joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42df00
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x56841c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42dfe6
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [eax + 0x88], 0
lea ecx, [0x568730]
mov dword [esp], ecx
call sym.runtime_internal_atomic.Loadint32
mov eax, dword [esp + 4]
test eax, eax
je 0x42dfc2
mov dword [esp + 8], 0
mov ecx, dword [0x56841c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x30]
lea edi, [esp + 0x10]
xor eax, eax
call fcn.004620a9
lea ecx, [sym.runtime._mLockProfile_.captureStack.func1]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 3
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x10]
mov dword [esp], edx
call sym.runtime.systemstack
mov eax, dword [esp + 8]
cmp eax, 0x20
jge 0x42dfbe
jae 0x42dfdb
mov ecx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 8], 0
add esp, 0x2c
ret
lea eax, [sym.runtime._LostContendedRuntimeLock]
inc eax
mov ecx, dword [esp + 0x30]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
add esp, 0x2c
ret
mov ecx, 0x20
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._mLockProfile_.captureStack
Function at 0x440200
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x2c
call sym.runtime.traceAcquire
mov eax, dword [0x56841c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ecx, dword [eax + 0x18]
mov edx, dword [esp]
mov dword [esp + 0x14], edx
mov ebx, dword [esp + 4]
mov dword [esp + 0xc], ebx
inc dword [ecx + 0x7c]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
mov ebp, dword [esp + 0x34]
mov dword [esp + 4], ebp
call sym.runtime.save
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x30]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call sym.runtime.casgstatus
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
ja 0x440285
cmp dword [eax + 4], ecx
jae 0x4402b3
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
lea ecx, [sym.runtime.reentersyscall.func1]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x24]
mov dword [esp], ecx
call sym.runtime.systemstack
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x440309
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
lea eax, [sym.runtime.reentersyscall.func2]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call sym.runtime.systemstack
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call sym.runtime.save
lea eax, [0x52a8c0]
mov dword [esp], eax
call sym.runtime_internal_atomic.Load8
movzx eax, byte [esp + 4]
test al, al
je 0x440342
lea eax, [0x4a75d0]
mov dword [esp], eax
call sym.runtime.systemstack
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call sym.runtime.save
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
test byte [ecx], al
mov ecx, dword [ecx + 0x11a0]
test ecx, ecx
je 0x44037e
lea eax, [0x4a7690]
mov dword [esp], eax
call sym.runtime.systemstack
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call sym.runtime.save
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x58]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x1f8], edx
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
lea edx, [ecx + 4]
mov dword [ecx + 0x2c], 0
mov ebx, dword [eax + 0x18]
mov dword [ebx + 0x60], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x58], 0
mov dword [esp], edx
mov dword [esp + 4], 2
call sym.runtime_internal_atomic.Store
lea eax, [0x52a8b4]
mov dword [esp], eax
call sym.runtime_internal_atomic.Load8
movzx eax, byte [esp + 4]
test al, al
je 0x4403f6
lea eax, [0x4a75cc]
mov dword [esp], eax
call sym.runtime.systemstack
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call sym.runtime.save
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x7c]
add esp, 0x2c
ret
Function at 0x450650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x56841c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4507ca
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x4507c0
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x4506aa
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4506aa
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x4506bd
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x450797
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x45078b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x450782
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x450710
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x450753
mov eax, 1
cmp eax, ecx
ja 0x450747
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call sym.runtime.panicSliceBU
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x45077d
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x45074c
mov ecx, dword [esp + 0xc]
jmp 0x450715
call sym.runtime.panicIndexU
xor eax, eax
mov ecx, eax
call sym.runtime.panicIndex
call sym.runtime.panicSliceBU
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x4507bb
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x450790
mov ecx, dword [esp + 0x18]
jmp 0x4506c2
call sym.runtime.panicIndexU
xor eax, eax
mov ecx, eax
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.step
Function at 0x457c70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x56841c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x457df4
sub esp, 0x24
movzx eax, byte [esp + 0x28]
movzx ebx, al
add ebx, dword [edx + 4]
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
mov edi, esi
shl esi, 8
or ebp, esi
shr edi, 0x18
movzx esi, byte [ebx + 2]
mov ecx, esi
shr esi, 0x10
or esi, edi
shl ecx, 0x10
or ecx, ebp
movzx ebp, byte [ebx + 3]
mov edi, ebp
shr ebp, 8
or ebp, esi
shl edi, 0x18
movzx esi, byte [ebx + 4]
or esi, ebp
movzx ebp, byte [ebx + 5]
shl ebp, 8
or esi, ebp
movzx ebp, byte [ebx + 6]
shl ebp, 0x10
or ebp, esi
movzx ebx, byte [ebx + 7]
shl ebx, 0x18
or edi, ecx
or ebx, ebp
movzx ebp, byte [esp + 0x29]
xchg ebp, eax
cmp al, 8
xchg ebp, eax
jae 0x457d81
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], edi
shl ebp, 3
lea ecx, [ebp - 0x40]
neg ecx
mov byte [esp + 0xa], cl
shl ebx, cl
mov esi, edi
shl esi, cl
add ebp, 0xffffffe0
mov ecx, ebp
shr edi, cl
neg ecx
mov byte [esp + 0xb], cl
mov eax, dword [esp + 0x18]
shl eax, cl
mov dword [esp + 0x18], eax
movzx edx, byte [esp + 0xa]
cmp dl, 0x20
sbb eax, eax
mov dword [esp + 0x14], eax
and ebx, eax
and esi, eax
mov ecx, edx
shr esi, cl
and esi, eax
xchg ebp, eax
cmp al, 0x20
xchg ebp, eax
sbb eax, eax
and edi, eax
or edi, ebx
movzx edx, byte [esp + 0xb]
cmp dl, 0x20
sbb ebx, ebx
mov edx, dword [esp + 0x18]
and edx, ebx
or edi, edx
mov edx, ecx
mov ecx, ebp
mov ebp, edi
shl edi, cl
and edi, eax
or edi, esi
movzx ecx, byte [esp + 0xb]
mov eax, ebp
shr ebp, cl
and ebp, ebx
mov ecx, edx
shr eax, cl
mov ebx, dword [esp + 0x14]
and ebx, eax
or edi, ebp
mov edx, dword [esp + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
mov eax, dword [edx + 8]
mov dword [esp + 0x1c], eax
call sym.runtime.printlock
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call sym.runtime.printhex
call sym.runtime.printunlock
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x28]
mov byte [esp], cl
movzx ecx, byte [esp + 0x2a]
mov byte [esp + 1], cl
call eax
movzx eax, byte [esp + 4]
test al, al
jne 0x457df0
call sym.runtime.printlock
lea eax, [0x4bd394]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.runtime.printstring
call sym.runtime.printunlock
add esp, 0x24
ret
call sym.runtime.morestack
jmp sym.runtime.printArgs.func2
Function at 0x459590
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x56841c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45962b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x56841c]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004620a7
lea ecx, [sym.runtime.callers.func1]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call sym.runtime.systemstack
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime.callers
Function at 0x45ec80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x56841c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45ee13
sub esp, 0x24
mov eax, dword [esp + 0x28]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x20], ecx
nop
mov dword [esp], ecx
call sym.runtime.lock2
mov eax, dword [esp + 0x28]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x45edfc
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call sym.runtime._pollDesc_.publishInfo
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], ecx
call sym.runtime.netpollunblock
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
lea edx, [esp + 0x14]
mov dword [esp + 0xc], edx
call sym.runtime.netpollunblock
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test ecx, ecx
je 0x45ed68
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call sym.runtime.deltimer
mov eax, dword [0x5684b8]
test eax, eax
jne 0x45ed4f
mov eax, dword [esp + 0x28]
jmp 0x45ed5d
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
call sym.runtime.gcWriteBarrier1
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x45ed9f
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call sym.runtime.deltimer
mov eax, dword [0x5684b8]
test eax, eax
jne 0x45ed8a
mov eax, dword [esp + 0x28]
jmp 0x45ed98
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x78]
call sym.runtime.gcWriteBarrier1
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym.runtime.unlock2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x45edc5
mov dword [esp], eax
mov dword [esp + 4], 3
call sym.runtime.netpollgoready
mov eax, dword [esp + 0x18]
test eax, eax
je 0x45eddd
mov dword [esp], eax
mov dword [esp + 4], 3
call sym.runtime.netpollgoready
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45edf8
nop
lea ecx, [0x56837c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sym.runtime_internal_atomic.Xadd
add esp, 0x24
ret
lea eax, [0x4a48af]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.internal_poll.runtime_pollUnblock

Function at 0x461da0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x568306], 0
je 0x461dba
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x461dc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x568306], 0
je 0x461ddb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback
Function at 0x462c00
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x462c1a
mov ecx, 0x14
jmp 0x462c23
shl ecx, 2
add ecx, 0xe10
mov dword [0x56841c], ecx
ret
Function at 0x487740
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x56841c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4877e1
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x4877d7
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x4877d7
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x4877d7
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x4877d7
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x4877d7
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x4877d7
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x4877d7
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x4877d7
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x4877d7
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x4877d7
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x4877d9
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x100ac0bb
Capabilities:
Encode data using xor

Disassembly:
fsub dword [esi + 0x3b]
aad 0xf5
add edi, eax
jmp edi
shl dword [esi - 0x7b], 0xfc
cmp bl, dl
xor ecx, 0x2ad75922
jmp 0x10286047
xlatb
sub ch, cl
mov word [edi + 0x4481001d], ds
add dword [esp + 0x10], 0x67b70f9f
invalid
invalid
add dword [esp + 0x10], 0x67b70f9f
call fcn.10143ab8
call fcn.101906ab
nop
in al, dx
outsb dx, byte [esi]
sbb byte [esi + 0x142a4643], cl
bound edx, qword [ecx + eax*4]
lodsd eax, dword [esi]
cmp ecx, edx
aaa
push ss
add dword [ebx], ecx
call 0xc79337e0
pop ds
cmp al, 0xad
sub byte [esi], bh
test al, 0xb0
ja 0x100ac0aa
xchg esi, eax
xchg edx, eax
xor ebx, dword [edi - 0x59]
jae 0x100ac07e
in al, dx
sub dword [eax - 0x3b0af16a], edi
pushfd
push eax
jb 0x100ac0f4
and dword [esp + ebp - 0x50], edx
push cs
push 0xf6bb8ed3
mov eax, dword [0x31a49aeb]
les ebx, es:[edx - 0xb755929]
salc
mov byte [edx - 3], cl
ja 0x100ac0b4
pop edi
mov word [esi], fs
xlatb
pop esi
cwde
add ah, bh
inc esp
cmpsb byte [esi], byte es:[edi]
add al, byte [ebx + 0x782358d4]
pop esp
mov byte [0xc7364647], al
mov dl, 0x73
fst dword [esi]
xor eax, 0x54f84869
clc
push esp
add eax, 0xb0f0a9b3
pop ss
adc ebp, esi
int1
pop eax
inc eax
jle 0x100ac187
cmpsd dword [esi], dword es:[edi]
add dword [ebp + 0x23d3bc40], edx
fcom qword [eax]
leave
call 0x2b38bfcc
push ebp
lodsd eax, dword [esi]
or byte [edx], dh
rcl byte [eax + 0x753eb616]
jg 0x100ac13a
push ds
mov eax, 0x81412676
leave
add ah, ah
push esp
push dword [esi]
xor dl, byte [0x5f7dacf6]
aas
push 0x72
sbb dword [esp + eax*4], 0xfd66d158
xlatb
invalid
pop es
in eax, dx
cmp al, 0x7b
sbb edi, dword [ebx + 0x5150428]
out dx, al
dec eax
retf 0x314a
jmp ebp
dec ecx
clc
test ebx, 0xc440064
test esi, edi
neg ecx
test esi, 0x39f6739f
xor ebx, ecx
add ebp, ecx
jmp 0x10132ab8
bswap ecx
jmp 0x102620ef

Function at 0x100f966b
Capabilities:
Encode data using xor

Disassembly:
jg 0x101bcd74
not cx
push ebx
cmp ebx, dword [esp]
mov esi, dword [esp + 0x2c]
setne byte [esp + 0x20]
call fcn.1027dba2
xchg ecx, ecx
seta cl
mov dword [ebp + 8], eax
not cl
xchg cx, cx
pushfd
pop dword [ebp]
sub edi, 4
shr cl, cl
btr ecx, 0xd8
mov ecx, dword [edi]
cmp bp, di
xor ecx, ebx
cmc
xor ecx, 0x6da11d7f
add ecx, 0x2d704b5e
cmc
jmp 0x1034d1dc
push esi
ret
ror ecx, 1
clc
cmp dx, si
not ecx
cmp ecx, esi
cmp cl, 0xa8
xor ecx, 0x6ac81f13
stc
clc
xor ebx, ecx
test cx, si
test esi, 0x13212ddd
add esi, ecx
jmp 0x10329827

Function at 0x10147bae
Capabilities:
Encode data using xor

Disassembly:
add ebp, ecx
jmp 0x10169348
jmp 0x100fcd5c
call fcn.1041b73e
inc esp
xor byte [esi + 0x6e], bh
sti
stosb byte es:[edi], al
dec edi
jl 0x10147c0b
outsb dx, byte [esi]
fcom dword [eax - 0x2849cdab]
je 0x10147ba9
mov byte [ebp + 0x54216817], cl
aad 0xae
or edi, dword [edx + 0x2738f102]
out dx, al
iretd
jmp 0x10147c2e
jecxz 0x10147c97
and dword [ecx - 0x50], esp
imul esi, dword [edi + 0x63fa87bc], 0xffffffb6
invalid
sub eax, 0xcb0fc988
test byte [esi + 0x372c114], ah
push esi
sub eax, dword [ecx - 0x58]
mov al, byte [0x5f883830]
test dword [ecx], 0xc370c537
adc ecx, dword [ebx + edx*2]
push esi
xchg cl, ah
rcl byte [ebp + 0x113dd4da]
pushal
invalid
push ebp
ret
Function at 0x1016934c
Capabilities:
Encode data using xor

Disassembly:
add word [esp + 4], 0x36de
mov esi, dword [esp + 0x18]
mov esi, dword [esi + ecx*2 - 0x4bc7f532]
sub byte [esp + 0xc], cl
seto byte [esp + 4]
mov dword [esp + 0x18], ecx
push esi
push edi
lea esi, [esi + ecx*4 - 0x2724c65a]
mov edi, dword [esp + 0x14]
mov dword [esp + 4], edi
neg byte [esp + 0xc]
call fcn.1033ca2e
bound eax, qword [esi + edx + 0x7ea2cfe0]
sub eax, 0xe3028cd
xchg ebx, eax
pop esi
push esp
xor eax, 0xd9e434f4
xchg byte [eax + 0x28], bh
div byte [ecx]
cmp al, 5
insd dword es:[edi], dx
invalid

Function at 0x1018d082
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ebp, dword [esp + 0x10]
mov ebp, dword [ebp + esi - 0x6c3e]
call fcn.1038bf7c
sub ah, dl
and ebp, dword [edi]
xor al, 0xb1
dec eax
and edx, eax
mov cs, word [edi + 0x65d00ce0]
sbb byte [esp + edi + 0x64], cl
sbb dh, ah
cmp edi, dword [edi - 0x1fcdeadb]
pop ds
adc al, 0xfa
mov esi, 0x98e48c3a
cmp eax, 0xda999012
loop 0x1018d122
pop esp
pop esp
sti
mov dword [ebx + 0x6cfd7062], ebp
arpl word [esi], bp
mov dl, 0
and eax, 0xf8496ce4
in al, dx
fmul qword [eax + 0x4e]
aas
imul esi, ebx, 0xffffff90
test al, 0xc7
ret
enter 0x4949, 0x17
sub byte [edx + 2], 0x17
pop ss
nop
xor al, 0x98
jbe 0x1018d11b
xlatb
jno 0x1018d0d1
out 0xba, eax
xor ecx, esi
jmp 0x67f258fa

Function at 0x10297875
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx + edx*8 + 0x10e244f1]
seta byte [esp + 0x10]
jg 0x102d7e5a
inc edx
stc
clc
rol edx, 2
jmp 0x10418717
mov dword [esp + edx*2 - 0x5212ef9e], ebp
xor dword [esp + 0x10], 0x51d97e0c
push 0x479656d5
test dword [esp], 0x2b705498
call fcn.103004b6
inc edx
cmp bh, bl
clc
xor ebx, edx
stc
cmp di, si
clc
add edi, edx
push edi
ret

Function at 0x1036f52d
Capabilities:
Encode data using xor

Disassembly:
xor cl, cl
add ecx, ecx
call fcn.103c9b12
xchg esi, eax
sbb eax, 0x4d61028
xor eax, 0xc6e41fbb
adc al, byte [edi + eax*4]
mov dword [ebx + 0x52376286], edi
jno 0x1036f56a
cdq
pop eax
dec esp
outsb dx, byte [esi]
or dword [esi], edi
mov al, 0x5c
dec esi
cmp edi, eax
invalid
adc dl, byte [eax - 0x39590125]
sub byte [edx], dh
sbb dword [edi - 4], 8
sub al, 0x5f
loop 0x1036f596
idiv byte [eax]
pop edx
pop edi
insd dword es:[edi], dx
mov ah, 0x60
out 0xe6, al
aaa
jne 0x1036f54a
sub ch, byte [edi]
and al, 0xba
pop ss
push ss
stosb byte es:[edi], al
mov ebp, 0x39db8a8
cmpsd dword [esi], dword es:[edi]
arpl di, ax
mov esi, 0x6f5be214
adc al, 0xe2
pop ebx
outsd dx, dword [esi]
lodsd eax, dword [esi]
sub byte [eax], dh
adc dh, byte [eax]
push edx
mov bl, 0x56
xor al, 0x52
pop ss
lodsd eax, dword [esi]
invalid
Function at 0x103bf8a1
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.10404942
rol byte [ecx + 0x6723a6fc], 1
dec esi
clc
xor ebx, eax
add ebp, eax
jmp 0x1033b900
push cs
mov dl, byte [esi + 2]
test dx, ax
sub esi, 2
test si, 0x3c8b
add cl, dl
not dh
jmp fcn.1032ab26
push ebp
pushfd
mov ebp, 0x76d253f5
mov dword [esp + 0x14], ecx
push esi
push edx
mov esi, ebp
mov si, 0x2625
add dword [esp + 0x10], 0xfffba6eb
call fcn.103585c7
dec edi
mov ebp, 0x6ee35878
jb 0x103bf873
sahf
loop 0x103bf84f
or dword [ebx], esp
cmp dh, cl
mov al, 0xfe
push edx
jne 0x103bf93d
inc esi
lodsd eax, dword [esi]
imul ecx, dword [edi - 0x2a646d78], 0x7822444f
jle 0x103bf8f6
xor byte [ecx + 0x1f], cl
or ch, byte [ecx + ebx*4 - 0x51]
and al, 0x83
ret 0x327f
pop ebx
js 0x103bf94a
invalid
je 0x103bf956
sub eax, 0xd8bcc98b
dec esi
mov ah, 0x3d
pop edi
mov byte [0xa0e1d3a8], al
inc edi
pop ecx
push ss
or al, 0xf7
invalid
neg ebp
stosd dword es:[edi], eax
pop esp
fld qword ds:[ecx]
push ebx
pop ebp
pop ebp
dec esp
into
and eax, edx
lahf
lodsd eax, dword [esi]
pushfd
imul esp, dword [ebx - 0x1360bc30], 0x60
lahf
in al, dx
pushal
pop ss
jae 0x103bf98a
dec esi
scasd eax, dword es:[edi]
push edi
push edx
jecxz 0x103bf921
adc dword [edi], ecx
xor al, 0x9d
rol byte [ebp - 0x33ec826f], 1
sub byte [ecx + 0x31f74008], 0x1d
bound esi, qword [ebx + 0x6f]
push edi
lodsd eax, dword [esi]
mov ebp, 0xc98cdf37
adc ebx, esp
lcall 0xcfee, 0xdf217772
sbb al, 9
jg 0x103bf9d7
jb 0x103bf935
int 0xe4
and eax, 0x856209f8
pop ebp
or byte [edi - 0x41], bl
bound eax, qword [ebp - 0x40a0f7a3]
test byte [ebp + 0x1edb4ad4], cl
mov cs, word [ebx - 0x789b9d85]
add ebp, dword [ebp + 0xf2a5a44]
nop
rol byte [esi + 0x65893bd5], 1
sbb eax, 0xd5cd7a4a
into
out dx, eax
mov cs, word [ebx + 0x1103759a]
ljmp 0x1c92
inc esp
xchg ebp, ecx
sbb eax, 0x734bbb66
sar dword [esi - 0x45], cl
in eax, 0x94
and eax, dword [ebx - 0x45]
imul edi, dword [eax + edi*2 + 0x73540258], 0xad809eaa
or byte [ebx], ah
cmp al, bl
mov edx, 0x427552ff
pop esp
lodsb al, byte [esi]
imul ecx, dword [edi - 0x2a65470e], 0x792c364f
jle 0x103bfa1c
pop esi
ja 0x103bfa2a
or ch, byte [edi + eax*4 - 0x7f]
and eax, 0x886c283
xlatb
lea ebp, [ecx - 0x76]
clc
and al, 0xd0
pop ebx
sub dl, byte [edi - 0x3a]
xchg ebp, eax
jl 0x103bfa42
daa
pop ss
dec esp
push ebp
dec bh
sti
lcall 0x38ef, 0x85109c9e
mov ah, 0xd7
sbb byte [edx + edi + 0x33], cl
ja 0x103bfa3d
pop ebx
out 0xf, al
cmp dword [edi], ebx
pop ds
add dword [ecx + 0xc345a0c], ecx
or al, 0x5a
xor al, 0xc
jp 0x103bfa54
mov dword [0xb2b73fa3], eax
ffree st(0)
jno 0x103bfa40
salc
imul ecx, dword [ecx], 0x50
push edx
or dh, dl
ljmp 0x1ffb