joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463ba4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x5c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x463bfe
push 0x46
push 0x401c0e5
push 6
call fcn.004aa009
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x463c15
mov eax, 0x4f8ef2
jmp 0x463cf8
fild dword [ebp - 8]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fmul qword [0x4c87ad]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x4c87ad]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.00401d32
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.004ab510
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x463c6c
push ebx
call fcn.004aa003
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
fild dword [ebp - 8]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x4c84af]
fstp qword [ebp - 0x1c]
mov dword [ebp - 0x20], esp
fld qword [ebp - 0x1c]
call fcn.00401d32
push eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x463c98
add eax, 8
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x463cc2
push 0x165
push 0x401c0e5
push 6
call fcn.004aa009
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x463cd9
mov eax, 0x4f8ef2
jmp 0x463cf8
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x463cf3
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004a9ffd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x463cf8
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x463d09
push ebx
call fcn.004aa003
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x48024b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x48026e
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x480346
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x480369
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x480522
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x480545
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4837f1
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x20
push 1
mov ebx, 0x1bc
call fcn.004ab510
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x483852
push ebx
call fcn.004aa003
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00403916
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x483890
push 0xc9
push 0x401a531
push 6
call fcn.004aa009
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4839c9
push edi
push edx
push esi
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov edx, ecx
mov edi, dword [ebp - 4]
mov esi, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edx
pop edi
push 0x80000301
add eax, dword [eax]
sub byte [edx], 0x68
add al, 0
add byte [eax], al
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.004ad0a0
add esp, 0x1c
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0x80000301
push 0
push 3
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x48391f
mov eax, 0x4c8201
push eax
push 3
mov ebx, 0x19c
call fcn.004ab890
add esp, 0x28
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x48394b
push ebx
call fcn.004aa003
add esp, 4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp ecx, 0x80000101
jne 0x483963
and eax, 0xff
jmp 0x4839b8
cmp ecx, 0x80000201
jne 0x48396e
cwde
jmp 0x4839b8
cmp ecx, 0x80000301
je 0x4839b8
cmp ecx, 0x80000401
je 0x4839b8
mov dword [ebp - 0x24], eax
cmp ecx, 0x80000501
je 0x4839a8
cmp ecx, 0x80000601
je 0x4839ad
push 0x366
push 0x401a531
push 2
call fcn.004aa009
add esp, 0xc
fld dword [ebp - 0x24]
jmp 0x4839b3
mov dword [ebp - 0x20], edx
fld qword [ebp - 0x24]
call fcn.00401d32
push eax
call fcn.004839eb
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
jmp 0x4839d3
mov eax, 0x4c8200
jmp 0x4839d3
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4839e4
push ebx
call fcn.004aa003
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4ab420
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x4ab42d
xor eax, eax
pop esi
ret
push esi
call fcn.004ae970
add esp, 4
test eax, eax
jne 0x4ab43c
pop esi
ret
cmp eax, 1
jne 0x4ab44a
cmp byte [esi], 0x5c
jne 0x4ab44a
xor eax, eax
pop esi
ret
push esi
call fcn.004ab1d0
add esp, 4
test eax, eax
je 0x4ab45e
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x4aba30
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x4aba71.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x4aba71.2
jmp dword [eax*4 + 0x4abafc]
mov word [esp + 0x48], di
jmp 0x4abaaa
mov word [esp + 0x48], 2
jmp 0x4abaaa
mov word [esp + 0x48], 3
jmp 0x4abaaa
mov word [esp + 0x48], 4
jmp 0x4abaaa
mov word [esp + 0x48], 7
jmp 0x4abaaa
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x4abaf4
cmp dword [esp + 0x70], edi
je 0x4abae0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x4ac4c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4ac4de
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4ac4d3
pop esi
ret

Function at 0x4ae0b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4ae142
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x4ae134
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4ae12c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4ae0f5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x4ae150
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.004afc20
mov edi, dword [esp + 0x28]
mov ebp, eax
push edi
xor esi, esi
call fcn.004ae970
add esp, 8
test ebp, ebp
je 0x4ae219
test eax, eax
je 0x4ae219
inc eax
push ebx
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4ae1bb
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ae1f5
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4ae208
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x4aea50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x4aea71
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x4aeacb
inc edi
cmp edi, esi
jl 0x4aea65
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x4aeb00
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x4aeaba
cmp byte [eax], bl
je 0x4aead5
cmp byte [eax + 1], bl
je 0x4aeade
cmp byte [eax + 2], bl
je 0x4aeae8
cmp byte [eax + 3], bl
je 0x4aeaf4
add eax, 4
cmp eax, edi
jb 0x4aea91
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x4ba500
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x50374c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4ba513
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4ba554
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x5037f4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4ba586
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4ba58a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4ba57b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4ba5a8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4ba5ac
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4ba59d
xor ecx, ecx
mov eax, 0x50375c
xor ebx, ebx
mov bl, byte [ecx + 0x503804]
cmp byte [esp + ebx + 0x14], 0
je 0x4ba5d7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x50381c]
cmp byte [esp + ebx + 0x14], 0
je 0x4ba5ee
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4ba5be
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4ba547
lea edx, [esp + 0x84]
push edx
call fcn.004ba630
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x57339d
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + 0xc]
mov ecx, 0x2bee5958
call fcn.007cc1da
xadd byte [edx + 0x413b7634], dl
mov cl, 0x34
cwde
sub ebp, eax
das
mov fs, word [0x92c00f00]
xor al, 0x76
cmp eax, dword [ecx - 0x4f]
xor al, 0x98
out dx, al
add esp, dword [edx - 0x35]
ja 0x5733a5
add dword [edx + 0x47e3f134], eax
or bl, 0xf2
mov dword [0x58cb2b64], eax
invalid

Function at 0x5cabdb
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, 0x152618ad
movzx bx, bl
pushfd
add dword [esp + 8], 0xffbb9c8e
push ebx
mov dword [esp + 0xc], 0x8979ede1
movsx ebx, byte [esp]
xor ebx, dword [esp]
xor dword [esp], 0x12cb0c35
test dword [esp], ebx
setne byte [esp]
jb 0x5cabe6
mov ebx, dword [esp + 8]
and word [esp], 0x59a4
xor byte [esp], 0x9b
call fcn.006f5f98
lea edi, [edi + 4]
xor eax, ebx
jmp loc.00409d66

Function at 0x62a705
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x31ba0d20
not edi
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0x3ddfca03
call fcn.00672ce7
push ebx
call fcn.0074ded1
pop edi
ja 0x62a71d
mov ebx, 0xbb90a88d
test al, 0x2b
pop dword [eax + 0xb2aa80e]
push esp
fcom qword [esi + 0x6b]
xchg dh, bl
arpl word [edi + 0xb], dx
scasd eax, dword es:[edi]
push edx
cmp al, 0x57
sti
xchg edx, eax
xor ch, byte [edi - 0x57]
inc esi
fiadd word [edx]
cli
test al, 0xe4
mov al, byte [0x6b57e7ec]
salc
sub dword [ebp - 0x57], edi
push 0xa896856d
cdq
test eax, 0xc2a850eb
out dx, eax
mov bl, 0x7c
add byte [0x790f7c5b], bl
sbb ah, byte [esi - 0x2783570e]
invalid

Function at 0x691c27
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0xffa6051c
push edi
mov edi, 0x210e136e
and edi, edi
call fcn.00741a38

Function at 0x6ea9fd
Capabilities:
Encode data using xor

Disassembly:
in al, 0xff
mov edx, dword [esp + 4]
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.0066bbd3
dec esi
dec eax
sbb eax, 0x91979e44
push 0x5abb4357
mov eax, dword [0x678c8d57]
sub byte [eax + 0x35779bef], 0xa8
adc esp, dword es:[ebx - 0x5d74a919]
sub dword [eax + 0x57], ebx
setnp byte [ebp - 0x4910a8f9]
lds edx, [ecx + ebp*4 - 0x56]
fdivrp st(5)
shr dword [eax - 0x23e45304], 0x57
jg 0x6ea9e1
or bp, word [ecx - 0x159460b]
sub dl, 0xf2
add edi, edi
lds ebx, [ebx - 0x2c]
or al, 0xed
mov al, byte [0xf6550609]
push ebx
push ds
test byte [ecx - 0x41], al
inc eax
test eax, 0x7e8c8214
cli
test dword [ebp], ecx
jae 0x6eaaaf
imul edi, dword [esi + 0x6c], 0x5d6b22b8
in eax, dx
iretd
invalid
Function at 0x70599f
Capabilities:
Encode data using xor

Disassembly:
jmp edi
add edi, eax
jmp 0x520b0a
mov ebp, 0x2cf20875
jo 0x7059ba
mov ebp, dword [esp]
call fcn.00727f2c
cmc
stc
rol eax, 1
test ch, dh
cmc
xor eax, 0x5f5a15db
jmp loc.00416007
add eax, 0x26b3431e
not eax
stc
rol eax, 3
test edi, 0x73d67dc0
test esp, esp
xor ebx, eax
cmc
test bx, sp
jmp 0x560a0a
stc
cmc
ror eax, 1
jmp 0x6f5b63
enter 0xffffffffffffd0e9, 1
invalid
mov edi, 0x281c1ff2
pushfd
or di, di
add edi, edi
mov di, 0x6c6f
mov edi, dword [esp + 8]
mov dword [esp + 8], 0xc990fae1
push ebp
jns 0x6cb855
or dh, ch
test al, 8
xor byte [ecx - 0x78], 0xb7
or byte [eax + 5], cl
pop ecx
pop ebx
div dword [ebx + 0x776f6ea0]
js 0x70598d
stosb byte es:[edi], al
xchg dword [eax - 0x7c25d8ba], ecx
or ah, bl
push edi
adc edx, dword [esi + 0x77]
cmpsb byte [esi], byte es:[edi]
daa
fiadd dword [ebx + 0x1357dc08]
push esi
ja 0x70598a
das
push edx
ja 0x7059da
and edx, dword [ebx + ecx + 3]
add byte [eax + 0x7f], ch
invalid

Function at 0x71d13a
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x3b64e750
or byte [edx + 0x527ab2e], ah
mov byte [0x2bf81e9], al
mov byte [0x82474ff], al
popfd
lea esp, [esp + 0x10]
call fcn.00668a9d
push esi
mov dword [esp + 4], 0xc8673baa
inc esp
and al, 4
stosb byte es:[edi], al
cmp esp, dword [edi - 0x38]
call fcn.00625167
call fcn.00655d31
jge 0x71d11b
clc
mov ah, 0xa2
pop ss
inc edx
sub eax, 0x4160c4b
das
mov ah, 0xf
push edx
daa
test byte [ecx + esi*4 + 0x4bd99c62], dh
cmc
cmp eax, 0xa04b5839
xor edi, esi
dec bx
push edx
adc eax, 0xdab41d25
inc edx
jb 0x71d13c
mov ah, 0x3f
push esp
jmp 0x71d1c5
push ebx
hlt

Function at 0x738a71
Capabilities:
Encode data using xor

Disassembly:
push ecx
add dword [esp + 8], 0xffa00ea4
mov ebx, dword [esp + 0x1c]
mov edx, 0x40c6ac2
mov ecx, 0x4ae00a42
lea edx, [edx + 0x50c920af]
and ecx, 0x73d96c64
xor cl, dl
mov edx, dword [esp + 0x14]
and cl, 0xea
neg ecx
sub cl, 0x23
jge 0x738a88
jge fcn.00738a71
lea ecx, [ecx + ecx*4 + 0xa135085]
pop ecx
push dword [esp + 8]
popfd
lea esp, [esp + 0x1c]
call fcn.0062d314
Function at 0x741a50
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.006c01c2
ret 0x6f54
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x20]
call fcn.0066bbd3
call fcn.0054686d
jnp 0x72256d
bound esi, qword [esi - 6]
jge 0x7225f1
stosd dword es:[edi], eax
ja 0x72260c
rcl byte [ebp - 0x47], 0x77
sar byte [edi - 0x5477a074], 0x60
adc byte [edi + esi*2 - 0x566adfd4], dl
ja 0x722617
xor dword [ecx + 0x54], ecx
mov byte [ecx - 0x63], dl
fild qword [ebp - 0x462f1289]
invalid
mov eax, 0xab88c06a
xor esi, dword [ecx - 0x78]
cld
pop ebp
movsx esi, word [ebx - 0x77b516c4]
and byte [edx + 0x38], ah
cmp al, 0xe9
dec edx
mov byte [eax], ah
bound edi, qword [eax]
cld
xor ecx, edx
out dx, eax
sal dword [edi + 0x6f], cl
je 0x72262b
wait
aam 0x5e
daa
add byte [edx], ah
mov dword [esi - 0x429c0fd8], esp
pop es
push eax
add byte [esi + 0x3f], dl
xchg edi, eax
or al, 0
pushfd
enter 0xffffffffffff82dd, 0xffffffffffffffff
adc byte [ebp - 0x1a], bh
fdivr st(7)
pop esi
jg 0x7225fe
invalid
call [esi + 0x7f]
iretd
fimul word [edi]
invalid
jns 0x72258e
cmp word [esp + 0x14], 0x207c
call fcn.00722588
rol ecx, 1
cmc
clc
xor ebx, ecx
test eax, 0x5243052
add ebp, ecx
jmp 0x585a6f

Function at 0x7492fc
Capabilities:
Check for software breakpoints

Disassembly:
push ecx
mov ecx, 0x370c1f0f
mov dword [esp + 4], 0xd5008e41
not ecx
push 0x779163fc
push edx
pushfd
mov edx, ecx
sub edx, edx
setne dl
push ebx
mov ecx, dword [esp + 0x10]
mov ebx, 0x646129b6
neg edx
js 0x74931a
call fcn.005bbb9c
Function at 0x76a9ed
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov esi, ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x14], 0x293d5347
push edi
mov edi, dword [esp + 0xc]
mov edi, dword [esp]
or dword [esp + 0xc], esi
setb byte [esp + 0xc]
sub dword [edi - 0x75], edx
jl 0x76aa24
or al, 0x8b
jl 0x76aa28
add byte [ecx], cl
je 0x76aa2c
or al, 0xf
xchg edx, eax
inc esp
and al, 0xc
not esi
test dword [esp + 0xc], esi
call fcn.0068209f
pushfd
push esi
mov esi, 0x29470273
mov esi, 0x76f84b38
jbe 0x76aa25
push dword [esp + 4]
popfd
je 0x76aa4c
add al, 0x9d
mov dword [esp + 4], 0x85a58390
pushfd
push esi
xor word [esp], 0x5bd5
and al, 4
nop
and dword [ebp + 0x66569c85], 0xffffff81
je 0x76aa5c
add ch, dl
pop ebx
and esi, 0x109067aa
push esi
cmp dword [esp + 4], esi
mov esi, dword [esp + 0xc]
call fcn.005ed99d
inc ebx
lea eax, [edi + ebx*8 + 0x78]
pop esp
das
call 0x4503ee51
fistp qword [eax + 0x5c]
mov ch, 0xe7
loopne 0x76a9f4
adc dh, byte [edi + edi - 0x1f]
ja 0x76aa74
loope 0x76aad5
adc eax, 0x6e00270
jo 0x76aa63
loopne 0x76aa69
xor byte [ecx + ebx*4 - 0x4d9936e0], 0xc2
mov dl, 0xc2
fisub word [ecx]
push esp
sub byte [esi - 0x1e], ah
pop ebx
je 0x76a9fb
xchg ecx, eax
and dword [ebp - 0x4e], edi
jge 0x76aa2a
adc eax, dword [0x441b5703]
mov dl, byte [esi + esi*4 + 0x17]
sbb ch, byte [ecx - 0x7dee4983]
mov ebx, 0x50afcec
xor bh, byte [ebp - 0x2e]
pop ecx
pop ecx
add byte [esi], dh
add dword [edx + 0x1e], edi
jp 0x76aab5
jno 0x76aae0
test dword [ebp - 0x70], ecx
les ebp, [edx - 0x26badc23]
adc dword [eax + 0x6f], edx
lodsb al, byte [esi]
insd dword es:[edi], dx
wait
out dx, al
mov edx, 0x8eacd6ea
dec ebx
mov cl, 0x91
and dword [esi - 0x42], ebp
out dx, eax
add al, byte [edi + 0x6efedeaa]
xchg esi, eax
nop
movsx eax, al
sbb dh, byte [esi + ecx*2 + 0x2d6f8ef3]
inc edx
mov byte [edi + eax + 0xa68ba3], 0x45
jb 0x76aa95
invalid
fimul dword [edx]
dec esi
jno 0x76aa76
invalid
push ebx
in eax, 0x5f
retf