joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc5d897
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + ecx - 0x9bf1023]
sub cl, ah
jno 0xffd3b8
not eax
dec eax
mov dword [esp + edx*8 - 0x5110b0], ecx
xor eax, 0x30347c85
dec edx
or dword [esp + edx - 0xa2211], edx
pop edx
neg eax
push ecx
mov dword [esp + 4], edx
xor eax, 0x909bbc3b
sal edx, cl
inc word [esp + edx - 0x4a9ffffe]
rol ecx, 0xf0
rol eax, 2
call fcn.00bb1d83
lea esi, [eax + esi - 0x12a98763]
xor dx, bx
and cx, ax
sub eax, eax
xor dx, 0x872a
jmp 0xec7356
ror edx, 0x6a
ror eax, 1
dec eax
rol dx, 0x25
dec edx
setb dl
neg eax
neg ecx
ror dl, cl
xor ebx, eax
xor edx, ecx
and dl, 0xba
adc esi, eax
or edx, 0x9bbf3625
or cl, dh
jle fcn.00b943b0
neg dx
and ecx, 0xe710bf34
adc byte [esp + eax*4 + 2], 0x10
xor dx, 0x4882
lea ecx, [ecx + ecx*2 + 0x1c3ec68e]
xor bx, dx
xor ax, ax
and dword [esp + eax*2], 0xe281a108
xor eax, dword [esp + eax]
lea edi, [edi + eax*2 - 0x41014202]
add al, 0x84
not word [esp + eax*2 - 0x41014307]
or ecx, dword [esp + eax - 0x2080a184]
mov word [edi + eax*2 - 0x41014308], dx
neg word [esp + ecx - 0x6e7fde8e]
lea edx, [ecx + eax + 0x76267f34]
pop eax
jle fcn.00d62eca
mov edx, dword [esi]
mov ecx, 0x20039f8f
mov eax, 0xca3bbd9f
lea esi, [ecx + esi - 0x20039f8b]
xor edx, ebx
call fcn.00c0466c
sal cl, 0x86
shl cx, 0x48
inc dx
jmp 0xe7b8f6
xor edx, ebx
rol eax, cl
ror al, cl
bswap edx
call fcn.010c1457
rol al, 1
or edx, 0x11029e33
neg al
xor al, 0x88
sal edx, 0x8c
ror byte [esp + edx - 0x29e32fff], 0x63
neg al
push edx
rol edx, 0xe2
xor bl, al
rol ecx, 0xb1
not word [esp + 1]
dec edx
lea eax, [esp + eax + 8]
mov cx, word [eax]
xchg byte [esp + 5], dl
sbb ebp, 1
movzx eax, dx
mov word [ebp + eax*8 - 0x5ffc8], cx
pop eax
mov eax, dword [edi + eax*2 - 0x52399e00]
shr dl, 0xc6
sub edx, dword [esp]
pop ecx
adc edi, 3
and cl, ch
sbb cx, dx
xor eax, ebx
dec dx
and edx, 0xb8160db5
sbb eax, 0x14118c1a
jmp 0xe5b108
Function at 0xc6256c
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, eax
mov dword [esp + ecx], ecx
add ecx, ecx
xadd cl, ch
lea edi, [edi + ecx - 4]
lea edx, [edx + 0x779feaa4]
mov dword [edi + ecx*4], eax
push edx
jg 0xdc512a
sal edx, 0x22
pop eax
pop eax
js fcn.00d62eca
mov esi, 0x60b48fba
inc eax
neg dh
inc esp
mov edi, esi
mov ax, word [edi + esi - 0x60b48f46]
inc ebp
movsx ebx, bh
dec eax
lea edi, [edi + esi - 0x60b48f44]
inc ebp
movsx esi, bx
movzx ecx, byte [ebp + esi - 0x60b48f46]
jae 0xc6262f
inc esp
movzx eax, si
dec ecx
lea ebp, [edi + ebp - 0x60b48f45]
inc ecx
movzx ebx, bh
dec ecx
bt edi, esi
inc ecx
xor cl, dl
inc ecx
bt ebx, 0x36
inc ecx
push eax
sbb cl, 0x8a
dec ecx
shr ebx, 0xa7
ror cl, 1
inc ecx
neg edi
dec edi
lea edi, [esi + ebx - 0x544eccc6]
inc esp
movzx ecx, bl
xor cl, 0x17
add cl, 0x2d
xor cl, 0x93
dec cl
dec edx
inc dword [esp + esi*2 - 0x8c]
dec ecx
xadd ecx, ebx
ror ebx, 0xd3
inc esp
xor dl, cl
dec eax
lea ecx, [esp + ecx + 8]
inc edx
mov byte [ecx + edi + 0x544ecc80], al
dec eax
shr dword [esp + esi - 0x60b48f46], 0x41
mov eax, dword [esp + esi - 0x60b48f44]
inc esi
add ebx, dword [ebp + ebx*4]
inc ebp
movzx ebp, ax
dec edx
lea edx, [edi*8 + 0x7ba27313]
dec eax
lea ebp, [esi + ebp - 0x60b48f42]
inc ebp
xor ebx, edx
inc ecx
neg ebx
dec eax
sal dword [esp + esi - 0x60b48f46], 0xbb
inc esp
adc ebx, eax
dec eax
neg dword [esp + esi - 0x60b48f46]
neg si
inc ecx
rol ebx, 2
inc ecx
bswap ebx
cdq
jmp 0xd9d8b6
Function at 0xc7b660
Capabilities:
Encode data using xor

Disassembly:
shr ecx, 8
neg dword [esp + 8]
and al, 8
call fcn.00b9bc3f
add dl, byte [ecx]
add eax, 0x1102fff2
lds eax, [eax]
fst qword [ecx + 0xba390f8]
out 0x96, al
dec ebx
outsb dx, byte [esi]
mov byte [edi + 0x20], ch
lea ecx, [edi]
push ebx
xchg byte [0x1703905e], dl
pop edx
outsd dx, dword [esi]
dec edi
pop ss
inc esi
mov cl, byte [edx - 0x5be29d91]
pop ebx
push cs
and byte [ebx + 0xe], 0xa1
cmp byte [ecx - 0x6d], dh
mov ah, 0x70
sahf
aaa
sub al, 0x2a
insd dword es:[edi], dx
mov eax, 0xa9870c00
stosb byte es:[edi], al
sbb edx, 0x8fe36adb
dec edx
xchg ebx, ebx
dec ebx
xchg ecx, eax
mov bh, 0xfe
sub ebp, dword [edi - 3]
jge 0xc7b6c6
stc
cwde
xchg ecx, eax
bound eax, qword [eax]
jb 0xc7b707
jno 0xc7b680
push es
sub dword [edi + 0xb], ebp
not byte [ebp - 0x686e21ab]
adc dword [edi + 0x20], ebp
outsd dx, dword [esi]
or esi, esi
xchg ebp, eax
push ebp
ficom word [ecx + 0x206f1197]
outsd dx, dword [esi]
and byte [eax + 0x1afcec53], ah
mov al, byte [0x1afcec53]
les ebx, [ecx - 0x2ee05f02]
aas
loop 0xc7b669
adc esp, ecx
sal esp, 1
loop 0xc7b665
cmp al, 0x71
mov byte [0x2b9e8b36], al
mov ebx, 0x40131405
add dh, al
pop es
sbb al, 0x12
retf
adc eax, 0x520c7f46
or al, 0x52
and ax, 0xa088
dec esi
fstp xword [ebp - 0x27]
xor al, 0xd7
jbe 0xc7b70a
dec ebx
xor ecx, dword [eax - 0x19fff4a2]
lcall 0x2cdc, 0x5cc78565
shl dword [esi - 0x5f], 1
pop esp
pop ecx
mov ebx, 0xb3d6a990
mov byte [ebp + 0xd90c6ac], cl
dec edx
adc eax, 0x7701571
jp 0xc7b6cf
hlt

Function at 0xc7f6fd
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
dec ecx
xor edx, ebx
movzx eax, cl
lea edx, [edx + eax*2 + 0x5930371e]
add eax, 0x981c6225
xor edx, 0x75926b07
not edx
call fcn.00e46ead
inc eax
or ecx, ecx
neg eax
sal dword [esp], cl
pop edx
shl ecx, 0x68
ror eax, 2
ror ecx, 0x42
sar dx, 0x27
xadd edx, ecx
xor ebx, eax
add esi, eax
sar ecx, 0x2c
jne fcn.00cf9758
lea esp, [esp + 0xc]
je 0xbc0dab
push edi

Function at 0xc8fa1e
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x76a3c82b], eax
mov eax, dword [eax + esi - 0x76a3c82b]
mov edx, dword [esp]
mov ecx, dword [esp + edx - 0x76a3c82b]
lea esi, [edx + esi - 0x76a3c827]
xor eax, ebx
shl dword [esp + edx - 0x76a3c82b], cl
je 0xd61b6b
rol edx, cl
neg eax
jmp 0xd2fb55
ror byte [esp + edx*2 - 0x3c82b767], 0x83
rol eax, 1
dec ecx
inc eax
or cl, 0x29
sbb byte [esp + edx*4 - 0x79056ed3], 0
xor eax, 0x259bcb12
shr ecx, 0x3d
xor ebx, eax
add ebp, eax
sub dword [esp + edx*2 - 0x3c82b76a], 0xf495118d
inc dword [esp + ecx*4 - 0xc]
movzx dx, byte [edi + edx*4 - 0x79056ed4]
movzx eax, cl
call fcn.00cb9f70
Function at 0xc9258c
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
inc esp
movzx edi, al
dec eax
btr edx, 0x2c
rol ecx, 1
pop eax
not bx
dec ecx
shl ecx, 8
inc ecx
push edx
or ebx, 0x50950521
inc cx
shl eax, 0x61
inc edx
xor dword [esp + ecx*4 - 0x23000], ecx
inc ecx
pop edx
dec eax
add ebx, 0x3ab5fa2d
inc ebp
and ebp, edi
dec eax
arpl cx, cx
jb 0xb8ada8
dec esi
lea edi, [ecx*4 + 0x1d85b49e]
dec esp
adc esp, ecx
inc ecx
mov ecx, edi
inc si
mov eax, dword [edi + ecx - 0x8c00]
xadd bl, dh
inc esp
movsx esi, bl
inc cx
mov esi, dword [ecx + edi - 0x8bfe]
dec edx
lea edi, [edi + ecx*2 - 0x117fe]
dec dx
inc cx
not eax
inc cx
sal edi, 0xa3
not si
inc ebp
xor cl, ch
inc sp
and eax, esi
inc bp
mov dword [ebp + edi - 8], eax
dec eax
dec ebx
je 0xfbe4b8
dec ebp
btc ebp, ebx
inc ecx
jmp esp
inc sp
xchg dword [esp + ecx*4 - 0x87], ebp
dec eax
lea ebp, [edx + ebp - 0x72b39af4]
dec ecx
bswap ecx
inc ecx
ror cl, 0xc1
inc bp
xor edi, edx
inc cx
xor edi, 0xf44a90a
shr ecx, 0x48
or edx, eax
inc cx
ror edi, 1
rol word [esp + edx - 0x7ef79afc], 0x68
dec esp
lea eax, [ecx*8 + 0x20bdd48c]
jb 0xda675c
inc cx
sbb edi, 0x4166d483
neg edi
inc ecx
dec al
call fcn.010d6fe8
inc esp
and al, dh
inc eax
bt ax, bx
dec ebp
add esp, ebx
cbw
inc eax
xadd dl, dh
dec eax
mov ebx, dword [edi + edx - 0x72b39af2]
push edx
dec eax
lea edi, [edx + edi - 0x72b39aea]
inc esi
movzx edi, word [ebp + eax*8]
inc esp
xadd dl, ch
jne 0xf2ac24

Function at 0xc9dbd7
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
not cx
ror edx, 3
dec al
xor ebx, edx
add esi, edx
rol ecx, 0xc4
inc ax
dec ecx
movzx ax, byte [ebp + eax*8 - 0x800]
mov dl, byte [ebp + ecx - 0x46d8e054]
lea ebp, [ebp + ecx - 0x46d8e054]
lea ecx, [ecx + ecx + 0x582e3ad]
and ecx, ecx
not al
mov dword [esp], 0x46113606
add byte [esp + 2], 0x25
not dl
jl 0xfc0bde
sbb ecx, 0x35968339
shr dword [esp + ecx - 0x5d9e2120], 0x25
or al, dl
movsx edx, cl
mov word [ecx + ebp - 0x5d9e2120], ax
movsx eax, cl
not eax
cbw
mov dword [esp + ecx - 0x5d9e2120], esi
ret

Function at 0xca31ff
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], eax
dec ebx
lea esp, [esp + 8]
jne 0xcfcff6

Function at 0xcc2a05
Capabilities:
Encode data using xor

Disassembly:
push ecx
rol ax, 0x28
ror eax, 0x11
popfd
mov eax, dword [edx + esi - 0x249b]
bswap edx
movsx ecx, dx
bt ecx, ecx
lea esi, [esi + ecx*2 + 4]
xor eax, ebx
btc dx, dx
shr dx, 0xe3
inc eax
add edx, edx
rol eax, 1
bt dx, 0x22
dec eax
xor ecx, ecx
add ecx, ecx
ror eax, 3
ror ecx, 0x25
lea edx, [edx*8 - 0x1c541245]
call fcn.010a78aa
aam 0x3c
add dword [eax], 0xa779beb7
mov fs, word [ebx]
sub ebp, dword [ebx]
invalid
inc ecx
rol dx, 8
bswap ecx
neg ax
push eax
and dword [esp + edx*8 - 0x6fffff8], 0xb43bc303
rol ecx, 3
cdq
sub ecx, 0x2b28f997
sal dx, 6
rol edx, 0xdf
xor ebx, ecx
add ebp, ecx
rol dx, 0xe1
pop eax
pop ecx
pop ecx
jno fcn.00ff1508
mov eax, 0xad8a249b
add ebp, 4
movzx edx, ax
jmp 0xcb7945
Function at 0xcce632
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x2234f40f
add esi, 4
push 0x6ade08f
shr word [esp + 3], 0x24
shrd dx, ax, cl
mov ecx, dword [esp + 1]
movsx eax, cl
call fcn.00d70ed0

Function at 0xceff01
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ecx + eax - 0x5387f109]
bswap ecx
inc edx
mov dword [esp + edx - 0x2cb00001], eax
not ecx
mov dword [esp + edx - 0x2caffff9], edx
call fcn.01003d5a
push eax
shr eax, cl
cmp bh, byte [esi]
xor dword [eax], eax
mov esp, ecx
les edx, [ebx]
dec ebx
bnd jns 0xceff19
xor al, 0x1c
fadd dword [edi]
in al, dx
and bl, cl
add al, 0xd
in eax, dx
mov ah, 0x49
std
sti
aaa
invalid

Function at 0xcf6dec
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp], 0x5f8ab810
xor ebx, edx
call fcn.00d6dda1

Function at 0xcfe55f
Capabilities:
Encode data using base64

Disassembly:
inc edx
xor dword [esp + ecx*4 - 0x10004374], esi
inc bp
btr ebp, ebx
call fcn.00de25b5
jmp 0xfe4f6c
xor edx, edx
test eax, eax
call fcn.00be5bbf

Function at 0xcffb9c
Capabilities:
Encode data using xor

Disassembly:
shl dword [esp + 8], 0xb
xor ebx, ecx
xor dword [esp + 5], 0xd236dd3c
adc ebp, ecx
push 0xac355f25
not byte [esp + 1]
jmp 0xface52
lea esp, [esp + 0x10]
jmp 0x1017151
pushfd
mov dword [esp], 0xfc90e077
call fcn.0106d124
xor al, bl
add al, cl
not dword [esp + edx - 0x1895249f]
xor al, 3
add al, cl
add dword [esp + edx*2 - 0x312a493e], 0x2e287aa6
inc word [esp + edx - 0x1895249e]
xor al, 0x89
xor bl, al
lea edi, [edi + edx*4 - 0x6254927e]
lea ecx, [edx*4 + 0x253d4e9a]
add dword [esp + edx*2 - 0x312a493e], ecx
mov word [edi + edx*4 - 0x6254927c], ax
jnp 0x10a6bcc
movsx eax, cl
cwde
pop eax
ja fcn.00d62eca

Function at 0xd009f2
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + 8], 0x38cb4517
dec eax
lea esp, [esp + 8]
call fcn.00dd142f
Function at 0xd017a3
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
inc ecx
rol dh, 1
dec ecx
neg ebp
inc ecx
ror bh, 0x25
inc ecx
dec dh
inc ecx
neg dh
ror ax, 0xec
inc ecx
inc ebp
inc ecx
dec al
inc ecx
dec dh
inc ecx
rol dh, 1
inc ecx
sar ebx, 0x21
dec esp
lea edi, [edx + edx*4 + 0x65b5b18b]
inc esp
adc bh, cl
inc ebp
xor dl, dh
inc esp
and ebx, ecx
call fcn.00fa9b62
neg cx
dec ebp
add esp, ecx
inc esi
mov ebx, dword [edi + eax*4 - 0x29520]
inc ecx
mov eax, dword [eax + edi - 0xa544]
call fcn.00e668dd
neg dword [esp + ecx - 0x3992fffc]
xor eax, ebx
not eax
xor dword [esp + ecx*2 - 0x7325fffc], 0x6223dd13
sal cl, 0xe3
lea eax, [ecx + eax - 0x1f59f774]
mov edx, ecx
rol eax, 1
xchg dword [esp + ecx - 0x3992fffc], edx
sub cl, byte [esp + ecx - 0x39930000]
xor eax, 0xc7a7991c
xor ebx, eax
add byte [esp + ecx - 0x3993006b], dl
rol dword [esp + ecx*2 - 0x732600da], cl
call fcn.00e50ebb
mov esi, 0xf3b63c9f
inc esp
movsx ebp, dh
inc ecx
movzx edx, ch
mov ecx, dword [ebp + edx*2 - 0x13e]
inc eax
rol dh, 5
push edx
dec eax
lea ebp, [edx + ebp - 0x9b]
pop edx
inc ecx
xor ecx, edx
dec ecx
inc ecx
push ebp
inc ebp
mov eax, ebp
movsx eax, dx
neg ecx
rol ecx, 2
xor ecx, 0x9e2b502a
dec esp
mov dword [esp + edx*2 - 0x13e], edx
inc ecx
mov edi, 0x8cb8d9b4
dec esp
lea edx, [esi + eax*2 - 0x3de96680]
xor dword [esp + edx - 0x9f], ecx
dec esi
lea ecx, [edx*2 + 0x22ad0d1f]
dec eax
cwde
dec eax
bts eax, eax
inc ecx
pop edx
inc esp
movzx ebx, dh
dec edi
lea ebx, [ebp + ebp*2 - 0x7c473962]
inc ecx
dec ch
dec eax
arpl cx, cx
adc esi, esi
dec esp
add esp, ecx
mov si, word [edx + edi - 0x9f]
dec eax
lea edi, [edi + edx*8 - 0x4f6]
dec ebp
and edi, ecx
inc edx
inc esp
movzx esi, byte [ebp + edx - 0xa0]
inc cx
sar ebx, 0x2a
inc ebp
add edi, ebp
dec eax
lea ebp, [ebp + edx*2 - 0x13f]
inc ebp
add al, bl
dec edi
lea eax, [eax + ebp - 0x75d9686e]
cwde
inc ebp
xor dh, dl
dec eax
lea ecx, [edx*2 + 0x661ae02a]
inc ecx
ror cl, 1
jno 0xb8ede7

Function at 0xd06be0
Capabilities:
Encode data using base64

Disassembly:
bswap edx
pop edx
jge fcn.00cf9758
mov edx, 0xbebfb9bf
movsx ecx, dl
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov cl, byte [ebp + 8]
call fcn.010599ac
mov dword [esp + eax*2 - 0x60000000], eax
sal eax, 0x2a
ror ecx, 1
cwd
xor al, 0xac
setle byte [esp + eax*2 - 0x153]
xor ebx, ecx
shr al, 0xa5
lea ebp, [ebp + eax*2 - 0xe]
bt edx, 0x89
sal edx, 0xad
pop eax
mov dword [edx + ebp], ecx
and al, 0x31
jae 0xc3c847

Function at 0xd07c9d
Capabilities:
Execute syscall

Disassembly:
cwde
mov ecx, 0x3da40aa8
mov eax, dword [esi + edx]
or edx, dword [esi + edx*4 + 4]
dec cx
call fcn.00d41205
mov ecx, 0x2002bc28
lea edx, [ecx*2 - 0x22e9da77]
shl edx, cl
lea edi, [edi + ecx - 0x2002bc2c]
mov ecx, dword [ecx + edi - 0x2002bc28]
xor ecx, ebx
movzx eax, dl
and eax, 0x6633d72f
shr dx, 0xef
not ecx
sal eax, 0x31
bt ax, 0xe
cwde
lea ecx, [ecx + edx*8 - 0x92881f8]
call fcn.010ebedb

Function at 0xd0b070
Capabilities:
Encode data using base64

Disassembly:
dec edx
push 0x59999392
not edx
call fcn.00b9380a
mov dword [esp], 0x96868192
xor edx, ebx
jmp 0xe47fca
push 0x2999ca9a
inc word [esp + 6]
neg edx
inc word [esp + 2]
jg 0xcf9705
Function at 0xd136eb
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
xor esi, 0x50877e14
dec ebp
btc ebx, edi
jb 0xc3a049
bswap esi
inc ecx
push edx
dec ecx
cmovae ebx, ecx
inc cx
sal ebx, 0x6c
xor dword [esp + ebx - 0x2000003], esi
inc cx
shr edi, 0xca
setb dl
inc ecx
pop edx
inc ecx
and bl, dh
dec eax
arpl si, si
dec esp
adc esp, esi
call fcn.00f983d4
dec edx
lea ebp, [ebp + ebp*2 - 0x135]
dec ecx
xadd ebp, ebx
neg al
inc esp
movzx esi, si
inc ebp
xor cl, dl
ror ebx, 0xe1
dec esp
lea ebx, [esi + esi*2 - 0x595419f0]
inc esp
movsx edi, ax
inc ecx
adc cl, 0x25
dec eax
lea ecx, [ebx*4 - 0x607de07f]
inc ecx
not dh
inc ecx
neg cl
inc ecx
mov edx, ebp
or bl, 0xbe
inc ecx
rol cl, 1
inc esp
add cl, bl
inc esp
xor cl, bl
inc cx
dec esi
inc ecx
inc sp
cmovo edi, edx
inc ecx
add cl, 0x1f
dec eax
shr ebx, 6
dec esi
lea eax, [esi*4 + 0x1a1d028b]
inc ecx
neg cl
dec eax
ror eax, cl
dec ecx
or esi, 0x903563b3
inc ecx
adc cl, 0x23
jmp 0x10b7ff1
not ecx
not eax
mov dword [esp + edx - 1], edx
rol al, 0x45
xor ecx, 0xad974924
not word [esp + edx*8 - 7]
neg edx
rol ecx, 1
xor ecx, 0x95127aad
rol ecx, 1
sal word [esp + 1], 0xe8
sal al, 0x84
bswap ecx
not byte [esp + 7]
and word [esp + 6], 0x639b
not byte [esp + 4]
ror ecx, 2
btc ax, 0x87
push eax
xor ebx, ecx
shr word [esp], 0x6e
dec eax
add edi, ecx
xadd dl, dh
movzx eax, byte [ebp]
mov ecx, edx
adc ebp, 0
pop ecx
xor al, bl
ror al, 1
rol edx, cl
push ecx
jb 0xd8c40c
mov edx, 0xef8ed9b5
sub esi, 4
movzx ecx, dx
btr edx, ecx
mov eax, dword [ecx + esi - 0xd9b5]
ror edx, cl
xchg ecx, edx
call fcn.00f722d3
sbb al, 0x8f
xor al, 0x87
lea edx, [edx + edx*2 + 0x6b12e220]
push ecx
sub al, 0xa
and word [esp + edx - 0x6b12e1fa], cx
xor bl, al
lea esi, [esi + edx - 0x6b12e207]
push edx
ror dx, 0x26
call fcn.010c7f58
add edi, edx
push ecx
mov word [esp + ecx - 0xd3ffffe], cx
mov edx, ecx
or dx, word [ebp + ecx*4 - 0x35000000]
mov ax, word [ebp + ecx - 0xd3ffffe]
and byte [esp + ecx*4 - 0x35000000], ch
lea ebp, [ebp + ecx*8 - 0x69fffffe]
dec cx
inc cl
adc dx, ax
call fcn.00ea98a7
mov ebx, 0xcb81e19b
inc esp
movzx ebp, bl
inc esi
movzx ecx, byte [ebp + ebp - 0x9b]
mov eax, 0x5e3082b5
movzx esi, bx
jmp 0xce0080
dec ecx
xchg ebx, eax
inc ecx
neg cl
inc eax
xor dl, dh
dec eax
shl eax, 0xbb
inc ebp
xor dl, cl
dec eax
sar edx, 0x1e
dec esp
adc ecx, esp
inc sp
btr ecx, ebx
adc al, 2
cwd
inc si
mov ebp, dword [ebx + ecx - 0x2000003]
inc cx
shr edi, 0xe4
inc ecx
shr edi, 0x73
inc ecx
setne bh
dec eax
lea edi, [edi + ebx - 0x2000005]
inc sp
mov dword [ebx + edi - 0x2000003], ebp
inc ecx
or ebx, 0xbbb5cc92
inc esp
movsx ebp, dh
mov esi, dword [ebp + ebx*2 - 0x4000006]
inc ebp
movsx ecx, bx
dec eax
lea ebp, [ebx + ebp - 0x1ffffff]
inc ecx
sub eax, esi
inc cx
not esi
inc bp
cmovnp esi, edi
inc ecx
xor esi, edx
sal cl, 3
rol esi, 3
dec ecx
add eax, 0x5320421
dec esp
and ecx, ebx
inc ecx
neg ebp
bswap esi
rol esi, 3
or edx, eax
inc ecx
sbb eax, 0xb3fa53d
jae 0xb847b8
Function at 0xd1d604
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x9d3551bb
neg eax
neg dword [esp + edx + 0x18]
push ecx
xor eax, 0xf7d8f79d
pop esp
adc al, 0x18
add ecx, 0x7633ac3b
xor ebx, eax
lea edx, [edx + ecx*8 - 0x375d8cfb]
pop ecx
add edx, edx
adc ebp, eax
mov ecx, edx
and edx, 0xf80a23a6
call fcn.00f5c536
pop esi
jno 0xd1d606
add byte [ecx + 0x2790eef1], al
dec edi
invalid

Function at 0xd21a36
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
inc bp
xor ecx, ecx
inc ecx
bswap ebp
inc ebx
mov dword [esi + edi*2 - 0x77544028], esi
jge 0xeb2d94
not ecx
dec edx
mov dword [esp + edi*2 + 0x1fa8eca], 0x2f851d03
inc esp
xadd dl, bh
jns 0x100df09
ror dword [esp], 0xf9
shl dword [esp], 0x45
mov edx, dword [edi]
call fcn.00c7f6fd
mov edx, 0xe69a720a
mov dx, word [ebp]
mov eax, 0xf023190
btr eax, 0xaa
btc eax, eax
mov ax, word [ebp + eax - 0xf03318e]
mov ecx, 0xfd2f8784
inc ecx
adc ebp, 2
sar ecx, 0x55
adc dx, ax
movsx eax, cl
sar ax, cl
mov word [ebp], dx
btr eax, ecx
movsx edx, ax
rol eax, 0x90
sbb edi, 3
mov ecx, dword [edi]
call fcn.00bd978e
jmp 0xecbaef
inc ecx
movzx esi, bl
dec esi
mov dword [esp + edi*2 - 0x77544028], esp
ret 8
dec esi
mov dword [esp + edi + 0xfd4773], edx
inc cx
shl ebp, 0x87
dec eax
or ebx, 0x902fc102
dec eax
or edx, 0x323aa11d
inc edx
xor dword [esp + edi + 0xfd4773], ecx
inc ecx
pop edx
dec ecx
btr ecx, 0x87
jae 0xbde0c2
dec eax
arpl cx, cx
neg dl
inc ecx
push esi
dec esp
add esp, ecx
inc esp
xchg dl, al
inc ecx
sal esi, 0x11
btr ebx, 0x91
dec esi
mov dword [esp + edi + 0xfd4773], esp
ret

Function at 0xd244be
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
not ecx
lea edi, [edi + ecx - 0x49608]
mov dword [esp + ecx*2 - 0x92c00], ecx
bswap ecx
dec ecx
mov dword [edi + ecx*4 - 0x2580ff8], eax
mov dword [ecx + edi - 0x9603ff], edx
mov dword [esp + ecx*2 - 0x12c07fa], ecx
bts ecx, 0x24
mov dword [esp + ecx*4 - 0x2580ff4], 0x43ab382b
pop edx
pop ecx
pop edx
jb fcn.00d62eca
add byte [eax], al
arpl word [ebp + 0x66], sp
pop edi
jbe 0xd2453e
jae 0xd2457c
popal
arpl word [ebx + 0x5f], bp
je 0xd24580
popal
arpl word [ebp + 0x5f], sp
je 0xd24575
arpl word [ebp + 0x72], si
jb 0xd24580
outsb dx, byte [esi]
je 0xd2451e
mov eax, 0x2f3ba4b3
mov eax, dword [esi + eax - 0x2f3ba4b3]
mov ecx, 0xaf20e5aa
movzx edx, cl
inc cx
lea esi, [esi + edx*8 - 0x54c]
sal edx, cl
call 0x10394584
mov edx, 0xc98087fa
scasd eax, dword es:[edi]
Function at 0xd30053
Capabilities:
Parse pe header

Disassembly:
mov esi, dword [esi*4 + 0xc060c8]
shr eax, 8
shr dword [esp + 4], 0x8b
mov dword [esp], 0x3008118
jne 0xff997c
mov ecx, 0x1f081a93
movzx edx, byte [edi + ecx - 0x1f081a93]
call fcn.00e8cf88
call fcn.0103f537
neg edx
rol eax, 0xa1
add al, ah
dec edx
xor eax, 0x62b7568d
cwde
xor ebx, edx
and eax, eax
rol eax, 0x5a
add edi, edx
btr eax, 0x9a
jb 0xe5b0c8
movzx edx, byte [esi + eax - 0x500001eb]
lea esi, [eax + esi - 0x500001ea]
sub ax, 0x4398
push eax
jg 0xef0f32
xor dl, bl
rol dl, 1
dec dl
pop eax
neg dl
inc dl
xor bl, dl
bts eax, eax
sub eax, eax
bts ax, ax
push esi
push edi
or eax, 0xcc042897
shl al, 0x41
push ebx
call fcn.00e16226
push dword [esp + 4]
popfd
call fcn.00ddb04f
xor eax, esi
mov dword [esp + 8], 0xb7a65dbb
jmp 0xe04616

Function at 0xd34f90
Capabilities:
Encode data using xor

Disassembly:
sub ecx, 0x2ba4622c
ror eax, 1
inc dl
and dword [esp + 4], 0xf012b183
not eax
shr ecx, 0xc7
ror eax, 1
sal ecx, 0x33
shl byte [esp + ecx*2 - 0x73affffa], 0xe2
xor ebx, eax
shl word [esp + ecx - 0x39d7fffa], 0xd
adc cx, 0x302f
add cx, word [esp + ecx*2 - 0x73b06059]
adc ebp, eax
shr cl, 0x87
mov ecx, dword [edi + ecx*2 - 0x73b06000]
push edx
lea eax, [edx*2 - 0xe6b944f]
mov ax, word ss:[ecx]
mov dword [esp + 4], edx
call fcn.010e5cbf
mov eax, 0xc98215a3
push eax
mov edx, dword [esi]
pop eax
add esi, 4
sub ax, 0x20b
lea ecx, [eax + eax - 0x45cccd63]
ja 0xd5dcfe
fadd dword [edi]
das
xor ecx, edi
push edx
lodsb al, byte [esi]
cmp dword [0xda88d280], ecx
push ecx
jge 0xd3500f
pop es
add cl, byte [eax]
je 0xd3502f
mov gs, eax
ror byte [edx + 0x71], 1
xor byte [edi - 0x68], dh
movsb byte es:[edi], byte [esi]
ret
ror dword [ecx + 0x141dbb67], cl
cli
insd dword es:[edi], dx
add ebp, dword [ebp + 0x30]
mov eax, 0x90231bd0
idiv dword [eax - 0x68]
mov edx, 0x32060188
mov dl, 0xc7
lodsb al, byte [esi]
xchg ebp, eax
sub cl, byte [ebx]
mov edx, 0xd4ef783c
add ebp, dword [0xc0e6ff33]
xlatb
mov edi, 0xa795a03e
ret
xor edx, ebx
bts cx, cx
dec edx
shr eax, cl
xor cl, cl
cbw
not edx
ror ecx, 0xb0
sub ecx, ecx
and ecx, ecx
adc edx, 0xc1020332
xor edx, 0xdc93931b
add edx, 0xfd955d01
neg ecx
rol edx, 3
call fcn.00d58521