joyce8/EMBER2024-capa huggingface dataset:
Function at 0xac1c43
Capabilities:
Encode data using xor

Disassembly:
sbb esi, 3
mov dword [esp], ecx
neg byte [esp]
push ecx
mov edx, dword [esi]
adc byte [esp], ch
xor edx, ebx
movsx eax, cl
xor edx, 0xb38892
rol eax, cl
pop ecx
dec edx
and cx, word [esp]
shl eax, 0xbe
xor word [esp], cx
not edx
shl cl, 0x64
bts cx, 0x17
setb cl
neg edx
xchg byte [esp + 3], al
not dword [esp]
not ecx
xor ebx, edx
rol cl, 0x47
and ecx, ecx
adc edi, edx
xchg byte [esp + ecx*2 - 0x737ed6fc], cl
cdq
mov dword [esp + ecx*2 - 0x737ed77e], edi
ret
rep movsb byte es:[edi], byte [esi]
call int.00c00fd2
mov edx, 0x7fb5093f
jmp 0xc03f18
pop edx
mov cx, word [ebp + 2]
push 0xcc1b6323
add ebp, 2
shr cx, 1
call fcn.00a87a6f
mov eax, 0xe221d0bf
movzx ecx, al
mov eax, dword [ebp + ecx*4 - 0x2fc]
mov edx, ecx
sub edx, 0x543c97a7
call fcn.00a71a06
mov ecx, 0xad9deaa8
movsx eax, cx
inc ax
sub ebp, 4
sal eax, 0x17
xor eax, 0x822bf01d
xchg ah, cl
mov edx, dword [ebp]
jno 0xace3f4
outsb dx, byte [esi]
jnp 0xac1c32
add eax, 0xe1b8463f
rol byte [edx], 0xfe
add bh, dh
popal
mov esi, 0xa813718d
mov dh, cl
pop ds
fcmovnb st(0), st(0)
mov al, byte [0xa6e3bf1b]
adc dword [esi + 0xe], esi
stosd dword es:[edi], eax
sbb dword [ebx - 0x72], esi
scasb al, byte es:[edi]
xor bl, byte [ecx]
test dword [edx - 0x40691d72], ebx
cld
sar byte [ebx - 0x1440d3b9], 0x82
add eax, 0x375fa972
lea edi, [edx - 0x637fc635]
jecxz 0xac1ca5
xchg ecx, eax
mov al, byte [0xdef69ceb]
retf
sub edx, edx
or edx, edi
jmp edx
mov ax, word [ebp + edx - 0x7fb5093f]
sar dl, 0xe2
lea ebp, [ebp + edx - 0x7fb5090d]
lea esi, [esi + edx - 0x7fb50910]
push edx
adc edx, 0xc78412ba
lea ecx, [edx*4 + 0x1cbf412b]
movzx edx, byte [edx + esi - 0x47391bca]
imul ecx, ecx
setb byte [esp]
neg ecx
xor dl, bl
or dword [esp + ecx*2 - 0xdb78a2e], ecx
lea ecx, [ecx + ecx - 0x4776c158]
jno 0xd26e5a
mov ecx, 0x203eff9e
not ecx
add ebp, 6
mov word [edx], ax
mov eax, ecx
xchg ch, cl
sub esi, 4
movsx edx, cx
mov eax, dword [esi + edx*2 - 0xc200]
shl edx, 0xc1
shl cl, 0x62
bt ecx, edx
xor eax, ebx
inc eax
not eax
ror cl, 1
btr edx, 0xb5
neg ecx
rol eax, 1
inc eax
and cx, 0x8584
xor cl, ch
xor ebx, eax
xadd ecx, edx
adc edi, eax
jmp 0xaf21e3
neg dl
or cl, 0x26
setp cl
adc dl, cl
sub ecx, dword [esp]
setae cl
sbb dword [esp + ecx - 0x4640fa01], ecx
rol dl, cl
or byte [esp + ecx - 0x4640f9ff], cl
shr ecx, 0xaf
dec dl
or cl, cl
shr ecx, cl
xor bl, dl
sub ecx, dword [esp + ecx - 0x4640]
bts cx, cx
shr byte [esp + 2], 0xe4
lea edx, [esp + edx + 4]
xor cx, word [esp]
rol cx, 0xcd
js 0xd2f508
push 0xe150786
mov esi, dword [esp + 8]
mov dword [esp + 8], 0x7d177064
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00ab2b2d
mov byte [edx], al
js 0xaad2c4
mov eax, 0xeb34ff9c
and eax, eax
mov ecx, eax
sbb edi, 4
not cx
call fcn.00a74b6d
Function at 0xaf676d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0x71833db3
lea esp, [esp + 4]
call fcn.00d4534c
mov word [edx + ebp], ax
xor ecx, dword [esi + edx]
lea esi, [esi + edx*4 + 4]
sar edx, 6
lea eax, [edx + edx*2 - 0x337c6c42]
sbb byte [esp + edx*2 + 7], 0x30
xor ecx, ebx
rol word [esp + edx + 5], 0x61
xor ecx, 0x67225f8a
call fcn.00cf3f87
add byte [edx + 0x20ab6ebd], bh
mov ecx, dword [edx + ebp - 0x20ab6ebd]
or dx, dx
xor dx, dx
btc edx, edx
lea ebp, [ebp + edx*2 - 0x4155fffe]
bswap edx
xor ecx, ebx
xor edx, edx
movzx eax, dl
shr eax, 0x5c
neg ecx
cwde
shl edx, 0x2f
xor ecx, 0xb3ad9323
or eax, edx
cdq
cwde
ror ecx, 1
lea ecx, [ecx + edx*2 - 0x5e06b529]
ror ecx, 3
not ecx
neg edx
cwd
sal ax, 0x2c
xor ebx, ecx
jmp 0xcf71bb
xor eax, ebx
ror eax, 1
neg eax
imul ecx, edx
ror cx, 0xc6
bswap edx
not eax
dec eax
not eax
call fcn.00ab6554
mov edx, dword [edi]
mov ecx, 0x4900052a
mov cl, byte [ecx + edi - 0x49000526]
mov eax, 0x77a050ae
sal eax, 0xaa
neg al
adc edi, 6
mov byte [edx], cl
movsx ecx, ax
lea edx, [eax + eax - 0x2179d3fa]
mov edx, dword [ebp]
sub cx, cx
setg cl
adc ebp, 4
sub ecx, eax
xor edx, ebx
rol edx, 2
not ax
sal ecx, 0xa1
js 0xb7c0c2
call fcn.00adf901
not ecx
xor ebx, edx
add ebp, edx
bt ecx, 5
lea edx, [eax + ecx*8 - 0x744b2472]
mov esi, dword [esi + ecx - 0x300ff639]
shl dx, 0xe7
js fcn.00b75b25
sbb edx, 0x4b845e97
ror edx, 3
push eax
sar word [esp + 1], 0xc3
neg edx
bswap edx
xchg dword [esp], eax
shr byte [esp], 0xa2
dec cl
inc edx
xor ebx, edx
call fcn.00bbe941
adc ebp, 5
shld eax, edx, cl
mov dword [ebp], eax
mov edx, 0x8e3dee88
movzx ecx, dl
mov eax, edx
mov dword [esp + ecx*2 - 0x110], edi
ret
add esi, ecx
push edx
add dword [esp + edx*2], edx
add ax, word [ebp + edx*2]
rol byte [esp + edx + 3], 0xa1
and edx, edx
or dword [esp + edx*2], edx
lea ebp, [ebp + edx*2 + 2]
movsx ecx, word [esp + edx]
shr dx, 0xc7
pop edx
xor ax, bx
xadd dx, cx
adc ax, 0xeabe
neg ecx
not ax
shr ecx, 0xe1
and cl, dl
ror ax, 1
bt dx, 0xae
jb 0xc24d17
not ax
cmovb edx, ecx
shl dx, 0x24
shr cl, 0x63
inc ax
lea edx, [ecx + edx*2 - 0x22e8c2cc]
imul edx, edx
xor ax, 0xd89d
xor bx, ax
dec edx
lea edi, [edi + ecx*8 - 4]
mov dword [ecx + edi], eax
mov eax, 0x23ab44b6
sal cl, 1
rol ax, 0x69
je fcn.00b25f42
mov eax, dword [ebp]
mov ecx, 0xb008562f
add ebp, 4
mov edx, 0xce11a40b
jmp 0xaf9a68
Function at 0xaf9b16
Capabilities:
Encode data using base64

Disassembly:
sbb ebp, 7
call fcn.00a79d40
mov edx, dword [ebp]
mov eax, 0xad9123a3
add ebp, 4
and al, ah
add eax, eax
xor edx, ebx
lea ecx, [eax*4 - 0x235bd6da]
rol edx, 2
neg ecx
bt ecx, ecx
sal eax, 0x73
dec edx
not edx
neg edx
shl ecx, 0x8e
sub ecx, 0xee2f2621
ror edx, 2
xor ebx, edx
sar cx, 0xaa
xor cx, cx
adc esi, edx
and al, ch
mov edi, dword [eax + edi - 0x32300000]
jno fcn.00cba72e
pop eax
xor edx, ebx
xor ecx, ecx
inc cl
rol edx, 2
shl cx, cl
dec edx
movsx eax, cx
ror cl, 0x82
dec eax
not edx
add ecx, eax
call fcn.00b8f7e0
mov edx, 0x8303d138
mov ecx, 0x3d140120
movzx eax, cl
lea edi, [eax + edi - 0x24]
xchg edx, eax
mov edx, dword [edi + edx*2 - 0x40]
dec ax
bts cx, 1
xor edx, ebx
rol eax, cl
neg edx
push eax
mov dword [esp + ecx*2 - 0x7a280244], 0x35974224
rol eax, 0x22
not edx
jae 0xd2d809
mov edx, 0xf7231238
mov ecx, dword [esi]
jmp 0xb5f819
xor eax, edi
jmp eax
bt edx, edx
mov eax, edx
adc esi, 3
not al
dec al
seto dl
xor ecx, ebx
rol dx, 0xd
lea edx, [edx + eax - 0x7b65f5d9]
dec ecx
inc eax
xor ecx, 0x31024f20
cbw
ror ecx, 3
lea ecx, [ecx + edx - 0x38aeb898]
btc edx, 0xa1
xor ebx, ecx
sub dx, 0xd49c
bts eax, eax
sbb edx, edx
add edi, ecx
not ax
dec eax
mov eax, dword [ebp]
bt edx, edx
adc edx, edx
movsx ecx, dx
mov ecx, dword [ebp + 4]
dec dx
push ebx
cpuid
push 0x14176e00
jnp 0xaa9718
mov eax, 0x45af342c
movzx edx, al
dec ax
mov eax, dword [esi + edx*2 - 0x58]
movzx ecx, dl
mov edx, dword fs:[eax + edx*2 - 0x58]
dec ecx
mov dword [esi + ecx*8 - 0x158], edx
movzx eax, cl
sal ecx, 0x32
lea ebp, [ebp + ecx*8 - 0x5600004]
ror ecx, 0xf7
bt ecx, eax
mov ecx, dword [ecx + ebp - 0x58000001]
imul eax
xor eax, edx
add eax, eax
xor ecx, ebx
inc al
mul dx
rol ecx, 3
dec ecx
bswap ecx
btr edx, edx
imul dx, ax
inc ecx
xor ebx, ecx
bts ax, 0x88
xor dl, dh
mul eax
adc edi, ecx
movzx ecx, ax
shr eax, 0x1d
jp 0xb195af
xor bl, al
shr dx, 0xeb
sub edx, edx
sbb edx, edx
adc eax, esp
mov word [eax + edx], cx
lea ebp, [edx + ebp - 4]
mov eax, dword [ebp + edx]
xor eax, ebx
movzx ecx, dl
push edx
push ecx
ror eax, 3
xor eax, 0x108b5d15
inc eax
xor eax, 0xf72a30ba
inc dword [esp + edx*2 + 1]
pop edx
xadd byte [esp + ecx + 2], dh
xor ebx, eax
shl dword [esp + edx], 0xcf
imul dx, word [esp + edx + 1]
xadd dl, cl
adc edi, eax
shl dl, 0x47
sar edx, 0x2f
shl cx, 0x6e
mov dword [esp + edx], edi
ret
shl ecx, cl
ror eax, 1
call fcn.00acb365
xor ebx, eax
bt cx, 0xaa
btc edx, edx
bt edx, ecx
add edi, eax
sar ecx, 0xfc
xor ecx, ecx
or edx, ecx
xor ecx, edi
jmp ecx
inc edx
rol edx, 1
shr cl, cl
xchg ecx, eax
neg edx
pop eax
xor ebx, edx
shl cx, 0xac
jnp 0xcd88a4
inc ax
add ebp, edx
mov dx, word [esi + eax*2 - 0x6b2e844a]
sal ecx, 0x5f
bts ax, 0x1e
xor eax, eax
adc cl, byte [esi + ecx*2 + 2]
lea esi, [esi + eax*8 + 2]
sar eax, 0x2a
shl dx, cl
movsx ecx, ax
mov word [eax + esi], dx
movsx edx, cl
imul ax, ax
or edx, eax
or eax, ebp
jmp eax
Function at 0xb01fb8
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov edx, 0x91a2ac17
shr edx, 0xb7
jae 0xbe7937
rol eax, 3
sal cx, 0xf
xor ebx, eax
add cx, dx
not dword [esp + edx - 0xb5f621c]
adc ecx, ecx
add edi, eax
adc al, 0xe4
popfd
in al, 0x9d
mov al, byte [0x3c913f4]
clc
call fcn.00a82592
sal byte [edi - 0x54], cl
add byte [esi], bh
pop edx
or dword [edx], esp
add edi, 0x61459692
add ch, byte [ebp - 0x3f]
xor eax, 0x563da66
push esp
push eax
dec ebx
xlatb
scasd eax, dword es:[edi]
and eax, 0xffffff97
imul ebx, dword [0x35eeb0ac], 0xcf255943
stosb byte es:[edi], al
jbe 0xb0203d
jecxz 0xb01fc6
loopne 0xb01fc7
test dword [eax + 0x46f16ac4], eax
int1
add dword [ebp], esi
xor bh, bh
dec eax
sahf
enter 0x3610, 0xffffffffffffffc9
mov ecx, 0x3c01e8ea
xchg edx, eax
loope 0xb01fa9
xchg ebx, eax
mov dword [0xc5ffd167], eax
inc ecx
sub byte [ebx - 0x80], dh
sub al, 9
int 0xe3
cli
push 0x659c1e43
pushal
sbb dword [ecx + esi*4 + 0x639ec5bf], edx
push ds
mov cl, 0xbf
mov edi, 0x1e639ec5
lds ebx, [esi + 0x61ba1e63]
mov edx, 0x1703d61
jle 0xb0200b
popal
cmp eax, 0xc87e0170
pop ebx
daa
cld
sub dword [esi + 0xe], ebp
push cs
adc dl, 0x49
push es
inc dword [edx]
inc esi
xchg edx, eax
mov dl, 0x89
xor bh, byte [esi]
and eax, 0x9831bc79
jle 0xb02037
add bh, byte [ecx + 0x4d]
add ecx, ebx
push 0xd354ff02
loopne 0xb020a3
jns 0xb020d1
rol byte [esi + ebp*2 - 9], cl
push ebx
sbb eax, 0x7e5bfc7e
stosb byte es:[edi], al
aas
das
into
push es
inc dword [ebp - 0x4b]
xchg ebx, eax
loopne 0xb02048
leave
xor al, 0xc5
jnp 0xb0201f
leave
mov esp, 0x2d10564e
sub eax, 0x7fb9f740
loope 0xb020c0
invalid
inc byte [edx - 0x80]
imul ebx, dword [ebx + 0x1a], 0x41550076
js 0xb0211d
add ch, cl
jmp 0xb02036
int 0xeb
nop
xchg byte [edx + 0x6abdb17f], cl
cdq
push dword [ebp + 0x6a]
mov dl, 0x9d
jg 0xb020de
pop ss
lodsb al, byte [esi]
jb 0xb02038
in al, dx
scasd eax, dword es:[edi]
push es
jge 0xb0203d
call fcn.00407145
mov ecx, dword [ebp]
add ebp, 4
nop
dec dword [ebx - 0x7effdab4]
lds eax, [eax + eax]
add byte [eax], al
mov eax, 0xd82bb83d
mov edx, eax
xor eax, eax
xor ecx, ebx
neg dx
imul dx
and dl, 0xb6
loop 0xb02096
dec ecx
call fcn.00c4c8e2
rep movsb byte es:[edi], byte [esi]
push ecx
pushfd
mov ecx, 0x71a2458b
call fcn.00d46b5a
enter 0xffffffffffff8ddf, 0xffffffffffffff8c
enter 0x111, 0xffffffffffffff84
cmp al, 0x81
mov ecx, dword [eax + esi*4 - 0xd931784]
adc al, 0
Function at 0xb4ce30
Capabilities:
Encode data using xor

Disassembly:
xor ebx, ecx
add ax, ax
adc edi, ecx
sal al, 0x62
mov bp, word [ebp + edx - 0x57201ad9]
and eax, 0xa48caf07
jp fcn.00b37273
not al
rol ecx, 2
and edx, 0x5720e526
lea ecx, [ecx + eax - 0x5095699e]
bswap ecx
not dx
jnp 0xa90862
mov edx, 0x44bba927
lea eax, [edx - 0x1c39c5b]
call fcn.00ba9a40
mov edx, 0xd4343aaa
call fcn.00aff25f
scasb al, byte es:[edi]
wait
invalid
xor ebx, edx
lea esi, [esi + eax*2 - 0x5c8]
mov dword [ecx + esi - 0x3f7bffff], edx
lea ebp, [ebp + ecx*2 - 0x7ef80002]
movsx edx, cx
mov dword [esp + ecx*2 - 0x7ef7fffe], 0xa7047831
mov word [esp + eax*2 - 0x5c2], 0x7918
mov edx, dword [ebp + ecx*2 - 0x7ef7fffe]
add eax, 0xce25039f
adc eax, dword [esp + ecx*2 - 0x7ef7fffe]
dec ecx
xor edx, ebx
pop eax
sal ecx, cl
xor edx, 0x310cb709
not al
btc eax, eax
jb 0xc7fc6f
mov ecx, 0x658b0daf
movsx edx, cl
mov eax, edx
fsub qword [ebp + ecx - 0x658b0daf]
sub edx, ecx
ja 0xb54cc9
lea esi, [ecx + esi - 0x658b0db3]
mul edx
dec dl
je 0xbd1f09
mov ecx, dword [eax + esi - 0x20ff6e00]
call fcn.00b93f6e
mov ecx, 0xeaacdf0b
mov dword [esp + eax - 0x7b04ee9b], ebp
ret 4
and eax, 0x2d0f0a8a
call fcn.00bbe81b
mov eax, 0xcc835dae
movzx edx, al
movsx ecx, ax
mov ecx, dword [ebp + edx*2 - 0x15c]
lea ebp, [ebp + edx*8 - 0x56c]
idiv ax
mul dx
xor ecx, ebx
push eax
lea ecx, [ecx + edx*2 + 0x80cb4e9]
xor ecx, 0xbd9e050e
cdq
sub ecx, 0x162e5b3f
add al, 0x16
push edx
bswap ecx
adc word [esp + 3], dx
add ecx, edx
shl dword [esp], 0x12
xor ebx, ecx
rol eax, 0x2d
rol dword [esp + eax - 0x79d7d98f], 0x72
neg eax
add esi, ecx
mov edx, dword [edi]
dec al
call fcn.00c7856f
mov eax, 0xe8a1b6b1
xor al, ah
fcomp qword [esi]
movzx edx, ax
lea ebp, [ebp + edx - 0xb60b]
mov ecx, 0x34b21715
sbb edx, 0x6536d3a7
sub edx, eax
mov eax, dword [ebp + ecx*2 - 0x69642e2a]
jo 0xb0bf37
adc dx, 0xdd1c
xor eax, ebx
xor cl, dl
not eax
ror eax, 2
sub eax, 0xc98e4c0d
sal edx, cl
sar dx, cl
neg eax
xor ebx, eax
inc dx
add edi, eax
jmp edi
movsx eax, cl
lea ebp, [ecx + ebp - 0x3a3be53b]
add eax, ecx
mov eax, dword [ebp + ecx - 0x3a3be537]
lea ecx, [ecx + ecx + 0x4e980d3f]
xor eax, ebx
xor ecx, 0x2fb342a3
adc ecx, ecx
inc eax
ror eax, 1
mov edx, ecx
shl dl, 0xe3
or ecx, ecx
dec eax
sar cx, 1
sal cx, 0xac
rol eax, 3
shl edx, 0xd7
inc eax
sub edx, edx
shr edx, 0x1b
rol dx, 0xf
xor ebx, eax
bts dx, 0xf
and cx, dx
adc edi, eax
mov ax, word [esi + edx*4 - 0x20000]
bt cx, 0x8d
lea esi, [esi + edx*4 - 0x1fffe]
lea ebp, [ebp + edx*8 - 0x40001]
movzx edx, byte [ebp + edx*8 - 0x40000]
xor dl, bl
call fcn.00c7358f
push 0x19cce24
add edi, 4
push 0xc197a316
push 0x2c074ca2
shl byte [esp + 4], 0x85
shrd dx, ax, cl
pop eax
mov word [edi + eax - 0x2c074ca2], dx
movsx ecx, al
bswap eax
shr ecx, cl
mov edx, dword [ebp + ecx*2 - 0x7fffffd0]
shr ecx, cl
sar ax, 0x67
bts ecx, 0xab
lea ebp, [ebp + ecx*8 - 0x1fffff4]
jb 0xbc2a2a
call fcn.00a913d5
lea edx, [edx + eax*2 - 0x550f9072]
not edx
sbb edx, 0xcc8b9289
call fcn.00d26da4
inc dl
dec eax
rol eax, 2
and ecx, edx
sub dl, dl
bswap ecx
inc eax
neg eax
btr dx, cx
inc eax
rol dl, 0xe7
sub dl, 0x2b
xor ebx, eax
add edi, eax
bswap ecx
call fcn.00cd0c98
Function at 0xb63104
Capabilities:
Encode data using xor

Disassembly:
add edx, ecx
mov edx, dword [ecx + ebp - 0x72626358]
mov dword [esp + ecx - 0x72626358], ecx
xor edx, ebx
inc edx
ror edx, 1
mov byte [esp + ecx - 0x72626355], cl
shr ecx, 0x6c
lea eax, [ecx + 0x4d3a13a9]
xor edx, 0x34351602
push eax
and byte [esp + ecx - 0x72623], 0xb9
not edx
dec edx
ror ecx, 0xc4
btr eax, ecx
setb byte [esp + eax - 0x4d4139c4]
xor ebx, edx
call fcn.00a84961
mov ebx, 0xe8acf778
popal
jnp 0xb6311f
invalid
lodsb al, byte [esi]
mov dword [eax], esp
mov eax, 0xd079229e
xor al, 0x30
lodsd eax, dword [esi]
aaa
retf 0x31d8

Function at 0xb7a81b
Capabilities:
Packed with generic packer

Disassembly:
pop ecx
mov cl, byte [edi + ecx - 0xffc5]
adc edi, 1
bts dx, dx
jb 0xc22323
shl al, cl
btr edx, edx
call fcn.00c6698d
shl ah, 1
nop
push edx
pop ss
pop ss
xlatb
mov dl, byte [ecx + 0x55]
mov cl, 0x44
add al, 0xac
shr byte [ecx], cl
adc dword [esi], 0xffffffac
fild dword [ebx]
sub byte [ebx - 0x3d55ac75], dh
lea edx, [ebx]
aaa
mov bh, 0x61
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
std
adc ah, 0x7e
lodsb al, byte [esi]
sub bl, al
mov ch, 0x53
mov edx, 0x5391340c
jbe 0xb222a9
pop eax
int3
aas
pop esi
dec ecx
pop ecx
jb 0xb2224c
xor byte [esi + ebx*2 + 0x2dab17f2], al
pop ebp
sbb esi, dword [ebp - 0x4b]
push ebx
leave
sbb ah, byte [esi + 0x7171c452]
jl 0xb22316
jecxz 0xb2226e
loop 0xb222bb
lodsb al, byte [esi]
cmp eax, 0xace02537
dec ecx
popal
cmp dl, byte [0x64b8537d]
jnp 0xb2232c
fidivr dword [ebp + 0x11]
xchg edi, eax
lodsb al, byte [esi]
dec ebx
out 0xa2, eax
jb 0xb2226b
lodsb al, byte [esi]
or ah, byte [ebp + 0x43]
push ebx
invalid
mov dword [0xb817250d], eax
cld
pushal
sub eax, 0x72568570
test dword [esi + 0x483f18d1], ecx
aaa
sub al, 0xf1
cmp byte [eax + 0x2c], dh
invalid
call fcn.00a8762d
push edx
pushfd
mov edx, 0xeaab9e32
shr dx, 0x36
shl edx, 0x77
jae 0xb994a3
push esi
mov esi, 0x4c985003
pushfd
or esi, esi
jg 0xca725c
rcr ax, cl
mov word [edx + ebp - 0xf2c76], ax
and byte [esp + edx*2 - 0x1e58ea], 0xbe
push edx
mov dword [esp + edx*4 - 0x3cb1d8], edi
ret 8
mov edx, dword [esp + 4]
mov dword [esp + 4], 0x6a8136e4
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00ab2b2d
mov ecx, dword [ebp]
add ebp, 4
mov eax, 0x3a3578bc
movzx edx, al
xor ecx, ebx
bt edx, edx
dec eax
div eax
rol ecx, 1
btc edx, eax
neg ecx
imul ax, dx
push eax
neg edx
ror ecx, 1
inc eax
not ecx
sar word [esp + eax - 0xc757], 0x48
ror ecx, 1
lea ecx, [ecx + edx - 0x4b06589f]
or eax, 0xb88fa6af
xor ebx, ecx
not al
add esi, ecx
mul al
dec al
sbb eax, 0xe6827894
movzx ax, byte [edi]
jnp 0xb22225
ror ecx, 1
lea ecx, [edx + ecx + 0x4d1867be]
xor eax, edx
or al, ah
neg ecx
btc eax, eax
cdq
xor ebx, ecx
add ebp, ecx
ror dx, 0xce
lea edi, [edi + edx - 1]
setae al
rol dl, 0xa2
movzx ecx, ax
adc dl, byte [edx + edi]
bt cx, 0xb
btc eax, eax
xor dl, bl
sub dl, 0x80
or ax, 0x2295
and cx, ax
ror dl, cl
sal ax, 0xe1
neg dl
bts ecx, ecx
xadd ecx, eax
shl cl, 0xe7
dec dl
not ecx
or eax, 0x8d206a31
xor bl, dl
sub esi, 2
mov word [esi], dx
call fcn.00c6a33b
push esi
push ecx
call fcn.00b9a8eb
Function at 0xb99488
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov ebx, 0x349c1c01
mov dword [esp + 0xc], 0x1a6d48
mov ebx, dword [esp + ebx*2 - 0x693837fa]
popfd
call fcn.00c2a524

Function at 0xb9f940
Capabilities:
Encode data using xor

Disassembly:
not edx
neg edx
not eax
lea ecx, [edx*2 - 0xcd407da]
or cx, 0xc52a
inc eax
neg eax
xor ecx, ecx
neg edx
sal ecx, 0xd7
not eax
mov dword [esp + edx - 0x7d6c6cc8], edx
rol eax, 3
call fcn.00cda945
mov edx, 0x23ba461e
sar dl, 0x64
movsx eax, dl
mov eax, dword [ebp + eax*2 - 2]
jae 0xafa11f
inc esp
inc ebp
dec byte [edi]
sbb dword [ebp + 0xffff5a7], 0xffffffb7
retf 0xf9c0
movzx ecx, dx
sar cl, 0x62
mov dl, byte [ebp + edx - 0x23ba45fd]
add ecx, 0xfba7e094
adc ebp, 6
call fcn.00d155bc
mov ch, 5
sal byte [esi - 0x76], 1
xor eax, 0x96877732
mov dl, 0xef
salc
pop ds
je 0xb9f979
cmp ah, cl
outsb dx, byte [esi]
pop ss
mov edx, 0xd5668536
xchg ebp, eax
cmp eax, 0xc2f39cb6
jbe 0xb9fa2f
test bh, bl
das
bound edx, qword [edi + ebx*4 + 0x7a]
inc eax
in eax, 0x24
scasd eax, dword es:[edi]
cmp al, 0xe0
and eax, 0x564b8677
jno 0xb9f9c9
ficom word [edx - 0x5af2c52]
pop ebp
in eax, 0x3a
aaa
scasd eax, dword es:[edi]
sbb dh, byte [ecx + ecx*8 - 0x739815c]
ret 0xa39c
lcall 0x7a9a, 0xfe675754
xchg ebx, edi
jp 0xb9fa9f
retf 0x364e
shl byte [ebx - 0xa9ae496], 1
sub eax, 0x9a95e01e
pop edi
popfd
in al, dx
invalid

Function at 0xbb053d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0xf598], ecx
xor al, bl
ror ecx, cl
ror al, 1
not byte [esp + ecx - 0xf597fd]
inc al
sal dword [esp + ecx - 0xf59800], 0x6d
neg al
xchg word [esp + ecx - 0xf59800], cx
dec cl
Function at 0xbb4e13
Capabilities:
Encode data using xor

Disassembly:
sub dl, byte [esp + edx - 0x4ac417d3]
call fcn.00d07610
push edi
mov edi, 0x7095c6ba
pushfd
cmp di, 0x8a1e
mov edi, dword [esp + edi - 0x7095c6b6]
mov dword [esp + 4], 0x861aa379
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00ac9118
bswap ecx
mov dword [esp + edx - 0x514ffff], eax
xor dword [esp + edx - 0x514ffff], 0x6888a60f
xadd word [esp + edx - 0x514fffd], dx
rol ecx, 1
mov dword [esp + edx*2 - 0xa292eea], 0xcd8d4188
xor ebx, ecx
sal byte [esp + edx*8 - 0x28a4bbb8], 0xa1
neg dx
add ebp, ecx
neg dword [esp + edx - 0x5146885]
lea edx, [edx*8 + 0x2220d392]
not ax
fcomp qword [esi + edx - 0x4ac417da]
jns 0xaaae28
cmp esi, dword [ebp + 0x5fbe890f]
out dx, eax
dec ecx
leave
pop ecx
scasb al, byte es:[edi]
cdq
jle 0xbb4e62
xor byte [ebp + 0x319ffa32], bl
sbb al, bl
or ah, 0x40
adc edx, dword [eax + 0x5e]
insd dword es:[edi], dx
jbe 0xbb4e9f
and byte [eax - 3], cl
out 0xdb, eax
pop ds
cmp ah, byte [ecx - 1]
fsubr qword [esi]
leave
std
rcl eax, 0xe8
mov esi, 0x1db1f738
jle 0xbb4f16
dec ebx
fst st(2)
popal
mov al, byte [0x7357e76a]
dec ebx
push edi
jae 0xbb4eed
jb 0xbb4efd
pop ecx
push ecx
sbb byte [ecx - 0x47], dh
pop ebp
adc eax, 0xff490f8
stc
das
mov al, byte [0xb72274db]
imul edx, dword [ecx], 0xffffffa9
cmp al, byte [ecx]
pop es
call 0xbfb64c51
jg 0xbb4eb8
adc dword [ecx - 0x17f8fec6], ebp
invalid
adc ah, byte [0xe236bcb7]
pop edi
test cl, dh
cld
mov edi, 0x2f03bddd
sbb byte [edi], 0xf5
xchg edx, eax
hlt
sub eax, 0xb899f0af
xor edx, dword [eax]
cli
mov esi, dword [eax]
push ecx
imul byte [edx + 0x4d1a701b]
jo 0xbb4f19
dec ebp
jl 0xbb4f5f
sbb al, 0xac
or eax, esp
invalid
ret
inc dword [ebx + 0x5d]
xor byte [ebx - 0x3e83cae5], dl
mov al, byte [0xb21b054e]
push edx
call 0xd07f13df
das
pop eax
push ss
xchg dword [edx], eax
cli
jae 0xbb4f30
jb 0xbb4f59
call 0x8a8a232c
arpl word [eax + 3], cx
push edx
invalid
scasd eax, dword es:[edi]
add al, 0xac
xor ecx, edx
clc
fistp qword [edi + 0x3602fb5d]
imul ecx, ebp, 0xffffffca
aas
js 0xbb4f75
dec edx
inc esi
inc esi
sti
add dword [esi - 0x6dc5ecfb], 0x30
dec edi
pushfd
invalid
xchg edx, eax
xor bh, bh
iretd
Function at 0xbbf16c
Capabilities:
Encode data using xor

Disassembly:
mov word [eax + esi], dx
lea ebp, [ebp + eax*2 - 4]
lea eax, [ecx*2 + 0x7e154810]
mov ecx, dword [ecx + ebp - 0x74ec4c93]
dec eax
dec al
xor ecx, ebx
push eax
mov edx, 0x47899da2
dec word [esp + edx - 0x47899da0]
neg ecx
neg edx
jno 0xc8198b
shrd dx, ax, cl
mov word [ebp], dx
mov ecx, dword [esp]
mov dword [esp + ecx - 0x6296a02f], edi
ret 4
mov edx, dword [esp + edx + 0x78c36bec]
js 0xcb814d
sub ebp, 4
mov edx, 0x3b3f2ba2
mov ecx, edx
mov eax, dword [edx + ebp - 0x3b3f2ba2]
and dx, cx
lea ecx, [edx + ecx + 0x48964517]
dec eax
xor eax, ebx
btr ecx, 0xa3
ror eax, 1
mov edx, 0xc8d1a3f1
call fcn.00bc7c83
xlatb
mov al, byte [eax]
add bh, dl
pop ebx
inc edi
aas
pushal
xor al, 0xab
add eax, 0x3939427a
xor dword [bp + si - 0x2b], 0xffffff87
aad 0xac
jb 0xbbf1a5
fisttp dword [ebx + 0x44f1df59]
out dx, al
jbe 0xbbf224
lodsd eax, dword [esi]
daa
xor ebp, dword [esi + 0x3b]
leave
in eax, dx
mov edx, 0x25beec38
mov dl, 0x42
lodsb al, byte [esi]
push edi
test byte [eax - 0x1989bdb6], al
fucomp st(5)
dec ecx
js 0xbbf1a1
pop esp
jo 0xbbf196
xor al, 0x4d
add byte [edi + 0x56471e91], cl
daa
and ecx, dword [esi]
or byte [edi + 0x51], 7
daa
push esi
inc ebx
mov gs, word [ecx + 0x7f0437e8]
add eax, 0x80f78906
mov bh, 0xc
add bh, byte [edi + 0x61]
cmp ebx, ebx
clc
and byte [ebx], 0x2d
cld
out 0xe7, al
or byte [esp], 0x3d
jg 0xbbf276
bound eax, qword [eax]
or edi, edi
js 0xbbf19a
retf
imul edx, edx
mov edx, dword [ebp + edx*4 - 0x43648c40]
movsx ecx, al
call fcn.00b781a6
inc esp
sub ebx, edi
js 0x42e1fa
jle 0xc47091
mov eax, 0x1d17991c
lea edx, [eax + eax*4 + 0x59cec1e]
mul al
mov ecx, dword [eax + esi - 0x1d170310]
and dl, 0x10
mov dx, word ss:[ecx + eax*2 - 0x3a2e0620]
lea ecx, [eax + eax*8 + 0x6f1d3102]
sbb eax, eax
inc cx
lea esi, [esi + eax*4 + 2]
sal eax, cl
je 0xb237af

Function at 0xbd30a6
Capabilities:
Encode data using xor

Disassembly:
sbb ecx, 0xba381b0b
sub al, 0x30
sbb eax, dword [esp + eax*8 - 0x7f5a4]
rol ecx, 1
xchg byte [esp + eax - 0x71a7], al
xor ebx, ecx
sal dword [esp + eax - 0x70f4], 0xd2
adc ebp, ecx
xor word [esp + eax*2 - 0xe1f6], dx
mov ecx, dword [esi + eax*2 - 0xe200]
pop eax
sar dword [esp + 4], 0x74
mov ax, word [ecx]
push edx
movzx ecx, dx
lea esi, [esi + ecx*8 - 0x7d466]
mov word [esi + ecx*8 - 0x7d468], ax
call fcn.00ba745d
inc dl
rol eax, cl
or ecx, 0x970bb6a3
rol dl, 1
shl al, 0x41
add dword [esp], 0x762a529e
sbb cl, byte [esp + 1]
xor bl, dl
jmp 0xacd4ed

Function at 0xbd7236
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.00cf3a07
mov eax, 0xe3011890
mov ecx, dword [esi]
add esi, 4
cwde
not eax
cdq
xor ecx, ebx
call fcn.00bb9387
in al, 0x9c
sub dword [edi], ecx
inc eax
pop ds
invalid