joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10b597bb
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [eax + ecx + 0x74a0522e]
adc eax, eax
xor ebx, ecx
xor dword [esp], eax
adc edi, ecx
mov ecx, dword [esi]
sal byte [esp + 1], 0xe6
push eax
add eax, dword [esp]
mov eax, dword [esi + 4]
imul ecx
push 0x1c27da9e
jmp 0x10c10b9b
lea eax, [edx*8 - 0x555711e3]
dec ecx
bswap ecx
neg ecx
call fcn.10b04aef
mov ecx, dword [ebp]
mov eax, 0xb9094795
sal al, 0xa3
adc ebp, 4
xor ecx, ebx
neg eax
ror ecx, 2
push eax
not word [esp + eax - 0x46f6b858]
not ax
neg ecx
ror eax, 0x9c
shr dword [esp + eax - 0x6f647a74], 0x9b
bswap ecx
sar byte [esp + eax - 0x6f647a73], 0xc1
adc eax, 0xf131be8b
jne 0x1071c72a
inc cx
neg eax
not dl
xchg dx, cx
dec eax
call fcn.10aeff92
jno 0x10b8006c
mov ecx, 0x988dc0b7
jmp 0x107a7b30
adc esi, edx
mov eax, dword [ebp]
lea edx, [ecx + ecx*8 + 0x78b7df2d]
mov dl, byte [ebp + 4]
call fcn.108954d1
lea edx, [ecx + 0x728d3824]
lea edi, [edi + edx*2 - 0x52731164]
jmp 0x10ae04fd
mov ecx, dword [edi + edx*2 - 0x52731160]
xor ecx, ebx
jmp 0x1073ec29
shr dx, 0x41
or edx, edx
neg cl
inc dword [esp + edx + 0xb]
and dl, 0x83
call fcn.10ad6941
inc edx
and cx, cx
dec ecx
rol edx, 3
lea ecx, [ecx*8 - 0x7fe07949]
not edx
shr cl, 0x65
rol edx, 3
and cl, 0x2d
and ecx, ecx
lea eax, [ecx*2 - 0x7b655fc6]
xor ebx, edx
sal al, 4
or cl, cl
jge 0x1090aab0
mov edx, dword [ebp]
add ebp, 4
xor edx, ebx
mov eax, 0x361f5f27
dec eax
lea edx, [edx + eax - 0x415cedb2]
jno 0x108f9f17
neg ecx
or eax, 0x7501b710
not edx
sbb ecx, 0x822c7db9
shr edx, 0x66
xor eax, eax
not ecx
or dl, 0x99
lea ecx, [ecx + edx*2 + 0x6d4b2268]
shr edx, 0x70
xor ebx, ecx
sar edx, 0x9e
call fcn.10bf0a6f
ror edx, 2
mov ecx, eax
neg edx
lea edx, [edx + ecx - 0x110b90fc]
not eax
rol ax, 0xa3
push eax
xor ebx, edx
shr ecx, 0x54
add edi, edx
mov edx, dword [ecx + esi - 0x361]
mov ecx, dword [ecx + esi - 0x35d]
xor eax, 0x13913ba3
shl dword [esp], 0xd8
adc esi, 8
and ax, ax
call fcn.10871ee1
mov ecx, 0xb6ac508c
jmp 0x1093365b
inc dword [esp + 7]
mov dword [esi], edx
mov dword [esi + 4], eax
call fcn.10c14fdc
Function at 0x10b5fe0a
Capabilities:
Encode data using base64

Disassembly:
mov dword [edx + ebp - 0xa1db9f8], ecx
lea eax, [eax + 0x609387b0]
jns 0x10840037
xchg dword [ebx + 0x2890f60], edx
inc ebx
or eax, dword [eax]
lea edx, [ecx + ecx*4 - 0x14d65d58]
lea eax, [eax + ecx + 0x3b054331]
not eax
inc cl
call fcn.109f20d0
pop esp
stc
jp 0x1078bd7a
jnp 0x1078bd2c
aas
jb 0x1078bdc0
push ss
out dx, al
int3
sbb al, 0x4e
push edx
pop es
and dh, ch
cdq
imul ecx, dword [edi], 0x37
test dword [ebp + 0x72487997], ebx
sti
add cl, byte [ebp - 0x45]
add dword [esi - 0x58c5e4fe], esp
mov edx, 0x65afc2e2
sub byte [eax], 0x41
pop ebx
invalid
push edi
out dx, al
invalid
neg byte [esp + eax - 0x60931d64]
mov eax, dword [edi + edx*4 - 0x2876e7e0]
shl byte [esp + edx*2 - 0x143b73ec], 6
push edx
mov ecx, edx
lea edi, [edi + edx*2 - 0x143b73ec]
inc byte [esp + edx*2 - 0x143b73ed]
adc dword [esp + edx*2 - 0x143b73e8], ecx
setb cl
xor eax, ebx
dec eax
and cx, word [esp + edx*2 - 0x143b73ed]
add dl, byte [esp + edx*4 - 0x2876e7de]
ror eax, 1
shr cl, 0xc4
sbb byte [esp + edx*4 - 0x2876e44a], 0x3d
sub cx, dx
inc eax
xor word [esp + edx*4 - 0x2876e451], 0xb01e
call fcn.107dd7b0
not byte [esp + eax - 0xa1db932]
xor ax, 0xf682
bswap ecx
add dl, 0x3f
or byte [esp + eax - 0xa1d4fb0], ah
sbb eax, edx
not ecx
sar dword [esp + edx - 0xa1db9f8], 0xdf
not word [esp + edx*2 - 0x143b73ef]
xor ebx, ecx
push eax
sal dword [esp + edx*2 - 0x143b73ef], 0xa4
lea ebp, [ebp + edx - 0xa1db9fc]
jns 0x1078bd22
dec eax
lea eax, [edi + eax + 0x6f1efaab]
xor edx, 0x8d82ca2a
dec esp
and ebp, edi
dec edx
sbb dword [esp + ebp - 0x7b], eax
dec edx
dec esp
mov edx, dword [esp + 0x10]
dec ecx
add edx, 0xffccd7a2
inc ecx
jmp edx
rol eax, 2
call fcn.10bae98b
mov ecx, 0x272bef84
jmp 0x10b77065
mov ecx, dword [ecx + edi - 0x272bef84]
mov eax, 0xa1db932
lea edi, [edi + eax*4 - 0x2876e4c4]
xor ecx, ebx
mov edx, eax
push edx
xchg byte [esp + eax - 0xa1db931], ah
bswap ecx
xadd byte [esp + eax - 0xa1db932], al
xchg byte [esp + eax*8 - 0x50edc98f], dl
dec ecx
jmp 0x10a408b7

Function at 0x10b76441
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0xef56d1f0
mov dword [esp + 4], 0x85afac4f
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.10a5d714
Function at 0x10b7b960
Capabilities:
Execute anti-debugging instructions

Disassembly:
js 0x10b59754
not ax
xor ebx, edx
add esi, edx
call fcn.10afafeb
mov ecx, 0x8b8313ab
movsx edx, cl
movzx eax, dl
mov ecx, dword [ebp + eax*8 - 0x558]
shr dl, 0xa5
rol eax, 0xd1
lea ebp, [ebp + eax - 0x155fffc]
xor ecx, ebx
sub al, dl
dec ecx
and eax, 0x4b73821
xor dx, ax
jge 0x10b8bd07
xor ecx, 0xd5333680
inc ecx
inc ax
sar eax, 0x3d
not ecx
push eax
sar dword [esp + eax], 7
xor ebx, ecx
jmp 0x10cb2930
mov eax, 0x99111e8c
rdtsc
sub ebp, 8
mov ecx, 0x37286c81
mov dword [ebp + ecx*2 - 0x6e50d8fe], eax
mov dword [ebp + ecx - 0x37286c81], edx
lea edx, [ecx + ecx*4 - 0x337f48cc]
mov ecx, dword [ecx + esi - 0x37286c81]
sar edx, 0xfb
xor dl, dh
adc esi, 4
xor ecx, ebx
xor ecx, 0x7d322d8f
sub edx, 0xd30dd6b0
jnp 0x10c5c3e7
jbe 0x1087f4c0
neg ecx
jmp fcn.107412e2
xor eax, ebx
rol eax, 2
sub eax, 0x87a70086
rol edx, cl
bswap eax
dec eax
call fcn.10c9bdc7
sub edx, 0xe7a7fd0a
sal ax, 0xad
xor edx, 0x8a89408f
and ecx, 0x2c2fac3e
add ecx, 0xab2d1a1d
ror eax, 0xea
dec edx
bswap edx
jmp 0x108da99a
jbe 0x10a31535
sar ecx, cl
mov dword [esp + ecx*8], esi
ret 0xc
lea esi, [esi + edx - 0x4b0b06fc]
xor ecx, ebx
sar dx, 0x6e
not eax
rol edx, 0x65
xor ecx, 0xe88a0ab0
add edi, ecx
mov ecx, 0x58976bb5
or word [esp + eax + 2], 0x989e
movzx ecx, byte [eax + ebp]
dec edx
push edx
lea ebp, [ebp + eax*8 + 1]
xor cl, bl
shl word [esp + eax*8], 0x41
add al, 0x1c
call fcn.10cd484e

Function at 0x10b84f4b
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx + eax*4 + 0x62114080]
push ecx
xor byte [esp + eax + 3], ch
rol edx, 1
not al
mov dword [esp + ecx*4 - 0x27894], ecx
inc edx
or ecx, 0xd3f15a8
neg edx
lea eax, [ecx*2 + 0x161f6f1d]
xor ecx, 0x2a8a1b2f
xor ebx, edx
dec al
and word [esp + eax - 0x309eae75], 0xfbb9
call fcn.10acda4c
cld
inc ebp
xor dword [eax], esi
adc edi, ecx
jo 0x10b84f8c
add bh, bl
push es
add byte [ebp - 0x20c5e3ad], bh
stosd dword es:[edi], eax
jmp 0x860bdc77
Function at 0x10b96cad
Capabilities:
Encode data using base64

Disassembly:
neg ecx
or dword [esp + ecx - 0x5c2400c6], ecx
ror cl, 0xa6
xor bl, dl
sub ecx, ecx
lea edx, [esp + edx + 4]
mov dword [ecx + edx], eax
call fcn.10af1db8
inc edx
lea ecx, [ecx + eax*8 - 0x4d8fcd05]
dec eax
shr edi, 0x20
inc ecx
sar dh, 0x44
bswap ecx
dec esi
mov dword [esp + eax*4 - 0x17af0], esp
call fcn.10cab5ec
mov ecx, 0x3210fb32
movzx eax, cx
mov edx, 0xfb20a209
lea edi, [edi + ecx*2 - 0x6421f668]
inc eax
push edx
shr word [esp + ecx - 0x3210fb32], 0xe9
mov ecx, dword [eax + edi - 0xfb33]
xor ecx, ebx
sar dl, 0xc1
rol ecx, 1
rol edx, 0xdb
not ecx
rol ecx, 3
sub dword [esp + eax*8 - 0x7d998], 0x282d7da3
seto al
xor ecx, 0x5327adad
rol ecx, 2
jmp 0x10b07694
adc eax, edx
mov dword [ebp - 4], eax
push 0x2501a730
test ebx, ebx
push 0xa1bb587
lea esp, [esp + 8]
je 0x10bf8188
mov ecx, dword [esi + 4]
mov edx, 0x9a92c007
sal dx, 0xcf
xchg dh, dl
add esi, 4
or eax, ecx
ror edx, 0xe2
jae 0x10a76d9b
mov edx, ebx
sal edx, 2
shl ax, 0xa4
mov eax, ebp
jbe 0x108475c5
ror dl, 0x61
not eax
mov dword [esi + edx*2 - 0x4d490020], eax
movsx eax, dx
lea edx, [eax + eax*8 - 0x6f474375]
mov ecx, 0x1eb81124
jmp edi
not ecx
push edx
call fcn.10cec49d
add edx, edx
not dl
xor bl, cl
sal eax, 0x4c
push edx
jnp 0x107908aa
mov dword [esp + eax*2 - 0x3ffc], edi
mov dword [esp + eax - 0x2000], esi
xor al, 0x2d
add edx, 0xbfbf8e23
push ebx
sal eax, 0xfb
shr ax, 0xae
jns 0x10bff17c
mov eax, dword [esi + ecx - 1]
neg ecx
js 0x10883d7d
mov edx, 0x87aeea09
mov edx, dword [ebp]
add ebp, 4
mov ecx, 0xdf179297
xor edx, ebx
call fcn.108ca05d
mov ebx, ecx
je 0x10a345f4
mov ecx, dword [ebp]
mov eax, 0xeb3ddc08
lea edx, [eax*8 + 0x7900df84]
add ebp, 4
lea eax, [eax + eax + 0x4313d82]
xor ecx, ebx
add ecx, 0x2391302b
bswap ecx
inc ecx
xadd ax, dx
neg dl
rol ecx, 3
xor ebx, ecx
xchg edx, eax
add edi, ecx
mov esi, dword [esi]
sal edx, 0x64
jb fcn.10788c54
pop edx
pop ecx
pop ecx
jmp ebp

Function at 0x10b9985c
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + edi - 0x98fa035], edx
shr ebx, 0x5b
add bl, 0x14
adc esi, edx
mov dword [esp + edi*8 - 0x4c7d02c0], eax
mov dword [esp + ebx - 0x21], ebx
movsx edx, word [esp + edi*8 - 0x4c7d02c4]
mov esp, ecx

Function at 0x10bb46f8
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
mov dword [esp], eax
neg edx
or al, ah
sal word [esp + 2], 0x29
not edx
neg edx
call fcn.10c957c5
mov eax, 0x8501c2a5
mov ecx, dword [esi]
movzx edx, al
or edx, 0x4826529e
rol dl, 0xc1
mov dx, word [ecx + edx - 0x4826527f]
ror ax, 0x86
add esi, 2
movzx ecx, al
ror al, 0x45
mov word [esi + ecx*2 - 0x14], dx
lea edi, [edi + ecx*4 - 0x2c]
xor eax, eax
and eax, eax
mov ecx, dword [edi + eax*4]
adc eax, eax
sal al, 0x43
xor ecx, ebx
sub ax, 0xa6bf
rol ecx, 2
add ax, ax
neg ecx
dec eax
call fcn.108c0065

Function at 0x10bce334
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
add ebp, 0xc
inc ebp
xor edx, edx
jmp 0x109160bb
Function at 0x10bd85bb
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc edx
not byte [esp + ebx*2 - 0x3f2]
inc edx
lea edx, [edx + ebx - 0x431e8a3c]
dec edx
mov dword [esp + ebx - 0x1ff], edi
inc edx
ror byte [esp + ebx*2 - 0x3fa], 0xe3
inc edx
or byte [esp + ebx - 0x1f9], cl
xor edx, 0x81c0f1d
inc ebp
xadd ebp, edx
inc cx
add esi, edx
jp 0x10ad8dac
ror edx, 2
dec edx
shr dword [esp + ebp*4 - 0x170], 0x26
xor edx, 0x9f895302
dec esi
mov dword [esp + ebx - 0x1f7], esp
inc edx
xor dword [esp + ebx*4 - 0x7f4], edx
shr edi, cl
inc ecx
sal ebx, cl
dec esp
mov esp, dword [esp + edi*8 - 0x8848]
inc eax
adc bh, byte [esp + edi - 0x1108]
dec eax
arpl dx, dx
dec eax
inc dword [esp + edi*4 - 0x44d0]
dec eax
adc ebx, edx
dec eax
mov dword [esp + edi - 0x112c], 0x7a1d6e87
dec eax
add esi, esi
mov si, word [ebp + edi - 0x1134]
setl byte [esp + edi - 0x112c]
inc ecx
pop ebx
mov cl, byte [ebp + edi - 0x1132]
inc esp
mov dword [esp + edi*4 - 0x44cf], eax
dec eax
lea ebp, [ebp + edi*4 - 0x44ce]
inc bp
or edx, ebp
inc sp
sub dword [esp + edi - 0x1134], ebp
shl si, cl
inc word [esp + edi*2 - 0x2266]
inc eax
setnp bh
dec eax
shr dword [esp + edi - 0x1101], 0x75
mov word [edi + ebp - 0x1101], si
dec eax
add dword [esp + edi*2 - 0x2202], ebx
ret

Function at 0x10be5e2c
Capabilities:
Encode data using xor

Disassembly:
mov esp, ebp
mov esi, ecx
pop esi
call fcn.10a11349
bswap esi
pop esi
mov ebp, dword [esp + ecx - 0x2aff]
jmp 0x10aa380a
xor al, 0x32
xadd ax, dx
ror ecx, 1
ror dl, 0x63
dec ecx
call fcn.10cd9df4
mov esi, dword [esp + ecx - 0x2afb]
push ecx
call fcn.108505a7
mov edx, dword [esi]
mov eax, 0xba80b604
jmp 0x10c66af8
adc cx, 0xab08
rol cx, 1
neg cx
or eax, 0x68264230
dec cx
mov dword [esp], 0x753e2bbf
neg cx
lea eax, [eax*4 - 0x667ee341]
sal eax, 0x5f
xor bx, cx
xor edx, edx
adc word [esp + edx], dx
lea esi, [edx + esi - 2]
jns 0x10c3271f
mov edi, dword [esp + ecx*2 - 0x5602]
jmp 0x10790699
xor eax, edx
mov word [edx + esi], cx
sub byte [esp + edx + 2], dl
call fcn.10a36e23
mov ecx, 0x91be0c2f
jmp 0x10782b29
mov eax, dword [esi + 4]
mov ecx, 0xa0896e2b
mov cl, byte [esi + 8]
add esi, 6
shld edx, eax, cl
mov dword [esi], edx
mov eax, 0xbdaf590c
mov ecx, 0x3a578ac
mov ecx, dword [ebp + ecx*2 - 0x74af158]
sar eax, 0xc5
adc ebp, 4
movsx edx, al
xchg ah, al
xor ecx, ebx
jmp 0x10828b6e

Function at 0x10bf298e
Capabilities:
Encode data using xor

Disassembly:
rol eax, 1
call fcn.10ca43e8
neg ecx
jmp 0x10c0755a
ror dl, 1
xor ecx, 0x508ee7ac
call fcn.10bbefc2
in al, 0xf3
invalid

Function at 0x10bf9a84
Capabilities:
Encode data using xor

Disassembly:
ror dword [esp + 4], 0xe1
xor ecx, 0x12a69b21
mov dword [esp], 0x3b0b4d01
dec edx
lea esp, [esp + 8]
jne 0x10b60efe
pop esi
shr ecx, 8
xor ecx, esi
inc eax
jmp 0x1072b9e9

Function at 0x10bf9ccd
Capabilities:
Encode data using xor

Disassembly:
push 0x4c003684
jmp 0x10bfdf8a

Function at 0x10c05e8e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esi + 4], ecx
mov dword [esi], edx
mov ebx, dword [esp + 8]
call fcn.10a9d256
Function at 0x10c05e9c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
not word [esp + edx - 0x4700db15]
xadd dword [esp + edx - 0x4700db10], edx
lea ebp, [ebp + edx - 0x71fe2210]
ja 0x10994da7
lea edx, [edx - 0x4de9ea75]
mov word [ebp + edx*2 - 0x48286f32], cx
xadd word [esp + edx*2 - 0x48286f29], dx
movzx ecx, dx
xadd dword [esp + edx*2 - 0x4829fdf8], ecx
pop eax
pop ecx
pop eax
ja fcn.10c9be42
xor al, 0xbb
sal dl, 0x26
shl cl, 5
dec al
xor al, 0x18
mov dword [esp], edx
xor bl, al
xadd dx, cx
xor edx, ecx
lea eax, [esp + eax + 0xc]
sar dl, 0xc2
xor byte [esp + edx - 0x4700db15], 0xad
movzx cx, byte [eax + edx - 0x4700db18]
jno 0x1087fac9
call fcn.10c339f5

Function at 0x10c0c3f0
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
call eax
mov ebx, 0xe58d8ebc
movzx esi, bx
mov ebp, dword [esi + ebp - 0x8ec0]
lea ecx, [esi + ebx*4 - 0x3434765]
lea ecx, [ebx*8 - 0x3f942db]
mov dword [ebp + esi - 0x8ebc], eax
mov esi, ebp
mov ebp, 0xe7aa483e
not ebx
push ebx
mov ebx, dword [esp + ebx*2 - 0x34e4e282]
mov ebp, dword [esp + ecx*2 - 0x50e66602]
and cx, cx
jne 0x108e427c

Function at 0x10c12c4a
Capabilities:
Encode data using base64

Disassembly:
movzx cx, byte [ecx + esi - 0x8000]
jmp 0x10b5fddb
mov dl, byte [eax + esi - 0x37]
lea esi, [esi + eax*2 - 0x70]
inc dword [esp + eax*2 - 0x71]
jo 0x10bedfec
add cl, dl
movzx edx, al
rol dl, 0xc7
jb 0x10be9507
mov word [esi + eax - 0x39], cx
and dx, 0x1028
call fcn.109cec08
mov dword [esp + ecx - 0x8000], 0x38b0b302
adc edi, edx
jmp 0x10a110c0
Function at 0x10c1a035
Capabilities:
Encode data using xor

Disassembly:
push 0x5d88c695
mov esp, eax
push 0x7632801d
mov dword [esp], edi
mov edi, 0x6d0bf491
push edi
mov dword [esp + edi - 0x6d0bf491], esi
pushfd
mov esi, 0x8ea36cb4
mov esi, edx
sal di, 0xee
mov edi, eax
call fcn.10ac6236
cmp al, byte [ebp + 0x42]
sub ch, byte [ecx - 0x17]
cdq
xor al, 0x9d
jno 0x10c1a046
hlt
xlatb
stc
jb 0x10c1a0d7
adc al, 0xe3
or al, byte [ecx]
cwde
inc esp
mov ch, 0x8b
cmpsd dword [esi], dword es:[edi]
pushfd
insb byte es:[edi], dx
push ds
jb 0x10c1a094
xchg ebp, esi
jne 0x10c1a07e
mov ecx, 0x6b526779
jnp 0x10c1a0a0
out 0xb0, al
invalid
sbb edx, dword [esi + 0x64]
clc
sbb al, 0xec
mov al, 0x75
sub eax, 0xcd419928
cmp al, byte [ebx - 0x63]
int 0x3a
inc ebx
popfd
push ebp
je fcn.10c1a035
jb 0x10c1a0ee
cmp byte [eax + 0x7d], al
add dword [eax - 0x5803e9a0], esi
cwde
add bh, cl
imul esp, dword [ebp + 0x2e], 0x256d326
clc
in eax, dx
ficom dword [eax]
push edx
pop ebx
invalid
push ebx
das
cmp bl, byte [eax]
xor esi, edi
je 0x10c1a0ea
pop edi
xchg edi, eax
xchg ebx, eax
sal byte [ebx], 1
bound edx, qword [edi]
cmp al, 0xd6
mov ebp, dword [ebp - 0x3e]
je 0x10c1a156
mov edx, eax
retf
push edx
jno 0x10c1a06e
mov ch, 0xdf
ret 0x9431
ffreep st(2)
xor dword [ebx + 0x644f3e21], edx
cwde
or al, 0x83
and edi, dword [edi - 0x213a1722]
push cs
adc dword [eax + 0x3e], 0xdd166c4e
push eax
fxch st(2)
jg 0x10c1a175
call 0x91d07fc7
push eax
dec esi
insb byte es:[edi], dx
push ss
fst qword [eax - 0x27]
retf 0x687f
adc eax, 0x2b7b52a0
mov ecx, 0x5172a1e0
in al, dx
inc edi
push es
inc esp
xor dword [ebp - 0x624980bb], ebx
push ss
out dx, eax
xchg edi, eax
jbe 0x10c1a0c6
xor dword [esi], ecx
adc dword [eax - 0x42], 0x579bd89e
mov esi, 0x579bd89e
and dword [edi], edi
bnd js 0x10c1a0fd
xchg edi, eax
shr bl, 0x6b
push ebx
jae 0x10c1a12a
dec ebp
or eax, 0xd061a3a1
adc dword [ecx], esp
pop edi
das
js 0x10c1a128
aaa
hlt
xchg edi, eax
xchg esi, eax
adc byte [eax - 0x4d], 0xce
stc
xchg esi, eax
invalid
push eax
jle 0x10c1a18d
mov gs, edx
or ebx, dword [ebp - 0x4afcd099]
invalid
cmp eax, 0x724f8dd9
fild dword [edi - 0x34]
lcall 0x30d1, 0x3255ab99
mov bl, 0xa
mov esi, ebx
push eax
fsub qword [eax + 0x32]
sub ah, byte [eax]
inc esi
mov ecx, 0xc58753c8
or eax, 0x4f763575
sbb al, 0xdd
and dword [0x9fc1d364], eax
inc edx
pop edx
lahf
rcr byte [esi + 0x299ec45], 1
or edx, 0xe37e1156
div byte ds:[edx + 0x55]
int3

Function at 0x10c421ef
Capabilities:
Encode data using xor

Disassembly:
adc edi, edx
neg cx
inc cl
movzx eax, byte [ebp + eax - 0x2a004000]
movsx edx, cl
dec ecx
add dl, dh
lea ebp, [ebp + ecx - 0x6d2549c0]
call fcn.10cdea18
dec edx
ror edx, 1
bswap ecx
mov dword [esp + eax - 0x15002000], eax
not edx
xor ebx, edx
ror eax, cl
jae 0x1092a172
invalid
cmp edi, dword [esi - 0x4a]
xchg ebp, eax
mov fs, word [ebx + 0x20]
push edx
jne 0x10c421f9
sub eax, 0x628d75dd
invalid
Function at 0x10c61f78
Capabilities:
Execute syscall

Disassembly:
push 0x2a0e068b
mov dword [esp], ebx
mov ebx, 0x6593f090
and ebx, ebx
rol bx, 0xa5
movzx ebx, byte [edx + ebx - 0x6593121e]
call fcn.10ba7e3d
mov ebp, dword [ebp]
jno 0x10b48086
syscall
call fcn.10b30e8b
mov eax, 0x6b2a4a2b
xor eax, 0xa20b86b8
sar eax, 0xa9
sbb edi, 1
call fcn.1074b7f8
movzx edx, al
push edx
mov dword [esi + eax - 0xb95d], ecx
mov dword [esp + eax - 0xb95d], ebp
ret 0x14
jmp edi
pop ecx
jle fcn.10abd498
pop ecx
jbe fcn.10b7cdcb
call fcn.10726c68
mov cl, byte [ebp + ecx*2 - 0x6d4b9434]
call fcn.10bf2a71
mov eax, 0x102b7a1e
lea edi, [eax + edi - 0x102b7a22]
movsx edx, ax
shr ax, 0x21
mov edx, dword [edi + eax*4 - 0x40acf43c]
xor edx, ebx
sub ax, 0xcba7
ror eax, 0x98
sal al, 0x43
neg edx
inc edx
push eax
or dword [esp + eax - 0x2b716880], eax
ror edx, 2
lea edx, [edx + eax*8 - 0x7fed7bce]
and dword [esp + eax*2 - 0x56e2d100], eax
xor ebx, edx
add ebp, edx
mov edx, eax
jmp 0x10cd019e
not ecx
mov edx, 0x85021a93
call fcn.10a0d5bb
xor ecx, 0x4dba0ebc
inc ecx
push eax
not ecx
xor eax, 0x942c413a
xor ebx, ecx
add edi, ecx
mov ecx, esi
sub esi, 2
mov word [esi], cx
mov ecx, dword [esp + 4]
add ecx, 0xffd15109
jmp ecx
pop eax
movzx eax, byte [edi]
mov ecx, dword [esp]
xor al, bl
ror cx, 0x6c
dec al
not al
shr cx, 0x44
and ecx, ecx
inc al
sal dword [esp + ecx - 0x17], 0x4d
inc dword [esp + ecx - 0x17]
rol al, 1
xor bl, al
sar cl, 0xa7
lea eax, [esp + eax + 4]
mov dword [ecx + eax], edx
jbe 0x10c71e6f
mov eax, dword [ebp]
mov ecx, 0xc3a3941b
add ecx, 0x73023603
movzx edx, cl
mov edx, dword [ecx + ebp - 0x36a5ca1a]
jle 0x10972a21
jp 0x10c0cd1a
sal dword [esp + eax - 0x2b716880], 6
mov edx, dword [eax + esi - 0x2b716880]
mov eax, dword [esi + eax - 0x2b71687c]
adc esi, 4
xor ecx, ecx
test eax, eax
lea esp, [esp + 4]
je 0x10c429f7
jmp 0x10923b4b
Function at 0x10c634ea
Capabilities:
Encode data using xor

Disassembly:
movsx eax, cl
lea edi, [edi + eax*4 - 0xf6]
shr ecx, 0xf2
mov word [edi + ecx*4 - 0x4c24], dx
neg eax
pop edx
call fcn.10938cb4
dec al
push ecx
shl dword [esp + ecx*2 - 0x4c26414a], cl
jp 0x10ca47cc
mov cx, word [esi]
mov edx, 0x8b087e9e
movsx eax, dl
sar ax, 0x4d
mov ax, word [esi + 2]
lea edx, [edx + edx + 0x66b8d508]
sub edx, edx
lea edx, [edx*4 - 0x58e9e7e3]
adc esi, 2
call fcn.108252cb
add edi, 4
mov ecx, 0x13a328ad
xor edx, ebx
call fcn.108c4d81
xor al, 0x33
dec byte [esp + ecx - 0x261320a2]
dec cx
not al
inc ecx
sub al, 0x91
dec word [esp + ecx - 0x261320a3]
ror al, 1
mov dword [esp + ecx*2 - 0x4c26414a], 0x533b591b
add ecx, ecx
mov dword [esp + edx*8 - 0x10520], edx
xor bl, al
xor dword [esp + edx*2 - 0x414a], edx
mov dword [esp + ecx - 0x4c264146], 0xd18f4c92
neg word [esp + edx - 0x20a4]
lea eax, [esp + eax + 0xc]
sar dword [esp + edx*2 - 0x4142], cl
mov dx, word [eax + ecx - 0x4c26414a]
pushfd
adc al, 0x5c
invalid
mov esi, 0x66ffffbe
mov edx, dword [eax + ecx - 0x4c26414a]
sub cx, 0xb60d
jnp 0x10befe77
mov ecx, 0xfeba2a18
lea edx, [ecx + ecx*8 + 0x4224101f]
mov eax, ecx
mov edx, dword [ebp + edx*2 - 0x6d5f15ee]
ror cl, 0x86
call fcn.10c4ddf0
adc dword [ebp - 0x16d7b52a], esp
stosd dword es:[edi], eax
dec eax
unpckhps xmm0, xmmword [ecx + 0x63ad4faf]
or byte [esi + 0x73], bl
mov ecx, 0xd4e981d0
push 0x774c9284
add bh, bh
jae 0x10ca481e
rol byte [ecx - 0x7b972b17], 1
xchg edx, eax
dec esp
ja 0x10ca486f
test byte [edx - 0xff88b4], dl
call [eax - 0x1b3a8444]
cmpsd dword [esi], dword es:[edi]
cwde
mov esp, 0xa7e4c57b
dec ebp
sbb byte [ecx], al
cmp byte [esi], bl
push ss
xor edi, ebx
jle 0x10ca4863
jle 0x10ca486a
xor dword [edx - 0x483af770], edi
ja 0x10ca4811
pop es
in al, dx
mov esp, 0x98654c37
or byte [edi - 0x51a4f96f], bh
or eax, 0xf5944a20
clc
mov ch, 0xd6
int 0xe1
sbb ebp, dword [ecx - 0x5a5b2d4c]
dec esi
add byte [edi - 0x56], cl
inc ebp
ret

Function at 0x10c76d31
Capabilities:
Execute syscall

Disassembly:
mov dword [esp], 0x5414f802
adc esi, edx
shr cx, cl
pop ecx
jne fcn.10bff091
syscall
call fcn.10773afc

Function at 0x10c7a84c
Capabilities:
Execute syscall

Disassembly:
not ecx
rol ecx, 1
call fcn.10cdd1ed
mov edx, dword [ebp]
call fcn.108f9429
not ecx
sal edx, 6
neg ecx
and byte [esp + edx - 0x7c4247d], dl
jno 0x108ffd8f
mov ecx, 0xda19af11
movsx edx, cl
mov ax, word [edx + ebp - 0x11]
neg dx
lea ebp, [ebp + edx - 0xffed]
sar cx, 0x69
movzx ecx, byte [edx + edi - 0xffef]
lea edi, [edi + edx*2 - 0x1ffdd]
xor cl, bl
add edx, 0xbdb8902c
sub dx, dx
xor edx, edx
neg cl
sar edx, 0xd8
dec cl
shr dl, 0x46
jns 0x10ba02ac

Function at 0x10c83bb9
Capabilities:
Encode data using xor

Disassembly:
call fcn.1077a0f3
mov edx, 0xf694cfa9
mov ecx, dword [ebp]
mov al, byte [ebp + 4]
shr edx, 0xd7
sar edx, 0xec
rol edx, 0x77
lea ebp, [ebp + edx*2 + 6]
and edx, edx
xor dx, 0xb5a2
invalid
invalid
invalid
Function at 0x10c99422
Capabilities:
Manually build aes constants

Disassembly:
lea edx, [edx + ecx*8 + 0x66ecc102]
adc dword [esp + ecx - 0xfc2e800], 0x59325db2
not edx
pop eax
inc cl
dec edx
lea eax, [eax*2 + 0x54299b2f]
ror edx, cl
xor ebx, edx
add edi, edx
push ecx
pop edx
jmp fcn.10ca43a0
dec ecx
xadd dword [esp + eax - 0x2dba56ff], ecx
ror edx, 3
sal eax, 6
sar cx, 0xed
lea edx, [edx + eax*2 + 0x20930800]
jnp 0x10a00d37
sub byte [esp + eax - 0x6e95bfbe], cl
xor edx, 0xaa1d8fbd
sal word [esp + eax - 0x6e95bfc0], 0x26
ror ecx, cl
bswap edx
ror edx, 1
pop ecx
xor ebx, edx
ror cx, 0x25
adc edi, edx
sub ecx, ecx
xor ecx, edi
jmp ecx
adc byte [esp + ecx*8 - 0x3c1f85ce], 0x94
lea esi, [esi + ecx - 0x783f0be]
mov edx, dword [esi + ecx*4 - 0x1e0fc2e8]
shl ecx, 0x8a
je 0x10afaa38
xor edx, ebx
ror edx, 3
ror dword [esp + ecx - 0xfc2e800], 0xa2
jb 0x10955382
mov word [ebp], ax
mov edx, dword [edi]
mov eax, 0xa5b02b89
dec dword [esp]
add edi, 4
lea ecx, [eax + eax + 0x7501c8b2]
xor edx, ebx
jmp 0x10cf1aa3
add esi, 4
shrd dx, ax, cl
mov word [esi], dx
call fcn.10b5d263
mov ecx, 0x783f4817
lea eax, [ecx*4 - 0x27dab358]
movzx edx, al
rdtsc
push ecx
lea ebp, [ebp + ecx - 0x783f481f]
ror cx, 0x69
sar ecx, cl
mov dword [ebp + ecx*8 - 0x3c1f85cc], eax
mov dword [ebp + ecx - 0x783f0ba], edx
jne 0x10c92424
shr cx, 0x24
and dword [esp], eax
bswap edx
call fcn.1075ffb8
not edx
ror dword [esp + ecx - 0x20b4092], 0x14
mov dword [esp + ecx*2 - 0x416812c], ecx
inc edx
call fcn.10b4ebbb

Function at 0x10ca0a71
Capabilities:
Encode data using xor

Disassembly:
add edi, edx
shl cl, 0xc3
movzx edx, byte [esi + ecx*2 - 0x15ca0]
sal cx, 0x66
sub ax, 0x28bd
bswap ecx
lea esi, [esi + ecx - 0x93ffff]
xor dl, bl
jmp 0x10c163c7
lea esp, [esp + 8]
je 0x10ca0ac2
push ebx
mov ebx, 0x461a0a0d
xor ebx, ebx
sbb ebx, ebx
or bl, byte [ecx + ebx*2]
push 0xe7b43c2a
push 0x540ae
xor ebx, edx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x107d6700]
shr edx, 8
neg dword [esp + 4]
xor edx, ebx
inc ecx
xor edx, 0x29344287
dec eax
lea esp, [esp + 8]
jne 0x10ca0a7c
mov ebx, 0xb688332f
pop ebx
mov ecx, 0x901ea915
not edx
mov dword [ebp], edx
call fcn.10748a2e
mov eax, 0xf08bae2a
bswap edx
movzx ecx, ax
dec edx
xor ebx, edx
inc ax
jl 0x10a76748
mov eax, dword [edi]
add edi, 4
jmp 0x109cf453

Function at 0x10cbb534
Capabilities:
Encode data using xor

Disassembly:
ror cx, 1
shr byte [esp + edx - 0xff735fb], 0x22
bswap eax
xor cx, 0x20af
pop eax
rol cx, 1
movsx eax, byte [esp + edx*2 - 0x1fee6c00]
add cx, 0x7530
not cx
inc al
neg cx
lea edx, [edx + edx*8 - 0x3e4202cf]
call fcn.10761409
mov edx, 0x2a53e8a
lea edi, [edx + edi - 0x2a53e8e]
mov edx, dword [edx + edi - 0x2a53e8a]
mov eax, 0xa23d94b9
rol eax, 0xdd
xor edx, ebx
lea eax, [eax + 0x20800922]
inc edx
ror eax, 1
jb 0x10b98cdd