joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100604e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.10060560
movzx eax, al
test eax, eax
je 0x10060511
push 0x100014c4
push 0x13c6b4e0
call fcn.100551b0
add esp, 8
push 0
call fcn.10071870
mov ecx, dword [ebp - 4]
call fcn.10060820
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.10060650
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10068ce0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0x13c6b312]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0x13c6b4e0
call fcn.1005f480
add esp, 8
mov esp, ebp
pop ebp
ret 4

Function at 0x1006a010
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008f340]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x1006a034
jmp 0x1006a0a3
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1006a048
jmp 0x1006a0a3
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x1006a074
jmp 0x1006a0a3
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x1006a095
jmp 0x1006a0a3
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call main
mov esp, ebp
pop ebp
ret
Function at 0x10084185
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008f340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10074b2c
mov dword [ebp - 0x14], eax
cmp dword [0x13c6c4d8], esi
jne 0x10084278
push 0x800
push esi
push 0x10007acc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10084205
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10084358
push esi
push esi
push 0x10007acc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10084358
push 0x10007ae4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10084358
push eax
call ebx
push 0x10007af0
push edi
mov dword [0x13c6c4d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007b00
push edi
mov dword [0x13c6c4dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007b14
push edi
mov dword [0x13c6c4e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x13c6c4e8], eax
test eax, eax
je 0x10084275
push 0x10007b30
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x13c6c4e4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1008429d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10084290
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100842b2
push 4
pop eax
jmp 0x1008435a
cmp dword [ebp - 0x14], esi
je 0x100842b2
push dword [0x13c6c4d8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10084297
mov eax, dword [0x13c6c4e4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10084310
cmp dword [0x13c6c4e8], edi
je 0x10084310
push eax
call ebx
push dword [0x13c6c4e8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10084310
test eax, eax
je 0x10084310
call ecx
test eax, eax
je 0x10084305
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10084305
test byte [ebp - 8], 1
jne 0x10084310
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10084340
mov eax, dword [0x13c6c4dc]
cmp eax, edi
je 0x1008433d
push eax
call ebx
test eax, eax
je 0x1008433d
call eax
mov esi, eax
test esi, esi
je 0x1008433d
mov eax, dword [0x13c6c4e0]
cmp eax, edi
je 0x1008433d
push eax
call ebx
test eax, eax
je 0x1008433d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x13c6c4d8]
call ebx
test eax, eax
je 0x10084358
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1008435a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x4044b0
Capabilities:
Encode data using xor

Disassembly:
fld qword [eax + ebp*2 - 0x4f3e5e1c]
out 0xc1, eax
fisub word [eax]
mov eax, 0x25e1ed7f
inc esi
rcr byte [esi - 0x15], cl
rol byte [0xcd3d53c2], 1
cld
xor eax, 0x40ffa273
enter 0x3ac4, 0x6a
loopne 0x4044a7
lodsd eax, dword [esi]
invalid

Function at 0x4b7254
Capabilities:
Encode data using xor

Disassembly:
xor ah, al
in eax, 9
jo 0x4b7218
pop ebp
pushal
fcom st(2)
iretd
pop ds
xchg esp, eax
outsb dx, byte [esi]
dec esi
aaa
insb byte es:[edi], dx
sub ebp, dword [esi]
push cs
mov ebx, 0x32cc568d
jp 0x4b7210
call 0xf152039c
ret 0x6eda
jo 0x4b71e8
xlatb
mov dword [0x20ef92f], eax
cmpsd dword [esi], dword es:[edi]
fild word [edx + 0x55]
lodsb al, byte [esi]
les edx, [edx - 0x18]
sbb byte [edi + 0x67], cl
push ebx
call 0x53b2c13c
daa
cld
mov al, 0x96
popal
sti
insb byte es:[edi], dx
or byte [edx + ecx], 0xa7
in eax, 0x1f
jbe 0x4b71be
push esp
or byte [edi], ch
mov al, 0xcf
jle 0x4b7219
test dword [edi], ebx
mov bh, 0xee
js 0x4b727e
sbb bh, bh
js 0x4b71e2
popfd
adc dword [ebx - 0x12191139], ebx
jne 0x4b721d
pop ebp
adc ebx, esi
js 0x4b721f
mov ch, 0x7b
sub eax, 0x25a85dbc
out dx, eax
in eax, dx
xor esi, esi
in al, 0x1b
mov dword [ecx - 0x3eb4fb8e], esp
mov edi, 0xd227fd9
jp 0x4b72cc
mov dword [ebx + 8], edx
dec esp
xor dword [eax - 0x725817f9], edi
adc esp, edx
int3
packsswb mm3, qword [edi]
push esp
xchg esp, eax
dec edi
jo 0x4b726e
invalid

Function at 0x4d2fdc
Capabilities:
Encode data using xor

Disassembly:
loopne 0x4d304d
pop eax
loope 0x4d303a
hlt
in al, 7
invalid
cwde
xor dword [esi + 0x4f], esp
push ecx
test eax, 0x1a66b2c4
fdiv qword [esi + 0x1e]
push ds
mov byte [0xa97dd230], al
sar byte [ebp - 0x57], cl
mov edx, 0xb8919e5e
inc edx
daa
out 0x51, eax
test dword [edi - 0x6ec05abb], 0x599346ce
cwde
mov byte [esi + edx], bl
daa
mov byte [ebx + 0x74216618], dl
out 0x2c, eax
mov esp, 0x2bb803b
lds edx, [ebx - 0x5ddf3ed3]
mov eax, 0xd0aecd33
and eax, 0x96ef0f4a
pop esp
mov edi, 0xf6abc3c9
mov word [edi], ss
cmc
cmc
aad 0x85
dec esi
fnsave dword [ebx + 0x1c]
cwde
adc esi, edx
xor al, 0x3e
pop ds
ror byte [ecx], cl
inc ebp
mov ah, 0x40
push ebp
sub esi, ecx
mov ch, 0xa6
fcomp qword [ebx + 0x2e]
jle 0x4d3035
invalid

Function at 0x531400
Capabilities:
Encode data using xor

Disassembly:
add cl, al
invalid
sub dword [esi + 0x6d], edx
nop
fistp word [edi + 0x6c1ff2de]
pushfd
push esi
sahf
wait
jl 0x531357
push ecx
sahf
ret
lodsd eax, dword [esi]
mov eax, 0x7b72366d
shr ebp, cl
aam 0x9b
xor al, 0x8a
mov ebp, 0x705cb58c
jo 0x5313a6
jbe 0x531385
cmp eax, 0xa3a25637
push esi
mov eax, dword [0x9221e8e2]
xor dword [edx - 0x23e52ee0], edi
test byte [ebp - 0x78a8db9a], 0x1a
pop edx
add edx, 0x77
adc eax, 0xb9d17fe
mov dl, 0xdd
loopne 0x53140f
int3

Function at 0x6b0944
Capabilities:
Encode data using xor

Disassembly:
mov byte [esi + 0x51], ch
push ecx
dec eax
ljmp 0xda07
Function at 0x6b3858
Capabilities:
Encode data using xor

Disassembly:
and al, 0xc5
jne 0x6b37d2
sub al, 0xd6
test dword [edx + 0x12bbe576], edx
or esp, dword [edi + edx*2 - 0x5d]
enter 0x2244, 0xffffffffffffffd2
push es
push eax
lds edx, [ecx - 0x6d]
inc ebx
sahf
fmul st(1)
leave
leave
cmpsb byte [esi], byte es:[edi]
stosb byte es:[edi], al
xor cl, byte [esi + 0x22]
sbb dword [eax + 0x15], 0x9cb7b154
adc eax, 0xbe785693
ja 0x6b3855
jmp 0xe0973c7a
or al, byte [esp + ebp]
loopne 0x6b3826
jnp 0x6b3815
jae 0x6b386b
dec eax
jle 0x6b3803
xor eax, 0x26e7921c
xchg ebp, eax
dec edx
fsqrt

Function at 0x6b5b68
Capabilities:
Encode data using xor

Disassembly:
push esp
int 4
sub ebx, ebx
add esi, eax
invalid
jno 0x6b5ae7
push ds
cwde
mov bl, 0x44
cmp al, 0xbc
xchg ebx, eax
lodsd eax, dword [esi]
cdq
xor al, 0x47
jmp 0xf455d57d
sahf
push ss
out dx, al
jb 0x6b5b90
enter 0x6804, 6
push eax
mov edi, 0x5092f45a
mov ebx, ecx
adc al, 0x3c
add dh, byte [edi - 0x31]
xchg esi, eax
pop ecx
and ah, al
pop ds
dec eax
sbb al, 0x3a
xor bl, byte [ebx + edx*4 + 0x773782e8]
push ebx
push esp
jno 0x6b5b83
loope 0x6b5b46
adc al, 0xec
invalid

Function at 0x6ecd20
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
xchg ebx, eax
adc al, 0xde
mov bh, 0xb0
mov al, 0xa3
and ch, bh
xchg ebp, eax
out 0x23, eax
les ecx, [esi + edx*4 + 0x5ff8ba19]
fist word [ebx - 0x3fe80547]
push 0x63
shl ecx, 1
das
mov eax, 0xadef6107
out dx, ax
cli
dec ebx
and al, 0x4d
mov word [ecx], ds
cmp byte [eax], 0x33
mov eax, dword [0xa8f2fce1]
cld
test al, 0xf5
cld
test al, 0xf5
outsd dx, dword [esi]
jno 0x7bb59ac3
lodsb al, byte [esi]
mov ebx, 0xbed351c1
sbb dword [edi], 0xffffffa8
imul esp, dword [edx], 0x74772ba1
xchg byte [edi + 0x1b9398a6], bh
mov dh, 0xc2
xchg edi, eax
xchg esi, eax
xor al, 0xfd
or dl, byte [eax + esi*2 + 0x29d3fc05]
bound ebp, qword [ebp - 0x46]
sbb eax, 0xcdeba335
insb byte es:[edi], dx
jb 0x6ecced
push edx
sbb byte [eax + ebp*2 - 0x765ddc72], bl
sbb byte [esi], al
push edx
mov cl, 0x5e
fcom dword [ebx - 0x45ce198f]
daa
pop ss
xchg ebp, eax
invalid
Function at 0x6eee00
Capabilities:
Encode data using xor

Disassembly:
jle sym.ECMTitanium.exe__TPerformanceGraph_PaintBar_qqr15Graphics_TColorll
and eax, 0xe640762e
xchg ebx, eax
invalid
mov dword [0x61bb1213], eax
sub eax, 0xbb8501c6
and ecx, ebx
loop 0x6eeda5
test dword [eax + 0x12], eax
or byte [ebp - 0x6d], 0x7f
xor al, 0xb
dec eax
cmp eax, 0x9fe1c646
or ebp, edx
outsd dx, dword [esi]
xchg esi, eax
xchg ecx, eax
or esi, dword [ebx]
salc
push eax
dec esp
sbb esi, dword [esi - 0x89c3cf0]
int3
ret
inc esi
fst dword [ebx - 0x347854c1]
jbe 0x6eedf8
jge 0x6eee37
loopne 0x6eed7b
push ss
sahf
mov al, byte [0x4ab922aa]
retf 0x20c0
push eax
in eax, dx
test dword [edx + 0x74], esp
cmc
frstor dword [ecx]
xor bl, ah
jae sym.ECMTitanium.exe__TPerformanceGraph_PaintLine_qqr15Graphics_TColorll
salc
and ebp, dword [esi + 0x67]
sar byte [eax - 0x643ede63], 1
xchg ebx, eax
mov edi, 0x4af74ef
mov cl, 0xe1
and al, 0xb7
out dx, eax
je 0x6eedc2
add al, 0xb1
loope 0x6eed97
loopne 0x6eedd0
loopne 0x6eee73
stc
cwde
cmp al, 0x4c
ret
pushal
pop ss
invalid
jne 0x6eeec9
inc ebx
ret
loope 0x6eeec9
popal
jnp 0x6eee58
pop esp
xchg ebx, eax
mov bh, 0x4a
loopne 0x6eee10
and eax, 0xdb0dcc70
aas
inc ebx
push edx
arpl word [edx - 0x36f81dc2], cx
frstor dword [ecx + ebx - 0x7a87bcd1]
jl 0x6eee63
mov cl, 0xbd
loope 0x6eeef3
pop edx
dec esp
out dx, al
pushal
xor byte [ecx - 0x1f], ah
neg byte [esi - 0x678ecd87]
mov al, byte [eax - 0x386c552e]
pop ebp
out 0x4c, eax
push esp
sub eax, 0x56045f54
add eax, 0x23e9a996
int 0x56
inc edx
xchg edi, eax
invalid
stosb byte es:[edi], al
salc
je 0x6eef3e
invalid
scasb al, byte es:[edi]
lodsb al, byte [esi]
Function at 0x75fed4
Capabilities:
Encode data using xor

Disassembly:
popfd
inc si
xchg ebx, eax
fnstenv [eax + 0x4b]
hlt
out dx, eax
cmpsb byte [esi], byte es:[edi]
push esp
int 0x56
fdiv dword [eax]
mov esp, 0x735ab5bf
and dl, byte [edx + ecx*4 + 0x1f884efb]
mov dl, 0x50
xchg edx, eax
push edi
invalid
movsd dword es:[edi], dword [esi]
add byte [0x52538220], ah
scasb al, byte es:[edi]
inc ebx
pop ss
push ebp
dec esi
mov al, 0xab
xchg ebx, eax
and dword [ebx], 0xffffffe1
shr byte [esi - 0x1e], 0xb2
dec edx
cdq
push 0x5de5f3a5
pop ebp
xchg esp, eax
ror eax, cl
mov al, byte [0x4ce7d1a3]
fld xword [ecx + 0x4b]
and dword [ebx - 0x134c72d8], 0x38
xchg esp, eax
mov cr2, edi
mov bh, byte [eax - 0x66]
jecxz 0x75feb9
test edi, ebx
inc ebx
mov byte [0x3923eb57], ch
loope 0x75fea7
fisub word [eax - 0x109ef884]
cmp eax, 0x5ac91504
lahf
mov edx, 0x9d2eb206
adc eax, 0xba9f5ac9
push es
mov dl, 0x2e
popfd
jecxz 0x75ff95
rcr dword [ebx - 0x32c5d94c], 1
xor dword [eax - 0x1e7ca90f], ecx
je 0x75ff20
and ecx, dword [eax]
in al, 0x99
pop edx
mov al, 0xbe
neg bh
xchg ebx, eax
bswap edx
xchg ecx, eax
jecxz 0x75ff44
retf 0xe391
js 0x75ff07
outsd dx, dword [esi]
cld
xchg ecx, eax
sub byte [edx], al
loopne 0x75ff68
or eax, 0x1c44685b
xchg ebx, eax
push es
imul esi, dword [ebp - 0x7b85eb03], 0xffffffaa
jns 0x75fef0
and eax, esp
retf 0xcff6
loopne 0x75ff6b
mov eax, dword [0xced7cd80]
or ch, 0xd7
into
mov eax, dword [0x6ba9e055]
dec eax
sar byte [edi], 0xe0
in al, 0xee
mov cl, 0x68
inc esi
push ebp
fmulp st(5)
invalid
mov dword [edx + 0x7bd05d7], ebp
loopne 0x75ffb8
push ds
aad 0x95
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
xor dword [ebx + 0x1c0d20cd], eax
test eax, 0xc500f583
and ah, byte [eax]
jle 0x75ff95
invalid
pop esp
and bh, dl
insd dword es:[edi], dx
mov byte [0x8b6be1f9], al
and bh, byte [edi + ebx]
Function at 0x7607b0
Capabilities:
Encode data using xor

Disassembly:
iretd
or al, 0xb3
ret 0xb322
cmp dword [ebx], edi
pop ebx
and bh, byte [edi]
out dx, al
xchg ebp, eax
pop ebp
aaa
dec edi
pushfd
je 0x76079a
xlatb
daa
jp 0x760712
loope 0x7606ee
cld
or byte [ecx], ah
sal dword [eax], cl
add esi, dword [eax - 0x29adfc5a]
outsb dx, byte [esi]
lcall 0x24ad, 0x314f3acd
and esp, edx
out 0x2f, eax
xchg eax, esp
imul ebx, eax, 0xffffffeb
push ecx
adc byte [ebp - 0xe], dh
int 0x57
call 0x56031ceb
wait
or byte [esi + esi], dl
adc al, 0x36
and ebp, ebx
in al, dx
xor dword [esi + ebp*2 - 0x77], ebx
mov bl, 0xfd
cmp al, 0xcf
xchg ebx, eax
pop esp
outsb dx, byte [esi]
mov dword [ebx - 0x6c30c303], esi
adc al, 0x2d
and dword [ebx + ebp*8], eax
daa
jne 0x760751
stc
adc al, 0x79
movsb byte es:[edi], byte [esi]
mov ecx, 0x3993bebd
dec edx
pop edx
fbstp tbyte [edx - 0x4a]
jnp 0x760715
loopne 0x7606fe
shr dword [ebp - 0x41], 0xce
dec esi
xor eax, 0x937465d1
sbb byte [edx], 0x97
add eax, dword [edx + 0x3b]
popal
clc
loope 0x7607b2
cli
cwde
inc ebp
out dx, eax
out dx, al
std
xor ch, cl
add byte [eax - 0x73a93477], 0xda
mov edx, ds
lodsb al, byte [esi]
and eax, dword [esi + 0x2ff2f225]
in eax, 0xd3
push ecx
lahf
xor eax, 0x1d8ab393
ficomp dword fs:[edi - 0x21a8e308]
clc
sbb al, 0x57
fisub word [edx - 0x5f]
mov eax, dword [0x8a473371]
lds eax, [ebp + edx - 0x6d]
push eax
xor dword [edx], ecx
clc
sbb al, 0x57
push edi
fisub word [edx - 0x5f]
mov eax, dword [0x8a473371]
lds eax, [ebp + edx - 0x6d]
push eax
xor dword [edx], ecx
stc
nop
lahf
sbb al, 0x91
test al, 0xac
rcl byte [ebx - 0x4229f90], 0xb9
inc ecx
js 0x760757
iretd
Function at 0x76e46c
Capabilities:
Encode data using xor

Disassembly:
add byte [ebp - 0x2fa998c5], 0x61
jbe 0x76e4a0
ret 0x3da7
mov ecx, 0xd43bb86
and dh, byte [edx + 0x12]
wait
mov eax, dword [0xe36ebd7]

Function at 0x77455c
Capabilities:
Encode data using xor

Disassembly:
pop edi
pop ebx
sbb al, 0x42
fcmovbe st(0), st(3)
stc
push ds
jmp 0x7744f2
div byte [ecx]
fdivr dword [edi]
xor eax, ebx
aas
cmp al, ah
scasb al, byte es:[edi]
daa
add eax, 0xe3b73f19
or eax, 0xbae5bbcd
int 0xbb
in eax, 0xba
or eax, 0xdc1f168a
and byte [esi - 0x5e9a10c9], cl
xlatb
dec esp
aad 0xaf
sbb esp, eax
xchg esi, eax
xchg ebx, eax
xor al, 0x5b
mov ebp, 0x53ce405d
jge 0x774500
push ss
daa
aaa
xchg esp, eax
add al, 0x65
ja 0x7744df
lodsd eax, dword [esi]
loop 0x7744e5
cli
ljmp 0xb58f
mov byte [0x6bce7d56], al
jmp 0x7744f3

Function at 0x77e260
Capabilities:
Encode data using xor

Disassembly:
les esi, [ecx - 0x2ee9b67d]
invalid
div dh
jb 0x77e1e9
pop ebp
mov edx, eax
sbb ch, byte [edx - 0x1f]
cli
adc dword [ebp + 2], edi
lcall 0xe759, 0x15eb3558
and dword [ecx - 0x6249aaf2], ecx
scasb al, byte es:[edi]
pushfd
iretd
lds ebx, [ecx - 0x4b]
add eax, 0xdad8c3f5
cmpsd dword [esi], dword es:[edi]
mov ebp, eax
movsb byte es:[edi], byte [esi]
pop ds
add byte [0xe2279d7e], cl
xchg esp, eax
popfd
daa
loop 0x77e191
jle 0x77e241
or byte [0x117b336c], dh
cld
or ch, byte [ecx + 0x76303ac8]
pop ebp
xor byte [esi + 0x5d], dh
adc eax, edx
outsd dx, dword [esi]
sbb eax, 0x1a358fc0
je 0x77e1a8
in al, 0x35
mov ch, 0x53
cmpsb byte [esi], byte es:[edi]
test dl, ah
out dx, eax
push eax
adc cl, byte [eax - 0x7d58cedf]
dec esi
cmc
in eax, 0x7b
invalid
push cs
mov word [eax], cs
cdq
shr dl, 1
dec eax
xor eax, dword [ebp + 0x347c0a5f]
adc ebp, dword [ecx - 0x63]
mov bh, 0x98
xor al, 0x71
sahf
mul byte [ebp + 0x4b]
dec esi
faddp st(6)
mov esp, 0xc2f4e81
das
or al, 0x56
das
or al, 0x56
out dx, al
loope 0x77e2d1
dec bl
push edx
or esp, ecx
jg 0x77e20a
jb 0x77e1f9
invalid
Function at 0x7ab5ec
Capabilities:
Encode data using xor

Disassembly:
or al, 0x2e
add eax, 0xe23c1d11
sal dword [ebx], cl
daa
pop eax
pop ebx
fsub st(6), st(0)
in eax, 0x4a
pop esi
invalid
mov eax, dword [0xd832095]
jns 0x7ab5aa
sub eax, 0x10e02030
fst qword [eax]
xchg ecx, eax
cmpsb byte [esi], byte es:[edi]
jb 0x7ab4ff
push ss
xor al, 0x16
in al, 0xf8
sub byte [ebp + 0x758e0380], bl
mov word gs:[edi], ds
aas
jne 0x7ab56c
mov ch, ah
cmp esi, esp
mov cl, 0x74
retf
jl 0x7ab559
aaa
sbb eax, 0x65729057
fcomp dword [eax + ebx + 0x169b9994]
movsb byte es:[edi], byte [esi]
sbb dword [ebx], esi
pop edi
sbb byte [ecx + ebx*4 + 0x19a4169b], dl
xor esp, dword [edi + 0x5f]
test al, 0x5f
lodsd eax, dword [esi]
dec ebx
retf
dec edx
jb 0x7ab653
invalid
repne movsw word es:[edi], word [esi]
movsd dword es:[edi], dword [esi]
or eax, 0x681cc2d
loopne 0x7ab625
sbb ch, bl
in eax, 0x84
loope 0x7ab5ea
mov ebx, 0x675f0607
fcmovb st(0), st(7)
inc edx
invalid
or al, 0xd4
fist word [esp + esi*4 + 0x73]
aam 0xdf
push esp
mov ah, 0x73
pop ds
imul edx, dword [eax], 0xffffff84
fcmovnu st(0), st(2)
xchg edx, eax
push ebp
jecxz 0x7ab5a0
inc byte [edx]
sbb edi, ebx
push 0x27
call 0x48ea36cd
rol byte [ecx + 0x70], 0x9e
push 0xb158c412
and eax, 0x84dba5b6
mov ah, 1
cli
inc eax
mov edx, 0x67872bd2
push ss
wait
in al, 0x4c
jne 0x7ab6c2
pop esi
aad 0x8e
int3
popal
mov ebx, 0xa2aa932d
in eax, 0xcf
xor dword [edi], ecx
sub al, byte [ebp + 0x6fe81d20]
add eax, 0xb321c28b
fistp qword [ebx]
loop 0x7ab66e
ret
js 0x7ab6d9
leave
je 0x7ab6ca
loop 0x7ab60f
sahf
pushal
out dx, eax
lodsb al, byte [esi]
mov ds, word [ecx - 0x19]
shr edx, 1
or byte [edx + edi + 0x673f4562], al
je 0x7ab610
ror cl, cl
push fs
jge 0x7ab697
out 0xef, eax
dec esi
jb 0x7ab70d
adc edi, dword gs:[ebx]
mov bh, 0x97
xchg edi, eax
jne 0x7ab70c
aas
mov eax, dword [0x9aeff6b]
mov eax, dword [0xa8f542c4]
cld
sbb edi, dword [ecx]
outsd dx, dword [esi]
push esi
enter 0x59c0, 0x24
inc esp
aas
xchg esi, eax
mov esp, 0xed5efb65
aaa
test eax, 0xdf49dc9e
add dword [edi - 0x34], ebp
popfd
sahf
cli
xor dword [edx], edx
dec edi
cmp byte [ecx + 6], 2
mov dword [0x307a6c52], eax
add ah, byte [ebx + 0x307a6c52]
cmp bh, byte [edx - 0x1f]
jnp 0x7ab747
cmp byte [ebp - 0x6d], bl
mov eax, 0x44fabd51
push cs
invalid
push ecx
mov ebp, 0x8c0e44fa
mov eax, 0x2bae43a7
adc eax, 0xe2c0ba86
sti
mov al, 0x73
add eax, 0xed404c88
mov ebx, 0x6bea6693
fild qword [ebp + ecx*2 + 0x63]
aaa
nop
xchg edi, eax
sub eax, 0x982bfb08
dec edx
in al, 5
pop ds
fcom dword [ecx]
cmp byte [eax + 0x17], 1
inc ebx
mov dword [ebx - 0x6e], esp
jmp 0x878405b2
aaa
retf

Function at 0x88c294
Capabilities:
Encode data using xor

Disassembly:
sti
xor dword [edx + 0x188f02af], edx
aad 0xd
invalid
Function at 0x401c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x407018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov dword [ebp - 0x10], 0x696e6977
mov dword [ebp - 0xc], 0x2e74656e
mov dword [ebp - 8], 0x6c6c64
mov dword [ebp - 0xa0], 0x65746e49
mov dword [ebp - 0x9c], 0x74656e72
mov dword [ebp - 0x98], 0x63617243
mov dword [ebp - 0x94], 0x6c72556b
mov word [ebp - 0x90], 0x41
mov dword [ebp - 0x2c], 0x65746e49
mov dword [ebp - 0x28], 0x74656e72
mov dword [ebp - 0x24], 0x6e65704f
mov word [ebp - 0x20], 0x41
mov dword [ebp - 0x8c], 0x65746e49
mov dword [ebp - 0x88], 0x74656e72
mov dword [ebp - 0x84], 0x6e6e6f43
mov dword [ebp - 0x80], 0x41746365
mov byte [ebp - 0x7c], 0
mov dword [ebp - 0x50], 0x70747448
mov dword [ebp - 0x4c], 0x6e65704f
mov dword [ebp - 0x48], 0x75716552
mov dword [ebp - 0x44], 0x41747365
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x78], 0x70747448
mov dword [ebp - 0x74], 0x646e6553
mov dword [ebp - 0x70], 0x75716552
mov dword [ebp - 0x6c], 0x41747365
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x3c], 0x70747448
mov dword [ebp - 0x38], 0x72657551
mov dword [ebp - 0x34], 0x666e4979
mov word [ebp - 0x30], 0x416f
mov byte [ebp - 0x2e], 0
mov dword [ebp - 0x64], 0x65746e49
mov dword [ebp - 0x60], 0x74656e72
mov dword [ebp - 0x5c], 0x64616552
mov dword [ebp - 0x58], 0x656c6946
mov byte [ebp - 0x54], 0
mov dword [ebp - 0xb4], 0x65746e49
mov dword [ebp - 0xb0], 0x74656e72
mov dword [ebp - 0xac], 0x736f6c43
mov dword [ebp - 0xa8], 0x6e614865
mov dword [ebp - 0xa4], 0x656c64
mov dword [ebp - 0xcc], 0x70747448
mov dword [ebp - 0xc8], 0x52646441
mov dword [ebp - 0xc4], 0x65757165
mov dword [ebp - 0xc0], 0x65487473
mov dword [ebp - 0xbc], 0x72656461
mov word [ebp - 0xb8], 0x4173
mov byte [ebp - 0xb6], 0
mov dword [ebp - 0x1c], 0x64616f4c
mov dword [ebp - 0x18], 0x7262694c
mov dword [ebp - 0x14], 0x41797261
call fcn.00401ad0
mov edx, eax
call fcn.00401b20
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
push edx
call edi
lea ecx, [ebp - 0x10]
push ecx
call eax
lea edx, [ebp - 0xa0]
mov ebx, eax
push edx
push ebx
call edi
mov dword [esi], eax
lea eax, [ebp - 0x2c]
push eax
push ebx
call edi
lea ecx, [ebp - 0x8c]
push ecx
push ebx
mov dword [esi + 4], eax
call edi
mov dword [esi + 8], eax
lea edx, [ebp - 0x50]
push edx
push ebx
call edi
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x78]
push eax
push ebx
call edi
lea ecx, [ebp - 0x64]
push ecx
push ebx
mov dword [esi + 0x10], eax
call edi
lea edx, [ebp - 0xcc]
push edx
push ebx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
call edi
lea ecx, [ebp - 0xb4]
push ecx
push ebx
mov dword [esi + 0x1c], eax
call edi
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 0x20], eax
xor ecx, ebp
mov eax, esi
pop ebx
call fcn.00404e6c
mov esp, ebp
pop ebp
ret