joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x512a3d
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x5129b6
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x5129b6
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x51299d
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x51299d
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.00513af0
mov ebp, eax
test ebp, ebp
je 0x512995
push ebp
mov ecx, esi
call fcn.00514f70
test eax, eax
je 0x512995
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x512995
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x512956
xor eax, eax
jmp 0x51295e
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.00515940
inc ebx
xor ebp, ebp
jmp 0x5128e7
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x5128c0
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.00513e00
test eax, eax
pop ebx
je 0x512a3d
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.00513af0
mov edi, eax
cmp edi, ebp
je 0x512a3d
push edi
mov ecx, esi
call fcn.00514f70
test eax, eax
je 0x512a3d
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.00514040
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.005140b0
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.00515940
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x51b5f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5683b1
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x51b62d
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.0055d3c9
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.0055c711
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.00514400
lea ecx, [esp + 8]
call fcn.0055d638
lea ecx, [esp + 0x30]
call fcn.0055c875
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.0055c711
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.00514870
lea ecx, [esp + 0x74]
call fcn.0055c875
lea ecx, [esp + 8]
call fcn.0055d639
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.00512010
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.00514310
mov ecx, esi
call fcn.00514eb0
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.00514310
mov ecx, esi
call fcn.00514eb0
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.00514310
mov ecx, esi
call fcn.00514eb0
mov ecx, dword [edi + 0x5c]
call fcn.005117f0
push eax
mov ecx, esi
call fcn.00511800
mov ecx, dword [edi + 0x5c]
call fcn.00511db0
push eax
mov ecx, esi
call fcn.00511d50
mov ecx, dword [edi + 0x5c]
call fcn.00511ed0
push eax
mov ecx, esi
call fcn.00511e80
mov ecx, dword [edi + 0x5c]
push 0
call fcn.005110d0
push eax
mov ecx, esi
call fcn.005110e0
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.0055c7ed
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.0055c7ed
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.0055d452
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x51cdc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5685d7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.005536d4
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.005536d4
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.0051d8e0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x51d930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5686b0
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0055f665
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x51d963
xor al, al
jmp 0x51da8f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x51d985
xor al, al
jmp 0x51da8f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x51d998
xor al, al
jmp 0x51da8f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x51d9ac
xor al, al
jmp 0x51da8f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.00553799
test eax, eax
jne 0x51d9e0
xor al, al
jmp 0x51da8f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x8f244c
mov dword [esp + 0x20], ebp
call fcn.0055f665
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.0055c3c6
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.0055c41d
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x51da74
mov ax, word [ebx]
test ax, ax
je 0x51da66
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.0051dab0
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x51da4a
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.0055c41d
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x51df90
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.0055da76
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x51dfd6
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.00536b78
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x9e4d58
push ecx
call fcn.00538a08
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x521460
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xa38dc4]
xor edx, edx
cmp eax, edx
jne 0x521486
xor eax, eax
mov byte [eax + 0xa38cc4], al
inc eax
cmp eax, 0x100
jl 0x52146e
mov dword [0xa38dc4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xa38cc4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x521517
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x5214ea
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x5214b8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x521590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x5215e3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x5215ca
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x527fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56890e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.005288c0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x8f268c
call fcn.00555311
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x528033
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00555311
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x52802c
push 0
mov ecx, eax
call fcn.0051f0a0
mov dword [esi + 0xc], eax
jmp 0x528035
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x528035
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x557986
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5579be
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00555a2b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00555a03
jmp 0x5579ca
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x559186
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5591c8
call fcn.0055f665
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5591c8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5591bf
xor eax, eax
jmp 0x5591d0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005591d6
pop edi
pop esi
pop ebx
ret 4

Function at 0x55fb95
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x55fbc3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x55fbe1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0055fafb
jmp 0x55fbe1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x55fbe1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0055fafb
test edi, edi
mov eax, edi
jne 0x55fbcb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0xa52b85
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xa2
ror al, 1
sub al, 0xb3
bts edx, edx
xor bl, al
lea esi, [esi + edx - 0x7b07337c]
mov dword [edx + esi - 0x7b073378], eax
movzx eax, dl
sal byte [edx], cl
fmul dword [ebp - 0x337be94c]
clc
test byte [ecx - 0x3377cd7c], cl
clc
test byte [edi], cl
mov dh, 0xc2
shr al, 4
push ecx
mov ecx, dword [eax + edi - 7]
lea edi, [edx + edi - 0x7b073374]
mov dword [esp + eax - 3], 0x49a3618a
pop eax
xor ecx, ebx
div dl
xchg dx, ax
call fcn.00c92089
and bh, bl
add byte [edi - 0x78], bl
push ecx
push esi
or ecx, dword [ebp + 0x32]
imul esi, dword [edx + ebx*2], 0xa94bb052
inc ecx
pop eax
pop edx
add cl, byte [ebx + ebp*2 - 0x70b65bad]
mov ah, 0xfa
imul esp, dword [edx], 0x9f0ec0e
daa
fld qword [edx + 0x5e14200b]
push edx
inc ebx
cmp dl, dh
mov al, byte [0x87e5d855]
jbe 0xa52b8d
cli
cld
pushal
adc al, 0xf7
jmp dword [edi]
Function at 0xa5f38e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sets dl
sar ecx, cl
inc eax
rol ecx, 0x6e
or cl, cl
neg eax
inc edx
jg 0xab576d
mov eax, 0xbf0f2fa2
and eax, eax
rdtsc
mov ecx, 0x5f0ecdbd
lea edi, [ecx + edi - 0x5f0ecdc5]
bts ecx, ecx
jae 0xc2b4a8
mov edx, 0x76b4919d
lea ebp, [ebp + edx - 0x76b491a1]
movsx eax, dx
lea eax, [eax + eax*4 - 0xc71dc60]
mov ecx, dword [ebp + edx - 0x76b4919d]
add eax, edx
call fcn.00c00b38
xadd ax, cx
xor edx, ebx
xor edx, 0xb53e780e
call fcn.00b67b1a
mov eax, 0xb2b05c09
sub esi, 4
bswap eax
mov edx, dword [eax + esi - 0x95cb0b2]
lea ecx, [eax + eax*4 - 0x8cbeb64]
xor edx, ebx
ror eax, cl
adc eax, 0x258b3613
setl al
xor edx, 0x9d15a290
or eax, eax
sbb edx, 0xfca7b624
neg ecx
ror edx, 2
rol ecx, cl
inc edx
xchg cx, ax
xor ebx, edx
add ebp, edx
mov ecx, dword [edi]
cbw
mul eax
movzx dx, byte ss:[edx + ecx - 0x5a9b87a3]
btc ax, ax
movsx ecx, ax
lea edi, [edi + ecx*4 - 0xa5ca]
btr ecx, 0x13
rol ecx, 0xc2
cbw
mov word [edi + ecx*4 - 0x29730], dx
setb al
rol cx, cl
cdq
jmp ebp
jno 0xbe41f9
xor ebx, eax
lea ecx, [ecx*2 - 0x717d36ef]
mov dword [esp + edx - 0x4a00001], edx
sal ecx, 0x53
adc ebp, eax
lea edx, [edx + ecx*4 + 0x3600e72a]
rdtsc
inc ecx
lea edi, [edi + ecx - 0x48880009]
shl ecx, cl
inc ecx
mov dword [edi + 4], eax
movsx eax, cl
mov dword [edi + eax*8 - 0x18], edx
xchg dword [esp + eax*2 - 6], eax
shl eax, 0xdc
inc dword [esp + eax*2 - 0x20000000]
pop ecx
jns fcn.00b34f20
add edi, 2
call fcn.00d3e377
mov eax, dword [edi]
mov edx, 0x88b9cc2b
and dx, dx
dec dx
mov cl, byte [edi + 4]
adc edi, 2
shl dl, 0x84
sal eax, cl
lea ecx, [edx*2 - 0x11d1cce2]
btr dx, cx
call fcn.00b36b5e
mov ecx, 0x7e9da439
mov eax, 0xefbf49b4
cbw
mov edx, dword [esi + ecx - 0x7e9da439]
rol ecx, cl
add ecx, ecx
sal cx, 0xe1
mov cx, word ss:[edx]
lea edx, [eax + eax + 0x368b439a]
sar edx, 0x6e
sub al, 0xb3
lea esi, [esi + edx*4 - 0x160b2]
shr dx, 2
or dl, 0xb9
inc eax
mov word [esi + edx*8 - 0xb5d8], cx
sub ax, 0x5426
mov ecx, dword [edx + edi - 0x16bb]
sbb dx, ax
sub dl, dh
lea edi, [edx + edi - 0x6b70]
cmovge ax, dx
xor ecx, ebx
xor dx, dx
sal dx, 0xc5
dec ecx
bswap ecx
or al, dh
xor eax, 0x5b213397
not edx
neg ecx
call fcn.00d2b794
mov ecx, 0x21b26fbe
mov eax, dword [edi + ecx - 0x21b26fbe]
movsx edx, cl
mov ecx, dword [edi + ecx*2 - 0x4364df78]
btc edx, 0xb4
sub dl, dh
push ebx
cpuid
sbb edi, 7
jmp 0xc24b2b
lea esi, [esi + eax - 0x7f0ecdf7]
sal ax, 0x4a
jne 0xaab94e
btc cx, 0x26
mov dword [edi + ecx - 0x7f0ecdf9], eax
mov eax, ecx
dec ecx
mov dword [edi + eax - 0x7f0ecdfd], edx
neg cl
mov edx, dword [ecx + esi - 0x7f0ecd04]
rol al, 0x21
jno 0xc0ba0c
Function at 0xa60490
Capabilities:
Encode data using xor

Disassembly:
add byte [eax - 0x3b6b10ea], bh
movsx edx, ax
call fcn.00a7fc26
mov esi, 0x3934b5
sub esi, esi
mov esi, dword [esp + esi + 0xc]
mov dword [esp + 0xc], 0x3b427f85
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.00cb3abd
neg ecx
xor ebx, ecx
sar eax, 0xfc
add esi, ecx
mov ecx, dword [edi + eax - 5]
bts eax, eax
lea edi, [edi + eax*8 - 0x124]
lea ebp, [ebp + eax*4 - 0x95]
lea edx, [eax + eax*8 + 0x1990ef20]
movzx edx, byte [ebp + edx*2 - 0x3321e0da]
call fcn.00c6005e
sub dl, byte [ecx + 0x10]
cmp dh, cl
mov gs, word [ebx - 0x12b1aa00]
mov dword [ebp - 0x60], esp
ja 0xa60482
xchg ecx, eax
and al, 0x1b
fisttp dword [eax - 0x60c68519]
sahf
movsb byte es:[edi], byte gs:[esi]
xor al, 0x91
in al, 0x1b
inc edi
push ds
xchg dword [edx + 0x34], ebp
push esp
fstp xword [edx + 0x11e1251c]
test dword [0xd21eaafc], 0xe5170a3b
invalid

Function at 0xa66f94
Capabilities:
Encode data using xor

Disassembly:
btr ecx, 0x21
xor edx, ebx
not ax
sal cx, 0xc
cwde
neg edx
inc cx
bt ax, cx
dec ecx
dec edx
not ecx
mov dword [esp], ecx
xor edx, 0x5d20be93
push ecx
lea ecx, [ecx*8 + 0xf8ea1bb]
inc edx
cbw
ror edx, 1
imul cx, cx
lea edx, [ecx + edx - 0x2b97e8bf]
shr cx, 0xa1
jb 0xac2094
mov esi, 0xc1242493
movsx ecx, si
mov eax, esi
mov edx, dword [edi + ecx*2 - 0x4926]
lea eax, [ecx + eax*4 + 0x473feb09]
ror cl, 0x81
lea edi, [edi + ecx*2 - 0x498e]
mov esi, edx
jno 0xb1c142
mov edx, 0x2a334135
mov esp, ebp
movzx esi, dl
mov ebx, edx
mov eax, 0xcf0e1524
pop esi
shl edx, 0xc5
popfd
push eax
cwde
mov eax, dword [esp + edx - 0x4668269c]
mov ebx, dword [esp + edx - 0x46682698]
mov dword [esp + edx - 0x4668269c], edx
movzx ecx, dx
not ecx
mov ebp, dword [esp + edx - 0x46682694]
call fcn.00ba7d3d
mov ecx, 0xe9ae5cb1
mov ecx, ebp
mov edx, 0x5922919a
sub dl, 0x16
lea ebp, [ebp + edx - 0x59229188]
movzx eax, dl
mov dword [ebp + edx - 0x59229184], ecx
lea esi, [esi + eax - 0x88]
add edx, edx
shr dl, 0xc6
mov ecx, dword [esi + eax*2 - 0x108]
sar dx, 0x8b
lea eax, [edx + eax*2 + 0x739de4ae]
xor ecx, ebx
bswap ecx
add dl, dh
not dx
ror ecx, 1
lea ecx, [ecx + eax*4 + 0x21345dd1]
rol ecx, 3
neg al
push eax
shl dx, 0xa7
shl edx, 0xa7
xor ebx, ecx
imul dx
xchg dword [esp + eax - 0x25e2d100], edx
add edi, ecx
pop edx
or edx, 0x1d2c48be
adc dl, 0x3c
jg fcn.00cba434
sbb eax, 0xf3cd280
cmp al, 0xf
invalid
mov cl, 0x13
sub dh, byte [eax]
popfd
mov ebx, 0xdd03dcde
or eax, 0xae6decfb
fucomi st(6)
loop 0xa670b1
stosd dword es:[edi], eax
mov cl, 0x93
xor bh, bl
sti
adc dword [eax + eax*4 - 0x101461b4], ebp
pop edx
stosd dword es:[edi], eax
lds ebp, [edx + ebx*4 + 0xf]
bswap ebp
mov dl, 0x9b
cmp al, 0xda
jne 0xa6709a
inc ebx
jecxz 0xa670b4
push ebx
mov bl, 0x53
outsb dx, byte [esi]
cmp al, byte [ebx + 0x49]
lodsd eax, dword [esi]
and eax, edi
jl 0xa670d2
and al, 0x34
add ebp, dword [edi + edi*8 + 0xb]
js 0xa67130
invalid
dec eax
fbld tbyte [ebx]
fimul word [esi + 0x51ff06a5]
std
lahf
mov al, byte [0x4663de25]
nop
das
pop edx
and eax, 0x8e099e5c
sub al, 0x1c
shl dh, cl
invalid
xor ebx, edx
and ax, cx
adc esi, edx
or dword [esp + ecx*2 - 0x1f1ca322], eax
mov dword [esp + ecx - 0xf8e5194], esi
ret 8