dx
jne 0x4a3e93
cwde
push ecx
pop eax
sbb dl, byte [ecx + 0x21]
invalid

Function at 0x4f7a55
Capabilities:
Encode data using xor

Disassembly:
add dh, byte [ebp + 0x61]
popal
xor al, 0xa7
dec esp
xor esi, ecx
dec eax
lahf
push ebx
pxor mm1, qword [edi - 0x2208e315]
or edi, ecx
mov al, cl
sub eax, 0x13176a9a
cmpsd dword [esi], dword es:[edi]
dec ebx
sal byte [ecx], 1
aaa
adc eax, 0x5e79222c
jb 0x4f7a57
or ch, byte [edx - 0x5eb8d933]
invalid