joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ffe53e8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
add al, 4
sub al, 4
push eax
pop eax
pushf
popf
inc esi
dec esi
xor eax, ecx
xor eax, ecx
add al, 0
pushf
popf
add al, 0
pushf
popf
push eax
pop eax
not eax
not eax
inc esi
dec esi
not eax
not eax
add al, 0
add al, 4
sub al, 4
inc esi
dec esi
push bx
inc esp
inc esp
push eax
pop eax
pushf
popf
add al, 0
xor eax, ecx
xor eax, ecx
push es
pop ds
not eax
not eax
inc esi
dec esi
and al, 0xff
clc
call 0x7ffe543e
pop edx
inc esi
dec esi
xor dx, dx
push es
pop ds
and bh, 0xff
add edx, 0xd5e0
inc esi
dec esi
inc esi
dec esi
xor ecx, ecx
push es
pop ds
push bx
inc esp
inc esp
stc
mov cl, 0x1e
push bx
inc esp
inc esp
and al, 0xff
xor byte [ecx + edx], 0x9f
loop 0x7ffe5464
stc
push dword fs:[0x24]
pop dword [edx + 0xa]
and al, 0xff
clc
mov cl, 0xff
push es
pop ds
push edx
loop 0x7ffe547c
add al, 4
sub al, 4
cld
mov dword [edx + 0x11], 0xffffacbb
pushf
popf
mov ecx, dword [eax + 0x2c]
push eax
pop eax
not eax
not eax
stc
mov dword [edx + 0x1b], ecx
xor eax, ecx
xor eax, ecx
push eax
pop eax
mov dword [edx + 0x100], ecx
stc
mov dword [eax + 0x2c], esp
push 0
inc esi
dec esi
cld
push 0
inc esi
dec esi
push 0
xor eax, ecx
xor eax, ecx
clc
push 0
not eax
not eax
push 0x30
push es
pop ds
not eax
not eax
cld
push 0x20
push bx
inc esp
inc esp
push eax
pop eax
push 0
stc
push 0
add edx, 0xffff7f33
cld
and al, 0xff
push edx
and al, 0xff
push edx
xor eax, ecx
xor eax, ecx
stc
push 0
xor eax, ecx
xor eax, ecx
call dword [edx + 0x8210]
and al, 0xff
add al, 4
sub al, 4
cld
add esp, 0x3f8
push bx
inc esp
inc esp
push eax
pop eax
xor eax, eax
nop
inc eax
ret 0xc

Function at 0x7ffe8354
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
add al, 0
push bx
inc esp
inc esp
cld
pop eax
pushf
popf
and al, 0xff
add eax, 0x15
cld
mov byte [eax], 5
call 0x7ffe8354
push edx
cdq
pop edx
add eax, 5
and al, 0xff
mov ecx, eax
push eax
pop eax
and al, 0xff
cld
call 0x7ffe8315
add al, 4
sub al, 4
pop eax
add al, 0
not eax
not eax
clc
add eax, 0x19
push bx
inc esp
inc esp
push es
pop ds
mov byte [eax], 5
nop
call int.7ffe84d6
add eax, 5
push eax
pop eax
clc
xchg ecx, eax
add al, 0
sub ecx, eax
pushf
popf
cld
xor byte [eax + ecx], 0x2e
push bx
inc esp
inc esp
loop 0x7ffe8343
and al, 0xff
not eax
not eax
cld
pop ecx
invalid
Function at 0x53a800
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4df00d
lea edi, [esi - 0xde00d]
push edi
or ebp, 0xffffffff
jmp 0x53a822
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53a829
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a818
mov eax, 1
add ebx, ebx
jne 0x53a83b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53a84c
jne 0x53a86b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a86b
dec eax
add ebx, ebx
jne 0x53a858
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53a830
add ebx, ebx
jne 0x53a867
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x53a8bd
xor ecx, ecx
sub eax, 3
jb 0x53a883
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53a8f2
sar eax, 1
mov ebp, eax
jmp 0x53a88e
add ebx, ebx
jne 0x53a88e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a85c
inc ecx
add ebx, ebx
jne 0x53a89c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a85c
add ebx, ebx
jne 0x53a8a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53a89e
jne 0x53a8ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53a89e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53a8dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53a8ce
jmp 0x53a81e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53a8dc
add edi, ecx
jmp 0x53a81e
pop esi
mov edi, esi
mov ecx, 0x3e07
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53a8fa
cmp byte [edi], 0x22
jne 0x53a8fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x53a8ff
lea edi, [esi + 0x134000]
mov eax, dword [edi]
or eax, eax
je 0x53a96e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17c690]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17c738]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53a92c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17c740]
or eax, eax
je 0x53a968
mov dword [ebx], eax
add ebx, 4
jmp 0x53a949
call dword [esi + 0x17c73c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x53a99f
cmp al, 0xef
ja 0x53a992
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x53a974
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x53a981
mov ebp, dword [esi + 0x17c744]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x13a9fa]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x53a9eb
sub esp, 0xffffff80
jmp 0x45bfe0
Function at 0x1b00a769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1b00e190
cmp edx, dword [eax]
je 0x1b00a78b
add eax, 8
inc ecx
cmp eax, 0x1b00e220
jl 0x1b00a77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1b00e190]
jne 0x1b00a8b9
mov eax, dword [0x1b00ebb0]
cmp eax, 1
je 0x1b00a893
test eax, eax
jne 0x1b00a7bc
cmp dword [0x1b00e0e4], 1
je 0x1b00a893
cmp edx, 0xfc
je 0x1b00a8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1b00a7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1b00b670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1b00b490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1b00a836
lea eax, [ebp - 0x1a4]
push eax
call fcn.1b00b490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1b00d45c
push edi
call fcn.1b00bf00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1b00b670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1b00b680
lea eax, [ebp - 0xa0]
push 0x1b00d43c
push eax
call fcn.1b00b680
push dword [esi + 0x1b00e194]
lea eax, [ebp - 0xa0]
push eax
call fcn.1b00b680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1b00be75
add esp, 0x2c
pop edi
jmp 0x1b00a8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x1b00e194]
push 0
push eax
push dword [esi]
call fcn.1b00b490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x40b9b0
Capabilities:
Encode data using xor

Disassembly:
or byte [esi + 0x4e418561], ch
mov byte [ebx + 0x2ebe826], dh
add edx, 0x12
retf
jnp 0x40b908
push ds
push esp
dec ecx
ror edi, 0xfc
mov ebp, 0xef44fb94
mov bl, 0xbf
fstp qword [0x91341172]
invalid
loopne 0x40b97f
and al, 0xce
repne stosb byte es:[edi], al
sbb dword [eax + 0x62], 0xffffffa1
enter 0x40fd, 0x65
arpl word [edx - 0x1cfed39f], dx
popal
sub al, 1
jecxz 0x40b9a3
jp 0x40b9c7
pop ebx
jo 0x40ba04
push 0xd536888f
mov byte [0x49edb05d], al
mov dword [0xb946c788], ebx
jbe 0x40b9f4
mov esi, 0x987108d
mov dl, 0xb3
lds ebp, [eax + 0x3d5c044d]
and ecx, esi
mov eax, dword [edx]
int3
and dword [ebx + 0x3e], ebp
jge 0x40ba0e
jge 0x40ba0e
test eax, 0x5716366b
inc ecx
dec dword [esi - 0x36]
adc byte [ebx - 0x47], 0xc2
ror byte [ebx - 0x152abeae], 1
cli
lcall 0x7492, 0x47d16653
pop es
rol dword [edi - 0x6e], 1
je 0x40ba1a
mov al, bh
push esp
lahf
dec eax
add al, 0xb1
xor eax, esi
dec esp
sbb byte [edi + 0x23b0659e], cl
jns 0x40b9f2
mov cl, 0x33
invalid
or byte [ebx + eax], ah
shr bh, 1
mov cl, 0x9e
aas
nop
rcr byte [ebx - 0x207438d0], 1
xchg ebp, eax
and dword [ebp - 0x6f517f53], esp
pop es
test al, 0x53
xor al, 0xc0
jle 0x40ba2e
push ds
add dl, byte [ecx]
fdivr st(4)
cmc
call dword [esi]
nop
xchg al, bh
cmp eax, 0xf0165b23
fisubr dword [ecx - 0x59bfed4f]
push eax
int3

Function at 0x438ed5
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x96
call 0x332af670
je 0x438e9d
rcl dword [eax]
cwde
sub dword [ebp + 0x2a4e1d90], ebp
movsd dword es:[edi], dword [esi]
insd dword es:[edi], dx
stosb byte es:[edi], al
popal
test al, 0x52
jmp 0x438eb3
sub byte [ebp + 8], cl
xor ebp, edi
int3
fldcw word [edi - 0x2f9d97ff]
mov cl, 0x81
mov al, byte [0xed458b8c]
cmp byte [edi - 0x40], ch
or eax, 0xaa1042cc
or eax, 0xacd33210
int3
or eax, 0xacd33210
popal
cmpsb byte [esi], byte es:[edi]
rol byte [esi + 0x41], 0x56
loope 0x438ef1
fstp qword [edi]
aam 0x7c
xchg dword [eax + 0x29de52d1], edx
and al, 0xd
salc
jge 0x438eae
fbstp tbyte [ecx]
sbb byte [edx], ah
inc ebx
add byte [ecx + edx], bl
sbb al, 0x11
fsub qword [eax - 0x33]
je 0x438e95
inc eax
dec edx
push ecx
cdq
inc byte [ecx - 0x4c]
lodsd eax, dword [esi]
push ebx
pop edi
mov edi, 0xc06ea529
invalid
Function at 0x44c8c0
Capabilities:
Encode data using xor

Disassembly:
lcall 0x61d1, 0x34100119
add dword [eax], edx
xor al, 0xd1
popal
fldenv [ebx + 0x5d8c6715]
cmp al, 0x8c
das
lahf
cmp eax, 0xe09858c9
push ss
aad 0xfb
mov ecx, 0xf88b187d
push ss
sbb al, dh
and eax, 0x39f21e9b
cmpsd dword [esi], dword es:[edi]
shl dword [ebx], 1
dec ecx
inc esp
xor eax, 0xe611507d
jbe 0x44c8c2
sal dword [ecx - 0x17], 1
sbb bh, bh
push ss
mov ebx, ecx
fnstenv [edx]
mov byte [0xf30153ce], al
xor dl, byte [ebx + 0x4dde5908]
dec eax
sbb bh, byte [edi - 0x27]
outsd dx, dword [esi]
xor eax, 0x645d5b1f
push ss
leave
test dword [edx - 0x5f063031], 0x8eee9ceb
pop ebx
out dx, eax
pop ebp
or al, byte [edi + 0x5055641]
mov edi, 0xe0840bc9
dec ebx
in eax, 0x56
sub dword [ebx + ebx - 0x19], ecx
test eax, 0xf4d9f41f
mov dword [ecx], ebx
movsb byte es:[edi], byte [esi]
pop edi
and ah, byte [edx - 0x35]
invalid

Function at 0x47ba2e
Capabilities:
Encode data using xor

Disassembly:
dec edi
jne 0x47ba78
or ch, byte [eax + 0x1f591fef]
insd dword es:[edi], dx
idiv byte [ecx - 0x3325ae14]
pop ebx
pop edi
pop ecx
pop eax
pop ecx
and al, 0x7b
and al, 0x1d
insb byte es:[edi], dx
sub byte [esp + esi - 5], dl
push esp
xor al, 0xfb
dec eax
jbe 0x47ba4a
bound esp, qword [eax + ebp*4 + 0x7e]
dec ecx
sti
out 0x39, al
cmp ebx, dword [ebx]
popfd
xchg esi, eax
and eax, dword [esi]
retf 0x3cd6
retf 0xe386
Function at 0x48e8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx + 0x18]
sub esp, 0x2c
push esi
push edi
mov edi, dword [ebx + 0x14]
cmp eax, edi
jne 0x48e8bc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
sub edi, eax
mov dword [ebp - 8], edi
cmp edi, ecx
jbe 0x48e8ca
mov dword [ebp - 8], ecx
mov edi, ecx
xor esi, esi
mov dword [ebp - 0xc], esi
cmp dword [ebx], esi
jle 0x48e9a2
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
mov eax, dword [eax + esi*4]
mov edx, 0x8000
mov dword [ebp - 0x10], eax
test word [ecx + esi*2], dx
je 0x48e946
cmp dword [ebx + 0x18], 0
je 0x48e8f9
cmp dword [ebx], 1
jle 0x48e90c
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
movzx ecx, word [ecx + esi*2]
mov edx, dword [edx + esi*4]
mov dword [eax + 0x10], edx
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
push ecx
push eax
mov eax, edi
call fcn.0048d800
mov edx, dword [ebx + 8]
add dword [edx + esi*4], eax
mov eax, dword [ebx + 0xc]
lea ecx, [edx + esi*4]
mov cx, word [eax + esi*2]
lea eax, [eax + esi*2]
add cx, di
movzx edx, cx
and edx, 0x80007fff
jns 0x48e941
dec edx
or edx, 0xffff8000
inc edx
mov word [eax], dx
jmp 0x48e996
cmp dword [ebx + 0x18], 0
jne 0x48e95c
mov ecx, dword [ebx + 8]
mov edx, dword [ecx + esi*4]
mov dword [eax + 0x10], edx
mov dword [eax + 8], 0
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp + 8]
xor edx, edx
xor esi, esi
or edx, edi
or ecx, esi
lea esi, [eax + 0x14]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ecx
call fcn.0048e450
push eax
push esi
lea esi, [ebp - 0x18]
call fcn.0048e100
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
add dword [eax + 0x10], edx
mov esi, dword [ebp - 0xc]
mov edi, edx
inc esi
mov dword [ebp - 0xc], esi
cmp esi, dword [ebx]
jl 0xd430e8d7
neg ebp
test edi, esi
salc
pop eax
in al, 0xc2
cmc
mov cl, byte [eax - 0x25]
cli
insb byte es:[edi], dx
inc esp
push ecx
dec edi
ja 0x48e9c2
or esp, dword [ebp + 0x1a]
pop ss
sbb dl, byte gs:[edi]
xor al, 7
xchg byte [ecx], bl
sbb esp, dword [edi - 0x4b08df0f]
mov dword [ebp + 0x24de63d], 0x29d1a949
div dword [edi + eax*8 + 0x4de63d85]
add cl, byte [ecx - 0x57]
shr dword [ecx], 1
sti
cmpsd dword [esi], dword es:[edi]
push edi
jne 0x48e9b6
out dx, eax
invalid

Function at 0x4a3c94
Capabilities:
Encode data using xor

Disassembly:
push ebx
outsd dx, dword [esi]
aaa
mov si, 0xdd16
xchg esp, eax
push ds
pop es
outsd dx, dword [esi]
daa
xor eax, 0x44b696c5
xchg dword [edi], edi
pushfd
test edi, 0xe1e35e05
out 0x5d, al
imul ebp, dword [ebx + eax + 0x64235337], 0xce31175b
into
cmp dword [ecx], edi
or byte [ebx], ah
push 0xffffffffffffff9d
loope 0x4a3cbc
invalid
Function at 0x4bd990
Capabilities:
Encode data using xor

Disassembly:
jbe 0x4bd9f6
push ebx
arpl word [esi], bx
sti
xor edx, dword [esi]
push ss
push ebp
and edx, dword es:[ebx + 0x33]
mov eax, dword [0xc54372bb]
salc
test esi, eax
mov bl, 0xdb
xchg ebp, eax
and esp, dword [esi + 0x45afb6f5]
xchg ebp, eax
push ebp
push ebx
or eax, 0x813b1263
arpl word [0xda23262b], si
lea ebp, [edi + ebx - 0x1c197a39]
ret
sbb eax, 0xf5c76bdf
push edx
inc ebp
push ss
push edi
xor esp, dword [ebp - 0x197c8d05]
jecxz 0x4bd9fd
scasb al, byte es:[edi]
push edx
outsd dx, dword [esi]
lds eax, [ebx - 0x1d54886a]
ja 0x4bd9bb
loop 0x4bda85
invalid
adc ax, 0x4356
and dword [ebx], esi
pop edi
mov ebx, 0x3635a382
jecxz 0x4bda4c
push ebp
mov byte [0xc3b5e6c5], al
cmpsb byte [esi], byte es:[edi]
invalid
invalid
adc al, 0x6b
mov ch, 0x48
cmpsb byte [esi], byte es:[edi]
dec ebx
mov esi, 0xf6d61974
retf 0x26f4
pop esp
jle 0x4bdae9
push ss
outsb dx, byte [esi]
jp 0x4bda93
wait
or ch, byte [ebx - 0x57]
clc
adc ebp, dword [esi + 0x9f068b0]
enter 0x1710, 0xffffffffffffffe2
or byte [edi], ah
not ecx
mov al, byte [0xb9f441f5]
xchg esp, eax
or dl, byte [edi]
push ebp
cmpsd dword [esi], dword es:[edi]
sbb dword [esi], esi
sbb bl, dl
push ebx
adc eax, dword [edi + 0x37]
sbb edx, 0xfffffff8
adc al, 0x3e
xor ecx, dword [edx]
mov dh, 0xaf
call 0xca0ee99f
mov al, 0xf6
push cs
jecxz 0x4bda70
movsb byte es:[edi], byte [esi]
mov bh, 0xeb
hlt
xchg byte [edi - 0x11e87728], al
arpl word [esi + 0xbc70e1e], di
inc ecx
sbb ah, byte [edi]
and dword [esi + 0x43], eax
mov dword [ebx - 0x1e98f88a], 0xae57f7bb
not dword [edi - 0xc381805]
int 0x5f
mov bh, 0xf3
push ss
cmpsd dword [esi], dword es:[edi]
push eax
scasd eax, dword es:[edi]
inc ecx
inc edi
mov ecx, 0x44272704
dec ebx
lcall 0xc94e, 0x77797807
wait
xor dl, byte [edi]
mov dl, al
aaa
movsd dword es:[edi], dword [esi]
mov dl, 0xd9
test eax, 0xdaffe0d1
xchg edx, eax
sub dh, byte [ebx + 0x58]
pop ebx
jne 0x4bdb95
mul dword [edi]
daa
sbb al, 0x22
lodsd eax, dword [esi]
int 0xd7
rcr al, cl
loop 0x4bdb90
loop 0x4bdb48
lahf
or ch, cl
xlatb
add dl, dh
xor esi, edi
nop
dec ebx
mov ebp, 0x50e39373
popfd
push ebp
xor byte [ebx + 5], 0xc4
dec ecx
sbb bl, byte [edi]
xchg cl, cl
aaa
xlatb
adc ebp, dword [eax]
inc ecx
cdq
adc byte [ebx + 0x4f], cl
adc ecx, dword [edx]
cmp ch, byte [ebx - 0x797fa2e3]
test al, 0x5b
push ebx
push cs
xchg edi, eax
dec ecx
cmp ebx, dword gs:[edx + 0x53]
mov dword [ebx + 0x28ab25d8], 0x16cecb08
fidivr word [0x86d64597]
div dword [esi]
aam 0x95
jmp 0x3421de24
xchg ebp, eax
loope 0x4bdb38
rol byte [ebx + 0x47], cl
inc edi
adc al, 0x1b
daa
daa
pop esi
xor ch, byte [ebx]
dec ebx
sub esi, esi
test eax, 0xf5ebc7f6
jbe 0x4bdbc0
wait
mov byte [0xc28b46b0], 0x4d
mov ch, 0x6b
mov bh, 0x77
dec edx
xchg ebx, eax
or ebp, dword [ebp - 0x8bc35cd]
invalid
xchg dword [edx], ecx
and eax, 0xd3c64c02
mov ebx, 0x53f384a7
ret 0xec5
Function at 0x504754
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x7f194d31
or byte [edi - 0x22], 0x39
dec edi
fidivr word [ecx]
retf 0x2096
lodsb al, byte [esi]
pop ebp
inc esi
lcall 0xc7a9, 0xa8d1c9e2
mov esp, 0x7d316916
ficomp word [ecx]
push 0x75
js 0x504792
aas
or eax, 0xfc11e92b
fstp dword [ecx]
ret 0x89f2
pop edx
clc
pop edi
sti
dec edi
xchg edx, eax
in al, dx
jle 0x5046ea
xor eax, 0xa841adfb
jne 0x5046f0
or al, 0x7b
js 0x504773
mov byte [0xc21e1ba], al
push 0x3b
push es
fcomp qword [edi - 0x67e053b2]
dec esi
lodsb al, byte [esi]
pop ds
cwde
clc
daa
test eax, 0xb74ccbca
jns 0x504716
xchg dword [ebx - 1], ebx
inc esp
jmp 0x5047ec
dec edi
push cs
mov ecx, 0xdd5bbe86
test al, 0xe9
mov cl, 0xef
invalid
adc dword [edi], ecx
outsd dx, dword [esi]
dec edi
wait
push ebx
sahf
jne 0x504802
invalid
pop esp
pop esp
loope 0x50486a
aaa
invalid
sbb ah, ah
mov byte [ebp - 0x55a5d5e1], bh
xchg edi, eax
movsd dword es:[edi], dword [esi]
aad 0x16
mov esi, 0xa2f61ce0
sub bh, bl
fisttp qword [edi - 0x3a]
stc
xchg dword [ecx + 0x23], esi
pop eax
xor byte ss:[ecx + 0x7c03eb38], cl
dec eax
xor byte [edx], cl
push edi
scasb al, byte es:[edi]
jmp 0x50488f
or dl, byte [edi - 0x52]
jg 0x50488a
mov word [ecx], ss
cld
pushal
sbb eax, 0xcc02a468
sbb ebx, dword [ebx - 0x30a4f028]
invalid

Function at 0x5169d0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec edx
outsd dx, dword [esi]
mov esi, 0x86f9dfcf
pop ecx
mov esi, 0x91f28e0f
mov dh, 0x31
nop
mul dword [edi]
push edi
movsd dword es:[edi], dword [esi]
invalid
or ebx, dword [ecx + 0x38576f66]
daa
jg 0x51699c
jnp 0x516a41
test byte [ecx + 0xc], dh
add dword [ebx - 0x30], edx
invalid
xchg edx, eax
xchg ecx, eax
iretd
cmp byte [edi + 0x2c], bl
jmp 0xbf9d8964
and byte [eax], dl
in al, 0xb2
and cl, ah
inc dword [ebx - 0x47fcb227]
js 0x516a32
push esi
add byte [ebx], ch
insd dword es:[edi], dx
sti
dec esi
xchg dword cs:[edi], edx
cmp al, 0xe7
jg 0x516ad2
mov esi, 0xa0815f53
loop 0x516a72
sal dword [ebx], 0xd9
inc ebp
xchg esp, eax
mov edx, 0x9935cfa0
movsd dword es:[edi], dword [esi]
pop ss
jecxz 0x516a6b
iretd
push es
cmp al, ch
mov ah, 0x71
dec esp
and al, 0x1c
outsd dx, dword ss:[esi]
jne 0x516ac8
jae 0x516a19
test eax, 0xa7dd7696
xchg ecx, eax
and dh, byte [edx + eax*8]
mov dh, 0xe1
or ebp, dword [ecx + 0x3e17ed9f]
jl 0x516aa6
enter 0x5f6f, 0x27
dec edi
lodsd eax, dword [esi]
ficom dword [eax - 0x1c9964d0]
mov al, 0x23
sti
test bh, cl
pushfd
aad 0xb
iretd
or ecx, edi
add eax, 0xf022841c
cmp al, 0xe6
mov eax, 0x1a322e42
ror byte [ebx + eax*2], cl
idiv byte [edx - 0x22]
wait
invalid
sub al, 0x39
loopne 0x516aa8
call 0x3043765c
shl ebx, 0x9f
jecxz 0x516a73
xor eax, 0x53a71364
sbb eax, dword [ebx]
and al, 0x31
pop ds
sub byte [edx], cl
mov bh, 0x8e
invalid
Function at 0x539ee0
Capabilities:
Encode data using xor

Disassembly:
push esi
inc esp
invalid
dec esi
stc
xchg esp, eax
dec esi
inc edx
mov byte [0x80f38712], al
sahf
rcl byte [eax + 0x3a07404b]
pushfd
push eax
retf
enter 0x68fc, 0x72
mov edx, 0x231ca8d0
cmpsb byte [esi], byte es:[edi]
das
xor bl, bh
jg 0x539ee9
mov eax, 0x2ffd1086
jae 0x539ec6
inc ebx
mov ebx, 0xcdb640d3
push edi
cli
and ecx, edi
mov cl, 0x5f
test eax, 0x46d6b351
ja 0x539f0f
xchg byte [edx + 1], dl
pop es
lahf
or ch, cl
inc byte [ecx - 0x5e6690bd]
and byte [esi + esi*4 + 0x7f], ah
add ecx, edi
je 0x539ead
jmp 0x6f972112
popfd
add byte [eax], cl
leave
mov ebp, es
mov esi, 0xdccd4eb2
dec esi
out dx, eax
pop esi
cld
pushfd
in al, 0xee
sbb byte [edi - 0x53dd09e], 0x3d
xchg byte cs:[eax + 0x7ba54e87], bl
ret 0x420f

Function at 0x546df6
Capabilities:
Encode data using xor

Disassembly:
test al, 0x30
aad 0xbe
mov al, byte [0xe4945071]
jle 0x546def
ret
jno 0x546e4d
sub ah, bl
mov ebx, 0x5fa37a86
jp 0x546d86
pop edi
mov dh, 0xff
popfd
add esp, edi
mov dh, 3
pop edi
sti
stosd dword es:[edi], eax
out 0xdd, al
xor edi, dword [edx + 0x53b35d64]
fnsave dword [ebx]
mov edx, 0x53b35d64
jecxz 0x546e6e
mov byte [0x4b677569], al
xchg ecx, eax
jecxz 0x546de1
sbb eax, 0xd7e96951
mov bh, 0xa3
push eax
push esp
ucomiss xmm3, dword [ebp + esi*8 + 0x32bae674]
jg 0x546e56
push edi
shr dword [edx + 0x14], cl
dec ecx
mov al, byte ds:[0x261c2179]
cmp eax, 0xb64f630f
psrlq mm6, mm1
scasd eax, dword es:[edi]
push edi
inc ebx
push ecx
cmpsd dword [esi], dword es:[edi]
xor byte [edi], 0xc1
push cs
and bh, byte [eax + 0x3d]
aaa
rcr byte [ecx + 0xdf1c04f], 0x8e
jbe 0x546ddb
xchg edx, eax
push ds
pcmpgtw mm7, mm4
jecxz 0x546e5b
xchg ebx, eax
fisub dword [ebp + 0x69e9830c]
sbb byte [ecx - 0x68], bl
cwde
sub bh, al
je 0x546e77
adc eax, 0xcaceaab9
ret 0x3454
retf 0x54c2
mov edx, 0x2ebc3d13
pop ds
dec esp
sub eax, dword [edx + 0xf50fd16]
aam 0x6c
into
push es
pop ds
loopne 0x546e42
rcl dword [ecx + 0x557f4918], cl
xchg ecx, eax
sbb byte [ecx + 0x7f], cl
push ebp
jecxz 0x546edb
jbe 0x546e97
pop ds
fnstsw word [ebx - 0x70]
stc
pushal
pop ds
test dword [ebx], eax
pushfd
pop ss
pop eax
lahf
lodsb al, byte [esi]
fisttp word [edi]
sub dh, byte [ebx]
xchg ecx, eax
push eax
aas
les ebx, [ebx - 0x69e8203f]
or eax, 0x67
invalid
fprem
add esi, dword [ecx + ebp*8 + 0x31657e73]
or dword [edi + edx*8 - 0x75], ebx
ret
stc
stosb byte es:[edi], al
or eax, 0x70353f9d
mov cl, 0x39
dec edx
popfd
aas
xor eax, 0x4a39b170
fsub dword [ebx + 0x2f]
mov eax, 0xb0aedcc3
sub byte [eax + 0x46e682f9], ch
or eax, 0x61bfc80e
push ebp
not dword [0xe073679c]
cmp ch, dh
aam 0xfa
jp 0x546ede
invalid