joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c08bf2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x5c08bf76
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x5c08bf1d
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x5c08bf2c
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x5c491bcf
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x5c08bf7d
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.5c072df3
cmp eax, dword [ebp + 0xc]
pop eax
je 0x5c08c01c
add edi, 4
add eax, 2
dec ecx
jne 0x5c08bf62
call 0x5c08bfc9
loope 0x5c08bfbf
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x5c08c019
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x5c08c02a
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x5c08bfdd
cmp eax, ecx
ja 0x5c08bfdd
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x5c08c067
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x5c08c05d
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.5c0732d2
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x40ef91
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
push ss
bound eax, qword [esi - 0xa8fe91]
jg 0x40ee83
dec eax
ret
xchg byte [0x2b7781e9], dl
fucompi st(2)
out dx, al
out 0x80, eax
or al, 0xc4
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
mov ebx, 0xaeaa83f4
les esp, [esi - 0x7c0b4459]
stosb byte es:[edi], al
scasb al, byte es:[edi]
xchg ecx, eax
xchg edx, eax
dec eax
fidiv word [edx]
cdq
out 0x86, al
and al, 0x4d
pop edx
fdivr qword [esi]
rcr dword [esi], 0xb4
rcr dword ds:[esi], 0xb4
xor dh, al
mov bh, 0xf7
popal
loope 0x40ef13
loop 0x40ef0f
jns 0x40eed5
adc ch, bl
js 0x40ef27
mov word [edi - 0x5fc2f504], cs
in al, 0x72
dec ebp
jne 0x40efa1
jge 0x40ef6d
pop ds
dec esi
push ebx
out dx, al
test byte [esi], dl
sal bh, 0x97
mov word [edx + 0x5e695675], es
and eax, 0xb5556be6
mov es, word [edi + 0x7832ed15]
ret
mov ch, 0x8e
xchg dword [0xc37832ed], edx
push ecx
inc esi
wait
mov bh, 0x77
mov gs, ecx
invalid
ja 0x40eef7
jmp 0x2bb09f34
sub edi, dword [ecx + 0x6a]
fstp qword [edx]
sahf
fld xword [eax + 0x63]
test eax, 0xbd3d6a0
pop esp
stosd dword es:[edi], eax
cld
and bl, cl
mov ebx, esi
jge 0x40efc6
mov cl, 0x65
pop edx
push ebx
xor eax, 0xa1d252c3
jmp 0x40ef67
mov bl, 0xa5
or al, 0x9f
push edx
bound esp, qword [eax - 0x2d]
jg 0x40ef30
sub byte [ebx + 0x46], al
sal dword [edx + edx - 0x80], 1
cmp bl, byte [edi - 0x3a4b8e6a]
cmp eax, 0x92dd4a7a
cmp byte [edx], 0x9f
xchg esi, eax
jno 0x40ef5b
lds edi, [0x92dd4a7a]
lcall 0x299f, 0xabd99257
dec eax
scasd eax, dword es:[edi]
push ss
ljmp 0xc511
mov ebx, 0xe89aed2d
mov dl, 0x3f
xchg esi, eax
out dx, eax
inc eax
imul ebx, eax, 0x10639d01
dec eax
cwde
clc
xchg byte [esi], ch
ljmp 0x9801

Function at 0x417e10
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x4c7acc], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [0x4c7acc]
push 0x10
add ecx, eax
mov dword [0x4c7acc], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x417e4d
or dword [esi], 0x2000000
mov eax, esi
pop esi
ret
Function at 0x428def
Capabilities:
Encode data using xor

Disassembly:
int3
je 0x428d36
adc eax, 0x90cbf896
mov dword [0x3217bf41], eax
xchg edi, eax
jne 0x428dbf
xor dword [esi + 0x2c23bf5c], esp
cmp al, 0x71
invalid
pop ss
xor al, 2
sub eax, 0xc128f5e3
push ebp
inc eax
jecxz 0x428d3d
fisttp qword [ebx]
xor byte [eax - 0x58486a49], ch
xchg ebx, eax
aam 0xfc
jmp edi
jge 0x428e39
xor byte [0x3c7cd05f], 0xbb
sar byte [esp + edi - 0x45], 1
sbb byte [0xb66d6fda], 0xcd
sti
adc dword [edx - 0x268b96f8], esi
sub eax, 0xd69b91d
fld xword [eax - 0x36c867e8]
insd dword es:[edi], dx
scasd eax, dword es:[edi]
test eax, 0x7341d78e
popal
jge 0x428d75
cld
inc eax
pop ebx
xlatb
push edi
js 0x428e0d
xchg esi, eax
insb byte es:[edi], dx
sbb eax, 0x6c7d8789
add eax, 0xf01f7f96
sub al, 0x54
pop ebp
std
jne 0x428dba
adc al, 0xd2
lea esp, [esi]
pop ebp
push di
lahf
test byte [ebx + 0x61], dh
ror dword [ecx + 0x4d], 1
dec ecx
dec ebp
mov ah, 0xdf
push esp
invalid
adc al, 0xea
stosd dword es:[edi], eax
aaa
lea ebp, [ecx - 0x10769168]
out dx, eax
xor eax, 0x3d456d0d
rcr dword [eax + ecx*8 + 0x2d464c20], 0x21
add eax, 0xc18e2ad
loop 0x428e30
insd dword es:[edi], dx
sbb eax, 0x4df3a9be
out dx, al
int 0x6e
retf 0xa05f

Function at 0x42a889
Capabilities:
Encode data using xor

Disassembly:
test dword [ebp + 0x533ac668], 0x4c832e1a
mov ch, 0x44
sbb edi, dword [ebx + esi*2 + 0x7c]
pop ecx
salc
mov word [esi + 0x31], ss
cmp al, 0xf5
adc bl, byte [edx + 0x64]
xchg ebx, eax
inc eax
inc esi
mov eax, dword [0x99ee969a]
mov edx, 0x2afc5ee6
in eax, 0x9a
lcall 0xbf89, 0x9c489a8d
lcall 0xbf89, 0x9c489a8d
cmp ah, byte [edi - 0x1c]
pop ebx
push esi
adc byte [edi + 0x5f], dl
loope 0x42a8a8
inc ebp
pop ebx
hlt
inc esi
scasb al, byte es:[edi]
rcr byte [edx + 0x7ec766cb], cl
aad 0x8f
sub byte [edx], al
cmpsd dword [esi], dword es:[edi]
je 0x42a861
or al, 0xd3
stosb byte es:[edi], al
loop 0x42a916
inc esp
xchg ebp, eax
push cs
stosd dword es:[edi], eax
and al, 0x14
scasb al, byte es:[edi]
invalid
fdivr qword [esi - 0x5b7bbf44]
invalid
push ebp
cld
push cs
push ebx
xchg ecx, eax
das
jge 0x42a8aa
sub eax, 0xba262c44
xor ecx, esp
loope 0x42a90f
jae 0x42a8c0
fiadd word [edi]
xchg ebp, eax
cmp eax, 0x72f6eb5d
dec ecx
pop ebp
retf 0xaeaa

Function at 0x42c7c1
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
mov word [ebx - 4], ds
or ecx, edi
bound esi, qword [ebp + 0x1d283662]
or al, 0x46
out dx, eax
mov ah, al
add eax, 0x88029bfc
dec ebx
sub ch, 0x19
cmpsd dword [esi], dword es:[edi]
pop es
or eax, 0x6b12b358
out dx, eax
xchg ecx, eax
mov esp, 0x55b4a7b
jecxz 0x42c841
stc
pop esp
sti
salc
imul ebp, dword [edx], 0xf2d87636
cmc
mov ecx, 0x862f421e
pop ss
cmpsb byte [esi], byte es:[edi]
das
and dword [esp + esi*4], ecx
inc esi
sub byte [ecx + 0x4d], 0x4e
loop 0x42c7eb
xor eax, dword [ecx]
mov bh, 0x35
pop edx
iretd
sahf
invalid
Function at 0x42ce29
Capabilities:
Encode data using xor

Disassembly:
invalid
wait
push eax
add ah, ch
xchg eax, esp
cld
sub eax, 0x5d23cee5
mov al, byte [0xa137fb05]
and dword [edx - 0x1f48c208], ecx
adc ecx, dword [edi]
adc eax, 0x6b065803
invalid
xchg esi, eax
mov al, byte ds:[0x33fa9b3e]
sub byte [eax], bh
mov cl, ah
mov esi, 0x4984ee55
stosb byte es:[edi], al
arpl word [ebx], sp
sbb edx, esp
into
sub eax, dword [ebp + 0x69]
ljmp 0x8276
imul ebp, edx, 0x92b34c0b
xchg edx, eax
jbe 0x42cd4e
or byte [eax - 0x25], ah
and byte [ecx + 0x6b], ah
or byte [ecx + ebp*8 - 0x35], 6
in al, 0xbf
cmp ebx, ebx
imul eax, dword [edi + ebp*8 - 0x32], 5
pop ecx
adc eax, 0xcca34ab2
out dx, eax
jno 0x42cd7f
leave
mov esi, 0x25a304ad
nop
je 0x42cdc9
clc
salc
nop
xchg ebp, eax
mov dh, 0xaf
movsb byte es:[edi], byte [esi]
or ecx, ecx
xor byte [esi - 0x178f9e2e], dl
xchg ebx, eax
jle 0x42cdab
int1
pcmpgtw mm6, qword [ebp - 0x2b75bf2a]
jecxz 0x42ce27
cmpsb byte [esi], byte es:[edi]
add ah, byte [edx - 0x19ebd825]
call 0xc516c857
pop esp
xchg ebx, eax
sti
movsb byte es:[edi], byte [esi]
in al, dx
and al, 0x19
sub eax, 0xb275d171
jne 0x42cdda
mov dl, 0xb4
mov ah, 0x79
sti
jns 0x42ce26
out 0xcf, al
sbb al, bh
jnp 0x42cdc4
leave
xchg esi, eax
sub cl, byte [ebp - 0x56]
sbb dword [ecx - 0x4c], ecx
xlatb
invalid
Function at 0x43caa0
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x913bc6f3
or dword [ebx + 0x5611b08e], edx
test dword [edx - 0x42], ecx
xchg ebx, eax
invalid
mov eax, 0x6657dcd5
sbb byte [edi - 0x28683aa9], ch
stc
pop esp
push cs
cmpsb byte [esi], byte es:[edi]
push 0xffffffffffffffb1
push ebx
jg 0x43ca2f
mov ecx, 0xb5f899be
bound eax, qword [eax + edx]
mov byte [ecx], cl
cmp ch, ah
mov dh, 0xe0
adc al, 0xc7
imul eax, dword [edi - 0x1f656c67], 0xa5b5cf37
popfd
bound esi, qword [ecx]
sub al, 0x59
add ebx, dword [ebx]
outsb dx, byte [esi]
sbb al, 0x55
sbb ebp, dword [esi + 0x1c]
push ebp
sub dword [esi - 0x25032e21], 0x3e34a86f
xor al, 0x3e
js 0x43ca7f
insb byte es:[edi], dx
cmc
add dword [eax], 0x45fa437c
jl 0x43cacc
cli
inc ebp
stosd dword es:[edi], eax
push 0x10c0ae90
and al, 1
jns 0x43ca35
sbb esi, edi
loop 0x43ca87
and ebp, ecx
mov ecx, 0x8b7fe2bc
jno 0x43cb14
jbe 0x43ca73
in al, 0xc8
outsb dx, byte [esi]
mov edi, 0x371a6c0
jo 0x43ca3d
dec eax
push ds
call edx
stc
jno 0x43cb1d
mov esp, edi
sbb byte [eax], al
ljmp 0x1207
dec ecx
xchg esp, eax
adc esi, 0xbd1f600c
ftst
push 0xffffffffffffffc8
imul esp, dword [edx - 0xfb898c5], 0x6cd7b944
xchg eax, edx
cmp eax, 0x61b92e86
pop esi
std
aad 0x35
cmp bh, bl
mov al, byte [0xcf3edae7]
das
or al, dl
enter 0xffffffffffffeb6a, 0x6f
inc ebp
mov ebx, 0xcb648534
cmp eax, 0x7c3d0c0e
das
jge 0x43cb6d
outsd dx, dword [esi]
lahf
sub edi, dword [edx + 0x65]
inc esi
and dl, ah
stc
mov ecx, dword [edi + ebx*8]
enter 0xcb7, 0xe
invalid
mov bh, 0xc
push cs
test byte [ebx - 6], bh
mov al, byte [0x4ac53d23]
sbb bh, dh
and edi, dword [0xfe1a4ac5]
sbb ebp, dword [ecx + 0x11d10ca4]
push cs
cmc
inc esi
insd dword es:[edi], dx
mov esp, 0xf495cc6c
adc al, 0x43
imul eax, dword [eax - 0x4a9b3a01], 0x46
cmp ebx, ecx
dec ebp
cmp dword [eax], eax
adc edi, dword [ebx - 0x2920ba04]
mov dl, 0x85
xor byte [edx + 0x3e], 0x9d
inc esp
and byte [ebx + 0x52], dh
test byte [edx - 0x13], dh
jo 0x43cb23
inc ebp
int1
mov al, byte [0x8144d9c5]
mov dh, 0xb
push es
js 0x43cb16
mov dword [0xddef305a], eax
add edi, dword [edi - 0x3f]
mov edi, 0x281d886
and eax, 0xdac4dd31
sbb byte [edx + edx*4 + 0x614eeb69], dh
mov edi, 0xa23a7fbc
imul eax, dword [edi + 0x3ffd6f6d], 0x14
mov bl, 0x6f
add dword [edx], 0xc4dd3125
ficomp dword [eax]
mov ah, 0x92
imul ebp, ebx, 0xbcbf614e
jg 0x43cbb9
mov byte [0x6f6d876b], al
std
aas
adc al, 0xb3
outsd dx, dword [esi]
xor ebx, esp
adc byte [edx], ah
xor al, 0x22
add al, 0xf8
aaa
sub bl, byte [ebx + 0x271c9076]
out dx, al
push 0xed755e53
in al, 0x5a
push 0xffffffffffffffa7
retf
push 0x37
push 0x57
xor edx, dword [esi + 0x41e70aa6]
out 0x41, eax
pop ds
dec eax
xchg esi, eax
xlatb
push esi
cmc
daa
test al, 0x66
mov esp, 0x15a57514
pop ds
push edi
dec edi
loopne 0x43cbc1
jne 0x43cb8b
cmc
int1
invalid
Function at 0x43dd27
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
ljmp 0x7a51
inc ebx
pushal
cmc
sbb ah, al
add al, 0xd6
sub ch, 0x8c
mov cl, byte [edi + 0x5b]
cli
dec esp
jge 0x43dcec
hlt
or dword [edx - 0x23f6e50e], esp
in al, 0x63
sbb cl, byte [ecx]
fsubr st(4), st(0)
arpl cx, sp
stc
loope 0x43dcef
inc eax
jnp 0x43dd18
invalid
mov dword [ebx], edi
jl 0x43dca3
cli
invalid
xchg ecx, eax
jo 0x43dcab
leave
sub esp, dword [esi + esi*2 + 0x14dc6445]
jb 0x43dcf4
ror byte [edx + 0x65], 0x7b
sti
dec edx
jnp 0x43dd33
add byte [esi + 0x5529ec02], ah
push es
out 0x60, al
daa
xor al, 0xfe
sti
sbb al, byte ds:[esi - 0x5337befe]
push ecx
xchg edx, eax
fmul qword [ebp - 0x5df717e0]
aad 0x25
mov ecx, 0xa1b3ece2
pushfd
cmpsb byte [esi], byte es:[edi]
push esp
xor al, 0x2e
mov ebp, 0x41a973ed
mov byte [ebx - 0x48bd3c69], ah
inc ebx
pop ebp
jp 0x43dd42
or cl, ah
scasd eax, dword es:[edi]
cld
sub dl, 0xb2
movsd dword es:[edi], dword [esi]
lea ebx, [eax + 0x63]
salc
mov dword [0x72b078f0], eax
aaa
mov byte [0xe151dfa5], al
in al, dx
sbb dword [eax + 0x6260307a], esp
push cs
sub dword [ebx + 0x7023a1b3], edx
stosb byte es:[edi], al
dec esp
jno 0x43de08
invalid
in al, dx
mov byte [esi - 0x50d00482], dl
xchg esi, eax
jle 0x43ddce
das
scasd eax, dword es:[edi]
pop eax
push esp
cmp eax, 0xaa6aacaa
dec ebp
outsb dx, byte [esi]
fdiv qword [esi]
nop
cmpsd dword [esi], dword es:[edi]
dec edi
mov dh, byte ss:[esi]
salc
dec esp
out 0x14, al
add dh, byte [esi + ecx*4]
sbb dword [edx + 0x45], ebx
iretd
pop esp
cmp eax, 0x30f091b4
aad 0x61
test eax, 0x72f02cd0
cmp eax, 0x7d0490ec
sub al, 1
xor dl, byte [edx]
insb byte es:[edi], dx
fcmovnbe st(0), st(2)
jae 0x43ddd0
invalid

Function at 0x43f0e6
Capabilities:
Check for software breakpoints

Disassembly:
cmp byte [edx - 0x56], dl
clc
mov byte [0xdad7b54a], al
js 0x43f11e
mov dh, 0x15
add al, byte [edi]
add eax, 0xcf857ce0
xor al, 0x68
adc dword [edi - 0x1d], esi
pushal
cmpsd dword [esi], dword es:[edi]
rol byte [ecx + 0x257c6779], cl
sbb byte [esi], ch
and dword [esi], ebp
das
inc ebp
jg 0x43f176
std
dec ebx
hlt
inc edx
clc
push es
inc eax
push eax
jnp 0x43f0ef
stosd dword es:[edi], eax
leave
rcr dword [esi], 0x1d
mov edi, 0xb95c92b5
pushfd
invalid

Function at 0x43ff57
Capabilities:
Encode data using xor

Disassembly:
push esp
add byte [esp + eax*8 - 0xc], ah
sub byte [eax - 0x52668745], 0x11
salc
sal dword [edi + 0x78], 0x21
adc al, 0xa4
lodsd eax, dword [esi]
mov al, 0xd5
invalid
Function at 0x456d04
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi + 0x78], edx
xor dh, ch
out dx, eax
nop
and dl, byte [ebp + ebp - 0x5d2e797a]
test eax, 0x59a79cd8
cmpsd dword [esi], dword es:[edi]
pop ecx
outsd dx, dword [esi]
nop
pop ecx
js 0x456c7c
mov byte [ecx], 0xe4
add esp, esp
add esp, esi
std
mov dh, 0xc8
pop ebx
sbb bl, byte [esi]
sbb bl, byte [ecx]
xor dl, byte [esi - 0x5939f137]
inc esp
pop ds
jmp 0x456cad
invalid
aaa
xlatb
add bh, byte [eax]
cmp byte [edi], dh
aaa
jecxz 0x456c8d
sbb cl, byte [eax + 0x59]
fucompi st(6)
clc
cwde
sub dword [edx + eax*8 - 0x1780b1c7], ecx
pop ds
rol dword [ebp - 0xc], 1
pop esi
sahf
cmpsb byte cs:[esi], byte es:[edi]
sbb bl, byte [edx + esi*8]
mov dh, 0x1e
push ds
jb 0x456c95
out 0xaf, al
leave
mov dl, 2
xchg eax, ebx
fcomp dword [edx - 0x1471df9e]
pop es
popal
ja 0x456ccf
sahf
enter 0x59a1, 0xffffffffffffffae
pop ecx
scasb al, byte es:[edi]
mov bh, 7
and al, 0xa3
xchg ecx, eax
lodsd eax, dword [esi]
iretd
pop es
or al, 0x59
or byte [ebx], cl
xchg edx, eax
daa
aaa
rcr byte [ebx - 0x4d], 1
add dword [eax - 0x64], ecx
jae 0x456cb0
div ebx
mov dword [ecx + 0x5025578d], esi
mov ebp, 0xd90472b8
mov cl, 0x8d
push edi
and eax, 0x72b8bd50
add al, 0xd9
push ebx
xchg esp, eax
in eax, 0x23
dec esi
bound esi, qword [ecx + edi*8 + 0x46]
movaps xmm1, xmmword [eax - 0x3d]
sub ebp, dword [edi - 0x3f]
push cs
in eax, 0x87
xor esp, esp
cmpsb byte [esi], byte es:[edi]
jb 0x456d17
stc
or al, 0xd6
salc
adc byte [esi - 0x45], 0xde
cmp dword [ebx - 0x5bfffca2], esi
sub edi, dword [edx]
mul bl
and esp, ebp
bnd jne 0x456ce5
dec ebp
jmp 0x5d904440
Function at 0x458d17
Capabilities:
Encode data using xor

Disassembly:
lea esp, [ebx + 0x7f]
and byte [eax + ebx*8 + 0x7d], bl
add eax, 0xfb0fe2bf
mov edi, 0x6954f4ae
fsubrp st(1)
and ebp, dword [esi - 0x27]
mov edi, dword [esi]
retf
arpl word [edi + 0x20], di
pop esp
fdivr dword [ebp + 5]
mov edi, 0xbffb0fe2
scasb al, byte es:[edi]
hlt
aaa
mov ebp, 0x703dd293
out dx, eax
ror byte [edx + 0x12500346], 1
pop edi
adc eax, 0xf404eb
xchg dword [eax + 0x711a8ba1], ebx
dec esi
int3
adc al, dh
push ss
push esp
and ecx, 0x862f19b
loope 0x458c4a
int1
bound ecx, qword [eax]
popal
stosb byte es:[edi], al
jge 0x458c49
lahf
movlps xmm0, qword [edx]
je 0x458ce4
or eax, 0x61188953
push cs
or dword [edi + 0x7b9328a5], esi
scasd eax, dword es:[edi]
xchg ebx, eax
jnp 0x458c78
sbb al, byte [edx + 0x66]
lodsd eax, dword [esi]
jnp 0x458cad
jns 0x458ca7
adc edi, dword [ecx + 0x7a]
stosd dword es:[edi], eax
mov word cs:[eax], fs
jno 0x458cda
xchg edx, eax
nop
insb byte es:[edi], dx
sub ebx, dword [eax - 0x45ee725c]
xchg ebx, eax
xchg ebx, eax
sbb eax, 0x104f58c7
pop ss
or byte [ebx], 0xbb
fmul qword [ebx + ebp*8 - 0x69]
loope 0x458c79
cwde
pop edx
mov dword [edi + 0x1c128094], eax
out dx, eax
xor byte ss:[ebx + 0x6033c337], al
xor byte [ebx + 0x6033c337], al
xor eax, 0x30e313b5
sal dword [ebx + 0x7b70e6b5], 0x80
add al, 0x68
sbb dword [ecx], ebp
invalid
test al, 0x73
mov ebp, 0x5092fcfa
mov cl, 0
add byte [eax], bl
popal
mov esp, 0x5b92e104
outsb dx, byte [esi]
mov bh, 0x43
inc eax
jecxz 0x458cfe
xlatb
lodsd eax, dword [esi]
jae 0x458cc6
push edx
jbe 0x458d80
jge 0x458db0
or al, 0xc2
push eax
std
sbb al, 0x52
les ebp, [esi + 0x465709d]
sub al, 0x68
xor byte [0x24f07d94], bl
or eax, 0xff5126
jae 0x458d40
jo 0x458da7
add al, 0x2c
push 0x7d941d30
invalid
retf 0x6a0e
adc al, 0x60
push ss
mov ch, ch
int 0x25
mov eax, 0x7f5385b1
cld
inc eax
mov cl, 0x69
push ecx
aad 0x67
mov edi, 0x58b9bad3
xor dword [eax + 0x49], edx
mov ecx, 0x49503158
lahf
xor ah, dl
and byte [eax + 0x5957e17a], ah
inc esi
mov dh, 0x7e
ffree st(4)
push es
jbe 0x458dd2
push ebp
xor dword [ebp - 0x21], 0x4f086344
inc esp
arpl word [eax], cx
dec edi
jbe 0x458e26
popal
adc dword [ebx], edi
mov esi, 0x92d87617
ja 0x458deb
add byte [eax], 0x57
jae 0x458d96
sbb ch, al
iretd
nop
bound esi, qword [ecx - 0x2effecd4]
jno 0x458e10
push ss
ret 0xd376
xlatb
pop ebx
stosd dword es:[edi], eax
pop ds
mov edi, 0x85955742
push 0x7278c086
aad 0xb7
mov al, 0x90
add esp, esp
and eax, 0x7ef81ea9
nop
invalid
lodsw ax, word [esi]
lahf
push edi
push 0x185d3388
bound ebx, qword [ecx - 0x72]
shl esi, 1
or dword [0x6b01c518], 0x6092288f
or eax, 0x6b01c518
invalid
xchg edx, eax
pushal
test dword [ecx], ebx
test dword [edx], ebp
outsb dx, byte [esi]
cmp edi, dword [edi - 0x34]
jns 0x458e1f
invalid
Function at 0x468696
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
out 0x71, eax
xchg ebx, eax
mov byte [0xf9b3212b], al
mov bl, 0xf9
mov bl, 0xf9
nop
popal
or byte [ecx], dh
sbb eax, 0xb9728706
and byte [ecx + edx + 0x7289c32f], dl
mov ah, 0x15
cdq
xor dword [ebx + 0x5320b15b], esi
push ss
mov byte [ebx - 0x5e], dl
sub dword [ecx + eax*2 - 0x1f], edi
dec di
dec edi
and eax, 0x5cbbb305
sub esp, dword [esi]
fbld tbyte [ecx]
mov al, byte [0xe0ae43a2]
pop edx
lodsb al, byte [esi]
inc eax
inc ecx
and ch, bh
xor esp, dword [edx + 0x2a]
mov al, byte [0x8008f995]
jo 0x4686cc
lodsb al, byte [esi]
push esp
loope 0x46868f
xor eax, ecx
stosb byte es:[edi], al
sti
xchg ebp, eax
or eax, 0x5d0af014
push ebp
jbe 0x4686ba
sub bh, 0xe0
jmp 0x468703
mov es, ebx
mov edi, 0xdfa1f5b4
arpl word [ecx + 0x63], bx
ror al, 1
mov al, bl
mov esp, 0x610370e1
add dword [ebx - 0xf511d0], ebp
xor dh, dl
push ebx
xlatb
sbb eax, 0x23bd0e8e
aad 0xf5
jge 0x46874f
or ch, byte [esp + ecx*4]
sbb dword [edx], esi
cmc
into
mov eax, 0xa5a2aa80
iretd
mov bl, 0xf6
outsd dx, dword [esi]
xlatb
in al, dx
bound esi, qword [edi - 0x14]
daa
invalid

Function at 0x46c322
Capabilities:
Encode data using xor

Disassembly:
sbb byte [ebp + edx - 0x10], ah
test dword [ecx - 0x71c21a3d], esi
and esi, dword [ebx]
sub ah, byte [edx]
imul eax, dword [ecx - 0xe35f779], 0x1da113e0
add dword [edi - 0x1f0e35f8], 0xcd1da113
popal
add dword [edi - 0x1f0e35f8], 0xcd1da113
popal
adc dword [edx], 0xe3561893
scasd eax, dword es:[edi]
or al, 0xe7
js 0x46c36e
pop ebx
xor byte [ebx + 0x1b], ah
mov esp, 0x43024659
sahf
sub dword [edx + 0x2d829dd3], ecx
jl 0x46c313
cwde
xchg ebx, eax
pop edx
in eax, dx
cmp al, 0xbe
add eax, 0xb45c5e55
and byte [edi + ebp*2 - 0x79f74c48], dl
lds edi, [esi + ecx*2 + 0x4d]
cld
inc esi
ret 0x9475
out 0xad, eax
clc
dec eax
push eax
loop 0x46c3df
outsb dx, byte [esi]
jmp dword [ecx + 0xaba2287]
xor esi, dword [edi + ecx]
lodsb al, byte [esi]
jl 0x46c3f1
adc byte [eax + 0x29], ah
pop ss
mov esi, 0x9e5e222a
push ds
pop ebp
adc byte [ecx + 0x4a809356], ah
mov eax, dword [0x4a809356]
xor al, 0xd2
and byte [ecx - 0x1d], bl
invalid

Function at 0x484d9b
Capabilities:
Encode data using xor

Disassembly:
push 0x78
insd dword es:[edi], dx
dec ecx
cmp ch, 0x9f
mov byte [0x5e120e59], al
jecxz 0x484ddc
mov eax, 0x7c2e3e84
cmp dword [edi + ebp - 0xf], esp
add al, 0x50
cmp eax, 0x5ee41908
xor ebx, ebp
mov byte [ebp - 0x700b5b6f], cl
or byte [0x7292d8d], ah
inc eax
aas
imul esi, dword [ecx + 0x7d], 0x6c1be369
int 8
pop ds
pop es
int1
fsubr qword [ebx + 0x19]
enter 0x1f99, 0x7c
Function at 0x497ff4
Capabilities:
Encode data using xor

Disassembly:
call 0x8e7b0e2a
jge 0x498025
fild dword [0x9c3daed7]
pop esp
push esi
int1
cwde
xor dword [esi + 0x31], eax
retf
lodsb al, byte [esi]
mov dword [0xa4bbdea3], eax
or dword [edi], 0x98314e32
xor cl, byte [esi + 0x31]
cwde
mov esi, 0xf391e57d
mov bl, 0x30
jo 0x49802d
and dword [ecx], eax
and bl, bh
jno 0x498099
mov eax, dword [0x411bf06f]
sub dh, byte [ebp + ecx + 0x2d]
mov al, 4
outsd dx, dword fs:[esi]
int3
fsub qword [bx - 0x183d]
stc
pop esp
sub ch, byte [esi + 0x37969c9e]
cmp byte [edi + 0x70ec1891], dh
mov fs, word [edi]
jle 0x49810e
dec edi
push 0x6e4a661e
leave
sbb dword [eax - 0x6ed107cc], 0xd004dfc6
cmp dword es:[edi], eax
mov ecx, 0xea911a9b
outsd dx, dword [esi]
mov byte [esp + ecx*8 + 0x53], cl
fidivr word [edi + ebx*2 + 0x11a6cee1]
adc esp, dword [ecx - 0x76dec7a8]
mov dl, ah
pop ecx
xor eax, 0xb41c98a8
jmp dword [ebx - 0x2ca1ec5a]
add bh, byte [edi]
into
into
outsb dx, byte [esi]
jmp 0x4980c4

Function at 0x49a191
Capabilities:
Encode data using xor

Disassembly:
or eax, dword [eax - 0x50881ee5]
fidiv dword [eax + ecx*2]
invalid
aas
nop
rcr byte [edi], 1
sub al, 0xcb
pop esi
push ds
mov bh, 0x59
neg dword [edx - 0x632420d4]
loop 0x49a16e
jbe 0x49a1cc
scasd eax, dword es:[edi]
das
mov esi, 0xc5a1c1fb
stosd dword es:[edi], eax
add esi, dword [edx]
mov esp, 0xcf90ccc0
adc al, 0xe4
dec eax
lodsb al, byte [esi]
xor ebx, dword [ecx + 0x38bd7787]
or ecx, dword [edi + ecx*8 - 0x287a794a]
mov edi, cs
mov dh, 0x86
test edi, edx
sub byte [edx], bl
xchg esi, eax
fild word [edx - 0x60]
xor eax, dword [ecx + 0x13]
mov cl, 0xb
aas
mov byte [0x56f3f8c], al
inc esi
aas
wait
inc edx
inc ecx
adc esi, dword [ecx - 0x735dc0f5]
aas
outsd dx, dword [esi]
add eax, 0x429b3f46
xchg edi, eax
xchg byte [esi - 0x46], al
mov edi, dword [edi + 0x6c49484b]
aas
out 0x78, al
xor byte [edi - 0x7cc01071], dl
jp 0x49a1bf
dec edx
pop ss
or byte [esi - 0x48159570], bh
ficomp word [esi]
pop ds
invalid