joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1cff548
Capabilities:
Encode data using base64

Disassembly:
not edx
pop ecx
dec edx
mov ecx, eax
neg ecx
neg edx
lea eax, [ecx*2 - 0x42e5ff67]
inc edx
push eax
xor ebx, edx
xor cl, 0xb2
push ecx
adc esi, edx
movzx edx, byte [esp + ecx - 0x6cc2324d]
pop eax
mov dx, word [ecx + ebp - 0x6cc2324d]
ror eax, cl
mov cl, byte [ebp + ecx - 0x6cc2324b]
call fcn.0216e1e2
mov eax, 0xf395c081
lea edx, [eax + eax*4 + 0x331b45b7]
mov ecx, dword [ebp]
add dx, 0x4f26
adc ebp, 4
movzx eax, byte [edi]
add edi, 1
xadd dl, dh
jns 0x20eb1d1
xor al, bl
dec edx
dec al
sal edx, 0x5b
add edx, edx
push edx
ror al, 1
bswap edx
sub edx, dword [esp + edx*4 - 0x200]
shl dword [esp], 2
dec al
jmp 0x22984ef
neg al
sar dword [esp], 0xdc
dec dx
jns 0x2210ed7

Function at 0x1d039a5
Capabilities:
Encode data using base64

Disassembly:
or word [esp + eax - 0x401e], ax
ror edx, 1
not edx
xor ebx, edx
lea ecx, [eax*2 - 0x68e6d74c]
pop eax
ror cl, 0xa5
add edi, edx
call fcn.020adcf1
dec ebp
mov esi, dword [eax]
mov edx, 0xfe9e0f97
dec ecx
mov edi, dword [eax + 8]
mov eax, edx
inc esp
movsx esp, dl
dec ecx
add eax, 0x10
mov ebp, eax
dec esp
lea ecx, [eax + ebp*2 + 0x38b34e05]
dec eax
ror eax, 0xc2
dec ecx
mov dword [esi], edi
inc esp
mov ebp, dword [esi]
call fcn.02167b4c

Function at 0x1d0b461
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
or eax, eax
lea eax, [eax + eax*8 - 0x367472d3]
neg ecx
call fcn.022cb8af
lea edi, [edi + edx + 4]
dec dx
xor ecx, ebx
pop edx
not ecx
pop eax
jmp 0x1b6f10f

Function at 0x1d1ad46
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor esi, eax
push 0xee102b2d
sal word [esp + 2], 0x45
and esi, 0xff
mov esi, dword [esi*4 + 0x2297628]
shr eax, 8
jmp 0x1b947e7

Function at 0x1d1d4b2
Capabilities:
Execute syscall

Disassembly:
movsx ecx, dx
mov dword [ebp + edx - 0x7cf858f0], eax
sub dl, ch
call fcn.020a5b12
sub edi, 4
mov edx, 0x62ee736
jmp 0x2315720

Function at 0x1d22f6f
Capabilities:
Encode data using xor

Disassembly:
sub dx, dx
rol eax, 2
sub ecx, 0x611cdca6
xor ebx, eax
neg dl
mov dword [esp + edx + 4], 0x18c13d
neg dword [esp + ecx - 0x5311a22c]
add edi, eax
and byte [esp + ecx - 0x5311a22a], 0x2c
mov dword [esp + edx], edx
push edx
mov eax, dword [ecx + esi - 0x5311a234]
add edx, dword [edx + esi + 4]
mov cl, byte [esi + ecx - 0x5311a22c]
mov word [esi], cs
aam 0x5d
out dx, al
lodsb al, byte [esi]
call fcn.022a332e
neg ax
not cx
neg cx
ror edx, 0x91
lea eax, [edx + edx*4 + 0x522e91bc]
xor bx, cx
lea ebp, [ebp + edx - 2]
mov word [ebp + edx*2], cx
and edx, eax
mov ecx, dword [esi + edx]
shr edx, 0xa5
adc edx, eax
lea esi, [esi + edx - 0x522e91b8]
xor ecx, ebx
add al, ah
inc ecx
call fcn.022aee39
out 0xf0, al
jo 0x1d22fa8
ljmp 0x53ef:0x56aa83e7

Function at 0x2079e4e
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax + edx - 0x1a2639d2]
mov dword [esp + ecx*2 - 0x2fab4d8], ecx
xchg ecx, edx
bswap eax
ja 0x21db948
Function at 0x207d122
Capabilities:
Encode data using xor

Disassembly:
sub cl, 0x1c
xor cl, 0x31
rol al, 0x27
ror al, 0xa6
adc cl, 0x2b
ror al, 0xc7
sub al, al
setnp al
xor bl, cl
shr eax, 0x51
adc ecx, esp
and eax, eax
mov byte [ecx + eax*8 - 0x3e560], dl
mov edx, eax
call fcn.02097d0a
pop edx
bswap edx
not edx
neg edx
xor ebx, edx
sal ax, 6
shl byte [esp], 0x46
adc ebp, edx
ror dword [esp], 0xb0
mov dx, word [edi]
adc edi, 2
pop ecx
add cx, cx
dec cl
movzx ecx, byte [esi + ecx*2 - 0x1e55e]
add esi, 1
inc al
xor cl, bl
ror cl, 1
dec ax
jle 0x1be0dfe
call fcn.0225e255
pushal
ja 0x207d125
push ds
add byte [eax + 0x77], ah
sti
inc edx
mov ebp, 0xf69d6f19
xchg byte [eax - 0x678f51e7], ch
jo 0x207d0ce
xlatb
pop ecx
jb 0x207d153
jo 0x207d134
leave
mov eax, 0x7416ae6
mov al, 0x43
dec esi
lcall 0x92b9, 0x3ef600f8
ret 0x6936
and ebp, dword [ecx - 0x3a54bad7]
dec edi
xor esp, dword [ebp - 0x68dab0e9]
fidivr dword [edi]
ret
sub dword [ebp - 0x55], eax
lds ecx, [edi + 0x33]
movsd dword es:[edi], dword [esi]
pop ss
dec edi
and eax, 0xc33fda97
out 0xf7, eax
cmpsb byte [esi], byte es:[edi]
jp 0x207d151
invalid

Function at 0x2082ae3
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + eax*2 - 0x5d35241e]
lea esp, [esp + 8]

Function at 0x20886e6
Capabilities:
Encode data using base64

Disassembly:
not ecx
mov dword [esi], ecx
jmp ebp
lea esp, [esp + 0x14]
je 0x224c7db
push 0x1c200419
sar dword [esp], 0x16
mov dword [esp], ebx
mov ebx, 0x838fb888
movzx ebx, byte [eax]
xor ebx, ecx
jmp 0x21237bc
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x1bbfcc8]
push 0x16061e1e
shr ecx, 8
sub dword [esp], 0xa61cf29f
xor ecx, ebx
sar dword [esp], 0xf3
inc eax
xor ecx, 0x4e313f1f
sal word [esp], 0x6f
dec edx
lea esp, [esp + 4]
jne 0x20886fc
call fcn.0224c7c7
mov edx, 0xe83c2b31
jmp 0x1bbc392

Function at 0x2095e83
Capabilities:
Get number of processors

Disassembly:
push ecx
mov edx, dword [ecx + esi - 0x70e40000]
call fcn.022b767d
Function at 0x20a495e
Capabilities:
Authenticate hmac

Disassembly:
inc dword [esp]
movzx edx, cx
ror eax, 1
call fcn.02165c07
mov eax, 0xd017f38a
mov edx, dword [edi]
xor edx, ebx
bswap edx
neg edx
sub edx, 0xa383ad89
or ax, ax
not edx
pop eax
xor ebx, edx
lea eax, [eax*4 - 0x26d58e65]
movzx ecx, ax
add ebp, edx
dec al
sub eax, eax
lea edx, [eax - 0xa7f8bda]
lea edi, [edi + eax - 4]
xchg dh, cl
jns 0x21b9b6a
mov dword [esp], eax
mov word [esp + 2], ax
mov dword [ebp], ecx
sub edi, 4
call fcn.0207cc0d
jbe 0x20a490e
xor dword [edx - 0x56bc4288], 0xd6c335f6
xor al, 0x61
xchg esp, eax
push esi
test eax, 0x1d3bbd03
test eax, 0x699f389c
test eax, 0x9c2b55ac
push esi
imul eax, dword [edi + 0x16c1846e], 0x19
js 0x20a4a1a
sub dword [esp + esi], ebx
arpl si, ax
out dx, al
push ss
das
test al, 0xa7
salc
retf
int 0x7e
mov byte [ecx - 0x19], bl
pop ds
sar dl, 0xd1
jmp 0x20a4985
dec esi
adc dword [ebx], edx
mov byte [0xa471bdf1], al
cmp eax, 0xe3afae60
daa
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
jecxz 0x20a4a10
daa
pop edx
fisubr word ss:[edi + 0x4ee87461]
mov al, byte [0x12d9c9f4]
mov al, 0x7f
xchg esi, eax
push ss
out dx, eax
pop eax
cmp al, 0xf6
popfd
std
inc esp
xor byte [edi + 0x32d5416d], cl
push edi
jb 0x20a4abf
imul esi, dword [esi + ebp + 0xd], 0xad7f0151
jnp 0x20a49eb
popal
pop eax
pop esi
fbld tbyte [esi]
cli
ret 0x2f79
xchg ebp, eax
iretd
mov edx, dword [ecx + edi - 0x1f74]
xor edx, ebx
xor cl, 0x1d
or ecx, ecx
or ecx, ecx
inc edx
inc ecx
lea ecx, [eax*4 - 0x435ff2c3]
rol edx, 1
bswap edx
ror cl, 0xe5
ror ecx, cl
call fcn.020dc121
mov eax, 0x37845188
movsx ecx, ax
lea edi, [edi + eax - 0x3784518c]
add al, cl
mov ecx, dword [eax + edi - 0x37845110]
mov edx, eax
xor ecx, ebx
dec eax
add edx, eax
dec ecx
jmp fcn.020836ab

Function at 0x20a6ab2
Capabilities:
Encode data using base64

Disassembly:
add esi, 4
call fcn.0212ca19
Function at 0x20a6abd
Capabilities:
Encode data using base64

Disassembly:
sal cl, cl
ror ebp, 1
inc esp
movzx ebp, cl
pop edx
dec edx
lea edi, [ecx*2 + 0x741d1735]
push ebx
not cl
xor dword [esp + eax - 0x6f22], ebp
inc cx
and edi, ebp
inc ecx
movsx edx, cx
pop ebx
jg 0x21b9ebf
test esp, ebx
dec esi
lea ebx, [ecx + ecx*8 + 0x751c8184]
sbb cx, 0xbf8c
dec eax
arpl bp, bp
call fcn.01bc460b
mov esp, 0x4802caf0
mov esp, 0x7a3446fc
xchg ebx, eax
jbe 0x21b9f2c
mov byte [0xcbde556a], al
pop ebp
dec ecx
push ecx
xor edx, dword [esi]
mov ah, 5
sbb esp, dword [edx]
xor al, 0xd2
idiv byte [ebp + 0x46]
std
dec ebx
or ah, byte [edx - 0x64e03422]
and al, 0x38
push ds
mov ah, 0xbf
aad 0x2a
sbb dh, byte [ebx + ecx]
enter 0xffffffffffffb680, 0x4b
xor ebx, dword [edi]
xchg edi, eax
mov ah, 0x71
fld qword [edx + eax - 9]
inc esp
add dh, bh
and esi, dword [ebx - 0x25]
invalid
fidiv dword [esi]
dec esi
or al, 0x2e
loop 0x21b9f3f
test edx, edx
dec ebx
push 0xfffffffffffffff4
inc esi
and eax, 0x9f1825cf
pop dword [0xc5fd2001]
add eax, 0xc5fd2001
sub byte [ecx + 0xcbffd3a], dl
or byte [edx], al
jb 0x21b9f32
shl dword [edx + eax], cl
loope 0x21b9f1f
xchg dword [edx + 0x66], edx
std
jne 0x21b9ee6
add byte [edi], dh
std
js 0x21b9eff
and dword [eax + 2], eax
push ds
sti
pop ss
inc eax
add cl, byte [eax - 0xd]
sbb bh, ch
inc ecx
lahf
inc esp
xor eax, 0xf4ddd502
adc eax, 0x876e9902
mov ah, 0x90
mov eax, dword [0x4e342fa8]
jbe 0x21b9f11
into
out 0x4b, eax
retf 0xd3e6
Function at 0x20d97fe
Capabilities:
Encode data using base64

Disassembly:
not dword [esp + eax - 0x35a7b8b6]
rol edx, 2
not dword [esp + eax*2 - 0x6b4f7171]
push eax
sal cx, 0x44
xor edx, 0x260c95bd
call fcn.0224d6bd
inc eax
push edx
neg eax
movzx ecx, dx
inc ecx
neg edx
sub eax, 0xd7193424
add edx, ecx
shr edx, 0xff
shl word [esp + edx*2], 0xc1
xor ebx, eax
lea edx, [ecx*8 + 0x6fa41734]
add edi, eax
mov dword [esp + edx - 0x6fab9734], edi
ret
movzx esi, byte [ecx]
jmp 0x2288f45
lea edx, [eax + edx - 0x413edcc6]
js 0x1c4e8f2
mov eax, dword [esi]
call fcn.01c426a0
mov ecx, 0xb9949d3a
pop esi
mov edx, 0xe50f06a4
mov ecx, edx
not eax
mov dword [edi], eax
jmp ebp
inc al
neg al
shr ecx, 0x51
dec al
inc dword [esp + ecx*8 - 0x1eda9]
push edx
not edx
neg al
mov dword [esp + ecx - 0x3db2], 0xbe9c340a
xor bl, al
inc edx
add ecx, edx
mov byte [esp], 0x2a
lea eax, [esp + eax + 0x10]
lea edx, [edx + ecx*2 + 0x1f36dd1a]
mov ecx, dword [eax]
jbe 0x22abc8b
movzx eax, dx
call fcn.021b76a6
not edx
dec edx
neg ecx
neg edx
shl cx, cl
neg ecx
inc edx
xchg ecx, eax
or ecx, 0xa917d02f
xor ebx, edx
inc eax
not cl
sal cx, 0x46
adc esi, edx
add ecx, ecx
mov edx, eax
mov ax, word [ebp + ecx - 0x522fe800]
or cl, byte [ebp + ecx - 0x522fe7fe]
add ebp, 2
shr ax, cl
mov word [ebp], ax
lea eax, [edx + edx + 0x35287e96]
jmp esi
xor edx, 0x133ae937
xchg byte [esp + eax*2 - 0x6b4f716d], cl
shr word [esp + eax*2 - 0x6b4f7171], 0x65
ror edx, 1
inc eax
or byte [esp + eax - 0x35a7b8b5], 0xc
jno 0x208870b
mov ecx, 0xcc8341ba
sub edi, 4
sal cx, 0x41
mov eax, dword [edi]
xor eax, ebx
rol eax, 2
rol ecx, cl
xor cx, cx
dec eax
call fcn.01be13dc
add byte [eax], al
add byte [edi + 0x65], al
je 0x20f7ff7
outsb dx, byte gs:[esi]
jne 0x20f7ff1
push 0x4d6b6365
popal
jb 0x20f8021
inc esp
imul ebp, dword [ebp + 0x65], 0x6f69736e
outsb dx, byte [esi]
jae 0x20f7fc1
sub edi, 4
mov eax, 0x6302c6bd
mov eax, dword [edi + eax - 0x6302c6bd]
xor eax, ebx
mov edx, 0x7d999d13
inc edx
movsx ecx, dx
xor eax, 0xed977a81
rol eax, 1
sar cl, 0x25
xor eax, 0x89c2ca7
call fcn.0228526f
movzx dx, byte [edi]
add byte [esi + 0xf], ah
mov dh, 0x17
mov eax, 0xd0915b31
shr al, 0x67
movzx ecx, al
xor dword [ebx - 0x6f], ebx
rol al, 1
call 0xcac58f68
xor cl, byte [ecx + edi + 2]
call fcn.020ede86
xor esi, eax
and esi, 0xff
mov esi, dword [esi*4 + 0x1c587c0]
shr eax, 8
mov dword [esp], 0x1c8a0937
xor eax, esi
push 0xcb108423
inc ecx
sar dword [esp + 4], 0xae
xor eax, 0xcc27c911
dec edx
lea esp, [esp + 8]
jne 0x1cdf14b
mov bl, byte [ebx + esi]
invalid
jmp 0x208bd08
call 0x20f800a
mov ecx, dword [esi]
dec byte [esp]
add esi, 4
mov eax, dword [esp]
push eax
mov dword [esp + 4], ecx
push dword [esp + 4]
popfd
mov dword [esp + 4], 0x7cbcd8ac
sub edi, 4
lea ecx, [eax*2 + 0x57bb2da6]
xadd cl, ch
mov edx, dword [edi]
adc ecx, ecx
mov byte [esp + ecx*2 - 0x6b4f716e], 0x22
xor edx, ebx
xchg ecx, eax
jmp 0x20f7f5b
Function at 0x20e3707
Capabilities:
Encode data using base64

Disassembly:
and ebx, 0xff
push 0xe9df9b0
mov ebx, dword [ebx*4 + 0x222c1e8]
shr edx, 8
xor edx, ebx
inc eax
sar word [esp + 1], 0x8b
xor edx, 0xa4847a2f
mov dword [esp + 4], 0xba86d012
dec ecx
lea esp, [esp + 0xc]
jne 0x2290e5c
mov ecx, 0xaf8ad2bd
jmp 0x21342fe
jmp 0x21a61d4
pop ebx

Function at 0x20e565b
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0x4c06130c
lea edx, [edx + edx*8 - 0x2fca9779]
bswap eax
sub eax, 0xaeb232b7
bswap eax
push edx
rol eax, 1
dec word [esp + edx - 0x41733eb0]
mov dword [esp + edx - 0x41733eae], 0xad96b583
xor ebx, eax
sub byte [esp + edx - 0x41733eb0], 0x9d
add esi, eax
xor edx, 0x51a1cd16
ror dword [esp + edx*2 - 0x21a5e747], 0xde
mov bp, word [ebp + edx*2 - 0x21a5e748]
pop eax
pop edx
jne fcn.022a833e

Function at 0x20e6b8b
Capabilities:
Encode data using base64

Disassembly:
not ecx
mov dword [esp + eax - 0x29d00000], eax
bswap ecx
dec ecx
dec dword [esp + eax*2 - 0x53a00000]
xor ebx, ecx
inc dword [esp + eax*2 - 0x53a00000]
push eax
je 0x22abcb1
add ebp, ecx
mov dword [esp + eax - 0x29d00000], ebp
ret 4

Function at 0x20ea891
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push edx
and edx, 0xda1c64b1
neg ecx
xor ebx, ecx
add ax, ax
add esi, ecx
bswap edx
mov ebp, dword [ebp + edx*2 - 0xc02004]
sar eax, 0x81
sar dword [esp + edx - 0x601002], 0x4f
push eax
pop eax
pop ecx
pop eax
jne fcn.01b34394

Function at 0x20fa331
Capabilities:
Encode data using xor

Disassembly:
cmovb ecx, eax
ror edx, 1
mov dword [esp + ecx - 0x3370002d], eax
sub byte [esp + ecx*2 - 0x66e00058], cl
or al, 0xd3
dec dword [edi + 0x4c8c28cc]
test al, 0xff
pop ds
cdq
bswap edx
xor ebx, edx
shl ax, 0xc3
call fcn.01bfeccb
jg 0x20fa338
mov eax, dword [0x28ca2f02]
sub al, 0xb4
sahf
add byte [eax], bl
xor al, 0xb0
pop eax
mov bl, byte [ebp - 0x39]
dec ebx
std
mov ecx, 0xd080cbe4
xchg dword [ebx], esp
and al, 0xb4
xor al, 0x7a
xor dword [eax], esp
xor al, 0xbd
adc ebx, dword [ebx - 0x40ffb474]
movsd dword es:[edi], dword [esi]
mov cl, 0xb4
lds eax, [ecx]
dec edx
dec esp
xor al, 0xc7
and eax, 0xa0074b7c
or byte [ecx + 0x24b15e4b], ah
mov eax, edi
add dh, byte [ebx + 0x7efdca14]
std
retf

Function at 0x20fbd83
Capabilities:
Encode data using base64

Disassembly:
inc edx
xor byte [esp - 0x4a], 0x8e
dec esi
mov dword [esp - 0xb4], esp
inc ecx
dec ebx
inc bp
and esi, esp
call fcn.01d1ce9a
mov ecx, 0x1313be28
lea eax, [ecx*2 - 0x3a4d6359]
sal ax, cl
lea edi, [edi + ecx - 0x1313be2c]
mov eax, dword [ecx + edi - 0x1313be28]
call fcn.022da380

Function at 0x21059ef
Capabilities:
Encode data using xor

Disassembly:
jns 0x21aab83
mov cl, byte [esi + 2]
jl 0x2287bb1
pop eax
add eax, 0xff964117
jmp eax
Function at 0x2108a0f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xe9851be2
rcl byte [0xd0860016]
xchg al, dl
xchg al, dl
xor ecx, ebx
rol ecx, 1
not edx
neg ecx
xor ecx, 0x8234341c
mov dword [esp], eax
rol ecx, 1
xor ebx, ecx
and edx, eax
xadd eax, edx
xor al, dl
adc edi, ecx
pop ecx
add edx, ecx
mov ecx, dword [eax + ebp - 0x3749a00]
call fcn.01bca6f1
inc ebx
shr byte [ecx], cl
mov ebp, dword [esi + 0x5e]
insb byte es:[edi], dx
adc byte [0x62eceffb], ah
push ebp
movsb byte es:[edi], byte [esi]
push cs
jp 0x2108a06
adc bl, byte [edi - 0x2a849161]
aas
mov ebx, 0x9ab7bd80
enter 0xfffffffffffff6e9, 0xffffffffffffffd3
add eax, 0x12219330
test eax, 0x3311c344
sahf
inc esp
call 0x127f93cb
adc al, byte [edi + 0x6bf7eb00]
adc ah, byte [edx - 0x34e5b45a]
and byte [edx + 0x3fedfd4c], ch
aad 0xfa
mov ah, 0x21
int 0xdb
imul edx, dword [edx], 0x19567515
sbb ebx, ecx
insd dword es:[edi], dx
xlatb
in eax, dx
xchg edx, eax
push esi
fsin
xor al, 0xf5
or dword [eax], 0x1292355b
pop esp
int3

Function at 0x210e25d
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [ebp + eax - 0x79f]
call fcn.02090f18

Function at 0x2112cf1
Capabilities:
Encode data using base64

Disassembly:
not eax
xor edx, ebx
push eax
lea edx, [edx + eax + 0x205ade0]
push eax
xor edx, 0x923f7032
mov dword [esp + ecx - 0x16b4968c], eax
xor ax, ax
jae 0x1d18ce2

Function at 0x2118131
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0x3a9a4478], ecx
or dx, ax
add byte [esp + ecx*2 - 0x753488ed], ch
movzx eax, cl
sar dword [esp + eax - 0x78], cl
not dx
mov word [esi + eax - 0x78], dx
sar cl, 0x61
sal dword [esp + ecx - 0x3a9a443c], cl
lea ebp, [ebp + ecx - 0x3a9a4440]
xchg word [esp + ecx - 0x3a9a443b], cx
mov edx, dword [ebp + ecx*2 - 0x75340000]
js 0x225eb9a
inc esp
mov ecx, dword [esi]
inc ecx
mov esp, 0x75b6da8a
inc ecx
movsx edi, ah
mov edx, 0x1d337427
dec edx
lea esi, [esi - 0x75b6da86]
rol dl, 0x25
inc ebp
movsx ebx, ah
jae 0x232182a
mov edx, 0xb5adf932
ror edx, 0x82
jb 0x226f7c4
mov edx, dword [esi]
mov eax, 0x8610039a
push eax
dec word [esp]
add esi, 4
or byte [esp + 1], 7
xor edx, ebx
pop ecx
push ecx
neg edx
pop ecx
lea edx, [edx + eax - 0x726c2776]
and ecx, ecx
rol cl, 0x67
bswap edx
xchg ch, cl
push ecx
xadd eax, ecx
lea edx, [edx + eax*8 + 0x54b9581b]
call fcn.021dc7cd
mov ecx, 0xd78ae43a
sar ecx, 0x5b
mov eax, ecx
sub edi, 4
mov ecx, dword [edi]
xor ecx, ebx
dec eax
bswap ecx
ror eax, 0xad
dec ecx
bswap ecx
call fcn.021bcee9
call fcn.022d4617
jmp 0x1cda6e3

Function at 0x211841e
Capabilities:
Encode data using xor

Disassembly:
shl byte [ebx - 7], 0x77
jmp 0x196cc3ad
add edi, ecx
lea eax, [edx + edx*2 + 0x443b11b5]
call fcn.01b3d673
push edx
js 0x21183dc
aas
xchg esp, eax
sbb byte [ebx + ebx - 0x723ce63a], cl
sbb ebx, dword [esi + 0x12]
invalid

Function at 0x2118d7f
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp]
mov cl, byte [ebp + 4]
call fcn.01c5a4c8
mov bh, 0x11
push eax
xchg ebp, eax
xor esi, dword ds:[esp + edx*2 + 0x12]
mov bh, byte [edi]
adc al, 0x72
inc ebx
cli
invalid
Function at 0x211d445
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
pop ecx
xadd byte [esp + edx*2 - 0x172], dh
mov ecx, 0xbe9e448c
adc ebp, eax
dec cx
lea eax, [edx + ecx + 0x3dbcec21]
mov edx, dword [esi + edx - 0xbb]
shl cl, 0x41
inc ax
adc dword [esp + 4], 0x5317c78c
adc esi, 4
pop eax
pop ecx
mov dword [esp + ecx - 0x53183d8d], edx
popfd
jmp 0x2205226
call fcn.0212c944

Function at 0x21208bc
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esi]
mov dword [esp], edx
sub dword [esp], edx
adc esi, 4
xor eax, ebx
xor eax, 0x249c663b
not eax
sub byte [esp + 3], dh
inc eax
not eax
call fcn.01b8c7a2
shr cx, cl
not edx
xchg ecx, eax
jp 0x207cbc6

Function at 0x21208eb
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + eax*2 - 0x547539c8]
call fcn.0216c835
inc ecx
bswap ecx
inc ecx
dec ecx
pop edx
inc ecx
push edx
dec eax
lea ebp, [ebp*2 - 0x1c5c3568]
dec eax
mov dword [esp + eax*2 - 0x6c], ebx
dec edx
lea edi, [ecx + 0x663f258f]
inc esp
movsx ebp, byte [esp + eax - 0x36]
inc esp
xor dword [esp + eax*2 - 0x6c], ecx
dec eax
lea edi, [ecx + ecx*8 + 0x3b903637]
dec eax
not dword [esp + eax - 0x3e]
inc esp
mov esi, ebp
dec eax
mov ebx, dword [esp + eax - 0x2e]
dec eax
mov dword [esp + eax*2 - 0x6c], ebp
dec ecx
shl edx, 0x24
inc bp
sbb edx, esp
dec ebp
arpl cx, cx
dec ebp
add edi, ecx
inc ebp
movzx ebx, sp
inc ebp
or edx, esi
inc sp
mov dword [esp + eax - 0x33], esi
dec ecx
mov ecx, dword [eax + eax*4 - 0xf8]
inc esp
mov ebp, dword [ecx + eax*2 - 0x7c]
neg byte [esp + eax - 0x33]
inc ecx
movsx ecx, dl
dec eax
lea ecx, [ebp + ebp*2 + 0x2e9e6c9e]
dec esi
lea eax, [eax + eax - 0x3a]
jns 0x20cd74f

Function at 0x2121753
Capabilities:
Encode data using base64

Disassembly:
pop edx
mov dx, word [esi + 2]
mov cl, byte [esi + 4]
push 0xd606f612
add esi, 4
shrd ax, dx, cl
mov word [esi], ax
mov ecx, 0x5c846919
not ecx
pop eax
lea ebp, [ebp + eax*2 + 0x53f213d8]
shl cx, 0xeb
neg al
mov ecx, dword [ebp + eax*2 + 0x53f21224]
lea edx, [eax - 0x7dfac87d]
call fcn.01c3fcea
mov ecx, 0x728d133c
mov eax, ecx
jmp 0x219248a
mov eax, dword [ecx + ebp - 0x728d133c]

Function at 0x2124b23
Capabilities:
Encode data using xor

Disassembly:
inc eax
mov dword [esp + edx*2], ecx
ror eax, 1
xchg dh, dl
lea edx, [ecx*8 + 0x63274112]
call fcn.01d0b4f9
lodsb al, byte [esi]
sbb al, byte [ebx - 0x2d]
sbb eax, 0x10cc9127
and dword [ebp + 0x317c68fb], ebp
cmp dword [ecx - 0x7b], ebp
aam 0x6e
pop esp
xor eax, 0x693d3d70
push 0xde163408
and dword [ebx], 0xffffffc6
or edx, esp
sal dword [ecx - 0x69], cl
wait
xchg byte [ecx], al
fcmovnb st(0), st(4)
mov byte [ebx], cl
scasb al, byte es:[edi]
rol edi, 0
sahf
aaa
lodsd eax, dword [esi]
cwde
test byte [ecx + 0xe], dl
inc ecx
bound ecx, qword [esi + ecx*2 - 0x35e1e9ba]
xchg esp, eax
je 0x2124b33
ret 0xbe69
clc
inc edx
ret 0x8d54
Function at 0x21342ad
Capabilities:
Encode data using base64

Disassembly:
and cl, 0x23
inc ecx
mov edx, 0x8e2c472d
dec ebp
mov esp, eax
inc ebp
mov ebx, esi
dec ebp
lea eax, [eax + ebp - 0x2af3bcac]
inc cx
dec esi
dec eax
mov dword [esp + ebp - 0x2af3bca0], ebp
inc ebp
mov dword [eax + ecx*2 + 0x558031fa], esp
inc ecx
pop ecx
pop eax
inc ecx
pop edx
jno fcn.01c5732f
add byte [eax], al
add byte [ecx + 0x75], dl
jb 0x2134364
push eax
jb 0x2134355
outsd dx, dword [esi]
jb 0x213435f
popal
outsb dx, byte [esi]
arpl word [ebp + 0x43], sp
outsd dx, dword [esi]
jne 0x2134368
je 0x2134361
jb 0x21342fe
or cl, ch
sbb eax, 0xbd001ef6
or al, 0x2e
adc byte [ebx + 0xf44fd8b], dh
mov bl, 0x8b
std
inc esp
movsx edx, bp
dec ebp
mov ebp, eax
mov edi, 0xe88b4dd5
call 0xc7d152ad
inc eax
movsx eax, ch
call fcn.0213f9e7
Function at 0x2173ea6
Capabilities:
Authenticate hmac

Disassembly:
rol dl, 0x24
adc esi, eax
movzx eax, byte [edx + edi - 0x1a000000]
ror dl, 7
rol edx, 0xe7
lea edi, [edi + edx*4 - 0x33]
rol cx, 0x6a
call fcn.021b6e65

Function at 0x217c4ba
Capabilities:
Encode data using base64

Disassembly:
rol edx, 2
push eax
bswap eax
sal dword [esp + eax - 0x469fbf74], cl
inc edx
rol ecx, cl
push ecx
jae 0x1bc1aa9
inc ecx
mov ebp, ebp
dec esi
lea eax, [edi + eax - 0x65bf87f6]
inc ecx
mov byte [ecx + edi - 0x65bf8800], dl
dec ebp
lea ecx, [ebp + ebp*2 + 0x2ba60f90]
inc ebp
movsx esp, bp
call fcn.01bbc0f0
sub dword [esi - 0x19dfc13e], 0x24793997
jp 0x1bc188c
mov al, byte [0x6d93ffb2]
xchg ebp, eax
daa
and ebx, dword [edx - 0x64fe2]
mov ecx, dword [ebp - 0x42731baf]
and byte [esi - 0x5ece023e], 0x25
sti
cmp al, 0x54
jmp 0x1bc18c8
ret
sub bl, cl
outsd dx, dword [esi]
dec eax
pop esi
or al, 0x68
cmpsd dword [esi], dword es:[edi]
in al, dx
aas
in al, dx
rcr dword [eax - 0x57], cl
lcall 0xa265, 0x73ebec62
cli
adc al, 0x90
add dl, ah
sbb ecx, dword [ebx - 0x6f]
ja 0x1bc192e
loope 0x1bc192f
call 0xb3457a5a
xchg esp, eax
salc
test ah, 0xf
das
xchg ecx, eax
aad 0x9c
dec esp
insd dword es:[edi], dx
out 0xb3, al
mov ebx, 0x4560e3da
in al, 0x9e
xchg ecx, eax
test byte [ebx + 0x22895441], dl
imul ecx, dword [edx - 0x7f], 0xffffff94
push es
mov ebp, 0xd1f74143
inc ecx
not ecx
movsx edi, byte [esp + 0x1a]
dec esi
lea ebp, [edx*4 - 0x127b4beb]
dec eax
sbb dword [esp + edi + 0x15], 0xc014cc1d
inc ecx
dec ecx
dec eax
mov dword [esp + edi*2 + 0x18], ebx
pop esp
jl 0x1bc1949
dec eax
mov dword [esp + edi*2 + 8], eax
dec eax
shr dword [esp + edi*8 + 0xc], 0xb6
inc esp
xor dword [esp + edi + 0x18], ecx
dec ecx
sub ebp, 0x920a259c
dec eax
mov ebx, dword [esp + edi*2 + 0x18]
inc ecx
pop ebp
dec ecx
add ebp, 0xfff5d5b9
inc ecx
jmp ebp
bswap edx
bswap eax
xor ebx, edx
inc cl
xor cl, byte [esp + ecx - 0x20005cbe]
xor ecx, ecx
adc ebp, edx
inc eax
xchg dword [esp + ecx + 8], ecx
add dword [esp + ecx*2 - 0x2e80c76f], ecx
mov cx, word [esi + ecx - 0x174063b8]
lea edx, [eax + 0x1f210930]
ja 0x22e669b
cmc
add ebp, eax
mov dword [esp + ecx - 0x3b000000], ecx
call fcn.01cf2521
mov dword [esp + edx - 0xc5c], edx
mov dl, byte [ebp + edx*2 - 0x18bc]
mov ecx, dword [esp]
add ebp, 6
call fcn.020e5e4e
xadd ax, dx
call fcn.022026e1
add eax, eax
sbb edi, 4
mov eax, dword [edi]
mov edx, 0x7714bea2
bswap edx
shl dx, 0xa3
xor eax, ebx
dec eax
not eax
or edx, 0xd01f271c
and edx, edx
movsx ecx, dx
bswap eax
or cx, cx
jo 0x1bc1807
neg eax
inc cx
xor ebx, eax
push ecx
sal word [esp], 0x4b
add ebp, eax
mov si, word [esi]
pop edx
jmp fcn.0207cd37
lea esi, [esi + eax - 0x77bf9f45]
lea edi, [edi + eax - 0x77bf9f48]
ror dx, 3
call fcn.0207a4e5