joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439b42
Capabilities:
Encode data using xor

Disassembly:
cmp dword [edx + 0x1134bb16], ebp
inc edi
adc al, 0xdd
movsb byte es:[edi], byte [esi]
lea eax, [edi - 0x54]
sbb byte [ecx + 0x75], 0x88
dec esi
dec esp
je 0x439b8c
imul ebp, dword [edi - 0x30], 0x39
mov bh, 0x19
xchg ebp, eax
aaa
ror dword [ebx - 0x14bb42bc], 1
invalid
xor al, 0x4b
dec ebx
xor edi, dword [esi]
fstp st(2)
in al, 0xc3
add al, 0xd9
pop ds
stosd dword es:[edi], eax
jl 0x439b8b
pop esp
adc dword [edi + 0x60f14776], edx
cmc
and al, byte [ebx - 0x1b]
dec ebp
dec ebx
push ebx
dec esp
call 0xee80ac39
mov word [ebx - 0xf], es
js 0x439b57
xchg ebx, edi
fild dword [ebx + eax*4 - 0x3569f416]
add al, 0x5b
fadd qword [eax]
rcr byte [esi - 0x754fcb1c], 0xa0
stosd dword es:[edi], eax
loopne 0x439bc7
push es
shl byte [eax + 0x5b56c3a], 0x44
lodsb al, byte [esi]
ret 0x8a94

Function at 0x44862e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004492e6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0044878e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x448778
test ebx, ebx
jl 0x44871c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcfea92
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x44873d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x44872f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0044a0fe
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0044a0fe
add esp, 8
mov ebx, 0x80070057
jmp 0x44871c
Function at 0x45f28e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0045ff46
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045f3ee
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45f3d8
test ebx, ebx
jl 0x45f37c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd156f2
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45f39d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45f38f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00460d5e
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00460d5e
add esp, 8
mov ebx, 0x80070057
jmp 0x45f37c
Function at 0x47628e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00476f46
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004763ee
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4763d8
test ebx, ebx
jl 0x47637c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2c6f2
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47639d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x47638f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00477d5e
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00477d5e
add esp, 8
mov ebx, 0x80070057
jmp 0x47637c
Function at 0x48da7e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048e736
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048dbde
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48dbc8
test ebx, ebx
jl 0x48db6c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd43ee2
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48db8d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48db7f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048f54e
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048f54e
add esp, 8
mov ebx, 0x80070057
jmp 0x48db6c
Function at 0x4a4b3e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a57f6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a4c9e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a4c88
test ebx, ebx
jl 0x4a4c2c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5afa2
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a4c4d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a4c3f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a660e
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a660e
add esp, 8
mov ebx, 0x80070057
jmp 0x4a4c2c
Function at 0x4ba46d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2378
cmp edx, dword [eax]
je 0x4ba48f
add eax, 8
inc ecx
cmp eax, 0x4c2408
jl 0x4ba480
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2378]
jne 0x4ba5bd
mov eax, dword [0x4c6f00]
cmp eax, 1
je 0x4ba597
test eax, eax
jne 0x4ba4c0
cmp dword [0x4c22a0], 1
je 0x4ba597
cmp edx, 0xfc
je 0x4ba5bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba4f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bae50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb2e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba53a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb2e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf904
push edi
call fcn.004bd1b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bae50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bae60
lea eax, [ebp - 0xa0]
push 0x4bf8e4
push eax
call fcn.004bae60
push dword [esi + 0x4c237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bae60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd124
add esp, 0x2c
pop edi
jmp 0x4ba5bd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c237c]
push 0
push eax
push dword [esi]
call fcn.004bb2e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x417e10
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
mov esi, 0x190
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
mov edi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417ee7
lea ecx, [esp + 0x24]
push ebp
mov ebp, 4
push ecx
push ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0x24], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call ebx
test eax, eax
jne 0x417e94
mov edi, dword [esp + 0x1c]
xor esi, esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Browse_For_Folder_Height
push eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call ebx
test eax, eax
pop ebp
jne 0x417ec2
or esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x417edc
mov ecx, dword [0x4c9b4c]
push 0x4c983c
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x47c547
Capabilities:
Encode data using xor

Disassembly:
or eax, dword [eax - 0x1c]
sub bh, ch
out dx, eax
out dx, eax
mov dh, 0x9e
xor byte [eax - 0x574967db], dl
sahf
pop ecx
ja 0x47c543
or bh, byte [ebx]
inc ecx
dec edi
push edx
sbb dl, bh
or dword [ebx], esp
int3
Function at 0x47e947
Capabilities:
Encode data using xor

Disassembly:
js 0x47e901
cmpsb byte [esi], byte es:[edi]
xor dl, ah
jge 0x47e93b
invalid
mov esp, 0x5072a6d1
mov esp, 0x6d36af39
insd dword es:[edi], dx
cmc
rol dh, 0x1d
push 0xffffffffffffff9e
dec esi
lds ecx, [esi + 0x37]
adc esi, dword [edx - 0x2f]
mov eax, dword [0x7eafbe90]
cmpsd dword [esi], dword es:[edi]
sub cl, bl
inc edi
mov bh, byte [ebp - 0x2677fa25]
nop
mov esi, 0x28a77eaf
fld dword [edi - 0x76]
mov ebp, 0xd98805db
fnstcw word [esi - 0x7ddd60df]
mov esi, 0x82229f21
add edi, edx
xor byte [ecx - 0x7f], cl
mov al, byte [0xd284325d]
jo 0x47e8be
xor al, byte [edx + edx*8 + 0x3bb28f70]
mov dl, 0x3b
push ecx
mul cl
xlatb
jge 0x47e910
mov byte [0x34e991c0], al
sahf
xchg ecx, eax
jmp 0x2d6d8773
xor al, 0x9e
and eax, 0x14fb582d
pop ds
push ds
lodsb al, byte [esi]
and cl, byte [ebp + 0x6da1cbba]
mov edx, 0x9b6da1cb
mov edx, 0x9b6da1cb
out dx, eax
rcr dh, 0x82
xchg byte [esi - 0x5ad8c2aa], ch
fidiv word [ebx]
mov esi, 0xe7405f0d
xor al, 0x71
test edx, edx
dec esp
sbb dword [esi - 0x4f21fffe], ebx
jle 0x47e8f8
pushfd
inc edx
jl 0x47e939
and byte [ecx + 0x7cc740be], ah
sal dword [eax], 0xdf
xchg esp, eax
pop esi
xor byte [ecx - 0x32780020], dl
dec esi
loop 0x47e908
cmp dword [eax - 0x52], esp
fdivr dword [edi - 0x6d424252]
mov al, byte [0x1a0b578]
push ds
inc ebp
out 0x41, al
js 0x47e91d
mov eax, 0x468d9123
jecxz 0x47e92a
rcr dword [edi + 0x523f1ad2], 0x7a
and ebp, dword [ebx]
cmpsd dword [esi], dword es:[edi]
add dword [edi - 0x2c], eax
psubusb mm5, qword [edi - 0x13d94219]
inc edi
aam 0xf
fsubr dword [edi - 0x13d94219]
mov ds, esp
out 0xe7, al
aam 0xf1
and ebx, edx
jl 0x47ea2e
and edx, ebp
dec ecx
adc eax, 0x76c799df
dec dword [ebp - 0xf803ff0]
cmpsb byte [esi], byte es:[edi]
adc eax, 0xa6450919
lahf
xchg dword ss:[ebp + 0x57], esp
jp 0x47e9a8
aas
wait
pop eax
xor dword [ebp + edx*8 - 0x75], edx
mov cl, 0x13
insd dword es:[edi], dx
inc esi
movsd dword es:[edi], dword [esi]
sbb ch, ah
push edx
push eax
mov bh, 5
mov dl, pe_nt_image_headers32
dec ebp
aad 0x55
test dword [ebx], eax
jmp 0x77fa9fb9
bound esi, qword [edx + 0x77]
or ebx, edx
jne 0x47ea17
push ebx
mov eax, dword [0xfaf765f5]
mov eax, dword [0xfaf765f5]
dec eax
shr byte [ebp + 0x45], 1
jg 0x47ea3f
dec eax
retf
push es
adc al, 0xc0
cmc
mov byte [0x8ad52ff4], al
aad 0x8a
in eax, 0x87
je 0x47ea7a
jge 0x47ea11
xchg esp, eax
aas
call 0xe18b2697
jns 0x47ea61
sub dword [ebp + 0x45772349], edx
jecxz 0x47ea27
xchg edx, eax
xchg ebx, eax
leave
aam 0x66
jle 0x47eaa5
hlt
cmp al, 0x65
iretd
jae 0x47ea8e
rcl dword [edi - 0x42]
xchg byte [edi + ebp], dh
xor al, 0x2f
cmc
imul dword [eax - 1]
inc esp
salc
pop edx
inc eax
stc
loop 0x47ea80
adc al, 0x65
and eax, 0x9e1851d2
and eax, 0x9e1851d2
sal word [edi - 0xaf6045c], cl
sti
or ebp, esi
mov eax, dword [0x61becbd1]
push ecx
jnp 0x47ea98
push edi
inc ebp
leave
adc al, 0x27
pop ebx
push edi
invalid
Function at 0x47f327
Capabilities:
Encode data using xor

Disassembly:
invalid
xor esp, esp
dec esi
jbe 0x47f3aa
jp 0x47f2b2
clc
xor ch, byte [eax]
or eax, 0xe4792e0e
out 0x90, eax
xor ch, byte [edi]
arpl word [edi + 0x36], bx
sti
and ecx, dword [ebp - 0x10f8614]
jne 0x47f3a3
inc eax
pop ds
stosd dword es:[edi], eax
cmp ecx, dword [edx + ecx*2]
or al, 0x4a
loope 0x47f34b
push ebx
rcl byte [ebx - 0x65], cl
arpl word [0x3eb88d10], dx
add ch, byte [ebx - 2]
push 0xffffffffffffffc3
cld
invalid
cld
and al, byte [edi + edi*8 + 0x63]
js 0x47f330
pop es
jae 0x47f35b
dec edi
xor eax, 0x7baec191
dec esp
scasb al, byte es:[edi]
jnp 0x47f3bd
xor al, 0x5b
invalid
call [ebx]
fdivrp st(1)
sub dword [edx], edi
sub ch, byte [ecx]
outsb dx, byte [esi]
js 0x47f3fc
ja 0x47f36e
jmp [edx - 0x50cfe045]
enter 0xffffffffffffd068, 0x3a
or esp, dword [eax]
sbb al, 0xf4
sti
mov bl, 0x26
insb byte es:[edi], dx
push ecx
xor byte [ebx + 0x5f], cl
push es
js 0x47f396
mov eax, dword [0x7b864fce]
aas
into
dec edi
xchg byte [ebx + 0x3f], bh
cld
cmpsb byte [esi], byte es:[edi]
idiv dword [ebx]
add dword [ebx + 0x7af957f8], ebp
mov dl, 0xa6
inc esi
loope 0x47f348
mov ch, 0x8d
add ebp, ecx
dec esp
mov cs, edx
push ds
pushal
adc byte [edx], dl
dec eax
jbe 0x47f3bb
je 0x47f35f
adc dword [esi - 6], ebx
jge 0x47f3dd
push ss
cwde
mov esi, dword [edx]
mov dh, byte [eax + 0x1d]
js 0x47f382
das
mov al, 0xf2
sub al, byte [esi + 0x2b]
in al, 0x97
xor dword [esi], esp
and dword [edi], esi
mov ebx, 0xfea582d2
inc ebp
test dh, ah
jno 0x47f3e0
stc
add eax, eax
mov ebx, 0x3bfb4c4
stc
push ds
cmpsb byte [esi], byte es:[edi]
sub dword [ebx - 0x49], edi
stc
inc edi
scasb al, byte es:[edi]
neg dword [ecx + 0x76]
out 0x43, eax
loope 0x47f463
aaa
test dword [edx + 0x24bc26da], ebx
in eax, 4
xchg byte [eax], bh
adc ebp, dword [bp + di - 0x2648]
sub al, 0x37
jae 0x47f437
sub ebp, 0x22ee3581
jns 0x47f455
jne 0x47f448
push 0x57830927
pop ebx
pop esi
sbb esp, dword [eax - 0x14fe0995]
sub dword [ecx + 0x771e5d15], esp
cmpsb byte [esi], byte es:[edi]
or dword [ebp - 0x4b], esp
clc
iretd
jmp 0x47f462
xor eax, 0x5b963014
insb byte es:[edi], dx
mov al, 0xe4
pop dword [eax - 0x528f9d6a]
jo 0x47f404
mul byte [ecx + eax*2]
pop es
xor al, 0x8d
sar dword [ebx + 0x50], 0xb2
int1
int1
arpl word [eax + 0xfa01721], sp
push edi
ret 0xb02c