joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10067c8
Capabilities:
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0xa
pop esi
jmp 0x10067f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2747
jne 0x1006809
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esi + esi*4]
shl esi, 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10067db
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10

Function at 0x100023dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100023eb
pop dword [ebp - 0x1c]
mov eax, 0x1af7191f
sub eax, 0xaf6f534
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xab517313
add dword [ebp - 0x2c], 0xa300d238
mov dword [ebp - 0x28], 0xf17f375d
add dword [ebp - 0x28], 0x40b414e8
mov dword [ebp - 0x24], 0x1dc85c9a
sub dword [ebp - 0x24], 0xd17c186c
mov dword [ebp - 0x20], 0x6a9f9dad
sub dword [ebp - 0x20], 0x6a9f9dad
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x4e3e3230
add dword [ebp - 0x2c], 0x26343726
mov dword [ebp - 0x28], 0xde6642bc
add dword [ebp - 0x28], 0x63061eb9
mov dword [ebp - 0x24], 0x281e0ec4
add dword [ebp - 0x24], 0x3b515da8
mov dword [ebp - 0x20], 0x8e9244b3
sub dword [ebp - 0x20], 0x8e9244b3
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x9f13789d
add eax, 0x70ed276b
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x34b97
push 0
call eax
mov ecx, 0x407c
mov ebx, eax
mov edi, 0x1000f800
add edi, dword [ebp - 0x1c]
mov edx, 0x3103cd48
mov esi, dword [edi]
sub dword [ebp - 8], 0x2d9b5766
xor esi, edx
sub dword [ebp - 0x14], ebx
mov dword [ebx], esi
mov dword [ebp - 4], 0xeb75dab1
add ebx, 0x766f9f8
sub ebx, 0x766f9f4
add edi, 0x73a21385
add edi, 0x8c5dec7f
loop 0x100024f6
add eax, 0x25ecd99e
add eax, 0xda141b25
xor ebx, ebx
add ebx, eax
add eax, 0x478e9290
sub eax, 0x478e928b
mov ecx, 0xc5b07869
sub ecx, 0xb5b07869
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x44982551
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x2527342b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x403130
Capabilities:
Check for time delay via gettickcount
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x1d8]
sub esp, 0x258
mov eax, dword [0x4132b0]
xor eax, ebp
mov dword [ebp + 0x1d4], eax
cmp dword [0x414d48], 0
mov eax, dword [ebp + 0x1e4]
push ebx
mov ebx, dword [ebp + 0x1e0]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], eax
jne 0x403371
test ebx, ebx
je 0x40334d
cmp byte [ebx], 0
je 0x40334d
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jl 0x40334d
push esi
push ebx
mov esi, 0x105
push esi
lea eax, [ebp + 0xcc]
push eax
call fcn.0040716b
test eax, eax
jge 0x4031b3
push 0x85f
push str.sfxhead.c
call fcn.0040242b
lea eax, [ebp + 0xcc]
push esi
push eax
call fcn.004011f2
pop ecx
pop ecx
push 0x410414
push esi
lea eax, [ebp + 0xcc]
push eax
call fcn.00407207
test eax, eax
jge 0x4031df
push 0x861
jmp 0x4031a9
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x78], eax
je 0x403326
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push esi
lea eax, [ebp + 0xcc]
push eax
call fcn.0040716b
test eax, eax
jl 0x403339
lea eax, [ebp + 0xcc]
push esi
push eax
call fcn.004011f2
cmp byte [ebp + 0xbc], 0
pop ecx
pop ecx
je 0x403253
lea eax, [ebp + 0xbc]
push eax
push esi
lea eax, [ebp + 0xcc]
push eax
call fcn.00407207
test eax, eax
jge 0x40326c
push 0x86a
jmp 0x4031a9
lea eax, [ebp - 0x48]
push eax
push esi
lea eax, [ebp + 0xcc]
push eax
call fcn.00407207
test eax, eax
jl 0x403343
test byte [ebp - 0x74], 0x10
je 0x4032e1
cmp byte [ebp + 0xbc], 0
push 0x410410
je 0x40329a
lea eax, [ebp + 0xbc]
push eax
call fcn.004079f0
test eax, eax
pop ecx
pop ecx
je 0x403310
lea eax, [ebp + 0xbc]
jmp 0x4032ac
lea eax, [ebp - 0x48]
push eax
call fcn.004079f0
test eax, eax
pop ecx
pop ecx
je 0x403310
lea eax, [ebp - 0x48]
push 0x41040c
push eax
call fcn.004079f0
test eax, eax
pop ecx
pop ecx
je 0x403310
push dword [ebp - 0x80]
lea eax, [ebp + 0xcc]
push eax
call fcn.00403130
test al, al
pop ecx
pop ecx
jne 0x403310
lea eax, [ebp + 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x403310
call edi
lea ebx, [eax + 0x3e8]
jmp 0x4032fa
call fcn.004015a2
test eax, eax
pop ecx
je 0x40330d
call fcn.004020af
call edi
cmp ebx, eax
lea eax, [ebp + 0xcc]
push eax
ja 0x4032eb
call fcn.004015c3
pop ecx
mov ebx, dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403203
pop edi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
jmp 0x403373
push 0x867
jmp 0x4031a9
push 0x86c
jmp 0x4031a9
push 0
mov ecx, 0x7d0
call fcn.004025d3
push eax
mov ecx, 0x401
call fcn.004025d3
push eax
push dword [0x414d38]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov ecx, dword [ebp + 0x1d4]
xor ecx, ebp
pop ebx
call fcn.00407386
add ebp, 0x1d8
leave
ret
Function at 0x4038f7
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040f6], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404650], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045e4], eax
mov dword [0x4040ee], eax
mov dword [0x4045d0], 0x30
mov dword [0x4045d4], 2
jmp 0x40393c
mov dword [0x4045d8], 0x40321a
mov dword [0x4045dc], 0
mov dword [0x4045e0], 0
mov dword [0x4045f8], 0x40454d
mov dword [0x4045f0], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045e8], eax
mov dword [0x4045fc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045ec], eax
push 0x4045d0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040ee]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.lofegaswer_huijd
push str.lisclass
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404648], eax
push 5
push dword [0x404648]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404648]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404600]
jmp 0x403a10
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a02
mov eax, dword [0x404608]
jmp 0x403a2b
call 0x402c21
ret

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401533
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401dc7
sub eax, fcn.00401592
push eax
push fcn.00401592
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107a
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401461
mov eax, ebx
lea ecx, [ebx + 0x1b600]
call fcn.004014b3
mov esi, ecx
mov eax, ebx
or si, 1
cdq
idiv esi
lea edx, [eax + ecx]
mov eax, ebx
lea ebx, [ebp - 2]
or eax, 0x402054
call fcn.00401592
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401533
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push edx
enter 0x11c, 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x401210
Capabilities:
Encode data using xor

Disassembly:
test dl, cl
mov ebx, ecx
mov edi, eax
movsx edi, dx
imul ebp, ecx, 0x13e61fc0
imul eax, ebx
or ebx, eax
jb 0x401237
lea edx, [0x3d1060e7]
sub eax, 0x4f881994
mov edx, 0xd1c0964a
add edx, eax
movsx edi, dx
sub eax, 0x932b67ae
call 0x40129a
imul edx, edx, 0
test eax, ebp
mov esi, 0xc802477e
test dl, 0xd7
mov ch, 0xd4
dec al
mov edi, 0x69a40cde
mov ebp, 0xc4d
xor ebp, 0xc5b
dec ebx
imul ebp, ebp, 0x5e
dec eax
xadd edx, ebp
xchg cl, ah
imul ebx, ebp, 0xc7ecb459
sub edx, 0x813
mov ch, 0x98
imul ebp, ebx
mov esi, ebp
imul ecx, ecx
mov edi, ebx
cmp edx, 0x5bc
jb 0x40124a
pop edx
add esi, edi
dec ch
xor ebp, 0x878c68e4
mov edi, 0x915f9349
jbe 0x4012b5
mov eax, 0x82799bf4
mov ebp, ecx
push 0xbc4f
lea ecx, [0x8a0846]
pop ebx
xchg ah, ch
cmp ebp, esi
movsx ecx, bl
xor ebx, 0x47df
imul edi, edi
mov ebp, ecx
movzx edi, dx
je 0x4012e1
mov ah, 0x83
sub eax, 0x8b395462
imul ebp, edi, 0x901977a9
mov esi, edi
or eax, 0x2e4aa2e1
cmp esi, 0x9d36
jo 0x4012fc
imul eax, edi, 0xa7085253
mov al, dh
cmp edi, 0xf6346314
mov ebx, edi
xchg ch, al
test ch, cl
and eax, 0xb0c3bb64
push 0x4ecf5
mov ch, 0xe6
mov bl, 0xd8
xchg ch, cl
pop ebp
test bh, 0x9e
movsx ebx, dh
sub ebp, 0x4bc45
lea edi, [0x18d1689c]
add edx, ebp
jb 0x401339
lea eax, [0xa0be2576]
add edx, 0xde6
inc ebp
dec ebx
imul esi, eax, 0x7ecbb7f1
push edx
push ebp
imul edi, ecx
movsx ebp, ax
sbb ebx, ebp
mov ch, dh
cmp al, 0x1a
mov eax, 0x5fff2cc5
imul edi, ebp, 0x680daa2
sub al, 0xd0
push edx
test ebx, 0xcd7f5852
xchg ecx, edi
test ecx, ebp
mov al, 0x4f
jo 0x401381
imul ecx, ecx, 0xab5c7933
mov edi, 0x7d4d1fbf
test ah, 0x38
mov esi, 0xffffc601
adc al, ah
sbb ah, 0xe1
xor esi, 0xb92
movzx eax, di
movzx eax, dh
sbb eax, esi
xadd ebx, esi
add ebx, 0x9070
mov ch, 0x2c
and al, al
ret
Function at 0x42e45a
Capabilities:
Encode data using xor

Disassembly:
retf
mov eax, dword [eax + 0x649b331c]
shl ch, cl
xchg ebp, eax
xor ebx, dword [ebx - 0x6a1a2d9c]
mov edi, dword [ecx]
dec esi
stosd dword es:[edi], eax
xor eax, 0x74be5607
sub al, 0xf8
push ss
test byte [ebp + edx*4 - 0x2e], bl
xchg esp, eax
sub ecx, dword [ebp + 0x59dbe4b6]
mov cl, byte [edi]
out 0x2b, al
loope 0x42e457
loopne 0x42e42f
xchg byte [edi - 0x3a3832a9], bl
sbb edx, dword [edi]
in al, 0x1e
out 0x17, al
and ch, 0x3a
dec edi
push edi
mov ebx, 0xbf931dd0
push esi
test eax, 0x88d1e8cb
invalid

Function at 0x45148a
Capabilities:
Encode data using xor

Disassembly:
adc esp, edi
in al, 0x4e
invalid
adc al, dl
out dx, eax
aad 0x7d
adc byte [0x8d923d01], ch
scasd eax, dword es:[edi]
xor dword [esi - 0xa301df3], ebx
test eax, 0x33c1940a
arpl sp, ax
call 0x62886a51
mov ecx, 0xfe44a6a2
push esp
dec eax
sbb ecx, edx
sbb dword [edx + esi - 0x2c], ebx
push ss
xor ch, byte [ebp - 0x255940d0]
ror dword [0xfd0fcd57], 0x10
mov bh, 0x25
pushfd
adc ch, dh
xlatb
jg 0x4514ac
invalid
fnstsw word [ecx]
mov ebp, 0x4fea20f2
jg 0x451482
sar dword [esi*2 + 0x796bf548], 0xed
invalid

Function at 0x49310a
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0xcab9baf3
sbb byte [edx - 0x3e], cl
xor edi, dword [ebx]
xor dword [edx + eax - 0x7d], esp
call esp
or dword [esi + 0x75], eax
xor al, 0xbb
dec edx
inc ebx
invalid

Function at 0x4c069a
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x20ca0991
or eax, 0x41c3c6fe
scasb al, byte es:[edi]
adc esi, dword [0xd03d32e]
cmp eax, 0xf17266b3
outsd dx, dword [esi]
cmp byte [ecx - 0x14], 0x97
push 0x79
invalid
Function at 0x4c080a
Capabilities:
Encode data using xor

Disassembly:
jbe 0x4c07e1
sti
xor dword [edx], 0
pop esi
cld
jns 0x4c07ed
pop ds
sbb dh, byte [edx + esi*4 - 0x48f39719]
call [esi + 0x2e5b036f]
xchg edi, eax
sbb eax, 0xf9d9dd62
rcr byte [ebp + 0x66], 1
sar esp, 1
cld
sahf
invalid
xchg ebx, eax
cmc
jns 0x4c0787
arpl word [esi + 0x35327997], sp
jb 0x4c083d
cmpsb byte [esi], byte es:[edi]
xchg edi, eax
jns 0x4c0808
xor eax, 0x7c136472
enter 0xffffffffffff9415, 0x32
jne 0x4c0765
adc edi, dword [eax + ecx*8 + 0x15]
xchg esp, eax
xor dh, byte [ebp - 0x7c]
add dl, byte [esi + 0x6b]
or ecx, dword [esi + 0x1e883ff1]
lcall 0xb3de, 0x530f2d6f
sub eax, 0xb3de530f
mov bl, 0xa
cmp al, 0x72
pop ebx
mov esi, dword [eax - 0x41d1f13e]
lahf
cmp byte [eax + 0x40], dh
xor al, 0x56
in eax, dx
imul dword [eax + 0x43be7114]
mov esi, 0x8be9b043
fiadd word [edi - 0x62b92124]
mov al, 0xe9
mov ebx, esi
xchg esp, ebx
fiadd word [esi - 0x63]
out dx, al
push edx
cmpsb byte [esi], byte es:[edi]
jl 0x4c07cd
mov ebx, dword [edi + 0x272da17]
outsd dx, dword [esi]
loop 0x4c0845
int 0x1a
aaa
sahf
jno 0x4c07d2
add al, 0x8c
push edi
retf
jb 0x4c0845
aas
mov ebp, 0x2f047d74
add al, 0xfc
and byte [esi - 0x58d83fb8], bl
jae 0x4c083f
jb 0x4c08ae
fcom dword [esi - 9]
xor ebx, edi
or dword [eax + 0x5f], edi
or eax, 0xca1f0f1e
nop edx
retf 0x3234
xor al, 0x32
outsb dx, byte [esi]
push ebx
jnp 0x4c085b
mov edi, 0x3504529
push 0xffffffffffffff8c
push edx
mov ebp, 0x2277d5b1
imul ebp, dword [edx - 0x4e], 0x4e
mov edx, 0x408c83f0
and dword [ebx - 0x1e79a795], 0x6e
imul ebx, dword [eax - 0x7a], 0xffffffe1
outsb dx, byte [esi]
test al, 0x4d
pop ds
and byte [edx - 0x6b], ah
cmp eax, 0xe6fb683
and ebx, dword [edx + 0x13]
popfd
loop 0x4c087c
int1
mov dh, 0xad
inc edx
pop edx
pop ds
xchg ebx, eax
mov edi, 0xfbe329da
stosd dword es:[edi], eax
pop es
inc edx
lodsb al, byte [esi]
adc byte [eax - 0x62], cl
jae 0x4c08db
invalid
mov ecx, 0x3ba615ac
imul esp, esi, 0xffffffaa
jnp 0x4c085d
not dword [edx + 0x63d8db5f]
dec esi
ja 0x4c0880
ret
rcl byte [ecx + 0x73]
jle 0x4c094e
ror ebp, cl
pop ebp
push cs
in al, 0xde
xor ebp, dword [ebx + ecx]
adc dword [edi - 0x18], eax
xchg esp, eax
sub byte ds:[edi + 0x7d], cl
cli
xor dword [eax], 0xa9e232df
sub al, 0x37
out dx, al
movsd dword es:[edi], dword [esi]
ret
frstor dword [edx + 5]
sbb al, 0x24
jg 0x4c0957
dec ebp
out dx, eax
paddq mm5, qword [ebx]
push 0x3ef85f86
sub byte [ebp - 0x3798a6e2], 0x34
mov ebx, 0xe838ca9f
and byte [edx - 0x7e], 0xfa
jmp [edx + 0xa]
Function at 0x4e401a
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x25
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
mov al, 0x57
xor byte [edi + 0x39], dl
xlatb
add dword [edi + ecx*8 + 0x7043001f], edx
push 0x9c3c0410
and dword [ecx + ebx*4 - 0x2b], 0xc7f134ca
xor al, 0xf1
mov ecx, 0x9f8bc874
sal dword [eax + ecx*8 - 0x75], 0x9f
in eax, 0xa8
inc eax
cmp ah, dl
push ebx
ja 0x4e3fb6
cli
loope 0x4e3f9b
loop 0x4e3fd2
inc eax
invalid
nop
mov bh, 0xa9
int 0x65
mov eax, 0x29879416
cwde
mov dword [ecx], edi
add al, 0x59
xor eax, 0x4b4a842
xchg byte [edi - 0x2ea1a240], dl
xor eax, 0xbf5ce382
out 0x6f, al
add al, 0xb7
push ds
add byte [ebx - 0x17], al
push 0xcfc3a19d
lodsb al, byte [esi]
xchg byte [0x569cc750], dl
outsd dx, dword [esi]
xchg ebp, eax
and al, 0xd
push cx
mov bl, 0x24
invalid
in al, dx
lds ebx, [eax]
mov eax, dword [0x50c3fa4c]
inc ecx
adc dh, byte [eax + esi + 0x16ffe028]
js 0x4e3fb9
not byte [esi]
xor eax, 0xe1873084
xor al, 0x80
xor al, ch
jl 0x4e4090
test byte [ecx - 0x1fded66b], bl
pop edx
add eax, 0xb037c738
in al, 5
rol dh, 1
inc edi
les eax, [esi + 0x35]
xor byte [esi + 0x69], al
push esp

Function at 0x5214ec
Capabilities:
Encode data using xor

Disassembly:
invalid
je 0x5214f2
and al, 0x69
sahf
sal byte ss:[edx], 1
sal byte [edx], 1
mov edx, 0x78c064f5
imul esp, dword [edx], 0xc4dac3da
cmc
or esi, dword gs:[esi - 0xc]
xchg dword [esi - 0x26], ecx
push cs
jnp 0x521492
adc dword [edx + edx*8], ecx
and ebx, dword [edx]
dec esi
adc dl, al
test eax, 0xdb97821c
mov byte [0x6eb2c1b], al
xor byte [eax + esi*8 + 0x59abfa3e], al
jae 0x521518
pushfd
pushfd
insb byte es:[edi], dx
sahf
add byte [ecx + ecx], bh
and al, 0xe0
mov edx, 0xccd8dfc1
xchg esp, eax
inc edx
test eax, 0x908fd523
jno 0x521525
aas
mov esi, 0x465ae05a
xor eax, 0x5b437497
and byte [esi], dl
mov edx, 0x60d6efc1
ljmp 0x74de

Function at 0x5339b7
Capabilities:
Encode data using xor

Disassembly:
push ecx
cmp bl, al
sahf
in eax, dx
outsd dx, dword [esi]
fisubr word [esi]
xor byte [edx - 0x35], bl
push ebx
sub eax, 0x3974e8fb
add esi, edi
wait
cmp bh, byte [ebp + 0x4f]
out dx, eax
shr byte [ebx - 0x39507af2], 1
sahf
pop esp
scasd eax, dword es:[edi]
nop
das
out 0x3f, al
inc esp
lea edi, [edx + edi*2]
fst qword [esi + 0x4e]
adc bh, dh
xor al, ch
add edi, dword [esp + edi*4 - 0x6e]
xchg ebx, eax
pushfd
jge 0x5339c7
or al, byte [edi]
pushal
xchg ebp, eax
push ds
pushal
into
stosb byte es:[edi], al
lahf
js 0x533a2c
or edi, ecx
push ds
shl dword [edi], 0x4e
out 0x2f, al
invalid
push ebp
jb 0x5339b6
adc edx, ebp
mov ebp, 0x9897cf1f
sbb ebp, dword [ebp + ecx + 0x749643b0]
invalid
mov cl, byte [ebp + 0x4b629514]
sal dh, 1
lahf
jle 0x533a05
dec esi
dec byte [edx]
out dx, eax
or ebx, dword [ecx - 0x4df62095]
fmul dword [ebx + 0x62]
loop 0x533a95
adc dh, byte [ebx + ecx + 0x5b0ea06d]
cmpsd dword [esi], dword es:[edi]
sti
das
xor byte [esi + 0x57], bl
mov esp, 0x9e3b6322
or al, byte [eax - 0x149aa91c]
dec ecx
xor bh, byte [edx + 0x6ea9cb2e]
invalid
mov dword [0xeee0fed5], eax
fisttp dword [esi]
pushal
pop ss
test eax, 0xef39ce3d
and al, 7
xchg byte [eax], ch
popal
out dx, eax
pushal
int 0x95
pop eax
salc
mov dh, 0x1e
lodsb al, byte [esi]
invalid
Function at 0x57cd16
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
sub dword [ebx - 0x46], edx
mov dl, 0x92
mov eax, dword [0x744353a9]
rcr dword [esi + eax*4 + 0x6c], 0xf8
clc
bound eax, qword [ebp - 0x356fc500]
dec eax
and cl, byte [eax]
and esi, esp
pushal
fcom dword [edi]
sbb ch, byte [esp + ebx*2]
xor eax, 0x95da9393
bound eax, qword [eax + 0x407474bd]
and cl, 0x72
jp 0x57cd25
invalid
add dword [esi], edx

Function at 0x5b863a
Capabilities:
Encode data using xor

Disassembly:
inc ecx
outsb dx, byte [esi]
pop ds
and dword [ecx + 0x2fadcf0e], 0x134121b3
pcmpgtw mm6, qword ds:[ecx]
scasb al, byte es:[edi]
xor ch, cl
adc byte [esi - 0x2a588ee4], dh
nop
aas
fimul word [ecx - 0x2a1160fa]
movsb byte es:[edi], byte [esi]
mov al, 0x36
psadbw mm7, qword [edi + 0x50]
mov cl, 0x42
lahf
push ebx
xor ebx, dword [edx]
stosd dword es:[edi], eax
sub eax, 0x9dc16065
aas
dec edx
ja 0x5b855b
dec edi
push edi
adc al, byte [ebx]
test eax, 0x36a79e77
mov edi, dword [eax - 0x3d]
retf 0x6667
movsd dword es:[edi], dword [esi]
pop ss
or ch, bh
cmp al, 0x70
add edi, esi
xor esp, dword [esi - 0x37]
xchg ecx, eax
lahf
xchg ebp, eax
loopne 0x5b858c
xor eax, 0x1fa13ff5
and byte [ecx], 0xc5
and ebp, eax
pop edi
inc esi
invalid
mov eax, dword [0x5df1b9ff]
xchg edx, eax
jne 0x5b85df
jo 0x5b85c8
daa
cli
pop esp
pop esp
arpl word [edx + 0xdc4ba49], si
push ecx
adc al, 0xb2
popal
mov dword [0xd4fcc596], eax
invalid

Function at 0x5c16aa
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
push 0xffffffffffffffa0
xlatb
inc esp
sbb dword [ebx + 0x1c], ebp
inc edi
cld
dec edi
invalid
Function at 0x6033da
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0xb9
or byte [ebx + 4], 5
or dword [ecx + 0x70], 0xffffff98
lodsd eax, dword [esi]
invalid
push ebx
mov ah, 0x39
sti
xor dword [edi], 0xffffffbb
aaa
xor bh, dl
pushfd
cmp eax, 0x6033e6e8
ja 0x603351
pop esi
call 0x3c980fea
mov ebp, 0x9d8831a8
invalid
xchg esp, eax
push edx
invalid
jbe 0x6033a4
sub byte [esi], dh
mov byte [edx - 0x52], al
inc edx
scasb al, byte es:[edi]
xlatb
js 0x6033ab
or dl, byte [edx + 0x738a02ec]
jle 0x6033ce
test al, 0x68
pop ds
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
push cs
sbb byte [edx + 0x297c8764], ah
or esi, ecx
push ss
adc ch, byte [ebx]
cmp eax, 0xe2ceb643
in eax, 0x9a
or al, 0x9e
jl 0x603449
pushfd
insb byte es:[edi], dx
mov dh, 0x63
push 0x2baff5ee
mov bl, 0x18
lds edi, [ebp + 0x37]
das
rcr byte [eax - 0x22d3778e], 0x59
lodsd eax, dword [esi]
push ss
and byte [ebx - 0x111b17dc], ch
add ecx, dword [ebx - 0x389159e6]
xor eax, 0x6a5322c8
dec ebx
xchg byte [edi - 0x68], dh
adc al, 0xf0
loop 0x603456
wait
int3
mov ebp, 0x92a15cfd
rcl byte [edx - 0x3c], cl
mov eax, dword [0x92ae4959]
scasb al, byte es:[edi]
xchg edx, eax
stc
xchg ebx, eax
jne 0x60346a
js 0x6033df
mov dh, 0xb3
inc eax
xor eax, 0xb47eb14
or byte [esi], dh
insd dword es:[edi], dx
cmp esi, dword [edi]
aaa
insd dword es:[edi], dx
inc esp
jns 0x6034ef
mov ebx, 0x605dd7d4
loop 0x603454
xor dl, 0xff
sbb ah, ch
mov eax, 0x3bd2c81d
add cl, byte [ebx]
or bl, dh
cld
int3
push esi
adc al, 0xf5
adc byte [ebp - 0x3c77fc4a], ah
mov dh, 3
mov bl, al
stosb byte es:[edi], al
test eax, 0xd18e73f8
call 0xb8718e5e
pop edx
adc dh, dl
lodsd eax, dword [esi]
mov eax, dword [0x13129055]
xor byte [edx], 0x79
xor eax, 0x2d70ca5e
cmp dword [edi - 0x21], ebp
dec esi
pop es
fisttp word [esi + 7]
sbb eax, 0x1d2207ce
mov ebp, 0x1f0daf54
xor edi, dword [eax]
stosd dword es:[edi], eax
daa
push edx
popal
jae 0x6034ba
lodsd eax, dword [esi]
jb 0x6034c0
xchg dword [edx], edx
dec eax
movsb byte es:[edi], byte [esi]
enter 0xffffffffffffccd6, 0xffffffffffffffb3
fdiv dword [edi + eax*2]
adc ebp, dword [esp + esi*4 + 0x12f672c6]
push dx
pop edx
shr byte [edx + 0x43], 1
dec cx
jns 0x6034e2
or ah, bl
loop 0x603517
fsubr st(2), st(0)
std
push ss
add ebp, edi
mov bh, 0x6e
mov eax, dword [0xb582211e]
add dword [edx], 0x39
cmp ebx, dword [eax + 0x27b0ac1]
mov ebx, 0x5529fc43
arpl si, ax
shr dword [eax - 0x1e], cl
push ss
test byte [esp], dl
das
adc edx, ebp
cmp dh, byte [edx - 0x1c]
or byte [eax], ch
sub bl, byte [esi + 0x1ce05e42]
push 0xffffffffffffff98
xor eax, edx
sub al, 0x7f
mov dl, 0xec
push edi
imul esi, edi, 0x58328190
in al, 0x5c
sub dword [esi + 0x47], esi
invalid

Function at 0x60b21a
Capabilities:
Encode data using xor

Disassembly:
inc ecx
rol dword [eax - 0x2f1dff90], cl
mov bl, 0x27
movsb byte es:[edi], byte [esi]
mov dl, 0x99
inc edi
pop ss
xchg esp, eax
jnp 0x60b1c0
pop es
add byte [ebx - 0x62], 3
sbb cl, byte [ecx + 0x64]
adc dword [edx + 0x2e], ecx
and byte [esi + ecx*2 + 0xa9153a5], 0xf0