joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a7db
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [edx + 0x3f]
push esi
shr eax, 6
mov esi, edx
sub esi, eax
mov dword [esp + 0x10], edx
push edi
xor edi, edi
mov ebx, ecx
and dword [esp + 0x18], edi
inc esi
imul eax, esi, 3
shr eax, 2
cmp eax, dword [ebp]
jbe 0x42a812
mov eax, 0xffffff53
jmp 0x42a9e5
mov esi, dword [esp + 0x20]
cmp edx, 3
jbe 0x42a9d3
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
lea edx, [esp + 0x18]
call fcn.0042a77d
add esp, 4
test eax, eax
jne 0x42a9cc
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
mov byte [esp + 0x13], cl
mov dword [esp + 0x18], eax
test cl, cl
je 0x42a9d3
dec dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.0042a77d
add esp, 4
test eax, eax
jne 0x42a9e5
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x12], cl
mov ecx, ebx
push eax
call fcn.0042a77d
add esp, 4
test eax, eax
jne 0x42a9e5
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x24], cl
mov ecx, ebx
push eax
call fcn.0042a77d
add esp, 4
test eax, eax
jne 0x42a9e5
mov eax, dword [esp + 0x18]
mov dl, byte [esp + 0x13]
mov dh, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
cmp dl, 0x2b
jb 0x42a9c5
mov cl, byte [esp + 0x12]
cmp cl, 0x2b
jb 0x42a9c5
mov al, byte [esp + 0x24]
cmp al, 0x2b
jb 0x42a9c5
cmp dh, 0x2b
jb 0x42a9c5
cmp dl, 0x7a
ja 0x42a9c5
cmp cl, 0x7a
ja 0x42a9c5
cmp al, 0x7a
ja 0x42a9c5
cmp dh, 0x7a
ja 0x42a9c5
xor ecx, ecx
cmp al, 0x3d
setne cl
xor eax, eax
inc ecx
cmp dh, 0x3d
setne al
add ecx, edi
add eax, ecx
cmp eax, dword [ebp]
ja 0x42a808
mov cl, byte [esp + 0x12]
movzx eax, dl
mov al, byte [eax + 0x46882d]
mov byte [esp + 0x13], al
movzx eax, cl
mov ch, byte [eax + 0x46882d]
mov al, byte [esp + 0x24]
cmp al, 0x3d
jne 0x42a968
xor cl, cl
jmp 0x42a971
movzx eax, al
mov cl, byte [eax + 0x46882d]
cmp dh, 0x3d
jne 0x42a97a
xor al, al
jmp 0x42a983
movzx eax, dh
mov al, byte [eax + 0x46882d]
mov ah, byte [esp + 0x13]
mov dl, cl
shl dl, 6
or dl, al
shl ah, 2
mov al, ch
shr al, 4
or al, ah
mov byte [edi + esi], al
inc edi
cmp byte [esp + 0x24], 0x3d
je 0x42a9af
shr cl, 2
shl ch, 4
or cl, ch
mov byte [edi + esi], cl
inc edi
cmp dh, 0x3d
je 0x42a9d3
mov byte [edi + esi], dl
inc edi
cmp dword [esp + 0x14], 3
ja 0x42a81f
jmp 0x42a9d3
mov eax, 0xffffff66
jmp 0x42a9e5
cmp eax, 0xffffff7c
jne 0x42a9e5
test esi, esi
je 0x42a9e0
cmp dword [ebp], edi
jbe 0x42a9e0
mov byte [edi + esi], 0
mov dword [ebp], edi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x42e0e1
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x42e1db
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 0x18]
jne 0x42e102
test esi, esi
jne 0x42e1db
cmp edx, 3
je 0x42e138
cmp edx, 4
je 0x42e138
cmp edx, 5
je 0x42e138
cmp edx, 6
je 0x42e138
cmp edx, 7
je 0x42e138
cmp edx, 8
je 0x42e138
cmp edx, 0xa
je 0x42e138
cmp edx, 0xb
je 0x42e138
cmp edx, 0xc
je 0x42e138
cmp edx, 0xd
jne 0x42e1db
xor ebx, ebx
mov byte [edi + 0x114], dl
push ecx
mov byte [edi + 0x115], bl
call fcn.0042e0c4
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x42e1e0
cmp byte [edi + 0x114], 6
lea ecx, [edi + 0x70]
jne 0x42e1db
cmp esi, 0x40
ja 0x42e17e
cmp dword [esp + 0x14], ebx
je 0x42e1a7
push esi
push dword [esp + 0x18]
push ecx
call fcn.004358d0
add esp, 0xc
jmp 0x42e1a4
mov edx, dword [esp + 0x14]
mov ecx, edi
push esi
call fcn.00432fc3
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x42e1d7
lea edx, [edi + 0x70]
mov ecx, edi
call fcn.0043309e
mov ebp, eax
test ebp, ebp
jne 0x42e1d7
push 0x20
pop esi
lea ecx, [edi + 0x70]
cmp esi, 0x40
jae 0x42e1bf
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [ecx + esi]
push ebx
push eax
call fcn.00435e50
add esp, 0xc
mov al, byte [ebx + edi + 0x70]
xor al, 0x5c
mov byte [edi + ebx + 0xb0], al
xor byte [ebx + edi + 0x70], 0x36
inc ebx
cmp ebx, 0x40
jb 0x42e1bf
mov eax, ebp
jmp 0x42e1e0
mov eax, 0xffffff53
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x43205f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
push edi
inc ebx
inc esi
cmp dword [esp + 0xe8], 0
mov edi, ecx
push 0
cmovne ebx, dword [esp + 0xec]
mov ebp, edx
pop ecx
test bl, 0x1f
mov eax, ebx
push 0x37
push dword [esp + 0xf0]
setne cl
shr eax, 5
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x44]
push eax
call fcn.004358d0
and dword [esp + 0x20], 0
add esp, 0xc
cmp dword [esp + 0x10], 0
jbe 0x43219d
lea ecx, [esp + 0x74]
call fcn.004330dd
mov esi, eax
test esi, esi
jne 0x43219d
push 0x37
lea edx, [esp + 0x40]
lea ecx, [esp + 0x78]
call fcn.00432fc3
mov esi, eax
pop ecx
test esi, esi
jne 0x43219d
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x74]
call fcn.0043309e
mov esi, eax
test esi, esi
jne 0x43219d
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004358d0
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [edi], 1
jbe 0x432148
cmp eax, dword [edi + 4]
jne 0x432148
cmp byte [edi + 0x76], 1
je 0x4321bb
mov edx, dword [esp + 0x10]
mov byte [edi + 0x76], 1
lea eax, [edx - 1]
cmp dword [esp + 0x14], eax
lea ecx, [edx + 1]
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x43214f
mov byte [edi + 0x76], 0
mov dword [edi + 4], eax
test ebp, ebp
je 0x43218a
test ebx, ebx
je 0x43218a
lea eax, [esp + 0x1c]
cmp ebx, 0x20
jb 0x43217d
push 0x20
push eax
push ebp
call fcn.004358d0
add esp, 0xc
lea ecx, [esp + 0x3c]
sub ebx, 0x20
add ebp, 0x20
call fcn.00432050
jmp 0x43218a
push ebx
push eax
push ebp
call fcn.004358d0
add esp, 0xc
xor ebx, ebx
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10]
jl 0x4320bd
push 0x37
pop edx
lea ecx, [esp + 0x3c]
call fcn.0041c611
xor eax, eax
test esi, esi
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
push 3
pop eax
jmp 0x4321b0

Function at 0x4328b7
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x432863
mov eax, 0xffffff53
pop esi
ret
push edi
push 0x20
xor edi, edi
push edi
push esi
call fcn.00435e50
add esp, 0xc
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
xor eax, eax
mov dword [esi + 0x68], edi
mov dword [esi], 0x6a09e667
pop edi
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
ret
test ecx, ecx
jne 0x4328c1
mov eax, 0xffffff53
ret
mov dword [ecx + 0x6c], edx
jmp 0x432855
Function at 0x432fe2
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x432ff0
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0x43303d
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.00435e50
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.0043282b
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.004328c9
test eax, eax
jne 0x433099
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.00435e50
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.0043282b
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.004358d0
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.004358d0
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.004328c9
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x43309e
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x4330d5
test edi, edi
je 0x4330d5
call fcn.00432fe2
test eax, eax
jne 0x4330da
push 0x20
mov edx, esi
mov ecx, esi
call fcn.0043282b
push 0x20
push esi
push edi
call fcn.004358d0
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0x432855
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0x43318d
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0x433227
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x433227
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.0042e870
mov dword [esp + 0xc], eax
test eax, eax
jne 0x43322c
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0x4331ed
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00433177
mov ecx, ebx
mov esi, eax
call fcn.00433177
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0x4331c7
jmp 0x433212
mov ecx, dword [esp + 0x10]
jmp 0x433212
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00433177
mov ecx, ebx
mov esi, eax
call fcn.00433177
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0x4331f3
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0x43322c
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x44afb5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044ae34

Function at 0x44e98f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044e2fd

Function at 0x44e99a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044e538
Function at 0x410b2e
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0xc3
push es
movsb byte es:[edi], byte [esi]
inc eax
inc ebx
popal
retf
mov word fs:[esi + 4], es
inc ebp
xor dword [ebp + edi*2 - 0x67], 0xc54c40eb
adc eax, 0x2aefcf85
int 0x36
inc eax
sbb esi, esi
lds esp, [esi + 0x43f3c863]
hlt
das
or ah, byte [ecx + 0x71]
cmp bl, bh
insb byte es:[edi], dx
pop esp
lcall 0x23ac, 0x739ae225
or eax, 0xc92d36a7
in al, 0x48
jp 0x410a99
in eax, 0xc0
xor eax, dword [edi - 0x2873e32c]
sal byte [ebx], 0x87
aam 0x1c
mov edi, ss
pop esp
ja 0x410af9
imul ecx, dword [edi - 0x59], 0xffffffe1
invalid
sbb ebx, dword [ecx + 0x6d]
je 0x410abc
adc byte [edi - 0x13], 0xd5
add al, byte [ebp - 0x18]
inc ebp
jnp 0x410b8c
aad 0x97
xor dword [eax - 0x31], esp
xchg edi, eax
mov dl, 0x44
fisubr dword [ebx]
jecxz 0x410bc0
rcl ah, 0x6d
popal
xor al, 0x56
xor al, 9
inc esp
aam 0xa6
invalid
pcmpeqw mm6, qword [edi - 0x1a]
loop 0x410b12
or dword [eax + 0x37], esp
xor cl, byte [eax]
cld
inc byte [ecx + eax*4 - 0x5e]
dec edi
mov edx, 0x724474d0
push ebx
mov ch, 0xd0
adc eax, 0xbe007fa0
ror byte [eax - 0x40041f5], 0x29
jl 0x410bab
mov byte [ebx], cl
mov esi, 0x7c29fbff
clc
inc ebp
hlt
das
insd dword es:[edi], dx
mov ebp, 0x21fc7fff
stc
call [edx - 0xb02fe70]
jl 0x410c41
adc esp, dword gs:[ebp - 0x28]
div dword [edi - 0x239a2879]
je 0x410bf8
sub byte [edx], al
mov eax, 0xe7cf98fe
push ebp
cmp dl, byte [eax - 0x5a]
aam 0x7c
adc cl, byte [esi - 0xd9f3bd4]
arpl word [edi + 0x73d5b66c], di
mov ch, byte [ebx]
sahf
push edi
xor cl, al
sub ebx, dword [esi - 0x3ecfc1a9]
lds edi, [edx]
int1
dec byte [eax + 0x43]
mov ah, 0x68
mov dword [0x299ffd0e], eax
imul ebx, dword [edi - 0x4f0b18a], 0x5740b980
mov al, byte [0xd85d22db]
rcl dword [edi + 0x6b88d732], cl
pop esi
adc cl, ch
push ss
mov bl, 0xaa
std
push es
jnp 0x410c84
call [ecx]
invalid
mov dh, 0x20
aad 0x56
test dword [ebp - 0x4c], edx
cmp eax, dword [edx]
jle 0x410c8c
daa
ret 0x2d6c
invalid
sbb ah, byte [esi + 0x2087452d]
shr dword [ebx + ecx*4 - 0x4d], cl
jp 0x410cda
mov esi, dword [ebx + 0x557b4a7a]
jnp 0x410ce7
pop dword [ecx + 0x71]
wait
paddsw mm0, qword [esi]
jo 0x410c78
inc eax
and al, 0x9f
out dx, al
ror byte [eax - 0x26da914a], cl
stosd dword es:[edi], eax
shl byte [ecx - 0xb], 0x29
out dx, al
cmc
sub esi, ebp
push edi
stc
salc
nop
add ch, dl
sbb ebx, edx
and bl, bh
xor eax, 0x6218eecd
fadd dword [eax]
jno 0x410ca8
jno 0x410d23
invalid
invalid
mov al, 0xdf

Function at 0x417e10
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x4c7a9c], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [0x4c7a9c]
push 0x10
add ecx, eax
mov dword [0x4c7a9c], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x417e4d
or dword [esi], 0x2000000
mov eax, esi
pop esi
ret
Function at 0x427362
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x364d614a
mov byte [0x5e1c259c], al
inc ebx
xlatb
push edi
push esi
pop esi
mov al, byte [edi - 0x7b17f3d9]
push eax
cmp esp, eax
pop ss
and eax, 0x38007499
dec ebp
xor esi, dword [eax + 0x1f]
push ss
insb byte es:[edi], dx
xchg byte [ebp - 0x26055b70], bh
pop ebp
enter 0xffffffffffffdc49, 0x23
xor dl, al
aam 0xa9
or dh, byte [esi]
pop esp
mov byte [0x7a16b925], al
out 0xb7, al
sbb dl, byte [edi]
mov ch, 0xf6
xor dword [ecx], 0xffffff9a
mov edx, 0x8dcc561b
xchg dword [edx + 0x6f2d1dbb], ebx
and edx, ebp
inc ebx
cmpsb byte [esi], byte es:[edi]
loopne 0x427398
test al, 0xa9
std
out dx, eax
mov ah, 0xe7
xchg dword [edx + ecx - 0x44], ecx
cmpsd dword [esi], dword es:[edi]
mov ecx, 0xfecb7387
push esi
loopne 0x427429
arpl word [ebx], bp
inc ebp
xchg ebp, eax
invalid
cmp eax, 0xd6e16718
push cs
sub al, 0xb4
cmp dword [ebx], eax
xor al, 0x11
mov bh, 0x34
jl 0x427467
cmc
push cs
cld
add ebx, edi
mov edi, 0x2b83d731
dec ecx
push 0xffffffffffffffdd
outsb dx, byte [esi]
js 0x427473
sbb al, 0x2a
cld
invalid
call [esi]
push ds
jg 0x4274e9
int 0x33
mov dh, 0xfc
sub dh, byte [0x2214f31e]
adc al, 0x22
inc ebx
div dword [edx - 0xe]
stosd dword es:[edi], eax
sbb dl, byte [ecx]
pop ebx
salc
jge 0x4274e7
inc esi
sub byte [ebp - 0x2b], bh
inc eax
cmp bl, byte [ebx + 0x2c]
pushfd
xchg ebp, eax
shr byte [eax - 0x60], cl
cmp dword [edx + ebp + 0x2e54c0ce], ebp
dec ebx
mov dword [0x2da99373], eax
pop ebp
std
push esp
jge 0x42751c
push edi
loop 0x427520
sahf
mov ebx, 0xb997466d
xchg ebx, eax
adc eax, 0x3d7b3cbb
aas
cmp ah, byte [edx + 0x73]
movsb byte es:[edi], byte [esi]
je 0x4274d1
lahf
pop ebx
wait
movsd dword es:[edi], dword [esi]
and eax, 0x1afe4ad0
push ebx
in eax, dx
adc ebp, dword [edi + 0x6c7c9aab]
jp 0x427467
cld
js 0x4274dc
dec edx
std
jnp 0x4274b4
jnp 0x4274b4
popal
aas
xchg edx, eax
mov word [ecx - 0x11e77538], es
out dx, al
mov ah, byte [eax + 0x7b]
dec ebx
hlt
retf 0x35c1
xor eax, 0x22631a2c
retf 0x8c13
test dword [ecx - 0x42], esi
invalid
xchg edi, eax
jmp 0x42753b
xor eax, 0x1143ba31
pop ds
adc dword [edi], ebx
insb byte es:[edi], dx
fchs
mov dword [0x5444807d], eax
mov al, 3
sbb bl, ah
imul ebp, edi, 0x73
pop es
sbb eax, 0x42b1c077
sub cl, dl
dec esp
dec ecx
rol byte [ebx + edi*4], 0xe5
test eax, 0x7ed49cc3
enter 0x7bed, 0x71
cwde
aas
scasb al, byte es:[edi]
les ebp, [edx + eax*4 - 0x16]
jb 0x42756c
adc bl, byte [ebx - 0x7e]
rcr byte [ecx - 0x15], 1
mov fs, word [ebx - 0x7b63dd89]
cmp bh, dl
hlt
sahf
imul ebp, dword [ebx + 0x2c], 0x38
sbb dword [eax + 0xedf2b9d], ecx
jl 0x427511
scasb al, byte es:[edi]
insb byte es:[edi], dx
xchg edx, eax
sub al, 0x54
mov ecx, 0x7e478f98
js 0x42750a
xor ah, byte [edx - 0x69]
inc edx
mov ch, 0xab
loope 0x427585
int3
Function at 0x42821f
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x3a7d7da8]
xchg edi, eax
pop ss
test dword [eax - 0x4bb4ffc5], esp
xor dword [si + 0x46], 0x47913c01
pop edi
sbb dh, byte [edi]
sub byte [edx], dh
mov al, 0x2c
mov dl, 0x24
mov cl, 0x5e
sub edx, esi
clc
sub eax, 0x8052f73a
clc
cmp ebx, dword [ecx + ebx*8 - 6]
xor cl, byte [edx]
rcr ch, 0xd7
fisub dword [ebx]
leave
or al, 0x64
or eax, 0x8d01d27d
fsubr qword [ebx + edx*4]
dec esi
seta dl
js 0x428240
xlatb
sbb ch, cl
or al, 0x7a
aam 0xf
mov edx, 0xbf2d093e
sbb dword [ebx], 0xfffffff2
in eax, 0x2c
push ecx
sub al, 0xe5
cli
cmp cl, bl
inc ebp
invalid

Function at 0x428d5f
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0xe5
or al, 0x92
inc edi
cmpsd dword [esi], dword es:[edi]
adc al, 0xa1
adc al, 0x62
aaa
push 0x221e45
enter 0xffffffffffffb61b, 0x4e
cwde
xchg byte [ecx], cl
int3
sbb al, 0xbd
and eax, 0xe7fde57b
imul esp, ebp, 0x22f6f5d4
inc ebp
or dword [edx + 0x56], edi
int 0x1e
push esp
push esi
daa
salc
mov dl, 0xe8
popfd
sti
push ss
aaa
cmp cl, byte [edi + 0x21]
and dword [edi + esi*8 + 0x7a454794], edx
shl al, 1
inc eax
aad 0x67
jo 0x428d08
pushal
hlt
mov al, byte [0x294ec3c7]
and al, 0xd6
jns 0x428d24
inc ebp
mov edi, 0x51b5fbf5
sub al, 0x69
loopne 0x428daa
in eax, 0xe1
call 0xe3aa5b42
mov esp, 0xf571171c
and eax, 0x602ac3c
invalid
or dword [edi - 0x3123431b], edx
int1
mov bh, 0x7a
cmc
jp 0x428da1
xchg edx, eax
imul ebp, dword [edx + 0x6b39461d], 0xa2ef7178
invalid
Function at 0x43ca10
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
mov al, 0xa
push 0x3d684a36
rcr byte [esi], cl
outsd dx, dword [esi]
and byte [ebp - 0x61], 0x4f
pop ds
jbe 0x43c960
and eax, 0x761f4f9f
call edx
add eax, 0x2009f3e
rol byte [0x2009f3e], cl
and ebx, edi
pop eax
cmc
ror dword [ebx], 1
aaa
outsb dx, byte [esi]
add eax, dword [edi]
add eax, 0xc2f0d6a1
push ebp
cwde
sbb byte [edx], bl
cmpsb byte [esi], byte es:[edi]
mov al, byte [0x8fb6e5a2]
pop ebx
clc
pop ebp
xchg edx, eax
jl 0x43c94d
ret 0x9855
push ds
pop eax
outsd dx, dword [esi]
xchg ebx, eax
ror dword [ebp + edi*4 + 0x73], 0xde
leave
adc eax, 0x6fe1764f
dec esp
mov ebp, 0x15c9de73
dec edi
jbe 0x43c975
outsd dx, dword [esi]
push edx
adc edx, dword [ebx + 0x3e]
stosd dword es:[edi], eax
adc byte [ecx], ah
adc eax, 0x8fa9a05b
sal dword [esi + 0x76], 1
xor bl, 0xbf
or dword [ecx], ebx
mov byte [0xaa82aa1d], al
sbb bh, byte [ebx]
mov bl, 0x1c
das
dec eax
pop eax
insb byte es:[edi], dx
mov dh, 0xa
jle 0x43c99c
loop 0x43c95a
lahf
sal cl, 0xd0
not byte [eax - 0x54]
mov dh, 0xc6
movsb byte es:[edi], byte [esi]
pop edi
push 0x4c
xor byte [edx + 0x77], cl
lahf
leave
mov byte [eax + 0x51], ah
out dx, eax
jg 0x43c98b
push esp
sbb dword [esi + 0x2d], 0xa15a60e1
loopne 0x43ca1a
xchg ebp, eax
invalid
push ds
sar ecx, 0x95
call 0x70a6d2f8
stosd dword es:[edi], eax
scasb al, byte es:[edi]
test dword [ebx], 0x56c08b9a
cwde
adc al, cl
jge 0x43c9b5
push 0x2c
jae 0x43ca48
or eax, 0x2f02583c
ret 0xc196
jbe 0x43ca43
lahf
movsb byte es:[edi], byte [esi]
pop ss
scasb al, byte es:[edi]
jno 0x43c9b9
mov eax, dword [0xd07dc2de]
faddp st(2)
jge 0x43c9ec
mov dword [0x9ea93f3f], eax
fdivp st(0)
dec esi
push 0xffffffffffffff9b
test ecx, edx
lcall 0xa3cc, 0x95df3ed1
invalid
inc ecx
invalid
jecxz 0x43ca17
jae 0x43ca4f
jle 0x43ca48
pop es
pop es
add cl, byte [esi + 9]
dec ebp
push ds
mov cl, 0xd6
sbb eax, 0x6d87799c
lahf
pop ds
sub byte [edi], dl
cdq
mov dword [0x899074a9], eax
adc al, 0xf
lds edi, [ecx]
scasb al, byte es:[edi]
add dword [ecx - 0x15603e88], ebp
fstp qword [esi]
inc esp
push 0xffffffffffffffdb
pop ecx
pop ds
sahf
sub byte [esp + edx*4 + 0x74], ch
cmp dword [ebp + 0x16], esp
into
popfd
dec eax
ret

Function at 0x450596
Capabilities:
Encode data using xor

Disassembly:
inc esp
mov bl, 0x95
or al, 0xde
add eax, 0xfc1b03a1
adc al, 0x54
cld
das
arpl word [esi + 0xa72fee8], bx
pushal
in eax, dx
dec bx
xor al, bh
cli
popfd
inc dh
sbb cl, byte [edi - 0x170a6742]
mov esi, 0xe4e8f598
push ecx
mov esi, 0xe4e8f598
push ecx
push es
xchg ebx, eax
sbb eax, 0xf328abe0
lea edi, [ebx + esi*4 + 0x64]
arpl word [edx + 0x5a], dx
fstp dword [ebx*4 + 0x5fc2a6ae]
xor edi, dword [eax]
push 0xffffffffffffffbc
or bl, byte [esi]
popfd
push esi
insb byte es:[edi], dx
pop eax
scasd eax, dword es:[edi]
loope 0x450575
outsd dx, dword [esi]
push dword [esi + 0x5e57e6c7]
inc edx
xor al, 0xe3
pop ebx
cmp dword [0xbf87cf82], eax
or bl, byte [esi - 0x3c]
jae 0x4505c2
invalid
sub al, 4
xor al, 0xf9
jne 0x450629
std
retf 0x4f92
adc byte [edx - 0x6b], ah
test dword [ecx], ebp
in eax, 0x66
out dx, al
iretd
Function at 0x4590bb
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xe0ea7460
push 0xf8e2ad2d
mov al, byte [0x2c85cfc6]
dec edx
cmpsd dword [esi], dword es:[edi]
mov dl, byte [ebx - 0x5434aa3d]
mov esp, dword [ebp + edi*8 + 0x49341d6d]
push cs
lodsb al, byte [esi]
add dword [eax + esi*2], ebp
cmp eax, 0x2ac559cf
mov byte [edx + 0x6b], ch
movsb byte es:[edi], byte [esi]
sub eax, 0xbd96a13d
pop ebx
dec ebp
invalid

Function at 0x46f1d1
Capabilities:
Encode data using xor

Disassembly:
cmc
dec byte [edx]
ja 0x46f22f
or al, 0xf4
les esi, [ecx]
mov dh, 0x1b
pop esp
push es
adc eax, dword [esi + 0x31]
je 0x46f25d
mov dh, 0xfd
mov dword [eax - 7], eax
lodsd eax, dword [esi]
sub edi, ebx
pop esi
sub byte [edi - 0x70eca878], ah
sahf
invalid
invalid
or edx, esi
pop es
invalid

Function at 0x46f65e
Capabilities:
Encode data using xor

Disassembly:
sbb dword [eax + 0x32], esi
or byte [eax + 0x66], 0xf9
push ebx
xor edi, dword [esi]
jmp 0x13178f95
das
scasd eax, dword es:[edi]
sbb dl, ah
cmc
test byte [esi - 0x46], 0x90
mov cl, 0x98
mov ah, 0xc4
les edi, [ecx + 0x77]
les edi, [ecx + 0x77]
xor edx, dword [edx - 0xf32d178]
inc eax
pop ss
sar ecx, 0x22
out dx, al
push es
loop 0x46f62f
outsd dx, dword [esi]
lodsb al, byte [esi]
je 0x46f652
push ecx
jb 0x46f637
scasb al, byte es:[edi]
rcr ah, cl
cmc
sbb ch, ch
push esi
rcl dword [esi + 0x7e]
xchg esp, eax
dec ebp
sub al, 0xc0
std
or edi, dword [ebp - 0x274bcfb5]
mov esi, 0x421a9dd
dec edx
xchg esp, eax
invalid
mov ecx, 0x82b6f34b
cmpsd dword [esi], dword es:[edi]
cmp bh, byte [edi + esi*2 - 0x46148be6]
inc eax
invalid

Function at 0x484a27
Capabilities:
Encode data using xor

Disassembly:
inc ebp
jno 0x4849bc
sbb ebx, ecx
adc byte [edi + 0x16], bl
popal
xor dword [esi + 0x2e], 0x784c9818
div byte [ebx]
inc edx
lock xor byte [ebx - 0x5f], bl
jbe 0x4849b1
sub byte [edi], ah
in eax, dx
inc esi
movsb byte es:[edi], byte [esi]
invalid

Function at 0x4956d0
Capabilities:
Encode data using xor

Disassembly:
test dword [ebp + 0x31], ebx
adc ecx, dword [ecx + 0x6e]
xor dword [ebx], edx
dec ecx
outsb dx, byte [esi]
fldcw word [ecx - 0x6edd2560]
xchg esi, eax
mov al, 0x84
xor esi, esi
xor dword [edx + 0x10dfa307], edi
push edi
xchg edi, eax
mov esp, 0xcc90efb4
cmp cl, byte [eax - 0x47]
sbb dword [esp + edi*2 - 0xe92a948], esp
call [ecx + 0x158e84ee]
test eax, 0xb847d3fa
fld xword [0x85f28878]
out dx, eax
lcall 0x242a, 0xab6e021d
mov dh, 0x10
in al, 0x26
jge 0x4956ce
test byte [esp - 0xd], dh
xchg ebp, eax
push ds
cmp byte [ecx + 0x5c2ebc53], cl
sbb byte [esi + 0xf], bh
aad 0xa
cmp al, 0xa7
adc byte [edx + 0x4e], 0x5c
or byte [edi], ch
invalid

Function at 0x49a101
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esp
cmp byte [edx + 0x637d1abe], cl
adc dword [esi], ebx
xor eax, 0xa237c69b
mov bl, 0xc1
push esi
mov byte [0x4fd9c616], al
out 0x1d, eax
push es
jae 0x49a13c
cmp al, 0x33
invalid
nop
daa
mov fs, word [edi + 0x1e]
daa
mov dl, 0x93
in eax, 0xb7
mov eax, 0x417a0e1
mov al, 7
invalid