joyce8/EMBER2024-capa huggingface dataset:
Function at 0x81240a
Capabilities:
Hash data using murmur3

Disassembly:
sbb ecx, 0x7423a896
sal al, 0x41
ror ecx, 3
inc ecx
mov dword [esp + edx*2 - 0x3c4d6700], edx
cwde
rol ecx, 2
ror eax, 0x34
xchg word [esp + edx*4 - 0x789acdff], ax
xor ecx, 0x71094008
shr edx, 0x70
neg ecx
rol edx, 0xf
and byte [esp + edx - 0xf130000], dl
ror ecx, 1
rol dword [esp + edx*2 - 0x1e260000], 0xd
shl ax, 0x4c
not al
xor ebx, ecx
shr ax, 0x25
add ebp, ecx
movzx ecx, ax
lea edx, [edx*2 + 0x11b8813c]
mov eax, dword [edx + esi - 0x2fde813c]
dec edx
and edx, dword [esp + edx*2 - 0x5fbd0276]
add ecx, edx
mov dx, word [esi + ecx*8 - 0x1474]
neg ecx
adc esi, 5
sar ecx, cl
sbb ecx, dword [esp]
call fcn.00b278a8

Function at 0x8145ef
Capabilities:
Execute syscall

Disassembly:
inc ecx
lea eax, [eax + ecx*2 - 0xf2fe32d]
jg 0x63fad1
mov eax, dword [ebp]
jmp 0xad1a93
bts ecx, ecx
ror edx, 0x69
rol eax, 1
bts ecx, ecx
dec eax
not eax
lea eax, [eax + edx + 0x6cf9ca4d]
bts dx, 0xb0
sal ecx, 0x50
inc ecx
xor ebx, eax
shr edx, 0x35
adc edi, eax
neg edx
neg cl
movzx eax, dx
jmp edi
not dx
jmp 0xa8db18
jmp ebp
xor eax, esi
call fcn.0063573d
mov edx, 0xb507eeb1
movsx eax, dx
mov edx, dword [ebp]
and al, 0x8c
bts eax, eax
mov eax, dword [ebp + 4]
mov ecx, 0x6c2d978e
lea ebp, [ebp + ecx - 0x6c2d9786]
jb 0x9b5b27
jb 0x5f5a35
adc ecx, ecx
mov dword fs:[edx], eax
ror cx, 0xad
js 0xb6dcc7
mov edx, 0x8ea5b62d
mov eax, edx
or dx, ax
mov dx, word [ebp]
mov ax, word [ebp + 2]
mov ecx, 0xf9ade21a
adc ebp, 2
bts cx, cx
not cl
shr cx, cl
and dx, ax
jmp 0x730b4f
xor edx, 0xe7821712
inc eax
not edx
or eax, 0xd4b48a91
neg ecx
ror edx, 2
add eax, eax
and ecx, ecx
cwde
inc edx
neg al
ror al, 0x84
xor ebx, edx
push ecx
ror dword [esp + eax*8 - 0xbb60], 0xd2
add ebp, edx
mov dword [esp + eax - 0x176c], ebp
ret
inc cx
or ecx, ecx
mov word [ebp], dx
movsx edx, cx
lea eax, [edx + 0x62b4b13c]
neg eax
lea edi, [edi + edx - 0x73c]
mov edx, dword [edi + edx*2 - 0xe70]
call fcn.00a04f20
bt ecx, ecx
shr eax, cl
ror dx, cl
xor bx, dx
neg ax
xor eax, ecx
sbb ebp, 2
sub cl, ch
btr cx, ax
inc ax
mov word [ebp], dx
sbb edi, 4
jmp 0x99c085
mov ecx, 0xd711a3b3
movzx edx, cx
mov dl, byte [ebp + edx*2 - 0x14762]
ror cx, 0xaa
or cl, ch
adc ebp, 6
mov byte [eax], dl
bt ecx, ecx
sbb edi, 4
lea eax, [ecx + 0x1e3450b2]
cwde
mov eax, dword [edi + eax*2 - 0x7b3c]
xor eax, ebx
sub eax, 0xba8da184
movsx edx, cl
bts ecx, 0x33
not eax
bswap eax
setb dl
jb fcn.00a50813
neg ecx
lea eax, [eax + ecx*2 + 0x2146d871]
dec cl
ja 0x7318a4
neg eax
ror edx, cl
xor cx, 0xba23
neg ecx
xor ebx, eax
bswap ecx
add esi, eax
jmp esi
or ecx, ecx
sbb esi, 4
xor ecx, 0x602b1130
mov eax, 0x641e0cbd
cwde
mov edx, dword [eax + esi - 0xcbd]
dec cx
sub cx, ax
sub cl, al
xor edx, ebx
shr eax, cl
lea ecx, [ecx + ecx*8 - 0x7eef3bf6]
rol edx, 1
shl ecx, cl
not edx
sub eax, ecx
and cl, ch
xor ax, ax
ror edx, 1
rol ecx, 0xdc
not edx
xor ebx, edx
lea ecx, [ecx + 0x1a026309]
add edi, edx
mov edx, eax
rol edx, 0xc4
not cl
jmp edi
Function at 0x84c182
Capabilities:
Encode data using xor

Disassembly:
dec si
inc cx
movzx ebx, byte [ecx + edi - 0x70000000]
dec eax
cwde
dec eax
neg edx
cdq
mov cl, byte [edi + ecx - 0x1c240b84]
dec edx
lea edi, [edi + ebp*8 - 0x42e]
dec edx
not dword [esp + ecx - 0x6ffffff8]
sal bl, cl
cbw
inc dx
mov dword [edi + ebp - 0x86], ebx
mov ecx, 0xe002a1a7
dec esi
mov dword [esp + ecx - 0x70000000], esp
ret 8
xchg eax, ebp
mov dl, 0x3e
and eax, dword [eax]
dec ebp
arpl di, di
inc edx
and byte [esp + ecx - 0x6ffffffd], 0xba
dec eax
neg eax
dec esi
mov dword [esp + ecx - 0x6ffffff8], ebp
dec ebp
add esp, edi
jmp 0x5c3cc1
push 0x77089ab2
push 0xef29ce9c
shr eax, 8
call fcn.00696991
push ebx
rol dword [edi + ebp*4 + 6], 1
jne 0x84c14c
pop ds
aas
sti
jbe 0x84c1d2
xchg edi, eax
jnp 0x84c204
lodsb al, byte [esi]
out dx, eax
push edi
wait
pop es
ret
cmp al, 0xa1
pop eax
cdq
imul esp, dword [edx + 0x7f04ae6e], 0xffffffe7
sbb eax, 0xa62a08ee
enter 0x560c, 0x78
mov eax, 0xe14b68ec
xchg ebx, eax
pop edi
invalid
lodsb al, byte [esi]
inc esi
movsd dword es:[edi], dword [esi]
out dx, eax
and al, 0xb8
mov dl, 0x10
adc dh, byte [eax + 1]
invalid

Function at 0x84d602
Capabilities:
Execute syscall

Disassembly:
push edx
ror ax, 0x82
ror ecx, 3
call fcn.00b2d6b3
mov eax, 0x930b48b0
mov ecx, 0x74b60889
lea edx, [eax*2 - 0x26c232f1]
mov ecx, dword [esi + ecx - 0x74b60889]
lea eax, [eax*8 + 0x5ba3beb9]
inc edx
add esi, 4
xor ecx, ebx
add ecx, 0x3bbc8d39
rol ecx, 1
neg ecx
bt eax, edx
call fcn.00a4e952
syscall
push ecx
dec eax
mov dword [esp], 0x38a4add0
call fcn.0069bd91
mov edx, 0x6a1f722c
push edx
movzx eax, dx
mov edx, dword [esi + eax - 0x722c]
mov ecx, dword ss:[edx + eax*2 - 0xe458]
sal dword [esp + eax*2 - 0xe458], 0x5e
call fcn.0068c9a0
dec eax
and dword [esp + edx*2 - 0x8936], edx
or word [esp + edx - 0x4497], 0x5917
inc ebp
xor eax, edx
movzx eax, word [esp + edx*2 - 0x8933]
inc ecx
inc eax
dec eax
mov dword [esp + edx*2 - 0x892e], 0x8f0235b5
sub si, ax
inc ecx
mov esi, 0x5fb65e36
inc ecx
xor eax, 0x841e279f
cwd
dec esi
lea ebx, [eax + esi*4 + 0x13368b2e]
inc ecx
sub eax, 0xc517e21a
shl dx, 0x29
inc ecx
sub dh, bl
shl byte [esp + edx + 0xf], 0xe3
inc ecx
ror eax, 1
dec esp
mov dword [esp + edx + 8], edx
dec ebp
lea edi, [ecx + 0x35abfb35]
inc ebp
movzx edx, si
inc esp
xor dword [esp + edx + 8], eax
dec esp
mov edx, dword [esp + edx*4 + 8]
mov ebx, eax
dec eax
cdq
dec eax
mov dword [esp + edx + 8], esi
dec ebp
arpl ax, ax
dec word [esp + edx + 0xc]
dec ebp
add esp, eax
inc ecx
push ecx
rol word [esp + edx + 8], 0xe1
dec esp
mov dword [esp + edx*4], esp
ret 0x10
Function at 0x858c7f
Capabilities:
Encode data using xor

Disassembly:
btr eax, 0x11
add eax, 0xfe33be3f
xor ebx, edx
call fcn.00606607
xor ecx, ebx
movsx eax, dx
shr eax, 0xb1
neg ecx
sub edx, eax
push eax
ror ecx, 2
sal edx, 0x54
sal al, 0xe1
and edx, ecx
mov ecx, dword [esp]
jmp 0x8ce38a
mov dword [esp + ecx - 0x6f2759a7], 0xb994ac9e
neg edx
and word [esp + ecx - 0x6f2759a5], cx
sbb edx, 0x20b3f301
sar eax, 0xec
je 0x64baec
call fcn.006e1c4b
popal
sub dword [esi - 1], ebp
dec ebp
xchg esp, eax
sbb bl, byte [ebp + 0x159cb37f]
popal
jge 0x858cc7
dec edi
cmpsd dword [esi], dword es:[edi]
or dword [edi - 0x6de0999c], ecx
je 0x858cf2
cmp dword [esi], esp
jle 0x858ca3
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
lea ebp, [ecx]
outsb dx, byte [esi]
cwde
adc al, 0xa5
jnp 0x858c74
mov gs, word [edi]
cmpsb byte [esi], byte es:[edi]
mov edx, dword [eax - 0x70]
dec ebx
stosd dword es:[edi], eax
pop es
insd dword es:[edi], dx
pop ebx
pop es
add eax, 0xe2198d67
push 0x1acf9792
push es
mov ah, 0x70
insd dword es:[edi], dx
sbb dword [ecx + 0x70], edx
dec eax
and byte [ebp - 0x7d], bl
je 0x858d65
xor dword [eax + esi*2 - 0x22], 0xffffff93
sahf
int 0x70
fmul dword [esi + 0x792c6e7e]
cmp dword [edi], edi
xchg ecx, eax
mov esi, 0x1e27783
pop esp
pop esp
ror byte [0x60899bf9], 5
mov edi, 0xc4d8c663
dec edx
adc dword [ecx], esi
movsd dword es:[edi], dword [esi]
and bl, dl
mov dh, 0xdd
out 0x3d, eax
sub dword [ecx], 0x559f0022
fcmovb st(0), st(7)
pop eax
dec edx
invalid
ficom word [ebx - 0x278f3262]
invalid
adc dword [ebx + 0x44], ebx
push ebp
out dx, al
inc ebx
dec dword [ebx]
scasd eax, dword es:[edi]
sbb al, 0x61
call 0x79072849
push esi
and eax, dword [esi - 0x2d]
sbb al, 0xd1
cmp dword [ecx + 0x71d56edb], ebx
wait
sub dl, ch
or dword [edi], 0xde89163
retf
Function at 0x8c79b6
Capabilities:
Encode data using xor

Disassembly:
or bl, al
inc ebp
xor ebp, edx
pop eax
inc esp
movsx ebx, cl
mov eax, 0xc952090
inc ecx
bswap ebp
inc ecx
rol ebp, 2
btr ebx, 0x87
inc ebp
movsx ecx, bl
inc ecx
not ebp
inc ecx
ror ebp, 1
inc ebp
movzx eax, cx
inc ecx
or eax, eax
inc ecx
push edx
inc esi
xor dword [esp + ebx - 0x53], ebp
inc esp
mov edi, esi
jmp 0x9165f2
dec eax
sal esi, 0x5b
inc ecx
pop edx
dec ebp
arpl bp, bp
dec esp
lea edi, [eax + esi*4 - 0x7169c66e]
inc cx
bts ecx, eax
dec esp
or eax, ecx
dec ebp
adc esp, ebp
cwde
inc sp
add ecx, ecx
btc ebx, 7
dec eax
mov edx, dword [ebx + ebp - 0x5e48ebe9]
dec edx
lea ebp, [ebp + ebx*4 - 0x144]
inc eax
setb dh
inc esp
mov esi, esi
dec ecx
xor edx, edx
dec esp
lea ebp, [eax*2 + 0x2b834eb0]
call fcn.00773bc0
adc byte [edx - 0x79], 0
neg dword [esi - 0x1970c01e]
fbld tbyte [ecx - 0x29]
pop dword [ecx - 0x6df74067]
sbb esi, dword [edi + 0x70d45bc2]
mov ch, 0x44
xor dword [eax + 0x20], esi
add al, 0x5d
ficom word [eax + esi*2]
ror byte [ebx - 0x3f8f523d], cl
rcr dword [esi], cl
outsb dx, byte [esi]
jl 0x9166ad
xchg edi, eax
rcl dword [ecx + 0x6159489c]
pop ebx
jno 0x916651
dec edx
xchg ecx, eax
test al, 0x6f
cmpsd dword [esi], dword es:[edi]
mov cl, 0xff
xchg edx, eax
retf
cmc
sbb al, 1
sub al, byte [esi - 0x59]
add dword [edx], ebp
inc esi
cmpsd dword [esi], dword es:[edi]
js 0x9166eb
js 0x916715
cmpsb byte [esi], byte es:[edi]
mov al, 0xc6
xchg dword [esp + ebx*8], ecx
les edx, [edi]
mov edx, 0x53f34987
mov ebp, 0xd3a0d2a0
mov esi, 0x68f5c791
mov eax, dword [0xb9e20a10]
inc esp
push ebx
insb byte es:[edi], dx
adc esi, dword [ebx]
xor ch, byte [eax]
sub byte [eax], bl
xor eax, 0x75904453
scasd eax, dword es:[edi]
cli
lodsd eax, dword [esi]
mov dword [0x5c024bd4], eax
out dx, eax
mov ebx, 0x5f25066b
add bl, byte [edi + ebp*8 - 0x45]
imul eax, dword [esi], 0x25
pop edi
and eax, 0xee25285f
push edi
cmp eax, 0x2035e531
mov edx, 0x36066434
sub byte [0x313d57ee], ah
in eax, 0x35
and byte [edx + 0x36066434], bh
shr ecx, 0x54
cld
je 0x9166c7
xor byte [ebp + 0x7d], bh
inc ebx
pop ecx
mov esp, 0x4f827a0e
jb 0x91677b
sbb al, 0xe
inc esi
pop es
xchg byte [edi + 0x2e1620c1], bh
je 0x916781
and byte [esi], dl
je 0x916781
inc ecx
adc al, 0xe3
in eax, dx
mov esp, 0x65d025cf
jecxz 0x91672f
inc ebx
push cs
jp 0x9166ab
push edi
or eax, 0x92917d25
jp 0x916765
adc eax, edi
sub dh, 0x8e
out dx, al
mov es, word [ebx + 0x10afb7e7]
push cs
and edi, 0xffffffb7
scasd eax, dword es:[edi]
adc byte [esi], cl
dec esp
fdivr dword [ecx - 0x7d85f1bd]
pop ecx
stosb byte es:[edi], al
xor ch, byte [esi]
dec ebp
xor al, 0x3d
xor dword [ebx], ebp
pushfd
js 0x9167b0
sbb bh, byte [esi - 6]
mov dl, byte [esi]
add bh, byte [ecx + 0x70595442]
push es
adc edi, ecx
stc
in eax, 0xd7
push cs
jp 0x9166e5
pop ebx
dec ebx
lahf
add al, ah
in al, 0xae
mov dh, 0x70
std
pop ss
popal
scasb al, byte es:[edi]
invalid
std
in eax, 0x75
sub dword [ebp + ebp + 0x719f70a4], edx
xlatb
movsb byte es:[edi], byte [esi]
jo 0x916723
jno 0x91675d
ja 0x916736
invalid
jp 0x916734
pop edi
pop esi
pop es
sal byte [ecx + 0x6c], cl
mov esp, 0x445b5701
retf
Function at 0x8fd804
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edx
not ecx
sbb dx, dx
xor dword [esp], edx
not dl
xor ecx, 0xe79a1309
sal eax, 0x62
sbb ecx, 0xca154810
rol ecx, 1
cbw
xor ebx, ecx
add edx, edx
jo 0xaa0922
mov edx, 0x892ed18a
sub esi, 4
lea eax, [edx*2 - 0x686b47f4]
push eax
pop edx
mov ecx, dword [esi]
xor ecx, ebx
push edx
inc dword [esp]
dec ecx
sub dword [esp], 0x1c254785
ja 0x6b902e
call fcn.0088a25f
jmp 0x7ede01
add edi, ecx
mov ecx, dword [edx + ebp - 0x1b9a01fe]
shl byte [esp + edx*2 - 0x373403fc], 0x87
mov eax, dword ss:[ecx + edx*4 - 0x6e6807f8]
mov dword [esp + edx - 0x1b9a01fe], 0x1dbbf13d
xchg dword [esp + edx*4 - 0x6e6807f8], edx
xor dword [esp + edx - 0x1dbbf13d], edx
mov dword [ebp + edx - 0x1dbbf13d], eax
movzx eax, dl
neg word [esp + edx - 0x1dbbf13c]
movzx ecx, dx
mov dword [esp + ecx*2 - 0x1e27a], edi
ret

Function at 0x9379ff
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
call fcn.00769288
add al, 0x78
inc dword [eax + edi*2]
push ds
inc esi
sub dword [0xf75d6ac1], edi
adc byte [eax - 0x7774544d], dl
cmp al, 0xf8
mov esi, 0x323bd6aa
not dword [eax]
nop
mov bl, 0xab
mov ecx, dword [eax - 0x554107c4]
salc
cmp esi, dword [edx]
loope 0x937a5a
xchg byte [ebx + 0x2b8d828], bh
jl 0x937a03
out 0xce, al
xchg ebp, eax
inc edx
ror ch, cl
dec edx
insb byte es:[edi], dx
out 0xd, eax
rol ecx, 0x6e
sub dh, dh
add dh, cl
salc
xor eax, 0x2ad57b6
pop es
fbld tbyte [0xd8344516]
xor al, byte [ebp - 0x6e69aeb2]
xchg edx, eax
inc esi
sal dword [esi + 0x44], cl
push edi
pop eax
aam 0xac
xchg esi, eax
xor al, bl
push cs
std
jo 0x937a0d
and dh, byte [esi - 0x67ea2c40]
in al, 0xfe
cdq
add bh, byte [ebp + 0x234de31f]
aaa
sub esp, dword [ebp + 0x468278b7]
pop ebx
cwde
dec edi
lodsd eax, dword [esi]
invalid

Function at 0x940bac
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jmp 0x631cab
push ecx
mov dword [esp], 0x5976db52
call fcn.009d7954
pop ss
call 0x5c62eb19
ficomp dword [ebx]
push esi
fmul st(6)
xor eax, 0x54535789
pushfd
or eax, 0x441f2d40
xor dword [esi + 0x1fec41a1], edx
inc esp
clc
daa
push ds
mov dl, 0xc
inc esp
rcl byte [esi - 0x61], cl
loope 0x631cca
xchg edi, eax
imul ebp, dword [ebp - 0x2f], 0x21759ad
mov esi, 0x38187321
stc
dec ecx
test al, 0xfc
sbb byte [esi + 0x7a], 0xb4
invalid
jmp 0x58a6ea
Function at 0x944e09
Capabilities:
Encode data using xor

Disassembly:
not edx
btr ecx, ecx
setae al
sbb cx, cx
lea edx, [edx + ecx*8 + 0x7b477e18]
ror edx, 1
sal eax, cl
call fcn.0099c6d4
or al, 0x8c
mov word [ebp + eax*2 - 0x11a], cx
mov eax, dword [edi + eax*8 - 0x468]
mov edx, 0x1cbcc632
movzx ecx, dl
sar dl, 0x41
lea edi, [edx + edi - 0x1cbcc615]
dec dl
xor eax, ebx
xor dl, 0x3b
neg dl
not eax
xadd dl, cl
add cx, dx
neg eax
ror ecx, cl
sbb dx, dx
rol eax, 2
sar dx, cl
jbe 0xb154ab
clc
sub edx, edi
cli
insb byte es:[edi], dx
or esp, dword [ebx]
call 0x87dfabb7
push 0xffffffffffffffad
xor al, 0x38
inc eax
stosd dword es:[edi], eax
dec ebp
pop ecx
dec ebx
mov ecx, dword [ebp + esi*4 - 0x74]
je 0x944eca
ja 0x944ee4
nop
xor al, 0x27
sal byte [eax - 0x47d7f49f], 0xb
imul ecx, dword [ebx - 0x48], 0x2c8e33ce
cmp byte [esi + ecx], ch
leave
dec ecx
sahf
xor al, 0x1f
inc ebx
and eax, 0x3e6ca3ee
dec esi
mov ah, 0x27
mov ecx, 0x7d867934
je 0x944e8a
jbe 0x944e6d
cmp cl, byte [esi + 0x7a]
xchg ecx, eax
stosb byte es:[edi], al
and eax, 0xebdac923
xor dl, bl
inc edx
xchg ecx, eax
mov dh, 0x16
ret
mov edi, es
sub esi, edx
adc al, 0x9d
or al, 0xf9
aad 0x14
jg 0x944e7f
rcr dword [edx + 0x7018ee83], 1
jmp 0x766c41cc
mov cl, byte [ecx + 0x5b9f3904]
test ah, 0x61
xor al, 0x7c
sar byte [edx + esi*2 + 0x5c], 0x6f
insb byte es:[edi], dx
or al, 0x29
sub ebp, dword [ebx - 0x59]
sub byte [ecx - 0x194f7195], dl
out 0xd0, al
mov edx, dword [edx + 0x6e]
fild word [eax + edx*2 - 0x382073e2]
lea esi, [ebp + 0x5301071c]
salc
adc byte [ebx + 0x45d52115], cl
fisttp word [edx - 0x52ea09b0]
das
add edi, dword [ecx + 0x4a]
invalid
bswap ecx
mov word [eax + ecx*2 - 0x17f32], dx
mov eax, ecx
mov ecx, dword [edi + eax*2 - 0x17f32]
btr ax, 0x9c
lea edx, [eax + eax*4 - 0x74e2d3c2]
setae dl
lea edi, [edi + eax - 0xaf95]
bts edx, eax
adc edx, eax
xor ecx, ebx
and dx, ax
rol dx, 0x8e
call fcn.009bd5b3
inc ecx
mov ecx, 0xa5298fbd
inc ebp
mov edi, ecx
inc ecx
movzx ecx, cx
mov eax, dword [ebp + ecx*2 - 0x11f7a]
inc esp
movsx ebp, cx
inc ebp
movzx esi, ch
dec esi
lea ecx, [edi*4 + 0x640e0919]
dec eax
lea ebp, [ebp + ecx*2 - 0x11f76]
mov esi, 0x8d97b50f
inc ecx
ror ecx, 0x90
inc ecx
xor eax, edx
inc ecx
movsx edx, cx
lea eax, [eax + ecx*2 - 0x589faf8e]
xor eax, 0x583c1807
rol eax, 1
inc ebp
movzx ebx, cx
inc ebp
movzx eax, bp
dec eax
lea edx, [edx*2 + 0x668dd4bd]
neg eax
inc ecx
push ebp
inc eax
xchg byte [esp + ecx - 0x8fb6], dh
inc eax
call fcn.009b5965
mov ecx, 0x99bf3f0b
movsx eax, cl
mov edx, 0xfca19012
mov eax, dword [eax + ebp - 0xb]
mov dx, word [ebp + 4]
xor cx, cx
adc ebp, 6
jmp 0xb0405e
Function at 0x96439c
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x1c]
jne 0x67a021
pop esi
mov dword [esp], ecx
sub edi, 4
sar ecx, 0xba
mov edx, dword [edi]
xor edx, ebx
movsx eax, cl
neg edx
cwde
rol edx, 3
not word [esp + 1]
rol ecx, cl
jae 0xa48a37
sbb edx, 0x12031625
not edx
xor ebx, edx
jmp 0xa4f543
shr ecx, cl
add esi, edx
call fcn.00b66bed
mov eax, 0x87371ead
movzx edx, al
xor eax, 0xe0494b2
mov ecx, dword [esi + edx - 0xad]
cwd
bswap eax
ror eax, 0xc5
lea esi, [eax + esi - 0x48fc5198]
shl dl, 0xa5
xor ecx, ebx
btc edx, 0x97
neg ecx
add edx, eax
bswap ecx
xor ecx, 0x5c331a30
sar edx, 0xcd
ror ecx, 2
dec ecx
xor ecx, 0xac3dd506
lea ecx, [ecx + edx*8 + 0x20289dc6]
call fcn.00a41d94
dec eax
jmp 0x5c6391

Function at 0x977a4a
Capabilities:
Encode data using xor

Disassembly:
neg cx
mov ecx, dword [eax + ebp - 0x200e00c1]
sar ax, 0xe1
xchg ah, al
mov dword [esp + eax*2 - 0x401cc000], eax
mov eax, dword [ebp + eax*2 - 0x401cbffc]
call fcn.008d1dd2
push ecx
pop esi
cdq
add byte [esi - 0x497d60ef], dh
cmp byte [edx + 0x27], ah
fcomp st(5)
jo 0x977acd
invalid
adc bl, byte [ebx - 0x61]
inc ebp
invalid
imul ebx, dword [esi - 0x49dca664], 0xb142998e
and dword [ecx], ecx
jne 0x977b57
mov esp, 0x6881d94e
popal
jnp 0x977aae
wait
add eax, 0x39273b41
in eax, dx
salc
nop
test dword [esi + esi + 0x27d85642], ebx
add edx, esi
mov dword [0x50df38e], eax
jb 0x977b7c
dec ebx
cld
invalid
adc dword [edi], edi
popfd
sbb bh, byte [eax + 0x391e757e]
mov esi, 0x9cb4ee2c
pushfd
cmp eax, dword [ebp + eax + 8]
add al, 0xe3
adc al, 0xb
shl dword [ebx + eax*4], cl
sbb bl, byte [edx]
mov byte [0xf20c64c7], al
je 0x977b49
pop ss
out dx, al
mov ah, 0x9c
aaa
push 0x1a
fcomp qword [eax]
and edx, edx
outsd dx, dword [esi]
aas
mov word [edi + 0x7d5596f5], fs
das
xchg esi, eax
push ebp
jge 0x977baf
dec ebx
imul edi, dword [ebx - 0x1719267b], 0x3b7bb1da
dec dword [ecx + ebx*2]
das
sbb ch, byte [edx + 0x21184e99]
add al, 0xcc
sahf
push ebx
out 0x85, eax
inc eax
mov edx, 0x339cb4ee
test byte [edi], dl
pushfd
cdq
and dword [edi], eax
xor eax, dword [edi + edx + 0x721999c]
and ch, byte [ebp - 0x76]
push cs
jle 0x977ba0
adc dword [eax + 0x3eeb85de], ebx
inc ebx
ljmp 0xfdca
cwde
fiadd word [ebp - 0x15bcc115]
cdq
std
dec ebp
sub ecx, edx
std
fidivr word [edi - 0x5b]
mov ebx, edx
sahf
in al, dx
das
div byte [ecx]
inc ebx
lar edx, esi
push ebp
invalid

Function at 0x9800e4
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor

Disassembly:
xor edx, ebx
bt ecx, eax
xor edx, 0x7621d128
and ax, 0xa732
lea edx, [eax + edx + 0x522e4c1f]
sub ecx, ecx
xchg ecx, eax
bswap edx
jb 0x79b148
call fcn.00b7049a
neg dx
neg al
mov dword [esp], 0x603d6e06
inc al
xchg dh, cl
xor al, 0x29
dec word [esp + 2]
xor bl, al
sal cl, 0xe7
or dword [esp], edx
sbb byte [esp + 1], cl
sbb edi, 2
sub dword [esp], 0x7ebcff26
mov word [edi], ax
pop eax
sbb ecx, edx
shl eax, 0x7f
mov edx, dword [esi + ecx*2 - 0x650a]
lea esi, [esi + ecx - 0x3281]
ja 0x72814e
Function at 0x9a399c
Capabilities:
Encode data using xor

Disassembly:
not ecx
or dx, dx
btr dx, 0xa8
pop eax
bswap ecx
xor ebx, ecx
add ebp, ecx
mov eax, 0x6e33489a
movsx ecx, dx
and cx, 0x223e
movzx eax, byte [esi + eax - 0x6e33489a]
call fcn.004020e0
sal byte [esp + edx - 0xa007], 0xc7
call fcn.00679bb7

Function at 0x9a67e3
Capabilities:
Encode data using xor

Disassembly:
not edx
pop eax
lea edx, [ecx + edx + 0x17d2a6a9]
pop eax
and ax, cx
ror edx, 1
btr eax, eax
mov dword [esp + ecx*2 - 0x7971ffbc], eax
and eax, 0xe5b563bf
bswap edx
adc byte [esp + ecx*2 - 0x7971ffbb], 0x9f
and ax, ax
neg ecx
xor edx, 0x6a247da0
sub eax, 0x18a47504
setle byte [esp + eax - 0xc0bee9a]
lea edx, [edx + eax*8 + 0x51be4a44]
add cl, ch
btc cx, 0xaf
or cx, 0x6184
bswap edx
setg al
xchg ecx, eax
pop ecx
xor ebx, edx
bt ax, 0x26
adc edi, edx
shl cx, 0x22
sar eax, 0x14
mov cx, word [esi + ecx*2 - 0x7970f000]
btc eax, eax
adc esi, 1
neg eax
cdq
movzx eax, byte [eax + ebp - 0x1003cc]
btr dx, dx
lea ebp, [ebp + edx*2 + 1]
call fcn.008b6eba

Function at 0x9b0425
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov edx, 0xe3db388
bswap edx
add dword [esp + 4], 0xff9fc68e
lea edx, [edx*8 - 0x4cd8e943]
movzx edx, dx
mov edx, dword [esp + edx*8 - 0x7f960]
mov dword [esp + 8], 0xe371a409
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.0052e9c9

Function at 0x9b9939
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], ebx
movzx ebx, byte [ecx]
xor ebx, edx
and ebx, 0xff
call fcn.0077d8d3
adc ecx, ebp
and ch, bh
cwde
sbb dword [ebx + 0x39], 0xffffffa8
push esp
enter 0x15c1, 0xffffffffffffff92
out dx, al
dec ebp
inc ebp
ficom word [edx + 0x66]
jl 0x9b99dc
add dword [ebx + esi], edi
sub bh, ah
dec ebx
sahf
mov byte [ebx - 0x73d27dad], dl
js 0x9b99c2
leave
rcl dword [edi + 0xb96de0a], cl
push es
xchg edi, eax
or bl, dh
xchg esi, eax
or eax, dword [esi]
insd dword es:[edi], dx
jge 0x9b99b1
jl 0x9b998a
outsb dx, byte [esi]
int 0x93
or al, 0x42
salc
shr byte [edi], 1
push esp
aaa
mov esi, 0x49963316
jae 0x9b9975
invalid
invalid
inc ebp
add bl, bl
clc
pop ds
mov dh, 0x8d
sbb byte [esi - 0x2e], dh
int3
inc ebp
mov ah, 1
insb byte es:[edi], dx
invalid

Function at 0x9d97a2
Capabilities:
Encode data using xor

Disassembly:
add ecx, 0xce9cb707
mov edx, dword [esi + eax - 0x7d361ee0]
push ecx
add dword [esp + eax - 0x7d361ee0], ecx
lea esi, [esi + eax - 0x7d361edc]
bt eax, 0xa8
movzx eax, byte [edi + eax - 0x7d361ee0]
and ecx, 0x5eb1eba0
sar ecx, 0x41
pop ecx
adc edi, 1
sar cl, 0xc2
neg cx
sar ecx, cl
xor al, bl
shr ecx, 0x7a
adc ecx, ecx
xor al, 0x3a
neg al
call fcn.0068fa0f
xchg ebp, eax
push edx
xchg ebp, eax
adc byte [esi + 0x4f], al
sub dword [esp], 0x5d
sub al, 0x64
pop ebp
dec ecx
std
sahf
mov bl, 0x45
insd dword es:[edi], dx
xor bh, al
pushal
dec eax
cmp esi, dword [0x702b3b32]
push esi
fmul dword es:[esi - 0x11]
jb 0x9d97f1
mov al, byte [0xd24c7870]
arpl sp, bp
sub ecx, 0x7ab4af0d
in al, 0xa4
inc dword [esi + edx*8]
xchg esi, eax
inc edi
add byte [eax - 0x79], dh
imul ecx, dword [edi + 0x56450161], 0xfa353583
outsd dx, dword [esi]
mov dword [0xd93ece61], eax
cmp byte [eax - 0x66], cl
jmp 0x9d97f8
Function at 0x9f525a
Capabilities:
Execute anti-debugging instructions

Disassembly:
sar dl, 0xe6
dec edx
xor edx, 0xa0b4b205
ror eax, 3
inc dl
jg fcn.006888ad
bswap eax
and ecx, 0xf28ebb1c
lea ecx, [edx + edx*4 - 0x4a487af8]
bt ecx, ecx
xor eax, 0x9d33bc30
sub ecx, ecx
xor ebx, eax
sub ecx, edx
not cl
add esi, eax
lea edi, [edx + edi - 0x5f4b4dfc]
movzx edx, byte [edi + edx - 0x5f4b4dfb]
movsx eax, cx
xadd al, ch
xor dl, bl
jmp 0x67b850
mov eax, 0xb0e6d0e
mov eax, dword [eax + edi - 0xb0e6d0e]
mov ecx, 0x5420fb12
sal cx, 8
lea edi, [ecx + edi - 0x542011fc]
add cl, ch
btc ecx, ecx
xor eax, ebx
ror cl, 0xc4
not eax
movzx edx, cl
dec edx
dec eax
shl ecx, 0x29
js 0x6cd0c5
xchg edx, ecx
ror eax, 1
and edx, 0x113f51a6
xadd dl, cl
inc eax
bswap eax
ror eax, 2
call fcn.009ddbbe
call fcn.0081a84e
jmp 0x8d00e0

Function at 0xa1c3c0
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x10]
jmp 0x7df79a

Function at 0xa3fc3e
Capabilities:
Encode data using xor

Disassembly:
call fcn.005354e0
mov ecx, dword [edx + ebp + 4]
bts edx, 0xb0
add edx, 0xa3251a18
mov dword [esp + 0xc], ebx
cpuid
inc byte [esp + 2]
jbe 0x66b644
bswap eax
jmp 0x8a466b
sbb ebp, 8
call fcn.005278d9
adc edi, 6
push ecx
and word [esp], cx
mov word [eax], dx
lea eax, [ecx*8 - 0x68733fca]
sal eax, cl
setbe cl
mov dword [esp + eax - 0x80000000], ebp
ret 4
neg byte [esp + 3]
rol eax, 1
mov edx, 0x6ba4b42c
sal dword [esp + edx - 0x6ba4b42c], 0x85
sbb edx, edx
xor ebx, eax
mov dword [esp + edx], 0xc805e8bc
sar dx, 0x29
xchg dh, dl
adc esi, eax
add edx, dword [ebp + edx]
mov eax, dword [esp]
not ax
bswap eax
mov eax, dword [ebp + eax - 0x431705c4]
sal word [esp + 1], 0xe7
adc ebp, 4
xor ecx, ecx
not dword [esp]
inc word [esp]
test eax, eax
call fcn.00a4d5a4
movzx eax, byte [edi + ecx - 0x57b15abc]
shr cx, 7
movsd dword es:[edi], dword [esi]
dec esi
test al, 0x66
shr ecx, 7
lea edx, [ecx + ecx*2 - 0x745ea0d9]
inc cl
xor al, bl
bts edx, ecx
dec cl
mov dword [esp + ecx - 0x57b100b5], 0x14362a05
ror al, 1
xor dl, byte [esp + ecx - 0x57b100b3]
xor al, 0x38
xchg edx, ecx
add cx, dx
neg al
call fcn.0058241f
dec ecx
lea eax, [ebp + ebx*2 - 0x2ff9fae7]
inc ecx
dec eax
mov edx, 0xbd91d4b7
inc ebp
movzx edi, ch
inc ecx
rol eax, 1
inc cx
neg ebx
inc ecx
bswap eax
inc ecx
xchg cl, dl
inc ecx
setge bl
inc cx
bts ebx, ebx
inc ecx
push edx
sar dx, 0xc1
inc esi
xor dword [esp + ebx - 0x4e9e0701], eax
inc cx
add ebx, 0xc148a73c
jecxz 0xa3fc43
inc ecx
pop edx
dec ebp
arpl ax, ax
ror cl, 5
dec ebp
add esp, eax
inc ecx
sub ebx, ebx
inc dx
mov edx, dword [edi + ecx*4 - 0x760932dc]
inc bp
mov ebx, dword [ebx + edi - 0x4e9eae3b]
inc ecx
movsx esi, di
inc ebp
movsx esi, ch
inc edx
mov cl, byte [edi + ecx - 0x1d824cb3]
dec ecx
lea edi, [ecx + edi - 0x1d824cb3]
inc sp
shld edx, ebx, cl
inc cx
shr ecx, 0x65
dec ecx
sar ebp, 0x81
inc cx
mov dword [ebp + edi - 0x70b3ea05], edx
inc ebp
xchg ecx, esi
jae 0x643c86
inc bp
xor esi, ebp
inc ecx
jmp esp