joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd4ec77
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
inc edx
movzx ecx, byte [esi + ecx - 0x680c3a53]
inc edx
jnp 0xfd3b40
lea edx, [edx*4 - 0x2348efd6]
xor cl, bl
sub cl, 0x82
lea edx, [edx + edx*2 - 0x574782cd]
ror cl, 1
push edx
neg byte [esp + edx - 0x7c704812]
xor cl, 0x90
dec cl
xor bl, cl
shl dx, 0x44
lea ecx, [esp + ecx + 4]
mov word [edx + ecx - 0x7c708150], ax
movsx ecx, dx
lea esi, [esi + edx - 0x7c708154]
rol dword [esp + edx - 0x7c708150], cl
mov edx, dword [esi + edx - 0x7c708150]
xor edx, ebx
mov dword [esp], ecx
mov byte [esp], cl
dec edx
mov eax, 0x45075ea6
rol byte [esp + eax - 0x45075ea4], 0x43
neg edx
pop ecx
call fcn.00d9f10a
xchg ecx, eax
xor eax, 0x428969a5
bswap edx
cbw
ror edx, 3
xor cl, ah
sal ax, 0xec
bswap edx
rol al, 0xa1
xor ebx, edx
sal eax, 0xee
adc edi, edx
xadd al, ch
lea edx, [ecx*4 + 0x601e97ac]
not cl
mov dx, word [ecx + ebp - 0x2f]
inc cl
inc eax
sub eax, 0x25be6318
mov ax, word [eax + ebp - 0x7a419d5f]
mov cl, byte [ebp + ecx*2 - 0x5c]
push 0xcf808a3d
adc ebp, 4
call fcn.00e87f57
inc ecx
bswap ecx
inc cx
sal ebp, 0x8c
inc ebp
lea ecx, [ecx + edx + 0x133bd28]
js 0x109d8f8
inc ecx
not ecx
inc ebp
lea ecx, [ecx + ebx*4 - 0x7699c920]
inc ecx
pop esi
inc bp
and eax, eax
dec esp
mov dword [esp + ebx + 0x10], edx
jp 0xd79471
mov ax, word [edi]
mov ecx, 0x680cc51d
lea edx, [ecx + ecx*8 - 0x4dfc9ad4]
not cx
lea edi, [ecx + edi - 0x680c3ae0]
xchg dh, cl
lea esi, [esi + edx - 0x5a76e232]
jmp 0xcd3c9c
inc esp
xor dword [esp + ebx*4 + 0x10], ecx
shr esi, 0xb
dec esp
mov edx, dword [esp + ebx + 0x10]
dec ecx
neg eax
inc sp
sbb dword [esp + ebx*2 + 4], eax
inc eax
rol dh, 0x83
dec ebp
arpl cx, cx
not dword [esp + ebx*2 + 1]
dec eax
cwde
dec ebp
lea edi, [eax - 0x34494e7b]
dec ebp
add esp, ecx
dec esp
mov dword [esp + ebx*2], esp
ret 0x10
shl dl, 0x62
dec esi
mov dword [esp + ebx*2 + 0xc90288], esp
ret 0x10
inc si
mov dword [ebx + esi + 0xe795e0], eax
dec ebp
or ebx, esi
jae 0xe23d40
dec edx
mov dword [esp + esi*2 - 0x1cf2bbe], 0x83366093
inc si
xadd dword [esp + esi - 0xe795dc], eax
mov eax, 0x729dda32
inc si
mov eax, dword [edi + esi*4 - 0x39e5774]
inc ebp
movzx edi, dh
dec eax
lea edi, [edi + eax - 0x729dda28]
inc ecx
sub dl, bh
dec ecx
not esi
js 0x108ec1a
mov edx, 0x3187d39
movzx eax, dl
mov eax, dword [edx + esi - 0x3187d39]
movsx ecx, dx
xchg ecx, edx
lea esi, [esi + edx*2 - 0xfa6e]
sub ecx, 0xbebba504
and cx, cx
xor eax, ebx
not cx
sar ecx, 0x76
ror eax, 1
rol ecx, 0xb7
ror cx, 0xc8
shl cl, 0xc1
dec eax
bts edx, 0x23
shl dl, 0x25
rol eax, 3
or ecx, ecx
sar edx, 0x3d
neg cl
not eax
bt cx, cx
sar edx, 0xfe
xor ebx, eax
sal edx, 0x57
inc ecx
lea ecx, [ecx + ecx*4 - 0x44f32e6a]
adc ebp, eax
jmp 0x109fe75
mov eax, dword [edx + edi]
sal dl, 6
xor edx, dword [edx + edi + 4]
lea edi, [edi + ecx - 0x658cd197]
shl cl, 0xa7
or ecx, 0xb21fd202
neg cl
add eax, edx
mov edx, ecx
mov dword [edi], eax
jmp ebp
Function at 0xd53b09
Capabilities:
Encode data using xor

Disassembly:
bswap ecx
lea ecx, [edx + ecx - 0x517ea116]
push eax
cwde
neg ecx
cwd
bswap edx
ror ecx, 2
xor ebx, ecx
sal edx, 0x12
add ebp, ecx
mov dword [esp + 8], edx
mov edx, dword [esi]
push eax
push eax
neg dword [esp + 7]
adc esi, 3
pop eax
call fcn.00ea75ee
adc eax, 0x62e2c100
shl edx, 0x62
neg eax
rol edx, 0xc6
inc eax
mov dword [esp + edx*2 - 0x4d862800], edx
xor ebx, eax
sal dword [esp + edx*2 - 0x4d8627fc], 3
call fcn.00c1ce3e
xchg edi, edi
sbb bh, bh
shr ecx, 0xc8
jo 0xd53ad5
add eax, 0x886fc857
inc eax
and eax, 0x148fef31
mov ecx, 0x51914780
sub eax, 0x331c6e63
xchg edi, eax
scasd eax, dword es:[edi]
add ebx, 0xa1c24f56
xchg esp, eax
xchg ecx, eax
lodsb al, byte [esi]
pop eax
push dword [edx - 0x19]
call [edx]
and al, byte [ecx - 0x7adf6091]
nop
jecxz 0xd53b07
sbb ah, byte [eax + ebx*4]
xchg edx, eax
jns 0xd53bce
mov ss, word [ecx + esi*2]
cmc
fcomp qword [eax + 0x6251e070]
cwde
outsd dx, dword [esi]
cmp al, 0xb4
jno 0xd53b7a
mov edi, 0xb525e48f
pop ss
mov ch, 0x17
xchg ecx, eax
invalid
cmp esi, dword [esi + 0x415b32b1]
add esi, dword [ecx]
sar byte [esi - 0x6b], cl
das
sbb dword [0x5f0b9d40], esi
mov esp, 0x62e8063c
salc
pop edi
xchg ebp, eax
invalid

Function at 0xd5f2ad
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], edx
mov edx, dword [esi]
shr byte [esp], 0x62
adc esi, 4
jmp 0xe6d38f

Function at 0xd6b759
Capabilities:
Encode data using base64

Disassembly:
bswap edx
dec cx
neg edx
bts eax, ecx
sar eax, cl
btc eax, 0x87
not edx
dec eax
sar byte [esp + ecx*2 - 0x25159512], 0x21
call fcn.00bd1e94

Function at 0xd70f52
Capabilities:
Check for vm using instruction vpcext

Disassembly:
adc edi, 3
call 0xe68088
mov esi, 0xd436b92a
movzx edx, si
mov edx, dword [ebp + edx - 0xb92a]
add ebp, 4
lea ecx, [esi*2 + 0x73b8608c]
mov esi, edx
mov edx, 0x9d873201
sal edx, 0x69
jp 0xc8e2c6
inc esp
mov ebx, dword [ebp]
inc ecx
mov edi, 0xb59fea22
inc ecx
mov ecx, 0xb4141c27
inc ebp
movzx eax, bh
dec edx
lea ebp, [ebp + eax*8 - 0x10c]
inc ebp
movzx esi, cl
inc ecx
movzx ecx, dh
inc ebp
xor ebx, edx
movzx edx, cx
inc ecx
inc ebx
inc ecx
xor ebx, 0x9b3bc6b7
inc bp
btr eax, eax
inc edi
lea ebx, [eax + ebx + 0xd0f895f]
inc ecx
bswap ebx
dec edi
lea ebp, [ecx + eax*2 + 0x3427e83b]
inc ecx
not ebx
inc cx
sal esi, cl
inc ecx
xor ebx, 0x513375a3
movzx eax, dx
Function at 0xd730ff
Capabilities:
Execute syscall

Disassembly:
call fcn.0104139c
mov edx, 0x1d307397
mov eax, dword [esi + edx*2 - 0x3a60e72e]
shl edx, 0x8a
add edx, edx
push edx
adc esi, 3
lea edx, [edx*4 - 0x27ef6456]
lea ecx, [edx + 0x5a0c150f]
xor eax, ebx
xor ecx, 0xb73bdbb7
not word [esp + 1]
not eax
xor byte [esp + 1], ch
rol edx, cl
adc eax, 0x2ba84cb5
lea edx, [edx + ecx*8 + 0x17277da7]
ror dx, 0xe3
bswap eax
bswap edx
or edx, 0xbe8d8a03
not cl
ror eax, 1
xor eax, 0x7eba2f80
push ecx
sub eax, 0xef256b86
not eax
rol dword [esp + 2], 0xeb
sal cl, 0xe1
shl edx, cl
xor ebx, eax
add ebp, eax
shr dword [esp + 4], 0xa8
add dword [esp + 4], ecx
rdtsc
ror ecx, 0xe8
sbb edi, 7
inc cl
and cl, 0x2d
mov dword [edi + 4], eax
mov eax, ecx
mov dword [edi], edx
lea edx, [ecx + ecx*2 - 0x41cfc0e4]
pop eax
pop edx
jae fcn.00d62eca
syscall
call fcn.00ed838f
rol ecx, 3
dec dx
dec dx
xor edx, dword [esp + edx - 0x48256d07]
sbb ecx, 0x9b046983
xchg dword [esp + edx - 0xe], edx
shl edx, 0xa8
xor ebx, ecx
add edi, ecx
mov eax, dword [ebp + edx*2 - 0x4ada1200]
and edx, dword [esp + edx*2 - 0x4ada1200]
mov ecx, edx
or ecx, dword [ebp + edx + 4]
lea ebp, [ebp + edx + 8]
mov dword [edx + eax], ecx
mov dword [esp + edx*4], edi
ret 8

Function at 0xd7c98b
Capabilities:
Authenticate hmac

Disassembly:
neg edx
mov dword [esp], eax
rol edx, 1
bswap edx
jmp 0xc55594

Function at 0xd7d2f9
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor ebx, eax
inc ecx
lea ecx, [ecx + ecx - 0x10fe37dc]
sar ecx, cl
add ebp, eax
call fcn.010951c7
push ecx
popfd
movsx ecx, dx
neg ax
mov edx, dword [edi + edx*8 - 0x311c8]
lea edi, [ecx + edi - 0x6235]
and ecx, ecx
sal ecx, 0x10
xor edx, ebx
call fcn.00f1616e

Function at 0xd8098f
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jmp 0xc68428
bswap ecx
ror edx, 1
inc eax
not edx
ror edx, 3
mov dword [esp + eax - 0x41168d73], 0x9f2022bb
pop eax
jmp 0xfb7a3c
xor ebx, edx
xadd cl, al
add ebp, edx
movzx dx, byte [esi]
mov al, byte [esi + 2]
add esi, 2
or cx, cx
push ecx
adc dl, al
add ecx, 0xe2ae5613
xadd word [esp + 1], cx
mov word [esi], dx
jbe 0xcd5a02
pop edx
jmp ebp

Function at 0xd8c157
Capabilities:
Authenticate hmac

Disassembly:
call fcn.00c60baa
jmp 0xc86696
lea esp, [esp + 0xc]
je 0xd9db3c
mov eax, dword [ebp + ebx*4]
call fcn.01028631
xor ebx, edx
mov dword [esp + ecx*2], 0x20af4803
dec ecx
add esi, edx
sal dword [esp + eax], 0x49
call fcn.01044280
jp 0xb8fd42
mov eax, 0xc68fd09c
movsx edx, ax
mov ecx, ebp
bt eax, edx
jae 0xfbd02f
push 0x54a25914
add eax, edx
dec byte [esp + 3]
push 0x7e3dd785
sar byte [esp + 5], 4
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0xe59e90
call fcn.00cb3352
jmp 0xbf1886
xor ecx, 0x4b83229d
lea ecx, [edx + ecx - 0x50705873]
bswap ecx
and eax, edx
shl dl, 0xe3
or dl, al
neg ecx
ror eax, 0xd5
sub eax, eax
xor ebx, ecx
xchg edx, eax
add edi, ecx
jmp fcn.010d94d7
shr eax, 0x7b
lea ebp, [eax + ebp - 0x1a]
cwd
mov word [ebp + eax*8 - 0xc0], cx
mov ecx, dword [esi + eax - 0x18]
not al
lea esi, [esi + eax - 0xe3]
shr dx, 0xe3
xor ecx, ebx
xor eax, eax
sal al, 0xa4
jns 0xfa8733
Function at 0xd925c5
Capabilities:
Encode data using base64

Disassembly:
inc ebp
xor dl, ch
inc ecx
rol al, cl
inc ecx
btc edi, 0x9f
dec edx
lea edi, [edi + ecx - 0x92c]
neg esi
dec eax
inc ecx
dec edx
mov dword [esp + ecx - 0x928], 0x73272d0e
inc esi
mov dword [edi + ecx*4 - 0x24a0], ebp
dec edx
shr dword [esp + ecx*4 - 0x24a0], cl
inc ecx
pop ebp
ja fcn.00d45932
mov edx, 0x60a55696
call fcn.00c5533c
mov edx, 0x2091641c
push edx
shr dword [esp + edx - 0x2091641c], 0x2a
mov eax, dword [esi + edx - 0x2091641c]
lea esi, [esi + edx*2 - 0x4122c834]
xor eax, ebx
movzx ecx, word [esp + edx*2 - 0x4122c838]
sal dx, 0x63
jns 0x10a10bd
mov ecx, 0x61dc6ba
lea ecx, [ecx*4 - 0x5ce34bce]
mov ecx, dword [esi]
mov eax, 0x941623bc
bt eax, 0xe
lea edx, [eax*2 + 0x4f147d84]
mov eax, dword fs:[ecx + edx - 0x7740c4fc]
movzx ecx, dl
neg edx
sar dx, 0xa7
mov dword [esi + ecx*4 - 0x3f0], eax
movsx eax, cx
add eax, 0xad2428ba
mov edx, dword [ebp + ecx*8 - 0x7e0]
lea ebp, [ebp + ecx*2 - 0x1f4]
sar cl, 0x43
call fcn.01001804
neg eax
dec byte [esp + ecx - 0x2459]
rol eax, 3
push ecx
bswap eax
sar byte [esp + edx*2 - 0x412241be], 2
dec byte [esp + edx*2 - 0x412241bc]
lea eax, [eax + edx*4 - 0x4c8b0900]
pop edx
rol cx, 0x4b
shl dword [esp + edx*2 - 0x48b2], 0xce
neg eax
neg cx
sub dx, 0x7c25
xor ebx, eax
xor byte [esp + edx*2 - 0x15068], dh
sar ecx, 0x61
setno byte [esp + edx*4 - 0x2a0ce]
adc ebp, eax
movzx dx, byte [edi + edx*2 - 0x15068]
mov cl, byte [ecx + edi - 0x1b6d]
pop eax
ror ax, 0x6c
sbb eax, 0x12231d16
adc edi, 1
shl dl, cl
mov word [edi], dx
rol al, 0xa6
or eax, 0x938b7c29
movzx ecx, ax
jmp ebp

Function at 0xd9a758
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea ebp, [eax + ebp - 0x7e81ffa2]
inc ebp
xor bl, dl
dec edx
mov dword [esp + edi - 0x7d179306], 0x7355ea8
and edx, 0xadab5ab7
inc ecx
inc bl
sub word [esp + esi - 0x56a7a678], 0x29b1
pop eax
inc ecx
ror bl, 1
inc ebp
mov esi, edi
inc ecx
inc bl
ror word [esp + esi - 0x56a7a67e], cl
inc ecx
xor bl, 0x39
inc ebp
xadd ebp, esi
jne 0x101f2d3
neg word [esp + ecx*2 - 0x5055ffff]
xor eax, ebx
or edx, ecx
not eax
ror eax, 1
shr ecx, 0x65
pop edx
xor eax, 0x4685b1a5
xadd ecx, edx
lea eax, [eax + edx - 0xe579d9e]
sub ecx, 0x82b32caa
ror eax, 1
sal edx, cl
jns 0xf26f78
mov ecx, 0x3ca7f592
movzx eax, cx
mov edx, dword [esi + ecx - 0x3ca7f592]
btr eax, ecx
lea esi, [eax + esi - 0xf58e]
sbb ecx, 0xf8275c2d
lea eax, [eax*4 + 0x825a321]
xor edx, ebx
inc cx
inc edx
xor ecx, ecx
leave
jnp 0xcf174f
xor ebx, eax
bt edx, 0x29
xadd cl, dl
neg cl
add ebp, eax
mov eax, dword [esi + edx*2 - 0x2b000118]
sal ecx, 0xc8
shl cx, 0xc3
adc edx, 0x2a9d58b0
mov edx, dword [esi + ecx - 0x5c89ffc]
lea esi, [esi + ecx - 0x5c89ffc]
and eax, edx
movzx edx, cx
not eax
mov dword [esi + ecx*2 - 0xb914000], eax
sar edx, 0x4a
setns cl
setnp dl
add edx, ebp
jmp edx
Function at 0xdb0cee
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 8]
jne 0xf2bab9
call fcn.00c344d2
mov eax, 0x4210202b
lea ecx, [eax + eax*4 - 0x525093fd]
dec ecx
mov ecx, dword [edi + eax - 0x4210202b]
xor eax, 0x6da49899
mov ax, word [edi + eax*2 - 0x5f697160]
mov edx, 0xf360a9d
lea edi, [edi + edx*2 - 0x1e6c1534]
sal dx, 0x41
or edx, edx
mov word [ecx + edx*4 - 0x3cd854e8], ax
movsx ecx, dx
lea esi, [esi + edx - 0xf36153e]
mov eax, 0x7134c234
mov edx, dword [esi + edx*4 - 0x3cd854e8]
ja 0xfe65c6
dec edx
not dword [esp + ebx - 0x14b67e88]
dec edx
mov dword [edi + ebx*2 - 0x296cfd16], esi
inc dx
sal dword [esp + ebx - 0x14b67e7e], cl
dec esi
mov dword [esp + ebx*2 - 0x296cfd16], esp
ret 8
mov eax, 0xc3bd18a3
sub eax, 0x6c3f283b
seto al
mov eax, dword [ebp + ebx*4]
call fcn.00f1af7e

Function at 0xdbed79
Capabilities:
Encode data using xor

Disassembly:
dec ecx
inc ecx
dec eax
mov dword [esp + 8], 0xb33ac32d
xor edx, 0x3f33d2be
call fcn.00c49d25

Function at 0xdca42a
Capabilities:
Authenticate hmac

Disassembly:
push ecx
mov ecx, 0x8abf730d
mov ecx, dword [esp + ecx + 0x75408cf3]
mov dword [esp], 0xd97afd3c
call fcn.00d6637b
mov eax, 0xc7887ea1
mov eax, dword [esi]
mov ecx, 0xa7a24a18
bt cx, cx
adc ecx, ecx
lea esi, [esi + ecx - 0x4f44942c]
add ecx, ecx
sbb cx, 0x8b09
shl ecx, 0x52
xor eax, ebx
sar cl, 0x84
add ecx, ecx
jg 0xba96e4
mov edx, 0xb9b3899f
movzx eax, dx
btr edx, 0x3b
mov edx, dword [eax + esi - 0x899f]
lea ecx, [eax + eax + 0x1517d9bd]
lea esi, [esi + eax*2 - 0x1133a]
sal eax, cl
ror ecx, cl
xor edx, ebx
add ax, 0xd097
xor ax, cx
inc edx
lea eax, [eax + ecx - 0x596c4671]
dec ax
ror edx, cl
neg edx
sar eax, cl
jnp 0xf46f8e
ror edx, 1
xor ebx, edx
add edi, edx
mov dx, word [ebp + eax - 0x106c6a39]
mov cl, byte [ebp + eax*4 - 0x41b1a8e2]
ror ax, 0x6b
setb al
lea ebp, [ebp + eax - 0x106c46fe]
shr dx, cl
sub ax, ax
lea ecx, [eax - 0x2b4cb0ec]
mov word [eax + ebp - 0x106c0000], dx
cbw
jns 0xdcc19d
neg eax
dec eax
shr cl, 0xe7
not eax
xchg ch, cl
ror ecx, 0x5e
inc eax
call fcn.00d99a5a
mov dword [esp], 0x6f2d0906
shl word [esp + 2], 0x4f
dec eax
ror word [esp + 0xe], 0x46
xor ebx, eax
sar word [esp + 0xc], 0xa1
shr dword [esp + 9], 0x3a
sub word [esp + 6], 0xdd0c
add edi, eax
lea esp, [esp + 0x10]
jmp 0xb99ac8
rol ax, 0xe5
jmp edi
xor ecx, ebx
and ax, dx
rol eax, 0x95
neg ecx
ror dx, 0x83
adc dx, dx
dec ecx
sal dl, 0x45
sar dl, 0xe4
ror ecx, 3
dec ecx
not eax
call fcn.00ba01f1

Function at 0xdcdd89
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ebp + edx*4 - 0x163540f8]
jae 0xbc7bd2
xor ecx, 0xbb3dcb8d
lea eax, [edx + edx*2 + 0x39375593]
cwde
xchg dword [esp + eax*4 - 0x1be40], edx
inc ecx
shr al, 0x23
push edx
xchg dword [esp + eax*2 - 0xde14], eax
not ecx
sbb byte [esp + 0x13], 0xb2
bswap ecx
add dl, 0x22
call fcn.00ecb8d8

Function at 0xdcddc1
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp]
jmp 0xb8521c
Function at 0xdd5f35
Capabilities:
Encode data using base64

Disassembly:
bts cx, dx
inc ecx
mov edi, 0x8fb30fbe
dec edx
lea edi, [edi + ebp + 0x2562be2c]
jae 0xfd981b
dec edx
mov dword [esp + eax - 0x43a7ef8e], 0x90bd8415
inc dx
mov dword [edi + eax - 0x43a7ef8e], eax
inc ecx
mov ecx, 0xe11a560d
dec esp
lea ecx, [ebx*8 - 0x27553b00]
inc ecx
pop ecx
pop ebx
inc ecx
pop ebp
jae fcn.00d45932

Function at 0xddb21b
Capabilities:
Execute syscall

Disassembly:
add esi, eax
xchg byte [esp + ecx - 0x4b7da7f7], cl
call fcn.00eee3a1
syscall
push edx
dec eax
mov dword [esp], 0x38a7a579
call fcn.00dd142f
mov edx, dword [esi + 4]
mov cl, byte [esi + 8]
add esi, 6
shld eax, edx, cl
mov ecx, dword [esp + 8]
add byte [esp + ecx - 0x5e45016f], 0xb3
mov dword [esi + ecx - 0x5e450178], eax
adc cl, 0x3c
sub cx, cx
add word [esp + ecx - 0x5e44fffb], 0x8d09
mov dword [esp + ecx - 0x5e450000], ebp
ret 8

Function at 0xde25b5
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec esi
mov dword [esp + ecx - 0x40010d7], ebx
dec esi
mov edx, dword [esp + ecx*2 - 0x80021ae]
setb al
inc esp
xadd edx, eax
dec eax
arpl si, si
dec esi
mov dword [esp + ecx - 0x40010df], ebp
dec esp
adc esp, esi
inc ecx
xor cl, ch
dec eax
mov edx, edi
inc ecx
mov esi, ebx
inc edx
sar dword [esp + ecx - 0x40010d5], cl
dec ecx
lea edi, [ecx + edi - 0x40010e3]
call fcn.00c29e95

Function at 0xde912b
Capabilities:
Encode data using base64

Disassembly:
sar dword [esp + 4], 0xdb
push 0x6a332338
test ecx, ecx
lea esp, [esp + 0xc]
je 0xff9dcc
call fcn.00d731f7
sub edi, 4
mov eax, 0x5ea4f885
movsx edx, al
lea ecx, [edx - 0x775fccde]
mov edx, dword [edi + eax - 0x5ea4f885]
xor edx, ebx
neg eax
bswap edx
xor edx, 0xc3680a0
neg edx
rol edx, 1
neg ecx
xor ebx, edx
add ebp, edx
movsx edx, cx
mov eax, dword [ecx + esi - 0x775fcd59]
mov edx, dword [ecx + esi - 0x775fcd55]
rol cx, 0xe1
mov cl, byte [esi + ecx - 0x775f9aab]
call fcn.00dcfa82
not edx
mov dword [ebp], edx
mov ecx, 0xd882c538
jmp esi

Function at 0xe0467f
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + 8], 0x381215fb
dec eax
lea esp, [esp + 8]
call fcn.00dd142f
Function at 0xe04692
Capabilities:
Encode data using base64

Disassembly:
call fcn.00d45355
xor bl, al
inc dx
lea eax, [esp + eax + 4]
add dl, dh
mov byte [edx + eax - 1], cl
ror byte [esp + edx*4 - 2], 0xa2
xadd dword [esp + edx - 1], edx
lea edi, [edx + edi - 4]
push edx
movzx eax, word [esp + edx + 3]
mov ecx, dword [edi + edx*2]
seta byte [esp + edx*8 + 3]
pop eax
shl eax, 0xa2
xor ecx, ebx
or dword [esp + edx], eax
cbw
neg eax
neg ecx
btr eax, eax
bswap eax
jae 0x108c3e3
push edx
lea edi, [ecx + edi - 1]
sal dword [esp + ecx*4], 0x49
adc cl, byte [ecx + edi]
call fcn.00ef112e
add esi, ecx
lea esp, [esp + 8]
jmp 0xbbc4ab
bswap ecx
ror ecx, 3
sub ax, 0x8402
neg dword [esp + edx + 4]
sets dl
xor ebx, ecx
pop eax
rol dword [esp + edx - 1], 0xe2
add esi, ecx
xor al, byte [esp + eax*2 - 0x1f5]
mov dword [esp + edx - 1], esi
ret
xor ecx, 0x4b26652d
ror ecx, 2
sal dword [esp + edx], 2
ror edx, 0x31
push eax
xor ecx, 0x54303424
xor eax, 0x91afc632
dec al
jl 0xe42b6f
neg al
bswap edx
sal cx, 0xad
neg dl
xor bl, al
add eax, esp
rol dl, 0x22
shl edx, 0x71
sub edx, edx
add dl, byte [eax + edx]
call fcn.00e3958d

Function at 0xe07120
Capabilities:
Authenticate hmac

Disassembly:
dec edx
lea ebp, [ebp + eax - 0x65b8bb06]
inc ecx
movsx ebx, di
inc ebp
xor esi, edx
inc esp
movsx ebp, al
inc ecx
inc bh
dec eax
mov dword [esp + eax - 0xbb0a], eax
inc ecx
inc esi
inc ecx
mov ebx, 0x19aa5521
inc bp
bt edi, eax
inc ecx
xor esi, 0x9b3bc6b7
dec ebp
lea ecx, [edi + 0x301b3885]
inc dword [esp + eax*4 - 0x2ec24]
setl byte [esp + eax*2 - 0x17613]
inc ebp
lea esi, [esi + eax + 0xd0ece77]
dec eax
inc dword [esp + eax - 0xbb0a]
inc cx
ror ecx, 0x8e
inc ecx
bswap esi
dec eax
cdq
inc ecx
not esi
inc ecx
xor esi, 0x513375a3
dec esp
mov dword [esp + eax - 0xbb0a], edx
btr ax, 0x11
inc esp
xor dword [esp + eax - 0xbb08], esi
inc ecx
pop edx
dec ecx
ror ecx, 0x43
setb bl
dec ebp
arpl si, si
call fcn.00c0e202

Function at 0xe1fbc2
Capabilities:
Encode data using add xor sub operations

Disassembly:
cli
push edi
neg edx
inc ebp
movzx eax, bh
neg edx
inc ebp
movzx eax, bh
inc ecx
bswap ebx
inc edx
neg dword [esp + edi - 0x43419413]
ror edx, 1
not edx
inc edx
inc dword [esp + edi - 0x43419413]
inc ecx
inc edi
dec esp
mov dword [esp + eax - 0x400000b8], edx
inc cx
ror ebx, 3
xor dword [esp + eax - 0x400000b8], edx
dec esp
mov dword [esp + eax - 0x400000c0], eax
inc ax
dec esi
mov edx, dword [esp + edi - 0x43419417]
dec ecx
sar edi, 0x8a
inc esi
xchg dword [esp + edi*2 - 0x21a0ca], eax
dec eax
arpl dx, dx
dec edx
sub dword [esp + edi - 0x10d065], eax
inc dx
and dword [esp + ecx*2 - 0x1cf], 0x4166d930
add ebx, 0x134cbebc
loop 0xe1fbc0
fadd dword [edi + ecx - 0x49]
invalid
Function at 0xe32526
Capabilities:
Authenticate hmac

Disassembly:
pop edx
mov dword [esp + edx - 0x6298320a], ebx
bts edx, 8
sbb edx, edx
mov ebx, eax
jno 0xc866be
mov ecx, 0xe31f432b
call fcn.00f5b683
btr edx, 0xae
xor bl, al
mov dword [esp + edx - 0x17408e7e], 0x62bd100a
mov word [esp + edx*4 - 0x5d0239f7], 0x9832
add dword [esp + edx - 0x17408e73], edx
mov dword [esp + edx*2 - 0x2e811cf0], esi
add edx, dword [esp + edx*2 - 0x2e811cf4]
sal dword [esp + edx*2 - 0xc03e52f], 0x34
mov dword [esp + edx - 0x601f293], edi
js 0xb8b604

Function at 0xe3e2af
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x8484], 0xf72ab6b8
add dx, 0x65a7
or byte [esp + eax*8 - 0x4241d], 0x99
neg dx
ror dx, 1
not dx
shl eax, 0x70
js 0xe1bb1e
neg eax
dec eax
sub byte [esp + 3], 0xac
xor dword [esp], 0x9931892a
ror eax, 1
rol dword [esp], 0x61
sal word [esp + 2], 0x2b
bswap eax
xor ebx, eax
call fcn.01042a86

Function at 0xe42300
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor dh, bl
stc
invalid
out dx, al
test byte [ebx - 0x1219be5f], bh
sbb dl, byte [ecx + 0xe]
or eax, 0x1d0741a9
cli
iretd
sub ebx, ecx
cmp dh, byte [edi - 0x73]
sbb esi, dword [edi + ebx*8 - 0x6d791422]
out 0xb5, eax
push edx
popal
jns 0xe421fa
je 0xe4223f
pop ebp
xchg esi, eax
dec esp
push 0x37
pop ecx
clc
wait
jp 0xe422af
mov esi, 0x3e5f1e17
rcr bh, cl
mov eax, 0x4c142edf
jno 0xe42282
cmp ah, byte [eax + ecx - 0x7115be2a]
dec esp
mov byte [ebp + 0x45], al
lcall 0x342c, 0x83b1b87d
pushfd
pop es
aad 0xb1
ror al, cl
test eax, 0x3d5abae7
push eax
xchg esp, eax
push ds
invalid
and byte [ebp - 0x1abe08bd], cl
mov al, 0xce
retf 0xdbc3
jle 0xe4225d
sub byte gs:[ebp - 0xe8e3245], bh
xor dword [ebx], eax
out dx, al
push ebx
stosb byte es:[edi], al
aam 0x16
inc edi
retf 0xe6d4
mov dword [ebp + 4], ecx
mov eax, 0x9202e62c
mov dword [esp + 0xc], eax
mov dword [ebp], edx
rol dword [esp + 0xc], 0xa1
mov ebx, dword [esp + 0x18]
and al, 0x18
mov dword [esp], eax
mov dword [esp + 0x10], eax
cdq
pop ecx
pop ecx
pop edx
pop eax
pop eax
pop ecx
pop eax
jb fcn.010d94d7
inc ecx
test dh, ah
add byte [esi - 0x276f24fc], bl
inc esp
sub eax, 0x436e6803
cli
add ecx, dword [ebp - 0x7f9a6738]
jge 0xe422d7
loopne 0xe422cb
jns 0xe423ba
push esp
pop eax
xor eax, 0xc26e034b
mov dh, 0xc9
stc
jge 0xe422d8
jne 0xe423d6
cmp dword [ebx], 8
add byte [ecx + ebp - 0x3f], 0x3e
jno 0xe42317
xchg ebx, eax
mov dl, 0x70
mov ch, 0x38
sub eax, 0x69156fb2
jo 0xe423ba
xchg ebp, eax
invalid
xor bh, byte [edi + ebp*8]
mov ss, edx
aam 0x6f
push es
dec edx
xor eax, 0x9aab0746
sbb byte [edi], 0x55
mov cl, 0x25
jge 0xe42438
popal
sbb bh, byte [esi + 6]
add dword [edx], 7
and dword [ebx], 0x73763ce2
or dl, byte [ecx]
pushfd
invalid
mov dh, byte [ebp - 0x1e]
jae 0xe42443
stosb byte es:[edi], al
sti
push ebp
lcall 0xec28, 0xc99d47ee
popfd
leave
sub ah, ch
mov byte [eax - 0x4e], 0x82
outsd dx, dword [esi]
retf
Function at 0xe48a51
Capabilities:
Encode data using xor

Disassembly:
movzx dx, byte [ebp + edx - 0x72973b11]
mov eax, 0x6a89ab8d
movzx ecx, ax
push 0xab8db88d
mov dword [edx + 0xf], ebp
mov bh, 0xc8
mov cl, byte [ecx + ebp - 0xab8b]
rol eax, 0x93
lea ebp, [ebp + eax - 0x5c6b544b]
shr dl, cl
mov word [ebp + eax - 0x5c6b544d], dx
mov dword [esp + eax - 0x5c6b544d], eax
or dword [esp + eax - 0x5c6b544d], eax
lea ecx, [eax*2 - 0x2dd0df67]
mov eax, dword [edi + eax - 0x5c6b544d]
and cx, word [esp + 2]
adc edi, 4
xor eax, ebx
rol dword [esp], cl
push ecx
inc eax
xchg word [esp + 4], cx
ror eax, 2
movzx edx, cx
dec eax
ror eax, 1
xor ebx, eax
add esi, eax
movsx eax, cx
call fcn.00cd0c01
push esp
adc eax, 0x7812307a
jecxz 0xe48a58
test al, 0x2d
iretd

Function at 0xe4eaf0
Capabilities:
Encode data using xor

Disassembly:
inc ecx
movzx ecx, bl
inc si
xor esi, dword [esp + eax - 0x1077]
dec edx
lea edi, [edi + eax*4 - 0x41ee]
btc ecx, 0xad
inc cx
adc eax, 0x8141e8b6
int 0x8c
fdiv qword [eax]
sub ah, byte [esi + 0x46]
mov dword [edi + eax - 0xf933], ecx
dec esi
mov dword [esp + eax - 0xf933], esp
ret
not dword [esp + ebx + 0x19]
inc ebp
xor bl, byte [ebp + ebx*8]
dec eax
lea edi, [edi + ebx*2 - 2]
inc sp
mov dword [edi + ebx*2], ebx
inc cx
xor ebx, esi
xor bx, 0x2f1f
jbe 0xd0612a
inc ecx
pop ebx
pop edx
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop ecx
pop esi
inc ecx
pop ebx
jge fcn.00d45932
or al, 0x90
out 0, eax
aas
invalid