joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024138
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and dword [0x1002cc34], 0
sub esp, 0x10
mov edx, 0x104
xor al, al
mov ecx, edx
push esi
push edi
mov edi, 0x1002cb30
mov esi, 0x1002cc38
rep stosb byte es:[edi], al
mov ecx, edx
mov edi, esi
mov edx, dword [ebp + 8]
rep stosb byte es:[edi], al
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10024168
sub edx, ecx
mov ecx, edx
mov dword [ebp - 0x10], edx
mov eax, edx
and ecx, 3
sub eax, ecx
shr eax, 2
test ecx, ecx
lea edx, [eax + 1]
cmove edx, eax
mov dword [ebp - 8], edx
call fcn.100242f2
mov edx, dword [ebp - 0x10]
xor edi, edi
mov ecx, dword [0x1002cc34]
movzx eax, al
mov dword [ebp - 4], eax
movzx eax, dl
shl eax, 0x10
or ecx, eax
mov eax, dword [ebp - 8]
movzx eax, al
shl eax, 8
or ecx, eax
mov eax, dword [ebp - 4]
movzx eax, al
or ecx, eax
mov dword [0x1002cc34], ecx
cmp dword [ebp - 8], edi
jbe 0x10024217
mov eax, dword [ebp + 8]
and dword [ebp - 0xc], 0
cmp edi, edx
jae 0x100241d8
mov cl, byte [edi + eax]
inc edi
jmp 0x100241da
xor cl, cl
movsx edx, cl
xor edx, dword [ebp - 4]
push 3
and edx, 0xff
pop ecx
sub ecx, dword [ebp - 0xc]
shl ecx, 3
shl edx, cl
or dword [esi], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
inc ecx
and ecx, 0xff
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, 4
jb 0x100241ce
add esi, 4
dec dword [ebp - 8]
jne 0x100241ca
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1002421f
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, ecx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002422b
sub ecx, esi
jne 0x100242ad
and dword [ebp - 4], ecx
xor esi, esi
push ebx
movzx ebx, byte [edx + 0x104]
mov dword [ebp - 8], esi
cmp byte [edx + 0x105], cl
jbe 0x100242a1
push edi
lea edi, [edx + 0x108]
mov dword [ebp - 0xc], edi
mov eax, dword [edi]
xor esi, esi
mov edi, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 3
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
xor al, bl
mov byte [edi + edx], al
inc edi
mov eax, dword [ebp - 0x10]
inc ebx
and ebx, 0xff
inc esi
cmp esi, 4
jb 0x10024262
mov esi, dword [ebp - 8]
movzx eax, byte [edx + 0x105]
inc esi
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
add edi, 4
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
cmp esi, eax
jb 0x10024258
pop edi
movzx eax, byte [edx + 0x106]
pop ebx
mov byte [eax + edx], 0
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x100242f2
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [0x100270b4]
cmp esi, 0x270
jl 0x100243d2
cmp esi, 0x271
jne 0x1002431b
rdtsc
and eax, 0xffff
mov ecx, eax
call fcn.100242c7
xor esi, esi
mov edx, esi
mov ecx, dword [edx*4 + 0x1002aa44]
xor ecx, dword [edx*4 + 0x1002aa40]
and ecx, 0x7fffffff
xor ecx, dword [edx*4 + 0x1002aa40]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x1002909c]
xor ecx, dword [edx*4 + 0x1002b074]
mov dword [edx*4 + 0x1002aa40], ecx
inc edx
cmp edx, 0xe3
jl 0x1002431f
cmp edx, 0x26f
jge 0x100243a0
push edi
lea edi, [edx*4 + 0x1002aa40]
mov ecx, dword [edi]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x1002909c]
xor eax, dword [edi - 0x38c]
xor eax, ecx
mov dword [edi], eax
add edi, 4
cmp edi, 0x1002b3fc
jl 0x1002436f
pop edi
mov ecx, dword [0x1002aa40]
xor ecx, dword [0x1002b3fc]
and ecx, 0x7fffffff
xor ecx, dword [0x1002b3fc]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x1002909c]
xor ecx, dword [0x1002b070]
mov dword [0x1002b3fc], ecx
mov ecx, dword [esi*4 + 0x1002aa40]
mov eax, ecx
shr eax, 0xb
inc esi
xor ecx, eax
mov dword [0x100270b4], esi
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
ret

Function at 0x1002554d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 0x10]
test edi, edi
je 0x100255b2
movzx eax, word [edi + 0x14]
lea ecx, [edi + 0x18]
add ecx, eax
movzx eax, word [edi + 6]
imul eax, eax, 0x28
mov esi, ecx
mov dword [ebp - 8], ecx
add eax, ecx
cmp ecx, eax
jae 0x100255b2
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002557e
sub ecx, edx
push ecx
push ecx
mov eax, esp
lea ecx, [ebp - 4]
mov dword [eax], esi
call fcn.1001c162
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
cmp dword [ebp + 8], eax
je 0x100255b4
movzx eax, word [edi + 6]
add esi, 0x28
imul eax, eax, 0x28
add eax, dword [ebp - 8]
cmp esi, eax
jb 0x10025579
xor esi, esi
lea eax, [ebp + 8]
lea ecx, [ebx + 4]
push eax
call fcn.10023e0a
test esi, esi
je 0x100255da
mov ecx, dword [esi + 0xc]
add ecx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x100255e7
mov ecx, dword [esi + 0x10]
jmp 0x100255e7
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100256b9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x100256db
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100256db
movzx ecx, word [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
je 0x100256dd
xor ecx, ecx
mov eax, ecx
pop ebp
ret
Function at 0x100256e1
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
xor al, al
mov dword [esp + 0x14], edx
mov ebx, ecx
lea edi, [esp + 0x18]
push 0x40
pop ecx
rep stosb byte es:[edi], al
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [edi]
jmp 0x10025760
movzx eax, word [esi + 0x2c]
lea ecx, [esp + 0x18]
mov edx, dword [esi + 0x30]
shr eax, 1
push eax
call fcn.100244a1
add esp, 4
call fcn.10024484
mov edx, eax
lea ecx, [edx + 1]
mov dword [esp + 0x10], ecx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10025735
sub edx, dword [esp + 0x10]
push edx
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [esp + 0x14]
call fcn.1001c162
mov eax, dword [esp + 0xc]
and dword [esp + 0xc], 0
cmp dword [esp + 0x14], eax
je 0x1002577b
mov esi, dword [esi]
cmp esi, edi
jne 0x10025711
and dword [ebx], 0
push 0x40
pop ecx
xor al, al
lea edi, [esp + 0x18]
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x10025790
lea edx, [esp + 0x18]
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0x10025786
mov eax, dword [esi + 0x18]
mov dword [ebx], eax
jmp 0x10025767

Function at 0x10025797
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push ebx
xor al, al
mov ecx, 0x104
push edi
lea edi, [ebp - 0x108]
xor ebx, ebx
rep stosb byte es:[edi], al
mov eax, dword fs:[0x18]
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
add ecx, 0xc
test eax, eax
je 0x10025858
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10025857
mov edx, dword [ecx]
jmp 0x100257e3
cmp dword [edx + 0x18], eax
je 0x100257e9
mov edx, dword [edx]
cmp edx, ecx
jne 0x100257dc
jmp 0x10025857
movzx eax, word [edx + 0x2c]
lea ecx, [ebp - 0x108]
mov edx, dword [edx + 0x30]
shr eax, 1
push eax
call fcn.100244a1
add esp, 4
call fcn.10024484
lea edx, [ebp - 0x310]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1002580e
mov al, byte [ebp + ebx - 0x310]
mov byte [ebp + ebx - 0x20c], al
inc ebx
test al, al
jne 0x10025818
lea ecx, [ebp - 0x20c]
mov al, byte [ecx]
inc ecx
mov byte [esi], al
inc esi
test al, al
jne 0x10025831
lea edi, [ebp - 0x20c]
mov ecx, 0x104
rep stosb byte es:[edi], al
lea edi, [ebp - 0x310]
mov ecx, 0x104
rep stosb byte es:[edi], al
mov bl, 1
pop esi
xor al, al
lea edi, [ebp - 0x108]
mov ecx, 0x104
rep stosb byte es:[edi], al
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100259d5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
call fcn.10108672
jno 0x1012737b
xchg esi, esi
sub cl, byte [eax - 0x7b68f034]
sub al, 0xdd
invalid
inc cx
btr ebp, 0xab
dec ecx
adc edi, ecx
dec esp
mov edi, esp
dec edi
lea ebx, [edi + ebx*2 - 0x1d8]
ror al, 0x81
or eax, eax
inc ecx
and bl, 0xf0
xadd ebx, eax
inc ecx
or ch, 0x11
call fcn.100f872f
mov edx, 0x4f86ee3f
movzx ax, byte [edi + edx - 0x4f86ee3f]
dec edx
inc dl
bt edx, edx
mov dl, byte [edi + edx - 0x4f86ee3d]
push 0x8a343c1f
call fcn.1010ef52
mov ebp, 0x9935468a
bts bp, 0x33
lea eax, [ebp*4 + 0x7d21d405]
mov ebp, dword [edi]
mov ecx, eax
xor ax, cx
add al, al
mov eax, dword [edi + 4]
ror cx, 0xec
mov cl, byte [edi + 8]
jb 0x100df075
call fcn.10123ffc
jno 0x1010438e
jg 0x100aa957
ret 4
call 0x100259d5
mov ecx, dword [ecx + edi*2 + 0x7d977e54]
and di, 0xf934
push ecx
mov ecx, edi
jg 0x100ee893
push esi
push edx
pushfd
mov esi, 0x40380b14
mov edx, esi
movsx dx, dl
and edx, 0xa53e128f
mov esi, dword [esp + edx - 0x37fffc]
mov dword [esp + 8], 0xf9f10208
mov edx, dword [esp + edx*2 - 0x700004]
jge 0x1009ad0d
inc ecx
mov ecx, 0xeb00007
inc ecx
push ebx
push edx
dec esi
lea ebx, [ecx*2 - 0x20fe6870]
inc ecx
bswap ecx
push eax
inc ecx
movsx eax, bx
inc ecx
push esp
dec esi
lea ebx, [ebx*2 - 0x3cdba5da]
push ebp
inc ecx
xchg ebx, eax
not eax
cwde
push edi
cbw
dec ebx
lea edi, [ebx + ecx*4 - 0x75b575d]
push esi
dec edx
lea edi, [edi + ebx + 0x5783a722]
inc ecx
push ebp
inc ecx
push ecx
inc cx
xchg ecx, edi
pop eax
pushfd
dec ebp
bts ecx, ebx
dec ecx
bswap ebx
dec esi
mov dword [esp + ecx - 0x47003ee9], eax
inc al
dec eax
dec edi
inc ecx
push edx
inc cx
sar ebx, 0x2c
dec eax
rol edi, 0x23
push ecx
je 0x10123bb3
push dword [esp + 0x3c]
popfd
lea esp, [esp + 0x44]
ret
inc esi
mov cl, byte [ecx + ecx - 4]
dec eax
inc dword [esp]
xor word [esp + 2], 0x49bc
shl dword [esp + 1], 0x1e
dec ecx
sbb edi, 2
inc bp
mov dword [edi], ecx
push 0x34bf9ab9
call fcn.10109f16
call fcn.100ac325
dec eax
mov dword [esp], 0xa5935e01
push 0x4030e3d
dec eax
adc edi, 1
jmp 0x101156a0
call fcn.1007d1e7
push esi
dec esi
lea ebp, [ebx*2 - 0x50f8bffe]
cwde
dec ecx
cmove edi, ebx
push ebx
inc ecx
mov ebx, ebx
inc ecx
xchg ecx, eax
or edi, dword [esp + eax - 0x47003ec1]
dec edx
lea eax, [eax + ecx*2 + 0x5b71f98]
inc esp
btr ebx, ecx
xor edi, 0xff9e33b9
sub ax, bx
rol edi, 1
inc edi
rol edi, 1
dec esp
mov dword [esp + ebx*8 + 0x78], esi
inc ecx
neg ch
inc ecx
push edi
dec esp
lea ecx, [0xefedc406]
jg 0x100df034
inc ecx
ror ebx, 0x11
dec esi
mov dword [esp + ebx + 0x38], ecx
inc ebp
sub ebx, ebx
jbe 0x10025b98
js 0x100dab6b
add dword [esp], 0xeff652ee
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call int.1013bcac
Function at 0x10039c1a
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xc630f8a1
or ebx, ebx
jne 0x1014a026

Function at 0x1003a810
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x538ec6f9
pop es
outsd dx, dword [esi]
fimul word [edx + 0x30bece9a]
stc
invalid
stosd dword es:[edi], eax
jne 0x1003a7f2
je 0x1003a7da
out dx, eax
mov ch, 0x22
movsb byte es:[edi], byte [esi]
sal bl, 1
add ecx, edi
adc al, 0xd8
jp 0x1003a7e6
iretd
lds ebx, [ecx - 0x5b29ce99]
test dword [ecx], esi
dec ecx
mov ebp, 0xa86261df
insd dword es:[edi], dx
xor dword [ecx - 0x43], ecx
fbld tbyte [ecx + 0x62]
test al, 0x6d
popal
xchg ecx, eax
xchg ebp, eax
int 0xe3
jno 0x1003a7d9
int3
out dx, al
test esi, ebx
je 0x1003a7fe
sbb cl, byte [edi + 0x4f7673d2]
outsb dx, byte [esi]
popfd
test eax, 0x3a71e042
push ebx
push cs
out dx, eax
pop ss
arpl word [0x8f870b7e], bp
invalid
Function at 0x10085729
Capabilities:
Packed with generic packer

Disassembly:
lodsb al, byte [esi]
xchg edx, eax
pop ss
push esp
out 0x2f, al
xchg ecx, eax
pop edx
xor al, byte [eax]
dec ebx
cmp eax, 0x2de63ae
in al, 0x34
sub eax, 0x57b55fd2
invalid
daa
stosd dword es:[edi], eax
popfd
jmp 0x100856c7
mov dword [esp + ecx + 0x5f5dff58], 0x9c1d8c1b
jb fcn.1002e47a
jne 0x100c3735
mov bl, byte [ecx + 0x4f122754]
out dx, al
push cs
pop esp
pop ds
adc al, 0x30
mov dl, 0xbf
mov ebp, 0x6ce9ecc5
not dword [ecx + 0x1b386450]
loopne 0x10085777
test dword [eax + 0x5d49f8e3], eax
pop eax
pushfd
jno 0x10085740
arpl word [edx + 0x684dd324], si
les esp, [eax + 0x70]
fst st(3)
mov byte [edi - 4], ah
out dx, al
jb 0x10085718
les eax, [ecx]
cmp esi, edx
pushal
enter 0xffffffffffffe41f, 0x2a
cmp eax, 0x580c7ba6
xchg dword [eax + 0x5d], ebx
cmp ch, bl
les eax, fs:[eax + 0x12]
xchg edx, eax
popfd
pop edi
ror cl, cl
or byte [ebx], 0xf3
sub dl, al
add byte [edx + 0x58], dl
cdq
popal
push eax
mov ebx, 0x231b4999
adc eax, 0x32cd9d2
inc ebx
salc
inc eax
cmp al, 0x3e
push 0xffffffffffffff8c
jno 0x10085779
sbb dword [edi - 0x3a6b58f6], ecx
mov al, byte [0x903ae89a]
iretd
or ebp, dword [esp + 0x14]
jns 0x1002e7c4
xchg dword [esp + ebp + 0x63e251ed], edx
mov ebp, dword [esp + ebp + 0x63e251e1]
call fcn.100e77e8

Function at 0x100a2a0e
Capabilities:
Encode data using xor

Disassembly:
jae 0x100bfef5
sub eax, 0xd2697d3e
js 0x100a2a18
sar byte [eax - 3], cl
mov fs, ebx
mov dh, 0xb
xchg esi, eax
inc ebx
cli
mov ch, 0x19
dec esi
cld
push ss
sub esi, dword [edi - 0x6ac714c5]
movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
in eax, 0xee
xor edx, dword [ecx - 0x5385e8a1]
test al, 0xcd
add al, 0xa8
invalid

Function at 0x100aa9cd
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x10], ecx
or ebp, ebp
push ecx
add dword [esp + ebp + 0x5ee7ffde], 0xccf8
cmp ebp, 0xc40b0923
mov ebp, 0x951c8ba4
add byte [ecx + 0xb0923fd], al
les edi, [ebp - 0x6ae3745c]
jns 0x1002a14b
lea ebp, [ebp + ebp + 0x3385d5ac]
cmp ebp, 0xe7bc9c89
jb 0x100a5620
jle 0x100aaa07
je 0x100aaa5d
mov edx, 0x667450e
jge 0x100aaa53
sbb esp, ebp
stc
mov byte [ecx - 0x43d85cee], ch
sbb dh, byte fs:[ebp + ebp*4 - 0x5ea4c2d2]
call 0xc5cf3cbc
cdq
jns 0x100aaa4b
invalid
jnp 0x100aa9d7
test byte [0x3f6cfa84], ah
insb byte es:[edi], dx
ror byte [eax + 0x1decd1ca], cl
mov ecx, dword [edi - 0x20751471]
loop 0x100aaac0
invalid
invalid
jmp 0x100aa9e9
outsb dx, byte [esi]
xor ebp, dword [esp + edi*2]
popfd
jl 0x100aaa5b
dec edi
test eax, 0x2c3af678
jl 0x100aaa6e
sub al, 0x7c
std
test ebp, esp
invalid
adc eax, 0xddf10393
jle 0x100aaa5c
and dword [edx], 0xffffffed
xchg edi, eax
xchg ecx, eax
iretd

Function at 0x100b87ae
Capabilities:
Encode data using xor

Disassembly:
push 0xd3310514
call fcn.1012aa42

Function at 0x100c2d21
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + 0xc]
push esi
pushfd
mov esi, 0xc880b79f
neg esi
add dword [esp + 0xc], 0xeff55a33
neg esi

Function at 0x100c3b74
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor word [esp + ebp - 0x3b5a69b6], 0xb538
call fcn.100a7281
Function at 0x100c3b83
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call 0x100e12e0
jne 0x1008a6b4

Function at 0x100c43ee
Capabilities:
Encode data using xor

Disassembly:
and edi, edi
invalid
add dword [esp + 8], 0xefed71a3
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x18]
call int.1013bcac
je 0x100c43e5
add byte [edi + ebx*8 + 0x66], dh
add ebp, dword [edx]
add bp, word [edx]
add esi, dword [eax - 0x5caf3685]
jle 0x100c443d
salc
retf
jns 0x100c447c
jne 0x100c44af
aas
sub cl, byte [ebx - 0x1e]
movsd dword es:[edi], dword [esi]
or dword [esi], eax
xor al, 0xd
pop ds
dec edx
jmp dword [edx - 0x49]
cld
loope 0x100c4403
and eax, 0x1fcdc26e
salc
movsd dword es:[edi], dword [esi]
nop
lds esi, [eax]
xor al, 0xde
popfd
xchg esi, eax
push ss
outsb dx, byte [esi]
inc edi
fisub dword [ebx + 0x402e5866]
scasd eax, dword es:[edi]
or byte [esi + 0x2b], al
cli
imul ebp, ebp, 0x41
cmpsb byte [esi], byte es:[edi]
and byte [ecx - 0x2a], 0x40
inc eax
je 0x100c44a2
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0x34ade63a]
cmpsd dword [esi], dword es:[edi]
stosb byte es:[edi], al
scasd eax, dword es:[edi]
aad 0x98
cmp ebp, dword [esi + 0x172e8044]
jmp 0x100c4537
cmpsd dword [esi], dword es:[edi]
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
xor ah, byte [edx + 0x5e81bd2f]
and dword [edx - 0xd], ebp
dec esp
outsb dx, byte [esi]
and al, 0x48
adc dword [edi], 0xffffffd3
sbb esp, eax
add eax, 0x439a0198
xor al, 0x48
movsd dword es:[edi], dword [esi]
cwde
add dword [edx - 0x5ab7cbbd], ebx
or ah, byte [ecx + 0x65]
jo 0x100c45d5
lodsb al, byte [esi]
dec esi
add al, 0xbd
jle 0x100c454e
in al, 0xb1
in al, dx
and al, 0x68
invalid
mov dword es:[0x3db1cce8], eax
xor eax, 0xe5e5ea79
xor esi, dword fs:[edx]
fadd dword [ecx]
lodsb al, byte [esi]
cmp eax, 0x50be867
push cs
cld
inc esi
cmp eax, 0x8a883376
sti
cmp byte [ebp + 0x79e037b], ah
mov al, byte [0x9f062dfb]
movsd dword es:[edi], dword [esi]
pop esp
or eax, 0xeae1142
add eax, 0x5a17920b
adc dword [edi - 0x22], edx
aad 0x75
lodsd eax, dword [esi]
pop ss
imul esi, ebp, 0xffffffee
xor al, 0x9d
fnstenv [ebp + 0x19]
inc edi
ror dword [esi + 0x6c], 1
jno 0x100c460e
lea ebp, [ecx + 0x43]
lea ebx, [esi]
xor al, 0x68
push 0xbfb61a97
push ebx
push edx
call 0x100e4654

Function at 0x100de158
Capabilities:
Check for vm using instruction vpcext

Disassembly:
not esi
not esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x10], ebx
call fcn.1013cbe8

Function at 0x100de169
Capabilities:
Check for vm using instruction vpcext

Disassembly:
not ebx
push ebp
mov ebp, 0xbaa96ad
mov ebx, dword [esp + 8]
mov dword [esp + ebp*2 - 0x17552d3a], ebx
mov dword [esp + ebp*2 - 0x17552d52], ebp
shl ebp, 0x6b
sub dword [esp + ebp - 0x54b567f8], 0xedb0909f
call fcn.100a2d4a
Function at 0x100de196
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call fcn.1012b8fb
and al, 4
lahf
xor cl, byte [ecx - 0x7f]
fild word [edx]
add byte [eax], al
add byte [eax + 5], ch
imul ecx, dword [edx], 0x54cde9f2
add eax, dword [eax]
mov ebp, dword [esp + 0x24]
mov ebp, dword [ebp]
jbe 0x100385d9
pop ebx
lahf
in al, 0x5c
mov al, byte [0x83f874ec]
jae 0x100c3b31
mov edx, dword [ebx]
pop edi
and al, 0x8c
jo 0x100c3bd5
mov ah, 0xc0
mov ebx, 0xcb53bf43
dec edi
xor al, 0x84
js 0x100c3b89
dec esp
fsub dword [ebx - 0x69c4d825]
clc
inc eax
fcmovnb st(0), st(0)
pop esp
test al, 0xc2
pop ds
cmp dword [esp + ebx], ebp
fsub qword [esi - 0x2c65c17]
mov edi, 0x62a222ef
add dword [ecx - 0x64], edx
invalid
not esi
not dword [esp + esi + 0x5b80afb5]
lea esi, [esi + ebx + 0x1379209]
add dword [esp + 0x1c], 0x64bff
push ecx
sub bl, byte [esp + 9]
push 0xa58fb310
jae 0x1002cac1
jno 0x100c3b89

Function at 0x100e16da
Capabilities:
Encode data using xor

Disassembly:
push ebx
pushfd
mov ebx, 0x5838fc1e
mov dword [esp + 8], 0x32e70288
mov ebx, dword [esp + ebx - 0x5838fc1a]
push dword [esp]
popfd
lea esp, [esp + 8]
call int.1013bcac
Function at 0x1011b21d
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + edi - 0x8886376], ebx
mov ebp, dword [esp + edi*8 - 0x44431d6c]
mov dword [esp + edi*2 - 0x1110c734], 0xe2814a89
call fcn.100295c4
jbe 0x10118cfb
mov al, byte [0x4cd14cfd]
in eax, dx
cmpsb byte [esi], byte es:[edi]
mov ch, byte [0x78ad5e8f]
sub eax, 0xd1c84dd0
outsb dx, byte [esi]
mov ebx, 0x1b26927
xchg byte [esi - 0x301b3a3a], cl
arpl word [edx], sp
cli
invalid
les edi, [ebp + edx*4 - 0xd7d5a70]
mov ah, 0xaa
dec ebx
jno 0x10118d4f
push ds
and dword [eax + 0x14], ebx
sub ah, ah
enter 0x38de, 0x1f
in eax, dx
inc esp
add al, bl
in al, dx
fiadd word [eax]
jnp 0x10118ce9
inc esp
or byte [eax], ah
xor edi, esi
mov dword [0xb26a4f52], eax
invalid
inc esp
aad 0x97
pop ebx
in al, 0x40
pop esi
sal byte [edi], 0xb1
int 0x7b
add eax, 0x874d4978
push ss
dec ebp
xchg dword [esi], edx
dec esi
xlatb
fbstp tbyte [ecx - 0x7a]
pop esp
cmc
sub ah, byte [edi]
aam 0x5a
pop ss
jne 0x10118dd4
xchg ebp, eax
push edi
cmpsd dword [esi], dword es:[edi]
sbb dword [eax + 0x4f4c8b0b], edx
sti
fnstsw word [ebx + 0x65]
les esp, [edx - 0x34]
pop ds
shr dword es:[edx + 0x4d9c5307], 0xd3
mov dl, 0x47
in eax, dx
jne 0x10118dd3
pop es
push ebx
pushfd
dec ebp
sal dword [edx + 0x4575ed47], cl
jp 0x10118d88
jl 0x10118df2
mov edx, dword [eax + 0x195df17]
cmp eax, dword [0x3b71586d]
scasd eax, dword es:[edi]
xor byte [edx], ch
adc al, 0x7c
jnp 0x10118d84
inc ebx
cwde
imul edx, dword [esi + 0x50], 0x139f457b
xor byte [edi + eax*8 + 0x3dbcb16e], 0xa0
jne 0x10118d5e
outsd dx, dword [esi]
dec ecx
aam 0xe8
cmp dword [ecx + 0x7edcb6ec], esi
invalid
push ss
push 0xffffffffffffffe5
jecxz 0x10118d52
std
invalid
imul byte [ebp - 0x4f]
push 0xffffffffffffff99
or dword [0xfc349575], esp
pop ecx
invalid
fisub word [ebx]
pop ebx
jb 0x10118dcd
jno 0x10118e1c
mov byte [0xcb325f7e], al
mov bh, 0x89
mov esi, 0xb61d3cbd
xchg ebx, eax
mov ebp, 0x93b61d3c
cdq
push eax
push esp
clc
xchg esp, eax
jp 0x10118e03
invalid
imul ebx, dword [edi + 0x6a6f3913], 0xe30d04d5
inc edi
dec ebx
dec eax
sub esi, ecx
into
dec ebp
jl 0x10118e32
pop es
inc esp
stosb byte es:[edi], al
imul edx, dword [eax + 0x16], 0x8af3b897
insd dword es:[edi], dx
imul edx, dword [esi - 0x21], 4
cmc
out 0x6f, al
jae 0x10118e36
push eax
push ss
xchg edi, eax
mov eax, 0x6b6d8af3
mov ch, byte [ebp + 0x6b]
push esi
fild word [esi*8 - 0xb8c901a]
sub dword [ecx + 0x4c], esp
jmp 0x10118e2a
xor word [esp + 0x1c], 0x5d35
ja 0x10118c76
cmp eax, 0x67cd822e
mov byte [0x58b9e4d1], al
lds edx, [eax - 0xf]
stosb byte es:[edi], al
push cs
sbb eax, 0x2cb55e3f
inc eax
out dx, al
fstp dword [edx + 0x4b]
pop ecx
in eax, dx
mov dh, 0xd7
pop eax
push 0x22915b04
lahf
xor byte [edx], 0
pop eax
jp 0x1011b291
iretd
nop
iretd