joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10090290
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push esi
je case.0x10090362.0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1012cbb4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x1012b334]
mov dword [ebp - 4], esi
cmp eax, dword [esi + 0x408]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jg 0x100903ff
mov ecx, dword [ebp - 4]
mov eax, dword [0x1012b33c]
cmp eax, dword [ecx + 0x408]
jg 0x1009043f
mov eax, dword [0x1012b330]
test eax, eax
je 0x10090302
cmp dword [0x1012b338], 0
je 0x10090302
call eax
push eax
call dword [0x1012b338]
jmp 0x1009035b
cmp byte [0x1012b340], 0
jne 0x10090356
push str.GetProcessDpiAwareness
push 0x100de5bc
call edi
push eax
call esi
push str.IsProcessDPIAware
push 0x100de5bc
mov dword [ebp - 8], eax
call edi
push eax
call esi
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x1009033e
push 0x101033c8
push 0
call ecx
jmp 0x1009034f
test eax, eax
je 0x1009034f
call eax
neg eax
sbb eax, eax
neg eax
mov dword [0x101033c8], eax
mov byte [0x1012b340], 1
mov eax, dword [0x101033c8]
inc eax
pop edi
cmp eax, 3
ja case.0x10090362.2
jmp dword [eax*4 + 0x100904c4]
mov eax, dword [0x1012b344]
test eax, eax
jne 0x100903fa
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [0x1012b344], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x1012b344]
mov ecx, 0x60
cmp eax, ecx
pop esi
cmovl eax, ecx
mov dword [0x1012b344], eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [0x1012b34c]
cmp eax, dword [ecx + 0x408]
jg 0x1009047f
mov eax, dword [0x1012b348]
test eax, eax
je case.0x10090362.0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 0
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
js case.0x10090362.0
mov eax, dword [ebp - 4]
cmp eax, 0x60
jae 0x100903fa
mov eax, 0x60
pop esi
mov esp, ebp
pop ebp
ret
push 0x1012b334
call fcn.100a1b6f
add esp, 4
cmp dword [0x1012b334], 0xffffffff
jne 0x100902d1
push str.GetThreadDpiAwarenessContext
push 0x100de5bc
call edi
push eax
call esi
push 0x1012b334
mov dword [0x1012b330], eax
call fcn.100a1b25
add esp, 4
jmp 0x100902d1
push 0x1012b33c
call fcn.100a1b6f
add esp, 4
cmp dword [0x1012b33c], 0xffffffff
jne 0x100902e5
push str.GetAwarenessFromDpiAwarenessContext
push 0x100de5bc
call edi
push eax
call esi
push 0x1012b33c
mov dword [0x1012b338], eax
call fcn.100a1b25
add esp, 4
jmp 0x100902e5
push 0x1012b34c
call fcn.100a1b6f
add esp, 4
cmp dword [0x1012b34c], 0xffffffff
jne 0x100903c3
push str.GetDpiForMonitor
push str.shcore
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
push 0x1012b34c
mov dword [0x1012b348], eax
call fcn.100a1b25
add esp, 4
jmp 0x100903c3
Function at 0x10094320
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetupDiGetClassDevsA
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10094364
push 0x100947d0
push ebx
call fcn.1006f540
add esp, 8
test al, al
jne 0x10094364
push 0
push 0x1012b37c
push 0x100947d0
push ebx
call fcn.1006eaf0
add esp, 0x10
push str.SetupDiGetClassDevsW
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10094399
push 0x10094800
push ebx
call fcn.1006f540
add esp, 8
test al, al
jne 0x10094399
push 0
push 0x1012b380
push 0x10094800
push ebx
call fcn.1006eaf0
add esp, 0x10
push str.SetupDiEnumDeviceInterfaces
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x100943ce
push 0x10094650
push ebx
call fcn.1006f540
add esp, 8
test al, al
jne 0x100943ce
push 0
push 0x1012b384
push 0x10094650
push ebx
call fcn.1006eaf0
add esp, 0x10
push str.SetupDiEnumDeviceInfo
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10094403
push 0x100945c0
push ebx
call fcn.1006f540
add esp, 8
test al, al
jne 0x10094403
push 0
push 0x1012b388
push 0x100945c0
push ebx
call fcn.1006eaf0
add esp, 0x10
push str.SetupDiEnumDriverInfoA
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10094438
push 0x100946d0
push ebx
call fcn.1006f540
add esp, 8
test al, al
jne 0x10094438
push 0
push 0x1012b38c
push 0x100946d0
push ebx
call fcn.1006eaf0
add esp, 0x10
push str.SetupDiEnumDriverInfoW
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1009446d
push 0x10094750
push ebx
call fcn.1006f540
add esp, 8
test al, al
jne 0x1009446d
push 0
push 0x1012b390
push 0x10094750
push ebx
call fcn.1006eaf0
add esp, 0x10
push str.SetupDiGetDeviceInterfaceDetailA
push esi
call edi
pop edi
pop esi
mov dword [0x1012b394], eax
pop ebx
pop ebp
ret

Function at 0x10095ab0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
mov dword [esi], vtable.CThread.0
je 0x10095b7f
cmp dword [esi + 0xc], 0xffffffff
push ebx
push edi
mov edi, 0x32
sete bl
test bl, bl
je 0x10095ae9
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0xc], 0xffffffff
sete bl
sub edi, 1
jne 0x10095ad1
mov eax, dword [0x1012b3b0]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x10095b01
push eax
call edi
mov eax, dword [0x1012b3b0]
test bl, bl
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10095b65
cmp eax, 0xffffffff
je 0x10095b1c
push eax
call edi
cmp eax, esi
je 0x10095b65
mov eax, dword [0x1012b3b0]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10095b65
cmp eax, 0xffffffff
je 0x10095b2e
push eax
call edi
mov ecx, dword [esi + 4]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10095b65
test eax, eax
je 0x10095b51
cmp eax, 0xffffffff
je 0x10095b51
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10095b65
mov eax, dword [esi + 4]
push eax
mov dword [esi + 4], 0
call ebx
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10095b76
push eax
call ebx
mov dword [esi + 4], 0
pop edi
mov dword [esi + 8], 0
pop ebx
pop esi
ret
Function at 0x10095c40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10095c9d
mov eax, dword [0x1012b3b0]
cmp eax, 0xffffffff
je 0x10095c61
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esi + 4]
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10095ca4
test eax, eax
je 0x10095c85
cmp eax, 0xffffffff
je 0x10095c85
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10095ca4
mov eax, dword [esi + 4]
push eax
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov al, 1
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10095d80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100cc03d
push eax
mov dword fs:[0], esp
sub esp, 0x10
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x10095dd0
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x10095dd0
cmp dword [ebp - 0x14], 0x103
jne 0x10095dd0
xor al, al
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0
push 0
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x1c], eax
push 0xc
mov dword [ebp - 4], 0
call fcn.100a19fe
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10095e17
lea eax, [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], eax
lea eax, [ebp - 0xd]
mov dword [ecx + 8], eax
jmp 0x10095e19
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [edi + 8]
mov eax, esi
neg eax
push ebx
sbb eax, eax
and eax, 0x10000
push eax
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x14]
push eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], eax
test eax, eax
je 0x10095e79
push 0xea60
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10095ea0
cmp eax, 0x80
je 0x10095ea0
mov eax, dword [edi + 4]
push eax
mov dword [edi + 4], 0
call esi
mov dword [ebx], 0
xor bl, bl
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10095e8b
cmp byte [ebp - 0x18], 0
je 0x10095e8b
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp - 0xd], 0
je 0x10095e66
cmp dword [edi + 4], 0
setne bl
jmp 0x10095e7b
Function at 0x10096a00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov dword [0x1012b3bc], eax
mov eax, dword [ebp + 0x1c]
mov dword [0x1012b3c0], eax
mov eax, dword [ebp + 0x20]
mov dword [0x1012b3c4], eax
mov eax, dword [ebp + 0x2c]
mov dword [0x1012b3d0], eax
mov eax, dword [ebp + 0x24]
mov dword [0x1012b3c8], eax
mov eax, dword [ebp + 0x28]
mov dword [0x1012b3b8], ecx
mov dword [0x1012b3cc], eax
test ecx, ecx
je 0x10096a9f
mov eax, dword [0x1012b468]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x10096a7f
mov ecx, dword [0x1012b46c]
test ecx, ecx
je 0x10096a7f
mov edx, dword [0x1012b470]
test edx, edx
je 0x10096a7f
cmp eax, ebx
jne 0x10096a75
cmp ecx, edi
jne 0x10096a75
cmp edx, esi
je 0x10096a7f
mov ecx, 0x10108480
call fcn.1007e230
mov dword [0x1012b46c], edi
mov ecx, 0x1012b3d8
pop edi
mov dword [0x1012b470], esi
pop esi
mov dword [0x1012b468], ebx
pop ebx
pop ebp
jmp fcn.10091c10
pop ebp
ret
Function at 0x1009a130
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, 0x10108480
push eax
mov eax, dword [ebp + 8]
push dword [eax - 8]
call fcn.1007faf0
cmp eax, 0x48f
jne 0x1009a15f
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
push 0
push 0
mov ecx, 0x10108480
call fcn.1007ed90
test al, al
jne 0x1009a17f
call fcn.10099570
test al, al
je 0x1009a17f
mov edx, dword [ebp - 0x14]
jmp 0x1009a18d
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
push esi
mov esi, 0xe
cmp dword [ebp + 0xc], esi
cmovbe esi, dword [ebp + 0xc]
xor ecx, ecx
test esi, esi
je 0x1009a1c4
push edi
mov edi, dword [ebp + 0x10]
jmp 0x1009a1b0
test word [ecx*2 + 0x10103420], dx
setne al
mov byte [ecx + edi], al
inc ecx
cmp ecx, esi
jb 0x1009a1b0
pop edi
mov edx, 6
cmp dword [ebp + 0x1c], edx
cmovbe edx, dword [ebp + 0x1c]
xor ecx, ecx
test edx, edx
je 0x1009a2a3
fldz
fld qword [0x100d7258]
mov esi, dword [ebp + 0x20]
fld qword [0x100d25b8]
fld st(2)
cmp ecx, 5
ja case.default.0x1009a1f6
jmp dword [ecx*4 + 0x1009a310]
movsx eax, word [ebp - 0xe]
fstp st(0)
add eax, 0x8000
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fdiv st(2)
jmp case.default.0x1009a1f6
movsx eax, word [ebp - 0x10]
fstp st(0)
add eax, 0x8000
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fdiv st(2)
jmp case.default.0x1009a1f6
movsx eax, word [ebp - 0xa]
fstp st(0)
add eax, 0x8000
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fdiv st(2)
jmp case.default.0x1009a1f6
movsx eax, word [ebp - 0xc]
fstp st(0)
add eax, 0x8000
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fdiv st(2)
jmp case.default.0x1009a1f6
movzx eax, byte [ebp - 0x12]
fstp st(0)
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
jmp 0x1009a28f
movzx eax, byte [ebp - 0x11]
fstp st(0)
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fdiv st(1)
fstp qword [esi + ecx*8]
inc ecx
cmp ecx, edx
jb 0x1009a1eb
fstp st(2)
fstp st(0)
fstp st(0)
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1012cbb4]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1012b5bc]
cmp eax, dword [ecx + 0x408]
jg 0x1009a2e2
call esi
mov ecx, dword [ebp + 0x24]
sub eax, dword [0x1012b5b8]
pop esi
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 4], 0
mov esp, ebp
pop ebp
ret 0x20
push 0x1012b5bc
call fcn.100a1b6f
add esp, 4
cmp dword [0x1012b5bc], 0xffffffff
jne 0x1009a2c5
call esi
dec eax
push 0x1012b5bc
mov dword [0x1012b5b8], eax
call fcn.100a1b25
add esp, 4
jmp 0x1009a2c5
Function at 0x100be5d2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100be448

Function at 0x100c370d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100c3260
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x17596922
nop
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x290b3e42
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
mov ecx, 0x4a145623
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x624b1194
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x417fcf
Capabilities:
Query or enumerate registry value

Disassembly:
inc edx
or al, 0xff
rol byte [ebx + 0x458910c0], 1
invalid

Function at 0x418010
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
mov dl, byte [0x4c3044]
and al, dl
mov edx, dword [0x4c3038]
or al, 0xfa
sub esp, 0xc
mov byte [0x4c3044], al
mov eax, dword [0x4c303c]
mov ecx, eax
push esi
shl ecx, 4
and edx, ecx
xor ecx, ecx
mov cl, byte [0x4c3045]
mov dword [0x4c3038], edx
mov edx, dword [0x4c3034]
xor esi, esi
and edx, 8
invalid

Function at 0x427cff
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
xor byte [ebx + esi - 0x64e015c3], 0xd
mov ah, 8
lcall 0x8de5, 0x4112f9fb
or byte [edx + 0x4112f9fb], bl
in eax, 0x8d
sahf
movaps xmmword [esi], xmm5
or al, 0x97
and edi, eax
and dword [edi - 0x7b], 0x57
mov al, 0x46
shl byte [eax - 0x5e32a4aa], cl
xor byte [edi - 0x55], ah
jne 0x427d09
sti
ret 0x57ac

Function at 0x441f5b
Capabilities:
Encode data using xor

Disassembly:
or byte [esp + esi*2 + 0x19b0d1c], cl
push ss
sub eax, 0xe4eed2ba
shl byte [edx + 0x7a], 0x11
imul byte [0x381ce9c8]
enter 0x1ce9, 0x38
enter 0x1ce9, 0x38
je 0x441f46
jnp 0x441fd0
out dx, al
loope 0x441f68
pop ecx
and dh, byte [0xfd7a7590]
xor eax, 0xfd7a7590
rcl edx, cl
add byte [eax - 0x2c], bl
dec ebp
mov ebx, 0xc25af17d
jno 0x441fcc
push esi
push edi
in al, dx
mov ebx, 0x4cb9deea
mov word [ebp + 0xf], ds
aaa
jl 0x441f7b
mov word [0xa7b1fb8d], gs
cmpsd dword [esi], dword es:[edi]
pop ss
xor cl, byte [ebp - 0x52]
in eax, 0xb1
movsb byte es:[edi], byte [esi]
push cs
mov dl, 0x99
salc
lcall 0x20f9, 0xf4a0edc3
test eax, 0x990cb710
lahf
loopne 0x441f8e
xor ah, cl
xor cl, byte [0x30551337]
imul esi, dword [ebx - 0x67d8921a], 0xbcc93daa
and byte [eax + 0x4c], bh
push es
lds esi, [eax + 0x38]
std
push ss
cmp dl, byte [ecx + 0x39]
and eax, 0xcf588437
xor al, 0x12
aas
invalid
movsb byte es:[edi], byte [esi]
pushfd
das
inc esi
or al, 0xb8
mov word [ebp + 0x792d5da3], ss
insd dword es:[edi], dx
inc ebp
adc edi, edx
bound esi, qword [eax + 0x189c9c92]
push edx
sub bl, cl
inc esi
inc ebx
pushfd
inc edx
out 0x12, al
pop es
and edi, dword [eax]
xor byte [esi], 0x21
in eax, dx
dec ebp
pop edi
lodsb al, byte [esi]
sub dword [edx - 0x24b27832], esi
or bh, byte [ebp + 0x29]
minps xmm3, xmmword [ebx + 0x45cb69db]
cmp eax, 0xf70a3f31
pop edx
inc esp
popal
sbb dword [edi + 0x5d8ccef2], 0x7900012d
dec esp
adc esp, ebx
je 0x442011
xchg ecx, eax
inc edx
sbb eax, 0x4cf63444
mov ebp, 0x95cafb88
or dword [edx + ebp*2], esp
sbb al, 0xba
lahf
xor esi, ecx
out 0x93, al
mov al, 0xb
push edi
mov dl, 0xfa
xor al, 0xae
daa
stosb byte es:[edi], al
mov dl, 0xdf
idiv eax
outsd dx, dword [esi]
dec esi
mov bl, 0x86
xchg dword [edi + ecx*4], ebx
sbb eax, 0x943b45d4
jno 0x442077
enter 0x4e3d, 0xa
push ss
rcr dword [ecx + edi*8 - 0x91e3a6f], cl
push es
stc
xchg ecx, eax
vpsadbw xmm0, xmm3, xmmword [esi]
int1
inc ecx
into
cdq
popal
cmpsw word [esi], word es:[edi]
outsb dx, byte ss:[esi]
jp 0x442021
retf
adc byte [ecx], 0x64
jo 0x442059
pushfd
nop
xor al, 0x8a
inc esi
js 0x44207e
push eax
pop esp
inc ebp
dec ecx
mov ch, byte [ebx + eax + 0x7f]
hlt
Function at 0x4442af
Capabilities:
Encode data using xor

Disassembly:
pop eax
push 0xe
fisttp qword [edx - 0x1a837e3]
inc ecx
cmp dword [0x3a8fbf3f], 0xf3498c1d
and bl, dh
xor eax, dword [ecx - 8]
popal
invalid

Function at 0x45a6e1
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
mov ah, 0x7c
jl 0x45a6f3
cli
dec eax
or edx, esi
sbb al, 0xad
xor esi, dword [ecx + 0x1c]
in al, 0xc3
or esi, dword gs:[eax + 0x74]
mov al, byte [ecx + 0x4f]
or al, 0x43
rcl byte [eax], cl
sbb al, 0x95
adc byte [edx], dl
aad 0x98
neg al
outsd dx, dword [esi]
dec esp
out dx, eax
sbb ecx, dword [edi + ebx + 0x545bb36b]
pop ebx
push esp
pop ebx
push esp
loopne 0x45a6b6
cmc
in eax, dx
in al, dx
inc esp
wait
xchg ecx, eax
cld
add bh, cl
and al, 0x5a
mov eax, dword [0x9d310ef3]
mov ebp, 0x3820611f
popfd
or ch, al
mov dl, 0x56
push cs
xor dword [ebp + 0x20611fbd], ebx
cmp byte [ebp + 0x56b2e80a], bl
fcomp dword fs:[esi - 0x4518598c]
cmpsb byte [esi], byte es:[edi]
out 0xba, eax
xor ecx, dword [ebx + 0xa]
jnp 0x45a6ea
mov ah, 0x9a
out dx, eax
push ss
adc bl, bl
or cl, byte [ebx]
movsb byte es:[edi], byte [esi]
imul ebp, dword [eax], 0xfffffffc
push edx
fld qword [edi + ebp + 0x644c8139]
adc ebp, dword [ecx + 0x2d]
loop 0x45a752
xlatb
pop esi
sbb esp, dword [ebx + 6]
push eax
std
test byte [ebp - 0x24b374a2], dl
adc eax, 0x93a4ddd0
jp 0x45a73e
add eax, 0x833bc21a
dec ecx
sbb al, dl
cmp eax, dword [ebx - 0x7c0a16b7]
jae 0x45a77f
jmp 0x3cb92b38
and byte [eax + 0x71], bl
mov cl, 0x5d
pop ebx
jge 0x45a704
cmovg eax, dword [ebx + eax*2 - 0x72504d4c]
xor cl, bh
lea esi, [eax]
stc
jmp 0xb706de7a
jb 0x45a738
invalid

Function at 0x4723da
Capabilities:
Encode data using xor

Disassembly:
or ch, byte [ebp + ecx - 0x15e53a21]
popfd
push edx
adc bh, byte [eax]
in eax, dx
cmpsb byte [esi], byte es:[edi]
invalid
Function at 0x4866b1
Capabilities:
Encode data using xor

Disassembly:
push ss
jle 0x486658
or bh, bl
cmpsd dword [esi], dword es:[edi]
cli
in al, 5
fmul dword [ecx]
pmulhw mm5, qword [0x46d21401]
and byte [esi - 0x48a97993], dl
pop ds
imul ecx, dword [eax + ecx*4 + 0x76], 0xffffffb9
xlatb
push edi
jle 0x4866c9
xchg edx, eax
pop ebx
push esp
enter 0x5d93, 0xffffffffffffff96
movsb byte es:[edi], byte [esi]
fist word [esi + 0x6e098872]
jge 0x486643
ja 0x4866f1
loop 0x486669
jo 0x486641
add esi, dword [eax]
dec ecx
test eax, 0x968fdb2
xor edi, dword [esi]
salc
mov eax, dword [0xa10007f3]
xchg ecx, eax
stosd dword es:[edi], eax
push ebx
jp 0x4866fe
xor al, 0x4d
dec ebp
lcall 0xea43, 0x2b572b88
into
jle 0x486712
sub bh, 0xe0
enter 0x7311, 0xffffffffffffffe5
or esp, esi
jbe 0x486753
pop es
jae 0x4866fd
xor ah, byte [ecx - 0x49e207ad]
jb 0x48668f
inc ebp
or eax, 0xeb890280
pop eax
nop
sbb al, 0x81
and byte [ebp + 0x4a], 0x45
mov edi, 0x32439a9f
salc
jmp 0x48674b
inc ebx
xor dl, dh
cmp al, bh
and eax, 0x3006dac2
invalid
xor byte [ebp - 0x69ae0b38], cl
add ah, dl
invalid
cmp esp, dword [eax]
cmp eax, 0xe3779c89
cmpsd dword [esi], dword es:[edi]
mov byte [edi + 0x61], ah
mov byte [edi + 0x17], dh
outsb dx, byte [esi]
clc
or dword [edx], ebp
or dl, al
pushfd
xor al, 0xbc
xor dl, byte [esi + 0x133f654]
inc edi
invalid
test dword [ebx + 0x58], edx
sbb dword [ebp + 0x185a2295], esp
lds ebp, [edx + 0xd200697]
or al, 0xae
sub al, 0x3f
lodsd eax, dword [esi]
in eax, dx
cld
jle 0x486706
and edx, ecx
sub al, 0x71
mov ah, 0xd7
out 0xc2, al
adc edi, dword [edi - 0x65]
sbb byte [edx - 0x10], ah
mov dword [0x99961ff9], eax
dec esi
cmp eax, 0x27d4bbb8
aam 0x27
mov dl, 0xbf
sub al, 0xb6
mov byte [0x9db01354], al
cdq
mov byte [edx + 0x19a78399], ah
add ch, 0xa5
adc edx, ecx
aad 0xd4
je 0x486759
jno 0x486770
arpl word [ecx], bp
call 0xb4ec192
je 0x48676a
adc eax, 0x255aed1f
je 0x486738
cmpsb byte [esi], byte es:[edi]
lodsd eax, dword [esi]
js 0x48674b
fist word [ecx - 0x3d005775]
dec ebx
and cl, byte [ecx]
int1
xor byte [ebp + 0x1728d820], 0xdc
loope 0x4867a1
inc ebx
mov edi, 0x19e65c4b
fcomp qword [ecx - 0x48d2696c]
xlatb
sub eax, dword [ecx - 0xb]
call 0x3b5d47fc
jmp 0x486797
Function at 0x488e49
Capabilities:
Encode data using xor

Disassembly:
inc ecx
and esi, edi
inc ecx
sti
adc eax, 0x90a96531
xchg ebx, eax
imul ecx, dword [esi + esi*2 + 0x4ee44090], 0xe4dcf576
nop
inc eax
in al, 0x4e
jbe 0x488e53
cmc
fsubr st(4), st(0)
and al, 0xee
in al, dx
out dx, al
add al, dh
xor eax, 0x5c9cc4be
fbld tbyte [ebx - 0x4b]
push esp
xchg byte [edx - 0x18ba2e2e], ah
mov edx, 0xa91fb3c4
dec edi
insb byte es:[edi], dx
jp 0x488e58
xor ah, byte [edx - 0x36]
mov ebx, 0xe51bce92
adc al, 0xd8
movsd dword es:[edi], dword [esi]
push esp
mov bh, bl
xor al, 0x3a
pop esi
xor bh, byte [ecx]
outsb dx, byte [esi]
in al, 0xac
fnstsw ax
xor esp, edx
and byte [ecx + 0x19322734], 0x6d
jne 0x488efd
push edx
das
in eax, dx
in al, dx
test dl, cl
test eax, 0xd1a9a198
mov ah, 0x72
xchg eax, edx
js 0x488e5d
in eax, dx
shr eax, cl
iretd
xor edi, dword [ebx - 0x3657f732]
add ecx, 0x8a590fe9
xchg ecx, eax
cmpsb byte [esi], byte es:[edi]
cdq
xor byte [edx - 0x31ea0593], ah
movsd dword es:[edi], dword [esi]
lea ebx, [ebx - 0x68]
mov eax, esp
mov edi, 0xf5d7abc8
invalid

Function at 0x4a3aa6
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0xe2
popal
sbb eax, 0xe7d736f2
out dx, al
xlatb
out 0xee, eax
aas
cmp byte ds:[0x71de8b14], ch
in eax, dx
push esp
cmp esp, dword [esi - 0x74]
add byte [ebx + eax - 0x6f3779cf], ah
or dl, ch
push esi
add dword [ecx - 0x28], edx
xor dword [ebx + 0x33286d1d], eax
dec eax
inc ecx
add dword [eax], esi
jns 0x4a3a33
fimul dword [ecx - 0x76367640]
test byte [ecx - 0x76127613], 0xc0
mov ecx, ecx
mov esi, esi
mov esi, esi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, 0x6716b009
add ch, al
jge 0x4a3a2f
aam 0x2c
add al, byte [ebx + 0x54]
push ebp
add eax, dword [ebx - 0x11]
inc esi
add ecx, dword [edi + 0x24]
adc al, 0x3e
mov ch, 0x1a
add cl, byte [edi + 0x1e6f8f0c]
adc ecx, ecx
sbb dword [ecx + 0x4470cdb], eax
pop edx
bound ebx, qword [ebp - 0x6c]
push ds
invalid