joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b90dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov dword [esp], edx
mov esi, eax
mov byte [esi + 0x104], 0
mov byte [esi + 0x105], 0
xor ebp, ebp
xor ebx, ebx
lea edi, [esp + 4]
xor eax, eax
mov al, bl
mov byte [esi + eax + 4], bl
lea eax, [ebx + 0xd]
and al, 0xff
mov byte [edi], al
mov eax, dword [esp]
call fcn.00405078
test eax, eax
jle 0x4b9144
mov eax, dword [esp]
call fcn.00405078
push eax
xor eax, eax
mov al, bl
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [esp]
mov al, byte [eax + edx]
push eax
mov eax, dword [esp + 4]
call fcn.00405078
pop edx
add dl, al
xor byte [edi], dl
inc ebx
inc edi
test bl, bl
jne 0x4b9101
xor ebx, ebx
lea eax, [esp + 4]
xor edx, edx
mov dl, bl
mov dl, byte [esi + edx + 4]
xor ecx, ecx
mov cl, dl
add ebp, ecx
xor ecx, ecx
mov cl, byte [eax]
add ebp, ecx
and ebp, 0x800000ff
jns 0x4b9174
dec ebp
or ebp, 0xffffff00
inc ebp
mov cl, byte [esi + ebp + 4]
mov edi, ebx
and edi, 0xff
mov byte [esi + edi + 4], cl
mov byte [esi + ebp + 4], dl
inc ebx
inc eax
test bl, bl
jne 0x4b9150
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b9424
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b95c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404db8
mov dl, 1
mov eax, dword [0x4b904c]
call fcn.00403e98
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b9567
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004b93a0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004b90dc
xor esi, esi
mov ebx, 8
mov eax, dword [ebp - 8]
call fcn.004b919c
xor al, byte [esi + 0x4d5e34]
and al, 0xf
and eax, 0xff
lea ecx, [ebp - 0x10]
mov edx, 1
call fcn.004096c8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00405080
mov eax, dword [ebp - 4]
inc esi
dec ebx
jne 0x4b9483
mov eax, dword [ebp - 4]
mov edx, 0x4b95dc
call fcn.00405080
mov eax, dword [ebp - 4]
mov edi, 3
mov ebx, 4
mov eax, dword [ebp - 8]
call fcn.004b919c
xor al, byte [esi + 0x4d5e34]
and al, 0xf
and eax, 0xff
lea ecx, [ebp - 0x14]
mov edx, 1
call fcn.004096c8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00405080
mov eax, dword [ebp - 4]
inc esi
dec ebx
jne 0x4b94d1
mov eax, dword [ebp - 4]
mov edx, 0x4b95dc
call fcn.00405080
mov eax, dword [ebp - 4]
dec edi
jne 0x4b94cc
mov ebx, 0xc
mov eax, dword [ebp - 8]
call fcn.004b919c
xor al, byte [esi + 0x4d5e34]
and al, 0xf
and eax, 0xff
lea ecx, [ebp - 0x18]
mov edx, 1
call fcn.004096c8
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00405080
mov eax, dword [ebp - 4]
inc esi
dec ebx
jne 0x4b951d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b956e
mov eax, dword [ebp - 8]
call fcn.00403ec8
ret
Function at 0x4b9634
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b970a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4b904c]
call fcn.00403e98
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b96ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004b93a0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004b90dc
xor edi, edi
test ebx, ebx
jge 0x4b9698
mov eax, dword [ebp - 4]
call fcn.00405078
mov ebx, eax
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.00405404
mov esi, ebx
test esi, esi
jle 0x4b96d7
mov ebx, 1
mov eax, dword [ebp - 0xc]
call fcn.004b919c
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor al, dl
xor al, byte [edi + 0x4d5e34]
push eax
mov eax, dword [ebp - 8]
call fcn.004052d0
pop edx
mov byte [eax + ebx - 1], dl
inc edi
inc ebx
dec esi
jne 0x4b96ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b96f4
mov eax, dword [ebp - 0xc]
call fcn.00403ec8
ret

Function at 0x4b9718
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b97ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4b904c]
call fcn.00403e98
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b97e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004b93a0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004b90dc
xor edi, edi
mov eax, dword [ebp - 4]
call fcn.00405078
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00405404
mov eax, dword [ebp - 4]
call fcn.00405078
mov esi, eax
test esi, esi
jle 0x4b97cc
mov ebx, 1
mov eax, dword [ebp - 0xc]
call fcn.004b919c
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor al, dl
xor al, byte [edi + 0x4d5e34]
and eax, 0xff
mov ecx, 0x19
xor edx, edx
div ecx
add edx, 0x61
push edx
mov eax, dword [ebp - 8]
call fcn.004052d0
pop edx
mov byte [eax + ebx - 1], dl
inc edi
inc ebx
dec esi
jne 0x4b9791
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b97e9
mov eax, dword [ebp - 0xc]
call fcn.00403ec8
ret
Function at 0x59df66
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [ebx + 0x75659946]
lea eax, [esi*4 - 0x7a58aca5]
pushal
setbe ah
nop
bswap eax
mov al, 0x20
pushfd
jmp 0x847e84
insd dword es:[edi], dx
xor dword [eax + 0x3116e5a3], eax
add byte [ebp + 0x2c], bh
push edi
mov eax, dword [esp + 0x24]
call fcn.00b79a61
jo 0x847e42
scasb al, byte es:[edi]
mov ch, byte [0x4e774af7]
inc ebx
jbe 0x847f04
outsb dx, byte [esi]
jg 0x847eca
jg 0x847ef7
inc edx
scasd eax, dword es:[edi]
out dx, al
idiv byte [ebx - 0xe5f6c1c]
push ebx
adc dword [eax - 0x46], eax
in al, 0x42
inc ebx
insb byte es:[edi], dx
push ecx
js 0x847f08
dec esp
insd dword es:[edi], dx
inc ecx
jecxz 0x847f03
mov bh, 0xa5
sbb eax, 0xb3c3ebe2
adc eax, 0xc122b077
xchg edi, eax
test byte [edx - 0x3558fff6], ch
pop es
fisub word [ebp + 7]
inc eax
xor eax, 0xcd899b96
out dx, eax
clc
mov ecx, 0x36d2aeb9
and dword [ebx + 0x685ae750], eax
mov byte [esi + 0x23b8b395], bl
cmp byte [ecx], bl
jl 0x847f63
cmpsd dword [esi], dword es:[edi]
retf 0xde07
lds ebx, [bx + di + 0x32]
and edi, dword [0x42d53837]
aad 0x42
les ebp, [ebp - 0x7e]
cmp dword [ecx], esi
and eax, 0x59004530
xor dword [esi], edi
and eax, 0x59004530
add byte [ecx + 0x34], bl
push ebp
pop ecx
xor al, 0x55
adc al, 0x61
popal
cmp al, 0x4d
and al, 0x61
mov byte [0x1f057efc], al
inc ecx
inc ecx
push edx
adc eax, dword [esi + 0x3d]
std
pop edi
inc eax
mov dword [0xffeee5f7], ebp
invalid
jl 0x847efd
int3

Function at 0x5ab523
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov esi, 0x4428f0
pushfd
mov word [esp + 8], 0x7fb
inc esp
and al, 8
sti
pop es
call fcn.00b6d00c
call fcn.00ba814f
out 0x44, al
daa
push ebx
push edi
neg dword [ebx + ebx*4 - 0x70794c5a]
cmpsb byte [esi], byte es:[edi]
mov edx, dword [edx - 0x41707d6d]
wait
ficomp dword [ecx]
pushal
fldcw word [eax]
push eax
movsb byte es:[edi], byte [esi]
pushfd
leave
sal byte [0x5486cad5], 0x5e
xor dl, byte [0x6cd556]
pop esi
mov ecx, 0x99804fcf
jb 0x5ab52c
stosb byte es:[edi], al
cdq
clc
add byte [edi - 0x72e0e7dc], 0x62
inc ebp
in al, dx
pop gs
inc eax
mov ch, 0x8c
invalid
Function at 0x5ae7ae
Capabilities:
Encode data using xor

Disassembly:
and al, 0xc
popfd
push ecx
push dword [esp + 0x14]
ret 0x18
pushfd
push dword [esp]
mov byte [esp], 0xa7
nop
push 0x1259da1f
call fcn.00b84e39
and byte [edx - 0x8a8de9b], al
add dword [edi - 0x5047c6e4], edi
mov esi, 0x271c382c
daa
test dword [eax - 0x7617171b], ebx
mov esi, 0xc679ef7d
mov ecx, 0x4e467553
dec ecx
push eax
pop ecx
push esp
jge 0x5ae835
jns 0x5ae867
insd dword es:[edi], dx
inc eax
loop 0x5ae7d2
add dword [eax - 0x3d], ebp
xchg dword [eax], edi
fimul dword [edx + 0x39089909]
push 0xda3887c3
mov cl, byte [ecx]
cdq
or byte [ecx], bh
cdq
mov esp, edi
enter 0x6595, 0x5a
adc eax, 0x32800b55
loopne 0x5ae858
jne 0x5ae7a3
pop ebx
dec ebp
sal byte [0xa3654aec], 1
pop edx
mov ecx, 0xe4dfdf82
pop edx
jne 0x5ae7f0
jns 0x5ae87b
jae 0x5ae833
sal dword [edx + 0x2d], 1
push edi
adc byte [0xd94dd3b3], dl
retf 0xdcc6
aas
add byte [esi + eax + 0x15], bh
clc
sbb ebp, dword [eax - 0x73cedef]
jl 0x5ae83d
adc eax, 0x11a81bf8
adc al, bl
clc
ret
fmulp st(5)
sub byte [0x38297062], al
aas
adc byte [esi + 0x3e], 0xe3
push esi
dec edx
sbb ch, byte [ebx - 0x55354d8c]
cmpsb byte [esi], byte es:[edi]
push 0x92ad6bd1
lodsd eax, dword [esi]
xchg edx, eax
mov ecx, es
leave
or esp, dword [esi]
xor eax, 0xf7024b73
push ss
sub eax, 0x976e5770
push edi
outsb dx, byte [esi]
xchg edi, eax
pushfd
and dword [eax], 0xc36dbed7
or dh, ch
call 0x9914cd30
dec ebp
push cs
and al, byte [edx + 0x4adc0d3f]
arpl sp, dx
js 0x5ae85a
cmp byte [edi], 0xd
fmul qword [edx + 0x63]
aam 0x78
salc
stc
and eax, 0xbe791685
scasd eax, dword es:[edi]
add dh, 0x35
int 0x90
nop
scasd eax, dword es:[edi]
lodsb al, byte [esi]
pop ebx
inc esi
lcall 0x9736, 0x460f227d
push edi
nop
jmp 0xcd3ac48e

Function at 0x694a7e
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 0x10], di
xor edi, 0x428a2a33
cmc
call fcn.008bdc8a
cmp bx, di
xor eax, 0x9bc29806
cmp bh, 0x45
push dword [esp + 0x24]
popfd
mov byte [esp + 8], dl
push dword [esp + 0x28]
ret 0x2c
pushfd
jmp 0x94bae5
clc
xor eax, 0x619ba5e1
clc
xor dword [esp + 0x24], 0x880
clc
xor ebp, 0x8185f55d
jmp 0x5b01aa
pop dword [esp + 0x20]
mov byte [esp + 0x10], dl
xor esi, 0x351242d6
clc
push edx
xor edx, 0x7c510717
jmp 0xade383
adc byte [ecx + 0x1242d6f6], al
xor eax, 0xf28152f8
pop ss
pop es
push ecx
jl 0x927e01
sbb eax, dword gs:[bx + si]
call fcn.00b83644
les esp, [esi + 0x49]
mov bl, byte [edi]
idiv edx
f2xm1
loope 0x927e08
int1
push 0x71
push 0xf9141335
cmpsb byte [esi], byte es:[edi]
in eax, 0xd7
jno 0x927e41
sub esi, dword [esi - 0x2c]
sub bl, byte [edx + 0x2b]
in al, dx
invalid
rcr ecx, 1
salc
out dx, eax
invalid
xchg dword [esp + 0x10], edx
jmp 0x9717b6
mov edx, 0x4b6710
mov byte [esp + 0xc], ch
jmp 0x97f4f1
mov edx, dword [edx + 0x2a5b3d]
jmp 0x927e1c
xor ecx, 0x68a2c56a
jmp 0x8f618d

Function at 0x6a9421
Capabilities:
Packed with generic packer

Disassembly:
pushal
nop
pushfd
xchg dword [esp + 0x20], eax
not ah
cwde
movzx eax, bl
mov eax, 0x439650
jmp fcn.004cdd52
Function at 0x6f0af9
Capabilities:
Encode data using xor

Disassembly:
pushal
jmp 0x8e8e64
xchg byte [esi + 0x1a4eea9d], bh
cmp dword [ecx + edi*2], ebp
sub al, 0x24
pop es
movsd dword es:[edi], dword [esi]
mov edi, 0xc9335b87
ljmp 0x7ab2
nop
pushfd
pushal
xchg dword [esp + 0x40], eax
not ax
pushfd
pop eax
push edx
mov eax, 0x460957
pushfd
call fcn.008d57c4
xchg ecx, eax
xor edx, dword [edx + edi*2]
and esi, edi
xor dword [esi], ecx
daa
jbe 0x8e8eeb
pop edx
or al, byte [esi - 0x70]
xchg edi, eax
jp 0x8e8e15
pop edx
xchg ecx, eax
invalid
inc edi
jne 0x8e8f57
bound esi, qword [edi]
dec edi
push esp
sub byte [edi], ah
push 0xf
push edx
adc ecx, dword [eax + 0x67941247]
invalid
lodsb al, byte [esi]
rol esi, 1
push edi
hlt

Function at 0x766684
Capabilities:
Packed with generic packer

Disassembly:
fnsave dword [esi + edi*4 + 0x75]
bound esp, qword [ecx + 0x122a528f]
push esp
or byte [ebx - 0x47565f7d], 0xad
punpckhdq mm4, qword [ecx + 0x1f]
pop ds
out dx, al
mov dword [ebx + 0x45], edi
xor dword [ebx - 0x5b3e2ee], edi
int 0xe1
inc ecx
movsb byte es:[edi], byte [esi]
cmc
push eax
sub eax, 0x470666d1
bound edi, qword [edx + ecx - 0x11]
or ch, bh
insd dword es:[edi], dx
salc
jbe 0x766690
push ecx
jb 0x7666a2
pop ecx
dec eax
aas
inc ebp
inc ebx
pop esp
add eax, 0x686a1605
jg 0x76660b
dec ebx
inc ecx
cli
sbb al, 0x54
dec ebx
rcl byte [edx - 0x17ecfb7b]
fnstsw word [edi - 1]
test al, 0x47
and eax, 0x26a70536
mul ebx
dec ebp
inc esp
dec esp
push ebx
jne 0x7666b3
pop ebx
push es
push edi
sbb dh, byte [edi + 0x36]
jae 0x76668f
jg 0x766681
dec ebx
xor dl, byte [eax - 0x4a20d350]
xchg ecx, eax
ja 0x7666e5
cmp eax, 0x1aba5e60
adc al, 0x4b
add byte [eax + 0x69], ch
xchg ecx, eax
invalid
mov edx, 0x4b141a
push 0xc43e9169
call 0xbc6dd9
jp 0x76662c
inc esi
pop es
inc esi
add byte [edx - 0x69], bh
jbe 0x766639
cmp esi, edi
dec ebp
jle 0x7666e7
push 0x63
dec esi
and edi, dword [eax + 0x389a81a3]
shr dword [esi - 0x6e], cl
and al, 0xb8
lahf
cmp eax, 0x40dfd3a3
lodsd eax, dword [esi]
sbb dword [edx - 0x6d912cc8], 0x3d9fb824
mov dword [0xad40dfd3], eax
mov ebp, dword [esp - 0x79407155]
wait
mov ah, byte [ebx - 0x2879605e]
mov dh, bl
lcall 0xb173, 0xdcb8d81b
inc ecx
movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
invalid
lodsd eax, dword [esi]
push edx
push edi
add esp, dword [ebx - 0xb]
arpl word [edi + edi*4], si
loopne 0x7666c9
int3
dec esi
not dword [ebp + 0x3012cef1]
xchg ebp, eax
int1
into
adc dh, byte [eax]
loop 0x76674c
popal
xchg dword [eax + 0x73d190d9], edi
out 0x68, eax
sub esp, dword [ebp - 2]
push es
ljmp 0x479e
push dword [esp]
lea esp, [esp + 8]
jmp loc.004c0e71
Function at 0x872e2b
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x34], esi
not esi
mov esi, 0x447a49
jmp 0xa3adbf
mov esi, dword [esi + 0x4c9bc9]
pushfd
mov dword [esp + 0xc], 0x6c1b4d27
mov word [esp], sp
dec ebp
sbb ebp, dword [esi - 0x77]
and al, 0x24
lea esi, [esi + 0x2b7d3697]
call fcn.0072f7fc
adc al, 0xb6
cdq
pop ebx
push cs
idiv dword [ebp + 0x60]
pushal
inc ecx
dec eax
dec ecx
je 0xa3ae43
dec eax
popal
jns 0xa3ae37
insd dword es:[edi], dx
js 0xa3adcb
mov dh, 0x42
insd dword es:[edi], dx
push ds
or dword [ebx], ebp
push ss
jp 0xa3ade4
out dx, eax
pushal
invalid
inc eax
mov ecx, 0x8f9e7885
leave
mov edi, 0x43fb0b1f
inc ebx
ljmp 0x3e31:0x5769c814

Function at 0x8d4b1c
Capabilities:
Packed with generic packer

Disassembly:
invalid
movsx ebx, al
push eax
mov ebx, 0x402a57
pushfd
call fcn.005abc53
loopne 0x63804d
and eax, 0xc1f74e88
shr ch, 0xd0
loope 0x637ffd
cmc
clc
stc
cld
fnstcw word [esp + ebp*8 + 0x60c2f5f9]
aas
lcall 0x2082, 0xe7c29684
inc esp
jae 0x637ff7
invalid
dec esi
dec esi
pop ebp
inc dl
loope 0x6380b4
ret 0x6ab5
loope 0x6380a2
invalid
mov ebx, 0xa7f2c942
ffreep st(4)
pop ebx
or dword [ecx], ebx
pop esp
sub eax, 0x11783d60
push eax
sbb dword [ecx + eax - 0x5d], ebp
ror dword [ebx + esi*4 + 0x3d687b30], 4
jmp 0xf7b20993
adc dword [eax + 0x19], edx
insb byte es:[edi], dx
add dword [ebx + 0x30b38cc1], esp
jnp 0x638128
cmp eax, 0x88cce904
dec esi
div edi
in al, 0xf1
loopne 0x6380a1
hlt
sbb edi, dword [ecx + 0x4c8dec4d]
or bh, byte [esp + ebp*4 - 0x6074ad97]
aaa
aas
hlt
mov dh, 0xb3
cmc
enter 0xc03, 0x75
or eax, 0x434c4e32
loope 0x63816c
adc ecx, eax
popal
jg 0x63818e
xchg edx, eax
jge 0x63810a
fmul qword [ebx]
sbb byte [ebx - 0x56447db7], ah
fsubr st(2), st(0)
invalid
enter 0xfffffffffffff9d6, 0xffffffffffffff91
mov esi, 0x2944b5d9
sub byte [edi - 0x24], ah
daa
pop es
mov bh, 9
leave
sahf
invalid
insb byte es:[edi], dx
and dword [ecx + esi*2 + 0x3185d76c], edx
push ss
add eax, 0x40475e5f
add dword [eax + 0x66], eax
pop ecx
sti
invalid
dec esp
add eax, 0x443bd6d1
out dx, eax
and ebp, dword [edi - 0x11d29b9b]
xchg byte [edx + 0x1d3a48ea], bl
adc eax, 0xb46173e
push 0x17
aaa
outsb dx, byte [esi]
punpckldq mm5, dword [edi]
push esi
and eax, dword [ecx + 0x5593ea9f]
cli
sti
mov edx, 0xce68a8d3
rol byte [edx], 0x5f
push 0x5f02c0ce
pushal
pushfd
nop
call fcn.00a285a6
inc ecx
jecxz 0x6bf46f
adc al, 0x46
test dword [edi - 0x42634648], 0xc4949984
rol esp, 1
xchg ebp, eax
popfd
mov dl, 0x10
push 0x73cb6ef7
pop eax
wait
invalid
xchg dword [esp + 4], ebx
lea esp, [esp + 4]
jne 0x637ffa
push 0xcb9ea20b
mov ebx, 0x402a57
push 0xb05e0a69
mov ebx, dword [ebx + 0x7556a6]
jmp 0x764a0f
call fcn.00b7f8df
push 0xc3ca368b
mov dword [esp + 4], 0xe9f250ab
pushal
lea esp, [esp + 0x24]
jmp loc.004a2098
jnp 0x9535ab
pushfd
nop
mov dword [esp], esp
pushfd
mov byte [esp], 0xb2
jmp 0x6cbee4
jmp 0x6bf49b
Function at 0xa108fc
Capabilities:
Encode data using xor

Disassembly:
pushal
jmp 0xb3516b
mov edi, dword [edi + 0xa09b9]
pushfd
call fcn.00b91e04
neg ebx
and al, 0x69
sahf
jae 0xb351d0
mov bh, 0xfe
div byte [esi]
or edi, dword [edx]
aaa
and ebp, dword es:[edx]
aaa
push cs
sbb esp, dword [esi]
daa
or bh, byte [edi]
cld
xchg ah, cl
xor eax, 0x11f2e9be
mov al, 0xb8
ficomp dword [eax]
xlatb
jg 0xb35182
cmc
std
cmp al, 0xe7
xchg ebx, eax
cdq
inc ebp
imul esp, edx, 0xffffffcb
leave
out dx, al
cld
scasb al, byte es:[edi]
adc byte [esi - 0x47caa215], 0xfe
loope 0xb35179
mov esp, 0x1136c69f
insd dword es:[edi], dx
outsd dx, dword [esi]
pop eax
mov ch, 0x4f
stosb byte es:[edi], al
xchg edi, eax
invalid
or dword [edi], edx
cmp byte [edi - 0x634e6333], dh
int1
pushfd
add dword [eax], 0xffffffca
in al, 0xb0
wait
test byte [eax - 9], al
adc al, byte [eax + 0x77]
and dword [esi], edx
mov bh, 0xe3
arpl word [esi], si
call 0x5f99320c
js 0xb35206
int 0xc4
push esp
jae 0xb35222
sub bh, byte [0xd5a186c4]
out 0x8b, al
pushfd
push cs
push es
pop eax
jnp 0xb3523a
out 0xfa, eax
cmp al, 0xef
out dx, eax
mov ebx, 0x679133bf
jne 0xb35209
pop ds
adc eax, 0x86a168ac
mov word [ecx + edi*8], gs
push esi
loopne 0xb3522b
fcom qword [bx + di - 0x36]
in eax, dx
dec edx
ljmp 0x2ab2
sub ah, dh
dec esp
shr byte [eax + 0x6a], 1
dec ebp
imul eax, dword [edx - 0x33], 0xcab2f473
mov al, 0x93
retf 0xe9ca
Function at 0xb82ba0
Capabilities:
Encode data using xor

Disassembly:
xor edi, 0x61c3e9e
mov byte [esp], 0xa9
stc
xor dword [esp + 0x24], 0x815
push 0x9069595d
xor esi, 0xae77d485
test ebp, 0x9a47ad51
clc
xor ebp, 0xab777680
cmp cl, ah
cmc
xor eax, 0x1d2894b4
bt cx, 0xc
call fcn.008b5a5a
xor ebp, 0x82b30a4e
call fcn.00891d3c
jb 0xb82b5e
mov al, 0xdd
stc
div byte [ebx + 0x50]
jns 0xb82bf9
cmp dword [esp + ecx*2 + 0x4f], eax
mov byte [0x1e298ee5], al
xchg byte [ebp - 0x3dd61cd9], al
sub edx, eax
sub eax, dword [ebp + 0x4d]
dec esi
push 0x525f4273
jae 0xb82c15
inc edi
pop esi
dec ebx
dec esi
ja 0xb82c23
add dword [esi - 0x8d98a14], ebp
push es
xchg ebx, eax
iretd
xchg edx, eax
push 0xd202b9ca
ja 0xb82c7d
sal byte [edi + 0x7c], cl
pop eax
clc
call [ebp + 0x20]
adc ebx, ecx
xor al, 0x9b
loope 0xb82bfe
loopne 0xb82bc2
mov edi, 0x5c9ae95
in eax, 0xf6
xchg ebx, eax
xchg ebx, eax
cwde
pop edx
sbb cl, byte [ecx]
test al, 0x62
and bh, byte [ebx - 0x634df094]
mov ch, 0xb8
inc esi
sahf
aas
or al, byte [ecx]
lodsd eax, dword [esi]
fidivr dword [ecx + 0x59c86697]
pop ebp
sal al, 1
add dword [eax], 0x31
push esp
inc esi
je 0xb82c6c
stosb byte es:[edi], al
neg dword [ebp - 0x16734884]
jmp 0x9f43db19
invalid
fiadd dword [eax]
int 0xec
int 0x7d
xchg esi, eax
xor al, al
scasb al, byte es:[edi]
jns 0xb82c89
fisttp qword [edx + 0x3f]
mov word [ecx - 0x6c], fs
and al, 0x75
lea ebp, [edi]
xchg esp, eax
cmp byte [esi - 0x6e116477], dl
sub bh, byte [ecx]
pop esp
lodsb al, byte [esi]
mov bl, 0x10
or esi, dword [esi]
cmc
jno 0xb82caa
xchg esi, eax
cmp al, 4
adc edi, edx
test byte [edi], al
stosb byte es:[edi], al
cli
cmp eax, dword [eax - 0x57455ce4]
cmc
push es
mov edx, 0x682efd06
adc dword [edx + 0xe228091], ebp
std
cld
ja 0xb82d1b
invalid
test dword [ecx + 0x42], 0xe02a9537
push edi
rep outsb dx, byte [esi]
push ecx
xchg edi, eax
test ch, cl
inc edx
xchg ebx, eax
inc edx
dec ebp
push edx
leave
sub cl, bl
and al, byte [ebp + 0x54]
dec ebx
inc esi
and eax, dword [ecx + edi]
lcall 0x9aa3, 0x98e0b9a6
xchg edx, eax
cdq
test ch, cl
test al, 0xd1
mov al, 0xf5
mov eax, 0x88cd94d5
int 0x88
fnstsw word [edi - 0x63]
add eax, 0xb6b6eb43
movsd dword es:[edi], dword [esi]
rcr byte [ebp - 0x11f2505d], 0xda
stc
not ch
test bh, 0xfe
jmp 0xb82d4c
Function at 0xbb2ae5
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [esp], eax
mov ah, ch
mov eax, 0x45a7a7
call fcn.006c027b
pushfd
jno 0x5a38a4
rcl byte [edi - 9]
out 0xc0, eax
rcr esp, 1
aad 0xe8
fucom st(4)
in eax, 0xcc
movsd dword es:[edi], dword [esi]
int3
loopne 0x5a3883
ja 0x5a38a6
pushfd
xchg esp, eax
mov bh, 0x63
inc esp
js 0x5a38be
insb byte es:[edi], dx
into
xor dword [eax], esi
jle 0x5a385b
jae 0x5a38a1
xchg ebp, eax
wait
mov byte [ecx], ch
xchg ebp, eax
xchg ebx, eax
movq mm0, qword [ebx - 0x1f]
test al, 0x38
cmp edx, edx
test eax, 0xe9f2ac10
sti
test eax, 0x5828ea8f
jge 0x5a389c
iretd
adc byte [ebx], ah
salc
jb 0x5a38a6
clc
inc esi
mov ecx, 0x10107d7a
jp 0x5a3923
adc byte [eax], dl
pop es
jnp 0x5a3924
cli
mov ah, 0xaf
loopne 0x5a3869
mov dh, 0x62
movsd dword es:[edi], dword [esi]
invalid
jl 0x5a392b
jb 0x5a38cf
or ah, byte [ebx + 0x59]
mov al, byte [0xb83d73d1]
or byte [ebx], bh
pop edi
mov cl, 0x54
int1
cmp dl, byte [edx - 0x7c0fe6c1]
add dword [eax + 0x59faeded], 0x65
inc edx
adc dl, bl
dec esp
and eax, dword [eax - 0x80]
push ss
invalid
cld
fcmovne st(0), st(1)
invalid
cmc
test byte [edx - 0x53505078], 0x53
jb 0x5a398a
je 0x5a3926
cmc
invalid
aam 0x1e
imul eax, dword [ebp + 0x7e], 0xffffff90
out 0xa4, al
mov dword [edi], esp
mov eax, dword [edi]
bound ecx, qword [esi + 0x62a1f35c]
hlt
xchg dword [esp + 0x24], eax
push dword [esp]
mov byte [esp], 0x64
push dword [esp + 0x28]
ret 0x30
call fcn.00b22d9a
xchg dword [esp + 0x14], eax
pushal
lea esp, [esp + 0x34]
jno 0xbd4f2c
pushal
xchg dword [esp + 0x1c], eax
movsx ax, cl
mov word [esp], 0x4153
movsx eax, dl
mov eax, 0x45a7a7
pushfd
push dword [esp]
mov eax, dword [eax + 0x328bea]
pushal
pushfd
lea esp, [esp + 0x48]
jns 0x73247b
pushal
lea eax, [eax - 0x52001644]
pushfd
jmp 0x679eba
jmp 0x5a383d

Function at 0xbdda07
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x5f0873
pushal
xchg dword [esp + 0x1c], eax
pushfd
lahf
mov eax, 0x43d1bb
jmp 0xbca56c
jmp 0xc0aecc
lea esp, [esp + 8]
jae 0x5d525b
pushal
push eax
xchg dword [esp + 0x20], eax
not al
not ah
call fcn.004ced15
mov eax, dword [eax + 0x8391f7]
mov byte [esp + 4], ch
mov byte [esp + 4], dh
pushfd
mov byte [esp], 0xea
lea eax, [eax - 0x2774877c]
push dword [esp + 8]
call fcn.00b6b505
and eax, dword [ecx - 0x90ea59e]
push es
pop ds
sbb ch, byte [edi]
cmp al, byte [edi]
push ds
pop ds
push ss
pop es
adc ecx, dword ds:[esi]
add esp, dword [ecx + 0x67d600ef]
scasb al, byte es:[edi]
mov ecx, 0x9c4ff3b0
fld dword [0xcb960924]
xor dh, ah
lds ebp, [edx]
add dword [eax + 0x70], esi
jg 0xc0af1f
jmp dword [ebx]
add dword [esi], ebx
ja 0xc0af3b
sbb ebx, dword [edi - 0x78]
push eax
movsb byte es:[edi], byte [esi]
pop edi
mov byte [eax - 0x5c], dl
inc eax
popal
int 0x40
and ah, bl
sti
in eax, 0xb7
mov edi, 0xada4a1ed
adc byte [edi + 0x2d5c4365], ah
sub eax, 0xb0e39032
jecxz 0xc0aeed
sar edx, cl
les ebp, [ebp + 8]
out dx, al
hlt