joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510480
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x510523
test eax, eax
jbe 0x510523
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x510523
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x5104ce
xor esi, esi
jmp 0x5104d4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x5104ff
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0051bd30
add esi, eax
push esi
mov ebx, esi
call fcn.0051bd30
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x5104e0
pop ebp
test edi, edi
pop edi
jne 0x510523
test ebx, ebx
je 0x510523
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00534990
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x510645
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x51075d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x51075d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0054686f
mov esi, eax
test esi, esi
je 0x51075d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x51075d
mov ecx, esi
call fcn.005105d0
cmp edi, eax
jge 0x51075d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x5106e3
mov dword [esp + 0x34], 1
jmp 0x51073e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x51075d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0050fb80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x51ddf0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
call fcn.00524200
mov ebp, dword [esp + 0x220]
mov eax, dword [esp + 0x21c]
push ebp
push 0
push 0
push eax
push 0xaade88
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
cmp edi, 0x20
ja 0x51dee9
lea ecx, [esp + 0x10]
push ecx
push str..htm
push accept
mov ecx, esi
call fcn.004ae5f0
test eax, eax
jne 0x51dee9
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push accept
mov ecx, esi
call fcn.004ae5f0
test eax, eax
jne 0x51dee9
lea edx, [esp + 0x10]
push str.__1_
push edx
call fcn.005351a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x51deba
lea eax, [esp + 0x10]
push 0xaade60
push eax
call fcn.005351a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x51deba
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x51debd
mov byte [esi], 0
push 0xaad628
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x524140
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5550a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x5241f0
mov eax, dword [0xab05d0]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.005451ec
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0054523b
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.00545198
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x5241d7
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x5241d7
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00544e08
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5272f0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x555530
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x527497
mov ecx, dword [0xab05d0]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x5273ec
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00526010
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00544ef5
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.00544e08
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xaad628
call fcn.00544e76
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.005263d0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.00544ef5
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.00544e08
lea ecx, [esp + 0xc]
call fcn.005452d0
mov ecx, dword [esp + 0xc]
push 0xaae064
push ecx
call fcn.00534054
add esp, 8
test eax, eax
je 0x527414
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x52734d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.00544e08
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00544e08
jmp 0x52749b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00527090
test eax, eax
push 0
je 0x52747f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.00525730
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x527465
cmp eax, 0x64
jg 0x527453
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x5273f0
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x5273f0
cmp eax, 0x64
jge 0x5273ec
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x5273f0
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.00525730
mov esi, eax
jmp 0x5273f0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x5274a5
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x52f060
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0xa8c920
push 1
push 0
push 0xa8c910
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x52f08e
xor eax, eax
add esp, 0x210
ret 8
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp]
lea edx, [esp + 4]
push edx
push 0xa8c9c0
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x52f0c2
xor eax, eax
add esp, 0x210
ret 8
mov ecx, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push 2
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 1
add esp, 0x210
ret 8

Function at 0x547213
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x54724b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00545263
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0054523b
jmp 0x547257
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x548909
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x54894b
call fcn.0054e734
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x54894b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x548942
xor eax, eax
jmp 0x548953
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00548959
pop edi
pop esi
pop ebx
ret 4

Function at 0x54ec64
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x54ec92
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x54ecb0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0054ebca
jmp 0x54ecb0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x54ecb0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0054ebca
test edi, edi
mov eax, edi
jne 0x54ec9a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1002aaee
pop dword [ebp - 0x4c]
mov eax, 0x1002aaee
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x8fbe0e90
add dword [ebp - 0x5c], 0xbe9436bb
mov dword [ebp - 0x58], 0x4d50a66c
add dword [ebp - 0x58], 0xe4e2a5d9
mov dword [ebp - 0x54], 0x92328547
add dword [ebp - 0x54], 0xba19bee7
mov dword [ebp - 0x50], 0x54cd5aba
sub dword [ebp - 0x50], 0x54cd5aba
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x86eadc6f
add eax, 0x8917e3c9
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xa1664b3b
sub dword [ebp - 0x5c], 0x2cf3e1e5
mov dword [ebp - 0x58], 0x6fda73b1
add dword [ebp - 0x58], 0xd191edc4
mov dword [ebp - 0x54], 0x51040634
sub dword [ebp - 0x54], 0xed9499c8
mov dword [ebp - 0x50], 0x6caa4cc5
add dword [ebp - 0x50], 0x9355b33b
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xd5d6452f
sub eax, 0xc5d38507
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3523c
push 0
call eax
mov ecx, 0x42b0
mov edi, eax
mov ebx, 0x2f4e56d8
add ebx, 0xe0b53f28
add ebx, dword [ebp - 0x4c]
mov esi, 0x1f8fca17
add esi, 0x561d97d0
mov dword [ebp - 0x2c], 0xafbd8fed
mov edx, dword [ebx]
sub dword [ebp - 0x28], edx
xor edx, esi
mov dword [edi], edx
add dword [ebp - 0x30], eax
add edi, 0x4941c1a1
sub edi, 0x4941c19d
add ebx, 0xadb680a7
sub ebx, 0xadb680a3
loop 0x1002ac05
add eax, 0xf5cb7884
add eax, 0xa35850f
mov ebx, eax
add eax, 5
mov ecx, 0x8395a1ae
sub ecx, 0x7395a1ae
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x100232f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10023308
pop dword [ebp - 0x18]
mov eax, 0x10023308
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x41495
push 0
mov eax, 0x4be4e86e
sub eax, 0x3bdd6752
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x40a5
mov edx, eax
mov esi, 0x404e13ae
add esi, 0xcfca5e52
add esi, dword [ebp - 0x18]
mov ebx, 0x8cf3e4d0
add ebx, 0xffd848e2
xor dword [ebp - 0x14], esi
mov edi, dword [esi]
sub dword [ebp - 4], 0xb0fbf793
add edi, ebx
mov dword [edx], edi
mov dword [ebp - 0x14], 0x44a18b6a
add edx, 4
add esi, 0xe984084e
sub esi, 0xe984084a
loop 0x1002335c
add eax, 0x9c5fa4ac
sub eax, 0x9c5eaf45
mov ebx, eax
add eax, 0xdc385264
add eax, 0x23c7ada1
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10071ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x10071f6b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x10071f22
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x10071f22
cmp esi, ebx
jge 0x10071f22
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10071f65
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10071f65
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x10071f7d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x100721a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x100721c8
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x100721e2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.100232f9
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100762d0
leave
ret 4

Function at 0x100723b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x100723e6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10072445
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.100232f9
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.100232f9
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.100232f9
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100762d0
leave
ret 0x10
Function at 0x10072460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007248c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x100724bd
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x100724bb
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100232f9
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x100724bd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100762d0
leave
ret 8
Function at 0x40a2c4
Capabilities:
Encode data using xor

Disassembly:
pop eax
and byte [edx + 0x5bd5d089], 0x12
xchg ecx, edx
xor eax, 0x9ab81ce9
and eax, 0x3544a900
sahf
aas
mov dh, 0x84
aad 0x10
xchg ebx, eax
outsd dx, dword es:[esi]
pop ebp
xor byte [edi], bl
stc
push edi
stosd dword es:[edi], eax
mov eax, 0xee5fb46
push eax
enter 0xffffffffffffa4e2, 0xffffffffffffffa5
pop ecx
push 0xffffffffffffffcb
imul edi, dword [edi - 0x31], 0xa10b3388
mov al, 0x66
jbe 0x40a2ce
xchg dword [ebx + 0x408a715c], ebx
add dword [ebx + edi + 0x53d5520b], esi

Function at 0x420284
Capabilities:
Encode data using xor

Disassembly:
jg 0x4202d9
ror byte [ecx + edx], 0x74
or dword [ebp + 0x43e0dff9], esp
scasb al, byte es:[edi]
mov edx, 0x7acdae26
pop ds
invalid
push edi
inc dword [ebx + edx*8]
ret

Function at 0x42a96c
Capabilities:
Encode data using xor

Disassembly:
xor al, 8
aam 0x7f
in al, dx
mov al, 0xf5
stosb byte es:[edi], al
dec ecx
jb 0x42a9a0
pop ebp
push eax
inc edx
pop ebp
cmp eax, 0x49458410
cmp al, 0x9d
xchg edi, eax
mov al, 0x5b
sub dword [esi - 0x6e51682e], ecx
sub edx, ebx
js 0x42a9ce
push ds
invalid

Function at 0x4416bc
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0xb7
cmp al, 0xf3
xor ah, bl
or ah, byte [edi - 1]
push eax
xor byte [edi + 0x4ebf0e57], 0x15
stosd dword es:[edi], eax
pop esp
out 0xb1, al
jb 0x4416ab
stosd dword es:[edi], eax
sbb ebp, dword [edx]
sub edi, dword [edi + 0x1555808f]
push ecx
push edi
cmp bl, byte [edi - 0x1667020d]
shl ah, 0x10
invalid
Function at 0x442945
Capabilities:
Encode data using xor

Disassembly:
push 0xb8261d19
xor cl, bh
outsd dx, dword [esi]
sbb dword ss:[0x5e410232], esi
xor al, 0x1e
jl 0x44292d
rol dword [ecx], 0xd9
jne 0x442911
mov byte [0xde23dc5a], al
pop ds
xor dword [eax], esp
mov ecx, 0x86d61126
pushfd
imul edi, dword [esi], 0x37
pop ebx
dec eax
invalid
mov ecx, 0x5048a066
inc esp
loop 0x4428f6
in al, dx
jns 0x442986
aam 0xeb
dec esi
pop esp
fstp qword [eax]
jns 0x44297a
sbb byte [ecx + edi*2 + 0x65], ah
or byte [ecx - 0x6dfd3439], ch
xor dword [ebx - 0x39], ebx
invalid
cmp bh, byte [ecx]
and dword [edx - 0x1e], edx
mov al, 0xb
pushal
jp 0x442909
adc eax, 0x1cbbd468
retf 0x1673
push edx
push eax
jb 0x4428cb
imul edi, dword [ebx + 0xf], 0x11
jbe 0x442901
adc dword [esi - 0x4e], esi
jno 0x4429b2
cwde
clc
dec ebp
xor bh, byte [esi + 0x385c7714]
aam 0x1e
je 0x44294c
retf 0xa72d
xchg esi, eax
mov dl, 0x71
jo 0x442984
mov ecx, 0x85c5d039
pop ebx
test dword [ebx - 2], ebx
adc ebp, ecx
jle 0x442a09
invalid
inc ebx
dec ecx
cli
mov gs, word [eax + ebx - 0x2c62d6bf]
nop
sar dword [ebp + 0x4e1f4adf], cl
push ebp
salc
in eax, 0x75
push cs
invalid
cdq
add eax, 0x5d745cf9
jae 0x4429f5
mov eax, 0x2fbe5a72
ror dword [ebp + 9], 0x53
popal
fld dword [ecx + 0x64]
pop esi
cli
push 0x14f2867b
mov byte [0xe3dc606a], al
cmp dword [ebp + ecx*4 + 0x38b87b03], eax
pop edx
xchg esp, eax
cmp byte [edx - 0x6c], bl
mov eax, dword [edi]
xchg dword [ecx + ebx*4 + 0x2b], esp
popal
cmp al, 0x80
fld xword [ebx - 3]
cmp byte [eax + ecx - 0x54], bh
or al, byte [eax + 0x854549a]
mov esi, 0xf95f62f
invalid
xchg ebp, eax
paddusw mm5, qword [edx]
cmp esi, edx
sahf
lcall 0x80d3, 0xd7e976ba
jae 0x4429c7
ret
fist word [ebx]
or ah, byte [esi + 0x73]
leave
fild dword [eax]
insd dword es:[edi], dx
push es
stc
mov al, byte [0x77aaf3af]
mov dh, 0x77
fisttp dword [edi + ebp*4]
sal dword [eax], cl
test al, 0x9f
call 0x25ef9961
fiadd dword [ebx + 0x1d]
ja 0x4429d9
jno 0x442a66
sub eax, 0xdc410ad3
mov ebp, ebx
cmp bl, byte [ecx - 0x48207a26]
sbb al, 0x53
invalid
add byte [edx - 5], 0x6c
cwde
int1
cmc
mov bh, 0xb4
invalid
Function at 0x451754
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x28d395b1
pop ebx
xor dh, byte [edx + 0x1d]
mov ecx, 0xb1489f75
dec ebx
or byte [ebx], cl
lodsd eax, dword [esi]
add byte [ebp + 0x3b], ah
dec ebx
fstp xword [ebx - 0x1a53ea4f]
inc esi
xchg byte [edi + 0xe], dl
outsd dx, dword [esi]
xor byte [ecx + ebp - 0x5c5e0692], bh
imul esi, ebp, 0x4f
sub edi, esi
cmpsb byte [esi], byte es:[edi]
add byte [ecx + 0x76], ah
aaa
add dword [ebp - 0x5ecd8a18], ebp
outsb dx, byte [esi]
add eax, 0x8964008e
xchg dword [eax + 0x7b], ecx
inc ebp
cmp edx, dword [ecx - 0x44]
ror esp, 1
add esi, edi
adc ecx, dword [ebp - 0x39e9d7ba]
mov fs, word [edi]
add eax, 0xa3f17df
dec ebx
xchg ebp, eax
mov ecx, 0x730486df
outsd dx, dword [esi]
dec ecx
push 0x70
push eax
jae 0x451778
outsd dx, dword [esi]
adc eax, 0x843faa2f
xor byte [esi + 0x4c51719a], 0xbf
cmc
add byte [ecx + ebp*2], al
movsd dword es:[edi], dword [esi]
pop ds
and dword [ecx], esp
sub al, 0xb3
jae 0x451843
mov edx, 0x112b200b
or eax, 0xffd4d457
daa
shl dword [eax], cl
pop esp
inc edx
clc
adc eax, 0x47cccdf0
dec edx
xchg ebp, eax
js 0x4517f3
in al, dx
xchg esi, eax
mov esi, 0x68fb1c7
push es
pop es
pop ebx
sub dh, byte [ebp + edx*2 + 0x2f]
je 0x4517f5
imul edi, dword [ecx - 0x6d111f3b], 0xffffffa3
xchg esi, eax
mov ah, 0x4f
das
movsd dword es:[edi], dword [esi]
push esp
inc ebx
sub edi, dword [edx]
jg 0x45182c

Function at 0x467c84
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x6352afc8], al
jb 0x29d5b081
mov edi, dword [eax]
invalid

Function at 0x46f345
Capabilities:
Encode data using xor

Disassembly:
std
cmp byte [edx - 0x226e872f], bl
push edi
out 0x63, eax
je 0x46f376
mov ecx, 0xdbdfe6c2
mov edi, 0x48f3567b
movsb byte es:[edi], byte [esi]
arpl sp, dx
std
adc edx, esp
mov eax, 0x57f755ef
mov eax, dword [esi - 0x47cbaef5]
nop
arpl ax, cx
mov dword [ecx + 0x1a], esp
inc edi
pop ecx
enter 0xffffffffffffcd5a, 0xffffffffffffffa0
aaa
xchg esi, eax
add byte [edx - 0x1c], ah
push ebp
rcl dword [ebx + eax*4], cl
je 0x46f3ac
jb 0x46f3a7
in eax, 0x1b
or byte [edx + 0x16a9e69c], cl
push ss
xchg edx, eax
pop ds
inc ecx
push ebx
in eax, 0x28
xchg edi, eax
outsd dx, dword [esi]
lodsb al, byte [esi]
outsd dx, dword [esi]
lcall 0x9987, 0x7b5279e9
inc esi
popfd
xor al, 0
popal
fdivr dword [ecx - 0x5d62f105]
sbb esp, esp
daa
pop ebx
movsd dword es:[edi], dword [esi]
jns 0x46f3b1
pop ecx
invalid