joyce8/EMBER2024-capa huggingface dataset:
Function at 0x878376
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
nop
mov ebx, 0x37b4fb2a
or cl, 0x38
neg ebx
jle 0x8dd8c9
neg word [esp + ebp - 0x516ed6f8]
shr byte [esp + ebp - 0x516ed6f8], 0x36
jns 0x9d8441
push 0xd33b37bb
pushfd
neg word [esp + 4]
or byte [esp + 4], 0x87
add dword [esp + 4], 0x4b9c7fb8
push ebp
mov ebp, dword [esp + 8]
mov dword [esp + 8], 0xd26ec168
mov ebp, dword [esp]
jne 0xa05b06
mov ebx, dword [esp + 4]
mov ebx, dword [ebx + ecx*2 - 0x73759974]
mov dword [esp + ecx*2 - 0x73759970], ebp
call fcn.00a393a1
outsd dx, dword [esi]
or eax, 0xb9ec8e19
add cl, byte [ecx + 0x6f]
in eax, dx
or dword [esi], edi
mov word [ecx - 0x21c78a2a], gs
xchg esp, eax
xor eax, eax
or eax, 0xe6b4904a
mov ebp, 0x83650083
enter 0xffffffffffffda5c, 0x48
cmp ebx, esp
sbb byte [esi + 0x786c95c4], dh
int1
pop ecx
push 0x7f08388d
fstp st(6)
mov esp, 0x4582dc4c
pop eax
rcr dword [eax], 0x9a
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
push eax
cdq
ret 0x1dfe
and dword [esp + ebp - 0x516ed6f8], ebp
mov ebp, dword [esp + ebp - 0x516ed6f4]
jl fcn.008095e3
shr byte [esp + 0x18], 0xd6
add dword [esp + 4], 0xff7fa9d3
test word [esp + 8], 0xc7ad
jg 0x806a40
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x20]
ret
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.0092ae5b
call fcn.00998922
mov word [edx], ax
lea esp, [esp + 0x14]
jmp fcn.0099c951

Function at 0x880373
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
mov edi, dword [esp + edi - 0x1a76317]
jg 0x8d823c
jb 0x92d7bd
mov esi, 0x2c87cb0d
mov si, word [esi + edi - 0x2c87cb0d]
mov cl, byte [edi + 2]
jmp 0x970a55

Function at 0x8cf99c
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [edi + eax - 0x331800]
sbb esi, 4
mov dword [esi], edi
lea esp, [esp + 4]
jmp fcn.0083f47c
pop edi
rol al, 1
xor bl, al
sal dword [esp], 0xa9
ja 0x9ad593
fadd st(1)
xor al, 0x24
test eax, 0xdbe8870f
or eax, 0x596efc00
cld
outsb dx, byte [esi]
pop ecx
mov esp, 0xef09c288
in eax, dx
add edi, dword [eax - 0x2f8d9aa8]
xor al, 6
cld
rcl dword [ecx], cl
xchg ebp, eax
bnd js 0x8cf9a0
into
test byte [ebx], ah
xor dword [ebp - 0x6e], 0x28aa0d58
pop ecx
sub dword [eax], 0xffffffbe
cmp al, 0xd8
into
mov esi, 0x9bc70890
mov dl, dl
fucomi st(3)
jns 0x8cfa01
and byte [eax + edx*2 - 0x214e8fb0], bl
out 0x73, al
cmp eax, edx
xor ebx, dword [edx - 0x53]
ffreep st(0)
lcall 0x5328, 0x1dfd0d37
xor byte [edi + edi*4 - 0x2a], dh
test edi, 0x1cc4ea0e
std
or eax, dword [ebx + edi*4]
invalid
mov edi, dword [esp]
lea eax, [esp + eax + 4]
jns 0x7eea0c

Function at 0x8dd0c0
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [esp + ebx + 0x686e5ce7]
push esi
jl 0x9a5702
jmp 0x85605b
Function at 0x90a997
Capabilities:
Encode data using xor

Disassembly:
add ebp, 4
and esi, eax
push 0x2b091882
not esi
mov dword [ebp], esi
lea esp, [esp + 8]
jmp fcn.00755990
clc
les edi, [0xaac56206]
lodsb al, byte [esi]
sbb dl, byte [esi]
outsb dx, byte [esi]
adc ebp, dword [edx + 6]
invalid
xchg edi, eax
push 0x31
cmp ecx, dword [ebp - 0xf]
in eax, 0x59
std
jp 0x83f016
sbb dword [esi - 0x5f73bfaa], 0x8bc48400
je 0x83f0b4
mov esi, dword [esp + 0x14]
jo 0xa114dc
adc al, 0xf
add byte [ebp + 0x24], 0x1d
add byte [esi + 0x33], ah
rol cl, cl
loop 0x83f112
xor dx, dx
shl edx, 0x75
jbe 0x8801d5
cdq
jmp 0x83f079
dec dword [ebx + 0xc93d9fd]
mov esi, 0x9227805f
jmp 0x83f09d
pop esp
mov bl, 0x66
daa
mov bl, byte [ebp + ecx*8 + 0xa]
rcl dword [ebp - 0x60]
aas
lodsd eax, dword [esi]
leave
cmpsb byte [esi], byte es:[edi]
sahf
pop edi
invalid
shr dx, 0x83
mov edx, dword [esp + 0x34]
push dword [esp + 0x24]
popfd
lea esp, [esp + 0x44]
ret
shl dl, 0x46
cmp esi, 0xac181035
jns 0x83f08d
mov eax, 0x843ae097
push eax
mov eax, dword [ebp + 4]
jmp 0xa23c93
neg ebp
jl 0x92baa1
mov esi, dword [ebp]
jmp 0x98e545
jmp 0x78979a

Function at 0x913742
Capabilities:
Authenticate hmac

Disassembly:
call fcn.0099fa9e
imul edx, dword [edi - 0x164c2b4], 0x3b3e552d
and esp, esi
in al, dx
adc eax, 0xa72adc1
mov al, byte [0xacb3a7c9]
insd dword es:[edi], dx
jno 0x913791
lcall 0x800f, 0x663fe766
push esi
invalid
rcl ah, 0x28
std
sahf
inc edx
adc al, 0xc8
sbb byte [ebx + 0x5133f492], 0x89
sub byte [edi - 0x59], dh
adc dl, bh
sub esi, dword [esi - 0x448ce7c7]
test eax, 0x979baa2f
push ds
call 0x7f8b78d8
invalid

Function at 0x915e2c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
dec esp
call fcn.0099f314
or edx, dword [ebp + ecx + 0x1d394f73]
sbb byte [edi], 0x8e
adc eax, 0x1d2b5b61
pop ecx
xor ebx, dword [ebx + 0x65]
pop ss
das
pop edx
sar dword [ebp + 0x69], 0xbf
sub bl, byte [0xb4bd8847]
jmp 0x915df1

Function at 0x95d27a
Capabilities:
Encode data using xor

Disassembly:
call fcn.00a1b514
shl byte [esp + 0x14], 0xe2
call fcn.00878518
jmp 0x8dad37

Function at 0x960b68
Capabilities:
Encode data using base64

Disassembly:
jb 0x98f56c
call fcn.008d5fdc
mov ebp, dword [esp + ebp - 0x55b92087]
mov dword [esp + edx + 0x4fd2d40f], ebp
movzx edx, dl
call fcn.0099365c
Function at 0x960b73
Capabilities:
Encode data using base64

Disassembly:
ret
sub ebx, edx
sub dx, word [esp + edx + 0x61554304]
test byte [esp + edx + 0x6155f63d], dl
jg 0x9950b3
shl dl, 0x8d
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + edx + 0x6155f700]
lea ebx, [edx*2 - 0x5be270d3]
and dword [esp + ebx + 0x1e8e5ed3], 0x281b34b5
shl byte [esp + ebx + 0x1e8e5ed7], 0xa7
lea ebx, [edx + ebx*8 - 0x534e8262]
call fcn.0096b3cf
not ebp
mov edx, dword [esp + 4]
mov edx, dword [edx]
call fcn.007f7f6e
shr word [esp + 0x10], 0x17
js fcn.0099308a
xor dword [esp + 0x10], 0xba223586
call fcn.00a2482a
mov esi, 0xf715911a
mov eax, dword [ebp]
add ebp, 4
lea edx, [esi*8 + 0x6081dac]
inc esi
xchg ebp, eax
lea edi, [esi - 0x2bcd5562]
mov edi, eax
call fcn.00929a47
call fcn.008efc99
lea edi, [edi + edi*4 + 0x3bfe2a0]
mov ecx, dword [esp + ecx + 0x41f97baa]
call fcn.008706a8
xor dword [esp + 0x24], 0xe9b471a0
mov dword [esp + 8], 0x2633580f
mov ebx, 0x6f870211
mov ebx, dword [esp + ebx - 0x6f8701f5]
mov ebx, dword [ebx]
and byte [esp + 0x24], 6
cmp byte [esp + 0x18], 0x2f
jns 0x7c4a5e
push ebx
mov ebx, 0xa3aa642a
pushfd
neg bl
ja 0x7ef623
jo 0x908666
push edx
xchg dword [esp + ebx + 0x5c559b36], eax
mov edx, 0x411e6d96
je fcn.00805e72
add ebx, 0xb43c07a1
neg edx
or edx, 0x503eaab9
and dx, 0x6405
mov ebx, dword [esp + 8]
mov dword [esp + 8], eax
jbe 0x8507fa
xor edx, 0xbd2f9cba
cmp dl, 0x3f
setl dl
or edx, edx
js 0x785625
neg dl
mov dl, 0x19
call fcn.0080c106
lea esp, [esp + 0x4c]
ret

Function at 0x960c6c
Capabilities:
Encode data using xor

Disassembly:
not cl
cmp ecx, dword [esp + 0x10]
jne fcn.008bf46e
cmp ebx, dword [esp + 0x24]
xchg dword [esp + 0x2c], ebp
mov ecx, dword [esp + ebx - 0x5c26e0d8]
seta byte [esp + ebx - 0x5c26e0dc]
cmp dword [esp + ebx - 0x5c26e0f0], ebx
mov ebx, dword [esp + ebx - 0x5c26e0ec]
jle 0x970f3c
seto byte [esp + 0x24]
add byte [esp + 0x10], 0x1c
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x2c]
ret
call fcn.00986237
mov edi, dword [esp + 4]
lea esp, [esp + 8]
jmp 0x99f227
not edx
mov dword [edi], edx
push 0xe70bf700
push 0x47afb815
lea esp, [esp + 8]
jmp fcn.007cb203
Function at 0x963cab
Capabilities:
Encode data using base64

Disassembly:
add edi, 2
call 0x8542ac
and al, 9
or eax, 0x3d9fd9ba
mov ebp, 0xb46c25ae
aaa
mov bl, 0x5c
mov bl, 0x40
adc cl, cl
xlatb
fiadd word [esi + 0x3ca9d0f9]
test al, 0xd9
xor byte [edx + 0x3b47de98], ch
test dword [ecx - 0x29], esp
lodsd eax, dword [esi]
mov ch, 0x66
mov al, byte [0x396fe417]
adc esp, 0x41224e68
or al, 0xd0
mov ah, 0x71
or esp, dword [edi + 0x3e02200e]
cwde
adc byte [0xd1d6d49], al
invalid
bswap esi
shr word [esp], 1
mov esi, ebx
jae 0xa391b2
call fcn.00928b69
mov ecx, 0x7b0c5914
mov eax, ecx
movzx ax, byte [edi + ecx - 0x7b0c5914]
xor ecx, ecx
neg ecx
sub cx, cx
xor cl, byte [edi + ecx*2 + 2]
jmp 0x788eb0
jge 0x99d055
mov ebp, 0x772bbd3a
push ebp
add dword [esp + 4], 0x215b50
or bp, 0x5939
not esi
push esi
sub ebp, esi
mov ebx, dword [esp + esi*8 - 0x8303268]
mov ebx, dword [ebx + ebp - 0x7625f6ed]
bswap ebp
mov dword [esp + esi*4 - 0x4181930], ebp
lea ebx, [ebx + esi - 0x48675b33]
shl ebp, 0xe8
shl bp, 0xdd
je 0x78d64b
or byte [esp + 0x10], 0x8f
add dword [esp + 0x10], 0x12250aa6
add dword [esp], 0xff763111
mov ebp, dword [esp + 8]
mov ebp, dword [ebp]
test dword [esp + 0x10], 0xb9a39a9d
mov dword [esp + 8], 0x5b284be
call fcn.0075c162

Function at 0x96553f
Capabilities:
Encode data using base64

Disassembly:
mov bl, byte [esi - 0xcae3ba3]
test eax, 0x3330f2ae
or dh, byte [ebx]
popfd
cmpsb byte [esi], byte es:[edi]
nop
mov esp, 0x79608566
invalid
cmp byte [ebx], cl
cwde
and byte [ebp - 0x27], 0x7d
jp 0x6e3535
pop ss
pop ds
cmpsb byte [esi], byte es:[edi]
push es
test dword [ebx + eax*2 - 0x34753de5], 0xe67743f4
xchg edx, eax
sti
push 0x8dcaab17
lea esi, [esi + 1]
push ecx
pushfd
mov ecx, 0x71593bd
call fcn.009255d9
call fcn.007897d3
jl 0x6e3584
int3
jle 0x6e35ac
cmp byte [esp + 0x18], 0x28
jle fcn.00852dbd
and dword [esp + 0x18], 0x6e0fc131
call fcn.007eedbd

Function at 0x965867
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
shl esi, 0xbd
mov dword [esp + esi - 0x5fffffdc], edx
mov dword [esp + ebx - 0x572ef12b], ebx
call fcn.007b8669
sub ebx, ebx
jge 0x846944
call fcn.00875a96
sub ebp, 1
mov esi, 0x4f0d3c0e
movzx edx, byte [ebp + esi - 0x4f0d3c0e]
shr esi, 0x50
xor dl, bl
sar si, 0x64
dec dl
add esi, 0x6cb7402f
ror dl, 1
xor dl, 0x21
dec dl
xor bl, dl
add edx, esp
neg esi
adc esi, esi
movzx si, byte [edx + esi - 0x269175c3]
call fcn.008de10b
mov ebx, esi
jg 0x7a4ca7

Function at 0x96586f
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
push ecx
mov ecx, 0xb428d590
shl ecx, 0xfd
inc ecx
push esi
inc ecx
push eax
inc ecx
push ebx
dec eax
not ecx
inc esp
movsx eax, cl
jns 0x8cf910
bswap ebx
call fcn.006e2d50
mov dword [esp + 0xc], eax
push ebx
test byte [esp + 4], 3
call fcn.007aecd1
call fcn.008f40ea
dec eax
mov dword [esp], eax
pushfd
mov eax, 0x42b7da14
add al, al
dec eax
add eax, eax
dec eax
lea eax, [0xff834b7b]
jg 0x8838f1
Function at 0x969c80
Capabilities:
Encode data using xor

Disassembly:
not bl
mov ebp, dword [esp + 0xc]
mov ebx, dword [esp + ebp*4 + 0x6b35b1c8]
not ebp
not byte [esp + ebx*4 + 0x6b35b1c8]
mov ebx, dword [esp + ebx + 0x1acd6c83]
mov ebx, dword [ebx]
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], ebp
shl dword [esp + 0x14], 3
jb fcn.00a09270
push ebp
jno 0x81c158
setno bl
lea ebp, [ebp + ebx - 0x52a27bff]
sets bl
je 0xa1be0c
and bx, bx
mov dword [esp + ebx - 0x52a27bdc], ebp
not bx
jns 0x7fcb3c
mov ebp, dword [esp + ecx*2 + 0x46fe7c8e]
lea esp, [esp + ecx*2 + 0x46fe7c92]
ret 4

Function at 0x96e43c
Capabilities:
Packed with generic packer

Disassembly:
or dx, 0x213e
mov esi, dword [esp + 0x18]
mov esi, dword [esi]
jle 0x78a443
add dword [esp + 0x18], 0xffee811e
mov edx, 0xce95f317
mov esi, 0x9988298f
bswap ecx
shl esi, 0x21
jl 0x81e66f
sub dl, dh
mov dword [esp + ecx - 0x122f24bf], esi
sub cx, 0x48bd
or ecx, 0x8e9e93ac
shl dx, cl
jbe 0x9016e0

Function at 0x970a70
Capabilities:
Encode data using base64

Disassembly:
bswap esi
call fcn.00986009
mov edx, 0x959b91b3
lea eax, [edx + edx*8 - 0x1e7e9c6b]
xor al, ah
movzx ecx, byte [esi + eax - 0x23f98262]
push edx
lea esi, [esi + eax - 0x23f98261]
movzx ebp, word [esp + eax - 0x23f98262]
xor cl, bl
jmp 0x9282ae

Function at 0x9768ba
Capabilities:
Encode data using base64

Disassembly:
call fcn.0073db6a
jmp fcn.00832f69
mov edx, dword [esp + ebp*2 + 0x53eb1cee]
mov edx, dword [edx + ebp*2 + 0x53eb1ce2]
jbe 0x7b2f7a
push 0x9c825e18
mov byte [esp + 3], 0x3c
mov ebx, ebp
mov edx, 0xffce0000
pop ecx
sub ebx, edx
mov edi, esi
pop esi
jae 0x915112
mov edx, dword [esp + ebx*2 - 0x1290a610]
xor dword [esp + ebx - 0x9485312], ebx
sub dword [esp + ebx*2 - 0x1290a624], 0xd20f2383
or dword [esp + ebx - 0x9485312], ebx
cmp bl, 0x21
lea ebx, [ebx*8 + 0x76173b9f]
lea edx, [edx + 1]
lea ebx, [ebx + ebx - 0x2c46b380]
setl byte [esp + ebx - 0x546cf4de]
mov ebx, dword [esp + ebx - 0x546cf4de]
cmp dword [esp], 0xc8877c91
not bl
jle 0xa3914f
sub al, 0xdf
pop edx
push 0x54899d4f
and al, 0xc
mov dword [esp + ebp + 0x4f685adb], ebp
push edi
pushfd
mov edi, ebp
movzx edi, bp
bswap edi
add dword [esp + 0xc], 0x21cedd
shl di, 0xa7
mov ebp, 0xd60a718f
jae 0x90b1d7
inc esp
pop edx
push esi
movsb byte es:[edi], byte [esi]
push ecx
and al, 0xd2
fst dword ss:[edx + ebp*2 - 0x598d9666]
sub cl, cl
xchg byte [esi - 0x68], ch
jno 0xa22519
mov dl, 0x30
aad 0xfb
dec edx
cmp eax, 0xe7bf9b65
into
sbb ebp, edx
shr byte [bx + si], 1
inc ebx
jmp 0xa2246e
dec ebx
invalid
push edi
add ebx, dword [esp + 4]
mov dword [esp + ebx - 0x56faa6e7], edx
xor bx, bx
push ecx
mov ecx, 0xc43daf0d
push 0x2c23a031
mov edi, 0xba8a5523
xor edi, dword [esp + ebx - 0x56fa0000]
add dword [esp + 0x14], 0xffedcc42
or word [esp + ebx - 0x56f9fff4], 0x179f
push 0x3499cf0c
jbe 0xa22483
call fcn.009775b7
Function at 0x983e5c
Capabilities:
Encode data using base64

Disassembly:
push edx
call 0x7c6549
neg byte [esp + ecx*2 - 0x17fde]
cmp dword [esp + ecx - 0xbfdd], ecx
lea esi, [esi + ecx*4 + 0x7d0ca6]
mov dword [esp + ecx*4 - 0x2fffc], ecx
mov word [esp + ecx*2 - 0x17fde], 0x4092
mov dword [esp + ecx*2 - 0x17fee], ecx
xchg dword [esp + ecx*2 - 0x17fd6], esi
mov ecx, dword [esp + ecx - 0xbff1]
ja 0x87f5fe
jae 0x8d7918
sysenter
call fcn.007afce5
jl 0x97bdc2
mov edi, dword [esp + 0x38]
seta byte [esp + 0x28]
not dword [esp]
call fcn.008d4c46
rcr ebx, 1
sbb al, 0xf
mov dl, 0x85
push edx
ror byte [edx], 0x12
or al, 0xa7
xor dword [edx - 0x39], edx
inc ecx
outsd dx, dword [esi]
hlt
pop edx
call fcn.008fb632
push eax
call fcn.0090a984
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x2c]
ret
push esi
mov edi, dword [esp + 0x14]
mov esi, 0x4f081408
pushfd
shr esi, 0x4b
xor si, 0xa90f
push 0x282f152a
lea edi, [edi + esi*2 - 0x129019]
add byte [esp + esi - 0x9480d], 0xae
push 0x2928202e
cmp dword [esp + esi - 0x9480d], 0xf03db006
jb 0x9fed4d
push ebx
pushal
jl 0x983f08
xor dl, dh
jns 0x983efd
jb 0x983ee9
and eax, ecx
popal
cmp dword [esi - 0x1c0404e], 0x6c381023
and al, 0xc
mov dword [esp + 0x24], ebp
push ecx
jo fcn.008e1055
xchg dword [esp + esi*4 + 0x4b69f28c], ebx
mov ecx, dword [esp + esi + 0x12da7cc2]
jle 0xa0a096
shr dword [esp + 0x18], 0x87
setb byte [esp + 0x28]
jae 0x8daa88
mov dh, 0xa4
add al, 0x58
xchg esi, eax
push ecx
xchg esp, eax
pop eax
dec eax
add eax, 0xfffb2d8f
jmp eax
lea dx, [ebx - 0x46f49efd]
mov esp, edi
movsx ecx, bx
movzx ebp, cx
lea ebp, [edx*8 - 0xd746dd5]
pop edi
neg cx
pop ebp
mov esi, 0x6c9656b7
and esi, 0x302c4b90
pop ebx
mov eax, ecx
pop ecx
xor esi, 0x152144b4
pop esi
xor ax, dx
pop edx
add eax, eax
setns al
popfd
lea eax, [eax + eax + 0x37188a16]
lea eax, [eax*8 + 0x359e0432]
not eax
pop eax
call fcn.007cbf7f
retf
neg byte [esp + esi - 0x9480d]
or dword [esp + esi*4 - 0x252030], 0xdcb82ca7
mov dword [esp + esi*4 - 0x252014], edi
and byte [esp + esi - 0x94809], 0x9e
jle 0x7878fa
jmp 0x908835
neg cx
xor cx, 0x889
xchg dword [esp + ecx - 0x1b5e8b15], esi
xor cl, 0x91
jg 0x81bb92
push 0xb203fc9f
or dword [esp + ecx - 0x1b5e8bb0], 0xe031b793
movsx cx, cl
mov dword [esp + 0xc], esi
xor dword [esp + ecx - 0x1b5effb0], 0x73107c92
or dword [esp + ecx - 0x1b5effb0], 0xdd164233
push edi
push edx
or dword [esp + ecx - 0x1b5effa8], ecx
jl 0xa1df0c
neg ecx
call fcn.00799867
mov eax, dword [esp + edi*2 - 0x26]
mov eax, dword [eax + ebp*2 - 0xa3bf408]
or ebp, 0xa90b22b0
jg 0xa463c0
mov dword [esp + ecx*8 - 0x6071d0c8], ecx
cmovge ebp, dword [esp + ecx*4 - 0x3038e85c]
lea eax, [eax + ecx*2 - 0x37740d0d]
add dword [esp + ecx*2 - 0x181c7436], 0xff99e0a0
push ebx
mov cx, 0xcb10
push ebp
call fcn.00988cfe
popfd
lea esp, [esp + 0x28]
ret
Function at 0x9898e3
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
call fcn.007c1143
jmp 0x8d2e03
jb 0x8cf90b
or dword [esp + 8], esi
push edx
test edi, edi
xchg dword [esp + 0x1c], eax
mov edx, dword [esp + 0x18]
lea esi, [esi + esi + 0x7df6f36a]
call fcn.007f32b7
sbb ebp, 2
mov word [ebp], di
call 0x6d0590
sub cl, 0x28
ror cl, 1
inc byte [esp + edi*2 + 3]
xor bl, cl
and di, word [esp + edi*2 + 1]
lea ecx, [esp + ecx + 4]
cmovbe di, word [esp + edi*2]
rol dword [esp + edi*2 - 0x11c46], 0x59
movzx di, byte [ecx + edi - 0x8e23]
jae 0x90f025
test edx, esi
jle 0x9e58ec
mov dword [esp + 8], esi
jl 0x92eee4
lea eax, [eax - 0x42f58ac2]
jno 0x8c1602
mov ecx, 0xb71dfb92
movzx ecx, byte [esi]
mov edi, 0xab267025
shr edi, 8
lea esi, [edi + esi - 0xab266f]
xor cl, bl
lea edi, [edi*8 - 0x38f6a55c]
push edi
xor edi, edi
sbb cl, 0x8f
xor cl, 0xaa
dec word [esp + edi*2]
jne 0x960a10
mov ecx, 0x4620f696
movzx dx, byte [esi + ecx - 0x4620f696]
shr cx, 0xa8
or cx, cx
mov cl, byte [ecx + esi - 0x462000f4]
adc esi, 2
jmp 0x7cc610
push ebx
lea ecx, [ecx*4 + 0x5223b626]
mov dword [esp + 0x10], edx
jbe 0x85208f
mov ebx, ecx
mov bx, 0x6dba
call fcn.006f0e75
jmp dword [ecx]

Function at 0x98a73f
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xchg dword [esp + 4], edi
call fcn.00914a18
add edi, ecx
salc
les eax, [edx - 0x63c0f0f8]
push cs
push ecx
salc
lodsb al, byte [esi]
mov dl, bl
pushal
outsd dx, dword [esi]
sub al, 0xe9
push cs
invalid

Function at 0x98efbf
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub dword [esp], ebp
bswap ebp
mov ebp, dword [esp + 0x1c]
add dword [esp + 0x14], 0x4c955628
setb byte [esp + 0xc]
or dword [esp + 0xc], 0x81aec837
not byte [esp + 4]
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x28]
ret
js 0x5a9cac
add dword [esp], 0x184e7c
movsx ebp, word [esp + ebp + 0x74bb89dd]
mov edi, dword [esp + 8]
push ebp
pop edx
xor word [esp + 8], 0x9126
setno byte [esp + 8]
mov edi, dword [esp]
mov edi, dword [edi]
mov dword [esp], ebp
push ebp
bswap edx
shl dl, 0x17
xor ebp, ebp
lea edi, [edi - 0x7b60afdd]
push edx
push edx
sub ebp, dword [esp + 4]
jo 0xa223d7
and edx, ebp
xchg dword [esp + 0x28], edi
mov edx, dword [esp + 0x10]
setns byte [esp + 8]
movsx ebp, byte [esp + 8]
xor dword [esp + 0xc], 0x218f691e
shl word [esp], 0xee
je 0x6d7375
jne 0x7c5758
Function at 0x9a1895
Capabilities:
Packed with generic packer

Disassembly:
je 0x9fa0d1
xchg dword [esp + 8], ecx
call fcn.00a0057f
call fcn.009c278d
pushfd
xor si, si
shr si, 0xde
jns 0x6da7e9
mul byte [esi - 0x3f]
out dx, al
fimul word [edi]
mov dword [ebp - 0x24002303], edx
mov byte [ebp - 0x7e], dl
adc ah, 0xee
fisttp dword [eax - 0x2b7f7dab]
out dx, al
push ebp
fstp xword [eax + 0x300aed57]
daa
test dword [ecx - 0x5d], eax
cdq
push esi
push esp
jo 0x90aaa1
insd dword es:[edi], dx
cwde
xor ebp, dword [eax + 0x56]
cmc
add bh, 0x1d
push 0x8d4e8983
mov byte [esi + 0x538f4a0d], bl
in al, 0xc0
mov al, byte [0x80216f0d]
sub dword [edx - 0x54a3534b], edx
mov dl, byte [ebp - 0x2ca3c9ec]
int1
ja 0x90aaea
xchg edx, eax
push es
sbb byte [ecx], ah
movsd dword es:[edi], dword [esi]
pop ebx
inc esi
lahf
ljmp 0x554
or dword [ebp + eax + 1], edx
jg 0x90ab09
rcl dword [edi + 0x37794669], cl
mov byte [edi + 0x23], 0xed
nop
jno 0x90aa49
jecxz 0x90aa74
invalid
and dword [edi + 0x4a], esp
dec ebx
xor dword [esi - 0x11b6928e], ebp
jb 0x90ab3a
dec ecx
out dx, al
inc edx
add edx, ebx
aaa
std
retf 0xc9c6
pop esi
cmc
inc esp
daa
inc esp
cmpsd dword [esi], dword es:[edi]
sub eax, 0x843af229
xor eax, 0xe643c77c
into
pop ecx
invalid
test eax, 0xc80d5e31
pop ecx
mov word [esi - 0x1a], ds
dec esi
sbb eax, 0xd5e62799
xchg byte [eax], bl
pop ecx
mov eax, 0xff882087
movsd dword es:[edi], dword [esi]
push ss
pushal
add ebx, dword [esp + eax*2 + 0x6ef47753]
pop ebp
dec eax
add byte [eax - 0x67b09317], bh
sub dword [eax + 0x23bd2a78], esi
jp 0x90aacb
adc dword [ebp - 0x4efcb83a], ebp
fmul st(3), st(0)
xchg ecx, eax
mov cl, 0xdc
retf
add al, 0x57
leave
aaa
sbb al, 0x95
je 0x90aac5
cmp cl, byte [ecx]
outsb dx, byte [esi]
popal
inc esi
xchg ecx, eax
fmul qword [ebx - 0x2b]
rcl byte [eax + ecx*4], cl
cmp eax, 0x56e8e411
ja 0x90ab35
jge 0x90abd1
mov bl, 0xe0
jle 0x90aaff
inc edi
js 0x90abcd
adc dword [edi + ecx*4 - 0x2b], ebx
imul ebp, dword [eax + 3], 0xe6b18ca
push ss
mov bl, 0x9c
mov eax, 0xfec5b12f
nop
add eax, dword [ebx + 0x3835b3a7]
pushfd
sahf
cmovns ebp, dword [esi]
insd dword es:[edi], dx
retf
pop ds
ja 0x90ac30
cmp ah, byte [esp + edi*4 - 0x7a44d66a]
movsb byte es:[edi], byte [esi]
mov esp, 0x85bb2996
rcr dword [esi], 1
cmp al, 0xc2
add eax, 0x4a138dde
stosd dword es:[edi], eax
hlt
xchg edi, eax
invalid
jle 0xa20c79
mov dword [edi], esi
jmp 0x852e66
lea eax, [eax + esi + 0x13c80001]
push ebp
push 0xc13983b7
mov ebp, esi
js 0x748880
movsx ebp, word [esp + esi*2 + 0x27900000]
and byte [esp + esi + 0x13c80000], 0x22
mov dword [esp + ebp*2 + 0xf8a6], eax
neg byte [esp + ebp + 0x7c49]
not ebp
lea esi, [esi + esi - 0x5f19b065]
push ecx
call fcn.00a4125c
call fcn.00a23176
push 0x5a011e8e
add edi, 2
or cl, al
not cl
call fcn.00a352c7
jb 0x8fbe54
test byte [esp + ebx - 0x5aa7f4c3], 0x1a
mov byte [esp + 0x18], ch
xchg dword [esp + 0x38], eax
mov ebx, dword [esp + 0x2c]
jl 0x90aa46
neg cl
jo fcn.0077c29a
mov word [esp + 0x18], 0x2d00
and dword [esp + 0x1c], edx
mov edx, dword [esp + 0x28]
call fcn.009cb0be
inc ebp
mov dword [eax], esp
dec eax
lea esp, [esp + 8]
jmp fcn.00a3f250
Function at 0x9b31f5
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp], 0xf32e4a31
call fcn.00986f19
xor dword [edi + eax*4 - 0x4bc6b573], edx
test eax, 0xf2955f8c
and byte [ebx + ebp - 0x6f7de864], bh
add al, byte [ebx - 0x2289ea30]
dec ebx
js fcn.009b31f5
push ebx
test al, 0x1d
push ss
std
dec ebx
cmp dword [0xdf5d8832], esi
mov bh, 0x6c
invalid

Function at 0x9b94d9
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0x30]
popfd
lea esp, [esp + 0x44]
ret
jg 0xa1149d
mov edi, dword [esp + 0x20]
shl dword [esp + 0x28], 0x67
or dword [esp + 4], 0xf696d98c
xor dword [esp + 4], 0xc8887b2d
test dword [esp + 0x10], 0xa0089d8c
jl 0x7abeef
cdq
invalid