joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465b10
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5040ec]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x465b23
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x465b64
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x504194]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x465b96
mov bl, byte [esp + ecx + 0x4c]
jmp 0x465b9a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x465b8b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x465bb8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x465bbc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x465bad
xor ecx, ecx
mov eax, 0x5040fc
xor ebx, ebx
mov bl, byte [ecx + 0x5041a4]
cmp byte [esp + ebx + 0x14], 0
je 0x465be7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5041bc]
cmp byte [esp + ebx + 0x14], 0
je 0x465bfe
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x465bce
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x465b57
lea edx, [esp + 0x84]
push edx
call fcn.00465c40
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x477754
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x47f2d4
call fcn.0046a660
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0047d1f8
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x477793
call fcn.0047d1f8
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4777a1
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4777af
or eax, 0xffffffff
jmp 0x477897
mov ecx, esi
call fcn.004776ca
mov dword [ebp - 0x14], eax
call fcn.004786c0
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x4777e6
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4777e6
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.00478674
push dword [ebp - 0x14]
call fcn.004781a6
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00477462
cmp eax, edi
je 0x477859
test byte [esi + 0x24], 0x10
je 0x477827
push 4
mov ecx, esi
pop ebx
call fcn.00477ba6
test ah, 1
je 0x47781f
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0047a1d0
cmp dword [esi + 0x1c], edi
je 0x477859
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00477bda
jmp 0x477859
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x47786d
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x477886
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x477886
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.00477704
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x47a07e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47a0c0
call fcn.0047d1f8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47a0c0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47a0b7
xor eax, eax
jmp 0x47a0c8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047a0ce
pop edi
pop esi
pop ebx
ret 4
Function at 0x47d6f1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47d71f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47d73d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047d657
jmp 0x47d73d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47d73d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047d657
test edi, edi
mov eax, edi
jne 0x47d727
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405646
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x405655
pop dword [ebp - 0x34]
mov eax, 0x381b59e3
sub eax, 0x37db038e
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xea9e7502
add dword [ebp - 0x44], 0x63b3d049
mov dword [ebp - 0x40], 0x2961245c
sub dword [ebp - 0x40], 0xf72dd817
mov dword [ebp - 0x3c], 0x510ba7be
add dword [ebp - 0x3c], 0xfb409c70
mov dword [ebp - 0x38], 0x176d1808
add dword [ebp - 0x38], 0xe892e7f8
lea eax, [ebp - 0x44]
push eax
mov eax, 0x1244ec6
sub eax, 0xe3dd82
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x6e117f74
add dword [ebp - 0x44], 0x660e9e2
mov dword [ebp - 0x40], 0x66508964
sub dword [ebp - 0x40], 0x24e427ef
mov dword [ebp - 0x3c], 0x47cd5c02
add dword [ebp - 0x3c], 0x1ba2106a
mov dword [ebp - 0x38], 0xb388aa67
add dword [ebp - 0x38], 0x4c775599
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3afc7
push 0
call eax
mov ecx, 0xfcf71838
sub ecx, 0xfcf6bff4
mov ebx, eax
mov esi, 0x436000
add esi, dword [ebp - 0x34]
mov edi, 0x2857403f
mov edx, dword [esi]
xor dword [ebp - 0x30], eax
xor edx, edi
mov dword [ebx], edx
xor dword [ebp - 0x30], eax
add ebx, 4
add esi, 0xbf2d203a
add esi, 0x40d2dfca
loop 0x405766
add eax, 0x153e3
mov ebx, eax
add eax, 0x8484cd1c
sub eax, 0x8484cd17
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x4058f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421968
push esi
call fcn.00405d21
push esi
call fcn.004058a8
mov edi, eax
test edi, edi
jne 0x405916
xor eax, eax
jmp 0x405968
push edi
call fcn.00405f83
test byte [0x423f78], 0x80
je 0x40592f
mov al, byte [edi]
test al, al
je 0x405912
cmp al, 0x5c
je 0x405912
sub edi, esi
jmp 0x405947
call fcn.0040601c
test eax, eax
je 0x405941
test byte [eax], 0x10
je 0x405912
push esi
call fcn.0040585b
push esi
call sub.kernel32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405933
call fcn.00405814
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4059d9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4059f5
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
ret 4

Function at 0x4059f8
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileA]
ret 0xc
Function at 0x88e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0088e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88e06a
add dl, dl
jne 0x88e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88e0dc
xor eax, eax
add dl, dl
jne 0x88e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88e17d
add dl, dl
jne 0x88e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x88e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x88e075
mov eax, 1
add dl, dl
jne 0x88e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88e0e1
sub eax, ebx
mov ebx, 1
jne 0x88e128
mov ecx, 1
add dl, dl
jne 0x88e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88e136
cmp eax, 0x7d00
jae 0x88e16d
cmp eax, 0x500
jb 0x88e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88e075
cmp eax, 0x7f
ja 0x88e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x88e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x402d20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x60
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
push esi
push esi
push 0x407360
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.GDI32.dll_CreateDCA]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebp, eax
push 0xe
push ebp
call ebx
push 0xc
push ebp
mov edi, eax
call ebx
imul edi, eax
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp edi, 1
jg 0x402d69
mov edi, 1
jmp 0x402d85
cmp edi, 4
jg 0x402d75
mov edi, 4
jmp 0x402d85
xor eax, eax
cmp edi, 8
setg al
dec eax
and al, 0xf0
add eax, 0x18
mov edi, eax
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0x30]
push ecx
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov edx, dword [esp + 0x34]
mov eax, edi
and eax, 0xffff
mov dword [esp + 0x4c], edx
imul eax, edx
add eax, 0x1f
mov ecx, dword [esp + 0x38]
cdq
and edx, 0x1f
mov dword [esp + 0x48], 0x28
add eax, edx
mov dword [esp + 0x50], ecx
mov ebx, eax
mov word [esp + 0x54], 1
sar ebx, 5
imul ebx, ecx
shl ebx, 2
mov word [esp + 0x56], di
mov dword [esp + 0x58], esi
lea eax, [ebx + 0x28]
mov dword [esp + 0x5c], esi
push eax
push 0x42
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x70], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, 0xa
lea esi, [esp + 0x48]
mov edi, eax
push 0xf
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, eax
test esi, esi
je 0x402e46
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
push 0
push esi
push ebp
call dword [sym.imp.GDI32.dll_SelectPalette]
push ebp
mov esi, eax
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x402e4a
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x74]
push 0
lea ecx, [edi + 0x28]
push edi
push ecx
push edx
push 0
push eax
push ebp
call dword [sym.imp.GDI32.dll_GetDIBits]
test esi, esi
je 0x402e86
push 1
push esi
push ebp
call dword [sym.imp.GDI32.dll_SelectPalette]
push ebp
call dword [sym.imp.GDI32.dll_RealizePalette]
push ebp
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x78]
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402eb4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60
ret
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
lea edx, [esp + 0x10]
mov word [esp + 0x26], ax
mov word [esp + 0x28], ax
push eax
push edx
lea eax, [esp + 0x28]
push 0xe
add ebx, 0x36
push eax
push esi
mov word [esp + 0x34], 0x4d42
mov dword [esp + 0x36], ebx
mov dword [esp + 0x3e], 0x36
call ebp
lea ecx, [esp + 0x10]
push 0
push ecx
push ebx
push edi
push esi
call ebp
mov edi, dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x60
ret
Function at 0x403710
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1004
call fcn.00404030
push esi
push edi
xor esi, esi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push 0x1000
push edx
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x403792
test dword [esp + 8], 0xfffffffc
jbe 0x403792
push ebx
mov ebx, dword [esp + 0x101c]
push ebp
mov ebp, dword [esp + 0x101c]
lea edi, [esp + 0x14]
mov eax, dword [esp + 0x1018]
mov ecx, dword [edi]
push ebx
push ebp
push eax
push ecx
call fcn.004037a0
mov edx, dword [esp + 0x20]
add esp, 0x10
inc esi
add edi, 4
shr edx, 2
cmp esi, edx
jb 0x40376c
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1004
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x512f5833
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3e581683
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x103b30b8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103b30c2
pushal
call 0x103b30c8
pop ebp
sub ebp, 0x10
sub ebp, 0x3b30b8
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103b30ec
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103b30f5
mov eax, 0x3b30b8
add eax, ebp
add eax, 0x63
mov ecx, 0x5f3
mov edx, 0x9c5bd920
xor byte [eax], dl
inc eax
dec ecx
jne 0x103b310c
jmp 0x103b311f
stosd dword es:[edi], eax
in eax, dx
stosd dword es:[edi], eax
test eax, 0x2020201c
mov eax, dword [0x2020d8e1]
and byte [ebx], ah
in eax, dx
cwde
and al, 0x20
and byte [eax], ah
lcall 0xc2d7, 0x20202008
and ebp, eax
stosd dword es:[edi], eax
mov eax, dword [0x2020202c]
and esp, ebp
lodsd eax, dword [esi]
inc esp
add al, 0xdc
test eax, 0x48700424
jo 0x103b31ae
and byte cs:[eax + 0x46], cl
xchg edx, eax
or al, 0x20
and dword [esp + eax], ecx
dec eax
jne 0x103b317f
aas
enter 0x2025, 0x20
and cl, cl
adc byte [eax], ah
and byte [eax], ah
lodsd eax, dword [esi]
inc esp
add al, 0xdc
test eax, 0x4cad040c
add al, 0x20
stosd dword es:[edi], eax
movsd dword es:[edi], dword [esi]
sub byte [eax], ah
and byte [eax], ah
stosd dword es:[edi], eax
mov ch, 0x2c
and byte [eax], ah
and byte [ebx + 0x202030ad], ch
and cl, ah
leave
and dl, byte [ecx]
and ah, byte [ebx + 0x2f6924e2]
movsd dword es:[edi], dword [esi]
aam 0xdf
invalid
inc esp
add al, 0xdc
test eax, 0x25c8042c
and byte [eax], ah
and cl, cl
sbb dword [edx], esp
and byte [eax], ah
lodsd eax, dword [esi]
inc esp
add al, 0xdc
test eax, 0xccab040c
fist word [ebp + 0x2c]
fist word [ebp + 0x28]
enter 0x2046, 0x20
and byte [ebx + 0x2020289d], ch
and byte [ebx], dl
jmp 0xd8df23f1
Function at 0x1000cd20
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
nop
fnstcw word [ebp + 1]
adc dh, byte [eax + 0x31bc5d7e]
and dl, byte [ecx + 0x21fdb5c8]
enter 0xfffffffffffffdb5, 0x21
add eax, dword [ecx - 0x7127368a]
inc ebp
jg 0x1000cceb
in al, dx
test eax, 0x34dad2fd
mov ebp, dword [ebp + 0x44ce9da1]
adc cl, bh
inc ecx
and byte [edx], al
aas
daa
pop eax
invalid
popfd
pop esi
lea ecx, [eax + 0x73]
jae 0x1000cd81
jae 0x1000cd81
jne 0x1000cce9
xor al, 0x62
mov esp, 0xfd6c7031
xor dword [eax + 0x6c], esi
std
ror dword [edi + 0x2c9cf4d3], 0xd4
xlatb
jnp 0x1000cd1b
xlatb
jns 0x1000ccf7
mov es, eax
adc dh, al
push es
adc eax, dword [edx]
mov esi, 0x981e3ff1
xlatb
ret
push es
invalid
mov ch, 0xc9
nop
jecxz 0x1000cd6c
add eax, 0x83b587d7
fisub dword [ecx - 0x1b]
dec esp
or eax, 0xb25d7bea
sbb dword [ebp - 0x58061f04], esp
jg 0x1000cd27
mov eax, ss
test eax, 0x10e5cefb
into
in eax, 0x10
mov dword [esi + esi*2 + 0x78fc44f6], ecx
aad 0xb6
insb byte es:[edi], dx
cld
js 0x1000cd5e
mov dh, 0x6c
pop ds
je 0x1000cd7e
idiv byte [ebx + 0x5d754df7]
test eax, 0x52a39ebb
int1
ja 0x1000ce16
jg 0x1000cdc5
mov edx, 0x3fb3ec1e
xchg edx, eax
and dword [ebx], 0xffffffd0
test dword [edi + ecx*8 - 0x6bc63eea], 0x3c417cb2
xchg edx, eax
jge 0x1000cdb9
aam 0xde
adc dword [edx + 0x103252cb], 0x59
mov byte [0x103252cb], al
pop ecx
iretd
or byte [ebx - 8], ah
and dword [ebp - 0x6d85c01e], 0xffffffac
loop 0x1000ce06
jp 0x1000cd5b
lodsb al, byte [esi]
arpl cx, si
mov dword [0xf1e9b8d1], eax
popal
jb 0x1000ce1b
jl 0x1000cdc0
jno 0x1000cd94
sub ebp, dword [eax + ebx + 0x189858f3]
out 0, eax
int1
mov dh, 0xda
jb 0x1000ce55
call 0x9ec1873
push ds
sbb byte [edi - 0x6e06589b], 0x94
xor eax, 0x4fbff5ee
push es
cmovns edi, edx
xor al, 0xb1
jge 0x1000cd86
push ss
int1
jp 0x1000ce2b
mov ch, 0x45
inc ebp
wait
imul ebx, eax, 0xdd030da0
inc edx
invalid
Function at 0x10012c30
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
dec edx
sahf
add eax, 0x80679f23
pop edi
dec edx
xor al, 0xdc
xor esp, ecx
stosd dword es:[edi], eax
cmc
xchg esp, eax
jbe 0x10012c0f
mov cl, 0x99
lea ebp, [eax - 0x5d]
xchg edi, eax
or eax, 0x1251a279
insb byte es:[edi], dx
jo 0x10012c48
adc al, bl
lodsb al, byte [esi]
pop ss
xchg edi, eax
push ebx
jb 0x10012c7e
mov ecx, dword [ecx + 0x27]
mov esp, 0xa87cd304
js 0x10012bf8
jae 0x10012c99
sbb dl, byte [eax + 0x186c72d1]
movsd dword es:[edi], dword [esi]
shl dword [esi], 0xaa
stosb byte es:[edi], al
xlatb
adc dword [ebx], 0xd0e8363a
xor al, byte [esi]
mov edx, 0x84ce8a95
adc bl, bh
adc edi, dword [edx]
call 0xca075f20
xchg ebp, eax
mov cl, dh
test byte [eax], dl
sti
popfd
or esp, dword [ebp - 0x75]
dec ecx
jp 0x10012bfb
dec edi
jl 0x10012ca2
js 0x10012c68
mov bh, byte [ebx + 0x13]
dec edx
mov dl, 0xf6
mov cl, 0xa7
or al, 0x52
jnp 0x10012c10
adc byte [ecx + edx], 0x6e
out dx, eax
jecxz 0x10012c62
daa
mov esi, esp
pop ecx
imul esp, dword [edi + 0x3c], 0x3ec6a3ab
inc edi
push esp
mov cs, eax
dec ecx
cld
xchg edx, eax
stosd dword es:[edi], eax
mov edi, 0x99f370b6
jo 0x10012c51
invalid
cmp al, 0xc0
mov ah, 0x65
jns 0x10012c44
mov ecx, dword [eax - 0x5b6e7b49]
mov ecx, 0x6d335c88
cmpsd dword [esi], dword es:[edi]
test byte [ecx + 0x5c88b9a4], dl
xor ebp, dword [ebp - 0x59]
jl 0x10012c2b
dec edi
fild qword [edx - 0x5b1cbb2b]
fsubr qword [ebx - 0x4561437a]
stosd dword es:[edi], eax
xchg ch, dl
xchg ebx, eax
into
lodsd eax, dword [esi]
out dx, al
cmp byte [edx], al
out 0xe8, eax
invalid
Function at 0x100147d0
Capabilities:
Encode data using xor

Disassembly:
adc byte [edi + 0x69], al
aam 0x8f
insd dword es:[edi], dx
in eax, 0xef
cmc
sbb byte [ebx], dh
ja 0x100147cc
xchg edi, eax
or dh, bl
push ecx
ret
aas
and eax, 0xbfe8cc31
xchg ecx, ebp
das
enter 0x52be, 2
adc esi, dword [edx]
invalid
mov esi, 0x32130252
xor bh, byte [edx + 0x593290ad]
mov edx, 0x593290ad
jno 0x100147dd
pop ebx
jp 0x10014783
jg 0x1001482c
jo 0x10014789
in eax, dx
jbe 0x10014812
mov dh, 0x4e
xor bl, byte [0x4c4cad4]
enter 0xffffffffffff9939, 0xffffffffffffff83
jl 0x100147c2
or eax, 0xbe80a9dd
stc
je 0x10014872
xor byte [ecx + eax*8 + 0x4b], 0x53
inc esp
mov ebp, 0xbcb55080
and al, 0x54
adc eax, 0x9dae7c63
and al, 0xd2
xchg ebp, eax
imul eax, dword [ecx], 0x30
inc eax
mov ebp, 0x87ff32f1
sub esi, edx
popfd
ror edi, 0xd
pushal
sbb al, 0x3e
pop ecx
mov dl, 0x8c
out 0xc6, eax
clc
mov cl, byte [esi + 0x53b03015]
inc dword [edi - 0x3e6229d7]
iretd
pop ss
add byte [ebx + 0x7b], dl
jnp 0x10014811
test byte [edi], bh
and eax, 0x8a5076b7
std
mov ecx, dword [edx + 0x2e]
call dword [edi + 8]
xor esp, ebp
mov dword [0xd0498aed], eax
jg 0x100148b9
xor bh, byte [ebp - 0x14]
fbstp tbyte [esi + 0x5f539a09]
invalid
xor al, byte [ecx]
add al, bl
scasd eax, dword es:[edi]
mov edi, dword [eax + ecx*2 - 0x63]
jnp 0x10014815
imul esi, dword [edi - 0x59], 0xffffffff
cdq
pop eax
invalid
push 0x14
mov eax, dword [0xe5715749]
push 0xffffffffffffffad
mov ebx, 0xa023998b
lodsb al, byte [esi]
jno 0x1001490e
add dh, bl
push edx
adc esp, edx
aas
movsb byte es:[edi], byte [esi]
jbe 0x1001491c
mov ah, 0xd1
mov eax, dword [0x920d5152]
mov al, dh
inc edx
mov dword [edx + eax + 0x50a305d], edi
adc al, 0xbe
std
cmc
nop
inc edx
sal dword [esi - 0x259905dc], 1
out dx, al
dec edx
call 0x33e84d2c
push 0x3e
inc edi
inc ecx
ror dword [eax - 0x7e], 0xa0
add al, 0x80
mov byte [0x7867a462], al
xor ebp, dword [ecx + edi*2 - 0x3b]
cmp edi, edx
push edx
jno 0x10014964
jno 0x10014964
xor dh, al
pushfd
movsd dword es:[edi], dword [esi]
inc edx
ljmp 0x237f
and ebp, dword [esi - 0x6f]
dec edx
jmp 0x10014943
fst qword [esi - 0x1f]
and byte [eax - 0x7e5dab5a], 0x10
retf 0x77ef
sbb byte [eax], dl
scasb al, byte es:[edi]
mov eax, dword [ebx - 0xa]
pop ebp
std
sahf
jl 0x100149d4
invalid
pop ds
imul esi, dword [0xb4ed6ea9], 0x85029bf2
call 0x4482e7bb
dec edx
outsb dx, byte [esi]
in eax, dx
mov ah, 0xf2
wait
add al, byte [ebp - 0x7e61b818]
xor al, 0x4a
in eax, 0xe7
xchg edx, eax
out dx, al
pop ebx
mov esp, 0x54b012f9
inc eax
mov byte [edi], bh
je 0x10014968
movsb byte es:[edi], byte [esi]
lcall 0xddb9, 0xa1d35fca
xchg ebx, eax
test dword [ebp - 0x7754c9c4], eax
fldcw word [edx]
jne 0x10014952
movsd dword es:[edi], dword [esi]
xor ebx, dword [ecx + edx*4]
int3
scasb al, byte es:[edi]
clc
adc byte [esp + ecx*2 + 0x61cb1d3f], ah
mov bl, 0x4c
ja 0x1001496d
add eax, 0xe9058f87
invalid
Function at 0x1001b6c0
Capabilities:
Encode data using xor

Disassembly:
sbb dl, byte [esi + 0x4a3ba079]
out 0x81, eax
imul edi, dword [edx + eax*4 + 0x2e], 0x9384dbd2
sub edx, ecx
mov eax, dword [0x6822867f]
and eax, 0x75c6b74a
xchg ebx, eax
sub al, 0xbe
push ds
pop edx
cdq
dec edi
xor cl, ch
xlatb
or dword [edx - 0x18ca9e28], edi
jne 0x1001b6a0
pop ebp
and byte [esi], bh
jnp 0x1001b701
sub esi, dword [ebx - 0x4c3dcb51]
mov cl, 0xa
invalid
pop esp
invalid