joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc63c2c
Capabilities:
Execute syscall

Disassembly:
lea ecx, [eax + eax - 0x20eba04e]
sar cl, 0x64
lea esi, [eax + esi - 9]
mov dword [esp + eax*2 - 0x1a], ecx
cwde
dec ax
xor edx, ebx
dec edx
neg edx
or eax, 0x85994888
sar eax, cl
sbb edx, 0x4023a914
sub dword [esp], 0xbf1e3aa8
neg edx
dec edx
neg byte [esp + 3]
shr eax, cl
not edx
sal eax, cl
rol ecx, cl
or cx, word [esp + 1]
xor ebx, edx
push ecx
push eax
add ebp, edx
shr ecx, cl
mov word [esp + ecx + 7], 0x91a8
xadd eax, ecx
add cx, word [edi]
xadd dword [esp + 8], eax
adc edi, 1
lea edx, [eax + eax*8 + 0xfa79421]
rol al, 0x65
movzx edx, byte [edx + esi - 0x152b309]
adc esi, 0
add dword [esp + 5], eax
jl 0x754428
syscall
push edi
dec eax
mov dword [esp], 0xaec39572
call fcn.00cbd9c2

Function at 0xc6b2e1
Capabilities:
Authenticate hmac

Disassembly:
inc edx
not edx
and ecx, dword [esp + ecx - 0x10686cd7]
sub word [esp + ecx*4 - 0x40a18fff], ax
add ecx, ecx
xor edx, 0x7300df1b
inc edx
sal cl, 1
bswap eax
xor ax, 0x643f
xor ebx, edx
xchg dword [esp + eax - 0x3bc980d6], eax
btc eax, ecx
adc esi, edx
rol ecx, 0x6f
pop eax
pop edx
pop edx
jae fcn.00c409cb
mov edx, 0x978eac80
dec edx
sal dl, 0x63
sbb esi, 1
inc dl
xor dx, dx
movzx ecx, word [esi]
call fcn.00b7a02d
add eax, eax
xor ecx, ebx
bswap ecx
inc eax
not byte [esp + 4]
mov dword [esp], 0x87a83723
xor ecx, 0x690d799
imul dword [esp]
ror word [esp + eax - 0x42021d96], 0xa4
lea ecx, [ecx + edx*4 + 0x7e062f09]
cdq
rol ecx, 2
not ax
mul eax
sub dx, ax
xor ebx, ecx
rol dword [esp + edx*2 - 0x220bb181], 0xf9
or word [esp + edx - 0x1105d8bb], dx
div dl
add ebp, ecx
mul dword [esp + edx - 0x1105d8c1]
pop edx
pop edx
pop edx
jo fcn.00c02781
mov eax, dword [edi]
mov edx, 0xad878619
mov ecx, dword [edi + 4]
push ebx
movzx ebx, dl
cpuid
sub edi, 8
push 0x7abc5ab2
push 0xef979324
mov dword [edi + 0xc], eax
jmp 0xc75a49
mov dword [edi + 8], ebx
mov eax, 0x67a7fb2e
mov dword [edi + eax - 0x67a7fb2a], ecx
mov dword [edi + eax - 0x67a7fb2e], edx
mov ebx, dword [esp + eax - 0x67a7fb26]
lea ebp, [ebp + eax - 0x67a7fb32]
xadd dword [esp + eax - 0x67a7fb2e], eax
mov ecx, eax
sal word [esp + 4], 9
mov edx, dword [ebp]
not ecx
rol eax, 0x2b
xor edx, ebx
rol eax, cl
sbb edx, 0x9482727f
neg edx
rol edx, 1
jmp 0xb371c9

Function at 0xc6ef27
Capabilities:
Authenticate hmac

Disassembly:
call fcn.0072a95e
sar dl, 0x61
mov dword [edi], eax
mov eax, dword [ebp]
movzx ecx, dx
js 0x7099a4

Function at 0xc75a3d
Capabilities:
Authenticate hmac

Disassembly:
add esi, eax
movzx eax, byte [ebp + edx*2 + 4]
call fcn.007c5f2e
Function at 0xc85c2f
Capabilities:
Authenticate hmac

Disassembly:
jmp ebp
mov dword [esp + edx*4 - 0x98fcc40], edx
xor ecx, 0x751a3d1c
xor ebx, ecx
btc eax, edx
adc esi, ecx
xchg word [esp + edx*2 - 0x4c7e613], ax
neg byte [esp + edx*2 - 0x4c7e615]
pop eax
pop edx
pop ecx
pop ecx
pop edx
pop eax
pop eax
jl fcn.00bb937c
rol ecx, 3
add dl, al
xor ecx, 0xc2822a19
not al
shr al, 0xa7
bswap ecx
lea ecx, [ecx + eax*2 - 0x53427bd2]
xor ecx, 0x1ebf322c
xor ebx, ecx
ror dx, 9
and eax, eax
cwd
adc ebp, ecx
cdq
xor edx, dword [eax + edi - 0x55315d00]
and eax, eax
mov ecx, eax
mov ecx, dword ss:[edx + ecx - 0x55315d00]
sar eax, 0xac
mov dword [eax + edi - 0x55315], ecx
mul eax
xor dx, ax
jne 0xaf851e

Function at 0xc8774e
Capabilities:
Authenticate hmac

Disassembly:
ror edx, cl
bswap eax
sal dx, 0xc5
call fcn.00c616d9
mov eax, 0x77bb6004
movsx edx, ax
mov edx, dword [eax + edi - 0x77bb6004]
mov ecx, eax
add eax, ecx
mov eax, dword [ecx + edi - 0x77bb6000]
lea edi, [ecx + edi - 0x77bb6000]
sbb ecx, ecx
jp 0xa9307a
sub byte [esp + edx + 1], dl
mov dword [esi + edx*2], ecx
movzx ecx, dx
adc dword [esp + edx*2 + 4], 0x88068113
bts ecx, ecx
pop eax
pop eax
jae fcn.00cb8833

Function at 0xc8e580
Capabilities:
Execute syscall

Disassembly:
sub al, 0xd
bswap ecx
xor al, 0x9f
add al, cl
jmp 0x7bfd7b
xor bl, al
shr ecx, 0xd
pop ecx
lea ecx, [edx*8 + 0x3f3e36af]
mov word [ebp - 4], ax
call fcn.00c72e4a
syscall
call fcn.00ac5938
mov eax, 0xcfbaf52b
sub esi, 4
xor al, al
movzx ecx, ax
mov eax, dword [esi + ecx*2 - 0x1ea00]
xor eax, ebx
movsx edx, cx
not dl
not eax
bts dx, 1
lea ecx, [edx*4 - 0x517d88f1]
sbb dl, 0x2b
rol eax, 2
sub eax, 0xca15c3be
not cx
add edx, edx
bswap eax
sub dx, 0xb81f
dec cl
sbb ecx, edx
neg eax
imul ecx, edx
imul edx, edx
xor ebx, eax
push ecx
add ebp, eax
mov ecx, dword [edi]
lea eax, [edx*8 - 0x10cc084b]
movzx dx, byte ss:[ecx + eax - 0x9bc813d]
lea edi, [edi + eax - 0x9bc813b]
and dword [esp + eax*2 - 0x1379027a], eax
ror ax, 0xab
movzx ecx, al
mov word [edi + eax - 0x9bc27b0], dx
mov dword [esp + eax - 0x9bc27b0], ebp
ret
mov dword [esp + edx*2 - 0x6b406000], eax
dec al
mov word [ebp + edx - 0x35a03002], cx
mov al, byte [eax + esi - 7]
adc byte [esp + edx - 0x35a03000], 1
not word [esp + edx*2 - 0x6b405fff]
lea esi, [esi + edx*2 - 0x6b405ffb]
xor al, bl
ror edx, 0x1f
bt dx, 0x3a
xchg dword [esp + edx - 0x6b406000], edx
inc al
not byte [esp + edx - 0xffff0b]
and edx, edx
dec dword [esp + edx - 0xffff0e]
ror al, 1
sub al, 0xb8
movsx ecx, dx
not al
btc dx, 0x83
or edx, 0x97b11600
rol al, 1
jmp 0x76a4d9

Function at 0xca0653
Capabilities:
Authenticate hmac

Disassembly:
neg eax
sub word [esp + 0xe], 0x9099
mov dword [esp], 0x3e1aca24
adc eax, 0xa10bda03
shl dword [esp + 0x12], 0x8b
push 0x6cae8aa0
xor ebx, eax
not dword [esp + 4]
add edi, eax
lea esp, [esp + 0x1c]
jmp 0x79a2d6
push ebp
pushfd
mov ebp, 0x290e5381
mov ebp, dword [esp + ebp - 0x290e537d]
mov dword [esp + 4], 0xea7b2870
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00ba8918
not ecx
lea ecx, [eax + ecx + 0x642d2810]
call fcn.00780414
jmp 0x760892
Function at 0xcabc06
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + eax - 0x25], eax
cdq
add ecx, 0xb1380022
sal dword [esp + eax - 0x25], 0x7d
shr ax, 0xcc
not word [esp + eax]
bswap ecx
mov dword [esp + eax*8 + 4], 0xb1a0f592
not ecx
sar dx, 0xa7
sal dword [esp + eax*8 + 1], 0x1d
xor ebx, ecx
xadd al, dl
adc ebp, ecx
xor ax, word [eax + esi - 6]
movsx ecx, dx
lea esi, [esi + edx*2 - 6]
shr dx, 0x85
sal dword [esp + edx + 4], 0xc
xor ax, bx
shr dx, 0x6c
neg ax
not ax
and cl, byte [esp + edx*2 + 4]
imul edx, ecx
neg ax
sar cx, 0x28
inc ax
push ecx
sub dword [esp + edx*2 + 5], ecx
shl ecx, 0xf0
xor bx, ax
sal byte [esp + edx + 3], 0xe4
mov word [edi + edx - 6], ax
ror byte [esp + edx*4 + 0xa], 0x26
lea edi, [edi + edx - 6]
btc ecx, edx
movsx eax, byte [esp + edx + 8]
pop edx
pop eax
pop eax
jae fcn.007b8565
btc dx, dx
sbb ecx, 0x6a135b9b
xor ecx, 0x88a38ebe
mul eax
sal eax, 0x35
xor ebx, ecx
add ebp, ecx
movzx ecx, ax
inc dl
add eax, dword [edi + eax]
not edx
dec cl
mov ecx, dword [edi + ecx*8 - 0x7f4]
xor dx, dx
neg dl
push ebx
push edx
mov ebx, edx
bts edx, 0x3e
cpuid
not byte [esp + 2]
push 0x81a48b1f
sbb edi, 8
mov dword [edi + 0xc], eax
mov eax, 0x72ac66b3
or eax, 0x88248e09
lea eax, [eax*8 + 0x5aef53c]
mov dword [edi + 8], ebx
xchg byte [esp + 6], ah
mov dword [edi + 4], ecx
mov dword [edi], edx
not word [esp + 5]
mov ebx, dword [esp + 8]
movsx ecx, al
not ecx
mul dword [esp + 3]

Function at 0xcb4735
Capabilities:
Authenticate hmac

Disassembly:
shrd ax, dx, cl
call fcn.00aa5529

Function at 0xcbc25c
Capabilities:
Encode data using xor

Disassembly:
pop ecx
rol edx, 1
mov ecx, eax
btr ecx, eax
enter 0xffffffffffffb30f, 0xffffffffffffffc1
dec edx
sar cl, 0x43
not cx
xor ebx, edx
add edi, edx
call fcn.00767cb4
mov eax, 0x231da799
mov eax, dword [eax + ebp - 0x231da799]
call fcn.00b6a51b
fild dword [esi]
cmp bh, byte [ebp + 0x42]
jbe 0xcbc260
pop ss
or al, 0xa1
sub ebp, dword [edi]
cmp eax, 0x7e6e6100
out 0xae, al
mov esi, 0xea266e6a
aas
push eax
mov edx, 0xd6b92773
fadd dword [eax + 0x5f8c4189]
hlt

Function at 0xcc59ec
Capabilities:
Authenticate hmac

Disassembly:
pushfd
pop eax
mov dword [esp + 0xc], eax
shr word [esp + 8], 0xab
Function at 0xccc4b3
Capabilities:
Authenticate hmac

Disassembly:
setnp dl
xor cx, bx
call fcn.00c9e190
add edi, eax
movzx eax, byte [ebp + ecx*2 - 0x375c0000]
sub dx, 0x3585
bswap ecx
neg cl
lea ebp, [ecx + ebp - 0xaee4]
ror cx, 0xcc
push ecx
and dl, dh
xor al, bl
inc al
xor al, 0xb7
sub al, 0xa5
and cx, 0x961c
dec edx
and edx, dword [esp + ecx - 0x8618]
not al
neg dword [esp + edx*2 - 0x19484]
xor bl, al
add edx, dword [esp + edx - 0xca42]
lea esi, [ecx + esi - 0x861a]
and cx, dx
jno 0xb64b87
setnp byte [esp + eax - 0x2335999]
neg ecx
xor ebx, ecx
xchg byte [esp + eax*8 - 0x119accec], dl
xadd byte [esp + eax*2 - 0x466b339], al
sbb dword [esp + eax - 0x23359fb], eax
add edi, ecx
imul edx
not dl
movzx ax, byte [eax + ebp - 0x5396e8ab]
mov dl, byte [ebp + 2]
call fcn.00b80b61
sbb edx, edx
mov word [esi + ecx*8 - 0x41040], ax
mov eax, dword [esp + edx]
and byte [esp + edx + 2], ah
jge 0xc8a221
mov edx, 0x889ae034
movzx eax, dx
movsx ecx, dl
mov edx, dword [esi + eax*4 - 0x380d0]
add ax, ax
lea esi, [esi + eax*4 - 0x3019c]
cwde
cwde
shl ecx, 0x19
xor edx, ebx
neg edx
rol ecx, 0xeb
xor edx, 0x53bd7100
inc ecx
bt ecx, ecx
bswap edx
xor edx, 0xc407908e
bt ax, ax
xor ebx, edx
or eax, eax
xor eax, 0x64a6c283
sbb eax, ecx
adc edi, edx
lea ecx, [ecx + ecx*2 - 0x6dd62ccc]
mov edx, dword [ebp]
call fcn.007d41bd
ror dl, 0x63
bswap eax
ror edx, 0xb6
sar edx, 0x9c
xadd dword [esp], edx
ror eax, 2
bt edx, edx
jb 0xb91832
inc dword [esp + edx - 0x7c36a200]
not eax
push edx
shl eax, 0x5f
mov ecx, dword [edi + eax*4 + 2]
shr ax, 0xe4
jnp 0xb72443
mov dword [esp + eax*4], edx
movzx edx, byte [esi + eax - 5]
push eax
dec ax
xor dl, bl
push eax
xchg dword [esp + eax*8 - 0x7fff0], eax
add dl, 0x38
not dl
sub dword [esp + eax - 0x69110c2d], eax
push eax
xchg word [esp + eax - 0x69110c32], ax
neg dl
add dl, 0xaf
sal word [esp + eax - 0x69116907], 0xa8
xchg byte [esp + eax - 0x691168ff], ah
adc ax, word [esp + eax - 0x6911d901]
xor bl, dl
cbw
xor eax, eax
pop eax
lea edx, [esp + edx + 0x10]
adc word [esp + eax*2 - 0x1868185c], 0xaa84
bswap eax
adc eax, eax
mov dword [edx + eax - 0x68186818], ecx
sar dword [esp + eax - 0x6818680d], 0x8a
movzx ecx, word [esi + eax - 0x6818681f]
shr al, 0xa6
adc byte [esp + eax - 0x681867f6], 0x90
lea edx, [eax*4 + 0x1d0b29a3]
lea esi, [esi + eax - 0x68186807]
jne 0xa8a242
Function at 0xcd26bd
Capabilities:
Authenticate hmac

Disassembly:
jae 0xc6eef3
mov ecx, eax
mov ecx, dword [esi]
seta al
btr eax, eax
dec eax
xor ecx, ebx
and eax, eax
sbb eax, eax
lea ecx, [ecx + eax*8 + 0x60141ebc]
sal eax, 0xfa
xor ecx, 0xfb8d84bf
shl eax, 0x81
not ecx
sar ax, 8
add eax, eax
neg ecx
dec ecx
sub eax, eax
neg ecx
push eax
xor byte [esp + eax*2 + 1], 0x9c
shl eax, 0x3a
ror ecx, 1
neg ecx
neg dword [esp + eax]
neg dword [esp + eax*2]
xor ebx, ecx
xadd dword [esp + eax*2], eax
adc ebp, ecx
rol dword [esp + eax - 0x9c00], 0x45
bswap eax
mov ecx, dword [edi + eax - 0x9c0000]
dec eax
mov eax, dword [edi + eax - 0x9bfffb]
push 0x57abfb03
dec dword [eax - 0x75]
test byte [edi], al
pop es
add eax, 0x68ff6400
add edi, ebx
stosd dword es:[edi], eax
push edi
call fcn.00afc0b4
mov bh, 0x36
cli
sub eax, 0x29cf35ad
adc eax, 0xa7593dff
sub dword [0xb34fb4ff], edx
sub dword [0xed3519ff], edx
mov byte [esi + 0x5b], bl
xlatb
xchg ebx, eax
cmp eax, 0x33be6548
fist word [ebx]
pop es
js 0xbe03ca
fidiv word [ebx]
fist word [ebx]
jns 0xbe03ce
dec byte [esp + ecx*4 + 0x1d]
mov ebx, 0x51918f07
sal cx, 0x47
call fcn.00aed197
or dl, al
movzx ax, byte [ecx]
sbb edi, 2
shl edx, 0x90
mov ecx, edx
inc edx
mov word [edx + edi - 1], ax
push ecx
dec edx
call fcn.00b786e8
mov eax, 0xbc244b30
ror ax, 0x27
lea edx, [eax + eax*2 + 0x51aa973c]
mov eax, dword [esi]
or edx, edx
lea ecx, [edx + edx - 0x13616adc]
sub cl, 0x96
adc esi, 3
sub cx, dx
lea ecx, [ecx*8 - 0x7e4402d5]
xor eax, ebx
sal edx, cl
xor eax, 0x52ab8a38
rol ecx, cl
lea eax, [ecx + eax + 0x4f0a29d9]
not edx
shr cl, 0x65
cmovns cx, dx
ror eax, 3
bt edx, edx
not eax
btc cx, cx
sbb dx, dx
xor dl, dh
neg eax
btc edx, edx
xor eax, 0x511bb5b4
imul cx, dx
add edx, 0xf3384b91
bswap eax
rol dx, 0xb
rol eax, 3
add cx, cx
dec dl
xor ebx, eax
bts ecx, ecx
add ebp, eax
and cx, cx
jbe 0x796a9c
sub cl, 0x11
mov ecx, dword [edi + edx - 0x3570925b]
sbb dl, dl
mov ax, word [edi + edx*2 - 0x6ae123fc]
call fcn.00bbb9ff
mov eax, 0x9a1b52bf
sub esi, 4
or ax, ax
jge 0xbe036b

Function at 0xcd2bf0
Capabilities:
Encode data using xor

Disassembly:
setb byte [esp + 4]
test ebx, ebx
push 0xcfa2a51b
push 0x9997adbf
lea esp, [esp + 0x10]
je 0xc3db27
Function at 0xcd6da0
Capabilities:
Authenticate hmac

Disassembly:
dec ebp
xor edx, eax
inc ecx
rol esi, 1
inc ecx
xor esi, 0x7c14c22c
inc ecx
sub esi, 0xdaba0f10
inc esp
mov dword [esp + eax - 0xe1c9ca8], edx
inc cx
not ebx
inc ecx
xor esi, 0xa30da714
dec edi
lea eax, [edi + edi - 0x75c285ff]
inc ecx
not esi
sar word [esp + eax*2 - 0x1c39394c], 0x26
dec eax
cdq
dec eax
mov dword [esp + eax*2 - 0x1c39394c], ebp
inc esp
xor dword [esp + eax*4 - 0x387272a0], esi
ror word [esp + eax*4 - 0x387272a5], 0xc9
movzx ecx, word [esp + eax*2 - 0x1c393951]
dec eax
mov ebp, dword [esp + eax*2 - 0x1c39394c]
jae 0xb4ba30
dec ebp
arpl si, si
dec dx
inc ecx
and edi, 0x39078da7
dec ebp
adc ebp, esi
inc sp
xor edx, dword [esp + eax - 0xe1c9ca5]
pop eax
pop ecx
jne fcn.0079a4c9
neg eax
sbb ebx, 0x90360eaf
rol ebx, 3
inc ebx
inc ecx
movsx esi, dx
dec esp
xor esp, esi
inc sp
sub edi, eax
xor ebx, 0x22227ca5
inc edx
neg byte [esp - 0x2366a80e]
lea ebx, [ebx + edx*4 - 0x47dc93dc]
inc ecx
sub edx, edx
cwd
js 0xcab7bd
neg dword [esp + ecx - 0x2a338555]
mov dword [esp + ecx - 0x2a338555], esi
ret
ror ebx, 3
jmp 0xcc2c34
dec edx
mov dword [esp - 0x46cd5024], ebp
push ecx
neg dx
dec eax
cwde
inc edx
xor dword [esp - 0x11b35401], ebx
inc esi
movsx ebx, word [esp - 0x46cd5020]
dec edx
mov ebp, dword [esp - 0x11b35401]
dec edx
div dword [esp - 0x11b35409]
dec eax
arpl bx, bx
inc edx
dec dword [esp - 0x2366a810]
cwde
dec esp
add ebp, ebx
call fcn.00789fb0
mov dword [esp], 0xfe72dbdc
call fcn.00ca25fd
btc ebx, eax
dec esi
lea edi, [esp + edi + 0x10]
sal ebx, 0x89
inc ecx
mov ecx, dword [edi + eax*4 - 0x387272a8]
xor byte [esp + eax - 0xe1c9ca1], 0x1b
dec edi
lea eax, [edx + esi*8 - 0x41e41967]
dec esi
lea ecx, [eax + ecx - 0xe1c9cae]
inc ecx
ror esi, 0x9c
inc ecx
mov dword [ecx + eax*2 - 0x1c393954], ecx
inc esp
mov esi, dword [edi + eax*8 - 0x70e4e550]
dec edi
lea edi, [ebx + eax - 0x6bc23174]
inc dword [esp + eax*2 - 0x1c39394b]
dec eax
lea edi, [eax + edi - 0xe1c9ca6]
inc esp
xor esi, ebp
jmp 0xa82d85
Function at 0xce4fb6
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ecx + 0x260522ba]
pop esi
mov edi, edx
jmp 0x71b517
sal eax, 0x9b
adc esi, edx
xor eax, dword [edi + eax*4]
lea edx, [ecx + ecx*4 - 0x69682573]
bt edx, edx
lea edi, [edi + ecx*2 - 0x4d59cff4]
setae cl
lea ebp, [ebp + ecx - 0x26ace701]
sub ecx, 0xd22443a4
movzx edx, byte [ebp + edx - 0x57f86279]
push ecx
imul ecx, dword [esp + ecx - 0x5488a354]
sbb word [esp], cx
xor dl, bl
add cx, cx
adc ecx, 0xebbacaa0
mov dword [esp + 4], ecx
inc dl
rol dl, 1
not cx
not byte [esp + 0xa]
xor dword [esp + 1], 0xd2a91908
not dl
shl cx, cl
ror dl, 1
bt ecx, ecx
shl dword [esp + 5], 0xf
lea ecx, [ecx*2 - 0x2b55eeff]
neg dl
sal byte [esp + ecx - 0x143437fe], 0xa1
not cx
xor bl, dl
call fcn.00c1f427
shr byte [ebp + 3], 0xcf
test eax, 0x3dff2dfa
das
fsqrt
sub eax, 0xcd795dff
cli
sub eax, 0xe96741ff
mov dl, 0xf5
pop esi
sar byte [esi + esi*8 + 0x64], cl
sbb al, 0x7e
jp 0xce506c
jp 0xce5084
push edi
pop edx
mov dword [esi], esi
add al, 0x95
wait
jne 0xce507a
fdiv qword [ecx + 0x66]
push ss
mov cl, byte [ecx]
adc eax, 0xbf12fcb9
jne 0xce5058
test dword [esi + 0x41], eax
pop ds
and dword [edx], 0xa1a6c1fe
sub esp, dword [eax - 0x71]
clc
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0xf88f602b]
stosb byte es:[edi], al
salc
daa
inc ebx
jne 0xce50e7
and dh, 0xba
out 0x97, eax
xor dword [edx + 0x19], ecx
push ss
lodsb al, byte [esi]
mov ch, 0x73
fsub qword [edi + ecx - 0x43]
js 0xce5095
jno 0xce50d0
add byte [ebx + 0x38], ch
lahf
mov byte [eax], bl
jno 0xce50fd
mov esp, esi
pop ebp
popfd
mov ecx, 0x4fbbb518
pop eax
jmp 0xb4222c
push esp
dec dword [ebp + 0x387d3f94]
js 0xce50f4
inc esp
mov word [edi + 0x441a200c], ds
mov word [edi], cs
fdivr dword [eax]
sbb al, byte [esp + ecx*4 + 0x27]
mov word [edi], fs
mov eax, 0x8c441a80
pop edi
lodsb al, byte [esi]
and byte [edx], bl
inc esp
mov word [edi - 0x34], es
enter 0x441a, 0xffffffffffffff8c
pop es
loopne 0xce514d
inc edi
int3
sbb al, byte [esp + ecx*4 + 0x57]
shl al, 0x1a
inc esp
mov edi, es
sub al, 0x88
adc dword [ebx + edi*8 + 0xb374716], esp
add byte [eax], al
add byte [edx + 0x7a21bcca], al
add ch, bh
test al, 0x76
salc
invalid
add al, 0x20
Function at 0xce5c27
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x92
imul edx, edx
xor al, 0x98
xchg dword [esp + ecx - 0x144f699], ecx
bswap ecx
neg edx
inc al
pop edx
neg dx
xor al, 0x96
imul edx, dword [esp + edx*2 - 0x1dc00300]
sar ecx, cl
xor bl, al
ror ecx, 0x88
ror ecx, 0x6d
lea eax, [esp + eax + 0xc]
sub edx, ecx
add dword [esp + ecx*4 + 7], 0xf907d28c
adc dx, cx
movzx dx, byte [eax + ecx*2]
mov ax, dx
call fcn.00bd47b7
xor bl, ah
insd dword es:[edi], dx
dec edi
push ecx
call dword [ebp + 0x46]
xor eax, 0x35ff2d52
invalid
xor al, bl
push ecx
sub edx, 0xb081b2ab
rol al, 1
btr edx, edx
sub edx, dword [esp + ecx - 0x144f69d]
xor al, 0x9f
push edx
jmp 0x71586f
sub eax, 0xa484b9bb
neg ecx
bt cx, 0xad
xor eax, 0x9f24c4a6
mov dword [esp + ecx*8 - 0xa27b528], 0xa728ada3
imul edx, edx
jae 0xb5925a
lea eax, [ecx + eax - 0x39453952]
rol dword [esp + ecx*8 - 0xa27b528], 0x5a
xor ebx, eax
add esi, eax
xadd dword [esp + ecx - 0x144f6a1], edx
mov dword [esp + ecx - 0x144f6a4], ecx
movzx eax, byte [ebp + ecx*2 - 0x289ed4f]
jge 0xae0fd8
ror cl, cl
inc dx
xor bl, al
bswap ecx
mov word [ecx + edi - 0x7c805bc7], ax
movsx eax, cx
sal eax, cl
lea ecx, [ecx + ecx*4 - 0x5f6c70fc]
mov ecx, dword [ebp + edx*2 - 0x6dea2215]
cdq
xor ecx, ebx
dec ecx
neg ecx
not eax
dec edx
lea ecx, [ecx + eax - 0x43b5a33]
not edx
setne dl
xor ecx, 0xe411ae23
dec dl
dec ecx
neg dl
shr dx, 0x26
bt dx, dx
xor ebx, ecx
add esi, ecx
call fcn.00bdf8fe
Function at 0xcea62f
Capabilities:
Encode data using xor

Disassembly:
neg ax
mov eax, dword [ebp + eax - 0x7f902aff]
mov edx, 0x7b84ce02
movzx ecx, dx
lea ebp, [ebp + ecx*4 - 0x33804]
bts dx, cx
bswap edx
not edx
xor eax, ebx
push ecx
bswap eax
jmp 0xb69386
cbw
pop edx
js fcn.00c9443b
inc eax
shl ecx, cl
bswap eax
xor ebx, eax
add dl, 0x86
dec ecx
ja 0xba2d55
cmp dword [edi + ecx*8 - 0x3c2e367], ecx
push ebp
insd dword es:[edi], dx
cmp al, 0xed
in al, dx
push ebp
insd dword es:[edi], dx
je 0xb53221
mov bh, bh
cmc
insd dword es:[edi], dx
invalid
ret
pop edx
sub cx, cx
inc eax
shr dx, 0x26
rol eax, 1
sub dl, 0xb6
bswap eax
not ecx
btc ecx, ecx
xor eax, 0xcb0e7fbb
or ecx, edx
adc cx, cx
xor ebx, eax
add edi, eax
jmp edi
mov word [edi + edx*2 - 0x2000], ax
ror dword [esp + edx*2 - 0x1ffe], cl
xchg dword [esp + ecx*8 - 0x7f8], edx
mov cx, word [ebp + edx*4 - 0x78ea2]
movsx eax, byte [esp + edx*2 - 0x3c754]
dec dword [esp + edx*8 - 0xf1d50]
inc dword [esp + edx - 0x1e3aa]
lea ebp, [ebp + edx*2 - 0x3c74c]
xchg ah, dl
xor cx, bx
neg byte [esp + edx - 0x1e3fc]
sbb cx, 0x7a3a
pop eax
lea eax, [eax - 0x2dfc169]
rol cx, 1
sub al, al
and dl, ah
inc cx
not cx
cwd
sub cx, 0x7505
add eax, edx
not cx
neg dx
xor bx, cx
mov word [edi + edx - 0x10004], cx
cdq
lea eax, [esp + 0x3c]
push edx
movzx cx, byte [eax]
movzx eax, byte [esp]
or dword [esp + eax - 0xff], edx
sal eax, 0xd4
mov word [edi + eax - 0xff00006], cx
add ax, ax
movzx ecx, dx
xor byte [esp + eax - 0xff00000], 0x84
lea edi, [eax + edi - 0xff00006]
and edx, edx
js 0xb531b8
mov eax, ebp
sub ebp, 4
mov ecx, 0x4c3681bc
mov edx, 0xfa9f43ac
mov dword [ebp + ecx - 0x4c3681bc], eax
bt ecx, edx
sbb edx, ecx
sar cx, 0x45
mov edx, dword [esi + ecx - 0x4c36fc0d]
bt cx, 0x1a
lea eax, [ecx + ecx*4 - 0x67d3895f]
xor cx, 0x631d
lea esi, [ecx + esi - 0x4c369f0c]
setb al
xor edx, ebx
call fcn.00c963ad
mov dword [esp], edx
shr edx, 0xd4
xor ax, 0xc6aa
xor dword [esp + edx*2 - 0x1ffe], edx
movzx ecx, dl
xor bx, ax
neg dword [esp + ecx - 0xff]
jg 0xc068bc
movzx dx, byte [esi]
mov cl, byte [esi + 2]
add esi, 2
mov eax, 0x7f90d52f
ror al, 0xa7
setae al
sal dl, cl
mov word [esi + eax - 0x7f90d501], dx
jmp 0x7bf85d

Function at 0xced1df
Capabilities:
Hash data using murmur3
Parse pe header

Disassembly:
ror edx, 3
not al
not eax
xor eax, dword [esp + ecx - 0x263f0022]
bswap edx
xor ebx, edx
sal cx, 4
adc esi, edx
cdq
and dl, 0x8c
movzx ecx, byte [ebp + eax - 0x184e2eab]
add eax, dword [esp + eax - 0x184e2eac]
sar eax, 0xe1
lea ebp, [ebp + edx + 6]
mov dword [esp + edx*2], eax
mov dword [esp + edx*8 + 4], edx
xor cl, bl
xadd dword [esp + edx*4 + 1], eax
pop edx
ror cl, 1
shr dx, 0x61
xor cl, 0x8c
and eax, dword [esp + eax*8 - 0x6be34b8]
ror cl, 1
inc cl
xor bl, cl
mov word [edi + eax*2 - 0x124], cx
movzx ecx, dx
cwd
lea edi, [edi + eax*2 - 0x124]
idiv cx
sar cl, 0x81
pop ecx
jp fcn.00bb937c
Function at 0xcf4ea1
Capabilities:
Encode data using xor

Disassembly:
dec esi
lea ecx, [ebx + ecx - 0x29a58008]
mov eax, dword [ebx + edi - 0x29a57ff6]
dec esp
xchg dword [esp + ecx + 0x194baad5], ebx
inc ecx
push eax
dec esp
xchg dword [esp + ecx + 0x194baad8], eax
dec eax
lea edi, [ecx + edi + 0x194baae3]
dec ecx
lea edx, [edx - 0x32f15dd7]
dec ebp
bt esp, esp
xor eax, ebp
inc eax
call fcn.00ce7563
jmp 0xbf0c24
mov edx, dword [esi + ecx - 0x714c6356]
sal dword [esp + ecx - 0x714c6356], cl
xadd dword [esp + ecx - 0x714c6356], eax
setl byte [esp + ecx - 0x714c6356]
xor edx, ebx
push eax
lea eax, [eax + ecx*2 + 0x25296bad]
call fcn.00bfd97d
add ebp, edx
neg eax
ror cx, 0xe6
mov edx, dword [esp + ecx - 0x714c6356]
lea esi, [ecx + esi - 0x714c635a]
rol byte [esp + ecx - 0x714c6354], 0xc6
jae 0x79610c
invalid
leave
xor dword [edx - 0x31], esi
mov al, byte [0x30ff5ca6]
adc byte [eax - 0x3300a35a], ch
jle 0xbf0c41
cmpsb byte [esi], byte es:[edi]
pop esp
inc dword [esp - 0x17]
salc
mov word [eax], fs
pushfd
cmpsb byte [esi], byte es:[edi]
shr eax, 1
push 0x46
mov ch, 0xf0
dec edx
jnp 0xbf0cd5
outsb dx, byte [esi]
inc ebp
ret
sub byte [edi - 0x35], dh
inc esp
lcall 0xdc22, 0x77e10017
xor byte [ecx - 0x67], dh
mov eax, dword [0x1c40f415]
lodsb al, byte [esi]
invalid
btr edx, 0x22
adc ebp, 4
mov eax, 0xc529f110
xor ecx, ebx
push edx
sub ecx, 0x12888893
mov dword [esp], 0xda3b20b7
cbw
neg al
not ecx
add dword [esp], 0x1d02d181
neg ecx
xchg byte [esp + 3], ah
shr dword [esp], 0xf4
rol ecx, 2
not ecx
cwde
jmp 0xb906a1
inc ebp
mov esi, dword [ecx + 4]
inc ecx
mov cl, byte [ecx + 8]
dec ecx
add ecx, 6
inc ecx
mov edx, 0x61ae3c8a
dec esi
lea ebx, [edx*2 + 0x5c294083]
inc ecx
movzx edx, dl
inc esp
shld ebx, esi, cl
dec edx
mov dword [esp + edx - 0x61ae3c8a], 0xf4a7bfb2
inc ebp
movsx esp, dl
call fcn.00aeb662
dec eax
dec eax
inc ecx
sub edi, 0x12919610
dec ebp
cmova esi, edi
dec esp
lea esp, [esi*4 + 0x1322af2c]
dec eax
xor eax, 0x7e88a18e
dec eax
xor ebp, eax
dec esp
or ebx, dword [esp + ebx - 0x29a58000]
dec edx
mov dword [ebx + ecx - 0x29a58008], eax
jne 0x70af25
mov edx, 0xcb8b6d08
mov ecx, 0xa036c1f
bts ecx, ecx
mov ecx, dword [ebp]
jae 0xcc186a
dec edx
shr eax, cl
btc eax, eax
add cl, ah
not edx
xor ebx, edx
add esi, edx
bts cx, 0x1c
setb al
mov edx, dword [edi + eax - 0xc01]
mov eax, dword [edi + eax - 0xbfd]
push ecx
dec dword [esp]
btc cx, cx
mov cl, byte [edi + 8]
adc edi, 6
call fcn.00ae46ed
cwd
dec ecx
or esi, ebp
jmp esi

Function at 0xcf936c
Capabilities:
Authenticate hmac

Disassembly:
dec eax
lea edx, [ecx*4 - 0x16750457]
dec ebp
lea ecx, [ecx + ebx*4 - 0x4cd0002]
inc ecx
sal dl, 0xc6
ja 0x742c4d
dec word [esp + ecx - 0x66919975]
inc bp
mov dword [ecx + ecx - 0x6691997f], edi
mov eax, dword [edi + ecx - 0x6691997f]
dec eax
inc dword [esp + ecx - 0x66919977]
call fcn.00ce61ba

Function at 0xcfda71
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0x290c9c85], ecx
ror eax, 1
neg eax
sal edx, cl
mov dword [esp + ecx - 0x290c9c89], edx
rol dl, 0x81
bswap eax
xor ebx, eax
push ecx
add esi, eax
pop ecx
pop ecx
pop eax
jmp fcn.00bb937c