joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11b4aa6
Capabilities:
Get number of processors

Disassembly:
mov dword [esp], 0xdcd521db
call fcn.011cf8f8

Function at 0x11bbc54
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
not edx
mov dword [esp], 0x46aa1a89
dec edx
rol edx, 1
xchg word [esp + 2], cx
inc ecx
setl al
dec edx
and word [esp + 2], cx
btc eax, ecx
rol cx, 0x47
xor ebx, edx
or dword [esp], 0x527ee80
adc esi, edx
movzx edx, byte [esp]
dec edx
xchg dl, al
mov edx, dword [ebp + edx - 1]
xor ecx, eax
lea ebp, [ecx + ebp - 0x27]
movzx eax, byte [edi + ecx*2 - 0x56]
lea ecx, [ecx + ecx + 0xb965f8c]
sbb cx, 0x5696
lea edi, [edi + ecx*8 - 0x5cb04a5f]
neg cl
setp cl
sbb ecx, ecx
xor al, bl
sub al, 0x12
xor al, 0x15
sub byte [esp + 2], cl
add al, cl
bts ecx, ecx
xor al, cl
sar ecx, 0x54
ror al, 1
shl ecx, cl
xor al, 0xb2
bswap ecx
push ecx
not al
xor bl, al
shr word [esp + ecx*2 - 0xfa], 0x68
sal cx, 0x67
call fcn.00b71db8
mov ch, 0xae
cmp eax, 0xd8f5edca
bound ebx, qword [ecx + 0x1c]
inc edi
out dx, eax
lea esi, [0x1e58fe42]
jge 0x11bbd60
cmc
inc esp
retf 0x9eca
sub ch, dh
push ss
out 0xe4, eax
in eax, dx
out 0xbc, al
inc ebp
inc edi
pop es
fnsave dword [edi + ebx*2]
xchg byte [ebp - 0x36f24247], bh
jno 0x11bbdbc
iretd
add byte [ebp - 0x72], dl
sbb al, 0x60
push ebp
mov ds, word [eax]
pop ss
scasb al, byte es:[edi]
xor eax, 0x3e2de94c
dec edx
stosb byte es:[edi], al
and bl, byte [ebx + 0x76]
push edx
sbb al, 0xc4
sti
xchg byte [0xa0395d5], dh
aad 0x95
add ecx, dword [edx]
jbe 0x11bbe3c
scasb al, byte es:[edi]
push eax
xor eax, 0xb3bd99ca
js 0x11bbdd3
sbb al, 0xc5
and eax, 0x252db5da
add byte [esi - 0x4a], cl
jecxz 0x11bbe25
pop ds
retf 0xed4a
push ebp
add byte [eax], al
add byte [eax], al
stosd dword es:[edi], eax
mul dh
jne 0x11bbdbd
shl byte [eax + 0x75f935e6], cl
ret 0xe8ad
cwde
or dword [ebx], edx
in al, 1
mov byte [0xff728b33], al
or esp, esi
adc eax, 0xdde15c88
stc
inc esp
pushal
mov ebp, 0xd2089860
xchg edi, eax
inc esi
retf 0xe265

Function at 0x11bcb72
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], edx
mov dword [esp], edx
adc edi, 3
add word [esp + 8], dx
not dl
xor eax, ebx
inc eax
ror eax, 3
bswap eax
rol eax, 1
movsx ecx, dx
sar dl, 0xa1
call fcn.00c701f0
mov eax, 0x4b399d9e
lea ecx, [eax + eax*4 + 0x6b07f239]
lea esi, [esi + eax - 0x4b399da2]
lea ecx, [ecx*2 - 0xe645463]
cwde
or eax, eax
mov edx, dword [esi]
shl ecx, cl
xor edx, ebx
lea eax, [eax + ecx*2 + 0x8827baf]
bt ecx, ecx
imul cx, ax
ror edx, 1
inc ecx
add edx, 0x161010aa
xor ax, 0x2ba2
push eax
or cx, 0x590
bswap edx
sbb edx, 0x3e3a451e
xor ebx, edx
cwde
mov word [esp + eax - 0x32ee], 0x209a
add ebp, edx
mov eax, dword [edi + eax*2 - 0x65de]
call fcn.00aa4898
fdiv qword es:[eax - 0x5298c887]
mov bl, 0x7a
pop ebx
pop ss
insb byte es:[edi], dx
pop edx
mov al, byte [ebp + 0x257a5874]
lcall 0x847a, 0xf60b7f1c
mov ch, 0xfd
jnp 0x11bcbb6
mov ah, 0x95
int1
xlatb
xchg edi, eax
mov ah, 0x15
pop esp
mov eax, dword [esp + ebx*2]
int3
Function at 0x11bf819
Capabilities:
Encode data using xor

Disassembly:
push ebp
call fcn.00bdf718
sub edi, 4
movsx edx, al
mov dword [edx + edi - 0x10], ecx
shl dl, 0xc5
adc edx, dword [esi + edx]
invalid
lds edx, [ebx]
adc al, 0x16
push eax
add esi, 4
xor edx, ebx
mov ecx, eax
add ecx, dword [esp]
cbw
not edx
rol edx, 2
bswap edx
shr ecx, 0x5f
ror edx, 2
imul ax, ax
neg edx
xadd al, ah
bts eax, 0xb9
lea edx, [ecx + edx - 0x59a267ba]
xor ebx, edx
add ebp, edx
lea edx, [eax + ecx - 0x787d2fe7]
sar dword [esp + ecx - 1], cl
pop eax
jno fcn.013d47dd
xchg esi, eax
mov ah, 0xfb
idiv dword [edi - 1]
jl 0xc14586
mov edi, dword [edx + 0x4bf51f0a]
jae 0xc145d4
mov ch, 0x5d
loope 0xc1451c
daa
xchg esi, eax
enter 0xffffffffffffc1e8, 0xffffffffffffffc6
push ebp
ja 0xc145ae
or eax, 0xc1df5348
and al, 0xfd
clc
loopne 0xc1451f
mov cl, byte [edi + 0x201e0923]
add dh, bh
mov esp, 0x8cd2614f
pop eax
push ds
mov bl, 0x57
mov al, 0x53
xchg esi, eax
ljmp 0xc7e3
out dx, eax
lahf
cmp ebx, dword [0x31fe6010]
cmp edx, dword [eax]
pop ebp
adc byte [ecx + esi - 0x4d], bh
test eax, 0x9a23f485
xor al, byte [esi - 0x7fdd852c]
sbb byte [edx], 0x47
xor esp, dword [eax - 0x20c85444]
jle 0xc145b8
sub ebp, dword [ebp + 7]
insd dword es:[edi], dx
pop es
and dword [esi], esp
sbb eax, 0x7cc230c5
inc edx
out 0x7b, eax
sub al, 0xae
or al, 0x1a
int1
xor dword [ebx + 0x21], esi
sar byte [ebp - 0x3db2b28f], 1
invalid
lea esp, [esp + 4]
jmp 0xc1450a

Function at 0x11cec97
Capabilities:
Authenticate hmac

Disassembly:
xchg cx, ax
call fcn.00c059f5
sub esi, 4
mov eax, 0x4c9a89b7
movsx edx, al
jmp 0x12e7793
mov eax, dword [esi + eax - 0x4c9a89b7]
sal edx, 0x3e
xor eax, ebx
movzx ecx, dl
xchg edx, ecx
ror eax, 1
not dx
neg dx
imul edx, ecx
bswap eax
adc ecx, ecx
imul dx, cx
inc cl

Function at 0x11d115a
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, edx
call fcn.0130f948
cwde
mov ecx, edx
mov edx, ebp
add al, ch
sbb ebp, 3
dec cl
xchg ecx, eax
jle 0xace890

Function at 0x11d5cdb
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
jne 0x12a3884

Function at 0x11d7b00
Capabilities:
Encode data using base64

Disassembly:
push 0xa2026ca1
lea esp, [esp + 0xc]
je 0xb3bf32
push 0xb63164b2
jmp 0xc158b6

Function at 0x11dcd00
Capabilities:
Encode data using xor

Disassembly:
mov dx, word [esi]
mov ax, word [esi + 2]
mov dword [esp], 0xf98bce8f
mov cl, byte [esi + 4]
push 0x9d8a9227
rol dword [esp], 0x50
adc esi, 4
push 0x1201b626
sal word [esp + 0xa], 0xc1
shld dx, ax, cl
mov word [esi], dx
call fcn.012bdd76
mov ecx, 0x312bae86
lea edx, [ecx - 0x336f8c62]
lea edi, [ecx + edi - 0x312bae8a]
lea eax, [edx*4 + 0x3a311404]
sal cl, cl
and ecx, ecx
mov edx, dword [edi + ecx*2 - 0x62575d00]
rol ax, 0x6e
xor edx, ebx
not ecx
sal ecx, 0x7b
xchg ch, al
dec edx
inc ecx
xadd ax, cx
rol edx, 1
and al, ah
lea eax, [ecx*8 - 0x30ffb065]
bswap edx
dec edx
xor ebx, edx
bt eax, eax
add ebp, edx
bt ecx, ecx
movsx edx, ax
sub dl, cl
rdtsc
sbb esi, 8
jmp 0x1349632
mov dword [esi + 4], eax
add ecx, 0x6cb5feb4
mov dword [esi + ecx - 0x64b625b4], edx
movsx edx, cl
and cx, cx
lea eax, [ecx + ecx*4 + 0x40a7f584]
ja fcn.013c0ed1
Function at 0x11df3e9
Capabilities:
Encode data using xor

Disassembly:
call fcn.01347886
dec eax
shl edx, 0x5a
neg eax
shl ecx, 0x66
xor eax, 0xba3a5897
neg dword [esp + edx*2 + 4]
adc ecx, 0x9f335212
mov dword [esp + edx], edx
adc eax, edx
push edx
mov dword [esp + edx + 0xc], edx
neg eax
sal edx, cl
ror ecx, cl
call fcn.013bb426
mov ecx, 0x404d8b2
mov eax, ecx
lea edi, [edi + ecx*4 - 0x101362cc]
neg al
xor al, cl
je 0xbd9040
mov eax, dword [edi + ecx*2 - 0x809b164]
xor eax, ebx
add cx, cx
dec eax
sub cl, 0x25
mov edx, ecx
rol eax, 1
inc ecx
xor edx, 0x2a39c69c
sar dx, 0x64
bswap eax
dec dx
dec eax
ror ecx, 0xf3
adc cl, 0xb3
xor ebx, eax
sub edx, 0x5295af31
xor edx, edx
adc ebp, eax
and dl, 0x34
lea edx, [edx - 0x2fcba50]
bts ecx, ecx
rdtsc
sar cx, 0x82
add ecx, ecx
xor cl, cl
lea esi, [esi + ecx*2 - 0x58e00008]
push ecx
je 0xcb51a5
btr eax, eax
lea eax, [eax*4 - 0x6b55e9f1]
mov byte [ecx], dl
push eax
pop edx
pop ecx
jmp ebp

Function at 0x11e4d29
Capabilities:
Execute syscall

Disassembly:
ror dl, 6
mov word [edx + ebp - 0xebf6], ax
pop ecx
pop ecx
pop eax
jp fcn.00b43108
sub esi, 4
mov ecx, 0x29328392
mov eax, dword [esi + ecx - 0x29328392]
xor eax, ebx
not eax
not cl
movsx edx, cx
lea ecx, [ecx*2 - 0xc522380]
neg eax
dec eax
neg eax
inc ecx
rol eax, 2
bswap ecx
btr ecx, edx
xor ebx, eax
add ebp, eax
call fcn.00b3bd84
syscall
call fcn.00a9c49e
mov ecx, 0xc5af39b2
movsx edx, cl
lea ecx, [ecx*4 + 0x5aba0409]
mov eax, dword [edi + ecx - 0x7176ead1]
lea edi, [edi + ecx - 0x7176eacd]
inc dl
shl cx, 3
xor eax, ebx
sar cx, 0x69
sbb eax, 0x222efa12
call fcn.00b0dd46

Function at 0x11ef06c
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [esi]
or al, byte [esp + 5]
xchg word [esp + 4], cx
pop edx
pop edx
jno fcn.00c946d3
rcl edi, cl
and dword [ebx], ebx
call 0xfbf220d0
push ss
mov byte [ebx + 0x51], ch
out dx, al
dec edx
cmp esp, dword [eax + edi - 0x6a392ea7]
cwde
sbb eax, 0xc8fd9434
dec eax
and eax, 0xc0a5fb62
adc byte [ecx - 0x7be8bec0], ah
aaa
lea esp, [edx]
mov esp, 0xca471481
mov eax, 0x48192977
popfd
lahf
sbb eax, 0x779112a5
jb 0x11ef10a
adc al, 0x47
retf 0xb826
pop ebp
iretd
out 0x8f, eax
aad 0xe9
jl 0x11ef0ad
fdivp st(1)
leave
fsubrp st(4)
lds eax, [edx - 0x27]
leave
inc esi
dec eax
sti
dec ecx
mov eax, 0x35c78f8c
sahf
sub eax, 0x91e86266
cmc
jl 0x11ef145
sbb al, 0xda
pop ebp
and al, 0x1f
loop 0x11ef0dd
test al, 0x44
popal
inc ebp
salc
test eax, 0x796fb999
push edi
sub eax, 0xbc002374
neg ch
cld
and esp, edi
dec edx
sbb ebp, dword [edi - 0x74be2eab]
dec esp
sbb al, bl
in eax, 0x38
loope 0x11ef1a0
sti
js 0x11ef0f5
je 0x11ef105
pop ds
cmp eax, 0x85e18ef5
cli
jnp 0x11ef146
shl byte [esi + 0x65], cl
sbb eax, 0xce91e4a7
hlt
invalid
ljmp 0x25c9:0xe7c864e2
invalid
Function at 0x11f0183
Capabilities:
Encode data using xor

Disassembly:
inc edx
xor dword [esp + ebp - 0x580efe06], ebp
dec esi
mov ecx, dword [esp + ebp - 0x580efe06]
dec esi
lea edi, [ebp*2 + 0x1207ee08]
dec ecx
lea edx, [ebx + eax - 0x33d98fe1]
dec ebp
bt edi, ebx
dec eax
arpl bp, bp
inc esp
mov esi, eax
dec edx
mov dword [esp + ebp - 0x580efe0e], 0x59b603ab
dec esp
add edx, ebp
dec edi
lea eax, [eax + ebp - 0x580efe0f]
inc edi
movzx esp, byte [eax + ebp - 0x580efe0e]
shr cx, 0x89
shr ecx, 0x89
dec edx
mov dword [esp + ebp - 0x580efe06], 0x3621aba4
inc ebp
xor ah, cl
dec eax
lea ebp, [edx*8 + 0x162b7ca4]
call fcn.00bce845
ja 0x11f01ce
inc eax
ret 0xe080

Function at 0x1268528
Capabilities:
Encode data using xor

Disassembly:
into
shl dl, 0x47
btc ax, ax
and eax, edx
not ecx
ror ecx, 3
xor ebx, ecx
dec dl
cdq
add ebp, ecx
inc ax
cdq
call fcn.00b9c281
mov eax, dword [esp + ecx - 0xa6a0]
lea ecx, [ecx + 0x243a9a0e]
pop ecx
mov ecx, dword [esp + 0x10]
call fcn.012945f4
add byte [edi + 0x6c], ch
xor esi, dword gs:[edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx + 0x3b], dh
je 0x126859c
arpl word [esi + 0x26], ax
mov edi, 0x69cf7bca
xlatb
dec edi
pushfd
les ecx, [ebp - 0x6404caf4]
mov eax, dword [0xd7e3c8a5]
clc
jecxz 0x12685b1
wait
wait
jb 0x12684fe
invalid
sbb ah, byte [ebp + 0x4b]
jecxz 0x12685f2
daa
imul ecx, edx, 0x6a
sbb ebx, dword [0xe8b8b5fb]
fld dword [esi - 0x69]
jecxz 0x12685cd
retf
pop ds
dec edx
jmp 0x1268573
retf 0x122f
inc ebp
nop
inc ebx
sub eax, 0xe0d27b19
invalid
fbstp tbyte [0x1d10bf57]
ror dword [ebp - 0x5e92a985], 1
or dword [ecx - 0x5e5dc7ac], edi
ror dword [eax], 0x4f
xor ah, dh
jb 0x12685f8
fcomp st(5)
add esi, esp
pop ecx
mov ebp, 0x5af965b2
invalid

Function at 0x1276fe2
Capabilities:
Get number of processors

Disassembly:
ror edx, 1
not al
shr cx, cl
inc edx
cwde
push eax
or cl, al
ror edx, 1
xchg byte [esp + ecx*4 - 0x3f9], ch
sub cl, 9
setp byte [esp + ecx - 0xf4]
inc edx
cwde
call fcn.00b137ba
lea ecx, [ecx*8 - 0x4957ffea]
seto cl
lea edi, [edi + ecx - 0x61acd0fd]
pop ecx
push 0xbf202982
xor eax, ebx
sub eax, 0x1e21c811
ror eax, 1
mov edx, 0xbdacfb9c
mov dword [esp + 4], edx
neg eax
call fcn.013d0e7c
rol word [esp + eax*4 - 0xf], 0xa1
adc esi, eax
xor ecx, ebx
sub byte [esp + eax - 3], al
movzx edx, word [esp + eax*4 - 0x10]
jne 0xbeceeb
inc ecx
mov ebx, 0xdcb9cb8d
dec edx
lea ebx, [ebx*4 + 0x42a4a585]
dec ecx
sub eax, 4
inc ecx
shl ebx, 0x74
inc ecx
mov edi, dword [eax]
call fcn.013b3bb7
mov edx, 0xeb0f85ad
mov edx, dword [esi]
mov ecx, 0xbba0a03d
btr ecx, 0x94
adc esi, 4
and ecx, ecx
lea eax, [ecx + 0x40b5cb16]
sal eax, 0x38
xor edx, ebx
shr ecx, cl
jb 0x11b4a7f
Function at 0x12af493
Capabilities:
Get number of processors

Disassembly:
mov dx, word [ebp + ecx*4 - 0x22ade]
mov dword [esp + ecx - 0x8ab8], ecx
sar cl, 0x22
and ecx, ecx
mov cl, byte [ebp + ecx*2 - 0x115d8]
adc ebp, 4
push 0x9fb94eb5
jmp 0x1329370

Function at 0x12afb1e
Capabilities:
Authenticate hmac

Disassembly:
call fcn.00b06c6d
mov eax, dword [esi]
mov edx, 0x7d91d49b
lea esi, [esi + edx - 0x7d91d497]
xor eax, ebx
jmp fcn.00c43fd3
add esi, edx
movzx edx, al
call fcn.013a9e01
mov cx, word [esi]
inc ecx
mov esi, 0xda101136
inc sp
mov esp, dword [esi + 2]
dec eax
add esi, 2
dec ecx
lea eax, [esi + 0x630b6b07]
dec esi
lea edi, [eax + esi*2 - 0x294c6d51]
dec esp
lea ebp, [eax + eax*2 + 0x492b28bf]
inc cx
add ecx, esp
mov word [esi], cx
dec ecx
sub eax, 4
inc ecx
bt edi, 3
inc ebp
movzx esp, si
jb 0xada2ed
mov ecx, 0xd81c5b8d
mov eax, dword [esi]
add cl, 0x13
mov edx, ecx
adc esi, 4
ror ecx, 0x34
and edx, ecx
or ecx, 0xaa0d0a86
xor eax, ebx
dec cl
lea edx, [edx + edx*8 - 0x2d715a7d]
xor eax, 0x7185b329
not dl
sar dx, cl
test dword [ecx - 0xa], esi
shl byte [esi - 0x2d], cl
cli
bswap eax
xchg ecx, edx
dec eax
inc dx
sete dl
neg eax
shr cl, 0xc3
not eax
not cl
xor ebx, eax
and dl, dl
dec cl
btc edx, ecx
adc ebp, eax
btc cx, cx
movsx eax, cl
sub edx, 0x9c0f07ac
mov ax, word [edi + edx - 0x53b00756]
rol cx, cl
rol dx, 0x82
mov dx, word [edi + edx - 0x53b01d56]
shr ecx, cl
jns 0x12c4f26
aad 0xe1
in al, dx
dec edx
cwde
mov eax, 0x9c54ec3e
xchg ebx, eax
mov dh, 0x17
xor eax, 0x9e4e489c
shl ebx, cl
cmp bl, al
clc
dec edx
adc byte [eax + 0x7d], bl
test al, 0x94
sbb al, 0x22
xchg ebx, eax
stc
call 0x6010accc
push eax
jecxz 0x12afb9f
sbb al, 0x70
retf 0x4c89
mov cl, byte [edi + ecx*2 + 2]
jne 0xb618ed

Function at 0x12baf5f
Capabilities:
Authenticate hmac

Disassembly:
dec eax
cdq
dec esp
mov ecx, dword [esp + edi - 0x126f8da8]
inc ecx
pop esi
xadd dx, di
dec ebp
arpl bx, bx
push ecx
inc ecx
div esp
dec ebp
add edx, ebx
dec eax
mov esi, dword [esi + edi*2 - 0x24de0000]
dec eax
cwde
pop edi
inc cx
shl ebp, 0xf
pop edx
jns fcn.00ca1b11

Function at 0x12bafa1
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x18]
jne 0x13e84ca
mov esi, 0xc420233a
mov edx, esi
mov eax, 0xb2b29e82
pop esi
xor edx, 0x89bb1be
shr ecx, cl
ror eax, 0xb8
not edx
xor edx, 0xad1ae0ac
btr eax, ecx
call fcn.00ad0a11
neg edx
xor edx, 0x628f3d25
ror edx, 1
dec cx
shr word [esp + eax - 0x7fece7fd], 0xc1
call fcn.00aa458c
jmp 0xaf0ecc
Function at 0x12d41e7
Capabilities:
Encode data using xor

Disassembly:
rol cl, 0x43
sbb dx, dx
xor ebx, eax
add dx, 0xf625
push edx
jns 0x13c5368
adc ebp, eax
not dword [esp + ecx]
jmp 0xb87229
bswap eax
jmp 0xaad9d6
sar cl, 0x87
mov dword [esp + ecx], ebp
ret
push edx
shr cl, 0xc4
not al
rol al, 1
xor bl, al
sar ecx, 0x8b
or cl, byte [esp + ecx*8 - 0x14407e]
lea ebp, [ebp + ecx - 0x28875]
not ecx
push ecx
xadd byte [esp + 0xd], ch
mov word [ebp], ax
inc ecx
lea eax, [edx*8 + 0x52a76419]
and ax, 0x7611
pop eax
pop eax
pop edx
pop eax
jae fcn.00b43108
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x12d4281
outsb dx, byte [esi]
push 0x6c646e61
inc ebp
js 0x12d429a
jo 0x12d42ae
imul ebp, dword [edi + 0x6e], 0x746c6946
jb 0x12d4244
push edi
xor eax, 0xd81315a1
invalid
xchg edx, eax
cmp eax, 0x7f5fd72c
adc dword [esi + 0x31], 0xffffffd2
xor eax, 0x3c4a9129
push edx
xor eax, 0xa5653e6e
in al, dx
dec eax
and dword [ecx - 0x2eaee095], edx
push esp
jbe 0x12d4282
imul ebx, dword [edi], 0x51
rcl dword [esi + esi*2 - 0x1f]
or edx, dword [ecx + 0x4e958b8c]
or eax, 0xc82f8faa
lodsd eax, dword [esi]
push 0xd2261c74
int 0x81
stosb byte es:[edi], al
invalid
je 0x12d42cc
sal bl, cl
int 0x81
push edx
sti
pushal
pop dword [edx]
sub eax, 0xad15882b
movsb byte es:[edi], byte [esi]
push edx
sbb al, 0xf7
push edx
rcr byte [edx], 1
and dh, dh
push edx
loopne 0x12d42a8
cli
mov dword [ebp*4 + 0x52d9f140], ebp
or byte [ebx + edx + 0x22], dh
lodsd eax, dword [esi]
sar byte [ecx + 0x7fbeae15], 1
mov eax, ecx
lea esi, [esi + eax - 0x7fbeae19]
mov eax, dword [ecx + esi - 0x7fbeae15]
mov edx, 0x7ab1524
ror ecx, cl
xor eax, ebx
bswap edx
sal cl, 4
sbb eax, 0x9490e200
sar edx, 0x35
dec ecx
rol eax, 2
push edx
bts edx, 0x99
inc eax
ror eax, 1
shl edx, cl
sal ecx, 0x2c
sub cx, dx
dec eax
sal ecx, 0xad
neg cx
pop edx
xor ebx, eax
inc ecx
add ebp, eax
imul cx, dx
rol cx, 0x8b
adc cl, 0x86
mov eax, dword [edi + edx*4 - 0x480]
inc dx
mov ecx, dword [edi + edx*2 - 0x23e]
ja 0x13c8cc7
mov ecx, 0x9f1ecc95
mov eax, 0xb110d80b
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov cl, byte [edi + 8]
add edi, 6
shld edx, eax, cl
mov eax, 0x5299db2c
mov dword [eax + edi - 0x5299db2c], edx
movzx ecx, al
lea esi, [esi + ecx*2 - 0x5c]
sub al, 0x8b
cdq
mov eax, dword [esi + ecx*2 - 0x58]
xor ecx, ecx
xor eax, ebx
not eax
bt dx, 0x93
bswap eax
dec edx
sbb eax, edx
jmp 0xb4e08d
rol edx, 1
push ebx
movzx ebx, dl
cpuid
sbb edi, 8
mov dword [edi + 0xc], eax
mov eax, 0x6d23fd2d
shl ax, 0x24
mov dword [edi + eax - 0x6d23d2c8], ebx
mov ebx, eax
bswap eax
sbb bl, bh
mov dword [edi + ebx - 0x6d23d2f9], ecx
mov dword [edi + ebx - 0x6d23d2fd], edx
pop ebx
movsx edx, al
btc dx, dx
movzx ecx, dx
jae fcn.00b67c6c
Function at 0x130b510
Capabilities:
Authenticate hmac

Disassembly:
add ecx, 0xf705a0b1
push eax
rol edx, 0x97
dec eax
not ecx
bts ax, 0x20
pop eax
shr al, 0xa1
rol ecx, 1
xchg dx, ax
btr eax, 0x11
sar eax, 0xe1
xor ebx, ecx
call fcn.012c1430
mov dword [esp + ecx - 0x4a934b1b], edi
ret 0x14
cwde
jmp 0xb2ba2d
ror edx, 1
neg ax
sbb al, 0xb1
je 0xbd5e02
xor edx, 0x188cce04
rol cl, 0xc5
dec edx
ror edx, 1
xor ebx, edx
sar ax, 0x88
add esi, edx
push ecx
movsx edx, byte [esp + eax - 0x1ba60004]
xor edx, dword [ebp + eax - 0x1ba60004]
xor eax, dword [esp + eax*4 - 0x6e980010]
neg word [esp]
xor cx, word [edx]
add byte [esp + 2], ah
jp 0x11df4a9
bts eax, eax
adc ebp, 2
rol al, 0x27
movsx edx, ax
idiv eax
mov word [edx + ebp - 0x332801f4], cx
mov dword [esp + edx*2 - 0x665003e8], esi
ret
ror ax, cl
sar edx, 0xca
dec ax
neg cx
push edx
xor ax, 0x3e3c
neg ax
not ax
shr dl, 1
xchg dl, cl
sbb ax, 0x3413
or byte [esp + 1], 0x2d
not ax
xor bx, ax
sub esi, 2
bt dx, 0x9e
add cl, 0xa5
imul ecx, ecx
mov word [esi], ax
pop edx
pop ecx
jo fcn.00c946d3
mov eax, 0x9918339d
mov edx, dword [edi]
add eax, 0x828df099
lea edi, [edi + eax*4 - 0x6e9890d4]
mov ecx, eax
xor cl, cl
sal ecx, 0x27
xor edx, ebx
sar ax, 0x43
dec edx
dec eax
not ax
jns 0xc438f7
dec edx
sub eax, ecx
not edx
shr dword [esp + eax - 0x6faafcfd], 0xfc
adc cx, word [esp + eax - 0x6faafcfb]
lea edx, [edx + eax*2 - 0xac7807b]
xor ebx, edx
add ebp, edx
call fcn.00addda6
mov ecx, 0xb0876006
movzx ax, byte [esi]
movzx edx, cl
btr ecx, ecx
xor cx, dx
add cl, byte [esi + edx*8 - 0x2e]
inc edx
sar edx, 0xc7
lea esi, [esi + edx*8 + 2]
sar dl, 0x65
dec dl
or al, cl
movzx ecx, dx
sub ecx, ecx
xor al, dl
neg ecx
mov word [edx + esi - 0xff], ax
movzx eax, cl
lea ebp, [edx + ebp - 0x103]
sbb ecx, 0x2412d48b
mov edx, dword [edx + ebp - 0xff]
adc cx, 0x802f
shl ecx, 0xc3
ror al, 0xe6
xor edx, ebx
btr cx, 0x8e
rol edx, 2
xchg cx, ax
rol eax, 0x55
inc edx
ror eax, 0x5c
or cl, al
adc eax, ecx
xor edx, 0x9aacb023
ror edx, 1
sub cl, 0x88
xadd cx, ax
setge cl
sbb edx, 0xf9345925
rol edx, cl
call fcn.013de7a4
push ecx
adc edi, edx
add byte [esp + 5], al
pop edx
sbb ebp, 1
xor dl, dl
movzx eax, word [ebp]
inc ecx
xor ax, bx
jmp 0x1290b3f
Function at 0x131b26d
Capabilities:
Encode data using base64

Disassembly:
pushfd
mov esi, 0xaf9394a7
mov esi, dword [esp + esi + 0x506c6b61]
mov dword [esp + 8], 0x46a563af
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.012cd8bc
mov eax, dword [esi]
mov edx, 0xa69938bb
movsx ecx, dx
sar cl, 0x64
lea esi, [esi + ecx*2 - 0x71f2]
xor eax, ebx
xor eax, 0xc01d268b
sal edx, 0x14
btr ecx, edx
sub ecx, ecx
not eax
call fcn.00ad140b
neg dl
mov eax, 0xf6293602
shr al, 0x87
xor bl, dl
lea edx, [esp + edx + 8]
dec byte [esp]
mov byte [edx], cl
mul dword [esp + 4]
jae 0xb85ce7
pop eax
pop edx
jmp ebp

Function at 0x13264fb
Capabilities:
Execute syscall

Disassembly:
not eax
rol dword [esp + ecx - 0x2f122269], 0x13
xor ebx, eax
sal cx, 0xe
adc ebp, eax
mov edi, dword [edi + edx - 0x2201]
call fcn.00abd368
inc esp
xor bl, bl
inc ebp
xor dh, cl
inc esp
add dh, dl
inc esp
xor dh, dl
push ecx
or word [esp + ebp*2 - 0x70d0], 0xe312
or cl, 0x9e
inc esp
adc dh, dl
dec eax
or eax, dword [esp + ebp*4 - 0xe195]
call fcn.0131830b
syscall
inc ecx
push esp
pushfd
dec ecx
mov esp, 0x4412de99
sub al, 0x41
add dword [ecx + 0x4c], esp
mov esp, dword [esp + 8]
dec eax
mov dword [esp + 8], 0x3fb13975
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.011c6914

Function at 0x1329572
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [ebx*4 + 0xa973f4]
push 0x3bb2401a
push 0xfc321aa2
shr ecx, 8
xor ecx, ebx
jmp 0x12f7cca
and ebx, 0xff
jmp 0x12a6a0f

Function at 0x13922dd
Capabilities:
Encode data using xor

Disassembly:
xor edx, edi
push 0x35b4c287
call fcn.012b0438

Function at 0x13b74a2
Capabilities:
Authenticate hmac

Disassembly:
push 0x23016933
push 0xb837070e
lea esp, [esp + 0x1c]
jne 0xb50d45
mov edx, 0x2e9a113b
pop edi
Function at 0x13bb77d
Capabilities:
Encode data using base64

Disassembly:
bswap eax
inc eax
and edx, 0xb075a87
xor eax, 0x7390219b
ror word [esp + edx*4 - 0x2c1d2012], cl
bts ecx, edx
xadd byte [esp + edx*2 - 0x160e900a], ch
lea eax, [ecx + eax + 0x59f91588]
shl byte [esp + edx*4 - 0x2c1d2013], 0x63
shr ecx, cl
xor ebx, eax
not cx
add ebp, eax
mov dword [esp + edx - 0xb074805], ebp
ret
add cl, cl
shr word [esp + ecx - 0x5a], 0x2c
rol dx, 1
imul ecx, eax
mov dword [esp], eax
not ecx
xor dx, 0x1cb6
push eax
neg ecx
xor bx, dx
sub edi, 2
push ecx
mov word [edi], dx
rol byte [esp + 0x11], cl
mul eax
sbb cl, al
pop edx
pop eax
pop ecx
pop edx
pop eax
jne fcn.00b67c6c
inc eax
sub cl, dh
sets dl
jle 0x134d6e2
sub edx, edx
adc eax, dword [edi + edx]
lea edx, [edx + edx*2 - 0x60d033f5]
sar dl, cl
xor eax, ebx
imul ecx, edx
push ecx
jae 0x11e4e4a
mov edx, dword [esp]
mov cx, word [esi]
dec dl
add esi, 2
bts edx, edx
movsx eax, dx
movzx eax, byte [edi + eax*4 - 0x9a34]
neg edx
sar dword [esp + edx - 0x4e58d973], 0xc8
lea edi, [edi + edx - 0x4e58d972]
sar edx, 0xe2
xchg word [esp + edx*4 - 0x4e58d970], dx
xor al, bl
xchg dh, dl
ror edx, 0x1b
not al
ror word [esp + edx - 0x72c4d4e1], 0x82
adc dl, 0x89
shr edx, 0x2e
inc al
imul edx, edx
shr byte [esp + edx - 0x373d2367], 0xe5
sal edx, 0x73
neg al
and dword [esp + edx*4 - 0x6d200000], 0x2187468e
bswap edx
xor al, 0x38
and dl, dl
sal byte [esp + edx - 0x481b], 0xe3
add dword [esp + edx*2 - 0x9036], 0x5b152b3f
xor bl, al
xadd word [esp + edx - 0x481a], dx
call fcn.013c1109
mov ecx, 0x8f931d9a
mov ecx, dword [esi]
jmp 0x1277a60

Function at 0x13bd697
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
push ecx
inc ebp
movsx esp, dh
dec eax
shl edi, cl
inc ecx
ror edi, 0xc9
inc edx
xor dword [esp + ebp - 0xf00d808], ebp
inc ecx
sal edi, cl
dec esp
lea ecx, [ebx - 0x10d43e53]
inc ecx
pop ecx
sar dl, 0xc4
dec ecx
sar ebp, 0xc1
dec eax
arpl bp, bp
inc ecx
push edi
inc dx
sar dword [esp + ebp - 0x7806c02], 0x25
inc ecx
rol ah, 0x27
dec esp
add edx, ebp
inc dx
dec dword [esp + ebp - 0x7806bfe]
dec edx
rol dword [esp + ebp - 0x7806c04], 0xb6
dec esi
mov dword [esp + ebp*8 - 0x3c036020], edx
ret
xor ebx, edx
push ecx
add eax, 0x69a29304
adc ebp, edx
cwde
lea edx, [eax + ecx - 0x5577fbe9]
sal edx, cl
mov eax, dword [edi + ecx - 0x7c937c93]
mov dword [esp + ecx - 0x7c937c8f], 0x116991e
pop ecx
mov cl, byte [edx + edi - 0x1c0ffffc]
lea edi, [edx + edi - 0x1c0ffffe]
jnp 0xc1be0f
shl eax, cl
call fcn.00bb081e
dec ebp
inc ecx
movsx eax, di
sar di, 0x8e
ror ebp, 1
inc esp
movsx esi, dl
ror eax, 0xec
inc edx
lea ebp, [ebp + ebp*2 + 0x7138703]
inc ecx
idiv ch
inc ecx
shl ch, 0xc1
jo 0xc19a13
Function at 0x13d6b16
Capabilities:
Encode data using xor

Disassembly:
dec edx
not edx
add edx, 0xdf0a450b
mov dword [esp + eax - 0x2a1e00], ecx
rol ax, 0xa9
xor ebx, edx
bt ecx, 0x8b
not al
shr eax, 0x72
add esi, edx
not al
not ecx
mov edx, dword [ebp + eax*4 - 0x3d4]
xadd word [esp + eax - 0xf4], cx
mov eax, dword [eax + ebp - 0xf1]
shl word [esp + 1], 0x84
push ecx
mov ecx, dword [ebp + 8]
inc word [esp + 1]
dec word [esp + 1]
adc ebp, 4
call fcn.01331fe6
sub esi, 4
mov edx, 0xb5bae198
mov edx, dword [esi]
xor edx, ebx
neg edx
push 0x31a26231
jmp 0xc5e8d6