joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9dd000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c35cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4d2bb0
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x9dd090
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x9dd057
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [0x4d10f8]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x9dd081
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.00a34244
jmp 0x9dd096
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.00a34244
jmp 0x9dd096
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4d2b44
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.00a34190
mov ecx, esi
mov dword [edi], 0x4d2710
mov dword [esp + 0x1c], 0xffffffff
call fcn.00a34226
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x9f6360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c6f9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4d56a0
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x9f63f0
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x9f63b7
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [0x4d10f8]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x9f63e1
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.00a34244
jmp 0x9f63f6
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.00a34244
jmp 0x9f63f6
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4d2b44
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.00a34190
mov ecx, esi
mov dword [edi], 0x4d2710
mov dword [esp + 0x1c], 0xffffffff
call fcn.00a34226
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0xa0e210
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, byte [eax + 0x4e0e00]
xor cl, 0x7d
mov byte [eax + 0x558afc], cl
inc eax
cmp eax, 0x6e0e
jb 0xa0e212
mov eax, 0x558afc
ret
Function at 0xa55f50
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
cmp ebx, 1
push edi
jl 0xa55f6b
cmp ebx, 8
jg 0xa55f6b
mov eax, 1
jmp 0xa55f6d
xor eax, eax
mov esi, dword [esp + 0x14]
push 0x544da4
push eax
push esi
call fcn.00a547d0
mov eax, dword [esi + 0x6af70]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af78], ebp
jne 0xa55fa4
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
mov ecx, 0x7fff
xor eax, eax
lea edi, [esi + 0x4af70]
mov dword [esi + 0x6af6c], ebp
rep stosd dword es:[edi], eax
mov ax, word [ebx*8 + 0x51ffba]
xor ecx, ecx
mov dword [esi + 0x6af98], eax
mov cx, word [ebx*8 + 0x51ffb8]
xor edx, edx
mov dword [esi + 0x6af9c], ecx
mov dx, word [ebx*8 + 0x51ffbc]
xor eax, eax
mov dword [esi + 0x6afa0], edx
mov ax, word [ebx*8 + 0x51ffbe]
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0xa56005
mov eax, dword [esp + 0x1c]
or byte [eax], 4
jmp 0xa56011
cmp ebx, 8
jl 0xa56011
mov eax, dword [esp + 0x1c]
or byte [eax], 2
lea edi, [esi + 0x1af70]
push 0x10000
push edi
push esi
mov dword [esi + 0x6af84], ebp
mov dword [esi + 0x6af74], ebp
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af90], eax
je 0xa5608a
cmp eax, 0xffffffff
je 0xa5608a
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebp
jae 0xa56055
push esi
call fcn.00a562a0
add esp, 4
mov dword [esi + 0x6af7c], ebp
xor eax, eax
mov edx, dword [esi + 0x6af7c]
xor ecx, ecx
mov cl, byte [edi + eax]
and edx, 0x3ff
and ecx, 0x7fff
shl edx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [esi + 0x6af7c], ecx
jb 0xa5605d
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0xa563f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0xa56634
push ebx
cmp eax, 3
jb 0xa5646b
mov ecx, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
xor eax, eax
and edx, 0x3ff
mov al, byte [ecx + esi + 0x1af72]
and eax, 0x7fff
shl edx, 5
xor eax, edx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebp, dword [esi + eax*4 + 0x4af70]
mov dword [esi + ecx*4 + 0x2af70], ebp
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebp, ebp
je 0xa564ad
mov edx, dword [esi + 0x6af84]
sub edx, ebp
cmp edx, 0x7efa
ja 0xa564ad
mov eax, dword [esi + 0x6af90]
mov ecx, dword [esi + 0x6afa0]
cmp ecx, eax
jbe 0xa56495
mov dword [esi + 0x6afa0], eax
push ebp
push esi
call fcn.00a560a0
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0xa564ad
mov edi, eax
cmp edi, 3
jb 0xa565a6
mov ecx, dword [esi + 0x6af84]
mov ebx, dword [esi + 0x6af88]
lea eax, [edi - 3]
sub ecx, ebx
push eax
push ecx
push esi
call fcn.00a557a0
mov edx, dword [esi + 0x6af90]
mov ecx, dword [esi + 0x6af98]
add esp, 0xc
sub edx, edi
mov ebx, eax
cmp edi, ecx
mov dword [esi + 0x6af90], edx
mov eax, edx
ja 0xa56554
cmp eax, 3
jb 0xa56554
dec edi
mov ebp, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
inc ebp
xor eax, eax
mov ecx, ebp
mov dword [esi + 0x6af84], ebp
and edx, 0x3ff
mov al, byte [esi + ecx + 0x1af72]
and ecx, 0x7fff
and eax, 0x7fff
shl edx, 5
xor eax, edx
dec edi
mov dword [esi + 0x6af7c], eax
mov ebp, dword [esi + eax*4 + 0x4af70]
mov dword [esi + ecx*4 + 0x2af70], ebp
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0xa564f4
jmp 0xa565d0
mov edx, dword [esi + 0x6af84]
xor eax, eax
add edx, edi
push 0x544e00
mov dword [esi + 0x6af84], edx
push 1
mov al, byte [edx + esi + 0x1af70]
lea ecx, [edx + esi]
xor edx, edx
mov dword [esi + 0x6af7c], eax
mov dl, byte [ecx + 0x1af71]
and eax, 0x3ff
and edx, 0x7fff
push esi
shl eax, 5
xor edx, eax
xor edi, edi
mov dword [esi + 0x6af7c], edx
call fcn.00a547d0
add esp, 0xc
jmp 0xa565d6
mov eax, dword [esi + 0x6af84]
xor ecx, ecx
mov cl, byte [eax + esi + 0x1af70]
push ecx
push 0
push esi
call fcn.00a557a0
mov ecx, dword [esi + 0x6af90]
add esp, 0xc
dec ecx
mov ebx, eax
mov dword [esi + 0x6af90], ecx
inc dword [esi + 0x6af84]
test ebx, ebx
je 0xa56610
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0xa565ed
lea ecx, [eax + esi + 0x1af70]
jmp 0xa565ef
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.00a55560
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0xa56625
push esi
call fcn.00a562a0
add esp, 4
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0xa56414
pop ebx
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0xa56647
lea ecx, [eax + esi + 0x1af70]
jmp 0xa56649
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.00a55560
add esp, 0x10
pop edi
pop esi
pop ebp
ret
Function at 0xa7c160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cfa6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x521fb0
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0xa7c1f0
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0xa7c1b7
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [0x4d10f8]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0xa7c1e1
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.00a34244
jmp 0xa7c1f6
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.00a34244
jmp 0xa7c1f6
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4d2b44
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.00a34190
mov ecx, esi
mov dword [edi], 0x4d2710
mov dword [esp + 0x1c], 0xffffffff
call fcn.00a34226
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0xb734ff
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
aas
add byte [edi - 0x77d7dba4], al
xchg dword [esp + 0x28], ebx
mov byte [esp], ah
pushfd
pushal
mov ebp, dword [ebp + 0x190da1]
call fcn.00e51fb4
jle 0xb73513
sub eax, 0xac057e00
lodsb al, byte [esi]
sbb esp, dword [ebx]
jge 0xb7355e
dec edx
dec ebp
jl 0xb734d7
mov dword [eax - 0x26], edx
je fcn.00b734ff
imul esp, esi, 0xe4cbe6c7
retf
fsub st(4)
fistp dword [edi + edx + 0x7a08a446]
cdq
lodsb al, byte [esi]
enter 0x1ee0, 0x2b
cdq
pop eax
dec esp
je 0xb735eb
jg 0xb735ec
add byte [esi], al
mov esi, 0xf40c7c2c
inc ebx
jae 0xb7350a
inc edx
adc ebx, dword [esi - 0xf8a3205]
push edi
lodsd eax, dword [esi]
clc
mov al, byte [0xb11220af]
or byte [esi], ch
pop ds
jne 0xb735e4
xor eax, 0x4ac93291
xor al, 0x8f
cmc
adc bl, byte [ebx - 0xbcc6fd8]
outsd dx, dword [esi]
sahf
jmp 0xb735ad
test dword [0xbfe4f6d1], eax
pop edx
adc dword [edx + 0x2b], edi
xor dword [edx + 0x334271b], edx
mov bl, 0x22
xor dword [edx + 0x7f], ebp
wait
sub al, 0xed
insb byte es:[edi], dx
popal
bound esp, qword [ecx + 0x68]
invalid
cmp dword [edi], edx
adc al, 0x91
jb 0xb73615
lodsd eax, dword [esi]
cdq
dec ecx
push cs
outsd dx, dword [esi]
mov esi, 0xbbf9a218
inc ebp
sbb ebp, dword [eax - 0x7d]
mov dl, 0x12
invalid
out 0x5d, al
jnp 0xb735b4
cmp eax, 0x69ef6981
push ebp
shr dword [edx - 0x22231c45], 1
invalid

Function at 0xb8db9d
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [eax + 0x194fd6]
call fcn.00f5ac14
Function at 0xb8dba8
Capabilities:
Packed with generic packer

Disassembly:
jmp 0xf42811
pushal
mov dword [esp + 0x20], 0x3e385936
call 0xf9c883
mov edx, 0xb5f067d5
cli
fnstenv [eax - 0x65]
adc byte [edi + 0x57b66289], cl
in al, dx
pop eax
std
push ecx
adc al, byte [edi + 0x20a19534]
or byte [ecx - 0x2304aff6], ah
dec eax
or al, 0x43
adc dword [ebx + eax*2 - 0x7a], edx
mov ecx, 0x3706864d
mov ss, ebx
adc byte [edi - 0x7ff0f022], cl
loop 0xf428b9
pop eax
outsb dx, byte [esi]
popal
test al, 0xb3
invalid
invalid

Function at 0xb93399
Capabilities:
Packed with generic packer

Disassembly:
and al, 0xc
mov word [esp + 0x10], 0x2495
push dword [esp + 0x50]
ret 0x54
push dword [esp + 0x50]
ret 0x58
pushal
nop
call 0xf8c068
js 0xb933b1
sahf
sub edx, dword [ecx]
dec esp
ja 0xb93364
sbb eax, 0xcf2e30b0
test eax, edx
mov al, 0x30
iretd
push edx
jmp 0xb93411
pop edi
inc ch
inc ebp
aad 0x60
xchg esi, eax
xchg edi, eax
jne 0xb933af
pop esp
movsd dword es:[edi], dword [esi]
xchg esi, eax
xor edi, ebx
test al, 0x13
cmp bl, dl
xbegin 0x9d70b21b
leave
jo 0xb933a9
mov ah, 0xd7
jge 0xb9338d
invalid
movsb byte es:[edi], byte [esi]
sbb ebx, edx
scasb al, byte es:[edi]
jmp 0xb93422
xchg dword [ebp + 0x5d], ebp
idiv bh
sbb dword [eax], esi
dec esi
jg 0xb933d3
mov al, byte [0x37fabefb]
add ch, cl
mov esi, 0xcd0037fa
xchg edi, eax
jns 0xb93404
sub al, 0x5e
mov edi, 0x4176237a
popaw
pop edx
fisubr dword [ebp + 0x4e]
into
imul esp, dword [eax - 0x51], 0xffffffa4
scasd eax, dword es:[edi]
adc esp, dword [ebp - 0x402b3e6e]
invalid

Function at 0xb954e0
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0x62
jmp 0xbd38cf
pushfd
call 0xfa0ad4
mov ecx, 0xcdfebbee
popal
in al, dx
xor byte [ecx + 0x1feed8f2], ah
mov eax, dword [0x1feed8f2]
and al, 0x79
inc esp
pop ebp
push 0x2d
sub byte [0xf5a61d8a], 0xb6
and eax, dword [ebx]
test al, 0x1d
jl 0xbb9a4b
je 0xbb9a53
jo 0xbb9a5f
pushal
push ebp
js 0xbb9a67
js 0xbb99fc
sbb ebx, dword [ebx]
sub eax, 0x95ad5260
xchg edx, eax
mov eax, dword [0xda8da90c]
invalid
jle 0xbb9a9c
adc byte [ebx - 3], dl
dec ecx
mov ebx, 0x5cd88973
mov eax, ebx
pop esp
fisubr dword [eax - 0x4c]
cmpsb byte [esi], byte es:[edi]
and bh, byte [eax + 0x42]
mov esp, 0x9826643d
cwde
lcall 0x497e, 0xd74ca892
jle 0xbb9ab2
or bh, byte [edi]
cmp esi, ebp
mov esi, cs
push dword [eax - 0xeba08b]
pop edi
adc al, 0xff
inc eax
pop ebx
hlt
xchg edx, eax
push es
sahf
add esp, ecx
cdq
dec ebx
mov word [0x55eba21f], ax
hlt
popfd
jne 0xbb9a72
fbstp tbyte [ebx - 0x7953cdf9]
int1
sahf
lahf
inc esp
add bh, bl
cmp al, byte [0xa68fc449]
jecxz 0xbb9ac4
les ecx, [edi + 0x43fbe3a6]
inc ebx
sbb byte [0x1a023caa], 0xa3
xor byte [ecx - 0x5f], 0xa6
popal
retf
mov dword [esp + 8], ebx
pop ebx
pushal
mov ebx, dword [esp + 0x28]
call fcn.00cd6b9a
jmp 0xbb99ee

Function at 0xbbf37d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [ebx + 0x3fc480]
pushfd
jmp 0xe8b89a
push ecx
call fcn.00ec6b9a
xor dword [edx], 0x10
inc ebx
or eax, 0x50bb464e
xor dword [eax + 0x20], 0xd855b882
fcmovnu st(0), st(6)
invalid
Function at 0xbc4139
Capabilities:
Packed with generic packer

Disassembly:
movsx di, al
mov edi, ebx
pop ebx
not bl
pushfd
call fcn.00d8625a
pushfd
mov byte [esp], ah
pushal
nop
pushal
mov dword [esp + 0x40], ebx
lea esp, [esp + 0x40]
je 0xd6421d
mov bh, dh
movsx bx, bl
not bx
mov ebx, dword [esp + 4]
call fcn.00d61569
pushfd
mov byte [esp], 0xce
xchg dword [esp + 4], ebp
pushal
xchg dword [esp + 0x20], ebp
jmp 0xc76552
bswap ebp
mov ebp, 0x496362
jmp 0xef2723
pushfd
mov ebx, dword [esp + 8]
pushfd
call fcn.00c4a441

Function at 0xbd38b3
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0xd7315ca
mov edx, 0x42ad06
call 0xbf4010
call fcn.00bf1892
jmp 0xe9b3ca
pushfd
xchg dword [esp + 0x14], edx
bswap dx
movsx dx, al
lea edx, [esp - 0x7a29fe34]
mov edx, dword [esp + 0x18]
push edx
lea esp, [esp + 0x18]
jo 0xbe46c4
lea edx, [edx + 1]
push 0x1ef683a9
pushfd
push 0xc4e12c33
mov dword [esp + 0x10], edx
movsx dx, dl
jmp 0xbd38a3

Function at 0xbf4109
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x10], ebp
push 0xfb732544
mov ebp, 0x4811b8
mov byte [esp], 0x1c
call fcn.00bd10b7
jmp 0xbd38b8

Function at 0xbf6250
Capabilities:
Encode data using xor

Disassembly:
not bx
bswap bx
pushfd
nop
mov bh, al
movzx bx, cl
bswap bx
mov ebx, dword [esp + 4]
jmp 0xb8e415

Function at 0xc0c1d5
Capabilities:
Packed with generic packer

Disassembly:
lea ebx, [ebx + 1]
call fcn.00b72644
and ch, byte [ebx]
fscale

Function at 0xc0c1e4
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x3c]
jns 0xead3e3
pushfd
xchg dword [esp + 4], ecx
pushfd
pushfd
pushal
mov word [esp], 0xe72c
push dword [esp + 0x2c]
ret 0x30
pushfd
call fcn.00bd35b9

Function at 0xc20305
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp], 0x9241
lea esp, [esp + 4]
jne 0xe6f2af
nop
call fcn.00dd079b
call fcn.00e9276e
Function at 0xc4d68b
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov edx, 0xae159243
wait
out 0x5b, eax
sbb al, byte [ebx + esi*2 - 0xc]
mov ecx, 0x7b5a069b
cmp dword [edx], 0x77d72ace
sub dword [edi], edi
sbb eax, 0xbaf848d5
aam 0xa0
jp 0xc4d60d
hlt
movsb byte es:[edi], byte [esi]
mov esp, dword [ebx + 0x1f]
adc al, 0xbf
insd dword es:[edi], dx
pop esp
arpl word [ebp + edx*2 - 5], sp
shl dword [ecx + 0x73fc51ea], 0x37
add eax, 0x2c017ca9
xchg dword [ecx + ecx], edi
pop ss
or bh, byte [esi]
fadd qword [ebp + 0x10]
cmp eax, 0x18e3716a
adc byte [0x18e3716a], bh
mov edi, 0xea5db442
xor dl, byte [ecx]
add eax, 0xdddaf7be
js 0xc4d601
adc dword [edx - 0x7fbe75cf], esp
inc ebp
jb 0xc4d645
push ecx
push 0x52
pop esi
push 0xffffffffffffffd2
ja 0xc4d6ae
xchg dword [esp + 0x1c], ecx
push esp
lea esp, [esp + 0x20]
je 0xedf869
pushal
pushal
xchg dword [esp + 0x3c], ecx
lea ecx, [esp - 0x52a96895]
movsx ecx, bl
movzx cx, dl
mov ecx, 0x477ed1
call fcn.00cf68fc
aaa
dec edx
jg 0xc4d65f
mov dword [0xce0db0b3], eax
cdq
sub byte [eax], dh
mov bl, 0xb0
or eax, 0x302899ce
xlatb
adc esp, edi
inc ebp
xor byte [eax - 0xe293868], 0xa6
adc dword [esp - 0x4ef7548d], edi
wait
mov dh, 0x9c
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsb al, byte [esi]
sahf
mov ebx, 0x9bc7a92
cmp al, 7
or dword [edi + eax], edi
xor al, 0x1c
mov esp, edx
mov esi, 0x585d3813
jne 0xc4d6e4
test edx, 0xc483f5ae
stc
scasd eax, dword es:[edi]
out 0xe3, al
salc
pop ecx
adc al, 0x89
adc byte [ecx - 0x74c17697], bh
xor dh, byte [ebp + 0x6814aa78]
repne stosb byte es:[edi], al
jns 0xc4d773
popal
mov word [esi - 0x325e01dc], ss
lar ecx, word [ebp - 0x17]
int 0xf
add cl, byte [ebp - 0x17]
ja 0xc4d6bb
jg 0xc4d6e1
mov dh, 0x31
jl 0xc4d714
invalid
sbb byte [ebp + 0x24], 0x65
or eax, 0x4f4afdac
sbb eax, 0x455ff152
mov ecx, edx
test dword [ecx + 0x20], 0x823c6f9d
inc ebp
add edi, dword [eax + eax*4]
sbb byte [edx], cl
xchg byte [eax + 0x22], dh
dec byte [edx]
xchg byte [ecx - 0x2a981f7b], dh
sar byte [edi - 0x7f4c1eed], cl
add ecx, dword [ecx]
dec edx
pop ebx
inc ecx
cwde
invalid
pushal
jmp fcn.00e95e71

Function at 0xd28571
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov esi, dword [esi + 0x326ec7]
outsb dx, byte [esi]
xor al, byte [eax]
push dword [esp + 4]
push 0x9f493af1
call fcn.00c07cdb
sbb byte [ebx], 0x7c
xor eax, 0xae864378
out dx, eax
enter 0x2105, 0xffffffffffffffb0
je 0xd28575
imul esi, dword [eax - 0x48], 0xcaf5bcf1
aad 0xf2
leave
lodsb al, byte [esi]
sbb byte [esp + esi + 0x40fc454c], bh
fcomi st(3)
imul esp, dword [eax + 0x6b95dde2], 0x7b
dec eax
push edi
xlatb
loopne 0xd28612
pop esi
sbb dword [ebx + esi*2], ebp
pop edi
cdq
arpl word [esi + 0xd], sp
xchg edi, eax
sbb ah, byte [esi]
push 0x67dc345d
and bh, byte [ecx]
sbb edx, dword [eax + 0x17]
sub al, 0xbc
add al, 0x48
adc edi, dword [eax]
cmpsb byte [esi], byte es:[edi]
mov ebx, 0xf627fe90
dec edi
invalid
sub bh, byte [esi]
adc al, 0x2f
retf
Function at 0xd5f026
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.00c21ef0
push eax
sub esp, dword [0xe162633a]
sub ecx, dword [ebx - 0x76]
arpl word [ebp - 0x18a150ce], si
mov ah, 9
aas
push ss
cmp byte [ebx], dl
sahf
adc ebx, dword [edx + 0x7b302125]
cmp byte [ecx - 0x4efde35f], bl
push es
invalid
lea esp, [esp + 0x54]
jle 0xcaaada
push 0xdf7f631b
push dword [esp]
xchg dword [esp + 8], esi
pushal
push 0x9a96cc03
mov word [esp + 4], dx
mov byte [esp + 4], 0xf3
push dword [esp + 0x2c]
ret 0x30

Function at 0xd6f5d9
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp + 4], 0xc
mov dword [esp + 0x58], esi
jmp 0xe5f7a4

Function at 0xd93ad7
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], 0xfc4ee5e9
mov word [esp + 4], bx
lea ebx, [ebx + 0x276af8fe]
call fcn.00e5261d
add byte [ebx + 0x25a12dbf], cl
add bh, bh
xor al, 0x24
mov edi, dword [edi + 0x25a12d]
push dword [esp]
mov word [esp], 0x29bc
call fcn.00a71858
and ebp, dword [ecx + ebp - 0x78]
dec ebx
jecxz 0xd93ad6
jnp 0xd93abf
invalid

Function at 0xdc7731
Capabilities:
Encode data using xor

Disassembly:
pushfd
pushfd
push 0x4d9965ab
call 0xa72fba
lahf
mov eax, dword [esp + 0x2c]
call fcn.00cfd3da
mov eax, dword [eax + 0x3c0023]
lea esp, [esp + 0x20]
jp 0xeee76f
lea eax, [eax + 0x4893b5aa]
call fcn.00f3c236
mov edx, dword [esp + 0xc]
push dword [esp]
jmp 0xe7fc09
lea edx, [edx + 1]
jmp 0xd37c8e
push 0x9946b5ee
lea eax, [eax + 0x4893b5aa]
pushal
push dword [esp]
jmp 0xd75d04

Function at 0xdca578
Capabilities:
Encode data using xor

Disassembly:
push eax
lea esi, [esi - 0x2d715448]
push dword [esp + 4]
pushfd
call 0xf70e50
xchg esp, eax
in eax, 0x6d
fdiv st(5), st(0)
cmp eax, dword [edx + 0x8968c19]
add eax, 0x49763108
add byte [ebp + 0x3bfddc6d], dl
sbb byte [ecx], 0x8c
xchg esi, eax
or byte [0x49763108], al
push esi
pop ecx
push esi
jae 0xcb04e1
wait
push es
scasd eax, dword es:[edi]
and byte [esi], dl
stosd dword es:[edi], eax
ja 0xcb04a9
adc al, 0x78
lea esp, [ecx + edx*4]
movsd dword es:[edi], dword [esi]
xor ebx, dword [esi]
movsd dword es:[edi], dword [esi]
invalid
sub dword [0x47fcb429], eax
xor esp, dword [ecx + 0xf]
inc eax
adc edx, dword [edi - 0x28]
lodsb al, byte [esi]
adc dword [esi + 0x439c30d7], ebp
cli
and edx, dword [ebx + eax*2]
fist dword [esi]
idiv dword [ebx + 0x64]
jbe 0xcb04c7
invalid
push 0x46569d11
mov esi, dword [esi + 0x22e5c9]
jmp 0xeed3d4
jmp 0xcb0499

Function at 0xdd714f
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [ebp + 0x1f1070]
jmp 0xe570c6
call fcn.00bd05e5
Function at 0xe0a8ce
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov byte [esp + 4], bl
call fcn.00e464f1
add al, byte [ebx + 0xa2e9d1c]
mov bl, 0x96
push ds
xchg ebx, eax
sbb esi, dword [edi + 0x4a]
xor ebp, dword [edi]
and byte [ecx + 0x10919f2e], cl
mov ecx, 0x9d913202
sub al, 0xf2
shr esi, 0xc1
push es
xchg ecx, eax
xor al, 0xc
inc ecx
xchg esp, eax
sahf
stosd dword es:[edi], eax
jno 0xe0a8d2
dec ecx
and dword [edi], ebx
inc ebp
cmp dword [edx - 0x58], esp
outsd dx, dword [esi]
test byte [esi + 0x54], ch
neg edx
pop ds
mov dword [0x20112ab3], eax
aas
add al, 0x31
adc cl, byte [ecx - 0x30a6f7c6]
sub eax, 0x5770536c
out dx, al
invalid

Function at 0xe43cdf
Capabilities:
Packed with generic packer

Disassembly:
out 0x66, eax
bswap edi
jnp 0xe43c72
popal
jge 0xe43ce8
add byte [eax + ebp*8 + 0x13aedb], bl
pushfd
call 0xf7ebc0
inc ebp
insb byte es:[edi], dx
dec ebx
sub byte [esi - 0x3e274be9], 0x36
sub byte [edx - 0x79d6f7fb], 0x43
push edx
insd dword es:[edi], dx
xor bh, byte [edi + 0x2e]
cdq
movsd dword es:[edi], dword [esi]
scasb al, byte es:[edi]
sti
shl bl, 0xe0
loope 0xe43d42
jbe 0xe43d52
stc
push 0x565b7a33
add dh, byte [edi - 0x44]
cdq
lodsb al, byte [esi]
pop ebx
inc eax
xor dl, byte [esi + 8]
and dword [ecx - 0x493d862], esp
imul edx, dword [ebx + esi], 0x54
jmp 0xe43ccc
push ss
pop ss
mov esi, 0x508fbe55
aaa
or al, 0xca
mov dl, 0xd3
or byte [eax + 0x79], dl
adc byte [eax + 0x3823eb0d], ch
je 0xe43cdb
test al, 0xd
jmp 0xe43d79
hlt
mov esi, 0x164dd9ea
jne 0xe43d52
inc eax
stosb byte es:[edi], al
mov al, 0x63
out 0x83, al
inc edx
add ebx, edi
int1
pop esi
mov ebp, 0x6c9dcb2
lds ebp, [esp + esi + 0x74]
mov eax, dword [0x6e330ac1]
or dh, byte [ebx]
outsb dx, byte [esi]
dec edi
push edx
imul eax, edi, 0x7e3f220
add al, 0x80
jb 0xe43d5b
pop ss
mov ebp, 0xda401b9f
lahf
loope 0xe43d41
adc eax, 0xff5b1db8
test al, 0x17
xchg edi, eax
xchg esp, eax
xor esi, ebx
test eax, 0xf93e6bb6
leave
test al, 0x66
wait
dec eax
cmc
mov al, 0x91
sbb edx, dword [ebp - 0x7f27d3e1]
mov edx, 0x5ffc0159
mov word [edi - 0x31684afc], fs
in eax, dx
retf 0xa205

Function at 0xe64ce9
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0x28], ebx
pop ebx
movzx ebx, dl
mov ebx, 0x42360d
push ebx
mov word [esp + 4], 0xec23
call 0xf67757