joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15f889a
Capabilities:
Encode data using xor

Disassembly:
xor ax, word [edx + ebp - 0x67800000]
xor dx, 0xc28d
ror edx, 0x50
mov dword [esp], edx
mov dx, word [ebp + 2]
mov ecx, 0x32323315
lea ebp, [ebp + ecx*2 - 0x64646628]
adc ecx, 0xd505f2b1
call fcn.017b4f7e
rcr dword [esi + 0x31f457f], 1
jecxz 0x15f894a
imul eax, dword [eax + edx*2 - 7], 0xffffff80
mov ebx, 0xa900acff
mov ebx, 0x3c48537b
ja 0x15f8927
push 0x44766d9a
cdq
lcall 0xa0d3, 0x28ba8dbb
mov edx, 0x5a4cd1f2
mov edx, 0x9119f535
inc ebp
push es
in eax, 0x34
outsb dx, byte [esi]
sub edx, ebp
mov ebp, 0x27e90c2c
invalid
sbb byte [ecx], ch
insb byte es:[edi], dx
xor ebp, dword [ecx - 0x14417558]
push ss
mov ecx, 0xe345b912
fisttp word [ebx + ebx*2 - 0x43]
sal dword [edx], cl
mov dh, 0x15
sbb ah, byte [ecx + ecx*8 + 0x536c75ea]
jne 0x15f8995
push ebx
adc dl, bh
jg 0x15f890c
adc byte [eax], bl
frstor dword [ebp - 0x43ac519b]
out 0x6f, eax
test eax, 0xaf2f2f65
push ebp
add al, 0x37
das
rol edi, cl
push edi
ret
jg 0x15f895a
sets byte [edi]
cwde
pop es
outsd dx, dword [esi]
and ecx, esi
push edx
push eax
inc eax
cwde
pop es
les edx, [ecx + 0x66]
fdivp st(4)
das
jle 0x15f896e
add byte [edx - 0x6638d878], bh
mov byte [esi], ah
rol dword [ebx], 0x60
mov eax, dword [0xd3e0d426]
pop esp
jg 0x15f8949
push cs
adc eax, 0x1ad97e0d
adc ebx, ebx
test dword [edi], esp
mov dword [0x4927a8b3], eax
dec edx
sub al, 0x52
daa
xchg edx, eax
jp 0x15f89ff
cdq
fsub dword [esi]
mov cl, 0x7d
popfd
mov bh, 0xd8
push 0x77188a8f
and al, 0x8e
mov ebx, dword [ecx - 0x43276ee6]
jne 0x15f89fe
and dh, byte [esp + esi*8 - 0x35d4ccfb]
adc byte [eax - 0x2914d6f5], bh
movsd dword es:[edi], dword [esi]
fdivr st(6)
or dword [edx + 0x20], edx
xor byte [eax + 0x71], cl
mov dword [edi - 0xa6611ef], ecx
popfd
shr byte [esi + 0x3ec24b5d], 1
das
add dword [ebx + 0x2b], eax
daa
out dx, eax
mov esp, 0x519de37f
int1
cli
pop ds
nop
add edx, edi
imul edx, edi, 0x42e34b50
iretd
and eax, 0xa84ae946
dec ebp
pop esi
jmp 0x72bbd14a
mov fs, word [eax]
adc dword [esi], 0x7af692c9
call 0xe9b7282b
and ebp, ebp
and byte [ecx - 0x96d36ea], al
jp 0x15f89ef
and byte [esi - 0x12de17a9], bl
add dword [ebp + 0x54d1c0e8], ebp
pop ss
adc al, 0x91
ret 0x48b0

Function at 0x1635105
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + eax - 0xc]
sub ecx, ecx
mov edx, eax
mov ebp, dword [esp + eax*2 - 0x18]
not eax
or ax, cx
adc al, dh
lea ebp, [ebp + ecx*2 - 4]
bt ecx, ecx
mov dword [esp + ecx + 4], 0xdd30d0a2
mov eax, dword [ecx + ebp]
mov dword [esp + ecx + 8], 0x8d3f0422
xor eax, ebx
call fcn.016d89ce
Function at 0x1674701
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, 0x10a4582d
mov dword [esp + eax*4 - 0x429160b4], eax
mov ecx, dword [eax + esi - 0x10a4582d]
mul dword [esp + eax*4 - 0x429160b4]
sub edx, dword [esp + edx - 0x114f486]
jns 0x164c967
adc esi, 3
sub ebp, 1
or dword [esp], eax
setns byte [esp + 1]
movzx edx, byte [ebp]
xor dl, bl
dec word [esp + 2]
not ax
inc dl
ror eax, 0x7a
rol al, 0x21
neg dl
cwde
xor eax, dword [esp + eax - 0x55d]
sbb eax, dword [esp]
sbb dl, 0x14
shr eax, 0xb9
inc eax
neg dl
dec al
jnp 0x17176dc
cwde
xor dl, 0x3f
xor bl, dl
lea edx, [esp + edx + 4]
sal dword [esp + eax], 0x47
cbw
add dword [esp + eax], 0x54b0d78e
mov dword [edx + eax], ecx
movsx edx, ax
movsx ecx, dx
jnp 0x18a74db
mov ecx, 0x57a36b09
movzx edx, cx
mov ax, word [esi + edx*2 - 0xd612]
not edx
sar cx, cl
mov dx, word [esi + ecx - 0x57a30033]
or cx, cx
jg 0x1713a43
movzx eax, word [edi]
mov ecx, 0x346399
call fcn.017be22e
lea ebp, [eax + ebp - 4]
sbb ecx, eax
rol dl, 5
add edx, dword [ebp + eax]
add cx, ax
xor edx, ebx
xor edx, 0x5c93a9b0
bswap edx
push ecx
cwde
btr cx, cx
sbb edx, 0x99998e88
ror edx, 1
xchg ecx, eax
sar ecx, 0x66
sbb edx, 0xb4398838
xor al, 0x9d
not cx
not dword [esp + eax - 0x99]
xor ebx, edx
mov dword [esp + eax*2 - 0x138], eax
dec ax
add edi, edx
cdq
and eax, 0x3d9cb225
pop ecx
mov dword [esp + eax - 4], edi
ret

Function at 0x1681aa4
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
xor edx, 0x32935d34
bt cx, 0xa7
sar ecx, 0xae
ror ecx, cl
not edx
sbb edx, 0x6511f3b1
mov dword [esp + eax - 0x208d8b06], ecx
ror edx, 1
or dword [esp + ecx - 0x4ffffe30], 0xe8b9f12e
not edx
btr eax, ecx
shr ecx, 1
shl dword [esp + eax - 0x208d8b03], cl
xor ebx, edx
sal eax, cl
shl dword [esp + eax - 0x17fffff7], cl
call fcn.0157ea71
dec eax
sbb byte [ecx], dl
xor dword [0x586dbaa], ebp
xchg ebx, eax
fnstenv [ecx]
mov esp, 0x46d1112
dec edi
ror dword [edi - 8], cl
mov bh, 0x35
lodsd eax, dword [esi]
inc edx
invalid

Function at 0x16f9301
Capabilities:
Execute syscall

Disassembly:
xor eax, 0xb2d3119
shl dl, 0xa3
inc dx
rol edx, 0xf8
neg eax
neg dx
push ecx
rol eax, 1
and edx, edx
inc eax
rol dl, 4
btc ecx, 0x16
not eax
neg dx
js 0x2837f5b
rol cx, 0xad
xor ebx, eax
sar ecx, cl
adc esi, eax
Function at 0x1769dad
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push 0x5c1105b5
lea esp, [esp + 0x10]
jne 0x27e2dec

Function at 0x177fd93
Capabilities:
Encode data using xor

Disassembly:
shl edx, cl
mov ecx, dword [ebp + 4]
push edx
push edx
adc ebp, 3
sar dword [esp + 2], 0xb
imul edx, edx
not byte [esp + edx - 0x4000000]
not eax
not ecx
jo 0x162863f
div byte [esp + eax*8 + 6]
xor ecx, 0x9798c43f
pop edx
inc ecx
cdq
xor ebx, ecx
xchg edx, eax
add edi, ecx
add eax, dword [edx + esi]
mov ecx, edx
add edx, edx
add ecx, dword [edx + esi + 4]
lea esi, [edx + esi + 4]
inc edx
setge byte [esp + edx*2 - 1]
not eax
sub byte [esp + edx*2 - 1], dl
push edx
not ecx
push edx
and eax, ecx
mov dword [esi + edx*2 - 2], eax
shl edx, 0xa4
call fcn.028241cd
mov edx, 0x3eb286a6
mov edx, dword [edi + edx*2 - 0x7d650d4c]
mov ecx, 0x4fac473a
lea edi, [ecx + edi - 0x4fac4736]
movzx eax, cl
not eax
sar eax, 0x9a
xor edx, ebx
add edx, eax
ror edx, 3
sar ecx, cl
push ecx
setp byte [esp + ecx - 0x13]
neg edx
xchg word [esp + ecx*2 - 0x26], cx
ror cl, 0x21
lea edx, [eax + edx - 0x7ec034c1]
bswap edx
xadd word [esp + ecx + 2], cx
pop ecx
xor ebx, edx
xchg ecx, eax
add cl, 0x8e
bts ecx, ecx
add esi, edx
movsx edx, cl
mov eax, dword [ebp + eax*2 - 0x26]
ror edx, 0x97
jb 0x1713646
adc esi, ecx
btc ax, ax
or byte [esp + edx - 0x398fffd], ah
pop ecx
pop edx
pop ecx
jno fcn.019121cf
adc eax, 0xea4e7388
invalid
Function at 0x17888e6
Capabilities:
Encrypt data using chaskey
Get number of processors

Disassembly:
cbw
inc eax
add ebp, 4
cwde
push ecx
lea ecx, [edx*2 + 0x56927db4]
xor edx, edx
xchg ecx, eax
popfd
and cx, ax
jae 0x19286f9
mov ecx, dword [esi]
mov ax, word [ecx]
mov ecx, 0xae231502
add esi, 2
movzx edx, cl
mov word [esi + edx - 2], ax
jmp 0x250706a
xor eax, 0x199995af
dec dword [esp + 1]
xor eax, esi
mov dword [esp + 8], 0x9d3a2c91
mov dword [esp], 0x66991221
sar byte [esp + 7], 5
inc ecx
shr dword [esp + 8], 0x91
jne 0x28e9742
movsx eax, dl
mov ecx, dword [eax + esi]
sub dx, ax
btr ax, dx
cwd
lea esi, [esi + eax*8 + 4]
neg edx
cwd
adc eax, eax
xor ecx, ebx
bswap ecx
call fcn.0175a1bc
xor edx, ebx
mov ecx, eax
jmp 0x1848d84
not edx
inc edx
inc eax
setp byte [esp + eax*2 - 0x6400002]
sal dword [esp + eax*4 - 0xc800004], cl
ror edx, 2
call fcn.0167d3d3
push ecx
dec edx
rol edx, 1
sub ecx, 0x76243087
jl 0x17cc320
mov edx, 0x848c8389
mov eax, edx
mov ecx, dword [ebp]
jmp 0x15fd844
mov eax, dword [edi + edx*2]
bswap ecx
or dx, dx
lea edx, [ecx + ecx + 0x1828a30e]
lea edi, [edi + edx - 0x1d32a308]
sbb ecx, edx
jbe 0x164a1ea
rol edx, 0x14
xor eax, ebx
bt ecx, ecx
call fcn.0281e43d
imul edx, edx
movsx eax, dl
sbb ebp, edx
shl ecx, 0x30
mov ecx, dword [ecx + ebp - 0x15020000]
mul edx
sbb edx, edx
adc al, al
xor ecx, ebx
bt edx, 0x8e
or ax, dx
bswap ecx
inc ax
xor ecx, 0xe089231
xchg edx, eax
and al, ah
rol ecx, 1
dec ecx
mul ax
push edx
and word [esp + edx*8], dx
xor ebx, ecx
inc eax
add edi, ecx
add dword [esp + edx*2], edi
ret
jnp 0x1703399
sub edi, 1
mov eax, 0xfbab37b5
movzx eax, byte [edi]
mov edx, 0x1217b88a
rol dl, 0x21
xor al, bl
xor dl, dl
xor al, 0x82
xchg dh, dl
neg al
lea edx, [edx + edx + 0x7102bf8d]
xor dx, 0xbf3f
adc al, 6
or edx, 0x3b1764b6
neg edx
ror al, 1
jmp fcn.018a32ca
Function at 0x178c503
Capabilities:
Encode data using xor

Disassembly:
neg eax
lea ecx, [ecx + edx*8 + 0xaa1840e]
xor dl, dh
sbb eax, 0x2808f796
rol eax, 3
shr edx, cl
xor ebx, eax
rol dword [esp + edx - 0x26471], 0x8c
adc esi, eax
movsx eax, dx
add dword [esp + edx - 0x26471], 0xceb02196
pop edx
jp fcn.019121cf
rol eax, 3
mov dword [esp + edx - 0x2ba90ca], 0x4c004682
or byte [esp + edx*2 - 0x5752190], dh
xchg dx, cx
neg eax
neg dword [esp + edx*4 - 0xaeb90b4]
and cl, 0x8f
xor ebx, eax
add esi, eax
mov eax, dword [edi + edx*2 - 0x575c85c]
lea edi, [edi + edx*2 - 0x575c858]
sar dx, cl
xor eax, ebx
xadd word [esp + edx*2 - 0x575ffec], dx
xor dx, 0x8f10
jge 0x192adf8
sar byte [esp + 1], 0xc2
lea edx, [ecx*2 - 0x31561c44]
lea eax, [eax + edx - 0x64bf9dc7]
neg edx
inc dword [esp]
sub word [esp], dx
not eax
js 0x171ba46
inc eax
xlatb
xor dword [ebx + esi*4 + 0x7ef10392], esp
push esi
call 0x441ac722
pop es
mov dword [ecx - 0x2434e2e5], eax
cwde
add ebp, esp
imul edx, dword [eax - 0x80], 0x8a82af01
add dword [ecx + 0x7e62e2bc], 0xffffffb6
mov byte [eax], ah
fld xword [ebp + 0x23b16e81]
add dword [edi + 0x6b596799], 0xf12d39aa
xor dword [ecx], eax
shl ch, cl
mov ecx, 0xe7329cd8
fbld tbyte [ecx + 0x60baa2dd]
pop edx
cmpsd dword [esi], dword es:[edi]
shl byte [esi + 0x49], 1
push ecx
outsd dx, dword [esi]
jle 0x178c58e
fdiv st(7)
aad 0x68
invalid
bswap eax
shl edx, 0x81

Function at 0x17a8625
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
lea edi, [edi + ecx*2 - 6]
add al, byte [esp + ecx + 6]
mov ecx, dword [edi + ecx*4 - 4]
xor ecx, ebx
push edx
xadd dl, al
bswap ecx
add edx, eax
xor al, dl
inc ecx
imul edx
or byte [esp + edx*8 - 0x9d], al
xor ecx, 0x6a847e18
mul eax
sub dl, al
div eax
dec ecx
ror ecx, 1
jmp 0x169bf42
ror ax, 0x29
xor ecx, 0x2d2b6836
xor ebx, ecx
add ebp, ecx
sal ax, 0xe9
imul dword [esp + 2]
pop edx
pop ecx
pop edx
jo fcn.01681dee
push 0x8c9bbc85
mov eax, dword [edi]
mov edx, dword fs:[eax]
push 0x201c9b8c
mov dword [edi], edx
mov edx, dword [ebp]
call fcn.027f47cb
add edx, 0xbe20ba3d
not al
push ecx
lea edx, [edx - 0x50cc3d45]
xor bl, al
sar cx, 0xc6
xchg dx, cx
imul ecx, edx
lea eax, [esp + eax + 8]
add dx, 0x2893
shl ecx, 0xbb
sar edx, 0xaa
movzx dx, byte [edx + eax - 0x3df8a]
mov eax, ecx
setns cl
xchg byte [esp + ecx*4 - 4], al
lea esi, [esi + ecx - 3]
mov word [esi + ecx - 1], dx
lea edx, [eax + eax*2 + 0x16b737ac]
jb 0x15fb7a6
mov eax, 0x6d08ad9e
movzx ecx, ax
cdq
xor edx, dword [eax + edi - 0x6d08ad9e]
inc al
jne 0x16a8d35
mov dword [esp], edx
sub ecx, edx
rol al, 1
dec dword [esp + ecx - 0x44765c08]
js 0x16fcc48

Function at 0x17c5d6c
Capabilities:
Encode data using xor

Disassembly:
call fcn.02513816
push 0x7f0f6919
shr word [esp + 0xb], 0x66
xor ebx, edx
mov dword [esp + 4], 0xdb950f07
mov dword [esp + 0x10], 0xa9ccf34
push 0x5a9c2239
add esi, edx
push 0xc4206c9d
push 0xd7a3c32c
lea esp, [esp + 0x24]
jmp 0x17a4e96
Function at 0x182c711
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x1699a58a
neg dx
mov dword [esp + eax - 0x359a8689], 0x690246a8
xor dx, 0xd1aa
jmp 0x27e24ff
or ecx, edx
rol eax, 3
shr cl, 0x82
shl byte [esp + 8], 0x47
and dx, word [esp + 2]
xor ebx, eax
lea ecx, [ecx + ecx + 0x57abb987]
add esi, eax
neg word [esp + ecx - 0x37a7b5fc]
and dx, 0x2098
pop edx
pop ecx
pop edx
jae fcn.017a2dfd
mov esi, 0xdf872007
shr dword [edx + 0x58], 0x86
fld dword [eax + 0x577e8222]
xor bh, byte [ecx + 0x7d]
sbb eax, 0xa2fdbc09
or byte [ebx - 0x3e7d6fcd], 0x37
invalid
shr word [esp + eax*2 - 0x6b350d10], 0x8f
rol dx, 1
or ecx, eax
or eax, 0x931506ba
xor bx, dx
sub ecx, 0x54bf5d2d
lea ebp, [ebp + ecx - 0x2900a2d4]
mov word [ebp + ecx - 0x2900a2d2], dx
mov eax, dword [edi + ecx*2 - 0x520145a4]
setno byte [esp + ecx*2 - 0x520145a2]
lea edi, [edi + ecx*2 - 0x520145a0]
lea ecx, [ecx*4 + 0x5e08a116]
mov edx, 0x53b99d28
rol edx, 0x16
xor eax, ebx
push edx
not cx
not eax
imul ecx, ecx
xor ecx, 0x392c0f29
xadd edx, ecx
inc eax
neg eax
jmp 0x2790f54

Function at 0x186fdae
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax], edx
jmp 0x25b0021
movzx edx, al
push eax
push dword [esp + 4]
popfd
mov byte [esp + eax], al
mov ecx, dword [edi + eax*4]
mov dword [esp + eax*2 + 4], 0xeab3112f
lea edi, [edi + eax*8 + 4]
call fcn.016a088f

Function at 0x188108e
Capabilities:
Encode data using xor

Disassembly:
bts edx, edx
lea ecx, [edx*2 + 0x7a8315b5]
mov edx, dword [ecx + esi - 0x7a8315b3]
shl ecx, 0x66
mov eax, dword [esi + 4]
sal ecx, 0x88
adc esi, 8
push ecx
call fcn.018c0cba
xor ecx, 0xba13641f
mov dword [esp], 0x71b79984
call fcn.017126aa
dec esi
mov dword [esp + esi - 0x62b10602], edx
dec ebp
lea esi, [edi + 0x31954014]
dec eax
bswap edx
inc edx
xor dword [esp + edi*8 - 0x300], edi
dec eax
sal esi, 0xef
cbw
inc ecx
pop edx
cdq
dec eax
arpl di, di
call fcn.0282ae8c
sub bl, byte [edi - 0x5b071059]
xor dl, ch
clc
js 0x1881113
add eax, 0xad133919
mov dh, 0x63
inc edi
and edi, dword [edi - 0x7b]
adc ebp, dword [ebp + 0x234763b6]
jg 0x1881067
out 0x8c, al
clc
scasd eax, dword es:[edi]
out dx, eax
add ecx, edi
call dword [edi - 0x47096f1f]
pop esp
out 6, al
dec esi
xor ebx, dword [0xae17472f]
fcmovnb st(0), st(6)
cmp byte [edi - 0xd137736], bh
jp 0x18810da
hlt
retf 0x4dd8

Function at 0x1882924
Capabilities:
Encode data using xor

Disassembly:
xor dl, 0x3c
jmp 0x15bba2e
xor ebx, eax
mov dword [esp + ecx - 0x40c8abb1], 0x60197d9d
inc ecx
add edi, eax
xchg byte [esp + ecx - 0x40c8abaa], cl
lea ebp, [ebp + ecx - 0x40c8ab92]
movzx eax, word [esp + ecx - 0x40c8ab85]
xchg edx, eax
movzx edx, byte [ecx + ebp - 0x40c8ab91]
dec ecx
shl ax, 0xe
xor dl, bl
add byte [esp + ecx - 0x40c8ab84], al
cbw
neg dl
rol dl, 1
xor dl, 0x14
neg dl
inc dl
push eax
jmp 0x157e483

Function at 0x1884dcc
Capabilities:
Authenticate hmac

Disassembly:
adc esi, ecx
neg eax
lea ecx, [eax + eax*8 + 0x4daf840f]
pop ecx
pop ecx
jp fcn.017a2dfd
Function at 0x18a8227
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xedaf64a9
movsx edx, ax
mov eax, dword [ebp + edx*4 - 0x192a4]
movzx ecx, dx
mov edx, dword [eax + edx - 0x64a9]
mov dword [ebp + ecx - 0x64a9], edx
ror ecx, cl
mov eax, dword [ecx + edi - 0x54800032]
movzx edx, cx
lea edi, [edi + edx*2 - 0x60]
xor edx, edx
bt edx, edx
xor eax, ebx
inc eax
push edx
not eax
or dword [esp + edx], edx
not dx
bt dx, dx
neg eax
not eax
push edx
lea edx, [ecx*8 + 0x2f2f1434]
rol ecx, 0x9c
lea eax, [ecx + eax - 0x5585b092]
not dword [esp + ecx - 0x25480002]
jb 0x1858f37
not eax
setae cl
jb 0x27ff198
fadd st(0)
insd dword es:[edi], dx
xchg esi, eax
mov dl, 0x7e
push esp
adc al, 0x68
or ebp, ebp
xor al, 0x27
stosb byte es:[edi], al
call 0x98fefde0
xor eax, 0xd935a5dd
push ss
sahf
adc dword [edi + 4], ebp
call 0xa82986d2
push 0x1775daa4
adc al, 0xff
fcmovb st(0), st(6)
xchg esi, eax
test al, 0x54
cmp cl, bh
scasb al, byte es:[edi]
imul esp, dword [eax + 0x16be66eb], 0x879b113d
out 0x92, eax
xlatb
xor dword [edi - 0x3dd5ce35], edx
outsd dx, dword [esi]
jne 0x1858f55
hlt
mov dword [esp + 4], 0x1926c401
mov ebx, dword [ebx*4 + 0x1723a28]
push 0xdf23080f
call fcn.01575f5d
jmp 0x17f27be
rol eax, 2
call fcn.01920203

Function at 0x18b0164
Capabilities:
Execute syscall

Disassembly:
inc ecx
dec esi
inc ecx
dec al
pop esi
movsx edx, cl
inc ecx
bswap esi
inc ecx
pop edi
and word [esp + ecx - 0x139248fd], dx
ror word [esp + ecx*2 - 0x27249201], cl
inc ecx
rol esi, 3
dec eax
lea edi, [ecx + ecx + 0x10b0c31e]
or word [esp + ecx*4 - 0x4e492402], 0x59a5
dec esp
mov dword [esp + ecx - 0x13924901], edx
inc esp
xor dword [esp + ecx*2 - 0x27249202], esi
dec ecx
xor eax, 0x8237818d
jl 0x253088c
inc ecx
pop edx
not edx
dec ebp
arpl si, si
inc cx
btc eax, ecx
inc ecx
not ecx
dec ecx
adc ebx, esi
dec ebp
mov ebx, dword [ebx + ecx*2 - 0x27249202]
or cl, ch
inc esp
movzx edi, dx
jae fcn.0256c8bf

Function at 0x18b30b2
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp + ecx - 0x75082986]
xor eax, ebx
movzx edx, word [esp + ecx - 0x75082986]
lea eax, [eax + ecx*2 - 0x605f9575]
sal ecx, 0xdd
ror eax, 1
call fcn.0159ff2f
cli
ja 0x18b30b9
loope 0x18b30d8
jmp edi
out 0x97, eax
and dh, byte [edx]
leave
int1
pushfd
cmp al, 0xab
xor al, 0x16
cli
retf
Function at 0x18bd689
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop ecx
pop eax
pop edx
jle fcn.01816128
mov dword [esp], ecx
neg edx
btr ax, ax
dec edx
shl eax, cl
rol eax, cl
not edx
sar cl, 0xc1
or ax, 0x1aa4
bswap edx
not dword [esp + eax*2 - 0x3548]
bt eax, 0x17
dec edx
push eax
sub dword [esp + eax*2 - 0x3544], ecx
add eax, dword [esp + eax - 0x1aa3]
not edx
inc cx
xor ebx, edx
and dword [esp + eax - 0x3d001aba], eax
push ecx
adc ebp, edx
mov ecx, dword [esi + eax*2 - 0x7a00357c]
lea esi, [esi + eax*2 - 0x7a003578]
movsx edx, byte [esp + eax - 0x3d001ab6]
xor ecx, ebx
ror dl, 0x21
seto dl
neg ecx
shr byte [esp + edx*2 + 9], 0x41
sbb edx, eax
inc dx
not ecx
setge al
jo 0x27fd3eb
lea eax, [eax*8 + 0x7b096ca8]
ror ecx, 2
not ecx
cdq
sal eax, 1
jae 0x291ac4c
dec edi
cmp bh, byte [edx + 0x62]
invalid
mov al, byte [ebp + ecx*4 - 0xf8]
lea ebp, [ebp + ecx*2 - 0x78]
add ecx, ecx
rol ecx, 2
not ax
idiv eax
neg ecx
push edx
xor ebx, ecx
pop eax
lea edi, [edi + eax*2 - 0x30a4357c]
mov dword [eax + edi - 0x18521abc], ecx
neg eax
and byte [esp + edx*2 - 0x30a43574], 0xa3
ja 0x179477d

Function at 0x18fa737
Capabilities:
Encode data using xor

Disassembly:
btc ecx, ecx
mov eax, dword [edx + edi - 0x6a9e0000]
xor cx, 0xcf99
add edx, ecx
lea edi, [edi + ecx - 0x7db4cf9c]
and cl, ch
xchg byte [esp + ecx - 0x7db4cf79], dl
sal dx, 0xe3
movzx ecx, byte [esi + ecx - 0x7db4cf80]
rol byte [esp + 4], 0x23
neg dword [esp + 8]
sar edx, 0xa8
adc esi, 1
push edx
sar edx, 0xd6
or dx, word [esp + 0xc]
xor cl, bl
sar byte [esp + 2], 0xc1
sbb cl, 0x2b
ror cl, 1
xor cl, dl
call fcn.017b332d
jp 0x18fa73a
cmp eax, 0x75c11145
push ecx
mov ah, 0x43
in al, 0xa1
test eax, 0x9b8b3842
mov ah, 0x5d
retf

Function at 0x190d722
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + 4], 0xc18ae62f
inc edx
neg edx
jmp 0x257d7a1
not word [esp + 6]
sub edx, 0xd6059b32
mov dword [esp], 0x8c87530f
call fcn.016d70ef
sysenter
pushfd
mov dword [esp], 0x170cf0bc
call fcn.01791fe8

Function at 0x192e630
Capabilities:
Encode data using xor

Disassembly:
call fcn.01874f79
movsx ebx, dl
not dl
cpuid
jae 0x16d4dc4
not edx
mov eax, 0xe9ac7833
movzx ecx, ax
neg edx
not edx
inc edx
sub byte [esp + ecx*2 - 0xf060], cl
dec ecx
xor edx, 0xfe873e25
lea eax, [eax + 0x4816179f]
btc ecx, eax
dec cl
xor ebx, edx
mov dword [esp + ecx - 0x47831], ecx
call fcn.0189c136
sub dl, dh
inc esp
push esp
push ecx
dec si
jecxz 0x192e698
adc eax, 0x1d52ea6f
mov dword [0xbdc55bd], eax
sub ebx, dword [edi + 0x54820c34]
xchg esp, eax
jno 0x192e623
ljmp 0xdc55:0xbda31d52
jl 0x192e671
fisttp word [esi - 0x3d]
add ah, byte [esi]
xor al, 0x9c
dec esp
and dword [esi - 7], 0xffffffa5
pop esp
popfd
stc
dec edi
stosd dword es:[edi], eax
cmp al, 4
daa
or edx, dword [esi - 0x66]
and edx, dword [eax - 0x77]
aaa
sbb byte [ebp - 0x507a0139], 0xb7
and dword [ebp - 0x7b], 0x4c518252
dec esp
xor byte [ebp - 0x44312843], bh
fld st(2)
jns 0x192e6ad
ljmp 0x105:0x70a307ab

Function at 0x24f6909
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg al
inc dl
neg edx
ror al, 1
call fcn.028d7f3c
xor ecx, ecx
test eax, eax
push 0x869e6423
lea esp, [esp + 8]
je 0x256f285
push ebx
Function at 0x2506d0e
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x7be4e8
call fcn.016b3678
in al, 0x7b
add al, ch
pop ebp
leave
sbb bh, bh
aam 3
mov dl, 0x15
xchg edi, eax
sbb ch, byte [ecx + 0x32e0e805]
sub eax, 0x1333843b
jp 0x2506d13
daa
adc ch, byte [edx + 0x4c]
sub dword [eax], 0xffffffed
sub al, 0xe0
add byte [esi - 0x7c], 0x1b
push esi
mov dl, 0x5b
sub esp, ebp
div dword [ebx]
mov edx, 0x2420d0eb
xor ebp, edx
dec esp
pop eax
or al, 0x86
mov esp, 0x88ac6b15
sbb bl, byte [ebx - 0x1a5de5e9]
pop eax
jge 0x2506d2e
wait
pop ss
sbb ah, byte [edx - 0x2b82a71b]
mov ch, ch
int1
adc dword [ebp + 0x3412faee], esp
push ds
out 0x13, eax
adc al, 0x22
jnp 0x2506d52
in al, dx
push 0x7a
and al, 0xbe
inc esp
sbb bl, byte [eax - 0x7c]
mov dword [0xc0faede9], eax
call 0xe551d13d
push ds
or ch, dh
bound esi, qword [edx + 0x15]
rol byte [eax + ecx*4], cl
sar byte [ebp - 0x3d514f7c], cl
and esp, dword [edx + 0x68]
push ebp
ljmp 0xf108

Function at 0x250b731
Capabilities:
Hash data using murmur3

Disassembly:
inc ecx
pop edx
cbw
dec eax
neg edx
dec ebp
arpl cx, cx
dec ecx
add ebx, ecx
dec eax
shl ebp, 0xe6
inc sp
btc eax, ebp
div esi
jmp ebx
inc ecx
sal eax, cl
dec esi
lea ecx, [ebp*2 + 0x48976db8]
inc ecx
movzx edi, dh
inc edi
mov dword [esi + ebx - 0x3a], eax
sal edx, 0xe2
inc cx
shl esi, 0x8b
dec edi
lea esp, [ebp - 0x6102bc3e]
inc edi
mov ecx, dword [ebp - 0x6102bc3a]
dec esp
lea eax, [edi + edi - 0x24d7afc5]
inc ecx
mov ebp, eax
inc ebp
xor ecx, edx
inc ecx
inc ecx
inc ecx
neg ecx
bswap edx
dec ecx
add ebp, edi
inc ecx
xor ecx, 0x41114a0d
dec esp
add eax, ebp
inc ecx
dec ecx
inc ecx
not ecx
dec ecx
lea ecx, [esi + edi*4 + 0x51017ea0]
inc cx
sal edi, 0x46
inc ecx
dec edi
inc ecx
dec ecx
inc ecx
rol al, 0x83
inc ecx
push edx
dec ecx
neg ebp
inc ecx
or dh, 0x9b
inc ecx
mov esi, ebp
inc esi
xor dword [esp + ebp + 0x6102bc3a], ecx
dec ecx
lea eax, [ebp + 0x61132d8b]
inc sp
and eax, esi
jns 0x166632c
movzx ecx, ax
mov dword [esp + ecx*2 - 0x772], eax
mov dword [ecx + ebp - 0x3b9], edx
pop ecx
pop ecx
movsx edx, cx
mov ecx, dword [edi]
add edi, 4
inc edx
neg edx
jns 0x1578e8b
inc ecx
mov ebp, 0x6102bc3a
inc edi
mov eax, dword [ebx + ebp - 0x6102bc3a]
inc ecx
movsx edx, bp
inc ebx
mov cl, byte [ebx + ebp - 0x6102bc36]
dec edi
lea ebx, [ebx + ebp - 0x6102bc38]
inc ecx
mov edi, 0xa6b94b3a
inc esp
movsx esi, dl
jmp 0x1933313
Function at 0x257d7c9
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, 0x11af8031
ror ebx, 0x46
movzx ebx, byte [ecx]
xor ebx, eax
call fcn.0281c4c8
shr eax, 8
xor eax, ebx
inc ecx
xor eax, 0xfd28672f
mov dword [esp], 0x7a1fde0f
or word [esp], 0x6387
dec edx
push 0xfab68b34
lea esp, [esp + 0xc]
jne 0x191d09c
mov ecx, 0xe10a0d9b
mov edx, ecx
imul edx, edx
pop ebx
not eax
mov dword [ebp], eax
mov eax, 0x5c8b8da7
neg eax
movzx ecx, ax
mov eax, dword [edi + ecx - 0x7259]
movsx edx, cx
dec cl
lea edi, [edi + ecx*2 - 0xe4ac]
add ecx, edx
xor eax, ebx
rol edx, 0x9c
jb 0x25a387e
not eax
btr edx, edx
rol dx, 0xa2
rol eax, 3
push edx
xadd byte [esp + ecx - 0xe4b1], cl
seto byte [esp + ecx*4 - 0x39050]
bswap eax
dec eax
call fcn.018d4cb0

Function at 0x278d9ef
Capabilities:
Execute syscall

Disassembly:
xor ecx, 0x6fbc0d12
not dword [esp + 0xc]
call fcn.0166b70d

Function at 0x27e2da1
Capabilities:
Check for software breakpoints

Disassembly:
lea edi, [ecx + edi - 0x1bfc]
xor edx, ebx
mov dword [esp + ecx*2 - 0x3800], ecx
neg word [esp + ecx - 0x1bff]
xor edx, 0xf507ce16
xadd byte [esp + ecx*4 - 0x7000], ah
dec cl
sbb edx, 0x87017f00
imul ax, ax
inc eax
lea ecx, [eax*8 - 0x62688b59]
ror edx, 1
jmp 0x1605ea1

Function at 0x27e2de2
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
lea ecx, [ecx + eax - 0x65977dfd]
xadd edx, eax
rol edx, 0xff
bts edx, edx
bswap ecx
or ax, dx
sal eax, 0xc3
rol ecx, 3
ror edx, 0xd7
dec eax
xor ecx, 0x41589b1
rol ecx, 1
call fcn.016345a6
push 0xdc1eeb0c
call fcn.0157e31a
mov edx, 0x34942d23
inc edx
lea edi, [edi + edx*2 - 0x69285a4c]
mov ecx, dword [edi + edx - 0x34942d24]
xor ecx, ebx
lea eax, [edx + edx - 0x45c311ec]
mul dl
jo 0x25e335f
neg ecx
sal edx, 0xb4
xor ecx, 0xd48dccb2
btc edx, 0x91
adc edx, eax
btr dx, 0x1d
not ecx
or al, ah
imul eax
ror ecx, 1
xchg edx, eax
and edx, 0xe9815c95
jne 0x176302e
neg edx
inc eax
call fcn.0165bf32
lea esp, [esp + 0xc]
je 0x1769dbc
call fcn.01609b43