joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e8db
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x492070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0043e860
pop ecx
test al, al
je 0x43e904
mov eax, 0x1126
jmp 0x43ea70
and dword [ebp - 0xc], 0
xor eax, eax
push ebx
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push edi
push eax
push esi
mov dword [ebp - 8], 7
call fcn.0043e7d5
mov bh, al
lea eax, [ebp - 0x1c]
push eax
call fcn.0043ef11
mov bl, al
lea eax, [ebp - 0x1c]
push eax
push eax
call fcn.0043e73f
add esp, 0x14
test bl, bl
jne 0x43e94f
test al, al
jne 0x43e94f
test bh, bh
jne 0x43e94f
push 0x7b
pop esi
jmp 0x43ea60
xor bh, bh
or edi, 0xffffffff
test bl, bl
jne 0x43e9a2
push 0x46da78
lea ecx, [ebp - 0x4c]
call fcn.00421800
push edi
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004192b0
push eax
lea ecx, [ebp - 0x34]
call fcn.0041a430
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041fd50
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00418cb0
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00418cb0
inc bh
mov eax, edi
xor bl, bl
and dword [ebp - 0x24], 0
xor ecx, ecx
push eax
push ecx
lea eax, [ebp - 0x1c]
mov word [ebp - 0x34], cx
push eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
call fcn.00419190
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041fd50
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00418cb0
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
jne 0x43ea34
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x43ea3b
cmp esi, 3
je 0x43ea3b
cmp esi, 0x7b
je 0x43ea3b
test bl, bl
je 0x43ea60
test bh, bh
je 0x43ea60
push 1
push edi
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x5c
push eax
lea ecx, [ebp - 0x1c]
call fcn.00418ee0
cmp eax, 3
jne 0x43ea60
mov esi, 0x1126
jmp 0x43ea60
test eax, 0x400
jne 0x43ea5e
push 1
push edi
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x5c
push eax
lea ecx, [ebp - 0x1c]
mov bl, 1
call fcn.00418ee0
cmp eax, 2
ja 0x43e9a6
jmp 0x43ea2d
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00418cb0
pop edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044e44e
mov esp, ebp
pop ebp
ret
Function at 0x43f92b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x492070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
cmp byte [ebp + 8], 0
mov dword [ebp - 0x60], edi
jne 0x43f957
cmp dword [ebx + 8], edi
jne 0x43f985
xor eax, eax
jmp 0x43fa73
push edi
push 0x444ebf
push 1
push str.NtMapViewOfSection
mov esi, 0x46daac
push esi
call fcn.0043f381
push 1
push 0x444fe3
push 1
push str.NtUnmapViewOfSection
push esi
mov ecx, ebx
call fcn.0043f381
mov eax, dword [ebx]
push 1
push 0x2000
push 0x10000
mov eax, dword [eax]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push eax
mov dword [ebp - 0x58], eax
call edi
mov esi, eax
mov eax, dword [ebx + 8]
shl eax, 6
add eax, 0x50
push eax
mov dword [ebp - 0x5c], eax
call fcn.0043f597
pop ecx
mov ecx, eax
mov edx, 0xfffff000
and ecx, edx
and eax, 0xfff
add esi, ecx
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x5c]
push 0x40
push 0x1000
add ecx, 0xfff
and ecx, edx
push ecx
push esi
push dword [ebp - 0x58]
call edi
mov esi, eax
test esi, esi
jne 0x43f9ee
call fcn.00427e60
mov edi, dword [ebp - 0x64]
and dword [ebp - 0x48], 0
add edi, esi
mov esi, dword [ebp - 0x5c]
push 0xa4
push 0
push 0x4931e0
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 0x10
call fcn.004518b0
add esp, 0xc
lea eax, [ebp - 0x54]
mov ecx, ebx
push eax
push esi
push edi
call fcn.0043f6e5
test eax, eax
jne 0x43fa73
lea eax, [ebp - 0x60]
push eax
push 0x10
lea eax, [ebp - 0x54]
push eax
push edi
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x43fa70
cmp dword [ebp - 0x60], 0x10
jne 0x43fa70
lea eax, [ebp - 0x68]
push eax
push 0x20
push esi
push edi
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebx]
push 0xa4
push 0x4931e0
push str.g_originals
call fcn.0043aab4
jmp 0x43fa73
push 0x2a
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e44e
mov esp, ebp
pop ebp
ret 4
Function at 0x442fa6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x34]
push esi
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x44303e
cmp dword [ebp + 0xc], 0
mov ecx, 0x101c01
push edi
push 1
push 0
mov edi, 0x1fffff
mov eax, edi
cmove eax, ecx
push eax
push esi
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x443010
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x44303d
cmp dword [ebp + 0xc], 0
lea eax, [esi + 4]
push 1
push 0
mov ecx, 0x100c43
cmove edi, ecx
push edi
push eax
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
ret

Function at 0x4430f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x44311c
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 3
push 0
push 0
push dword [ebp + 0x20]
push dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
neg eax
pop esi
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
pop ebp
ret

Function at 0x44a8f6
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push dword [ebp + 8]
push edi
push 0x8000004
push edi
mov dword [esi], edi
push 0xffffffffffffffff
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
mov ecx, esi
call fcn.004225e0
push dword [esi]
call fcn.004223c0
pop ecx
test al, al
je 0x44a93d
push dword [ebp + 8]
push edi
push edi
push 6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x46326d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004630ec

Function at 0x466164
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00465e24
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x73241959
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x13cf2ad1
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x7ffe53c1
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
add eax, 0
cld
push edx
cdq
pop edx
nop
pushal
inc eax
popal
stc
push edx
cdq
pop edx
nop
lea esp, [esp]
nop
add eax, 0
stc
pushal
inc eax
popal
nop
push edx
cdq
pop edx
nop
pushal
inc eax
popal
cld
add eax, 0
cld
push edx
cdq
pop edx
cld
pushal
inc eax
popal
cld
and bh, 0xff
cld
push edx
cdq
pop edx
stc
add eax, 0
cld
lea esp, [esp]
stc
lea esp, [esp]
cld
and bh, 0xff
clc
cld
cld
call 0x7ffe5416
pop edx
add al, 0
nop
xor dx, dx
add edx, 0xd5e0
nop
xor ecx, ecx
cld
nop
stc
nop
mov cl, 0x1e
pushal
inc eax
popal
xor byte [ecx + edx], 8
loop 0x7ffe542f
and bh, 0xff
nop
pushal
inc eax
popal
nop
push dword fs:[0x24]
and bh, 0xff
clc
inc esi
dec esi
cld
pop dword [edx + 0xa]
lea esp, [esp]
clc
mov cl, 0xff
and bh, 0xff
stc
add eax, 0
clc
cld
push edx
loop 0x7ffe545d
cld
push edx
cdq
pop edx
stc
inc esi
dec esi
cld
mov dword [edx + 0x11], 0xffffacbb
cld
mov ecx, dword [eax + 0x2c]
stc
clc
mov dword [edx + 0x1b], ecx
add eax, 0
mov dword [edx + 0x100], ecx
lea esp, [esp]
cld
mov dword [eax + 0x2c], esp
add eax, 0
nop
cld
push 0
push 0
clc
and bh, 0xff
pushal
inc eax
popal
push 0
push edx
cdq
pop edx
nop
pushal
inc eax
popal
stc
push 0
push edx
cdq
pop edx
cld
stc
push 0x30
cld
cld
push 0x20
clc
push 0
pushal
inc eax
popal
clc
stc
stc
push 0
push edx
cdq
pop edx
cld
clc
clc
cld
add edx, 0xffff7f33
push edx
stc
lea esp, [esp]
clc
push edx
pushal
inc eax
popal
stc
push edx
cdq
pop edx
nop
push 0
pushal
inc eax
popal
stc
lea esp, [esp]
stc
stc
call dword [edx + 0x8210]
stc
add eax, 0
cld
nop
cld
nop
add esp, 0x3f8
cld
pushal
inc eax
popal
push eax
pop eax
cld
xor eax, eax
clc
stc
inc eax
stc
push edx
cdq
pop edx
cld
and bh, 0xff
nop
ret 0xc

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, reloc.winmm.dll_midiOutSetVolume
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
nop
jmp int.00401219
Function at 0x412100
Capabilities:
Encode data using xor

Disassembly:
dec edx
fdiv qword [ebx + 0x4c]
inc ebp
dec esp
push esi
sub byte [eax - 0x37ebdf7], 0x6b
adc eax, 0xca3e45d6
retf 0xe235
fist word [edi - 0x4e]
cwde
cmp ch, al
xchg edx, eax
pushfd
mov word [edx - 3], fs
out 0xd1, al
and eax, 0xf5220970
sub al, 0xc8
pop ds
sub byte [edi], cl
cmc
push edi
dec edx
add esp, 0xffffffac
pop ebx
mov ch, 0xc6
mov al, 0x73
inc esi
push edx
xchg esi, eax
jl 0x412130
clc
cmpsb byte [esi], byte es:[edi]
sbb bh, cl
and dword [eax + 0x6e], esp
or dword fs:[eax + 0x222c260d], 0xba1827e2
or dword [eax + 0x222c260d], 0xba1827e2
loopne 0x4120dd
lodsd eax, dword [esi]
mov ebp, 0xf3979d4f
cdq
pop ds
je 0x41217a
lodsb al, byte [esi]
int3
lcall 0x8450, 0x485645de
neg byte [eax - 0x5e]
jl 0x4121da
cli
fdivp st(3)
dec esp
push ss
or eax, 0xed867f24
jnp 0x4121ca
and ch, ah
push es
out 0x46, al
adc eax, dword [edi + 0x7b]
mov dword [edi + esi*2], ecx
adc ecx, dword [ebx + 0x4d]
jg 0x4121c1
xchg dword [eax + 0x41733e6f], edi
inc ecx
or al, 0x97
or dword [edi], ebp
das
test ah, al
pop ss
sal dword [ebx], cl
in al, dx
jbe 0x41221b
daa
aam 0x77
adc al, ah
push cs
inc byte [si + 0xe]
adc al, 0xdb
in al, 0xd4
mov ah, 0x69
jecxz 0x4121ad
out 0x25, al
push esi
cmp al, 0x70
sub dh, byte [edx - 0x36f81192]
and eax, 0x2a703c56
mov dl, 0x6e
out dx, al
pop es
leave
jne 0x4121ef
cmp dh, ah
mov esp, 0xaeba341
cmpsb byte gs:[esi], byte es:[edi]
mov dword [0xa6650aeb], eax
inc ebp
mov dword [0xef6473aa], eax
mov ecx, 0xb64b7d34
sbb al, 0xf0
int3
fmul qword [esp + esi - 0x44]
invalid
leave
lodsb al, byte [esi]
mov edx, 0xe6a3d656
bnd jl 0x4121a8
add eax, 0x1ff44c1a
sub al, 0xd5
in al, dx
add dh, ch
salc
int1
invalid
Function at 0x438980
Capabilities:
Encode data using xor

Disassembly:
into
inc ecx
xor ecx, ebp
inc edx
xchg edx, esp
rcl byte [edx - 0x52], cl
mov bh, 0xbb
invalid
push 0xffffffffffffffcd
or eax, 0x473c7e1f
cmpsd dword [esi], dword es:[edi]
invalid
xchg edi, eax
jnp 0x43891b
and dword [ebx + 0x14], 0xfb20c0c
xchg edx, eax
insd dword es:[di], dx
sub dword [ebp + 0x64], 0xffffffbc
clc
out dx, eax
inc edi
jp 0x4388d6
mov esp, 0x7a47eff8
mov ah, 0xa2
mov edx, 0xb54b4cf3
rcr byte ds:[eax + ebp*4 - 0x7fd2d2da], cl
mov byte [0x4b4cf3ba], al
mov ch, 0x3e
rcr byte [eax + ebp*4 - 0x7fd2d2da], cl
pop esp
out 0xf3, eax
dec esi
adc dword [ebx + 0x2e0a2ed5], 0x630d070a
mov edx, 0x542f045
in al, 0x58
mov byte [0x9ae2d18f], al
jns 0x4388f7
aas
push ds
fiadd word [edx]
aaa
movsb byte es:[edi], byte [esi]
fnsave dword [edx]
clc
hlt
movsd dword es:[edi], dword [esi]
mov edi, 0x6f030970
pop edi
adc byte [edi - 0x50], bh
jl 0x43890c
and eax, 0x4055cb2
push esi
mov esi, 0xf732e727
and al, bl
push ebx
pushfd
out 0x24, al
aad 0xeb
rcl ah, cl
cmp ecx, dword es:[edi]
or al, 0x1e
stc
dec esp
call 0x8d3335c8
out 0x96, al
dec eax
std
add eax, dword cs:[esi - 0x11ec6ddc]
mov cs, word [ebx]
int 0x99
cmp al, 0x66
or esp, dword gs:[ecx + edi]
sub al, 0x74
inc ebx
out 0x3c, eax
faddp st(4)
or esp, esi
mov eax, dword [0xcd9a451]
lcall 0xbf0c, 0x6b9a0116
sub al, 0xbb
xor dword [edi], esi
popfd
dec esi
dec ebx
mov ecx, 0x6e5acbcd
mov ecx, 0x6d4708b
sbb al, 0x92
cmp al, 0xa8
insb byte es:[edi], dx
invalid

Function at 0x44a610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x652f04
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x44a62d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDB3EE7802_8224_4787_A1EA_F0DE16DEABD3InprocServer32
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0xa53200], eax
jne 0x44a6aa
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x652f04
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0xa53200], eax
jne 0x44a692
cmp dword [esp + 8], ebx
je 0x44a694
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x44a6aa
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa53200]
test ecx, ecx
jne 0x44a6cd
test eax, eax
jle 0x44a6c8
and eax, 0xffff
or eax, 0x80070000
mov dword [0xa53200], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret
Function at 0x44a6e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
mov dword [esp + 8], 0
call fcn.0044a610
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x44a753
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push str.IsWow64Process
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44a753
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test edi, edi
mov ebx, eax
je 0x44a74a
mov ecx, dword [0x652df4]
push 0x652b28
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea edx, [esp + 0xc]
push edx
push ebx
call esi
pop ebx
mov ecx, dword [esp + 8]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
add esp, 8
ret

Function at 0x45cf87
Capabilities:
Encode data using xor

Disassembly:
pop ecx
sub esi, dword [ecx]
pop esp
in eax, dx
mov eax, dword [0x395613f7]
jo 0x45cfb3
adc dword [ebp - 0x7a], ebp
invalid
xchg esp, eax
loope 0x45cfb4
pushal
test dword [edx + 0x6d], eax

Function at 0x4a50bb
Capabilities:
Encode data using xor

Disassembly:
test al, 0xf9
add dword gs:[ebx + 0x7819ef3b], edx
fdiv qword [esi - 0x4242e75c]
popal
out 0x2b, eax
mov ah, 0x6d
xor bl, cl
mov bp, 0x71eb
cwde
xor esi, dword [edi + ebp*2]
xchg edx, eax
cli
push edi
out 0x56, eax
push esi
aam 0x68
sub al, 0x6b
xchg ebx, eax
fnsave dword fs:[edx]
jno 0x4a503e
dec esi
push 0xd7a2e230
sahf
pop ss
daa
add al, 0x49
out dx, al
invalid
sub byte [edx - 0x10], bl
salc
stc
xchg esp, eax
sbb dword [eax], edi
cmp eax, dword [esi]
test eax, 0xd387d615
fdivr dword [edx]
push es
cmp eax, 0xc78a9bd7
pop ebx
ja 0x4a5060
adc ebp, dword [eax + 0x3998d89c]
aas
out 0xbe, al
clc
dec edx
add dword [edx - 0x1e], ecx
insd dword es:[edi], dx
cmp dword [edi + 0x1d7d38a], eax
wait
ja 0x4a5167
mov ah, 0xd6
dec edx
mov eax, dword [0xe729e759]
mov ecx, 0x12b7598d
invalid
fstp dword [eax + 0x74485bba]
movsd dword es:[edi], dword [esi]
bound edi, qword [eax - 0x3b]
push eax
invalid
Function at 0x4a5654
Capabilities:
Encode data using xor

Disassembly:
dec edx
fiadd word [esi]
nop
invalid
mov edi, 0x9792cf42
lds esp, [ecx + 0x2d]
cmp dword [ecx], eax
out dx, eax
mov ss, word [esi]
jge 0x4a56c2
les ecx, [esi + 0x9dceea3]
mov dword es:[ecx - 0x6ea59048], esi
push es
jl 0x4a56e9
add eax, 0xd01fbf0f
xchg byte [edi - 0x25], ah
push ecx
out 0x90, eax
cmpsd dword [esi], dword es:[edi]
jbe 0x4a569c
sti
inc ebx
test byte [edx + 0x50], 0xee
cld
xor ecx, edx
xchg edi, eax
jns 0x4a5688
loopne 0x4a5638
imul ecx, ebx, 0x32
jle 0x4a56ed
add edi, dword [esi - 9]
mov ch, 0x50
fcomp qword [ebx + 0x6ce5204c]
and ch, ah
insb byte es:[edi], dx
mov edi, 0xa0be38f7
ficom word [ebx - 0x5429c979]
out 0xc6, eax
mov bh, 0xe2
test eax, 0x3fa8597c
pop es
push cs
call 0x5863e3c0
out dx, al
push esi
mov esp, 0xd9e67e77
rol byte [edi], 0xda
mov esi, 0x18b687f2
pop es
fidivr dword [esi + 0x18b687f2]
or ah, dh
jnp 0x4a5702
outsb dx, byte [esi]
test eax, 0x7612a6a
cwde
cmovno ebx, dword [edi]
push eax
fistp dword [edi + 0x71385cf]
mov eax, ecx
add al, 0xd7
xchg dword [edi - 0x66f9a995], ecx
cmp cl, byte [ecx + 0x5d67d331]
pop ebp
and eax, 0x84d930a1
test byte [eax - 0x5a], 0xe8
inc esp
pop edx
push ecx
mov bl, 0xe8
les ebx, [bx + 0x4712]
inc edi
push cs
insb byte es:[edi], dx
mov dword [ebp + 0x2c], esi
add cl, byte [edi]
xchg byte [ebp + 0x41cf6552], cl
mov eax, dword [0xc002d11b]
pop ecx
int 0x8f
invalid
Function at 0x4dd924
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.004e6933
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4dd96a
xor eax, eax
jmp 0x4dd96d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.004e6f68
lea eax, [edi + 0x7c]
test eax, eax
je 0x4dd988
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.004e72cd
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x4dd9c6
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.004e72cd
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.004e664d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004e6fe9
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e8eea
Capabilities:
Encode data using xor

Disassembly:
xor ecx, dword [eax]
mov byte ds:[0x76fd07b8], al
ffree st(6)
and eax, ebp
xor eax, 0xb21425e6
mov eax, 0x3248d242
inc edx
ror byte [eax + 0x32], cl
in al, 0x4e
sahf
invalid
mov eax, 0x85f38c60
mov edi, 0x98577cb5
enter 0xfffffffffffffe67, 0x58
add edx, dword [ebx - 0x20]
salc
aaa
rcl byte [ebp - 0x77e9ec58], 0x31
push ss
mov byte [ecx], dh
or eax, 0xcb805808
invalid
jp 0x4e8e82
aas
xchg edx, esp
fcomp dword [edi + edi - 0x4b]
test dword [edx - 0x3cc00c30], eax
push eax
fisttp dword [ebx + 0x81b99cd]
daa
jns 0x4e8ec1
out dx, al
mov ebp, 0x33ef7bbc
fcomp dword [ebp + 0x1bf21772]
jns 0x4e8e94
int 0x44
sahf
xchg byte [ebp - 0x1238b583], al
jne 0x4e8ed8
invalid
Function at 0x4f8474
Capabilities:
Encode data using xor

Disassembly:
sub ebx, dword [edx + 0x6d]
sahf
xor dword [0x19a89f9], esp
mov dword [edx - 0x6259c4ff], ebx
xor eax, 0xd0b89848
dec ebx
rcr dword [ecx + 0x6c], cl
mov dword [edx - 0x6259c4ff], ebx
xor eax, 0xd0b89848
dec ebx
rcr dword [ecx + 0x6c], cl
lock add bh, byte [eax - 0x279c00e1]
add al, 0xcd
out 0xc, al
push ss
rcl byte [esp + eax*2 + 0x74e644d9], 0x54
test eax, 0x57c815e3
mov al, byte [0xf0ccf3c]
cld
jle 0x4f846d
xor dword [esi], 0xffffffcd
xchg ebp, eax
inc edx
inc ebp
imul ecx, dword [edx], 0x18
jns 0x4f84a4
cmp byte [edx], ch
sbb ebx, dword [edx - 0x72d68cd8]
iretd

Function at 0x504c1d
Capabilities:
Encode data using xor

Disassembly:
jl 0x504c38
jmp [esi]
sal byte fs:[ecx + 0x65], cl
fbstp tbyte [edi - 0xfdcbdfe]
out 0x92, eax
out 0x21, al
clc
mov ch, 0xb8
cmp ch, byte [0x5ba49bd4]
lock add dword [ebx], ebx
mov ecx, 0x9f9bc3f6
xchg dword [ebx], edx
clc
dec edx
mov eax, 0x62d6a9f8
mov bl, 0x91
cli
xchg edi, eax
test dword [eax - 0x2ab4ccae], edx
and al, 0xcd
xchg ecx, eax
dec ebx
aad 0x24
int 0x91
mov eax, dword [0x14a7ea43]
mov eax, 0xab38e95f
xor byte [eax - 0x208d0c26], ah
popal
bound esi, qword [eax + eax*2 - 0x77]
cld
lodsb al, byte [esi]
stosd dword es:[edi], eax
mov eax, 0xdb52f567
jp 0x504c68
and cl, byte [esi]
mov dword [0x3a93f1], eax
mov al, byte [0x4f16b3b6]
ja 0x504cc8
add esp, dword [eax - 0x5b]
ja 0x504c3c
call 0xc8c3e0d7
ret
ret 0x881c
fcomp qword [eax - 0x40]
push 0x9157034b
jge 0x504ccc
ret
adc ecx, dword [eax - 0x8ad92cd]
jecxz 0x504d23
push edx
mul ebx
push ebx
xor eax, 0x61377fd8
invalid
invalid
in eax, dx
imul byte [edi + 0x29]
xchg ebx, eax
adc al, 0xb1
xor word [edx + 0xe], bp
jae 0x504cb2
lodsb al, byte [esi]
imul byte [ebp + edx*8 - 0x38]
jle 0x504cba
jle 0x504d24
and edi, edi
sbb bh, byte [esp + esi*2 - 0x3d]
inc edx
pushal
jle 0x504d78
das
xor dword [ecx - 0x3f16c482], ecx
cld
stc
jo 0x504d3f
dec ebx
shr byte [bp + di + 0x713a], 0xd
or dword [ebx - 0x3d146c53], ecx
jnp 0x504d37
or eax, 0x93ad8b09
jmp 0x504d1d
int1
fisttp qword [edi + 0x23]
fbld tbyte [0x51426722]
mov eax, 0xcf1b2fbd
cmp dword [eax], 0x1d71fbf3
push 0xeb787393
enter 0xffffffffffffeebe, 0xffffffffffffffe9
adc eax, 0x68d5717a
or al, 0x59
mov bl, bl
mov esi, 0x7a15e9ee
jno 0x504d54
push 0xdb88590c
sbb eax, 0xb59ba00
inc esp
xchg ebx, eax
push ebp
cmc
jmp 0x1cf1eacf