joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd81d8a
Capabilities:
Encode data using base64

Disassembly:
xor cl, 0x3b
ror cl, 1
not eax
shr edx, 0x62
sub cl, al
and dl, 0x82
mov dword [esp + edx*2 - 0x261ebd04], 0x8d2367a3
xor cl, al
push edx
xor bl, cl
pop eax
call fcn.00d01d3d

Function at 0xd82b0b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x9fb2d139
mov dl, byte [esi]
movzx ax, byte [esi + 2]
pop ecx
lea ecx, [ecx + ecx*4 + 0x741ed38d]
add esi, 2
shl cl, 0x64
ror ecx, 0x10
imul dl
movzx edx, cl
mov word [esi + edx*4 - 0x270], ax
mov ecx, dword [ebp + edx*8 - 0x4e0]
lea ebp, [ebp + edx*2 - 0x134]
movsx eax, dx
add eax, 0xf22ba117
xor ecx, ebx
not ecx
btr edx, edx
ror ecx, 1
rol edx, 0xb6
and eax, eax
sar dl, 0x27
lodsb al, byte [esi]
push ebp
int3
cli
daa
dec ecx
not ecx
inc ecx
cdq
xor edx, eax
rol ax, 0xc6
rol ecx, 1
inc ecx
dec al
rol dword [ecx - 2], 0xc8
sal al, 0x22
xor ecx, 0xcd327fa7
neg ax
call fcn.00da17ba
mov ebp, 0xb87b94a0
mov edx, 0xa5705ba9
xchg esi, eax
salc
test eax, 0xd6cd705b
out dx, al
test eax, 0x8e99705b
add dl, byte [edx]
inc edx
jo 0xd82b60
aas
salc
lds eax, [esi]
pop esp
std
xchg ebx, eax
push 0xfffffffffffffff1
or al, ah
sub ecx, dword gs:[esi]
mov esi, 0x9c70ea59
pushfd
lodsd eax, dword [esi]
salc
js 0xd82b6e
dec eax
aam 0x95
jecxz 0xd82b43
inc ebp
xor edx, esp
sub esp, dword [ebp + 0x13355c64]
test eax, 0x435c7a45
pop ds
mov dword [ebp + 0x7a], eax
pop esp
jge 0xd82c0d
cmc
inc ebp
jp 0xd82c32
imul edx, dword [ecx], 0xfffffffc
bound ecx, qword [eax + 0x5c]
test al, 0x49
sar esi, 0xc3
dec ebp
add ecx, esp
inc ebp
movzx esp, si
dec eax
mov dword [esp + ebx*8 - 0x60120], ebx
movsx eax, bx
inc bp
mov edx, dword [edx + ebx*2 - 0x1804a]
call fcn.00997716
call fcn.00cfde74
Function at 0xd89b80
Capabilities:
Encode data using base64

Disassembly:
idiv eax
inc cx
bt esp, eax
neg bx
inc ebp
movsx esi, bh
xor si, bx
dec ecx
not esi
inc ecx
pop ebp
dec eax
add ebx, esp
movzx bp, byte [ebx + edi - 0x55196fb9]
dec ebp
lea edx, [edx + edi - 0x55196fbb]
inc dx
mov dword [edi + edx - 0x55196fb9], ebp
inc ebx
mov eax, dword [ebx + edi*2 - 2]
dec edi
lea ebx, [ebx + edi + 3]
inc ecx
sar al, 0x66
xor eax, esi
inc ecx
sub eax, edi
sal cl, 0x47
ror eax, 3
inc ecx
lea eax, [edi + eax + 0x2926fd04]
dec esi
lea edi, [esi*8 + 0x1694f029]
dec eax
add edi, edx
xor eax, 0xbd82c695
inc ecx
dec bh
mov ebp, edx
push esi
and bp, 0x9136
inc edx
xor dword [esp + edi - 0x1694f018], eax
pop esi
inc ecx
sal bh, 4
dec eax
shr ebp, 0xc9
movsx ebx, di
dec eax
arpl ax, ax
dec esp
add ecx, eax
inc cx
xadd esi, ebp
dec ecx
imul ebx, esi
jae fcn.0098d067

Function at 0xd92d5c
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + edi*2 - 0x12028], ebx
dec ecx
rol ebp, 0x33
dec eax
arpl di, di
inc edx
sar byte [esp + edi - 0x9009], 0x84
pop ebx
and ecx, 0x3822513f
dec esp
adc ecx, edi
dec ebx
lea edx, [eax + eax - 0x627587c1]
dec esi
sub dword [esp + edi*2 - 0x12030], ebp
inc ecx
pop edi
pop ebp
js fcn.0098d067

Function at 0xd932b9
Capabilities:
Authenticate hmac

Disassembly:
movzx edi, byte [edx + edi - 0x633b499d]
jmp 0xd28fbd

Function at 0xd972ab
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xd59da2ba
xor eax, 0x52333584
mov dword [esp + edx - 0x7fff001f], ecx
xchg ch, cl
ror dword [esp + ecx - 0x6091906f], 0xd2
inc eax
xor ebx, eax
add ebp, eax
bt cx, 0xb6
movzx edx, word [edx + edi - 0x7fff0027]
mov eax, dword [esp + ecx - 0x6091906f]
call fcn.00d4693b

Function at 0xd9ef0c
Capabilities:
Encode data using base64

Disassembly:
rol edx, 1
add ax, 0x50a1
lea edx, [ecx + edx - 0x476ce9e8]
inc ecx
mov dword [esp + eax - 0x5692], eax
xor ebx, edx
ror word [esp + ecx - 0x70a84100], cl
and eax, 0xc9a96996
call fcn.00da020e

Function at 0xda1858
Capabilities:
Encode data using base64

Disassembly:
inc edx
jmp 0xd4fc48
mov edx, dword [ebp]
bts ecx, ecx
adc ebp, 4
xor edx, ebx
lea eax, [ecx*2 - 0x7d1697b]
not ax
dec edx
rol cl, 0xa7
add ax, 0xa63f
mov dword [esp], eax
xor edx, 0x603aa326
not ax
shr eax, cl
rol edx, 2
lea edx, [edx + ecx - 0x4774fd7]
add ecx, eax
xor ebx, edx
add edi, edx
mov edx, ecx
rdtsc
sub cl, cl
shr ecx, 0xb5
lea esi, [ecx + esi - 0x78b]
shl cl, cl
sar ecx, cl
push ecx
mov dword [ecx + esi + 4], eax
js 0xd86c8e
je 0x95bbd5
mov edx, 0x5c98c510
call fcn.00dce2ce
mov eax, 0x91815a0
shr eax, 0x38
mov ecx, dword [edi + eax*2 - 0x12]
mov edx, eax
xor ecx, ebx
mul eax
dec ecx
and dx, dx
bswap ecx
xor ecx, 0x2b80f53b
div ax
add ecx, eax
btr edx, 0x17
div ax
not ecx
xor eax, edx
jnp 0xdc6cea
add byte [eax], al
add byte [edi + 0x6c], cl
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
add byte [edx - 0x3f], bl
pop edx
sal dword [esp + ecx*2 - 0x4b78e052], 0x7c
sbb eax, 0xe8b59681
inc cx
movsx edx, cx
rol eax, 2
bts dx, dx
xor ebx, ecx
imul eax
adc ebp, ecx
call fcn.009808e3
Function at 0xda190c
Capabilities:
Encode data using base64

Disassembly:
pop edx
sal dword [esp + ecx*2 - 0x4b78e052], 0x7c
sbb eax, 0xe8b59681
inc cx
movsx edx, cx
rol eax, 2
dec eax
xor ebx, eax
or dx, cx
adc esi, eax
dec byte [esp + ecx - 0x25bc7028]
lea eax, [ecx + ecx + 0x2490c93a]
or byte [esp + ecx - 0x25bc7028], 0xd
mov eax, dword [ebp + ecx - 0x25bc702a]
call fcn.00c817aa

Function at 0xda1aa2
Capabilities:
Authenticate hmac

Disassembly:
dec ebp
lea ebx, [ebx + ebp - 0x2f3f9590]
dec eax
mov dword [esp + ebp - 0x2f3f9594], 0x5518811c
inc ebp
imul esi, ebp
and di, 0x6c8b
xor edx, esi
dec esp
lea eax, [ebp + ebp*2 - 0x23fafe71]
call fcn.00d0000f
mov eax, 0xbba30f09
mov ecx, dword [edi]
add edi, 4
xor ecx, ebx
ror ax, 0x47
xor ax, 0xff3b
push eax
rol ecx, 2
not ecx
movsx edx, ax
mov dword [esp], edx
btc edx, 0xa
rol ecx, 2
xor edx, 0xb3bb34
xor ecx, 0xd10e228e
inc edx
sub al, byte [esp]
call fcn.00cf57a8
mov eax, 0x47aaa88d
movzx ecx, al
mov cx, word [eax + edi - 0x47aaa88d]
lea edi, [eax + edi - 0x47aaa88b]
xor cx, bx
rol eax, 0x8c
cwde
adc cx, 0xf8b5
cbw
push eax
neg cx
lea edx, [eax + eax - 0x1754c06b]
pop edx
not cx
add cx, 0xba09
add eax, edx
add ax, ax
xor bx, cx
mul edx
sbb ebp, 1
mov word [ebp], cx
inc ax
mov ecx, dword [edi]
bswap edx
lea edi, [edx + edi - 0x6302fdfb]
and edx, 0x21105919
sar dx, 0xa2
xor ecx, ebx
ror eax, 0xd
dec ecx
mul ax
shr dl, 0x81
rol ecx, 1
sar al, 0x21
neg edx
neg ecx
ror al, 0x83
jae 0xc6d588
mov ecx, 0x8926d222
mov edx, 0xf10e3f03
mov dx, word [esi]
add esi, 2
movzx eax, byte [ebp]
add ebp, 1
push ecx
inc cx
lea ecx, [ecx*8 - 0x40e48750]
xor al, bl
inc cl
rol al, 1
btc ecx, 0x13
dec al
and dword [esp + ecx*4 - 0x21682724], 0x6889f5ad
or cl, ch
not al
ror dword [esp + ecx*2 - 0x10b41392], cl
pop ecx
shr ecx, 8
adc al, 0x32
bt ecx, ecx
call fcn.00d2726e

Function at 0xda679c
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov eax, 0x7c29c99c
dec edi
lea ebx, [ebx + eax - 0x7c29c998]
mov ebp, 0xd7be2e80
inc esp
xor edi, esi
movzx ecx, bp
inc ecx
ror edi, 2
dec edx
mov dword [esp + eax - 0x7c29c99c], ebp
inc ecx
movzx edi, ax
inc ebp
lea edi, [edi + ecx*2 + 0xb10bd39]
inc esp
movzx ebp, di
inc ecx
neg al
inc ecx
ror edi, 2
inc esp
movzx esi, cl
inc ebp
lea edi, [edi + ebp - 0x7e3a61dc]
inc ecx
dec esi
inc ecx
xor edi, 0xb8174205
inc ecx
bswap edi
push edi
jmp 0xd5692a
Function at 0xdaa7e6
Capabilities:
Encode data using base64

Disassembly:
xor di, 0xc3bd
neg al
xadd dx, cx
shr byte [esp + edi - 0x939c4c9], 0xc1
xor bl, al
sub ecx, 0xcd2fd50c
xadd dword [esp + edi - 0x939c4cb], edi
lea eax, [esp + eax + 4]
shr edi, 0x43
dec ecx
shl ecx, cl
mov ecx, dword [eax + edi - 0x1feffff8]
mov edi, ecx
push ebp
mov byte [esp + ebp*2 + 1], 3
or dword [esp + ebp*2 + 4], 0x9fae21b5
or ebp, esi
neg dl
movzx ecx, dx
pop edx
pop eax
jne 0xccd65a
dec esp
add ecx, ebx
rol ecx, 0x25
pop ebp
sub ax, cx
jl fcn.0098d067
add byte [eax], al
push ebx
je 0xdaa842
imul ebp, dword [ebp + 0x50], 0x746e696f
jb 0xdaa807
mov edi, 0x939b03c
push edi
dec edi
movzx eax, byte [edi + ebp - 0x939b03b]
inc word [esp + edi*2 - 0x12736076]
movzx ebp, di
xor al, bl
lea edx, [ebp + edi*4 - 0x12e21060]
neg dword [esp + edi*2 - 0x12736076]
btr ebp, edx
sbb al, 0xb2
and word [esp + edi*2 - 0x12736074], 0xd639
ror dword [esp + edi - 0x939b03b], 0x25
xchg byte [esp + edi*2 - 0x12736075], dl
xor al, 0x2a
ror al, 1
lea ecx, [edx + edi*2 - 0xd5353e1]
neg dword [esp + ebp*4 - 0x2c0ec]
bt ebp, edi
not al
shr ebp, 0x3b
rol di, 0xc5
sar dword [esp + edi*2 - 0x12720eec], cl
xor al, 0x81
imul bp, word [esp + edi - 0x9390775]
jno 0xc8ae19
cmp al, 0xc5
dec edi
invalid

Function at 0xdae242
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movzx ecx, dl
mov ecx, dword [esi + edx - 0x7aa96189]
neg dl
mov edx, dword fs:[ecx + edx - 0x7aa96177]
mov ecx, 0x16805b9d
mov eax, 0x168c3938
mov dword [esi + ecx*2 - 0x2d00b73a], edx
movsx edx, al
rol cx, 0xe1
mov edx, dword [edi + eax - 0x168c3938]
neg ax
jne 0xda95fe
mov ecx, dword [edi + eax - 0x20000000]
lea edi, [edi + eax*4 - 0x7ffffffc]
movsx edx, ax
xor ecx, ebx
lea ecx, [ecx + eax*2 + 0x6f035c8f]
imul eax, edx
sar al, 2
neg ax
xor ecx, 0x8295e595
neg ecx
xor ecx, 0x7499f690
rol al, 0x63
jb 0xce1452
dec ecx
sal dl, 0xa1
xor dl, dl
not ecx
dec dl
xor ebx, ecx
call fcn.00ca6eba
mov edx, 0x7aa96189
jmp 0xd19e24
lea edi, [ecx + edi - 0x1680b736]
xor edx, ebx
lea ecx, [ecx + ecx*8 - 0x5c5a74ec]
dec cl
inc edx
push ecx
sar ecx, 0x21
rol edx, 1
push ecx
sal dword [esp + eax - 0x168cc6c4], 0x4c
push ecx
bswap edx
setbe byte [esp + ecx - 0x3715fe0e]
add word [esp + ecx - 0x3715fe08], ax
xor edx, 0xa7b19987
lea eax, [ecx + eax + 0x29b49d97]
lea edx, [edx + ecx - 0x629b2b49]
call fcn.00c8e3c5
inc ecx
bswap esi
div ebp
dec eax
shr edi, 0x51
inc ecx
ror esi, 2
inc ebp
xadd eax, esp
dec ecx
div eax
dec ebp
imul esp, eax
inc ecx
bswap esi
dec ecx
rol eax, cl
inc cx
sbb eax, 0x41663f3e
and esp, 0xd14122ba
invalid
xor eax, edi
inc edx
mov dword [esp + 0xc], 0x4e0dbe9c
push 0x75967b82
push 0x1f359d
xor eax, 0xf625111c
mov dword [esp + 0x10], 0xc928ea29
push 0xd8ae8f24
push 0xb3317a1b
dec ecx
push 0xc3c51b3
call fcn.00d31544
mov eax, 0x1c3399a2
mov ecx, eax
mov edx, dword [ebp + eax*4 - 0x70ce6688]
shl cl, cl
sal eax, 0x5c
lea ecx, [ecx*8 - 0x45d241fa]
mov ecx, dword ss:[edx + eax - 0x20000000]
mov dword [eax + ebp - 0x20000000], ecx
mov ecx, 0x5d2f289c
inc cx
jge 0xd4dbf1
Function at 0xdae91e
Capabilities:
Encode data using xor

Disassembly:
bswap eax
pop edx
jnp fcn.0096f6cc
lea ecx, [ecx + eax*2 - 0x233ff896]
shr dword [esp + eax], 0xd
jns 0xdf2a37
sub edi, 4
mov eax, 0x942e3633
lea ecx, [eax + eax*2 - 0x3d5d81e3]
mov edx, 0xff35bc8d
mov eax, dword [ecx + edi - 0x7f2d20b6]
rol cl, 0x64
xor eax, ebx
inc ecx
js 0xdc5586
lea eax, [eax + ecx - 0x7e925260]
sar edx, cl
sar dl, 0x27
sar ecx, 0xa5
rol eax, 1
mov al, byte [esi + 4]
add esi, 6
mov edx, 0xef1faf92
btr dx, dx
mov byte [ecx], al
lea ecx, [edx + edx*8 - 0x7a4eb9fd]
cmovb ecx, edx
lea eax, [ecx*4 + 0x4cae0eb9]
lea edi, [edi + eax - 0x3e7d751]
inc ecx
not eax
mov eax, dword [edi]
jle 0xd40edb
xor eax, ebx
sub eax, 0x84b20b0f
inc edx
bts edx, 0x95
rol cl, 0x42
neg eax
shl edx, cl
add ecx, edx
rol eax, 3
btc ecx, ecx
jae 0xd6026d
std
xchg ebp, eax
rcl byte [esi - 0x3e], 0x15
cmp bl, byte [edx - 0x7dea341d]
inc esp
shl bl, cl
retf
xor ecx, ebx
cdq
cbw
not ecx
mov dword [esp + edx*4], 0xd798ff01
jmp 0x97fa5f
bswap ecx
cwde
adc ecx, eax
inc dword [esp + eax]
bswap ecx
je 0xce8e6a
ror ecx, 3
xor ebx, ecx
sub dword [esp + eax], edx
xchg byte [esp + eax], al
sbb dx, 0xc987
add edi, ecx
pop edx
mov al, byte [ebp + edx - 0x6bbfc]
lea ecx, [edx + edx*4 - 0x354c664f]
lea ebp, [edx + ebp - 0x6bbfb]
inc cx
xor al, bl
sar edx, 0x1f
and cl, dl
inc al
bswap edx
not al
sal ecx, 0xc7
sbb al, 7
ror al, 1
dec ecx
ror dx, 0xa2
xor bl, al
sal cl, 0x24
shr ecx, 0xf3
adc eax, esp
shl edx, 0x89
or edx, dword [eax + edx]
lea eax, [ecx*4 + 0x522ef525]
push ecx
sub cx, word [esp + ecx - 0xd53]
mov dword [ecx + esi - 0xd4b], edx
mov edx, ecx
sar dx, cl
add eax, 0x502c7c8c
lea esi, [esi + ecx*2 - 0x1a92]
jnp 0x96dbce
sysenter
call fcn.00d4ecbf

Function at 0xdb45b0
Capabilities:
Encode data using base64

Disassembly:
jne fcn.0096f6cc
add byte [eax], al
inc edi
je 0xced081
inc ebp
dec ebp
inc ebx
push eax
add byte [eax - 0x76c25945], bh
movzx ecx, ax
xchg ah, cl
mov ecx, dword [edi + ecx - 0xa6a6]
movsx edx, ax
ror dl, 0xc5
adc edi, 3
and dl, ah
xor ecx, ebx
mul ax
bts edx, edx
bt eax, 0x38
bswap ecx
neg ax
push edx
and edx, edx
xor ecx, 0xa59366b4
shl dword [esp], 0x4a
xor word [esp + 1], dx
cwd
ror ecx, 2
btc ax, 0x2f
cwd
mov edx, 0x99662ff8
sbb ecx, edx
xor ebx, ecx
shl dword [esp], 0xf1
btc eax, 0x2b
cdq
adc ebp, ecx
mov ecx, dword [esi]
dec ax
push edx
inc dx
mov edx, dword [esi + 4]
pop eax
call fcn.00992ce1
mul edx
dec ecx
mov dword [esp + edx*4 - 0x1d8], edx
bswap ecx
rol edx, 2
ror ecx, 3
shr ax, 9
jnp 0xced026
not ecx
lea edx, [edx + edx*4 + 0x72387230]
xor dl, byte [esp + eax - 0x5838000c]
inc ecx
inc word [esp + edx - 0x72387b1e]
and al, al
jno 0xdce73a
bswap ecx
jnp 0xd3936c
shl al, 2
rol ecx, 3
xor ebx, ecx
sub edx, dword [esp + eax - 0x58380030]
dec eax
jae 0x96f691
Function at 0xdb96eb
Capabilities:
Encode data using base64

Disassembly:
and dx, dx
xor bl, al
push ecx
lea eax, [esp + eax + 8]
and dword [esp + ecx - 0x100806a], 0x6582351d
movzx cx, byte [eax + ecx*2 - 0x20100d8]
jnp 0xcc21c5
jg 0xcd0aac
dec eax
and byte [esp + eax*2 - 0x201ffffd], al
sar dx, 0xef
adc edi, ecx
call fcn.00cbadcb
ror eax, 2
shr dl, 0x41
shl ecx, 0x4e
mov dword [esp + ecx - 0x6c800000], ecx
xor ebx, eax
bt cx, 0x90
adc edi, eax
pop edx
btc cx, cx
lea eax, [ecx*2 + 0x4112295]
movzx eax, byte [edx + ebp - 0x6c800000]
btc edx, 0x89
bswap ecx
push ecx
lea ebp, [ebp + edx - 0x6c8001ff]
xchg dword [esp + edx - 0x6c800200], ecx
xor al, bl
and cl, cl
inc al
shl byte [esp + edx - 0x6c8001ff], 0xe4
sal byte [esp + edx - 0x6c8001fd], 0xa1
sbb edx, ecx
not al
rol edx, cl
neg al
dec al
rol dword [esp + ecx - 0x100806c], 0xbb
sar dword [esp + ecx - 0x100806c], cl
or byte [esp + ecx*4 - 0x40201ae], ch
ror al, 1
ror word [esp + ecx*8 - 0x8040360], cl
jae 0xd03b4b
imul cx, cx
rol dl, cl
and cl, ch
add cx, cx
dec dl
imul cx, cx
lea ecx, [ecx + ecx*8 + 0x6098310c]
rol dl, 1
xor cl, cl
jnp 0xd90a17
call fcn.00cacd34

Function at 0xdb9fd7
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
inc ecx
sbb eax, 0xd13be3bd
mov ebp, 0x6f9a3984
inc ecx
bswap eax
call fcn.00c848ae
sal word [esp + 3], 0x6d
inc ecx
bswap eax
inc byte [esp + 2]
jne 0xc977df
lea edx, [eax + edx - 0x47f1d4c9]
and cx, cx
inc ax
bswap edx
jne 0xc7aa57
mov ecx, 0x4511c13c
movzx eax, cx
lea edi, [edi + ecx - 0x4511c140]
rol eax, cl
mov edx, dword [edi + ecx - 0x4511c13c]
shl cl, 0x61
add eax, ecx
xor edx, ebx
and eax, 0xd48db71f
sal ecx, cl
rol edx, 1
add cl, ah
dec eax
xor edx, 0xbba9e883
bt eax, ecx
rol ax, 0x22
rol ax, 5
lea edx, [edx + ecx - 0x436f39e4]
push eax
btr ecx, 0x12
not edx
ror edx, 1
or word [esp + ecx - 0x78000085], ax
inc edx
dec eax
not dword [esp + eax - 0x4018541]
xor ebx, edx
sub ecx, eax
adc ebp, edx
lea ecx, [ecx*4 + 0x6c203baf]
lea edi, [edi + eax - 0x4018545]
pop edx
sar edx, 0x8a
mov eax, dword [eax + edi - 0x4018541]
xor eax, ebx
xor edx, 0x550d1339
ror ecx, 0x74
shl cx, 0xcd
lea eax, [eax + edx - 0x1c3bd30d]
setp dl
bswap eax
or ecx, edx
sbb eax, 0xa6369b20
sal ecx, cl
sal edx, cl
bswap eax
inc dl
sal cx, 0x6c
not eax
call fcn.00d2b920
add ebp, eax
mov dword [esp + ecx - 0x26200a80], 0xbcb5ff2a
movsx eax, word [esp + ecx - 0x26200a80]
xadd al, cl
mov eax, dword [ecx + esi - 0x26200a2a]
mov ecx, dword [ecx + esi - 0x26200a26]
adc eax, ecx
call fcn.00990bbb
inc ebp
mov eax, dword [ebx]
inc esp
xor eax, esi
push 0x9789f29d
jmp 0xd974d9
Function at 0xdba57b
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, edx
call 0x9a0b2f
mov eax, 0xe32aac2a
bts ax, ax
lea edx, [eax + eax*8 - 0xcc3466a]
sbb edi, 3
mov ecx, dword [edi]
xor ecx, ebx
sar eax, 0xf6
rol edx, 0x98
neg ecx
sub ecx, 0xb11a2899
not ecx
lea edx, [eax + edx*2 - 0x35638ca]
or al, dh
lea edx, [eax*2 - 0x38d3f0c3]
inc ecx
rol ecx, 1
cwd
push eax
lea ecx, [ecx + eax - 0x526b18b8]
rol dx, 0x8d
and word [esp], 0x30b4
xor ebx, ecx
add ebp, ecx
bts edx, eax
mov dx, word [esi]
rol eax, 0xbb
mov cx, word [esi + eax - 0x67fffffc]
xor eax, eax
lea esi, [eax + esi + 2]
shr al, 0xc5
and al, al
sub ax, word [esp + eax*4]
and dx, cx
add dword [esp + eax - 0xcf7c], eax
not dx
shr al, 0xa1
mov word [esi + eax*4 - 0x33cf8], dx
xadd dword [esp + eax*2 - 0x19e7c], eax
jne 0xcd2716
mov edx, 0x76079a2b
mov dword [esp + eax], ebp
ret
rol edx, 3
or dword [esp + eax - 0x25b4], ecx
and ax, cx
bswap edx
xchg dword [esp + eax*4 + 8], eax
jns 0x97ec95

Function at 0xdbcb65
Capabilities:
Encode data using xor

Disassembly:
adc eax, edx
call fcn.00d19ea0
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, 0x5d39d507
call fcn.00dd8d5d
add byte [eax], al
inc ebp
js 0xd85675
push esp
js 0xd85679
dec edi
jne 0xd8567c
inc ecx
add byte [esi - 0x3f], ah
rol dx, 0x26
invalid
xchg edx, eax
movsd dword es:[edi], dword [esi]
xchg esi, eax
adc ecx, eax
enter 0x6602, 0xffffffffffffff87
mov word [esp + eax + 0x33f183b0], ss
fcom dword [edx + 3]
invalid
ror eax, 2
xchg word [esp + edx*4 - 0xe7c4ffc], cx
xor ebx, eax
push edx
add esi, eax
mov ax, word [edx + ebp - 0x39f1400]
and dword [esp + edx - 0x39f13ff], ecx
lea ebp, [edx + ebp - 0x39f13fe]
movzx ecx, byte [edi + edx*8 - 0x1cf8a000]
lea edi, [edi + edx - 0x39f13ff]
xor cl, bl
dec cl
sal dx, 0x25
neg cl
pop edx
rol cl, 1
xor dword [esp + edx - 0x3860400], 0x973be8ba
neg dx
neg dl
neg cl
neg word [esp + edx*2 - 0x70df7ff]
sar dword [esp + edx*2 - 0x70df7fd], 0xe1
xor bl, cl
lea ecx, [esp + ecx + 8]
mov word [edx + ecx - 0x386fc00], ax
mov dword [esp + edx - 0x386fc00], esi
ret 4
dec edx
xor bl, al
and edx, edx
mov dword [esp + edx - 0x27], edi
mov dword [esp + edx*4 - 0xdc], esi
mov dword [esp + edx - 0x2f], ebx
mov ebx, eax
shl dx, 0x8d
movzx eax, dx
shl edx, 0x99
adc edx, ebx
shr ax, 0xc8
sal edx, 2
or eax, dword [esp + eax*2 - 0xb8]
mov eax, ebp
shr byte [esp + 7], 0x87
jp 0xd855e7
mov eax, dword [esi]
mov ecx, 0xfc11648d
neg cl
mov dx, word [eax]

Function at 0xdc1ec3
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [ebp]
call fcn.00db82ed
lea esp, [esp + 0xc]
je 0xd0ed0d
mov eax, 0x7304310b
or eax, 0x830ef600
mov eax, dword [ebp + ebx*4]
jae 0xdce3a2
mov eax, dword [esi + eax*4 - 0x210]
not ecx
push ecx
push ecx
adc esi, 3
ror cx, cl
call fcn.00d40c91
hlt
call fcn.00dbb38d

Function at 0xdc487c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0x1fc53727
lea esp, [esp + 4]
call fcn.00d4ad25

Function at 0xdcbffd
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push 0x1f2f541f
lea esp, [esp + 0x18]
je 0x967969
push esi
Function at 0xddc3e6
Capabilities:
Encode data using base64

Disassembly:
pop eax
jnp fcn.00d5d32b
div eax
xor cl, bl
push edx
inc cl
xchg dword [esp + edx - 0xf300003], eax
ror cl, 1
mul edx
cwd
not ax
sbb cl, 0x36
ror cl, 1
call fcn.00d472ec

Function at 0xde2f3a
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov esi, dword [esp + ecx - 0x3588472a]
div cx
dec eax
arpl bx, bx
inc cx
ror ebp, 0x88
inc ecx
pop edi
dec esp
adc ecx, ebx
inc ecx
bt esp, eax
dec edx
lea ecx, [eax + esi - 0x557d2e72]
inc si
mov edx, dword [ecx + edx + 0x557d2971]
dec edx
lea ebp, [0x148a0f30]
inc ecx
pop esp
jb fcn.0098d067
add esi, dword [0x130a2ab8]
je 0xde2f82
jge 0xde2f9c
pop edx
xchg ecx, eax
les eax, [ebx]
jge 0xde2fa2
xchg edx, eax
out dx, eax
insb byte es:[edi], dx
add edi, dword [ebp + 0x1b]
inc esi
xchg esp, ebx
add edi, dword [ebp + 0x1b]
salc
inc ecx
in al, 3
jge 0xde2fb4
lcall 0x3a1b, 0x7d030485
ffree st(4)
add edi, dword [ebp + 0x1b]
cmp bl, ch
les eax, [ebx]
jge 0xde2fc0
add edi, dword [ebp + 0x1b]
xchg ch, bh
cmc
jno 0xde3000
sbb edi, ecx
adc al, 0x62
sbb al, 0xb
pop ss
jns 0xde2fb6
mov bh, ah
cld
xchg edi, eax
test byte [edx], ah
stosb byte es:[edi], al
sub edi, dword [esi]
nop
cmpsd dword [esi], dword es:[edi]
or cl, byte [edi]
pop ds
push es
aam 0x92
les ebx, [edi - 0x37]
cmp edx, dword [esp + ebx*4]
inc dword [esi]
aas
cmp eax, dword [eax]
add byte [eax], al
leave
cmp bl, byte [edx + edx*4 - 0x5b672cc5]
xor bh, byte [edx + 0x32301c66]
imul edx, dword [ebx - 0x1f], 0x7587c230
push cs
push edx
in eax, dx
out 0x58, al
pop edi
xchg edx, eax
dec ecx
dec ecx
xor byte [ecx - 0x76], ah
push dword [esi]
fidivr dword [edx]
mov ebx, 0
xlatb
push esi
loope 0xde2fee
ror byte [ebx + 0x50a942fc], cl
clc
sbb dword [eax], edx
mov edi, esp
inc edx
test eax, 0x1019f850
xchg ecx, eax
cmp edi, dword [esi + 0x930fea6]
xchg esp, eax
sbb eax, dword [eax - 0x33261eaf]
cmp eax, 0xadf24d35
pop edi
push esp
pushal
mov dword [0x4013b86d], eax
push ecx
jbe 0xde3026
inc esi
ljmp 0

Function at 0xde40fc
Capabilities:
Execute syscall

Disassembly:
mov word [esi], ax
push edx
mov ecx, dword [edi - 5]
movzx eax, byte [esp + 1]
lea edi, [edi + eax*2 - 5]
xor ecx, ebx
sar edx, 0xc
ja 0xd6cd1a
lea ecx, [ecx + edx - 0x17794e67]
sar edx, 0xe4
xor ecx, 0x7a03c6b7
neg ax
jo 0xc7ed6f
mul byte [esp + eax*4 + 3]
dec ecx
xor ecx, 0x5b04ef03
and dx, dx
xor edx, eax
mul ax
neg ecx
cwd
xor ebx, ecx
rol edx, 0x35
lea edx, [edx*2 - 0x7eef53d4]
adc ebp, ecx
cdq
mov dword [esp + edx], ebp
ret 4
mov dword [esp + eax - 0x450256d6], 0xe492b9bb
add dword [esp + eax - 0x450256d6], edx
lea ecx, [esp + ecx + 4]
sar dx, 0x25
cwd
movzx ax, byte [ecx + eax - 0x450256d6]
jb 0x95586b
Function at 0xde9c6e
Capabilities:
Encode data using xor

Disassembly:
seta byte [esp + edx - 0x1a2b1262]
mov word [esi + edx*4 - 0x68ac4998], ax
mov eax, edx
mov ecx, edx
cdq
mov dword [esp + edx], ebp
ret 8
xchg esp, eax
add dword [eax], eax
dec edi
fld qword [ecx - 0x1fbbb4c]
lahf
mov ebx, 0x33a1ab29
mov ax, dx
mov cx, word [esi]
mov edx, dword [esp + 3]
setae byte [esp + edx - 0x4a0e8546]
shl edx, 0x48
not ax
je 0x9a5030
push edx
not cx
shr word [esp + edx*8 - 0x742a2ff7], 0x2c
call fcn.00d25623
sub ecx, edx
pop eax
mov eax, edx
bswap ecx
or al, al
add eax, eax
call fcn.00d0e2df
jo 0xde9c27
cmpsd dword [esi], dword es:[edi]
test al, 0x15
and dl, ah
add bh, byte [ebx]
add dword [edx], esp
aam 2
sub ah, byte [ebx + 0x2d42205]
and eax, 0xe51a558b
fstp qword [ebp - 0x38]
leave
push edx
sub ebp, esp
aam 0xca
mov ebp, 0xae376395
mov ebx, 0xcaf1bec6
jb 0xde9d18
rcr byte [edx], 1
pop ebp
pop ecx
das
fucom st(5)
lea esi, [edi - 0xa]
cmp ebx, dword [ebx + ecx*4 + 0x2fe84b48]
pushfd
mov ecx, dword [eax + 0x45]
sbb byte [edi - 0x64], dl
mov ecx, dword [eax + 0x33]
mov esi, 0x8730844f
insd dword es:[edi], dx
mov edi, 0xddab8ee5
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
test al, 0xb8
and dl, ah
add bl, byte [eax + ecx + 0x2d422bc]
xchg esp, eax
sub al, 0xc8
and dl, ah
add ch, cl
pop edx
test byte [edx], bl
in eax, 0xdd
mov edi, 0x659b0a3b
mov bl, 0x48
mov eax, dword [0xb7298715]
test dword [esi + 0x57], esp
xchg dword [ecx], ebp
mov bh, 0x85
push di
outsb dx, byte [esi]
sub al, 0x20
pop ebx
lock sbb dword [eax + 0x6c781363], ebp
sub dword [ebp - 0x4ca8e2e8], ebp
insb byte es:[edi], dx
mov ecx, 0x9414b35d
retf 0xc589
add al, 0x90
movsd dword es:[edi], dword [esi]
lcall 0x9b5c, 0xe10b634c
adc eax, 0x77f74aa3
cmp al, 0xa1
dec eax
mov byte [0xc7d173dc], al
push edi
test eax, 0xbe1cb593
add eax, 0xaa5d9bde
xlatb
inc edx
jae 0xde9ce8
sbb eax, 0x304dc6b0
in eax, 2
xchg esi, eax
xor al, 0x80
outsd dx, dword [esi]
adc dword [eax], edx
push esi
sahf
mov byte [ecx + 0x71e8e595], cl
push edi
push ds
test dword [esi + 0x75], ebp
outsb dx, byte [esi]
cmp al, 0x41
mov bl, 0xed
arpl cx, ax
movsd dword es:[edi], dword [esi]
in al, 0x4b
sbb al, 0x22
popfd
inc ecx
dec esp
xlatb
clc
pop ds
imul esp, dword [edi - 0x4b], 0xffffffa5
jnp 0xde9cf6
invalid
add eax, 0x56a7a687
xor al, 0x2e
jecxz 0xde9d76
pushal
push ss
mov edi, 0x3f54d62e
inc ecx
dec ebp
push edi
xchg dword [ecx - 0x65d9da8b], esp
test byte [edi + eax*2], bl
jae 0xde9d43
pop ds
xlatb
add bh, byte [ebx - 0x3c1a28a7]
mov ebx, 0x3c8cbd4d
xchg dword [edx + 0x1b], eax
adc dword [0xc2f3f852], edi
xlatb
int 0xc4
mov esp, 0x5c1000d3
sbb byte [ebx], 0xea
push 0xfdab1789
pushal
push 0x56
pop ebx
mov dl, 0xc2
jp 0xde9d80
fld qword [ebx]
ret