joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410b00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ax, word [0x568450]
cmp ax, 0xcb
je 0x410c0c
cmp ax, 0xcc
je 0x410c0c
mov edx, dword [0x5d9070]
test edx, edx
je 0x410b35
mov eax, dword [0x5d8f20]
call edx
mov ebx, eax
jmp 0x410b3a
mov ebx, 0x5d8f24
cmp word [0x5d8f10], 0
jle 0x410b60
mov eax, 0x5d8ef0
call fcn.00410d80
mov eax, ebx
call fcn.00410680
mov eax, ebx
call fcn.00410700
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410b82
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x410b7d
mov edx, edi
mov eax, ebx
call fcn.0040fad0
jmp 0x410b80
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410b68
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5d8f10], 0
jle 0x410c0c
mov edx, 0x5d8e30
mov eax, ebx
call fcn.0040fc20
mov edi, eax
test edi, edi
je 0x410bdc
mov eax, dword [0x5d8ec4]
mov dword [edi + 0xc], eax
cmp dword [0x5d8ec4], 0
je 0x410bd0
mov eax, dword [0x5d8ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5d8ec4], eax
nop
sub word [0x5d8f10], 1
cmp word [0x5d8f10], 0
sete bl
mov eax, 0x5d8ef0
call fcn.00410da0
test bl, bl
je 0x410c0c
mov eax, 0x5d8ef0
call fcn.00410d70
lea esi, [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417010
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dx, 0xffff
add dx, 1
movsx eax, dx
mov ecx, eax
xor bx, bx
lea esi, [esi]
add bx, 1
mov eax, ecx
and eax, 1
je 0x417041
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x417043
shr ecx, 1
cmp bx, 8
jl 0x417028
movzx eax, dx
mov dword [eax*4 + 0x5fad00], ecx
cmp dx, 0xff
jl 0x417018
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
cmp dword [0x5fad04], 0
jne 0x41707c
call fcn.00417010
mov esi, esi
mov ecx, edi
not ebx
mov eax, ebx
cmp esi, 1
jl 0x4170b4
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov dl, al
xor dl, byte [ecx]
and edx, 0xff
mov edi, eax
shr edi, 8
xor edi, dword [edx*4 + 0x5fad00]
mov eax, edi
add ecx, 1
cmp esi, ebx
jg 0x417090
mov esi, esi
not eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x58c154
call fcn.0040cd60
test al, al
je 0x43c6f6
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0043c710
xor eax, eax
push fcn.0043c600
push ebp
push 0x414600
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408840
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.0043b800
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.0043b2c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0043c600
jmp 0x43c701
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0043e920
mov esp, ebp
pop ebp
ret

Function at 0x466c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, eax
xor eax, eax
lea ebx, [edx + 1]
movzx ecx, byte [edx]
add ecx, 1
and ecx, 0xff
add edx, ecx
jmp 0x466c71
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor ecx, esi
mov eax, ecx
add ebx, 1
cmp edx, ebx
ja 0x466c60
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
lea esi, [ecx - 1]
test esi, esi
jl 0x4966ac
mov edi, 0xffffffff
lea esi, [esi]
add edi, 1
mov cl, al
xor cl, byte [edx]
and ecx, 0xff
mov ebx, ecx
mov ecx, eax
shr ecx, 8
xor ecx, dword [ebx*4 + 0x5fbe50]
mov eax, ecx
add edx, 1
cmp esi, edi
jg 0x496688
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 8], eax
lea esi, [esi]
mov edx, edi
mov eax, dword [edx + 0x30]
mov ecx, dword [edx + 0x68]
sub eax, ecx
sub eax, dword [edx + 0x60]
mov dword [ebp - 4], eax
test eax, eax
jne 0x498255
mov eax, edi
cmp dword [eax + 0x60], 0
jne 0x498255
cmp dword [eax + 0x68], 0
jne 0x498255
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x498344
cmp dword [ebp - 4], 0xffffffff
jne 0x498264
sub dword [ebp - 4], 1
jmp 0x498344
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, eax
mov eax, edx
mov edx, ecx
mov esi, eax
sub edx, 0x106
sbb esi, 0
add edx, ecx
adc esi, eax
mov eax, dword [edi + 0x60]
xor ecx, ecx
cmp esi, ecx
jl 0x498295
jg 0x498344
cmp edx, eax
ja 0x498344
mov eax, dword [edi + 0x2c]
add eax, dword [ebp - 8]
mov edx, dword [edi + 0x2c]
mov ecx, dword [ebp - 8]
call fcn.00403520
mov eax, dword [ebp - 8]
sub dword [edi + 0x64], eax
mov eax, dword [ebp - 8]
sub dword [edi + 0x60], eax
mov eax, dword [ebp - 8]
sub dword [edi + 0x50], eax
mov ebx, dword [edi + 0x40]
mov eax, dword [edi + 0x38]
lea eax, [eax + ebx*2]
mov dword [ebp - 0x10], eax
lea esi, [esi]
sub dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
movzx edx, word [eax]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
ja 0x4982eb
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov word [edx], ax
jmp 0x4982f3
mov eax, dword [ebp - 0x10]
mov word [eax], 0
sub ebx, 1
jne 0x4982c8
mov ebx, dword [ebp - 8]
mov eax, dword [edi + 0x34]
lea eax, [eax + ebx*2]
mov dword [ebp - 0x10], eax
lea esi, [esi]
sub dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
movzx edx, word [eax]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
ja 0x49832b
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov word [eax], dx
jmp 0x498333
mov eax, dword [ebp - 0x10]
mov word [eax], 0
sub ebx, 1
jne 0x498308
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
lea esi, [esi]
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4983b3
mov eax, edi
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x60]
mov eax, dword [eax + 0x68]
add eax, ecx
add edx, eax
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
call fcn.00497e90
mov ebx, eax
add dword [edi + 0x68], ebx
cmp dword [edi + 0x68], 3
jb 0x49839c
mov eax, edi
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x60]
movzx eax, byte [edx + eax]
mov dword [edi + 0x3c], eax
mov eax, edi
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x60]
movzx edx, byte [edx + ecx + 1]
mov esi, dword [eax + 0x3c]
mov ecx, dword [eax + 0x4c]
shl esi, cl
xor edx, esi
and edx, dword [eax + 0x48]
mov dword [edi + 0x3c], edx
mov eax, edi
cmp dword [eax + 0x68], 0x106
jae 0x4983b3
mov eax, dword [eax]
cmp dword [eax + 4], 0
jne 0x498228
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x4b65a4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x4b666a
mov esi, esi
xor eax, eax
push 0x4b664b
push ebp
push 0x414980
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040ce50
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x58bdb0
call fcn.0043aab0
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004b6810
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.004b6880
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004b68f0
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4b6640
cmp dword [ebp - 4], 0
je 0x4b6640
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4b666a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c1180
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4c11b4
mov eax, esi
call fcn.004c55b0
cmp byte [esi + 0x40], 0
je 0x4c11ac
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4c1265
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4c1244
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4c123c
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4c11e8
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4c1200
xor bl, bl
jmp 0x4c1265
cmp edi, 2
je 0x4c123a
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4c11d8
cmp edi, 3
je 0x4c1218
cmp edi, 1
jne 0x4c11d8
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4c11d8
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4c11d8
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4c125c
cmp dword [esi + 0x14], 0xcc
je 0x4c125c
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004c15c0
lea esi, [esi]
mov eax, esi
call fcn.004c1270
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x514130
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
je 0x51414b
jmp 0x514158
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
nop
cmp dword [ebp - 0xc], 0
je 0x514160
jmp 0x514168
jmp 0x51421a
xor eax, eax
push 0x5141f7
push ebp
push 0x414980
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov edx, 0
call fcn.0040ce50
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
jne 0x5141d9
jmp 0x5141ec
cmp dword [ebp - 8], 0
jne 0x5141e1
jmp 0x5141ec
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x51421a
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x551110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x5ce8b0
call fcn.0040e660
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00551100
push ebp
push 0x414600
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x34]
mov edx, 0
call fcn.00408840
mov eax, dword [ebp - 0xc]
mov edx, fcn.004e4260
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dx, 0
call fcn.004091a0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x30]
call fcn.00408840
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.0054ef20
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005517b0
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
je 0x551215
jmp 0x551234
mov eax, dword [ebp - 4]
call fcn.00507940
test al, al
je 0x551223
jmp 0x551234
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00551100
mov esp, ebp
pop ebp
ret
Function at 0x4195ec
Capabilities:
Terminate process

Disassembly:
call fcn.004195f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x100115b0
Capabilities:
Encode data using xor

Disassembly:
dec edi
push eax
ficom word [esi + ebp*2 - 0x6a]
popal
fbld tbyte [edi]
fst dword [ebx + 0x55]
cmp dh, byte [ebx]
adc ch, byte [ebx - 0x4e82d9db]
and eax, 0xeb17d26
xor edx, dword [edx]
stosd dword es:[edi], eax
pop edi
pop ebx
je 0x100115ad
fild qword [bx + 0x4a0b]
or eax, 0x8759e7da
out 0x59, eax
xchg esp, edi
and edx, dword [edi + 0x69]
inc edx
loop 0x1001160a
push dword [ebp + 0x713ec30a]
rcr ch, 1

Function at 0x10011a80
Capabilities:
Encode data using xor

Disassembly:
jo 0x10011a78
movsb byte es:[edi], byte [esi]
std
out 0x8f, eax
or al, 0xc8
xor byte [esi - 0x55daa4aa], bl
dec esp
and dword [edi - 0x67604c90], 0xffffffa5
loope 0x10011ace
in al, 0xe6
inc ecx
fist dword [eax]
sub edi, esp
stc
jge 0x10011ac7
shl dword [edi], cl
jns 0x10011ae2
push 0x768baca2
sar dword [ecx], 1
arpl word [edi - 0x6f], si
lodsb al, byte [esi]
mov esi, dword [esi - 0x2f]
cmp dword [ebx + 0x77], esp
xchg ecx, eax
invalid

Function at 0x10011e60
Capabilities:
Encode data using xor

Disassembly:
or dword [ecx], edi
test dword ds:[ebp - 0xeabf3a6], ecx
mov ecx, 0xe0f220ff
or ebp, dword [eax]
cdq
adc ebp, esi
lcall 0x6e69, 0x8f753c44
pop ebp
leave
push ebx
rcl byte [esi + 0x17], 0x1e
push esi
pop ss
push ds
rcr dword [ebp + ecx*4 - 0x7090b5ac], 1
loopne 0x10011e02
xchg si, ax
invalid
cmpsb byte [esi], byte es:[edi]

Function at 0x10011f30
Capabilities:
Encode data using xor

Disassembly:
invalid
jne 0x10011e96
lahf
int1
lea ecx, [0xfce8e6ec]
cld
lcall 0x4bd7, 0x823497f
idiv byte [edi - 0x1899c789]
movsd dword es:[edi], dword [esi]
mov esi, 0x1c8e5c4d
ja 0x10011f43
xchg edi, eax
xchg edi, eax
enter 0xfffffffffffffb6a, 0xffffffffffffffc6
jns 0x10011ec9
xor al, 0xb3
nop
js 0x10011ede
pushal
sbb eax, 0x4cc131d2
mov eax, 0x2eed9fde
in eax, dx
fdiv st(5)
lahf
dec edi
vmaxss xmm0, xmm6, dword [edx - 0x747d6c0b]
jns 0x10011f44
mov dl, 0x11
jp 0x10011ec3
add byte [eax + 0x26], 0x46
inc eax
inc esi
clc
ja 0x10011f2f
salc
jns 0x10011f6e
invalid

Function at 0x100133c0
Capabilities:
Encode data using xor

Disassembly:
xor al, dl
xchg ebx, eax
push ds
dec edi
or dword [ebx + 0x3a77da8f], ecx
cdq
and al, cl
mov ebp, 0x837ee0b
out dx, al
aaa
or byte [edx], ch
lahf
ja 0x100133c4
pop eax
scasd eax, dword es:[edi]
je 0x100133ba
pop edx
push ss
sbb bh, dh

Function at 0x10013670
Capabilities:
Encode data using xor

Disassembly:
or esi, edx
jp 0x100135fe
mov dh, 0x1a
in al, 0x51
sbb eax, esi
invalid

Function at 0x10013740
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
mov es, word [edi + 0x56c54d1b]
fisub word [edi]
out dx, eax
jns 0x100136b5
jbe 0x100136dd

Function at 0x10014400
Capabilities:
Encode data using xor

Disassembly:
ret
xor ebx, dword [ebp - 0x6c65404a]
mov esi, gs
xchg esi, eax
js 0x100143fa
push esp
dec ecx
invalid
push ebp
pop eax
Function at 0x133b6c74
Capabilities:
Encode data using xor

Disassembly:
jmp 0x133b6c7e
pushal
call 0x133b6c84
pop ebp
sub ebp, 0x10
sub ebp, 0x33b6c74
mov al, byte [esp + 0x28]
cmp al, 1
je 0x133b6ca8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x133b6cb1
mov eax, 0x33b6c74
add eax, ebp
add eax, 0x63
mov ecx, 0x5d4
mov edx, 0xa1b0db5c
xor byte [eax], dl
inc eax
dec ecx
jne 0x133b6cc8
jmp 0x133b6cdb
imul edx, edi, 0xffffff91
xlatb
xchg ecx, eax
xlatb
aad 0x60
pop esp
pop esp
pop esp
fstp qword [ebp + 0x5c5c5ca4]
pop edi
xchg ecx, eax
in al, 0x54
pop esp
pop esp
pop esp
out 0x74, al
pop esp
pop esp
pop esp
stosd dword es:[edi], eax
mov esi, 0xddd7945f
push eax
pop esp
pop esp
pop esp
pop edi
cdq
sar dword [eax], 1
js 0x133b6ca5
aad 0x58
js 0x133b6cda
cmp byte [eax - 0x60], bh
aad 0x58
js 0x133b6d44
rcr bh, 0xff
pop esp
xor al, 0x84
mov ah, 0xcb
pop esi
pop ebp
jo 0x133b6d94
xor al, 0x87
mov cl, 0xe9
inc esp
mov ah, 0x59
pop esp
pop esp
pop esp
mov ch, 0x6c
pop esp
pop esp
pop esp
or ecx, edx
xor byte [eax + 0x5c], bh
xlatb
fst dword [esp + ebx*2 + 0x5c]
pop esp
xlatb
leave
push eax
pop esp
pop esp
pop esp
xlatb
ror dword [esp + ebx*2 + 0x5c], 1
pop esp
popfd
mov ch, 0x5e
pop esi
insd dword es:[edi], dx
pop esi
fistp word [esi - 0x26aceaa8]
test al, 0xa3
mov dword [0x7870d7a3], eax
sar dword [eax], 1
js 0x133b6db0
sahf
push eax
pop esp
xlatb
sar byte [eax + 0x58], 1
pop esp
pop esp
pop esp
xor al, 0xc0
invalid
invalid
adc bl, byte [esp + ebx*2 + 0x5c]
push ebx
aam 0x14
pop esp
pop esp
pop esp
cmp dl, bh
inc eax
fsub qword gs:[edi + 0x46d853b4]
pop esp
pop esp
pop esp
fsub qword [edi + 0x4dd853b5]
pop esp
pop esp
pop esp
cmp bl, ch
cmpsd dword [esi], dword es:[edi]
mov dword [0x49d85379], eax
pop esp
pop esp
pop esp
sbb eax, 0xa3a390b5
mov dword [0x5d651075], eax
fistp word [ebp + 0x58b4df59]
mov ch, 0xe1
mov dword [0x875a3a3], eax
pop esi
fistp word [ebp + 0x58b6df5a]
fbstp tbyte [ecx + ebx*2 - 0x5c5c084b]
mov dword [0x5c509e01], eax
or edi, edx
mov al, 0xa
or ecx, dword [ecx]
xlatb
sub dword [eax - 0x29], edx
and dword [eax - 0x12], edx
invalid
Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
sub ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
push esi
pop edi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
push edi
pop ecx
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x5563e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
je 0x4b6646
ror dh, cl
sal si, cl
sbb si, bx
mov esi, dword [eax + 0x3c]
test sp, 0x8a05
add esi, eax
setne dh
mov edx, dword [esi + 0x78]
jmp 0x55d41a