joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5212d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x5213f1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x5213d5
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x521327
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x521305
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x521e39
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x521e90
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x521e90
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x521e90
xor eax, eax
inc eax
jmp 0x521e92
xor eax, eax
leave
ret 0x10
Function at 0x521ebb
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x521f29
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x5909c4
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x521f20
cmp dword [ebp - 0xc], 4
jne 0x521f20
cmp dword [ebp - 0x10], edi
je 0x521f20
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x68c440], edi
xor eax, eax
jmp 0x521f68
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x68c440], edi
jge 0x521f63
lea eax, [ebp - 0x34]
push eax
mov dword [0x68c440], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x521f63
cmp word [ebp - 0x14], 5
jb 0x521f63
call fcn.00521e96
test eax, eax
je 0x521f63
emms
mov dword [0x68c440], 1
mov eax, dword [0x68c440]
pop edi
leave
ret

Function at 0x552151
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x552189
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005501db
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005501b3
jmp 0x552195
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x553843
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x553885
call fcn.00559581
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x553885
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x55387c
xor eax, eax
jmp 0x55388d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00553893
pop edi
pop esi
pop ebx
ret 4

Function at 0x559ab1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x559adf
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x559afd
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00559a17
jmp 0x559afd
mov eax, dword [esi + 0x14]
test eax, eax
je 0x559afd
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00559a17
test edi, edi
mov eax, edi
jne 0x559ae7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x22c5f39
Capabilities:
Encode data using xor

Disassembly:
ja 0x3d97fde
mov ecx, 0x57ad53b9
lea edi, [edi + ecx - 0x57ad53bd]
mov eax, dword [ecx + edi - 0x57ad53b9]
jmp 0x35d379d
lea edx, [ecx*8 - 0x577805dd]
xor eax, ebx
jmp 0x360d468
xchg esi, eax
push dword [ebx]
ret
xor eax, ebx
call fcn.0366df90
push ss
call dword [esi]
xor ecx, 0x97102596
push 0xffffffffffffffb0
pop ss
enter 0x1e0b, 0xffffffffffffffb8
mov dword [0x62b6744], eax
push ebx
fild dword [ebx]
mov esi, 0xd9838623
xor byte [edx], dl
popal
popfd
adc byte [esi + 0xdf52979], al
add byte [edi + 0x601ab06a], dl
or ebx, dword [esi]
push 0xffffffffffffffb0
sbb ah, byte [eax + 0xb]
push ds
mov eax, 0xc3673446
push ss
push ebx
fild dword [ebx]
dec esi
jle 0x3d97fdc
push ebx
pop es
xchg edi, eax
inc ebp
add byte [eax + 0x21], dh
xchg al, bh
inc eax
into
pop esp
cmp esp, edi
sahf
loope 0x3d98037
mov eax, 0xdfbe2064
cmc
xor esp, dword [eax - 7]
stc
test eax, 0x7a914353
out dx, al
test eax, 0x650647d1
and edi, dword [edx + 0x29]
loope 0x3d9800c
cld
sahf
loope 0x3d97fe4
shl edx, 1
xor eax, 0x5a243f0c
xor byte [edi - 0x2995436d], bh
dec edx
mov eax, 0x204ad66a
jl 0x3d98021
sbb ebx, ebp
mov al, 0x87
add dl, byte [ebx]
sal dword [0xaff8307], 1
mov ch, 0x32
xor eax, 0x2c4707d
sbb dl, byte [ebx + 0xe32abc5]
mov al, 0x55
add ebx, dword [esi - 2]
jmp 0x3d980ea
js 0x3d980ec
push eax
mov cs, ecx
retf 0x66d9

Function at 0x35c2a27
Capabilities:
Authenticate hmac

Disassembly:
dec ebp
arpl di, di
dec esp
mov dword [esp + ebx - 0x3fff], esi
dec ebp
add edx, edi
inc ecx
ror dh, 0xe2
inc esp
xadd dword [esp + ebx*2 - 0x7ffe], esp
dec ebx
dec eax
mov esi, ebp
ror word [esp + ebx - 0x3ffd], cl
dec eax
lea ebp, [ebx + ebp - 0x4002]
mov dword [ebp + ebx - 0x3ffe], esi
dec ecx
shl ebx, cl
dec eax
xadd dword [esp + ebx*8 - 0x1fff0], ebx
inc sp
xadd dword [esp + edi*2 - 0x15a], esi
pop ebx
jae fcn.022bb722

Function at 0x35c2a7b
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, ecx
sar edx, 0xba
or dx, 0x4a24
call fcn.035d4005
bswap eax
mov ecx, dword [esp + 6]
dec eax
jmp 0x3618adb

Function at 0x35fffdf
Capabilities:
Authenticate hmac

Disassembly:
add esi, eax
neg ecx
mov dword [esp + ecx - 0x5bf80002], ecx
mov edx, dword [ebp + ecx - 0x5bf80002]
pop eax
movzx ecx, byte [edi + eax - 0x5bf80007]
lea eax, [eax + eax*8 - 0x484d3bf5]
sbb eax, eax
sub edi, 5
dec eax
jl 0x3d579db

Function at 0x363cb09
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [ebp]
movzx ecx, byte [edi + 4]
shl word [esp + 8], 0x43
mov edx, 0x5bbb5507
lea edi, [edi + edx - 0x5bbb5502]
sets dl
xor cl, bl
sub cl, 0xba
dec dl
rol cl, 1
pop edx
not cl
add cl, 0x91
not cl
call fcn.036a1e70

Function at 0x36419b1
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 8]
je 0x35d5bd8
Function at 0x3646c41
Capabilities:
Execute syscall

Disassembly:
dec ecx
sal esi, 0xce
inc ecx
xor edx, ebp
inc ecx
push ebx
dec edx
mov dword [esp + esi - 0xabff8], 0x9bab7315
inc ecx
mov ecx, esi
inc edx
lea edx, [edx + ebx*2 - 0xe21d6c4]
inc edx
not byte [esp + esi*2 - 0x157ff9]
dec ebp
sub ecx, ecx
not edx
dec edx
ror edx, 1
xor cx, 0xeb01
inc cx
sar ebx, 0x4a
inc ecx
push ecx
bswap edx
dec edx
lea ebx, [ecx + ecx*8 - 0xf790bee]
inc ecx
movsx esi, bx
inc edx
dec ebp
or ecx, ecx
inc ecx
push ecx
ror ebx, 0x33
dec esi
mov dword [esp + ebx - 0x6a1bfff2], ebp
dec esp
lea edi, [ecx + ebx*4 + 0x7cba6f96]
call fcn.03d63afd

Function at 0x36483ed
Capabilities:
Check for vm using instruction vpcext

Disassembly:
dec ebp
arpl si, si
dec ebp
adc edx, esi
dec eax
mov dword [esp + eax - 0x13821bf0], 0x6a8f5220
dec eax
inc eax
dec ecx
inc edi
dec esp
mov edi, dword [ebp + eax - 0x13821bfd]
dec ecx
mov ebx, dword [edi + eax*2 - 0x27043802]
inc esp
movzx edi, word [esp + eax*4 - 0x4e086ff8]
jne 0x3cef74b
pop esi
dec eax
add esi, 0xfff6ffab
jmp esi

Function at 0x364dfb5
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test edx, edx
jmp 0x362a399
je 0x363f625
mov esi, dword [ebp + 0xc]
stc
test esi, esi
jmp 0x363f60f
je 0x363f625
mov eax, 0x5a4d
cmp ebx, esi
cmp word [edx], ax
je 0x23446a2
push ebp
add edx, esi
cmovg edx, ebp
btr edx, ebx
mov ebp, esp
mov edx, dword [ebp + 8]
test cx, si
sub esp, 0x114
test dl, 0x2e
test si, dx
push esi
cmc
jmp 0x22b7667

Function at 0x3656ca5
Capabilities:
Encode data using xor

Disassembly:
rol cx, 1
inc sp
xor ebp, ecx
dec edx
lea ebx, [ebx*2 + 0x108c8811]
dec eax
xor eax, edx
dec eax
lea ecx, [esp + ecx + 0x30]
setb bl
not ax
sal dx, 0x25
mov word [edx + ecx - 0x3f07a300], si
shl byte [esp + edx*2 - 0x7e0f45d8], 0x45
inc ecx
mov eax, dword [eax + edx*2 - 0x7e0f4600]
dec ebp
lea eax, [eax + edx*2 - 0x7e0f45fc]
inc ecx
xor eax, ebp
call fcn.0367d437
call fcn.035fbd75

Function at 0x365c7e7
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [esp + eax*4 - 0x6c00], 0x6687eaa5
neg edx
sal al, 0xc5
dec edx
bswap edx
xor ebx, edx
add esi, edx
mov ebp, dword [eax + ebp - 0x1afc]
rol ax, 0xa9
add dword [esp + eax - 0x36], ecx
pop edx
pop eax
pop ecx
ja fcn.03607c0d
Function at 0x366eaca
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [ecx + ebp - 0xba]
rol ecx, cl
and al, dl
movzx edx, cl
xor ecx, edx
not al
mov word [ebp + edx*2 - 0x16], ax
jne 0x3d757f3
mov dword [ebp], eax
mov ecx, dword [edi]
push 0x603e813c
mov edx, 0x869aa7b1
xor ecx, ebx
bswap ecx
call fcn.03649fbd
inc ecx
mov esp, 0xd2b62f24
inc ebp
mov ecx, esp
inc ecx
movsx ebx, cl
dec esp
mov esp, ebp
inc ecx
movzx eax, cx
inc esp
movzx edi, bx
jmp 0x3d3ad7d
inc ecx
jno 0x3d386e4
sub edi, 4
push ecx
mov edx, dword [edi]
jmp 0x3609ff6
movzx eax, cl
sar byte [esp + eax - 0x96], 0xa4
xor edx, ebx
call fcn.036e8034
dec ecx
inc edx
xor ecx, 0xc25ee80
mov dword [esp + eax*2 - 0x421c92c], edx
lea ecx, [edx + ecx - 0x28286b52]
not al
xor ebx, ecx
call fcn.03612859
mov edx, 0xe63e588a
movzx ax, byte [ebp]
add edx, 0xebda731
movzx ecx, dl
shl dl, 0x25
mov dl, byte [ebp + ecx*2 - 0x174]
inc cx
jge 0x235998b
inc ecx
sal edi, 0xbc
inc ecx
pop ebp
jae 0x3d770c1
neg edx
add ecx, 0x1ab886ad
dec edx
bswap edx
movsx eax, cx
sal al, 0xc2
xor ebx, edx
shr ecx, cl
push ecx
add esi, edx
sal dword [esp + ecx - 0xa5a35], 0xd0
or ecx, 0x571a8219
call fcn.03651a1d
mov edx, 0x57bfd389
movzx ecx, dx
mov edx, dword [edx + ebp - 0x57bfd389]
call fcn.036af95b
dec esp
mov dword [ebx + ebp - 0x2c], esp
inc ebp
mov esp, dword [eax + ebx*4 - 0x90]
dec esp
sub edi, ebx
dec esi
lea eax, [ebx + eax - 0x20]
inc ebp
xor esp, ebp
shr eax, 0x50
inc ebp
lea esp, [esp + ebx*2 - 0x5cbec2d5]
inc ecx
mov esi, 0xc1d7796
inc ecx
bswap esp
movzx esi, ax
inc ebp
movzx ebx, di
inc ecx
ror esp, 1
and eax, esi
inc ecx
xor ebx, 0x2b87e3b3
inc ecx
inc esp
dec edx
lea edx, [esi + ebx*4 + 0x792548ab]
inc ebp
or cl, bl
dec eax
lea eax, [eax*8 - 0x59e95ac3]
inc ecx
bswap esp
inc ecx
xchg ecx, ebx
shr bx, 1
inc ecx
push ebp
inc esi
xor dword [esp + ecx*2 - 0x48], esp
dec ebx
lea ecx, [ecx + edi*8 + 0x6c29dd87]
jmp 0x3671187
inc cx
ror edi, 0x2d
dec ebp
arpl sp, sp
call fcn.03d08a6a
sub edi, 4
mov ecx, 0xeb0511c
mov edx, dword [ecx + edi - 0xeb0511c]
xor edx, ebx
lea edx, [edx + ecx*2 + 0x1640494b]
jmp 0x35fa2f8

Function at 0x36d619e
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xbebb23ad
mov byte [esp + 1], cl
movzx ecx, byte [esi - 5]
ror eax, 0x93
sal eax, 0x34
or word [esp], ax
adc esi, 0xfffffffb
add byte [esp + 3], al
xor cl, bl
add eax, eax
shr eax, 0xb2
mov dword [esp + eax - 0x3ff8], eax
adc cl, 0xe
dec al
rol cl, 1
call fcn.03d34dcd

Function at 0x36e1013
Capabilities:
Check for vm using instruction vpcext

Disassembly:
shl dx, 0x64
lea edi, [edi + eax*2 - 0x74f84a77]
mov dword [esp + eax*2 - 0x74f84a78], edx
xor cl, bl
xor dl, 0x10
ror cl, 1

Function at 0x36e3ff4
Capabilities:
Encode data using xor

Disassembly:
not cl
not dl
call fcn.035d8697
Function at 0x3cf4579
Capabilities:
Check for vm using instruction vpcext

Disassembly:
sub cl, 0x3a
and dx, word [esp + edx*2 - 0x784b875b]
dec dx
not cl
xor dx, ax
push edx
rol cl, 1
xor bl, cl
lea ebp, [ebp + edx*2 - 0x784a4f28]
neg dword [esp + edx - 0x3c25278e]
push edx
jno 0x3d3b702
dec edx
shr cx, 0x47
adc ecx, ecx
push ecx
not edx
lea eax, [ecx + 0x35082e3e]
dec edx
not edx
push eax
rol edx, 3
pop eax
pop ecx
sar ax, 0xa1
xor ebx, edx
mov dword [ebp + ecx*2 - 6], edx
lea ebp, [eax + ebp - 0x35081725]
mov edx, ecx
shr cl, 0x67
pop edx
pop eax
pop ecx
jae fcn.03607c0d
inc cx
add edi, 0x2b49423a
ror dword [eax - 0x73], cl
cmp al, 0x95
or byte [esi + edi + 0x33], bl
inc cx
rol edi, 1
call fcn.03d11e5f
sbb eax, 0xf22c2080
mov dword [esp + edx - 0x55cc78ef], edx
xadd dword [esp + edx - 0x55cc78ef], ecx
not eax
sar word [esp + ecx - 0x55cc78ef], 0x89
or dword [esp + ecx - 0x55cc78ef], 0xb01e0736
sal byte [esp + edx - 0x55cc78ee], 0x27
lea eax, [eax + ecx - 0x3a3667e7]
shl word [esp + ecx - 0x55cc78ee], 0xad
xor ebx, eax
xor edx, edx
xor cx, dx
shl ecx, 0x4a
add edi, eax
sub dword [esp + edx*2], edx
mov cx, word [edx + ebp]
sub dx, 0x638b
neg dx
mov eax, 0x2737b19c
movzx eax, byte [esi + edx*2 - 0xc71b]
neg byte [esp + edx*2 - 0xc715]
xor al, bl
bswap edx
neg al
and dl, 0x32
not edx
dec al
xor dx, dx
dec dx
xor al, dl
neg edx
sar dword [esp], 0xe3
rol al, 1
add dword [esp], edx
jnp 0x3d98f82
xor dl, bl
dec dl
rol dl, 1
inc dl
and word [esp + 1], cx
mov dword [esp], 0xe020cb86
push ecx
neg dl
xchg byte [esp + 3], cl
mov eax, ecx
shr cx, 0xe7
xor bl, dl
dec ecx
lea edx, [esp + edx + 8]
xor al, al
xor cx, word [edx]
sar al, 0x81
shr eax, 0xec
mov dword [esp + eax*2 - 0x116c5c], eax
mov word [ebp + eax - 0x8b630], cx
not dword [esp + eax*4 - 0x22d8be]
mov dword [esp + eax - 0x8b630], edi
ret 4
mov word [ebp + eax - 0x3a7c253c], cx
pop edx
pop ecx
pop ecx
pop ecx
pop edx
js fcn.03607c0d
xor bl, al
lea eax, [esp + eax + 4]
dec dword [esp]
dec dl
shr dl, 0x42
mov byte [eax], cl
mov ecx, edx
movzx edx, byte [esi - 6]
ja 0x36e102c
sbb esi, 6
jmp 0x3d0b5df
Function at 0x3cfdd44
Capabilities:
Encode data using xor

Disassembly:
sal ecx, cl
push ecx
dec eax
push ecx
bswap eax
movsx edx, byte [esp + 4]
shr ecx, 0x88
jns 0x3d9fb6c
call fcn.03609a57
inc ecx
movsx edi, cx
dec edi
lea eax, [eax - 0x378]
inc ecx
xor edx, ebp
inc ecx
inc dword [ecx + 0x33]
aad 0x41
mov ebx, esi
inc eax
add dh, dh
jp 0x3da036c
out 0x37, eax
inc ebp
inc edi
mov ah, 0x7a
jl 0x3cfdd69
and dword [edx + 0x62], ecx
or ax, 0xff29
dec esi
pop edx
jb 0x3cfdd99
sub edi, edi
pop edx
push ds
or cl, byte [0x1e22ff29]
jbe 0x3cfdda5
sub edi, edi
pop esi
adc ah, byte [esi]
push ebx
call [esi + 0x12]
push ebx
into
jmp 0x3cfddef
cmc
sbb cl, byte [ebp + 0x34]
cld
mov ebx, 0x650647f3
das
dec esp
clc
jl 0x3cfdde6
add bh, cl
fdivr st(4)
je 0x3cfddec
add bh, cl
mov al, 0xfc
cmp byte [edx], dh
add bh, cl
mov word [eax - 0x30ffcdf8], ss
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
lds esi, [edi - 0x3745b6b3]
sbb dword [ecx + 0x1d], ebp
xchg esi, eax
add eax, dword [eax - 0x6e6dad3]
inc ecx
cld
cmp dword [ecx], edi
xor eax, 0x15fc41f9
sub eax, 0xfc41f93d
iretd
inc ecx
cld
adc eax, 0x41f93959
inc ecx
cld
sbb dword [ecx], esp
popal
cmp byte [edx], bh
or dword [ebp + 0x4c], 0x5b
cmpsb byte ds:[esi], byte es:[edi]
and dword [ecx + 0x38], esp
cmp al, byte [ebx + 0x3e5b4c4d]
cmpsb byte [esi], byte es:[edi]
adc eax, 0xfc344eee
ja 0x3cfddbb
test dword [0xdc642f65], 0xcf0031a0
test byte [eax], bh
mov ah, 0x31
add bh, cl
js 0x3cfde8a
fdiv dword [ecx]
add bh, cl
adc al, 0x74
les esi, [ecx]
add bh, cl
push 0x4db7c683
sbb ecx, edx
mov dword [ebp - 0x5ffec638], ebx
mov al, byte [0x55d29fc]
arpl word fs:[edx + 0x4d], sp
pop eax
fimul dword [ebx + 0x5a445866]
mov byte [ecx + edi*8], cl
ljmp 0x2528
or cl, byte [edi + 0x59]
cdq
mov cl, 0xfa
bound edi, qword [ecx]
xchg ecx, eax
mov cl, 0x84
dec esp
invalid
xor eax, 0x95ad4c87
dec eax
shl dx, 0xc8
push ecx
rol eax, 2
mov dword [esp + ecx*4 - 0x2c0003c], 0xf721fe82
xor ebx, eax
add esi, eax
xchg dword [esp + ecx*2 - 0x160001f], edx
movsx eax, cx
call fcn.03d8c44c
add ebp, 4
sar word [esp + 2], 0x62
shld dx, ax, cl
mov word [ebp], dx
ror dword [esp + 3], 0x15
pop eax
pop eax
jmp esi

Function at 0x3d2429e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xee39ac19
shl ax, 0x86
neg dl
mov dword [esp], 0xc37c32d
xor byte [esp + 3], 0x3f

Function at 0x3d25410
Capabilities:
Authenticate hmac

Disassembly:
xor ecx, 0xe09c73a9
call fcn.036bc204
Function at 0x3d29eee
Capabilities:
Execute syscall

Disassembly:
mov ecx, dword [esp + 1]
bswap edx
jmp 0x3d3427d
shr cl, 0xe2
inc dl
not cx
xor bl, dl
add ecx, 0xa9354d85
lea edx, [esp + edx + 4]
mov dword [edx + ecx - 0x53729972], eax
mov ecx, dword [edi + ecx - 0x53729971]
xor ecx, ebx
mov edx, 0xdbb7013f
neg ecx
inc dx
jne 0x36be77a
dec edx
lea ebp, [ebp + esi*4]
inc eax
and dh, bl
inc eax
sbb dh, 0x13
dec eax
xadd esi, ebx
inc sp
shrd eax, esp, cl
inc dx
mov dword [ebp + esi*8 - 8], eax
jmp 0x363b28f
shl cl, 0xc1
mov eax, dword [ebp + edx*2 - 0x6a5d5ed2]
mov dword [esp + edx*2 - 0x6a5d5ed2], 0x7207193e
mov cl, byte [ebp + ecx - 0x6a5d5f00]
add dword [esp + edx - 0x352eaf69], edx
lea ebp, [ebp + edx*2 - 0x6a5d5ed0]
sal dx, 0xa7
setnp dl
adc dl, byte [esp + edx - 0x352eb3fd]
sal eax, cl
xchg dword [esp + edx*2 - 0x6a5d68d4], edx
mov dword [ebp], eax
xchg esp, eax
push esp
sub al, 0x97
mov byte [0x458995], al
call fcn.0368fbdc
inc si
inc esi
mov esp, dword [ebp + esi*2]
inc edx
ror dword [esp + esi + 2], 0xee
inc ecx
mov cl, byte [esi + ebp + 3]
jb 0x36a9e39
mov ebp, 0xe396fa61
xchg esp, eax
mov bl, 0x5d
add ch, bl
jne 0x3d29fb0
mov eax, dword [0x6f0a02f6]
mov dl, 0xd0
add esp, dword [edi - 0x617700ee]
dec edi
cmc
cmpsd dword [esi], dword es:[edi]
adc al, 0xea
inc edi
fdivr qword [edi]
js 0x3d29f7a
loope 0x3d29fe9
popal
mov al, 0xd6
xor edx, ebp
adc eax, 0x86ad7ab8
dec edi
das
jp 0x3d29f29
xchg byte [edi + 0x2f], cl
mov dl, 0xd0
add ebp, dword [edx - 0x5e]
ja 0x3d29f38
rol byte [ebx], 1
bound edi, qword [edi]
pop ds
sub ecx, 0x5c6cd3a2
cmpsb byte [esi], byte es:[edi]
invalid
fdivr qword [ecx + 0x1b308925]
push edi
jno 0x3d29fdd
shr ah, 0x5d
arpl word [ebx + 0x43817e24], di
inc ebx
adc al, 0x23
inc esi
jno 0x3d29f9f
rcl dword [ebx], cl
inc esi
lds esp, [0x46231463]
cmp dword [ebp - 0x16ec1a98], ebx
pop ebx
mov dword [esp + 4], 0xc7bf210a
rol edx, 3
jmp 0x22b7e0e
neg dl
mov dword [esp], ecx
jmp 0x35dd500
scasb al, byte es:[edi]
cld
invalid
inc edx
call fcn.036e730f

Function at 0x3d4f431
Capabilities:
Encode data using xor

Disassembly:
inc dl
rol dl, 1
neg dl
lea ecx, [ecx + ecx*2 + 0x19bee5b3]
dec byte [esp + ecx - 0x19bee5a7]
mov dword [esp + ecx*2 - 0x337dcb5a], ecx
xor bl, dl
call fcn.036d994f
Function at 0x3d51347
Capabilities:
Encode data using xor

Disassembly:
adc word [esp + edx*2 - 0x619b9323], dx
shr byte [esp + edx - 0x30cdc991], 0xc7
dec ecx
movzx eax, byte [esp + edx - 0x30cdc992]
call fcn.03d5bf1f
push 0xef377d91
mov edx, dword [edi]
rol word [esp + 2], 0x67
mov ecx, 0x19ab9915
lea edi, [edi + ecx*4 - 0x66ae6450]
push ecx
push ecx
xor edx, ebx
movsx eax, cl
lea edx, [eax + edx - 0x253e699c]
and cl, byte [esp + eax - 0xc]
sbb cl, 0x37
inc byte [esp + ecx - 0x19ab99d4]
bswap edx
neg al
rol edx, 3
or eax, ecx
sbb eax, 0xe078e0c
or ecx, ecx
lea edx, [edx + ecx*4 + 0x7ee30b13]
sar word [esp + ecx - 0x19ab99d6], 0xa6
sal cx, 0xcd
neg edx
not ecx
push eax
dec edx
dec ecx
pop eax
xor ebx, edx
shl cl, 0x81
setge byte [esp + eax*4 - 0x2e902fc7]
add esi, edx
push ecx
mov edx, dword [ebp + eax - 0xba40bf3]
inc byte [esp + eax*2 - 0x174817d7]
mov cx, word ss:[edx + eax*8 - 0x5d205f98]
mov ecx, dword [edi]
mov dword [esp], edx
xor ecx, ebx
shl dword [esp], 0xf3
adc dx, dx
dec ecx
xor ecx, 0x618db31b
sub word [esp + 2], dx
adc edx, dword [esp]
not ecx
jne 0x36565f0
dec esp
mov edi, dword [ebp]
dec esp
mov esp, dword [ebp + 8]
mov ebx, 0x1b9bc6a1
mov edx, ebx
dec ebp
add edi, esp
mov edi, 0x5c11d093
inc esp
movsx ebx, bx
dec esp
mov dword [ebx + ebp - 0x1b9bc699], edi
inc edx
mov ecx, dword [ebx + eax - 0x1b9bc6a1]
inc ecx
xor ecx, ebp
inc esp
mov edi, edi
inc esp
movsx esp, dl
sub ecx, 0x67ad1f02
dec ecx
inc esp
rol ecx, 1
inc ecx
mov esi, 0xbfb09caa
inc ecx
and ebx, esi
dec ecx
ror esp, 0xfd
not ecx
dec ebx
lea esi, [ebx + esi*4 - 0x2fc15f9]
xor ecx, 0x70182193
dec eax
rol ebx, 0x46
neg ecx

Function at 0x3d602ad
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [esp + eax*2 - 0x7b24fa1a], ecx
bswap edx
xor ebx, edx
add dword [esp + eax*2 - 0x7b24fa1a], eax
and eax, 0x1bb6d90e
call fcn.03d21292