joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451db0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x63
jb 0x451dbc
xor eax, eax
ret
push esi
mov esi, dword [eax*4 + 0x4a11b8]
test esi, esi
je 0x451f7a
cmp dword [esi], 0
push ebx
push ebp
push edi
je 0x451e8a
xor edi, edi
xor ebx, ebx
lea esp, [esp]
mov eax, dword [edi*4 + 0x4a11b8]
test eax, eax
je 0x451e04
mov eax, dword [eax + 0x40]
cmp eax, dword [esi]
jne 0x451dfb
push edi
call fcn.00451db0
add esp, 4
inc ebx
cmp dword [0x4a2b64], ebx
je 0x451e0a
inc edi
cmp edi, 0x63
jb 0x451de0
mov eax, dword [esi + 4]
test eax, eax
je 0x451e4e
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x406
push eax
call ebx
mov ebp, eax
xor edi, edi
test ebp, ebp
jle 0x451e4e
jmp 0x451e30
mov ecx, dword [esi + 4]
push 0
push edi
push 0x414
push ecx
call ebx
test eax, eax
je 0x451e49
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
inc edi
cmp edi, ebp
jl 0x451e30
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x451e8a
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetMenu]
cmp byte [esi + 0xbb], 0
jne 0x451e8a
mov edx, dword [esi]
push edx
mov byte [esi + 0xbb], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x60]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x451e9a
push eax
call ebp
mov eax, dword [esi + 0x68]
test eax, eax
je 0x451ea4
push eax
call ebp
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x451eb2
push eax
call dword [sym.imp.SHELL32.dll_DragFinish]
xor ebx, ebx
cmp dword [esi + 0xc], ebx
jbe 0x451f02
xor edi, edi
jmp 0x451ec0
mov eax, dword [esi + 0x14]
mov cl, byte [eax + edi + 4]
add eax, edi
cmp cl, 2
jne 0x451ee8
mov edx, dword [eax + 0x10]
test edx, edx
je 0x451ee8
test byte [eax + 5], 0x80
push edx
je 0x451ee4
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x451ef9
call ebp
jmp 0x451ef9
cmp cl, 0xa
jne 0x451ef9
mov eax, dword [eax + 0x10]
push eax
call 0x4785bf
add esp, 4
inc ebx
add edi, 0x14
cmp ebx, dword [esi + 0xc]
jb 0x451ec0
mov ecx, dword [esi + 0x14]
mov edi, dword [esi + 0x70]
mov ebx, dword [esi + 0x74]
push ecx
call 0x4785bf
mov esi, dword [esp + 0x18]
mov edx, dword [esi*4 + 0x4a11b8]
push edx
call 0x479b23
mov dword [esi*4 + 0x4a11b8], 0
mov esi, dword [0x4a2b64]
dec esi
add esp, 8
mov dword [0x4a2b64], esi
test edi, edi
je 0x451f77
cmp edi, dword [0x4a312c]
je 0x451f77
xor edx, edx
mov ecx, 0x4a11b8
cmp edx, esi
jge 0x451f6b
mov eax, dword [ecx]
test eax, eax
je 0x451f60
cmp dword [eax + 0x70], edi
je 0x451f77
inc edx
add ecx, 4
cmp ecx, 0x4a1344
jl 0x451f50
mov esi, dword [sym.imp.USER32.dll_DestroyIcon]
push edi
call esi
push ebx
call esi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret
Function at 0x458280
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [eax]
test eax, eax
je 0x45828f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret

Function at 0x4582a0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [eax + 0x1c], 0
mov eax, dword [eax]
jne 0x4582bb
test eax, eax
je 0x4582ce
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret
push 0
push 0x2af80006
push 0x414
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
ret

Function at 0x458310
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
cmp dword [edi], 0
push ebx
push esi
je 0x458475
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jbe 0x458359
xor esi, esi
mov eax, dword [edi + 0x14]
cmp dword [eax + esi + 8], 0
je 0x458350
cmp byte [eax + esi + 4], 6
je 0x458350
mov edx, dword [esi + eax + 8]
lea ecx, [esi + eax]
push edi
mov eax, str.Submit
call fcn.00458520
inc ebx
add esi, 0x14
cmp ebx, dword [edi + 0xc]
jb 0x45832d
xor esi, esi
xor ebx, ebx
cmp esi, dword [edi + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
je 0x458390
mov edx, dword [edi + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [edx + eax]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x20000
je 0x4583df
mov eax, 1
cmp dword [esp + 0x10], eax
jne 0x4583cc
cmp dword [esp + 0xc], eax
jle 0x4583cc
cmp ebx, 0xffffffff
jne 0x4583a8
xor ebx, ebx
push 0xa
lea edx, [esp + 0x24]
push edx
push ebx
call 0x476952
mov ecx, dword [esp + 0x24]
add esp, 0xc
push 1
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push eax
call fcn.004668b0
cmp esi, dword [edi + 0xc]
je 0x458464
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 0x14]
mov edx, dword [esp + 0x14]
cmp byte [eax + edx + 4], 6
jne 0x45844d
mov esi, dword [eax + edx + 8]
inc dword [esp + 0xc]
test esi, esi
je 0x458401
inc dword [esp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax + edx]
push 0
push 0
push pe_nt_image_headers32
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x458437
test ebx, ebx
je 0x458422
or ebx, 0xffffffff
jmp 0x458426
mov ebx, dword [esp + 0xc]
test esi, esi
je 0x45844d
push 1
push 0
push 0xffffffffffffffff
push 0x4916f4
jmp 0x458446
test esi, esi
je 0x45844d
push 1
push 0
push 0xffffffffffffffff
push 0x4900b0
mov ecx, esi
call fcn.004668b0
mov esi, dword [esp + 0x1c]
add dword [esp + 0x14], 0x14
inc esi
mov dword [esp + 0x1c], esi
cmp esi, dword [edi + 0xc]
jbe 0x458374
cmp byte [ebp + 8], 0
je 0x458475
mov ecx, dword [edi]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45aaf0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, eax
mov al, byte [edi]
xor bl, bl
mov byte [esp + 0xf], bl
test al, al
je 0x45ab29
cmp al, 0x21
je 0x45ab1a
cmp al, 0x2b
je 0x45ab15
cmp al, 0x5e
jne 0x45ab25
or bl, 2
jmp 0x45ab1d
or bl, 1
jmp 0x45ab1d
or bl, 4
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45ab04
mov byte [esp + 0xf], bl
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov cl, byte [edi]
test cl, cl
je 0x45ac17
cmp byte [edi + 1], 0
jne 0x45ab7d
mov byte [esp + 0x10], cl
cmp cl, 0xa
jne 0x45ab51
mov al, 0xd
jmp 0x45ac0f
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExA]
movzx eax, ax
mov ecx, eax
shr ecx, 8
cmp cl, 0xff
jne 0x45ac0f
cmp al, 0xff
jne 0x45ac0f
xor al, al
jmp 0x45ac0f
movzx esi, cl
test esi, 0xffffff80
jne 0x45ab9a
push 2
push esi
call 0x47814e
add esp, 8
test eax, eax
je 0x45ab9a
and esi, 0xffffffdf
mov eax, esi
cmp al, 0x56
jne 0x45abd6
movzx esi, byte [edi + 1]
test esi, 0xffffff80
jne 0x45abbe
push 2
push esi
call 0x47814e
add esp, 8
test eax, eax
je 0x45abbe
and esi, 0xffffffdf
mov eax, esi
cmp al, 0x4b
jne 0x45abd6
push 0x10
lea edx, [edi + 2]
push 0
push edx
call 0x478594
add esp, 0xc
jmp 0x45ac0f
xor esi, esi
jmp 0x45abe0
mov eax, dword [esi*8 + 0x49e108]
push edi
push eax
call 0x476cb6
add esp, 8
test eax, eax
je 0x45ac20
inc esi
cmp esi, 0x6d
jl 0x45abe0
mov eax, edi
call fcn.00410e90
movzx ecx, ax
test cx, cx
je 0x45ac17
call fcn.004115c0
mov byte [esp + 0x10], al
test al, al
jne 0x45ac29
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov al, byte [esi*8 + 0x49e10c]
jmp 0x45ac0f
mov eax, edi
call fcn.00410e90
movzx eax, ax
test ax, ax
jne 0x45ac4e
mov ecx, dword [esp + 0x10]
push ecx
xor bl, bl
call fcn.00411340
mov bl, byte [esp + 0x13]
add esp, 4
movzx eax, ax
test eax, 0x100
je 0x45ac58
or bl, 8
movzx edx, byte [esp + 0x10]
movzx eax, bl
pop edi
shl eax, 8
pop esi
or eax, edx
pop ebx
add esp, 8
ret
Function at 0x45ac70
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, ebx
push esi
shr eax, 8
push edi
mov esi, ebp
test al, 1
je 0x45ac8e
mov byte [ebp], 0x2b
lea esi, [ebp + 1]
test al, 2
je 0x45ac96
mov byte [esi], 0x5e
inc esi
test al, 4
je 0x45ac9e
mov byte [esi], 0x21
inc esi
test al, 8
je 0x45acee
push ebx
xor bl, bl
call fcn.00411340
mov ecx, dword [esp + 0x18]
push ecx
mov bl, 1
movzx edi, ax
call fcn.00411340
movzx eax, ax
add esp, 8
mov ecx, eax
test eax, 0x100
jne 0x45acca
mov ecx, edi
test ecx, 0x100
je 0x45acea
cmp di, ax
je 0x45acea
mov eax, 0x64
mov edx, esi
call fcn.00410e30
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov ebx, dword [esp + 0x14]
xor eax, eax
cmp byte [eax*8 + 0x49e10c], bl
je 0x45ad4c
inc eax
cmp eax, 0x6d
jl 0x45acf0
push 0x64
push ebx
xor eax, eax
call fcn.00411260
add esp, 8
cmp byte [esi], 0
je 0x45ad74
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 1
mov ecx, eax
push 0
xor edx, edx
mov eax, esi
call fcn.00410f30
add esp, 8
test al, al
jne 0x45ad74
movzx edi, bl
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov byte [esi], al
test al, al
je 0x45ad65
pop edi
mov byte [esi + 1], 0
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov edx, dword [eax*8 + 0x49e108]
push 0x63
push edx
push esi
call fcn.0047a8e0
add esp, 0xc
mov byte [esi + 0x63], 0
jmp 0x45ad0c
push edi
push str.vk_02X
push esi
call 0x477162
add esp, 0xc
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x460b80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010c
call fcn.00488480
push esi
mov esi, ecx
test esi, esi
je 0x460b9c
cmp byte [esi], 0
jne 0x460ba1
mov esi, str.ERROR
push 0xfffe
lea eax, [esp + 0x115]
push 0
push eax
mov byte [esp + 0x11c], 0
call fcn.004812e0
mov eax, dword [ebp + 8]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp byte [edi], 0
je 0x460c19
lea ecx, [esp + 8]
push ecx
push 0xffff
lea edx, [esp + 0x118]
push edx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 1
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x11c]
push ecx
mov ecx, dword [0x4a09d8]
call fcn.004668b0
pop esi
mov esp, ebp
pop ebp
ret 4
cmp byte [ebx], 0
je 0x460c39
lea eax, [esp + 8]
push eax
push 0xffff
lea ecx, [esp + 0x118]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
jmp 0x460c51
lea edx, [esp + 8]
push edx
push 0xffff
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
test eax, eax
je 0x460bf9
lea eax, [esp + 0x110]
lea esp, [esp]
cmp byte [eax], 0
jne 0x460c6e
cmp byte [eax + 1], 0
je 0x460bf9
mov byte [eax], 0xa
inc eax
jmp 0x460c60
Function at 0x4613f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
mov esi, dword [esp + 0x120]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
je 0x4614a2
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebp
test eax, eax
jne 0x4614af
mov edx, dword [esp + 0x14]
push edx
call fcn.004613f0
mov bl, al
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4614af
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x4614af
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
jne 0x461436
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret

Function at 0x4614c0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push esi
mov esi, eax
test edi, edi
je 0x4614d6
cmp byte [edi], 0
jne 0x4614df
test esi, esi
je 0x461536
cmp byte [esi], 0
je 0x461536
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x461536
test esi, esi
je 0x461543
cmp byte [esi], al
je 0x461543
push str.ahk_default
push esi
call 0x476cb6
add esp, 8
test eax, eax
jne 0x461519
mov esi, 0x49588a
mov edx, dword [esp + 0xc]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x461570
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004613f0
mov edx, dword [esp + 0x10]
add esp, 4
push edx
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x461536
mov eax, dword [ebp + 8]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x461536
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
push 0x4900b0
call fcn.004668b0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x464030
Capabilities:
Encode data using xor

Disassembly:
add dword [ebp + ecx*2 + 0x5c8c1302], ebp
xchg dword [esi - 0x7dcbeaf4], eax
sub byte [ecx + edx + 0x1884e324], al
sbb byte [eax], ah
out 0x60, al
adc dword [esi], edx
sub dword [ecx], esi
add ecx, dword [ebx + 0x30]
add byte [edx + 0x4420841], cl
dec eax
add al, 0xa4
and byte [ebx + 0x100284c8], 0x25
add al, byte [eax]
imul edx, dword [eax], 0x21820080
fadd dword [ecx - 0x7cbde15c]
dec eax
test eax, 0x6e590250
add al, 0x53
or al, 0x67
cwde
add dword [eax], esp
lodsd eax, dword [esi]
sbb byte [edx - 0x3578f300], dl
adc dword [eax + ebp], 0x9c200014
inc esi
xlatb
test dword [ecx], esp
push eax
xchg dword [edx], eax
pushal
dec esp
and dword [eax], edx
test eax, 0x4f050045
cdq
or eax, dword [edx + 0x40992378]
push ss
pop es
or byte [edx], 0x81
xor al, 0x93
add eax, 0x2c093400
dec eax
sub al, 0x48
add ch, byte [eax]
add al, byte [ecx]
and al, 0x16
test byte [eax - 0x777f24c0], al
add al, 0xa
add al, 0x74
loopne 0x46402e
sub byte [eax + 0x44], cl
mov cl, byte [ebx - 0x7e]
mov byte [ecx + 0x40], bl
jns 0x46406a
push ss
dec ebx
adc ah, ah
sbb byte [eax + ebx + 7], 0x15
adc ecx, dword [eax]
popal
dec eax
pushal
adc dword [ecx], esi
mov eax, dword [0x900808b4]
clc
push esp
pushal
adc byte [edi], cl
je 0x464109
wait
inc esp
adc al, 0xc8
add dword [edi + 0x2b], 0x445b9c
add al, 0x50
and dword [eax + 0x42005d94], eax
inc ebx
or al, 0x14
add byte [edx], bl
mov byte [0x6001e], al
in eax, dx
push ss
ror byte [ecx], cl
push 0x26431011
push es
or dword [eax], eax
sub dword [eax], eax
or al, 0x25
cmp al, byte [eax + 0xc]
rol byte [edx], 0
add byte [edx - 0x68], 0x55
add dword [eax], eax
test byte [edi], al
shl byte [ecx + 0x898c767], 5
add al, cl
and ecx, dword [ebx + 0x6a]
or cl, byte [eax + ecx*2 + 0x10c0894]
or eax, dword [eax - 0x48]
movsb byte es:[edi], byte [esi]
or al, 2
inc eax
inc edx
dec eax
ret
movsd dword es:[edi], dword [esi]
xor ch, byte [ecx + 0x2610200]
or dword [ebp - 0x7b], ebx
or dh, byte [eax]
inc eax
adc cl, bh
pop edx
and bl, byte [esi]
add al, 2
lea eax, [eax]
add al, byte [eax]
and dword [edx], edx
pop ecx
push eax
mov eax, 0xa964001
add dword [eax + 0x52a02e3], ecx
or al, 0xda
inc eax
xor al, 0xc1
sub al, 0
and al, byte [eax + 0x1ca40024]
nop
in eax, 0x99
and esp, dword [0x2980a802]
sbb byte [eax + ebx], cl
dec edx
push eax
dec ebx
cdq
xor byte [eax + 0x2c45009], 0xba
push 0x1a
pop es
test byte [ebx], al
ret 0x6228
Function at 0x4645f0
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
pop ss
add ah, 0x92
xchg edx, eax
xchg edx, eax
xor byte [eax], al
push 0x49501118
add al, ah
pop dword [edx + 0x53a1e087]
add edx, dword [ecx + 0x185c85]
test byte [ebx - 0x68], cl
loope 0x4645ec
inc eax
push ss
jo 0x216c4f35
add al, 0x29
and byte [eax - 0x77a3d980], ah
inc edx
sbb dword [ecx], edx
add eax, 0xc0e92a00
and byte [ebx + ecx*8 + 0x10a018cc], cl
add byte [eax + 0x17], 0xb2
push es
cmp ah, ah
cmp dh, byte [edi + eax]
mov al, byte [0x47018b05]
mov word [ecx - 0x1dfbdf68], ss
add byte [ebp - 0x6e3657fc], ah
jae 0x46465b
add al, 0x80
salc
pop gs
jl 0x4646be
dec esp
inc ecx
adc dword [esp + ebx + 0x23020640], 0xc
add dword [ebx], edx
adc al, 0x8c
add byte [edx], 0x51
movsb byte es:[edi], byte [esi]
pushal
sbb byte [eax], 0x8a
adc eax, 0x11811010
or ah, cl
mov al, 0x20
or byte [eax + edi], al
push eax
loopne 0x4646d4
mov byte [0x6401cb0e], al
ret 0x4b91
add byte [ebx + 0x1904887c], bh
adc byte [eax + 0x28820090], ah
inc eax
add al, 0
inc eax
dec edx
pop ebp
sbb byte [eax - 0x1e66378b], al
and dword [eax*2 - 0x787e7bb0], edx
sysexit
inc edx
cdq
loope 0x4646f8
adc al, 0x45
push eax
test byte [ecx + 0x42350f87], al
add al, byte [eax]
test byte [ecx - 0xc], 0xce
sub eax, 0x8da4a783
je 0x4646f7
xor byte [esi + 0x7421185], al
test byte [eax], al
add eax, 0x8989408
add dword [eax], edx
sbb byte [ecx + 0x32d6a002], al
cmp ch, byte [edx]
inc ax
xchg esp, eax
cwde
or byte [ecx], al
adc byte [eax], bl
add dword [edx], 0x3a32d6a0
sub ah, byte [esi + 0x40]
shr eax, cl
in al, 1
aam 0x22
adc byte [eax], al
mov eax, 0x1a424231
adc byte [ebx + eax*4 - 0x50], ch
add ah, byte [ebx]
sub byte [eax + 0x6400296], ch
add byte [edx + 0x46600314], ah
and ah, bl
mov ah, 0x30
sub dword [esp + ebx*8], 0xc51646c1
or dword [eax], ecx
inc eax
adc ah, byte [ebx]
mov al, 0x40
or byte [ecx + 8], dl
ret 0x2aa9

Function at 0x464760
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], ch
and dword [eax + edx*2], eax
cmp ah, byte [esp + ecx*4]
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
xor byte [ecx + 0xc01428], al
pop ss
add byte [ecx], cl
dec ecx
nop
or eax, 0xa681d01
inc edx
inc ebx
or byte [eax + 0xa], 0
pop ss
or dword [ecx], eax
add dword [eax], edx
pop es
add dword [eax], edx
pop es
or al, 9
pop esp
loop 0x46473e
xor dword ss:[eax], ebp
sub byte [eax], ah
and byte [ecx], dh
cdq
inc ecx
inc eax
or dword [eax - 0x1c83d306], eax
mov byte [0x2ba91e06], al
shl byte [edx], 0x23
mov byte [0xc204591], al
mov al, byte [0x29d224b0]
jne 0x46478e
adc eax, 0x9022602
add ah, byte [esi]
add cl, byte [ecx]
add byte [ecx + 0x38223921], ch
inc eax
rol dword [edi], 0xc4
xor byte [edx], 0x21
sbb byte [esi + 7], ah
xor eax, 0x20c92821
bound eax, qword [ebx]
adc dword [ecx], 4
push es
add dword [0x6ca25407], edx
or al, byte [ebp - 0x7e3ef7dc]
xor byte [eax + edx + 0x5020540a], ah
invalid
Function at 0x4673c0
Capabilities:
Encode data using xor

Disassembly:
add al, 8
fld qword [0x11c0005c]
iretd
movsb byte es:[edi], byte [esi]
inc eax
mov al, 0x33
enter 0x4801, 0xffffffffffffff90
adc byte [esi], al
xor dword [esi], eax
or byte [eax], dl
or bl, ah
and al, 0xd0
add dl, byte [eax + 0x52]
add byte [ecx], bl
sub dword [edi], 0x56842288
xor byte [eax + eax + 0x46508187], ah
inc esi
inc esi
xchg byte [eax + 0x51], cl
add al, byte [edx]
xor ch, cl
add dword [edx + 0x70], ecx
adc byte [ecx + 0x12], dl
in eax, 0x3c
std
or byte [ebx - 0x675aa740], dh
rcr byte [eax - 0x5b], 0x98
mov dword [0x1a15298], eax
and esp, esi
and al, 8
pushal
lea esi, [ebp - 0x66]
or byte [eax - 0x73], ah
jne 0x46737f
inc eax
add al, 0xc5
adc byte [eax + eax*8 + 0x632e0ee2], ah
and dword [eax + eax + 0x2a134c11], edx
dec eax
xchg ebx, eax
and byte [esi - 0x6d], 0xff
adc dword [edx - 0x57], ecx
loopne 0x46739d
loopne 0x467446
sbb dword [esp + ebp*2], edx
adc dword [edx], 0xa02b21b
inc edx
jo 0x4673d4
add byte [esi + 0x42], cl
add dword [eax], edx
jl 0x4673e0
dec edi
cmp al, byte [eax - 0x1bbc3fd7]
inc esi
adc dword [ecx + 0x20], ecx
loopne 0x467446
pop esp
pop ebp
xchg esp, eax
inc esi
push ss
and eax, 0x80570821
inc eax
adc eax, 0xd40300af
and ch, byte ss:[ebx]
test dword [eax], edx
salc
mov byte [0x843822c], al
push ss
sub eax, dword [ebp + 0x2ca2d610]
add byte [ebx + 8], 0x16
outsb dx, byte [esi]
and byte [edi], cl
mov al, 0x35
dec eax
or al, cl
and al, 0x69
and dl, byte [edx]
popal
inc ecx
mov al, byte [0x2ca40002]
or byte [edx - 0x4ecacae8], 0x40
add cl, byte [eax + 0x54319900]
or eax, 0x3612e000
bswap ecx
xor eax, 0x24c80848
imul esp, dword [edx], 0xa0416112
add al, byte [eax]
movsb byte es:[edi], byte [esi]
sub al, 0x82
mov bl, byte [eax]
xor eax, 0x240b135
mov byte [eax], al
cdq
xor dword [ebp + ecx], edx
loopne 0x467478
bswap ecx
add bh, cl
add byte [esi + 0x66], bh
push esi
adc eax, dword [edi]
ret 0x2001
add eax, 0x82c10c2f
adc dword [edx - 0x1c7fcf5e], eax
aad 0x90
push es
clc
shr dword [eax + ebp*4], 0x58
add byte [edi], al
les eax, es:[ecx + 0x14]
inc edx
shr byte [eax + 0x2a468180], 0x8c
and dl, dl
add byte [eax], ah
nop
add byte [eax], ah
mov al, byte [0x608cf481]
xchg esp, eax
pop ebp
push ecx
push es
inc eax
mov ecx, 0x95130e0c
add al, 0x8c
xchg byte [esi], bl
sbb al, 0x34
jno 0x467437
xor al, byte [ecx]
add al, 0xdf
mov bh, byte [eax]
pop eax
out 0xa1, al
xor esp, eax
cwde
js 0x4674e9
in al, dx
inc esp
nop
dec eax
or cl, byte [eax]
adc byte [eax - 0x4c], al
jno 0x467540
xchg ecx, eax
sbb eax, 0x1840a242
add dword [eax], esi
pop es
test eax, 0xc203020f
push edi
xor al, byte [ecx - 0xdcdf9f8]
inc ecx
mov edx, 0x16120d6d
adc dl, byte [esi]
xor byte [edi], al
nop
or dword [esi - 0x3e], eax
add byte [edx - 0x64f73fbb], ah
adc byte [eax + 0x1228ad2], 0xb2
dec eax
cmp eax, 0x54311911
cmp eax, dword [eax + 0x17c6bf9d]
test dword [ecx], esi
dec eax
ret
and cl, byte [ecx]
xchg esi, eax
inc ecx
loope 0x467546
xchg edx, eax
Function at 0x467d40
Capabilities:
Encode data using xor

Disassembly:
fldenv [ecx + eax*4 + 0x10]
test al, 5
add byte [eax], bl
enter 0x6d01, 0x22
inc eax
inc esp
rcl byte [eax + 8], 0xc6
dec ebx
mov ss, word [esi]
adc al, byte [eax + 0x1680153c]
mov al, byte [0x8a034919]
push ds
add byte [ecx], al
and byte [ebp + 0x42], dh
add al, cl
inc eax
test al, 0x6a
inc ecx
adc cl, byte [edx]
add dword [ebx], edx
dec edx
sbb ah, byte [esp + eax*2]
shl dword [ecx], 0x56
xchg esi, eax
xor dword [eax + 0x23], edx
and al, byte [edx]
xor al, byte [esi]
push esi
mov esp, 0x2244cc01
adc al, 0x40
nop
adc dword [ecx - 0x5d79deba], 0x1c
mov byte [0xc34441c], al
mov byte [0xc34441c], al
insb byte es:[edi], dx
or byte [ecx], dh
cmp byte [eax + 0x130240a4], ch
xchg edx, eax
dec eax
cmpsd dword [esi], dword es:[edi]
mov word [ecx], es
sbb byte [esp + eax*8], bl
add al, byte [eax]
mov eax, 0x3b220d22
add dword [eax], edx
mov al, 0xb4
and byte [ecx + 0x6e04c906], bl
inc eax
inc eax
rol byte [ebx], 1
loopne 0x467cf3
mov edi, 0x416611df
add eax, 0xc3c09014
ret

Function at 0x47f404
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49cdb0]
jne 0x47f40e
repz ret
jmp fcn.00487498