joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449f70
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x449fa3
push esi
call fcn.00458310
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x449f9c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44a029
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44a012
mov eax, dword [esi + 8]
test eax, eax
je 0x449fc7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44a00e
cmp eax, 2
je 0x44a012
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x449fba
cmp eax, 3
je 0x449fed
cmp eax, 1
jne 0x449fba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x449fba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x449fba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044a050
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44a038
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044a050
add esp, 4
pop esi
ret

Function at 0x44a8c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x44a8e1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x44a8e1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x44a8e1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x44ad30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x44ad3b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x44ae3e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x7e5fa0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x7e5fa0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x7e5fa0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x7e5fa0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x7e5fa0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x7e5fa0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x7e5fa0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x7e5fa0]
xor eax, edx
inc ecx
dec edi
jne 0x44ad56
pop edi
test esi, esi
je 0x44ae60
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x7e5fa0]
xor eax, edx
inc ecx
dec esi
jne 0x44ae42
pop esi
pop ebx
not eax
ret
Function at 0x465610
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4656b3
test eax, eax
jbe 0x4656b3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4656b3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46565e
xor esi, esi
jmp 0x465664
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46568f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00408820
add esi, eax
push esi
mov ebx, esi
call fcn.00408820
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x465670
pop ebp
test edi, edi
pop edi
jne 0x4656b3
test ebx, ebx
je 0x4656b3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0046a240
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4657d5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4658ed
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4658ed
mov eax, dword [esi + 0x3c]
push eax
call fcn.0047ae0d
mov esi, eax
test esi, esi
je 0x4658ed
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4658ed
mov ecx, esi
call fcn.00465760
cmp edi, eax
jge 0x4658ed
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x465873
mov dword [esp + 0x34], 1
jmp 0x4658ce
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4658ed
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00464d60
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x47b7b0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47b7e8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00479867
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047983f
jmp 0x47b7f4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47cea1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47cee3
call fcn.0048295a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47cee3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47ceda
xor eax, eax
jmp 0x47ceeb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047cef1
pop edi
pop esi
pop ebx
ret 4

Function at 0x482e8a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x482eb8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x482ed6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00482df0
jmp 0x482ed6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x482ed6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00482df0
test edi, edi
mov eax, edi
jne 0x482ec0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x841e47
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dword [esp + 4], 0xff74a0ef
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.00987eba
mov edx, 0x3593daaf
mov eax, edx
rol edx, 0x95
movzx eax, byte [edx + esi - 0x55e6b27b]
movzx ecx, dl
lea esi, [edx + esi - 0x55e6b27a]
btr edx, edx
not dx
and edx, ecx
xor al, bl
bswap ecx
xor al, 0x24
sub al, 0xb3
xor al, 0xaf
btr ecx, edx
shl ecx, 0x47
adc al, 0x7f
jmp 0x8b7d60
xor bl, al
xor ecx, ecx
push ecx
dec byte [esp + edx*2 + 2]
lea eax, [esp + eax + 4]
adc dword [esp + ecx*2], ecx
jne 0x943fa7
movzx edx, ax
xadd edx, eax
mov edx, dword [eax + edi - 0xfa0a]
lea ecx, [eax + eax*4 + 0x7085c2c]
adc cl, 0x90
xor edx, ebx
cbw
ror edx, 1
ror al, 7
dec al
xor edx, 0xd887abbf
bswap edx
sub eax, ecx
not edx
not ax
xor ebx, edx
add ebp, edx
xor ecx, ecx
mov edx, ecx
ror ecx, 0x16
movzx ax, byte [esi + ecx*2]
jp 0x9b868f
add dx, word [eax + edx]
jmp 0x99dd0a
dec dword [esp + ecx*2]
lea edi, [ecx + edi - 2]
push ecx
bswap ecx
movsx eax, byte [esp + ecx*2 + 3]
mov word [ecx + edi], dx
jno 0x9c6936
mov eax, 0x5b31fa05
sal al, 0x21
lea edi, [eax + edi - 0x5b31fa0e]
jno 0x8ea8cb
invalid
Function at 0x842d0c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xa0b6d81
pushfd
and dword [esp + 4], 0xfa8f310b
add dword [esp + 4], 0xf1202625
mov dword [esp + 8], 0x8897310d
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.0092ae79
mov ecx, 0x640187a9
ror cx, cl
mov cx, word [ecx + edi - 0x6401d4c3]
mov eax, 0x9d8cb382
jae 0x83b302
call fcn.00914d02
mov edx, 0x819e93a1
movsx ecx, dl
sub esi, 4
sar ecx, 0x2c
mov eax, dword [esi]
sub ecx, ecx
sbb dx, 0x37b5
jne 0x8e59f4
add ecx, 0x689be913
dec edx
call fcn.008f9efd
shl ecx, cl
xchg dx, cx
xor bl, al
lea eax, [esp + eax + 8]
mov edx, dword [eax + edx*2 - 0x74a79810]
push ecx
movsx eax, word [esp + ecx*2 - 0x504ea]
add dword [esp + ecx*2 - 0x504f1], 0xab02f3b5
lea edi, [edi + ecx*8 - 0x1413cc]
sar dword [esp + ecx*4 - 0xa09e4], 0x73
mov dword [ecx + edi - 0x28279], edx
xor al, 0x29
sbb dword [esp + ecx - 0x28275], ecx
not cx
lea ebp, [ebp + ecx - 0x27d8a]
adc dword [esp + ecx - 0x27d7e], 0x383956b0
inc ecx
mov ecx, dword [ebp + eax*2 - 0xa756]
not eax
xor ecx, ebx
rol ecx, 3
sub ecx, 0x2d21e100
xor ecx, 0x102262ad
shr dword [esp + 2], 0x3d
and eax, eax
sbb ecx, 0x2bb65696
bts eax, eax
and al, byte [esp + 3]
lea edx, [eax + eax + 0x2c3c0eb1]
xor ebx, ecx
inc byte [esp + edx - 0x2c3b66ac]
jle 0x9b9ba1
add esi, ecx
push edx
pop eax
pop eax
pop ecx
pop ecx
jmp fcn.00880f1a
xor eax, ebx
sal edx, 0x91
inc dx
bswap eax
sal ecx, 0xda
rol cl, 0xe1
not cx
xor eax, 0xdbaaaa80
lea eax, [ecx + eax - 0x3196f423]
bt dx, dx
sub ecx, ecx
neg eax
neg dl
xor ebx, eax
add edi, eax
and dx, 0x413f
lea edx, [ecx + ecx - 0x70c5155d]
mov bp, word [ecx + ebp]
rol dl, 6
call fcn.008b7820
sub ebp, 1
push 0xf939fa01
push 0x79845981
mov edx, 0xc0917c2c
movzx eax, byte [ebp]
xor edx, edx
movsx ecx, word [esp + edx]
xor al, bl
sar edx, cl
inc al
shr dl, cl
add dword [esp + edx*2 + 4], ecx
rol ecx, cl
xor al, 0x92
xadd dword [esp + edx*4 + 3], edx
rol al, 1
inc al
jmp 0x87e4cb
sar al, 0x82
xor ebx, ecx
add ebp, ecx
call fcn.0094f664

Function at 0x84530d
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl eax, 8
xor dl, bl
ror eax, 0x4d
call fcn.008b5f9a

Function at 0x84531a
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx edx, word [esp + ecx - 0x739024e7]
mov eax, dword [edx + esi - 0xe643]
sar cx, cl
lea esi, [edx + esi - 0xe63f]
xor word [esp + edx*4 - 0x39906], 0x86aa
xor eax, ebx
xchg edx, ecx
xor eax, 0x998d1a93
ror dword [esp + ecx*4 - 0x39908], cl
and dword [esp + ecx*2 - 0x1cc82], ecx
mov dword [esp + ecx - 0xe643], ecx
ror eax, 1
not eax
rol eax, 2
neg eax
sub ecx, 0xb2032288
ror eax, 1
push edx
sal dword [esp + edx - 0x738ffffc], cl
xchg byte [esp + edx - 0x738ffffd], dl
xor ebx, eax
lea ebp, [ebp + edx - 0x73900004]
not ecx
mov dword [edx + ebp - 0x73900000], eax
pop ecx
pop edx
pop eax
jmp fcn.009338ec

Function at 0x84583e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [ebp + ecx*2 - 2], dx
lea edx, [ecx*2 + 0x523894bf]
pop eax
pop eax
pop edx
jl fcn.009338ec
lea edx, [eax*4 - 0x7ebb141]
mov eax, dword [edi + edx - 0x529bff0f]
jmp 0x899af7
Function at 0x84ea9d
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edx
sal edx, cl
xor eax, ebx
ror eax, 3
shr edx, 0x2a
ror byte [esp + edx - 0x3d9ffc], 0x42
imul edx, dword [esp + edx - 0x3d9ffc]
sbb eax, 0x8f28d6ac
mov dword [esp + ecx - 0xffb5], 0x56b049ac
sal byte [esp + ecx - 0xffb1], 0x66
neg eax
rol eax, 2
inc ecx
bswap eax
lea eax, [eax + ecx + 0x399218da]
sal ecx, cl
sar edx, 0xce
not ecx
neg eax
or byte [esp + ecx*2 - 0x24fffff8], dl
xor ebx, eax
call fcn.0097f9e0
mov edx, 0x900107aa
movzx eax, dl
cwd
mov edx, dword [ebp + eax*2 - 0x154]
mov ecx, 0xb49da60d
lea ebp, [eax + ebp - 0xa6]
idiv cl
xor edx, ebx
inc eax
sar ecx, cl
push eax
dec edx
inc dword [esp + eax*8 - 0x870]
neg edx
rol eax, 0x43
pop eax
call fcn.009881c2
Function at 0x84eb55
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr dword [esp + 8], 0xc1
dec edx
xor ebx, edx
shl al, 0xe6
rol dword [esp + 8], 0xe7
add ebp, edx
lea edx, [eax*2 + 0x38bfc80d]
cwd
and eax, eax
mov ecx, dword [esi + edx*4 - 0x575bfffc]
ror eax, 0x42
add dx, 0xd982
movzx dx, byte [ecx + eax - 0x3ba2e600]
movzx ecx, word [esp + eax*2 - 0x7745cbf8]
sal dword [esp + eax*2 - 0x7745cbfc], 0xb8
lea esi, [esi + eax - 0x3ba2e5fe]
and ecx, dword [esp + eax*2 - 0x7745cbfa]
jbe 0x98f320
mov word [ecx + esi - 0x3000], dx
shr ecx, 0x38
movsx edx, cl
mov dword [esp + eax*2 - 0x7745cc00], ebp
ret 8
mov dword [esp + edx - 0x5200], esi
ret
cwde
bt di, si
cmovae ebx, edi
not ebp
push eax
sbb ebp, 0xafbc9038
sar dword [esp + edi - 0x13900], 0xc4
adc ebp, ecx
pop esi
xor esi, esi
mov dword [esp + ebx - 0x138e0], edx
movsx ecx, bx
sub si, 0xdb1a
cwde
mov edi, esp
lea esi, [edi + ebx*2 - 0x272f4]
mov esp, esi
mov edx, 0xb100210a
jmp 0x9872ce
and al, byte [esp + ecx - 0x491712f4]
cwde
ror edx, 1
btc ecx, ecx
cwde
neg cx
lea edx, [edx + ecx*2 + 0x4af08fa2]
sal al, 0x27
shl cx, 0xc8
bswap edx
sub dword [esp + ecx - 0x49070c00], eax
lea eax, [ecx + ecx + 0x590160ad]
rol edx, 3
dec edx
call fcn.0091d1de
add esi, 4
btr edx, edx
movsx eax, dl
xor ecx, ebx
neg ecx
bswap ecx
dec ecx
bt edx, edx
dec eax
jl 0x9763c4
mov dword [esp + 4], 0x59476d9f
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.0083caad
mov ecx, 0x6095053d
inc cx
movzx edx, cl
mov eax, dword [edx + edi - 0x3e]
not ecx
bts edx, ecx
push ecx
mov dx, word [edi + edx - 0x3a]
jae 0x89ecb3
jb 0x9a0687
bts ecx, 0x11
xor edx, 0x611146a8
xor eax, 0x760dd9a6
dec edx
or ax, 0xf63c
xor cl, ah
rol eax, 0x35
xor ebx, edx
not ecx
add edi, edx
shr eax, 0x4b
movzx edx, al
xadd ecx, edx
jmp edi
neg ecx
bswap ecx
or eax, 0xab9b6a8c
ror ecx, 1
inc dl
neg ax
dec dx
xor ebx, ecx
shl dx, 0xc2
sal dl, 0x42
or eax, 0xa04fd89
adc ebp, ecx
bswap eax
cdq
mov ecx, dword [edi]
add eax, eax
mov edx, dword fs:[ecx]
movsx ecx, ax
lea ecx, [ecx + 0x6e99e103]
lea eax, [eax + eax*4 - 0x7658866f]
mov dword [eax + edi - 0xd937987], edx
jmp ebp
mov ebx, ebp
call fcn.0084e097
add cx, 0x2807
mov word [ecx + ebp - 0xa807], ax
mov edx, 0x838b8605
mov edx, dword [esi + ecx*2 - 0x1500e]
lea esi, [esi + ecx*4 - 0x2a018]
push ecx
shr ecx, cl
movzx eax, cx
xor edx, ebx
not edx
pop ecx
rol cx, cl
sub ax, ax
adc edx, 0xfe85c325
jmp 0x93af0b
ror eax, 0xe8
xor ebx, edx
lea eax, [ecx*4 - 0x2cc003d4]
add esi, edx
shl cl, 0xa3
mov dword [esp + eax - 0x344145e0], eax
xchg word [esp + eax - 0x344145e0], ax
movzx ax, byte [eax + edi - 0x344145e0]
mov dl, byte [edi + 2]
btr ecx, 0xb9
adc edi, 2
add al, dl
inc ecx
movzx edx, cx
mov word [edi + edx*8 - 0x29348], ax
setnp dl
jp 0x8815ae
mov edx, 0xce82f9ac
mov ecx, dword [esi]
jmp 0x903b7a
adc edi, 5
and cx, 0xa110
mov word ss:[eax], dx
mov edx, dword [esi]
setne cl
adc esi, 4
and byte [esp + 2], cl
movsx eax, byte [esp]
lea ecx, [eax + 0x49171333]
xor edx, ebx
jmp 0x8dfc44
Function at 0x84f17b
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
jl 0x99a870
lea esi, [esi + eax*2 - 0x1232c838]
xor edx, ebx
bt ax, ax
ror edx, 1
push eax
inc edx
inc al
neg edx
btc eax, 6
mov dword [esp + eax - 0x919645b], 0x7898310b
inc edx
mov ecx, eax
xor edx, 0x308c8401
sub eax, ecx
xor ebx, edx
add ebp, edx
movzx edx, ax
rol word [esp + eax*2 + 0xb], 0xed
or eax, eax
pop edx
pop edx
pop ecx
pop ecx
jbe fcn.0084da17
not ecx
ror ecx, 2
lea ecx, [ecx + edx*4 + 0x1221e07a]
pop eax
shl edx, 0x3e
ja 0x8ad12d
push 0xd4a9c717
add esi, 4
mov edx, 0xac07bb39
neg word [esp + 2]
rol edx, 0x48
xor eax, ebx
ror eax, 3
mov ecx, edx
lea eax, [edx + eax - 0x636a29c2]
shr edx, 0xc5
xor edx, dword [esp + edx - 0x3dd9cd]
rol word [esp + edx*2 - 0x56d43db3], 0x82
not eax
and cl, cl
xor edx, edx
xor eax, 0xdbae7f37
neg dword [esp + edx]
shl cx, cl
add ecx, 0xbca21c30
bswap eax
rol eax, 3
not cl
xadd dx, cx
xadd dword [esp + edx*4 - 0x3733c], edx
xor ebx, eax
call fcn.008ab92b
not ecx
imul dx, ax
bt edx, 0x13
sbb dl, dh
inc ecx
bswap ecx
cwde
bts eax, edx
xor ecx, 0x9680aeb0
sal dl, 0xc2
sal edx, 0xcb
ror ecx, 2
bts edx, 0x25
xor ebx, ecx
add esi, ecx
lea ecx, [eax*2 + 0x1c0eaf03]
jmp esi
add ebp, ecx
pop edx
jmp fcn.0084da17

Function at 0x84f249
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
mov eax, dword [esi]
mov edx, 0x3e2be691
lea esi, [esi + edx - 0x3e2be68d]
call fcn.009ad30c

Function at 0x85baf5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
push ebx
pushfd
mov esi, 0x7abdac31
or esi, 0xb333f7a0
shr si, 0x84
mov dword [esp + 0xc], 0xafcffc6e
mov esi, dword [esp + 8]
mov ebx, 0x1935b113
jae 0x9546f8
call fcn.00401e11

Function at 0x860075
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc edi, eax
pop eax
pop edx
jmp fcn.009338ec
Function at 0x860da3
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edx
cwde
sub edx, 0x8d07a52b
sar cl, 0xe6
call fcn.00944f55
mov ecx, dword [esi + edx*8 - 0x1c0]
btr edx, edx
movzx eax, dx
add edx, edx
lea esi, [esi + edx*8 - 0x37c]
rol ax, 0x48
div dl
lea eax, [edx*8 - 0x6876c17a]
xor ecx, ebx
jmp 0x958d81
lea edi, [edi + ecx - 0x7bf330b2]
mov eax, ecx
or eax, ecx
lea edx, [eax + 0x2aaf769b]
mov edx, dword [edi + ecx - 0x7bf330ae]
btc cx, ax
xor edx, ebx
dec ax
imul ecx, eax
rol edx, 1
neg al
shl cx, 0xc3
shl ax, 0x6d
neg edx
or al, al
btr eax, 0xe
inc edx
and cl, cl
adc al, 0x33
rol edx, 3
xchg ah, cl
inc cl
not edx
dec cl
lea edx, [edx + eax - 0x544bcaf5]
xor edx, 0x7ebfac0f
imul cx, ax
rol edx, 2
shl eax, 0xc6
call fcn.008e01be
sub al, 0x83
add edi, edx
jmp fcn.009338ec
not dl
not ecx
cwde
ror ecx, 3
inc ecx
dec edx
rol eax, 0x1a
not ecx
xor ebx, ecx
imul dx
add ebp, ecx
or dl, byte [edx + edi]
dec eax
mov cl, byte [edi + eax - 0x1800926d]
lea edi, [edi + eax*2 - 0x300124dc]
shr eax, 0xe5
cwde
ja 0x943c77
mov ecx, 0x538d4609
or ecx, ecx
mov eax, dword [esi + ecx - 0x538d4609]
jle 0x9b479f
lea esi, [esi + ecx - 0x538d4605]
movzx edx, cl
xor eax, ebx
xor cx, 0xfeaa
dec edx
bswap eax
imul ecx, ecx
jo 0x961924
movzx eax, byte [esi]
mov ecx, 0xe529c20b
bts cx, 0xba
adc esi, 1
lea edx, [ecx + ecx*4 + 0x2d2d7cac]
shl ecx, cl
lea edx, [ecx*8 + 0x2c31b5a2]
xor al, bl
shr cl, 0xe3
rol al, 1
dec al
xor ecx, 0x4f94b52a
shl edx, cl
dec cl
neg al
dec cl
xchg ecx, edx
rol al, 1
bts ecx, edx
btc edx, ecx
bswap edx
xor bl, al
xor cx, 0x9728
xor ecx, ecx
bts dx, cx
add eax, esp
neg edx
bts cx, dx
sbb dx, cx
mov edx, dword [eax + ecx*4 - 0x20000]
movzx eax, cl
sub al, cl
inc cl
lea ebp, [ecx + ebp - 0x8005]
sbb cx, cx
rol ecx, 0x35
add eax, eax
mov dword [ebp + ecx], edx
sbb cl, ah
sal cx, 0x84
mov edx, dword [esi + ecx]
lea esi, [esi + ecx*2 + 4]
xor ax, 0xf908
xor edx, ebx
ror cx, 0x25
not edx
inc edx
or ax, ax
dec cl
bt ecx, eax
rol edx, 1
ror eax, 0x18
dec edx
xchg ah, al
xor ebx, edx
jmp 0x92cef8
ror eax, 3
rol edx, 0xd4
btr edx, 0x2e
adc edx, edx
dec eax
dec edx
not eax
sal cl, 0x82
push ecx
sbb eax, 0xffa83804
or cx, dx
xor ebx, eax
add ebp, eax
movzx eax, byte [esi + edx*2 - 0x1fffffe]
not ecx
lea esi, [esi + ecx - 0x6546ffff]
shr cl, 0x21
not dword [esp + edx*2 - 0x1fffffe]
inc cl
xor al, bl
xadd dl, cl
and dword [esp + ecx - 0x654700ff], 0xf0a3f10b
sbb al, cl
lea edx, [ecx + 0x6984e594]
ror al, 1
btr cx, 0xa4
ror cl, 0x41
not al
not edx
sar edx, 0xbf
adc al, 0x97
inc dword [esp + ecx - 0x654700f7]
sub byte [esp + ecx - 0x654700f4], dh
shl ecx, 0xc5
xor al, 0xa
shl cl, 0xa5
rol dx, 0x49
pop edx
xor bl, al
push ecx
neg byte [esp + edx - 0x6003400c]
neg edx
lea eax, [esp + eax + 4]
ror edx, 0x54
not dx
pop ecx
movzx cx, byte [eax]
movzx eax, dx
ror dx, 0x2a
lea edi, [eax + edi - 0xb602]
cwde
mov word [edi], cx
add al, ah
movsx ecx, al
cwde
jno fcn.0088b1ed
mov eax, dword [esi]
mov ecx, 0x573df998
mov dl, byte [esi + ecx - 0x573df994]
lea esi, [ecx + esi - 0x573df992]
ror ecx, 0x37
mov byte ss:[eax + ecx - 0x7bf330ae], dl
jae 0x929d1a
bt edx, ecx
dec ecx
adc esi, eax
movzx eax, dx
jmp fcn.009b97d0
Function at 0x863894
Capabilities:
Encode data using xor

Disassembly:
pushfd
and dx, 0x5005
call fcn.0096dc23

Function at 0x8664a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0x6164f85
mov ecx, dword [esi + edx*4 - 0x18593e14]
lea esi, [esi + edx*2 - 0xc2c9f06]
movsx eax, dl
rol edx, 0xd6
mov dword [esp], 0x97a3a620
xor ecx, ebx
and word [esp + 1], ax
rol ecx, 2
pop edx
bt eax, edx
jb 0x9a3027
mov edx, 0x2035a73b
mov ecx, dword [edx + ebp - 0x2035a73b]
lea ebp, [edx + ebp - 0x2035a737]
xor ecx, ebx
call fcn.00884bf4
shl ecx, 0x91
jns fcn.008ac5bb
inc ecx
rol ax, 0xad
not ecx
inc edx
call fcn.00931c63

Function at 0x867d27
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol edx, 1
mov dword [esp + ecx - 0x412fb613], ecx
and ecx, 0xe28c435
inc byte [esp + ecx - 0x28840f]
lea edx, [ecx + edx - 0x9d6364b]
inc ecx
push eax
xor ebx, edx
neg cx
add esi, edx
not dword [esp + ecx*4 - 0xa1efb4]
shl ecx, cl
movsx edx, word [esp + ecx*2 - 0x3df6ffff]
mov ecx, dword [edi + ecx*2 - 0x3df70000]
shr dl, 0xa7
cbw
adc edi, 4
sub ebp, 1
add edx, 0x9e0ee031
add ax, dx
cwde
movzx edx, byte [ebp]