joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f2b8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45f2ca
add esp, 0xfffffff0
call fcn.004045ac
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422720
mov eax, dword [0x47ea80]
mov dword [eax + 4], ebx
mov dword [eax], 0x45f65c
mov eax, dword [0x47ea8c]
mov dword [eax + 4], ebx
mov dword [eax], 0x45f668
mov eax, ebx
call fcn.0045f674
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41744c]
call fcn.00404218
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41744c]
call fcn.00404218
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41744c]
call fcn.00404218
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41744c]
call fcn.00404218
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41744c]
call fcn.00404218
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45b10c
push eax
push 0
push 0
mov eax, dword [0x47ebfc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x426628]
call fcn.00427e7c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x426628]
call fcn.00427e7c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x426628]
call fcn.00427e7c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045faa4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f974
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f974
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f974
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45f407
call fcn.00404604
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45f758
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f903
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45f8e4
mov dl, 1
mov eax, dword [0x417ab8]
call fcn.00404218
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004050b4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45f8d3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004520f8
test al, al
je 0x45f8c6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45f914
lea eax, [ebp - 0x254]
call fcn.0040a278
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x45f8c6
xor eax, eax
push ebp
push 0x45f8bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45f94c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x45f8a8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405324
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45f8a8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405324
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f8c6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45f7c9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041c2a8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f90a
lea eax, [ebp - 0x260]
call fcn.004050b4
ret

Function at 0x46027c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x482584]
cmp byte [eax + 0xad], 0
jne 0x4602ed
cmp dword [0x48259c], 0
jne 0x4602ae
call sub.KERNEL32.DLL_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x460238
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x48259c], eax
cmp dword [0x482598], 0
jne 0x4602c9
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x482598], eax
cmp dword [0x4825a0], 0
jne 0x4602ed
push esp
push 0
push 0
push 0x4601dc
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4825a0], eax
pop edx
ret
Function at 0x4604c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4604d7
add esp, 0xfffffff0
call fcn.004045ac
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422720
mov eax, dword [0x47ebe4]
cmp word [eax + 2], 0
jne 0x4604ff
mov eax, dword [0x47ebe4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00462018
mov eax, dword [0x47eca8]
cmp word [eax + 2], 0
jne 0x460519
mov eax, dword [0x47eca8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00462224
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41744c]
call fcn.00404218
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41744c]
call fcn.00404218
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41744c]
call fcn.00404218
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x427138]
call fcn.0042e8c4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4606d0
mov eax, dword [0x47eaf0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042ec98
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4628e4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47eaf0]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040db24
test eax, eax
je 0x460620
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409c1c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040db58
test eax, eax
je 0x460634
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00405324
mov byte [ebx + 0xd4], 0
push ebx
push 0x461b60
call fcn.0042389c
mov dword [ebx + 0xc8], eax
mov eax, dword [0x47e9d0]
cmp byte [eax], 0
jne 0x460685
mov eax, ebx
call fcn.00460814
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00462ac0
mov eax, ebx
call fcn.00463620
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4606c5
call fcn.00404604
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460a94
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x482584]
cmp dword [eax + 0x30], 0
je 0x460b3e
cmp dword [ebx + 0x94], 0
jne 0x460b38
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x460a24
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x460b38
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x460afe
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x460b38
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419ce8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x460b0d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x461858
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x46188d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004051a4
jmp 0x46189a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405108
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x462ca4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x462d12
mov eax, esi
call fcn.0044cd74
test al, al
je 0x462d12
mov eax, dword [ebx + 0x84]
call fcn.0044c9d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x462d12
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x462d06
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044c9d4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00444dc0
jmp 0x462d12
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00462ae0
pop esi
pop ebx
ret
Function at 0x472c08
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov eax, dword [ebp - 4]
call fcn.00405568
xor eax, eax
push ebp
push 0x472cb8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405578
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
jne 0x472c97
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueA
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x110]
call fcn.00409e08
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp + 8]
call fcn.00405108
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472cbf
lea eax, [ebp - 0x114]
call fcn.004050b4
lea eax, [ebp - 4]
call fcn.004050b4
ret

Function at 0x47456c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405568
mov eax, dword [ebp - 8]
call fcn.00405568
xor eax, eax
push ebp
push 0x474635
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403728
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov eax, dword [0x47ec88]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.00405578
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
call fcn.00405578
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x47461a
mov eax, dword [0x47ec88]
mov eax, dword [eax]
call fcn.00461d10
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
cmp dword [ebp - 0xc], 0x103
jne 0x47461a
mov eax, dword [0x47ec88]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x4745e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47463c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050d8
ret
Function at 0x421bc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x421be2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421be9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421bd8
mov eax, 1
add ebx, ebx
jne 0x421bfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421bf0
jne 0x421c0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421bf0
xor ecx, ecx
sub eax, 3
jb 0x421c20
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x421c92
mov ebp, eax
add ebx, ebx
jne 0x421c2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x421c38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x421c5c
inc ecx
add ebx, ebx
jne 0x421c48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x421c3d
jne 0x421c59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421c3d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x421c7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x421c6d
jmp 0x421bde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x421c7c
add edi, ecx
jmp 0x421bde
pop esi
mov edi, esi
mov ecx, 0x843
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x421c9a
cmp byte [edi], 0xd
jne 0x421c9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x421c9f
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x421d17
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2293c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x229f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x421ccc
mov ecx, edi
jns 0x421cfb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x229f4]
or eax, eax
je 0x421d11
mov dword [ebx], eax
add ebx, 4
jmp 0x421ce9
call dword [esi + 0x229f8]
popal
jmp section.UPX0
Function at 0x401ea0
Capabilities:
Terminate process

Disassembly:
rol byte [eax], 0x50
aad 0x83
ret 0x6840
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
nop
nop
imul edx, dword [eax - 0x6f966f70], 0xec8b3590
xor eax, 0xec83ec8b
mov bh, 0x53
xor eax, 0xec83ec8b
mov bh, 0x53
push ebp
mov ebp, esp
or byte [edi - 0x75], dl
inc esi
loope 0x401e8d
in al, dx
or al, ch
dec ecx
dec ebx
add byte [eax], al
mov dword [0x410ba0], eax
mov al, 0x15
xor cl, byte [ebx]
inc ecx
add byte [ebx + 0x14466cd8], cl
test eax, eax
mov edi, edx
jne 0x401e5d
mov ebx, 0x6a0448
push 0
push ecx
call 0x62408c70
mov ds, word [esi + 0x85c]
mov dword [esi + 0x5400683c], edi
wait
inc esi
add al, 0xc6
add byte [eax], al
push esp
mov edx, dword [0x4117ec]
cdq
push esi
adc al, 0xa1
pushal
add byte [ecx + 0x60a11456], bl
add al, byte [ecx]
test eax, eax
push ecx
jbe 0x401ef2
jo 0x401f42
inc ecx
add byte [ebx - 0x7637fc36], cl
mov edi, 0x8b2deb48
invalid
mov eax, dword [esi + 4]
mov byte [ebp + 8], cl
add ecx, dword [edi + 0x51]
push edx
push eax
call 0xbf408ac0
test dword [eax - 0x4e7cfa8c], ecx
or ebp, esi
insb byte es:[edi], dx
cmp eax, 0xaf8fa
je 0x401f8a
cmp eax, 0xafcd9
movsd dword es:[edi], dword [esi]
and byte [0xafd57], bh
je 0x401f8a
cmp eax, 0x2db86d
je 0x401f8a
cmp eax, 0x380afca1
je 0x401f8a
cmp eax, 0xb23ea
jne 0xc71fb1
mov eax, dword [ebp + 8]
mov edx, dword [ebx]
mov al, byte [0x847f4102]
cmp eax, 0x4102a4
add ebx, eax
adc edi, 0
mov dword [0xc1bb02a0], ebx
mov dword [0x4102a4], edi
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
add edx, eax
sub ecx, eax
mov dword [esi + 0x18], edx
mov dword [esi + 0x14], ecx
jne 0x54951eac
mov dword [esi + 8], 3
call fcn.00406a00
mov dword [0x410bef], eax
mov dword [0x410ba4], edx
mov edx, dword [esi + 4]
mov dword [esi + 0x341b340], eax
mov esi, edx
jmp 0x401fef
mov edx, esp
hlt

Function at 0x40a580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov esi, dword [edi + sym.imp.MSVCRT.dll_strrchr]
push esi
fmul dword [ebx + 0x2f6a087d]
push edi
scasb al, byte es:[edi]
shr dword [edx + 0x72], cl
add dword [eax + esi*8 - 0x40], ebx
rol dword [ebx - 0x39c4f93c], cl
jbe 0x40a5a3
mov esi, eax
test esi, esi
dec esi
invalid
push 0x3a
push edi
push dword [edx + esi*4 + 0x65c4b232]
test dword [ecx + 0x74], ebp
or dh, byte [ebx + 0x46]
insb byte es:[edi], dx
adc ebx, dword [esi + 0x5b]
or edx, eax
add al, 0
mov eax, edi
pop edi
pop esi
xchg esi, eax
mov ch, 0xc2
add al, 0
nop
push eax
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub dword [ebp + 0x5dcd5318], 0x10
test ebx, ebx
push edi
invalid
Function at 0x401700
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
das
jmp 0x9deb679a
adc ch, byte [edi - 0x7ac697ce]
push ss
xor ch, byte [eax + 0x39]
das
mov byte [esi - 0x7d], dh
adc esp, ecx
jnp 0x4016fd
jnp 0x4016b7
inc eax
mov gs, word [eax]
xchg dword [esi + 0x75], edx
cli
imul esi, ecx, 0xffffff81
rcr byte [ebp + 0x1e], 1
push ecx
pushal
xor esi, dword es:[ecx + ebp*8 - 0x71aa3f5]
pop ds
cdq
int1
jo 0x4016fb

Function at 0x403030
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xb9e0137d], al
cdq
push 0x2e0d9258
xchg edi, eax
imul edx, dword [esi], 0x7249bad1
and eax, 0xc4193929
cld
loop 0x403058
int1
invalid
xchg ecx, eax
invalid

Function at 0x4052f0
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x16
wait
or bh, byte [ebp + 0x7373898f]
mov es, word [edx + 0x44]
inc esp
imul ebp, dword [eax], 0x7a
push 0xcf9c4b26
cmp cl, byte [esi + 0x77]
mov bl, 0x5d
inc esp
cmpsd dword [esi], dword es:[edi]
and byte [edx], ch
or al, 9
mov cl, 0x51
mov ebp, 0x472c9daf
inc edx
push es
cmpsb byte [esi], byte es:[edi]
mov bl, dh
call [edi - 0x56]
mov byte [0xb4ac899c], al
fild dword [eax - 0x67]
xor al, 0xf6
pop edi
xlatb
xchg edx, eax
adc esp, edi
jle 0x405351
in al, 0xac
push ebp
out dx, eax
pop es
test al, 0xed
in al, 0x56
inc esi
xor eax, 0xeff7a172
je 0x4052fb
adc dl, bl
je 0x4053a1
enter 0x3b21, 0xffffffffffffffde
xor esi, dword [edx + 0x5d3d0dd3]
iretd
mov ch, 0x6d
ja 0x405335
jno 0x405329
shr byte [edx + 0x67], cl
push 0x67
stosb byte es:[edi], al
push ss
push esp
mov edx, 0x57921bf
push edx
fcom qword [edi]
xchg ebp, eax
wait
rol byte [edx + 0x49], 0x30
pop ss
push eax
xor al, 0xd0
jnp 0x405356
dec ebp
sbb al, 0x67
lcall 0x4ac4, 0x70625653
aad 0x4c
in eax, dx
pop ds
and eax, 0xdf4650ad
push 0x6f197637
inc eax
xor cl, byte [ecx - 0xc]
and eax, ebp
out 0x92, al
pop ebx
mov cl, 0xb6
into
movsb byte es:[edi], byte [esi]
jo 0x40537c
mov ch, 0xf3
test dword [edx - 0x41], edx
add eax, 0x127d75a5
and eax, 0x2d91686c
inc di
jnp 0x40539c
std
inc eax
jmp 0x5f3bfa05
Function at 0x40cca0
Capabilities:
Encode data using xor

Disassembly:
fisubr word [edx - 0x54]
test dword [eax + 0x3f], ecx
xlatb
fimul word [ecx]
sub al, 0x2a
out 0xc9, al
push edx
fld xword [ebx + edi*2 + 0x2f13879]
jnp 0x40cd1b
cmp cl, dh
invalid
je 0x40cd0b
jnp 0x40cd1b
cmp cl, dh
add dh, byte [esp + 0x61]
popal
stc
push ecx
mov dword [0x6ee38ee5], eax
push ds
and ecx, esp
adc byte [eax], ah
test dword [esi - 0x6f4e40fb], edi
mov edi, 0xbc6966dd
xchg edi, eax
scasb al, byte es:[edi]
sub dword [ebx - 0x21], edi
sbb bl, ah
imul di, word [edi + edx*4 - 0x2084d652], 0xdc1a
xor al, 0xb5
xchg esp, eax
sal byte [edx - 0x6a], cl
loopne 0x40cc90
xchg esp, eax
push ss
cmpsd dword [esi], dword es:[edi]
sbb eax, dword [edx + 0x58]
xor esi, dword [0xcac869b0]
mov dl, 0x5b
cmp al, 0x83
dec esp
lcall 0xf357, 0x5075b77d
retf 0xb514
js 0x40cd40
jne 0x40ccbc
and edi, dword [edi + 0x4748c84]
adc dl, byte [eax - 0x50]
xor cl, ch
movsd dword es:[edi], dword [esi]
test dword [ebp + 0x37], eax
mov ecx, 0xd777888d
mov byte [edi - 0x29], dh
movsd dword es:[edi], dword [esi]
and dl, cl
les ecx, [ebx + 0x59640b7b]
jb 0x40cd9f
out 0x54, eax
mov cs, word [esi + 0x57]
invalid
iretd
pop ebx
and al, 0xb9
lea ecx, [edi]
invalid

Function at 0x40e3d0
Capabilities:
Encode data using xor

Disassembly:
and al, 0x3b
sti
push edi
mov eax, 0x630628ec
nop
jecxz 0x40e3d9
push esp
cmp eax, 0x4588bf6c
rcl byte [eax]
xor dh, byte [edi - 0x3a]
inc ecx
pop eax
fbstp tbyte [ecx]
push ecx
sal dword [edx + 0x1bdd8544], cl
test byte [edi], ch
pcmpgtd mm1, qword [ebx - 0x75]
cmp dword [eax], ecx
invalid

Function at 0x4118a0
Capabilities:
Encode data using xor

Disassembly:
push cs
sub eax, edx
jp 0x4118f4
jmp 0x5ddb7ceb
sub dword [edi + 0x44179758], 0x57
mov ah, 0x34
shl edx, 0xc7
xor ch, byte [0x9a560620]
add dword [eax], ecx
aas
or ch, byte [edi + 0x41905a38]
sbb dl, byte [eax - 0x43eb2a76]
xchg ecx, eax
in al, 0x28
cmc
cmp dword [ecx + ecx + 0x628aaf37], ebx
ja 0x411949
bound esi, qword [edi + 0x27]
push ebp
add eax, 0xa9b7d610
xor byte [edi + 0x3e], bh
loop 0x41191f
xor dh, 0xb8
dec ebx
jae 0x24a7f439
pop ecx
push eax
inc edx
mov cl, 0x7a
cmc
xchg dword [edx], esp
fbld tbyte gs:[esi + 0x5333841f]
ret
sub eax, 0xbb575f82
cmpsd dword [esi], dword es:[edi]
cmp dl, byte [edi - 0x7b]
lodsd eax, dword [esi]
dec esi
sahf
mov eax, dword [0x3cf7d9d1]
jnp 0x4119a9
pop eax
aad 0xad
lodsd eax, dword [esi]
push edi
push ds
outsb dx, byte [esi]
cmp al, 0x37
inc ebx
jl 0x4119be
push edx
or dword [ecx + 5], 0x21
retf
cmp ecx, dword [ecx - 0x62]
add bh, ah
mov dh, 0xc9
add al, 0x62
nop
faddp st(0)
stosd dword es:[edi], eax
jo 0x41195e
sub eax, 0x52cf199a
int1
mov dword [ecx + 0x220eb083], esi
in al, dx
add al, 0xcc
mov dword [0x49afaa05], eax
sub al, 0xed
imul ebx, dword [ebx - 0x6609de1c], 0x8c827524
mov edi, 0xfa043b73
pop es
iretd

Function at 0x416b80
Capabilities:
Encode data using xor

Disassembly:
lock add ebx, dword [esi - 0x72]
mov eax, dword [0x6ac8142b]
push edi
pop ecx
xor ch, byte [edi + 0x24]
inc edx
mov al, byte [0x643721a5]
jno 0x416b36
cmp edi, dword [esp + ecx]
shr byte [esp], 1
jmp 0xe686f02b