joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1055ec26
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx*2 - 0x18d4], edx
rol al, 1
rol cl, 0xe6
jae 0x108e4de0
cdq
fild word [ecx + 0x4629e291]
outsb dx, byte [esi]
xor byte [eax + 0x6e06e2ab], dl
xor byte [eax + 0x6eced1aa], dl
nop
stosb byte es:[edi], al
ror esi, 1
outsb dx, byte [esi]
xor byte [eax + 0x6e86f100], dl
xor byte [eax + 0x6ea6ab0a], dl
xor byte [eax + 0x6e76eba9], dl
xor byte [eax + 0x6e26fa7a], dl
xor byte [eax + 0x6e7e930a], dl
xor byte [eax + 0x41d7890], dl
fild qword [edi - 0x59787834]
jno 0x1055ecae
mov al, 0xa6
push edi
scasd eax, dword es:[edi]
je 0x1055ec47
or byte [ecx - 4], cl
out dx, eax
ret 0xb3a3
invalid
add byte [esp + ecx*4 - 0x3262], 0x3d
sbb al, 0x2f
xor dl, 0x28
and word [esp + ecx - 0xc9a], cx
ror word [esp + ecx - 0xc99], 0x21
xor al, 0x24
shl ecx, 0x95
neg al
push ecx
bswap edx
xor bl, al
or dword [esp + edx*2 - 0x711089f2], 0xe85a9b1
lea eax, [esp + eax + 0xc]
neg byte [esp + edx*2 - 0x711089fa]
mov edx, dword [eax + edx*2 - 0x711089fa]
call fcn.108f3c05
inc ecx
push edi
inc esp
mov dword [eax + esi - 0x2889ccf7], ebp
shl dword [esp + eax - 0x2889ccf8], 0x81
push eax
dec eax
lea esi, [esi + eax - 0x2889ccf7]
inc ecx
mov eax, dword [esi + eax - 0x2889ccf9]
jo 0x10904513
dec ecx
lea edx, [edi + ebx*4 + 0x66269c01]
inc esp
movzx ebx, dx
dec edi
lea esi, [esi + edi*8 + 6]
inc esp
adc edi, ebx
inc ecx
xor eax, esp
sub eax, 0xe03f0c35
call fcn.105f063f
dec ecx
lea ebx, [edi + eax*8 + 0x448f2eba]
inc ecx
ror ecx, 2
inc ecx
bswap ecx
push ebx
inc ecx
dec ecx
inc edx
or byte [esp + edi + 0xa04b7f5], dl

Function at 0x10560bb3
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc eax, edx
shl byte [esp + ecx + 4], 0x22
sbb word [esp + ecx*4 - 1], cx
mov dword [esp + ecx - 2], 0x211eb928
mov dword [esi + ecx*4 - 4], eax
jge 0x10ab1a64
add edi, 6
jmp 0x10a96723

Function at 0x1056404b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], edi
movzx edi, byte [edx]
push 0xd7116c1d
xor edi, eax
and edi, 0xff
push 0x8f8ccc11
mov edi, dword [edi*4 + 0x109ea7f0]
shr eax, 8
inc dword [esp + 2]
xor eax, edi
inc edx
push 0xd9b090a2
xor eax, 0x47aba032
dec ecx
push 0xcb856d9b
lea esp, [esp + 0x10]
jne 0x1056404e
jmp 0x1055f045
Function at 0x10576981
Capabilities:
Get number of processors

Disassembly:
pop ecx
xor al, 0xb
push 0x5203d706
mov ecx, 0x6c195d2b
mov dword [esp + ecx - 0x6c195d27], 0x96041b10
add al, 0xa0
dec cl
rol al, 1
xor ecx, 0xc023e502
inc ecx
sete cl
xor bl, al
lea eax, [esp + eax + 8]
sar cl, 1
mov word [eax], dx
mov eax, ecx
pop edx
sbb dx, word [esp + edx - 0x5203d706]
mov edx, dword [edi + edx - 0x5203bbf6]
rol ecx, 0x64
and ax, ax
adc edi, 4
and eax, dword [esp]
call fcn.109e7363
ror ax, 0x82
or edx, ecx
rol al, 0x44
sal eax, 0xf3
not edx
sar eax, 0xcc
jp 0x109f30e3
mov dword [ebp], edx
call fcn.109d93d3

Function at 0x105769f1
Capabilities:
Get number of processors

Disassembly:
xor ebx, edx
mov dword [ecx + ebp - 0xbc], edx
movzx edx, cl
add dl, 0xb3
mov ecx, dword [ebp + ecx - 0xbc]
sar al, 3
mov edx, dword [eax + ebp - 0xf7]
sar eax, 0x1b
shr dword [esp + eax + 0xf], 0xb5
not ecx
not edx
push eax
shl al, 0xa1
or ecx, edx
movsx edx, al
inc edx
mov dword [eax + ebp], ecx
sub al, dh
call fcn.1053d725

Function at 0x1057e3de
Capabilities:
Encode data using xor

Disassembly:
not dx
neg eax
push eax
sbb eax, eax
neg dx
sal eax, cl
not cl
inc dx
shr ecx, 0x7e
mov dword [esp + ecx*2 + 2], ecx
xadd cx, ax
not dx
sbb dx, cx
dec byte [esp + ecx + 0xa]
neg dx
inc dword [esp + ecx*8 - 5]
call fcn.10a09abe
jmp 0x10565718

Function at 0x1057fc0e
Capabilities:
Encode data using xor

Disassembly:
dec eax
lea esi, [esi + ebp - 0x588f16fc]
inc esp
movzx ebp, bh
dec esp
lea ebx, [edi - 0x415fe800]
call fcn.108e5ac3
rcl dword [esi - 0xdbdf7f0], 6
inc esi
insb byte es:[edi], dx
sub ch, byte [esi + 0x6c4646bf]
sub bh, byte [esi + 2]
push esi
inc esi
insb byte es:[edi], dx
sub cl, byte [edx + ecx*8 + 6]
inc esi
insb byte es:[edi], dx
sub bl, byte [esi - 0x25]
jno 0x10513000
xchg dword [ebx - 0x36], ecx
inc esp
out dx, al
sti
sub al, 0x38
jo 0x10512f91
xchg esi, eax
out dx, eax
test al, 0xc
invalid
and eax, 0x91c62026
sub eax, 0x3827d2cd
ret
dec esp
mov ebp, edx
dec esi
mov ecx, dword [edi + ebp - 0x52bc73aa]
dec esp
mov dword [ebp + esi - 0x588f16fc], ecx
dec eax
mov dword [esp + ebp - 0x588f16f4], ebx
jb 0x10512f5b
Function at 0x1058dda1
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [esi + edx*2 - 0x54]
inc ebp
movzx ebp, ax
dec eax
lea esi, [esi + edx - 0x29]
shl bx, cl
inc ecx
ror ch, 0xa2
inc ecx
movzx ebp, ax
mov word [esi + edx*4 - 0xac], bx
call fcn.108f4988
not ecx
xchg dword [esp + eax*2 - 0x7a0242ea], eax
dec ecx
ror ecx, 1
xor eax, eax
rol ax, 0x24
neg ecx
pop edx
call fcn.108b619d
rol edx, 2
shl al, 0x23
shr ax, 0xa1
call fcn.105f65e9
stosd dword es:[edi], eax
mov ebx, 0x5555cc34
cmpsb byte [esi], byte es:[edi]
test al, 0x2f
push eax
pop eax
shr al, cl
push es
rol dword [eax], 0xd3
inc esp
xor al, 0x60
jnp 0x104a1287
xor edi, esp
fdivr dword ss:[esi + ebp*2]
mov edi, 0x624867c
cmc
add al, 0xa9
inc ebx
and eax, 0x133247eb
jnp 0x104a133f
pop edx
out 0x66, eax
mov edx, 0xd43b5be8
inc esp
jecxz 0x104a1348
shl ecx, cl
xor eax, 0x66e3ef07
xor dword [esi + 0x28721376], eax
les esp, [edx + 0x74]
xor dword [ebp - 0x5f9944d1], edi
sub dh, byte [edi + ebp + 0x7a44a1d8]
cld
add ecx, dword [edi + 0x7d]
imul dword [ebx + ebx]
jmp 0xde0fb7a6
adc dl, al
mov dh, 5
mov ecx, 0x55723a3e
mov ecx, 0xa4787c23
dec esi
cli
dec esi
retf 0x7e0
inc ecx
movsx ebp, cl
inc ecx
pop esp
jp 0x10ae2523
xor al, 0x29
bswap ecx
sal cx, 0xc6
call fcn.10aa9b19
lea eax, [eax + eax*8 - 0x68e6ad6e]
sar al, 0xc3
adc edi, 4
xor ecx, ebx
sar ax, 0x45
lea edx, [eax + eax + 0x6913b896]
ror ecx, 2
neg ecx
xor ecx, 0x7e9c9702
inc edx
ror al, 7
rol ecx, 1
not dl
inc edx
inc ecx
call fcn.109f5f85
mov dword [esp + eax*2 - 0x3228b2ec], 0xd7a0d0b5
mov dword [ebp + eax*2 - 0x3228b2f0], edx
lea edx, [eax*2 - 0x53471d70]
mov dword [esp + eax - 0x19145978], eax
and dword [esp + eax - 0x19145974], edx
lea edi, [edi + eax - 0x1914597c]
mov eax, dword [edi + eax - 0x19145978]
xor eax, ebx
rol edx, 0xee
bswap eax
shr dword [esp + edx - 0x656037b4], 0xb0
lea eax, [eax + edx*2 - 0x249d58b1]
call fcn.10a3e2d2
not ecx
inc cx
inc ecx
jo 0x104a127e
dec esi
mov dword [esp + ebp - 0x15], esp
inc edx
xor dword [esp + ecx - 0x699cba16], ecx
sal edi, 0xd8
ja 0x104fad7b
mov ebx, 0xf23fa837
inc ecx
or al, 0xa9
dec eax
arpl cx, cx
inc ebp
movsx edi, ch
dec esp
adc edx, ecx
dec edx
mov esi, dword [esi + ebp*2 - 0x2a]
movzx edx, bx
inc ecx
ror ecx, 0xf1
jae fcn.10ad0c3e

Function at 0x105bfecd
Capabilities:
Encode data using xor

Disassembly:
and ecx, dword [edi - 0x43ccbe9a]
xor byte [ecx + 0x4affff6c], al
lea esi, [esi + eax*2 - 0x126f8]
dec esi
lea ebx, [esp + eax*4 - 0x24d04]
call fcn.108f09c6
lea eax, [eax*8 - 0x7b606b6b]
sbb ebp, 0xfffffff4
xor edx, ebx
call fcn.10aa04e8
jg 0x105bfead
invalid
Function at 0x105d3d36
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor ecx, esp
dec ecx
not ebx
inc ecx
neg ecx
dec ecx
shr edi, 0x85
inc ecx
xor ecx, 0x86298996
inc ecx
movzx edi, bx
inc ecx
sub ecx, 0xd2afcbbf
mov ebp, 0xf1b3f19d
mov ecx, ebx
inc ecx
xor ecx, 0x1cbe109b
inc esp
mov eax, ebx
inc ecx
push esp
dec edx
lea eax, [ebp + ebx*4 - 0x38ed4c75]
sub bp, di
inc esi
xor dword [esp + edi - 0x1ec], ecx
inc ecx
pop esp
dec ebp
arpl cx, cx
inc ecx
movzx edx, bh
dec ebp
add edx, ecx
push eax
jmp 0x105d4b09
call fcn.1091ae61
inc ebp
mov ecx, dword [edi]
inc esp
movsx edi, bx
inc esi
mov dword [esi + edi - 0x3d84], ecx
inc edi
mov ecx, dword [esi + edi - 0x3d80]
inc ebp
movzx ebx, di
jmp 0x1058e88c

Function at 0x105e5d6e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x848db13b
rdtsc
mov ecx, 0x3c339334
call fcn.10547835
mov dword [esp], 0xcae54aa
mov dword [esp], esi
movzx esi, byte [edx]
push 0xb6b56987
xor esi, eax
and esi, 0xff
rol dword [esp], 0x33
ror dword [esp], 0x43
mov esi, dword [esi*4 + 0x105494e8]
shr eax, 8
call fcn.108b6d41
pop ebx
rol dword [edx - 2], 1
cwde
jnp 0x105e5e13
insb byte es:[edi], dx
das
mov ebx, 0x6e116f03
pop ss
adc eax, dword [ebx + 0x176e5d6b]
adc ecx, dword [ebx + 0x5f]
xor dword [esi + 0x17], ebp
adc edi, dword [edi - 0x79]
add dword [esi + 0x17], ebp
adc edx, edi
xlatb
and ch, byte cs:[ecx]
inc edx
dec eax
pop es
xor al, 0x37
jge 0x105e5dc1
dec edi
jle 0x105e5e3e
adc cl, byte [edi - 0x240e0df9]
and al, dh
mov al, byte [0xae5dfcee]
int1
popfd
in al, 3
adc byte [ebp - 0x5d101f56], dl
sub ah, byte [esi - 0x59d3b50f]
int1
dec edx
or ebx, dword [edi + 0x6268111a]
cld
dec ecx
in al, dx
pop ecx
mov ch, 0xca
mov ebx, 0xd17dee31
out dx, al
mov ebx, 0x4c5ee31
mov bh, byte [ebx + 0x6c04ee31]
mov bh, byte [ebx]
cdq
adc ecx, esi
mov edi, 0x42e9efa5
imul esi, ebx, 0xffffffff
sysenter
push esi
mov esi, 0x5932233c
mov esi, dword [esp + esi - 0x5932233c]
mov dword [esp], 0x3f56f2a3
call fcn.108be642
out dx, eax
jmp 0x1051c95b
bswap ecx
add edi, edx
mov dword [esp + eax - 0x6ff41757], eax
mov dword [esp + eax - 0x6ff4175b], edi
ret 4
or edx, dword [eax - 0x5afb4377]
call 0x1520ee54
add byte [ecx - 0x7433bbbc], cl
mov dword [esp + eax*2 - 0x34], eax
mov eax, dword [esp + eax*2 - 0x14]
mov ebp, dword [esp + 0x24]
jmp 0x10a9f3f3
lea esp, [esp + 0x28]
ret

Function at 0x105f786a
Capabilities:
Encode data using xor

Disassembly:
xor dword [esp + edx - 0xb07], eax
mov esi, dword [eax + esi - 0x53b80b11]
pop ecx
pop eax
pop edx
ja fcn.10979c8a
and byte [ebx - 0x75], cl
xchg ecx, eax
fnstenv [ebx]
lahf
cli
cmp dl, byte [eax - 0x5e054cf]
xor ebx, dword [edi + 0x31903afa]
stosd dword es:[edi], eax
pop ds
cli
cmp dl, byte [eax - 0x548458f]
cmp dl, byte [eax - 0x5f8d685]
cmp dl, byte [eax - 0x5e097f7]
cmp dl, byte [eax - 0x5503f2e]
cmp dl, byte [eax - 0x508e57d]
cmp dl, byte [eax - 0x5c06508]
cmp dl, byte [eax - 0x2485ae]
aam 0x6f
rcl byte [esp + ecx + 0x6d]
mov eax, dword [0xa20b1e23]
js 0x105f7886
or dword [eax + 0x10], ebx
daa
comiss xmm7, xmm5
pop ecx
push 0x310dbe69
jmp 0x5543c030
Function at 0x108a5ab1
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
dec eax
lea esi, [esi + ebp + 6]
call fcn.105ab811
mov ecx, 0x19918116
mov edx, dword [ecx + ebp - 0x19918116]
sar cl, 0x85
sal cl, 0xc6
sbb ecx, ecx
or ecx, dword [ebp + ecx*2 + 4]
mov eax, 0x4601c301
lea ebp, [ebp + eax - 0x4601c2fd]
jmp 0x105769da

Function at 0x108a6f5c
Capabilities:
Encode data using base64

Disassembly:
inc ebp
mov eax, ebp
dec edx
lea esi, [esi + ebp*8 + 0xa]
inc dx
mov dword [ecx + ebp*4], ebx
jbe 0x10949cb5
dec bl
movsx edi, word [esp + eax - 0xf0a8]
inc esp
movsx ebx, word [esp + eax - 0xf0a6]
rol edi, 0x92
ror bl, 1
inc sp
xchg edi, ebx
xor bl, 9
inc ebp
movsx eax, bl
sub word [esp + eax*4 - 0x3c2ca], di
dec ecx
sar ebx, 0xb9
dec bl
dec eax
or edi, dword [esp + eax - 0xf0a8]
call fcn.105e65c9
mov ecx, 0x2a883a28
dec eax
lea ebx, [ecx*4 - 0x1a63ce60]
dec eax
mov ecx, dword [esi + ecx*2 - 0x55107450]
mov eax, ebx
sal ax, 0x84
mov bx, word [esi + 8]
inc esp
movzx ebp, al
jp 0x1051fa02
call fcn.1093f7f5

Function at 0x108bde24
Capabilities:
Encode data using xor

Disassembly:
push edx
mov edx, ecx
pop ecx
call fcn.10978ab8
call fcn.104a17cb
mov ecx, 0xf4107417
and ecx, 0xec279699
movzx edx, cl
movzx ax, byte [edx + ebp - 0x11]
ror ecx, cl
and edx, 0x302e3111
add cl, byte [ebp + ecx*2 - 0x1411e3fe]
shl edx, 0x42
shl edx, 0x50
and al, cl
lea ecx, [edx + edx*2 - 0x20cc2cc5]
sub dl, dh
lea edx, [ecx*2 + 0x5820719c]
not al
and dl, ch
adc dl, cl
neg cl
mov word [ebp + edx*2 - 0x30403098], ax
jp 0x104dca55
inc ecx
movzx ecx, byte [esi]
mov ebx, 0x991aaa14
dec esp
lea eax, [ebx + ebx - 0x22695d75]
dec ecx
add esi, 1
inc ecx
xor cl, ah
not cl
dec cl
dec esp
lea ebp, [ebx + ebx + 0x2c174401]
inc ecx
movzx edx, al
dec ecx
and ebx, ebp
xor cl, 0x88
dec cl
ror cl, 1
xor cl, 9
shr dl, 0x44
dec cl
inc esp
xor ah, cl
inc ecx
xor edx, ebp
call fcn.10ad8522
Function at 0x1090c403
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + ebx*4]
jmp 0x105616ff
rol ecx, 3
neg ecx
lea edx, [eax*2 + 0x7025cc08]
inc ecx
sub edx, eax
xor ebx, ecx
ror ax, 0xcb
call fcn.10a3a68f
not edx
xor edx, 0x448650b6
dec word [esp + ecx*2 - 1]
neg edx
xchg dword [esp + ecx*2 - 2], ecx
bswap edx
neg cl
rol edx, 1
sub edx, 0xca8e93ac
not word [esp + ecx - 0x57a8e87b]
mov eax, ecx
not cx
not edx
add ax, cx
add cl, ah
sub edx, 0x91185913
not word [esp + ecx - 0x57a81781]
pop ecx
xor ebx, edx
sar ecx, cl
not dword [esp + eax - 0x57a8ffff]
add esi, edx
or dword [esp + eax - 0x57a8ffff], 0x86a6dcbd
sal cx, 0x69
mov dword [esp + eax - 0x57a8ffff], esi
ret
neg eax
lea ecx, [edx + ecx - 0x761ca52]
xor ebx, eax
call fcn.10a4bd31
mov edi, 0xe136aab0
inc esp
movzx ecx, di
inc ecx
movsx ebx, cx
inc edi
mov ebx, dword [ecx + esi - 0xaab0]
inc esp
movsx edi, di
inc ebp
xor ebx, esp
inc ecx
movzx eax, cl
inc ecx
bswap ebx
inc ecx
dec ebx
inc ecx
not ebx
inc edi
lea ebx, [ecx + ebx - 0x7304bf69]
inc ecx
mov eax, 0x64a63f8b
dec ebp
sub eax, eax
inc ecx
push esp
inc esi
xor dword [esp + ecx - 0xaab0], ebx
dec edx
lea ebp, [eax*2 + 0x6a3c4ba8]
dec esp
lea ebp, [ebp + ebp*2 + 0x38808123]
inc ecx
pop esp
inc esi
mov dword [esi + ecx*4 - 0x2aac4], ebx
inc ebx
mov al, byte [esi + ecx*8 - 0x5557c]
inc ecx
xor al, ah
inc eax
sar bh, 0xe6
dec ecx
and ebp, ebp
ror bl, 0xc3
not al
dec bl
inc ecx
xchg cl, bl
dec al
call fcn.10931859
dec ebx
jmp 0x109d5dd4
je 0x109eec38
call fcn.10ad3549
lea esp, [esp + 4]
jne 0x10533776
mov eax, 0xaf3712a4
mov eax, dword [ebp]
push 0x8b14ecab
lea esp, [esp + 4]
call eax
mov ebx, 0x15394908
mov ebp, dword [ebx + ebp - 0x1539490c]
inc ebx
ror bx, 0x83
mov dword [ebx + ebp - 0x15392921], eax
movsx ecx, bx
movsx edi, bx
mov edi, ebp
not ecx
pop ebx
movzx esi, cx
movzx eax, cl
pop esi
push eax
pop eax
pop ebp
jae 0x1094936f
xor eax, ebx
xchg ecx, edx
pop ecx
add eax, 0x828890a2
inc dx
rol eax, 1
lea edx, [edx + edx - 0x4978a25d]
not edx
inc eax
sar dl, 0x81
lea ecx, [edx*4 + 0x65038c32]
jp 0x1090c372
mov eax, 0x34bb183f
movzx ecx, al
lea esi, [esi + eax - 0x34bb1843]
mov ecx, dword [esi + eax*2 - 0x6976307e]
ror al, 0x21
xor ecx, ebx
dec ecx
jmp 0x1057cdf1

Function at 0x109362e7
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x105cd7d7
mov eax, 0x5a4d
cmp word [edx], ax
je 0x1056f13d
test edx, edx
je 0x105cd7d7
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x105cd7c3
push ebp
btc bp, cx
mov ebp, esp
bt edx, 0x8c
bswap edx
shr dh, 0x8b
mov edx, dword [ebp + 8]
test eax, 0x2a007e9e
cmc
cmp bl, 0xc
lea esp, [esp - 0x114]
clc
stc
push esi
jmp 0x1092e105

Function at 0x109451e6
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea edi, [esp + edi + 0x18]
call fcn.108f4cf9
rol edx, 2
sub edx, 0x9e21cf14
xor cx, cx
not edx
movzx eax, cl
add eax, ecx
dec ax
bswap edx
bswap eax
shr eax, 0xf
not edx
jne 0x10584bc6
Function at 0x1095fa35
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, 0x1786250a
dec ebx
movzx ebx, byte [ecx + ebx*4 - 0x5e189424]
push 0x6389b023
xor ebx, eax
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x10a04eec]
shr eax, 8
xor eax, ebx
inc ecx
xor eax, 0x8d1bdf21
shl dword [esp], 0xd4
dec edx
lea esp, [esp + 4]
jne 0x105bf3fb
mov ecx, 0x8cac6b1d
pop ebx
not eax
mov edx, 0xc3848a6
mov dword [ebp + edx*8 - 0x61c24530], eax
mov edx, dword [edi + edx*8 - 0x61c24530]
mov ecx, 0x5dbdd614
lea ecx, [ecx*2 + 0x501a0913]
movzx eax, cl
lea edi, [ecx + edi - 0xb95b537]
xor edx, ebx
xor ecx, ecx
sub cx, cx
adc eax, ecx
neg edx
xadd ax, cx
not eax
lea edx, [eax + edx - 0x40f52223]
or cx, 0x2404
xor edx, 0xbe3abaa7
not al
dec edx
xor ebx, edx
lea eax, [eax*4 + 0x2b2dd29d]
lea ecx, [eax + ecx*8 + 0x27ba918c]
not cx
add esi, edx
lea edx, [ecx + eax*8 + 0x752bffa0]
shl eax, cl
jmp esi
lea esp, [esp + 8]
je 0x105bf43d
jmp 0x109fa5dd
jmp 0x10a2bc74
jmp 0x105bf3fa

Function at 0x1096cf6c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword ss:[ecx + eax - 0x12869d8d]
mov eax, edx
rol dword [esp + ecx*2 - 0x250d3b1a], 0x2e
mov edx, dword [ecx + edi - 0x12869d89]
and ecx, ecx
not eax
sbb ecx, ecx
pop ecx
sbb cx, cx
not edx
sbb cx, cx
and eax, edx
push ecx
dec ecx
lea edx, [ecx + ecx + 0xa04eb18]
mov dword [edi + edx - 0x58caeb12], eax
mov ecx, dword [ebp + edx - 0x58caeb1a]
lea ebp, [ebp + edx - 0x58caeb1a]
jl 0x10af6908
add esi, eax
movsx eax, byte [esp + ecx*8 - 0x72beffb0]
lea edx, [edi + ecx*2 - 0x1cafbfea]
mov dword [edi + ecx*2 - 0x1cafbfee], edx
dec eax
pop edx
mov dword [esp + ecx*2 - 0x1cafbfee], esi
ret 4
add eax, eax
dec dl
xor ebx, ecx
or edx, 0xc7245195
jne 0x10a74657
jno 0x105dc9f9
xor ecx, ebx
pop eax
mov eax, edx
dec edx
rol ecx, 1
lea eax, [edx + edx*4 + 0x5c3c838b]
sar eax, 0x86
bswap ecx
push edx
or edx, dword [esp + eax*4 - 0x5993930]
inc ecx
sal word [esp + eax - 0x1664e4a], 0xec
xor eax, dword [esp + eax*2 - 0x2cc9c98]
rol edx, 0xd1
neg ecx
rol ecx, 3
dec ecx
push eax
rol ecx, 2
xor ebx, ecx
add esi, ecx
movzx ecx, word [edx + edi - 0x39679883]
xor dl, al
shr dword [esp + eax - 0x4166d2fb], 0xdb
lea edi, [eax + edi - 0x4166d2f7]
add byte [esp + edx - 0x39679871], dh
xor cx, bx
inc cx
xor ax, 0xfb3e
xor edx, 0x733160ab
neg cx
sar dl, 0x85
neg word [esp + eax - 0x416629bb]
adc cx, 0xdbd
not cx
not eax
rol cx, 1
sal al, 0x21
jns 0x10a61d17
push 0x12869d8d
mov ecx, dword [esp]
movzx eax, cx
mov eax, dword [edi + eax*8 - 0x4ec68]
jmp 0x104e069e
adc esi, ecx
movzx ecx, dl
mov eax, dword [eax + edi - 0x7ac5fffc]
shr edx, 2
sub dl, 0x3f
call fcn.10a8564c
not cx
push ecx
bswap eax
movzx edx, cl
push edx
rol eax, 2
bswap eax
xor ebx, eax
neg word [esp + ecx - 0xe57dfef]
jbe 0x1093e2f0
movzx eax, dl
xadd edx, eax
xor ecx, ebx
add byte [esp + edx - 0x58caeb29], al
ror edx, 0xeb
inc ecx
pop eax
not ecx
lea ecx, [edx + ecx - 0x39d6b632]
ror ecx, 2
lea ecx, [ecx + edx + 0x16869140]
jmp 0x105f129c
Function at 0x1097de88
Capabilities:
Encode data using xor

Disassembly:
clc
ror edx, 1
sub cx, 0x7283
call fcn.10a71e38
add byte [esi + edx*4 + 0x43], dh
test byte [eax], al
add dword [eax], edx
sub eax, 0x2463c598
jecxz 0x1097debf
pushfd
loope 0x1097df18
and ebp, dword [0xd5cebef9]
cli
ficomp word [edx]
xor al, byte [edi]
pop ebp
rcr dh, cl
mov byte [0x933549fe], al
je 0x1097deaf
xchg edi, eax
std
adc ch, byte [ebp - 0x5c]
insd dword es:[edi], dx
movsb byte es:[edi], byte [esi]
sub ch, ch
jge 0x1097de53
and eax, 0x2295350d
or byte [edi + 0x37420d7b], cl
xchg ebp, eax
lds esp, [esi]
in al, dx
lds ecx, [esi]
dec edi
xchg edi, eax
and byte [ecx + 0x7e], 0xd5
test dword [esi - 0x2322cea0], eax
dec ecx
add eax, 0x651f2c29
jae 0x1097def4
scasd eax, dword es:[edi]
pop edx
outsb dx, byte [esi]
cli
jge 0x1097df22
invalid
inc edi
popal
jge 0x1097def9
xor dword [esi], eax
push es
shl byte [edi], 1
in al, dx
je 0x1097df6d
cmpsd dword [esi], dword es:[edi]
adc eax, 0x19e02ca2
popfd
pop es
mov dl, 0x6a
jp 0x1097df1e
and dword [ecx - 0x59], ebx
call 0xa2e43b8
movsd dword es:[edi], dword [esi]
mov ebp, 0x44d489d2
inc esp
dec ebp
xchg edx, eax
lodsb al, byte [esi]
mov ds, word [ebx + 0x3d]
je 0x1097df4f
cmp eax, 0xf8f42e74
hlt
clc
invalid
test byte [edx + eax*2 - 0x19e93df], dl
and ch, byte cs:[esp + ebx*8]
stc
xchg edi, eax
sbb eax, 0xedf9070c
mov edi, 0x9eab52e8
das
fdiv dword [edx - 0x68]
pushfd
pop eax
jns 0x1097dfc4
push esi
ljmp 0xf1ec:0x3fbd99f8
loopne 0x1097dfe8
add byte [ebp + 0x6f], 0x3c
dec edx
xchg esi, eax
add esp, dword [0xd724d902]
inc edx
loope 0x1097df92
jmp 0x93a768f9
dec eax
mov ah, 0xef
movsd dword es:[edi], dword [esi]
retf
push es
pop esi
jg 0x1097df77
lodsb al, byte [esi]
aad 0x26
mov dword [0x8a70c86f], eax
sub dl, byte [eax]
insb byte es:[edi], dx
mov dh, 0x22
rol edi, 7
dec edi
mov edi, 0x6833b40d
add byte [ecx], bl
shr byte [ebp - 0x76], 1
cwde
pop esi
jne 0x1097dfdb
mov ah, 0x33
push 0x6dd01900
mov bl, byte [eax - 0xc8aa19c]
mov ah, 0xa0
ljmp 0xf97e
Function at 0x109efe4b
Capabilities:
Encode data using xor

Disassembly:
not eax
movzx edx, cx
shl dl, 0x45
mov dword [ebp + ecx - 0x2eac4a92], eax
mov eax, edx
lea edi, [edi + ecx*2 - 0x5d589528]
sbb cl, dh
jg fcn.10aaabd5
mov ecx, dword [edi + ecx*2 - 0x5d589490]
dec edx
inc dx
xor ecx, ebx
neg ecx
sar al, 0xc1
inc ax
call fcn.109fd075
mov edx, 0xca24a7b6
mov ecx, dword [esi + ecx*2 - 0x154d245a]
neg edx
sub dx, dx
dec dx
lea esi, [esi + edx - 0x35dbfffb]
inc edx
not eax
sub dx, dx
not ecx
call fcn.10acdb9e
mov esp, 0x7918002
jge 0x10543147
mov bl, 0x31
nop
int 0x44
arpl word [ebx + 0x164d9031], si
mov esi, dword [ebx - 0x1db6fcf]
or esi, dword [ebx - 0x5a6fcf]
mov ebx, 0x379031b3
xlatb
stosd dword es:[edi], eax
mov bl, 0x31
nop
in eax, 0x94
xor dword [eax - 0x4c74e9b3], edx
xor dword [eax - 0x4cf401dc], edx
xor dword [eax - 0x4c44005b], edx
xor dword [eax - 0x4c5428c9], edx
xor dword [eax - 0x4c046b1b], edx
xor dword [eax - 0x4c1419c9], edx
xor dword [eax - 0x6dbaf27a], edx
int 0xaf
sti
mov bl, 0x31
nop
aaa
out 0xeb, al
mov bl, 0x31
nop
xchg byte [0xafcd9245], cl
scasd eax, dword es:[edi]
inc ebp
sal dword [eax - 0x1e86df4a], 0xc1
mov al, byte [0x30794ca7]
jo 0x10543156
cmpsd dword [esi], dword es:[edi]
dec esp
jns 0x1054312b
shl eax, 1
cmpsd dword [esi], dword es:[edi]
dec esp
jns 0x10543151
test al, 0x50
cmpsd dword [esi], dword es:[edi]
dec esp
jns 0x10543126
jns 0x10543150
cmpsd dword [esi], dword es:[edi]
dec esp
jns 0x10543174
mov al, byte [0x794ca7a8]
call 0x9ee3f5d6
and ebx, ebp
pop ebx
mov ecx, 0x2eac4a92
or ecx, ecx
jae 0x105430bb
mov dword [esp], 0xb1a23b27
dec byte [esp + 2]
mov dword [esp], ebx
movzx ebx, byte [ecx]
push 0xab291da1
xor ebx, eax
inc dword [esp]
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x109fbee0]
shr eax, 8
xor eax, ebx
push 0xb1ac0523
dec dword [esp + 2]
inc ecx
xor eax, 0x5e9fd7ad
dec edx
lea esp, [esp + 8]
jne 0x109efe59
mov ebx, 0x8b3ee50e
jmp 0x108ab9a6

Function at 0x109feb91
Capabilities:
Execute syscall

Disassembly:
add esi, 2
push 0x1a052a3d
mov word [esi], dx
call fcn.108b1b8f
Function at 0x10a056a6
Capabilities:
Manually build aes constants

Disassembly:
shr ecx, 0xe1
sub cl, bl
mov edi, dword [esp + ecx - 0x2545290a]
jnp 0x109de6e9
mov edx, 0x6cbf7536
jmp 0x10908a52
dec esp
dec esp
add ebx, ebp
neg edx
ror eax, 0x4e
sar dword [esp + ecx*2], 0xad
xor ebx, edx
add esi, edx
mov dword [esp + ecx], esi
xor al, 0xc
ret
lea ecx, [edx*8 + 0x3fa9d391]
mov eax, dword [esi + edx - 0x6cbf7536]
xchg ebx, eax
shr cl, 0x65
add ecx, edx
lea esi, [edx + esi - 0x6cbf7532]
sar cl, 4
lea ecx, [edx + edx*2 + 0x5d06c611]
xor eax, ebx
push ecx
or word [esp + edx - 0x6cbf7536], dx
inc eax
call fcn.10abcee5
xor eax, 0xb608d133
push edi
scasb al, byte es:[edi]
jecxz 0x10908a3d
sub al, byte [esi + 0x66]
cmpsb byte [esi], byte es:[edi]
jecxz 0x10908a43
sub bl, byte [esi + 0x53]
out 0xe3, al
lodsd eax, dword [esi]
sub bl, dh
xchg edx, eax
bnd jecxz 0x10908a4f
sub bl, dl
push 0xffffffffffffffd2
cli
outsd dx, dword [esi]
push esp
jo 0x10908a5f
movsd dword es:[edi], dword [esi]
adc al, 0xa5
pop edi
push eax
fnsave dword [ebx + 0x1b09e4f1]
mov bh, cl
aad 0x85
aas
mov esi, 0xe6b217c0
jmp 0x10908b14
in eax, 0xd7
xor al, 0x63
xchg dword [esi], ecx
lahf
in al, dx
inc esi
push eax
insb byte es:[edi], dx
dec ecx
clc
add ebx, dword [ecx - 0x344d39cc]
cmp byte [ecx - 2], ah
xor dword [edi], eax
jmp 0x4a49320d
push esi
add di, dx
ror edi, 0x83
mov edx, 0
mov dword [esp + ecx - 0x4a8a537b], edx
jb 0x108a3ac8
mov edx, dword [edi]
mov dword [esp], 0xdc87ef9c
mov eax, dword [esp]
movsx ecx, word [esp]
xor edx, ebx
bswap edx
dec dword [esp]
js 0x10a52b47
bswap edi
rol ebx, 0xcb
xor edi, 0xed8e021b
sub cl, ch
movsx esi, cx
sar ecx, 0x6b
bswap edi
sbb ebx, esi
rol edi, 1
not ecx
movsx eax, cl
add edi, edx
add ebp, eax
seta bl
mov ebp, esp
dec cx
push esi
lea ecx, [esi + ebp - 0x29dd]
dec dword [esp + esi - 0x2909]
mov esp, ecx
mov dword [esp + ecx - 0x4a8a539b], eax
mov ebx, ecx
movsx edi, dl
jmp 0x1094f75c
rol eax, cl
not edx
sbb dword [esp], eax
sub cl, al
sal word [esp], cl
sub edx, 0x851897aa
xchg dword [esp], eax
not edx
xor ebx, edx
or eax, 0x7f88749c
sal cx, 6
add ebp, edx
call fcn.1051df73
lea ecx, [ecx - 0x69fe8ccf]
adc ebp, edx
shr ecx, 0xd3
mov eax, dword [edi + ecx*2 - 0x241c]
lea edx, [ecx + ecx*2 + 0x7c0e4aab]
inc dl
xor eax, ebx
xadd dl, dh
not dl
ror eax, 1
and ecx, ecx
rol ecx, cl
bswap eax
xor eax, 0x31bbd595
jmp 0x10a8ef63
inc eax
ror ecx, 0x3e
call fcn.10a283e8