joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4022f0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c910
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4220c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x4242e8
call fcn.00409bd0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1836
call fcn.00406140
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x424134]
call fcn.00406770
mov dword [ebp - 4], 0
movzx eax, byte [0x424138]
test eax, eax
je 0x402360
call dword [0x42411c]
jmp 0x402373
push 0
call dword [0x424114]
push 0xb4
call dword [0x424120]
mov ecx, dword [0x424140]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4023af
mov dword [ebp - 4], 0xffffffff
mov ecx, 0x4242cc
call fcn.004057d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x4242b0
call fcn.004057d0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4023e6
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4023c7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c4d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4220c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00405850
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x1c], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x24], 0
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x28], 0x4e
mov byte [ebp - 0x25], 0x53
mov byte [ebp - 0x1c], 0x4d
mov byte [ebp - 0x18], 0x6c
mov byte [ebp - 0x23], 0x49
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x15], 0x29
mov byte [ebp - 0x1d], 0x28
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x24], 0x5f
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x27], 0x53
mov byte [ebp - 0x26], 0x49
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1a], 0x7a
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x16], 0x61
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.004098d0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d024
mov esp, ebp
pop ebp
ret

Function at 0x406530
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0
push 0
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.004057d0
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x20], eax
push 0
push 0
push 3
push 0
push 0
movzx edx, word [ebp + 0x24]
push edx
lea ecx, [ebp + 8]
call fcn.004057d0
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x24], 0
jne 0x40659d
mov byte [ebp - 5], 0
lea ecx, [ebp + 8]
call fcn.004058a0
mov al, byte [ebp - 5]
jmp 0x4065b3
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x1c], 1
mov byte [ebp - 6], 1
lea ecx, [ebp + 8]
call fcn.004058a0
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret 0x24
Function at 0x4073b0
Capabilities:
Check http status code
Contain obfuscated stackstrings
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4220c0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 1], 0
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xb], 0x6d
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0x11], 0x67
mov byte [ebp - 0xe], 0x2e
mov byte [ebp - 0xa], 0
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x14], 0x67
mov byte [ebp - 0x13], 0x6f
push 1
push 0
call fcn.004068e0
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x28], esp
lea eax, [ebp - 0x14]
push eax
call fcn.00406140
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x48]
call fcn.00406530
mov ecx, dword [ebp - 0x48]
movzx edx, byte [ecx + 0x1c]
test edx, edx
je 0x4074c8
mov dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.00406910
mov dword [ebp - 0x50], eax
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push 0
push 0x41ef2c
push 0x41ef38
mov ecx, dword [ebp - 0x50]
call fcn.004057d0
push eax
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x44]
call fcn.004058a0
cmp dword [ebp - 0x18], 0
je 0x4074be
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 4
push 0
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x24]
push eax
push 0x20000013
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
cmp dword [ebp - 0x24], 0xc8
jne 0x4074be
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x48]
call fcn.004065c0
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040d024
mov esp, ebp
pop ebp
ret
Function at 0x407860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea ecx, [ebp + 0xc]
call fcn.004057d0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4078b5
mov dword [ebp - 0x10], 4
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea ecx, [ebp + 0x28]
call fcn.004057d0
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 0xc]
call fcn.004058a0
lea ecx, [ebp + 0x28]
call fcn.004058a0
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x4078e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c648
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4220c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8c], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00405850
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
lea ecx, [ebp + 0x10]
call fcn.004057d0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407a5a
lea ecx, [ebp - 0x50]
call fcn.00407b80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x50]
call fcn.00407c90
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x38]
push edx
push 0
push 0
push 0
lea ecx, [ebp + 0x2c]
call fcn.004057d0
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x407a4e
mov ecx, dword [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x50]
call fcn.00407c70
lea edx, [ebp - 0x38]
push edx
push 0
lea ecx, [ebp - 0x50]
call fcn.00407cb0
push eax
push 0
push 0
lea ecx, [ebp + 0x2c]
call fcn.004057d0
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x407a4e
lea ecx, [ebp - 0x50]
call fcn.00407c90
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jle 0x407a4e
push 1
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x78]
push edx
lea ecx, [ebp - 0x50]
call fcn.00407c40
mov ecx, eax
call fcn.00407ce0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x50]
call fcn.00407c10
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x70]
call fcn.004089f0
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404790
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.004058a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
call fcn.00407bf0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405810
mov ecx, dword [ebp - 0x8c]
or ecx, 1
mov dword [ebp - 0x8c], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004058a0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.004058a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x2c]
call fcn.004058a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d024
mov esp, ebp
pop ebp
ret 0x40

Function at 0x409aa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov byte [0x42419b], 1
mov byte [0x4242a8], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x409bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4242ac], eax
mov esp, ebp
pop ebp
ret
Function at 0x40a760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jge 0x40a7ea
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a7b0
cmp dword [ebp - 0x10], 0
jne 0x40a7b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a7ea
cmp dword [ebp - 4], 0
jne 0x40a7cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x40a7cd
jmp 0x40a7ea
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x10]
mov dword [ebp + 0xc], edx
jmp 0x40a781
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp eax, dword [ebp + 0x10]
sete cl
mov al, cl
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40abe0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c988
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4220c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x1c], 0
je 0x40ac20
mov ecx, dword [ebp - 0x1c]
call fcn.0040b090
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00404790
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x40aab0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x58], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x58], 0
jne 0x40ac73
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058a0
mov al, byte [ebp - 0x15]
jmp 0x40ac93
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], 1
mov byte [ebp - 0x16], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058a0
mov al, byte [ebp - 0x16]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x40ad30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x10]
jge 0x40ad8d
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40ad70
xor al, al
jmp 0x40ad9a
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x10]
mov dword [ebp + 0xc], edx
jmp 0x40ad43
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp eax, dword [ebp + 0x10]
sete cl
mov al, cl
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40d024
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4220c0]
jne 0x40d02e
repz ret
jmp fcn.0040ea66

Function at 0x416bff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040f5e6
and dword [ebp - 4], 0
cmp dword [0x423f7c], 0
mov ebx, eax
jne 0x416cb0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x416d61
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41e55c
push edi
call esi
test eax, eax
je 0x416d61
push eax
call fcn.0040f574
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423f7c], eax
call esi
push eax
call fcn.0040f574
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423f80], eax
call esi
push eax
call fcn.0040f574
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423f84], eax
call esi
push eax
call fcn.0040f574
pop ecx
mov dword [0x423f8c], eax
test eax, eax
je 0x416cb0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040f574
pop ecx
mov dword [0x423f88], eax
mov eax, dword [0x423f88]
cmp eax, ebx
je 0x416d08
cmp dword [0x423f8c], ebx
je 0x416d08
push eax
call fcn.0040f5ef
push dword [0x423f8c]
mov esi, eax
call fcn.0040f5ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x416d08
test edi, edi
je 0x416d08
call esi
test eax, eax
je 0x416cff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416cff
test byte [ebp - 0xc], 1
jne 0x416d08
or dword [ebp + 0x10], 0x200000
jmp 0x416d41
mov eax, dword [0x423f80]
cmp eax, ebx
je 0x416d41
push eax
call fcn.0040f5ef
pop ecx
test eax, eax
je 0x416d41
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416d41
mov eax, dword [0x423f84]
cmp eax, ebx
je 0x416d41
push eax
call fcn.0040f5ef
pop ecx
test eax, eax
je 0x416d41
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423f7c]
call fcn.0040f5ef
pop ecx
test eax, eax
je 0x416d61
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416d63
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4186b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [esp + 4], eax
mov al, byte [0x4cb950]
test al, al
je 0x41871d
mov ecx, dword [0x4cb9c0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
and ecx, 0xffff
cmp ecx, 0xffffd7b2
push edi
jne 0x4186ea
mov eax, dword [0x4c9c3c]
test eax, eax
je 0x4186ea
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff5
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0xc]
push 0
push edx
push 0x1d
push 0x4ca920
push eax
call edi
push 0xfffffffffffffff5
call esi
lea ecx, [esp + 0xc]
push 0
push ecx
push 2
push 0x4cb9d0
push eax
call edi
pop edi
pop esi
ret
mov al, byte [0x4ca4a8]
test al, al
jne 0x418737
push 0
push 0
push 0x4ca920
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret

Function at 0x445128
Capabilities:
Encode data using xor

Disassembly:
fsub st(0), st(0)
mov ch, 0xd6
sbb edi, ecx
xor byte [ecx - 0x49], ah
push dword [ecx + 0x7f]
xchg ebx, eax
mov dl, 6
mov cl, 0x92
stosb byte es:[edi], al
aad 0x58
dec edx
inc esi
xor ebp, dword [ebx - 0x6d]
push cs
or bl, bl
out 0xf7, al
inc edx
mov ebx, 0x7dd342b4
dec edi
inc ebx
mov ebx, 0x3a49091b
adc dword [eax + 0x5c1d633e], ecx
mov cl, dh
add byte [ebp + 0x28a22daf], al
dec esp
out dx, al
xchg edi, eax
cdq
mov dh, 0xed
and dh, byte es:[edx + 2]
loope 0x44513e
pop es
cli
and byte [edx - 0x75774ae], ch
pushal
stosd dword es:[edi], eax
jb 0x4451cc
arpl sp, bp
scasb al, byte es:[edi]
pop esp
punpcklwd mm4, dword [edx]
sbb esi, edx
pop ss
hlt
jno 0x445231
mov ecx, 0xb613390a
scasd eax, dword es:[edi]
sub al, 0x3c
ror ecx, 0x85
push ebx
dec edx
cmp ebp, dword [ecx + 0x6340396e]
sub bl, 0x52
nop
movsd dword es:[edi], dword [esi]
pop ds
add edx, 0xffffffca
cmp dword [eax], ebp
xchg edx, eax
shr ch, 1
cld
movsb byte es:[edi], byte [esi]
rol ebp, 0x2d
mov dh, 0x4f
dec ecx
aaa
mov esp, dword [ebx]
add dword [ecx + 0x55], 0x40
push ds
jae 0x445269
invalid
mov byte [eax], bl
and ebx, ebx
pushfd
jno 0x44527c
sahf
lahf
add eax, 0xe80afd8e
mov eax, 0x6e64b26b
inc eax
add ebp, dword [edx]
retf
sbb al, 0xe4
jecxz 0x445206
sbb byte [edx + 0x2a], 0x4a
invalid
xor al, byte [esi]
mul ah
and byte [edi + 0x3c], bl
lodsb al, byte [esi]
sub al, 0x21
and edx, edi
cdq
invalid
adc al, 0x26
jmp 0x9d4194e4
Function at 0x4546a8
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
adc dword [ebp + 0x66], 0x5f
inc ebx
sbb eax, 0x12a440fb
lodsd eax, dword [esi]
ror byte [ebx], 0x59
adc byte [edx - 0x20], dl
test al, 0x5d
popal
sbb byte [eax], dh
arpl word [eax + 0x58], sp
xchg edi, eax
cpuid
adc edi, dword [ebp - 0x2015687e]
xor bh, ch
pop ebx
sub al, 0xf4
pop eax
out dx, al
mov byte [ebx - 0x50f0ab2f], ah
add dword [edx + 7], ebp
sub cl, byte [eax + 0x4cee250b]
xor ch, byte [eax - 0x5b]
aas
xchg edx, eax
wait
wait
scasd eax, dword es:[edi]
inc edi
jnp 0x45467f
salc
salc
or dword [edi + 0x5bff1373], edi
js 0x454722
push ebx
add edi, dword [edx]
std
or eax, 0x2b57f077
stosb byte es:[edi], al
insd dword es:[edi], dx
test edi, eax
js 0x454664
push cs
add eax, eax
mov ebx, 0x1a0de8dd
invalid
xor eax, 0x76a79409
jb 0x454794
mov ch, 0xd3
or esi, dword [edi - 0x65]
push esi
jle 0x4547a5
mov byte [edi + edi*2 + 0x2b], cl
stosd dword es:[edi], eax
aam 0x34
inc ebp
cwde
cmc
ret
cmp al, 0x34
dec esp
add al, byte [edi + 0x65]
outsb dx, byte [esi]
lodsb al, byte [esi]
lodsd eax, dword [esi]
ret
sub al, 1
rcr dh, 1
into
or ah, al
out 0x70, eax
invalid
pushal
lds esp, [eax]
push edi
sub byte [eax], cl
add dword [0xa55f212d], ebx
scasd eax, dword es:[edi]
cmc
inc byte [ebx + ebx*2]
jbe 0x45475c
leave
out dx, eax
fisub word [ecx + 0x5e]
add dword [edx + 0x249222d6], edi
invalid

Function at 0x4808e8
Capabilities:
Encode data using xor

Disassembly:
ret 0x263d
mul byte [ecx - 0x49cf9b18]
scasb al, byte es:[edi]
test byte [edi - 0x2b], bl
mov byte [0x7f38f583], al
push edi
clc
xor dword cs:[edi - 0xd], eax
mov esi, 0xae223c00
and ch, byte [esi + 0x5fe06c62]
and ch, byte [esi + 0x5fe06c62]
push edi
jno 0x480937
std
push edi
push ss
dec edi
add byte [esi], dh
jbe 0x4808cf
cmp al, 0x1c
sbb eax, 0x81300fbc
cmpsd dword [esi], dword es:[edi]
or cl, dl
jo 0x480897
cmp dl, dh
sbb al, 0xdd
sahf
sahf
or ebx, dword [edx]
mov dword ds:[0x4f81fdc], eax
jle 0x48090b
out 0xbf, eax
or al, 0xd4
mov ebp, 0x8e7d3dd7
add eax, 0x5726561b
je 0x48093b
pop esi
sbb ebx, dword [edx]
adc al, 2
mov cs, word [esi - 0x7c]
xor eax, 0x21563e15
out 0x9f, al
jle 0x4809a2
hlt
adc eax, 0x2e713d5d
test dword [ebx + 0x27], edi
test dword cs:[ebx + 0x27], edi
das
push ss
popal
insd dword es:[edi], dx
xlatb
invalid
xlatb
and dl, byte [ebp + 0x19]
push edx
xchg ch, dh
mulps xmm5, xmmword [ebp + 0x6fd627b2]
popfd
lds ebp, [ecx]
iretd
xchg ebx, eax
sub dword [ecx - 0x39], esi
jbe 0x4809e7
and eax, dword [edi + edx*8 + 9]
dec ecx
dec ecx
push esi
sal edx, 1
cld
test byte [eax], dl
je 0x4809ad
pop es
div byte cs:[eax]
mov dh, 0x13
lahf
out 0x46, eax
jmp 0x480988
invalid
Function at 0x48b898
Capabilities:
Encode data using xor

Disassembly:
invalid
xchg ebp, eax
lahf
inc ecx
jns 0x48b83d
aas
dec ebp
and eax, 0xc8b6af4d
dec esp
mov esp, 0x1bf9b5ea
sbb byte [edx], bh
push ecx
cld
mov ch, 0xf9
sbb ebx, dword [eax]
cmp dl, byte [ecx - 4]
div dword [esi]
push ecx
salc
out dx, al
xor ah, byte [esi]
mov byte [ecx + 0x9fbac05], dh
inc ebx
and edx, dword [eax + 0x382c5b1a]
sub al, 0x1a
je 0x48b8ab
mov edx, 0xe2d6be20
arpl word [edi + 0x835a5ac], sp
cli
jno 0x48b917
in eax, 0xa4
test eax, 0xddd015f5
lds ebx, [edx]
leave
ja 0x48b8a7
jmp ebp
fstp dword [ecx - 0x68]
sbb dword [ebx - 0x73], 0x483d27a
mov edi, 0xb12e1522
and dh, byte [edx]
inc ebp
cmp byte [edx - 0x48], 0x5a
lodsd eax, dword [esi]
push edi
sub ah, byte [ecx]
push eax
popal
sahf
sub cl, dh
sbb edi, esp
inc esp
invalid

Function at 0x4983c8
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ebx + 0x30aa3276], cl
adc ecx, dword [edx]
adc byte [ebx + 0x2ba763aa], cl
pop ss
jbe 0x4983ae
stosb byte es:[edi], al
xor byte [ebx], dl
or dl, byte [eax]
mov ebp, dword [edx + 0x172ba763]
push eax
aaa
mov bl, 0xea
cli
cvtdq2ps xmm5, xmm3
xor ebp, dword [ebx + 0x56fe449d]
scasd eax, dword es:[edi]
insd dword es:[edi], dx
shl byte [eax*8 + 0x6aeee0a2], cl
aad 7
mov bh, byte [ebx]
out dx, eax
pop eax
aaa
sbb byte [ebx - 0x30], ch
sti
push ds
push edx
loopne 0x49837a
stosd dword es:[edi], eax
popfd
inc esp
invalid
int1
daa
pop es
inc edx
mov dh, 0x29
mov ecx, 0x57d8333f
push ebx
scasd eax, dword es:[edi]
sbb dword [ebx + 0x7df59a3f], eax
cwde
mov cs, word [ebx + 0x750bc0d5]
or esi, dword [ebp - 0x32]
or esi, dword [ebp - 0x32]
adc eax, dword [ebp + 0x77b48278]
stosb byte es:[edi], al
cdq
mov bl, 0x61
sti
mov edi, 0xd9e4c37a
jp 0x498390
cmc
stosd dword es:[edi], eax
outsb dx, byte [esi]
pop ebp
sbb byte [ebx], dl
outsb dx, byte [esi]
inc esp
sbb al, 0x8d
mov ebx, 0x5c891ed3
pop esp
pushal
je 0x498378
jge 0x4983ed
sub ebp, dword [edx - 0x1d1e9a5a]
scasb al, byte es:[edi]
mov eax, 0x6cce615e
push cs
lcall 0x2576, 0xbd113491
pop ebx
push ebp
pushfd
pop ss
push ds
cmp ah, byte [esi + 0x2d]
and ecx, dword [edx]
lodsb al, byte [esi]
int 0x18
sub ebx, edi
dec edx
jg 0x4983b5
jae 0x498497
mov dword [0xcf54f51b], eax
sbb esi, dword [esi - 0x7c]
jbe 0x4983bd
mov edi, 0x70d0ffd0
mov ch, 0xc2
aas
or eax, 0x5fdabc7a
popfd
sub eax, 0x1e1f7f9d
mov edx, 0xf75afb2f
jl 0x49849b
pushfd
cdq
push esp
mov esi, 0xa85a014d
invalid
mov edi, 0x2edf3001
or bh, dh
or bh, dh
fsub qword [esi - 0x72]
jb 0x498513
mov edi, 0xd900ce8
movsb byte es:[edi], byte [esi]
pop eax
test byte [edi], bl
xchg byte [ecx - 2], ch
invalid
invalid
mov dh, 0x81
pop esi

Function at 0x4a66bc
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [esi], 0xffffffbe
add ecx, edx
lds edi, [eax - 0x335259d4]
popfd
fisttp qword [edi - 0x72]
xor al, 0xd6
add byte [ecx - 0x68], bh
imul byte [ebx + 0x3b1397c3]
invalid