joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40770f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
call fcn.00407987
test al, al
jne 0x407724
xor eax, eax
jmp 0x40784b
push ebx
xor ecx, ecx
mov ebx, 0x417dec
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0x407848
push esi
push edi
push 0x800
push eax
mov edi, 0x40f138
push edi
call fcn.0040246e
mov esi, eax
add esp, 0xc
mov dword [ebp - 4], esi
test esi, esi
jne 0x407787
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x407839
push esi
push esi
push edi
call fcn.0040246e
add esp, 0xc
lea ecx, [ebp - 4]
push eax
call fcn.004032ca
mov esi, dword [ebp - 4]
test esi, esi
je 0x407839
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push esi
call edi
mov dword [ebp - 4], eax
test eax, eax
je 0x407839
push str.MessageBoxW
push esi
call edi
mov dword [ebp - 8], eax
test eax, eax
je 0x407839
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_EncodePointer]
call edi
mov ecx, 0x417df0
xchg dword [ecx], eax
push dword [ebp - 8]
call edi
mov ecx, 0x417df4
xchg dword [ecx], eax
push str.GetActiveWindow
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ecx, 0x417df8
xchg dword [ecx], eax
push str.GetLastActivePopup
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ecx, 0x417dfc
xchg dword [ecx], eax
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ecx, 0x417e00
xchg dword [ecx], eax
push str.GetUserObjectInformationW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ecx, 0x417e04
xchg dword [ecx], eax
mov ecx, esi
xor eax, eax
lock cmpxchg dword [ebx], ecx
neg eax
sbb eax, eax
and esi, eax
jmp 0x40783b
xor ebx, ebx
test esi, esi
je 0x407846
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407919
Capabilities:
Create thread
Print debug messages

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004075ca
Function at 0x100465a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f4e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101f9834]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x100465e9
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x101f354c], 0
jne 0x10046600
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x1004664d
mov eax, dword [esi]
test eax, eax
je 0x100465d2
cmp dword [esi + 4], 0
je 0x100465d2
push eax
call fcn.100d8740
add esp, 4
push dword [esi + 4]
call fcn.100d8740
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x1004663e
push eax
call fcn.100d8740
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10046685
push eax
call fcn.100d8740
jmp 0x10046682
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.100d8740
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.100d8740
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.100d8740
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.100d8740
add esp, 4
push 8
call fcn.100d8740
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100466c0
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100d8740
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100e1380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a102e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f9834]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.100e2a90
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.100e2a70
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10159fd0
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x10159fe1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1019d030
movss xmm5, dword [0x101e25d4]
movss xmm4, dword [0x101e25dc]
movss xmm6, dword [0x101e25d0]
movss xmm7, dword [0x101e25c8]
movss xmm3, dword [0x101a83c8]
push esi
xor esi, esi
nop dword [eax + eax]
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub esp, 8
addsd xmm0, qword [eax*8 + 0x101e5600]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm4
movaps xmm1, xmm2
mulss xmm1, xmm5
subss xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100d8740
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100d8740
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, xmm7
add ecx, eax
mov dword [esi*4 + 0x10207160], ecx
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100d8740
movaps xmm0, xmm2
mov edx, eax
mulss xmm0, dword [0x101e25d8]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100d8740
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x101e25c0]
add eax, edx
mov dword [esi*4 + 0x10207960], eax
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100d8740
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, dword [0x101e25cc]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100d8740
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x101e25c4]
add eax, ecx
mov dword [esi*4 + 0x10207560], eax
mulss xmm0, xmm3
subss xmm0, xmm4
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100d8740
movaps xmm0, xmm2
mov dword [esi*4 + 0x10207d60], eax
mulss xmm0, dword [0x101e25e4]
mov dword [esi*4 + 0x10208560], edx
mov dword [esi*4 + 0x10208160], ecx
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100d8740
movaps xmm0, xmm2
mov dword [esi*4 + 0x10208960], eax
mulss xmm0, dword [0x101e25e8]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100d8740
movaps xmm0, xmm2
mov dword [esi*4 + 0x10208d60], eax
mulss xmm0, dword [0x101e25ec]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100d8740
mov dword [esi*4 + 0x10209160], eax
mulss xmm2, dword [0x101e25e0]
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.100d8740
mov dword [esi*4 + 0x10209560], eax
add esp, 8
inc esi
cmp esi, 0x100
jb 0x1019d060
pop esi
ret
Function at 0x100242af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100242be
pop dword [ebp - 0x1c]
mov eax, 0x100242be
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x7c761be
sub dword [ebp - 0x2c], 0xb9751c73
mov dword [ebp - 0x28], 0x23ee96f5
add dword [ebp - 0x28], 0xe44b550
mov dword [ebp - 0x24], 0xf28376d8
sub dword [ebp - 0x24], 0xa63732aa
mov dword [ebp - 0x20], 0xb2bd052a
sub dword [ebp - 0x20], 0xb2bd052a
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x847d7604
sub eax, 0x747a8478
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x18d5821
add dword [ebp - 0x2c], 0x72e51135
mov dword [ebp - 0x28], 0xe782fa3
add dword [ebp - 0x28], 0x32f431d2
mov dword [ebp - 0x24], 0x67fd0054
add dword [ebp - 0x24], 0xfb726c18
mov dword [ebp - 0x20], 0x498946a8
add dword [ebp - 0x20], 0xb676b958
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x45bfc
push 0
call eax
mov ecx, 0x4d0c
xor ebx, ebx
add ebx, eax
mov esi, 0x12e50875
sub esi, 0x2e0a475
add esi, dword [ebp - 0x1c]
mov edi, 0x3cc1550b
sub edi, 0x56319c20
mov dword [ebp - 4], 0x37bf7df9
mov edx, dword [esi]
sub dword [ebp - 8], 0xa41c7ad2
xor edx, edi
sub dword [ebp - 4], eax
mov dword [ebx], edx
add ebx, 0xe17ebd9c
sub ebx, 0xe17ebd98
add esi, 4
loop 0x100243d2
add eax, 0x12703
mov ebx, eax
add eax, 5
mov ecx, 0x3ad2e034
add ecx, 0xd52d1fcc
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x100252bb
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cdfb], 0
jne 0x100252fd
cmp byte [0x1003cdfa], 0
je 0x10025334
movzx eax, bl
mov esi, 0x1003e1a8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.100242af
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10025324
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10025334
push esi
call fcn.10005eb0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cdfb], 0
jne 0x1002534b
cmp byte [0x1003cdfa], 0
je 0x1002537d
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1a8
push esi
call fcn.100242af
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x1002536d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1002537d
push esi
call fcn.10005eb0
pop ecx
mov al, 1
pop esi
ret
Function at 0x401120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, 0xb3
push edi
xor ecx, ecx
lea edx, [eax - 0x6d]
mov ebx, 0x6d36
mov esi, 0x7975
mov dword [ebp - 4], 0x5a42
mov dword [ebp - 8], 0xcf
jmp 0x401150
cmp eax, 0xcf
cmovl eax, dword [ebp - 8]
dec dword [ebp - 4]
jne 0x401150
mov eax, dword [ebp + 8]
test eax, eax
je 0x401245
cmp dword [ebp + 0xc], ecx
je 0x401245
cmp eax, dword [ebp + 0xc]
jae 0x401245
jmp 0x401180
inc ecx
mov eax, ecx
and eax, 0x80000003
jns 0x40118f
dec eax
or eax, 0xfffffffc
inc eax
jne 0x401192
inc ecx
cmp ecx, 0x2b23
jl 0x401180
mov eax, 0x3390
mov ecx, 0x69
cmp edx, ecx
cmovl edx, ecx
dec eax
jne 0x4011a4
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
mov edi, 0x749f
mov dword [ebp + 0xc], eax
lea ebx, [ebx]
mov eax, 0x38e38e39
imul edi
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x4011c0
xor ecx, ecx
mov edi, 0x20b0
cmp dword [ebp + 0xc], ecx
jbe 0x401200
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov al, byte [ecx + edx + 1]
add al, 0x1a
xor byte [ecx + edx], al
inc ecx
cmp ecx, esi
jb 0x4011e5
mov esi, 0x7975
jmp 0x401200
mov eax, 0x38e38e39
imul ebx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401200
mov eax, 0xea0ea0eb
imul edi
add edx, edi
sar edx, 7
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401213
jmp 0x401230
mov eax, 0xb40b40b5
imul esi
add edx, esi
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403270
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x4032cd
mov eax, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [ebp + 0xc]
inc edi
mov bh, byte [edi + ecx - 1]
inc byte [eax]
movzx esi, byte [eax]
movzx edx, byte [esi + eax + 2]
movzx ecx, byte [eax + 1]
add esi, eax
add ecx, edx
movzx edx, cl
mov byte [eax + 1], cl
movzx ecx, byte [edx + eax + 2]
mov bl, byte [esi + 2]
mov byte [esi + 2], cl
mov byte [edx + eax + 2], bl
movzx ecx, byte [esi + 2]
mov edx, dword [ebp + 0xc]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + eax + 2]
xor cl, bh
mov byte [edi + edx - 1], cl
cmp edi, dword [ebp + 0x10]
jb 0x403280
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10001070
Capabilities:
Encode data using xor

Disassembly:
or ecx, ecx
ja 0x10001013
cmp ch, byte [edi]
adc byte [eax], 0xdd
or esi, ecx
mov esp, dword [edi + 7]
push es
aaa

Function at 0x10006020
Capabilities:
Encode data using xor

Disassembly:
cdq
loopne 0x1000601c
jns 0x10005fba
push ss
mov edx, 0xb732e1f0
in eax, dx
mov esi, 0x6b8e92ed
xor al, 0x72
push edx
ret 0xdacc
std
inc ecx
popal
inc esi
cdq
adc eax, 0xa9100a93
xor dh, cl
outsd dx, dword [esi]
fsub qword [esi]
mov eax, 0x6c50bee1
leave
mov ecx, 0x75983e3a
int3
cmp bh, byte [esi]
cwde
jne 0x10005fa2
mov eax, dword [0xfff12e84]
mov esi, 0x4f969c5
invalid
jns 0x10006060
adc eax, 0xec901182
mov eax, dword [0xdcae93f8]
cli
scasb al, byte es:[edi]
fdiv st(2), st(0)
out 0xc1, eax
stc
scasb al, byte es:[edi]
rcl dword [edi - 0x56c2cba6], 0xbf
in eax, dx
or esp, dword [ebp + 0x402b66e]
push dword [ecx]
jl 0x10005fd1
aas
popfd
jo 0x10006012
add byte [ebx + ecx*8], 0x97
mov dl, 0xeb
call 0x75e3ab91
mov edi, dword [edx]
insb byte es:[edi], dx
mov dl, 0x94
jmp 0x6230f288
push ds
and eax, 0x7988e17d
sal dword [eax + 0x7a], 0xb3
cmp al, byte [eax]
test dword [esi], edx
dec ecx
wait
xchg ecx, eax
outsb dx, byte [esi]
cmp al, 0x8b
stc
arpl word [di], di
fmul qword [0x6cc511e6]
ror edi, 0xe7
inc ebx
wait
mov cl, 0xb2
pop esi
mov eax, 0x54d3cff2
call 0xe534b5d4
xor al, 0xd5
pop ds
cmp dh, byte [edx + ebp + 0x27345f90]
cmp dword [eax - 0x2d12f03c], esp
imul ebp, edi, 0x6f
fucomp st(0)
and dh, bh
fisttp qword [ecx + edi*2 - 0x5d25fe8e]
jbe 0x1000608f
out dx, eax
or eax, ecx
sub dword [ecx], ebp
int1
jp 0x100060e8
adc eax, 0xce74e64f
in al, 0xbf
sub dword [ebp + edi*4 + 0x11], ebp
push eax
push edi
jbe 0x10006134
lahf
insb byte es:[edi], dx
xor edx, dword [eax - 0x39f3a763]
invalid
invalid

Function at 0x1000b620
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx + 0x48ea21c], edi
and esi, dword [eax - 0x24]
pushal
popal
outsb dx, byte [esi]

Function at 0x1000b920
Capabilities:
Encode data using xor

Disassembly:
fldenv [ebp + ecx*8 - 0x130b83ab]
movsb byte es:[edi], byte [esi]
pushfd
pop ss
fcmovnbe st(0), st(2)
sal dword [esp + esi*4], 1
or al, 0xbf
lcall 0x1468, 0x11a6c818
cmp edi, ebx
sub dword [edi + 0x3cd6b02a], edi
movsd dword es:[edi], dword [esi]
stosb byte es:[edi], al
sbb dl, byte [esp + ebx*8 - 0x46730608]
mov al, byte [0x26e0d771]
dec edx
xor dword [edi + 0x20], esi
dec ebx
test dword [edi - 0x6bca369], eax
push ebp
aaa
invalid
Function at 0x1000bef0
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xc583aea5]
insd dword es:[edi], dx
rcl dword [ecx - 0x31], 0x9c
sub dword [edx + 0x78c3ea07], esp
sub eax, 0x694a38ee
pop ebp
jns 0x1000be71
shr dword [edx + edi*2 - 0x180a4f01], cl
or dword [eax - 0x3505c127], 0xffffffc5
xor bh, byte [edi]
cmc
mov ch, 0xbe
aam 0x8a
cmc
wait
pop ecx
mov ah, bh
mov bh, 0x6a
and eax, 0x9c2b8f4
xchg esi, eax
push edx
std
mov dh, byte [ecx - 0x250564d7]
dec eax
insd dword es:[edi], dx
fldenv [edi - 0x2455e208]
xchg edi, eax
jecxz 0x1000bedc
lds eax, [edi + 0x7e]
pop esi
and dword [edi - 0x145c447e], 0xe43c9674
neg dword [ebx + 0x7a]
or al, ah
cmp al, 0x54
adc dword [ebx + 0x3245530d], 0x6d
xchg ebx, eax
or eax, 0x6d324553
add dh, dh
js 0x1000bed6
sub ch, byte [esi - 0x2d6e81eb]
das
adc byte [esi], 0x9e
or dword [edx + 0x5178c4b6], ecx
les edi, [eax + 0x51]
mov byte [eax], dh
sbb dword [esi - 0x2b], ebp
lds edx, [edx]
jp 0x1000bf08
cdq
xchg ebx, eax
salc
rcr dword [edx + 0x5f], cl
out dx, eax
mov bl, 0xe1
push 0x7e
enter 0x4b87, 0x35
aam 0x28
mov eax, 0x46274d13
sub byte [esi + 0x7b], dh
into
mov ch, 0x54
je 0x1000be74
invalid
in eax, dx
movsd dword es:[edi], dword [esi]
fcmovb st(0), st(5)
or dword [ecx - 0x5e0e0aad], 0x77
neg byte [ecx + 0x74]
and byte [edi + ecx + 0x25], ah
lodsd eax, dword [esi]
mov dl, 0xc
or al, 0x12
mov ah, 0xe
out dx, eax
insd dword es:[edi], dx
adc edx, dword [ecx]
adc dword [ecx - 0x6f], edi
jns 0x1000be8b
add byte [eax - 0x7f], cl
push eax
dec edi
xor al, 0x87
dec esp
jns 0x1000bef7
or eax, 0x9113bdd2
dec edx
out 0x33, al
sbb bh, byte [esi + ebp*4 - 0xcef7bc2]
mov bh, 0xcb
adc edx, dword [ecx + 0x1a33e64a]
mov esp, 0x10843eae
mov bh, 0xcb
popfd
call 0xda3b6a2e
scasb al, byte es:[edi]
cmp esp, ecx
fdiv qword [ebp - 0x7c4d19c3]
xor eax, 0x939bc0fd
push ebp
mov ebx, 0xbd1ae410
xlatb
fsub dword [eax + esi + 0x2dba90c2]
lds esi, [ebx]
insb byte es:[edi], dx
mov dword [0xe56f37b], eax
cmpsd dword [esi], dword es:[edi]
out 0x42, eax
sub al, 0x40
test eax, ecx
movsb byte es:[edi], byte [esi]
invalid
Function at 0x1000e1f0
Capabilities:
Encode data using xor

Disassembly:
sub edx, edx
jle 0x1000e1ff
mov dh, 0x20
mov bh, 0x4d
dec ebp
dec ebp
dec esi
shr byte [ecx + ecx*2 + 0x56c2899c], cl
lodsd eax, dword [esi]
clc
mov esp, 0xcba1d68
dec edx
popal
push esp
pop eax
xchg ebp, eax
push ss
push edi
movsb byte es:[edi], byte [esi]
push esi
sbb edi, edi
loop 0x1000e1a9
mov word [edx - 0x7f], ds
mov al, byte ss:[0x6328e367]
cmpsd dword [esi], dword es:[edi]
sar al, cl
add eax, edx
pop ecx
jnp 0x1000e222
lcall 0xa845, 0xa6c0484c
adc byte fs:[eax], bh
dec esp
dec eax
shl byte [esi + 0x1064a845], 0x38
aam 9
cdq
jb 0x1000e1b9
inc edx
sub ch, byte [eax + 0x5f7e5d8e]
mov ds, word [ebp + 0x7e]
pop edi
dec ecx
dec edi
mov ebx, 0xfb38e7db
add bl, byte [ebx + 0x442887c1]
jl 0x1000e211
wait
rol dword [edi + 0xe7c4428], 0xdf
inc esi
stc
sub byte [esp + edi*2 + 0xe], al
fild word [esi - 7]
mov dh, 0xad
test eax, 0x4fb25c5e
popfd
add al, 0x26
mov ebx, 0xfb849746
inc esi
xchg edi, eax
test bl, bh
xchg edi, eax
xor esi, ecx
or dh, byte [ecx + 0x46505d62]
jb 0x1000e1fc
xlatb
cmp al, 0x3f
aas
cmp ah, byte ss:[eax - 0x69]
pushfd
jg 0x1000e1df
push cs
jbe 0x1000e274
pop eax
xor edx, edx
hlt
push ebx
pop ecx
iretd

Function at 0x1000f8b0
Capabilities:
Encode data using xor

Disassembly:
jno 0x1000f8c1
aas
pop es
xchg ecx, eax
mov ebp, 0xfbe399b9
jecxz 0x1000f8ad
je 0x1000f872
sub dword [edx + edx*2 + 0x68094134], 0x32
call 0xcdc486a4
add dword [ecx + 0xf896b79], esp
pop ebp
and al, 0x74
inc esi
cmp esi, dword [ebp + edx*4 + 0x2d]
xor al, 0xfb
rol dword [eax - 0x6f], 0x12
mov esp, 0xfc840b54
cmp dword [ecx + 0xf], 0x453354ab
out 0x7d, al
inc esp
and dword [esi - 0x3cc4ec6a], ebx
js 0x1000f89c
shr dword [eax - 0x6a], cl
mov edx, 0x9dacd4b5
sub al, byte [esp + eax*4 + 0x15ce606e]
xchg ebp, eax
jg 0x1000f945
hlt

Function at 0x1000fdf0
Capabilities:
Encode data using xor

Disassembly:
xor ebp, dword [eax - 0x5a599cfa]
mov eax, 0xfcd1ade2
or dword [ebx + 0x61], ecx
sub dl, byte [ebx]
jg 0x1000fd89
push cs
lodsb al, byte [esi]
mov bh, 0xef
mov edi, 0xc6fe9b02
inc ebx
jge 0x1000fe19
xchg ebx, eax
pop esp
invalid
add dword [esi + 5], ebp
sbb eax, 0xf6eca210
cld
sbb byte [ebx + esi + 0x52037e51], bl
mov ebx, 0xb1d15420
js 0x1000fe61
dec ebp
mov dword [ebp + 0x43], eax
push ebx
rol dword [0x7a80e082], 1
xchg byte [ebp + esi*8 + 0x30338dce], bl
mov dl, 0xc2
pop edx
test ah, bh
sub al, 0xb6
int 0x59
fiadd dword [esi - 0x2c7c428]
and dword [esi + 0x5a], esp
pop es
cmpsd dword [esi], dword es:[edi]
jb 0x1000fe86
pop edi
pop edi
lcall 0x1916, 0xbde926a6
lds esi, [edi]
aaa
out 0x8c, eax
int3
push ecx
bound edi, qword [ebx - 0x2261372c]
or al, 0x8a
cmp al, 0x59
inc edx
add ebp, ebx
mov edx, 0x33b3f11c
int1
push ds
fild word [0x2cae6fff]
mov eax, dword [0x9da171db]
stosb byte es:[edi], al
ror byte [ebx], 1
sub byte [ecx - 0x14], ah
loop 0x1000fe57
pop ds
sbb al, 0x8f
inc esi
inc edx
push ecx
pop edx
or byte [0x514aa268], 0x71
jmp 0xdd53096d
Function at 0x10010930
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
invalid
jne 0x10010881
dec dword [eax + 0x2867d8b4]
cmp bh, byte [ebx]
sbb byte [esi], ah
or byte [edi - 0x3a], 0x2e
sub dword [ebx], ecx
mov esp, esp
push ss
inc ecx
jp 0x1001091d
pop ebp
sub ebp, ecx
insb byte es:[edi], dx
push es
ljmp 0xcfa8
or edi, dword [esi - 0x65643058]
test eax, 0x243f61ba
inc eax
test al, 0xcf
wait
lcall 0x4024, 0x3f61baa9
dec edx
push esp
out dx, eax
pop esi
and eax, 0x1c025f54
jnp 0x100108a6
add bl, byte [ebx + edi*2]
leave
xchg ebx, eax
movsd dword es:[edi], dword [esi]
push esi
mov cl, 0x92
pop edx
xchg esp, eax
jmp 0x9f648a76
outsb dx, byte [esi]
sbb byte [ebp - 0x2b4bfb52], bl
imul dword [edx]
inc eax
js 0x10010922
sbb al, 0x31
or dl, bl
xchg edx, eax
jecxz 0x100108c8
cmp bl, byte [edi - 0x2f63c508]
shr byte [edx], cl
jge 0xf63648a1
sbb eax, 0x98aea5bb
pop esp
push 0x5a
jae 0x100108d2
test byte [eax], dh
scasd eax, dword es:[edi]
loop 0x100108de
jecxz 0x100108d9
dec ebp
fdiv st(7), st(0)
sahf
out 0x52, al
stosb byte es:[edi], al
add al, 0x90
fcmovnu st(0), st(1)
jo 0x100108c6
mov eax, dword [0x7fd6e68d]
cld
imul edi, esp, 0xffffffac
add byte [esi + 0x56], bh
das
add edi, dword [eax + 0x6d328a4d]
inc edi
js 0x100108f1
xchg ecx, eax
pop edi
mov edx, 0x3a729a70
xor dh, byte [eax]
mov ecx, 0x3b0611cb
cmpsb byte [esi], byte es:[edi]
sbb ah, al
aaa
invalid

Function at 0x100177e0
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xaf2392f8
pop edx
inc esi
and dh, byte [ecx + esi*2 + 0x19]
adc dh, dh
mov ch, 0x6f
fnstcw word [eax - 0x365a5cbf]
xchg edx, eax
xchg byte [esi + 0xa], cl
xlatb
invalid

Function at 0x10017f20
Capabilities:
Encode data using xor

Disassembly:
cwde
push edi
mov eax, ss
pop esp
stosd dword es:[edi], eax
outsb dx, byte [esi]
mov ecx, dword [ebp + 0x26]
sbb cl, byte [edx + 0x68]
push edx
push esi
adc dword [esi + edi*8 - 0x7a], ecx
inc ecx
mov eax, dword [0x67bc3fd3]
sti
push ss
mov dl, 0x52
xchg ecx, eax
cmpsb byte [esi], byte es:[edi]
xor dword [esi - 0x2fdc78af], ebx
mov esp, 0xe47cb2f2
test dword [esi], edx
inc edi
pop ecx
invalid
Function at 0x10018440
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x4a808243]
mov dh, 0xf1
and ebx, dword [ecx]
ret
dec eax
push ds
cmp ecx, dword [ebp + 0x20d722ae]
mov ecx, fs
jne 0x10018409
lea ebp, [esi - 0x73df28de]
loope 0x10018474
or esi, edx
salc
in eax, 0x68
dec ecx
adc ah, dh
xor dword [edx + 0x1628e210], edx
loop 0x10018433
push ss
cmpsb byte [esi], byte es:[edi]
imul edi, dword [edx], 0x6f
pop es
jge 0x100183f7
into
sti
xor eax, 0x8eef13c8
mov ss, word [edx]
ja 0x10018473
pop es
xchg esp, eax
xchg edx, eax
add byte [eax], dl
mov bh, 0x57
pop edx
xchg esi, eax
leave
cld
je 0x100183d9
mov word [ecx + 0x6c], fs
jo 0x1001849e
pop ecx
add dword [edi + edi*4], edi
cmp al, 0xbf
mov edx, 0x2d37f6c3
jecxz 0x10018469
add dword [edx], ecx
cld
hlt
mov byte [eax], bh
shr dword [eax + 0x56], 0xab
push ebp
cdq
rcl dword [ebp - 0x72bb6687], cl
adc dl, byte [eax + esi*4 - 0x3cc5f920]
xchg ecx, eax
jecxz 0x100183f4
call 0x2e9d43c1
fldcw word [eax]
inc esp
mov bl, 0xb3
pop edi
cmpsd dword [esi], dword es:[edi]
add al, 0xd9
adc ebx, esp
int3
retf
das
pop ebx
sbb ebp, dword [0x6820a801]
invalid
sahf