joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d627
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10028c40]
jne 0x1000d631
repz ret
jmp fcn.10012c8c

Function at 0x10012e83
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10028e28]
je 0x10012e9e
inc edi
cmp edi, 0x17
jb 0x10012e8f
cmp edi, 0x17
jae 0x1001301e
push ebp
push 3
call fcn.10019eb8
cmp eax, 1
pop ecx
je 0x10012fea
push 3
call fcn.10019eb8
test eax, eax
pop ecx
jne 0x10012ed2
cmp dword [0x1002bfc4], 1
je 0x10012fea
cmp ebx, 0xfc
je 0x1001301d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1002c360
push ebp
call fcn.10011740
add esp, 0xc
test eax, eax
je 0x10012f08
push esi
push esi
push esi
push esi
push esi
call fcn.1000da09
add esp, 0x14
push 0x104
mov esi, 0x1002c379
push esi
push 0
mov byte [0x1002c47d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10012f4c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.10011740
add esp, 0xc
test eax, eax
je 0x10012f4c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1000da09
add esp, 0x14
push esi
call fcn.100117b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10012f91
push esi
call fcn.100117b0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1002c674
push 0x100224bc
sub ecx, eax
push ecx
push eax
call fcn.100166d6
add esp, 0x14
test eax, eax
je 0x10012f91
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1000da09
add esp, 0x14
jmp 0x10012f93
xor esi, esi
push 0x100224b8
push ebx
push ebp
call fcn.1001661b
add esp, 0xc
test eax, eax
je 0x10012fb3
push esi
push esi
push esi
push esi
push esi
call fcn.1000da09
add esp, 0x14
push dword [edi*8 + 0x10028e2c]
push ebx
push ebp
call fcn.1001661b
add esp, 0xc
test eax, eax
je 0x10012fd5
push esi
push esi
push esi
push esi
push esi
call fcn.1000da09
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10019cfb
add esp, 0xc
jmp 0x1001301d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1001301d
cmp ebp, 0xffffffff
je 0x1001301d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10028e2c]
push dword [esi]
call fcn.100117b0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10019cfb
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.100110d2
xor ebx, ebx
cmp dword [0x1002ca4c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10019dd1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10019eb1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x10019eb1
push eax
call fcn.10011064
mov dword [esp], 0x10023700
push edi
mov dword [0x1002ca4c], eax
call esi
push eax
call fcn.10011064
mov dword [esp], 0x100236ec
push edi
mov dword [0x1002ca50], eax
call esi
push eax
call fcn.10011064
mov dword [0x1002ca54], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000e7f1
test eax, eax
pop ecx
pop ecx
je 0x10019d9f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000da09
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10019dd1
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10011064
cmp eax, ebx
pop ecx
mov dword [0x1002ca5c], eax
je 0x10019dd1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10011064
pop ecx
mov dword [0x1002ca58], eax
mov eax, dword [0x1002ca58]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x10019e56
cmp dword [0x1002ca5c], ecx
je 0x10019e56
push eax
call fcn.100110db
push dword [0x1002ca5c]
mov esi, eax
call fcn.100110db
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x10019e56
cmp edi, ebx
je 0x10019e56
call esi
cmp eax, ebx
je 0x10019e23
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10019e23
test byte [ebp - 0x18], 1
jne 0x10019e56
lea eax, [ebp - 0x10]
push eax
call fcn.1000e828
test eax, eax
pop ecx
je 0x10019e3e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000da09
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10019e4d
or dword [ebp + 0x10], 0x200000
jmp 0x10019e91
or dword [ebp + 0x10], 0x40000
jmp 0x10019e91
mov eax, dword [0x1002ca50]
cmp eax, dword [ebp - 8]
je 0x10019e91
push eax
call fcn.100110db
cmp eax, ebx
pop ecx
je 0x10019e91
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10019e91
mov eax, dword [0x1002ca54]
cmp eax, dword [ebp - 8]
je 0x10019e91
push eax
call fcn.100110db
cmp eax, ebx
pop ecx
je 0x10019e91
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002ca4c]
call fcn.100110db
cmp eax, ebx
pop ecx
je 0x10019eb1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10019eb3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7ea40f20
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x269c2c01
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7266384e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4826732
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3c363b11
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x45a250f
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x416900
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0041698f
jae 0x41690e
xor ecx, ecx
call fcn.0041698f
jae 0x41693d
xor eax, eax
call fcn.0041698f
jae 0x41694d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0041698f
adc al, al
jae 0x41692f
jne 0x416979
stosb byte es:[edi], al
jmp 0x416911
call fcn.0041699b
sub ecx, ebx
jne 0x416956
call fcn.00416999
jmp 0x416975
lodsb al, byte [esi]
shr eax, 1
je 0x416983
adc ecx, ecx
jmp 0x416972
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00416999
cmp eax, 0x7d00
jae 0x416972
cmp ah, 5
jae 0x416973
cmp eax, 0x7f
ja 0x416974
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416911
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x401154
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x465008]
jne 0x40115e
repz ret
jmp fcn.00401f74

Function at 0x413649
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409429
and dword [ebp - 4], 0
cmp dword [0x467d7c], 0
mov ebx, eax
jne 0x4136fa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4137ab
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4137ab
push eax
call fcn.004093b7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x467d7c], eax
call esi
push eax
call fcn.004093b7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x467d80], eax
call esi
push eax
call fcn.004093b7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x467d84], eax
call esi
push eax
call fcn.004093b7
pop ecx
mov dword [0x467d8c], eax
test eax, eax
je 0x4136fa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004093b7
pop ecx
mov dword [0x467d88], eax
mov eax, dword [0x467d88]
cmp eax, ebx
je 0x413752
cmp dword [0x467d8c], ebx
je 0x413752
push eax
call fcn.00409432
push dword [0x467d8c]
mov esi, eax
call fcn.00409432
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413752
test edi, edi
je 0x413752
call esi
test eax, eax
je 0x413749
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413749
test byte [ebp - 0xc], 1
jne 0x413752
or dword [ebp + 0x10], 0x200000
jmp 0x41378b
mov eax, dword [0x467d80]
cmp eax, ebx
je 0x41378b
push eax
call fcn.00409432
pop ecx
test eax, eax
je 0x41378b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41378b
mov eax, dword [0x467d84]
cmp eax, ebx
je 0x41378b
push eax
call fcn.00409432
pop ecx
test eax, eax
je 0x41378b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x467d7c]
call fcn.00409432
pop ecx
test eax, eax
je 0x4137ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4137ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4582c0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov dword [esp], 0x20
add dword [esp], 0x20
mov al, 0x65
mov byte [0x467e69], al
mov byte [0x467e6c], al
mov al, 0x6c
push 0x467e68
mov byte [0x467e68], 0x6b
mov byte [0x467e6a], 0x72
mov byte [0x467e6b], 0x6e
mov byte [0x467e6d], al
mov byte [0x467e6e], 0x33
mov byte [0x467e6f], 0x32
mov byte [0x467e70], 0x2e
mov byte [0x467e71], 0x64
mov byte [0x467e72], al
mov byte [0x467e73], al
mov byte [0x467e74], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x469650]
mov edx, dword [0x468368]
lea eax, [esp + 4]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
ret
Function at 0x458590
Capabilities:
Clear file content
Compare security identifiers

Disassembly:
sub esp, 0x424
mov eax, dword [0x465008]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [0x469650]
push esi
mov esi, dword [0x468368]
push edi
mov edi, eax
cmp eax, 0x5dd
jne 0x4585c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov eax, dword [0x465ff0]
push eax
call fcn.00458450
add esp, 4
cmp dword [0x469650], 0x2f
jne 0x458650
xor edx, edx
xor ecx, ecx
mov word [esp + 0x12], dx
xor eax, eax
mov word [esp + 0xe], cx
lea edx, [esp + 0x18]
push edx
mov word [esp + 0x10], ax
mov eax, dword [esp + 0x10]
push eax
mov word [esp + 0x18], cx
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
push 0
call dword [sym.imp.KERNEL32.dll_CancelDeviceWakeupRequest]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call fcn.004584c0
add esp, 4
cmp dword [0x469650], 0x568
jne 0x458672
push str.ximawazudikahefafopoporifozib_kadamuzayecep_hizujajugejusawaharidam_wunoguzazapeguvecazageganuzi
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
call fcn.00401154
add esp, 0x424
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x29f459f4
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x33ac72cb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40378b
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
in al, dx
sub esp, 0x10
push ebx
xor dword [eax], eax
push esi
push edi
xor esi, esi
mov dword [ebp - 8], eax
add byte [eax], al
add al, 0x89
jge 0x403791
lea ecx, [eax + eax + 0x4b74ff85]
mov eax, dword [ebp + 8]
add byte [eax], al
add byte [ecx + 0x4b33fc45], cl
add cl, cl
test ax, ax
je 0x4037ea
mov eax, dword [eax]
add byte [ebx + 0x8b087d], cl
dec eax
add byte [eax + edx*2], al
mov dword [ebp - 0xc], eax
mov eax, dword [ebp]
add byte [edi + 0x453966c0], dh
add al, 0
and eax, dword [ebx + 0xf]
mov bh, 4
pop edi
cmp word [ebp + 4], ax
add byte [ebx], ah
inc ebx
movzx eax, word [edi + ebx*2]
add byte [eax], al
jne 0x4037cf
mov edi, dword [ebp - 0x10]
nop
add byte [edi], cl
test dword [ecx], esp
sti
add eax, dword [eax]
mov eax, dword [eax]
add byte [esi + 0x5b], bl
leave
ret 0x5e04
Function at 0x4092ce
Capabilities:
Authenticate hmac

Disassembly:
xor eax, 0x7c7eb3d9
sub al, 0x8f
mov eax, 0x3ad947e3
movsb byte es:[edi], byte [esi]
fmul dword [edx + 0x792947e8]
mov dword [0x95cd1cda], eax
sbb al, 0xcd
xchg ebp, eax
sbb al, 0xcd
xchg ebp, eax
dec ebp
enter 0xffffffffffffe97c, 0x5c
aaa
add bl, byte [ecx]
cdq
and byte [esi - 0x35], ch
jo 0x40930a
push es
stosb byte es:[edi], al
or eax, 0x4ffde840
out 0xe2, al
push esp
aaa
and al, 0x21
cmp al, 0x66
push ss
jl 0x4092b9
invalid
out dx, eax
mov byte [0xf6ab25a3], al
sub dword gs:[esi - 0x16], 0x4c
ljmp 0x3b96:0xd364804c
dec esp
and byte [ebx + edx*8 - 0x6a], 0x3b
das
jo 0x40936d
mulps xmm5, xmm2
insb byte es:[edi], dx
mov word [esi + 0x31], es
push cs
add eax, 0x7c61d958
sal byte [esi - 0x152c4e16], cl
jp 0x409300
leave
aam 0xa0
sahf
test al, 0xce
cld
dec ebx
aam 0xf5
dec ecx
xor byte [ecx + 0x61], bl
or al, 0x34
inc esp
inc edx
jp 0x409309
stosb byte es:[edi], al
jno 0x4093bd
pop ss
jne 0x409396
nop
xor esp, dword [ebx]
and byte [ebx], ah
loop 0x409390
and edi, dword [ebp + 0x5adc28dc]
daa
cld
add eax, 0x2341a694
mov ebp, 0xc7b65efc
pop esp
lcall 0x9926, 0x8665e39e
test al, 0x4b
imul esp, dword [edx - 0x369507d4], 0x79
adc byte [edi + 0x4c4a7335], al
sub eax, 0x20752fbe
mov esi, 0xb820752f
xor ah, byte [edx]
mov word [edi + 0x7d], gs
invalid
leave
jns 0x409380
xchg dword [0x2d4c4a73], esi
inc edi
lahf
pop esi
retf
inc ecx
ret
sub eax, 0x8cf10233
push 0xffffffffffffffe4
pushal
or bh, byte [eax]
aad 0xa8
stosd dword es:[edi], eax
adc byte [edx - 0x6a], bh
or al, 0xd8
mov edi, 0x1fe22ed3
lea ebp, [esp + eax*8 - 0x338215aa]
mov edx, dword [edi]
pop edi
sbb eax, 0x819a99eb
cld
or bh, bl
add al, 0x5a
std
shl dword [eax], cl
or al, 0x8b
mov ebx, 0xafd1bedd
xlatb
aas
lodsd eax, dword [esi]
mov cl, 0x98
outsb dx, byte [esi]
inc ebp
movsd dword es:[edi], dword [esi]
sub byte [eax + ebp + 0x68], al
or edx, 0xffffffb9
in al, 0x8d
cmp byte [esi + 0x76], al
lea ebx, [edx - 0x20]
test al, 0xda
or ebp, 0xffffffcd
mov word [edx + 0xe9fff39], cs
mov ecx, 0x6e05930f
fnsave dword [edi - 0x642ecb10]
ud1
mov ch, 0xf5
pop ebx
or byte [edi], dh
rcr byte [eax - 0x78], 0x78
shl byte [esi + 0x3cf59e11], 1
pushfd
dec ebx
int 0x3f
invalid
Function at 0x41a2df
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov dword [0x6f80], 0x64
xor ecx, ecx
add byte [eax], al
xor dl, byte [0x9441004d]
add byte [0xa6a004d], dl
mov dword [0x4d0000], ecx
mov dword [0x673c], ecx
mov dword [0x4d1540], ecx
add byte [eax], al
adc eax, 0xa366004d
cmpsb byte [esi], byte es:[edi]
add byte [ebp], cl
mov dword [0x4d16f4], ecx
add byte [0x4d16f8], cl
jp 0x41a2c4
add byte [eax], al
add byte [eax - 0x77], bl
or eax, 0x14
mov dword [0x894d1544], eax
add byte [eax + 0x15], cl
dec ebp
add byte [ecx + 0x4c0d], cl
add bl, al
push ebp
mov ebp, esp
cmc
add cl, bh
cmp byte [edi + 9], 0
jne 0x45a2ef
push esi
push 0x40
rol dword [eax], 0xe3
add dword [eax], eax
pop ecx
push dword [ebp + 8]
add byte [eax], al
mov ecx, esi
call 0xfba315
mov ecx, dword [edi + 4]
mov dword [esi + 0x38], ecx
mov dword [eax], eax
add byte [esi - 1], bl
pop es
pop edi
pop ebp
sbb dword [eax], eax
add byte [ebp - 0x75], dl
in al, dx
push esi
mov esi, dword [ebp]
add byte [ebx + 0x678356f9], cl
cwde
add al, ch
jmp 0x41a30c
shl dword [eax + 0x63], cl
push ebx
adc byte [eax + 0x18], al
stc
push cs
mov bh, 0xe1
in eax, dx
aam 0x92
pop ebp
adc byte [ebx], cl
pushal
lodsd eax, dword [esi]
mov ah, 0x4c
scasb al, byte es:[edi]
int3
jl 0x45a369
push edi
pop esi
push 0x6b
scasd eax, dword es:[edi]
mov esp, 0xb3d3fd2e
lahf
push ecx
sub byte [ecx - 0x73], 0x5d
xor ah, byte [eax - 0x54]
imul dword [ebp + 0x7bfdb02]
add dword [edi + 0x4186bc51], 0xe6a717e3
mov dh, byte [eax + 0xf]
mov ecx, 0xa8f043ff
sbb al, 0x6f
jge 0x45a377
mov ebx, 0x92e35c52
xchg edx, eax
das
jl 0x45a330
pop ss
xchg edx, eax
aad 0xad
sub eax, 0x32b012c7
loopne 0x45a2c8
xor ah, al
xchg ebp, eax
retf
push cs
xchg ebx, eax
aam 0xf1
cld
retf
sbb byte [eax + 0x4bacc6d0], dl
aas
jns 0x45a3b3
pop edi
cmp eax, 0x4b4a4227
or esi, ebp
mov byte [edx], ch
lodsb al, byte [esi]
push ss
mov al, byte [0xf93b8490]
test byte [ebx], bh
stc
jae 0x45a3d3
in al, 0x6c
jecxz 0x45a3c1
push ss
pop ds
jno 0x45a324
push eax
mov al, byte [0xfde50dc7]
pop eax
pop esp
pop eax
jns 0x45a38f
outsd dx, dword [esi]
pop es
adc edi, dword [esi + 0x5f]
pop esi
cmpsd dword [esi], dword es:[edi]
push esi
jecxz 0x45a3c5
or cl, cl
xchg ecx, eax
mov cl, 0xf
out 0x83, al
adc ebp, dword [esp + esi*2]
push ebp
invalid
outsd dx, dword [esi]
into
stosd dword es:[edi], eax
pop eax
sub dl, cl
mov ah, 0xc8
retf 0x94d5
lodsb al, byte [esi]
inc eax
mov bh, 0x1f
fild word [ecx]
mov dl, 0x80
invalid
Function at 0x41bffb
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
in al, dx
sub esp, 0x10
push ebx
xor dword [eax], eax
push esi
push edi
xor esi, esi
mov dword [ebp - 8], eax
add byte [eax], al
add al, 0x89
jge 0x41c001
lea ecx, [eax + eax + 0x4b74ff85]
mov eax, dword [ebp + 8]
add byte [eax], al
add byte [ecx + 0x4b33fc45], cl
add cl, cl
test ax, ax
je 0x41c05a
mov eax, dword [eax]
add byte [ebx + 0x8b087d], cl
dec eax
add byte [eax + edx*2], al
mov dword [ebp - 0xc], eax
mov eax, dword [ebp]
add byte [edi + 0x453966c0], dh
add al, 0
and eax, dword [ebx + 0xf]
mov bh, 4
pop edi
cmp word [ebp + 4], ax
add byte [ebx], ah
inc ebx
movzx eax, word [edi + ebx*2]
add byte [eax], al
jne 0x41c03f
mov edi, dword [ebp - 0x10]
nop
add byte [edi], cl
test dword [ecx], esp
sti
add eax, dword [eax]
mov eax, dword [eax]
add byte [esi + 0x5b], bl
leave
ret 0x5e04
Function at 0x43449b
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
in al, dx
sub esp, 0x10
push ebx
xor dword [eax], eax
push esi
push edi
xor esi, esi
mov dword [ebp - 8], eax
add byte [eax], al
add al, 0x89
jge 0x4344a1
lea ecx, [eax + eax + 0x4b74ff85]
mov eax, dword [ebp + 8]
add byte [eax], al
add byte [ecx + 0x4b33fc45], cl
add cl, cl
test ax, ax
je 0x4344fa
mov eax, dword [eax]
add byte [ebx + 0x8b087d], cl
dec eax
add byte [eax + edx*2], al
mov dword [ebp - 0xc], eax
mov eax, dword [ebp]
add byte [edi + 0x453966c0], dh
add al, 0
and eax, dword [ebx + 0xf]
mov bh, 4
pop edi
cmp word [ebp + 4], ax
add byte [ebx], ah
inc ebx
movzx eax, word [edi + ebx*2]
add byte [eax], al
jne 0x4344df
mov edi, dword [ebp - 0x10]
nop
add byte [edi], cl
test dword [ecx], esp
sti
add eax, dword [eax]
mov eax, dword [eax]
add byte [esi + 0x5b], bl
leave
ret 0x5e04
Function at 0x44c6eb
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
in al, dx
sub esp, 0x10
push ebx
xor dword [eax], eax
push esi
push edi
xor esi, esi
mov dword [ebp - 8], eax
add byte [eax], al
add al, 0x89
jge 0x44c6f1
lea ecx, [eax + eax + 0x4b74ff85]
mov eax, dword [ebp + 8]
add byte [eax], al
add byte [ecx + 0x4b33fc45], cl
add cl, cl
test ax, ax
je 0x44c74a
mov eax, dword [eax]
add byte [ebx + 0x8b087d], cl
dec eax
add byte [eax + edx*2], al
mov dword [ebp - 0xc], eax
mov eax, dword [ebp]
add byte [edi + 0x453966c0], dh
add al, 0
and eax, dword [ebx + 0xf]
mov bh, 4
pop edi
cmp word [ebp + 4], ax
add byte [ebx], ah
inc ebx
movzx eax, word [edi + ebx*2]
add byte [eax], al
jne 0x44c72f
mov edi, dword [ebp - 0x10]
nop
add byte [edi], cl
test dword [ecx], esp
sti
add eax, dword [eax]
mov eax, dword [eax]
add byte [esi + 0x5b], bl
leave
ret 0x5e04