joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100833c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100d4040]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push 0x1008e388
push edi
mov dword [ebp - 0x210], edi
call sub.msvcrt.dll_wcspbrk
add esp, 8
test eax, eax
jne 0x10083400
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10079d54
mov esp, ebp
pop ebp
ret
push ebx
push esi
xor esi, esi
call sub.msvcrt.dll__errno
mov ebx, dword [eax]
call sub.msvcrt.dll__errno
push 0x104
push edi
mov dword [eax], esi
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll__wfullpath
add esp, 0xc
mov edi, eax
call sub.msvcrt.dll__errno
test edi, edi
je 0x1008343c
mov dword [eax], ebx
mov ebx, dword [ebp - 0x210]
jmp 0x1008346b
cmp dword [eax], 0x22
jne 0x1008357a
call sub.msvcrt.dll__errno
push 0
mov dword [eax], ebx
mov ebx, dword [ebp - 0x210]
push ebx
push 0
call sub.msvcrt.dll__wfullpath
mov esi, eax
add esp, 0xc
mov edi, esi
test edi, edi
je 0x1008357a
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10083470
sub ecx, edx
sar ecx, 1
cmp ecx, 3
je 0x10083552
mov ecx, edi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10083490
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jb 0x1008357a
movzx eax, word [edi]
cmp eax, 0x5c
je 0x100834b9
cmp eax, 0x2f
jne 0x1008357a
movzx eax, word [edi + 2]
cmp eax, 0x5c
je 0x100834cb
cmp eax, 0x2f
jne 0x1008357a
movzx eax, word [edi + 4]
cmp eax, 0x5c
je 0x1008357a
cmp eax, 0x2f
je 0x1008357a
movzx eax, word [edi + 6]
lea edx, [edi + 6]
mov edi, eax
test ax, ax
je 0x10083512
mov ecx, eax
cmp cx, 0x5c
je 0x1008350f
cmp cx, 0x2f
je 0x1008350f
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
mov edi, eax
test ax, ax
jne 0x100834f1
jmp 0x10083512
movzx edi, cx
test di, di
je 0x1008357a
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
test ax, ax
je 0x1008357a
cmp cx, 0x5c
je 0x10083543
cmp cx, 0x2f
je 0x10083543
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
mov edi, eax
test ax, ax
jne 0x10083525
jmp 0x10083546
movzx edi, cx
test di, di
je 0x10083552
cmp word [edx + 2], 0
jne 0x1008357a
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push esi
cmp eax, 1
jbe 0x1008357b
call sub.msvcrt.dll_free
add esp, 4
mov al, 1
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10079d54
mov esp, ebp
pop ebp
ret
push esi
call sub.msvcrt.dll_free
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor al, al
pop esi
pop ebx
pop edi
call fcn.10079d54
mov esp, ebp
pop ebp
ret
Function at 0x10083740
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100838e8
push esi
xor esi, esi
push dword [edi + esi*4]
call sub.msvcrt.dll_free
inc esi
add esp, 4
cmp esi, 7
jne 0x10083752
push ebx
lea esi, [edi + 0x1c]
mov ebx, 7
lea esp, [esp]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10083770
lea esi, [edi + 0x38]
mov ebx, 0xc
lea ebx, [ebx]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10083790
lea esi, [edi + 0x68]
mov ebx, 0xc
lea ebx, [ebx]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x100837b0
lea esi, [edi + 0x98]
mov ebx, 2
lea ecx, [ecx]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x100837d0
push dword [edi + 0xa0]
call sub.msvcrt.dll_free
push dword [edi + 0xa4]
call sub.msvcrt.dll_free
push dword [edi + 0xa8]
call sub.msvcrt.dll_free
mov eax, dword fs:[0x18]
add esp, 0xc
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60001
jb 0x100838e6
lea esi, [edi + 0xb8]
mov ebx, 7
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10083835
lea esi, [edi + 0xd4]
mov ebx, 7
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10083852
lea esi, [edi + 0xf0]
mov ebx, 0xc
nop
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10083870
lea esi, [edi + 0x120]
mov ebx, 0xc
lea ecx, [ecx]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10083890
lea esi, [edi + 0x150]
mov ebx, 2
lea ecx, [ecx]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x100838b0
push dword [edi + 0x158]
call sub.msvcrt.dll_free
push dword [edi + 0x15c]
call sub.msvcrt.dll_free
push dword [edi + 0x160]
call sub.msvcrt.dll_free
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100838f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10083a82
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1008391a
call fcn.100836e0
test al, al
jne 0x1008391a
push dword [esi + 0xc]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x10083935
call fcn.100836e0
test al, al
jne 0x10083935
push dword [esi + 0x10]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10083950
call fcn.100836e0
test al, al
jne 0x10083950
push dword [esi + 0x14]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x1008396b
call fcn.100836e0
test al, al
jne 0x1008396b
push dword [esi + 0x18]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x10083986
call fcn.100836e0
test al, al
jne 0x10083986
push dword [esi + 0x1c]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100839a1
call fcn.100836e0
test al, al
jne 0x100839a1
push dword [esi + 0x20]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x100839bc
call fcn.100836e0
test al, al
jne 0x100839bc
push dword [esi + 0x24]
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60001
jb 0x10083a82
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x100839fb
call fcn.100836e0
test al, al
jne 0x100839fb
push dword [esi + 0x38]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x10083a16
call fcn.100836e0
test al, al
jne 0x10083a16
push dword [esi + 0x3c]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x10083a31
call fcn.100836e0
test al, al
jne 0x10083a31
push dword [esi + 0x40]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10083a4c
call fcn.100836e0
test al, al
jne 0x10083a4c
push dword [esi + 0x44]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10083a67
call fcn.100836e0
test al, al
jne 0x10083a67
push dword [esi + 0x48]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x10083a82
call fcn.100836e0
test al, al
jne 0x10083a82
push dword [esi + 0x4c]
call sub.msvcrt.dll_free
add esp, 4
pop esi
pop ebp
ret
Function at 0x10083a90
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0xbc]
test ecx, ecx
je 0x10083c0d
mov eax, dword [edi + 0xb0]
test eax, eax
je 0x10083c0d
cmp dword [eax], 0
jne 0x10083c0d
call fcn.100836e0
test al, al
jne 0x10083c0d
mov ecx, dword [edi + 0xb0]
call fcn.100836e0
test al, al
jne 0x10083c0d
mov ecx, dword [edi + 0xb8]
test ecx, ecx
je 0x10083b0f
cmp dword [ecx], 0
jne 0x10083b0f
call fcn.100836e0
test al, al
jne 0x10083b0f
push dword [edi + 0xb8]
call sub.msvcrt.dll_free
push dword [edi + 0xbc]
call fcn.100838f0
add esp, 8
mov ecx, dword [edi + 0xb4]
test ecx, ecx
je 0x10083bf4
cmp dword [ecx], 0
jne 0x10083bf4
call fcn.100836e0
test al, al
jne 0x10083bf4
push dword [edi + 0xb4]
call sub.msvcrt.dll_free
mov esi, dword [edi + 0xbc]
add esp, 4
test esi, esi
je 0x10083bf4
mov ecx, dword [esi]
test ecx, ecx
je 0x10083b68
call fcn.100836e0
test al, al
jne 0x10083b68
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10083b83
call fcn.100836e0
test al, al
jne 0x10083b83
push dword [esi + 4]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10083b9e
call fcn.100836e0
test al, al
jne 0x10083b9e
push dword [esi + 8]
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60001
jb 0x10083bf4
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x10083bd9
call fcn.100836e0
test al, al
jne 0x10083bd9
push dword [esi + 0x30]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x10083bf4
call fcn.100836e0
test al, al
jne 0x10083bf4
push dword [esi + 0x34]
call sub.msvcrt.dll_free
add esp, 4
push dword [edi + 0xb0]
call sub.msvcrt.dll_free
push dword [edi + 0xbc]
call sub.msvcrt.dll_free
add esp, 8
mov ecx, dword [edi + 0xc0]
test ecx, ecx
je 0x10083c73
cmp dword [ecx], 0
jne 0x10083c73
call fcn.100836e0
test al, al
jne 0x10083c73
mov eax, dword [edi + 0xc4]
sub eax, 0xfe
push eax
call sub.msvcrt.dll_free
mov eax, dword [edi + 0xcc]
add esp, 4
sub eax, 0x80
je 0x10083c4f
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword [edi + 0xd0]
sub eax, 0x80
je 0x10083c65
push eax
call sub.msvcrt.dll_free
add esp, 4
push dword [edi + 0xc0]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [edi + 0xd4]
test ecx, ecx
je 0x10083ca8
cmp dword [ecx + 0xb4], 0
jne 0x10083ca8
call fcn.100836e0
test al, al
jne 0x10083ca8
push dword [edi + 0xd4]
call fcn.10083740
push dword [edi + 0xd4]
call sub.msvcrt.dll_free
add esp, 8
lea esi, [edi + 0x48]
lea ebx, [edi + 0xa8]
cmp esi, ebx
je 0x10083cec
mov ecx, dword [esi]
test ecx, ecx
je 0x10083cc0
call fcn.100836e0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10083ce5
call fcn.100836e0
test al, al
jne 0x10083ce5
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10083ce5
cmp dword [eax], 0
jne 0x10083ce5
push eax
call sub.msvcrt.dll_free
add esp, 4
add esi, 0x10
cmp esi, ebx
jne 0x10083cb5
push edi
call sub.msvcrt.dll_free
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10083db0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x100d4040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1018b21c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x508], ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test eax, eax
jne 0x10083dfe
push str._create_locale
call fcn.10085bf0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x508]
test eax, eax
jne 0x10083df9
or eax, 0xffffffff
mov dword [0x1018b21c], eax
lea edi, [eax + 1]
neg edi
sbb edi, edi
and edi, eax
je 0x10083f1e
test esi, esi
je 0x10083e3f
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x10083e3f
xor ecx, ecx
mov al, byte [esi + ecx]
lea edx, [ecx + ecx]
test al, al
je 0x10083e5c
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x10083e22
push esi
push dword [ebp - 0x508]
call edi
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10079d54
mov esp, ebp
pop ebp
ret
cmp edx, 0x200
jae 0x10083fe7
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x10083e3f
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call ebx
test eax, eax
je 0x10083e3f
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call ebx
test eax, eax
je 0x10083e3f
lea ebx, [ebp - 0x504]
xor eax, eax
jmp 0x10083ef0
movzx ecx, word [ebx + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x10083f0f
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x10083ef0
jmp 0x10083e3f
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x10083e3f
cmp ecx, 5
ja 0x10083fc7
test esi, esi
je 0x10083fc7
call fcn.10084150
mov edi, eax
test edi, edi
je 0x10083fd2
call fcn.1007a710
mov ebx, eax
push esi
push dword [ebp - 0x508]
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x50c], eax
or eax, 2
mov dword [ebx + 0x70], eax
call fcn.10084260
add esp, 8
test eax, eax
je 0x10083f82
mov eax, dword [ebx + 0x6c]
push dword [eax + 4]
call sub.msvcrt.dll__setmbcp
add esp, 4
test eax, eax
jne 0x10083f82
call fcn.10084150
mov esi, eax
jmp 0x10083f84
xor esi, esi
mov eax, dword [ebp - 0x50c]
mov ecx, dword [ebx + 0x6c]
mov dword [ebx + 0x70], eax
mov eax, dword [edi]
cmp eax, ecx
je 0x10083f9b
mov dword [edi], ecx
mov dword [ebx + 0x6c], eax
mov eax, dword [edi + 4]
mov ecx, dword [ebx + 0x68]
cmp eax, ecx
je 0x10083fab
mov dword [edi + 4], ecx
mov dword [ebx + 0x68], eax
push edi
call fcn.10083ff0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10079d54
mov esp, ebp
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
mov ecx, dword [ebp - 4]
xor esi, esi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.10079d54
mov esp, ebp
pop ebp
ret
call fcn.1007a4eb
int3
Function at 0x10084260
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x100d4040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1008435b
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x1008435b
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x100842ba
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x10084298
jmp 0x1008435b
cmp edx, 0x200
jae 0x100843c1
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x1008435b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x1008435a
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x1008435a
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x100843a3
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x10084340
pop edi
mov eax, dword [0x1018b224]
test eax, eax
jne 0x10084381
push str.setlocale
call fcn.10085bf0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1008437c
or eax, 0xffffffff
mov dword [0x1018b224], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x100843af
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10079d54
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x1008435a
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10079d54
mov esp, ebp
pop ebp
ret
call fcn.1007a4eb
int3
Function at 0x10084a40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call sym.steam_api.dll_SteamAPI_ISteamController_GetControllerState
mov esi, dword [ebp + 8]
test al, al
je 0x10084a5e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.10084a70
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40cee2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe039b3
invalid
cmp eax, esp
add dh, bh
movsd dword es:[edi], dword [esi]
cmp al, 0x5e
push 0x459f12f9
jmp 0x40ce31
jno 0x40ce35
xor dword [edi - 0x49], ecx
aad 0x13
fdivr qword [ebx + 0x17e8f69c]
mov bh, 0xd5
adc ebx, esp
mov ebx, 0x17e8f69c
pop ds
ror byte [ecx], 1
mov ch, 0x1d
inc esp
invalid
rcr dword [edx - 0x7577bdee], cl
test dword [eax - 0x51c9aae9], edi
mov ch, byte [eax]
sbb edi, ebp
fsub st(5)
mov al, byte [0x3d9a44ff]
insd dword es:[edi], dx
jns 0x40ce15
jge 0x40ce17
fisubr dword [edi - 0x70]
jg 0x40ce1e
cmc
mov byte [edx + 0x6c], dh
inc ebx
adc eax, 0x99380551
inc esi
dec esi
pop ebp
hlt
sbb eax, 0x6d1b1f9e
jno 0x40ce6f
pop ds
sbb ebp, dword [ebp + 0x71]
xchg byte [edi - 0x5cc48d1f], bh
mov edi, 0xa33b72e1
insd dword es:[edi], dx
push esp
imul esp, esp, 0xb864c4f8
salc
clc
les esp, [eax + edi*4 - 0x2a]
jbe 0x40cf3c
push dword [eax]
je 0x40cf6f
mov ch, 0x6c
mov cl, 0xb2
mov esp, 0xc4ee771c
cmp eax, 0xb78c4500
push ecx
mov al, byte [0xf220d8a5]
cwde
xchg byte [ebx + 0x1c], dh
mov dword [edi - 0x59], esi
xchg edx, eax
shl edx, 0xbc
xchg dword [ebx], ebp
mov edi, 0x11cccf9
fsubr st(2)
xor cl, byte [esi]
xor al, 0xc9
mov dword [0x3c463e], eax
mov ecx, 0x94186fe3
imul edx, dword [ebp + 0x1f63ccf7], 0x35
inc ebx
lahf
xchg edx, eax
rcl byte [ebx]
idiv dword [esi - 0x4e3c1b2c]
jp 0x40cee4
add dword [esp + edi*8 - 0x37], 0x1d
cmp eax, 0x93c3c915
ja 0x40cef2
sbb dword [ecx], edi
jbe 0x40cfa6
cmp bl, byte [ebx - 0x5523f982]
push ebx
inc esp
cld
xor ebx, esp
jne 0x40cf5f
inc eax
inc esp
cmp eax, 0x93e69f44
inc esp
lahf
out 0x93, al
add ecx, 0xb900f9fd
sub byte [esi + esi*2 + 0x36], 0xa6
std
stc
add byte [ecx + 0x36766c82], bh
cmpsb byte [esi], byte es:[edi]
or ecx, dword [esi + 0x4c253825]
loopne 0x40cf69
pop es
push 0x99fe262d
imul esi, dword [ebp + 0x2d], 0xffffffec
xchg ebx, eax
insb byte es:[edi], dx
cmpsb byte [esi], byte es:[edi]
out dx, al
mov byte [edx + 0x30243df1], bh
sbb ah, ah
mov dh, 0x66
adc eax, 0x6f5cf5b7
aaa
or byte [esi - 0xc], bl
xchg esi, eax
insb byte es:[edi], dx
hlt
aad 0x16
and ebp, esp
ljmp 0x6608

Function at 0x43d75c
Capabilities:
Encode data using xor

Disassembly:
bound esp, qword [edi + 0x78cf8302]
mov dword [0x279e692e], eax
test dword gs:[ebx - 0x69d71d0], 0x6967a5a3
outsd dx, dword ds:[esi]
out 0x83, al
enter 0xffffffffffffaaac, 0xffffffffffffffc6
insd dword es:[edi], dx
pop ss
lea esp, [0x7fd83e87]
jg 0x43d737
adc dword [ebp + 0x4a], 0xffffffde
mov dword [eax], ebx
adc dl, dl
sbb edx, edx
and al, 0x7d
ja 0x43d7af
retf
xchg ecx, eax
mov dword [0x91848f04], eax
dec ebx
jo 0x43d7e5
jg 0x43d737
adc dword [ebp + 0x4a], 0xffffffde
mov dword [eax], ebx
adc dl, dl
sbb edx, edx
and al, 0x7d
ja 0x43d7af
retf
inc ebp
test byte cs:[0x9e6453ec], cl
Function at 0x4438ea
Capabilities:
Encode data using xor

Disassembly:
aad 0x93
lodsb al, byte [esi]
xlatb
cmp al, 0x62
retf 0xaf0a
xor byte [ecx + 0x4c], 0xe1
jle 0x443952
jno 0x4438ca
mov esp, 0x1e6ed134
insb byte es:[edi], dx
jmp 0x74b42c19
adc eax, 0x146e0495
sbb al, 0x50
shr esp, 1
inc edi
mov ah, 0xbb
fbld tbyte [eax + ebp*4]
das
adc al, 0xe5
out dx, eax
rcr ecx, cl
add bl, dl
sub ah, byte [edx - 0x6a]
mov esp, 0x54ce39ec
xor dl, byte [eax*8 - 0x3edb530e]
add eax, 0x9dead82a
xchg al, ah
xchg esi, eax
pop esp
outsd dx, dword cs:[esi]
adc dword [edi + 0x74c935e7], edx
lea ebp, [ebp + edx*4 - 0x5a6114c]
nop
dec edx
or byte [edx], cl
xchg esi, eax
sar dword [esi + edx*4], 1
mov esp, 0x5ac831a7
imul eax, dword [esi + 5], 0xcdcf0ad9
out 0xaf, al
int 0xe6
scasd eax, dword es:[edi]
pop esi
push 0x50
sub dl, byte [edi + ebx*4 - 0x15a392e7]
std
scasd eax, dword es:[edi]
xor dword [esi + 0x5f8b5414], ebx
aam 0x79
cdq
popfd
adc eax, 0x6fcf0265
dec edi
imul eax, dword [ecx + edx], 0x3e
cmc
push esp
jecxz 0x4439a3
invalid

Function at 0x47794d
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xe4
jp 0x4779a0
inc edx
sub dword gs:[ecx], ecx
retf 0xce46
xor byte [esi], dl
movsb byte es:[edi], byte [esi]
inc ebp
or ecx, edx
invalid
std
nop
jae 0x477959
sub eax, 0xa3964fc2
cmp ch, byte [0xb10b5a44]
cmp dword [edx], edx
mov dword [ecx - 0x3d], ebp
sbb esi, edx
call 0x1f7a7f92
int3
or bl, byte [ecx + 0x60fbd0c6]
lahf
jns 0x477a21
xchg ebp, eax
fnsave dword [edx]
enter 0x75e, 0xffffffffffffffac
inc ecx
jbe 0x4779e9
aad 0xfa
xor byte [ecx - 0x129ea106], dl
shr dl, 0x42
lds esi, [edi]
je 0x4779b4
adc al, 0x2b
arpl word [ecx + 0x5ab7ac71], si
mov edx, dword [ecx]
mov esp, 0x927e8e2
imul ebp, edx, 0xffffff86
div ch
inc eax
or ebx, dword [edi - 0xa51251b]
pop edx
loopne 0x477983
jb 0x4779e8
fbld tbyte [edx + 0x59]
insd dword es:[edi], dx
test al, 0xe7
out 0x80, eax
scasb al, byte es:[edi]
dec ebx
pop ecx
mov dl, 0xb0
push esp
sub byte [esi - 0x4f4da6b5], 0x67
push esp
xchg edx, eax
xor al, byte [esi - 6]
popal
invalid
sub al, 0x45
pop es
fild dword [ecx - 0x14]
push ds
cld
push ds
sbb ch, ch
sbb al, 0xdb
int3

Function at 0x49c4ba
Capabilities:
Encode data using xor

Disassembly:
loop 0x49c509
dec edi
push ss
mov ebx, 0x922751cb
push ss
pop ecx
not byte [edx]
out 0x51, al
xchg edi, eax
popal
inc eax
outsb dx, byte [esi]
hlt
mov ebp, 0x521745ff
inc ebp
pop ss
push edx
add dword es:[edx + 0x23], 0xeca8ade7
fiadd dword [ebx]
mov edx, 0x8553ee5d
jb 0x49c4e7
pop ebp
out dx, al
push ebx
test dword [edx - 0x38], esi
lcall 0x1876, 0xdff5f5f
insb byte es:[edi], dx
xchg ebx, eax
cmp ebp, dword [ebp + 0x32a1476a]
mov dh, 0xa1
xor eax, 0x2abd72dd
sti
mov bl, 0x50
enter 0x3851, 0xfffffffffffffffe
movsb byte es:[edi], byte [esi]
nop
add edx, edi
mov al, byte [0xd97ee20e]
jnp 0x49c519
xchg dword [ecx], edi
je 0x49c50b
cmp byte [edx], bh
cwde
mov al, byte [0xbbbbd921]
jp 0x49c5cf
cmpsd dword [esi], dword es:[edi]
mov byte [0x9f6249e6], al
stc
dec esp
or al, 0x94
aam 0xa
in al, dx
xor eax, esi
insb byte es:[edi], dx
lcall 0x7ae9, 0x93be0f55
mov ah, 0x1e
invalid
outsd dx, dword [esi]
pop eax
dec ebp
xor bl, byte [esi]
invalid
Function at 0x4b081c
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0xd7
xor esp, esp
in al, dx
mov esp, 0xe9922738
adc ch, byte [ebp - 0x17]
outsd dx, dword [esi]
mov ch, 0x1a
bound esp, qword [esi]
sbb al, cl
popfd
andnps xmm3, xmmword [ecx - 0x331e7554]
sub ch, dh
xor esp, ecx
push ss
stc
jno 0x4b082a
pop ss
jae 0x4b08c0
inc eax
jg 0x4b086c
xchg ecx, eax
push edi
cmpsd dword [esi], dword es:[edi]
shr dword fs:[edx + ebp + 0x6426b7da], cl
and ch, byte [edi + 0x34291829]
je 0x4b0818
lahf
push edx
cdq
je 0x4b0889
cdq
mov eax, 0xf0c6c87f
and ah, byte [edi + ebp*8]
invalid
invalid
loope 0x4b0842
xor byte [edi], 0x10
clc
push ebp
jmp 0xd26be5e4
push esp
xor eax, ebp
add byte [ecx - 0x50], bl
mov esp, 0x6771a522
or ch, bh
imul eax, esp, 0x44
mov bh, 0xb8
sub dh, byte [ecx + ecx + 0x6f]
loop 0x4b0847
jns 0x4b0868
clc
pop edi
aad 0xb1
xlatb
shr edi, 1
jl 0x4b0905
adc ah, byte [ebp + 0x1d36f37]
into
call 0xab908466
retf
sar dword [ebp + ebx*4 - 0x57], 1
insb byte es:[edi], dx
cmc
invalid
fstp xword es:[ecx + 0x78]
add dword [ebp + 0x11579d42], 0xb9d1345a
cwde
mov dword [0x75300377], eax
ljmp 0xdc03
popfd
push edi
adc dword [edx + 0x34], ebx
sar dword [ecx + 0x77a398f3], 1
add esi, dword [eax]
jne 0x4b08fe
xlatb
cwde
or dword [ebp - 0x39ff23fd], 0x74
leave
jecxz 0x4b08a4
xchg edx, eax
pop eax
mov eax, eax
sbb eax, 0x4aebf1a9
sub eax, 0x277d59c0
scasd eax, dword es:[edi]
add dword [eax], edx
and byte [ebx - 0x11], bh
xor eax, 0xd1cf9139
mov ebp, 0xee15ba9
popal
dec ecx
dec dword [ecx + eax*4]
das
out dx, al
out dx, al
or edi, ecx
fptan
xchg ebx, eax
dec edi
aad 0x54
push edx
invalid