joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4262f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push 0
push 0
push eax
call fcn.0055e9a0
mov esi, dword [ebp + 0x10]
add esp, 0xc
cmp dword [ebp + 0xc], 0
mov dword [ebp - 4], 0
jbe 0x42635d
mov ecx, dword [ebp + 0x14]
lea edx, [esi + ecx]
push ebx
mov dword [ebp + 0x10], edx
push edi
cmp esi, dword [ebp + 0x10]
jae 0x42635b
mov ebx, dword [esi]
mov eax, dword [ebp + 8]
mov edi, dword [esi + 4]
push 1
push ebx
push eax
add esi, 8
call fcn.0055e9a0
mov ecx, dword [ebp + 8]
push ecx
push edi
push 1
push esi
call fcn.0055e89c
mov eax, dword [ebp - 4]
lea edx, [edi + ebx]
add eax, edx
add esp, 0x1c
add esi, edi
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jb 0x426320
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x426c20
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x42aab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
push esi
push edi
mov esi, ecx
jb 0x42aac2
mov eax, dword [eax]
push 0x5a57e8
push eax
call fcn.0055ead8
mov edi, eax
add esp, 8
test edi, edi
jne 0x42aadf
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [esi]
test eax, eax
je 0x42aaea
mov edx, dword [eax + 4]
jmp 0x42aaec
xor edx, edx
test eax, eax
je 0x42aaf4
mov ecx, dword [eax]
jmp 0x42aaf6
xor ecx, ecx
test eax, eax
je 0x42aaff
mov esi, dword [eax + 4]
jmp 0x42ab01
xor esi, esi
push edi
push edx
push 1
push ecx
call fcn.0055e89c
xor ecx, ecx
cmp eax, esi
setne cl
push edi
mov esi, ecx
call fcn.0055e6d1
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x42abc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x603d70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
push esi
push edi
mov edi, ecx
jb 0x42abdf
mov eax, dword [eax]
push 0x5a4018
push eax
call fcn.0055ead8
mov esi, eax
add esp, 8
test esi, esi
jne 0x42ac08
pop edi
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d11a
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.00561fe1
lea ecx, [ebp - 0x34]
push ecx
push eax
call fcn.00561c8f
add esp, 0xc
test eax, eax
je 0x42ac26
mov edi, 1
jmp 0x42ac48
mov eax, dword [ebp - 0x20]
push esi
push eax
push 1
push eax
mov ecx, edi
call fcn.0042ab30
push eax
call fcn.0056082a
xor edx, edx
add esp, 0x10
cmp eax, dword [ebp - 0x20]
setne dl
mov edi, edx
push esi
call fcn.0055e6d1
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0055d11a
mov esp, ebp
pop ebp
ret 4
Function at 0x42d070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585213
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x603d70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.0042a8e0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea ebx, [edi + 0x14]
lea ecx, [esi + 0x14]
push ebx
mov dword [ebp - 4], 0
call fcn.0042a8e0
mov ecx, dword [ebx + 4]
mov dword [esi + 0x18], ecx
mov edx, dword [ebx + 8]
mov dword [esi + 0x1c], edx
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x20], eax
mov ecx, dword [ebx + 0x10]
mov dword [esi + 0x24], ecx
mov edx, dword [edi + 0x28]
mov dword [esi + 0x28], edx
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0x34]
lea eax, [edi + 0x38]
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
mov dword [esi + 0x34], edx
call fcn.0044a900
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x3c], ecx
mov dl, byte [edi + 0x40]
mov byte [esi + 0x40], dl
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov ecx, dword [edi + 0x48]
mov dword [esi + 0x48], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42d140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585238
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x603d70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.0042a8e0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x18]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
lea edx, [edi + 0x24]
mov dword [esi + 0x20], ecx
push edx
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 0
call fcn.0044a900
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4344a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585d7f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x603d70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea eax, [esi + 0x15c]
push eax
call dword [0x5a24b0]
lea edi, [esi + 0x110]
mov dword [ebp - 0x14], edi
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.004340e0
mov edi, dword [edi + 4]
push edi
call fcn.0045e9ee
add esp, 4
lea ecx, [esi + 0x3c]
call fcn.0042e960
lea ecx, [esi + 0x30]
call fcn.004328b0
mov edi, dword [esi + 0x30]
push edi
call fcn.0045e9ee
lea edi, [esi + 0x24]
add esp, 4
mov dword [ebp - 0x18], edi
mov ecx, edi
mov byte [ebp - 4], 7
call fcn.004302c0
mov edi, dword [edi]
push edi
call fcn.0045e9ee
lea edi, [esi + 0x18]
add esp, 4
mov dword [ebp - 0x18], edi
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.0042f830
mov edi, dword [edi]
push edi
call fcn.0045e9ee
add esp, 4
lea ecx, [esi + 0xc]
call fcn.004327b0
mov edi, dword [esi + 0xc]
push edi
call fcn.0045e9ee
add esp, 4
mov ecx, esi
mov dword [ebp - 4], 9
call fcn.00430280
mov edx, dword [esi]
push edx
call fcn.0045e9ee
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43ae30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x58]
push esi
push edi
cmp eax, 0xffffffff
je 0x43ae7c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
push edi
push esi
push eax
call fcn.00562bcc
add esp, 0x10
cmp eax, esi
jne 0x43ae7c
cmp edx, edi
jne 0x43ae7c
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x58]
push esi
push eax
push ecx
call fcn.00562a51
add esp, 0xc
cmp eax, esi
jne 0x43ae7c
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x10
Function at 0x450b20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5889ee
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x603d70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0042a8d0
lea ecx, [esi + 0x14]
mov dword [ebp - 4], 0
call fcn.0042a8d0
push 0xffffffffffffffff
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
call fcn.0044a8c0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [esi + 0x28], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x2c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x30], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 2
mov dword [esi + 0x34], edx
call fcn.0044a930
mov eax, dword [ebp + 8]
mov dword [esi + 0x3c], eax
mov byte [esi + 0x40], 0
mov eax, dword [eax + 0x140]
push 0x80000
mov ecx, esi
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
call fcn.0045bea0
push 0x10000
lea ecx, [esi + 0x14]
call fcn.0045bea0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4534b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588c8b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x603d70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor edi, edi
push 0x58
mov dword [esi + 0x10], edi
call fcn.0045e9bf
add esp, 4
cmp eax, edi
je 0x45355b
mov dword [esi + 0xc], eax
mov dword [eax], eax
mov eax, dword [esi + 0xc]
mov dword [eax + 4], eax
mov eax, dword [esi + 0xc]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0xc]
mov al, 1
mov byte [ecx + 0x54], al
mov edx, dword [esi + 0xc]
mov byte [edx + 0x55], al
mov dword [ebp - 4], edi
mov dword [esi], 0x708
mov edi, 8
lea ecx, [ecx]
call fcn.0055f9d7
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
shld ebx, ecx, 8
cdq
shl ecx, 8
xor eax, ecx
xor edx, ebx
dec edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
jne 0x453520
mov ecx, esi
call fcn.00451b30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], edi
call fcn.0055d02c
push 0x5e0cc8
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable._q_v_2WiNe_KdZ_.0
call fcn.0055d27a
int3
Function at 0x454b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588fcd
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x603d70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0xf4], ebx
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x5a44ca
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xf8], esi
mov byte [esi], bl
call fcn.00406f50
lea ecx, [ebp - 0xe8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xf4], 1
call fcn.0045c730
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], 0x33323130
mov dword [ebp - 0x1c], 0x37363534
mov dword [ebp - 0x18], 0x62613938
mov dword [ebp - 0x14], 0x66656463
mov word [ebp - 0xec], bx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
cmp ecx, 0x10
jb 0x454bc8
mov eax, dword [edi]
jmp 0x454bca
mov eax, edi
lea edx, [eax + 1]
mov dword [ebp - 0xf0], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x454bd3
sub eax, dword [ebp - 0xf0]
cmp ecx, 0x10
jb 0x454be7
mov edi, dword [edi]
push eax
push edi
lea ecx, [ebp - 0xe8]
call fcn.0045c750
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0045c800
mov dword [ebp - 0xf0], ebx
mov ecx, dword [ebp - 0xf0]
movzx edx, byte [ebp + ecx - 0x30]
shr edx, 4
mov al, byte [ebp + edx - 0x20]
mov byte [ebp - 0xec], al
lea eax, [ebp - 0xec]
mov byte [ebp - 0xeb], bl
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x4c], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x454c40
sub eax, edx
push eax
lea ecx, [ebp - 0xec]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.00406f50
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x4c]
push edx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00406400
mov edi, 0x10
mov byte [ebp - 4], 1
cmp dword [ebp - 0x38], edi
jb 0x454c85
mov eax, dword [ebp - 0x4c]
push eax
call fcn.0045e9ee
add esp, 4
mov ecx, dword [ebp - 0xf0]
movzx edx, byte [ebp + ecx - 0x30]
and edx, 0xf
mov al, byte [ebp + edx - 0x20]
mov byte [ebp - 0xec], al
lea eax, [ebp - 0xec]
mov byte [ebp - 0xeb], bl
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x4c], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x454cc0
sub eax, edx
push eax
lea ecx, [ebp - 0xec]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.00406f50
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x4c]
push edx
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00406400
mov byte [ebp - 4], 1
cmp dword [ebp - 0x38], edi
jb 0x454d00
mov eax, dword [ebp - 0x4c]
push eax
call fcn.0045e9ee
add esp, 4
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp eax, edi
jl 0x454c09
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], bl
call fcn.0045bf00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055d11a
mov esp, ebp
pop ebp
ret 8
Function at 0x45adc0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp eax, ecx
jne 0x45add3
mov eax, 1
pop ebp
ret
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
pop ebp
ret
Function at 0x45c030
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
push 0x40
lea esi, [ecx + 0x5c]
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.0045bfe0
mov byte [esi], 0x80
pop esi
ret

Function at 0x46ac1b
Capabilities:
Encode data using xor

Disassembly:
dec ebx
mov edx, 0xe83cc9da
fdiv qword [ebp - 0x1da92a7b]
loop 0x46ac0f
mov cl, 0x52
loop 0x46ac0f
mov cl, 0x52
sub cl, bh
clc
inc eax
imul eax, dword [bx + 0x67], 0x9c9a86dc
cmpsd dword [esi], dword es:[edi]
xor dword [esi - 0x54f8bb01], esp
aad 0x17
and eax, 0xf03bcba6
sub dword [ebp - 0x6cd4b3a4], edi
pop eax
invalid

Function at 0x478a59
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0xb43aed9d]
mov bl, 0xdd
xchg byte [esi + 0x56], dh
sbb esi, dword [edx + 0x63485d19]
xor dword [edi + 0x534cbca], edx
dec ecx
xor esp, ebx
pop edx
invalid
popal
arpl di, bp
wait
mov al, bh
jb 0x478a75
xor byte [edi + 0xabe1d02], dl
je 0x478a61
push 0xffffffffffffffd7
push cs
pop edi
in eax, dx
salc
loope 0x478aef
xor al, 0x74
sub byte ss:[edx - 0x55], dh
jb 0x478a22
mov bh, 0xeb
push ecx
test al, 0xf3
push ebp
imul edi, dword [edi + edx*2], 0x540ec9bc
mov eax, 0x177b73ea
lds ebx, [ebp + 0x1ce8509a]
cmpsb byte [esi], byte es:[edi]
aaa
je 0x478aa9
lodsb al, byte [esi]
xchg ecx, eax
dec ecx
xor eax, 0xc6e4c63e
in eax, 0x51
dec esp
cmpsb byte [esi], byte es:[edi]
invalid
and byte [edx - 0x15], ch
call 0xc4c2d3c9
stc
pop edx
or dl, cl
pop ebx
sub byte [0xf9614fb6], bl
bound esi, qword [ecx + 0xc8f61b2]
inc esp
and dl, byte [eax - 0x358d2c38]
pushal
adc al, 0xe9
invalid
Function at 0x480977
Capabilities:
Encode data using xor

Disassembly:
sbb byte [ebp + 0x6b], al
jbe 0x48095b
push ecx
clc
invalid
and eax, 0xc41bd932
sbb dword [esi + 0x1ca11e41], 0x61
jge 0x48097a
push edx
fstp dword [ebx]
movsb byte es:[edi], byte [esi]
dec eax
jmp 0x7961b80
pop edx
scasb al, byte es:[edi]
popfd
mov byte [0x8e5bcb5a], al
wait
sub eax, 0x4dd3f6cd
push esi
mov esi, esi
cmpsb byte [esi], byte es:[edi]
mov esp, 0x736b310e
scasd eax, dword es:[edi]
retf
jae 0x48093c
cmp ecx, eax
insb byte es:[edi], dx
insd dword es:[edi], dx
shr ebx, cl
add al, 0xb3
movsd dword es:[edi], dword [esi]
dec ebp
in eax, dx
clc
mov dl, 0xb5
push ecx
jb 0x480975
inc edi
push edi
rol cl, 0x61
lea ebx, [edi + 0x16]
or byte [edi + ebx*2 - 0x5fa368d3], 0xef
sal al, 1
add dl, byte [0xea80b7e4]
mov esi, 0x2e3972e2
wait
push cs
ja 0x48098b
cdq
imul eax, dword [ebp - 0x46], 0x4a
loopne 0x48095b
or byte [eax + 0x52], dh
cmpsb byte [esi], byte es:[edi]
mov ebx, 0x754350dd
loop 0x480a44
invalid
je 0x4809ae
mov ah, ch
push 0xffffffffffffff8c
mov ebx, 0x2a3530b1
push edx
movsb byte es:[edi], byte [esi]
imul edi, ebx, 0x4c
pop edx
scasd eax, dword es:[edi]
xchg ebp, eax
in al, dx
sub al, 0x26
cli
test dword [esi + 0x11], 0xc7195aa8
js 0x48099b
in al, 0x6c
ror byte [ebx - 0x21], 6
test ah, ch
xchg edx, eax
or al, 0xcb
push ebx
inc ebp
mov ebx, 0x1e72a7dd
lahf
daa
add eax, 0xe0e9ac3e
cmc
imul dword [ecx]
and al, 0xd5
pop ss
invalid
fnstcw word [esi + 0x547e648b]
mov cl, 0xe6
adc al, 0x31
push 0xffffffffffffffa8
shl eax, cl
inc ebx
mov cl, 0xa9
mov eax, dword [esi - 0x27044a1e]
xchg esp, eax
jle 0x480a76
ja 0x4809f7
fcmovnu st(0), st(4)
cmp eax, 0x45d65bc2
ja 0x480a52
mov ds, word [edx]
iretd
aad 0x95
ror byte [edx], 0xc5
inc eax
stosd dword es:[edi], eax
inc esi
out dx, al
and al, 0x35
jb 0x480aaa
int1
nop
cmp ecx, dword [edx]
xchg byte [edi + edx*4], dh
and dword [edx - 0x79], esi
dec esp
mov edi, 0x16e1e9a6
invalid
ffree st(7)
mov ecx, 0xb1dfad8f
stosb byte es:[edi], al
sbb al, 0xa9
sub al, byte [ebx - 6]
xchg edi, eax
lcall 0xd0, 0x5c0c2310
and dword [ebx], eax
imul ebx, dword [esi + ebx*8 - 0x5d], 0xdd64fdfa
scasd eax, dword es:[edi]
xchg ecx, eax
out dx, al
xchg ebp, eax
and byte [ebp - 0x43], dl
scasb al, byte es:[edi]
xor ebx, dword [eax + 0x7d]
sti
xchg edx, eax
mov eax, 0xd93e9f6e
imul ecx, dword [ecx - 0x46], 0x9a9c5660
jo 0x480ad1
clc
and eax, 0x306662e7
lodsb al, byte [esi]
or dh, ch
invalid
Function at 0x49c743
Capabilities:
Encode data using xor

Disassembly:
test byte [eax - 0x66], al
mov ebp, 0x6e07c212
add dl, byte [eax + eax*4 + 0x608537b8]
adc ebp, dword [edi + 0x605f1a40]
inc eax
sbb bl, byte [edi + 0x60]
sbb bl, byte [edi + 0x60]
mov eax, 0x1180d326
les ecx, [ebp + edi + 0x69c0ba85]
test dword [edx - 0x64f39640], edi
dec esi
scasd eax, dword es:[edi]
shr esi, 1
in eax, dx
arpl word [ecx + 0x49cf518d], dx
xor dl, ah
out 0x26, al
dec esi
push ds
mov byte [ecx + 3], bh
and dword [edx + 0x74], 0xffffff8a
pop eax
jnp 0x49c738
sub dword [edx + 0x12c92464], ebx
pop ss
aas
iretd
int1
mov byte [0xa36e9326], al
mov eax, 0x856ae20a
mov eax, 0x94589004
lcall 0x13a, 0x460ee998
cmp al, 0xa7
jecxz 0x49c79b
sbb eax, 0x80f6d0a3
push eax
and al, 0x48
salc
in eax, dx
dec eax
jp 0x49c726
in al, 0xc2
invalid

Function at 0x4ad95f
Capabilities:
Encode data using xor

Disassembly:
sti
xor eax, 0x78aeca0a
mov dh, 0x96
xor dword [esi], eax
in al, 0x2e
and al, 0xc5
inc esp
lahf
invalid

Function at 0x4adcc3
Capabilities:
Encode data using xor

Disassembly:
dec esi
jns 0x4adcd3
mov al, 0x84
jge 0x4adc7b
mov esp, 0x1bfd9e3
sbb al, 0xe7
mov byte [0x1d209beb], al
nop
mov al, 0x3c
cmp dl, byte [ebp + edi + 0x56f6d875]
wait
and byte [0x3a3cb090], bl
xchg esp, eax
cmp eax, 0x56f6d875
sbb dword [0xf13330e3], esi
test esp, edx
inc ebx
adc dword [esi + 0x40784d56], ebx
fiadd word [edi]
cmp dword [ebx], esp
ja 0x4add6e
mov al, byte [0xe694fb2e]
jo 0x4adc9d
rcl byte [edi], 0xbc
retf
int3

Function at 0x4b063e
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [esp + eax*4 - 0x4333ae6d]
test ebp, esp
dec edx
mov esi, dword [ecx]
lodsd eax, dword [esi]
adc eax, 0xc8d412c7
pop ebx
test al, 0x9b
push edx
mov al, ah
xor al, 0x71
loope 0x4b064c
invalid
mul byte [esi]
cmp eax, dword [ebp + 0x7a353642]
cld
invalid
Function at 0x4cc558
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x21
scasb al, byte es:[edi]
cmp ebp, dword [ebx + 0x78]
pop edx
scasd eax, dword es:[edi]
hlt
js 0x4cc59c
loope 0x4cc59d
cli
test dword [edi + 0x52140a11], eax
xchg dword [ecx], edx
or dl, byte [edx + edx*2]
aam 0x15
stc
push esp
in eax, 0xc2
push edi
xlatb
inc ebp
pop eax
adc ebp, dword [edx + 0x5d]
add ecx, dword [ebx]
int 0x38
pop ebx
fimul word [eax - 0x9ba8f3d]
outsd dx, dword [esi]
ror byte [esi + eax*8], cl
mov byte ds:[0xf6a6b647], al
mov bl, byte [edx + 0x734e37f]
cmp dword [eax - 0x29], edi
popfd
out 0x62, al
lahf
retf
push ds
loopne 0x4cc522
or dword [edx], 0x17
in eax, dx
dec edi
test dword [ebx + 0x64f96682], ebx
pop es
inc edi
ja 0x4cc50e
mov ch, 0xe6
sub dh, dl
dec esi
mov dl, 0x6f
in al, dx
sti
mov bl, 0xc1
jg 0x4cc51c
out dx, eax
pop edi
stosb byte es:[edi], al
cli
mov esi, 0x7df7d55f
neg byte [ebp - 0x589d703]
jmp 0x4cc55f
lcall 0xa63c, 0x996fb160
pushal
mov cl, 0x6f
cdq
cmp al, 0xa6
xchg ebp, eax
and byte [esi], 0xff
cmp dh, byte [edx + 0x765d106f]
aad 0x1b
adc dl, bh
mov bh, 0x10
lahf
mov dl, 0xe4
push esp
mov al, byte [0x5ca77204]
add byte [eax - 0x358e2324], al
pop edi
adc eax, esp
and eax, 0x1b6925e4
stosd dword es:[edi], eax
je 0x4cc566
sub eax, 0x674f6113
add byte [edx], al
sub al, 0xa7
pushfd
std
mov al, 0xe6
xchg edi, eax
jne 0x4cc63c
jp 0x4cc5f3
cld
and byte [0x3a783f04], ch
call 0xfe9aaae
xchg esp, eax
inc esp
sub bl, byte [ecx - 0x1b]
and eax, 0xfefd9b9b
and eax, 0xfefd9b9b
retf
jns 0x4cc6ae
ljmp 0x1c8b:0xefc4ee84
add eax, 0x3d2aaa59
out dx, eax
pop ecx
xor bh, byte [ebx]
dec ecx
sub byte [ebp + 0x7df800d6], cl
pop ecx
salc
add al, bh
jge 0x4cc6e3
sahf
loop 0x4cc679
test dh, bl
out dx, al
xchg edi, eax
xchg edx, eax
or ebp, dword [eax + 0x4d15e105]
mov al, 0xe8
test dword [ecx + 0x39], ebx
sub al, 0x43
out 0x85, al
cwde
cmp eax, 0x36cde9d9
ja 0x4cc6e4
sal ch, 0xc5
fstp qword [0x26653c0]
sbb eax, 0x26653c0
dec esi
leave
push cs
jecxz 0x4cc685
sbb eax, 0x7c43403f
mov ah, 0x67
mov al, 0x47
bound ebx, qword [ebp + 0x67]
xchg esp, eax
mov ebp, 0x2f23c842
add ch, byte [edi + ebx*8 + 0x23d0e214]
jne 0x4cc722
mov edx, 0xdcd912d5
xlatb
invalid
inc edi
push ebx
sal byte [ebp - 0x4f584e9a], 0x23
pop edx
adc dword [ebp + 0x4f], ebp
push ebp
nop
jmp 0x4cc75a
xchg byte [eax + 7], ch
cmpsd dword [esi], dword es:[edi]
and byte [ebx - 0x5e238428], dh
scasb al, byte es:[edi]
ror byte [ebx - 0x6e], 0x28
pop esp
cli
xchg ecx, eax
mov bl, 0xdd
movsd dword es:[edi], dword [esi]
push eax
aaa
ja 0x4cc734
cmp dl, bl
push edi
jb 0x4cc7a6
retf
dec eax
xor bl, byte [edi - 0x46]
jp 0x4cc785
inc ecx
bound esp, qword [ecx + 0x6b9eee49]
xchg edi, eax
mov ebx, 0xb7271b67
dec esp
dec ebp
stc
loop 0x4cc78a
retf 0x74e0
cwde
movsd dword es:[edi], dword [esi]
bound edi, qword [esi - 0x5b0fb266]