joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1332db9
Capabilities:
Get number of processors

Disassembly:
inc ebp
mov ebx, ecx
inc esi
xor dword [esp + ecx - 0x3bf0], edx
dec edx
mov edi, dword [esp + ecx - 0x3bf0]
mov edx, 0xca850f0f
pop edx
dec ebp
arpl dx, dx
inc al
dec esi
mov dword [esp + ecx - 0x3bf8], ecx
dec edx
mov dword [esp + ecx - 0x3c00], 0xf53f4c03
dec ebp
add edi, edx
inc ebx
mov edx, dword [esi + ecx*2 - 0x7800]
inc edi
mov ebp, dword [esi + ecx*8 - 0x1dffc]
dec edx
sub dword [esp + ecx*2 - 0x77fb], 0x7f93e82f
mov esi, 0x717be06
inc ecx
and edx, ebp
call fcn.0176edf0
mov eax, 0x679b3e88
push eax
sub word [esp + eax - 0x679b3e85], ax
dec ebp
mov ebx, dword [esi + eax - 0x679b3e88]
call fcn.01234f20
cmp ax, 0xb933
test edx, edi

Function at 0x1334aa6
Capabilities:
Encode data using base64

Disassembly:
sal edx, 0x8c
xor dx, 0xf22a
adc ecx, eax
call fcn.01392b2a
movsx edx, bx
dec eax
mov dword [esp + ebx - 0x4c166cb2], ebx
dec ecx
not edx
ror byte [esp + ebx - 0x4c166cab], 0x84
dec ecx
or esi, edx
dec eax
inc edx
inc ecx
setno al
inc dword [esp + ebx - 0x4c166caf]
dec ebx
mov dword [esi + eax*8 - 0x36008], esi
jns 0x17a057a
inc ecx
push eax
mov ecx, dword [esp + ebx - 0x4c166ca7]
inc ecx
mov edx, dword [esp + ebx - 0x4c166cb2]
dec eax
or dword [esp + ebx - 0x4c166caa], ebx
ror word [esp + ebx - 0x4c166cac], cl
dec esi
lea esp, [ebx - 0x4c166cae]
dec esp
lea ecx, [eax + ebx*2 + 0x66a3a18a]
call fcn.0132a135
mov edx, 0x29b8ae26
mov ecx, dword [edx + ebp - 0x29b8ae26]
lea eax, [edx + edx + 0x173e1828]
mov eax, dword [ebp + edx - 0x29b8ae22]
jmp 0x1247d9f
Function at 0x1339378
Capabilities:
Encode data using base64

Disassembly:
jae 0x133df8d
not dl
ror ax, 0x46
call fcn.012345f8
dec esi
lea ebx, [ecx + ebp*8 - 0x57e566da]
inc ecx
movzx edx, bx
dec esi
lea esp, [edx - 0x5ea2]
inc esp
movzx ecx, cl
movsx ebp, cl
inc esp
xor edx, edi
mov ebx, ebp
inc ecx
not edx
call fcn.0122b30e
neg al
inc ecx
mov edx, ebx
inc esp
xadd edx, ecx
pop ebp
xor al, 0xbc
inc ecx
shr ebx, 0x12
sbb al, 0xa4
mov esi, edx
inc ecx
inc ecx
inc edx
shl dword [esp + eax + 0xc], 0x37
inc eax
xor bh, al
dec eax
lea eax, [esp + eax + 0x10]
inc esi
xchg dword [esp + eax + 0xb], ecx
inc edx
neg byte [esp + eax*2 + 0xa]
or esi, 0x4592bd15
inc si
mov ebp, dword [eax + eax]
call fcn.017ab4d5
pop ebp
pop ecx
inc ecx
pop ecx
pop edx
jl fcn.0136d40d
dec ebp
lea esp, [esp + eax*4 - 0x214]
dec esp
sbb eax, ecx
dec ecx
or ecx, ebp
jb 0x1274fc2
inc esp
xor ebx, edi
mov ebp, eax
inc ecx
add cl, 0x9f
inc ecx
inc ebx
jmp 0x134de68
mov esi, ecx
pop edi
jns 0x121814c
inc edx
movzx eax, byte [esp + edx - 0x5907]
dec esp
adc edi, ebx
dec esi
mov dword [esp + edx*2 - 0xb208], eax
jmp 0x1775d1f
dec edx
mov dword [esp + edx*4 - 0x16420], edi
inc edx
xor dword [esp + edx*2 - 0xb208], ebx
mov edi, 0xfaa86187
dec edx
mov edi, dword [esp + eax - 0x451358fc]
dec esi
mov dword [esp + eax - 0x4513590c], edx
inc edx
not dword [esp + eax - 0x45135904]
inc edx
neg byte [esp + eax - 0x45135909]
dec eax
arpl bx, bx
inc ebp
movsx ebx, al
jbe 0x126e1da
rol ecx, 1
lea ecx, [ecx + eax - 0x6ccf12d3]
not ecx
shr edx, 0xea
or ax, dx
xor ebx, ecx
sal eax, 0xa9
neg eax
xchg dx, ax
mov dword [ebp + eax*2 - 0x209b0066], ecx
movzx ecx, al
mov edx, dword [esi + eax - 0x104d8039]
xor edx, ebx
neg ecx
xor ax, ax
sal ecx, 0xba
neg edx
xadd al, ch
dec eax
inc edx
neg edx
jmp 0x1795d51
dec ebp
arpl bx, bx
je 0x121aa7c
inc ecx
dec ecx
inc ecx
ror ebx, 2
inc ecx
rol eax, cl
inc edi
lea ebx, [ebx + ecx - 0x1bdfba02]
inc ecx
rol ebx, 3
dec bp
push edi
dec eax
shl ebp, cl
add ecx, eax
jge 0x1777372
inc eax
ror ch, 1
dec esi
mov dword [esp + ebp - 1], ebx
inc edx
sal dword [esp + ebp*4 - 0x1c], cl
inc eax
not ch
call fcn.01372f04
dec esp
xchg dword [esp + 8], ebx
dec ecx
add ebx, 0x7777
inc ecx
jmp ebx
inc ebx
xor al, byte [eax - 0x4513590c]
inc edx
inc byte [esp + edx*4 - 0x16425]
inc ecx
pop eax
inc ecx
sar eax, 0xf1
dec edi
lea esp, [esp + eax*2 + 1]
inc ebp
mov ecx, edx
inc eax
xor al, bh
sub al, 0xb7
inc esi
or dl, byte [esp + eax*2 + 9]
inc ecx
push ecx
jnp 0x124993e
inc esp
xor dword [esp + eax*4 - 0x218], ebx
dec eax
sar ecx, cl
jbe 0x1252c35
Function at 0x1339f5d
Capabilities:
Encode data using base64

Disassembly:
push edx
jmp 0x1795c01
inc ebx
mov dword [esi + ecx - 0x1f], eax
call fcn.0122e784
ror ebx, 1
movsx ebp, ax
not ebx
inc ecx
neg dl
inc sp
and edx, ebp
rol ebx, 1
inc ecx
shl dl, 0x81
jge 0x17a8ce3
ror byte [esi + 0x23], cl
std
and eax, ecx
adc al, 0xd9
push ds
xchg esi, eax
fadd dword [0x8c896dd3]
mov dword [esp + edx - 0x6eac628c], ecx
mov edx, dword [esi + ecx - 0x8c]
xor edx, ebx
and cl, al
inc edx
ror word [esp + ecx*2 + 1], 0x81
neg cx
sbb byte [esp + ecx*4 + 3], 0x12
rol edx, 2
lea edx, [edx + eax - 0x5172846d]
add dword [esp + ecx], eax
neg edx
not cx
xor ebx, edx
jmp 0x13b3486
sbb ebx, 0x29090f8e
not ebx
push edi
jmp 0x122b560
xor dword [esp + 8], ebx
mov ecx, ebp
dec eax
mov edi, dword [esp + 8]
dec eax
arpl bx, bx
inc ecx
xadd edx, edx
dec eax
rol eax, 0x5c
dec eax
mov dword [esp + 8], 0x25baae11
dec esp
adc edi, ebx
bswap ecx
inc bp
dec ecx
mov esi, dword [esi]
sal dword [esp + 4], cl
and cl, 0x8d
inc ecx
mov cl, byte [esi + 8]
inc esp
movzx ebp, al
jge 0x133a869
dec edx
lea esi, [ebp + edx*4 + 0x4a111304]
not ebx
jbe 0x136f8f1

Function at 0x133a7f5
Capabilities:
Encode data using base64

Disassembly:
pop edx
mov edx, 0xa53fed29
inc bp
mov ebx, dword [esi]
dec eax
lea ecx, [edx + edx + 0xcad5ba2]
inc ecx
mov cl, byte [esi + 2]
dec esp
lea ecx, [edx + edx*2 + 0x4ca68011]
inc ecx
movzx ebx, cl
dec ebp
lea esi, [esi + ebx*2 - 0x116]
dec ebp
add ecx, ecx
sar bl, 1
inc esp
movsx eax, dl
inc cx
shr ebx, cl
inc ecx
push ecx
dec edx
lea esi, [ebx + eax*2 + 0x5f1dd98d]
inc bp
mov dword [esi + ebx*2 - 0x18c], ebx
mov word [esp + ebx*8 - 0x62b], 0x103a
inc ebp
mov ebp, dword [esp + ebx*2 - 0x18c]
dec esi
lea esp, [ebx - 0xc2]
inc esi
movzx edx, byte [esp + eax*2 - 0x52]
inc sp
xchg edx, edx
inc eax
or dh, dl
inc esp
xor ebp, edi
inc edx
sar byte [esp + eax - 0x29], 0x66
inc ebp
lea ebp, [ebp + ebx - 0x473c2600]
inc ebp
mov ebx, edx
dec ecx
inc ecx
call fcn.01391e24
Function at 0x133a882
Capabilities:
Encode data using base64

Disassembly:
inc ebp
lea eax, [eax + ebp*2 - 0x79ebdb88]
inc ecx
movzx eax, cl
jmp 0x1337c17
jl 0x13a3feb
inc ebp
mov eax, dword [esp]
dec ecx
add esp, 4
mov ebp, 0x6f063892
inc esp
xor eax, edi
dec esp
lea ebx, [ebp + 0x2b0b4d0c]
inc ebp
mov ecx, ebx
inc ecx
inc eax
inc ecx
movsx esi, cl
dec eax
rol esi, 0x41
inc ecx
ror eax, 2
inc ecx
push ecx
inc esp
movsx ebp, word [esp + ebp - 0x6f06388e]
jmp 0x1266b01
inc ecx
rol eax, 3
inc eax
add byte [esp + ebp - 0x6f06388c], dh
push esi
dec edx
mov dword [esp + ebp*2 + 8], edi
dec esp
lea edx, [esi*2 + 0x2cad4932]
dec eax
sar eax, 0x6b
dec eax
not dword [esp + ebp - 0x6f063892]
inc esp
xor dword [esp + ebp - 0x6f06388a], eax
dec edx
mov edi, dword [esp + ebp*2 + 8]
sub edx, 0x14bfe986
movsx eax, cx
or ecx, ecx
neg edx
pop ecx
not edx
mov dword [esp], 0x8ebc4d9b
add al, al
neg edx
lea ecx, [eax + eax*2 - 0x737a774a]
xor ebx, edx
rol word [esp + 1], 0x6a
or ecx, eax
adc edi, edx
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
sub cx, word [esp + 1]
adc ebp, 4
not edx
not eax
xor ecx, 0xb13a862d
or edx, eax
add dword [esp + ecx - 0x4ec535a0], ecx
movzx eax, cl
mov dword [ebp + eax - 0xa0], edx
jnp 0x1288c48
mov dword [esp + eax - 0xa0], edi
ret
Function at 0x134a078
Capabilities:
Authenticate hmac

Disassembly:
dec esi
mov dword [ecx + esi - 0x1aad40eb], ecx
movsx ebp, bl
dec eax
xchg dword [esp + ecx - 0x1aad40e5], ebp
dec ebp
lea esi, [esi + ecx - 0x1aad40eb]
inc ecx
movzx eax, bl
inc ecx
xor ebx, dword [esp + ecx*4 - 0x6ab50394]
and byte [esp + ecx*4 - 0x6ab50394], 0x10
dec edi
lea esp, [esp + ebx*2 - 0x4b16a258]
inc ecx
shl bl, cl
inc esp
movsx ebp, ax
xor ebx, edi
inc ebp
mov eax, ebx
jmp 0x1330cae
inc esp
movzx eax, ch
inc ecx
shr ebx, cl
call fcn.01785d7b
mov dword [ebp + 2], edx
jmp 0x134df27
inc ecx
rol bl, cl
ror ebx, 1
jmp 0x133a12e
inc ebx
xadd cx, ax
call fcn.01239096
dec edx
lea eax, [ebp*2 + 0x5d1b70bf]
inc ecx
bswap ecx
inc ecx
mov ecx, ebp
dec eax
mov dword [esp + ecx*2], ecx
inc ecx
dec ecx
movsx esi, bx
inc ecx
bswap ecx
dec eax
sub esi, 0x5d8f5aa0
call fcn.013b015d
jns 0x139bcf8
inc ecx
mov edx, 0x6ab3e0b9
inc ebp
mov ecx, edx
inc edi
movzx eax, byte [edx - 0x6ab3e0b9]
dec ebx
lea ebx, [ecx + edx - 0x204950cc]
inc ecx
movsx eax, cx
dec edi
lea esp, [esp + edx - 0x6ab3e0b8]
jmp 0x1223b7f
dec esi
lea ecx, [ecx + esi - 0x1aad40e3]
jmp 0x12308dc
bswap eax
xor ebx, eax
add edi, eax
movzx eax, cl
sal edx, cl
mov edx, dword [ebp + eax - 0x63]
dec al
lea ebp, [ebp + eax - 0x5e]
dec eax
and ax, 0x4b86
jns 0x139a698
mov esi, 0xa912ea0e
mov eax, 0xe19ffd30
jmp 0x179c0a5
movzx ecx, byte [esi - 1]
shr eax, 0x9c
xor cl, bl
mov edx, 0x7225ac19
rol dx, 0xcc
rol cl, 1
not cl
neg ax
jl 0x12484b8
mov ecx, 0x258b512e
inc bp
movzx eax, byte [esi + ecx - 0x258b512e]
inc ecx
mov ch, byte [esi + ecx - 0x258b512c]
inc ecx
not al
inc esp
movzx ecx, cl
dec ecx
lea ebx, [ecx + ecx*4 - 0x51f3d1e5]
inc ecx
push ecx
inc eax
not ch
dec esi
lea ebx, [ecx*2 + 0x1aad4089]
dec eax
shl ebx, 0x6a
inc ecx
xchg ebx, ecx
inc esp
or al, ch
inc si
mov dword [ecx + esi - 0x1aad40e3], eax
jmp 0x134a3ea
shr ecx, 0xd0
not ax
mov cl, byte [ebp + ecx - 0x2871]
sub eax, 0x6113360d
shl edx, cl
jmp 0x1241c1b
inc edx
mov cl, byte [esi + esi + 4]
movsx ebp, al
dec ebp
lea esi, [esi + esi + 2]
inc eax
movsx ebx, ch
jbe 0x1239a2b
mov edx, 0x8abcb58b
lea ecx, [edx + edx*2 - 0x77c028ff]
movsx eax, dl
mov edx, dword [ebp + ecx - 0x2875f7a2]
jmp 0x1361ed1
push edx
movsx edx, cl
xchg ecx, eax
popfd
add ecx, edi
jmp ecx
lea eax, [eax + edx*2 - 0x4b8e4427]
neg edx
neg eax
sar dx, 1
lea eax, [eax + edx - 0x30d5a09e]
rol eax, 3
or ecx, 0xc63a2901
js 0x134b3d8
inc ebp
mov ebx, dword [esi]
xor esi, esi
je 0x138128b
inc ecx
bswap ebx
push edi
inc cl
call fcn.01793a3a
dec eax
mov edi, dword [esp + esi - 0xfe68]
dec eax
mov dword [esp + esi*2 - 0x1fcd8], ebx
call fcn.0124d7c6
out dx, al
xchg ebp, eax
ror dword [eax - 0x53713560], cl
add edx, esi
sal dl, 0xba
xchg esp, eax
add edx, esi
ror byte [edx - 0x29fc0312], 0xc0
mov byte [0xd603a0e2], al
sar byte [esi - 0x29fc6f22], 0xc0
invalid
Function at 0x134d40a
Capabilities:
Authenticate hmac

Disassembly:
add dword [esp + ecx*2 - 0x402602b6], edx
setp dl
inc eax
neg edx
or dword [esp + ecx - 0x2013015b], 0x7f02203b
setne byte [esp + edx*2 - 0x3a00]
xor ebx, eax
xor ecx, edx
push ecx
sbb edx, dword [esp + ecx*2 - 0x402638b2]
add edi, eax
sar dword [esp + ecx*2 - 0x402638b5], cl
mov dword [esp + ecx*2 - 0x402638b6], edi
ret 4
bswap ebp
call fcn.013ac5b8
xor ecx, ebx
mov eax, 0x20291601
not ecx
mov dword [esp + edx*2 - 0x14], 0xa89e5da9
sal al, 6
call fcn.0179c9d1
lea esi, [esi + edx*2 - 0x3952]
dec cx
lea ecx, [edx*8 + 0x20121c33]
xor eax, ebx
neg eax
push ecx
xchg dword [esp + ecx - 0x20130157], ecx
inc eax
pop ecx
neg eax
neg edx
dec edx
jno 0x17710e4
lea eax, [eax + ecx*4 - 0x76aea062]
not eax
jb 0x127a48a

Function at 0x134eaf5
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
inc eax
sal dh, 0x87
dec eax
mov dword [esp], edi
inc ecx
mov ebx, 0xf62599ba
movzx edx, bp
inc cx
dec eax
xor dword [esp + edx*2 - 0xd4], ecx
inc ebp
or edx, eax
pop edi
inc ecx
rol al, 0x81
inc ecx
shl ebx, 0xdf
push esi
dec eax
arpl cx, cx
dec esi
lea ebp, [esi + ebx*4 - 0x56df0fd]
dec esi
xor dword [esp + ebx*4], eax
dec esp
adc edi, ecx
inc edx
neg byte [esp + ebx*2 + 2]
dec edi
add ebx, dword [ebx + esi]
call fcn.01257fd5

Function at 0x135f7a4
Capabilities:
Encode data using base64

Disassembly:
inc esp
xor ecx, edi
dec ecx
shl ebp, 0xae
inc edi
lea ecx, [ecx + edx - 0x709df9b7]
call fcn.01337a1e
ja 0x133f7e6

Function at 0x1361593
Capabilities:
Encode data using xor

Disassembly:
dec ecx
add esp, 4
inc esp
xor edx, edi
call fcn.0133351d
Function at 0x1372675
Capabilities:
Encode data using base64

Disassembly:
inc edi
mov eax, dword [edx - 0x1b6640]
dec edx
mov dword [esp + edx*2 - 0x36cc80], esi
dec edx
lea eax, [edx*2 + 0x772c4a1c]
dec edi
lea esp, [esp + edx - 0x1b663c]
inc esp
xor eax, edi
inc edi
lea eax, [edx + eax + 0x54fb7771]
inc ecx
ror eax, cl
inc edx
not dword [esp + edx - 0x1b6640]
inc esi
movzx ecx, word [esp + edx*4 - 0x6d98fe]
inc ecx
inc eax
dec eax
lea edx, [eax*2 - 0x43e79063]
inc ecx
not eax
inc ecx
rol eax, 3
inc esi
lea eax, [eax + eax + 0x1328ac1c]
inc ecx
xor eax, 0xb8a7e30c
inc ecx
movsx ebx, dx
inc ecx
dec eax
call fcn.0136d500

Function at 0x137dfff
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ebp*4 - 0x1f0], esi
inc ecx
mov cl, byte [esi + ebp - 0x78]
rol ebp, 0x82
movsx ebx, dx
not byte [esp + ebp - 0x1e9]
dec ebp
lea esi, [esi + ebp*2 - 0x3dc]
pop eax
dec eax
rol edx, 0xd9
inc bp
shld eax, ebp, cl
inc si
mov dword [ebp + esi - 0x1f0], eax
inc esp
movsx eax, si
inc ebp
mov edx, dword [esp + ebp*4 - 0x7c0]
xadd ebp, eax
dec ebp
lea esp, [esp + eax*2 - 0x3dc]
inc esp
xor edx, edi
inc ecx
xor al, 0x1f
call fcn.0134a308

Function at 0x1385d99
Capabilities:
Encode data using base64

Disassembly:
pop eax
dec ecx
rol eax, 0xc7
inc ebx
mov ebp, dword [edx + esi - 0x582f014]
dec esi
lea ecx, [ebx*8 + 0x42bc362c]
inc cx
dec ebp
dec edi
lea esi, [edx + esi - 0x582f014]

Function at 0x13915f7
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov dword [esp + esi - 0x5a8c], edx
pop edx
inc ecx
not eax
inc esp
movzx ebx, dx
movzx ebp, dl
dec ebp
xadd ebp, ebx
push edi
xor bx, bx
inc esp
xor dword [esp + esi*2 - 0xb518], eax
inc ecx
sar ch, 0xc4
inc eax
or ch, 0x27
pop edi
dec ebp
arpl ax, ax
inc bx
dec ebp
adc edi, eax
inc ecx
xadd ebx, esi
dec ebp
mov eax, dword [esi + ebp - 0xbf]
call fcn.013886d7

Function at 0x1397501
Capabilities:
Encode data using xor

Disassembly:
not ecx
bswap eax
xor ebx, eax
rol ecx, 0x21
call fcn.0137eac8
dec ecx
mov esi, dword [esi]
mov eax, 0xa0000a36
inc bp
mov ebx, dword [esi + 8]
dec ecx
add esi, 0xa
inc esp
mov ebp, eax
call fcn.012813fa
call fcn.0123e743

Function at 0x139e0a4
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov byte [esi], al
jmp 0x139e0ab
jb 0x176d900
mov eax, dword fs:[0x30]
ror ecx, 0x32
mov eax, dword [eax + 0xc]
rcl bh, 0x3c
mov ecx, dword [eax + 0xc]
bsr ebx, ebp
add bx, 0xb48a
ror bh, cl
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
mov ebx, ecx
cmp sp, dx
cmp ecx, eax
jmp 0x17800a9
cmp edx, 0x104
jmp 0x12776e3
neg ebx
call 0x125489e
je 0x12776e9
inc edx
jmp 0x1332e38
mov eax, 0x6b042b95
mov cl, dl
bts si, ax
rol eax, cl
rcl esi, 0x26
lea esi, [ebp + edx - 0x10c]
cmp di, 0x93be
add al, dl
xor al, byte [edi + esi]
jmp 0x1261419
je 0x137aaa2
lea ebx, [ebx]
Function at 0x13a7a20
Capabilities:
Encode data using xor

Disassembly:
xor eax, ebx
not eax
inc ecx
movzx ebp, ax
dec eax
not dword [esp + edx - 0xaebc57]
inc cx
movzx esi, byte [ebx + eax - 0x5a6bf797]
inc esp
movsx ebp, dl
rol bp, 0x4e
dec edi
lea esi, [esi + ebx - 0x5a6bf799]
inc bx
mov dword [esi + ebx - 0x5a6bf797], esi
adc byte [esp + edx*2 - 0x15d78be], bl
pop edx
pop ebx
pop ebx
pop esi
js fcn.0136d40d
xor al, 0x2b
inc edx
xor dword [esp + ebx - 0x5a6bf793], 0x57af3911
neg cx
inc edx
and dword [esp + ebx - 0x5a6bf77f], 0xb5282a39
inc al
dec eax
shr dword [esp + edx - 0xaebc66], 0x91
inc eax
xor bh, al
dec eax
lea eax, [esp + eax + 0x20]
jmp 0x1284b56
bswap ebp
inc ecx
shl al, 0x86
adc ax, 0xca13
push edi
dec edi
lea ebp, [ecx + edx*8 + 0x529bfd8e]
call fcn.0135cb1b
sar ebx, 0xdd
xor ebp, edi
inc ecx
movzx esi, bx
inc esp
movzx eax, dh
dec eax
neg eax
not ebp
jp 0x13acfb1
inc ecx
sar al, 0xe1
jno 0x13945a4
lea ebp, [ebp + esi - 0x709daeb7]
inc esp
movsx ecx, si
ror ebp, 1
add si, 0x2822
add si, cx
mov ebx, 0x432b97be
bswap ebp
inc esp
movzx eax, al
dec eax
lea ecx, [ecx + ecx + 0x60193625]
jns 0x13b6cb8
neg ebp
inc esp
movzx edx, bl
push edi
xor dword [esp + esi*2 - 0x1ded8], ebp
xchg ch, al
pop edi
inc cx
inc ecx
inc esp
movsx ebp, cx
dec eax
arpl bp, bp
inc esp
movsx ebx, bl
js 0x1325c06
dec esp
add edi, ebp
inc ecx
mov ebx, dword [esi + esi*2 - 0x1ded8]
inc ecx
movzx ebp, ax
inc bp
or eax, ebx
inc edx
mov eax, dword [esi + esi - 0xef68]
sar cl, 1
dec eax
add esi, 0x8a6f79a
mul ebx
inc bp
xor ebp, eax
inc ecx
mov dword [esi + esi - 0x8a7e706], edx
call fcn.0177ae78
ret 0x3e4a
neg ebp
inc ecx
sar dl, 0x63
inc ebp
dec esi
lea eax, [esi + edx + 0x5198db07]
jmp 0x133dfa3
mov dword [esp], ecx
sub esi, 4
and word [esp], 0x3298
lea edx, [ecx + ecx*4 + 0x19d523b]
mov eax, dword [esi]
jg 0x122e7de
ror byte [esi + 0x23], cl
jecxz 0x13a7a53
fcom qword [0xdbba07f5]
and bl, dl
sbb byte [ecx - 0x74baeb1b], ah
inc ebp
mov edx, dword [esp]
inc ecx
movzx esi, bx
dec esi
lea esp, [esi - 0xce2a]
inc ecx
movsx eax, bx
call fcn.01286a41
movzx esi, cl
xor ebp, edi
jmp 0x138b97d
inc esp
cmp ch, ch
and dword [edi + 0x48], esp
inc cx
xchg ecx, eax
dec ecx
inc edx
inc ebp
movsx eax, bx
ror ebp, 1
inc ecx
movsx ecx, cx
call fcn.0122fa26
mov ebp, 0xe6a97ea3
dec ecx
mov esi, dword [esi]
dec ecx
add esi, 8
dec eax
lea ebx, [ebp + ebp + 0x4929461f]
inc esp
mov ebx, ebx
dec ebp
lea ecx, [ebx - 0x3c7fa0d2]
push esi
popfd
inc esp
movsx edx, bl
inc ecx
ror edx, 0xd9
inc eax
movzx eax, ch
inc ebx
mov ebp, dword [esp + ebx*2 - 0x2cf886ca]
dec edi
lea esp, [esp + ebx - 0x167c4361]
jae 0x134db67
Function at 0x13acc76
Capabilities:
Encode data using xor

Disassembly:
dec eax
lea edx, [esp + edx + 0x18]
call fcn.01279fe9
sub word [esp + 3], 0x5412
dec ecx
add esp, 4
add bp, 0x29bd
inc esp
xor ebx, edi
inc ecx
pop edx
dec eax
inc ebx
inc ecx
xor ebx, 0xf0042d30
inc ecx
sub ebx, 0x2016e695
inc ecx
rol ebx, 3
inc ecx
neg ebx
inc ecx
sub ebx, 0x63899011
call fcn.017a1f17
add cl, byte [ecx - 0x91f65db]
xchg ebx, eax
jae 0x12378cf
rol dword [eax - 0x2c8c6c0a], cl
adc eax, 0xfffffff6
xchg ebx, eax
jae 0x1237953
mov ebx, 0x7393f6e8
or esi, dword [ebx + 0x20]
not byte [ebx + 0x287b5373]
not byte [ebx + 0x481b2373]
and ebx, dword [ebx]
dec eax
not byte [ebx - 0x67342c8d]
not byte [ebx - 0x1a04948d]
cmp ah, byte [ebp + 0x54c088f3]
invalid
inc ebp
pop fs
jg 0x1237929
mov ecx, 0xff3671b4
invalid
inc eax
xor dl, bh
inc ecx
sar ch, 0xe1
xor dl, 0x3f
dec esi
mov dword [esp + eax - 0x77264c0a], edx
dec dl
not dl
inc dl
inc si
or dword [esp + eax - 0x77264c05], ebp
inc eax
xor bh, dl
jmp 0x12378bd

Function at 0x13b4cfb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg eax
mov dword [esp + ecx - 0x1d605875], 0xf830e037
shl ecx, cl
not eax
setne cl
neg eax
ror dword [esp + ecx - 0xe9ffffe], 0x34
sar byte [esp + ecx - 0xea00001], cl
xor ebx, eax
add edi, eax
sub dword [esp + ecx*4 - 0x3a800003], edx
mov edx, dword [ecx + ebp - 0xea00001]
lea eax, [ecx + ecx*4 + 0x54a53910]
pop ecx
mov ecx, dword [ebp + 4]
not edx
not ecx
add dword [esp], 0xca896782
neg al
or edx, ecx
rol al, 0x61
mov dword [ebp + 4], edx
mov edx, dword [ebp + 4]
mov cl, byte [ebp + 8]
shr edx, cl
movsx ecx, al
mov dword [ebp + 6], edx
lea edx, [ecx*2 + 0x805b3b6]
sal eax, cl
ror cx, 0xaf
lea ebp, [ebp + edx*2 - 0x100b66c2]
call fcn.0178f8a4
Function at 0x17657dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, dl
inc cl
add dword [esp + edx - 0x4e0e748a], edx
xor cl, 0x82
call fcn.01769dd4

Function at 0x17672ea
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
shr word [esp + edx*2 + 0x15], cl
xor dword [esp + edx*2 + 0x20], eax
dec edx
mov edi, dword [esp + edx*2 - 0x6013a]
inc cx
rol ecx, 0x83
inc ecx
mov dword [esi + edx*2 - 0xc], eax
dec esi
lea esi, [edx + esi - 0xc]
dec eax
xor ecx, 0x5e3a8b13
pop ecx
call fcn.0133a106

Function at 0x1767337
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [ebp + ecx*4]
neg eax
mov eax, dword [ebp + ecx + 4]
neg ecx
sub cl, 0xbd
mov cl, byte [ebp + ecx*2 - 0x7e]
mov dword [esp], 0xcf02548c
add ebp, 6
shld edx, eax, cl
push 0xe022d7b8
mov dword [ebp], edx
call fcn.0137dfed

Function at 0x1777895
Capabilities:
Encode data using xor

Disassembly:
dec ebp
or ebx, dword [esi + ebx*2]
inc cx
not edx
inc ecx
rol dl, 0x67
inc ebp
movzx edx, byte [esp + ebx*2 + 4]
inc esp
xor dl, bh
dec eax
lea ebp, [edx + ebx*2 + 0x39cfb9c]
dec esp
lea eax, [edx + esi*4 + 0x28843d3e]
inc esp
sub dl, dh
dec eax
mov dword [esp + ebx + 8], edx
inc ecx
neg dl
inc esp
movzx ecx, ch
inc ecx
not dl
dec eax
xadd ebp, eax
dec ecx
cmovne ebx, ecx
dec eax
and ebx, eax
inc ecx
xor dl, 0x29
sub byte [esp + ebx*2 - 0x127], bh
and eax, 0x7a30a11d
inc ecx
rol al, 0x44
inc ecx
xor bh, dl
dec eax
mov dword [esp + ebx*8 - 0x4e8], edx
rol eax, 0x3b
dec esi
lea edx, [esp + edx + 0x20]
pop ebx
shr dl, 0x24
dec esi
mov dword [esi + edx - 1], ebx
xchg word [esp + esi + 1], bp
inc esp
adc cl, dl
dec esi
lea ebp, [ecx*4 + 0x73182e8d]
inc ebp
mov ebx, dword [esp + esi + 4]
dec esi
lea ebp, [eax*4 - 0x54e0abcb]
shl bl, 0xa3
inc ecx
push ebp
dec ebp
lea esp, [esp + esi + 8]
inc esp
xor ebx, edi
inc ecx
dec eax
inc ecx
sal eax, 0x1e
fild word [ecx - 1]
enter 0xffffffffffffc141, 0xfffffffffffffff0
push ds
dec eax
lea ecx, [ebx + eax*2 + 0x728ff09d]
inc ecx
neg ebx
xor byte [esp + esi + 8], dl
dec edx
lea edx, [ebp*4 + 0xf3abc13]
pop eax
inc ecx
sbb ebx, 0xe913c71b
call fcn.0139f456
or byte [edi], dl
outsd dx, dword [esi]
push ebp
pushal
dec eax
or al, 0x5e
mov edi, 0x1400000b
dec esi
mov edi, 0x3450000b
jb 0x1777930
or eax, dword [eax]
sub al, 0x64
inc edx
mov edi, 0x101c000b
mov edi, 0xc28000b
xchg ecx, eax
invalid

Function at 0x177ae78
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
ror dword [esp], cl
mov eax, dword [ebp + 4]
call fcn.017a1d98
or dword [esp + 2], edx
mov edx, dword [ebp]
pop ecx
jle 0x135ffe7
invalid
inc ecx
movsx edx, bl
inc ecx
mov dword [esi + esi*4 - 0x229f9c14], eax
call fcn.01284ec2
jmp 0x13a57b7