joyce8/EMBER2024-capa huggingface dataset:
Function at 0x144d39d
Capabilities:
Encode data using xor

Disassembly:
rol al, 1
mov dword [esp + edx - 0x7c476974], 0xc931eb24
leave
xor bl, al
lea eax, [esp + eax + 0x10]
shr dl, 0x67
jbe 0x2121e71
imul ebx, dword [ebp + 0x4d35ac7e], 0x39013de6
out dx, eax
pop es
inc edx
out 0x5b, eax
aas
popfd
stosd dword es:[edi], eax
mov cl, 0xb7
movsd dword es:[edi], dword [esi]
mov al, 0x51
adc al, 0x38
sbb ebx, eax
pop es
push ecx
xchg ebp, eax
add dl, byte [ebx]
insb byte es:[edi], dx
mov byte [0xecbe3504], al
insd dword es:[edi], dx
leave
push esp
or dword [ebp - 0x5d], ebx
xchg dword [edi], esi
lahf
sbb edx, dword [ebp - 0x43]
adc dl, cl
sub eax, 0x5c92128f
push 0xc658ab5a
pminub mm7, qword [ebp - 0x33]
popal
mov ah, 0xa4
nop
push ecx
jecxz 0x144d3a9
or al, 0x3d
test eax, 0xc68adc15
in eax, 0xc7
das
or byte [eax], bh
dec byte [esp + ebx]
fnstcw word [edi - 0x7e84712c]
ffreep st(5)
mov ebp, 0x955a0c29
xor dword [edx], ebp
add ecx, dword [edx + ebx*4 + 0x196855ec]
lodsd eax, dword [esi]
or al, 0xe2
mov ecx, 0xbf2ad2d4
xchg esp, eax
mov edi, 0x9bac65b1
inc eax
sbb dword ds:[eax - 0x334d2efd], 0xffffff8e
xchg ebx, eax
xor esp, ebp
lodsd eax, dword [esi]
mov esi, 0x235bba00
das
loope 0x144d46a
paddq mm0, qword [esi + 0x56b708d3]
cmp al, 0xc7
sbb al, 0xd4
arpl word [ebx - 0x4c00d4a1], bx
mov ch, 0x77
aam 0x75
pop edx
stosb byte es:[edi], al
sub esp, dword [esi + edi]
ret 0x582d
pop eax
pop esp
inc esi
push eax
dec ebx
xchg ebx, eax
scasd eax, dword es:[edi]
shr dword [edx], 0x12
inc ebx
sub ax, 0x54e1
scasb al, byte es:[edi]
dec eax
mov ch, 7
sbb ah, ch
in al, dx
std
push edx
out dx, eax
popal
add al, 0xc7
inc eax
cmp eax, dword [ebx - 0x35]
pop ebx
cmp esp, esi
invalid
ret 0xc
mov word [eax + edx - 0x7c476900], cx
jne 0x210b8b3
shl dword [esp + edx - 0x7c4768f9], 0x3b
xchg byte [esp + edx - 0x7c4768fa], dh
mov dword [esp + edx - 0x7c478f00], esi
ret 0xc
Function at 0x145f762
Capabilities:
Encode data using xor

Disassembly:
rol cl, 1
shl byte [esp + 0xa], 0x43
inc ebx
neg cl
push eax
or eax, 0xf927c02e
mov dword [esp + 4], 0x43113136
xor dword [ecx], edx
inc ebx
ror cl, 1
leave
sal ax, 0xa1
sal ax, 0x43
dec cl
xor bl, cl
xor al, byte [esp + 6]
dec eax
sal ax, 8
lea ecx, [esp + ecx + 0x20]
not word [esp + 0x15]
lea eax, [eax + eax*2 + 0xca3721e]
call fcn.022820cc
call fcn.0144c2ac
pop eax
shr dl, 1
mov cl, 0x8a
pop ecx
jecxz 0x145f776
pushfd
out dx, al
loop 0x145f7d1
enter 0x3d45, 0xffffffffffffff8c
fstp xword [eax + esi*8 - 0x45e5782a]
mov esp, 0xfddd244f
jbe 0x145f77a
xchg dword [edx], ebx
mov edx, 0x244fbc2e
invalid
loop 0x145f768
xlatb
mov al, 0x79
aam 0x57
out 0xf9, al
and al, byte [edi + 0x6a]
dec esi
fadd qword [eax]
and dl, byte [edi + 0x65]
loopne 0x145f7bf
call 0x63725525
push es
inc esp
pop ebx
imul edx, eax, 0xffffff85
jp 0x145f77f
cwde
ja 0x898691c9
test al, 0x98
jg 0x145f81b
cmp ah, bl
cmpsd dword [esi], dword es:[edi]
bound ebx, qword [ecx]
hlt
add dword [esi + 0x16], 0xa31cc3c8
bnd retf

Function at 0x1484c13
Capabilities:
Execute syscall

Disassembly:
lea eax, [edx + edx*8 + 0x299c324]
xor ebx, ecx
xor ax, dx
adc esi, ecx
movzx ecx, byte [edi + eax*4 - 0xa768570]
lea edi, [edi + eax*2 - 0x53b42b7]
xor cl, bl
call fcn.02226eaf
sysenter
push esi
pushfd
mov esi, 0x9aaaa41d
mov esi, dword [esp + esi + 0x65555be7]
mov dword [esp + 4], 0xfe5dace0
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.0143c4dc
shl cl, 0x64
not edx
mov dword [esp + ecx*2 - 0x20], ecx
pop eax
bswap edx
not edx
ror edx, 3
xor ebx, edx
add edi, edx
call fcn.0143313c
rol ecx, 1
neg ecx
movsx edx, ax
shr word [esp + edx - 0x7384], 0x2a
pop eax
not ecx
add ax, dx
sub ax, ax
inc ecx
shl eax, 0x5b
je 0x13df768
mov edx, 0x71a8ad38
neg dx
lea ecx, [edx + edx*8 - 0xc4e8572]
mov eax, dword [edi + edx - 0x71a852c8]
call fcn.022247ca
cmc
fmul dword [ecx]
mov ds, esi
aad 0xe2
adc al, byte [edi + ebp*8]
dec edx
movsd dword es:[edi], dword [esi]
inc ebp
mov bh, 0xfd
pop ebx
rol byte [ebx], cl
hlt

Function at 0x148c26b
Capabilities:
Get number of processors

Disassembly:
add ebp, ebx
dec esp
mov dword [esp + eax*2 - 0x1ffb2], eax
rol ebp, 2
dec esp
mov dword [esp + eax - 0xffd9], esp
jmp 0x2121396
neg ebx
xor dword [esp + eax*2 - 0x1ffb2], ebp
call fcn.022eb6b5
Function at 0x14977db
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edi + edx - 0x5105a1fc]
ja 0x20aa2db
adc edi, 4
xor ecx, ecx
test edx, edx
mov dword [esp], 0xa728860b
lea esp, [esp + 4]
je 0x2302626
call fcn.014a76f1
mov edx, 0x298c0e36
mov ecx, dword [edx + edi - 0x298c0e36]
inc edx
lea edi, [edi + edx - 0x298c0e33]
movsx eax, dx
neg edx
xor ecx, ebx
ror ecx, 3
sub ecx, 0xf92545a6
lea eax, [edx + 0x7c341f21]
rol ecx, 2
add al, dh
bswap edx
shr al, 4
lea ecx, [eax + ecx - 0x60520a3b]
bswap ecx
jnp 0x22786dc
mov eax, dword [edi]
push 0xbbaf5604
mov ecx, 0x1bbf56be
call fcn.020ccbee
fcomp qword [edi]
mov eax, 0x36a7a8bc
xor eax, eax
lea edx, [eax + eax*2 + 0x75b18b16]
lea ebp, [ebp + eax - 4]
or edx, edx
add dl, ah
movsx ecx, ax
adc ecx, dword [ebp + eax]
neg ax
call fcn.02144f3b
adc eax, dword [edi + 0x4b]
adc ecx, dword [ebx - 0x35]
push edx
adc ah, byte [eax + ebp - 3]
aaa
xor ebx, esp
add ebp, dword [esp]
cli
and esi, dword [esi + 0x28]
into
jns 0x149790f
pop eax
push edi
sub al, 0xc8
aaa
shr edi, 0xe4
ficom dword [edx + 0x69]
invalid
jmp 0xd8e5b422
sub edx, 0x8020fdb0
xor ebx, edx
dec al
not ecx
add edi, edx
mov bp, word [ebp + eax*2 - 0x1fe]
mov dword [esp + eax - 0xff], eax
sar byte [esp + eax - 0xfd], 0x63
pop edx
je fcn.01387fe3
add esi, 4
xchg esi, eax
lea edx, [ecx*4 - 0x507634e1]
mov ebp, eax
movzx eax, dl
jmp 0x2104d49
sar eax, 0x4e
je 0x142d071
shr dword [esp + ecx - 0x574ebe3e], 0xdd
movsx eax, word [esp + ecx - 0x574ebe40]
xor edx, 0xe1a83211
sal eax, 0x49
sub edx, 0xd4358eb5
dec byte [esp + ecx - 0x574ebe3f]
or eax, dword [esp + ecx - 0x574ebe3c]
rol edx, 1
sar eax, 0x3d
dec edx
add ax, ax
call fcn.022c111f
arpl word [eax], di
retf
sar dl, 2
jnp 0x227912a
jmp 0xfbe6650e
inc ecx
neg ecx
rol edx, 0x1f
inc eax
sar dl, 0xc3
not ecx
xor ebx, ecx
sal dx, 0xc6
adc esi, ecx
mov ax, word [ebp + edx - 0x64f87f40]
or dx, 0x4d8b
lea ecx, [edx + edx - 0x127bba56]
mov cx, word [ebp + edx - 0x64f87fc9]
jno 0x21487f0
lea ebp, [edx + ebp - 0x64f87ff0]
push edx
and dword [esp + edx - 0x64f87ff2], 0x880283b3
adc ax, cx
inc edx
mov word [ebp + edx - 0x64f87ff3], ax
ror dword [esp + edx - 0x64f87ff3], 0xa1
dec byte [esp + edx - 0x64f87ff0]
movsx ecx, dl
mov dword [esp + edx - 0x64f87ff3], esi
ret
mov edx, 0x5bbe5ca6
not ecx
sar dx, 0xa4
mov dword [edi + edx - 0x5bbe05ca], ecx
lea ecx, [edx + 0x171050af]
mov edx, dword [esi + edx - 0x5bbe05ca]
lea esi, [esi + ecx - 0x72ce5675]
sal ecx, cl
movsx eax, cl
ja 0x21b0044
mov eax, 0x2d19bd08
mov eax, dword [ebp + eax*2 - 0x5a337a10]
mov edx, 0x56941cbe
mov ecx, dword [ebp + edx - 0x56941cba]
inc edx
push edx
lea ebp, [ebp + edx - 0x56941cbb]
lea edx, [edx*2 - 0x2bd166f3]
neg dx
neg dl
add eax, ecx
mov dword [ebp], eax
shr edx, 0x77
jp 0x2308c5f
mov eax, dword [edi + edx*2 - 0x204]
lea edi, [edi + edx - 0xfe]
rol edx, 0x64
xadd dword [esp + edx - 0x1020], edx
call fcn.01a8a019
mov cl, byte [eax + ebp + 2]
lea ebp, [ebp + eax + 2]
shr dx, cl
xor ax, 0x96aa
shr ax, 0x41
mov word [ebp + eax*2 - 0x96aa], dx
xor dword [esp + eax*8 - 0x25aa8], edi
ret 4
Function at 0x14a67bc
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x7de98d5c], eax
fld qword [edi + ecx - 0x7d53feb8]
xor eax, eax
call fcn.02277b73

Function at 0x1a5bab6
Capabilities:
Encode data using xor

Disassembly:
call fcn.014a2e35
ror eax, 0xfb
xor ebx, ecx
not dl
dec edx
add esi, ecx
movzx ecx, dx
not ax
movzx cx, byte [ebp + ecx*2 - 0x1564a]
call fcn.020d940f
je 0x1a5bb04
sub dword [edi], ebp
das
mov ebx, 0xc4d49ede
aam 0xc4
push ebp
mov bh, 0x53
inc ebx
or al, 0x6e
outsb dx, byte [esi]
and dword [edx - 0x4fe8ad1], edi
lodsd eax, dword [esi]
pop ecx
cmc
fsubp st(5)
dec ebp
enter 0xffffffffffffaca5, 4
sub al, 0x91
pop ebx
mov ah, 0x21
sub al, 0x44
invalid
wait
pop es
xchg byte [esi], ch
mov dword [0x69217f34], eax
cli
loope 0x1a5bae7
add al, 0xfe
jae 0x1a5bada
je 0x1a5badf
ficom word [ecx]
pop esp
xlatb
xchg edx, eax
pop es
push 0xffffffffffffffef
mov edi, 0x8ad72150
pop edi
outsb dx, byte [esi]
clc
neg bl
cmp eax, ebx
add al, 0x59
adc eax, 0x21e9212c
sbb al, 0xe9
and dword [ecx + ebp*8], ebx
jne 0x1a5bb30
mov byte [ebp + 0x17], cl
insd dword es:[edi], dx
fisub word [eax - 9]
pop ebx
sal edi, 0x6e
mov dh, 0x5f
aas
ror byte [edx + 0x15], 1
pop ds
pop esi
cli
xchg edi, esp
invalid
Function at 0x1a638ae
Capabilities:
Encode data using xor

Disassembly:
pop ebp
mov eax, edx
movsx ebx, al
not eax
pop esi
add ebx, edx
shr eax, 0x19
pop eax
add dl, bl
inc dx
rol dl, 0xc7
popfd
pop ebx
jmp 0x22bfd83
pop edi
mov ebp, edx
jnp 0x135f113
pop ecx
jnp 0x144963b
mov dword [esp + ecx - 0x619c6367], ecx
add edi, eax
mov edx, dword [ebp + ecx - 0x619c6367]
mov eax, ecx
dec eax
pop ecx
mov ecx, dword [ebp + ecx - 0x619c6363]
lea ebp, [ebp + eax - 0x619c635e]
bswap eax
jns 0x1acb94f
xor eax, ebx
ror eax, 1
jmp 0x20f0538
and edx, 0x25380288
adc eax, ecx
shr dl, 0xe2
mov dword [esp + edx - 0x21080022], edx
mov dword [edx + edi - 0x21080022], eax
lea edx, [edx*2 + 0x1e964015]
neg word [esp + edx - 0x60a64057]
mov eax, dword [esi + edx - 0x60a64059]
movzx ecx, dl
not word [esp + ecx - 0x59]
lea esi, [esi + edx - 0x60a64055]
sal dl, 0xa5
adc dword [esp + edx - 0x60a64020], edx
pop ecx
xor eax, ebx
rol eax, 2
not eax
call fcn.013c29af
mov edx, 0x14355a08
sar dl, 0xc3
jp 0x1acb9ef
mov esp, edi
jnp 0x14a6e60
xor ecx, ecx
xor eax, ebx
and cx, 0xc113
call fcn.02121989
mov ecx, dword [edi]
add edx, 0x98a8ed1b
movzx eax, dx
shr eax, 0xbd
xor eax, dword [edi + eax*4 + 4]
call fcn.02262dfd
mov word [eax], cx
pop ecx
jmp edi
add esi, eax
rdtsc
sub ebp, 8
sal dword [esp], cl
mov dword [ebp + 4], eax
movsx eax, cl
mov dword [ebp + eax*8 - 0x328], edx
push eax
pop ecx
pop edx
js fcn.014a3934
lea eax, [eax + eax*8 - 0x41756bee]
mov dword fs:[edx + eax - 0x580b137b], ecx
movzx ecx, ax
call fcn.013c0580
ror ecx, 2
lea eax, [ecx + eax + 0x5c774e29]
and byte [esp + ecx*4 - 0x7ea623f9], cl
je 0x22936f4
or edx, 0xac8af1bb
neg eax
sal cl, 0xa1
inc eax
xor eax, 0xb02ede30
neg ecx
neg edx
ror byte [esp + edx - 0x53750e45], 0xe3
xor ebx, eax
rol cl, 0x27
inc dword [esp + edx - 0x53750e45]
jne 0x1aba0e3
shr ecx, 0x8b
not eax
movsx edx, cl
shl ecx, cl
neg eax
sal ecx, 0x7a
rol byte [esp + ecx + 4], 0x43
bswap eax
xor ebx, eax
pop edx
pop edx
add edi, eax
mov dword [esp + ecx], edi
ret
not dx
pop edx
call fcn.0218b8ed

Function at 0x1a63c27
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ret
lea eax, [edx + ecx*4 + 0x3a8fb22e]
mov dword [esp + edx*2 - 2], esi
ret 4
mov word [ebp + edx - 1], ax
and ecx, 0x2714d296
jns 0x143e3f2
mov cl, byte [eax]
cmp ebp, 0x49aaf215
cmp cl, 0xe1
jb 0x13d829a
mov eax, 1
jmp 0x13c0967

Function at 0x1a66b75
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp]
xor eax, ebx
mov dword [esp + 4], 0x539a5426
mov dword [esp + 4], 0x32989892
rol eax, 1
dec eax
mov edx, 0xbfaea01b
xor eax, 0xacb67134
pop edx
call fcn.0224d1d0
invalid

Function at 0x1a6b6a8
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], eax
mov dword [esp], 0xc79c9282
sal word [esp + 6], 0xac
test ebx, ebx
push 0x8036a4a1
lea esp, [esp + 0xc]
je 0x2302531
Function at 0x1a79568
Capabilities:
Get number of processors

Disassembly:
pop eax
mov dword fs:[ecx], edx
mov ecx, 0xca1fa018
call fcn.022a9552
mov eax, dword [esi]
mov edx, 0xda39443e
mov ecx, edx
add esi, 4
xor eax, ebx
inc eax
ror eax, 3
not dl
not edx
xor eax, 0xd209d692
bswap eax
call fcn.01429a3b
jns 0x1a795d0
sar dword [edi], 0xd0
adc byte [ebx - 0x6c66941f], cl
mov dword [0x245cf7a4], eax
add ah, byte [esi - 1]
rcl cl, 0xc2
adc dword [esi - 1], esp
test byte [edx + ebp*4 + 1], al
invalid

Function at 0x1a84b6f
Capabilities:
Encode data using xor

Disassembly:
shl edx, 0x63
lea eax, [edx + eax + 0x238b137d]
ror eax, 3
rol dword [esp + edx - 0x7ca02c38], 0xa6
dec eax
call fcn.01464f88
mov eax, 0x6e1f2633
mov eax, dword [edi + eax - 0x6e1f2633]
mov edx, 0x8f0da7b5
mov ecx, edx
add edi, 4
rol ecx, 0xce
push edx
xor eax, ebx
xor cx, dx
lea ecx, [ecx*8 + 0x3e857e9f]
inc eax
add edx, ecx
shl edx, 0x6f
bswap eax
sal dl, 0x43
lea eax, [ecx + eax - 0x246781c1]
xor edx, 0xbb3a5232
sal byte [esp + edx*4 - 0x78e148c6], 0xc1
ror eax, 1
add dl, ch
xor ebx, eax
xchg dword [esp + edx*2 - 0x3c70a5a8], ecx
add esi, eax
xchg cx, dx
mov edx, dword [ebp + edx*2 - 0x3c714f6a]
mov cl, byte [ebp + 4]
add ebp, 2
sal edx, cl
rol word [esp + 1], 0x8d
add al, 0x81
lds eax, [edx]
add byte [eax], al
add bl, dl
rol word [esp + 1], 0x8d
sar word [esp + 2], 0xe4
mov ecx, dword [esp]
mov dword [ebp], edx
jbe 0x217cf6a
mov ecx, 0x5a162a1d
mov ecx, dword [edi + ecx - 0x5a162a1d]
add edi, 4
mov edx, 0xe28dd500
movzx eax, dl
xor ecx, ebx
ror ecx, 1
rol eax, 0x53
and eax, edx
lea ecx, [eax + ecx + 0x51a03c01]
rol ecx, 1
shr edx, 0x44
sal ax, 0x22
not eax
inc ecx
dec dl
ror ax, 0x2a
neg ecx
sal dl, 0x47
dec ecx
sub dx, 0x2cb3
jno 0x2221159
jecxz 0x1a84bee
jmp 0x66fcdc3
adc esi, dword [esi + eax + 0x66]
jl 0x1a84c17
mov ah, 0x8c
cmpsd dword [esi], dword es:[edi]
out dx, eax
xor byte [edi + 0x1c], al
test eax, 0xe5fc54fa
cwde
pop ss
xchg dword [edx + 0x6c9ada24], edx
cdq
in eax, 0xc0
push es
push ecx
fstp xword [ebx - 0x3f5f76b]
arpl word [edi - 0x57353c06], bp
lodsb al, byte [esi]
inc ebx
cmp al, 0xb8
adc byte [edx], bl
cmp byte [edx - 0x1ac857c4], 0x81
push ds
mov esp, 0xb9811c91
and dl, byte [esi]
mov dword [0xa669308a], eax
cli
pop ss
invalid
shl edx, 0xe4
xor ebx, ecx
rol eax, 0x94
bswap edx
add esi, ecx
neg eax
movzx edx, word [edi + eax*2 - 2]
lea edi, [edi + eax + 1]
xor dx, bx
sub dx, 0xe223
xor dx, 0x6322

Function at 0x1aa9d64
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + ebx + 0x657bbcca], esp
inc edx
inc edx
xor dword [esp + ebx + 0x657bbcca], ebx
call fcn.021a76ba
push ecx
mov ch, byte [esi + 0x4b5cf57d]
fst qword [esp + esi*8 - 0x23a59b6a]
fsubr qword [eax]
xchg ebp, eax
and dh, byte [ebp + 0x205fab37]
push cs
jp 0x1aa9d6b
pushal
dec ebx
fcom qword [eax]
and al, 0x54
fsubr qword [ecx + 0xd]
sub dword [eax + 0x7f6dc40], eax
cli
invalid
Function at 0x1abaf14
Capabilities:
Encode data using xor

Disassembly:
xor ecx, 0x7324c909
dec eax
lea esp, [esp + 8]
jne 0x1abaf30
mov eax, 0x22b90516
pop esi
jmp 0x22542e3
add ebp, 4
xor ecx, ecx
test eax, eax
lea esp, [esp + 4]
je 0x1a44edf
push 0x62909c38
mov dword [esp], esi
movzx esi, byte [edx]
push 0xbaa67fa2
xor esi, ecx
sar word [esp + 2], 0x66
push 0xbb0afb21
jb 0x22a6df6
shr ecx, 8
dec dword [esp + 4]
xor ecx, esi
inc edx
jmp 0x1a44ec8
and esi, 0xff
shr byte [esp + 7], 0x61
mov esi, dword [esi*4 + 0x22efa7c]
jo 0x226e61f

Function at 0x20c50a8
Capabilities:
Encode data using xor

Disassembly:
neg dword [esp + 0x10]
dec eax
lea esp, [esp + 0x14]
jne 0x22e331b
call fcn.021641a5

Function at 0x20c7d42
Capabilities:
Encode data using xor

Disassembly:
or edx, edx
mov edx, dword [eax + edi - 0x17800]
sub al, ah
mov ecx, dword [esp + eax - 0x17888]
add eax, 0xb90dbdb2
xor edx, ebx
neg byte [esp + ecx*4 - 0x57fffffe]
lea edx, [ecx + edx - 0xcfd4f7f]
bswap edx
dec al
setns cl
xchg dword [esp + ecx*2 - 0x2c000002], eax
ror edx, 2
jmp 0x22e47ae
neg edx
inc edx
and word [esp + eax - 0x15ffffff], cx
adc cx, 0x540b
xor ebx, edx
sub al, 0xb4
sar ecx, cl
adc esi, edx
pop edx
jmp fcn.020c1ce6
shr eax, 0x1b
not eax
mov ecx, dword [ecx + ebp - 0x353c8054]
add ebp, 4
and al, 0x89
add ax, ax
and edx, ecx
movsx ecx, ax
sar byte [esp + 1], 0x61
not edx
mov dword [ebp], edx
xchg ecx, eax
ror eax, 0x93
pop edx
jmp edi
pop ecx
add esi, edx
or dword [esp + 0xe], eax
movzx edx, al
call fcn.020e9135
mov edx, 0xb28aa18b
mov ecx, edx
sub edi, 4
push edx
mov ecx, dword [edi]
add dword [esp], 0xa08650a4
xchg dword [esp], edx
jl 0x22568c9
sbb dl, 0x8d
add byte [esp + ecx - 0x143eef9], cl
xor bl, dl
lea edx, [esp + edx + 8]
not cl
or ecx, eax
mov ecx, dword [edx]
movsx edx, ax
not dl
sbb ebp, 4
add word [esp], ax
pop eax
call fcn.01a459a6
xor ecx, ebx
movsx eax, dl
ror al, 0xa6
jae 0x20ae67b
rol ecx, 3
jmp 0x23050d6
bswap edx
sub byte [esp + ecx - 0x15ffffff], ah
jae 0x1ab146b
inc ecx
not ecx
or edx, edx
sal dword [esp + edx - 0x5310f22f], 0x19
ror eax, 0x17
inc ecx
push edx
neg ecx
ror ecx, 1
sal dl, 2
adc edx, edx
sal dx, 0x41
xor ebx, ecx
lea ebp, [ebp + eax*8 - 0xbc004]
pop edx
mov dword [edx + ebp - 0x5310f22f], ecx
lea edi, [edi + eax - 0x17804]
jmp 0x1a74aad

Function at 0x20e7dfb
Capabilities:
Execute syscall

Disassembly:
call fcn.01400ed2
syscall
call fcn.013c3e97
or edx, dword [esp + edx - 0x4451c07f]
adc esi, ecx
movsx eax, dx
mov dword [esp + edx - 0x7dddf47f], esi
ret
Function at 0x20f8423
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
sub edx, edx
mov dword [esp + edx*4], edx
xchg dword [esp + edx*2], edx
mov dword fs:[edx + eax], ecx
mov eax, 0x61a36700
or dword [esp + edx], edi
ret
dec eax
lea ecx, [ebp - 0x11449df0]
rol edi, cl
inc cx
xor ebp, 0xf781e48c
test al, 3
mov cl, byte [ecx - 0x575247bf]
cmp al, 0x48
lea edi, [edi + ecx*8 - 0x69b64b38]
dec eax
sar ecx, cl
xor edi, 0xc331fa84
inc ecx
movsx edx, ax
inc ecx
push esp
movsx eax, dl
xor dword [esp + ebp - 0x7886193], edi
inc cx
shr eax, 0x62
call fcn.0142d900
pushfd
jnp 0x139a659
or eax, 0x2a86a01a
inc ebx
sub bl, ah
nop
sub byte [ecx - 0x3982635b], bl
adc byte es:[ebp + 0x16d541e7], dh
enter 0xffffffffffffd762, 0xffffffffffffffcb
mov al, 0x90
sub byte [edx], ah
add eax, 0xd28af9c
inc esi
push esp
jno 0x139a6b8
mov edx, edx
pushal
xlatb
insd dword es:[edi], dx
dec edi
mov esp, 0xc1289c40
invalid
jmp 0x139a670
inc ecx
push ebx
inc ecx
shrd esi, ebp, cl
push eax
mov ecx, esi
push eax
inc edi
mov dword [edi + eax*2 + 0x51ca0020], esi
add bx, 0xe102
jg 0x20dbcd5
dec esp
mov dword [esp + esi - 0x711cfa96], ecx
ret 0x20

Function at 0x21213b2
Capabilities:
Get number of processors

Disassembly:
xor edx, 0x898b6b1a
call fcn.01ab63ba
mov edx, 0x72a37ead
movzx ecx, dx
mov ecx, dword [esi + ecx*8 - 0x3f568]
sal dx, 0xe
lea esi, [esi + edx - 0x72a33ffc]
call fcn.013f04f8
mov eax, 0x7c885fa9
mov ecx, eax
mov cx, word [eax + ebp - 0x7c885fa9]
mov dx, word [eax + ebp - 0x7c885fa7]
xor al, ah
lea ebp, [ebp + eax - 0x7c885ff4]
ror eax, 0x25
and eax, eax
adc cx, dx
lea edx, [eax + eax*4 - 0x1ed09fea]
or edx, edx
mov word [ebp + edx - 0x64a4af11], cx
shr al, 0x41
mov ecx, dword [esi + edx - 0x64a4af11]
lea esi, [edx + esi - 0x64a4af0d]
or edx, eax
jne 0x22733f0

Function at 0x2125390
Capabilities:
Get number of processors

Disassembly:
lea edx, [edx + edx*2 - 0x2b64fb68]
mov dword [edx + ebp - 0x5a94bebc], ecx
mov dword [esp + edx - 0x5a94bebc], edx
inc dword [esp + edx - 0x5a94bebc]
pop ecx
jge fcn.020c1ce6
outsb dx, byte [esi]
xor eax, ecx
aas
mov dword [ecx], 0x896fe689
invalid
Function at 0x216220e
Capabilities:
Encode data using xor

Disassembly:
inc esi
xor dword [esp + ebp - 0x1aabc37], esi
dec esi
mov esp, dword [esp + ebp*2 - 0x3557876]
ror dx, 0xae
dec ebp
arpl si, si
inc dx
neg dword [esp + ebp*2 - 0x3557879]
dec ebp
adc ecx, esi
inc dx
neg dword [esp + ebp - 0x1aabc3b]
inc bp
mov eax, dword [edi + ebp*8 - 0x5e1f8]
inc sp
xadd edx, ebp
push ebp
dec edi
lea edi, [edi + ebp*2 - 0x353fffe]
dec edx
mov dword [esp + ebp - 0x1a9fff0], ecx
inc edx
xchg dword [esp + ebp*4 - 0x6a7ffff], esi
call fcn.0145c95b
dec edi
adc byte [ebp - 9], bh
rcr byte [eax + 0xd], 0xb8
mov eax, dword [0xd26707c5]
pop edx
and dword [edi + 0x32e5227], esp
sti
invalid
jmp 0x1384452
xor eax, ebx
rol cx, 0x63
neg ecx
call fcn.0213c2a8
push ebp
inc ecx
bswap esi
inc cx
sub ebx, 0xc141080c
mov byte [edx], 0x41
sub esi, 0x8404c293
dec ecx
sub ebx, 0x159f8125
inc edx
shr dword [esp + ebp*2 - 0x355787d], 0x71
dec ecx
xadd eax, edx
inc ecx
bswap esi
inc ecx
inc esi
inc ecx
or al, 0x9d
inc edx
xadd dword [esp + ebp - 0x1aabc3c], edx
inc ecx
ror esi, 1
dec eax
lea ecx, [ebp - 0x39ddab47]
dec esi
xchg dword [esp + ebp - 0x1aabc3d], eax
dec esi
mov dword [esp + ebp*4 - 0x6aaf0f4], esp
inc ecx
mov esp, 0x85000c37
jmp 0x1407c0c

Function at 0x216bd7d
Capabilities:
Encode data using xor

Disassembly:
ror ecx, 3
shl edx, 0xf7
mov dword [esp + eax - 0x778c1a01], 0xad0f6799
inc dl
xor ebx, ecx
add esi, ecx
call fcn.01474c44
mov cl, 0x52
add dword [edx], esp
std
cmp byte [ebp - 8], bh
sti
movsd dword es:[edi], dword [esi]
cmp bh, byte [esp + ecx*2]
invalid

Function at 0x216fc80
Capabilities:
Encode data using xor

Disassembly:
movsx eax, cx
push eax
mov edx, dword [ebp]
sub ax, word [esp + 2]
xor edx, ebx
call fcn.020ef044
xor eax, 0xd14699ef
push edi
in al, 0x1a
lea ebx, [ebx]
cmp eax, 0xe2d8242c
jg 0x1360b6d
sbb dword [esp + 0x57b7f8b5], 0x474178e3
pop edi
push ebx
leave
add dword [ecx + 0x57], 0x8b60d14e
inc edx
out dx, eax
or dh, 0x73
push cs
inc eax
pop es
cmp eax, 0x634d02e3
xchg byte [edx], bl
pop ss
xor edi, eax
push esi
insb byte es:[edi], dx
into
adc edx, dword [esi - 0x70]
mov edi, dword [edx + 0x6b7571e8]
jne 0x1360bda
mov dl, 0xb2
mov bh, 0x39
pop ds
out 0x6e, al
retf
add al, 0x7e
mov dword [esp + 0xc], eax
neg word [esp + 9]
mov ebx, dword [esp + 0x14]
movzx esi, ax
push eax
not al
mov edi, dword [esp + esi - 0x7ba0]
mov esi, dword [esp + esi*4 - 0x1eed0]
lea ebp, [eax + eax - 0x23dff2c1]
ror eax, 0xbb
mov eax, dword [esp + eax - 0x360f6857]
sar ebp, 0xd4
push dword [esp + 0x28]
popfd
mov ebp, dword [esp + 0x2c]
call fcn.020f04de
mov ecx, 0xd2178bac
mov edx, ecx
sub ebp, 4
jmp 0x1360b17
Function at 0x217002f
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov esp, dword [esp + ebx*4 - 0x224]
rol ax, cl
inc sp
xchg ebp, ebx
dec eax
arpl bx, bx
dec esp
adc ecx, ebx
inc edx
ror dword [esp + ebx*2 - 0xa4], 0x84
dec esi
mov dword [esp + ebx*2 - 0xa6], ecx
ret 0x10
inc ebx
not bp
not ebx
inc ecx
lea ebx, [ebx + ebx + 0x3306fe94]
dec edx
mov dword [esp + ebx - 0x85], 0xa687e916
dec edx
lea eax, [ebp + ebx*8 - 0x4ef81bce]
neg ebx
movsx edi, cl
dec edx
rol dword [esp + ebx - 0x87], cl
dec esi
mov dword [esp + ebx - 0x7d], esp
inc edx
xor dword [esp + ebx*4 - 0x224], ebx
jmp 0x20e6656
inc ebx
mov ebx, dword [edx + ebx*2 - 0x11a]
movsx ebp, cl
inc ecx
xor ebx, esp
push ebp
sar dword [esp + ecx - 0x9b], cl
jp 0x2125480
mov dh, byte [0x9dfffb54]
popfd
push ebp
wait
inc edi
and eax, 0x6d4fa959
xor ebp, esp
sahf
loop 0x2170046
iretd

Function at 0x2193056
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xba270497
dec ebx
not byte [esp + 2]
jmp 0x13807b5
lea esp, [esp + 4]
jne 0x225e669
jmp 0x1430332
mov eax, 0xa3a8b520
mov eax, dword [ebp]
call eax
mov edx, 0x4408f3a2
movzx edi, dl
mov ebp, dword [edx + ebp - 0x4408f3a6]
shl edx, 0xcf
movzx ebx, di
mov dword [ebp + edi*8 - 0x510], eax
movsx ecx, bl
sub cl, 0xbb
pop ebx
dec edx
pop edi
shl edx, cl
ja 0x22bff74
lea esi, [esi + ecx - 0x24c08]
sal ecx, 0xe2
jae 0x1a5ba09
xor eax, ebx
rol eax, 1
ror cx, 0x49
neg eax
call fcn.014928dc
shl ax, 0xc7
mov eax, dword [ebp + ebx*4]
mov dword [esp], eax
jp 0x2222d8f
mov ecx, dword [ebp]
movzx eax, dx
xor eax, eax
call fcn.022894d5
jp 0x1374f08
movzx edx, word [ebp]
mov ecx, dword [esp + 4]
add ecx, 0xfff3ac05
jmp ecx
mov eax, 0x7c1701a0
call fcn.02193056
pop esi
and ecx, edx
neg ecx
jmp edi

Function at 0x2195c65
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], ebx
mov ebx, 0xe0052008
neg ebx
movzx ebx, byte [eax + ebx - 0x1ffadff8]
push 0x117d0b9
xor ebx, edx
push 0xac143d09
and ebx, 0xff
not byte [esp + 6]
mov ebx, dword [ebx*4 + 0x2247e38]
shr edx, 8
sub word [esp + 5], 0x6522
not dword [esp + 4]
xor edx, ebx
shr dword [esp + 4], 0xa1
inc eax
xor edx, 0xff0640b5
dec ecx
lea esp, [esp + 8]
jne 0x2195c68
mov ecx, 0xcb30c80e
rol cx, cl
pop ebx

Function at 0x219a403
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push esi
cmp di, cx
clc
test edx, edx
jmp 0x1a8d1b2
je 0x14704fe
mov eax, 0x5a4d
stc
cmp word [edx], ax
jmp 0x14704f8
je 0x14ae381
jne 0x14704fe
mov ecx, dword [eax + 0x78]
jmp 0x2231f2f
mov eax, dword [edx + 0x3c]
clc
cmp dh, 0x9f
add eax, edx
cmp ax, 0xdf0e
cmc
stc
cmp dword [eax], 0x4550
jmp 0x148e0f8
je 0x14704fe
mov esi, dword [ebp + 0xc]
cmc
test esi, esi
jmp 0x146959e
push ebp
shr dl, 0xa7
rcl dl, cl
mov ebp, esp
or dl, 0x8a
ror dh, cl
bt dx, ax
mov edx, dword [ebp + 8]
lea esp, [esp - 0x114]
jmp 0x13d2c3f