joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18112702
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x181d400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.181117e7
lea esi, [edi + 0x1e4]
xor ecx, ecx
mov eax, dword [esi]
inc ecx
mov ebx, 0x100
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, ebx
or eax, ecx
jge 0x18112740
push ebx
mov ecx, esi
call fcn.1800771c
push ebx
push dword [esi]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.18009eb8
push 1
mov ecx, edi
call fcn.181144e8
push 8
call fcn.1811ead8
mov esi, eax
lea eax, [ebp - 0x10]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov eax, dword [edi + 0x1c4]
mov dword [edi + 0x1c4], esi
test eax, eax
je 0x18112797
push 8
push eax
call fcn.1811e756
pop ecx
pop ecx
push 0x7d9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor esi, esi
push esi
push 1
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 0x181c9de8
push 3
push esi
push 0x181b74f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x181127fc
mov ecx, dword [edi + 0x1ec]
mov ebx, dword [ebp - 8]
mov dword [ebp - 8], esi
test ecx, ecx
je 0x181127f6
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x181623e8]
call esi
xor esi, esi
mov dword [edi + 0x1ec], ebx
mov ecx, edi
call fcn.18113967
mov dword [ebp - 0xc], esi
call fcn.18006f7b
push eax
lea ecx, [ebp - 0xc]
call fcn.1800768f
push 0xbdc
lea ecx, [ebp - 0xc]
call fcn.180076c8
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.1811455a
mov ecx, edi
call fcn.181144b9
push 0x7db
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov eax, dword [ebp - 8]
test eax, eax
je 0x1811286a
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x181623e8]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811e228
leave
ret 0x10

Function at 0x18113a3f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.180270ed
test al, al
je 0x18113a76
push 0x7dc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x18113aae
and dword [ebp - 8], 0
call fcn.18006f7b
push eax
lea ecx, [ebp - 8]
call fcn.1800768f
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.180076c8
lea eax, [ebp - 8]
mov ecx, esi
push eax
push 0x7dc
call fcn.18113873
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1811e228
leave
ret 8
Function at 0x18117129
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x181d400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov dword [eax], 1
mov ebx, ecx
lea eax, [ebp - 0x18]
xor edi, edi
push eax
mov dword [ebp - 0x18], edi
push dword [ebx + 4]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x48
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.18132ed0
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x58]
add esp, 0xc
mov dword [ebp - 0x5c], eax
push ecx
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
cmp byte [ebx + 0x28], 0
mov edx, eax
mov dword [ebp - 0x60], edx
je 0x18117192
mov ecx, dword [ebx + 0x38]
jmp 0x181171a0
cmp byte [ebx + 0x27], 0
je 0x1811719d
mov ecx, dword [ebx + 0x34]
jmp 0x181171a0
mov ecx, dword [ebx + 0x30]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebx + 0x44]
push dword [ebp - 0x60]
call dword [sym.imp.GDI32.dll_SelectObject]
push 2
push 2
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x60]
call dword [sym.imp.GDI32.dll_RoundRect]
cmp byte [ebx + 0x29], 0
je 0x181171ec
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_DrawFocusRect]
xor edi, edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
je 0x18117284
mov dword [ebp - 8], edi
call fcn.18006f7b
push eax
lea ecx, [ebp - 8]
call fcn.1800768f
inc esi
lea ecx, [ebp - 8]
push esi
call fcn.18007592
push esi
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.18009eb8
push dword [ebx + 0x2c]
push dword [ebp - 0x60]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x27
mov eax, ebx
pop ecx
cmp byte [ecx + eax], 0
je 0x1811724b
mov eax, dword [ebx + 0x40]
jmp 0x1811724e
mov eax, dword [ebx + 0x3c]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push dword [ebp - 0x60]
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0x25
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push dword [eax - 0xc]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811e228
leave
ret 0x10
Function at 0x181185b1
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181d400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov ecx, dword [edi]
cmp dword [ecx - 0xc], 3
jge 0x181185e4
push str.DRIVE_UNKNOWN
mov ecx, ebx
call fcn.180074da
jmp 0x18118735
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 3
push eax
mov ecx, edi
call fcn.1800f92d
push 1
lea ecx, [ebp - 8]
call fcn.18009fc4
cmp ax, 0x3a
jne 0x1811871e
push 2
lea ecx, [ebp - 8]
call fcn.18009fc4
cmp ax, 0x5c
jne 0x1811871e
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
call fcn.18014f23
mov esi, dword [ebp - 0xc]
cmp dword [esi - 0xc], 0
je 0x181186ae
mov ecx, dword [edi]
mov edx, esi
call fcn.18016606
test al, al
je 0x18118658
push str.DRIVE_SYS
mov ecx, ebx
call fcn.180074da
lea ecx, [esi - 0x10]
call fcn.18006f52
jmp 0x1811872a
push 2
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
call fcn.1800f92d
mov ecx, dword [edi]
push 1
mov edx, dword [eax]
call fcn.180133c8
pop ecx
mov ecx, dword [ebp - 0x14]
mov bl, al
add ecx, 0xfffffff0
call fcn.18006f52
test bl, bl
je 0x181186ab
mov ecx, dword [ebp - 0x10]
push str.DRIVE_PRI
call fcn.180074da
lea ecx, [esi - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov eax, dword [ebp - 0x10]
jmp 0x18118737
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 0
je 0x18118717
sub eax, 1
je 0x18118710
sub eax, 1
je 0x18118709
sub eax, 1
je 0x18118702
sub eax, 1
je 0x181186fb
sub eax, 1
je 0x181186f4
sub eax, 1
jne 0x18118717
push str.DRIVE_RAMDISK
mov ecx, ebx
call fcn.180074da
lea ecx, [esi - 0x10]
call fcn.18006f52
lea ecx, [edi - 0x10]
jmp 0x18118730
push str.DRIVE_CDROM
jmp 0x181186e0
push str.DRIVE_REMOTE
jmp 0x181186e0
push str.DRIVE_FIXED
jmp 0x181186e0
push str.DRIVE_REMOVABLE
jmp 0x181186e0
push str.DRIVE_NO_ROOT_DIR
jmp 0x181186e0
push str.DRIVE_UNKNOWN
jmp 0x181186e0
push str.DRIVE_UNKNOWN
mov ecx, ebx
call fcn.180074da
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811e228
leave
ret
Function at 0x1811de52
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push 4
pop edx
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x181a0850]
sub edx, 1
jne 0x1811de55
mov eax, ecx
ret
Function at 0x1814e45a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1814e0d7

Function at 0x181551d4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1815504a

Function at 0x18159b90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x18159bbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x18159bbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4025c6
Capabilities:
Get number of processors

Disassembly:
and ch, byte [ebp + 0x61]
js 0x4025f8
ja 0x402636
je 0x402638
cmp ch, byte [esi + 0x6f]
jae 0x402668
push 0x7974732e
xor byte [0x6965683b], ah

Function at 0x402829
Capabilities:
Get number of processors

Disassembly:
push 0x222b693d
jo 0x4028a8
and ch, byte [0x732e632e]
arpl word [edx + 0x6f], si
Function at 0x4ca877
Capabilities:
Encode data using xor

Disassembly:
bound ebp, qword [eax]
clc
sbb eax, 0xb6f5a2fd
invalid

Function at 0x5564e0
Capabilities:
Encode data using xor

Disassembly:
shl dword [esp + edi*4 - 0xf70d72e], cl
shl dword [ebp - 0x7cce0cbd], 0x1f
jge 0x55654b
aaa
jb 0x55655e
inc byte [edi + eax + 0x4d988bc5]
sub ah, byte [edi - 0x1c]
inc edi

Function at 0x55c291
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [ebp + 0x110566f0]
lcall 0x826, 0x65bc3c24
cli
mov ebp, 0x3a9d6f21
pop ebx
and eax, 0x3e774d3
sal ecx, 1
mov word [ebp - 0x3b], ss
or dword [0xd8dca59c], esi
xor eax, 0xd8dca59c
cmp bl, byte [eax + esi*4 + 0x1e3ec63b]
shr dword [edi], 1
inc ebx
salc
xor dword [edx - 0x4c76853f], esi
add al, byte [eax - 0x1b]
xor eax, dword [ebx - 0x22]
call 0x64e1fbe2
shl ecx, 0xe4
and dh, byte [esi]
pop es
xor byte fs:[ebx - 0x27d97cc7], dl
dec edx
sar byte [ebx + 0x74], 1
jne 0x55c230
mov ebp, 0x659c5195
loope 0x55c211
and eax, 0x3789587
pop ebp
fdivr qword [0x2b115603]
ror byte [ebp - 0x7b], 5
shl byte [edi], 0x8b
mov ch, 0x64
mov ah, 0xbd
dec edi
mov ebp, 0xe38a5055
xchg dh, dh
loope 0x55c28b
mul cl
std
and ecx, dword [esi]
insd dword es:[edi], dx
mov eax, 0x51d0e4cb
jbe 0x55c264
push esi
mov esp, 0xa012ac37
fadd dword [esi + 0x504d80d0]
mov al, byte [0x80d086d8]
dec ebp
push eax
and byte [ebp + 4], 0x1b
std
in eax, dx
sbb esi, dword [eax]
xor al, 0x1e
jge 0x55c29d
popal
int1
or eax, 0x7a4d99b3
adc eax, 0xbf356e66
adc ah, byte [eax + 0x45ff6d12]
push esp
nop
invalid
Function at 0x55e6d0
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], al
sbb al, 0x89
sbb al, 0x5e
hlt
jno 0x55e6a9
jnp 0x55e60b
jp 0x55e687
mov edi, 0xfc1089a7
lodsd eax, dword [esi]
sbb al, 0x69
adc eax, 0x55916529
div byte [ebp + 0x539420c7]
sahf
adc byte [ebx + 0x2b5a5017], dl
sar byte [eax - 0x3dd58d70], 0xba
outsb dx, byte [esi]
test byte [eax + 0x35], ah
loopne 0x55e702
jb 0x55e6b3
ret 0x6eba
loop 0x55e6e3
in al, dx
add edi, edx
sbb dword [ebp + 8], 0xffffff91
mov eax, 0xce408448
ror byte [esi + 0x60409360], cl
add byte [ebx], al
adc byte [esi + 0x6f], bh
outsd dx, dword [esi]
mov bl, 0x11
insd dword es:[edi], dx
invalid
fdiv st(2)
mov dword [0x41545718], eax
push esp
inc ecx
shl byte [0x5bf151ae], 1
push 0xe7ac8148
dec eax
invalid
lodsb al, byte [esi]
out 0x94, eax
hlt
outsd dx, dword [esi]
pop edi
ja 0x55e664
std
movsd dword es:[edi], dword [esi]
jne 0x55e6ae
xor eax, 0xd183e590
adc eax, 0xaa0205e1
salc
pushal
test eax, 0xfab0d743
adc byte [eax + 0x6b055122], ch
sub dword [edx + 0x18], ebp
xor eax, 0x91fe5e67
and cl, byte [ebp - 0x41]
xor byte [ebp - 3], dl
dec edx
mov ch, byte [esi + 0x53f293c8]
push ebx
andnps xmm7, xmmword [ebp + 0x13]
in al, 0x11
add ecx, dword [esi]
xchg esp, eax
add eax, 0x1167ad10
mov dword [edi - 0x57816ec5], edx
out 0xd7, al
adc byte [ebp - 0x6876ee99], ch
cmp edx, dword [ecx - 0x28195782]
xor al, 0x80
outsd dx, dword [esi]
mov eax, 0xbb38871c
xchg ecx, eax
jb 0x55e70e
pop ds
lds ebx, [esi]
cld
sub edx, dword [ebx + 0x7a]
xchg esi, eax
popal
test dword [ebx], ebx
sbb byte [eax + 0x3a453364], bl
movsd dword es:[edi], dword [esi]
sub byte [esi + 0x3f3e3045], dh
push edx
adc eax, 0x5e0ad4d
push ebx
xchg esp, esi
invalid

Function at 0x57fd8c
Capabilities:
Encode data using xor

Disassembly:
inc eax
or dh, byte [edi + 0x9653588]
fnsave dword [eax - 0x68ed5444]
xchg cl, dh
shl byte [edi - 0x6bc9d9e6], cl
invalid

Function at 0x59fa36
Capabilities:
Encode data using xor

Disassembly:
or byte [ebp + 0x693085d7], 0x11
leave
or al, dh
xor eax, edi
Function at 0x5a6431
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
push edx
call 0xb41f491d
fiadd dword [edi]
fidiv word [eax - 0x1d]
sal byte [ebx + 0x11], 0xb6
push ebx
rcr al, cl
movsb byte es:[edi], byte [esi]
adc dword [esi - 0x5b272dad], esi
adc al, 0xf5
not dword [ecx + 0x7e]
sbb ah, dl
outsd dx, dword [esi]
push ecx
jle 0x5a6388
aam 0x6f
xor byte [ebp - 0x22], 0x4f
out 0xfa, al
nop
fadd st(5), st(0)
fistp qword [esi + 0x63]
mov ds, word [esi + 0x73b2841e]
cli
cmp dl, bh
xchg esp, eax
in eax, dx
in al, dx
mov ebp, 0xd5400e56
push 0xf43a94ea
dec eax
bound ebx, qword [edx + 0x6fe70ab8]
or al, 0xaa
jno 0x5a63a6
jb 0x5a63bc
iretd
xchg edx, eax
cli
scasb al, byte es:[edi]
mov eax, dword [ebx - 0x18]
sbb dword ds:[esi], 0xbfaf85e
insd dword es:[edi], dx
jge 0x5a636d
mov bl, byte [edx - 0xf]
sbb byte [edx + 0x1cd19c], 0xaa
rcr dword [eax + eax], 1
stosb byte es:[edi], al
inc esi
loop 0x5a63c7
outsb dx, byte [esi]
loopne 0x5a6400
mov dh, 0x3d
invalid
cmp eax, 0xb6def8c4
loope 0x5a6356
nop
pushal
outsd dx, dword [esi]
jg 0x5a6364
dec ecx
into
mov edx, 0x2acbe8b8
invalid
loope 0x5a6379
mov ecx, 0x7a868550
stc
mov ebp, 0x4ea67315
ret
mov bl, 0xd9
cli
dec esp
ror ah, cl
inc ecx
fdiv dword [eax + 0x13]
pop ecx
enter 0xffffffffffff8619, 0xfffffffffffffff6
invalid
jp 0x5a63e9
ja 0x5a6446
adc ebp, edi
std
invalid
or byte [eax + 0x34], 0xe7
insd dword es:[edi], dx
mov ecx, 0xcf4646b0
leave
js 0x5a6434
mov al, 0x46
inc esi
iretd
js 0x5a6463
in al, 0x90
push edi
loop 0x5a64d4
fidiv dword [edx - 0x265cd56a]
invalid
cwde
out 0x67, al
xor dword [edx + 0x5fcdc996], ebp
sub edx, ecx
jns 0x5a644c
retf
retf
mov al, 0xf1
jnp 0x5a64a9
in al, 0xf
shrd dword [eax - 0x3f9f7349], eax, 0x4d
lodsb al, byte [esi]
xor byte [edi + 0x4dc0608c], 0x8e
cmpsb byte [esi], byte es:[edi]
imul edi, dword [ecx], 0x3e
imul esi, dword [edi - 0x15], 0xfffffff3
sal byte [edx - 0x5bd949af], 1
mov fs, word [esi + 0x6b3e396b]
ja 0x5a64cf
sal byte [edx - 0x5bd949af], 1
and byte [0x8c0a016], dl
xlatb
cli
clc
add ch, 0xf1
popal
add al, 0x78
cmc
jp 0x5a64d5
dec eax
aam 0x8c
xor ch, bh
loope 0x5a64dc
and ebx, ecx
jb 0x5a6518
add al, 0xbb
cmp al, 0xd8
ljmp 0xa538
sub al, 0x25
push eax
mov esp, 0x964b35b0
xor byte [esi - 0x2f], bl
les edx, [ecx]
dec ecx
mov ah, 0xea
and bh, byte [esi]
cmp byte [eax + 0x495a19e0], bl
retf 0x4fa3
Function at 0x5a776b
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
jmp 0x1aaafe64
adc dword [edx], ecx
loope 0x5a76e0
sal byte [ebx - 0x74860400], 0x34
pushfd
or eax, 0xa7d8b080
xchg edx, eax
lds ecx, [ebx - 0x42]
pushal
les edx, [eax]
das
out 0x38, eax
jmp [eax + edx*8 + 0x31]
dec esp
leave
invalid
inc edi
jno 0x5a77d1
ror ch, 0xb2
sbb edx, ebx
jle 0x5a771c
add eax, 0x60e11e95
xchg edi, eax
pop edx
xchg ebp, eax
sub al, 0xc6
xor eax, 0xd52feb5a
aad 0x10
stosb byte es:[edi], al
sbb cl, dl
xchg edx, eax
xor bh, byte [eax - 0x614cae9e]
mov bl, 0x9e
xor ah, al
cmp byte [ebp - 0x1f], 0xcf
xchg esp, eax
xchg cl, bl
sub dword [ecx + 0x556ee4c8], 0x41
dec ecx
dec ebx
pop ss
push edi
add esi, ebp
pop edx
ja 0x5a778e
scasb al, byte es:[edi]
int 0xa8
push esi
xchg dword [esi - 0x28], eax
fstp dword [edi - 0x50]
jle 0x5a77b2
mov al, 0x7e
std
mov dword [eax], eax
pop eax
in al, dx
xor dword [eax - 0x1ea66c86], esi
cdq
cmp edx, edi
fmul qword [ebp + 0x3608b606]
jne 0x5a7752
cmp bl, cl
cmp byte [ebp + 0x43], 0xcd
call 0xc5d317fb
wait
sub byte [eax - 0x5f14cedb], 0x70
adc al, 0xcc
add al, 0xa6
mov al, byte es:[0x809bc578]
test al, 0x25
xor ebx, ebp
mov al, byte [0x4cc1470]
cmpsb byte [esi], byte es:[edi]
add byte [ecx], al
clc
popal
test al, 8
fistp dword [eax - 0xa]
invalid
stosd dword es:[edi], eax

Function at 0x5afab3
Capabilities:
Encode data using xor

Disassembly:
imul edx, dword [eax + 0x28], 0xffffffef
xor byte [eax + 0x792f92a8], dh
invalid
inc edi
test byte [ebx - 0x5a], cl
push esp
jg 0x33bdcb01
sahf
js 0x5afa91
cmovae esp, dword [edi]
in al, 0x40
sbb dh, 0x20
invalid

Function at 0x5f0984
Capabilities:
Encode data using xor

Disassembly:
pop edx
jae 0x5f099a
add ecx, dword [ebx + edx]
lodsb al, byte [esi]
xchg dh, al
xlatb
sahf
mov byte [0xa8f1aac7], al
cmp eax, 0x521293c6
aaa
or eax, 0x22e1a296
jbe 0x5f09ad
xchg ecx, eax
cmp ecx, dword [edx + 0x39]
pop ds
mov ebx, 0x82bdf067
ret 0xe000
in al, 0x1a
mov ebx, 0x38771eb5
push 0x25
push 0xffffffffffffff96
mov eax, dword [0x66dde6ce]
pop ecx
fisubr word [ecx + 0x62a6f661]
out 0x94, eax
mov bh, 0xbd
pop esi
inc edx
xor al, 0xb6
add esp, dword [edx + 0x13]
invalid
bound edx, qword [ebx]
mov al, 0xd7
xlatb
inc edi
and ebp, dword [ebx]
push esp
add dl, bl
sub edx, dword [edx + eax - 0x2d]
xor bl, dh
mov dh, 0x2b
jg 0x5f09a5
jg 0x5f094d
call 0xa8c13a6b
mov dl, 0xd5
inc esi
pop esi
push ebx
sub dh, byte [edx + 0xb]
or eax, dword [esi]
Function at 0x5ffffc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov bl, byte [eax + eax*2 - 0x76]
fadd dword [0x64832a9e]
lcall 0x4a03, 0x385233a2
mov bl, 0x5b
pmuludq mm6, qword [eax]
enter 0xffffffffffffb0e6, 0xffffffffffffffe6
mov ebp, 0x35f1061c
rol byte [ecx], cl
cmp eax, dword [edx - 0x67]
xchg byte [esi + edx*4], dl
imul esp, dword [esi - 0x44566c87], 0xffffffb9
test eax, 0x5334b9bb
test eax, 0x5334b9bb
ja 0x5fffd1
adc byte [ebx + 0x7a], 0xac
mov es, word [ecx - 0x5e87cd93]
pop edi
mov byte [0x838d], al
loopne 0x600015
lea esi, [edx - 1]
jb 0x600016
call ecx
out dx, al
shr esi, 1
add eax, eax
add esi, ebp
add eax, eax
lea edi, [edx + ebp - 1]
test edx, edx
jbe 0x6000e3
mov dword [esp + 0x10], edx
mov edi, edi
mov bl, byte [esi]
mov cl, al
shr bl, cl
and bl, 0xf
mov byte [edi], bl
cmp eax, 4
jne 0x600046
xor eax, eax
dec esi
jmp 0x600049
add eax, 4
dec edi
sub dword [esp + 0x10], 1
jne 0x600031
jmp 0x6000df

Function at 0x60009c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jb 0x60009d
dec dword [ebp - 0x113e00b6]
add eax, dword [ebx + 0x7b807e1]
add byte [eax], al
add byte [ebx], al
cmc
lea ecx, [edx - 1]
shr esi, 3
and ecx, 7
mov eax, 7
add esi, ebp
sub eax, ecx
lea edi, [edx + ebp - 1]
test edx, edx
jbe 0x6000e3
mov dword [esp + 0x10], edx
jmp 0x6000c1
mov bl, byte [esi]
mov cl, al
shr bl, cl
and bl, 1
mov byte [edi], bl
cmp eax, 7
jne 0x6000d6
xor eax, eax
dec esi
jmp 0x6000d7
inc eax
dec edi
sub dword [esp + 0x10], 1
jne 0x6000c1
mov ebx, dword [esp + 0x18]
mov byte [ebx + 9], 8
mov byte [ebx + 0xb], 8
mov dword [ebx + 4], edx
cmp byte [ebx + 9], 8
jne 0x6001eb
cmp dword [esp + 0x24], 0
lea ecx, [edx + ebp - 1]
je 0x60018b
lea esi, [edx*4]
mov dword [esp + 0x10], esi
lea eax, [esi + ebp - 1]
test edx, edx
jbe 0x600172
mov edi, dword [esp + 0x20]
mov ebp, edx
mov edx, dword [esp + 0x28]
movzx esi, byte [ecx]
cmp esi, edx
jl 0x600130
mov byte [eax], 0xff
jmp 0x600139
mov ebx, dword [esp + 0x24]
mov bl, byte [esi + ebx]
mov byte [eax], bl
movzx esi, byte [ecx]
lea ebx, [edi + esi*2]
movzx ebx, byte [esi + ebx + 2]
mov byte [eax - 1], bl
movzx esi, byte [ecx]
dec eax
lea ebx, [edi + esi*2]
movzx ebx, byte [esi + ebx + 1]
dec eax
mov byte [eax], bl
movzx esi, byte [ecx]
lea ebx, [edi + esi*2]
movzx ebx, byte [esi + ebx]
dec eax
mov byte [eax], bl
dec eax
dec ecx
sub ebp, 1
jne 0x600124
mov ebx, dword [esp + 0x18]
lea esi, [edx + edx*2]
mov dword [esp + 0x10], esi
lea eax, [esi + ebp - 1]
test edx, edx
jbe 0x6001d8
mov edi, dword [esp + 0x20]
mov ebp, edx
nop
movzx esi, byte [ecx]
lea edx, [edi + esi*2]
movzx edx, byte [esi + edx + 2]
mov byte [eax], dl
movzx esi, byte [ecx]
lea edx, [edi + esi*2]
movzx edx, byte [esi + edx + 1]
dec eax
mov byte [eax], dl
movzx esi, byte [ecx]
invalid
push edi
jmp 0xbc9519
jmp 0xbb6964
Function at 0x635554
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x51e67b77
inc ebx
inc ebp
cwde
stc
fstp xword [esi - 0x1bf28f18]
xor edx, dword [ebp + 0x16]
movsd dword es:[edi], dword [esi]
or dword [eax + 0x2606f3b8], eax
fdiv qword [esi + ebx*4]
push es
ja 0x635573
and byte [ecx], 0xd
push ebx
aaa
inc edi
dec esi
inc ebp
sub edi, dword [esi + 0x46]
inc edi
in eax, 0x61
out 0x37, eax
sbb dword [eax + 0x4ab236], esp
in eax, dx
stosb byte es:[edi], al
mov ah, 0x9a
dec ebx
test eax, 0x56b63c66
mov esp, dword [edi - 0x2a]
or byte ss:[ebx + esi*4 - 0x6cf1682], dh
xor ebx, dword [ecx]
xchg dword [esi], esp
xor eax, 0xc8c0ee9e
inc eax
push ebp
js 0x63557e
shr dword [ebp + 0x48], cl
insd dword es:[edi], dx
dec eax
outsb dx, byte [esi]
push esp
dec ecx
jne 0x6355aa
add byte [ecx + 0x4c2ca93a], al
ljmp 0x6005
Function at 0x63b437
Capabilities:
Encode data using xor

Disassembly:
push es
sub al, 0x9e
jns 0x63b413
imul edi, dword [esi - 0x12], 0x41b13e1c
in eax, 0x21
test byte [edx], ah
xor eax, 0x58353bba
xor eax, 0xd856d541
dec eax
pop edi
cmp esi, dword [0xd5413558]
push esi
fmul dword [eax + 0x5f]
and eax, 0x4b3ae229
cmp byte [edi + ecx*8], ah
xor cl, cl
xchg ebp, eax
mov ss, word [edi + 0x102599b6]
retf
mov byte es:[0x5ea96099], al
add al, 0xdd
wait
add ebx, esp
mov dword [edi + 0x199d58b5], eax
inc ebp
imul ebp, ebx, 0xff4be2e8
adc dword [esi], 0x2d70dd17
inc ebx
aas
rol byte [eax], 1
add byte [eax - 0x2b], 0xfe
jge 0x63b3fa
sbb byte [0x3b280f6d], dl
jge 0x63b40c
sbb al, 0x87
jo 0x63b4b1
scasb al, byte es:[edi]
in eax, 0xf2
add edi, dword [edi + 0x4a]
and eax, 0x4337f37c
aaa
inc ebx
push esp
cdq
push esp
popal
les edi, [edx + 0x4eadea53]
xor byte [ebp - 0x439b3573], ch
inc eax
sub dword [ebp - 0x3b], ebp
test dword [eax - 0x36], ebx
jns 0x63b473
test dword [esi], edx
test byte [ecx + eax*4 + 0x57556933], cl
sub dword [edx - 0x7517d4c5], 0x44
mov edi, dword [ecx + eax*8 - 0x16c0ff2b]
je 0x63b4a4
aas
jmp 0xb858b11e
hlt
lcall 0xb90a, 0x83bd0522
push esp
add esp, dword [eax + ebx + 4]
add eax, 0xd08b393c
lodsb al, byte cs:[esi]
xchg edi, eax
fcomp dword [edx + 0x18]
fsubr qword [ebx + 0x6d3dd87f]
fisubr word [eax + 0x53785338]
jg 0x63b4a4
cmp eax, 0x38a8de6d
push ebx
js 0x63b527
jb 0x63b500
nop
jmp 0xf4a0ee9a
jp 0x63b4ca
mov bh, 0xdc
mov edx, 0x6fe931c5
invalid
outsb dx, byte [esi]
aad 0x98
mov dl, 0x18
sal byte [edi], 0xcc
lodsd eax, dword [esi]
invalid
imul edi, dword [edx], 0x94b9c52c
pop ebp
or eax, 0xf5d68ae6
adc esp, dword [0x5b8f6a1a]
xor byte [esi - 0x52f988e1], cl
sub edx, ebx
sbb dword [ecx + ebx*8], eax
popal
jmp 0x63b582
or al, 0xaa
sti
fld dword [edi + 0x4f]
push ecx
pop ecx
adc bh, byte [eax*2 + 0x3594e040]
test cl, dh
les edx, [ebx + 0x6e]
push ebx
outsb dx, byte [esi]
xchg esp, eax
dec edi
je 0x63b5f3
loope 0x63b515
fcom qword [esi]
aad 0xfe
push ds
sub ch, byte [esi + 0x26]
or eax, 0x841e3020
or eax, 0x841e3020
sbb ah, byte [eax]
popfd
or al, 0x7e
push edi
mov ch, 0xf4
jp 0x63b527
jecxz 0x63b570
xor byte [eax], dh
in eax, dx
xchg esp, eax
xor edx, esp
inc eax
les ebp, [edi - 0x7fca04a4]
aad 0x64
insd dword es:[edi], dx
scasd eax, dword es:[edi]
pop esp
sti
xor eax, 0x6d64d580
inc esp
jne 0x63b591
sub bl, byte [edx + 0x78]
jns 0x63b5ab
sal byte [edx + 0x36], cl
cli
not dl
movsd dword es:[edi], dword [esi]
loop 0x63b640
push esi
enter 0xffffffffffffd4f0, 0xfffffffffffffffb
mov dl, byte [edi + 0x51a97599]
jb 0x63b604
js 0x63b59c
out dx, al
push 0xfffffffffffffff4
add eax, 0x751cc6cd
add byte [ebp - 0x68], dl
push es
xchg byte [ebx + 0x3d8ff5d3], bh
scasd eax, dword es:[edi]
cmp byte [edx], bl
adc eax, 0x9b85e705
xor al, 0x43
xor eax, 0x756dfd3e
ret
insd dword es:[edi], dx
jne 0x63b5b9
and eax, 0x2e04e6ae
sub edx, ebp
push esp
in eax, dx
out 0x94, eax
das
jne 0x63b5ff
mov esp, 0xd4b0eebc
or byte [ebp + 0x19], dh
xor al, 0xde
invalid
sar byte [ecx - 0x2dc1a866], 1
test al, 0x39
pop ebp
pop ebp
sbb ecx, 0x25
mov byte [edx], ch
invalid