joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d43b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x453230]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41d47e
cmp word [esi], dx
jne 0x41d47e
or byte [edi + eax + 0x28], 4
jmp 0x41d483
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41d5d6
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41d5b6
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41d4c5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41d4fb
cmp eax, edx
jae 0x41d507
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41d49d
jmp 0x41d5d6
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d5b2
cmp dword [ebp - 0x14], 0
je 0x41d5b2
mov eax, dword [ebx*4 + 0x453230]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41d58a
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41d553
mov word [esi], cx
jmp 0x41d586
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x453230]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x453230]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x453230]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41d5d6
pop ebx
cmp word [ebp - 4], bx
jne 0x41d59b
cmp esi, dword [ebp + 0xc]
jne 0x41d59b
mov word [esi], bx
jmp 0x41d5d3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041de6f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41d5d6
push 0xd
jmp 0x41d5cf
mov ecx, dword [ebx*4 + 0x453230]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41d5cd
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41d5d6
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100eecd1
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc dl
cmc
stc
rol dl, 1
jmp 0x1007b76e
inc dl
stc
test ah, al
cmc
xor bl, dl
sub ebp, 2
cmp di, 0x7b5f
cmp ax, bp
mov word [ebp], dx
lea esi, [esi - 4]
cmovno dx, di
rol dl, cl
sub edx, ebp
mov edx, dword [esi]
test esi, edi
xor edx, ebx
jmp 0x100bc850
sub dword [esp + 0x24], edx
sub word [esp + 0x18], 0x6b1b
mov ebx, edx
or dx, bx
mov ebx, dword [esp + 4]
lea edx, [edx*4 + 0x67424969]
mov ecx, 0x40233e5
neg dword [esp + 0x24]
movzx ecx, word [esp + 0x24]
test cx, 0x16c8
mov ecx, dword [esp + 0x10]
lea edx, [edx + edx*2 + 0x783b2366]
call fcn.10387081
movzx ecx, byte [esi]
test ch, 0x9b
sbb ah, 0xb1
cwd
add esi, 1
xor cl, bl
dec cl
shl dl, 0x5f
not cl
clc
and edx, 0x1460217b
not dl
sub cl, 0xbe
rcl dh, cl
movzx edx, bx
cdq
xor cl, 0x28
shld ax, bx, 0xe7
rcl dl, 0x68
xor dl, 0x56
sub cl, 0x5f
cmovle edx, ebx
bts dx, dx
stc
ror cl, 1
btr eax, eax
xor eax, esi
btc eax, 0xc6
neg cl
rcr ax, 0x85
cmovne ax, bx
sar dl, cl
xor bl, cl
btc edx, edi
setnp dh
movsx ax, ah
push esi
cwd
rdtsc
shr edx, 0x86
push ebp
xor eax, edi
and al, 0xd
rdtsc
push ebx
cmc
not ah
mov ebp, edi
jmp 0x101b1ac5
ror edx, 1
cmc
add edx, 0x3eae4680
test dh, cl
cmp ebp, 0x57155b39
bswap edx
cmp ah, 0xb5
stc
clc
not edx
cmc
clc
test ebx, eax
neg edx
test bp, cx
cmc
xor ebx, edx
jmp 0x101e1dde
sub dword [esp + 8], 0x4e7c6c05
xchg dword [esp + edx - 0x39733fce], eax
setbe byte [esp + 8]
jb 0x100a2a3e
test ebp, esi
neg dl
jmp 0x1002521d
mov ebx, ecx
xor dx, sp
btc dx, dx
mov edx, ebx
shl ax, cl
shl edx, 2
mov eax, ebp
add eax, edx
test eax, 0x2d047294
cmp si, 0x17df
cmp bp, bp
mov dword [ebp - 4], eax
test eax, ebx
cmp ax, 0x290e
stc
test ebx, ebx
jmp 0x10323565
add edi, edx
jmp 0x10384e0c
je 0x1039db15
jmp fcn.1021d2d4

Function at 0x10123a7f
Capabilities:
Encode data using xor

Disassembly:
jl fcn.100fa985
xor dword [esp + 0x34], ebx
mov ebx, dword [esp + 0x20]
not dword [esp + 4]
jns 0x1036906b
mov eax, ebp
xor dh, 0x21
btc edx, eax
dec edx
lea ebp, [ebp - 4]
setno dh
sar edx, 0x40
mov dl, 0x78
mov dword [ebp], eax
add dl, 4
cmovne edx, esi
mov edx, dword [esi]
add esi, 4
xor edx, ebx
jmp 0x10303683
add edx, 0x69cc1163
jmp 0x1030e5d7
inc edx
ror edx, 1
cmc
xor ebx, edx
add edi, edx
jmp fcn.1033e7d4
ror edx, 3
stc
add edx, 0x608f52d8
cmc
clc
ror edx, 2
jmp 0x1022a4d3
xor ebx, edx
add edi, edx
jmp 0x103644cf
jmp fcn.103b3636
sub esi, esi
call fcn.10362c12
bswap edx
jmp 0x10230105
Function at 0x101334a0
Capabilities:
Encode data using xor

Disassembly:
sub edx, esi
and edx, edx
cmovae esi, dword [esp + 0x2c]
not si
add dword [esp + 0x10], 0xefce7b4e
xor ebp, dword [esp + 0x2c]
mov ebp, dword [esp + 0x3c]
call fcn.10153823
cmp al, 0xe8
bound eax, qword [ebx]
add al, byte [eax]
loop 0x1013350d
xor byte [ecx], cl
aam 0xa2
fnstenv [esi - 0x4f]
dec edi
outsb dx, byte [esi]
sub eax, dword [eax]
adc ah, byte [ebp - 0x1c]
mov dword es:[ebx - 0x13], edx
in al, dx
invalid
push ecx
int 0x1d
js 0x101334bb
aas
push eax
lodsb al, byte [esi]
sub dh, byte [edx - 0x7a]
invalid
je 0x101334eb
inc esi
xchg ebp, eax
inc ebp
inc ecx
pop ss
mov cl, 0x66
cld
inc edi
cmp dword [ebx], ebx
pop es
lea ebp, [edx + 0x62]
adc al, 0x9e
jmp 0x58c0e5a4
Function at 0x1016f6be
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0xe6cf7b82
pushfd
add dword [esp + 4], 0xefcb449e
push edx
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.1033e2f1

Function at 0x101d03e1
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.10035410
not ecx
inc ecx
stc
jmp 0x1033ede3
lea edi, [edi + 4]
xor ecx, ebx
stc
neg ecx
xor ecx, 0x32ba1f8a
cmc
test si, 0x1cdc
test bl, cl
add ecx, 0x74be6ac0
cmp sp, 0x3900
test di, 0x5289
xor ecx, 0x4a8328da
clc
ror ecx, 1
jmp 0x1010bd0c
add byte [ebx], dh
retf
call fcn.1030c440
mov eax, dword [0xbaecfaa4]
idiv edi
sub dword [eax - 0x3e], ecx
ficom word [ebp - 0x24120347]
outsb dx, byte [esi]
xor byte [0xdc2537ca], bl
jb 0x101d03e6
dec ebx
jb 0x101d0440
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
jno 0x101d03aa
dec edi
jne 0x101d03af
rcr dword [ecx], 1
dec edi
jmp 0x18c6769c
dec edi
fistp qword [ecx - 0x142d2813]
mov bl, 0xd
dec ebp
movsb byte es:[edi], byte [esi]
sub eax, 0xedce8080
ret 0xecf6
neg ecx
clc
stc
bswap ecx
xor ebx, ecx
add ebp, ecx
jmp 0x100b59f6
Function at 0x1027a838
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.1021d2d4
inc eax
cmp bp, 0x7e2a
cmc
neg eax
cmc
xor ebx, eax
test si, bx
test bl, 0x66
add edi, eax
jmp 0x101524be
not ah
sub esi, 4
btc eax, ebp
xor eax, 0x65907434
mov eax, dword [esi]
xor eax, ebx
jmp 0x10378918
call fcn.10037ffa
adc dword [esi + ebp*2 + 0x16e6604f], 0xffffffdd
dec esi
out 0x10, eax
jne 0x1027a7f9
rcl byte [eax + 0x74], cl
test byte [eax], 0x11
std
sahf
sbb ecx, dword [edi]
imul esp, dword [eax], 0x179ab62
pop ss
test cl, 0x5f
mov esp, 0xc0422d00
std
xor eax, 0x1464654b
in eax, 0xf
sbb ecx, dword [ebx + ecx*2 - 0x60]
inc eax
push 0x800eb19b
inc ecx
push es
push ss
pop ss
push edx
arpl word [eax], bx
test al, 0x4b
arpl word [esi - 0x75], sp
js 0x1027a8c6
inc edi
stosb byte es:[edi], al
xor al, byte [ebp - 7]
stosd dword es:[edi], eax
test eax, 0x9dfa6809
fstp xword [edx + 0x15ac6c6c]
push ebp
lcall 0x2c87, 0xf0b9e476
out dx, eax
mov word [esi + 4], ss
ret 0xe5b0
xor eax, 0xebff43df
invalid
mov byte [0x6ec3e6ed], al
loop 0x1027a8b2
sahf
test al, 0x8a
adc byte [ebx + ebp*8], al
stosd dword es:[edi], eax
dec edx
mov esi, 0xbd14a5ba
dec eax
xor al, 0xdb
jecxz 0x1027a8db
jp 0x1027a92a
fisttp word [edx + 0x29]
jl 0x1027a8e0
pop ebx
push 0x4ba22ba0
fcmove st(0), st(4)
fstp dword [edi - 0x5d20fa1b]
xor byte cs:[ebx - 0x6b3d7a23], bl
cmp esi, dword [edx - 0x14]
das
inc edx
push eax
aad 0x46
retf
xlatb
cmp dword [eax - 0x4f896e1d], edx
outsd dx, dword [esi]
mov al, 0x6d
add al, 0xd6
jge 0x1027a945
push esi
mov bl, 0x5b
fnstcw word [edx + 0x5dd8f7bd]
bound eax, qword [edi]
jne 0x1027a995
dec edi
adc bh, dh
inc ecx
sti
cmp eax, dword [esi + 0x711abb90]
cmp byte [edi], dl
pop eax
retf
push esp
lcall 0xb4b2, 0x2a438feb
call 0x5a961a73
fbstp tbyte [eax + 0x6e]
dec edx
xor byte [ebp + 0x78], al
clc
inc ebp
js 0x1027a990
pop eax
mov eax, dword [0x80f5650b]
xchg ecx, eax
stosb byte es:[edi], al
adc bl, byte [edi]
loope 0x1027a987
mov bl, 0x23
mov eax, 0x6c8e1112
jae 0x1027a9ae
push ds
int 0xe9
pop esp
jo 0x1027aa1f
fcomp qword [edx - 0x34]
mov ah, byte [edi]
add esi, 0x65
insb byte es:[edi], dx
invalid
push esp
sti
adc dh, 0x18
add bl, byte [eax + 0x61613334]
test bl, dh
mov esi, dword [ebx + 0x19]
or al, 0x6b
outsd dx, dword [esi]
mov ecx, 0x70fed291
nop
pop ss
cmovo ebx, dword [ecx + ebx*4 - 0x7b]
mul ecx
out 0x4f, eax
not edx
leave
mov eax, 0xf70ddd89
iretd
inc eax
xor eax, 0x459b1a2e
jmp 0x10196031

Function at 0x102f282e
Capabilities:
Encode data using xor

Disassembly:
xor dx, 0x1b8
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x10], 0xe7b2a8e2
mov ebx, 0x2a4b238f
jbe fcn.102f282e
neg bx
lea ebx, [edx*8 + 0x6d0c432f]
add dword [esp], 0xffe00943
add edx, 0x3d4a18e3
ret
Function at 0x102f4ac0
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp - 2]
not ax
not dx
cmp cl, dl
or ax, dx
jmp 0x103aee65
mov edi, 0x243431e8
dec esp
movzx ebp, di
inc ecx
pop ebp
dec ecx
test ecx, ebx
dec eax
arpl si, si
cmc
dec esp
add esp, esi
jmp 0x1013f091
and ecx, 0x6a9f429b
add dword [esp + 4], 0xefd5e75a
mov edi, dword [esp + 0x50]
add dword [esp + 0x28], 0xffe42d72
not bx
mov dword [esp + 0x58], 0x11c34e26
mov ecx, dword [esp + 0x3c]
add bl, bl
or dword [esp + 0x4c], 0x50453abf
dec esi
ret
fild dword [ecx - 0x40b3dbb4]
cmp al, byte [ebp + 0x50]
and bl, byte [esp + 0x59]
test byte [esp + 0x4c], 0x8c
not ebx
jl 0x1031d20f
jb 0x102f4ae2
bound ecx, qword [esi - 0x38]
sbb eax, 0x59d29859
jno 0x102f4aea
aas
adc edx, esi
xchg edi, eax
aaa
cmp byte [ecx + 0x27], ch
jg 0x102f4aa1
dec esi
add dword [eax], eax
mul ebp
push 0x6e040dbc
idiv ebp
in eax, 0x68
mov esp, 0xf76e040d
std
add byte [edx + 0x49], cl
push ebx
adc al, 0xfc
aaa
jnp 0x102f4b7b
xchg ecx, eax
jno 0x102f4b77
lodsb al, byte [esi]
mov cl, 0x37
cli
jle 0x102f4b37
loop 0x102f4b60
xor dword [edi], 0xffffffa1
pop es
mov ah, 0x70
insb byte es:[edi], dx
jo 0x102f4bae
dec esi
loop 0x102f4b3b
push es
rcr byte [esp + ebx*8 - 0x7b], 1
and dword [ebx], ecx
nop
add byte [eax - 0x72], bl
retf 0xc544
jecxz 0x102f4b74
xchg dword [eax + edx*4], eax
jae 0x102f4b8c
jno 0x102f4b1e
div dword [edi - 0x269a71d3]
jno 0x102f4b40
aad 0x6e
push edi
mov esp, 0x872a73e
jb 0x102f4b81
mov dword [edx + 0x6c8ac87f], 0x48eeaeb
sbb al, 0x59
jg 0x102f4b45
mov ch, byte [ebx + ebp*8 - 0x16]
mov es, word [esp + ebx]
pop ecx
lea esi, [ebp + 0x76]
iretd
cmpsd dword [esi], dword es:[edi]
enter 0xffffffffffff9055, 0xffffffffffffff98
dec ebx
pop dword [esi]
sub byte [edx], 0x27
jne 0x102f4bcd
xchg esi, eax
xor ebp, edx
sub al, byte [esi + 0x4e]
dec esi
push ds
pop ecx
call 0x9dfae2a6
pop eax
mov esi, edi
ljmp 0xe2d9
inc ebx
invalid
push edx
xchg dword [ebx - 0x342c2d5e], ecx
or byte [0xcfae5c11], al
call esp
invalid
mov ebx, dword [esp + 0x40]
cmp byte [esp + 0x48], 0xf7
call fcn.100251b1
mov ax, word [ebp]
mov dx, word [ebp + 2]
test bh, al
stc
jmp 0x1023a34d
Function at 0x1033c658
Capabilities:
Encode data using xor

Disassembly:
or byte [esp], 0xb9
push ebp
call fcn.10284b13
seto byte [esp + 8]
mov dword [esp + 0x10], ebp
xor byte [esp + 8], 0xe8
and dword [esp + 8], 0x761b77a0
add dword [esp + 0xc], 0x1bfada
cmp dword [esp + 8], 0x3a0962f9
jbe 0x102e3240
call fcn.100e182c
enter 0xffffffffffff8652, 0x7a
push eax
fucomp st(5)
push edx
jbe 0x1033c6e0
mov dword [0x24960030], eax
xchg dx, ax
sub byte [ecx - 0x78aa110f], ch
add byte [esi + 0x28926624], dl
test eax, 0x8755eef1
fnsave dword [ecx - 0x14]
lcall 0xae71, 0x187b3ab5
out dx, al
mov byte [edi + 0x27], ah
hlt
or byte [ecx - 0x27104bc], ch
jne 0x1033c695
enter 0xffffffffffffafec, 0xffffffffffffffda
outsd dx, dword [esi]
cmp dword [esi + 0x262daaf5], esi
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
cld
rol dword [eax + 0x77], 1
les eax, [ebp + 0x78158859]
jmp 0x1033c750
or al, 0x87
rep stosb byte es:[edi], al
inc ecx
sub ebx, esp
pop ss
invalid
push 0xe25aee19
stosd dword es:[edi], eax
jno 0x1033c712
push esi
les ebp, [0xbbdbd33a]
mov ebp, 0x4755429a
or ah, byte [esp + ebx + 0x4a]
nop
sti
inc edx
out dx, al
pop esi
invalid
Function at 0x10362f17
Capabilities:
Encode data using xor

Disassembly:
xor cl, 0x41
jmp 0x1015dc63
not cl
cmc
ror cl, 1
stc
neg cl
cmp ebp, 0x290c3f75
clc
jmp 0x1008c9d0
jmp 0x1035df42
call fcn.101a814a
mov al, 0x96
pop ebp
jp 0x10362f84
fstp dword [ebp - 0x7b]
or al, 0x34
pop ebp
test dword [esp + esi], ecx
mov ebx, 0xf10c9414
adc al, 0x94
or al, 0xf1
mov esp, 0xc105a3a4
xor ebx, ebp
jle 0x10362f27
inc esi
inc esi
in al, 0xe1
je 0x10362f33
loope 0x10362fac
cli
jl 0x10362f9a
jg 0x10362ec9
test ecx, ecx
dec edi
js 0x10362f36
movsb byte es:[edi], byte [esi]
lds ebp, [edx + 0x21]
sti
lodsb al, byte [esi]
add byte [ebx + 0x136fcdad], bh
invalid
jle 0x10362fc8
pop esi
adc eax, 0xf75f5c50
inc ebp
mov ebp, 0x33653233
inc ebx
loop 0x10362f22
shl byte [eax], 1
movsd dword es:[edi], dword [esi]
cmc
pop ebx
adc edi, edx
inc edi
inc ebx
hlt
movsd dword es:[edi], dword [esi]
jl 0x10362f66
cwde
cmpsd dword [esi], dword es:[edi]
leave
loope 0x10362f3d
test al, 0xfe
xchg esp, eax
aam 0xcc
xchg byte [esp + esi*2 + 0x49], cl
add eax, 0x3179758c
loop 0x10362fce
test al, 0x29
outsd dx, dword [esi]
cld
pop eax
movsd dword es:[edi], dword [esi]
fcom qword [ecx + 0x31]
out 0xea, al
dec esi
shr byte [edx - 0x60], 1
lea ecx, [edi]
aaa
getsec
pop ebx
mov ebp, dword [edi - 0x296acdd9]
cld
fisttp word [esi]
push edi
sal dword [edi - 0x71df55c1], 0x42
adc dword [edi], 0x1b1d2775
jo 0x10362ffa
xor dword [ecx + 0x45], edx
push ecx
inc ebp
lds edx, [ebx]
xor eax, dword [eax + 0x20]
mov dh, 0x7a
inc esi
aaa
cld
inc eax
and byte [esi - 0x3c8b986], dh
cwde
xor edx, dword [ecx - 0x55]
xor al, 0x5c
aad 0x40
jne 0x10363014
stosd dword es:[edi], eax
test byte [ebx - 0x38d8a851], al
mov byte [0x4d1e7907], al
add eax, 0x8b94b74e
pop eax
dec esi
imul esi, dword [esi], 0xb1302baa
pop ebx
adc esp, eax
pop ds
cmp esp, edi
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
salc
stosd dword es:[edi], eax
in al, dx
and dword [edx + esi*8 + 0x552cbe00], esi
pop ds
xlatb
sub al, 0x3b
push ds
fiadd word [ecx - 0x2791d84]
xchg ch, bh
xor ch, ch
mov cl, 0x65
or al, 0x40
pop eax
and edx, dword [ecx]
invalid

Function at 0x1037564d
Capabilities:
Encode data using xor

Disassembly:
neg edi
add dword [esp], 0xefe53e3f
Function at 0x10383f3c
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [esp + 0x1c]
xor byte [esp + 0x20], 0x63
add dword [esp + 8], 0xefcfc2c5
not dword [esp + 0x20]
sub dword [esp + 0x24], 0x4d0618d7
test dword [esp + 0x24], 0x60dd5433
push dword [esp + 0x34]
popfd
lahf
pop esp
dec ebx
fnstenv [edx - 0x40]
stosd dword es:[edi], eax
wait
push edi
pop ds
adc al, 0x7b
rep lodsd eax, dword [esi]
aam 0xd6
xor eax, 0x8a329d2d
das
adc byte [edx - 0x4f08338d], bh
xor bl, byte [ebx - 0x1f]
invalid
jae 0x10086b61
dec edi
inc edi
cdq
pushal
pop edi
push ebx
jo 0x10383f13
jbe 0x10383fc1
mov dh, 0xc8
ficom word [esp + 0x6de1ff0f]
js 0x10383f63
invalid
xchg edx, eax
movsd dword es:[edi], dword [esi]
mov esi, 0xc37b7188
test al, 0xcc
in eax, dx
xchg dword [ebx + 0x37], ebx
push ebx
and word [edx + 0x5a], bx
pushfd
jl 0x10383fe9
sub al, 6
add ebx, dword [eax + 0x76ed172b]
push 0x7e
scasd eax, dword es:[edi]
cli
xchg esp, eax
sbb ebx, dword [edi - 0x50923a68]
cmp al, 0xa1
sub byte [eax + 0x635b5123], cl
test eax, 0x922104b5
and eax, 0x7b55ef16
sub eax, dword [eax - 0x41]
sar byte [esp + ebp + 0x34], 0x55
sbb dword [ecx - 0x3a30d5ad], edi
push esp
cwde
push 0x4f
and bh, byte [ebx - 0x16]
adc dword [eax + ecx*2], 0x7ba06296
scasb al, byte es:[edi]
mul byte [edx]
cli
push cs
outsb dx, byte [esi]
jg 0x10384043
adc al, 0xd1
jmp 0x10384044
mov ah, 0x15
jle 0x10384043
pop ebx
cmpsd dword [esi], dword es:[edi]
add dh, byte [esi - 0xb]
dec edx
add dword [ecx], 0x4b
sbb al, 0x95
movsd dword es:[edi], dword [esi]
add bh, dh
push cs
lcall 0xc60c, 0xb9941bd5
cmp dword [edx - 0x432c587a], ebx
invalid
pop ebp
jmp 0x1038408e
clc
aaa
std
jae 0x103840d6
inc edi
mov ds, word [edx + eax*4 + 0x6df49211]
ret 0x8079
add byte [eax + edi*8 + 0x781c3d74], 0x20
mov ebx, 0xda9903a2
outsb dx, byte [esi]
stosd dword es:[edi], eax
insd dword es:[edi], dx
add dword [ebx + 0x63f2f778], 0x64
xchg edi, eax
out 0x1c, al
mov esi, esi
rcr byte [esi + 0xb], cl
imul esi, dword [eax], 0x73
imul esi, dword [edx + edx*4], 0xd950e833
jae 0x1038407d
div edx
arpl word [edi + edx*4 - 0x1a], sp
sbb al, 0x89
not dl
pop esi
or ebp, dword [ebx + 0x30]
jae 0x1038411a
xor al, 0x92
xor ebp, eax
push eax
fnstenv [ebx - 0x3c]
das
mov al, byte [0x11f29caa]
cmc
shr byte [ebp + 0x31], 1
push 0x1e
movsb byte es:[edi], byte [esi]
test byte [eax - 0x2c], al
pop edx
cmp byte [eax + 0x50], bh
lds esp, [edi]
cdq
jne 0x10384129
push esi
int3
jl 0x103840f8
out 0x4e, al
invalid
mov edx, 0x707a6025
outsd dx, dword [esi]
mov ebp, 0x9aa84c24
mov eax, 0x799c928d
xor esi, ecx
jnp 0x103840a1
jns 0x1038416e
pushfd
aaa
push eax
pop ss
jl 0x103840f8
cmp al, 0x84
and dword [eax + 0x76], ecx
invalid
jns 0x103840d2
xchg ebx, eax
add esp, dword [edi - 0x7a]
xlatb
push ecx
add eax, 0xce876c0a
adc ebx, dword [eax + 0x503f029a]
aas
push esp
movsd dword es:[edi], dword [esi]
lcall 0xa554, 0x3f503f02
arpl word [esi - 0x4b], sp
jb 0x1038415a
and byte [ecx - 0x49], dh
pop ebx
out 0xbc, al
xchg ebx, eax
invalid
outsb dx, byte [esi]
stosb byte es:[edi], al
out dx, eax
xor dword [edx - 0x26], esi
jmp 0xdeca800e
aas
shl byte [ebx - 0x1e6dfb1], cl
mov bh, bh
xchg ecx, eax
ljmp 0x70b
Function at 0x1038cbef
Capabilities:
Encode data using xor

Disassembly:
dec eax
stc
not eax
ror eax, 1
cmp ch, 0x7d
xor ebx, eax
cmp esi, 0x50ea6f91
add ebp, eax
jmp fcn.10035410
mov word [esi + 4], ax
jmp 0x103b9819
mov cl, byte [esi + 2]
lea esi, [esi - 2]
cmc
shr ax, cl
jmp 0x10307a83
invalid
call fcn.1028d9a4
clc
movsd dword es:[edi], dword [esi]
add eax, 0x2cc2f1eb
inc edi
or dword [edi - 0x1c], 0x70
fsub dword [ebx - 0x38]
adc esp, dword [ecx + 0x36]
mov dword [edx], esi
jbe 0x1038cbe3
xor dh, byte [esi - 0x27]
and dword [ebx + 0x44], ebp
aas
out dx, al
push ds
xchg edx, eax
outsd dx, dword [esi]
lodsb al, byte [esi]
xlatb
jae 0x1038cc07
push ebx
daa
sbb byte [ecx + ebx*8 + 0x6dfa72c5], 0xc5
scasb al, byte es:[edi]
cdq
mov es, word [esp + edx*8 + 0x7812dd38]
pop esp
out dx, eax
inc edx
or eax, 0x4b0aee99
arpl word [ebx - 0x3e8e319], ax
arpl word [eax - 0x3d], sp
push es
adc cl, byte [ecx + 0x5bec625]
imul eax, dword [edi + edx*2 - 0x77], 0x3a
xchg edx, eax
pushal
je 0x1038cbfb
xlatb
jae 0x1038cbdd
fild dword [eax - 0x5c]
pushfd
adc dword [0xe394da2f], ecx
pop eax
fild dword [ebx + 0x14]
dec edi
wait
stc
out dx, eax
test dword [esi], 0xde8ff493
insb byte es:[edi], dx
jecxz 0x1038cc6b
cli
mov ah, byte [edi - 0x48]
aaa
bnd jb 0x1038cc22
cmpsd dword [esi], dword es:[edi]
je 0x1038cc52
aas
or byte [eax + 4], 0x85
xchg byte [edx - 0x1b], dl
in eax, 0xa1
push eax
push 0x26
popfd
pushfd
neg dword [eax - 0x3baa3acf]
mov dword [ecx - 0x16], esi
or byte [ebx], al
and dword [ecx + 0x1a], 0x49
mov bl, 0x6b
or dword [ebx + 0x15], esi
mov ah, 0x8e
test dword [ebx], esi
scasb al, byte es:[edi]
cdq
out dx, al
push cs
mov esi, 0x73318a3d
dec eax
invalid
pushfd
pop dword [esi]
shr ah, 0x85
xchg al, ah
mov eax, dword [edi]
lea edi, [edi + 4]
test ax, bx
stc
xor eax, ebx
ror eax, 1
jmp 0x101d8765
Function at 0x104dccf7
Capabilities:
Encode data using xor

Disassembly:
inc ecx
push ebp
inc esp
xor dword [esp], eax
inc ecx
pop ebp
inc ecx
cmp dl, al
clc
stc
dec ebp
arpl ax, ax
inc cx
test edi, 0x34d73cc
loopne 0x1041a20b
xor al, 9
and al, byte [eax]
movzx dx, byte ss:[eax]
clc
add ebp, 2
jmp 0x10581129
inc eax
dec bh
inc ebp
test bh, dl
jmp 0x10675a5d
dec ecx
add edi, 4
inc cx
test edx, 0x4466098b
cmp ecx, ecx
inc ebp
xor eax, ebp
cmc
inc ecx
rol eax, 2
stc
inc ecx
sub eax, 0x3dff5100
inc ecx
not eax
stc
inc ecx
sub eax, 0x1dbc4112
inc eax
cmp dh, 0x70
jmp 0x1041a208
mov edx, dword [esp + 8]
call fcn.1044b661
inc bp
mov eax, dword [esi]
inc eax
seta bh
rol edi, 0x84
stc
dec ecx
add esi, 2
inc ecx
movzx edi, byte [edi]
clc
dec ecx
add edi, 1
inc ecx
xor bh, ch
jmp 0x106d5704
xor edx, ebx
clc
stc
cmc
ror edx, 3
jmp 0x105c6611
mov word [ebp], dx
sal edx, cl
not dl
rcr dl, 0x9a
sub esi, 4
cmc
bts edx, esi
sal dl, 1
mov edx, dword [esi]
cmc
jmp 0x10571ce2
not edx
cmp esp, esp
stc
test di, si
xor ebx, edx
cmp edi, eax
test bp, bp
test bp, 0x8d7
add edi, edx
push edi
ret
inc eax
not bh
jmp 0x1043eb3e
not edx
jmp 0x10681868
inc eax
ror bh, 1
jmp 0x105a425f
inc esp
xor ch, bh
cmc
inc ebp
test cl, dh
test esp, 0x27ba1504
inc sp
mov dword [esp + edi], eax
inc cx
neg eax
stc
inc cx
bswap eax
inc ebp
mov eax, dword [edi]
cmp eax, esp
jmp 0x1047a4f3
inc edx
cmc
jmp 0x10589c10
inc eax
dec bh
cmc
jmp 0x105d89ec
Function at 0x100036d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100134c8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1001f008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, 0x1001bf31
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10006200
test al, al
jne 0x1000378d
mov eax, dword [ebp + 0x18]
inc eax
push eax
call fcn.10006ec8
add esp, 4
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov ebx, eax
mov edx, ebx
cmovae ecx, dword [ebp + 8]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10003730
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003742
sub esi, ecx
inc esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.10009b20
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x100037bd
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100037b3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100037cf
push edx
push ecx
call fcn.10006952
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1000a250
int3