joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a4170
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + eax - 0x5416ffff], edi
sbb eax, 0x6e9c3729
push esi
ror eax, 0xf0
and eax, 0xc28bff9d
push ebx
movzx ebx, al
xor eax, ebx
mov ebx, edx
mov edx, ebx
xor al, ah
dec al
lea eax, [eax + 0x2390a889]
shl edx, 2
add eax, 0x978369af
mov eax, ebp
add eax, edx
call fcn.005a233c
dec esp
lea edx, [edx + 0xd9e883b]
dec ebp
mov ecx, dword [esi + edx - 0x739d0a90]
inc esp
movzx ebp, dx
inc ecx
push ebp
inc edx
ror dword [esp + ebp*8 - 0x5480], 0xb2
dec esi
mov ebx, dword [edx + ecx - 0x739d0a90]
inc ecx
push ebp
dec edi
mov dword [esi + ebp*8 - 0x5480], ebx
inc ebp
mov esp, edx
inc ecx
push edx
inc esi
mov ecx, dword [esi + ebp - 0xa90]
dec eax
sar dword [esp + edx - 0x739d0a8b], 0xd6
inc ecx
pop ebx
jae 0x630aa0
inc ecx
mov edi, 0x263e160a
dec ebx
lea ebx, [edi + edi*2 + 0x3fb95f27]
inc esi
mov ebx, dword [esi + edi - 0x263e160a]
call fcn.0063e2db
call fcn.00501276

Function at 0x5aadee
Capabilities:
Encode data using base64

Disassembly:
call fcn.005fbcb7
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.005f46ab
mov edx, dword [edi]
jmp 0x4e5513
push esi
pushfd
mov esi, 0x659be7a6
shl esi, 0x85
add dword [esp + 8], 0xffa9e25f
test esi, esi
jbe 0x51b51c
cmp esi, 0xd01df0ad
mov dword [esp + 8], 0x81c723ac
mov esi, dword [esp + 4]
js 0x51b51c

Function at 0x5ae188
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
or eax, 0x5b53c0b1
pop ebx
sub al, 0x6c
jmp [ebp - 0x79]
xchg byte [esi], al
ror edi, cl
push es
push ebx
insb byte es:[edi], dx
xchg esi, eax
retf
invalid
inc ecx
pushfd
xchg ecx, eax
fnstcw word [ebx - 0x356aa8f8]
mov ch, 0xf0
ja 0x531c72
sub al, 0x35
les esp, [ecx - 0x36]
loop 0x531c99
invalid
mov dl, 0xd2
mov ebp, ebp
jns 0x531d66
mov cl, 0xda
out dx, eax
or eax, 0x79202793
shr dword [esi + 0xb], 1
xor dl, byte [ecx + ebp - 0x1db9266e]
mov esp, 0xf1d2426a
dec ebp
popfd
jbe 0x531ca7
push ds
aam 0xeb
outsb dx, byte [esi]
xchg ecx, eax
xchg byte [esi], dh
push 0x32
mov edi, 0xd1043610
outsb dx, byte [esi]
mov ch, 0x69
aad 0x85
sti
xor dword [ebx], esi
loopne 0x531d23
xor dh, cl
jne 0x531d49
jecxz 0x531cb2
xchg dword [eax], ebp
pop ecx
and dword [esi - 0x10722726], edx
sti
ljmp 0xbab8
dec ecx
xchg ebp, eax
call fcn.0056dfce
pushal
dec edi
and dword [esi], esi
jbe 0x531cec
inc esi
cmp eax, 0xca3f5060
fcom dword [eax + edx*8 - 0x3d9426ef]
stosb byte es:[edi], al
dec esp
out 0x71, eax
cmp eax, 0x33b3f352
jno 0x531da5
push edx
mov bl, 0x33
xchg esp, eax
jecxz 0x531d83
je 0x531da9
imul ebp, dword [edi + eax*4], 0xffffff94
dec ebx
cmp eax, 0x943de39a
cwde
in al, dx
int3
nop
lodsb al, byte [esi]
ret 0xd2bb
jmp 0xd3e55156
rcl ecx, cl
mov al, byte [0x961c2d0f]
std
and esp, dword [esi]
mov esi, 0x3c8dbbab
dec edx
add eax, 0x47cea06a
invalid
xor eax, ebx
rol eax, 2
sar edx, 0xab
jnp 0x531d4b
Function at 0x5c4c33
Capabilities:
Encode data using xor

Disassembly:
jno 0x5cbfff
inc ecx
add ah, 0xb8
inc esi
movzx ebx, byte [esp + edi*2 + 0x40]
not ecx
inc cx
rol ebp, 0xc1
dec ebp
and ebx, ebp
dec edx
mov dword [esp - 0x658533bc], ebp
inc dx
rol dword [esp + edi*4 + 0x7b], 0xa3
inc edx
xor dword [esp + edi*4 + 0x88], ecx
pop edx
inc si
mov dword [esp + edi + 0x24], edi
dec edx
mov ebp, dword [esp + edi*2 + 0x48]
dec eax
arpl cx, cx
dec ebp
xadd esp, edx
dec esi
mov dword [esp + edi + 0x2c], esp
dec esp
adc eax, ecx
dec edx
lea edi, [edx*2 - 0x5be8bbcc]
dec esi
mov dword [esp + ebx - 0x20], eax
ret 0x10
add dword [esp], 0xffa06507
push dword [esp + 8]
popfd
lea esp, [esp + 0x1c]
call fcn.005f46ab
adc dword [ecx - 0x4c], 0xffffffde
fstp xword [edx - 0x7e]
jbe 0x5cc031
xor eax, 0x34b168a6
xchg ebx, eax
ret
inc ecx
enter 0x38ce, 0xffffffffffffffc5
ror dword [ecx], 1
dec esi
rcl dword es:[edx - 4], 0x38
sbb eax, 0x4292c341
xchg dword [0xf775116d], esi
xor eax, 0xf775116d
mov edi, dword [0x4bd6bfad]
sbb dword [eax + 0x2f08ae71], ebx
jb 0x5cc025
push ss
sub byte [ecx + 0x44c3ad3b], bl
daa
mov bh, 0xf
sti
leave
test dword [esi + 0x42], esi
sbb cl, byte [0xf3b16f15]
rcr dword [edi + 0xe], 1
pushfd
mov ecx, 0xe12d3e25
fsubr dword [edi + 0x5c]
sar eax, cl
mov dword [esi - 0x39c78050], eax
push edx
mov bl, 0x4f
jb 0x5cc045
add byte [eax], al
add byte [eax], al
sub dh, 0xbb
stosb byte es:[edi], al
sal ebx, cl
cmp bh, byte [esi - 0x28]
mov ebp, 0x8d92fa77
sbb eax, 0xdf00a88e
or dword [ebx + 0x2fee5e57], ebp
pushal
mov dword [eax + 0x5dd5a76b], ebp
out 0x15, eax
add al, 0x20
inc ebp
retf
Function at 0x5d5a95
Capabilities:
Encode data using base64

Disassembly:
inc ecx
ror ah, 0xc1
inc ecx
rol ebx, 1
dec eax
lea edi, [edx*4 + 0x1405828b]
inc cx
shl ebp, 0xc8
inc ecx
bswap ebx
shl di, 0x25
jae 0x5e0371
xor eax, 0xb4ae4598
dec edx
xor ecx, ecx
xor ebx, eax
xchg word [esp + ecx*4 + 5], dx
add esi, eax
call fcn.0069827d
sub ebp, 2
lea edx, [ecx*8 - 0x14d106e2]
xor word [esp + edx - 0x50153dcc], dx
mov word [ebp + edx - 0x50153dce], ax
call fcn.0066f57e
inc esp
movzx ebp, word [esi]
mov ebx, 0xda2fc107
dec eax
add esi, 2
inc esp
mov ecx, ebx
movzx ecx, bx
inc ecx
mov edx, 0x4e92a700
inc sp
xor ebp, ebp
sal cx, cl
inc cx
neg ebp
mov edx, ebx
inc cx
not edx
inc ecx
and ebx, ecx
inc cx
rol ebp, 1
dec esi
lea ebx, [edx*4 + 0x1bac0027]
dec eax
ror edx, 0xe3
push edx
inc cx
neg ebp
inc ecx
neg ecx
inc ecx
movzx eax, cl
dec ax
inc cx
rol ebp, 1
dec eax
and dword [esp + ecx - 0x8380], 0xbe274d28
inc edx
sbb dword [esp + ecx - 0x25d03ef6], 0xb584ac3f
inc ecx
setge cl
inc cx
xor ebp, ebp
dec edx
sar dword [esp + ecx - 0x25d03e01], 0x68
dec esi
lea ebp, [esp + ebp + 8]
inc dx
neg dword [esp + ecx - 0x25d03dfb]
dec esi
lea esp, [edx*4 - 0x71caafef]
sar ecx, 0x13
inc di
mov esp, dword [ebp + ecx - 0x25d03e01]
dec esi
lea esi, [ecx + esi - 2]
inc esi
mov ebp, dword [esp + ecx - 0x25d03dff]
inc di
mov dword [esi + ecx - 0x25d03e01], esp
inc esi
mov ebx, dword [esi + ecx - 0x25d03e01]
rol dx, 0xcd
inc esp
mov esp, edx
dec edx
lea esi, [esi + ecx*2 - 0x4ba07bfe]
dec edx
dec dword [esp + ecx - 0x25d03e01]
inc esi
xor byte [esp + ecx - 0x25d03e00], dl
inc esp
xor ebx, ebp
inc ecx
dec ebx
jmp 0x5aae20
inc ecx
pop esp
inc ecx
dec ebx
bswap ebx
jmp 0x63cccb

Function at 0x61dc61
Capabilities:
Encode data using xor

Disassembly:
inc esp
xor dword [esp + ebx - 0x3a8fcc26], edi
dec eax
mov ebp, dword [esp + ebx - 0x3a8fcc26]
inc ecx
pop ebx
dec ebp
arpl di, di
dec eax
mov dword [esp + ebx - 0x3a8fcc2e], 0xab3a21a5
call fcn.006200af

Function at 0x6206e4
Capabilities:
Execute syscall

Disassembly:
xor eax, ebx
lea edx, [ecx + ecx*8 - 0x6a75455d]
jmp 0x5501a8
xor ecx, 0xf3221330
rol eax, 1
neg eax
push ecx
add word [esp + 1], cx
ror eax, 1
sar word [esp + 1], 0xa1
inc edx
lea edx, [ecx*2 - 0x52c6ed50]
dec eax
ror ecx, 0x66
xor ebx, eax
jmp fcn.005af504
mov dword [esp], 0x81c44090
call fcn.005f46ab
mov eax, dword [edi]
mov ecx, 0x55a21cae
sub ecx, ecx
lea edi, [edi + ecx + 4]
neg ecx
jle 0x51b793
syscall
push 0x7106e528
dec eax
mov dword [esp], 0xe0e6bc1f
call fcn.004df8f2
push eax
invalid

Function at 0x62b853
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ebp
adc esp, edx
xor edi, ebp
dec edi
dec edx
mov dword [esp - 0x30be0fbc], 0x6f219cb5
inc esi
xchg byte [esp - 0x30be0faf], ah
rol edi, 2
pop eax
jmp 0x6066bb

Function at 0x64b5c2
Capabilities:
Encode data using xor

Disassembly:
push edx
mov edx, 0x4110370e
not bp
sub edx, ebp
call fcn.004ee344
lea ebp, [eax + 0x7054f611]
or eax, 0x8205c94
xchg edx, eax
push esp
xor cl, byte [0xe26b1954]
invalid
Function at 0x65055e
Capabilities:
Encode data using xor

Disassembly:
inc ebp
movsx edi, ch
xor bp, dx
inc ecx
push edi
dec eax
lea edx, [esp + edx + 0x28]
mov ebx, 0x68241d86
inc ecx
mov dword [ecx + edx - 0x14340f35], edi
inc ebp
movsx edx, ch
dec edi
lea ebx, [ebp + edx*8 - 0x23d82c5a]
inc esi
mov esp, dword [esi + ecx - 0x14340f35]
dec edx
lea esi, [esi + ecx*2 - 0x28681e66]
dec edx
mov dword [esp + ecx*4 - 0x50d03cb4], 0xf33116a6
inc esp
xor esp, ebp
inc edx
mov dword [esp + ecx - 0x14340f1b], 0xc192c9bd
inc esi
xor dword [esp + ecx - 0x14340f35], edx
inc ecx
xor esp, 0xd48d4632
dec eax
bswap ecx
call fcn.00602f0f
jge 0x650595
adc eax, 0x9aecb9b6
out dx, al
xchg esp, eax
add eax, dword [ecx - 0x11]
imul ebp, dword [ecx + 0x53], 0xffffffdb
mov bh, 0x47
cmp eax, 0x5e344d5
xchg esp, eax
invalid

Function at 0x65a11e
Capabilities:
Encode data using xor

Disassembly:
fild dword [ebp - 0x795052f8]
ret 0xe6ca
mov dword [esp], ecx
not dl
neg cl
lea ecx, [ecx*4 + 0x4a0c60b3]
mov bl, 0x60
or al, 0x4a
xor bl, dl
and cl, cl
add dword [esp + ecx - 0x4c4e31a3], ecx
mov cl, 0xb3
lea edx, [esp + edx + 8]
call fcn.0057354b
jo 0x65a135
pop ss
sub dh, byte ss:[eax + 0x3d]
push ds
adc ch, byte [edi + 0x76]
out dx, al
xchg esp, eax
sub byte [ebp - 0x2b179411], 0x5c
pop ebx
inc edi
cmp eax, 0x50ff748
xchg esp, eax
cdq
jl 0x65a128
push cs
imul ebp, dword [eax], 0xffffffa7
sub byte [ebp + 0x3d], bh
mov edx, 0xd0940b5f
pop ebx
jo 0x65a101
ret 0x494d
Function at 0x661719
Capabilities:
Encode data using xor

Disassembly:
inc cx
rol ecx, 0x62
dec edx
mov dword [esp + ecx*2 - 0x7a1de86a], edx
inc ecx
bswap esp
dec edx
mov dword [esp + ecx - 0x3d0ef439], ebx
jb 0x6b2752
inc edi
lea esp, [esp + ecx - 0x28f02b19]
aam 0xf
xlatb
mov ecx, 0xbd83f9a9
inc ecx
rol esp, 1
inc ecx
pop ecx
inc ebp
movzx ebx, cx
inc esi
xchg byte [esp + ecx*4 - 0x2a], cl
inc ecx
not esp
mov edi, 0xc0aa2415
inc esi
movsx edx, byte [esp + ecx*4 + 0xb]
inc ebp
movzx ebp, cl
dec edx
mov dword [esp + ecx*8 + 8], ebp
call fcn.00492ac0
fdivp st(7)
xor ebp, esi
sbb esi, dword [esi - 0x1f477117]
xchg esp, eax
popal
arpl cx, sp
imul ebp, dword [edi + 0x1b], 0xffffff85
xchg ebp, eax
dec ecx
cmp eax, 0xbc11a8b
xchg esp, eax
jo 0x6b2793
xor byte [edx], al
imul ebp, dword [esi], 0x64
jl 0x6b2757
pop ss
sbb eax, 0x9d263624
leave
push edi
xor al, 0x9c
sub dl, byte [ebp - 0xfb0e8a]
test dword [esp + eax*4], ecx
mov eax, edx
adc ebx, esi
std
imul eax, dword [0x67dcb827], 0x3d
mov eax, 0x3d6c80b6
sub al, 0xc2
adc dl, byte [esp + edi - 0x5c002d16]
or cl, byte [eax]
mov bl, 0x43
inc ebx
pop esp
jne 0x6b2787
aam 0x6a
pop ebp
or dword [edx + 0x3d], 0x45
insd dword es:[edi], dx
or al, 0xdf
aam 0x94
dec eax
mov edi, 0xa24e6b2a
xchg ebx, eax
push edx
ja 0x6b27db
scasb al, byte es:[edi]
and eax, 0x8055004a
sub eax, 0xb5843d57
sbb eax, 0x7ec23d26
jb 0x6b2791
mov edx, dword [esi]
or eax, dword gs:[ebx]
mov ecx, dword [ecx - 0x708e70bb]
dec ebp
jnp 0x6b287e
push cs
lahf
ficom word [edx + ebp*2 - 0x261f6acb]
aaa
push eax
jle 0x6b2856
pop ebp
cmp eax, 0x386995d3
scasb al, byte es:[edi]
push ds
pop bx
xchg esp, eax
cmp dword [esi], 0x59
mov ebp, 0xaa597b9a
pop ss
invalid
salc
invalid
mov edx, 0xbd9ecf0
aad 0x3e
xchg ebp, eax
in eax, dx
jp 0x6b27fc
and dword [edi + 0x3c30c791], 0x5f9ea939
sbb dword [esi - 0x72], edx
lea edx, [ebx]
sbb ah, byte [esi]
cmp dword [ecx + 0x56195f9e], ebp
mov cs, word [ebp + 0x261a0053]
push esp
popfd
salc
push 0x3b
lea ebx, [eax]
fst qword es:[ebx + 0x7d]
jb 0x6b2844
xchg dword [eax], edi
xchg ebp, eax
jne 0x6b28a7
ret 0xbdcb
test al, 0x1f
dec edx
mov ecx, ebp
jle 0x6b283e
adc dword [esi], esp
cmpsd dword [esi], dword es:[edi]
hlt
mov bh, 0xa3
fnstenv [0x924d9b83]
dec esi
aaa
push 0xfffffffffffffff6
out 0x22, eax
das
xchg edi, eax
mov edi, 0x6b69ca8d
imul edi, ecx, 0xfffffff9
pop esp
invalid

Function at 0x68356e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
inc ecx
rol ebx, 1
dec ebx
lea edx, [ebp + ebp*4 + 0x7123c8d]
inc ecx
not ebx
dec esp
lea ebp, [edx + eax + 0x62abc035]
inc esi
movsx edx, word [esp + edi*8 + 4]
inc ecx
dec ebx
inc ecx
neg ebx
Function at 0x689f84
Capabilities:
Encode data using xor

Disassembly:
inc esp
xor bl, ch
dec esi
lea ebp, [edx - 0xc5ade7f]
inc ecx
pop ebp
dec ecx
add ebp, 0x16b0f
inc ecx
jmp ebp
shl edi, 0x9f
jbe 0x5af7f0
xor byte [edi + 0x1a91b619], ch
pop es
push 0x3d
pop es
jo 0x689fb5
xchg esp, eax
popal
inc edi
out dx, al
pop edi
xchg dl, al
mov fs, word [eax - 0x243d72fd]
add al, 0xe6
imul edi, dword [ebp + 0x3d6c7c83], 0xffffff91
aad 0x82
and dl, dh
xchg esp, eax
insd dword es:[edi], dx
sti
imul esi, dword [edi + 0x43], 0xfffffff9
or eax, 0x56ef3d5b
pop ecx
sbb dword [eax + ebx*2 + 0x6be9a838], edx
dec edx
mov edx, 0xd00d4db1
das
sub esp, dword [esi]
jge 0x689fd4
xor bh, byte [ecx]
js 0x68a01c
cmp dword [eax + 0x45], edi
aam 0xd3
sub al, 0x6c
mov esp, 0xdd5bd790
mov esi, 0x38dc35ac
in eax, 0xe5
pop ebx
xor cl, byte [ecx]
xchg esp, eax
lodsd eax, dword [esi]
cld
imul ebx, dword [eax - 0x59], 0x2d
inc edx
bound ebp, qword [esi]
sub al, 0x48
cmovbe ebx, dword [esi - 0x716b09bf]
pop eax
adc bl, cl
or dl, cl
imul ecx, dword [edi + 0x18179539], 0x7a
js 0x68a049
rcl byte [0x8856f672]
dec esp
stosb byte es:[edi], al
lodsb al, byte [esi]
mov edi, 0x3accf1b4
pop esp
adc dword [ebx], edx
ror byte [edx + edx*2 - 0x27], 1
fiadd dword [ebx - 0x40]
adc ebx, esi
adc edx, eax
dec esp
push edx
fstpnce st(2), st(0)
inc ebx
rcl byte [ecx], 0xf3
pushal
lea ebp, [ecx - 0x67]
ficomp dword [eax - 0x3c]
rol byte [esi], cl
jnp 0x68a02b
pop eax
invalid
stc
pop ebp
xor eax, 0x615e5c6c
mul ebp
add byte [ebx + 0x5a77fa76], bh
push 0xa6ff218e
cmp edx, dword [edi - 0x74fa64bf]
jge 0x68a032
wait
add eax, 0x8ce47d8b
rcl dl, 1
das
mov eax, ss
shr byte [edi], cl
fidiv word [0x8da94150]
stc
mov dh, 0xd8
push es
cmc
les esp, es:[ebx - 0x7e]
inc esi
mov dh, 0xda
cmp edi, dword [eax + ecx]
fidivr dword [ebx]
cmp al, 8
cwde
test dword [eax], edx
cmp al, 0x63
jp 0x68a063
and al, 0x5a
mov al, 0xd5
add byte [esi - 0x6c], 0xb9
nop
xchg esi, eax
stc
jo 0x68a0a4
mov ebx, 0x2e6432cd
add edi, dword es:[ebp + 0x7f454820]
outsd dx, dword [esi]
cmp al, al
aaa
push esp
adc al, 0xb6
sub byte [edx + 0x7ada8141], bh
not byte [0x14118b17]
and eax, 0x9d2a6f2f
dec edx
lodsd eax, dword [esi]
mov word [ebp - 0x4da9117d], es
cmc
out dx, al
push esi
mov dl, 0xf5
cwde
int3
Function at 0x6a6a50
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xe4141fab
add edx, 0x24a4c012
bswap edx
xor ebx, edx
movsx eax, cx
add esi, edx
call fcn.0059f8a5
ja 0x6a6a8b
imul bh
scasd eax, dword es:[edi]
add edx, dword [ecx - 0x3d762879]
xchg edi, eax
fbstp tbyte [esi + 0x596b178b]
push eax
push ss
xchg esp, eax
pop ebp
inc ebx
shl dword [esi + 0x46c3c2be], 1
cld
imul ecx, dword [edx - 0x77], 0x35
not dword [ebp - 0x3d7b2ade]
aas
mov byte [0x4b3d6bf2], al
invalid
dec edx
mov dword [0x22a594f7], esi
aad 0x84
ret 0xa23f

Function at 0x6ad741
Capabilities:
Encode data using xor

Disassembly:
pop ebp
pop edi
xor al, byte [edi - 0x6c]
insd dword es:[edi], dx
cwde
stosd dword es:[edi], eax
or byte [ebp + 0x13], 0xc1
dec ebp
adc eax, ecx
shr cx, cl
dec eax
mov dword [esp + edi*2 + 0xa801b2], edx
pop edx
pop eax
inc ecx
pop edx
jns fcn.0055633a
push esp
xchg ebp, eax
adc al, 0xf6
popfd
lahf
dec ebx
jnp 0x64718c
in al, 0x4c
adc byte [eax + ecx*4 - 0x3d65cb38], dl
mov dl, 0xd0
xchg ebp, eax
push 0xb37a6b04
add eax, 0xb22c1a94
inc ebp
lodsd eax, dword [esi]
ret 0x21a2
dec ebx
aad 0x43
cmc
mov bh, 0x4f
pop ebx
jmp 0x647124
call fcn.00498820
inc ecx
bswap ecx
shl di, cl
inc esp
movsx ebp, word [esp + ebx - 0x522b6f1d]
dec ebp
lea ebx, [esp + eax*4 + 0x478879b6]
inc ecx
xor ecx, 0x4a258ab
inc ecx
ror ecx, 1
dec eax
shl ebx, 0x32
adc byte [esp + edx - 0x65], dl
or dword [esp + edx*8 - 0x387], edx
dec eax
mov dword [esp + edx - 0x62], ebp
inc esp
xor dword [esp + edx*2 - 0xd4], ecx
inc ecx
sar bl, 0xa6
dec eax
mov ebp, dword [esp + edx*4 - 0x1b8]
dec eax
sbb ecx, dword [esp + edx*2 - 0xdc]
dec eax
or edi, 0xfaa9ff2f
dec eax
rol edx, cl
dec ebp
arpl cx, cx
ja 0x64712e
adc dword [esi + 0xecdf61a], esi
sub dl, ah
xchg esp, eax
sub dh, byte [ebp - 0x573d6e38]
mov edi, 0x92be6be7
adc eax, 0x73d7d90
aas
int3

Function at 0x6c9b7e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
add eax, ecx
call fcn.0073f997
mov eax, dword [edi]
mov ecx, 0x8b208117
add edi, 4
xor eax, ebx
movsx edx, cl
dec cl
xor eax, 0xd383878e
bswap eax
jmp 0x797faf
jne 0x7efd0f
inc ecx
not eax
sal dx, 0x6b
sbb cx, 0x7b0b
dec dl
bswap eax
sar ecx, cl
shr ecx, 0xb
not eax
sbb cl, ch
ror cx, 0x81
ror cx, cl
xor ebx, eax
sub edx, 0x951cb60a
adc cl, 0xb7
setl cl
add esi, eax
and cx, cx
mov bp, word [ebp + ecx*2 - 0x3fe200]
jp 0x6e165d
inc esp
mov edx, dword [esi]
jmp 0x811a9c
jp fcn.007a703a
mov eax, dword [edi + edx*2 - 0x126]
movsx ecx, dx
push edx
lea edi, [edi + edx*2 - 0x122]
shl cl, 0xc3
not cl
xor eax, ebx
xadd cl, ch
dec eax
xadd ecx, edx
sbb dx, cx
shr dword [esp + edx - 0xff6d], cl
neg eax
ror dword [esp + edx*4 - 0x3fdb4], 0x35
jae 0x75b438
mov edx, 0x903f2527
movzx ecx, dl
dec eax
lea esi, [ecx + esi - 0x23]
jmp 0x7eab17
Function at 0x6e3781
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp], 0x1ab42b8b
inc cx
mov eax, dword [esi]
neg word [esp + 6]
je 0x79b310
dec eax
dec dword [esp]
dec ecx
adc esi, 2
inc ecx
mov esp, 0xaf2bf924
mov ecx, 0xdf228d3a
movzx edx, word [esi]
sal byte [esp + 2], 0xc7
dec eax
adc esi, 2
sal dword [esp + 4], cl
dec ecx
lea edi, [esp + ecx*2 + 0x31391986]
inc ecx
ror esp, 0x33
xor dx, bp
dec eax
neg ecx
not dx
dec dx
neg dx
not dx
call fcn.00726331
add esp, ecx
cmc
or dword [esp + ecx*2 - 0x63793d77], ebx
add al, 0xf5
imul edi, esi, 0xffffffbe
or ecx, dword [ecx]
cmp eax, 0x94011439
das
push fs
nop
std
imul ecx, dword [eax + 0xb], 0xffffff98
arpl word [0x77ad2c01], di
cmp eax, 0x168394e
xchg esp, eax
pushal
jo 0x79b31c
ret 0x6266

Function at 0x71478f
Capabilities:
Encode data using xor

Disassembly:
dec ebx
and word [esp + ecx - 2], 0xcc14
dec eax
mov dword [esp + ecx*4 - 0x2c], ebp
inc ecx
ror ebx, cl
call fcn.007b1fbd
rcr ch, 0x93
fdivp st(0)
sal dh, 1
add dh, 0x59
in eax, 0x4a
invalid

Function at 0x74da13
Capabilities:
Encode data using xor

Disassembly:
dec edx
mov dword [esp + ebp - 0xd516], ecx
dec edx
lea esi, [esi + ecx - 0x76b7d515]
inc ecx
pop ebp
dec ebp
and ecx, ebp
jg 0x79f22d
inc ecx
mov esp, 0xafae9413
dec edx
lea edi, [0x60bec038]
dec esi
lea ecx, [0x31a7b2bc]
inc esp
mov ecx, dword [esi]
dec ecx
not esp
dec eax
add esi, 4
inc esp
xor ecx, ebp
dec esp
lea edi, [edi*8 + 0x3318e135]
jmp 0x7947be
sar dword [ebx - 0x40d3ab60], 1
dec esi
lea edi, [0x3814001e]
inc esp
mov edi, dword [esi]
inc ebp
movzx ebx, sp
inc esp
mov ebp, ebx
inc ecx
dec ch
dec edx
lea esi, [esi + ebx*2 - 0x17a52]
inc esp
xor edi, ebp
jmp 0x6d831f
inc edx
movzx ebx, byte [esi + ebp*2 - 0x1aa2c]
jne 0x6cd434
shr ch, 0x96
ficomp word [eax - 0x80]
shl ch, 0x74
sub al, byte [ebx + ecx*2 - 0x38eb20ec]
and ebp, dword [eax]
jge 0x74d9e0
pop ss
out dx, eax
cwde
stc
shr byte [edx - 0x34], cl
and ah, byte [edx - 0x1f]
invalid
inc ecx
bswap ecx
inc ecx
add ecx, 0x43996d90
inc ecx
inc bh
inc ebp
movsx ebp, ah
inc ecx
neg ecx
inc ecx
dec ecx
inc ecx
bswap ecx
push ebp
call fcn.0081a228
push edi
imul ebp, dword [edx + 0x11], 0xffffffb6
iretd
inc eax
xor bl, ch
inc bl
inc ebp
movzx esp, bl
inc ecx
dec ebp
call fcn.00709051
sal eax, 0x58
movzx ecx, al
xor dl, bl
not eax
lea ecx, [ecx*2 - 0x71c7cb5c]
neg al
rol dl, 1
push ecx
neg dl
not cl
add dl, 0xac
mov dword [esp + eax - 0x6cfffefd], eax
neg byte [esp + eax - 0x6cfffefe]
neg dl
sar byte [esp + eax - 0x6cfffefa], 0x22
or ecx, dword [esp + eax - 0x6cfffefd]
sbb dl, al
ror dword [esp + eax - 0x6cfffefd], 0x29
shl ecx, 0x45
xor bl, dl
xor ecx, dword [esp + eax - 0x6cffff00]
lea ebp, [ebp + eax - 0x6cffff03]
mov word [eax + ebp - 0x6cffff01], dx
pop ecx
pop eax
jg fcn.007a703a
jge 0x79f2a6
add byte [ecx - 0x43], al
sub al, 0x87
cmp dword [edi + 0x45], esi
inc ecx
mov ebp, 0x7739872c
inc ebp
mov esp, dword [ebp + esi - 0x7739872c]
inc ebp
movsx ebx, bp
dec edi
lea ecx, [ebx + ebx*8 + 0x62002230]
dec edx
lea esi, [esi + ebp - 0x77398728]
inc esp
xor esp, ebp
call fcn.0072bd43
cmp byte [edx + ecx], cl
jbe 0x79f2a4
stosd dword es:[edi], eax
add al, 0x94
salc
ljmp 0x9ccf
Function at 0x74f85e
Capabilities:
Encode data using base64

Disassembly:
jb 0x796487
push eax
movsx ax, dl
movsx eax, si
cwde
push 0
lahf
push edx
mov al, 0xb7
cwde
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree_1]
call eax
ret
call fcn.007e5679
mov dword [esp + 8], 0x819902ea
lea esp, [esp + 8]
call fcn.0076bbf2
inc esp
xor ebp, ebp
dec ebp
lea edx, [ecx + 0x4ea11e09]
inc ecx
not edx
inc ecx
mov edx, edx
inc ecx
rol ebp, 2
inc ebp
mov edi, ecx
inc ecx
movsx eax, di
inc ecx
bswap ebp
inc ecx
not ebp
dec eax
or eax, 0x4932c40a
dec ecx
xadd edx, edx
inc ecx
inc ebp
sar eax, 0x56
jne 0x6ce716
dec eax
or ebx, 0xfaba8898
inc esp
xchg bl, dl
inc ecx
dec ecx
push ebp
shl bl, 0x21
inc esi
xor dword [esp + edi*4 - 0x16ce8], ecx
call fcn.007916dd
je 0x7bf60e
inc dx
xchg dword [esp + ebp*2 + 2], ebx
dec ebp
adc eax, ebx
call fcn.0077124b
mov eax, 0xdd8d73b1
call fcn.0077fe5a
inc ecx
xor ebp, 0xf8946698
dec ecx
xadd edi, edx
inc bp
cmovle edi, edx
inc ecx
bswap ebp
inc ecx
mov ecx, edi
inc ebp
lea ebp, [ebp + eax*2 + 0x460fac50]
dec ebp
add edi, edi
push ebp
jo 0x788271
jns 0x7a653d
call fcn.007039d6
mov eax, 0x31b26124
neg eax
mov ecx, dword [edi]
push eax
add edi, 4
xor ecx, ebx
mov edx, eax
xadd edx, eax
not ecx
inc dx
pop edx
dec ecx
shr dl, 0xa2
call fcn.00719575
mov edx, dword [edi]
call fcn.007b8526

Function at 0x75ba91
Capabilities:
Encode data using base64

Disassembly:
inc ecx
inc cl
inc ecx
xor ch, cl
dec ebx
lea ecx, [esp + 0x7602d59b]
dec ecx
and ebp, 0xe2a39b08
shr dl, 0x81
dec esi
lea ecx, [esp + ecx + 0x20]
inc edx
mov byte [edx + ecx - 0x80af42], bh
inc cx
rol esp, 0x4c
mov eax, dword [esi + edx - 0x80af42]
inc cx
or ebp, 0x8d489909
mov ah, 0x56
and byte [ecx - 0x3fbe0102], 0xca
push es
inc cx
rol edx, 0x28
xor eax, ebp
dec eax
mov dword [esp + edx - 0x80af42], 0x3c296fbe
not eax
inc ecx
inc dl
neg eax
inc ecx
mov ecx, 0x2a9e73b6
sub eax, 0xcbafbd20
inc sp
xor dword [esp + edx*4 - 0x202bceb], ebx
bswap eax
dec eax
neg edx
inc cx
inc ecx
inc ecx
sar ebx, 5
ror eax, 1
sal word [esp + edx*2 + 0x1015e8d], 3
call fcn.0074f85e
pop ebp
inc cx
xadd esp, eax
dec ecx
and ebx, ecx
inc ecx
dec ebp
dec eax
arpl di, di
inc ecx
ror esp, 0x50
inc ecx
push ebx
dec esp
adc eax, edi
call fcn.0071b5a3
Function at 0x761a84
Capabilities:
Get number of processors

Disassembly:
xor al, byte [edi + esi]
jmp 0x76bb8e
mov eax, 0xbd2bf80d
bts esi, eax
mov cl, dl
rcl si, 0xa6
rol eax, cl
mov esi, ecx
xor si, di
cmovne si, sp
lea esi, [ebp + edx - 0x10c]
cmp bx, si
stc
clc
add al, dl
jmp 0x6c4e2e
inc ebp
movsx edi, ch
xor bp, dx
inc ecx
push edi
dec eax
lea edx, [esp + edx + 0x28]
mov ebx, 0x68241d86
inc ecx
mov dword [ecx + edx - 0x14340f35], edi
inc ebp
movsx edx, ch
dec edi
lea ebx, [ebp + edx*8 - 0x23d82c5a]
inc esi
mov esp, dword [esi + ecx - 0x14340f35]
dec edx
lea esi, [esi + ecx*2 - 0x28681e66]
dec edx
mov dword [esp + ecx*4 - 0x50d03cb4], 0xf33116a6
inc esp
xor esp, ebp
inc edx
mov dword [esp + ecx - 0x14340f1b], 0xc192c9bd
inc esi
xor dword [esp + ecx - 0x14340f35], edx
inc ecx
xor esp, 0xd48d4632
dec eax
bswap ecx
call fcn.0070d619
je 0x761b03
inc edx
cmp sp, ax
cmp edx, 0x104
jb 0x6e8c7c
mov eax, dword fs:[0x30]
or bl, 0x94
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
mov bh, cl
ror bx, cl
adc bx, 0xf188
mov eax, dword [eax + 0x10]
sar bl, cl
mov bx, bp
mov dword [ebp - 4], eax
mov ebx, ecx
test edx, ebp
cmp ecx, eax
jmp 0x7cd7b2
mov byte [esi], al
jmp 0x761aed
je 0x7e2ec9
lea ebx, [ebx]
bts edi, esi
or esi, edx

Function at 0x78bde2
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
inc bp
xor ebp, esp
neg al
dec esp
add eax, ecx
sal al, 0x44
dec esp
lea edx, [eax + 0x282188bf]
dec eax
lea ebx, [edi - 0x37e9f0f4]
inc cx
mov ecx, dword [esi + eax*4 - 0x300]
dec ebp
lea esi, [esi + edi*4 - 0xb0da]
jnp 0x81d412
jb 0x77ae84
inc ecx
sar ch, 0x41
inc ebp
movsx ebx, sp
xor ecx, 0xf9adeb17
neg ecx
dec eax
mov dword [esp + eax*4 - 0xdc], ebp
and eax, 0x953b6eac
mov ebp, edi
xor dword [esp + eax*2 - 0x48], ecx
pop ebp
inc ecx
ror ah, 1
mov edx, edi
dec eax
arpl cx, cx
jno 0x73a3c2