joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x9b71e0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x47030b
je 0x47035e
cmp ebx, 0x20
jbe 0x470364
cmp ebx, 0x40
jbe 0x4703aa
jmp 0x47044b
test ebx, ebx
je 0x470354
add eax, 0x10
test ax, 0xff0
je 0x470340
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x7946c0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x7947c0]
jmp 0x470328
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x470328
pxor xmm1, xmmword [0x9b71f0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x9b71f0]
pxor xmm2, xmmword [0x9b7200]
pxor xmm3, xmmword [0x9b7210]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x9b71f0]
pxor xmm2, xmmword [0x9b7200]
pxor xmm3, xmmword [0x9b7210]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4704aa
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x9b6b88], 0
je 0x471b9a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4702d0
jmp fcn.00409230
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3673759f
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2f7c48fe
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x3f91bbd
Capabilities:
Check for software breakpoints

Disassembly:
dec dword [ebp]
lea esp, [esp + 0x34]
jg 0x3f928c9
pushal
pushfd
lea esp, [esp + 0x24]
jne 0x3f91451
jmp 0x3f90735
mov dword [esp + 0x40], eax
pushfd
lea esi, [ebx - 0x5c319401]
movzx esi, cl
movsx si, cl
mov dword [esp + 0x40], edx
movsx si, al
lea esi, [eax - 0x52e70d85]
push 0x80022c16
mov dword [esp + 0x40], ebx
pushfd
pushfd
mov dword [esp + 0x44], ecx
movsx esi, bl
push 0x20445d01
push dword [esp + 0xc]
mov dword [esp + 0x48], ebp
not si
call fcn.03f91198
shr ecx, 0x19
cmp si, cx
stc
or eax, ecx
clc
jmp 0x3f923d9
bt ax, 0xb
cmp cl, 0xcc
xor al, byte [edx]
push ebp
push ebx
inc edx
pushfd
push dword [esp + 8]
mov byte [esp + 4], 0xe1
jmp 0x3f90f38
call fcn.03f918a7

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x67667dcb
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, str._WC
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x57c6275f
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40b002
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40b041
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40b041
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40b041
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40b041
cmp dword [ecx + 0x74], 0xe
jbe 0x40b041
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4182e7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x429160
push 0x429158
push str.FlsAlloc
push 0x1f
call fcn.00418152
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41831b
push dword [ebp + 8]
mov ecx, esi
call dword [0x42512c]
call esi
jmp 0x418321
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x418365
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x429170
push 0x429168
push str.FlsGetValue
push 0x21
call fcn.00418152
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41839c
push dword [ebp + 8]
mov ecx, esi
call dword [0x42512c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4183a4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x429178
push 0x429170
push str.FlsSetValue
push 0x22
call fcn.00418152
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4183de
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42512c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41aab2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41ab4f
push ebx
push esi
call fcn.0041aa7b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00419836
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41aafc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ab4e
push edi
push eax
call fcn.00415ae9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41ab1c
call fcn.00415aaf
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ab4d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00419836
add esp, 0x20
test eax, eax
jne 0x41ab3b
push edi
call fcn.00415aaf
jmp 0x41ab43
push ebx
call fcn.00415aaf
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41d5dc
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00416e9f
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41d64b
cmp esi, dword [ebp - 4]
je 0x41d646
cmp dword [ebp + 0xc], 0
je 0x41d646
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41d623
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0041d12e
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x41d64d
xor eax, eax
inc eax
jmp 0x41d64d
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x41d6b2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x430040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00416e9f
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00416e9f
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x41d729
cmp word [ecx], dx
je 0x41d729
mov eax, dword [0x4295dc]
push edi
dec eax
push eax
push 0x4294c8
call fcn.0041d651
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x41d79c
cmp word [eax], dx
je 0x41d79c
mov eax, dword [edi]
test eax, eax
je 0x41d74d
cmp word [eax], dx
je 0x41d74d
lea eax, [ebp - 0x10]
push eax
call fcn.0041d034
jmp 0x41d756
lea eax, [ebp - 0x10]
push eax
call fcn.0041d0cf
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x41d7c6
mov eax, dword [0x4294c4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4291b8
call fcn.0041d651
add esp, 0xc
test al, al
je 0x41d7c6
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x41d791
cmp word [eax], di
je 0x41d791
lea eax, [ebp - 0x10]
push eax
call fcn.0041d034
pop ecx
jmp 0x41d7c8
lea eax, [ebp - 0x10]
push eax
call fcn.0041d0cf
jmp 0x41d78e
mov eax, dword [edi]
test eax, eax
je 0x41d7b3
cmp word [eax], dx
je 0x41d7b3
lea eax, [ebp - 0x10]
push eax
call fcn.0041cfe9
pop ecx
jmp 0x41d7c6
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x41d891
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0041d4d6
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41d891
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x41d891
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x41d891
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41d81e
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004184e4
test ebx, ebx
je 0x41d88c
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004184e4
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41d891
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41d891
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004216b5
add esp, 0x10
xor eax, eax
inc eax
jmp 0x41d893
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a32b
leave
ret
Function at 0x4237a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4237cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4237cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x45852b
Capabilities:
Encode data using xor

Disassembly:
mov word [edi + eax*2 - 0x2df7766], cx
movsx ecx, al
mov ecx, dword [ebp + eax*4 - 0x5beeecc]
lea ebp, [ebp + eax*2 - 0x2df7762]
xor ecx, ebx
mov dword [esp + eax - 0x16fbbb3], eax
dec ecx
lea eax, [eax + 0x6922a988]
ror ecx, 3
xadd word [esp + eax - 0x6a92653a], ax
dec ax
setbe al
not ecx
neg word [esp + eax - 0x6a926f00]
jo 0x46e5e0
neg ecx
push eax
push eax
not ecx
movzx edx, word [esp + eax - 0x6a926efd]
call fcn.0047c6c8
mov ebx, dword [edx - 0x17]
fdivr qword [ecx + 0x5f]
dec byte [esi + 0x5f31c2fe]
dec byte [esi + 0x5f79e49c]
dec byte [esi + 0x5f25c0f2]
dec byte [esi + 0x5f8dd880]
cmp eax, 0x24e83064
pop ecx
or al, 0x71
sub eax, 0xd7021dbf
cmp eax, 0x7ae2174d
add eax, 0x7ae24b6f
jno 0x458603
add esp, edx
jp 0x4585fc
pop ds
arpl bx, di
jae 0x458646
adc edi, 2
pop eax
shr eax, 0x58
shr dl, cl
lea eax, [eax*4 + 0x26280e23]
call fcn.004528a7
mov dword [esp + 0xc], 0x4d676bae
lea esp, [esp + 0xc]
call fcn.00463d5e
invalid
xlatb
mov ecx, 0x4b48950
hlt
leave
rep movsd dword es:[edi], dword [esi]
lds esi, [ebx + 0x36]
cmc
cmpsd dword [esi], dword es:[edi]
rol ebp, 0x73
aad 0xb3
sub ah, dl
jno 0x45868e
or byte [eax - 0x18], cl
mov ebp, 0x5afffddd
pop edx

Function at 0x45d95f
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x10]
call fcn.00463d5e
add byte [esp + 8], 0x35
push ecx
or byte [esp + 0xc], 0x35
mov ecx, 0x99050e8f
push ecx
mov dword [esp + 0x10], 0x6d67337d
mov ecx, dword [esp + ecx + 0x66faf175]
jne 0x49297e
not dword [esp]
seto byte [esp]
jl 0x4392db

Function at 0x478f77
Capabilities:
Encode data using xor

Disassembly:
neg bl
and ebx, 0x76aa5037
mov bx, 0x74a0
mov ebx, dword [esp + 8]
call fcn.00437567
push ss
fucomp st(1)
fsubr st(4), st(0)
fdivr st(6)
invalid
jb 0x4501ff
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x14]
call fcn.00463d5e
mov ecx, dword [ebp]
add ebp, 4
xor ecx, ebx
mov edx, 0xcd15c4af
or edx, edx
mov eax, 0xc2b703ae
xor ecx, 0x3f8f2b0a
xor dl, dh
not edx
bswap edx
rol ecx, 1
jmp 0x480b7d
shr eax, 0xa3
dec ecx
lea eax, [eax*2 - 0x2eed78d9]
neg eax
not ecx
xor dx, ax
lea ecx, [edx + ecx - 0x4d7f384c]
xor ecx, 0x8d2e1718
dec dx
xor dx, dx
xor ebx, ecx
sal al, 0x83
and eax, eax
adc esi, ecx
sub edx, edx
movzx ecx, al
xor edx, dword [edi + edx]
dec ecx
neg cx
rol eax, 0x5b
lea edi, [edi + ecx - 0xff85]
push edx
movsx edx, cx
popfd
xadd eax, ecx
jmp esi

Function at 0x483ce0
Capabilities:
Encode data using xor

Disassembly:
push eax
inc dl
xor ecx, 0x3906b0b8
neg eax
xor bl, dl
lea edx, [esp + edx + 8]
mov ecx, dword [edx + ecx*2 - 0x54983b70]
mov dword [esp + 4], 0x6b3ba490
mov edx, eax
mov dword [edi - 4], ecx
mov edx, dword [ebp + 1]
lea eax, [eax + eax*4 - 0xd70ee4]
jmp 0x447d99

Function at 0x489674
Capabilities:
Get number of processors

Disassembly:
mov ebx, dword [esp + ebx - 0x47046d7b]
mov dword [esp + 8], 0xed66d151
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00463d5e
add esi, edx
add eax, eax
mov dword [esp], 0x55a075a4
jae 0x49bf3c
mov edx, dword [edi - 4]
lea ecx, [eax + eax*4 - 0x6cd7f9f2]
xchg dword [esp + 4], ecx
adc ecx, 0xfffd3f42
jmp ecx
Function at 0x4896a2
Capabilities:
Get number of processors

Disassembly:
mov eax, dword [ebp]
call fcn.0049d5ad
test eax, 0x5bdce449
dec esp
invalid

Function at 0x48aeca
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0xffba25ab
push esi
mov dword [esp + 8], 0xcd66d4f9
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00463d5e
mov eax, 0x281bee10
mov edx, 0xbea1153c
lea ecx, [edx*2 + 0x349f259b]
mov ecx, edi
shl edx, 0xa2
adc al, al
lea edi, [edi + eax - 0x281bee22]
call fcn.00449a52
movzx ecx, dx
or dl, byte [esp + ecx*2 - 0x4bd4]
not eax
jne 0x48dc94
lea edx, [eax*4 - 0x6d7becc1]
add esi, ecx
movsx ecx, al
mov dword [esp + edx - 0x1284133f], esi
ret 0xc
not dword [esp + ecx*2 - 0x4bd0]
neg eax
not eax
jmp fcn.0043db15

Function at 0x48b2cf
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.00463d5e
fild qword [ebp - 0x1c]
fsubr qword [0x9c8ef368]
rcr byte [ebp + 0x68], 0xf3
mov es, eax
enter 0x6835, 0xfffffffffffffff3
mov ss, word [eax - 0xc97b612]
mov cs, eax
in al, dx
mov dword [eax + 0x30], ebp
sub byte fs:[esi], dl
dec eax
and dword [ebx], edi
les edx, [eax]
aam 0x52
invalid

Function at 0x48d8f0
Capabilities:
Encode data using xor

Disassembly:
movsx eax, word [esp + edx - 0x6790f649]
xor ecx, ebx
inc ecx
not ecx
xor ecx, 0xc98ccc21
sub edx, edx
rol eax, 0x8c
sal dword [esp + edx*8 + 4], 0x29
inc ecx
neg ecx
mov word [esp + edx + 6], 0xbe90
call fcn.00445a6b

Function at 0x49504c
Capabilities:
Encode data using xor

Disassembly:
movsx ecx, dl
mov dword [esp + ecx - 0x4f], 0x19b3ba1b
bswap eax
pop ecx
xor eax, 0x9c93d5bf
sal dx, 0x6d
call int.0044f2a4
movzx edx, word [ebp + eax*2 - 0x166d7d46]
movzx ecx, ax
or eax, 0xe318fe22
jns 0x458939
lea ebp, [ebp + ecx - 0xbea1]
neg cl
xor dx, bx
neg dx
sub ecx, 0x8cb13200
lea eax, [ecx + eax*4 + 0x7337a238]
dec dx
ror dx, 1
xor ecx, 0x7bb5824
adc dx, 0xc014
xor bx, dx
xor eax, 0xcc2cb79b
shl ecx, cl
lea edi, [edi + eax - 0x5faf9ebc]
mov word [edi + eax - 0x5faf9eba], dx
sar ax, 0x2e
rol eax, 0x61
shl ax, 0xad
mov ecx, dword [ebp]
sub al, ah
add ebp, 4
xor ecx, ebx
lea edx, [eax - 0x33ef4763]
xadd edx, eax
shl dl, 0x43
rol ecx, 1
not ecx
inc ecx
inc ax
xadd dx, ax
call fcn.004624ff
sub dword [esp + eax*8 - 0x10000], 0xdc10a033
lea ebp, [ebp + ecx*4 - 0x3ff8a]
xadd word [esp + eax*2 - 0x3fff], ax
call fcn.0048bc00

Function at 0x497e37
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [eax + ecx*8 - 6]
dec dword [ebx + 0x24f84]
mov eax, dword [edi + ecx*2 - 0x5ea5fffe]
sal ecx, 0x4f
jne 0x47b260
and ecx, 0x23249c2c
dec eax
xor dx, cx
pushfd
mov ecx, 0xf717dc9c
mov dword [esp + 0xc], 0x2d6764f6
mov ecx, dword [esp + ecx*2 + 0x11d046d0]
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.00463d5e
jge 0x497e22
in eax, 0xdc
invalid

Function at 0x499c2e
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x839cb013
call fcn.00466646
mov ecx, 0xa20f729c
ror ecx, cl
mov eax, dword [ebp + ecx*2 - 0x41ee5394]
lea ebp, [ebp + ecx*2 - 0x41ee5390]
lea edx, [ecx + ecx*2 - 0x7b5568df]
xadd dx, cx
adc ecx, edx
xor eax, ebx
ror eax, 2
shl cx, cl
sub ecx, edx
lea eax, [eax + ecx + 0x79408b5e]
jae 0x484385
Function at 0x49b665
Capabilities:
Encode data using xor

Disassembly:
neg eax
push ecx
xor cl, dl
xor ebx, eax
xchg ecx, edx

Function at 0x49f5f3
Capabilities:
Encode data using xor

Disassembly:
sub edx, 0xc8ab102b
lea eax, [edx + 0x572fce9f]
rol cl, 1
inc cl
shr al, 6
inc eax
add dl, dl
xor bl, cl
xadd edx, eax
inc dl
shr ax, 0x23
adc ecx, esp
dec ax
push eax
mov eax, dword [eax + ecx - 0x37550174]
mov dword [edi - 4], eax
sal byte [esp + 2], 0xc2
inc dx
mov dword [esp], 0x11045397
mov eax, dword [ebp + 1]
mov ecx, dword [esp]
xor dword [esp + ecx - 0x11045397], ecx
xor eax, ebx
dec eax
sal dword [esp + ecx - 0x11045397], 0xb6
sub cl, byte [esp + ecx*2 - 0x2208a72d]
ror edx, cl
bswap eax
neg ecx
not edx
xor eax, 0xda3fba8e
push ecx
add dl, byte [esp + edx - 0x4c369e6f]
rol eax, 2
xor ebx, eax
push edx
jmp 0x434beb
add esi, ecx
mov ecx, dword [esp + edx*2 - 0x4600]
xadd al, ch
mov dword [esp + eax - 0x401923b3], esi
ret 8
xor eax, ebx
push ecx
jmp fcn.004595f4
lea eax, [eax*8 + 0x7a21eba0]
mov dword [edi + 4], ecx
ror dl, 0x82
mov eax, dword [ebp]
movzx ecx, dx
jns 0x476c51
mov ecx, 0x1ea9b237
movsx edx, cl
inc ecx
movzx ecx, byte [ebp + edx*4 - 0xdc]
rol dx, 0xe7
movzx eax, dl
xor cl, bl
dec cl
xor cl, 0x90
jmp 0x43f461
inc dl
shr edx, 0x56
neg eax
or edx, ecx
rol eax, 1
shr edx, cl
adc dx, cx
sbb eax, 0xa11dfe9f
lea edx, [edx + ecx*2 - 0xceedd71]
call fcn.0049b665
not ecx
shr eax, 0x43
jne 0x4884ca
xor ebx, ecx
movzx edx, ax
jmp 0x44a266
Function at 0x403cc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
or eax, 0xffffffff
test cl, 3
je 0x403cee
test esi, esi
je 0x403cee
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x430a38]
inc ecx
dec esi
je 0x403cee
test cl, 3
jne 0x403cd0
mov edx, esi
shr esi, 2
and edx, 3
sub ecx, 4
test esi, esi
je 0x403d52
push edi
mov edi, edi
xor eax, dword [ecx + 4]
add ecx, 4
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x430a38]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x430a38]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x430a38]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x430a38]
dec esi
jne 0x403d00
pop edi
test edx, edx
je 0x403d7a
add ecx, 3
lea esp, [esp]
movzx esi, byte [ecx + 1]
inc ecx
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x430a38]
dec edx
jne 0x403d60
pop esi
ret
Function at 0x417a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [edx]
sub esp, 0x10
add edx, 4
cmp dword [ebp + 8], 0
mov dword [eax], ecx
jbe 0x417af5
movzx ecx, byte [eax + 2]
push ebx
mov bl, byte [eax + 1]
push esi
push edi
lea esi, [edx + 1]
mov edi, edx
sub edi, esi
mov byte [ebp - 1], cl
movzx ecx, byte [eax + 3]
mov dword [ebp - 8], edi
mov edi, edx
sub edi, esi
sub edx, esi
mov byte [ebp - 2], cl
mov ecx, esi
mov esi, dword [ebp + 8]
dec esi
add edi, 2
add edx, 3
shr esi, 2
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edx
inc esi
lea ecx, [ecx]
mov edx, dword [ebp - 8]
movzx edx, byte [edx + ecx]
xor byte [eax], dl
xor bl, byte [ecx]
mov dl, byte [ebp - 1]
mov edi, dword [ebp - 0xc]
mov byte [eax + 1], bl
xor dl, byte [edi + ecx]
mov edi, dword [ebp - 0x10]
mov byte [ebp - 1], dl
mov byte [eax + 2], dl
mov dl, byte [ebp - 2]
xor dl, byte [edi + ecx]
add ecx, 4
dec esi
mov byte [ebp - 2], dl
mov byte [eax + 3], dl
jne 0x417ac0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4