joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7b3bf6
Capabilities:
Encode data using xor

Disassembly:
sub eax, ecx
jae 0x7e48d7
movsx edx, al
mov dword [esp + eax - 0x4ee0e671], esi
ret 0x10
inc edx
ror byte [esp + 0xe], 0x64
neg ebx
call int.00824989
mov edx, 0xe58935af
mov ecx, dword [ebp]
mov eax, edx
xor eax, edx
mov edx, dword [ebp + eax*4 + 4]
inc ax
add eax, 0x1307240b
adc ecx, edx
mov dword [ebp + eax*4 - 0x4c1c902c], ecx
sal al, 0x41
ror eax, 0x2c
movzx ecx, al
mov edx, dword [ebp + eax - 0x4181306e]
jp 0x813edf
call fcn.0074c809
mov dword [edx + eax - 0x41813071], ecx
mov ecx, eax
mov edx, dword [edi + ecx - 0x41813071]
jns 0x74bee0
adc bh, dh
push 0x14227aaa
mov byte [0x123eaa3d], al
and al, 0xa2
cmp eax, 0x487e16aa
mov byte [0x767eaa3d], al
inc eax
mov byte [0x3666aa3d], al
invalid
lea edi, [eax + edi + 4]
add eax, ecx
xor edx, ebx
ror eax, 0xd0
bswap edx
inc eax
xor edx, 0x250b7f05
rol cl, 0x67
sal al, 0xa1
rol edx, 1
bswap edx
or ax, ax
xor ebx, edx
not al
jmp 0x7eae55
add esi, edx
movzx edx, al
jmp esi
sar ecx, 0xcd
or cx, cx
adc ecx, dword [ebp + ecx*2 + 8]
dec eax
lea ebp, [ebp + eax - 0x41813065]
jge 0x7d6f9b
push esp
scasd eax, dword es:[edi]
xchg esp, eax
stosb byte es:[edi], al
sub al, 0x1c
sub dh, bl
shr dword [edx - 0xcc1f7dc], 0xc1
stosb byte es:[edi], al
xor al, 0x70
inc esi
shr dword [edx - 0xc99af88], 0xc1
stosb byte es:[edi], al
sub al, 0x30
ret
Function at 0x7b7a0d
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
jmp 0x7d1906
shr ecx, 8
xor ecx, ebx
inc eax
xor ecx, 0x1133baa8
dec edx
jmp 0x7b1eee
lea esp, [esp + 4]
jne 0x82a2af
mov eax, 0x6034c4b4
lea eax, [eax + eax - 0x6d74994f]
push eax
mov ebx, dword [esp + eax - 0x52f4f015]
lea esp, [esp + 8]
mov eax, 0xe432d736
not ecx
lea eax, [eax + eax*8 - 0x2bc5f177]
mov edx, eax
sal dl, 0x21
mov dword [ebp + 4], ecx
jp 0x7ca53e
mov eax, 0x64ada63a
mov cx, word [eax + ebp - 0x64ada63a]
call fcn.00739926
shr cl, 0xc2
xor edx, ebx
call fcn.0080ec80
jmp 0x7df45f
call 0x7b7a0d
mov edx, 0xe7afcf2e
mov eax, dword [edi]
add edi, 4
or dl, 0x1b
xor eax, ebx
bswap edx
jmp 0x7dbaf4
dec ecx
mov edx, esi
inc eax
ror dh, 0xc4
inc si
and dword [esp + ecx*2 - 0xb95], esp
dec edi
lea esi, [esi + ecx - 0x5d4]
inc eax
movsx ebx, dh
dec edx
mov dword [esp + ecx*4 - 0x1748], 0xd7a19ead
inc bx
mov dword [ecx + esi - 0x5d2], edx
pop esi
pop esi
pop edx
inc ecx
pop edi
je fcn.008764ee
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x889334]
jmp 0x763dc5
movzx ecx, ax
mov edx, dword [edi + ecx*2 - 0x13ede]
jns 0x8579fd
xor edx, ebx
lea edx, [edx + eax - 0x54c5c7cb]
xchg ecx, eax
rol edx, 2
sar ecx, 0x47
lea ecx, [eax*8 + 0x4d20ab25]
sub edx, 0xdd3bfab6
shr cl, 0xa4
ror edx, 3
xor edx, 0xbb9d730e
rol eax, 0x23
dec edx
jmp 0x84610e
dec edi
lea esi, [esi - 0x88]
inc ecx
mov ebp, ebp
dec ebx
mov dword [esp + esi - 0x20], esi
dec eax
not ebp
inc ecx
movsx esi, cx
dec edx
lea edx, [ebp*2 + 0x4097391e]
inc edi
mov ecx, dword [esp + eax - 0x20]
dec eax
sub ebx, esi
dec edi
lea eax, [esp + eax - 0x1c]
dec edi
lea edi, [esp - 0x4873426b]
movsx ecx, bx
movsx edi, dx
inc ebp
xor ecx, edx
inc edi
lea ecx, [ebp + ecx - 0x4fb96c4]
inc ecx
movzx eax, sp
inc ecx
bswap ecx
call fcn.007af541
mov dword [esp + edx*2 - 0x5c789824], esi
ret
xor eax, 0x110eb317
ror eax, 2
sub eax, 0x67968118
not dl
rol eax, 2
xor ebx, eax
add esi, eax
movzx eax, byte [edi + edx - 0x3fcfaf18]
lea edi, [edi + edx*2 - 0x7f9f5e2f]
jmp 0x7b4fdb
xor al, bl
jmp 0x828f9a
shr edx, 0xe5
xor al, 0xab
add al, 0xaf
rol edx, 0x39
shl edx, 0xf5
setae dl
ror al, 1
xor al, 0x18
push edx
inc dl
ror dword [esp], 0xa5
adc al, 0x38
xor bl, al
call fcn.008330cd
inc ecx
mov ecx, 0xba883620
dec ecx
mov esi, dword [eax]
inc ecx
mov ebx, ecx
dec ecx
add eax, 8
inc esp
movsx ebp, bl
dec ecx
xor esi, edx
inc ecx
xor bl, cl
jns 0x82dfef
movzx ebx, byte [eax]
jmp 0x7b6024
dec eax
inc esi
dec eax
rol esi, 6
inc ebp
movzx esp, ch
dec eax
lea esi, [esi + ebx - 0x5cc3bfa9]
jmp 0x847f61
xor ebx, edx
add esi, edx
movzx edx, byte [eax + edi - 0x4fb74]
push eax
rol eax, cl
lea edi, [edi + eax - 0x9f6effb]
xor dl, bl
ror dl, 1
inc dl
call fcn.0075baea
dec eax
xor esi, 0xe8aa161b
inc esp
xadd ebx, ebp
dec eax
rol esi, 5
dec esp
xor edx, esi
jmp 0x74a18e
call fcn.007da154

Function at 0x7bba51
Capabilities:
Encode data using xor

Disassembly:
dec ecx
inc edi
xor ebp, 0x46bc5c1d
dec eax
dec edx
push 0xf1083a3c
dec eax
lea esp, [esp + 0x18]
jne 0x85225a
Function at 0x7c51c6
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
add al, byte [esi]
pop ss
xchg esi, eax
pop dword [esi - 0x3f3ea632]
add ch, byte [0xdd3bfab6]
ror eax, 3
call fcn.00883f70
dec esi
mov edx, dword [esp + edi*2 - 0x18a16]
call fcn.0084b945
jo 0x7c5195
imul ebp, dword [edx - 0x63bd8bd8], 0x44caa3c
xor bl, byte [esp + edi + 0x5a6c7caa]
pushfd
cmp al, 0xaa
sbb al, 0x68
pop esi
pushfd
cmp al, 0xaa
add al, 0x28
xchg ecx, eax
int 0x26
stosb byte es:[edi], al
aad 0xb2
enter 0x55df, 0x3c
hlt

Function at 0x7c95ae
Capabilities:
Encode data using xor

Disassembly:
inc ecx
sub dl, ah
inc ecx
neg edi
dec esi
mov dword [esp - 0x7b2c1132], edx
neg eax
dec esi
lea ecx, [ecx*4 - 0x7dc5d85f]
dec esi
mov dword [esp - 0x3d96089d], ebp
inc esp
xor dword [esp + edx - 0x1219b55e], edi
dec esi
lea edx, [0x979779b2]
inc edx
shr dword [esp + ecx + 0x7dc5d49b], 0xe
dec esi
mov edx, dword [esp - 0x7b2c1132]
dec eax
not edx
dec edx
lea esi, [edx + ecx*4 + 0xa075f01]
movsx ebx, dx
dec ebp
arpl di, di
inc dx
sal dword [esp - 0x7b2c113a], 0xea
dec ebp
adc ebx, edi
dec esp
sub ebp, ebx
inc esi
movzx edi, byte [esp - 0x3d96089a]
inc ecx
xchg ecx, edx
dec ebx
mov ecx, dword [esi - 0x3d96089d]
call fcn.007a91e0
mov al, byte [edi]
imul ebp, dword [edx + 0x5bd0e6b6], 0xb6deaa3c
sbb byte [ebx + 0x3c], 0xaa
mov dl, 0xb2
test byte [ebx + 0x3c], bl
stosb byte es:[edi], al
lcall 0x86aa, 0x3c5bf4c2
mov byte [0xaa398a51], al
cmp al, 0xaa
xchg byte [edx - 0x55c675af], ah
std
sbb dword [ecx + edx*4 + 0x46acbfb6], 0x1526d9f8
in al, 0x7e
xor al, ah
stc
out dx, al
mov eax, dword [0xbe2d3a67]
sub al, 0xb3
and ch, ch
sub al, 0xe0
je 0x7c9643
mov ch, 0x18
pushfd
cmp al, 0xd9
mov esp, 0x2a16dd07
fbstp tbyte [0xe607ba63]
scasb al, byte es:[edi]
adc byte [edi + 0x11e61b9], bl
out 0x2e, al
add byte [ebx + 0x5c9b0839], dh
mov al, 7
outsb dx, byte ss:[esi]
jae 0x7c966c
int 0x44
invalid
Function at 0x7d155b
Capabilities:
Encode data using xor

Disassembly:
dec ebp
arpl bp, bp
dec ebp
adc ebx, ebp
pop edx
inc eax
shl bh, 0x46
inc eax
setnp ch
inc ebx
movzx ecx, word [eax - 0x1dc46]
seta dl
neg esi
dec edi
lea eax, [eax - 0xee1f]
call fcn.005bf1c0
push 0xb934e4a2
not byte [esp + 3]
movzx dx, byte [ebp]
mov eax, dword [esp]
movzx ecx, al
mov cl, byte [ebp + ecx*8 - 0x50e]
and dl, cl
movzx ecx, al
call fcn.0085c224
push edi
inc ebp
insd dword es:[edi], dx
stosb byte es:[edi], al
dec ebx
pop ss
and dword [ecx], ebx
cmp byte [edx + 0x19457333], ch
cmp byte [edx + 0x1905335b], ch
cmp byte [edx + 0x19093f77], ch
cmp byte [edx - 0x3717e4f5], ch
cmp eax, 0xde3448aa
xchg ebp, eax
mov dh, 0x2a
lock xor byte [edi - 0x153c82e0], cl
sub dh, al
xor byte [edi - 0x153c82e0], cl
pop esi
mov edx, 0x9e12f70d
jns 0x78d51b
mov dh, 0x46
in al, 0x82
xchg edx, eax
mov eax, dword [0x34127660]
adc eax, 0x4f7a2749
sahf
cmc
scasb al, byte es:[edi]
push ds
push edx
mov edx, 0x98763132
or bl, ch
aas
sub dword fs:[esi - 0x26], ebx
neg dword [ecx + ebp + 0x1d]
imul esi, dword [esi + 0x5e], 0xffffffb6
add dword [eax + ebp*4], esi
outsb dx, byte [esi]
lea ebx, [ebx - 0x1b]
or al, byte [edx - 0x57]
push ds
push ebx
xor byte [esi + 7], ch
test al, 0xd8
fcom dword [edx + ebp*4 - 0x4c7276be]
popal
mov dword [0x296a476f], eax
and byte [ecx - 0x63f3a032], dh
xchg byte [eax + ecx + 0x6b], bh
in al, 0xcc
pushfd
mov word [edx - 0x4c77b74d], gs
push 0xffffffffffffffdd
mov al, byte [ebp - 0x530d8c58]
popal
adc al, 0xf8
pop ecx
push 0x23
and eax, 0x41a938fe
fist dword [esi - 0x7181cf8a]
or edx, edx
mov edx, esi
stc
add eax, esp
neg ch
loopne 0x78d5b9
inc edx
fdivr qword [edi - 5]
test al, 0x33
mov ebx, 0xec0538f0
invalid
cli
cld
or al, 0x76
daa
adc cl, byte [edi - 0x493ad961]
inc edx
sbb bh, byte [ebp - 0x40]
dec edi
mov ebp, 0xca0287fb
cmp esp, dword [ecx]
mov byte [ebp - 0x59], bl
mov cl, 0x42
sti
pop ds
and esi, eax
invalid
dec edx
mov dword [esp - 0x1dc4a], ebp
inc ecx
ror ebp, 1
jmp 0x7d15d8
inc ecx
movzx eax, cl
inc ecx
dec ebp
dec esi
mov dword [esp - 0x1dc4a], edx
xadd eax, ebp
inc eax
shl ch, 0x83
inc esi
xor dword [esp - 0xee25], ebp
inc cx
sar ecx, cl
movzx esi, dl
ja 0x828684
inc ecx
pop edx
push esi
inc ebx
jg 0x78d4a4

Function at 0x7d4527
Capabilities:
Encode data using xor

Disassembly:
dec dword [eax + 0xf]
int 0x81
ror dword [ebx + esi], 0x1f
fadd dword [ecx + 0x5a]
call fcn.0074220d
dec esi
lea esi, [ebx + esi - 0xa8]
dec eax
mov dword [esp + ebx - 0xac], 0xbbbde6b2
call fcn.0073969a
push dword [edx - 0x1744421a]
pop edx
push ecx
idiv bh
jecxz 0x7d4516
push 0xf1c783aa
mov byte [0xd1e7afaa], bh
mov byte [0xf5c3f3aa], bh
mov byte [0xc9ffa3aa], bh
mov byte [0x44b7cbaa], bh
pop ecx
cmp byte [edx - 0x6fb0572c], ch
mov dh, 0x54
bound ebp, qword [edx + 0x6a9c6021]
imul ecx, ecx, 0x4d
adc byte [ebx - 0x70119623], 0x7a
xor dword [edi], ecx
fild dword [ebx - 0x34]
test eax, 0xca1387e8
loop 0x7d4536
add dword [ebx], esi
int 0xee
xor eax, 0xc6f5fc7e
shl byte [eax], 0xf
jmp 0x8b4e0a83
Function at 0x7ed0ec
Capabilities:
Encode data using xor

Disassembly:
not al
mov dword [esp], ecx
shl dword [esp], 0x86
sar dword [esp], 0x6e
ror al, 1
xor bl, al
lea eax, [esp + eax + 4]
xor cx, cx
push ecx
sbb cl, ch
mov dword [eax], edx
xchg byte [esp + 1], ch
mov eax, dword [edi + 1]
adc edi, 5
shl byte [esp + 2], 0xc1
mov dword [esp + 1], ecx
xor eax, ebx
inc eax
xchg byte [esp + 7], cl
not eax
xchg dword [esp + 4], ecx
lea edx, [ecx + ecx*8 + 0x3b815a7]
xor eax, 0xb4341a97
not cl
add eax, 0xe18b87b0
xor ebx, eax
sub edx, ecx
adc esi, eax
or byte [esp + ecx - 0x1831c], 0x17
jle 0x847fb7
not dword [esp + eax*2 - 0x63417b60]
xor eax, 0xd912b1a6
inc cl
xadd byte [esp + 1], ah
xor ax, ax
lea edx, [eax + eax*4 - 0x30d019e1]
xor cl, 0xa3
inc cl
shr eax, 0x50
xadd byte [esp + eax - 0xe8b2], ah
shl dl, 4
xor bl, cl
lea ecx, [esp + ecx + 4]
mov edx, dword [ecx + eax - 0xffb2]
mov dword [ebp + eax*2 - 0x1ff64], edx
xor eax, 0x290ccd14
mov dword [esp + eax*2 - 0x5218654c], esi
ret

Function at 0x7f0f09
Capabilities:
Get number of processors

Disassembly:
inc edi
lea esp, [esp + ecx*2 - 0x613408c3]
inc ecx
inc bh
inc ecx
push ecx
movzx edi, ax
dec esp
mov dword [esp + edx - 0x5d9bcbcb], edx
inc ecx
sal edi, cl
push edi
movsx ebx, si
inc esp
xor dword [esp + edx - 0x5d9bcbc3], esp
dec esp
mov edx, dword [esp + esi*2 - 0xa4fa]
dec esp
mov dword [esp + esi*4 - 0x14a04], edi
dec eax
and dword [esp + esi*8 - 0x29418], ecx
dec ebp
arpl sp, sp
dec ebp
adc ebx, esp
inc cx
xchg ecx, eax
inc ecx
mov ebp, 0x34a34709
jmp 0x80f30e
dec eax
shr edx, cl
dec ecx
mov dword [esi + edi + 0xa040], edx
inc ecx
push edi
call fcn.0086165e
dec esp
adc ebx, esi
neg edi
dec ecx
mov edi, dword [esi + eax*2 - 0x66]
movsx esi, ax
inc esp
mov edi, dword [edi + ecx*2 - 0x6661987e]
push esi
shl dword [esp + ecx*2 - 0x6661987b], cl
dec ebp
lea esi, [esi + ecx*2 - 0x6661987a]
ror si, 0xef
inc ebp
mov dword [esi + ecx - 0x3330cc3f], edi
call fcn.007a4d0e
jnp 0x7af3d5
mov edx, ebx
neg eax
neg dword [esp + eax]
sal edx, 2
push eax
or eax, ebp
add eax, edx
mov dword [ebp - 4], eax
ror word [esp + 2], 0xc6
test ebx, ebx
call fcn.0082560d
dec esp
mov dword [esp + esi - 0x5285], ebx
ret 0x10
Function at 0x7f0f77
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
lea esp, [esp - 0x10c]
push ebx
push esi
push edi
adc edi, edi
mov edi, eax
shld eax, ebp, 0xa2
lea eax, [ebp - 0x10c]
test bl, al
cmp ebx, edx
cmp dl, 0x8a
sub edx, edx
cmp bp, si
cmp ebp, 0xd71d8c2d
sub edi, eax
jmp 0x7f1e3b
cmp ecx, eax
je 0x74a6a4
lea ebx, [ebx]
shrd esi, edx, 0x14
jb 0x7a92df
mov eax, dword fs:[0x30]
neg ch
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
test dx, sp
mov eax, dword [eax + 0x10]
cmp esp, ecx
rcl bl, 0xbc
mov dword [ebp - 4], eax
sbb bx, 0xaa3d
ror bh, 0xb1
add ebx, 0x3420e539
mov ebx, ecx
cmp si, dx
jmp 0x740ae8
mov eax, 0x84881f25
rcl cl, 0x11
mov cl, dl
rol eax, cl
lea esi, [ebp + edx - 0x10c]
cmp ax, dx
clc
add al, dl
xor al, byte [edi + esi]
jmp 0x875c91
neg edx
mov dword [esp + eax - 0x5019], 0x97161903
call fcn.0076fcea
push ebp
adc ebp, ecx
rcr bp, 0x1e
mov ebp, esp
clc
jmp 0x731121
jmp 0x7a92df
mov byte [esi], al
je 0x745fc5
inc edx
cmp edx, 0x104
jmp 0x745fbf

Function at 0x8041a8
Capabilities:
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
inc dx
neg dword [esp]
inc ecx
xor ebp, 0x153480
dec ax
inc edx
shl byte [esp - 1], 0x22
inc edi
lea ebp, [ebp + 0x47b52d04]
jae 0x86b24b
dec edx
mov dword [esp - 4], eax
inc ecx
not ebp
inc ecx
dec ebp
inc cx
xadd ecx, edi
inc ecx
bswap ebp
inc ebp
movzx edi, ah
inc ecx
neg ebp
jmp 0x7dfba9
inc edx
neg byte [esp - 1]
dec esi
mov dword [esp - 2], edx
call fcn.0077fb49

Function at 0x804b6d
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
not al
ror edx, 2
xor eax, 0xb8b4e208
jnp 0x818afd
mov esi, 0xa6aa631b
mov byte [0xaa364794], al
mov edx, 0x3647c0f6
stosb byte es:[edi], al
sub byte [esi - 0x55c9b868], 0xba
stosb byte es:[edi], al
pushfd
inc edi
stosb byte es:[edi], al
stosb byte es:[edi], al
lcall 0xf5aa, 0x339641b2
mov dword [eax - 0x45b94965], eax
cwde
xor byte [edi], al
lcall 0x8029, 0x89199bcc
je 0x768a38
retf
lea edi, [edi + edx - 0x2b2147f8]
not dword [esp + edx - 0x2b214800]
jnp 0x810269
xor eax, 0xcd1f701f
lea edx, [edx*4 - 0x3a7a9bf7]
shl edx, 0x4b
mov dword [esp + edx - 0x2b214800], edx
neg eax
inc edx
pop edx
sete dl
lea eax, [eax + ecx + 0x1b70437]
xor ebx, eax
add esi, eax
xadd word [esp + edx*2 - 0x56428ffd], cx
pop eax
mov eax, dword [edi + edx*2 - 0x56428ffc]
jno 0x7aa7f0
movzx ax, byte [ebp]
mov ecx, 0x6400383c
mov cl, byte [ecx + ebp - 0x6400383a]
jmp 0x83d886
xor eax, ebx
neg cx
and edx, 0x3c1e06b7
rol ecx, 0x41
inc eax
dec edx
not eax
xor eax, 0xe511ebaa
pop edx
ror eax, 3
xor ebx, eax
call fcn.007c2e37
dec edx
not edx
add eax, eax
dec edx
dec eax
xadd cl, ch
xor ebx, edx
sal cx, 0x4c
adc cl, cl
adc esi, edx
jmp esi
mov edx, 0x88b0f299
add ebp, 2
neg dl
shr al, cl
mov word [ebp], ax
lea ecx, [edx + edx - 0x27df2dcc]
sar dx, cl
sub ecx, 0x8f1c49b5
mov edx, dword [edi + ecx - 0x5a666d4d]
movsx eax, cx
lea edi, [ecx + edi - 0x5a666d49]
jno 0x768a0b
dec esp
mov dword [esp + ecx*2 - 0x6661987e], ebx
ret 0x10
Function at 0x80ec80
Capabilities:
Encode data using xor

Disassembly:
lea edi, [eax + edi - 0x5301c7fc]
rol dword [esp + edx*2 - 0x18ffc], 0x52
and dx, ax
or dword [esp + eax - 0x5301c800], 0x468c9f0e
xor ecx, ebx
sub eax, dword [esp + edx - 0xc7fd]
ror word [esp + edx - 0xc7fe], 0xa8
inc ecx
shl word [esp + edx*4 - 0x31ffd], 0xa4
not ecx
xor ecx, 0xe511ebaa
lea edx, [edx*4 - 0x4340ff63]
sar edx, 0x8f
ror ecx, 3
sar word [esp + eax - 0x5301c7b6], 0x2c
xor ebx, ecx
lea edx, [edx + eax + 0x1db27511]
push eax
lea ebp, [ebp + edx - 0x70b3b653]
jmp 0x849a11
mov dword [esp + ecx], ecx
rol ecx, 0x99
inc edx
neg byte [esp + ecx*4 + 2]
add ax, cx
bswap edx
adc eax, eax
rol eax, 0xc6
add word [esp + ecx*8], ax
not edx
or byte [esp + ecx + 2], 0x3d
xadd byte [esp + ecx*4 + 1], ah
sar dword [esp + ecx*2], 0x78
sbb edx, 0x81915bbf
push ecx
lea eax, [eax + ecx*2 + 0x7c834000]
dec al
xor ebx, edx
add esi, edx
xor ecx, dword [ecx + edi]
xor eax, dword [esp + eax - 0x5301c7fc]
movzx edx, ax
jns 0x7c1206
rol byte [esp + edx - 0x70b3b64b], 0x62
mov dword [ebp + eax - 0x5301c7ba], ecx
movsx ecx, byte [esp + edx - 0x70b3b647]
pop eax
pop ecx
pop edx
jae fcn.007541d4
movzx ebx, si
inc ecx
xor edi, edx
dec eax
lea eax, [esi*2 + 0x4a9dc822]
inc esp
mov edi, eax
not edi
inc ecx
shr edi, 0xa9
adc byte [esp + ebx - 0x4611], bl
dec edi
dec eax
sal dword [esp + ebx - 0x461c], 0x76
call fcn.0078f1d8
cld
or edx, dword [ecx - 0x291f4b56]
push edi
les ebp, [edx + 0x57facccc]
les ebp, [edx + 0x57a690e8]
les ebp, [edx + 0x578abcdc]
les ebp, [edx - 0x79bc4f14]
shr dword [edx + 0x6990bbc7], 0xb6
das
stosb byte es:[edi], al
pop es
mov dh, 0xbe
shl dword [esp + ebp], 0x91
xor al, 0x55
xchg edx, eax
imul esp, dword [eax], 0xf05dfc71
xchg edx, eax
sar byte [edi], cl
inc ebp
lcall 0x6e57, 0x45216469
or edx, dword [ecx + 0x13774140]
wait
dec edi
mov edi, dword [ebp - 0x2533dcef]
push cs
sub dword [eax], esi
jle 0x849a87
pop ss
cmp al, byte [ebx + edi*4 + 0x74]
adc al, 0x46
xchg ebx, eax
loope 0x849adb
mov dword [0x811a0915], edi
or dword [edx - 0x6b], ecx
xchg ebp, eax
or dword ss:[ecx], 0x12e0a84a
or dword [ecx], 0x60d1d4a
or dword [ecx], 0xe89f94a
mov dword [esi], ecx
cmp byte [esi + 0x4a], ch
stosb byte es:[edi], al
or bh, byte [esi - 0x7e999aa7]
std
xor ebp, dword [ecx - 0x761d7a9a]
jge 0x849ae8

Function at 0x816690
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
xor edx, ebx
mov dword [esp + eax*2 - 0x2abac6e], eax
inc edx
mov ecx, eax
not edx
xchg cx, ax
sar cx, 1
setg byte [esp + eax*2 - 0x2abac6d]
xor edx, 0xe511ebaa
call fcn.0078d8f3
imul esp, dword [ebp + 0x72], 0x6e
insb byte es:[edi], dx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + 0x32], al
cli
inc eax
ror bh, 1
inc esp
movsx ecx, al
inc ebp
and cl, cl
dec eax
rol eax, 2
inc eax
sbb bh, 0x3a
inc cx
xchg esp, ebx
inc eax
xor bh, 0x1b
inc ebp
mov ebp, esp
mov esi, eax
inc eax
add bh, 0x88
dec eax
lea edx, [ebx + ecx*2 + 0x15bc6391]
inc eax
ror bh, 1
call fcn.00811cbc
Function at 0x81d30f
Capabilities:
Encode data using xor

Disassembly:
dec eax
lea ebx, [ebp*2 - 0x1addca4c]
dec ebp
lea eax, [eax + eax - 0x3a77]
inc ebp
xor esp, edx
inc eax
shl ch, 0xa7
inc ecx
not esp
dec eax
shr eax, 0xfc
inc al
sub eax, eax
inc ecx
ror esp, 2
dec ecx
or ebx, ecx
call fcn.00788df0
inc ecx
rol ecx, 1
dec esp
lea edi, [ebx + ebp*4 - 0x27c39e9]
call fcn.008211d5
inc ebp
mov ebp, dword [esi]
inc ecx
mov ecx, 0x6d89cf2e
inc ecx
mov esp, 0xa89cb7b3
inc ecx
movzx edx, cl
dec edi
lea esi, [esi + ecx - 0x6d89cf2a]
inc ecx
movsx eax, cx
inc edi
movzx ecx, byte [eax + ecx - 0x6d89cf2e]
call fcn.00758302
inc cx
rol edi, 0x44
inc ecx
rol ecx, 1
dec edx
mov dword [esp], 0x41376da1
dec edx
and dword [esp], ebx
inc ebp
lea ecx, [ecx + ebx - 0xef827f0]
inc ecx
push esp
jb 0x76739f
sub bx, 0xc21
inc ecx
neg ecx
inc sp
sub esp, ebx
inc dx
xor dword [esp - 0x671e], edi
dec esi
mov dword [esp - 0x6716], edx
inc esi
xor dword [esp - 0x6716], ecx
inc ecx
shl ah, 0xe3
dec esi
mov edx, dword [esp - 0x67e8]
dec edx
mov dword [esp - 0x67e8], edi
dec ebp
arpl cx, cx
dec esi
or dword [esp - 0xcfd8], edi
inc edx
mov byte [esp - 0x67e2], bl
dec ebp
adc ebx, ecx
dec edx
shl dword [esp - 0x67e8], 0x15
call fcn.007eb260
dec ebp
lea eax, [eax + ebx - 0x7204fa17]
inc ebp
xor ecx, edx
movzx ebp, bl
jmp 0x782e3c

Function at 0x8448e9
Capabilities:
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
not edx
mov dword [ebp + ecx*8 - 0x51bccdf8], edx
movsx edx, cx
mov eax, dword [ecx + edi - 0xa3799bf]
push ecx
mov dword [esp + ecx - 0xa3799bb], edx
lea edi, [edi + ecx*2 - 0x146f337a]
ror edx, cl
Function at 0x84859a
Capabilities:
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
shr byte [esp + 1], 0x42
sbb edx, 0xde90a936
not cx
lea ecx, [ecx*4 + 0x482d552d]
xor edx, 0xd0d6e30
xor cx, 0x4706
sbb edx, 0x563b6f33
xor ebx, edx
mov eax, 0xd53bdc0b
add esi, edx
mov edx, dword [esp]
mov ebp, dword [edx + ebp - 0x6d400000]
pop ecx
jmp fcn.007541d4
inc ecx
mov esi, ebp
dec edi
lea esi, [esi + ebp*2 - 0x54a5b6e]
dec eax
shl edx, cl
call fcn.007eee67
mov ecx, 0x343c36a9
mov edx, dword [edi + ecx - 0x343c36a9]
sub ecx, 0x3681989a
jle 0x87718f
mov ecx, dword [ebp + ecx*8 - 0x1228000c]
jnp 0x7dcdb8
not ecx
xor edx, ebx
neg dword [esp]
neg edx
jmp 0x7c46dd
rol edx, 3
or ecx, ecx
jl 0x5b9878
pop ebp
dec ebp
mov dword [esi + esi - 0x318e7f90], ecx
dec eax
lea ecx, [esi*4 - 0xafb2b50]
inc ecx
push ebp
dec esp
mov dword [esp + esi - 0x318e7f90], ebx
ret 0x20
add ebp, 4
call fcn.00737c4d
dec ebx
cmp ah, bh
inc ebx
xor byte [ebx + 0x12e0a503], bl
call fcn.007ed0ec
jno 0x7dce30
push 0x576129aa
add byte [0x5b6d51aa], bh
add byte [0x6f5975aa], bh
add byte [0x734515aa], bh
add byte [0x803919aa], bh
push ecx
daa
stosb byte es:[edi], al
pushfd
sti
push esp
ficom word [ebp - 0x33]
mov ecx, 0xc96df52c
cmp eax, 0x6e1a908b
stosd dword es:[edi], eax
adc ebx, edx
int 0xb7
push ds
sbb dh, byte [edi]
mov cl, 0x36
mov ch, 0x6a
cmp dl, al
pop ss
outsd dx, dword [esi]
ljmp 0x5aec
or eax, 0x3db31e49
imul ebx, dword [ecx], 0x3db3121d
imul edi, ebp, 0x4293062d
imul esp, ecx, 0xf5aa685f
sal edi, 3
cmp eax, 0xa395f9aa
add edi, dword [0xf3c591aa]
add edi, dword [0xbf89adaa]
add edi, dword [0x1eedf9aa]
sar byte [eax], cl
stosb byte es:[edi], al
mov esi, 0xb690c4c2
shl byte [edx + 0x52], 0x7b
in eax, 0xbc
test byte [edx - 0x13], dh
xchg esp, eax
pop ebp
imul esi, edi, 0xefa8c04f
push edi
imul eax, dword [ebx + edi*4 - 0x66], 0xe005b623
inc ecx
invalid
inc si
mov dword [eax + esi + 0x469d997d], esp
and al, dh
dec esi
mov dword [esp + ebp - 0xbf], edi
adc word [esp + eax + 0x469d99fc], cx
dec ebp
lea esi, [esi + edx - 0x434c8820]
inc dx
or eax, dword [esp + ebp*2 - 0x175]
pop edi
inc ecx
pop ebp
pop eax
jae fcn.008764ee
jmp 0x76a1a8
add edi, 4
not ecx
not cl
ror cl, 1
xor edx, ebx
xor edx, 0x1996eba6
not edx
neg edx
shr cx, 0xd
sbb edx, 0xa41b1613
ror cx, cl
sbb cl, cl
xor ebx, edx
and cx, 0xcaa
inc ecx
adc esi, edx
mov edx, dword [ebp + ecx*2 - 0x48a0002]
inc cx
jnp 0x7bce9b
dec ebp
add ebx, edi
inc esi
and cl, byte [esp + ebp - 0x2a52db4]
dec ebx
mov edx, dword [esi + ebp*4 - 0xa94b6e0]
inc ecx
push ebp
inc ecx
movsx edi, cx
inc ebx
add cl, byte [esi + ebp*4 - 0xa94b6d8]
jmp 0x749065
Function at 0x866006
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edx + 0x3c]
stc
clc
test dx, 0xbe91
add eax, edx
cmp esp, 0x3d92618d
clc
cmp dword [eax], 0x4550
jmp 0x797183
pop esi
jmp 0x843685
jmp 0x745fa0
jne 0x7b3adb
mov ecx, dword [eax + 0x78]
cmp bp, di
mov dword [ebp - 4], ecx
test ecx, ecx
jmp 0x87b4a0
je 0x749e6d
sub eax, eax
jmp 0x76a3a3
push ebx
test edi, esp
push edi
mov dword [ebp - 0x10], eax
stc
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0x817ff3
je 0x75516e
mov eax, dword [ecx + edx + 0x20]
dec edi
lea eax, [eax + edx]
cmp si, cx
xor ebx, ebx
test bx, bp
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x75516e
jmp 0x839989
ja 0x865660
mov eax, esi
cmc
sub eax, dword [ecx + edx + 0x10]
jmp 0x774090
mov edi, dword [ecx + edx + 0x18]
cmc
test edi, edi
jmp 0x7f700e
push ebp
cmc
mov ebp, esp
not edx
and dl, 0x2a
test bx, 0x5b12
mov edx, dword [ebp + 8]
lea esp, [esp - 0x114]
test dl, bl
push esi
test di, cx
cmp ch, 0x93
test edx, edx
je 0x7b3adb
mov esi, dword [ebp + 0xc]
test cl, 3
test esi, esi
je 0x7b3adb
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x7b3ad5
je 0x7b3adb
mov eax, dword [eax + 0x7c]
jmp 0x7c2a7d

Function at 0x86dba5
Capabilities:
Encode data using xor

Disassembly:
dec ebp
arpl sp, sp
inc cx
sar ecx, 0x48
dec ebp
adc ebx, esp
inc edx
dec dword [esp + ecx - 0x583c0049]
pop ebp
pop edx
pop ebp
pop ecx
pop edx
jge fcn.008764ee
inc ebp
mov edi, dword [esi]
inc ecx
mov eax, dword [esi + 4]
jmp 0x74bc67

Function at 0x8757d3
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x5739590b
xor eax, ebx
push 0x6ab39d06
not eax
call fcn.0082a3b7
push 0x87a1cb87
inc ecx
mov eax, dword [eax]
push 0xe803d703
inc esp
mov esp, dword [esp + 7]
dec ecx
add eax, 4
inc esp
movsx ecx, word [esp + 7]
inc ecx
xor eax, edx
dec edi
lea ebp, [ecx + ecx*4 + 0x329deb05]