joyce8/EMBER2024-capa huggingface dataset:
Function at 0x99a582
Capabilities:
Encode data using xor

Disassembly:
mov word ss:[edx], cx
call fcn.00ed3644
mov edx, 0x9526008a
rdtsc
call fcn.00ed56ae
mov eax, 0xf0285121
movsx esi, ax
mov ax, word [edi + esi - 0x5121]
mov ecx, esi
btr esi, ecx
mov si, word [edi + esi - 0x511f]
sbb cx, cx
inc ecx
mov cl, byte [edi + ecx*4]
jno 0xeb149c
xor edx, esp
fistp word [0x83706d91]
into
ret 0x641f
jmp 0x96f303
movzx di, byte [edx]
rol dword [esp + 0xb], 0x3a
jb 0xeb1487
cmp byte [ecx], 0x2b
jecxz 0x99a563
cmpsb byte [esi], byte es:[edi]
push esp
out dx, al
add cl, cl
mov ebx, 0x7c81a566
push ecx
push edx
adc ebx, eax
mov esi, 0xf74c6fd
loop 0x99a59c
movsw word es:[edi], word [esi]
cmp dword [ecx + edx*2 + 0x52], 0xfdbec311
invalid
arpl bx, di
xchg ebp, eax
adc dword [edi + ebp*2 - 0x1e], ebp
out dx, eax
adc byte [eax], dh
invalid
dec ecx
adc edx, 5
inc cx
mov dword [edx], edi
dec eax
lea esp, [esp + 0x10]
jmp fcn.00df2538
push 0x199a3bb7
and byte [esp + 3], 0x15
adc edi, 4
jmp 0xf9c1e9
dec dword [esp]
call fcn.00f61a40
lea esp, [esp + 0xc]
jmp fcn.00e06160

Function at 0x99e483
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esi], eax
lea esp, [esp + 8]
jmp fcn.00e2b2e5

Function at 0x99fe57
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0xcd98b58c
shld dx, ax, cl
jmp 0x996e6a

Function at 0x9a1bdf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.00e2b2e5

Function at 0x9a3c6f
Capabilities:
Encode data using xor

Disassembly:
call fcn.00978163
mov ecx, 0xdf35bfb3
xor cx, 0xf119
imul ecx, ecx
movzx cx, byte [ebp]
mov eax, 0x6e20c193
sub eax, 0xe58a8ebb
sub ax, 0x3f09
mov al, byte [ebp + 2]
jl 0xedff33
mov word [ecx - 0xdffac3e], ds
pop edi
pop edi
jb 0x9a3c94
mov ebx, eax
adc eax, 0xd2dc3c0c
sbb dword [ebx - 7], ebp
xor eax, 0xea66a476
shl dword [ebx - 0x27], 1
xor eax, 0xc281fc41
push ss
sub esp, dword [esi - 0x390bd6db]
mov ah, cl
adc ebx, dword [ecx + 0x8c6035]
shr dword [edx + eax*2 - 0x32470352], cl
dec ebx
cmp bl, byte [ebp + 0x38]
sbb ebx, dword [esi - 0xa]
insd dword es:[edi], dx
push edx
xor byte [0x589e4c88], dl
in eax, dx
jo 0x9a3c95
imul ebp, dword [ecx - 0xdf55bfe], 0x54b405f5
jmp 0x9a3d2a
cmpsd dword [esi], dword es:[edi]
cmc
mov ecx, 0xdb451764
cmp eax, 0xcaf12e43
stosd dword es:[edi], eax
aaa
invalid
add esi, 2
jmp 0xe6f959
or dx, cx
push 0x7c0ad6a3
jmp fcn.00df647e
adc ebp, 1
push 0x8a28e7a3
ror byte [esp + 3], 0xc4
not cl
neg dword [esp]
sar byte [esp + 1], 5
not al
and cl, al
mov word [ebp], cx
call fcn.00e3cdfc
jmp 0xe433e1

Function at 0x9a5048
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add edi, eax
mov dword [esi], edi
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0x9a71fe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esi], cx
push 0x4e370109
jmp 0xe29fad

Function at 0x9ad90c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sal byte [esp + 7], 0x62
adc esi, 2
mov word [esi], dx
lea esp, [esp + 8]
jmp fcn.00e2b2e5
Function at 0x9addde
Capabilities:
Encode data using xor

Disassembly:
push ebp
imul ebx, dword [ebp - 0x11], 0x76d71bdb
pop ebp
pop edi
sbb bl, dh
push edi
pushal
add esi, dword [ecx - 0x5427bbeb]
int 0x14
arpl word [ebp - 0x7397ac05], sp
jmp 0xeedbbff5
insd dword es:[edi], dx
mov dword [0x154cdc7b], eax
lodsd eax, dword [esi]
push 0xffffffffffffffe8
push cs
into
cmp dword [ecx + 0x4dff68d8], ebx
mov dword [esp], 0xfbb2c920
adc eax, edx
shr word [esp + 1], 0x4a
jb 0xe21b9c
fisttp qword [ecx]
mov ch, dh
mov ch, 0xf9
mov fs, ebp
xchg ebp, eax
salc
xchg edx, eax
mov dword [ecx - 0x1e], esi
inc edx
loope 0x9add8f
mov edx, 0x95c08da1
adc edx, dword [eax + 0x4b]
mov esp, dword [0xba647f6c]
or eax, 0x884d3dc8
cmc
add bl, byte [esi]
cmp ecx, ecx
jnp 0x9addb6
cmp al, 0x28
outsb dx, byte [esi]
invalid
mov dword [ebp - 4], eax
shr word [esp], 0xa6
test ebx, ebx
push 0x6e976512
lea esp, [esp + 8]
je 0x9566b8

Function at 0x9ae179
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.00e2b2e5

Function at 0x9b2117
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xada46728
mov byte es:[edx], al
mov byte [esp], 0x9a
mov dword [esp + 8], 0x1b9855b4
push 0x780c780a
lea esp, [esp + 0x10]
jmp fcn.00e2b2e5

Function at 0x9b5ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esi], edx
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0x9b9173
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esi], dx
push 0x3eb92804
not byte [esp + 8]
jmp 0xe39454
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0x9b9b4f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0xf4fb42
adc ebp, 8
call 0xef3f05
inc dword [esp]
and dword [esp], 0x20947a8b
test edx, edx
lea esp, [esp + 4]
je 0xf0db39
push 0xc925b089
push 0xd1a8c1ae
mov dword [esp + 4], ebx
lea esp, [esp + 4]

Function at 0x9ba17a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x9beaf7
lea esp, [esp + 4]
jmp fcn.00e2b2e5

Function at 0x9ba1de
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
jmp fcn.00e2b2e5

Function at 0x9be73d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp]
lea esp, [esp + 4]
call eax
mov ebx, 0x6e8d951a
mov ebp, dword [ebp + ebx - 0x6e8d951e]
mov dword [ebp + ebx - 0x6e8d951a], eax
mov esi, ebp
push ebx
push ebx
mov ebx, dword [esp + ebx - 0x6e8d9512]
mov ebp, dword [esp + 0xc]
jmp 0xe06539
jmp 0xf24d00
lea esp, [esp + 0x10]
jmp fcn.00e2b2e5

Function at 0x9c2f8e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0xdf128f
mov dword [esi], edi
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0xdf1d32
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sal edx, cl
mov dword [esi], edx
not word [esp + 6]
lea esp, [esp + 8]
jmp fcn.00e2b2e5

Function at 0xdf4b81
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0xe38eed
lea esp, [esp + 8]
jmp fcn.00e2b2e5

Function at 0xdf907f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not byte [esp + 0xb]
mov word [esi], cx
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0xdfd249
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5
Function at 0xdfd66b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x83a2feb1
mov word [esi], ax
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0xe0513e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.00e2b2e5

Function at 0xe0d4b1
Capabilities:
Encode data using xor

Disassembly:
push 0xe51cb7bf
dec ecx
add edx, 2
call fcn.00f705b3
mov esi, 0x44281ca6
shr esi, 0x3e
movzx edx, si
mov esi, dword [ebp + esi - 1]
lea edi, [edx - 0x63f733d8]
dec dword [ebp + 0x8cc28ba]
pushfd
lea ebp, [ebp + edx*2 + 2]
movzx ecx, dx
not edx
mov edi, esi
ror dx, cl
jns fcn.00e9d0bf
mov esp, 0x5dce1cb1
dec ebp
sbb dword [edx + 0x1694d7aa], 0xffffffc5
jg 0xe0d47c
aas
bound edx, qword [edi + 0x3ee53774]
push ebx
xchg edx, eax
inc edx
rcr byte [edi + esi*2], 1
test dword [esi], ecx
and edx, dword [edi - 0x16]
mov esp, 0x8d7fc555
cmpsd dword [esi], dword es:[edi]
mov eax, dword [esi - 0x6448b669]
dec eax
jle 0xe0d57b
jl 0xe0d4bf
or dword [ecx - 0x585bc9c4], esi
clc
dec ecx
pop ebx
dec edx
scasb al, byte es:[edi]
outsb dx, byte [esi]
push edx
sal cl, cl
sbb eax, 0xc12344a0
xor edi, edi
xchg esp, eax
inc eax
dec ecx
sar dword [esi + 0x6562aa54], 0x95
or al, 0xf4
sbb eax, dword [ecx - 0x57b38821]
test dword [ecx], edx
xor ch, ah
stosb byte es:[edi], al
or bh, byte [ebx - 0x61]
adc esp, dword [edx]
xor cl, byte [edx]
in al, 0x5d
in eax, dx
sbb bl, bh
adc ah, dl
imul eax, dword [ebp + eax*4 + 0x55], 0xba283b37
popal
or al, 0x37
test eax, edx
mov bl, 0xd8
sub al, al
insb byte es:[edi], dx
add eax, 0x29203a0
adc al, 0xc8
pop ss
int1
fisttp word [ecx + ebp*2]
fidivr dword [esp + ecx*8]
aad 0x4d
xchg ebp, eax
popfd
push 0x74bcdabf
mov dh, 0x1d
shl dword [eax], cl
mov eax, 0x8fc6b9ed
sets byte [edx]
push eax
in al, 0x9b
in eax, dx
mov ecx, 0x980f8fc6
sub dl, byte [eax - 0x1c]
wait
inc ebx
xchg byte [edx - 0xb], cl
pop edi
mov ch, 0x71
xchg byte [esi], ah
div dword [edi]
cld
jp 0xe0d5d7
int3
xor edx, dword [eax - 0x49]
or eax, 0xeff5b5f9
out dx, al
sar edi, cl
pop eax
mov al, byte [0x9d1b2cc0]
aaa
cmp byte [ecx - 0x29112147], cl
cmp byte [ecx], ch
das
mov dword [ecx + 0x38d6eede], edi
sub dword [edi], ebp
mov ebp, 0xe7825eaf
inc ebx
dec esp
dec ecx
sbb dword [esi], ebx
jecxz 0xe0d5c4
imul ebx, ecx, 0xfffffffd
and bh, byte [eax + ecx*4 - 0x11]
outsb dx, byte [esi]
retf 0x9834
Function at 0xe0f53c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x96123d
xor ebx, edx
shl word [esp + 1], 0x2f
rol byte [esp + 1], 0xc6
sbb esi, 4
mov dword [esi], edx
call fcn.00e9ebbe
mov ecx, 0xe2b51131
mov edx, 0x978de83e
mov cx, word [esi]
sal edx, 0xbe
and edx, edx
or dx, word [esi + edx - 0x7ffffffe]
jmp 0x954c57
movd eax, mm6
xor al, byte [ebp + 0xf3a19a2]
iretd
and byte [ebx + 0x2851b6c], cl
mov dh, 0xd7
pop es
sub byte [ecx], 0x44
jns 0xf423c1
hlt
add cl, byte [ebx]
xchg ecx, eax
mov cs, word [bx - 0x61]
aad 0x15
adc byte [edi + 0x13a77134], dl
imul esi, dword ss:[edi + 0x35], 0x4cc319c3
mov edi, 0x86ebb3b4
mov byte [0x39e5b032], al
mov al, byte [0xdb6edac9]
add al, 0xf7
cli
inc edx
push cs
clc
xchg ebx, eax
adc byte [ecx - 0x7b], bh
jle 0xf42490
add eax, 0xa8703ece
jl 0xf423ca
clc
sub esp, 0xfffffff1
ja 0xf423d3
fsubp st(1)
test eax, 0xb03db3c1
ja 0xf42461
jmp 0xf42480
enter 0xffffffffffffa51d, 0xffffffffffffffdd
inc ebx
xchg edi, eax
cmp ch, 0x9b
std
wait
jbe 0xf42401
invalid
mov dword [esp], 0xec379399
neg dword [esp]
xor edx, 0x74bd2225
dec dword [esp]
jge 0xf65c10
add byte [edi], cl
lea ecx, [ecx - 0x64fffdc9]
wait
sub ah, bh
pop ebp
dec esi
out dx, eax
add dl, byte [esi - 0x2be8da9e]
inc eax
cmc
and eax, 0xf540d417
out dx, al
mov bl, 0x96
fiadd dword [ebx - 0x3e531db2]
cmp eax, 0xf56b4508
ror byte [esi], 1
push ecx
sahf
adc bh, byte [ebx + 0x5dc1b2a1]
mov ah, 0x7f
nop
movsd dword es:[edi], dword [esi]
mov esi, esi
jge 0xf4245a
dec eax
pop dword [edx*4 + 0x1ba04f79]
lodsb al, byte [esi]
in eax, dx
mov ebp, dword [edx]
xlatb
scasd eax, dword es:[edi]
inc edi
cmpsb byte [esi], byte es:[edi]
mov ebp, 0xf906ad7c
or esp, ecx
aad 0xef
and ebx, dword [esi + 0x1595f095]
stc
sahf
in al, dx
pop ebx
xchg esi, eax
adc eax, 0x65d17550
cmp dh, byte [esi + 0x6ecebfc5]
sub al, 0xde
invalid
sub edx, 0xcd2c352e
shl dword [esp], 0xc1
ror word [esp + 2], 0x6d
shr dword [esp], 0x6f
not edx
jp 0xe0f522

Function at 0xe1053c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esi], ecx
push 0x5800ad04
lea esp, [esp + 0x10]
jmp fcn.00e2b2e5

Function at 0xe1323e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esi], ax
lea esp, [esp + 0x10]
jmp fcn.00e2b2e5
Function at 0xe185e5
Capabilities:
Encode data using xor

Disassembly:
adc esi, 3
call fcn.00e73bf4
call fcn.009ad10a
mov ebp, 0xc68504a7
mov edx, dword [esi]
add esi, 4
lea ecx, [ebp + ebp*8 + 0x35203831]
mov ebp, edx
lea edx, [ecx*4 - 0x1d73dd41]
xor cx, dx
jl 0xe2b2d0
sub ebp, 1
mov edx, 0xb0ad832d
add byte [eax], al
add byte [edx - 0x4f527cd3], bh
call fcn.009abb33
sahf
mov bl, byte [eax]
sbb edx, dword [esi - 0x7eb3e053]
cwde
test al, 0xd3
sbb ah, bh
lodsd eax, dword [esi]
sbb ebp, 0x4c46e540
fld qword [eax - 0x1b]
inc esi
dec esp
aas
in al, 0x89
test dword [eax - 0x40], ebx
scasb al, byte es:[edi]
xor eax, 0xeaa9a407
cmp ch, ah
cmp ebp, edi
loopne 0xe1860f
mov bh, 0x87
pop ecx
jne 0xe186a9
cld
dec edi
mov ebx, 0xb33ff801
clc
mov cl, 0xc3
adc al, byte [edi]
div byte [ebx - 0x3a]
jge 0xe1862d
invalid
and ecx, ebx
add al, 0xc0
xchg edi, eax
movsd dword es:[edi], dword [esi]
out dx, eax
ret
int 0x22
sahf
sub ebx, dword [edi + 0x28]
stosd dword es:[edi], eax
or dword [esi - 0x59eb538f], edi
inc eax
jb 0xe186fc
xchg ebp, eax
cmp dword [ebp - 0x1e5978e2], ecx
jbe 0xe1867a
pushfd
jle 0xe186df
mov dword ss:[ebp + 0x47b0702c], ebp
xchg edx, eax
int 5
adc byte [edi + edi*8 - 0x322ff53a], cl
xchg edx, eax
scasd eax, dword es:[edi]
adc ah, dl
movsd dword es:[edi], dword [esi]
pushal
xchg edx, eax
xor al, 0x9d
je 0xe18746
mov al, 0x47
xchg edx, eax
aad 0x7c
cmp al, 0x10
mov byte [0xf79030fa], al
lds ecx, [edi]
cmp bl, bl
in al, dx
xor al, 0x9f
or eax, dword [edx]
mov dl, byte [ecx]
cmpsd dword [esi], dword es:[edi]
sub eax, 0x475692c9
push esi
inc edi
invalid
dec esp
or byte es:[ecx + 0x6d6], al
add byte [eax + 0x2e], ch
int 0xb5
lodsd eax, dword [esi]
call fcn.009aa96b
mov ecx, 0x6b13d138
mov ax, word [esi + ecx - 0x6b13d138]
shl cx, 0xa1
mov edx, ecx
lea edx, [edx + ecx - 0x4cc7f87a]
mov dx, word [esi + ecx - 0x6b13a26e]
mov cl, byte [esi + ecx - 0x6b13a26c]
jb 0xec8ba6
mov ecx, 0x871bf69c
lea ebx, [ecx + ecx + 0x589a3938]
mov ebx, ebp
mov ecx, 0
sub ebx, ecx
mov eax, dword [edi]
call fcn.00e17e83
add al, 0x8f
xchg edx, eax
mov eax, 0x18c2606f
std
shl byte [esi], 1
sub eax, 0x5f4d3fec
xor al, 0xfa
mov word [esi - 0x157a49ae], gs
enter 0xfffffffffffffb56, 0x15
cmpsd dword [esi], dword es:[edi]
and al, 0x4c
pop esp
fistp word [ebx - 0x77b74840]
insb byte es:[edi], dx
xchg ebp, eax
aas
and dword [ebx - 0x42f3a5a1], 0xd87f6087
int3
jbe 0xe04122
mov edi, dword [esi]
mov eax, 0xdb216e36
jmp 0xe458f0
dec ecx
ror ebp, 0x1a
dec eax
sbb esi, 2
inc esp
movzx ebp, word [esi]
call fcn.00ea6233
call fcn.00f6be96
xchg bh, bl
call fcn.00e597df
dec word [esp + 2]
mov dword [esp], edi
mov edi, 0xdbb7da96
movzx edi, byte [eax]
call fcn.00e3d22b
mov edx, dword [edi]
mov bp, word [edi + 4]
add edi, 6
call fcn.00957f50
rcl byte [edx - 0x5f], 0x59
retf 0xddb6
dec edx
mov dword [esp + edi - 0x1903d122], 0x9cb81cb6
inc di
movzx edi, byte [ebp + edi*2 - 0x3207a244]
jno 0xf83ab3
jle 0xf64bcd
dec ecx
adc edx, 6
jmp 0xe185e0

Function at 0xe22599
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
jmp fcn.00e2b2e5
jmp 0xe196cd

Function at 0xe23a12
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5
Function at 0xe23f89
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0xeb5b93
lea esp, [esp + 0x14]
jmp fcn.00e2b2e5

Function at 0xe28d52
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0xa40b4583
and eax, eax
mov ax, word [edi]
push 0x68995b7
shl word [esp], 0xd
setnp byte [esp]
adc esi, 2
mov word [esi], ax
mov dword [esp + 4], 0x23b6ec3a
push 0x57ad418e
jmp 0xef6470
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0xe2b2aa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + esi - 0x31a0ffdc], ecx
sar si, 0xaa
mov dword [esp + esi - 0x31a10000], 0xe36fe83
lea esi, [esp + esi - 0x31a0fffc]
lea ebx, [esi - 0xf4]
mov esp, ebx

Function at 0xe2b2f5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sal dword [esp], 0x16
shr eax, 8
jmp 0x9c3e2f
ret 0x561c
and eax, 0xeac05204
mov dword gs:[esp], ebx
cpuid
jp 0xf84c9d
mov ch, byte [esi + 0xe]
pop esp
add al, ch
out 0x94, eax
push esp
add byte [edi], cl
add eax, 0x14d92568
dec esp
call fcn.00f0d31b
syscall
push 0x4c14d925
pushfd
dec eax
shr dword [esp + 8], 0x94
dec eax
mov dword [esp + 8], 0xfeb45a20
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.00e44487
bound eax, qword [ebp + 0x3ee446c2]
je 0x9c3e72
add byte [ebp + 0x24648d48], bl
or al, ch
sub eax, 0x62004806
test edx, eax
inc esi
in al, 0x3e
add al, 0xd5
sar byte [edx - 0x5e], 1
jbe 0x9c3e09
mov dh, 0x22
mov al, 0x6e
inc esi
leave
sbb al, 0x81
pop esi
cmp ebp, esp
je 0x9c3e9b
pop es
sal dword [ecx], 0x28
ficomp word [ecx + 0x22cde052]
in eax, 0x12
xor eax, 0x765a1385
sub dh, bl
cdq
push edx
loopne 0x9c3e4c
and ah, ch
adc dh, byte [0x765a1385]
or eax, ebp
dec edx
jge 0x9c3e2a
mov ah, 0xff
pop edi
int1
jge 0x9c3e79
add eax, 0xf88d92a1
loope 0x9c3e1d
jge 0x9c3e3d
mov eax, dword [0xa1d899ae]
aam 0xc6
mov eax, dword gs:[0x2fe4b24c]
scasb al, byte es:[edi]
cdq
fsub dword [ecx - 0x5e9a392c]
dec esp
mov dl, 0xe4
das
or al, 0x9e
push cs
shr dl, cl
sbb eax, 0xee3cd66a
int3
mov dword [esp], 0xe58b0a85
and edx, 0xff
rol byte [esp + 2], 0x41
mov edx, dword [edx*4 + 0xf9f2d4]
jo 0x969175
call fcn.00fa77c2

Function at 0xe2f3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
jmp fcn.00e2b2e5

Function at 0xe32852
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0xeb5642
daa
cmp dl, byte [esi]
xchg edx, eax
or dword [ebp + 0x36], ebp
into
pop ebp
in eax, dx
mov gs, word cs:[0x1df64a81]
push ecx
pop edx
inc ecx
xchg esp, eax
push ds
and cl, cl
and dl, dl
xchg byte [edx + 0xc8fa942], ah
mul byte [edx - 0x3c2c7c95]
cmpsb byte [esi], byte es:[edi]
jmp 0xe2227008
or dl, al
not dl
push 0x30382f07
push 0x2e8d8690
push 0x1aa324a4
mov word [esi], dx
lea esp, [esp + 0x14]
jmp fcn.00e2b2e5
adc esi, 1
jmp 0xe66f23

Function at 0xe33ae6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xfc39e9ac
jmp 0xeca472
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0xe37716
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0xe38a67
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0x539a063e
push 0xdd3abdba
lea esp, [esp + 8]
jmp fcn.00e2b2e5
Function at 0xe396ed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
jmp fcn.00e2b2e5
sub dword [esp + 4], 0xa220390f
adc esi, 6
mov byte [eax], dl
jmp 0xe3698d

Function at 0xe3ddf4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
div ecx
push 0x8005be88
mov dword [esi], edx
jmp 0xe54ae0
not word [esp + 2]
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5
mov ecx, dword [esi + 8]
mov dword [esp], 0xd936680
push 0xca2cb0a9
adc esi, 3
jmp 0x97d22e
jmp 0xf70134
mov dword [esi + 4], eax
jmp 0x9b494d
jmp 0xeb4ee2

Function at 0xe3e1f5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x13a174a0
lea esp, [esp + 0x18]
jmp fcn.00e2b2e5

Function at 0xe46a9b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esi], ax
lea esp, [esp + 0x14]
jmp fcn.00e2b2e5

Function at 0xe46c89
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
jmp fcn.00e2b2e5

Function at 0xe47a91
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xc68b1520
adc edi, 4
shl dword [esp], 0xd8
jbe 0xef4c4e
adc esi, 5
push 0xee371d24
shl dword [esp], 0xda
shld edx, eax, cl
push 0xa011430
push 0x3dbf78b6
mov dword [esi], edx
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5
add ah, ch
not dl
adc cl, 0xa9
pop ebp
jmp fcn.00dfe0bd
jne 0x9ba19d
sar edx, 1
inc eax
wait
mov edi, dword [eax + 0x33e703be]
test dword [ebx - 0x340aa02b], ebp
xor bh, byte [esi + 0x52]
pop ss
xchg edi, eax
add ecx, edx
jne 0xe47a9b
movsd dword es:[edi], dword [esi]
mov al, 0x2f
test byte [ecx], bh
clc
push esi
jno 0xe47afb
adc dl, byte [eax]
or al, 0x7d
and esi, dword [edi + 0xd34b95]
mov cl, 0x3e
mov al, 0xea
jg 0xe47a6d
mov al, byte [0x6ee77d38]
mov dword [0xcf4d43a5], eax
dec eax
sub eax, 0x5bf8a7a6
shr byte [esi - 0x4e], 0x58
dec ecx
sub eax, 0x398e11a6
push esi
test eax, 0xc00825f8
cdq
cli
add byte [eax - 0x515e9651], 7
sub byte [0x4528ea0d], bh
mov esp, 0xeccae60c
out 0xca, al
in al, dx
outsb dx, byte [esi]
mov bh, 0xd2
pop ecx
dec dword [eax - 0x4a5b490a]
push eax
push edx
aam 0x3e
mov dh, 0xd2
pop ecx
sbb al, 0xe8
xchg ebp, eax
test eax, 0x2bdb0756
out dx, al
invalid

Function at 0xe481a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esi], cx
push 0xbe899c87
lea esp, [esp + 0x18]
jmp fcn.00e2b2e5

Function at 0xe48a48
Capabilities:
Encode data using xor

Disassembly:
shr edx, cl
mov dword [esi], edx
jmp 0xe644c3
call fcn.00f6cc66
invalid

Function at 0xe499fa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x313c3326
mov dword [edi], edx
lea esp, [esp + 0x14]
jmp fcn.00e2b2e5
Function at 0xe51c9c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ror dword [esp + 9], 0x50
jae 0xe6f166
xor bx, ax
jmp 0xe23cd5
push 0x5e1c6932
sub edi, 2
push 0xd180d12b
call fcn.00e02a28
mov eax, 0xd4308517
mov eax, edi
jmp 0xe51c61
call fcn.00f6526d
mov edx, 0x5599b611
movzx dx, byte [edi + edx - 0x5599b611]
mov ecx, 0x938dae28
mov cl, byte [edi + 2]
push 0x8dafa622
sal dword [esp], 0x6a
and dword [esp], 0x4aa5fdae
adc edi, 2
add dl, cl
call fcn.00ecc891
lea esp, [esp + 0x24]
jmp fcn.00e2b2e5
mov si, word [ebp]
mov eax, 0xd2866d2c
mov ax, word [ebp + 2]
add ebp, 2
call fcn.00f0a7a2
lodsb al, byte [esi]
in al, 0x63
fisubr dword [eax + 0x65]
rcr byte [edx - 0x29], 0xc
cwde
jmp 0x96fe9fe8

Function at 0xe56b91
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5
jmp 0x992063

Function at 0xe57298
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0xe57c97
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esi], ecx
jmp 0xe6d899
push 0xe0267994
jmp 0xeb6e15
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5

Function at 0xe5b6ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0x4da32113
lea esp, [esp + 8]
jmp fcn.00e2b2e5

Function at 0xe63105
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5
jmp 0xed909d
jmp 0xe23d9e
mov dword [esi], edx
mov dword [esi + 4], eax
jmp 0xe6b886

Function at 0xe633df
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x3832469f
mov dword [esp + 4], 0xdd00e833
add esi, 2
rol dword [esp + 4], 0x84
shl edx, cl
jmp 0x9b981c

Function at 0xe650df
Capabilities:
Authenticate hmac

Disassembly:
hlt
not dl
mov dword [esp + eax - 0x6020000], 0xe401200b
call fcn.00f623ee
les edx, [eax]
jne 0xe6514f
rol eax, cl
xor dh, byte [eax + 0x3b]
shl dword [esi - 0x6d54b484], cl
mov ebp, ebp
daa
sbb bh, byte [ecx]
enter 0x38ee, 0xffffffffffffffbc
mov dh, 0x8f
add byte [0x69239342], al
push 0x990d902b
or eax, 0x8764dcf1
and ecx, esp
pushal
sub dword [ecx + eax*4 + 0x5d98111e], 0x38c84663
cdq
mov word [ecx], cs
outsb dx, byte [esi]
sbb esp, esp
push es
inc ecx
jno 0xe650db
inc edx
xchg dword [edx - 0x665d67b4], ebx
cmp ebp, dword [0xba8b2d2e]
push ds
invalid
xchg esi, eax
sub al, 0x2f
mov edx, dword [esi + 0x1f]
stosd dword es:[edi], eax
mov dl, 0x1f
jno 0xe650da
invalid

Function at 0xe66668
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 4]
jmp fcn.00e2b2e5

Function at 0xe6c350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc esi, 6
push 0x4108dc14
mov byte es:[ecx], dl
push 0x8b27212a
lea esp, [esp + 0x10]
jmp fcn.00e2b2e5

Function at 0xe6fa72
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esi], edx
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5
jmp 0x9bc82f

Function at 0xe7397a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esi], edx
lea esp, [esp + 0xc]
jmp fcn.00e2b2e5
jmp 0xe3949d