joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474490
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
push eax
xor esi, ecx
imul esi, edi, 0x42
mov edi, 0xaf26ae27
mov eax, dword [0x79d28e1f]
ja 0x474492
imul edx, dword [edx - 0x15029d1f], 0x3b
xlatb
rol dword [ebp + esi*2 + 0x2e], 1
cmp al, 0x4c
dec eax
lahf
sbb dword [edx + 0x1d24d4d7], ebp
lahf
mov ss, word [edi - 0x52]
xor cl, 0xf9
jae 0x47451f
test byte [edi + 0x4f], ch
salc
call dword [edi - 0x6fc11586]
or eax, 0xf6826e4f
jbe 0x4744e7
cmp al, byte [edi]
push ds
xchg edx, eax
sub eax, 0x863ed8af
adc dl, byte [ecx]
invalid
mov cl, 0x9b
aas
push edx
pushfd
invalid
invalid

Function at 0x4c2fd0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
dec ebx
pushfd
les esp, [esi - 0x5b]
pop edx
xor al, 7
invalid
xor dword [ebx - 0x163d7e2a], esp
je 0x4c2f7f
lcall 0xa749, 0x7376e8dd
push esi
inc edi
pop ecx
in al, 0x4f
js 0x4c3012
and dword [eax], ebp
push eax
cmp dword [ebx + ebp], esp
movsb byte es:[edi], byte [esi]
cmp dword [esi - 0xbfdface], esp
int 0x2f
pop es
stosd dword es:[edi], eax
adc edi, dword [ebx]
inc esp
mov ecx, 0x8e94b988
test byte [ecx + 0x58444968], al
adc al, 0x69
aam 0x7b
xchg esi, eax
jg 0x4c2fda
xor eax, 0xd8044192
push ss
fcom dword [esi]
sub esp, dword [ecx + edi*4 + 0xf442959]
lahf
bound edi, qword [ebx]
cmc
push 0x5d
sub dword [eax + 0x7f], ebx
lea esp, [edi + 0x22]
push ebx
fnstcw word [ebx + 1]
mov bl, 0xfa
fisubr dword [ecx + 0x35]
mov dword [esi - 0x60], ebx
add al, 0x1e
das
cmc
aad 0xc8
loopne 0x4c2f8f
xchg esp, eax
add ebp, 0x626194c0
invalid
and ecx, dword [ebx]
jmp 0x4c304b
ret
add eax, 0x606e257a
outsb dx, byte [esi]
add byte [eax - 0x24], ah
push cs
jl 0x4c305b
mov ah, 0x85
push es
ja 0x4c3044
call 0x9df5e3ad
dec ebp
mov bl, 0xa9
popfd
pop esi
je 0x4c30db
push cx
push eax
imul edx, dword [eax - 0x15], 0x51
invalid
invalid

Function at 0x505fb0
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax - 0x6cda2b5a], al
xchg esi, eax
adc al, 0x1b
add edi, dword fs:[ecx]
cmp dword [0xa7f00b4e], ebp
sub dword [edi], ebx
mov eax, dword [0x6887af15]
not dword [edx + 0x1d]
pop eax
in eax, 0x43
sbb eax, 0x35bf93a3
sub dword [edx + eax*4 - 0x726c1db], eax
pop esi
xchg ebx, eax
mov edi, 0x82842935
and eax, 0x5ef8d93e
cli
sbb bl, dh
xor dword [edx], esi
mov esi, 0xa90cb1f4
xchg ebx, eax
cdq
xchg ebx, eax
jp 0x505fd1
arpl word [eax], di
popal
invalid

Function at 0x5a7e00
Capabilities:
Encode data using xor

Disassembly:
and ch, byte [ecx - 0x7c]
fistp dword [edx]
cmp bh, al
dec ebx
nop
mov ch, 0xa7
dec ecx
and dword [ecx], ebp
popal
out dx, eax
mov cl, byte [esi - 0x86be3f1]
xor byte [ecx + 0x10], ah
add bl, byte gs:[ebx - 0x44]
or ah, byte [esi + 0x690ad43e]
and byte [ebx - 0x10], 0xed
or dword [edx], 0x38c3aef0
dec esi
or eax, 0x9a3e4246
jno 0x5a7e50
pop ebx
mov esp, 0xd43ea60a
or ch, byte [ecx - 0x80]
mov dword fs:[0xa81edf0], eax
invalid
inc ecx
or al, 0x10
dec edx
jl 0x5a7e1b
pop es
imul esp, dword [eax], 0xffffff8b
invalid
movsb byte es:[edi], byte [esi]
mov ebx, 0x8e388209
mov ah, 0xc2
push 0x2c1bd6f6
xor al, 0x1a
jg 0x5a7e51
mov edx, ebx
pushfd
jno 0x5a7e77
ror ch, 0x3b
invalid
invalid
Function at 0x5f5be0
Capabilities:
Encode data using xor

Disassembly:
or byte [esi], cl
into
pushfd
pop esp
inc ebx
adc dword [ecx], 0xffffffd1
xlatb
pop ss
lds eax, [0xba7ae828]
add eax, 0xba7ae828
mov esp, 0xf1ee2e7c
fimul dword [eax - 0x78]
mov cs, word [esi - 0x64]
pop esp
jno 0x5f5b6d
and esp, ebx
in eax, 0x25
ja 0x5f5b79
test al, 0x68
cli
cmp bh, byte [esp + edi*8]
out dx, al
xlatb
pop ss
test dword [ebp + 0x43], eax
adc ecx, 0x11
push cs
into
pop esp
pushfd
lcall 0x37a5, 0x6548885a
div ecx
xor dword [ebx - 0x5d], esp
arpl word [ebx + 0x2eee7cbc], sp
sub al, ch
cmp bh, dl
invalid
xor ch, byte [esi - 0x3a]
arpl word [ebx + 0x2eee7cbc], sp
sub al, ch
cmp bh, dl
lcall 0x69a, 0x32c66e32
scasb al, byte es:[edi]
dec edx
loop 0x5f5bb3
push ss
loop 0x5f5c42
push esi
invalid
stosd dword es:[edi], eax
mov bh, 0x1f
sbb dword [ecx + 0x19b145ed], esi
test dword [0x953d61c9], ebp
popal
leave
aad 0x7d
mov ecx, 0x11e54d11
mov ecx, 0xc1698d25
popfd
xor eax, 0xdd7569c1
imul eax, ecx, 0x69c1359d
jne 0x5f5c27
pop eax
invalid

Function at 0x6308a0
Capabilities:
Encode data using xor

Disassembly:
xor dl, byte [ebx]
or ebp, esi
aaa
pop esp
adc cl, cl
cmpsd dword [esi], dword es:[edi]
adc cl, byte [ecx - 6]
invalid
push edi
pop edx
imul ebp, dword [ebx], 0x9ed8881f
push 0x7f570782
pushfd
out dx, eax
inc edx
add al, 0x6c
ja 0x63087b
sahf
les eax, [edi - 0x5ecb1e88]
fiadd word [ebp - 0x56]
movsd dword es:[edi], dword [esi]
and esp, dword [edi + 0x723342d0]
pushal
inc esi
jae 0x63092c
cli
adc ebp, edi
iretd
and ah, byte [esi]
xor dl, byte [edx]
stc
sbb dword [edx - 0x684feecc], eax
rcl dword [ecx + 0x2b98bf22]
lodsb al, byte [esi]
fldcw word [esi + 0x27]
pop es
cmp dword [edi], ebp
cwde
ja 0x6309ad
insd dword es:[edi], dx
add byte [edi], dl
add byte [ecx], ah
xor cl, byte [0x55d1c620]
and dword [edx], esi
or eax, 0x55d1c620
adc al, 0x63
adc edi, edx
out 0x47, eax
fsubr dword [esi + 0xa]
add eax, 0x5934b6d3
clc
mov ecx, 0x78c22ab9
nop
sub eax, 0x97896c26
pop edx
xor ch, byte [ecx + eax*4 + 0x28]
cmpsb byte [esi], byte es:[edi]
jbe 0x630948
out 0xa7, eax
jecxz 0x63094c
xchg esp, eax
in al, dx
xchg ebp, eax
fidivr dword [edi - 0x5e]
xchg ebx, eax
ret 0x3e07
push esp
loope 0x6309e6
fisubr dword [ebp - 0x38]
push es
out 0x33, al
daa
mov edi, gs
mov dh, 0x6a
iretd
xchg ebx, eax
inc edx
rcl edx, 1
and dl, dl
xlatb
cmp byte [ecx + esi*8 + 0x13], cl
dec edi
pminsw mm5, mm4
mov cl, 0xd8
pop edx
wait
xchg esi, eax
pop edx
movsd dword es:[edi], dword [esi]
lds edi, [edi - 0x4b16c659]
call 0x1884a170
xchg ebx, eax
ljmp 0x42cf
Function at 0x631150
Capabilities:
Encode data using xor

Disassembly:
fstp xword [esi - 0xe]
les edx, [edi + 0x43]
add eax, 0x77d372aa
cmpsb byte [esi], byte es:[edi]
sal dword [edx - 0x77], 0x71
push ebx
pushal
sub ebx, dword [0xc7361203]
popal
xor cl, ch
shr byte [ebx - 0x7267540e], 1
sub dh, byte [eax + 0x4763ebc5]
stosd dword es:[edi], eax
dec byte gs:[esi - 0x62]
sar dword [ebx - 0x46], cl
sbb eax, 0x2bda1bd3
div byte [esi]
ret 0x753c
test al, 0x7b
sbb cl, byte [edx + eax - 0x5c]
mov ebx, 0xd2769ee6
push dword [ecx + 2]
and dword [ebx + 0x73], edx
xchg ah, dh
jb 0x631096
fisttp word [ecx + 0x23e9e24e]
mov ch, 0xf6
out dx, al
xchg esi, eax
out 0xe2, eax
out 0xef, al
lahf
xor byte [ecx + 0x5b9a87af], 0x16
xor eax, 0x4bdce141
xchg edi, eax
imul byte [edx - 0x29]
jno 0x631114
ljmp 0x1da7:0x918d7ad6
mov bl, dh
shl al, cl
rol cl, 0x2d
mov bl, 0xd5
xchg edi, eax
and dh, byte [ebp + edi*8 + 0x78b8a7bf]
ja 0x6310f7
xchg ebx, eax
invalid

Function at 0x636300
Capabilities:
Encode data using xor

Disassembly:
push ds
pop ss
ja 0x63637e
adc dl, al
daa
out 0xd5, al
rcl esi, 1
mov edx, esp
push ebp
ret
or dword [esi], edi
cmp al, byte [eax]
push esp
mov cl, 0x57
bound ecx, qword [ecx - 0x6a]
dec edx
xor edx, dword [ebx + eax + 0x7e]
stosd dword es:[edi], eax
inc edi
push es
inc edi
sub eax, 0x513beec4
xchg edi, eax
add al, 0xfc
cld
mov bh, 0xd6
push 0xbad67c07
add esp, dword [eax + 0x49]
jae 0x6363ef
sar dl, cl
ret 0x6018
loope 0x6363d0
pop es
adc edi, esi
retf 0x3f80
sbb dword [ecx - 0x27], ebx
shl byte [edx - 0x70], 1
int 0xf7
lahf
fnstenv [edi - 0x45e85ae1]
xlatb
daa
inc esi
inc ecx
popf
push edi
les ebx, [edx]
outsb dx, byte [esi]
jne 0x636410
retf 0x1c30
xor byte [edx + edx*4], bl
fst qword [ecx]
jecxz 0x636398
loop 0x63641f
adc byte [eax + edi*2 + 0x4a71f585], dl
popfd
or edx, dword [edx + 0x1d]
push ds
clc
fdivr qword [edi - 0x41]
jg 0x6363c7
retf 0x9fa4
invalid
jnp 0x6363c8
test al, 0x40
inc eax
dec ebp
aam 0xe
dec esi
adc al, 0x12
add bl, ch
jp 0x636448
adc byte [edi], dh
and eax, 0xb00d22b2
jae 0x636406
mov dh, 0xe6
push edx
imul ecx
xchg ebp, eax
loope 0x636404
loope 0x63641e
xor dword [edi + 0x52], edx
cwde
ja 0x63644f
sbb dword [eax + 0x4e], esp
dec esi
and edi, dword [ecx]
xor al, 0xfc
cmpsb byte [esi], byte es:[edi]
aaa
loop 0x636456
rcr bl, cl
xor dh, cl
test ch, 0x17
lds edx, [edi]
inc ecx
popfd
xchg esi, eax
sbb cl, 0xab
out 0x27, eax
inc eax
adc ch, byte [ebx + 0x12]
idiv dword [esi + 0x53]
xchg esi, eax
test edx, esi
test eax, 0xbddcec41
mov ebp, ebp
out dx, al
in al, dx
jae 0x6364ac
fsubr qword [eax + ecx*8]
push edx
push ebp
sbb byte [eax], 0x81
pop edi
pop esp
invalid
outsd dx, dword ss:[esi]
ret 0x71c1

Function at 0x642710
Capabilities:
Encode data using xor

Disassembly:
fucom st(4)
mov eax, dword [0x99a79d02]
cdq
or eax, 0x3ec92234
xchg ebp, eax
leave
xchg ebp, eax
mov eax, dword fs:[0x2856e1b5]
and dl, byte [ecx - 0x14]
mov ebp, 0x48e736b2
adc dword [eax], ebx
xor dword [edi - 0x1e], edx
mov dh, 0x8c
sub al, 0x3f
jo 0x64270c
adc edi, dword [edx + 0x51]
xor bh, ah
rcl ch, cl
loope 0x642706
mov byte [eax], dl
in eax, 0x99
stc
pop ds
salc
mov eax, 0x4c767992
pop edi
retf 0x32c1
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000983f
pop dword [ebp - 0x28]
mov eax, 0x1000983f
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x36c5b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x6cf8df71
add ecx, 0x93075fa4
xor esi, esi
add esi, eax
mov edi, 0xe66012af
add edi, 0x29a17351
add edi, dword [ebp - 0x28]
mov ebx, 0x2cc2dd35
sub ebx, 0x2d1fc281
mov edx, dword [edi]
xor dword [ebp - 0x24], 0x5eb5ac14
sub edx, ebx
mov dword [esi], edx
add dword [ebp - 0x14], 0x7db71157
add esi, 0x4879aa73
add esi, 0xb7865591
add edi, 0x700ff8d2
sub edi, 0x700ff8ce
loop 0x10009896
add eax, 0xef27
xor ebx, ebx
add ebx, eax
add eax, 0x608499be
add eax, 0x9f7b6647
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x633470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x581015
lea edi, [esi - 0x180015]
mov dword [edi + 0x20b988], 0x26ce9774
push edi
or ebp, 0xffffffff
jmp 0x63349a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6334a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x633490
mov eax, 1
add ebx, ebx
jne 0x6334b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6334c4
jne 0x6334e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6334e3
dec eax
add ebx, ebx
jne 0x6334d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6334a8
add ebx, ebx
jne 0x6334df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x633535
xor ecx, ecx
sub eax, 3
jb 0x6334fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x63356a
sar eax, 1
mov ebp, eax
jmp 0x633506
add ebx, ebx
jne 0x633506
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6334d4
inc ecx
add ebx, ebx
jne 0x633514
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6334d4
add ebx, ebx
jne 0x633521
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x633516
jne 0x633532
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x633516
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x633554
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x633546
jmp 0x633496
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x633554
add edi, ecx
jmp 0x633496
pop esi
mov edi, esi
mov ecx, 0x63d1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x633572
cmp byte [edi], 0x24
jne 0x633572
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x633577
lea edi, [esi + 0x226000]
mov eax, dword [edi]
or eax, eax
je 0x6335e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2334ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23353c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6335a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x233544]
or eax, eax
je 0x6335e0
mov dword [ebx], eax
add ebx, 4
jmp 0x6335c1
call dword [esi + 0x233540]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x633617
cmp al, 0xef
ja 0x63360a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6335ec
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6335f9
mov ebp, dword [esi + 0x233548]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x233672]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x633663
sub esp, 0xffffff80
jmp 0x4014c0
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40673a
pop dword [ebp - 0x50]
mov eax, 0x58616303
sub eax, 0x5820fbc9
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x13123a46
add dword [ebp - 0x60], 0x3b400b05
mov dword [ebp - 0x5c], 0x93746c48
add dword [ebp - 0x5c], 0x9ebedffd
mov dword [ebp - 0x58], 0xf97e3fc0
sub dword [ebp - 0x58], 0xad31fb92
mov dword [ebp - 0x54], 0x84ef6926
add dword [ebp - 0x54], 0x7b1096da
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xf295c835
add dword [ebp - 0x60], 0x81dca121
mov dword [ebp - 0x5c], 0x77e63b3b
add dword [ebp - 0x5c], 0xc986263a
mov dword [ebp - 0x58], 0x4e4d12fc
add dword [ebp - 0x58], 0x15225970
mov dword [ebp - 0x54], 0xeffa6dc9
sub dword [ebp - 0x54], 0xeffa6dc9
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3ab05
push 0
call eax
mov ecx, 0x3fd70013
sub ecx, 0x3fd6ab62
mov edi, eax
mov esi, 0x46e400
add esi, dword [ebp - 0x50]
mov ebx, 0x1be36664
sub ebx, 0x33e199db
sub dword [ebp - 0x38], ebx
mov edx, dword [esi]
xor dword [ebp - 0x34], 0x52315472
sub edx, ebx
sub dword [ebp - 0x18], 0xc172fe70
mov dword [edi], edx
xor dword [ebp - 0x18], 0x1376b428
add edi, 0x5084a12d
add edi, 0xaf7b5ed7
add esi, 0xcce0b39e
add esi, 0x331f4c66
loop 0x40684c
add eax, 0xdf16cf29
sub eax, 0xdf158992
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6650bf29
sub ecx, 0x6610bf29
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1001224e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1001225d
pop dword [ebp - 0x20]
mov eax, 0x1001225d
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x873b80d2
sub dword [ebp - 0x30], 0x38e93b87
mov dword [ebp - 0x2c], 0x48bb6f20
add dword [ebp - 0x2c], 0xe977dd25
mov dword [ebp - 0x28], 0x4e6af8a6
add dword [ebp - 0x28], 0xfde14b88
mov dword [ebp - 0x24], 0x7a1c854d
sub dword [ebp - 0x24], 0x7a1c854d
lea eax, [ebp - 0x30]
push eax
mov eax, 0xfd1c6224
sub eax, 0xed1b118c
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xca626486
add dword [ebp - 0x30], 0xaa1004d0
mov dword [ebp - 0x2c], 0xfb7ed4a9
add dword [ebp - 0x2c], 0x45ed8ccc
mov dword [ebp - 0x28], 0xda4aa4e9
add dword [ebp - 0x28], 0x8924c783
mov dword [ebp - 0x24], 0xe7562781
add dword [ebp - 0x24], 0x18a9d87f
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xf89115c9
sub eax, 0xe88fc52d
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3b4fe
push 0
call eax
mov ecx, 0xecc98855
sub ecx, 0xecc93564
mov esi, eax
mov edx, 0xfef5a806
add edx, 0x110e73fa
add edx, dword [ebp - 0x20]
mov ebx, 0x2d64aa39
add ebx, 0xd07234df
mov edi, dword [edx]
mov dword [ebp - 0x10], 0x64e0735c
xor edi, ebx
add dword [ebp - 8], 0xad745a2d
mov dword [esi], edi
mov dword [ebp - 8], 0xb3adac96
add esi, 0xd1dca2cc
sub esi, 0xd1dca2c8
add edx, 0x2e4c9177
add edx, 0xd1b36e8d
loop 0x1001237a
add eax, 0xc298a16e
sub eax, 0xc29762d7
mov ebx, eax
add eax, 5
mov ecx, 0xc2139783
sub ecx, 0xb2139783
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x100022de
pop dword [ebp - 0xc]
mov eax, 0x100022de
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x5ee72cc9
add dword [ebp - 0x1c], 0xef6b1882
mov dword [ebp - 0x18], 0x43067a02
add dword [ebp - 0x18], 0xef2cd243
mov dword [ebp - 0x14], 0xaf5fd05
add dword [ebp - 0x14], 0x41564729
mov dword [ebp - 0x10], 0xecbb5078
sub dword [ebp - 0x10], 0xecbb5078
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xd3bcb90a
add dword [ebp - 0x1c], 0xa0b5b04c
mov dword [ebp - 0x18], 0xcc1a55e0
sub dword [ebp - 0x18], 0x8aadf46b
mov dword [ebp - 0x14], 0x17ffaeb7
sub dword [ebp - 0x14], 0xb490424b
mov dword [ebp - 0x10], 0xcf1ca784
sub dword [ebp - 0x10], 0xcf1ca784
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3731e
push 0
call eax
mov ecx, 0x4ad5
mov edi, eax
mov edx, 0x9f25f8d4
sub edx, 0x8f2596d4
add edx, dword [ebp - 0xc]
mov esi, 0x3cdd0019
sub esi, 0xa43254f5
add dword [ebp - 8], 0x85ad95cb
mov ebx, dword [edx]
xor dword [ebp - 8], 0x4b6a9656
xor ebx, esi
mov dword [ebp - 4], 0xb6d5db44
mov dword [edi], ebx
add dword [ebp - 8], 0x7a6897a8
add edi, 4
add edx, 0xd9d6ba7d
sub edx, 0xd9d6ba79
loop 0x100023eb
add eax, 0x1f22c87a
add eax, 0xe0de55ad
xor ebx, ebx
add ebx, eax
add eax, 0x12274d36
sub eax, 0x12274d31
mov ecx, 0xe98d98f
add ecx, 0x1672671
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10009100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10025768
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1002d7d8]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x1002d7d8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
mov edi, ecx
mov ecx, dword [esp + 0x7c]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.10001190
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.10007380
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.1001b68c
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x58], 0xffffffff
test eax, eax
je 0x100091ef
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.1001b68c
mov eax, dword [edi + 4]
test eax, eax
jbe 0x100091cd
cmp eax, 0xffffffff
jae 0x100091cd
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.1000f167
test esi, esi
je 0x100091ef
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x68], 0
mov edx, dword [esp + 0x64]
jne 0x10009238
test edx, edx
je 0x1000922d
mov eax, dword [edx + 0x20]
cmp dword [eax], 0
je 0x10009215
mov ecx, dword [edx + 0x30]
cmp dword [ecx], 0
jle 0x10009215
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x10009222
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0x10]
call edx
mov edx, dword [esp + 0x64]
cmp eax, 0xffffffff
je 0x1000922d
mov byte [esp + 0x69], al
jmp 0x10009233
xor edx, edx
mov dword [esp + 0x64], edx
mov byte [esp + 0x68], 1
cmp byte [esp + 0x70], 0
mov ecx, dword [esp + 0x6c]
jne 0x10009274
test ecx, ecx
je 0x10009272
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x1000925e
mov esi, dword [ecx + 0x30]
cmp dword [esi], 0
jle 0x1000925e
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x1000926d
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x64]
cmp eax, 0xffffffff
jne 0x10009274
xor ecx, ecx
test edx, edx
jne 0x1000927e
test ecx, ecx
je 0x10009282
jmp 0x10009286
test ecx, ecx
je 0x10009286
or dword [ebp], 1
lea ecx, [esp + 0x2c]
cmp dword [esp + 0x14], ecx
je 0x100092a3
cmp dword [esp + 0x10], 0
jne 0x100092a3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
jmp 0x100092a7
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov dword [eax], edx
mov edx, dword [esp + 0x68]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10011cf3
add esp, 0x4c
ret 0x20