joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10061a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100a800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10061a50
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073f29
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10061a80
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10061a80
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073f29
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10061b56
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10061aa9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10061ab5
movsx eax, bl
jmp 0x10061aed
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10061b17
sub eax, 1
je 0x10061b17
sub eax, 2
jne 0x10061b56
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073f29
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10061b35
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10061b56
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10061b56
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073f29
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10073f29
mov esp, ebp
pop ebp
ret 4
Function at 0x10070f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100a800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10070fdc
cmp byte [esi + 0x3d], 0
je 0x10070fdc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10070fca
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10070f91
sub eax, 1
je 0x10070f95
sub eax, 2
jne 0x10070fca
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073f29
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10070fb3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10070fca
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073f29
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073f29
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10073f29
mov esp, ebp
pop ebp
ret

Function at 0x10071830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 3
xor eax, eax
mov dl, byte [edi + eax - 0x2dde7edd]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007185e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10071841
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10071870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xb5
xor eax, eax
mov dl, byte [edi + eax - 0x39e8c79c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007189e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10071881
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100718b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x7e
xor eax, eax
mov dl, byte [edi + eax + 0x47b30cfa]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100718de
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x100718c1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x100718f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x90
xor eax, eax
mov dl, byte [edi + eax + 0x2c0f6166]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007191e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10071901
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10073cc0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082bdd
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100a800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.10073b50
cmp byte [ebp - 0x84], 0
jne 0x10073e11
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x10073d55
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x100a9a50
call fcn.10073b50
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10073b50
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x10073dc4
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.10073c00
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10073e53
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10073e49
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10073e49
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007484f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10073f29
mov esp, ebp
pop ebp
ret
Function at 0x121ff3f
Capabilities:
Encode data using xor

Disassembly:
dec eax
lea ebp, [esp + ebp + 0x10]
dec ecx
bswap ebx
mov byte [ebp], al
dec esp
mov dword [esp], esi
inc ecx
mov ebp, dword [ebp + 2]
mov eax, dword [esp + 9]
shl byte [esp + eax*2 - 0x1fffff2], 0xa1
xor ebp, ebx
lea ebp, [ebp + eax - 0x2915ab29]
inc ecx
dec al
jge 0x1265045
call fcn.017aba6b
add dx, cx
dec edx
ror eax, 2
inc edx
sal dx, 0xe6
not eax
dec cl
not edx
rol eax, 1
rol edx, cl
or cl, ch
xor ebx, eax
ror ecx, 0x3e
xor dx, cx
jne 0x1226688
mov eax, 0xcda10bb8
movzx ecx, ax
dec ecx
lea esi, [esi + ecx*2 - 0x1772]
call fcn.01253d21
adc edi, eax
jmp edi
bswap ebp
inc ebp
movzx edi, si
rol ebp, 1
dec byte [esp + eax*2 - 0x1fffffa]
not ebp
movsx esi, al
jo 0x17a1661
dec eax
mov dword [esp + eax - 0xfffff7], ebx
jne 0x176a712
dec ecx
lea eax, [eax + ebx*8 + 0x7f37718b]
pop ebx
shr ax, 0x21
setg dl
inc ebx
mov dword [ebx + ecx - 0x2a40], ebp
dec ecx
xor esp, 0xccb01c9b
call fcn.016890b1
inc edi
dec eax
shl esi, 0xde
xor dword [esp + edi*2 + 6], ebp
dec eax
mov ebx, dword [esp + edi*8]
dec esp
or ebx, eax
dec eax
and dword [esp + edi*2 - 2], 0x6703a31d
dec eax
arpl bp, bp
dec esp
adc edx, ebp
inc ecx
movzx eax, word [ebp + edi*4 + 2]
dec esp
lea esi, [edx*4 + 0x6f18e391]
outsd dx, dword [esi]
dec esp
sub edi, edi
dec ebp
lea ebp, [ebp + edi*2 + 6]
call fcn.01272075
lodsd eax, dword [esi]
nop
test al, ch
rcr byte [esi], 1
xor al, 0xa9
sbb byte [0xcdba2c2f], dl
sbb byte [0x8d02f62f], dl
sbb byte [0xf162b82f], dl
sbb byte [0xf160582f], dl
sbb byte [0xca7ad02f], dl
sal bl, 1
loope 0x176a73f
jmp 0x38ec9652
dec ebp
arpl di, di
movzx ebp, ax
sete al
dec ebp
add edx, edi
jmp fcn.012409d7

Function at 0x12256d6
Capabilities:
Execute syscall

Disassembly:
rol eax, 1
mov dword [esp + ecx - 0x5400], ecx
xor dword [esp + ecx - 0x5400], edx
neg eax
neg cx
xor eax, 0xd4814929
and dword [esp + ecx*2 - 0x15800], ecx
push edx
ror eax, 3
and ecx, ecx
dec eax
xor eax, 0xaf3b8bbc
neg cx
dec byte [esp + ecx*4 - 0x15000]
sets cl
xor ebx, eax
add edi, eax
rol cx, 0x67
sub ecx, dword [esp + ecx*4 - 0xa4]
call fcn.01290022
sysenter
push ecx
mov dword [esp], 0xde199891
call fcn.01299740

Function at 0x1240d88
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov ecx, eax
inc ebx
mov eax, dword [ebp + eax - 0x3997529f]
dec edx
mov dword [esp + eax*2 - 0x732ea53e], ecx
mov esi, 0x85814632
dec edi
lea ebp, [ebp + eax - 0x3997529b]
add dword [ebp + 0x5ac8d4f], 0xc668ad65
xor eax, ebx
inc esp
mov edi, ecx
call fcn.012b0ea8
movsx edx, ax
lea ebp, [ebp + edx*8 - 0x29e06]
seta dl
rol eax, 0xf
mov word [eax + ebp - 0x29e09eec], cx
lea esi, [edx + esi - 0x5304]
mov eax, dword [esi + eax - 0x29e09eec]
movzx ecx, dl
neg edx
neg ecx
xor eax, ebx
dec eax
call fcn.0169128d
ja 0x1240d89
fimul word [eax - 0xe8b0dad]
inc edx
jne 0x1240d9e
inc eax
mov dh, 0x8a
xchg ebx, eax
bound esi, qword [ecx + ebx*8 - 0x35796a58]
pop ecx
push 0xffffffffffffffd2
out 0x9d, al
xor al, 0x4c
invalid
Function at 0x1247540
Capabilities:
Authenticate hmac

Disassembly:
dec dx
xor dx, 0xdeab
pop ebp
xor bx, dx
call fcn.012b156f
jbe 0x1247554
mov ebp, 0x70461d6
salc
popal
add al, 7
stc
inc eax
jge 0x12475b6
test byte [eax], cl
sub eax, 0x79c648c1
imul dword [edi + 0x25]
dec esp
invalid
push cs
lahf
cmp dword [ebx - 0x3dc9beef], eax
or esi, dword [esi - 0x48eb90f6]
sal bh, cl
add dword [edx + 0x68661e17], esp
mov cl, byte [edx - 0x64]
test al, 0x58
add eax, 0xa8a2168a
sbb al, 0x49
mov dl, byte [esi]
mov byte [0x8a3da000], al
push ss
mov byte [0x8a7964e4], al
push ss
mov byte [0x2eb6d584], al
add ecx, esi
les ebp, [esi]
mov ecx, 0x91102c25
mov dl, 0x44
fidiv dword [edx + 0x10]
xchg ebp, eax
mov dl, 0x44
fisub dword [edx]
xchg ch, ah
mov dl, 0x44
fimul dword [eax - 0x20]
xchg ebp, eax
mov dl, 0x44
fiadd dword [esi + edx*2 - 0x25bb4d37]
bound ebp, qword [esi - 0x42]
jp 0x124757f
adc al, 0x36
jl 0x12475fd
jg 0x1247663
mov esp, dword [edi]
leave
stc
int 0x88
inc ebx
add ah, byte [edx - 0x270969e9]
mov dword [edx - 0x64], ecx
insb byte es:[edi], dx
jl 0x12475e8
mov dword [esi], edx
mov byte [0x899d28ac], al
push ss
mov dword [esi], edx
mov byte [0x89d11ce4], al
push ss
mov byte [0x89ad9070], al
push ss
mov byte [0x2eb571c0], al
add dword [0x87dfec24], ecx
int3
in al, 0x5c
mov ecx, 0x84bb7869
out dx, eax
mov edi, dword [esp + ebp*2 - 0x49]
xor ebx, ecx
jl 0x12475e4
test byte [edx + ecx*8 + 0x3f], bl
sbb al, 0xe
pop esi
dec ebp
and dword [ebx + 0x1c], eax
out dx, al
xor eax, 0x37ad51b7
mov al, 0x7f
nop
jg 0x12475f5
test al, 0xcb
sbb dword [0xab030c86], 0xffffffed
cmpsb byte [esi], byte es:[edi]
cmp ecx, dword [edi]
call [ebp - 0x1e]
sub eax, 0x8c6ab110
neg byte [edi - 0x72]
push esi
les eax, [ecx + 0x11df4353]
inc eax
cmp ah, byte [eax + 0x27]
fsubp st(7)
pop dword [ebx + 0x2dec13a9]
imul ebp, dword [0x1f95601c], 0xffffffa9
pop ss
in eax, dx
cli
pop ds
sub ah, byte [ebx + 0x273e9599]
jl 0x1247641
push 0xc63adca9
fcmovu st(0), st(3)
je 0x124771f
ret 0x3823
imul ebx, dword [ebx], 0x65597e5
pop ebx
dec esi
invalid
jg 0x12476cc
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
invalid
Function at 0x127625d
Capabilities:
Authenticate hmac

Disassembly:
xor bx, ax
call fcn.01770400
call fcn.0168e6af

Function at 0x12950cf
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov edx, eax
not esi
jns 0x16987a1
inc edx
add dword [esp + edi*4 - 0x5287fff7], 0xa8be5b33
dec edx
mov dword [esp + edi*4 - 0x5287fff8], ebx
inc edx
xor dword [esp + edi*4 - 0x5287fff8], esi
dec eax
mov ebx, dword [esp + eax - 0x14a2ad28]
pop ebp
dec eax
add ebp, 0xfffccadd
jmp ebp
dec eax
bswap eax
dec ecx
not edi
dec eax
arpl cx, cx
dec esp
add edx, ecx
dec eax
dec eax
lea esi, [eax + edx*8 - 0x6d7382d9]
inc cx
mov eax, dword [ecx + edx - 0x47]
dec ebp
lea ecx, [ecx + edx*4 - 0x11a]
dec esp
lea eax, [ebp*4 - 0x237d3269]
shl bp, 0x26
inc ebp
movzx eax, byte [ebp + edx - 0x47]
dec eax
lea ecx, [edx + edi*8 - 0x3746ee6f]
push ecx
dec esi
lea ebp, [edx + ebp - 0x46]
ja 0x178b4a9

Function at 0x1298e61
Capabilities:
Encode data using xor

Disassembly:
sbb si, 0x3392
not ecx
inc edx
mov edx, dword [esp + edi*2 - 0xf917]
rol si, 1
dec si
xor si, 0xdeab
dec esi
mov dword [esp + edi - 0x7c93], ebx
dec esi
and eax, dword [esp + edi - 0x7c84]
inc ecx
and al, 0xab
xor bx, si
shl ax, 2
dec eax
lea esi, [esp + esi + 0x18]
inc dx
xor dword [esp + edi - 0x7c91], 0x850f1db1
cmp dword [esi + 0x23e8ffff], edi
aaa
jle 0x1298e7b
iretd
Function at 0x12a75af
Capabilities:
Encode data using xor

Disassembly:
inc ecx
not eax
inc ecx
xor esp, 0xae253118
inc ecx
pop ebx
inc ecx
bswap esp
movsx ebp, byte [esp + esi*2 - 0x106]
xchg esi, eax
dec eax
mov dword [esp + eax*2 - 0x104], ebx
inc esi
movsx ebx, byte [esp + esi - 0x459e2312]
movzx ebx, word [esp + eax*2 - 0x10b]
inc esp
xor dword [esp + eax - 0x7e], esp
dec ebp
xor esi, esi
dec ecx
bswap ebx
dec eax
or dword [esp + eax*2 - 0x10c], ebx
dec edx
mov ebx, dword [esp + esi*4 + 8]
dec di
call fcn.0176a3da
jp 0x12a75bb
xor dword [edx - 0xe], ebp
dec ebx
jmp 0xec2238b

Function at 0x12ab80f
Capabilities:
Encode data using xor

Disassembly:
dec esi
lea ecx, [esi + ecx - 4]
inc ebp
mov dword [ecx + esi], edi
setae byte [esp + esi + 0x15]
pop edx
pop edi
pop esi
inc ecx
pop edi
jb fcn.012409d7
pop esi
imul ebp, dword [esi + eax*2 + 0x6ae3e5a4], 0x30
mov ebx, 0x4ad5f15b
xor byte [ebx + 0x1e9f6d5b], bh
mov ebx, 0x1e9f6d5b
xor byte [ebx + 0x2ebd995b], bh
xor byte [ebx + 0x26bdad5b], bh
xor byte [ebx + 0x5d5c35b], bh
clc
pop ebp
xchg ebp, eax
loope 0x12ab837
mov bl, byte [edx - 0x598c0320]
xchg edi, eax
lodsd eax, dword [esi]
das
mov edx, dword [esi + 0x7317accc]
sub edx, dword [0x759c4447]
jns 0x12ab876
inc edi
sbb byte [edx + 0x47182515], ah
sbb byte [edx + 0x476005c1], ah
inc edi
sbb byte [edx + 0x477c6151], ah
sbb byte [edx + 0x207be4dd], ah
add ecx, eax
add byte [0xecf894d0], dh
test eax, 0x74e66b2d
add dword [ecx - 0x33c594d3], ebp
dec ebp
test eax, 0xb46c6b2d
sub eax, 0xbe6b2da9
push cs
test eax, 0x5e506b2d
popal
retf

Function at 0x12b2cae
Capabilities:
Authenticate hmac

Disassembly:
jge 0x12b5b36
dec ecx
inc edi
inc ecx
xor eax, 0xd5889d30
dec eax
dec eax
dec eax
mov dword [esp], 0xbea73da0
push 0xe3bd951a
dec eax
lea esp, [esp + 0x20]
jne 0x1666f79
mov esi, 0x5c954ca4
movsx eax, si
movzx edi, si
inc ecx
pop ecx
dec eax
arpl dx, dx
pop edi
dec eax
add edi, 0x428e2e
jmp edi
inc ecx
movzx edx, byte [edi]
push 0xc08b0125
inc ecx
xor edx, eax
and edx, 0xff
inc ecx
mov edx, dword [ecx + edx*4]
sal dword [esp + 2], 1
call fcn.0168846d
Function at 0x166b270
Capabilities:
Encode data using xor

Disassembly:
pop eax
not cx
add edi, edx
movsx eax, cx
movzx edx, cx
or cl, dl
pop ecx
jle fcn.0125441b
pop es
sub eax, dword ds:[ebx + 0xf8e60b5]
mov bh, 0x7e
dec edx
mov esi, 0x7eb747c2
dec edx
jl 0x166b2be
push ebx
mov bh, 0x7e
dec edx
shr byte [esi + 0xf], 0xb7
jle 0x166b2ec
lcall 0x744a, 0x7eb74b3c
cld
jl 0x166b32b
cwde
test byte [eax + ecx*4 - 0x229a74b2], bl
mov esp, dword [ebp - 0x23]
mov dh, 0xb7
invalid
pop esi
fisub word [eax]
dec ebp
or byte [esp + ebp + 0x544d79c4], bl
mov byte [0x4d3db078], al
push esp
mov byte [0x4d09c4cc], al
push esp
mov byte [0x4d39047c], al
push esp
mov byte [0x6c7181f8], al
add dword [ebx + esi*4 + 0x59e4395d], ebx
cmc
sahf
rol esp, 0x1b
jnp 0x166b34f
loop 0x166b2b1
les ebx, [ebx]
ja 0x166b36d
test cl, 0xc4
sbb ebx, dword [edi + 0x4f]
mov cl, 0xc4
sbb esi, dword [ecx + 0xf]
mov al, cl
les ebx, [ebx]
daa
adc eax, 0xd52209ed
sbb esi, edi
hlt
mov byte [0x4c81b490], al
push esp
mov byte [0x4cad382c], al
push esp
mov byte [0x6c705db4], al
add dword [ebx], edx
and ch, dh
invalid
clc
push 0x755db00
mov edi, 0xbd15e6a0
fucom st(2)
invalid
loopne 0x166b3db
pushfd
push cs
mov esi, 0xf19c2c3a
and ah, byte [eax]
jno 0x166b3d6
test eax, 0xe23b6c87
invalid
outsb dx, byte [esi]
xor dword [edi + 0x46d7f38e], 0x7d
xor dword [eax], edi
call 0x68345138
xlatb
inc esi
jge 0x166b410
cmp al, ch
push ebx
popfd
int 0x66
or dword [ecx], eax
invalid
mov bl, 0xb3
mov ebx, 0x37304042
xchg edx, eax
xor dword [edx - 0x491a830f], ebx
mov ss, word [edx + 0x2fb98aa]
and byte [ebp - 0x73], 0xef
out dx, eax
std
jbe 0x1c2c0f25
xchg ebx, eax
sub dh, byte [eax + 0x55013cd4]
stc
jp 0x166b3f8
xchg esi, eax
in eax, 0xc4
adc ecx, eax
dec ecx
test dword gs:[ecx], ebp
imul esp, dword [ecx + 0x29], 0x44816815
invalid

Function at 0x1671c3b
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 0x3c2309a7
call fcn.017c2d16

Function at 0x168846d
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
shr eax, 8
push 0x8236970d
inc byte [esp]
inc esp
xor eax, edx
jmp 0x12b2cb4

Function at 0x1688567
Capabilities:
Get number of processors

Disassembly:
dec edx
mov dword [esp + eax*2], edi
bswap ebp
not ebp
inc edx
lea ebp, [ebp + edi*2 - 0x5f549597]
inc ecx
shl bh, 0xc1
dec edx
mov dword [esp + edi*2 + 0x475f020c], ebx
inc dx
or dword [esp + edi*2 + 0x475f0204], esi
dec eax
sal esi, 0xf0
je 0x16960c1
xor dword [esp + esi + 8], ebp
sar dword [esp + esi*2 + 2], 0xa
setns byte [esp + esi*8]
dec edx
mov ebx, dword [esp + edi*2 + 0x475f020c]
dec eax
arpl bp, bp
dec esp
adc edx, ebp
inc edx
xor byte [esp + edi*2 + 0x475f0204], bh
inc dx
ror dword [esp + edi*2 + 0x475f0209], 0x4c
dec esi
mov dword [esp + edi + 0x23af8102], edx
ret 8
Function at 0x16885be
Capabilities:
Get number of processors

Disassembly:
mov eax, 0xe4bd0e31
cmc
ror esi, 0xb
mov cl, dl
rol eax, cl
lea esi, [ebp + edx - 0x10c]
add al, dl
cmc
test ebp, 0x17140303
jmp 0x1749de9
je 0x17c9850
lea ebx, [ebx]
xadd si, si
rol esi, 0x39
cmc
je 0x16833f2
inc edx
cmp edx, 0x104
jb 0x1232dd8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
bts cx, bp
mov ecx, dword [eax + 0xc]
mov ebx, 0xf9b84b00
rcr ebx, 0x85
mov eax, dword [eax + 0x10]
xor bl, bl
not bh
mov dword [ebp - 4], eax
neg bx
and bx, 0x19d
mov ebx, ecx
cmp ecx, eax
jmp 0x16767af
inc ecx
sub bl, 0x2f
neg cl
inc ecx
xor bl, bl
call fcn.017b9932
push ebp
bts ebp, edx
mov ebp, esp
test edi, 0xa425f397
sub esp, 0x10c
test ebp, 0x38be7701
cmp ah, 0xd
push ebx
push esi
cmc
push edi
or edi, 0x3709e189
sal edi, 0x35
mov edi, eax
nop
rcl eax, 0x9f
lea eax, [ebp - 0x10c]
cmp di, 0xb9c
xor edx, edx
sub edi, eax
jmp 0x16a45f7
jmp 0x1232dd8
xor al, byte [edi + esi]
mov byte [esi], al
jmp 0x16833df

Function at 0x16997d5
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx*2 + 0x26973fb8]
call fcn.0168502f
Function at 0x16a5416
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xbe041701
inc ecx
mov eax, dword [ebp]
dec ecx
add ebp, 4
inc eax
movzx edx, bh
inc esp
movsx esi, dx
xor eax, ebx
dec eax
mov dword [esp + edx - 1], 0x4e0ee706
push edi
add eax, edx
inc esp
mov edi, edx
inc esp
movzx ebx, byte [esp + edx*8 - 2]
inc esp
movsx esp, word [esp + edx + 9]
neg eax
sub eax, 0xb98fac2d
inc ecx
push edi
rol eax, 1
inc ecx
movzx esi, sp
sub eax, edx
movzx ebp, dl
inc esp
and dword [esp + edx*2 + 1], esp
inc esp
xadd dword [esp + edx + 0x11], esi
dec eax
mov dword [esp + edx + 0xf], ebx
inc ecx
movzx ecx, sp
inc cx
xadd edi, edi
add word [esp + edx*4 + 9], 0x8f98
xor dword [esp + edx*2 + 0xe], eax
dec eax
sub esi, dword [esp + edx + 7]
ret 0x8b44
pop es
call fcn.017640e5
jp 0x16a54fe
jbe 0x16a543c
fstp st(5)
arpl word [edx], cx
pop ebx
test eax, 0x4ec72ddd
pop ebx
test eax, 0x56357ddd
pop ebx
test eax, 0xbefbcbdd
cli
mov dl, 0x96
jle 0x16a54b1
inc ebp
inc esi
mov dh, 0x65
inc eax
cmp ebx, esp
pushal
popal
sbb bh, byte [ebp - 0x16]
scasb al, byte es:[edi]
push edx
push edi
jecxz 0x16a5488
lodsd eax, dword [esi]
test al, 0xb7
iretd
out dx, eax
dec edi
int3
xor dword [eax + 0x40], esi
pop ds
or byte [esi], bl
mov dh, 0x33
pop edx
popfd
stosd dword es:[edi], eax
mov ebp, 0x7d82fca6
dec esp
add ecx, dword [edi - 0x40]
test dword [edi + edx*8], esp
rcl byte [ebx + 0x6f65673f], cl
stc
sbb eax, 0xbbb802a2
jnp 0x16a54e5
mov byte [0x7bbbb802], al
rcl dword [edi + edx*2], 0xe2
dec edi
mov ebx, 0x5714c17b
adc al, 0x57
loop 0x16a5577
aam 6
lodsb al, byte [esi]
aas
bound edx, qword [edx - 3]
mov esi, 0xe67e8b84
jo 0x16a54bd
pop esi
rcr byte [ebp + 0x1e], 0x2e
adc ch, bl
jnp 0x16a551e
inc eax
jecxz 0x16a5556
test dword [esi + ecx*8], ebp
jae 0x16a5521
call 0xc5997344
movsd dword es:[edi], dword [esi]
sahf
xor cl, byte [edx + 0x59]
call [ebx]
mov dh, byte [ebx + 0x7a37d600]
inc esi
mov bl, 0
salc
add dh, dl
aaa
jp 0x16a55a1
jl 0x16a554e
int1
dec edi
out dx, al
xchg edi, eax
xchg ebx, eax
add dword [ecx + 0x2c3e201d], ecx
xchg dword [ebx], edx
pop ss
cdq
xchg dword [ebp + 0x15a1e79a], ecx
xchg byte [ebx], ah
mov bl, 0x96
and edx, dword [ecx + ebx*8 - 0x59923c1e]
cmp eax, 0xe3ad0163
lodsd eax, dword [esi]
cmp al, 0x61
dec esi
jae 0x16a555c
invalid
in eax, 0x67
mov edi, 0x1f05f8ae
and dword [edx - 0x567ee950], eax
invalid
loopne 0x16a5555
adc eax, 0xe1838df5
mov dword [0x9c5d9978], ebp
ret