joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1045a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1045a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1045a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045a06a
add dl, dl
jne 0x1045a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045a0dc
xor eax, eax
add dl, dl
jne 0x1045a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045a17d
add dl, dl
jne 0x1045a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1045a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1045a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1045a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1045a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1045a075
mov eax, 1
add dl, dl
jne 0x1045a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1045a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1045a0e1
sub eax, ebx
mov ebx, 1
jne 0x1045a128
mov ecx, 1
add dl, dl
jne 0x1045a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1045a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1045a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1045a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1045a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1045a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1045a136
cmp eax, 0x7d00
jae 0x1045a16d
cmp eax, 0x500
jb 0x1045a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1045a075
cmp eax, 0x7f
ja 0x1045a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1045a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1045a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1045a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1000ef53
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000ef60]
jne 0x10017e82
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1001a2f8], eax
mov dword [0x1001a2f4], ecx
mov dword [0x1001a2f0], edx
mov dword [0x1001a2ec], ebx
mov dword [0x1001a2e8], esi
mov dword [0x1001a2e4], edi
mov word [0x1001a310], ss
mov word [0x1001a304], cs
mov word [0x1001a2e0], ds
mov word [0x1001a2dc], es
mov word [0x1001a2d8], fs
mov word [0x1001a2d4], gs
pushfd
pop dword [0x1001a308]
mov eax, dword [ebp]
mov dword [0x1001a2fc], eax
mov eax, dword [ebp + 4]
mov dword [0x1001a300], eax
lea eax, [ebp + 8]
mov dword [0x1001a30c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1001a248], 0x10001
mov eax, dword [0x1001a300]
mov dword [0x1001a1fc], eax
mov dword [0x1001a1f0], 0xc0000409
mov dword [0x1001a1f4], 1
mov eax, dword [0x1000ef60]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1001a044]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1001a240], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10017f84
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1001a240], 0
jne 0x10017f6e
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x10016a7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10016a89
pop dword [ebp - 8]
mov eax, 0xee3f3d79
sub eax, 0xde3dd2f0
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x67617c15
add dword [ebp - 0x18], 0xe6f0c936
mov dword [ebp - 0x14], 0x6ea87a11
add dword [ebp - 0x14], 0xc38ad234
mov dword [ebp - 0x10], 0x7286dcf9
add dword [ebp - 0x10], 0xd9c56735
mov dword [ebp - 0xc], 0xa6d2ab11
add dword [ebp - 0xc], 0x592d54ef
lea eax, [ebp - 0x18]
push eax
mov eax, 0xbe0a49c4
add eax, 0x51f5c7bc
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x815ffb7e
sub dword [ebp - 0x18], 0xced9228
mov dword [ebp - 0x14], 0x31bb8efc
sub dword [ebp - 0x14], 0xf04f2d87
mov dword [ebp - 0x10], 0xd7da2615
add dword [ebp - 0x10], 0x8b954657
mov dword [ebp - 0xc], 0x1d338c25
sub dword [ebp - 0xc], 0x1d338c25
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x73ecb688
add eax, 0x9c135af0
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x400a0
push 0
call eax
mov ecx, 0x80c3cc8d
sub ecx, 0x80c37abc
xor ebx, ebx
add ebx, eax
mov edx, 0x1001ce00
add edx, dword [ebp - 8]
mov edi, 0xac2b61ea
add dword [ebp - 4], esi
mov esi, dword [edx]
sub dword [ebp - 4], 0x693d9be6
add esi, edi
xor dword [ebp - 4], ecx
mov dword [ebx], esi
xor dword [ebp - 4], 0xfc39a206
add ebx, 0xe902663b
sub ebx, 0xe9026637
add edx, 0x20ee3f8c
add edx, 0xdf11c078
loop 0x10016ba1
add eax, 0x9ffff499
add eax, 0x6001457e
xor ebx, ebx
add ebx, eax
add eax, 0x757592b2
add eax, 0x8a8a6d53
mov ecx, 0xa20ea594
add ecx, 0x6df15a6c
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1001730e
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x14]
push esi
push edi
push 0xf0000000
xor edi, edi
push 0x18
push edi
mov dword [ebp + 0x14], eax
push edi
lea eax, [ebp - 8]
push eax
mov esi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x1001737f
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
je 0x1001737f
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_CryptHashData]
test eax, eax
je 0x1001737f
push edi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_CryptGetHashParam]
test eax, eax
jne 0x10017397
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10017397
and esi, 0xffff
or esi, 0x80070000
cmp dword [ebp - 4], edi
je 0x100173a5
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_CryptDestroyHash]
cmp dword [ebp - 8], edi
je 0x100173b4
push edi
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x100173bc
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1000ef60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x20]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], ecx
mov esi, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
cmp edi, 0x660e
je 0x10017408
cmp edi, 0x6801
jne 0x10017505
test edx, edx
je 0x10017505
test eax, eax
je 0x10017505
mov ebx, dword [ebp + 0x18]
cmp ebx, 0x10
jb 0x10017503
jbe 0x10017429
push 0x10
pop ebx
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.advapi32.dll_CryptAcquireContextW]
push ebx
push dword [ebp - 0x48]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x30], 0x208
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
call sub.msvcr100.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x1c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.advapi32.dll_CryptImportKey]
test eax, eax
je 0x100174e9
cmp edi, 0x660e
jne 0x100174a4
call dword [sym.imp.msvcr100.dll_rand]
mov byte [ebp + ebx - 0x14], al
inc ebx
cmp ebx, 0x10
jl 0x1001747e
xor ebx, ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push 1
push dword [ebp - 0x34]
call dword [sym.imp.advapi32.dll_CryptSetKeyParam]
test eax, eax
je 0x100174e9
push dword [ebp + 0x10]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push ebx
push 1
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.advapi32.dll_CryptEncrypt]
test eax, eax
je 0x100174e9
cmp edi, 0x660e
jne 0x1001750a
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x1001750a
push ebx
lea ecx, [ebp - 0x3c]
push ecx
push eax
push 1
push dword [ebp - 0x34]
mov dword [ebp - 0x3c], 0x10
call dword [sym.imp.advapi32.dll_CryptGetKeyParam]
test eax, eax
jne 0x1001750a
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1001750a
and esi, 0xffff
or esi, 0x80070000
jmp 0x1001750a
xor ebx, ebx
mov esi, 0x80004005
cmp dword [ebp - 0x34], 0
je 0x10017519
push dword [ebp - 0x34]
call dword [sym.imp.advapi32.dll_CryptDestroyKey]
cmp dword [ebp - 0x38], 0
je 0x10017529
push ebx
push dword [ebp - 0x38]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ef53
leave
ret 0x1c
Function at 0x40a8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40a8bf
pop dword [ebp - 0x40]
mov eax, 0x40fd95c5
add eax, 0xbf4312fa
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x39814338
add dword [ebp - 0x50], 0x14d10213
mov dword [ebp - 0x4c], 0x1c2cfae9
add dword [ebp - 0x4c], 0x1606515c
mov dword [ebp - 0x48], 0x5db4a772
sub dword [ebp - 0x48], 0x11686344
mov dword [ebp - 0x44], 0x5f13f04b
sub dword [ebp - 0x44], 0x5f13f04b
lea eax, [ebp - 0x50]
push eax
mov eax, 0xe4323e29
add eax, 0x1c0f1257
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xbcb2de54
add dword [ebp - 0x50], 0xb7bf8b02
mov dword [ebp - 0x4c], 0x989df8bc
add dword [ebp - 0x4c], 0xa8ce68b9
mov dword [ebp - 0x48], 0xe6427cbc
add dword [ebp - 0x48], 0x7d2cefb0
mov dword [ebp - 0x44], 0x947c044
add dword [ebp - 0x44], 0xf6b83fbc
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x95fa85ca
sub eax, 0x95b9357e
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3bc6c
push 0
call eax
mov ecx, 0x3ebdef25
sub ecx, 0x3ebda24a
mov ebx, eax
mov esi, 0x942f484
add esi, 0xf6feff7c
add esi, dword [ebp - 0x40]
mov edx, 0x332afa2b
sub edx, 0xdb08208b
sub dword [ebp - 0xc], 0xc080b821
mov edi, dword [esi]
add dword [ebp - 8], ecx
xor edi, edx
sub dword [ebp - 0x2c], 0xba458db
mov dword [ebx], edi
xor dword [ebp - 0x30], ebx
add ebx, 0xcf1605b
sub ebx, 0xcf16057
add esi, 0xb3b5c9bf
add esi, 0x4c4a3645
loop 0x40a9e1
add eax, 0x1263f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x6c281330
Capabilities:
Encode data using xor

Disassembly:
lcall 0x1bfb, 0x30aebf75
mov esi, 0xa8720166
xor bl, bh
sbb edi, dword [esi - 0x578dfe9a]
aas
scasd eax, dword es:[edi]
mov eax, 0xa7c0b073
dec esp
pop eax
movsb byte es:[edi], byte [esi]
push 0xffffffffffffff9b
imul ebx, dword [eax], 0x34
invalid
stc
and eax, 0xaee23499
and eax, 0x633ad0fe
cmp ah, byte [ebx + 0x75]
outsd dx, dword [esi]
xor ebp, esi
fldenv fs:[esi - 0x5430adcd]
sbb dword [ebx + esi*2 - 0x39], esi
cmp eax, 0x1cb02122
insd dword es:[edi], dx
add byte [esp + esi*8 + 0x4fa68c7d], 0xbf
jge 0x6c281303
mov ebx, 0x35c400ad
popal
xlatb
inc edx
in al, dx
or eax, 0x4f7c75a5
movsd dword es:[edi], dword [esi]
jne 0x6c2813da
dec edi
mov cl, 0x71
aaa
test bh, cl
popfd
sti
mov esi, 0x4d09605d
dec edi
xchg ebx, eax
sub dword [edx + 0x326b8d09], 0xffffffc7
pop eax
dec edi
bound ebx, qword [ebx]
jne 0x6c281307
hlt
push ebx
fcomp qword [edx]
jb 0x6c2813d3
mov ah, byte [edi - 0x2d]
loop 0x6c28135b
pop ecx
aas
movsd dword es:[edi], dword [esi]
stosd dword es:[edi], eax
fstp dword [0x82ed13cd]
dec esp
sahf
inc byte [edx + ecx*4 - 0x508f4e79]
jne 0x6c281327
invalid
xchg byte [ecx + 0x292428ad], cl
mov dword [ebp - 0xed6dbd8], ebp
sub byte [ecx + ebp], ah
int1
inc ebx
mov bl, 0x43
dec edi
mov byte [edi - 0x72088178], dh
rcr edi, 1
div dword [ecx + edx*2 - 0x7dfea095]
mov edi, 0xde90637e
jae 0x6c281382
fidivr dword [eax - 0x234127e6]
pop ss
adc al, 0xe4
mov dl, 0x59
xor al, 0x81
xchg edx, eax
imul esp, dword [edx + ebp*4 - 0x64], 0xdeabaccd
fisub word [esi + 0x45]
int 0xac
stosd dword es:[edi], eax
invalid
insd dword es:[edi], dx
mov dh, 0x30
scasd eax, dword es:[edi]
imul ebp, ebx, 4
push edi
mov es, word [esi - 0x36]
mov ch, 0xca
lea esp, [eax - 0x40]
jb 0x6c2813ce
dec ecx
loope 0x6c2813b3
add eax, 0x4834e4f9
jp 0x6c28138c
inc esi
xor bh, byte [eax + 0x379eef14]
cli
xor dword [eax + edx*2 + 0x10ed2603], edx
les edx, [ebp + 0x6b]
adc al, 0x7f
dec eax
insb byte es:[edi], dx
in al, 0x64
xor eax, 0x3564b96c
insb byte es:[edi], dx
mov fs, word [ecx + eax]
push eax
das
sub byte [esi + edx*2 + 0x641a6bab], ch
insd dword es:[edi], dx
stosd dword es:[edi], eax
dec ecx
mov cl, 0xff
int 0x53
jo 0x6c281459
cmp al, 0x1a
xor al, 0x37
mov esi, 0x32828b6b
shl dword [edi + 0x41], 1
xor al, byte [eax - 0x54]
adc al, 0xa0
je 0x6c28147c
cmp esp, ebp
std
pop es
mov word [ecx], gs
push es
clc
and al, 0x32
invalid
mov dword [0xde7039c], eax
push 0xc745e42
add dh, byte [eax + edi*2 - 0x2d924f86]
jb 0x6c2814d1
arpl word [esi - 0x3fda9b32], ax
out dx, al
shr dl, 1
add eax, 0x524d4366
cdq
mov al, 0x65
insd dword es:[edi], dx
mov dword [0x6691456f], eax
xor ah, byte [eax + 0x49]
mov dword [eax - 0xc03aaad], edi
adc byte [esi + 0x31], 0xb3
mov dword [ecx + edi], ecx
outsb dx, byte [esi]
adc eax, 0xc590420c
fimul dword [ecx]
inc ebx
loope 0x6c2814f1
inc ecx
cmp dh, byte [ebx + 0x53358802]
pop edi
int3
sub al, 0xde
push ebp
cmpsb byte [esi], byte es:[edi]
xor dword [esi - 0x19], ecx
invalid
push ebx
and bh, byte [esp + ebx - 0x45]
ret 0xbe5c
Function at 0x6c286660
Capabilities:
Encode data using xor

Disassembly:
pushfd
cdq
xchg ebx, eax
pop esi
rcr bl, 1
popal
test eax, 0x164aaa29
inc ebx
push esi
popfd
pop ss
lahf
adc al, 0xae
sub al, 0x43
or ecx, dword [esi]
mov bl, 0x76
wait
pushfd
das
invalid
xchg edx, eax
jbe 0x6c286684
push edx
rol dword [edi], 0xae
mov edx, 0xf81febba
mov edi, 0x3c7a0705
push eax
xor al, 0x83
fsub dword [ebx]
leave
jno 0x6c28662c
popal
rcl byte [ebx + 0x5472a622], cl
ror eax, 1
xor ebx, dword [0x6b49ed0c]
in al, 0x83
or al, 0xed
dec ecx
imul esp, esp, 0xffffff83
leave
test dword [ebx - 0x27e86f89], edx
call 0x46703f23
xor al, 0x57
ja 0x6c2866d8
hlt
mov al, byte [0xa85bd830]
push ebx
stosb byte es:[edi], al
imul byte [ebx - 0x2e15457a]
xor ax, 0x89e0
adc dword [edi - 0x66], eax
out dx, eax
mov cl, 0xce
xchg edi, eax
add esp, dword [ebx]
scasb al, byte es:[edi]
mov dword [0x5a6d7138], eax
and dword [ecx + 0x7d], esp
sahf
mov ebp, 0x9d3f4a38
pop edi
movsb byte es:[edi], byte [esi]
adc dh, byte [eax]
cmp eax, 0x7bd2102d
movsd dword es:[edi], dword [esi]
enter 0x2457, 0x3c
out dx, eax
dec edx
ficomp dword [ebx - 0x15]
pushfd
jecxz 0x6c286720
in eax, 0xc1
fidivr word [ebx + esi*4 - 0x76]
not dh
xor edx, dword [ebx + 0x52]
push ebx
push edx
sar dword [0x2184115a], 1
or byte [eax + 0x52045c31], 0xc4
jl 0x6c286770
pop esp
add al, 0x52
les edi, [edi + edi + 0x45]
aas
inc ebp
imul esp, dword [eax + edi - 0x53c16d37], 0x38
xchg esp, eax
insb byte es:[edi], dx
sbb eax, 0xad9d05f3
invalid
salc
jle 0x6c28672b
cmp al, 0x4e
mov ebx, dword [ebx + esi*8]
mov bh, 0x6b
add esi, dword [ecx]
inc esi
salc
add esi, dword [ecx + 0x75]
mov ebx, 0x7ac2d3d1
sub byte [edx + 0x46], dh
pop ebp
not dword [eax]
jbe 0x6c2867c2
xchg esi, eax
adc bh, byte [edi]
mov ecx, 0xe066ee18
clc
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
call 0xdc8e82a3
sal byte [0x51439993], 0x52
stosd dword es:[edi], eax
insd dword es:[edi], dx
mov bl, 0xda
push ebp
push edi
jns 0x6c286730
cdq
sahf
and byte [esp + edx*8], ah
mov bh, 0x61
lodsb al, byte [esi]
mov word [edi], ds
jmp 0x6c286766
cwde
jbe 0x6c2867dd
add byte [eax + 0x650311b7], dl
invalid
stc
fcom qword [edi - 0x2d8be762]
shr dword [bp + 0x1616], 0x5a
imul dl
imul esp, dword [esi + 0x42], 0xffffff8c
adc ch, byte [edi]
add byte [ecx + ebx - 0x4e02b4c3], 0xa9
ja 0x6c2867de
movsd dword es:[edi], dword [esi]
enter 0x5d48, 0xffffffffffffffc2
xchg ebp, eax
out 0x4d, eax
add eax, 0x70f020fa
nop
invalid

Function at 0x6c28e2d0
Capabilities:
Encode data using xor

Disassembly:
pushal
dec ebp
test al, 0x9f
test al, 0xd9
pop eax
mov dword [0xf3d74d4d], eax
jge 0x6c28e2f9
and byte [edx + ecx*2], cl
imul ebx, esi, 0xfffffffc
test byte [edi + 0x66b5a327], ch
out 0x67, al
xor byte [edx + esi*8 + 0x383c0e3], ch
invalid
invalid
Function at 0x6c291f30
Capabilities:
Encode data using xor

Disassembly:
add dword [edi + esi*2], 0x4b0b826c
mov eax, fs
popal
nop
imul edi, dword [edi - 0x4a94ca6c], 0xb
test al, 0x9d
and al, 0x5b
or eax, dword [edx]
and bh, byte [edx]
sub dword [ebx - 4], ebp
add dh, byte [ebp - 0x79cc73a0]
arpl si, cx
mov ebx, 0x17c4658c
or eax, 0xbab7ab9e
shl dword [eax + edx*4 - 0x4bcbd7a4], cl
mov word [edi - 0x2c95642f], es
nop
out dx, al
push esp
sbb eax, dword [edx]
push 0x7b
sub byte cs:[ebx - 0x62f38b74], dl
inc ecx
jnp 0x6c291fad
xor byte [ebx], bh
push ebp
lahf
cmp esp, dword [ebp + edx*2 - 0x61]
xor esp, esi
cld
or dl, byte [ecx]
push 0xda229e3d
sahf
and bl, dl
xor eax, 0x8c62d342
sub al, 0xff
invalid
jne 0x6c291f7d
stosd dword es:[edi], eax
dec edi
cmp ebp, dword [ebx + ebx + 0x75]
sub ecx, dword [edi*8 + 0x4c5909f0]
jl 0x7bb6ff16
js 0x6c291f88
mov al, 0x36
sub ah, byte [eax]
adc al, 0xfc
pop ecx
sbb eax, esp
out 0x4d, eax
pop edi
xchg esp, eax
dec ebx
push edi
enter 0xffffffffffff9146, 0xffffffffffffffdc
xchg esi, eax
dec edi
and bl, byte [eax*4 - 0x2e260acb]
xor byte [edx + ebx*2 + 0x7d], cl
dec ebx
xor al, 0x64
ficom dword [eax]
stosb byte es:[edi], al
jb 0x6c292003
inc esi
jle 0x6c291fcd
cld
jl 0x6c291f7c
inc ebp
xchg byte [edi - 0x42], bl
xchg esp, eax
xor eax, 0xca05d67
jle 0x6c29200b
mov al, byte [0x640c7e0c]
shl dword [0xca5be1c8], 0xa7
shl dword fs:[0xca5be1c8], 0xa7
loope 0x6c292060
retf 0x4ba7
dec ebx
cmp eax, 0x59f406ce
daa
mov esi, 0x85d9508f
mov dl, 0xa3
sub dword [edi + ecx*2 + 0x4a], ebp
scasd eax, dword es:[edi]
mov ch, ch
push eax
out 0xbc, al
jne 0x6c291ffb
hlt
lcall 0x9464, 0xca2d899c
mov cl, bl
stosd dword es:[edi], eax
sub esi, ebp
pop ebx
inc esi
test byte [ecx - 0x4e9d63e8], 0xdc
sub byte [eax - 0x6c], dh
pushfd
bound esi, qword [ecx - 0x6b8fd724]
lcall 0x31d0, 0x3fe7911e
fdivr dword [edi + 0x74337f73]
and eax, 0x21afb2d9
add al, 0xf4
xor edx, ecx
call 0x280f85
outsb dx, byte [esi]
or eax, 0x11afab64
xchg ecx, eax
pop ecx
outsb dx, byte [esi]
cmp bh, byte [ecx]
jge 0x6c292033
mov esi, 0xcb1c57d8
into
ficom dword [eax]
ja 0x6c2920a6
fild dword gs:[edi]
dec eax
cmp byte [ebx + edx*8 - 0x1e], ch
xor al, 0x75
lodsd eax, dword [esi]
jnp 0x6c2920cd
sbb dl, byte [esi - 0x463c2232]
imul esi, dword [ecx + edi + 0x565e50a], 0xffffffca
cmp al, 0xd4
invalid
into
xchg ecx, eax
retf 0x6152
inc esp
dec esp
iretd

Function at 0x6c2933e0
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x5c293810
call 0x11861008
and al, 0xa8
aam 0xc4
lodsb al, byte [esi]
cmc
dec ebx
dec esi
lds ebx, [edx - 0x25f4998e]
or ebx, edx
mov byte [ecx], bh
mov dh, 0x73
mov edi, 0x1b61096b
lodsb al, byte [esi]
push 0x395fe7ea
xor ch, byte [edx + 0x56b861ac]
fstp qword [edx + 0x3c]
ficomp dword [ebp + 0x45]
push ecx
pop ebp
jbe 0x6c2933dc
xor al, 0xe7
mov esp, 0xdb02dedf
fimul dword gs:[0x538c30a4]
in eax, dx
mov ebx, 0xbab271d1
aas
pop eax
or dl, byte [ebp - 0x56]
dec edx
jnp 0x6c2933c6
push eax
imul ebx, dword [ebx + ebx], 0x7e944cf7
cmc
lds ebx, [edx + 0x536bb8a9]
mov dword [0x1f7a04d4], eax
xchg dword [edx], ebp
mov dh, 0xad
inc edi
invalid
Function at 0x6c296910
Capabilities:
Encode data using xor

Disassembly:
clc
xchg byte [esi + 0x2b], bl
or eax, 0xc89951a4
xor dword [bx - 0x30], eax
invalid

Function at 0x6c29c4d0
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
lea eax, [ecx + 0x58e9f1f3]
clc
push edx
push ebx
lodsb al, byte [esi]
loope 0x6c29c4fb
fistp word [ebx]
push cs
xor ah, byte [ebx - 0x3fbd85e7]
adc al, 0x5f
dec ebx
imul ecx, dword [ecx], 0xb0a0dc20
loop 0x6c29c44d
test cl, ah
xor ebx, 0x337409a3
ficom dword [edi]
pop eax
pop ds
mov eax, dword [0x1d6f2324]
and al, 0x23
outsd dx, dword [esi]
sbb eax, 0xc5ec7c08
and al, 0x23
outsd dx, dword [esi]
sbb eax, 0xc5ec7c08
out dx, al
pop ds
push 0x31
test al, 0x73
inc ecx
sti
movsb byte es:[edi], byte [esi]
inc ebx
inc cx
jno 0x6c29c4ff
xlatb
mov al, 0x1e
je 0x6c29c499
and esi, ebx
jno 0x6c29c474
movsd dword es:[edi], dword [esi]
xchg edx, eax
push eax
jecxz 0x6c29c4aa
or al, 0xd9
push 0xb1df7e59
inc edx
mov cl, 0x42
add eax, 0xd06f47cc
aad 0xb4
out dx, al
inc edi
outsd dx, dword [esi]
rcl ch, 1
mov ah, 0xee
pop es
stosd dword es:[edi], eax
test al, 0x51
xor edi, dword [eax + 0x77]
retf

Function at 0x6c29ffd0
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x23
sahf
jl 0x6c2a0038
cmpsd dword [esi], dword es:[edi]
and al, 0x31
and al, 0x1a
push ds
in al, dx
aas
xor ebp, eax
adc eax, esp
push 0x9de23560
jbe 0x6c29ff8a
or bh, byte [ebp + 0x2c]
sar byte [eax], 0x52
push 0xffffffffffffffcc
or ecx, dword [ebp - 0x6c]
pop eax
mov esi, 0xa575a1ae
cmc
dec esp
rcr dword [eax - 0x721eb4f6], 1
sbb edx, dword [edx]
neg dword [esi - 0x1d]
mov dword [0xb32bc0a6], eax
test al, 0x9d
invalid
retf
loop 0x6c2a005b
or dh, ch
test al, 0xb3
imul eax
sbb bl, cl
loop 0x6c2a0024
test al, 0x4f
clc
mov edx, 0xaf7a76a8
test al, 0x76
jp 0x6c29fffb
jbe 0x6c2a0042
or dword [eax + ecx + 0x35], eax
insd dword es:[edi], dx
mov al, byte [0xc45d6d8b]
xor dword [ebx], ebx
and eax, 0x250b13c3
nop
jns 0x6c2a0048
sbb al, 5
or eax, 0x3dc01982
neg dword [ebx - 0x74f0fdf5]

Function at 0x6c2a05d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [edx + 0x10], 0xe7
hlt
loop 0x6c2a0546
sub byte [esi - 0x2f], dl
clc
jecxz 0x6c2a0591
and al, 0xff
or eax, 0x5ebaf87
out 0xc7, eax
insb byte es:[edi], dx
cmpsb byte [esi], byte es:[edi]
into
and dl, byte [eax]
invalid
sub edi, esi
out dx, eax
fld dword [edi - 0x7c6a93ca]
add edi, ecx
push es
pushal
aad 0xec
je 0x6c2a0553
mov bl, byte [0x6cbdf488]
test byte [edi + 0x7a408b52], 0x99
pop ecx
inc ebp
mov edx, dword [ecx + 0x566eac7c]
xor byte [esi + ebx*8 - 0x7a], 0xe1
aaa
fld dword [ecx + ebx*2]