joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1312fc3
Capabilities:
Encode data using xor

Disassembly:
not al
rol edx, 2
mov dword [esp], ecx
dec esp
and al, 0
xor ebx, edx
add esi, edx
rdtsc
dec dword [esp]
jl 0x1372fbb
xchg edx, eax
scasb al, byte es:[edi]
xchg byte [ebp + 0xc], bl
mov ch, byte [eax + ebp + 0x79]
and al, 0xaa
out dx, eax
jae 0x1312fc9
insd dword es:[edi], dx
fstp dword [ebx + 0x62]
cld
add ah, ah
xor edi, edx
lodsb al, byte [esi]
dec edx
mov bl, 0xf6
sub dword [edx], ebx
mov esi, 0xc919ddd6
xor al, 0x78
sub esi, dword [eax + 0x49]
mov ebp, 0xe38154c0
jb 0x131303a
hlt
fst dword [eax]
push ds
inc esp
push es
inc ebx
pop edi
retf
sub edi, 8
imul ecx, dword [esp]
xor word [esp], 0x879c
neg dword [esp]
mov dword [edi + 4], eax
btr cx, cx
mov eax, dword [esp]
mov dword [edi + eax - 0x455b24ba], edx
cdq
rol ecx, cl
pop edx
jb fcn.0250d21a
mov eax, 0xa0bbe080
movsx ecx, ax
movzx edx, ax
lea ebp, [edx + ebp - 0xe084]
mov ecx, dword [ebp + edx*2 - 0x1c100]
shr eax, 0x6c
btr ax, ax
btr eax, 0xac
xor ecx, ebx
xor ecx, 0x828f4caa
sub ecx, 0xefae4432
btr eax, eax
setae dl
push eax
rol ecx, 3
btc ax, dx
lea eax, [eax*8 - 0x29d4d746]
lea ecx, [ecx + edx*4 - 0x5aa30f26]
not dword [esp + edx*2 - 0x1c002]
rol ecx, 1
imul dword [esp + edx - 0xe001]
bswap ecx
add ax, 0x429a
add word [esp + edx - 0x1a112], dx
xor ebx, ecx
add esi, ecx
xor dword [esp + edx*2 - 0x34228], eax
add byte [esp + edx - 0x1a111], 0xa1
mov dx, word [edi + edx - 0x1a114]
mov ecx, eax
or ecx, dword [esp + eax - 0x690937b4]
mov cl, byte [edi + eax - 0x690937b2]
dec eax
adc eax, dword [esp + eax - 0x690937b3]
adc edi, 2
and word [esp + 1], ax
or word [esp + 1], ax
lea eax, [eax*2 - 0x65c1066d]
shr dx, cl
neg ax
pop ecx
add ax, cx
mov word [edi + eax - 0x3e52b812], dx
jmp esi
Function at 0x13180f5
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov dword [esp + 4], 0x66ff938d
lea esp, [esp + 4]
call fcn.01a5f946
shl cl, 0x61
lea ecx, [edx + ecx*2 - 0x4a76f477]
lea eax, [eax + edx*8 - 0x792e0c92]
or dx, cx
bswap eax
and edx, 0xd867a8b
adc dl, ch
jnp 0x1adbf35
mov ecx, dword [edx]
jl 0x131812b
rcl byte [ecx - 0x56], cl
jnp 0x131815d
stc
fstp qword [ecx + 0x6b]
xor ebp, dword [esi + 0x132db89a]
or bh, byte [edi]
mov dl, 7
jae 0x1318126
cmc
shr byte [eax], 1
pop ebp
fnstenv [esi - 0x23]
cmpsd dword [esi], dword es:[edi]
lcall 0x6dfb, 0x2fc51d90
imul esp, dword [ecx - 0x239bc22], 0xffffffa0
sbb byte [eax + edx*8 + 0x14], dh
sahf
pushal
mov al, 0xc3
push ss
movsb byte es:[edi], byte [esi]
push edx
cdq
and eax, 0x84e25b93
cmp al, 0x57
pop edx
je 0x13181cc
pop ecx
lds ebp, [ebx + 0x5f4ab50e]
cmp al, 0xa
jmp 0xaa2ac557
jg 0x1318241
mov edi, 0x71911b9e
faddp st(2)
salc
sahf
or dl, byte [esi]
push esi
cmp al, 0xfa
fiadd word [edx - 0x68]
cli
sbb bl, byte [esi + 0x6f]
repe cmpsb byte [esi], byte es:[edi]
call 0xe130204f
sbb byte [esi - 8], 0x87
test ebx, ebp
dec edi
loop 0x13181fb
sbb eax, dword [edx]
inc esi
pop eax
imul eax, dword [ebx + 0x376ac74c], 0x8b7a8a58
imul eax, dword [ebx + 0x376ac74c], 0x8b7a8a58
xchg dword [ebp + 0x3155c80], esi
push esp
inc ebx
adc cl, byte [ecx + 0x44]
std
cmp dword [ebp - 0x25c1997b], esp
add byte [ebp - 0x74], dl
lodsb al, byte [esi]
jge 0x1318233
sub al, 6
pop ebp
sahf
fsubr st(3)
inc edi
les eax, [esi + 0x683a4c3a]
sub byte [ebp + 0x7a5804e5], ah
pop es
cdq
add al, 0x88
inc ecx
into
imul edi, dword [esi], 0x46de54fb
cmp bl, byte fs:[bx + di]
cmp bl, byte [ecx]
pop esp
mov cl, cl
int1
inc esi
or cl, dl
out dx, eax
retf 0x2ab
sbb eax, 0xe7b84025
inc edx
not cl
not eax
xor dl, dh
shr cx, 0x49
xor ebx, eax
shl dl, 0x65
adc esi, eax
push edx
mov dword [esp + edx*2 - 0x15c0], esi
ret
Function at 0x131d2c4
Capabilities:
Execute syscall

Disassembly:
add edi, eax
xadd ecx, edx
mov edx, dword [esi + ecx - 0x484ffff]
pop eax
mov ecx, dword [esi + ecx - 0x484fffb]
dec eax
bts ax, 0x9e
sal ax, 0x41
adc esi, 7
shr ax, 0xae
sar al, 0xa7
mov dword fs:[edx], ecx
mov edx, eax
jmp edi
btr ecx, 0x15
pop edx
pop edx
pop edx
jae fcn.0136a196
mov ecx, 0x3184a22d
lea eax, [ecx + ecx*2 - 0x47cffa6d]
lea ebp, [ebp + eax - 0x4cbdec1e]
or ax, 0x650e
add al, 0xc
cwde
mov eax, dword [ecx + ebp - 0x3184a22d]
movsx edx, cl
or cx, 0xd006
sar cx, 0xed
xor eax, ebx
push edx
sub dl, dl
pop edx
bswap eax
neg eax
lea eax, [eax + ecx*4 + 0x3317dda8]
push ecx
rol eax, 3
bswap edx
sub dword [esp + ecx - 0x3184ffff], 0xb23f43af
sub byte [esp + edx - 0x2cfffffd], cl
xor ebx, eax
ror cl, 0x44
imul edx, ecx
jb 0x12de4f0
syscall
call fcn.01c27fb4
mov eax, 0xe8995bb6
movzx edx, ax
bts dx, dx
lea edi, [edi + edx*4 - 0x16fdc]
bswap eax
mov edx, dword [edi + edx*2 - 0xb7ec]
xor edx, ebx
movsx ecx, ax
not cl
sub edx, 0x45b11ca9
bswap edx
ror ecx, cl
xor edx, 0x3eadcb36
sal eax, 0xbc
push ecx
shl cl, 0x84
not edx
rol edx, 3
add eax, eax
push eax
xchg al, cl
xor ebx, edx
add ax, 0xa30c
adc esi, edx
inc ecx
sal cl, 0x81
sbb ecx, dword [esp + eax - 0xa3f8]
mov edx, dword [ebp + eax - 0xa3fc]
mov eax, dword [ebp + eax*2 - 0x147f4]
and ecx, 0x8c107687
sbb dword [esp + 1], ecx
adc ebp, 8
mov dword fs:[edx], eax
sar cx, 0x41
add ecx, 0x940272b0
sbb byte [esp + ecx - 0x2012adb1], cl
mov dword [esp + ecx - 0x2012adb1], esi
ret 4

Function at 0x13233dc
Capabilities:
Authenticate hmac

Disassembly:
sal eax, 0x64
dec edx
not al
not al
xor ebx, edx
push ecx
rol al, 0x81
add edi, edx
xor dword [esp], ecx
bt eax, 0xb9
call fcn.01b848cb
xchg byte [eax], al
xor ebx, ecx
add esi, ecx
mov dword [esp + edx - 0x24036796], 0xeeacf00d
movsx ecx, byte [esp + edx - 0x24036792]
shl dword [esp + edx - 0x24036795], 0xad
mov bp, word [ebp + edx - 0x24036796]
cdq
sal edx, cl
add dl, byte [esp + edx*2 + 3]
pop ecx
pop eax
jle fcn.01b51770
sar edx, 0xed
neg dl
lea ebp, [edx + ebp + 2]
jae 0x1c05d5e
jp 0x132345a
jge 0x13233bf
jbe 0x13233da
push 0x15
and edi, dword [edx + ecx]
inc esi
xor al, 0x36
int3
lds ebp, [edi - 0x70]
aad 0x39
wait
dec eax
loopne 0x1323489
push 0x5b0fd49
mov al, 5
mov bh, 0x56
add eax, dword [esi]
int1
jbe 0x132343d
add eax, 0x5bd49886
pop edx
push ebp
mov ebp, 0xce48eacd
xchg ebx, eax
add al, byte [0x20cc9ee8]
push esi
dec esp
push ebp
jnp 0x1323431
invalid
inc edx
xor esp, ebp
and al, byte [esi + ecx*4]
xchg dword [ebx], edx
cmp edx, dword [edx + 0x53218c35]
retf 0x4a7b
sal edx, 0x27
xor dx, dx
adc al, cl
movsx ecx, dx
btr ecx, 0xb7
mov word [ecx + ebp], ax
bt ecx, ecx
xadd dl, dh
movzx eax, cl
add edx, dword [esi + ecx*2]
lea esi, [esi + ecx*4 + 4]
sub cx, ax
imul ecx, ecx
xor edx, ebx
bswap eax
bts ecx, 0x16
dec edx
xadd al, ch
ror edx, 3
not cl
ror eax, cl
adc ax, 0xef2c
bswap edx
or eax, eax
bts cx, cx
xor edx, 0xe617840f
btr ax, ax
btr eax, ecx
xor ebx, edx
sar ecx, cl
sub cx, ax
xadd cl, ah
add edi, edx
jmp edi
Function at 0x1328dc0
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx*4], 0xc8104f0b
pop eax
sub cl, 0xba
sal edx, 0x71
sbb edx, eax
xor eax, edx
ror cl, 1
cdq
imul ax, ax
btc eax, edx
sbb cl, 9
mul edx
and al, dl
shr ax, 0xa6
xor bl, cl
sal ax, 0x41
xor eax, 0xcb83739
adc dl, ah
adc ecx, esp
inc eax
sub ax, ax
je 0x1b193b0
mov dl, byte [ecx + edx - 0x7fff0033]
sbb ebp, 2
mov word [ebp], dx
cwde
jmp fcn.01b51770

Function at 0x13353d8
Capabilities:
Encode data using xor

Disassembly:
or dx, cx
mov ecx, eax
mov word [edi + eax*4], dx
push eax
push ecx
mov edx, eax
lea ebp, [ebp + eax*8 - 4]
or edx, dword [esp + eax*4 + 0x10]
rol eax, 0x46
add eax, dword [ebp + eax]
rol dx, 0xe1
rol dl, 0x85
push ecx
xor eax, ebx
btr ecx, ecx
xor edx, ecx
or edx, edx
lea eax, [eax + ecx*4 + 0x2c20b718]
setl dl
neg eax
sal edx, 0x6e
add edx, edx
lea eax, [eax + ecx*8 - 0x5b138204]
pop ecx
bswap eax
dec edx
call fcn.01b51edd

Function at 0x1346be7
Capabilities:
Encode data using base64

Disassembly:
xor al, 0x8b
neg ecx
xor ebx, ecx
imul eax
adc edi, ecx
bt ax, dx
sub dword [esp + eax - 0x22260], eax
js 0x19cad71
pop edx
pop ecx
js fcn.0136a196

Function at 0x134f765
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not ecx
movsx edx, word [esp + eax - 0x76ec8eb6]
ror ecx, 3
bswap edx
xor ecx, 0xe817c527
add edx, edx
call fcn.0250473b
Function at 0x13675e6
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + ecx - 0x3e610000], edx
dec eax
imul edx, dword [esp + ecx - 0x3e60fffc]
imul edx, edx
xor ebx, eax
sar word [esp + ecx - 0x3e60fffa], 0x6c
adc dword [esp + ecx - 0x3e60fffc], edx
add edi, eax
mov ebp, dword [ebp + ecx*2 - 0x7cc20000]
shl cx, 0x8c
dec dx
pop ecx
pop ecx
js fcn.0251841a
mov eax, 0xef8d8a0e
lea edx, [eax + 0x7221f0bf]
mov ecx, dword [esi + edx - 0x61af7acd]
push eax
lea esi, [esi + edx - 0x61af7ac9]
Function at 0x13a402b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
add dword [esp + 4], 0xfe5248cd
mov dword [esp + 4], 0x415104ea
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.01ac9348

Function at 0x1920e3c
Capabilities:
Authenticate hmac

Disassembly:
not edx
xor ebx, edx
mov dword [esp + ecx - 0x54b463a0], 0xa91777a4
bswap eax
add esi, edx
movzx edx, byte [ecx + edi - 0x54b463a0]
sar eax, 0xfb
xchg dword [esp + ecx - 0x54b4639c], ecx
call fcn.01b44460

Function at 0x1920e8c
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + eax - 0xc840], eax
sal edx, 2
sal eax, 0x5d
add eax, ebp
and dword [esp], 0x41979b3c
jp 0x253b016
mov edx, 0xcd187e29
sar dl, 7
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov ecx, 0x95b6d68f
adc edi, 8
xor ecx, 0xcda47891
neg ecx
xor ecx, ecx
mov dword [eax + ecx*4], edx
sbb ecx, 0x32b7548b
btc cx, cx
movsx eax, cl
lea esi, [esi + eax*4 - 0x158]
jae 0x194d179
mov edx, dword [esi + eax*2 - 0xaa]
xor edx, ebx
btc ecx, 0x8b
not edx
ror cl, 0x23
rol edx, 1
btc eax, eax
bt eax, 0x25
shr cl, 0xc1
neg edx
bswap ecx
dec ecx
jp 0x1c278f0
invalid
call fcn.012d5d31
push 0xe89b3c98
add esi, 6
ror dword [esp], 0xc1
and word [esp + 2], 0xb1b3
shrd edx, eax, cl
mov eax, dword [esp]
mov dword [esi + eax*2 - 0x60033c98], edx
add word [esp + eax - 0x30019e4c], 0xf5b6
movzx ecx, ax
ror ax, 0xc
lea ebp, [ebp + ecx*2 - 0x13c9c]
cbw
mov edx, dword [eax + ebp - 0x3001ffc9]
shr dword [esp + eax - 0x3001ffc9], cl
xor edx, ebx
neg edx
sub dword [esp + ecx*8 - 0x4f260], eax
mov word [esp + eax - 0x3001ffc8], ax
setne cl
rol edx, cl
sub edx, 0xf106d390
inc eax
add eax, eax
rol edx, 3
bts ax, 0x32
jae 0x1d1555c
xor edx, 0x2c38cd9c
not ax
rol ax, cl
bswap ecx
xor ebx, edx
sub cl, 0x1d
and ecx, 0x152bde02
adc edi, edx
sal al, cl
shl al, cl
mov dword [esp + eax - 0x60030060], edi
ret
Function at 0x1930b71
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sal ecx, 0xea
lea ebp, [ebp + edx*2 - 0x5a]
mov ecx, dword [edx + ebp - 0x2b]
xor ecx, ebx
rol ecx, 1
not ecx
lea eax, [edx*2 + 0x588d23ab]
xor eax, eax
adc ecx, 0x9a35d13a
shl dword [esp + edx - 0x2b], 0x7e
rol ecx, 3
sar eax, 0x6e
adc ecx, 0xb9014e32
xor ebx, ecx
call fcn.019b5afe
lea ecx, [eax - 0x42cd2ded]
xor edx, 0x5a924d29
rol eax, cl
add al, ch
push ecx
neg edx
bswap edx
push ecx
dec edx
neg cx
jne 0x1b0f950
shr edx, 0xb6
ror edx, 0x90
xor ebx, ecx
movzx eax, dl
lea eax, [eax + edx*4 - 0x2e412acb]
idiv eax
add esi, ecx
movsx ecx, dl
jmp esi
sub edx, 0x87482892
dec esp
and al, 4
btr edx, ecx
ror eax, 1
pop ecx
xadd dl, dh
jge 0x1bdb1af
cmpsb byte [esi], byte es:[edi]
sub al, byte [eax]
mov edx, dword [esi]
mov ecx, 0x7c2e572b
push ecx
mov eax, dword [edx + ecx - 0x7c2e572b]
movsx edx, cl
sub ecx, 0xa0bcf32
mov dword [esi + edx*2 - 0x56], eax
jne 0x192e4ec
and ecx, dword [esp + ecx - 0xa]
xor eax, 0x10ad9da4
rol edx, 1
ret 0x95e8
call fcn.01929106
call fcn.01c3d461
mov ch, 0xea
js 0x1930b27
loopne 0x1930b3c
ror byte [edx + 0x76d7a54c], 1
popfd
pop ebx
or bl, byte [0x9e5a548b]
sahf
mov byte [ebx + eax*2 - 0x6172c5a6], bl
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
dec ebx
jge 0x1930b6c
pop eax
mov esi, 0xaa1b129e
pop eax
out 0x4e, eax
int1
movsd dword es:[edi], dword [esi]
mov al, 0xbc
rcr al, cl
dec esp
movsb byte es:[edi], byte [esi]
xchg edx, eax
rcl byte [edx + 0x22], cl
and byte [edx + 0x62aeebb8], ch
lea edi, [eax + 0x3a]
je 0x1930b6b
lodsd eax, dword [esi]
fiadd word [esi + 0x4d]
invalid
btr ax, ax
xor dword [esp + eax - 0x108ffe4f], 0x803717b8
bswap edx
xor ebx, edx
ror cl, 0xe5
add edi, edx
mov edx, 0x7f93843c
mov dword [esp + eax*2 - 0x211ffca4], edi
ret 4
ror dword [esp + eax - 0x108ffe50], cl
neg edx
jmp 0x1aa936c
neg eax
sub ecx, ecx
ror byte [esp + 2], 0xe2
sub cl, ch
sbb eax, 0x7cb62fa6
dec dword [esp]
sub word [esp + 1], dx
rol eax, 1
btr ecx, 0xa4
sub word [esp + 2], 0xe904
bswap eax
neg ecx
sbb edx, dword [esp]
call fcn.01d2c2e1
Function at 0x1933144
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov dword [esp + ebx - 0x6b18d916], ebx
inc edx
lea eax, [eax + ecx*2 + 0x33e160b]
inc dx
rol dword [esp + eax - 0x6b18d913], 0xed
sal di, 0x2a
inc edx
setns byte [esp + eax - 0x6b18d916]
rol eax, 3
inc bp
btc ebp, ebp
dec esi
mov dword [esp + ebx - 0x6b18d916], edx
inc ecx
adc ch, 0x9f
inc ecx
movzx ebx, cx
inc bp
imul ecx, eax
inc edx
xor dword [esp + eax - 0x6b18d916], eax
call fcn.01bcc5eb
mov ecx, 0x652e5e82
lea eax, [ecx + ecx*4 + 0x65208298]
lea esi, [esi + eax - 0x5f085b26]
btr ecx, eax
movzx edx, cl
mov eax, dword [eax + esi - 0x5f085b22]
adc edx, edx
adc cx, 0x198c
bt ecx, 0xac
xor eax, ebx
sar edx, cl
sbb dl, dh
neg eax
not cl
lea eax, [eax + edx*2 + 0x18154893]
shr edx, cl
btr cx, cx
neg cx
rol eax, 3
rol cx, 0x84
sar ecx, 0x4a
jns 0x1d578a0
rol eax, 1
xor eax, edx
imul edx, ecx
jo 0x1aee11a
ror ecx, 0x72
lea eax, [eax + edx*2 - 0x75ca2ec6]
shl ecx, 0x3f
rol eax, 3
lea eax, [eax + edx*2 - 0x56feb1ce]
xor ebx, eax
or cl, dl
adc edi, eax
lea ecx, [edx + ecx*4 - 0x14de7044]
ror ecx, 0xd0
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [edx*4 - 0x27a45f2]
movzx eax, dx
mov dword [edx + esi - 0x1d85ba0e], ecx
mov ecx, edx
sbb ecx, edx
jmp edi
bts cx, cx
mov dword [esp + ecx - 0x13fe5f4], ecx
neg al
rol edx, cl
xor bl, al
lea esi, [esi + ecx*2 - 0x27fcbf4]
mov dword [esp + ecx*4 - 0x4ff97e0], 0x8d887423
mov dword [ecx + esi - 0x13fe5f8], eax
xor cx, 0x5aae
mov eax, ecx
cwde
lea ebp, [ecx + ebp - 0x13fbf5a]
mov ecx, dword [ebp + ecx*4 - 0x4fefd58]
xor ecx, ebx
and byte [esp + 3], dh
call fcn.01bac21b
sub ebp, 4
mov edx, dword [ebp]
xor edx, ebx
mov eax, 0x89a87f25
add ax, ax
bt ax, ax
rol edx, 3
sub eax, 0x9e2fe00b
dec ax
btc eax, 0x1d
xor edx, 0x230b2baf
shr eax, 0x7f
not ax
add eax, eax
not edx
btr eax, eax
inc edx
bswap edx
sar ax, 0xeb
call fcn.01cd0c4f
sbb eax, 0x7523efe1
rol dword [edi], 0x38
or ebx, dword [ebx + 0x68aaa4db]
xor byte [edx], dh
sbb dh, byte [ebp + 0x43]
movsb byte es:[edi], byte [esi]
sub eax, 0xff13d5f5
sbb edi, dword [ecx - 0x44]
push 0xda37fcf6
push ecx
adc eax, dword [0x8744fb1b]
pop ebp
cwde
mov al, byte [0x64e6aee2]
adc eax, 0x16c73d2f
mov al, byte [0xd9e0777f]
pop esi
leave
cmp ecx, 0xffffffaa
retf 0x53f4
add ebp, 4
call fcn.01ce0a63
neg eax
add dl, dl
imul dx, cx
inc eax
ror dl, 0xe7
jb 0x1baf7a9
rol eax, 1
neg dl
shr dl, 0xa3
adc cl, 0xa0
neg eax
xor ebx, eax
call fcn.01ae7aad
mov edx, 0x6d82d33b
movzx eax, dx
movzx ecx, ax
mov eax, dword [edx + esi - 0x6d82d33b]
lea esi, [esi + edx - 0x6d82d337]
dec dl
not cx
and edx, edx
xor eax, ebx
sub ecx, ecx
add ecx, 0x40361401
bswap eax
imul cx, cx
shl dl, cl
xor eax, 0x9531bba2
rol cl, 0x41
sub dl, 0x81
not edx
sbb eax, 0xdf2c95b4
sub ecx, 0x4b383e14
rol eax, 3
inc ecx
and dx, 0xefb2
setbe cl
inc eax
not edx
rol eax, 1
call fcn.0195a684
jmp 0x1cefa29
Function at 0x19c4adf
Capabilities:
Authenticate hmac

Disassembly:
bts eax, 0x20
mov eax, dword [esi + eax*2 - 0x3a2afe7a]
call fcn.0252addf
mov edx, 0xbf1fa49e
mov ecx, edx
mov edx, dword [ebp]
imul ecx, ecx
push ecx
mov eax, dword [ecx + ebp - 0xc1ed180]
shl cx, 0xab
lea ebp, [ebp + ecx*2 - 0x183c3ffc]
push ecx
adc edx, eax
ror dword [esp + ecx*2 - 0x183c3ffc], 0xc8
mov dword [ebp + ecx*4 - 0x30788000], edx
jb 0x1d673c7
mov eax, dword [esi + ecx - 0xc1e2000]
lea edx, [ecx + ecx*4 + 0x48bdc13e]
adc cx, 0x6f86
lea esi, [esi + ecx*4 - 0x307a3e18]
xor eax, ebx
and ecx, dword [esp + ecx*2 - 0x183d1f0e]
sar cl, 0xc1
xor word [esp + ecx*8 + 5], cx
sbb eax, 0xad865d10
bswap eax
lea eax, [eax + ecx + 0x4b295d0e]
not eax
lea ecx, [ecx*2 - 0xb79e8ea]
inc eax
neg edx
btr ecx, ecx
shr ecx, 0x57
xor ebx, eax
dec edx
inc dx
or dl, dh
adc edi, eax
sal word [esp + ecx - 0x1e6], cl
not byte [esp + ecx - 0x1e2]
mov dword [esp + ecx - 0x1e9], edi
sal dword [esp + ecx*2 - 0x183c3ffe], 0x8c
jb 0x1cdd39b
Function at 0x19e3f3b
Capabilities:
Encode data using base64

Disassembly:
neg dl
sar al, 0xa4
xor bl, dl
inc al
sub cx, 0x4688
sbb ebp, 2
push ecx
push ecx
push eax
mov word [ebp], dx
mov eax, dword [esi]
xadd dword [esp + 5], ecx
sal dword [esp + ecx - 0x22a6defd], cl
lea esi, [esi + ecx*2 - 0x454dbe04]
inc dword [esp + ecx - 0x22a6df01]
movsx edx, cx
and dword [esp + ecx - 0x22a6defc], 0x4b9dca3f
xor eax, ebx
pop ecx
bswap eax
xadd dx, cx
dec eax
sal dword [esp + 3], 0x4c
bswap eax
sub dx, 0x2892
dec eax
xchg dword [esp + 4], ecx
movzx ecx, dl
movzx ebp, cx
mov esi, eax
mov dword [esp + edx*8 - 0x7c4f8940], ecx
call fcn.01d389ae
mov eax, 0xc0b60d0d
movsx edx, al
cdq
movzx edx, byte [esi]
add esi, 1
lea ecx, [eax*8 - 0x4f6588c2]
bswap ecx
xor dl, bl
sub cl, ah
sbb dl, 0xb
jmp 0x1ab1ff8
xor dl, 0x3f
inc dl
inc ecx
and al, ch
jne 0x1930ace

Function at 0x1a0431b
Capabilities:
Execute syscall

Disassembly:
shl dl, 0x41
shl eax, 0x4e
xor ebx, ecx
mul edx
add edi, ecx
or al, byte [ebp + edx*2 - 0xfbc]
or dl, dh
mov dl, byte [ebp + edx - 0x7dd]
mov ecx, 0xa815b7a1
mov dword [esp], ecx
adc ebp, 2
neg dword [esp]
sal dword [esp], 0xdb
adc al, dl
sar dword [esp], cl
jp 0x1cb14f9
movzx edx, word [esp]
mov word [ebp + edx], ax
mov dword [esp + edx*2], edi
ret

Function at 0x1a125a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [ebp + edx - 0x1084a9c3]
mov dword [ebp + edx*2 - 0x2109537e], ecx
mov dword [esp + eax*2 - 0x17e], edx
shr edx, 0xe9
pop ecx
jb fcn.01b51770
mov eax, 0x5ba316a3
bts eax, 0x17
movsx edx, al
lea ebp, [ebp + eax - 0x5ba316a7]
cbw
mov edx, dword [ebp + eax - 0x5ba3ffa3]
or eax, 0xc60cc996
movzx ecx, al
xor edx, ebx
or eax, eax
rol edx, 2
dec cx
and cx, cx
dec edx
shr ecx, cl
xor cx, ax
rol edx, 2
not edx
lea ecx, [ecx + eax*8 + 0x69bbd13b]
inc ecx
btc ax, cx
lea edx, [edx + ecx - 0x4b85d4f0]
xor ebx, edx
not cl
add edi, edx
cwde
dec ecx
lea ebp, [ecx + ebp - 0x673cce54]
xor eax, eax
xor ecx, 0x78087420
adc al, byte [ebp + eax]
xor al, bl
movzx edx, cx
shl ecx, 0xaf
jp 0x1ce837b
ror al, 1
ror ecx, 0x9b
inc cl
sal cl, 1
not al
inc edx
sar ecx, cl
and cl, dl
rol al, 1
inc al
inc edx
xor al, 0x2d
xor dl, 0x95
or ecx, 0xb627b6be
shl ecx, 0x9a
xor bl, al
rol ecx, 0xe7
call fcn.019dca64
Function at 0x1a29b0d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx], eax
rol ecx, 1
sar eax, 0x93
jae 0x1a76135
xor dword [esp + edx*4], eax
xor ebx, ecx
bswap eax
add ebp, ecx
mul byte [esp + edx + 1]
bt eax, 0xbb
lea ecx, [eax*8 + 0x9a8159a]
lea esi, [edx + esi - 1]
movzx ecx, byte [esi + edx*4]
add al, 0x17
xor cl, bl
neg eax
adc cl, dl
neg cl
sub cl, 0x3f
sub edx, dword [esp + edx]
rol cl, 1
pop eax
push eax
and edx, edx
inc cl
xor bl, cl
lea ecx, [esp + ecx + 4]
sal byte [esp + edx + 2], 0xc1
xor dl, al
sar dl, 0xe5
xor ax, word [edx + ecx]
lea edi, [edi + edx*2 - 2]
shr word [esp + edx*8 + 2], 0xc2
sub dx, dx
mov word [edx + edi], ax
or word [esp + edx], dx
shr dword [esp + edx], 0x3a
pop eax
jns fcn.01bc557c
mov ecx, 0x7ebe5b18
movzx edx, cx
lea edi, [ecx + edi - 0x7ebe5b1c]
movzx eax, dl
ror cl, 5
mov edx, dword [ecx + edi - 0x7ebe5bc0]
dec cx
dec cl
or eax, eax
xor edx, ebx
lea ecx, [ecx*4 + 0x5034c016]
dec edx
bswap edx
neg edx
shr cx, 0x69
bswap edx
sar cx, 0xa9
xor ebx, edx
bts eax, ecx
adc esi, edx
movsx edx, al
ror cl, 0xe1
lea edi, [edi + ecx - 0x4b2e0002]
add cl, al
mov ax, word [edi + eax - 0x19]
xor ax, bx
add ax, 0xe126
not ax
sub ax, 0xc52e
neg ax
lea ecx, [edx + ecx*2 - 0x27d765cd]
lea ecx, [ecx*4 - 0x54cd648]
xor bx, ax
lea ebp, [ebp + edx*4 - 0x66]
shr cx, 0x68
inc edx
mov word [ebp + edx - 0x1a], ax
lea edx, [edx - 0x70f1b873]
inc dx
sar edx, 0x63
jne fcn.01b51770

Function at 0x1a3cd1c
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [esi + edx - 0x39f1c94]
xor al, bl
pop edx
dec al
mov edx, 0xac32a08b
xor edx, 0x442c1794
inc dx
not al
shr dx, 0x2a
adc dx, 0x8a2c
dec al
rol edx, 0xc1
bts edx, edx
shr dl, 0x24
ror al, 1
sub dl, dl
sbb edx, edx
xor bl, al
ror dx, 1
adc eax, esp
mov dword [eax + edx*8], ecx
movzx ecx, dx
mov eax, ecx
cdq
lea esi, [edx + esi - 4]
imul ax, dx
setae cl
add edx, dword [edx + esi]
xor edx, ebx
xor cl, 0x8f
not al
push eax
sbb edx, 0x858148b8
inc ecx
xor edx, 0x8cb6e184
neg edx
xchg ecx, eax
not edx
dec dword [esp + ecx - 0xff]
call fcn.01939f10
push esi
insd dword es:[edi], dx
xor eax, 0x9b97a04a
sub eax, 0xe89df6c2
push ecx
push edx
and al, 0x44
push esi
mov edx, edx
nop
jecxz 0x1a3cd2e
sub al, 0x6b
mov eax, 0x53b1ae46
nop
mov esi, 0xe42c6e48
das
add esp, dword [esp + ebp*4 - 0x73]
aad 0x9b
pop eax
sal dword [ecx + 0x60d367b4], cl
jecxz 0x1a3cdec
movsb byte es:[edi], byte [esi]
cmc
and byte [edx + 0x73], dh
shl dword [esi - 0xf], cl
nop
out 0x98, al
call 0xaf62dbbe
ljmp 0x13a8
or ch, byte [esi + edi + 0x37ca4262]
mov eax, 0xa77c8652
enter 0xffffffffffffe979, 0x36
xlatb
in eax, dx
invalid

Function at 0x1a4d4ea
Capabilities:
Authenticate hmac

Disassembly:
neg ecx
mul ax
setno dl
adc al, dh
xor ebx, ecx
imul eax, eax
add edi, ecx
xadd word [esp + eax*4 - 0x55fdb040], dx
mov dword [esp + edx*4 - 0x179e0], edi
ret
xor ecx, 0x56ace716
add ax, ax
mov dword [esp + eax], edx
rol ecx, 1
btc edx, 0xb4
neg ecx
cdq
cbw
add al, byte [esp + edx + 2]
lea ecx, [ecx + edx*2 - 0x3b1acd84]
xor edx, eax
bts eax, 0x19
jae 0x12d2650
Function at 0x1a5297b
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [esp + esi - 0x4a1ffec]
mov dword [esp + ebx*2 - 0x73461860], ebx
call fcn.01c30d97
mov ecx, 0xa1369610
mov ecx, dword [esi]
mov eax, 0x4021ea09
lea esi, [esi + eax - 0x4021ea05]
or al, 0x24
xor ecx, ebx
inc ecx
ror ax, 0x8d
bswap ecx
lea edx, [eax - 0x23e61ed9]
bt eax, eax
add eax, eax
not ecx
call fcn.013a67cc
pop eax
mov cx, word [edi + edx]
jae 0x1b5d45e
add dx, dx
mov edx, dword [esi + 4]
mov eax, 0x481b6919
or eax, 0x54a06896
lea esi, [esi + eax - 0x5cbb6997]
shl eax, 0xa9
adc eax, eax
mov dword es:[ecx], edx
lea ecx, [eax + eax - 0x9d9ec6d]
push ecx
movzx edx, byte [esp]
lea ebp, [ebp + edx*4 - 0x258]
dec byte [esp + edx*4 - 0x253]
sal ax, 0xe8
btc dx, 0xb7
mov ecx, dword [edx + ebp - 0x15]
dec al
xor ecx, ebx
btr dx, dx
sbb ecx, 0xdb01090a
dec edx
neg dl
bswap eax
not ecx
sal dword [esp + edx*8 - 0x760], 0x66
setns dl
bts eax, 0x87
bswap ecx
sub ecx, edx
rol word [esp + edx*8 - 6], 0x6d
ror dword [esp + edx*2 - 2], 0x50
xor ecx, 0xd09a0506
xor ebx, ecx
call fcn.01bf676e
adc eax, 0x4bf3b0f1
fild dword [eax + 0x50]
invalid
pop ecx
mov ecx, dword [esp + esi - 0x4a1fff0]
lea ebx, [ebx*4 - 0x76761c5a]
mov dword [esp + esi*2 - 0x943fff8], ebx
jmp 0x13a7afa

Function at 0x1a68572
Capabilities:
Encode data using xor

Disassembly:
rol cl, 1
sub cl, 0xae
mov dword [esp], edx
xor eax, dword [esp]
xor bl, cl
lea esi, [esi + eax - 0x504]
mov dword [esi + eax*4 - 0x1400], ecx
ror byte [esp + eax*8 - 0x27fe], 0x61
pop edx
jo fcn.01ace843
mov esi, 0x8dab4b97
add esi, esi
mov ecx, dword [ebp + esi - 0x1b56972e]
call fcn.0137e9ba

Function at 0x1a6b286
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov ecx, dword [esi + ecx*4 - 0x12728c10]
mov dword [esp + eax*8 - 0x20], eax
mov al, byte [esi + eax*8 - 0x1c]
add esi, 6
call fcn.012d4bbc
ror dword [ebx + 0x29], 1
stc
pop ds
test dword [edi - 0x7368b610], esi
mov dword [0x24ba12cf], eax
mov edx, 0x3e98b624
bswap eax
inc eax
btr dx, dx
jae 0x1b6f48c
mov edx, 0x1db3b512
bt edx, 3
movzx eax, dx
movzx eax, byte [esi + edx - 0x1db3b512]
sub edx, edx
lea esi, [esi + edx*4 + 1]
not edx
neg edx
xor al, bl
shr dl, 0x21
ja 0x1b8bb79
jbe 0x1d51759
rol eax, 1
mov ecx, edx
sar dword [esp + edx - 0x3e98b620], cl
push edx
not eax
xor ebx, eax
add ebp, eax
mov dword [esp + ecx*2 - 0x7d316c48], ebp
ret 8
rol al, 1
shl edx, 0x5a
shl edx, 0x89
sbb al, 0xa2
neg dx
rol al, 1
sub dx, dx
call fcn.01d35720
mov dx, word [edi]
mov cx, word [edi + 2]
add edi, 2
mov eax, 0xabdda12
not dx
sub eax, eax
lea eax, [eax + eax - 0x32d6cef8]
dec al
not cx
sar al, 0x87
or ax, ax
not al