joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454b1c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x454b54]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x454b35
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x454b44
or bl, 4
test esi, 0x20000000
je 0x454b4f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45b1fc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45b20e
add esp, 0xfffffff0
call fcn.004034bc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419588
mov eax, dword [0x4883c8]
mov dword [eax + 4], ebx
mov dword [eax], 0x45b5a0
mov eax, dword [0x4883d8]
mov dword [eax + 4], ebx
mov dword [eax], 0x45b5ac
mov eax, ebx
call fcn.0045b5b8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411868]
call fcn.00403168
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411868]
call fcn.00403168
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411868]
call fcn.00403168
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411868]
call fcn.00403168
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411868]
call fcn.00403168
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4579d4
push eax
push 0
push 0
mov eax, dword [0x488538]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41b03c]
call fcn.0041c7b0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41b03c]
call fcn.0041c7b0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41b03c]
call fcn.0041c7b0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045b9d8
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b8b4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b8b4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b8b4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45b34b
call fcn.00403514
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45b698
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b843
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45b824
mov dl, 1
mov eax, dword [0x411c84]
call fcn.00403168
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403ee8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45b813
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004491ec
test al, al
je 0x45b806
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45b854
lea eax, [ebp - 0x254]
call fcn.00408cec
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45b806
xor eax, eax
push ebp
push 0x45b7ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45b88c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45b7e8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404158
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45b7e8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404158
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b806
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45b709
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415778
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b84a
lea eax, [ebp - 0x260]
call fcn.00403ee8
ret

Function at 0x45c178
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x489bb0]
cmp byte [eax + 0xa5], 0
jne 0x45c1e9
cmp dword [0x489bc8], 0
jne 0x45c1aa
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45c134
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x489bc8], eax
cmp dword [0x489bc4], 0
jne 0x45c1c5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x489bc4], eax
cmp dword [0x489bcc], 0
jne 0x45c1e9
push esp
push 0
push 0
push 0x45c0d8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x489bcc], eax
pop edx
ret
Function at 0x45c2e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45c2f7
add esp, 0xfffffff0
call fcn.004034bc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419588
mov eax, dword [0x488524]
cmp word [eax + 2], 0
jne 0x45c31f
mov eax, dword [0x488524]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d9d0
mov eax, dword [0x4885e8]
cmp word [eax + 2], 0
jne 0x45c339
mov eax, dword [0x4885e8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045dbc8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411868]
call fcn.00403168
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411868]
call fcn.00403168
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41bb1c]
call fcn.004235c8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45c4c0
mov eax, dword [0x488438]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423998
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45e168
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x488438]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c3b4
test eax, eax
je 0x45c42e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004086e0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c3dc
test eax, eax
je 0x45c442
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404158
mov eax, dword [0x4882e8]
cmp byte [eax], 0
jne 0x45c476
mov eax, ebx
call fcn.0045c5e8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045e344
mov eax, ebx
call fcn.0045ed08
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45c4b6
call fcn.00403514
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c868
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x489bb0]
cmp dword [eax + 0x30], 0
je 0x45c912
cmp dword [ebx + 0x94], 0
jne 0x45c90c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45c7f8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45c90c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45c8d2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45c90c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413bd0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45c8e1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45d474
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45d4a9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403fd8
jmp 0x45d4b6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403f3c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45e520
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45e561
mov eax, esi
call fcn.004447b4
test al, al
je 0x45e561
mov eax, dword [ebx + 0x84]
call fcn.004444b0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45e561
push 0
mov eax, dword [ebx + 0x84]
call fcn.004444b0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x461c28
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x461c56
mov eax, ebx
call fcn.004626dc
cmp dword [ebx + 0x40], 0
je 0x461c4f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x461cc7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x461cb9
cmp dword [ebx + 8], 0
je 0x461c78
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x461c8a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x461cb9
cmp dword [ebx + 8], 0
je 0x461c6b
cmp eax, 3
je 0x461c9d
dec eax
jne 0x461c6b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x461c6b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x461c6b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x461ce5
cmp dword [ebx + 0x14], 0xcc
je 0x461ce5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00461cf0
pop ebx
ret
Function at 0x473668
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4738c8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4736cb
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00473130
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040bfa0
cmp al, 1
jne 0x4736cb
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00473448
test al, al
je 0x473857
cmp dword [ebp - 8], 0
jge 0x4736e9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00473130
mov eax, dword [ebp - 0x210]
call fcn.004041a8
cmp ebx, eax
jge 0x473733
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00473130
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x488744]
and eax, 0xff
bt dword [edx], eax
jae 0x473733
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x473747
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00473644
cmp ebx, dword [ebp - 8]
je 0x473849
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x473773
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403394
and eax, 0x7f
movzx eax, word [eax*2 + 0x487794]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x473836
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403394
and eax, 0x7f
movzx eax, word [eax*2 + 0x487794]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4738aa
cmp dword [ebp - 8], 0
jge 0x473862
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00473130
mov eax, dword [ebp - 0x218]
call fcn.004041a8
cmp eax, dword [ebp - 8]
jg 0x47389c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00473130
mov eax, dword [ebp - 0x21c]
call fcn.004041a8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00473644
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4738cf
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00403f0c
ret
Function at 0x47e054
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
push 4
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x47e0d6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x47e0c5
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 4
call fcn.004028c8
mov eax, dword [ebp - 8]
push eax
push 0x10
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e0cc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
Function at 0x1ff1f24
Capabilities:
Encode data using base64

Disassembly:
shr cl, 0x47
xor edx, ebx
sar dword [esp + ecx*2 - 0x46bbfdfc], 0xb5
movsx eax, cx
dec edx
call fcn.029e99ed

Function at 0x2016cec
Capabilities:
Encode data using xor

Disassembly:
pop edx
xor eax, ebx
and cl, ch
jle 0x29f0ac0
sbb eax, 0xe18dea98
sar ecx, 0x84
lea ecx, [ecx + ecx*4 + 0x210d77bb]
movsx edx, cl
neg eax
inc eax
xor cx, cx
rol edx, 0x23
lea ecx, [ecx*4 - 0x58e4d065]
neg eax
shr dx, 0xaf
xor ebx, eax
push edx
neg edx
add ebp, eax
mov ecx, dword [edi + edx*4 - 0x3fffc]
mov edx, dword [edi + edx*8 - 0x7fff4]
mov eax, 0xb18fd919
add edi, 8
call fcn.02a294db
pop ds
mov esi, 0x4ca3a944
leave
and dword [esi], esi
and dword [ebp + 0x75c2343d], 0xffffffcb
cmp al, 0x39
ljmp 0x7242

Function at 0x201b75d
Capabilities:
Encode data using xor

Disassembly:
dec edx
mov dword [esp - 0xffec], edx
dec ebx
mov ebx, dword [ebp - 0xffec]
call fcn.0357e0c2
pushfd
js 0x201b7d0
push 0xb4381dcd
int1
test al, 0x6e
fcmovbe st(0), st(0)
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
jmp 0x201b7dd
cmpsb byte [esi], byte es:[edi]
mov esp, 0x4bf2094f
lcall 0xff40, 0xc89fc929
invalid

Function at 0x2023dd2
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + ecx - 0xff4a], ecx
xor eax, ebx
ror eax, 1
not word [esp + ecx*8 - 0x7fa4f]
not eax
add eax, 0xfebc9a9c
mov edx, ecx
sub cx, cx
neg dl
xor eax, 0x862f5c35
sub dword [esp + ecx], edx
xor ebx, eax
ror ecx, 0x9a
jae 0x20cec88
jae 0x3726fdd
mov eax, dword [edi]
add edi, 4
xor eax, ebx
push 0x9c08b5be
mov word [esp + 1], 0x448e
shr byte [esp + 2], 3
xor eax, 0x37a82b98
neg eax
dec dword [esp]
jne 0x2005ff4
adc edi, eax
dec edx

Function at 0x2044730
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [eax + eax - 0x5d4ea4e7]
xor edx, ebx
xor ax, 0x7825
push ecx
add al, al
dec edx
rol edx, 1
add eax, eax
xor cx, word [esp + eax + 0x18f293f1]
lea edx, [edx + eax*2 + 0x11d641ab]
rol edx, 1
sal ecx, 0xce
sar cx, 0xe9
call fcn.036aa186
mov eax, 0xdf179998
lea edx, [eax*4 + 0x3d935689]
shr edx, 0x64
lea edi, [edi + edx*4 - 0x2e7c6f3c]
and dx, 0x281c
mov ecx, dword [edi + edx*2 - 0x173e1018]
call fcn.02a2f93a
Function at 0x204aa5f
Capabilities:
Encode data using xor

Disassembly:
dec ecx
lea esp, [esp + 8]
jne 0x36e8b32
test eax, ecx
loopne 0x204aad2
add dword [edx - 0x1376bc7a], edi
mov edx, 0xec894386
call fcn.02a2345a
adc ch, al
test eax, 0x53c965a9
stosd dword es:[edi], eax
movsd dword es:[edi], dword [esi]
xor ecx, dword [esi - 0x57]
fabs
outsb dx, byte [esi]
mov dh, 0xf4
push es
inc eax
dec eax
lodsd eax, dword [esi]
dec esi
out 0xed, al
xor byte [edx + 0x1786ac2f], al
jns 0x204aa65
sbb ch, byte [edx + 0x49]
push edx
dec ebp
mov ecx, 0x1b454de0
in eax, dx
jb 0x204aae5
imul esp, dword [edi + 0xf], 0xfffffff0
pop ds
xor al, 0x18
outsb dx, byte [esi]
rsm
mov dh, 0x15
push esp
inc byte [edx + 0x4f]
xlatb
cmc
xor eax, 0x9c01227c
mov ch, 0x51
pop ecx
cmpsd dword [esi], dword es:[edi]
sal dword [ecx + edx*2 + 0x21], 0x60
or al, 0x2d
pushfd
jecxz 0x204aaa4
invalid
dec edi
pop esp
invalid
into
xor eax, 0x7f906c26
mov eax, dword [0x4e8203ec]
iretd
call 0x7cb4eeb1
mov dh, 0x1b
int 0xe5
cmp ecx, dword [ecx + 0x1e3b85e]
and ebp, edi
aam 0x9d
loop 0x204ab4e
jge 0x204ab1b
or eax, 0x99b171c0
jnp 0x204ab20
and al, 0x83
rol byte [esi - 0x6e], cl
pop ds
add eax, 0x313b06da
int 0x14
mov esp, 0x4ed1bb37
push ebx
salc
invalid
pop ds
or eax, 0x60a38e31
pushal
dec esp
xor al, 0xa5
dec esi
ret 0x899b
ljmp 0x1bb9:0xb860755f
mov esi, 0x21318c1e
movzx esi, byte [edx + esi*2 - 0x4263183c]
push 0xcd2d58bd
xor esi, eax
and esi, 0xff
mov esi, dword [esi*4 + 0x36c292c]
shr eax, 8
xor eax, esi
inc edx
xor eax, 0x64b66784
call fcn.0204aa5f
movzx ecx, byte [esi]
add esi, 1
mov eax, 0x689c9f0f
xor cl, bl
sub cl, 0x8c
push eax
xor al, ah
movzx edx, ax
rol cl, 1
push edx
xor eax, 0xd2b1771a
shr ax, 0x68
add cl, 0x35
not byte [esp + edx - 0x9f8f]
ror cl, 1
sub edx, 0xbb851928
xor bl, cl
sar al, 0xe3
lea ecx, [esp + ecx + 8]
neg dx
rol edx, 9
neg eax
movzx ax, byte [ecx + eax - 0x45d2ff03]
not word [esp + 6]
call fcn.036e16a7
Function at 0x2061d87
Capabilities:
Authenticate hmac
Encrypt data using chaskey

Disassembly:
movzx eax, dl
bswap ecx
dec ecx
mov dword [esp + edx - 2], 0x4e972884
sub eax, 0x51165b24
ror ecx, 3
dec dword [esp + edx*8 - 0x10]
call fcn.035267cc
movsx eax, cx
mov word [edi + ecx - 0x3636823a], dx
lea edx, [eax + eax*2 - 0x66af7ec]
lea esi, [esi + ecx*2 - 0x6c6d0478]
not ecx
sal eax, cl
shl dx, 5
mov edx, dword [esi]
lea ecx, [ecx + eax + 0x648aaf2b]
xor edx, ebx
push ecx
rol edx, 3
inc edx
ror edx, 3
inc byte [esp + ecx*2 - 0x5c88e85d]
lea edx, [edx + ecx - 0x5e4f7ede]
sub eax, dword [esp + ecx - 0x2e447430]
jne 0x2939998
shl eax, 0xac
lea eax, [edx + edx + 0x32812705]
xor ebx, ecx
call fcn.020866b4
lea eax, [ecx*4 + 0x6a196795]
add edi, 2
mov word [edi], dx
xadd ecx, eax
sar eax, cl
jne 0x35c38da
mov ecx, 0x330a4e94
movsx eax, cl
shl ax, 9
mov edx, dword [esi + ecx*2 - 0x66149d28]
lea esi, [esi + ecx*2 - 0x66149d24]
or cl, 0xb
shr eax, 0x5f
xor edx, ebx
rol ecx, 0x63
add eax, ecx
ror edx, 3
inc edx
call fcn.036fac94
push ecx
xor ebx, edx
add ebp, edx
shl word [esp + ecx - 0x2e44742c], 0xd
call fcn.035a8b4f
or dx, ax
rol ecx, 2
pop edx
ror eax, 0x52
neg dl
lea ecx, [ecx + eax + 0x4d597d82]
not ecx
jo 0x36e8390
neg ecx
lea ecx, [ecx + edx*4 + 0x283bc6ac]
jmp 0x207601a
jmp ebp
bswap eax
push edx
dec byte [esp + edx - 0x27aab3fd]
dec dx
ror eax, 1
jmp 0x29b032f

Function at 0x20647e5
Capabilities:
Encode data using xor

Disassembly:
pop ecx
pop eax
pop eax
jne fcn.036d6a8f
mov ebp, 0x3598c22c
mov edx, ebp
call fcn.0366549c
jne 0x2064812
dec eax
and byte [edi + 0x2c21e230], dh
int1
clc
mov edx, 0x7636f6b5
punpckldq mm6, dword [0xb555cb92]
xor eax, 0x2f6b05bd
push edx
mov ebp, 0x522f6b05
stosb byte es:[edi], al
aam 0xbd
dec edx
inc ebx
xor esi, ebp
loop 0x206481c
sub eax, 0x252aadc8
sar cl, cl
mov esi, 0x694aa7d2
enter 0x2c30, 0xfffffffffffffffa
ljmp 0xaa2d

Function at 0x20744c0
Capabilities:
Execute syscall

Disassembly:
adc esi, 4
call fcn.0367c601
syscall
inc ecx
push edi
dec eax
mov dword [esp], 0x50702902
call fcn.0366dc85
Function at 0x208ea1c
Capabilities:
Encode data using xor

Disassembly:
not cx
xor edx, ebx
inc edx
add cl, al
xor edx, 0x5e22dc37
inc ecx
sub edx, 0xdc1fb6b0
mov dword [esp + ecx - 0x6daa3700], eax
xor edx, 0x4c2d621e
dec ecx
sub edx, 0x5b20ef80
call fcn.0377c262
mov ecx, 0x41825114
shl cl, 0x25
mov dx, word [ecx + edi - 0x41825180]
mov eax, ecx
ror ax, 0xec
mov ax, word [edi + eax - 0x41821803]
add cx, cx
sar ecx, 9
mov cl, byte [ecx + edi - 0x20c14d]
jne 0x3703ab3
add edi, 4
push 0x97bcb217
call fcn.03666ecf
call fcn.0292ce47
push esi
and word [ecx], sp
call dword [esi + 0x66]
and dword [ecx], esp
fcomp qword [ebx - 0x6e]
dec eax
sub eax, 0xb4d3889a
xchg ebp, eax
xor eax, 0x340b7f75
xchg ecx, eax
mov ebx, 0xa6ceb43c
push ds
sbb eax, dword [esi + 0x53]
mov cl, 0xa4
aam 0x4b
push eax
mov al, 0x76
xchg edx, eax
xchg ebp, eax
sub al, 0xb
outsb dx, byte [esi]
pop edx
dec esp
shl dword [edx + 0x4bcea2e5], cl
xor bh, byte [eax - 0x7e76d2a7]
test eax, 0x4e343e9d
leave
pop edx
mov edx, ebx
or byte [eax + 0x10], al
dec edx
out dx, eax
aaa
ja 0x36f37d8
enter 0xffffffffffff93ca, 0x73
dec dword [edx + 0x54]
push esp
in al, dx
rol dword [ebp + 0x176c43ad], cl
mov ch, 0x82
ret 0x5a04
jnp 0x36f37c4

Function at 0x209bdad
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
imul ecx
mov dword [edi], edx
mov dword [edi + 4], eax
call fcn.036e52c0
pop ecx
jae 0x209be14
push ds
shr byte [ecx], 0xd6
add eax, 0xad9318cd
sbb dword [eax + 0x2f43f4ba], edi
push es
rol dword [ecx + 0x81022f1], 1
sbb dword [edi], ecx
mov edi, 0xf7c80fc2
rol ecx, 1
movsb byte es:[edi], byte [esi]
add al, 0
add bl, dl
xchg edx, eax
cmpsd dword [esi], dword es:[edi]
dec eax
ror ecx, 3
sub eax, edx
xor ebx, ecx
pop edx
call fcn.0370e266
xor ecx, edi
inc eax
and byte [ebx], dl
add eax, 0xe8e82d03
shl byte [eax], 0x64
xor al, 0xdf
pop eax
out 0xd1, eax
rcr dword [ecx + 0xe4a4afd], cl
xchg dh, al
or dl, byte [edx - 0x5a31dd36]
dec edx
dec ebp
jne 0x209bde1
outsb dx, byte [esi]
fild qword [ebp - 0x4ab22e9e]
sti
push ebx
xchg ebp, eax
out 0xc, eax
rcr al, cl
mov ebp, 0xd12dd52f
xchg esi, eax
xlatb
push edi
mov ch, 0x41
int 0xc0
rcl dword [edx], cl
cli
shr al, cl
cmpsd dword [esi], dword es:[edi]
retf 0xe265