joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e33a6
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x63
rol ecx, 0x7c
sar dword [edi + ebp*4 + 0x46], 0x95
sar dword [edi + ebp*4 + 0x46], 0x95
jae 0x5e33a3
imul eax, edx, 0xcabe668d
push es
cli
je 0x5e3420
xchg ebp, eax
scasd eax, dword es:[edi]
ret 0x33e3
cmp al, 0xd5
dec edi
cmp al, byte [ecx + 0x7b]
leave
pop ss
pop esi
in eax, dx
dec ebp
invalid
inc eax
and byte [ebx + 0x25], 0x97
mov dh, 0xe
cmp al, 0xc8
adc byte [0xb9033b25], cl
salc
daa
fnstsw word [ebp + 2]
test dword [ebp + 0x311555e5], esi
xor ah, 0xe7
dec eax
sbb byte [edx], dl
shl byte [0x924990a4], cl
sal dword [ecx + edi*2], 0x77
invalid
jg 0x5e33be
test al, 0x1e
outsd dx, dword [esi]
dec eax
in eax, dx
xor dh, ch
and dh, byte [eax + 0x1bd3433f]
mov dh, 0x6f
and eax, 0x3daf488e
fldenv [eax + 0x17]
jle 0x5e33f5
sub eax, 0xdd18d37a
wait
xchg dword [esi + ecx*8 + 8], eax
mov eax, 0x4ee7ffda
outsb dx, byte [esi]
mov al, 0xe3
mov eax, dword [0x48480f3f]
push cs
jp 0x5e34a2
out dx, eax
xchg edi, eax
xchg ebx, eax
mov ch, 0xd8
push ebp
pop edi
lcall 0xc0aa, 0xdb2f06c
mov dword [eax + 0x7f], 0x3dbb5260
mov dl, 0xd4
xchg edi, eax
push ebx
ffree st(3)
push esi
jne 0x5e34f3
lahf
add eax, 0x4b1c36ba
sbb byte [eax + 0x36], 0xe9
popal
mov ebx, 0xd0760270
retf
cmp ch, byte [edi + 0x20]
dec esi
int3
jmp 0xf83c2600
adc al, 0xe2
retf 0x530c
inc edi
shl al, 1
mov edi, 0xc9dce7d7
loopne 0x5e34b7
xlatb
out 0xdc, eax
leave
add bh, cl
push esi
add dl, byte ds:[esi - 0x1139010d]
mov ebx, 0x1269e609
shl byte [ebp + 0x30], cl
mov al, 0xc0
dec ebx
mov dh, 0x53
add dword [ebp + 0x7e], ecx
mov esi, 0x4ba68845
jnp 0x5e34f6
xchg esi, eax
insd dword es:[edi], dx
jno 0x5e359f
dec esi
xor bh, byte [edx + 0x2d398399]
mov ebp, 0x253b6b20
pop eax
pop ecx
or eax, 0x6285257a
int 0x25
mov bh, 0x37
jnp 0x5e34cd
and al, 0x97
jl 0x5e35a9
outsb dx, byte [esi]
cmp al, ch
or esi, ecx
test esi, ecx
pop eax
xor bh, 0xf8
and esi, dword [ebx - 0x10]
aas
out 0xef, eax
or byte [ecx], bl
mov esi, esi
cmp dh, byte [ebx]
lea eax, [ebp + 0x5b]
test ecx, ebp
loop 0x5e35ce
inc edi
mov al, byte [0x62ee4f1a]
mov ebp, 0xd7e7ecb7
add dword [ebx], ebx
xor al, 0xf8
dec esi
jae 0x5e35af
std
imul dword [edi + edi*4 - 0x14]
into
xor byte [edi - 0x1d], ch
sbb al, 0x22
sbb dword [ecx - 0x3c5d9da6], 0x18
jo 0x5e35cc
rol dword [0x85063db2], 0x55
mov es, ecx
push ds
xor al, 0x61
mov ch, 0x19
xor eax, 0x6e29fb1c
test bl, ch
cmp al, 0xc
or byte [ebx - 0x5c07ca0c], bl
stosd dword es:[edi], eax
imul ecx, ecx, 0x71
pop esi
rcl dword [0x3c315028], cl
xor al, dl
lodsb al, byte [esi]
in eax, dx
int 0x50
push eax
cwde
add byte [ebp + 0xf6f9e2e], ah
jns 0x5e356f
inc edi
nop
add dword [edi + 0x73], esi
ficomp word [ebp + 0x55]
jle 0x5e356a
invalid
cmp byte [edi], ah
Function at 0x5eb47e
Capabilities:
Encode data using xor

Disassembly:
call [ebp - 0x2e]
inc esi
aaa
pop ds
push 0xa509cfa1
adc eax, 0x4285d48e
jns 0x5eb4bf
sub byte [ecx - 0x74387f01], ch
movsd dword es:[edi], dword [esi]
ja 0x5eb4ad
fadd qword [edx - 0x67]
cmp byte [edx - 0x58d8d573], dh
das
inc esi
adc dword [edi + 0x2c], ebx
mov dword [0x7e4c43ad], eax
push 0xffffffffffffff84
js 0x5eb500
test byte [eax + 0x50], bh
push ds
jo 0x5eb51c
mov bh, byte [edx]
inc ecx
insb byte es:[edi], dx
push ebx
shl byte [ebp + 0x4b026ccb], 1
cmp dh, byte [ebp - 0x2a]
jne 0x5eb497
xor al, bh
sbb dword [edi + 0x3f0cb1e4], 0x954698af
sbb cl, byte [ecx]
inc edi
das
adc al, 0x92
mov esp, 0x57e22d77
mov eax, ebx
and byte [0x4cdbdbc4], bl
mov eax, 0x912ce3c9
or al, 0x36
jp 0x5eb50d
ret
cld
mov ss, word [esi]
jo 0x5eb4d9
std
cmpsb byte [esi], byte es:[edi]
and bl, byte [ecx - 0x7f]
xchg ch, al
das
add dword [esi + 0x64e82fc5], 0xe954cc33
invalid
lds ebp, [edi]
call 0x552ae85f
jmp 0x1cc31ec6
mov bl, 0x46
mov ch, 0x6f
mov edi, 0x7d6eb802
ret 0x939
mov al, 0x57
or esi, dword [eax - 0x7b9cfbfe]
xchg ebp, eax
fmul dword [ebx - 0x46]
paddsw mm4, qword gs:[edx]
ja 0x5eb592
and dh, byte [edi + 0x73]
pop es
imul edi, dword [eax], 0xfffffff4
xor al, 0xa
and eax, 0x4a1c7a7c
mov dl, 0x89
dec esp
in al, 0x68
mov ch, ah
les ebp, [ecx + ebp*2]
dec esi
jno 0x5eb536
jmp [ecx]
sub dword [eax], esp
ja 0x5eb5aa
scasd eax, dword es:[edi]
sub al, 0x5b
jae 0x5eb4f2
ficomp word [eax + esi + 0x15]
xchg dword [ecx], edi
pop ds
push es
xchg ecx, eax
sal dword [esp + ecx*8 - 0x25f33930], 1
lodsd eax, dword [esi]
rcr ah, cl
out dx, eax
ficomp word [edi + 0x64eb7adc]
popfd
sbb bl, byte [edi + 0xc]
aam 0x4b
aaa
xchg byte [ecx], ch
xchg esi, eax
in al, dx
mov dl, 0xbf
ja 0x5eb4f4
add esp, 0x10
ret
adc eax, 0x9cb87e02
sti
invalid
ret
sub dword [eax], edi
cmp eax, dword [edi - 0x7ca3d745]
adc ebp, edx
ror esp, cl
sar dword [esi - 0x648fb87], cl
lahf
pop eax
push es
movsd dword es:[edi], dword [esi]
call 0xcc8f45c3
or eax, dword [edx + 0x68]
jae 0x5eb586
push 0x4c
jnp 0x5eb605
mov ecx, 0xb61ae7f4
cmp dword [ecx - 0x41], 0x66cbb1aa
push es
sub eax, 0x5ceae19c
ja 0x5eb586
wait
xor byte [edx - 0x3668bf68], al
add dword [eax + 0x3e8d7f73], edx
test eax, 0xa6b97d50
xor eax, edx
dec eax
invalid
push eax
push ebx
and eax, 0xfbbed009
add edx, dword [edi - 6]
pop ss
add ch, ah
mov dword [ebx - 0x54], esi
int 0x3b
sbb byte [eax + 0xcc4cb7a], dh
jns 0x5eb5f6
lodsd eax, dword [esi]
lodsb al, byte [esi]
add byte [ebx + 0x76], 0x65
je 0x5eb667
xchg byte [esi + edx + 0x387ecee3], dh
das
dec esp
sub ecx, 0xfffffff9
invalid
popal
fiadd word [esi - 0x6a3c71bf]
sub dword [eax], eax
add edi, esp
push es
invalid
Function at 0x635700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x635710
xor eax, eax
jmp 0x6358ad
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x63586e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x693b38]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x693b38]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x693b38]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x693b38]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x693b38]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x693b38]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x693b38]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x693b38]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x635719
cmp dword [ebp + 0x10], 0
je 0x6358a7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x693b38]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x635874
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret

Function at 0x22d4f53
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl di, cl
and al, 0xfc
dec di
pushfd
clc
sub eax, ecx
push 0x7eb80fa4
movsx di, cl
mov esp, eax
pushfd
lea edi, [eax*4 + 0x201cd6a5]
bswap di
pushfd
pop dword [esp]
bswap edi
movzx di, al
push esi
call fcn.022d4e65
Function at 0x54787c
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
call 0x547eb3
add byte [eax], al
push ebp
outsb dx, byte [esi]
push 0x6c646e61
inc ebp
js 0x5478c1
jo 0x5478d5
imul ebp, dword [edi + 0x6e], 0x746c6946
jb 0x54786b
add byte [eax], al
push ebx
je 0x5478c8
imul ebp, dword [esi + 0x64], 0x6f4c776f
outsb dx, byte [esi]
push edi
add al, ch
call 0x621ede
add byte [eax], al
dec ecx
jae 0x5478ca
imul esp, dword [ecx + 0x6c], 0x654d676f
jae 0x547902
popal
push edi
add byte [eax], al
add byte [edi + 0x65], al
je 0x5478e7
outsb dx, byte gs:[esi]
jne fcn.0054789e
and al, 0xc
dec esp
imul esi, dword [ebx + 0x74], 0x6172445f
ja 0x5478e0
add byte [edi + 0x69], dl
inc ebx
push 0x6f547261
dec ebp
jne 0x547961
je 0x547960
inc edx
jns 0x54796e
add byte gs:[eax], al
add byte [ebx + 0x61], dl
inc cx
inc ecx
jb 0x547977
popal
jns 0x54794b
jb 0x54796f
popal
je 0x547972
add byte [eax], al
add byte [esi + 0x69], dl
jb 0x547988
jne 0x547977
insb byte es:[edi], dx
push ecx
jne 0x54797f
jb 0x547995
add byte [eax + 0x60e89c01], cl
push ebx
push cs
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x547982
imul ebp, dword [esi + 0x64], 0x6c50776f
popal
arpl word [ebp + 0x6d], sp
outsb dx, byte gs:[esi]
je 0x54793a
add byte [eax + 0x23], ah
inc edi
je 0x54798f
jns 0x547995
popal
insd dword es:[edi], dx
push esp
js 0x5479c2
inc ecx
add byte [eax], al
add byte [eax + 0x74], cl
je 0x5479c6
push ebx
outsb dx, byte gs:[esi]
push edx
jno 0x5479d3
jae 0x5479d5
je 0x5479a3
inc ecx
add cl, ch
mov bh, 0xb1
push cs
add byte [edi], cl
and byte [edi + eax], 0
and al, 0x28
mov ecx, 0xf960000d
je 0x5479a5
add al, 0x8d
and al, 0x24
xor bl, byte [edx]
add byte [eax], al
or eax, 0x43000000
popal
insb byte es:[edi], dx
inc ecx
add ah, ah
xor edi, dword [ebp + 0x37dd43e2]
nop
jns 0x5479a2
dec ecx
iretd
invalid
sub esp, edi
pop ebp
fmul st(6)
mov dword [0x8352de19], eax
popal
leave
invalid
push dword [esp]
inc esi
jmp 0x54784b
pushal
xor dl, 0xa9
mov byte [esp], 0x9c
pushal
pushfd
inc dl
clc
push word [esp + 0x48]
popf
jmp 0x54c113
Function at 0x547963
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x547eb3
add byte [eax], al
push ebp
outsb dx, byte [esi]
push 0x6c646e61
inc ebp
js 0x5478c1
jo 0x5478d5
imul ebp, dword [edi + 0x6e], 0x746c6946
jb 0x54786b
add byte [eax], al
push ebx
je 0x5478c8
imul ebp, dword [esi + 0x64], 0x6f4c776f
outsb dx, byte [esi]
push edi
add al, ch
call 0x621ede
add byte [eax], al
dec ecx
jae 0x5478ca
imul esp, dword [ecx + 0x6c], 0x654d676f
jae 0x547902
popal
push edi
add byte [eax], al
add byte [edi + 0x65], al
je 0x5478e7
outsb dx, byte gs:[esi]
jne fcn.0054789e
and al, 0xc
dec esp
imul esi, dword [ebx + 0x74], 0x6172445f
ja 0x5478e0
add byte [edi + 0x69], dl
inc ebx
push 0x6f547261
dec ebp
jne 0x547961
je 0x547960
inc edx
jns 0x54796e
add byte gs:[eax], al
add byte [ebx + 0x61], dl
inc cx
inc ecx
jb 0x547977
popal
jns 0x54794b
jb 0x54796f
popal
je 0x547972
add byte [eax], al
add byte [esi + 0x69], dl
jb 0x547988
jne 0x547977
insb byte es:[edi], dx
push ecx
jne 0x54797f
jb 0x547995
add byte [eax + 0x60e89c01], cl
push ebx
push cs
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x547982
imul ebp, dword [esi + 0x64], 0x6c50776f
popal
arpl word [ebp + 0x6d], sp
outsb dx, byte gs:[esi]
je 0x54793a
add byte [eax + 0x23], ah
inc edi
je 0x54798f
jns 0x547995
popal
insd dword es:[edi], dx
push esp
js 0x5479c2
inc ecx
add byte [eax], al
add byte [eax + 0x74], cl
je 0x5479c6
push ebx
outsb dx, byte gs:[esi]
push edx
jno 0x5479d3
jae 0x5479d5
je 0x5479a3
inc ecx
add cl, ch
mov bh, 0xb1
push cs
add byte [edi], cl
and byte [edi + eax], 0
and al, 0x28
mov ecx, 0xf960000d
je 0x5479a5
add al, 0x8d
and al, 0x24
xor bl, byte [edx]
add byte [eax], al
or eax, 0x43000000
popal
insb byte es:[edi], dx
inc ecx
add ah, ah
xor edi, dword [ebp + 0x37dd43e2]
nop
jns 0x5479a2
dec ecx
iretd
invalid
sub esp, edi
pop ebp
fmul st(6)
mov dword [0x8352de19], eax
popal
leave
invalid
push dword [esp]
inc esi
jmp 0x54784b
pushal
xor dl, 0xa9
mov byte [esp], 0x9c
pushal
pushfd
inc dl
clc
push word [esp + 0x48]
popf
jmp 0x54c113
Function at 0x547c76
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 4], 0xc2
call fcn.006329e8
add byte [eax], al
inc edi
je 0x547cd9
je 0x547cec
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[eax], al
add byte [edi + 0x65], al
je 0x547ce2
outsd dx, dword [esi]
jne 0x547d05
inc esi
imul ebp, dword [ebp + 0x4e], 0x41656d61
add byte [eax], al
add byte [ecx + ebp*2 + 0x6e], cl
push esp
outsd dx, dword [esi]
add byte [ecx + 0x26dde8fe], cl
add byte [eax], al
int 0x36
or byte [ecx - 0x26], ah
cwde
je 0x547ca3
push edx
xchg edi, eax
sbb eax, 0x494a38c8
imul esi, ebx, 0x1c
add eax, 0xb3d0cdb6
add al, 0x1d
enter 0x55e5, 0x18
mov dword [edx], 0x77b5c2
add al, 0xca
mov dh, 0xcd
sal byte [ebx - 0x1a37e2fc], 1
push ebp
sbb bh, al
add al, dl
mov ch, 0x77
add byte [edx + ecx*8], al
stosb byte es:[di], al
xlatb
xor byte [esi - 0x2f], cl
enter 0x3578, 0xffffffffffffffea
and eax, 0x84eaec4c
lcall 0xad9b, 0xc59288d6
jb 0x547d67
sub eax, 0x8e3df995
mov esp, 0xb02368c8
sahf
xchg byte [edx], bh
jae 0x547d6d
invalid
scasd eax, dword es:[edi]
insd dword es:[edi], dx
pop ebx
test byte [edi - 0x4cf0bee5], dh
add byte [eax], al
dec ebp
popal
inc ecx
btr dword [eax], eax
add byte [ebp + 0x61], cl
jo 0x547dcd
imul ebp, dword [esi + 0x64], 0x6f50776f
imul ebp, dword [esi + 0x74], 0xfc00073
test eax, 0x37dd47ce
into
jle 0x547d99
and ebx, dword [edx - 0x34]
sbb ebp, dword [edx + 0x35c98aae]
mov dword [edi], esp
adc byte [ebx + 0x2f69176a], al
sub dword [edx + 0x17], 0x69
das
mov esi, 0x9e07df12
invalid
mov eax, edx
insb byte es:[edi], dx
ja 0x547e28
aas
dec eax
in eax, 0x3a
sbb byte [ebp - 0x6a], 0xb8
fistp qword [ebx - 0x58]
or bh, cl
inc ebx
mov edx, 0x6c7ed504
mov al, 0x38
fstp qword [ebx]
setns bl
sub eax, 0x74bf8961
loop 0x547daa
je 0x547db1
fiadd dword [ebp + esi*8 - 0x11]
inc esp
cmc
out dx, eax
sub al, 0x13
int1
dec edi
mov byte [0xd0d83c3c], al
mov edx, 0x25e1689
dec edx
adc eax, 0xac012b4c
mov byte [0x1773b01d], al
inc ebp
idiv dword [ecx]
mov eax, dword [0xd58ba17e]
stosb byte es:[edi], al
push 0xcbae3843
adc al, 0x36
dec ebp
xchg edi, eax
sub dword [ebx], esp
adc al, 0xa8
sbb eax, dword [esi + esi - 0x1f]
enter 0x30b0, 0xffffffffffffffa1
mov eax, 0xfe1a7cf8
push ebx
sahf
fist word [ebx - 0x5b097a24]
push 0xffffffffffffffb5
pop ss
hlt
push esp
add al, 0x58
out 0xcd, eax
mov eax, 0xeaf3cd70
fmul st(0)
test eax, 0xcb8016ac
cwde
inc ecx
enter 0xffffffffffffc909, 0x47
add ch, bl
push ebp
std
push es
dec edx
push es
sub al, 0x76
jb 0x547e79
jp 0x547e7b
bound ebp, qword [esi]
dec esi
or dl, byte [ecx]
invalid
add al, ch
cmp al, 0x22
add byte [eax], al
Function at 0x549594
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
imul edx, edx, 0xa
call fcn.0062f229
add byte [eax], al
inc esp
jb 0x549606
ja 0x5495fb
js 0x54961e
inc ecx
add byte [eax], al
add byte [edx + 0x65], al
imul ebp, dword [bp + 0x50], 0x687461
add byte [eax], al
push ebx
je 0x54960b
popal
jo 0x54960e
outsd dx, dword [esi]
add byte gs:[esi + 0xf], ah
mov ebx, 0x247a8bf1
call fcn.006340dd
add byte [eax], al
inc ebx
jb 0x54963b
popal
je 0x54963e
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x54963f
je 0x549649
bound ebp, qword [ebp + 0x42]
imul esi, dword [ebp + ebp*2 + 0x61], 0x70
dec ecx
outsb dx, byte [esi]
je 0x549655
jb 0x54965e
outsd dx, dword [esi]
arpl word [ebx + 0x65], bp
inc ebp
js 0x54965d
push 0x65676e61
add byte [eax], al
popal
outsb dx, byte [esi]
add byte gs:[bx + si], al
add byte [edi + 0x65], al
je 0x54965d
imul ebp, dword [esi + 0x64], 0x6552776f
arpl word [eax + eax], si
push edx
arpl word gs:[eax + eax], si
je 0x549610
add byte [eax], al
inc edi
je 0x54965b
add byte [edi + 0x65], al
je 0x54965b
outsb dx, byte [esi]
push 0x6174654d
inc esi
imul ebp, dword [ebp + 0x44], 0x72637365
imul esi, dword [eax + 0x74], 0x416e6f69
add byte [eax], al
add byte [esp + ebp*2 + 0x73], dl
inc edi
insb byte es:[edi], dx
inc esp
jae 0x549687
jb 0x54968f
jo 0x54969c
imul ebp, dword [edi + 0x6e], 0x41
push esp
insb byte es:[edi], dx
jae 0x54967a
je 0x54968c
popal
insb byte es:[edi], dx
jne 0x54969f
add byte [eax], al
add byte [edi + 0x65], al
add byte [eax], al
inc edi
je 0x549691
je 0x549691
jb 0x5496ac
jbe 0x5496a6
je 0x5496ac
push eax
jb 0x5496b9
outsd dx, dword [esi]
imul bp, word [ebp + 0x53], 0x7274
imul ebp, dword [esi + 0x67], 0x8d600041
add byte [eax - 0x73], ah
and al, 0x24
jae 0x62d0c5
cmp cl, byte fs:[esi]
cmp cl, byte [esi]
add al, ch
loop 0x5496e1
call fcn.00621448
add byte [eax], al
push ebx
or eax, 0x53000000
insb byte es:[edi], dx
jo 0x54966e
test edi, edi
jmp 0x62212d
je 0x5496c0
insb byte es:[edi], dx
popal
jae 0x5496f4
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax], si
add byte [eax], al
add byte [ebx + 0x72], al
popal
je 0x5496f5
inc esp
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x5496db
add byte [eax], al
add byte [eax + 0x74], cl
je 0x549711
dec edi
jo 0x549709
outsb dx, byte [esi]
push edx
jno 0x54971e
jae 0x549720
inc ecx
add byte [eax], al
add byte [edi + 0x6c], al
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
dec esp
outsd dx, dword [esi]
arpl word [ebx], bp
imul eax, dword [eax], 0xfffffff9
jmp 0xc7de1f83
bt edi, ecx
ror dword [esi + 0xe4218e9], 0
pushfd
pushfd
mov byte [edi - 1], 0
call fcn.00548145
pushfd
ret
pushfd
push edx
push ebp
lea esp, [esp + 0x44]
je 0x62c22b
push edi
pushal
pushfd
push eax
lea esp, [esp + 0x2c]
jmp 0x62d684
bt dx, 5
add eax, edi
pushfd
clc
cmp eax, edx
jmp fcn.0062f537
Function at 0x549dd8
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
call fcn.0062d595
add byte [eax], al
inc edi
je 0x549e0d
arpl word [ecx + ebp*2 + 0x76], si
push edi
imul ebp, dword [esi + 0x64], 0x8d00776f
lea edi, [edi + 1]
movsx ax, dl
movsx eax, dl
mov eax, dword [esp + 0x54]
mov word [esp], 0x345
jmp 0x62f489
inc esp
jb 0x549e71
dec esp
popal
jbe 0x549e7b
add byte [esi - 0x64], dl
mov edx, edi
sub edi, eax
xchg dword [eax + 0x77], esi
salc
std
cwde
invalid
adc byte [esp + ecx], ah
mov bh, 0x32
jnp 0x549ec5
sahf
std
jecxz 0x549e4d
retf 0x2464
pop esi
xor cl, byte [eax - 2]
add al, 0x34
sahf
lodsb al, byte [esi]
invalid

Function at 0x54bb69
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0062d94a
lea esp, [esp + 0x54]
jne 0x54be73
pushal
pushal
jmp 0x621815
push 0xcdb603e8
mov dword [esp + 0x40], edi
push 0xd3d509db
mov dword [esp + 0x40], ebx
pushfd
lea esp, [esp + 0x44]
call fcn.006233f6
push 0x9e87b1b5
pushal
mov esp, esi
push esi
pushfd
mov word [esp], 0xa299
pushal
lea esp, [esp + 0x28]
jmp 0x62c232

Function at 0x621e37
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
call 0x547eb3
add byte [eax], al
push ebp
outsb dx, byte [esi]
push 0x6c646e61
inc ebp
js 0x5478c1
jo 0x5478d5
imul ebp, dword [edi + 0x6e], 0x746c6946
jb 0x54786b
add byte [eax], al
push ebx
je 0x5478c8
imul ebp, dword [esi + 0x64], 0x6f4c776f
outsb dx, byte [esi]
push edi
add al, ch
call 0x621ede
add byte [eax], al
dec ecx
jae 0x5478ca
imul esp, dword [ecx + 0x6c], 0x654d676f
jae 0x547902
popal
push edi
add byte [eax], al
add byte [edi + 0x65], al
je 0x5478e7
outsb dx, byte gs:[esi]
jne fcn.0054789e
and al, 0xc
dec esp
imul esi, dword [ebx + 0x74], 0x6172445f
ja 0x5478e0
add byte [edi + 0x69], dl
inc ebx
push 0x6f547261
dec ebp
jne 0x547961
je 0x547960
inc edx
jns 0x54796e
add byte gs:[eax], al
add byte [ebx + 0x61], dl
inc cx
inc ecx
jb 0x547977
popal
jns 0x54794b
jb 0x54796f
popal
je 0x547972
add byte [eax], al
add byte [esi + 0x69], dl
jb 0x547988
jne 0x547977
insb byte es:[edi], dx
push ecx
jne 0x54797f
jb 0x547995
add byte [eax + 0x60e89c01], cl
push ebx
push cs
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x547982
imul ebp, dword [esi + 0x64], 0x6c50776f
popal
arpl word [ebp + 0x6d], sp
outsb dx, byte gs:[esi]
je 0x54793a
add byte [eax + 0x23], ah
inc edi
je 0x54798f
jns 0x547995
popal
insd dword es:[edi], dx
push esp
js 0x5479c2
inc ecx
add byte [eax], al
add byte [eax + 0x74], cl
je 0x5479c6
push ebx
outsb dx, byte gs:[esi]
push edx
jno 0x5479d3
jae 0x5479d5
je 0x5479a3
inc ecx
add cl, ch
mov bh, 0xb1
push cs
add byte [edi], cl
and byte [edi + eax], 0
and al, 0x28
mov ecx, 0xf960000d
je 0x5479a5
add al, 0x8d
and al, 0x24
xor bl, byte [edx]
add byte [eax], al
or eax, 0x43000000
popal
insb byte es:[edi], dx
inc ecx
add ah, ah
xor edi, dword [ebp + 0x37dd43e2]
nop
jns 0x5479a2
dec ecx
iretd
invalid
sub esp, edi
pop ebp
fmul st(6)
mov dword [0x8352de19], eax
popal
leave
invalid
push dword [esp]
inc esi
jmp 0x54784b
pushal
xor dl, 0xa9
mov byte [esp], 0x9c
pushal
pushfd
inc dl
clc
push word [esp + 0x48]
popf
jmp 0x54c113
Function at 0x621ede
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x621479
mov word [esp + 4], 0x1ea2
lea esp, [esp + 0xc]
ja 0x62d0ce
pushal
inc ecx
pushfd
dec bl
pushfd
setno bl
inc ecx
dec bl
jmp 0x623692

Function at 0x622016
Capabilities:
Authenticate hmac
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
pushal
mov esi, dword [ebp + 0xc]
mov word [esp + 0xc], di
mov dword [esp + 0x24], eax
jmp 0x62ccfa
mov byte [esp + 0x10], bl

Function at 0x622df5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x28]
jae 0x62c22b
push 0x757ba863
push 0xbb372ac5
push eax
pushfd
lea esp, [esp + 0x10]
jmp 0x62d253

Function at 0x6233f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0062fe0a
or dword [edi], esi
mov bl, 0xdd
xchg ebx, eax
and bl, byte [ebx]
add edi, dword [ebx]
sbb dword [ecx], ebx
das
pop es
pushfd
cld
mov bh, 0xb2
fdivr st(0)
adc al, 0x13
das
cmp al, 0xbe
push ds
jmp 0x6208a6
mov esi, 0x5f4f1cff
inc ecx
cmp al, 0x9a
xlatb
mov ecx, 0x7f876d3e
sub al, 0x86
pop edi
pushfd
sar dh, 0x86
or eax, 0x13ceeffd
imul ebx, dword [edi + 1], 0xc758c847
sub edx, dword [esi - 0x4264b111]
xor byte [ebx - 0x80], cl
xchg dword [edi - 0x54], ebp
push es
mov ecx, dword [esi - 0x76e8b901]
push ebx
int3
sets ah
cwde
sbb ah, dl
dec ah
push ebp
lahf
rcl ah, cl
mov ebp, esp
aaa
xor ah, dh
mov ah, 0x17
sub esp, 0x10
btr eax, 0xa
clc
push esi
rcl ax, cl
push edi
xor ax, 0x8ed8
push ebx
lahf
lahf
clc
neg ax
push edx
stc
stc
mov eax, dword [ebp + 8]
cmc
jnp 0x62087f
stc
test eax, eax
pushal
lea esp, [esp + 0x20]
je 0x62c22b
sbb dx, 0x2281
rcr dl, cl
pushal
neg dl
mov esi, dword [eax + 0x3c]
movzx edx, bl
xor dh, 0xdd
add esi, eax
neg dh
dec dl
cmp al, 0x32
shr dl, 6
mov edx, dword [esi + 0x78]
clc
push esp
bt bx, di
test edx, edx
call fcn.00547c76
add byte [eax], al
inc edi
je 0x6234b7
outsd dx, dword [esi]
jb 0x6234d9
jb 0x6234e6
jne 0x6234e7
push edi
imul ebp, dword [esi + 0x64], 0x776f
add byte [ebx + 0x72], al
popal
je 0x6234ee
push ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
imul esp, dword [edx + eax*2 + 0x72], 0x687375
add byte [eax], al
push edx
popal
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x656c6150
je 0x623517
add byte gs:[ebp - 0x1cc71701], al
invalid
dec edi
inc edx
jb 0x623551
jae 0x623546
dec edi
jb 0x623548
inc ebp
js 0x6234e4
pushfd
lea esp, [esp + 0x50]
and al, 0x50
and al, 0x50
ja 0x547ec4
invalid
clc
call fcn.00549594
add byte [eax], al
inc edi
je 0x62353e
ror byte [0x99e387a9], cl
test eax, 0xf099e387
shr dword [eax + edx*2 + 0x3b], 0x4b