joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e595
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4ba030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [esi + 0xc], 0x201
jne 0x47e686
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00428be0
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x218]
push eax
push edi
push 0x44b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x244], eax
xor eax, eax
push 7
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], edi
lea edi, [ebp - 0x234]
pop ecx
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x238], 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebx + 0xb8]
pop edi
cmp eax, dword [ebx + 0xbc]
je 0x47e689
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x47e689
and dword [eax], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00426ca5
leave
ret 0xc

Function at 0x47f670
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov dword [0x4e4bb4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xfffffffffffffffa
push dword [0x4e4bb4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
push eax
push 0x47f390
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
test eax, eax
mov dword [0x4e4bb8], eax
pop esi
setne al
pop ebp
ret 4
Function at 0x48a160
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
xor bl, bl
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x48a17d
mov eax, dword [esi]
test eax, eax
je 0x48a2a1
cmp word [eax], 0
je 0x48a2a1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48a2a1
test al, 0x10
jne 0x48a2a1
cmp dword [esi + 0x14], 8
jb 0x48a1af
mov esi, dword [esi]
push 0x4a9878
push esi
call fcn.00433ac3
mov esi, eax
add esp, 8
test esi, esi
je 0x48a2a1
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [esp + 0x18], xmm0
call fcn.0043b75b
push 2
push 0
push esi
call fcn.0043ade2
lea eax, [esp + 0x24]
push eax
push esi
call fcn.0043b75b
lea eax, [esp + 0x34]
push eax
push esi
call fcn.0043bbdc
add esp, 0x24
cmp dword [esp + 0x10], 0x28
jbe 0x48a298
xor eax, eax
mov dword [esp + 0x20], 0x48535844
push esi
push 1
mov word [esp + 0x40], ax
xorps xmm0, xmm0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x28]
push 0x28
push eax
mov dword [esp + 0x34], 0x28
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
movsd qword [esp + 0x40], xmm0
call fcn.0043a3cb
add esp, 0x10
test eax, eax
je 0x48a298
mov eax, dword [esp + 0x2c]
not eax
ror eax, 3
cmp eax, dword [esp + 0xc]
jne 0x48a298
cmp dword [esp + 0x20], 0x48535844
jne 0x48a298
cmp dword [esp + 0x24], 0x28
jne 0x48a298
movzx ecx, word [esp + 0x38]
add ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
add ecx, dword [esp + 0x40]
add eax, 0x28
add eax, ecx
cmp eax, dword [esp + 0x10]
sete bl
push esi
call fcn.00433f01
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x401113
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push 0
push dword [ebp + 8]
push 0
push 0x8000040
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40115b
push 0
push 0
push 0
push 0xf001f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x401176
push 0x40
push 0x101000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401197
push 0
push 0
push 0x40119c
push 0x40119c
push 0x80030008
call fcn.004010a1
add esp, 0x14
mov eax, dword [ebp - 4]
leave
ret
Function at 0x406004
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x422a1c], esi
push edi
jne 0x40603e
mov ecx, 0x422a18
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40601a
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422e18
jl 0x406015
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406073
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a18]
xor eax, esi
inc ecx
dec edx
jne 0x406056
pop edi
pop esi
not eax
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x4041f9
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
cmp dword [0x40f6b8], 2
push esi
push edi
jne 0x4042ea
push str.advapi32.dll
xor edi, edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
je 0x404232
push str.GetUserNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
mov dword [ebp - 4], 0x208
je 0x4042ea
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x21c]
push eax
call esi
test eax, eax
je 0x4042ea
cmp word [ebp - 0x21c], di
lea eax, [ebp - 0x21c]
je 0x4042df
push ebx
jmp 0x40426b
mov eax, dword [ebp - 8]
movzx ebx, word [eax]
inc eax
inc eax
cmp ebx, 0x20
mov dword [ebp - 8], eax
jne 0x40427e
push 0x5f
pop ebx
cmp ebx, 0x20
jl 0x4042a2
cmp ebx, 0x7e
jg 0x4042a2
push ebx
push str._:___
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
test eax, eax
pop ecx
jne 0x4042a2
and byte [ebp - 0x13], al
push 1
mov byte [ebp - 0x14], bl
pop eax
jmp 0x4042b5
push ebx
lea eax, [ebp - 0x14]
push 0x40cc34
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea esi, [eax + edi]
lea ecx, [esi + 1]
cmp ecx, dword [ebp + 0xc]
jae 0x4042d5
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
add edi, eax
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edi, esi
mov eax, dword [ebp - 8]
cmp word [eax], 0
jne 0x404268
pop ebx
mov eax, dword [ebp + 8]
and byte [edi + eax], 0
mov eax, edi
jmp 0x40430b
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x404304
and byte [esi], al
push esi
call sub.MSVCRT.dll_strlen
pop ecx
pop edi
pop esi
leave
ret

Function at 0x4051ed
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
mov ebx, dword [ebp + 8]
push edi
push ebx
call fcn.004032b4
mov edi, eax
pop ecx
test edi, edi
je 0x4052b0
push esi
push ebx
call sub.MSVCRT.dll_strlen
mov esi, eax
lea eax, [ebp - 0x400]
push esi
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
mov al, byte [ebp + esi - 0x401]
add esp, 0x10
cmp al, 0x2f
je 0x40523f
cmp al, 0x5c
je 0x40523f
mov byte [ebp + esi - 0x400], 0x5c
inc esi
push edi
call fcn.004033aa
test eax, eax
pop ecx
je 0x4052a8
cmp byte [eax + 0x10], 0x2e
lea ecx, [eax + 0x10]
jne 0x405265
mov dl, byte [eax + 0x11]
test dl, dl
je 0x40523f
cmp dl, 0x2e
jne 0x405265
cmp byte [eax + 0x12], 0
je 0x40523f
lea eax, [ebp + esi - 0x400]
push ecx
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x400]
push 0x1ff
push eax
call dword [sym.imp.MSVCRT.dll__chmod]
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 0x14
test eax, eax
je 0x40523f
lea eax, [ebp - 0x400]
push eax
call fcn.004051ed
pop ecx
jmp 0x40523f
push edi
call fcn.00403469
pop ecx
pop esi
push ebx
call dword [sym.imp.MSVCRT.dll__rmdir]
pop ecx
pop edi
pop ebx
leave
ret
Function at 0x40934a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d398
push 0x409482
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x40f8ac], 0xffffffff
or dword [0x40f8b0], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x40f7b4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x40f7b0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40f8a8], eax
call fcn.00409481
cmp dword [0x40e290], 0
jne 0x4093cd
push 0x40947e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040946c
push 0x40e00c
push 0x40e008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x40f7ac]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40f7a8]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x40e004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call section..text
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4148a2
Capabilities:
Encode data using xor

Disassembly:
and dword [0xc2c5244d], 0x38
mov al, 0xe4
test eax, 0x1f098a4
lock add dword [eax], esp
add byte [eax], al
push ebx
mov edx, dword [ebx + 0x32]
mov al, 3
stosd dword es:[edi], eax
inc ecx
shr byte [eax - 0x14], 0xee
inc ecx
das
rcl ebx, cl
invalid
invalid
Function at 0x44b610
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov al, byte [0x65e04e]
mov cl, byte [0x65e043]
xor cl, al
mov byte [0x65e043], cl
mov cl, byte [0x65e041]
or cl, 0xc
shr cl, 2
and ecx, 0xff
mov dword [esp], ecx
fild dword [esp]
fdivr qword [0x6619e0]
fadd qword [0x661980]
fstp qword [0x6619e0]
call dword [sym.imp.USER32.dll_GetDialogBaseUnits]
mov dl, byte [0x65e042]
mov al, byte [0x65e049]
mov ecx, dword [0x65e030]
xor al, dl
mov byte [0x65e049], al
mov eax, dword [0x65e034]
mov edx, dword [0x65e048]
and eax, 4
add ecx, eax
and edx, 0xff
mov dword [0x65e030], ecx
mov ecx, dword [0x65e03c]
and ecx, 0xc
mov eax, dword [esp + 8]
imul ecx, edx
mov edx, dword [0x65e038]
push eax
xor edx, ecx
mov dword [0x65e038], edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [0x661be4], eax
mov eax, dword [0x661be0]
test eax, eax
jne 0x44b728
mov ecx, dword [0x661acc]
push ecx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0xa3
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jne 0x44b6ed
mov eax, dword [esp + 8]
mov ecx, dword [0x661be4]
cmp eax, ecx
je 0x44b6ed
mov dword [0x661be4], eax
push esi
push edi
push str.comctl32.dll
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.LoadIconWithScaleDown
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov dword [0x661ad4], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
mov dword [0x661be0], 1
pop esi
pop ecx
ret 4
mov eax, dword [esp + 8]
pop ecx
ret 4
Function at 0x458470
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0xb3331e6c
push cs
and al, 0xa2
and dl, dh
push ss
pop ecx
adc al, 0x66
xchg byte [edx], dl
sbb al, dl
fisub dword [ebp - 0x492bedec]
adc al, 0x12
aam 0xb6
in al, 0xf2
xor al, 0xe1
jne 0x45842a
int1
std
sbb al, 0xcf
add dword [esi - 0x33e8caec], 0xffffffd4
movq mm4, mm4
lcall 0x8b4f, 0xff19bebb
test dword [eax - 0x2c], ecx
not byte [bx + di + 0x35]
mov eax, dword [ebp + 0x6667d448]
not byte [ecx + 0x35]
stosd dword es:[edi], eax
cmc
dec si
cmp dword [edi - 0xc0825a6], esp
ja 0x45843f
push edx
sbb edx, ebp
popal
shl dword [edx - 0x653eb285], 1
push es
xor byte [ebp + 0x633ba038], al
adc dh, byte [esi - 0x5c]
jbe 0x458416
jbe 0x458416
out 0xfb, eax
xchg ebx, eax
xor ch, byte [ebp - 0x76]
push edx
mov edx, 0xf5410b2
sub bl, byte [eax + 0x62bbca6f]
jns 0x458493
lodsd eax, dword [esi]
in al, dx
lea ebp, [esi + 0x7c]
adc dl, byte [esi + 0xa]
cmp eax, dword [ebx + 0x45]
push es
jl 0x458426
xchg edx, eax
stc
pushfd
aam 0xad
wait
push 0xffffffffffffffe1
jg 0x458469
add byte [ebx + edx + 0x12], 0x33
lds ebx, [eax - 0x1f]
jmp 0x458449
Function at 0x46c6f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x89e49b9d
wait
in al, 0x89
pop ebp
sbb edx, dword [ebx]
jp 0x46c715
add eax, 0xb0446db5
das
mov al, 0x2f
or byte [ecx - 0x56], bh
or eax, 0x83cb22bb
in al, 4
inc edi
mov ah, 0x38
cmp byte [ebx], 0x11
movsd dword es:[edi], dword [esi]
push es
vmaxsd xmm2, xmm7, xmm4
jmp 0x46c6ee
fadd st(5)
fmul dword [eax]
add al, 0x46
add esp, dword [ebp + eax*4 - 0x36]
test edx, ecx
adc bl, 0x8d
push ebp
jae 0x46c6fc
adc byte [eax], dl
insd dword es:[edi], dx
jne 0x46c787
sti
invalid
jno 0x46c71d
push ebp
and eax, dword [0x1d6c9d73]
pop esp
insb byte es:[edi], dx
xchg ebx, eax
inc edx
in eax, dx
adc esi, esp
cmp dword [eax + edx*4 + 0x1a], 0xffffffa3
jecxz 0x46c7ef
sbb ah, byte [ebx + 0x674ee33e]
or dl, byte [ebx + 0x61f07de4]
test bh, 0x81
add dword [edi], esp
lahf
invalid
or dl, byte [bp + di + 0x7de4]
invalid
jns 0x46c79c
xchg eax, ebx
test byte [ebx - 0x2c], 0x20
inc edx
or cl, ah
stc
js 0x46c85b
xor byte [0xced23bb3], dl
mov dh, byte [edx + eax*2 + 0x370f5ba5]
inc esp
mov al, byte [0xa760345]
xchg ecx, eax
stc
sub al, 0x7d
jl 0x46c7fb
and al, byte [eax - 0x23]
push es
mov ch, 0x25
bound esp, qword [ecx - 0x2a]
sbb dh, byte [ebx + eax - 2]
xor al, byte [ebp + 0x656644a]
adc dl, byte [edi]
cmp ah, byte [ebp - 0x7f6fc9f0]
mov eax, 0xf6fcb161
inc edi
outsb dx, byte [esi]
pop es
mov ah, 0x7e
xor byte [edx + edx*4 - 0x28], 0x53
xchg esp, eax
jb 0x46c83d
mov ebp, eax
lahf
je 0x46c8af
push edx
int1
inc esp
popal
pushal
pop ebx
int 0x48
clc
jne 0x46c8b9
les esi, [edi + 0x3278a7a4]
dec esp
je 0x46c8ac
xor cl, byte [esp + esi*2 + 0x4d]
push 0x72e332e3
hlt
xchg esp, eax
push ds
movsb byte es:[edi], byte [esi]
adc dl, byte [ebx + 0x2d]
sub eax, 0xf6ce1a46
xor dword [edx + 0x2a], 0x17bc24a6
jb 0x46c8e5
cmpsb byte [esi], byte es:[edi]
and al, 0xbc
pop ss
in al, dx
pop ebx
inc ebx
xor al, 0x19
std
mov bl, 0x30
lodsb al, byte [esi]
popfd
adc edi, dword [esi + edi + 0x50e6f4b9]
pop ebx
lds esi, [eax + 0x5206b775]
adc esp, dword [esi + 0x24]
nop
push edx
aas
mov eax, dword [0x80f482b7]
leave
and ah, byte [ecx - 0x7a60a4e]
mov dl, 0xf5
pop ecx
clc
bound eax, qword [ebx + edx*4 - 0x6e67c73c]
xchg ecx, eax
ret 0x969d
Function at 0x4ed4c0
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
imul edi, dword [edi], 0xabf47abc
xchg ecx, eax
jo 0x4ed452
xor bl, byte [ecx + 0x4d]
adc dword [0x227730b], edx
rol byte [ecx], 0x83
pushal
dec ebx
sub eax, 0xd643d46
sbb ebp, ebp
xchg al, dl
or eax, 0xd086ed19
pop ss
fnstenv [esi - 0x306d30bd]
mov bh, byte [ebx]
xor al, 0x92
mov fs, word [eax + 0x3b]
jbe 0x4ed470
sbb eax, 0x5282b0e2
xchg ecx, eax
leave
std
and edi, dword [eax]
jmp 0xb0068a91
mov dword [0x74c61757], eax
push ss
jge 0x4ed4cc
add edx, dword [edi]
jmp 0x4ed4d0
cmp esp, dword [esi - 0x2d]
das
stosd dword es:[edi], eax
popfd
arpl word [esi + 0x79], bp
insb byte es:[edi], dx
loop 0x4ed45a
rep stosd dword es:[edi], eax
inc ebp
push edi
pop ebx
test byte ss:[esi], ah
pop ss
cmpsb byte [esi], byte es:[edi]
fcom dword [esi - 0x2a]
popal
daa
push 0x2e
dec edi
test eax, 0x53b4b216
popal
mov esp, 0xaf26a0d6
mov dh, 0x52
mov al, dh
aaa
popfd
ret
Function at 0x538030
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0xb9
dec ebx
test bl, ah
jno 0x538052
jl 0x5380a5
and byte [ecx], bh
jo 0x5380ba
mov cl, 0x6a
not byte [ebx + 0xb]
mov eax, 0xef5cb9b1
sub word [ebx + 0x78], di
xor byte [ebx + 0x4d], ah
iretd
aaa
inc edx
pop ebp
les ecx, [ecx + ecx*2 - 0x5b]
shr byte [edx], 1
mov ch, 0x62
inc eax
push esi
mov eax, dword [0xb2b06f61]
in eax, dx
mov ah, 0xb6
invalid
je 0x538064
nop
invalid
sub dword [esi + eax*2 - 0x6d1d73ef], esi
sbb al, 0x2a
les ecx, [eax + 0x59770238]
pushfd
in al, dx
mov esp, 0x8fc92adf
add eax, 0xa1cc751e
dec eax
mov dh, 0x2b
add byte [esi + eax*4 - 0x7a61194], 0xf9
and dword [eax], ebp
add ch, byte [ecx + esi*4 - 0x5f]
adc dword [edx - 0x11bd2726], edi
call dword [esi + 0x394b5875]
add ah, dh
mov cl, 0x36
mov al, 0x97
adc ch, byte [edx - 0x4c]
test dh, al
dec edx
in al, 0xbc
salc
test esp, esp
fsubr dword [eax + 0x2d]
and dword [edx - 0x667cb4c0], esp
mov ch, 0x1e
mov dword [0x832d5055], eax
pop ebp
mov bl, 0xb
push 0x40a2212d
dec ebx
sbb dword [ecx + 0x55a31eb5], 0x50
sub eax, 0xbb35d83
jecxz 0x53816e
pop ds
ret
adc ch, al
outsb dx, byte [esi]
xor esi, dword [ebx]
fimul dword [ecx + 0x4b]
vmptrld qword [eax - 7]
mov ebp, 0xb94d9988
dec ebp
invalid
mov ch, 0x4d
dec ebx
jg 0x538105
or al, 0x2f
enter 0xffffffffffff9992, 0xffffffffffffff9e
popal
out dx, eax
adc cl, ah
cmpsd dword [esi], dword es:[edi]
loopne 0x538152
lcall 0xa189, 0x62216198
fst dword [esp + esi*8 + 0x67]
xor dh, al
invalid

Function at 0x541320
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa9cc1ad9
pushfd
scasb al, byte es:[edi]
xchg esi, eax
xchg dword [ebp + 0x703bbc44], edx
inc ecx
mov ebp, es
test dword [ecx + 0x583004d], ebp
and eax, 0x88535ce6
inc edx
add byte [ecx + 0x645bc6d6], bh
or dword [ebx + esi + 0x61], ebp
xchg dword [esi + 0x36], edi
dec eax
scasb al, byte es:[edi]
jecxz 0x5412f3
test eax, 0x9921b603
jg 0x541382
out 0x39, eax
pop es
dec edi
adc dword [eax], esi
mov eax, 0x8a665e39
scasd eax, dword es:[edi]
mov esi, 0xdad93215
push ebp
add ch, ah
cmp al, 0x9f
stosb byte es:[edi], al
inc eax
pop es
mov ch, 0xcf
out dx, al
adc ax, 0x1da9
or ebp, dword [esi + 0x51afdde]
mov word [ecx - 0x23], es
sal dword [0x7644c6b0], 0x5b
fdivp st(5)
sbb al, byte [0xc1dd418c]
xor eax, 0x7644c6b0
pop ebx
jecxz 0x54134c
invalid
and eax, 0xe19b074c
mov dword [0xf2f528bb], edi
adc al, 0x40
jmp 0x54139f
jns 0x541383
call dword [ebp - 0x60d6c2df]
or al, 0xe6
xchg ebp, eax
and dword [0xe60c9f29], edi
scasb al, byte es:[edi]
neg al
lds esp, [edx - 0x16]
adc al, 0x39
jge 0x54135f
scasb al, byte es:[edi]
stosb byte es:[edi], al
xor byte [ecx + 1], 0x9a
xor ebx, dword [edi + ebx*8 + 0x5c]
jecxz 0x54135f

Function at 0x543610
Capabilities:
Encode data using xor

Disassembly:
bound esi, qword [eax - 0x26e95fcf]
cmp byte [ecx + 0x30], 0xb3
dec edx
push ss
fld dword [eax + 0x4ab33079]
mov eax, dword [eax - 0x1a]
daa
mov al, byte [0x55842008]
aad 0x3b
xor byte [ecx + 7], ch
je 0x543614
and eax, 0xd9388e99
cmp dh, byte [ecx - 0x41a3bf74]
hlt
Function at 0x5456d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
test bh, al
mov ebx, 0xa5204bd0
pop edi
fld qword [ecx + 0x52e17fe9]
in eax, dx
xlatb
and edx, ebp
punpckhdq mm6, qword [ebx]
or ch, byte [edi - 0x37]
push edx
mov bh, 0x50
xor byte cs:[ebx - 0x2e], ch
in al, dx
push 0x4d
adc edi, dword [ecx + 0x4b2916df]
mov eax, dword [0x2f4fd112]
test eax, 0xf9c73b08
adc dword [edx - 0x5a0b70d], edx
rol byte [edi + 0x3a], 1
fcmove st(0), st(3)
enter 0xfffffffffffff967, 0xffffffffffffffd7
movlps qword [eax + edx + 7], xmm4
inc edx
or ebx, 0x67
xor cl, byte [ecx - 0x15059544]
clc
push eax
mov dh, 0x1b
out dx, eax
test al, 0xa6
stc
mov cl, 0x8b
xchg byte [esi + 0x12247947], ah
adc bl, ch
mov ch, 0x44
ja 0x545750
mov edx, 0x951769a6
loop 0x545796
std
xchg ebp, eax
loop 0x545796
std
inc edi
dec esp
dec edx
add byte [ebx + 0x7c314f79], bl
xor byte ss:[ebp + 0x2e], bl
aad 0x30
and eax, 0xc04671c0
sub ebp, eax
pushfd
mov ebx, 0x242cc50b
jge 0x54573a
sbb bh, ch
dec ebp
int1
sbb eax, 0x981aeefa
sub dh, cl
pop esp
push ds
xchg ebp, eax
les ebx, [edi + 0x695a9995]
and dword [ebp - 0x6b], esi
lds ecx, [esi]
and bl, bh
xchg byte [esi], dh
adc dl, dl
mov eax, 0x47494e58
mov ecx, 0x6be1a911
xor ecx, ebp
shl eax, 0xca
test dword [0x4eaf60cb], ebp
xor edx, dword [esp + ebp - 0x74]
lodsd eax, dword [esi]
pop ecx
or esi, ecx
pop es
cmp al, 0xbc
pop ebx
jo 0x54573d
invalid