joyce8/EMBER2024-capa huggingface dataset:
Function at 0x587352
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor dword [eax], ebp
shl ebx, 0x20
shr bp, 0x40
shl dh, 0x20
mov ebx, dword [esi + 4]
xchg al, bh
xchg bh, al
mov dh, dh
mov ebx, dword [ebp + ebx]
lea esi, [esi + 8]
shr di, 0x40
xchg di, ax
xchg di, ax
dec dword [ebx]
call fcn.00592c87
add eax, 0x24448f64
cld
shl al, 0x20
lea esi, [esi + 4]
xchg si, ax
xchg si, ax
xchg ebp, eax
xchg ebp, eax
cli
jmp dword [esi]
mov ah, 0x96
shr bl, 0x40
je 0x5844cb
movsd dword es:[edi], dword [esi]
je 0x5844e0
pop ebx
je 0x58bd9d
invalid
lea esi, [esi + 8]
neg dword [ebx]
jmp dword [esi]
wait
jb 0x5844f9
xchg dword [edx + 0x12], esi
add byte [eax], al
jbe 0x5844f5
cpuid
jbe 0x5844b8
jbe 0x585761
add byte [eax], al
fdivr dword [esi - 0x7e03ba77]
jge 0x5844ff
cld
cmp dword [ebp - 4], 0
add byte [eax], al
add byte [eax], al
jne 0x58bb79
mov si, si
je 0x584514
int 0xf1
or eax, eax
jne 0x58bb6a
je 0x584520
into
xchg ebp, eax
je 0x58bb6a
sbb byte [esi + 0x558b0189], 0xf8
mov bx, bx
shl ah, 0x20
jno 0x5860b1
jo 0x585772
jo 0x5860b1
shl eax, 0x20
xor edx, edx
jb 0x58374f
ja 0x597600
jbe 0x587051
int1
dec esi
mov al, 0xe2
jbe 0x597600
add eax, 0x100f728
add byte [eax], al
popal
add byte [eax + 0x68], al
add byte [ecx], ah
add byte [eax], al
sbb byte [eax], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], ah
add byte [eax], al
test eax, 0xf4000022
inc edx
add byte [eax], al
and byte [eax], al
add byte [eax], al
jl 0x587087
add byte [eax], al
mov eax, dword [0x8000151]
add byte [eax], al
add byte [eax + eax], ah
add byte [ebp + 6], bh
add byte [eax], al
push 0x68000000
add byte [eax], al
add byte [ebx + eax*2], al
add byte [ebx], bl
and dword [ecx], eax
add byte [ebx], dl
cmp dword [eax], eax
add byte [ebx - 0x28], dh
add byte [eax], al
add eax, 0xc518b7c
mov eax, eax
js 0x58c01f
and al, 4
test eax, eax
jb 0x5844e7
push 0x2242
ret
inc eax
jbe 0x58bb2e
cpuid
nop
ret
jbe 0x58703a
mov ax, word [edx + 0x20]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], eax
mov edx, dword [ebp + 8]
push 0x1c3d7
ret
mov ebx, 0x820fc031
jg 0x58bb27
invalid
pop edx
mov ecx, dword [ebp + 8]
shl di, 0x20
push ecx
push 0x18843
ret
invalid
adc dword [edx + 0x3f215], ecx
add byte [ebx - 0x1f3ff3bb], cl
and byte [ecx + 0x4d8b2c50], cl
or bl, ch
push ecx
push 0xddc0
ret
Function at 0x5887e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x3c], 0x45
je 0x584361
nop
cpuid
ret
je 0x593aaf
fst dword [0xfc24448f]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x18]
jne 0x58c80b
je 0x58437f
cpuid
nop
ret
je 0x58c80b
fnstenv [ebx + 0x66ed8966]
mov edx, edx
mov eax, dword [esi + 4]
shl ecx, 0x20
mov ebx, dword [esi + 8]
mov eax, dword [ebp + eax]
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
xor dword [ebx], eax
jb 0x58f798
shl esi, 0x20
jmp dword [esi]
lea esp, [esp + 4]
jne 0x584349
je 0x5887ee
cmp eax, 0x8bc98892
dec ebp
or byte [ebx - 0x7af0b9af], cl
inc eax
mov ebx, 0x474ffff
mov cl, cl
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x46]
jne 0x58433c
je 0x588802
cpuid
ret
je 0x58433c
sbb byte [eax - 0x3e08f175], 0
and byte [eax], al
add byte [edi], cl
sbb byte [ebp - 0x20], 0
add byte [esi + 0xff586ee], al
test dword [ebx], esi
add byte [eax], al
add byte [esp + eax + 0xf], dh
mov byte [0xce86c305], al
xchg cl, dh
mov dl, dl
mov eax, dword [esi + 4]
add bx, 0xae09
sub bx, 0xae09
add esi, 0xc
cmp dx, dx
cmc
popfd
lea edi, [ebp + eax]
jmp dword [esi - 4]
lodsb al, byte [esi]
sbb byte [esi - 0x69], ah
xchg di, ax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x40], eax
jmp fcn.0058fccd
Function at 0x5932f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg ecx, eax
daa
lea esi, [esi + 8]
xchg bh, bl
xchg bl, bh
jmp dword [esi]
js 0x597218
jns 0x58c7cf
sahf
add al, 0x4e
ror dword [edi], 1
mov dword [ebx - 0x56], eax
add byte [eax], al
jns 0x597218
xor eax, 0xfd23134
cmp byte [esi + 0x66000073], 0x8b
push ecx
sbb al, 0x31
ror byte [edi], 1
cmp byte [ebx + esi*2 + 0x36e80000], 0x33
invalid
sal dword [edx + 0x66], 1
shl esi, 0x20
xor eax, 0xfc24448f
mov edx, dword [ebp - 4]
shr si, 0x40
mov edx, edx
mov eax, dword [edx + 4]
jno 0x58c7c3
jo 0x593311
jle 0x593379
inc edi
push esi
jo 0x58c7c3
and eax, 0xe256e98e
invalid
and dword [ebp + ebx], eax
jb 0x58ea72
jmp dword [esi]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
jmp 0x597221
push edx
mov eax, dword [ebp + 8]
jmp 0x597227
push eax
call fcn.0058a407
add esp, 0x10
sub si, 0
and eax, 0xff
jb 0x57cd6a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
push 0x1aa51
ret

Function at 0x595cc0
Capabilities:
Check http status code
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pop esi
or byte [ebx + 0xc768d00], cl
push 0x6df
ret
push ebp
mov ebp, esp
mov di, di
jne 0x597277
je 0x595cd2
stosb byte es:[edi], al
cpuid
ret
je 0x597277
xor eax, 0x53368d18
pop ebx
mov eax, dword [esi + 4]
jno 0x5835bc
jo 0x595ced
cpuid
nop
ret
jo 0x5835bc
xor al, 0x3b
mov al, byte [ebp + eax]
lea esi, [esi + 0xc]
mov eax, dword [ebp + 8]
mov dword [0x49], eax
pop ebp
ret 4
Function at 0x1002bbf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x1002bd52
cmp edi, esi
je 0x1002bd52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x1002bd42
add edi, 4
jmp 0x1002bca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x1002bcb8
mov dword [ebp - 4], 2
jmp 0x1002bcd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x1002bccf
mov dword [ebp - 4], 1
jmp 0x1002bcd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x1002bd52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x1002bd10
mov byte [ecx + 2], 0x3d
jmp 0x1002bd1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x1002bd2c
mov byte [ecx], 0x3d
jmp 0x1002bd32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x1002bca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d44e
Capabilities:
Execute syscall

Disassembly:
jb 0x100fe5d2
push dword [esp + 0x44]
popfd
lea esp, [esp + 0x4c]
ret
mov esi, 0x68637227
mov bl, 0x2f
mov esi, dword [esp + 0x14]
mov esi, dword [esi + edx - 0x640b5a5d]
xor ebx, edx
call fcn.103397a0
pushfd
call fcn.102cd5b3
out dx, al
pop edx
cmp dword [esi], edi
or byte [ebx + 0x6a], dl
sub dword ds:[eax - 0x4c], esi
jl 0x100fe647
xor al, 0x81
out 7, al
shl esp, 0xeb
mov ah, 0xe6
mov bh, 0x4e
cmc
cmp eax, 0x5fc4ad3e
imul ecx, dword [eax + 0x36], 0xc1dc2864
popal
mov edi, 0x2085861e
insb byte es:[edi], dx
aam 0xc7
insd dword es:[edi], dx
sbb ah, byte [edx + 8]
test dword [edi], ebx
inc ebx
cdq
mov byte [ebx], bh
ror dword [edi], cl
mov dh, 0xb4
aad 0x3b
int1
test eax, ecx
out 0x8e, eax
cmp esi, dword [edi]
invalid
jmp 0x100fe6c3
mov bl, 0xb3
scasb al, byte es:[edi]
scasb al, byte es:[edi]
mov eax, dword [0x35e00de7]
idiv dword [ecx + 3]
retf
popal
add dword [ecx + 0x4d], 3
mov edi, 0x4c860bc7
mov ch, byte [ecx - 0x288e36a0]
loop 0x100fe6bd
inc esp
aad 0x83
pop esp
lcall 0x47b7, 0xfc42cfa3
sbb bh, dh
pushfd
mov ah, 0x7d
out dx, eax
imul esp, ebx, 0x1d
or dl, byte [ecx + ebp*2]
mov byte [eax + 0x1d3ff6a7], ah
iretd
neg dword [esp + esi*4 - 0x1c941083]
sbb eax, 0x8869140a
mov al, byte [0x1d3ff6a7]
fsub dword [eax]
clc
pop esp
pop edi
add bh, 0xc6
sbb eax, 0x601de013
scasd eax, dword es:[edi]
xchg edi, eax
mov eax, dword [esi - 0x304d47d5]
jge 0x100fe6a5
enter 0xffffffffffff9f48, 0x4d
mov dword [0x145ee24b], eax
and dword [ebx - 0x13f1e1a4], ebx
inc ebx
jge 0x100fe70b
dec esp
sbb byte [edi + 9], ah
jp 0x100fe685
mov dword [esi], eax
mov esp, 0xc50f8699
jae 0x100fe727
jns 0x100fe719
stosb byte es:[edi], al
loopne 0x100fe76d
adc al, 0x48
mov ecx, 0xfba8a520
or byte [ebx - 0x78179bf6], dh
fidiv dword [edi - 0x5493b1e2]
push 0xffffffffffffffd2
call 0x96c3f51c
push 0xffffffffffffffa1
jb 0x100fe7a0
push ebp
ret 0x6b31
sbb eax, 0x2f6d76a3
out 0x98, eax
or byte [ebp + 0x7d1cd17b], ch
push ebp
invalid
clc
or eax, 0xf98ac802
pop ebx
lcall 0x7d7d, 0xa702162
jae 0x100fe81c
loop 0x100fe7fb
cmc
sub eax, 0xfcc615aa
invalid
out dx, al
out dx, eax
sub ebx, dword [ebx - 0x2d]
jns 0x100fe87d
pushal
xchg ecx, eax
fdivr dword [0x7813c47d]
ret 0xd1fd
syscall
faddp st(3)
cmp byte [0xb49b054b], bh
xor dword [0xd842f5c5], 0x11
ret 0x6369
push cs
into
pushfd
inc ecx
dec edx
mov ebp, edx
or cl, byte [edi + 0x5d]
cmpsd dword [esi], dword es:[edi]
inc esi
out 0x64, al
xor eax, 0x2fcdb9c3
in eax, 0x2e
iretd

Function at 0x1006c70d
Capabilities:
Encode data using xor

Disassembly:
call 0x10292512
dec eax
add byte [eax - 0x75], cl
stc
mov edi, ecx
pop esi
xor byte [esi - 0x16ececf9], cl
cld
pop es
mov dword [0x8a858216], eax
or dword [edx], edx
cwde
jo 0x1006c711
out 0xe1, eax
nop
jns 0x1006c713
push edi
jmp 0xa3f3ea2b
Function at 0x100c42d1
Capabilities:
Encode data using xor

Disassembly:
adc dword [eax], eax
mov dword [esp + 0xc], ecx
and al, 0xc
lea ebp, [ebp + ecx - 0x213f751f]
call fcn.102e306b
xor eax, 0x62c30e16
dec edx
jecxz 0x100c42be
movsb byte es:[edi], byte [esi]
mov dl, 0x4b
cmp al, 0x3b
fcmovne st(0), st(1)
xchg ecx, eax
out 0xf5, eax
movsb byte es:[edi], byte [esi]
imul edx, dword [esi + 0x265b0321], 0xdb164d86
xor edi, dword es:[esi + 0x47813ddb]
out dx, eax
movsb byte es:[edi], byte [esi]
js 0x100c42d3
push eax
loopne 0x100c4331
mov dl, 0x24
xchg edi, eax
retf 0x5ea4
mov ecx, ss
or edi, dword [ebx - 0x51]
mov ah, 0x14
lodsb al, byte [esi]
add edx, ecx
xchg edx, eax
invalid
Function at 0x10157a50
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xffdb77a0
xor edx, 0x2a6836c5
call fcn.101950cc
dec ebp
mov eax, edi
dec ecx
sub edi, 2
dec ecx
rol edx, cl
inc bp
mov dword [edi], eax
inc cx
xor edx, 0x8041403c
loop 0x10157a64
inc ecx
rcr edx, 0x15
dec ecx
sub ebp, 4
inc ecx
add dl, 2
inc ebp
mov edx, dword [ebp]
inc ecx
test al, 0x39
inc esp
xor edx, esi
test edx, ecx
inc ecx
neg edx
clc
stc
inc ecx
rol edx, 2
jmp 0x1025dbbb
inc ecx
bswap edx
inc ecx
inc edx
clc
push esi
shrd si, dx, 0xfd
inc esp
xor dword [esp], edx
pop esi
dec ebp
arpl dx, dx
dec eax
cmp ebx, esp
inc esp
test ch, ah
dec ecx
add ebp, edx
jmp 0x1030747f
jmp fcn.101933b6

Function at 0x1016d532
Capabilities:
Encode data using xor

Disassembly:
ret
mov edi, dword [esp + 0x1c]
jle fcn.1009eaac
mov cl, 0xd4
call fcn.102f4d91
xchg ecx, eax
pop eax
jmp 0x1016d557
popfd
cmp bl, byte [edi + 0x6f]
xor ebx, dword [ebp - 0x22723af2]
pushfd
pushfd
arpl word [ebp - 0x24], bp
bound edi, qword [esi]
lds ecx, [ebp + 0x639c9cdd]
insd dword es:[edi], dx
fsub qword [edx + 0x3e]
jo 0x1016d4f3
xor esp, dword [ebx + 0x2e]
and dword [esi + eax*8 - 0x64], eax
jae 0x1016d550
aad 0x62
mov esi, 0x632e6c5f
pop ss
insb byte es:[edi], dx
arpl word cs:[edi], dx
or dword [ebp + 0x3c], esi
popfd
inc ebx
enter 0xffffffffffffc213, 0xffffffffffffff9d
pushfd
jae 0x1016d571
cmp byte [esi - 0x28], ch
mov dword [0x71c66328], eax
cmp dword [ebx], eax
dec ebx
insd dword es:[edi], dx
cmp al, 0x25
sbb al, 0x15
push ds
inc ebx
fistp qword [esi]
in al, 0xca
push eax
aam 0x85
ljmp 0x327a

Function at 0x101b8e01
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
push es
mov byte [ecx - 0x57], al
bound esi, qword [ecx + 0x77]
xor edx, 0xffffffa6
invalid
mov edx, 0xbb535bf3
add al, 0x5d
sbb eax, 0x3c986857
jge 0x101b8e22
pop ebx
push ebx
mov ebx, 0x571d5d04
push 0x157d3c98
pushfd
test word [esp + 4], bx
call fcn.100356c2
inc edx
ficomp dword [esp + eax*8 - 0x4c]
pop ebp
cmp byte [ecx - 0x17], bl
in al, 0x3e
xor ebx, dword [ebp + 0x22573310]
xor ebx, dword ds:[ebp + 0x22573310]
or esp, ebp
jae 0x101b8dff
mov eax, esp
jecxz 0x101b8de0
add dword [eax], 0xa09f1c39
pop ds
mov edx, 0x3d7dbe10
mov al, byte [0x10f24c1c]
hlt
Function at 0x101d4bb8
Capabilities:
Encode data using xor

Disassembly:
push edi
mov dword [esp + esi - 0xdec], ebx
jne 0x103b8330
inc ecx
inc eax
dec ebp
cmp ecx, esi
inc ecx
not eax
stc
clc
inc ecx
bswap eax
inc ebp
test cl, bl
inc ecx
xor eax, 0x767d6b
cmp bx, cx
inc ecx
bswap eax
push esi
inc esp
xor dword [esp], eax
pop esi
dec ebp
arpl ax, ax
clc
inc eax
test bh, dl
dec ecx
cmp eax, esi
dec ecx
add ebp, eax
jmp 0x102f6f0c
mov esi, ecx
add esi, esi
xor esi, esi
mov edi, 0x3e3e3ef6
push edx
test cx, 0x4d17
not cl
add dword [esp + 8], 0xffd8b103
push 0x3077f8e
mov dword [esp], 0x2aea1306
neg dword [esp]
mov edx, dword [esp]
mov ebx, 0x695a076c
neg cl
mov ebx, dword [esp + 0xc]
mov ebx, dword [ebx + edi*2 - 0x7c7c7dec]
test dx, 0x6103
setl dl
lea edi, [edx*8 + 0x6f0d538a]
and dword [esp], ecx
xor ecx, 0x28521c45
bswap edi
lea ebx, [ebx + edi - 0x50cf7bd0]
mov dword [esp + 0xc], esi
call fcn.100ad989
imul eax, dword [ebx - 0x45], 0x73beae08
loop 0x103b8360
sal al, cl
dec ecx
fbstp tbyte [ebp - 0x75]
int 0x98
out dx, eax
sub al, 0xed
invalid

Function at 0x101d80d6
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
inc ecx
clc
jmp 0x1028ac9e
mov edx, 0x50757813
push 0x16d03920
call fcn.103034bb
rol ecx, 3
inc ebp
cmp ch, ah
test al, 0xe7
neg ecx
jmp 0x103b1329
rol ecx, 2
cmc
bswap ecx
not ecx
cmp bp, di
xor ecx, 0x14944cd4
inc esp
cmp cl, bh
clc
inc cx
test ebx, 0xc18123b0
cmp dword [esi + 0x46], esi
jp 0x1028ad16
bswap esi
rol si, cl
xor dword [esp], ecx
inc eax
sete dh
pop esi
clc
dec eax
arpl cx, cx
dec eax
add ebp, ecx
jmp 0x10038529
fadd qword [esi]
std
not ecx
jmp 0x1013a955

Function at 0x101e489f
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + 0x18], 0x5b5f56ef
xchg dword [esp + 0x24], edx
call fcn.10098ff7
enter 0x293b, 0x4b
fstp xword [ecx + 0x72]
pop ebp
mov edx, 0xa9a9c166
fld dword [ebx - 0x13]
test eax, 0x518b2522
invalid

Function at 0x1028ac94
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
setb byte [esp + 4]
call fcn.1022ba92

Function at 0x1028acd9
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ecx
pushfd
mov edi, 0x2de81aa0
add dword [esp + 0xc], 0xffe4ad8d
call 0x346d2e10
or al, 0x8d
lodsd eax, dword [esi]
in al, 0xff
xchg dword [esp + edi*2 - 0x5bd0352c], ebp
mov ecx, edi
push esi
call fcn.1028c142
daa
mov dword [0xf480c829], eax
cmc
and eax, 0x6bd1d3da
cmpsb byte [esi], byte es:[edi]
fld qword [esi + 0x1b7c4600]
push edi
and al, 0x72
mov edx, 0x27d0630f
movsb byte es:[edi], byte [esi]
xor dword [edi - 0x2f92359], edx
mov al, 0x13
pop edi
jno 0x1028acde
invalid

Function at 0x102dea48
Capabilities:
Encode data using xor

Disassembly:
jbe 0x100c1a7e
xchg byte [eax], dh
xor dh, bl
dec dword [edi]
mov byte [0x8bfff80e], ch
fld dword [esp + ebp*2 - 0x76aaf7dc]
test byte [ecx], bl
or bh, dh
mov edx, 0x5151eb8b
js fcn.1025f881
mov ebx, ecx
test byte [esp + 8], ch
push ebp
mov dword [esp + ebx - 0x4508f79f], eax
mov ebp, ebx
push ecx
push ecx
call fcn.10337f11
dec esi
inc ebx
aaa
jno 0x102dea49
retf 0xc7b
Function at 0x102e2aad
Capabilities:
Encode data using xor

Disassembly:
call fcn.1029f658
outsd dx, dword [esi]
mov dword [edi], esi
sub eax, 0xcb1c3a8
add eax, 0x12e4ef14
cmp edi, dword [eax]
push eax
pop ds
mov al, 0xf7
pop es
push esp
pushfd
invalid
xor word [esp + 0x34], 0x5700
mov edi, dword [esp + 0x30]
setl byte [esp + 0x1c]
and al, 0x34
add byte [edi - 0x75], dl
jl 0x102e2adb
xor byte [edi], cl
pushfd
inc esp
and al, 0x1c
jbe 0x1026a915
jb 0x10358fda
or dword [esp + 0x28], 0x2f0236b7
call fcn.101e3660
xlatb
sar ecx, 1
loop 0x102e2ab0
aam 6
push es
lds ecx, [ebx]
sbb eax, 0x350f332b
push eax
cdq
pushfd
lds esi, [ebx]
dec al
add dl, ch
cmc
cmc
mov esp, 0xf68267ba
inc eax
cld
insb byte es:[edi], dx
cmp eax, 0x2fb8cb82
xor dh, byte [ebx]
jp 0x102e2b0a
sti
mov bh, 0xb8
push cs
mov bh, 0x97
cld
cwde
rol esp, 1
stosb byte es:[edi], al
call 0x2a4b986b
push eax
mov ch, 0x19
arpl bx, di
or al, ah
xchg ecx, eax
adc byte [edx], dl
sbb cl, bh
outsb dx, byte [esi]
mov esp, 0x39318b1e
mov eax, dword [0x113bf1e7]
sbb cl, byte [edx]
jmp 0x563612e4

Function at 0x10321776
Capabilities:
Encode data using xor

Disassembly:
fisttp qword [edi - 8]
invalid
call fcn.100996c5
xchg ebp, eax
pop ds
jns 0x103217c7
inc edx
in al, 0xa9
hlt
bound ebp, qword [ebp + 0x79]
imul dl
jno 0x10321824
in eax, dx
jg 0x10321772
push edx
push 0x94288d4e
pop ecx
fidivr dword [ecx + 0x128d80ee]
add al, 0x6a
jb 0x10321844
cld
out dx, eax
cld
sub byte [edx - 0x33d773c5], 0x8c
inc esi
inc edi
sahf
sbb edx, dword [edi - 0xc]
cld
adc byte [ecx], 0xc0
sbb al, 0x37
int3
xor eax, dword [ebx]
mov esi, cs
mov al, 0xd4
cmpsd dword [esi], dword es:[edi]
add byte [eax + 0xf5c9cee], al
cmc
mov eax, dword [0x2d1ae137]
push eax
wait
out 0x51, al
add byte [ebx], cl
out 0xbd, eax
or dword [edi + 0x41], edx
inc ecx
jne 0x10321874
out dx, al
mov byte [ebx + 0x5d], bh
sbb dh, byte [edx - 0x78]
mov ebx, dword [ecx]
inc ebx
pop es
mov bh, cl
sub al, 0xf0
push eax
ja 0x1032185b
imul ecx, dword [ebx + 0x53], 0x9b6aa388
mov eax, 0x36d28077
test byte [eax + 0x3bb0b6bc], 0x88
test byte ss:[eax + 0x3bb0b6bc], 0x88
les ecx, [esp + edi*4 + 0x4c]
ja 0x10321870
inc edi
js 0x10321807
mov byte [ecx], bh
invalid
ljmp 0x5711:0x77614c83
retf
leave
pop eax
add ecx, dword [eax - 0x78]
out 0x88, al
scasb al, byte es:[edi]
push es
ja 0x103218e9
adc al, 0x28
retf
inc eax
popfd
out dx, al
and edx, dword [edx + 0x20]
pushal
invalid
Function at 0x103501a9
Capabilities:
Encode data using xor

Disassembly:
call fcn.101c8589
and eax, 0x864a0127
salc
or byte [ecx + 0x7473c7c4], bh
scasd eax, dword es:[edi]
les edx, [esi]
mov ah, bl
dec esp
cmp ebp, ecx
fdiv qword [ebx]
mov eax, 0x192c0704
jle 0x1011e626
mov dword [edi], esi
bound esi, qword [ecx + 0x3b]
adc dh, byte [esi - 0x6104bc94]
mov dword ss:[0x6cc3c488], eax
add dword [ebx + ecx*8], 0xc484045d
retf 0xec7a
cwde
pop edx
xor dword [edi], edx
push esi
mov edx, 0xb7c23f50
inc esi
retf 0xc1a1
xor dword [edx - 0x2d], eax
out 0x1c, al
push ds
test eax, 0xafb94964
jp 0x1011e609
mov eax, 0xfcd060b5
pop ecx
lodsb al, byte [esi]
push 0x45d72d6d
shr byte [edi + 0x1989b3b3], cl
invalid
not ecx
cmp sp, cx
xor ecx, 0xdde26c8
clc
not ecx
rol ecx, 1
xor ebx, ecx
add edi, ecx
jmp 0x103b9f9b
jg 0x1011e589
dec ecx
test ebp, 0x59b44204
bswap ecx
stc
cmc
sub ecx, 0x477e4d1a
jmp 0x1014e955
jmp edi

Function at 0x10374d36
Capabilities:
Encode data using xor

Disassembly:
add ax, 0x5143
xor ax, 0x6e6b
jmp 0x10135412
dec ax
rol ax, 1
stc
clc
test cl, bh
xor bx, ax
lea ebp, [ebp - 2]
test di, 0x230b
mov word [ebp], ax
not ah
stc
mov eax, dword [edi]
cmp dl, 0x1a
lea edi, [edi + 4]
cmp di, 0x3d6c
cmc
xor eax, ebx
bswap eax
jmp 0x10262918
add eax, 0x3a254ec0
xor ebx, eax
clc
cmp al, 0x7f
add esi, eax
jmp 0x1038d136
dec eax
ror eax, 1
test al, 0xfd
jmp 0x1024fcd0
aas
push 0x4b3a9818
mov cl, 0xe8
mov cl, 2
push eax
pop ss
test byte [eax], dl
adc dword [eax - 0x7216b567], 0xffffe7a
mov bh, 7
stc
test si, cx
clc
add edi, 2
test si, 0x2fd1
clc
test ah, dl
xor ax, bx
test esi, 0x79bb6963
jmp 0x10107371
not dword [esp + 0x30]
call fcn.1020bf5a
popal
fldenv [ecx - 0x64acc9ac]
jle 0x10374cec
adc al, 0x60
invalid
jmp fcn.10070596
Function at 0x104ec038
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x10588b15
mov esi, dword [ebp + 0xc]
cmp ax, si
cmp sp, 0x88d
test esi, esi
jmp 0x104929e4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
lea esi, [edi + ebx]
sar esi, 1
mov eax, dword [eax + esi*4]
jmp 0x106da93e
ja 0x106cfa8e
mov eax, esi
cmp ecx, 0x42a90a51
stc
sub eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jmp 0x104e673c
mov eax, dword [ecx + 0x3c]
cmp edi, 0x762e7a86
cmc
cmp dword [eax + ecx], 0x4550
jmp 0x10503e0b
je 0x10588b15
mov eax, 0x5a4d
stc
cmp bl, 0x1a
cmp word [ecx], ax
jmp 0x10588b0f
jae 0x10430c81
mov esi, dword [edx + ecx + 0x1c]
test cl, 0xb2
cmp ebp, edx
clc
lea eax, [esi + eax*4]
cmc
cmp ch, 0x5b
mov eax, dword [eax + ecx]
stc
test eax, eax
jmp 0x1054e41a
mov esp, ebp
movzx ebp, ax
bswap bp
pop ebp
ret
mov eax, dword [ebp + 8]
shl dh, 0xe6
mov ecx, dword [ebp - 4]
test bx, sp
bsf dx, bp
btc dx, bp
mov edx, dword [ecx + eax + 0x24]
rcl ch, cl
lea ecx, [edx + esi*2]
movzx edx, word [ecx + eax]
bts ecx, edi
mov dword [ebp - 8], edx
movzx cx, bl
mov ecx, eax
ror dh, cl
movsx eax, dx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
stc
cmp eax, dword [edx + ecx + 0x14]
jmp 0x104977b2
push ebp
setge cl
mov ebp, esp
rcr ch, 0xd9
shl cx, cl
bsr cx, ax
mov ecx, dword [ebp + 8]
test bp, 0x2c7b
lea esp, [esp - 0x114]
clc
cmc
push esi
test ecx, ecx
jmp 0x10409865
jne 0x10588b15
mov edx, dword [eax + ecx + 0x78]
test si, 0x348e
mov dword [ebp - 4], edx
cmp esi, 0x1f005b78
test edx, edx
jmp 0x10579162
jmp 0x1057e221
call fcn.106bab4d
add esp, 4
test eax, eax
jns 0x1057e215
lea edi, [esi - 1]
jmp 0x10509c4d
je 0x10430c81
cmp eax, edx
jb 0x106add52
mov esi, dword [ebp - 0x10]
lea esi, [esi + edx]
clc
stc
cmp eax, esi
jmp 0x106c07df
je 0x10588b15
mov eax, dword [eax + ecx + 0x7c]
jmp 0x106101de
jle 0x104e6707
lea ebx, [esi + 1]
bts ecx, edi
mov ecx, dword [ebp + 8]
test esp, ebx
cmp ebx, edi
jmp 0x105e3576
je 0x10488847
xor eax, eax
mov esi, 0x512e4664
xchg si, si
pop esi
jmp 0x104db349
jle 0x104325fd
jmp 0x104e6739
push ebx
push edi
clc
test sp, 0x4d17
mov dword [ebp - 0x10], eax
cmp bx, bx
stc
mov dword [ebp - 8], 0xffffffff
test si, dx
test eax, 0x6729462f
cmp esi, 0xffff
jmp 0x104555e7
mov dword [ebp - 0xc], eax
js 0x104e673c
jmp 0x10432600
je 0x10430c81
pop edi
movzx bx, bh
pop ebx
bswap si
sar esi, 0x6d
add eax, ecx
pop esi
jmp 0x104c7040
jae 0x106add52
lea eax, [eax + ecx]
bswap si
setns cl
mov cl, byte [eax]
bsr esi, ecx
bt esi, 0xff
mov esi, eax
test cl, cl
jmp 0x1065da1e
mov edi, dword [edx + ecx + 0x18]
test bp, ax
test edi, edi
je 0x104e673c
mov eax, dword [edx + ecx + 0x20]
test dh, 0x26
jmp 0x106dca75
push edx
rcl dh, 0x4c
ror dx, cl
mov edx, dword [ebp + 0xc]
test bx, bp
add eax, ecx
jmp 0x1052912f
lea eax, [eax + ecx]
xor ebx, ebx
dec edi
jmp 0x10653b61