joyce8/EMBER2024-capa huggingface dataset:
Function at 0x115fdd9
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor ebx, edx
sal ecx, 0xcc
pop ecx
btr eax, 0x93
add esi, edx
bt ax, cx
lea edx, [ecx + ecx*2 - 0x24cc9361]
setb dl
jmp esi
lea esp, [esp + 0xc]
jne 0x19f6f92
pop edi
mov ecx, 0xe7a18b9e
not eax
mov edx, 0x399727b7
xor ecx, edx
bts edx, ecx
mov dword [edi + edx*2 - 0x732e4f6e], eax
movzx eax, dx
mov ecx, eax
mov cl, byte [ebp + 4]
neg ax
shr al, 0xa6
bts eax, eax
adc ebp, 6
inc ax
sal ax, 0xc5
mov byte [edx], cl
sbb edi, 4
mov edx, dword [edi]
xor edx, ebx
mov ecx, eax
neg cl
push ecx
xor edx, 0x4b8bef26
bswap ecx
dec edx
neg edx
inc cl
setnp byte [esp]
bswap edx
neg edx
dec byte [esp + 1]
jl 0xff79b5
dec ecx
jmp 0x107fc41
jne 0x1a55c13
jbe 0x115fde2
mov ebp, 0x44f55d2
and byte [esi + 0x657858fe], 0x46
pop edx
push cs
invalid
rcl byte [ebp + 0x4f], cl
add al, 0x82
cmpsb byte [esi], byte es:[edi]
invalid
inc edx
xor eax, 0x800af11c
dec dword [esp + 3]
push 0x285473d
jl 0x10fafb8
mov eax, 0xd90b5a0c
cdq
mov edx, dword [ebp]
jmp 0x10eecbe
and edi, 0xff
dec byte [esp + 1]
rol dword [esp], 0x52
mov edi, dword [edi*4 + 0x1a4460c]
call fcn.0115fdd9
mov edi, 0x67a78d3f
movzx edi, byte [edx + edi - 0x67a78d3f]
xor edi, eax
push 0xeaa218b9
jmp 0x1300f20
mov dword [esp], 0xe1a10809
shr eax, 8
xor eax, edi
shl dword [esp], 0x8f
jae 0x119a394
xor ebx, ecx
add esi, ecx
lea ecx, [edx + edx*2 - 0x42f6e5cf]
mov edx, dword [edi + edx*2 - 0x12d96]
call fcn.01a0d8a5
dec ecx
sub esi, 4
mov edx, 0xb018a2ba
inc ecx
mov ebp, dword [esi]
movzx eax, dl
jmp fcn.019f3b50

Function at 0x11607a3
Capabilities:
Authenticate hmac

Disassembly:
mov al, byte [esi + 4]
shl dl, 0x47
jbe 0x1a55688
mov ecx, 0xa105f119
mov eax, dword [edi]
lea edx, [ecx - 0x66e329f7]
push edx
btr ecx, 0xf
mov ecx, dword [edi + edx*2 - 0x74458e40]
lea edi, [edx + edi - 0x3a22c71a]
shl dx, 2
sbb dword [esp + edx - 0x3a221c88], edx
ror dword [esp + edx*2 - 0x74443910], 0x7e
mov dword [eax + edx*2 - 0x74443910], ecx
xchg dword [esp + edx*2 - 0x74443910], edx
mov eax, dword [esi + edx - 0x2aa64]
movsx ecx, dl
lea esi, [esi + edx - 0x2aa60]
xor eax, ebx
neg cl
not ecx
and edx, ecx
neg eax
ror eax, cl
not eax
rol eax, 2
inc dword [esp + edx - 0x2aa60]
xor ebx, eax
shr ecx, cl
xchg byte [esp + edx*2 - 0x554bf], dl
jne 0x1a8e62b
adc esi, 5
shl dl, 0x61
mov dword [esp], 0xae36fd2e
mov byte es:[ecx], al
lea ecx, [edx + edx*2 - 0x42dce350]
movzx eax, byte [esp + 8]
add al, dh
mov dword [esp + eax - 0xc0], ebp
ret 8
adc ebp, eax
sal cx, cl
mov eax, 0xa381b3af
mov dword [esp + edx*4 - 0xaa870], ebp
ret
Function at 0x116082c
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
ror esp, 0xa2
bswap ecx
dec esp
mov dword [esp + edx*8 - 0x43f58], esp
inc sp
sbb ebp, dword [esp + edx*2 - 0x10fcc]
push ebp
inc ecx
ror ecx, 1
add al, 0x32
lea ecx, [ecx + edx*2 - 0x30887076]
cwd
dec edx
sub dword [esp - 0x6a859e61], edx
not ecx
call fcn.012caf9b
mov ecx, 0xa18aaa11
lea eax, [ecx + ecx + 0x4d1a1f80]
mov ecx, dword [esi]
movsx edx, al
sub eax, edx
cmovnp ax, dx
adc esi, 3
sal eax, 0x89
not edx
push edx
mov dword [esp + edx - 0x5d], ecx
shr dx, 0x2a
movzx ecx, al
popfd
call fcn.00fe79d2
ror al, 1
not al
and edx, edx
xor bl, al
shl dl, 0xa1
and edx, edx
adc eax, esp
btc cx, 0x8c
mov cx, word [edx + eax]
lea ebp, [ebp + edx*2 - 2]
inc dx
or dx, 0xafbb
mov word [ebp + edx - 0xafbb], cx
mov edx, dword [edi + edx*2 - 0x15f76]
mov ecx, 0xdab8f013
mov eax, 0x5ab622b8
and cl, 0x8e
lea edi, [edi + eax - 0x5ab622b4]
call fcn.010f6022

Function at 0x11653b8
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov edx, 0xd995501e
dec word [esp + 2]
mov dx, word [esi + 4]
sar byte [esp + 2], 0xc3
adc esi, 6
jb 0x1075a24
mov dword [esp], 0xc80b249b
sbb ebp, 8
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
mov eax, dword [esp]
rol eax, 0xd
mov dword [ebp + eax - 0x649378fd], ecx
mov dword [eax + ebp - 0x64937901], edx
mov dword [esp + eax - 0x64937901], eax
mov ebx, dword [esp + eax - 0x649378fd]
pop eax
pop edx
jb fcn.010b8be2
mov ecx, dword [esi]
jmp 0x1adb4d3

Function at 0x117d2b5
Capabilities:
Encode data using base64

Disassembly:
shr eax, 8
sal dword [esp], 0x89
xor eax, esi
and dword [esp], 0x79120905
jbe 0x1ac89a9
inc edx
rol dword [esp], 0xa7
call fcn.0118bcb3
lea esp, [esp + 0x18]
jne 0x19ce7e1
pop esi
mov edx, 0x4c259c08
movzx ecx, dx
not eax
sar dx, 0x46
adc cx, 0xa29c
push ecx
mov dword [edx + edi - 0x4c25fe70], eax
mov eax, dword [esi + ecx*2 - 0x7d48]
shl edx, cl
pop ecx
shr dx, 0x48
lea esi, [esi + ecx - 0x3ea0]
rol cx, cl
add dx, cx
push ecx
xor eax, ebx
btc edx, edx
push ecx
pop ecx
lea eax, [eax + ecx*2 + 0x49a856a9]
xor eax, 0xc199daaf
neg edx
bswap eax
not cl
sal ecx, 0xd9
push edx
not eax
imul edx, dword [esp + edx - 0x3da010d3]
inc eax
xor eax, 0xbba43c3b
add dword [esp + ecx - 0x77fffffc], edx
sub cx, cx
xor ebx, eax
pop edx
and dl, 0x22
adc ebp, eax
xchg dword [esp + edx - 0x3da01002], ecx
mov dword [esp + edx*2 - 0x7b402004], ebp
ret
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
push 0x5f88583e
sub byte [esp + 1], 0x1d
mov esi, dword [esi*4 + 0x12e5934]
ja 0x112ef6c
jl 0x19ce810
mov edi, 0x335274f4
lahf
enter 0x6641, 0xffffffffffffff85
ret

Function at 0x1183e48
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [ebp + ecx - 0x5091d389]
mov dword [esp + ecx - 0x5091d379], ecx
ror ecx, cl
mov dword [ebp + 4], eax
mov dword [ebp], edx
lea edx, [ecx + ecx*4 - 0x5e5460e7]
shl edx, 0x30
sbb cx, cx
pop eax
pop edx
pop edx
jle fcn.010b8be2
Function at 0x118cd10
Capabilities:
Encode data using base64

Disassembly:
pop edx
neg eax
inc eax
xor ebx, eax
movsx edx, cx
rol dl, 0xe1
not cl
adc esi, eax
shl edx, cl
lea ebp, [ebp + ecx - 0x6000100]
shl dx, 0x8f
movzx eax, cl
adc dl, byte [ebp + ecx*2 - 0xc0001fe]
ror cl, 0xe4
not cx
xor dl, bl
dec ecx
sal cl, 0x42
add dl, al
lea eax, [ecx + ecx + 0x6a11e3b5]
neg ecx
sal cl, cl
ror dl, 1
bswap eax
inc dl
xchg ecx, eax
cwde
bt eax, 0x27
neg dl
rol dl, 1
xor dl, 0xb3
dec al
bswap eax
shl ax, 0xcc
xor bl, dl
btc ax, 0x16
xchg ecx, eax
neg ecx
add edx, esp
ror al, 0x83
mov cx, word [edx]
mov edx, eax
bts edx, edx
sbb edi, 2
ror dx, 0x4f
xor dl, ah
mov word [edi], cx
cwde
movzx ecx, dl
cbw
js fcn.019f5515
mov edx, 0xd7967328
lea ecx, [edx*2 + 0x432459b0]
sub edi, 4
mov eax, dword [edi]
and dl, 0x28
sbb edx, 0x24165734
xor eax, ebx

Function at 0x11970f1
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0x9287253d
mov dx, word [esi]
mov eax, 0x7f151d10
mov cl, byte [esi + eax - 0x7f151d0e]
lea esi, [eax + esi - 0x7f151d0e]
bt eax, eax
sub al, al
bts eax, eax
shr dx, cl
or eax, eax
mov ecx, 0xa0ba7f83
neg al
mov word [esi + eax - 0x7f151dff], dx
imul eax, eax
sbb cx, ax
sbb edi, 3
sar ax, cl
sub ecx, eax
mov edx, dword [edi]
xor edx, ebx
call fcn.00fec43f
imul ax, ax
lea esi, [eax + esi - 0x6f6bfffc]
bswap ecx
xor edx, ebx
or cx, cx
inc edx
not cl
lea eax, [eax + ecx*8 + 0x41aded13]
mov dword [esp + ecx - 0x80c513], eax
bswap edx
rol edx, 2
pop eax
not edx
xor ebx, edx
push eax
cwde
add word [esp + eax*2 - 0x2b55], 0xdf99
lea edi, [edi + eax*8 - 0xad5c]
mov dword [edi + ecx*2 - 0x1018a26], edx
cwde
mov edx, eax
xadd al, dh
pop edx
jp fcn.01002e95
mov ecx, 0xae9fa3b1
jmp 0x12d87cf
bts ecx, ecx
sbb edi, 3
mov eax, 0xaab36e11
or eax, eax
mov eax, dword [edi]
mov edx, 0xe0b842f
jns 0xfd2e28
xor eax, ebx
imul edx, edx
and ecx, ecx
neg edx
inc eax
rol dl, 0xa4
not edx
ror eax, 1
xchg cl, dl
or edx, ecx
bswap eax
or cl, ch
xor cx, 0xc517
lea eax, [eax + ecx + 0x38e553f5]
sub dx, cx
ror eax, 2
call fcn.01a0da21
mov edx, 0x4013bc20
lea eax, [edx - 0x25d98ac4]
lea edi, [edi + eax*4 - 0x68e8c574]
inc edx
mov edx, dword [edi + eax*4 - 0x68e8c570]
cwde
setns al
bswap eax
xor edx, ebx
lea edx, [eax + edx - 0x48e4b033]
btr ax, ax
jb 0x19c0d7c
and eax, eax
xor edx, 0x7298fe8f
inc edx
imul eax, eax
ror edx, 1
shl ax, 1
push eax
xor ebx, edx
or eax, 0xf596a6be
ror ax, 0xca
add esi, edx
sub edi, 1
rol eax, 0x47
mul dword [esp]
xor al, byte [eax + edi]
inc dl
inc edx
bt edx, 0x19
xor al, bl
bts edx, 0x27
pop edx
dec al
rol al, 1
shl dx, 0xea
adc al, 0x29
rol al, 1
add al, 0x9d
rol al, 1
shr dx, 0x81
adc al, 0xaa
xor edx, edx
ror edx, 0xa9
xor al, 0x32
dec al
sar dl, 0x42
ror edx, 0xbb
sar edx, 0xde
xor bl, al
or edx, edx
push edi
push esi
push ebx
lea ebx, [edx*8 - 0x3073e6f9]
mov ebx, eax
lea eax, [edx + edx + 0x72bc1737]
cdq
or dl, 0x3b
mov edx, ebx
ja 0x12cd3cd
Function at 0x11997ae
Capabilities:
Encode data using base64

Disassembly:
xchg edx, eax
add esi, ecx
cwd
or word [esp + edx*8 - 0x7ffee], dx
push edx
lea ebp, [edx + ebp - 0x10000]
bts eax, edx
inc eax
movzx eax, byte [edx + ebp - 0xffff]
lea edx, [edx + edx*8 + 0x686b3]
shr edx, 0x52
xor al, bl
add al, 0x2a
lea edx, [edx + 0x40192608]
neg al
rol al, 1
bt edx, 0x2c
ror dx, 0xa
sub dl, 0xb0
inc al
bt dx, 0x93
shr word [esp + edx - 0x4019820d], 0xc8
push edx
xor bl, al
btr dx, dx
mov dword [esp + edx - 0x40198009], ebp
xadd word [esp + edx - 0x40198015], dx
mov dword [esp + edx - 0x4019fff3], esi
mov dword [esp + edx - 0x4019fff7], edx
movsx ebp, word [esp + edx - 0x4019fff7]
and ebp, ebp
mov dword [esp + edx - 0x4019fff7], ebx
mov ebx, edx
btc bp, dx
mov ebp, edi
rol word [esp + ebx - 0x4019ffff], 0x4e
or edx, dword [esp + edx - 0x4019ffff]
mov ebx, eax
mov edx, ebx
mov eax, dword [esp + 3]
jns 0x1ba0095
shl edx, 2
push eax
mov eax, ebp
ror dword [esp + 7], 0x3a
jae 0x1002eaf
mov edx, 0x36205533
push edx
movsx ecx, dx
lea edi, [edi + ecx - 0x5537]
movzx eax, dl
mov ecx, dword [edi + edx - 0x36205533]
xor ecx, ebx
rol ecx, 3
mov dword [esp + edx - 0x36205533], eax
sub dx, word [esp + edx*2 - 0x6c40aa64]
cbw
lea ecx, [ecx + eax - 0x423304d7]
dec edx
shr al, 0x86
neg ecx
jmp 0x19be161

Function at 0x119b29d
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + ecx - 0x75aa4a8a]
sar cx, 0xcd
and cx, 0x110d
adc cx, cx
mov dword [eax + ecx - 0x75aa0000], edx
mov dword [esp + ecx - 0x75aa0000], ecx
movzx edx, cx
lea ebp, [edx + ebp - 4]
or dword [esp + edx*2], 0x4c12f216
adc edx, dword [ebp + ecx - 0x75aa0000]
bswap ecx
xor edx, ebx
shr ecx, 0x84
call fcn.00ff5611

Function at 0x119b2df
Capabilities:
Encode data using base64

Disassembly:
sal cl, 0x86
mov dword [esp + ecx], eax
pop eax
pop edx
jae fcn.01002e95
add byte [eax], al
add byte [edi + 0x65], al
je 0x119b33a
imul ebp, dword [ebp + 0x54], 0x656c7469
inc ecx
add byte [ebx + 5], ah
mov edx, 0x115341d9
mov dl, 0xb8
retf
cmp al, 0xff
invalid

Function at 0x119b3ae
Capabilities:
Encode data using xor

Disassembly:
dec eax
add cl, dh
cmovo cx, dx
xchg dh, cl
bswap eax
sbb eax, 0x87094fad
rol eax, 1
xor edx, ecx
bt cx, dx
xor ebx, eax
xor cl, 0x1f
add ecx, 0x34895b30
jne 0x1a0dc0e
pop edx
mov eax, dword [esi]
mov ecx, 0x80329a2b
movzx cx, byte ss:[eax]
add esi, 2
mov eax, 0x8a828a84
mov word [esi], cx
movzx ecx, ax
xadd al, cl
lea edi, [edi + ecx*2 - 0x1150c]
mov eax, dword [edi + ecx - 0x8a84]
xor eax, ebx
and ecx, 0x48eae17
rol eax, 1
mov edx, ecx
and cx, cx
sete dl
not eax
dec ecx
lea ecx, [ecx*2 + 0x23af22a0]
jge 0x1070798
adc ebp, eax
sar cl, 0x23
mov eax, edx
sbb cl, cl
jmp ebp
Function at 0x11b4dfe
Capabilities:
Execute syscall

Disassembly:
not cx
mov ecx, dword [edi + edx - 0x5db8f9ea]
lea edi, [edi + edx - 0x5db8f9e6]
mov dword [esp + edx - 0x5db8f9ea], 0x593ba19d
sets byte [esp + edx - 0x5db8f9ea]
adc eax, 0x4b8cc280
xor ecx, ebx
ror eax, 0x41
ror al, 0x21
lea edx, [eax*2 + 0x2b909203]
inc ecx
xor ecx, 0x8122c03e
shl dl, 0xc4
inc dl
neg ecx
idiv dword [esp]
sar dl, 0xa1
lea ecx, [ecx + edx - 0x5b9952f7]
adc edx, 0xd99cea19
mov dword [esp], edx
bswap ecx
cbw
sal dx, 0xe3
mul byte [esp + 1]
inc ecx
call fcn.0102c185
rdtsc
mov ecx, 0xdb82cf86
sub edi, 8
mov dword [edi + 4], eax
mov dword [edi], edx
mov eax, 0xd833dd3a
movsx edx, cl
mov edx, dword [esi]
call fcn.01075b31
syscall
push 0xd4010981
dec eax
mov dword [esp], 0xe1094171
call fcn.019d74fc

Function at 0x11b60ff
Capabilities:
Encode data using base64

Disassembly:
xor edi, eax
mov dword [esp], 0x933be602
sar dword [esp], 0xf8
and edi, 0xff
mov edi, dword [edi*4 + 0x1a9b488]
rol dword [esp], 0xe
shr eax, 8
call fcn.010397de

Function at 0x11b6128
Capabilities:
Encode data using base64

Disassembly:
xchg ch, al
lea edi, [edi + ecx*2 - 0x782b0e06]
mov dword [esp + ecx*2 - 0x782b0e04], ecx
call fcn.011c1506

Function at 0x11b7199
Capabilities:
Encode data using base64

Disassembly:
call fcn.011d8124
not eax
neg eax
sub eax, 0xdf05ee2f
lea ecx, [edx + edx + 0x1138751e]
inc edx
shr edx, 0xa4
xor eax, 0x4c340c8f
sub edx, 0xaf3d86ab
ja 0x1a85777
dec dx
inc eax
not dx
ror ecx, cl
dec cl
xor ebx, eax
add ebp, eax
lea eax, [ecx*2 + 0xa9cff05]
not edx
jmp fcn.012dd51d
and ax, ax
not dl
push eax
shr ax, 0x6e
and cl, dl
mov word [ebp + eax - 0x6ca20001], cx
lea esi, [esi + eax - 0x6ca20005]
mov eax, dword [esi + eax - 0x6ca20001]
mov edx, dword [esp]
imul edx, edx
push edx
xor eax, ebx
jmp 0x1ab64d8
xchg dword [esp + 2], edx
xor eax, 0xd41579aa
or dword [esp + edx - 0x443de763], 0x3e26faad
call fcn.01abc55e

Function at 0x11c654c
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x232a4c29
lea edi, [edi + ecx*2 - 0x46549856]
lea edx, [ecx*4 + 0x19901c8d]
Function at 0x11c7bb5
Capabilities:
Encode data using base64

Disassembly:
movzx dx, byte [ebp]
mov dword [esp], 0xef2307a1
mov eax, dword [esp]
movzx ecx, al
mov cl, byte [ebp + ecx*4 - 0x282]
add ebp, 2
sar word [esp], 0x41
sar word [esp], 0x24
or dl, cl
shr ax, 0x23
movzx ecx, word [esp]
not dl
inc cx
mov word [ecx + ebp - 0x3e], dx
lea edx, [ecx*4 + 0x78b6838c]
xchg ch, dl
sal byte [esp + ecx*2 - 0x1087b], 0x27
mov ecx, dword [edi + ecx*2 - 0x1087c]
lea edi, [edx + edi - 0x78b683fc]
xor ecx, ebx
or edx, eax
sal al, 0x85
rol ecx, 1
add eax, dword [esp]
lea ecx, [ecx + edx - 0x50197ec2]
cdq
bswap ecx
shl dword [esp], 0x14
cwde
jp 0x1abf32a
mov ecx, 0x1903ca95
lea ebp, [ebp + ecx*2 - 0x3207952e]
mov eax, dword [ebp + ecx - 0x1903ca95]
movzx edx, cx
xor eax, ebx
sar dx, 9
xor eax, 0x4183d71a
push edx
push edx
not eax
dec eax
and edx, dword [esp + ecx*4 - 0x640f2a52]
bts cx, 0x95
and edx, 0x7e905c06
rol eax, 1
sar dword [esp + ecx - 0x1903cab1], cl
xor eax, 0x1f36690b
or dl, byte [esp + ecx - 0x1903cab3]
shl dx, 5
not byte [esp + ecx*4 - 0x640f2ad4]
xor ebx, eax
mov dword [esp + ecx*2 - 0x3207956a], 0xcc10318f
add esi, eax
not dl
mov word [esp + ecx - 0x1903cab4], dx
mov edx, dword [edx + edi - 0xff]
ror cl, 0xe2
mov eax, dword [edi + ecx*2 - 0x320794d6]
jae 0x1ae224b
xor ecx, edx
call fcn.019a3887
mov ecx, 0x60b4cbbb
not cx
lea edi, [edi + ecx - 0x60b43448]
mov eax, 0x73039498
inc cx
mov edx, dword [edi + ecx - 0x60b43445]
btc ecx, 0xb6
cwde
xor edx, ebx
rol edx, 3
rol al, cl
bswap edx
adc ecx, 0xe1fa538
inc ecx
not edx
call fcn.01052457

Function at 0x11cb60b
Capabilities:
Encode data using base64

Disassembly:
cbw
bt eax, eax
neg edx
pop eax
add cl, ch
rol edx, 2
xor ebx, edx
movsx eax, cx
add ebp, edx
ror eax, 0x26
xadd cl, ch
rdtsc
bswap ecx
sal ecx, cl
shr cl, 0x66
sbb edi, 8
dec ecx
add ecx, ecx
mov dword [edi + 4], eax
mov eax, ecx
sal ecx, cl
neg eax
mov dword [edi + ecx - 0x80000000], edx
or ecx, eax
lea eax, [eax + eax*4 - 0x50d133cb]
jle fcn.01002e95

Function at 0x11d2185
Capabilities:
Encode data using base64

Disassembly:
movsx eax, dl
mov edx, ebx
or ax, 0x70a4
btr ax, ax
sal edx, 2
mov eax, ebp
call fcn.01ad39cc
jmp 0x1a44086
not dl
mov dword [esp + edx*4 - 0x7ffffc00], edi
add edx, edx
btc edx, edx
push esi
push ebx
xor dx, dx
bts dx, 0xa1
movzx ebx, dl
mov ebx, eax
jae 0x104e94f
sal dx, 0xbc
mov edx, 0x9e0346a7
bswap edx
sub edi, 4
call fcn.019ac5a1
Function at 0x11d6392
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
cwde
cwde
not edx
push ecx
shr word [esp + ecx - 0x5053c160], cl
bts ecx, 0x23
ror edx, 1
lea ecx, [ecx*4 - 0x7eccd145]
dec ecx
jge 0x11d7667
xor edx, 0xf33ccf9c
xor al, cl
jne 0x1ac9073
sub edi, 4
mov ecx, 0x46a935a8
lea edx, [ecx - 0x6b6a5674]
btc edx, 0x86
mov edx, dword [edi + ecx - 0x46a935a8]
jb 0xfdfdd9
sal cx, cl
xor edx, ebx
xchg ch, cl
lea edx, [edx + ecx*2 - 0x5c4d4aab]
not ecx
movzx eax, cl
rol edx, 2
rol cx, 5
sbb ecx, ecx
add edx, ecx
shl cx, 0xc9
shl eax, 0x41
neg edx
xchg ah, cl
jmp 0x1ab610b
lea edx, [edx + 0x7331d92b]
mov dword [esp + edx*2 - 0x1791ff06], 0xe4b605be
xor ebx, eax
imul dx, word [esp + edx*2 - 0x1791ff02]
call fcn.01099deb
mov ecx, 0x2829e0b1
lea edi, [edi + ecx*2 - 0x5053c166]
mov eax, ecx
lea eax, [ecx*4 - 0x2175e6cc]
mov edx, dword [edi + ecx - 0x2829e0b1]
btr cx, 0xa
adc ecx, ecx
ja 0x11b4c0a
or ecx, 0x3136eb02
xor ebx, edx
shl cl, 1
adc ebp, edx
shl ax, 0xb
mov ax, word [esi + eax*8 - 0x38000]
mov edx, ecx
xadd edx, ecx
call fcn.01313c9f
xor al, ch
lea edx, [ecx + edx + 0x99ecc7]
dec cl
dec ecx
neg edx
shl ax, 0x89
sbb edx, 0x2e88a18b
add eax, 0xfa18693f
xor ecx, eax
call fcn.0113a8a5
lea esp, [esp + 0x34]
ret

Function at 0x11e48f2
Capabilities:
Encode data using base64

Disassembly:
inc ecx
sal dword [esp + 0xb], 0x37
xor edx, 0xda37f006
and word [esp + 0xb], 0x3523
dec eax
lea esp, [esp + 0x18]
jne 0x10c46b6
mov eax, 0xf813516
movsx edi, al
pop edi
xor edx, edi
jmp 0x119213e

Function at 0x11e64e4
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 8]
not ax
mov dword [edi + 8], ebx
mov dword [edi + 4], ecx
call fcn.00ff0eff

Function at 0x12de33c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx - 0x8000], ecx
ja 0x1a0c1a6
xor eax, ebx
neg eax
bswap eax
xadd byte [esp + edx - 0x7ff9], ch
sal dx, 0x4e
not ecx
lea eax, [eax + edx*4 + 0xb28128a]
ror byte [esp + edx + 6], 0x41
bswap eax
sbb edx, dword [esp + edx + 2]
ja 0x11d3162
shr dx, cl
xor ebx, eax
add esi, eax
pop edx
sal dl, cl
pop edx
jne fcn.01172398

Function at 0x12e8f1f
Capabilities:
Encode data using base64

Disassembly:
cwd
ror ecx, 2
sub ecx, 0xf68144b4
xor ecx, 0xe7b126b6
and edx, edx
xor ebx, ecx
cwde
mov dword [esp], edx
pop edx
add ebp, ecx
sar ax, 0x43
mov ecx, dword [esp]
pop edx
jne fcn.01002e95
imul ecx
mov dword [edi], edx
pop edx
mov ecx, 0xae3a5baa
rol cl, 4
mov dword [edi + 4], eax
mov edx, ecx
mov eax, ecx
jae 0x12f0a43
sbb ebp, 4
cwde
mov ecx, dword [ebp + eax*4 - 0x16ea8]
xor ecx, ebx
ror edx, 0xf7
rol al, 0x41
lea ecx, [ecx + edx*2 - 0x6ec9d40d]
rol dx, 0x6d
neg ecx
btr ax, 0x36
bswap ecx
sal ax, 0x4c
xor ecx, 0x5ca03f28
ror al, 0x66
xor ebx, ecx
cwd
add esi, ecx
imul edx
lea ecx, [edx + edx*4 - 0x78da5343]
not ecx
jmp esi
Function at 0x12f213f
Capabilities:
Encode data using base64

Disassembly:
sbb edi, 7
sub byte [esp + 5], 0xb7
mov dword [edi + 0xc], eax
sal dword [esp + 4], 0x99
mov eax, 0x8b20259d
ror ax, 0x8c
mov dword [edi + 8], ebx
mov dword [edi + 4], ecx
mov ebx, dword [esp + 4]
mov ecx, eax
mov dword [edi + ebx*8 - 0x10000000], edx
sub eax, 0x9b37beaf
je 0x1a95825
push eax
mov ebx, dword [esp + ebx - 0x1fffff4]
sub cl, 0x27
dec ecx
movsx edx, cx
pop ecx
pop edx
pop ecx
pop eax

Function at 0x1300e6b
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x239f0193], eax
mov ecx, eax
xor edx, ebx
dec edx
rol dword [esp + eax - 0x239f0193], 0xfb
neg edx
sal cl, 0xa6
btc eax, ecx
bswap edx
bts ax, 7
neg edx
add cx, cx
bts eax, 0x38
ror edx, 2
rol ecx, 0x30
not word [esp + ecx*8 - 0x1c011cf7]
jb 0x1b9a4ef

Function at 0x1300eab
Capabilities:
Encode data using base64

Disassembly:
sub ax, ax
not edx
shl eax, 0xba
call fcn.010a96a9
rol ecx, 1
xor ebx, ecx
add esi, ecx
neg edx
movsx ecx, dl
add edx, esi
jmp edx
mov dword [esp], 0x82aa0d84
mov cl, byte [edi + 4]
mov eax, 0x50b3b921
pop eax
add edi, 2
rol eax, 0x6e
dec eax
sal eax, 0xc5
sal edx, cl
lea ecx, [eax + eax*4 - 0x49e255cd]
xor cl, 0x31
mov dword [edi + eax - 0x6c241520], edx
mov edx, dword [esi + eax - 0x6c241520]
ror cl, cl
lea esi, [esi + eax - 0x6c24151c]
and ecx, ecx
xor edx, ebx
btr eax, ecx
jae 0x11d149a

Function at 0x131e243
Capabilities:
Encode data using base64

Disassembly:
dec esp
lea ecx, [eax*4 + 0x1a9db5ac]
lea edi, [ebx + edi - 0x4254ea34]
jae 0x105414c
dec esp
btc edx, ebp
inc cx
dec edi
rol edi, 1
inc eax
or ch, 0x35
pop eax
rol dword [esp + ebp + 0x2e2c015], cl
neg edi
call fcn.010c08d6
mov edx, 0x3f8c29b7
lea edi, [edi + edx*2 - 0x7f185372]
movsx eax, dx
sub eax, 0x22b0aca8
adc eax, edx
mov edx, dword [edi + edx*2 - 0x7f18536e]
jno 0x1044855

Function at 0x1321277
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
and cx, dx
call fcn.01a14ed1
pop ecx
lea eax, [eax + edx*2 + 0xf028c31]
lea ecx, [edx + edx*8 + 0x16b03512]
xor eax, 0x6ab87885
xchg ecx, edx
mov dword [esp + edx - 0x326c34af], ecx
xor ebx, eax
xchg dword [esp + edx - 0x326c34af], ecx
push edx
add esi, eax
mov cx, word [ebp + edx*2 - 0x64d8695e]
lea eax, [edx*2 + 0x3708719a]
mov dx, word [ebp + edx*2 - 0x64d8695c]
sal eax, 0x8d
lea ebp, [ebp + eax - 0x1b5efffe]
btc ax, ax
and byte [esp + eax*2 - 0x36bdfffb], al
jno 0x1001c41

Function at 0x132f0b0
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [esp + ecx + 8]
lea eax, [edx + eax*2 - 0x56f306d9]
and edx, dword [esp + edx*2 - 0x6fbffffc]
mov eax, dword [ecx + edx*2 - 0x69400000]
mov dword [esp + edx*2 - 0x69400000], edx
lea edi, [edi + edx - 0x34a00004]
sub word [esp + edx - 0x349ffffe], 0x8fa8
mov dword [edi + edx*2 - 0x69400000], eax
movzx eax, dl
push edx
pop eax
pop eax
pop eax
jne fcn.019f5515
Function at 0x19a9ca0
Capabilities:
Encode data using xor

Disassembly:
bswap eax
push esi
bt eax, 0x24
add al, ah
push ebx
mov ebx, eax
bswap eax
jne 0x1aba227
add ebx, edx
shl eax, 0x94
lea edx, [eax*8 + 0x1ea1fd0a]
mov edx, ebx
shl al, 0x21
rol eax, 0x6d
btr ax, ax
sal edx, 2
ror al, 0xe5
sar ax, 0x67
rol eax, 0xa4
add eax, ebp
push 0xb80f7513
push 0x95349908
add eax, edx
mov dword [ebp - 4], eax
call fcn.0108504b
shl al, 0x44
xor ebx, ecx
add ebp, ecx
shl edx, 0xe6
xor edx, dword [esi + edx*2]
mov ecx, 0xf8993fb9
mov ecx, dword [edx]
lea edx, [eax*8 - 0x5c7445e4]
call fcn.012fc435
sub esi, 4
mov eax, 0x5e25152e
movzx ecx, ax
cwde
mov eax, dword [esi + eax*2 - 0x2a5c]
and cl, cl
mov edx, 0x879630b2
xor eax, ebx
jmp 0x1a70067
mov eax, 0x7db63092
mov eax, dword [eax + ebp - 0x7db63092]
call fcn.019dd32d
push ebx
mov ebx, 0xf0110238
movzx edx, bl
sal ebx, 0x57
cpuid
call fcn.010e45f2
test ebx, ebx
lea esp, [esp + 0xc]
je 0x10a1114
mov eax, 0x95b85195
call fcn.012ff629
mov ecx, 0xe2260903
jmp 0x12e392f
adc dl, 0xaa
ror eax, 0x13
cbw
xor dl, 0x32
rol ax, 0x8d
dec dl
inc byte [esp + eax*2]
xor bl, dl
sal byte [esp + eax + 1], 0x86
mov dword [esp + eax], edi
neg al
jns 0x109ddf4
ror edx, 1
xor cx, cx
or ax, 0x2085
btc eax, ecx
xor ebx, edx
imul ecx, eax
adc ecx, 0x9a1677bd
lea ebp, [ebp + eax*2 - 0x410c]
shr eax, 0xfb
not cl
dec ax
mov dword [ebp + eax*2 - 0x1fffe], edx
neg cx
shl al, 1
jl fcn.0110247b
jmp 0xe4424d6b
mov eax, dword [ebp]
jmp 0x1a5179f
lea esp, [esp + 0x14]
je 0x131977f
mov eax, 0xd6900111
add ax, ax
bts ax, ax
mov eax, dword [ebp + ebx*4]
push 0xa22f7997
call fcn.01a64051
push ebx
mov ebx, 0x9817e38c
mov ebx, dword [esp + ebx + 0x67e81c74]
mov dword [esp], 0xeb35b203
call fcn.01a248f8
and byte [edx - 0x80], cl
sub eax, 0xeb44d496
shr dword [0xdba07484], cl
stc
mov ah, 7
adc dl, dl
mov eax, ebx
push esp
sub al, 0xda
mov dh, 0xf1
cmp eax, 0xc407c523
out 0xd1, al
pop ss
xor byte [eax - 0x56], ch
add cl, dl
mov ch, byte [edx - 0x2e35d1ec]
jnp 0x19a9cc5
and eax, 0xa6f250e3
invalid
rol dl, 1
inc eax
add dl, 0x29
xor eax, eax
adc ax, ax
rol dl, 1
add dl, 0x9d
sal eax, 0x27
jbe 0x1ab4245
call fcn.00fe8f1d
jge 0x1a517b1
test al, 0xf5
imul edx, dword [eax + 0x17], 0xccbad80
sub dl, al
sal eax, 0xc1
push eax
ja 0x1a26e4e
ror edx, 0xc1
ror cl, 0x26
inc eax
call fcn.01ae6298
mov edx, 0x907d694
lea edi, [edi + edx*8 - 0x483eb4a4]
mov eax, dword [edx + edi - 0x907d694]
xor eax, ebx
dec dl
not dl
ror eax, 1
movsx ecx, dx
sar dx, cl
sbb eax, 0x950d4bac
bswap eax
or cl, 0xa
call fcn.010d5407
sysenter
push ebp
mov dword [esp], 0xebc4f4a6
call fcn.01a248f8
jne 0x10c53bc
btr ax, 0x34
rol dl, 1
add dword [esp + eax*4], eax
jge 0x10fe1b2
ret 4

Function at 0x19aec91
Capabilities:
Encode data using base64

Disassembly:
dec ebx
lea esp, [esp + 4]
jne 0xff50e5

Function at 0x19bdb3a
Capabilities:
Encode data using xor

Disassembly:
xor bl, dl
pop ecx
lea edx, [esp + edx + 8]
push 0x2a0a3d25
mov dword [edx], eax
call fcn.0109eccf
mov eax, 0xb109a71f
mov edx, 0x97a8072f
sub edi, 4
mov edx, dword [edi]
and ax, ax
rol al, 1
bt eax, 0x99
xor edx, ebx
add eax, 0x3622de09
dec edx
xor eax, eax
neg edx
shr eax, 0xf3
call fcn.01ae06af