joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011b030
Capabilities:
Encode data using xor

Disassembly:
sub dl, dh
setae byte [esi - 0x17ff4116]
insb byte es:[edi], dx
fstp qword [ecx - 0x6c]
test al, 0x1f
mov esi, 0x2fc14baa
invalid
mov dl, 0x5a
nop
xor ebx, dword [0x18a3ac1c]
call 0xcf714f36
xor ch, byte [eax + esi*4 - 0x72512125]
ret 0x5cff
adc byte [edx + esi*8], dh
movsb byte es:[edi], byte [esi]
mov cl, 0x37
xchg edi, eax
jo 0x1011b05d
sbb edi, dword [ebx - 0x32cb8636]
daa
jnp 0x1011afd9
inc ebp
xor byte [eax + 0x6aaf0d37], dh
inc esi
cwde
insb byte es:[edi], dx
loope 0x1011aff0
jle 0x1011b06c
inc ebp
mov esp, 0x2f53a24e
xor esi, esp
loopne 0x1011b0c6
xor ebx, dword [esi - 0x4f2cbea]
xor al, 0xd
sti
or eax, 0x2f035639
in eax, dx
or ebp, dword [ebx - 0xa9c59f5]
inc esi
inc esi
add al, 0xc
mov ebx, 0x318f1ba3
enter 0x6a55, 0xffffffffffffffe3
and esp, eax
xchg esp, eax
nop dword [edx]
mov al, byte [0x988231f1]
not byte [esi]
js 0x1011b098
ror bl, 0x76
and dh, byte [eax - 3]
push 0x3f6be1c6
pop ebp
push esi
pop ss
mov byte [0x77809dec], al
ficom word [ebx]
xor byte [edi - 0x22], 0x13
sbb dh, ah
imul ebx, dword [ebx], 0x50
push eax
loop 0x1011b09b
cmp bl, dl
xor al, 0x32
test eax, 0xf6024116
retf
add ebp, dword [esi]
pop esi
pushfd
nop
and bl, dl
cmp eax, 0xfa22f2de
and bh, dl

Function at 0x10139cb0
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x18be03e2
jb 0x10139cdf
mov esi, 0xdea5648c
cdq
mov ebp, 0x18eef3bf
pop esp
lodsd eax, dword [esi]
sbb cl, byte [ebx + 0x6c]
mov ebx, 0x11e7fb67
cmp ch, bl
int3
scasb al, byte es:[edi]
dec edx
jns 0x10139d5e
invalid
pop esi
inc ecx
shl esp, cl
fscale
scasd eax, dword es:[edi]
add dword [edi], esp
aaa
pop edi
push esp
push ecx
add eax, 0x6f3d8412
adc byte [ebp - 0x568a0bcc], 0xe4
mov ch, 0xb1
invalid
test dword [edx - 0x5a], 0x686acb
loope 0x10139d76
sub word [edi + 0x4721b331], cx
inc esi
mov ebx, 0xd1d454e4
das
mov ecx, 0x87614931
fldcw word [ebp - 0x5eac3d1d]
xchg edx, eax
mov edi, 0x5f242112
xor dword [ecx + 0x61], ecx
xchg ecx, ebx
lodsd eax, dword [esi]
jecxz 0x10139d40
push ebx
mov eax, dword [0x2112bf92]
and al, 0x5f
cmp ebx, 0x1a3c4e03
mov edx, 0x6f2f237
cdq
leave
wait
imul ecx, ecx, 0x12
xchg ebp, eax
pushal
into
mov dword [0x919dd9d3], eax
mov bl, byte [ebx + 0x5d0c5adb]
out 0xeb, al
lahf
sar dword [ecx + 0x37], 0x34
lodsd eax, dword [esi]
mov ch, byte [esi - 0x51fb1faa]
mov ah, 0x86
inc eax
jae 0x10139dff
pop ebp
push esp
add dword [eax + 0x45], esi
scasd eax, dword es:[edi]
cdq
ret 0xc466
out 0x66, eax
sub dword [eax - 0xc], ecx
cmpsb byte [esi], byte es:[edi]
inc edx
cmp esi, dword [edi - 0x538cfbba]
cld
call 0x25aa0c06
mov byte [ecx - 0x7b76ca2e], ch
mov ecx, 0x8d131bf
wait
add byte [ecx + 0x3bbc48fe], bl
xor eax, 0x34beadf7
test dh, ah
in eax, 0x68
mov bh, 0x91
and eax, 0x4bfdce7
xlatb
insd dword es:[edi], dx
sbb eax, 0x7ed9d16c
ret
jle 0x10139dc4
jo 0x10139e06
sbb esi, dword [0x4bb1edf9]
in eax, dx
mov cl, 0x4b
out dx, al
inc esi
dec esp
xor dword [edx - 0x77], ecx
in al, dx
sbb ebx, ebx
mov ch, 0xcf
mov al, byte [0x6866a957]
mov esp, 0x57155679
ja 0x10139dbf
nop
mov al, byte [0xc9e4a5b2]
aaa
outsd dx, dword [esi]
in eax, 0x4a
sar dword [0x23c08a99], 1
cmp ebx, dword [0x2e2938d8]
invalid
Function at 0x1013a6e0
Capabilities:
Encode data using xor

Disassembly:
invalid
loopne 0x1013a752
sub dword [esi], esp
and ah, dl
imul esp, dword [esi - 0x29], 0xffffffd7
xchg ebp, eax
adc al, 0xc2
cdq
cmp esi, dword [ecx - 0xd]
sub al, 0x36
push ss
mov al, 0xe7
push 0x3237662d
out dx, al
pop ebx
xchg esp, eax
or al, 0x4b
dec esi
xor al, 0x74
sti
cmpsd dword [esi], dword es:[edi]
sahf
push edx
pushfd
sub cl, byte [esi + 0x42af3b33]
and eax, 0x16398439
jae 0x1013a6ad
pop ss
mov ebx, 0xcafadc69
aaa
jbe 0x1013a773
push 0xffffffffffffffe6
fst dword [edi]
mov word [esi], di
test al, 0x17
pop ecx
wait
inc ecx
call 0x62312075
jo 0x1013a783
test byte [eax + 0x24c6e928], 0xca
or al, 0xa4
rcr byte [esi], 0x3d
jg 0x1013a71f
sub bh, bh
loop 0x1013a7a2
inc ebx
sub al, 0x61
push eax
invalid
neg byte [ebp + esi*4 - 0x27ae6fd1]
and al, 0xdd
adc ch, 0xbf
imul eax, dword [ecx - 0x5dfa2d41], 0x4e
inc esi
jne 0x1013a7ad
test eax, 0x76280314
shr ebx, 1
push cs
mov edx, 0xab45c2f9
fstp dword [ebp + 0x3b]
add al, 0x98
and ebx, dword [ecx - 0x24]
mov eax, 0xb1f2473f
ret 0xab45
xchg ebp, eax
test dword [ecx], ebp
xchg esp, eax
stosb byte es:[edi], al
pop esi
add dh, dh
push esp
int1
and byte [edi + 0x37552390], al

Function at 0x1013b7d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xf4a769ee
pop ds
pop edi
or byte [esi + 0x13], 0x90
sbb ebx, dword [ebx]
lcall 0x71c, 0xaad55d79
add eax, 0xba414ba7
enter 0xffffffffffffd81f, 0xffffffffffffffab
push ebp
cdq
scasd eax, dword es:[edi]
invalid
js 0x1013b798
mov edx, 0x100e2507
or ch, byte [ebx]
mov ecx, 0xd0ad28e9
jno 0x1013b7ef
test byte [edi - 0x1de40695], bh
mov ebx, 0xf9a09c6
lds ebp, [ebx + edx*2]
jle 0x1013b822
xor ch, byte [edi + 0x64]
add al, byte [edx - 0xd]
outsd dx, dword [esi]
add al, byte fs:[edx - 0xd]
cmp byte [eax - 0x1c], 0xad
popal
cld
int 0xd6
mov edx, 0x45c4d402
test dword [edi + 0x40], ebx
xchg ebx, eax
mov byte [0xa0416366], al
je 0x1013b81e
ror byte [eax + 0x162f02ef], cl
mov bh, ch
add ch, byte [edi]
push ss
cli
add al, bl
dec ecx
sub al, 0x27
add ah, byte [eax + 0x2d3f6156]
mov eax, 0x9adb200d
cmc
dec eax
xchg ch, bl
sub eax, 0xdb200db8
lcall 0xe475, 0xdd8648f5
fistp dword [edx - 0x2279b70b]
jne 0x1013b80e
and eax, 0x4a8e8ea4
pop es
fcmovnb st(0), st(5)
retf 0x1cb8

Function at 0x10140450
Capabilities:
Encode data using xor

Disassembly:
mov dl, al
sbb ah, 0x81
mov ecx, 0x386a9a29
xchg ch, dh
scasb al, byte es:[edi]
jmp 0x10140447
pop es
xor al, 4
pop ds
push esi
adc bl, byte [ecx - 0x7c]
fldenv [ecx]
daa
pop ecx
test cl, bl
and dword [edi], esp
test byte [eax - 0x56], dl
push ss
push ss
add al, 0xd9
adc esi, dword [edx - 0x7550be2a]
xchg edx, eax
push eax
in eax, 0x4e
and byte [ecx + edx*4], 0x32
cmp byte [0xc90e1d4e], bl
mov byte [0xaf0369ce], al
add cl, byte [eax + 0x3739fdbd]
out dx, eax
mov byte [0x44f92a81], al
xchg ebp, eax
and ch, dh
ror byte [ecx + 0x3bdeb76a], 0xb4
xor byte [ecx + 0x707fc346], 0x23
push ss
inc ebp
loopne 0x10140441
hlt
Function at 0x1014e5f0
Capabilities:
Encode data using xor

Disassembly:
xor bl, byte [edx - 0x7317adb6]
xchg dword [edi - 0x1c], eax
jnp 0x1014e609
shl dword [ecx], cl
push ebp
imul eax, dword [ebx + 0x66], 0xaec4d45c
aam 0xb6
outsd dx, dword [esi]
cmp al, 0x8e
xor eax, dword [ecx]
mov dh, 0x3f
sbb eax, 0xd149018f
lodsb al, byte [esi]
invalid
je 0x1014e5b6
jns 0x1014e624
xchg ah, al
movzx ebx, bh
nop
stc
cmp bh, byte [ebx + 0x40]
jb 0x1014e614
mov byte [edx - 0x1c], dl

Function at 0x101519c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, 0x1a9587e
stosd dword es:[edi], eax
call dword [ebp + edi*2 + 0x51]
push esi
enter 0x6f6a, 0xffffffffffffffdc
invalid

Function at 0x10152d00
Capabilities:
Encode data using xor

Disassembly:
inc edi
and bl, ah
xor ecx, eax
in al, dx
cmp ebp, ebp
sub eax, 0x3671ceb5
hlt
push dword gs:[ebx]
cmp esp, ebp
loope 0x10152ca1
cmp byte [esi + eax*4 + 0x1fe95560], 1
inc di
push sp
sub dword [edi + 0x32bafc3b], edi
and dword [edx + 0x2e], edi
pop ss
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
jl 0x10152d73
sahf
invalid
stc
fld xword [ecx - 0x7e]
inc ebx
cmpsb byte [esi], byte es:[edi]
jmp 0x10152dcb
ret
enter 0xfffffffffffffa79, 0xffffffffffffffa6
mov bh, byte [ecx - 7]
jns 0x10152dbc
mov dh, 0xee
mov dword [esi], ecx
daa
dec ecx
shr al, cl
or ah, bl
cmp ecx, edx
clc
inc esi
daa
cli
inc edi
jbe 0x10152dc1
jo 0x10152d9b
dec edx
push ss
enter 0x5209, 0x6a
ror byte [edi + 0x37], cl
mov esp, 0x4cb2fe20
dec ebx
enter 0xffffffffffff834f, 0x51
pop edi
sub byte [eax], 0x61
sar ecx, 0x48
add dh, byte [0x5cc5d264]
jg 0x10152e6a
sub ecx, ecx
cmp eax, 0xf5d1445b
cmc
fadd dword [ebp - 0x2949e67c]
sbb ebx, dword [ebp + 0x42]
push eax
mov ebp, dword [edx + ebx*4]
cmp dword [ebx + 0x3bace0e2], edx
mov ebx, 0xdb0c1db6
insb byte es:[edi], dx
dec ax
cmp bl, dh
and al, 0x7d
rol byte [ebp + 0x18], 1
pop eax
fist dword [eax + 0x57646dea]
invalid
jl 0x10152e9a
jb 0x4f935ee8
cld
cmp dl, byte [edx]
cld
mov ch, 0x73
inc ebx
add ebx, dword [edx - 0xbfc8f6d]
add dword [ecx], 0x805d53c2
aad 0x50
cmp esp, dword [ecx]
jnp 0x10152e56
jl 0x10152ee3
leave
sbb byte [eax], cl
mov ah, ah
cdq
xor eax, ecx
sub bl, ah
dec esp
psrlw mm1, qword [esi + edx*4 + 0x38]
ror dword [esi + edx*4 + 0x38], 1
outsb dx, byte ss:[esi]
pop esp
sub eax, 0x412fe35d
jecxz 0x10152e3d
pop ebp
rcl ecx, 1
push edx
inc esp
hlt
clc
sbb byte [edx - 0x463d329c], 0x77
pop ecx
xor ah, bh
outsb dx, byte [esi]
test byte [ecx + 0x14], ch
je 0x10152e96
int3

Function at 0x10160750
Capabilities:
Encode data using xor

Disassembly:
pop es
test eax, 0xa5bae41f
mov al, 0xf0
fidiv dword [eax + 0x1a47cc72]
and ch, bl
push ebx
xor al, 0x97
or al, byte [0x5056f1b2]
cdq
dec edi
fidivr word [esi - 0x32ed1bbc]
invalid
Function at 0x10160dc0
Capabilities:
Encode data using xor

Disassembly:
cli
int1
dec esi
fsubr st(2), st(0)
jle 0x10160daa
pop edx
daa
rol byte [ecx + edx*8 + 0x22238cc1], cl
xchg ecx, eax
adc al, byte [edx]
jns 0x10160dbc
cmp eax, 0xf8dee92c
mov dword [0x14a9eaea], eax
xor eax, 0xac358366
fmul dword [ebp - 0x6cfe0c]
jb sym.DD_Db.dll_public_virtual:_bool___thiscall_OdDbTable::cellStyleOverrides_unsigned_long_int__unsigned_long_int__class_OdArray_unsigned_long_int__class_OdObjectsAllocator_unsigned_long_int____const
ja 0x10160d49
ret 0xb1e9
lodsb al, byte [esi]
jno 0x10160d41
mov al, byte [0x8de0dda4]
loopne 0x10160d4f
mov dword [ecx - 0x7a], esp
xchg ebp, eax
jnp 0x10160e30
aaa
jp 0x10160dbd
aad 0xfc
sub byte [esi], bl
add al, 0x8d
mov al, 0x4d
pop es
popal
mov bh, 0x23
mov ah, 0xeb
cdq
outsb dx, byte [si]
mov byte [0x9447c556], al
lahf
mov ah, 0x8b
insb byte es:[edi], dx
mov byte [edi - 0x7b192222], bh
in eax, 0xc6
stosb byte es:[edi], al
stosd dword es:[edi], eax
jae 0x10160e5f
mov al, 0xe1
aas
push cs
cmp esi, dword [ebp + 0x20]
mov bh, 0xed
ret 0xf4ea
sub bl, byte [edi - 0x7f]
inc eax
mov esp, 0x45dbd18f
and byte [eax], dl
test al, 0xd8
pop ss
js 0x10160eba
js 0x10160df6
lodsd eax, dword [esi]
jp 0x10160ebf
retf
invalid
add al, 0x5e
pushfd
into
das
adc al, 0x8e
xchg ebx, eax
push edi
cmpsb byte [esi], byte es:[edi]
out 0x7f, eax
add dword [ecx + 0x511af1a6], ecx
push ecx
mov edi, 0x8912fa89
les ecx, [ebp + 0x5488afd9]
jnp 0x10160eb6
adc cl, byte [ecx - 0x5026723c]
scasd eax, dword es:[edi]
mov byte [ebx + edi*2 - 0xe], dl
fld st(2)
les edi, [ebp + 0x153fd0c7]
jns 0x10160ea4
in al, dx
arpl word [ecx + 0x26], bx
test al, 0xed
mov edi, 0x42fb87e1
pop esi
inc esp
push 0x4f89dd90
loope 0x10160f5d
outsb dx, byte [esi]
pop ds
mov byte [eax - 0x597f3520], dl
and dword [0x9eae4572], eax
sub bh, byte [edi - 0x486ea0ee]
daa
xchg ecx, eax
arpl word [ebp + 0x6f], cx
jecxz 0x10160f3c
cmp eax, 0x6443b4ab
dec ebp
push edx
sub cl, byte [edi + 0x5502234b]
lodsd eax, dword [esi]
invalid
inc ebp
xor ebx, edx
std
in al, 0x3f
aas
cmp eax, 0x1722427f
sti
sub byte [eax - 0x27eaa11f], ah
inc esp
pop esp
jge 0x10160f20
push ss
enter 0x4a2f, 0x40
loopne 0x10160f36
jmp 0x7a04564e
imul esp, dword [edx - 0x7d], 0x347b9f40
push 0xa7ae0d2c
mov eax, dword [0x175b9114]
rep stosd dword es:[edi], eax
sti
nop
inc esp
jecxz 0x10160f1b
in eax, dx
mov bx, sp
pop es
fld xword [esi - 0x2f]
cmp dword [esi + 0x11], ecx
invalid

Function at 0x10161c20
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xaa5a6982
mov word [esi], fs
mov ecx, 0xc76940ab
sar byte [ecx - 0x4a361b43], 0x25
test byte [eax - 0x60f3487f], ah
mov edi, 0xe14d6edf
mov word [eax], ss
inc ebp
adc dh, al
dec ebp
imul ebp, edi, 0x7868ea83
cwde
invalid
Function at 0x1016ba60
Capabilities:
Encode data using xor

Disassembly:
pop ebx
cmpsb byte [esi], byte es:[edi]
sbb byte [esi + ebp*2 + 0x7df2ed92], al
sub bh, byte [esi - 0x35]
cmpsb byte [esi], byte es:[edi]
inc esi
xor eax, 0xa9689a23
loop 0x1016ba30
ror al, 0x81
pop es
xor al, 0x8d
stc
das
push ss
mov ebx, edi
mov ebx, 0x54704df6
out dx, eax
imul eax, dword [eax - 0x3d], 0xffffffba
in al, 0xa
in eax, 0xc0
inc ebx
shr dword [edi], 1
inc edx
bound edi, qword [ebp - 0x64]
inc esi
sti
fmul dword [edx + 0x1b]
mov bl, 0xde
xor bl, ah
add al, 0x50
dec ebp
in eax, dx
cmp al, 0xf2
mul cl
mov cl, bh
cmp eax, 0xbc5b703c
shr dword [edx], cl
pushfd
outsb dx, byte [esi]
inc edi
scasb al, byte es:[edi]
je 0x1016b9ce
xor dword [esi + 0x5e], esp
cmc
dec edi
sbb al, 0x4e
xchg edx, esi
push 0xab889c17
sub eax, 0x2a93dc44
out dx, al
dec edx
out dx, al
dec esp
jo 0x1016b9b5
sar byte [ebp + 0x70], cl
and eax, 0x8b25aed8
jne 0x1016ba55
inc edx
and eax, 0x22ef0943
dec ecx
pop es
out dx, al
cmpsb byte [esi], byte es:[edi]
add esp, dword [esi]
invalid
int3
mov edx, 0x3cc11d9d
mov ebx, 0xff43bb56
jae 0x1016bad1
pop edx
pop ecx
mov bh, 0xc0
je 0x1016ba99
inc ecx
push ecx
iretd
je 0x1016ba20
xor ecx, ebx
mov byte [ecx], dh
das
dec edi
invalid
push ds
mov bl, 0x66
inc esp
sub ch, bl
jmp 0xf4ba7d15

Function at 0x10174dd0
Capabilities:
Encode data using xor

Disassembly:
sbb dword [0x3c312ade], ebx
push 0xa7d94f35
cmp bh, cl
fisubr word [edx]
xor dword [eax + ebp*2], edi
xor eax, 0x3aa7d94f
stc
cmp ah, byte [ecx]
inc ebp
jb 0x10174dd2
mov byte [edx], 0xb7
imul esi, dword [ebx + 0x3e], 0xffffffdd
mov dword [edi - 0x14], esp
mov cl, 0x31
xchg edx, eax
mov cl, 0x3f
into
not dword [0x607bb889]
xchg esi, eax
insd dword es:[edi], dx
scasd eax, dword es:[edi]
das
xor eax, 0x467a4f29
notrack jmp 0x10174e44
push esi
inc ebx
inc eax
adc eax, 0x6ec7d0ad
in eax, dx
retf
sbb eax, 0x26c07c1e
adc dl, byte [ebp + 0x79]
inc edx
xchg byte [eax + 0x363245ca], al
rcr dh, 1
in al, 0x17
into
mov edx, 0x4d3c60f5
mov ebx, 0xe5706217
sub dword [edi + 0x7f825f86], esi
fild dword [edi + 7]
in al, 0x24
loopne 0x10174e17
mov dword [edx - 0x65], 0x624b3f96
cdq
lcall 0xdbde, 0x7b2e687e
invalid

Function at 0x10196c60
Capabilities:
Encode data using xor

Disassembly:
aam 0xcd
mov eax, 0x3160cb82
push cs
mov edx, 0x8bc63f67
test al, 0x33
leave
lodsb al, byte [esi]
jle 0x10196cae
sub ebx, ecx
in eax, dx
out 0x4e, al
cdq
inc edi
pop es
bound ebx, qword [edi]
salc
stosd dword es:[edi], eax
and esi, esp
push esi
xor ebp, edi
daa
test byte [esi + edi*2 - 0x5a314a34], ch
dec ebp
pop eax
invalid
mov dh, 0xce
dec ebx
invalid
Function at 0x1019dc90
Capabilities:
Encode data using xor

Disassembly:
out dx, al
and byte [ebp - 0x65a8e898], ah
out dx, eax
in al, dx
xchg ebx, eax
int1
das
pushal
in al, 0x65
sbb eax, 0xe72e303a
mov bh, byte [edx - 0x56]
test eax, edx
stc
clc
add al, 0xe5
pop edx
aad 0x90
mov byte [0x7c16a063], al
imul esi, ebx, 0x4e
test eax, 0xfdedecd4
mov ecx, 0xb120d072
shl byte [eax], 1
mov cl, 0xed
lds ebx, [eax]
frstor dword [esi + 0x2ba95394]
pop ds
xchg ecx, eax
pop edi
mul ebp
packsswb mm2, qword [esp + eax*4 - 9]
arpl word [esp + eax*4 - 9], dx
pop es
pop eax
imul eax, dword [ebx + 0x6b84efa3], 0x8f983c1f
pop edx
xor esi, esp
dec eax
mov esi, 0x58e543c3
idiv dword [ebx - 0x7f3f4533]
movsb byte es:[edi], byte [esi]
add al, 0xee
popal
inc edx
push edx
test byte [ebx + 0x1250913f], bl
dec esi
dec ebx
pushal
aas
mov dh, 0x34
loopne 0x1019dca2
in eax, 0xeb
fucomi st(5)
mov byte [0x1647d2c8], al
in eax, dx
cmp byte [edx - 0x6f], dh
movsd dword es:[edi], dword [esi]
dec ecx
imul edx, dword [di + 0x4061], 0xffffffec
adc cl, byte [ebp + eax*8 + 0x39308d0e]
pop esp
daa
push eax
loop 0x1019dcfb
cld
pop edx
pushal
xchg ebp, eax
sub esp, ecx
and ebp, esi
pop ebp
imul esp, edi, 0xffffffe4
mov byte [0x5677a5c5], al
xor eax, 0x4144cc55

Function at 0x101aa1d0
Capabilities:
Encode data using xor

Disassembly:
push esp
mov eax, 0x7eb227a4
sub eax, 0xa34dc44a
push ecx
xor byte [edi], ch
and eax, dword [edx + 0x68]
test dword fs:[esi - 0xf], 0x1c4c131c
dec esp
sbb al, 0xf2
sahf
dec esp
sbb al, 0xf2
sahf
test byte [eax - 0x5f], cl
mov bh, 0x9c
popal
je 0x101aa1b9
push es
test dword [esp + ebp*8 + 0x77], 0x3ee46c43
or byte [ecx + 0x6b], ah
or eax, 0x6609efe3
mov ebp, 0xbd26b69
mov ebx, 0x1d45a3dd
aas
xor eax, 0xca489b25
aad 0xb1
or cl, byte [ebx + 0x16505d3f]
sbb byte [esi + 0x58], 0xe9
invalid

Function at 0x101aa700
Capabilities:
Encode data using xor

Disassembly:
and byte [edi], 0x13
push 0xb3736b2
or edi, dword [edi + 0x6931b7e2]
or edi, dword [edi + 0x6931b7e2]
lodsd eax, dword [esi]
dec eax
xor ecx, dword [edx + 0x65516d1f]
mov cl, 0x39
add esp, dword [edi + 0x75c64ad6]
mov ebx, 0x8f38dccd
or esp, ebx
lcall 0x1302, 0xaa4e7df7
xlatb
sbb dword [eax + 0x6dc8defb], edi
pop esi
jge 0x101aa6f8
mov word [ecx + 0x7c4bbbd6], gs
mov al, byte [0x856419c6]
dec edi
jae 0x101aa756
add al, 0x6c
imul ch
jmp 0xeff33d9b
xchg edx, eax
call 0xd4acecb6
pop ss
stc
rcr dword [eax + 0x173d1874], 0x72
nop
std
aad 0x5e
dec ebx
aaa
fcomp dword [edi + 0x2a]
dec ebx
loop 0x101aa757
jmp 0xd83f4202

Function at 0x101b8020
Capabilities:
Encode data using xor

Disassembly:
sub dword [ecx + 0x1f], 0x58
add ebp, dword [esi]
sub al, 0xe6
popal
invalid
jp 0x101b7ffb
insb byte es:[edi], dx
add eax, 0x7fa74d9b
ror dword [ebp + 0x2eb1ec7b], 0xab
invalid

Function at 0x101b8630
Capabilities:
Encode data using xor

Disassembly:
or al, 0xe4
aas
mov bl, 0x6b
xor byte [edi], dl
mov dword [0x2d45e1a2], eax
mov edx, 0x2b4a8083
out dx, al
push 0x71
wait
call dword [ebx + 0x50]
xor al, 0x4c
xor dword cs:[esi + 0x7f], edx
dec eax
dec ecx
jae 0x101b8642
lcall 0xd3ec, 0x73178296
les edx, [edx - 0x47]
dec edx
cmc
pushfd
xor al, 0xb5
cmp eax, 0xd0cbdba4
invalid
Function at 0x101c57e0
Capabilities:
Check for software breakpoints

Disassembly:
inc eax
add dh, 0x82
shr dword [esi + 0x47], cl
push es
sbb edi, dword [ecx - 0x31]
das
je 0x101c5855
adc byte [eax + ebp*4 - 0x4c], 0xb
pop ecx
xor al, 0xa
push ebp
push ebp
pop ds

Function at 0x101c5850
Capabilities:
Check for software breakpoints

Disassembly:
add al, 0xaa
cmpsd dword cs:[esi], dword es:[edi]
add ebx, dword [edi]
test dword [edx + 0x149804ff], 0x4978bb3f
insd dword es:[edi], dx
cmp byte [ecx], 0xcc

Function at 0x101d5480
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x23e35d88
mov edx, 0x4400e6e7
out dx, al
and byte [edx + edx*4 + 0x78], ah
invalid

Function at 0x101de0a0
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ebx], ebx
movsd dword es:[edi], dword [esi]
add ah, byte [esp + eax*2 + 0x4b]
pop ds
mov al, byte [0xac591307]
pop ecx
pop ebp
sets dh
push ds
mov al, 0x56
call 0xb7a0b38e
inc ecx
and esi, dword [eax]
neg dword [esi]
cmpsd dword [esi], dword es:[edi]
cmp byte [ebx + ebx + 0x4b99f839], dh
clc
cdq
dec ebx
test dword [ebp + ecx*8 - 9], ebx
out 0x80, eax
cmp eax, 0xcac042c5
mov al, byte [0xe97ed41a]
mov al, 0x11
push eax
xor byte [ebp - 0x1f91ed6b], cl
aaa
lea edx, [ebp + 0x37e06e12]
adc dl, ch
adc dword [eax + 0x5d530072], 0xccc71a7b
fisttp qword [esi + 0x4b]
loop 0x101de048
wait
xlatb
mov bl, 0x58
jbe 0x101de0b6
adc esp, ebx
jge 0x101de060
invalid
idiv bh
and bl, bl
jle 0x101de0e2
lcall 0xfe42, 0x2dad5895
loop 0x101de0b7
cmp ch, byte [esi]
rcl byte [ecx + 0x243fa986], cl
and al, 0xeb
mov byte [ecx + 0x44], bl
jp 0x101de0db
jmp 0x101de041
in al, 0xf3
push ebx
add edx, ebp
into
fdiv qword [edi + 0x2d1ae121]
movsd dword es:[edi], dword [esi]
cmp al, 0xb1
mov edi, 0x60eb92c2
nop dword [esi]
jle 0x101de07d
push edi
adc eax, 0x45330f66
inc ebp
mov ah, 0x94
mov cl, bh
stc
jp 0x101de065
cmp dword [ebx + 0x43], 0x6b
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
mov bh, 0x38
pop es
mov esi, 0x5d9de1f9
adc al, 0xde
rcl dword [0x85e49e10]
call 0x61bee22a
or esp, esi
sbb cl, ch
arpl word [esi + 0x6852be0b], sp
push cs
rcl dh, 1
jbe 0x101de106
push 0x76d6d00e
cli
jne 0x101de0e2
add edi, dword [esi]
inc edx
pushfd
sub al, byte [ebp - 0x53]
mov fs, word [ecx + 0x4b]
lcall 0x4748, 0x2bf73130
lea ecx, [eax + 0x721324f2]
loope 0x101de0df
sbb al, 0xf1
fld dword [ebx - 0x7f]
add eax, 0x1d9a3235
push 0xdb806b0c
je 0x101de1ad
imul eax, dword [eax - 0x538a8b25], 0xffffff87
mov cl, byte [edx]
push ds
xchg edi, eax
scasb al, byte es:[edi]
lodsb al, byte [esi]
xchg dword [edx - 0x5168e1f6], ecx
pushal
or al, 0x65
fisubr word [ebx - 0x13]
and eax, 0x2b75f1db
pop edi
jp 0x101de1ca
inc dword [ebp - 0x42]
pop es
leave
or dword [esi], esp
adc byte [ecx + 0x62], al
lcall 0x6a4b, 0x75fdca20
push es
pop edi
test dword [edi], ebx
mov ah, 0x87
invalid
jno 0x101de133
test eax, 0xd62a90cc
salc
sal dword [edi + 0x18], cl
daa
sbb cl, bl
pop ss
dec ebp
sub esp, dword [eax - 0x14326764]
sti
xor ecx, dword [ebx]
mul byte [edx - 0x422e6853]
jns 0x101de1b3
mov ebp, 0x6c5de679
pop ebp
insb byte es:[edi], dx
ljmp 0x61ba:0xb1d68be3
Function at 0x101e8270
Capabilities:
Encode data using xor

Disassembly:
xor bh, byte [edi]
or ecx, dword [edi + esi*8]
lahf
pop eax
aad 0x7b
push eax
xchg ebx, eax
out 0xff, al
test eax, 0x82616df5
popal
adc byte [ebx + 0x12], 0x3c
invalid
jno 0x101e82c1
mov edx, 0x80247a87
xor byte [ecx - 0x69], dl
xchg edi, eax
mov dl, 0xca
xor eax, 0x652092be
salc
pop edx
js 0x101e827f
push edi
dec ebp
lea ebx, [edi]
ljmp 0xd6c9
cdq
xor dh, byte [ebp + 0x1c]
pop ebx
mov ebp, 0xcd8f0916
invalid

Function at 0x101f30d0
Capabilities:
Encode data using xor

Disassembly:
loope 0x101f30f9
mov dword [edi + 0x29d1074a], ecx
pushfd
mov edi, 0x400da7ac
or al, 0xf5
xchg ebp, eax
dec ebx
fiadd dword [ecx - 0x60d09553]
push edx
pop ebp
out 0x1c, eax
mov eax, 0x4e7a2c25
dec edi
sbb bl, byte [eax]
mov dword [0x7cc2cdab], eax
xchg esp, eax
and byte [ebp - 0x23], cl
mov byte [esi + 0xcf4686c], bh
ror byte [eax], 0x18
out 0x46, al
xchg eax, ecx
enter 0x3942, 0x30
enter 0x3942, 0x30
fsubp st(7)
add eax, 0x398737fc
and dword [edx + 0xf948b8], edx
jae 0x101f3096
mov edi, dword [esi - 0x5c3c6022]
pop eax
jne 0x101f3158
lahf
ret
fdivr dword [ebx + 0x4d]
ljmp 0x11e5
mov byte [0x90baaab3], al
mov ebp, 0x9be1ac3f
invalid
cmp al, 0xd0
sahf
or byte [ecx - 0x46ac2025], dh
test al, 1
lds edx, [ecx + ebx*8 - 0x331a9309]
cmp ah, dl
xchg ecx, eax
add ch, byte [0xb46b401]
dec eax
sub dh, byte [esi - 5]
cmp edx, ecx
mov dh, 0x5f
dec ecx
add cl, byte [eax]
arpl word [edi + 0x1ec96038], sp
or byte [ecx - 0x442feb22], 0xa8
xchg edx, eax
arpl word [eax + edi*2 + 0x7989497b], bp
mov word [edi - 0x4a], gs
cmp bl, dl
lds esi, [0x26453aed]
jns 0x101f30e6
outsd dx, dword [esi]
mov dh, 0x3a
fcmovb st(0), st(5)
xor eax, 0x26453aed
xchg ebx, eax
leave
fsub qword [eax]
xor al, 0xaa
jle 0x101f311d
out 0x57, al
dec esp
cdq
xchg edi, eax
mov ch, 0x91
sub ebx, dword [esi]
cmp al, 0xfc
out dx, eax
mov eax, dword [0x8ee34f17]
movsd dword es:[edi], dword [esi]
mov ebp, 0x4c6063b3
cwde
invalid

Function at 0x101f3cb0
Capabilities:
Encode data using xor

Disassembly:
or bh, byte [edi + edi*4]
pop ebp
dec esp
adc al, 0x93
insd dword es:[edi], dx
xor byte [edi], bl
loop 0x101f3ca8
xor byte [ebx + 0x3e1f651a], ah
sar ebp, 1
sti
stosb byte es:[edi], al
adc al, 0x4f
sbb al, 0xc1
and ch, al
xor bl, dh
mov cl, 0x1f
scasb al, byte es:[edi]
in eax, 0xb8
imul esi, esp, 0x1c
xor dword [ebx - 0x6d25a682], ebx
lahf
push ecx
jmp dword [eax + 0x6e1ecc86]