joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fd440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c274b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov eax, dword [edi + 4]
mov dword [ebp - 4], ebx
cmp eax, 0xffffffff
je 0x4fd54b
push 0x66b730
lea ecx, [ebp - 0x14]
call fcn.0059dfae
mov eax, dword [0x679a04]
mov dword [ebp - 0x18], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push 1
push ecx
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 2
call fcn.0052d6c0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push edx
call fcn.0059e27e
cmp dword [esi + 0x38], ebx
je 0x4fd4cb
push str._r_nreferer:
lea ecx, [ebp - 0x14]
call fcn.0059e242
mov eax, dword [esi + 0x38]
lea ecx, [ebp - 0x14]
push eax
call fcn.0059e242
cmp dword [esi + 0x3c], ebx
je 0x4fd4e9
push str._r_ncookie:
lea ecx, [ebp - 0x14]
call fcn.0059e242
mov ecx, dword [esi + 0x3c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0059e242
mov edx, dword [esi + 0x17c]
add esi, 0x17c
cmp dword [edx - 8], ebx
je 0x4fd510
push str._r_npd:
lea ecx, [ebp - 0x14]
call fcn.0059e242
push esi
lea ecx, [ebp - 0x14]
call fcn.0059e27e
push str._r_n__r_n
lea ecx, [ebp - 0x14]
call fcn.0059e242
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
push ebx
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0059df40
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.0059df40
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ff890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c2920
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfac
mov edx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x14], ecx
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x10], esp
cmp ecx, 0x7d0
mov dword [ebp - 4], 0
jb 0x4ff8e8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebp - 0x7e8]
lea ebx, [ebp - 0x7e8]
rep stosd dword es:[edi], eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x25
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x7e8]
push ecx
call fcn.00581b50
add esp, 8
test eax, eax
je 0x4ff9bb
lea edx, [ebp - 0x7e8]
push edx
call fcn.004fe170
add esp, 4
mov bl, al
push str.Shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4ff980
push str.UrlUnescapeA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ff977
push 0x2100000
push 0
lea ecx, [ebp - 0x7e8]
push 0
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4ff9a4
lea edx, [ebp + 8]
push 0x30000000
lea eax, [ebp - 0x7e8]
push edx
lea ecx, [ebp - 0x7e8]
push eax
push ecx
mov dword [ebp + 8], 0x7d0
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test bl, bl
je 0x4ff9bb
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x7e8]
push edx
push eax
call fcn.00555090
add esp, 8
lea ecx, [ebp - 0x7e8]
push 0x3f
push ecx
call fcn.00581b50
add esp, 8
test eax, eax
je 0x4ff9eb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x67e58c]
test eax, eax
jne 0x4ffa31
push 0
push 0x67e58c
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareDownloadManager_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4ffa31
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x67e58c]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xfb8]
push edx
push eax
push 0
push 0
push str.Extensions
push ecx
mov dword [ebp - 0x18], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4ffa72
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0xfb8]
lea eax, [ebp - 0x7e8]
push edx
push eax
call fcn.004ff5e0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ffaec
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x7d4
mov edx, dword [0x67e58c]
push esi
mov esi, ecx
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0
push str.Extensions
push edx
mov dword [esp + 0x1c], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4ffb21
xor eax, eax
pop esi
add esp, 0x7d4
ret 4
mov ecx, dword [esp + 0x7dc]
lea eax, [esp + 8]
push eax
push ecx
mov ecx, esi
call fcn.004ff5e0
pop esi
add esp, 0x7d4
ret 4
Function at 0x5000f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c29ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x41c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
push 0xa
lea ecx, [edi + 4]
mov dword [ebp - 0x1c], edi
call fcn.00598aa9
lea esi, [edi + 0x20]
push 0x67df5c
push esi
mov dword [ebp - 4], 0
mov dword [edi], 0x5f0c8c
mov dword [ebp - 0x20], 0xffffffff
call fcn.00582a2e
mov eax, dword [0x67e560]
add esp, 8
test eax, eax
mov byte [ebp - 4], 1
jne 0x50015a
mov eax, 0x67e564
push str.UrlHistory2.txt
push eax
push 0x653e00
push esi
call fcn.00582a2e
add esp, 0x10
lea ecx, [ebp - 0x14]
push 0x67df58
call fcn.0059dfae
mov eax, dword [0x679a04]
mov dword [ebp - 0x18], eax
push 0
push 0
push 4
push 0
push 1
push 0xc0000000
push esi
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x20], ebx
jne 0x5001d2
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0059df40
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0059df40
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x428]
push eax
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x428]
push ecx
push 0x3ff
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x500278
mov eax, dword [ebp - 0x28]
test eax, eax
jbe 0x500278
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x14]
push eax
call fcn.0059e242
push 0xa
lea ecx, [ebp - 0x14]
call fcn.0059e32d
mov esi, eax
cmp esi, 0xffffffff
jle 0x5001d2
test esi, esi
jne 0x500235
push 1
push eax
lea ecx, [ebp - 0x14]
call fcn.00596696
jmp 0x500213
lea ecx, [ebp - 0x24]
push esi
push ecx
lea ecx, [ebp - 0x14]
call fcn.0059690a
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.0059e079
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.0059df40
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [eax + 4]
call fcn.00598c52
inc esi
lea ecx, [ebp - 0x14]
push esi
push 0
call fcn.00596696
jmp 0x500213
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0059df40
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0059df40
jmp 0x5002cb
cmp ebx, 0xffffffff
je 0x5002d7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x506f20
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x506f54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
ret
lea edx, [esp + 0xc]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 0x10]
mov dword [esi], eax
mov dword [esi + 4], 0
cmp dword [esi], 0xffffffff
jne 0x506fa2
mov eax, dword [esi + 4]
test eax, eax
jne 0x506fa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
je 0x506fa2
mov dword [esi], 0
push edi
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0xc]
push 1
push 0
push 0
push edx
call fcn.005843a0
mov ecx, dword [esi]
push edi
add ecx, eax
mov dword [esi], ecx
mov ecx, dword [esi + 4]
adc ecx, edx
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret
Function at 0x50e940
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x18]
mov byte [eax], 0
mov edx, dword [esi + 4]
push 0
push ecx
push edi
push edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
call ebp
cmp eax, 0xffffffff
jne 0x50e99c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [esp + 0x10], eax
je 0x50e99c
mov ecx, esi
call fcn.0050e610
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x20]
push 0
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x50e9d6
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
cmp eax, ecx
jne 0x50e9d6
mov edx, dword [esp + 0x34]
mov byte [edx], 1
mov eax, dword [esp + 0x28]
xor ecx, ecx
add eax, edi
lea edx, [esp + 0x18]
adc ecx, ebx
add eax, 4
push 0
push edx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esi + 4]
adc ecx, 0
push eax
mov dword [esp + 0x28], ecx
call ebp
cmp eax, 0xffffffff
jne 0x50ea20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x50ea20
mov ecx, esi
call fcn.0050e610
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x18

Function at 0x50ea40
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x50ea4d
xor eax, eax
ret 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push ecx
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 0xc

Function at 0x50ea80
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [ecx + 4]
push esi
cmp eax, 0xffffffff
jne 0x50ea91
xor eax, eax
pop esi
pop ecx
ret 4
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], 0
cmp dword [esi], 0xffffffff
jne 0x50ead0
mov eax, dword [esi + 4]
test eax, eax
jne 0x50ead0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x50ead0
mov dword [esi], eax
mov dword [esi + 4], 0
xor eax, eax
pop esi
pop ecx
ret 4
mov edx, dword [esp + 4]
push 1
push 0
push 0
push edx
call fcn.005843a0
mov ecx, dword [esi]
add ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 4]
adc eax, edx
mov dword [esi + 4], eax
mov eax, 1
pop esi
pop ecx
ret 4
Function at 0x516340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c3ad0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov edx, dword [ebp + 8]
mov esi, ecx
push edi
test eax, eax
mov eax, dword [esi + 0x30dc]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov ecx, dword [eax + 0x70]
push ecx
mov ecx, dword [esi + 0x80]
push edx
je 0x51638f
call fcn.00561850
jmp 0x516394
call fcn.0055e9e0
mov eax, dword [esi + 0x30dc]
add eax, 0x80
mov ecx, dword [eax]
mov edx, dword [eax + 4]
or ecx, edx
je 0x5163e5
mov ecx, dword [0x67e58c]
lea edx, [ebp + 8]
lea eax, [ebp + 0xc]
push edx
push eax
push 0
push 0
push str.bIgnMTCh
push ecx
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5163d8
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x5163e5
mov ecx, dword [esi + 0x30dc]
push 0
call fcn.00519b40
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x519880
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esi + 0x1cc], 0
mov edx, dword [0x67e58c]
push 0
push 0
push str.FtpPasive
push edx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5198c9
xor eax, eax
mov dword [esi + 0x1cc], eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 8]
mov dword [esi + 0x1cc], eax
pop esi
add esp, 8
ret
Function at 0x526470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c4240
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov edx, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
mov eax, dword [esi + 0x30cc]
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov ecx, dword [eax + 0x70]
push ecx
mov ecx, dword [esi + 0x80]
push edx
call fcn.0055e9e0
mov eax, dword [esi + 0x30cc]
mov edi, 1
mov dword [eax + 0xf0], edi
mov eax, dword [esi + 0x30cc]
add eax, 0x80
mov ecx, dword [eax]
mov edx, dword [eax + 4]
or ecx, edx
je 0x526572
mov ecx, dword [0x67e58c]
lea edx, [ebp + 8]
lea eax, [ebp - 0x14]
push edx
push eax
push 0
push 0
push str.bIgnMTCh
push ecx
xor bl, bl
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x526513
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x526513
mov bl, 1
mov edx, dword [esi + 0x80]
mov eax, dword [edx + 8]
test eax, eax
je 0x526572
test bl, bl
jne 0x526572
push 0x3f
push eax
call fcn.00581b50
add esp, 8
test eax, eax
jne 0x526572
mov eax, dword [esi + 0x30cc]
mov ecx, dword [eax + 0xf4]
test ecx, ecx
jne 0x526565
mov ecx, dword [esi + 0x80]
mov eax, dword [0x67f4a0]
push 0x50044
mov edx, dword [ecx + 8]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x526572
mov dword [esi + 0x3118], edi
mov byte [esi + 0x311c], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x541e80
Capabilities:
Encode data using xor

Disassembly:
jnp 0x541e3f
sub byte [edx + 0x51], 0x8f
invalid
dec edi
cmp esp, edi
push ebx
lodsb al, byte [esi]
jmp 0xe0dcba7e
popal
push ebp
mov dl, 0xc9
mov cl, 0xc4
aam 0xab
dec ebp
cmpsb byte [esi], byte es:[edi]
test edi, ebp
stosb byte es:[edi], al
cmp al, 0x78
js 0x541e72
js 0x541e72
je 0x541eb5
test cl, bh
push eax
jns 0x541e21
jnp 0x541ea3
dec ebp
jae 0x541ea4
cmp dword [ecx], eax
jo 0x541f34
retf 0xa4e8
mov esp, 0x3f4ecae5
add dword [ecx], esp
mov edx, 0x33be83c0
push eax
xchg ebp, eax
mov dl, 0x1a
sbb byte [0x4f07bd63], bl
pushfd
xchg edi, eax
mov byte [0x8f28273], al
sbb eax, esp
or al, 0x5a
loopne 0x541f83
or al, 0x5a
xchg esi, eax
loope 0x541f1a
call 0xfec92e37
insb byte es:[edi], dx
outsb dx, byte [esi]
jno 0x541ed9
pop edx
sub al, 0x7d
mov bl, 0xe1
out 0x19, eax
pop ds
sbb al, 0x72
invalid
jb 0x541efc
xor ah, byte [ebp - 0x1b]
dec ebp
xor al, cl
push ebp
rcr byte [eax], cl
sub al, 5
push ds
xor dword [edi - 0x7e0bd56b], ebp
sub al, byte cs:[ebp - 0x60456387]
movsd dword es:[edi], dword [esi]
fcomp st(6)
ljmp 0x5574
jo 0x541f0a
xor al, 0xc
jl 0x541f1e
sbb eax, 0x165f8398
mov dword [0xb2ebaaab], edx
das
sbb byte [eax - 0x1249ef73], dl
mov dh, 0xed
inc ebp
xlatb
daa
sahf
out 0xb8, eax
movsd dword es:[edi], dword [esi]
stosd dword es:[edi], eax
rol dword [ebx], 1
sub esi, edi
and dh, byte [esi + edx*2 + 0x357be660]
jl 0x541fd9
xchg byte [ecx + 0xc], dh
invalid
mov byte [0x5b7d780b], al
jns 0x541f6d
dec ebx
cmpsb byte [esi], byte es:[edi]
inc edx
out 0xe, al
sub esp, ebp
sbb dword [eax + 0x5ec2be15], ebx
dec ecx
int 0xbe
jno 0x541fc4
pop ebp
inc ecx
mov edx, 0x403c54b
xchg edi, eax
stosd dword es:[edi], eax
add dword [ebx + 0x6b246455], ebx
cwde
mov bh, byte [edx - 0x52]
push ss
dec ebx
xchg edi, eax
mov esp, dword [ebx - 0x3f18fd1c]
cmpsb byte [esi], byte es:[edi]
sbb cl, byte [edi + 0xc2026cb]
lodsb al, byte [esi]
mov al, 0x4b
leave
sub dword [edx], ebx
enter 0x56d8, 0x2c
sub ebp, esp
dec edi
outsb dx, byte [esi]
push edx
je 0x54208d
int3

Function at 0x5421e0
Capabilities:
Encode data using xor

Disassembly:
pop es
rol dword [eax - 0x725b9feb], cl
lea esp, [edi]
lea esp, [edi]
lcall 0x8293, 0xb13c4e3d
jne 0x5421da
in eax, 0x3b
sub byte [edi + 0x502739dd], bh
mov fs, word [ebx + edx*8 + 0x5306862c]
pop edi
push edx
xchg byte [ebx - 0x36], ah
and al, 0xee
lcall 0x67c1, 0x31e58ab2
pop esp
invalid
Function at 0x5690c0
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
stc
dec ebp
push 0x6d
xchg dl, ah
xchg edx, eax
sub bh, bl
adc esp, ebx
sub ecx, 0xffffff99
mov dword [0x734d5f92], eax
jne 0x56911c
dec ebp
jge 0x5690f0
in eax, 0x9f
jg 0x5690d3
mov esp, 0xab6dd67
jl 0x56912a
or byte cs:[ebx - 0x18], cl
or byte [ebx - 0x18], cl
push ecx
xchg esi, eax
inc ebp
xor ah, byte [eax - 0x1d]
and esi, esp
inc eax
pushal
jecxz 0x569111
out 0x40, al
bound edx, qword [esi]
push ss
sahf
cmp al, dl
popal
or eax, 0xbe7d4116
xor dword [esi + 0x75], esp
jp 0x5690e6
adc dword [edi - 9], ecx
jg 0x569125
scasd eax, dword es:[edi]
mov ebx, 0x391f5604
xor eax, 0xcc90abf8
jmp 0xc3341dd8
int3
movsb byte es:[edi], byte [esi]
jnp 0x5690f3
jl 0x5690ed
cmp al, 0xcc
invalid
invalid
mov ss, word [ebx]
pop esi
int3
Function at 0x56cd50
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [ebx]
fimul word [ebx + 0x2b4d05d]
lds edx, [eax + 0x2ce20b2e]
sti
mov ebx, 0x3f102018
dec eax
aad 0xf
mov cl, byte [eax - 0x422910fa]
invalid
movsb byte es:[edi], byte [esi]
shr dword [esi - 0x2d4e0cce], cl
sub eax, 0x2c584b3e
dec ebx
pop eax
invalid
dec ebx
pop eax
sub al, 8
in al, 0xa7
or ah, ah
cmpsd dword [esi], dword es:[edi]
push esi
mov cs, ecx
jge 0x56ccee
pushfd
mov esi, 0x1841b979
jg 0x56cd98
pop eax
mov bh, 0x71
scasb al, byte es:[edi]
stosd dword es:[edi], eax
invalid
mov ah, byte [edi - 0x39]
mov esp, 0xb1c487ac
idiv dword [edx]
mul dword [esi]
xchg esp, eax
mov cl, 0xf7
cmp dh, bh
mov ebx, 0xbcb21ab
mov ebx, 0xbcb21ab
or bh, bl
xchg ebx, esi
or ebp, ecx
enter 0xffffffffffff8ebb, 0xffffffffffffff8d
in eax, dx
mov eax, 0x9a05313f
test dword [ebx + 0x38], ecx
push esp
jo 0x56cd48
mov byte [0x75b842ea], al
fadd st(4)
mov byte [ebx + 0x1a6d9fd4], dl
sbb eax, 0xa5767d43
jne 0x56cd9d
les ecx, [eax + 0x6d9fd493]
sbb bl, byte [0xa5767d43]
cmp eax, 0xf0c00028
adc al, 0x3c
pop ds
setp byte [edi]
inc ebp
dec edi
popfd
movsb byte es:[edi], byte [esi]
sar dword [edx], cl
mov ah, 0xa7
sbb dl, ch
sbb dword [edi + edi + 0x5c5d838c], 0xffffffbb
loope 0x56ce01
jnp 0x56cdc3
xchg dword [0x1bddb6e0], ecx
hlt
jp 0x56cdd9
imul dword [ebx - 0x67]
ja 0x56cdfc
in eax, dx
sbb eax, 0x7dc29f2
sub esp, ebx
pop es
add al, 0x27
xor byte [0x42373196], ch
mov ah, byte [edi]
mov word [ecx], gs
movsd dword es:[edi], dword [esi]
push 0x63
push edi
sti
sbb edi, dword [edi + 0x2173616d]
bound esp, qword [ebp - 0x4b2657c4]
xchg ebx, edx
jle 0x56ce05
dec ecx
mov ecx, eax
imul ebx, dword [ebx], 0xffffffc5
invalid

Function at 0x584940
Capabilities:
Encode data using xor

Disassembly:
push ebp
xchg esi, eax
push cs
je 0x5848d5
invalid
cmp eax, 0x47f85fa7
fiadd word [0x43a89a5f]
jp 0x5848d6
mov edx, 0xc4481ae1
pop esp
scasd eax, dword es:[edi]
jae 0xe6776cf
jmp 0x5849d3
fld qword [esp + edi]
mov al, 0xc4
mov ebx, 0x132a94a5
cmp al, 0xaa
leave
mov byte [0x84d79d7d], al
cmp dh, byte [edx + 0xeed4495]
inc esp
in eax, dx
push cs
shl dword [edx + ebx*8], cl
jns 0x584997
and word [eax - 0x4e], di
xchg dword [ecx + 0x6956ac3], edx
pushal
adc dword [edx*2 + 0x54c3f0fa], eax
cmp byte [eax - 0x5de99794], cl
mov bl, 0x99
lodsd eax, dword [esi]
xor esp, dword [edx + esi + 0x572caacc]
push ss
mov byte [0x33ad99b3], al
movsb byte es:[edi], byte [esi]
xor cl, ah
stosb byte es:[edi], al
sub al, 0x57
dec ebx
mov ebp, 0xe71d2303
push es
xor esp, dword [ebx + 0xe]
sub dword [edi + 0x3a061a22], 0x56c0724b
cmp bl, byte [eax + 0x67ec2a82]
aad 0xb5
rcl byte [esi + 0x3a], 0x98
sub byte [edx], 0xec
aad 0xb5
jp 0x584982
loopne 0x5849b5
mov byte [0x74b6eeec], al
cmp bl, bl
nop
arpl word [edi - 0x3d], sp
ror dword [ebp - 0x77], 0xa1
mov dl, 0x43
adc dl, bh
or dword [ecx], esp
out 0xb7, al
and al, 0x3d
pop es
mov bl, ah
mov ebx, 0x5400b75c
into
cli
adc al, 0x98
rcl edi, 0x41
std
test byte [ebp + eax*4 - 0x7db995c1], dh
loopne 0x58499d
cmp dword [edx - 0x1b31b0a0], ecx
int3
Function at 0x58b3db
Capabilities:
Encode data using xor

Disassembly:
inc edi
sbb al, 0x26
pop ds
movsb byte es:[edi], byte [esi]
daa
fnstsw word [eax + eax*2 + 0x4eb770fc]
adc al, 0x7f
mov ch, byte [ebx - 0x46d4f5fc]
inc edx
adc esi, esp
pavgw mm1, qword [eax + 0x77]
dec ebx
xlatb
xor esp, dword [esi - 0x74]
bound esi, qword [ebp + 0x2b]
dec edi
leave
and eax, 0x5b76da86
pop ss
add dword fs:[edx - 0x68], esi
out dx, al
xchg esi, eax
or edi, dword [edx]
or eax, 0xb3f3f981
lds esp, [esi + 0x4dcf66a0]
pushfd
lea eax, [eax + 0x2645e239]
jle 0x58b433
and byte [eax], 0xb1
jbe 0x58b42c
jg 0x58b3fb
into
sbb al, 0xc0
pop ebp
lcall 0x1de8, 0x22d007f7
mov bl, 0x2f
js 0x58b496
shl byte [edx], 1
call 0x78886757
pop ebx
xchg esi, eax
xlatb
pop es
invalid
invalid

Function at 0x58e150
Capabilities:
Encode data using xor

Disassembly:
pop edx
imul ebp, dword [ebx + 0xec0f03], 0xffffffce
push edi
xchg ebx, eax
xchg ebx, eax
jb 0x58e1a6
fsubr dword [esi + 0x41]
push cs
into
xor byte [ebx + eax*4 - 0x1e], ah
add ebx, dword [ebp + esi*4 + 0x30c52387]
push ebp
lodsb al, byte [esi]
aad 0x93
imul ebp, dword [edi - 0x36e2f1cb], 0xffffffa4
cmp byte [edx], 0xbb
sbb byte [edi - 0x67c44986], al
fisub word [ebp + 0x79]
adc cl, byte [edx]
jecxz 0x58e158
aam 0xe3
mov ebx, 0xfa8817ac
fsubr qword [edx]
xchg dword [ecx], ebx
arpl word [esi - 0x29], ax
fcom st(1)
sti
popal
stc
out 0x85, al
int 9
sub byte [ebp - 0x4c], ah
adc byte [0x9c758f54], dh
in al, 0xa
dec esp
push ebx
push edi
dec edi
in al, dx
xor ch, byte [ebx + 0x67]
pushfd
or eax, 0x418bce43
mov eax, dword [0xad782d1]
neg byte fs:[ecx - 0x508f9b72]
pushf
arpl word [ebx + 0x14faed7f], bp
mov al, 0x62
jo 0x58e1a0
invalid
inc esi
sub bl, bh
adc byte [edx], al
mov eax, 0x82c990d0
into
dec edi
stosb byte es:[edi], al
or eax, 0x61de0dc5
adc eax, dword [ebp - 7]
or dword [eax + 0x64], ebp
jns 0x58e202
add byte [edi + 0x4f], ah
push es
mov edi, 0x364d293a
jb 0x58e17b
push es
scasb al, byte es:[edi]
inc ebx
in al, 8
scasd eax, dword es:[edi]
ret
cmp esp, dword [edi + 0x4533dabe]
jmp 0x45a0d07c