joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bdd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab055
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x523168]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x30], 0
push str.var_app_if___app___app___if___app.navigator___app.navigator___if___app.navigator.geolocation___app.navigator.geolocation____function_____app.navigator.geolocation.getCurrentPosition__function_success_error___t_native_function_getCurrentPosition_______return_getCurrentPosition_success_error_________
lea ecx, [ebp - 0x28]
call fcn.00403ab0
mov dword [ebp - 4], 0
push 0x18
call fcn.004a6384
add esp, 4
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x38], 0
je 0x41be52
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push 0
call fcn.0041c200
mov ecx, dword [ebp - 0x38]
call fcn.0041d9e0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x3c], eax
jmp 0x41be59
mov dword [ebp - 0x3c], 0
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 0
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x74]
call fcn.00407170
mov byte [ebp - 4], 2
push 0
push str.v8_app
lea ecx, [ebp - 0x68]
call fcn.004071b0
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
mov eax, dword [ebp - 0x48]
push eax
call fcn.0041c250
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.0045d1d0
add esp, 0xc
mov byte [ebp - 0x29], al
movzx eax, byte [ebp - 0x29]
test eax, eax
jne 0x41beb9
mov dword [ebp - 0x40], 1
jmp 0x41bec0
mov dword [ebp - 0x40], 0
mov cl, byte [ebp - 0x40]
mov byte [ebp - 0x2a], cl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x68]
call fcn.004079e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x74]
call fcn.004079e0
movzx edx, byte [ebp - 0x2a]
test edx, edx
je 0x41bf63
call fcn.0041ca10
cmp eax, 1
jle 0x41bef2
jmp 0x41bf45
push str.Cef_register_extension_failed.
push 1
push 0x8b
push str.d:jenkins_slaveworkspacemusicfab_us_win_x86_build_releasemusicfab_usmainqcef_srccefQCefRenderHandler.cpp
lea ecx, [ebp - 0x124]
call fcn.004589c0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x30]
or ecx, 1
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x50]
call fcn.00405220
push eax
call fcn.00406810
add esp, 8
push eax
lea ecx, [ebp - 0x31]
call fcn.00403c00
mov ecx, eax
call fcn.00403eb0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
and edx, 1
je 0x41bf63
and dword [ebp - 0x30], 0xfffffffe
lea ecx, [ebp - 0x124]
call fcn.00458ec0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401980
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a6347
mov esp, ebp
pop ebp
ret
Function at 0x596c30
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec esp
adc esp, esi
inc ecx
shl ebp, 0x3b
dec esp
mov dword [esp + edx*8 - 0x56512d68], ebx
je 0x9d40a3
bswap edx
pop edx
xor eax, ebx
shl dx, cl
bswap eax
sbb edx, edx
bts edx, ecx
adc eax, 0xd690f6ad
bswap eax
btr edx, edx
sal ecx, 0xe
adc eax, 0x97ab159a
sal ecx, 0x3b
shr dx, 0x68
add dl, ch
neg eax
rol ecx, 0x7f
ror eax, 2
sar dx, 0xaa
not eax
bt ecx, edx
call fcn.00b6c90d
dec ecx
mov ecx, dword [esi + edi - 0x7ea00420]
inc ecx
push edi
inc esi
mov bh, byte [edi + esi - 0x7ea00418]
inc ecx
pop esi
push edx
dec eax
lea edi, [edi + edx*2 - 0x15944b50]
dec ecx
btr ebp, edx
inc esp
mov byte [edx + ecx - 0xaca25ad], bh
inc ebp
movsx ecx, bp
dec esp
mov dword [esp + edx*2 - 0x15944b5a], esp
ret 8

Function at 0x5a4152
Capabilities:
Encode data using xor

Disassembly:
rol edx, 1
push ecx
btc eax, ecx
lea eax, [eax*2 - 0x34d44b51]
bswap edx
sub eax, ecx
neg edx
shl al, 0xc5
setns byte [esp]
cmova eax, dword [esp + 4]
xor edx, 0x9b190aa3
or word [esp + 5], ax
sar dword [esp + 4], 5
xor ebx, edx
add edi, edx
mov edx, eax
pop eax
mov eax, dword [esi]
dec word [esp + 1]
mov ecx, dword [esi + 4]
call fcn.007caaf0
mov eax, 0x40a44e07
movsx ecx, ax
mov eax, dword [eax + esi - 0x40a44e07]
ror cl, 0x45
mov edx, ecx
call fcn.00a20be9
neg dx
mov dword [esp + ecx - 0x7801ff48], ecx
not dx
dec dx
neg dx
shr eax, cl
pop ecx
neg eax
dec dx
pop eax
xor bx, dx
mov ecx, 0xcc9a7734
lea ebp, [ebp + eax - 0x7801ff4e]
ror eax, 0xc1
shr al, 0xe6
shl al, 0x65
mov word [eax + ebp - 0x3c00ff40], dx
add ecx, eax
ror cl, 0x85
je 0x5a2d4f
pop edx
pop eax
jb fcn.005aabfd
not dx
inc ecx
xadd al, cl
xor dx, 0xe096
neg eax
jb 0x880294
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov ecx, 0xa0ad9c2c
or ecx, 0xfbbf20c
inc cx
jo 0x5378de
adc dx, 0x3a25
bt eax, eax
pop ecx
push eax
xor bx, dx
xchg dword [esp + ecx*2 - 0x2d2169c0], ecx
bt eax, 0x8f
sbb esi, 1
mov word [esi], dx
not dword [esp]
pop edx
jmp fcn.00602b9d

Function at 0x5bf986
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx*2 + 0x433b11a4]
setns byte [esp + edx - 0x488a8c12]
inc eax
push edx
not eax
xor dl, 0x34
lea ecx, [edx + edx + 0x23a12490]
mov dword [esp + edx - 0x488a8c1e], edx
xor eax, 0x1cbcf9bf
xor ebx, eax
sal byte [esp + edx - 0x488a8c1e], 0x44
or dl, 0x35
adc ebp, eax
add word [esp + edx - 0x488a8c30], cx
sar edx, cl
rdtsc
not ecx
sal cx, 0xa
shl ecx, 0x76
lea esi, [esi + ecx - 8]
setae byte [esp + ecx*2 + 3]
mov dword [esi + ecx + 4], eax
mov dword [esp + ecx*2 + 0xc], ecx
sub word [esp + ecx + 5], cx
mov eax, 0x43335d8f
mov dword [eax + esi - 0x43335d8f], edx
xor byte [esp + ecx + 9], cl
sub dword [esp + ecx*2 + 0xc], 0xa40c2f19
pop eax
pop eax
pop ecx
pop eax
jne fcn.00602b9d
bt di, di
movzx edi, byte [eax + edi*8 - 0x50218c10]
jae 0x8e21fc
mov ecx, dword [esp + ecx - 0xd4d]
call fcn.0089ae4f
xor edi, edx
call fcn.0060a111

Function at 0x5cf081
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0xa31c4fa3
sar dword [esp + 4], 0x16
jp 0x75fe07
jbe 0x9190cc
add cl, dl
sbb cl, dh
xor ebx, eax
not dx
add esi, eax
mov dword [esp + ecx - 0x63feb17], esi
ret
Function at 0x5da77c
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg eax
bswap eax
not eax
bt dx, cx
mov dword [esp + edx - 0x6000], ecx
rol eax, 1
sal ecx, 0xb6
xor ebx, eax
add byte [esp + ecx - 0x1bbffffe], cl
dec cl
ror ecx, cl
adc edi, eax
shl cx, 0xa8
shr byte [esp + edx - 0x6000], 0x44
inc byte [esp + edx*8 - 0x2fffd]
mov dword [esp + edx*8 - 0x30000], edi
ret
mov dword [esp], 0xa7859603
mov esi, dword [esi*4 + 0x7895d8]
jmp 0xb6dd1c
neg ecx
call fcn.0080487c
mov ecx, 0x5135bd12
lea edx, [ecx*4 - 0x16f409df]
call fcn.00ae7c47
mov edx, 0xac1a55b9
mov ecx, dword [edi]
add edi, 4
movsx eax, dx
call fcn.00ae62be
mov ecx, 0xb33ae58b
sub esi, 8
inc cl
mov dword [esi + 4], eax
shr ecx, cl
jb 0x5c90bb
jae 0x5e628e
mov ecx, 0x57a59187
add ecx, ecx
jnp 0xa7d7a1
sbb esi, 4
jmp 0x6b47c1
call fcn.00a676b1
mov eax, 0xa10b1016
rdtsc
jmp 0x8c26da

Function at 0x5e2657
Capabilities:
Authenticate hmac

Disassembly:
ror ecx, 3
bswap ecx
xadd al, dl
lea ecx, [eax + ecx - 0x683c898c]
jns 0x8bc121
add al, 0x2f
xor ecx, 0xd23e20e
not ecx
mov dword [esp + edx - 0x40178d00], eax
xor ecx, 0x6e03a59a
xor ebx, ecx
add esi, ecx
lea edi, [edi + edx - 0x40178d04]
mov eax, dword [edi + edx - 0x40178d00]
xor eax, ebx
lea ecx, [edx + edx + 0x129700b7]
inc eax
or byte [esp + edx - 0x40178cff], 0xb0
neg byte [esp + edx - 0x40178cfe]
ror eax, 1
bswap eax
bts ecx, 0x11
not eax
bt ecx, edx
xor ebx, eax
lea ebp, [ebp + edx - 0x40178d04]
shl edx, 0xbb
shr dword [esp + edx], cl
not cx
mov dword [edx + ebp], eax
sbb dword [esp + edx], edx
pop ecx
jnp fcn.006143c7
rol ecx, cl
btc ecx, 0x2e
lea edi, [edi + edx - 0x322a]
xadd cl, ch

Function at 0x654b5c
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x6b837412
lea esi, [esi + edx - 0x6b837416]
add dx, dx
push edx
mov edx, dword [esi + edx - 0x6b83e824]
mov ecx, 0xac2a0993
movsx eax, cx
lea ecx, [eax + ecx*4 + 0x11806ebc]
xor edx, ebx
add eax, dword [esp + eax - 0x993]
rol al, 0xa3
and cl, cl
rol edx, 1
bswap edx
cbw
not edx
shl ecx, cl
neg byte [esp + eax - 0x6b83ffbd]
rol edx, 1
xor ebx, edx
mov dword [esp + eax - 0x6b83ffb9], 0x1026ee16
call fcn.00626ec9
imul esi, dword [edx + 0x3c], 0xc991aece
pushal
pushal
aaa
stosd dword es:[edi], eax
or byte [esi + 0x572f6333], dl
jle 0x654b61
daa
add dword [esi - 0x53], ebx
rol dword [ecx + 0x49], 1
xchg ebp, eax
push ecx
call 0x2d102731
push esi
pop eax
mov esi, 0xc3c78902
shr ah, 1
cmp al, byte [eax - 0x57]
inc edi
jbe 0x654bea
pop eax
mov edx, dword [ebx + 0x3f5446ba]
push esp
aas
sub edx, dword [eax + 9]
adc ah, byte [esi - 0x5f]
mov al, byte [0xd572aea]
cld
sub dword [edx], esp
cmp byte [esi - 0x39], bl
popfd
movsd dword es:[edi], dword [esi]
or ebp, edx
popal
mov bl, 0x59
pop eax
insd dword es:[edi], dx
adc dword [edx], esp
pop esi
sar eax, 1
xchg esi, eax
push edi
or eax, 0x74c54df8
invalid
Function at 0x68c7d1
Capabilities:
Packed with generic packer

Disassembly:
movzx edi, byte [eax]
xor edi, edx
mov dword [esp], 0x93992f0a
not word [esp]
xor dword [esp], 0xa937ad25
and edi, 0xff
ror dword [esp], 0x49
sub byte [esp + 3], 0x3d
mov edi, dword [edi*4 + 0x834e2c]
shr edx, 8
sar word [esp], 0x27
sbb dword [esp], 0x3bac28ae
je 0x9add76
xor edx, edi
inc eax
xor edx, 0xc98e4f32
call fcn.00a01471

Function at 0x6957e7
Capabilities:
Encode data using xor

Disassembly:
and edx, eax
or al, dl
xor ebx, ecx
not dl
add edi, ecx
mov ecx, dword [ebp]
mov edx, dword [ebp + 4]
mov dword [esp], eax
inc dword [esp]
xchg word [esp], ax
add ebp, 4
bt ax, 0x3b
or word [esp + 2], ax
shr word [esp], 0xa9
not ecx
jbe 0x836e6e
sar eax, 0x8a
not edx
xor eax, dword [esp]
call fcn.00a2bba1
Function at 0x6b47ef
Capabilities:
Encode data using xor

Disassembly:
sub dl, 0xa
sal eax, 0x30
or cx, ax
dec ecx
xor dl, 0x88
push ecx
shr eax, cl
sbb dl, 0x94
pop ecx
neg dl
ror cl, cl
lea ecx, [ecx + ecx + 0x2800c6a6]
xor bl, dl
mov dword [esp + ecx - 0x4817cec4], 0x94bec3a4
push eax
lea ebp, [ebp + ecx - 0x4817cec8]
sar ecx, 0x93
mov dword [ebp + ecx*4 - 0x2408], edx
lea ecx, [ecx*8 - 0x5b49fc5e]
ror ecx, 0xa7
pop eax
pop edx
jns fcn.008d459f
mov ecx, 0x93336910
shl ecx, 0xa9
lea edi, [edi + ecx - 0x66d22004]
mov eax, ecx
jns 0xa1fa49
call fcn.00affb18
hlt
mov edx, dword [edi + ecx - 0x66d22000]
cmovne ecx, eax
neg ecx
xor edx, ebx
add ecx, ecx
neg edx
sub edx, 0xfb21dd18
rol edx, 1
sub al, 0x81
setb al
sbb edx, 0xba11c2ab
xchg edx, eax
rol byte [ecx + 0x11c2abda], 0xba
xchg cx, ax
inc eax
xor ebx, edx
not ecx
add esi, edx
xor eax, eax
sbb eax, ecx
rol cl, 2
lea edi, [edi + eax*2 - 0x64b64005]
movzx ecx, byte [edi + eax - 0x325b2002]
jne 0xa3d193
or al, 0xcc
and bh, bh
xchg edx, ebp
das
mov dl, 0x70
mov eax, dword [0x1d6e013f]
and byte [ebx - 0x32], bh
xchg ecx, eax
or ebp, ebp
mov byte [ebp - 0x148d8ebc], cl
jge 0xa1fa66
outsd dx, dword [esi]
push es
pop ebp
loopne 0xa1fa46
jle 0xa1fb22
xchg edi, eax
pop ss
outsd dx, dword [esi]
sub cl, byte [ebx - 0x2efa8034]
sub al, 0xea
nop
insd dword es:[edi], dx
mov bh, byte [esi]
xlatb
push cs
dec esp
invalid
inc edx
or edi, dword [edx + 0x41960b04]
pop es
inc esi
test edi, edi
jnp 0xa1fb6d
sub ecx, edx
into
pop ebx
adc eax, 0x289e7895
les ebx, [0xfef85af4]
xor byte [edx + eax - 0x3a], dh
add al, 0x1b
dec ecx
cmpsb byte [esi], byte es:[edi]
lahf
nop
loop 0xa1fb56
imul edi, dword [edx - 0x65], 0x16
hlt
fisttp word ss:[esi + 0x4c71425f]
xchg esp, eax
inc esp
mov ecx, 0xb16ca7af
sub dword [edx], edx
jl 0xa1fbc5
push ebx
mov ecx, dword [ebx - 0xf]
das
ret 0x3a7e
mov dword [ebp + 0x22d26d95], ebx
mov ebp, dword [eax - 0x5b6109d1]
mov cs, word [esi - 0x4d]
add ah, byte [eax]
iretd

Function at 0x6cfe6f
Capabilities:
Encode data using xor

Disassembly:
btc edx, 0x26
xor cl, 0x89
or edx, 0x29aec023
mov dword [esp + eax*4 + 4], edx
mov dword [esp + eax + 8], 0xdc095d1d
xor bl, cl
lea edi, [edi + eax*2 - 2]
mov dword [esp + eax*4], edx
mov word [edi + eax], cx
lea ecx, [eax + edx + 0x1a14e427]
not cx
ror dword [esp + eax*4 + 0xc], 0xca
pop edx
pop eax
pop ecx
pop eax
jb fcn.00653ab1

Function at 0x6da0b3
Capabilities:
Encode data using xor

Disassembly:
das
add bh, dh
neg edx
inc ebp
movzx eax, bh
neg edx
inc ebp
movzx eax, bh
inc ecx
bswap ebx
inc edx
neg dword [esp + edi - 0x43419413]
ror edx, 1
not edx
inc edx
inc dword [esp + edi - 0x43419413]
inc ecx
inc edi
dec esp
mov dword [esp + eax - 0x400000b8], edx
inc cx
ror ebx, 3
xor dword [esp + eax - 0x400000b8], edx
dec esp
mov dword [esp + eax - 0x400000c0], eax
inc ax
dec esi
mov edx, dword [esp + edi - 0x43419417]
dec ecx
sar edi, 0x8a
inc esi
xchg dword [esp + edi*2 - 0x21a0ca], eax
dec eax
arpl dx, dx
dec edx
sub dword [esp + edi - 0x10d065], eax
inc dx
and dword [esp + ecx*2 - 0x1cf], 0x4166d930
add ebx, 0x134cbebc
loop 0x6da0b1
fadd dword [edi + ecx - 0x49]
invalid
Function at 0x6dc851
Capabilities:
Execute syscall

Disassembly:
mov dword [esp], edx
sal dx, 0xc7
rol eax, 2
shl ecx, cl
or ecx, ecx
lea eax, [edx + eax - 0x51f252d0]
lea ecx, [ecx*8 + 0x4024311b]
setl byte [esp + 2]
shl dword [esp], cl
xor ebx, eax
pop ecx
add ebp, eax
push edx
neg ecx
mov ax, word [edi + ecx - 0x68000000]
jne 0x83b7dc
dec esp
adc esp, eax
inc cx
add edi, 0x334d9b0f
fadd qword [ecx - 1]
jecxz 0x735a0d
xor dword [esi], 0xffffff9b
retf
invalid
push edx
mov cx, word [esi + ecx*2 - 0x4c1189fc]
neg word [esp + edx + 1]
bt edx, 0xa8
add edx, dword [esp + edx]
lea esi, [esi + edx*8 + 6]
push edx
neg dl
mov word ss:[eax + edx], cx
lea eax, [edx + edx*2 + 0x7c28249b]
adc dword [esp + edx], ebp
ret 4
neg edx
lea edi, [ecx + edi - 0x67fffffe]
lea esi, [esi + edx*2 - 0x1cd01]
movzx ecx, byte [ecx + esi - 0x68000000]
jg 0xb1c07b
lea eax, [eax + ecx*2 + 0x73013f9c]
xor ebx, edx
or ax, 0xf93f
not ecx
rol ecx, cl
adc ebp, edx
shr cl, 0x27
movzx edx, cl
mov eax, dword [esi + ecx - 0x2608c500]
jbe 0x7dd9ac
xor dx, ax
xor ebx, ecx
bts edx, edx
add esi, ecx
movsx ecx, al
ror cl, 0x85
jmp esi
xor cl, bl
shl dl, 0x66
sbb cl, 0x82
ror cl, 1
dec edx
xadd dword [esp + edx - 0xe5ff], edx
xor cl, 0x90
lea edx, [edx + 0x2512843f]
inc dword [esp + edx - 0x25119dbf]
sub dl, dl
dec cl
xor edx, 0xca9b49bd
xor bl, cl
lea ecx, [esp + ecx + 4]
push edx
shl edx, 0x1f
mov word [ecx + edx - 0x80000000], ax
not dword [esp + edx - 0x7ffffffe]
call fcn.007aaea1
dec eax
add esi, esp
inc ecx
mov ebx, ebx
inc ebp
xchg cl, bl
inc ecx
push ebx
inc sp
mov dword [esi + ecx*2 - 0x176], edi
mov eax, dword [ecx + ebp - 0xbb]
dec eax
lea ebp, [ebp + ecx - 0xb7]
dec ebp
add ebx, esi
dec ebx
lea ecx, [ebx + esi*8 - 0x44624e72]
inc ecx
xor eax, edx
inc esp
or byte [esp + 5], cl
dec eax
pop ebx
dec cl
inc ebp
btr ebx, esi
bswap eax
inc edx
lea eax, [eax + ebx*2 - 0x71911867]
inc ecx
btr esi, 0x97
inc ebp
or cl, cl
ror eax, 2
inc ebp
movsx eax, cx
inc edx
lea eax, [eax + ebx - 0x67b64bc9]
inc ebp
movsx ebp, ax
ror bx, 0xe5
rol eax, 2
inc ecx
movzx edx, cx
inc ecx
push edx
dec esp
xadd edx, esi
inc cx
sal ebp, 0xef
inc ebp
mov edi, ebp
inc edx
xor dword [esp + esi - 0xb6b0], eax
dec esi
lea edx, [ecx*4 + 0x2c9ffe35]
inc ecx
pop edx
inc ecx
or edx, eax
dec ecx
shr ebx, cl
dec eax
arpl ax, ax
bt dx, dx
jae 0x7359cd
mov ecx, dword [esi + ecx - 0x77a7d0ae]
mov edx, 0x8684fc04
add esi, 8
mov dword [eax], ecx
movzx eax, dx
mov ecx, 0x2c1c1488
cdq
mov ecx, dword [edi + eax*8 - 0x7e020]
lea edi, [edi + edx + 4]
sub dword [esp + edx*2], edx
cdq
cwde
xor ecx, ebx
rol eax, 0x28
lea ecx, [ecx + edx*8 - 0x630b28bf]
neg edx
and al, 0x1d
not ecx
shl ax, 1
sbb dx, 0xcea3
dec eax
ror ecx, 1
bswap ecx
sal dword [esp + edx - 0x315d], 0x41
cwd
shl dword [esp + edx], 0x56
xor ebx, ecx
add dl, byte [esp + edx*2]
bts dx, ax
cwde
adc ebp, ecx
or al, ah
movsx ecx, al
bts dx, 0x93
mov dword [esp + edx*8 - 0x1040], ebp
ret
Function at 0x6e6c24
Capabilities:
Encode data using xor

Disassembly:
not eax
sar dl, 0x44
ja 0x71480f
dec dword [esp + edx - 0xc99d3f8]
xor eax, 0x409343a0
xor ebx, eax
xchg dword [esp + edx*4 - 0x32674fec], ecx
add ebp, eax
call fcn.0066ad49
mov eax, 0x4902990d
mov ecx, eax
movsx edx, cl
mov ecx, dword [eax + esi - 0x4902990d]
ror eax, 0x5a
lea esi, [eax + esi - 0x40a6434e]
not dl
call fcn.009d8198
fidiv dword [ebx]
mov edi, 0x2be8d2f6
adc eax, 0x33da002f
xor edi, eax
clc
inc dword [eax - 0x4b9260c6]
or byte [0x28dff94], ah
jae 0x6e6c6e
xchg edx, eax
aam 0x7c
adc dword [edi - 0x77098fd4], 0x770f70c9
push ss
adc ch, ah
jo 0x6e6c55
js 0x6e6ca1
push ebp
jo 0x6e6cc8
pop ds
out 0x6e, al
invalid
mov dword [0xcae1c071], eax
jo 0x6e6c65
dec edx
bound esp, qword [ebp + 0x59]
jge 0x6e6c93
jo 0x6e6ce7
xchg edx, eax
xchg ecx, eax
mov edi, 0x107ddc08
or al, 0xcc
sub esp, ebx
lahf
lea ecx, [esi]
cmp edx, dword [eax + 0x65ecc092]
fisttp word [eax + esi*2 - 0x26]
invalid
invalid
ret 0x2143

Function at 0x72c31b
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg eax
mov dx, word [ebp + eax*4]
seta cl
shr cl, 0x24
xor cl, byte [eax + ebp + 2]
and ax, ax
sub eax, eax
push eax
lea ebp, [ebp + eax + 2]
shr dx, cl
mov dword [esp + eax + 4], 0x338ea41c
lea eax, [eax + eax*4 + 0x598084b7]
movzx ecx, byte [esp + eax - 0x598084af]
mov word [ebp + eax - 0x598084b7], dx
sal eax, 0x91
jae 0x5bf996
neg cl
add dword [esp + eax - 0x96e0000], esi
ret 8

Function at 0x753ee8
Capabilities:
Execute syscall

Disassembly:
add cx, 0x27a9
mov dword [ebp + 4], eax
movzx edx, cx
call fcn.00704bab
int 0x2e
push esi
mov esi, 0x26203888
mov esi, dword [esp + esi - 0x26203888]
mov dword [esp], 0xe0641838
call fcn.009b3519
mul ecx
pop ecx
pop ecx
mov dword [ebp], edx
pop ecx
jmp 0x7285fc
Function at 0x762406
Capabilities:
Authenticate hmac

Disassembly:
rol dword [esp + 4], 0xbe
setae byte [esp + 4]
mov edi, dword [edi*4 + 0x683aec]
call fcn.006d4740

Function at 0x768790
Capabilities:
Encode data using xor

Disassembly:
push 0xf615d1ba
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 0xc]
je 0x6608b8

Function at 0x78c6b2
Capabilities:
Encode data using xor

Disassembly:
lea eax, [ecx*2 - 0x73e35b48]
bt dx, 0x15
movzx dx, byte [edx + edi - 0xdf4011c]
and ecx, 0xff2a7f92
jb 0x7f07c4
mov al, byte [edi + 2]
sal ecx, 0x72
mov dword [esp + ecx], 0xe2a99d8e
add cl, 0
lea edi, [edi + ecx + 2]
adc dl, al
call fcn.00838950

Function at 0x7c1ce2
Capabilities:
Encode data using xor

Disassembly:
not cx
dec cx
not dx
or edx, eax
ror cx, 1
sar eax, 0x51
mov dword [esp + eax*2], eax
or dword [esp + eax], edx
adc cx, 0x6588
not edx
not edx
sar word [esp + eax*8 + 1], 0xe1
xor bx, cx
lea esi, [eax + esi - 4]
call fcn.00ad0396
mov eax, 0x83b13491
rol ax, 0xb
mov edx, 0x22b86594
mov ecx, dword [edi + edx - 0x22b86594]
lea edi, [edi + edx*2 - 0x4570cb24]
xor ecx, ebx
call fcn.00b73a9a
ficomp word [ebp + 0x1b]
call dword [ebp + 0x1d6ea319]
cld
pop ebp
mov esp, 0x8f34dc57
mov edx, 0x63e8cb33
sbb eax, 0x5dde003b
sbb edi, edi
xchg ebp, eax
sbb dword [ebx + 0x5dfc1d6e], esp
insb byte es:[edi], dx
xchg ecx, eax
xor dword [ecx + 0x3c], ebp
stosd dword es:[edi], eax
out 0x71, al
sahf
out dx, eax
pop ebx
adc eax, 0x427b026f
xchg edx, eax
outsb dx, byte [esi]
or dh, bh
aad 0x22
jb 0x7c1d2a
xor ch, byte [0xbb2e6a6d]
salc
int1
invalid
Function at 0x7c7af5
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor esi, edx
dec eax
lea eax, [ebx + ebx*2 - 0x796189cf]
inc ecx
mov edi, 0xddb89b3f
bts ax, 0xbc
inc ecx
bswap esi
inc ecx
ror esi, 2
dec esi
lea eax, [ebx + edi + 0x65111794]
inc ecx
neg esi
inc ecx
and eax, 0x1f848ab9
pop ds
inc ecx
movzx ecx, ax
inc ecx
dec esi
inc cx
dec edi
inc ecx
not esi
sal cx, 0x61
inc esp
movsx ebx, al
inc ecx
push edx
sub eax, ebx
inc ebp
adc bh, bl
jge 0x882b51
ror ah, 1
mov eax, dword [0xa480f22f]
dec edi
xchg edi, eax
lea esi, [edx - 0x2a]
fiadd word [esi + ebx*4 - 0x70c745a8]
xchg ebp, eax
in eax, dx
mov edx, 0xed958f38
dec ecx
pop ds
mov esp, 0xc9ee68f4
xchg edi, eax
mov ah, 0xaf
xor al, 0x17
push edi
jo 0x6394e9
scasb al, byte es:[edi]
cmp ebp, dword [ebp - 0x36]
and ch, byte [ebx + 0x21]
push ss
sub dh, byte [ecx]
push eax
push ebx
and byte [ebx + 0x18], bh
jle 0x6394b5
into
adc dword [edi - 0x6b], edi
push ds
jmp 0x63958c
sbb eax, 0xc1061d4a
invalid
shr dword [0xcb21fdd], 1
jl 0x6395b4
shr byte gs:[edi], cl
shr byte [edi], cl
das
sub dword [ebx - 0x74], ecx
jae 0x639552
jbe 0x639540
inc esi
push ds
inc ebx
mov byte [ecx - 0x38], al
cli
or ebx, eax
dec dh
ja 0x6395e7
js 0x6395ac
adc ebp, dword [esi - 0x62]
hlt
and ecx, 0x23
leave
daa
xchg edi, eax
sti
sahf
test byte [eax - 0x51], 0xa7
dec eax
scasd eax, dword es:[edi]
cmpsd dword [esi], dword es:[edi]
sbb al, 0x2e
jnp 0x639582
movsb byte es:[edi], byte [esi]
inc ecx
shl dword [esi + 0x35], cl
outsd dx, dword [esi]
fiadd word [esi - 0x47d410c3]
sbb eax, 0x51f090d4
pop ebp
sub bl, cl
les esp, [esi - 0x11]
add cl, dh
sbb ebx, dword [esi - 0x3a365281]
xchg esp, eax
test dh, cl
pushfd
jg 0x63955d
leave
lds edx, [esp + eax*4 + 0x7c9e4ece]
mov dword [0x4195fa6f], eax
into
dec esi
sahf
jl 0x63955c
outsd dx, dword [esi]
cli
xchg ebp, eax
inc ecx
stc
cmc
jo 0x6395d3
sar byte [ebx - 0x6f], 1
lodsb al, byte [esi]
xor al, 7
pushal
adc dword [eax - 0x7798f153], ebx
jp 0x639598
enter 0xffffffffffffdaff, 0x29
fisubr dword [ecx]
xlatb
xor dword [edx + 0x14], eax
push ss
mov esi, 0xf5a1323c
cmpsd dword [esi], dword es:[edi]
ror cl, cl
call 0xda0be8c4
jle 0x63958b
xchg esi, eax
imul ebx, dword [esi], 0x71
add eax, 0x5e597953
in eax, dx
inc edi
jg 0x63958c
out dx, eax
push ebp
mov ecx, gs
pushfd
cmpsb byte [esi], byte es:[edi]
sbb edx, dword [esp + ebx*8 - 0x30a0706d]
insd dword es:[edi], dx
xor al, 0x5c
test dword [edi + 0x49], 0xb537f3bd
fld qword [ecx + 0x20b8872b]
faddp st(5)
add al, 0xc9
mov al, byte [0xce503b27]
sbb al, 0xcc
inc ecx
popfd
inc eax
cmpsb byte [esi], byte es:[edi]
add dword [esi - 0x3d], ebp
std
mov dword [0x9d2a861a], eax
pop eax
cmp eax, 0x583e7829
salc
into
pop esi
cmc
mov ecx, 0x3ec701a6
in al, dx
cmpsd dword [esi], dword es:[edi]
salc
invalid
shl al, 0x63
mov edx, dword fs:[ecx + edx*4 - 0x41c00000]
mov dword [ebp], edx
shl ax, 0x42
add byte [esp + 1], 0x81
movzx ecx, ax
mov dword [esp + ecx*8 - 0x6b400], edi
ret
lea esi, [esi + ecx*2 - 0x433c4220]
sar ecx, cl
ja 0x64f89f
push ecx
xor eax, ebx
call fcn.0063233b
inc esp
mov esi, dword [ebp]
mov ebx, 0x951e6cab
dec eax
add ebp, 4
jmp 0x639487