joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401790
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
test ebp, ebp
je 0x40198b
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipCursor]
push edi
mov edi, dword [sym.imp.USER32.dll_CloseDesktop]
nop
push 0
call edi
push 0
call esi
mov ecx, dword [esp + 0x14]
push 0
xor byte [ebx + ecx], 0x79
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x60
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x29
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xe5
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
xor byte [ebx + eax], 0xf
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
xor byte [ebx + eax], 0xcc
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xc4
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x15
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
xor byte [ebx + eax], 0x7a
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x78
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xd
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xb6
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x4b
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xac
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xfe
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x32
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xe7
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xfb
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
xor byte [ebx + eax], 0x51
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
xor byte [ebx + eax], 0x85
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0xd5
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x25
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x1a
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x3d
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x57
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x21
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
xor byte [ebx + eax], 0xc7
push 0
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
push 0
add byte [ebx + eax], 0x6c
call edi
push 0
call esi
mov eax, dword [esp + 0x14]
add byte [ebx + eax], 0x63
inc ebx
cmp ebx, ebp
jb 0x4017b0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401990
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov eax, dword [0x45640c]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x10], ebx
mov eax, dword [ebx + 0x3c]
push edi
mov dword [esp + 0x18], 0
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [ecx + ebx + 0x20]
add ecx, ebx
mov dword [esp + 0x20], ecx
add eax, ebx
mov dword [esp + 0x10], eax
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x401b2b
mov edi, dword [esp + 0x48]
nop
mov edx, dword [eax]
xorps xmm0, xmm0
add edx, ebx
mov dword [esp + 0x34], 0
mov eax, edx
mov dword [esp + 0x38], 0
movups xmmword [esp + 0x24], xmm0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401a01
sub eax, esi
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.00401070
test ebx, ebx
je 0x401adb
cmp edi, 3
jbe 0x401adb
mov edi, dword [esp + 0x34]
lea ebx, [esp + 0x24]
mov esi, edi
xor esi, 0x14d
cmp dword [esp + 0x38], 0x10
cmovae ebx, dword [esp + 0x24]
push ebx
shr edi, 2
push edi
push str._x_and__p
call fcn.00401de0
add esp, 0xc
xor edx, edx
test edi, edi
je 0x401a81
nop dword [eax + eax]
imul ecx, dword [ebx + edx*4], 0x5bd1e991
inc edx
imul esi, esi, 0x5bd1e991
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e991
xor esi, ecx
cmp edx, edi
jl 0x401a60
mov eax, dword [esp + 0x34]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x401aab
sub eax, 1
je 0x401aa1
sub eax, 1
jne 0x401ab9
movsx ecx, byte [ebx + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [ebx + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [ebx + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor esi, eax
mov edi, dword [esp + 0x48]
mov eax, esi
shr eax, 0xd
xor eax, esi
imul eax, eax, 0x5bd1e991
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
je 0x401ad7
cmp ecx, edi
je 0x401b44
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
add eax, 4
mov dword [esp + 0x10], eax
cmp ecx, 0x10
jb 0x401b20
mov edx, dword [esp + 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401b12
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401b97
push ecx
push edx
call fcn.0040276a
mov eax, dword [esp + 0x18]
add esp, 8
inc ebp
cmp ebp, dword [esp + 0x1c]
jb 0x4019e0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
add eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402778
add esp, 0x30
ret
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov eax, dword [edx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + ebx]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x38]
cmp ecx, 0x10
jb 0x401b2b
mov edx, dword [esp + 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401b8b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401b97
push ecx
push edx
call fcn.0040276a
add esp, 8
jmp 0x401b2b
call fcn.0040574f
int3
Function at 0x100320c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x1046008], 0x8088405
inc edx
mov dword [ebx + 0x1046008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x10189bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1018aaa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.01005068
lea eax, [ebp - 8]
mov edx, edi
mov ecx, 0
call fcn.01005068
mov eax, dword [ebp - 8]
test eax, eax
je 0x1018a1f
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x1018a1f
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.010046b4
test eax, eax
je 0x1018a28
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x1018a4a
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x1018a4a
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.010046b4
test eax, eax
je 0x1018a53
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x1018a84
mov ebx, 1
lea eax, [ebp - 4]
call fcn.010049f8
lea eax, [eax + ebx - 1]
push eax
mov eax, ebx
dec eax
cdq
idiv dword [ebp - 0x10]
movzx eax, word [edi + edx*2]
mov edx, dword [ebp - 4]
xor al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
inc ebx
dec esi
jne 0x1018a5e
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.01005040
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1018ab1
lea eax, [ebp - 8]
mov edx, 2
call fcn.01004514
ret
Function at 0x410a70
Capabilities:
Encode data using xor

Disassembly:
pop ecx
dec edx
pop edi
jo 0x410a18
or dh, bl
inc esi
cli
fimul word [edx + 0x7a]
push edi
inc di
shr byte [edi], 0x99
rcl dword [esi], cl
push ss
jns 0x410a51
mov al, 0xe
dec ebp
mov dl, 0x4d
std
fistp word [ecx + ebx*2 + 0x45]
jno 0x410a6b
jb 0x410a04
and bh, bh
xlatb
ljmp 0xb200
inc esp
mov edi, 0x8946fef8
salc
inc esi
mov esi, edx
push ds
invalid
jbe 0x410abd
je 0x410a4c
adc al, 0x12
xor esi, dword [ecx]
test byte ss:[ebx + 0x11cde790], dl
out 0xcd, eax
adc dword [edx + ebx*8 - 0x40], edx
mov edi, 0xf789fb41
mov edx, 0xb3e68276
jae 0x410a72
jmp 0x410ae3
cld
pop edx
pop ebx
enter 0x1ede, 0x52
lahf
inc esi
cld
pop edx
xchg ebp, eax
invalid
push ecx
dec dword [ebx - 0x280385ce]
push ds
push 0x9531dde
mov dl, 0x1f
invalid
invalid

Function at 0x41ad08
Capabilities:
Encode data using xor

Disassembly:
fcmovb st(0), st(0)
add dh, byte [edx + 0xda3f946]
mov bl, 0x73
in al, dx
out 0xcd, eax
adc dword [edx + ebx*8 - 0x28], edx
mov esi, 0xf789f841
mov edx, 0xb3e29276
cmpsb byte [esi], byte es:[edi]
inc eax
add dword [eax], eax
mov dl, 0xcf
test al, 0x37
aaa
xchg ebp, eax
test al, 0x6e
push ss
add eax, dword [eax]
cmp edx, dword [ebx]
sbb dword [esi + ecx*4 + 0x64], ebx
xor al, 0x14
add ecx, dword [ecx - 0x6d895119]
loop 0x41ac11
mov dh, 0x70
add dword [eax], eax
mov dl, 0xe
je 0x41abf8
mov bl, 0x73
mov bl, 0x73
call 0x44ac2cf6
std
xlatb
push esi
mov cl, 0x73
in al, 0xf5
inc ebp
dec ecx
inc edi
mov eax, eax
xchg ebp, eax
jge 0x41ac47
lahf
adc dword [eax + esi*4 + 0x46], 0xfffffffd
pop esp
dec ebx
les ecx, [0xb2027b96]
inc esi
adc esp, 0xffffffe1
jne 0x41ac67
loop 0x41acd9
sti
mov al, 0x32
in al, dx
pop esp
pop ebx
les edi, [ebp - 0x4dfda86c]
inc esi
invalid
push edi
mov byte [0xb3e29276], al
mov dh, 0x40
add dword [eax], eax
mov dl, 0x7d
mov eax, 0xbd366b37
push ecx
dec dword [ebx - 0x2800e1ce]
push ds
add esi, dword [ebx - 0x10]
ja 0x41ad03
aas
adc ebx, dword [0xdec45b5c]
push ecx
int3
int 0x18
mov bl, ch
test al, 0x63
arpl word [edi + 0x327681ef], bx
add ch, byte [eax]
loope 0x41ad7d
mov edi, 0xf789ef41
mov edx, 0xb2e29276
mov dh, 0xed
add dword [eax], eax
mov dl, 0x6a
cld
mov dword [0x38cb3c14], eax
add dword [edi], ecx
xor dword [esi - 0x4ae12803], edi
jae 0x41ad12
push ebx
call 0xd83795c8
xchg ebx, eax
mov ch, 0x42
jmp 0x41ad39
Function at 0x41b4d0
Capabilities:
Authenticate hmac

Disassembly:
add al, 0xc
out 0x15, al
cdq
mov ch, 0x5d
pop ecx
pop edx
jno 0x41b548
sal dword fs:[ecx + edi], cl
pop edi
cmp dh, bh
add byte [esi], cl
cwde
inc esi
test byte [edx + edi*2 + 0x6f75555a], 0x65
fsub qword [edx]
mov ch, 0x46

Function at 0x4202f0
Capabilities:
Encode data using xor

Disassembly:
sub edx, dword [ebp + 0xb9f0278]
jmp ebx
push ebp
inc edx
iretd
push esi
mov ebx, dword [esi - 0x3b]
cmp dword [edi], ebp
xchg edi, eax
jge 0x4202c3
lahf
inc esi
cld
cmp dword [esi], eax
lodsd eax, dword [esi]
and dword [esi + 0x6f], ebx
mov dh, 0x60
adc ecx, dword [ebx + 0x2c15baf7]
loop 0x4202d3
leave
lahf
push esi
cld
mov byte [ecx*8 - 0x9f4e55e], al
inc dword [ecx]
mov al, 0xb3
into
mov eax, 0xcd7d942c
dec ebp
pop edx
pop ebp
jno 0x4202fc
insd dword es:[edi], dx
inc edi

Function at 0x4206b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov ebx, dword [esi - 0x3b]
cmp dword [edi], esp
dec ebp
or ebp, ebp
popfd
pop esi
invalid

Function at 0x425ff0
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xef
test ch, dh
xlatb
mov gs, word [eax + 0x51ef9f63]
arpl word [edi - 0x301eae11], bx
push ds
invalid
arpl word [edi - 0x41897c11], bx
je 0x425f8a
loop 0x425fad
jae 0x425fe4
mov byte [eax - 0x2802bd66], al
xchg ebp, eax
js 0x426037
popfd
inc esi
clc
cmp dword [ebx], eax
add eax, 0xf565478e
invalid

Function at 0x427db4
Capabilities:
Encode data using xor

Disassembly:
mov esi, edi
mov edx, 0x3c525776
adc al, 0xeb
adc ebx, dword [esi]
mov ecx, 0x295e5d02
mov esi, 0xf78af451
mov cl, 0x76
xor al, byte [ebx - 5]
cmpsb byte [esi], byte es:[edi]
test byte [esi - 0x75], dl
push esi
mov ebx, dword [esi - 0x3b]
cmp dword [edi], ebp
hlt
push esi
mov ebx, dword [esi - 0x3b]
cmp dword [edi], ebp
dec ebp
mov cl, 0x73
call 0xcd90c2de
jne 0x427d2b
rcr dword [0x469f3638], cl
sbb eax, 0x469f3638
cld
cmp esi, edx
std
aam 0x1e
cmp byte [ebp - 0x557400af], bh
mov ecx, 0x381e336e
lahf
inc esi
cld
cmp esi, eax
in eax, dx
aam 0x1e
cmp byte [edi - 0x87404af], bh
mov edi, 0xf78bfb51
mov esi, 0x65478ea6
cmc
test byte [esi - 0x75], dl
push esi
mov ebx, dword [esi - 0x3b]
cmp dword [edi], ebp
xchg edi, eax
jge 0x427d57
lahf
inc esi
cld
cmp esi, edx
std
aam 0x1e
cmp byte [ebp + 0x328bff51], bh
or bh, cl
xlatb
push ds
rcr byte [esi + 0x39fffcbf], 1
push es
fstp qword [esi + 0x5b]
pop ebx
sar byte [ebp - 0x14a604af], 0x1b
inc edi
mov gs, word [eax - 0x7c10609d]
invalid
lahf
out dx, eax
invalid
jbe 0x427d78
je 0x427d3e
out 0xb1, al
jae 0x427da8
mov byte [ebp + 0x4e], al
int 0x6d
xlatb
sbb eax, 0x469f3638
cld
cmp esi, eax
mov cl, 0xd3
push ds
cmp dh, bl
popal
test al, 0xff
dec ebp
int 0xa8
das
xchg edi, eax
push 0x5d5a4d16
jno 0x427db8
insd dword es:[edi], dx
inc edi

Function at 0x429820
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esi + 2], edx
test dword [esi + 0x61], esp
imul edx, edi, 0xffffff93
nop
out 0xcd, eax
adc dword [esi - 0x60358269], eax
inc esi
cld
xor bh, dh
rcr dword [0x3638], cl
bound ecx, qword [edx]
mov esi, edi
mov edx, 0x3c845f03
adc al, 0x5a
pop ebp
jno 0x429816
Function at 0x429840
Capabilities:
Encode data using xor

Disassembly:
mov gs, word [eax + 0x51ef9f63]
cmp eax, dword [ebx]
test al, 0x5c
mov ebx, 0xc930f4f2
cmp ecx, dword [ebx]
sbb eax, 0xbfc04b5e
push ecx
push dword [ebx]
jb 0x429867
xchg ebp, eax
jle 0x4297de
jp 0x42988f
jo 0x429857
xor dh, dl
iretd
ret 0xd83d
call [ebx - 3]
std
std
xlatb
push ds
mov bl, 0x73
call 0x43411922
std
xlatb
imul cl
xchg ebp, eax
adc eax, dword [ebx]
dec eax
aaa
xchg dl, dh
pop ebx
mov edx, 0x43143638
mov edi, esi
mov byte [0x38ea923a], al
adc al, 3
xor esi, dword [edx - 0x31]
mov eax, 0xc26d9527
lahf
inc esi
cld
cmp esi, eax
mov cl, 0xd3
push ds
cmp dh, bl
xchg ebp, eax
xchg ebx, eax
dec dword [ebp - 0x33]
mov ebp, 0xc67d25cb
push 0x61
mov esp, edi
mov dl, 0x76
xchg edx, eax
loop 0x42988d
mov dh, 0x58
pop es
add byte [edx - 0x1eb86a52], dh
invalid
Function at 0x429fdc
Capabilities:
Authenticate hmac

Disassembly:
xor dword [ebx + 0x7d], ebp
jno 0x42a033
cmp byte [edi], dh
adc al, 0xaf

Function at 0x42cf80
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
jge 0x42cee7
lahf
out 0x5d, al
jno 0x42cf68
std
xlatb
loope 0x42ceed
leave
jmp 0x42cf30
adc al, 3
mov esi, edi
adc eax, 0xde381ed5
inc edi
adc eax, dword [eax]
mov dl, 0xcd
mov eax, 0x34a7f62b
adc al, 3
pop ecx
mul byte [edi + 0x59031434]
jmp 0x42cf97
arpl word [edi - 0x41897c11], bx
je 0x42cf1a
loop 0x42cf3d
jae 0x42cf74
mov byte [eax - 0x2802bba6], al
xchg esp, eax
js 0x42cfb4
pushfd
inc esi
sti
cmp byte [ebx], al
push es
mov es, word [edi + 0x65]
cmc
test byte [esi - 0x75], dl
push esi
mov ebx, dword [esi - 0x3b]
cmp dword [edi], ebp
xchg esi, eax
insd dword es:[edi], dx
int 0x9d
inc esi
cld
cmp byte [ebx], dl
push es
pop esp
pop ebx
les edi, [ebp - 0x4dfd146c]
inc esi
jmp 0x42cfb8
adc eax, 0x36380e88
dec ebp
pop edx
pop ebp
jno 0x42cf98
insd dword es:[edi], dx
inc edi

Function at 0x42d020
Capabilities:
Encode data using xor

Disassembly:
dec ebx
mov bl, 0xda
xchg edi, eax
xbegin 0x5c43d345
pop ebx
les edi, [ebp - 0x4dfd146c]
inc esi
ja 0x42cfab
mov al, 0x73
out dx, eax
mov dword [ebp + 0x49], eax
pop ds
movsb byte es:[edi], byte [esi]
mov bl, ch
test al, 0x63
arpl word [edi - 0x41897c11], bx
jne 0x42cfaa
in eax, 0xb1
jae 0x42d014
mov dword [ebp + 0x49], edx

Function at 0x43d4ec
Capabilities:
Encode data using xor

Disassembly:
jne 0x43d49a
mov es, word [ebp + 0x62]
cld
cmc
xlatb
push ds
cmp dh, bl
stc
popal
push es
mov dl, 0xcb
mov eax, 0x54d3f62b
adc al, byte [ebx]
ret
add eax, ebx
pop ebx
inc ebp
sahf
rcr dword [esi], 1
rcl ebp, cl
dec edi
mov ch, ah
out dx, eax
test dword [edx], eax
sub cl, ah
invalid
add esi, ecx
mov dl, byte [esp - 0xffa3749]
push ebp
jbe 0x43d49a
cmp byte [esi], dh
adc al, 0xfc
dec dword [ebp - 0x47]
invalid
out 0xcd, eax
adc dword [edx + ebx*8 - 0x74], edx
daa
fmul dword [ecx - 0x758b0d11]
int 0x11
push esp
fimul dword [ebp - 0x107627d9]
bnd je 0x43d484
cmpsb byte [esi], byte es:[edi]
mov cl, 0x6b
test al, 0x8a
dec ebp
jp 0x43d4d1
test al, 0x1b
xchg edi, eax
jge 0x43d4ed
lahf
inc esi
int3

Function at 0x44c45c
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
mov esi, 0x16d7b044
push ds
xor byte [ebx + 0x64], ah
push edi
imul eax, esi, 0x8ea4982a
test al, 0x63
arpl word [edi - 0x41897c11], bx
je 0x44c3e6
out 0xb1, al
arpl word [edi - 0x41897c11], bx
je 0x44c3e6
out 0xb1, al
jae 0x44c450
mov byte [ebp + 0x4a], al
int 0xed
push esi
hlt
Function at 0x450d74
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
mov ecx, 0x4f1c186a
xor dword [ebp - 0x4e], ebx
salc
cmc
xlatb
push ds
cmp byte [esi], dh
adc byte [ebx], dl
add byte [edx + 0x1cd7b840], al
cmp byte [esi], dh
adc al, 0x57
xlatb
sbb al, 0x38
adc al, 0x57
dec esi
xlatb
xor eax, 0x7b7ab289
pop ecx
js 0x450de1
insd dword es:[edi], dx
fdiv qword [0xa45fddd]
imul edx, dword [esi + edx*2], 0xffffff8b
push esi
mov ebx, dword [esi - 0x3b]
cmp dword [edi + 0x4d], ebp
push esi
mov ebx, dword [esi - 0x3b]
cmp dword [edi + 0x4d], ebp
outsb dx, byte [esi]
popal
popfd
push esi
sar byte [ebx], 1
add ebp, dword [ecx]
outsd dx, dword [esi]
jle 0x450d5b
jl 0x450d9c
jmp 0x450d8d
pop esp
pop ebx
call 0x56ea172
mov dl, 0x7d
clc
mov ebx, 0x1b3672e8
xchg byte [edx], bl
mov bl, 0x46
std
pop esp
dec ebx
in al, dx
mov ch, 0x6e
pop es
add dh, al
push ebp
jbe 0x450d46
retf 0xf7bb
cmp dl, byte [edx - 0x60c9cf0a]
push ss
insb byte es:[edi], dx
inc esp
or al, 0xfd
pop esp
pop ebx
call 0x591a5ae
mov dl, 0xcd
ficom word [edi - 0x324dfab4]
sub eax, 0xbd28dc54
push ecx
xlatb
xor dword [edx + 0x56], 0x15
pushal
or eax, 0x169f363d
adc eax, 0x363d0d60
lahf
push ss
insb byte es:[edi], dx
inc esp
or al, 0xfd
pop esp
pop ebx
call 0x5917fcc
mov dl, 0xae
adc ebp, edx
fidiv word [ecx + 0x4c]
add eax, 0xd511aeb2
push ds
cmp byte [ebp - 0xc7628a7], bh
push edx
jbe 0x450dbe
jb 0x450dcc
jl 0x450e14
mov byte [ebp + 0x62], al
scasb al, byte es:[edi]
mov cl, 0x98
sbb edi, dword [eax]
mov ebp, 0xbec280c4
int 0xb8
add ebx, dword [ebp - 0x7c03c508]
adc esi, dword [edi + 0x72c27646]
into
adc dword [ebx], 0xffffffb7
inc esi
jbe 0x450ddc
jb 0x450dea
jl 0x450e32
mov byte [ebp + 0x62], al
scasb al, byte es:[edi]
rcr dword [eax + 0x5cbd381b], cl
sbb ecx, dword [ebx - 0x608b6d09]
push es
mov bl, 0x23
js 0x450e28
cmc
dec edx
mov dl, 0xcd
mov eax, 0x792ff607
adc dword [ebx], eax
mov esp, edx
pop edx
jbe 0x450ddc
retf 0x77b3

Function at 0x451800
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
inc edi
push ss
cmp byte [esi], dh
adc al, 3
add al, 0xa2
inc esi
imul ebp, esi, 0x1434385b
add eax, dword [eax]
out 2, al
pushfd
mov dword [0x7a5f747f], eax
push 0xcf1d9820
mov bl, byte [esi]
test al, 0x3e
adc al, 3
add byte [edx - 0x392812be], dh
invalid
push esi
mov ebx, dword [esi + 0x17]
scasb al, byte es:[edi]
adc dword [ebx - 0x39], ebx
aaa
lahf
inc esi
or ah, dl
lds eax, [ebp + 0x4d]
push ds
cmp byte [esi], dh
adc al, 0x77
adc eax, 0x5c02133f
push ebx
xor byte [ebp - 0x4dff606b], bh
inc esi
jbe 0x4517be
push ss
invalid
Function at 0x451b3c
Capabilities:
Encode data using xor

Disassembly:
jb 0x451abd
inc ebp
pop edx
dec esi
std
pop edx
dec ebx
les edi, [ebp + 0x7283d751]
outsb dx, byte [esi]
adc eax, 0x363d09f2
nop
ret
or dword [0x74c39036], edi
mov esp, 0x952ba8cb
jge 0x451af7
xchg edi, eax
ret
arpl word [edi - 0x6d897c11], bx
je 0x451ac6
loop 0x451af7
jae 0x451b08
mov ebx, 0xfd0c5db8
aas
and byte [ecx], bh
xor edx, dword [esp + eax*8]
inc ebp
inc esi
inc edi
std
xlatb
push ds
mov ch, 0x63
call 0xae9360ee
mov edx, eax
sbb edi, dword [eax]
leave
push ecx
mul dword [esi + 0x75]
add edx, dword [0x63b51edf]
call 0xc5ab60fc
cmp eax, 0x208df6fb
adc dword [ebx], eax
test byte [edx + 0x32], dh
pop edx
dec ebx
les edi, [ebp + 0x7283d751]
push 0x15
and al, 0xb
cmp eax, 0xf44eeb36
aas
add eax, dword [ecx]
insd dword es:[edi], dx
sbb al, 0x38
adc al, 0xeb
mov bl, 0xa7
inc ebx
std
pop esp
push ebx
loopne 0x451bf3
popfd
push cs
add byte [edx - 0x4a302ba], dh
cmc
test byte [esi - 0x75], dl
push esi
mov ebx, dword [esi - 0x3b]
cmp dword [edi], ebp
xchg edi, eax
insd dword es:[edi], dx
into
popfd
inc esi
cld
xor dword [ebx], edi
add eax, 0xbd366ad7
inc ecx
sti
mov esi, edi
mov edx, 0xb32e9776
notrack jmp 0x451c1d
ret
push ebx
sar byte [ebp - 0x57600af], 0x7e
movsb byte es:[edi], byte [esi]
mov es, word [ebx - 5]
mov esi, 0xb1e68274
jae 0x451c0c
cmp byte [ebp + 0x4a], 0x46
mov ecx, ebx
xchg ebp, eax
insd dword es:[edi], dx
into
lahf
inc esi
cld
cmp dword [esi], eax
rcr dword [esi + edx - 0x39], 0x67
sbb al, 0x5a
pop ecx
out dx, eax
invalid
Function at 0x45a890
Capabilities:
Authenticate hmac

Disassembly:
xor dword [0x5f65357], ebx
xchg edx, eax
mov ebx, 0x7058556b
push es
dec ebx
mov dl, 0x3e
add bl, byte [ebx + 0x1236301e]
push eax
inc esp
cmc
xor al, 0x94
mov bl, 0x16
cmp byte [edx - 0x42], dl
inc esi
add byte [esi - 0x19], bl
mov eax, 0x7399e2d7
adc al, 2
add byte [edx + 0x1ed7fd46], dh
mov eax, 0x31436
mov dl, 0x46
not byte [ecx + esi*2 + 0x6d794354]
inc ecx
fisubr word [edi]
lcall 0x1b14, 0x739282b9
mov byte [0x75d546f7], al
pop ebx
cmp byte [edi], dh
adc al, 3
add byte [edx + 0x1e57fd46], dh
cmp byte [esi], dh
adc al, 2
add byte [edx + 0x6abe9903], bh
insb byte es:[edi], dx
dec edi
pushaw
dec ebp
or bh, ch
xchg ebx, eax
mov esp, 0xa140367d
inc ebp
mov dl, 0x47
std
xlatb
push ds
cmp byte [esi], dh
adc al, 0x83
add byte [edx + 0x1ed5fd46], dh
xor dword [ebp + 0x7b], esi
outsb dx, byte [esi]
invalid

Function at 0x4613a8
Capabilities:
Authenticate hmac

Disassembly:
add byte [ecx], bh
mov dword [0xa88e14a0], eax
arpl word [edi + 0x33b51ef], bx
add dword [edi + 0x23], edx
fdivr dword [edi + ebx*2]
add eax, dword [eax]
invalid
test al, 0x5c
mov ebx, 0x4d8ab4f2
adc cl, bh
test al, 0x73
xchg edi, eax
jge 0x461355
lodsb al, byte [esi]
mov edi, 0x1546f945
sbb byte [esi], dl
cmp al, 0x36
jmp 0x461439
invalid
xchg esp, eax
loope 0x4613f5
or eax, 0x1b6bd7fd
pop esi
cmpsb byte [esi], byte es:[edi]
add eax, dword [eax]
mov dl, 0x2e
push ebp
ret 0x3855

Function at 0x4615ec
Capabilities:
Encode data using xor

Disassembly:
add byte [ecx], bh
mov dword [0xa88e14a0], eax
arpl word [edi + 0x33b51ef], bx
add dword [edi + 0x23], edx
fidivr dword [edi + ebx*2]
add eax, dword [eax]
invalid
test al, 0x5c
mov ebx, 0x4d8ab4f2
adc cl, bh
test al, 0x73
xchg edi, eax
jge 0x461599
lodsb al, byte [esi]
inc edi
inc esi
stc
inc esi
adc eax, 0x363c185c
jmp 0x46167d
enter 0x46d8, 0x70
xchg edx, eax
into
push 0xfeeb27de
dec ebp
lds edi, [ecx]
fist word [ebp - 0x758f6593]
adc eax, 0xd7fd46b2
xchg ebp, eax
invalid
xchg esp, eax
jecxz 0x461639
or eax, 0x1b6bd7fd
pop esi
mov al, byte [0x2eb20003]
daa
ret 0x3855

Function at 0x4636c4
Capabilities:
Authenticate hmac

Disassembly:
dec ebp
mov ecx, 0x6116137e
imul edx, edi, 0xffffff93
nop
out 0xcd, eax
adc dword [edx + ebx*8 - 0x64], edx
mov edi, 0xf789a741
out dx, al
inc ebp
pop edi
push eax
jae 0x46370b
cld
mov ch, 0xe5
mov cl, 0x46
wait
adc byte [ebx - 0x7c], bl
adc al, 0x8e
push ebp
invalid
lds edi, [ecx]
fist word [ebp - 0x5f8f6583]
add byte [edx - 0x4a302ba], dh
cmc
test byte [esi - 0x75], dl
pop esi
lds edi, [ecx]
jnp 0x4636ba
insd dword es:[edi], dx
lcall 0xb3fa, 0xab0469d
pushfd
push ds
shr byte [eax - 0xf], 1
add byte [eax], al
xor bh, byte [ebx + 1]
fst qword [ebp + 0x38]
popal
and ebp, dword [eax + 0x7f]
inc esi
std
xlatb
jbe 0x4637ba
pop edi
add edi, edi
invalid
sbb al, 0x88
dec ebp
push es
and dh, byte [edx + ebx*8 + 0x1e]
cmp byte [esi], dh
adc al, 0x88
in eax, 0xef
test dword [ebp + 0x47], ebp
Function at 0x46ad48
Capabilities:
Encode data using xor

Disassembly:
out 0xcd, eax
adc dword [edx + ebx*8 - 0x64], edx
mov edi, 0xf789a741
out dx, al
inc ebp
outsd dx, dword [esi]
jae 0x46adcb
cld
xor dword [edi - 0x4f], ebp
inc esi
cmp dl, byte [edx + 0x14363ad6]
add esp, dword [esi + 0x75]
add eax, dword [ecx - 0x21]
push ds
mov ebx, 0x558ee4f2
scasb al, byte es:[edi]
adc al, 0x70
wait
cmp bh, byte [edi]
cld
stosd dword es:[edi], eax
mov eax, 0x137eb94d
push ss
invalid
lds edi, [eax + 0x63b31c1f]
mov al, 0xeb
dec ecx
mov dl, 0x46
std
sub byte [ebx - 0x10], dl
leave
pop ecx
retf