joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c5970
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [edi + eax - 0x74c19839]
movsx edx, al
neg dl
or eax, edx
lea edi, [edi + edx - 0xc3]
xor ecx, ebx
add dl, dl
neg dl
rol ecx, 2
sub ecx, 0xe42b39ac
call fcn.006e6c8c
setno dl
jp 0xbd5217
dec eax
add ebx, edi
inc ecx
ror esi, 0xb1
dec ecx
shl edx, 0x2b
inc ecx
pop ecx
inc ecx
pop ecx
inc ecx
pop eax
jns fcn.0085e60e
mov eax, 0xb80fe12c
rdtsc
mov ecx, 0xac0bf20e
sub esi, 8
inc ecx
mov dword [esi + 4], eax
lea eax, [ecx - 0x374a59d6]
mov dword [esi + eax - 0x74c19839], edx
lea ecx, [eax + ecx*4 - 0x2a46b471]
jle 0x7be407
xchg dword [esp + edx - 0x68ccfaad], edx
shr dword [esp + eax - 0x399dc352], 0xd
xor ecx, 0xb0dfe2a
pop eax
neg edx
bswap ecx
inc eax
xor ebx, ecx
ror al, 0x62
call fcn.0073d820
mov dword [esp + 4], edx
rol ecx, 1
add ecx, 0x90655b2
neg ecx
movzx eax, dx
xor ebx, ecx
xadd dword [esp + eax*2 - 0x17655], eax
ror word [esp + eax - 0x2bffffd2], 0x43
adc edi, ecx
call fcn.008a5a5b
not ecx
rol edx, 0x65
or dword [esp + edx*2 - 0x3b], edx
pop edx
or eax, ecx
lea ecx, [edx + edx*2 - 0x21caa8d6]
shl edx, cl
mov dword [edx + ebp + 4], eax
sal cx, cl
ja 0x779226
xor ecx, ebx
sal eax, 0xa1
xchg dword [esp + edx - 0x553945e7], edx
dec ecx
bswap ecx
jmp 0xbc5007

Function at 0x7cfaab
Capabilities:
Check http status code

Disassembly:
mov ecx, 0
mov edi, 0x6c0775b0
sub ebx, ecx
lea esp, [esp + 4]
call fcn.006f8ba0
not edx
lea edx, [edx + eax*4 - 0x3d2dad67]
xchg byte [esp + eax*2 - 0x1011a5], al
xor edx, 0x9e076087
pop eax
inc edx
bt ax, 0xa6
sar eax, cl
xor edx, 0x6f177808
lea edx, [eax + edx + 0x6e33ffef]
rol eax, cl
xor ax, ax
neg edx
dec al
cmovs ecx, eax
lea edx, [edx + eax*4 - 0x32245411]
jo 0x8490d3
ror cl, 0xe2
shl eax, 0x66
xor ebx, edx
div al
xor cl, ah
adc edi, edx
mov eax, dword [ebp + eax*4 - 0x8000154]
lea edx, [ecx*8 - 0x5759ef59]
mov cx, word [ecx + ebp - 0x800fb]
and edx, edx
inc edx
adc ebp, 6
bts edx, edx
bt edx, 0x24
jae 0x8aa84e
mov word ss:[eax], cx
mov eax, 0x6c046024
jmp edi
Function at 0x7d7012
Capabilities:
Authenticate hmac

Disassembly:
dec ecx
lea esp, [esp + 0x18]
jne 0x87abe9
pop edi
not edx
mov eax, 0x3ea54dac
shl al, 0x45
call fcn.006e7b56
sub dword [esp + 3], 0x13a6a42e
add eax, edx
shl dword [esp + 4], 0x5c
js 0x877c1a
mov edx, 0x59358c95
lea edi, [edx + edi - 0x59358c99]
mov edx, dword [edi + edx - 0x59358c95]
mov eax, 0xa32d6031
xor edx, ebx
rol ax, 0xc2
mov ecx, eax
ror eax, cl
bswap edx
setae cl
lea edx, [edx + eax - 0x5b349436]
ror ecx, 0x37
xor edx, 0x330d716
bswap ecx
or eax, eax
lea edx, [edx + eax*4 + 0x1dd1b9ed]
rol edx, 1
xor ebx, edx
neg cl
shr eax, cl
bts eax, eax
adc ebp, edx
or ecx, 0x66333bb0
mov eax, dword [esi + eax*2 - 0x2d196c2]
mov cx, word [esi + ecx - 0x66333bb1]
mov edx, 0x538939b5
not dx
inc edx
lea esi, [esi + edx - 0x5389c645]
xor edx, edx
shl edx, 0xa3
mov word [eax + edx*8], cx
jp 0x786f0b
div al
xor ebx, ecx
and ax, ax
lea edx, [eax - 0x6b5295fc]
adc edi, ecx
movzx ecx, al
sal edx, 0x8b
jbe 0xbd433d
btr cx, cx
not ax
xadd cl, ch
shl cl, 0x43
or dx, ax
mov eax, ecx
shr cx, 0xa1
mov word [ecx + esi - 0x487e], dx
call fcn.0079c7fa
mov ecx, 0x8428f623
mov edx, dword [esi]
movzx eax, cx
rol eax, 0x2c
lea esi, [esi + eax*4 - 0x3d88bffc]
ror eax, cl
xor edx, ebx
call fcn.006d14c3
mov edx, dword [esi]
mov ecx, 0xa221c0bb
add esi, 4
rol ecx, 2
ror ecx, cl
and ecx, 0xad17513e
xor edx, ebx
lea eax, [ecx + ecx*4 - 0x3c5e7a78]
neg ecx
dec edx
inc cl
rol edx, 1
xchg ecx, eax
not edx
btc ax, ax
cwde
bts cx, ax
neg edx
sal eax, 0x82
sbb cx, cx
sub cl, cl
xor ebx, edx
add edi, edx
mov ebp, dword [ebp]
movsx edx, al
btr dx, dx
jb fcn.008892e8
bt edx, edx
xor eax, ebx
movsx ecx, dx
dec eax
and edx, ecx
or ecx, ecx
je 0xc13f6d
shld ax, dx, cl
mov ecx, dword [esp]
neg ecx
mov word [esi], ax
not byte [esp]
movzx edx, cl
sar cl, 0x61
mov dword [esp + edx - 0xf1], ebp
ret
neg eax
xchg dx, cx
or dl, 0x8d
imul ecx, edx
not eax
lea eax, [eax + edx*8 - 0xe059b04]
ror ecx, 6
dec cl
xor ebx, eax
lea ecx, [ecx + edx*4 + 0x2828c380]
or ecx, ecx
adc ebp, eax
shr cx, 6
mov ax, word [esi + edx - 0x8d]
ror dx, 0xed
lea edx, [ecx*8 + 0x44a4ee80]
mov dx, word [ecx + esi - 0x28280318]
mov cl, byte [esi + ecx*2 - 0x50500630]
push 0x35b72d0f
adc esi, 4
sar word [esp + 2], 4
jnp 0x8664a5

Function at 0x7e6b3e
Capabilities:
Encode data using xor

Disassembly:
dec eax
rol eax, 1
sar word [esp + edx - 0x4a5e3e38], 2
inc eax
neg eax
inc word [esp + edx - 0x4a5e3e3c]
neg edx
or dword [esp + 6], edx
xor ebx, eax
add edx, edx
movzx ecx, word [esp + edx - 0x6b438378]
pop ecx
add esi, eax
movsx ecx, dl
shl edx, cl
pop eax
pop eax
jp fcn.007df732
fsub dword [edi - 0x4c]
lcall 0xbde1, 0x58542fb1
imul edx, dword [eax + ebx*2 - 0x1f], 0xffffffc1
jmp 0x7e6b90
adc al, 0xe1
test eax, 0x252bf7e6
xor ecx, dword [edi + 0x5e]
add eax, 0x29930800
loope 0x7e6b90
push ds
movsb byte es:[edi], byte [esi]
mov ah, byte [edi]
xor dword [ebx], edx
push ebp
bound esi, qword [ebp + 0x237bb585]
hlt
Function at 0x82b504
Capabilities:
Authenticate hmac

Disassembly:
adc edi, 5
lea eax, [ecx*8 - 0x187e59ce]
jmp 0x808321
xor dl, bl
dec dl
mov byte [esp + 0xe], ah
ror dl, 1
add dl, 0xac
ror dword [esp + 7], 0x25
xor dl, 0xa5
mov dword [esp + 0xf], eax
xor eax, eax
xor bl, dl
shr al, 0x61
mov word [esi + eax*4], dx
sar word [esp + eax*8 + 1], 0xe9
cdq
mov dword [esp + eax*2], ebp
ret 0x10
pop eax
inc ecx
pop eax
jno fcn.0085e60e
mov edx, 0xd990f72a
ror edx, 0x23
imul dx, dx
mov eax, dword [edi + edx - 0x5b3278d9]
xor eax, ebx
bswap edx
dec edx
lea eax, [eax + edx - 0x6dc80350]
movsx ecx, dl
and dl, 0x1d
jge 0xb3bda0
rol eax, 2
sar cl, 0xc1
inc ecx
sal edx, cl
bswap eax
sal edx, cl
xor dx, 0xb522
btc dx, cx
xor eax, 0xae09179f
shl ecx, cl
imul edx, edx
push ecx
xor ebx, eax
add ebp, eax
sar edx, 0x21
btr edx, ecx
setae cl
mov cx, word [ecx + esi - 0xb8001]
push edx
movzx eax, byte [edi + 4]
sub edx, dword [esp + 4]
add dx, dx
imul dx, word [esp + 5]
xor al, bl
add edx, edx
dec word [esp + 2]
not al
sbb dl, byte [esp + 5]
push edx
neg al
xor edx, dword [esp + 8]
adc al, 0x8f
xor al, 0x17
push edx
sub al, 0x2c
xor bl, al
lea eax, [esp + eax + 0x10]
sar dl, 0x42
push edx
mov byte [eax], cl
lea ecx, [edx*4 + 0x5514eea2]
sub dword [esp + 0xd], edx
movzx edx, byte [edi + 5]
jne 0x7ecce7
lea ecx, [ecx + eax*8 + 0x6e32af6d]
sal edx, 0x8d
neg ecx
sar dl, 0xc3
cbw
sal dx, 0x27
lea ecx, [ecx + eax*2 - 0x32045047]
add byte [esp + edx*2 - 0x7e85fffd], dh
add edx, 0x1c8c0091
add dword [esp + edx - 0x5bcf0091], eax
xor ebx, ecx
rol dl, 0x41
sub dl, byte [esp + eax - 0x16]
adc edi, ecx
mov dword [esp + eax - 0x19], edi
ret

Function at 0x83fe72
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esp + edx + 4]
mov word [edx], ax
mov eax, ecx
mov dword [esp], 0x35b71694
sbb edi, 3
ror cx, 0x2d
mov edx, dword [edi]
xadd byte [esp + 2], cl
dec al
xor edx, ebx
ror edx, 2
sar ax, 0xe8
neg eax
not cx
sbb edx, 0x65b770a1
xor word [esp + eax - 0x5209fffe], cx
not edx
ror edx, 1
call fcn.00847245
mov eax, 0x818adc3b
mov ecx, dword [esi]
and eax, eax
adc esi, 4
ror eax, 0x68
mov edx, eax
xor ecx, ebx
dec edx
lea ecx, [ecx + eax - 0x21d91230]
btr dx, dx
and dx, 0xa9ac
add edx, 0xde90af17
bswap ecx
lea eax, [edx*8 - 0x17e41768]
shr al, 0xc1
rol ecx, 2
idiv eax
ror edx, 0x73
cdq
xor ecx, 0xc383c02f
xadd eax, edx
not ecx
xor ebx, ecx
or edx, eax
adc ebp, ecx
bt dx, 6
rdtsc
mov ecx, 0x5e9e5e2d
add ecx, ecx
imul ecx, ecx
sbb edi, 7
mov dword [edi + 4], eax
lea eax, [ecx + ecx*4 - 0x2de084d1]
sar ecx, 0x36
mov dword [edi + eax - 0x6df50963], edx
inc ax
movsx edx, ax
call fcn.0078c395
mov eax, 0x941f60a6
mov ecx, dword [ebp]
mov edx, 0xd9300e2d
movzx edx, byte [esi - 1]
xor dl, bl
sub dl, 0x27
ror dl, 1
bt eax, eax
sub al, 0x3b
dec dl
xor dl, 0x88
xor bl, dl
sar ax, 0x4f
add edx, esp
mov dword [edx], ecx
not al
movsx ecx, al
mov ecx, dword [esi - 5]
dec eax
movsx edx, ax
mul dx
xor ecx, ebx
jmp 0x8d1aa8

Function at 0x841511
Capabilities:
Authenticate hmac

Disassembly:
dec edx
mov dl, byte [edx + edi - 0xcc]
mov eax, 0x539f5315
mov dword [esp + eax - 0x539f5315], 0x9cb47023
btc eax, 0xaf
lea edi, [eax + edi - 0x539fd30f]
call fcn.00bef8c2
Function at 0x844bad
Capabilities:
Encode data using xor

Disassembly:
add ebp, 4
mov dword [esp], 0xcca788b8
shld dx, ax, cl
mov eax, 0x290176a1
add word [esp + eax - 0x290176a0], ax
mov word [ebp + eax - 0x290176a1], dx
mov eax, dword [eax + esi - 0x290176a1]
call fcn.00b5cb7b
and dword [ebx + esi*8], edi
sbb bh, 0x3b
cmpsb byte [esi], byte es:[edi]
pop ebx
enter 0x7723, 0x53
cmpsb byte [esi], byte es:[edi]
pop ebx
enter 0xffffffffffff8623, 0xffffffffffffffb3
cmpsb byte [esi], byte es:[edi]
pop ebx
enter 0x2feb, 0xffffffffffffffd3
cmpsb byte [esi], byte es:[edi]
pop ebx
enter 0xfffffffffffffffb, 0xffffffffffffff93
cmpsb byte [esi], byte es:[edi]
pop ebx
enter 0xffffffffffffcedb, 0xffffffffffffff9b
cmpsb byte [esi], byte es:[edi]
pop ebx
enter 0xffffffffffffd753, 0xffffffffffffffdb
cmpsb byte [esi], byte es:[edi]
pop ebx
enter 0x1ecb, 0x26
mov ch, 0xc8
xor eax, 0x894a3b60
pop esp
add ebx, dword [eax + 2]
outsd dx, dword [esi]
scasb al, byte es:[edi]
aad 0
add byte [eax], al
sbb ah, byte es:[0xa97ba399]
mov ah, 0
xchg dword [esi + 0x4b], edx
call [eax]
or al, 0xa9
mov ah, 0
invalid

Function at 0x853b6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
cdq
dec ecx
adc ebx, ecx
inc ecx
shl dl, cl
dec edx
mov dword [esp - 0x3a05a712], ebp
rdtsc
dec edi
lea ebp, [ebp - 0x3a05a71a]
inc ebx
mov dword [ebp - 0x1d02d385], eax
inc edx
shl byte [esp - 0x1d02d383], 0xc6
inc ebx
mov dword [ebp - 0x1d02d389], edx
not si
shr di, cl
pop edi
ja fcn.0085e60e

Function at 0x85922f
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [edx + eax*2 - 0x33000000]
ror al, 0x41
adc dword [esp + eax*4 - 0x65fffffc], 0xd7a5a81b
mul al
mov edx, dword [esi + eax*4 - 0x66000000]
xor dword [esp + eax*4 - 0x65fffffc], eax
and ecx, edx
push eax
not dword [esp + eax*4 - 0x66000000]
mul eax
not ecx
mov dword [esi + eax], ecx
add eax, dword [edi + eax*2 + 1]
lea edi, [edi + edx - 0x28a3ffb]
xor eax, ebx
call fcn.0072a260
Function at 0x85b7df
Capabilities:
Manually build aes constants

Disassembly:
inc ecx
xor edi, esp
inc ecx
sbb dh, 4
inc ecx
not dh
inc ecx
sub edi, eax
inc ebp
xor bh, dh
dec edx
mov dword [esp + eax - 0x147f84bd], 0x40a027bf
dec esi
lea esi, [esp + esi + 0x28]
inc ecx
rol ah, 5
cwde
dec edx
mov ebp, dword [ebp + esi - 0xe12a]
inc esp
mov esi, eax
dec ecx
mov dword [ebp + edi*2 - 0x3f638740], ebp
dec edi
lea ebp, [ebp + eax - 0x147f84cc]
dec eax
lea edx, [ecx + eax - 0x27e1976d]
dec eax
neg dword [esp + edi - 0x1fb1c39a]
dec edx
mov dword [esp + eax*2 - 0x28ff09a8], ebx
ret 0x20
xor al, 0x13
neg al
lea ecx, [ecx + edx + 0x150ec3b0]
imul ecx, ecx
sub ecx, 0x46be2db8
xor bl, al
add dx, 0x701c
jp 0x867875
inc cx
or ecx, eax
jb 0x726943
inc ecx
rol dh, 1
inc ecx
imul edi, eax
jo 0x6f1108
mov eax, dword [esi]
mov ecx, 0xe01fb198
movzx edx, cl
xor ecx, edx
movzx cx, byte [eax + edx*2 - 0x130]
lea esi, [esi + edx*8 - 0x4be]
movsx eax, dx
xadd dx, ax
mov word [edx + esi - 0x130], cx
cwd
ror al, 0xe1
cdq
mov ecx, dword [edi + edx]
add edx, 0xbf269020
bt edx, edx
lea edi, [edi + eax - 0x48]
xor ax, 0x8fae
bts ax, ax
xor ecx, ebx
btc eax, 0x1b
rol dx, 0x23
sbb dx, 0xb18c
xor ecx, 0x8f8229a3
neg eax
cdq
add eax, 0xa3ae0b02
xor ecx, edx
btc dx, dx
adc dx, ax
sub edx, edx
neg ecx
add dl, 0x93
shl al, 0x44
lea ecx, [ecx + edx*2 + 0x6103fa7c]
sbb dx, 0x92b
neg eax
xor ecx, 0x3738c2ae
inc ecx
call fcn.0087fd4b
mov edx, 0x96998b01
inc ebp
mov esp, dword [ebx]
movsx ebp, dl
dec eax
lea ecx, [ebp*4 - 0x62db11fd]
jmp 0xb3fb48
not dword [esp + eax - 0x4c19d9ba]
inc dl
dec ecx
imul ax
neg ecx
and edx, 0x250a962b
sar al, 0xe3
bswap ecx
and al, dh
xor ebx, ecx
shr eax, 0xd7
adc edi, ecx
mov dword [esp + eax - 0x98], edi
ret 4
sbb dx, dx
inc ecx
xor ecx, 0x49afcb1e
lea eax, [edx*2 - 0x5be33e69]
pop eax
neg ecx
xchg dword [esp + 2], edx
lea edx, [edx + 0x29350180]
mov eax, dword [esp + edx - 0x4c19d9ba]
xor ecx, 0xed07f121
xadd edx, eax
bswap ecx
jle 0x859b05
mov edx, 0xae90a720
xor al, bl
rol dl, 5
btr edx, edx
sar edx, 0x62
sbb al, 0xc
mov ecx, edx
neg al
xor al, 0x83
inc al
sal ecx, 0xaa
dec cx
jne 0x72f318

Function at 0x85bc40
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x7c84af1d
xor edi, eax

Function at 0x865224
Capabilities:
Encode data using base64

Disassembly:
call fcn.0070080f
add byte [eax], al
add byte [ecx + 0x73], cl
push eax
jb 0x8652a0
arpl word [ebp + 0x73], sp
jae 0x8652a5
jb 0x86527e
popal
je 0x8652b1
jb 0x8652a3
push eax
jb 0x8652a6
jae 0x8652a8
outsb dx, byte [esi]
je fcn.00865246
add bl, al
pop ebp
stosb byte es:[edi], al
scasd eax, dword es:[edi]
retf 0xd8f6
fcom st(0)
enter 0xffffffffffffc166, 0xffffffffffffffc9
sub eax, 0xc166cafe
retf 0x3241
Function at 0x865246
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
call fcn.008b5eae
xor dx, bx
dec dx
xor dx, 0x7c11
push eax
dec dx
add ax, 0xae00
cwde
not dx
xor bx, dx
bt eax, 0x95
dec dword [esp]
mov word [ebp - 2], dx
shl ecx, cl
movzx eax, byte [ecx + edi - 0x55a227fe]
shl cl, 0xe2
xor al, bl
dec byte [esp + ecx - 0x55a227fe]
neg cx
neg ecx
xor al, 0x34
lea edx, [ecx + ecx - 0x51c408e0]
add al, 0x32
not ecx
xor al, 0x13
imul ecx, edx
neg al
ror al, 1
ror cx, 0x2d
dec dl
ror dx, 0x41
xor bl, al
xor dl, byte [esp + edx - 0x2f6a38e]
lea eax, [esp + eax + 4]
sar dl, cl
lea ecx, [edx*4 + 0x1a26e13]
mov ecx, dword [eax + ecx*8 - 0x6be7f038]
mov dword [ebp + edx*4 - 0xbda8ffa], ecx
adc word [esp + edx*4 - 0xbda8ff4], 0x6681
lea ebp, [edx + ebp - 0x2f6a403]
shl edx, 5
adc word [esp + edx - 0x5ed47f9e], 0xd53d
ror dword [esp + edx - 0x5ed47fa0], 0xf6
mov ecx, dword [edi + edx - 0x5ed47f9d]
ja 0x8c2ce1

Function at 0x868a79
Capabilities:
Check http status code

Disassembly:
mov dword [edi + 4], ecx
bts eax, eax
mov dword [esp], eax
mov dword [edi], edx
mov dword [esp + 8], 0x701457ae
movsx ebx, byte [esp + 6]
mov ebx, dword [esp + ebx*2 - 0x32]
mov dword [esp + 0xc], 0xe37a301
pop ecx
sar eax, cl
pop ecx
pop ecx
pop edx
js fcn.00bd3fc5

Function at 0x86917c
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx*2 - 0x966], 0x7c87f981
or dx, ax
xor cl, 0x92
not dword [esp + edx*4 - 0x112cc]
not cl
pop eax
bt edx, 0xaf
lea eax, [eax + eax*8 + 0x799cefb2]
xor cl, 0x8b
dec cl
not cl
ror eax, 0x9f
mul eax
neg eax
xor cl, 0xbc
inc eax
xor bl, cl
add dx, 0x670f
add ecx, esp
or edx, edx
movzx dx, byte [ecx + edx*2 - 0x13441946]
movsx ecx, ax
call fcn.007c743a
neg ecx
not edx
movzx eax, cl
bswap edx
push eax
push eax
rol edx, 2
and ax, 0x3500
bswap edx
call fcn.00b6e241
mov edi, 0x18703b9d
xor eax, esp
invalid

Function at 0x88f925
Capabilities:
Encode data using xor

Disassembly:
dec edx
ror edx, 2
not al
and eax, ecx
lea edx, [edx + ecx + 0x39dd4ac4]
dec al
btr eax, 2
rol eax, 0xac
xor ebx, edx
cwde
add ebp, edx
mov eax, dword [esi + ecx*4 - 0x7aef4f00]
mov edx, 0x6e008609
ror cx, 0x61
mov ecx, dword [esi + ecx*2 - 0x3d76d3bc]
push edx
neg dword [esp + edx - 0x6e008609]
lea edx, [edx + edx + 0x5a872a0a]
lea esi, [esi + edx*2 - 0x6d106c30]
mov dword ss:[edx + eax - 0x3688361c], ecx
call fcn.00879d9b
mov eax, dword [ebp]
add ebp, 4
xor eax, ebx
mov ecx, 0xc40b5433
xor ecx, ecx
rol eax, 1
imul cx, cx
movzx edx, cx
inc edx
bswap eax
lea eax, [eax + ecx*4 - 0x50b26511]
shr cx, 0xa3
ror eax, 1
xor dx, cx
bt edx, 0xa4
not eax
setb dl
setb cl
xor ebx, eax
not cx
add edi, eax
mov eax, dword [ecx + esi - 0xffff]
add edx, dword [esi + ecx - 0xfffb]
xadd cl, ch
mov cl, byte [esi + ecx*2 - 0x1fff4]
adc esi, 5
shld eax, edx, cl
mov ecx, 0x9c3493ac
mov dword [esi], eax
lea edx, [ecx + ecx*8 - 0x6f53bae3]
jmp edi
dec eax
mov dword [esp + 8], 0x514eb1bd
dec eax
lea esp, [esp + 8]
call fcn.00b7f0af
sub edi, 4
mov edx, 0xb580ea2f
mov edx, dword [edi]
mov ecx, 0x1ebbd396
xor edx, ebx
neg edx
shl cl, 0x25
lea eax, [ecx + ecx*8 + 0x6e02ca17]
js 0x74cd4c
sahf
invalid
Function at 0x8935df
Capabilities:
Encode data using xor

Disassembly:
dec edx
or cl, 0x19
xchg cx, ax
neg edx
xadd ecx, eax
xor eax, eax
call fcn.0080d6a4
xor ebx, ecx
add edx, dword [esp + edx*2 - 0x3e5c7062]
adc edi, ecx
bswap edx
mov edx, dword [ebp + edx - 0x75705c3e]
mov ecx, dword [ebp + 4]
jmp 0x89c8d7
add dl, byte [esp + edx - 0x1f2e383b]
neg ecx
sub ecx, 0x9b03921a
sub dl, byte [esp + edx*2 - 0x3e5c70bc]
jns 0x72d975
mov ebp, esi
stosb byte es:[edi], al
jmp 0x872e7f
invalid
mov ecx, 0xac1b9799
mov edx, 0x6028469a
mov ecx, dword [edx + edi - 0x6028469a]
lcall 0x3a8c, 0x8b602846
mov cx, 0x9fd7
cmp ah, byte [esi - 0x47]
xlatb
lahf
movsx eax, dl
lea edi, [edx + edi - 0x60284696]
shl ax, 0x6c
xor ecx, ebx
shl eax, 0xe2
push edx
mov byte [esp + edx - 0x60284699], dh
sbb ecx, 0x269ce801
not ax
not ecx
xor ecx, 0x6138a99c
lea ecx, [ecx + eax - 0x1ed80543]
call fcn.00886d1f
cmpsb byte [esi], byte es:[edi]
clc
xlatb
cmp eax, dword [esi + 0x23]
movsd dword es:[edi], dword [esi]
jl 0x872e86
jle 0x872f01
jae 0x872e7b
jl 0x872e8c
sbb al, 0x79
shld dword [esp + esi*4 - 0x74], edi, cl
dec esi
outsd dx, dword [esi]
push esp
xchg ebp, eax
and al, 0x4e
les edx, [ebp - 0x66]
mov esi, 0x6964f4fe
xchg edx, eax
popfd
std
retf 0x1487
add dh, byte [ebp - 0x172d9c00]
xchg byte [ebp + 0x5f], cl
push cs
xor ebx, eax
call fcn.0089b4f4
add edi, edx
mov dword [esp + ecx - 0x1d231023], edi
ret 4
inc ecx
inc dx
xor ecx, 0xa824e28b
mov dword [esp + edx*2 - 0x3e5c7084], edx
bswap ecx
push edx
jmp 0xb51629
dec byte [esp + 9]
add ebp, 4
xor eax, eax
dec dword [esp + 7]
call fcn.007571af
xor ecx, 0x9024cab9
bt edx, 0xa1
jb 0x872e64
adc ebp, 4
shld dx, ax, cl
pop ecx
movzx eax, cx
sar ecx, 0x3e
mov word [ebp + eax - 0x1ca3], dx
mov edx, dword [esi + ecx*2 + 4]
lea esi, [esi + eax - 0x1c9f]
xor edx, ebx
add ecx, ecx
js 0x7018e6
aad 4
add byte [eax], al
add byte [esi + 0xf], ah
movsd dword es:[edi], dword [esi]
ret 0xf59
sysenter
pushfd
mov dword [esp], 0x1903803d
call fcn.0077332d
sbb al, al
in eax, 0x3b
js 0xb5163a
popfd
dec esi
mov ah, 0xce
mov esp, 0xb44e9de5
xchg ah, al
int 0x9d
dec esi
mov ah, 0x4e
invalid

Function at 0x89c092
Capabilities:
Authenticate hmac

Disassembly:
call fcn.00b78d2c
inc dl
movsx ecx, dx
mov edx, dword [esi + ecx - 0x525e]
lea esi, [esi + ecx*8 - 0x292ec]
mov eax, ecx
shl eax, cl
xor edx, ebx
rol ecx, cl
neg edx
jmp 0x6c7b90

Function at 0x8b8a76
Capabilities:
Authenticate hmac

Disassembly:
sub ax, si
inc edi
mov esp, dword [ebx + esi - 0xbb]
dec edi
lea ebx, [ebx + esi*2 - 0x172]
inc ebp
xor esp, edi
pop esi
pop eax
inc edi
lea esp, [esp + esi*2 - 0x539814a4]
inc ecx
movsx ecx, al
dec esp
add esi, ecx
inc ecx
rol esp, 2
movzx ebp, al
dec ebp
or esi, eax
dec edx
lea ebp, [ebp + esi*8 - 0x446d735e]
inc ecx
inc esp
inc ecx
xor esp, 0x2cb11c08
call fcn.0087d1c9
Function at 0x8cb50a
Capabilities:
Encode data using xor

Disassembly:
push edx
xor eax, 0xac25748a
and dl, byte [esp + ecx*4 - 0x29e1b]
dec cx
dec eax
mov dword [esp + ecx - 0xa782], 0xaa86b296
sar edx, cl
jnp 0xc0c7ae
not eax
not edx
sbb edx, edx
ror eax, 1
sub eax, edx
xor ebx, eax
lea edx, [edx + ecx*8 - 0x6ccc137c]
xor edx, 0x2cb27cbc
adc edi, eax
mov dword [esp + ecx*8 - 0x53c30], edi
ret 4
Function at 0x8cca8b
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr cl, 0x64
lea edx, [ecx + ecx*2 - 0x68787269]
mov eax, dword [esi]
neg edx
lea edx, [ecx + ecx*8 + 0x4295101f]
jns 0xb7a472
call fcn.006f7598
mov eax, 0x48baef9b
movzx cx, byte [esi + eax - 0x48baef9b]
movsx edx, ax
bts eax, eax
mul dx
mov dl, byte [eax + esi - 0x48bac7d7]
and cl, dl
mov edx, 0x30b1bb8a
dec ax
sal al, 0xa1
not cl
xchg edx, eax
xor eax, 0x9a341cb7
mov word [esi + edx - 0x48bac7ae], cx
or edx, eax
mov ecx, dword [edi - 4]
mul edx
lea edi, [edi + eax - 0x717830d]
sar ax, 9
inc dl
xor ecx, ebx
rol eax, 0x4d
ror ecx, 1
xor edx, edx
bts eax, 0xae
dec ecx
jmp 0xbc7e1c
mov cl, byte [esi + edx*2 - 0x12ed2]
sar dl, 0x81
xor edx, edx
shr eax, cl
lea ecx, [edx*2 - 0x39e52543]
bt ecx, 0xa9
xchg ecx, edx
mov dword [esi + ecx*2 + 4], eax
not dl
jb 0xb1ec1d
lea esi, [esi + ecx*4 + 4]
mov eax, edx
or eax, 0x693a6c81
xor ecx, ebp
jmp ecx
shl eax, 0xbb
neg dl
neg ecx
xor ecx, 0x380a2134
xor ebx, ecx
add edx, edx
ror eax, 0xb6
sub dx, 0x6894
add ebp, ecx
inc al
mov ecx, edx
ror al, 0x41
mov eax, dword [esi + eax*2 - 0x13e]
shr cx, cl
ja 0x8d1a59
mov edx, 0x17b0f4bb
movsx ecx, dl
movzx eax, cx
rdtsc
sub ebp, 8
or ecx, 0xddbbaf81
or ecx, ecx
adc ecx, 0xfb817201
mov dword [ebp + 4], eax
or ecx, ecx
sar ecx, 0x61
mov dword [ebp], edx
jl 0x6cebe4
Function at 0xb3c93d
Capabilities:
Encode data using xor

Disassembly:
call fcn.008727ed
dec dl
mov word [esi + 2], ax
lea edx, [edx*2 - 0x4d7235d7]
setl dl
lea eax, [edx + edx*8 - 0x74c9c376]
mov edx, dword [edi + edx - 0x10b4ef05]
bts ax, ax
mov ecx, eax
dec cx
lea edi, [edi + eax*2 - 0x4325473a]
btr ax, cx
xor ecx, ecx
xor edx, ebx
ror ax, 0x61
lea eax, [ecx*4 + 0x7a346aa4]
bswap edx
xor edx, 0x17114736
or cx, cx
sets al
rol ecx, 0x3c
lea edx, [edx + ecx*2 - 0x110481bf]
xchg ecx, eax
imul ax, ax
xor edx, 0x3131548c
lea ecx, [eax*4 + 0x187f11f]
xor dword [ebp - 0xee07af4], ecx
xchg dword [ecx], eax
shr ecx, cl
rol edx, 1
sub eax, 0x19181b16
sbb ecx, ecx
xor edx, ecx
or ax, 0xc621
jl 0x877b08
mov ecx, 0x9d31febd
movzx eax, cl
mov dh, 0xc1
mov edx, dword [ebp + eax*2 - 0x17a]
sal eax, cl
setb cl
jb 0x6e93ff
jo 0xb3c9a6
jns 0xb3c97d
xor eax, 0xe195f6df
arpl word [edi - 0x19], cx
not byte [ebp - 0x48baa61f]
not byte [ebp + 0x4b0919e1]
cdq
and ecx, 0x80a734e9
loope 0xb3c9cb
inc edx
add byte [ecx + edx], al
pushfd
into
pop ebx
pop ecx
pop esi
push ss
jge 0xb3ca59
or ah, byte [ecx - 0x165e595b]
lcall 0x5e46, 0x907683c8
inc esi
and ecx, dword [esi - 0x11]
inc edi
lea esi, [eax - 0x3eb9f910]
dec ebp
mov eax, 0x24174ff1
xchg ebp, eax
push ebp
xchg esp, eax
jae 0xb3ca7d
lds eax, [edx + 0x4e]
cmp ch, byte [ecx - 0x2c]
mov cl, 0x6f
xchg byte [edi + 0x49201b06], ch
and byte [ebx + edi*2 - 0x3f], dh
rol ah, 0xab
jp 0xb3ca66
daa
salc
pushfd
xor dword [ebx + 0x45], edi
sbb esi, dword [ebx - 0xd]
dec ebp
stc
xchg esp, eax
je 0xb3ca01
arpl word [ecx], di
aaa
mov esp, ecx
fisubr word [ebx]
sub eax, 0x9c16e397
add byte [eax - 0x48], bh
fsubp st(2)
inc ebp
mov eax, dword [0x6366e6d7]
mov dword [0xc4766cff], eax
imul edx, ecx, 0x59
xor al, 0x41
test al, 0x8d
loope 0xb3cacd
ljmp 0x6366:0xe6d7a145
das
sub ch, dh
out dx, al
xchg edx, eax
lodsd eax, dword [esi]
inc edx
js 0xb3cab1
out dx, al
xchg edx, eax
lodsd eax, dword [esi]
pop eax
mov byte [esi], cl
invalid
fabs
daa
and al, 0x8a
call 0xc9b327ef
add byte [ebx + ecx*4], bl
enter 0x1c00, 0xffffffffffffff8b
out dx, eax
loope 0xb3cabb
push cs
sub byte [ebx - 0x1e105fe1], dh
or cl, ah
push edx
sal byte [eax], 0xc4
xor ah, al
fidivr word [esi + edx*8]
push esp
and ecx, dword [edi - 0x2536ff1a]
sahf
pop ebp
std
xor dh, byte [eax - 0x46]
retf