joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c29c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5c8584]
xor edx, edx
cmp eax, edx
jne 0x4c29e6
xor eax, eax
mov byte [eax + 0x5c8484], al
inc eax
cmp eax, 0x100
jl 0x4c29ce
mov dword [0x5c8584], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5c8484
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4c2a77
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4c2a4a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4c2a18
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4c2af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4c2b43
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4c2b2a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c94d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fcb4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004c9df0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x54cacc
call fcn.004ea257
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4c9563
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ea257
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4c955c
push 0
mov ecx, eax
call fcn.004c0600
mov dword [esi + 0xc], eax
jmp 0x4c9565
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4c9565
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4ec8f6
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ec92e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ea971
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ea949
jmp 0x4ec93a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4ee0f5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ee137
call fcn.004f47dd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4ee137
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4ee12e
xor eax, eax
jmp 0x4ee13f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ee145
pop edi
pop esi
pop ebx
ret 4

Function at 0x4f4d0d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4f4d3b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f4d59
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004f4c73
jmp 0x4f4d59
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4f4d59
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004f4c73
test edi, edi
mov eax, edi
jne 0x4f4d43
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x7aa5fa
Capabilities:
Encode data using xor

Disassembly:
rol edx, 1
sub eax, dword [esp + eax - 0x3ff4]
xadd cx, ax
adc al, 0xae
xor ebx, edx
mov dword [esp + eax*2 - 0x1f305ce0], eax
rol byte [esp + eax*2 - 0x1f305cda], 0x27
call fcn.0084a9dc

Function at 0x7b9ab5
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + eax - 0xaf2e], edi
inc eax
xor ch, bh
inc eax
add ch, dh
inc eax
xor ch, bh
inc bp
add ecx, ecx
inc eax
sbb ch, 0x93
and dword [esp + eax - 0xaf28], esi
inc esp
xor ch, ch
and ecx, 0x89b0b702
dec eax
shr dword [esp + eax - 0xaf2e], 0xf5
dec eax
lea ebp, [esp + ebp + 0x10]
sbb word [esp + eax*2 - 0x15e54], ax
inc cx
add esi, ecx
xor ecx, edi
dec esp
mov esi, dword [eax + ebp - 0xaf2e]
inc ecx
pop ecx
add byte [esp + eax - 0xaf2a], 0xa7
inc ebp
add al, bl
dec ebp
mov dword [edi + eax*8 - 0x57978], esi
inc ecx
xor dh, cl
inc ecx
ror al, 0x42
inc esp
xchg dword [esp + eax - 0xaf2b], esp
dec edi
lea edi, [edi - 0x71af30]
and edi, 0xe7311ebc
call fcn.009406bc
call fcn.00808a12
insd dword es:[edi], dx
push 0x6b
fldenv [edx - 0x66746371]
adc byte [edx - 0x6674637d], 0xa6
fidiv dword [ebx - 0x31667464]
push ss
invalid

Function at 0x7e72bc
Capabilities:
Authenticate hmac

Disassembly:
inc esp
xor dword [esp + eax - 0x4a9e0b33], ebx
dec esi
mov ebp, dword [esp - 0x166e]
dec ebp
arpl bx, bx
dec edx
mov dword [esp - 0x166e], eax
dec ecx
add ebx, ebx
dec edi
mov ebx, dword [edi - 0x1676]
dec eax
mov dword [esp + esi*2], 0xfaac4d81
inc di
mov ecx, dword [edi - 0xb33]
call fcn.00995272
inc ecx
mov esp, 0x2e34fc85
inc ecx
movzx ecx, ah
dec edi
lea edx, [edx - 0x5c69f90e]
inc ebx
mov eax, dword [edx - 0x2e34fc85]
dec ecx
lea ebp, [esp + ecx - 0x2d4d2670]
inc ecx
mov eax, 0x8c8f580d
inc ecx
not eax
inc ecx
xor eax, ebp
inc esp
xadd ch, ah
inc ebp
mov ecx, esp
jp 0x925390
ror eax, 2
inc eax
bswap eax
not eax
inc ecx
push ebp
dec eax
sal ecx, cl
dec eax
sar ebp, 0xe2
xor dword [esp + ecx - 0x10a0], eax
dec ecx
sal esp, 0x5b
inc ecx
pop ebp
inc cx
not ecx
inc ecx
xor eax, 0xd5b6bd3b
dec eax
arpl ax, ax
dec esi
lea ebx, [ecx*8 - 0x507df046]
dec ecx
sar ebx, 0x27
dec eax
adc ebx, eax
inc ecx
movsx edx, cl
dec ebp
lea edx, [edx + ecx*4 - 0x4284]
inc edx
mov esi, dword [ecx + edx - 0x10a0]
inc ecx
xor esi, ebp
dec ecx
neg eax
inc ecx
lea esi, [eax + esi + 0x233bd6b6]
rol esi, 2
sar ebp, 0xf9
inc edx
lea esi, [esi + ecx*2 + 0x7933bd4f]
xor esi, 0xde817aac
dec ecx
bswap ecx
inc ecx
push ebp
inc sp
or ecx, edx
inc ecx
dec eax
dec esi
lea ebp, [0x8694813f]
xor dword [esp + ecx - 0x10a0], esi
inc ecx
pop ebp
dec ecx
shr eax, 0x41
jns 0x88154b
mov edx, 0x618a1a9b
dec eax
arpl cx, cx
inc eax
shl bh, 3
dec eax
add ebx, ecx
inc ecx
not ah
inc si
mov eax, dword [edi + edi - 0x15b685c0]
rol edi, 0xfd
inc ecx
adc esi, 0xb0af0f8e
inc ecx
mov cl, byte [edi + edi*8 - 0x15b685be]
inc esp
xadd edx, esi
dec ecx
sar esp, 0x9a
inc sp
adc esp, ecx
dec ebp
lea edi, [edi + ecx*2 - 0x2144]
inc ecx
mov dword [edi + ecx*2 - 0x2140], esi
dec edx
lea ebp, [0xaaa0493f]
dec eax
sal ecx, cl
jns fcn.009634d7
Function at 0x804d27
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + edx - 0x5a537cac]
mov dword [esp + edx - 0x5a537cb2], 0xef9de30a
rol word [esp + edx - 0x5a537cae], 0xcc
dec dword [esp + edx - 0x5a537caa]
xor al, bl
neg al
sar dword [esp + edx - 0x5a537caa], 0x3d
add cx, word [esp + edx - 0x5a537ca8]
shl dword [esp + edx - 0x5a537cad], cl
dec al
push edx
neg al
not al
neg dl
rol al, 1
sar word [esp + edx - 0x5a537c45], 1
xor bl, al
not dx
lea eax, [esp + eax + 0x10]
mov edx, dword [eax + edx - 0x5a5383b1]
mov dword [esi], edx
movsx eax, cl
rdtsc
call fcn.0091ea4c
sar byte [eax + edx*4 + 0x4a6687d9], 0x70
cdq
inc ebx
invalid

Function at 0x815228
Capabilities:
Encode data using xor

Disassembly:
sal edx, 0xd5
add ebp, eax
call fcn.009919a5
call fcn.0084ca7f
inc ecx
ror cl, 5
push ecx
inc ecx
mov edx, dword [edx]
inc ecx
xor edx, ebp
neg edx
movzx esi, word [esp + 3]
sal ecx, cl
sar word [esp + ecx - 0x7ffffffe], 0xe
sub edx, 0x83213f2a
call fcn.00b79504
push edi
dec eax
add ebx, esi
inc ecx
pop esp
jmp 0x85a3a4
rol ebp, 2
dec esp
mov dword [esp], ebx
xor ebp, 0x7f39e8b9
dec esp
lea ecx, [edx + edx*8 - 0x12f94ef4]
dec esp
mov dword [esp], ebp
inc ecx
not ebx
inc edx
xor dword [esp + ebx - 0x51d265c3], ebp
dec edx
lea eax, [ebx*4 - 0x2d4485e5]
inc ecx
pop ebp
dec edx
lea ecx, [ebx*4 - 0x7c3f270]
inc esp
movsx esp, ax
dec eax
arpl bp, bp
call fcn.00990c70
mov dword [edx + esi - 0x169f600a], eax
mov eax, dword [edi + edx - 0x169f600a]
and edx, dword [esp + edx - 0x169f600a]
lea edi, [edi + edx*2 - 0x147ffc]
lea edx, [edx + edx - 0x4f57ca62]
dec edx
setp byte [esp]
xor eax, ebx
rol eax, 2
dec eax
mov ecx, edx
xchg dh, dl
sal ecx, 0x31
not eax
sal edx, 0x41
sub dword [esp + ecx - 0x6b3a0000], 0x1bb40a98
xor eax, 0x4c80311a
lea ecx, [ecx*8 - 0x77da82fd]
xor ebx, eax
xadd cx, dx
jg 0x791bdf
inc ecx
xchg ecx, edi
dec eax
arpl si, si
jmp 0x7e1e2c
dec edi
mov esp, dword [edi + ecx*2 - 0x50e6fa4a]
dec ebx
mov edi, dword [ecx + edi - 0x28737d1d]
dec ecx
not esp
dec eax
not edi
dec edx
lea edx, [ebx*4 + 0x5529c531]
jmp 0x7ccb8f

Function at 0x81739f
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov dword [esp + edx - 0x7daef231], ebp
inc ecx
or bl, 0xab
inc esp
xor dword [esp + edx - 0x7daef231], esi
call fcn.008122ce
salc
mov eax, 0x64d3a14b
in al, 0xc9
dec ecx
or esp, dword [eax]
adc al, 0x9c
and dword [ecx + 0xb], ecx
and ah, bl
pop ecx
dec ecx
or esp, dword [eax]
movsb byte es:[edi], byte [esi]
cld
sbb dword [ecx + 0xb], ecx
and ah, ah
xor al, 0x31
dec ecx
or esp, dword [eax]
or al, 0x94
and dword [ecx + 0xb], ecx
and ah, bl
inc esp
ror dword [ecx + 0xb], 0x20
sbb al, 0x34
and dword [ecx + 0xb], ecx
and ah, bh
mov ah, 9
mov ebx, ecx
in al, dx
push es
loopne 0x8173d4
ror dword [eax - 0x505e3852], 1
jns 0x817471
leave
stosd dword es:[edi], eax
outsd dx, dword [esi]
adc al, byte [edx]
out dx, eax
xchg ebx, eax
clc
mov bh, 0xac
xchg edx, eax
cmp edx, dword [ebx - 0x59c115d9]
invalid
sbb eax, 0xa088a8b5
cmp eax, 0x48809d75
pushal
int1
invalid
Function at 0x82aa6c
Capabilities:
Authenticate hmac

Disassembly:
ret 0xe903
add al, 0xf5
cdq
sub byte [edi + edi*2 + 0x3484894a], bl
mov dl, 0x19
je 0x82a9ca
inc esi
xor dword [esp + esi - 0x578be646], ebx
dec esi
mov ebp, dword [esp + esi - 0x578be646]
inc ecx
movsx ecx, cl
dec ebp
arpl bx, bx
dec ecx
add ebx, ebx
call fcn.0083adf3
jbe 0x95bebc
and dword [ebx - 0x6e], ebx
fldenv [esi - 0x79]
lodsd eax, dword [esi]
jb 0x82aa14
sub cl, dl
fld xword [ebp + 0x36569972]
iretd

Function at 0x83a72f
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esp
inc esi
mov eax, dword [ebp + edx - 0x6020ee53]
dec edi
lea ecx, [esi + ebx*4 - 0x4dc2834d]
dec eax
sal eax, cl
jne 0x919c16
inc eax
or ch, 0x20
dec esi
lea esp, [esp + 8]
dec edx
mov dword [esp + esi - 0x936f503], 0x34006d98
inc ebx
mov dword [esi - 0x936f503], edi
inc cx
not eax
inc ebx
mov edi, dword [esi + edi - 0x936f4ff]
inc eax
not ch
ror si, 0x69
inc edx
sub dword [esp + esi*2 - 0x126dea04], 0x11a9bc86
dec esi
lea ecx, [esp + esi - 0x936f4f3]
inc ebx
mov dword [esi + ecx - 0x936f503], edi
jno 0x80bdab
inc ebp
xor eax, ebp
inc ecx
sub eax, 0xc292840f
inc ecx
mov edi, ebx
inc ecx
not eax
inc ecx
ror ah, 0xa1
inc edi
lea eax, [esi + eax - 0x78e91398]
inc ecx
add ebx, 0x7b01fe3c
inc ecx
add dh, dh
inc ecx
rol eax, 1
jmp 0x92d1c0
inc ecx
push ebp
call fcn.009546a9
Function at 0x84b072
Capabilities:
Encode data using xor

Disassembly:
enter 0xfffffffffffffff6, 0x42
inc edx
mov edx, dword [esp + esi - 0x6033ad7d]
inc ecx
push ecx
neg edi
inc esi
movsx esp, byte [esp + eax*2 - 0x2e675b28]
dec esi
mov dword [esp + eax - 0x1733ad6d], ebp
dec edx
mov dword [esp + eax - 0x1733ad85], 0x692b7702
push edx
inc edx
xor dword [esp + eax*2 - 0x2e675afa], edi
inc ecx
dec eax
inc dx
add dword [esp + eax - 0x1733ad8e], 0x8b4e58bc
lodsb al, byte [esi]
inc esp
or byte [ebp + 0x6348d198], ah
dec dword [eax + 0x13]
fbld tbyte [esi - 0x7f]
mov dword [0xb4014e46], eax
inc esp
loopne 0x84b06f
cwde
ror dword [edi - 0x73], 1
movsb byte es:[edi], byte [esi]
pop es
outsb dx, byte [esi]
push edx
int3

Function at 0x84f733
Capabilities:
Encode data using xor

Disassembly:
rol eax, 1
rol cx, 0x27
neg eax
push edx
xor ebx, eax
sal dword [esp + ecx - 0xfbb1], cl
jne 0x85227e
and dword [esp + edx*2 - 0x86], edx
xor eax, ebx
shl cl, 3
ror eax, 1
shr dl, 0xa1
add edx, ecx
enter 0xffffffffffffeac0, 0xffffffffffffffa1
sbb cl, byte [esp + edx*2 - 0x40]
push ecx
dec eax
not ecx
xor dword [esp + edx*4 - 0x83], 0x5d96bd24
rol eax, 3
sub word [esp + edx - 0x1e], cx
adc dword [esp + edx - 0x21], 0xe521acb0
call fcn.007e25e9
mov ebx, 0xca0fc4c5
sbb dword [ecx], ebx
mov esp, 0x6139a5c6
loope 0x7a945d
invalid
shr dl, 0x21
sub eax, 0xf619e4b6
not eax
mov dword [esp + ecx*2 - 0xcbee], edx
jmp 0x7a943a

Function at 0x850c55
Capabilities:
Get number of processors

Disassembly:
inc eax
setnp dh
dec ebp
arpl ax, ax
jle 0x7d3cad
sal eax, cl
dec ecx
add ebx, eax
dec eax
or esi, 0xea2a790b
inc ebp
movzx eax, cl
inc ecx
push esp
dec eax
mov dword [esp + eax - 0x152a0000], ebx
ret
dec ebp
lea esp, [esi + eax*8 - 0x51f86857]
inc ecx
inc eax
inc ecx
not eax
dec esp
mov dword [esp + eax*4 - 0x6cc54a8], ebp
movsx edi, cl
inc esp
xor dword [esp + eax - 0x1b3152a], eax
inc ecx
movsx esi, dh
inc ecx
inc cl
dec eax
lea edi, [edx*8 - 0x42cb4d51]
inc ecx
pop ebp
inc ebp
add ecx, esp
jae 0x7917f5
jmp 0x7d598e

Function at 0x85e498
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec edi
mov dword [ebx + edi - 0xff14], esp
dec edi
lea edi, [edi + ebx*4 - 0x3fc14]
inc ebp
mov esi, ebx
inc sp
xor dword [esp + esi*2 - 0x110], eax
dec edx
shl dword [esp + ebx*2 - 0x1fdf5], 0x7e
pop edi
inc ecx
pop esi
pop eax
inc ecx
pop eax
pop edx
inc ecx
pop esi
jp fcn.009634d7
Function at 0x864171
Capabilities:
Encode data using xor

Disassembly:
inc edx
xchg byte [esp + eax*4 + 0x26], bh
inc ecx
ror dh, 1
inc dx
sub dword [esp + eax + 0xd], edx
inc ecx
neg dh
inc ebp
xadd ah, al
inc esp
movzx ebx, bh
inc esi
xor dword [esp + eax + 0x10], esp
inc ecx
inc dh
pop edi
inc ebp
xor ch, dh
dec eax
and edx, 0x75bce8ab
inc sp
add dword [esp + edx*2 - 0x8004039], eax
dec esi
lea esi, [esp + esi + 0x30]
inc ecx
mov ecx, esp
inc ecx
movsx esi, bl
mov edi, 0xbd2ffc06
dec ebp
mov dword [esi + edx - 0x4002020], ecx
push edi
sar byte [esp + edx - 0x4001ff5], cl
dec ecx
mov ecx, dword [edi + edx*4 - 0x10008078]
inc esi
movzx esp, byte [edx + edx - 0x4002026]
call fcn.0095bfa3
mov edx, dword [eax + edi - 0x25c5229e]
sar al, 0x41
bswap eax
adc edi, 4
add eax, 0xa4a66a1b
add byte [eax], al
add byte [0xa4a66a1b], al
xor edx, ebx
sub ax, ax
inc edx
not al
dec cx
neg ecx
ror edx, 3
lea eax, [ecx*2 + 0x14a37b86]
neg edx
lea edx, [edx + ecx - 0x7b2f7543]
sub eax, 0xaeb88cae
dec al
shr eax, 0x86
not edx
sub edx, 0x9ea1b90e
sar ecx, 0x88
ror edx, 2
xadd ecx, eax
xor edx, 0x8739451d
lea edx, [edx + ecx*8 + 0x7fc25162]
xor edx, 0x4689c392
xadd cl, ch
call fcn.00809f4e
sbb dword [ebx - 0x1001266a], esi
inc ebp
jbe 0x8641ec
push edx
ret 0x458f

Function at 0x878795
Capabilities:
Encode data using xor

Disassembly:
inc ecx
push esp
inc esp
movzx eax, byte [esp + ebp*2 - 0x22f4]
dec edi
lea edi, [edi - 0x4408]
push ebp
inc cx
shr esp, 0x44
inc ecx
mov dword [edi + ecx - 0x5285038c], edx
dec ebp
lea esi, [ecx + 0x3683aca4]
sub byte [esp + ecx - 0x52850380], 0x10
dec esp
sub dword [esp + ebp - 0x1172], ecx
pop ecx
pop eax
jp fcn.009634d7
mov ecx, 0x47bebbac
call fcn.00894331
dec ecx
mov edi, dword [edx + ebp - 0x18b2603a]
mov esi, 0x5aa50eb3
neg al
dec ecx
xor edi, ebp
dec eax
shr ebp, 0xe8
dec eax
xor edi, 0xb99107a6
dec eax
ror edi, 4
push ebp
inc ecx
and edx, eax
dec eax
lea edi, [edi + ebp*4 + 0x5ea7381b]
inc cx
shr ecx, 0xa2
dec eax
neg edi
dec edx
lea edi, [edi - 0x60aeca7e]
push ebp
call fcn.0098d8ab
or esi, 0x7f9d82bd
dec esp
mov dword [esp + ebp - 0x24], ebp
xadd bp, di
jnp 0x998f2f
inc ecx
not esi
inc ebp
movzx esp, cx
jmp 0x7bf66a
xor dword [esp + ebp - 0x117a], edx
inc ecx
pop ebp
jmp 0x78fdaf

Function at 0x88394c
Capabilities:
Get number of processors

Disassembly:
mov eax, 0xed23249f
rol esi, 0xa4
mov cl, dl
btr esi, edx
clc
rol eax, cl
bswap esi
lea esi, [ebp + edx - 0x10c]
cmc
add al, dl
jmp 0x7db8a6
xor al, byte [edi + esi]
jmp 0x938812
mov eax, ecx
sar al, 0xe2
not dl
call 0x84dc37
je 0x977dcb
inc edx
cmp edx, 0x104
jmp 0x977dc5
mov byte [esi], al
jmp 0x883958
jb 0x7d598e
mov eax, dword fs:[0x30]
and bh, 0x17
or ebx, 0xc20ace24
mov eax, dword [eax + 0xc]
dec cx
mov ecx, dword [eax + 0xc]
ror ebx, 6
mov eax, dword [eax + 0x10]
shr bh, 0x85
cmc
mov dword [ebp - 4], eax
mov ebx, ecx
clc
cmp esi, 0x82a70b1e
test bp, 0x743f
cmp ecx, eax
je 0x933710
lea ebx, [ebx]
neg edi
Function at 0x8839e6
Capabilities:
Encode data using xor

Disassembly:
sal esi, 0x1a
dec esp
mov dword [esp + esi - 0x4000000], ebp
push edx
dec eax
xor ecx, 0xdd279cb3
xor dword [esp + esi*2 - 0x7fffff8], ebp
dec esp
mov ebp, dword [esp + esi - 0x3fffff8]
dec eax
arpl bp, bp
call fcn.007bebad
inc ecx
mov eax, 0xe93a498f
inc ecx
mov ebp, eax
dec ecx
sub edx, 4
inc ecx
not eax
jmp 0x898371
inc eax
or dh, dh
jnp fcn.009634d7
jmp 0x87ba4a
rol ecx, 2
dec dx
jne 0x9315d1
jmp 0x89c2e6
xor ebx, eax
shr word [esp + 4], 0xe3
sar edx, 0xd
inc dx
mov dword [esi - 2], eax
mov dword [esp], 0x1025e1a3
mov ecx, dword [edi + 4]
sar dword [esp + 4], 0xe6
js 0x88d5f6
movzx dx, dl
not word [esp + eax*2 - 0x2e]
sar al, 0xc1
mov al, byte [esi + eax*4 - 0x30]
push ecx
not dl
not al
or dl, al
ror dword [esp + ecx - 0x762fb293], cl
lea eax, [ecx*2 + 0x20adfd94]
mov cx, dx
add al, al
movzx cx, cl
sub eax, eax
lea edx, [eax*4 + 0x470851a0]
sal dl, 0x44
or al, byte [esi + eax*2 + 2]
add cl, al
jmp 0x7e565c
dec esp
mov dword [esp + eax - 0x34612dc5], ebp
call fcn.0087184c
fisubr dword [esi]
hlt
xor ecx, ebx
movsx eax, word [esp + 4]
bswap edx
bswap ecx
dec eax
sub ecx, 0xe30278b8
dec word [esp + 2]
shr dword [esp + 3], 0xf9
jne 0x80f7a0
inc ecx
push ebx
neg ebp
ror ebp, 2
jmp 0x7a1cd6
inc ebp
movzx ecx, ax
inc edi
mov eax, dword [edx + eax - 0x16c5b670]
inc ebp
xor eax, ebp
inc ecx
movsx eax, cl
dec ebp
xor ecx, ecx
inc ecx
inc eax
dec eax
lea esi, [eax + 0x75adf490]
inc ecx
mov esp, 0x9b1c3f3f
dec ecx
ror esp, 0xad
inc ecx
bswap eax
inc ecx
not eax
inc ecx
bswap eax
inc eax
inc dh
inc ebp
mov ebx, ecx
inc ecx
push ebp
inc esi
xor dword [esp + ecx*4], eax
inc eax
movzx ecx, ch
inc eax
movsx edi, ch
inc ecx
pop ebp
inc ebp
movzx esi, bx
dec eax
neg ecx
dec ebp
arpl ax, ax
shr cx, 0x8f
dec ecx
add ebx, eax
inc cx
dec ecx
dec edi
mov edi, dword [ecx + edi - 0xffff]
jp 0x7d858c
dec ecx
sub edx, 4
inc ebp
xor esi, ebp
dec eax
lea eax, [ebp - 0x755eac51]
mov ecx, ebp
inc ecx
bswap esi
dec bp
push ebp
inc ebp
lea esi, [esi + eax - 0x54623cea]
add bp, cx
dec esp
lea eax, [ecx*8 - 0x4fa0679]
jno 0x9552dd
add ebp, ecx
sub al, 0xaf
sal eax, 0x92
ja 0x7babf6
shr edx, 0xd0
lea ecx, [ecx + edx + 0x83d2c8c]
mov dword [esp + edx - 0x84af], 0xb6814500
jnp 0x98e946
imul cl
movzx ecx, dx
dec cl
mov word [esi + ecx - 0x1562], ax
inc dl
jl 0x93ec4b
bswap ecx
mov dword [esp + ecx - 0x62150000], ebp
ret 0xc
lea eax, [eax + edx + 0x2c601106]
call fcn.00921798
inc ecx
bswap esi
inc ecx
ror esi, 3
inc ecx
not esi
jmp 0x884b42
rol ecx, 1
xor ebx, ecx
jmp 0x7da7e0
Function at 0x89158a
Capabilities:
Authenticate hmac

Disassembly:
pop eax
jmp ebp
not ax
xor ebx, ecx
add dword [esp], eax
and dx, dx
adc ebp, ecx
movsx ecx, al
mov eax, dword [esi + 2]
and dword [esp], ecx
mov edx, dword [esi + 6]
adc eax, edx
not cx
mov dword [esi + 6], eax
and dword [esp], ecx
movzx edx, cx
neg word [esp + edx]
mov ecx, dword [edx + edi + 3]
not word [esp + edx - 1]
neg dword [esp + edx*2 - 2]
lea edi, [edi + edx + 7]
jbe 0x7e2609
mov ecx, dword [eax + edi]
lea edi, [edi + eax*2 + 4]
xor ecx, ebx
inc ecx
lea eax, [eax + edx*8 + 0x5523f837]
mov dword [esp + eax*2 - 0x545a8b7e], 0xf601f5a7
dec al
bswap ecx
xor ecx, 0xedb03f22
ror ecx, 2
sal edx, 0xfd
xor ebx, ecx
xadd dx, ax
adc ebp, ecx
or byte [esp + edx - 0x200045bc], 0xa3
jne 0x7b3e44
mov eax, 0x2b4d50a
mov eax, dword [esi + eax - 0x2b4d50a]
mov edx, 0x831aea89
mov cl, byte [esi + 4]
shl eax, cl
mov dword [esi + 2], eax
mov ecx, dword [edi]
xor ecx, ebx
movzx eax, dl
xor eax, edx
neg ecx
shr al, 0x46
sbb ecx, 0xf619e4b6
push eax
inc ax
not ecx
rol ecx, 1
xor dx, dx
inc byte [esp + 3]
neg ecx
jmp 0x81b978

Function at 0x89348d
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
not ecx
mov cl, byte [esi + edx*4 - 0x3803be14]
sets dl
rol dl, 1
call fcn.00792ce7
neg eax
xor ebx, eax
shl edx, cl
adc edx, ecx
add ebp, eax
mov dword [esp + edx - 0xe00ef86], edx
xadd dword [esp + edx - 0xe00ef86], edx
add ecx, 0xba19e198
mov eax, dword [esi + edx*2 - 0x1c01df0c]
js 0x78a667

Function at 0x893973
Capabilities:
Encode data using xor

Disassembly:
and cl, al
mov dword [esp], edx
rol dx, 0x27
mov eax, dword [esp + 4]
mov word [esi + eax - 0x59a4bcbc], cx
and edx, 0xa6b69b8a
mov ecx, dword [edi + eax - 0x59a4bcbc]
dec dx
shr edx, 0x87
inc ax
lea edi, [edx + edi - 0x1490111]
xor dword [esp + edx - 0x1490111], 0xb1371405
adc dl, 0x10
or dword [esp + edx*2 - 0x2920249], 0x52ac602c
xor ecx, ebx
neg byte [esp + edx*8 - 0xa480928]
not ecx
or dword [esp + edx*4 - 0x5240490], eax
pop eax
dec ecx
sub dx, 0xfb9b
xor ecx, 0xd9911811
add edx, 0xa4bfd814
dec ecx
not eax
lea eax, [edx + eax*4 + 0x2cbb579d]
call fcn.0095571f

Function at 0x896641
Capabilities:
Encode data using xor

Disassembly:
inc ebp
lea ecx, [ecx + ebp*2 + 0x708085e1]
inc ecx
not ecx
inc ecx
sub ecx, 0x790dd5ae
inc ecx
ror ecx, 3
call fcn.00969365
mov eax, 0x75ba3785
dec ecx
mov esp, edi
inc esp
movsx edi, al
and ax, ax
inc ecx
pop edi
mov ebx, 0x1934623e
dec esp
lea esi, [ebx + eax*4 - 0x49d9b8d4]
call fcn.0091b864
dec esi
lea edx, [ebp + edx - 0x3e1a9e24]
dec eax
mov dword [esp + ebp - 0x3e1a9e20], ebp
inc ebp
mov ecx, dword [edx + ebp - 0x3e1a9e20]
inc ebp
xor ecx, ebp
jmp 0x795e83