joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007815f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100781a1
call fcn.1007f6ac
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100781a1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10078198
xor eax, eax
jmp 0x100781a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100781af
pop edi
pop esi
pop ebx
ret 4

Function at 0x100789d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x100789fa
cmp dword [edi + 0x3c], 0
jne 0x100789fa
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.1007f6ac
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.10078a27
pop edi
pop esi
pop ebx
ret 8
Function at 0x401880
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e004]
jne 0x40188a
repz ret
jmp fcn.004022d9

Function at 0x4087a5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040408c
xor ebx, ebx
cmp dword [0x40fa7c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40887a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4087e5
xor eax, eax
jmp 0x40893e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40b9c8
push edi
call esi
cmp eax, ebx
je 0x4087de
push eax
call fcn.00404029
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40fa7c], eax
call esi
push eax
call fcn.00404029
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40fa80], eax
call esi
push eax
call fcn.00404029
mov dword [0x40fa84], eax
lea eax, [ebp - 8]
push eax
call fcn.00401dab
test eax, eax
pop ecx
pop ecx
je 0x408848
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004027b6
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40887a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404029
cmp eax, ebx
pop ecx
mov dword [0x40fa8c], eax
je 0x40887a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404029
pop ecx
mov dword [0x40fa88], eax
mov eax, dword [0x40fa88]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4088f3
cmp dword [0x40fa8c], esi
je 0x4088f3
push eax
call fcn.00404095
pop ecx
call eax
cmp eax, ebx
je 0x4088c0
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x40fa8c]
call fcn.00404095
pop ecx
call eax
test eax, eax
je 0x4088c0
test byte [ebp - 0x18], 1
jne 0x4088f3
lea eax, [ebp - 0xc]
push eax
call fcn.00401de2
test eax, eax
pop ecx
je 0x4088db
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004027b6
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4088ea
or dword [ebp + 0x10], 0x200000
jmp 0x408924
or dword [ebp + 0x10], 0x40000
jmp 0x408924
mov eax, dword [0x40fa80]
cmp eax, esi
je 0x408924
push eax
call fcn.00404095
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x408924
mov eax, dword [0x40fa84]
cmp eax, esi
je 0x408924
push dword [ebp - 4]
push eax
call fcn.00404095
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x40fa7c]
call fcn.00404095
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x121da84
Capabilities:
Encrypt data using chaskey

Disassembly:
inc ecx
mov edx, dword [ebp + edx*2 - 0x352a]
inc cx
shl ecx, 5
dec edx
xchg dword [esp + ecx*2 - 0x69], ebx
inc ebx
mov eax, dword [ebp + ecx*2 - 0x7c]
dec edx
mov dword [esp + ecx - 0x38], 0xff3d372a
call fcn.0135d3d4

Function at 0x1221776
Capabilities:
Get number of processors

Disassembly:
xor ebx, eax
sal cx, 0x42
add cx, cx
adc esi, eax
and dx, dx
mov eax, dword [edi + edx*2]
call fcn.0178a2bc

Function at 0x1229e78
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax + ebp - 0x4bfc0660]
mov dword [esp + eax - 0x4bfc0660], eax
lea ecx, [eax + eax*8 + 0x55a97531]
xor edx, ebx
and eax, eax
bswap edx
xor ecx, eax
jns 0x13de423
inc ecx
not eax
movsx edx, bx
inc ecx
xor eax, 0x6b263d3e
inc edi
lea eax, [esi + eax - 0x752bdb27]
ror di, 0x4a
push edx
inc ecx
not eax
dec ecx
neg ebx
dec edx
mov dword [esp + esi*2 - 0x75274cf6], esi
inc eax
inc bh
call fcn.013cdc07
movzx cx, byte [edi]
mov dl, byte [edi + 2]
mov eax, 0xe893319c
and al, 0xad
adc edi, 2
add cl, dl
movsx edx, al
mov word [edi], cx
shr dx, 0xb
or edx, edx
sbb ebp, 4
mov edx, dword [ebp]
push eax
rol dword [esp], 0x9b
xor edx, ebx
not eax
mov ecx, 0xcf146209
and ax, word [esp + eax - 0x176cce71]
neg edx
add eax, 0x311453a9
ror ax, 0xa7
ror edx, 3
or eax, dword [esp + eax - 0x4880d333]
xchg dword [esp + eax - 0x6fc4dbbf], eax
not edx
neg edx
call fcn.0179a7d7
mov eax, 0x171d8e8b
sub ax, ax
lea ebp, [ebp + eax - 0x171d0004]
lea edx, [eax + 0x29869594]
mov edx, dword [ebp + eax - 0x171d0000]
call fcn.01786d20
sar ecx, cl
lea edx, [edx + ecx*2 - 0x4836561a]
neg edx
neg ecx
rol cx, cl
dec ecx
rol edx, 2
xchg cx, ax
fldenv [esi - 0x2d]
ror dword [ecx - 0x3f], 0xc2
add ah, byte [esi - 0x6f]
xchg word [esp + eax - 0x4bfcac4c], ax
xor ebx, edx
shr cx, 0x62
sar ecx, 0xf9
call fcn.01327594
loop 0x13de42f
in eax, 0x39
aaa
fcmovnu st(0), st(3)
shl byte [esi + ecx*4 + 0x4d], 1
xor esi, edi
mov esp, 0xc74d8e64
iretd
Function at 0x122b31e
Capabilities:
Encode data using xor

Disassembly:
not cx
movsx edx, cx
not eax
shl ecx, 0xd1
mov dword [esp + ecx - 0x5bfdfff0], 0x592fdc3a
movsb byte es:[edi], byte [esi]
cmp bl, ah
das
pop ecx
xor eax, 0x349efb39
or edx, edx
call fcn.013ab012
xchg edi, eax
inc ebx
loope 0x122b32f
ja 0x122b3b4
mov edx, 0xd5c606d
dec esi
sub al, byte [ecx]
pushal
pop esp
or eax, 0x6015e6c2
pop esp
or eax, 0x601de2d6
pop esp
or eax, 0x6001fe36
pop esp
or eax, 0xe82b6bfa
ret
popal
fstp qword [eax + 0x61a5b75c]
pop esp
mov bh, 0xa5
popal
fst st(4)
xor bh, ah
movsd dword es:[edi], dword [esi]
popal
frstor dword [ecx + ecx*4]
leave
sub eax, 0xdec4bbfe
pop ebx
into
xchg esi, eax
cmp byte [edi - 0x6b], ah
cmp byte [ebx - 0x74], 0xea
dec edx
sahf
xchg edx, eax
mov eax, dword [0xc866ee32]
mov al, byte [ebx - 0x26ddecfe]
inc esi
out dx, eax
dec esp
jb 0x122b42e
invalid
fld dword [esi - 0x11]
and dword [eax], eax
fld dword ds:[esi - 0x11]
or dh, byte [edx]
push cs
fld dword [esi - 0x11]
or dword [esp + ebx*4], edx
pop eax
add dword [ebx - 0x5a], ecx
xor ch, byte [ecx + 0x6390a3d3]
js 0x122b42e
in al, 0xd0
aas
pop ss
into
push esi
cld
pushal
dec edi
pop ss
into
push esi
or al, 0x27
jno 0x122b3b1
push ecx
xor byte [ebx], al
cmp bh, byte [eax + 0x3397b844]
xor al, 0xf8
xor ch, byte [ecx]
loope 0x122b42e
push esp
cdq
cmp eax, 0x17bf3d13
inc ebp
cdq
ljmp 0x1092
mov eax, 0x781092ed
out dx, al
dec esi
cmp byte [eax + 0x185b35ac], dh
jmp 0x122b3c3

Function at 0x12366e4
Capabilities:
Encode data using base64

Disassembly:
inc esp
movzx ebx, di
inc esp
xor esi, esi
inc ecx
ror esi, 3
inc ecx
dec esi
pop edi
call fcn.0133c6d6
dec eax
arpl ax, ax
jbe 0x1268e14
xchg word [esp + ebx*2 - 0x5728e42], di
dec esp
adc esp, eax
pop ecx
pop ebp
pop edi
pop eax
jmp fcn.013240cb
inc ecx
pop ebx
jnp fcn.013240cb
shr byte [esp + 5], 0xa6
xor edx, ebx
neg edx
not edx
sub edx, 0x9fbdbe35
mov ecx, dword [esp + 4]
lea eax, [ecx + ecx + 0x58aaa828]
neg edx
sub edx, 0xdaa0d001
lea ecx, [eax + ecx*2 - 0x3c7e5f5a]
jmp fcn.0134de1e
Function at 0x1248b96
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
sbb al, 0x82
inc edx
push cs
movsb byte es:[edi], byte [esi]
sbb al, 0x23
imul edi, edi, 0xe
movsb byte es:[edi], byte [esi]
sbb al, 0x82
bound eax, qword [edi + 0x221ca40e]
invalid
neg dl
call fcn.01230a8b
pop ebx
wait
xchg esi, eax
aaa
sahf
mov byte ss:[0xe48017bd], al
sahf
jb 0x1248b40
pop ss
and ah, 0xae
inc esi
movsd dword es:[edi], dword [esi]
pop ss
and ah, 0x8e
leave
pop ss
and ah, 0xa
in eax, dx
pop ss
and ah, 0x2e
nop
fistp word [edi + 0x6cd2821f]
insb byte es:[edi], dx
mov edx, 0x81bc89f7
lodsb al, byte [esi]
fcomp qword [edx - 0x554c899a]
cmpsd dword [esi], dword es:[edi]
xor ch, byte [edx - 0x7c730fc1]
aaa
xor eax, 0xef40e107
dec esi
dec eax
jg 0x1248bc7
inc eax
out dx, eax
insb byte es:[edi], dx
arpl word [ebx - 0x1f], dx
inc eax
out dx, eax
inc ebp
add eax, 0xef40e123
add edx, dword [0xaa015ea4]
mov esi, 0x13aea101
daa
enter 0x1680, 0xffffffffffffffd4
mov bl, 0xbb
mov al, pe_nt_image_headers32
push ss
aam 0x4b
arpl word [eax + 0x5bd41680], bx
outsd dx, dword [esi]
nop
adc byte [esi], 0xd4
rol dword [edi], cl
fadd dword [eax - 0x39e42bea]
xchg esi, eax
or byte [ecx + 0x2cfb9bb2], cl
mov esi, 0xf19c172b
adc dl, bh
out dx, al
add byte [ebx - 0x53], 0xa7
xor cl, byte [edx]
invalid
Function at 0x124b48f
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, dx
mov dword [esp + edx], edx
mov ebp, dword [esp + edx + 4]
xor edx, 0x941a748f
lea ebp, [ecx + ebp - 4]
xadd dword [esp + ecx*2], edx
lea ecx, [edx + ecx*2 - 0x56737b5e]
bswap ecx
adc edx, dword [edx + ebp]
shr ecx, 0x26
call fcn.013561aa
mov edi, 0xf4a4c99b
rol edi, 0xae
dec ebp
lea edi, [edi + edi*2 - 0x64cdfa56]
inc esp
movzx edx, di
inc esi
mov edx, dword [edi + edi - 0x3266fd29]
movzx ebx, di
inc esp
movsx eax, di
inc esp
xor edx, esi
sal bl, 0xa3
inc ecx
or edi, eax
inc esp
movsx esi, bl
inc ecx
ror edx, 1
inc edi
lea edx, [edx + eax - 0x2569fc03]
dec esi
lea ebx, [esi*2 - 0x3147a26d]
inc ecx
xor edx, 0x18bbabbc
inc ebp
movsx ecx, al
dec eax
add edi, ebx
dec ecx
lea ebp, [ebx + edi - 0x6c74d5]
inc esi
lea edx, [ebx + edx + 0x6218d0e5]
inc ecx
ror edx, 1
movsx eax, bx
inc ecx
sar esi, 0xc6
jne 0x1324ee2
lea edx, [ecx*2 - 0x30c1414e]
mov edx, dword [edx + ebp - 0x34a18fce]
xor edx, ebx
mov eax, ecx
push eax
shr word [esp], 4
bswap edx
sub edx, 0x48360ba2
push ecx
sub byte [esp + 2], 0x96
sbb dword [esp + 2], ecx
neg edx
rol edx, 2
call fcn.013552a5
mov dword [esp + edx - 0x731c6a6], edx
xor bl, cl
rol dword [esp + edx - 0x731c69f], 0x52
lea ecx, [esp + ecx + 0x10]
pop eax
add eax, 0xfe4b
jmp eax
inc ecx
xor edx, 0xd08169ba
inc ecx
not edx
inc ecx
xor eax, ecx
inc eax
add bh, bl
inc ecx
seto cl
push esi
inc eax
sal ch, 0xe6
inc esp
xor dword [esp + ebx*2 - 0x1fa90], edx
inc cx
not ebx
pop esi
inc cx
add ebx, eax
inc ecx
xchg ebx, eax
inc eax
xor bh, 0x9b
dec ebp
arpl dx, dx
dec ebp
adc esp, edx
dec ax
inc ebp
movzx edx, dh
dec edx
mov ebx, dword [ebx + ebp - 0xfa71]
inc ecx
sub edx, 0x1d189627
push ebp
dec edi
mov ebx, dword [ebp + esi + 7]
inc edx
ror dword [esp + esi + 3], 0x72
inc edx
inc byte [esp + esi + 2]
jae 0x1794057
mov ecx, 0xb2b1688e
sub ebp, 4
jmp 0x131880c
inc ebx
mov cl, byte [esi + ebp + 0xf]
je 0x13db664
movsx edx, bp
inc cx
and esi, 0x8d4f2a30
insb byte es:[edi], dx
or cl, byte cs:[eax - 0x3f]
ror byte [edx + 0x4c], 0xf
lodsd eax, dword [esi]
fild dword [edx - 0x3f]
je 0x17940b0
add dh, byte [edx + 0x42]
movsx ecx, byte [esp + esi*2 + 1]
dec ebx
mov dword [esi + ebp], ebx
inc esi
movsx ebx, byte [esp + esi*8]
dec esi
mov dword [esp + esi*2], esp
ret
add al, 0xff
enter 0x6ef1, 0x34
mov ebp, ecx
inc eax
outsb dx, byte [esi]
or al, al
mov bl, 0xcb
jge 0x17940e3
out dx, al
invalid
sub dword [esp], ebx
sub bl, byte [0x6f0210ef]
add eax, dword [ecx]
retf 0xd11a
Function at 0x1264fb9
Capabilities:
Authenticate hmac

Disassembly:
inc esp
movsx ecx, bh
dec eax
mov dword [esp], ecx
inc ecx
xor eax, 0x3a9a1dab
shr dword [esp + 3], 0xb3
sbb word [esp + 6], 0x7c84
inc ecx
not eax
inc ecx
inc eax
sar edx, 0x7b
jb 0x13974ec
inc ecx
rol eax, 3
inc ecx
xor eax, 0x4cae6e1b
sar word [esp + 1], 0xa1
pop ebx
inc ecx
mov eax, ecx
inc ecx
dec eax
movsx ebp, bx
dec eax
lea edi, [edx*2 - 0x59c38ace]
push esi
movsx esi, dl
inc esp
xor dword [esp + ebp - 0x1b6a], eax
inc esp
mov ebx, eax
sar edx, 0xee
inc sp
or ecx, esi
pop esi
shr cx, cl
dec ebp
arpl ax, ax
dec ebp
add esp, eax
dec ebp
lea edi, [edi + ebp*8 - 0xdb54]
inc cx
inc ecx
jp 0x13a4890
movzx ebp, cx
dec esp
add esp, edi
xchg edx, ecx
inc ecx
not dl
jmp fcn.013b19ed

Function at 0x1267ac3
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
rol dx, 0x2e
mov dword [esp], edx
lea eax, [esp + eax + 8]
pop edx
xadd dword [esp], edx
jl 0x1396116
mov dword [eax], ecx
shr dword [esp], 0xe
sar dword [esp], 0x4f
ror dl, 0xa6
pop edx
jmp esi

Function at 0x1310e95
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [esp + edx*2 + 4]
push edx
lea ebp, [edx + ebp - 0xa]
pop edx
mov dword [esp + edx + 2], edx
mov ecx, dword [ebp + edx*2 - 0xc]
jne 0x133916b
mov dword [esp + edx - 0x6ba5822c], 0x9d3184a0
mov ebp, dword [ebp + edx - 0x6ba58230]
or dl, byte [esp + edx - 0x6ba5822b]
movzx edi, dl
mov dword [ebp + edi - 0xac], eax
push edi
lea edi, [edx + edi*4 - 0x2f534f47]
mov edi, ebp
jne 0x131e560
not ax
movsx edx, cx
not edx
mov word [edi], ax
jmp esi
lea esi, [edx*4 - 0x74ecf270]
mov ebx, dword [esp + edx - 0x6ba582a4]
ror word [esp + esi - 0x39a9183c], 0xc5
mov ecx, esi
shr edx, 0x3c
mov esi, dword [esp + edx + 6]
jnp 0x179529f
jb 0x12384f0
ror dx, 0xaf
call fcn.01319ad5

Function at 0x131443f
Capabilities:
Encode data using xor

Disassembly:
inc ecx
not eax
sal cx, cl
inc ecx
pop ebx
dec cl
push esi
inc esp
xor dword [esp + ecx - 0x33ee9c9f], eax
pop esi
inc ebp
mov edx, esi
dec ebp
arpl ax, ax
dec eax
lea ebp, [ecx + ebx - 0x59cbaf4d]
dec ebp
add esp, eax
inc eax
and ch, 0x3c
dec ebp
mov eax, dword [ebp + ebx - 0x20bb]
dec eax
lea edi, [ebp*8 + 0x3d02538d]
dec ebp
mov edx, dword [ebp + ecx*2 - 0x67dd3936]
inc ecx
mov cl, byte [ebp + ecx - 0x33ee9c8f]
call fcn.0125eff8
add byte [esi + 0x33ad03d0], dh
xchg ebp, eax
invalid
Function at 0x131c952
Capabilities:
Authenticate hmac

Disassembly:
inc ebx
mov eax, dword [ebp + eax*2 - 0x67f8]
inc eax
seta bh
call fcn.013dc20e
mov eax, 0x6c3ab3b7
adc eax, ecx
xor edx, ebx
shr ecx, cl
jp 0x13a6a7d
test byte [ebp + 8], al
cwde
invalid
cmp eax, 0xaa09d84d
sbb al, ah
add ebx, dword [ecx - 0x42]
ror al, 1
push 0xd0be594b
test al, 0xa4
dec edi
pop ecx
mov esi, 0x1f388cd0
pop ecx
mov esi, 0x27f83cd0
pop ecx
mov esi, 0x2d7664d0
shl dword [ecx], 1
mov dh, 0x20
and al, byte [ebx + eax*8 - 0x6766079c]
arpl word [ebp + 0x4c3f0dc], bp
fisub dword [ebp - 0x7f37b2ce]
mov es, word [ebx - 0x6e57772c]
inc edx
out dx, eax
mov byte [ebp - 0x10bd6e44], cl
mov bh, al
loopne 0x126faa2
inc edx
out dx, eax
invalid
dec ebp
mov esi, dword [ebp + edx - 0x80]
dec edx
lea edx, [edx + edx*4 + 0x103cca22]
dec edx
mov dword [esp + eax - 0x3400], 0x630db9a
jge 0x126faa0
pop esi
neg ebx
call fcn.0135f0c7
sal dword [esp + ecx*8 - 0x2f8], 0x75
bswap edx
bswap eax
lea edx, [edx + ecx*4 - 0x5db34327]
not edx
rol edx, 1
add ecx, 0xe91231ad
not ecx
xor dword [esp + eax - 0x4f4e299c], ecx
xor ebx, edx
xor cl, cl
adc esi, edx
mov dword [esp + ecx*2 - 0x2ddb9a00], esi
ret
Function at 0x132b9d7
Capabilities:
Encode data using xor

Disassembly:
ror ebx, 2
dec esp
lea esi, [edi*8 - 0x3ede284e]
dec edx
mov dword [esp + ecx - 0x4a3a280b], 0xb0aac107
lea ebx, [edi + ebx + 0x493183eb]
call fcn.0122ff62
fcmovnb st(0), st(3)
pop ebp
xchg edx, eax
lodsd eax, dword [esi]
inc esi
mov cs, word [ecx + 0x42d725dc]
pop edx
test esp, ebx
and eax, 0xdd32c6d7
fsub qword [0xa97ef6d7]
fsub qword [0x89c2c2d7]
fsub qword [0xb3e6cad7]
push esp
mov bl, 0x54
mov edx, 0x1fa7beb1
les edx, [edx + 0x4a]
and eax, 0x2b5dba9f
xor al, 0xe4
xchg ecx, eax
out 0x58, eax
dec eax
wait
jne 0x132ba59
cmpsb byte [esi], byte es:[edi]
push edx
js 0x132ba7f
cmp al, 0xe
xlatb
or byte [ebx - 0x139ccd4f], bl
rcr dword [edx - 0x331a727d], 0xd0
push esi
out dx, eax
int1
rcl al, 0x56
out dx, eax
loopne 0x132ba1f
invalid
push esi
out dx, eax
aad 0x90
mov ah, 0xd0
push esi
out dx, eax
sahf
mov dl, byte [ebp - 0x7161feb8]
sbb eax, 0x2c0dfef2
sbb cl, bh
invalid
pop eax
shl byte [edx + 0x11], cl
cmp eax, 0xcf05679b
dec ebp
movsd dword es:[edi], dword [esi]
dec edi
push gs
xor dl, ch
pop esp
jbe 0x132bb06
aam 0xe8
sub al, 0x48
sub ebp, ecx
aaa
loope 0x132bacb
mov ch, 0x79
mov esp, dword [edx + 0x222b981c]
mov ecx, 0x7c94c90a
sbb eax, esp
out 0xd5, eax
leave
leave
cmpsb byte [esi], byte es:[edi]
push 0x36b7601d
cwde
insb byte es:[edi], dx
xchg esp, eax
stosd dword es:[edi], eax
sub eax, 0x6909014
and ebx, dword [eax]
rcl byte [esi - 0x11]
push ss
sub al, dl
push esi
out dx, eax
push edi
js 0x132bb10
inc esp
rcl byte [esi - 0x11]
imul edi, dword [0xef56d01c], 0x27
xchg ebp, eax
dec eax
add dword [eax], edi
pop ecx
sub eax, 0x87665a1d
add eax, 0x25111867
sub dl, dl
bound ebx, qword [ebp + 0x35]
sub dl, dl
sub dl, dl
bound edx, qword [0xd2285245]
bound esi, qword [ecx + 0x679b4d86]
dec ebp
pop edi
cmp eax, 0xd8914fa5
xor dl, ch
jno 0x132baed
invalid
xor eax, 0x4415906a
lodsb al, byte [esi]
push cs
stosb byte es:[edi], al
std
cmp eax, 0x1d32b19a
test eax, eax
lcall 0x56d1, 0x9dadaf83
out dx, eax
call 0x580454ea
out dx, eax
cmpsd dword [esi], dword es:[edi]
xchg edx, eax
lodsd eax, dword [esi]
rcl dword [esi - 0x11]
shl dh, cl
fst st(1)
push esi
out dx, eax
retf

Function at 0x133455f
Capabilities:
Authenticate hmac

Disassembly:
inc edx
mov ebp, dword [edx + edi - 0x23b57531]
xor ebp, esi
inc ebp
sub bl, dh
ror ebp, 3
movsx ebx, byte [esp + edx - 0x23b5751d]
dec ecx
add ebx, eax
dec ebp
dec eax
mov dword [esp + edx*2 - 0x476aea62], 0xae2fb581
xor ebp, 0x1337271f
dec esp
or dword [esp + edx - 0x23b57521], esi
inc bp
cmovne eax, esi
ror ebp, 3
inc edx
not byte [esp + esi - 0x23b57570]
inc esp
xadd dl, dh
dec ebp
neg ebp
not byte [esp + edx - 0x23b57592]
pop eax
pop ecx
dec eax
mov dword [esp + edx*2 - 0x476aeb4c], esi
inc ecx
or bl, 0xac
inc ecx
adc al, 0x23
inc esp
and bl, dl
inc edx
xor dword [esp + ebx*2 - 0x476aeb4c], ebp
movzx ecx, dl
dec esi
lea edx, [ecx*8 + 0x2f86790c]
jmp 0x131c971
Function at 0x1336d17
Capabilities:
Encode data using xor

Disassembly:
or dl, byte [edx - 0xd7ec1d4]
stosd dword es:[edi], eax
repne stosd dword es:[edi], eax
aam 4
lahf
pop eax
pop edx
pop eax
pop ecx
pop ecx
pop eax
jb fcn.013148ee
in al, dx
xchg ecx, eax
rcl byte ds:[ebx], cl
or dword [ecx], esi
dec esi
mov edx, edx
adc ebx, ecx
push ecx
push ds
mov edx, edx
adc edi, dword [ecx - 0x2d740937]
adc esp, dword [ecx + 0x29]
push ds
mov edx, edx
adc ebx, dword [ecx - 0x2d74b157]
adc ebx, dword [ecx]
inc ecx
inc esi
mov edx, edx
adc edx, ecx
jns 0x1336d6d
mov edx, edx
adc ecx, dword [ecx - 0x2d7479ef]
adc edx, ecx
test eax, 0x13d28788
shr dword [ecx + 0x13d28788], 1
push esp
jp 0x1336dd0
jo 0x1336d80
in al, dx
fistp qword [ecx]
sub byte [edi - 0x795d3e1b], dl
jnp 0x1336d8a
sbb al, 0x3a
sbb al, 0x78
cmp bl, byte [eax + edi*2]
jecxz 0x1336d6c
je 0x1336d06
loop 0x1336d0b
push ecx
in ax, 0xc5
push cs
inc edx
invalid
mov al, byte [ecx + ebp*2]
cmp dword [edi + 0x76], ecx
mov cl, 0x9c
jle 0x1336d58
stosd dword es:[edi], eax
call 0xf7da8a43
mov bl, 0xe8
mov bl, 0x1c
pop esi
xlatb
and ebp, eax
mov bl, 0x1c
scasb al, byte es:[edi]
pop es
mov bl, 0xe8
mov bl, 0x1c
mov bh, 0xd6
push ebx
call 0x40098a5b
imul ebp, eax, 0xffffffb3
sbb al, 0x4f
xchg byte [ebx - 0x58e34c18], dl
push ds
imul ebp, eax, 0xffffffb3
sbb al, 0xb6
pop ss
test ah, al
or ebp, edi
lea edx, [edx]
cmc
fmul qword [eax]
cwde
stosd dword es:[edi], eax
xchg ebx, eax
inc edx
cmpsb byte [esi], byte es:[edi]
pushal
mov al, byte [0xa64293b3]
push eax
jl 0x1336d78
cmpsd dword [esi], dword es:[edi]
xchg ebx, eax
inc edx
cmpsb byte [esi], byte es:[edi]
les edx, [eax - 0x59bd6c4d]
jo 0x1336e48
wait
xchg ebx, eax
inc edx
cmpsb byte [esi], byte es:[edi]
ror dh, 1
xchg ebp, eax
sbb ebx, ebp
rcr byte [eax - 0x1b4a8718], 0xae
inc ebx
out dx, al
scasd eax, dword es:[edi]
sbb ah, byte [edi]
dec eax
out 0x3b, eax
dec edi
mov al, 0x32
add eax, 0x839b159b
mov cl, 0xf8
fild word [edi + edx*2]
out dx, eax
mov cl, 0xb6
add dword [edi + edx*2], 0xffffffef
mov bh, 0x94
scasd eax, dword es:[edi]
add al, 0x57
out dx, eax
mov byte [0x5704d7f4], al
out dx, eax
out 0xf5, al
inc ecx
dec ecx
add dword [edi], edi
and esp, dword [edx]
repne stosd dword es:[edi], eax
xchg byte [esi + 0x3d], dh
mov dword [0xd6c6d145], eax
salc
xor dword [ebx + 0x6ef2d145], esp
jno 0x1336dd1
inc ebp
rcl dword [edx]
dec byte [ecx]
mov dword [0xf2f2d145], eax
sbb eax, 0x36d145a3
adc eax, 0xb7da2b47
dec edx
fdivr dword [edi - 0x3e]
sub byte [esi - 0x5d2366bc], bl
cmpsb byte [esi], byte es:[edi]
jo 0x1336e25
inc esp
cdq
fsub qword [edx + 0x13d670a6]
dec edi
mov al, 0x32
insb byte es:[edi], dx
out 0x15, eax
adc ecx, dword [edi - 0x50]
xor ch, byte [edi + 0x15]
wait
or eax, 0xfffffff7
retf

Function at 0x134e804
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 8], 0xb342ed0f
lea esp, [esp + 8]
call fcn.0135236e
Function at 0x135128b
Capabilities:
Authenticate hmac
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec ebp
lea edi, [edi + edi - 0x3c000004]
inc esi
mov ebx, dword [edi + edi - 0x3c000000]
add ebx, dword [esp + ebp*2 - 0x1d2]
inc esp
mov edx, ebp
inc esp
xor ebx, esi
inc ebp
movzx ecx, dx
neg dword [esp + edi - 0x3bffffed]
jno 0x17a6092

Function at 0x13570f4
Capabilities:
Encode data using xor

Disassembly:
call fcn.013694ce
clc
and eax, dword [ecx]
add al, bh
or dword [edx + 0x1aa603c1], ebp
mov eax, 0x44f1af80
xor byte [ecx + ecx*2], ch
aaa
mov ebx, 0x2d82b33
salc
sar ebx, 0x3f
les eax, [edx]
salc
rol dword [edi - 0x3b6098c0], 0x8b
in eax, dx
loopne 0x13570f6
out dx, eax
std
push eax
fild word [eax]
jmp 0x54eb430f

Function at 0x13591dc
Capabilities:
Encode data using base64

Disassembly:
inc eax
call fcn.0122b31e
rol byte [ebx + ebp*4], cl
xor esp, ebx
inc dword [eax]
arpl word [ebx + 0xcfb3b49], dx
arpl word [ebx + 0x242ff749], dx
arpl word [ebx - 0x42c2f8b7], dx
sub al, ah
in al, 0x5d
xor dword [ebx + esi*2 + 0x57b52ed5], edx
aam 0xec
inc ecx
push ds
dec eax
invalid
push ecx
mov word [edi], dx
sbb ebp, 4
mov eax, dword [ebp]
push ecx
xor eax, ebx
neg ecx
jns 0x125c303

Function at 0x137239d
Capabilities:
Encode data using xor

Disassembly:
mov word [ecx + 0x53], cs
out dx, eax
xor ebp, 0xef5349dc
aam 0xca
or al, 0x4d
add esi, ebx
pop ss
sub ebx, dword [0xb529ee32]
popal
sbb ch, bh
xor esi, edx
rcl edi, 0x62
xor eax, 0xd7c192a1
bound ebx, qword [ecx - 0x5f]
scasb al, byte es:[edi]
rcl edi, 0x62
rcl edi, 0x62
pop ecx
mov eax, dword [0x62d7c1ae]
insd dword es:[edi], dx
bound esp, qword [esi + ebx*4 - 0x2b7c8699]
mov al, byte [0x31dacb4f]
aad 0xb5
test dh, dl
inc edi
xchg ecx, eax
dec eax
mov word [edx + 0x63d83de9], ds
jle 0x1372317
retf 0x5ac9
call fcn.01271c98
jns 0x1372339
and al, 0xeb
push ecx
sar al, 0xeb
movsd dword es:[edi], dword [esi]
pop esp
sub eax, eax
mov al, 0x93
movsd dword es:[edi], dword [esi]
pop esp
sub edx, dword [eax - 0x3c]
out dx, eax
movsd dword es:[edi], dword [esi]
pop esp
sub esp, dword [esp + esi*4]
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
pop esp
sub eax, dword [esp + edx*8 - 9]
movsd dword es:[edi], dword [esi]
pop esp
sub ecx, dword [ebx + eax*4]
lds ebp, [0xdec84dc3]
cmp byte [eax - 0xe1ca085], al
mov al, 0x98
add al, 0xfe
sahf
pop ss
fldl2t
inc edi
imul esi, esp, 0xffffffa3
loope 0x13723a7
push ebx
mov ecx, 0xb3b5aadc
and eax, 0xc74cda39
sub dword [edi], esp
loopne 0x13723ec
invalid
pop ss
adc al, 0x25
and eax, 0x3200ad16
or eax, 0x14ad1625
pop eax
imul ebp, dword [edx], 0xffffffb4
int3