joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbd303d
Capabilities:
Encode data using base64
Execute syscall

Disassembly:
dec eax
cdq
pop edx
pop esi
inc ecx
pop ebx
jb fcn.0079a4c9
mov eax, 0x89b89091
movzx cx, byte [edi]
mov edx, eax
mov dl, byte [edi + 2]
not cl
sal eax, 0x84
not dl
js 0xadf913
dec edi
jg 0xbd30ba
mov ebp, 0x4e49b23e
pop ecx
invalid
cli
sub al, byte [ebx + edi - 0x7d70d185]
rcr dword [edx - 0x63], 1
jb 0xbd30f8
add dword [eax + 0x68], ebp
invalid
aad 0xe1
pop ecx
fsubrp st(6)
mov dword [0xabbccd83], eax
int 0xbc
stosd dword es:[edi], eax
push ebp
mov ch, 0xfd
mov ch, 0x52
inc eax
jnp 0xbd30ff

Function at 0xbd47b7
Capabilities:
Authenticate hmac

Disassembly:
inc cx
not edi
call fcn.00796bad
xor edx, ebp
inc ecx
movsx eax, bh
mov ebx, eax
mov esi, eax
sub edx, 0x44be06bf
inc ecx
movsx ecx, di
ror edx, 1
inc edx
idiv bl
dec eax
ror ecx, 0x73
inc ecx
xchg edi, eax
rol edx, 1
call fcn.00be2f3b
movzx edx, byte [ebp]
add ebp, 1
xor dl, bl
mov eax, 0x21ab7638
dec eax
sub dl, 0xb2
dec eax
shr eax, 0x2a
rol eax, 0x7e
neg dl
shr al, 0xc2
dec dl
xor dl, al
shl eax, 0x77
xor bl, dl
ror al, 0x61
push ebp
mov ebp, 0x891a88b9
push esi
bts eax, ebp
sub ax, bp
bt ax, ax
push ebx
or eax, eax
and ebp, ebp
mov ebp, edi
sal eax, 0x41
shl ax, 1
cbw
mov ebx, edx
movsx edx, ax
mov edx, ebx
dec al
shl edx, 2
cwde
shr eax, 0x41
mov eax, ebp
add eax, edx
call fcn.00ae55e4
rol dx, 0x85
mov word [edi - 2], cx
movzx ecx, dx
lea eax, [ecx + edx + 0x22bb8bb]
lea edi, [edi + ecx*2 - 0x1efb8]
xor ecx, dword [esp + ecx - 0xf7ce]
pop eax
pop eax
pop edx
pop eax
pop ecx
jno fcn.00c409cb
inc esp
mov eax, dword [edi]
inc ecx
mov esi, 0xd7140c1a
inc esp
xor eax, ebp
inc ecx
sub eax, 0x44be06bf
jmp 0xcd78e2
sub word [esp + ecx + 4], 0x7707
and byte [esp + ecx + 0xd], 0xb9
movzx ax, al
mov dl, byte [edi + ecx*8]
push ecx
seta cl
not al
bswap ecx
xor cl, byte [esp + ecx*8 - 0x7fffff0]
not dl
or al, dl
mov word [edi + ecx*8 - 0x80003b8], ax
mov edx, 0x1d150003
lea ecx, [ecx + edx*8 + 0x3eab5e0d]
lea edx, [ecx + ecx - 0x774fdd7d]
movzx eax, byte [ebp + ecx - 0x28535ea2]
add dword [esp + ecx - 0x28535e9c], ecx
lea ebp, [ebp + ecx*2 - 0x50a6bd3e]
xor al, bl
bswap ecx
rol al, 1
neg al
dec edx
xor al, 0x21
not al
xor bl, al
or edx, 0x73218e0c
lea eax, [esp + eax + 0x14]
ror ecx, cl
sub dword [esp + ecx*2 - 0x5138bca6], ecx
movzx cx, byte [ecx + eax - 0x289c5e53]
js 0xb596eb
inc ecx
ror eax, 1
call fcn.007ac8a9
mov ecx, 0x5e956fa2
movzx eax, cx
mov eax, esi
rol ecx, 0x4b
mov dword [esi - 4], eax
not cx
call fcn.007c3e58
dec eax
not dword [esp + ecx - 0x267d80f5]
neg edx
ror edx, 1
inc esp
xor dword [esp + ecx - 0x267d80f2], esp
dec esp
cmovg eax, dword [esp + ecx*2 - 0x4cfb01ea]
dec eax
mov dword [esp + ecx*2 - 0x4cfb01ea], ebp
inc ecx
sbb cl, ah
movzx ebx, cx
xor dword [esp + ecx - 0x267d801c], edx
pop ebp
dec eax
arpl dx, dx
dec eax
inc ebx
dec esp
add ebp, edx
dec ebp
lea ebx, [esp + ecx*2 - 0x795866d8]
and cx, cx
dec ebp
mov edx, dword [ecx + ecx*2 - 0x4cfb0038]
inc esp
movzx edi, word [edi + ecx - 0x267d8018]
mov edx, ebx
inc sp
xor edi, ebp
dec ecx
neg ebx
inc cx
xor edi, 0x41667a96
neg edi
inc ebp
sub al, al
inc ecx
mov esi, eax
jbe 0xb2eb38
jmp 0xbddf25
Function at 0xbd67fe
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sbb ecx, ecx
bswap edx
btc ecx, 0xa0
or eax, eax
sal eax, 0x9d
neg edx
shr cl, cl
jle 0xc409c5
jmp fcn.00afca8d
not eax
xor ecx, ebx
xor al, byte [esp + eax*2 - 0x629a00e3]
call fcn.00bcbe89
adc esi, 4
xor edx, ebx
btc eax, ecx
jae 0xaf11d2
mov edi, 0x64c8c0c8
jae 0xba7394
mov eax, 0xceb26f8c
movsx ecx, ax
push eax
lea ebp, [ebp + ecx*2 - 0xdf1c]
movsx edx, cl
mov word [esp + ecx - 0x6f8a], 0x5713
mov ecx, dword [ebp + ecx*4 - 0x1be30]
xchg dx, ax
jmp 0xb82ef2
mov dword [esp + 8], 0x331f87cf
lea esp, [esp + 8]
call fcn.007dff45
not ebx
inc esp
movzx ebx, ax
inc esi
movsx edi, word [esp + ebx - 0x730]
rol ebx, 3
dec edx
sal dword [esp + ebx*2 - 0xe68], cl
inc ebx
call fcn.00b79a83
outsb dx, byte [esi]
lodsb al, byte [esi]
dec esp
jge 0xbd67c8
or ebp, dword [ebx]
ljmp 0xba56
Function at 0xbd8f8d
Capabilities:
Authenticate hmac

Disassembly:
mov cl, byte [ebp + 4]
call fcn.00c78b93
lea ecx, [eax + ecx*8 + 0x4220dd91]
shr cx, 0x27
mov ecx, dword [edx]
mov edx, eax
btc eax, 0xba
not eax
mov dword [eax + ebp - 0x400000a], ecx
neg dword [esp + eax - 0x4000000]
lea ebp, [ebp + eax*2 - 0x800000a]
push edx
je 0xbdc322
mov edx, dword [esi + eax*2 - 0x8000009]
lea esi, [eax + esi - 0x4000009]
xor edx, ebx
xchg dword [esp + eax*2 - 0x7fffffe], eax
or dword [esp + eax - 0x2ffff], eax
xor edx, 0x3506d338
ror edx, 2
rol dword [esp + eax - 0x2fffb], 0x9c
push eax
cwde
bswap edx
neg ax
lea ecx, [eax*2 - 0x7e4bf8e7]
sal ecx, cl
sbb edx, 0x979e440d
dec ecx
shr dword [esp + 8], cl
bswap edx
pop ecx
shl al, 0xe1
sbb cl, 0x1f
xor ebx, edx
and word [esp + ecx - 0x2ffdd], ax
push ecx
adc ecx, 0x97affca4
adc edi, edx
btr eax, ecx
pop edx
pop eax
pop edx
jae fcn.007c6802
mov edx, 0x8daea083
shr edx, 0xc
lea esi, [edx + esi - 0x8daeb]
movzx ecx, dl
or cl, dh
shl dl, 0x65
movzx eax, byte [edx + esi - 0x8da40]
xor al, bl
lea ecx, [edx + ecx - 0x7fb9b69]
and cx, 0x2529
ror al, cl
jmp 0xcb18b8
Function at 0xbda4f6
Capabilities:
Authenticate hmac

Disassembly:
lea ebp, [esi + ebp - 0x319e03a1]
rol ecx, 0x55
call fcn.007adc43
btc eax, eax
push eax
xor ebx, ecx
sub dword [esp + eax - 0x41], 0xa9a7260d
pop eax
jge 0xb33522
bts ecx, eax
lea esi, [esi + eax - 0x1849c6a5]
mov eax, dword [esi + ecx*2 - 0x8e04]
mov edx, 0xac31d591
neg ecx
xor eax, ebx
ror eax, 1
sal edx, 0x52
dec dx
bt cx, cx
neg eax
sar cl, 0x61
not eax
lea ecx, [ecx*2 - 0x5cc3e459]
ror edx, 0xb6
ror eax, 1
not dx
bts cx, cx
or ecx, ecx
xor ebx, eax
jmp 0xad1784
dec edx
not edx
rol al, cl
cwde
bts cx, 0x9e
lea edx, [edx + ecx*2 + 0x9a81e6b]
xchg ecx, eax
xor ebx, edx
sal cl, 0x46
lea edi, [edi + ecx*2 - 0x8e04]
mov dword [edi + ecx*2 - 0x8e00], edx
jp 0x786720
add cx, 0xe7b3
add ebp, eax
jmp fcn.007b8565
add esi, ecx
movsx ecx, al
cbw
mov dword [esp + ecx - 0x34], esi
ret 4
call fcn.007a5abb
ror edx, 1
imul ecx, ecx
neg edx
lea eax, [ecx*8 - 0x64d72f62]
imul ecx, ecx
jb 0x7a9854
mov esi, 0x319e03a5
movsx eax, si
mov eax, dword [ebp + esi - 0x319e03a5]
lea edx, [esi + esi*4 + 0xe912b2d]
lea ecx, [esi + esi*4 + 0x6faf3102]
jmp 0x7324cc
lea ecx, [esp + ecx + 8]
mov edx, dword [ecx]
xchg byte [esp + 6], al
sub edi, 4
mov dword [edi], edx
cbw
sub byte [esp + 3], al
pop edx
pop edx
jle fcn.00c409cb
cwde
inc edx
ror eax, 0x1a
bswap edx
xor ebx, edx
add esi, edx
ror word [esp + eax - 0x1ffc0], 0x23
and dword [esp + eax*2 - 0x3ff7c], ecx
lea ebp, [eax + ebp - 0x1ffc1]
or al, 0x13
movzx ecx, byte [ebp + eax*4 - 0x7ff4c]
cbw
sub byte [esp + eax - 0x1ffd1], ah
xor cl, bl
movsx edx, al
ror cl, 1
mul edx
setb byte [esp + edx*4 - 0x7ff45]
dec ax
neg cl
dec word [esp + edx*4 - 0x7ff42]
sal dword [esp + edx - 0x1ffce], 0xb5
adc cl, 0xd
and byte [esp + edx*2 - 0x3ffa1], al
xor ax, ax
not cl
add dl, 0xb6
adc cl, al
not edx
sal edx, 0xbb
shr ax, 9
xor bl, cl
jmp 0xb8c974
xor ax, 0x52ad
rol ax, 1
push edx
call fcn.0074d1b9
mov eax, 0xe0300414
mov edx, dword [ebp]
or eax, eax
lea ecx, [eax + eax*4 - 0x2a5e4c6a]
lea ebp, [ebp + ecx - 0x3691c7f6]
xor edx, ebx
not ecx
lea edx, [edx + eax - 0x110e35d6]
bts ecx, ecx
and cx, cx
not edx
call fcn.00776e93
not edx
not byte [esp + 2]
dec edx
neg edx
neg dword [esp]
jp 0xccfb89
push 0xb7b9a02a
mov eax, 0xb3a3538f
sub ebp, 4
push eax
movsx ecx, al
mov edx, dword [ebp]
xchg ecx, eax
bts cx, 5
xor edx, ebx
cwde
shl ecx, 0x95
dec edx
bswap ecx
rol edx, 3
shr eax, cl
jbe 0xbcdca6
shr byte [esp + 1], 0xa1
adc edx, 0xa10bda03
push 0xf19ab8f
shl word [esp + 5], 0x2b
xor ebx, edx
jmp 0xb50e58
Function at 0xbdbc7c
Capabilities:
Authenticate hmac

Disassembly:
add dl, 0x9e
btc cx, cx
xor bl, dl
lea edx, [esp + edx + 4]
mov dword [esp], ecx
mov dword [edx], eax
mov eax, dword [esp]
dec al
sub word [esp + 1], cx
pop edx
jmp edi
js 0x716714
xor ebx, edx
mov dword [esp + 4], 0x911c50a5
neg word [esp + 0xc]
jne 0x718440
adc esi, edx
jmp 0xb982fe
lea esp, [esp + 0x10]
jmp 0xc5906c
neg dword [esp + 0xc]
sbb edx, 0x1f9e06af
sal dword [esp + 0xc], 0x5f
je 0xab0587
mov edx, dword [esi + eax - 0x1f40f7c0]
sub al, 0x80
movsx ecx, al
rol ecx, 0x2f
xor edx, ebx
inc edx
btr ax, cx
xadd al, ch
add ecx, ecx
not edx
dec edx
shr ecx, 0x83
shr ax, 0xcd
bts ecx, eax
bswap edx
push ecx
push ecx
add dword [esp + eax*2 - 0x3e80000e], eax
xor ebx, edx
add ebp, edx
movsx edx, cl
idiv word [esp + eax*2 - 0x3e80000d]
mov dword [esp + eax - 0x1f40fe3a], ebp
ret 4
call fcn.00bc5ae1
mov dword [esp + 4], edi
pop edi
push esi
jmp 0xc7be34
pushfd
mov esi, edi
lea esi, [esi + esi - 0x16fbb74a]
mov esi, eax
and di, di
xor edi, edi
xor edi, edx
cld
call fcn.00ab7d48

Function at 0xbe3473
Capabilities:
Authenticate hmac

Disassembly:
mov word [esp + edx - 0x5c864a20], dx
pop ecx
mov ecx, dword [ebp + edx - 0x5c864a20]
mov eax, 0x459dd10b
ror dx, 0xc1
xor ecx, ebx
mul dl
cdq
xor ecx, 0x5a31823a
ror eax, 0xaf
jb 0xbfc73e
shr dl, 0x61
not ecx
adc ecx, 0xe2ad46ae
neg dx
adc eax, edx
or edx, edx
bswap ecx
sub eax, edx
xor ebx, ecx
sub eax, eax
neg edx
adc esi, ecx
add edx, esi
jmp edx
mov ecx, dword [edi + ecx - 0x4a20]
lea eax, [edx + 0x2c308007]
mov dword [esp + edx - 0x5c864a20], edx
or eax, dword [esp + edx - 0x5c864a20]
mov eax, dword [ecx + edx - 0x5c864a20]
mov dword [edx + edi - 0x5c864a20], eax
lea ebp, [ebp + edx - 0x5c864a24]
jne 0x71e449
mov ecx, 0xf125de1e
movzx eax, cl
mov edx, ecx
mov eax, dword [ebp + eax - 0x1e]
add ebp, 4
add dx, 0x63f
adc cx, cx
xor eax, ebx
neg cx
adc dx, dx
neg eax
bswap ecx
sub eax, 0xf7be981a
shr ecx, 0x63
xadd cx, dx
sbb dl, cl
xor eax, 0xedb8c8a4
ror eax, 2
push edx
pop ecx
xchg ch, cl
xor ebx, eax
not edx
add edi, eax
neg dl
btc ecx, 0x14
xadd cx, dx
mov edx, dword [esi + edx - 0xeda4464]
mov cl, byte [esi + 4]
mov eax, 0xac3f5034
adc esi, 2
ror al, 0x66
shr edx, cl
mov dword [esi], edx
lea ecx, [eax*2 + 0x460f4fac]
jmp edi

Function at 0xbf30d7
Capabilities:
Encode data using xor

Disassembly:
inc ecx
bswap esp
dec edx
mov dword [esp + edx - 0x8d0d], 0x9207cf03
inc ecx
mov ebx, ebx
inc esi
lea esp, [eax + 0x40ebaa6]
inc ebp
mov edi, ebx
dec eax
sal dword [esp + eax - 0x5f0c8d0d], 0x7a
inc ecx
neg esp
inc edi
lea esp, [esp + edx - 0x4c9d1533]
dec eax
mov dword [esp + eax - 0x5f0c8d0d], ebp
inc esi
xor dword [esp + edx*8 - 0x46868], esp
inc ebp
mov esi, edx
pop ebp
dec edx
lea ecx, [eax*2 - 0x48703860]
inc ecx
xor eax, edi
dec ebp
arpl sp, sp
dec eax
bts ebx, eax
dec ebp
add ebp, esp
inc bp
bt eax, edi

Function at 0xbf913f
Capabilities:
Encode data using base64

Disassembly:
shr al, 0x83
xor edx, ebx
rol edx, 3
dec edx
rol ecx, 0x6d
call fcn.00c46167
jb 0x7b91eb
mov edx, dword [ebp]
mov eax, 0x3cbce499
bt eax, eax
call fcn.00bdf5ae
Function at 0xbfda13
Capabilities:
Execute syscall

Disassembly:
mov ebp, dword [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
not ax
mov edx, dword [esp + 0x14]
sal al, 0x25
setbe al
push dword [esp + 0x18]
popfd
mov eax, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
push 0xf4327704
call fcn.00c9cada

Function at 0xc12c65
Capabilities:
Authenticate hmac

Disassembly:
dec ebp
arpl sp, sp
sar dx, 0xe1
dec ebp
adc ebp, esp
dec esi
lea ebx, [ebx + eax*2 + 0x6d22ad3c]
dec esp
mov dword [esp + ebx*4], esi
inc si
mov edi, dword [edx + ecx]
dec ebp
lea ecx, [ecx + edx*4 + 2]
dec eax
ror ebx, 0x7e
inc ecx
sal dl, 0x44
inc esp
movzx esp, word [edi + edx]
ja 0x7e33b2

Function at 0xc1364c
Capabilities:
Encode data using base64

Disassembly:
bt ecx, ecx
sbb cl, ch
lea edx, [ecx*4 - 0x975297c]
lea ebp, [ebp + edx - 0x40d3e380]
btr edx, edx
xor eax, ebx
sar ecx, 0xab
inc eax
sar edx, 0x49
call fcn.00be717e
cwde
mov ecx, eax
neg dl
rol dl, 1
neg dl
sub cl, al
inc dl
neg cl
xor bl, dl
push ecx
cbw
lea edx, [esp + edx + 4]
sar ax, 0x8d
pop eax
movzx cx, byte [edx + eax*4 - 0x2c00]
movzx edx, ax
add al, 0x3f
adc edx, 0x183b8d91
lea esi, [esi + eax*2 - 0x1680]
sub al, 0x3d
mov word [esi + edx - 0x183b9891], cx
adc dl, dl
lea ebp, [eax + ebp - 0xb06]
sar dx, 0xa6
mov ecx, dword [ebp + eax*2 - 0x1604]
dec edx
cmovno ax, dx
lea eax, [eax + edx*4 - 0x1376f756]
xor ecx, ebx
and edx, 0xcd9982bc
xchg dx, ax
not ecx
sbb eax, 0xc79f54a8
adc dl, 0x2a
idiv eax
sub ecx, 0x7ba893a0
push eax
rol ecx, 3
cwd
ror al, 0x42
jae 0xc50b7c
inc dl
ror eax, 1
not eax
not dl
xor ebx, eax
rol cl, cl
adc ebp, eax
call fcn.00c32da6
rol eax, 1
inc eax
shl dx, 0xeb
not eax
add dx, dx
or ecx, ecx
adc eax, 0x30118c3d
shl edx, 4
or dx, cx
xor edx, edx
bswap eax
push ecx
add dx, 0x593c
inc dword [esp + edx - 0x593c]
neg eax
bswap eax
xor eax, 0xf3b97b5
sal cx, 6
jb 0xb15811
inc edx
rol eax, 3
neg ecx
xor ecx, ecx
xor eax, 0x623636bb
inc ecx
ror edx, 0x61
bts ecx, 0x82
neg eax
bswap eax
call fcn.00b99148
mov edx, 0x26b9da12
mov cl, byte [edx + edi - 0x26b9da10]
mov dword [esp + edx*2 - 0x4d73b424], edx
neg dword [esp + edx - 0x26b9da12]
jne 0xce1265
mov ecx, 0xbb248d12
ror ecx, 0x16
and al, dl
not al
mov word [edi + 4], ax
mov eax, ecx
sub ecx, ecx
movsx edx, al
lea ecx, [ecx + edi + 4]
mov dword [edi], ecx
mov ecx, dword [ebp]
cdq
xor edx, eax
lea ebp, [ebp + edx - 0x6dcbb50f]
lea eax, [edx + eax*2 + 0x6d35d52b]
not edx
setnp dl
xor ecx, ebx
neg ecx
or edx, edx
adc ecx, 0x70e5d3b
or edx, edx
neg al
cdq
bswap ecx
shl edx, 0x9a
sar al, 1
sbb ecx, 0x68a0520e
bts ax, ax
xor eax, edx
bts eax, 0xf
xor ebx, ecx
inc al
shl al, 0x82
add esi, ecx
mov ecx, 0xeb96b505
jmp esi
bswap ecx
xor ebx, ecx
bt ax, 0xb8
add edi, ecx
pop edx
jmp fcn.00ab5433
lea edi, [edi + edx - 0x26b9da10]
js 0xcb76d1
mov eax, dword [ebp]
mov edx, 0x54135e88
and dl, dl
lea ebp, [ebp + edx - 0x54135e84]
lea edx, [edx + edx*4 + 0xe900921]
xor eax, ebx
sar edx, 6
lea ecx, [edx*2 - 0x13c25a76]
jns 0x713874
neg eax
add cx, 0xfd08
jne 0xb5a222
Function at 0xc199db
Capabilities:
Authenticate hmac

Disassembly:
sub eax, ecx
push 0x5dab7a3f
push 0x8186bf30
jmp 0xbd1051
mov esp, eax
push edi
push esi
jmp 0xcf6ba8
push 0xc13ed06
shl dword [esp], 0x8e
and eax, 0xfffffffc
jmp 0x7bd4d7
mov esi, 0xf4276d34
pushfd
not esi
bts si, si
mov esi, edx
call fcn.007ced9b

Function at 0xc1e1e8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
dec edx
mov dword [esp + esi - 0x5620600c], edx
inc esp
xor edi, ebp
dec esp
lea eax, [edx*4 + 0x15235585]
inc edx
sal dword [esp + esi - 0x5620600b], 0x44
inc ecx
neg edi
push ebp
and edx, dword [0x34b4c142]
cmc
lahf
fild qword [ecx - 0x2008bebc]
inc esp
mov esp, esi
dec ecx
neg esi
inc edx
mov dword [esp + esi + 0x5620600d], eax
inc ecx
inc edi
inc ecx
neg edi
inc esi
mov ebx, dword [esp + esi + 0x5620600f]
inc edx
movzx ecx, byte [esp + ebx - 0x2f32]
inc ecx
sub esp, 0xa51313af
inc ecx
ror edi, 2
dec eax
cdq
neg byte [esp + edx + 2]
dec edx
mov dword [esp + esi + 0x5620600c], ebp
movzx ebx, cl
inc esi
xor dword [esp + esi + 0x5620600c], edi
bswap ebx
dec ebp
add esp, eax
cwd
pop ebp
call fcn.00737451
stc
pushal
lea edi, [ebx - 0x1b]
dec ecx
js 0xc1e1f8
test dword [eax], esi
add dword [ecx + 0x78], eax
xchg ebx, eax
test dword [eax], ebp
adc dword [0x4e859378], esi
cdq
dec edx
retf 0x568
Function at 0xc1f98c
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [edi]
mov ebx, 0xc8379f13
dec eax
add edi, 4
inc esp
movsx esi, bl
movzx edx, bl
xor ecx, ebp
inc ebp
mov edx, esi
inc ebp
mov eax, edx
dec ecx
dec edx
mov dword [esp + esi - 0x13], ebx
inc ecx
mov esi, edx
inc edx
inc byte [esp + esi*2 - 0x22]
xor ecx, 0xb4886aa3
inc esp
movsx edi, dl
inc dx
sub ecx, 0x841eacb3
dec edx
neg dword [esp + esi*2 - 0x26]
jno 0x751139
mov ecx, 0xc5ab593d
lea edx, [ecx + ecx + 0x2fba62b6]
movsx eax, dl
lea esi, [esi + eax*4 - 0xc4]
shr edx, 0x1e
div ecx
bts dx, 0xb4
mov edx, dword [edx + esi - 0x74a94db6]
jae 0xbec577
xor edx, ebx
jmp 0xcd2c25

Function at 0xc23d89
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x18]
je 0x7e3f4b
push 0xc13dca3d
mov dword [esp], ebx

Function at 0xc40c93
Capabilities:
Authenticate hmac

Disassembly:
sar byte [esp + 7], 0x63
jnp 0xa9415c
mov eax, dword [esi]
mov edx, 0x3a81a5a9
movsx ecx, dx
sub ecx, 0x20340532
lea esi, [edx + esi - 0x3a81a5a5]
sub ecx, edx
xor eax, ebx
xchg ch, dl
and cx, 0x923a
not eax
bts ecx, ecx
or cl, dl
ror eax, 2
jmp 0xc06eba

Function at 0xc453d6
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], eax
call fcn.00bb8ae6
neg byte [eax + ebp]
mov ebp, 0x2df0d187
and bh, bh
les ecx, [eax - 0x73a21714]
fistp dword [eax + 0x44]
call 0xe13fe054
aam 0xe8
pop ebp
mov word [ebx - 0x34], fs
movsb byte es:[edi], byte [esi]
call 0x59fe060
cld
call 0x49afe066
xor al, 0xe8
pop ebp
invalid

Function at 0xc45928
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [eax + edi]
push eax
not ecx
cwde
sar dword [esp + eax + 7], 0x43
jbe 0xaaff2d
not edx
ror al, 0x65
sub eax, eax
lea eax, [eax + eax*8 - 0x60692879]
or ecx, edx
lea eax, [eax + 0x56b8a3a9]
cwde
mov dword [esp + eax*2 - 0xf65d], 0x4603461c
mov dword [edi + eax*2 - 0xf660], ecx
lea edx, [eax + eax*8 + 0x1d377f2c]
mov edx, dword [ebp + eax*2 - 0xf65c]
lea ebp, [ebp + eax*2 - 0xf658]
push eax
xor edx, ebx
dec edx
rol edx, 1
lea edx, [eax + edx + 0x2a8ad8d9]
lea ecx, [eax*2 - 0x1bd9056b]
sal byte [esp + eax*2 - 0xf657], 1
bswap edx
inc al
or cx, ax
xor ebx, edx
dec byte [esp + eax*4 - 0x1ecb9]
or cx, word [esp + eax*8 - 0x3d981]
adc esi, edx
movzx edx, byte [esp + eax - 0x7b2d]
mov dword [esp + eax*2 - 0xf662], esi
ret 0xc
mov ecx, edx
pop edx
jmp 0x7bb5c9

Function at 0xc4d358
Capabilities:
Execute syscall

Disassembly:
inc sp
xor ebx, ebp
inc edx
and dword [esp + edi*2 - 0x7b0ed674], 0xd4ab64ad
inc cx
neg ebx
ror dx, 0x8f
movzx eax, bl
call fcn.00aeaf1f
mov ecx, dword [edx + ebp - 0xf5a6138]
adc edx, 0x4105f783
jbe 0xca9e11
sal edx, 0xf0
not eax
imul dx, dx
not ecx
and eax, ecx
jmp 0xb12811
Function at 0xc598a8
Capabilities:
Encode data using base64

Disassembly:
dec eax
sbb eax, ebx
dec esp
mov esi, ecx
adc word [esp + 0xb], bx
dec eax
mov dword [esp], ebx
inc ecx
mov cl, byte [ecx + 0x10]
jae 0xc5b6f2
dec ecx
shr esi, cl
dec eax
and dword [esp], ebx
dec ebp
mov dword [ecx + 0xa], esi
dec ecx
adc ecx, 0xa
ror bx, 0xaa
mov ecx, dword [edi]
or al, 0x27
movzx esi, word [esp + 6]
push ebx
inc esp
mov edx, ebx
dec eax
lea edi, [edi + esi + 4]
inc eax
xchg byte [esp + esi*2 + 0x16], dh
dec eax
inc dword [esp + esi*2 + 5]
shl word [esp + esi + 4], 0x27
xor ecx, ebp
dec eax
rol dword [esp + esi*2 + 8], 0x76
mov edx, 0x5818fa9b
call fcn.00bc9332
jae 0xc5b771
jge 0xc5b708
mov eax, dword [0x968c4ffd]
dec ebp
mov ecx, 0xd68c4ffd
sbb eax, 0xa792f4d9
xchg ebx, eax
in al, dx
cmp dh, byte [ecx]
and dword [ecx], 0xffffffff
aam 0x7c
cmp byte [ebx + 0x4700cdc7], dl
and edi, edi
or ebp, dword [ebp + 0x58]
in eax, 0xfa
invalid
mov bl, 0xad
or eax, 0x51e9351e
mov al, byte [0xa18f6782]
stc
mov edi, 0xa63ad344
test byte [esi - 0x2854c2e], dl
nop
cmpsb byte [esi], byte es:[edi]
sub byte [ebx - 0x5f], 0xbb
lds edi, [ebx + edi*4]
mov al, byte [0x9d8a89cf]
pushal
add al, 0xff
out dx, eax
rol byte [eax - 0x61], 1
jbe 0xc5b73a
push 0x1f13edbf
mov edx, 0xfa1f3687
movzx eax, dl
mov edx, edi
lea edi, [edi + eax*8 - 0x43a]
shl al, 0x41
or eax, eax
mov word [edi + eax*2 - 0x1c], dx
mov edx, dword [ebp + eax*2 - 0x1c]
lea ebp, [ebp + eax - 0xa]
cwde
xor edx, ebx
ror edx, 1
dec edx
lea eax, [eax*8 + 0x19bb3b01]
neg edx
push eax
sub al, 0xa5
not eax
xor edx, 0x6736c716
movzx ecx, al
xor eax, 0x3f1cbda2
not ecx
bswap edx
push eax
bts ecx, 0x1b
xor ebx, edx
add esi, edx
shl cl, 0xa4
movzx edx, byte [esp + 8]
push eax
pop edx
pop ecx
pop eax
pop edx
jne fcn.00bb937c
movzx edx, byte [esi]
mov eax, 0x7da6820c
xor dl, bl
add dl, 0x16
movsx ecx, ax
not dl
sub dl, 0xa1
sal eax, 0x47
btr cx, ax
ror cx, cl
neg dl
xor bl, dl
add edx, esp
rol cx, 0x86
sal eax, 0xc9
lea ecx, [eax + eax + 0x302cd3b4]
mov eax, dword [edx + ecx*2 - 0x6889a768]
add cl, 0x3e
movsx edx, cx
btc edx, edx
mov edx, eax
xor ecx, 0x31a91427
sbb cx, cx
mov eax, dword [edi + ecx - 0x5ed0000]
call fcn.00cac045
bts ax, ax
shr eax, 0x4d
shl edx, cl
add eax, eax
lea ecx, [eax*4 - 0x5475d5ea]
mov dword [edi + eax*2 - 0x1c9ffa], edx
mov ecx, dword [eax + edi - 0xe4ffc]
movsx edx, al
mov edx, dword [edi + eax - 0xe4ff8]
or eax, eax
adc ecx, edx
cdq
neg edx
or eax, 0x12061e8e
mov dword [edi + eax*4 - 0x48397ff2], ecx
lea edx, [eax + edx*8 - 0x12e284da]
lea edi, [edi + eax - 0x120e5ff8]
push edx
cdq
mov dword [esp + eax - 0x120e5ffe], esi
ret
Function at 0xc5a3f8
Capabilities:
Encode data using xor

Disassembly:
xor edi, ecx
sal byte [esp + 2], 0xc7
adc word [esp + 2], 0x9d3b
and edi, 0xff
inc dword [esp]
sar word [esp + 2], 0xc
mov edi, dword [edi*4 + 0x760064]
sar byte [esp + 2], 0xe4
xor word [esp + 1], 0x93ad
not dword [esp]
shr ecx, 8
push 0x3d8b1410
xor ecx, edi
dec word [esp]
push 0x1781ee8b
inc edx
sal byte [esp + 6], 0x63
xor dword [esp + 7], 0x2b87aa3c
jae 0xc79e75
mov edx, 0x4a25420
mov eax, dword [edi + edx*8 - 0x2512a100]
movzx ecx, dx
mov cl, byte [edi + edx - 0x4a2541c]
dec dl
add edx, edx
shr edx, 0x61
lea edi, [edi + edx*8 - 0x2512a0f2]
push edx
xor dx, dx
mov byte es:[eax + edx*2 - 0x9440000], cl
xor word [esp + edx - 0x4a1ffff], dx
lea esi, [esi + edx - 0x4a20004]
mov eax, dword [esi + edx*4 - 0x12880000]
mov ecx, dword [esp + edx*2 - 0x9440000]
shl dword [esp + edx*2 - 0x9440000], cl
xor eax, ebx
sal cl, 0xc4
not eax
adc edx, dword [esp + edx*4 - 0x12880000]
btc dx, dx
rol eax, 1
pop edx
bt ecx, 0xb6
dec eax
jmp 0xc20509
xor ebx, eax
shr edx, cl
and dx, cx
adc ebp, eax
xor edx, ebp
jmp edx
lea ecx, [edx + 0x4386990]
neg eax
shr edx, cl
bswap eax
jp 0xbee264
mov eax, dword [edi]
mov edx, 0xca0c1d3e
bt dx, 0x98
and edx, 0x10371d82
mov edx, dword [edi + edx*2 - 0x83a00]
mov ecx, 0xf3a30c25
adc edi, 4
sub cl, cl
rol cl, 0x86
not eax
shr ecx, 0x12
not edx
and eax, edx
imul ecx, ecx
xor cl, ch
neg ecx
mov dword [edi], eax
ror cl, 1
lea eax, [ecx*2 + 0x3999061d]
mov eax, dword [ebp + eax*2 - 0x393bc096]
and ecx, 0xf0a4a82d
adc ebp, 4
xor eax, ebx
neg eax
mov edx, ecx
push ecx
xor byte [esp + 3], dl
dec eax
neg cl
neg eax
shr edx, cl
sar cl, 0xa3
xor byte [esp + edx*2 - 0x39], 0xa
xor eax, 0x693c882f
ror eax, 1
lea eax, [eax + edx*8 + 0x4b1630cb]
bswap eax
xor eax, 0x61b5790a
xadd byte [esp + edx*8 - 0xed], cl
dec word [esp + edx*8 - 0xee]
jns 0xcd0aec
xor ebx, eax
add esi, eax
shl edx, cl
mov dword [esp + edx*4], esi
ret
movzx edi, byte [edx + edi - 0x789ed093]
mov dword [esp], 0x59b93d86
shr dword [esp], 0x8b
jns 0xb5bcd3
dec ebp
pushal
xor al, 0x7d
invalid
xor ecx, 0x26add7ad
sal word [esp + 4], 1
dec eax
call fcn.0071f82d
mov eax, dword [esi + ecx]
lea edx, [ecx*4 - 0x57bbd0]
shr edx, 0x36
xor eax, ebx
call fcn.00ab8a50
sysenter
push ebx
pushfd
mov ebx, 0x9686ff02
mov ebx, dword [esp + ebx + 0x69790102]
mov dword [esp + 4], 0x18bcece
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00733ecb
xor ebx, ecx
and eax, 0xc6a6b034
sub dword [esp + eax - 0xa69000], edx
add ebp, ecx
mov ecx, 0x8024f95
xor ecx, 0x55bca30d
mov eax, edi
sal ecx, cl
mov dword [edi - 4], eax
mov edx, ecx
mov ecx, dword [esi]
movsx eax, dl
ror edx, 3
lea esi, [esi + edx*4 - 0x4bfffffc]
inc eax
xor ecx, ebx
call fcn.00bff7ac

Function at 0xc5d439
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [eax + edi - 0x3929d3fa]
jle 0xc3c4e5