joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa81012
Capabilities:
Encode data using xor

Disassembly:
push edi
mov dword [esp + 4], 0xa12766f6
lea esp, [esp + 4]
call fcn.00a891ad

Function at 0xad76e8
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x930c941f
pushfd
mov ebp, dword [esp + ebp + 0x6cf36be9]
mov dword [esp + 8], 0xa124e1dc
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.00a891ad
mov ecx, 0xad24d799
movzx eax, cx
mov eax, dword [esi + eax*2 - 0x1af32]
lea edx, [ecx*8 - 0x1a518670]
lea esi, [esi + edx - 0x4ed53654]
xor eax, ebx
shr edx, 0xc4
dec ecx
sbb dx, 0x13
sbb eax, 0xf522ee0e
sub dx, 0x540e
imul ecx, ecx
ror eax, 3
sar dl, 5
shl ecx, 0xf5
inc eax
call fcn.00abf628
mov byte [0x9859de53], al
loopne 0xad76f5
mov word [eax + 0x44], gs
push ds
push edi
into
wait
or eax, 0xba64086c
xchg ebx, eax
clc
loopne 0xad777a
inc edx
mov ebx, 0x196dcf87
pop ebx
outsb dx, byte [esi]
sar dword [ebp - 0x4e], cl
mov dword [ebx - 0x378892f3], edx
push esp
inc esi
cmp eax, 0xba5e8402
cmp eax, 0xba5e8402
push edi
loopne 0xad77fe
cmp byte [edx - 0x59df0873], dl
fcom dword [0x8d543bbb]
nop
xor dword [esi + 0x3aa372d3], ebx
mov dword [eax + 0x7c], esp
movsd dword es:[edi], dword [esi]
cdq
xchg edi, eax
je 0xad77c0
pop ss
ret 0xcf41
aad 0x9a
test dword [ebx + ebp*8], 0xe8ed71d5
xchg esi, eax
or byte [0x82ae93f], bl
nop
fsub qword [edi + 0x14]
mov bh, 0x4b
retf
out dx, al
xchg edx, eax
xchg esi, esi
outsd dx, dword [esi]
leave
out 0x1b, eax
dec esp
jle 0xad786b
fucomp st(5)
cld
dec edx
xor dword [ebp + edi - 0x37], eax
in eax, 0xea
adc dword [ecx + 0x2063dc2], esp
sub ch, byte [edi + ecx*8]
and al, 0xf3
mov al, byte [0x71951d7b]
mov cs, word [eax + 5]
jp 0xad77ef
adc dword [eax - 0x71], edi
out 0xe9, al
pop es
lcall 0x2e2e, 0xcd501cd4
push cs
sbb al, byte [edi - 0x66]
aam 0xd9
test dword [edi - 0x60371379], esp
iretd
pushfd
jne 0xad78a6
fstp dword [esi - 0x7f]
outsd dx, dword [esi]
mov edi, 0xc1a134de
add al, 0x7c
invalid
push ds
shr dword [ebp - 0x28], 1
fnsave dword [ebp - 0x39]
shl dword [esi + 0x18d36a01], 1
jg 0xad790e
fisub dword [edx + 0x1a20b139]
pop edi
out dx, al
pushal
push ss
aad 0x12
mov eax, dword [ecx - 0x4f]
dec eax
mov edi, dword [edx + 0x7f]
out 0x5c, al
sbb eax, 0xb5a5f3ea
mov dl, byte [ebx]
invalid
mov eax, 0x980adae0
push esi
in eax, dx
cmp ecx, dword [ecx + 0x5f]
add dh, dh
popal
xchg ebp, eax
and edi, esi
or dword [ebp + 0x2b], 0xf0907604
sbb al, bh
mov ds, word [edx + eax*2 + 0x6d]
invalid

Function at 0xaef303
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movzx ecx, byte [edi + edx - 0x581aff01]
lea edi, [edx + edi - 0x581aff00]
xor cl, bl
bt edx, 0x27
jae 0xbc55ca
mov eax, 0xde0a591f
sub esi, 4
shr eax, 0xf
mov edx, eax
movsx ecx, dl
mov edx, dword [eax + esi - 0x1bc14]
xor edx, ebx
lea eax, [ecx - 0x5e6d0ecb]
inc edx
rol edx, 2
call fcn.00cdde3f
movsx eax, cx
mov cx, word [edi + eax*2 - 0xa69a]
sub eax, 0x4eaf98a2
cwde
adc edi, 1
ror eax, 0x83
and al, al
call fcn.00d35bf2
Function at 0xaff62f
Capabilities:
Encode data using xor

Disassembly:
xadd ax, cx
adc esi, edx
cwde
pop edx
lea ebp, [ebp + eax*4 - 0x10185]
movsx edx, cx
movzx eax, byte [ebp + ecx - 0x73aa0000]
shl dl, 0x83
xor al, bl
call fcn.00a5815f
movzx eax, dl
ror ecx, 2
sub eax, eax
cbw
neg ecx
lea ecx, [ecx + edx*2 - 0x74d3fd45]
bswap ecx
sar dx, 0xa
shl edx, 0x81
not ecx
lea ecx, [ecx + eax*2 - 0x2c9f5e87]
bts dx, dx
cbw
xor ebx, ecx
call fcn.00acf264
mov edx, 0xba185022
movzx ecx, dx
bt edx, ecx
mov ecx, dword [ecx + edi - 0x5022]
mov eax, dword fs:[ecx]
mov dword [edi], eax
lea eax, [edx*2 + 0x2c993eae]
call fcn.00a78ed3
aas
sal esp, 0x1f
cmp al, byte [0x397c7976]
movsb byte es:[edi], byte [esi]
mov ecx, 0x8006d34d
push ecx
mov al, byte [0x28dc75ec]
inc ebp
adc esi, dword [edi]
outsb dx, byte [esi]
mov esi, 0x97c486be
xchg ah, ch
aad 6
xor eax, 0x578d1375
mov esi, 0xd7ac96ac
clc
arpl word [ebx + 0x354b2aa], dx
jb 0xaff690
mov es, word [eax - 0x77fd4f8a]
pop es
das
das
cli
sahf
and ecx, dword [esi - 0x70]
add edx, dword [eax + ebp*2 - 0x63]
mov bh, 0x94
inc edi
leave
int 0x29
invalid
Function at 0xb0a1b6
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esi + eax - 0x1660003]
mov cx, word [edx + esi - 0x660001fc]
neg edx
adc esi, 5
or dx, dx
adc dword [esp + 1], edx
mov word ss:[eax], cx
pop edx
pop edx
jmp ebp
xor edx, dword [edx + ebp]
xor cx, 0x5f1c
xor ecx, 0x801458b5
xor edx, ebx
or al, cl
call fcn.00cc8785
not ecx
shl dl, 0x63
ror edx, 0xc9
neg ecx
xor ebx, ecx
neg ax
btr edx, edx
adc dx, dx
adc esi, ecx
mul eax
mul dl
cdq
fadd qword [edx + edi]
movzx ecx, ax
or edx, esi
jmp edx
imul ecx
inc dword [esp + 4]
mov dword [edi], edx
call fcn.00afae3a
mov eax, 0xef989438
movsx ecx, al
lea esi, [ecx + esi - 0x3c]
shr eax, 0x21
mov edx, dword [esi + eax - 0x77cc4a1c]
btc ecx, eax
xor edx, ebx
xchg cx, ax
sal al, 0xc4
dec edx
bswap eax
xor edx, 0x229b8c18
sar cl, 0xc3
xadd ecx, eax
ror edx, 2
lea edx, [eax + edx + 0x3c31c995]
or eax, eax
xor edx, 0x93af3507
add cl, ah
sub ax, cx
sbb ecx, eax
not edx
cwde
xor ecx, ecx
xor ebx, edx
bswap ecx
lea ecx, [eax + eax*2 + 0x6d992a24]
add ebp, edx
bts cx, 0x32
rdtsc
btc cx, cx
sub cl, ch
or cx, cx
lea edi, [ecx + edi - 0x6d99c30a]
bt ecx, ecx
setb cl
xor ecx, ecx
mov dword [ecx + edi + 4], eax
lea eax, [ecx*2 - 0x2eebae8]
xchg ecx, eax
ror ax, 0x6c
mov dword [eax + edi], edx
bts eax, 0x22
mov edx, eax
or dl, ch
jne fcn.00c1fa2e
mov eax, 0xe9a4d72a
mov edx, eax
jmp 0xc172e6
div eax
and dl, ah
jle 0xa581bb
mov edx, 0xa51c21b2
movzx eax, dl
cwde
mov eax, dword [eax + esi - 0xb2]
push edx
lea ecx, [edx + edx*2 + 0x7da3a1b8]
lea esi, [esi + ecx - 0x6cf806ca]
or edx, edx
xor eax, ebx
btr dx, 0x1a
call fcn.00c865aa
call fcn.00d19e13
rol dx, 0x28
xor ecx, 0x3dac9424
sub ecx, 0x808e723d
rol ecx, 2
sub dx, ax
xor ebx, ecx
and eax, edx
adc esi, ecx
movzx cx, byte [edi]
imul al
rol eax, 0xd1
mov dl, byte [eax + edi - 0x189b0]
lea edi, [edi + eax - 0x189b0]
sar eax, 0xde
neg eax
adc cl, dl
inc al
mov word [edi + eax*4 - 4], cx
sal eax, 0x6d
mov edx, 0x22a4540c
lea eax, [eax*2 - 0x61dce3f6]
jmp esi
mov eax, dword [edi]
bt edx, edx
mov ecx, edx
mov cl, byte [edi + 4]
adc edi, 5
xor edx, edx
jnp 0xb1e41d
bt edx, edx
mov byte ss:[eax + edx], cl
xor edx, edx
mov eax, edx
lea ecx, [edx + eax*2 + 0x3fa8a6a1]
lea ebp, [ebp + edx*2 - 4]
xor ecx, ecx
jle 0xad3c03
Function at 0xb1e6fb
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
movzx ecx, word [esp + eax - 0x639c33b1]
ror edx, 3
mov dword [esp + ecx*8 - 0x3f060], 0x3a977a0d
xor edx, 0x602e41a3
sal dword [esp + eax - 0x639c33b5], 0xac
lea edx, [eax + edx + 0x66976f67]
and word [esp + eax - 0x639c33b3], cx
not edx
xchg ecx, eax
sar word [esp + eax - 0x7e08], 0x4a
shl cx, 0x6e
xor ebx, edx
inc al
add ebp, edx
btr eax, 0
mov eax, dword [edi + eax*2 - 0xfc18]
jb 0xc7152a
mov edx, 0x598512bc
mov ecx, dword [esi + edx - 0x598512bc]
lea esi, [esi + edx - 0x598512b8]
sal edx, 0x7a
xor ecx, ebx
dec ecx
rol ecx, 3
inc ecx
xor edx, edx
neg ecx
xor ecx, 0xd9b3d22f
add edx, edx
xor ebx, ecx
add ebp, ecx
mov ecx, 0xb121d09f
add edx, dword [edx + edi]
push ecx
dec word [esp]
mov cl, byte [edi + 4]
mov eax, dword [esp]
shr al, 0x85
adc eax, eax
lea edi, [edi + eax - 0x6243a007]
shl eax, 0x7f
and eax, eax
div byte [esp + eax - 0x7fffffff]
shr edx, cl
btr ax, ax
xchg dword [esp + eax - 0x80000000], eax
sbb ax, ax
mov dword [edi], edx
movsx edx, al
mov dword [esp + edx], ebp
ret
rol ecx, 0x15
movsx edx, word [esp + ecx*8 - 0x639c3c]
mov ecx, dword [ecx + edi - 0xc7384]
xchg dword [esp + edx - 0x1e], edx
setae byte [esp + edx*2 - 0x3eec019c]
mov dword [esp + edx*2 - 0x3eec019c], ebx
lea ebx, [edx*4 - 0x296a894b]
cpuid
jb 0xb146f0
jae 0xaf2be9
jmp 0xc37b6d
Function at 0xb20dc2
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp + edx - 0x6307aaaa]
lea eax, [edx + edx*2 + 0x60a6418e]
mov word [ebp + edx - 0x6307aaa8], cx
pop edx
pop eax
pop eax
jae fcn.00bc3641
and dword [esp + eax*4 - 0x5ab8], eax
ror dx, 0xaf
mov dword [esp + eax*2 - 0x2d5c], esi
ret
rol al, 1
inc ecx
xadd cx, dx
mov dword [esp + ecx - 0x71488aa8], 0x5b8bc1b0
xor bl, al
and byte [esp + edx - 0x6307aaa1], dl
setl byte [esp + edx - 0x6307aaa5]
ror dword [esp + ecx - 0x71488aa4], 0x83
lea eax, [esp + eax + 8]
push ecx
jae 0xce6eda
not word [esp + edx - 0x1e26]
dec eax
not eax
xor ebx, eax
mov dword [esp + edx*2 - 0x3c4c], edx
push edx
add ebp, eax
movzx eax, dl
movzx ecx, dl
shl dx, 0x2e
lea esi, [esi + edx - 0x8002]
mov ax, word [esi + edx*2 - 0x10000]
xor ax, bx
dec ax
add cl, ch
inc dword [esp + edx - 0x7ffe]
sal ecx, 0x95
xor ax, 0x97b9
pop ecx
and dword [esp + edx - 0x8000], 0x40f1f8f
inc edx
adc ax, 0xaba5
xor ax, 0x8b1f
xor bx, ax
pop edx
dec cx
push ecx
sub edi, 4
shl dword [esp], cl
mov dword [esp], edx
mov dword [edi], eax
inc cx
shl edx, 0xb2
sbb dword [esp], edx
pop eax
jle fcn.00c1fa2e
mov ecx, 0x48821c17
mov eax, ecx
mov edx, dword [edi + eax - 0x48821c17]
jmp 0xd46be0
ljmp 0xd42d:0xc5148d0b
cdq
int 0xb
jg 0xce6e5f
leave
push ds
lea edx, [ecx + edx - 0x220a0b40]
and al, 0xa2
bswap edx
seta al
push ecx
xor ebx, edx
xadd dword [esp + ecx - 0x4d33fdef], eax
push eax
rol word [esp + eax - 0x4d33fdec], 0xe8
adc ebp, edx
inc eax
add word [esp + ecx - 0x4d33fde8], 0x83bf
mov dword [esp + ecx - 0x4d33fdef], ebp
ret 8
inc dword [esp + ecx - 0x71488aa2]
movzx cx, byte [eax + ecx - 0x71488aa8]
jae 0xb0c58c
mov ecx, 0x6c82da15
movsx eax, cl
mov eax, dword [ebp + eax*2 - 0x2a]
not cx
mov cl, byte [ebp + ecx - 0x6c8225e6]
ror dword [edx - 0x25e5f274], 1
jge 0xce6e99
mov edx, 0x5f80a12d
lea ebp, [edx + ebp - 0x5f80a12b]
bts edx, 0x3a
shl eax, cl
or dx, 0x510c
btr edx, 0xb5
rol edx, 0x25
mov dword [ebp], eax
mov eax, 0x42981a98
xor dl, dh
lea esi, [esi + eax - 0x42981a9c]
movzx ecx, dl
and eax, edx
inc al
mov ecx, dword [esi + eax - 0x40180089]
call fcn.00bb1606
test dword es:[esi + 0x65988647], eax
sbb dword [esi - 0x592731de], eax
imul ebp, dword [eax], 1
cmp dword [edi - 0x1a], edx
adc al, dl
add eax, 0xe6726692
jno 0xce6efe
jle 0xce6fe7
fstp xword [esi - 0x22ab467]
out 0x78, al
cmp eax, 0x5e653cd
inc esi
jbe 0xce6f6e
bound ebx, qword [ecx]
in al, 0x36
jo 0xce6f8d
or dword [ecx - 0x122265a2], eax
cmp eax, 0xb5770114
int 0x74
push ebx
clc
fild qword [edi]
xchg ebp, eax
fbstp tbyte [edi + edi*2]
lodsd eax, dword [esi]
push es
mov edx, 0xbef782bf
xchg edx, eax
les eax, [edi]
xor al, 0xed
movsb byte es:[edi], byte [esi]
inc eax
xchg byte [ebx + 0x48], bl
rcr eax, 1
invalid
or dword [esp + eax*2 - 0x29b4d36c], edx
xor ecx, 0x643d1e28
dec ecx
sal eax, 0xff
shr dx, 0xed
xor ebx, ecx
shl dword [esp + eax], 0x41
bswap edx
adc ebp, ecx
mul ax
mov dword [esp + eax*2], ebp
ret
xor cx, ax
add cl, byte [edi + eax - 0x48821c13]
sar eax, 0xa6
call fcn.00d3ae0f
Function at 0xb46b75
Capabilities:
Encode data using xor

Disassembly:
lea eax, [eax*8 + 0x513eab1a]
add edi, 6
pop eax
mov word ss:[ecx], dx
mov ecx, dword [esi]
mov edx, 0xa6087d85
jge 0xb46b95
cmpsb byte [esi], byte es:[edi]
lea edx, [edx*8 + 0x7e1c4e32]
movsx eax, dx
lea esi, [esi + eax - 0x3a56]
xor ecx, ebx
not ax
dec ecx
xor ecx, 0xc4b41282
dec dx
sub ecx, 0xb22b6384
not al
xor ecx, 0x9104c931
rol edx, 0x65
xor ebx, ecx
ror ax, 0xa7
btr dx, ax
mov bl, 0xc2
ret 0x78e8
call fcn.00a56d46
mov al, 0x63
rol dword [edi - 0x5fb83663], 1
dec edi
test dword [edx - 0x4e5657bc], 0xec2785be
pop edx
cdq
push 0x49
pop ss
jae 0xb46b8b
xchg ebp, eax
dec esi
adc byte [ebp + ebp*2 + 0x688b496b], al
jae 0xb46bc8
popfd
mov dword [0x94ca3f55], eax
inc ecx
outsb dx, byte [esi]
test al, 0x7a
out 0xe1, eax
std
sal edx, 1
jg 0xb46bc7
pop ecx
pop es
outsb dx, byte [esi]
push 0xe1c124fb
lodsb al, byte [esi]
shl byte [esi + 0x51c7bbf], 1
lodsb al, byte es:[esi]
les edx, [edx]
ljmp 0x902c

Function at 0xb5a948
Capabilities:
Encode data using xor

Disassembly:
rol al, 1
or dx, cx
xor bl, al
sub dx, 0x9392
push ecx
lea edi, [ecx + edi - 0xfe46]
bswap ecx
mov dword [ecx + edi - 0x42fe0000], eax
pop eax
jae fcn.00cbac6c
sal ecx, cl
imul ecx, ecx
seto cl
neg al
xchg ecx, edx
ror al, 1
shl dl, 0x61
and dx, 0xc5bc
not al
and dl, ch
jle 0xafee2f
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp]
movzx edi, si
call fcn.00b44a1b
adc ah, byte [eax]
jecxz 0xb293d0
pop ds
invalid
fnstenv [edx + ecx*2]
adc edx, dword [edx - 0x33]
dec ebp
scasd eax, dword es:[edi]
in al, dx
pop eax
jno 0xb293b0
pop ecx
adc ebx, ebp
jecxz 0xb2937f
int3
mov edi, eax
mov dword [esp], 0xe8aa3885
cld
jmp 0xb2939f
Function at 0xb7120d
Capabilities:
Encode data using xor

Disassembly:
lea edx, [eax + eax*2 - 0x3b6613e8]
lea ecx, [ecx + eax*8 + 0x5421134b]
bt dx, ax
rol ecx, 3
xor ebx, ecx
add esi, ecx
rol edx, 0xa
mov eax, dword [eax + edi - 0x1cb]
mov edx, dword [edx + edi - 0x67c5e70e]
mov ecx, 0x8d3df215
adc edi, 8
btc cx, cx
mov dword fs:[eax], edx
movzx edx, cx
jae 0xd46415
mov dword [0x341fe386], eax
mov al, 0x85
lodsb al, byte [esi]
aas
xchg edx, eax
push 0xfffffffffffffff9
add byte [edx + 0x4f], dl
loopne 0xb23592
stc
stosd dword es:[edi], eax
xchg edi, eax
jge 0xb23586
adc bl, dh
invalid
in al, dx
pushfd
inc ebx
invalid
call 0x27950203
call 0xd49a42ca
or ebp, 0xffffffeb
cmp ebp, edi
insb byte es:[edi], dx
xchg ebp, eax
stc
jge 0xb2355a
jmp 0xb235cd
arpl word [edx - 0x9457eb0], bx
push 0xffffffffffffff83
sti
mov ecx, dword [ebp + 0x40e93583]
or dh, byte [ebx]
mov dword [0x3bf830b7], eax
push ebp
outsd dx, dword [esi]
cdq
bound ecx, qword [ebp - 0x4cd7e6d0]
inc esp
push cs
pop ebx
int 0xc6
pop ebx
jecxz 0xb235cb
or dl, byte [ecx + 0x1b]
movsb byte es:[edi], byte [esi]
xchg edi, eax
cwde
jno 0xb23621
push ecx
sbb esp, dword [edi + edx*4 + 0x11597198]
mov dword [0xb1f3e96c], eax
adc dword [ebx - 0x4e0c1694], esp
jmp 0x20cae7c3
mov cl, 0x18
and byte [ecx + 0x24], al
rcl bl, 1
ret 0x9d97
sbb byte [eax], ah
inc ecx
and al, 0xd0
rol edx, cl
xchg edi, eax
popfd
mov dword [0xf691a883], eax
or byte [ebp - 0x74], al
std
scasb al, byte es:[edi]
pop ecx
cmc
mov ebp, 0x99317432
shl dword [ebp - 0x53fa1975], 0x3e
dec eax
call 0xd203ecab
stc
jo 0xb23667
or eax, 0x32969db6
jo 0xb235c0
sbb byte [esp + edi*2 + 0x65], dh
mov bl, 0x83
mov bl, 0x83
cmp byte [edx - 0x7908e87f], 0x2b
mov eax, 0xff0d602b
pop esi
jne 0xb23602
push 0x82974443
mov byte [0xafb9f5a1], al
retf
invalid
invalid
mov dword [esp + eax - 0xffff], 0xc83b2b14
neg ecx
xor eax, eax
rol edx, 0x17
not eax
sbb ecx, 0x40a0b13c
call fcn.00d113e8
sub ebp, 4
mov eax, 0x489a2838
mov ecx, dword [ebp + eax - 0x489a2838]
xor ecx, ebx
neg al
rol ax, 0x24
jbe 0xc77b98
dec ecx
ror ecx, 2
movzx edx, al
idiv eax
btr eax, eax
not ecx
jae 0xb234d6
mov edx, 0xa133290f
shl dl, 3
sbb esi, 4
movsx eax, dl
movsx ecx, ax
and cx, cx
mov ecx, dword [eax + esi - 0x78]
rol dl, 0x65
xor ecx, ebx
lea edx, [eax*8 + 0x5722b713]
btr eax, 0x2f
add ax, 0xc83c
ror ecx, 2
btc ax, dx
dec ecx
mul dl
rol ecx, 2
bswap eax
inc al
cdq
xor ecx, edx
sub ecx, 0xda374cb8
cwde
xor ecx, 0xf92b1792
imul dx, dx
inc al
jmp esi
Function at 0xb9b565
Capabilities:
Encode data using xor

Disassembly:
add ecx, ecx
bswap ecx
mov ecx, dword [esp + ecx + 0x4b6bb439]
mov dword [esp + 8], 0xb4f20555
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00bfde90
mov eax, 0xcf9d9c84
mov edx, dword [edi]
rol ax, 0x4c
or eax, 0xa596d6a7
adc edi, 4
not eax
call fcn.00cada2f

Function at 0xba08a6
Capabilities:
Encode data using xor

Disassembly:
add eax, eax
xor dl, bl
add al, ah
mov dword [esp + eax*2 - 0x15535ab2], 0xbaa6be82
not ax
sbb dl, 0x3c
not dl
ror dword [esp + eax - 0xaa952a6], 0xda
btc ax, 0x92
dec dl
xor eax, dword [esp + eax*2 - 0x1552a544]
or dword [esp], eax
add ax, word [esp]
xor dl, 0x12
cwde
xor bl, dl
xor al, al
or byte [esp + 3], 0x2f
lea edx, [esp + edx + 4]
shl word [esp], 0xec
btr ax, ax
mov word [edx], cx
ror ax, 0x6f
mov eax, dword [esi]
adc esi, 3
xor eax, ebx
call fcn.00b07d4e
dec eax
nop
xchg byte [esi], al
adc byte [0xdfa32a54], ah
not dword [ebx + esi*8]
shr dword [edi - 0xfc9e159], 1
pop esp
jle 0xba08a8
cmp eax, 0x3d3c1883
dec ebx
salc
outsd dx, dword [esi]
mov dword [eax], eax
inc esp
mov esp, 0xc5f31ebe
adc dl, bl
stosb byte es:[edi], al
mov ebx, 0x41233906
xor eax, 0x8ee32017
movsb byte es:[edi], byte [esi]
sbb eax, 0x86fd5aed
movsb byte es:[edi], byte [esi]
pop ds
imul ebx, dword [esp + edi], 0xffffff8b
inc eax
dec esp
pop ebp
adc cl, byte [edi + 0x22]
push ebp
mov byte [0x285fd1ed], al
dec eax
imul ebp, ebp, 0x2a
out 0x27, eax
adc dh, dl
pop ds
wait
cmpsb byte [esi], byte es:[edi]
in eax, dx
mov byte [0x5bdf047d], al
adc cl, byte [edi + 0x67]
xchg ecx, eax
xchg byte [edx], dl
imul eax, ebp, 0xdc98edc0
out dx, eax
dec edi
sbb dl, byte [edx]
add eax, 0xf4e2a4a
scasd eax, dword es:[edi]
leave
neg ax
sar cx, cl
dec ax
neg dx
jnp 0xa67e75
Function at 0xbddfd1
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00d2f1be
inc edx
rol ax, 0x26
rol edx, 1
lea eax, [ecx*4 + 0x25af23a2]
mov dword [esp + eax + 0x555073f2], 0xd895ad0c
xor ebx, edx
shr ecx, 0xb5
call fcn.00cf8ecc
ja 0xccd0ee
js 0xbddffa
cli
invalid
jbe 0xc14346
stosd dword es:[edi], eax
inc esp
jge 0xbddfd8
mov dword [0xfd46a9f7], eax
call 0x2068e4c
insb byte es:[edi], dx
fnstcw word [edi - 0x212386fe]
mov edi, 0x75bfdffe
clc
test eax, 0x326114fe
push ebx
std
out dx, al
rcr byte [ecx + eax - 0xb], cl
out 0x55, eax
inc ebx
inc ecx
add dword [esi - 0x5b], esp
cmpsd dword [esi], dword es:[edi]
add cl, byte [ebx]
xchg esp, ebx
ror byte [ebx - 0x4f608977], 1
std
and dh, byte [esi - 0x66]
push eax
push esi
jle 0xbddffc
lodsb al, byte [esi]
mov ah, 0x84
mov fs, edx
push edx
mov bh, 0xf2
wait
xchg ebx, eax
mov ch, 0x2f
push 0xffffffffffffffb5
jb 0xbde088
fisubr dword [ebp + 0x50]
and ch, byte [esi]
out dx, al
std
iret
sahf
test dword [esi], 0xf6c28b8c
clc
xor ecx, ebx
call fcn.00b85048
jns 0xb9e99c
mov ecx, 0x70159188
call fcn.00caeadf
push ebx
mov ebx, edi
shr ebx, 0xd3
mov edi, dword [esp + 8]
mov dword [esp + 8], 0x3fd267f8
mov ebx, dword [esp]
jbe 0xbddff4
push 0xf0a9dd9a
mov eax, 0x2c200eaa
btr ax, ax
movzx dx, byte [eax + edi - 0x2c200aaa]
lea ecx, [eax + eax*8 + 0x6a2068b1]
ror ecx, 0x51
shl dword [esp + eax - 0x2c200aaa], 0xfa
mov cl, byte [eax + edi - 0x2c200aa8]
sar ax, 0x29
lea edi, [edi + eax*2 - 0x58400008]
not eax
and al, 0x81
shr dl, cl
inc word [esp + 1]
call fcn.00a59b25
push edi
mov edi, 0xb5bc680a
pushfd
and edi, 0x4e8d009e
jg 0xc26047

Function at 0xbe5652
Capabilities:
Packed with generic packer

Disassembly:
add ebp, edx
mov dword [esp], ecx
cdq
ror edx, 0x32
pop ecx
pop ecx
pop eax
jb fcn.00be019c
mov edx, 0xa7888125
jmp 0xc75e43
fld qword [ecx + edi - 0x12]
neg word [esp + ecx - 0x11]
adc byte [esp + ecx - 0x10], 0x85
shl dl, 0x84
mov dword [esp + ecx*4 - 0x48], esi
ret
movsx ecx, dl
lea ebp, [ecx + ebp - 0x29]
push edx
mov eax, dword [esp + ecx - 0x25]
ror eax, 0xea
mov eax, dword [ebp + ecx*4 - 0x94]
ror edx, 0x64
or ecx, 0x32b2c4bc
xor eax, ebx
btc dx, cx
sub ecx, 0x273ec291
inc eax
ror eax, 2
neg byte [esp + edx - 0x5a78a810]
xadd edx, ecx
ror edx, 0x63
sbb eax, 0xa312c9a4
rol eax, 1
ror dx, 0x21
lea eax, [edx + eax - 0x3c80827c]
not ecx
ror eax, 1
shr cl, 0x44
ror dword [esp], cl
inc eax
xor ebx, eax
shr dword [esp], 0x36
not cx
xchg dword [esp], ecx
adc esi, eax
and dword [esp + ecx - 0x12], 0xf34fd92
jno 0xc716ec
movzx ecx, ax
xor edx, ecx
pop ecx
jno fcn.00be019c
sar eax, 0x37
rol edx, 3
lea edx, [edx + ecx - 0x7678dee7]
not cl
neg edx
cwde
xor eax, dword [esp + eax + 8]
pop ecx
xor ebx, edx
add ebp, edx
and eax, ecx
call fcn.00c6f0fb
Function at 0xbf754d
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.00b0aba9
dec dword [esp + ecx*4 - 0xffff80]
inc eax
and cx, word [esp + ecx*2 - 0x7fffbe]
ror dl, 0xc7
not eax
mov word [esp + ecx - 0x3fffde], 0x7c27
sal dl, 0x44
adc ecx, 0x123eaaae
xor ebx, eax
lea edx, [ecx + ecx - 0x13cdc5ca]
sal ecx, 0xec
xchg word [esp + edx*2 - 0x225f1ea7], cx
add esi, eax
movsx eax, cl
xchg byte [esp + edx - 0x112f8f54], cl
pop edx
jmp fcn.00cc1810
mov word [eax + edi - 0x198c], dx
not ecx
sal eax, cl
jb 0xb1b1f7
lea ebp, [ebp + eax*2 - 4]
add al, 0xb5
mov edx, ecx
mov eax, dword [ebp + eax*2 - 0x16a]
neg cx
add dx, dx
xor eax, ebx
bswap eax
dec eax
shr dx, 0x6a
rol ecx, cl
ror ecx, 0x2c
ror eax, 3
push edx
jmp 0xba0f0a
jbe 0xc44d78
jae 0xb66c10
mov eax, 0xc8a7a61f
sub ebp, 2
movzx edx, word [ebp]
xor dx, bx
dec dx
not eax
bts eax, eax
rol dx, 1
movzx ecx, al
inc dx
shr ecx, 0xcd
btr cx, 0x16
jae 0xc9335d
call fcn.00b36b47
or dx, ax
shr cx, 0x4e
not dx
mov eax, dword [esp]
mov word [eax + ebp - 0x2514009f], dx
inc eax
call fcn.00c64016
call fcn.00cf1510
xor dx, 0x20b8
shr ecx, 0x30
inc dx
rol dx, 1
btc eax, 0xae
btr ecx, 0xbf
xor bx, dx
bts eax, eax
lea edi, [edi + eax - 0x375819e5]
cwde
sal al, 0x42
jnp 0xbd5783
mov eax, dword [esi]
add esi, 4
mov ecx, 0x2a2fc903
mov edx, ecx
xor eax, ebx
imul cx, cx
bswap eax
setb cl
xadd ecx, edx
xor eax, 0x50890387
ror eax, 1
shr edx, cl
btc edx, 2
lea eax, [ecx + eax + 0x7aa3fe2b]
or cx, cx
rol eax, 1
add ecx, 0xe0959324
sal ecx, cl
lea edx, [edx + ecx*8 - 0x29dc7b70]
xor ebx, eax
imul ecx, edx
lea ecx, [edx*4 + 0x4c124d09]
add ebp, eax
fld qword [ecx + edi - 0x51714cd9]
ror cx, 0xa6
jmp ebp

Function at 0xc2a6b8
Capabilities:
Encode data using xor

Disassembly:
sar eax, 0xfa
pop eax
add ebp, edx
movsx eax, cx
movzx eax, byte [esi + ecx*2 - 0x72633418]
lea esi, [ecx + esi - 0x39319a0b]
movzx edx, cl
xor al, bl
ror al, 1
jmp 0xbf5d60

Function at 0xc2bf40
Capabilities:
Encode data using xor

Disassembly:
sal edx, 0xb9
adc ebp, 2
ror dx, 1
shl edx, 0xef
shr al, cl
inc dl
bts edx, edx
mov word [ebp + edx*2 - 6], ax
call fcn.00ac5701
xor eax, ebx
and dx, dx
push ecx
and edx, 0x243de3bf
sbb eax, 0xaf2df5b1
dec edx
xchg cl, dl
bswap eax
dec eax
bswap eax
or dx, dx
xor ebx, eax
add ebp, eax
sub dword [esp + edx - 0x3023d1], edx
pop eax
not ax
mov eax, dword [esi + edx*2 - 0x6047a2]
shr cl, 0xc4
mov edx, dword [edx + esi - 0x3023cd]
lea ecx, [ecx - 0x42732c41]
mov cl, byte [esi + ecx - 0x67f58bb8]
push 0xc0d7a12
mov dword [esp], 0xe19ef697
sar dword [esp], 0xb
adc esi, 5
shrd eax, edx, cl
mov dword [esi], eax
mov edx, 0xcb5a3b6
neg edx
jle 0xb31d5d
pop ecx
jmp ebp
rol edx, 2
mov eax, dword [esp + 4]
bswap edx
call fcn.00cf10e1
movzx ax, byte [ebp]
mov edx, 0x7f8b5a9a
imul dx, dx
movzx ecx, dx
mov cl, byte [edx + ebp - 0x7f8ba4a2]
ror dl, 0x47
jae 0xadaee7
mov ecx, 0x71be5900
mov cx, word [edi + ecx - 0x71be5900]
jmp 0xc84e37
Function at 0xc2e174
Capabilities:
Encode data using xor

Disassembly:
imul edx, edx
lea esi, [esi + ecx - 0x8007]
xchg ch, dl
and dx, cx
mov ecx, dword [ecx + esi - 0x903]
sets dl
sar dx, 0xaf
xor ecx, ebx
mov eax, edx
xor edx, eax
xor ecx, 0xb98d6915
bts edx, edx
xchg edx, eax
bswap ecx
not edx
jae 0xd3580e
inc ecx
pop ecx
pop eax
pop eax
pop ecx
jnp fcn.00bc3641
mov ecx, 0xd026179b
sub esi, 1
movsx eax, cl
cwde
or ax, ax
movzx edx, byte [esi]
bswap ecx
not cl
sar ecx, cl
xor dl, bl
shr cx, 0x65
dec dl
shr ecx, cl
sal eax, 0xf
xor dl, 0x10
shr eax, cl
add dl, cl
xor dl, 0xb3
add dl, cl
neg al
dec al
ror dl, 1
sar ax, 0x8a
bts eax, eax
bt ax, cx
xor dl, 0x86
shr ax, 0xa6
bt eax, eax
xor bl, dl
inc ecx
rol eax, 0x46
adc edx, esp
inc cl
add cl, cl
btr ax, cx
add al, byte [edx + ecx*2 - 0x10004]
inc cl
movzx edx, cl
jg 0xcee401
lea edi, [edi + ecx*2 - 0x10008]
neg edx
btc edx, 0xb1
mov word [edi + ecx*2 - 0x10006], ax
jb 0xa8d74d
ja fcn.00c1fa2e
push edi
mov edi, 0x748379a7
pushfd
shr di, 0x4d
push edx
add edi, 0x883ccb81
mov edi, dword [esp + 8]
mov dword [esp + 8], 0xa12559ba
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00a891ad
mov eax, 0xc8131034
add edi, 8
mov dword fs:[edx], ecx
mov ecx, eax
mul eax
bts dx, cx
jmp ebp
ror ecx, 3
lea ecx, [ecx + eax*2 - 0x5b218f16]
neg ecx
xchg edx, eax
rol eax, 0xfe
xor ebx, ecx
sub eax, edx
adc ebp, ecx
xadd dx, ax
jp 0xd07fad