joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100dfc3a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x100dfc90
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x100dfc69
call fcn.100e6a22
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x100dfc7e
call fcn.100e6a22
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x100dfc90
call fcn.100e6a22
call fcn.100d36c4
cmp dword [eax + 0x3c], 0
je 0x100dfca5
push edi
mov ecx, ebx
call fcn.100df36a
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.100dfe77
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x100dfcce
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x100dfcda
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100e1920
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x100e1973
push esi
push dword [ebp + 8]
call fcn.100e1b09
mov edi, eax
test edi, edi
je 0x100e196e
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100e196e
mov eax, dword [ebp - 8]
jmp 0x100e1985
mov eax, dword [ebp + 0x10]
jmp 0x100e1985
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x1010e92f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x1010e949
call fcn.100d36c4
mov esi, dword [eax + 0xc]
push 0x102759ac
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1010e99f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1010e99f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1010e97e
xor esi, esi
jmp 0x1010e994
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.1010e9a8
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x1010e9a1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x101a7f12
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x10254bec
call fcn.1020aee2
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.1000bbc0
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x10263a10
call fcn.100e0af0
cmp eax, 0xffffffff
jne 0x101a7fec
push 0
push 0x10275968
lea ecx, [ebp - 0x4d0]
call fcn.100e0af0
cmp eax, 0xffffffff
jne 0x101a7fec
push 0
push 0x10263250
lea ecx, [ebp - 0x4d0]
call fcn.100e0af0
cmp eax, 0xffffffff
jne 0x101a7fec
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.1000bbc0
mov edi, eax
pop ecx
mov dword [ebp - 0x4d4], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x4d8], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x101a7fbb
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x1025aa48]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.100d2730
jmp 0x101a8025
lea eax, [ebp - 0x218]
push eax
call fcn.1022428e
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.1000ed80
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.100d2730
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x101a8012
mov edi, dword [ebp - 0x4cc]
jmp 0x101a8025
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x1025aa48]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.100d2730
mov eax, edi
call fcn.1020ae8c
ret

Function at 0x101c1aa4
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.102258e6
pop ecx
test eax, eax
jne 0x101c1ae6
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.100d3d79
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x101c1aac
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret
Function at 0x1022e87f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1022e526

Function at 0x1022e88a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1022e6b0
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429004]
jne 0x401010
repz ret
jmp fcn.004014f3

Function at 0x407a15
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404c04
and dword [ebp - 4], 0
cmp dword [0x42bc9c], 0
mov ebx, eax
jne 0x407ac6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407b77
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407b77
push eax
call fcn.00404b92
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42bc9c], eax
call esi
push eax
call fcn.00404b92
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42bca0], eax
call esi
push eax
call fcn.00404b92
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42bca4], eax
call esi
push eax
call fcn.00404b92
pop ecx
mov dword [0x42bcac], eax
test eax, eax
je 0x407ac6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b92
pop ecx
mov dword [0x42bca8], eax
mov eax, dword [0x42bca8]
cmp eax, ebx
je 0x407b1e
cmp dword [0x42bcac], ebx
je 0x407b1e
push eax
call fcn.00404c0d
push dword [0x42bcac]
mov esi, eax
call fcn.00404c0d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407b1e
test edi, edi
je 0x407b1e
call esi
test eax, eax
je 0x407b15
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407b15
test byte [ebp - 0xc], 1
jne 0x407b1e
or dword [ebp + 0x10], 0x200000
jmp 0x407b57
mov eax, dword [0x42bca0]
cmp eax, ebx
je 0x407b57
push eax
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b57
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407b57
mov eax, dword [0x42bca4]
cmp eax, ebx
je 0x407b57
push eax
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b57
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42bc9c]
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b77
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407b79
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409ba0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x2713cb4], 0x930
jne 0x409bca
push str.Gahaw_tugez_kirapiface_fuya
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x2713cb4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x2713af8], eax
jne 0x409bfd
push 0
lea ecx, [ebp - 0x404]
push ecx
push 0
call sub.KERNEL32.dll_VerLanguageNameA
lea edx, [ebp - 0x420]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
mov esp, ebp
pop ebp
ret
Function at 0x1743e
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ecx + 0x6c], 0
je 0x1ecad
ret
xchg ecx, eax
mov ch, 0x16
xor byte [eax + 0x4c1dd43a], 0x1a
imul eax, ebp, 0xb0f52268
arpl word [edi + ecx*2], ax
xor dword [edx + 0xe632216], esi
push es
sbb ch, byte [edx + 0x70]
push 0x70
cwde
mov dh, 0x58
adc dword [ecx], 0x60
xchg edx, eax
jp 0x1ec3f
salc
jl 0x1ecd3
xor al, 0x1d
adc edi, dword [eax - 0x7e]
test eax, 0x76ab2425
jo 0x1ec5b
int3
and dword [ecx - 0x2a08369e], edi
jg 0x1ecd8
mov dword [ecx - 0x556eb6e8], esi
xor dword [ecx], 0xffffffe7
dec eax
jg 0x1ec94
cwde
rcl dword [ebx], 0x9d
out 0x8b, eax
out 0x8b, eax
std
xchg dword [edi], ebx
push esp
push esp
inc ebx
popal
mov ecx, eax
or al, byte [esi + 0x1f93dad]
add bl, byte [esi]
jl 0x1ec5b
dec ebp
mov ah, 0x26
xchg byte [ebx - 0x51fec02c], ah
sbb dl, byte [ecx]
and dl, byte [esi - 0x5416bf8b]
stosd dword es:[edi], eax
jl 0x1ec9c
xor byte [esi + 0x2c], bl
push es
sub al, 6
and edx, esp
invalid

Function at 0x3b08b
Capabilities:
Packed with generic packer

Disassembly:
popal
jae 0x3b101
and byte [ebx + 0x50], al
outsd dx, dword [esi]
insb byte es:[edi], dx
imul esp, dword [ebx + 0x79], 0x74617453
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0x3b0c0
sub ch, byte [ebx]
insb byte es:[edi], dx
popal
jae 0x3b11a
and byte [ebx + 0x50], al
outsd dx, dword [esi]
insb byte es:[edi], dx
imul esp, dword [ebx + 0x79], 0x74617453
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0x3b0d9
sub ch, byte [ebx]
insb byte es:[edi], dx
popal
jae 0x3b133
and byte [ebx + 0x43], al
popal
jae 0x3b12b
dec ecx
outsb dx, byte [esi]
jae 0x3b12f
outsb dx, byte [esi]
jae 0x3b136
je 0x3b138
jbe 0x3b136
push ebp
outsb dx, byte [esi]
imul esp, dword [ebx + 0x6f], 0x74536564
jb 0x3b145
je 0x3b14d
imul ebp, dword [esi + 0x67], 0x54727450
outsb dx, byte [esi]
push eax
je 0x3b153
push esp
popal
bound ebp, qword [ebp + 0x48]
insb byte es:[edi], dx
jo 0x3b150
jb 0x3b129
arpl word [ecx + 0x73], bp
jae 0x3b113
inc ebx
push eax
outsd dx, dword [esi]
insb byte es:[edi], dx
imul esp, dword [ebx + 0x79], 0x74617453
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x3b142
sub al, 0x37
sub al, 0x30
cmp bh, byte ds:[edx]
inc ebx
inc edx
jne 0x3b172
imul esp, dword [ebp + 0x74], 0x43
push 0x3a6e6961
cmp al, byte [ebx + 0x6c]
insb byte es:[edi], dx
popal
jb 0x3b16d
outsd dx, dword [esi]
inc ebx
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
bound esp, qword [ecx + 0x63]
imul eax, dword [eax], 0xffffff90
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
call dword [ebp - 0x75]
in al, dx
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
push 0x753db794
lea ecx, [ebp - 0x18]
call fcn.00020c60
lea ecx, [ebp - 0x18]
call fcn.00020c90
call 0xfe5eca2f
dec dword [ebp + 0x40e8e84d]
pop ebx
invalid
pop ebx
invalid
xor ebx, ebx
xor edi, edi
cmp dword [esi], ebx
jbe 0x3b16f
invalid
Function at 0x3e946
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [eax], ebx
call dword [0x74db15fc]
mov edi, dword [ebp + 8]
push 0x64
mov dword [ebp - 0x18], eax
pop eax
cmp dword [ebp + 0xc], eax
jb 0x5d378
push dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
call fcn.0003bd06
mov dword [ebp - 0x1c], eax
lea eax, [edi + 0x54]
mov esi, dword [eax]
mov dword [ebp + 8], ebx
fistp word [ebp + 0x78032d76]
cmp cl, dl
pop ss
push ss
sbb al, 0x7b
sub ebx, dword [0x7b2b04ab]
push ebp
add dword [ebx + 2], ecx
mov al, 0x4d
push eax
push ebx
add dh, byte [eax + 0x5350654d]
insd dword es:[edi], dx
aam 0x6f
pop edi
jne 0x5d304
rol dword [esi + 0x64], 1
xchg edx, eax
add ch, byte [esi]
push 0x35
rcl dword [edi + eax*8], cl
mov dword [0x1b3dfbc2], eax
loope 0x5d2f8
in eax, 0xe8
jp 0x5d2c2
leave
jae 0x5d310
stosb byte es:[edi], al
xor eax, 0x7212c4a9
mov bl, 0x43
push esi
push edx
cmp esp, dword [esi]
xchg esp, eax
rcr esi, 1
or edi, esi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
invalid
insd dword es:[edi], dx
pop esi
jae 0x5d2d7
cwde
push ebp
xor dword [esi + 0x2cc16031], edi
push esp
jns 0x5d30c
inc edx
or eax, dword [edx - 0x2c]
test al, 0xd8
mov cs, word [eax - 0xb97b631]
in al, dx
into
cmp al, byte [eax + 0x590eca7c]
in eax, 0x45
xchg byte [edx - 0x78], ch
mov dl, 0xfa
push 0xffffffffffffffc0
lea ebp, [ecx]
mov ch, 0xf2
ret 0x8bc2
and byte [edi], 0x48
popfd
mov ecx, 0xe6c50614
cdq
call [esi + 0x7ce7ebcd]
mov ch, 0xa7
in eax, dx
inc byte [ecx + edi*4 + 0x739aa3b7]
jb 0x5d387
jecxz 0x5d3b8
out dx, al
xchg ecx, eax
push eax
stosd dword es:[edi], eax
pop esp
rcl bl, cl
jecxz 0x5d356
jnp 0x5d3cf
loope 0x5d30c
pop edx
stc
jp 0x5d3d1
ror byte [0x91106e5c], cl
or eax, 0x91106e5c
jbe 0x5d30f
jecxz 0x5d383
outsd dx, dword [esi]
sbb edi, esp
add dl, byte [ebx]
sub ah, byte [edi + 0x14]
sub eax, 0x23a3c2bd
pushal
cmp eax, 0x4f78301a
jo 0x5d3c5
inc ebp
int3
Function at 0x3e9b5
Capabilities:
Packed with generic packer

Disassembly:
cmp esi, eax
je 0x3e9e9
cmp dword [ebp - 8], ebx
jne 0x5d394
cmp dword [ebp - 4], ebx
jne 0x5d3a6
cmp dword [esi + 0xe0], ebx
je 0x3e9d6
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push 1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0xffffffffffffffff
push dword [esi + 0xe0]
call dword [0x74e3319c]
add esp, 0x14
cmp eax, ebx
jne 0x3ea67
mov esi, dword [esi]
lea eax, [edi + 0x54]
jmp 0x3e98f
mov eax, dword [edi + 0x6c]
cmp eax, ebx
je 0x3ea33
push ebx
inc ebp
sbb byte [esi - 0x77], dl
test esp, esp
std
invalid
adc ebp, dword [edx]
adc al, 0x2d
mov ebp, 0x6023a3c2
ret 0x23a3
popal
mov ebp, esi
or bp, si
mov ebp, 0x659c1211
add ebp, dword [eax - 0x67904b07]
adc bl, byte [ebp - 0x4b0657fd]
outsd dx, dword [esi]
cwde
sti
pop edi
xchg esp, eax
or al, 0xa3
fdiv qword [eax + 0x3d2e47da]
sbb dh, byte [eax]
js 0x5d40d
mov bl, 0x79
sub dl, ch
or dl, byte [eax + 0x7e]
xchg dword [ebx + 0x34208c2d], ecx
push fs
xchg edx, eax
outsd dx, dword [esi]
invalid
jge 0x5d39a
add byte [ebp + edi*4 + 0x351d4d97], ch
psrlw mm4, qword [ecx - 0x66]
jge 0x5d40b
mov eax, 0x787f3304
inc dword [eax + 0x7322affe]
arpl word [eax + 0x798ee622], dx
or ebp, dword [esi + esi*2 + 1]
aas
inc ebx
movsd dword es:[edi], dword [esi]
leave
dec edx
aaa
mov ch, 0xb
xor al, 0x6e
and dword [edi - 0x38c5bb49], edi
jecxz 0x5d460
in al, 3
add edi, dword [ecx]
lcall 0xe0a4, 0x8eb20567
add dh, byte [edi]
inc esp
pushal
sub eax, 0x588c3499
je 0x5d49c
jno 0x5d4b0
cmpsb byte [esi], byte es:[edi]
adc eax, 0xd74d2efa
dec ebp
xlatb
pop dword [edx + 0x73]
adc al, 0xad
cmp al, byte [ebp + 0x152390ac]
xor eax, 0xf9f02dda
ljmp 0xe2a0
retf
cmc
push ecx
les ebp, [edx - 0x7b]
iretd
Function at 0x57beb
Capabilities:
Encode data using xor

Disassembly:
inc ecx
call 0x83bb3ac4
push esi
fadd dword [edx - 0x3f]
inc edx
invalid
invalid
inc edx
ror dword [edi + 0x48698809], 0xd1
sti
movsb byte es:[edi], byte [esi]
test eax, 0xcfeef68b
jg 0x57c20
aaa
xchg edx, eax
adc al, 6
invalid
add dword [ebx + 5], eax
mov word [esi + 0xdb4e800], es
dec esp
loope 0x57bfd
call 0x416b95c8
sbb ecx, esi
sahf
shl esi, 1
mov bh, 8
arpl bx, si
rcl dword [edi + 0x65fba5fe], cl
push 0x42abda23
test edx, ebp
jl 0x57c91
and esi, dword [edx - 0x1acb6571]
cmc
cmp al, 0x4e
mov edi, 0x1a5a7e62
les ecx, [edx - 0x27db5c07]
add dl, byte [edx + esi*2]
adc dword [eax], 0x89b83192
jle 0x57cb1
sbb al, ah
mov bh, cl
mov dword [0x1402d824], eax
jb 0x57be3
adc al, 0xa0
xchg edx, eax
xor dword [eax + 0x4898bb89], edi
aas
pop es
mov al, byte [0x89b83192]
mov ebx, 0x73f4898
popal
dec esi
jecxz 0x57ccb
sub al, 0x57
imul dword [ecx - 0x3d]
xchg esi, eax
sbb ecx, dword [0x5a5bc082]
or eax, 0x3fef30e5
retf 0xc71b
inc ecx
xchg dword [ebx], ecx
mov al, 0x5e
pop esi
mov dword [esi + 0x5e], esp
xor bh, bl
salc
push 0x118dd0ee
sbb eax, esp
cmp byte [edi], ah
jp 0x57c8c
jg 0x57c63
and dword [edi - 0x4b], edi
mov bl, 0xb8
jne 0x57c55
enter 0x6423, 0xffffffffffffffba
mov esi, ebx
mov ebp, esp
inc esp
or dh, byte [ecx - 0x21]
mov dl, 0xea
lodsd eax, dword [esi]
invalid

Function at 0x61366
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x7ba87344], al
or eax, 0x5b54fc62
and eax, 0x4156adcd
cdq
sub al, 0x44
mov ah, 0x4d
clc
cmpsd dword [esi], dword es:[edi]
dec ecx
mov byte [ebp + ecx + 0x1376767b], 0x92
sti
push 0x4c
push 0x5d8355cb
rcl esi, 0xff
push esi
fdiv qword [ebx]
adc eax, 0xfa3e8f1b
leave
adc edx, eax
pop esp
xor dl, byte [edx]
jbe 0x61394
fiadd dword [edx + 0x34]
stc
scasd eax, dword es:[edi]
mov dh, 0x49
rcl dword [eax - 0x28], cl
nop
sub edx, ecx
mov eax, 0x1db2a324
adc byte [ebx + esi*8], ah
dec esi
arpl word [edx - 0xa690e04], dx
adc dword [eax + edx + 0x30d1152c], 0xfffffff7
and esi, dword [esi]
adc al, byte [ebp - 0x4bfaf9b9]
shr al, 0xe1
push es
add eax, 0xe1e8c0b4
stosb byte es:[edi], al
fistp qword [esi - 0x33ff0e8d]
loope 0x613cc
push ss
retf 0x8b40
Function at 0x677bf
Capabilities:
Encode data using xor

Disassembly:
or ah, byte [eax + 0xa]
pop es
add byte [ecx], cl
add byte [edx + 0xa000000], ch
add byte [ecx], cl
add byte [edx], cl
add byte [ecx + 0xa000a00], ch
add byte [eax], al
add byte [ecx], cl
add byte [eax], cl
add byte [edx], cl
stosb byte es:[edi], al
or byte [eax], al
add byte [eax], al
or al, byte [eax]
or al, byte [eax]
add byte [eax], al
or dword [eax], eax
or byte [eax], al
or ch, byte [edx + 8]
or byte [eax], al
or byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
test eax, 0x9a00900
add byte [ecx], cl
mov al, byte [0xa0aa6a00]
add byte [eax], 0x9a
or ah, byte [eax + 0x860]
add byte [eax], al
add byte [eax], al
add byte [esi + 0xaaa], ah
add byte [eax], al
add byte [ebp + 0xa000889], ah
add byte [eax], al
add byte [ebp + 0x69], dh
stosb byte es:[edi], al
jp 0x6772e
mov ah, byte [eax + 0xa998500]
mov al, byte [0x70009008]
jne 0x676da
add byte [eax + 0x75], dh
test al, 0xaa
stosb byte es:[edi], al
or ah, byte [eax + 0x657a08aa]
mov al, byte [0x9090a08a]
or byte [edx - 0x5f777f8a], bl
test eax, 0x7670aaa0
nop
nop
add byte [edx], cl
add byte [edx], cl
jo 0x676ea
mov al, byte [pe_dos_header]
add byte [eax + 0x987], dl
add byte [eax], al
or dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
aam 0xaa
inc ebx
jne 0x67787
invalid
stosb byte es:[edi], al
push ecx
mov ah, 0x60
sbb eax, 0x1796f600
push ebp
add byte [ebx - 0x5cb6a107], bl
mov esi, 0xdff9d3aa
lcall 0xc82f, 0x5279fc2e
stosd dword es:[edi], eax
popal
sub al, 0
imul edx, dword [eax], 0xffffffd5
jbe 0x6780a
jo 0x677ae
or byte ss:[eax + 0x6f17d53d], cl
inc eax
and byte [ebx + 0x48], bh
xor dh, dh
and al, 0x78
pushal
pop dword [ebp - 0x4f]
inc ebp
invalid
outsb dx, byte [esi]
xchg ebp, eax
xchg esp, eax
popal
sub eax, dword [edi + 0x4483c0dc]
adc ah, bh
xor byte [esi], bl
inc esp
mov ds, word [eax]
add dl, byte [esi + 5]
add edi, ebp
nop
mov dl, 3
imul ecx, dword [edi - 0x4c], 0x12
mov ebp, 0x80cdcb04
sub dword [esi - 0x63386735], ebp
pop edx
pushfd
jo 0x677cd
mov dword [esi], esp
xor ebp, dword [edi + 9]
imul eax, eax, 0xffffffb1
push ecx
cmp dword [ebp - 0x40], ecx
xor eax, 0xc95ae507
xchg ecx, eax
jae 0x677c1
add al, 0x5e
add dl, byte [ebp + 0x75]
jg 0x67862
out 0x77, al
xor dword [ecx - 0x6376d866], ebp
in al, 3
cmp esp, dword [esi + 0x1c9baaa8]
and dword [edi], edi
mov bh, 0x1e
or dword [edi], edi
in al, dx
fcmovu st(0), st(7)
nop
int3
jg 0x67880
cwde
cmp bh, byte [ebx + ebx*4]
and eax, 0xde65bfef
add byte [edx - 0x68], 0xe3
push edx
add dword [edx + 0x18], ecx
imul eax, dword [edx + esi*4], 0xfd186ef
adc eax, 0xd3ec198e
or byte [edx - 0x13], dh
in eax, dx
sbb esp, ebp
ror dword [eax], cl
jb 0x67871
in eax, dx
pop es
lahf
loopne 0x6787e
lea eax, [esi]
ret 0x5889
Function at 0x90b66
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 0x10], eax
jne 0x90b88
cmp dword [ebp + 8], 0xc
je 0x90b81
cmp dword [ebp + 8], eax
jne 0x9309c
xor eax, eax
inc eax
pop ebp
ret 0xc
cmp dword [ebp + 8], 0xc
jmp 0x90b7b
out dx, al
scasb al, byte es:[edi]
bnd js 0x930d1
mov bh, 0x21
sahf
stosd dword es:[edi], eax
fcom dword [esi]
rcr byte [0x747ea062], 1
ret 0x27b
mov byte [0x83cfa03a], al
cmc
mov dh, byte [edi - 0x515737e1]
dec esp
cwde
test al, 0xd5
sub ecx, dword [esp + esi*8 + 0xf]
push es
outsb dx, byte [esi]
pop dword [esi]
push es
mov ebp, 0x8d0744b2
xor dword [edx], ebx
loop 0x9307e
mov edx, 0xd3058e12
pop es
mov dh, 0xc0
sub al, 0x1f
mov byte [0x837289f8], al
fiadd word [edi - 0x27eb71cf]
add ecx, edi
xor ebp, dword [edi + edi*2 + 0x53]
jae 0x930b3
fadd dword [ebx]
iretd
shl dword [esi - 0x6a], 0x80
add bh, byte [eax + esi*8]
cdq
test dword [edi - 0x10], 0xc30fd90d
cli
sahf
invalid

Function at 0x933df
Capabilities:
Encode data using xor

Disassembly:
pushfd
out dx, eax
dec edi
push eax
invalid
jbe 0x933a8
and cl, 0xc7
adc byte [edi + 0xa8e7318], ah
dec esi
jecxz 0x93411
loop 0x9337d
inc edi
jbe 0x9343b
pop ebx
jno 0x9336c
add ah, ch
sbb byte [0xe592f374], 0x79
mov dword [0xb5567720], eax
inc ebp
push 0x8fe8f7d1
xor dword [eax + 0x2b], esp
aaa
xchg byte [ebx], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0xb09], bl
add byte [eax], al
add byte [eax + 0xb], bl
add byte [eax], al
add byte [edi + 0xbb00b], dh
add byte [eax], al
add byte [edi + 0xa], al
add byte [eax], al
add byte [esi - 0x4f4fff57], dl
mov al, 0xb0
or ecx, dword [ebx]
add byte [esi - 0x4fff4455], al
add byte [eax], al
add byte [esi + 0xbb000aa], al
mov ebx, 0xba960000
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov eax, 0xb
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al