joyce8/EMBER2024-capa huggingface dataset:
Function at 0x35c4820
Capabilities:
Encode data using xor

Disassembly:
xor dl, bl
add dl, 0x82
xor dl, 0x34
lea ecx, [eax + eax*8 - 0x1b4759cf]
sar eax, cl
push ecx
not dl
jp 0x2091bcd
mov eax, 0xae3de8b0
lea ecx, [eax + eax*4 - 0x427390f4]
movsx edx, al
rdtsc
lea esi, [ecx + esi - 0x24c1fa84]
neg ecx
mov dword [esi + 4], eax
mov dword [esi], edx
mov edx, dword [edi]
movsx eax, cx
ror ecx, cl
lea edi, [eax + edi - 0x580]
push eax
xor edx, ebx
xor eax, 0x6c890103
lea edx, [ecx + edx + 0x71ef8db2]
seta al
and eax, 0xac350616
dec dword [esp + ecx - 0x4db3e058]
bswap edx
sub ecx, 0x6db8449a
call fcn.036c074c
mov dword [esi], eax
sub ebp, 4
mov ecx, 0x72b8d389
jmp 0x36c5d11
add edi, eax
xor dword [esp], edx
ror dword [esp], cl
pop eax
jae fcn.035561cf
sar ecx, cl
ror eax, 2
xadd dx, cx
mov dword [esp + edx - 0x8fe7], ecx
jnp 0x20c6b0e
not eax
bswap eax
ror eax, 1
sub dword [esp + edx*4 - 0x23f9c], edx
or edx, 0xf710d19d
xor ebx, eax
inc dl
jle 0x351836c
lea edi, [edi + eax - 0x71a90f42]
lea edx, [eax + eax*4 + 0x1c2ffc16]
xadd eax, edx
sub dx, 0x403
mov eax, dword [edi + edx - 0x71a90b3b]
adc cl, dl
xor eax, ebx
shl cl, 0xa1
xor edx, ecx
bswap edx
lea eax, [eax + ecx*2 + 0x10d20cb3]
neg eax
sal cx, cl
ror eax, 1
or dx, 0x5682
sbb eax, 0x361344bb
call fcn.02965908
sbb byte [esi - 0xd], bl
and edi, dword [esi]
mov ch, 0xf1
mov ecx, 0x52549601
retf 0x5682
scasb al, byte es:[edi]
sub esi, eax
dec edx
ja 0x35c488b
sbb dword [edi], ebx
xchg dword [0x5ed7791c], ebp
sar byte [ebp + 0x4adc2ffa], cl
sub eax, 0x6e2c4b35
jbe 0x35c491f
adc byte [esi - 0x6628f97f], ch
rol bh, cl
int 2
dec ebx
invalid
mov edx, dword [eax + 0x49]
je 0x35c48a6
scasb al, byte es:[edi]
dec edx
sub eax, 0xa202c569
outsd dx, dword [esi]
xchg esi, eax
loop 0x35c48bf
cmp al, byte [ebp + 0x389987c3]
mov dh, 0x4b
invalid
mov eax, dword [ebp + ecx - 0x72b8d389]
and ecx, ecx
movsx edx, cl
xor eax, ebx
xor eax, 0xbd955536
bswap eax
call fcn.029fbace

Function at 0x35c7d88
Capabilities:
Encode data using xor

Disassembly:
mov ch, byte [edx - 0x5a]
add edi, 4
shld ax, dx, cl
mov word [edi], ax
push 0x432c2339
mov edx, dword [esi]
mov eax, 0xcb3050b5
add esi, 4
mov dword [esp + 4], eax
dec ax
xor edx, ebx
movsx ecx, al
rol edx, 1
shl eax, cl
inc eax
lea ecx, [eax*4 + 0x32193681]
bswap edx
neg byte [esp + eax - 0xb3ffffd]
call fcn.036c88e8
out dx, eax
sub byte [edi + 0x45], al
fldl2e
stosd dword es:[edi], eax
add esp, ecx
jl 0x35c7d9a
in eax, dx
mov edx, 0x95d0a906
std
jae 0x35c7d6b
pop es
cmpsb byte [esi], byte es:[edi]
push esi
add edi, esi
sub eax, 0x18ffc8af
jae 0x35c7dd8
dec ebx
clc
pushal
jnp 0x35c7e57
add byte [ebp + ebp*4 + 0x21fe0955], ch
push ecx
mov al, 0x81
ret
pop ebp
popfd
jne 0x35c7e57
push esp
mov dh, 0x96
out dx, eax
cli
sbb dword [ebx + 0x6d], ecx
jmp 0x35a3a7ff
Function at 0x368cd60
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
bswap eax
or cx, 0x2e2b
shl ecx, 0xe
je 0x29bf5ff
not eax
shr ecx, 0xcb
xor ebx, eax
xchg edx, ecx
add edx, ecx
adc ebp, eax
jmp 0x3783bdc
movsx ecx, ax
mov eax, dword [edi]
adc edi, 4
xor eax, ebx
shl ecx, 0x21
movzx edx, cl
rol eax, 1
bswap eax
or cx, dx
dec dl
xor eax, 0xdd39fa0f
lea eax, [eax + edx + 0xcad1123]
jmp 0x36d6fb0
neg edx
lea ecx, [eax*2 - 0x17e16f60]
ror edx, 2
mov dword [esp + eax - 0x5c4bbc3f], 0xfa205ca7
neg edx
sal dword [esp + eax - 0x5c4bbc3d], 0x83
push eax
xor edx, 0xc1126202
shr cl, 0xa2
add ecx, ecx
lea ecx, [eax*4 - 0xcf68377]
neg edx
shr eax, cl
push ecx
not edx
push eax
shr dword [esp + eax*8 - 0x1712ef02], 0x51
call fcn.0293aeac
mov eax, 0xfe8eb01e
mov cx, word [ebp]
mov edx, eax
sub ax, ax
dec al
adc ebp, 2
inc edx
je 0x29a59d9
xor al, 0x1b
movzx edx, byte [esi]
adc esi, 1
xor dl, bl
call fcn.0359b79e
ror eax, 1
xor ebx, eax
add ecx, 0x36bd011e
sub edx, edx
add dx, cx
adc ebp, eax
sal ecx, 0xb9
jmp ebp
movsx eax, cl
mov dx, word [edx + esi - 0x17167]
sal eax, cl
sbb ax, cx
lea eax, [eax + ecx - 0x1e645879]
mov cx, word [esi + ecx*4 - 0x3a]
add ax, ax
adc esi, 2
inc al
or dx, cx
not eax
not dx
mov ecx, 0x7d07e11c
bswap eax
mov word [esi + ecx - 0x7d07e11c], dx
jmp ebp

Function at 0x368cdd9
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x7ca52fb7
pop ecx
pop eax
jae fcn.0376e7f8
inc eax
xor bl, cl
and edx, 0xc4b444b6
adc ecx, esp
add eax, 0x219f501c
neg ax
inc edx
mov edx, dword [ecx + eax*2 - 0x433f4100]
shr ax, 0x4c
lea esi, [esi + eax*2 - 0x433e0018]
jp 0x297dcff
bswap ecx
inc edx
bswap edx
xor ebx, ecx
xchg edx, eax
call fcn.02925683

Function at 0x3695a0b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], eax
sbb ebp, 4
sar dword [esp + 4], 0x46
mov ecx, dword [ebp]
ror al, 0xc1
jno 0x36ce82b
add edi, ecx
movsx ecx, ax
mov dword [esp + edx - 0x29], edi
ret 4
mov dword [esi + 0xc], eax
mov eax, 0xc3812683
mov dword [esi + 8], ebx
movzx ebx, word [esp + 4]
rol ebx, 0xb2
mov dword [ebx + esi - 0x769bfffc], ecx
pop ecx
mov dword [esp + ebx - 0x769c0000], 0x41a8e82e
mov dword [esi + ebx - 0x769c0000], edx
mov ebx, dword [esp + ebx - 0x769bfffc]
rol word [esp + 1], 0xa2
jae 0x292430b

Function at 0x369719d
Capabilities:
Encode data using xor

Disassembly:
neg ecx
bswap ecx
xor ebx, ecx
sal byte [esp + 6], 0x24
jbe 0x371fa60
xor ebp, 0x39a8a88f
inc esp
movzx edi, bh
inc esp
add bh, bl
shl bx, 0xa3
lea ebp, [ebp + eax*2 - 0x5429f6d0]
ror ebp, 2
dec eax
sar edx, 1
inc ecx
push edi
add dword [esp + ebx - 0x59d4], 0x6e03b308
xor ebp, 0x34a132a0
inc esp
xchg dword [esp + edx - 0x7ffff40c], eax
sal dword [esp + edx - 0x7ffff40b], 0xb7
dec eax
or dword [esp + eax*8 - 0x740d0], edx
dec esp
mov dword [esp + edx - 0x7ffff40d], esi
xor dword [esp + edx - 0x7ffff40d], ebp
push edx
dec esp
mov esi, dword [esp + edx - 0x7ffff405]
call fcn.0352c556
Function at 0x36a0ff6
Capabilities:
Encode data using xor

Disassembly:
xor edx, 0xd28c08a6
xor dword [esp], ecx
pop eax
not edx
xor ebx, edx
add cx, ax
sar ax, 0x21
call fcn.0377c208
sub dx, cx
jae fcn.0375072d
mov edx, 0xc78d3e8d
sub edi, 4
movsx ecx, dx
shr edx, 0x57
mov eax, dword [edi + edx*8 - 0xc78]
add ecx, 0xc6bc68b7
xor eax, ebx
xor dl, ch
inc eax
xor cx, dx
not eax
jno 0x36bb4e1
rol edx, 2
xadd dword [esp + ecx*2 - 0xf81fc], eax
inc dword [esp + ecx - 0x7c0fc]
neg edx
not ecx
rol edx, 2
inc cl
pop eax
jge 0x20960a6
inc ecx
mov eax, dword [ecx]
inc ecx
mov esp, 0x14bc44b6
dec edi
lea ecx, [ecx - 0x14bc44b2]
dec edx
lea esi, [0x5800d892]
dec esp
lea edi, [esi*4 + 0x67917513]
inc ecx
movsx ebp, di
inc ecx
xor eax, esi
call fcn.0359f270
rol dword [esp], 9
shl dword [esp], 0x64
xor ax, 0xcc86
ror ax, 1
add ax, 0xcf01
rol ax, 1
xadd edx, ecx
sub ax, 0x9036
add dword [esp + edx - 0x51ab9ead], edx
xchg dword [esp + edx - 0x51ab9ead], edx
not ax
shl dl, 0x84
pop edx
or dx, 0xd291
inc ax
inc ecx
not ax
neg ax
sub ax, 0x2cb5
bswap edx
ror ax, 1
xor ax, 0xfeac
sal edx, cl
xor bx, ax
sub esi, 2
lea edx, [ecx + edx*4 + 0x2192e39a]
dec cx
mov word [esi + edx - 0x30ca4790], ax
mov dword [esi + edx - 0x30ca4790], eax
neg edx
jnp 0x3659ede
stosb byte es:[edi], al
lfs ebp, [ebp - 0x15985be4]
in eax, 0x78
push cs
push 0xb4e299c4
xor eax, 0xa2c3e69b
xlatb
in al, dx
push ebp
clc
pop edx
stosb byte es:[edi], al
cmp esp, dword [eax + 2]
inc edi
test al, 0x4b
stosb byte es:[edi], al
rol byte [edi - 0x5f51f803], 0x79
movsb byte es:[edi], byte [esi]
dec edi
push 0x818339dc
xor dh, byte [edi - 0x7b4f87e2]
cld
jb 0x36a10a9
invalid
Function at 0x36a2127
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0xfc9aabb0
lea esp, [esp + 4]
call int.020e2340
loope 0x36a21b8
imul edx, dword [ebx - 0x19], 0x6d
push esi
sbb byte [ebx], al
or eax, 0xfff3e925
or cl, byte [edx]
sahf
add edi, ebx
scasb al, byte es:[edi]
adc eax, 0x7e068f0d
xor byte [eax - 0x17057b03], ah
inc esi
arpl word [ecx], ax
mov eax, 0xfffd4fde
mov cl, 0xb4
or edi, dword [esi - 8]
cmpsd dword [esi], dword es:[edi]
wait
push eax
add byte [edx + 0xe], dh
mov ch, 0x3c
inc cl
lcall 0xd6d4, 0xf978245b
add byte [edx - 0x4e], 0x9e
call 0xffcaba6
mov esi, 0x5436629a
push ecx
adc byte [ebx - 0x12], cl
idiv dword [ebx - 0x57]
invalid
out 0x62, al
push ecx
imul edx, ebp, 0x54
out dx, al
adc edx, dword [edi]
pop ecx
add al, byte [esi]
push es
xchg esi, eax
loope 0x36a21fb
cmpsd dword [esi], dword es:[edi]
mov ebp, 0xb3bdfd6b
loope 0x36a21c3
salc
xlatb
or byte [ebx + 0x71fca75e], ch
pop eax
out 0x4f, eax
pushal
outsd dx, dword [esi]
or edi, dword [0xc97e68ab]
mov eax, 0xcd13d913
xor eax, 0x529ce341
sub ebp, dword [0x73b5284c]
nop
leave
adc dword [edx - 0x4f], 0x1e
invalid
inc esp
sbb eax, 0x61ff464b
cwde
les ecx, [esi]
shr byte [eax + edi*8 + 0x18adfcd7], cl
xor esp, dword [esi + 0x7c]
sub eax, 0x86b2b01e
fld dword [edi - 0x4b8e0c22]
and byte [eax + 0xa], ah
and byte [edx - 0x2b], ah
dec esp
or byte [edi - 0xa], dl
cmpsb byte [esi], byte es:[edi]
fsub st(2), st(0)
dec ecx
xor al, 0x59
jbe 0x36a2266
pop esp
in eax, 0x90
pushal
add bl, byte [edi + 0x7a98c8fc]
add ecx, dword [ebx]
in al, dx
out dx, al
mov ecx, 0x94a725ff
outsb dx, byte [esi]
jmp [ecx - 0x7d]
add byte [edi], bh
out 0x28, eax
dec esp
test eax, 0x8a30043
adc eax, 0x8d513db5
xchg ebx, eax
push ds
mov word [eax - 0x3e], cs
sbb eax, 0xdd26f7ee
dec ebx
lodsb al, byte [esi]
xor al, 0xec
fisubr word [ecx]
mov al, 0xc0
dec esi
stc
int1
lahf
mov esi, 0x24904c97
invalid

Function at 0x36a2eaf
Capabilities:
Execute syscall

Disassembly:
mov dword [edx + esi - 0x59ed], eax
mov edx, dword [edi + ecx - 0xdb25913]
lea eax, [ecx*2 - 0x267a4f46]
push ecx
lea edi, [edi + ecx - 0xdb2590f]
dec dword [esp + ecx - 0xdb25913]
xor edx, ebx
xor dword [esp + ecx - 0xdb25913], eax
bswap edx
push ecx

Function at 0x36b2f7b
Capabilities:
Execute syscall

Disassembly:
ror edx, 1
shr eax, cl
ror ecx, 0x67
neg edx
sar al, 0xa4
xor ebx, edx
ror al, 0x61
sbb ax, cx
add edi, edx
mov edx, dword [esi + eax - 0xe463]
lea ecx, [eax + ecx*8 + 0x2bb91383]
mov ecx, dword [esi + eax*2 - 0x1c8c2]
lea esi, [esi + eax*8 - 0x72314]
lea eax, [eax + eax + 0x697e8aa]
mov dword [esp + eax*2 - 0xd3362e0], eax
not edx
not ecx
or edx, ecx
mov ecx, dword [esp + eax - 0x699b170]
rol al, 2
jb 0x36ce498
syscall
push esi
call fcn.0204ba1a
mov dword [esi + eax*2 - 0xd336382], edx
lea ecx, [ecx + ecx*2 - 0x17323ee]
lea edx, [eax*2 - 0xff56961]
ror dword [esp + eax - 0x699b1c1], 0xb2
mov dword [esp + eax - 0x699b1c1], edi
ret
Function at 0x36cc9f8
Capabilities:
Encode data using xor

Disassembly:
xadd edx, eax
not cl
xor cl, 0x1f
xor bl, cl
add word [esp + edx - 0x5e2792b6], 0x8d9a
lea ecx, [esp + ecx + 0x10]
and dl, 0x82
mov edx, dword [ecx + edx - 0x5e279280]
setns al
sbb esi, 4
or ax, word [esp + 0xc]
sub ax, ax
mov dword [esi], edx
or ax, 0x5c96
push eax
setp al
pop ecx
pop ecx
pop eax
pop ecx
pop ecx
jp fcn.036d8555
adc ebp, dword [eax + 0x11ba015f]
and bl, cl
mov edx, 0xcb203e11
jae 0x20ddd3e
add eax, 0x974adc53
dec ebx
cmc
lds eax, [ebx]
jl 0x20ddd2a
sub al, 6
arpl word [edi + ecx + 0x4c084fd3], si
lea ecx, [ebx - 0x21]
push esi
sbb ch, byte [0x73446c14]
jge 0x20ddd9d
add eax, dword [esp + esi*4 - 0x51ba2c38]
push ebx
dec edx
mov byte [0x8b59faba], al
retf 0x9d1e
lodsd eax, dword [esi]
sahf
adc byte [ebp + esi*4 - 9], 7
sal dword [ebp + edx + 0x7c0164d2], 0xcc
sub eax, 0x4e8492d5
mov ch, 0x45
sahf
invalid
mov ebx, 0xc579cabe
inc ebx
push eax
dec edx
adc al, 0x2e
add eax, 0xe76783a8
insd dword es:[edi], dx
sbb al, byte [esp + esi*4 + 0x33]
jl 0x20ddd81
jns 0x20ddd56
sub eax, dword [eax + 0x311b90c3]
aas
pop esi
inc ebx
jae 0x20dde11
xchg ebp, eax
xchg byte [ebx + 0x7f], dl
add byte [edi*4 - 0x79b64ace], dl
inc edx
lodsd eax, dword [esi]
mov dl, 0xde
cli
stc
mov ch, 0xf4
jg 0x9e069935
mov edi, 0x9b7e0787
inc esp
and dword [di + 0x72], ebp
sbb dword [ebx - 0x5c], 0x64aa92fc
xor eax, dword [eax + 4]
outsb dx, byte [esi]
lds edx, [ebp - 0x66]
rcl byte [ecx - 0x78], 0xba
invalid
dec edx
mov eax, dword [0x4ad4e540]
inc eax
in eax, 0xd4
dec edx
push esi
jbe 0x20dde5f
push edx
std
salc
mov dword [ebp + 0x68c9f9fd], ebp
adc dword [ebp - 0x24b180df], edx
clc
std
stc
leave
push 0x21a59411
jg 0x20dde69
fcomi st(3)
clc
out 0x74, eax
in eax, 0xe2
ficomp word [edi + 0x73]
jnp 0x20dde04
aad 4
sub al, 0x53
out dx, eax
xchg edx, eax
inc eax
and ecx, 0x1b
pop edx
wait
and ebx, edx
xor eax, 0xb2708f6a
inc ebp
sbb byte [edi + 0x2bd22c72], 0x74
jge 0x20dde06
cmp byte [edi], 0xca
test al, 0xb8
lds edi, [0xe7a1d6c4]
cmp ecx, dword [ebx + ebp*8 + 0x490d6565]
push esp
pop ebx
cmp al, 0xf4
xchg ecx, eax
and eax, 0x6c1b4dc7
sbb byte [ecx + ecx*2 + 0x11], al
pop ebx
lahf
sbb ebp, dword [eax + ebx + 0x44]
dec ecx
adc dword [ebx - 0x61], ebx
mov byte [0xf0b8d7a8], al
sub ah, bl
mov eax, dword [0x548d9b75]
rcl dword [ecx + 0x2e], cl
invalid
xlatb
mov eax, 0xa1e32af0
jne 0x20dde0c
lea edx, [ebx + edx*8 + 0x51]
invalid
push ecx
ror dword [esp + ecx - 0x4a], cl
neg eax
bswap eax
add edx, edx
xadd word [esp + ecx*8 - 0x247], cx
xor ebx, eax
xor edx, edx
adc ebp, eax
ror edx, 0xc7
lea eax, [edx + edx*2 + 0x5e27931e]
add cl, byte [ecx + edi]
mov dword [esp + edx + 4], 0x7ea2203a
or dword [esp + edx + 0xc], edx
lea edi, [edi + edx*8 + 1]
xor cl, bl
dec edx
neg cl
bswap edx
and dl, byte [esp + eax - 0x5e279318]
rol cl, 1
jmp 0x20ddcfa
Function at 0x36da390
Capabilities:
Encode data using base64

Disassembly:
shr al, 0x22
adc edi, edx
xadd al, ah
neg al
mov edx, dword [ecx + ebp - 0x19a1cc0b]
call fcn.029a592e
mov ecx, dword [ebp + eax - 0x43690000]
adc eax, edx
jns 0x36c8954
xor cl, 8
not edx
add cl, 0xab
jmp 0x375c0a9
xor ecx, 0x33b2f980
inc ecx
jmp 0x368ce12
xor ecx, ebx
sub al, ah
jne 0x29fa276
bswap ecx
call fcn.036e5794
lea eax, [ecx*4 + 0x592e01ae]
xor edx, 0x1f351835
ror cx, 0xa7
sbb ecx, eax
sub edx, 0x75180f2a
xor ebx, edx
add esi, edx
sal ecx, cl
jmp esi
mov dword [esp], eax
push 0xe43ca098
sal dword [esp], 0xcf
dec ebx
call fcn.035a5827
mov ecx, 0x9b80784
add ecx, ecx
movzx eax, cx
mov ecx, dword [esi + ecx*4 - 0x4dc03c20]
jne 0x3732ada
lea esi, [eax + esi - 0xf04]
lea edx, [eax - 0x43686ce7]
sub dx, dx
ror dx, 0xc3
push ecx
sal eax, 0x7f
popfd
sub eax, edx
add ax, dx
lea ebp, [ebp + eax - 0x43690004]
jle 0x35b9f86
mov ecx, 0x19a1cc0c
movzx edx, cx
mov edx, dword [esi + ecx*4 - 0x66873030]
lea esi, [esi + ecx - 0x19a1cc08]
dec ecx
xor edx, ebx
xor edx, 0x671a5a25
inc edx
lea eax, [ecx + ecx*8 - 0xd75597a]
shl ax, cl
ror edx, 3
lea eax, [ecx*4 - 0x20465fe0]
ror ax, cl
xor edx, 0xf5b1c5bf
sub al, 0x8a
xor ebx, edx
jmp 0x20a5f0a
mov byte [esp + 1], al
dec edx
rol cl, 1
shl eax, 0xf3
add cl, 0x8f
xor bl, cl
neg word [esp]
sub ebp, 2
mov word [ebp], cx
bswap edx
sub edi, 4
mov eax, dword [edi]
rol word [esp], 0x65
dec dl
xor eax, ebx
neg eax
inc eax
neg eax
call fcn.036e7970
mov ecx, 0x4126bf0c
movzx eax, cx
mov edx, dword [esi + eax - 0xbf0c]
or ecx, eax
not ecx
mov ax, word [eax + esi - 0xbf08]
rol ecx, 0x9e
and ecx, 0x3524d1a8
lea esi, [esi + ecx*2 - 0x4a48a04a]
xor cl, ch
mov word [ecx + edx - 0x25245078], ax
movsx edx, cl
mov ecx, dword [edi + ecx*2 - 0x4a48a0f0]
lea edi, [edi + edx*2 - 0xec]
shr edx, 0xd5
movzx eax, dx
xor ecx, ebx
rol eax, 0xd9
rol al, 0xc2
inc ecx
or al, 0xb4
rol al, 0xa4
rol ecx, 1
jmp 0x369ac81

Function at 0x36e3f83
Capabilities:
Check for vm using instruction vpcext

Disassembly:
dec eax
call fcn.036c237f
dec ebp
jae 0x35d6597
push ss
retf 0xc723
pop es
xor edi, edi
call fcn.0377819c
ror ecx, 1
not byte [esp + 7]
call fcn.036d7a28
jmp 0x35d6536

Function at 0x36e56c0
Capabilities:
Encode data using xor

Disassembly:
cmovne dx, ax
call fcn.020e3872
shl dl, 0x41
mov dword [esp + edx], edx
lea eax, [esp + eax + 4]
mov dword [eax + edx], ecx
lea ebp, [ebp + edx - 4]
mov ecx, dword [ebp + edx*8]
movzx eax, word [esp + edx*2]
sbb dword [esp + edx], edx
xor ecx, ebx
pop eax
lea edx, [eax + edx*4 - 0x2377fff3]
ror edx, 0xcf
sbb ecx, 0x8001b719
bswap ecx
inc eax
shr edx, 0x10
lea ecx, [edx + ecx + 0x71037aed]
jns 0x3654ee2
Function at 0x36e6c1a
Capabilities:
Encode data using xor

Disassembly:
adc eax, eax
mov cl, byte [ecx + ebp - 0x436efe55]
sub eax, eax
add eax, 0x6f8b4c2f
xchg dword [esp + eax - 0x6f8b4c2d], eax
lea ebp, [ebp + eax*8 - 0x68636]
not dword [esp + eax*2 - 0x1a18a]
call fcn.0364ecab
or edx, eax
mov dword [esp + ecx*2 - 0x175f81c], ecx
call fcn.03797d21
add esi, eax
xchg dword [esp + ecx - 0x436efe55], edx
lea eax, [edx*8 + 0x22ac0e9d]
mov edx, dword [ebp + eax*8 - 0x39a0c668]
sal dword [esp + eax*4 - 0x1cd06330], 0x15
jbe 0x353b2af

Function at 0x36f574f
Capabilities:
Encode data using xor

Disassembly:
call fcn.02060095
mov ecx, dword [esi]
add esi, 4
sal eax, 0xb8
adc eax, 0x2980ae1d
shr al, 0x66
xor ecx, ebx
xor eax, 0x3c1c10bf
movzx edx, al
inc ecx
jmp 0x36f6678
push edx
movzx eax, dl
xor ecx, ebx
sub dl, 0xa2
sar ax, 0x29
inc ecx
pop eax
mov dword [esp], edx
jmp 0x374a3cd
jmp 0x37020da
xor ecx, 0x6f140aae
jmp 0x3779f82
not ecx
sub dword [esp], edx
neg dword [esp]
xor dl, 0x9f
sbb ecx, 0xa37f904
rol dword [esp], 0xd7
xor eax, dword [esp]
neg ecx
sar byte [esp + 2], 0xc2
not ecx
ror word [esp], 0x22
xor ebx, ecx
jmp 0x36b4fbc

Function at 0x3705947
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x4b1b1486], eax
xor edx, ebx
sub edx, 0xf3baa629
neg edx
movzx ecx, ax
not ecx
sub edx, 0xdd95733c
ror cl, 5
bswap edx
neg eax
bswap eax
xor edx, 0x70b5629b
shl eax, 0xb8
sub eax, dword [esp]
bswap edx
pop ecx
lea edx, [edx + ecx - 0x7e27378b]
xchg cl, al
sbb ecx, 0xd1271209
jns 0x28fed76

Function at 0x3717356
Capabilities:
Encode data using xor

Disassembly:
sal dword [esp + ecx*2 - 0x37c5c6], cl
sbb eax, 0x8912ed2b
bswap eax
call fcn.036f30eb

Function at 0x371ee9e
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x1a620000], edx
bswap ecx
call fcn.036ea336
ror ecx, 0x4e
mov edx, dword [edi + ecx*2 - 0x5556751e]
movsx eax, cl
not eax
ror ecx, cl
xor edx, ebx
bswap ecx
sub edx, 0xae0b478d
xor cx, ax
call fcn.0370f3f1
dec ebp
shl byte [ebx], 1
sar ecx, 1
dec esp
or al, 0x35
mov cs, word [ecx]
mov edi, dword [ecx + 0x2291c8d2]
dec ebx
daa
aaa
ja 0x371ef4b
cli
retf
aas
xor dword [eax], esp
aam 0x38
push ecx
push ebx
dec ecx
dec ebx
xchg esi, eax
pop ebx
in al, dx
mov eax, 0xe184c396
add eax, 0x5c775be1
aaa
mov al, byte [0xcb23936f]
xchg esp, eax
inc dword [ebp + 0x127082b2]
aad 0x1b
test byte [eax + 0x75ffb7c0], ch
invalid

Function at 0x372d94f
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
mov eax, 0x8e33bd0d
mov dx, word [esi + edx - 0xd0d5810]
sal cx, cl
call fcn.02091ac6
invalid
add esi, 2
xchg byte [esp + 8], dh
sub dx, word [esp + 7]
shr eax, cl
call fcn.03570732
adc ebp, eax
or cx, 0x5a83
ja 0x3524f4d
sar ebx, 0xbe
dec esp
mov dword [esp + ebp*2 - 0x32], edx
ret 0x10
Function at 0x3747923
Capabilities:
Encode data using xor

Disassembly:
push ebp
pushfd
mov ebp, 0xed9790a8
mov ebp, dword [esp + ebp*2 + 0x24d0deb4]
mov dword [esp + 4], 0xfc9aabb0
push dword [esp]
popfd
lea esp, [esp + 4]
call int.020e2340
mov eax, 0xa055d21
sub eax, eax
fcomp qword [esi + eax*2]
lea ebp, [ebp + eax*2 - 4]
shl eax, 0x2a
movzx ecx, ax
mov edx, dword [ebp + eax]
xor cx, 0x1910
sal ecx, 0x1d
or ecx, ecx
xor edx, ebx
bswap edx
lea ecx, [eax*4 + 0x50053c23]
sub edx, 0x941e733c
neg edx
call fcn.020cbd03
jg 0x2070e23
wait
and bh, byte [ebp - 0x7e]
mov ah, 0x84
xor al, 0xf2
mov ah, 0x25
rcl edi, cl
mov dl, 0x7c
cld
sub al, 0x5e
sbb dword [esi + edi*2 - 0x1661314c], eax
sar ch, cl
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x75f2cb8e]
jl 0x2070e9c
sub al, 0xb4
mov al, byte [0x7b3b7bb5]
xchg ecx, eax
js 0x2070ea1
lahf
push ebp
dec edi
mov ch, 0xc8
sub byte [eax + 0x3f5235f5], dl
dec edx
cmpsd dword [esi], dword es:[edi]
dec edx
invalid
enter 0x46dc, 4
invalid
insd dword es:[edi], dx
sbb cl, byte [ebx + edi*8 + 0x14]
lea eax, [esi + 0x5a]
mov eax, dword [0x1728b313]
into
invalid
ror dword [esp + 4], 0x32
sal dword [esp + 2], 0xb2
adc esi, 8
mov edx, 0xe2a66b7
sub dx, dx
mov dword fs:[ecx + edx*4 - 0x38a80000], eax
xchg dword [esp + edx*2 - 0x1c53fffc], edx
jbe 0x36bdf44
bswap eax
xor eax, 0xf8392115
xor ebx, eax
add esi, eax
lea esp, [esp + 8]
jmp 0x2070ddd
mov ax, word [eax + esi - 0x2223be7d]
sar cx, cl
shl cx, 0xc3
add esi, 6
mov word [edx], ax
shl cl, 7
mov edx, dword [edi]
call fcn.036e7fce
lea eax, [edx + eax + 0x3e3e3b00]
bswap eax
call fcn.03582f4f
invalid
jmp 0x2964b90
mov eax, 0x76120185
mov dword [esp + eax - 0x76120185], ebp
ret 4
neg dword [esp + ecx - 0x63403aca]
inc edx
not edx
neg cl
not ecx
inc edx
shr cl, 0x26
jnp 0x352aec1
xor ebx, edx
neg ax
lea ecx, [eax + eax*4 - 0x5ff170d4]
dec ecx
add esi, edx
mov dword [esp + eax*2 - 0x18a62], 0x8e27950b
sar eax, 0xa1
mov eax, dword [eax + ebp - 0x6298]
mov cx, word [eax]
sal dword [esp + 5], 0x34
jnp 0x207eec1
add ebp, 2
ror dword [esp + 8], 0x82
mov word [ebp], cx
mov edx, 0x56ac789a
mov dword [esp + edx - 0x56ac789a], esi
ret 8
Function at 0x3764b1b
Capabilities:
Execute syscall

Disassembly:
mov edx, ecx
mov edx, dword [esi + edx - 0x56a03b03]
dec cx
movsx eax, cl
sets cl
lea esi, [esi + eax*2]
shl eax, 0x61
xor edx, ebx
shl cx, 0xaf
xor cl, al
lea eax, [ecx + ecx*2 - 0x3bc5b5f2]
inc edx
inc eax
dec eax
rol cl, cl
ror edx, 1
or al, 0xd
lea eax, [eax + 0x799b5406]
lea edx, [edx + ecx - 0x3bfd4d0e]
bswap edx
xadd eax, ecx
xor ebx, edx
add ebp, edx
movzx edx, cl
xor eax, edx
mov cx, word [edi + ecx - 0x41b59e25]
inc edx
sar edx, 0x42
lea edi, [edi + edx*4 - 0x22]
ror dx, 9
sbb eax, eax
sar eax, 0x10
or al, byte [esi + eax]
ror dl, 0x63
ror dx, 0x45
lea esi, [edx + esi - 0x801f]
setae dl
shl edx, 0x30
xor edx, 0x890c1b04
xor al, bl
inc al
or dl, dl
ror al, 1
ror edx, 0xf8
or edx, edx
rol dx, 0xe3
not al
sbb al, 0x36
xor bl, al
jmp 0x36be77b
movsx ecx, ax
lea ebp, [edx + ebp - 0x5360804]
rol edx, 0x7d
ror dx, 0x24
mov eax, dword [ebp + eax - 0x40000000]
call fcn.037827d3
syscall
call fcn.036b4ad1
add ebp, eax
neg cx
jno 0x36d5373
syscall
call fcn.035d339a
call fcn.036bc7d5
xor edx, 0xc896903f
lea ecx, [eax*8 + 0x7a800eb9]
xor ebx, edx
add edi, edx
mov dword [esp + ecx - 0x4782f2c5], 0x62ac3f0c
xor eax, 0x7a32d9a6
mov dword [esp + ecx - 0x4782f2c9], edi
ret 0xc
neg dx
add eax, esp
lea edx, [edx*2 + 0x7d10d030]
xchg dh, dl
mov word [eax], cx
or dx, dx
not dl
jmp ebp
push ecx
movzx ax, byte [edi]
shl edx, 0x42
xor dl, 0x18
mov cl, byte [edi + 2]
xor dx, dx
neg edx
push edx
lea edi, [edi + edx - 0xfffe]
ror word [esp + edx*8 - 0x7fffa], 5
pop edx
call fcn.036dec0e
xchg al, dl
jg 0x356e14e
mov dword [esp], ecx
add esi, 4
movzx eax, byte [edi]
shl cl, 3
add edi, 1
xor al, bl
neg dword [esp]
lea ecx, [ecx + ecx*4 - 0x50e489dd]
ror cx, 0xa5
inc al
xor al, 0xa3
pop ecx
dec cl
inc al
call fcn.0294dd0d
sbb edx, 0x31c9713
xor ebx, eax
sar edx, 0x99
setb cl
jb 0x3696bc1
xor ecx, ebx
add ecx, 0x5e09991d
rol ecx, 1
dec dword [esp]
mov edx, 0xcaac919d
xor ecx, 0x6d2e9b2a
sal edx, 0x47
not ecx
sub ecx, 0x4a9c0c0c
ror ecx, 3
pop eax
not ecx
sar edx, 0x19
xor ebx, ecx
add edx, edx
call fcn.035d9c7c
mov ecx, 0x56a03b03
jmp 0x2086cd8

Function at 0x3777537
Capabilities:
Encode data using xor

Disassembly:
movsx edi, dl
inc ecx
mov ebx, 0x330e84
dec ebp
lea ecx, [ecx + edi - 0x3c]
dec eax
mov dword [esp + edi - 0x40], edx
inc ecx
xor ebx, esi
inc esp
movzx esp, dx
shr word [esp + edx - 0x620dbf3f], cl
xor ebx, 0xdebc5820
dec ecx
xor edx, esp
dec eax
sub dword [esp + edi*2 - 0x80], 0x10bc9010
lea ebx, [ebx + ebp - 0x786da8f4]
dec ecx
lea ebp, [esp - 0x78ca7afe]
inc ebp
movzx eax, bl
not ebx
xor word [esp + edi*2 - 0x7e], bp
xor ebx, 0xa6a0db1c
inc cx
and esp, 0xcb0fbd30
rol ebx, 2
xor ebx, 0xea1ceb23
inc ecx
mov eax, ebx
neg ebx
inc eax
xor bh, 8
xadd edi, edx
dec esp
mov dword [esp + edx*2 - 0x90], esi
dec eax
shr ebp, 0x2f
call fcn.02023b7c
cmp dword [esi + 0x51], 0x21
push ebx
clc
jnp 0x3777594
ret
ljmp 0x1a7a:0x4af900ad