joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa0db4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x7c38b118]
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
jle 0xa0dbed
push edi
lea edi, [esi + 8]
mov dword [ebp + 8], ebx
mov eax, dword [esi + 4]
shr eax, 0xb
push 3
and eax, 7
push eax
push edi
call fcn.00a0d9a1
mov eax, dword [esi + 4]
mov ecx, eax
and ecx, 0xfffff800
add ecx, 0x800
xor ecx, eax
and ecx, 0x3800
xor ecx, eax
add esp, 0xc
dec dword [ebp + 8]
mov dword [esi + 4], ecx
jne 0xa0db73
lea edi, [ebx + ebx*4]
shl edi, 1
lea eax, [esi + 0x1c]
push edi
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.009dccda
push 8
pop eax
sub eax, ebx
lea eax, [eax + eax*4]
shl eax, 1
push eax
lea eax, [edi + esi + 0x1c]
push eax
lea eax, [esi + 0x1c]
push eax
call fcn.009dc7ad
push edi
lea eax, [ebp - 0x54]
sub esi, edi
push eax
add esi, 0x6c
push esi
call fcn.009dccda
add esp, 0x24
pop edi
jmp 0xa0dc2b
jge 0xa0dc2b
mov ecx, dword [esi + 4]
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
xor eax, ecx
and eax, 0x3800
xor eax, ecx
mov dword [esi + 4], eax
shr eax, 0xb
and eax, 7
push 0
push eax
lea eax, [esi + 8]
push eax
call fcn.00a0d9a1
lea eax, [esi + 0x1c]
push 0x46
push eax
add esi, 0x26
push esi
call fcn.009dc7ad
add esp, 0x18
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.009db90c
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x2aa1829
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..text_1
mov ebx, 0x4304d8
nop
mov ecx, 0x33344a89
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x41136c
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
jl 0x41139b
pop es
popal
mov eax, dword [0xe3125d17]
mov eax, 0xc84af463
imul esi, esp, 7
xchg ebp, eax
xor bh, byte [eax + 0x50bcafc2]
not ebp
invalid
hlt
in al, dx
mov dword [0x3df9976b], eax
lcall 0xf2ae, 0xb1367644
push edi
adc bl, dl
and al, 0x1a
jo 0x4113ab
dec ecx
push ebp
mov al, byte [0xaac82cac]
xchg cl, ah
jb 0x41131c
in al, 0xbe
pop es
mov al, byte [0x4160e2ad]
mov ecx, 0x368af93b
jns 0x4113b6
in al, 0xfd
std
dec esp
jnp 0x411327
enter 0x3d30, 0xffffffffffffffcf
jnp 0x411381
push ds
cmp dword [edx], ecx
bound esp, qword [ecx + 9]
cmp al, 0xcc
mov ah, 0xa2
test dword [0x50aa7bc3], 0xb59a0745
mov esi, 0x587b43a
pop es
lcall 0x587, 0xb43abeb5
shl byte [ebp + 0x7f566c2e], cl
xor eax, 0x5994bc31
mov esi, 0x24a0c06e
add dword [ecx - 0x48], 0xffffffed
sub byte [ebp + 0x23], al
invalid

Function at 0x416ad1
Capabilities:
Encode data using xor

Disassembly:
pop es
imul dword [ebx - 0x6be7f1a]
pop ebx
pop ss
enter 0x6e5a, 0xffffffffffffff9b
xor ah, byte [esi]
mov word [esi + 0x2801497f], es
das
push ss
sbb al, 0xc8
xor dword [esp + eax*2], 0x52
sti
ja 0x416ae0
mov dh, 0x3f
int1
lea ebx, [edx + ecx*4]
xchg dword [eax], esp
xchg esp, eax
shl dh, 1
mov gs, word [edx - 0x2d2a606f]
stosb byte es:[edi], al
xchg ecx, eax
lahf
aad 0xd2
jnp 0x416b62
enter 0x562d, 0x27
call 0xe0f4aa11
clc
clc
inc ecx
sal byte [ecx + 0x23], 1
mov bh, 7
mov dh, 0x72
stosd dword es:[edi], eax
mov word [edx - 0x416f8ec3], gs
mov dh, 0xc9
jle 0x416afe
retf
mov ch, 0x2d
invalid
Function at 0x4176c5
Capabilities:
Encode data using xor

Disassembly:
push 0xf54d09c6
push es
rol edi, cl
or eax, 0x30cacde6
nop
adc al, 0x8c
leave
mov ebx, 0x7f91a658
or edx, dword [ebx]
mov ebp, 0x440c0853
push ebp
pop ss
movsb byte es:[edi], byte [esi]
mov ch, 0x95
dec ebp
aaa
jne 0x41768d
push ecx
test dword [ebx + 0x44690488], esi
stosb byte es:[edi], al
push ss
mov ecx, 0x99c62a1a
or dword [ecx], ebx
movsb byte es:[edi], byte [esi]
xor bl, cl
stosd dword es:[edi], eax
dec eax
jp 0x417662
pop es
mov bl, 0xfc
retf 0x9ffd
jne 0x417608
sub dword [ecx - 0x4c], ebp
pop edi
jns 0x417634
pop ecx
cmpsd dword [esi], dword es:[edi]
or al, 0x22
mov dh, 0x73
inc esp
jp 0x417634
clc
pop ss
test dword [edx + 0x6a7f3625], esi
mov dl, 0x25
jg 0x4176d1
adc byte [ebx + 0x74d9a3f1], ch
lcall 0x91c, 0xe889118d
outsd dx, dword [esi]
into
jp 0x4175fb
lds ecx, [edi - 0x2e37f728]
mov ebx, 0x8c1fb109
adc al, 0x8a
mov bl, byte [eax - 0x24]
xor ebx, dword [ebx + ebx*8]
ror dword [eax - 0x77b5685a], cl
xchg edi, eax
dec edx
mov byte [ecx + 0x5d], cl
dec ecx
pop ebp
outsb dx, byte [esi]
sub al, 0x66
fmul dword [esi + 0x1c]
adc dword [edi + 0x431a8a92], edi
cwde
push cs
out dx, eax
std
sti
push esi
or eax, 0x92fab9f3
sbb bl, dh
cdq
sub byte [edi], al
clc
je 0x41764e
out 0xd6, eax
sbb dl, byte [edx]
popal
call 0x3723eaa5
and al, 8
outsb dx, byte [esi]
popfd
push ebp
push esp
lahf
mov dl, 0x81
pushal
sbb eax, 0x1cfc4707
push ds
cld
sbb al, 0x1e
xor esi, dword [edx + 0xb6cbd6f]
mov byte [0x7f4fa276], al
or esp, dword [edx + 0x7f4fa276]
xor ebp, dword [ecx - 0x7a0b2d7d]
mov word [ebx - 0x747507c9], es
stosb byte es:[edi], al
cdq
or byte [edx - 0x50f7eea1], bl
fmul st(2)
loopne 0x4176c9
outsd dx, dword [esi]
pop edx
pushal
call 0x393719ff
mov edx, dword [ebx + 0x62]
pop esi
leave
aam 0x57
jle 0x417690
invalid

Function at 0x41fbc4
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
xor al, 0xa7
sbb dword [ecx], edx
and al, 0x24
inc edx
mov bl, 0x72
jecxz 0x41fb5b
or eax, ecx
sub dword [edi - 0x75f66f27], esp
inc esi
pop es
xor eax, 0x899ca75
cmp dword [ebp - 0x77], ecx
rol dword fs:[eax], 1
test al, 0x88
pop eax
add dword [ebx], edx
push 0x1a52035
sar byte [eax], 1
inc edi
pushal
clc
adc ah, al
int3
Function at 0x4201e1
Capabilities:
Encode data using xor

Disassembly:
salc
mov dword [0x62e9e9bb], eax
shl dword [eax - 0x4433f6af], 6
sbb esp, dword [eax]
shl byte [ecx - 0x4fefb6fa], 0xe8
fild word [eax - 0x613b9781]
mov al, 0xde
xchg ebx, eax
pushal
arpl word [ebp + edi*4 + 0x1f], cx
mov bl, 0x30
cdq
stc
push ebx
je 0x420282
cmp ebp, dword [ecx + 0xae170c8]
shr byte [0x5a6244f8], cl
les edx, [ecx - 0x7e5eb73b]
pop ebp
pop ds
fistp dword [ebx]
imul ecx, dword [ecx], 0x73
int 0x76
test eax, 0x1b108610
xor al, 0xa1
sahf
mov ebx, 0x4bc1afd6
cld
aam 0xa2
mov bl, 0xe
and dword [eax], edx
jp 0x420258
rcl ebp, 0x60
enter 0x4b5b, 0xffffffffffffffc5
add esp, dword [ecx - 0x4483e617]
mov eax, dword [0xbb7c19e9]
mov ah, 0xe1
cmp ecx, esi
fistp dword [0x7e1dd0]
invalid
fstp xword [ebx - 0x3a0fbe3c]
or al, 0x2a
sub dword [ebx], 0xc26120f0
outsd dx, dword [esi]
stc
and al, 0xf8
sub eax, 0xad2116e1
mov edx, 0x71fdfa0
add bp, word [edi]
nop
and ebx, 0x7e30e7bf
mov ebp, 0xcf03c941
leave
add ecx, edi
imul esi, eax, 0xffffffa8
mov dl, 0xcd
sbb eax, 0x23f12afd
and byte [ebp - 0x4d4f9a1b], cl
jecxz 0x420245
mov al, byte [0xe89bdd3c]
pop eax
mov cl, 0xd5
aas
mov byte [0x22c89ceb], al
dec edx
mov dword [0xdf01e13e], eax
cmp eax, 0xf13dea67
wait
sal dword [ebp - 0x10], 0x12
mov ch, 0x1e
mov byte [eax + 0x2f], ah
fnstenv [eax - 0x6bbc2a30]
adc ah, byte [eax + 0x2d]
sub edi, dword [eax + 0x5113ac01]
mov word [ebx + 0x662bb25c], es
popal
adc eax, 0x1022e9bc
inc edi
and esp, dword ds:[ecx - 0x6b]
xor dword [esi - 0x5f2e38b3], eax
test eax, 0x343d2eb1
add dword [ebx - 0x6dd02c0f], 0x8190f721
sbb byte [0xce78b2cf], al
push ebp
or al, 0xb4
imul eax, dword [0xb88601ef], 0x391c5ca7
cmpsd dword [esi], dword es:[edi]
invalid

Function at 0x421d84
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
retf 0x998e
add al, 0x92
loope 0x421dc7
shl dword [edx], 1
xchg ebp, eax
xchg edi, eax
xchg esp, eax
adc ch, byte [esp + edi - 0x719a6c8f]
add dl, cl
push edi
push esp
jne 0x421cee
and eax, 0xcdc995cc
push edx
hlt
dec esi
nop
sub al, 0x7f
dec esp
loop 0x421d4f
and al, 0x19
cmp eax, 0x99384f5c
imul byte [edx]
push ss
ljmp 0xe552
aad 0x42
mov esi, 0xe780e552
in al, 4
rep movsd dword es:[edi], dword [esi]
dec eax
xchg edx, eax
mov dh, 0x72
add eax, ebp
inc edi
lds esi, [edx + 0xe]
invalid

Function at 0x426693
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0xdd
xor al, 0xde
fnstsw word [esi]
xor al, 0xde
wait
lds eax, [edi - 0x25216d0d]
inc edx
wait
xchg byte [ecx], cl
shl byte [esi + esi*4], 0x38
xchg ebp, eax
cmp eax, 0xc36fb516
and esi, dword [esi + 0x3dfe0a24]
out 0xc3, eax
inc edx
div dword [esi - 0x39]
mov dl, 0x64
mov dword [0x686d0f2a], eax
lcall 0xdab6, 0x8666263b
fisubr word [edx + 0x2e6dee65]
aam 0xad
pop eax
xchg dword [eax + 0x7ae3b499], edx
wait
inc ebp
add ecx, edx
dec eax
mov dword [eax + 0x12], 0x547b0064
xchg ebx, eax
lds edx, [ecx + 0x5b]
lodsb al, byte [esi]
jns 0x426694
or edi, dword [ecx - 0x25]
sub dword [ebp - 0x74a21b8], ebx
arpl word [edx - 0x6ad1bf90], ax
pop esi
sub esi, ecx
sbb eax, 0x7babae5c
mov al, al
adc ebx, dword [edx]
jmp 0x41c5e21c
Function at 0x43c74d
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x77
xor dword [0x13e8bcd8], 0x9b1ed5da
adc ebx, edx
aad 0x1e
wait
adc ebx, edx
aad 0x1e
wait
xchg edx, eax
mov ebx, 0x96cf779e
adc al, 0x1a
add bh, byte [ebp - 0x28]
aam 0xdf
ror dword [edi], 1
cld
popal
pop eax
paddb mm4, qword [ecx + 0x58]
sbb al, 0xa8
jo 0x43c746
push 0x36e8c79e
rcr dword [ebx - 0x4f83decb], 1
mov esi, 0x2c4fbfb6
pop es
out 0xda, eax
invalid

Function at 0x43d338
Capabilities:
Encode data using xor

Disassembly:
in al, 0x2c
jecxz 0x43d33e
movsb byte es:[edi], byte [esi]
mov cl, 0x8f
mov dword [0xd534ae9a], eax
dec eax
in al, 0x31
daa
sal byte [edx + esi*2], 1
jp 0x43d38e
in al, dx
outsb dx, byte [esi]
and al, 0x80
xchg esp, eax
stc
sbb byte [esi - 0x1a8c1511], cl
push es
aam 0x4e
add edx, ecx
iretd
pop edi
jae 0x43d30f
pushfd
pop ds
xor al, 0x12
rcr byte es:[esi], cl
adc ah, byte [esi]
rcr byte [esi], cl
stosd dword es:[edi], eax
outsd dx, dword gs:[esi]
daa
imul ebp, dword [ebx], 0x42
mov dword [0xcbdfc19d], eax
push edx
pop ss
shr eax, cl
sub al, 0x24
fidivr dword [esi]
pop dword es:[ecx - 0x7d]
cli
daa
sub eax, 0xdb4400b4
xor ah, byte [ebp - 0x2b09cf6a]
fst qword [eax - 0x362251d9]
jns 0x43d345
lodsd eax, dword fs:[esi]
mov al, 0x3b
mov ah, 0xba
test esp, edx
or al, 0xa0
int3
lds edx, [ebp + 0x5ae755c1]
sub eax, 0x311acefd
test al, 0x45
mov edi, 0x227126e7
add al, 0x10
push cs
insd dword es:[edi], dx
mov dword [ebp + 0x602deb04], esi
cwde
cmc
mov dl, byte [esp + ecx*2 + 0x679dd933]
inc edi
imul eax, dword [eax + 7], 0x16
xor dword [edx - 0x17], ecx
mov edx, 0x69404364
push 0xea42614b
stosd dword es:[edi], eax
mov edi, 0x32f78521
fbstp tbyte [edi + 0x1656643a]
dec esp
add al, 0x46
jge 0x43d373
dec ebp
mov esp, ebx
push ebx
ja 0x43d383
add byte [ebx + 0x2d], ch
jmp 0xa1cc40e5
Function at 0x45bc59
Capabilities:
Encode data using xor

Disassembly:
and byte [eax], bh
push edx
pop edi
add bh, byte [esi]
inc edi
lcall 0xcc49, 0xfcb06636
inc edx
jl 0x45bb4e
mov al, 0xfc
dec ecx
int3
xor dword [eax + 0x1ad5c88], ebx
std
lodsd eax, dword [esi]
add ebp, edi
sbb dh, byte gs:[edx - 0x20aba5ea]
mov ecx, 0x7f847d04
mov dl, 0x16
pop edx
push esp
fistp qword [ecx + 0x7f847d04]
test eax, 0xb4882c1b
jmp 0x45bafb
jge 0x45bb16
enter 0x4ef0, 9
fcomi st(0)
jae 0x45bb42
invalid
jle 0x45bb3e
stosb byte es:[edi], al
retf 0xfe6d
invalid
jne 0x45bb95
and dh, byte [ebp - 0x6f]
jne 0x45bb06
das
inc ecx
push es
cld
dec ebp
jb 0x45bb11
xlatb
js 0x45bbc8
fadd dword [esi - 0x4b818c04]
outsd dx, dword [esi]
cld
mov dh, 0x2f
adc eax, 0x902e6ca7
jb 0x45bbc2
jge 0x45bb40
jns 0x45bb71
fld xword [0x5df0fb8d]
sub eax, 0x5df0fb8d
popfd
inc ebx
mov dl, 0xc3
jg 0x45bbb4
insd dword es:[edi], dx
xor esi, dword [esi - 0x777c0fed]
rcr dword [edi + edi*8], 0xad
and byte [esi], ah
push edx
or dh, byte [edx - 0xca24e12]
jge 0x45bbee
jge 0x45bbee
xor dword fs:[edx + 0x54], ebp
jge 0x45bc29
xor eax, 0x12b451f0
stc
or al, 0x74
enter 0x7bb4, 0xffffffffffffffc9
leave
xor edi, dword [eax]
int 0xb3
ja 0x45bb72
or ebx, dword [0x883a81fc]
fstp dword [0x4275e3f9]
adc eax, 0x823d75dd
stosd dword es:[edi], eax
std
test byte [eax - 0x28], bl
xchg esp, eax
cwde
lodsd eax, dword [esi]
wait
aam 0x36
and ebx, 0x76
adc ch, byte [ecx + 0xdf7706e]
aaa
push ds
scasd eax, dword es:[edi]
sub eax, 0xc8f74271
adc eax, 0x7b246c61
cmp dword [ebp + 0x4be9a83a], edx
pushal
shr byte [ebp - 0x3d], cl
scasb al, byte es:[edi]
lahf
xchg byte [esp + edi*8 + 0x1c879871], cl
jb 0x45bc41
invalid
jno 0x45bbac
xchg dword [edx + esi*2], ebx
sub dword [ebp + 0x5c], ebp
insd dword es:[edi], dx
pop esp
lea ebx, [ebx - 0x2b]
adc byte [0xf863484a], al
invalid
invalid
sar dword [edi + 0x7967de90], 0x54
jecxz 0x45bc12
je 0x45bcaf
pushfd
add edx, dword [eax + 0x72]
call dword [eax]
sbb dword [eax], ecx
sbb dword [edx], edi
dec ebp
imul dword [0x6976fc91]
sar esp, 1
sub al, byte [edx - 0x7c4c849d]
or dword [0x621d999d], 0x52
or dword [0x621d999d], 0x52
rcr dword [ebp - 0x5202472], 0xad
loopne fcn.0045bcd8
jl 0x45bc97
insd dword es:[edi], dx
invalid
Function at 0x45c02e
Capabilities:
Packed with generic packer

Disassembly:
xor dword [ebp - 0x30], edi
invalid
mov byte [0xfecabea3], al
cli
add al, 0x55
sal dword [ecx], 1
movsd dword es:[edi], dword [esi]
or byte [esi - 0x9dab405], 0xbb
popal
mov cl, 0xa3
jmp 0x45c0b9
xor dword [ebp + 0x4bfb8e80], esp
and eax, 0xb161bbf6
mov dword [0x69a874eb], eax
ja 0x45c009
xchg ch, cl
jnp 0x45c0ac
leave
mov bh, 0xef
ljmp 0xbb64
jnp 0x45c037
mov ebx, 0x9b7ef404
xchg dword [eax + edi*4 + 0x5f], ecx
dec esi
cmp dword [edx], edx
adc eax, 0x1b2068f4
sahf
pop esp
hlt
pop eax
out dx, al
ror byte [edi], cl
mov edx, 0xe1314f3b
mov edi, 0xd1d4bdd1
aam 0xd1
xchg edi, eax
push ss
and esp, dword [edi + ebp*2]
jno 0x45c054
mov edi, 0x7ad69315
or eax, 0x2ed934f8
mov word [eax], ss
cmc
insb byte es:[edi], dx
pop edx
loop 0x45c11e
call 0xd2a7600d
dec eax
movsd dword es:[edi], dword [esi]
pop es
jecxz 0x45c11a
and dword [edi], 0xffffffd2
cwde
mov byte gs:[esi + ebp*8 + 0x3c], ah
test al, 0x1d
popfd
cmp al, cl
and byte [edx + 0x154cbb14], ch
hlt
and al, 4
and al, 0x10

Function at 0x45c102
Capabilities:
Packed with generic packer

Disassembly:
fisub dword [eax + ecx + 0x1e]
out dx, eax
mov ecx, dword [eax]
mov edx, dword [ebx]
mov dword [esp], ecx
mov dword [esp + 0xc], edx
mov ecx, dword [eax + 4]
mov edx, dword [ebx + 4]
mov dword [esp + 4], ecx
mov dword [esp + 0x10], edx
mov ecx, dword [eax + 8]
mov edx, dword [ebx + 8]
mov dword [esp + 8], ecx
mov dword [esp + 0x14], edx
mov ebp, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
xor ecx, ecx
movq mm5, qword [esp + 0x4c]
movq mm4, qword [esp + 0x54]
cvtpi2ps xmm6, mm5
cvtpi2ps xmm7, mm4
movd mm6, dword [esp + 0x34]
and al, 0x34

Function at 0x45c14b
Capabilities:
Packed with generic packer

Disassembly:
and al, 0x34
movd mm7, dword [esp + 0x38]
movss xmm0, dword [ebp]
movss xmm1, dword [edx]
unpcklps xmm0, xmm1
add edx, 4
cvtps2pi mm0, xmm0
add ebp, 4
movaps xmm2, xmm0
movlhps xmm2, xmm7
movlhps xmm6, xmm0
cmpltps xmm2, xmm6
movmskps eax, xmm2
cmp eax, 0
jne 0x45c1c7
movq mm1, mm0
bswap esp
int3
jne 0x45c1ab
push edi
mov edi, dword [ebp + 0xc]
jmp fcn.0063463d
add byte [eax], al
inc ebx
push esi
and byte [eax], ah
das
and dh, dl
pop fs
insd dword es:[edi], dx
push es
arpl word [edx + 0x21], dx
test eax, edi
xor ebx, dword [edi]
add edi, dword [ebx]
or bh, 0x1e
cmp eax, 0x16165bd9
pop ebx
push ss
push ss
sbb al, 0x80
sti
xor byte [edi], al
and ebp, ecx
and esp, edx
dec esp
pushal
cdq
adc ecx, edi
cmpsb byte [esi], byte es:[edi]
lea eax, [edx - 0x5b]
sub bh, byte [ebx - 0x2c2c77f0]
inc eax
fcomp st(6)
popal
das
jecxz 0x45c199
dec ebx
jmp 0x45c1d4
Function at 0x468664
Capabilities:
Encode data using xor

Disassembly:
add al, 0xba
cmc
not ah
stosd dword es:[edi], eax
aam 0x8a
jne 0x468618
xor dword [eax - 0x75], ebp
adc al, 0xba
and eax, 0x15fbf087
nop
jne 0x46863d
push 0x25ba148b
xchg eax, esi
sti
adc eax, 0x8c4a7590
xchg edx, eax
test eax, 0x29074fa
das
mov word [edx - 0x6f8b0557], ss
add ch, byte [edi]
or dword [edx - 0xccbc430], ecx
mov dh, byte [esi + 0x2b045934]
insd dword es:[edi], dx
fmul st(5)
cmp bh, bl
hlt
ret
jbe 0x4685e6
jb 0x4685dd
pop es
arpl word [ecx + 0x2d], di
int 0xfb
pushal
arpl bp, si
xor dl, byte [ebp - 0xc]
jnp 0x4686a0
fldenv [edi + 0x51]
inc eax
out dx, eax
cld
sti
je 0x468650
inc esi
sti
xor al, 0xfc
xchg ecx, eax
lgs ebp, [ebp - 0x77c32bb9]
mov byte [esi], al
mov byte [esi], al
sahf
xor eax, 0xbcb3c5b
les ecx, [edi]
sub al, 0xc5
sti
adc eax, 0x54bb77f2
faddp st(2)
fiadd word [edi*2 - 0x641b14a3]
test byte [ecx - 0x5bdd619b], dl
jg 0x468642
stosd dword es:[edi], eax
add ch, byte [ebx + 0x24]
mov bl, 6
push cs
test byte [ecx], al
imul ecx, dword [edi], 0x1b1d5a19
push ss
jb 0x468716
or esp, dword [edx + 0x1dab5e21]
add eax, 0x6424d8b2
mov dl, 0xd8
and al, 0x64
jge 0x4686a6
mov ebx, 0xab598786
loop 0x46863d
add al, 0x1d
mov cl, 0x4e
inc eax
test al, bh
shl dword [ebx + ebx*8 + 0x1d], cl
test eax, 0xeb212b1e
adc al, 0xef
scasb al, byte es:[edi]
mov al, 0xb4
xor byte [ebx + edi*8 - 0x99f5b49], cl
dec ebx
invalid
out 0x88, al
loopne 0x4686b4
enter 0xfffffffffffff0eb, 0x45
push es
push 0x5c5fc1bf
sbb ebx, dword [eax + 0x5e2158d2]
invalid
Function at 0x469bed
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x2bb5db3f
add al, 0xad
imul ebx, esi, 0xffffffdb
jae 0x469be6
inc esi
sbb byte [edi], 0x77
xchg esp, eax
imul ecx, dword [ebx + 0x364107e8], 0xed240e43
xor byte [ebp*8 - 0x2a63f02c], ch
xor al, 0x61
sub dword [ebx], esp
je 0x469c49
or al, byte [ebx]
pop ecx
into
stosb byte es:[edi], al
lodsd eax, dword [esi]
push ecx
push ebx
push ebp
pushfd
insb byte es:[edi], dx
cmp ch, bl
fnstsw word [esi]
in al, 0x53
leave
aaa
setp byte [0x1dc1f2e7]
cmp al, 0xb1
jl 0x469cab
popfd
xchg ebx, eax
or byte [eax], cl
xor esp, edx
sub ebp, esp
leave
inc ebx
imul byte [eax]
push ss
mov eax, dword [0x5ac872ad]
adc al, 0x8d
enter 0x145a, 0xffffffffffffff8d
xor ebp, ebp
xor ah, byte [eax]
dec edx
dec eax
sub byte [ebx], bl
movsb byte es:[edi], byte [esi]
cmp al, 0x2f
mov ebx, 0x893a0c73
xchg dword [eax], ecx
pop edx
adc ah, cl
aaa
push 0x53cafdf2
loope 0x469c90
push eax
dec ecx
sbb ecx, ebx
lcall 0xb170, 0x3ac87c33
cmp dh, byte [eax - 0x4f]
pop es
xor al, byte [eax - 0x43d010c7]
mov bl, cl
push es
xchg esp, eax
sbb eax, 0x549b36f8
push esp
xor edi, dword [edi + 0x5b]
xchg ebx, eax
scasb al, byte es:[edi]
xor eax, dword [eax + 0x1878e4cf]
arpl word ds:[ebx - 0x14392be1], cx
in al, 0x78
sbb byte [esi], bh
arpl word [ebx - 0x14392be1], cx
and eax, 0xf275331c
daa
cmpsb byte [esi], byte es:[edi]
daa
mov esi, dword [ecx]
sti
inc edi
fcmovbe st(0), st(3)
sbb dword [eax + ebp + 0x1d], esp
insd dword es:[edi], dx
insd dword es:[edi], dx
rol dword [esi + 0x41], cl
push cs
pushal
add ebp, dword [ebp - 0x743fa8f4]
jnp 0x469ca2
mov bh, 0x34
dec ecx
pop edx
xor bh, bl
xor al, 0x70
mov bh, 0xa2
jp 0x469c67
cmp bh, byte [ebx - 0x1a]
and dl, byte [ebx - 0xd]
cld
mov esi, edx
mov bh, byte [ebp + 0x1137769]
daa
mov eax, edx
lahf
pop esp
add eax, 0x917067e7
imul eax, dword [esi - 0x46e1f7b6], 0x7a93fcac
mov dl, 0x14
inc esi
mov ecx, 0x531a15ac
xor eax, 0xf110960f
adc al, 0xee
mov dh, 0x3a
cmp al, 0x72
jbe 0x469d14
xchg ebx, eax
push edx
cmp edx, esi
sub byte [ebp - 0x57], dh
push ss
call 0x6c118357
retf

Function at 0x4729fb
Capabilities:
Encode data using xor

Disassembly:
out 0xc6, al
pop edi
stosb byte es:[edi], al
mov ch, 0x62
sub bp, word [eax - 0x1aa3a9ed]
xchg esp, eax
inc eax
xchg ecx, eax
dec edi
xchg ecx, eax
and ebx, edi
inc ebp
subps xmm6, xmmword [ecx]
movsb byte es:[edi], byte [esi]
mov dl, dh
dec eax
mov al, byte [0x996a2b03]
xor dword [edx + ecx*4 + 0x3a048d6], esp
sub ebp, dword [edx - 0x67]
jp 0x472a13
sahf
mov ecx, 0xac4ee54
int3

Function at 0x47bb6e
Capabilities:
Encode data using xor

Disassembly:
aas
pop edi
inc bp
wait
jmp 0x95385c73
inc edx
sbb dl, byte [esi + edx*2 + 1]
xchg ebp, eax
push ebp
xchg esi, eax
sahf
adc eax, 0x7ad49e19
and esp, dword [eax]
jae 0x47bb23
sti
add al, 0xf4
adc ebx, dword [esi - 0x750e60ef]
invalid
lahf
int1
invalid
adc dword [edi + 0x1b238af1], ebx
and ebx, dword [ebx]
xchg esi, eax
mov edi, 0xdf75e031
push ss
jns 0x47bb56
mov ecx, dword [esi]
jle 0x47bb72
invalid
Function at 0x48a5bf
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0xbc2ade48
inc esp
mov dword [ecx - 0x6a94858f], edx
sub ah, byte [eax + 0x6c7aeed9]
jne 0x48a616
clc
call 0x21d159e0
stosd dword es:[edi], eax
mov dword [0xd52d2b6a], eax
adc byte [ecx], cl
jae 0x48a61c
insb byte es:[edi], dx
sbb dword [edx + ecx*4 - 0x7ef7a827], ebx
xor byte [edi - 0x7b1d9922], 0xd0
loop 0x48a5eb
ljmp 0x2a11:0x95a714c9
mov ebp, 0xb8c0420d
inc edi
loop 0x48a671
mov word [ecx], fs
sub ch, bl
sub ebx, dword [ebx]
sub dh, byte [ebp - 0x65]
wait
jl 0x48a638
push 0x5841ca43
mov eax, dword [0xe99ccda0]
push edx
in al, 0x1b
dec edi
imul esi, dword [esi + 0x30], 0xffffffb6
cmp eax, 0x7aae1919
sahf
or ecx, dword [ebx]
mov edx, dword [eax - 0x4bf3a362]
fbld tbyte [ebp - 0x5e]
sub byte [ecx - 0x40b5af96], 0xab
jo 0x48a698
insb byte es:[edi], dx
pop ebx
jo 0x48a60c
pop ds
imul esp, dword [esi + 1], 0x4c
cmp byte [ecx + ebx*2 + 0x42], 0xd1
test dword [eax], eax
clc
add dword [ecx], eax
inc esp
mov dh, 0x9a
mov eax, dword [0x6bacf3e0]
jns 0x48a660
in al, 0xb5
mov edi, edi
mov ebp, ebp
mov ecx, ecx
leave
mov edi, edi
add byte [esi + 0x57], dl
jmp fcn.0057de42