joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e55ea
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x864
mov eax, dword [0x4a2f50]
xor eax, esp
mov dword [esp + 0x860], eax
push ebp
push 0x46
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.005343ca
add esp, 0xc
push 0x104
lea ecx, [esp + 0x260]
push ecx
push 0
call dword [fcn.00475410]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x274]
push edx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x4e5672
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x860]
xor ecx, esp
call fcn.00531591
add esp, 0x864
ret
push ebx
push esi
push edi
push 0
push 0
push 0
push ebp
call dword [fcn.00475404]
call fcn.004e551a
mov ebx, dword [0x475408]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x47c]
push ecx
push ebp
or esi, 0xffffffff
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
jne 0x4e576d
shr edx, 2
je 0x4e5738
lea esp, [esp]
mov ecx, dword [edi]
mov eax, ecx
xor eax, esi
and eax, 0xff
mov dword [esp + 0x10], eax
mov eax, esi
mov esi, dword [esp + 0x10]
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 8
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 0x10
xor esi, eax
shr eax, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x4a65f0]
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 4
test edx, edx
mov esi, eax
jne 0x4e56ca
sub edx, 1
push 0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x47c]
push eax
push ebp
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
je 0x4e56be
test edx, edx
je 0x4e5799
jmp 0x4e577a
movzx ecx, byte [edi]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 1
test edx, edx
jne 0x4e577a
sub edx, 1
mov dword [esp + 0x10], edx
push 0x104
lea edx, [esp + 0x64]
push edx
call dword [fcn.00475400]
push 0x47da8c
lea eax, [esp + 0x64]
push eax
call dword [fcn.00475424]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x78]
push ecx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4e57eb
mov eax, 1
jmp 0x4e5840
push 0
push 0
push 0x690
push ebp
call dword [fcn.00475404]
push 0
lea edx, [esp + 0x14]
push edx
push 0x48
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
lea ebx, [esp + 0x18]
mov edi, 0x47daa8
mov eax, ebx
call fcn.004e0f6a
mov ecx, dword [esp + 0x14]
mov edi, dword [fcn.00475414]
push ecx
call edi
push ebp
call edi
mov edx, ebx
push edx
call fcn.00531a3d
xor ecx, ecx
add esp, 4
cmp eax, esi
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.00531591
add esp, 0x864
ret
Function at 0x512645
Capabilities:
Encode data using xor

Disassembly:
push ecx
retf
inc eax
call 0xccdb6a1a
xor eax, ebp
add al, byte [ecx - 0x35bfb101]
xchg ebp, eax
dec eax
add ch, 0xff
pop esi
out 0xb1, al
mov bl, 0x69
xor eax, 0x668c453a
dec ebx
push es
push 0xa32c0869
dec esi
mov edx, 0x26c549ce
lds esp, [esi]
xor eax, 0x135d0928
xor dh, dl
mov ecx, 0xb9b7239b
xor dword [eax - 0x7686a78a], ecx
push 0x12283d60
and al, 6
dec ecx
mov bh, 0xcf
enter 0x3f49, 0xb
cmp byte [eax + edi*8 - 0x544303c3], cl
clc
cmp eax, 0x58abbcfc
clc
cmp eax, 0x58abbcfc
ja 0x51267e
push edx
mov al, byte [edx + 9]
mov ecx, 0xe6a1419
pop edi
jg 0x512621
push ss
fmul dword [esi]
add bh, byte [ecx]
loop 0x5125f1
cmpsd dword [esi], dword es:[edi]
xor ecx, ebp
fmul qword [ebp - 7]
cmp byte [ecx], ch
jbe 0x5125f9
lodsd eax, dword [esi]
sub dword [esi - 0x26c37f8a], 0xe9b9274f
and byte [0xc8f2ba82], cl
test eax, 0xb90d2afb
fstp xword [edx]
invalid
or eax, 0xf03adbb9
push edi
and byte [eax - 0x6c], dh
or dword [ebx + 0x22], esi
cmp cl, byte [edx]
pop esi
inc edi
nop
packsswb mm1, qword [ecx - 0xef46e45]
dec edx
test dword [eax], edi
insb byte es:[edi], dx
shr dl, 1
mov edx, edi
cmp edi, ebx
jecxz 0x5126db
adc esp, dword [esi - 0x64537111]
test al, 0x6f
xor edi, dword [edx + edi]
add dh, byte [esi - 1]
loope 0x512728
ljmp 0x70d9:0xb9026cdc
neg dword [eax + 0x520013a6]
wait
add eax, 0xf8d79264
mov ch, 0xa
lds esi, [ebx + 0x48e264fa]
push edi
retf 0x7277
scasd eax, dword es:[edi]
daa
int3

Function at 0x519cff
Capabilities:
Encode data using xor

Disassembly:
sbb edx, dword [ebp + 0x7c9c1452]
mov esi, 0x79170d5d
pmulhuw mm4, qword [edx]
in al, 0x22
in al, 0x22
outsb dx, byte [esi]
and byte [ebx], bl
movsb byte es:[edi], byte [esi]
jg 0x519c6f
arpl word [ebx], dx
sub eax, 0xef04eaa8
dec eax
inc edi
sub eax, 0x24c4d856
loopne 0x519c2d
movsd dword es:[edi], dword [esi]
salc
push 0x50caa262
sub al, 0x24
xchg dword [ebx], esi
pop ecx
fiadd dword [esi]
loopne 0x519cdd
xchg ebp, eax
ficom word [ebx + 0x4b6b054c]
stosd dword es:[edi], eax
test byte [ecx], ah
bound ebp, qword [eax + 0x67c2b834]
xchg ebp, eax
push ss
retf 0x814
ret 0x9567
push esi
pop es
add eax, 0x1e9f5086
mov ebx, 0x9b65708
push 0x89a9d4ab
pop ecx
mov edi, 0xe740a550
clc
out 0x9f, al
bound edi, qword [eax - 0x2f19d329]
mov esi, 0x17c8c038
ror al, 0x17
cld
xor al, 0xfc
pop ss
or bh, byte [ecx + 0x23d8563e]
ja 0x519d54
cdq
xlatb
invalid
or dword [eax + ebp*2], edi
out 8, al
out 0x69, al
lodsd eax, dword [esi]
or dword [ecx + ecx*2 - 0x54b9b216], edi
Function at 0x51a8d0
Capabilities:
Encode data using xor

Disassembly:
or byte [edi - 0x17], ah
ja 0x51a88d
in eax, 0xc9
mov bh, 0x4b
inc ecx
leave
lahf
add byte [esi], bh
clc
cmc
push ebp
dec edx
push ecx
test al, 0x21
cmp eax, 0x93db18f5
push edi
and ebp, edi
into
mov dh, 0x78
test eax, 0x67a807ca
test al, 0x67
adc dh, ah
cmp dword [ebx - 0x4edc16dc], 0x77543925
add eax, 0xa806b544
cwde
or dword [eax + esi*8], ebx
xor al, 6
out 0x66, al
retf 0x3cc4
adc dword [edi + 0x53626bea], esp
add al, 0x5b
imul esp, dword [edx + 0x53], 4
pop ebx
js 0x51a844
outsd dx, dword [esi]
daa
xor dword [ebp - 0x18], 0x66
xor edi, ebp
invalid
sbb dl, ch
lodsd eax, dword [esi]
mov word [edi + 0x23abcdab], es
xchg ecx, eax
je 0x51a92f
dec edi
jl 0x51a927
fisttp qword [edx]
inc ecx
cmp eax, 0xfaacbf52
cdq
ja 0x51a868
mov edi, 0x7799faac
test eax, 0x705f8e2
inc esi
adc al, 0x28
loop 0x51a8b9
add eax, 0x28144607
push cs
mov byte [eax], dl
cmp al, 0x2c
popal
sub al, 0x61
mov bh, 0x48
push esi
inc esi
pop ebp
push 0x76687e8b
mov eax, dword [0x617a9ee8]
cmp byte [0x526436d7], dh
lahf
fisub word [esi]
jb 0x51a949
cli
loope 0x51a88a
and al, 0x5a
mov ecx, 0xa98e53f9
call 0x750136e2
aam 0x67
mov byte [0xc9c9c43f], al
push ebx
mov gs, word [ecx - 0x50721418]
je 0x51a8cc
mov byte [0xc43f], al
leave
leave
jge 0x51a92b
call 0xdeb0624c
or byte [edx], 0x5e
mov dl, 0x70
idiv bl
daa
arpl bx, cx
jp 0x51a8a5
invalid
mov bh, al
xor byte [edi + 0x70], 0xb1
sub dl, byte [edx]
push edi
mov cl, 0x2a
adc dl, byte [edi - 0x27]
xchg byte [esi - 0x3a737840], bl
xchg byte [ebp + 0x4a], al
jnp 0x51a996
fld dword [esi - 0x73783f62]
lds eax, [esi + 0x5f7b4a45]
xchg dword [ebp + eax*8 + 0x7b4a4586], ecx
pop edi
and eax, 0x16346744
xor al, 0x16
push cs
push 0xc184670f
or byte [ecx], dl
fcom qword [edx]
sub byte [edi], dl
mov eax, 0xa27efa4e
dec esi
cli
jle 0x51a8ef
jle 0x51a920
xchg edi, eax
leave
mov ah, 0x28
or eax, 0x67d28bf2
clc
jecxz 0x51a97f
movsb byte es:[edi], byte [esi]
salc
clc
jg 0x51a912
test eax, 0xf436b47e
sub byte [esi + 0x1977b40a], ah
in al, 0x97
aam 0x88
inc esp
loope 0x51a939
lds esi, [edi]
lds eax, [eax + 0xa]
pop ss
mov edx, 0x191f3780
xchg esi, eax
loop 0x51a927
aaa
out dx, eax
cmp eax, 0x34fc0e37
call 0xa868b7e3
xchg esp, eax
xchg ebx, eax
fisubr dword [ebp + 0x65a794da]
jmp [ebx + 0x15e609d2]
jmp gs:[ebx + 0x15e609d2]
Function at 0x59966a
Capabilities:
Encode data using xor

Disassembly:
hlt
sahf
scasb al, byte es:[edi]
arpl word [edi - 0x253c2929], sp
mov ch, 0xda
or al, 0xb7
mov bh, 0x8a
test dword [esi - 0x512b6a33], edi
mov al, byte [ebp - 0x2b6a3242]
scasb al, byte es:[edi]
mov esi, 0xaed495cd
wait
jne 0x599617
aam 0xb6
sbb esi, dword [esi + 0x6c8d0ce5]
mov dh, 0x27
imul ebx, edx, 0xffffffc2
fild dword [eax]
and dl, byte [ebx + 0x1b]
jo 0x599679
pushfd
jl 0x599677
jb 0x5996c5
inc ebp
inc ecx
jno 0x5996f1
cmp cl, byte [ebx - 0x4424536d]
mov ch, 0x33
xor ecx, dword [edi + 0x32]
les ebx, [eax]
cmp eax, 0xe770f38a
dec ebx
lahf
sub al, 0xe6
inc ecx
push esp
cmp byte [edi + ebx*8 - 0x5ea3aced], dl
xchg ebp, eax
call 0xa4214c2e
dec esp
fld qword [edi - 0x29ec8396]
xchg esp, eax
fist word [ebx]
push ebx
pop esp
mov eax, dword [0xb56be895]
invalid
xchg dword [edx + 0x7c], ebp
adc edx, esi
sub byte [edx + 0x770349ef], dl
sub byte [esi], dl
pushal
and ah, byte [ebx]
aaa
pop eax
int 0xf6
and dword [edx + 0x63], ecx
push 0x1b
mov esp, 0xa3e5997e
stc
mov dh, 0x8e
sar ch, 8
test byte [edi + 0x3efca9d6], bh
insd dword es:[edi], dx
sub ah, byte [ecx + 0x4b]
cmp ch, byte [eax - 0x4c]
inc ecx
les eax, [ecx + 0x2f]
ror byte [ecx], 0x1f
jns 0x5996b7
mov dh, pe_nt_image_headers32
mov esi, 0xc6e52003
push 0x5b
cmp byte [esi - 0x391adffd], 0x6a
pop ebx
xlatb
pop ecx
fisub dword [ecx]
sbb esi, ebx
inc ebp
aaa
cmp byte [eax + 0x7c], al
inc edx
adc esi, dword [ebx + esi + 0x77155c94]
pop esp
adc al, 0x67
xor edx, 0xb625d119
xor eax, dword [esi - 0x9f17806]
in al, dx
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
fsubrp st(5)
push ebp
push esi
push eax
sar dh, cl
invalid
invalid
invalid

Function at 0x5b34ab
Capabilities:
Encode data using xor

Disassembly:
xchg cl, dl
stc
sar ecx, 1
mov dword [0xad2668c7], eax
push eax
xor esp, dword [eax + 0x2f]
xor al, 0x4d
jno 0x5b34ac
pop es
ror dword [edi + 0x3e094af8], 1
mov bl, 0x4b
in eax, 0xcb
stc
retf 0x9750

Function at 0x5b3a78
Capabilities:
Encode data using xor

Disassembly:
mov ch, byte [0xb0bd78a1]
loope 0x5b3a42
push edx
pop ebx
cmp edx, dword [ebp + 0x24]
leave
cmp eax, 0xf7399dd3
mov ecx, 0x807ca838
inc eax
mov dl, 0x6d
xor ch, 0x79
jae 0x5b3a85
push ds
aam 0xfb
inc esp
mov byte [ebp + 0x53], dl
or dx, word [ecx]
inc ecx
xor dword [edi + 0x18], ecx
add al, 0x73
nop
pushal
invalid
Function at 0x5f2e09
Capabilities:
Encode data using xor

Disassembly:
invalid
xchg esi, eax
mov dword [ebp - 0x1523046c], 0x3b800af4
or eax, 0xf44d1bb9
push esp
sub eax, 0x75d81738
jo 0x5f2e7c
pop es
jb 0x5f2e7d
push edx
js 0x5f2d95
mov ecx, dword [esi - 0x57660ce7]
lodsb al, byte [esi]
stc
sal dword [ebp - 0xa89db78], 1
out 0xb6, al
sbb byte [edi + 0x2421552b], cl
push eax
xor cl, dl
mov byte [0x67bb3457], al
js 0x5f2df3
invalid
and dword [esi], edx
sbb esp, dword [ebx + ecx + 0x7ca63472]
or dword [ecx - 0x3f], edi
mov edi, 0x703aa971
adc edi, edi
sti
pushfd
mov dl, 0x44
test dword [eax + 0x4cc5c1d7], edi
iretd
xor eax, 0x587c1df
call dword [ebp - 0x13]
stosb byte es:[edi], al
ffreep st(1)
xchg dword [0xaaed55ff], eax
sub dword [ebx], edx
xor al, 0x58
mov eax, 0x52bbc287
insb byte es:[edi], dx
mov edx, ebx
or edi, esp
cwde
inc ebp
cdq
sbb edi, dword [ecx + 0x161aa5d4]
xchg esp, eax
test al, 0xc1
sub dword [esi - 0xa], ebx
insb byte es:[edi], dx
scasb al, byte es:[edi]
and byte [ebp - 0x33d9d574], dl
add dword [ecx], ecx
jb 0x5f2f04
arpl sp, cx
loope 0x5f2e3f
mov ah, 0xf1
mov al, byte [0x4b51c4af]
pop ebx
ret 0xa4af
cmp ebx, dword [ecx - 0x35]
jge 0x5f2f61
int1
arpl word [ebp + 0x597b2a64], cx
inc edi
leave
sbb dword [ecx - 0x735634b5], ebx
sub dword [ebx], 0xeced47d5
loop 0x5f2f2e
sub byte [edx], bl
adc ch, byte [esi + edx*4 + 0x23]
cwde
or eax, 0x59b90554
inc edi
jmp 0x5f2f72
inc ebx
adc ch, byte [ebp + 0x19]
invalid
mov byte [0xea35f14e], al
add al, 0xdc
lea ebx, [esi + edi*2]
xor eax, 0x8ddc04ea
sbb al, 0x7e
rcl dword [esi - 0x17], 0x40
sbb dl, dh
cdq
xchg dword [ecx - 0x145aaf80], ebp
sub al, 0x5b
pushfd
xchg edi, eax
loope 0x5f2f64
xchg ecx, eax
movsd dword es:[edi], dword [esi]
add eax, 0x6678324b
cmp esi, edi
mov esp, 0x58750a1b
movsb byte es:[edi], byte [esi]
in eax, dx
push ebp
add al, 0xb5
movsd dword es:[edi], dword [esi]
xor al, 0x37
insd dword es:[edi], dx
pop eax
test dword [edi], ecx
in al, 0x38
in eax, 0xc1
inc eax
mov cl, 0xbf
sbb dword [0x5b171554], eax
cmp byte [edx + edi], ah
push edi
sbb al, 0x63
cld
cmpsb byte [esi], byte es:[edi]
inc ebx
mov dword [0x9e98d468], eax
xchg edx, eax
sbb dword [eax - 0x26d4c726], ebp
push ebp
push ebp
pop eax
popal
test al, 0xae
dec ecx
sbb ebx, dword fs:[eax - 0x3f]
cli
lodsb al, byte [esi]
dec esp
and byte [esi + 0x5b9f69d8], 0xa7
adc byte [ebp - 0x1fd693a7], dh
push ecx
invalid

Function at 0x63cd3d
Capabilities:
Encode data using xor

Disassembly:
adc dword [edi - 0x20795137], eax
mov ch, 0x62
mov al, byte [0x5b924bc4]
les ecx, [ebx - 0x6e]
pop ebx
les ecx, [ebx - 0x6e]
pop ebx
and al, 0x56
daa
pop edi
mov eax, 0x7d232179
jne 0x63cd34
or esp, dword [eax + 0x29]
add al, 0xcb
adc al, 0x82
invalid
Function at 0x7729553d
Capabilities:
Encode data using xor

Disassembly:
call 0x772954b6
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x772954e6
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x77295502
xor edx, 0
jmp 0x7729550d
xor edx, edx
jmp 0x77295524
jmp 0x77295530
xor eax, eax
push 0x8427d7c0
call 0x7729553d
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x77295579
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x77295552
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x77295590
add eax, 0
jno 0x77295595
add esi, 0
ret 0x10

Function at 0x772962fe
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x77296320
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x772964c2
cmp edi, dword [ebp + 0x10]
jb 0x772964c2
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.77295dea
inc edi
jmp 0x772963a9
jmp 0x772963b6
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.77295dea
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.77295dea
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x7729640a
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x772963ee
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.77296438
add dword [eax], 0x39
jle 0x77296414
sub al, 0xf5
mov ch, al
call fcn.7729644d
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10
Function at 0x77298125
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x7729813b
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x7729814c
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.7729818d
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx

Function at 0x7729a4f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x7729a442
add ebx, 0
push ecx
call 0x7729a457
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x73a771dc
sub ebx, dword [0x73a96a1b]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x73a96a0b
call fcn.77295f21
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.7729542f
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x7729a5b5
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x7729a5b5
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x7729a56c
mov eax, 1
lock xchg dword [0x73a96a17], eax
push 0x3dd1fc71
call 0x7729a4f9
push esi
add esp, 8
cmp eax, 0
jne 0x7729a4e2
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x7729a508
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x7729a51d
cmp ecx, edx
cmp eax, 0
je 0x7729a542
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x7729a52c
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.7729a55b
dec eax
loope 0x7729a55e
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x73a96a17], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x7729a592
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x7729a5a7
jmp 0x7729a5b2
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x7729a4a0
Function at 0x772a161a
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x772a18f0
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x73a8368f
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x73a7a655
push 0xffffffffffffffff
call fcn.7729881a
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x772a1684
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.772a169c
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x772a18e4
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x772a18b8
Function at 0x772b10ea
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x772b110c
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x772b110c
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x772b110c
ret
cmp word [ebx + 4], 0x14c
jne 0x772b110c
test word [ebx + 0x16], 2
je 0x772b110c
test word [ebx + 0x16], 0x100
je 0x772b110c
cmp word [ebx + 0x18], 0x10b
jne 0x772b110c
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x772b110c
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x772b1198
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x772b112c
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.77298077
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x772b110c
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x772b1198
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x772b110c
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x772b110c
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x772b110c
ret
cmp word [ebx + 4], 0x14c
jne 0x772b110c
test word [ebx + 0x16], 2
je 0x772b110c
test word [ebx + 0x16], 0x100
je 0x772b110c
cmp word [ebx + 0x18], 0x10b
jne 0x772b110c
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x772b110c
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x772b1198
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x772b112c
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.77298077
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x772b110c
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x772b124f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x772b12a8
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x772b124f
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x772b125e
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x776b6f01
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x772b12af
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.77298125
cmp eax, dword [ebp + 0xc]
pop eax
je 0x772b134e
add edi, 4
add eax, 2
dec ecx
jne 0x772b1294
call 0x772b12fb
loope 0x772b12f1
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x772b134b
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x772b135c
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x772b130f
cmp eax, ecx
ja 0x772b130f
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x772b1399
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x772b138f
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.77298604
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]