joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8853ff
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x8e029d
push 0x72b49af
pushal
mov dword [esp + 0x24], 0xc111d984
pushal
pushfd
push 0x4940283b
lea esp, [esp + 0x4c]
jmp loc.0041c59c

Function at 0x891a9c
Capabilities:
Packed with generic packer

Disassembly:
aas
invalid
xor dword [ebx - 0x40c28d44], edi
jo 0x891a48
je 0x8919ed
add eax, 0x6a279fcc
test byte [eax], 0x2f
int3
or byte [edi], ch
je 0x891a1f
inc edx
imul eax, dword [ebp - 0x60], 0x3f
push edx
inc eax
jecxz 0x891984
sbb esi, edi
invalid
jmp 0x891a46
and byte [edi], 0xe2
cmp al, 0xbd
pop ebx
jne 0x8919de
add dword ss:[ebp - 0x57b0d830], ecx
add dword [ebp - 0x57b0d830], ecx
shl byte [edi], 1
dec edi
test al, 3
in eax, dx
add ebp, ebp
mov cl, 0xdd
mov esp, ds
jns 0x8919e7
jne 0x891ad0
mov esi, 0xa267201
sub al, 0x2c
and eax, 0x19081813
jbe 0x891a56
inc esi
add ah, dl
xor al, 0x7f
rcl dl, 0x3a
lodsd eax, dword [esi]
sub byte [ebp - 0x10], bl
jns 0x891a95
jl 0x891a94
pushal
hlt
and al, 0x44
and al, 0x44
call fcn.006fcac9
mov ah, 0x72
jo 0x891af5
jmp 0x891a3d
shl dword [eax - 0x69518405], 0xfb
movsb byte es:[edi], byte [esi]
fild qword [edi - 0x6f]
jns 0x891ac8
cld
push ecx
add cl, byte [ebp - 0x2b]
add byte [eax + 0x5248bef3], bl
xchg edx, eax
mov ecx, 0x1a705605
ljmp 0xd925
push 0x2614709
insd dword es:[edi], dx
mov eax, dword [0xee82255d]
xlatb
test al, 0x6f
and esp, dword [ecx]
invalid

Function at 0x895510
Capabilities:
Packed with generic packer

Disassembly:
call fcn.008b3ad4
shl bp, 7
bswap bp
mov ebp, 0xdebeae41
cmc
sub eax, eax
pushal
mov ebp, dword [esp + 0x20]
pushal
mov byte [esp + 8], 0x83
push dword [esp + 0x44]
ret 0x4c
mov dword [esp + 0xc], 0x85e57c
pushal
call fcn.0088c6e6
loope 0x7c0a48
xor cl, byte [esi - 0x5f585c06]
iretd
sbb al, 0x81
invalid
lea esp, [esp + 4]
pushfd
cmp byte [ecx], al
push dword [esp]
lea esp, [esp + 0x30]
jb 0x8b3f7b
jne 0x7d0b31
stc
mov eax, dword [ecx + 1]
clc
add eax, edi
bt bp, ax
add eax, 0x1383dcce
cmc
push 0xe18214e0
xor eax, dword [ecx + 0x19]
pushal
lea esp, [esp + 0x24]
je 0x786d45
pushal
xchg dword [esp + 0x1c], ebx
call fcn.008bf9da
adc dword [ebx], ebx
inc esi
jp 0x895506
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
mov ah, 0xe3
push ss
dec byte [eax + 0x3b19263a]
dec edx
xor byte [esi], 0x6e
and ah, byte [ecx]
jae 0x895529
enter 0x1482, 0x46
ret
pushal
lea esp, [esp + 0x20]
jne 0x7d0b31
das
mov eax, dword [ecx + 1]
stc
pushfd
pushfd
add eax, 0x1383dcce
stc
push dword [esp + 4]
xor eax, dword [ecx + 0x19]
mov byte [esp + 4], 0x76
pushfd
pushfd
call int.00717372
xchg dword [esp + 4], esi
not bx
lea esp, [esp + 4]
jle 0x6f9505
mov esi, eax
bswap ebx
pushfd
push 0x3f2220d9
mov dword [esp + 4], edi
not bl
lea ebx, [esi + 8]
push edi
jmp 0x8c67ce
push dword [esp + 4]
mov dword [esp + 8], ebx
pushfd
mov byte [esp + 8], 0x25
push ebp
jmp 0x7c0a14
Function at 0x89bd3e
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
pushfd
mov dword [esp + 0x24], 0xe272fbe
push 0x6813f0d6
mov byte [esp], 0x15
lea esp, [esp + 0x28]
jmp fcn.0041ce55
jmp 0x793f3d
call fcn.009173eb
push dword [esp]
mov word [esp + 0x14], bp
mov dword [esp + 0x34], ecx
call fcn.007367eb
push ebx
pushal
lea esp, [esp + 0x24]
js 0x8d1f26
pushfd
mov dword [esp], 0xbea839b6
jnp 0x87811d
pushal
mov dword [esp + 0x1c], 0xe272fbe
mov byte [esp + 4], bl
push dword [esp]
pushal
lea esp, [esp + 0x40]
jmp fcn.0041ce55
outsb dx, byte [esi]
insd dword es:[edi], dx
out dx, al
out dx, al
in eax, 0x53
retf 0xeef4
xchg ecx, eax
stosd dword es:[edi], eax
jae 0x8d1ee0
dec eax
popfd
sub dword [ecx - 0x68], edi
cmpsb byte [esi], byte es:[edi]
sub al, 0x77
imul edx, dword [edx], 0x33dac1bc
cmpsb byte [esi], byte es:[edi]
fstp qword [ecx]
dec ecx
into
add byte [eax], cl
test al, 0x69
inc edi
mov dl, 0xac
sbb dword [ebp + ebp*4 + 0x69330b09], ecx
pop eax
insd dword es:[edi], dx
adc eax, dword [edi - 0x1c]
outsb dx, byte [esi]
sbb edi, dword [esi - 0x4a]
pop edx
inc esi
aas
mov bh, 0xaf
and ah, bl
mov esp, 0xd679590e
push 0xffffffffffffffb2
dec esi
pop ss
adc al, 0x6b
xor ebx, 0x34
sbb bl, 6
push es
wait
xor edi, ecx
and al, 0x62
jns 0x8d1ebe
invalid
call fcn.008b77ed
xor eax, 0xe5be02e8
xchg edx, eax
cmpsd dword [esi], dword es:[edi]
jo 0x8d1ed3
loop 0x8d1fa4
jo 0x8d1fa0
or ch, byte [ebx + 0x606c62bd]
cmp ecx, dword [edx]
mov word [ecx + 0x5ea9b727], ss
sbb cl, 0x4c
sub al, byte [esi]
test dword [esi + 0x19], eax
and esi, dword [eax + 0x6ac741a9]
mov esp, 0x25ef1307
adc al, 0xa8
mov ebp, 0x8a5705e5
mov eax, dword [0x9d65ef3]
call 0x2f3b7345
xchg ecx, eax
in eax, 0x4c
mov byte [0xe165977e], al
mov al, 0x83
mov byte [esi - 0x7c], al
insd dword es:[edi], dx
mov eax, 0x8e3f32cc
out 0x27, eax
jecxz 0x8d1f40
cmp dword [0x79e7990e], 0x17
pushal
invalid
sar ah, 0x67
jo 0x8d1f78
push es
popal
invalid

Function at 0x8a0169
Capabilities:
Encrypt data using rc4 prga
Packed with generic packer

Disassembly:
lea esp, [esp + 0x44]
jl 0x5ea127
not bx
pop edi
lea eax, [0xfd2c17f]
movsx ax, bl
lahf
mov eax, 1
push esp
pop ebx
pop ebx
call fcn.0073402e
pushal
mov dword [esp + 0x1c], 0xbf513c46
jmp 0x88efc3
pushal
lea esp, [esp + 0x24]
je 0x7c017c
movsx ax, al
bswap ax
movzx eax, word [edi]
dec ch
pushal
sete cl
push dword [esp + 8]
movzx ecx, word [edi + 2]
mov word [esp + 4], 0x7910
mov dword [esp], 0xdbb22046
inc ebx
test bl, cl
stc
add eax, ecx
jmp 0x8ab28b
mov byte [esp + 4], bh
mov byte [esp], 0x29
pushfd
mov dword [esp + 0x1c], 0xf564e249
mov byte [esp], 0xf
pushfd
pushal
lea esp, [esp + 0x40]
jmp loc.0041c59c
cmc
jmp 0x8bfe19
pushal
clc
cmp ebx, eax
mov byte [esp + 4], 0xe1
jmp 0x73b3ca
test eax, eax
jmp 0x85fa2e
Function at 0x8a4283
Capabilities:
Encode data using xor

Disassembly:
push 0xfcdbe76f
lea esp, [esp + 4]
jle 0x8d6f25
pushal
push esp
lea esp, [esp + 0x24]
je 0x90573d
lahf
pop edi
pushfd
pushfd
mov esi, dword [esp + 8]
pushal
mov eax, ebx
call fcn.008739aa
arpl word [ebp - 0xa], di
jns 0x88109d
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
mov ch, 0xe4
out 0xde, al
ror dword [edi + edx*2 - 0x5eb11a1d], 0xe2
lds ebp, [edx - 0x73cef904]
mov bh, 0xad
mov byte [ecx - 0x5d], bh
push esi
stosb byte es:[edi], al
std
sub al, 0xe2
xor ebx, dword [ebx + 0x17]
inc ebx
scasb al, byte es:[edi]
add dword [edi - 3], ebx
invalid
push 0x2449b051
lea esp, [esp + 4]
je 0x90573d
call fcn.009098c6
loop fcn.00898a9f
leave
add dword [ebx - 0x6a], edi
cmpsd dword [esi], dword es:[edi]
xchg ecx, eax
iretd
lea esp, [esp + 4]
jo 0x881079
je 0x90573d
cwde
call fcn.008f2d3f
pop eax
wait
stosd dword es:[edi], eax
pop ds
ret
jmp 0x898ac4

Function at 0x8a96c9
Capabilities:
Packed with generic packer

Disassembly:
push 0xbf7f8f76
push esp
mov word [esp], bx
pushal
mov dword [esp + 0x20], 0x1319ed1
push 0x3a8394e6
mov byte [esp], 0x7e
pushfd
mov byte [esp + 4], ch
lea esp, [esp + 0x28]
jmp fcn.0041c325
stc
bt cx, 0xb
test esi, esi
call fcn.0091dd4c
pushal
jmp 0x7d40ae
call fcn.006fbd3d
jmp 0x70735f
lea esp, [esp + 0x40]
call fcn.00887a97
lea esi, [esp + 0x42e2a1a5]
lea esi, [ebx + 0x84b1e5d]
dec esi
mov esi, eax
jbe 0x78e1d6
push 0x42c0b78c
bt cx, 6
cmc
test esi, esi
jmp 0x7b76e0
Function at 0x8ac783
Capabilities:
Encode data using xor

Disassembly:
call fcn.0071cff8
inc edi
inc ecx
jbe 0x8ac7e0
xchg ebp, eax
cmpsd dword [esi], dword es:[edi]
fst dword ds:[edx + 0x25]
invalid
wait
add dword [ebp + 0x1f7801f8], ecx
pop ebp
pop ss
sar dword [esi + 0x62196f22], 1
mov al, byte [0x476f73]
sub eax, dword [eax + 0x3aad8903]
sub ebx, dword [esi + 0x7e]
je 0x8ac843
outsd dx, dword [esi]
inc edi
add byte [ebx], ch
add byte [ebx], 0x89
lodsd eax, dword [esi]
cmp ch, byte [ebx]
pop esi
jle 0x8ac861
push ebp
loop 0x8ac83c
aad 0xa8
mov ah, 0xf8
das
pop ds
in al, dx
mov byte [ebx - 0x52], bl
call [edx - 0x4d3f915d]
jmp 0x8ac7cf
pushfd
mov dword [esp + 4], 0xb810c5e6
call fcn.008e8277
push esp
out 0x11, al
adc byte [eax + 0x3ba2de8], bh
add byte [esi + 0x11], dl
scasd eax, dword es:[edi]
cmp al, 0x95
cmpsd dword [esi], dword es:[edi]
jg 0x8ac85e
jl 0x8ac85d
sbb dl, byte [ebx]
mov byte [ebp - 0x2e], bh
loopne 0x8ac8cd
in eax, dx
ltr word [esi - 0x686a0242]
add byte [esi - 0x686a0242], bl
std
xchg ebp, eax
xchg edi, eax
fadd dword [ecx - 0x416d977]
xor eax, 0x340703bb
ljmp 0x2797
cmp byte [ecx], 0x2e
jp 0x8ac8e0
push cs
add dh, bl
sub dh, ch
mov eax, 0x3ad7b68e
pushfd
retf
lcall 0x328e, 0x6bf6dbdc
cmp eax, 0x2bfca795
jbe 0x8ac940
or bl, dl
dec ebp
add bh, ah
lodsd eax, dword [esi]
mov edi, 0x5e136664
inc ebx
pushfd
xor al, 0x9f
pop ss
cmp dword [edx], ebp
rcl byte [eax - 0x5d], 0xd1
xchg ebx, ecx
push esp
cdq
pop ds
mov ebx, 0x83653dc5
xchg edi, eax
je 0x8ac8f1
jge 0x8ac8d1
jp 0x8ac8f0
frstor dword [ebp + 0x3e]
sub ebx, dword [edi - 0x280ea2c3]
sub dl, byte [0xc60ab700]
fsub qword [edi + 0x43389c7d]
test al, 0xf5
pushfd
xchg ebp, eax
sub byte [eax - 0x7e], bh
rcr dh, 0x19
pop edx
leave
xchg esi, eax
mov bh, 0xc1
push 0xffffffffffffffcd
out 7, eax
das
and eax, 0x33d56a97
or al, 0xaa
pop edi
push ecx
xchg edx, eax
cmp dword [edi - 0x6b31bd5d], eax
dec edx
mov dword [0x4a94ce42], eax
pop ebx
pop esp
cdq
jl 0x8ac94d
popal
les edx, [eax - 0x69a22c8b]
xchg esp, eax
push dword [edx]
dec edx
mov ebp, dword [ebp + 0x3e]
into
mov eax, 0x7fee3f13
adc edi, dword [esi - 0x2f]
push ebp
test al, 0x94
xchg ebp, eax
or dword [ecx], ecx
and al, byte [ebp + edi - 0x544295f7]
pop edi
int3
Function at 0x8c9cc9
Capabilities:
Packed with generic packer

Disassembly:
jo 0x8d8872
pushfd
test edi, edi
pushal
push 0xe540d46d
mov word [esp + 8], di
lea esp, [esp + 0x28]
je 0x8f902c
rcr dl, 3
cmc
push 0x62f2c0d1
or dh, 9
mov edx, dword [ebp + 0xc]
pushfd
cmp eax, 0xa64e70ef
bt ax, 5
jmp 0x912410
pushfd
lea esp, [esp + 0x28]
je 0x74250b
jmp 0x867a66
jmp 0x8b588d
clc
call fcn.00774efa
lea esp, [esp + 0x38]
jl 0x869026
mov si, 0x4525
cwde
not ax
pop edi
pushal
mov esi, dword [esp + 0x20]
call fcn.008e926a
push esp
dec esi
dec edi
jbe 0x8d8916
xchg edx, eax
cmpsd dword [esi], dword es:[edi]
sbb al, 0xa5
das
cmp dword [ecx + 0x1a], esi
xor al, 0xd5
sub byte [edi - 0x1fe88e7b], bh
in eax, 0x4f
pop ss
loopne 0x8d8890
dec edi
lds ebp, [eax]
jmp 0x12a6d93
add bh, byte [edi + 0x79]
or al, byte [esi + 0xc6f4db9]
cmp ebp, dword [bx + si + 0x67a1]
cmp al, 0x5c
pop esp
daa
dec byte [eax + 0x2ac7c553]
stc
movsd dword es:[edi], dword [esi]
xchg edi, eax
dec ebp
cwde
adc al, 0xc
pop edi
xlatb
push es
dec edi
mov eax, 0xc7ee1bf0
daa
sub eax, 0x53c94fe1
loope 0x8d893c
leave
push ebx
jle 0x8d88fb
dec eax
sbb esi, 0xffffffd6
inc edi
mov bl, byte [ecx]
mov bh, 0xf2
pop esp
inc ebp
or byte [eax - 0x61ae4425], bl
and dword [edi - 0x18b5b6a], esp
in al, dx
loope 0x8d8941
cmp eax, 0x492c8e2f
cmp eax, 0x492c8e2f
pop edx
mov bh, 0x4b
pop ecx
test al, 0xa5
sal byte [esi], 0x8c
inc eax
jae 0x8d88a8
fisttp qword [edi]
pop ss
and byte [edi - 0x76], cl
cdq
dec edi
jg 0x8d88fa
stosd dword es:[edi], eax
push ebp
inc ebp
stc
sub al, 0x26
and ebp, edx
nop
js 0x8d88c1
test dword [ecx], edx
mov dword [0xb0117d29], eax
jns 0x8d88eb
jbe 0x8d8976
cmp dword [esi + 0x5993f0b5], eax
xchg byte [ebp + 0x745993f0], dh
invalid
pop ecx
je 0x8d890a
xor dword [ecx + 0x43a014ab], ebp
or dword [esi + esi*2], esp
mov byte [ecx - 0x2ddc5072], dh
cwde
cwde
retf
imul ebx, ecx, 0x53
mov dh, 0xce
pushal
push ds
mov dl, 0x68
push ebx
invalid
shr bx, cl
shr si, cl
pop esi
shrd bp, bx, cl
rcl bp, cl
xor eax, eax
movsx bp, bl
bswap ebp
push 0x7e334eb5
mov ebx, dword [esp + 4]
call fcn.008c45c3
test edx, edx
push 0x1f4de744
pushfd
lea esp, [esp + 0x10]
jl 0x8f902c
call fcn.007792e9
bt bx, bp
bt bp, bp
push ecx
call fcn.0092c450
mov dword [esp + 0x3c], eax
push 0x5b9e053
mov dword [esp + 0x3c], 0x8738fd
pushfd
push dword [esp + 8]
mov dword [esp], 0x744fb3e
push dword [0x5fd098]
pop dword [esp + 0x40]
pushfd
pushfd
pushfd
push dword [esp + 0x4c]
ret 0x50
Function at 0x8cf609
Capabilities:
Encrypt data using rc4 prga
Packed with generic packer

Disassembly:
cmp edi, esi
test edx, edx
call fcn.005ea09e
pushal
pushal
mov dword [esp + 0x3c], 0xbffecdfe
mov word [esp], bx
mov byte [esp + 4], 0x1d
mov byte [esp + 8], 0xeb
mov dword [esp + 0x38], 0xde080f04
mov dword [esp], eax
pushfd
lea esp, [esp + 0x3c]
jmp fcn.0041c4eb
add edx, eax
cmc
cmp bl, 0x1f
mov dword [ebp - 8], esi
cmp cl, 0xab
mov dword [ebp - 4], ebx
clc
jmp 0x88a002
mov ecx, dword [ebp + 8]
shrd ax, cx, 2
setne ah
shrd ax, ax, cl
bswap ax
mov eax, dword [ebp + 0xc]
push dword [esp]
stc
cmp eax, dword [ecx]
mov byte [esp], ah
lea esp, [esp + 8]
jne 0x923e6c
ror dx, 5
rdtsc
pushfd
aas
mov dword [esp], ebx
and ah, 6
pushfd
xchg dword [esp], esi
lahf
sub ah, bl
bt si, ax
movzx ax, cl
mov esi, dword [ecx + 0x2c]
das
aas
movzx edx, word [esi]
sar al, cl
movzx eax, word [esi + 2]
cmp ebp, 0x404f14c6
clc
jmp 0x921869
xor ebx, ebx
jmp 0x8c5ded

Function at 0x8e028f
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x38], 0x8aaea4
pushfd
call fcn.0091dd04

Function at 0x8e71bf
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x34], eax
jmp 0x89bd43

Function at 0x8e926a
Capabilities:
Packed with generic packer

Disassembly:
lea ebx, [ebx + 0x3e9159ff]
mov dword [esp + 8], edx
not bx
mov eax, 1
movzx bx, cl
jmp loc.0042742a

Function at 0x8f0d6b
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [esp + 0x30]
lea ebx, [ebp - 0x2cb8f016]
pop ebx
pop ebx
push edx
mov ebx, dword [esp + 0x30]
call fcn.0092c479
mov esi, dword [esi + 0x74]
dec esp
clc
nop
cmpsd dword [esi], dword es:[edi]
inc esi
test byte [esi + 0x2f], bh
inc ecx
out 0x21, al
add eax, 0xdce8565a
pop si
push ecx
leave
jecxz 0x8f0dc8
int3
mov eax, dword [0xd44e4a1]
int3
bound eax, qword [eax + 0x391df2c3]
or dh, byte [edx]
stc
pop ebx
adc eax, 0xc23cc7c9
invalid
cdq
mov ecx, 0xad927b5e
adc eax, 0x2b2a5569
xchg esp, eax
xor dword [edx + 0x30df9385], edi
ficom word [ebx + 0x1ca7f594]
jae 0x8f0db0
dec ebp
sbb eax, 0xce00fec7
push edx
nop
ficom word [ebx]
insd dword es:[edi], dx
or ah, byte [ebp + 0x43baa21e]
push ss
pop edx
popfd
jae 0x8f0da9
cld
invalid
Function at 0x8f8565
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], bh
mov dword [esp + 0x1c], 0xbf792a06
push dword [esp + 4]
jmp fcn.0071b6d0
pushal
jmp 0x5ed6ce
dec ebp
sbb eax, 0xafad98db
push esp
in al, dx
jae 0x8f8482
pushal
invalid
ja 0x8f8421
sbb al, byte [ebx + 0xba64bee]
mov dword [eax + 0x3852492c], 0xd3b9882d
cmp dword [esi - 0x3aeed78a], ebx
xor esp, dword [edx - 0x53]
add byte [ecx + 0x22], ah
aas
inc ebx
adc dword [ebp - 0x78], esp
sub al, 0x24
dec eax
rcl dword [edi + 0x28a69a2f]
mov byte [edi - 0x6c], al
int 0x6f
push ds
stc
sbb al, byte [eax + 0xd8c595f]
jg 0x8f8458
aaa
push edi
jl 0x8f848c
insb byte es:[edi], dx
xchg edi, eax
mov dl, 4
ret
inc ecx
cmp ecx, dword [0x3967f49f]
lds edx, [ecx]
jl 0x8f84a5
aam 0xb2
mov esp, 0xfbe9ba79
sar edi, 0x11
mov eax, es
xchg ecx, eax
aas
mov dword [0x3875f69], eax
add eax, edi
lea edi, [edi + 0x388b1648]
lcall 0xefc8, 0xb66497df
enter 0xffffffffffffad1f, 0x69
push ebx
sahf
sar byte [eax - 0x1b], cl
insb byte es:[edi], dx
aas
invalid
cld
popal
or eax, 0xebc9cd49
aas
lcall 0x26ae, 0x917b5884
imul esi, dword [eax + ebp*8], 0x1bd1785
xchg ebp, eax
in al, dx
add al, 0x31
jmp 0x8eb4b0
call fcn.005ecff2
jge 0x8f8546
xlatb
out dx, al
jg 0x8f8500
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
sub eax, 0x738ebbcf
ret

Function at 0x90234d
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x18], 0x872bf0
call fcn.0070ee7c
jne 0x5e9010
ror ah, 1
int3
push 0x31f56e6f
movzx edx, word [edi + 8]
lea eax, [edi + 0x73c70588]
call fcn.005ea1c1
movsd dword es:[edi], dword [esi]
xchg edx, eax
test eax, 0x43005fb
inc esp
cmpsd dword [esi], dword es:[edi]
fdiv dword fs:[ebp + 0x40]
push eax
push ecx
xchg edx, eax
add al, 0xa8
cdq
sar byte [esi - 0x17], cl
inc esp
fdivr st(1), st(0)
scasd eax, dword es:[edi]
push esp
jg 0x5e9044
sub dword [ecx], ebx
xchg ebx, eax
dec eax
inc edx
std
cmpsb byte [esi], byte es:[edi]
enter 0x7f65, 0x20
jnp 0x5e8fe0
mov word [edi + 0x32], fs
mov esi, 0x8f94f1c0
out 0xcb, al
out 0xbf, eax
mov dword [0x6962be7e], eax
sbb byte [eax + 0x77], cl
invalid
retf
push dword [esp + 4]
jmp 0x5e8f98

Function at 0x905647
Capabilities:
Packed with generic packer

Disassembly:
je 0x912a32
setbe ch
call fcn.0077bc18
adc al, 0xf1
fxch st(5)
mov al, 0xa7
push ebp
hlt
push ss
adc ebp, dword [edx*2 + 0x424648d]
push dword [esp]
lea esp, [esp + 0x14]
call fcn.005ed390
xor si, ax
inc si
shld si, sp, 3
mov esi, dword [ebp - 4]
pushfd
test eax, eax
lea esp, [esp + 4]
jge 0x90c2a5
invalid
je 0x912a32
push 0xa8d33c72
lea eax, [edi*8 + 0x4df15cfd]
mov byte [esp], al
pushal
mov ecx, dword [ebp + 0x14]
setno al
setne ah
mov edx, dword [ebp - 8]
setno ah
not al
setb al
push edx
mov dword [esp + 0x24], ecx
bswap ax
bswap cx
bswap cx
mov ecx, dword [ebp + 8]
call fcn.007cadb2
daa
jp 0x7b91eb
inc eax
jae 0x7b9212
cmpsd dword [esi], dword es:[edi]
push edx
nop
stosb byte es:[edi], al
dec ebx
inc ebp
push ebx
lodsb al, byte [esi]
invalid
pushfd
jmp 0x7b9201
jmp 0x6f3756
Function at 0x90e580
Capabilities:
Packed with generic packer

Disassembly:
cmp bx, 0xc246
sub cl, 0x5b
bsf edx, ebp
push ebp
test si, cx
sar cx, 0xd
mov ebp, esp
not dx
bswap dx
rcl dl, 2
not ch
mov edx, dword [ebp + 8]
btr ecx, eax
sbb ch, 0x36
rcl cx, 7
movsx ecx, al
push esi
xor ch, al
push edi
not ecx
rol edi, cl
dec di
call fcn.00899624

Function at 0x910620
Capabilities:
Encode data using xor

Disassembly:
add esp, 0x14
jmp 0x8c9b28
shr dword [ebx + 0x2c], 0x7b
add al, cl
inc ecx
test dword [ecx], ebx
daa
enter 0xffffffffffff9fe3, 0xd
mov bl, ah
daa
invalid
push eax
call fcn.006f50d1
in eax, dx
inc eax
inc esi
jp 0x8c9b9c
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
sbb byte [esi + 0x70], dl
adc dword [ebx], eax
add ebp, esi
mov esi, 0x32852833
cmp al, 0x30
sti
shl byte [ebp - 0x426df6c0], cl
xchg esi, eax
jnp 0x8c9ae3
cmp al, 0xd2
in al, 0x6a
in eax, 0xad
cmpsb byte [esi], byte es:[edi]
clc
push ebx
invalid
jns 0x8c9bb0
cli
adc eax, esi
aaa
or dword [ecx - 0x3d967e05], 0x17f8d6a7
cmp ebp, dword [eax + 0x12]
ret 0xa89b
wait
test al, 0xe9
arpl bp, di
and dword [ebx - 0x62], eax
add ebp, dword [edi + 0x212c3eeb]
insd dword es:[edi], dx
int1
inc ecx
lodsb al, byte [esi]
or dword [ebp - 0x34e82c6f], ebx
add edi, dword [edi - 0x2d]
push ds
mov edi, fs
mov bh, 0xe
push 0xffffffffffffff93
cmpsd dword [esi], dword es:[edi]
test byte [esi], dl
xchg ebx, eax
test byte [edx - 0x3e], cl
fdivr qword [ebp + 0x77]
ret
jmp 0x76c33b
Function at 0x9191ff
Capabilities:
Encode data using xor

Disassembly:
bt bp, bp
test bl, 0xbd
cmp esi, 0xffffffff
jmp 0x8a8951
lea esp, [esp + 0xc]
jne 0x88f109
pushal
movzx dx, al
mov byte [esp], ah
seto dh
mov edx, dword [eax + 8]
pushal
jmp 0x88f0c9
call fcn.007095b0
pushfd
pushal
pushal
push dword [esp]
mov dword [esp + 0x44], ebx
push edx
mov word [esp + 0x14], dx
mov dword [esp + 0x44], 0x854fc1
dec edi
test dword [eax], eax
call fcn.00888685
add byte [edx], al
xor dword [edi + 0x3a7a85b], ecx
inc ecx
je 0x77a954
jae 0x77a939
mov dh, 9
invalid
jb 0x77a99b
xor bh, dh
jns 0x77a9cf
inc eax
int3
mov bh, 0x53
test al, 0x3d
stc
arpl word [edx - 0x2bb43b64], dx
xchg dword [edx], esi
pop esi
push eax
sub eax, 0xc77a3be
push cs
dec esp
out dx, al
dec ebp
xor ch, byte [ecx]
push cs
pop ecx
sub eax, 0xa8708ae0
inc edi
push es
in eax, dx
inc eax
outsd dx, dword [esi]
js 0x77a9b3
aad 0xa7
add al, 0x7e
and cl, dl
imul ebp, dword [ebx], 0x56
stosb byte es:[edi], al
add eax, 0xe648c56a
lds ecx, [eax - 0x1a]
adc dword [edi + 5], eax
daa
sysret
jmp 0x77a91f
pushfd
mov dword [esp], 0x74389f
pushfd
push dword [fcn.005fd048]
pop dword [esp]
push 0x3ee866a1
pushfd
mov word [esp], dx
push dword [esp + 8]
ret 0xc
daa
jmp 0x918fe9
mov byte [esp + 8], 0x10
mov dword [esp + 0x3c], edx
push 0x7d193446
lea esp, [esp + 0x40]
call fcn.005f2751
rdtsc
aaa
and dh, ch
add esp, 4
cdq
mov eax, esi
pushfd
not dx
mov edx, edi
lea esp, [esp + 4]
js 0x78c0b9
pushfd
push dword [esp]
push eax
lea esp, [esp + 0xc]
call fcn.007bc08c
call fcn.00791832
xchg si, bp
mov esi, dword [esp + 0x20]
pop ebp
mov ebp, dword [esp + 0x20]
pushfd
push dword [esp + 0x28]
ret 0x30
push ecx
lea esp, [esp + 4]
js 0x7aa7c6
push 0x74389f
pushfd
pushal
pushfd
call fcn.007c3dc9
jne 0x7c2168
pushal
mov dword [esp + 0x1c], ebx
pushfd
lea esp, [esp + 0x20]
jae 0x88f8a8
push 0x74389f
pushfd
pushal
mov dword [esp], esp
push dword [fcn.005fd048]
pop dword [esp + 0x20]
mov word [esp + 4], 0x3553
pushfd
push 0xe7f1b71
push dword [esp + 0x28]
ret 0x2c
mov ecx, dword [edi]
stc
clc
ror al, 1
btc ax, cx
lea eax, [esi + esi*2]
stc
test al, 0x29
push ebx
pushfd
add dword [ecx + eax*4 + 4], 0xffffffff
push esp
lea eax, [ecx + eax*4]
jmp 0x71a4a2
pushal
lea esp, [esp + 0x24]
je 0x70f872
pushfd
inc esi
push ebx
add ecx, 0xc
cmc
clc
call fcn.007cf01a
push ecx
mov dword [esp + 4], 0x90d1b2
push esp
mov word [esp + 4], 0xdb8f
push dword [fcn.005fd048]
pop dword [esp + 4]
push dword [esp]
push 0x639d8fb4
mov byte [esp], dh
push 0x966d7536
push dword [esp + 0x10]
ret 0x14

Function at 0x919249
Capabilities:
Packed with generic packer

Disassembly:
pushfd
xchg dword [esp + 0x2c], edi
not di
lea edi, [edx - 0x1684ec8c]
mov edi, dword [ecx + eax*8 + 8]
push esi
pushfd
mov dword [esp + 0x30], edi
mov byte [esp + 0x10], bh
call int.00920688
Function at 0x929969
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 8], eax
pushfd
call fcn.008f1c78
or byte [eax + ebp*8 - 0x37cfb], bl
jge 0x9299d5
imul cx, word fs:[ebp - 0x2a95d359], 0xff98
pop ebx
adc dword ss:[edi], edi
push ds
mov dl, 0xdd
pop ds
in eax, 0x86
leave
dec dword [esi]
fidivr word [ebx]
xor ebp, dword [ebp + 0x60156c62]
cmp al, 0xe2
mov ah, 0xdf
mov esp, 0x729d1933
jg 0x92996c
pop es
push ebp
mov ebx, esi
mov al, byte ss:[0xd5fbe1cf]
rcr byte [edx], cl
pop ebp
cdq
dec eax
mov edi, 0x80c4fc70
invalid
inc dword [esi - 0x2f]
int 0xd6
pushfd
shl byte [ebx], 1
invalid

Function at 0x92edc1
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
mov ebx, eax
pushfd
pushfd
mov byte [esp + 4], bl
pushal
lea esp, [esp + 0x2c]
jmp fcn.00912a37
lea esp, [esp + 8]
call fcn.007c29bf
pushfd
lea ebx, [eax - 0x18097ca4]
jmp 0x5ea789
push 0x56baddc
rdtsc
movsx ecx, cl
push dword [esp]
mov ecx, dword [ebp + 0x14]
movzx ax, bl
mov edx, dword [ebp - 8]
mov ax, word [esp + 4]
mov dword [esp + 4], ecx
movsx cx, bl
cwde
jmp 0x7ddfde
mov ecx, dword [ebp + 8]
lea eax, [eax*2 - 0x4835f339]
pushfd
mov dword [esp + 4], esi
movzx ax, dl
pushfd
cwde
mov dword [esp + 4], edx
movsx ax, bl
mov eax, edi
push dword [esp]
jmp 0x90489f
mov dword [esp + 0x40], esi
not ax
cwde
pop eax
mov dword [esp + 0x38], edx
setle ah
lea eax, [ebx*4 + 0x4a7ac2bd]
lea eax, [edi - 0x6c8b49b2]
jmp 0x89df0e
mov eax, edi
pushfd
push dword [esp + 4]
push dword [esp]
lea esp, [esp + 0x44]
call fcn.007c29bf
pushal
movzx bx, dl
call fcn.008cee4b
xor eax, 0x25cefcd7
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
les ebp, [ebx + ebx*4 + 0x38d55572]
pop esi
inc ebp
and byte [edx - 0x8b6a256], bh
fdivr st(0)
push edi
dec esi
salc
loopne 0x89df1c
invalid
jmp 0x5eca30
mov word [esp], 0x1bd8
lea esp, [esp + 0x28]
je 0x912a32
pushfd
mov dl, bh
rdtsc
lea esp, [esp + 4]
je 0x7276c3
mov ecx, dword [ebp + 0x14]
push ebp
sete al
xchg dh, al
mov edx, dword [ebp - 8]
bswap ax
push esp
pushal
xchg dword [esp + 0x24], ecx
not ch
cwde
pushal
mov ecx, dword [ebp + 8]
cwde
jmp 0x87b522