joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3203700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0320378f
jae 0x320370e
xor ecx, ecx
call fcn.0320378f
jae 0x320373d
xor eax, eax
call fcn.0320378f
jae 0x320374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0320378f
adc al, al
jae 0x320372f
jne 0x3203779
stosb byte es:[edi], al
jmp 0x3203711
call fcn.0320379b
sub ecx, ebx
jne 0x3203756
call fcn.03203799
jmp 0x3203775
lodsb al, byte [esi]
shr eax, 1
je 0x3203783
adc ecx, ecx
jmp 0x3203772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03203799
cmp eax, 0x7d00
jae 0x3203772
cmp ah, 5
jae 0x3203773
cmp eax, 0x7f
ja 0x3203774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3203711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x3223700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0322378f
jae 0x322370e
xor ecx, ecx
call fcn.0322378f
jae 0x322373d
xor eax, eax
call fcn.0322378f
jae 0x322374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0322378f
adc al, al
jae 0x322372f
jne 0x3223779
stosb byte es:[edi], al
jmp 0x3223711
call fcn.0322379b
sub ecx, ebx
jne 0x3223756
call fcn.03223799
jmp 0x3223775
lodsb al, byte [esi]
shr eax, 1
je 0x3223783
adc ecx, ecx
jmp 0x3223772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03223799
cmp eax, 0x7d00
jae 0x3223772
cmp ah, 5
jae 0x3223773
cmp eax, 0x7f
ja 0x3223774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3223711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x404a30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x400
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor esi, esi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x414]
lea edi, [esp + 0x10]
mov eax, ebx
xor edx, edx
div dword [esp + 0x41c]
mov ebp, dword [esp + 0x418]
xor eax, eax
mov byte [ebx + ecx], bl
inc ebx
add edi, 4
cmp ebx, 0x100
mov al, byte [edx + ebp]
mov dword [edi - 4], eax
jl 0x404a5a
xor eax, eax
lea edi, [esp + 0x10]
mov dl, byte [eax + ecx]
mov ebp, dword [edi]
mov ebx, edx
and ebx, 0xff
add ebx, ebp
add esi, ebx
and esi, 0x800000ff
jns 0x404aaa
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + ecx]
add edi, 4
mov byte [eax + ecx], bl
inc eax
cmp eax, 0x100
mov byte [esi + ecx], dl
jl 0x404a89
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret 0xc

Function at 0x404ad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
test eax, eax
jbe 0x404b5c
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
inc ecx
and ecx, 0x800000ff
jns 0x404afb
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [ecx + eax]
mov ebx, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x404b18
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + eax]
mov byte [esp + 0x18], dl
mov byte [ecx + eax], bl
mov ebx, dword [esp + 0x18]
mov byte [esi + eax], dl
xor edx, edx
mov dl, byte [ecx + eax]
and ebx, 0xff
add edx, ebx
and edx, 0x800000ff
jns 0x404b46
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [edx + eax]
mov bl, byte [edi + ebp]
xor bl, dl
mov edx, dword [esp + 0x1c]
mov byte [edi + ebp], bl
inc edi
cmp edi, edx
jb 0x404aea
pop ebp
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x407860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10c
push esi
call fcn.004ecbe3
fisubr dword [edx]
mov byte [esp + 8], 0x4d
mov byte [esp + 9], 0x6f
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xb], 0x68
mov byte [esp + 0xc], 0x65
mov byte [esp + 0xd], 0x72
mov byte [esp + 0xe], 0x33
mov byte [esp + 0xf], 0x36
mov byte [esp + 0x10], 0x30
mov byte [esp + 0x11], 0
call esi
lea eax, [esp + 4]
push 0xa
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, dword [0x426608]
call fcn.00404a30
push 0
call esi
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x114]
and edx, 0xffff
lea ecx, [esp + 0x10]
push edx
push eax
push ecx
mov ecx, dword [0x426608]
call fcn.00404ad0
push 0
call esi
pop esi
add esp, 0x10c
ret

Function at 0x407b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
nop
call fcn.004ed7a5
push 0xd6ff006a
mov bl, 0x6c
push 0
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x78
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0
call esi
push 0
call esi
nop
lea eax, [ebp - 0x10]
push eax
call fcn.00408750
add esp, 4
test eax, eax
je 0x407c5a
push 0
call esi
push 0
call esi
nop
mov al, 0x6b
mov dl, 0x69
mov byte [ebp - 0x2d], al
mov byte [ebp - 0x2c], al
mov al, 0x20
mov cl, 0x2f
push 0
mov byte [ebp - 0x30], 0x74
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2b], dl
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], al
mov byte [ebp - 0x27], cl
mov byte [ebp - 0x26], 0x66
mov byte [ebp - 0x25], al
mov byte [ebp - 0x24], cl
mov byte [ebp - 0x23], dl
mov byte [ebp - 0x22], 0x6d
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], 0x75
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x64
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x78
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0
call esi
push 0
call esi
nop
push 0
call esi
nop
lea ecx, [ebp - 0x30]
push 0
push ecx
call fcn.004ed915
sub dword [edx], ebp
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43da0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
sub esp, 0x19
mov byte [esp + 2], bl
mov ax, bp
xchg dword [esp + 0x1c], edx
call fcn.0043d9dc
adc byte [ebx - 0x52fb72b3], dl
dec ebp
lea eax, [ebp*4]

Function at 0x43f1ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
push si
push word [esp]
jmp 0x43f30d
call fcn.0043f2cb
add edx, 0x5e76cd8e
jmp 0x43fe6f
add edx, 0x216a34ff
jmp 0x43fedb
jne 0x43f1c6
je 0x43f1c6
call fcn.0043fe96
mov ebx, dword [esp]
lea ebx, [ecx + edx]
adc bx, 0xf5cf
jmp 0x43f225
mov bx, si
jmp 0x43feea
mov bx, dx
dec ebx
jnp 0x43fec5
mov bx, si
jmp 0x43ff52
mov bx, dx
mov esp, esi
lea ebx, [eax + ebx]
mov ebx, edi
lea ebx, [edx + ebp]
jmp 0x43ff2e
mov ebx, dword [esp]
push edx
ret
mov bx, dx
jmp 0x43feed

Function at 0x441388
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dl
mov bh, 0xf5
bts bx, sp
lea esi, [esi + 0x19]
xchg edx, ebx
bts ebx, edi
jmp 0x4413f3
xchg bl, bh
mov bx, cx
bsr dx, sp
xchg dword [esp], esi
dec bl
jmp 0x441370

Function at 0x4413b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x44141d
sub esp, 8
js 0x441407
push di
pop dx
jmp 0x44142c

Function at 0x480018
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
inc esi
jmp 0x47ef4f

Function at 0x4f8180
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 2], edx
add esp, 1
sete bh
sete dh
jmp 0x4f8143
mov di, 0x148
lea esi, [eax - 0x2f57]
mov dx, word [esp + 2]
push dword [esp]
pop dword [esp + 1]
mov word [esp + 6], ax
jmp 0x4f80fa
or dh, al
pop word [esp + 2]
mov bx, cx
lea esp, [esp + 5]
jmp 0x4f8158
mov esi, 0x41d1a9cf
mov si, word [esp + 6]
pop cx
push ebp
xchg bp, ax
rcr si, 0xc
jmp 0x4f812d
push dword [esp + 2]
pop word [esp + 2]
mov dword [esp], edx
rdtsc
xchg bl, cl
xchg ebx, edx
jmp 0x4f8187
xchg word [esp + 3], di
jmp 0x4f8110
pop dword [esp]
mov dl, 0x43
cld
push word [esp]
bswap ebp
pop word [esp]
jmp 0x4f81ee
bswap edi
rdtsc
mov cx, 0xf146
pop edx
lea ebx, [ecx + esi]
lea esi, [edx + esi]
jmp 0x4f81c5

Function at 0x4f85dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], bx
xchg word [esp], bx
xchg dl, ah
ror ebp, 3
shl ebp, 0x16
lea edx, [ecx*4]
jmp 0x4f84ee
pop word [esp]
btr ebx, ecx
bsf di, bp
lea ebx, [esp + edx]
mov bp, 0x1894
dec cx
jmp 0x4f8504
jmp 0x4f8554
Function at 0x4f87c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0x28], dh
add esp, 0xa
bsf edi, eax
mov byte [esp + 0x19], al
rdtsc
jmp 0x4f87d6
pop word [esp]
sub esp, 0x1c
mov ecx, 0x4f5c238c
jmp 0x4f87b2
mov bx, sp
xchg word [esp], dx
rdtsc
xchg byte [esp + 0x11], bh
lea ebp, [esp - 0xa7]
jmp 0x4f8803
and dh, ah
cmc
not ch
push dword [esp + 3]
lea ecx, [esi + ebp]
mov word [esp + 0x14], di
jmp 0x4f8ad3
mov ebx, 0x825e7d64
mov dword [esp], ebx
pushfd
mov word [esp + 7], bp
rdtsc
lea esi, [ebx*4]
jmp 0x4f8836
pop dword [esp]
bsf cx, sp
mov cl, 0x93
not ebx
mov word [esp + 4], di
push bx
jmp 0x4f884c
xchg word [esp + 2], bp
sub esp, 3
mov dl, 0x9a
sete al
not ebx
std
jmp 0x4f88b0
mov edx, 0x5aeca505
lea ebx, [esi*4]
xchg dl, al
add esp, 0x1f
xchg cx, ax
lea edx, [ecx + ebp]
jmp 0x4f88fd

Function at 0x4f89d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4f8a0a
rcl ebx, 0xc
mov al, byte [esp + 2]
lea esp, [esp + 2]
stc
rdtsc
mov ax, si
jmp 0x4f8a1c
mov esi, dword [esp + 2]
xchg dword [esp], edi
rdtsc
or ecx, edx
cld
pop word [esp]
jmp 0x4f89da
neg ecx
cld
xchg edx, eax
lea ecx, [esp + ecx]
xchg cx, ax

Function at 0x4f8d77
Capabilities:
Access peb ldr_data

Disassembly:
push word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 8], edi
jmp 0x4f8db0
lea esp, [esp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x4f8d9a

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xca07e3
Capabilities:
Encode data using xor

Disassembly:
shrd eax, edx, cl
mov dword [edi], eax
push 0xdaddf84
mov ecx, 0x83eaa0b
mov eax, dword [ecx + esi - 0x83eaa0b]
inc cl
call fcn.015fc384
test al, 0x78
lodsd eax, dword [esi]
or eax, 0x3eaa0bb9
or byte [ebx + 0x55f53184], cl
sal edi, 0xfe
shr eax, 0x84
mov ebx, 0x78a80095
mul ebx
jno 0xca0849
mov al, 0x41
jno 0xca0879
das
fstp qword [ecx]
push ds
mov ss, ecx
aaa
or dl, byte [eax]
invalid
push ss
jno 0xca08a0
sub ebp, dword [edi + 0x71]
push 0x12
inc edx
mov ah, 0x1f
jno 0xca0897
adc al, byte [edx - 0x4c]
pop ds
mov cs, word [edi + 0x61]
add byte [esi - 0x60189687], cl
invalid
lahf
fdiv qword [ecx - 0x46]
jecxz 0xca0811
xor dword [eax - 0x27d7f21b], ebp
pop es
push ebx
jge 0xca0835
sbb ah, byte [eax]
lds eax, [edx + 0x54]
xchg esp, eax
stosb byte es:[edi], al
fadd qword [edx + 0x58]
mov eax, 0xb1a21ab8
cmpsb byte [si], byte es:[di]
xlatb
cld
mov ebp, 0x3db64848
jl 0xca07eb
test al, 0xa0
stosb byte es:[edi], al
int 0x66
push cs
dec eax
or al, byte [edx - 0x78]
stc
push ds
xor dword [eax + ebp*8], esp
add al, 0x5b
mov eax, 0xda859f4e
push esp
mov cl, 0x34
jno 0xca08a2
mov ebp, 0x5a5d5b98
add dword [edi + 0x53], ebp
add al, 0x71
aas
mul ebp
mov edx, 0x7817101
test eax, 0xe909710f
loopne 0xca0826
mov fs, word [esi]
salc
salc
lodsb al, byte [esi]
jne 0xca082b
and eax, 0x718a53e7
mov dh, byte [ecx + 0x3f]
aas
push ecx
mov eax, 0x884f8e09
jo 0xca0839
and al, ch
pop edx
pop ss
add byte [ecx + 0x57], dh
ret 0x711f

Function at 0xd8c239
Capabilities:
Get number of processors

Disassembly:
mov ecx, ebp
mov esi, 0
mov dword [esp + edi - 0x10e2], eax
mov dword [esp + eax - 0x5fccc499], esi
lea edi, [eax*2 + 0x141fc914]
rol ax, 0xe5
mov edi, dword [esp + eax - 0x5fcc9488]
mov edx, eax
mov dword [esp + eax - 0x5fcc94b4], 0xae98c938
rol edi, 1
sub dword [esp + edx - 0x5fcc94b5], eax
pop ecx
bswap edi
sal ebp, cl
lea ecx, [edx + eax*2 + 0x2a229c3a]
dec edi
not edi
jmp 0xdeda80
sal cl, cl
xchg word [esp + ebp - 0x4203f2de], cx
add edi, esi
mov esi, ecx
ror byte [esp + eax - 0x5fcc94b5], 0xc1
lea ebp, [esp + edx - 0x5fcc94b4]
lea edx, [ebp + eax - 0x5fcc9580]
jno 0x152762b
mov esp, edx
Function at 0xd9bbaf
Capabilities:
Encode data using xor

Disassembly:
dec edx
lea ecx, [eax + ecx*2 - 0x5d42b251]
shr cl, 0xe1
mov dword [esp], 0x210a887
not edx
xor ebx, edx
add edi, edx
sal ecx, cl
call fcn.0174ca16
mov ecx, 0x72220e18
sub ecx, ecx
mov eax, dword [ebp + ecx]
or cx, word [ecx + eax]
mov edx, 0xb2a0f7b8
sar edx, 0xec
adc ebp, 2
ror dl, 0x27
mov word [ebp], cx
movzx eax, dl
mov ecx, 0xf5932db6
mov edx, dword [esi + eax*8 - 0xf0]
xchg al, cl
jae 0x1518cd7
mov ecx, 0xbf1f9099
mov eax, ecx
mov eax, dword [edi]
lea edx, [ecx*8 + 0x7d0f6104]
shr cl, 0xc1
lea edi, [edi + edx - 0x760be5c8]
jnp 0x168b3ea
sal eax, cl
lea edx, [eax + edx + 0x4d24d4a7]
xor word [esp + eax*2 - 0x16bffe], cx
sal byte [esp + eax*4 - 0x2d8000], 0x86
setnp byte [esp + eax - 0xb6000]
bswap edx
xor edx, 0x429812b9
ror edx, 1
xor ebx, edx
xadd dword [esp + eax*4 - 0x2d8000], ecx
add edi, edx
mov edx, eax
sub dword [esp + eax*4 - 0x2d8000], ecx
pop ecx
jmp edi
call fcn.01461bad
push esp
and al, 0x9a
dec esp
mov edx, 0xa2692814
cmp byte [eax - 0x3fa0f1e9], bl
invalid
add esi, eax
xor dx, dx
add ecx, 0x6f10f0af
mov ax, word [ecx + ebp - 0x2e306062]
sub dl, dh
or dx, word [ecx + ebp - 0x2e306060]
bswap ecx
neg ecx
mov cl, byte [ebp + 4]
jne 0xe4334f
bswap edx
ror edx, 1
inc edx
bswap edx
sar ecx, cl
jne 0x15fe131
sar al, 0x82
dec ecx
movzx edx, al
not ecx
lea ecx, [eax + ecx - 0x17b648f6]
ror ecx, 3
xor ebx, ecx
push edx
bswap edx
neg al
add edi, ecx
mov dword [esp + eax*2 - 0x630], edx
xor dword [esp + eax*4 - 0xc60], eax
fild dword [eax + ebp - 0x318]
shr eax, 0xf0
not dl
mov dword [esp + eax], edi
ret
neg cx
lea esi, [esi + eax - 0xb2]
sub cx, ax
xor edx, ebx
xor edx, 0xf72d9d82
push ecx
jmp 0xdc1768
jae 0x14850d1
lea edx, [edx + ecx - 0x357ea511]
lea eax, [ecx*4 + 0x1b976f35]
xor ebx, edx
neg ax
adc byte [esp + eax*2 - 0x372f2c33], ch
or ecx, ecx
adc esi, edx
movsx edx, ax
mov word [esp + eax - 0x1b979614], ax
mov dword [esp + eax - 0x1b97961b], esi
ret 8
xor eax, ebx
push edx
dec edx
neg eax
not eax
xchg dword [esp + edx - 0x760be5cb], edx
bswap eax
inc edx
push ecx
js 0x1500c13
xor eax, 0x790699ac
and byte [esp + edx - 0x760be5cd], cl
inc cl
bswap eax
sar dword [esp + edx - 0x760be5c9], 0x11
xor ebx, eax
neg cx
jnp 0x14e7a3b
not al
rcr edx, cl
shl eax, 0x1c
mov dword [eax + ebp - 0x10000000], edx
mov ecx, eax
movzx edx, cl
or edx, esi
jmp edx

Function at 0xdb6f5a
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg eax
lea esi, [esi + edx*2 - 2]
pop edx
lea edx, [eax - 0x30e2aadf]
mov word [esi], cx
sub edi, 4
mov edx, dword [edi]
lea ecx, [eax*4 + 0xa170f18]
lea eax, [ecx*4 + 0x46316db4]
xor edx, ebx
call fcn.01774241
mov edx, 0x2432f524
lea esi, [edx + esi - 0x2432f525]
lea eax, [edx - 0xb62d4d8]
sub ax, 0xa6ae
jbe 0x1623343
movzx ecx, byte [edx + esi - 0x2432f524]
jg 0x15fe2fd
popfd
rdtsc
nop
push ebp
pushfd
mov ebp, 0x68accb07
shr bp, 0x1b
movzx ebp, bp
test ebp, ebp
mov ebp, dword [esp + ebp + 4]
mov dword [esp + 4], 0x2ad45d7f
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.01443318
Function at 0xdc276c
Capabilities:
Encode data using xor

Disassembly:
xlatb
mov al, byte [0xa3a4d5bc]
invalid
inc ecx
rol bh, 0xa7
dec esp
add ebx, ebx
inc dx
xor dword [esp + esi*4 - 0x7c50769f], 0x894ee72b
pushfd
xor al, 0x51
loop 0xdc2770
loopne 0xdc2749
sub byte [eax], al
lea esp, [esp + 0x24]
ret

Function at 0xdeb9ef
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
adc byte [esi - 0x8017e52], ah
fimul dword [ebp - 0x64d4fe74]
mov ch, 0xe6
call fcn.016bfc7f
push esp
and al, 0x14
xor ebx, eax
mov dword [esp + ecx*2 - 0x9ef8ffc], edx
not byte [esp + ecx*4 - 0x13df1ff6]
shl cl, 0x43
add esi, eax
call fcn.00d9706e
shr byte [edx + 0x6a], 0x7f
add ebx, dword [eax + 0x2d5efea2]
cli
jg 0xdeba11
cwde
mov byte [0xfa2d5efe], al
pop esi
sub eax, 0x70e03efa
loopne 0xdeba87
jle 0xdeba73
jnp 0xdeb9a7
push cs
pop eax
add eax, 0xff73102a
jmp eax
mov dword [edx + 0x5c], ecx
mov ebp, 0x7ae2627d
jge 0xdeb9e4
xor eax, 0xf76fe1e8
and byte [edx], bl
dec esp
add ah, byte [ebp + 0xd]
stc
mov byte [edx - 0x74], 0x1f
mov esi, 0x386e42c7
out 0x9e, al
inc edx
outsb dx, byte [esi]
cmp byte [ebp - 0x1a], ah
sahf
jns 0xdeba57
invalid
push 0xffffffffffffffba
xchg ebp, eax
loope 0xdeba0c
ficomp word [ebx + 0x274b4594]
pop ss
cmpsb byte [esi], byte es:[edi]
test dword [eax + 0x5a0567da], 0xeab93c8b
and byte [ecx + edi*2 - 0x2e], dl
invalid
Function at 0xdf94ad
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp]
push 0x94a15c8c
mov dword [esp + 4], 0x80145729
push 0xa48796bc
lea esp, [esp + 0xc]
call eax
mov ebx, 0x550e7dad
movsx ecx, bx
mov ebp, dword [ebp + ebx - 0x550e7db1]
sub cl, ch
mov dword [ebp + ecx*2 - 0xfa60], eax
push ecx
movzx edx, cx
mov edi, ebp
movzx ebp, dl
dec ebx
mov byte [esp + ebx - 0x550e7dab], 0x93
mov ebx, dword [esp + ebx - 0x550e7da8]
mov ebp, dword [esp + ecx*2 - 0xfa58]
movzx esi, cl
movsx eax, si
neg dword [esp + ecx*2 - 0xfa60]
mov esi, dword [esp + ecx*2 - 0xfa54]
sbb cx, cx
shr ax, 0x66
rol eax, 0x49
lea esi, [esi + ecx - 0x10003]
add eax, dword [esi + edx - 0x7d30]
call fcn.016749bd
call fcn.014f7c82
lea esp, [ebx]
loopne 0xdf958e
lds ecx, [edi - 0xb1b02c8]
add eax, 0xb897216d
sahf
xor cl, ch
invalid
fdiv dword [ecx]
inc edx
cdq
cmp byte [ebx], al
adc byte [esi - 0x42874587], bl
aam 0x17
and ebx, eax
std
cmpsb byte [esi], byte es:[edi]
outsb dx, byte [esi]
test eax, 0x2a5d218d
sbb al, 0x9c
or esi, ebx
cmc
stosd dword es:[edi], eax
or byte [edx - 0x43], 0xff
adc byte [eax], ch
insb byte es:[edi], dx
jge 0xdf957d
invalid
loope 0xdf95ad
xchg ebp, eax
pop edx
rcr byte [edx + 2], 1
aas
push eax
cmp eax, 0x6cd11e8b
or byte [eax], al
sub byte [edi], ch
test byte [eax], al
mov cl, 0x22
imul esi, dword [esp + edx*4 - 0x6a516ef9], 0x1012c3a5
pop es
xchg ecx, eax
scasb al, byte es:[edi]
xchg ebp, eax
movsd dword es:[edi], dword [esi]
ret
adc dl, byte [eax]
pop edx
mov bl, 0xc2
inc edi
scasd eax, dword es:[edi]
inc edi
xor dword [esi - 0x42], ebp
sar dword [ebx], cl
out 0x3c, al
js 0xdf95a7
out 0xf, al
jl 0xdf9565
loope 0xdf95e9
or al, 0x75
cdq
jae 0xdf95af
cdq
into
insd dword es:[edi], dx
push ebx
rol esi, cl
wait
sbb bl, byte [ebp - 0x72]
push ecx
invalid
add al, 0xd2
mov bh, 0x26
dec edx
ror byte [ebx + 0x2a], cl
mov ecx, 0xdfc7bfa6
movsd dword es:[edi], dword [esi]
scasd eax, dword es:[edi]
add al, 0xd
ret

Function at 0xe14ca4
Capabilities:
Encode data using xor

Disassembly:
sub dword [esp + edx - 0x123e1764], 0xd501f023
not ecx
call fcn.017281bd
call fcn.0146439c

Function at 0xe259cf
Capabilities:
Encode data using xor

Disassembly:
rol ebp, 1
inc si
and dword [esp - 0x1c9fff8], ecx
dec edx
lea esi, [edi + esi*4 + 0x2e9d400b]
dec eax
lea edx, [esi + 0x70982d0d]
inc edx
lea ebp, [ebp - 0x2d3a640a]
inc esp
movsx edi, si
dec esi
mov dword [esp - 0xe4ffff8], eax
inc edx
xor dword [esp - 0x1c9fff8], ebp
call fcn.015ec3ec
Function at 0x1438e8b
Capabilities:
Encode data using xor

Disassembly:
xor dword [esp + eax - 0x2d00], ecx
dec edx
rol edx, 1
ror al, 0x81
mov dword [esp + ecx*4 - 0x7ee826d0], 0xb23e5fbe
xor ebx, edx
add edi, edx
cli
xor dword [esp + ecx - 0x1fba09b2], ecx
jno 0x15d346c
push cs
cmp byte [edx + edx*2 + 0x46], bh
xchg esp, eax
movsb byte es:[edi], byte [esi]
cld
xor byte [edi + 0x7c20f11e], bl
xchg ebx, eax
mov ch, 0x2b
jne 0x1438ea6
mov ebp, dword [edx + 0x5ebc3637]
inc ecx
lahf
adc byte [eax + 0x48], bh
and al, 0x1b
int3
mov bp, word [ebp + ecx - 0x1fba09b4]
push eax
setge al
sar dword [esp + ecx - 0x1fba09ae], 0x19
pop eax
pop ecx
pop edx
jbe fcn.016c52eb

Function at 0x143c3c8
Capabilities:
Execute syscall

Disassembly:
movzx ax, byte [ebp + eax - 0x30245030]
movzx ecx, dx
pop ecx
movzx ecx, dl
mov cl, byte [ebp + edx - 0x3024502e]
bswap edx
lea ebp, [ebp + edx*2 - 0x60a0485e]
call fcn.01652c26
syscall
push 0xa23f8935
dec eax
mov dword [esp], 0xfb195441
call fcn.00dc10f1

Function at 0x146f47b
Capabilities:
Execute syscall

Disassembly:
dec ebx
call fcn.016bd3d7
mov ecx, 0x4f24d905
sal cx, cl
mov ecx, dword [esi + ecx - 0x4f2420a0]
mov edx, 0x30ae370a
lea esi, [edx + esi - 0x30ae3706]
xor ecx, ebx
movsx eax, dl
shl eax, 0x76
not ecx
lea ecx, [ecx + edx + 0x6c6c1b0d]
rol ecx, 3
not dx
not edx
not ecx
dec dl
bswap eax
push edx
xor ebx, ecx
neg eax
sbb al, byte [esp + 1]
adc edi, ecx
sar eax, 0x82
sub word [esp], ax
pop ecx
mov ecx, dword [ebp]
call fcn.017297e3
sysenter
call fcn.0167220f
Function at 0x147eba4
Capabilities:
Encode data using xor

Disassembly:
inc dl
xor bl, cl
call fcn.016b25f6
mov eax, 0xee10d7a7
lea ecx, [eax + ecx - 0x1f090e02]
sub eax, 0x600995b1
sub eax, 0x188f0d26
xor ecx, 0xb01a948a
bswap ecx
movzx edx, al
rol ecx, 1
add eax, 0x9f8e4eba
xor ecx, 0x61299439
xor ebx, ecx
add edi, ecx
neg eax
mov ax, word [ebp + edx*4 - 0x340]
mov cx, word [ebp + edx - 0xce]
sar dx, 0x47
lea ebp, [ebp + edx*2]
lea edx, [edx*8 + 0x632de4a0]
or ax, cx
not ax
mov word [ebp + edx - 0x632de4a8], ax
lea ecx, [edx*2 + 0x44335c0d]
add edx, 0x1b8979bf
jmp edi
jmp 0x16ee6ea
test ebx, ebx
lea esp, [esp + 0xc]
je 0x16e9d3f
mov eax, dword [ebp + ebx*4]
jmp 0xe53141
lea eax, [ecx*2 - 0x55d20667]
mov eax, dword [esi + ecx*2 - 0x32f62c2a]
add edx, edx
add ecx, ecx
lea esi, [ecx + esi - 0x32f62c26]
sbb ecx, edx
xor eax, ebx
sal cx, 6
lea edx, [edx + ecx*2 + 0x53ac6820]
inc edx
rol eax, 1
lea edx, [ecx*8 - 0x87c7761]
xadd dl, ch
not eax
xor eax, 0x13b4c99d
jmp 0x16b0fa5
jmp edi
jae 0x1491e62
and ecx, 0x61cefb8
lea eax, [eax + edx*2 - 0x44404918]
not dx
add ecx, ecx
ror eax, 3
neg eax
rol edx, 0x74
add edx, edx
rol dx, 0x2d
xor ebx, eax
sal edx, 0x67
adc edi, eax
and dl, cl
shl cx, 4
jmp edi
mov eax, dword [ebp]
push 0x6704efa1
lea esp, [esp + 4]
call eax
mov edi, 0xa13a7ab9
mov ecx, edi
mov ebp, dword [ebp - 4]
not ecx
ror ecx, 0x46
movzx esi, cl
mov dword [ebp + ecx*2 - 0x32f62c2a], eax
pop ebx
pop edi
movsx edx, si
pop esi
jae 0x14d1b30
movzx ecx, byte [esi]
add esi, 1
shl edx, 0x5d
sub edx, edx
xor cl, bl
push edx
sal dx, 0xa6
sbb cl, 0xa6
sal dword [esp + edx*2], 0x96
ror cl, 1
sar edx, 0xcd
adc cl, 0x84
jmp 0x173760e
call 0x16e9d27
mov edx, 0x159d5807
mov dx, word [ebp + edx*2 - 0x2b3ab00e]
mov ecx, 0x5bae780c
mov eax, 0x6aacddb0
neg eax
mov cl, byte [ebp + ecx - 0x5bae780a]
adc ax, 0xfcb4
jne 0xdf6fb7
pop ecx
jmp esi
rol cl, 1
add dword [esp + edx*8], edx
jp 0xdf461b
lea edx, [eax + eax*4 + 0x43179b9f]
rol ecx, 2
xor ebx, ecx
add edi, ecx
jmp 0x14bed0e

Function at 0x14a1e40
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esi]
mov edx, 0xfa08beaa
add esi, 4
xor ecx, ebx
dec edx
inc dl
add edx, edx
rol ecx, 3
jmp 0xdc7613
mov eax, edx
sub ecx, 0xf33812a7
neg ecx
dec dl
not ecx
inc ecx
sal eax, 0x92
or ax, dx
dec eax
xor ebx, ecx
rol ax, 0x8c
xadd edx, eax
add edi, ecx
lea ecx, [edx*2 + 0x4011a9a1]
call fcn.01698196
pop ecx
pop ecx
pop eax
pop eax
jmp ebp
lea ecx, [ecx + edx - 0x6101467d]
sal dl, 0xa4
xor ebx, ecx
add ebp, ecx
shr al, 0x27
jb 0xdeda7a
jmp 0xcc51f3

Function at 0x14a24f2
Capabilities:
Encode data using xor

Disassembly:
dec edx
xor ebx, edx
add edi, edx
xor cx, word [ebp + ecx]
lea edx, [eax*8 - 0x53c53ac4]
call fcn.016107d5