joyce8/EMBER2024-capa huggingface dataset:
Function at 0x617415f0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
test byte [0x61743028], 8
jne 0x61741670
test esi, esi
je 0x617416ca
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x617416d1
mov dword [eax], 1
test byte [0x61743028], 8
jne 0x617416a0
mov dword [esi], ebx
xor eax, eax
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.handle__p._n
mov dword [esp + 8], str.CreateInteractionContext
mov dword [esp + 4], 0x61743028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6174160e
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Created_context__p._n
mov dword [esp + 8], str.CreateInteractionContext
mov dword [esp + 4], 0x61743028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x61741657
mov eax, 0x80004003
jmp 0x6174165b
mov eax, 0x8007000e
jmp 0x6174165b

Function at 0x617416e0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x61743028], 8
jne 0x61741738
test ebx, ebx
je 0x61741762
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.context__p._n
mov dword [esp + 8], str.DestroyInteractionContext
mov dword [esp + 4], 0x61743028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x617416fd
mov eax, 0x80070006
jmp 0x61741727
Function at 0x617425b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6174260b
cmp byte [esi + ebx - 1], 0xa
je 0x617425df
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x61743118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x438860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x438882
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x438889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x438878
mov eax, 1
add ebx, ebx
jne 0x43889b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x438890
jne 0x4388ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x438890
xor ecx, ecx
sub eax, 3
jb 0x4388c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x438932
mov ebp, eax
add ebx, ebx
jne 0x4388cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4388d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4388fc
inc ecx
add ebx, ebx
jne 0x4388e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4388dd
jne 0x4388f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4388dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43891c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43890d
jmp 0x43887e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43891c
add edi, ecx
jmp 0x43887e
pop esi
mov edi, esi
mov ecx, 0xe0e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43893a
cmp byte [edi], 0xa
jne 0x43893a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x43893f
lea edi, [esi + 0x36000]
mov eax, dword [edi]
or eax, eax
je 0x4389b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3820c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x382ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43896c
mov ecx, edi
jns 0x43899b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x382b0]
or eax, eax
je 0x4389b1
mov dword [ebx], eax
add ebx, 4
jmp 0x438989
call dword [esi + 0x382b4]
popal
jmp 0x41be59
Function at 0x4b63b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6e000]
push edi
or ebp, 0xffffffff
jmp 0x4b63d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b63d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b63c8
mov eax, 1
add ebx, ebx
jne 0x4b63eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b63fc
jne 0x4b641b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b641b
dec eax
add ebx, ebx
jne 0x4b6408
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b63e0
add ebx, ebx
jne 0x4b6417
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b646d
xor ecx, ecx
sub eax, 3
jb 0x4b6433
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b64a2
sar eax, 1
mov ebp, eax
jmp 0x4b643e
add ebx, ebx
jne 0x4b643e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b640c
inc ecx
add ebx, ebx
jne 0x4b644c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b640c
add ebx, ebx
jne 0x4b6459
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b644e
jne 0x4b646a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b644e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b648c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b647e
jmp 0x4b63ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b648c
add edi, ecx
jmp 0x4b63ce
pop esi
mov edi, esi
mov ecx, 0x2bea
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b64aa
cmp byte [edi], 0x1e
jne 0x4b64aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b64af
lea edi, [esi + 0xb3000]
mov eax, dword [edi]
or eax, eax
je 0x4b6527
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb72bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb73c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b64dc
mov ecx, edi
jns 0x4b650b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb73c4]
or eax, eax
je 0x4b6521
mov dword [ebx], eax
add ebx, 4
jmp 0x4b64f9
call dword [esi + 0xb73d4]
mov ebp, dword [esi + 0xb73c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b655b
sub esp, 0xffffff80
jmp 0x45d8f7
Function at 0x445ea0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x39000]
push edi
jmp 0x445eba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x445ec1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x445eb0
mov eax, 1
add ebx, ebx
jne 0x445ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x445ec8
jne 0x445ee4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x445ec8
xor ecx, ecx
sub eax, 3
jb 0x445ef8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x445f6a
mov ebp, eax
add ebx, ebx
jne 0x445f03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x445f10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x445f34
inc ecx
add ebx, ebx
jne 0x445f20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x445f15
jne 0x445f31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x445f15
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x445f54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x445f45
jmp 0x445eb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x445f54
add edi, ecx
jmp 0x445eb6
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x445f72
cmp byte [edi], 9
jne 0x445f72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x445f77
lea edi, [esi + 0x43000]
mov eax, dword [edi]
or eax, eax
je 0x445fef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6de98]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6df78]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x445fa4
mov ecx, edi
jns 0x445fd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6df80]
or eax, eax
je 0x445fe9
mov dword [ebx], eax
add ebx, 4
jmp 0x445fc1
call dword [esi + 0x6df7c]
mov ebp, dword [esi + 0x6df84]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x446023
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x424964
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0xf4cae016], eax
ret 0x4556
mov esi, 0x75841f63
or dword [ebx + 0x8f423ca], 0x744d8e0f
mov cs, word [ebp + 0x74]
cmpsd dword [esi], dword es:[edi]
xlatb
inc ebp
and ah, byte [0xb34dffa1]
sal byte [edi + 0x3b], 0x5f
sahf
adc byte [edi], 0x5d
in al, 0xc5
enter 0xffffffffffff93cd, 0
lds esi, [ecx]
int 0x9f
jge 0x4247f5
push 0xb948cb82
cmc
popal
jb 0x4247b9
add dh, ch
test al, 0x2b
cmp eax, 0xdb065ed4
pop ebx
sbb al, ah
pop esi
pop ebp
salc
out 0xe5, al
xor al, byte [edi + 0x4a]
dec edx
sbb byte [edi + ecx], 0xc3
sbb eax, 0xef63d814
adc al, 0xd8
arpl di, bp
cmp al, dl
setg byte [eax]
xchg esp, eax
movsd dword es:[edi], dword [esi]
outsd dx, dword [esi]
mov esi, 0xf95dc9e9
sti
div dword [eax]
mov al, byte [0x49f7f1db]
pop ebp
sahf
sahf
pop edx
lodsb al, byte [esi]
jb 0x4247e9
test byte [edx - 0x6d], bl
mov edx, 0xf0b40728
or al, 0x2b
add al, 0xbe
or al, 0x49
ja 0x424837
insb byte es:[edi], dx
jb 0x424831
add dh, dl
add esi, dword [ebp - 0x13fc62b7]
aas
adc dword [ecx + edi + 0x3907930f], esi
invalid
jge 0x424932
dec edx
inc ebx
push edx
add eax, 1
pop ebx
jg 0x424851
push edx
mov byte [0xeaeb9d12], al
xlatb
scasd eax, dword es:[edi]
int1
wait
outsd dx, dword [esi]
scasd eax, dword es:[edi]
adc dword [edx + 0x3e867e4e], edi
aaa
salc
and dword [ecx - 0x38], eax
or eax, 0x3ceb7b6c
ror dword [eax], cl
test dword [edx], esp
cmpsb byte [esi], byte es:[edi]
pop eax
mov es, word [edx + 0x48]
leave
sub al, 0xb2
insd dword es:[edi], dx
cli
pop es
jle 0x4248b7
mov dl, 0xad
cmp bh, byte [ebx - 0x48]
mov ebx, 0xe07b2bb3
ret
popal
xchg esi, eax
mov dh, 0x99
and al, 0xb0
les esp, [esi]
int1
in al, dx
test eax, 0x5c3669b7
invalid
cmp dword [eax], 0x10f5da45
xchg ebp, eax
std
leave
inc ebx
xchg edi, eax
add dh, byte [ecx + 0x2daac0d6]
jnp 0x4249f0
dec esi
dec eax
loop 0x424910
loope 0x424904
xor byte [edx + 0x3e692b1d], bl
mov eax, 0x26e385d2
push ecx
xchg cl, ah
xchg edx, eax
mov esi, 0xfc74a2cc
mov ch, 0x96
fidiv word [ecx + 0xe]
adc dword [ecx + 0xf95588], 0xe6f753e9
sbb eax, 0x6b501abb
add eax, dword [eax + 0x61]
inc ebx
invalid
jmp 0x9c3f7a88
cwde
xchg ebp, eax
jge 0x424a3d
ret 0xf0c5
push 0x35
or edi, edx
cmp dword [0x654f0fff], esi
maxps xmm0, xmm3
xor eax, 0x3539fa0b
dec dword [edi]
dec edi
maxps xmm0, xmm3
mov bl, 0x63
xor al, 0xda
mov dl, byte [ebx - 0x35]
jl 0x4249da
out 0xb1, eax
js 0x424a3c
lds esi, [edi + edx*8]
xchg esi, eax
adc eax, 0xbdc57d9d
in eax, 0xbd
add eax, 0x6de525bd
inc ecx
test eax, 0x2981e961
loope 0x424ad8
shr dword [ecx + 0x2981e961], 0xe1
imul eax, dword [ecx - 0x57], 0x2189e161
jmp 0x69e413e3
dec ebp
scasd eax, dword es:[edi]
inc ecx
scasd eax, dword es:[edi]
or dword [ebp - 0x4ff26af9], ebx
rcr byte [esi], 0xd3
popfd
insb byte es:[edi], dx
sbb eax, 0xcde4cdce
or dword [ecx], 0x4100be3
mov ch, 0x1e
push 0x15dde31d
fidiv word [ebp - 0x15]
aad 0x9e
xor al, 0xf1
sub al, 0x9e
pop eax
sahf
push ecx
push ecx
xor dword [ebp + 0x17], ebx
dec eax
mov esi, 0x695e5495
mov edx, 0xeb0d5e89
xchg ebp, eax
push cs
jge 0x424aab
adc dword [eax + 0x38ef7c36], edx
cli
invalid
Function at 0x42891f
Capabilities:
Encode data using xor

Disassembly:
fdivr qword [edi]
cld
invalid
cmp byte [ecx + 0x57], ch
inc eax
xchg edx, eax
fist word [eax]
push 0x6b
mov eax, dword [0xccee1c9a]
cmpsb byte [esi], byte es:[edi]
jle 0x4288bb
sbb al, 0xee
int3
imul ebx
sbb byte [esi + 0x1bc4e32c], dh
inc eax
cdq
and dl, 0x88
mov gs, word [0xfe14ce9e]
xor al, 0xaa
mov fs, word [eax + 0x2b]
or ebp, dword [esi + 0x7299e10]
jbe 0x42892a
sbb ah, cl
add eax, 0x9c8ed809
push esi
jmp [ecx + 0x1f]
Function at 0x437982
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ebx], ch
sbb al, byte [ebx]
mov bl, 0x77
inc ebx
jecxz 0x43794e
adc al, 0x3d
inc edi
cmpsb byte [esi], byte es:[edi]
mov ebp, 0xb0537cac
jl 0x437967
mov al, 0xb7
mov ch, 0x12
jle 0x437974
shl dword [edx + 0x79], 1
push esp
xchg bl, ch
or dword [ecx], edx
ja 0x437935
mov cl, 0x24
cmpsb byte [esi], byte es:[edi]
and al, 0xa6
adc ecx, dword [esi + 0x33]
xchg byte [eax], dl
ret
mov dl, 0xe6
invalid
shl dword [ebx + 0x4b37cabd], 0xeb
add dword [ebx + ebx - 0x2951281b], ecx
salc
mov byte [esi + 0x36], ah
add dword [0xf0776393], esp
aaa
and eax, 0xcab45c1a
push esi
imul esi, dword [ecx + 0x7a], 0xf7a7d22b
push es
aas
pop ecx
loopne 0x4379ee
inc edx
mov ch, 0x97
ja 0x437925
dec eax
jns 0x437960
or al, 0x30
mov byte [esi + 0x63], cl
test dword [esi + esi*2 - 0x686681f5], esi
xchg edi, eax
push ecx
invalid
cmp al, 7
fist dword [ebx - 0x4f8aff48]
push 0xffffffffffffff80
cmp byte [edx], 0x2f
lahf
aaa
adc al, 0xf7
xor cl, dh
add byte [edx + 0x379f2f3a], 0x14
div dword [edx]
into
push esi
inc ebx
fst dword [edx]
push edi
jo 0x4379e5
sar dword [ecx], cl
jns 0x43798c
sub eax, 0xc2f9bec
sahf
loopne 0x4379f7
insd dword es:[edi], dx
xor al, 0x71
inc ebx
imul ecx, dword [eax + 0x1c], 0xffffffb7
mov bh, 0x1b
adc eax, 0x6759cfc6
shl dword [eax + edx*8 + 0x68b9fdf1], cl
pop ebx
lahf
out 0x50, al
popal
out dx, eax
and dh, byte [edi - 0x41]
xchg esp, eax
xchg dword [ecx - 0x589133d5], esp
add esp, dword [ebp + 0x4f329602]
sbb esi, dword [ecx]
mov eax, dword [0xc1b2c9e4]
in eax, 0xc1
jb 0x437a58
add esp, dword [ecx]
jae 0x437a4b
popal
loope 0x437a63
insd dword es:[edi], dx
mov esp, 0xee1f69d2
pop edi
aad 0x91
outsd dx, dword [esi]
iretd
dec ecx
ret
pop es
lodsd eax, dword [esi]
mov dh, 3
sub dword [edx], esp
pop ebx
push ds
add dh, byte [ebx]
sahf
imul edi, ebx, 0xda199335
fidiv dword [ecx - 0x7c394d1b]
sub al, 0xa3
fst dword [edi + 0x3fa7fbb2]
bound ecx, qword [ecx]
test al, 0x53
xchg dword [ecx + 0x6b6fabde], edx
pop ebp
xchg esi, eax
aaa
and ebx, eax
out dx, al
test dword [eax], ecx
test al, 0x80
outsd dx, dword [esi]
xchg esp, eax
adc dword [eax - 0x1c3ee09a], ecx
cwde
loop 0x437aec
mov dl, 0x30
invalid
invalid
jmp edx
push edi
fadd st(2)
xchg edi, eax
pop es
pushal
xor esi, dword [eax + 0x79]
sti
rol edi, 0x1a
out dx, eax
mov dh, 0x92
push ss
xchg edx, eax
dec ebx
insd dword es:[edi], dx
dec ecx
aam 0xbe
jl 0x437ae1
sub dword [ecx + ebx*4], ecx
outsd dx, dword [esi]
cmpsd dword [esi], dword es:[edi]
pop es
and esi, dword gs:[ebx - 0x75]
jne 0x437abd
xchg edi, eax
stosd dword es:[edi], eax
jbe 0x437ab5
insd dword es:[edi], dx
adc byte [ebx - 0x4ac54151], 0x84
jno 0x437ac4
mov edi, gs
ror dword [eax + 0x2037c34f], cl
pop ss
adc edx, eax
and byte cs:[ebx + 0x41], al
inc esp
bound eax, qword [edi + edx]
sub eax, dword [ebx - 0x61]
mov edi, 0xf767362d
add al, 0xb8
neg dword [ebx - 0x52]
int 0xd9
mov ebx, 0x53379783
Function at 0x438dd2
Capabilities:
Encode data using xor

Disassembly:
cmp esp, esi
les ecx, [ebx + edx*8]
push ebx
add dword [esi + ebx + 0x5cec3f89], edx
daa
cwde
add byte [edi + 4], bl
xchg bl, dh
mov edi, 0x83529e80
wait
or eax, 0x2504c87c
pop esi
jle 0x438e56
mov bl, bl
invalid
add dword [eax + 0xaae83c6], edx
sbb al, 0x1b
fsubp st(4)
mov cl, byte [edi - 0x4d351a6f]
mov eax, 0x9783422c
push ecx
stosd dword es:[edi], eax
test byte [ecx], al
sub ah, byte es:[esi + 0x1c99ee]
mov dl, 0xb8
sub al, 0x42
adc dword [edi + 0x184ab51], 0x26
sub ah, byte [esi + 0x1c99ee]
ror dword [esi], 1
xchg ebp, eax
insb byte es:[edi], dx
sbb byte [edx], ch
xor bl, bh
fimul word [edx + 0xd9311e1]
je 0x438e5d
mov dh, 0xaf
add cl, byte [edx - 0x8d728cb]
add ecx, dword [edi]
xchg esi, eax
or byte [eax + 0x1a33875e], 0x51
xchg byte [ecx], bl
xchg ecx, eax
mov word [ebx - 0x31], fs
sbb ebp, edi
jb 0x438e9a
inc dword [esi + 0x1fafe10f]
xchg byte [edi], cl
loope 0x438e4e
pop ds
mov byte [esi], ah
adc esi, ebp
cmp dl, cl
ret

Function at 0x442993
Capabilities:
Encode data using xor

Disassembly:
jge 0x4429f0
and al, 0x8c
and al, 0x8c
fucomi st(3)
dec edi
in eax, dx
cmc
and eax, 0x6b232b09
cmpsd dword cs:[esi], dword es:[edi]
pop es
xchg ebx, eax
xor dword [edi + ebp*8 + 0x213aa94a], edi
sub byte [esi + ebx*4], ch
jo 0x442996
popal
adc eax, 0xe5b2dffe
add byte [0x30a0e35e], ah
ja 0x4429ec
loop 0x442a07
fmul st(2)
shl dl, cl
push 0x566de3e8
fsub qword [edi + 0x1312d35d]
pop bp
outsd dx, dword [esi]
ror byte [edx - 0x30], 1
mov bh, 1
mov dword [0x2d91f320], eax
jl 0x4429ff
imul edx, ebx, 0xffffffde
push edi
mov eax, 0xdc008dda
test byte [ebp + 3], al
lea eax, [eax + 0x27]
inc ebp
add ecx, dword [ebp + 0x5f1e2740]
daa
push ds
pop edi
lds ebx, [edi]
jno 0x442a0c
ret
xor esp, dword [edx]
sbb byte [esi], cl
and eax, 0x532ef5d1
push ebx
push ebx
nop
mov eax, dword [0xe47dd5a4]
jge 0x4429f2
mov eax, dword [0x2e05bdc]
loope 0x442a06
invalid
Function at 0x469648
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
dec ebp
add dword [eax + ebp - 0x15], ebp
sti
pop esp
rol dl, 0xd1
nop
mov edi, 0x31a4c090
jmp es:[ebx - 0x53]
jg 0x4695c6
jmp 0x46959a
inc esp
or al, 0x5e
inc ecx
pop ds
mov dl, 0xb8
pop ebp
rcr dword [eax], 1
sub byte [0xbd318057], bl
jle 0x469626
outsb dx, byte [esi]
adc dword [esi - 0x5a], eax
sti
in eax, 0xa0
imul edi, dword [ecx + 4], 0x47
invalid
sahf
or al, 0x9e
sbb al, 0x4e
fsubr qword [ecx]
scasb al, byte es:[edi]
mov ds, word [ebx + ebp*8]
jae 0x4695b6
imul edi, ecx, 0x31
into
or al, 0x4b
outsb dx, byte [esi]
dec esi
jmp 0x46965b
xchg ebp, eax
mov al, byte [0x8a336888]
das
les edi, [edx]
cmp dl, byte [edx - 0xd]
outsb dx, byte [esi]
mov cl, 0xcd
cwde
cmp ebp, eax
sar dword [ebp - 0x47], cl
push ecx
fst qword [ebx - 0xb]
adc ecx, eax
or al, 0x3c
out dx, eax
sbb dh, ah
sal dword [eax], cl
loop 0x4696c7
invalid
jle 0x4696c7
jge 0x4696c1
jbe 0x469608
mov esp, 0x3cbb57b7
adc edx, 0x11
mov bh, 0x57
mov ebx, 0x11d2833c
rcl byte [ecx], cl
or al, 0xf3
dec ebp
xor al, 3
outsb dx, byte [esi]
inc ebx
loop 0x469651
cmc
leave
invalid
push 0xb883ebb
into
cmp dword [ecx + edi*2 + 0x1a2d79ef], ebx
inc edi
enter 0x5a7f, 0x71
sub al, 0xfe
insb byte es:[edi], dx
invalid
Function at 0x469894
Capabilities:
Encode data using xor

Disassembly:
mov bh, 1
salc
add byte [eax - 0x40b563bc], dh
mov dword [edi - 0x77], ebx
mov ebx, 0xb742a54c
add edi, edx
add byte [eax - 0x4dba6cba], dh
test byte [ebp - 0x77], bl
mov esi, 0xb84e994f
or eax, 0x43e50ddb
xchg esp, eax
inc esi
mov dl, 0x8a
pop esi
mov byte [ebx - 0x4a8d658d], bh
add edx, esp
add dh, byte [edx + eax*2 - 0x7f49be69]
push esi
xor byte [esi - 0x4eb86eb9], 6
rol byte [0x449245b3], 1
add eax, 0x449245b3
mov dl, 0x8b
pop ebp
mov bh, byte [edx + ecx*2 + 0x8be499f]
fldenv [ebx + 0x429442b4]
mov bh, 0x81
push edi
xor dword [edi - 0x49be68bf], 0xb600d600
inc eax
xchg esi, eax
inc eax
mov dh, 0x80
push ecx
xchg dword [ecx - 0x4eb86eb9], esi
pop es
rol dword [edi], 1
mov al, 0x46
nop
inc esi
mov al, 0x86
push ebx
test dword [ebx - 0x4dba6cbb], esi
add al, 0xd2
add al, 0xb2
dec ebx
popfd
dec ebx
mov esp, 0xbb8e5e8a
dec ebp
add eax, 0xd601b443
push es
mov bl, 0x4b
popfd
dec edx
mov esi, 0xb4835503
inc ecx
xchg edi, eax
inc eax
mov cl, 7
rol byte [esi], 1
mov al, 0x4b
popfd
dec ebx
mov esp, 0xba895c8a
jae 0x4698d7
inc edi
mov eax, 0xb100d733
inc edi
xchg ecx, eax
inc edi
mov esp, 0x85818588
inc edi
xchg ecx, eax
inc edi
mov cl, 7
rol dword [edi], 1
mov cl, 0x45
xchg edx, eax
dec ebx
mov esp, 0xbb8d5989
jae 0x469976
sbb al, 0x51
cmp eax, 0x3e535e33
jae 0x46998a
push ebx
aas
mov dl, 0xd8
push esp
cmp dh, byte [esi + 0x17]
pop ebp
xor dword [edx + edx*2], edi
cmp al, 0x52
pop edi
xor eax, dword [ecx + 0x2c]
push ecx
cmp al, 0xb0
ficom word [ecx + edi + 0x7a]
adc byte [ecx + esi + 0x3f], bl
push ebx
pop esi
or al, 0x71
sbb al, 0x53
jno 0x4699a8
push ebx
mov dl, 0xd9
pop ecx
xor al, 0x7b
adc byte [ebx + esi + 1], bl
pop ecx
push edi
cmp dh, byte [edi + 0x14]
pop eax
mov esp, 0x710c5ed2
sbb eax, 0x5e300c61
push edx
cmp dword [edi + 0x1b], esi
pop ecx
xor al, 0xb8
aad 0x5b
jp 0x4699cb
pop edx
xor byte [0x7e325f51], bh
adc esp, dword [ecx + 0x3c]
mov cl, 0xdd
push eax
jae 0x4699e3
push ebp
cmp byte [0x773a5459], dh
sbb dl, byte [edi + 0x3b]
mov dh, 0xdb
pop ecx
xor eax, 0x375a177b
cmp dl, byte [edi + 0x5a]
aaa
jge 0x469a08
push ebx
mov bl, 0xde
push ebx
jae 0x469a02
push ds
push ebx
xor ebx, dword ds:[edi + 0x52]
aas
jb 0x469a0b
push edx
aas
mov ch, 0xd8
push ebp
cmp byte [ebp + 0x18], dh
push ebp
cmp byte [ecx + ebx*2], dh
push esp
cmp dword [ecx + ebx + 0x54], esi
cmp dword [edi + 0x773a57da], esi
sbb dl, byte [edi + 0x3a]
pop ebx
ja 0x469a1e
push edi
cmp dh, byte [esi]
pop ebx
push esi
cmp esi, dword [esi + 0x1b]
push esi
or al, 0xb1
fcom qword [ecx + 0x3c]
jno 0x469a30
sbb edx, dword [esi + 0xc]
mov cl, 0xdc
push ecx
cmp al, 0x71
sbb al, 0x51
push ecx
cmp al, 0x31
nop
push eax
adc al, 0x41
sbb eax, 0xdde13d25
loope 0x4699fd
in eax, dx
cmp eax, 0xd8502ce9
xor byte [eax + edx*2 + 0x614c7300], bl
pop ecx
ficom word [ebp + 0x4524513f]
xchg ebp, eax
aas
push ecx
and al, 0x45
pop esp
xchg esp, ebp
jmp 0x53f2b449