joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8ca5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, eax
shr ecx, 0x10
mov dword [ebp - 0x214], esi
push edi
test cx, cx
je 0x4b8cf9
add esi, 0x28
cmp word [eax], 0x3c
mov ecx, esi
jne 0x4b8cef
push eax
call fcn.004c6df2
test al, al
jne 0x4b8d56
xor eax, eax
jmp 0x4b8d80
push 0
push eax
call fcn.004c6e3d
jmp 0x4b8ce4
push edx
push eax
call fcn.0049a3cd
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4b8ce8
push edi
call fcn.0049a3cd
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x4b8d29
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4b8ce8
push 0
push edi
add esi, 0x28
call fcn.0049a3cd
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, esi
call fcn.004c7138
test al, al
je 0x4b8ce8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.004c6d49
sub esp, 0x20c
mov esi, eax
mov edi, esp
mov ecx, 0x83
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x214]
call fcn.004b89b9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005026fe
mov esp, ebp
pop ebp
ret 8
Function at 0x4c3cc2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x4c3d4a
cmp dword [esi + 0x10], 0
je 0x4c3d4a
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00507d80
mov ebx, esp
test ebx, ebx
je 0x4c3d4a
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1cc
call fcn.004969b6
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push 0x53c438
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0049e601
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0049a65d
test al, al
je 0x4c3d4a
mov ecx, dword [esi + 0x10]
call fcn.004a0e13
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005026fe
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4c6220
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x536d0a
call fcn.005078b1
mov esi, ecx
lea eax, [esi + 0xc]
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], bl
call fcn.00480759
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push ebx
push ebx
call fcn.005053f6
add esp, 0x18
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4c626a
lea eax, [ebp + 0xc]
mov ecx, esi
push eax
call fcn.004807f2
mov bl, 1
cmp byte [ebp - 0x10], 0
je 0x4c627b
mov ecx, dword [ebp - 0x14]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, bl
call fcn.0050787f
ret 8
Function at 0x4c92cc
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4c9300
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4c9300
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x4c93b2
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x4c931d
cmp ax, 0x5c
jne 0x4c931f
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4c9311
cmp esi, ebx
je 0x4c9365
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.00506c20
add esp, 0xc
cmp esi, 0x208
jae 0x4c93c2
xor eax, eax
mov word [ebp + esi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.004c92cc
pop ecx
pop ecx
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x4c9382
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.005073ba
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0050738b
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4c93b2
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.005026fe
mov esp, ebp
pop ebp
ret
call fcn.005049b3
int3

Function at 0x4c99e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4c9a94
cmp dword [esi + 4], 0xffffffff
jne 0x4c9a94
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.005074c6
pop ecx
movzx eax, word [esi + eax*2 + 0x242]
cmp eax, 0x5c
je 0x4c9a3b
cmp eax, 0x2f
je 0x4c9a3b
push 0x53ade8
push edi
call fcn.0050738b
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x4c9a5d
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4c9a5d
mov eax, 0x2000000
jmp 0x4c9a99
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004cc10c
add esp, 0x10
test eax, eax
jne 0x4c9a7b
mov eax, dword [ebp - 4]
jmp 0x4c9a99
push eax
call fcn.004cc7de
pop ecx
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
jmp 0x4c9a99
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c9f42
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movsx eax, al
push esi
mov ecx, dword [edx]
mov esi, 0xff
xor eax, ecx
shr ecx, 8
and eax, esi
mov eax, dword [eax*4 + 0x540198]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edx + 8]
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, esi
pop esi
xor eax, dword [ecx*4 + 0x540198]
mov dword [edx + 8], eax
pop ebp
ret

Function at 0x4cc20b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4cc23f
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4cc23a
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4cc266
mov edx, dword [edi + 0x1c]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x18]
jbe 0x4cc24f
mov esi, dword [edi + 0x18]
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.00506c20
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x4cc383
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4cc391
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x4cc44c
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x540198]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x540198]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x540198]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x540198]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x540198]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x540198]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x540198]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x540198]
dec edi
jne 0x4cc3af
pop edi
test esi, esi
je 0x4cc465
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x540198]
inc edx
dec esi
jne 0x4cc450
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x4dd033
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x294]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x4dd05f
xor eax, eax
jmp 0x4dd0dc
push 0xfe
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], 0
push 0
push eax
call fcn.00507270
add esp, 0xc
lea eax, [ebp - 0x104]
push 0xff
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4dd05b
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 0x298]
push eax
call fcn.00506c20
mov ecx, dword [ebp - 0x298]
add esp, 0xc
movzx eax, cl
shl eax, 8
movzx ecx, ch
add eax, ecx
movzx ecx, byte [ebp - 0x296]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x295]
shl eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005026fe
mov esp, ebp
pop ebp
ret

Function at 0x4deee0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bc6ca

Function at 0x4dfe82
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
push edi
and dword [ebx + 0x770], 0
mov edi, dword [ebp + 0x18]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x76c], ecx
mov dword [ebx + 0x774], eax
test ecx, ecx
jne 0x4dfeea
call fcn.004dfc65
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
test esi, esi
je 0x4dfeea
call fcn.004dfc65
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
lea esi, [ebx + 0x10]
call fcn.004dfc65
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov ecx, dword [ebx + 0x76c]
test ecx, ecx
jne 0x4dff07
mov ecx, edi
jmp 0x4dff0e
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0049a3c0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.004967d2
push 0
sub esp, 0x10
mov esi, eax
mov edi, esp
mov ecx, ebx
push 0x88
movsd dword es:[edi], dword [esi]
push SysReAllocString
push 0
push dword [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0049f84d
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x4dff51
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x4dff4c
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005026fe
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4e5c8d
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, dword [ebp + 0xc]
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov esi, eax
cmp edi, 0x21
jb 0x4e5cdb
cmp edi, 0x28
jbe 0x4e5cd5
lea eax, [edi - 0x2d]
cmp eax, 1
ja 0x4e5cdb
or esi, 0x100
cmp dword [ebp + 0x10], 0
je 0x4e5ce7
or esi, 0x1000000
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00507270
add esp, 0xc
shl esi, 0x10
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.0049681b
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005026fe
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4eb110
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eb120

Function at 0x4eb3a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4eb3ac
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004eb3c0
Function at 0x525a89
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00512030
mov dword [ebp - 0x14], eax
cmp dword [0x595134], esi
jne 0x525b7c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x525b09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x525c5c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x525c5c
push 0x560ea0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x525c5c
push eax
call ebx
push 0x560eac
push edi
mov dword [0x595134], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x560ebc
push edi
mov dword [0x595138], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x59513c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x595144], eax
test eax, eax
je 0x525b79
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x595140], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x525ba1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x525b94
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x525bb6
push 4
pop eax
jmp 0x525c5e
cmp dword [ebp - 0x14], esi
je 0x525bb6
push dword [0x595134]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x525b9b
mov eax, dword [0x595140]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x525c14
cmp dword [0x595144], edi
je 0x525c14
push eax
call ebx
push dword [0x595144]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x525c14
test eax, eax
je 0x525c14
call ecx
test eax, eax
je 0x525c09
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x525c09
test byte [ebp - 8], 1
jne 0x525c14
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x525c44
mov eax, dword [0x595138]
cmp eax, edi
je 0x525c41
push eax
call ebx
test eax, eax
je 0x525c41
call eax
mov esi, eax
test esi, esi
je 0x525c41
mov eax, dword [0x59513c]
cmp eax, edi
je 0x525c41
push eax
call ebx
test eax, eax
je 0x525c41
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x595134]
call ebx
test eax, eax
je 0x525c5c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x525c5e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005026fe
mov esp, ebp
pop ebp
ret
Function at 0x6b9ede
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xfd620028
out dx, eax
or bh, byte [eax - 0x7c]
and al, 0x8b
push 0x3e
push 0x1034b804
call 0xc06b1051
mov dword [0x8fcb1508], eax
xlatb
push es
add byte [eax], al
mov ebx, dword [ebp + 0xc]
call 0x759a3f
mov eax, esp
or eax, 0xcec6bb10
push ss
test dword [ebx + 0x2d13e802], eax
out dx, eax
fmul qword [eax]
pushal
xor eax, 0x9d23e766
lea edi, [esp + 0x64]
aad 0x80
mov ecx, dword [ebp - 0x74]
inc edi
add al, 0xf
inc ebp
inc edx
js 0x6b9ef3
xchg dl, cl
add al, 0x5a
pop ebp
and dh, byte [eax]
push eax
add dword [ebx], 0xd0df6bc5
out dx, eax
out dx, al
out 0x85, al
jl 0x6b9f3c
push esp
jne 0x6b9f42
call 0xda85d6de
aaa
sbb bl, dl
push edi
push eax
call 0x8b157dbc
or byte [ecx + 0x5d], dl
jbe 0x6b9f22
test eax, 0x5d51088a
or byte [eax + 0x6abe91ff], ch
sub al, ch
nop
and cl, 0x89
add al, 0x24
mov ecx, eax
call 0xbf8d9b08
sbb ebp, dword [ecx + ebp - 0x3cec83c1]
adc ah, byte [edi + 0x3f]
or dword [eax], eax
push 0x10
pop es
adc byte [eax + ecx*8], bh
call 0xd75466de
lodsd eax, dword [esi]
out dx, eax
loop 0x6b9f78
invalid
jg 0x6b9fc7
and al, 0x70
mov edx, dword [esp]
mov dword [ecx], edx
mov dword [esp + 0x28], ebx
mov edx, dword [ecx]
mov dword [esp + 0x1c], edi
rcl dword [edx + 0x53]
call 0x57e7a05d
les esp, [esi]
pop es
js 0x6ba009
push eax
call 0x106b274e
sti
ja 0x6b9ffa
add al, 0x83
mov byte [edx + ebp*2], 0x2c
call 0xc1f4dcd8
lea eax, [esp + 0x70]
push eax
push esi
call 0xf0c328f8
mov dword [edi - 0x10], edx
fistp word [edi + 0x31582806]
leave
dec ecx
mov dword [ebx], esp
jb 0x6ba03b
idiv byte [edi + 0x18247cbb]
inc ebp
mov ebx, 0x4518247c
jl 0x6b9fed
sbb byte [ebp - 0x18], al
lds esp, [ebx + 0x146a0006]
call fcn.00724395
push 0x14
call 0xc80421ce
test byte [eax], al
xor byte [eax], al
je 0x6b9fff
aam 6
inc ecx
aaa
mov esp, 0x476433e9
or byte [0x840f7f06], bh
and al, 0xc
mov dword [esp], edi
or al, 0x89
cmp al, 0x24
adc al, 0
or eax, 0x245c8dff
push esp
mov dword [ebx], 0xd94d4c00
add eax, dword [eax]
dec esp
dec ebp
invalid
loop 0x6b9fc0
and eax, eax
sbb al, 0x43
je 0x6ba02b
jo 0x6ba05f
call fcn.0077cb89
push ecx
pushal
stosb byte es:[edi], al
sub ecx, ebx
jnp 0x6b9fb5
sbb dh, byte [esi]
mov eax, 0x8b74f85d
push ss
imul ecx, dword [eax - 0xf8beb24], 0xb202fb9d
retf
push 0x14
push 0xe2211efc
dec dword [esi + 0x822f8]
cmp byte [esp + 0x7b], 0x89
jnp 0x6b9fc6
jo 0x6ba027
mov eax, dword [0xceefec40]
test dword [ebp + 0x244c8d38], ecx
push esp
push esi
call 0x2751f398
in al, dx
inc ebp
sub dl, byte [edx - 0x77]
dec eax
push edx
sub byte ds:[eax + 0x12], 0x52
adc eax, 0x39b91168
xchg edx, eax
push 0x9239b911
and ebx, ebp
xchg ebx, eax
movsd dword es:[edi], dword [esi]
push edx
dec esi
adc al, 0x98
wait
or byte fs:[esi], dh
and eax, 0xe115209
leave
sbb eax, 0xfb522768
sub byte [ebx], 0x82
inc ebx
fsub dword [ebp - 0x5b]
add dword [edx - 0x1d], edx
add al, 0xcf
arpl word [esi + 0x30], bp
inc ebp
ror byte [ecx], cl
push edx
pop ss
push 0x7feff45
mov ebx, 0xa8f821b0
push edx
pop esp
and al, 0x70
mov ecx, edi
push 7
push 0xe75dcd5d
out dx, al
and al, 0x53
call 0x28d11988
adc cl, byte [eax + ebp*2]
push esi
out dx, eax
cld
int 0xe8
invalid
Function at 0x6fdf34
Capabilities:
Encode data using xor

Disassembly:
fidiv dword [esp + ebx]
aas
sar byte gs:[ecx + 0x3dd85f35], cl
imul ecx, dword [edx], 0x2e
mov eax, 0x11a7eb26
mov bl, 0x66
rol byte [ecx + 0x30], 0x7b
in al, 0xa6
cmpsd dword [esi], dword es:[edi]
adc dword [ebx + 0x3041c066], esi
jnp 0x6fdf10
cmpsb byte [esi], byte es:[edi]
adc dword [edi], esp
xchg ebp, eax
stosd dword es:[edi], eax
mov edx, 0xcea9622a
test eax, 0x608938ce
push ebx
mov ecx, 0xf6f7338b
push edi
adc esi, ebp
test eax, 0x608938ce
push ebx
mov ecx, 0xf6f7338b
push edi
adc esi, ebp
add dh, byte [ebx - 0x77]
lea ebx, [ebx + 0x49]
push ebp
jge 0x6fdf23
pop ebp
xabort 0xffffffffffffffe8
cmpsb byte [si], byte es:[di]
dec ebp
or byte [ebx - 0x78ce76ff], cl
and dword [edx], edx
and ebx, dword [ebx - 0x3d83f410]
std
or ebp, esp
push ebx
push esi
push eax
call 0x101aa18f
mov dword [edx - 0x4faba8a8], eax
inc dword [eax - 0xd]
dec esp
test byte [eax], 0x61
dec ebx
rcr dword [ebx], cl
mov cl, 0x13
dec esp
invalid

Function at 0x77cb89
Capabilities:
Check for software breakpoints

Disassembly:
inc edi
xor al, 0x89
js 0x77cbaf
adc eax, 0x2b83398d
test dword [edi - 0x1007e45e], ecx
lea ecx, [ebp + 0x6a56804d]
das
call 0xc81fef95
lea ecx, [ebp - 0x544ec889]
xchg byte [ecx - 0x17a9b00d], cl
jle 0x77cbff
mov ecx, edi
push ebx
mov ecx, 0x8dde2831
invalid
test dword [ebx], edx
push ebx
sti
fimul word [ebp - 0x4acec7b]
lea eax, [ebp + 0x25fb5313]
jbe 0x77cb58
and eax, 0x9d36c776
popfd
pop esi
push ebx
enter 0x23ed, 0x33
mov ch, 0x84
invalid
test dword [0xbe703455], ebx
push ss
test byte [ecx + 0x41f14180], bh
mov ecx, 0x41f14180
push ebx
test dword [ecx + edx*2 - 0x20118f48], eax
or eax, 0x7cbd8de1
cmp cl, bh
push eax
call 0xedff01e5
ror byte [0x93e7cd66], 0x3a
inc ebp
popfd
je 0x77cbe2
mov ebx, 0xd920f8c7
inc dword [ebx]
call 0xf9e5dcd6
add ebp, eax
out dx, al
adc byte [esi - 7], ch
push esi
dec ecx
in eax, dx
sub ch, byte [eax + 0x77]
jno 0x77cc11
lea edi, [ebp + 0xdf98937]
jae 0x77cb88
dec ebp
push eax
call 0x4613ebce
inc ebp
dec ebp
pop eax
adc eax, dword [ecx - 0x31]
and eax, dword [ebp + 0x2d]
mov dword [ebp + 0x70], eax
ja 0x77cc65
ja 0x77cbb7
and eax, 0x212b4589
inc ebp
sub esp, dword [ecx]
mov eax, dword [ebp - 0x1ec7bb8]
fsub st(0)
mov ecx, dword [ebp + 0x40c80153]
and cl, byte [ebx + 0x7fff1f64]
js 0x77cbaf
sar byte [edi - 0x7baf079], 0xe8
and dword [eax], ecx
add al, byte [eax]
mov esi, eax
cmp byte [ebp + 0x1d61007f], 0xcc
invalid
xchg esi, eax
or al, 0x62
mov dl, byte es:[esi - 0xc9749f4]
pop ss
dec edx
ljmp 0xa1