joyce8/EMBER2024-capa huggingface dataset:
Function at 0x209dc5c
Capabilities:
Encode data using xor

Disassembly:
mov word [eax + esi - 0xf2], dx
jge 0x36d1f1b
mov dword [esp + eax*2 - 0x1e4], edi
ret 8
movsx edx, cx
mov dword [esp + ecx*2 - 0x414], ebp
ret
shl cl, 0x41
mov dword [esi + ecx*4 - 0x1a2ab380], edx
mov edx, ecx
sal eax, 0x97
not edx
mov eax, dword [ecx + edi - 0x68aace0]
lea edi, [edi + ecx*2 - 0xd1559bc]
call fcn.020af185
pop eax
pop edx
jp fcn.035561cf
dec edx
ror dword [esp + ecx - 0x828b205], cl
not ax
rol edx, 1
xor ebx, edx
sal eax, cl
or cl, byte [esp + ecx - 0x828b205]
sete al
adc ebp, edx
mov dl, byte [esi + ecx*2 - 0x1051652a]
movzx ax, byte [ecx + esi - 0x828b293]
rol cl, 0x46
sar cx, 0x81
lea esi, [esi + ecx*8 - 0x4146c98e]
imul dl
mov word [esi + ecx*2 - 0x1051b264], ax
shr ecx, cl
jne 0x36ca6de
pop ecx
dec eax
xor edx, 0xb72326a9
xor cx, cx
xor edx, ecx
xor ebx, eax
or dx, 0x358f
jns 0x370652f
jbe 0x36cae92
xor eax, 0x4f94240d
bswap edx
call fcn.037827aa
sbb cl, 0x20
adc ebp, edx
call fcn.036d5a67
push 0xddbae521
mov ecx, dword [edi]
add edi, 4
shl byte [esp], 0x23
xor ecx, ebx
inc ecx
neg ecx
shl dword [esp], 0xfc
push 0x82346c08
ror ecx, 3
shl byte [esp + 2], 4
pop eax
sar al, 0xc3
adc ecx, 0xb516d53e
xor ebx, ecx
movzx edx, al
add ebp, ecx
pop ecx
sal ecx, 0xa7
xor ecx, dword [esi + eax + 0x7dbf93ff]
rol al, 0x86
mov eax, dword [eax + esi + 0x7dbf93c4]
shl edx, 0xf8
not dx
jp 0x36ed5fa
lea esi, [esi + edx*4 - 0x403fff4]
setp dl
mov dword [edx + ecx - 0x100ff01], eax
call fcn.03523c86
add ebp, edx
mov ax, word [esi + eax - 0x6b97af5a]
mov edx, 0xa8202a33
mov cl, byte [esi + 2]
sub edx, edx
lea esi, [esi + edx*2 + 2]
dec edx
not dx
call fcn.03542885
ror dl, 1
not dl
call fcn.036e345e
mov edx, dword [esi]
mov eax, 0xd217ad37
lea ecx, [eax + 0x3e9af8b4]
inc cl
lea esi, [esi + ecx*4 - 0x42ca97ac]
sar ax, cl
mov dword [esp + ecx - 0x10b2a5ec], edx
popfd
movzx edx, cx
jmp ebp
adc edi, eax
movzx eax, dl
sal dx, 0x6a
xchg edx, ecx
mov ecx, dword [esi + edx*8 - 0x8c00000]
mov edx, dword [esi + edx*4 - 0x45ffffc]
add ax, ax
not eax
or al, al
adc esi, 8
sal eax, 0xdc
sar al, 0x21
mov dword [eax + ecx - 0x10000000], edx
jmp edi

Function at 0x20c74e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi + ecx*4 - 0x94]
xor eax, ebx
not ecx
xor eax, 0x85b0a019
neg eax
xor eax, 0xaa2681e
push ecx
movzx edx, cx
lea ecx, [ecx*8 - 0x3740a162]
lea eax, [ecx + eax + 0x2ac21e3b]
or dl, 0x91
not eax
sub al, byte [eax - 0x2f086e36]
rol edx, 0x46
dec edx
push edx
ror eax, 3
lea eax, [eax + edx - 0xe46cf4e]
not eax
shr edx, cl
adc dx, word [esp + edx - 0xfe]
mov dword [esp + edx - 0x40ee], edx
xor ebx, eax
add esi, eax
dec word [esp + edx - 0x40f4]
call fcn.036651aa
cmc
dec esi
and ah, byte [eax]
dec esi
mov bh, cl
rcl dword cs:[ebp + 0x2cf707f0], cl
push esp
adc edi, edi
jne 0x20c7508
invalid

Function at 0x20d8f6d
Capabilities:
Encode data using xor

Disassembly:
push 0x4b0db0be
add ebp, 4
mov edx, 0xdf30982e
mov dword [esp + 4], ecx
shl dx, 0x29
push dword [esp + 4]
popfd
pop ecx
lea edi, [edi + ecx - 0x4b0db0c2]
call fcn.03729265
Function at 0x20dcb5a
Capabilities:
Encode data using base64

Disassembly:
inc esi
xor dword [esp + ebx*2 - 0x1cc76], edi
dec eax
shr esi, 0xff
call fcn.01ff1ea5
bswap ecx
inc ecx
xor dx, ax
jne 0x296d0cc
jnp 0x36bb1d4
movlps qword [eax], xmm4
jl 0x296d14d
wait
mov ebp, 0x3a1a768b
xor al, 0x3d
cmpsd dword [esi], dword es:[edi]
mov dword [eax + 0x368a76cb], edx
mov dh, 0xb6
push eax
mov edi, esi
int 0x3f
xchg edx, eax
ja 0x296d153
out dx, eax
and dl, byte [ebx - 0x5c1b548a]
mov dword [edi + 0x5b], ebp
insd dword es:[edi], dx
cmp al, 0x8e
mov dword [ecx - 0x57], ebx
invalid
push esp
adc al, 0xfe
adc ebp, dword [ebx]
wait
ret
call fcn.036f2421
not ecx
shl eax, 0xbd
dec dx
shl edx, 0x8f
xor ebx, ecx
shl ax, 0x4e
xadd eax, edx
adc ebp, ecx
sal al, 0x64
lea esi, [esi + edx - 0x40000001]
movzx edx, byte [esi + edx*2 - 0x80000000]
lea ecx, [eax*4 + 0xf11d303]
xor dl, bl
add dl, 0x1d
sal cl, cl
xor al, ah
or cx, ax
ror dl, 1
neg cx
jne 0x358e2eb

Function at 0x2903367
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp], 0x50518694
call fcn.0366dc85

Function at 0x2926b83
Capabilities:
Encode data using xor

Disassembly:
ror ecx, cl
sub ebp, 4
call fcn.036bc029

Function at 0x2937e27
Capabilities:
Execute syscall

Disassembly:
inc al
xor dword [esp + 6], edx
ror edx, 0x1a
ror al, 1
or edx, 0x1300da19
add edx, edx
ror edx, 0xde
neg al
rol al, 1
call fcn.0379374a
mov ecx, 0x790cd225
sub ecx, ecx
je 0x36d0fdc
mov eax, dword [esi]
mov ecx, 0xe0364a05
lea edi, [ecx + ecx*4 - 0x11f5e967]
lea esi, [edi + esi - 0x4f1988ae]
call fcn.0203c19a

Function at 0x295c806
Capabilities:
Encode data using xor

Disassembly:
ror al, 1
not al
inc al
xor bl, al
lea eax, [esp + eax + 0xc]
movzx cx, byte [eax]
mov edx, dword [esp + 8]
mov dword [esp + edx - 0x5e753987], edx
lea ebp, [edx + ebp - 0x5e753989]
mov word [edx + ebp - 0x5e753987], cx
shl edx, 0xfe
pop eax
pop edx
pop edx
jb fcn.020c8026
adc esi, 4
call fcn.035626e6
mov eax, 0x202f2382
mov eax, dword [edi + eax*2 - 0x405e4704]
mov ecx, dword ss:[eax]
mov edx, 0x603d8a1f
add edx, edx
movsx eax, dl
mov dword [eax + edi - 0x3e], ecx
lea eax, [eax*8 - 0x24c29d71]
adc edx, 0xc48326ad
mov ecx, dword [esi]
call fcn.0352a24a
in al, 0xa7
xor bl, byte [0x716a36f0]
pop esp
in al, dx
insd dword es:[edi], dx
in al, dx
jecxz 0x295c88f
mov dl, 0x40
pop es
mov byte [0x22f3a1b], al
xlatb
arpl word [ebx + 7], si
inc esi
pop eax
xchg ecx, eax
invalid

Function at 0x2966279
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x29c7e1d
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x2923042
je 0x29c7e1d
mov eax, 0x5a4d
test al, 0x83
cmp word [edx], ax
jmp 0x29c7e17
push ebp
mov ebp, esp
shrd edx, edi, 0x9a
mov edx, dword [ebp + 8]
test eax, 0x802e0ea8
lea esp, [esp - 0x114]
stc
cmp al, 0x3a
push esi
test edx, edx
jmp 0x20c2505

Function at 0x2978d2f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, 0x399fe18b
bswap edx
jmp 0x364973f
dec edx
mov dword [esp], 0xec3fc98f
neg edx
bswap edx
ror byte [esp], 0x83
ror edx, 1
xor ebx, edx
jmp 0x36d381c
Function at 0x29a68e8
Capabilities:
Encode data using base64

Disassembly:
add ecx, ecx
mov cl, byte [esi + 8]
adc esi, 6
mov dword [esp], 0xe5166e0a
shld edx, eax, cl
mov dword [esi], edx
mov ecx, 0x6d09c99f
or ecx, ecx
lea ebp, [ebp + ecx - 0x6d09c9a3]
movsx eax, byte [esp + ecx - 0x6d09c99f]
mov ecx, dword [ebp + eax*4 - 0x28]
jne 0x2075f3e
xor ecx, ebx
rol dl, 0x46
not ecx
dec edx
dec ecx
xor ecx, 0x7500eaa1
sar dl, 0x24
movzx eax, dx
not eax
ror ecx, 1
xchg al, dl
add eax, 0x30be6abc
and ax, dx
dec ecx
call fcn.0208d8d7
Function at 0x29c7db1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add edi, ecx
xor al, byte [esp + eax - 0x45aa84ac]
setge dl
push edx
mov si, word [eax + esi - 0x45aa84b5]
and dword [esp + edx*4 - 0x1ff8], eax
mov dword [esp + edx - 0x7fc], edx
movsx ecx, byte [esp + eax - 0x45aa84b3]
pop eax
pop ecx
pop edx
jno fcn.035561cf

Function at 0x29c7df7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec edi
add eax, edx
sub ebx, ebx
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x355b577
jmp 0x20baabd
lea eax, [eax + edx]
cmp dword [eax], 0x4550
jmp 0x20d719b
jne 0x29c7e1d
mov ecx, dword [eax + 0x78]
clc
mov dword [ebp - 4], ecx
cmp edi, 0x768f4b80
test ecx, ecx
jmp 0x2a0e7ad
mov dword [ebp - 8], 0xffffffff
test bp, 0x35a3
clc
cmp esi, 0xffff
jmp 0x35d46df
mov dword [ebp], edx
pop edx
inc eax
push eax
sub edi, 4
call fcn.029b6975
add ebp, 6
mov dword [esp], 0x4fa457a8
shld edx, eax, cl
sub word [esp + 2], 0xbb12
mov eax, dword [esp]
jg 0x295eef1
je 0x358bb49
xor eax, eax
pop esi
jmp 0x350692c
je 0x29c7e1d
mov eax, dword [eax + 0x7c]
cmp esp, ebx
push ebx
clc
push edi
mov dword [ebp - 0x10], eax
cmp bx, sp
test ecx, ebp
jmp 0x295e40a
mov esp, ebp
movzx ebp, si
cmovae ebp, edx
pop ebp
jmp 0x1fe6901
je 0x355b577
mov eax, dword [ecx + edx + 0x20]
jmp 0x20014b7
mov edi, dword [ecx + edx + 0x18]
cmp eax, ebx
test edi, edi
jmp 0x351b851
mov eax, dword [edx + 0x3c]
cmc
cmp bx, cx
jmp 0x200db64
ja 0x354ec86
mov eax, esi
cmc
sub eax, dword [ecx + edx + 0x10]
jmp 0x355b571
Function at 0x29f4d59
Capabilities:
Encode data using xor

Disassembly:
not edx
mov word [edi + ebx*8], cs
fdiv qword [0x948966fb]
dec edi
mov dh, 0xb9
imul esi, esi, 0x66
dec dword [esp + ecx*2 - 0x9944644]
mul byte [esi - 1]
mov word [esp + edi*4 - 0x47], cs
imul esi, esi, 0xffffffe8
dec edx
dec ebx
insd dword es:[edi], dx
inc dword [edx - 0x3f]
inc edx
shl eax, 0x13
call fcn.020c98a3
inc edx
shl eax, 0x13
neg edx
mov dword [esp + eax*2], 0xcf0160a4
rol edx, 3
movsx ecx, al
and byte [esp + eax*4 + 1], al
xor ebx, edx
add ebp, edx
xor word [esp + eax*2 + 5], 0x8b19
call fcn.037768dc
jns 0x29f4d22
push edx
aas
das
fidivr dword [edi + 0x79d1eda5]
and esp, dword [ecx - 0x6b20afd4]
pop esi
mov ebp, 0xd3d183c5
pop esi
sbb dword [ebx], esi
and dword [ecx - 0x761f4712], esp
pop esi
cmp bh, byte [edx - 0x31]
mov bl, byte [ebp - 0x33]
jno 0x29f4d3e
jns 0x29f4d4b
rcr ah, 0x2c
div bl
movsd dword es:[edi], dword [esi]
sar dword [ebx - 0x675f57c4], cl
insb byte es:[edi], dx
mov ecx, 0x1739d5f
invalid

Function at 0x2a03ba4
Capabilities:
Encode data using base64

Disassembly:
rol cl, 0xe3
rol edx, 2
inc edx
neg eax
not edx
ror ecx, 0xe3
setne al
ja 0x352682a
mov eax, dword [esi]
add esi, 4
mov ecx, 0x4f20e220
mov dword [esp + ecx - 0x4f20e220], 0xa010c398
neg dword [esp + ecx - 0x4f20e220]
movzx edx, byte [ecx + edi - 0x4f20e220]
jge 0x370d927
mov edx, dword [ebp + edx*2 - 0x591f8e72]
mov ecx, 0x86048633
movsx eax, cl
xor edx, ebx
jmp 0x293193f
neg edx
xor eax, 0x40183a2d
lea ecx, [ecx + 0x6f2e500f]
neg al
xor ebx, edx
push ecx
add edi, edx
mov dx, word [esi]
xchg cx, ax
ror byte [esp], 1
sar cl, 0x42
mov cl, byte [esi + 2]
sbb eax, dword [esp]
lea esi, [esi + eax*4 - 0x7fe401c2]
or al, al
call fcn.036dbc10
jmp 0x373b9e0
inc dl
dec ecx
sets byte [esp + 3]
ror dl, 1
inc dl
add byte [esp + 4], 0x92
lea ecx, [ecx*8 + 0x7fb19da7]
neg dword [esp + ecx - 0xcbb819b]
neg dl
shr ecx, 0xbb
ja fcn.029fa3ee
adc ecx, 0x2827e8a2
not dl
dec ecx
dec dl
not dl
and dword [esp + ecx - 0x2827e8a3], 0xe683251b
inc dl
call fcn.036fe0fb
mov edx, dword [esi]
mov cx, word [esi + 4]
mov eax, 0x3a9d810b
bswap eax
rol eax, 0x3f
lea esi, [esi + eax*8 - 0x2e0674e2]
mov word [eax + edx - 0x5c0ce9d], cx
shl eax, 0x70
sbb ebp, 4
mov ecx, eax
call fcn.0373bb89
jmp 0x36ae266
lea edi, [edi + ecx - 0x4f20e21f]
xor dl, bl
sal cx, 0xac
push ecx
dec cx
inc dl
xchg dword [esp + ecx - 0x4f20fffd], ecx
and cl, byte [esp + ecx - 0x3c684f1d]
shl ecx, 0xe2
xor dl, 0xa3
jmp 0x36f0488
lea edx, [edx + ecx*2 - 0x19926af]
lea eax, [ecx*4 - 0x795c5357]
push ecx
xor ebx, edx
pop ecx
and ecx, ecx
adc ebp, edx
xadd al, cl
jmp ebp
Function at 0x2a09430
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
sub ebp, 2
not dx
pop ecx
shl edx, 0x3c
mov word [ebp], ax
mov eax, dword [edi]
mov ecx, edx
adc edi, 4
not edx
lea ecx, [edx + ecx*2 + 0x2528e211]
xor eax, ebx
xadd cx, dx
bswap eax
not edx
ror eax, 1
lea edx, [edx + edx - 0x70fce4e3]
bswap eax
dec eax
jmp 0x364e98a
add ecx, edx
rol edx, 0xbd
not eax
and dx, 0x9d3d
lea eax, [eax + ecx - 0x610a826f]
xadd dl, cl
jg 0x36f2f8b
mov eax, 0x6a272abb
lea ebp, [ebp + eax - 0x6a272abf]
mov ecx, eax
shl ax, 0x89
neg eax
mov ecx, dword [ebp + ecx - 0x6a272abb]
not al
movzx edx, al
xor ecx, ebx
jmp 0x36bbfba
push ecx
xor eax, 0x8b335980
call fcn.0354481a
mov ecx, edx
ror eax, 1
lea eax, [eax + edx + 0x2af34107]
ror eax, 1
inc eax
sar edx, 0xcf
sub byte [esp + ecx - 0x51146528], cl
or dx, dx
xor ebx, eax
rol dl, 1
lea ecx, [edx*8 - 0xe740568]
adc edi, eax
call fcn.029d9eb7

Function at 0x2a0ba69
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword fs:[ecx]
call fcn.036f67ad
xor al, byte [ecx]
and dh, byte [edi + 0x5f]
sbb ch, bl
xor al, 0xd8
pop edi
fild qword [eax - 0x2d]
sahf
invalid
Function at 0x3547327
Capabilities:
Encode data using xor

Disassembly:
sar ecx, 0x99
adc eax, 0xb31a613a
neg eax
dec eax
call fcn.02a047e9
imul ecx, dword [eax], 0xc2492042
add dword [0xe7321a7a], ebp
xor al, 0x35
mov dl, 0x20
rcl ebx, cl
jae 0x20b7af9
dec eax
dec edx
hlt
ficomp word [esi + 0x7a345305]
shl dword [esp + esi*4 + 0x25], 0xb5
or eax, 0x5a531e61
or ecx, edx
sub eax, 0x89380292
adc al, 0x94
xor bl, byte [eax + edi*8 - 0x6d]
call 0xe89d31d6
inc ecx
scasb al, byte es:[edi]
test al, 4
add al, byte [edi]
add byte [0x52fa426c], 0xe1
xor dword [ecx - 0x76550733], 0x8d9dcb4a
enter 0x4b07, 0x55
mov edi, 0xe7932d49
mov ebx, 0x993aaab6
loopne 0x20b7b80
push cs
stosb byte es:[edi], al
loope 0x20b7ba5
sub edi, esp
loop 0x20b7b09
adc ebx, edx
xor eax, 0xe76c1db6
mov ebx, 0x4d73aeb6
cli
test eax, 0xbd2fd08d
mov ebp, cs
mov dword [ebx], edi
insd dword es:[edi], dx
cmp al, dl
insb byte es:[edi], dx
in al, 0xcb
fimul word [edi]
mov dword [edi], ebp
sub eax, 0xeee469a1
xor al, 0x57
pop edi
aas
jmp 0x20b7bb4
cmp al, 0x76
pop ss
xlatb
or esi, dword [edi + 0xa28b324]
fstp xword [eax + edx]
test al, 0xb1
insd dword es:[edi], dx
dec ebp
ficom word [edi + 0x10]
into
or cl, ch
push edi
and dl, byte [edx - 7]
aad 0xe8
sahf
add byte [ebx + 0xe], 0xd7
inc ecx
sbb bh, byte [ecx]
hlt
jnp 0x20b7bcc
mov esi, 0xd6334934
add bh, bl
sbb edx, dword [edi + 0x3c3e129]
xor al, 0xa9
in eax, 0xfd
jb 0x20b7bc3
push esi
dec esp
invalid
aaa
int 0x56
and eax, 0xe9f1c6ba
cmc
sbb bh, byte [edx + ebp - 0x2a]
fsubr dword [ebx - 0x46d6ff9d]
mov dword [esp], 0x171e561d
mov edx, dword [esi]
sar dword [esp], 0x3a
jns 0x364d649
mov edx, 0x24a2168d
movsx eax, dl
sal edx, 0x31
mov ecx, dword [edi + edx*2 - 0x5a340000]
add ax, ax
mov edx, dword [edi + edx - 0x2d19fffc]
and ax, ax
dec ax
adc edi, 8
and al, ah
inc ax
mov dword fs:[ecx], edx
shr eax, 0x36
lea esi, [eax + esi - 0x403]
mov ecx, dword [esi + eax*8 - 0x1ff8]
push eax
xor ecx, ebx
sub ecx, 0xe18dea98
add eax, eax
add dword [esp + eax - 0x7fe], eax
movzx edx, al
neg ecx
pop edx
and dx, 0xfea4
inc ecx
xadd al, dh
neg ecx
bswap edx
xor ebx, ecx
neg ax
call fcn.036ed9c4
xor edx, ebx
call fcn.02084891
push 0xf6220c8a
adc esi, 4
div ecx
mov ecx, 0xfe170ea9
ror ecx, 0x74
jb 0x29b7208
mov dword [esi + ecx - 0x70ea9fe1], edx
mov dword [esi + ecx - 0x70ea9fdd], eax
mov eax, dword [ecx + edi - 0x70ea9fe1]
push ecx
lea edi, [edi + ecx - 0x70ea9fdd]
xor eax, ebx
xchg word [esp + ecx - 0x70ea9fe0], cx
or word [esp + ecx - 0x70eaea9a], 0x6f89
not eax
jp 0x20b7a9a
mov byte [esi], 0x1d
and esi, esp
int3
mov eax, 0x7cac9803
mov eax, dword [esi + eax - 0x7cac97ff]
mov ecx, 0xb6ae4807
not word [esp + 1]
mov ecx, dword [esi + 8]
add esi, 4
jmp fcn.035395a2
Function at 0x3575879
Capabilities:
Encode data using xor

Disassembly:
not edx
ror edx, 2
bswap ecx
xor ebx, edx
mov dword [esp + eax*2 - 0x6c000000], eax
call fcn.0295e472
push edi
xor al, 0x86
add byte [esi - 0x3c], al
xchg edi, eax
call dword [edi - 6]
cli
or dword [ecx], eax
salc
mov eax, 0xab068abe
movsb byte es:[edi], byte cs:[esi]
inc byte [edx + edx*2 - 0x1ff3800]
dec eax
jnp 0x3575882
add al, byte [edi]
adc ebp, dword [ebp - 0x32]
and byte [ebx], al
or eax, 0xffcb7125
or dl, byte [edx - 0x2b20fe5a]
sub eax, 0x5606b795
push edx
sar esi, 1
cmp byte [ecx + 0x1dee9c54], cl
push edi
fadd qword [eax]
outsd dx, dword [esi]
in eax, dx
mov ah, 0xcd
int3

Function at 0x3577f4e
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x23
add bh, bh
jmp dword [0x4ab4181b]
or al, 0x9e
adc eax, ecx
rol edx, 1
rol ax, 0x27
inc edx
ror edx, 2
lea edx, [ecx + edx + 0x770b2b6d]
mov dword [esp + eax - 0x47247770], ecx
call fcn.02903239
fbld tbyte [edx - 0x61]
mov byte [ebx], al
pop es
test ebp, ebp
ja 0x3577eed
mov word [eax + edx*4], es
mov bl, bl
mov eax, 0x38b2cae8
invalid
xchg edi, eax
jbe 0x3577f77
aad 0x47
jbe 0x3577ffc
jbe 0x3577fea
push ebp
imul ecx, dword [ecx - 0x75455c32], 0x46
hlt
xchg esp, eax
pop ebx
ja 0x3577f62
ficom word [0x82141ab9]
inc edi
cmpsd dword [esi], dword es:[edi]
mov al, 0x40
call [ebx + 0x7f]
hlt
adc eax, 0xc47dfc9e
push 0xf4c40350
retf
neg byte [eax - 0x66]
jbe 0x357802a
sub dword [ebx], esp
jp 0x3577fb6
mov dword [edi + 0x5f8a608c], eax
invalid
fdivr dword [esi + esi*2 - 0x48]
stosb byte es:[edi], al
add al, 0x41
mov edx, 0x6a797c89
mov ebp, edi
mov edx, dword [ebx + edi*8]
pop edi
xor byte [edi], dl
pop ds
ficomp word [ecx - 0x77876375]
test al, 0xf6
xchg ecx, eax
mov eax, 0x4376bfb0
jl 0x3578077
fstp xword [ebx - 7]
xor byte [eax + 0xa], al
sar eax, 0x24
int3
out 0xa0, eax
cld
aaa
push edi
imul ebx, dword fs:[ebp + 3], 0xffffff85
adc dword [eax], edi
add edx, esi
cmc
cwde
mov ecx, esp
xor dword [edx + eax*8 + 0x20d66289], ebp
in eax, 0x8a
mov ebx, 0x7427a995
adc eax, dword [ecx]
mov esi, dword [esi + 0x1672cf75]
mov ah, byte [ecx]
adc ebp, dword [0x38a3baa]
in eax, dx
fisttp dword [edx + 0x75df09fc]
invalid
Function at 0x358f31a
Capabilities:
Encode data using xor

Disassembly:
push 0x29a6e918
lea esp, [esp + 4]
jne 0x358f331
mov eax, dword [ebp]
push 0x8aaf0a9a
lea esp, [esp + 4]
call eax
push 0x2009f69b
mov edx, dword [esp]
mov ebp, dword [ebp + edx*2 - 0x4013ed3a]
mov dword [ebp + edx*2 - 0x4013ed36], eax
mov esi, ebp
movzx ecx, word [esp + edx*2 - 0x4013ed36]
or dword [esp + edx - 0x2009f69b], edx
lea ebx, [edx + edx*2 - 0x1fd4df67]
mov ebx, dword [esp + edx - 0x2009f697]
movsx eax, dx
mov ebp, dword [esp + edx - 0x2009f693]
and dword [esp + edx*2 - 0x4013ed36], edx
push eax
sar eax, 0x4f
mov edi, dword [esp + ecx - 0xf68b]
call fcn.03653943
mov edx, 0x759d480b
mov cx, word [esi + edx - 0x759d480b]
lea esi, [esi + edx - 0x759d4809]
neg dx
push edx
lea ebp, [ebp + edx - 0x759db7f6]
movzx eax, byte [ebp + edx - 0x759db7f5]
xor al, bl
add byte [esp + edx - 0x759db7f3], dl
call fcn.036d51b6
movzx edx, cl
push edx
lea ebp, [ebp + ecx - 0x6fc11f7b]
setae byte [esp + ecx - 0x6fc11f77]
mov edx, dword [ebp + ecx - 0x6fc11f77]
jno 0x373b1e1
pop es
xchg ecx, eax
and al, 0x20
lahf
cli
pop ss
push cs
ror esi, cl
mov edi, ebp
mov word [ebx + 0x5e], cs
cmc
sbb ebp, dword [0xd0456d25]
jl 0x2029a89
lcall 0xddc, 0xd3c9171d
push edx
dec edx
mov bl, 0x9b
invalid
sbb byte [edi - 0x2050d736], bh
or ch, byte [0xb491c56e]
mov dword [ecx], edi
jns 0x2029acb
dec ecx
xor al, 0x11
cmp byte [ecx - 0x4c], 0x6a
pop eax
clc
mov ebx, 0x56e1ea54
xlatb
insb byte es:[edi], dx
call 0x43bc5169
std
mov edi, 0x2b8ebd5d
std
aam 0xbb
inc ebp
cli
invalid
invalid
mov dword [ebp - 4], eax
mov dword [esp], 0xc61afabc
test ebx, ebx
lea esp, [esp + 4]
je 0x2029983
mov eax, 0xa7286c0d
mov eax, dword [ebp + ebx*4]
push 0xfe0cae21
mov dword [esp], eax
dec ebx
jmp 0x2029974
xor edx, ebx
call fcn.028faa72

Function at 0x359ae04
Capabilities:
Authenticate hmac

Disassembly:
bswap edx
inc eax
lea edx, [edx + ecx - 0x7ad67ebe]
mov byte [esp + 1], 0x36
bswap edx
seto byte [esp]
lea eax, [eax + ecx*2 - 0x425a41fe]
xor ebx, edx
neg cl
lea ecx, [ecx*2 + 0x131afeaf]
lea ebp, [eax + ebp - 0x5db84e]
inc cx
mov dword [eax + ebp - 0x5db84a], edx
sar eax, cl
pop eax
jns fcn.035875e2
xor ebx, ecx
pop edx
movsx edx, al
push eax
add esi, ecx
and word [esp + 1], ax
sbb edi, 4
bswap eax
shl byte [esp + 3], 0xc1
mov edx, dword [edi]
je 0x3789e15
mov ecx, eax
xor edx, ebx
neg cx
and eax, eax
sbb edx, 0x92a1caaa
rol dword [esp], cl
setb al
xor word [esp], ax
ror edx, 1
or eax, ecx
and byte [esp + 2], cl
jnp 0x291ef20
rol dx, 0xe4
dec cx
xor eax, 0x2a54c18
sub dx, dx
ror eax, 3
or cl, dh
call fcn.036e8def

Function at 0x35a6eec
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xf70fc2ca
call fcn.020cbcd9
Function at 0x35b2cee
Capabilities:
Encode data using xor

Disassembly:
neg byte [esp + 2]
movsx ecx, al
lea ebp, [ecx + ebp - 0x1a]
lea ecx, [eax + ecx*2 - 0xdc1a776]
mov edx, dword [ebp]
xor edx, ebx
sub eax, eax
xor edx, 0x73b6e020
neg ax
sbb dword [esp + eax*2], 0x61988596
ror edx, 1
lea edx, [edx + ecx - 0x1caeb138]
xor ecx, ecx
rol edx, 1
inc cl
jg 0x36daa22
and dword [esp + 1], 0x4f26c233
pop eax
pop edx
jmp esi
lahf
das
loope 0x35b2d3d
wait
pop ds
adc al, 0xa7
mov dword [esp + 4], edi
lea esp, [esp + 4]
sub dl, 0x21
ror dl, 1
add dl, 0x23
pop eax
mov eax, 0xf62c5216
ror dl, 1
xor bl, dl
lea edx, [esp + edx + 4]
rol dword [esp], 0xbf
and al, 0xbf
mov word [edx], cx
jae 0x2a27b5b
call [esi - 0x7bdeea84]
add ecx, dword [eax - 0x6d3dd284]
sahf
jl 0x35b2d29
and dword [ebx + eax - 0x3dd28378], eax
xchg edx, eax
out 0xb4, eax
in eax, 0x35
jne 0x35b2d87
aas
xor al, 0x91
mov eax, dword [0x868eb408]
add dword ds:[edx + 0x53], esi
xchg byte [esi], bh
add dword [edx + 0x53], esi
xchg ecx, eax
mov esi, 0x78984be0
mov esi, 0xb2ca188
outsb dx, byte [esi]
inc eax
js 0x35b2d10
sbb bl, byte [ebp - 0x48]
cli
dec ebx
mov ah, byte [edx - 0x3676d293]
loope 0x35b2cd1
or dh, byte [esi + eax]
add dword [eax - 0x41], 0x245a40d3
dec edx
idiv dword [edi]
jg 0x35b2d06
cld
retf 0x699b
inc eax
invalid
outsd dx, dword [esi]
sbb dl, dh
call eax
sbb bh, 0xf
imul ecx, dword [ecx], 0xffffff87
std
mov al, byte [0xab52f6d7]
pop edi
outsb dx, byte [esi]
inc esi
sub cl, bl
cld
in al, dx
out 0x21, eax
jp 0x35b2d6c
xor dh, byte [edi - 0x319a12fa]
test ax, 0x440e
mov word [edi + 0x1583140f], ss
cmp al, 0xd3
invalid
dec ax
lea edx, [edx + eax*2 - 0x5205b924]
lea ecx, [ecx + eax + 0x219c9d8e]
sar eax, 0x99
sets byte [esp + eax*4]
xor ebx, edx
or ax, cx
adc edi, edx
lea edx, [ecx*4 - 0x7a6722d8]
jmp 0x36a450d
Function at 0x35c14b1
Capabilities:
Encode data using xor

Disassembly:
add ebp, 4
call fcn.03737cee
or byte [edi], ch
jb 0x35c14e1
sti
cmp eax, 0x70d27eae
adc eax, 0x912da766
salc
sahf
and eax, 0xb28401b5
ror edx, cl
retf 0xa1e2
mov ah, 0xec
xor al, 0x74
mov esp, dword [ebx]
xor al, 0x90
dec edi
adc al, 0xb4
movhps qword [edi + 0x536eef], xmm5
push eax
cld
outsb dx, byte [esi]
push ebx
add byte [eax - 4], dl
dec ebx
loope 0x35c14e1
das
mov bp, 0x4a2c
das
scasb al, byte es:[edi]
rcl ebx, cl
xchg esp, eax
push esi
out 0x4b, al
inc ebx
dec esp
jno 0x35c1537
js 0x35c1504
shr byte [ecx + 0x16], 1
xor al, 0xef
push 0xa9d3a3ae
mov ah, 0x38
dec edx
dec esi
jle 0x35c1574
pop eax
sbb bl, al
dec edx
jmp fcn.035c82aa
fnsave dword [ebp + 0x57f42364]
cwde
pop ebp
js 0x35c151b
push ebp
dec ebp
mov al, 0x4d
cmp dword [esi + esi*8 - 0x2287169], esi
pop edi
jb 0x35c14f0
dec ecx
movsb byte es:[edi], byte [esi]
sub byte [ecx - 0x10], 0xc2
jbe 0x35c156d
outsd dx, dword [esi]
dec edx
adc edi, dword [ebx + 0x7b]
retf 0xf0ba
push 0x35409ffb
add al, 0x5f
cld
frstor dword [ebx + ebp*8 + 0x3a]
sbb dword [esi], ebx
pop esi
or byte [esi - 0x14a5f0c], 0x60
loopne 0x35c15b8
dec ebx
je 0x35c15ec
mov ah, 0xfc
dec ebx
push 0x56b18639
jle 0x35c1537
or ch, dh
inc esp
sub dh, al
xor byte [eax], dh
mov edx, 0x28b193ee
sub byte [ecx - 0x392aa783], bh
invalid
sub esi, dword [edi]
add dl, byte [edi]
xlatb
xor eax, 0x9f687834
pop ebx
xchg ebx, eax
push ebp
mov eax, dword [0x2bfd1540]
push cs
mov ebx, 0xdf150bbe
aaa
and al, bh
mov al, 0xd1
and byte [ebp + 0x4944186d], 0x11
cwde
test dword [ebx], ecx
mov dword [0x4872d0b7], eax
call 0x7df65d69
push ebx
adc dl, byte [eax - 0x23]
and al, 0x6f
frstor dword [edi + ebp*2]
sbb dword [ebp + 0x56], esi
test eax, 0xa5214103
ret