joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409990
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x47cbeb
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x49d7b0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49d7b0]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x14]
call fcn.00406a30
push 0
push 0x1a
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x150], 0
mov ebp, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0
call ebp
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x18]
call fcn.00406a60
mov eax, dword [0x49ed14]
push eax
mov esi, eax
call fcn.004019f0
add esp, 4
mov ebx, eax
push esi
lea eax, [esp + 0x18]
call fcn.0040a0f0
lea ecx, [esp + 0x14]
call fcn.00401dd0
mov esi, eax
call fcn.00409ab0
push 0
push 0x1c
lea edx, [esp + 0x38]
push edx
push 0
call ebp
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.00406a60
mov eax, dword [0x49ed18]
push eax
mov esi, eax
call fcn.004019f0
add esp, 4
mov ebx, eax
push esi
lea eax, [esp + 0x18]
call fcn.0040a0f0
lea ecx, [esp + 0x14]
call fcn.00401dd0
mov esi, eax
call fcn.00409ab0
lea ecx, [esp + 0x14]
call fcn.00401db0
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0043bced
add esp, 0x134
ret
Function at 0x409b80
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47cb63
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x49d7b0]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49d7b0]
xor eax, esp
push eax
lea eax, [esp + 0x178]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1a4]
lea eax, [esp + 0x188]
push eax
mov esi, 0x48d4cc
lea edi, [esp + 0x1c]
mov dword [esp + 0x184], 0
call fcn.0040a180
add esp, 4
lea ecx, [esp + 0x34]
push ecx
mov ecx, eax
call fcn.00401dd0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, edi
mov esi, eax
call fcn.00401db0
cmp esi, 0xffffffff
jne 0x409c1a
lea ecx, [esp + 0x188]
call fcn.00401db0
xor al, al
jmp 0x409cd0
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov bl, 0x10
test byte [esp + 0x34], bl
je 0x409c44
lea eax, [esp + 0x60]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409c30
sub eax, edx
cmp eax, 8
je 0x409cfa
lea edx, [esp + 0x34]
push edx
push esi
call edi
test eax, eax
jne 0x409c22
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x190]
push eax
mov ecx, ebp
call fcn.00401f30
push 0x48d4d0
call fcn.004019f0
add esp, 4
mov ebx, eax
push 0x48d4d0
mov eax, ebp
call fcn.0040a0f0
lea esi, [esp + 0x18]
call fcn.00410780
push 0
push eax
or eax, 0xffffffff
mov esi, ebp
mov byte [esp + 0x188], 1
call fcn.004098e0
lea ecx, [esp + 0x18]
call fcn.00401db0
push 0
mov ecx, ebp
call fcn.00401dd0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
lea ecx, [esp + 0x188]
sete bl
call fcn.00401db0
mov al, bl
mov ecx, dword [esp + 0x178]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.0043bced
add esp, 0x170
ret 0x20
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x190]
push eax
mov ecx, ebp
call fcn.00401f30
push 0x48d4d0
call fcn.004019f0
add esp, 4
mov ebx, eax
push 0x48d4d0
mov eax, ebp
call fcn.0040a0f0
lea ecx, [esp + 0x60]
push ecx
call fcn.004019f0
add esp, 4
lea edx, [esp + 0x60]
mov ebx, eax
push edx
mov eax, ebp
call fcn.0040a0f0
lea ecx, [esp + 0x188]
call fcn.00401db0
mov al, 1
jmp 0x409cd0
Function at 0x40bd90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x47d097
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49d7b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x48d5f0
mov dword [edi + 0x58], 0x48d55c
lea esi, [edi + 8]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.0040cde0
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], 0x48d5ec
call fcn.0040d7b0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], 0x48d5b0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x4a26d8]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x40d7b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x47a0eb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49d7b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], 0x48d564
call fcn.004593b2
push 4
mov dword [esp + 0x20], 0
call fcn.0041dd23
mov edi, eax
add esp, 4
test edi, edi
je 0x40d830
call fcn.004590d9
mov dword [edi], eax
call fcn.00458f0d
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00459215
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40d825
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00459236
jmp 0x40d832
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40eb00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47d178
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x49d7b0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0xc]
call fcn.00402310
mov ecx, dword [esp + 0x34]
push eax
mov dword [esp + 0x30], 0
call fcn.0040e9a0
lea ecx, [esp + 8]
mov esi, eax
call fcn.00401db0
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 8

Function at 0x40f2a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47cf82
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49d7b0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
push edi
mov eax, esi
call fcn.004102f0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00408300
test esi, esi
mov dword [esp + 0x18], ebx
jne 0x40f2eb
call fcn.0043c1ce
mov ebp, dword [esi + 4]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.00408300
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], esi
je 0x40f30f
cmp eax, esi
je 0x40f314
call fcn.0043c1ce
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x20]
je 0x40f32e
add eax, 0x10
call fcn.00409880
test eax, eax
jge 0x40f3b6
xor eax, eax
mov ebp, 0x48d71c
mov ebx, 1
mov dword [esp + 0x24], ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x80], eax
lea eax, [esp + 0x24]
push eax
push edi
lea ecx, [esp + 0x44]
push ecx
call fcn.0040fb30
mov byte [esp + 0x80], bl
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push edx
mov eax, esi
call fcn.0040f5e0
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 4]
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x1c], edx
mov byte [esp + 0x84], 0
call fcn.0040f580
mov dword [esp + 0x80], 0xffffffff
lea esi, [esp + 0x24]
mov dword [esp + 0x24], ebp
call fcn.0040e0e0
cmp dword [esp + 0x14], 0
jne 0x40f3c2
call fcn.0043c1ce
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp eax, dword [ecx + 4]
jne 0x40f3d8
call fcn.0043c1ce
mov eax, dword [esp + 0x18]
add eax, 0x30
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
Function at 0x410860
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x47c3a1
mov eax, dword fs:[0]
push eax
mov eax, dword [0x49d7b0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax], 0x48d780
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x4114a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x47d3a8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x49d7b0]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49d7b0]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x94]
mov eax, dword [ebp + 0x10]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov ebx, edx
mov edx, ecx
sub edx, eax
cmp edx, 1
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebx
jb 0x411675
mov edx, dword [ebp + 4]
cmp byte [eax + edx], 9
jne 0x411675
add eax, 1
cmp eax, ecx
mov dword [ebp + 0x10], eax
jne 0x41151a
xor eax, eax
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], eax
lea edi, [esp + 0x34]
mov ecx, ebp
call fcn.00412760
test al, al
je 0x411675
mov eax, dword [esp + 0x34]
test al, 1
jne 0x411559
mov edi, eax
shr edi, 1
add esi, 4
call fcn.004129b0
mov esi, ebx
mov edi, eax
call fcn.0040e0e0
push ebx
mov ecx, edi
call fcn.0040f170
mov al, 1
jmp 0x411677
xor eax, eax
mov edi, 0x48d71c
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x14]
push eax
push ebp
lea ebx, [esp + 0x24]
mov dword [esp + 0x94], eax
call fcn.00411050
test al, al
je 0x41165d
cmp dword [esp + 0x24], 0x11
jne 0x4115b7
mov edi, dword [esp + 0x2c]
push 0x48d439
call fcn.004106e0
add esp, 4
test al, al
jne 0x41169b
mov edi, 0x48d71c
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x3c]
call fcn.0040e740
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0x90], 1
call fcn.00401d70
mov ecx, dword [esp + 0x18]
push eax
mov byte [esp + 0x90], 2
call fcn.0040e9a0
mov ecx, dword [esp + 0x14]
push eax
push ebp
call fcn.00410970
test al, al
lea ecx, [esp + 0x54]
sete bl
call fcn.00401db0
lea ecx, [esp + 0x38]
call fcn.00401db0
mov dword [esp + 0x8c], 0xffffffff
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.0040e0e0
test bl, bl
jne 0x411675
xor eax, eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x14]
push eax
push ebp
mov ebx, esi
mov dword [esp + 0x94], eax
call fcn.00411050
test al, al
jne 0x411592
mov dword [esp + 0x8c], 0xffffffff
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.0040e0e0
xor al, al
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0043bced
add esp, 0x7c
ret 4
mov dword [esp + 0x8c], 0xffffffff
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 0x48d71c
call fcn.0040e0e0
mov eax, dword [esp + 0x34]
shr eax, 1
mov edi, eax
mov esi, 0
je 0x411703
push esi
push str.s5be
lea edx, [esp + 0x78]
call fcn.004106c0
mov ebx, dword [esp + 0x20]
add esp, 8
lea edx, [esp + 0x70]
push edx
push ebx
call fcn.0040eb00
mov ecx, dword [esp + 0x14]
push eax
push ebp
call fcn.00410970
test al, al
je 0x411675
add esi, 1
cmp esi, edi
jb 0x4116c6
jmp 0x411707
mov ebx, dword [esp + 0x18]
push 1
mov esi, ebx
call fcn.0040f0f0
mov esi, dword [esp + 0x14]
add esi, 4
call fcn.004129e0
mov al, 1
jmp 0x411677
Function at 0x4160f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47c289
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x49d7b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov esi, 1
push 0x48d439
mov ecx, edi
mov dword [esp + 0x3c], esi
call fcn.00402310
sub esp, 0x1c
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [esp + 0x24], esi
push eax
lea esi, [esp + 0x7c]
call fcn.00401d70
mov ecx, esi
lea esi, [esp + 0x30]
call fcn.004161a0
add esp, 0x1c
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
mov byte [esp + 0x44], 2
call fcn.00401f30
mov ecx, esi
call fcn.00401db0
lea ecx, [esp + 0x40]
call fcn.00401db0
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret

Function at 0x416c90
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x416cf2
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
cmp esi, 0x400000
mov eax, 0x400000
ja 0x416cbf
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x416cf7
test ecx, ecx
je 0x416cf0
test esi, esi
ja 0x416cb0
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x41d710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x41d729
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
jmp 0x41d750
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x41d76f
jmp 0x41d760
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x41d76f
add edi, 1
cmp edi, edx
jb 0x41d760
mov eax, edi
sub eax, ecx
mov ecx, eax
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x41d885
cmp ecx, 3
jbe 0x41d7a5
xor ebp, ebp
mov cl, byte [edi + 4]
test cl, cl
mov dword [esp + 0x1c], eax
je 0x41d7e3
cmp cl, 0xff
je 0x41d7e3
and ebp, 3
add ebp, ebp
or ebp, 1
add eax, 1
jmp 0x41d750
add ecx, 0xffffffff
shl ebp, cl
and ebp, 7
je 0x41d788
movzx ecx, byte [ebp + 0x47e944]
mov ebx, edi
sub ebx, ecx
cmp byte [ebp + 0x47e93c], 0
mov cl, byte [ebx + 4]
je 0x41d7cf
test cl, cl
je 0x41d7cf
cmp cl, 0xff
jne 0x41d788
and ebp, 3
add ebp, ebp
mov dword [esp + 0x1c], eax
or ebp, 1
add eax, 1
jmp 0x41d750
xor edx, edx
mov dh, cl
movzx ecx, byte [edi + 2]
mov dl, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
lea esp, [esp]
cmp dword [esp + 0x28], 0
je 0x41d80e
lea ebx, [edx + eax]
add ebx, esi
jmp 0x41d814
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x41d856
movzx esi, byte [ebp + 0x47e944]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x41d839
cmp dl, 0xff
jne 0x41d852
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
sub edx, 1
xor edx, ebx
jmp 0x41d800
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
sub dl, 1
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x41d750
cmp ecx, 3
pop edi
pop esi
pop ebx
jbe 0x41d898
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
add ecx, 0xffffffff
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret

Function at 0x4265b9
Capabilities:
Encode data using xor

Disassembly:
test al, 0xbd
and byte [ebx + 0x1e7a4d83], ch
dec ebp
jp 0x4265da
dec ebp
jp 0x4265da
xchg edx, eax
dec edi
pop edx
push 0x54e8941b
xchg edx, eax
in al, dx
pop ds
les ecx, [edx - 0x40]
fild word [eax]
mov ah, 0x38
andnps xmm0, xmmword [eax - 0x34a380ae]
cwde
out 0xa5, eax
pop ebx
xor byte [ebx - 0x74], dl
push cs
push ebx
mov word [esi], cs
mov al, byte [0x42578b3c]
jb 0x4265b4
mov word [edx - 0x8c4a7df], cs
jmp 0x7d428c4d

Function at 0x429a88
Capabilities:
Encode data using xor

Disassembly:
adc byte [ecx - 0x3b7d10a1], al
mov ah, 0xaa
outsd dx, dword [esi]
push 0x8656f906
insd dword es:[edi], dx
popfd
test cl, bl
mov eax, 0x7c35d092
adc bl, byte [ecx*8 + 0x6e72a65d]
pop esi
mov edi, 0x6412616e
jecxz 0x429aa8
cli
cld
invalid
Function at 0x42ac79
Capabilities:
Encode data using xor

Disassembly:
add byte [edi + 0x18], bl
mov al, byte [0x17866870]
invalid

Function at 0x43bced
Capabilities:
Encode data using xor

Disassembly:
shr byte [ecx - 0x18], 1
mov cl, 0xbd
xor esp, dword [ebx + ebp*4 - 0x3a]
mov ebp, 0xc6ab6433
xor dword [esi + 0x1f], 0xffffffb9
insb byte es:[edi], dx
sahf
mov cl, 0x68
pop ecx
out 0x9a, eax
xlatb
fadd dword [ecx + 0x16]
mov cl, byte [ecx + 9]
jne 0x43bc62
sub al, 0xc3
clc
test esp, edx
int1
in eax, dx
invalid
mov esp, 0x870e8d39
je 0x43bc5e
sar byte [edi + 0x29387719], 0xc9
xlatb
inc eax
sub al, byte [edi + 0x4e39b3c5]
xlatb
fdivp st(3)
fldenv [esi]
jecxz 0x43bcc4
rcl byte [ecx + 0x6a2baaf7], cl
push cs
jae 0x43bcea
or eax, 0x461392e0
popfd
or bl, byte [edx - 0x30]
mov word [esi], gs
daa
push ss
pop ebx
pop eax
ror byte [esi + ebp + 0x585b1627], 1
pop es
insd dword es:[edi], dx
adc eax, 0x100be868
test al, 0x37
dec eax
pop edi
dec ebx
or al, 0x81
add dword [esi - 0x980065c], 0xabc4fee1
out dx, al
std
mov eax, dword [0x338c3ca4]
jbe 0x43bcab
add dword [esi - 0x980065c], 0xabc4fee1
out dx, al
std
mov eax, dword [0x338c3ca4]
jbe 0x43bcab
push cs
in al, 0x9c
dec ebx
mov cl, 0x5c
mov fs, ebx
dec ecx
nop
add al, 0xc7
mov dh, byte [eax]
loopne 0x43bcd9
adc dword [eax + 0x28991eec], 0x11
ret 0x9381

Function at 0x43c295
Capabilities:
Encode data using xor

Disassembly:
out 0xa4, al
movsb byte es:[edi], byte [esi]
jg 0x43c227
dec edi
cmc
fiadd dword [edx + 0x3bdc61d]
shr dword [edi + ecx*4 + 0x29], 1
pop esp
dec dword [edx]
push ss
sub ah, ah
enter 0xffffffffffffb800, 0xffffffffffffffce
add byte [eax - 0x3484232], bh
xor esp, esi
dec eax
popal
pushfd
das
inc edi
pop ss
and byte [edx + 0xb], bh
and byte [ebx - 0x10], cl
invalid
fdiv st(2)
inc ebp
xor byte [ebx], ah
cdq
mov dh, 0xff
adc cl, byte [0x40574a68]
salc
mov esi, 0xefb0cc49
out dx, eax
out dx, eax
adc edx, ebx
jg 0x43c282
lodsd eax, dword [esi]
xchg esp, eax
jb 0x43c226
xchg ebx, eax
mov eax, 0xca8be223
aaa
stc
invalid
Function at 0x43e86f
Capabilities:
Encode data using xor

Disassembly:
or byte [eax + esi - 0x7c], ch
rol bh, 0xad
enter 0xffffffffffffd19d, 0xffffffffffffffad
fisttp qword [ebx - 0x1dad2ffa]
fimul dword [edx + 0x2a2a161a]
jno 0x43e7cf
cmp al, 0xa5
xchg ebx, eax
xchg byte [edi + 0x5f], dl
push edi
pop edi
stosb byte es:[edi], al
insd dword es:[edi], dx
xchg esp, eax
dec edx
call 0xe649e3a3
sub dword [ecx], edi
pop ecx
xchg esi, eax
clc
push ds
mov word [esi - 0x24], gs
and edi, dword [ebx]
dec esi
sti
sbb byte [edi + 0x4a], dh
daa
ja 0x43e838
xor byte [ecx + 0x4b48aa6e], 0x67
mov eax, 0x8c59d1c2
rcr dword [ecx - 0x74], 1
or ch, byte [edi + 0x2e]
inc ecx
ror dword [0xa286bf21], 0xf6
jns 0x43e84b
in al, 0x78
arpl word [esi], cx
and ebp, ecx
movsd dword es:[edi], dword [esi]
jns 0x43e7b2
mov edx, 0x84e71da8
push es
cmpsd dword [esi], dword es:[edi]
fiadd word [ecx + 0x33]
sub ah, dl
insd dword es:[edi], dx
lea edx, [esi]
loope 0x43e7bd
push ebp
and ebp, dword [ebx - 0x1de1f243]
imul edi, dword [ebp + 0x24d4dd5b], 0xffffffcf
push ds
push edi
jp 0x43e7bd
invalid
call 0xb93aa2c3
xor byte [edx - 0x37], dh
invalid
mov edx, 0xd8313b01
jae 0x43e830
leave
int1
jp 0x43e87c
mov ss, word [edi - 0x7e]
iretd
jg 0x43e879
insb byte es:[edi], dx
sahf
daa
rcr byte [edx], 1
dec esi
stc
stosb byte es:[edi], al
stosb byte es:[edi], al
mov dword [0xd19dd36], eax
sar eax, cl
bound eax, qword [eax - 0x315c769e]
pop ss
bound edx, qword [ebp - 0x2c1ae67]
fstp qword [ecx]
or eax, 0x8062f8d3
bound ecx, qword [ecx + 0x6217cea3]
xchg ebp, eax
cdq
push ecx
std
xchg esi, eax
neg bh
push edx
push 0x76
xor ebx, 0x5e
xor dword [0x7c1d21b0], ebx
nop
and cl, al
jbe 0x43e87a
test al, 0xb2
jp 0x43e828
ljmp 0xb14:0x2b29ab0e