joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe4993a
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xae
push dword [esp]
sub dword [esp], 0xad
push dword [esp]
xchg dword [esp], esi
mov esi, dword [esi]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xe49964
mov ecx, 0x7be
xor eax, eax
je 0xe49969
call 0x1734f20a
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xe4997c
mov ecx, 0x7be
xor eax, eax
je 0xe49981
call 0xed67f222
and al, 0xc7
inc esp
and al, 0x20
sub eax, 0x44c79ae4
and al, 0x1c
jb 0xe49994
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0x9ae42d64
mov dword [esp + 0x1c], 0x20072
add al, byte [eax]
mov dword [esp + 0x18], ecx
mov ecx, 0xe49908
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ecx
nop
xor ecx, ecx
nop
mov edx, dword [esp + 0x20]
mov edx, dword [edx]
xor ecx, edx
nop
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
nop
jne 0xe499ab
xchg ebp, ebp
mov edx, dword [esp + 0x14]
add esi, ecx
mov ecx, dword [esp + 0x18]
add esp, 0x24
nop
xchg dword [esp], esi
mov dword [esp + 4], 0x510004c2
jmp 0xe499d8
ret 4

Function at 0xf533ed
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xaa
push dword [esp]
sub dword [esp], 0xa7
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xf53417
mov ecx, 0x7be
xor eax, eax
je 0xf5341c
call 0x17458cbd
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xf5342f
add dword [ebp + eax - 0x47], esi
mov esi, 0x33000007
sal byte [ecx + eax - 0x18], 0x9d
mov ecx, 0x7be
xor eax, eax
je 0xf53434
call 0xed788cd5
and al, 0xc7
inc esp
and al, 0x20
loopne 0xf53427
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0x86c1e8e0
mov dword [esp + 0x1c], 0x20071
mov dword [esp + 0x18], edx
mov edx, 0xf533bc
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], edx
rol dword [esi + 0x1c2444c7], 0x71
add byte [edx], al
add byte [ecx - 0x45e7dbac], cl
mov esp, 0x8900f533
jl 0xf53479
adc al, 0x89
push esp
and al, 0x20
nop
xor edx, edx
mov edi, dword [esp + 0x20]
mov edi, dword [edi]
xor edx, edi
add dword [esp + 0x20], 4
nop
dec word [esp + 0x1c]
jne 0xf5345d
lea eax, [eax]
mov edi, dword [esp + 0x14]
nop
add ebx, edx
mov edx, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], ebx
mov dword [esp + 4], 0x650004c2
jmp 0xf53489
ret 4
Function at 0xf733a0
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xa9
push dword [esp]
sub dword [esp], 0xa6
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xf733ca
mov ecx, 0x7be
xor eax, eax
je 0xf733cf
call 0x17478c70
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xf733e2
mov ecx, 0x7be
xor eax, eax
je 0xf733e7
call 0xed7a8c88
sbb bh, al
inc esp
and al, 0x14
imul eax, dword [eax - 0x13], 0xffffff8d
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0x8ded406b
mov dword [esp + 0x10], 0x2003e
mov dword [esp + 0xc], ebp
mov ebp, fcn.00f73370
mov dword [esp + 8], esi
xchg edi, edi
mov dword [esp + 0x14], ebp
xor ebp, ebp
mov esi, dword [esp + 0x14]
mov esi, dword [esi]
xor ebp, esi
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0xf73411
nop
mov esi, dword [esp + 8]
add edx, ebp
mov ebp, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], edx
mov dword [esp + 4], 0x310004c2
jmp 0xf7343a
ret 4

Function at 0xf73538
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xb3
push dword [esp]
sub dword [esp], 0xb0
push dword [esp]
xchg dword [esp], esi
mov esi, dword [esi]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xf73562
mov ecx, 0x7be
xor eax, eax
je 0xf73567
call 0x17478e08
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xf7357a
mov ecx, 0x7be
xor eax, eax
je 0xf7357f
call 0xed7a8e20
and bh, al
inc esp
and al, 0x1c
dec ecx
imul ebp, dword [ebx], 0x34
popfd
pop eax
sub esp, 0x20
mov dword [esp + 0x1c], 0x342b6b49
mov dword [esp + 0x18], 0x20063
mov dword [esp + 0x14], edx
mov edx, 0xf73508
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx]
nop
xor edx, ecx
mov eax, eax
add dword [esp + 0x1c], 4
xchg ebx, ebx
dec word [esp + 0x18]
mov ebx, ebx
jne 0xf735a7
lea edi, [edi]
mov ecx, dword [esp + 0x10]
xchg esi, esi
add esi, edx
mov edx, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], esi
mov dword [esp + 4], 0x1b0004c2
jmp 0xf735da
ret 4
Function at 0x101721d
Capabilities:
Encode data using xor

Disassembly:
jl 0x10171cd
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], 0x3cc
xor dword [esp], 0x35c
sub esp, dword [esp]
push 8
mov eax, 0xfffa7723
mov eax, dword [eax + ebp + 0x588e5]
sub esp, 4
mov dword [esp], eax
mov ecx, 0xfffa62e3
lea ecx, [ecx + ebp + 0x59d15]
sub esp, 4
mov dword [esp], ecx
call 0x1017173
rcl byte [esi - 0x55feea5a], cl
add dword [esp], 0x31
push dword [esp]
sub dword [esp], 0x30
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
add eax, 0x9ca
xchg dword [esp], eax
mov dword [esp + 4], 0xab0004c2
jmp 0x1017198
ret 4
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], 0x1f
xor dword [esp], 0x8f
sub esp, dword [esp]
push 8
mov eax, 0xfff84ee3
mov eax, dword [eax + ebp + 0x7b125]
sub esp, 4
mov dword [esp], eax
mov ecx, 0xfff4318d
lea ecx, [ecx + ebp + 0xbce6b]
sub esp, 4
mov dword [esp], ecx
call 0x101721d
mov esi, 0x159c190f
add dword [0x4813596], edi
and al, 0xaf
add byte [eax], al
add bh, bh
xor al, 0x24
sub dword [esp], 0xad
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1017247
mov ecx, 0x7be
xor eax, eax
je 0x101724c
call 0x1751caed
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x101725f
mov ecx, 0x7be
xor eax, eax
je 0x1017264
call 0xed84cb05
sbb bh, al
inc esp
and al, 0x14
salc
movsd dword es:[edi], dword [esi]
mov dl, cl
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0xca88a5d6
mov dword [esp + 0x10], 0x2004e
mov dword [esp + 0xc], ebp
mov ebp, 0x10171ec
mov dword [esp + 8], eax
nop
mov dword [esp + 0x14], ebp
xor ebp, ebp
mov eax, dword [esp + 0x14]
nop
mov eax, dword [eax]
mov ebx, ebx
xor ebp, eax
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x101728d
nop
mov eax, dword [esp + 8]
xchg ebx, ebx
add ecx, ebp
mov ebp, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], ecx
mov dword [esp + 4], 0xe70004c2
jmp 0x10172bb
ret 4
Function at 0x10245e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x12c0fe6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov ecx, 0xc
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00e3bc00
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 0x64
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00e3bc00
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
add edx, 0x98
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x98
call fcn.00e3bc00
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
add eax, 0xcc
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xcc
call fcn.00e3bc00
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 8]
add ecx, 0x100
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x100
call fcn.00e3bc00
mov byte [ebp - 4], 4
mov edx, dword [ebp + 8]
add edx, 0x134
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x134
call fcn.00e3bc00
mov byte [ebp - 4], 5
mov eax, dword [ebp + 8]
add eax, 0x168
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x168
call fcn.00e3bc00
mov byte [ebp - 4], 6
mov ecx, dword [ebp + 8]
add ecx, 0x19c
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x19c
call fcn.00e3bc00
mov byte [ebp - 4], 7
mov edx, dword [ebp + 8]
add edx, 0x1d0
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x1d0
call fcn.00e3bc00
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0x204
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x204
call fcn.00e3bc00
mov byte [ebp - 4], 9
mov ecx, dword [ebp + 8]
add ecx, 0x238
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x238
call fcn.00e3bed0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1080a30
Capabilities:
Encode data using xor

Disassembly:
and al, 4
add dword [esp], 0xa6
push dword [esp]
and al, 0xa6
add byte [eax], al
add bh, bh
xor al, 0x24
sub dword [esp], 0xa4
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1080a5a
mov ecx, 0x7be
xor eax, eax
je 0x1080a5f
call 0x17586300
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1080a72
mov ecx, 0x7be
xor eax, eax
je 0x1080a77
call 0xed8b6318
sbb bh, al
inc esp
and al, 0x14
loopne 0x1080a04
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0xae7982e0
jns 0x1080a32
mov dword [esp + 0x10], 0x20045
mov dword [esp + 0xc], edx
mov edx, 0x1080a00
mov dword [esp + 8], ecx
mov dword [esp + 0x14], edx
xor edx, edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
xor edx, ecx
nop
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x1080a9f
mov ecx, dword [esp + 8]
add ebx, edx
mov edx, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], ebx
mov dword [esp + 4], 0xe50004c2
jmp 0x1080ac8
ret 4

Function at 0x1080af0
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xac
push dword [esp]
sub dword [esp], 0xab
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1080b1a
mov ecx, 0x7be
xor eax, eax
je 0x1080b1f
call 0x175863c0
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1080b32
mov ecx, 0x7be
xor eax, eax
je 0x1080b37
call 0xed8b63d8
sbb al, 0xc7
inc esp
and al, 0x18
pop edi
adc dh, byte [ebx]
push ecx
popfd
pop eax
sub esp, 0x1c
mov dword [esp + 0x18], 0x5133125f
mov dword [esp + 0x14], 0x20062
mov dword [esp + 0x10], eax
mov eax, 0x1080ac0
mov dword [esp + 0xc], edi
nop
mov dword [esp + 0x18], eax
xor eax, eax
nop
mov edi, dword [esp + 0x18]
mov edi, dword [edi]
xor eax, edi
add dword [esp + 0x18], 4
nop
dec word [esp + 0x14]
jne 0x1080b60
mov edi, dword [esp + 0xc]
add ecx, eax
mov eax, dword [esp + 0x10]
lea ebx, [ebx]
add esp, 0x1c
mov eax, eax
xchg dword [esp], ecx
mov dword [esp + 4], 0x50004c2
jmp 0x1080b8e
ret 4
Function at 0x1080bb9
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xb0
push dword [esp]
sub dword [esp], 0xae
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1080be3
mov ecx, 0x7be
xor eax, eax
je 0x1080be8
call 0x17586489
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1080bfb
mov ecx, 0x7be
xor eax, eax
je 0x1080c00
call 0xed8b64a1
and al, 0xc7
inc esp
and al, 0x20
aaa
leave
mov ebp, 0x2444c78a
sbb al, 0x7d
add byte [edx], al
add byte [ecx - 0x44e7dba4], cl
mov byte [ebx], cl
or byte [ecx], al
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0x8abdc937
mov dword [esp + 0x1c], 0x2007d
mov dword [esp + 0x18], ebx
mov ebx, 0x1080b88
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
xor ebx, ebx
nop
lea ebp, [ebp]
mov edx, dword [esp + 0x20]
nop
mov edx, dword [edx]
xor ebx, edx
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
lea ebp, [ebp]
jne 0x1080c29
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
nop
add edi, ebx
mov ebx, dword [esp + 0x18]
nop
add esp, 0x24
xchg dword [esp], edi
mov dword [esp + 4], 0x510004c2
jmp 0x1080c5c
ret 4

Function at 0x1080dc2
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xad
push dword [esp]
sub dword [esp], 0xaa
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1080dec
mov ecx, 0x7be
xor eax, eax
je 0x1080df1
call 0x17586692
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1080e04
mov ecx, 0x7be
xor eax, eax
je 0x1080e09
call 0xed8b66aa
sbb al, 0xc7
inc esp
and al, 0x18
xor bl, byte [esi - 0x40]
adc eax, edi
inc esp
and al, 0x14
ja 0x1080e1c
popfd
pop eax
sub esp, 0x1c
mov dword [esp + 0x18], 0x13c05e32
mov dword [esp + 0x14], 0x20077
add al, byte [eax]
mov dword [esp + 0x10], esi
mov esi, 0x1080d90
mov dword [esp + 0xc], ecx
nop
mov dword [esp + 0x18], esi
xor esi, esi
nop
mov ecx, dword [esp + 0x18]
nop
mov ecx, dword [ecx]
xor esi, ecx
lea edi, [edi]
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x1080e33
mov ecx, dword [esp + 0xc]
add eax, esi
mov esi, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], eax
mov dword [esp + 4], 0x450004c2
jmp 0x1080e5e
ret 4
Function at 0x1080e89
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xae
push dword [esp]
sub dword [esp], 0xac
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1080eb3
mov ecx, 0x7be
xor eax, eax
je 0x1080eb8
call 0x17586759
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1080ecb
mov ecx, 0x7be
xor eax, eax
je 0x1080ed0
call 0xed8b6771
and bh, al
inc esp
and al, 0x1c
and byte [ebx - 0x1c], ah
adc eax, edi
inc esp
and al, 0x18
push ebp
add byte [edx], al
add byte [ecx - 0x46ebdbb4], cl
pop eax
push cs
or byte [ecx], al
popfd
pop eax
sub esp, 0x20
mov dword [esp + 0x1c], 0x13e46320
mov dword [esp + 0x18], 0x20055
mov dword [esp + 0x14], ecx
mov ecx, 0x1080e58
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ecx
mov edx, edx
xor ecx, ecx
nop
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
xor ecx, edi
add dword [esp + 0x1c], 4
lea edi, [edi]
dec word [esp + 0x18]
nop
jne 0x1080efb
nop
mov edi, dword [esp + 0x10]
add eax, ecx
mov ecx, dword [esp + 0x14]
add esp, 0x20
nop
xchg dword [esp], eax
mov dword [esp + 4], 0x390004c2
jmp 0x1080f28
ret 4

Function at 0x1081115
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xae
push dword [esp]
sub dword [esp], 0xac
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x108113f
mov ecx, 0x7be
xor eax, eax
je 0x1081144
call 0x175869e5
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081157
mov ecx, 0x7be
xor eax, eax
je 0x108115c
call 0xed8b69fd
and bh, al
inc esp
and al, 0x1c
push esp
lcall 0x1824, 0x44c77df3
insb byte es:[edi], dx
add byte [edx], al
add byte [ecx - 0x40ebdb84], cl
in al, 0x10
or byte [ecx], al
popfd
pop eax
sub esp, 0x20
mov dword [esp + 0x1c], 0x7df39a54
mov dword [esp + 0x18], 0x2006c
mov dword [esp + 0x14], edi
mov edi, 0x10810e4
mov dword [esp + 0x10], edx
nop
mov dword [esp + 0x1c], edi
xor edi, edi
mov edx, dword [esp + 0x1c]
lea esi, [esi]
mov edx, dword [edx]
xor edi, edx
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x1081185
xchg edi, edi
mov edx, dword [esp + 0x10]
xchg ebp, ebp
add ebx, edi
mov edi, dword [esp + 0x14]
nop
add esp, 0x20
xchg dword [esp], ebx
mov dword [esp + 4], 0x440004c2
jmp 0x10811b4
ret 4
Function at 0x10811e0
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xa6
push dword [esp]
sub dword [esp], 0xa5
push dword [esp]
xchg dword [esp], esi
mov esi, dword [esi]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x108120a
mov ecx, 0x7be
xor eax, eax
je 0x108120f
call 0x17586ab0
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081222
mov ecx, 0x7be
xor eax, eax
je 0x1081227
call 0xed8b6ac8
adc al, 0xc7
inc esp
and al, 0x10
or bl, byte [eax + 0x44c7a5d8]
and al, 0xc
cmp eax, 0x89000200
dec esp
and al, 8
popfd
pop eax
sub esp, 0x14
mov dword [esp + 0x10], 0xa5d8980a
mov dword [esp + 0xc], 0x2003d
mov dword [esp + 8], ecx
mov ecx, 0x10811b0
mov dword [esp + 4], eax
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
xor ecx, eax
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x108124f
mov eax, dword [esp + 4]
add esi, ecx
mov ecx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], esi
mov dword [esp + 4], 0xfd0004c2
jmp 0x1081277
ret 4

Function at 0x10813d0
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xac
push dword [esp]
sub dword [esp], 0xa9
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10813fa
mov ecx, 0x7be
xor eax, eax
je 0x10813ff
call 0x17586ca0
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081412
mov ecx, 0x7be
xor eax, eax
je 0x1081417
call 0xed8b6cb8
sbb bh, al
inc esp
and al, 0x14
or ebp, ebp
push edx
mov dword ss:[esp + 0x10], 0x20066
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0x3652ed0b
mov dword [esp + 0x10], 0x20066
mov dword [esp + 0xc], esi
mov esi, 0x10813a0
mov dword [esp + 8], edx
mov dword [esp + 0x14], esi
xor esi, esi
nop
mov edx, dword [esp + 0x14]
nop
mov edx, dword [edx]
xor esi, edx
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x1081440
mov edx, dword [esp + 8]
nop
add eax, esi
nop
mov esi, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], eax
mov dword [esp + 4], 0x570004c2
jmp 0x108146b
ret 4
Function at 0x1081496
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xae
push dword [esp]
sub dword [esp], 0xac
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10814c0
mov ecx, 0x7be
xor eax, eax
je 0x10814c5
call 0x17586d66
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10814d8
mov ecx, 0x7be
xor eax, eax
je 0x10814dd
call 0xed8b6d7e
sbb al, 0xc7
inc esp
and al, 0x18
test eax, 0xc7381f1c
inc esp
and al, 0x14
jno 0x10814f0
popfd
pop eax
sub esp, 0x1c
mov dword [esp + 0x18], 0x381f1ca9
mov dword [esp + 0x14], 0x20071
add al, byte [eax]
mov dword [esp + 0x10], esi
mov esi, 0x1081464
mov dword [esp + 0xc], ebp
nop
mov dword [esp + 0x18], esi
xor esi, esi
xchg edx, edx
mov ebp, dword [esp + 0x18]
nop
mov ebp, dword [ebp]
xor esi, ebp
add dword [esp + 0x18], 4
nop
dec word [esp + 0x14]
jne 0x1081508
mov ebp, dword [esp + 0xc]
add eax, esi
nop
mov esi, dword [esp + 0x10]
add esp, 0x1c
mov eax, eax
xchg dword [esp], eax
mov dword [esp + 4], 0xa80004c2
jmp 0x1081536
ret 4

Function at 0x10815af
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xb1
push dword [esp]
sub dword [esp], 0xae
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10815da
mov ecx, 0x7be
xor eax, eax
je 0x10815df
call 0x17586e80
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10815f2
mov ecx, 0x7be
xor eax, eax
je 0x10815f7
call 0xed8b6e98
sbb bh, al
inc esp
and al, 0x14
wait
invalid
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0xaeefc59b
mov dword [esp + 0x10], 0x20072
mov dword [esp + 0xc], edi
mov edi, 0x108157c
mov dword [esp + 8], esi
mov dword [esp + 0x14], edi
xor edi, edi
nop
mov esi, dword [esp + 0x14]
lea ebp, [ebp]
mov esi, dword [esi]
mov ecx, ecx
xor edi, esi
add dword [esp + 0x14], 4
dec word [esp + 0x10]
lea eax, [eax]
jne 0x108161f
mov esi, dword [esp + 8]
add ebp, edi
nop
mov edi, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], ebp
mov dword [esp + 4], 0x560004c2
jmp 0x1081650
ret 4
Function at 0x108178a
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xad
push dword [esp]
sub dword [esp], 0xab
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10817b5
mov ecx, 0x7be
xor eax, eax
je 0x10817ba
call 0x1758705b
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10817cd
mov ecx, 0x7be
xor eax, eax
je 0x10817d2
call 0xed8b7073
and al, 0xc7
inc esp
and al, 0x20
test byte [edi + 0x44c7aa04], bl
and al, 0x1c
add byte [bp + si], al
add byte [ecx - 0x44e7dba4], cl
pop eax
pop ss
or byte [ecx], al
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0xaa049f84
mov dword [esp + 0x1c], 0x20067
mov dword [esp + 0x18], ebx
mov ebx, 0x1081758
mov dword [esp + 0x14], edx
mov eax, eax
mov dword [esp + 0x20], ebx
xor ebx, ebx
mov edx, dword [esp + 0x20]
mov edx, dword [edx]
xor ebx, edx
nop
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
nop
jne 0x10817fc
mov edx, dword [esp + 0x14]
add ebp, ebx
mov ebx, dword [esp + 0x18]
nop
add esp, 0x24
xchg dword [esp], ebp
mov dword [esp + 4], 0x710004c2
jmp 0x1081827
ret 4

Function at 0x108191d
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xa9
push dword [esp]
sub dword [esp], 0xa7
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081947
mov ecx, 0x7be
xor eax, eax
je 0x108194c
call 0x175871ed
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x108195f
mov ecx, 0x7be
xor eax, eax
je 0x1081964
call 0xed8b7205
and bh, al
inc esp
and al, 0x1c
fxch st(6)
loope 0x1081939
popfd
pop eax
sub esp, 0x20
mov dword [esp + 0x1c], 0xe165ced9
mov dword [esp + 0x18], 0x2003b
inc esp
and al, 0x18
cmp eax, dword [eax]
add al, byte [eax]
mov dword [esp + 0x14], ecx
mov ecx, 0x10818ec
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov ebx, dword [esp + 0x1c]
mov ebx, dword [ebx]
xor ecx, ebx
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x108198c
mov ebx, dword [esp + 0x10]
add edx, ecx
nop
mov ecx, dword [esp + 0x14]
mov ebx, ebx
add esp, 0x20
nop
xchg dword [esp], edx
mov dword [esp + 4], 0x360004c2
jmp 0x10819b8
ret 4
Function at 0x10819e3
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xae
push dword [esp]
sub dword [esp], 0xac
push dword [esp]
xchg dword [esp], esi
mov esi, dword [esi]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081a0d
mov ecx, 0x7be
xor eax, eax
je 0x1081a12
call 0x175872b3
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081a25
mov ecx, 0x7be
xor eax, eax
je 0x1081a2a
call 0xed8b72cb
sbb bh, al
inc esp
and al, 0x14
and eax, 0xc7912467
inc esp
and al, 0x10
cmp eax, 0x89000200
inc esp
and al, 0xc
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0x91246725
mov dword [esp + 0x10], 0x2003d
mov dword [esp + 0xc], eax
mov eax, 0x10819b0
mov dword [esp + 8], ebp
mov dword [esp + 0x14], eax
xor eax, eax
xchg esi, esi
mov ebp, dword [esp + 0x14]
mov ebp, dword [ebp]
xor eax, ebp
add dword [esp + 0x14], 4
dec word [esp + 0x10]
nop
jne 0x1081a54
nop
mov ebp, dword [esp + 8]
add esi, eax
mov eax, dword [esp + 0xc]
nop
add esp, 0x18
nop
xchg dword [esp], esi
mov dword [esp + 4], 0x440004c2
jmp 0x1081a81
ret 4

Function at 0x1081aae
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xaa
push dword [esp]
sub dword [esp], 0xa7
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081ad8
mov ecx, 0x7be
xor eax, eax
je 0x1081add
call 0x1758737e
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081af0
mov ecx, 0x7be
xor eax, eax
je 0x1081af5
call 0xed8b7396
and al, 0xc7
inc esp
and al, 0x20
cwde
mul byte [ebp + 0x2444c7ea]
sbb al, 0x50
add byte [edx], al
add byte [ecx - 0x41e7db8c], cl
jl 0x1081b2b
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0xeaa5f698
mov dword [esp + 0x1c], 0x20050
mov dword [esp + 0x18], esi
mov esi, 0x1081a7c
or byte [ecx], al
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], esi
xor esi, esi
nop
nop
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx]
xor esi, ecx
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
add al, 0x66
dec dword [esp + 0x1c]
jne 0x1081b1e
mov ecx, ecx
mov ecx, dword [esp + 0x14]
add edx, esi
mov esi, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], edx
mov dword [esp + 4], 0xfc0004c2
jmp 0x1081b49
ret 4