joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406b73
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004043e7
and dword [ebp - 4], 0
cmp dword [0x426cf8], 0
mov ebx, eax
jne 0x406c24
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406cd5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406cd5
push eax
call fcn.00404375
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x426cf8], eax
call esi
push eax
call fcn.00404375
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x426cfc], eax
call esi
push eax
call fcn.00404375
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x426d00], eax
call esi
push eax
call fcn.00404375
pop ecx
mov dword [0x426d08], eax
test eax, eax
je 0x406c24
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404375
pop ecx
mov dword [0x426d04], eax
mov eax, dword [0x426d04]
cmp eax, ebx
je 0x406c7c
cmp dword [0x426d08], ebx
je 0x406c7c
push eax
call fcn.004043f0
push dword [0x426d08]
mov esi, eax
call fcn.004043f0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406c7c
test edi, edi
je 0x406c7c
call esi
test eax, eax
je 0x406c73
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406c73
test byte [ebp - 0xc], 1
jne 0x406c7c
or dword [ebp + 0x10], 0x200000
jmp 0x406cb5
mov eax, dword [0x426cfc]
cmp eax, ebx
je 0x406cb5
push eax
call fcn.004043f0
pop ecx
test eax, eax
je 0x406cb5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406cb5
mov eax, dword [0x426d00]
cmp eax, ebx
je 0x406cb5
push eax
call fcn.004043f0
pop ecx
test eax, eax
je 0x406cb5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426cf8]
call fcn.004043f0
pop ecx
test eax, eax
je 0x406cd5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406cd7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x48f9e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
push edi
jmp 0x48f9fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48fa01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48f9f0
mov eax, 1
add ebx, ebx
jne 0x48fa13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48fa24
jne 0x48fa43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa43
dec eax
add ebx, ebx
jne 0x48fa30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48fa08
add ebx, ebx
jne 0x48fa3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48fa95
xor ecx, ecx
sub eax, 3
jb 0x48fa5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48faca
sar eax, 1
mov ebp, eax
jmp 0x48fa66
add ebx, ebx
jne 0x48fa66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
inc ecx
add ebx, ebx
jne 0x48fa74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
add ebx, ebx
jne 0x48fa81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48fa76
jne 0x48fa92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48fa76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48fab4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48faa6
jmp 0x48f9f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48fab4
add edi, ecx
jmp 0x48f9f6
pop esi
mov edi, esi
mov ecx, 0x1a9e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48fad2
cmp byte [edi], 6
jne 0x48fad2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48fad7
lea edi, [esi + 0x8d000]
mov eax, dword [edi]
or eax, eax
je 0x48fb4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8f104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48fb04
mov ecx, edi
jns 0x48fb33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8f108]
or eax, eax
je 0x48fb49
mov dword [ebx], eax
add ebx, 4
jmp 0x48fb21
call dword [esi + 0x8f118]
mov ebp, dword [esi + 0x8f10c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48fb83
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x440d8f
Capabilities:
Encode data using xor

Disassembly:
sub al, al
pushal
push 0x12daacbd
cmp dh, bl
repne scasb al, byte es:[edi]
push edi
jmp 0x440274
Function at 0x493d30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.artexa_live_storage_6581F47D2B5C
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x493d65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x493d65
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 0x67
jmp 0x493d68
mov esi, dword [ebp - 4]
jmp 0xbb66da

Function at 0x4f7dca
Capabilities:
Encode data using xor

Disassembly:
cdq
and eax, 0xb0b164af
fcom qword [eax - 0x37dff5b8]
nop
dec esp
xchg ecx, eax
pushfd
add esp, ecx
sbb dword [ebp + 0x4d], ecx
xor al, byte [eax + 0x27711115]
daa
mov eax, dword [edx - 0x2e]
adc ah, byte [edx - 0x4c1d8fdd]
push ss
jo 0x4f7da0
aad 0xf2
push ebp
cmpsd dword [esi], dword es:[edi]
enter 0x4570, 0xffffffffffffffff
cmc
mov al, 0xa0
inc eax
test dword [ecx - 0x59629e1b], 0xf1e28f32
adc al, byte [edi - 0x2b]
pop ebp
dec edx
sbb byte [edi - 0x20], dh
sal dword [esi + ecx], 9
cmp ebx, eax
int 0xaf
fmul st(5)
scasd eax, dword es:[edi]
sub eax, 0x59542ca
bound ecx, qword [edi + 0x51]
add eax, 0xba16e14a
loope 0x4f7d6a
mov edx, 0x758552dd
invalid
lodsd eax, dword [esi]
pop edi
pop esi
je 0x4f7db0
push eax
mov ah, 0xa0
mov cl, 0x3a
aam 0x82
mov dl, 0xf
mov bl, 0x94
xchg byte [ecx], ah
mov byte [0x60b8287], al
inc edx
lahf
jl 0x4f7da6
push ds
test edx, eax
adc bh, dh
add byte [edx - 0x792d0544], dl
imul ebx, dword [esi + 0x35394ec0], 0xfffffff4
push edx
or esp, ecx
loope 0x4f7d45
xchg edx, eax
mov esp, 0x6b86d2fa
sahf
ror byte [esi + 0x39], 0x35
hlt
inc edx
push esp
insd dword es:[edi], dx
mov al, 0x33
scasb al, byte es:[edi]
or dl, byte [esi + 0x71eb2bcc]
add byte [0xc5c3cb61], bl
lcall 0x6dc2, 0xdaa63ca4
insd dword es:[edi], dx
sar byte [ecx + 0x32da96ee], cl
inc esp
test byte [eax + ebp*2 + 0x31], dh
or eax, 0xa2f15b87
jnp 0x4f7d3b
push 0x5b870d31
int1
mov byte [0xa1827b], al
inc edx
ljmp 0xdc0f
mov eax, dword [0xb1ea4200]
lodsd eax, dword [esi]
add ebp, dword [ebx + 0x1eebdc0f]
imul ebx, dword [ebp + 0xe75b290], 0xffffff94
push cs
xchg esp, eax
xchg ebp, eax
adc ebx, dword [esi - 0x21]
jo 0x4f7df3
dec ebx
wait
add byte [eax + 0x3eae0a46], dh
adc al, byte [ecx + 0x12]
mov bh, ah
lahf
or al, 0xff
mov ebp, 0xcbdfc3a4
dec ebx
mov dh, 0xdf
xor dh, byte [eax + 0xc572ee]
loop 0x4f7e46
cmc
jno 0x4f7e02
ljmp 0xb9d3:0xc40ece
pushfd
xor dl, bh
sbb byte [esi], 0xce
push edx
iretd
adc bl, byte [esi + 0x3d]
push eax
pushfd
add ch, dh
sar ah, 0x6f
sub al, 0x1a
and byte ds:[ecx + 0x6e], 0xbe
and edx, 0xb
push edx
mov ebp, 0x10353e27
mov esi, dword [ebx]
xor dh, byte [edx]
mov al, al
invalid
Function at 0x535553
Capabilities:
Encode data using xor

Disassembly:
fld st(3)
inc ecx
cmp eax, 0xac7b784c
invalid
xlatb
xchg ebp, eax
jp 0x5355c5
movsd dword es:[edi], dword [esi]
sbb eax, 0x37d70ddf
ja 0x535570
xchg esp, eax
fnsave dword [edi]
mov esi, 0x27a17ed9
inc esp
fcomp st(6)
mov eax, 0x5eefac67
jle 0x53554a
fst dword [esi - 0x7b3e5cb3]
int 0xa7
xchg esi, eax
dec ebp
mov dword [0xa7cd84c1], eax
std
invalid
fild qword cs:[ebx - 0x6d]
push esi
mov ebx, 0x7cbdb0ea
fisttp word [esi - 0x225e35d0]
and eax, 0x334159e0
pop edx
fisubr dword [eax + 0x1923092c]
out 0x1b, eax
outsd dx, dword [esi]
loope 0x535650
pushfd
ret
push 0x64
mov esp, 0x63f86390
invalid

Function at 0x540df1
Capabilities:
Encode data using xor

Disassembly:
wait
inc ebp
jbe 0x540e17
xor dword [esp + ebp + 0x38d13074], 0xd196b0f1
invalid
jae 0x540e89
mov al, byte [0x5c40973d]
aaa
lodsb al, byte [esi]
sbb eax, 0x50bafb5c
xchg esp, eax
int3
xchg ebx, eax
mov ebp, 0xf959a96a
push 0xffffffffffffffa9
pop ecx
stc
enter 0x7074, 0x61
repne lodsb al, byte [esi]
mov esp, 0xf14abf16
sbb ch, byte fs:[ebp + esi*2 + 0x1ad20bd2]
dec esi
xor byte [ebp - 0x4e160f8b], ch
push ebp
fsub st(4), st(0)
jo 0x540e4d
aam 0x38
mov cl, 0x74
test byte [esi], ah
inc ebp
fdivr dword [edi]
sal dword [esi], cl
or byte [ecx + ebx*4 + 0xc], dl
sal esp, cl
ret 0xce67
and al, 0x43
pop eax
mov esp, 0x4930892b
sti
adc dword [esi + 0x9a2e9a5], 0xe
loopne 0x540e4f
sub dl, dl
jp 0x540ebe
loopne 0x540efc
xor al, 0xf4
xor al, 0x4d
lodsd eax, dword [esi]
dec esi
cmp eax, 0xc5833145
ret
mov al, 0x32
popal
aaa
pop edi
cli
pushfd
cmpsd dword [esi], dword es:[edi]
sub eax, 0x1d26fb01
inc edi
je 0x540f01
pop ds
or eax, 0x354d0b6e
jge 0x540e89
sbb al, 0x59
add esp, dword [edi]
sbb eax, 0x4cf328a7
invalid
sub al, byte [edx + 0x1b]
add ebp, ebx
dec ebx
popal
adc cl, ch
inc edx

Function at 0x57a408
Capabilities:
Encode data using xor

Disassembly:
fdivr qword [edx + 0x4b]
xor dword [eax + 0x3e], ebp
invalid
pop es
sub esp, ecx
fiadd dword [esi]
mov ecx, 0xce671ee2
cmp eax, 0x22ce49c8
mov al, 0x16
jnp 0x57a3ab
and dword [edi - 0x15ad28f1], esi
rol dword [esi], 1
aam 0x92
insd dword es:[edi], dx
xchg dword [edi + eax*4 + 0x6a], ebp
inc edi
and ah, bl
cmp byte [eax - 0x3a], dh
mov dl, 0xc7
inc edi
leave
xchg dword [eax + 0x5f], ebx
sbb dh, byte ds:[eax + 0x4b]
add byte [ecx], cl
fisub word [ebx - 0x75b000de]
not dword [edx + edx]
jbe 0x57a407
pop ss
add dword [ebx + 0x657f0bd2], edi
adc dword [ecx - 0x4f155876], ebx
sbb al, byte [0x6699]
add bl, byte [edi]
cld
hlt
Function at 0x57c38a
Capabilities:
Encode data using xor

Disassembly:
sub esi, dword [ebp - 0x37]
pushal
bnd ret
mov eax, dword [edi + 0x5b696794]
sbb esp, eax
xchg dword [edi - 0x3be6a497], edx
pop ss
sub eax, 0x39cba883
loopne 0x57c33b
add edx, ebx
push edi
xor eax, 0x9d116fc9
popfd
invalid
dec ebx
aad 0x92
or byte [ebx + 0x19], dl
pop ss
inc ebp
jne 0x57c2ac
jne 0x57c2e8
leave
fstp dword [edi - 0x77]
and eax, 0xb9853407
mov esp, 0x27edf74a
jnp 0x57c2d1
pop edi
aaa
sbb al, 0x36
pop esp
js 0x57c381
movsb byte es:[edi], byte [esi]
je 0x57c2d2
fcomp dword [eax]
daa
sub eax, 0x2ac7ca7b
inc esp
retf 0x7ab4
stosb byte es:[edi], al
xor byte [edx + edi*8 - 0x245b5b7b], 0x42
mov al, 0x88
insd dword es:[edi], dx
aas
mov byte [ebp + 0x3f], ch
je 0x57c358
cmp ebx, esi
lea edx, [ebp + 0x27]
lea edx, [ebp + 0x27]
jg 0x57c369
les ebp, [ebx + 0x60]
add byte [eax], cl
das
mov bl, 0xd7
xchg dword [esi], edi
mov cl, 0x93
test byte [ecx + 0x4be38494], ch
dec ebx
add eax, 0xaaa5d02
jg 0x57c3bd
push edi
sbb edi, dword [edi + 0x2e]
call 0x4c3040ab
mov esi, 0x84b361ea
loope 0x57c31e
movsd dword es:[edi], dword [esi]
ror byte [edx - 1], 1
mov dword [edx + 0x4ef6ccca], eax
or al, 0xa7
cmp al, 0xb3
jge 0x57c363
popal
frstor dword [esi + 0x708b8218]
push ebp
xor byte [ebx + 0xd], dl
pop ebx
mov ecx, 0x19a081f1
add bh, 0x25
addps xmm2, xmm0
les ecx, [edx]
inc esi
xor eax, 0x34493d2b
dec edx
inc eax
out dx, al
popal
xchg edi, eax
xlatb
inc edi
js 0x57c3bd
ret

Function at 0x57cf8c
Capabilities:
Encode data using xor

Disassembly:
dec eax
cmp byte [edx - 0x298837a9], dh
xchg edx, eax
imul esp, dword [esi + 0x1b], 0x3685a5a7
fld dword [esi]
jnp 0x57cfae
test ch, al
push 0xfffffffffffffffd
imul ebp, dword [esi], 0x3102314e
jg 0x57cfcd
mov esp, dword [esi - 0x50]
push edi
mov al, 0x57
pop esp
invalid
and ecx, dword [edi + eax*8 - 0x3bf51f06]
invalid

Function at 0x58a1f5
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xc14f179c
sahf
pop ebp
in al, 0xeb
push cs
xchg edi, eax
inc edx
pop es
add eax, 0xcfb22db0
insb byte es:[edi], dx
lcall 0xd59a, 0x596b3c75
pop ebp
push 0x7a
out 0x76, eax
cli
sub eax, dword [ebx + 0x26]
sar eax, cl
clc
or esi, dword [eax - 0x55c1a86b]
aas
or ch, byte [ecx - 0x3cba46d]
inc ebp
xor dword [0x470c01a4], esi
imul eax, dword [edi - 0x69e59a26], 0xc0fab694
sbb dl, byte gs:[esi - 0x3f05496c]
push 0x54
mov edx, 0x1ac40ac2
cmp ch, byte [eax]
cmp ebp, dword [ebp + 0x78]
jnp 0x58a21b
push esi
mov dl, 0xa
dec ebx
push ds
mov eax, 0xb7b77e55
cmc
mov dword gs:[0xbebd14a4], eax
jne 0x58a1ff
lodsb al, byte [esi]
leave
mov edx, 0x91ffb0f5
pop es
pop esp
mov ebp, gs
jno 0x58a233
xlatb
sub ah, byte [esi + 0x41]
invalid

Function at 0x5c5dad
Capabilities:
Encode data using xor

Disassembly:
out 0x95, al
sbb ebp, eax
std
pop eax
int3
adc edi, dword [esi - 0x46ea6700]
push edx
adc ah, byte [0xa0adcb1d]
test bl, cl
sbb al, 0x25
add byte [ecx - 0x22], 0x9e
jno 0x5c5d48
sub al, 0x96
salc
pop ds
push esp
mov ss, esi
insb byte es:[edi], dx
inc eax
jbe 0x5c5e37
insd dword es:[edi], dx
xor dword [ecx + 0x777802df], esp
add edi, dword [edx + ebx*8 + 0x780e5cdd]
int1
shr byte [ecx], 0xb5
cdq
in eax, dx
invalid
Function at 0x60e0b4
Capabilities:
Encode data using xor

Disassembly:
das
aam 0x83
jmp 0xd19e319f
jnp 0x60e07c
dec ebx
xor al, 0xca
dec ecx
dec ebx
cmp al, 0xd2
sub byte [ebp + 0x1fb12a6a], bl
stc
jnp 0x60e0b6
inc ebp

Function at 0x615fc4
Capabilities:
Encode data using xor

Disassembly:
retf 0xfbe0
mov cs, esi
and ch, byte [edi - 0x28ee1582]
dec esi
nop
lahf
fldcw word [ebx + 0x3b181819]
xor ebp, dword [ebp - 0x2611bbb0]
pop ebp
jne 0x615f6e
fstp dword [ebp + 0x75]
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
mov dh, 0x21
adc eax, 0xe8008a9d
aas
pop ss
aad 0xc3
push esi
mov sp, word [ebp - 0x497c3fd8]
mov byte [0xe475b5e6], al
mov dh, 0x46
sbb byte [edx - 0x4848a443], dl
mov ch, 0x93
xor edi, ecx
sub esp, esi
add byte [esi], 0x7f
pop esi
mov ch, 0x56
idiv dword [edi]
aad 0xce
in eax, 0x81
xchg ebx, eax
pop esi
sub byte [esi + 0xc], 0xcb
xor al, 0x9e
xor eax, 0xb533eafc
or ah, byte [eax + eax*8]
mov byte [0xfd701189], al
js 0x615fae
pop esp
mov ah, 0x6a
xchg esi, eax
ret 0xa2aa

Function at 0x61d9d8
Capabilities:
Encode data using xor

Disassembly:
bound ebx, qword [esi + 0x22]
xor ah, byte [ebx + 0x17]
xchg esi, eax
inc esi
div ch
pushal
mov edi, 0xcec66b4e
xchg esp, eax
fcmove st(0), st(1)
stc
lds edx, [edi + 2]
jmp 0x61da14
fnstenv [ebx]
inc eax
and byte [ebp + eax - 0x3f], dl
dec ebp
sbb eax, 0x89e5db65
xchg dword [edx + 0x12], ebx
outsd dx, dword [esi]
scasd eax, dword es:[edi]
pop edx
adc ch, byte [edi + 0x65]
scasd eax, dword es:[edi]
sbb al, al
or byte es:[eax - 0x50471ce], bl
out dx, eax
aam 0x9b
mov bl, 0x59
adc dword [edx], edi
inc ebp
mov ecx, dword [edx + 0x6cca5fdd]
mov bh, 0x38
in al, 0x5d
xor eax, 0xc43bcc53
xor byte es:[eax + eax*8 - 0x2255dac8], bl
sbb dl, byte [eax + edx*2 + 0x30556cd5]
loopne 0x61da06
insb byte es:[edi], dx
outsd dx, dword [esi]
inc ebp
cmp ch, byte [eax]
arpl word [eax - 0x2b9c937d], si
movsd dword es:[edi], dword [esi]
cwde
inc esp
mov ebp, 0x85178aea
bound edx, qword [0x9dac29c8]
xchg esi, eax
pop eax
les esp, [esp + esi*8 - 0x6fca3aeb]
or dword [edx - 0x6a1acf01], eax
ret 0xd579
Function at 0x457168
Capabilities:
Encode data using xor

Disassembly:
inc edx
mov ecx, 0x9946a9b9
mov cl, 0x8b
fadd qword ss:[esi]
cmc
stosd dword es:[edi], eax
salc

Function at 0x475b79
Capabilities:
Encode data using xor

Disassembly:
xor cl, byte [esi]
pop edx
add esi, dword [ebx - 0x4521e01]
xchg edi, eax
nop
dec ecx
push ss
invalid

Function at 0x493d30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.js_edit_control_F467DB58152C
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x493d65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x493d65
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 0x67
jmp 0x493d68
mov esi, dword [ebp - 4]
jmp 0xbaa74a

Function at 0x493da4
Capabilities:
Encode data using xor

Disassembly:
test al, 0xb2
xor dword [eax], ebx
mov esp, 0x297c085a
pop ebx
cmp byte [ebx], cl
or ebp, edx
cmpsd dword [esi], dword es:[edi]
adc ah, byte [ebx + 0x77e9f017]
mov dword [0xe7390073], eax
add byte [ecx], bh
out 0x64, eax
cmp eax, 0xef8f9acc
add byte [ecx], bh
out 0x64, eax
cmp eax, 0xef8f9acc
scasb al, byte es:[edi]
aam 0xa5
loopne 0x493d8d
mov esp, dword [esi - 0x56]
pop ss
out dx, eax
aam 0x20
dec ebp
fst st(3)
and al, 0xbf
add dword [ecx + 0x2f], ebx
pop ds
fcmovnb st(0), st(3)
push es
cwde
sbb ecx, dword [edx + 0x23]
pop es
adc byte [eax + 0x768239f9], al
invalid

Function at 0x4a603a
Capabilities:
Encode data using xor

Disassembly:
jne 0x4a6081
wait
push 0x7cadb89
mov al, byte [0x2de4eaa8]
rol byte es:[edi + 0x5cd684db], 1
mov edx, 0x68c42ea3
hlt
mov dl, 0x4d
loopne 0x4a60e7
sub esp, dword [ebx + esi*2]
invalid
mov dword [0xebb1a72a], eax
rol byte [esi + 0x193077c0], cl
movsb byte es:[edi], byte [esi]
wait
test al, 0xa
push edi
or edi, ebx
xor dword [0x38e832b9], 0x5089ef6
push edi
add al, 0xf6
push edx
add eax, 0x52f60457
mov esi, 0x70005302
mov dl, 0x79
add byte [edx], ch
mov eax, dword [0x8049bca]
add al, 8
insb byte es:[edi], dx
loop 0x4a60ae
invalid
push cs
fisttp dword [edi - 0x75]
cdq
adc ebx, edi
rcr byte [ebx + ebx*4 + 0x24788292], cl
stosd dword es:[edi], eax
pushfd
wait
xchg edx, eax
cmp byte [eax + 0x24], 0xab
js 0x4a6123
or byte [ebx], cl
jbe 0x4a6100
in al, 0x75
invalid
sti
out dx, al
movsd dword es:[edi], dword [esi]
pinsrw mm0, word [edx - 0x2a], 0xd3
push ebx
push eax
jbe 0x4a60c9
pop ecx
sbb eax, 0xa56d6d4b
mov ax, word [0xcccd40bb]
fnsave dword [ecx]
js 0x4a60f0
pop edi
add byte [esi], dh
pop esp
add byte [edi], al
and eax, 0x16bdf9e7
dec ebx
out 0xcb, al
out 0xf9, eax
mov ebp, 0xcbe64b16
jp 0x4a6183
mov ecx, 0x369fd623
ret
mov esi, 0x10f91795
invalid
Function at 0x530d26
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xace09be5
aam 0xf
pop ds
push ebp
inc ecx
push 0x5f
loopne 0x530d88
push ebx
invalid
aaa
clc
shr dword [0x878c1c63], 1
push ecx
cmp byte [esi - 0x443a5691], dl
xor dh, byte [eax + ebp + 0x3ac5f81f]
dec ebx
mov byte [0xd985704b], al
retf
jne 0x530d40
sahf
out dx, al
lodsd eax, dword [esi]
loope 0x530df9
les ebx, [ecx]
stc
push esp
or ch, byte [ebx - 0xe]
wait
cvtdq2ps xmm7, xmmword [edi + 0x2e206310]
or byte cs:[edx + edi*2 - 0x71], ch
in al, dx
dec eax
nop
lea esp, [edx - 0x66]
mov edx, 0x14432873
lea esi, [ebp + 0xb]
fimul dword [edx + 0x3d]
xor eax, 0xcc87bbdc
in al, 0xa5
cli
jmp 0x97b6ba57
push 0xa3a9af3b
cmp dword [edx], ebp
push ebx
invalid

Function at 0x5319d2
Capabilities:
Encode data using xor

Disassembly:
xlatb
invalid
sbb bh, dl
mul byte [eax]
lahf
movsb byte es:[edi], byte [esi]
add cl, bl
stosd dword es:[edi], eax
nop
retf 0xa779
jge 0x531969
imul edi, dword [eax - 0x59], 0xffffff96
add cl, byte [edx - 0x16]
mov byte [ecx], ch
xlatb
mov bh, dh
mov ecx, 0x8aeb646b
ror dword [0xd332ca9a], cl
mov dword [0x57d4b70d], eax
lcall 0xb70d, 0xa3d332ca
aam 0x57
into
pushfd
lds edi, [ebp - 0x34]
jnp 0x5319a8
sti
cmc
jg 0x531976
in eax, 0x82
test al, 0xfa
out dx, eax
mov ah, 0x87
mov al, byte [0x98fb275f]
cmpsb byte [esi], byte es:[edi]
cmp dl, bl
dec esp
sahf
mov byte [edi + ebx*4], dh
cmp ah, cl
ficomp word [eax - 0x31932ab1]
jnp 0x531992
leave
fimul word [eax - 0x61]
xchg dword [ebx + 0x705d14c6], ebx
pop edi
pop ebp
jo 0x531a44
dec ecx
xor bh, ch
rol byte [esi + 0x6c], cl
and dword [eax - 0x2ec24fc1], edi
push esp
dec edx
or al, 0x7d
jnp 0x5319e2
out 0x1b, eax
movsb byte es:[edi], byte [esi]
inc ebp
bound edi, qword [eax - 0x67]
cmp al, 0xd8
rol byte [edx + 0x719b8d4d], cl
mov bl, 0xc5
ljmp 0x3b9e
outsb dx, byte [esi]
in eax, 0x9e
cmp ebp, ebx
mov esp, dword [ecx + 0x1a]
sbb byte [edi - 0x3c0c867f], ch
mov eax, 0xcf20ab3e
imul eax, ebp, 0xffffffdf
lodsb al, byte [esi]
frstor dword [eax - 0x33]
leave
hlt
jns 0x531a0b
ret
in eax, 0x1e
push dword [ebx + edi*8 + 0x76]
int1
jae 0x531a16
wait
fld qword [eax + 0x30c5cb]
pop edi
xchg ebx, eax
imul edx, ebx, 0x791380e3
stosb byte es:[edi], al
nop
mov bh, 0xc0
xor ecx, dword [ebx - 0x1b]
sub ebx, ebx
pop ecx
test bl, 0x98
mov ah, 0x9b
cdq
sbb byte cs:[edx + 0x59], bh
inc esi
outsd dx, dword [esi]
inc esp
xlatb
pop edx
shl byte [esi], 1
cmp byte [esi - 0x61274f11], cl
leave
dec ebx
cwde
cmp byte [edx + 0x47], 0x58
not esp
retf

Function at 0x57dd09
Capabilities:
Encode data using xor

Disassembly:
leave
das
leave
neg dword [edi + 0x7ea25f7a]
jge 0x57dd2c
pop esp
push es
invalid
sub bl, ah
push ecx
and edx, dword [esi + ebp*8 - 0x7f]
insd dword es:[edi], dx
sbb al, 0x3c
jne 0x57dcf8
invalid
xor ah, byte [ecx + 0x1f]
xchg edi, eax
scasd eax, dword es:[edi]
jle 0x57dd2c
subps xmm5, xmmword [ebx + 0xfa5cf48]
pushfd
cmpsb byte [esi], byte es:[edi]
int 0xfe
hlt
Function at 0x5bacc4
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x39
cdq
xchg ebp, eax
js 0x5bacee
xchg byte [eax + 0x67b3258b], dh
or byte [ebx - 0x550a2725], 0xb2
lodsd eax, dword [esi]
imul eax, dword [0xbc743e8f], 0xffffffe2
invalid
in eax, dx
test byte [edx], 0xf8
sub al, 0xea
dec ecx
push cs
je 0x5bad4c
mov dl, 0xb6
jl 0x5bad26
ret
xchg ebp, eax
out dx, al
fisttp qword [ecx + 0x4bc34c78]
cld
or dword [edi], ebp
and dl, ah
call 0x38289182
jo 0x5bad52
nop dword [esi]
or eax, 0xf85880d4
invalid
les eax, [edx - 0x3eccef6c]
pop es
aaa
sub al, 0x89
loopne 0x5bad60
sbb edi, dword [ebp + 0x22]
cli
sbb dh, byte [ebx]
jp 0x5bad68
pop es
or eax, 0x98612dcd
les esp, [eax + 0x7a]
cmc
pushal
jp 0x5bad60
lodsd eax, dword [esi]
inc eax
hlt

Function at 0x5cafe6
Capabilities:
Encode data using xor

Disassembly:
and eax, dword [ebx]
xchg edx, eax
mov ebx, 0x4ad66b4f
out 0xf0, al
push ebx
in al, 0xc7
sub dword [esi - 0x26], 0xffffffdd
int1
mov esp, 0xb790fec7
lahf
imul ecx, dword [edx - 0x50], 0x58
ret 0x553d
cmp eax, 0x6fa57255
imul edi, edi, 0x1e
dec edx
mov ecx, 0xbac15585
xchg edx, eax
add byte [edx + 0x7c], 0x84
arpl bx, cx
mov edx, 0x7c428092
test byte [ebx - 0x35], ah
lea esp, [ebx]
pop ebx
jns 0x5caf9d
fisttp word [eax]
push esp
popfd
or al, 0xa9
jp 0x5cb00b
or byte [ebp + ebx*4 + 0xc], dl
test eax, 0xdb0c4c7a
or al, 0xdb
sbb dh, byte [ebx]
jo 0x5cb020
in eax, 0x98
ja 0x5caffb
xchg esp, eax
jb 0x5caf7f
xchg ebx, eax
push ebx
jge 0x5cafb8
invalid
ret 0x21df
mov ecx, 0x9d6a5993
mov eax, dword [0x37936b02]
add ch, byte [ebx - 0x6d]
aaa
mov al, 0x48
je 0x5cb011
jne 0x5cafaa
push ebx
mov edi, 0xed72763b
in eax, dx
stosb byte es:[edi], al
mov eax, 0x7bf696d0
push ds
popal
cwd
cmp dword [ebp + 0x66a6daef], edi
cmp ch, byte [edx]
cmp ch, byte [edx]
pop edx
xor dl, byte [ebp + 0x28]
pop edx
mov dl, byte [edx]
dec esi
mov eax, dword [0xe36ea797]
sbb al, byte [esi + 0x4a82f2ee]
pop edx
aas
fnstcw word [edx + 0x67]
xchg edi, eax
xlatb
cmpsb byte [esi], byte es:[edi]
add al, 0x65
pop edx
in eax, 0xa3
mov ecx, 0xa498a6f3
cli
pop edx
scasb al, byte es:[edi]
mov dh, 0x1c
xchg byte [ebx], dl
in al, dx
loop 0x5cb030
ror dword [edx + 0x154d9d8c], cl
pop edx
pop edx
mov edi, 0xb0fd922c
and eax, 0xd27fb765
mov al, 0xd7
push 0x2c7a030c
add dword [ebp - 0x72], esi
loope 0x5cb00b
invalid