joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbdf112
Capabilities:
Encode data using base64

Disassembly:
lea eax, [edx*2 - 0x456f3fee]
mov eax, dword [edi]
lea ecx, [edx + edx*8 - 0x7d7718e5]
shl ecx, 0xcc
mov ecx, dword [ecx + eax - 0x2ea9b000]
movzx eax, dl
sal eax, 0x39
adc dl, dh
mov dword [eax + edi], ecx
mov edx, dword [ebp + eax*2]
mov ecx, eax
jns 0xd3f120
sar ecx, 0xa
xadd edx, ecx
mov ecx, dword [esi + ecx*4 - 0x1f4fad8]
mov eax, 0x9472ab
xor ecx, ebx
dec eax
sub eax, eax
rol ecx, 1
not ecx
imul ax
or ax, 0x972a
adc ecx, 0xbc04c622
dec edx
xchg dx, ax
bswap ecx
rol ecx, 3
not eax
push edx
neg ecx
neg ax
cdq
jno 0xaf494f
push edx
mov dword [esp + 4], 0x874e6e24
lea esp, [esp + 4]
call fcn.00ab2b2d
xor ecx, edx
ror dx, 0x41
adc ax, word [esp]
mul byte [esp]
xor ebx, ecx
rol word [esp + 2], 0x61
adc edi, ecx
add dx, 0x9d24
pop edx
jne fcn.00a7447b
ror edx, 1
shl eax, 0x6a
xor ebx, edx
xor cx, cx
sbb ecx, 0xea2f7f35
add esi, edx
cbw
movzx edx, cx
mov edx, edi
lea edi, [eax + edi - 0x5f350002]
inc cx
mov word [edi + eax - 0x5f350000], dx
sub cx, cx
jge fcn.00cba72e
not eax
xor eax, 0xf4911526
mov dword [esp + edx*8 - 0x28430], 0x52005e2a
pop ecx
neg ecx
bswap eax
sal ecx, 0x6a
mov dword [esp + edx*2 - 0xa10c], ecx
inc eax
xor ebx, eax
inc word [esp + edx - 0x5086]
call fcn.00c3afc6
mov edx, 0x8a3bc780
jmp 0xa7eddc
adc esi, edx
bts ax, 0xb9
mov edx, 0x8bfb5ba
or ecx, esi
jmp ecx
lea ebp, [eax + ebp + 4]
xor edx, ebx
shl al, 0x25
dec edx
inc cl
setge al
neg edx
bts eax, ecx
sbb edx, ecx
not edx
add edx, ecx
bts eax, eax
bswap edx
and eax, ecx
shr ecx, 0xe3
inc eax
xor ebx, edx
sar cl, 0xe5
cwde
jae 0xc6ecf0

Function at 0xbe1bfc
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
pushfd
add ebp, 0x1eb05b10
neg bp
mov ebp, dword [esp + ebp*4 + 0x6e559a68]
mov dword [esp + 8], 0x7fcc3f37
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.00cf3a07

Function at 0xbfb792
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + 4], 0xff58991f
push dword [esp + 0x14]
popfd

Function at 0xbffb33
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
mov edx, 0xb80f938e
pushfd
neg dl
lea edx, [edx*8 + 0x64b1bfae]
mov dword [esp + 0xc], 0x201890ee
mov edx, dword [esp + 4]
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.00ce2570
Function at 0xc1644b
Capabilities:
Encode data using xor

Disassembly:
jns fcn.00c8ed7c
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x24]
call fcn.00cf3a07
clc
push 0x69ecb0fd
xchg esp, eax
insd dword es:[edi], dx
arpl word [ebx - 0x71bc6d5c], bp
mov eax, dword [0xb6b6927e]
jle 0xc164db
insd dword es:[edi], dx
nop
sbb byte [eax], al
call 0xbecfd22e
inc ecx
pushal
xchg edx, eax
mov dl, 0xcf
fidivr dword [edi + 0x6d]
jecxz 0xc16488
cmp byte [edx - 0x7a0d1993], al
xchg edx, eax
fadd st(3)
out 0x97, eax
sti
mov dh, 0xf
aas
jmp eax
call 0xa4adcddb
idiv edx
dec byte [eax + 0x48]
test dword [ecx + 0x66], 0x6dbc7cf9
shl ecx, 1
scasd eax, dword es:[edi]
lcall 0xaaa4, 0x206d
xchg edx, eax
push ds
shr dword [esi - 0x5a306d90], 1
jno 0xc16567
insd dword es:[edi], dx
mov ebx, 0xbee747f9
insd dword es:[edi], dx
outsd dx, dword [esi]
mov ch, 0x4e
outsb dx, byte [esi]
xchg edx, eax
imul esp, dword [eax - 0x73928e2b], 5
dec esp
ja 0xc16582
xchg ecx, eax
xchg edx, eax
lodsd eax, dword [esi]
inc esp
mov al, byte [0xf77aff6c]
mov dword [esi + 0x35], ebx
test eax, 0x6d79caa5
movsd dword es:[edi], dword [esi]
stosd dword es:[edi], eax
pop esp
xchg edi, eax
adc al, ah
cmc
dec edx
xchg edx, eax
jmp 0xc16593
out dx, al
adc al, 0x74
test byte [ebp + 0x26], ch
cmp dh, byte [edx + 0x34]
and esp, edi
retf
mov bh, 0x88
wait
inc ebx
jb 0xc1653b
jmp 0xc16598
inc esp
loope 0xc1659a
inc ebp
push 0x31
dec ebx
sub byte [eax - 0x3e], bh
mov esi, 0xeeee3313
or ebx, esp
add eax, 0x34ff16d3
push dword [esi + ebx*4]
xor al, 0x9e
sahf
jne 0xc16597
cld
xor byte [eax], dh
in al, dx
adc eax, 0x92ae8f58
pop esi
push esi
push cs
das
xchg edx, ebp
sub dword [ecx + 0x501500cc], ecx
scasd eax, dword es:[edi]
inc ebx
sub byte [eax + 0x16], 0x14
inc edi
xor eax, 0x9f9d3ed4
mov dh, ah
jle 0xc16596
adc al, 0x56
cmp al, 0x59
push ds
invalid

Function at 0xc1d034
Capabilities:
Encode data using xor

Disassembly:
sal dword [esp + ecx - 0x30b9], 0xe8
xor edx, 0xcf24fc0e
inc dword [esp + ecx - 0x30b9]
not edx
btc cx, 0x2c
ror ax, 0x21
sbb edx, 0xdb94eb9e
not edx
sal byte [esp + ecx*2 - 0x4170], 0x67
adc byte [esp + eax - 0x32aedd5e], ah
xor ebx, edx
dec word [esp + ecx*2 - 0x4170]
pop ecx
add edi, edx
jmp 0xccad7e
lea esi, [esi + edx*2 - 0x43a6176]
rol edx, cl
mov dword [esp + ecx*4 - 0xc2e4], 0x32aedbab
mov eax, dword [esp + ecx - 0x30b9]
mov edx, dword [edx + esi - 0x72043a61]
add word [esp + ecx*2 - 0x6170], ax
ror ax, 0x4c
xor edx, ebx
shl word [esp + ecx - 0x30b7], 0xc7
jb 0xa90a52
rol ecx, cl
call fcn.00bcfbdd
Function at 0xc26880
Capabilities:
Encode data using xor

Disassembly:
xor eax, ebx
mov dword [esp + edx - 0x5e291af5], edx
or edx, dword [esp + edx - 0x5e291af5]
lea eax, [eax + edx*2 - 0x13244361]
neg eax
movsx ecx, byte [esp + edx - 0x5e291af5]
push ecx
rol dword [esp + edx - 0x5e291af1], cl
xor eax, 0x3daee213
imul edx, dword [esp + edx - 0x5e291af2]
jo 0xb230ea
mov edx, 0xba81c0a1
lea ecx, [edx + edx*8 + 0x7db66d91]
and edx, 0xb536baba
lea esi, [ecx + esi - 0xc46333e]
adc dl, dl
bts edx, edx
sar ecx, 0x28
mov eax, dword [ecx + esi - 0xc4633]
xor eax, ebx
or cx, 0x8a16
inc eax
ror ecx, cl
sbb edx, 0x952f1036
sar edx, 0x83
bswap eax
btc edx, 0x1b
rol ecx, 0x41
dec eax
rol cx, 3
enter 0xffffffffffffba0f, 0xfffffffffffffffa
sbb eax, ecx
rol dword [ecx + 0x48], 0x66
rol ecx, 3
or dx, 0x7990
neg eax
xor ebx, eax
sal cx, 0xb
adc edi, eax
mov eax, ecx
sar edx, 0xad
inc cl
lea esi, [esi + edx*8 - 0x2d69c]
sal cx, cl
mov ecx, dword [edx + esi - 0x5ad3]
btr edx, 0x93
shl dx, 0xac
xor ecx, ebx
bt dx, ax
bts eax, eax
shr ax, 0xac
lea ecx, [ecx + eax*4 - 0x14c6b369]
call fcn.00d093d8
push ebx
pushfd
mov ebx, 0xa5336b86
call fcn.00c7e0b5
or dl, byte [eax]
fstp qword [edi]
leave
pop edx
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
leave
push eax
jl 0xc268f8
js 0xc2697c
invalid
stosb byte es:[edi], al
leave
sub byte [ebp - 0x45], 0x78
adc byte [edx + 0x70afdb8f], 0x92
add ebp, dword [0x324fe59]
aaa
add al, 0xb5
dec dword [ecx]
mov dh, byte [edx + 0x49e00d]
add bh, dh
cmp eax, 0xfddd7207
adc dword [eax + ecx - 0x12], 0x620f3745
adc byte [esi - 0x2fbdb25], 0x48
sar dh, 0xad
insd dword es:[edi], dx
in eax, 1
push 0x13
scasb al, byte es:[edi]
dec ebp
xchg esp, eax
jle 0xc269fa
cmp dword [ecx - 0x4c], ecx
lodsb al, byte [esi]
in eax, dx
mov bl, byte [edx + 0x6692f482]
btc eax, edx
ror ecx, 1
call fcn.00a6ee18
sal edx, 0x8d
mov dword [esp + ecx - 0x5d635729], esi
ret

Function at 0xc3ee8e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
dec dword [edi]
pop dword [eax + eax]
add byte [eax], al
jg 0xc3ee98
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x14]
call fcn.00b16dc3
mov cl, 0x27
popal
sub eax, 0x31ffb29f
xor byte cs:[esp + ebp*2 - 0x41], dl
rcl dword [edx], cl
mov al, byte [0xad3adab]
jbe 0xc3ee8d
wait
xor byte [edi + edx*2], ch
ljmp 0xda9f

Function at 0xc45164
Capabilities:
Encode data using xor

Disassembly:
push ecx
pushfd
mov ecx, 0x98174132
shr ecx, 0xe1
call fcn.00bfd3be
sub esi, 4
mov ecx, 0x8dbb1212
call fcn.00b0a97a

Function at 0xc4ee79
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ecx + eax*2 - 0x2d5328fe]
shr edx, 2
bswap eax
sal word [esp + edx*2 - 0xb4a105c], 0x6d
ror ecx, 2
add al, 0x81
setno byte [esp + edx - 0x5a5082c]
inc ecx
and word [esp + edx*8 - 0x2d28417a], dx
div eax
neg ecx
xor ebx, ecx
mov dword [esp + eax - 0x78f81d3], edx
add edi, ecx
add dword [esp + eax - 0x78f81cf], 0x3ebe8526
jae 0xb1c27d
Function at 0xc77c58
Capabilities:
Encode data using base64

Disassembly:
movzx edx, al
mov word [esi + edx*4 - 0x308], cx
dec edx
lea edi, [edi + edx*2 - 0x186]
and dl, dl
mov eax, dword [edi + edx*2 - 0x182]
mov dword [esp + edx - 0xc1], 0x50ad5c39
movzx ecx, byte [esp + edx - 0xc1]
rol dword [esp + edx*8 - 0x608], 0x35
xor eax, ebx
sal dx, 0x2d
inc eax
neg ecx
not eax
call fcn.00b049ad

Function at 0xc7f824
Capabilities:
Encode data using xor

Disassembly:
call fcn.00a62213
cld
mov dword [esp], 0x19167221
push 0x46b069ae
call fcn.00d0d336

Function at 0xc855e9
Capabilities:
Authenticate hmac

Disassembly:
not dl
neg dl
mov dword [esp + ecx*8 - 0x130], 0x9e08e538
add dl, 0x2e
xor dl, 0xc
or eax, dword [esp + ecx*2 - 0x4c]
xor eax, 0xe8a58cbb
not dl
shl dword [esp + eax*2 - 0x2e1ad38e], 0xac
call fcn.00c6a32b

Function at 0xc8caca
Capabilities:
Encode data using xor

Disassembly:
ja 0xb6b1e0
mov eax, 0x76b5b592
lea esi, [esi + eax - 0x76b5b596]
call fcn.00cfc3dc
call fcn.00c65ade
and byte [ecx + 0x72536109], cl
sbb eax, 0xc52531d8
cbw
mul byte [edx]
fsub st(4), st(0)
daa
test eax, 0x27fff480
ljmp 0x331b
add ebp, 6
jmp 0xb2ff58
shrd eax, edx, cl
call fcn.00b83f25
mov ecx, 0x829e502b
lea ecx, [ecx + ecx*8 + 0xf2346a4]
sub esi, 4
lea eax, [ecx*4 - 0x72e0586a]
or ecx, ecx
shl al, cl
mov edx, dword [esi + eax - 0x27f00800]
jb 0xc8b1a2
jmp 0xaa1e0c
adc edi, edx
fstp qword [ebp]
xor al, 0x8b
mov word [esp + 0xd], ax
call fcn.00cbccc5
xor edx, ebx
push eax
lea edx, [edx + eax*2 + 0xb5a7196]
push eax
imul eax, dword [esp + eax*2 - 0x4fe00ffc]
neg edx
sal eax, 0x9a
rol edx, 3
or ecx, 0xd9929127
ja 0xa8d052
pop esi
mov al, 0x66
cmc
ficomp word [edx - 0x3b11408d]
rcr dword [edx + 0x765ef869], 1
xor edi, dword [esi + 1]
or edx, dword [0x6511d290]
adc bl, byte [esi + 0x65c9199b]
xchg ebp, eax
test al, 0xe3
inc ecx
push cs
fidiv word [eax - 5]
sti
xor dword [edx + 0xb0581fc], esp
mov bl, 0xf1
adc eax, 0xbe5bcafd
lcall 0xfaf7, 0x354213c0
outsd dx, dword [esi]
push edi
push es
jb 0xc8b1cf
jae 0xc8b190
out dx, al
invalid
add dword gs:[ecx + 0x658b5932], esp
add dword [ecx + 0x658b5932], esp
pop eax
scasb al, byte es:[edi]
adc eax, 0x9d66269a
or al, 0x14
lcall 0xf29a, 0x637d3bb8
cmpsd dword [esi], dword es:[edi]
loope 0xc8b20c
nop
mov dword [0x79d96590], eax
stosb byte es:[edi], al
enter 0xffffffffffff9a17, 0xffffffffffffff86
mov bl, 0x1d
lcall 0x8d7a, 0x19b012b2
sbb dh, bh
push cs
or bl, byte [eax - 0x3b]
int3
mov dword [esp + edx - 0x442a4628], edx
sub byte [esp + edx - 0x442a4627], dh
neg al
movsx ecx, dl
dec al
call fcn.00b3859d
mov ecx, 0x5bacd0a
movzx ecx, word [ecx + ebp - 0x5bacd0a]
add ebp, 2
mov edx, 0xf700543e
shr edx, 0x95
mov eax, edx
xor cx, bx
add cx, 0xeabe
ror eax, 0x9e
rol eax, 0x16
shl eax, 0xdc
not cx
idiv eax
neg al
call fcn.00d42119
jmp 0xc02d5d
Function at 0xca3747
Capabilities:
Encode data using xor

Disassembly:
or cx, cx
and ecx, dword [esp + ecx*2 - 0x77000000]
dec eax
ror eax, 3
not cl
sub eax, 0xda099e0c
rol eax, 2
xor ebx, eax
and cx, 0x213c
add cl, 0xaa
adc esi, eax
mov eax, dword [edi + ecx - 0xe6]
rol dl, 0xe5
mov edx, dword [edi + edx*2 - 0x349fc]
rol ecx, 0xf3
lea edi, [edi + ecx*2 - 0xe5ffff8]
pop ecx
call fcn.00ab78a8
dec esp
pop edx
adc al, 0x25
push ebx
inc esp
cdq
mov al, 0xac
and eax, 0xb0994453
lodsb al, byte [esi]
lcall 0x7f0f, 0x535cece5
push edx
pop dword [ebx + 0x53]
cli
cwde
mov byte [eax + esi*8 - 0x5353904a], ch
xor al, 0x85
dec esp
sub dword [ebx + ebx*2 + 0x7211645d], 0x6d8e0ceb
pop esp
or eax, 0x68e842c8
xor al, 0xe1
sub byte [esi - 0x5aad6c5a], ch
scasb al, byte es:[edi]
popal
shr dword gs:[ebx], 0x53
add dh, cl
push es
cmp dword [ebx - 0x69], edx
jbe 0xbed65a
movsb byte es:[edi], byte ss:[esi]
lodsb al, byte [esi]
mov cl, 0xe4
push ds
outsb dx, byte [esi]
lea eax, [esi - 0x6a54cbbd]
inc ebx
xor al, 0xab
xchg ebp, eax
jns 0xbed6d4
pop eax
cmp ebx, dword [ebp + ebp*4 - 0xb5d0d8b]
mov esp, 0xfabfca0d
xor al, 0xc
in eax, 0x87
nop
cmp dword [edx + 0x1e], esi
pushfd
div byte [bp + di + 0xc]
cmp dl, byte [edi - 0x30f22b00]
int1
jb 0xbed6c2
or eax, 0xf272f1cf
bound esi, qword [esi + 0x17]
rol dword [ecx + 0x72], 0x45
inc ecx
jb 0xbed71c
xor eax, 0x7c5ff250
jae 0xbed6cb
js 0xbed6a7
inc esp
and al, 0xc
pushf
adc eax, 0x24648d80
or al, 0xe8
or byte [esi + 0xf], 0
add byte [esi], dh
jae 0xbed74b
call 0x1025a91c
mov ebx, 0x28548bd1
cld
sar edx, 0xac
lea ebp, [edx + ebp - 0x1a5d8]
xor eax, ebx
mov dword [esp + edx*8 - 0xd2ee0], edx
not ecx
inc eax
dec dx
xor eax, 0x37163f1b
and word [esp + edx*2 - 0x34bb5], dx
xor dl, dl
shl ecx, cl
bswap eax
jb 0xbed612

Function at 0xcb788c
Capabilities:
Encode data using xor

Disassembly:
xor ebx, edx
xadd ecx, eax
shr ecx, 0x77
xadd eax, ecx
adc esi, edx
shr ecx, 2
adc ax, cx
setne al
mov edx, dword [eax + ebp - 1]
imul eax, eax
rol edx, 1
ror ecx, cl
xor edx, 0x2e994b8c
sal ecx, 0xdb
rol edx, 1
jmp 0xa59452
mov edx, dword [ebp + ecx - 0x10400000]
pop eax
lea eax, [ecx + ecx*4 - 0x256033d8]
mov eax, dword [edx + ecx*4 - 0x41000000]
lea edx, [ecx*8 - 0x46dbcc4e]
btc cx, cx
mov dword [ebp + ecx - 0x10400001], eax
movsx eax, cx
jae 0x40b59b
mov eax, 0xcf873cae
mov edx, dword [ebp]
movzx ecx, al
and ecx, 0xe0a059af
shl eax, cl
lea ebp, [ecx + ebp - 0xaa]
xor edx, ebx
bt eax, 0x8d
xor edx, 0x2a967404
lea edx, [edx + ecx*2 - 0x7ebdd097]
dec ecx
jnp 0xbb1c08
Function at 0xcb8228
Capabilities:
Encode data using xor

Disassembly:
movzx edx, byte [esi + edx - 0x5604fe87]
sar al, 0x61
movsx ecx, al
xor dl, bl
bswap eax
shr ax, cl
sub eax, eax
neg dl
imul eax, ecx
lea ecx, [eax*2 + 0x57a80ea9]
rol al, 0xe4
rol dl, 1
shl edx, cl
add edx, edx
not al
jbe 0xc26406
dec cx
call fcn.00a9d186
jmp 0xb7ad69
js 0xd23a07
mov ecx, 0xde91471d
mov eax, 0x78176217
add eax, 0xc12b0701
fcomp qword [ebp + eax*2 - 0x7284d230]
xor eax, ecx
sbb esi, 4
mov eax, dword [esi]
and cl, 0x1e
xor eax, ebx
or cl, cl
ror eax, 2
jmp 0xcaa4a8
mov word [ecx + edi - 0x1bfffec0], ax
rol cl, 0x64
pop eax
pop ecx
pop edx
pop ecx
jne fcn.00b25f42
call fcn.00408b4e
mov edx, 0xdfb73eba
movsx ecx, dl
sub esi, 1
btc edx, 0x35
ror dl, 0xa5
movzx eax, byte [esi]
btc ecx, ecx
xor al, bl
jmp 0xb8cc9e

Function at 0xcbc425
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx*2 - 0x704d826a], edx
rol ax, 1
shl edx, cl
shl cx, 0xca
or cl, 6
not ax
adc byte [esp + ecx*2 - 0x704da80a], 0x2f
adc dl, 0x3f
xor ax, 0xbe00
shr edx, cl
xor bx, ax
or byte [esp + edx*2 - 0x500fffb], ch
sal cx, 0x4a
ror ecx, 0xca
lea esi, [esi + edx*4 - 0xa020002]
lea ecx, [edx + edx*4 + 0x5716e708]
sal dword [esp + edx*4 - 0xa01fffc], cl
adc edx, edx
mov word [esi + edx - 0x5010001], ax
ror dl, 0xc7
setb byte [esp + edx - 0x500fffb]
btr ecx, 0xb5
pop ecx
pop ecx
jae fcn.00b75b25
jae 0xcbc4b7
mov ebp, 0x54ac039e
mov eax, 0x3be42d3d
ja 0xcbc493
cmp eax, 0x773be42d
xor eax, 0x8f4d7379
xor eax, 0x8f4d7379
fistp qword [edx]
mov esi, 0x3d3ddaf2
pop esp
sub edx, dword [ecx - 0x3446e6d5]
jne 0xcbc49b
mov bl, 0xa9
xchg ebp, eax
std
pop ds
test eax, 0x1ffd952e
wait
lodsd eax, dword [esi]
invalid

Function at 0xcc80c4
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x9509e807
cwde
lea esi, [esi + eax*2 - 0xb024]
bswap eax
not ecx
idiv byte [esp + eax - 0x14580000]
xor edx, ebx
rol edx, 3
pop eax
inc edx
add ax, cx
not edx
shl al, 0xa4
btr ax, 0x9f
btc eax, eax
rol edx, 3
inc eax
xchg ecx, eax
neg edx
sub edx, 0xd782babf
shl al, 0x81
xor ebx, edx
and ax, ax
adc edi, edx
ror ax, cl
mov dx, word [ebp + eax - 0x6944a72a]
bswap eax
call fcn.00c28ec9
dec esp
invalid

Function at 0xcdba98
Capabilities:
Encode data using xor

Disassembly:
cdq
mov dword [esp], edx
xor ebx, ecx
add esi, ecx
inc eax
xor ax, word [esp + 3]
xor eax, edx
rdtsc
sbb edi, 8
mov ecx, 0x90b31513
and ecx, dword [esp + 1]
mov dword [edi + 4], eax
add dword [esp + 4], ecx
lea eax, [ecx*4 - 0x1ae08bcd]
call fcn.00d25c69
Function at 0xce405c
Capabilities:
Authenticate hmac

Disassembly:
mov word [ebp + edx - 0x200], ax
jmp edi
mov ecx, dword [ebp]
call fcn.00b06f7f
mov ecx, 0x929ccabb
movzx edx, cl
lea esi, [esi + edx - 0xbf]
movzx eax, cx
shl ecx, cl
setnp dl
mov eax, dword [esi + edx]
or ecx, edx
btr ecx, ecx
lea edx, [ecx - 0x4feccb00]
xor eax, ebx
sal cl, 0x85
inc edx
bswap eax
xor edx, edx
not eax
sete dl
sbb eax, edx
rol eax, 2
xor ecx, edx
setle dl
neg eax
xadd ecx, edx
xor ebx, eax
add edi, eax
mov eax, ecx
cwd
mov ax, word [ebp]
shr dl, cl
adc ecx, edx
rol edx, 0x9b
add dx, word [edx + ebp - 0x6bffffe]
xchg ch, cl
add ebp, 2
bt ecx, ecx
and ax, dx
movzx edx, cx
bts cx, 0x1b
shr cl, 0x82
not ax
jp 0xca50b0

Function at 0xd12244
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + edx*8 - 0x7fffc]
pop ecx
mov edx, dword [edi + edx*4 - 0x3fffc]
mov eax, 0x990c9a7
movzx ecx, ax
or dword [edi], ecx
mov bh, 0xc8
lea eax, [ecx*2 + 0x5414d39c]
xor edx, ebx
bswap eax
dec edx
inc ecx
inc cx
bt ecx, 0xbc
ror edx, 1
call fcn.00cffbb1
mov edx, 0x9eb90424
and dl, dh
sbb edi, 4
mov edx, dword [edi]
xor edx, ebx
mov ecx, 0x8bb7e03d
movsx eax, cx
inc edx
not edx
lea edx, [edx + ecx - 0x20812b05]
call fcn.00aa2f25
jle 0xd12257
invalid

Function at 0xd42380
Capabilities:
Encode data using xor

Disassembly:
lea eax, [ecx*4 + 0x62b07b04]
add ebp, 4
inc ecx
imul eax, eax
xor edx, ebx
push eax
call fcn.00c3e8b5
popfd
fsubrp st(4)
pop ss
call 0x3dbff1e1
cli
das
outsb dx, byte [esi]
adc edi, dword [eax]
jo 0xa5d2d7
xchg ebp, eax
xor byte [eax], ah
dec esi
push ds
leave
fist dword [edi]
sub byte [edx - 0x6423232f], al
push ds
out dx, eax
rol byte [eax - 0x10], 1
push ss
adc al, 0x9f
sbb eax, 0xb15713be
add eax, 0xcede80bc
in al, dx
and ebx, dword [esi + 0x5fc7fd26]
jge 0xa5d271
enter 0xffffffffffffa478, 0x7d
mov dl, byte [edx]
mov word [bp + di + 0x2c0b], ds
test al, 0xd0
adc al, cl
add esi, esi
stosd dword es:[edi], eax
vxorps ymm0, ymm4, ymmword [eax]
fcom qword [edi]
cli
inc ebx
je 0xa5d2e4
and byte [0x321cad59], al
adc al, 0x5c
cmp eax, esi
js 0xa5d2a8
sbb esp, dword [ebp - 0x38]
jbe 0xa5d2f1
sal dword [ebp + 0x64], 0x78
mov ecx, 0xeaa83a18
sub eax, 0x21558999
loopne 0xa5d2dd
add byte [0x13714728], ah
push edx
mov byte ss:[edx], ch
outsb dx, byte [esi]
or esi, dword [esi - 0x38]
enter 0x1896, 0x13
xchg esi, eax
sbb byte [ebx], dl
inc edx
lds esi, [eax - 0x538a0067]
cdq
push dword [ebp - 0x54]
xor dword [edx], 0x7d
add ebp, dword [edi]
sbb dh, byte [edx + 0x13]
push eax
pop esi
adc edx, edi
scasd eax, dword es:[edi]
lcall 0xf961, 0xbf2000ea
fcmovnb st(0), st(6)
cdq
std
loope 0xa5d2de
xchg dword [esi + 0x61], esi
invalid
not ax
not dx
and ax, dx
shr cl, 0x21
or cl, 0xb3
mov word [ecx + ebp - 0x72a14cb3], ax
push ecx
lea eax, [ecx + ecx*8 + 0x5985296]
movsx edx, cl
lea esi, [eax + esi - 0xd4404e5]
call fcn.00b9cbf5
mov edx, dword [ebp]
mov ecx, 0xcd0684bf
jmp 0xa5d243
Function at 0x1001a146
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001a185
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001a185
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a185
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001a185
cmp dword [ecx + 0x74], 0xe
jbe 0x1001a185
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001ce28
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001cec5
push ebx
push esi
call fcn.1001cdf1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001cd87
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001ce72
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001cec4
push edi
push eax
call fcn.1001ae00
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001ce92
call fcn.1001adb0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001cec3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001cd87
add esp, 0x20
test eax, eax
jne 0x1001ceb1
push edi
call fcn.1001adb0
jmp 0x1001ceb9
push ebx
call fcn.1001adb0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10022eb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10022edd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10022edd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0xdd287aa4
call 0x89a67e6d
Function at 0x420b2f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 0x24], ecx
cmp edi, eax
je 0x455e04
xor al, byte [ebx]
add bl, dl
loop 0x420b03
invalid
or bh, bh
xor bh, bh
adc eax, 0x48f248
jmp 0x10420a46

Function at 0x465496
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor edx, edx
xor esi, esi
cmp dword [edi + 4], edx
jbe 0x4654da
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
xor ecx, ecx
test ax, ax
je 0x4654d3
mov eax, dword [edi]
movzx eax, word [eax + edx*2]
mov dword [ebp + 8], eax
movzx eax, word [ebx]
cmp word [ebp + 8], ax
je 0x4654e4
inc ecx
movzx eax, word [ebx + ecx*2]
test ax, ax
jne 0x4654c0
je 0x465500
add eax, dword [edx + 0x46]
inc edx
inc esi
cmp esi, dword [edi + 4]
jb 0x4654ad
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, edx
jmp 0x4654dd
call 0xfd42378c
dec dword [ebp + 0x46530170]
add dl, byte [eax + 0x50]
push esi
push edi
push 1
push eax
call dword [0x7ebf184]
call 0x7521daf6
xor dword [ebx], esi
leave
mov eax, esi
push 2
pop edx
cmp ebx, esi
jl 0x46552c
mov eax, ebx
dec dword [ebx + 0x4706a17]
mov ecx, eax
mov dword [ebp - 0x20], ecx
invalid

Function at 0x4687ee
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c3190]
jne 0x4687fb
call 0x835604d5
mov eax, dword [0x4c6ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c6ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0x56ffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x468833
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c3190]
jne 0x468845
call 0x835604d5
mov eax, dword [0x4c6ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c6ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0x56ffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]

Function at 0x468898
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cld
jns 0x468888
fadd qword [0x4b9e48]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4b9e20]
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
mov dword [0x4c6530], ecx
inc esi
mov ecx, 0x4c6530
jl 0x46887f
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c6eec
jl 0x4688a9
mov dword [0x4c3190], esi
mov dword [0x4c6518], esi
pop esi
ret
Function at 0x469155
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe837ffdc
lea ecx, [ebp - 0xdc]
push esi
push edi
call 0x1b18fab
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call 0xfcaf8ff1
add esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x469199
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.00469129
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x469183
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
sub ebx, dword [eax + 3]
cmp edi, dword [ebx + 0x31]
xchg dword [esi + edi*2 - 0x3d27130], edi
lcall 0x41bc, 0x398897e6
sub byte [esi], 0xb6
adc eax, 0x2186cfa
invalid