joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4961c2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4961fa
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00494276
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049424e
jmp 0x496206
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4978b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4978f6
call fcn.0049d62a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4978f6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4978ed
xor eax, eax
jmp 0x4978fe
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00497904
pop edi
pop esi
pop ebx
ret 4

Function at 0x49db5a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49db88
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49dba6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049dac0
jmp 0x49dba6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49dba6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049dac0
test edi, edi
mov eax, edi
jne 0x49db90
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x439340
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
xor edx, edx
cmp edi, edx
je 0x4393c6
mov ecx, dword [edi]
push ebx
push ebp
mov byte [ecx + 0x16], dl
push esi
mov esi, dword [edi + 4]
mov byte [ecx + 0x17], dl
xor eax, eax
cmp esi, edx
mov byte [ecx + 0x18], dl
mov byte [ecx + 0x19], dl
jle 0x43937f
movzx ebx, byte [ecx + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x58f8f0]
inc edx
cmp edx, esi
jl 0x439363
xor edx, edx
mov esi, dword [edi + 0xc]
cmp esi, edx
jle 0x4393aa
mov edi, dword [edi + 8]
lea esp, [esp]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x58f8f0]
inc edx
cmp edx, esi
jl 0x439390
mov edx, eax
shr edx, 8
mov byte [ecx + 0x16], al
mov byte [ecx + 0x17], dl
mov edx, eax
pop esi
shr edx, 0x10
shr eax, 0x18
pop ebp
mov byte [ecx + 0x18], dl
mov byte [ecx + 0x19], al
pop ebx
pop edi
ret

Function at 0x43e6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
movd mm7, dword [ebp + 8]
punpcklwd mm7, mm7
punpckldq mm7, mm7
movq mm4, mm7
psrlw mm4, 7
paddw mm7, mm4
movd mm6, dword [ebp + 0x2c]
punpckldq mm6, mm6
pand mm6, qword [0x5696c8]
mov eax, dword [ebp + 0xc]
shl eax, 2
sub dword [ebp + 0x18], eax
sub dword [ebp + 0x20], eax
sub dword [ebp + 0x28], eax
mov esi, dword [ebp + 0x24]
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
shr ecx, 1
or ecx, ecx
je 0x43e778
movq mm5, qword [esi]
movq mm4, qword [edi]
movq mm3, mm5
movq mm2, mm4
movq mm1, mm3
movq mm0, mm2
psrlw mm1, 8
psrlw mm0, 8
psubw mm1, mm0
pmullw mm1, mm7
psllw mm0, 8
paddw mm1, mm0
pand mm1, qword [0x5696d8]
pand mm3, qword [0x5696e0]
pand mm2, qword [0x5696e0]
psubw mm3, mm2
pmullw mm3, mm7
psrlw mm3, 8
paddw mm3, mm2
pand mm3, qword [0x5696e0]
por mm3, mm1
pand mm5, qword [0x5696c8]
pcmpeqd mm5, mm6
pand mm4, mm5
pxor mm5, qword [0x569718]
pand mm3, mm5
por mm4, mm3
movq qword [ebx], mm4
add esi, 8
add edi, 8
add ebx, 8
dec ecx
jne 0x43e6fc
mov ecx, dword [ebp + 0xc]
test ecx, 1
je 0x43e7d7
movd mm5, dword [esi]
movd mm4, dword [edi]
movq mm3, mm5
movq mm2, mm4
punpcklbw mm3, dword [0x5696b8]
punpcklbw mm2, dword [0x5696b8]
psubw mm3, mm2
pmullw mm3, mm7
psrlw mm2, 8
paddw mm3, mm2
psrlw mm3, 8
packuswb mm3, mm3
pand mm5, qword [0x5696c8]
pcmpeqd mm5, mm6
pand mm4, mm5
pxor mm5, qword [0x569718]
pand mm3, mm5
por mm4, mm3
movd dword [ebx], mm4
add esi, 4
add edi, 4
add ebx, 4
add esi, dword [ebp + 0x28]
add edi, dword [ebp + 0x20]
add ebx, dword [ebp + 0x18]
dec edx
jne 0x43e6f3
emms
pop edi
pop esi
pop ebx
pop ebp
ret 0x28
Function at 0x43e7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
movd mm7, dword [ebp + 8]
punpcklwd mm7, mm7
punpckldq mm7, mm7
movq mm4, mm7
psrlw mm4, 7
paddw mm7, mm4
mov eax, dword [ebp + 0x2c]
and eax, 0xffffff
movd mm6, eax
punpckldq mm6, mm6
mov eax, dword [ebp + 0xc]
mov edx, eax
shl eax, 1
add eax, edx
sub dword [ebp + 0x18], eax
sub dword [ebp + 0x20], eax
sub dword [ebp + 0x28], eax
mov esi, dword [ebp + 0x24]
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
shr ecx, 1
or ecx, ecx
je 0x43e8fe
push ecx
movd mm5, dword [esi]
mov eax, dword [esi + 2]
shr eax, 8
movd mm3, eax
psllq mm3, 0x20
por mm5, mm3
movd mm4, dword [edi]
mov eax, dword [edi + 2]
shr eax, 8
movd mm3, eax
psllq mm3, 0x20
por mm4, mm3
movq mm3, mm5
movq mm2, mm4
psrlw mm3, 8
psrlw mm2, 8
psubw mm3, mm2
pmullw mm3, mm7
psllw mm2, 8
paddw mm3, mm2
pand mm3, qword [0x5696d8]
movq mm2, mm5
movq mm1, mm4
pand mm2, qword [0x5696e0]
pand mm1, qword [0x5696e0]
psubw mm2, mm1
pmullw mm2, mm7
psrlw mm2, 8
paddw mm2, mm1
pand mm2, qword [0x5696e0]
por mm3, mm2
pand mm5, qword [0x5696c8]
pand mm3, qword [0x5696c8]
pcmpeqd mm5, mm6
pand mm4, mm5
pxor mm5, qword [0x569718]
pand mm3, mm5
por mm4, mm3
movd eax, mm4
psrlq mm4, 0x18
mov word [ebx], ax
movd ecx, mm4
shr eax, 0x10
or eax, ecx
mov dword [ebx + 2], eax
pop ecx
add esi, 6
add edi, 6
add ebx, 6
dec ecx
jne 0x43e843
mov ecx, dword [ebp + 0xc]
test ecx, 1
je 0x43e9a6
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 2]
shl eax, 0x10
mov cx, word [esi]
or eax, ecx
movd mm5, eax
xor eax, eax
xor ecx, ecx
mov al, byte [edi + 2]
shl eax, 0x10
mov cx, word [edi]
or eax, ecx
movd mm4, eax
movq mm3, mm5
movq mm2, mm4
psrlw mm3, 8
psrlw mm2, 8
psubw mm3, mm2
pmullw mm3, mm7
psllw mm2, 8
paddw mm3, mm2
pand mm3, qword [0x5696d8]
movq mm2, mm5
movq mm1, mm4
pand mm2, qword [0x5696e0]
pand mm1, qword [0x5696e0]
psubw mm2, mm1
pmullw mm2, mm7
psrlw mm2, 8
paddw mm2, mm1
pand mm2, qword [0x5696e0]
por mm3, mm2
pcmpeqd mm5, mm6
pand mm4, mm5
pxor mm5, qword [0x569718]
pand mm3, mm5
por mm4, mm3
movd eax, mm4
mov word [ebx], ax
shr eax, 0x10
mov byte [ebx + 2], al
add esi, 3
add edi, 3
add ebx, 3
add esi, dword [ebp + 0x28]
add edi, dword [ebp + 0x20]
add ebx, dword [ebp + 0x18]
dec edx
jne 0x43e836
emms
pop edi
pop esi
pop ebx
pop ebp
ret 0x28
Function at 0x442680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
movd mm7, dword [ebp + 8]
punpckldq mm7, mm7
pand mm7, qword [0x5696c8]
mov eax, dword [ebp + 0xc]
shl eax, 2
sub dword [ebp + 0x18], eax
sub dword [ebp + 0x20], eax
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
shr ecx, 1
test ecx, ecx
je 0x4426e3
movq mm6, qword [esi]
movq mm5, qword [edi]
movq mm4, mm6
pand mm4, qword [0x5696c8]
movq mm3, mm7
pcmpeqd mm4, mm3
pand mm5, mm4
pxor mm4, qword [0x569718]
pand mm6, mm4
por mm6, mm5
movq qword [edi], mm6
add esi, 8
add edi, 8
dec ecx
jne 0x4426b1
mov ecx, dword [ebp + 0xc]
test ecx, 1
je 0x44271d
movd mm6, dword [esi]
movd mm5, dword [edi]
movq mm4, mm6
pand mm4, qword [0x5696c8]
movq mm3, mm7
pcmpeqd mm4, mm3
pand mm5, mm4
pxor mm4, qword [0x569718]
pand mm6, mm4
por mm6, mm5
movd dword [edi], mm6
add esi, 4
add edi, 4
add esi, dword [ebp + 0x20]
add edi, dword [ebp + 0x18]
dec edx
jne 0x4426a8
emms
pop edi
pop esi
pop ebp
ret 0x1c

Function at 0x442730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
movd mm7, dword [ebp + 8]
punpckldq mm7, mm7
pand mm7, qword [0x5696c8]
mov eax, dword [ebp + 0xc]
mov edx, eax
shl eax, 1
add eax, edx
sub dword [ebp + 0x18], eax
sub dword [ebp + 0x20], eax
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
shr ecx, 1
or ecx, ecx
je 0x4427e0
movd mm6, dword [esi]
xor eax, eax
xor ebx, ebx
mov al, byte [esi + 5]
shl eax, 0x10
mov bx, word [esi + 3]
or eax, ebx
movd mm4, eax
psllq mm4, 0x20
por mm6, mm4
pand mm6, qword [0x5696c8]
movd mm5, dword [edi]
xor eax, eax
xor ebx, ebx
mov al, byte [edi + 5]
shl eax, 0x10
mov bx, word [edi + 3]
or eax, ebx
movd mm4, eax
psllq mm4, 0x20
por mm5, mm4
pand mm5, qword [0x5696c8]
movq mm4, mm7
pcmpeqd mm4, mm6
pand mm5, mm4
pxor mm4, qword [0x569718]
pand mm6, mm4
por mm6, mm5
movd dword [edi], mm6
psrlq mm6, 0x20
movd eax, mm6
mov word [edi + 3], ax
shr eax, 0x10
mov byte [edi + 5], al
add esi, 6
add edi, 6
dec ecx
jne 0x442765
mov ecx, dword [ebp + 0xc]
test ecx, 1
je 0x442845
xor eax, eax
xor ebx, ebx
mov al, byte [esi + 2]
shl eax, 0x10
mov bx, word [esi]
or eax, ebx
movd mm6, eax
pand mm6, qword [0x5696c8]
xor eax, eax
xor ebx, ebx
mov al, byte [edi + 2]
shl eax, 0x10
mov bx, word [edi]
or eax, ebx
movd mm5, eax
pand mm5, qword [0x5696c8]
movq mm4, mm7
pcmpeqd mm4, mm6
pand mm5, mm4
pxor mm4, qword [0x569718]
pand mm6, mm4
por mm6, mm5
movd eax, mm6
mov word [edi], ax
shr eax, 0x10
mov byte [edi + 2], al
add esi, 3
add edi, 3
add esi, dword [ebp + 0x20]
add edi, dword [ebp + 0x18]
dec edx
jne 0x44275c
emms
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c

Function at 0x4497e0
Capabilities:
Write file on windows

Disassembly:
push 0x22
call fcn.00448930
mov eax, dword [0x5b84e0]
mov ecx, dword [0x5b84d8]
mov edx, dword [esp + 8]
add eax, ecx
push edx
mov dword [0x5b04c4], eax
call fcn.004489d0
add esp, 8
mov dword [esp + 4], str._tenter_n
jmp fcn.0044b7f0
Function at 0x449b40
Capabilities:
Write file on windows

Disassembly:
push esi
push 1
call fcn.00448930
movzx esi, word [esp + 0xc]
push esi
call fcn.00448980
push esi
push str._ttrap_t_d_n
call fcn.0044b7f0
push 1
xor esi, esi
call fcn.00448bc0
push 0x26
call fcn.00448930
add esp, 0x18
pop esi
mov dword [esp + 4], str._tret_n_n
jmp fcn.0044b7f0

Function at 0x44b7f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [0x597670]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [0x5b84e8], 0
je 0x44b857
cmp dword [0x5b84d4], 0
mov eax, dword [esp + 0x408]
jne 0x44b822
cmp byte [eax], 0x2a
je 0x44b857
lea ecx, [esp + 0x40c]
push ecx
push eax
lea edx, [esp + 8]
push edx
call dword [0x56930c]
mov eax, dword [0x5b84e8]
push eax
lea ecx, [esp + 4]
push ecx
call dword [0x5690f8]
push eax
lea edx, [esp + 8]
push 1
push edx
call fcn.0051057f
add esp, 0x10
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0050f0b5
add esp, 0x404
ret

Function at 0x44d370
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
mov dword [0x5c88e0], eax
test cl, cl
je 0x44d39e
push esi
mov edi, edi
lea esi, [eax*8]
sub esi, eax
movsx ecx, cl
mov eax, esi
xor eax, ecx
mov cl, byte [edx + 1]
inc edx
mov dword [0x5c88e0], eax
test cl, cl
jne 0x44d380
pop esi
ret

Function at 0x44da20
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [ecx]
xor eax, eax
push esi
mov esi, 0x5c88f0
mov dword [0x5c88e0], eax
mov byte [0x5c88f0], dl
test dl, dl
je 0x44da5f
lea esp, [esp]
lea edx, [eax*8]
sub edx, eax
mov eax, edx
movsx edx, byte [ecx]
inc ecx
xor eax, edx
mov dl, byte [ecx]
inc esi
mov byte [esi], dl
test dl, dl
jne 0x44da40
mov dword [0x5c88e0], eax
call fcn.0044d2a0
mov ecx, dword [esp + 8]
mov dword [eax + 4], 0xffffffe5
mov dword [eax + 0xc], ecx
pop esi
ret

Function at 0x457580
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
call fcn.005067d0
call fcn.00444af0
push 0xffffffffffffffff
call fcn.004487e0
call fcn.004451b0
push 0
call fcn.0050e460
add esp, 8
call fcn.0050c400
call fcn.0042d120
call fcn.005092c0
call fcn.00507bb0
call fcn.005064e0
call fcn.005092f0
call fcn.0049a750
mov esi, 0x5c98f8
lea esp, [esp]
mov eax, dword [esi]
test eax, eax
je 0x4575e5
push eax
call fcn.00492dc0
add esp, 4
mov dword [esi], 0
add esi, 4
cmp esi, 0x5c9918
jl 0x4575d0
mov eax, dword [0x5c9e74]
test eax, eax
je 0x457612
push eax
mov eax, dword [0x7696e8]
push 0xfffffffffffffffc
push eax
call dword [0x5692d8]
mov dword [0x5c9e74], 0
cmp dword [0x5c9e70], 0
je 0x457630
push 0x5c991c
call dword [0x5690c4]
mov dword [0x5c9e70], 0
cmp byte [0x5c9938], 0
je 0x457681
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x5c9938
mov dword [esp + 0xc], 0x56b64c
call fcn.00454740
mov esi, eax
add esp, 4
test esi, esi
je 0x45767a
mov edx, dword [0x5c9e64]
mov eax, dword [0x5c9a3c]
push esi
push 1
push edx
push eax
call fcn.0051057f
push esi
call fcn.0050f9ea
add esp, 0x14
mov byte [0x5c9938], 0
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x457920
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x5b84f4], 0
jne 0x457a0b
cmp dword [esp + 8], 0
je 0x457a0b
push ebx
mov ebx, dword [0x5690e8]
push esi
push edi
mov edi, dword [0x5690ec]
mov esi, 0x5ca1f8
lea ecx, [ecx]
mov eax, dword [esi]
test eax, eax
je 0x45796a
push 0
push eax
call edi
test eax, eax
jne 0x45796a
mov eax, dword [esi]
push eax
call ebx
mov dword [esi], 0
add esi, 0x94
cmp esi, 0x5cb478
jl 0x457950
xor esi, esi
mov eax, 0x5ca1f8
nop
cmp dword [eax], 0
je 0x45799a
add eax, 0x94
inc esi
cmp eax, 0x5cb478
jl 0x457980
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, esi
imul eax, eax, 0x94
mov dword [ecx], esi
neg edx
mov dword [eax + 0x5ca208], ecx
lea ecx, [esp + 0xc]
push ecx
sbb edx, edx
and edx, 4
push edx
lea edi, [eax + 0x5ca1f8]
push edi
push 0x4577d0
push 0
push 0
mov dword [eax + 0x5ca288], 0
mov dword [eax + 0x5ca1fc], 1
mov dword [eax + 0x5ca200], 0
call fcn.005132c4
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x457992
push 0xffffffffffffffff
push eax
call dword [0x569174]
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
or eax, 0xffffffff
pop ecx
ret
Function at 0x50cea5
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x76afc0], eax
push eax
mov dword [0x5975a4], 1
call fcn.0050c980
add esp, 4
test eax, eax
je 0x50cec8
push 0x76afc0
push 0
push 0x50cd60
call fcn.00514729
xor ecx, ecx
add esp, 0xc
cmp eax, 0xffffffff
setne cl
mov dword [0x76aee0], ecx
mov eax, dword [0x76aee0]
ret
xor eax, eax
ret
Function at 0x418ac2
Capabilities:
Encode data using xor

Disassembly:
or al, byte [edi - 0xb]
insd dword es:[edi], dx
fild qword [esi + 0x16]
aaa
fst dword [edi - 0x453c3dec]
xchg esp, eax
add eax, esi
ficomp dword [ebx - 0x273a89bd]
fild dword [ebx + 0x31]
retf
pop ebx
stc
imul ebp, dword [eax + 0x6c], 0x200b0764
popal
jnp 0x418a47
lds ebx, [ebx - 0x3e33b00c]
les edx, [esi - 0x72993f93]
mov dword [ecx], ebp
sub eax, 0x44e04eeb
xchg byte [eax - 0x7d], al
arpl word [ebx + 0x6f], cx
pop esp
xchg esp, eax
push esp
invalid
xor eax, 0x1fe2f4c2
out dx, al
push 0xe
cmp ecx, dword [edi]
in eax, dx
scasb al, byte es:[edi]
mov ecx, eax
inc esi
outsb dx, byte [esi]
pop ebx
int1
sbb byte [ebp - 0x25], dh
das
jne 0x418abf
xor ecx, edx
jmp 0x69c3d66b
retf
add al, 0x83
mov dword [0x5418f1a7], eax
outsd dx, dword [esi]
cmp dword [ecx - 0x1f], edi
add edi, edi
test al, 0x81
and bh, byte [eax - 0x5e]
test dword [ebx], eax
loop 0x418a99
cmp al, 0xea
out 0xfb, al
and ah, byte [edx - 0x6c]
pop ds
mov byte [eax], dl
adc byte [ecx], bh
jb 0x418a69
sbb dh, bl
add esp, dword [ebx + 0x2d]
mov bh, 0x73
insb byte es:[edi], dx
adc bl, byte [eax - 0x42456e10]
cdq
pop edi
lcall 0xc7a5, 0x5c3be6ec
push ebp
xor dword [esi + 0x5a], 0xffffff91
in eax, dx
dec ecx
xor dl, dh
dec esi
inc byte [ebp + 0x626f644e]
jecxz 0x418ae9
stosd dword es:[edi], eax
mov dword [esi - 0x5c], edi
push 0x69
dec esp
jge 0x418adb
push edi
fild qword [esi - 0x7c440204]
and byte [eax + 0x5f9e2acc], ch
mov dl, 0x33
clc
sbb ebx, dword [edi]
pop ebx
mov ah, 0x84
push esi
invalid

Function at 0x45f3d1
Capabilities:
Encode data using xor

Disassembly:
or dword [eax], esp
push esp
and al, 0x9a
lea ecx, [eax]
popfd
ret
jle 0x45f3c2
or dword [ebx - 0x5ad3af93], 0x1ad2f678
push eax
sub al, 0xa5
js 0x45f3cc
rcr byte [edx], cl
push esi
cmpsd dword [esi], dword es:[edi]
outsb dx, byte [esi]
lcall 0xd035, 0xfe95db99
mov esp, 0xcc8b9c18
xchg ebp, edi
push ds
mov al, 0x4b
fisubr word [ebp - 0xa]
invalid
Function at 0x4ab442
Capabilities:
Encode data using xor

Disassembly:
xchg dword [0x3c326489], eax
jle 0x4ab3ef
sub ebx, dword [edi + ebp*4 - 0x6d]
xchg ebx, eax
and al, 0x32
inc esp
xchg ecx, eax
fstp xword [ebp - 0x3d73070]
mov eax, 0x855329e8
out 0xc1, al
mov ah, 0xfd
adc dl, ah
adc dword [ecx], esi
inc esp
adc dword [eax + ebp + 0x24], esp
adc byte [ecx - 0x2c], bh
adc al, 0x48
aam 0x14
dec eax
sub edx, dword [eax + 0x23]
pop eax
inc eax
mov al, 0x4f
mov ecx, 0x2d9513e0
mov edi, 0xf55e1653
rcl eax, 4
dec esp
loope 0x4ab37e
sbb ah, byte [edx + 0x736e2461]
pop edi
and dword [ebp + esi*2 - 0x125eac6a], eax
sal byte [ecx], 0xb1
out 0x70, eax
out dx, eax
stosb byte es:[edi], al
cmp eax, dword [ecx - 0x64]
jbe 0x4ab3b8
jge 0x4ab3a9
sbb eax, 0x73dbc838
je 0x4ab420
pushal
push ds
cdq
xor eax, 0x54df5514
add al, 0xf1
fist word [esp + eax - 0xf]
int1
jnp 0x4ab419
in al, dx
popfd
sti
pop edi
invalid
or esp, dword [ebp + 0x14476c21]
movsb byte es:[edi], byte [esi]
and dword gs:[edi + eax*2 + 0x14], ebp
jne 0x4ab3db
jg 0x4ab405
nop
add bh, byte [eax - 0x6f828584]
sub byte [edx - 0x2f646e14], dh
aam 0x37
xchg ecx, eax
wait
rcl ah, 1
aaa
jbe 0x4ab404
push ecx
int3
sub byte [esi + 0x58698180], ch
in eax, 0x3c
xor al, 0xd9
xor bh, byte [ebp + ebx*4 - 0x5a]
scasb al, byte es:[edi]
add byte [ecx + 0x3ce55869], 0x34
fnstenv [edx]
jl 0x4ab3ec
popfd
cmpsb byte [esi], byte es:[edi]
lds ebx, [eax]
add eax, 0x2893bfd0
sbb byte [0x2893bfd0], al
mov esi, 0x80c42840
mov eax, 0x5da90258
mov esp, 0xdffd0138
xor edx, dword [esi - 0x337a2d7a]
aaa
jno 0x4ab443
xor dword [ebp - 0x6b3f9bd7], ebx
or ax, sp
pushal
aad 0xa4
jno 0x4ab44e
out 0, al
aam 0x14
pop esp
xchg dl, bh
into
xor eax, 0x92e44419
push esi
xor esp, ebp
or byte [eax - 0x94645a0], dh
loope 0x4ab41a
adc eax, 0x9443b231
dec ecx
push esi
mov bh, byte [ecx + 1]
dec edi
add byte [ebx - 0x3e], ch
cmp dl, byte [esi + 0x4fbcc516]
jnp 0x4ab451
pop esp
xchg esp, eax
add cl, 0x36
add byte [ebp - 0x6f77f886], dh
out 0xf1, al
in eax, 0xa1
cmpsb byte [esi], byte es:[edi]
clc
sbb al, 0xb1
and eax, 0x2126641a
mov al, 0x9a
nop
ret
Function at 0x4b3fe1
Capabilities:
Encode data using xor

Disassembly:
popal
ret
mov bl, 0x6a
pop es
in al, 0xb3
sub ch, byte [edi]
fadd qword [eax]
pop esp
pop edi
mov edi, 0x1b595471
adc dl, byte [eax + ebp*8 - 0x70]
sti
out 0x10, al
cmp eax, 0x9479af54
test al, 0xe6
jo 0x4b4043
mov ebp, 0x28226f75
push esi
xchg byte [eax - 0x57], dh
pop ss
mov cl, 0x6d
je 0x4b405c
je 0x4b3fdd
bound esp, qword [edx + 0x102ab39a]
cmp al, 0x55
sbb al, 0x16
lcall 0x1c55, 0x3c102ab3
push ss
aas
inc eax
xchg edi, eax
xor esi, dword [ebx + 0x11]
inc esp
pop es
jb 0x4b4014
mov eax, 0x151e54c5
fimul word [edx + 0x11]
push eax
pop ds
fidiv dword [ebx - 0x49]
push eax
cmc
loope 0x4b402b
push ebp
in eax, 0xc3
sbb byte [ecx - 0x53b51f48], dl
push ecx
sbb eax, 0xf29736c4
bound edx, qword [ecx + 0x68500e59]
xchg edi, eax
bound edx, qword [ecx + 0x68500e59]
cdq
popfd
mov ebx, ebp
rcr dword [eax], cl
in eax, dx
call 0x754f9b8b
stosd dword es:[edi], eax
dec dword [edi]
into
lea esi, [ecx + 0xe0119ac]
insd dword es:[edi], dx
shl dword [edi + 0x1b7176df], cl
nop
mov edi, 0x70a43ec0
test byte [eax], ch
loopne 0x4b4068
sbb edx, dword [eax + 0x3ec0bff3]
movsb byte es:[edi], byte [esi]
jo 0x4b3ff5
sub al, ah
hlt
fbstp tbyte [esi + ecx]
inc ecx
xchg ecx, eax
or esi, esi
stc
push es
test al, 0x4c
std
out 0xf, al
mov edx, 0x68d87429
test al, 0x72
ret 0x701e

Function at 0x4b489e
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x1a9ac131]
or dh, dl
mov esi, 0x7f67d5cb
sar dword [edx + 0x11], 0x6a
int3
mov bl, 0x4c
inc edx
inc eax
adc dword [eax], ebx
add dword [eax], ebp
mov ch, 0x8e
movsd dword es:[edi], dword [esi]
mov byte [esi + eax*4 - 0x2c], ah
sbb byte [ecx], al
sub byte [ebp + 0x6488a58e], dh
xchg ah, dl
mov ch, 0xac
movsd dword es:[edi], dword [esi]
mov esp, 0xfc477a57
xor esp, edi
xor esp, dword [edi]
push ss
jne 0x4b484a
outsb dx, byte [esi]
in eax, dx
cmp eax, 0x77828b30
push esi
push ecx
ja 0x4b489c
or dh, dh
jge 0x4b4814
cmc
jne 0x4b480d
xor bl, ch
invalid
dec edx
aad 0x83
cmp dword [ebx + 0x67046e27], 0x58
xchg edi, eax
xchg ecx, eax
sub eax, 0x6ea6333e
call 0x35abdd10
mov al, 0x83
add ch, byte [ecx - 0x535c440b]
cmp al, 0x84
adc dword [ebp + 0x6b], edx
pop ebx
xor byte [ebp + 0x1a], al
jmp 0x4b4844
Function at 0x577c95
Capabilities:
Check for software breakpoints

Disassembly:
sar dword [ebp + 0x3d], 0x3c
lodsb al, byte [esi]
mov al, byte [0xce6ecf58]
mov cl, 0xd8
cmp al, 0xcc
inc ecx
pop ss
stosb byte es:[edi], al
stosb byte es:[edi], al
nop
jae 0x577bbc
mov ecx, 0x5f84a3d5
push eax
sub byte [eax], ch
add dword [esp + ecx*8 + 0x2968dc0], ecx
sbb al, 0xc0
pop esi
pop edi
inc esp
dec edx
movsb byte es:[edi], byte [esi]
adc byte [edx - 0x39], ch
call 0x6c81a022
push ebx
xchg esp, eax
in al, dx
adc byte [eax - 0x39], dl
adc byte [edi - 0x7dd6326], bh
push esi
loopne 0x577c55
in eax, dx
mov ch, 2
enter 0x2e1c, 0x32
add dh, 0xda
pop esp
out 0x61, al
mov ecx, 0x718aae0f
mov bh, bl
jp 0x577c42
dec esp
mov ah, 0xdc
pushal
inc eax
and eax, 0xd14f6837
adc al, 0xc2
mov dh, 0x4f
dec edx
mov bl, byte [ebx + edi*8 + 0x51]
pop edx
out 0x74, al
call ecx
ja 0x577bef
xchg esp, eax
cmp dword [ebx], ecx
jg 0x577c65
sbb dword [ecx - 0x5be36a55], ebx
sbb dword [edx + 0x55], edx
dec ebx
push esi
pop ecx
je 0x577bcb
mov ah, bl
and al, 0x23
fsub qword [ebx]
pop edx
enter 0xffffffffffffac6f, 0xffffffffffffffd6
insd dword es:[edi], dx
pop ds
inc cl
mov ah, 0x90
push edx
shl byte [edi + 0x314fc993], 0xf6
xchg ebx, eax
leave
dec edi
xor esi, esi
xchg edi, eax
adc eax, 0x2e39ffae
invalid
scasd eax, dword es:[edi]
mov eax, dword [0xc9209694]
int 0xb9
outsd dx, dword [esi]
invalid
sbb dword [edx + 0x2f], esi
mov cs, word [edi]
invalid

Function at 0x577d5d
Capabilities:
Encode data using xor

Disassembly:
dec edi
add al, byte es:[ecx + 0x4c5bf072]
inc eax
sub edi, edx
dec ecx
insb byte es:[edi], dx
add al, 0x13
outsd dx, dword [esi]
xchg ebx, eax
test byte [esi + 0x5d132408], bl
mov al, 0x66
and dword [0x89653544], ebx
pushal
in eax, dx
xor eax, 0xed608965
xor al, 0x93
mov dl, 0xda
mov esi, 0xefe7cae1
adc byte [ebp + 0x1ed985a8], cl
xchg edi, eax
pop ebp
adc al, 0xe2
adc esi, dword cs:[si + 0x74]
push edi
in al, dx
or eax, 0x5534aeab
xchg byte [edx + 0x6db7e67b], dh
jne 0x577d79
clc
jae 0x577dc2
cmpsb byte [esi], byte es:[edi]
mov cl, 0xf3
fiadd dword gs:[edi - 0xf3eebc3]
retf 0xe711
aad 0xed
scasb al, byte es:[edi]
pushfd
mov ecx, 0xd4ee24f0
out 0xc0, eax
jns 0x577dcc
sar byte [ecx - 3], 0xe9
mov byte [0xc25f474c], al
call 0xd7a1987a
sbb eax, 0x20e0a3d8
sbb dl, byte [esi + ebp*4 - 0x7df30570]
jmp 0x6a13637d
jmp 0x5f9eca76