joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425f1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x425f66
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x425f0d
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x425f1c
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x82bbbf
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x425f6d
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.0040cde3
cmp eax, dword [ebp + 0xc]
pop eax
je 0x42600c
add edi, 4
add eax, 2
dec ecx
jne 0x425f52
call 0x425fb9
loope 0x425faf
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x426009
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x42601a
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x425fcd
cmp eax, ecx
ja 0x425fcd
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x426057
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x42604d
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.0040d2c2
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x7d1710
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x227000]
mov dword [edi + 0x2cd47c], 0xb784346
push edi
jmp 0x7d173a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7d1741
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d1730
mov eax, 1
add ebx, ebx
jne 0x7d1753
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7d1764
jne 0x7d1783
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d1783
dec eax
add ebx, ebx
jne 0x7d1770
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7d1748
add ebx, ebx
jne 0x7d177f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7d17d5
xor ecx, ecx
sub eax, 3
jb 0x7d179b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7d180a
sar eax, 1
mov ebp, eax
jmp 0x7d17a6
add ebx, ebx
jne 0x7d17a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d1774
inc ecx
add ebx, ebx
jne 0x7d17b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d1774
add ebx, ebx
jne 0x7d17c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7d17b6
jne 0x7d17d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7d17b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7d17f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7d17e6
jmp 0x7d1736
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7d17f4
add edi, ecx
jmp 0x7d1736
pop esi
mov edi, esi
mov ecx, 0xef8e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7d1812
cmp byte [edi], 0x26
jne 0x7d1812
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7d1817
lea edi, [esi + 0x3c0000]
mov eax, dword [edi]
or eax, eax
je 0x7d188f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41b11c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x41b2f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7d1844
mov ecx, edi
jns 0x7d1873
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x41b2f8]
or eax, eax
je 0x7d1889
mov dword [ebx], eax
add ebx, 4
jmp 0x7d1861
call dword [esi + 0x41b2f4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x7d18c0
cmp al, 0xef
ja 0x7d18b3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x7d1895
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x7d18a2
mov ebp, dword [esi + 0x41b2fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7d18f4
sub esp, 0xffffff80
jmp 0x5c9f5a
Function at 0x10091c8c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10091b0b

Function at 0x1009b220
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1009b24d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1009b24d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
mov ecx, 0x4a176fdb
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x158f4cea
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x402000
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.kernel32.dll_GetACP]
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp loc.00409000

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x9449151
Capabilities:
Encode data using xor

Disassembly:
inc ecx
movzx ebx, bx
inc ebp
xor ecx, edi
shr ax, cl
inc ecx
ror ecx, 1
inc ecx
inc ecx
inc ecx
xor ecx, 0x17ae44b3
dec eax
mov dword [esp + edx - 0x5da81e00], esi
movsx ebp, cx
inc ecx
neg ecx
inc ecx
inc ecx
shl cl, 0x66
inc cx
add eax, ebx
inc ecx
neg ecx
dec eax
xadd eax, ebx
inc ecx
inc ecx
inc ecx
ror ecx, 1
inc eax
xchg bh, cl
ror word [esp + edi - 0x762f1ab4], cl
inc ebp
and ebx, ebx
inc ecx
sbb ecx, 0xe198baa8
dec esp
mov dword [esp + edi - 0x762f1ab8], edi
call fcn.09600b61
mov ebx, 0x128a1b8e
mov edi, ebx
mov esp, ebp
popfd
movsx ebp, bx
xchg ebp, ebx
movsx eax, bl
pop ebp
pop edi
pop edx
bswap eax
lea ebx, [eax + ebx + 0x1b0ac5ad]
pop ecx
bswap eax
push ebx
mov ebx, dword [esp + 4]
push eax
mov dword [esp + 8], eax
movsx esi, ax
mov eax, dword [esp + 0xc]
not esi
mov esi, dword [esp + esi*4 - 0x1b4]
call fcn.0996dc28

Function at 0x944b8c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
not edx
neg edx
xor ecx, eax
pop ecx
dec edx
rol eax, 0x1c
mov ecx, eax
xor ebx, edx
bts ecx, 0x1b
sal cl, 0x45
adc esi, edx
mov ecx, dword [ebp + eax*4]
movzx dx, byte ss:[ecx + eax*2]
jmp 0x946af7c
sub eax, eax
call fcn.099989f6
ror cl, 0x25
rol edx, 3
inc edx
xor edx, 0x2ab24793
ror word [esp + 1], 0xe4
dec ecx
dec edx
cwde
not ecx
imul eax, dword [esp + ecx - 0x4b]
rol edx, 1
ror dword [esp + ecx - 0x4b], cl
inc eax
btc ax, cx
xor ebx, edx
xadd eax, ecx
bt ax, cx
add esi, edx
mov cx, word [ebp]
cdq
call fcn.0941ed79
xchg ebx, eax
cmp byte [edx + 9], cl
xor bh, bl
sub dl, byte [ebp - 0x3e]
pop ecx
push ss
xor al, 0x14
xor al, 0x92
jp 0x946afa1
ret 0x4cd3
adc ch, 0x1d
add eax, 0xfdbcb237
in eax, 0xaf
scasd eax, dword es:[edi]
and edx, edi
sbb al, 0x56
repne outsd dx, dword [esi]
aam 0x5a
adc byte [edx], cl
imul edi, dword [edx - 0x6a], 0x2f
invalid

Function at 0x945fa8b
Capabilities:
Encode data using xor

Disassembly:
shr edx, 0xb4
sal al, 0x41
xor ecx, ebx
bswap ecx
mov dword [esp + edx*2], eax
div eax
not ecx
neg ecx
bswap ecx
btc dx, ax
xor ebx, ecx
call fcn.0947850a
inc al
adc ebp, 1
shr ax, 0xc1
Function at 0x946523c
Capabilities:
Encode data using xor

Disassembly:
call fcn.0944e1d0
mov eax, 0xa88c97bb
sub edi, 4
mov eax, dword [edi]
xor eax, ebx
rol eax, 1
mov ecx, 0xd818c1bc
and cl, ch
ror ecx, 0x39
not eax
xor eax, 0xf40c97a4
cmp edi, esi
sal byte [0xf40c97a4], 1
ror ecx, 0x19
rol eax, 3
xor ebx, eax
movsx edx, cl
add cx, cx
seta dl
adc esi, eax
xadd cl, dl
mov eax, dword [ebp + edx*2 - 0x18]
sub edx, 0x3931a9b2
lea edx, [edx + ecx*8 + 0x1c09213d]
mov ecx, dword [ebp + ecx - 0x30606c09]
btr edx, 0xb8
push ebx
ror edx, 0x52
cpuid
call fcn.09421322
add eax, 0x2f094bde
rol byte gs:[0x8e380c46], 0x2b
sbb byte [edx - 0x40], dl
mov al, byte [ebp - 0x33921a2c]
cmp al, 0x76
xor ecx, dword [ecx]
sub cl, 0x5c
scasd eax, dword es:[edi]
dec ebx
pop edi
push 0xffffffffffffffdf
outsd dx, dword [esi]
test dword [esi + 0x4dd49ed6], edi
pop edi
dec esp
mov dh, 0x33
or al, 0x34
add cl, dl
jg 0x946525c
int 0x1d
dec edx
xlatb
out 0x37, al
rcl dl, 1
push ebx
push eax
xchg ebp, eax
sti
jb 0x9465348
das
test eax, 0xd69cfa38
hlt
adc byte [ebp - 0x48], dh
int3

Function at 0x95f4146
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov eax, ebx
dec ecx
lea ecx, [edx + ecx*8 - 0x5f41d4ee]
inc ecx
xor esi, 0xba85e23d
push eax
inc ecx
movsx edx, bx
inc ecx
dec esi
dec eax
neg eax
inc ecx
not esi
inc ecx
neg ebx
dec ebx
lea edi, [edx + edx*2 + 0x253c4b17]
inc ecx
rol esi, 3
dec ebx
lea ebx, [edx + ebx*2 - 0x136015f1]
dec esi
mov dword [esp + edx*2 - 0x103041f4], edi
inc cx
dec ebx
dec edx
mov dword [esp + edx - 0x81820fa], eax
inc esi
xor dword [esp + edx*2 - 0x103041f4], esi
ror edx, 0xe3
dec esi
mov edi, dword [esp + edx*2 - 0x103041f4]
movsx esi, cl
dec ebp
arpl si, si
dec eax
cdq
shr ecx, cl
dec ebp
adc eax, esi
inc bx
mov eax, dword [ebp + edx*2 - 0x10304204]
dec edi
lea ebp, [ebp + edx - 0x8182100]
cld
mov ebp, 0x8d4fefcf
lodsb al, byte [esi]
adc eax, 0xf7e7df00
inc edi
movzx ebx, byte [esp + edx*4 - 0x20608408]
dec edi
lea esp, [esp + edx*2 - 0x10304203]
dec edx
mov dword [esp + edx - 0x81820f2], ebx
dec edx
sal dword [esp + edx - 0x81820ff], 0xb2
dec eax
lea ebp, [edx + 0x6ab3d0ad]
inc ebp
xor bl, bh
inc esp
xor bl, dl
inc edx
xor dword [esp + edx - 0x81820f0], ebp
inc esp
sbb bl, dl
inc edx
imul edi, dword [esp + edx - 0x81820ff]
inc dx
adc dword [esp + edx - 0x81820f4], 0xf742340c
pushfd
xchg esp, eax
push es
jl 0x95f41b6
fild word [ecx - 0xa]
fild dword [edx + ebp - 0x26]
shl ebp, 0xf8
call fcn.099002b6
Function at 0x95fb1d9
Capabilities:
Encode data using xor

Disassembly:
dec ebx
dec eax
bts esi, 0xb4
not ebx
dec edx
inc dword [esp + edx*8 - 0x428]
rol ebx, 1
call fcn.099660eb
mov ecx, 0x7d2bdcae
movsx edx, cx
movzx dx, byte [ebp + ecx - 0x7d2bdcae]
mov eax, ecx
mov cl, byte [ebp + eax - 0x7d2bdcac]
lea ebp, [ebp + eax - 0x7d2bdcac]
neg al
push eax
sal dl, cl
lea ecx, [eax + eax*4 - 0x72d23b46]
xor dword [esp + eax - 0x7d2bdc52], eax
mov word [ebp + eax - 0x7d2bdc52], dx
ror byte [esp + eax - 0x7d2bdc50], 0x81
mov byte [esp + eax - 0x7d2bdc52], al
pop edx
lea edi, [edi + edx*2 - 0xa8]
shr dx, 0x28
mov eax, dword [edi + eax - 0x7d2bdc52]
xor eax, ebx
bt edx, 0xba
setb cl
inc eax
call fcn.099ce704
adc byte [esi], dl
fstp dword [ebp + 0x569e84a5]
stosb byte es:[edi], al
mov ss, word [eax - 0x4a]
pop ss
movsd dword es:[edi], dword [esi]
test byte [esi + 0x508eaa56], bl
mov dh, 0x17
inc edx
in al, 0xf0
adc ebx, esi
lodsb al, byte [esi]
adc dword [edx - 0x4f], esp
sti
jno 0x95fb2c0
sbb ebp, ecx
mov dh, ah
fimul word [edi]
jle 0x95fb262
sbb cl, byte [edx + 0x1687c49b]
clc
adc al, 0x70
fidivr word [edx]
push cs
mov esi, 0x5bbd729a
loopne 0x95fb2c0
dec eax
push eax
mov dword [eax + 0x51], ecx
invalid
fisubr dword [edi]
mov dword [ebx + 0x795578de], ebp
mov dword [edx], esi
push esp
and eax, 0xd55ef6aa
and ecx, dword [ecx + 0x5374b731]
xor cl, byte [ecx - 0x4c]
rcr byte [ebp + 0x5f3cc5f4], 1
stosb byte es:[edi], al
pop es
dec ecx
adc al, 0x1e
inc edx
test al, 0xa5
inc esp
push ecx
movsd dword es:[edi], dword [esi]
adc dword [edi], esp
xchg esp, eax
pop ecx
js 0x95fb339
sub byte fs:[eax], 0xfd
fimul word [esi]
push edi
inc ecx
adc ecx, dword [edx + 0x168e66b2]
sbb eax, 0x337c0531
push cs
retf
sub byte [ebp + 0x78], 9
mov dword [0x4b76d0e7], eax
xchg edx, eax
in eax, dx
push 0xbdc47686
sbb byte [ebp + 9], dl
xor dh, bl
fidiv dword [esi + 0x1b]
pop es
pushal
popfd
pop esi
fisttp word [edi + 0x6b75aaef]
cmpsd dword [esi], dword es:[edi]
scasb al, byte es:[edi]
inc edx
add ecx, dword [ebx]
jb 0x95fb344
adc eax, 0xeaeec511
enter 0xffffffffffffc249, 0xffffffffffffffae
wait
dec ebp
fisub word [eax]
jns 0x95fb363
adc ebp, eax
out dx, al
ljmp 0x4d9b
mov dword [0x3ed59c8a], eax
push ss
dec ebx
fistp qword [ebx - 0x31]
or dword [esi], 0xffffffb5
mov ecx, ebx
mov ebp, 0xdb2caaec
or esi, ebp
rcr byte [ecx + 0x68], cl
dec eax
mov eax, 0x7a741e0a
div byte [edi - 0x29]
mov ebx, 0x3352b8f9
xchg dword [0x1904b18b], esp
or al, 0xc5
sub byte [esi - 0x17], ah
dec ebp
invalid
Function at 0x98f7ff0
Capabilities:
Authenticate hmac

Disassembly:
dec esp
mov dword [esp + ebp + 0x205378d7], ebx
inc ebx
mov edx, dword [esp + ebx*2 - 0x10e52]
dec esi
xadd dword [esp + ebx - 0x8729], ebx
inc esi
or dword [esp + ebx - 0x871d], ebx
dec ebp
lea esp, [esp + ebp*2 + 0x40a6f1b2]
dec eax
lea ebx, [ebp*8 - 0x13ff1480]
inc esp
movsx esi, bl
dec edx
xadd dword [esp + ebx - 0x8724], ebx
inc ecx
xor edx, edi
ror edx, 3
dec esp
xchg dword [esp + ebp + 0x205378df], edx
mov eax, dword [esp + ebp + 0x205378d9]
neg edx
or ebx, 0x931bbb0c
rol ebx, cl
inc ecx
sub dl, 0x8c
xor edx, 0xa5a6989b
lea edx, [edx + ebp*4 - 0x3fd7f645]
xor word [esp + ebp + 0x205378e3], 0x3d00
dec esi
mov dword [esp + ebx - 0x8721], edi
dec eax
shl ebp, 0x5c
inc edx
xor dword [esp + ebx - 0x8721], edx
rol bx, 0xa
call fcn.0946f63c

Function at 0x98ff393
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax*2], edx
not ecx
lea ecx, [edx + ecx + 0x2511092]
call fcn.09414e05
sub edi, 4
mov edx, 0xfd0ad009
imul edx, edx
lea ecx, [edx + edx + 0x52a8b682]
mov eax, dword [edi]
bswap ecx
bswap ecx
xor eax, ebx
lea edx, [edx*8 + 0x7909508f]
xor cl, dh
ror edx, 0x42
rol eax, 1
xadd dl, ch
or edx, edx
or edx, ecx
sbb eax, 0xe61a5606
push ecx
not eax
mov dword [esp], edx
inc edx
lea eax, [ecx + eax + 0x1f61680c]
ror dword [esp], cl
bswap eax
and ecx, 0xb237e310
xor ebx, eax
rol dl, 0xe5
adc esi, eax
mov dx, word [ebp]
jmp 0x9605e7e
Function at 0x99827aa
Capabilities:
Encode data using base64

Disassembly:
bts eax, 0x3f
jae 0x99b2e5b
mov edx, 0x890f5286
mov dword [esp], edx
mov cl, byte [ebp + 2]
pop edx
add ebp, 2
shr al, cl
lea edx, [edx + edx*8 - 0x7ecc5ffb]
btr edx, edx
mov word [ebp + edx - 0x52bd86bb], ax
lea edi, [edi + edx - 0x52bd86bf]
ror edx, 0x61
lea ecx, [edx + edx*4 + 0x237100f]
mov eax, dword [edi + ecx - 0x5110e0e0]
xor edx, ecx
neg cl
xor eax, ebx
lea ecx, [edx + ecx*8 - 0x53745478]
xor edx, edx
xadd edx, ecx
ror eax, 1
xor eax, 0xa70e5abe
shr ecx, 0x50
neg eax
bt dx, cx
ror eax, 1
xor ebx, eax
xchg dx, cx
imul edx, ecx
call fcn.099c610c
add byte [eax], al
add byte [ebp + 0x61], cl
jbe 0x9982888
inc ebx
jb 0x998288f
je 0x9982891
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [edi], cl
mov esi, 0x4c8966c2
sub cl, dl
lea edi, [edi + eax - 0x33]
btr edx, 0x20
mov ecx, dword [edi + eax*8 - 0x178]
jb 0x943be64
ror ecx, cl
xadd dl, cl
neg eax
and cx, 0x4310
inc eax
bswap eax
lea edx, [edx + edx*8 + 0x5507c1b6]
add cx, 0x1304
inc cl
not eax
sets dl
shr cl, 0xa2
neg dl
xor eax, 0xdb319f0e
rol eax, 1
call fcn.099ca98b
mov eax, 0x96b64997
sub edi, 4
push eax
lea ecx, [eax + eax + 0x3e168e8e]
mov edx, dword [edi + ecx - 0x6b8321bc]
add byte [esi - 0x74c1e972], cl
xchg esp, eax
cmove ebx, esi
jl 0x9982831
push ecx
dec ecx
xor edx, ebx
shr word [esp + ecx - 0x6b8321b7], 0xae
add dword [esp + ecx - 0x6b8321b9], ecx
lea edx, [edx + eax + 0x665981f6]
ror edx, 2
add ax, word [esp + ecx - 0x6b8321b8]
and byte [esp + ecx - 0x6b8321b7], cl
dec edx
add dword [esp + ecx - 0x6b8321bb], eax
ror edx, 2
sar al, 0x41
xor ebx, edx
xadd byte [esp + ecx - 0x6b8321ba], ch
add esi, edx
mov edx, dword [ebp + ecx - 0x6b83efbb]
mov eax, dword [ebp + ecx - 0x6b83efb7]
sub ecx, dword [esp + ecx - 0x6b83efbb]
call fcn.0944087d
mov edx, 0x2ebecbb5
not dl
mov eax, dword [ebp + edx*2 - 0x5d7d9694]
mov dl, byte [ebp + edx - 0x2ebecb46]
mov ecx, 0x5ba82905
add cx, cx
lea ecx, [ecx + ecx*2 - 0x405dcbdd]
adc ebp, 6
sar ecx, cl
call fcn.0996d606
xor ecx, ebx
ror ecx, 2
sar edx, 0xc1
ror eax, 0x3d
inc ecx
sar eax, 0xd9
call fcn.098ff393

Function at 0x998d15d
Capabilities:
Encode data using xor

Disassembly:
dec ebp
arpl bx, bx
inc cx
ror esi, 0xe7
xadd si, di
dec eax
mov dword [esp + edx*2 - 0x1d602], edx
dec ebp
add eax, ebx
dec ecx
mov ebx, dword [ebp + edx*2 - 0x1d602]
inc esp
mov esi, dword [edx + ebx - 0xeb01]
dec ebp
lea ebp, [ebp + edx - 0xeafd]
dec eax
lea ecx, [edx*4 + 0x52c95a7]
not word [esp + edx*2 - 0x1d600]
inc ebp
mov dword [ebp + edx*2 - 0x1d602], esi
add edi, dword [esp + edx - 0xeb00]
call fcn.09416bc3
xchg eax, esi
xor byte [esi], bh
lcall 0x3e30, 0xf087ffa8
cmpsd dword [esi], dword es:[edi]
rol dword [edx - 0x76425d22], cl
push 0xffffffffffffffd6
jg 0x998d1a4
push ss
pop edx
cmpsd dword [esi], dword es:[edi]
cli
jb 0x998d1ad
mov ecx, 0x5c2614ce
jmp 0xcd8c8c58