joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10084f52
Capabilities:
Packed with generic packer

Disassembly:
pushal
push ebp
xchg dword [esp + 0x30], esi
call fcn.103dd285
pop edx
popal
and cl, byte [ebx + 0x4c25de5]
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp

Function at 0x1009700f
Capabilities:
Packed with generic packer

Disassembly:
and al, 0x28
jmp fcn.100088c6
movsx di, dl
movsx edi, dl
not di
nop
not edi
call fcn.102456e9
popal
push esi
sub dl, dl
je 0x10097032
invalid
xchg esi, eax
jb 0x10097010
push cs
das
inc edx
fdiv qword [esi]
mov esi, 0x49f45a33
shl dword [esi - 0x7b], 1
salc
xchg ecx, eax
push ds
cmpsd dword [esi], dword es:[edi]
or al, 0x7a
mov dl, 0xf1
xchg ecx, eax
popal
cld
cmp ebx, ecx
mov bl, 0xaa
test dword [ecx], ebx
inc edi
fild qword [esi]
add ecx, ebx
sar dh, 1
xor bl, byte [eax]
js 0x10097007
sbb al, 0x5c
jge 0x1009709d
mov eax, dword [0xf3266f56]
push eax
push eax
dec ecx
loop 0x10097067
mov dword [0x1970ec33], eax
cdq
add bl, 0x98
fadd dword [ebx - 0x78]
lodsd eax, dword [esi]
sbb eax, 0x4b49d94c
into
lodsb al, byte [esi]
sub ebp, edi
sbb dword [edx - 0x59e429d2], eax
pop es
sti
xchg esp, eax
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
xchg esi, eax
adc ah, byte [ecx + 0x7e]
ret
lcall 0xa6ac, 0x446b070e
dec ebx
cmp eax, 0xc84f1178
sbb al, 0x77
insb byte es:[edi], dx
cwde
or dl, byte [eax + 0x20a6f85e]
fiadd dword [edx + ebp + 0x4e9cdde4]
mov eax, 0x58bee87e
and al, bl
sub al, 0xcb
sahf
mov ebx, 0xd5770cc7
xchg ecx, eax
xchg esp, eax
xchg esp, eax
lea eax, [ebp + 0x762c8515]
lahf
invalid
Function at 0x100ac4f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x101b1b80]
xor edx, edx
cmp eax, edx
jne 0x100ac516
xor eax, eax
mov byte [eax + 0x101b1a80], al
inc eax
cmp eax, 0x100
jl 0x100ac4fe
mov dword [0x101b1b80], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x101b1a80
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x100ac5a7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x100ac57a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x100ac548
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x100ac620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x100ac673
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x100ac65a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b3020
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100e0d2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.100b3940
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x101595fc
call fcn.100d1ee9
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x100b30b3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100d1ee9
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x100b30ac
push 0
mov ecx, eax
call fcn.100aa120
mov dword [esi + 0xc], eax
jmp 0x100b30b5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x100b30b5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x10223838
Capabilities:
Encode data using xor

Disassembly:
pushfd
call fcn.102d66ff
mov edi, 0xc6fc6d78
jo 0x102237e6
jl 0x10223886
adc dword [edx + 6], edi
or edi, dword [eax + 0x51]
ljmp 0x7ea4
in al, 0x8e
out dx, al
invalid
xchg esi, eax
outsd dx, dword [esi]
lodsb al, byte [esi]
shr dword [0xba3e1e90], 1
jne 0x10223843
cli
fcom qword [ecx]
pushfd
imul eax, dword cs:[esi - 0x39], 0x49
loope 0x10223862
popal
add al, 0x87
mov cl, 0x1a
imul eax, dword [edx], 0xbf6e126a
insd dword es:[edi], dx
lodsb al, byte [esi]
aad 0x9c
xor edx, ecx
mov edi, 0x3bfe218e
push esp
out 0xfa, al
pmulhw mm2, mm5
xor eax, 0x91ef1e4e
adc al, 0x68
cmpsb byte [esi], byte es:[edi]
jl 0x102238a8
invalid

Function at 0x10225260
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp], 0x275a
mov dword [esp + 0x38], edx
mov word [esp], 0xa40
mov byte [esp + 0xc], dl
setbe dh
bswap edx
mov edx, 0x1002f15c
push ebp
jmp 0x103a213f

Function at 0x10229edb
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x24], 0x680d1d60
push dword [esp + 4]
mov word [esp + 8], dx
push dword [esp + 4]
lea esp, [esp + 0x2c]
jmp fcn.10005a1b
mov word [esp + 4], 0xe55c
call fcn.1021c065
das
sub al, 0xea
movsb byte es:[edi], byte [esi]
cwde
cmc
jge 0x10229e84
mov dword [esp + 4], 0x7ee8e55c
and edi, edi
jmp [edi]
dec esi
lcall 0x7db7, 0x8e3b214f
pop ss
lds ebp, [edi]
or esi, dword [ebx - 0xcf26007]
popfd
test ebp, 0x61af052f
sti
mov bl, 0x5b
lock xor dword [esi - 0x6d], edi
or eax, dword [eax - 0xd21c266]
mov dword [edx + edi*8 + 0x4e], esi
mov bh, 0x5d
aaa
and al, 0xaf
or eax, 0x1ae92a40
pop edi
dec esp
mov al, byte [ebx - 0x1073d3a8]
mov ecx, 0xb29a8e7d
dec ebp
mov dh, 0x19
cmpsd dword [esi], dword es:[edi]
pop ds
push ecx
fisttp word [edi - 0x448b74f9]
push eax
mov bl, 0xab
dec ebp
sahf
fmul qword [edx + 5]
or al, byte [ecx]
insb byte es:[edi], dx
xlatb
lds ebx, [ebp + 0x3b]
inc esi
stosd dword es:[edi], eax
fild dword [eax]
jb 0x10229edc
imul edi, dword [edx], 0x14
popal
in al, dx
mov dl, 0xd5
test eax, 0xdfc27107
adc dword [edx + ecx*8 + 0xd], ebx
nop
inc edi
xor eax, 0x591d86f7
daa
adc eax, 0xfd6ed51
mov dword [0xc4fe5888], eax
in al, dx
push ebp
pop ecx
mov dword [0xb1c46f3e], eax
cmp dword [eax - 0x23fe57d0], eax
punpckhdq mm3, qword [edx - 0x52199cfb]
ljmp 0x2ed
Function at 0x10232fb3
Capabilities:
Encode data using xor

Disassembly:
jl 0x10232fa7
inc eax
and al, 0x20
or al, 0x67
xchg ecx, ebp
pushal
call fcn.10303208
call fcn.103b02e3
adc eax, 0x2369f131
pop ss
add byte [0x2369f131], dl
fnsave dword [edi - 0xf]
mov ch, 0x2d
mul dword [ecx + 0x7a]
mov dh, 0x63
loop 0x10232f81
and dl, bh
sbb al, dl
js 0x1023303c
jns 0x10232fb6
xor dword [eax - 0x18b723ce], ecx
xchg dword [eax], esp
test al, 0x26
in al, dx
inc ecx
sub eax, 0x40d7a712
mov al, byte [0xa6fc523f]
cmp eax, 0xfca2791
nop
or eax, 0x87b2a869
std
fsub dword [ebx]
femms
test al, 0x30
jmp 0x27af8730
sbb byte [ecx + 0x12], ah
mov byte [0x2bb3b4b6], al
ja 0x102330ac
cmp edx, dword [edx - 0x3f02f38f]
nop
or byte [esi + edi*2 + 0x46], bh
push edi
adc ch, byte [edx]
test ebx, esp
inc ecx
and byte [ebx + esi + 0x725390de], dl
mov eax, 0xca502e0d
outsb dx, byte [esi]
out 0xe4, eax
add bh, byte [ebp - 0x41]
fdiv dword [0x1f53106e]
adc byte [ebx + 0x1f], dl
arpl word [edx - 0x80], dx
xor al, 0x36
xchg edi, eax
cmc
sbb dword ds:[0x915337d8], edx
xor word [ecx + 0x44b417f9], si
jecxz 0x1023306d
inc esi
in eax, 0x14
xchg ecx, eax
mov cl, 0x25
push esi
mov esp, dword [eax - 0x3f5485c1]
sub cl, dl
dec ebp
leave
xor al, 0x73
outsb dx, byte [esi]
out dx, al
cmpsd dword [esi], dword es:[edi]
add byte [0x9cb78e95], ah
std
rol byte [ecx - 0x47dcb4e1], cl
sbb al, 0x44
mov ebp, 0x74808d21
lea eax, [eax + 0x6dc5ba74]
mov word [esp + 4], sp

Function at 0x1023e381
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [eax + 0x2f339b81]
das
mov ebp, 0x10017cba
call fcn.102646fa
cmc
pushal
or dh, byte [edx + ebp*2 + 0x1f8014]
inc eax
push edi
adc dword [ecx], edi
adc ah, bl
add eax, 0xf51b711
mov ecx, 0x61d2b55b
mov edi, 0xb6b91f65
xor eax, 0x196fb911
mov ebx, 0x36d2d975
stosd dword es:[edi], eax
lds ebp, [eax + 9]
fild dword [ebx + 0x60]
daa
jno 0x1023e386
mov dword [0x649748cc], eax
ror cl, cl
into
ja 0x1023e3ef
jbe 0x1023e3d1
sbb eax, 0x332d2b57
add edi, dword [esi + 0x1b]
push edi
sub ebp, dword [0x1b7e0333]
sub al, 0x81
mov dh, 0xdf
adc al, 0x78
fadd qword [ebp - 0x3f]
or eax, 0x986b9c84
adc al, 0x16
movsb byte es:[edi], byte [esi]
or byte [edx], al
xchg byte [ebx + ecx + 0x6f972275], bh
xor eax, 0xabbc78b4
wait
invalid
and dl, byte [edi + 0x78b4356f]
mov esp, 0xf0c79bab
insb byte es:[edi], dx
mov ebx, 0xd35db0d
invalid
Function at 0x10260dcf
Capabilities:
Packed with generic packer

Disassembly:
pushfd
call fcn.102d72ed
or dword [eax], eax
pushal
call fcn.1035ccb9
pushfd
pushfd
mov eax, dword [eax + 0x213cd7]
call fcn.1007293d
imul ebx, dword es:[edi], 0xffffffc7
jge 0x101d6559
invalid
sar dword [ebx + 0x1d], 1
ja 0x101d655f
cdq
inc ebx
lodsd eax, dword [esi]
jae 0x101d6519
cmpsd dword [esi], dword es:[edi]
push ecx
mul dword [ecx + 0x41]
mov ecx, 0x3c9d2d83
das
shl cl, 1
pop ebp
test eax, 0xaefe60f0
lodsd eax, dword [esi]
mov esp, 0xa467782c
mov al, 0x20
pushfd
and bh, byte [edx - 0x36fa5a0e]
cmp edx, 0x15e51085
das
inc edi
pushal
lahf
stosb byte es:[edi], al
sbb byte [eax + 0x71], bh
jge 0x101d6507
std
xor ch, byte [ebx + 0x60]
mov ecx, 0x73e33ade
pop esp
mov eax, 0x27d884e7
leave
test dword [ebp - 0x59], edx
sub dword [ebx], ebx
ror dword [edx - 0x62], 1
in eax, dx
and byte [0x8960ddc3], bl
sbb dword [eax + 0xa], ebp
invalid
mov eax, 0x1006c3de
call fcn.102e011d
xchg dword [esp + 0x20], eax
pushal
mov word [esp + 4], 0xc180
push dword [esp + 0x40]
ret 0x44
jb 0x101d650f
push ecx
pushfd
mov eax, dword [eax + 0x213cd7]
push dword [esp]
pushal
lea esp, [esp + 0x2c]
jns 0x1000b069
lea eax, [eax - 0xaee314d]
pushal
lea esp, [esp + 0x20]
jle 0x102ce250
xchg dword [esp], eax
push ebp
mov byte [esp], 0x27
push eax
push dword [esp + 4]
push dword [esp + 0xc]
ret 0x10
mov dword [esp + 0x50], eax
lea eax, [esi*8 + 0x737ddb41]
lea esp, [esp + 0x4c]
jns 0x103098dd
mov eax, 0x1006c3de
jmp 0x1023ac0b
pushal
mov byte [esp], al
jmp 0x10239374
pushfd
seto al
mov byte [esp], 0x1b
jmp 0x10222e1a

Function at 0x1029a887
Capabilities:
Encode data using xor

Disassembly:
nop
mov word [esp], 0x771f
mov byte [esp], bh
jmp loc.1008d6f8
push dword [esp]
jmp 0x10215e66
Function at 0x102ed3e6
Capabilities:
Encode data using xor

Disassembly:
lea eax, [eax - 0x4520fc29]
mov dword [esp], edi
call fcn.103f7c8b
jmp 0x10446d7f
pushal
call fcn.103fc291
pushfd
xchg dword [esp + 0x14], eax
pushal
pushfd
mov dword [esp + 0x34], eax
lea eax, [ebx - 0x420a978f]
setae ah
mov eax, 0x10001a0f
mov byte [esp + 8], 0x17
push 0xf4d8182
push 0xa86737dc
mov eax, dword [eax + 0x229372]
jmp 0x101ef0b8
pushal
lea ecx, [ecx + 1]
jmp 0x103623d5
pushfd
mov dword [esp], ecx
push esp
jmp 0x10233dde
jmp 0x10364fd1
lea ecx, [ecx + 0x2d2835a2]
call fcn.1023f4dc
xor dword [eax + 0xe], ebp
enter 0xfffffffffffff47c, 0xffffffffffffffc8
inc eax
cli
rol byte es:[esi + 0x4d38ce20], 1
rol byte es:[esi + 0x4d38ce20], 1
sbb al, 0xd0
cmp byte [edx], cl
mov ah, 0x66
and byte [ebx + edx - 0x3a], dh
out 0x23, eax
cmp edi, dword [0x437103eb]
in eax, dx
mov esp, 0xd869be33
xor eax, 0x79b2de05
xor dword [edx + 0x7d5ca410], 0xffffffdd
mov dword [esi + 0x7f], edi
sub dword [ecx - 0x5b3503fb], edi
xchg ecx, eax
sbb al, 0x50
sbb eax, 0xbbe21ec2
wbinvd
jo 0x102fa96f
cdq
into
call dword [edx]
and byte [edi + 0x1f], ch
pop ds
jge 0x102faa09
scasd eax, dword es:[edi]
pop ecx
adc eax, 0xa0f24fbe
insd dword es:[edi], dx
out 0xdf, al
sbb dh, ah
invalid
je 0x102fa9b3
rcr bh, 0x19
cwde
xor dword [ebp + 0x2b], ebx
dec ebp
salc
pushaw
sub esp, ecx
pushfd
je 0x102fa9ab
inc edi
lcall 0x5f06, 0xb20ce4d8
in al, 0xc
mov dl, 6
pop edi
inc edx
and cl, dl
mov esp, ds
in eax, dx
jp 0x102fa9b5
ja 0x102fa9f4
mov al, byte [0xec35beb8]
stc
adc dword [ebp - 0x2c], ebx
in al, dx
out 0x58, al
sub al, 0xf5
jbe 0x102faa55
xchg esp, eax
or byte [ecx], al
push ebp
stosb byte es:[edi], al
push ebx
invalid
or ebp, dword [0xcc1601ea]
inc esi
adc byte [edx + 0x22ca165c], bh
invalid
pushfd
mov byte [esp], 0x2f
lea esp, [esp + 4]
jo 0x102e58f1
push eax
xchg dword [esp], ecx
mov dword [esp + 0x24], ecx
pushal
movsx cx, cl
movsx cx, cl
push eax
mov ecx, 0x100c9995
call fcn.10208fbf
pushfd
nop
lea esp, [esp + 4]
jp 0x1035a9b2
pushfd
mov dword [esp], ecx
mov byte [esp], bh
xchg dword [esp], ecx
setnp cl
jmp 0x1040642b
mov ecx, dword [esp + 4]
jg 0x1029c9c9
pushfd
lea ecx, [ecx + 1]
jmp 0x10280b52
mov ecx, dword [esp + 8]
mov byte [esp], cl
lea ecx, [ecx + 1]
mov byte [esp], al
mov word [esp], ax
push edx
mov dword [esp + 0xc], ecx
pushal
movsx cx, al
push dword [esp + 8]
movzx cx, dl
mov ecx, 0x100c9995
push 0x847943e2
mov word [esp], 0x1a88
mov ecx, dword [ecx + 0x199c19]
jmp 0x102fa95a
Function at 0x102fe597
Capabilities:
Encode data using xor

Disassembly:
mov eax, esi
add al, 0x61
cmp dword [ebx + 0x6c], eax
cmp al, 0xa4
xor al, 0xa9
invalid
lahf
pop ds
fsub dword [ecx]
push es
invalid
lea ebx, [ebx - 0x290df5c7]
wait
cmp dword [edx], ecx
salc
call fcn.1021e3e2
jp 0x102fe56a
push es
push edi
test al, 0xad
sub al, 0xf8
jo 0x102fe5d7
invalid
mov ch, 0xee
jbe 0x102fe630
jo 0x102fe598
xchg esi, eax
rcr ebx, 0x68
mov dh, 0xa9
out dx, al
inc edi
scasd eax, dword es:[edi]
dec esi
and ebp, esi
lodsd eax, dword [esi]
leave
lcall 0x3c8a, 0xe30a9ae3
pop ds
mov bh, byte [edi + ebx]
insd dword es:[edi], dx
inc esp
adc dword [edi], eax
and byte [ebp - 0x6f], ah
stc
add eax, 0x3b58f2b8
push ecx
push ebx
pushal
jnp 0x102fe5be
xchg ebp, eax
fsubr st(1)
pop eax
cwde
pop ebx
je 0x102fe581
inc ebp
mov ecx, 0x7af70ea2
in eax, 0xfd
jmp [ebp + 0x75f54e7d]
add al, 0x85
test eax, 0xe9287cc2
invalid
Function at 0x1030eca9
Capabilities:
Authenticate hmac

Disassembly:
mov byte [esp + 4], 0x48
pop edx
mov edx, 0x100a0bfc
push esi
mov byte [esp + 4], 0x5c
jmp 0x10419f5f
xor byte [ebx + esi*8 + 0x1d912755], ah
sub cl, byte [ebp + 1]
stosd dword es:[edi], eax
add eax, ebp
outsd dx, dword [esi]
sub eax, dword [ebx + 0x5fa5035b]
add eax, esp
pop edx
ret
mov edx, dword [edx + 0x128430]
push ecx
mov byte [esp + 4], dl
pushfd
lea edx, [edx - 0x339c8e0b]
pushfd
call fcn.102c3ce3
insb byte es:[edi], dx
mov bh, 0x75
das
leave
jae 0x10419f15
mov eax, 0x78db2fcb
push ecx
jp 0x10419f15
dec esi
push ebx
inc edx
out dx, eax
outsb dx, byte [esi]
inc esp
mov esi, 0x527c3288
inc edi
mul byte [esi + ecx + 0x4ea84ad0]
dec edx
test al, 0x4e
sbb byte [edx + 0x3f66ee54], al
mov bh, 6
test al, 4
push es
xchg esp, eax
xchg ecx, eax
fimul dword [esi - 0x55]
push ds
stosd dword es:[edi], eax
les eax, [esi*4 - 0x482cdb36]
test eax, 0xf814312
or bh, dl
fcom dword [edx]
xor al, 0xde
sysenter
cmp al, dl
ja 0x10419fe1
push 0xa87ef643
je 0x10419fb9
out dx, al
sub al, 0x8d
sti
or eax, 0xabfa9994
inc edi
pop esp
pop esp
test eax, 0xe5c97a02
scasd eax, dword es:[edi]
add bh, byte [edx - 0x37]
in eax, 0xaf
inc ebx
packuswb mm4, qword [edi + 0x2ebd5c5d]
ror byte [edi - 0x142ecd67], 0x36
jp 0x10419fd9
xchg esp, eax
push 0x8ecac6c4
ror dword [ebp + 0x2d], 1
or dword [edi - 0x4c], 0x5b26a948
outsd dx, dword [esi]
out dx, al
push ss
lcall 0xa057, 0x39c3fd0
sar byte [edi], 1
pushfd
add edx, dword [edi - 0x60]
js 0x10419f96
mov cl, 0x3d
out 0x37, al
jne 0x10419fb7
sub edi, dword [edx - 0x24]
add dword [eax + 0xfc064a5], eax
sub esi, ebp
mov dword [edi - 4], ebx
cld
sahf
dec eax
push es
mov esp, 0xb05e4553
fnstcw word [edx]
js 0x10419fdb
jno 0x1041a021
stosb byte es:[edi], al
and al, cl
pushal
scasb al, byte es:[edi]
pop ds
xchg ebp, eax
mov dword [0x600000cd], eax
pushal
je 0x1041a056
les ebx, [edi + 0x13]
push 0xfffffffffffffff3
lea esi, [edi]
pushfd
cmp ebx, dword [ecx - 0x3c9912d7]
sahf
mov eax, dword [0xd702661]
push edi
jecxz 0x1041a03b
ret
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
push ebx
inc esp
shr byte [ecx - 0x32], 0x23
cmp esp, dword [eax + edx*4]
jns 0x1041a03b
sal byte [esi], cl
out dx, eax
cmp byte [ebp - 0x33], bl
xchg dl, al
in eax, dx
jns 0x1041a0bf
loope 0x1041a04b
pop esp
xor eax, 0x54bf9ad
dec eax
inc edx
push ds
xchg edi, eax
jmp 0x1041a006
invalid
call 0x4cb08956
xchg esi, eax
sbb byte [eax - 0x23aee776], cl
sub al, 0x3b
or byte [0x9b377dbf], bl
popfd
fimul word [ebx + 0x25]
dec esp
loope 0x1041a12e
invalid
inc edx
hlt
Function at 0x1030efc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
call fcn.103952a2
sbb byte [ebp + 0xb680b35], 0x26
inc ebx
pop ds
mov dword [esp], 0x8d3ae707
jmp 0x1039fe48
mov dword [esp + 0xc], ebp
bswap bp
lea esp, [esp + 0xc]
js 0x103e00d9
pushfd
mov ebp, 0x10084911
call fcn.101fc489
mov dl, 0xcd
xchg ebx, eax
cmp eax, 0x78d949df
pop ss
not byte [ebx - 0x48]
xchg edx, eax
lodsb al, byte [esi]
or al, byte [eax + ecx*2 - 0x35035d10]
invalid
pushfd
pushfd
pushfd
mov dword [esp + 8], 0x5c180acc
pushfd
push dword [esp + 4]
lea esp, [esp + 0x10]
jmp fcn.10005909
not bp
push 0xcd74a1dc
lea esp, [esp + 4]
js 0x102cc647
mov ebp, 0x10084911
pushal
call fcn.1038c706
imul edx, dword [edi + 0x21], 0xffffff9b
push ebp
invalid

Function at 0x1036ad73
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [edi + 0x377545]
call fcn.1038cbaa
sbb dword [esp + ebp - 0x6c], esp
test eax, 0x614a7c68
push cs
test al, 0x6a
aam 0xf5
push 0x3e
aam 0xf5
pop esi
sbb dh, byte [edx + 0x40]
stosb byte es:[edi], al
and al, 0xca
sahf
inc esi
in al, dx
xchg esi, eax
dec esp
out 0x94, al
dec esi
aaa
mov dh, 0x92
sub ch, al
mov byte [0x475ee64c], al
out 0x9b, al
insd dword es:[edi], dx
pop edx
in eax, 0xec
jle 0x101e4ab1
dec esi
xlatb
sbb bl, ah
jbe 0x101e4a2c
adc byte [ebx], ch
wait
invalid
dec edx
sbb al, byte [eax]
inc ebp
fld dword [ecx - 0x16]
jp 0x101e4aed
cmpsd dword [esi], dword es:[edi]
push eax
loopne 0x101e4aea
dec ebx
sub byte [esi - 0x4b832df1], bl
das
fnstenv [ebx - 0x25]
aad 0x6c
rol ch, 1
xchg ebx, eax
pop eax
jge 0x101e4ae8
lds edx, [ebx - 0xee882a8]
int1
dec edi
stc
dec byte [ebp - 0x54d436d8]
cli
insb byte es:[edi], dx
shl dword ss:[ecx + 0x5900d9d9], 0xc1
adc byte [eax], cl
loopne 0x101e4b63
dec ecx
pop es
xor byte [ebp - 0x21996de0], dl
sbb ch, byte [esi - 0x2c8658ed]
mov eax, dword [0x1d77cd0b]
mov dword [ebx + 0x2f67cd2b], 0x3c175c7
push ss
aaa
adc eax, 0xe49664e4
mov al, 0x73
mov ebx, 0xd6e89c28
test bl, al
xor byte [edx + 0x33769e93], bh
or al, 0x45
jno 0x101e4acc
xchg edx, eax
ficomp word [edx]
scasb al, byte es:[edi]
adc esp, dword [edi + 0xba1d379]
int 0x77
sbb eax, 0xcd2b83c7
das
invalid
cmc
dec edx
aaa
pop esp
popfd
ret 0x1b32
add al, ch
sbb dword [0x74870019], ebx
and al, 0x38
mov word [esp], ax
pushfd
push dword [esp + 0x3c]
ret 0x40
mov edi, dword [edi + 0x377545]
jmp 0x1039242a
call fcn.101d9c9d
push 0xd9dfe4be
mov edi, 0x1009d1f8
pushal
pushal
mov byte [esp], 0xab
jmp 0x101e4a16
jmp 0x102e0857
push 0xfe996700
pushfd
call fcn.10359048
call fcn.1038312f
lea eax, [eax + 0x3f82c82d]
pushfd
xchg dword [esp + 0x40], eax
push dword [esp + 4]
mov byte [esp], bh
pushfd
pushfd
push dword [esp + 0x4c]
ret 0x50
push 0xc17b5889
mov byte [esp], ah
xchg dword [esp], edi
movzx di, al
mov edi, 0x1009d1f8
pushfd
mov dword [esp], 0x91c6d512
call fcn.101f4016
jmp 0x102d14b9
xchg dword [esp + 0x54], edi
lea esp, [esp + 0x54]
jnp 0x1022dd20
push edi
jne 0x1020ae4b
movsx di, al
push ebp
movzx di, al
mov edi, 0x1009d1f8
lea esp, [esp + 4]
je 0x103e8330
push 0x4139d093
pushal
push eax
mov edi, dword [edi + 0x377545]
jmp 0x10206f3a
jmp fcn.10252410
pushfd
pushal
mov byte [esp], ah
jmp 0x10204be0
Function at 0x10382dd1
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edi - 0x1186dcb6]
pushfd
mov edx, 0x100d6c23
call fcn.101db361
pop esp
push 0x5c84c820
les ebp, [esi + edi*8]
push 0xb8fe4c8d
bound ebx, qword [esi + esi*4]
pushal
push ebp
invalid

Function at 0x1038a2f4
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x20]
js 0x103991a3
push 0xb9b7ee41
mov dword [esp], 0x6f845e56
push 0xe9e27175
push edi
pushal
mov byte [esp + 8], ah
lea esp, [esp + 0x28]
jmp fcn.10002147
mov eax, edx
dec ecx
add dword [esi - 0x34], 0xa5abdc3d
push cs
mov dl, 0x86
inc esi
xchg esp, eax
xor byte [edx - 0x5527e1e5], dh
aaa
xchg byte [esi + 0x42e115f5], bh
xchg edi, eax
and eax, 0x18e89c24
mov ecx, dword cs:[ebp - 0x39]
mov edi, dword [esi + 0x5a97d41c]
sub byte [edi + 0x73], dl
sub dword [edi], ecx
ja 0x103991b9
pushfd
call 0x5dc4bf81
invalid
lahf
or eax, 0x5c79ab8b
test eax, 0xa3c97f
cmp bl, dl
mov dword [0xc438530e], eax
jge 0x10399163
popfd
adc eax, 0xb1350ace
pop edx
adc dword [ecx + eax*4 - 0x4a], ecx
sbb al, byte [ebx]
outsd dx, dword [esi]
sub byte [eax + ebp*8 + 0x53560d4b], bl
dec esp
xor dword [esi + 0x286f031a], 0xd4be89c
push esi
push ebx
or eax, 0x55689286
push edx
mov al, byte [0xf3e860b4]
in al, dx
add al, 0
push 0xb4a05255
pushal
call fcn.103e7ea1
ja 0x10399143
dec edi
cmpsd dword [esi], dword es:[edi]
jne 0x10399193
mov eax, dword [0x59a3f93b]
shl eax, cl
in al, dx
pushfd
inc esp
div byte [eax + 0x3a]
adc al, 0x65
invalid

Function at 0x1039722d
Capabilities:
Packed with generic packer

Disassembly:
movzx eax, cl
lea eax, [esp - 0x256428cf]
jmp 0x1044139e
pushfd
mov dword [esp + 0x34], eax
jmp 0x10274938
jmp 0x103ce6da
nop
pushal
xchg dword [esp + 0x1c], eax
pushfd
pushfd
mov eax, dword [esp + 0x28]
pushfd
lea eax, [eax + 1]
push dword [esp + 4]
jmp 0x1035d3c9
mov eax, 0x1004e7e4
push dword [esp + 4]
call fcn.102d8658

Function at 0x103a2134
Capabilities:
Packed with generic packer

Disassembly:
or byte [eax], dh
push dword [esp + 0x14]
mov byte [esp], ch
call fcn.104353ce
lea eax, [eax - 0x54daeab7]
call fcn.101cb864
mov edx, dword [edx + 0x22c654]
mov byte [esp], 0x95
pushfd
pushfd
call fcn.1041c1cd
xor byte fs:[ebp - 0xc], 0xc6
pushal
sbb al, dl
push 0x44
lodsb al, byte [esi]
push esp
adc al, 0x7c
pop esp
aam 0xed
insb byte es:[edi], dx
mov eax, 0x4acdc72
mov word [ebx], gs
loopne 0x103a2107
dec byte [ebp - 2]
loopne 0x103a2199
dec eax
div dword [esi + 0x2c2c360]
invalid
xchg esi, eax
popfd
cmp edx, 0x737afe94
invalid

Function at 0x103b5888
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 0x48], eax
lea edi, [eax + 0x240192c5]
mov dword [esp + 0x44], eax
lahf
call fcn.10378110
invalid