joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aa17
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xc4c785db
fmul qword [ebp - 0x7c]
cmp byte [eax - 0x4c], dl
invalid
cmc
retf
mov ah, 0x8c
cmpsb byte [esi], byte es:[edi]
xor ecx, eax
in al, dx
jne 0x40aa13
mov dword [edx + 0x2072fa27], ebp
lcall 0x3ea9, 0x2b79b4c4
test eax, 0x9c23bab4
outsb dx, byte [esi]
jo 0x40aa28
mov ah, 0x79
sub ebp, dword [ecx - 0x454b56c2]
and ebx, dword [esi + ebp*2 - 0x6f850c90]
jp 0x40a9c7
aaa
ljmp 0xaa14

Function at 0x44a42d
Capabilities:
Encode data using xor

Disassembly:
lea eax, [ebx + 8]
push eax
mov ecx, edi
mov dword [ebp - 8], ebx
call fcn.004495db
mov esi, eax
lea eax, [ebx + 0x18]
push eax
mov ecx, edi
call fcn.004495db
mov ecx, dword [ebx]
cmp ecx, 0x28
ja case.default.0x449df8
jmp dword [ecx*4 + 0x408969]
dec dword [ebx - 0x3c7c07a3]
sub bh, bh
dec ebp
cld
mov ebx, dword [ebp - 8]
add ebx, 0x28
dec dword [ebp - 4]
jmp 0x449dd2
test byte [eax], al
fiadd word [eax + eax*2 + 0x40850d00]
add byte [esi], dl
test dword [eax], eax
cmp al, byte [ebp - 0x7b17ffc0]
inc eax
add byte [ebp + eax*4 + 0x40], bl
add byte [ebp - 0x56ffbf7b], al
test dword [eax], eax
mov byte [ebp - 0x7a19ffc0], 0x40
inc eax
add al, ch
test byte [eax], al
pop esp
test dword [eax], eax
test dword [ebp - 0x7a56ffc0], eax
inc eax
add dh, al
test dword [eax], eax
out 0x85, al
inc eax
add dl, dh
test dword [eax], eax
sti
test dword [eax], eax
add al, 0x86
inc eax
add byte [0x13004086], cl
xchg byte [eax], al
and al, byte [esi - 0x79c4ffc0]
inc eax
add byte [esi + eax*4 + 0x40], dl
add byte [ebx], cl
mov dword [eax], eax
js 0x44a36d
inc eax
add byte [ecx - 0x23ffbf7a], dl
xchg byte [eax], al
adc al, byte [edi - 0x78ceffc0]
inc eax
add byte [ebp - 0x79], dl
inc eax
add byte [ecx - 0x50ffbf79], cl
xchg dword [eax], eax
mov ebx, 0xda004087
xchg dword [eax], eax
loop 0x44a396
inc eax
add ch, ch
xchg dword [eax], eax
push ds
mov byte [eax], al
inc ecx
mov byte [eax], al
jo 0x44a3a7
inc eax
add dh, cl
mov byte [eax], al
dec esi
mov dword [eax], eax
inc esp
mov dword [eax], eax
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
and dword [ebx + 4], 0
and dword [ebx], 0
mov eax, 0x8000
push edi
cmp esi, eax
jae 0x44a44a
mov eax, esi
mov edi, dword [ebp + 8]
push eax
push edi
push dword [ebx + 8]
call fcn.0044beed
xor ecx, ecx
xor al, al
inc ecx
mov byte [ebp + 0xb], al
cmp esi, ecx
jbe 0x44a46e
xor al, byte [ecx + edi]
inc ecx
cmp ecx, esi
jb 0x44a463
mov byte [ebp + 0xb], al
push 8
mov ecx, ebx
call fcn.0044842e
mov esi, dword [ebp + 0x10]
mov al, byte [ebp + 0xb]
and dword [esi + 0x10], 0
cmp al, byte [edi]
jne 0x44a656
push dword [ebp + 0xc]
mov ecx, ebx
push edi
call fcn.004496c6
mov edi, eax
test edi, edi
je 0x44a4d2
push 1
mov ecx, esi
call fcn.004497b0
mov eax, dword [esi + 0x10]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
and dword [ebp + 0xc], 0
mov dword [esi + 0x10], ecx
lea ecx, [eax + 0xc]
mov dword [ecx], edi
invalid
Function at 0x44b68b
Capabilities:
Encode data using xor

Disassembly:
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x41dfe0]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x41dfe0]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x41dfe0]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x41dfe0]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
inc ebp
invalid
lea eax, [ebp - 0x24]
pop edi
inc ebp
fmul dword [ebp + 0x335fdc45]
test byte [edx + 0x30fc305c], 0x1c
xor byte [esi + 0x3b], al
bnd jl 0x44b693
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x44b693
add eax, edx
dec edi
jne 0x44b691
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x44b6e7
cmp ebx, edx
jge 0x44b6d0
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x44b6d2
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x44b6b4
cmp ecx, edx
jne 0x44b6d9
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x44b6a6
cmp dword [ebp + 8], 0xa
jle 0x44b64c
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x486661
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x486675
shr eax, 1
xor eax, 0xedb88320
jmp 0x486677
shr eax, 1
dec edx
jne 0x486668
mov dword [ecx*4 + 0x4161c0], eax
mov dword [ecx*4 + 0x4181c0], eax
inc ecx
cmp ecx, 0x100
jb 0x486663
push ebx
push esi
push edi
mov ecx, 0x4165c0
mov edi, 0x101
mov eax, dword [ecx - 0x400]
push 7
mov edx, ecx
pop esi
movzx ebx, al
shr eax, 8
xor eax, dword [ebx*4 + 0x4161c0]
mov dword [edx], eax
add edx, 0x400
dec esi
jne 0x4866a9
add ecx, 4
dec edi
jne 0x48669e
pop edi
pop esi
pop ebx
ret

Function at 0x4866cb
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4181c4], 0
jne 0x4866d9
call fcn.00486661
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x486706
test cl, 7
je 0x486706
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
jmp 0x4866e7
cmp esi, 8
jb 0x486799
mov edi, esi
shr edi, 3
push ebx
xor eax, dword [ecx]
sub esi, 8
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4171c0]
xor edx, dword [ebx*4 + 0x4175c0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4179c0]
movzx ebx, byte [ecx + 6]
xor edx, dword [ebx*4 + 0x4165c0]
movzx ebx, byte [ecx + 5]
xor edx, dword [ebx*4 + 0x4169c0]
movzx ebx, byte [ecx + 4]
xor edx, dword [ebx*4 + 0x416dc0]
movzx ebx, byte [ecx + 7]
xor edx, dword [ebx*4 + 0x4161c0]
movzx eax, al
xor edx, dword [eax*4 + 0x417dc0]
add ecx, 8
dec edi
mov eax, edx
jne 0x486715
pop ebx
jmp 0x486799
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
test esi, esi
ja 0x486785
pop edi
pop esi
ret 0xc
Function at 0x48dcdd
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
test eax, 0xd9f7c4b3
cmpsb byte [esi], byte es:[edi]
sub al, 0xfc
ficom dword [ebx]
mov ebx, 0x1ed417ba
push ds
push ds
and esi, dword [eax - 0x736659b7]
push cs
push ss
pop ebp
lea ecx, [edx]
imul ebp, dword [edi + 0x75], 0x53
push eax
add cl, byte [edx]
out dx, eax
add dl, byte [ebx - 0x47f3c0c2]
sal dword [edx + esi*8 - 0x32668a66], 0x3a
fisttp qword [edx]
je 0x48dca0
jb 0x48dce5
movsd dword es:[edi], dword [esi]
cmp al, 0x55
repne stosb byte es:[edi], al
stosb byte es:[edi], al
scasb al, byte es:[edi]
dec edx
or esi, eax
sbb byte [0x8259dc12], 0xce
sbb eax, 0x8259dc12
fcomp qword [ecx - 0x7e]
into
ja 0x48dce7
popfd
or cl, byte [ebx + 0x1c06f0b3]
fimul dword [edx + 0x22439223]
sal dl, cl
pop esp
sbb edi, dword [edx - 0x6cf50de2]
jp fcn.0048dd0f
pop ecx
mov bh, 0xcd
loop 0x48dcc4
inc eax
cli
jl 0x48dca7
fiadd word [edi + 0x3753bc6]

Function at 0x4cee96
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x41aec0]
xor dl, byte [eax + ebx*4 + 0x41b6c0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x41bac0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x41b2c0]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x4cee46
inc eax
cmp eax, edi
jl 0x4cee39
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.004cf61d
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x4cee37
pop edi
pop esi
pop ebx
leave
ret

Function at 0x509841
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x509855
shr eax, 1
xor eax, 0xedb88320
jmp 0x509857
shr eax, 1
dec edx
jne 0x509848
mov dword [ecx*4 + 0x4161c0], eax
mov dword [ecx*4 + 0x4181c0], eax
inc ecx
cmp ecx, 0x100
jb 0x509843
push ebx
push esi
push edi
mov ecx, 0x4165c0
mov edi, 0x101
mov eax, dword [ecx - 0x400]
push 7
mov edx, ecx
pop esi
movzx ebx, al
shr eax, 8
xor eax, dword [ebx*4 + 0x4161c0]
mov dword [edx], eax
add edx, 0x400
dec esi
jne 0x509889
add ecx, 4
dec edi
jne 0x50987e
pop edi
pop esi
pop ebx
ret
Function at 0x5098ab
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4181c4], 0
jne 0x5098b9
call fcn.00509841
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x5098e6
test cl, 7
je 0x5098e6
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
jmp 0x5098c7
cmp esi, 8
jb 0x509979
mov edi, esi
shr edi, 3
push ebx
xor eax, dword [ecx]
sub esi, 8
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4171c0]
xor edx, dword [ebx*4 + 0x4175c0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4179c0]
movzx ebx, byte [ecx + 6]
xor edx, dword [ebx*4 + 0x4165c0]
movzx ebx, byte [ecx + 5]
xor edx, dword [ebx*4 + 0x4169c0]
movzx ebx, byte [ecx + 4]
xor edx, dword [ebx*4 + 0x416dc0]
movzx ebx, byte [ecx + 7]
xor edx, dword [ebx*4 + 0x4161c0]
movzx eax, al
xor edx, dword [eax*4 + 0x417dc0]
add ecx, 8
dec edi
mov eax, edx
jne 0x5098f5
pop ebx
jmp 0x509979
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
test esi, esi
ja 0x509965
pop edi
pop esi
ret 0xc

Function at 0x5478ef
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x54
jae 0x547869
js 0x54782c
push dword [edx]
lodsd eax, dword [esi]
scasb al, byte es:[edi]
invalid
push edx
and cl, al
sar dword [ecx], 1
inc edx
xchg edi, eax
xchg dword [ebp + 0x51b6e702], eax
enter 0xef8, 0xffffffffffffff85
and eax, dword [edi - 0x38]
xchg edi, eax
cld
repne outsd dx, dword [esi]
cmc
in al, dx
push eax
push 0x9a57e77e
pop edi
inc edx
invalid
mov ebp, 0x89c419c0
cmpsd dword [si], dword es:[di]
mov esp, 0x6cbe14ba
xchg edx, eax
fsubr qword [ecx + 0x74]
cmp al, cl
mov dword [edx + 0x5e], 0x15cda708
cmp esp, dword [eax]
pop esi
or byte [edi + 0x203b15cd], ah
loope 0x547843
loop 0x5478a8
imul edx, dword [eax - 0x5b], 0x24
sti
ja 0x5478a1
in al, dx
mov ah, 0x43
hlt
jns 0x547903
sub edi, eax
push 0xeed407e5
invalid
stosb byte es:[edi], al
in al, dx
loop 0x5478c6
out dx, al
ja 0x547894
pop ebx
adc ch, byte [edx + 0x2e]
xchg ebx, eax
sub eax, 0x69bbea2b
je 0x54796b
mov cl, 0x81
daa
mov esi, dword [ebx + 0x52]
xor eax, 0xfd2bc74f
jbe 0x547925
mov eax, 0xcd4f1b76
invalid
je 0x547967
sbb edx, dword [edx + 0x3e1e2c51]
adc eax, 0x16c4ba5e
add al, byte [ebx - 0x2bd96adf]
clc
xchg edx, eax
xor eax, 0xb4476517
sub byte [0xbc048421], 0x34
imul ecx, dword [edi - 0x28], 0x2da78587
pop ss
inc edi
mov ah, 0x82
sub eax, 0xbc048421
xor al, 0x69
dec edi
fadd dword [edi + 0x172da785]
int 0xce
pop esi
in eax, 0x8d
mov cl, bh
mov dl, 0xdd
neg byte [eax]
xchg dword [eax + 0x54d9fef2], ebp
mov dl, 0x47
inc edi
das
mov ebp, edx
jno 0x54799d
push 0x457714b4
mov ah, 0x14
ja 0x5479b0
pop esp
pushal
mov byte [0x8cca8505], al
inc ebp
cmp eax, 0x843766d6
sbb cl, byte [ebp + 0x62]
jo 0x5479eb
bound ecx, qword [ebx + 0x7867d438]
pop esp
dec ecx
sub al, 4
aas
pop ebx
cmp dword [eax - 7], ecx
mov edx, 0xe3efecec
xchg esp, eax
in al, 0xd
invalid
sbb byte [ebx - 0x107caf42], cl
jns 0x54793c
stosb byte es:[edi], al
stosb byte es:[edi], al
hlt
sub ch, byte [ecx - 0x1939fdb]
Function at 0x54b421
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x54b435
shr eax, 1
xor eax, 0xedb88320
jmp 0x54b437
shr eax, 1
dec edx
jne 0x54b428
mov dword [ecx*4 + 0x4161c0], eax
mov dword [ecx*4 + 0x4181c0], eax
inc ecx
cmp ecx, 0x100
jb 0x54b423
push ebx
push esi
push edi
mov ecx, 0x4165c0
mov edi, 0x101
mov eax, dword [ecx - 0x400]
push 7
mov edx, ecx
pop esi
movzx ebx, al
shr eax, 8
xor eax, dword [ebx*4 + 0x4161c0]
mov dword [edx], eax
add edx, 0x400
dec esi
jne 0x54b469
add ecx, 4
dec edi
jne 0x54b45e
pop edi
pop esi
pop ebx
ret

Function at 0x54b48b
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4181c4], 0
jne 0x54b499
call fcn.0054b421
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x54b4c6
test cl, 7
je 0x54b4c6
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
jmp 0x54b4a7
cmp esi, 8
jb 0x54b559
mov edi, esi
shr edi, 3
push ebx
xor eax, dword [ecx]
sub esi, 8
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4171c0]
xor edx, dword [ebx*4 + 0x4175c0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4179c0]
movzx ebx, byte [ecx + 6]
xor edx, dword [ebx*4 + 0x4165c0]
movzx ebx, byte [ecx + 5]
xor edx, dword [ebx*4 + 0x4169c0]
movzx ebx, byte [ecx + 4]
xor edx, dword [ebx*4 + 0x416dc0]
movzx ebx, byte [ecx + 7]
xor edx, dword [ebx*4 + 0x4161c0]
movzx eax, al
xor edx, dword [eax*4 + 0x417dc0]
add ecx, 8
dec edi
mov eax, edx
jne 0x54b4d5
pop ebx
jmp 0x54b559
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
test esi, esi
ja 0x54b545
pop edi
pop esi
ret 0xc
Function at 0x554e7c
Capabilities:
Encode data using xor

Disassembly:
pop eax
out 0x22, al
mov bl, 0xbd
inc ecx
lcall 0xaadd, 0xfd6706f
mov esi, dword [ecx - 0x1831a6e9]
adc al, 0xea
invalid
push ss
mov cl, 0xe2
jecxz 0x554ec8
mov edx, 0xec32d4cb
enter 0x5609, 0x16
lss esi, [edx]
cli
jecxz 0x554e1b
fld qword [esi + eax*4 + 0x7b]
mov eax, 0x7ec1143a
loop 0x554ec0
mov byte [0xbf4e90c0], al
push ds
push ebx
out 0xa3, al
invalid
daa
cmpsb byte [esi], byte es:[edi]
mov edi, 0xcda73c91
ret
sub cl, byte [edi]
inc esp
je 0x554eef
out dx, eax
mov eax, 0xe68b23f3
xchg dword [edx + 0x34236933], edi
arpl word [ecx - 0x47], sp
inc edi
outsd dx, dword [esi]
dec ebx
mov byte [0xaf7f2d79], al
push 0x7f
jg 0x554f08
lodsd eax, dword [esi]
ret 0xc2f
sbb al, 0xcd
rsqrtps xmm2, xmmword [ecx]
invalid
imul ecx, edx, 0x1a
cmp ah, byte gs:[edx - 0x5e]
mov ss, esi
push ss
mov ecx, 0xcd829dc5
arpl ax, cx
pop esp
inc esi
dec edi
lcall 0xeffa, 0x921f781f
add bl, byte [edx - 0x5d67a17d]
adc ebx, esi
pop es
or al, 0x4d
pop es
ror byte [edx], 0x77
or eax, 0x23935a86
adc ecx, 0x3f
inc esi
shl dword [0x91cbdb24], 0x35
lodsb al, byte [esi]
xchg dword [edx], eax
xchg edx, esi
sbb dword [edx + 0x2cc385d8], esi
invalid

Function at 0x557eac
Capabilities:
Encode data using xor

Disassembly:
invalid
mov byte [0x18617d2], al
jno 0x557e76
pop es
xchg ebp, eax
sub esi, esp
cmpsb byte [esi], byte es:[edi]
xchg dword [ebx - 0x42], eax
pop ebp
movsd dword es:[edi], dword [esi]
jno 0x557f28
push esp
sbb al, 0xdb
mov bl, 0x98
test dword [edi - 0x3c15515a], ebx
inc esp
mov dword [0x56c9ecf8], eax
dec ebp
jg 0x557f00
test byte [esi], 0x12
mov dh, 0x33
cmp al, 0x59
jmp 0x557eea
xor eax, 0xeef6c9e4
loope 0x557f4f
pop es
retf
or eax, ebx
push edi
xchg edx, eax
xchg ebp, eax
rol edi, 1
mov bl, 0x88
fsub st(4), st(0)
push ss
push ss
push edx
xor al, 0x5a
sar byte [edx], cl
loop 0x557f6f
in al, dx
sbb eax, 0x1a5fdcdd
add edi, dword [eax - 0x35ae34e4]
add eax, 0x8f170759
retf
push 0xd653ac2f
fidiv dword [esi - 0xb]
push ebp
or al, 0x5d
cdq
xor eax, 0x9dcc9aa0
push ebx
jecxz 0x557f71
into
and dh, byte [ebp - 0x4e]
inc ebx
loope 0x557f99
mov edi, 0xa9fb8450
push esp
mov cl, 0x35
rcr dword [esi], 1
salc
inc ebp
xchg ebx, eax
ljmp 0x6f7a
outsd dx, dword [esi]
jle 0x557fda
das
lodsd eax, dword [esi]
dec edi
push ecx
dec edx
dec esp
std
cwde
sub dword [edx - 0x33e8103a], 0xff4bc812
sbb dl, byte gs:[0x93a33e16]
sbb dl, byte [0x93a33e16]
push ss
mov dword ds:[0x342c4993], eax
dec ecx
sub al, 0x34
out dx, al
pushfd
or dword [eax + ebp*4 - 0x3f], 0x6558a18c
aaa
rcl eax, cl
aam 0x24
test eax, 0x33bb2172
push esi
dec ebx
xor edx, dword [esi + 0x4b]
pop edi
invalid
les esi, [eax + eax*2]
shl byte [eax + 0x5b], 0x83
insd dword es:[edi], dx
jno 0x557f8c
cwde
jge 0x557f58
add al, 0x34
das
lds ecx, [ecx + 0x25]
invalid
mul esp
dec ebp
mov ds, word [eax - 0x14bfd864]
mov edx, gs
sub byte [esi + 0x3f], dh
adc byte [eax], bh
mov ah, 0x23
dec ebx
hlt
Function at 0x559824
Capabilities:
Encode data using xor

Disassembly:
xor al, 0xc4
pop ds
arpl word [ebp - 0x4e], si
xor byte [ecx + ebp + 0x4c172cd4], dh
sub al, 0x17
dec esp
lock xor esi, dword [ebx + ebp*8]
fldpi
xlatb
leave
aad 0xb7
mov ss, edx
xor al, byte [ebx]
mov dh, 0xa6
jns 0x5597c4
pop edx
popal
movsd dword es:[edi], dword [esi]
push edx
and byte [ecx + 0x39], al
xor ebp, esp
aaa
sbb al, dl
xor dl, 0xcb
xor esi, esi
jnp 0x5597ac
je 0x559812
adc al, 0xf0
adc al, 0x87
push ebx
shr byte [eax - 0x53fcddd8], cl
movsd dword es:[edi], dword [esi]
loop 0x559829
push edx
lodsd eax, dword [esi]
sbb eax, dword [edx]
fisub word [edx]
fbstp tbyte [edx]
xor byte [0xdf16d258], 0x4b
pop ds
fbld tbyte [esi - 0x7fac8d09]
sub bl, byte [eax - 0x5e]
jmp dword [edx - 0x6c]
test eax, 0xe61d937e
jecxz 0x5597c4
xchg ebx, eax
sbb eax, 0x3aade3e6
test eax, 0x77b2a603
cmp ch, byte [ecx + 0x77b2a603]
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
jbe 0x5597a2
lodsd eax, dword [esi]
adc byte [ebp + 0x68], 0xbe
push 0x7a2abbbe
adc ah, byte [edi]
push 0x7a2abbbe
adc ah, byte [edi]
jg 0x5597d9
mov dl, 0x20
loop 0x559810
wait
cmp dword [edx], ebx
salc
invalid

Function at 0x59979b
Capabilities:
Encode data using xor

Disassembly:
jne 0x599817
inc edx
sub eax, 0x13a7526f
mov eax, 0x3de568d7
push 0xdbbc2a08
sub ah, bh
out 0x41, eax
inc esi
lodsb al, byte [esi]
leave
dec esp
sub byte [ebp - 0x567f6f1], dl
sbb byte [edx - 0x48], 0xdb
mov eax, dword [0xa5cf360d]
cmp dword [ecx - 0x45], edi
xor dword [edx - 0x10ee68e4], ecx
salc
pop edx
pop ds
inc edi
sbb dword [ebx], esp
fdiv dword [ebx + 0x1cb3cb85]
mov edx, 0x81b3252b
pop edi
jnp 0x59979e
inc ebx
mov edx, 0xa63cfa5c
mov ah, 0xdd
enter 0xffffffffffffec7b, 0xffffffffffffffb9
js 0x59984a
cdq
xchg edi, eax
into
mov byte [0xb34dfec2], al
sti
sbb ch, byte [eax]
xlatb
in eax, dx
sbb al, 0xa9
cmpsb byte [esi], byte es:[edi]
wait
push edx
stc
mov edx, dword [edx - 0x35f6dade]
pushal
enter 0xffffffffffffbb90, 0xffffffffffffff9b
dec esp
dec ebx
sub bl, cl
test byte [ecx], cl
call 0x655d9695
adc dword [edi + 0x7b], edx
adc dword gs:[edi + 0x7b], edx
adc edi, esp
js 0x599830
mov edx, cs
push edx
hlt
jle 0x599833
enter 0x2e2c, 0xffffffffffffffb0
salc
sub al, 0x2e
mov al, 0xd6
int3
sub al, byte [ecx + 0x11f9f032]
pop edi
ret

Function at 0x5cbb41
Capabilities:
Encode data using xor

Disassembly:
test al, 0xb9
sbb ch, dh
cmpsd dword [esi], dword es:[edi]
push edx
adc bh, byte [edx + 0x36]
or eax, eax
xchg dword [esi - 0x18d33eef], ebx
xor esi, dword [0x48c0df68]
test eax, 0xab7d5abe
jp 0x5cbb47
or byte [ecx - 0x58], bl
adc al, 0x51
leave
jnp 0x5cbb8d
stosd dword es:[edi], eax
sub edi, 0xffcbe7fb
push 0x78
imul ecx, ecx, 0xffffffdb
cdq
aad 0xeb
js 0x5cbb3c
int3
enter 0x4ebf, 0x3c
scasd eax, dword es:[edi]
sub eax, dword [esi]
lodsb al, byte [esi]
pop ss
ret 0x2c87
Function at 0x5cdb50
Capabilities:
Access the windows event log

Disassembly:
add ebx, 0x40609992
xor ebx, 0xaf293cce
sub eax, ebx
pop ebx
push edi
mov edi, 0x34220ff6
add edi, 0xe83289ab
sub edi, 0xc5af5af
sub eax, edi
pop edi
push ebx
mov ebx, 0x76ec6187
jmp 0x5cd9ad
add ebx, 0x8acb9c0e
add ebx, 0x7405b3c1
sub ebx, 0x88f1e41e
xor ebx, 0x6c86c85d
push edx
mov edx, 0x5c92a692
jmp 0x5d342c
add edx, 0x56ecee8a
push ecx
mov ecx, 0xcfc6a6fa
xor ecx, 0x92b6ad58
sub ecx, 0x4c7bb578
add ecx, 0xe1feb79f
add edx, ecx
pop ecx
jmp 0x5cda9e
push edi
mov edi, 0x1f81d8
add edi, 0xb9fcbd2b
add edi, 0x40e8ca77
jmp 0x5cdb28
xor edi, 0xe4240472
add edx, edi
pop edi
push ecx
mov ecx, 0x6a422568
add ecx, 0x2403cb40
sub ecx, 0x4d2679de
add ecx, 0x62510a9a
sub ecx, 0x37bf4542
sub edx, ecx
retf 0x8d59
adc al, 0x22
mov dword [esp + edx], esi
pop edx
pop esi
push esi
push esi
push edx
push eax
mov eax, 0x5b51e8db
jmp 0x5cdba9
add eax, 0x39823dc7
sub eax, 0xd686bccb
sub eax, 0x4acbc701
push esi
mov esi, 0x8a6c58ce
add esi, 0xe2693f51
xor esi, 0x8ea57f7f
add esi, 0xf0431d09
xor eax, esi
pop esi
push edi
mov edi, 0x47d388ab
jmp 0x5cdbe6
add edi, 0x4d8278c3
sub edi, 0xc2800d6c
sub edi, 0xe6d14153
jmp 0x5cdcf2
jmp 0x5d03f9
sub eax, edi
jmp 0x5d0649
pop edi
push ebx
mov ebx, 0x87a24c
xor ebx, 0xebdd9765
jmp 0x5d06b2
jmp 0x5cd8fa
pop eax
push edx
mov edx, 0xb8aa5b89
xor edx, 0x63d93df7
xor edx, 0x467e5748
sub edx, 0x9a5cfe67
jmp 0x5cda54
invalid
add edx, 0xef1997e7
xor edx, 0x5cfa5a66
xor ebx, edx
pop edx
push ecx
mov ecx, 0xb0cf0ba
sub ecx, 0xa44a1a56
jmp 0x5d3484
add ecx, 0xd2f01090
sub ebx, ecx
pop ecx
push edx
mov edx, 0xec4d8fcb
add edx, 0x12389308
jmp 0x5d37cb
sub edx, 0xbd416323
add edx, 0x1be47459
xor edx, 0x1ab3973d
sub ebx, edx
Function at 0x5d46e0
Capabilities:
Access the windows event log

Disassembly:
pop edi
xor ecx, ebx
pop ebx
push esi
mov esi, 0x7d4e59d4
jmp 0x5d21f0

Function at 0x5d6df0
Capabilities:
Encode data using xor

Disassembly:
push esp
pushfd
lcall 0x9a38, 0x31e72ab8
sub ah, bh
xor dword [eax], edi
lcall 0x56e3, 0x7a8b44dd
push edx
out 0x16, al
lea eax, [ecx - 0x23]
imul dword [ebp + 0x49]
invalid
push 0xbdbcf87e
lodsd eax, dword [esi]
mov ah, 0xac
mov ebp, 0x23acb4ad
adc dword [ecx + edx - 0x4f068dcd], edx
and edx, dword [ecx + 0x7a]
ja 0x5d6e19
and edx, dword [ecx]
xchg esp, eax
adc dword [ebx], esi
jb 0x5d6e59
mov al, 0x23
push ecx
jp 0x5d6edc
mov bl, 0x37
aaa
adc dl, byte [edx + 0x31]
ficomp dword [0xdf68f80b]
adc ebp, dword [ebp + edi*4 - 0x77]
dec ebp
mov al, byte [0x11aebdc3]
jne 0x5d6e70
das
or al, 0x41
sbb eax, 0xf09bea3b
dec edi
xor byte [edx - 0x7ca303cc], 0xa3
xor ah, dh
mov word [esi - 0x56], fs
wait
jl 0x5d6e51
mov esp, 0x612d93ac
fmul qword [edx + 0x57]
sbb al, 0xee
jae 0x5d6ee3
jecxz 0x5d6e36
fcom dword [edi]
cmpsb byte [esi], byte es:[edi]
push ebp
test dword [eax + 0x28ba3f79], edi
mov al, byte [0x3e101468]
push edx
aam 0xb6
inc edx
pop es
mov ecx, 0x61f82fb5
enter 0x6272, 0x42
iretd
mov al, byte [0x88785277]
mov dh, dh
dec esp
fisttp dword [eax - 0x5d]
inc esp
push ebx
sub al, 0x75
mov eax, dword [0x9dc2a8e4]
invalid
dec dword [edi]
mov dword [0x426efd3a], eax
inc ecx
dec edx
test al, 0xbe
mov bl, 0x93
fdivr st(2), st(0)
xor byte [ebx], dh
jge 0x5d6ec6
jno 0x5d6f46
sbb byte [edx], 0x59
and al, byte [esi - 0x7a]
push es
inc eax
out dx, eax
add ch, 0xc6
arpl di, cx
dec ebp
adc ecx, 0x8c4e9952
nop
aas
push 0x1c9c8aa5
dec edi
or eax, dword [ebx - 0xc]
scasd eax, dword es:[edi]
jle 0x5d6f89
sub ecx, dword [ebx - 0x7d]
cmp al, 0xe3
jmp 0x9995ea63
adc byte [eax], bh
in al, dx
pop eax
push ecx
adc al, 0x72
popfd
sal dword [ebx - 0x1ae193c7], 1
adc esp, dword [eax]
xor dl, bh
imul ebp, dword [ebx + edi*2], 0xffffffdf
jae 0x5d6f4a
arpl word [edi - 0x52], cx
jnp 0x5d6fb7
adc ah, byte [edi]
mov ecx, dword [esi]
out dx, eax
invalid
retf
mov dl, 0xa9
ror byte [edx + ecx*2], cl
pop ss
cld
enter 0x202c, 0xffffffffffffff93
mov edx, 0xce635770
push ss
int3