joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe79f7c
Capabilities:
Authenticate hmac

Disassembly:
dec eax
push edx
xor eax, 0xb4033980
add edx, edx
add ecx, ecx
inc eax
xchg edx, ecx
dec dx
ror eax, 3
shl dl, 0xa4
dec ecx
xor eax, 0x8196c43d
rol edx, 0x91
xor ebx, eax
sal edx, 0x8d
sar cl, 0x24
shr dword [esp + edx*2 - 0x3e59fffc], cl
add esi, eax
xchg byte [esp + edx*2 - 0x3e59fffb], dh
rol dl, 0x24
push edx
or dl, byte [edi + edx*2 - 0x3e5a0000]
bt cx, 0x26
mov cl, byte [edi + 2]
call fcn.0058a569
std
cwde
aam 0xac
das
push cs
cmp byte [edx], bh
pop ds
or dword [edi - 0x80], ecx
dec esi
add dh, dl
push ss
jle 0xdf02f2
mov eax, dword [0x3f63ebb5]
and ebx, ebx
dec eax
cdq
mov ch, byte [ebp - 0x2f]
bts dword [edx - 0x5a], 0x9e
cmpsd dword [esi], dword es:[edi]
aad 0x36
or byte [edi - 0x394dbe2e], dl
fcmovnu st(0), st(0)
and al, 0xf6
fsubr qword [edi + 0x31b86387]
adc dword [ebx - 0x41], edx
inc esi
stosd dword es:[edi], eax
add dh, byte [esi - 0x4ecdc221]
test al, 0xc8
aas
mov ecx, 0xbe0f5e25
push edx
in al, 0x5e
mov bh, 0xcb
jb 0xdf0398
mov al, 0xbc
sar ebx, 1
aam 0x22
inc edi
retf
dec eax
outsb dx, byte [esi]
outsb dx, byte [esi]
in eax, dx
ficomp word [esi + 0x69]
lcall 0xfbeb, 0x40dcb7d
or dh, byte [ebx + 0x51]
stosb byte es:[edi], al
add ebp, edx
invalid
sal byte [edi - 0x19858544], 0xb5
jecxz 0xdf0375
salc
mov dl, 0x94
dec edi
inc ebx
salc
or bl, cl
jae 0xdf0364
jge 0xdf03f8
and bl, al
in al, 0xf5
cmc
adc bl, bh
xchg ebx, eax
add byte [edi], bl
xlatb
push ds
xchg esi, eax
das
shr byte [ecx + 0x2c], 1
jle 0xdf0380
invalid
lahf
sti
mov dh, 0xd0
push cs
out 9, al
inc eax
cwde
salc
push cs
aaa
and al, byte [edi - 0x484b51f9]
add cl, bl
pop ss
and ah, byte [edi + eax*2 - 0x7f]
adc ah, byte [ebx + 0x30]
cmp eax, dword [ebx + 0x6a]
test eax, 0xde6d73ad
pop eax
jle 0xdf0484
push ebx
into
dec esi
bound esp, qword [esp + esi*2]
pop ds
imul edi, dword [ebp - 0x3593d01e], 0x41
mov edx, 0x8ad75408
mov dr5, ebp
fild dword [esi]
mov edx, 0xcd01ebfb
push 0xfffffffffffffff6
mov esi, 0xb9c6fc5d
sub al, byte [esi - 0x69]
mov al, 0xb3
shl byte [edi + 0x3273c4b7], 1
rcr dword [edx - 0x1b], cl
add dl, ah
sub eax, 0xb4dd535f
leave
arpl dx, bx
ret
ljmp 0x6e97:0x7c9569a7
mov dword [esp], 0x583d070a
mov ecx, dword [esp]
xor eax, ebx
sub eax, 0xac83999e
lea ecx, [edx*2 - 0xe5117cd]
rol eax, 3
xor cl, dl
lea edx, [edx*8 - 0x76e1067e]
bswap eax
ror eax, 1
inc eax
lea ecx, [edx*2 + 0x41aea883]
rol eax, 1
inc word [esp + ecx - 0x3e5a23b5]
sal edx, cl
jp 0xdf0288
Function at 0xe84c8f
Capabilities:
Encode data using xor

Disassembly:
sub edi, edi
jle 0xe5c349
shr edx, 0xc6
sbb ecx, 0xf09ef5b0
neg ecx
not ecx
btr ax, dx
bswap ecx
btr eax, eax
cdq
bt eax, eax
xor ecx, 0x34918027
btc eax, 8
rol edx, 0x2c
sub edx, 0xcf83a539
xor ebx, ecx
call fcn.004d4965
mov eax, 0x5206e7a6
inc esp
mov esp, eax
dec ecx
mov esp, ebx
inc ecx
pop ebx
movzx esi, ax
mov edx, 0xa8b98936
dec ebp
lea eax, [esp + edx*8 - 0x77fc1549]
pop eax
inc ebp
movzx edi, ax
mov ebp, esi
pop esi
popfd
inc esp
mov edx, edx
call fcn.004789f5
xadd cl, dl
neg cx
xor eax, 0xc1b6cdb1
not edx
sal edx, cl
neg eax
bswap eax
xor ebx, eax
and dx, dx
bt ecx, 0xb2
shr ecx, 0x74
adc ebp, eax
btr dx, 0x97
sar dl, 0xe3
mov eax, ecx
mov ecx, esi
mul edx
lea esi, [esi + edx - 0x49]
mov word [esi + edx - 0x47], cx
movsx ecx, dx
inc eax
sets al
jb fcn.00ec7009
ret
adc esi, edx
xor ax, ax
mov edx, edi
sbb ecx, dword [esp + eax - 0x3dad0000]
lea edi, [edi + eax - 0x3dad0004]
mov dword [eax + edi - 0x3dad0000], edx
pop edx
jge fcn.00dc9a26
mov ecx, 0x34a99e06
lea ebp, [ebp + ecx*2 - 0x69533c10]
movzx eax, cl
dec al
mul eax
mov ecx, dword [ecx + ebp - 0x34a99e06]
neg ax
xor ecx, ebx
xor dl, dl
imul eax, edx
inc ax
rol ecx, 1
lea ecx, [ecx + eax*2 - 0x7131f32a]
shl dx, 4
rol ecx, 3
jmp 0x577ad9
rol word [esp], 0xce
movzx ebx, dx
mov esp, eax
mov ebp, dword [esp + edi*4 + 0x20]
bts edx, 0xe
ror edx, 0x67
not ebp
ror ebp, 1
add di, di
sar edi, 0xe7
or dx, dx
inc ebp
xor edi, 0xae14cca8
sbb di, di
neg edx
neg ebp
lea ebp, [ebp + edi - 0x450fc941]
rol ebp, 2
inc ebp
add ebp, ebx
push edi
mov dword [esp + 0x24], ecx
jmp 0xe34124
xor edx, ebx
not edx
mov dword [esp + eax - 0x3dadb4af], 0xf526dd14
not dword [esp + eax - 0x3dadb4af]
bt cx, ax
ror edx, 2
div byte [esp + eax*2 - 0x7b5b695c]
neg edx
ror dword [esp + eax - 0x3dad22d5], cl
jb 0x4ee6e0
test byte [ecx + edx*2], al
dec ebx
push edx
ret 0xdd14
lea edx, [edx + eax + 0x3d64d945]
shr word [esp + eax - 0x3dad22d5], 0x85
xor ebx, edx
shr dword [esp + eax - 0x3dad22d5], 0x45
jne 0xcd8e21
jle 0xe84c94
aam 0xdf
aad 0xca
lodsb al, byte [esi]
adc dword [ecx + 0x46], 0xffffffee
inc ebx
invalid

Function at 0xe87630
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x4fa94dba
dec ebx
jmp 0xe9db67
jb 0x5c2918
add edi, 4
xor eax, eax
call fcn.005dfe40
mov ebp, 0xfd9b281b
add bp, bp
jae 0x55df62

Function at 0xe8856e
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
lea esp, [esp + 0x1c]
jne 0xd0db30
call fcn.004cc274
Function at 0xe91552
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ebp - 0x8c], ecx
mov dword [esp + ebp - 0x90], edi
lea edi, [ebp*4 + 0x5e09b1b0]
adc edi, edi
push eax
movzx edx, di
mov edx, 0
shl edi, 0x71
shr edi, 0x7f
lea eax, [edi + edi + 0x5d10e614]
mov dword [esp + ebp - 0x90], edx
mov ecx, 0xa0216398
sar eax, 0x7f
mov ebp, dword [esp + ebp*2 - 0x100]
xor edi, 0xa48221a4
sbb eax, edi
inc ebp
and ecx, edi
ror ebp, 1
neg al
cmovs edi, ecx
xor ebp, 0xad136998
call fcn.00d88de1
xchg ecx, eax
or ch, byte [ebx - 0x5301ad24]
cli
mov edx, 0x40297415
lodsd eax, dword cs:[esi]
lea edx, [edi]
sub ecx, dword [edi]
inc ebp
mov ah, 0x94
enter 0x52aa, 0x54
cmc
inc ecx
jge 0xe9158b
cmp dword [edi + 0x3add5b7], edi
iretd

Function at 0xe91fac
Capabilities:
Encode data using base64

Disassembly:
and edi, 0xff
call fcn.00e5e7c8
bswap edx
lea eax, [ecx + 0x371c130a]
sar cx, 0xaa
xor ebx, edx
xchg ch, cl
xor cl, cl
ror ax, 0xec
adc esi, edx
btr ecx, ecx
sbb eax, ecx
xor ecx, 0xadabdebd
jp fcn.005544bb
inc ecx
not esp
inc ecx
shl ebp, 0x72
inc ecx
ror esp, 3
dec esi
mov dword [esp + ebp - 0x50000000], eax
inc esp
xor dword [esp + esi*2 - 0x315e592e], esp
inc ecx
pop eax
cdq
push edx
call fcn.00da8468
lea esp, [esp + 4]
call eax
mov edx, 0x7304591f
mov ebp, dword [ebp + edx - 0x73045923]
jmp 0x61788f
dec edx
movsx esi, dl
mov dword [ebp + esi - 0x1e], eax
movsx edi, dl
jns 0x5c594a
mov dword [esp], 0x92e081a
jmp 0x550c84

Function at 0xea3613
Capabilities:
Authenticate hmac

Disassembly:
test ebx, ebx
call fcn.005d9ac7
inc ecx
mov edi, 0xfaf45b1
dec ecx
rol edi, 0xfc
inc ecx
mov esi, dword [ecx]
dec ecx
adc ecx, 3
inc ecx
mov esi, 0x553e5d86
mov eax, 0x929c74ba
inc ecx
xor esi, eax
movzx ebx, ax
bswap esi
inc ecx
movzx ebp, di
inc esp
movsx edx, bl
neg esi
inc ebp
movsx esp, di
dec eax
cdq
dec eax
cdq
rol esi, 1
shl edx, 0xd7
bswap ebx
div al
xor esi, 0xfb0d5c97
dec eax
cwde
inc esi
dec esi
lea ebp, [0x3e24c836]
dec esi
lea esp, [0x1a1c9d1e]
bswap esi
sub eax, eax
inc ecx
sar bh, 0x26
inc bx
not esi
inc ebp
adc dl, ch
inc ecx
push eax
inc ebp
movzx eax, dx
dec eax
cdq
inc edx
xor dword [esp + esi - 0x553e5d86], esi
inc esp
add ah, al
inc ecx
pop eax
dec ecx
not esi
dec ecx
shr ebp, 0x78
dec eax
arpl si, si
dec eax
adc edi, esi
dec eax
xor ebp, edx
dec eax
lea ecx, [ebp*2 + 0x4b2a3f93]
dec ecx
sbb ebp, esp
dec ebx
mov esi, dword [ebx + esi + 0x553e5d87]
or dx, ax
rol ebp, 0x45
dec edx
or edx, dword [esi + esi + 0x553e5d87]
dec eax
dec ebp
dec esi
lea esi, [ebx + ebp*4 - 0x4f56d56d]
inc cx
sal edx, cl
dec ebx
mov dword [esi + ebx - 0x6b1d2a94], edx
movsx esi, cx
dec eax
add eax, edi
jmp eax
not dword [esp + 8]
jno 0x481210

Function at 0xeacad6
Capabilities:
Encode data using base64

Disassembly:
or cl, 0x23
mov cx, word [esi + edx*2 - 0x12c02]
lea esi, [esi + edx*4 - 0x25806]
bts edx, edx
mov word ss:[eax + edx*2 - 0x12c16], cx
lea eax, [edx + edx + 0x1a245815]
jmp ebp
xor ebx, eax
pop ecx
add ebp, eax
mov ecx, edx
lea eax, [edx + edx - 0x2bc37a5d]
btc eax, ecx
mov eax, dword [esi + edx*2 - 0x12c06]
btc ecx, ecx
jae 0xda35ed
Function at 0xebdf02
Capabilities:
Encode data using xor

Disassembly:
inc esp
movzx esp, dx
neg si
inc cx
sub esi, esi
inc ecx
movzx ecx, dh
neg si
mul eax
inc ecx
sar ah, cl
adc si, 0xbbc
sar cl, cl
dec eax
mov dword [esp + edx - 0x315887d9], 0x9318f78a
inc esp
sbb ah, cl
inc sp

Function at 0xebee54
Capabilities:
Encode data using xor

Disassembly:
neg cl
sub ecx, 0x1b8acaad
not edx
xor ecx, ecx
rol cl, 0xe2
xor ebx, edx
add ebp, edx
movsx eax, cl
add al, byte [ecx + esi]
lea edx, [ecx + ecx - 0x1b63d97d]
lea ecx, [ecx + ecx*8 + 0x5686a2bb]
shl ecx, 0xd7
xor cl, byte [esi + ecx - 0x5d7ffffe]
add esi, 2
ror dl, 0xe6
shr al, cl
mov word [esi], ax
jmp 0xd2bc11
mov eax, 0xba9ed519
call fcn.00480cc6
lea ecx, [ecx + ecx*4 + 0x7fb36bac]
sub edx, 0x649a8f37
bswap edx
dec edx
jmp 0x4e4eed
dec dl
jmp ebp
mov dword [ebp - 4], eax
mov dword [esp], 0xb132272d
push 0x282d8eb1
test ebx, ebx
lea esp, [esp + 0xc]
je 0x5d1933
mov eax, 0xc2be1e0c
or eax, 0x7998f297
mov eax, dword [ebp + ebx*4]
push 0x7a93ab01
mov dword [esp], eax
jp 0x58e6c1

Function at 0xec622c
Capabilities:
Inspect section memory permissions

Disassembly:
push es
add bl, ch
mov bl, 0x12
les ebp, [edi + esi*4]
jg 0xd9300b
inc ecx
push edi
dec esi
mov ebp, dword [esp + edi - 0x1bdd]
call fcn.00ea14da
js 0xec61e4
cdq
sbb al, 0x47
in al, 0x53
and esi, dword [edi - 0x2bab82fc]
bound esp, qword [edx]
xchg ebx, eax
lodsb al, byte [esi]
iretd

Function at 0xec638f
Capabilities:
Inspect section memory permissions

Disassembly:
sar ecx, 0xfa
neg eax
mov dword [esp + ecx - 4], 0xac1f75a6
bt ecx, edx
setae dl
adc eax, 0xddb45c0c
shl cx, 0x21
imul dx, dx
xor ebx, eax
rol ecx, cl
not dl
jb 0x5040f4
adc esi, eax
lea eax, [edx*8 + 0x50326a8c]
mov dword [esp + ecx*4 - 0x2000], esi
ret
Function at 0xed0538
Capabilities:
Encode data using xor

Disassembly:
ret 0xc
pop ebp
jmp 0x432afb
dec edi
lea ebx, [ebx + ebp*2 - 0x61e]
inc esp
xchg ebx, edx
dec ebp
adc edi, edi
inc esp
movsx esp, dh
push ebp
popfd
call fcn.00e2a981
mov eax, 0x2bad339a
push eax
mov eax, dword [ebp + ebx*4]
call fcn.00d0535e
and dword [esp + eax - 0xff9b], edx
rol ecx, 3
push edx
add eax, 0xc7ad4625
bswap ecx
cwde
shl word [esp + edx], 0x22
cdq
ror ecx, 1
xchg word [esp + edx*4 + 1], dx
mul dl
xor ebx, ecx
or eax, 0x2d1d999d
rol edx, 0x6b
adc esi, ecx
call fcn.00d3409c
je 0xce5a90
mov dword [edi + 0x18], ecx
mov edx, dword [ebp + 0x10]
jmp 0xe20f03
add esi, 0x3fa94c30
bt edi, 1
mov dword [ebp + esi*2 - 0x2cc51364], eax
pop ebx
jae 0xe1d6e1
mov esi, 0xf932fd3d
inc ecx
mov eax, dword [ecx]
mov ebp, esi
dec eax
lea ecx, [ebp + ebp*2 + 0x241cc8b2]
inc esp
movsx edx, cx
dec ecx
add ecx, 4
neg ebp
inc ecx
xor eax, eax
dec esp
lea edx, [ecx*4 + 0x2e8ce881]
inc ebp
or dl, dl
bswap eax
not eax
neg eax
dec esp
lea esi, [esi*8 - 0x2b72b9f6]
inc cx
not edx
movsx ebx, cx
dec eax
inc esp
mov ebp, ecx
dec eax
sar ebp, 0x31
inc ecx
sar esi, cl
bswap eax
inc ecx
sar ebp, 0xb2
inc ecx
push eax
dec eax
lea edx, [ebp*4 + 0x19378c99]
dec edi
lea eax, [esi + edx*4 - 0x3bc93b53]
xor dword [esp + ebp*8], eax
inc ecx
neg ch
adc dl, dl
inc ebp
btr edx, ebp
inc ecx
pop eax
dec eax
arpl ax, ax
ror si, cl
dec eax
add edi, eax
dec esi
lea edi, [edx*8 - 0x1ae4c9e3]
dec ecx
add ebx, edi
dec ecx
adc ebp, dword [ebx + ebp]
inc esp
or dl, cl
ja 0x4ddc4d
call dword [fcn.0045008c]
mov eax, dword [ebp + 0xc]
cmovl ebx, ebp
pop esi
mov bl, 1
not ebp
movzx ebp, ax
pop ebx
jmp 0x4395a6
pop esi
pop edi
mov edx, dword [edi]
mov ecx, 0x921f80be
lea eax, [ecx + 0x3e04f226]
btr ax, 0x2a
adc edi, 4
bswap eax
or ecx, ecx
inc ax
xor edx, ebx
rol edx, 1
bswap edx
lea edx, [eax + edx - 0x7133513c]
shl al, 0xc4
je 0xe923f8
sbb eax, ecx
xor edx, 0x3f3fef21
xor ebx, edx
imul ax, cx
xor ecx, ecx
adc esi, edx
or ecx, 0xb0a63b02
cwde
not cx
jmp esi
push edx
jmp 0xdf11fc
neg al
xor ebx, edx
add esi, edx
mov dword [esp + eax*8 - 0x60d40000], esi
ret
lea esp, [esp + 8]
jne 0xce5a45
mov eax, dword [ebp]
call eax
mov esi, 0xd6b93d82
mov edi, 0x982be099
mov edx, esi
mov ebp, dword [ebp - 4]
jmp 0xd7c817
Function at 0xedd2e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, 0x28021c08
call fcn.0118433a
mov ecx, 0xbd944db8
movsx eax, cx
movzx edx, byte [ebp + eax*8 - 0x26dc0]
lea ebp, [ebp + eax*8 - 0x26dbf]
jmp 0xf498fb
dec eax
xor dl, bl
sub dl, 0x85
bts cx, cx
bt ecx, ecx
lea eax, [ecx + ecx*2 + 0x4fa4533f]
xor dl, 0x8f
btc ax, 0x89
sbb ax, ax
not dl
jns 0xfa568e
bswap eax
xor bl, dl
shl cl, 0x63
xor ax, 0xb489
sar ax, 0xac
adc edx, esp
cbw
sal eax, 3
movzx ax, byte [edx + eax*2 - 0xfffb0]
mov edx, 0x6cb490a1
bt ecx, 0xbc
lea edi, [edi + edx - 0x6cb490a3]
call fcn.01046a54
mov eax, 0x1c0b5628
push eax
movsx ecx, word [esp + eax*2 - 0x3816ac50]
mov edx, dword [eax + ebp - 0x1c0b5628]
not eax
sub ecx, dword [esp + ecx - 0x5628]
sar eax, 0x5f
mov eax, dword [ebp + 4]
not ecx
lea ebp, [ebp + ecx - 0x1c0afff7]
push ecx
mov dword ss:[edx + ecx - 0x1c0affff], eax
neg cx
jno 0x120622e
movzx edx, word [ebp]
mov ecx, 0x5c8cdc0e
lea eax, [ecx + ecx*4 + 0x2eb3cc97]
lea ebp, [ebp + ecx - 0x5c8cdc0c]
xor dx, bx
div al
lea eax, [eax + ecx + 0x27228bb3]
add dx, 0xadb6
btc ax, 0x83
or ecx, ecx
rol dx, 1
inc dx
rol eax, 0x63
push ecx
rol dx, 1
btc ecx, ecx
inc dx
xor bx, dx
lea esi, [esi + eax*2 - 0x12418d5a]
sub ecx, 0x5525b283
bt eax, eax
dec word [esp + ecx*2 - 0xecdd315]
mov word [ecx + esi - 0x766e98b], dx
jno 0x1279a60
neg cl
sal eax, cl
xor dl, 0x28
jmp 0x121211e
adc cx, word [esp + ecx*4 - 0x7027ffff]
mov eax, dword [edi + ecx - 0x1c0a0b58]
lea edi, [edi + ecx*4 - 0x70282d5c]
btr ecx, ecx
xor eax, ebx
pop ecx
movzx edx, cl
xor eax, 0x17191206
ror eax, 2
sal dx, 0x8a
inc dword [esp + ecx*4 - 0x702bfffc]
not eax
call fcn.0103ebaa
add dl, 0x27
cwde
jmp 0xf828de
movzx edx, cl
mov ecx, dword [ebp + ecx*2 - 0xecdd316]
ror eax, 5
cdq
push eax
lea ebp, [ebp + edx + 4]
sar ax, 0x42
push edx
adc al, 0xa2
xor ecx, ebx
cdq
sar al, 0xa5
bswap ecx
neg ecx
not eax
dec ecx
and dword [esp + edx*2 + 8], edx
rol ecx, 2
shr eax, 0x4e
xor ebx, ecx
neg dl
setne dl
neg byte [esp + eax*2 - 0x4fdb6]
adc edi, ecx
lea edx, [edx + 0x73b93723]
xchg dword [esp + eax - 0x27ed3], edx
pop eax
pop ecx
pop eax
jmp fcn.0109aa5b

Function at 0xee0c55
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
jmp 0x122982d
Function at 0xee27cb
Capabilities:
Encode data using base64

Disassembly:
dec edx
neg edx
call fcn.010956c2
mov word [edi], ax
sub ebp, 4
mov edx, dword [ebp]
mov ecx, 0x29b6462b
xor edx, ebx
xor edx, 0xc2a5e708
bt ecx, ecx
btc cx, cx
inc edx
sar cx, 0x48
jns 0x12233d2
mov edx, dword [edi]
mov eax, dword ss:[edx]
mov edx, 0xb715f9a2
mov dword [edi], eax
mov eax, dword [ebp]
inc dl
add ebp, 4
dec dl
mov ecx, 0x62bf558c
push edx
xor eax, ebx
call fcn.00ef646c
call fcn.011a6ab8
inc esp
movzx ebp, dx
jmp 0x11ae3a7
xor edx, ebx
shr ax, 0xc3
neg edx
sal eax, 0x23
neg ax
sbb eax, dword [esp]
ror edx, 2
not eax
neg edx
push eax
xor edx, 0x1a99d2bf
imul eax, eax
pop eax
sar eax, 0xc
sbb edx, 0xcea0aa04
sar word [esp + eax - 0x5a0d4], 7
jp 0x113c3ef
mov eax, 0x13aa42bc
lea edx, [eax + 0x2e1df0ad]
mov edx, dword [ebp + eax*2 - 0x27548578]
or eax, eax
xor edx, ebx
lea ecx, [eax*8 + 0x173b3120]
sar eax, 0x11
rol al, 5
ror edx, 3
shr cx, 0x61
shr ecx, 0x1f
lea eax, [eax*8 + 0x26a2c318]
neg edx
jmp fcn.00fcc6e8
xor cl, byte [esi + 8]
jmp 0x1226949
inc ecx
xor esi, 0x4b385e11
jmp 0x1124adb
call fcn.00f089fd
xor ebx, eax
add ebp, eax
not dword [esp]
pop edx
mov edx, dword [edx + esi - 0x173ff00]
mov eax, dword [esi + 4]
xor cl, ch
jge 0xfb205e
cmpsd dword [esi], dword es:[edi]
mov ecx, 0x8a47e7c6
in al, 0xbb
add dword [eax], edx
fsubr st(7)
fisub word [ebx]
nop
ret 0x861b
xor ebx, edx
or al, 0x86
sub ax, 0xf9d
not eax
adc esi, edx
lea edx, [edx + eax - 0x2e59185]
xor edx, 0x18af6d38
ror dword [esp + eax - 0x1e000099], cl
jae 0x1090312
xor ebx, edx
jmp 0x11c2340
inc ecx
bswap esi
jmp 0x102dd90
xor al, al
cwde
adc edi, edx
xor cx, 0xcb0f
mov dword [esp + eax*8], edi
ret 4
push 0xdc235f9c
add esi, 6
push 0xc882f996
shrd edx, eax, cl
sub byte [esp + 6], 0x9d
jle 0xf92d1a
mov ecx, dword [esp + 4]
mov dword [esi], edx
pop eax
pop edx
jmp ebp
Function at 0xf1e436
Capabilities:
Manually build aes constants

Disassembly:
dec eax
ror eax, 1
ror ecx, 0xc1
call fcn.0106512a
mov eax, 0x3d0a239d
movsx ecx, ax
call fcn.00f9dbf8
pop ecx
xor eax, 0xf48ffeb5
lea ecx, [edx + 0x71ab0792]
btr edx, ecx
neg eax
imul cx, dx
sbb ecx, edx
xor edx, 0x1aa3eca9
sbb eax, 0x3b267190
xor edx, edx
add cx, cx
btr ecx, ecx
neg eax
sub eax, 0xf4a3dc25
shr edx, 0x1b
xor eax, 0xf1b82915
sar edx, 0x4f
cmovb edx, ecx
bt edx, 3
inc eax
and cl, 0x84
push ecx
xor ebx, eax
jmp 0x1030108
xor edx, 0xde21a13d
lea edx, [edx + ecx - 0x137e8f1]
or byte [esp + ecx*2 - 0xf4ed0], 0x33
dec eax
xadd word [esp + ecx - 0x7a766], cx
neg edx
ror cx, cl
jb 0x113b9e8
xor ebx, edx
sal ecx, 0xa3
adc esi, edx
not eax
mov eax, dword [edi + ecx - 0x387000]
movsx edx, cx
bt cx, 0xb1
jae 0xf82b48
mov ecx, 0xa9946706
movzx eax, cl
mov ecx, dword [ebp + eax*4 - 0x18]
call fcn.011238ef
mov cx, word [ecx + edi - 0x386ffc]
add dword [esp + edx*4 - 0x1c000], 0xecbdd9a7
lea edi, [edi + edx*4 - 0x1bffa]
sub dl, dh
lea edx, [edx*4 + 0x3492842e]
mov word [eax + edx - 0x3494466e], cx
mov dword [esp + edx - 0x3494466e], esi
ret
adc dl, dl
lea ebp, [ebp + edx - 0x6c210f12]
sub dx, dx
adc dword [esp + edx - 0x6c210000], edx
xadd word [esp + edx - 0x6c20fffe], dx
mov dword [edx + ecx - 0x6c2102c1], eax
mov dword [esp + edx - 0x6c2102c1], esi
ret
jmp 0x10a7c90
add esi, eax
inc ecx
add dl, byte [edx + ebp]
xchg byte [esp + ecx - 0x71ab9403], ch
sar cx, 0x82
movsx eax, cx
lea ebp, [ebp + ecx - 0x71abeac0]
shl ecx, cl
xor dl, bl
sub ecx, 0xbfa595a0
neg dl
neg ax
jge 0xf580cf
push 0x3aba4380
mov edx, dword [ebp]
add ebp, 4
mov eax, 0xf9b25d03
not byte [esp + 3]
xor edx, ebx
mov ecx, dword [esp]
neg edx
call fcn.010a1a15
mov eax, 0x1a89393b
setb al
mov dword [esi + eax - 0x1a8938f9], ebx
mov dword [esp + eax*4 - 0x6a24e400], eax
mov dword [esi + eax*4 - 0x6a24e400], ecx
mov dword [esi + eax - 0x1a893901], edx
push eax
sar ax, 0x45
lea ecx, [eax*4 + 0x5da221b3]
mov ebx, dword [esp + eax*2 - 0x35120384]
jbe 0xf56d59
lea ebp, [ebp + eax*2 - 0x35120394]
sbb ecx, ecx
mov eax, dword [ebp + eax - 0x1a8901c8]
add ecx, ecx
xor eax, ebx
jmp 0xeea546
jge 0x100a962

Function at 0xf352b9
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
xor eax, 0x180ff829
push 0x24922510
neg eax
sar word [esp + 1], 0xe9
bswap eax
mov dword [esp + 0x18], 0xe0b93e9a
jnp 0x11fa77e
jae 0x1185014
mov eax, 0x699585b0
mov ecx, eax
mov edx, dword [eax + ebp - 0x699585b0]
lea ebp, [ecx + ebp - 0x699585ac]
neg ecx
xor edx, ebx
dec cl
bswap edx
rol edx, 2
call fcn.00f37400
xor ebx, eax
not cl
inc ecx
add ebp, eax
movsx eax, dl
sub cx, cx
push ecx
xor ecx, dword [esi + ecx]
xadd edx, eax
ror dl, 0xe3
xchg dword [esp], edx
xor dx, word [edx + ecx]
push eax
dec ax
movzx ecx, word [esp + 2]
lea esi, [esi + ecx*4 - 0x28112]
mov word [ecx + esi - 0xa045], dx
jo 0x1004935
mov dword [esp + ecx*2 - 0x1408a], ebp
ret 4

Function at 0xf77dee
Capabilities:
Encode data using base64

Disassembly:
jmp 0x11720cb
test ebx, ebx
lea esp, [esp + 0xc]
je 0xff6fa1
Function at 0xfc11f9
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esi + 4]
mov dword [esp], 0x68b1b5b1
adc esi, 3
jmp 0x10a5dec
test eax, eax
push 0xad333283
lea esp, [esp + 8]
je 0x121be92
call fcn.011b99fc
pop es
rcl byte [edx - 0x11], 0xeb
nop
mov al, byte [0xc2b9bdaf]
sbb al, 0xb6
scasb al, byte es:[edi]
mov dh, byte [esi + edi*4 + 0x40dadade]
xchg esp, eax
mov esp, 0x1b460b0e
mov bl, 0xbb
xchg ebx, eax
push 0x44899b2
or byte [edx + 0x5ba6a29b], bl
adc al, cl
mov byte [0x88425ff5], al
inc eax
xor ecx, dword [edi]
add eax, 0x5e16451a
jecxz 0x105e32a
sahf
pushal
dec ebp
imul esi, dword [ecx + esi*8 - 0x29], 0xaf02c9a1
sub ah, byte [eax + 0x7f]
add dword [ebp + 0x4c2f1321], 0x30f27ab6
daa
adc ebp, dword [ecx]
ja 0x105e370
inc esp
std
add ebx, ebp
add dword [0x6ca17a7c], esi
in al, 0xd5
pop ss
adc al, 0xcb
in al, dx
imul edx, ebp, 0xffffffcd
mov byte [0x4de790af], al
int 0xa2
scasd eax, dword es:[edi]
nop
out 0x4d, eax
shr ebp, 1
aad 0x8f
mov ah, cl
pop es
inc ebp
retf
rol dword [esp], 0x91
setb byte [esp]
xor ecx, ecx
jmp 0x105e2f1

Function at 0x1001866
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + ebp - 0x48a7a406], ebx
inc cx
sbb edx, edx
dec edi
lea ebx, [ebx + 2]
inc esi
xchg dword [esp + 8], edx
inc ecx
not esp
inc cx
xor ecx, esp
inc esp
movzx edi, si
inc dx
inc cx
xor ebp, esp
call fcn.0101f072
mov ecx, 0x81b1493e
movsx eax, cx
lea ebp, [ebp + eax*2 - 0x9280]
jmp 0x12888e6

Function at 0x1011d03
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [edi + edx - 0x6d28b51c]
mov eax, edx
lea edi, [edi + eax - 0x6d28b518]
pop eax
imul dx, dx
lea eax, [edx*4 + 0x5127ba1e]
xor ecx, ebx
lea edx, [eax - 0x7be15b74]
cdq
lea ecx, [ecx + edx - 0x2fad988d]
dec eax
shl ax, 0x42
xor eax, edx
neg ecx
bts dx, ax
jb 0x1111214
inc ecx
lea eax, [eax*8 + 0x76267409]
cdq
cwd
bswap ecx
rol ecx, 1
xor ebx, ecx
call fcn.011cdce0
Function at 0x106a97d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [esp + 8], 0x90332c34
mov edx, 0x383aa936
xor ecx, ebx
mov eax, edx
inc ecx
shr edx, 0xd2
bts edx, 0xb4
not ecx
idiv eax
imul dx, dx
ror ecx, 2
mov dword [esp + edx - 0x31124000], eax
into
cdq
inc ecx
xor ecx, 0x2e8c3e9e
and dword [esp + edx*2 + 3], 0xb39b69a6
call fcn.010d4866
in eax, 0xd0
mov esi, 0xbe0818c3
inc byte [ecx]
sub edi, dword [ecx]
pop ebp
salc
cld
lcall 0x6a71, 0x32015e7c
pop ds
add dword [ebx - 0x56], esp
jb 0x106a98a
fdivp st(6)
cmc
ja 0x106a9a7
mov al, 0xfe
fst st(4)
pushfd
pop es
add dword [esi], ebp
popf
leave
invalid

Function at 0x1086542
Capabilities:
Encode data using xor

Disassembly:
jmp 0x108a8f9
xor eax, 0xa3abce0e
mov dword [esp], 0x1aa3a225
push 0x5a28db9e
shl word [esp + 5], 0x22
dec edx
call fcn.00fb072f
pop edx
xor ch, byte [ebx + 0x70dcaec6]
aam 0x5e
mov esi, 0x121b60e5
xor byte [ecx + 0x7a], bl
add eax, 0x28326a21
in al, 0xb7
or dh, byte [edx - 0x79cba1d2]
and dword [edx + 0x32], ebp
sub ah, ah
mov bh, 0xa
mov dl, 0x2e
pop esi
xor al, 0x86
mov ebp, 0x1c831b57
das
test dword [ecx - 0x70edb81e], esp
jb 0x108a929
mov bl, 0x48
pop esi
add ebp, dword [ecx]
fcmove st(0), st(3)
cld
aam 0xef
or byte cs:[edi], 0x94
invalid

Function at 0x108f166
Capabilities:
Encode data using base64

Disassembly:
mov ebp, 0xd02a7632
dec eax
mov dword [esp], ebp
dec ecx
mov esi, dword [ebx]
inc ebp
mov esp, dword [ebx + 8]
jmp 0x11e9b05

Function at 0x10be07d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor edx, ebx
sub edx, 0xac83999e
rol edx, 3
mov dword [esp], eax
push eax
add ax, cx
bswap edx
xchg dword [esp + 3], ecx
ror edx, 1
inc edx
or word [esp + 2], 0xadab
xchg ecx, eax
neg cx
rol edx, 1
sar dword [esp + 2], cl
dec edx
and eax, eax
or ecx, ecx
jl 0xf655fe