joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2060
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x4e20a1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4e2096
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x4e20b4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x14]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1c]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x1c], ecx
pop ebp
pop ebx
ret
Function at 0x4e2d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
jne 0x4e2dac
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
jne 0x4e2dbd
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x4e2dcb
push edi
call fcn.004e32a0
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push edi
call fcn.004e2b90
add esp, 0x10
test eax, eax
je 0x4e2df3
pop edi
pop esi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push 0x84
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x4e2e12
pop edi
pop esi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
push 0x4000
call sub.MFC42.DLL_operatornew
mov dword [esi], eax
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x44], ecx
mov edx, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x4e2e4b
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 0xffffff98
pop edi
pop esi
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp edx, ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
sete al
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
cmp eax, ebx
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
jne 0x4e2e99
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
push eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.004e18f0
add esp, 4
test eax, eax
jne 0x4e2e99
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x4e2ec6
mov edx, dword [edi + 0x38]
shr edx, 8
mov byte [esi + 0x80], dl
jmp 0x4e2ed2
mov eax, dword [edi + 0x3c]
shr eax, 0x18
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [esi + 0x70]
neg cl
sbb ecx, ecx
mov dword [ebx], 0x12345678
and ecx, 0xc
mov dword [esi + 0x74], 0x23456789
test ebp, ebp
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x78], 0x34567890
je 0x4e2f13
mov al, byte [ebp]
test al, al
je 0x4e2f13
push eax
push ebx
call fcn.004e1610
add esp, 8
inc ebp
jne 0x4e2eff
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
mov dword [esi + 8], 0
pop ebp
lea ecx, [edx + eax + 0x1e]
xor eax, eax
mov dword [esi + 0x3c], ecx
mov dword [edi + 0x7c], esi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4e3470
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x4e3552
cmp dword [ebp + 4], 0xffffffff
jne 0x4e3552
push ebx
lea ebx, [ebp + 0x13c]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov cl, byte [ecx + ebp + 0x13b]
cmp cl, 0x5c
je 0x4e34e2
cmp cl, 0x2f
je 0x4e34e2
mov edi, 0x621838
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
cmp edi, 1
pop ebx
jne 0x4e350e
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4e350e
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push edi
push ecx
push esi
call fcn.004e1e10
add esp, 0x10
test eax, eax
jne 0x4e3531
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.004e23e0
add esp, 4
mov dword [ebp], eax
neg eax
sbb eax, eax
pop edi
and eax, 0xfffffe00
pop esi
add eax, 0x200
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x4e3b50
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x214]
mov al, byte [esi]
test al, al
je 0x4e3c22
push ebx
push ebp
push edi
mov ebx, esi
mov ecx, esi
cmp al, 0x2f
je 0x4e3b77
cmp al, 0x5c
jne 0x4e3b79
mov ebx, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4e3b6f
mov ebp, dword [esp + 0x21c]
cmp ebx, esi
mov edx, ebx
je 0x4e3bbc
mov eax, ebx
lea edi, [esp + 0x10]
sub eax, esi
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + eax + 0x10], 0
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.004e3b50
add esp, 8
lea edx, [ebx + 1]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x118]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x208
ret
Function at 0x5318c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x598c61
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push ecx
push ebx
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00532760
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], edx
je 0x53196b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x531962
cmp al, 0xff
je 0x531962
dec al
mov byte [ecx], al
jmp 0x53196b
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x53199c
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x531993
cmp al, 0xff
je 0x531993
dec al
mov byte [ecx], al
jmp 0x53199c
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x402fc9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x402fd8
pop dword [ebp - 0x30]
mov eax, 0xeb85ffb1
add eax, 0x14ba3027
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x775597b4
sub dword [ebp - 0x40], 0x29035269
mov dword [ebp - 0x3c], 0xa544eb89
sub dword [ebp - 0x3c], 0x73119f44
mov dword [ebp - 0x38], 0xcbb064ce
sub dword [ebp - 0x38], 0x7f6420a0
mov dword [ebp - 0x34], 0x90fb810a
sub dword [ebp - 0x34], 0x90fb810a
lea eax, [ebp - 0x40]
push eax
mov eax, 0x1fce860
sub eax, 0x1bc180c
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x2b01d1ec
sub dword [ebp - 0x40], 0xb68f6896
mov dword [ebp - 0x3c], 0x8c20ce23
sub dword [ebp - 0x3c], 0x4ab46cae
mov dword [ebp - 0x38], 0x1b0736f0
sub dword [ebp - 0x38], 0xb797ca84
mov dword [ebp - 0x34], 0x89311e8a
sub dword [ebp - 0x34], 0x89311e8a
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x808a9ea4
sub eax, 0x8049ce58
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3bb17
push 0
call eax
mov ecx, 0x9606a241
add ecx, 0x69f9ae70
xor edx, edx
add edx, eax
mov ebx, 0x14aa5b0
sub ebx, 0x108f5b0
add ebx, dword [ebp - 0x30]
mov esi, 0x943835ac
add esi, 0xc7e67867
add dword [ebp - 0xc], ebx
mov edi, dword [ebx]
add dword [ebp - 0x1c], 0x773b932d
sub edi, esi
xor dword [ebp - 8], 0x818c031f
mov dword [edx], edi
xor dword [ebp - 8], 0x2ebc030b
add edx, 0xb9a13a58
add edx, 0x465ec5ac
add ebx, 0xb511b0a8
sub ebx, 0xb511b0a4
loop 0x4030fc
add eax, 0xedc49c44
add eax, 0x123c9953
xor ebx, ebx
add ebx, eax
add eax, 0x8dcfc2f0
sub eax, 0x8dcfc2eb
mov ecx, 0x75bc86b1

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40ffe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ebx + ecx*2 + 0x51], dl
pop edi
mov ecx, dword [ecx - 0xbdcd7f]
pushfd
leave
mov byte [0x154d0eb], al
fild qword [esi]
push esp
add edi, ebx
stc
stc
stc
xchg edi, eax
imul esp, ebx, 0x7142db11
mov ebx, 0xf2e7e3c7
sti
pushal
xor byte [edi - 0x2e], ch
outsd dx, dword [esi]
sal byte [ecx - 0x28], cl
leave
js 0x40ffdc
mov fs, esi
mov dword [0x324df671], eax
dec eax
mov byte [ecx], ch
dec ebp
or cl, byte [edi]
push eax
cwde
sub bl, byte [ecx - 5]
invalid

Function at 0x414120
Capabilities:
Encode data using xor

Disassembly:
mov word [edx - 0x1a], es
or edi, ebp
xor byte [ecx], 0xe1
lodsd eax, dword [esi]
bound esp, qword [esi]
loopne 0x4140f5
cli
in al, dx
aad 0xd0
push 0x509116bc
rcl byte [esi - 0x53df9cb5]
inc esp
invalid
inc ecx

Function at 0x414918
Capabilities:
Encode data using xor

Disassembly:
add ebp, dword [eax + ebp - 0x5a42a2bf]
mov esp, dword [eax - 0x31]
dec ebp
fcmovbe st(0), st(4)
xor ah, byte [edi - 0x290d18b9]
xchg esp, eax
sal byte [esi + 3], cl
pushfd
and eax, 0x3a6440b4
jle 0x414920
pushal
iretd
pop ecx
pushfd
add esi, dword [edi + 0x5d]
pop ecx
lahf
inc edx
insb byte es:[edi], dx
xchg edi, eax
sti
or dword [edx + 0x77cda1ae], eax
push ss
add ch, cl
imul ecx, dword [ebx - 0x54], 0xef74eeab
cli
mov ebp, 0x3768c093
mov al, byte [0x4bfdb1a8]
xchg esp, eax
pop ecx
add byte gs:[edi - 0x29de0a86], ah
dec esp
fdiv dword [esi - 0x6ed27f4c]
cli
and al, 0x71
jno 0x4149a5
pop ds
pop edi
salc
loopne 0x4149f0
jmp 0x4149c5
ljmp 0xd23c:0xeea3ad6
ljmp 0x311c:0xebd23c0e
jge 0x414a33
push ebp
rcl dword [ebx + 6], 0x6d
push 0xffffffffffffffbd
jae 0x4149c2
adc ebp, esp
jnp 0x414a01
sub eax, 0xd2937b8f
jae 0x4149e9
cld
sbb dh, cl
xor al, 0x1d
and eax, 0xcfbd56f7
inc edi
push esp
mov edx, 0x9df1b2c1
adc dword [esi], esp
or eax, 0x859fc039
shl dword [eax + ebx*8 + 0x38], 0x82
add cl, 0xaa
ror dword ss:[ebp + ecx*4 - 0xb], 1
cmpsb byte [esi], byte es:[edi]
wait
jecxz 0x414a99
retf 0x3f78
invalid
lahf
mov bh, 0x1c
jge 0x414ad5
and al, 0x66
sub ecx, esi
ret 0xe50d
fmul qword [ebp + 0x45421882]
mov byte [ebx], cl
dec ecx
fcmove st(0), st(6)

Function at 0x414b38
Capabilities:
Encode data using xor

Disassembly:
shr byte [eax], cl
jns 0x414ba7
sub dword [ebx], edx
js 0x414b34
or al, 0x96
lea edi, [edx - 0x66]
invalid
dec edi
inc esp
invalid

Function at 0x415790
Capabilities:
Encode data using xor

Disassembly:
and byte [esp + ebx*2 - 0x1a394ceb], bl
mov word [ebp + 0xe7559c2], ds
push es
sub al, 0x95
sbb eax, 0x491ca823
dec dword [eax - 0x2a6699ed]
pop ecx
xchg ebp, eax
sbb dword [edx + ecx*4 + 0x5e], ebx
aam 0x24
test eax, 0x1d9f7819
clc
pop eax
in al, 0xc3
add dword [eax + 0x58e5ee6c], eax
mov ebp, 0xf78a5f95
mov ebx, 0x747d2dd6
jl 0x415823
lcall 0xb521, 0xd2137299
ljmp 0x375e
mov ah, 0x58
outsd dx, dword [esi]
adc eax, 0x93404556
salc
dec esi
jns 0x41584b
mov al, byte [0x9987efad]
ret
imul eax, dword [edx - 0x5d356137], 0x9da2c258
mov byte [ebp - 0x32], dh
sal byte [ecx + edx], cl
mov eax, dword [0xe80b54fa]
invalid
Function at 0x421ea8
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xd9a02380], al
jo 0x421dca
jmp [edi - 0x664f6bd]
scasd eax, dword es:[edi]
inc ebx
or dword [ebx - 0x48711407], ebx
lea eax, [eax - 0x2e]
jnp 0x421e3c
fsubr dword [esi + 0x6ddc3269]
mov edx, 0xf68c189f
xchg byte [edx - 0x59b3cf84], dh
xor edi, dword [edi - 0x58]
and eax, edx
std
outsd dx, dword [esi]
cmp ebx, dword [edx]
inc edi
loopne 0x421dc4
or edi, eax
js 0x421e8a
mov dl, 0x60
jnp 0x421e35
pop edi
mov eax, dword [0xdc5c0523]
jl 0x421dee
cmp al, 0x1d
std
stosd dword es:[edi], eax
sbb ecx, dword [ecx + 0x46]
js 0x421dfe
in eax, dx
sub byte [edx + ecx - 0x16], dl
push esp
or ch, dl
and al, 0x71
inc esi
push ebp
stosb byte es:[edi], al
sti
ja 0x421eac
out 0xb9, eax
inc ebx
fdiv qword [esi - 0xfd73214]
mov ebp, 0xf75e0b76
adc al, 0xa6
test eax, 0x848cb8c3
invalid
test byte [ebx - 8], cl
mov fs, word [ecx]
sub dword [esi], 0xab1e3075
inc eax
stc
push eax
salc
push edx
enter 0xffffffffffffc0df, 0x1f
scasd eax, dword es:[edi]
leave
xor bh, byte [ebx - 0x1173ccd4]
loopne 0x421eb4
cmp ebp, 0xd8ec29b3
jae 0x421ecd
fdiv dword [ebx - 3]
adc byte [ebp + 0x3a4ae714], al
call 0x88906ac9
mov dword [0x5a2c95a1], eax
mov eax, dword [0x335a2c95]
push es
into
test byte [esi + 0x32], ch
loope 0x421e89
test eax, 0x7836f6ef
arpl word [ecx + 0x491dd217], sp
insb byte es:[edi], dx
stosb byte es:[edi], al
add byte [ebx - 0x22a7965a], ah
pop ebp
inc eax
test edx, ebp
mov ebp, 0x2d283adf
adc bl, ch
invalid

Function at 0x4220b4
Capabilities:
Encode data using xor

Disassembly:
jno 0x42201e
dec ebp
xchg ecx, eax
adc dh, dl
nop
sbb eax, 0x4eea162a
mov dword [ebx - 0x50], 0xcd0ecdf0
xchg esp, eax
in eax, 0x1d
xor ebx, ecx
call 0xe44f80cb
jno 0x42201c
mov byte fs:[ecx], dh
pop ebp
jb 0x4220f3
xchg ebp, eax
aam 0xd9
out 0xba, eax
sahf
fcmovbe st(0), st(2)
inc ebp
fcom dword [ebx]
inc esp
sbb al, 0x74
popfd
mov ebx, 0xe9f74ad8
inc ecx
scasd eax, dword es:[edi]
xlatb
xor esp, esp
mov byte [0x4a707ed], al
add dword [ecx], eax
dec edx
inc eax
rol dword [ebx + 0x73e0b518], cl
fcmovnu st(0), st(1)
in eax, 0xe6
out 0x31, al
fisttp word [edx + 0x4f4fe752]
pop esp
nop dword [eax]
arpl word [ecx + 0x28], si
adc cl, byte [edx]
shr byte [eax - 8], 1
xor ah, byte [0xa749ef08]
jae 0x42209d
fild qword [esi - 0x5720d63a]
bound ebx, qword [edi + 0x70c21c9a]
xor ebp, ebx
sub cl, byte [eax - 0x35deb9ee]
pop esi
wait
jp 0x4220e5
mov ebp, 0x4f7332b6
out dx, al
fistp dword [0xa49a8b54]
movsb byte es:[edi], byte [esi]
and byte [edx + 0xbb3b000], cl
pushfd
mov bl, 0xce
movsb byte es:[edi], byte [esi]
xchg esi, eax
mul byte [eax + 0x5944ca83]
ja 0x42212e
dec edx
scasb al, byte es:[edi]
xor byte [edx], dl
js 0x422091
sal dword [ecx], 1
mov cl, 0x12
mov ecx, 0xd2859638
add edx, dword [ecx]
adc al, 0xe5
fisttp dword [ebx + 0x1297ede3]
cmc
retf
xchg esp, eax
cld
and al, 0xe7
ljmp 0xd47b
Function at 0x4224dc
Capabilities:
Encode data using xor

Disassembly:
cmc
repe scasd eax, dword es:[edi]
not dword [edx - 0x79582b08]
std
ja 0xfd57547c
in al, dx
adc dword [ecx - 0x48], esp
sub eax, 0xffaedde2
call dword [edx]
dec edi
popal
call dword [edx]
dec edi
popal
xchg esp, eax
xchg ebp, eax
pop ds
mov cl, 0x78
xor eax, 0x82aa94b3
mov ecx, 0x7bab51e5
push esi
adc eax, 0x16c2ee2c
lodsb al, byte [esi]
call dword [edx - 0x19]
pop ds
out dx, al
cmc
sbb eax, 0xb55fe37
fidivr word [ebx + eax*2]
adc al, byte [ecx + ebp*4 + 0x21593a53]
jns 0x422458
rcl dword [edi - 0x6472c961], cl
sbb edi, dword [esi + 0x5c]
sbb byte [ebp + 0x226caa0e], 0x5f
pop edi
mov dl, byte [edi + 0x1c35fa32]
imul edi, dword [eax + 0x7dcd7772], 0x56bc2904
das
cli
xor eax, 0x72b8691c
ja 0x4224b5
jge 0x4224ee
sub dword [esi + edx*2 - 0x6fe4dbd1], edi
and al, 0x1b
nop
jp 0x4224e0
salc
pop esi
inc edx
or al, 0xdc
push esp
or ah, dl
jl 0x422487
sbb al, 0xa9
dec edx
mov byte [0x66d99648], al
mov edi, 0x1b2b46d0
push eax
sbb eax, 0xdc9f20db
inc ebp
pop ecx
jnp 0x42255e
invalid
popfd
pushal

Function at 0x4230dc
Capabilities:
Encode data using xor

Disassembly:
shr dword [ebx + 0x1c21fc74], cl
lodsd eax, dword [esi]
invalid
je 0x4230da
and dword [ebp*4 + 0x3279e6df], ebx
mov esp, 0x2468c02
cmp edi, esi
mov byte [esi - 0x2e239316], dh
sub dword [esi + 0x7e9b0335], esp
leave
out 0x79, al
xor bh, byte [edx + eax + 0x3b02468c]
dec byte [eax - 0x2393154a]
shr dword [ecx], 1
cmpsb byte [esi], byte es:[edi]
xor eax, 0xc97e9b03
fld dword [ecx]
xchg esp, eax
xchg ebx, eax
loop 0x4230e2
invalid
Function at 0x42b670
Capabilities:
Encode data using xor

Disassembly:
pop ecx
mov ebp, 0x1286e17d
popal
mov ah, 0x67
dec edi
dec edi
sbb bh, byte [edx + 0xa]
lds eax, [edx]
cmp ah, byte [eax]
jl 0x42b5de
and dl, byte [edx + 0x27]
or al, 0x10
invalid
cli
lea eax, [edx + 0x31]
xor dword [ecx - 0x6d], esi
xor dword [ecx - 0x6d], esi
add al, byte [ebx]
loopne 0x42b64b
xor eax, 0xb94628f3
xchg ecx, eax
salc
mov ecx, 0xc153d691
xor eax, 0xaeee7fb9
mov bl, 0xb8
jge 0x42b63d
push ebx
sal dword [0xaeee7fb9], 0xb3
mov eax, 0xf12ee47d
int1
push ecx
sal byte [ebx], 0xc7
jle 0x42b690
dec edx
leave
push edi
push cs
and byte [ebx + 0x53d04cab], ah
adc byte [ecx + 0x78b4a03f], 0xd2
mov ah, 0x78
rcr al, cl
and edi, dword [edi - 0x29]
fist dword [esi - 0x13]
and al, byte [edx + 0xe]
je 0x42b67d
pop ss
rcl dword [ecx + 0xd20bf2c], cl
pop esi
sub dword [ecx - 0x18], eax
js 0x42b69d
cdq
lahf
invalid
push dword [0x94bacdcf]
xor eax, 0x94bacdcf
mov eax, dword [0x961ab253]
sub al, 0xb4
pop ebp
inc ebp
dec esp
xchg ecx, eax
sar byte [esi], 1
clc
js 0x42b6ce
stc
pop es
loop 0x42b68f
and ah, byte [ebp + esi*4 - 0xdcefe29]
add dword [esi - 0x3df07f4a], ebp
cwde
scasb al, byte es:[edi]
loope 0x42b70b
stc
xor ch, byte [ebp - 0x74e6fa62]
add dh, bl
scasb al, byte es:[edi]
jp 0x42b67d
rol byte [eax + 0x29], 5
mov dword [0xc348baf9], eax
les ebx, [edx]
wait
pop edx
sub dword [edx + 0x15], eax
int1
aas
imul esp, dword [edx], 0x6a
sbb dword [edi], esi
js 0x42b747
ret
add al, dh
push esi
invalid
rol byte [edx], 0x73
push ebx
outsb dx, byte [esi]
js 0x42b72f
cdq
out 0x36, al
lds eax, [esi + 0x60]
arpl word [esi - 0x634fcfe5], bx
mov al, 0x9c
pop ss
add esp, dword [edx - 0x2a]
fidiv dword [eax]
xor dl, byte [ecx - 0x61e397dd]
lodsd eax, dword [esi]
and al, 0xec
sbb byte [esi - 0x32f0fa59], ah
sbb al, 0x1e
cmpsd dword [esi], dword es:[edi]
add eax, 0x1e1ccd0f
inc ebx
jle 0x42b71c
or al, 0x30
sub ebp, edi
mov edx, dword ss:[eax]
pushal
sbb cl, 0xfd
xor al, 0xd6
psubb mm2, qword [ecx - 0x59d83a57]
or eax, 0x63723fa7
xchg ecx, eax
test eax, 0xda627c5
cmpsd dword [esi], dword es:[edi]
aas
jb 0x42b7b4
sbb al, 0x45
outsd dx, dword [esi]
sub dword [ecx], 0xffffffac
xchg edi, eax
fistp word [eax]
push es
inc esi
adc eax, 0xb36b663b
in eax, 0xde
fld dword [eax - 0x2e]
push 0x13922351
dec edi
iretd
pop ss
movsb byte es:[edi], byte [esi]
cld
pop ebp
rcr byte [eax - 0x64c55e86], 0xb8
mov bl, 0x6f
sub byte [ebx], al
cmp byte [edi + 0x68], al
sub byte [edi + ebx*4], 0x93
loop 0x42b83c
into
inc esi
and dword [esi], ebx
ret 0xaeeb
fcmovbe st(0), st(3)
push edx
mov dword [0xdb7eac42], eax
fadd dword [ebx]
scasb al, byte es:[edi]
dec eax
add eax, dword [eax]
add dword [0x11427d7f], eax
lahf
std
out dx, al
sbb al, 0xed
lcall 0xb2e6, 0xe6894a6e
mov eax, 0x986e309a
inc ebx
leave
sub byte [ebp - 0x3565a120], dl
mov cl, 0x22
push esp
in eax, 0xe8
or al, 0x6d
sub esi, dword [ebx - 0x7b]
jmp 0x1a09ff24
Function at 0x74dcb0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
jb 0x74dcc9
jae 0x74dcc9
call 0x86712258
sal byte [ecx + edx - 0x7f], 0x7c
and al, 4
jbe 0x74dcd9
mov eax, dword [ebp - 4]
test eax, eax
je 0x74dce1
cmp dword [esp + 4], 0x1770376
ja 0x74dcd9
mov eax, 0xf
mov esp, ebp
pop ebp
ret
sldt word [eax]
add byte [ebx + 0x76c35de5], cl
add esi, dword [edi + 1]
jbe 0x74dce6
ja 0x74dce6
call 0xd528ea75
jae 0x74dcec
mov ecx, dword [0x73d4b4]
mov eax, 0x11
add ecx, eax
mov dword [0x73d4b4], ecx
jle 0x74dcfe
jg 0x74dcfe
call 0xd52ce22b
jae 0x74dd04
sub dword [0x73d4b8], eax
cmp dword [esp + 4], 0x1730372
mov eax, 0x14
mov esp, ebp
pop ebp
ret