joyce8/EMBER2024-capa huggingface dataset:
Function at 0xfde420
Capabilities:
Encode data using xor

Disassembly:
not ebp
mov dword [esp + eax*2], ebx
jp 0xf636df
add edi, ecx
mov ecx, eax
call fcn.010e5a96
inc cx
xor esi, 0x4166cb39
rol esi, 1
inc esp
movsx ebp, cl
inc cx
neg esi
inc ecx
not cl
dec esp
xadd esi, ebp
inc cx
xor edi, esi
or ecx, 0x9f3e6434
neg si
inc ecx
dec al
dec esp
add esi, esp
dec eax
lea ebx, [ebp + 0x57baea19]
inc cx
movzx ecx, byte [esi + edx*2 - 0x22]
add ebp, ebx
inc ecx
sal al, 0xa1
dec ebp
lea edx, [edx + edx - 0x13]
inc ecx
setge cl
inc dx
mov dword [edx + edx - 0x11], ecx
inc ebp
mov esi, ecx
sar ebx, 0x78
inc eax
adc bl, ch
inc esi
mov esi, dword [edx + edi - 0x11]
inc ecx
movzx eax, cx
inc bp
adc ebp, ebp
dec ebp
lea edi, [edi + edx - 0xd]
movsx ecx, dx
dec eax
ror ebp, 0x87
inc esp
xor esi, edi
shl esi, 0xf
inc ecx
cmovbe ecx, ebp
inc edi
lea esi, [ebp + esi - 0x773b9b8]
xor edx, edx
dec ecx
shl eax, 0x8d
inc ecx
rol esi, 1
inc ebp
lea esi, [esi + esi - 0x5d6b096c]
neg eax
inc ecx
ror esi, 1
dec esp
xchg ebx, ecx
push edi
shl bp, 0xa5
sbb bp, cx
call fcn.01200f05

Function at 0xfea323
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
adc bp, sp
mov ebp, esp
movzx edx, ax
mov dh, 0x2a
mov edx, dword [ebp + 8]
sub esp, 0x114
stc
test dl, 0xaa
cmc
push esi
test ax, bp
cmp eax, 0xd7ab870f
test edx, edx
jmp 0x12a08bc
je 0xe30441
mov esi, dword [ebp + 0xc]
jmp 0xe78059

Function at 0x105a6d2
Capabilities:
Encode data using xor

Disassembly:
dec esi
lea edi, [ebp + edi - 0x25fc]
xor esi, edi
inc ecx
pop esp
dec ecx
add esp, 0xfff14a39
inc ecx
jmp esp
inc ecx
mov ecx, 0xd2973726
mov word ss:[ecx], ax
inc ecx
movzx ebp, cx
and ebp, 0x54aa2601
inc ecx
mov esi, dword [edi + ebp*2 - 0x4c00]
jno 0xfa739c
Function at 0x1071b0f
Capabilities:
Encode data using xor

Disassembly:
xor dl, cl
add eax, 0x2faa620
push edi
sbb al, 0xab
or ecx, esi
mov bl, byte [ebx + 0xe29b90c]
push 0x6f3ebf27
push eax
add eax, 0x93c9666f
outsd dx, dword [esi]
leave
xchg ebx, eax
pop edi
popal
mov esi, 0x2ede4202
xchg esp, eax
jb 0xfff748
pop ecx
and edx, eax
sar byte [eax + 0x1bb7d713], 0x86
mov bl, 0x29
lea esi, [esi - 0x18c8a14c]
mov ebp, 0xbad7a1c7
mov al, 3
invalid
add esi, eax
sar ecx, 0x1a
mov ecx, ebp
lea ebp, [ebp + edx - 0x74f86154]
lea eax, [edx*4 - 0x75ef717c]
mov dword [edx + ebp - 0x74f86150], ecx
jae fcn.019b737d
add byte [ecx + 0x1b], dl
test eax, 0x364c836b
push ecx
sbb ebp, dword [ecx + 0x364c836b]
sbb al, 0xc
xchg esp, eax
adc eax, 0x9b9c2225
mov ah, 0xaa
adc eax, 0x87ba46c6
mov cl, dh
jae 0xfff828
mov al, byte [0x4074f180]
cmpsb byte [esi], byte es:[edi]
jns 0xfff761
xor dl, cl
shl dword [ebx - 0x76], 1
cmpsb byte [esi], byte es:[edi]
sti
or eax, 0xd498b8df
stc
jge 0xfff7a9
mov esp, 0x99128ea7
and ecx, dword [ecx]
pop ecx
sub al, 0x1b
scasd eax, dword es:[edi]
adc al, 0x3e
ret
dec esp
fnstsw word [edx + eax*8 - 0x29]
inc ecx
push esp
mov ch, byte [edx - 0xe9ae247]
mov al, byte [0x99e7356]
nop
cmp ecx, dword [ecx + 0x35]
movsd dword es:[edi], dword [esi]
arpl word [ecx], bp
pushal
push esi
int3
dec edx
xor eax, ebx
sal dl, 0x43
mov dword [esp + ecx - 0x748b733a], ecx
ror eax, 2
inc dword [esp + ecx - 0x748b733a]
xor byte [esp + ecx - 0x748b7338], ch
xchg word [esp + ecx - 0x748b733a], dx
sbb eax, 0x879e6a0f
lea ecx, [ecx + edx*8 - 0x79ef96e1]
xchg dword [esp], edx
and edx, dword [esp + edx - 0x74f869e8]
rol eax, 1
xor ecx, edx
cmovnp ecx, edx
not eax
rol dl, 0xc1
and dword [esp + ecx - 0x74f86128], edx
dec dword [esp + edx - 0x74f86150]
xor ebx, eax
pop ecx
jmp 0xfff788

Function at 0x108ab12
Capabilities:
Encode data using xor

Disassembly:
lea esi, [ecx + esi - 0x789efa3]
xor eax, ebx
shr cx, 0x87
mov dword [esp + ecx - 0x78901df], edx
dec eax
rol eax, 3
shl ecx, 5
sal edx, 3
xchg dword [esp + edx - 0x7fa6e], edx
dec eax
xchg dx, cx
add eax, dword [edi + 0x5921494]
clc
dec dword [eax + 0x66]
xchg edx, ecx
ror eax, 1
shr edx, 0xa2
lea ecx, [edx*2 - 0x72d7a74c]
bswap eax
call fcn.01989c60
pop ecx
rol eax, 2
sub eax, 0x989e7784
ror eax, 1
bswap eax
movzx edx, cl
dec edx
xor eax, 0xaba4bb1
shr ecx, 0x4b
add ecx, ecx
bswap eax
sub edx, edx
rol dl, 0xa1
dec ecx
xor ebx, eax
call fcn.018e1163
xor dword [ebx - 0x1a], 0x68
js 0x108ab2e
invalid

Function at 0x1097e08
Capabilities:
Execute syscall

Disassembly:
rol ecx, 1
xchg edx, eax
pop edx
shr eax, 0xab
sub ecx, 0xc004be16
jmp 0x10002c7

Function at 0x109bc2b
Capabilities:
Execute syscall

Disassembly:
inc ecx
mov ecx, 0x3d29bd32
inc ebp
and ecx, ecx
jae 0xe2d322
sysenter
call fcn.0117aac0
dec ecx
dec esi
dec eax
lea esp, [esp + 0x18]
jne 0xff97ca
mov edx, 0x3816b92a
inc ecx
pop edx
mov edx, 0xae1c4503
movzx esi, dl
not ecx
dec eax
or esi, edx
call fcn.0120fe71
xor ecx, 0x7fb89101
jmp 0x103c6df
Function at 0x1138f77
Capabilities:
Encode data using xor

Disassembly:
mov edi, ebp
push ecx
not cx
mov ebx, dword [esp + 8]
xadd byte [esp + 2], cl
lea edx, [ecx - 0x22ef38e0]
mov ebp, dword [esp + 0xc]
mov dword [esp + 4], ecx
sal edx, 0x5c
sar dx, 0xe6
mov esi, dword [esp + edx - 0x5ffffff0]
mov dword [esp + edx - 0x5ffffff4], 0x9a3044a5
call fcn.01077d27
outsb dx, byte [esi]
out dx, al
shl dword cs:[esi], 0x13
or al, 0x41
adc al, 0x6c
mov cl, 0x8d
fidivr word [esi - 0x70]
imul esi, ebp, 0x69f8eabe
lds esi, [eax + 0x7f3b6741]
and eax, 0x5f66b301
jle 0x113900e
sahf
cmp eax, 0xbaebfed9
out dx, eax
mov byte [0x39f4dc41], al
or byte [ecx + 0x4a], al
das
and ecx, 0x7e
add byte [edx], ah
push esi
mov dl, 0xfb
mov esi, 0xa28346bd
pop edi
shr ecx, 0xa1
jl 0x113901d
sbb eax, 0xc5010630
daa
out dx, eax
and dword [ebx], esp
pushal
idiv bh
adc al, 0x4c
add eax, 0x2ca9aece
das
pushal
sti
or al, 0xff
loop 0x113902e
jmp edx
enter 0xffffffffffff8f5b, 0xfffffffffffffff2
dec esp
movsb byte es:[edi], byte [esi]
push 8
or eax, 0x2684f036
test byte [esi], ah
sub ebx, dword [edi]
jbe 0x1139087
clc
add byte [ecx], 0x51
or dword [edi - 0x2f], edi
xor edx, dword [eax - 0x77441e0d]
mov dl, 0xc8
push edx
mov ebx, 0x52c8b288
jle 0x113902a
lahf
sbb ch, byte [edx - 0x34]
add dword [ebp - 0x30], 0x14
mov esp, 0x7c01ddb8
cmpsb byte [esi], byte es:[edi]
popal
jmp 0x113905a
int 0xf7
invalid
retf 0x2235
loope 0x113907d
fst qword [eax]
xchg ebp, eax
and al, 0xde
idiv byte [edx]
cld
mov eax, 0xec5319dd
xchg ebx, eax
push 0x80a823f2
or byte [eax], 0xe3
test dword [eax + ebx*2], ebx
and dword [ebx], edi
pop ecx
cmp al, 0x4e
push ebx
insb byte es:[edi], dx
and al, 0x11
add dword [esi], esi
out 0x9a, eax
sub dh, al
push edx
push cs
sub al, 0x9a
mov byte [0xf7367c55], al
xchg esi, eax
pop ss
invalid

Function at 0x114d1fb
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xce0acdb5
push eax
sub ebp, 2
mov word [ebp], cx
push eax
sar word [esp + 5], 0xa
sbb dword [esp + 6], eax
mov ecx, dword [esi]
push eax
jl 0x197de92
inc ebp
mov esp, dword [edx]
inc ecx
mov eax, dword [edx + 4]
mov esi, 0xdf04dea0
dec ecx
add edx, 4
dec esp
lea ebp, [esi + 0x2a9fd9be]
dec edx
lea ecx, [ebp*2 + 0x343acdae]
inc esp
and esp, eax
mov ebp, 0x2fa994
inc ecx
not esp
dec eax
lea eax, [ecx*8 + 0x6121449c]
inc ebp
mov dword [edx + ebp*2 - 0x5f5328], esp
inc esp
movzx esi, al
inc ebp
movzx eax, bp
dec esp
add esi, eax
inc esi
mov ecx, dword [ebp + edi - 0x2fa994]
inc ecx
adc ebp, esi
dec ebp
lea esp, [ebp + 0x3614ef3e]
jne 0x124cad4
dec edi
lea edi, [eax + edi - 0xb85a]
inc esp
xor ecx, edi
inc ecx
neg ecx
inc ecx
movzx edx, bp
dec ecx
rol esp, 5
inc ecx
and cl, ch
inc ecx
bswap ecx
inc ecx
shr ah, 0x43
inc ebp
add al, ah
jg 0x10eaa28
Function at 0x117a1aa
Capabilities:
Encode data using xor

Disassembly:
inc ecx
shr cl, 7
inc ecx
pop esp
pop ecx
inc ecx
pop esp
jnp fcn.00e7cea8

Function at 0x1182b63
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xb6842e3e
add ebp, 4
xor ecx, ebx
ror ecx, 3
add ecx, 0xe9bfab05
push 0x602ea123
push 0xb983dd19
bswap ecx
mov edx, 0x6855115
lea eax, [edx + 0x753fd686]
inc ecx
xor ebx, ecx
or dx, 0xd1b1
rol dx, 0xa7
adc edi, ecx
call fcn.0107dc10
inc ecx
not ebp
jmp 0x19e24de
and dx, 0x86b8
push edi
inc cx
not esp
dec edx
lea edi, [eax*2 - 0x8607f6f]
inc esp
xor dword [esp + esi - 0xb3], ebp
inc ebp
xor esi, esi
pop edi
je 0x114a9f3

Function at 0x1188f32
Capabilities:
Encode data using xor

Disassembly:
rol eax, 0x6b
not ecx
or eax, 0xd08a99a
neg eax
bswap ecx
xor ebx, ecx
shr al, 0x86
sbb al, ah
mov dword [esp + eax - 0x523254ac], 0x922e0da7
add ebp, ecx
mov ecx, dword [eax + esi - 0x523254ac]
mov eax, dword [esi + eax - 0x523254a8]
call fcn.00fb71df
dec esi
jecxz 0x1188f3c
cmp bh, byte [eax]
lodsb al, byte [esi]
invalid

Function at 0x11e60ad
Capabilities:
Execute syscall

Disassembly:
bswap ecx
mov edx, dword [esp + edx - 4]
call fcn.0195a80e

Function at 0x11f5be5
Capabilities:
Encode data using xor

Disassembly:
dec ecx
lea ecx, [esp - 0x785553db]
dec ebp
adc ebx, esi
inc ecx
ror esp, cl
inc edx
sub dword [esp - 0xa36602], edx
inc bp
movzx esi, byte [edx + esi*8 - 0x18]
inc eax
movsx eax, dh
inc ecx
mov al, byte [edx + esi*2 - 4]
sbb byte [esp + esi], 0xb9
inc esp
movsx eax, ch
jns 0xf63be6
dec ecx
mov esp, edx
mov esi, 0xe03d3b1f
call fcn.0105d7dd
mov ecx, 0x78b7aa31
lea esi, [ecx + esi - 0x78b7aa35]
movsx eax, cl
xor eax, eax
mov edx, dword [esi + eax*4]
xor edx, ebx
jmp 0x19b8f0a
dec eax
mov dword [esp + ebx*4 - 0x6ea0], ebx
inc esp
xor dword [esp + esi + 5], esi
dec eax
mov edi, dword [esp + esi*2 + 2]
dec eax
shl ebx, 0xae
dec ecx
lea ebp, [esp + esi*8 - 0x1f6e29e3]
dec ebp
arpl si, si
dec eax
mov dword [esp + esi + 5], 0x2f00f608
ja 0xf4ada3
mov edx, 0xf2b9b3b9
mov ecx, dword [edi]
call fcn.00e742f1
pushfd
add dword [esp + 4], 0xff0a3599
call fcn.0129febb
inc ecx
inc esi
inc ecx
neg esi
inc ecx
not esi
dec eax
mov dword [esp + 8], 0x53a7e439
shr esi, 0xfe
dec eax
mov dword [esp + esi*8 - 0x10], edi
movsx ebx, dx
jns 0x111e6e4
not edx
sub eax, 0xc2b45889
inc edx
rol edx, 3
jmp 0xfee368
dec edx
shl al, 0xc4
add ecx, eax
jns 0x1221ce5
Function at 0x11f70d7
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x1087252
sub esi, 2
mov word [esi], cx
sar al, 0xc6
call fcn.00fac123
xor ecx, ebx
sar dword [esp + edx - 0x79ef994], 0x6b
mov dword [esp + edx - 0x79ef998], edx
not ecx
mov eax, edx
or dl, al
jnp 0xedd8fb
clc
test esi, esi
jmp 0x19c85b6
xor ecx, 0xde1e5285
and word [esp + edx*2 - 0xf3df32a], 0x5f26
not ecx
sbb ecx, 0xa4a08eaf
xor ebx, ecx
rol word [esp + edx - 0x79ef996], 0xcf
rol eax, 0xed
add ebp, ecx
push edx
and dword [esp + edx*8 - 0x3cf7ccb9], edx
mov dword [esp + edx*2 - 0xf3df330], ebp
ret 8
not ecx
xor bl, dl
mov dword [esp + ecx*4 - 0x3fff8], eax
sal eax, 0x45
lea edx, [esp + edx + 4]
mov cx, word [edx + ecx - 0xfffe]
js 0xe7802a
mov dx, word [ebp + eax - 0x6780c900]
mov ax, word [eax + ebp - 0x6780c8fe]
or cx, word [esp + 1]
adc cl, byte [ebp + 4]
push 0xbb83bd38
add ebp, 4
shld dx, ax, cl
mov word [ebp], dx
mov edx, 0x4311b497
mov eax, dword [esp + edx - 0x4311b495]
mov dword [esp + eax - 0xbb83], esi
ret 4
je 0xe30441
mov eax, 0x5a4d
test bp, ax
cmp word [edx], ax
jmp 0xe3043b

Function at 0x11fb77a
Capabilities:
Encode data using xor

Disassembly:
not eax
dec eax
lea esi, [ebx + edx*2 + 0x732897a5]
dec eax
mov dword [esp + ebx - 0x50923f94], ebx
sub eax, 0x5a1e4302
xor eax, 0x79146811
dec eax
dec dword [esp + ebx - 0x50923f8d]
dec eax
mov dword [esp + ebx - 0x50923f84], edi
dec eax
xor dword [esp + ebx - 0x50923f8c], ebx
xor dword [esp + ebx - 0x50923f84], eax
dec eax
mov edi, dword [esp + ebx - 0x50923f84]
sal edx, 0xa1
dec ebp
lea edx, [edx + edx - 0x56066122]
pop ecx
dec eax
mov dword [esp + edx - 0x56066116], 0x3933d3b
pop ebx
inc ecx
mov dword [edx + edx - 0x5606611e], eax
inc esp
movsx eax, cl
inc cx
or eax, 0x8b42fc37
invalid

Function at 0x1208925
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, dh
dec edx
lea ecx, [ecx + eax - 0x757d583b]
call fcn.0194d21d
Function at 0x1244ccf
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov dword [esp + 4], 0x3017de4c
lea esp, [esp + 4]
call fcn.01926aca
mov eax, 0xdd00b6b0
mov ecx, eax
mov ecx, ebp
call fcn.0114d1fb
outsb dx, byte [esi]
rol dword ss:[ecx], cl
clc
inc ebx
sub dh, dh
adc ecx, esi
pop ds
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]

Function at 0x1246d51
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ebx
bswap ecx
rol edx, 0xd8
inc ecx
and dword [esp], 0xa193281e
not byte [esp]
neg ecx
bswap ecx
xor ebx, ecx
add edi, ecx
push eax
pop edx
movzx edx, byte [ebp]
call fcn.019759b6
ror eax, 2
mov dword [esp], 0xa304a793
lea edx, [edx + edx*2 - 0x7c400c6b]
lea eax, [eax + ecx - 0x15d12b67]
call fcn.012a4136
mov ecx, ebp
mov edx, 0x70b152ba
movzx eax, dx
lea ebp, [edx + ebp - 0x70b152be]
call fcn.010288c6
pushal
and al, dh
and al, 0xf7
push esp
xor eax, esp
popal
mov ecx, dword [ebp]
mov eax, 0x81345327
push eax
add ebp, 4
lea edx, [eax + eax*2 + 0x1b86423]
mov byte [esp], dl
jmp 0x11f6fd0

Function at 0x1266089
Capabilities:
Authenticate hmac

Disassembly:
movzx ecx, dx
xor al, bl
sar ecx, cl
neg cx
dec al
mov dword [esp + edx - 0x1cb162e9], ecx
pop edx
rol al, 1
call fcn.0112f66f

Function at 0x126aa42
Capabilities:
Encode data using xor

Disassembly:
xor ebx, ecx
add ebp, ecx
lea edx, [eax*4 + 0x14382db4]
or dword [esp + edx - 0x12612ec0], edx
mov dword [esp + edx - 0x12612ec0], ebp
ret
sar edx, 3
sub ecx, 0xa71fa4b4
xor ecx, 0xf99484be
add edx, 0x30930c32
jg 0x104145f
add esi, 4
shrd ax, dx, cl
mov word [esi], ax
mov ecx, dword [edi]
mov edx, 0x47b7e199
lea edi, [edi + edx - 0x47b7e195]
mov dword [esp + edx - 0x47b7e199], edx
xor ecx, ebx
and word [esp + edx - 0x47b7e198], dx
mov eax, 0x3f8a4002
neg dword [esp + edx - 0x47b7e199]
bswap ecx
adc al, ah
sub edx, edx
xadd dword [esp + eax*2 - 0x7f148086], edx
xor ecx, 0xb63cc882
not ecx
jmp 0x199d3e1
jmp 0x10c499a

Function at 0x126ee77
Capabilities:
Encode data using base64

Disassembly:
mov al, byte [esi + eax - 0x32]
neg cl
dec dl
neg ecx
sub eax, ecx
mov dword [esp + ecx - 0x736735bd], 0x903bc23b
not dl
cmovg ax, word [esp + ecx - 0x736735bc]
xor eax, eax
sbb ecx, 0x12888325
xor bl, dl
sal ax, 4
push eax
lea edx, [esp + edx + 8]
js 0x10aa075
push ecx
push eax
or eax, dword [edx + eax*2]
lea ebp, [ebp + ecx - 0x60deb29c]
mov dword [ebp + ecx - 0x60deb298], eax
mov eax, ecx
lea edi, [ecx + edi - 0x60deb29c]
rol eax, 0xdf
or ax, cx
mov edx, dword [ecx + edi - 0x60deb298]
push ecx
ror ecx, 0xf7
add dword [esp + eax - 0x306ffbcf], 0x558f6123
xor edx, ebx
call fcn.019994f4

Function at 0x126ef35
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub dl, 0x8a
or word [esp + ecx + 6], cx
adc edi, eax
push ecx
shr ecx, 0xbb
call fcn.019d8f62
Function at 0x18ee0d3
Capabilities:
Encode data using xor

Disassembly:
add ebp, 4
shrd ax, dx, cl
mov word [ebp], ax
mov edx, dword [esp]
pop eax
jmp edi
xadd cl, dl
jbe fcn.010c5948
rcl cl, 0xf
xchg byte [eax], bl
add al, 0
not ecx
bswap eax
lea ecx, [ecx + eax*2 - 0x78829a40]
push eax
movzx edx, ax
ror ecx, 1
and dword [esp + edx*8 - 0x321a8], 0x1cb71522
or dword [esp + edx - 0x6435], 0x1323752d
xor ebx, ecx
ror dword [esp + edx - 0x6435], 0xec
setae byte [esp + edx*4 - 0x190d4]
pop eax
adc edi, ecx
movsx ecx, dx
mov ax, word [eax + ebp - 0x52d17201]
add edx, ecx
neg ecx
mov dx, word [ebp + edx - 0xc868]
mov cl, byte [ebp + 4]
call fcn.012a51e7
jbe 0x124a008
wait
invalid
jbe 0x1077924
push ecx
push 0xffffffffffffffe4
jmp 0x107794c
xchg ecx, eax
test dword [ecx + 0x22], 0x14d1cf8d
mov al, byte [0x148d2da5]
push 0x221766e7
movsb byte es:[edi], byte [esi]
inc esp
adc al, 0xa0
movsd dword es:[edi], dword [esi]
sub eax, 0xe768148d
pop ss
and ah, byte [esp + eax*2 - 0x5ca1583]
invalid
jge 0x109a8d0
xor eax, 0x2758efa
xor edx, ebp
rcl dword [ebx - 0x6a], cl
cmp ebp, dword [edx - 0x7fcf8c30]
sbb esp, ecx
jge 0x109a8d7
inc bh
cmp esi, dword [ebp + 0x53]
jmp dword [esi - 0x6a]
rol edx, 0x81
mov esi, dword [esi + ecx*2 - 0x5600c180]
jb 0x1077923
pop ebx
and ah, byte [esi]
cmp eax, 0xf0abec93
mov edi, 0x11c6a8ab
jo 0x109a8e4
in al, dx
inc edx
invalid
xor ebx, edx
add edi, edx
lea edx, [eax + ecx*2 + 0x283121a]
sal ax, 0xa1
mov ax, word [edx + ebp - 0x18c4ef31]
push ecx
inc dword [esp + edx*2 - 0x3189de62]
mov dx, word [ebp + edx - 0x18c4ef2f]
mov cl, byte [ebp + 4]
jb 0xfbdaff
mov dword [esp + ecx - 0x4307c4a4], ecx
neg ecx
neg eax
lea edx, [ecx*2 + 0x6e08253a]
inc edx
lea eax, [ecx + eax - 0x57db4f38]
push edx
xadd dword [esp + 4], ecx
sal edx, 0x61
bswap eax
pop edx
sar byte [esp + ecx - 0x4307c4a4], cl
sub dword [esp + ecx - 0x4307c4a4], 0x3cad08b3
lea eax, [eax + ecx - 0x65c79f32]
dec edx
xadd ecx, edx
xor ebx, eax
pop edx
shl cl, 0xe5
cmovb cx, dx
adc ebp, eax
rol dx, 0xb
jae 0x109a912
call fcn.00f3ba7a
mov edx, ecx
or edx, edx
adc ebp, eax
movzx eax, cx
jmp fcn.018e6230

Function at 0x18f2cf2
Capabilities:
Encode data using xor

Disassembly:
dec eax
xor ebx, eax
add edx, ecx
lea edx, [ecx + edx + 0xda6e198]
add ebp, eax
mov edx, dword [edi]
lea ecx, [ecx*8 + 0x27ac1b37]
mov eax, dword [edi + 4]
shl ecx, 0xcc
rol ecx, 0xf3
neg ecx
mov cl, byte [edi + ecx - 0x7ff857c1]
jg 0xf32c36
movsx edx, cl
xor eax, 0x3a1d4f05
inc cl
lea eax, [eax + ecx*2 + 0x57687467]
lea ecx, [ecx - 0x5b65916c]
call fcn.00f89454
call fcn.00fbc6dd
rol eax, 3
mov ecx, 0x582166a7
lea edx, [ecx + ecx*2 - 0x52c1bfef]
ror dl, 0xc6
lea eax, [eax + ecx + 0x529b8f09]
xchg cx, dx
ror eax, 1
xchg ecx, edx
bswap eax
sub dx, 0xda0c
jge 0x11e1fef
mov eax, ecx
lea ecx, [eax + edx*8 + 0x51aa209b]
mov esi, dword [ecx + esi - 0x14921a0b]
sar cl, 0x66
lea eax, [edx*8 + 0x590d84a8]
jbe fcn.0107e126
mov edx, dword [esi]
push 0xc7be4838
add esi, 4
call fcn.0190c316
Function at 0x18f3d06
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ebx, ecx
and eax, eax
jp 0x1955db8
or al, al
lea ecx, [ecx + eax*2 + 0x443554d0]
mov dword [esp + edx - 0x566337fe], 0x77a8b526
xor edx, edx
ror ecx, 3
inc ecx
sal eax, 0xb5
push eax
shl dword [esp + edx + 4], 0x26
xor ecx, 0x9988e15
xchg word [esp + edx + 1], dx
neg ecx
xor word [esp + edx*4 - 0x1fffe], ax
inc ecx
jmp 0x18ea8b8
inc ax
adc ebp, ecx
pop edx
pop edx
pop edx
jmp fcn.018e6230
Function at 0x193dd16
Capabilities:
Encode data using xor

Disassembly:
ror byte [esp + ecx - 0x66260003], 0xc5
neg eax
xadd cl, dl
mov dword [esp + ecx - 0x66260008], edx
dec dword [esp + ecx - 0x66260004]
xor ebx, eax
and cx, word [esp + edx - 0xce002]
adc dword [esp + edx*8 - 0x67003c], edx
push ecx
adc ebp, eax
call fcn.01032d1c
mov dx, word [ecx]
mov dword [esp + 8], 0x7d1505b5
sub esi, 2
shl word [esp + 0xc], 0xe9
mov ecx, 0x2f94c584
mov word [esi + ecx - 0x2f94c584], dx
mov eax, 0x671f0927
call fcn.00f637f3

Function at 0x1949475
Capabilities:
Encode data using xor

Disassembly:
add ebp, 6
call fcn.0195aaa2
mov edx, 0x8e24969b
mov eax, edx
mov edx, dword [esi]
add ax, ax
mov cl, byte [esi + 4]
add esi, 2
shr edx, cl
mov dword [esi], edx
lea edx, [eax*4 - 0xdea346f]
movsx ecx, dx
lea edi, [edi + edx*2 - 0x554d00d6]
mov ecx, dword [edi + edx - 0x2aa68069]
xor ecx, ebx
rol eax, 0x28
neg edx
ror ecx, 2
neg edx
inc ecx
bswap ecx
lea ecx, [ecx + eax*4 + 0x66779f7e]
xor ebx, ecx
add ebp, ecx
jmp 0x10b7899

Function at 0x1950c39
Capabilities:
Execute syscall

Disassembly:
not edx
mov dword [ebp], edx
sub esi, 4
mov eax, 0x480fdf34
mov edx, dword [esi + eax - 0x480fdf34]
xor edx, ebx
mov dword [esp + eax - 0x480fdf34], eax
call fcn.019c05d0
sysenter
call fcn.00f0f399

Function at 0x195a0f0
Capabilities:
Execute syscall

Disassembly:
xor edx, 0x14bbf4b1
xadd eax, ecx
ror eax, cl
ror edx, 1
not al
pop ecx
movsx ecx, ax
xor ebx, edx
call fcn.019db317

Function at 0x1975f18
Capabilities:
Encode data using xor

Disassembly:
movzx ebx, byte [ecx]
push 0xb8bdb7a7
jmp 0x1996806
jg 0xf9af41
xor bx, ax
not dl
lea ecx, [ecx + edx*2 - 0x2854f9e4]
lea edi, [edi + ecx - 0x18d41678]
dec dx
mov word [ecx + edi - 0x18d41676], ax
lea esi, [esi + ecx*2 - 0x31a82cf0]
jne 0x112007b
xor ecx, ebx
xadd edx, eax
sbb ecx, 0xa9b54b31
dec ax
jg 0xe31fa6
or cl, al
add bh, al
mov edi, 0xf7dd025b
xor dl, bh
invalid
movsx eax, dx
jns 0x11d42be
and ebx, 0xff
mov ebx, dword [ebx*4 + 0xe384f8]
shr edx, 8
xor edx, ebx
inc ecx
xor edx, 0x238a3d96
jmp 0x1907d66
mov ecx, dword [ecx + esi - 0x18d41676]
not ax
jg 0xf907dd
add edi, ecx
xor word [esp + 0xa], dx
shl dword [esp + 2], 0x31
lea eax, [edx + edx*8 + 0x3fa3318e]
mov eax, ebp
sal dl, 0x21
sbb ebp, 2
lea edx, [edx - 0x1641a562]
movsx ecx, dl
mov word [ebp], ax
call fcn.019c84a9
dec eax
push 0x343afd27
lea esp, [esp + 8]
jne 0xe317eb
call fcn.01123336
rol ax, 1
shl cl, 0x66
sbb dx, 0x481d
inc ax
pop edx
movsx edx, cx
or ecx, ecx
ror ax, 1
pop ecx
dec ax
inc ecx
xor edx, ecx
jae 0xf70866
shr word [esp + 2], 0x8b
xor ebx, edx
jmp 0x1120084

Function at 0x19e2502
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor bl, dl
lea edx, [esp + edx + 0x10]
mov cx, word [edx + eax*2]
lea esi, [esi + eax*8 - 2]
mov word [esi + eax*8], cx
sal ax, 0xa
call fcn.00e5b804
add ebp, ecx
mov eax, edi
movsx ecx, dl
lea edi, [edx + edi - 0x120002]
shl dl, 0xc3
mov word [edi + edx - 0x120000], ax
movzx eax, dl
add cx, cx
jle fcn.018e6230
mov edx, 0x80924c1c
inc ecx
mov eax, dword [edi]
call fcn.00e3cff7
Function at 0x19e483a
Capabilities:
Encode data using xor

Disassembly:
shr byte [esp + 4], 0xa7
xor eax, 0x1c81ed3a
push ecx
ror eax, 2
movzx esi, cx
bswap eax
or dword [esp + esi - 0x6f09], 0xc73ede93
cmovo si, word [esp + esi - 0x6f04]
push ecx
ror eax, 1
inc esp
movsx esp, byte [esp + esi*2 - 0xde16]
xor eax, 0x168df79d
jmp 0x19b74c2
mov ebx, 0x61051a1a
xor eax, 0xa7182612
dec eax
or dword [esp + esi*2 - 0xde12], edi
push ecx
xor dword [esp + esi - 0x6ef9], eax
inc ebp
movsx esi, sp
inc ecx
pop esi
dec eax
mov edi, dword [esp + esi*2 - 0xde12]
dec eax
arpl ax, ax
dec esp
add ebx, eax
inc ecx
sal esp, cl
inc ecx
mov ebp, 0xf0be84b9
inc ecx
or dh, 0xb
pop ebx
pop esi
pop ecx
jg fcn.00e7cea8
dec esi
and dword [esp + 0xe], esp
inc eax
jmp 0x1208879
inc ebp
mov dword [edx], esi
dec eax
mov dword [esp], 0x58b5ebc
dec eax
lea eax, [ecx + eax*4 - 0x106498eb]
inc ecx
mov eax, dword [edi]
dec ecx
add edi, 4
xor eax, edi
jmp 0xe5f636

Function at 0x19e4a95
Capabilities:
Encode data using xor

Disassembly:
lea edx, [eax + eax*2 - 0x19e7a473]
ror dword [esp + eax*8 + 5], 0x81
movzx ecx, byte [edi + eax*8]
lea edi, [edi + eax*2 + 1]
inc edx
xor cl, bl
call fcn.0103bcd9
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x58fc7cb3
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x31d144ca
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
jmp 0x431219