joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9420c9
Capabilities:
Execute syscall

Disassembly:
jge 0xe494d6
syscall
pushfd
dec eax
mov dword [esp], 0x7f8d5a45
call fcn.00e0120f
inc eax
xor dh, ch
inc ecx
mov ebx, ecx
dec ecx
lea eax, [ecx + edx + 0x171ba7a3]
dec eax
lea ebp, [esp + ebp + 0x18]
inc esp
mov edi, dword [esp + edi - 0x595500f2]
mov edi, dword [edi + ebp - 0x59550100]
inc ecx
push edi
inc ebx
mov dword [edx + ebx - 0x5abeffaf], edi
dec ecx
lea edi, [ecx - 0x78ea2456]
dec esp
mov dword [esp + edi - 0x6ff47652], eax
ret 0x18
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.00a072bf
dec esp
mov edx, dword [esp + 8]
dec ecx
add edx, 0xffb8a2e2
inc ecx
jmp edx

Function at 0x967767
Capabilities:
Encode data using xor

Disassembly:
xchg byte [edi - 0x5374be9b], dh
pop esi
invalid
bswap edx
call fcn.00dc9215
mov eax, 0xcbad8081
inc esp
movzx edi, al
inc edi
mov ecx, dword [esi + edi*2 - 0x102]
dec edi
lea esi, [esi + edi*4 - 0x200]
inc esp
movsx esp, ax
inc ecx
movsx edi, sp
inc ecx
movsx ebp, ah
inc esp
xor ecx, esi
inc ecx
bswap ecx
inc esp
mov edx, edi
inc ecx
dec ecx
call fcn.00e6a1c7
push 0xffffffffffffff96
jp 0x9677c1
add dword [eax + 0xf44cbad], 0x8b47f8b6
invalid
aam 0xb7
mov bh, 0x9e
jg 0x967734
inc ebp
push esp
dec ebp
outsd dx, dword [esi]
cmp dh, 0xec
pop ds
mov dl, 0x75
jge 0x96776f
add ch, 0x7d
ret
sbb eax, dword [eax - 0x62]
mov dword [esi + 0x56], ebx
enter 0xffffffffffffbebf, 0xffffffffffffffd0
xor byte [edi + 0xb301d2d], dh
invalid

Function at 0x9789d7
Capabilities:
Authenticate hmac

Disassembly:
xor bl, cl
xor ax, 0xf508
lea ecx, [esp + ecx + 8]
mov word [esp + eax - 0x5560f502], 0xbe03
mov dword [ecx + eax - 0x5560f508], edx
jns 0xa19d59
pop edx
xor byte [esp + eax - 0x5560f507], 1
lea ecx, [eax + esi - 0x5560f504]
or dword [esp + eax - 0x5560f508], eax
mov dword [esi + eax - 0x5560f508], ecx
movsx ecx, ax
xor al, 0x29
add ax, word [esp + eax - 0x5560f521]
mov dword [esp + eax - 0x5560eacd], ebp
ret

Function at 0x987c07
Capabilities:
Authenticate hmac

Disassembly:
lea esi, [esi + edx*8 - 0x34d]
xadd dword [esp + edx*2 - 0xc4], edx
mov eax, edx
neg dl
xor cl, bl
ror eax, 0xbb
inc word [esp + 8]
rol cl, 1
xor cl, 0x36
neg cl
not dx
inc edx
add cl, 0x8c
dec eax
ror cl, 1
rol dl, 0xc3
rol al, 0x45
inc cl
not eax
sar edx, 0xe
sar edx, 0x3e
xor bl, cl
bswap edx
lea ecx, [esp + ecx + 0x14]
movzx ax, byte [ecx + eax - 0x798729ad]
not byte [esp + 0xe]
lea edx, [edx + edx + 0x372a81b7]
lea ecx, [edx*4 + 0x25253421]
mov word [ebp + ecx - 0x1cf3af7], ax
lea eax, [edx + edx*8 + 0x62e5427]
neg cx
or dl, 0x15
lea ebp, [ebp + edx*2 - 0x6e55036c]
pop edx
pop edx
pop edx
pop edx
pop eax
jne fcn.0097ee22
Function at 0x990a08
Capabilities:
Encode data using xor

Disassembly:
xor ebx, ecx
push eax
mov dword [ebp + edx*2 - 0x5feb9784], ecx
mov dword [esp + edx - 0x2ff5cbbc], edx
push eax
push edx
lea ebp, [ebp + edx*2 - 0x5feb9784]
neg eax
adc dword [esp + edx - 0x2ff5cbb9], edx
sbb byte [esp + edx - 0x2ff5cba8], dl
pop ecx
pop ecx
pop eax
pop edx
pop eax
pop ecx
pop ecx
jg fcn.0097ee22
add edi, eax
mov ax, word [ebp - 2]
rol ecx, cl
neg ecx
movzx ecx, byte [esi + ecx*2 - 0x427ce1ea]
or byte [esp + 0xe], 0x98
call fcn.00996d2f
mov eax, 0x402b5c9b
movzx ecx, al
lea edi, [edi + ecx - 0x9f]
mov ecx, dword [ecx + edi - 0x9b]
sub eax, eax
xor ecx, ebx
movsx edx, al
and edx, edx
dec eax
lea ecx, [ecx + edx - 0x1088a82a]
rol edx, 0x42
xor ecx, 0x5b8afe94
xadd ax, dx
ror ecx, 1
sub edx, eax
dec ecx
not dl
inc edx
jg 0x9b3d2f
call fcn.00a1fffd
xor ebx, ecx
shr eax, 0x17
jns 0xdee924
mov eax, dword [esi + eax - 0x1fb]
sar cl, 0xa3
lea ecx, [ecx + ecx*2 + 0x1615fc0f]
sar cx, 0x4f
mov cl, byte [ecx + esi - 0x1618fff7]
jne 0x9a56d6
xchg ebx, eax
psllw mm2, qword [edx - 0x7a2a0b48]
invalid
add ebp, ecx
mov ecx, edx
mov edx, dword [eax + esi - 0x1ff]
jmp 0xdb65aa

Function at 0x99324c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4c0041f5
inc cx
neg ebp
inc ecx
pop edi
inc ebx
mov byte [esp + ebp*2], ch
inc edi
mov edx, dword [ebp + esi + 1]
movzx ebx, cl
xor eax, 0xd9b60f01
mov dh, 0xd9
dec edi
lea esi, [esi + ebp + 5]
dec eax
ror ebx, 0x55
inc esp
xor edx, esi
inc ecx
ror ecx, 0x36
setb al
inc edi
lea edx, [edx + ebp*2 - 0x2350d3d]
xadd di, dx
call fcn.00dbdb89
lock xchg dword [edi + edx], eax
add al, 3
jae 0x99325c
rcl byte [ebx - 0x6104dd40], 0x5f
jb 0x993232
mov esp, 0x554445f2
adc cl, dh
imul edx, dword [eax + 0x14], 0xac571b73
mov al, 0xef
sub bl, byte [edx - 0x2f]
fsub st(4)
movsb byte es:[edi], byte [esi]
je 0x993324
pop esp
pop ebx
jnp 0x9932ea
inc ecx
jg 0x99325c
adc al, 0xba
jecxz 0x993259
mov dh, 0xea
fsub qword [ebx + 0x67154c4]
call dword [edx - 0x473d35dd]
aad 0x12
mov edx, 0x41c50dcf
fstp dword [edx + edx + 0xe]
pop ecx
push ecx
add dword [ebp - 0x7c], ebp
arpl word [ecx - 0x5f6316da], si
pop edx
insd dword es:[edi], dx
pushfd
fimul dword [edx + 0x63509c2d]
push ebx
inc edx
int1
leave
out dx, eax
bound ebx, qword [edi]
pop ds
retf
push 0x18
clc
in al, 0x36
cwde
invalid
Function at 0x999984
Capabilities:
Execute syscall

Disassembly:
dec ebx
mov dword [ebx + ecx - 0x6a17f78b], edx
inc edi
mov ebp, dword [esi + edx - 0x8b]
inc ebp
mov edi, ecx
dec edi
lea esi, [ecx + esi - 0x6a17f787]
inc esp
xor ebp, esi
inc ecx
ror ebp, 1
inc ebp
xchg ecx, edx
inc cx
ror ecx, 0x86
inc edi
lea ebp, [ebp + ecx*2 - 0x19aff13e]
jae 0xce33ea
mov eax, 0x808d0aa3
dec ebp
mov esp, dword [ebx]
inc ecx
mov cl, byte [ebx + 8]
dec ecx
add ebx, 2
dec eax
lea ebp, [eax + eax + 0x40b1ba8]
movsx ebx, bp
dec eax
shl ebp, 0xb9
dec ecx
shr esp, cl
dec eax
shr ebx, 0xce
dec eax
sub eax, 0x690e4e0f
dec esi
mov dword [eax + ebx - 0x177ebc94], esp
dec eax
lea edi, [eax + ebx*4 + 0x3a9097ad]
inc esp
movsx ebp, al
inc edx
adc ebp, dword [ebx + esi]
dec ebp
lea esi, [esi + eax*2 - 0x2efd7924]
dec eax
lea ecx, [eax + ebx*4 - 0x486a4b78]
push edi
xor ebp, esi
inc ebp
not ebp
inc esp
mov edx, dword [esp + eax - 0x177ebc91]
bswap ebp
inc esp
movsx esp, byte [esp + eax*2 - 0x2efd7927]
call fcn.00a20a46
ror eax, 1
sub eax, 0x3cb6710b
call fcn.00935190
inc ebx
movzx edx, byte [esi + ecx + 6]
inc ecx
movsx ebp, bh
inc eax
xor dl, dh
add dl, 0x18
inc edx
or byte [esp + ecx + 7], ch
jnp 0xe13b93
dec esi
mov dword [esp + ecx - 0x2c02], edi
inc edx
rol dword [esp + ecx - 0x2c00], 3
inc ecx
not ebp
jae 0xe4cda9
syscall
call fcn.00de16d5
xor dl, 0xb0
neg dl
xor dl, 0x84
inc ecx
mov edi, ecx
call fcn.009cd7a7
call 0xe645f2
dec esp
add eax, ebp
inc ecx
movsx ecx, sp
inc dx
not dword [esp + ecx]
jmp 0xcd1066

Function at 0x9a5906
Capabilities:
Encode data using xor

Disassembly:
inc dx
ror cx, 1
dec eax
bswap eax
add cx, 0x549b
mov dword [esp + 4], eax
inc esp
and al, 4
not eax
xor bx, cx
and byte [esp + eax - 0xdefff6], ah
sal al, 0xa6
mov word [eax + ebp - 0xdeffbe], cx
call fcn.00e0a3cd
aam 0xc1
sbb esi, dword [edx + 0x43]
dec esi
xor ah, byte [edi]
pop es
not byte [edx + 0x74d78fbf]
mul dword [ebp + 0x6fff83e0]
or al, 0xf7
movsd dword es:[edi], dword [esi]
loopne 0x9a5915
mov bl, 0x52
inc esi
ret

Function at 0x9a68fc
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
push esp
not ebx
inc ecx
movzx eax, sp
inc ebx
dec edx
add dword [esp - 0x7d5a2962], 0x9915dc00
inc edx
movsx ebp, byte [esp - 0x3ead14ad]
bswap ebx
dec esi
mov dword [esp - 0x7d5a295a], esp
jne 0xdd3fc9
loop 0x9a695b
jecxz 0x9a69ac
xor esi, edx
cmp eax, 0x34d51c7
les ecx, [ecx + ecx*4 - 0x54]
cmp al, 0x82
mov dword [0xf48ffff], eax
sar ebx, 0x41
mov ebx, dword [ebx]
inc ecx
mov cl, byte [ebx + 4]
dec ecx
adc ebx, 2
shr ebx, cl
dec eax
inc dword [esp + 8]
inc ecx
mov dword [ebx], ebx
jp 0xe5b22a
add byte [edi], cl
mov cl, al
dec eax
dec ebx
add byte [edi], cl
pop edi
sar ecx, 1
call dword [ecx + 0x4d]
daa
mov esi, 0xc166232d
loop 0x9a69be
dec esp
mov dword [esp + 0x10], ebp
mov ecx, ebp
inc ecx
pop ecx
pop ebx
inc ecx
pop edx
inc ecx
jmp eax
Function at 0x9d5c7e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8fa85b37
neg cl
mov dword [esp], eax
sub al, 0x80
push eax
not cl
rol cl, 1
xor bl, cl
pop eax
lea ecx, [esp + ecx + 4]
not eax
mov dword [ecx + eax - 0x7057a448], edx
mov eax, dword [esi + eax - 0x7057a44d]
xor eax, ebx
call fcn.00e7c2e1
push ds
cli
out dx, al
in eax, dx
sub dword [ecx], edi
daa
mov dword [0x3d072bcf], eax
stc
mov bh, 0xc7
mov bl, 0x77
pop es
cmp eax, 0xd30f53f9
pop ss
pop es
cmp eax, 0x68e84bf9
cmpsb byte [esi], byte es:[edi]
mov fs, eax
aaa
ja 0x9d5c8f
pushfd
adc dword [ecx], esp
lahf
mov cl, 0x9f
fsub dword [eax + 0xc]
sub ch, byte [ebx - 0x1f55231e]
xor al, 0x30
std
mov byte [0x6340cb98], al
invalid

Function at 0xa1fe9a
Capabilities:
Authenticate hmac

Disassembly:
inc esp
xor ecx, esi
dec eax
add edi, ebp
jns 0xe65fbb
inc ecx
movzx edx, byte [esi]
mov eax, 0x38befd20
movsx ebp, ax
dec ebp
lea esi, [esi + eax - 0x38befd1f]
inc ecx
mov edx, 0xe88e223d
jmp 0x9dea50
dec bl
movsx ebp, cx
inc eax
xor dh, bl
inc esi
movsx ebp, word [esp - 0x8a1a]
dec eax
lea ebx, [esp + ebx + 0x10]
inc si
movzx esp, byte [ebx - 0x11444]
inc di
mov dword [ebx + ebp*8 - 0x38], esp
inc dx
neg dword [esp + ebp - 1]
inc ebp
mov ecx, dword [esi + edi - 0x70168a21]
sar dword [esp + edi - 0x70168a22], cl
inc ecx
shr ebp, 0xb1
dec edi
lea esi, [esi + ebp + 5]
inc ebp
mov edx, ebp
jae 0x937d55
dec eax
rol edx, cl
inc esp
mov esp, ecx
bswap ebp
dec ecx
inc edx
not ebp
jg 0xdb817e
dec ebp
lea esi, [esi + ebx*4 + 4]
inc bl
xadd di, dx
xor ebp, esi
jmp 0x9c0b75
inc edi
lea ecx, [ecx + edi + 0x1c6ccd90]
inc ecx
mov eax, edi
inc ecx
neg ecx
dec edx
not dword [esp + ebp + 4]
dec edx
mov dword [esp + ebp*2 + 8], esi
neg dl
mov ebx, 0xacbb3a18
dec edx
lea esi, [ebx + edi*8 + 0x198039a4]
inc esi
xor dword [esp + ebp*2 + 8], ecx
inc dx
rol dword [esp + ebp*2 + 6], cl
dec edx
mov esi, dword [esp + ebp*2 + 8]
push ecx
push edx
dec ebp
arpl cx, cx
jb 0xddc4e3
dec esp
lea ebp, [ebp*4 + 0x7cb45d3b]
inc eax
xor dl, dh
inc eax
movsx ebx, ch
rol dl, 1
inc cx
sar edx, 0xc8
inc cx
shl ebp, 0x2d
dec ecx
lea ecx, [ebp + eax*2 - 0x45536ce2]
xor dl, 0xbf
sar bl, 0xe7
not ebp
jns 0xa01420
neg dl
dec dl
add eax, 0xeb812204
movsx edi, bl
inc eax
xor dh, dl
or eax, 0x67a7b816
inc sp
xor ebp, ebx
dec eax
adc edx, esp
inc sp
movzx esp, byte [eax + edx - 0x67e7bf36]
movzx edx, di
and al, ah
dec esi
lea ebx, [eax + ebx - 0x67e7bf38]
dec eax
add eax, ecx
inc ecx
mov ecx, 0x3d32b812
dec ecx
sub eax, edx
inc bp
mov dword [ebx + ebp - 0x2df], esp
inc ecx
mov ebp, dword [esi + ebp*2 - 0x5be]
jp 0x9c2f05
inc eax
movsx ebx, bh
dec edx
mov dword [esp - 0x22880], edi
inc ebx
mov bl, byte [esp + esi - 0x8a22]
dec edx
mov dword [esp - 0x8a22], 0xad8c190d
neg dword [esp + edi - 0x70168a19]
inc eax
xor bl, dh
rol bl, 1
inc esp
movsx ecx, word [esp + edi - 0x70168a19]
xor bl, 0xbf
neg bl
dec edx
rol dword [esp - 0x8a1a], 0xdb
jb 0x973a01
inc ecx
bswap ecx
dec eax
xchg ecx, ebp
inc ecx
not ecx
dec eax
adc ecx, edi
inc edx
adc cl, byte [esp + ebp*8 + 0xe]
inc ecx
mov edi, 0x6730a22d
inc ecx
inc ecx
inc eax
sub ch, 0x37
inc ecx
not ecx
inc ecx
and ch, 0x92
inc ecx
movsx edx, di
jno 0x9cddf1
Function at 0xce73db
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x820f823b
sbb dword ss:[eax], eax
bswap ecx
bswap edx
xor ecx, 0xa1b0cba7
xor ebx, ecx
sar byte [esp + edx*2 + 4], 0x81
adc edi, ecx
lea ecx, [edx + edx*4 + 0x3b8cc793]
sar cx, 0xa
sar cx, 0xaa
mov eax, dword [edx + ebp + 2]
sbb ecx, ecx
lea ebp, [edx + ebp + 6]
call fcn.00e5f55a
fidiv word [0xf0745c96]
clc
pop eax
jl 0xce73d2
lodsb al, byte [esi]
invalid

Function at 0xce7a63
Capabilities:
Authenticate hmac

Disassembly:
lea esi, [esi + edx*8 - 0xb]
dec edx
mov dword [esp + eax - 0x7fb6439f], edx
xor ecx, ebx
jmp 0xe42937

Function at 0xce86cc
Capabilities:
Encode data using xor

Disassembly:
inc esi
xchg dword [esp + edi - 0xd], edi
inc eax
xor dl, dh
dec edx
mov dword [esp + edi*2 - 0x1ff7e], 0x1b0c2c90
dec eax
lea ebp, [edi - 0x507bf14f]
inc dl
dec eax
lea eax, [ebx*8 + 0x5faef8a8]
sbb ecx, dword [eax - 0x73]
scasd eax, dword es:[edi]
mov cl, 0xe
test byte [edi - 0x72b73d02], ch
add al, 0xdd
test al, 0xf8
scasb al, byte es:[edi]
pop edi
inc esp
movzx edx, bh
neg dl
inc ecx
neg dl
call fcn.00931bd3
salc
and ah, al
pop ebx
xor edx, ecx
jbe 0x9a82a5
sub bh, ch
xor ah, ch
hlt
inc esi
xor dword [esp + edi + 3], edx
inc ecx
push edi
inc edx
mov dword [esp + edi*2 - 0x1a], 0x1c91cab1
inc edx
movsx esi, byte [esp + edi*2 - 0x19]
dec edx
mov esi, dword [esp + edi*4 - 0x1c]
dec ebp
arpl dx, dx
dec ebp
add eax, edx
inc eax
neg bh
inc bp
mov ecx, dword [ebx + ebx - 0xffcf]
inc ebx
movzx edx, byte [esi + edi - 9]
push ebx
dec eax
ror edi, 0x33
dec edi
lea esi, [esi + edi - 8]
dec esi
mov dword [esp + edi + 0xb], esp
js 0x9a8292

Function at 0xdb03c7
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x5dd4222a
call fcn.009d6aa3

Function at 0xdb1a0e
Capabilities:
Authenticate hmac

Disassembly:
mov word [ebp + edx*4 - 0x3fffe], cx
mov eax, dword [esi + edx - 0x10004]
je 0xde831b
lea esi, [esi + edx*2 - 0x20003]
push edx
mov dword [esp + edx - 0xfff7], edx
xor eax, ebx
movsx ecx, dx
dec cx
sar cl, 0x62
dec eax
xor eax, ecx
dec eax
dec cl
pop edx
xor eax, 0x631ccd94
lea edx, [edx + edx*2 - 0x10cc00c3]
lea eax, [edx + eax - 0x65b15e7b]
neg eax
bswap eax
mov dword [esp], edx
call fcn.00e654bc
movzx edx, byte [esi + eax*2 - 0x48ea00c6]
sal ax, cl
shr cl, 0xe2
pop ecx
adc ecx, 0xffbd781a
jmp ecx
Function at 0xdb31ad
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec ecx
lea edx, [edx + 0x6503fa0f]
inc sp
or edx, ecx
inc ecx
rol cl, 1
dec eax
sal edx, cl
inc ecx
dec cl
inc ecx
xor dh, cl
inc ecx
shr edx, 0x5a
and ecx, 0xf2b54aac
dec esp
adc ecx, esp
ror bl, cl
dec eax
lea ebx, [edi + 0x1e2ad6ae]
dec ecx
mov dword [ecx + ecx*2 - 8], ebp
dec ebp
add edi, eax
inc ecx
jmp edi
dec ebp
lea ebx, [ebx + ecx*8 - 0x810]
dec ecx
shr edi, 0xd6
inc ebp
movzx ecx, byte [esi + ecx - 0x100]
dec al
dec ebp
lea esi, [esi + ecx*2 - 0x203]
dec eax
sbb edx, 0x2c3d17bf
inc ecx
or edi, esp
inc esp
xor cl, dh
inc ecx
sub cl, 0xae
xor byte [esp + edi - 0x36c44b5d], bh
inc ecx
pop esp
dec ebp
lea esp, [edi + eax*8 - 0x11e3abdd]
inc ecx
neg cl
dec ecx
bswap esp
inc cx
xchg edx, ebx
dec esp
lea edx, [edx + edx*4 - 0x77cea756]
inc ecx
not cl
jmp 0x93dcc4
dec esp
adc eax, ebp
mov eax, 0x18bf6628
dec ecx
mov ebp, dword [ebx + ecx*2 - 0x200]
dec esp
mov dword [esp + ecx*2 - 0x208], edi
inc cx
shl edx, 0x27
jbe 0x9b2a30

Function at 0xdbbc0f
Capabilities:
Encode data using xor

Disassembly:
sal dword [0x4c4d89b3], cl
adc eax, ecx
dec ecx
not ebp
inc ecx
pop ebp
call fcn.00df9f8b
shr dx, 0x86
inc eax
push ecx
bswap eax
and ecx, dword [esp + 0x10]
ror eax, 3
sal byte [esp + 0x10], 0x81
mov dword [esp + 4], edx
bswap eax
sub eax, 0x3985758d
sub edx, edx
adc dword [esp + edx + 3], edx
xor eax, 0x15aa6237
call fcn.00dfd19f
cmp eax, 0xc199f9da
xchg byte [esi], cl
push ebx
mov cs, word [eax + edi*2 + 0x5052eb03]
jle 0xdbbc2e
or dl, byte [edi + 0x7e6cef87]
fisttp word [edx]
mov bl, 0xbf
jmp 0xdbbbfd

Function at 0xdbdc5e
Capabilities:
Authenticate hmac

Disassembly:
shr dx, 0xa8
mov dword [esp + eax], eax
xor ecx, ebx
lea eax, [edx*2 - 0x4d7f84f1]
inc ecx
sar byte [esp + edx], 0x66
rol ecx, 1
add dword [esp + edx*2], 0xc2dc511
lea ecx, [ecx + eax - 0x745523eb]
inc ax
rol ecx, 3
not ecx
sar ax, 0xa3
bswap ecx
and word [esp + edx*2 + 2], 0x3c8e
jp 0xdc5825
xor ebx, eax
mov ecx, 0x5032b59a
add edi, eax
movsx eax, cl
mov edx, dword [ebp + ecx - 0x5032b59a]
movzx ecx, byte [esi + ecx - 0x5032b59f]
sub ax, ax
dec eax
xor cl, bl
jmp 0xe61433
inc ecx
bswap ecx
xor ebx, ecx
call fcn.00994f9d
sub esi, 0xfffffffc
mov ecx, 0xb89803bc
add edx, eax
mov eax, ecx
mov ecx, edx
mov dword [esp], eax
movzx edx, byte [edi - 2]
xchg dword [esp + 4], eax
or eax, 0xc12f5508
xor dl, bl
rol dl, 1
jmp 0x93fea3
Function at 0xde0a1d
Capabilities:
Encode data using xor

Disassembly:
inc edx
inc dword [esp + edx + 2]
dec edi
mov ebx, dword [ebx + edx*2 + 8]
call fcn.009bd42b
mov dword [esp + ecx], ebp
ret 0x10
xor ebp, esi
inc ecx
shr bh, cl
dec esi
mov dword [esp + edi*2 - 2], ebp
inc ebp
mov edx, ebp
bswap ebp
not ebp
inc ecx
push edi
ror cx, 0x81
jno 0x9d2d99
inc ecx
mov eax, dword [esi + eax*2 - 0x4c]
inc ecx
mov ebp, 0xa993fa4
dec edx
and dword [esp + edx - 0x24], 0x7c26cb2a
dec edi
lea esi, [edx + esi - 0x22]
dec esi
lea ecx, [ebp*4 + 0x1cb3f7a4]
inc esi
add dl, byte [esp + edx*8 - 0x12b]
inc dx
sar dword [esp + edx - 0x20], 0xa7
xor eax, esi
inc si
xchg dword [esp + edx - 0x1a], edx
inc ecx
neg edx
bswap eax
inc ecx
push edx
ror eax, 1
mov edx, 0x64bbbaa4
dec edx
ror dword [esp + edx + 0x10], cl
sbb eax, 0xff0891bc
movsx ebx, cl
inc edx
sar byte [esp + edx*8 + 5], 0xa6
inc esi
mov edi, dword [esp + edx + 0x13]
xor eax, 0x941cd020
dec edx
rol dword [esp + edx + 0x10], cl
dec edx
mov dword [esp + edx + 0x10], esi
sub cl, 0xb6
inc edx
xor dword [esp + edx*8 + 0x10], eax
dec edx
mov esi, dword [esp + edx*2 + 0x10]
inc ecx
sal dl, 0x25
neg dx
dec esi
or dword [esp + edx*2 + 7], ecx
dec eax
arpl ax, ax
dec ecx
bswap ebp
inc edx
movzx ebp, byte [esp + edx + 2]
dec esp
adc eax, eax
jmp 0x93b7d8

Function at 0xde70aa
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edi
add eax, edx
stc
xor ebx, ebx
mov dword [ebp - 0xc], eax
cmc
stc
test edi, edi
jmp 0xdbcfa7
je 0x936a2e
mov eax, dword [ecx + edx + 0x20]
jmp 0x92bc70
mov edi, dword [ecx + edx + 0x18]
test edi, edi
jmp 0x92ccee
mov dword [ebp - 8], 0xffffffff
cmp ch, 6
cmp esi, 0xffff
jmp 0xe4b5bd
je 0xde70e1
mov eax, dword [eax + 0x7c]
push ebx
test ebp, eax
test esi, 0x54821232
push edi
clc
mov dword [ebp - 0x10], eax
stc
jmp 0x9d8386
pop esi
jmp 0xcec199
ret
mov esp, ebp
pop ebp
jmp 0xce34cf
jl 0x936a2e
jmp 0x966f86
mov dword [esp + eax - 0x52000000], eax
not edx
dec cx
bswap edx
xadd byte [esp + eax - 0x52000000], ch
not edx
call fcn.00e5d969
je 0xde70e1
mov eax, 0x5a4d
cmp ax, 0x4422
test edx, ebx
cmp word [edx], ax
je 0xdf8e3b
xor eax, eax
cmovae si, bx
jmp 0xa2025a
mov eax, dword [edx + 0x3c]
stc
lea eax, [eax + edx]
cmp dword [eax], 0x4550
jne 0xde70e1
mov ecx, dword [eax + 0x78]
cmc
clc
mov dword [ebp - 4], ecx
test ecx, ecx
jmp 0x9df2d9
ja 0x946a34
mov eax, esi
clc
cmp dx, 0x330
sub eax, dword [ecx + edx + 0x10]
jmp 0x936a2b
Function at 0xdeddc1
Capabilities:
Authenticate hmac

Disassembly:
call fcn.00a14f3b
inc ebp
mov ebp, dword [esi]
dec ecx
add esi, 4
inc esp
xor ebp, esi
mov edx, 0x7497bd99
call fcn.00e6cbdf
js 0xdff4ac
mov eax, dword [ebp + ecx - 0x149bdd15]
jmp 0xdb63ae
xor edx, ebx
mov eax, 0xdb895893
mov dword [esp], eax
not edx
lea ecx, [eax + eax*8 - 0x135f6979]
xor edx, 0x4ea6a50c
ror eax, 0x9f
jae 0x9e2079
mov dword [esp + 8], 0xf488c421
neg edx
mov dword [esp + 4], 0xf38dba3e
add ax, 0x5f0a
rol edx, 1
pop eax
not dword [esp + 4]
lea edx, [edx + ecx - 0x5c6b2388]
xor cx, 0x50b5
rol cx, 0x29
xor ebx, edx
add ebp, edx
jmp 0xe75f1a
dec ebx
lea ecx, [esp + edx*8 + 0xabf2094]
xor eax, esi
inc ecx
and ebp, 0xe2a74a3c
ror eax, 2
add cx, bp
inc eax
shr bh, cl
dec eax
rol eax, 1
dec eax
bswap ecx
or edi, ebp
neg eax
sub eax, 0xa4acd282
bswap eax
jmp 0x958881
inc esi
mov ecx, dword [esp + edi*8 - 0x48967]
dec edx
lea edi, [ebp*8 - 0x61fa8ac5]
sub ax, 0xb392
ror ax, 1
inc ecx
mov esp, 0x5e377f2f
inc si
sub ecx, dword [esp + edi*2 - 0x12258]
inc ax
inc edx
sal byte [esp + edi - 0x912b], 0xe1
neg ax
movzx ecx, word [esp + ebx - 0x78987d89]
xor si, ax
inc edx
and dword [esp + edi*4 - 0x244a4], 0xbe81f113
dec edx
adc dword [esp + edi - 0x9124], ecx
call fcn.009f9e92
bswap eax
ror word [esp + 1], cl
mov edx, dword [esi]
sub dword [esp + 4], 0x28f3421
and dword [esp + 1], eax
neg ax
mov cx, word [edx]
call fcn.00de1608
inc ecx
mov eax, dword [esi + edx*4 - 0x1ad34]
dec eax
sar dword [esp + edx - 0x6b4d], 0xe1
inc ecx
pop ebp
inc eax
shl bh, 0xa2
dec ebp
lea esi, [esi + ebp - 0x2cbd6afc]
jae 0x9c9fe3
inc ebp
mov ebp, edi
dec eax
arpl dx, dx
dec esp
add eax, edx
dec edx
mov dword [esp + edi*2 - 0x12250], eax
inc ecx
push ebp
inc edx
movzx eax, word [ebx + esi - 0x15]
shr di, 0x61
dec edi
lea esi, [edi + esi - 0x9129]
dec edx
lea ebx, [edi*2 + 0x78975b37]
dec eax
and dword [esp + ebx - 0x78987d94], ebp
xor ax, si
jmp 0xe4c5a2

Function at 0xdf996b
Capabilities:
Encode data using xor

Disassembly:
jmp 0xcd8cf0
inc ecx
push ecx
inc ecx
movzx ebp, byte [esi + ecx - 0x7f04]
dec esp
lea esp, [ecx + edx*4 - 0x39f6685d]
dec ebp
lea esi, [esi + ecx*2 - 0xfe0b]
dec eax
mov dword [esp + ecx*2 - 0xfe08], edx
inc ecx
rol esp, 0xcf
inc eax
xor ch, dh
inc eax
add ch, 0x20
inc eax
neg ch
inc eax
not ch
inc sp
xor esp, ecx
dec eax
mov dword [esp + ecx - 0x7efa], 0x9a94ee8b
movzx eax, cx
inc eax
neg ch
inc eax
not ch
jmp 0xdd5bc4

Function at 0xe03651
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, eax
rol dx, 0x2b
and cx, 0x7b83
mov dword [ecx + ebp - 6], eax
lea ebp, [ecx + ebp - 6]
mov eax, dword [esi + ecx - 0xc]
not edx
call fcn.00e38974
Function at 0xe03fb3
Capabilities:
Encode data using xor

Disassembly:
or edx, 0xbe81d92d
adc esi, 0xfffffff9
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.009b3a08
push ds
sbb eax, dword [ecx]
mov byte [edi + 0x1d81f4e0], ah
or al, 0x76
sub eax, 0xedfaa921
pop edi
add al, 0xc1
dec ebp
jno 0xe03fd8
cli
in eax, dx
pop edi
add al, 0x1d
xor eax, 0x7d0dace5
mov ds, word [esi + 0x24]
bnd jge 0xe03fdd
pop esi
and al, 0xf2
jge 0xe03fdd
loop 0xe03ff0
jns 0xe04062
jno 0xe03fe2
invalid
jg 0xe03fe8
pop ebx
xchg edx, ebx
rcl edx, 1
or cl, byte [ebx + ecx*8]
invalid
inc eax
mov dword [ecx], edx
mov ecx, dword [esi - 4]
mov edx, eax
xchg dl, al
not edx
xor ecx, ebx
jmp 0x9c4d29

Function at 0xe12ddf
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [edi + edx - 0x523c9724]
xor eax, ebx
xor eax, 0xdb17b017
lea eax, [edx + eax + 0x4b5c9385]
lea edx, [edx*2 + 0x22929939]
or ecx, 0xaeb4078c
mov dword [esp], edx
xor eax, 0x2984321e
inc ecx
inc cl
shr dword [esp], 0x71
neg eax
xor ebx, eax
xchg edx, ecx
lea edx, [ecx + ecx*2 - 0x52c41651]
pop ecx
add ebp, eax
lea edx, [edx*2 + 0x25178891]
or ecx, ecx
mov edx, dword [esi + edx - 0x29d608f5]
mov eax, ecx
jne 0x9c86aa

Function at 0xe12e38
Capabilities:
Authenticate hmac

Disassembly:
dec eax
mov dword [esp + ecx*2 - 0x5782], ecx
inc ecx
neg ah
inc esp
xor ah, bl
xchg ch, dl
mov eax, ecx
inc ecx
neg ah
inc ebp
or cl, cl
inc esp
add cl, bh
sar word [esp + ecx - 0x4fcb], cl
inc esp
xor ah, bl
pop ebp
dec eax
or ecx, dword [esp + ecx*2 - 0x9f8b]
rol byte [esp + ecx - 0x2bcfcf], 0x83
inc ecx
xor dh, ah
dec eax
sub edx, 0x60a6e9b7
add word [esp + ecx*2 - 0x579f89], di
jge 0xe2813a
mov edx, 0x12ab6318
mov ecx, 0x1c99b927
dec ebp
lea esi, [esi + edx - 0x12ab6314]
movzx edi, dx
dec esp
lea edx, [ecx*8 + 0xf2faa19]
xor ebx, esi
dec eax
rol edi, cl
mov eax, ecx
bswap ebx
inc ebp
mov ebp, edx
ror ebx, 1
dec eax
xchg edi, eax
dec eax
sar edx, cl
sbb ebx, 0xff0891bc
sub ax, 0x5438
xor ebx, 0x941cd020
call fcn.009697db
inc ecx
rol ah, 1
inc ecx
dec ah
inc ecx
xor dh, ah
dec esi
lea esp, [esp + 0x28]
dec ecx
mov dword [esp + ebp + 0x70467340], eax
inc eax
rol bh, 0xc3
bswap ebx
inc esi
movzx esp, byte [ecx + esi - 0x2bc7]
inc eax
dec ch
dec ebp
lea esi, [esi + ecx*2 - 0x5793]
pop ebp
inc esp
xor ah, dh
inc ecx
add ah, 0x20
dec ecx
sar ecx, 0x2d
jae 0x9d32f1
dec esi
lea esp, [esp + 0x18]
dec ecx
mov edx, dword [esp + ecx*8 - 0x15e7e78]
sal edi, 0x3a
call fcn.0092adba
inc ecx
mov ebp, 0x591d0686
inc ecx
movsx ecx, ch
inc ecx
movzx edi, ch
inc ebp
mov edx, dword [ebx + edi*2 - 0x10c]
inc esp
movsx edi, bh
inc ecx
push ebp
jmp 0x94f7ef

Function at 0xe1f617
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x490a8f1a], eax
xor ebx, ecx
xor ax, dx
adc edi, ecx
push eax
sal dx, 0xa5
movzx edx, byte [esi + eax - 0x490a8915]
sub dword [esp + eax - 0x490a8908], 0x16a7929a
pop ecx
lea esi, [esi + ecx - 0x490a8915]
xor dl, bl
shr cx, 0x25
rol dl, 1
bswap eax
xor dl, 0x36
neg dl
jmp 0xccf11e