joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405704
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov cs, word [ebx - 0x700a914]
or al, 0xff
jne 0x405716
jmp dword [ebx + sym.imp.KERNEL32.dll_LoadResource]
je 0x40575c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
add byte [ebx + 0x74dceff0], cl
aaa
push dword [ebp + 0xc]
lea ecx, [esi + eax]

Function at 0x459eb2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
in al, dx
or dword [ecx], 8
dec ebx
push edi
lea edi, [ecx + 0xe500a8]
jne 0x459ec6
xor esi, dword [esi]
jmp 0x459eb4
push dword [ebp + 8]
call 0xe5a1da3
pop ecx
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.00405684
pop edi
pop ebp
add dword [eax + ecx*4], 0xd98b55cc
push 0xffffffffffffffff
push 0x5d888d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
cmc
push esi
push edi
mov eax, dword [0x65ebd2]
xor edx, dword [esi - 0x29c172b0]
test byte fs:[eax], 0
cli
add byte [ecx + 0x65], ch
invalid

Function at 0x468e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sbb ecx, 0x68
mov eax, dword [0x65eb68]
arpl si, bx
dec ebp
inc ebp
cld
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
test edx, ebp
js 0x468ebb
cmp ebx, 0x64
jge 0x468eeb
mov eax, 0xcccc1fcd
mul ebx
mov ecx, edx
mov edx, dword [esi + 8]
xchg ecx, eax
jmp 0xa2939387
mov ah, 8
mov byte [ebp + 8], bl
shl cl, 0x41
add al, cl
add al, al
lea ecx, [edx + 1]
sub bl, al
xchg ecx, eax
ret
dec edx
add dword [edx], ebp
fcom dword [ecx + 0x4e3b30c3]
or al, 0x4d
or cl, byte [ebx + 0x38b2f06]
dec dword [ecx - 0x7408a975]
salc
add al, 0x2e
sbb al, 2
inc dword [esi + 8]
pop edi
pop esi
pop ebp
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x7b9f9c
mov esp, ebp
jecxz 0x468eae
mov eax, dword [ebp + 0x67]
mov dword [ecx - 0xc], esi
invalid

Function at 0x469fdc
Capabilities:
Encode data using xor

Disassembly:
or al, 1
add byte [eax], al
or al, byte [eax]
add byte [eax], al
add byte [ecx + 0x110], al
inc ebp
add byte [eax], al
jmp [ebx + 0x11481]
add byte [eax], al
add byte [eax], al
dec edx
pop esp
sbb al, 1
add cl, bh
add al, ch
add byte [eax], al
mov bl, 0x32
and byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [ebx - 0x39], al
and dword [ecx + eax], 0
mov edx, 0x2c4f8956
add dword [eax], eax
add byte [ebp - 0x2bfe837f], cl
add byte [ecx - 0x7f], bh
invalid
aam 0x6e
pop edi
jbe 0x469fa8
sbb dword [eax + 1], 0xa0000
add byte [eax], al
js 0x469f86
pop esp
add dword [eax], eax
add byte [eax], al
add byte [eax], al
mov dword [ecx + 0x1a0160], 0x2f3ff500
mov dword [ecx + 0x3e000164], 0x3a000000
mov dword [ecx + 0x168], 0
test dword [ecx + 0x175], eax
jne 0x46a017
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, al
xor dword [eax - 0x12], 0x7b000011
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov dword [ecx + 0x11ee70], 0x7b00
sub eax, 0xe8017ae7
xor bl, bh
shr edi, 0x81
je 0x46a014
add byte [eax], al
in al, dx
outsb dx, byte [esi]
pop edi
add bh, al
aaa
movsb byte es:[edi], byte [esi]
cdq
add byte [eax], al
or al, byte [eax]
in eax, 0
invalid
Function at 0x473ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
shr esp, 1
push 0x59
push 0x5da76e
mov eax, dword fs:[0x610000]
push eax
sub esp, 0x48
mov eax, dword [0x65eb68]
xor eax, ebp
mov esi, esp
invalid

Function at 0x49a0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
adc ch, ah
sub esp, 0x2c
push ebx
push esi
xor ebx, dword [ecx]
mov dword [edi - 0x24], ecx
neg bl
pop ebp
jne 0x49a0d6
push edi
mov dword [ebp - 0x10], ebx
call 0xffdced70
inc ecx
jne 0x49a10a
call fcn.00495ce0
mov dword [ebp + 0x1e], eax
push ds

Function at 0x4e06c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x65eb7e]
xor eax, ebp
popfd
inc ebp
cld

Function at 0x537280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x537687
invalid
pop ebx
pop ebp
ret

Function at 0x558500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x66
push 0x30603b
js 0x55850d
add byte [eax], al
add byte [eax], dl
sub esp, 0x740
mov eax, dword [0x65eb68]
or byte [edi - 0x3aceba77], cl
push esi
push edi
push eax
and eax, 0xa364f445
xchg edi, eax
add byte [eax], al
add byte [ebx - 0x4817c0f], cl
add byte [edi], cl
test byte [eax], bl
add dword [eax], eax
nop
cmp word [esi + 0x16], 8
fistp dword [ebp + 0x22c]
fist dword [esi]
cmc
add al, ch
xor edx, edx
mov ebx, eax
cmp dword [esi + 0x1c], edx
ror byte [ebx + 0x1c5639d8], cl
jbe 0x55858d
ja 0x55854b
push ss
pop ds
pop esp
add ah, dh
add bl, dl
lea esp, [eax + edi]
movzx eax, byte [ebx + edx*4 + 1]
imul ebx, dword [ebp + 0x59], 0xf003d15
mov dh, 4
xchg ebx, eax
imul eax, eax, 0x75
add ecx, eax
movzx eax, byte [ebx + edx*4 + 2]
add eax, eax
xor al, byte [ecx]
add byte [eax], al
push es
enter 0x55c1, 0xa
pushfd
or al, 0x8a
inc edx
cmp edx, dword [esi - 0x24]
jb 0x558560
mov eax, dword [esi + 0x4c00994c]
test eax, eax
js 0x5585a1
movzx eax, byte [ecx - 0x684f5e77]
add dh, ch
cmp word [esi + 0x16], 8
jne 0x5585c9
mov edx, dword [esi + 0x34]
xor ecx, dword [edx + 0x761c9839]
adc byte [edi], cl
mov dh, 4
adc dword [edx + 0x4888304], ecx
adc dword [ecx + 0x3b], eax
sbb dword [ebx + ecx], 0xfffffff0
mov ecx, esi
call fcn.0055c020
movzx eax, word [esi + 0x16]
xor dword [eax - 0x7c138bfc], 0xfffffff8
add dword [edi], ecx
invalid
Function at 0x5663b9
Capabilities:
Packed with generic packer

Disassembly:
jo 0x566437
call fcn.005710c5
inc esi
jge 0x5663cf
add byte [ebx + 0x37750858], cl
cmp dword [ebp + 0x10], 0
jne 0x566400
sub dword [esi], 0x14
jns 0x566449
sub ebp, eax
push edi
mov eax, 0x9c1eb4
mov dword [ebp - 0x75], eax
call fcn.0059aa31
push dword [ebp + 8]
xor edi, edi
je 0x566403
aam 0x85
popal
add byte [edx - 0x1e], ch
push 0x60
push esi
mov dword [eax], edi
call 0x9564dd6
and dword [eax], 0x18
jmp 0x566432
call 0xf959ec7c
add edi, ecx
mov eax, dword [eax]
mov eax, ecx
cld
call fcn.005a1c31
cli
adc al, 0x33
pop ds
invalid
pushal
push esi
call 0x63564df4
add esp, 0x24
bound eax, qword [ebx - 0x51ddb3c]
loop 0x56642e
mov bh, 0x72
add byte [ecx + 0x10167492], al
int1
mov ecx, 0x30ff0003
fisttp dword [edx]
jmp 0xd82b6448
adc dword [edx - 0xeefe98c], 0xff0003b9
xor bl, bl
or ch, cl
invalid
or ch, al
loop 0x56649b
add esp, dword [ecx]
mov ecx, dword [ebp - 4]
mov dword [ebx - 0x73], ecx
popal
aam 0x50
push esi
push ebx
call dword [0x5e857c]
cmp al, 0xc0
jne 0x566428
mov edx, dword [edi - 0x2ba476f8]
mov eax, dword [0xf396a40c]
mov bl, 0x45
fmul dword [ebx + 0x45891409]
cmp byte [ebx + 0x45890ccf], cl
mov edi, 0x8910d38b
inc ebp
sub eax, 0x50d4458d
mov dword [ebp + 0x44], edi
mov dword [ebp - 0x24], edi
mov dword [edx - 0x1c], ecx
xor edi, dword [ebp - 0x60]
mov dword [ebp - 1], esi
adc ebp, dword [edi - 2]
invalid
inc dword [ebp - 0x17fa8a32]
jg 0x566459
add byte [eax], al
invalid

Function at 0x566d73
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840002b6
mov eax, dword [0x1de268]
stosb byte es:[edi], al
lds ecx, [ecx + 0x5c83fc45]
mov esp, 0x57560066
mov edi, dword [ebp + 8]
test eax, eax
jne 0x566dbf
push 0x61aac8
call dword [0x5ea57d]
test eax, eax
je 0x566ddb
push 0x5edaae4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add byte [ebx - 0x7900a910], cl
clc
mov byte [0xd0a38e4e], al
mov esp, 0x9ca005e
push eax

Function at 0x5680d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
add eax, esp
add byte [eax], al
je 0x5680d1
xor eax, eax
inc eax
ret
xor eax, eax
jp 0x56812a
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov edx, dword [ecx]
push edi
test dword [ebp - 0x107c8191], esp
and byte [eax], al
fstp xword [eax - 1]
jbe 0x56810b
call dword [0x7184a8d4]
test eax, eax
je 0x568160
cmp dword [ebp + 8], 0
shl dword [ebp + 0x33], 1
dec dword [ebx - 0x703e1721]
add byte [eax], al
xor edi, edi
mov ebx, edi
call fcn.005710c5
push 0x61b490
dec dword [eax + 8]
mov eax, dword [eax + 0x31]
push eax
mov dword [ebp - 4], eax
or byte [ebx - 0x76afcec0], cl
inc ebp
cld
call dword [0x5eb73e]
je 0x568160
cld
test eax, eax
je 0x5680fa
mov edi, esp
dec ecx
mov edi, 0x4815ff53
movsd dword es:[edi], dword [esi]
pop esi
add bh, bh
invalid
pop eax
sar bl, 0x8b
dec edi
leave
ret 4

Function at 0x56a167
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x749d8508]
add ecx, dword [ebx - 0xaffba3]
jno 0x56a198
invalid
call fcn.00599fdc
mov edi, dword [ebp + 8]
lea edx, [esi - 0x1788000d]
Function at 0x56dea8
Capabilities:
Resume thread

Disassembly:
call 0x756e2b4
test eax, eax
jne fcn.0056de5c
mov eax, dword [edi]
pop es
mov esi, dword [eax + 0x2d]
cmp dh, cl
call dword [0x664258]
mov ecx, edi
inc dword [esi + 0x33]
rcr bl, 0x15
push dword [ebp + 0x10]
mov edi, 0x15ff2c77
inc eax
mov dword [0x45762e5e], eax
sbb byte [ecx + 0x75], bl
or edi, edi
ja 0x56defd
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov ecx, esp
cmpsb byte [esi], byte es:[edi]
add al, byte [eax]
ret 0x18
add dl, ch
add dword [ebx + 0x581565ce], ecx
stosd dword es:[edi], eax
pop esi
add byte [esi + edx*8 - 0x51], al
jge 0x56de9d
add byte [ecx + edx - 0x75], dh
pop es
mov esi, dword [eax + 0x78]
mov ecx, esi
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
pop eax
stosd dword es:[edi], eax
pop esi
add dh, ah
iretd

Function at 0x570528
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
stc
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x74], edi
cmp byte [eax - 0x14], ch
adc eax, 0x15ff005f
sub byte [ebp - 0x3f7aaf6d], ah
je 0x57056f
push 0x61bdfc
push eax
invalid
pop esi
add al, 0x74
or bl, byte [edi + 0x5e]
out 0xc, al
jmp dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]

Function at 0x570afa
Capabilities:
Encode data using xor

Disassembly:
call 0xea57d719
mov esi, ebx
mov al, 1
rol byte [eax], 0x85
mov esp, 0x768b0574
and bl, ch
out 0x62, al
push esi
inc ebp
dec dword [eax]
sal byte [ebp + 6], 0xd3
div byte [ebx]
call [ecx + 0x4f]
bnd jo 0x570b40
jmp 0x570b81
mov edx, 0xd74fe3b

Function at 0x5816af
Capabilities:
Print debug messages

Disassembly:
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
idiv byte cs:[eax + 0xe]
push 0xea21
push 0xfffffffffffffff4
jmp 0xa9682c93
sub byte [esi], bl
bound eax, qword [ebp - 0x10]
mov esi, 0xb7e900
test eax, eax
je 0x58167c
sub al, 0xff
ja 0x5816e2
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x5816da
push 0x5e00ea5f
push 0xfffffffffffffff4
push eax
inc dword [ebp + 0x10]
and al, 0x5e
cmp byte [edx], bh
push 0xfffffffffffffff4
cmp ch, byte [edx - 0xc]
inc dword [edx - 0x10]
call dword [0x455e4806]
push es
dec eax
pop esi
inc ebp
cmp dword [ebx + 4], 0
je 0x581705
push 1
push 0xffffffffffffffb1
push dword [edi - 0x20]
push esi
fsubr qword [edx]
pop esi
add byte [ebx + 0x18487], cl
add byte [edx + 0x36], dh
add dword [ebx + 0x4a1ffcd], edi
push dword [edi - 0xb]
mov eax, dword [0xf577ff04]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x581720
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xac]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x581744
mov eax, dword [eax]
push 1
mov esi, dword [eax + 0x5c]
into
call dword [0x5e4958]
fmul qword [ebp - 0x18]
test dh, dl
mov esi, dword [edx + ebp*2 + 1]
mov esi, dword [eax + 0x7f0178]
mov ecx, esi
call dword [0x5eab58]
mov ecx, edi
inc dword [eax]
cmp dword [ebx], 0xe900
je 0x58176f
xor eax, 0x3577ff33
call dword [0x105ed17e]
jmp 0x581772
mov ebp, ecx
invalid
push 5
push eax
call dword [0xd9ea04]
mov eax, dword [ebx + 0x14]
or eax, 0x89b78095
int3
Function at 0x584241
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov esi, dword [edx - 0xe74a8aa]
dec ebx
jp 0x5841cf
jmp 0xe90fcdb2
add edi, ecx
add byte [eax], al
push 0x81000375
push dword [edi + 0x20]
inc edi
je fcn.00584187
pop esi
add byte [ebx - 0x7dff535a], al
add bh, dh
jmp 0x584238
invalid
xor eax, eax
inc eax
xchg dword [esi + 0x5d], ebx
pop es
add al, 0
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edi, 0x2f
ja 0x58426a
je 0x58428d
rcl dword [ecx - 0x7d], cl
call 0xc8ab687
adc al, 0x68
je 0x58428d
sub eax, 1
je 0x584236
mov eax, dword [0x10eb01e8]
cmp edi, 0x6e
je 0x584246
sbb esi, 0x4e
dec esi
pop edi
cmp edi, 0xdf11
je 0x58428d
push dword [ebp + 0x22]
push dword [ebp + 0xc]
push edi
call 0xcc568c21
jmp 0x584349
mov eax, dword [ecx]
push ebx
push 0x5d
adc byte [esi - 0x75], dl
mov al, 0xd6
add dword [eax], eax
add byte [ebp + 0x2350f845], cl
push dword [esp + ecx + 0x38]
mov ss, word [edi - 1]
adc eax, 0x5eab58
mov ecx, dword [ebp + 0x1e]
call esi
test eax, eax
or byte [ebp + 0x228c], al
mov ebx, dword [edx]
cld
cli
xchg byte [eax - 0x7aff8400], al
add byte [eax + eax - 0x7b], bh
sal byte [ecx + ebx - 0x47], 0x11
add dword [eax], eax
add byte [ebx], bh
stc
jne 0x5842de
push ebx
push dword [ebp + 0xc]
push ebp
inc dword [eax - 0x57c14901]
sbb eax, dword [eax]
jmp 0x584347
out dx, al
and edi, dword [0xffe92054]
jno 0x5842e6
push dword [ebp + 0xc]
jne 0x5842f5
push edi
adc eax, 0x15ff8470
je 0x584299
jo 0x584271
call dword [0x8b2ca874]
sub al, 0x8b
mov dword [ebp - 8], eax
clc
cmp edi, 0x4e
jne 0x584347
cmp dword [ebx + 8], 0xfffffdf8
je 0x5842be
cmp dword [ebx + 8], 0xfffffdee
jne 0x584380
xor eax, dword [eax + 0x39]
xchg ebx, eax
mov al, 0
add byte [eax], al
jne 0x5842eb
lcall 0x4074, 0xc9850c4b
ja 0x584332
jne 0x584347
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push 0x4e
pop edx
int1
invalid
xor dword [edi + 4], 0
jne 0x584347
mov ecx, dword [ebx + 0xc]
test ecx, ecx
in al, 0x80
sub eax, 0x5ddeb00
popal
clc
pop esi
pop ebx
test cl, 0xc2
or al, 0
dec dword es:[ebx + ecx*4 - 0x35]
push dword [ebp - 0xa]
popal
mov ch, 0xc
push dword [ebp + 8]
invalid
Function at 0x588d0b
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
pop ebp
mov edi, ecx
sbb ebx, 0x1c
add byte [edi], cl
salc
sub byte [ecx], al
lahf
in eax, 0x83
jg 0x588d38
add byte [edi], cl
test byte [esi], bl
add dword [esi], edx
add byte [ebx - 0x367abfb1], cl
jne 0x588d51
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
invalid
push dword [edi + 0x18]
call dword [fcn.005e3fdb]
test eax, eax
je 0x588e78
pop ds
inc ebp
cld
enter 0xd8, 0
mov bh, 0x8b
cmp al, 0x53
mov esp, dword [esi + 0x3c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dl, 0xdb
cmp byte [edx + 0x5a], dh
mov eax, dword [edi + 0x44]
push 0xffffffffffffffc2
mov dword [ebp - 8], eax
jns 0x588d6f
retf
cmp eax, ebx
psubd mm5, qword [esi - 0x74fffff9]
jne 0x588db2
push eax
add byte [edx + ecx], 0x50
push ebx
push esi
pop es
mov bl, 0xda
out 0xff, eax
mov eax, dword [edi + 0x38]
add esp, 0x10
mov esp, ebp
jmp 0x5154d320
add byte [ebx + 0x5dec0123], cl
cld
cmp al, 0x89
add byte [eax], al
xor al, 4
sub dh, 0x8d
add al, 0x1a
cmp eax, esi
jb 0x588e2e
das
bnd jns 0x588dca
xor esi, dword [eax - 0x15]
aad 0x3b
ja 0x588dac
cmp esi, ebx
ja 0x588dac
push esi
movsd dword es:[edi], dword [esi]
cmp byte [edx], cl
push eax
push ebx
movsb byte es:[edi], byte [esi]
jne 0x588ddf
call fcn.00406839
fld dword [eax - 0x4a]
lea eax, [ebp - 8]
push eax
push dword [edi + 0x38]
push dword [esi]
inc eax
sal dword [edi + 0x18], 0x82
adc eax, sym.imp.WININET.dll_InternetReadFile
test eax, eax
adc byte [ebx - 0x75], 0x58
clc
sub ebx, esi
mov dword [edi + 0x1e], 0x273d83b
mov ecx, dword [ebp + 0x50]
push dword [edi + 0x40]
mov dword [ebp - 8], eax
popal
inc ebp
or byte [esi - 0x3a], ah
push ebx
push eax
call fcn.00403a39
mov eax, dword [ebp - 8]
add esp, 0x10
mov dword [edi + 0x3c], eax
lea ebx, [eax + esi]
jmp 0x588e41
push ebx
mov eax, dword [0xff5351ca]
jne 0x588e71
call fcn.00406839
imul eax, esp, 0x10
add dword [edi + 0x3c], ebx
invalid
push dword [edi + 0x20]
call fcn.005886cb
int3
push edi
mov ecx, ebx
call 0xff8e5684
push 0x80
jne 0x588e4b
jmp [eax - 0x80]
call 0xff9b55cd
movsb byte es:[edi], byte [esi]
push cs
mov edi, dword [edx - 0x75]
jno 0x588eec
jmp 0x588efa
call dword [ebx]
dec esi
push ss
call fcn.004055cd
mov ecx, dword [ebx]
mov esi, dword [ecx + 0x55]
test esi, esi
je 0x588f0f
push 0xa
pop ecx
scasd eax, dword es:[edi]
cmp dword [eax + esi*2 - 2], ecx
jne 0x588f02
xor ecx, ecx
mov ah, 0x4c
jo 0x588f0d
push 0xffffffffffffffff
mov ecx, ebx
call 0xfe41f8b1
xchg ebx, eax
jge 0x588f13
jne 0x588f21
test esi, esi
je 0x588f24
xor edi, edi
inc edi
inc ecx
invalid

Function at 0x58af6f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub dword [ecx + esi*2 + 0x56], edx
xchg esi, eax
mov edi, dword [ebp - 0x7f]
mov esp, dword [ebp + 0x47e6cf8b]
sbb byte [ebp - 0x30], ch
test al, 1
je 0x58afd2
mov ch, 0x5a
invalid
invalid
Function at 0x59032d
Capabilities:
Encode data using xor

Disassembly:
add bp, bx
or bl, ch
test dword [esi + ecx*8 - 0x6e7421fd], esp
or esp, dword [ebx + 8]
jmp 0x58eb1b
push 0x10
pop eax
sub edi, eax
mov eax, dword [ebp - 0x14]
out dx, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
mov dl, byte [eax]
test dl, dl
paddusb mm2, qword [edi]
invalid
push ebx
lodsd eax, dword [esi]
add byte [ebp - 0xaf4bbb], cl
adc eax, sym.imp.OLEAUT32.dll_VariantCopy
xor dword [ecx + ecx + 0xfc50200], 0x17385
add cl, ch
jns 0x58ec38
add byte [eax], al
add ecx, dword [edi + 0x38bce03]
neg eax
sbb eax, eax
jmp 0x58ea9f
ja 0x58eb1b
jmp dword [eax*4 + 0x58ee90]
add byte [eax], 0
add byte [ecx + 0x39], bl
inc esp
cmp dword [esi*2 + 0x39448be3], edx
adc byte [ebp + 0x24504], cl
clc
add cl, byte [ecx - 0x30efc6bc]
dec ebx
adc al, 0x89
dec ebp
loopne 0x59035d
mov bh, 0x74
cmp dword [esi + edx*2], edx
push edi
das
sbb eax, dword [eax]
add byte [ebx + 0x558ba675], cl
loopne 0x5903ad
add esi, eax
neg eax
and ecx, ebp
or dword [eax], eax
mov ecx, dword [edx + edi + 0x10]
mov dword [ebp - 0x78], esi
lea eax, [esi + 3]
add edx, ebp
and eax, 0xfffffffc
invalid
je 0x5903af
push ebp
aam 0x83
jl 0x5903b8
mov ecx, dword [ebp - 0x20]
inc edx
adc esp, 0xffffffd8
push ecx
mov dword [eax + edi - 0x78], ecx
adc dword [esi], 0xffffffef
mov dword [ebp - 0x10], esi
mov dword [eax - 0x2c], ebp
mov dword [ebp - 0x18], edi
cmp edx, dword [ebx + 0xc]
jb 0x58ebee
mov eax, dword [ebx - 0x238a761c]
cmp dword [ebx], 0
fiadd dword [ebp - 0x51ff7df9]
push 0xffffffffffffffb6
mov ecx, ebx
fucom st(1)
mov edx, 0x4589ff50
adc al, byte [ebp - 0x1276f040]
add byte [eax], al
add byte [ebx], dh
idiv byte [ecx]
jae fcn.0059044c
dec edi
jbe 0x5903fc
lea ecx, [edi + 0x14]
mov dword [edi], edi
int3

Function at 0x59148e
Capabilities:
Encode data using xor

Disassembly:
jo 0x5914e4
push esp
mov cl, 0xc0
push eax
push eax
push eax
push 0x17
mov ecx, esi
call dword [0x6d5eab74]
stosd dword es:[edi], eax
pop esi
insd dword es:[edi], dx
mov ecx, edi
call esi
test dword [edi + 0x78b1c74], esi
and dword [ebp + 0x36], 0
mov esi, dword [eax + 0x54]
xchg ebp, eax
js 0x59148f
push eax
lea eax, [ebp - 0x28]
sbb eax, 0xff6a5097
push 0
call dword [0xb4ab58]
mov edi, dword [esi - 1]
salc
out 0x8f, eax
push ecx
push eax
in al, 0x75
mov ah, 0x8b
or dl, byte [edx - 0x75]
jno 0x5914e9
mov ecx, esi
call dword [0x5eab58]
call esi
xlatb
fmul dword [ebx - 0x74af13bb]
or byte [ebx - 0x3174288f], cl
inc ebp
in al, dx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx - 0x29]
xlatb
mov ecx, esi
adc byte [0x5eab58], 0xff
salc
xor al, 0xde
in al, dx
jg 0x5914e2
and dword [edx], eax
add byte [eax], al
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x50]
inc ecx
mov ah, 0x8b
push ebp
lea eax, [ebp - 0x18]
push eax
push 0x620364
xor byte [ebx + 0x5815ffce], cl
stosd dword es:[edi], eax
xor byte [eax], al
call esi
test eax, eax
js 0x591589
test dword [ecx + 0x75], eax
pop ecx
mov eax, dword [ebp - 0x66]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x20]
stosd dword es:[edi], eax
push es
call dword [0x5eab58]
jmp dword [esi - 0x75]
mov eax, dword [ebp - 0x10]
invalid
dec eax
Function at 0x59619c
Capabilities:
Encode data using xor

Disassembly:
inc eax
cmpsb byte [esi], byte es:[edi]
pop esi
add byte [ebx + 0x75ff85f8], cl
add eax, 0xfdb993e8

Function at 0x59669c
Capabilities:
Log keystrokes via polling

Disassembly:
test ch, al
add dl, dh
add byte [ebx + 0x3d75894b], cl
cmp dword [esi + 0x74], ebx
jne 0x5966db
invalid
sbb byte [eax + 0x74], cl
test ecx, ecx

Function at 0x59679c
Capabilities:
Log keystrokes via polling

Disassembly:
cmovbe ebx, edi
add byte [ebx + 0x4d], cl
jbe 0x596769
xchg ebp, eax
sbb ebx, dword [eax + 0x66]
cmp dword [ebp - 0x20], eax
invalid
jmp 0x59674c
out 0x8b, al
dec ebp
or al, 0xff
xor eax, ebp
movups xmm5, xmm7
pop eax
push dword [ecx]
call 0x5956787f
mov edx, dword [edx]
xor eax, 0x4f89d08b
in al, dx
mov dword [ebp - 0x20], edi
cmpsd dword [esi], dword es:[edi]
jnp 0x59677e
add dword [eax], eax
add byte [edi], cl
test byte [esi], ch
add byte [eax + eax], bl
dec ecx
sbb dword [ecx], 5
je 0x5967c0
sub ecx, 4
punpcklwd mm3, dword [edx]
add byte [eax], al
test esi, esi
jne 0x5967ae
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
jns 0x596765
jns 0x1406878
mov ebp, dword [ebx + 0x7d]
mov eax, dword [ebp + 0xc]
je 0x5967d3
pop ecx
mov ecx, 0xfaf48c9
test byte [ebp - 0x15000000], bh
add esp, ecx
mov byte [0xe879010c], al
loope 0x596764
or al, 1
jns 0x5967ae
int1
or byte [ecx], dh
salc
cmp dword [ebp - 0x18], 0x9b01b3
mov ecx, eax
jne 0x5967de
test cl, 0x84
jne 0x596878
mov eax, dword [ebp + 0xc]
movzx edx, word [eax - 0x25]
cmp dx, word [ebp - 0x1c]
jne 0x5967f4
test cl, 2
push edi
invalid

Function at 0x59d79c
Capabilities:
Encode data using xor

Disassembly:
adc byte [esi + 0xf], ah
outsd dx, dword [esi]
xchg byte [esi - 0x13f0c5f1], bh
or byte [esi + 0xf], ah
jg 0x59d81a
and byte [ebp - 0x488ccf81], cl
push dword [esi + 8]
enter 0x6656, 0xf
outsd dx, dword [esi]
dec esi
xor al, 0x8d
jbe 0x59d7ba
mov edi, edi
movdqa xmm3, xmmword [esi + 0x10]
mov eax, dword [0xf6630e9]
outsd dx, dword [esi]
adc esp, dword [eax]
movapd xmmword [edi], xmm0
xor byte [ebp - 0x698cf8a], cl
dec edi
movdqa xmm2, xmm3
push eax
invalid
lea edi, [edi + 0x6d]
jae 0x59d7c0
lea esi, [esi + 0x1a]
cmp ecx, 0x10
movdqu xmm1, xmmword [esi]
and dword [eax + edx + 0x6610768d], 0xf
adc byte [esi + 0xf], ah
jg 0x59d82e
lea edi, [edi + 0x10]
jb 0x59d80c
bt ecx, 2
mov edx, 0x83068b0d
jmp 0x42e565da
test al, 0x8d
mov eax, dword [edx - 0x77]
pop es
lea edi, [edi - 0x4e]
bt ecx, 3
jae 0x59d84e
test dword [edi], ecx
jle 0x59d84f
sub ecx, 8
lea esi, [esi + 8]
movq qword [edi], xmm1
lea edi, [edi + 8]
mov eax, dword [ecx*4 + 0x59d894]
add al, 0x8d
xchg esp, eax
fcomp dword [ecx]
jmp eax
mov al, byte [esi]
mov byte [edi], al

Function at 0x5a039c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call 0x1d1af82
pushfd
int3
push ebp
mov ebp, esp
cmp dword [ebp + 0x20], 0x5a
push ebx
mov esi, dword [ebx + 0x1c]
push esi
push edi
mov edi, dword [ebp + 0xc]
je 0x5a0395
jne 0x5a0425
and byte [ebx + 0x57], dl
push dword [ebp + 8]
call 0xff850303
add edi, 0xffffffd5
das
mov dh, 0x40
test eax, eax
sbb eax, dword [edx]
inc edx
invalid
mov edi, dword [ebp + 0x18]
xor ebp, esi
push edi
invalid