joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f454
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1007685c], 0
push ebx
push esi
push edi
jne 0x1000f48c
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x1000f467
mov dword [ecx*4 + 0x10076858], edx
inc ecx
cmp ecx, 0x100
jb 0x1000f462
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
not edi
mov esi, dword [esp + 0x10]
mov edx, edi
test ebx, ebx
jle 0x1000f4da
movzx eax, byte [esi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10076858]
inc esi
sub ebx, 1
jne 0x1000f4a0
jmp 0x1000f4e1
cmp al, 0x23
jne 0x1000f4c8
cmp byte [esi], al
jne 0x1000f4c8
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10076858]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000f4ba
pop edi
not edx
pop esi
mov eax, edx
pop ebx
ret

Function at 0x1000f4e9
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 4], 0
je 0x1000f4f7
cmp dword [esp + 8], 0
jne 0x1000f50e
push 0x4cb
push str.ImGUIimgui.cpp
push str.filename__file_open_mode
call fcn.1003895a
add esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push esi
test ebp, ebp
je 0x1000f51e
mov dword [ebp], ebx
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.100377a9
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1000f5cb
push edi
push 2
push ebx
push esi
call fcn.10037bfd
add esp, 0xc
test eax, eax
jne 0x1000f5c1
push esi
call fcn.10039235
mov edi, eax
pop ecx
cmp edi, 0xffffffff
je 0x1000f5c1
push ebx
push ebx
push esi
call fcn.10037bfd
add esp, 0xc
test eax, eax
jne 0x1000f5c1
mov eax, dword [esp + 0x20]
add eax, edi
push eax
call fcn.1001289e
mov ebx, eax
pop ecx
push esi
test ebx, ebx
je 0x1000f5c2
push edi
push 1
push ebx
call fcn.10038ba7
add esp, 0x10
cmp eax, edi
je 0x1000f598
push esi
call fcn.100372dd
push ebx
call fcn.100128b4
pop ecx
jmp 0x1000f5c7
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x1000f5af
push eax
lea eax, [ebx + edi]
push 0
push eax
call fcn.1002ecf0
add esp, 0xc
push esi
call fcn.100372dd
pop ecx
test ebp, ebp
je 0x1000f5bd
mov dword [ebp], edi
mov eax, ebx
jmp 0x1000f5ca
push esi
call fcn.100372dd
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10017be4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100519ca
call fcn.1002b504
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
and dword [esi + 0xc], 0
and dword [esi + 8], 0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x50], eax
push 0x3f
pop eax
mov byte [ebp - 4], 2
mov dword [esi + 4], 0x3f800000
mov word [esi + 0x10], ax
call fcn.1001a7f8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10044d80
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10044bff
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
mov ecx, 0x3f
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
push edi
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], 0
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x104]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x104]
push edx
push 0x401cf5
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
add esp, 0xc
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp + 0x10]
jge 0x40654c
mov ecx, dword [ebp - 0xc]
sub ecx, 0xffffffff
and ecx, 0x800000ff
jns 0x4064ac
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ecx]
mov edx, dword [ebp - 0x10]
add edx, eax
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 4]
mov byte [ecx], dl
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ecx]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [edx]
add eax, ecx
and eax, 0x800000ff
jns 0x40651d
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov dl, byte [ecx]
mov byte [ebp - 4], dl
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
mov eax, dword [ebp - 4]
and eax, 0xff
xor ecx, eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x14]
mov byte [eax], cl
jmp 0x406481
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4b243042
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6ac870dd
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40c04d
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebx - 0x12d7acdf], esi
sbb al, 0xd7
and al, 0xe6
lds edx, [0xff5b5a23]
pop edi
and dword [edi], esp
pop ebx
call [edi + 0x21]
daa
mov eax, dword [ecx - 0x1d]
mov al, byte [0xc0ec72e9]
mov esp, 0xa07c10b3
arpl word [ecx], dx
dec eax
xor byte [eax - 0x61], dh
dec ebp
pop edx
jge 0x40c05b
sbb dword [esi + 0x77602638], 0xc93222b1
fcom dword [ebx]
fmul dword [ecx - 0x5f]
hlt

Function at 0x43f3b3
Capabilities:
Encode data using xor

Disassembly:
dec esp
pop esi
bound esp, qword [edi + 0x12]
push esp
add dl, byte [ebx + esi]
xor edi, eax
and eax, 0xb4c2d0c7
div ecx
mov ebx, dword [esi - 0x7f686e6d]
mov dl, 0xb4
mov dl, 0xe5
push edi
sub eax, 0x7be05045
sub dword [esi + 3], esp
dec edi
xor byte [eax], dh
push ebx
cmp al, 0xdc
xchg edx, eax
adc dword [eax - 0x1954576a], 0xffffff92
rol byte [edx - 0x5c0b489c], 0xa5
pop es
push ebp
add esi, dword [eax + 0x73]
popal
and byte [ecx + 0x4f], ah
adc byte [eax], ch
add dword [ebx], esp
xor dword [edi], 0x7270d220
aam 0xf3
nop
out 0xf0, al
sal dword [ecx], 1
xchg edi, eax
sal esp, cl
or ebx, 0x8270706c
cld
mov ecx, 0xdeada87c
jno 0x43f3ce
adc byte [ebx + 0x30], ah
pop ds
xor dh, byte [edx - 0x24]
push ebx
fucom st(4)
loop 0x43f45e
std
xchg ebx, eax
xchg ebp, eax
dec ecx
xor edx, 0x981f7ea2
lodsd eax, dword [esi]
std
cmp dword [ecx + 0x64a17f37], 0xc1151286
adc ebp, dword [edi - 0x23]
adc ebx, dword [ebx]
pop esi
shr byte [esi - 0x2d4efd10], 1
push edx
ret 0x47b1
salc
pushal
sub eax, 0xb895792
mov eax, dword [0x6241e8c2]
adc edx, 0xedfcffcc
bound eax, qword [ecx - 0x300332e]
in eax, dx
popfd
loope 0x43f453
xor edx, dword [esi]
ficom word [eax + 0x1c1e6161]
xchg edi, eax
insb byte es:[edi], dx
ret

Function at 0x457c96
Capabilities:
Encode data using xor

Disassembly:
sub ch, byte [ecx + 0x7d]
invalid
pop esi
shr byte [ebx + 0x4a], cl
rcr byte [eax - 0x7f], 0x8d
mov al, byte [0x99d23b92]
test bh, al
test dword [ecx], edx
mov ah, 0x3d
xor ebp, dword [0xd7671dff]
mov byte [0xd7c9371a], al
cmp eax, 0x56dfe01f
pop ds
loopne 0x457c97
push esi
prefetcht1 byte [edx + 6]
test dword [eax - 0x66], edx
dec edi
loope 0x457cb5
jb 0x457c5b
inc esi
mov eax, dword [0xc620f360]
adc al, dl
ret
Function at 0x46018a
Capabilities:
Encode data using xor

Disassembly:
sub ecx, dword [0xcd21e42a]
or eax, 0xcd21e42a
inc ebp
jbe 0x4601c6
int1
add byte [edx + 0x60], al
sbb eax, 0xb3c85661
mov al, 0xf2
fst qword [ecx + 0x73e0cd20]
jnp 0x460189
adc byte [ebp + 0x10], 0x7b
fisubr dword [ebx]
xchg byte [ecx - 0x54d5abd6], al
and dword [edx], ebp
push esp
sub ch, byte [ebx - 0xb0cc89a]
cmp byte [esi + 0x3593444c], 0x1f
xchg edx, eax
mov ecx, dword [edx + 0x702116f7]
xor eax, 0x8a8b921f
not dword [esi]
and dword [eax - 0x70], esi
nop
js 0x460243
and ah, byte [edx - 0x31fd4f50]
or eax, 0xc667f070
loopne 0x4601bd
bound ebx, qword [esi - 0x5c]
test al, 0xba
xchg esi, eax
mov ah, 0x5d
push 0x4dd2cf5d
mov bh, 0x63
jno 0x4601b8
sahf
mov word [ebp + 0x31681013], ds
add edx, dword [esi - 0x3e]
dec esp
ret 0xc3ed
js 0x460277
xor ebx, ecx
bound esp, qword [ecx]
fldenv [edx + 0x21]
or dword [edi + 0x63], 0xd5719666
inc esp
and edx, dword [ebx - 0xa2f531a]
xor ecx, dword [ebx + 0x61]
pop ebp
mov edx, dword [eax - 0x4c5a37bd]
pop esi
pop ds
pushal
push ecx
dec edi
je 0x4602d7
or al, 0x50
adc eax, 0xc07280a
loope 0x460242
pop ebp
mov ebp, 0x50318c2d
cmc
dec esp
xor byte [edi - 0xe3ddc43], 0xa5
dec eax
sbb eax, 0xe57f4d73

Function at 0x4a1696
Capabilities:
Encode data using xor

Disassembly:
in al, dx
sbb eax, 0xab905e7e
fcomp qword [eax - 0x3490c6a5]
mov edi, 0xe23936e7
add eax, 0xa5d3693f
sbb al, 0x38
lodsb al, byte [esi]
pop es
mov ebp, 0x83298b80
jl 0x4a1680
push edi
jl 0x4a16ed
sahf
xor edi, edx
imul edx, dword [ebx], 0xffffffe9
sub eax, 0xc553e507
call 0x106014b4
invalid
inc edx
jmp 0x7242bc2d
and dl, byte [ecx - 0x174040e6]
pop ecx
dec byte [edi - 0x3b]
cwde
leave
or eax, 0x4bed9cda
mov bh, 0xc7
sbb esp, dword [edx - 0x7b]
mov dl, 0xcf
sub edx, dword [ebx + 0x5bc1c8d3]
stosb byte es:[edi], al
sbb byte [ecx + 0x3b], bh
sbb ebx, ebx
add ebx, ebx
enter 0x1620, 0x5f
cmp ebx, dword [ecx]
fild dword [ebx]
fcmovne st(0), st(0)
and byte [esi], dl
pop edi
cmp al, 0x7f
inc ebx
fld xword [edx + 0xf]
lds ebx, [edi + 0x435c987f]
cdq
xchg ebx, eax
pop edi
pushal
inc ebp
cmp esi, ebx
push ss
fist dword [edi]
xchg esi, eax
out 0x11, eax
inc ebx
mov dword [edi], ebp
xchg ecx, eax
xor eax, 0xd14d4deb
aad 0xaf
jnp 0x4a17bb
loop 0x4a16cc
mov al, byte [0xba7f1aac]
rol cl, 1
cwde
xchg esi, eax
xor dword cs:[edx - 0x48], edx
or esi, dword [edx + 8]
inc ecx
call 0x4f3dde95
mov dword [ecx], ebp
aas
or al, 0xb7
insd dword es:[edi], dx
xchg dword [edx + ecx + 0x6ff98f7f], ebp
jmp 0x4a170e
pop esp
mov fs, word [ebx - 0xd]
jl 0x4a1825
add ah, byte [0x7f4cc615]
cmpsd dword [esi], dword es:[edi]
dec esi
js 0x4a17f8
fcomp dword [esi]
push ss
mov byte [0x21097944], al
xlatb
pop edx
mov esp, 0xb0682aa5
pop ecx
xor al, 0x2d
invalid
retf
daa
jge 0x4a182c
retf 0x57af
into
dec ebp
invalid
Function at 0x4a1a76
Capabilities:
Encode data using xor

Disassembly:
fsub st(6)
mov ebp, 0x8ff6354a
fstp xword [edx - 0x63]
mov edi, 0x59cf635d
mov ebp, 0x4b74292d
mov edx, 0x7a34c058
clc
sal byte [edx + edi*2], 0xf8
xor eax, 0xcd05af3a
and eax, 0x4abee9df
push dword [eax - 0x537039e8]
nop
mov esp, 0xa965048f
cwde
adc byte ss:[edx], al
pop dword [ebp + edi*2]
sbb eax, 0x472840ea
or eax, 0x83dc2bc1
fadd qword [ebx - 0x61f4faa5]
mov al, 0x85
ja 0x4a1a8c
cld
cmp byte [ecx - 0x68], dl
mov al, 0x25
scasd eax, dword es:[edi]
out 0x89, al
retf 0x9f6d

Function at 0x51e518
Capabilities:
Encode data using xor

Disassembly:
int1
mov dword [ecx + 0x114931a9], edx
sub dword [ecx + 9], esi
xchg ecx, eax
sub dword [ecx], esi
dec ecx
adc dword [ecx - 0x566e760f], ebp
xor dword [ecx + 0x11], ecx
sub dword [ecx + 9], esi
xchg ecx, eax
sub dword [ecx], esi
dec ecx
adc dword [ecx - 0x566e760f], ebp
xor dword [ecx + 0x11], ecx
sub dword [ecx + 9], esi
xchg ecx, eax
sub dword [ecx], esi
dec ecx
adc dword [ebx], esp
sbb al, 0x2b
sub ebp, dword [esi - 0x5941d322]
xor esi, dword [bp + di - 0xd]
pop edi
invalid
mov dl, 0x57
sub dword [ecx - 0x60af8655], 0xffffffe7
arpl word [edi - 0x641eb4f6], si
loope 0x51e4b5
loope 0x51e4b5
mov dword [0xc050e319], eax
mov eax, 0xe313550c
pushal
sub al, 0xb0
not byte [eax - 0x19]
mov bl, 0x52
nop
jbe 0x51e50b
invalid
Function at 0x52051a
Capabilities:
Encode data using xor

Disassembly:
push ebx
into
xchg ebx, eax
and ebx, dword [esi + 0x2d4058b3]
sti
dec edx
xchg ecx, eax
or byte [edx], dl
xchg ebx, eax
popal
and eax, 0xd58d335b
fnstenv [eax - 0x2f6cf1ba]
add ah, ah
xchg esi, edx
mov al, 0x46
push cs
xchg ebx, eax
rol byte [edx], 1
in al, 0x87
salc
push es
in eax, dx
in eax, 0x50
jae 0x5204b4
mov ch, 0x90
loopne 0x5204c4
mov eax, esp
popal
invalid
cmp eax, 0xc34f61b0
or byte [ecx], ch
pop esi
mov dl, 0xd
pop ebp
in al, dx
mov bl, 0x84
inc ebx
mov ebx, 0xfd1fc826
enter 0xfffffffffffffd1f, 0x53
enter 0xfffffffffffffd1f, 0x53
jge 0x5204ca
add ebp, dword [edi]
pop edi
in al, 0x31
add dword [esi + 0x26], esi
mov eax, dword [0x93135e20]
push 0x6ec28c81
outsb dx, byte [esi]
dec ebx
stosb byte es:[edi], al
xor eax, 0xd575a840
fdivr st(6), st(0)
salc
jnp 0x520532
add ebp, dword [ebp - 0x16]
mov ecx, 0xeeb31d2d
jecxz 0x5205c0
adc al, 0xcd
jnp 0x5205af
lcall 0x9378, 0x96ce1d3d
invalid
sbb al, 0xa9
xor dword [esi + 0x6e232b55], esi
inc esi
leave
xchg esp, eax
jecxz 0x520533
or cl, byte [edx + 0x22]
rcl ah, cl
push edi
jp 0x52050a
adc byte [eax - 0x4e4b4c2d], 0x75
lmsw word [esi]
nop
sal dword [ebx + 0xf75b1b4], cl
add dword [esi], esi
fadd dword [ebx]
fiadd word [esi + 3]
in eax, dx
inc esi
add ebp, ebp
and al, 0x73
int1
sti
loope 0x5205e6
push ds
and edi, dword [edi]
mov ebp, 0xc33b3565
jae 0x5205f4
invalid
std
je 0x520594
in eax, 0xb3
std
fld xword [ebp + 0x45]
push edi
lea ebx, [esi - 0x5e]
xor eax, 0x8f8ee2ed
mov dword [0x62217303], eax
pop edx
inc edx
invalid
add esi, dword [ebx + 0x21]
bound ebx, qword [edx + 0x42]
xor edi, dword [edx]
inc ecx
inc ebp
outsd dx, dword [esi]
inc ebx
jne 0x520606
sal dword [eax - 0x59], cl
loop 0x5205c2
or byte [0xc36f93d2], 0xf6
mov ah, 0xb
loope 0x520573
jle 0x520587
popal
nop
push ebp
mov ch, 0x69
xchg esp, eax
sub edx, dword [ebx - 3]
add ebp, dword es:[ebx + 0x77]
arpl di, ax
invalid
imul edx, dword [ebx + ebp + 0x262efd53], 0x63776b03
invalid
jae 0x5205dc
test ebx, ecx
pushal
push ebx
ret
fnstcw word [edi + esi]
and edi, dword [ebp - 0x65]
xchg dword [esi], ebx
pop ebp
into
and byte [ecx - 0x24], 0x87
add ah, ah
pushfd
sbb byte [eax - 0x41], bh
adc ch, 0xe4
ret
Function at 0x533d56
Capabilities:
Encode data using xor

Disassembly:
in al, dx
ljmp 0x474c
cmp eax, 0x736320c7
test dword ss:[esi], eax
arpl word [ebx + 0x36], si
test dword [esi], eax
jno 0x533cef
inc esi
ljmp 0xd405
push cs
jg 0x533c7b
arpl word [ebx], di
cwde
mov bh, 0x1c
inc edi
add dword [esi + 0x24], 0x4a
dec edx
xchg esi, eax
mov ah, ah
xchg byte [eax - 0xe], dh
outsd dx, dword [esi]
loope 0x533d3a
into
and al, 0x71
out dx, al
inc esi
in al, dx
mov esp, 0xd5422750
out dx, eax
int1
loope 0x533cc3
add al, 0x50
push edi
xchg esi, eax
cmp eax, 0xc5e9ea66
add eax, 0xb02f22f4
loope 0x533d3f
jp 0x533d04
aam 0x9c
mov edx, 0xd1eb240
or al, 0xa9
call 0x26753cd6
xchg edx, eax
xchg esp, eax
adc edi, esp
retf
out 0xcb, eax
insd dword es:[edi], dx
loop 0x533ce3
jae 0x533d77
invalid
in eax, dx
iretd
ficom dword [esi - 0x7fd838f4]
dec esi
pop ds
sub esp, dword [eax]
js 0x533cf9
or byte [esi + 0x1f], 0x2b
and byte [eax - 0x4d], bh
push eax
and eax, 0x3f0e4785
call 0x56ea7a51
jp 0x533d2b
mov ah, 0x5c
mov bh, 0x11
adc dword [ebp - 0x19dfc1f8], esi
mov ecx, 0x564819b7
jp 0x533da3
jb 0x533db0
das
cli
mov cl, 0xf3
scasb al, byte es:[edi]
or eax, 0xc06ce0d8
loopne 0x533d11
loopne 0x533dda
shl al, 0xa0
lodsb al, byte [esi]
sub ebp, dword [edx - 0x89e0cf3]
call 0xbc2fff12
imul eax
xchg ebp, eax
rcr esp, 0xbb
dec ebp
out 0x23, al
leave
inc ebp
mov dh, byte [eax]
xor byte [edi + ecx - 6], dl
push es
cdq
push es
pop esp
pop ebp
cmp dword fs:[esi - 0x25], ebp
jle 0x533d92
fstp xword [esi - 3]
jl 0x533d6c
mov dl, 0xf6
pop es
shl byte [ecx + 0x53a5a859], 1
aaa
jno 0x533dca
jg 0x533da5
jg 0x533da5
inc dword [edx + esi + 0x3f]
inc esp
xor bh, byte [edi]
adc al, 0x24
sbb byte [ebx - 0x1e88e83f], dh
xchg cl, al
rep stosb byte es:[edi], al
loope 0x533d38
shl dword [esi - 0xd], 0xaa
xor cl, 0x80
jae 0x533da7
jl 0x533d8e
inc edi
int1
hlt
mov esi, 0x714d1f35
add ebx, dword [ecx]
xlatb
mov ah, 0x37
xchg byte [ecx], ah
and dword [edx], ebp
into
push eax
ljmp 0x54a4:0xa438c46e

Function at 0x53f568
Capabilities:
Encode data using xor

Disassembly:
sub dword [edx], 0xfd98c476
sub dword [edx], ecx
mov cs, word [ecx - 0x67]
sbb dword [edx - 0x65acbaee], 0x31fd7937
push eax
push es
pop es
lcall 0xa982, 0x42928379
mov dl, 0x88
das
inc esi
retf
rol dword [esi], cl
pop ds
inc ebx
cmpsb byte [esi], byte es:[edi]
loope 0x53f4f8
add dword [eax - 0x69635232], edi
movsd dword es:[edi], dword [esi]
test eax, 0x42a1a797
invalid

Function at 0x566ccd
Capabilities:
Encode data using xor

Disassembly:
invalid
jns 0x566c6b
insb byte es:[edi], dx
push edx
out dx, al
fsub qword [0xe253604b]
mov esp, 0xbec7850b
invalid
Function at 0x5f798d
Capabilities:
Encode data using xor

Disassembly:
or byte [edx - 3], bh
xchg ebx, eax
fld qword [ebx]
movsb byte es:[edi], byte [esi]
or edi, dword [esp + eax*2 + 0x5ada7ee0]
cwde
mov dword cs:[0x6d79f141], eax
ficomp dword [ebp + 0x5a]
pop edi
ljmp 0xdf3a
mov ah, 0x5c
mov dword [0x999e5100], eax
inc ebx
arpl word ss:[ebx - 0x3e], bx
dec ax
cdq
xor byte [ebp - 0x69df01c4], 0xdd
loope 0x5f792f
invalid
cmp al, 0xfe
and byte [esi + 0x49a1e1dd], dl
invalid
dec ecx
mov eax, dword [0xa672049]
dec ecx
and byte [edi + 0xa], ah
xor cl, byte [0x7b997f77]
out 0xa5, al
cmpsd dword [esi], dword es:[edi]
mov al, byte [0x2fcce7f7]
popal
push ds
jle 0x5f7987
xchg esi, eax
push ds
mov eax, dword [0x9ef20c0e]
out 0xa9, al
mov dh, 0x74
out dx, eax
sti
push ss
cdq
loop 0x5f7976
rcl al, cl
sbb dword [esi], ecx
push esi
push ds
add si, si
jl 0x5f797d
les edi, [eax]
jo 0x5f7a1a
out dx, eax
cmp al, byte [eax + 0x4b1dff9f]
adc ebx, ebx
xchg esi, eax
invalid
mov dh, 0xcd
retf
pop ebx
dec esi
jns 0x5f79f9
cmp eax, 0xb6f164bc
pop esp
fisubr dword [ebx + edx + 0x23]
aaa
dec esp
jnp 0x5f79b4
pop esi
invalid

Function at 0x603019
Capabilities:
Encode data using xor

Disassembly:
lgs esp, [eax + 0x38bb26e5]
cmp edi, dword [ecx + ebp]
stosd dword es:[edi], eax
insb byte es:[edi], dx
push ebx
or ch, byte ss:[edx - 0x7a]
inc ebp
jmp ecx
or al, 0xf8
inc ebx
inc esp
sub eax, 0x3343d08
stosb byte es:[edi], al
push 0xb23aef80
dec ebp
jmp 0x4d6ed21d
cld
jl 0x602fa9
invalid
fcom st(6)
inc dword [edi + 0x2d]
sahf
mov ebp, 0x1e7faecb
lodsb al, byte [esi]
dec esp
cli
and bl, byte [edi + 0x16]
inc eax
sbb esi, edx
sub byte [edx], dh
pop esi
fcom dword [edx - 0x23cf6deb]
daa
push ebp
xor al, 0xda
js 0x603038
cmp al, 0xa2
pop edx
and cl, bl
and edx, ebx
jne 0x602fcd
pop ecx
sal byte [ebx + 0xa], 0x4f
push esp
jnp 0x60302a
insd dword es:[edi], dx
test esp, edx
inc edi
enter 0xffffffffffffd49e, 0xffffffffffffffc6
mov bh, 0xe0
pop es
lodsb al, byte [esi]
wait
cmc
cmp bh, byte [esp + eax*4 + 0x4e76b45d]
dec ecx
or bh, byte [0x1d7faeca]
pop ss
jp 0x602ff7
into
jmp [ebx + 0x47d112ce]

Function at 0x60cca9
Capabilities:
Encode data using xor

Disassembly:
js 0x60ccfd
sbb eax, 0x8059792
or eax, 0xb68a010a
rcl dword [edx + 0x5a], cl
pop eax
sub eax, 0x53c0467d
cli
inc ebx
iretd