joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10145200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
mov eax, ecx
push edi
mov dword [ebp - 0x18], esi
xor edx, edx
mov dword [ebp - 0x10], edx
test esi, esi
je 0x10145228
nop dword [eax]
cmp eax, esi
jae 0x101453a7
mov cl, byte [eax]
mov byte [ebp - 3], cl
test cl, cl
je 0x101453a7
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x102f8b80]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x1014525a
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp - 3]
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x10145272
mov bl, byte [esi]
mov byte [ebp - 1], bl
jmp 0x10145276
mov byte [ebp - 1], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x10145282
mov ch, byte ds:[esi]
jmp 0x10145284
xor ch, ch
lea ebx, [eax + 3]
mov byte [ebp - 3], ch
cmp ebx, edx
jae 0x10145292
mov bl, byte [ebx]
jmp 0x10145294
xor bl, bl
movzx esi, byte [ebp - 1]
movzx edx, ch
movzx ecx, cl
movzx edi, bl
mov byte [ebp - 2], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x102f8b6c]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x102f8b58]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp esi, dword [ebx*4 + 0x102f8b44]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, pe_nt_image_headers32
cmove edx, ecx
mov ecx, 0x10ffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x102f8b30]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x1014538b
xor edx, edx
mov esi, dword [ebp - 0x18]
cmp byte [ebp - 4], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
mov edx, dword [ebp - 0x10]
inc edx
jmp 0x10145212
add eax, ebx
test esi, esi
je 0x1014539d
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
inc edx
jmp 0x10145212
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101453c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ecx
lea eax, [edx - 1]
mov dword [ebp - 0xc], ebx
lea eax, [ebx + eax*4]
mov dword [ebp - 0x1c], eax
cmp ebx, eax
mov eax, dword [ebp + 8]
jae 0x1014557f
push esi
mov esi, dword [ebp + 0xc]
push edi
nop dword [eax + eax]
test esi, esi
je 0x101453fc
cmp eax, esi
jae 0x1014557a
mov bl, byte [eax]
mov byte [ebp - 3], bl
test bl, bl
je 0x1014557a
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x102f8b80]
test ecx, ecx
mov dword [ebp - 0x10], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x18], ebx
test esi, esi
jne 0x1014542e
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp - 3]
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x10145443
mov bh, byte [esi]
jmp 0x10145445
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 3], bh
cmp esi, edx
jae 0x10145453
mov ch, byte [esi]
jmp 0x10145455
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x10145463
mov bl, byte [esi]
jmp 0x10145465
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [ebp - 1], bl
mov ebx, dword [ebp - 0x10]
mov ebx, dword [ebx*4 + 0x102f8b6c]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0x10]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x102f8b58]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x10]
cmp esi, dword [ebx*4 + 0x102f8b44]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, pe_nt_image_headers32
cmove edx, ecx
mov ecx, 0x10ffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x102f8b30]
mov ebx, dword [ebp - 0x18]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x10145558
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 4], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x1014555e
add eax, ebx
test esi, esi
je 0x10145577
mov ecx, dword [ebp - 0x14]
mov dword [ecx], esi
add ecx, 4
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x1c]
jb 0x101453f0
jmp 0x1014557a
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0xc]
pop edi
pop esi
mov edx, dword [ebp + 0x10]
mov dword [ecx], 0
test edx, edx
je 0x1014558e
mov dword [edx], eax
sub ecx, ebx
sar ecx, 2
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101459e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10145a46
mov cl, byte ds:[esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10145a29
cmp edi, 2
jb 0x10145a29
cmp byte [esi], cl
jne 0x10145a29
cmp byte [esi + 1], cl
jne 0x10145a29
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102eead0]
jmp 0x101459f5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102eead0]
test edi, edi
jne 0x101459f5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10145a78
nop dword [eax]
cmp cl, 0x23
jne 0x10145a5f
cmp byte [esi], cl
jne 0x10145a5f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x102eead0]
test cl, cl
jne 0x10145a50
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x101479c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10350170]
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1cdc]
mov esi, 4
mov eax, dword [edi + 0xc4]
add edi, 0xc4
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x102eead0]
sub esi, 1
jne 0x101479f2
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x10147a39
inc ecx
test esi, esi
je 0x10147a27
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10147a2c
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10040820
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1014cba0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, edx
mov eax, 0x5e6ea9af
mul dword [ebp + 8]
push edi
shr edx, 0xb
xor edi, edi
imul eax, edx, 0x15b0
mov ecx, 1
mov edx, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 0x10], edi
sub ebx, eax
mov dword [ebp - 4], ebx
test edx, edx
je 0x1014cce6
xor edx, edx
mov dword [ebp - 8], edx
cmp ebx, 7
jbe 0x1014cc44
mov eax, 7
sub eax, esi
mov dword [ebp - 0x10], eax
nop
movzx eax, byte [esi]
add edx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add esi, 8
add ecx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
add edi, ecx
cmp eax, ebx
jb 0x1014cbf0
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 4]
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 8], eax
jae 0x1014cca5
sub eax, dword [ebp - 8]
cmp eax, 2
jb 0x1014cc98
mov eax, dword [ebp - 8]
mov edi, ebx
mov edx, dword [ebp - 4]
sub edx, eax
sub edx, 2
shr edx, 1
inc edx
lea eax, [eax + edx*2]
mov dword [ebp - 8], eax
nop
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x1014cc70
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jae 0x1014cca0
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
lea eax, [edx + ebx]
add edi, eax
mov eax, 0x80078071
mov ebx, dword [ebp - 4]
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
add edi, eax
sub dword [ebp + 8], ebx
mov ebx, 0x15b0
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
jne 0x1014cbd8
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1015fbe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1015fc21
mov eax, dword [0x10350170]
mov dword ds:[esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1015fc0a
dec dword [eax + 0x370]
push dword [0x1035018c]
push ecx
call dword [0x1034c470]
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1015fc5c
mov eax, dword [0x10350170]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1015fc45
dec dword [eax + 0x370]
push dword [0x1035018c]
push ecx
call dword [0x1034c470]
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword ds:[esi + 0x20]
test ecx, ecx
je 0x1015fc98
mov eax, dword [0x10350170]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1015fc81
dec dword [eax + 0x370]
push dword [0x1035018c]
push ecx
call dword [0x1034c470]
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1015fcf0
mov eax, dword [0x10350170]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1015fcd8
dec dword [eax + 0x370]
push dword [0x1035018c]
push ecx
call dword [0x1034c470]
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1015fd30
mov eax, dword [0x10350170]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1015fd14
dec dword [eax + 0x370]
push dword [0x1035018c]
push ecx
call dword [0x1034c470]
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1015fd70
mov eax, dword [0x10350170]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1015fd54
dec dword [eax + 0x370]
push dword [0x1035018c]
push ecx
call dword [0x1034c470]
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10161ac0
Function at 0x10197de0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [0x1034dcac]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov eax, dword [esi + 0x18]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1035b454]
cmp eax, dword [ecx + 4]
jg 0x10197e74
mov ecx, esi
call dword [0x1035b458]
mov eax, esi
pop esi
ret
push 0x1035b454
call fcn.1009af0b
add esp, 4
cmp dword [0x1035b454], 0xffffffff
jne 0x10197e68
push str.E8_________83_BE___________74_3A
push str.client.dll
call fcn.101a9f80
push 0x1035b454
mov ecx, dword [eax + 1]
add eax, 5
add eax, ecx
mov dword [0x1035b458], eax
call fcn.1009aeba
add esp, 4
jmp 0x10197e68
Function at 0x1019e620
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov al, byte [ecx]
mov edx, 0x811c9dc5
test al, al
je 0x1019e644
nop dword [eax + eax]
movzx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx]
test al, al
jne 0x1019e630
mov eax, edx
ret
Function at 0x101a9f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
push eax
call fcn.1046f7e7
mov edx, eax
test edx, edx
je 0x101aa05b
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x101aa05b
mov eax, dword [edx + 0x3c]
cmp dword [eax + edx], 0x4550
jne 0x101aa05b
mov eax, dword [eax + edx + 0x50]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
add eax, edx
mov dword [ebp - 4], eax
cmp edx, eax
jae 0x101aa05b
mov ecx, 0x3f3f
mov al, byte [esi]
mov byte [ebp + 0xb], al
cmp al, 0x3f
je 0x101aa026
movzx ecx, al
sub al, 0x30
cmp al, 9
ja 0x101a9feb
add ecx, 0xffffffd0
jmp 0x101a9ff1
and ecx, 0xffffffdf
sub ecx, 0x37
mov al, byte [esi + 1]
movzx edi, al
sub al, 0x30
cmp al, 9
ja 0x101aa002
add edi, 0xffffffd0
jmp 0x101aa008
and edi, 0xffffffdf
sub edi, 0x37
movzx eax, byte [edx]
shl ecx, 4
or ecx, edi
cmp eax, ecx
mov ecx, 0x3f3f
je 0x101aa026
test ebx, ebx
je 0x101aa051
mov esi, dword [ebp + 0xc]
mov edx, ebx
xor ebx, ebx
jmp 0x101aa051
test ebx, ebx
mov eax, edx
cmovne eax, ebx
cmp byte [esi + 2], 0
mov ebx, eax
je 0x101aa066
cmp word [esi], cx
je 0x101aa045
cmp byte [ebp + 0xb], 0x3f
mov eax, 2
je 0x101aa04a
mov eax, 3
add esi, eax
cmp byte [esi], 0
je 0x101aa066
inc edx
cmp edx, dword [ebp - 4]
jb 0x101a9fd4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x103934bb
Capabilities:
Check for software breakpoints

Disassembly:
and dword [esp + 8], 0x79831d60
push ebp
add dword [esp + 4], 0x6c1d6
mov ebp, 0x6caf2bb0
sub dword [esp + 0x10], 0x6f1379f9
call fcn.103b5451
dec edx
jne 0x104d8b8b
pop esi
cmc
not ecx
test edi, ebx
mov dword [edi], ecx
mov ecx, dword [esi]
clc
cmc
lea esi, [esi + 4]
cmp si, bp
cmp ch, 0xcc
stc
xor ecx, ebx
cmp ebp, 0x40c32829
neg ecx
cmc
test dx, sp
bswap ecx
test ax, 0x26a
cmp si, 0x792c
xor ecx, 0x59aa004a
cmc
sub ecx, 0x2517030e
jmp 0x104f37fa
push ebp
ret
movzx esi, byte [eax]
xor esi, ecx
jmp 0x10510090
xor ebx, ecx
add ebp, ecx
jmp 0x1048f3e2
and esi, 0xff
cmc
stc
cmp di, si
mov esi, dword [esi*4 + 0x10532a5c]
test esi, esi
shr ecx, 8
cmp edi, esi
jmp 0x1053f365
xor ecx, esi
inc eax
cmp dh, dh
xor ecx, 0x874432e
jmp 0x103934de

Function at 0x103c2b14
Capabilities:
Encode data using xor

Disassembly:
add dx, dx
mov ecx, dword [esp + 0x28]
xor ebp, ebp
sub dl, byte [esp + 0x31]
call fcn.104b5fce
inc esi
invalid

Function at 0x103c4a29
Capabilities:
Encode data using xor

Disassembly:
xor ecx, 0x22ad5bee
mov esi, ecx
call fcn.1035f23e

Function at 0x103cb9a3
Capabilities:
Encode data using xor

Disassembly:
jne 0x103cb9d4
xor dword [esp], ebp
inc ecx
pop esp
inc ecx
test cl, bl
dec ebp
arpl bp, bp
dec ebp
add edx, ebp
jmp fcn.10371680
mov dword [esp + 0xc], 0x7f296f34
nop
sub dword [edi - 0x70], edi
call fcn.105254e2
xor bh, byte [eax - 0x31]
push 0x41
adc eax, 0x16efc6e2
inc ebp
movsb byte es:[edi], byte [esi]
enter 0xffffffffffffa648, 0x23
adc ch, byte [ecx + 0x3253d097]
div esp
push eax
jp 0x103cb9a9
push 0xffffffffffffffa2
cmp dword [ebp + 0x22], ecx
jne 0x103cb98e
invalid
invalid
Function at 0x103e0594
Capabilities:
Encode data using xor

Disassembly:
call fcn.10361a24
loope 0x103e059d
ret
cmp byte [edx + 0x46], 0xc7
or cl, byte [ecx]
mov bh, 0x32
lcall 0xffe7, 0xbfe8f4b8
wait
mov al, byte [0x6358e9f9]
mov dh, 0x4f
mov byte [edi - 0x299059bb], al
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
salc
in al, 0x55
daa
or byte [ebx - 0x4e], 0xa4
xor byte [edi + 0x54], bh
stosd dword es:[edi], eax
push ebx
or eax, dword [edi]
outsd dx, dword [esi]
lcall 0x2bba, 0xc4065878
fucom st(1)
fld xword cs:[esi - 0xad45022]
lodsd eax, dword [esi]
jecxz 0x103e05b7
jbe 0x103e0625
sub byte [esi + edx*2 - 0x1330fff5], 0x10
add eax, 0xa6c21fa7
js 0x103e061f
add al, byte [esi - 0x441ee4c6]
imul esp, dword [edi - 0x69eb37b3], 0x656754b8
dec ecx
pop ebp
sub eax, 0x8622a66f
pushal
jbe 0x103e067f
sub al, 0x3f
cli
jmp 0xaa952141
and ebx, dword [ecx - 0x60]
add byte [edi + esi*4 + 0xaf7f6b6], dh
insb byte es:[edi], dx
test bl, ah
mov dword [edx + edi*4 - 0x480bc24b], ecx
retf 0x3c74
mov dh, 0xf6
test dword [edx], 0x89e3846c
invalid
mov eax, dword [0x3558f839]
enter 0xfffffffffffffa50, 0x2c
jbe 0x103e06d9
fisttp word [edx + 0x5112253b]
pop esp
pushal
push es
and al, 0xf6
fld xword [edi + 0x57]
push edi
inc esp
clc
fidiv dword [edx + ecx*2]
mov al, byte [0x3939cb17]
out dx, al
adc ah, ch
dec edx
in al, 0x9a
dec edi
push edi
xchg edi, eax
pop ss
xor dl, byte [eax]
sbb byte [ebx + 0x51], 0x3c
mov bh, 0x58
in eax, dx
out 0x5d, eax
push 0x3c7a50e
or edx, dword [esi + 0x24]
sub byte [esi - 0x282c98a3], bl
add dword [eax + esi*4 - 0x78], 0xfb75baaf
jnp 0x103e0666
adc dword [ebp - 8], edx
test byte [ecx - 5], 0x34
test dword [ebp - 0x9e501f9], edx
push eax
jae 0x103e066b
test al, 0x13
iretd
invalid
je 0x103e0727
push edx
retf
mov edi, 0x694b07a9
jns 0x103e0782
jne 0x103e06cb
test eax, 0xd8ea7418
movsb byte es:[edi], byte [esi]
xchg esi, eax
and byte [eax], al
cli
insd dword es:[edi], dx
sar edi, 0xff
invalid
popfd
or al, 0x4f
insd dword es:[edi], dx
inc ebp
and cl, byte [esi + edi + 0x1000000]
push esp
xchg edx, eax
pop ecx
jmp 0x103e073a
Function at 0x103f627d
Capabilities:
Encode data using xor

Disassembly:
pop esi
mov ecx, dword [esi]
cmp dx, bp
cmc
add esi, 4
stc
xor ecx, ebx
bswap ecx
test bl, cl
cmp cl, 0xc2
clc
sub ecx, 0x15cf3e36
clc
test ch, 0xec
cmp di, 0x1ef1
bswap ecx
add ecx, 0x30db662f
cmp cl, al
xor ecx, 0x54b77c01
cmp bp, 0x46de
cmc
xor ebx, ecx
add ebp, ecx
jmp 0x104659b6
lea esi, [esi + edi - 0x49ac7243]
cmp bl, 0xf6
mov ebp, 0x5a5b1432
lea ecx, [edi + ebx*8 + 0x492063d7]
push 0x20b132a0
je 0x1039cf58
push ebx
sub ebx, dword [esp]
xchg dword [esp + ebp - 0x5a5b140e], esi
push esi
push edx
mov esi, 0x3215f9c
not bp
mov edi, dword [esp + 0x24]
call fcn.1045ee6b
movzx eax, byte [esi]
add edx, edi
add esi, 1
mov edx, eax
xor al, bl
bt edx, 0x83
not al
and dx, 0x429e
neg dl
neg al
sbb dh, 0xcf
xor al, 0x2c
xchg dh, dh
cdq
dec al
bts edx, ebp
bswap edx
xor bl, al
btr edx, ecx
btc edx, esi
or edx, esp
push esi
push ebp
shl dl, cl
adc dx, ax
sub dh, bl
push ebx
mov ebp, edi
rol dl, 0x56
or dl, bl
mov ebx, eax
sub dl, 0xdc
mov edx, ebx
shl edx, 2
mov eax, ebp
cmp bl, bl
test cl, 0x2e
add eax, edx
cmc
stc
cmp edi, ebp
mov dword [ebp - 4], eax
jmp 0x105113d6
push ebp
jno 0x1038902b
push eax
stc
sub ebx, 1
jmp 0x10400836
jne 0x1054189f
mov eax, dword [ebp]
jmp 0x104ebc29
jmp ebp
call eax
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov edi, ebp
not bh
sal ebp, 0xd
add ecx, 0x6df75767
pop ebx
pop ebp
shld esi, edx, 0xc8
jmp 0x1035e0c7
test ebx, ebx
jmp 0x10541899
je 0x1040083c
mov eax, dword [ebp + ebx*4]
jmp 0x103fd2de

Function at 0x1041355a
Capabilities:
Encode data using xor

Disassembly:
call fcn.1037bdd5
imul eax, dword [ecx], 0x71
xor dword [eax + 0x573b76e6], ebx
xchg ebp, eax
inc ecx
sti
inc esi
adc byte [edx], dh
imul edi, dword [ebp + 0xf8ab748], 0xcc68290b
push edi
sub esi, dword [edi + 0xb]
movsb byte es:[edi], byte [esi]
invalid

Function at 0x104182ba
Capabilities:
Encode data using xor

Disassembly:
call fcn.104a5bd1
jno 0x104182d0
mov dh, 0x74
sub byte [ecx + 0x73], 0x44
mov bh, 0x9a
pop es
lds esp, [0xe51fc468]
jnp 0x104182dd
sbb al, 0xb6
or ah, dh
pop ebp
cmc
xor ebp, 0x9ae244f9
invalid
lcall 0x8c39, 0xe975c28d
imul edx, dword [ebp + 0x4a], 0x34836b9c
out dx, eax
invalid

Function at 0x1043bec5
Capabilities:
Encode data using xor

Disassembly:
dec ecx
test esp, edx
test bl, 0xa1
xor ebx, ecx
jmp 0x103d3f50
add edi, ecx
jmp 0x104ca1df
je 0x10409513
push esi
cmovne esi, ebx
clc
movzx esi, byte [edx]
xor esi, ecx
and esi, 0xff
cmc
test ah, 0xde
stc
mov esi, dword [esi*4 + 0x103d27b0]
shr ecx, 8
test esi, esp
xor ecx, esi
inc edx
cmc
xor ecx, 0x2e2066c1
dec eax
jne 0x104094e5
pop esi
not ecx
stc
test bh, 0xa1
clc
mov dword [ebp], ecx
shrd ecx, edi, 0x97
sbb cl, 0x14
mov ecx, dword [esi]
add esi, 4
test si, 0x3463
xor ecx, ebx
xor ecx, 0x66696170
jmp 0x1046c5c5
push esi
push edi
mov dword [esp + 0x20], edi
call fcn.10541488
mov edx, dword [ebp]
bt eax, esp
sal eax, cl
mov eax, dword [ebp + 4]
cmc
cmp si, bx
add ebp, 4
cmc
clc
xor ecx, ecx
test eax, eax
jmp 0x104094da
inc ecx
xor ecx, 0x4c3b2e38
neg ecx
jmp 0x103c80ae
push edi
ret
Function at 0x1049ab68
Capabilities:
Encode data using xor

Disassembly:
setae bl
call fcn.104cbcef
pushfd
push ebp
mov ebp, 0x74f71bec
push dword [esp + 4]
popfd
mov dword [esp + 4], 0xfaaf6ede
pushfd
xor ebp, 0x42ef0fa6
push ebp
or dword [esp], 0x428a5b5a
mov ebp, dword [esp + 8]
jl 0x103b28bd
cmp word [esp], 0x7544
call fcn.103c8878
neg ecx
not ecx
test bp, 0x6589
add ecx, 0x54603836
jmp 0x104b9f0f
xor ecx, ebx
cmp edi, 0x50935de6
bswap ecx
test ebp, 0x4bb93d44
cmp cl, 0xbc
jmp 0x1042524e
mov ebp, dword [esp + 0x18]
mov ebp, dword [ebp + esi - 0x84bb701]
jle 0x103b28aa
mov dx, word [ebp]
rol cl, 0x7a
mov cl, byte [ebp + 2]
lea ebp, [ebp - 2]
test esi, 0x43280217
shr dx, cl
mov cx, 0x2219
xchg cl, cl
mov word [ebp + 4], dx
movzx cx, cl
xchg ecx, ecx
pushfd
btc ecx, 0x38
pop dword [ebp]
rcr ecx, cl
movzx ecx, bx
sub esi, 4
rcl ch, 0x9e
rol cl, 0xb3
mov ecx, dword [esi]
jmp 0x1046d25f
xor ebx, ecx
add edi, ecx
jmp 0x104ebe84
jmp fcn.104e80cb

Function at 0x104cbcef
Capabilities:
Encode data using xor

Disassembly:
jb 0x1052bd11
call fcn.10406a6c
nop
push edx
lea ebp, [ebp + ebp + 0xfc937ee]
mov ebx, dword [esp]
not word [esp + 0x14]
seto dl
seto bl
add word [esp], 0x1920
mov ebx, dword [esp + 0x10]
mov ebx, dword [ebx + ebp - 0xfc937ee]
lea edx, [ebp + edx*2 + 0x72ee6f1b]
call fcn.105179c2
jmp fcn.1046e34f
Function at 0x44d7f8
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44d844
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44d829
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44d839
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44d854
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44d893
test ebx, ebx
je 0x44d868
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44d85d
cmp ecx, 0xfff1
jb 0x44d876
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44d97e
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44d8b8
Function at 0x461ab8
Capabilities:
Encode data using xor

Disassembly:
and cl, byte [ecx + 0x590dbcaa]
mov bh, 0xb
adc bl, byte [ecx + 0x79fb5461]
sti
mov dword [ebp*4 - 0x1ee086dc], esp
loopne 0x461ad6
test bl, 0xfe
invalid
or ebp, dword [ebp + 6]
sar byte [ebp - 0x43465963], 0xa3
retf 0xa3a4