joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x58913b02
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x95e487e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x413de9
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x97033703
not byte [edi + 0x2a]
test eax, 0xb0450dca
pop eax
add esp, dword [edi]
cmp al, 0x36
enter 0xffffffffffffc08b, 0x7e
enter 0xffffffffffffc08b, 0x7e
and dword [ebp - 0x3c6ea57f], edx
cmpsd dword [esi], dword es:[edi]
push esp
adc dword [edx + 0x7d], ebx
not byte [eax + 0x1e]
ja 0x413e13
pop esp
adc byte [edi - 0x7588fdb], ah
jne 0x413dd8
sti
cmp byte [esi + ebx*8], bh
test byte [ebx], bh
loope 0x413e67
stosb byte es:[edi], al
inc ebp
cmp edi, ebx
sti
iretd
cmp eax, 0xdc49bd43
dec esi
cwde
inc ebx
mov ebp, 0x984edc49
xchg byte [eax + ecx*2 + 0x72], al
call 0xcf269108
mov al, ch
neg dword [edx]
inc edx
mov edx, 0xa69d2cb7
fmul dword [esi]
xor eax, 0x606be865
jbe 0x413ec1
mov edx, 0x9aeb91c1
sar edi, 1
sbb dh, dh
mov esi, 0x10c61a8e
inc edx
enter 0xffffffffffff871a, 0xffffffffffffffdb
pop dword [esi]
popfd
sub ebx, ecx
pop ebx
or edi, dword [ebx + 0x59]
mov dword [ecx], ebx
cld
cmp esi, dword [esi + ebx*4]
xchg ebx, eax
wait
or byte [eax - 0x38bd4ae9], ch
popal
lcall 0x2074, 0x7a104eb7
lodsd eax, dword [esi]
xor byte [ecx - 0x2804d48], bh
invalid
mov dl, 0x7f
std
jg 0x413ec0
mov esp, dword [edx + ebx + 0x73811cfd]
and bl, byte [eax]
jg 0x413e66
lcall 0x52f5, 0xa0e3cb9c
aad 0x68
mov al, byte [0x68d552f5]
loope 0x413e71
inc ebx
mov edi, 0x245abb03
sub cl, byte [ecx + 0x7ba7459b]
jne 0x413eb3
fsub dword [ebx]
popal
cmp bl, byte [ecx + 0x3b]
jne 0x413ed2
outsb dx, byte [esi]
add dword [ebp + 0x70], eax
inc ebx
jp 0x413f25
outsb dx, byte [esi]
pop ds
scasd eax, dword es:[edi]
mov dword [0x9af04d39], eax
sbb ecx, esp
int1
dec byte [edi]
or dh, byte [ebp + 0x71864316]
inc esi
xchg byte [ecx + 0x46], dh
push 0x9309c4ae
sbb bh, byte [esi - 0x646594bb]
int3
insb byte es:[edi], dx
out dx, al
wait
leave
push 0x19
test ecx, ebx
jne 0x413f07
or byte [eax - 5], al
sbb dword [eax - 0x17d66e18], eax
xchg ecx, eax
mov edx, 0x4bbca887
sub cl, byte [edx - 0x65]
push ds
Function at 0x44c6c5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.004556d4
mov dword [esp + 0x28], 0
test esi, esi
jne 0x44c70b
xor eax, eax
jmp 0x44c70e
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.00455d09
lea eax, [edi + 0x7c]
test eax, eax
je 0x44c729
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0045606e
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [fcn.0051b194]
test ebx, ebx
je 0x44c767
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0045606e
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call int.004553ee
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00455d8a
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e1adb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.004eaaea
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4e1b21
xor eax, eax
jmp 0x4e1b24
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call int.004eb11f
lea eax, [edi + 0x7c]
test eax, eax
je 0x4e1b3f
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.004eb484
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [fcn.0051b194]
test ebx, ebx
je 0x4e1b7d
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.004eb484
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.004ea804
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004eb1a0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eb2d7
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call 0xa14c3ea5
invalid
je 0x4eb2ca
int1
push edi
test dword [0x30b04ab], esp
sub eax, 0x5d233ba7
jb 0x4eb2e9
and ebx, dword [ebp + 0x67]
jb 0x4eb2e9
stosb byte es:[edi], al
jns 0x4eb2c1
adc eax, dword [ebp - 0x4e]
lahf
inc ebp
mov dl, 0x9f
fcomp dword [edx - 0x3781455]
movsd dword es:[edi], dword [esi]
out dx, al
sub ecx, dword [edx + 0x32148905]
add eax, 0x27321489
add eax, 0x27321489
and byte [esi], dh
imul ecx, dword [esi + 0x2f], 0x3431cb0d
jbe 0x4eb26a
xchg dword [ebp + 0x49991447], eax
inc edi
adc al, 0x99
dec ecx
xor dl, dh
cmpsw word [esi], word es:[edi]
mov eax, 0xfc0b1cbe
cmpsd dword [esi], dword es:[edi]
jbe 0x4eb363
mov dh, 0x4a
inc edx
push eax
je 0x4eb35f
adc eax, 0x771bc204
pop ds
inc edi
call [edi]
test eax, 0xfc85c700
jnp 0x4eb2b4
fdivr qword [edx - 0x698977da]
xor esp, dword [eax]
jg 0x4eb37e
adc eax, 0x2e5b3062
wait
sub dword [edx - 0x5924ee81], esp
in al, dx
lahf
aaa
pop ebp
jmp 0x4eb3c6
outsd dx, dword [esi]
dec esp
xlatb
in eax, 0x87
jmp esp
dec ecx
cmp al, 0xcd
push edi
push ecx
insd dword es:[edi], dx
or al, 0x6a
lcall 0xea97, 0xee17f330
cmpsd dword [esi], dword es:[edi]
pop edx
fucomp st(1)
bound ebp, qword [edi - 0x60]
aaa
dec ebp
or dword [ecx + 0x360c2d3f], esi
pop edx
invalid
invalid
push ds
sar esp, 0x86
sbb ah, byte [edi]
insb byte es:[edi], dx
mov bh, 0xbe
push edx
dec esp
xchg dword [esi + 0x67], ebx
jge 0x4eb3b7
call 0x83f3f472
push edx
pop esp
or byte [esp + ebp*8], ch
or eax, 0x9dd9c8c9
jne 0x4eb403
pop es
invalid
dec esi
invalid

Function at 0x4f4000
Capabilities:
Encode data using xor

Disassembly:
jo 0x4f4071
adc dword [ecx - 0x77], ecx
jno 0x4f4058
out dx, al
xlatb
mov dword [0x744874cb], eax
mov es, word [esi + edx*4]
mov al, byte [edx + 0xad2899b]
jle 0x4f3ff7
xor eax, 0xb70d239a
sbb eax, 0xa4d61d22
daa
cmp eax, 0x229e34c7
xor bh, byte [eax]
push 0xdfef3ff0
adc al, 0xc3
imul edx, dword [ebp + 0x6069763a], 0xffffffe9
nop
jl 0x4f405b
int 0x9e
pushfd
shr cl, cl
sub dword [esp + esi*2 + 0x4b], esi
push esi
cmc
mov dl, cl
aam 6
not word [edi - 0x49939037]
pop esp
pushfd
dec esi
das
or dh, ch
add eax, 0x2cf294b3
push edi
xchg esp, eax
pop es
rcr byte [edx], cl
in al, dx
sbb ch, ah
dec esi
dec ebp
mov byte [edi - 0x29], bh
invalid
xchg edi, eax
fldcw word [edi]
pushfd
sti
adc byte [edi], dl
cmp al, 0x14
jecxz 0x4f4081
aaa
ret 0x37f7
adc ch, byte [ecx]
outsb dx, byte [esi]
dec edi
jno 0x4f4031
xchg dword [ebp - 0x2ca8b3a1], edi
mov bh, 0xdc
cmp dword [ecx + ebp - 0x3c2602c1], 0x307e0632
push edi
sal dword [edi + 0x29bc81dc], cl
aas
std
fld st(3)
xor al, byte [esi]
jle 0x4f40ca
mov eax, ds
inc edx
add al, byte [ebx - 0x59884bc6]
xor ah, dl
xor ch, byte [ebx - 0x3464fcfa]
adc ebp, edx
mov edx, 0x434decf5
cmp esp, dword [esi - 0x64507568]
cmp byte [edi + 0x48], bl
jbe 0x4f408b
mov eax, 0xb1f64728
jns 0x4f407b
mov bh, 0x43
inc ebx
mov eax, dword [0xf9a6]
or bl, ah
insd dword es:[edi], dx
sub eax, 0x318f2ce7
xchg al, ah
dec eax
loope 0x4f40c3
fsubr qword [ebp + 0x2d]
out 0x2c, eax
invalid
retf
Function at 0x53e999
Capabilities:
Encode data using xor

Disassembly:
fadd st(0), st(0)
push edx
fcmovnu st(0), st(3)
scasb al, byte es:[edi]
mov byte [0xc81856d9], al
mov dl, 0xe7
jecxz 0x53e8f7
scasb al, byte es:[edi]
test byte [ebx + ebp*8 + 0x23f0e46a], bl
cmp al, 0x56
insd dword es:[edi], dx
xchg esp, eax
push 0x7c
aas
shld dword [0x9d4fb94c], edi, 0x11
xchg ebp, eax
insd dword es:[edi], dx
jns 0x53e953
mov ebp, 0x2ce849ce
push ds
adc ebx, esi
cld
retf 0x7afb

Function at 0x53eaf2
Capabilities:
Encode data using xor

Disassembly:
push ss
aam 0xcd
fldenv [ecx + ebx*4 + 0x13f4dd8d]
cmp al, 0xfa
mov cl, 0x70
salc
cmp al, 2
inc esp
dec esi
ret
and bl, dl
dec esi
stosd dword es:[edi], eax
xor eax, 0x33b03cf3
salc
dec edi
dec esi
push esi
sbb dword [esi - 0x43], eax
invalid
pop esi
cdq
loope 0x53ea7a
mov edi, 0x34e1cd3b
enter 0xffffffffffffe809, 0xffffffffffffff8b
cli
jo 0x53eacb
insb byte es:[edi], dx
inc ebx
cdq
mov cl, 0x2d
and eax, 0xa25c89a8
push ds
mov dword [0xd12eb55c], eax
lea eax, [eax - 2]
xor byte [edi - 0x6181675a], ch
add edx, ebx
cmp edx, edi
test eax, 0xbfeac2e6
fsub dword [esi]
mov ebx, 0xf315ee73
int1
pop esi
aam 0x6e
fild word [ecx + 0x44]
mov byte [ebp - 0x62], dh
push ss
or eax, 0xd2def220
push ecx
invalid
Function at 0x543b14
Capabilities:
Authenticate hmac

Disassembly:
push eax
loope 0x543a8d
push ecx
in al, 0x27
push ss
sbb dword [esi], ecx
xor esi, 0xace46ed0
push cs
in eax, 0x9b
pop esi
mov al, byte [0xb680dc61]
pop edi
pop esp
push 0xb464e1fc
shr dh, 1
popal
fadd qword [eax + 0x685c5fb6]
cld
loope 0x543afb
mov ah, 0xd0
out dx, al
or dword [esi - 0x77c36d7c], ebp
in eax, 0x56
in al, 0x70
pop ss
mov fs, word [0x352dc4ab]
dec esi
test dword [edi + 0x234178b], edi
xor eax, 0x8bbf854e
pop ss
xor al, 2
dec edi
jecxz 0x543aaa
cmpsb byte [esi], byte es:[edi]
push esp
retf
mov eax, dword [0x2f9d04cc]
fcom st(0)
inc esp
or ebp, dword [ebx - 0x74]
pop ecx
dec eax
jno 0x543a7a
jg 0x543a79
jg 0x543ad5
xor bl, byte [eax - 0x61]
lahf
in eax, 0x80
sbb esp, ebx
adc eax, 0x478372ac
iretd
inc ecx
bswap esp
inc esp
cmc
outsb dx, byte fs:[esi]
push 0x8e65c439
cmp dl, byte [edi + 0x44969722]
xor byte [ebx + 0x7c], dh
jae 0x543b8c
xchg esi, eax
salc
ja 0x543ac0
adc byte [esi], cl
outsb dx, byte [esi]
enter 0xffffffffffff91f8, 0x7c
fdivr qword [eax]
push edi
test eax, 0xd08a0523
aaa
in eax, 0xb7
jbe 0x543ba6
retf
add edi, edi
push cs
pop ss
jbe 0x543b0e
xor ebx, dword [edx - 0x48]
push esi
add eax, 0xb02b5eb2
push ebp
pop edx
mov eax, 0x5eb20556
sub esi, dword [eax - 0x4b9084ab]
test byte [edx - 4], cl
mov al, 0x55
jnp 0x543c06
mov ah, 0x84
dec edx
cld
ret 0xebe5
and al, 0x12
push 0xffffffffffffffef
je 0x543bf8
jge 0x543b85
xor eax, 0x29dbc91b
adc dword [ecx + ebp*4], 0xffffffe7
cmp al, 5
or dword [0x6ab57ae9], eax
mov ch, 0x6a
clc
invalid
mov ah, 0x18
jo 0x543c52
mov cl, 0xc1
and cl, byte [eax - 0x2eec60db]
cmp al, 0xc9
sti
jmp 0xbefabb5b
insd dword es:[edi], dx
jg 0x543b93
mov esi, 0x43eac8a4
invalid
aad 0xe3
or al, 0x36
jns 0x543bbf
invalid
cmp ebp, edi
clc
loop 0x543bd9
movsb byte es:[edi], byte [esi]
test byte [ebp - 0x36ac340], 0x46
invalid
jle 0x543bea
push es
mov ebp, 0xaf73d34b
mov bx, 0xde41
and al, 0xc1
push ebx
insb byte es:[edi], dx
xchg esi, eax
scasb al, byte es:[edi]
jg 0x543ca2
push edx
into
sub ecx, esi
std
movsb byte es:[edi], byte [esi]
fldcw word [edi + ecx*8 - 0x54637ec5]
rcl dword [eax + ebx*2 - 0x5a], cl
mov ebp, 0x9907b9d9
aam 0x16
fimul dword [esi + eax + 0x74b7e250]
das
movsb byte es:[edi], byte [esi]
int3
and eax, 0x64e5d40e
js 0x543cba
cmpsd dword [esi], dword es:[edi]
invalid
add byte ss:[ebx + 0x1aeb0a1e], dl
fcompi st(4)
xor al, byte [ebp - 0x40]
invalid

Function at 0x58e2a0
Capabilities:
Execute syscall

Disassembly:
cli
mov al, byte [0x2d3150cc]
test al, 0xc2
int 0x2e
Function at 0x58e330
Capabilities:
Execute syscall

Disassembly:
xor byte [edi - 0x2f], bh
dec eax
xchg esi, eax
xor ebx, dword [esi - 0x3a]
js 0x58e2a1
mov ebp, 0xc93d0342
jne fcn.0058e2a0
in eax, dx
sbb eax, 0x1ebdaf51
popal
mov esp, 0xe41f1b0f
push ds
pop ds
in eax, dx
or byte [ebx - 0x53], cl
test eax, 0x6c2956f8
insb byte es:[edi], dx
sbb eax, 0x2d6c366d
adc esp, esp
test eax, 0xcdc56d89
test byte [ebx + ecx*4 - 0x3f], 0xd
jbe 0x58e39a
invalid
clc
push esi
sub dword [esp + ebp*2 + 0x1d], ebp
insd dword es:[edi], dx
insb byte es:[edi], dx
sub eax, 0x89a9e413
insd dword es:[edi], dx
vpsadbw ymm0, ymm6, ymmword [ebx + ecx*4 - 0x3f]
or eax, 0x2f6d6976
invalid
insd dword es:[edi], dx
das
imul ebp, dword [ebp + 0x2f], 0x3833e4e0
insd dword es:[edi], dx
das
loopne 0x58e319
xor edi, dword [eax]
push eax
imul edi, dword [edi - 0x3c], 0x9ad2ee8c
dec edi
cmp al, 0x60
je 0x58e2f5
ret 0x58ab
push 0x7a9e4f07
wait
fldcw word [esi + 0x3d320586]
salc
loop 0x58e403
sbb eax, 0x8208cc19
xchg ecx, eax
lds edx, [esi]
cld
inc ebx
aas
mov ecx, 0x2055461c
invalid
mov dl, 0xbc
pop esp
imul edx, esi, 0x8bebcc95
lds ebp, [edi]
cmp dword [0x4d892d74], ebx
insd dword es:[edi], dx
aad 4
xlatb
leave
push ebp
xchg ebp, eax
stosb byte es:[edi], al
int 0x6d
invalid

Function at 0x5fb152
Capabilities:
Encode data using xor

Disassembly:
in al, 0x5e
fidivr word [edi]
xchg ch, bl
invalid
loop 0x5fb0db
pop ebp
mov bl, byte [edi - 0x5e47198a]
jo 0x5fb14f
into
mov edi, 0x1f777d62
insb byte es:[edi], dx
jp 0x5fb12e
cmc
sbb dword [eax - 0x5482c077], esp
cdq
leave
mov ebx, 0xb86f1f75
mov edi, 0xceaae93c
inc ecx
jmp dword [edi + 0xd808b4f]
loopne 0x5fb1af
call dword [ecx]
mov dword [edx], ecx
sub ch, bl
ja 0x5fb111
adc dword [ecx + 0x77dd280a], ecx
mov eax, 0x2992d297
push eax
push 0xffffffffffffffd6
xchg edi, eax
rcl byte [edx - 0x2995afd7], cl
lodsb al, byte [esi]
jge 0x5fb173
or ch, ah
in al, dx
xor dword [ecx], eax
add dword [ecx], 0xb0cf268c
cmp bh, ch
lodsb al, byte [esi]
loop 0x5fb164
mov ecx, 0x90d8b807
mov ebx, 0x43c0f1d3
dec esi
sbb ch, dh
cwde
jle 0x5fb1fd
xchg ebx, eax
mov ah, 0x34
dec eax
push cs
scasb al, byte es:[edi]
enter 0xffffffffffffdfce, 0x66
mov edi, dword [edx]
test byte [edx - 0x6a4ab0bc], dl
test eax, 0x41c7acfb
mov ebp, 0xc9f8f3f8
add ebx, dword [esp + ebx*2]
push 0xdb9604d9
sbb al, 0x67
rol esp, 1
jmp 0x5fb151
mov bh, 0xa9
ljmp 0x6bbb
inc dword [ebx - 0x506aac2b]
hlt
salc
sub cl, byte [ebx + 0x3ce67c18]
dec ecx
dec edi
loop 0x5fb1f4
push edx
pop esi
pop eax
int3
Function at 0x61c0fb
Capabilities:
Encode data using xor

Disassembly:
push esp
xchg esi, eax
add al, 0x48
dec eax
outsd dx, dword [esi]
out dx, al
push 0xb8d15795
mov dh, 0xba
in al, 0xf8
inc esi
mov ah, 0x12
mov bh, 0x67
dec dword [ebp + 0x42e78d3c]
mov cl, 0xf5
lea edi, [ecx*4 - 0xa4ebd19]
push edi
push ss
sbb ch, byte [edi]
pop ebx
xor dword [edx], eax
add edx, dword [ebx + 0x1d]
sahf
je 0x61c0ca
xlatb
and dword [edi + eax + 0x5c], eax
or al, byte [eax - 0x4c]
jnp 0x61c0dc
aaa
xchg esp, eax
test byte [eax], al
cmp ch, byte [esi + ebx*2 - 0x3bd5893c]
stosd dword es:[edi], eax
pcmpeqw mm1, mm2
imul esi, dword [ebx], 0xc92062d9
pop es
stosb byte es:[edi], al
imul eax, eax, 0xce2cc6ce
je 0x61c183
wait
outsb dx, byte [esi]
xchg esp, eax
idiv dword [eax + 0x3a]
jne 0x61c0c7
scasb al, byte es:[edi]
shr dword [edx], 1
lea esi, [edx + ebp*8 + 0x18]
push edi
sub esp, dword [edi - 0x6e]
sahf
push esi
sub ecx, dword [edx + ebp]
inc esp
mov ebx, 0x26b4b2e1
clc
xor al, 0xd1
out 0xa6, eax
xor edx, ebx
test ebx, eax
lodsb al, byte [esi]
mov ebp, 0xa943869c
adc al, 0x69
jno 0x61c17e
inc ecx
scasd eax, dword es:[edi]
push ecx
wait
fyl2xp1
lodsd eax, dword [esi]
leave
xchg byte [edx + 0x5e4ca6ef], al
or dword [edi], esi
in eax, 0x19
pop ebx
and edx, esp
xor ecx, dword [ecx + 0x3c]
jmp 0x61c11f
or eax, 0xe4e092c
hlt

Function at 0x61e2cd
Capabilities:
Encode data using xor

Disassembly:
jge 0x61e24b
sbb al, byte [esi - 0x5b0cbee9]
dec ecx
scasd eax, dword es:[edi]
test al, 0xfa
cmp al, 0xb4
invalid
add al, 0xb1
imul ebp, edi, 0x454914b0
in al, 0x79
xchg esp, eax
xchg edi, eax
mov edx, 0x24742689
inc edi
mov cl, bh
invalid
cmp esi, dword [esi - 0x69]
inc edi
imul ebp, dword [edx + 0xd95d537], 0xffffffee
inc edi
loope 0x61e28c
lahf
dec edx
pushal
pop ss
dec edx
dec ecx
mov edx, 0x8e764bd5
aad 0x4b
jbe 0x61e274
std
pop esi
and edx, dword [edi + 0x7d]
insb byte es:[edi], dx
jmp 0x61e34c
aaa
mov dword [eax], edx
jbe 0x61e2e2
push edi
aas
salc
dec edx
add eax, 0xe89cd6ad
lodsd eax, dword [esi]
salc
pushfd
call 0xc7e8691f
invalid
aad 0x70
invalid
mov ebx, 0x3a7f4903
mov bh, 0x50
test byte [eax - 0x58], 0x18
clc
add ecx, dword [ecx + 0x7f]
cmp dh, byte [edi - 0x57bf09b0]
sbb al, bh
loop 0x61e335
sub ch, al
mov dh, 0x5e
invalid
and eax, 0xabdb4345
lahf
movsd dword es:[edi], dword [esi]
cmp dl, bh
int 0xc1
sal edi, 1
invalid
invalid

Function at 0x61e978
Capabilities:
Encode data using xor

Disassembly:
sub dl, byte [edx]
out dx, al
and ah, bh
mov esi, 0x67985ccf
out 0x86, eax
cwde
out 0x86, eax
xor al, 0x41
dec ecx
push 0x44
inc esp
jge 0x61e980
pop edi
pop ss
cmp ecx, dword [ecx - 0x3cd4f0a2]
pop eax
loope 0x61e988
push 0x7e3f3d74
invalid
Function at 0x65a318
Capabilities:
Read file via mapping

Disassembly:
push edi
push esi
sub esp, 0x14
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ecx, eax
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFh]
mov byte [0x665b96], cl
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFh]
mov byte [0x665b95], cl
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFh]
mov byte [0x665b94], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFh]
mov byte [0x665b93], cl
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFh]
mov byte [0x665b92], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFh]
mov byte [0x665b91], cl
mov ecx, eax
shr ecx, 0x18
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFh]
mov byte [0x665b90], cl
shr eax, 0x1c
mov al, byte [eax + str.0123456789ABCDEFh]
mov byte [0x665b8f], al
mov dword [esp + 8], str.LocalFastMM_PID________
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.DLL_OpenFileMappingA
sub esp, 0xc
mov esi, eax
test esi, esi
je 0x65a423
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov edi, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
jmp 0x65a425
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
ret

Function at 0x65a438
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, fcn.0065ad02
cmp dword [0x66542c], ecx
jne 0x65a53d
mov ecx, fcn.0065b086
cmp dword [0x665430], ecx
jne 0x65a53d
mov ecx, fcn.0065b27e
cmp dword [0x665434], ecx
jne 0x65a53d
mov ecx, fcn.0065b598
cmp dword [0x665438], ecx
jne 0x65a53d
mov ecx, 0x659638
cmp dword [0x66543c], ecx
jne 0x65a53d
xor eax, eax
mov ecx, 0x659648
cmp dword [0x665440], ecx
jne 0x65a53d
mov ecx, dword [0xa6860c]
test ecx, ecx
jne 0x65a53d
call fcn.0065a318
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x65a53d
mov dword [esp + 0x14], str.LocalFastMM_PID________
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
sub esp, 0x18
mov dword [0xa6860c], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov dword [eax], fcn.0065ad02
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov eax, 1
add esp, 0x18
ret