joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d1a1f
Capabilities:
Encode data using xor

Disassembly:
add ecx, dword [edi]
mov edx, 0xd01b1de0
lea ecx, [ecx + eax - 0x43e92fbf]
not ecx
pop edx
call fcn.0077e656
add byte [ecx + 0x4ef], al
add byte [ebx + 0x5789b80f], cl
mov ebx, 0xfcb337b
mov edx, 0xf0f6a2f0
sub edi, 4
mov ecx, dword [edi]
mov eax, 0x7bbb5789
xor ecx, ebx
btr eax, 0xa2
div al
bt eax, 0x81
ror ecx, 2
lea edx, [eax + eax + 0x296761c]
not dl
sal eax, 0x9a
sbb ecx, 0x65b770a2
not ecx
sal dx, 0x64
ror ecx, 1
bswap ecx
sal eax, 0x3c
xor ebx, ecx
neg eax
adc ebp, ecx
mov cx, word [esi + eax*8]
call fcn.0083fd8e
mov ecx, edi
xor dl, bl
not dl
call fcn.00767e6c
wait
popal
mov byte [ebx + 0x608f7492], ah
add cl, byte [edi]
pop ecx
jecxz 0x6d19bf
or al, 0xd5
fstp dword [ecx - 0x39]
pop esp
dec eax
aad 0xd9
pop ecx
push ecx
jge 0x6d19d4
push cs
xor ah, byte [edi - 0x12]
xchg dword [ebx + 0x7b], ecx
lcall 0x416e, 0x958a8931
pop ds
salc
ret 0x6e95
Function at 0x6dd4f2
Capabilities:
Check for software breakpoints

Disassembly:
sub ebp, 8
bts ecx, ecx
mov dword [ebp + 4], eax
shr ecx, 0x4b
lea eax, [ecx*8 + 0x4bb7701a]
imul cx, word [esp + ecx - 0x1fdd18]
mov dword [ebp + ecx*4 - 0x7c0000], edx
mov dword [esp + ecx - 0x1f0000], ecx
pop ecx
pop edx
add byte [edi + edi*8 + 0xc8c89], al
add cl, ah
call [ecx + 0x5a]
jae fcn.008892e8
sub cl, dl
not byte [ecx - 0x68747785]
and ebp, dword [ebp + 0x7b]
cld
jnp 0x6dd530
lahf
xchg ebx, eax
and ebp, dword [ebp + 0x7b]
mov al, 0xb7
wait
and ebp, dword [ebp + 0x7b]
shr bl, 0xcd
jl 0x6dd5af
sti
pop ebx
dec ecx
add ecx, dword [eax - 0x65]
jne 0x6dd516
mov esi, 0x9fb5602d
mov byte [edi + 0x37], bh
sbb edi, dword [edi + esi*2 - 0x1fe1016f]
jle 0x6dd5ac
aam 0xff
lcall 0x52ff, 0xd44f7624
push esp
jb 0x6dd5b8
aam 0xff
jbe 0x6dd56d
add cl, bh
js 0x6dd58f
adc esi, dword [edi + 0x3d]
lahf
sti
add al, 4
xor al, 0x6b
jnp 0x6dd5e4
add byte [esp + esi + 0x6b], ch
jnp 0x6dd5aa
sbb al, 0x7c
xor al, 0x6b
jnp 0x6dd5b0
je 0x6dd5c9
imul ebp, dword [ebp - 5], 0x50
sahf
fcomp qword [edi - 0x63]
jne 0x6dd5f7
and eax, 0xdab5663a
or eax, 0x1ba0377c
ja 0x6dd532
invalid
mov cl, 0x53
int 0x4f
aam 0xff
ror dword [ebx - 0x23], 1
dec edi
fisttp qword [edi - 0x2c]
invalid
aam 0xff
mov ecx, 0xd44fb587
jmp [ecx + 0x78f9cbd3]
xchg dword [ebp - 0x56002bb1], esi
ror ebx, cl
stc
mov ch, 0x4f
aam 0xff
test eax, 0x78f9cbd3
push ds
js 0x6dd5d8
mov ah, 0x3d
push edx
clc
sti
push cs
push es
cmp al, 0xfb
adc ebx, ecx
dec esi
push edx
lcall 0xe699, 0x5b7542f5
jae 0x6dd631
inc edx
jne 0x6dd627
cdq
out 0x73, al
popal
dec edx
ret
add al, 0x81
jge 0x6dd5d0
xor ebx, dword [edx]
or bl, byte [ebp + 0x1b717f3b]
inc edx
cli
call eax
shl ecx, 1
cld
call [ebp + 0x13]
ror byte [eax], 0x1f
ja 0x6dd5ca
inc dword [ecx + edx*2]
ror dword [esi + 0xad0a7], 1
xor al, 0x31
call 0x3ad6560
out dx, al
mov cs, edi
xchg edi, eax
xor al, 0x5a
ja 0x6dd626
mov fs, word [edi + 0x34000ad0]
xor eax, ebp
pop ebp
invalid
js 0x6dd5a2
salc
jo 0x6dd62c
dec edx
wait
enter 0x7cc3, 0xffffffffffffffca
adc eax, 0xbea853ba
push 0x89178ef3
jns 0x6dd623
ror eax, cl
mov dword [edx - 4], ebx
pop edx
cld
push esi
or ah, byte [edx + 0x78]
push ebp
mov edx, 0xa732332f
cmpsd dword [esi], dword es:[edi]
mov bl, 0x78
or dword [esi + 0x75f9efbd], eax
push ebp
arpl bx, di
invalid
Function at 0x6dff9d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*2 - 0x401f8c56], ecx
xor eax, ebx
not eax
shr cx, 0xac
dec edx
sub dword [esp + edx*2 - 0x33537ffe], ecx
inc eax
sub dx, cx
ror dword [esp + edx*2 - 0x33537fe6], cl
call fcn.006c8c18
mov ecx, 0x8431188a
movsx eax, cl
jmp 0x6e5fda
sub esi, 4
rol al, 0x85
sar ax, 6
mov eax, dword [esi]
jbe 0xb25326
add cl, ch
call fcn.00831d6a
xadd eax, edx
adc ebp, ecx
push edx
movzx ecx, word [esp + edx - 0x21bb5649]
mov cx, word [esi + edx*2 - 0x4376ac92]
rol eax, 0x8e
pop eax
cwde
lea esi, [esi + eax*2 - 0xac90]
mov byte [esp + edx - 0x21bb5647], dh
imul word [esp + edx*2 - 0x4376ac90]
lea edi, [edx + edi - 0x21bb0ff5]
mov dword [esp + eax*8 - 0x31c30], edx
and dl, 4
call fcn.007f9792
mov edx, dword [edi]
rol ecx, cl
xor edx, ebx
xchg dword [esp + 3], ecx
xadd byte [esp + ecx - 0x2f661cfa], al
neg cl
bswap edx
not ecx
btc cx, cx
sub ax, cx
neg edx
sub edx, 0x6d86b520
bswap eax
not edx
xadd eax, ecx
xor ebx, edx
cwde
add esi, edx
Function at 0x6ea66c
Capabilities:
Authenticate hmac

Disassembly:
ror eax, 3
mov dword [esp], ecx
neg ecx
xor ebx, eax
sal dword [esp + ecx + 3], 0xa5
ror cx, 0x8d
adc ebp, eax
mov ecx, dword [edi + ecx*8 - 0x40]
mov eax, dword [esp + 4]
mov eax, dword [eax + edi - 0x4e32bb9c]
inc dword [esp]
push 0x12b6f14
sal dword [esp], 0xb1
mul ecx
call fcn.00b51bbd
mov ecx, 0x559a2fac
mov edx, dword [esi + ecx - 0x559a2fac]
bt ecx, ecx
movzx eax, cl
lea esi, [eax + esi - 0xa8]
push eax
xor edx, ebx
xor eax, 0x95a2e917
not edx
and cl, byte [esp + ecx - 0x559a2fa9]
sal dword [esp + ecx - 0x559a2f00], 0x57
sal eax, 0x36
neg edx
push ecx
not cx
push eax
not edx
xor al, byte [esp + ecx - 0x559ad0f5]
xadd al, cl
rol ecx, 0x5d
bswap edx
ror word [esp + ecx - 0xab359f7], 9
not word [esp + ecx - 0xab359fc]
jae 0x7c4601
imul byte [esp + edi*4 - 0x16]
and al, 0x6a
pop esp
sbb dl, al
enter 0x7a60, 0x5c
sbb dl, al
mov dh, 0xe
bound ebx, qword [edx + ebx - 0x30]
mov ah, 0x20
dec ebx
pushal
add dl, al
adc edx, dword [edx + edi*4 - 0x38d15a30]
push ebp
jbe 0x6ea72f
invalid
not edx
xor ebx, edx
add edi, edx
mov edx, dword [ecx + ebp - 0xab35a00]
inc word [esp + ecx - 0xab359fd]
mov ecx, dword [ebp + ecx*2 - 0x1566b3fc]
dec ax
push eax
xchg dword [esp + eax - 0x6ec000f3], eax
not edx
call fcn.0080842d
mov ecx, 0x24ab379d
mov ecx, dword [esi + ecx*2 - 0x49566f3a]
jmp 0xc09db4
call fcn.00792d80
add esi, 4
call fcn.00be5810
jmp 0xbeb002
Function at 0x6efd3d
Capabilities:
Authenticate hmac

Disassembly:
ror edx, 1
or ecx, dword [esp + eax*2 - 0x4c0000ac]
pop ecx
not edx
lea ecx, [eax*8 - 0x58526ac4]
dec edx
neg cx
pop ecx
jno 0x7c98fd
not edx
and eax, ecx
lea edx, [edx + eax*2 - 0x68fe354e]
push ecx
sub byte [esp + eax - 0x35ffffff], 0x94
rol ax, 0xcf
ror edx, 2
bswap eax
bswap ecx
xor byte [esp + ecx*2 - 0x14069], cl
dec edx
sar ax, 0x61
not cl
shr dword [esp + eax*2 - 0x36], cl
ror edx, 1
lea eax, [eax + eax*4 - 0x17c2365e]
shl al, 0xc4
sub ecx, eax
xor ebx, edx
add cx, 0xcf0e
shl dword [esp + ecx - 0x17c2a547], 0x56
adc ebp, edx
lea edi, [edi + ecx*4 - 0x5f0a951d]
lea edx, [ecx*8 + 0x64bc5129]
not edx
neg byte [esp + ecx*2 - 0x2f854a8e]
movzx ecx, byte [ecx + edi - 0x17c2a547]
adc dword [esp], edx
xor cl, bl
bswap eax
dec word [esp + 2]
dec cl
call fcn.007c7e5e
call fcn.008a82c2
inc ecx
and eax, 0x90ab1e89
jns 0x895ad6
adc ebp, 6
jmp 0xbf7164
call fcn.00bd412c
mov edx, 0xb70ec1a9
mov ecx, 0x2fa641a8
movzx eax, cl
mov eax, dword [esi + ecx*2 - 0x5f4c8350]
call fcn.00b3a3e6
bswap edx
movsx ecx, ax
inc word [esp + eax - 0x26000058]
xor ebx, edx
div cl
add ebp, edx
neg byte [esp + ecx*2 - 0xb1]
ror dword [esp + eax - 0x26000001], cl
movzx edx, byte [esi + eax - 0x25fffffc]
call fcn.00bf0e61
mov eax, 0x51f9f9a
popfd
pop esi
jmp 0x746a44
neg dx
bswap ecx
adc edx, 0xc39033bb
and dl, 0xc
div al
neg ecx
xchg edx, eax
and ax, 0x6485
push eax
xor ebx, ecx
rol dword [esp + edx - 0x10880001], 0xc9
add ebp, ecx
mov ecx, 0x57039299
mov edx, dword [esi + edx*2 - 0x21100002]
neg word [esp + ecx - 0x57039297]
mov ax, word [edx + ecx - 0x57039299]
lea edx, [ecx + ecx*4 - 0x697788d8]
call fcn.008cc935
mov esp, esi
mov ecx, 0x103b2339
pop edi
lea ebp, [ecx + ecx*8 - 0x2765aec3]
mov esi, 0x55943d8b
movsx ebx, cx
pop edx
pop ecx
xchg esi, ebx
jmp 0x7d2c62
shld edx, eax, cl
mov dword [ebp], edx
jmp edi
Function at 0x70a1e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ecx
lea esi, [esi + edx - 0x723ef82c]
call fcn.00b3b87b
sal dword [esp + ecx - 0x5b800008], 0x38
lea esi, [esi + edx*8 - 2]
movzx ecx, word [esi + ecx - 0x5b800010]
xor cx, bx
lea eax, [edx + 0x56050724]
not cx
sub cx, 0xe40a
xor cx, 0x6137
inc al
setg al
inc word [esp + edx + 6]
not cx
bswap eax
cwd
mov dword [esp + edx], edx
dec cx
xchg dword [esp + edx*4 + 2], eax
push edx
xor edx, eax
ror cx, 1
ror dl, 0x25
xor cx, 0x4da4
inc dx
mul ax
xor bx, cx
neg dword [esp + 1]
sbb ebp, 2
shr word [esp + 0xc], 0x8a
adc edx, dword [esp + 0xb]
mov word [ebp], cx
btr ax, ax
cdq
pop edx
pop ecx
pop edx
pop eax
jae fcn.007024db
mov eax, dword [ebp]
mov edx, 0x6d032619
movsx ecx, dl
mov ecx, dword [edx + ebp - 0x6d032615]
not dl
and edx, edx
lea edx, [edx*4 - 0x41cda367]
lea ebp, [ebp + edx - 0x723ef829]
dec edx
mov dword fs:[edx + eax - 0x723ef830], ecx
movsx ecx, dx
mov eax, dword [esi + edx - 0x723ef830]
jg 0x6db967
xor edx, ebx
jmp 0xb4e97a

Function at 0x70d902
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + eax*2 - 0x437e4f71]
xor dl, bl
neg dl
mov dword [esp + eax*2 - 0x437e4f72], eax
neg word [esp + eax - 0x21bf27b7]
inc dl
neg dl
not word [esp + eax - 0x21bf27b8]
lea eax, [eax + eax - 0x3cdc00d9]
rol dl, 1
xor bl, dl
call fcn.00b32e69
stc
add cl, bh
scasb al, byte es:[edi]
pop es
and byte [edi], 0xf3
xor al, 0xaf
enter 0xffffffffffff87d3, 0xffffffffffffffbb
xor al, 0xaf
enter 0x6fbb, 0xffffffffffffff93
xor al, 0xaf
enter 0xffffffffffffeffb, 0xffffffffffffff9b
xor al, 0xaf
enter 0xffffffffffffe703, 0x2b
xor al, 0xaf
enter 0xffffffffffff9793, 0xffffffffffffffcb
xor al, 0xaf
enter 0x66e3, 0x4b
xor al, 0xaf
enter 0xffffffffffffb7c3, 0xffffffffffffffce
pop ecx
cmp al, 0x35
mov eax, 0x900a4fa3
inc dword [0x1de38171]
insb byte es:[edi], dx
push ss
inc ebp
dec eax
repne movsb byte es:[edi], byte [esi]
imul edi, dword [esi - 0x2b3535a7], 0x8a4a53d5
leave
jno 0x70d937
out 0xb3, al
xor eax, 0x2d2add7c
adc al, 0x3c
mov eax, 0xc0abc284
repe scasb al, byte es:[edi]
inc eax
popal
mov al, byte [0xffff7bfa]
invalid
Function at 0x71ab1e
Capabilities:
Parse pe header

Disassembly:
btc ax, 0x8c
mov ecx, dword [ecx + edi - 0x35980000]
lea edi, [edi + eax - 0x74045c95]
add al, al
mov edx, eax
push edx
xor ecx, ebx
cdq
ror al, 0xc1
rol al, 3
not ecx
ror ecx, 2
not eax
lea ecx, [ecx + edx - 0x158243b4]
cdq
push eax
xor ecx, 0x91058228
bswap ecx
sal al, 0x81
add dword [esp + 4], 0x794553f
sbb ecx, 0x3a094e8c
sub ax, word [esp + 2]
bswap ecx
ror ecx, 1
xadd eax, edx
shl edx, 0xf7
mul byte [esp]
xor ebx, ecx
add ebp, ecx
mov ecx, dword [esp + 4]
inc al
xchg dword [esp + ecx - 0x7b98b16d], eax
pop eax
pop ecx
jge fcn.006fcf9b
mov ecx, dword [eax + esi - 0x45165c3d]
btc eax, eax
movzx edx, ax
btr edx, 0x2e
mov edx, dword [esi + edx - 0x1c39]
adc ax, 0xf21a
dec eax
lea esi, [esi + eax - 0x65164e53]
add ax, ax
adc ecx, edx
mov dword [esi + eax - 0x65169cae], ecx
movsx edx, al
mov ecx, edx
mov ecx, dword [edi + eax - 0x65169cae]
lea edi, [edi + eax - 0x65169caa]
neg eax
xadd edx, eax
xor ecx, ebx
and edx, eax
rol ecx, 2
cdq
not ax
sar edx, 0x45
sub ecx, edx
lea edx, [edx*2 + 0x5ea53112]
cwde
not ecx
lea ecx, [ecx + eax*8 + 0x78845019]
neg dx
sar ax, 0x6f
mul dx
xor ebx, ecx
call fcn.00bad782
mov edx, 0x57186d1b
mov eax, dword [edi + edx - 0x57186d1b]
push edx
push edx
mov edx, dword [eax + edx - 0x57186d1b]
mov ecx, dword [esp + 4]
push ecx
movsx eax, cl
mov dword [edi + eax*8 - 0xd8], edx
inc ecx
movzx ebp, dl
inc ebx
mov eax, dword [esp + ecx*2 - 0x1000c000]
call fcn.00728879
mov ecx, 0xaf86b30b
mov edx, ecx
btc edx, 0xbb
mov edx, esi
shl ecx, cl
shl cx, 0x4d
mov eax, 0x74044c99
lea esi, [ecx + esi - 0x35980004]
mov dword [ecx + esi - 0x35980000], edx
jns 0x6ecbfd
inc ecx
add esp, 0x2853293
xchg ch, al
inc esp
xchg dword [esp + 0xc], ecx
inc esi
sub byte [esp + ecx*8 - 0x10], dl
inc ecx
bswap esp
inc cl
inc ecx
neg esp
dec edx
lea edi, [esi*2 - 0x73dd4aea]
sal al, 7
dec esi
mov dword [esp + ecx*4 - 4], edi
dec eax
sar eax, 0x4f
xor al, 0x9e
inc esi
xor dword [esp + ecx*2 + 2], esp
dec ecx
mul esi
inc ecx
mov esi, ecx
dec esi
mov edi, dword [esp + ecx*2 + 2]
rol eax, cl
dec ecx
div ecx
inc eax
inc bh
dec ebp
arpl sp, sp
cwd
dec ecx
bts ecx, eax
dec edx
mov dword [esp + ecx - 0x4003], 0xb222500a
dec ecx
adc ebx, esp
dec edx
mov dword [esp + ecx*2 - 0x7ffe], eax
dec edx
add dword [esp + ecx*2 - 0x7ffe], 0x968f6d32
inc ebp
movzx esp, byte [ebx + esi*8 - 0x18]
dec edi
lea ebx, [ebx + ecx*4 - 0x1000b]
inc ebp
xor ah, bh
inc ecx
sal ecx, cl
inc edx
sbb byte [esp + ecx*4 - 0x20017ffa], 0x29
inc ecx
not ah
inc ecx
adc ah, 0x9f
inc ecx
not ah
inc ecx
dec ah
inc edx
xchg dword [esp + ecx - 0x8005ffa], ecx
dec edi
lea eax, [ecx + ecx*2 - 0x555a6ac7]
inc ebp
xor bh, ah
dec ebx
lea edx, [ecx + esi*8 - 0x58d1f678]
inc edx
imul byte [esp + ecx*2 - 0x1000bff3]
dec esi
lea esp, [esp + 0x10]
inc sp
btc esi, eax
jae 0x70dd8f
Function at 0x71fd54
Capabilities:
Manually build aes constants

Disassembly:
or cl, al
mov eax, edx
rol ax, 0xea
mov word [edi + edx*2 - 0x70638000], cx
mul eax
cbw
movzx ecx, dx
mov edx, dword [esi + edx*2 - 0x18aaf564]
xor eax, eax
sal cx, 0x87
mov dword [esp + eax], ecx
lea esi, [esi + eax*4 + 4]
xchg ecx, eax
xor edx, ebx
push eax
shl cl, 6
dec eax
xor edx, 0x419821b5
xor eax, ecx
jne 0xb2f90c
dec ebx
push 0xe22e183e
call fcn.00779137
neg al
jmp 0xbf715f
call fcn.0084c9fc

Function at 0x7469cb
Capabilities:
Encode data using base64

Disassembly:
shl dl, 0xe1
adc ebp, 1
sar edx, 0xe7
adc dx, dx
shr ax, cl
or dl, dl
movzx ecx, dl
mov word [ebp + ecx*8 - 0x608], ax
movzx eax, cx
mov edx, dword [esi + ecx*2 - 0x182]
mov dword [esp + eax*2 - 0x182], eax
pop eax
neg ax
lea esi, [esi + ecx*4 - 0x300]
xor edx, ebx
shr ecx, cl
inc cx
sal al, 0x21
not edx
sbb ax, cx
btr ax, 0x92
jae 0xb4d8e8
bswap edx
jb 0xbeda49
or cl, byte [esp + ecx - 0xa5fd0c8]
xor ecx, ecx
xor edx, 0x779bcda2
jmp 0xbd2970

Function at 0x75f642
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dl, 0x16
neg dl
mov dword [esp + eax - 0x5e8c9c00], ecx
add dl, 0x91
rol dl, 1
sal ax, cl
dec eax
cbw
xor bl, dl
shl ecx, 0x50
xadd byte [esp + eax - 0x5e8bfffd], ah
cbw
lea edx, [esp + edx + 8]
call fcn.008a6b66

Function at 0x767e6c
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + eax*2 - 0x46d068e4], edi
sub cx, di
adc dl, 4
xor ecx, edi
xor eax, dword [esp + eax - 0x23683470]
neg dl
bts edi, 0x2d
mov dword [esp + eax - 0x4b0aa7db], 0x73bc71a9
sbb dl, 0x8a
ror dl, 1
sar word [esp + edi - 0x6862b3af], 0xf
inc byte [esp + edi - 0x6862b3ae]
xor dl, 0x82
ror dl, 1
or di, ax
dec eax
xor bl, dl
lea edx, [esp + edx + 8]
sub eax, dword [esp + edi - 0x6862b7fe]
jnp 0x8c1097
mov ecx, 0xafbf4206
lea edx, [ecx*2 + 0x6ba8c817]
mov ecx, dword [esi]
add esi, 4
mov eax, 0x84125fac
sal dl, 0xe6
dec ax
xor ecx, ebx
add al, ah
sub eax, edx
ror ecx, 2
xchg edx, eax
add edx, edx
lea ecx, [edx + ecx - 0x7bce9dc]
ror ax, 0x4a
neg eax
not dl
bswap ecx
sar edx, 0xe5
sbb ecx, 0xff8346af
btr eax, eax
lea edx, [edx*2 + 0x47b1519f]
xor ebx, ecx
btc edx, 0x20
add edi, ecx
cbw
movsx ecx, dl
mov ebp, dword [eax + ebp - 0x34d8ffed]
ror cx, 0xa1
xadd dx, cx
jne fcn.007efe46
inc ecx
mov ecx, 0x4c0534b2
inc ebp
mov esi, ecx
inc bx
movzx eax, byte [ebp + ecx - 0x4c0534b2]
dec ebx
lea edx, [ecx + esi*8 + 0x42b4e798]
inc ebp
movzx eax, cx
inc ecx
movzx ebp, cx
inc ebx
mov dh, byte [esi + ebp - 0x4c0534b0]
dec edi
lea ebp, [ebp + eax*2 - 0x6962]
inc ecx
or edx, ecx
dec ecx
lea edi, [ecx + ebp*2 - 0x50d176e8]
inc ecx
rol esi, 0x43
inc eax
and al, dh
mov ecx, 0x4b1c8ca2
not al
dec ebp
lea esp, [esi + ebp*8 - 0x62ff8342]
dec esp
and esp, ecx
sal cl, 0xe7
inc bx
mov dword [esi + ebp - 0x6029a592], eax
dec eax
lea esi, [edx + 0x3309bc03]
inc ecx
mov eax, ecx
cwde
inc ebx
mov esi, dword [ebx + ecx - 0x4c0534b2]
inc ecx
adc eax, esp
dec ecx
btc eax, 0xaa
dec edi
lea ebx, [esi + ebx - 0x6029a58e]
cwd
inc ecx
xor esi, edi
inc cx
not eax
cwde
inc edx
lea esi, [esi + ecx*2 - 0x79811e3e]
call fcn.00754dbd
Function at 0x76ed98
Capabilities:
Encode data using xor

Disassembly:
rol ecx, 3
xor eax, 0xfdb5df3d
mov dword [esp + edx - 0x6cfa1271], 0x18b769b6
imul al
dec ecx
xor ebx, ecx
add ebp, ecx
lea edx, [eax*2 - 0x10f93e66]
movzx eax, byte [esi + edx*4 - 0x79e36f88]
shl dx, 0xa6
dec byte [esp + edx*2 - 0x3cf1f100]
mov ecx, dword [esp + edx*4 - 0x79e3e200]
lea esi, [edx + esi - 0x1e78f87f]
lea ecx, [edx*4 - 0xf458370]
not cl
xor al, bl
pop edx
xor cx, cx
adc al, 0xaa
rol ecx, 0x34
neg al
sar dl, 0xe7
xor al, 0x15
shr dx, 0xc1
dec ecx
sub cx, 0xd125
neg al
bts cx, dx
push ecx
xor bl, al
lea eax, [esp + eax + 4]
pop ecx
mov edx, dword [eax + ecx*8 - 0x36c5d0]
shl ecx, cl
shl cl, 0xc3
sbb edi, 4
lea eax, [ecx + ecx*8 - 0x5e70aad3]
xchg ecx, eax
sal ax, 0xc7
mov dword [edi], edx
shl cl, 0xe4
mov edx, eax
bts dx, 0x3b
bts edx, 0x3b
jae fcn.00bd3fc5
call [ecx - 0x4a5e7fff]
add ebp, dword [ecx + 0x1d188dc8]
add ebp, dword [ecx - 0x7a9eaa38]
add ebp, dword [ecx - 0x4a67c238]
add ebp, dword [ecx + 0x5c92dc8]
add ebp, dword [ecx + 0x75c165c8]
add ebp, dword [ecx - 0x22479238]
add ebp, dword [ecx + 0x78688dc8]
adc byte [edx], bh
xor eax, 0x7e2c0526
shl byte [edx + 0x68747d2e], 0x8e
push edx
loope 0x76ee34
xchg esp, eax
push 0xf509528e
cmp al, 0x68
mov ss, word [edx - 7]
mov ebp, 0x528e684c
in eax, 0xaa
cld
push 0x7a65528e
int3

Function at 0x771cae
Capabilities:
Encode data using base64

Disassembly:
mov word [esi + ecx*4 - 4], ax
setle dl
lea eax, [ecx + edx - 0xf6a5f7e]
ja fcn.008756d8
shr eax, 8
mov dword [esp], 0x6f8e9584
inc dword [esp + 2]
xor eax, ebx
inc ecx
shl dword [esp + 4], 0x87
jp 0x84881a
sub edi, 4
mov eax, 0xc8ad3da3
mov edx, eax
mov edx, dword [edi]
mov ecx, eax
btc ax, ax
xor edx, ebx
sub cx, 0xe8bb
bts eax, 0x88
adc ecx, ecx
sbb edx, 0x401d2a34
bswap eax
xadd ax, cx
neg edx
lea eax, [eax + eax*4 - 0x1cf745d]
rol ecx, 0x1b
ror edx, 1
sal cl, 0xc5
cbw
not edx
and ecx, ecx
bt ax, 0x2c
xor edx, 0xae0e7a9b
bt ax, 0xb1
xor ebx, edx
btr ax, cx
adc ebp, edx
lea edi, [edi + ecx - 0x448ad5c1]
movzx edx, ax
movzx eax, byte [edi + eax - 0x5663ffa0]
shr edx, 0x15
sub ecx, 0xfc259397
xor al, bl
rol al, 1
inc al
imul ecx, edx
xadd cx, dx
rol al, 1
xor al, 0x90
jmp 0x7e8614
xadd ecx, edx
dec al
or edx, ecx
or dx, cx
not al
setg cl
inc cx
btr ecx, 0xb6
xor bl, al
shr dl, 0x62
or ecx, ecx
lea esi, [esi + ecx*2 - 4]
xor cl, ch
jg 0x6f0a60
jp 0xb9effa
Function at 0x77476a
Capabilities:
Encode data using xor

Disassembly:
adc edi, 4
call fcn.00be0aee
inc ecx
mov ecx, dword [ebp]
inc ecx
mov esp, 0x839e10d
inc ebx
mov esi, dword [ebp - 0x839e109]
dec ebp
add esp, esp
not ecx
inc ecx
movsx ebp, sp
not esi
dec ecx
lea edi, [esp + ebp*8 + 0x58beb51a]
dec eax
dec ebp
or ecx, esi
movzx eax, di
and eax, 0x7e9e4c04
dec edx
lea esi, [0x2581b706]
inc ebx
mov dword [esp + ebp - 0x1073c216], ecx
inc sp
btc esi, esp
inc ebp
movzx esp, byte [ebx + eax*4 - 0x2010]
inc esp
movzx esi, dh
inc ecx
inc esi
inc esp
movzx ecx, ax
inc ebp
xor ah, bh
mov ecx, edi
btc edi, eax
ror cl, cl
inc ecx
adc ah, 0x1e
dec eax
btr esi, 0x91
inc ecx
rol ah, 1
mov edx, esi
dec eax
lea ebp, [edi + ebp*8 - 0x6a5e48cf]
inc ecx
inc ah
call fcn.00853346
cmp byte [eax], dh
add byte [eax - 0x57558d9a], al
enter 0x1eea, 0xffffffffffffffca
stosb byte es:[edi], al
test al, 0xc8
lcall 0xcac8, 0xa8aada9e
punpckhdq mm5, qword [edx - 0x9cd3758]
test al, 0xc8
xor dh, dh
or ch, byte [edx - 0x399d3758]
pop edx
stosb byte es:[edi], al
test al, 0xc8
xchg edx, eax
push ss
sbb ch, byte [edx + 0x6f9ac8a8]
push ds
xor dword [esi - 0x6e1ddd4a], 0x5b
add byte [eax], cl
ja 0x774812
or al, bh
add dword [eax], edi
cmp al, byte [esi + 0x1b124517]
mov bh, 0xa2
invalid

Function at 0x79f454
Capabilities:
Encode data using xor

Disassembly:
lea eax, [esp + eax + 8]
mov ecx, dword [eax + edx - 0x6d7c6498]
movsx eax, word [esp + edx - 0x6d7c6494]
lea esi, [edx + esi - 0x6d7c649c]
cwde
sal edx, 0x2e
xadd dx, ax
mov dword [esi + edx*4 - 0x649ad23c], ecx
cmovb edx, dword [esp + edx*4 - 0x649ad23a]
mov ecx, edx
pop edx
pop ecx
jne fcn.00823edd
sbb ecx, 0xc102f818
cdq
cdq
xor ebx, ecx
xchg word [esp + edx*2], ax
add ebp, ecx
lea ecx, [eax + edx*2 + 0x1c357506]
lea edi, [edi + edx - 4]
xor edx, dword [edi + edx*2]
xor cl, ah
xor edx, ebx
ror ecx, 0xe8
adc dword [esp + eax - 0x4d7f03b3], eax
mov word [esp + eax - 0x4d7f03b1], 0x599
rol edx, 2
inc ax
neg edx
inc dword [esp + eax - 0x4d7f03b4]
or ecx, ecx
not edx
xor byte [esp + eax - 0x4d7f03b2], 9
lea eax, [eax + eax*2 - 0x38552d69]
add eax, 0x183bd99e
lea edx, [edx + eax - 0x475c214f]
sub al, al
jge 0x884f64
adc edi, ecx
movzx eax, byte [ebp + edx - 0x6d7c6498]
lea ebp, [ebp + edx - 0x6d7c6497]
movzx ecx, dl
xor al, bl
sub word [esp + ecx - 0x93], 0x8db1
xchg edx, ecx
bt cx, dx
adc al, 0x30
mov dword [esp + edx - 0x98], ecx
rol al, 1
not al
add al, 0xbe
sal byte [esp + edx*2 - 0x12e], 1
xchg edx, ecx
sub ecx, edx
rol al, 1
ror dword [esp + edx - 0x6d7c6497], 0x9d
bts ecx, 0xa7
jb 0xb96e57
adc al, 0x86
xadd dword [esp + edx - 0x6d7c6495], ecx
xor bl, al
jmp 0x77f6b7

Function at 0x7a7cdd
Capabilities:
Execute syscall

Disassembly:
push 0xf8f8ebe
inc edx
call fcn.00ba0396
Function at 0x7c4f2d
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
add dl, dl
sbb eax, 0xc382eb30
push ecx
xor ebx, eax
ror word [esp + edx - 0x1080a401], 0x2a
adc ebp, eax
dec edx
mov eax, 0xcc037c22
mov ecx, dword [edi + edx*2 - 0x21014802]
div eax
sub al, al
mov eax, dword [edi + eax*4 - 0x52d49bfc]
adc edi, 4
xor edx, dword [esp]
adc ecx, eax
jmp 0x810f79
mov eax, 0xd228d6ab
mov dword [edi], ecx
sar byte [esp + 3], 0x84
mul dword [esp]
mov dword [esp + edx - 0x137f8a], ebp
ret
inc ecx
dec dl
mov dword [esp + eax - 0x7dff], eax
xor ecx, 0x780a4e87
mov dword [esp + eax - 0x7dfb], eax
neg byte [esp + eax*2 - 0xfbfa]
lea ecx, [ecx + eax*2 + 0x1e023a2c]
jg 0xb31653
mov eax, dword [esi]
mov edx, 0x1080a401
movsx ecx, dl
lea esi, [esi + edx - 0x1080a3fd]
or dx, cx
jnp 0x88ab73
mov bl, 0x38
or eax, dword [eax - 0x5c5d1e23]
enter 0x5cd9, 0x41
mov byte [0x35c1c8a3], al
stc
mov byte [0xc551c8a3], al
jno fcn.007c4f2d
mov dword [0x71c551c8], eax
mov byte [0xbdf9c8a3], al
shl dword [edx + 0x15a1c8a3], 1
mov dword [0xd1bdf9c8], eax
mov byte [0x15a1c8a3], al
mov ecx, 0xf9c8a3a2
lea eax, [ecx - 0x1e375c5e]
adc al, 0x1c
mov cl, 0x30
xor eax, 0x9a082d1a
push ss
jns 0x7c4f85
mov edi, 0x378a59cf
mov ss, word [ecx + 0x12]
and al, 0x72
and ebx, edx
fmul qword [esi]
jb 0x7c4fbd
or dword [edi], ecx
add al, 0x68
invalid
jmp 0x773d0d
xor eax, ebx
btc cx, cx
lea eax, [eax + edx*4 + 0x742858a6]
or cx, 0xafa6
not eax
add cx, cx
inc cx
bswap eax
jbe 0x6f04a0
out 0xc, eax
mov eax, 0x8c1bc9d
xlatb
cmp al, 0xcc
add dword [edi - 0x3e99fb17], esp
invalid
invalid
je 0x88abcb
add eax, 0x68d8f765
and dword [eax - 0x74], 0x38
call fcn.0089ab74
mov edx, 0xaf322891
lea eax, [edx - 0x12fbde58]
movzx ax, byte [ebp]
mov cl, byte [ebp + 2]
not dl
add ebp, 2
sal al, cl
lea ecx, [edx + 0x7ea3b7b5]
mov word [ebp + ecx*2 - 0x5babc046], ax
lea esi, [esi + ecx - 0x2dd5e027]
sar ecx, cl
mov edx, dword [esi + ecx*4 - 0x16eaf010]
setae cl
xor edx, ebx
inc ecx
dec edx
ror edx, 3
call fcn.0070bb12
push edx
xor ecx, 0x64002386
xor ebx, ecx
xchg byte [esp + eax - 0x7df0], ah
and edx, 0x13eedb9
ror dword [esp + edx - 0x13000ad], 0x56
add edi, ecx
mul dword [esp + edx*4 - 0x4c002e1]
bts eax, 0xa4
mov dword [esp + edx*4], edi
ret 0xc