joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb10c63
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx*4], eax
dec word [esp + edx]
sub cl, 0x8d
idiv word [esp + edx + 1]
neg cl
rol dword [esp + eax], 0xf2
jae 0xbcbbb0
xor bl, cl
pop eax
add ecx, esp
mov al, byte [edx + ecx]
lea ecx, [edx + edx*8 - 0x27d3d5c6]
imul ecx, edx
btc ecx, ecx
lea edi, [edx + edi - 2]
neg ecx
bt ecx, ecx
imul ecx, ecx
mov word [edi + edx*2], ax
shr ecx, cl
add edx, dword [edx + esi]
movzx eax, cl
inc cx
lea esi, [ecx + esi + 3]
xor edx, ebx
and eax, ecx
bswap edx
lea ecx, [eax + ecx*2 + 0x40f5b39]
dec cl
neg ax
lea edx, [edx + ecx*2 + 0x5e133c27]
bts eax, eax
sar ax, 0xcd
xor edx, 0x2f26cd26
imul eax, eax
jae 0xc55603
sub esi, 4
mov edx, 0x3d116e12
movzx ecx, dx
call fcn.00c12ff8
mov eax, 0xb98f3a1e
mov edx, 0xb42a2db9
mov eax, dword [ebp]
add ebp, 4
xor eax, ebx
mov ecx, edx
sub eax, 0xbc8b4a2b
not eax
neg ecx
xor ecx, 0xa2f0c3f
ror eax, 3
add cl, ch
lea edx, [edx + edx*2 - 0x44dcf464]
not eax
xchg edx, ecx
dec dl
xor ebx, eax
add dl, cl
neg edx
add esi, eax
movsx eax, dx
mov eax, dword [eax + edi - 0x21e4]
xchg dh, dl
or edx, edx
mov ecx, dword ss:[eax]
call fcn.0078e8f8
not edx
or eax, 0xb7b3622e
cwde
inc ecx
adc edx, 0xfc979f80
ror edx, 2
xchg ah, cl
neg edx
shl cl, 1
ror eax, 0xae
xor ebx, edx
shl cx, 0xef
lea ecx, [eax*4 + 0x4b9223d]
adc ebp, edx
xadd eax, ecx
cwde
lea edx, [eax + ecx + 0x1f39bfac]
jne fcn.007ce517

Function at 0xb19a82
Capabilities:
Encode data using xor

Disassembly:
add ebp, edx
mov edi, dword [edi + eax - 0x57800000]
xadd ecx, eax
sub eax, eax
pop edx
pop eax
jge fcn.00a9ba64
push 0x7a0a5f90
pop ecx
mov cl, byte [esi + ecx - 0x7a0a5f88]
call fcn.00bc2dca
push cs
add byte [esi], cl
movsd dword es:[edi], dword [esi]
dec esp
sbb eax, 0x7c542ba
outsd dx, dword [esi]
ror dl, cl
scasb al, byte es:[edi]
push esi
lds eax, [edi]
outsd dx, dword [esi]
mov ch, byte [eax - 0x60e0b962]
dec edi
popal
inc ebp
xor dword [edi + 0x14], 4
pop es
jns 0xb19a98
and dword [edi + 0x18486bb4], edi
not cl
stosd dword es:[edi], eax
dec eax
sub ch, bl
push edx
add al, 0xf0
add bh, cl
jnp 0xb19aa9
ficomp dword [esi + 0x12]
pushfd
and byte [edi - 0xa], bh
jle 0xb19ae1
aad 0x67
rcl ebx, cl
push 0xcafd3a85
inc edx
mov byte [0x33aba864], al
scasb al, byte es:[edi]
cmp dh, dl
sub ch, dl
cld
mov ebx, 0xd53cecac
cld
mov ebx, 0xd560be89
cld
mov ebx, 0xb41cccd3
std
sub eax, dword [ebp + 0x1d4ca4b4]
hlt

Function at 0xb2305d
Capabilities:
Encode data using xor

Disassembly:
movzx edx, ax
mov dx, word [edi + edx*2 - 0x13400]
sal ax, 0x83
xor dx, bx
sal word [esp + 6], 0xc1
bts ax, ax
mov ecx, eax
rol dx, cl
xor ecx, 0x683767a7
ror dword [esp + 4], 0x48
adc dx, 0xef1b
add word [esp], ax
rol dx, 1
inc dx
neg dx
mov dword [esp], 0x39577c9b
call fcn.00cd9401
mov edx, 0xe4b941bd
push edx
mov ecx, dword [esi]
mov eax, 0xe705d81c
not ax
mov edx, dword [esi + 4]
lea eax, [eax*8 - 0x635364d1]
add ecx, edx
sar eax, 0x2b
lea edx, [esp + 0x14]
push eax
sub dword [esp + 2], 0x9b1ad986
setno al
mov dword [edx], ecx
add al, al
jno 0x78618a
Function at 0xb2f80a
Capabilities:
Authenticate hmac
Encrypt data using chaskey

Disassembly:
inc ecx
rol ecx, cl
ror eax, 1
mov dword [esp], edx
mov byte [esp + 1], dl
lea eax, [edx + eax - 0x5ffdd6f]
bt edx, 0x27
call fcn.00b2b00a

Function at 0xb348c5
Capabilities:
Authenticate hmac

Disassembly:
dec dl
cwde
mov dword [esp + 4], 0x169fc380
ror dl, 1
neg dl
add dl, 0xa7
pop eax
push 0xef141fb3
mov eax, dword [esp + 4]
xor bl, dl
rol dword [esp + eax*4 - 0x5a7f0dfa], 0x61
or al, ah
lea edx, [esp + edx + 0x10]
shr byte [esp + eax*4 - 0x5a7f0f05], 0xe6
mov dword [edx + eax - 0x169fc3c3], ecx
movzx ecx, word [esp + eax - 0x169fc3b7]
add byte [esp + eax - 0x169fc3bd], al
xchg ecx, eax
movzx eax, byte [edi + eax*2 - 0xa176]
add ecx, 0x7e2ca50f
xadd dword [esp + 0xc], ecx
xor al, bl
not al
shr cx, 5
mov edx, ecx
adc al, 0x2a
or dword [esp + 4], edx
neg al
sub al, 0xb2
neg al
neg word [esp + 0xe]
shl dword [esp + 7], 0xf4
jbe 0xb68802
neg edx
xor ebx, edx
add edi, edx
movzx edx, al
call fcn.00d46e5d
inc ecx
push ecx
dec ecx
lea ebp, [esi + ebp - 0x50000008]
dec edx
lea edi, [ebx*4 + 0x2fb96890]
inc esi
xadd dword [esp + esi - 0x50000000], ecx
pop ecx
inc cx
xor ebx, eax
inc ecx
push ecx
neg bx
not bx
inc esi
movsx edx, byte [esp + esi - 0x4ffffff8]
mov eax, 0xb253630
add bx, dx
dec dx
inc ecx
push ecx
div ax
ror bx, 1
inc esp
movzx ebp, al
inc sp
xor eax, ebx
dec eax
lea ebx, [esp + ebx + 0x18]
inc ecx
neg cl
inc ecx
cmovg edx, esi
inc ecx
push ecx
inc ebp
mov esi, dword [esi + ebx - 0x50000000]
dec eax
sub dword [esp + edx + 0x18], esi
inc esi
mov dword [edx + edi], esi
call fcn.007b9164
arpl word [esi + 0x4e], si
sbb eax, 0x51637cf
outsd dx, dword [esi]
std
invalid
rol dl, 0xe6
lea eax, [esp + eax + 0x10]
inc edx
add dx, 0xdd00
mov edx, dword [eax]
mov dword [esi - 2], edx
movzx edx, cx
dec byte [esp + edx - 0xfff6]
lea esi, [esi + edx*8 - 0x7ffea]
setl cl
mov eax, ecx
mov ecx, dword [edi + edx*4 - 0x3fffb]
lea edi, [edx + edi - 0x10004]
xor ecx, ebx
sar dx, 0xce
neg ecx
mul byte [esp + edx - 0xfff5]
not ecx
add dx, dx
jle 0xc0de62
sbb al, 0x34
jmp 0xd3c346
xor edx, edx
setl byte [esp + edx + 8]
xor ebx, ecx
idiv word [esp + edx*8]
add ebp, ecx
not eax
call fcn.00cd94d7
mov ecx, dword [ebp]
xor ecx, ebx
neg ecx
mov eax, 0x2085f53b
btc eax, eax
push eax
not ecx
lea ecx, [eax + ecx + 0x4087b572]
xor ecx, 0xaa2d818f
lea edx, [eax + eax*8 - 0x21cb69f6]
jmp 0x7722a4
neg ecx
pop eax
btc dx, ax
ror ecx, 1
jmp 0xbf7b8d
xor bl, al
inc dx
and dword [esp + 0xb], ecx
mov word [esi + 2], ax
movsx eax, dl
bt dx, cx
movzx eax, byte [edi - 3]
xor al, bl
neg byte [esp + 7]
lea ecx, [edx + edx*2 - 0x2862c06c]
dec al
mov dword [esp + 0xc], 0x39036319
dec word [esp + 4]
dec cx
rol al, 1
add al, 0x81
or cx, 0xb18
neg word [esp + 0xe]
xadd byte [esp + 5], dh
ror al, 1
sar ecx, cl
xor bl, al
jmp 0xb659dc
Function at 0xb359f1
Capabilities:
Authenticate hmac

Disassembly:
lea ecx, [eax + 0x260e68be]
movzx dx, byte [eax + esi - 0x8dc51b]
mov dword [esp + eax*2 - 0x11b8a36], ecx
mov cl, byte [esi + eax - 0x8dc519]
sal ax, 0x43
dec al
setle byte [esp + eax - 0x8d28d7]
lea esi, [esi + eax*8 - 0x46946b4]
or ax, 0x5934
dec al
and dl, cl
lea ecx, [eax + eax*4 - 0xbc919d1]
not dl
not word [esp + eax - 0x8d79f4]
imul ecx, ecx
xchg dword [esp + eax - 0x8d79f6], ecx
movzx eax, byte [edi + eax*2 - 0x11af3e8]
sbb edi, 0xfffffffa
jmp 0xc0e28f
xor al, bl
sub al, cl
shl word [esp], cl
bts ecx, 0x26
lea ecx, [ecx*4 + 0x56b0f220]
not al
ror word [esp], cl
xor cl, 0xac
rol al, 1
call fcn.00d2dd8e
Function at 0xb515d5
Capabilities:
Authenticate hmac
Manually build aes constants

Disassembly:
inc eax
adc bh, 0x33
inc cx
shl ecx, 0xe4
sub al, 0xa3
inc ecx
movsx edx, bp
inc eax
not bh
dec esp
lea ebp, [edx*4 - 0x42647646]
inc eax
adc bh, 0x39
inc eax
neg bh
add bx, 0xa837
dec esp
lea esi, [edx*8 - 0x7643a343]
mul bl
inc eax
xor bh, 0xa3
inc esp
bt ebx, esi
dec ecx
imul ebx
inc ecx
ror ecx, 0xf
inc esp
xor al, bh
dec eax
add edi, esp
inc ecx
xchg ebx, edx
shl cl, 0xa1
inc cx
btr edx, 0xa9
inc cx
mov dword [ebx + edi], esi
dec ecx
or ebp, 0xee996998
dec ecx
bt esi, 0xb9
dec ebp
or ebx, esp
inc ecx
jmp ebx
bswap edx
ror byte [esp + 0x13], 0x42
neg byte [esp + 0xe]
jns 0xd2c0f2
ror eax, cl
push eax
xor dl, 0x2f
sal ecx, 0xa5
dec word [esp + eax - 0x4049c3ab]
sal ecx, 0x31
adc dl, 0x10
sub dword [esp + eax - 0x4049c3a7], eax
push eax
xor dl, 0x1b
lea eax, [eax*8 + 0x241cc090]
inc dl
not dl
sar dword [esp + eax - 0x266adde6], 0x2c
and eax, eax
xor bl, dl
pop ecx
push ecx
xchg cx, ax
lea edx, [esp + edx + 0xc]
and dword [esp + eax*2 - 0x4cd58755], ecx
mov eax, dword [eax + edx - 0x266ac3ab]
movsx edx, cl
bts edx, ecx
sbb esi, 3
imul ecx, edx
jb 0xca5131
mov ebx, 0xe49a728d
movsx ecx, bl
inc esp
movzx ebx, bl
dec ecx
lea ebp, [ebx + ebp - 0x91]
movzx esi, cl
inc ecx
xadd ebx, esi
inc edx
mov edx, dword [ebp + ebx - 0x11a]
inc ebp
movsx edx, bx
sbb bx, cx
inc ecx
xor edx, eax
ror ebx, 0xaf
not edx
inc ecx
bts edx, esi
inc eax
movzx edi, dh
jae 0xc534ca
rol edx, 3
inc sp
imul edx, esi
bts ebx, 0x18
ror si, cl
lea edx, [edx + ecx - 0x1def1b52]
bswap edx
dec eax
sub esi, 0x2184a42d
dec esp
lea ecx, [ebx*4 - 0x5d4785c1]
inc ecx
push eax
inc edx
xor dword [esp + ebx - 0x11a], edx
inc ecx
pop eax
dec ecx
sar edx, cl
movsx eax, si
dec eax
arpl dx, dx
inc ecx
add edx, 0xc805d803
dec esp
lea ebp, [ebx*4 - 0x17ec6363]
ror edi, cl
dec esp
adc esp, edx
inc bx
mov esi, dword [edi + ebx - 0x11a]
dec ebp
lea edi, [edi + edi - 0x467fffe]
dec edx
lea ebp, [ebp + ebx*2 - 0x235]
inc edx
movzx edi, byte [ebp + ebx - 0x11a]
inc ebp
imul edx, ecx
inc ecx
xor bh, al
dec ecx
lea eax, [ebx + ecx + 0x2e347225]
dec ebp
btc ebx, ebx
jae 0xb32868
mov dword [esi], eax
btr ecx, 0x35
sar cx, 0x8b
mov eax, dword [ebp]
sbb dl, dh
ror byte [esp + 9], 0x46
adc ebp, 3
add dword [esp + 8], edx
pop edx
bt ecx, 0x1f
xor eax, ebx
not edx
lea ecx, [edx + ecx*8 + 0x3b33353a]
rol eax, 3
inc dl
neg eax
btc cx, dx
xor eax, 0x393a6203
add eax, 0x6d8de18d
add edx, edx
shr cl, 0xc7
inc byte [esp + 2]
ror eax, 2
sal dl, cl
not eax
xor ebx, eax
push edx
add edi, eax
mov eax, 0xcb1f583b
pop ecx
pop edx
pop ecx
jmp fcn.00ba7e32

Function at 0xb53e58
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [ecx + edi - 0x4222304]
lea edi, [edx + edi - 0x766e34c]
shr eax, cl
call fcn.00c3b86f
call fcn.007fb742
mov ecx, 0x64222b38
mov eax, dword [edi + ecx - 0x64222b38]
lea edx, [ecx + ecx*4 + 0x12bc0b36]
and ecx, edx
jns 0x7c5cd3
Function at 0xb5f335
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x9496a808
mul ecx
sar word [esp + 1], 0x8b
mov ecx, 0x58b08799
jbe 0xd5c569
push edi
mov dword [esp], 0x48bc0b25
call fcn.00b095df
mov ecx, dword [edi]
mov eax, dword [edi + 4]
jmp 0x751a57
sar word [esp + 2], 0x2f
inc eax
sar word [esp + 5], 0x66
neg byte [esp + 1]
rol eax, 2
rol dword [esp + 4], 0xcd
sbb eax, 0x3416c8ac
inc dword [esp + 4]
and dword [esp], 0x8317ae97
rol dword [esp], 0x70
xor ebx, eax
shr byte [esp + 4], 0x61
add ebp, eax
lea esp, [esp + 8]
jmp 0xc311d9
push 0xb99b648b
lea esp, [esp + 4]
jmp 0xb03b4d
call fcn.00ad2c1d
push 0xf78d18b1
ror dword [esp], 0x98
xor eax, ebx
push 0x4c3e85af
sar dword [esp + 3], 0x96
ror eax, 2
not dword [esp]
jmp 0xb7c8a0
or word [esp + 1], cx
xor eax, 0xbd258c2a
lea eax, [eax + edx - 0x54b90800]
xchg dx, cx
sub dl, dl
bswap eax
xor ebx, eax
and word [esp + 1], dx
and edx, dword [esp]
mov dword [edi + edx*8 - 0x7280000], eax
not dword [esp + edx*2 - 0x1ca0000]
mov edx, dword [ebp + edx - 0xe4fffb]
mov eax, ecx
adc ebp, 9
and ecx, ecx
xor edx, ebx
btr ecx, 0x1c
inc ecx
xor edx, 0xae38d617
sal eax, 0x77
adc ecx, eax
sub al, ch
not edx
jg 0xc41de7
mov eax, 0xf7ac940d
bt ax, 0x87
xadd al, ah
sbb edi, 4
xor al, 0x23
mov eax, dword [edi]
jne 0xc4a5f5
mov dword [edi + ecx - 0x58b08799], edx
mov dword [edi + ecx - 0x58b08795], eax
mov eax, 0xee01bab8
mov eax, dword [esi + ecx - 0x58b08799]
lea esi, [esi + ecx - 0x58b08795]
sbb dword [esp + ecx - 0x58b08799], ecx
call fcn.00c8afcf
mov edx, 0x8d13d2b1
neg dl
mov eax, dword [edi]
movzx edx, byte [ebp]
mov ecx, 0x399a5590
xor dl, bl
sar ecx, cl
rol cx, 0xae
rol dl, 1
inc dl
btr ecx, ecx
and cl, 0x1c
and ecx, ecx
neg dl
push ecx
dec dl
add dword [esp + ecx*2 - 0x11c08], ecx
xor bl, dl
lea edx, [esp + edx + 4]
add ecx, 0x2a17e5bb
ror ecx, 0x3a
bt ecx, ecx
mov dword [edx], eax
lea edx, [ecx*2 - 0x5644c373]
movsx eax, cx
mov eax, dword [ebp + 1]
shl dx, 0xcf
shr byte [esp + 3], 0x62
xor eax, ebx
bswap eax
jmp 0xcab454

Function at 0xb6f8af
Capabilities:
Authenticate hmac

Disassembly:
inc bp
movzx ecx, byte [esi + esi*8 - 0x1d8]
inc ecx
pop edx
inc cx
xchg ebp, eax
btr si, 0x84
inc si
mov dword [esi + edi - 0x2f], ecx
jb 0xc16197
inc ecx
rol dh, 0xa1
dec ecx
shr ebx, cl
adc dl, 0xb7
neg cl
inc esp
xor al, dl
jmp 0xc799f2
adc dx, 0x1591
movzx edx, byte [ebp + esi*4 - 0xb3]
ror ax, 9
dec eax
inc eax
dec eax
lea ebp, [ebp + esi*2 - 0x5d]
dec eax
lea edi, [eax*4 - 0x6ae2b5fd]
inc ebp
movsx esi, bx
inc sp
cmovbe esi, ebx
inc ecx
xor dl, al
cbw
dec eax
sal esi, 0xdd
idiv cl
sub dl, 0x9f
rol dl, 1
add cl, ch
neg dl
jmp 0xc04324
Function at 0xb80d83
Capabilities:
Authenticate hmac

Disassembly:
push edx
adc esi, 3
mov ebp, ecx
pop eax
jmp 0xccc3fd
xor ebx, ecx
cwde
add esi, ecx
movzx edx, byte [ebp + edx*8 - 0x38094]
movzx ecx, byte [esp + 4]
and cl, byte [esp + ecx - 0xd]
bt ecx, 0xb1
xor dl, bl
mov dword [esp + ecx + 8], 0x8b1ed27
dec ecx
neg dl
shr cx, 0x87
mov dword [esp], 0xb5a5f921
bswap ecx
adc dl, 0xb2
and cx, 0xef3a
neg dl
sar dword [esp + 3], 0x9a
shl word [esp + 3], 0xe9
sbb cx, ax
adc dl, 1
bswap ecx
xor dl, cl
add ecx, eax
xor bl, dl
cbw
ror ecx, 0x5e
mov word [edi - 2], dx
pop ecx
call fcn.00cf08a8
mov edx, 0xc402a006
mov ebp, edx
sal dx, 0x6f
mov ecx, dword [esi]
jbe 0x77895c

Function at 0xb8c687
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not edx
adc eax, dword [esp + ecx*4 - 0x2541ad40]
sub eax, dword [esp + ecx - 0x9506b50]
cmovns cx, word [esp + ecx - 0x9506b4e]
ror edx, 1
lea edx, [ecx + edx - 0xf79c75f]
shl dword [esp + ecx*4 - 0x2541ad40], 0x95
lea ecx, [ecx*8 + 0x1407ee2a]
ror edx, 1
xor ebx, edx
or word [esp + ecx - 0x5e8b48aa], cx
shr ax, 0xc5
not cx
adc edi, edx
pop ecx
dec al
shr ecx, 0xa3
jnp fcn.00ba7e32
mov eax, dword [esi + ecx - 0x5795de2e]
mov dword [esp + ecx - 0x5795de2e], ecx
mov ecx, dword [ecx + esi - 0x5795de2a]
mov edx, 0x3082d005
sub word [esp + edx - 0x3082d003], dx
btr edx, edx
lea esi, [esi + edx - 0x3082cffd]
inc edx
mov dword [edx + eax - 0x3082d006], ecx
movzx ecx, dl
not edx
lea edi, [edi + ecx*2 - 0x10]
ror edx, cl
shl edx, cl
mov eax, dword [edi + ecx*2 - 0xc]
or dword [esp + ecx*8 - 0x30], 0x7d355e1a
shr edx, cl
adc ecx, edx
xor eax, ebx
not eax
rol byte [esp + edx*2 - 0x67be97d], 0xa6
ror edx, 0xd4
xor eax, 0xafba03b5
add cx, 0x9f3a
lea eax, [eax + ecx*2 + 0x37bb46a3]
and cx, 0xfc9a
ror eax, 1
add edx, ecx
imul ecx, dword [esp + ecx - 0x33d909a]
call fcn.00c595c7
dec cl
mov dword [ecx + esi - 0x10ff], edx
mov edx, dword [ebp + ecx*8 - 0x87f8]
movsx eax, cl
cwde
lea ebp, [ebp + ecx - 0x10fb]
xor edx, ebx
shr ax, 0xf
rol ecx, cl
not edx
push eax
seta al
sal byte [esp + 2], 4
bswap edx
idiv cl
sal byte [esp + 1], 0xc5
sal word [esp], 0x4f
inc edx
jmp 0xc35b4e
or eax, dword [esp]
rol edx, 2
lea ecx, [eax + ecx*8 + 0x12a112a8]
sar ecx, 0xa1
jns 0x7cfb61

Function at 0xb8f22d
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
not dh
inc bp
xor eax, ecx
inc esp
xor esi, edi
dec esi
lea ecx, [esp + ecx + 0x20]
call fcn.00bb1cc7

Function at 0xb9ae3d
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], eax
ror ecx, cl
mov eax, dword [esi]
neg cl
sub cl, cl
adc esi, 4
push ecx
xor eax, ebx
add ecx, dword [esp]
sub edx, 0xc53524b8
bswap eax
and dword [esp + edx - 0x971c5dd], 0xcf3c8216
rol cx, 0x8c
ror eax, 1
ror ecx, 0xfa
sar cx, 8
lea eax, [eax + edx - 0x2f8360f3]
jp 0xd27c32
dec esi
mov dword [esp + ebp - 0xaf], esp
ret 8
xor eax, 0x761ea12e
push 0xaf3f6116
dec edx
lea esp, [esp + 0x10]
jne 0x77cb56
mov ecx, 0xeda9b7b9
pop ebx
mov edx, 0xcea6ea94
inc edx
movsx ecx, dx
not eax
jne 0x7fab71
Function at 0xb9c149
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + edx - 0x7743133e], eax
rol ecx, 3
dec dx
bswap ecx
xor ebx, ecx
add esi, ecx
xor dword [esp + edx - 0x7743133d], edx
xchg dword [esp + edx - 0x7743133d], eax
setae byte [esp + edx - 0x7743133d]
mov cx, word [edi + edx - 0x77431335]
cbw
cdq
cwd
adc edi, 0xa
sar dword [esp], 0x25
xor dword [esp], eax
adc dl, dl
movzx edx, byte [ebp + 5]
ror eax, 0x2c
bswap eax
lea ebp, [ebp + eax - 0x2fce2cf4]
xor dl, bl
call fcn.00c4ebfd
call fcn.00ca7899

Function at 0xb9db8a
Capabilities:
Encode data using xor

Disassembly:
ror edx, 2
bt eax, ecx
setb al
push ecx
sbb edx, 0x8a95d3e
or ecx, ecx
setl al
xchg byte [esp + 3], al
xor edx, 0x1438ce16
shr eax, 0x4c
sbb cl, 0x10
and dword [esp + eax - 0xb74ed], 0xe25d887
xor ebx, edx
dec eax
cwde
add ebp, edx
mov dword [esp + eax*4 - 0x1d3b0], ebp
ret
setns al
xor edx, 0xf2ae5e36
inc ecx
and al, al
rol edx, 1
add edx, 0x349310bb
btc ecx, eax
jae 0x76af7a
inc al
or dword [esp + edx - 0x6b3eb79a], edx
xadd cl, dh
not al
dec dl
call fcn.00c34044
mov al, byte [edi + 4]
jmp 0xd55143
adc esi, 3
xor edx, ebx
idiv cl
inc cx
and ax, 0x6cb2
lea edx, [edx + ecx - 0xb4bb29d]
lea eax, [eax + eax*2 - 0x737546d9]
jns 0xb2ddd8
not ecx
sal dx, 0xae
bswap ecx
call fcn.00d52502
jmp 0xd5867b
mov edx, 0xc583f0aa
and cl, al
not cl
bswap edx
mov word [edi + 4], cx
mov eax, dword [edi + 4]
mov cl, byte [edi + 8]
sub edx, edx
shr eax, cl
shr edx, 0x70
mov dword [edi + edx*2 + 6], eax
lea eax, [edx + edx*8 + 0x3086aa97]
bt edx, eax
lea edi, [edx + edi + 6]
lea ecx, [eax + eax*8 - 0xed10e4e]
lea eax, [ecx + edx*2 + 0x1301102e]
or edx, dword [esi + edx]
sub ecx, eax
jp 0xc470c1

Function at 0xba217b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x5239bb01], eax
mov eax, dword [ebp + ecx - 0x1220bcc8]
lea ebp, [ebp + ecx - 0x1220bcc8]
lea edx, [ecx*4 - 0x74439876]
sbb dword [esp + ecx - 0x1220bcc4], 0x6ca2463a
inc dx
xor eax, ebx
xor ecx, 0xaf03f620
sar dword [esp], 0xdb
js 0xbf078d
and byte [ebp - 0x47f911ae], bh
in al, 0xf3
adc al, 0xbf
sbb cl, byte [eax - 0x5c]
and edi, 0x97b7e41c
xor al, 0xac
invalid
rol eax, 1
lea eax, [ecx + eax - 0xa6eb046]
add word [esp + 1], dx
xadd word [esp + 1], dx
bswap eax
mov dword [esp], edx
sbb eax, 0x794cc2c
neg cl
not eax
sbb eax, 0xa1975b83
sar ecx, cl
sete byte [esp + 3]
xor ebx, eax
inc word [esp + 2]
add edi, eax
xadd edx, ecx
pop eax
jmp edi

Function at 0xbb8b75
Capabilities:
Encode data using base64

Disassembly:
sal word [esp + 4], 0xe1
shrd edx, eax, cl
pop ecx
mov ecx, edx
mov eax, 0xc38f99a
inc eax
lea eax, [esp + eax*2 - 0x1871f316]
mov dword [eax], ecx
mov edx, dword [esp]
jne 0xd4c289
mov eax, 0xc5104485
movzx edx, ax
mov ecx, dword [esi + edx*4 - 0x11214]
jmp 0xc01293
mov eax, dword [ebp]
add ebp, 4
or dword [esp], edx
movsx ecx, dl
xor eax, ebx
xchg dword [esp + 4], edx
add edx, 0x7dbfd
jmp edx
Function at 0xbbc36e
Capabilities:
Encode data using base64

Disassembly:
jb 0xbd6b62
or byte [ebp + 0x1a], cl
enter 0xffffffffffff8646, 0xffffffffffffffe2
and al, 0x1a
int3
mov edx, dword [edi]
mov dword [esp], 0x5b1704b4
dec word [esp + 1]
mov eax, dword [edi + 4]
mov cl, byte [edi + 8]
add edi, 6
shl byte [esp + 3], 0x83
jp 0xcbfd0f
mov cl, byte [edi + ecx - 0x125aabf]
adc edi, 3
shrd ax, dx, cl
mov ecx, 0xe5302da1
shl cx, 0x6e
mov word [edi], ax
mov eax, dword [ebp]
movsx edx, cl
lea ebp, [ebp + edx*2 + 4]
xor eax, ebx
rol eax, 1
neg eax
bswap edx
sub edx, 0x4c271b14
sbb eax, 0xf79fb08e
xadd dx, cx
neg eax
xor ebx, eax
sar edx, 0x79
inc dx
adc dx, 0xc1aa
add esi, eax
sub edx, ecx
jmp esi
xor eax, 0xd827f805
sub cx, 0x1c8b
sal dl, 0x62
xor ebx, eax
jmp 0xce2b6f
sal word [esp], 0xeb
shrd edx, eax, cl
call fcn.00b0345e
shr edx, 0x73
dec eax
btc edx, 0x2b
jb 0xafab26
call fcn.00d3dcc5
neg edx
add ebp, eax
movsx eax, cl
and al, 0xa3
lea eax, [esi + eax*2 - 0x3e]
rol dx, 0x41
btr ecx, ecx
jae 0xc7aab6
mov dword [ecx + esi - 0x4dd3ef75], eax
not dl
movzx edx, byte [edi + ecx - 0x4dd3ef70]
sub cx, cx
btr ecx, 0x3b
sbb cx, cx
lea edi, [edi + ecx - 0x45d3fff9]
mov eax, ecx
add eax, eax
xor dl, bl
ror ecx, cl
neg dl
push eax
xor dword [esp], eax
rol dl, 1
shr ecx, 0x1c
not dl
xchg dword [esp + ecx*4 - 0x20], eax
setae cl
jne 0xd2aa87
neg dl
xor bl, dl
lea edx, [esp + edx + 4]
or eax, eax
adc ecx, dword [ecx + edx]
pop edx
jmp 0xb11544

Function at 0xbc7702
Capabilities:
Encode data using base64

Disassembly:
sal eax, 0x9e
bswap ecx
not ecx
neg ecx
xor ebx, ecx
not dword [esp + eax - 0x3ffffff6]
btc edx, edx
adc ebp, ecx
cdq
shr byte [esp + edx*2 + 0xe], 4
lea ecx, [edx + edx*4 + 0x2e27f52f]
add edx, dword [eax + esi - 0x40000000]
mov eax, dword [eax + esi - 0x3ffffffc]
ror ecx, cl
mov dword [esp], 0x8835ef2a
mov cl, byte [esi + 8]
jb 0x7b5200

Function at 0xbcfb08
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
movzx ecx, ax
not dx
lea edx, [esp + ecx - 0x783d]
call fcn.00aa88fc

Function at 0xbd10fd
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xfe589d7b
call fcn.00c31310
mov eax, 0xfc97658a
mul al
movzx edx, al
mov ecx, dword [edi + edx*4 - 0x190]
mov eax, dword [edi + edx*2 - 0xc4]
or ecx, eax
not ecx
mov dword [edx + edi - 0x60], ecx
lea ecx, [edx*2 + 0x2f1cb087]
push ecx
rol dword [esp + edx*2 - 0xc8], 0x48
mov edx, dword [esi + edx*4 - 0x190]
mov eax, ecx
setb byte [esp + ecx - 0x2f1cb14f]
lea esi, [ecx + esi - 0x2f1cb14b]
add al, 0xa8
xor edx, ebx
inc ecx
sar eax, cl
dec edx
mov dword [esp + eax - 0x2f1c], ecx
xadd dword [esp + ecx*2 - 0x5e3962a0], ecx
call fcn.00ca9e40
cwde
mov ah, byte [edx - 0x36]
invalid
Function at 0xbd21d4
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [edi + 8], ebx
pop eax
push eax
mov dword [edi + eax*8 - 0x5057ada4], ecx
shl dword [esp + eax - 0xa0af5b5], 0x48
lea eax, [eax + eax*2 - 0x315c0748]
mov dword [esp + 4], eax
mov dword [edi], edx
imul dword [esp + 3]
neg byte [esp + edx*4 - 0x11c5fe98]
mov ebx, dword [esp + edx - 0x4717f9e]
push edx
rol byte [esp + edx*2 - 0x8e2ff49], 0x85
call fcn.0075d702
and eax, 0xc7af4972
add al, 0x50
mov eax, 0x4d02530f
xor eax, 0xb8452f25
sbb dword [ebx - 0xc], esi
outsb dx, byte [esi]
dec edi
dec eax
jg 0x773d1e
ljmp 0xbca5:0xa14111af
pop es
das
add al, 0xc1
mov bl, 0x92
xor dword [ebp - 0x5bd3d905], 7
push ecx
in al, 0x3f
enter 0xffffffffffffbe2b, 0xffffffffffffffae
loop 0x773d7d
mov eax, dword [0xf46ca452]
mov bh, 0x36
xor eax, 0xd7839abb
add byte [eax + 0x428efd8], bh
add al, 0x48
das
adc ebx, dword [eax - 0x48]
sti
popal
bound esi, qword [edi + eax - 0x562f2b3a]
push ebx
clc
in al, dx
invalid
jle 0x773df0
imul esi, dword [0xbf0b7a7b], 0x7ee49ea9
or dword [edx + 0x72c75724], ebx
mov esi, 0xb48a23c7
pop es
je 0x773d92
mov dh, byte [edi + eax - 0x5abc048c]
inc ebx
movsd dword es:[edi], dword [esi]
popfd
inc ecx
enter 0x7522, 0x7c
fld qword [ebp + 0x26]
lea esi, [edi]
aad 0x93
mov dword [0x991f1a38], eax
xchg ebx, eax
aaa
xor eax, 0xaf2a2193
bound ebp, qword [ebx + 0x38]
and eax, 0x1786c70
lodsd eax, dword [esi]
dec esi
xchg esp, eax
or dh, byte [edi + ebx*4 - 0x33]
pop esp
add ecx, dword [ecx]
add byte [eax], al
add byte [esi], ch
sub al, 0x42
xor dh, dh
invalid
dec esp
mov ecx, fs
or dh, dh
mov al, 0x9a
mov cl, 0x75
aad 0xb1
fsub qword [esi + 0x6ea1b1d7]
or dh, byte [esi - 0x76]
test al, 0x46
inc dword [edi - 1]
daa
out dx, al
out dx, eax
jg 0x773e0b
imul edx, dword [esi + 0x63], 0x59a72eea
jnp 0x773e74
pop edx
and bl, 0x7b
push eax
cmp dword [eax], edx
ret 0xa99a
cmp dword cs:[esi - 0x45], 0xffffff98
xchg ebp, eax
mov ch, 0x85
push ss
fcmovu st(0), st(0)
cmpsb byte [esi], byte es:[edi]
hlt
jbe 0xc08a7d
mov edx, 0xe5b40a13
movsx ecx, dx
movsx eax, cx
movzx edx, byte [edi + ecx*2 - 0x1427]
not ecx
dec ecx
xor dl, bl
add ax, ax
adc dl, 0x25
push ecx
rol dword [esp + eax*2 - 0x284c], cl
add eax, eax
ror dl, 1
sar byte [esp + eax - 0x284b], 0xc4
not dl
neg cx
sal ecx, 0x3d
ror dl, 1
xor bl, dl
mov word [eax + esi - 0x284e], dx
mov edx, dword [eax + edi - 0x2851]
btr eax, 0xa1
lea edi, [edi + eax*2 - 0x509d]
xor edx, ebx
call fcn.00d18f18
fbld tbyte [esi]
iretd
je 0xcfc43e
sbb edi, 8
push 0xa0af5b4
inc dword [esp]
mov dword [edi + 0xc], eax
jno 0x773c66
mov edx, 0xdbb55c23
movsx eax, dl
lea ebp, [eax + ebp - 0x27]
mov eax, dword [ebp + eax*4 - 0x8c]
xor eax, ebx
mov ecx, 0xe3128f30
shr cx, 0x86
sbb edx, edx
sub eax, edx
neg ecx
bswap edx
xor eax, edx
lea edx, [edx + ecx*8 + 0x62a095bd]
lea eax, [eax + edx*4 - 0x559c2ce3]
not ecx
lea edx, [ecx + edx - 0x7f6644d0]
xor eax, 0x309a2130
add eax, 0x3a9022f
xor ebx, eax
add edi, eax
movzx eax, dl
bts edx, eax
lea ebp, [eax + ebp - 0x48]
movzx edx, byte [ebp + eax - 0x47]
dec cl
dec ax
sal ecx, 0x81
xor dl, bl
xadd eax, ecx
sbb dl, 0x8c
xor eax, eax
neg dl
dec eax
sub dl, al
sar ecx, 0xbd
je 0xb30c2a
Function at 0xbd875a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Parse pe header

Disassembly:
mov dword [esp], 0x486f0995
call fcn.00b095df