joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d7538
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7d7714
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0xb9], 0
mov byte [ebx + 0xb8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jle 0x7d7582
mov esi, dword [ebp - 4]
movzx esi, word [esi + 0x10]
jmp 0x7d7584
xor esi, esi
push 0
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040b0c4
push eax
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0xb0]
push eax
call sub.winhttp.dll_WinHttpConnect
mov edi, eax
mov dword [ebx + 0xa0], edi
test edi, edi
jne 0x7d75d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x875a78]
mov dl, 1
mov eax, dword [0x7da338]
call fcn.0042f5f0
call fcn.00409c14
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0x7d7730
call fcn.0040b4c0
jne 0x7d75f1
or esi, 0x800000
push esi
push 0
push 0
push 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.007d5c44
mov eax, dword [ebp - 0x10]
call fcn.0040b0c4
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.007c8114
mov eax, dword [ebp - 0x14]
call fcn.0040b0c4
push eax
mov eax, dword [ebx + 0xa0]
push eax
call sub.winhttp.dll_WinHttpOpenRequest
mov edi, eax
mov dword [ebx + 0xa4], edi
test edi, edi
jne 0x7d767d
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x28]
mov edx, dword [0x87e9e8]
call fcn.0042da60
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [0x876340]
mov dl, 1
mov eax, dword [0x7da338]
call fcn.0042f5f0
call fcn.00409c14
mov eax, dword [ebx + 0x14]
push eax
mov eax, ebx
call fcn.007c8268
push eax
mov esi, dword [ebx + 0xc]
push esi
push esi
mov eax, dword [ebx + 0xa4]
push eax
call sub.winhttp.dll_WinHttpSetTimeouts
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x7d76ea
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x2c]
mov edx, dword [0x87e9e8]
call fcn.0042da60
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [0x8765f8]
mov dl, 1
mov eax, dword [0x7da338]
call fcn.0042f5f0
call fcn.00409c14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7d771b
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0040a5b8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040a5b8
pop eax
jmp eax
Function at 0x7f9674
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x7f973f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov ecx, dword [ecx]
mov eax, ecx
test eax, eax
je 0x7f969b
sub eax, 4
mov eax, dword [eax]
mov edx, eax
test edx, edx
jns 0x7f96a6
call fcn.004082b0
mov eax, ecx
mov ecx, edx
add ecx, ecx
add ecx, eax
cmp ecx, eax
jbe 0x7f96c4
movzx ebx, word [eax]
xor edx, ebx
imul edx, edx, 0x1000193
add eax, 2
cmp ecx, eax
ja 0x7f96b2
mov ebx, edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.007feb2c
test al, al
je 0x7f970f
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.007fde80
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
call fcn.0040b4c0
jne 0x7f9727
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call fcn.0040a948
jmp 0x7f9727
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.007fe738
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7f9746
lea eax, [ebp - 4]
call fcn.0040a558
pop eax
jmp eax
Function at 0x811f38
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.008148e4
mov esi, eax
mov eax, ebx
call fcn.00811f84
test esi, esi
je 0x811f7e
push esi
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, 0x7d0
push eax
push ebx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x811f7e
mov eax, 1
push eax
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle
pop esi
pop ebx
ret

Function at 0x8282bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x87ef24], 0
jne 0x8282d3
call fcn.00828278
mov eax, edi
dec eax
test eax, eax
jl 0x8282fb
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x87eb24]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x8282dd
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x82b354
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x82b385
dec al
je 0x82b3c0
dec al
je 0x82b404
dec al
je 0x82b476
jmp 0x82b511
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x82b511
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x82b395
jmp 0x82b511
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x82b511
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x82b3d0
jmp 0x82b511
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x82b511
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x82b437
xor edx, edx
mov dword [esp + 4], edx
jmp 0x82b44c
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x82b464
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x82b414
jmp 0x82b511
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x82b511
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x82b4dd
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.00828304
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x82b492
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x834608
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
test byte [esp + 0x11], 0x80
setne al
add esp, 0x100
ret

Function at 0x834624
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
call sub.user32.dll_GetKeyboardState
movzx eax, bl
test byte [esp + eax], 0x80
setne al
add esp, 0x100
pop ebx
ret
Function at 0x836c88
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathW
mov edx, ebx
mov eax, esp
call fcn.00428efc
add esp, 0x20c
pop ebx
ret
Function at 0x83c73c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040a64c
mov eax, dword [ebp - 8]
call fcn.0040a64c
lea esi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x83c80b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.00407e94
mov dword [esi], 0x3c
mov dword [esi + 8], ebx
mov dword [esi + 4], 0x440
mov eax, 0x83c818
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0040b0c4
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.0040b0c4
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], 1
push esi
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x83c7bf
call fcn.00431cac
cmp dword [esi + 0x38], 0
je 0x83c7ee
jmp 0x83c7d3
mov eax, dword [0x8766bc]
mov eax, dword [eax]
call fcn.005f90c8
push 0x32
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x83c7c7
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83c812
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a5b8
pop eax
jmp eax
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0xb9738d
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00b9738d
ret
Function at 0x7485c4
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
inc esp
or ebp, ebx
dec esp
mov dword [esp + edi - 0xff90], edx
inc ecx
not esp
xor dword [esp + edi*8 - 0x7fcb8], edx
pop ebp
jmp 0x8803b8
inc cx
movzx ebx, byte [esi + edi - 7]
dec eax
lea edx, [eax*4 + 0x210b2889]
mov word [esp + edi - 6], di
jbe 0x86604a
xor esi, 0x1218c7b2
dec edx
xchg dword [esp + ebp - 0x26d5], ebp
jmp 0x7ef6fd
dec esp
mov dword [esp + edi*8 - 0x38], ebx
ret
dec esi
mov dword [esp + ebp*4 - 0x9b84], edx
inc edx
xor dword [esp + ebp*4 - 0x9b84], esi
dec esi
mov edx, dword [esp + ebp - 0x26d5]
call fcn.007f5e2d
inc ecx
mov cl, byte [esi + edi*4 - 0x1a]
dec esi
lea edi, [ecx*4 + 0x1b2278ac]
shr dl, 0x67
dec ebp
lea esi, [esi + edi - 5]
inc ecx
inc bh
shr bl, cl
inc cx
mov dword [esi + edi*2 - 0xe], ebx
rol dword [esp + edi*2 - 0xe], 0xf3
jae 0x7c3bc0
call fcn.00761f93
fyl2x
xchg ebx, eax
stosb byte es:[edi], al
rcr ecx, 0xef
lodsd eax, dword [esi]
invalid
inc ebp
mov ecx, ebp
inc ecx
pop edx
dec eax
arpl dx, dx
inc ecx
push ecx
dec esp
add ebx, edx
inc ecx
xor cl, 0x99
dec eax
sar edi, cl
jns 0x790c15

Function at 0x74e3b1
Capabilities:
Get number of processors

Disassembly:
dec ebp
lea esi, [esi + edx - 0x3637fd9c]
inc ecx
mov dword [esi + edx*2 - 0x6c6ffb30], eax
push edx
dec eax
neg ebp
inc ecx
mov ecx, dword [eax + edx*2 - 0x6c6ffb30]
dec ebp
lea eax, [eax + edx - 0x3637fd94]
inc ebp
movzx ebp, ah
dec edx
mov dword [esp - 0x3637fd90], 0xc321ee01
inc ecx
xor ecx, edx
inc ecx
call fcn.007f8eca

Function at 0x74e3ef
Capabilities:
Get number of processors

Disassembly:
dec eax
sar eax, 0x92
inc ecx
bswap esp
jae 0x7f0f51
mov ecx, 0xc685e7a6
inc ecx
movzx eax, byte [eax]
movzx edi, cl
inc esp
movsx esp, cx
inc ecx
mov ecx, 0x7814ccac
inc ecx
xor al, dl
rol al, 1
inc ecx
mov ebx, ecx
xor al, 0x8c
inc ebp
movzx edi, cx
dec al
xor al, 0x2a
mov esi, 0x18391e13
dec cl
rol al, 1
jmp 0x7ec4ff
call fcn.00795cf2
add edx, esp
mov ecx, 0xbc347c90
shl ecx, cl
mov dword [edx + ecx - 0x7c900000], eax
rdtsc
inc cx
xor cx, 0x7c30
not cl
mov dword [ebp + ecx - 0x7c907cce], eax
push ecx
push ecx
lea ecx, [ecx*2 - 0x2a7c51fb]
mov dword [ebp - 4], edx
movzx edx, cx
lea ebp, [ebp + edx - 0xa7a5]
je 0x786eb5
pop ecx
pop eax
jne fcn.007541d4

Function at 0x7565cc
Capabilities:
Encode data using xor

Disassembly:
inc dx
mov dword [ebx + esi - 0x49201ab1], edi
call fcn.0074710b
Function at 0x756bc4
Capabilities:
Encode data using base64

Disassembly:
sar eax, 0x14
neg ecx
pop edx
lea edx, [eax + eax - 0x45c68144]
xor ax, dx
xor ebx, ecx
push eax
shl edx, 0x3f
add esi, ecx
not dl
mov eax, dword [ebp + edx - 0xff]
sal dx, 0x8d
shr edx, 0xfb
bswap edx
mov dword [esp + edx*8], ebx
cpuid
je 0x822fa9
sbb ebp, 0xc
mov dword [ebp + 0xc], eax
mov eax, 0x8e9c1bbb
or al, ah
call fcn.007409d2
inc esp
mov ebp, ecx
dec ebp
lea eax, [eax + ecx*2 - 0x5a5ef266]
and cl, bh
inc ebp
xor edi, edx
dec byte [esp + ecx*2 - 0x5a5ef1fa]
inc ecx
neg edi
neg word [esp + ecx - 0x2d2f78fc]
dec ecx
cmovp ebx, esp
inc ecx
bswap edi
dec eax
rol ebp, 0x87
inc ecx
neg edi
shr ebp, 0x9e
inc ecx
not edi
inc cx
not ecx
ror ecx, 0x3d
dec esp
mov dword [esp + ecx - 0x697bc801], edx
call fcn.00833e62

Function at 0x760e2b
Capabilities:
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
movsx eax, dx
call fcn.0074bf61
rol eax, 0x53
rol dx, 1
movzx ecx, ax
jmp 0x81ac2f
pop edx
inc ecx
pop esp
pop edi
inc ecx
pop ecx
inc ecx
pop ecx
pop edx
jne fcn.008764ee
mov edx, 0x1995e815
lea ecx, [edx + edx*4 + 0x45946286]
mov eax, dword [ebp + edx*4 - 0x6657a054]
add dl, dl
mov cx, word [eax + edx - 0x1995e82a]
lea ebp, [ebp + edx - 0x1995e828]
jae 0x73ca92
neg dx
xadd dword [esp + ecx - 0xb867], ecx
sub ax, 0x79a4
rol al, 0xe1
sub dx, 0xfaa5
jmp fcn.007e4291

Function at 0x7652e2
Capabilities:
Encode data using xor

Disassembly:
inc esp
movsx ebp, bl
inc ecx
mov dword [esi + edi - 0x752dcbb1], edx
inc edx
mov dword [ecx + esi - 0xf0e9], eax
inc esp
movzx edi, cx
dec esp
mov dword [esp + edi - 0x752dcbb1], esp
add word [esp + ecx*2 - 0x1e1d8], di
inc edx
mov ecx, dword [edi + eax - 0x752dcbb1]
movsx edx, bl
call fcn.0079775d
outsb dx, byte [esi]
or edx, ecx
popal
sbb ecx, edi
push esp
sti
mov byte [0x54437076], al
test dl, al
arpl word [edx - 0x612d1b60], bp
stosb byte es:[edi], al
in al, 0xe8
ficomp word [esi - 0x137355ca]
ficomp dword [esi - 0x273355ca]
out dx, al
sahf
stosb byte es:[edi], al
fadd qword [eax - 0x55d330c7]
xor dword [ebp + 0x3c], eax
aad 0x55
dec eax
das
loopne 0x76533c
stosb byte es:[edi], al
int3
hlt

Function at 0x7659ff
Capabilities:
Encode data using xor

Disassembly:
movzx dx, byte [ebp]
mov dword [esp], eax
movsx ecx, ax
call fcn.0087a5b6
mov bl, 0xcb
arpl word [edx - 0x68724421], bp
stosb byte es:[edi], al
invalid
Function at 0x767995
Capabilities:
Encode data using xor

Disassembly:
and al, 0x31
invalid
mov dword [ecx + eax - 0x65853e1c], edx
jp 0x5bb25f
jnp 0x807f5e
push 0x18aa4e23
sub al, 0x1a
jg 0x5bb2ef
stosb byte es:[edi], al
pop esp
or al, 0x3a
jg 0x5bb2f5
stosb byte es:[edi], al
jo 0x5bb339
push 0x7f
sbb ebp, dword [edx + 0x7f3e0804]
sbb ebp, dword [edx - 0x5150a3c8]
push ds
stosb byte es:[edi], al
push ebx
das
mov eax, 0xe78b6b6
or byte [ebp - 0x76f9d5ae], ah
push esp
aas
aas
movsd dword es:[edi], dword [esi]
push edx
sub al, byte [esi]
mov dword [edi + edi + 0x3f], edx
mov al, 0x31
invalid
mov dl, 0x50
leave
jo 0x5bb2c3
cdq
xchg edx, eax
sar ebp, 1
xchg esi, eax
cmc
and esi, ebp
sar ebp, 1
xchg esi, eax
fldenv [0x96fdd18a]
or eax, 0x9c3c1639
xchg esi, eax
bnd jle 0x5bb3d3
test ebp, edx
stc
and cl, byte [esi - 0x56]
aad 0xfd
retf
in al, dx
push esp
stosb byte es:[edi], al
invalid
xor eax, 0xeb10888f
xor bl, cl
neg eax
lea eax, [eax*2 + 0x7f04318b]
add eax, 0x2abbed2b
lea ecx, [esp + ecx + 4]
jge 0x5bb2be
push edi
pushfd
mov edi, 0xbd8d8a26
call fcn.005c303e
sar cl, 0xe1
adc word [esp + ecx - 0x3f8f9009], cx
adc eax, edx
movzx edx, word [esp + ecx - 0x3f8f900a]
mov dword [ebp + ecx - 0x3f8f9004], eax
lea eax, [ecx + ecx*2 - 0x574b17cc]
lea ebp, [ecx + ebp - 0x3f8f9004]
mov ecx, dword [edi + ecx*2 - 0x7f1f2014]
pop eax
ror edx, 0xa7
jae 0x767800
add esi, ecx
shl word [esp + eax - 0xc2], 2
sbb edx, 0x3913b191
ror word [esp + eax - 0xc1], 0x62
mov dword [esp + eax - 0xc2], esi
ret
mov dword [esp + eax - 0x490df8c2], eax
rol cl, 1
not cl
sar dword [esp + eax - 0x490df8c2], 0xaf
jp 0x7c1552
ror cl, 1
jmp 0x742159
Function at 0x77ab36
Capabilities:
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions
Parse pe header

Disassembly:
dec eax
mov dword [esp + ebx - 0x67e8], 0x54826027
dec esp
mov dword [esp + ebx*2 - 0xcfe8], edx
sal byte [esp + ebx - 0x67e9], 0xa1
jp 0x7edde5
dec ecx
mov edx, dword [esi]
mov ebp, 0xf9b4a099
dec ecx
add esi, 8
push edx
inc esp
movsx ecx, ch
popfd
jmp 0x77ccf4
inc ecx
mov ebx, dword [eax]
inc eax
movsx eax, ch
inc ecx
sar ecx, 0x50
dec ecx
add eax, 4
inc ecx
xor ebx, edx
jmp 0x848537
dec ecx
sbb edi, ecx
xor dword [esp + ebx - 0x67e8], eax
pop ebp
inc ecx
push esp
dec esp
mov edx, dword [esp + ebx - 0x67e8]
dec esp
lea esp, [edi + ebx*2 + 0x210a8824]
dec eax
sub edx, ebx
dec eax
arpl ax, ax
inc ecx
sets ch
dec esp
adc ebx, eax
push ebx
dec ecx
lea ebp, [esi + ebx*4 - 0x19ffe]
inc esp
add ah, byte [esp + ebx - 0x67f7]
dec ecx
mov dword [esi + ebx*8 - 0x34006], ebp
dec eax
mov eax, dword [esp + 0x10]
dec eax
adc eax, 0xfff408c4
jmp eax

Function at 0x783554
Capabilities:
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
dec ebx
lea ecx, [edi + ecx*4 - 0x4ee3f6ff]
dec ecx
xor edx, 0x1218c7b2
dec edx
mov dword [esp], esi
pop ecx
inc ebp
xadd cl, bh
dec esi
mov dword [esp + 8], edx
inc edx
xor dword [esp + 8], edx
dec esi
mov edx, dword [esp + 8]
dec eax
arpl dx, dx
call fcn.00817266

Function at 0x7948a8
Capabilities:
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
dec ecx
xor eax, edx
inc bp
or edi, ecx
call fcn.0087dd09
dec eax
arpl dx, dx
inc ecx
pop esp
dec esp
adc ebx, edx
neg dword [esp + ebx*2 - 0x678a16e6]
and edi, ebx
movzx ebp, cx
pop ebp
inc ecx
pop esp
jg fcn.008764ee
inc ecx
xor esi, edx
shr dword [esp + 0xb], 0xb1
inc esp
mov ebp, dword [esp + 1]
lea esi, [ebp + esi - 0x7d4fb236]
rol esi, 2
call fcn.0085ede0
dec ebx
mov eax, dword [esp + eax - 0x59]
jmp 0x8576a0
inc ecx
sar ch, 2
dec edi
lea eax, [eax - 0xaa]
ror ebx, cl
inc ebp
movzx ecx, sp
jns 0x7539f6

Function at 0x79bead
Capabilities:
Encode data using xor
Get number of processors

Disassembly:
push eax
dec eax
bswap eax
inc ebp
movzx ecx, byte [eax]
inc ecx
pop esp
inc ecx
movzx esi, sp
dec ebp
lea esp, [esp + esi + 0x4d94933c]
dec ebp
lea eax, [eax + esi*2 - 0x15e6f]
call fcn.00879871
mov byte [esp + ecx - 0x3330cc38], 0x10
dec eax
rol dword [esp + eax - 0x33], 1
sbb esi, 0xa993391b
bswap esi
ror esi, 1
inc di
dec esp
mov dword [esp + eax - 0x33], edx
movsx ebx, dx

Function at 0x79c87c
Capabilities:
Encode data using xor

Disassembly:
inc edx
bswap edx
dec edx
mov dword [esp + eax], 0x61365c92
movsx ecx, al
xor edx, 0xaa22483a
lea edx, [eax + edx - 0x350cca39]
lea ecx, [eax + ecx + 0x3f00aa1b]
lea ecx, [ecx + eax*8 + 0x6d265a31]
call fcn.00821334
or dword [ecx + 0x6c], ebx
stosb byte es:[edi], al
pop ecx
push ebx
add eax, 0xd55aa39
cmp eax, dword [0x1139aa39]
daa
add eax, 0x969aa39
aas
add eax, 0x515daa39
add eax, 0x6525aa39
xchg edx, eax
popal
and eax, 0x341348aa
invalid
Function at 0x7b35ff
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + eax - 0x63ea07c6]
mov edx, eax
lea eax, [edx + eax*4 - 0x71e0ae66]
xor ecx, ebx
sub al, dl
rol ecx, 2
lea eax, [edx + eax + 0x382be433]
or ax, dx
not eax
neg ecx
dec al
sub ecx, 0xb93dd729
and edx, 0xf33f0d13
or eax, eax
bswap ecx
inc ecx
inc eax
ror ecx, 3
not ecx
xor ebx, ecx
call fcn.0072fda6
push esi
mov ecx, dword [esp + ebp - 0x69b70420]
dec esi
lea eax, [ebp + eax - 0x69b70420]
inc ecx
movzx edx, bh
shl al, 0x65
not dl
inc ecx
xor ebx, edx
dec ebx
not ebx
call fcn.005c3b28
scasd eax, dword es:[edi]
test byte [ecx - 0x56], cl
mov dword [0x1cd8c1f7], eax
stosb byte es:[edi], al
sbb ebx, 0xffffffed
fcomp dword [edx + ebp*4]
stosd dword es:[edi], eax
xlatb
loope 0x5c14f8
sbb al, 0xaa
fist dword [edi - 0x55e3275f]
xchg ebx, eax
mov bl, 0x40
or dword [ecx], ebx
stosb byte es:[edi], al
pushfd
loopne 0x5c1550
mov cl, 0xb6
xchg edi, eax
mov ch, 0xf9
invalid
das
mov dl, 1
cli
inc edi
inc eax
xlatb
aaa
sahf
adc eax, 0xd1fa7ef0
aaa
inc ecx
inc ecx
pop ebx
push es
rcl byte [ecx + 0x55], cl
cwde
lea ebx, [esi]
les esp, [eax + 0x25fe3845]
dec ebx
int3
mov dword [esp + edx*2 - 0x191c4], edx
sub al, byte [esp + eax*2 - 0xd791c5]
pop eax
ja fcn.007541d4
rol bx, 0x4a
dec esp
lea edx, [ebx*4 + 0x32921a34]
inc esp
xor dword [esp + ebx - 0x4cef17bc], ecx
inc cx
xchg edx, ebx
neg bx
inc ecx
pop edx
dec ebp
arpl cx, cx
call fcn.007464ff
mov eax, 0x7f3d0b34
add eax, 0xe4acfc96
mov ecx, dword [edi + eax - 0x63ea07ca]
jge 0x5c14a2
push 0x8188129f
xor dword [esp + 0x38], ecx
dec esp
mov edx, dword [esp + 0x30]
dec ecx
add edx, 0x71dc0
inc ecx
jmp edx

Function at 0x7b3a89
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dx, word [ebp + ecx - 0x3b2a0000]
lea eax, [ecx + ecx*2 + 0x7ab116aa]
add ax, ax
or cl, byte [ebp + ecx - 0x3b29fffe]
rol dword [esp + eax*2 - 0x585e5aa0], 0x72
lea ebp, [ebp + eax*2 - 0x585e5aa6]
shl ax, 0x48
inc eax
mov dword [esp + eax - 0x2c2f5401], eax
shr dx, cl
xadd dword [esp + eax - 0x2c2f53f9], eax
mov word [ebp + eax*2 - 0x20030d36], dx
call fcn.007f3e2d