joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a3ca7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ef9c8
push 0x100a5d64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.005cd9a7
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b2947
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100c3ab0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.005b24f7
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.005b2577
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.005b2577
lea ecx, [esi + 0xc]
call fcn.005dea02
lea ecx, [esi + 0x10]
call fcn.005dea02
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.005b3b07
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.005b3b07
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.005b3b07
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.005dea77
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.005dea77
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5b88f7
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x1015cacc]
xor edx, edx
cmp eax, edx
jne 0x5b891d
xor eax, eax
mov byte [eax + 0x1015c9cc], al
inc eax
cmp eax, 0x100
jl 0x5b8905
mov dword [0x1015cacc], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x1015c9cc
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x5b89ae
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x5b8981
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x5b894f
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5b8a27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x5b8a7a
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x5b8a61
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5bf3f7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100c3eae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.005bfd17
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x100f0e4c
call fcn.005de7b8
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x5bf48a
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005de7b8
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x5bf483
push 0
mov ecx, eax
call fcn.005b6527
mov dword [esi + 0xc], eax
jmp 0x5bf48c
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x5bf48c
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x6514be
Capabilities:
Encode data using xor

Disassembly:
and word [esp + ecx*4 - 0x1b5fc], ax
xchg dword [esp + eax - 0x206dc5], ecx
neg edx
inc edx
push ecx
shr byte [esp + eax*2 - 0x40db94], cl
sbb cx, 0x3d84
xor ebx, edx
add esi, edx
shr word [esp + ecx - 0x4f2662e2], cl
fst dword [ecx + ebp - 0x4f2662e3]
call fcn.0073a69a
adc byte [ecx + 0x5da83689], 0x7c
xor bh, ch
xchg ecx, eax
pop edi
xchg ebx, eax
aad 0x78
xchg ebx, eax
invalid

Function at 0x6a21ea
Capabilities:
Encode data using xor

Disassembly:
push esi
mov dword [esp + 0x10], 0x6681db1f
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.006fa806
mov edx, 0x6f399ca9
mov eax, dword [edx + esi - 0x6f399ca9]
movsx ecx, dl
sal dl, 0xa5
lea ecx, [edx + edx*8 + 0x5422ae33]
movzx dx, byte es:[edx + eax - 0x6f399c20]
movsx eax, cl
jb 0x78be14
rol ax, cl
or eax, eax
adc edi, edx
sub eax, ecx
pop ecx
pop ecx
jmp edi
Function at 0x6a60ae
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
call fcn.007a0a3f
sub esi, 4
mov eax, 0xf6032585
movzx ecx, ax
shl al, 5
mov ecx, dword [esi + ecx - 0x2585]
xor ecx, ebx
sub ecx, 0xda9299a1
btr eax, eax
movsx edx, ax
xor ecx, 0x3a9dc39c
rol ecx, 2
ror al, 0xa6
not ecx
setb al
bts edx, 0xa7
neg edx
neg ecx
btr edx, eax
jae 0x6f8982
mov edi, 0x9cf181d0
ret
mov al, 0x87
mov byte [edi - 0x7c208ae4], dh
inc ebp
imul ecx, dword [edi + 0x38a7ba69], 0xffffff9e
cmp dl, bl
mov edi, 0xba1fb098
clc
and eax, dword [eax - 0x7f07393b]
cmp eax, 0x6bf3ba43
xor al, 0x4c
cmp bl, byte [esi + 0x6c]
sub dword [edx - 0x4a385f3b], 0xf51a3045
mov esp, 0xf52c2832
push esi
jae 0x6a6148
cmp byte [eax + 0x3a], bl
fbld tbyte [edx + 0x3d]
maxps xmm2, xmm7
xchg ecx, eax
int3
add dword [ecx + 0x35], edi
outsd dx, dword [esi]
jbe 0x6a60db
inc ecx
push es
xor ch, byte [esi - 0x1f]
das
ja 0x6a6191
test al, 0xe8
loopne 0x6a61cb
push ebx
pop ss
cli
cmp eax, 0xaf731a6e
cmp dh, dh
jl 0x6a6132
jmp 0xb7e4dbdd
movsb byte es:[edi], byte [esi]
and eax, 0xe73be0f7
add dword [esi], 0xfffffffe
pop esi
movsd dword es:[edi], dword [esi]
sub dl, byte gs:[edx + 0x37]
pop ecx
ret 0x980a
inc ecx
salc
rcr byte [ecx - 0x50], 0xc
pop ds
inc esi
jo 0x6a618b
add dword [ecx + 0xe], ecx
mov word [ebp - 0x1e], ss
adc eax, 0x60f2a31b
pushal
pop ds
adc dl, byte [esi]
lahf
or ebp, edx
mov eax, dword [0x10613f7b]
fsubrp st(0)
push ecx
sbb eax, 0xe0f02a4c
cli
jae 0x6a622b
inc dword [ebp + 0x17413799]
cmp esp, ecx
pushal
mov byte [ebx], dh
rcr byte [0x8ce0d79f], 0x9b
mov ebp, 0xbe0e942d
push edx
lodsd eax, dword [esi]
adc cl, byte [eax + 0x2f84bfd5]
sbb eax, 0x1bc28b9f
pop ds
add al, 0x5d
and byte [ebx - 1], dl
loop 0x6a623c
add byte [edi], bl
add edx, dword [ebx + 0x64]
adc ebx, dword [0x6738981f]
mov esi, 0xbe1e51bf
push eax
push ss
or al, 0xe1
pushal
sub eax, 0x9f1962c7
out dx, eax
int 0x4b
dec ebx
mov ebp, 0xbf0747fa
xchg ebx, eax
xchg ebx, eax
loop 0x6a61b8
add al, 0x20
cmp ebp, edi
arpl word [ebx - 1], si
int1
push ecx
add al, 0x7b
and dword [edi + ebp*2 - 0x6f3a655a], esp
inc eax
dec dword [edx - 0x413aab19]
cmp eax, 0x60fb70c7
inc ebx
test byte [edx + 0x2e], cl
pop ds
and eax, 0x3f79acc8
invalid
cwde
lea ecx, [ecx + eax - 0x22b0350b]
inc edx
ror edx, 0x4c
xor ebx, ecx
call fcn.008ca907
push edx
mov al, byte ss:[0x6dd82f73]
and ah, byte [ebp - 0x223ea29]
rol byte [ebx], 1
repe scasd eax, dword es:[edi]
jecxz 0x6f898a
sal byte [ecx - 0x3c], 1
dec ecx
aad 0xd0
cli
sahf
popfd
salc
sub byte [edi + 0x2f78d17f], dh
or dword [esi + eax*4 + 0x7f], eax
xlatb
leave
invalid
Function at 0x6dc974
Capabilities:
Encode data using xor

Disassembly:
sal edx, 0xa2
not dl
bswap ecx
ror ecx, 1
lea eax, [edx + edx*4 - 0x5159caed]
cbw
pop eax
inc ecx
sar ax, 1
neg ecx
imul dx
xor ebx, ecx
not edx
add edi, ecx
jmp edi
ror dl, 1
add ecx, ecx
pop ecx
adc dl, 0xa0
mov ecx, dword [esp]
rol ecx, 0xb2
pop ecx
rol dl, 1
inc cl
and ecx, ecx
adc dl, 0xa9
rol ecx, 0xc1
neg dl
shl cx, 1
shr cx, 0x4c
lea ecx, [ecx + ecx*8 + 0x78b0cb15]
not dl
or ecx, ecx
jne 0x81f73d
mov edx, dword [edi]
mov ecx, 0xbc1d3b07
add edi, 4
bts ecx, ecx
add byte [edi], cl
stosd dword es:[edi], eax
leave
movzx eax, cl
not cl
xor edx, ebx
shr ax, 0x6f
sbb edx, 0xd4a71b07
inc ecx
bswap edx
sal ax, 0x63
call fcn.0070bbfd
je 0x6dc9b6
push esi
ret 0x3cea
sal ecx, 0xa7
neg dl
sar ecx, 0xc7
sal ecx, 0x59
xor bl, dl
add edx, esp
neg cx
sete cl
btr cx, 0x17
mov word [edx + ecx*2 - 0x70000002], ax
mov eax, 0x443b269a
not al
shl cl, cl
lea ebp, [ebp + ecx*2 - 0x70000008]
neg al
movzx edx, al
mov ecx, dword [ecx + ebp - 0x38000002]
xor ecx, ebx
cbw
btc eax, edx
lea ecx, [edx + ecx - 0x3b2c40c6]
not ax
inc dx
neg ecx
and edx, edx
push eax
ror ecx, 3
inc ecx
jmp 0x6a0fea

Function at 0x728e99
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov esi, 0xf6307bb8
xor dh, dh
cmp si, 0xbc91
movzx esi, si
mov esi, dword [esp + 8]
mov dword [esp + 8], 0x668c1b83
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.006fa806
xor al, 0xff
jae 0x728e9d
inc edi
dec edi
cmp eax, 0xd058daab
ja 0x728f0d
nop
inc eax
sbb dl, dh
cmp dword [edi - 0x57e68fac], ebp
call 0x27467af1
mov ebx, 0xcc7d1de0
outsd dx, dword [esi]
insd dword es:[edi], dx
dec ebp
mov al, 0xa2
cli
pop ds
mov cl, 0xc2
invalid
test ah, ch
pop esp
mov esp, 0xd49b2bc7
mov dh, 0xc9
inc eax
pop edx
xor eax, dword [eax + 0x170d212c]
and ebx, esi
adc bh, dl
aam 0x63
popal
js 0x728f29
pop edi
jo 0x728ef0
andps xmm6, xmm1
sub al, 0x90
out 0x7d, eax
imul ebp, dword [ecx + 0x3a], 0xd
ja 0x728f82
int3
mov word [esi], gs
push cs
push ss
xor dword [ecx], edi
adc dword [ecx], 0x19f244f9
xor dword [ecx + esi + 0x299e76e5], ecx
add esi, esi
sbb byte [ebx], al
mov edx, 0xaeb70858
pushfd
or cl, byte [esi - 0x4b2b1e43]
pop ebx
sub dword [0x66ab2307], edi
ror ax, cl
xor ebx, edx
mov dword [esp + eax - 0xb3ef], eax
inc dword [esp + eax*2 - 0x167de]
add edi, edx
inc dword [esp + eax - 0xb3ef]
imul al
movzx ax, byte [ebp + eax*4 - 0x484]
lea edx, [ecx + ecx*4 - 0x72e625d1]
neg byte [esp + 3]
and al, 3
mov cl, byte [ebp + 2]
adc ebp, 2
call fcn.008d119d
shr dword [esp], cl
sar ecx, cl
inc al
jmp 0x78ff6d

Function at 0x743bb8
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [esp + ecx - 0x9ff7]
call fcn.007b31d1

Function at 0x76da02
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edi]
mov eax, 0x713ea530
lea edi, [eax + edi - 0x713ea52c]
mov dword [esp + eax - 0x713ea530], 0xfc30068e
xor edx, ebx
dec eax
sal dword [esp + eax - 0x713ea52f], 0x2b
not edx
xor edx, 0x4c85e09e
movsx ecx, ax
lea edx, [edx + eax*2 - 0x40401554]
jmp fcn.004db73b
Function at 0x773134
Capabilities:
Packed with generic packer

Disassembly:
adc edx, dword [esp + edx]
lea esi, [esi + edx - 0xfef8]
call fcn.0066b79f
mov dword [esp + edx - 0x6e75f33e], edx
and dword [esp + edx - 0x6e75f33a], edx
bswap eax
ja 0x7fa30f
xor eax, ebx
bt edx, 0xba
ror eax, 1
lea ecx, [edx + 0x7b080e3d]
neg ecx
sbb edx, edx
xor eax, 0x15ee0b
sub eax, 0x433f1b81
xor eax, 0x7782ada5
jmp 0x86680e
neg dl
mov word [esi], ax
movzx eax, cl
inc al
pop eax
jmp edi
xor ebx, eax
add edi, eax
mov ax, word [esi + edx - 0x6e75f33e]
mov dx, word [esi + edx - 0x6e75f33c]
add cl, 0x89
shl cx, 0x2b
adc esi, 2
bts cx, cx
and ax, dx
or dword [esp + 3], ecx
inc byte [esp + 7]
pop edx
not ax
jne 0x7766b5
mov edx, 0xce1c9cac
sub ebp, 4
lea ecx, [edx + edx + 0x3e89722d]
movzx eax, cx
shl ax, 4
mov edx, dword [ebp + eax - 0xb850]
xor edx, ebx
xor eax, eax
btr ecx, 0xba
dec ax
lea edx, [edx + eax + 0x333777a6]
dec eax
neg edx
ror edx, 2
lea edx, [edx + eax*2 + 0x28a4bc98]
xor ebx, edx
btc eax, 0xa8
sub ecx, ecx
push eax
adc edi, edx
mov edx, 0xa882b60f
xor edx, dword [esp + ecx]
mul dword [esp + eax*2 - 0x1fdfc]
mov eax, dword [esi + ecx]
jae 0x822641
or cl, byte [ecx + esi + 4]
xor dword [esp + edx], edx
jns 0x6d40be
lea ecx, [ecx + edx + 0x5cc30e71]
and dword [esp + eax - 0x64da9d91], eax
sbb edx, 0x7e236701
ror ecx, 3
dec byte [esp + eax - 0x64da9d90]
bswap ecx
neg dword [esp + eax - 0x64da9d90]
dec ax
xor ebx, ecx
cbw
add esi, ecx
jmp 0x82a168
sal dl, 0xc1
mov dword [esp + eax - 0x64daff94], esi
ret 8
call fcn.004db898
mov edx, 0x4e91a4b9
lea eax, [edx - 0x27df26fa]
ror edx, 0x48
lea esi, [esi + eax*2 - 0x4d64fb82]
mov edx, dword [esi + eax*2 - 0x4d64fb7e]
neg al
movsx ecx, al
dec ax
xor edx, ebx
sar cl, 2
not ecx
not cx
xor edx, 0x6cbcf72f
bswap edx
add cl, al
sal ax, 9
lea eax, [eax*8 - 0x63c8435f]
lea edx, [edx + eax - 0x5a343a05]
rol edx, 3
dec edx
btc eax, 0x3f
xor ebx, edx
add edi, edx
call fcn.0085714f
push edi
pushfd
mov edi, 0x139ddf0c
cmp edi, 0xc535d13a
movsx edi, di
mov edi, dword [esp + 4]
mov dword [esp + 4], 0x661e2867
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.006fa806

Function at 0x778871
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + esi - 0x4cbfcf0e]
mov dword [esp + 0x14], 0xc037e120
mov esi, dword [esp + esi - 0x4cbfcf12]
push dword [esp + 4]
popfd
lea esp, [esp + 0x14]
call fcn.007a0a3f
jmp 0x697e9d
Function at 0x7a334d
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0xf6
fmul dword [ebx - 0x7ef3dbb4]
shr dword [edi + 0x17], 8
add bh, bh
loope 0x7a33ac
lcall 0xa016, 0xe8ff9f7e
add al, byte [eax]
xor al, bl
add al, 0x98
ror dx, 4
and dx, word [esp + 6]
and al, 6
shl edx, 0x35
rol al, 1
not al
sar edx, 0xfd
or dx, 0xceaf
call fcn.0082b772
movsb byte es:[edi], byte [esi]
xchg dword [edi + esi*4 + 0x3a4d55d9], ecx
rcl dword [ebp - 0x3dba71b5], cl
inc edx
add ebp, 0x67f7191f
cmp ah, byte [eax - 0x5a]
jge 0x7a3344
cli
rcr byte [esi + eax*8], 1
imul edi, dword [edx], 0x24
cmp byte [ecx + 0x1e533a61], ch
xor eax, 0xc0f1459c
je 0x7a3358
fdivr dword [ebx]
push cs
mov dh, byte [edx - 0x36]
dec esp
pop edx
je 0x7a3334
sahf
invalid
dec edi
jbe 0x7a333c
pop esi
fisttp word [edx - 0x51]
mov cl, 0x11
int 0x82
add al, 0xd0
invalid
Function at 0x7a7f8c
Capabilities:
Encode data using xor

Disassembly:
dec esp
sub dword [esi + edx*4], edx
jb 0x7a7f8d
invalid
loop 0x7a7f8e
xor byte [eax + 0x32], bh
js 0x7a7fc1
xor cl, byte [ebp + 0x1b]
frstor dword [eax]
ror byte [edx - 0x3defe0b5], cl
dec ebp
sbb ebx, ebp
and dl, dl
mov cl, byte [ebx + 0x1f]
adc dl, al
xchg byte [edx + 0x5b], dl
mov esi, 0xd097cbf4
lds esi, [ecx + 0x12847519]
nop
mov edx, 0xafd1e0bb
mov esi, ebp
je 0x7a7f8a
fcom dword [ebx + 0x55]
or byte [eax], dl
xor eax, 0xd5c88e31
lds esi, [ecx]
sub byte [ebx - 0x35], ah
cli
lcall 0x1e71, 0x20a4cabe
and al, 0xa5
leave
xchg ebp, eax
xor eax, 0xcc4cdbec
scasb al, byte es:[edi]
or eax, 0x51d9e380
pushfd
push esp
mov ebx, dword [eax]
ja 0x7a8038
loopne 0x7a7f66
das
wait
out dx, eax
leave
adc cl, al
sbb eax, 0xe3b52e4
mov ecx, 0x967efc7c
insd dword es:[edi], dx
mov ah, 6
jae 0x7a8042
xor dword [ebp + 0x72], esp
je 0x7a8065
arpl word [ebp + 0x3976776f], cx
test byte [esi - 0x1409c649], bl
nop
aas
aaa
aam 0xf6
salc
mov ch, 0xb4
lea ebp, [ebp - 0x5a]
loope 0x7a805e
push esp
retf
outsd dx, dword [esi]
dec ebp
rcr dword [ebx], 1
cmp eax, 0x3a245d5a
xor al, 0x41
inc ecx
jb 0x7a8043
outsd dx, dword [esi]
mov bh, 0xb0
xor al, 0x56
imul byte [esi + 0x63f59005]
cli
inc edx
xchg esi, eax
jg 0x7a80cd
and dword [ecx + ebp*8], ebp
push es
nop
loope 0x7a80b8
pop ebp
sub word [edi + 0x53], cx
sub dword [edi + 0x53], ecx
cmpsb byte [esi], byte es:[edi]
xchg ebx, eax
push edi
mov dh, 0x9a
out dx, eax
adc dword [0x33c5dfc4], 0x1e
lcall 0xc5df, 0xc41583ef
xor ebx, dword [esi]
nop
xchg dword [eax + 0x400bff2c], edi
pop ecx
movsd dword es:[edi], dword [esi]
sbb esp, ecx
invalid
stc
push ss
jl 0x7a80f6
cmpsb byte [esi], byte es:[edi]
pop es
jecxz 0x7a80a9
ret
mov dword [0x5348f9c9], eax
ret 0x841f
xchg esi, ecx
insd dword es:[edi], dx
test cl, ch
pop es
mov ebp, 0x540a54e6
scasb al, byte es:[edi]
add eax, 0x36efceef
jnp 0x7a807b
out 0x54, al
or dl, byte [esi + ebp*4 + 5]
out dx, eax
into
out dx, eax
jnp 0x7a807b
daa
invalid
imul eax, ecx, 9
push cs
cmpsd dword [esi], dword es:[edi]
invalid
mov al, byte [0x681d1000]
loopne 0x7a80bf
mov eax, dword [0xfa000ab]
out 0xaa, al
out dx, al
dec ebp
test byte [ebx], ch
test byte [ebp - 0x73dd9d4e], bl
mov ch, 4
adc eax, ebp
push edi
dec edi
xchg ecx, eax
xor byte [esi + 0x27], 0x74
cmp dword [edx - 0x50], ecx
in al, 0x69
pop ss
cmp eax, 0x5f633215
je 0x7a8154
dec edx
mov al, 0xe4
imul edx, dword [edi], 0x6332153d
pop edi
mov al, 0x19
in eax, 0x6f
adc eax, 0x5319b3a6
cmp eax, 0xc51a1ef6
push cs
pushal
inc edi
add edx, dword [edi]
inc edi
dec ebx
adc byte [ebx - 0x20], dh
out dx, eax
ror byte [edx], 1
pop ss
xor al, byte [edi]
loop 0x7a8119
ret 0x733e
inc edx
int1
mov eax, 0x7a55d2b7
invalid

Function at 0x7aacf8
Capabilities:
Encode data using xor

Disassembly:
add byte [esi + 0x5e365e74], ch
mov ebx, 0x5fab7b15
invalid
Function at 0x7ce83c
Capabilities:
Check for software breakpoints

Disassembly:
and al, 0x4e
sub byte [edi - 0x357b8e28], 0xf5
and dword [0x650823c], 0xffffff88
in eax, dx
xchg ebx, eax
mov edi, 0x727df9ea
inc edi
enter 0x557d, 0xffffffffffffffb8
push cs
enter 0xffffffffffffbee3, 0xffffffffffffff86
mov edi, 0x90573bdd
xchg byte [ebp - 5], dh
js 0x7ce8d5
arpl word [edx - 0x3b29b20e], si
push es
jp 0x7ce896
sub byte [eax + 0x74faa873], 0x86
add ebp, dword [edi - 0x2b]
mov eax, 0xb4cfd99f
das
adc dword [0xefefc8c2], 0x108853de
pop esi
jp 0x7ce86e
adc edi, dword [eax - 0x16e74716]
outsd dx, dword [esi]
aaa
pushfd
dec ebx
rol ah, 1
sbb dword [ecx + 0x6d], eax
push eax
js 0x7ce8b4
retf 0xcc05
inc esi
and dl, bl
push cs
je 0x7ce91d
xor dword [ebx + 0x20], esi
ror dword [eax - 0x4d5303a2], cl
shr byte [0xf85ba6cc], 0xef
cld
lodsb al, byte [esi]
mov dl, 0xc0
sub eax, 0xf85ba6cc
out dx, eax
sar dword [ebx - 0x1a], 0x7f
lodsd eax, dword [esi]
jnp 0x7ce8a7
jg 0x7ce870
cmp dword [eax + eax*2 - 0x1f], edx
cmp eax, dword [ebx + 0x75]
stosb byte es:[edi], al
inc ebx
jns 0x7ce8bf
push ds
ja 0x7ce854
das
test dword [edx - 0x4dfe2317], esp
xor al, ch
sbb al, 0x9e
cmp al, 0xcc
fadd qword [ecx]
mov dl, 0x30
call 0xccb986fa
adc eax, 0xa8efa090
sbb eax, 0x40b0e8a6
mov eax, 0x3f9dadec
jp 0x7ce8fc
salc
pop es
pushal
adc byte [esi], bl
mov ecx, 0x970eb309
out dx, eax
outsd dx, dword [esi]
jae 0x7ce92c
das
add cl, byte [ebx + 0x75383e13]
idiv dword [edi - 0x2d]
mov dword [eax - 0x797bab1c], edx
ljmp 0xc1ef
sar byte [ecx + edi], 0xa3
jae 0x7ce922
jmp [ecx + 0x26]
imul esp, dword [esi], 0xd64ffd25
mov edx, 0xce271735
daa
into
sub ebp, dword [ebx - 0x2f]
fadd dword [esi]
pop edx
mov ebx, 0x8f9df19d
cli
retf 0x28fa

Function at 0x7f7bd6
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + ecx - 0x4084], esi
ret 4
mov edx, dword [edi]
btr eax, eax
xor edx, ebx
rol cl, 0xe5
mov dword [esp], eax
rol eax, 1
bswap edx
ror edx, 3
not edx
bswap ecx
sar eax, 0x90
and ecx, 0xe69c5e12
ror edx, 3
rol ecx, 0xea
xor ebx, edx
xor ax, ax
and cl, byte [esp + eax]
adc esi, edx
cwde
add eax, dword [ebp + eax*2]
mov dword [esp + ecx - 0x51784800], 0x8435cd83
lea ebp, [ecx + ebp - 0x517847fc]
lea edi, [edi + ecx - 0x51784801]
neg dword [esp + ecx - 0x51784800]
inc dword [esp + ecx - 0x51784800]
xadd cl, ch
movzx ecx, byte [ecx + edi - 0x51780048]
mov edx, 0xe2e102b
shr word [esp + edx - 0xe2e102a], 0x6d
sbb dl, byte [esp + edx - 0xe2e1029]
xor cl, bl
sub dl, 0xa
sbb cl, 0x37
xor cl, 0x2d
dec cl
dec dword [esp + edx*2 - 0x1c5c2042]
push edx
sal dword [esp + edx - 0xe2e101e], 0x2c
rol cl, 1
xor bl, cl
shr dword [esp + edx - 0xe2e101d], 0xf1
lea ecx, [esp + ecx + 8]
mov dword [edx + ecx - 0xe2e1021], eax
ror edx, 0xde
movzx ecx, dx
jns 0x7a89ac
Function at 0x7fb4ed
Capabilities:
Encode data using xor

Disassembly:
inc cx
dec eax
sub dl, byte [esp + edx*2 - 0x43210c02]
sbb word [esp + edx - 0x219085fa], 0xd930
mov dword [esp + edx - 0x21908600], edx
not eax
shl cx, 0x44
setae cl
sar ecx, 0xdc
inc eax
rol eax, 1
xor dx, dx
not word [esp + edx - 0x218ffffb]
rol dword [esp + ecx + 3], 0x55
inc eax
neg dx
neg eax
call fcn.007a7848
movsb byte es:[edi], byte [esi]
test al, 0x22
ror byte [ebx], cl
sahf
and eax, 0xaa03a93a
adc dh, byte [ebp - 0x24]
rcl dword [ebx + ecx*4 - 0x611a93c6], 0x64
push ecx
cmp bh, byte [eax + 0x18]
nop
cwde
sub byte [ebx], 0xe7
rol byte [edi - 0x1a033621], cl
xor esp, ebx
in eax, 0xb1
mov dword [0x7451bc0c], eax
xor ebp, ebx
aam 0xb
adc cl, al
jnp 0x7fb536
pop esp
sbb dword [eax + 0x53edd6ab], esi
sub edx, dword [edx - 0x5a]
jmp 0x7fb59a
test byte [ecx], dh
in al, dx
int1
ret
Function at 0x7fb99b
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esi]
add esi, 4
push ecx
mov eax, dword [esp]
mov dword [esp + 4], edx
cdq
inc dword [esp]
setp al
push dword [esp + 4]
popfd
mov dword [esp + 4], 0x40afd326
cbw
imul dword [esp + 4]
mov eax, dword [edi + eax*4 - 0x6f780000]
mov byte [esp + 3], dl
adc edi, 3
xor eax, ebx
bt dx, 0x20
bt ecx, 0xab
bswap eax
shr byte [esp + 3], 7
xor eax, 0x7a38853d
ror ecx, 0xe
lea ecx, [edx*8 - 0x58d17048]
rol eax, 1
neg eax
dec eax
jmp 0x88697f
call fcn.0087e80b
shr byte [esp + 2], 0x87
mov dword [esi], edx
sbb ebp, 4
shl dword [esp], 0x4d
mov edx, dword [ebp]
mov eax, dword [esp]
jnp 0x8b16af
xor edx, ebx
mov ecx, 0x313fdd9a
cwde
neg edx
sar cl, 0x81
and ecx, 0x932ed114
inc edx
rol edx, 1
or cl, 0x86
dec edx
neg al
imul cx, cx
ror edx, 1
lea eax, [ecx*8 + 0x5f9345bb]
lea edx, [eax + edx - 0x3bf04924]
lea ecx, [eax + eax*4 + 0x16a72c8f]
neg edx
bt ax, cx
push ecx
xor ebx, edx
add edi, edx
pop edx
sal byte [esp + 3], 0x22
neg eax
mov dword [esp + eax*2 - 0x2df8524a], edi
ret
xor cx, cx
bswap ecx
xor bl, dl
sar ecx, 7
sub cl, ch
sal cx, 0x49
adc edx, esp
sal ecx, 0xbc
mov ax, word [eax + edx - 0x178e1355]
shl ecx, 0xb7
lea edx, [ecx + ecx*8 + 0x251bbd0c]
lea edi, [edi + ecx - 2]
mov word [edi + ecx], ax
lea eax, [edx + 0x5294abb6]
shr dl, 0x85
lea esi, [esi + ecx - 4]
mov eax, dword [esi + ecx*8]
xor eax, ebx
xor dx, 0x995
neg eax
ror eax, 3
call fcn.0089c50f
cmp dword [ebx], ebp
sbb ch, bh
dec ebp
scasb al, byte es:[edi]
jp 0x8b16e4
xchg ebp, eax
or edi, esi
fadd st(1)
enter 0xffffffffffffe803, 0x10
scasb al, byte es:[edi]
invalid
pop edi
push esp
loope 0x8b1774
fisttp qword [edx + 0x7a]
sub dh, bl
outsd dx, dword [esi]
fstp qword [esi]
pop ss
dec ebp
mov ah, byte [edx]
jge 0x8b1717
and dword [edx], 0x6b89070b
fisttp qword [0x7af2d615]
fst qword [ebp - 0x3c]
and dword [edx], 0x43
pop es
into
mov byte [0xff48228a], al
das
jne 0x8b1719
je 0x8b1789
and al, 0x85
and al, ch
cmp bl, ah
shl dword [ecx + 0x258e20b7], 0x1f
or byte [ecx - 0x27f72ef3], 0xf
cmp byte [eax], dl
or eax, 0x93ea9057
or bl, ch
popfd
xchg esp, eax
pop ecx
dec ebp
sti
xchg esp, eax
fmul dword [edi + 0xd806096]
nop
xchg dl, bh
sub byte [esp + ebp - 0x33601991], cl
push 0xecec2288
and dh, byte [eax + 0x4c]
push 0xffffffffffffffe3
fisubr word [edi + 0x46]
jmp 0x8b16f3
jecxz 0x8b1754
outsd dx, dword [esi]
inc esi
sal byte [esi], 0xa4
mov ebp, 0x13f056be
inc esp
cmp eax, 0x56613021
mov byte [0xcab01ae8], al
mov al, 0xca
test al, 0xf5
clc
xchg edi, eax
and cl, bl
xor esi, dword [edi + 0x6bbff028]
adc ah, byte [ecx]
xlatb
salc
arpl bp, bx
sal dword [ecx - 0x6c], 1
into
add dword [ebx + 0x37], ecx
sub dword [ebp - 0x57cfbb93], esp
adc ebp, dword [ecx - 0x23]
ret 0xb565