joyce8/EMBER2024-capa huggingface dataset:
Function at 0x780bff
Capabilities:
Encode data using base64

Disassembly:
inc cx
rol esp, 1
inc cx
xor esp, 0xc7487db3
inc esp
and al, 0
and ch, byte [ebp - 0x7a]
ror byte [ecx + 0xf], cl
mov edx, 0x8d4a1cf8
pushfd
pop esi
mov byte [0x66768469], al
inc ecx
adc esp, 0x416693ff
neg esp
cwd
dec eax
neg ebx
xchg byte [esp + 7], cl
inc cx
adc esp, 0xff5b15a5
shl byte [esi + 0x41], 0xf7
aam 0x44
movzx edi, si
inc cx
xor edi, 0xa4018a3
salc
inc cx
xor ebp, esp
inc esp
btr ebx, eax
inc di
mov dword [edi + ecx - 0xb1cc], esp
inc cx
shr edi, 2
dec eax
mul eax
dec eax
shl edx, 0x61
mov esi, dword [edi + edx*2 + 2]
xor esi, ebp
cwd
cwd
dec esp
bts ecx, ebx
ror esi, 2
inc ecx
mov edx, 0xcf149ab0
mul ebx
shr al, 0x81
inc ecx
lea esi, [edi + esi - 0x1a2f1783]
cbw
inc ecx
push edi
ror esi, 1
sar bx, 0xe5
inc ecx
mul edx
neg esi
sar cx, 0x26
inc cx
shr edx, 0xe9
dec esi
inc dx
shl dword [esp + edi - 0x2c71], cl
inc ecx
not edx
dec edx
mov dword [esp + edi*8 - 0x16398], ebp
sbb bl, 0xac
call fcn.0077ea71
mov edx, 0xb516433a
bswap edx
lea ecx, [esp + edx - 0x3a431695]
movsx eax, dx
cbw
mov eax, dword [ecx + edx - 0x3a4316b5]
rol dx, 0xcb
mov edx, eax
mov eax, 0x6a97fd85
mov esi, edx
sar ax, 0x6f
jbe 0xbabf00
mov ecx, 0xbda8a311
movzx dx, byte [edi]
sub ecx, 0x2f8f5dba
mov cl, byte [edi + 2]
mov eax, 0xa526e09f
adc edi, 2
shr ax, 0x29
shr dl, cl
lea ecx, [eax + 0xa149380]
btr ax, cx
add ax, 0xa2bc
mov word [edi], dx
movzx edx, al
lea ebp, [ebp + edx - 0x30]
jnp 0xa90083
mov eax, 0x630c62b3
mov ecx, 0x8e85fb8f
mov edx, edi
jmp 0xacf2ae
jg 0xc0da4f
lea ecx, [ecx - 0x27c6e43]
mov eax, dword [ebp + edx - 0x2c]
xor eax, ebx
xor eax, 0x129168b7
shr dx, 0x2d
btc edx, 0x12
lea eax, [edx + eax + 0x43246827]
neg edx
jne 0xc4a52e
mov ecx, 0x391273b3
mov eax, ecx
movsx edx, cl
mov eax, dword [ebp + ecx*2 - 0x7224e766]
jmp 0xbb2623
xor eax, 0xee1dfc3d
imul dx, cx
neg edx
inc eax
xor ebx, eax
add esi, eax
rol edx, cl
bt dx, 0x8d
jmp esi

Function at 0x789528
Capabilities:
Authenticate hmac

Disassembly:
dec eax
mov ebp, dword [esp + ecx - 0x48b30724]
cbw
inc ecx
mov esp, 0xfe387aae
cdq
dec eax
arpl bx, bx
inc ecx
mov eax, 0x498ccfa4
dec esp
add ebp, ebx
dec eax
ror edx, 0x30
inc ecx
inc ebx
inc ecx
setnp al
inc ebp
mov ecx, dword [ecx + ecx - 0x48b30734]
pop eax
inc ecx
pop esp
pop ebx
ja fcn.0079a4c9

Function at 0x789567
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [ebp]
call fcn.00c6969d
dec eax
dec ecx
dec esp
mov dword [esp + ebx + 0x4b39fe5], ebp
ret
push 0x7f86b007
lea esp, [esp + 0xc]
je 0x7708e0
mov eax, 0x692059bd
push eax
inc ax
mov eax, dword [ebp + ebx*4]
mov dword [esp], eax
jge 0xbfca76
jno 0xcf6c14
mov eax, dword [esi + eax - 0x4e]
xor eax, ebx
neg eax
bswap ecx
dec eax
not eax
shl edx, 0x5b
btr cx, dx
xadd dx, cx
inc eax
xor cx, cx
xor ebx, eax
bts cx, cx
shl ecx, 0x93
sal dl, 0xc4
adc edi, eax
jmp edi
Function at 0x789932
Capabilities:
Execute syscall

Disassembly:
xor ebx, eax
shl dword [esp + 8], 0xb4
jae 0xce2309
mov esp, esi
mov edi, 0x2a88e62e
or edi, edi
pop ebp
shr edi, 0xe5
jne 0xcbfbf8
mov eax, 0x280f4220
mov edx, eax
mov cx, word [edi + eax - 0x280f4220]
mov dx, word [edi + edx - 0x280f421e]
shr ax, 0x65
not cx
not dx
inc ax
sub eax, eax
or cx, dx
mov edx, eax
shr edx, 0x32
sal dl, 0xc1
mov word [eax + edi + 2], cx
sal edx, 0xc3
mov ecx, dword [eax + esi]
setnp al
or dx, ax
and eax, edx
xor ecx, ebx
bswap ecx
btc edx, 0x16
neg ecx
shl eax, 0x2a
cdq
lea eax, [eax*2 - 0x507fefc4]
xor ecx, 0x9a8fae32
or eax, eax
inc ecx
rol dl, 0xc2
xor dx, ax
jne 0xc8b46d
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x70cb0c]
shr eax, 8
xor eax, ebx
mov dword [esp], 0xde15d33e
mov dword [esp + 4], 0x95afa89d
and dword [esp + 8], 0xd71beb9e
inc edx
xor eax, 0x9e88b128
dec ecx
lea esp, [esp + 0xc]
jne 0xc0074e
mov edx, 0x19209a2
push edx
mov ebx, dword [esp + edx*2 - 0x3241340]
lea esp, [esp + 8]

Function at 0x78a1f2
Capabilities:
Authenticate hmac

Disassembly:
not ecx
ror ecx, 2
bswap ecx
neg edx
rol eax, 0xda
jnp 0xc22cf9
mov eax, 0x5a8d0a15
mov eax, dword [ebp + eax - 0x5a8d0a15]
mov edx, 0xfb917c21
btc edx, edx
dec edx
adc ebp, 4
mov ecx, edx
shl dx, 0x89
xor eax, ebx
neg eax
shl dl, 2
bt edx, 0xbf
not eax
dec eax
bswap edx
inc dx
sar ecx, 0x8b
bswap eax
rol ecx, cl
inc ecx
xor ebx, eax
xor edx, ecx
adc esi, eax
movzx eax, cl
mov dx, word [edi + eax]
jmp 0x7b8b48
inc ecx
btr ebx, 0x10
jae 0x7c9a84
jmp 0xc891cb
jmp 0xc80aba
dec esp
mov eax, dword [esi + ecx*2 - 0x120]
jae 0xa97ce2
jmp 0xa8d0b2
mov ecx, 0x58163233
lea edx, [ecx*2 - 0x11595d78]
mov edx, dword [ecx + esi - 0x58163233]
btr ecx, ecx
jae 0xc32b69
dec ecx
mov edx, eax
setb cl
dec esp
lea edx, [esp + ecx + 0x18]
inc ecx
xadd ebx, ecx
dec ebx
mov dword [edx - 0x122], edx
inc cx
sub eax, edi
inc ecx
movsx edx, bh
dec esp
mov dword [esp + edx - 0x4a], ebp
ret
xor ebx, ecx
mul edx
adc edi, ecx
movzx ecx, dl
add cl, byte [esi + edx*4]
call fcn.00cb42e0
inc ecx
mov edx, 0x6d13be16
inc ecx
movzx edx, dl
inc ebp
mov eax, dword [edx + edi - 0x6d13be16]
inc esp
movzx edi, dx
inc ecx
movsx ecx, dl
sar cx, 0xa9
dec ecx
lea edi, [edx + edi - 0x6d13be12]
inc esp
xor eax, ebp
inc ecx
bswap eax
inc edi
lea eax, [eax + edx*2 - 0x367277a8]
inc esp
sub edx, ecx
inc esp
mov ebx, ecx
dec ebx
lea ebx, [ebx + ebx*8 + 0x6532272a]
inc ecx
neg eax
xadd ebx, ecx
inc cx
sal edi, 0xac
inc ecx
sbb dl, dl
inc ecx
xor eax, 0x2c05db90
sub bx, dx
inc ebp
movzx esi, bh
shl cx, 0x42
push ebp
movsx eax, cl
lea esi, [ecx + esi - 0x5816322f]
xor edx, ebx
call fcn.00b62174
mov eax, 0x6c9c40a2
mov ecx, dword [ebp + eax - 0x6c9c40a2]
cwde
lea ebp, [ebp + eax*2 - 0x8140]
mov edx, eax
not ax
neg edx
xor ecx, ebx
retf
rol eax, 0x47
and eax, eax
lea ecx, [ecx + edx - 0x30ddf120]
and eax, 0x79906435
jge 0x741bda

Function at 0x78a7c7
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp], 0x252d1ea1
xor edi, eax
and edi, 0xff
mov edi, dword [edi*4 + 0xc7ce24]
jmp 0xbec7f5
Function at 0x78f4ab
Capabilities:
Encode data using xor

Disassembly:
mul dx
ror cl, 1
mov word [esp + edx - 0x224fffec], dx
lea edx, [eax - 0x5aedc269]
or dl, dl
adc cl, 7
ror cl, 1
cwde
inc word [esp + eax + 0xb]
call fcn.00c4ca1b
inc ecx
mov ebx, 0x5d1cdc26
dec edx
lea edx, [ebx*4 - 0x71e2d767]
dec ecx
bt ebx, edx
inc ebp
mov edx, dword [ebx + edi - 0x5d1cdc26]
jae 0x71a152
add edi, ecx
cwde
jmp 0x79de17

Function at 0x7a1414
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, 0x3a39ed0f
shr bl, 0x25
movzx ebx, byte [eax + ebx*2 - 0x7473da00]
push 0x7010a126
sar dword [esp], 0x11
inc word [esp + 2]
xor ebx, ecx
push 0xab8d591e
shl word [esp + 5], 0x85
sar dword [esp + 4], 0x3a
and ebx, 0xff
jmp 0xc8b20a
bts eax, eax
lea edx, [esp + edx + 0xc]
xadd ecx, eax
lea ecx, [eax*8 + 0x6ca63bbd]
mov ax, word [edx + eax - 0x2fbe0800]
movzx edx, cx
lea ebp, [ebp + edx*4 - 0x1eef6]
adc cl, 0x3a
add dl, 0xa
mov word [ebp + edx*2 - 0xf78e], ax
jo 0xc5d6f5
movzx eax, cl
mov dword [esp + edx*2 - 0xf78a], ecx
mov ecx, dword [esi + edx*4 - 0x1ef1c]
or eax, dword [esp + edx*2 - 0xf78a]
sub al, al
mov dword [esp + edx - 0x7bbf], eax
lea esi, [edx + esi - 0x7bc3]
xor ecx, ebx
dec ax
or ax, 0x4fb3
shr edx, 0xc7
rol ecx, 2
lea edx, [eax*2 + 0x52b0298]
mul dword [esp + 8]
lea eax, [eax + edx*2 - 0x16dc45c2]
dec ecx
cbw
and dl, byte [esp + 7]
push edx
neg ecx
sal ax, 0x6c
neg dx
inc ecx
sub byte [esp], 0xb0
sar edx, 0x86
xor ebx, ecx
sar byte [esp + 2], 0x85
mov dword [esp + 4], 0x3346db6
add edi, ecx
sal dword [esp + 3], 0xb5
seta dl
pop edx
pop edx
pop edx
pop edx
jne fcn.00aabce2
mov byte [esp + 4], 0x91
push 0x8fb6ea84
lea esp, [esp + 0x1c]
jne 0x7768a1
mov ebx, 0x4089e7a1
movzx eax, bl
call fcn.00a85e12
inc edx
neg ecx
xchg ah, cl
adc ecx, 0xa0bd3797
xor edx, 0x470e4a31
inc byte [esp + eax*2 - 0x116c3c96]
push eax
sub al, 0x93
xor ebx, edx
mov dword [esp + eax - 0x8b61eb6], eax
add ebp, edx
or ecx, ecx
mov ecx, dword [edi + eax*2 - 0x116c3d70]
mov eax, dword [eax + edi - 0x8b61eb4]
mov edx, 0xb632aa95
adc edi, 8
mov dword fs:[ecx], eax
lea eax, [edx*8 + 0x91d8908]
sal dword [esp + 3], 9
pop ecx
pop edx
jmp ebp
not word [esp + 2]
call fcn.0074bbaf
Function at 0x7c1e60
Capabilities:
Encode data using xor

Disassembly:
not cl
inc dl
lea edx, [edx*4 - 0x2e60f24b]
and dl, dl
dec cl
mov dword [esp + edx - 0x5000df0d], 0x1a1e5b16
sar word [esp + edx - 0x5000df0d], 0x8a
ror dx, 0xca
neg cl
sub cl, 0x18
shl edx, 0x2d
shr dx, 0x4a
sar byte [esp + edx - 0x186e0037], 1
xor bl, cl
btc edx, edx
push edx
xadd dword [esp + edx*2 - 0x32dc006a], edx
lea ecx, [esp + ecx + 0xc]
add edx, 0x6113291c
adc dl, dh
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov eax, dword [esp + 4]
and dword [esp + eax - 0x1a560014], 0x329f6c91
lea edi, [edi + eax - 0x1a560006]
jle 0xa9a63e
sal al, 1
movzx eax, byte [ebp + eax*2 - 0x34ac0053]
jl 0xac1f85
mov ecx, dword [esp + 8]
bswap ecx
lea ebp, [ebp + ecx*2 - 0x311d30b8]
seto cl
xor al, bl
shl cx, 0x4d
dec cx
adc al, 0x9b
rol cl, 0xa3
xor al, 0xac
xor al, cl
xchg word [esp + ecx - 0x188efff9], cx
sub dword [esp + ecx - 0x188e1a52], ecx
xor al, 0x3c
shl word [esp + ecx - 0x188e1a4f], 7
xor bl, al
push ecx
lea eax, [esp + eax + 0x10]
shr cl, 0x66
mov dword [eax + ecx*2 - 0x311c3402], edx
mov dword [esp + ecx - 0x188e19fd], 0xd2974888
lea edx, [ecx*8 - 0x5640a54d]
mov dword [esp + ecx*4 - 0x62386804], esi
ret 0xc
Function at 0x7cd3db
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
pop edx
bswap ecx
neg al
xor ebx, ecx
add dx, word [esp + edx - 0x1b9638a7]
adc edi, ecx
lea esi, [esi + edx*4 - 0x6e5a40fd]
movsx ecx, word [esp + edx*4 - 0x6e5a40fc]
movzx eax, byte [esi + edx*2 - 0x372d207e]
shr dl, 0xe1
ror cx, 0x85
xchg byte [esp + edx*4 - 0x6e5a407b], cl
xor al, bl
and cx, 0x27b9
shr edx, 0xf5
sbb dl, dh
dec al
push ecx
lea ecx, [edx + ecx + 0x35058a15]
xor al, 0x8b
dec al
pop ecx
jmp 0xbf51f4
dec ax
not al
ror ecx, 3
mov dword [esp + edx*4 - 0x6c4ce2a0], edx
mul ax
rol edx, 0x9c
lea ecx, [ecx + edx*8 + 0x609e01c]
xor byte [esp + edx*4 - 0x46c4ff7e], 0x85
rol dword [esp + edx*2 - 0x23627fbc], 0xa5
not ecx
jb 0xba10f7
sbb ecx, 0x8383c23d
dec edx
ror ecx, 1
bt ax, 0x29
xor ax, 0x4d98
xor ecx, 0xd7848d89
jmp 0x729883
bts edx, 0x23
rol al, 1
or byte [esp + edx - 0xd8], dl
ror ecx, 0xc4
pop ecx
sbb al, 0x9b
bts edx, edx
shr ecx, 0xac
rol al, 1
bswap ecx
xor bl, al
btc ecx, ecx
rol dx, cl
adc eax, esp
btc ecx, ecx
ror cx, 0x6c
mov cx, word [eax + edx - 0x80001b6]
lea eax, [edx + edx*2 + 0x2606472c]
setb dl
lea ebp, [ebp + eax - 0x3e064c50]
sub eax, 0x8095be1c
ror edx, 0xce
or eax, eax
mov word [ebp + edx*2 - 0x8084000], cx
sbb al, ah
mov ecx, eax
btc dx, cx
jae fcn.007c6802
mov ax, word [edi]
mov ecx, 0x8232f791
movzx edx, cx
Function at 0x7cd577
Capabilities:
Encode data using xor

Disassembly:
dec edx
inc dword [esp + edi - 0xd6]
inc esp
movsx esp, cx
xor edx, ebp
inc ecx
mov edx, 0xe4bdb82d
inc edx
bswap edx
neg edx
not bl
dec esi
add ebx, dword [esp + edi*2 - 0x1b4]
rol edx, 3
dec edx
mov dword [esp + edi*2 - 0x1bc], 0x62b2e735
call fcn.00ccc55b
sal dword [esp + 2], 0x33
ror ecx, 1
lea edx, [eax + eax - 0x50c6567d]
inc byte [esp + 6]
xor ebx, ecx
shl byte [esp + 0xb], 0xa5
mov byte [esp + 7], dl
bts eax, edx
adc ebp, ecx
mov ecx, dword [esi - 8]
cdq
inc eax
push edx
xor ecx, ebx
not byte [esp + 1]
xor ecx, 0xcda20a89
xchg dword [esp + 0xa], eax
or ax, dx
or ax, word [esp + eax*4 - 0x2457fff9]
lea ecx, [ecx + eax*4 - 0x7880ad98]
ror byte [esp + eax - 0x915fff5], 0xa7
add byte [esp + eax*2 - 0x122bfffd], dh
add eax, dword [eax]
aam 0xed
ja 0xadade9
mov gs, ebx
mov cl, 0xcf
out 0x7c, eax
lahf
push dword [ebx + 0x67]
cmp dword [edi + ebx*4 - 1], 0x1b
or dword [edi + 0x3ff9f7c], ebp
xor eax, 0x523248b
xchg edx, eax
xor al, 0x9b
jne 0x7cd605
invalid
xor ecx, 0x9893469e
xor ecx, edx
cwde
xor ebx, ecx
dec word [esp + 0xd]
not word [esp + 4]
mov dword [edi - 4], ecx
movzx ecx, byte [esi - 9]
add esi, 0xfffffff7
xor cl, bl
shr byte [esp + 0xc], 0x25
pop edx
neg cl
xor cl, 0x3b
rol cl, 1
add cl, al
idiv eax
shr ax, 0xa
xor bl, cl
and dword [esp + eax*4 + 8], 0x808c4e87
not ax
xchg dx, ax
lea ecx, [esp + ecx + 0xc]
or dword [esp + eax*2 + 3], edx
mov edx, dword [eax + ecx]
mov dword [edi + eax - 8], edx
movzx ecx, ax
lea edi, [edi + eax - 8]
sal byte [esp + ecx + 6], 0xa6
pop ecx
pop edx
pop ecx
jne fcn.007b8565
mov ebx, 0x4d0ad7a9
mov ebp, ebx
movsx edx, bl
dec ecx
mov esp, ecx
inc esp
movzx eax, dl
popfd
dec esp
lea eax, [ebx - 0x62fa79ea]
inc esp
movsx esi, bp
push edx
dec esp
mov edi, dword [esp + ebx - 0x4d0ad7a1]
inc esp
movzx ecx, bp
dec esp
mov esi, dword [esp + ebp - 0x4d0ad799]
dec edx
lea esi, [ebx + eax*8 + 0x50b19f30]
call fcn.00aa76bf

Function at 0x7cd8a0
Capabilities:
Authenticate hmac

Disassembly:
neg dl
mov dword [esp + ecx*4 - 4], ecx
btc ecx, 0x9f
jb 0x73d628
xor bl, dl
lea edx, [esp + edx + 4]

Function at 0x7d3fdc
Capabilities:
Authenticate hmac

Disassembly:
shl word [esp + edx - 0x6b51d02f], 0x67
rol byte [esp + edx - 0x6b51d02d], 0xe2
lea ecx, [ecx + edx + 0x35667b7f]
xor ecx, 0x79b1560f
sar byte [esp + edx - 0x6b51d02a], 2
rol ecx, 1
mov dword [esp + edx - 0x6b51d033], 0x4681caa9
mov word [esp + edx - 0x6b51d031], dx
neg ecx
add word [esp + edx - 0x6b51d02c], dx
sub byte [esp + edx - 0x6b51d02e], dl
ror dx, 0x2d
dec ecx
pop edx
btc edx, 0x16
xor ebx, ecx
movzx eax, dl
inc al
shl eax, 0xfb
add ebp, ecx
movsx ecx, byte [esp + eax - 0x4ffffffc]
call fcn.00728812
Function at 0x7dbe9e
Capabilities:
Authenticate hmac

Disassembly:
jl 0x765811
or al, dl
lea edx, [ecx + ecx*8 + 0x383b993a]
not al
inc edx
mov word [ecx + ebp - 0x3103f753], ax
call fcn.00a8edc4
inc esi
dec esi
xchg dword [esp + edx - 0xe], eax
dec esi
xadd dword [esp + eax - 0xe], edi
bswap esi
dec esp
lea ebx, [ecx + 0x233121bc]
neg esi
inc cx
or ebx, 0xbf0f3abf
ret
adc dword [esp + eax*4 - 0xc223a78], ecx
xor ebx, edx
mov dword [esp + eax*4 - 0xc223a80], eax
ror byte [esp + eax - 0x3088e96], 0xc3
adc edi, edx
or dword [esp + eax - 0x3088e98], ecx
cmovge ecx, dword [esp + eax - 0x3088e9d]
cbw
movzx ax, byte [ebp + ecx*2 - 0x6206115c]
neg cx
mov dl, byte [ebp + ecx - 0x3103f750]
lea ebp, [ebp + ecx - 0x3103f750]
inc cx
js 0x713214
add byte [eax], al
inc edi
je 0x7dbf3f
outsd dx, dword [esi]
jne 0x7dbf62
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
inc ecx
add byte [edi], cl
stosd dword es:[edi], eax
leave
xor dword [esi + 1], esi
mov bh, 0x5b
sub eax, 0xbca3c33
sub eax, eax
jae 0x7dbfc3
adc eax, 0xd752e73d
dec edi
imul ecx, eax, 0x443d060
inc ebp
pushal
std
invalid
xor eax, 0x33667089
fsub dword [esi - 0x77]
inc esp
xlatb
invalid

Function at 0x7e3bf9
Capabilities:
Authenticate hmac

Disassembly:
neg ax
add esi, ecx
xor edx, 0xa18d2785
mov ax, word [edi + eax - 0x2e3922fd]
movsx ecx, dx
push ecx
mov dword [esp + ecx*8 - 0x13c20], 0xa1043fbf
mov dx, word [edi + ecx*8 - 0x13c26]
sal cx, 0x44
mov cl, byte [edi + ecx*4 - 0x1e13c]
jae 0x7c1533
xor dl, bl
mov eax, dword [esp]
div al
xchg cx, ax
xor dl, 0x8f
shr cx, 0x2d
cwde
adc eax, dword [esp]
inc dl
neg al
btr eax, ecx
neg dl
shl cl, cl
rol dl, 1
not al
neg dword [esp + eax - 0x6158dbae]
sar dword [esp + eax - 0x6158dbae], 0xcc
xor dl, 0x38
jmp 0xcae077
imul eax, ecx
lea edx, [esp + edx + 4]
bts eax, eax
adc al, 0x27
jae 0xb8f3da
lea ebp, [ebp + ecx - 0x14fc]
setns byte [esp + ecx - 0x1506]
and dword [esp + ecx - 0x1506], eax
shl dword [esp + ecx - 0x1506], 9
xor dl, bl
lea eax, [ecx*8 + 0x723ac531]
shr byte [esp + ecx*4 - 0x5416], cl
dec dl
xor dl, 0xb
inc dl
dec dword [esp + ecx*2 - 0x2a0c]
neg dl
xor bl, dl
jmp 0xa98946
mov ecx, dword [edx + ecx - 0x1506]
mov dword [edi - 0xc], ecx
cbw
sbb edi, 0xc
movzx ecx, ax
inc eax
pop edx
jp fcn.00bb937c
cbw
xor bl, dl
add ax, 0x8998
xadd byte [esp + eax - 0x61588946], ah
btr cx, cx
lea edx, [esp + edx + 4]
mov ecx, dword [eax + edx - 0x61587046]
mov dword [edi + eax - 0x6158704e], ecx
not word [esp + eax - 0x61587046]
sal al, 0x46
movzx edx, byte [eax + ebp - 0x61587077]
movsx ecx, word [esp + eax - 0x61587080]
js 0xb50b3c
Function at 0x7ea81b
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [eax + edi - 0x5bfffffc]
neg ecx
add edx, eax
movzx eax, cl
neg ax
neg al
mov dword [edi + eax - 0xffd3], edx
mov dword [esp + eax*8 - 0x7feb8], ecx
jbe 0xb28e84
mov edx, 0xb8327c36
movsx eax, dl
xchg dx, ax
mov edx, dword [eax + esi - 0x7c36]
not eax
or ax, 0xea4
xadd al, ah
adc esi, 3
movzx ecx, al
xor edx, ebx
sub al, al
xor ecx, eax
rol cl, 0x81
sbb edx, 0xe5bed137
inc cx
imul ecx, ecx
bt ecx, 6
not edx
xor eax, 0xc835461e
dec ecx
adc cl, 0x37
lea edx, [edx + eax + 0x70745be4]
dec cl
btr ax, 0x31
bswap edx
xor ebx, edx
call fcn.00b2b3e4
mov word ss:[eax + edx*2 - 0x40bcd554], cx
lea ebp, [ebp + edx - 0x205e6aae]
sbb edx, edx
mov eax, dword [ebp]
mov ecx, edx
xor eax, ebx
sub eax, edx
imul ecx, ecx
sar edx, 0x2e
bswap eax
call fcn.00b10249
mov edx, dword [ebp]
mov eax, 0x68164823
ror ax, 0x2d
push eax
lea ebp, [eax + ebp - 0x68164116]
xor edx, ebx
neg eax
xadd dword [esp], eax
movsx ecx, byte [esp + eax - 0x6816411a]
rol edx, 1
call fcn.00c4bd06
not eax
mov edx, dword [ebp + ecx - 0x676162db]
dec eax
lea ebp, [ebp + ecx - 0x676162db]
pop ecx
sbb eax, 0x112be10f
xor edx, ebx
xor edx, 0x56acb921
not ecx
dec al
sar eax, cl
bswap edx
shr eax, cl
rol edx, 3
xor ecx, 0x1b16ca99
xor edx, 0xb51fc4b6
neg ecx
push ecx
sal dword [esp + ecx - 0x7c77a84f], 0x9c
xor ebx, edx
add esi, edx
lea edx, [eax*8 + 0x7aaabb04]
mov eax, dword [edi + eax*8 - 0x7ff7694]
sal ecx, 0xcd
jp 0xbd84ab
jmp 0xbfb964
adc edi, 8
shl dword [esp], 0xd9
sar word [esp + 1], 0xc8
mov edx, dword ss:[eax]
dec dword [esp]
movzx eax, cx
or dword [esp + eax - 0xe000], eax
mov eax, edx
neg ecx
movzx edx, word [esp + ecx - 0xaf62000]
lea ecx, [esp + ecx - 0xaf61fb4]
push edx
mov dword [ecx + edx*4 - 0x3fffc], eax
mov dword [esp + edx - 0xffff], esi
ret 4
mov eax, dword [ebp]
jmp 0xcf0c11
push 0xa53c2197
lea esp, [esp + 0x10]
je 0xc66e1f
mov eax, 0xe2e6418
dec ax
mov eax, dword [ebp + ebx*4]
push eax
push 0xcebf9e2c
dec ebx
call fcn.00c66e15
jmp 0xbf50fe
inc esp
and al, 0
and byte [esi + 0x5c89340e], bh
and al, 0
call eax
mov ecx, 0xaf1c223d
bt ecx, ecx
shl ecx, cl
mov ebp, dword [ebp - 4]
call fcn.0071ec0a
int 0xb1
mov ch, 0x99
in al, dx
mov ebp, 0x6d8fc264
call 0x909188e6
insd dword es:[edi], dx
aam 0x75
je 0xcf0bfc
invalid

Function at 0xa82e12
Capabilities:
Authenticate hmac

Disassembly:
call fcn.0077082c
dec edx
call fcn.00764441

Function at 0xa8462e
Capabilities:
Encode data using base64

Disassembly:
xor cl, 0xa5
sar edx, 0x1e
neg cl
xor cl, 0x3d
xor bl, cl
mov dword [esp + edx - 1], edx
sub word [esp + edx], 0x209e
sub dx, word [esp + edx]
lea ecx, [esp + ecx + 4]
and edx, dword [esp + edx*2 - 0x413e]
not edx
mov byte [ecx], al
movsx eax, dl
jge 0xb18675
Function at 0xa84977
Capabilities:
Authenticate hmac

Disassembly:
dec edx
mov dword [esp + edi*2 - 0x321e], 0xcdaa1d3f
inc ecx
add bl, 0x3c
inc cx
inc ecx
xor ch, bl
and ebx, edx
shl byte [esp + edx + 6], 0x61
dec esi
lea ebx, [esp + ebx + 8]
dec edx
mov esi, dword [edx + ebx]
dec ecx
mov dword [ecx + edx*2 - 8], esi
inc ecx
bswap edi
inc ebp
mov eax, esp
inc ebp
movzx edx, ax
dec ebp
lea ecx, [ecx + edx - 8]
inc esp
movzx eax, word [edi + edx*2 + 1]
inc ecx
push esp
inc sp
xor eax, ebp
inc ebp
movzx esi, ah
inc cx
xor eax, 0x485a8e9e
shr ebx, 0x4a
jbe 0xaf9174
xor dl, 0x14
mov eax, 0xb5940333
sal ax, 0x4c
inc ax
sbb dl, 0x1e
call fcn.00b4d5f6

Function at 0xa8b514
Capabilities:
Encode data using base64

Disassembly:
dec ecx
or dl, dl
dec edx
adc eax, eax
ror ecx, 1
jmp 0xc231a0
mov dword [esp + edx - 0x2f9e7b38], ecx
je 0xc0da9f
mov dx, word [edx + esi - 0x2f9e7b36]
inc ecx
je 0x7274ca
sbb dword [esp + 3], 0x871e3c9e
mov cl, byte [esi + 4]
call fcn.00ad6f06
rol edx, 0xbb
lea edx, [edx*8 - 0x7a5ce041]
ror al, 1
shr word [esp + ecx*2 + 2], 0xe4
not word [esp + ecx + 2]
not al
adc al, 0x37
ror al, 1
neg edx
add dword [esp + ecx + 4], edx
bts ecx, 0xac
or ax, dx
and eax, 0xe33e669c
lea ecx, [eax + ecx - 0x3747b092]
bswap ecx
imul edx, edx
btc ax, dx
push eax
sbb ecx, 0xb12a2db7
rol ecx, 2
sar eax, 0x3f
mul eax
call fcn.007ca334
Function at 0xa8c27e
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
inc cx
not edi
dec eax
mul eax
inc cx
rol edi, 1
mov ecx, 0xf9094ba9
inc ecx
xadd dl, dl
inc cx
not eax
inc cx
not edi
cwde
jne 0xb7daa7
ror ax, 1
inc dl
dec cl
sub ax, 0x641a
bswap ecx
rol ax, 1
sub ax, 0x270c
bswap ecx
call fcn.00783027
mov edx, 0xc692f20c
mov ecx, edx
jmp 0xc35550
dec esp
mov dword [esp + ebx*2 - 0x485bcd4a], esi
inc ecx
inc edi
inc ecx
xor edi, 0x8c985d05
inc ebp
movsx edx, bx
inc cx
imul ebx, ebx
dec eax
mov dword [esp + ebx*2 - 0x485b8fb2], 0x2289c39c
inc ecx
bswap edi
rol word [esp + ebx - 0x242dc7cd], 0xc4
inc ecx
neg edi
dec esp
mov dword [esp + ebx*2 - 0x485b8f9a], edx
dec eax
mov dword [esp + ebx - 0x242dc7c1], ebp
pop ebp
idiv al
inc esp
xor dword [esp + ebx - 0x242dc7c9], edi
inc bl
dec eax
mov ebp, dword [esp + ebx - 0x242dc7ca]
inc bp
xadd ebx, eax
dec ebp
arpl di, di
dec esp
mov dword [esp + ebx - 0x242dc7ca], eax
movsx edx, byte [esp + esi + 0x4bc68504]
dec ecx
add esi, 0xbfbaea16
dec ebp
adc ebp, edi
dec ecx
mov esi, dword [ecx + ebx - 0x242dc7e2]
rol byte [esp + ebx - 0x242dc7cf], 0x47
movzx ecx, byte [ebx + edi - 0x242dc7d4]
div dword [esp + eax*2 - 0x56b04e54]
dec eax
lea edi, [edi + ebx*2 - 0x485b8fad]
inc eax
xor cl, ch
ror cl, 1
shl ebx, 0x28
inc ecx
sbb bl, 0xa3
cdq
dec cl
not cl
dec eax
cwde
dec eax
neg edx
rol cl, 1
call fcn.00a890f1
inc ecx
mov esi, 0x7c15fa10
inc ecx
movsx esi, dh
inc bx
mov ebx, dword [ecx + esi - 0x7c15fa10]
dec esp
lea eax, [esi*2 + 0x2a99c19e]
inc esi
movzx edi, word [edi + esi - 0x7c15fa10]
movzx eax, si
inc sp
xor edi, ebp
inc esp
movzx edx, dh
inc cx
nop
inc ebp
movzx esp, dh
inc cx
neg edi
rol ax, 0x47
jae 0x758cd6
movzx eax, cl
movzx ecx, byte [eax + esi - 0xc]
and eax, eax
sar al, 0x61
and eax, eax
xor cl, bl
xor eax, eax
inc cl
cwde
ror al, 0x21
xor al, 0x18
ror cl, 1
sub cl, 0xbf
neg al
sub ax, ax
not cl
xor cl, 0x86
push eax
lea eax, [eax*2 + 0x2732dc2b]
sal dword [esp + eax - 0x2732dc2b], 0xf1
inc cl
pop eax
not cl
bt eax, 0x95
neg eax
rol ax, 0xd
xor bl, cl
add ecx, esp
shl eax, 0xa4
mov dword [eax + ecx], edx
cwde
mov edx, dword [eax + esi + 1]
adc eax, eax
cwde
lea esi, [esi + eax + 5]
xor edx, ebx
bswap edx
lea edx, [eax + edx - 0x4fb7c6a7]
movsx ecx, ax
ror eax, 0x5a
bswap edx
rol cl, 5
ror ax, 0xe7
ror edx, 1
push eax
add dword [esp + eax*4], eax
add al, ah
xor ebx, edx
sub eax, eax
adc ebp, edx
mov edx, dword [edi + eax*4 + 4]
ror dword [esp + eax*2], 0x8b
lea ecx, [ecx + ecx*4 + 0x3b302820]
mov ecx, dword [edi + eax*2 + 8]
xor ax, 0xc438
btc ax, ax
rol al, 0x47
adc edx, ecx
movzx ecx, al
imul eax, dword [esp + eax - 0xc51c]
mov ecx, edx
shr eax, 0x2d
adc eax, dword [eax + edi + 0xc]
push 0x638f7d14
mov edx, 0xe8131f3a
sub dx, 0xaf80
sbb edi, 0xffffffef
shl edx, 0x23
lea edx, [edx*8 + 0x7830787]
mov dword ss:[ecx + edx*8 - 0x62f7b038], eax
mov dword [esp + edx*8 - 0x62f7b038], ebp
ret 4
mov edx, dword [edi]
jmp 0xb95389

Function at 0xa8c383
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp + 0xc], 0x15875c0
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.00733ecb