joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1bb0625
Capabilities:
Encode data using xor

Disassembly:
inc ebp
mov edx, ecx
inc ecx
neg esi
dec esi
mov ebx, dword [esp + edi + 5]
inc ecx
xor esp, 0x5b050998
inc ecx
pop ecx
call fcn.02eea5ba
mov edx, 0x12890716
mov ax, word [esi + edx*4 - 0x4a241c58]
lea esi, [esi + edx*4 - 0x4a241c56]
push edx
jecxz 0x1bb062c
mov ch, 0x52
lea edi, [edx + edi - 0x12890717]
add dx, word [esp + edx - 0x12890714]
adc al, 0xec
clc
jbe 0x1bb064f
movzx edx, byte [edx + edi - 0x1289199f]
mov ecx, dword [esp]
xor dl, bl
xchg byte [esp + ecx*4 - 0x4a241c57], cl
not cl
shl dword [esp + ecx*2 - 0x25120ff0], cl
dec dl
neg dl
sal word [esp + ecx - 0x128907f7], 0x4b
call fcn.01be4a6a
push 0xa911786f
jp 0x1bb065d
cmp byte [ebp + 0x1a], bl
aam 0xc0
push eax
adc eax, 0xaaece065
push eax
adc eax, 0xa68cb865
push eax
adc eax, 0x86a0b465
push eax
adc eax, 0x907f9c65
push edx
outsb dx, byte [esi]
pop ss
xchg edx, eax
aad 0xef
xor eax, 0xa0261c9a
dec esi
shr byte [edi], cl
insd dword es:[edi], dx
dec esi
mov al, 0x88
cmp bl, byte [esi + 0x5b]
mov cl, 0xbc
mov al, 0x6e
pop esi
pop ebx
mov cl, 0xe8
movsb byte es:[edi], byte [esi]
jbe 0x1bb0735
pop ebx
mov cl, 0xf0
hlt
pop edi
sal dword [ebx - 0x1b], 0x7f
add ch, ah
push cs
mov ch, 0x17
aad 0xc4
push 0x80c6ce86
inc esp
cmpsd dword [esi], dword es:[edi]
sbb dword [edx - 0x58bb676a], edx
sbb dword [edx + 0x12e08411], eax
or dword [ecx - 0x5d], esp
sbb dword [eax - 0x37dcc2b3], 0x77
inc eax
sub edx, dword [ebx - 0x4e808ef3]
sub bh, bl
rcl byte [eax], cl
xchg bp, ax
lcall 0x804e, 0x6828e3ae
sbb ebp, dword [eax + 0x1af3ccd0]
push cs
adc dword [ebx - 6], ebp
mov esi, 0x9e613265
mov cl, 0xa
or ch, ah
and dl, byte [ebx - 0x7f8ce0de]
hlt

Function at 0x1bb6db5
Capabilities:
Authenticate hmac
Check http status code

Disassembly:
mov eax, dword [esi + ecx - 0x40830913]
mov dword [esp + ecx - 0x40830913], ecx
add byte [esp + ecx - 0x40830910], ch
jge 0x21c4682
xor eax, ebx
shr word [esp + ecx - 0x4083090e], 0xa9
lea edx, [ecx*8 - 0x6553c050]
ror eax, 1
dec edx
inc eax
call fcn.02eedb5b
mov edx, 0x8e091c0c
lea edx, [edx*2 - 0x4241e6ee]
lea edx, [edx*8 + 0x43a42a0a]
mov ecx, dword [esi + edx*4 - 0x489acd6c]
lea esi, [esi + edx*4 - 0x489acd6c]
lea eax, [edx*2 + 0x70958024]
add ax, dx
xor ecx, ebx
add edx, edx
xor ecx, 0x17896c04
jmp 0x22178e7
mov dword [ebp + edx*2 - 0x489acdde], ecx
movzx eax, dl
dec edx
call fcn.01bac2a7
bswap ecx
and ax, ax
xor ecx, 0x15848902
ror ecx, 3
push edx
xor ebx, ecx
sar dl, 0x42
adc edi, ecx
mov ecx, ebp
or eax, 0xeb989e99
mov dword [ebp + edx - 0x244d66f1], ecx
mov eax, dword [edx + ebp - 0x244d66f1]
neg byte [esp + edx*2 - 0x489acdd9]
mov ecx, dword ss:[edx + eax - 0x244d66ed]
jno 0x21e8ec6
Function at 0x1bba4cc
Capabilities:
Get number of processors

Disassembly:
dec ebp
arpl sp, sp
dec esi
mov dword [esp + esi - 0x28], edi
dec eax
or eax, dword [esp + eax - 0x422307ba]
dec ecx
adc edi, esp
inc dx
movzx eax, byte [esi + esi*4 - 0xa0]
inc esi
mov dl, byte [esi + esi*4 - 0x9e]
not al
inc edx
sal byte [esp + esi - 0x22], 0x21
inc ecx
not dl
inc esi
xchg dword [esp + esi*8 - 0x13c], ebp
inc edx
shl byte [esp + esi - 0x21], 5
inc ecx
and al, dl
inc dx
shr dword [esp + esi - 0x26], 0xec
inc dx
mov dword [esi + esi*8 - 0x13e], eax
jae 0x22225b2
jmp 0x2ea194e
dec edx
dec dword [esp + esi*2 - 0x50]
inc bp
dec ebp
mov eax, dword [esi + esi - 0x26]
dec edx
lea eax, [esi*2 - 0x2ed4b357]
call fcn.02ef5f7e
lea esi, [esi + eax*2 - 0x733d6218]
mov dword [esp + eax - 0x399eb10f], ebp
ret 8
dec dl
not dx
not al
sar cl, 0xa1
setge dl
rol dx, 0x46
neg al
shl cx, 0xc9
jp 0x2e57881
or dl, cl
movzx ecx, ax
not ecx
not dl
sar eax, cl
mov word [esi + eax*2 - 0x5fae], dx
or ecx, ecx
movzx eax, byte [edi + eax - 0x2fd4]
adc ecx, ecx
sub edi, 0xfffffffb
movsx edx, cl
xor al, bl
jmp 0x2e40fa8

Function at 0x1bc2144
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov dword [esp + ecx - 0x22382ab2], ebp
inc esi
sub byte [esp + ecx - 0x22382aac], cl
dec esi
mov dword [esp + ecx*2 - 0x44705564], ebx
inc ecx
push ecx
inc edx
xchg byte [esp + ecx*2 - 0x44705563], dl
dec ecx
xchg ebp, ebp
inc edx
xor dword [esp + ebp - 0x7d6c5623], eax
dec esi
mov ebx, dword [esp + ecx*2 - 0x4470555c]
inc edx
sub ebp, dword [esp + ecx*2 - 0x44705561]
call fcn.02e22b0f

Function at 0x1bc2186
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
rol ecx, 1
pop edx
neg ecx
lea edx, [eax*8 - 0x58f77c7a]
rol ecx, 3
lea ecx, [ecx + eax*2 - 0x2f1b513d]
pop eax
xor ebx, ecx
not edx
mov eax, edx
call fcn.01b863cb
mov ecx, dword [edi]
xor ecx, ebx
xor ecx, 0xa21feb8
sub ecx, 0x1b01b583
mov edx, 0x311bc121
movsx eax, dx
ror ecx, 1
add eax, eax
dec ecx
not edx
dec edx
xor ebx, ecx
and eax, eax
not eax
adc ebp, ecx
or dl, dl
shr al, 0x47
dec al
mov ax, word [esi + eax*2 - 0xfa00]
not edx
movzx edx, byte [edi + edx*2 - 0x62378240]
mov ecx, 0xefb3b686
xor dl, bl
call fcn.021b7743
Function at 0x1bc5056
Capabilities:
Get number of processors

Disassembly:
xor ebx, edx
neg cx
add ebp, edx
mov dword [esp], 0x76bf4d38
mov edx, dword [esi]
mov cl, byte [esi + 4]
shl edx, cl
mov dword [esi + 2], edx
sal word [esp + 2], 0xce
mov dx, word [esi + 2]
neg byte [esp + 3]
sub ax, word [esp + 1]
adc esi, 4
mov ecx, dword [esp]
movzx eax, byte [edi + ecx - 0x40004d34]
pop ecx
call fcn.02ec90d7
mov eax, 0xdc89c69d
bswap eax
mov eax, dword [edi]
mov edx, 0x21a8f9b
mov edx, dword [edi + edx*8 - 0x10d47cd4]
mov ecx, 0xa408d50c
mov cl, byte [edi + 8]
push 0xf3bfb2a7
shrd eax, edx, cl
mov ecx, dword [esp]
mov dword [edi + 6], eax
movzx ecx, word [esi]
xor cx, bx
xor cx, 0x3125
jmp 0x2e95084
sub cx, 0x8905
sar dword [esp], 0x84
neg cx
call fcn.02ed6132
neg al
dec cx
xor cx, cx
rol al, 1
not al
sub cx, cx
sub ecx, ecx
movzx edx, cl
xor bl, al
add eax, esp
not cl
neg edx
or dx, word [eax + ecx - 0xff]
lea ebp, [ebp + ecx*4 - 0x3fe]
sar ecx, 0x61
mov word [ebp + ecx*4 - 0x1fc], dx
lea edx, [ecx + ecx*2 + 0x71981724]
sbb edx, ecx
movsx eax, dl
jns fcn.021b7ec4

Function at 0x1bca138
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov ecx, dword [edx]
inc eax
movzx edx, ch
dec esp
mov dword [edx + esi - 0xd3], ecx
inc esp
movzx edx, byte [edx + ebx - 0xd1]
ror ebp, 0x6d
rol edx, 0x8e
sal byte [esp + ebp - 0x2e5a6437], 0xc6
dec eax
lea ebx, [ebx + ebp - 0x2e5a6449]
inc ebp
xor dl, bl
inc ecx
add dl, 0x99
neg ecx
call fcn.02e6aa6b

Function at 0x1bcc246
Capabilities:
Get number of processors

Disassembly:
dec eax
sub ecx, 0xe4a65da6
rol ecx, 2
mov dword [esp + edx*2 - 0x5c], edx
jmp 0x21f5784
shl edx, 0xfd
add ecx, 0x23a2c887
jmp 0x2e3302d

Function at 0x1bcc866
Capabilities:
Encode data using base64

Disassembly:
mov word [edi + eax - 0x75b3a514], dx
mov dword [esp + eax - 0x75b3a514], 0xe996ccae
call fcn.02eadd9c

Function at 0x1bcd097
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [edx*8 - 0x57cbd4e8]
mov dword [esp + edx*2 - 0x1cad858], ecx
xor al, bl
and word [esp + edx*8 - 0x72b6160], 0xb793
ja 0x2f03106

Function at 0x1bd20f2
Capabilities:
Encode data using base64

Disassembly:
adc edi, 6
call fcn.021970f1
not dl
neg dl
rol dl, 1
jmp 0x2ed3fa9
jae 0x1b93a97
jmp 0x1bb7c89
neg ebx
add ebx, edx
mov edx, ebx
shl edx, 2
inc ax
mov eax, ebp
add eax, edx
mov dword [ebp - 4], eax
jmp 0x21a9f2f
push ebx
mov ebx, eax
sub ebx, ebx
jge 0x2ec49e8
mov ebp, esi
jle 0x21c0169
inc dl
shl eax, 0x7e
rol dl, 1
inc al
xor bl, dl
push edi
lea eax, [eax + eax + 0x5c0579b8]
push ebp
jmp 0x22394d0
Function at 0x1bda584
Capabilities:
Authenticate hmac

Disassembly:
dec ebp
lea ebp, [edx + 0x39b53aaf]
rol dl, 1
inc esp
xchg dword [esp + ebp*4 - 0x97], ebp
push ebp
neg dl
xor dl, 0x9c
inc ecx
movzx eax, bp
add dl, 5
inc esp
or dh, byte [esp + ebp - 0xa]
inc ebp
neg dl
dec esi
lea ebp, [ecx + eax*4 + 0x7625c786]
call fcn.01b9d048
mov eax, 0x271b97aa
movzx ecx, al
mov ecx, dword [esi + eax*2 - 0x4e372f54]
lea edx, [eax*2 + 0x541767a7]
and ax, ax
mov edx, dword [esi + eax*2 - 0x4e372f50]
adc ecx, edx
neg al
inc ax
lea edx, [eax*2 + 0x56345520]
mov eax, ecx
jle 0x2239fa5
adc edx, 0x5b98dca8
adc ecx, 0xd924f80
neg ecx
movzx eax, dx
xor ecx, 0x63ed416
dec ecx
neg edx
call fcn.02e8a39f
popal
leave
lea ebp, [edx]
mov edx, 0xc34e52ea
invalid

Function at 0x1bdb1ef
Capabilities:
Get number of processors

Disassembly:
xor ecx, 0x6eb3da82
rol ecx, 1
not dword [esp + 8]
neg ecx
xor ebx, ecx
mov eax, dword [esp + 8]
xchg byte [esp + eax - 0xd9], ah
pop edx
mov dword [eax + esi - 0xe5], ecx
mov dword [esp + eax*8 - 0x718], 0x7ac8c17
lea esi, [eax + esi - 0xe5]
inc al
pop eax
rol eax, 0xe4
pop eax
jae fcn.02e8367f

Function at 0x1be067c
Capabilities:
Get number of processors

Disassembly:
sub esi, 4
mov ecx, 0x2db5a5ad
mov ecx, dword [esi + ecx*2 - 0x5b6b4b5a]
xor ecx, ebx
inc ecx
mov dword [esp], 0x9f080c0e
not ecx
sub ecx, 0x4eac9129
jmp 0x2e9b541
ror ecx, 1
xor ebx, ecx
add edi, ecx
lea esp, [esp + 4]
jmp 0x2e2bee4

Function at 0x1be9d6e
Capabilities:
Get number of processors

Disassembly:
push eax
push edx
push 0x8ba9ec2e
call fcn.01b9a710

Function at 0x1bea873
Capabilities:
Encode data using base64

Disassembly:
ja 0x2e8ddca
pop eax
pop edx
pop eax
pop ecx
jmp ebp
ror cl, 1
or eax, eax
mov dword [esp + edx*2 - 0xbc00], edx
setle al
xor bl, cl
lea ecx, [esp + ecx + 4]
not edx
mov dx, word [ecx + eax*2 - 0x14400]
lea ecx, [eax + eax + 0x501b1dac]
call fcn.01b947fc
mov edx, 0xcc967ca4
lea eax, [edx + edx*4 + 0x7e10bd9d]
mov ecx, dword [ebp + eax - 0x7d012cd1]
sar dl, 0x85
mov dl, byte [ebp + eax - 0x7d012ccd]
lea ebp, [ebp + eax - 0x7d012ccb]
jnp 0x1bccf7e
add ebp, eax
call fcn.02ed1892
dec esp
lea edx, [ebp - 0x4155ebe9]
inc ebp
xor eax, ebx
inc edx
mov edx, dword [esp + ebp*4 - 0x1067b]
call fcn.02e0ce89
call fcn.021a6ca0

Function at 0x2195883
Capabilities:
Encode data using base64

Disassembly:
dec cl
push edx
xor eax, ebx
neg eax
shl byte [esp + 0xa], 2
xor eax, 0x67934a3b
or word [esp], dx
mov dword [esp + 4], 0x739c2923
sbb eax, 0x272b4f98
or edx, dword [esp + 8]
ror ecx, cl
sal word [esp + ecx*2 - 0x243403f8], 0x88
ror eax, 1
dec eax
sal edx, cl
jnp 0x1bc8acc
bswap edx
bswap eax
xor ebx, eax
inc dword [esp + ecx*2 - 0x243403f9]
and dword [esp + ecx - 0x121a01f7], edx
adc ebp, eax
mov dword [esp + ecx - 0x121a01ff], ebp
ret 8

Function at 0x21ae737
Capabilities:
Encode data using base64

Disassembly:
call fcn.02e2bcbd
movzx ecx, byte [edx + edi - 0x4080800f]
pop eax
movsx eax, dx
neg al
xor cl, bl
or edx, eax
not dl
sar edx, 0xb0
neg cl
dec dl
xor al, 0x82
shr eax, 0xad
rol cl, 1
dec al
or edx, 0xd00c0385
sbb dl, dh
sbb cl, 0xa9
jmp 0x1bc83b3
Function at 0x21aec96
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x3c98310d
pop ecx
jne 0x2e1ac9e
mov ecx, dword [edi]
mov eax, 0xed9461ab
xor ecx, ebx
movzx edx, al
ror ecx, 1
not ax
rol al, 0xc6
lea ecx, [edx + ecx - 0x769c1233]
ror ecx, 1
ror al, 0x84
jae 0x2e4f004
ror dx, 0xed
jae 0x2e5612c
movsx edx, cl
xor eax, ebx
sub edx, ecx
xor cx, 0xdd19
xor eax, 0x6aa1bd0c
shr ecx, cl
and cl, dl
xor dx, 0x462f
bswap eax
call fcn.01b88e6b
call fcn.02219360
mov edx, 0x7d3c7397
movzx ebp, dx
bswap ebp
mov ebx, edi
call fcn.01b8a473
mov ecx, dword [esi]
mov eax, 0x2fa59b3f
mov eax, dword [esi + eax - 0x2fa59b3b]
call fcn.02e91715
cmp esi, ecx
lea ecx, [eax + ecx - 0x5df66e97]
xor ebx, ecx
jmp 0x2e62b02
dec esi
mov ebx, dword [esp + ebp*4 + 0x56f6f3ac]
inc ecx
dec al
inc esp
sub edi, ebp
dec edx
lea esi, [esi + edi - 0x516da59c]
inc ecx
shl ah, 0xc6
inc ecx
seta ch
inc ecx
add eax, 0xef2070b3
inc esi
mov dword [esi + ebp*4 + 0x56f6f3fc], esi
sar ax, 0x8c
inc ecx
pop esp
pop ecx
inc ecx
pop esp
inc ecx
pop ecx
pop edx
jns fcn.02e1aa1a
xchg dh, dl
add ebp, ecx
mov ecx, 0x6901b8a2
jmp 0x2ec35f2
sub edi, 0xfffffffb
jmp 0x2edd248
mov dword [esi], edx
mov ebx, 0x1e9dac86
mov ebx, dword [esp + ebx*2 - 0x3d3b5908]
mov edx, 0x909c60bb
pop edx
pop eax
jmp fcn.02211a4f
mov dx, word [esi + ecx - 0x6901b8a2]
add ax, 0xd61b
push eax
or eax, 0xb118fb2
mov cx, word [esi + ecx - 0x6901b8a0]
ror byte [esp], 0x41
adc dx, cx
mov word [esi + 2], dx
movzx eax, byte [edi + 4]
jmp 0x2ea2506
xor al, bl
pop edx
movsx ecx, dx
not al
neg cl
neg al
or dl, dl
and cx, 0xb7af
sub edx, edx
not al
call fcn.02ea1576
mov dword [esp + ecx - 0x29615800], ecx
cpuid
sub esi, 0xc
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
mov dword [esi + 4], ecx
jmp 0x2eb05b3

Function at 0x21b12c0
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x41ce0000], 0xf71fa911
jbe 0x2e47de2

Function at 0x21b1ece
Capabilities:
Get number of processors

Disassembly:
ror dx, 0x2a
sbb cl, 0xbb
mov dword [esp + eax - 0x2402], eax
neg ax
xor cl, 0xae
dec byte [esp + edx - 0x5c0]
ror cl, 1
and dx, 0x8799
sbb cl, 0x26
xchg byte [esp + eax*4 - 0x36ff5], dh
bswap eax
rol cl, 1
neg cl
xor bl, cl
bswap eax
xor word [esp + eax*2 - 0x1b7fa], 0x3e84
lea ecx, [esp + ecx + 4]
jle 0x2e6f785
inc edx
xchg word [esp + eax - 0xdbfc], dx
mov edx, dword [ecx + eax*2 - 0x1b7fc]
jge 0x1b890b7
Function at 0x21b34c8
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov ebx, dword [esp + ebp + 0x10]
inc cx
dec ebp
dec ebp
arpl dx, dx
inc dx
sal dword [esp + ebp - 0xfff5], 0xb
jbe 0x21cbc10
inc ecx
mov eax, 0x5786fe05
dec esp
mov edx, esi
call fcn.021d126e
lea edi, [eax + edi - 0x22]
xor dl, bl
shr cl, 0x23
not dl
call fcn.02ecb198
mov ah, 4
cld
xor al, 0x6d
mov word [edi + ecx - 0x49], es
test byte [ebx - 0x4a], cl
sti
mov esp, 0x2245588f
rol byte [edi + ecx - 0x42], cl
loopne 0x21cbbb1
inc ebp
xchg esp, eax
rcr byte [edi], 0xee
lodsd eax, dword [esi]
jne 0x21cbb33
out dx, eax
add al, 0
add byte [eax], al
loope 0x21cbbab
invalid
dec ecx
add edi, edx
sal eax, 0xa6
inc ebp
mov esp, ebp
inc ecx
pop eax
inc ecx
pop edi
inc ecx
pop edi
jns fcn.02e1aa1a
loop 0x21cbc42
push cs
sar byte [ebp + 0x50fa248b], cl
out dx, al
jecxz 0x21cbc08
push esp
cli
push eax
out dx, al
xchg edi, eax
test eax, 0xee50fa28
invalid
sal eax, 1
sti
or al, 0x5e
mov bl, 0x9d
pop edi
pop edi
test al, 0x38
invalid

Function at 0x21b52df
Capabilities:
Encode data using xor

Disassembly:
add esi, 5
pop eax
call fcn.02e18588
mov edx, ebp
mov ecx, 0x4c0ebda8
movsx eax, cl
sar ecx, cl
mov dword [ebp + ecx*8 - 0x26075ec], edx
movzx edx, ax
ror edx, 0x14
bswap eax
mov ecx, dword [esi + ecx - 0x4c0ec1]
lea edx, [edx + edx*4 + 0x1aab410e]
jns 0x21d69bf
mov eax, 0x8fb83b14
mov ecx, eax
call fcn.01be83b2
sub cl, 0xa9
movsx eax, byte [esp + edx - 0x130ac00]
shl eax, 0x84
not cl
xadd byte [esp + eax*2 - 0x5ff], al
xor bl, cl
shr dl, 0x82
lea ecx, [esp + ecx + 0x10]
xadd edx, eax
add al, al
mov edx, dword [ecx + edx - 0x130afac]
lea ecx, [eax + eax*8 + 0x5b038cbc]
xadd dword [esp + eax*2 - 0x26157fc], eax
mov dword [esi + ecx - 0x65b998bc], edx
movzx edx, cx
sbb dl, ah
pop eax
mov dword [esp + ecx - 0x65b998bc], ebp
ret 8

Function at 0x21b7ce9
Capabilities:
Encode data using base64

Disassembly:
inc ecx
rol ecx, 1
xor ebx, ecx
add ebp, ecx
call fcn.021fe69d

Function at 0x21bbd3d
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0xc382cd19
mov cl, byte [edi + 2]
call fcn.02e8996b
Function at 0x21bc92c
Capabilities:
Encode data using base64

Disassembly:
neg al
xor al, 0x98
inc esp
xor bl, al
dec eax
lea eax, [esp + eax + 0x18]
dec eax
mov dword [esp + ebp - 0x5e951d92], 0x3b3de6a2
inc esi
xchg dword [esp + edx*2 + 0xb], esi
mov byte [eax + ebp - 0x5e951d9a], dl
dec esi
mov dword [esp + esi*2 - 0x76], edi
inc edx
xor byte [esp + esi*2 - 0x6f], 0x2e
dec ebp
xchg esi, edi
inc ebp
movzx eax, byte [esi + ebx - 0x1d9c]
jne 0x2e4bf31
inc ecx
push edi
dec ebp
arpl ax, ax
dec ecx
add edi, eax
jmp 0x2e60cab
inc ebp
xor al, bl
rol word [esp + ebp - 0x5e951d92], 0x67
mov ecx, 0xe8355bd
inc ecx
rol al, 1
inc ecx
xor edx, 0xe01b2b88
inc ecx
push esi
inc esi
mov esp, dword [esp + esi - 0x1d88]
inc ecx
sbb al, 0xa2
inc ecx
ror al, 1
inc cx
sar esi, 0xc3
inc ecx
neg al
inc ebp
xadd ah, dh
inc ecx
push esi
inc ecx
setbe dh
inc ebp
xor bl, al
dec edx
xadd dword [esp + esi - 0x2e6], ebp
inc si
mov dword [esi + esi*2 - 0x600], eax
inc ecx
movzx edx, dl
inc ebp
movsx eax, si
inc esi
mov eax, dword [ebx + esi*4 - 0xc06]
dec edx
lea ebx, [ebx + esi - 0x306]
inc ebp
xor eax, ebx
inc ecx
inc eax
inc ecx
push edx
sub cl, 0xba
xchg bp, dx
inc ecx
bswap eax
inc ecx
or ah, 0xa1
inc edx
and ch, byte [esp + esi*2 - 0x5db]
dec ecx
lea eax, [esp + edx*2 - 0x22fcf94c]
inc ecx
rol eax, 2
inc ebp
mov ecx, esp
inc ecx
neg eax
inc ecx
ror eax, 1
inc sp
xor edi, eax
inc edx
rol dword [esp + esi - 0x2e8], cl
jae 0x2e8bef7
mov ecx, 0xa20ee39e
add ecx, 0xd1860c1e
movzx ax, byte [esi + ecx - 0x7394efbc]
ror cx, 4
jns 0x2e9938f
inc ecx
inc al
call fcn.01bdadfe
dec edx
mov dword [esp + esi - 0x300], edi
ret 0x30
dec esi
mov dword [esp + esi*4 - 0xbd8], ebx
inc esi
xor dword [esp + esi*8 - 0x17d8], eax
dec esi
mov ebx, dword [esp + esi - 0x2d8]
dec edx
dec dword [esp + esi - 0x2e9]
jns 0x2213e04
mov edx, 0xeda77b16
call fcn.01baae50
mov cl, byte [ecx + esi - 0x7394cef9]
mov edx, 0x9811683f
setae dl
sub esi, 0xfffffffc
call fcn.021bea28

Function at 0x21bcb4c
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi + eax - 0x2c34afab], edx
shl al, 0x83
mov ecx, dword [esi + eax - 0x2c34af58]
mov dword [esp + eax*2 - 0x58695eac], 0x790d9a23
mov edx, dword [esp + eax*2 - 0x58695eac]
mov dword [esp + edx - 0x790d9a23], eax
lea esi, [esi + eax - 0x2c34af54]
sar edx, 0xd9
call fcn.0220c4bf
mov eax, dword [esi - 4]
ror dword [esp + 0xc], 0x3d
mov ecx, 0x7f006bb1
movsx edx, cl
lea esi, [esi + ecx - 0x7f006bb5]
not ecx
xor eax, ebx
dec ecx
or dl, byte [esp + 4]
bswap ecx
inc eax
xor eax, 0x9c21c22b
ror eax, 1
neg edx
shr dx, 0xca
sbb byte [esp + edx + 0xd], 0x23
dec eax
rol ecx, 0xb0
xchg word [esp + edx*2 + 0xe], dx
rol edx, 0x1a
xor ebx, eax
bswap edx
mov dword [esp + edx - 0x4b00007c], edx
add edi, eax
mov ebp, dword [ebp + edx - 0x4b00007c]
shr cl, 0x42
mov dword [esp + edx - 0x4b000078], ecx
pop edx
pop eax
pop ecx
pop eax
jne fcn.021b7ec4

Function at 0x21bdfa9
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + edx*4 - 0x4f68e541]
pop edx
mov eax, 0x7b137d0c
mov edx, eax
rol ecx, 3
lea ecx, [eax + ecx - 0x447ce0fc]
rol ecx, 3
xor ecx, 0x81dd705
xor ebx, ecx
rol eax, 0x11
jae 0x1bc20ef
Function at 0x21c3d48
Capabilities:
Encode data using base64

Disassembly:
lea eax, [esp + eax + 4]
mov dword [esp + ecx - 6], 0xfb8caa00
call fcn.0221352a
Function at 0x21d0c36
Capabilities:
Encode data using base64

Disassembly:
push eax
xor ebx, ecx
call fcn.01be81d8
lea ecx, [ecx + eax + 0x2c20c8ba]
not ecx
mov dword [esp + edx - 1], 0x1330c788
and eax, 0xe93b0a1d
pop eax
lea ecx, [ecx + eax*4 + 0x5ccfb49d]
bswap ecx
shl edx, 0x5e
ja 0x1bb8bff
add ebp, eax
jmp ebp

Function at 0x21d471f
Capabilities:
Authenticate hmac

Disassembly:
xor edx, ebx
rol cl, 0xe1
ror edx, 1
neg edx
push ecx
dec cl
inc eax
bswap edx
push ecx
add word [esp + eax*2], cx
rol cl, 0xa7
rol edx, 1
sub edx, eax
push ecx
pop eax
neg edx
not byte [esp + 5]
sal byte [esp + 3], 0xa2
xor ebx, edx
jmp 0x219e156
pop ecx
neg cx
add edi, edx
add dword [esp + ecx - 0x403c97e9], 0xa63be79a
movsx edx, word [esp + ecx - 0x403c97e9]
pop ecx
jle fcn.021b7ec4
adc edi, 6
jmp 0x21b7e4d
xor al, 0xb4
call int.02e554d2
call fcn.02ede6be
add ecx, 0x618d624
mov eax, dword [esp + 4]
add eax, 0x65c8c9
jmp eax
lea ecx, [ecx*4 - 0x5e49c3e4]
call fcn.021bd075
lea esi, [esi + ecx - 0x302ee0b8]
pop ecx
xor eax, ebx
mov edx, 0x833499a5
xor eax, 0x2955596
movsx ecx, dx
inc eax
xadd cx, dx
adc ecx, edx
jnp 0x21a6dbb
rol eax, 3
xor eax, 0x10893f2e
xor ebx, eax
xor ecx, edx
call fcn.02e1adf4
lea esi, [esi + eax*4 - 4]
mov edx, dword [esi + eax*2]
jp 0x1b7bf00
mov ecx, 0xb3be8cae
movzx edx, cx
shl dx, 0x83
movzx edx, byte [edx + esi - 0x6570]
jns 0x21d19cd

Function at 0x21d9c5a
Capabilities:
Encode data using base64

Disassembly:
jno 0x21d9bf7
arpl bp, ax
fxam
scasb al, byte es:[edi]
int3
loope 0x21d9b82
sbb byte [0xff634d45], 0x49
add edi, edi
call fcn.02ed6c1f
add bh, bh
loope 0x21d9bdb
invalid
sub byte [esp + 7], 0x36
mov byte ss:[eax], dl
insb byte es:[edi], dx
and al, 7
mov byte ss:[eax], dl
mov eax, 0x4e9e1f82
mov ecx, dword [esi + eax - 0x4e9e1f82]
dec word [esp + eax - 0x4e9e1f7d]
mov dword [esp + eax - 0x4e9e1f82], eax
jl 0x2e96a55
mov cl, 0x89
test byte [esi + edi*2], al
loopne 0x21d9cdd
mov cl, 0xf
mov edx, ss
int 0xcb
add byte [edi - 0x78], cl
daa
dec edi
mov byte [edi], ah
sub al, 0xe7
sbb dl, ch
cmc
popal
loopne 0x21d9cdb
out 0xdc, eax
mov cl, 0x52
pushal
or byte [edi - 0x44], bl
mov cl, 0x52
pushal
arpl word [ebx], bp
in al, 0xb1
push edx
pushal
pop ebx
jae 0x21d9c57
mov cl, 0x52
pushal
cmp eax, dword [edi]
imul ebx, edx, 0xffffff98
cmpsd dword [esi], dword es:[edi]
cli
pop ax
add dword [ecx + 0x37], eax
pop edi
mov cs, word [ebp + 0x1ab8c54f]
ret
sbb al, 0x87
sti
add al, 0x9f
push ss
jecxz 0x21d9c75
mov ch, byte [ecx + 0x4e]
or dword [ebx - 0x4a], esp
out 0x15, al
dec esi
or dword [ebx - 0x16], esp
retf 0x4e19
add al, 0x26
ror ecx, 1
lea edx, [eax*2 + 0x15be5432]
bswap ecx
inc eax
ror ecx, 2
shl eax, 0xee
xor ebx, ecx
push eax
mov dword [edi + 2], ecx
inc byte [esp + 0xa]
add edi, 2
mov eax, dword [esi + 4]
lea ecx, [edx + 0x398b97b2]
shr ecx, 0x30
shl dword [esp + ecx - 0xec83], cl
lea esi, [esi + ecx*2 - 0x1d904]
xor eax, ebx
neg dx
jge 0x2200b63
mov cx, word [edi]
jmp 0x2eb5fa3
xor ecx, ebx
bswap ecx
jmp 0x2e3e973
Function at 0x21db72c
Capabilities:
Encode data using base64

Disassembly:
or word [esp + eax - 0x744e1438], ax
pop ecx
mov word [esi + eax - 0x744e143c], dx
shr word [esp + eax - 0x744e1436], 0x87
mov ecx, eax
pop eax
pop eax
jns fcn.02e8367f
dec eax
sub ebx, 4
mov edx, 0x9e0b853e
inc esp
mov eax, edx
call fcn.02edbdef

Function at 0x21dde2c
Capabilities:
Encode data using base64

Disassembly:
xor ebx, edx
mov dword [esp + eax - 0x6aa7008b], ecx
shr al, 0x61
add edi, edx
pop eax
movzx ax, byte [ebp]
mov edx, ecx
sar ecx, cl
sbb dl, 0x11
mov dl, byte [ebp + 2]
lea ecx, [ecx*8 + 0x41b4428b]
not al
or ecx, ecx
inc ecx
not dl
jp 0x2ee8832
dec eax
sub ebx, 4
push 0xed83d0b4
mov ebp, dword [ebx]
inc ecx
xor ebp, ebx
dec eax
sar dword [esp], 0xa7
call fcn.02213ed5

Function at 0x21dfc02
Capabilities:
Encode data using base64

Disassembly:
shr cx, 1
push eax
rcr edx, cl
call fcn.0220a0be

Function at 0x21dfd97
Capabilities:
Get number of processors

Disassembly:
mov cx, word [edx + eax*2 - 8]
mov edx, dword [esp + eax]
call fcn.01bec1b3
mov edx, dword [edi]
jmp 0x2202827
mov eax, 0xa4820e8c
add edi, 4
mov ecx, eax
shr ecx, 0x6c
xor edx, ebx
shr ecx, 0x64
lea edx, [edx + ecx + 0x1eb287a0]
push ecx
ror edx, 3
ror dword [esp + ecx*8 - 0x52410], 0xd
not edx
jae 0x21aab10
add ebp, eax
mov eax, dword [esp + edx - 0x21]
rol dword [esp + edx*8 - 0x108], 0xe7
pop edx
mov ecx, dword [edx + esi - 0x7a9eeda7]
mov eax, dword ss:[ecx + edx - 0x7a9eeda7]
mov dword [edx + esi - 0x7a9eeda7], eax
shl dx, 0xea
jmp ebp