joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406111
Capabilities:
Print debug messages
Set registry value

Disassembly:
push 0x24
mov eax, 0x42b827
call fcn.004151ec
xor ebx, ebx
push 0xffffffffffffffff
mov dword [ebp - 4], 2
push ebx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00401e97
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x2c]
push ecx
mov esi, 0xf003f
push esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406181
push 0x436484
jmp 0x4061ae
push 0x4364a0
call esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4061fd
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push ebx
push esi
push ebx
push ebx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4061f2
push 0x4364b0
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call esi
push dword [ebp + 0x48]
cmp dword [ebp + 0x4c], 0x10
lea ecx, [ebp + 0x38]
cmovae ecx, dword [ebp + 0x38]
cmp dword [ebp + 0x34], 0x10
push ecx
push ebx
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40616f
push 0x436490
call esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406200
push 0x4364bc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or ebx, 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401c01
lea ecx, [ebp + 8]
call fcn.00401c01
lea ecx, [ebp + 0x20]
call fcn.00401c01
lea ecx, [ebp + 0x38]
call fcn.00401c01
mov eax, ebx
call fcn.004151aa
ret 0x48
Function at 0x40622a
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push 0x98
mov eax, 0x42b7e7
call fcn.004151ec
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0xffffffffffffffff
mov dword [ebp - 4], 1
push ebx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], ebx
mov byte [ebp - 0x94], bl
call fcn.00401e97
lea ecx, [ebp - 0x98]
push ecx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x80], 0x10
mov esi, 0xf003f
push esi
lea eax, [ebp - 0x94]
cmovae eax, dword [ebp - 0x94]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406331
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x436484
call esi
push 0x64
pop eax
push eax
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x9c], ebx
call fcn.00417240
add esp, 0xc
cmp dword [ebp + 0x38], 0x10
lea ecx, [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x9c]
push ecx
lea eax, [ebp + 0x24]
cmovae eax, dword [ebp + 0x24]
push ebx
push eax
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406319
push 0x4364c8
call esi
lea eax, [ebp - 0x7c]
push eax
call fcn.00401001
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
mov ecx, edi
call fcn.00401dba
jmp 0x406323
push 0x4364d4
call esi
or ebx, 0xffffffff
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406399
cmp dword [ebp - 0x80], 0x10
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0x98]
push ecx
push ebx
push esi
push ebx
push ebx
lea eax, [ebp - 0x94]
cmovae eax, dword [ebp - 0x94]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40638b
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4364b0
call esi
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x406396
push 0x4364e0
call esi
jmp 0x406396
push 0x4364bc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or ebx, 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00401c01
lea ecx, [ebp + 0xc]
call fcn.00401c01
lea ecx, [ebp + 0x24]
call fcn.00401c01
mov eax, ebx
call fcn.004151aa
ret 0x34
Function at 0x406469
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x43b5a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10
mov esi, ecx
pop ebx
cmp dword [esi + 0x14], ebx
jb 0x40648a
mov eax, dword [esi]
jmp 0x40648c
mov eax, esi
push 0
push eax
call fcn.004144cc
pop ecx
pop ecx
test eax, eax
je 0x4064bb
cmp dword [esi + 0x14], ebx
jb 0x4064a3
mov eax, dword [esi]
jmp 0x4064a5
mov eax, esi
push eax
push 0x436510
call fcn.00403e19
pop ecx
pop ecx
mov ecx, esi
call fcn.004065a1
jmp 0x406517
mov ecx, esi
call fcn.00406526
test eax, eax
je 0x406515
lea edi, [esi + 0x18]
cmp dword [edi + 0x14], ebx
jb 0x4064d2
mov ecx, dword [edi]
jmp 0x4064d4
mov ecx, edi
cmp dword [esi + 0x14], ebx
jb 0x4064dd
mov eax, dword [esi]
jmp 0x4064df
mov eax, esi
push ecx
push eax
push 0x436528
call fcn.00403e19
add esp, 0xc
mov edx, esi
push edi
lea ecx, [ebp - 0x1c]
call fcn.00402778
cmp dword [ebp - 8], ebx
pop ecx
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp - 0x1c]
call fcn.00401c01
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041206b
leave
ret
Function at 0x406f85
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x43b5a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 8
pop ecx
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebx + 4]
movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x406fb5
lea edi, [ebp - 0x404]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406fc5
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x404]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406fe2
mov esi, str.Parameters
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x408]
push eax
push 1
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
lea eax, [ebp - 0x404]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407082
push 4
pop edi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebx + 0xf4]
push eax
lea eax, [ebp - 0x410]
push eax
push esi
push str.Start
push dword [ebp - 0x408]
mov dword [ebp - 0x410], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x40c], edi
call esi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebx + 0xf8]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0x436688
push dword [ebp - 0x408]
mov dword [ebp - 0x40c], edi
call esi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebx + 0xf4]
mov dword [ebx + 0xfc], ecx
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0041206b
leave
ret
Function at 0x4070a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42bade
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x43b5a0]
xor eax, esp
mov dword [esp + 0xc8], eax
push esi
mov eax, dword [0x43b5a0]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
mov dword fs:[0], eax
push str.Enter_PluginManager
call fcn.00403c87
pop ecx
mov esi, 0x433b13
push esi
lea ecx, [esp + 0x28]
call fcn.00401bd2
and dword [esp + 0xe0], 0
lea ecx, [esp + 0x24]
call fcn.004022e6
push 0x435ba8
lea edx, [esp + 0x28]
lea ecx, [esp + 0x58]
call fcn.004026ea
mov byte [esp + 0xe4], 1
mov edx, eax
lea ecx, [esp + 0x40]
mov dword [esp], 0x43caa0
call fcn.00403a39
pop ecx
push eax
lea ecx, [esp + 0x28]
call fcn.004023ea
lea ecx, [esp + 0x3c]
call fcn.00401c01
lea ecx, [esp + 0x54]
mov byte [esp + 0xe0], 0
call fcn.00401c01
push esi
lea ecx, [esp + 0x10]
call fcn.00401bd2
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0xe4], 2
call fcn.00405d14
cmp dword [esp + 0x20], 0x10
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
push str.httpurl:_s
call fcn.00403ba1
pop ecx
pop ecx
push 0x43cab8
lea eax, [esp + 0x10]
push eax
push 0x43cad0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x7c]
call fcn.004063f6
mov byte [esp + 0xe0], 3
lea ecx, [esp + 0x6c]
call fcn.00406469
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4071b6

Function at 0x4071e8
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x43b5a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
and dword [ebp - 0x408], 0
push edi
mov ebx, ecx
push 8
pop ecx
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebx + 4]
movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x40721f
lea edi, [ebp - 0x404]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40722f
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x404]
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40724c
mov eax, dword [str.Status]
mov dword [ecx], eax
mov eax, dword [0x4366b0]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
xor esi, esi
push esi
push 0x20006
push esi
push 0x433b13
push esi
lea eax, [ebp - 0x404]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4072bf
push 4
lea eax, [ebx + 0xfc]
push eax
push 4
push esi
push str.Current
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041206b
leave
ret
Function at 0x424048
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43b5a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041747f
mov dword [ebp - 0x14], eax
cmp dword [0x43dea8], edi
jne 0x424139
push 0x800
push edi
push 0x432584
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4240c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x424219
push 0x432584
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x424219
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424219
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x43dea8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x43deac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x43deb0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43deb8], eax
test eax, eax
je 0x424136
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43deb4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x42415e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x424151
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x424173
push 4
pop eax
jmp 0x42421b
cmp dword [ebp - 0x14], edi
je 0x424173
push dword [0x43dea8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x424158
mov eax, dword [0x43deb4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4241d1
cmp dword [0x43deb8], esi
je 0x4241d1
push eax
call ebx
push dword [0x43deb8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4241d1
test eax, eax
je 0x4241d1
call ecx
test eax, eax
je 0x4241c6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4241c6
test byte [ebp - 8], 1
jne 0x4241d1
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x424201
mov eax, dword [0x43deac]
cmp eax, esi
je 0x4241fe
push eax
call ebx
test eax, eax
je 0x4241fe
call eax
mov edi, eax
test edi, edi
je 0x4241fe
mov eax, dword [0x43deb0]
cmp eax, esi
je 0x4241fe
push eax
call ebx
test eax, eax
je 0x4241fe
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x43dea8]
call ebx
test eax, eax
je 0x424219
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x42421b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041206b
leave
ret
Function at 0x426418
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041bad3
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x426450
xor eax, eax
jmp 0x42647c
cmp esi, dword [ebp - 4]
je 0x426479
cmp dword [ebp + 0xc], 0
je 0x426479
push dword [edi + 0x9c]
call fcn.00426026
push dword [edi + 0x9c]
mov esi, eax
call fcn.004177b4
pop ecx
pop ecx
cmp esi, eax
je 0x42644c
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x43749f
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [edi], cl
mov bh, 0x45
or byte [ebx + 0x127f7ff8], al
movzx eax, word [ebp + 8]
cmp eax, 0x7f
jg 0x437407
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call 0xa769728f
ficomp word [ebx + ecx]
xor dword [0x268d11fe], 0xfffffffe
inc ecx
push edx
push esp
mov bl, 0xb5
fnsave dword [eax + 0x66038d32]
cmp eax, 0x849463a1
and dword [ebx - 0x65], eax
jae 0x4373ec
invalid
test byte [eax], ah
mov bl, 5
or ebx, dword [ebx + 0x74d229b2]
or dword [ecx - 0x31], 9
mov edx, dword [eax]
xor cl, byte [edx*2 - 0x25abdaf5]
push ss
xor dh, byte [edx - 0x1d1abd33]
cdq
push ds
fucomp st(6)
add dword [ecx + 0x6e46ce14], ecx
jne 0x4374c4
jbe 0x4373e9
loope 0x437493
and al, 0x1c
mov bh, 0x75
mov bl, byte [ebx - 0x69]
shl ecx, cl
invalid
push edi
ret
jp 0x437442
mov byte [0x87efa774], al
mov esp, 0x74f8cca2
add al, byte [ecx - 0x38]
pop ebp
add ebp, dword [esi]
retf
push es
mov byte [0xbe1898e3], al
enter 0xffffffffffff8193, 0x43
xchg esi, eax
jb 0x437520
jae 0x437548
cmp edi, ecx
add edx, dword [ebp + 0x2591655b]
xchg esp, eax
adc eax, 0xcdd3d62e
xor edx, dword [0x3780fe1f]
mov dword [esi - 8], esp
inc edi
mov dword [0xecab81f3], eax
movsd dword es:[edi], dword [esi]
pop ds
mov ch, 0xc8
loope 0x437524
cli
xor ebp, edi
mov byte fs:[ecx - 0x66], bl
push es
test eax, 0x30a5cc13
xchg al, dh
test dword [ebx], 0xa9f3b897
jecxz 0x4374d5
dec eax
pop edi
push ds
scasd eax, dword es:[edi]
wait
adc dh, cl
int1
jl 0x437530
cmpsb byte [esi], byte es:[edi]
jge 0x437573
xor eax, 0x1226adf4
inc edi
in eax, dx
pop ss
mov bl, 0xd3
cmp byte [ebx], 0xa5
lahf
invalid
in eax, dx
imul ebp, dword [ecx + 0x6e6ba86], 0xffffff83
shl byte [ebx - 0x4c68f75e], 1
adc byte [0x346067f5], dl
fnstsw word [0xcde1da13]
mov bh, 0xfa
scasd eax, dword es:[edi]
adc byte [edx - 0x43], ah
pushal
mov al, 0x4c
dec edx
enter 0xffffffffffffc103, 0xffffffffffffffb5
push edi
and eax, 0xca437d4e
mov dl, bh
push ss
dec edx
pop edi
dec ebx
invalid
dec esi
jge 0x4375b9
retf 0xd78a
int 0xe5
imul edx, dword [edx - 0x10], 0x72
push ebp
pop ss
pop ebx
fld dword [ebx - 0x72]
invalid

Function at 0x437bdf
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
pushal
movsd dword es:[edi], dword [esi]
cmp byte [edi + 0x187a104], ah
movsd dword es:[edi], dword [esi]
mov dword [0x33857600], eax
nop
inc esp
push edx
inc ebx
lea esi, [eax - 0x7c4c2f35]
rep movsb byte es:[edi], byte [esi]
invalid
Function at 0x44e6ef
Capabilities:
Encode data using xor

Disassembly:
inc ebx
xchg edi, eax
push esp
mov al, byte [0x6d5f2989]
movsb byte es:[edi], byte [esi]
inc ecx
lock add dword [ebx], ebp
int1
mov dword [0xe4193437], eax
pop edx
mov byte [0x64ef81d3], al
cmp dword [eax + 0x4f], eax
sbb ch, cl
add ah, dl
rcr byte [ecx + 0x7a58cef3], 0x43
bound ecx, qword [esi]
dec ebp
loopne 0x44e627
loopne 0x44e627
test ah, bh
mov esi, 0xd682cdc2
insb byte es:[edi], dx
mov edx, 0x5f9e3462
insd dword es:[edi], dx
cmp dword [edi + 0x70], 0xec3da463
cmpsb byte [esi], byte es:[edi]
invalid
pop ecx
xlatb
test dword [ebp + ebp*4 + 0x3c], eax
shr byte [ebx - 0x2e], cl
xchg ebx, eax
push edx
push cs
and al, 0x39
sub edi, ecx
mov word [edi + 0x6030d16e], es
js 0x44e5fc
lcall 0xb5a5, 0x3b037a20
ror bl, cl
sbb byte [eax + 0x57], ch
pushal
cmp dword ss:[eax + 0x4a], 0xffffffe1
mov cl, 8
jecxz 0x44e6bd
pop ds
pushfd
xchg edi, eax
int1
add al, 0xf9
int1
pop ecx
jecxz 0x44e6cd
adc eax, 0xaf41a635
push edi
sub byte cs:[ebx - 0x78], dl
pushal
cld
sbb dword [ebp + edi*2 + 0x69], esi
mov edi, 0x366b00e6
lodsb al, byte [esi]
mov edx, 0x3daa408f
mov eax, 0xf5526e85
mov edi, 0xd1c2853e
out dx, eax
cmp bl, byte [edx + 0x30]
fld dword [ebp + 0xa]
dec ecx
xor dword [esi + 0x39], ebx
fst dword gs:[ecx]
push esi
jp 0x44e64f
xchg ecx, eax
sub byte [ecx + 8], dh
shr dword ds:[ebx - 0x4606f751], 0x92
cdq
test byte [ebp - 0x7f], bl
jno 0x44e673
mov eax, 0x6960ecef
mov al, byte [0x215160d6]
mov ecx, 0x416ec192
scasb al, byte es:[edi]
mov ecx, 0x70d5b277
shr byte [ebx], 0xe1
or dword [eax], esp
or byte [ecx - 0x57fb6007], bh
loopne 0x44e760
xchg byte [edx - 5], al
sbb byte [ecx + 0x35], ah
ja 0x44e68d
adc eax, 0x1065b52c
popal
jno 0x44e784
loopne 0x44e7a5
mov eax, dword [0x2412ca6]
jne 0x44e710
and bh, byte [eax]
invalid
Function at 0x452d64
Capabilities:
Encode data using xor

Disassembly:
aam 0x56
jp 0x452cb4
mov edx, 0xdf3ee3df
invalid
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte ss:[esi]
mov ah, 0x68
stosb byte es:[edi], al
push ecx
pop esi
xor eax, 0xaedcef6f
push 0xffffffffffffffb0
pop edx
pop esi
sub al, 0xa8
pop ebx
cld
aas
mov cl, 0x9b
mov ecx, 0x549aba5b
in al, dx
cmp eax, 0xec2b8eb2
lcall 0x2b8e, 0xb23dec54
in al, dx
mov eax, 0x5cb93a61
mov bh, 0x3c
invalid
fstp xword [edx - 0x5d06e555]
xor al, 0x4a
push edx
xor byte [ecx - 0x5993424e], bh
pop ds
pop edi
cmp bh, byte [eax + 0xcffb277]
mov eax, 0xcffb277
pop ds
adc al, 0xbb
xor al, 0xde
mov ecx, 0x47beadfc
jp 0x452ce0
jl 0x452c9a
pushal
mov dl, 0x54
pop eax
pop ss
mov eax, 0x1a2d5b5a
push edx
xchg esp, eax
pop eax
idiv ebx
sub eax, ebx
je 0x452d72
mov dword [edx], ebx
mov ebx, 0x5c506720
mov dl, 0xd5
add al, 0xc7
push ds
cmpsd dword [esi], dword es:[edi]
cmp bl, byte [edi + eax + 0x566fcbe4]
mov ecx, 0x37883f05
xchg esp, eax
jae 0x452cc4
pop es
jnp 0x452ccf
push ebp
sbb dword [ebx], eax
outsb dx, byte [esi]
fidivr word [ebx - 0x1d2046d6]
pop eax
fbstp tbyte [edx + 0x5b1e3939]
cmp dword [ecx], edi
push ds
pop ebx
stosb byte es:[edi], al
lcall 0xc417, 0x5bfd1a5c
mov eax, dword [0xf5aa78da]
fdivr qword [edx + ebp*8]
int1
retf 0x5dff
jle 0x452cf2
lea ebp, [edi + 0x12]
nop
xchg edx, eax
fcmovne st(0), st(5)
jae 0x452d63
outsd dx, dword [esi]
adc dl, byte [eax + 0x66cddb92]
jae 0x452d63
xor dword [edx + 0x111f185f], 0x3de50df3
fcomp qword [ecx + eax*2 + 0x15057d3d]
and dword [edx - 0x5d], ecx
sub eax, 0x73ffaf6d
loope 0x452df4
pop ds
adc ebx, esi
or eax, 0x9cdc3de5
inc ecx
cmp eax, 0x2115057d
dec edx
mov dword [0xffaf6d2d], eax
jae 0x452ded
loope 0x452df4
pop edi
fnstenv [0x5e7164e4]
inc ecx
dec ecx
add eax, 0x371505b0
salc
sub byte [edx], bl
loop 0x452dac
xchg edi, eax
aam 0x43
dec ecx
jge 0x452d44
add cl, byte [ebx + 0x6f]
salc
push es
sbb eax, dword [eax + 0x58]
pop eax
jle 0x452e28
rol byte [eax], cl
cmp dword [ebp + 0x40f62a57], ebx
mov ah, 0x1d
dec ebp
int 0xef
invalid
xchg edx, eax
movsb byte es:[edi], byte [esi]
cmp ebx, edi
add byte [edi - 0x36], ah
mov dword [eax - 0x6a776d6e], esi
pop edx
dec ebp
invalid
xchg ebp, eax
add eax, 0x55f9372c
fcomp dword [edx]
mov ebp, 0x97759f27
fistp word [ebp + 0x7f]
invalid
Function at 0x453839
Capabilities:
Encode data using xor

Disassembly:
xlatb
inc esp
insb byte es:[edi], dx
int3
sub eax, 0x7e195ad5
push cs
sub eax, 0x5012eadb
and dword [eax], edx
mov esp, 0xacdac28a
inc dword [edx - 0x4c9585f0]
cmp dword [ebx + 0x46fd13db], 0x4a
inc esi
dec edx
wait
cmp dh, byte [edx + 0x351cdbac]
insd dword es:[edi], dx
jp 0x453879
xchg ebx, eax
salc
sti
xchg esi, eax
dec esp
int3
js 0x45381f
add dword [esi], edx
insb byte es:[edi], dx
jb 0x453856
and al, 0x2b
pushfd
and al, 0x8f
jnp 0x4538e9
jo 0x453882
pop ss
inc ebx
cdq
cld
jmp 0xd13eb76
mov bl, 0xf9
fistp dword [edi]
stosd dword es:[edi], eax
fnstsw word [edx + 0x75ac3e8d]
loopne 0x453928
pop ss
push 0x3e342b0a
xor al, 0x3e
scasb al, byte es:[edi]
sbb byte [edi], 0xcc
loop 0x453935
lcall 0x51c5, 0x4646e748
jmp 0x4538e7
je 0x453951
jae 0x4538b3
mov ebp, 0xe6bb30ac
or dword [ebp - 0x28], eax
insd dword es:[edi], dx
insb byte es:[edi], dx
scasb al, byte es:[edi]
jnp 0x4538b1
popfd
sbb esp, dword [edx + 0x63435f52]
mov esi, 0xa0c3ef81
cmp ebp, edx
arpl word [eax], sp
scasd eax, dword es:[edi]
nop
sldt word [ebp + 0x31]
or ebx, dword [ecx + ebp*2]
sbb byte [edx + ecx], bh
xor edi, dword [ecx]
mov esi, ecx
mov esp, 0x47dadf3b
inc ebx
cld
jge 0x453911
dec ebx
and eax, 0xd0eb8b46
in eax, dx
dec ebx
cmpsb byte [esi], byte es:[edi]
pop esp
pop edi
jae 0x4538c2
dec ebx
salc
mov ebp, 0x7aab04d6
adc ah, dh
lahf
adc bl, bh
xor byte [ebp - 0x15], dh
sbb al, 0x9c
push ecx
retf 0x39b4
mov ebx, 0xcb80dc8d
jns 0x45398c
cdq
frstor dword [edx + 0x3f]
push ebx
test dword [edx + 0x6c], 0x415dec48
sub dword [eax - 0x28], ebp
mov byte [0x26b4ff99], al
xor eax, dword [0x143de202]
mov cl, 0x43
invalid
retf 0xbf5a

Function at 0x46513f
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
rcr eax, cl
cmpsd dword [esi], dword es:[edi]
dec ebx
and ebx, edi
sub eax, 0x19a43e92
sub eax, 0x19a43e92
in al, 0x3d
adc ah, bl
xchg edx, eax
adc byte [edi - 0x52], ch
add byte [edi], bh
xchg edi, eax
mov esp, 0x421fef69
pop ds
inc edx
pop ds
inc edx
adc byte [eax + 0x7f821225], bh
pop ss
or al, 0x96
add eax, 0xc09729f2
stosd dword es:[edi], eax
xor edx, dword [edx]
fcomp qword [0xcf03b39a]
test edx, ebp
sbb al, byte [esi]
imul ebp, eax, 0xffffffc3
scasb al, byte es:[edi]
xor ebx, ebx
pop edx
cmp byte [ebx], dl
xchg cl, bh
add byte ds:[edi + 0x7bee97fc], dh
jecxz 0x46514f
jnp 0x4651ad
jecxz 0x46514f
inc ebx
fcom qword [edx + 0x1e]
or al, bh
pushfd
jb 0x465124
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
and ebx, dword [esi]
xor eax, 0xc167d076
xor al, 0x60
imul esp, dword [eax - 0x356b85a9], 0xeea1aa83
mov bl, dl
dec ebx
jb 0x46516d
sbb dword [edx], esp
xlatb
cmpsb byte [esi], byte es:[edi]
lea esi, [ecx - 0x36]
push edi
jle 0x46512c
lcall 0xf40b, 0x72a6895e
out 0xeb, eax
add eax, 0x1a60ea2e
out dx, eax