joyce8/EMBER2024-capa huggingface dataset:
Function at 0x98c250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9a0808
push 0x990288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x98c329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x98c329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0098f1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x98c329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x98c329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x98c32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0098c351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x98cd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x98cd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x98cd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x98cd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x98cd94
push eax
push esi
call fcn.0098f20b
add esp, 8
pop esi
ret 0x10

Function at 0x98cda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x98ce22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x98ce15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x9a5320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0098edff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x98cdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x98ce30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x98cec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x98ceb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x9a5320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0098edff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x98ceab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x98ce6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x98d000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x98d131
push esi
call fcn.00990145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0097f080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x98d131
push 0
push ebp
call fcn.0097f3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0097f260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x98d08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0097f2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x98d121
push 0x9a5918
push edi
call fcn.0098e3f0
push eax
push ebx
push esi
call fcn.0098cf60
push 0x9a58f8
push edi
call fcn.0098e3f0
push eax
push ebx
push esi
call fcn.0098cf60
push 0x9a58d8
push edi
call fcn.0098e3f0
push eax
push ebx
push esi
call fcn.0098cf60
push 0x9a58c0
push edi
call fcn.0098e3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0098cf60
push 0x9a58a0
push edi
call fcn.0098e3f0
push eax
push ebx
push esi
call fcn.0098cf60
push 0x9a5888
push edi
call fcn.0098e3f0
push eax
push ebx
push esi
call fcn.0098cf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x98e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0098e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0098e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0098e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0098e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x98ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x98ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x9a087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x98ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x98ec52
xor eax, eax
pop esi
leave
ret 4
Function at 0x41a064
Capabilities:
Encode data using xor

Disassembly:
mov ebx, gs
adc dword [edx + 0x5a], edi
movsd dword es:[edi], dword [esi]
xor edi, dword [eax + 2]
out dx, al
mov ah, 0xbc
jle 0x41a058
mov eax, dword [0x92268e28]
wait
cmp dword [edi], edx
mov edi, eax
jo 0x41a032
retf
cmp esp, dword [edi - 0x6703b943]
mov edi, 0x6478d464
pop esp
aam 0x78
pop esp
and esi, edx
cmpsb byte [esi], byte es:[edi]
imul ecx, dword ds:[edi - 0x65], 0x5d2f4a23
and eax, 0xe378a3a8
js 0x41a02a
xchg esp, eax
insb byte es:[edi], dx
out 0x75, eax
movsb byte es:[edi], byte [esi]
lock sub byte [ebp - 0x72], cl
fsubr qword [ebx - 0x38]
mov bh, 0x5d
enter 0x69c8, 0xffffffffffffffe8
xor al, 0xf3
adc byte [ebp - 0x5fa98cb2], ch
add ch, byte [edi + 0x17]
call 0xad529391
dec esi
jae 0x41a0b6
push esi
mov al, byte [0x99176f02]
cdq
sub eax, 0x903e30bc
sub al, 0xcf
or al, al
push ecx
mov byte [0x2248f843], al
dec esp
jg 0x41a045
loop 0x41a00a
cmp bh, ah
pop eax
pop esi
jmp 0x41a05f
pop ecx
pop ebx
out dx, eax
fsub st(0), st(0)
sub al, 0xb8
popfd
lea ebx, fs:[edx]
std
insb byte es:[edi], dx
test al, 0x5b
mov cl, 0x6a
hlt
Function at 0x423604
Capabilities:
Encode data using xor

Disassembly:
enter 0xffffffffffffca17, 0x15
inc esi
js 0x423632
mov edx, 0x9b99ea
pop dword [esi]
imul edi, dword [edx - 0x57], 0xa4101825
sbb byte [eax], dl
movsb byte es:[edi], byte [esi]
sbb byte [eax], dl
movsb byte es:[edi], byte [esi]
mov byte [ecx + 0x5e], bl
outsd dx, dword [esi]
stosb byte es:[edi], al
jns 0x423663
in al, 0x8b
pushal
push 0xfffffffffffffffd
js 0x4235f2
dec esp
call dword [eax + 0x76ec8ec6]
mov ebx, 0x866cdc84
leave
mov eax, dword [0x6bd43497]
shr byte [ecx + 0x5ab02889], 1
or eax, 0xbbbf709d
xchg ecx, eax
or bh, cl
adc dword [ecx], ecx
xchg edi, eax
cli
pop esi
inc edi
cmp dl, byte [esi + 0x49f28eda]
jle 0x4236b9
push ss
pop ecx
salc
cmpsb byte [esi], byte es:[edi]
fidivr word [ecx + 0x1c89afd7]
dec esp
sbb al, 0x4c
imul esp, dword [ecx], 0xffffffdd
dec edx
daa
invalid
lodsb al, byte [esi]
loop 0x423651
inc eax
fdivr qword [edi*4 - 0x70a1613a]
popfd
sbb al, 0xd8
jge 0x42364c
call 0xa85cffa5
push esi
cmp eax, 0x56a81ac9
mov dl, 0x40
dec edi
pop ss
lcall 0xca11, 0xe00671c9
or dword [ebx - 0x60], edx
pop esi
lahf
xor byte [eax + 0x7c5ee53f], bl
js 0x42366d
or byte [ecx + 0x21], ch
test al, 0xe4
call 0x1366c3f
mov cl, 0xb
dec esp
dec esi
mov ebx, 0x987c45c8
cmp ebx, esi
add al, al
cmp dl, byte [eax + 0x4f448fd6]
or byte [edx - 0x6a97df22], dh
mov ecx, 0xb9ffc855
jge 0x423654
imul ebx, dword [edi], 0x58bfcfb3
leave
fst st(6)
mov bl, 0xcf
mov edi, 0xd6ddc958
pop eax
leave
push 0xffffffffffffff8d
enter 0xffffffffffff8b45, 0x11
or edi, dword [ecx + 0x7a]
js 0x4236df
jecxz 0x4236ae
pop eax
mov dl, 0x8d
jo 0x423696
salc
push esi
mov dl, 0x59
add al, 0xc
loopne 0x4236fa
sub byte [ecx], bh
jns 0x423744
outsd dx, dword [esi]
pop ecx
inc ebx
inc edx
mov bh, 0x31
inc eax
xor al, 0x59
idiv ebp
cmp dword [esi], esi
out 0xa1, al
push eax
mov edx, 0x25784158
inc esi
imul edi, eax, 0x2d499a40
and edx, dword [edi]
test al, 0x6b
xor eax, 0xb82320a6
invalid
stosb byte es:[edi], al
mov edx, edx
jge 0x4236d4
sar byte [ebp - 0x2b], cl
dec ecx
jl 0x4236fc
retf 0x55aa
out 0x2f, al
insb byte es:[edi], dx
test byte [edi + 0x3a], cl
inc ebx
scasd eax, dword es:[edi]
sbb ah, byte [edx + edi*2 + 0x76d61f38]
invalid
jp 0x42377e
pop ds
salc
jbe 0x42373a
imul ebp, dword [esi + 0x60], 0x2c40a789
aam 0xe3
outsb dx, byte [esi]
pushal
mov dword [edi - 0x1c2bd3c0], esp
mov esi, 0xef585c28
push 0xa6f8e945
int 0xd4
sbb eax, 0x39f6f92d
pop eax
ja 0x42374b
int3
push ebp
lcall 0xf289, 0xe0193830
dec eax
sbb al, 0xd8
leave
test al, 0xb8
test eax, 0xc739805a
jmp 0x423764
Function at 0x4636ea
Capabilities:
Encode data using xor

Disassembly:
pop ss
mov ebx, 0x72924933
mov ebx, 0x6f51769a
xchg edx, eax
call dword [esi]
invalid
push 0xffffffffffffffc3
dec ebp
jo 0x4636ad
dec ecx
pop ss
mov dh, 0x50
mov ebp, edx
fnstcw word [edx]
pop ebx
lds ebp, [ebp - 0x2306adc]
ror byte [ebx], 4
aas
out dx, al
sbb edx, dword [ebx + 0x364ee41c]
popfd
adc eax, 0x2c697c24
lea ebp, [esi]
xor esi, dword [edi + 0x12]
mov eax, dword [0x208d908b]
mov es, word [ebx + 0x13f20bec]
dec esi
cmp al, 0x80
stc
das
imul ecx, dword [eax + 0x50], 0x5d
push eax
pop ebp
insb byte es:[edi], dx
jp 0x463726
aaa
sbb esi, edx
nop
loopne 0x463760
mov ebx, 0x9e14a455
sahf
mov ebp, edi
mov ebp, 0xc2316fea
aad 0xa2
mov edx, 0x5f923d7c
out 0x5d, al
push 0xffffffffffffffe9
xor eax, 0x82653809
mov ah, byte [edx + 0x1d]
or eax, 0x51a84680
adc byte [ecx + 0x3df5b249], 0xe8
jnp 0x463735
sbb dword [edx + 0x7bbf65b0], ebp
ret 0xe2fe
mov al, 0x65
mov edi, 0xe2fec27b
rdmsr
invalid
Function at 0x464dde
Capabilities:
Encode data using xor

Disassembly:
lea esi, [ebx]
syscall
fadd st(0)
pushal
xor byte [edi - 0x3236a71e], 0x6e
loop 0x464cb8
leave
int 0x6e
and cl, ch
add edi, 0xb019b0df
lcall 0x5b98, 0x4010f496
push cs
das
mov ebx, 0xc201e09f
jg 0x464c5e
cmpsd dword [esi], dword es:[edi]
test dword [edx - 0x51060e6], 0xf9aef644
movsb byte es:[edi], byte [esi]
out dx, al
inc edx
loope 0x464c91
push 0xb
mov edi, 0xa036469e
sbb eax, 0xaa6f2e5e
sahf
inc esi
mov al, byte ss:[0x6f2e5e1d]
mov al, byte [0x6f2e5e1d]
stosb byte es:[edi], al
push edx
and eax, 0xad9d487b
fsub st(2)
in eax, dx
jl 0x464c55
fst qword [eax - 0x4e]
invalid
xor dword [ebx + 0x5378d76b], ebx
in eax, 0x2f
outsb dx, byte [esi]
aaa
cld
xlatb
popfd
sub byte [ebx + eax - 0x65], cl
pop ebp
mov ch, 0xa1
pop esi
sar ebx, 0xd1
dec ebp
mov bh, 0x45
add byte [eax + 0x7c], 0x76
inc esi
and byte [ecx - 0xc], dl
cmc
adc al, 0x5e
pop ss
invalid
jl 0x464d42
xchg ebx, eax
sbb ch, 0xfa
adc al, 0x65
jno 0x464c8e
invalid
in al, dx
aas
sub eax, edx
std
test al, 8
dec ebx
pop ebp
mov word [ecx], gs
nop
imul eax, dword [eax - 0x33954ca2], 9
cmp al, 0xf7
and eax, dword [ecx + 0x17]
fdiv qword [ebx - 0x51deaa75]
mov edx, dword [ebp + 0x21]
scasb al, byte es:[edi]
sal byte [edx + eax*2 + 0x6d8c404f], cl
xor al, 0x79
not dword [ecx - 0x48]
arpl ax, bp
push ebp
out dx, al
sal dword [ecx], 1
stc
imul ecx, dword [ecx + ebx*2 + 0x3a4d29f9], 0x42
pop ecx
stc
sub dword [ebp + 0x3a], ecx
inc edx
pop edi
movsb byte es:[edi], byte [esi]
daa
loop 0x464d28
pop esi
cld
sbb al, 0xa7
aas
jg 0x464da5
leave
fidivr word [edx]
ja 0x464d08
push cs
jmp 0xaea35045
mov byte [0x71e45a22], al
jg 0x464d03
mov esp, dword [esi]
pop edi
xchg edi, eax
xchg ecx, eax
jmp 0x464d7f
jmp 0x464d7b
mov edx, ebx
loopne 0x464d41
cmp dword [edx - 0x252e7537], esp
push ds
jle 0x464d78
lock or ebx, dword [edi - 0x7cb5e356]
or ebx, dword [edi - 0x7cb5e356]
dec ecx
mov al, byte [0xa59dbd61]
jb 0x464d64
pop esi
lea edx, [ebx + 0x4aa7983f]
push cs
fiadd dword [ebx]
cmp dword [edx - 0x18], esi
or bl, byte [edx]
lahf
sahf
pop ecx
invalid
rcr byte [edi - 2], 0x6e
lea ebp, [edi - 0x412ff53a]
xor dword [edi], eax
pop edi
dec ebx
or byte [esi - 0x486c7080], 0xcd
lahf
or edx, esi
xor eax, 0xf0fb56ca
jecxz 0x464deb
sar dword [esi], 1
add eax, 0xfed60914
jnp 0x464d87
mov eax, 0x9ea29ec0
sub dword [esi - 0x756cd661], 0xffffffc0
invalid
Function at 0x4f71cb
Capabilities:
Encode data using xor

Disassembly:
invalid
sbb eax, 0x3ff11c26
stosd dword es:[edi], eax
dec esi
loopne 0x4f7190
in eax, dx
jb 0x4f724e
invalid
jnp 0x4f7264
nop
push ss
invalid
cwde
jmp 0x4f71e4
scasb al, byte es:[edi]
sub eax, 0x539a33d0
rcr byte [ebp - 0x2108ec1e], cl
in al, 0x2c
xchg ebx, eax
les ebp, [esi + 0x75]
dec ebx
sbb eax, 0xc655fc17
pop edx
adc byte [ecx], al
push ds
sbb cl, bh
int1
ret 0x8411
sal dword [eax - 0x51], cl
jle 0x4f7272
mov byte [eax], al
pop eax
jb 0x4f71f0
mov dl, 0xf5
mov al, 0xad
fsub qword [edx + 0x31c4a991]
pop esi
and cl, byte [ebx]
popfd
jle 0x4f721c
outsd dx, dword [esi]
mov bl, bl
mov dl, byte [esi + 0xf80f594]
invalid
xchg esp, eax
cmc
or byte [edi], 0x8c
mov al, 0x87
mov al, 0xcc
jl 0xccfffa28
insd dword es:[edi], dx
lea esi, [ebx - 0x32becc24]
or al, 0x7d
xor edx, edi
jae 0x4f726f
xchg dword [esp + 0xdb006ef], esi
in eax, dx
movsb byte es:[edi], byte gs:[esi]
mov bh, 0xec
pop esi
adc al, 0x6d
push ebp
aaa
ficom word [edx - 0x6f]
cli
lcall 0x7a52, 0x40152836
sub dword [ecx], edx
sti
iretd

Function at 0x5004a0
Capabilities:
Check for software breakpoints

Disassembly:
pop ebx
ljmp 0x85c9
add dh, dl
pushal
xchg byte [ecx], dh
insd dword es:[edi], dx
test eax, 0xf18a675f
adc eax, 0x338f9a3c
inc edx
pop edi
div dword [edi + ebx*4 + 0x74392b65]
ret 0xcc3c
sub edi, dword gs:[ecx]
je 0x5003db
cmp al, 0xcc
insb byte es:[edi], dx
mov al, byte [0xc6fd168d]
out 0xb4, eax
outsb dx, byte [esi]
idiv byte [edx + 0x1ce1acb9]
pop ax
jno 0x500457
push edi
nop
pop edi
or al, 0x44
mov fs, word [ecx + eax*2 + 0xf]
mov esi, 0xc4c45c44
add eax, 0x1928d5e5
inc ecx
movsx eax, byte [esp + ebx*2 - 0x3c]
les eax, [0x1928d5e5]
or bh, cl
test al, 0xa7
mov byte [0xc686f249], al
xchg ebp, eax
arpl dx, dx
add eax, 0x8eca9a10
in al, 0x1e
jno 0x5003ff
mov cl, 0x39
cmp dword [ebx], esp
mov dl, 0x35
fist word [edi - 0x52]
and esi, dword [edx - 0x51a820cb]
adc ebx, dword [esi - 0x2a]
in eax, 0xf4
pushfd
sub byte [ecx + 0x362adc58], 0x9a
jge 0x500414
xor al, byte [edx]
mov dl, 0xb4
mov dword [ecx], esp
pop edx
push ss
jae 0x500435
invalid
wait
jbe 0x5004f0
xor dword [edx], esi
cmc
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
stc
push eax
push esp
fistp qword [edi + 0x6c]
loopne 0x500458
ror byte [ebx + ecx*2], cl
dec ebp
and dword [eax - 0xeb1d8fe], 0xc891b209
mov dword [eax + 0x56], ecx
xrelease xchg byte [esi], cl
or eax, 0x2b4466
push ecx
push 0x74b277e8
adc eax, 0xf2024246
hlt
xor dl, byte [edi + 0x74848354]
nop
add al, 0x1a
dec esp
add edx, dword [0x26cd0465]
sub dword [edi + ebx*2 + 0xc], ebx
rcl ebx, 1
outsd dx, dword [esi]
ror dword [edx], 1
inc ecx
stosb byte es:[edi], al
test al, 0x84
xchg ebp, eax
jl 0x50054a
loop 0x500569
mov byte [0xd244712b], al
wait
push edi
pushal
into
imul dword [eax + 0x2916b04d]
invalid
invalid
insb byte es:[edi], dx
test byte [esp], ah
xchg edx, eax
in al, 0x5a
in eax, 0x34
sbb ebx, edi
out 0x7c, al
fisubr dword [edx]
test esi, ebx
add bl, byte [ebx]
add al, 0x68
add al, 0xc1
outsd dx, dword [esi]
les esp, [0xaf46c1a]
test byte [esp + esi*8], al
inc esi
movsb byte es:[edi], byte [esi]
cmp al, 0xd
invalid
Function at 0x53ca0e
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
neg dword [ecx + edi + 0x72aa8065]
xchg ecx, eax
aam 0xd
mov bl, 2
sbb cl, byte [ebx]
lds si, [edi - 0x13]
sub byte [edx + 0xdd49172], 0xb3
add bl, byte [edx]
or esp, dword [esi - 0x3b]
ja 0x53c97a
aam 0x5f
stosd dword es:[edi], eax
sub ebp, dword [edi - 0x41d643eb]
lea esp, [edx + ecx*4 - 0x3fe392f0]
sub dword [esi + 0x108aa48d], edi
insd dword es:[edi], dx
sbb al, 0xc0
mov ebp, 0xb9df81d
jne 0x53c97f
jmp 0x53c9e2
ja 0x53c9a2
cwde
rcr al, 0x3b
loop 0x53c994
cmp esp, edx
mov esp, 0xe4def48
dec eax
out dx, eax
dec ebp
push cs
int 0x3f
mov bh, 0x39
imul edi, dword [edx], 0x43
cld
cmp al, byte [ebx - 4]
scasb al, byte es:[edi]
call 0x11b79dd8
cld
or byte [ecx + 0x499b4b1a], 0x41
pop ebx
inc esi
js 0x53ca05
outsb dx, byte es:[esi]
fistp word [ebp - 0x65]
mov esp, 0x73d489f1
int3
movsd dword es:[edi], dword [esi]
fsub qword [edi - 0x15]
or bl, byte [ecx + edi - 0x5a5afc41]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
dec ebp
outsb dx, byte gs:[esi]
cdq
sub eax, 0xcaa37712
fist dword [ebp + 0x3a]
je 0x53c9d0
xlatb
cld
lodsd eax, dword [esi]
dec esp
sub byte [ecx + ebx*4 + 0x2bc67af5], 0xce
mov ch, 0xfc
mov ah, 0xbc
push esi
stc
mul byte [ebx - 0x37]
xchg edx, eax
mov dword [0x5ac6de0d], eax
jb 0x53c9d5
out 0xb6, al
jge 0x53c9da
pushfd
mov esp, 0xe3fcaaa4
movsd dword es:[edi], dword [esi]
call 0x8b50b59e
mov ebx, 0xeca321aa
mov cl, 0xc0
xor esp, dword [ebp + 0x337d62bd]
insd dword es:[edi], dx
stc
sal ebx, 0xff
push ebp
invalid
Function at 0x54501e
Capabilities:
Encode data using xor

Disassembly:
invalid
fisttp dword [eax + 0x15]
and dword [esi], ebx
das
or ebx, edi
out dx, eax
test eax, 0xf03f0f95
lodsd eax, dword [esi]
cmp ecx, dword [edx - 0xb8a6266]
movsd dword es:[edi], dword [esi]
xchg ebx, eax
xchg esp, eax
mov ah, 0x49
jl 0x545033
inc edi
jmp 0x544fed
jecxz 0x544f62
inc ecx
js 0x544fd7
wait
ror dword [ecx], 0x42
inc ebp
out 0xe5, al
adc al, 0x5b
xor dh, cl
or ch, byte [ebx + 0x37]
push esi
dec ebp
mov byte [0xd56e9950], al
lea esp, [esi]
or dl, bh
or dl, bh
mov dl, 0xcc
ja 0x544fed
insd dword es:[edi], dx
sti
fstp qword [edx + 0xd6d35dd]
fcmovnu st(0), st(4)
les edi, [eax + 0x3f]
or eax, 0x78c4dcdb
aas
xor bl, bl
sbb bh, byte [esi - 0x14e0528f]
or esp, dword [ebp + 0x3a]
jne 0x544f99
jl 0x545012
pop esp
int 0xda
jns 0x544fc4
lcall 0xe518, 0x6da906df
and dword [ebx], ebp
sbb dword [esi], 0xffffffbb
inc edi
wait
or esp, edx
push ds
mov ebx, 0xe20b9b47
inc ebx
lahf
cld
cmp ebp, ebx
pop ss
loope 0x544fa8
adc bl, bl
add dword [esi], 0x7b43ed9c
movsb byte es:[edi], byte [esi]
or cl, byte [eax + edx*4 - 0x506406b]
invalid
shl byte [ebp + 0x77], cl
jae 0x5450a3
aad 0x51
pop ebp
pop ss
stosb byte es:[edi], al
sub esp, dword [ecx + 0x6e]
xchg ecx, eax
loop 0x544fdf
cld
cdq
fcmovnbe st(0), st(2)
push 0x7c
inc edi
dec ebp
xor bh, byte fs:[eax]
sbb edi, dword [ebx + 0x161feafd]
mov byte [0x74cb704e], al
cmp al, 0xbd
out 0x6d, eax
sub esp, dword [ecx]
mov ebp, 0x9bdafb8d
jge 0x54504b
fucomp st(7)
int 0x9b
out 0x9f, eax
push es
mov al, 0x51
test dword [0x6878b11f], 0x4da7a4e7
dec ebx
pop ebp
pop es
movsd dword es:[edi], dword [esi]
invalid
out dx, al
cld
xor bh, byte [eax + eax - 0x1c239f3]
pop eax
mov esp, dword [edi + 0x4f]
or eax, 0xbd6de57
jnp 0x5450d8
push ds
cdq
xor eax, 0x7fa9eb5c
dec edi
dec ebx
pop ds
pop ds
cmp byte [esi - 0x70], dh
mov ebx, 0xdc22551f
mov edi, ebp
jp 0x545128
cwde
or eax, 0x274b389c
cdq
int 0x76
or al, 0x7d
xchg byte [eax - 0x7c], ah
jp 0x54512c
invalid
leave
xchg ch, bl
mov edi, edi
pop ebx
mov cl, 0x7a
or al, 0xe5
mov edi, 0xa0723c0b
dec ebx
inc eax
add edx, eax
call [ebx - 0x4f]
jp 0x54513d
in eax, 0xbf
or edi, dword [edx + esi*2]
mov al, byte [0xd003404b]
and byte [ecx + ebp], ch
jl 0x54519f
sub dword [edi + ebx*2 - 0x49], edi
enter 0x1bd, 0x10
invalid
mov bh, 0xc8
mov ebp, 0xa68f1001
invalid
sub esp, dword [edx - 0x7efb62f1]
xchg edi, eax
fisttp word [ebx]
clc
aas
dec ebp
das
mov esp, 0x4b441fd8
cwde
in eax, dx
dec edi
movsb byte es:[edi], byte [esi]
sbb ebx, dword [esp]
enter 0xffffffffffffd6aa, 0x28
cwde
jbe 0x5451b4
push es
in eax, dx
imul ecx, ebx, 0x762bf2b8
push eax
mov edx, dword [edx + 0x7a]
out dx, al
mov dl, byte [esi + 0x73]
fsubr qword [ecx + 0x7b6b1b4e]
pop eax
invalid