joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484897
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x598f70]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4848d7
cmp byte [ebx], 0xa
jne 0x4848d7
or byte [eax + edi + 0x28], 4
jmp 0x4848dc
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4849da
mov al, byte [edx]
cmp al, 0x1a
je 0x4849bc
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x48490b
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x484930
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x48493a
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4848ed
jmp 0x4849da
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4849b7
cmp dword [ebp - 0xc], 0
je 0x4849b7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x598f70]
test byte [eax + edi + 0x28], 0x48
je 0x484991
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x48497c
mov byte [esi], dl
jmp 0x48498d
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x598f70]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4849da
cmp byte [ebp - 1], 0xa
jne 0x4849a0
cmp esi, ebx
jne 0x4849a0
mov byte [esi], 0xa
jmp 0x4849d9
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401866
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4849da
mov byte [esi], 0xd
jmp 0x4849d9
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x598f70]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4849d6
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4849da
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x484a36
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x598f70]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x484a79
cmp word [esi], dx
jne 0x484a79
or byte [edi + eax + 0x28], 4
jmp 0x484a7e
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x484bd1
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x484bb1
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x484ac0
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x484af6
cmp eax, edx
jae 0x484b02
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x484a98
jmp 0x484bd1
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x484bad
cmp dword [ebp - 0x14], 0
je 0x484bad
mov eax, dword [ebx*4 + 0x598f70]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x484b85
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x484b4e
mov word [esi], cx
jmp 0x484b81
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x598f70]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x598f70]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x598f70]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x484bd1
pop ebx
cmp word [ebp - 4], bx
jne 0x484b96
cmp esi, dword [ebp + 0xc]
jne 0x484b96
mov word [esi], bx
jmp 0x484bce
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401866
add esp, 0x10
cmp word [ebp - 4], bx
je 0x484bd1
push 0xd
jmp 0x484bca
mov ecx, dword [ebx*4 + 0x598f70]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x484bc8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x484bd1
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x404f9f
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
adc byte [ebx - 0x240003b3], cl
add byte [ebx + 0x3c8d0875], cl
or byte [ebx - 0x102f0000], cl
lea ebx, [eax + edi*2]
int3
inc edi
mov dword [eax], eax
add bl, ch
add al, 0x4f
mov dword [ebp + 0x4c], edi
add byte [ebx - 0x769907bb], cl
add ecx, dword [ebx + 0x45390000]
cld
jbe 0x404f71
push ebp
add byte [eax - 0x7d], al
jge 0x404fce
add byte [ebp + 3], dh
add byte [eax], al
adc byte [ebx + 0x268bf07d], cl
add byte [ebx - 0x7c99f38b], cl
and al, 0x47
add byte [eax], al
call fcn.00449559
aam 0
add al, 0x57
and dword [edi + eax*2], 0
add al, ch
add dword [ebp + 4], 0x400d400
push edi
call 0x6aed77
add byte [eax], al
invalid

Function at 0x40de7e
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xc8be68b7
sbb byte [edi + ebp*4 - 0x80], dl
ficom word ss:[esi + 0x3bd3a838]
popfd
clc
jmp 0x40def0
movsd dword es:[edi], dword [esi]
cmp ebx, dword [ebp + 0x40]
inc eax
shl byte [ebx + 0x11], 1
xor edi, 0x5d
add dword [edi], 0x67
xlatb
xor al, 0x25
mov bh, 3
sahf
adc dword [edx - 0x185d0828], 0xcacc119a
aad 0x80
neg edi
salc
xor al, 0xb2
push ds
inc ebx
add byte [ebx - 0x48], dh
test dword [eax], eax
pop es
xor eax, 0x4a624017
xor dword [ecx], edi
mov dl, 0xe5
loope 0x40def3
inc eax
xrelease xchg dword [esi], ebp
or eax, 0x5312701e
dec esp
aas
pop ebx
jo 0x40df8a
retf
sbb byte [edi], dl
rol dword [eax], 1
and byte [ecx + 0x3b9757d1], bl
and dword [ebp - 0x14], 0x23
jp 0x40dfaf
and edi, dword [edx + 0x15]
mov al, byte [0x98925205]
xor dword [ebp + 7], 0xe6a9e4a4
fdiv dword [ecx - 0x2df0692f]
mov eax, dword [0x885551e7]
push ebp
mov byte [eax - 0x38afa00f], al
loopne 0x40dfef
xor cl, 0x5f
push eax
invalid
pushal
popal
leave
ror byte [eax - 9], cl
jo 0x40df97
inc ecx
fisttp dword [ecx]
fild word [edx]
mov dword [0x9cb9f987], eax
call 0xc2f04c09
js 0x40e001
add al, 0xd6
fstp dword [ecx + 0x96fa6f9]
inc eax
add esi, eax
ja 0x40dff8
jl 0x40dfb1
fiadd dword [edi - 0x28]
imul esi, dword [ecx], 0xffffffde
jo 0x40dfd2
and byte [ecx - 0x79], 0xa5
mov dh, 0x24
invalid
jnp 0x40e01a
push eax
in al, dx
invalid
sub al, 0x6a
invalid
inc ebx
xlatb
lodsb al, byte [esi]
xor eax, 0xf551d711
inc eax
aaa
mov dword [edi], esi
push eax
invalid
Function at 0x4238f7
Capabilities:
Encode data using xor

Disassembly:
push edi
push ecx
xchg esp, esi
jno 0x423903
frstor dword [edi + 0x41]
out 0xf3, eax
xchg ebp, eax
movsd dword es:[edi], dword [esi]
xchg edx, eax
pop edi
adc byte [esi - 0x5c5e163b], 0xb2
enter 0x12b5, 0xffffffffffffff97
pushal
aaa
aad 0x36
adc al, 0x36
push eax
pop es
test al, 0x47
push eax
pop ss
sub eax, 0x11cf8db5
das
xchg ebx, eax
loope 0x4238f9
bound ebp, qword [ebx - 0x2e618e8c]
jns 0x423970
mov dword [0xc632662c], eax
push ss
and dword ss:[ebx], ecx
mov edx, 0x3f906451
xchg edi, eax
pop ebp
int 0x4c
push edx
stc
xchg dword [ebx - 0x3f1d09cd], ebx
mov eax, 0xc0f5b590
test al, 0x4e
push esp
cmp byte [edx + 0x258586], dh
daa
jno 0x423990
inc ecx
push 0x151c454d
jmp 0x423913
js 0x4238f9
pop eax
cmp edi, dword [edx + edi]
push 0x4b
pop ebx
mov al, byte [0x9f3bf3]
cmp dword [esi + 0x3406fe00], esi
salc
dec edx
and edi, esi
inc edi
xchg dword [esi], eax
pop ebp
popal
aad 0x95
xchg ebp, eax
xor dword [edi + 0x3c], eax
sahf
push esp
stosd dword es:[edi], eax
adc dword [eax + esi*2], ecx
loop 0x42398f
pop eax
pop eax
ret

Function at 0x43eb45
Capabilities:
Encode data using xor

Disassembly:
shl dword [ebx], 0x4d
stosb byte es:[edi], al
invalid
test dword [ecx - 0x6c], esi
aam 0xa4
or ecx, edi
pop ebp
mov bl, 0x29
pop edi
mov dword [0x765d4242], eax
jbe 0x43ea7e
fist word [ecx - 0x58492cf4]
adc esi, edi
xor bl, al
jmp dword [eax + ebx*4]
mov dh, 0xf8
clc
mov cl, 0x9b
push esi
mov esi, 0xcebae5f1
lds ebp, fs:[eax]
jns 0x43eb00
sub byte [ecx - 0xf], bh
stosd dword es:[edi], eax
add dword [edi + 0x14dd7429], ebx
mov dl, byte [ecx + ebx*4]
out dx, eax
inc esi
adc al, 0x50
xlatb
js 0x43eb01
xchg edx, eax
test eax, 0xe4eb614a
push 0x8ad15675
neg edi
and eax, 0xeb46685e
loope 0x43eac9
invalid
dec eax
sbb al, 0xa4
aaa
jbe 0x43eb0c
mov dl, 0x2e
mov edi, esp
sub byte [eax], bh
sub esi, edx
and dword [edi], esi
aad 0x17
or dh, dh
aas
mov dword [edi - 0x5f], edx
push ebx
mov byte [0xfdcd8d65], al
mul dword [0xfb0a9141]
cld
imul esi, ebx, 0x4b
mov dword [0x235748b4], eax
push ss
push ecx
cld
mov byte [eax], bl
mov dh, dh
push ecx
xor byte [ecx + 0x7084ac71], dl
jecxz 0x43eb5b
invalid
Function at 0x44a8d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x44a9c7
push ebx
push esi
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a94a
mov edx, dword [0x652fa4]
push 0x652cd8
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, ebx
or eax, 0x8001
push eax
call edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__lcreat]
push ebx
mov esi, eax
call edi
cmp esi, 0xffffffff
je 0x44a975
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
test eax, eax
je 0x44a99b
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044a880
add esp, 4
mov dword [0xa53204], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret 4
push 0x22
push ebp
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x44a975
mov dword [0xa53204], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret 4
mov dword [0xa53204], 6
or eax, 0xffffffff
pop ebp
add esp, 8
ret 4

Function at 0x49863f
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
adc byte [ebx - 0x240003b3], cl
add byte [ebx + 0x3c8d0875], cl
or byte [ebx - 0x102f0000], cl
lea ebx, [eax + edi*2]
int3
inc edi
mov dword [eax], eax
add bl, ch
add al, 0x4f
mov dword [ebp + 0x4c], edi
add byte [ebx - 0x769907bb], cl
add ecx, dword [ebx + 0x45390000]
cld
jbe 0x498611
push ebp
add byte [eax - 0x7d], al
jge 0x49866e
add byte [ebp + 3], dh
add byte [eax], al
adc byte [ebx + 0x268bf07d], cl
add byte [ebx - 0x7c99f38b], cl
and al, 0x47
add byte [eax], al
call fcn.004dcbf9
aam 0
add al, 0x57
and dword [edi + eax*2], 0
add al, ch
add dword [ebp + 4], 0x400d400
push edi
call 0x742417
add byte [eax], al
invalid

Function at 0x49e398
Capabilities:
Encode data using xor

Disassembly:
pop ds
inc ebx
stc
add eax, 0x3c1ad584
invalid
Function at 0x4a49ce
Capabilities:
Encode data using xor

Disassembly:
shr byte [edi], 0xa0
pop edi
test eax, 0xb0610d52
mov byte [0xf5333742], al
mov al, byte [0xd52a95f]
popal
mov al, 0xa2
inc edx
aaa
xor esi, ebp
in eax, dx
outsb dx, byte [esi]
cmp eax, 0xc2425e5
mov word [eax + ebx*4], ds
sbb eax, 0x7aa493ae
movsd dword es:[edi], dword [esi]
push ecx
jb 0x4a49d0
imul ebp, dword [ebp - 0x43d98483], 0xe39bc17d
mov ch, 0xaa
cmp dword [esi + edi*8], esp
aad 0x32
sub esi, edi
push es
add al, 0xf
in al, 0x3d
xor byte [ebp + 0x4b4aaba4], 0xe7
inc edi
dec edx
dec ebx
out 0x47, eax
mov eax, 0x5c0b9ce9
int 0x65
nop
jle 0x4a4a0b
cmp dh, byte [ecx + 0x3c48cc8c]
lea edi, [edx - 0x32]
xlatb
sub esi, ecx
add eax, 0x4158e0cc
xor esp, dword [ebp + 0x6b71a95c]
cmp al, 0x44
out dx, eax
inc eax
sbb eax, 0x10fd9964
mov ebp, 0xe32ad114
sbb dh, bh
jmp 0x355f32b5

Function at 0x4db145
Capabilities:
Encode data using xor

Disassembly:
int 0x65
in al, dx
mov dword [0xcc7eaef], edi
int1
inc ecx
sbb edx, dword [esi + 0x40]
lahf
adc eax, 0xf49ad74e
lcall 0x706b, 0x7ec91240
jle 0x4db0c7
push cs
xchg esi, eax
mov esp, 0x691cff10
inc ebp
cmp esi, dword [edx + 0x7f66865a]
test esp, esi
mov esi, 0x83cc424c
aaa
xchg byte [ebp + eax*2 - 0x69], bl
pop ecx
insd dword es:[edi], dx
mov cl, byte [ebx + 0x28a638d0]
mov dword [0x5de04aee], eax
adc ch, byte [edi + edi*4]
je 0x4db13f
hlt
adc eax, 0x7c23c73e
or byte [esp + ebx - 0x5d2c2396], bl
salc
sbb al, 0x3d
mov ch, 0xca
dec ecx
xor byte [edx], cl
jecxz 0x4db0f4
test al, 0xe1
mov ecx, 0xbec2c2d0
xor ebx, esp
add eax, 0x804cfd9c
jge 0x4db09b
lea ebx, [eax + 0x7c34ec2e]
mov al, 0x63
sti
xor edi, dword [edi - 0x4e]
mov fs, word [ecx]
pop edi
loop 0x4db0b8
iretd
xor dword [ebx], edi
and al, 0xbd
invalid
sbb eax, esi
xor ch, byte [ebp + eax*4 - 0x69]
shl byte [ecx], cl
mov ecx, edx
jge 0x4db0fe
std
adc byte ds:[esi - 0x9016785], bh
mov cl, 0xf0
cli
mov byte [0x524be67f], al
invalid

Function at 0x52bdbf
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
adc byte [ebx - 0x240003b3], cl
add byte [ebx + 0x3c8d0875], cl
or byte [ebx - 0x102f0000], cl
lea ebx, [eax + edi*2]
int3
inc edi
mov dword [eax], eax
add bl, ch
add al, 0x4f
mov dword [ebp + 0x4c], edi
add byte [ebx - 0x769907bb], cl
add ecx, dword [ebx + 0x45390000]
cld
jbe 0x52bd91
push ebp
add byte [eax - 0x7d], al
jge 0x52bdee
add byte [ebp + 3], dh
add byte [eax], al
adc byte [ebx + 0x268bf07d], cl
add byte [ebx - 0x7c99f38b], cl
and al, 0x47
add byte [eax], al
call fcn.00570379
aam 0
add al, 0x57
and dword [edi + eax*2], 0
add al, ch
add dword [ebp + 4], 0x400d400
push edi
call 0x7d5b97
add byte [eax], al
invalid

Function at 0x52ef88
Capabilities:
Encode data using xor

Disassembly:
in al, dx
fcomi st(3)
les eax, [ecx - 0x58736e75]
inc esi
rol byte [edi - 0x48], 1
inc ebx
mov byte [ebx + 0x24], ah
sal byte [eax], 1
and eax, 0xee303fe0
movsd dword es:[edi], dword [esi]
dec edx
xor al, 0x8a
nop
bound eax, qword [ebx]
in eax, 0xf8
xchg ebx, eax
invalid
Function at 0x5657c5
Capabilities:
Encode data using xor

Disassembly:
mov ss, word [eax]
dec ebx
inc eax
xchg esi, eax
add bl, al
adc dh, al
sbb byte [ebp - 0xc], 0xbc
sub dword [0xbe889bb2], esp
pushfd
mov edx, 0xe00d3441
cmp ch, dh
shr dword [eax + 0x66], 1
cmpxchg bh, dh
push ds
sub dword [ebp - 0x7eec5059], esi
xor dword [0xd12ea95d], ecx
pop ebp
test eax, 0xb495d12e
xchg edi, eax
pop ebp
test eax, 0xb495d12e
xchg edi, eax
or dword [esi - 0x308a5aef], 0x755a51ff
mov dword [0x860b00c5], eax
push edi
sbb eax, 0x40302910
jbe 0x5657f8
fsubr qword [0xf287a482]
xchg ecx, eax
loop 0x56579b
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
mov ch, 0x36
inc esp
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
les eax, [ecx]
inc eax
xchg edx, eax
dec ebx
invalid

Function at 0x57f3a8
Capabilities:
Encode data using xor

Disassembly:
xor ah, byte [eax - 0x13d6d6a3]
test al, 0xec
pushfd
jle 0x57f31f
int1
xor esp, esi
pushal
push ebp
xor cl, byte [eax - 3]
sbb dl, al
push eax
mov al, byte [0xb78102c3]
push eax
dec ecx
cwde
mov ah, 0x7e
ret
add ah, dh
inc ebp
cld
adc byte [ebx], dl
xor byte [ebx + 0x5ab5cf32], 0x16
xchg edi, eax
aad 0xcd
inc esp
dec edi
je 0x57f363
arpl sp, sp
inc esp
inc ebx
jae 0x57f3e7
sub eax, esp
xchg edx, eax
rcr dword [edi + 0x39322558], 0xad
lodsd eax, dword [esi]
pop ebx
mov al, byte [0x951ec0dd]
xor dh, al
pop ebp
rol byte [0xe497df87], 0xfb
cwde
mov al, 0xd5
push eax
cmpsd dword [esi], dword es:[edi]
pop edx
jns 0x57f44e
arpl word [ebx - 0x1e8bde1c], si
in al, 0x21
je 0x57f3cc
dec edi
js 0x57f442
sub dword [eax + 0x7e], esi
loopne 0x57f40f
and dword [esi + 0x41], esp
xlatb
outsb dx, byte [esi]
dec edi
xchg edx, eax
inc esi
xchg edi, eax
fcmovbe st(0), st(4)
or al, 0x25
mov esp, 0x78d0b133
and eax, 0x8ff5fe10
mov cl, 0x6d
inc edx
or byte [edi], dl
pop ss
adc eax, 0xa83c78d6
adc byte [esi + 0x1066646a], 0x72
mov edi, 0x92b87d7b
inc edx
test al, 0x70
mov es, word [esi]
adc esi, 0x1b
dec edx
test byte fs:[eax + 0x54], ah
add dl, 0x49
aas
arpl word [esi + ebp*8], bp
pop ds
arpl word [ecx + edx*8], si
fcomi st(0)
inc esp
fcomp dword [ecx + 0x49]
cdq
mov eax, 0x54c58b13
mov eax, ebp
push esp
in al, 0x33
mov eax, dword [0xb11082e2]
sahf
push esi
dec ebp
rol dword [edi + edi*4 + 0x9b2a3d5], 1
ret 0x4608
Function at 0x5bf83f
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
adc byte [ebx - 0x240003b3], cl
add byte [ebx + 0x3c8d0875], cl
or byte [ebx - 0x102f0000], cl
lea ebx, [eax + edi*2]
int3
inc edi
mov dword [eax], eax
add bl, ch
add al, 0x4f
mov dword [ebp + 0x4c], edi
add byte [ebx - 0x769907bb], cl
add ecx, dword [ebx + 0x45390000]
cld
jbe 0x5bf811
push ebp
add byte [eax - 0x7d], al
jge 0x5bf86e
add byte [ebp + 3], dh
add byte [eax], al
adc byte [ebx + 0x268bf07d], cl
add byte [ebx - 0x7c99f38b], cl
and al, 0x47
add byte [eax], al
call fcn.00603df9
aam 0
add al, 0x57
and dword [edi + eax*2], 0
add al, ch
add dword [ebp + 4], 0x400d400
push edi
call 0x869617
add byte [eax], al
invalid

Function at 0x5cbbce
Capabilities:
Encode data using xor

Disassembly:
push edi
ret 0x5961
mov bh, 0xab
mov fs, word [ebx]
fdivr dword [ecx + 0x47]
dec ecx
pop ss
jno 0x5cbc36
std
xchg byte [edi + esi + 0x7209daa4], dh
insb byte es:[edi], dx
loope 0x5cbbbb
mov edi, 0xd25ac28b
pop ebp
in eax, 0x39
outsb dx, byte [esi]
insb byte es:[edi], dx
add dword [eax + 0x4da0956b], ebx
in eax, 9
xchg esi, eax
mov dword [0x3947697b], eax
mov bh, 0x18
lodsb al, byte [esi]
sbb byte [ebx - 0x5457263b], dl
cmp dword [ebx - 0x18580c36], esp
or dword [edi + 0x4c43949e], edx
call 0x44f74ecd
xchg dword [esi - 0x5e], edi
jle 0x5cbbbb
xor eax, 0xf97bb46a
neg dword [0xe0542bb9]
imul ebx, dword [ecx], 0xffffffbe
cmp edx, dword [edi]
xchg ecx, eax
sbb bh, byte [ebp + 0x442099c6]
sbb byte [esi + ebx*8 - 0x1eba0b36], dh
mov ah, 0xef
loope 0x5cbbec
out dx, eax
add al, 0x2a
and al, 0x7b
or dword [edx], 0x17e12b74
pop es
pop esi
fst dword [esi]
in eax, dx
xchg edi, eax
push ebx
adc dword [ebp - 0x653528c6], 0xfffffff0
jno 0x5cbc17
dec ecx
out 0x56, al
mov ebx, dword [ebx + 0x1f]
stc
test dword [eax + 0x37], ecx
invalid

Function at 0x6094ef
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
adc byte [ebx - 0x240003b3], cl
add byte [ebx + 0x3c8d0875], cl
or byte [ebx - 0x102f0000], cl
lea ebx, [eax + edi*2]
int3
inc edi
mov dword [eax], eax
add bl, ch
add al, 0x4f
mov dword [ebp + 0x4c], edi
add byte [ebx - 0x769907bb], cl
add ecx, dword [ebx + 0x45390000]
cld
jbe 0x6094c1
push ebp
add byte [eax - 0x7d], al
jge 0x60951e
add byte [ebp + 3], dh
add byte [eax], al
adc byte [ebx + 0x268bf07d], cl
add byte [ebx - 0x7c99f38b], cl
and al, 0x47
add byte [eax], al
call fcn.0064daa9
aam 0
add al, 0x57
and dword [edi + eax*2], 0
add al, ch
add dword [ebp + 4], 0x400d400
push edi
call 0x8b32c7
add byte [eax], al
invalid
Function at 0x4098c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x42c420], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x42c41c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x42c420], eax
cmp ecx, 0x26f
jl 0x4098d0
mov dword [0x415900], 0x270
ret

Function at 0x409910
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x42b010]
cmp eax, dword [0x415420]
je 0x409928
mov dword [0x415900], 0x271
cmp dword [0x415900], 0x270
jl 0x409a47
cmp dword [0x415900], 0x271
jne 0x40995f
mov eax, dword [0x42b010]
call fcn.004098c0
mov eax, dword [0x42b010]
not eax
mov dword [0x42b010], eax
mov dword [0x415420], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x42c424]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x42c420]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x42ca54]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x415910]
xor edx, eax
mov dword [ebx*4 + 0x42c420], edx
cmp ebx, 0xe2
jl 0x409968
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x42c424]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x42c420]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x42c094]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x415910]
xor edx, eax
mov dword [ebx*4 + 0x42c420], edx
cmp ebx, 0x26e
jl 0x4099bc
mov eax, dword [0x42cddc]
and eax, 0x80000000
mov edx, dword [0x42c420]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x42ca50]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x415910]
xor eax, edx
mov dword [0x42cddc], eax
mov dword [0x415900], 0
mov eax, dword [0x415900]
mov eax, dword [eax*4 + 0x42c420]
add dword [0x415900], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x40b4d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x415180]
cmp ax, 0xcb
je 0x40b5cc
cmp ax, 0xcc
je 0x40b5cc
mov edx, dword [0x42d030]
test edx, edx
je 0x40b502
mov eax, dword [0x42ced0]
call edx
mov ebx, eax
jmp 0x40b507
mov ebx, 0x42ced4
cmp word [0x42cec0], 0
jle 0x40b52a
mov eax, 0x42cea0
call fcn.0040b740
mov eax, ebx
call fcn.0040b0b0
mov eax, ebx
call fcn.0040b120
mov edi, dword [ebx]
jmp 0x40b54a
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40b545
mov edx, edi
mov eax, ebx
call fcn.0040a580
jmp 0x40b548
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40b530
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x42cec0], 0
jle 0x40b5cc
mov edx, 0x42cde0
mov eax, ebx
call fcn.0040a6b0
mov edi, eax
test edi, edi
je 0x40b59f
mov eax, dword [0x42ce74]
mov dword [edi + 0xc], eax
cmp dword [0x42ce74], 0
je 0x40b594
mov eax, dword [0x42ce74]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x42ce74], eax
sub word [0x42cec0], 1
cmp word [0x42cec0], 0
sete bl
mov eax, 0x42cea0
call fcn.0040b750
test bl, bl
je 0x40b5cc
mov eax, 0x42cea0
call fcn.0040b730
pop edi
pop esi
pop ebx
ret