joyce8/EMBER2024-capa huggingface dataset:
Function at 0x538000
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x40
lea eax, [esp + 0x44]
lea ecx, [esp]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
push 0
push eax
push 0x40
push ecx
push esi
call ebx
test eax, eax
je 0x538175
cmp dword [esp + 0x54], 0x40
jne 0x538175
cmp word [esp + 0x10], 0x5a4d
jne 0x538175
mov edx, dword [esp + 0x4c]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push edx
push esi
call ebp
cmp eax, 0xffffffff
je 0x538175
lea eax, [esp + 0x54]
push 0
push eax
push 0xf8
push 0x53e960
push esi
call ebx
test eax, eax
je 0x538175
cmp dword [esp + 0x54], 0xf8
jne 0x538175
cmp dword [0x53e960], 0x4550
jne 0x538175
mov eax, dword [0x53e976]
test ah, 0x20
jne 0x538175
mov edx, dword [0x53ea80]
xor eax, eax
mov ax, word [0x53e966]
add eax, edx
lea eax, [eax + eax*4]
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [0x53ea58], eax
je 0x538175
push 1
push 0
push 0
push esi
call ebp
mov dword [0x53ea6c], eax
xor eax, eax
mov ax, word [0x53e966]
mov edx, dword [0x53ea58]
lea ecx, [esp + 0x54]
push 0
lea edi, [eax + eax*4]
push ecx
shl edi, 3
push edi
push edx
push esi
call ebx
test eax, eax
je 0x538175
cmp dword [esp + 0x54], edi
jne 0x538175
push 1
push 0
push 0
push esi
call ebp
mov ecx, dword [0x53ea80]
lea ecx, [ecx + ecx*4]
lea edx, [eax + ecx*8]
mov eax, dword [0x53e9b4]
cmp edx, eax
ja 0x538175
mov edi, dword [0x53ea58]
mov ecx, dword [0x53e988]
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0xc]
add eax, edx
cmp ecx, eax
jae 0x538175
xor eax, eax
push 2
mov ax, word [0x53e966]
push 0
push 0
push esi
lea ecx, [eax + eax*4]
mov ebx, dword [edi + ecx*8 - 0x18]
lea edi, [edi + ecx*8]
call ebp
mov edx, dword [edi - 0x14]
add edx, ebx
cmp eax, edx
jne 0x538175
cmp dword [edi - 0x20], ebx
ja 0x538175
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
Function at 0x53a769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x53e190
cmp edx, dword [eax]
je 0x53a78b
add eax, 8
inc ecx
cmp eax, 0x53e220
jl 0x53a77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x53e190]
jne 0x53a8b9
mov eax, dword [0x53ebb0]
cmp eax, 1
je 0x53a893
test eax, eax
jne 0x53a7bc
cmp dword [0x53e0e4], 1
je 0x53a893
cmp edx, 0xfc
je 0x53a8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x53a7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0053b670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0053b490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x53a836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0053b490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x53d45c
push edi
call fcn.0053bf00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0053b670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0053b680
lea eax, [ebp - 0xa0]
push 0x53d43c
push eax
call fcn.0053b680
push dword [esi + 0x53e194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0053b680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0053be75
add esp, 0x2c
pop edi
jmp 0x53a8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x53e194]
push 0
push eax
push dword [esi]
call fcn.0053b490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x4051ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4087d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040429a
and dword [ebp - 0x14], 0
cmp dword [0x40c630], 0
mov dword [ebp - 0x18], eax
jne 0x40525e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405306
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405306
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40c630], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40c634], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40c638], eax
call edi
push eax
call esi
mov dword [0x40c640], eax
test eax, eax
je 0x40525e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40c63c], eax
mov eax, dword [0x40c63c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4052b7
cmp dword [0x40c640], ecx
je 0x4052b7
push eax
call esi
push dword [0x40c640]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4052b7
test ebx, ebx
je 0x4052b7
call edi
test eax, eax
je 0x4052ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4052ae
test byte [ebp - 8], 1
jne 0x4052b7
or dword [ebp + 0x10], 0x200000
jmp 0x4052ea
mov eax, dword [0x40c634]
cmp eax, dword [ebp - 0x18]
je 0x4052ea
push eax
call esi
test eax, eax
je 0x4052ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4052ea
mov eax, dword [0x40c638]
cmp eax, dword [ebp - 0x18]
je 0x4052ea
push eax
call esi
test eax, eax
je 0x4052ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40c630]
call esi
test eax, eax
je 0x405306
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405308
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405516
leave
ret

Function at 0x405516
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4087d0]
jne 0x405520
repz ret
jmp fcn.00406683
Function at 0x409978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a64
push ebx
push 0x409a70
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099f8
mov al, 0x69
call fcn.0040961c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040994c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a01
call fcn.0040994c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a52
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409b04
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
jmp 0x409bad
cmp dword [esi + 0x10], 0x1000
jne 0x409b99
test byte [esi + 0x15], 1
jne 0x409b99
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b58
cmp eax, 2
je 0x409b58
cmp eax, 0x10
je 0x409b58
cmp eax, 0x20
jne 0x409b6d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b6d
mov bl, 1
xor ebp, ebp
jmp 0x409b7e
mov eax, dword [esi]
add eax, ebp
call fcn.00409afc
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b71
test bl, bl
je 0x409b99
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b30
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x484a30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5e000]
push edi
or ebp, 0xffffffff
jmp 0x484a52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x484a59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484a48
mov eax, 1
add ebx, ebx
jne 0x484a6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x484a7c
jne 0x484a9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484a9b
dec eax
add ebx, ebx
jne 0x484a88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x484a60
add ebx, ebx
jne 0x484a97
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x484aed
xor ecx, ecx
sub eax, 3
jb 0x484ab3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x484b22
sar eax, 1
mov ebp, eax
jmp 0x484abe
add ebx, ebx
jne 0x484abe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484a8c
inc ecx
add ebx, ebx
jne 0x484acc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484a8c
add ebx, ebx
jne 0x484ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x484ace
jne 0x484aea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x484ace
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x484b0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x484afe
jmp 0x484a4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x484b0c
add edi, ecx
jmp 0x484a4e
pop esi
mov edi, esi
mov ecx, 0x28cb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x484b2a
cmp byte [edi], 0x14
jne 0x484b2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x484b2f
lea edi, [esi + 0x81000]
mov eax, dword [edi]
or eax, eax
je 0x484b9e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9d4d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9d588]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x484b5c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9d58c]
or eax, eax
je 0x484b98
mov dword [ebx], eax
add ebx, 4
jmp 0x484b79
call dword [esi + 0x9d59c]
mov ebp, dword [esi + 0x9d590]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x484bd2
sub esp, 0xffffff80
jmp 0x4528f4
Function at 0x40803b
Capabilities:
Encode data using xor

Disassembly:
add dword [edi], ecx
test byte [ebx + 0x7e], bl
add dword [eax], eax
push ebx
push 0x57dc90
add byte [0x7f6a016a], al
inc dword [ecx + 0x57d001]
dec eax
sub eax, 1
add byte [0x13f], al
push ebx
cld
add esp, ebx
push edi
add byte [ebx + 0x57], dl
push 1
add byte [0xd09c15ff], al
push edi
les eax, [ecx]
sub eax, 1
je 0x540818d
pushfd
rcl byte [edi - 0x3c]
add dword [ebx - 0x7bf0fe18], eax
adc eax, dword [ecx]
add byte [0xdcb06853], al
push edi
xor dword [ecx], eax
push edi
push 1
push 0x7f
push ebx
push 0x3157dcb0
add dword [edi + 0x6a], edx
add dword [edx + 0x7f], ebp
call dword [fcn.00570500]
dec eax
sub eax, 0xffffffb8
add dword [edi + esi*8 + 0x6a000000], eax
pop ss
add byte [0x570057dc], al
call int.0054829b
add esp, 0xc
test eax, eax
add byte [0xf04d8d57], al
call 0x3f81f8
mov eax, dword [ebp - 0x10]
and dword [ebp], 5
cmp dword [eax - 0xc], 0x3c
jne 0x40806c
add dword [ecx*4 + 0x46c7ec45], esp
adc al, 0
add eax, 0x8d500000
dec ebp
add dword [ecx], eax
sub eax, dword [0x8d500000]
dec esi
add byte [0xe801fc45], al
scasd eax, dword es:[edi]
rol dword [ecx], 0xff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
add byte [0x8bffffa8], al
inc ebp
and eax, dword [ecx]
dec eax
invalid

Function at 0x44ba10
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov cl, byte [0x7cf04d]
mov edi, eax
mov al, byte [0x7cf04a]
mov edx, dword [0x7cf030]
and cl, al
mov eax, dword [0x7cf034]
mov byte [0x7cf04d], cl
mov ecx, eax
shr ecx, 2
sub edx, ecx
xor ecx, ecx
mov cl, byte [0x7cf043]
mov dword [0x7cf030], edx
mov edx, dword [0x7cf038]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
or edx, 7
push 0x10
imul edx, ecx
and eax, edx
mov dword [0x7cf034], eax
call ebx
test ax, ax
jge 0x44ba83
or dword [esi], 0x2000000
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [0x7cf030]
mov edx, dword [0x7cf034]
shr ecx, 0xc
or ecx, edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
fild qword [esp + 0xc]
test eax, eax
fadd qword [0x7cf050]
fstp qword [0x7cf050]
je 0x44bad2
mov edx, dword [0x7d2a9c]
push 0x7d27b8
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x11
call ebx
test ax, ax
jge 0x44bae1
or dword [esi], 0x4000000
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0x12
mov dword [0x7d2a9c], eax
call ebx
test ax, ax
jge 0x44bafb
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret 4

Function at 0x452ceb
Capabilities:
Encode data using xor

Disassembly:
add dword [edi], ecx
test byte [ebx + 0x7e], bl
add dword [eax], eax
push ebx
push 0x57dc90
add byte [0x7f6a016a], al
inc dword [ecx + 0x57d001]
dec eax
sub eax, 1
add byte [0x13f], al
push ebx
cld
add esp, ebx
push edi
add byte [ebx + 0x57], dl
push 1
add byte [0xd09c15ff], al
push edi
les eax, [ecx]
sub eax, 1
je 0x5452e3d
push ebx
push 0x3157dcb0
add dword [edi + 0x6a], edx
add dword [edx + 0x7f], ebp
Function at 0x458224
Capabilities:
Encode data using xor

Disassembly:
jno 0x4581b5
mov cl, 0x49
rol bl, 1
push ecx
iretd
push ebx
dec edi
xchg edi, eax
xor ebp, eax
dec esi
adc eax, 0x9331418a
mov bh, byte [edx + 0x40b28320]
adc eax, 0x4243a21f
call 0xbc473af6
ljmp 0x84c5
mov esp, 0x978a30ea
sbb ebp, eax
test ch, bl
xor al, 0xf4
lahf
js 0x4581c1
leave
mov ebx, 0x26619a5b
sub byte [eax], cl
jecxz 0x4581f4
std
sti
jae 0x4581e2
mov al, byte [ebx + ebp*2]
test eax, 0x52f1097f
aam 0x41
xor dword [edi], 0x43c5f75
mov edi, 0x70ad1d1
jmp 0x4581af
jp 0x4581db
push ebp
add ebp, ecx
invalid

Function at 0x49d98b
Capabilities:
Encode data using xor

Disassembly:
pushal
add eax, edx
push edi
add byte [eax - 0x7d], cl
call 0xbf4ed93c
add dword [eax], eax
add byte [ebx - 0x45], dl
add esp, ebx
push edi
add byte [ebx + 0x57], dl
push 1
add byte [0xd09c15ff], al
push edi
pop edi
add dword [ebx - 0x7bf0fe18], eax
pushfd
add dword [eax], eax
add eax, 0xdc706853
push edi
mov esi, 0x16a5701
push 0x7f
call dword [fcn.00570500]
dec eax
sub eax, 0x3c
add dword [eax + eax*4 + 0x53000001], eax
push fcn.00570500
push ebx
push edi
push 0xffffffffffffffa4
add dword [edi - 1], edi
adc eax, 0x57d09c
add byte [0x840f01e8], al
add dword [edi], ecx
test byte [ebx + 0x7e], bl
invalid
add byte [ebx + 0x68], dl
nop
fcom qword [edi]
push ebx
push 0x57dc90
add byte [0x7f6a016a], al
inc dword [ecx + 0x57d001]
dec eax
sub eax, 1
add byte [0x13f], al
push ebx
cld
add esp, ebx
push edi
add byte [ebx + 0x57], dl
push 1
add byte [0xd09c15ff], al
push edi
les eax, [ecx]
sub eax, 1
je 0x549dadd
push ebx
push 0x3157dcb0
add dword [edi + 0x6a], edx
add dword [edx + 0x7f], ebp

Function at 0x4e85eb
Capabilities:
Encode data using xor

Disassembly:
cmp al, 1
test byte [eax + 0x53000001], al
push fcn.00570500
push ebx
push edi
push 0xffffffffffffffa4
add dword [edi - 1], edi
adc eax, 0x57d09c
add byte [0x840f01e8], al
add dword [edi], ecx
test byte [ebx + 0x7e], bl
invalid
add byte [ebx + 0x68], dl
nop
fcom qword [edi]
push ebx
push 0x57dc90
add byte [0x7f6a016a], al
inc dword [ecx + 0x57d001]
dec eax
sub eax, 1
add byte [0x13f], al
push ebx
cld
add esp, ebx
push edi
add byte [ebx + 0x57], dl
push 1
add byte [0xd09c15ff], al
push edi
les eax, [ecx]
sub eax, 1
je 0x54e873d
pushfd
rcl byte [edi - 0x3c]
add dword [ebx - 0x7bf0fe18], eax
adc eax, dword [ecx]
add byte [0xdcb06853], al
push edi
xor dword [ecx], eax
push edi
push 1
push 0x7f
push ebx
push 0x3157dcb0
add dword [edi + 0x6a], edx
add dword [edx + 0x7f], ebp
call dword [fcn.00570500]
dec eax
sub eax, 0xffffffb8
add dword [edi + esi*8 + 0x6a000000], eax
pop ss
add byte [0x570057dc], al
call fcn.0062884b
add esp, 0xc
test eax, eax
add byte [0xf04d8d57], al
call fcn.004d87a8
mov eax, dword [ebp - 0x10]
and dword [ebp], 5
cmp dword [eax - 0xc], 0x3c
jne 0x4e861c
add dword [ecx*4 + 0x46c7ec45], esp
adc al, 0
add eax, 0x8d500000
dec ebp
add dword [ecx], eax
sub eax, dword [0x8d500000]
dec esi
add byte [0xe801fc45], al
scasd eax, dword es:[edi]
rol dword [ecx], 0xff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
add byte [0x8bffffa8], al
inc ebp
and eax, dword [ecx]
dec eax
invalid
Function at 0x53355b
Capabilities:
Encode data using xor

Disassembly:
add dword [edi], ecx
test byte [ebx + 0x7e], bl
add dword [eax], eax
push ebx
push 0x57dc90
add byte [0x7f6a016a], al
inc dword [ecx + 0x57d001]
dec eax
sub eax, 1
add byte [0x13f], al
push ebx
cld
add esp, ebx
push edi
add byte [ebx + 0x57], dl
push 1
add byte [0xd09c15ff], al
push edi
les eax, [ecx]
sub eax, 1
je 0x55336ad
pushfd
rcl byte [edi - 0x3c]
add dword [ebx - 0x7bf0fe18], eax
adc eax, dword [ecx]
add byte [0xdcb06853], al
push edi
xor dword [ecx], eax
push edi
push 1
push 0x7f
push ebx
push 0x3157dcb0
add dword [edi + 0x6a], edx
add dword [edx + 0x7f], ebp
call dword [fcn.00570500]
dec eax
sub eax, 0xffffffb8
add dword [edi + esi*8 + 0x6a000000], eax
pop ss
add byte [0x570057dc], al
call fcn.006737bb
add esp, 0xc
test eax, eax
add byte [0xf04d8d57], al
call fcn.00523718
mov eax, dword [ebp - 0x10]
and dword [ebp], 5
cmp dword [eax - 0xc], 0x3c
jne 0x53358c
add dword [ecx*4 + 0x46c7ec45], esp
adc al, 0
add eax, 0x8d500000
dec ebp
add dword [ecx], eax
sub eax, dword [0x8d500000]
dec esi
add byte [0xe801fc45], al
scasd eax, dword es:[edi]
rol dword [ecx], 0xff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
add byte [0x8bffffa8], al
inc ebp
and eax, dword [ecx]
dec eax
invalid

Function at 0x568eed
Capabilities:
Encode data using xor

Disassembly:
pop eax
rcl byte [esi + 0x14]
cli
push cs
xchg ebx, eax
jns 0x568f20
shl dword [esi + 0x102fc15f], 1
invalid
pop ss
aaa
xchg edx, eax
invalid

Function at 0x57e36b
Capabilities:
Encode data using xor

Disassembly:
add dword [edi], ecx
test byte [ebx + 0x7e], bl
add dword [eax], eax
push ebx
push 0x57dc90
add byte [0x7f6a016a], al
inc dword [ecx + 0x57d001]
dec eax
sub eax, 1
add byte [0x13f], al
push ebx
cld
add esp, ebx
push edi
add byte [ebx + 0x57], dl
push 1
add byte [0xd09c15ff], al
push edi
les eax, [ecx]
sub eax, 1
je 0x557e4bd
pushfd
rcl byte [edi - 0x3c]
add dword [ebx - 0x7bf0fe18], eax
adc eax, dword [ecx]
add byte [0xdcb06853], al
push edi
xor dword [ecx], eax
push edi
push 1
push 0x7f
push ebx
push 0x3157dcb0
add dword [edi + 0x6a], edx
add dword [edx + 0x7f], ebp
call dword [fcn.00570500]
dec eax
sub eax, 0xffffffb8
add dword [edi + esi*8 + 0x6a000000], eax
pop ss
add byte [0x570057dc], al
call fcn.006be5cb
add esp, 0xc
test eax, eax
add byte [0xf04d8d57], al
call fcn.0056e528
mov eax, dword [ebp - 0x10]
and dword [ebp], 5
cmp dword [eax - 0xc], 0x3c
jne 0x57e39c
add dword [ecx*4 + 0x46c7ec45], esp
adc al, 0
add eax, 0x8d500000
dec ebp
add dword [ecx], eax
sub eax, dword [0x8d500000]
dec esi
add byte [0xe801fc45], al
scasd eax, dword es:[edi]
rol dword [ecx], 0xff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
add byte [0x8bffffa8], al
inc ebp
and eax, dword [ecx]
dec eax
invalid
Function at 0x5c96cb
Capabilities:
Encode data using xor

Disassembly:
add dword [edi], ecx
test byte [ebx + 0x7e], bl
add dword [eax], eax
push ebx
push 0x57dc90
add byte [0x7f6a016a], al
inc dword [ecx + 0x57d001]
dec eax
sub eax, 1
add byte [0x13f], al
push ebx
cld
add esp, ebx
push edi
add byte [ebx + 0x57], dl
push 1
add byte [0xd09c15ff], al
push edi
les eax, [ecx]
sub eax, 1
je 0x55c981d
pushfd
rcl byte [edi - 0x3c]
add dword [ebx - 0x7bf0fe18], eax
adc eax, dword [ecx]
add byte [0xdcb06853], al
push edi
xor dword [ecx], eax
push edi
push 1
push 0x7f
push ebx
push 0x3157dcb0
add dword [edi + 0x6a], edx
add dword [edx + 0x7f], ebp
call dword [fcn.00570500]
dec eax
sub eax, 0xffffffb8
add dword [edi + esi*8 + 0x6a000000], eax
pop ss
add byte [0x570057dc], al
call 0x70992b
add esp, 0xc
test eax, eax
add byte [0xf04d8d57], al
call fcn.005b9888
mov eax, dword [ebp - 0x10]
and dword [ebp], 5
cmp dword [eax - 0xc], 0x3c
jne 0x5c96fc
add dword [ecx*4 + 0x46c7ec45], esp
adc al, 0
add eax, 0x8d500000
dec ebp
add dword [ecx], eax
sub eax, dword [0x8d500000]
dec esi
add byte [0xe801fc45], al
scasd eax, dword es:[edi]
rol dword [ecx], 0xff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
add byte [0x8bffffa8], al
inc ebp
and eax, dword [ecx]
dec eax
invalid

Function at 0x5e288d
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi], esp
pop ebx
inc ebp
int 0x8d
and eax, 0x7f2b6824
push ebp
pop esi
int 0xac
imul eax, ecx, 0x59db9c36
sal dword [esi], 0x9c
fistp dword [ecx + 0x1b]
stosd dword es:[edi], eax
xor al, 0xd1
or ecx, ebx
xchg ebx, eax
jo 0x5e2862
push ebp
inc dword [ecx + 0x37]
sub eax, 0xc10305c9
push ebp
xchg edi, eax
mov eax, 0x46f34587
mov byte [edx - 0x78fc62e1], ah
add dh, byte [ecx]
pop esi
jo 0x5e289b
fild dword [eax]
pop es
pop es
mov dword [0xd2b9314e], eax
adc dword [eax + 0x410b7d23], 0x4e
jno 0x5e28e2
sti
test byte [eax + 0x57], ah
pushal
push edi
daa
mov esi, 0x25d42640
xchg edx, eax
xor dword fs:[eax - 0x32bb93e], 0xa1ab6509
or dword [edx], ebx
jg 0x5e28c0
aaa
jno 0x5e28dd
test al, 0xd
sbb al, 0x49
aad 0xdb
or eax, 0xdbd5491c
xor edx, dword [ebx]
xor edi, dword [ebp + 0x41]