joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417610
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417636
mov eax, dword [0x4baa90]
test eax, eax
je 0x41762c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x4baa90], eax
test eax, eax
pop ebx
je 0x4176d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x4baa90]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x4baa8c], eax
call esi
mov ecx, dword [0x4baa8c]
mov dword [0x4baa94], eax
test ecx, ecx
je 0x4176c7
test eax, eax
je 0x4176c7
mov eax, 1
pop esi
add esp, 0x50
ret
Function at 0x4649c2
Capabilities:
Encode data using xor

Disassembly:
and edx, dword [esi - 0x6ae2cba1]
xchg esi, eax
pop edi
xor al, 0x1d
xchg ebp, eax
xor esp, dword [edx]
push ebp
movsd dword es:[edi], dword [esi]
push ss
xor eax, 0x6a010719
jge 0x4649c3
pop esi
xor eax, 0xd5449001
pop ds
mov esp, 0x7f4b990f
stosb byte es:[edi], al
mov al, 0x65
nop
cld
sbb eax, 0x5d3241ca
jnp 0x464a59
xor dh, byte gs:[edi + 0x45]
salc
popal
xchg esi, eax
sub eax, 0x6d15452a
or esi, dword [0xea24654]
pushfd
test eax, 0xecfe2223
adc eax, 0x54350b6d
inc esi
mov byte [0x23a99c0e], al
and bh, dh
in al, dx
imul ebx, dword [0x26af4094], 0xb5d7c186
push edx
mov ebp, 0x3ff442c3
sal dword [eax - 0x4e4f393a], 1
mov ebp, ebp
les edi, [edx - 0x72b442b7]
mov cs, word [edx + 0x21]
dec ebx
invalid
mov dword [ebp - 0x66], ebx

Function at 0x47182f
Capabilities:
Packed with generic packer

Disassembly:
xchg ebp, eax
ror dword [ebx + 0x5de58bc1], 0xc3
push 0x18
mov eax, 0x49008a
call 0x4d5035
call fcn.004719e5
xor edi, edi
cmp dword [eax + 8], edi
je 0x471931
mov dword [ebp - 0x10], edi
call fcn.004719e5
add byte [eax], al
mov eax, dword [eax + 8]
mov edx, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 8]
mov ecx, eax
push 2
call dword [edx + 4]
cmp dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
je 0x4718b9
push dword [ebp - 0x10]
lea esi, [ebp - 0x24]
call 0xcd4716b2
inc ebp
clc
add byte [edi], cl
xchg byte [ebx + eax], cl
add byte [eax], al
mov ecx, dword [eax + ebx]
Function at 0x474480
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [resource.31]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00474673
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call int.0047f1c8
xor ebx, ebx
cmp eax, ebx
jne 0x47462e
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00474673
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0047bea7
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4cd79c
add esp, 0x10
test eax, eax
jne 0x474549
push esi
call fcn.00471b32
mov esi, eax
cmp esi, ebx
pop ecx
je 0x474549
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x474534
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x474549
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x474542
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004806db
cmp byte [esp + 0x13], bl
je 0x474579
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004746b0
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4745e9
push 0x14
call 0x4cca09
cmp eax, ebx
pop ecx
je 0x4745a3
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4745a5
xor edi, edi
cmp edi, ebx
je 0x4745e9
push esi
push edi
call fcn.00473bd6
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00473c9e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00473dc7
add esp, 0x18
call fcn.00474673
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0047e895
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x474600
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x474612
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x474655
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x474655
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00473c9e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00473dc7
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4808dc
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x56
nop
jmp 0x480920
fmul st(6)
and ebp, dword [esi]
mov ds, word [ebx]
cmc
wait
xor dword [ebx + 0x5dc8540d], 0x811103d7
or eax, dword ds:[ecx + 0x451d4688]
sbb dword [esi], edx
ror byte [ecx - 0x1d], cl
cli
cmp edx, 0xc4e787ea
add cl, 0x91
scasd eax, dword es:[edi]
js 0x4808f8
xor byte es:[esi + 0x67d8a2b4], 0x4d
inc esp
or eax, 0xa5342165
neg byte [ecx + 0x45]
add byte [ebx], 0x65
les esi, [di - 0x5f]
inc edi
invalid
Function at 0x48b910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [resource.31]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0048bb03
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00496658
xor ebx, ebx
cmp eax, ebx
jne 0x48babe
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0048bb03
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00493337
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4e4c2c
add esp, 0x10
test eax, eax
jne 0x48b9d9
push esi
call fcn.00488fc2
mov esi, eax
cmp esi, ebx
pop ecx
je 0x48b9d9
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x48b9c4
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x48b9d9
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48b9d2
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00497b6b
cmp byte [esp + 0x13], bl
je 0x48ba09
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0048bb40
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x48ba79
push 0x14
call 0x4e3e99
cmp eax, ebx
pop ecx
je 0x48ba33
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x48ba35
xor edi, edi
cmp edi, ebx
je 0x48ba79
push esi
push edi
call fcn.0048b066
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0048b12e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048b257
add esp, 0x18
call fcn.0048bb03
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00495d25
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48ba90
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x48baa2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x48bae5
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x48bae5
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0048b12e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048b257
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a23e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [resource.31]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004a25d3
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004ad128
xor ebx, ebx
cmp eax, ebx
jne 0x4a258e
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004a25d3
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004a9e07
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004fb6fc
add esp, 0x10
test eax, eax
jne 0x4a24a9
push esi
call fcn.0049fa92
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4a24a9
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4a2494
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4a24a9
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a24a2
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004ae63b
cmp byte [esp + 0x13], bl
je 0x4a24d9
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004a2610
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4a2549
push 0x14
call fcn.004fa969
cmp eax, ebx
pop ecx
je 0x4a2503
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4a2505
xor edi, edi
cmp edi, ebx
je 0x4a2549
push esi
push edi
call fcn.004a1b36
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004a1bfe
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a1d27
add esp, 0x18
call fcn.004a25d3
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004ac7f5
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a2560
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4a2572
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4a25b5
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4a25b5
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004a1bfe
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a1d27
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d56e5
Capabilities:
Encode data using xor

Disassembly:
or dword [esp + 5], 0x29904215
jae 0x100e1be7
add byte [eax], al
cmp esp, dword [edi]
adc dl, 0x17
push 0x842fcf71
xchg ebp, eax
pop edx
add dword [ebx - 0x7a], edx
popal
mov ah, 0xbb
mov byte [0x94423cc1], al
xor eax, 0x2d41a21d
xchg edx, eax
dec ebp
cwde
mov ebx, 0x846cc9c9
fstp dword [edi - 0x3a]
xchg edi, eax
xor byte [ecx + esi*4 + 0x4ae583cc], bl
mov byte ss:[edx + 0x3a4e659b], dl
cld
xor cl, byte [ebp - 0x3ffa6db5]
jg 0x100d56f1
aad 0x34
stosd dword es:[edi], eax
fcom dword [edx + 0x6b]
les esi, [0x95446fb2]
inc esp
xchg ebp, eax
xchg edx, eax
xor eax, 0xe03ffae7
in al, dx
loopne 0x100d573d
movsd dword es:[edi], dword [esi]
xor al, 0xf6
mov dword [edi + edi*4 + 0x40], edx
push ecx
inc eax
or ah, 0xd7
dec esi
invalid
sbb edx, 0x8f103f0e
mov dword [esp], 0xb1abfa20
jmp 0x10035d0b
Function at 0x1015d78d
Capabilities:
Encode data using xor

Disassembly:
push 0xef045e95
call fcn.10038750
not cl
neg word [esp + 5]
jo 0x10105ab1
mov dword [esp], 0x752d459c
dec cl
leave
inc word [esp]
setle byte [esp + 4]
jns 0x1003a005
rcl dword [ecx - 0x55b57913], 0x76
dec ebp
loope 0x1015d7a3
or dword [edx + 0x455a4606], 0xe699add1
xor cl, byte [esi + 0xc2088e6]
scasd eax, dword es:[edi]
pop edx
inc ebp
shr dword [ebp - 0x71cd1967], 1
out 0x88, al
and byte [edi + ebp*4], cl
dec esp
push edi
stosd dword es:[edi], eax
pop es
arpl dx, dx
xchg byte [edi + 0x76], cl
aad 0x1e
sal dword [ebx - 0x2fc58457], cl
mov byte [ebp + 0x7af03855], dl
xor ch, byte [ebp + 0xc]
sbb dh, byte [edx - 0x7952f4a5]
xchg esi, eax
loop 0x1015d7cc
fnstenv [ebp + 0x59]
jne 0x1015d84e
or eax, 0xe6828612
jno 0x1015d811
pop ecx
jbe 0x1015d7c2
dec ebp
sbb dword [ebp - 0x6b], ebx
pop ebp
xchg ebp, eax
stosd dword es:[edi], eax
iretd
imul edx, dword [esi + 0x67], 0x77962dbc
cwde
push esi
mov esp, 0x9877962d
fistp dword [ebx - 0x6363aed7]
and dword [ecx], ebp
pop es
lahf
shl byte [ecx - 0x140fc65], 0xab
inc ebx
cmp dword [ebx - 0x2327bba9], ecx
mov eax, 0x7e3279b
lodsb al, byte [esi]
loopne 0x1015d810
xchg esp, eax
ror byte [ebx], 0xdd
loop 0x1015d8bb
int 0xee
or eax, 0xf7d515b1
imul ebx, dword [ecx - 0x56a7cc26], 0xfffffff0
loope 0x1015d8a6
adc al, 0x7f
mov bl, 0x7b
lahf
jg 0x1015d804
jnp 0x1015d7f2
mov cl, 0x71
mov cl, 0x71
loope 0x1015d854
sub eax, 0xb8a8ae4f
mov word [edx], es
mov esp, 0xbe068ff3
pop ds
stosd dword es:[edi], eax
stosb byte es:[edi], al
sti
pop dword [esi + 0x3a]
ljmp 0xb6e3
jecxz 0x1015d8fa
cmp eax, ecx
adc al, 0x7e
wait
add ecx, esp
rol dword [eax], 0xff
jge 0x1015d84f
sti
cdq
and dword [eax + edx*2], ebp
push ecx
cmp eax, 0xf2eea5e0
cli
jo 0x1015d93f
jg 0x1015d904
cmp dh, byte [ebx - 0x941bda9]
sub ah, bl
lahf
push edi
inc byte [edx - 0x6ee7532a]
and al, 0x38
sub eax, 0x893b4459
push 0xffffffffffffffd6
mov dh, 0x71
retf
jle 0x1015d96f
invalid
sbb ebx, dword [esi - 0x47]
in eax, dx
imul esi, dword [edi - 0x2a], 0x2a
invalid
mov eax, dword [0x625e3925]
jg 0x1015d98c
fisttp word [esi]
stosd dword es:[edi], eax
into
ror byte [edi + 0x1e], 1
ret 0x40f0
out 0x5a, al
lcall 0xf2bc, 0xbe1cd510
les ebx, [ebp + 0x2539a9be]
xor al, dh
sahf
mov byte [0xcdf67b7], al
mov ebx, 0x728bc31b
cdq
lds esp, [eax + ecx - 0x2b]
mov cl, 0x25
mov ecx, 0x3861652b
ja 0x1015d9a4
dec esi
pop edx
and byte [bp + si + 0x52ee], ch
xchg esi, eax
sub al, 0xd5
sbb al, 0xc2
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
xchg ecx, eax
jmp 0xb9abb1db
ret 0xa4a4
Function at 0x1019e585
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, 0xa813353b
push ecx
imul cx, word [esp + 2]
mov cl, byte [esi + 8]
shr dword [esp], 0xda
adc esi, 6
ror dword [esp], 0x82
jb 0x101cd9dc
inc edi
lea esi, [esi + edi - 0x59a888be]
bts edi, 0x38
mov edi, dword [esi + edi - 0x59a888ba]
mov dword [esp], 0xaf844395
xor edi, ebx
ror word [esp + 1], 6
jb 0x1021f46a
sbb edi, 0x9fb27585
not edi
bswap edi
neg edi
call fcn.101a091f
xor edi, edi
ror word [esp], 0xd
test ecx, ecx
call fcn.101d1a4e
push 0x3a3c65a6
mov dword [ebp + 0xc], eax
call fcn.10193a9d
push 0x72ad87b7
lea esp, [esp + 8]
jmp fcn.10208e34
shrd edx, edi, cl
mov dword [esi], edx
jmp 0x10203a54
adc ebp, 8
push 0x86a56032
mov dword fs:[edi], ecx
lea esp, [esp + 8]
jmp fcn.10234958
jmp 0x101be306
sub byte [ebx - 0x2e4ef7], cl
invalid
fbstp tbyte [edi]
jne 0x1021f426
ret 0xd0ee
xlatb
salc
inc edx
std
sbb edi, ebx
jne 0x1021f490
and byte [ecx], cl
rcr bl, 1
or eax, 0x6d1128d1
add dword [ebx - 0x67], edi
mov al, byte [0x1b199d7e]
sbb dword [ebx], ebx
sub eax, 0x8bff5c8a
or eax, 0xb9888647
xchg edx, eax
xor al, 0x14
cmp dword [ebx - 0x3491d644], ecx
jmp 0x1021f437
mov edi, dword [ecx + ebp - 0x39143492]
btc cx, cx
shr ecx, 0xe1
mov ecx, dword [ecx + ebp - 0x1c8a1a47]
push 0x92114fb7
jb 0x10195307
jne 0x101f77f0
jno 0x1021f43b
add eax, dword [edx]
add eax, 0xb20d30a2
dec ebx
aam 5
cmpsb byte [esi], byte es:[edi]
mov bl, 0x34
inc ebx
sub eax, esp
pop es
rcl byte [eax], cl
je 0x1021f45a
jl 0x1021f443
mov dl, 0x52
mov al, byte [0x8da13546]
add al, 0x79
pushfd
pop ebx
adc al, 0x6f
pop edi
adc al, 0x31
xchg esi, eax
jae 0x1021f522
ljmp 0xe8f9:0xe341a4c7
mov cl, cl
or eax, dword [edx]
Function at 0x101bda8f
Capabilities:
Encode data using xor

Disassembly:
shl edx, 0xa9
adc al, 0x2e
rol al, 1
not dx
inc edx
jp 0x102130ec
call fcn.1017688f
add eax, 0x2df8dd2
fnsave dword [ebx + edi*4]
jb 0x1017a4d4
cld
cmp esi, dword [esi - 0x45]
adc al, 0xf5
jb 0x1017a483
sbb al, 0xd
mov ebx, 0xa40f0b07
and dword [edx], ebx
movsd dword es:[edi], dword [esi]
rcl byte [ebx], cl
mov dl, dh
sbb ah, byte [ebp - 0xd77ec2e]
rcr byte [edi + esi*4 + 0x79], 0x18
wait
mov cl, 0x2b
add al, 0xde
jmp 0x1017a523
mov ebp, dword [ebp - 0x55b349b6]
sbb edi, edx
mov al, 0x3c
mov eax, dword [0xc938ecf8]
invalid
jmp 0x1017a4b4
not word [esp + 6]
jne 0x101da7fd
and eax, 0xd0bc2713
nop
mov ebx, es
aaa
sbb ecx, dword [edi - 0x1c]
test al, 0x90
fdiv st(7), st(0)
inc ebx
mov bl, 0xe8
or al, 0x7c
pushfd
fadd st(3)
cli
sahf
in eax, 0x1b
or dl, cl
mov cl, 0x63
xor al, 0xfc
push esp
out dx, al
sub eax, 0x197ec981
fnstsw word [ecx - 0xe9e06e6]
adc eax, 0xe9428339
xchg ebp, eax
jno 0x101bdab3
mov ebx, 0x5235263c
daa
jbe 0x101bdb57
xor eax, 0x7e762752
xchg ebp, eax
xchg esi, eax
fild dword [ebx - 0x47]
int1
mov bl, 0xd6
ja 0x101bdb61
xchg edi, eax
mov edi, 0x70d87e7e
cmpsd dword [esi], dword es:[edi]
jno 0x101bdb4d
sub dh, byte [edi + ebx*8 + 0x56d2b24f]
dec ecx
sti
stosd dword es:[edi], eax
inc eax
jbe 0x101bdb33
dec ebx
cmp byte [edx], 0xdd
dec dx
cmp dword [ecx], ebx
push ebx
mov dword [ecx - 0x6ceeb596], eax
mov ebp, 0x8188d647
push 0x27d82a67
invalid
push edx
push 0x10
fisubr word [ecx + 0x77b704b6]
xor eax, ebp
mov ah, 0x7f
xchg edi, eax
jg 0x101bdabe
dec esp
aam 0x60
cmp byte [ebx], ah
adc esi, edi
xlatb
push ss
add byte [0x2b87817b], dh
xor eax, 0x2b87817b
add dword [edi + 0x45568b2b], 0x143ece69
loope 0x101bdb31
mov edx, dword [esi + 0x45]
imul ecx, esi, 0xf2e1143e
push ss
salc
jbe 0x101bdb25
test edx, esi
mov bl, 0x45
in al, dx
jle 0x101bdad4
push esi
xor ecx, esi
into
or byte [0x84790151], al
les edi, [ebp + 0x24c07b65]
xlatb
jnp 0x101bdb19
and al, 0xd7
sti
lahf
xchg esp, eax
push edi
sub eax, 0x2426c09a
shl byte [esi], 0x24
add dword [edx], 0xf7b305e6
outsd dx, dword [esi]
push esi
mov dl, 0xee
xchg ebx, eax
lodsw ax, word [esi]
inc edx
in al, 0xec
add dword [esi + ebp*8], 0x61
movsd dword es:[edi], dword [esi]
pop ecx
cli
fimul dword ds:[edx + 0x60649c2]
clc
pop eax
pushal
inc esp
push ds
scasd eax, dword es:[edi]
ja 0x101bdb24
ret 0x5626
adc esi, 1
push 0x923e1215
mov dword [esp + 4], 0xf6020587
dec dword [esp + 8]
shr dx, cl
jmp 0x101b55eb
dec al
ror dx, 0x47
rol edx, 0x59
neg al
ror dl, 0x61
xor bl, al
rol dl, 0xc2
sal edx, 0x59
adc eax, esp
jmp 0x1022b10e
push edx
or edx, dword [edx + eax]
shr dword [esp], 0x8e
shl word [esp + 2], 0x8e
sbb ebp, 4
not dword [esp]
jmp fcn.1023e539

Function at 0x101d1ae8
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], ebx
push esi
call fcn.101d3f27
xor eax, 0xf7f52091
add eax, esi
invalid
Function at 0x101e465d
Capabilities:
Encode data using xor

Disassembly:
push 0x428cfa3b
mov word [esp + 2], 0x3625
mov eax, dword [ebp]
lea esp, [esp + 4]
call eax
call fcn.1020013d
mov bl, 0xa4
mov ecx, 0xeefb297e
add eax, edx
xchg edi, eax
stosb byte es:[edi], al
mov dword [ebx + ebx*4 - 0x40], edx
xchg edx, eax
push edi
sub byte [ecx], dh
invalid
test ebx, ebx
lea esp, [esp + 8]
je 0x10194099
push 0x90108b0f
mov eax, 0x62307427
mov eax, dword [ebp + ebx*4]
mov dword [esp], eax
call fcn.10194081
jl 0x101e46e2
movsd dword es:[edi], dword [esi]
aaa
or dword [ebx + 0x26274861], ecx
aam 0xa
inc ebp
adc ebx, dword [ebp - 0x3650c350]
lodsd eax, dword [esi]
cmp dword [eax], ebp
adc eax, 0x2a2ebf93
aad 0x52
out dx, al
mov bl, 0x4c
out dx, al
pop ds
iretd
xchg ecx, eax
mov es, word [edi]
mov esp, dword [edx + ebx*2 + 0x8195e9c]
and edx, dword [ecx + 0x69862d95]
sbb byte [ebp + edi*2 + 0x25e47074], bh
fcom qword [ebx + 0x28]
push ebx
mov esp, 0xe470747d
and eax, 0x532853dc
int1
nop
test eax, 0x34f9ef16
sub eax, 0xb156d706
popfd
adc al, 0x29
push esi
test byte [ecx + 0x21f4ffcf], al
cmp esi, dword es:[ecx - 0x5a35b278]
loopne 0x101e46f3
jb 0x101e473b
cdq
jle 0x101e4789
mov word [esi + 0x57], ss
or ebp, dword [ecx]
add esi, dword [ebx + edx*4 - 0x58]
in eax, dx
jmp 0x2b48bcbd
dec edi
invalid
xchg edx, eax
outsb dx, byte [esi]
inc ebp
mov dh, 0x83
wait
adc ecx, dword [edi + 0x57]
loopne 0x101e47b7
mov bl, 0x54
daa
pop es
imul eax, dword [ebx - 0x72], 0xf6a40138
lahf
fdivr qword [esi - 0x1a]
mov ecx, 0xac95f57b
dec ebx
sahf
sub byte [ebp + edi*2 - 0x731c8b4], bh
dec edi
xor dl, ah
test dword [ebx - 6], 0x2910b28b
cld
sti
mul byte [edx - 0x15]
salc
add eax, dword [ebx + edi*8 - 0x4e3e680]
xchg edx, eax
xor ebx, dword [eax]
pop edi
dec esi
cdq
mov bh, 0xf6
mov ch, 0xa6
add ebx, dword [ecx - 0x5e]
jne 0x101e4735
in eax, dx
push ecx
jl 0x101e4749
and bl, byte [ecx]
cmpsb byte [esi], byte es:[edi]
inc ecx
cwde
out 0xe9, eax
aad 0xa9
inc edx
adc eax, 0xf3efc6ba
xchg edx, eax
shl dword [edx], 0x25
sbb al, 0x6c
fnstcw word [ebp - 0x33]
adc al, 0xef
sub dword [eax + 0x53], ebx
dec edx
dec ecx
add eax, 0xcde3a98e
invalid
mov ecx, 0x1c26769e
jo 0x101e478c
push 0x3a
xchg esp, eax
iretd

Function at 0x102001f5
Capabilities:
Encode data using xor

Disassembly:
or byte [edi - 0x72b7fff9], dh
and al, 0x10
jmp fcn.1016d4a9
call fcn.101b8992
fcomp qword [ebx + 0x73965781]
or dword [edi - 0x688e7f8a], ebp
jle 0x1016c4a2
inc ecx
in al, 0xee
sbb byte [ecx + 0x694b9e7f], ch
invalid
btc cx, 0x9e
mov cl, byte [esi + 4]
jb 0x1016c4b7
salc
dec ecx
cwde
xchg edi, eax
sub al, 0x47
scasd eax, dword es:[edi]
invalid
call fcn.101f867a
mov ecx, 0x31b89b0f
ror ecx, 0x9e
lea ecx, [ecx*4 - 0x51c56479]
mov dx, word [esi]
mov di, word [esi + 2]
jb 0x101c3e58