joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10286b20
Capabilities:
Encode data using xor

Disassembly:
mov cx, word [esi + 2]
and ax, cx
mov ecx, 0xdca1ae15
mov dword [esp], ecx
lea edx, [ecx + ecx*8 + 0x179fc812]
not ax
lea ecx, [ecx + edx*8 + 0x559802a4]
add cl, dl
mov word [esi + 2], ax
adc edx, dword [esp]
sbb edx, ecx
movzx eax, word [ebp]
neg dword [esp]
and dword [esp], 0xe11bd719
push ecx
xor ax, bx
ror ax, 1
or dl, cl
bswap edx
xor ax, 0x5a0e
call fcn.10316ee1
insd dword es:[edi], dx
push ebp
jnp fcn.10286b20
jp 0x10286ba9
and ecx, dword [edi]
lds edi, [edx + 0x67]
xor eax, 0x7a892327
xor eax, 0x7abd5f6b
xor eax, 0x7aa1135f
xor eax, 0x7a814f43
xor eax, 0xd873d880
test byte [ebp - 0x53], dh
ror dl, cl
sub eax, 0x6763e516
pop esi
jne 0x10286bdd
cwde
retf 0x37cf
aaa
les esi, [ebx + 0x1b]
cmc
aaa
les esi, [edi + 0x373e8917]
les ebx, [ebx + 0x373ea5fb]
invalid
xchg ah, dl
bound esi, qword [0xd4a24c64]
bound esi, qword [0xddddcbf3]
test byte [esi + 3], ah
xlatb
retf 0x9a3e

Function at 0x1028e43f
Capabilities:
Encode data using xor

Disassembly:
add dx, ax
sub cl, 0x9d
call fcn.1018d37a

Function at 0x10295c15
Capabilities:
Encode data using xor

Disassembly:
ror dx, 0x22
mov word [esp + ecx - 0x1404a0df], 0xc20e
xor eax, ebx
pop ecx
dec eax
not ecx
neg ecx
push edx
neg eax
sub word [esp + 0xd], 0x5b0f
inc word [esp + 8]
inc eax
xor eax, 0xe9029321
inc byte [esp + 0xd]
xor ecx, 0x53b36a8e
lea eax, [edx + eax + 0x2f1b290a]
rol byte [esp + 4], 0x27
xor ebx, eax
dec cx
shl edx, cl
add edi, eax
xor dword [esp + edx*2 - 0xafffa], edx
sbb ecx, ecx
pop edx
pop eax
pop ecx
pop edx
jns fcn.1025c2e8
mov ecx, 0x4f0b98b0
call fcn.10260f2c
mov cx, word [eax + edx - 0x7e9bf1a1]
lea edx, [edx*4 - 0x54d56dc7]
mov dword [esp], edx
lea eax, [edx - 0x48ed59e8]
mov word [eax + ebp - 0x5cacfed7], cx
shl byte [esp + eax - 0x5cacfece], 0xc6
lea ebp, [ebp + eax - 0x5cacfed7]
mov ecx, 0x83b45012
sal dword [esp + eax - 0x5cacfecb], cl
ror ecx, cl
mov eax, dword [ecx + esi - 0x1404a0f3]
sar dx, 0xc9
lea esi, [esi + ecx*4 - 0x501283ba]
jns 0x101ba585

Function at 0x10299ee8
Capabilities:
Manually build aes constants

Disassembly:
mov dword ss:[edx + ecx*2 - 0x67049d76], eax
mov dword [esp + ecx*2 - 0x67049d76], ecx
movzx edx, byte [edi + ecx - 0x33824ebb]
jmp 0x101c2c0e

Function at 0x1029ac10
Capabilities:
Encode data using base64

Disassembly:
xadd ecx, eax
pop edx
pop edx
pop ecx
jns fcn.10360cf3
add al, 0x2b
dec dword [esp]
push 0x80928c21
rol al, 1
shr dword [esp + 4], 0x62
xor al, 0x25
not al
mov edx, 0x5310e508
xor al, 0x86
movsx ecx, byte [esp + edx - 0x5310e507]
shl dword [esp + edx - 0x5310e504], 0x7f
xor bl, al
xor cl, 0xbc
shl word [esp + edx - 0x5310e504], 0x8c
dec cl
mov word [esi + edx - 0x5310e508], ax
push edx
jo fcn.102f4e20
mov dword [esp + edx - 0x5310e508], edi
ret 8
sar word [esp + ecx - 0x17b00b], 0xe5
sub dx, 0x988c
shl ecx, 0xb4
xor dx, 0x4f0a
sub eax, eax
inc dword [esp + ecx - 0x1fffff4]
bswap ecx
xor bx, dx
mov word [ebp + ecx*4 - 0xa], dx
not byte [esp + ecx + 7]
neg ecx
call fcn.10232889
jmp 0x1028e2d3
Function at 0x102bfad8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor ecx, ebx
mov dword [esp + edx*2], 0x9e0eae1c
rol ecx, 3
call fcn.101947be
mov edx, dword [ebp + edx - 0x71973236]
mov eax, 0xea8eb7ab
mov cl, byte [ebp + 4]
sub eax, eax
js 0x102b3f6e
lea ebp, [ebp + eax*2 + 2]
dec eax
rol eax, 0x6b
shr edx, cl
movzx ecx, al
mov dword [ebp + ecx*2 - 0x1fe], edx
push eax
sub al, al
mov ecx, dword [esi + ecx*8 - 0x7f8]
dec dword [esp]
ror al, 0xc2
adc esi, 4
inc eax
js 0x102779fd
mov ecx, 0xe52cd8bb
mov edx, dword [ebp]

Function at 0x102c9612
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov edx, dword [ebp + eax*2 - 0x4f76f544]
mov eax, dword [ebp + eax*2 - 0x4f76f540]
mov cl, byte [ebp + 8]
add ebp, 6
call fcn.1036f7c9
mov dword [esp + eax - 0x5ab63500], eax
ror ecx, 2
pop eax
bswap ecx
ror al, 0x46
sbb ecx, 0xe80466b3
add eax, edx
lea eax, [edx + eax - 0x52faba5e]
xor ebx, ecx
shl dl, 0x46
inc ax
jno 0x1032c4a5
mov ecx, 0xde821230
movzx eax, cx
call fcn.1033c7a3
mov ecx, dword [edi]
mov eax, 0x3daaeb39
sar al, 3
call fcn.103b2411
mov eax, 0x9b945f19
movzx ecx, ax
mov edx, esi
lea esi, [ecx + esi - 0x5f1b]
lea ecx, [eax + eax*4 + 0x9364aa1]
mov word [esi + ecx*4 - 0x4c709878], dx
movsx edx, al
call fcn.10259e2b
add edi, edx
rol ecx, 0xf6
mov eax, ecx
inc word [esp + eax - 0x50bfffed]
pop edx
pop eax
pop eax
jns fcn.10360cf3
adc edi, ecx
dec eax
push eax
jne 0x10283934
not edx
movzx eax, cx
neg ecx
mov ecx, edx
mov edx, dword [eax + edi - 0x5aca]
add dword [esp + eax*4 - 0x16b48], eax
lea edi, [eax + edi - 0x5ac6]
ror word [esp + eax - 0x5ad1], 0xc
and ecx, edx
movsx edx, word [esp + eax*8 - 0x2d690]
sal dx, 0xf
call fcn.10326470
inc edx
movzx ecx, ax
neg ax
rol edx, 2
dec cl
xchg ecx, eax
lea edx, [edx + ecx + 0x5ef7c82e]
bswap edx
inc ecx
lea edx, [eax + edx - 0x1a08b27c]
setns al
shr eax, 0x2e
xor ebx, edx
shr eax, cl
adc ebp, edx
mov edx, eax
mov cl, byte [edi + eax - 2]
xor dl, byte [edx + edi]
and eax, 0x6795aa04
sbb eax, eax
not cl
sbb ax, ax
adc al, al
not dl
lea eax, [eax + eax*8 - 0x77c1cefb]
or cl, dl
jmp 0x103aee3d
add eax, eax
not ax
mov word [edi + eax*4 - 0x41f277d4], cx
lea edx, [eax - 0x4f4b4f59]
movzx eax, byte [eax + esi - 0x107c9dfb]
lea edx, [edx + 0x15bbfca7]
add esi, 0xfffffffa
xor al, bl
mov ecx, edx
ror al, 1
sar cx, 0x49
push ecx
neg al
xor al, 0x16
neg al
xor al, 0x9d
xadd dl, ch
adc al, cl
xchg byte [esp + 1], ch
lea edx, [edx + ecx*4 - 0x73f8fad1]
rol al, 1
not dx
xor ecx, ecx
ror cx, 0x8d
not al
call fcn.103606ce
neg cl
jmp 0x1024e5c3
Function at 0x102e66bb
Capabilities:
Parse pe header

Disassembly:
adc dx, word [esi + ecx + 4]
and ax, dx
not ax
movzx edx, cl
push ecx
mov word [esi + ecx*8 + 4], ax
lea edx, [edx*8 - 0x7450127b]
sub dword [esp + ecx*4], ecx
mov edx, dword [ebp + ecx*8 - 4]
xor edx, ebx
rol byte [esp + ecx + 2], 0x24
rol edx, 1
neg ecx
jno 0x103dac37
sal dword [esp + edx*4 - 0x3fbfff8], 0x7a
lea edx, [ecx + 0x100ea596]
not ax
inc ax
xchg byte [esp + edx - 0x110da591], dh
xor bx, ax
lea ebp, [ebp + edx*2 - 0x221a012e]
shr word [esp + edx*2 - 0x221a0128], 1
rol cx, 0xb
mov word [ebp + edx - 0x110d0096], ax
pop ecx
pop eax
pop ecx
ja fcn.1031e0c1
movsx ecx, al
inc edx
rol ax, 0xc9
sub ecx, 0x10a0c62c
sal eax, cl
bswap edx
dec cl
rol edx, 3
xor ebx, edx
not cl
add esi, edx
dec ax
ror al, 3
movzx cx, byte [edi + eax*4 - 0x75dda000]
push eax
mov al, byte [edi + eax*4 - 0x75dd9ffe]
or cl, al
inc dword [esp]
mov eax, 0x5f062cb5
not cl
ror ax, 0xa4
mov word [edi + eax - 0x5f0652cd], cx
lea ecx, [eax*4 + 0x4710a23d]
xor eax, 0x579fd235
lea edi, [edi + eax - 0x8998100]
add dword [esp + eax*8 - 0x44cc07f0], ecx
or ecx, ecx
movzx edx, byte [esp + eax*2 - 0x113301fc]
pop ecx
jne fcn.1016dacd
mov ecx, 0x30895996
movsx eax, cl
mov eax, dword [edi + ecx - 0x30895996]
not ecx
mov cl, byte [edi + 4]
mov edx, 0x29ad9939
neg edx
shr eax, cl
lea ecx, [edx + edx*8 + 0x1e16362e]
jmp 0x103ce7d2
xadd ecx, eax
mov ecx, dword [eax + ebp - 0x4d86fd0b]
lea edx, [eax + eax*8 + 0x2e93449f]
shl eax, 0x1e
xor ecx, ebx
and edx, eax
xor ecx, 0xd4ac6e0f
push edx
inc ecx
call fcn.103e3546
mov edx, 0x6400da26
lea esi, [esi + edx - 0x6400da22]
mov ecx, edx
sar edx, 0x77
xor eax, ebx
xor eax, 0x8d02faa4
xor ax, 0x24a3
xchg cx, dx
mov dword [esp + edx - 0xff0000], ecx
and edx, edx
adc ax, 0xa2bb
jmp 0x1028cf7a
mov dword [esp + eax - 1], ebp
ret 4
sub eax, eax
setns al
mov byte ss:[ecx + eax - 1], dl
jae 0x103110e9
add dl, 0xba
mov dword [edi + 2], eax
movzx eax, cl
sar edx, 0xe
xor edx, ecx
mov eax, dword [edx + esi - 0x59048a68]
xor eax, ebx
inc edx
not eax
rol edx, 0x1f
ror ecx, cl
xor eax, 0x23aa2916
dec eax
not cl
bswap edx
rol ecx, 0x99
xor eax, 0xea6a180
xadd cl, dl
ror ecx, cl
sub eax, 0xe7b40b3b
push ecx
call fcn.102709eb
mov edx, 0x4d86fd0b
mov eax, dword [esi + edx - 0x4d86fd0b]
mov ecx, edx
mov edx, dword fs:[eax + edx - 0x4d86fd0b]
lea eax, [ecx + ecx*2 - 0x1f405460]
sal eax, cl
add ax, cx
mov dword [esi + ecx - 0x4d86fd0b], edx
lea ebp, [ebp + ecx - 0x4d86fd0f]
jne 0x102d16d5
mov ecx, 0xd9382f1f
mov ecx, dword [esi]
mov edx, 0x8e0b0730
rol dl, 1
ror dx, 0xf
mov ax, word ss:[ecx]
sub dx, dx
movzx ecx, dx
je 0x101c5895
xor edx, 0x5d343eb3
lea edx, [edx + ecx*4 - 0x3fa3d512]
neg edx
shr byte [esp + ecx*2 + 1], 0x61
pop eax
sbb edx, 0xe499699a
rol edx, 2
sal ecx, 0xaa
jnp 0x103b71f5
rol ax, 0x62
xor edx, 0x9892570d
sal cx, 0x29
shl eax, 0x39
sar ecx, 0xfe
xor ebx, edx
add edi, edx
neg cl
xor cx, word [ebp + ecx - 6]
jmp 0x10272439
Function at 0x102f3f51
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ebx
mov dword [esp + edx - 0x776fa728], eax
rol ecx, 2
mov dword [esp + edx - 0x776fa72c], eax
sub ecx, 0x4831f620
pop edx
neg edx
not ecx
jg 0x103dab79
fcmovbe st(0), st(4)
xor eax, 0x26f0f885
adc bl, dh
sub dword [eax + 0x81026f0], edx
xchg esi, eax
fdiv st(0)
adc byte es:[esi + 0x50], al
sal al, 1
adc dh, bl
mov word [edi + esi + 0x49], es
adc byte [ebx + 0x235225b0], dh
clc
out dx, eax
rcl dword [edx + 0xf], cl
movaps xmmword [edx], xmm1
or ebx, ebp
xor al, 0xc
pop edx
aas
add byte [edx - 0x4c086516], ch
insd dword es:[edi], dx
cwde
sbb ah, byte [esi]
inc esi
pop eax
in al, 0x27
salc
jle 0x102f3f7e
xchg dx, ax
mov dword [esp + edx*2 - 0x19838732], edi
ret 4
bswap ecx
push edx
inc byte [esp + edx - 0x4dc13c67]
shl dx, 0x65
xor ebx, ecx
inc eax
add edi, ecx
and edx, dword [esp + edx - 0x4dc18cfd]
jg 0x102f5c00

Function at 0x1030fa98
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx*4 - 0x202c], 0x15920428
mov word [edx + esi - 0x80b], cx
lea ecx, [edx - 0x52e4e669]
mov ecx, dword [ebp + edx - 0x80b]
or dl, dh
jns 0x102ff006
Function at 0x10341b5f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword ss:[edx + eax - 0x110]
mov dword [esp + eax - 0x110], 0x548b439f
xadd dword [esp + eax*4 - 0x43f], eax
seto byte [esp + eax - 0x548b3f]
mov dword [ebp + eax*2 - 0xa91682], ecx
mov edx, dword [esp + eax - 0x548b3f]
jp 0x10346c6f
movsx ecx, ax
lea ebp, [eax + ebp - 0x548b3f]
call fcn.1036983c
xor ebx, edx
add al, 0xbc
rol ecx, cl
dec ecx
adc edi, edx
mov esi, dword [esi + eax*2 - 0x5ee6]
xchg byte [esp + eax - 0x2f71], ch
movzx edx, ax
sub cx, word [esp + eax - 0x2f72]
pop eax
jns fcn.10360cf3
push dword [ebx + 0x141b1f5d]
sbb byte [ebx], ch
pop ebp
clc
push dword [eax]
adc byte [ebx], bl
pop ebp
clc
call dword [esi]
xor byte [eax - 0x76], dl
imul ecx, esi, 0x22c1afe8
jle 0x10346cb9
mov dl, 0x15
and ecx, dword [ebx - 0x543a0e2d]
sub byte [edx + 0x1ecc0fb8], bh
xchg ebp, eax
inc ecx
cmp dword [0x2127b1e], ebp
adc byte [esi - 0x18], bh
scasb al, byte es:[edi]
mov edi, 0xd1a8df63
cwde
sbb dword [ebx - 0x70], ebp
cmp eax, 0xa935ad5b
xchg ebx, eax
and dword [esi + 0x5060545b], ecx
mov ebx, 0x515b8e21
fstp dword [edi - 0x9af2dc6]
rol dword [eax + 0x5c35ba52], 0x16
mov bl, 0x51

Function at 0x103659b3
Capabilities:
Packed with generic packer

Disassembly:
lea edx, [edx + eax*4 - 0x5be94abc]
shl ecx, cl
sar al, 0x46
neg edx
xor edx, 0xe93ee4ac
ror edx, 1
add ecx, ecx
mov dword [esp + eax - 0x8395e00], 0x7c987016
neg edx
ror ecx, 0xf4
not edx
dec byte [esp + eax - 0x8395df9]
xor edx, 0x5c098037
dec cl
dec edx
neg edx
ror edx, 3
xor cx, cx
sal word [esp + eax - 0x8395dfa], 0xa9
ror ecx, 0xf0
lea edx, [eax + edx + 0x2779e0a0]
shl al, 0x47
not dword [esp + ecx - 0x14fc]
ror edx, 3
call fcn.102ae244

Function at 0x103718a1
Capabilities:
Encode data using xor

Disassembly:
mov dword [eax + ebp - 0x19bfc], edx
lea eax, [ecx*2 - 0x55ff0ec]
call fcn.1016ad21

Function at 0x10374912
Capabilities:
Encode data using xor

Disassembly:
ror ecx, 1
not ecx
xor ebx, ecx
add edi, ecx
mov dword [esp], edx
movzx ecx, word [esp]
mov eax, dword [ecx + esi - 0x8cee]
and ecx, dword [esp + ecx - 0x8cee]
sal ecx, cl
lea esi, [esi + ecx*2 - 0x4676fffc]
rol ecx, 0x81
sar cx, 0x23
rol dl, 0x83
movzx dx, byte [eax + ecx - 0x46770000]
mov dword [esp + ecx - 0x46770000], ecx
call fcn.10320629
mov eax, dword [ebp]
add ebp, 4
add byte [ecx - 0x432d1747], cl
cli
dec dword [ebx - 0x7effdabc]
lds eax, [eax + eax]
add byte [eax], al
xor eax, ebx
ror eax, 1
mov edx, 0xb9a6b891
bswap eax
call fcn.10300b40
call fcn.1033b906
xchg esp, eax
jo 0x1037494f
sbb esi, dword [edx - 0x73]
push es
xchg ebp, eax
dec edi
mov al, byte [0x9506a95a]
dec edi
sahf
lcall 0xe4aa, 0x4f9506b9
lodsd eax, dword [esi]
push es
xchg ebp, eax
dec edi
xchg byte [ebx + ebx*8 - 0x4fbd6e73], cl
mov ch, dl
sub byte [ecx - 0xb], bl
ror byte [ebx + 0x1791f54f], cl
retf 0xaff2

Function at 0x1037949b
Capabilities:
Encode data using xor

Disassembly:
inc eax
neg dl
lea ecx, [edx - 0x5fc4d146]
rol eax, 2
xadd dword [esp + edx - 0x487d746], edx
bswap ecx
xor ebx, eax
bswap ecx
neg dword [esp + edx - 0x1ffffef]
call fcn.103127aa
or ecx, eax
jmp 0x1033854c
Function at 0x1037c6e3
Capabilities:
Encode data using xor

Disassembly:
rol ecx, cl
mov dword [esp], ecx
dec eax
call fcn.102dd1ff

Function at 0x1037df36
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi]
mov dword [esp], 0x1b07b9ba
sbb edi, 0xfffffffc
rol dword [esp], 0x11
sbb eax, dword [ebx + 0x4c1fcdf]
and al, 0x11
xor eax, ebx
xor eax, 0xd0ad5b3b
sub eax, 0xc02f4b15
not eax
mov edx, 0xa321b038
mov ecx, 0x3407ef36
call fcn.1020b869
mov ecx, 0x542d44a3
movzx eax, cx
shr eax, 0x63
movzx edx, word [eax + esi - 0x894]
sar ax, 0xc3
neg ecx
xor dx, bx
ror dx, 1
add dx, 0xf1a4
rol dx, 1
inc eax
sub dx, 0x988c
sar ax, 0x24
sub eax, 0x46b95024
or ax, ax
xor dx, 0x4f0a
or ecx, eax
xor al, ah
xor bx, dx
sub eax, ecx
ror al, 0x47
call fcn.103ba0fa
pop esp
push ecx
loop 0x1037df3e
dec ebx
xor ecx, dword [edi + eax*8]
or al, 0x10
pop ds
jno 0x1037e007
invalid
sub cl, al
mov fs, word [edx - 0x7a]
movsb byte es:[edi], byte [esi]
inc edx
pushfd
sbb edx, eax
jg 0x1037e064
pop esp
loop 0x1037dffc
daa
xchg ebx, eax
stosd dword es:[edi], eax
jl 0x1037e04b
mov ebp, 0xe50109e
add dword [eax], edx
add eax, 0x55b549e7
test esp, esp
mov esi, 0xa4a8c2d4
mov esp, 0xf77827fe
outsd dx, dword [esi]
pushal
fimul word [ecx]
xlatb
inc edx
push esi
xchg ebx, eax
push ds
xchg ecx, eax
sub eax, 0x136aa695
fcom dword [edi + ebp*2 + 0x20864657]
mov dh, 0xd1
push eax
call fcn.1035c24a
mov eax, dword [ebp]
mov ecx, 0xac0be8aa
mov edx, dword [ebp + 4]
add ebp, 8
sub ecx, ecx
call 0x65c38c5b
add al, 0x81
lds ecx, [eax]
add byte [eax], al
add byte [ebx], ch
leave
mov dword [eax + ecx*2], edx
movzx eax, cl
add eax, dword [ecx + esi]
shr ecx, 0xf2
movsx edx, cx
movsx edx, cx
shl cx, 0xef
lea esi, [ecx + esi + 4]
sar cx, 0x4b
sbb ecx, ecx
shr ecx, 0xbb
xor eax, ebx
or dl, 0x9b
ror eax, 1
sar ecx, 0x5f
push edx
xor eax, 0xb394609e
rol ecx, 0xd0

Function at 0x1038185c
Capabilities:
Packed with generic packer

Disassembly:
xor edx, ebx
dec cx
jnp 0x102852b1
mov ecx, dword [ebp]
mov eax, 0xb4b75238
mov eax, dword [ebp + 4]
mov edx, 0xd50aa7b0
sar dl, 0x64
js 0x1025e135

Function at 0x103863bc
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov esi, 0xaa961db1
xor esi, 0xcf3ba811
test esi, 0xdb944a0d
push 0x77b1182c
mov dword [esp + 0x10], 0xa35bad21
mov esi, dword [esp + 0xc]
jbe fcn.103863bc
cmp dword [esp], 0x2021b824
not word [esp]
call fcn.1035fa41
mov dword [esp + 4], edx
ror eax, 2
sub eax, 0x7d87d198
shr dl, 0x87
pop edx
xor eax, 0xfc192c9e
xor ebx, eax
call fcn.103d2c78
mov edx, 0x4e0ae600
mov edx, dword [edi + edx - 0x4e0ae600]
mov ecx, dword [edi + 4]
call fcn.1028112f
mov edx, 0x40210b86
movsx eax, dx
mov ecx, dword [edx + ebp - 0x40210b86]
jmp 0x10394e87
push edx
sar dx, 0xab
mov eax, dword [edx + ebp - 0x4020fffd]
mov dword ss:[ecx + edx - 0x40210001], eax
adc edx, edx
sub dword [esp], 0x83824f0c
mov ecx, dword [esi]
lea eax, [edx + edx*4 + 0x7f18f488]
adc dword [esp + eax*4 - 0x18bd248], eax
xor ecx, ebx
shl edx, 0xf7
sbb ecx, 0xfca68c9f
jmp 0x102753c4
Function at 0x1038d159
Capabilities:
Check for vm using instruction vpcext

Disassembly:
rol edx, 3
call fcn.10188473
mov edx, 0x101d1a09
lea ecx, [edx + edx*4 + 0x4a9fd517]
add ecx, edx
mov dx, word [ebp + edx*4 - 0x40746824]
adc ebp, 2
sub ecx, ecx
movzx eax, byte [esi + ecx]
sar ecx, 0xb8
jbe 0x101bda9c

Function at 0x1039233f
Capabilities:
Encode data using xor

Disassembly:
rol dl, 1
rol ecx, cl
xor bl, dl
lea edx, [esp + edx + 4]
call fcn.103f28de
fdiv qword [edi]
mov eax, 0x60b8849b
jmp 0x103c06e5
mov ecx, dword [ecx + ebp - 0x7682974d]
bswap eax
mov dword ss:[eax + edx - 0x3e2f], ecx
sar eax, 0xeb
lea edx, [eax*4 + 0x39b26d2f]
shr dword [esp + eax - 3], 0x52
mov eax, dword [ebp + edx - 0x39b26d3f]
mov dword [esp + edx*2 - 0x7364da96], edx
movsx ecx, dl
jne 0x10392fe1
neg al
sub al, cl
call fcn.103830d3
lea ebp, [edx + ebp - 0x39b26d3b]
sal word [esp + edx - 0x39b26d47], cl
add ecx, 0xcb890e06
rol dx, 0xc3
movzx edx, byte [edi + edx - 0x39b26a57]
cmovb ecx, dword [esp + 4]
lea edi, [ecx + edi - 0x47fb]
xor dl, bl
not word [esp + ecx*2 - 0x8fff]
add ecx, dword [esp + ecx - 0x47fc]
adc dl, 0x15
shl ecx, 0xfc
inc cx
rol dl, cl
xadd byte [esp + ecx*2 + 3], ch
inc ecx
rol byte [esp + ecx*8 - 0x24009], 0x61
adc dl, 0x16
neg ecx
pop ecx
jno 0x1024aa54
jmp 0x102eb466
mov eax, dword [ebp + eax - 0x60b8849b]
mov edx, 0x2b1a6834
sar dl, 0xa4
lea ecx, [edx*8 + 0x1d1c620d]
lea ebp, [edx + ebp - 0x2b1a67ff]
not edx
xor eax, ebx
dec eax
inc ecx
and edx, edx
bswap eax
xor eax, 0xa19209bd
shl ecx, cl
sar ecx, 0x65
sbb eax, 0xeb94fdb0
neg eax
dec eax
or ecx, edx
bswap eax
call fcn.10320ef9
Function at 0x1039720a
Capabilities:
Encode data using xor

Disassembly:
xor ebx, edx
add ebp, edx
fadd qword [edi + ecx - 0x16c]
shl dword [esp + ecx - 0x16c], cl
pop eax
mov dword [esp + ecx - 0x16c], ebp
ret
add byte [eax - 0x71792c45], bh
sal eax, 0x18
movzx ecx, byte [edi]
add edi, 1
mov edx, 0x3db27b3a
not al
xor cl, bl
lea edx, [eax + eax*8 - 0x4a57c3fb]
not eax
rol edx, 0xd1
inc cl
dec dx
rol cl, 1
xadd dx, ax
dec edx
add edx, 0x6cb02716
daa
mov al, 0x6c
dec cl
not cl
ror eax, 0xb4
sar ax, 0xeb
xor bl, cl
add ecx, esp
bswap edx
mov eax, dword [edx + ecx - 0x64b7a8f6]
call fcn.1039adf9
call fcn.10175115
les ebp, [edx]
cmp ch, byte [esi]
push ds
inc esi
popfd
jl 0x103971ea
fidiv dword [edx + 0x17d37dc6]
salc
mov edx, 0x6e5cea22
sbb al, 0x2e
xor byte [edx - 0x7e], bh
fsubrp st(7)
sbb byte [edi], cl
pop ss
ja 0x103971b4
adc al, 0x94
cmp byte [eax + ebp*4], cl
loopne 0x103971ed
fnsave dword [edi]
mov ebx, 0xfb1deaf1
stc
push ebp
lahf
mov esi, 0x2fe60bed
or esp, dword [eax - 0x4c9b9d33]
inc ebp
adc dword [edx + 0x57], edi
sbb edx, dword [0xf04e494]
dec edi
dec ebp
xchg esp, eax
in al, 4
push edi
arpl word [ecx - 0x6c], dx
in al, 4
dec ebx
push edi
dec ebp
xchg esp, eax
in al, 4
push edi
imul edx, dword [ebx + 0x66108b4f], 0xffffffff
test byte [edx + edx*8], cl
adc ebp, edx
movsd dword es:[edi], dword [esi]
xor dword [esp + ecx - 0x5a15ec2a], ecx
xor bl, dl
xor eax, dword [esp + ecx - 0x5a15ec2a]
mov word [ebp + ecx - 0x5a15ec2c], dx
not dword [esp + eax - 0x731de052]
lea eax, [esp + ecx - 0x5a15ebf2]
adc byte [esp + ecx - 0x5a15ec2a], cl
mov edx, dword [eax + ecx - 0x5a15ec2e]
movzx eax, cx
sal cl, 0xc6
mov dword [ecx + ebp - 0x5a15ec82], edx
pop eax
jne 0x10188c68
mov edx, 0xef1938b5
sar dl, 2
not al
xor dl, 0xb
sbb dl, dh
xor al, 0x91
inc edx
and dl, dh
not al
sbb dl, 0x30
add dl, dl
rol al, 1
lea edx, [edx + edx*4 + 0x122dd4ae]
sub edx, edx
rol edx, 0x42
xor bl, al
sub dl, 0x24
shr edx, 0xd6
neg edx
adc eax, esp
inc dl
or dx, dx
mov byte [eax + edx*2 - 2], cl
movsx ecx, dx
call fcn.10226e97
mov edx, dword [esi]
xor edx, ebx
shr ecx, cl
xor edx, 0x6886dfa8
dec ecx
ror edx, 3
push ecx
bswap edx
push ecx
inc edx
shr ecx, 0x74
ror eax, cl
jae 0x103285a9

Function at 0x1039ae49
Capabilities:
Packed with generic packer

Disassembly:
sub ecx, 0x2f3ec134
neg cx
add ebp, edx
call fcn.102bd086

Function at 0x1039aed2
Capabilities:
Packed with generic packer

Disassembly:
pop ecx
pop ecx
pop eax
jno fcn.1031e0c1
push ds
pop eax
invalid
Function at 0x103b1262
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
cmovge eax, ecx
ror edx, 1
rol al, 7
call fcn.10375db5
mov edx, dword [edi + eax - 0x743be3b1]
lea edi, [edi + eax - 0x743be3ad]
shl ax, 0x6a
xor edx, ebx
movsx ecx, al
xor cx, cx
lea edx, [edx + ecx*2 + 0x503e29a3]
push eax
not cl
jle 0x10181b26
and dword [0xa8f18b25], edx
fisubr dword [ebx]
aaa
rcr dword [edi], 1
mov ah, 0xda
xor esi, dword [edi - 0x63]
pop ds
mov ah, 0xda
jg 0x102cfa19
push ss
sub byte [esi + 0x29], 0xb
fst qword [ebp - 0x26]
loope 0x102cf9f0
or byte [edx + ebx*4 - 0xc89cab5], dh
dec edi
popfd
fcom dword [ebx + 0x7b]
retf 0xd596
xadd dl, ah
lea ecx, [esp + ecx + 8]
mov eax, dword [ecx + eax - 0x710d7466]
call fcn.101eb094
mov eax, 0x743be3b1
jmp 0x102cf9fa
xchg dh, dl
ror cl, 1
sub cl, 0x94
add edx, 0xd3a79ab6
lea eax, [edx*2 - 0x16736549]
mov dword [esp + eax - 0x710dd32b], 0xab2be407
xor cl, 0xa9
rol ax, 0x2b
not al
xor bl, cl
rol dl, 1
jno 0x1038988a

Function at 0x103b23b2
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x10], 0x20380413
mov edi, dword [esp + ecx - 0x5f8c33fd]
cmp ecx, 0xddb059b5
jno 0x1029ec93
mov ecx, 0x7db6699d
mov ecx, dword [esp + ecx - 0x7db66991]
add dword [esp], 0xefe143b7
call fcn.1029ec8e

Function at 0x103b7cf1
Capabilities:
Encode data using xor

Disassembly:
shl dl, 0xc3
movsx eax, cl
lea esi, [esi + ecx - 0x105]
pop edx
pop edx
jbe fcn.10360cf3
neg edx
not eax
inc eax
bswap eax
neg eax
xor ebx, eax
sub dx, dx
mov dword [ecx + esi - 0x105], eax
jle 0x103b442a
mov dword [0x81852196], eax
mov dl, 0x32
adc byte [edx + 0x32b289c8], cl
adc byte [ecx + 0x32b2e556], al
adc dl, dh
shr ecx, 0xb2
xor dl, byte [eax]
jecxz 0x103b7d67
fst qword [ecx + 6]
adc ch, al
rcl bh, 1
mov ebp, 0xcf81378
or bh, byte [edx + 0x16d467a5]
out 0x24, al
aaa
cld
pushfd
mov edx, 0x5ccdad84
add dword [edx*4 - 0x3fd1283d], 0x34d08589
invalid
mov ah, 0xe
std
add bl, cl
mov ebp, 0x7f8f0f59
invalid

Function at 0x103c0309
Capabilities:
Check for software breakpoints

Disassembly:
bswap ecx
xor bl, dl
rol eax, cl
lea ecx, [ecx*8 - 0x4ac8a7fb]
mov word [ebp + ecx - 0x480a1fe1], dx
mov edx, dword [esp + ecx - 0x480a1fda]
mov cx, word [ebp + edx - 0x392af104]
shr ax, 0x83
lea ebp, [edx + ebp - 0x392af102]
lea eax, [edx*4 + 0x1c89d321]
movzx edx, byte [edi + eax - 0x135971a]
call fcn.1039358b
mov dword [esp + eax], eax
rol ecx, 2
add word [esp + edx + 3], 0xf296
xor ebx, ecx
add esi, ecx
xchg dword [esp + edx*2], edx
movzx edx, byte [eax + edi + 6]
lea ecx, [eax + eax*8 + 0x7e1acfa3]
or ecx, dword [esp + eax + 2]
neg byte [esp + eax*4 + 4]
xor dl, bl
rol dl, 1
shl cx, 0xc
sbb dl, 0x3e
or cl, ah
or ecx, ecx
adc ecx, dword [esp + eax + 4]
rol dl, 1
inc cl
inc dl
add al, byte [esp + eax + 4]
jnp 0x10224fc4