joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x408943
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.0040896b
inc ebx
xor dword [edi], edx
inc edi
add ebx, 0xab2aad8b
cmp edi, eax
jne fcn.00408943
sub ebx, esi
and esi, esi
ret
Function at 0x20c0ee4c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x20c0ee56
pushal
call 0x20c0ee5c
pop ebp
sub ebp, 0x10
sub ebp, 0xc0ee4c
mov al, byte [esp + 0x28]
cmp al, 1
je 0x20c0ee80
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x20c0ee89
mov eax, 0xc0ee4c
add eax, ebp
add eax, 0x63
mov ecx, 0x5ca
mov edx, 0x3961d7f3
xor byte [eax], dl
inc eax
dec ecx
jne 0x20c0eea0
jmp 0x20c0eeb3
js 0x20c0eef3
js 0x20c0ef31
iretd
ret
wait
mov ebx, 0x9bf3ec2f
in al, dx
wait
int1
loope 0x20c0ef89
invalid
idiv byte [ebx - 0xc428804]
mov ebx, 0xf3bd77fc
ja 0x20c0ef2e
cld
cld
jnp 0x20c0ef32
xchg ebp, eax
js 0x20c0ef6c
retf 0x873
jae 0x20c0ef88
sbb edi, esp
ja 0x20c0ef6d
jae 0x20c0ef91
or byte [edx], bl
cld
sbb bh, ah
ja 0x20c0ef6f
xchg ebp, eax
jb 0x20c0ef9b
or al, 0xd6
cld
ja 0x20c0ef7e
mov dl, 0x1a
mov dl, 0x1a
aas
or al, 0xc
or al, 0xda
mov edi, 0x3270f2ca
div byte [eax + 0x1b]
neg dword [edx]
dec esi
or al, 0xc
or al, 0xda
cmpsd dword [esi], dword es:[edi]
retf 0x70f1
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x79b92693
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xd820c89
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, reloc.gdi32.dll_SelectObject
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x315b66a8
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x1a9863ef
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4016ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, esi
add ebx, 0xc8
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov edx, esi
shl edx, cl
mov eax, edi
add eax, edx
cdq
idiv ebx
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
jmp 0x4017bd
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
jmp 0x40173f
add dword [ebp - 0xc], ebx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x10], eax
jl 0x401739
mov ecx, dword [ebp - 8]
cmp eax, ecx
jne 0x401758
mov eax, dword [ebp + 0xc]
or eax, esi
mov ebx, eax
sub ebx, dword [ebp - 0xc]
or ebx, ebx
je 0x4017cf
and dword [ebp - 0x14], 0
push ebx
push dword [ebp - 0xc]
push esi
call fcn.004016c5
mov dword [ebp - 0x18], eax
push ebx
push dword [ebp - 0xc]
push esi
call fcn.004016c5
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 8]
mov edx, eax
xor edx, esi
add edx, edi
push edx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, esi
mov dword [ebp - 0x20], eax
mov ecx, edx
or cl, 1
cdq
idiv ecx
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x24]
mov ecx, eax
add ecx, edx
mov edx, ecx
add edx, edi
push edx
call fcn.004016ab
add esp, 0x20
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x7e8
jl 0x401760
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, esi
inc ecx
cdq
idiv ecx
cmp dword [ebp - 4], eax
jle 0x40172f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4026ff
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40273e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40273e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40273e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40273e
cmp dword [ecx + 0x74], 0xe
jbe 0x40273e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x408931
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
mov edi, dword [esp]
add esp, 4
sub eax, 0x625d7611
call fcn.00408964
dec edx
xor dword [ecx], edi
mov eax, edx
push 0xd7060ca4
mov eax, dword [esp]
add esp, 4
inc ecx
mov eax, eax
cmp ecx, ebx
jne fcn.00408931
add edx, eax
dec eax
ret
Function at 0x419460
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc0
lea eax, [esp]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x4d0b40
mov edi, eax
call fcn.00419410
add esp, 4
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0xcc]
mov eax, dword [esp + 0x12]
mov ecx, dword [esp + 0x14]
and edx, 0xffff
and eax, 0xffff
mov dword [esi], edx
lea edx, [esp + 0x18]
and ecx, 0xffff
push edx
push edi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 0xe]
mov edx, dword [esp + 0xa]
and ecx, 0xffff
and edx, 0xffff
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 8]
and ecx, 0xffff
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0xc4]
test eax, eax
lea edi, [edx + ecx]
je 0x419516
mov edx, dword [0x4d096c]
push 0x4d0670
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, edi
pop edi
cdq
mov ecx, eax
mov eax, 0x88888889
xor ecx, edx
sub ecx, edx
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esi + 0x18], edx
lea eax, [edx + edx*2]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x18]
shl edx, 2
sub ecx, edx
xor edx, edx
invalid
dec esi

Function at 0x4196b0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.d3d10.dll
pushal
ror byte [eax + eax - 1], cl
salc
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d1ba0], eax
invalid
test eax, eax
je 0x419700
push 0x4d0b40
call fcn.00419460
mov eax, dword [0x4d1ba0]
add esp, 4
push str.D3D10CreateStateBlock
push eax
call edi
mov ecx, dword [0x4d1ba0]
push str.D3D10CreateDevice
push ecx
mov dword [0x4d1bac], eax
call edi
mov dword [0x4d1b80], eax
push str.d3dx10.dll
call esi
test eax, eax
mov dword [0x4d1364], eax
je 0x419730
push str.D3DXMatrixPerspectiveFovLH
push eax
call edi
mov edx, dword [0x4d1364]
push str.D3DXMatrixLookAtLH
push edx
mov dword [0x4d0a98], eax
call edi
mov dword [0x4d0a94], eax
or cl, byte [ebp]
push str.dxgi.dll
Function at 0x436979
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xff
inc dword [eax]
add byte [eax], al
push ebp
mov ebp, esp
and al, byte [eax]
push 0
push ebx
push esi
push edi
push edx
push eax
add byte [eax], al
xor edi, edi
push 0
mov ecx, dword [ebx]
add al, 0x85
leave
je 0x4369d1
add word [eax], 0
add dword [esp - 0x77], esi
mov byte [edi], 0
xchg ebp, eax
add al, 0xe8
sub byte [edx], al
add byte [eax], al
add byte [eax], al
lea eax, [ebp + edx*4 + 4]
mov edi, esp
add al, ch
cld
invalid
xor eax, eax
jmp 0x436a2d
add byte [ebp - 0x57], dh
test edi, edi
je 0x436a4f
mov dword [eax], eax
add byte [ebp - 0x1c], al
mov esi, dword [edi - 4]
dec edx
add byte [edi - 0xc], cl
call fcn.00436e51
add byte [eax], al
in al, 0xff
aaa
add esi, dword [edi]
mov ecx, 0x558b0b00
cld
mov edx, dword [ebp - 4]
call fcn.004464b1
push eax
mov esi, eax
mov eax, dword [ecx + esi*2]
test eax, eax
je 0x436a72
mov edx, esi
test dword [eax], eax
add byte [edx], cl
mov ecx, dword [eax - 4]
add dword [eax + eax + 0x2f], ebx
sar edi, cl
dec dword [ebx + 0x75]
in eax, 0
add al, ch
mov eax, edx
neg eax
dec ebx
jne 0x436a5a
add byte [eax], al
call 0xd93b3b05
lds eax, [eax]
test esp, esp
call fcn.004363e9
add byte [eax], al
inc ebp
in al, 0x85
push dword [ebp + 0xb]
add dl, dl
je 0x436a94
dec dword [edx - 8]
call fcn.00426a99
mov edx, dword [ebp - 0x18]
add dword [eax], eax
xchg esp, eax
pop eax
pop edx
pop edi
pop esi
pop ebx
pop eax
add byte [eax], al
pop eax
lea esp, [esp + edx*4]
dec dword [ecx]
pmulhuw mm7, mm7
inc ebx
mov eax, eax
add byte [eax], al
je 0x436af8
test eax, edx
je 0x436b0b
add byte [eax - 0xa], bh
add dword [ebp + 0x5e], esi
cmp byte [edx], 0
jne 0x436b35
movzx ecx, word [eax]
cmp dword [eax], eax
add byte [edx], cl
jne 0x436b0c
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
xor dword [edx + 0x2bd92100], 0x48
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esi + ebp*8]
add byte [edx], cl
add ecx, 4
js 0x436ae7
pop eax
add byte [eax], al
pop ebx
ret
ret
add byte [eax], al
push eax
lea eax, [esp + 4]
lodsd eax, dword [esi]
add byte [edx], cl
add byte [eax], al
pop eax
mov edx, dword [esp]
add byte [eax], al
invalid
Function at 0x44ee79
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xff
inc dword [eax]
add byte [eax], al
push ebp
mov ebp, esp
and al, byte [eax]
push 0
push ebx
push esi
push edi
push edx
push eax
add byte [eax], al
xor edi, edi
push 0
mov ecx, dword [ebx]
add al, 0x85
leave
je 0x44eed1
add word [eax], 0
add dword [esp - 0x77], esi
mov byte [edi], 0
xchg ebp, eax
add al, 0xe8
sub byte [edx], al
add byte [eax], al
add byte [eax], al
lea eax, [ebp + edx*4 + 4]
mov edi, esp
add al, ch
cld
invalid
xor eax, eax
jmp 0x44ef2d
add byte [ebp - 0x57], dh
test edi, edi
je 0x44ef4f
mov dword [eax], eax
add byte [ebp - 0x1c], al
mov esi, dword [edi - 4]
dec edx
add byte [edi - 0xc], cl
call fcn.0044f351
add byte [eax], al
in al, 0xff
aaa
add esi, dword [edi]
mov ecx, 0x558b0b00
cld
mov edx, dword [ebp - 4]
call fcn.0045e9b1
push eax
mov esi, eax
mov eax, dword [ecx + esi*2]
test eax, eax
je 0x44ef72
mov edx, esi
test dword [eax], eax
add byte [edx], cl
mov ecx, dword [eax - 4]
add dword [eax + eax + 0x2f], ebx
sar edi, cl
dec dword [ebx + 0x75]
in eax, 0
add al, ch
mov eax, edx
neg eax
dec ebx
jne 0x44ef5a
add byte [eax], al
call 0xd93cc005
lds eax, [eax]
test esp, esp
call fcn.0044e8e9
add byte [eax], al
inc ebp
in al, 0x85
push dword [ebp + 0xb]
add dl, dl
je 0x44ef94
dec dword [edx - 8]
call fcn.0043ef99
mov edx, dword [ebp - 0x18]
add dword [eax], eax
xchg esp, eax
pop eax
pop edx
pop edi
pop esi
pop ebx
pop eax
add byte [eax], al
pop eax
lea esp, [esp + edx*4]
dec dword [ecx]
pmulhuw mm7, mm7
inc ebx
mov eax, eax
add byte [eax], al
je 0x44eff8
test eax, edx
je 0x44f00b
add byte [eax - 0xa], bh
add dword [ebp + 0x5e], esi
cmp byte [edx], 0
jne 0x44f035
movzx ecx, word [eax]
cmp dword [eax], eax
add byte [edx], cl
jne 0x44f00c
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
xor dword [edx + 0x2bd92100], 0x48
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esi + ebp*8]
add byte [edx], cl
add ecx, 4
js 0x44efe7
pop eax
add byte [eax], al
pop ebx
ret
ret
add byte [eax], al
push eax
lea eax, [esp + 4]
lodsd eax, dword [esi]
add byte [edx], cl
add byte [eax], al
pop eax
mov edx, dword [esp]
add byte [eax], al
invalid
Function at 0x4672e9
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xff
inc dword [eax]
add byte [eax], al
push ebp
mov ebp, esp
and al, byte [eax]
push 0
push ebx
push esi
push edi
push edx
push eax
add byte [eax], al
xor edi, edi
push 0
mov ecx, dword [ebx]
add al, 0x85
leave
je 0x467341
add word [eax], 0
add dword [esp - 0x77], esi
mov byte [edi], 0
xchg ebp, eax
add al, 0xe8
sub byte [edx], al
add byte [eax], al
add byte [eax], al
lea eax, [ebp + edx*4 + 4]
mov edi, esp
add al, ch
cld
invalid
xor eax, eax
jmp 0x46739d
add byte [ebp - 0x57], dh
test edi, edi
je 0x4673bf
mov dword [eax], eax
add byte [ebp - 0x1c], al
mov esi, dword [edi - 4]
dec edx
add byte [edi - 0xc], cl
call fcn.004677c1
add byte [eax], al
in al, 0xff
aaa
add esi, dword [edi]
mov ecx, 0x558b0b00
cld
mov edx, dword [ebp - 4]
call fcn.00476e21
push eax
mov esi, eax
mov eax, dword [ecx + esi*2]
test eax, eax
je 0x4673e2
mov edx, esi
test dword [eax], eax
add byte [edx], cl
mov ecx, dword [eax - 4]
add dword [eax + eax + 0x2f], ebx
sar edi, cl
dec dword [ebx + 0x75]
in eax, 0
add al, ch
mov eax, edx
neg eax
dec ebx
jne 0x4673ca
add byte [eax], al
call 0xd93e4475
lds eax, [eax]
test esp, esp
call fcn.00466d59
add byte [eax], al
inc ebp
in al, 0x85
push dword [ebp + 0xb]
add dl, dl
je 0x467404
dec dword [edx - 8]
call int.00457409
mov edx, dword [ebp - 0x18]
add dword [eax], eax
xchg esp, eax
pop eax
pop edx
pop edi
pop esi
pop ebx
pop eax
add byte [eax], al
pop eax
lea esp, [esp + edx*4]
dec dword [ecx]
pmulhuw mm7, mm7
inc ebx
mov eax, eax
add byte [eax], al
je 0x467468
test eax, edx
je 0x46747b
add byte [eax - 0xa], bh
add dword [ebp + 0x5e], esi
cmp byte [edx], 0
jne 0x4674a5
movzx ecx, word [eax]
cmp dword [eax], eax
add byte [edx], cl
jne 0x46747c
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
xor dword [edx + 0x2bd92100], 0x48
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esi + ebp*8]
add byte [edx], cl
add ecx, 4
js 0x467457
pop eax
add byte [eax], al
pop ebx
ret
ret
add byte [eax], al
push eax
lea eax, [esp + 4]
lodsd eax, dword [esi]
add byte [edx], cl
add byte [eax], al
pop eax
mov edx, dword [esp]
add byte [eax], al
invalid

Function at 0x4a87a5
Capabilities:
Encode data using xor

Disassembly:
push edi
mov ebx, fs
ja 0x4a8700
mov dword [ecx - 0x47], eax
push esp
mov cl, 0x6c
sahf
lodsd eax, dword [esi]
jnp 0x4a874b
push ecx
Function at 0x4ac5ac
Capabilities:
Encode data using xor

Disassembly:
das
or edx, dword [ecx - 0x1ccf970c]
push ecx
sub esi, dword [ebp - 4]
salc
push ebp
dec eax
xor dh, byte [esp + ecx + 0x62]
cmp byte [0x87880b6c], ah
sub al, 0xa7
pop ds
push edi
sbb byte [edx], dh
movsd dword es:[edi], dword [esi]
loope 0x4ac582
and esp, dword [0xf4b6e51f]
out dx, al
mov dl, 0xa8
ret
push cs
stc
mov ch, 0x19
inc ebx
je 0x4ac57a
scasb al, byte es:[edi]
out 0x9b, eax
xchg ecx, eax
add dword [edx + 0x6fbe0f5d], edx
and ebx, dword [ebp + esi*8 + 0x21]
or dword [edx], ebx
int 0xa5
xchg ebp, eax
cld
or dword [ebx - 0x3a436cda], esp
xchg dword [edx - 0x49], edi
mov cl, 0x1b
add byte [eax + 0x10], bl
mov bh, byte [ebp - 0x7516253f]
sub eax, 0x533d6c4a
das
call 0x235a22e9
invalid
invalid

Function at 0x4b14a9
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xff
inc dword [eax]
add byte [eax], al
push ebp
mov ebp, esp
and al, byte [eax]
push 0
push ebx
push esi
push edi
push edx
push eax
add byte [eax], al
xor edi, edi
push 0
mov ecx, dword [ebx]
add al, 0x85
leave
je 0x4b1501
add word [eax], 0
add dword [esp - 0x77], esi
mov byte [edi], 0
xchg ebp, eax
add al, 0xe8
sub byte [edx], al
add byte [eax], al
add byte [eax], al
lea eax, [ebp + edx*4 + 4]
mov edi, esp
add al, ch
cld
invalid
xor eax, eax
jmp 0x4b155d
add byte [ebp - 0x57], dh
test edi, edi
je 0x4b157f
mov dword [eax], eax
add byte [ebp - 0x1c], al
mov esi, dword [edi - 4]
dec edx
add byte [edi - 0xc], cl
call fcn.004b1981
add byte [eax], al
in al, 0xff
aaa
add esi, dword [edi]
mov ecx, 0x558b0b00
cld
mov edx, dword [ebp - 4]
call fcn.004c0fe1
push eax
mov esi, eax
mov eax, dword [ecx + esi*2]
test eax, eax
je 0x4b15a2
mov edx, esi
test dword [eax], eax
add byte [edx], cl
mov ecx, dword [eax - 4]
add dword [eax + eax + 0x2f], ebx
sar edi, cl
dec dword [ebx + 0x75]
in eax, 0
add al, ch
mov eax, edx
neg eax
dec ebx
jne 0x4b158a
add byte [eax], al
call 0xd942e635
lds eax, [eax]
test esp, esp
call fcn.004b0f19
add byte [eax], al
inc ebp
in al, 0x85
push dword [ebp + 0xb]
add dl, dl
je 0x4b15c4
dec dword [edx - 8]
call fcn.004a15c9
mov edx, dword [ebp - 0x18]
add dword [eax], eax
xchg esp, eax
pop eax
pop edx
pop edi
pop esi
pop ebx
pop eax
add byte [eax], al
pop eax
lea esp, [esp + edx*4]
dec dword [ecx]
pmulhuw mm7, mm7
inc ebx
mov eax, eax
add byte [eax], al
je 0x4b1628
test eax, edx
je 0x4b163b
add byte [eax - 0xa], bh
add dword [ebp + 0x5e], esi
cmp byte [edx], 0
jne 0x4b1665
movzx ecx, word [eax]
cmp dword [eax], eax
add byte [edx], cl
jne 0x4b163c
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
xor dword [edx + 0x2bd92100], 0x48
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esi + ebp*8]
add byte [edx], cl
add ecx, 4
js 0x4b1617
pop eax
add byte [eax], al
pop ebx
ret
ret
add byte [eax], al
push eax
lea eax, [esp + 4]
lodsd eax, dword [esi]
add byte [edx], cl
add byte [eax], al
pop eax
mov edx, dword [esp]
add byte [eax], al
invalid