joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d810
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b7578
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.004adb19
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0046d1b0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004ada47
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004aa236
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004aa236
push 1
push 0
push 0
mov ecx, esi
call fcn.004aa1de
push 1
push 0
push 1
mov ecx, esi
call fcn.004aa1de
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004adb8b
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x46d990
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b7598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.004adb19
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0046d1b0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.004ada47
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x46da54
cmp dword [esp + 0x40], 1
jne 0x46da52
cmp ecx, eax
jge 0x46da54
mov eax, ecx
cmp eax, 0xc8
jge 0x46da60
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0046d810
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004adb8b
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x46e1d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b7603
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004a864f
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004addc1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004af35c
test eax, eax
je 0x46e2ec
mov ecx, dword [esp + 0x3c]
call fcn.004addee
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x46e2b0
push edi
mov ecx, esi
call fcn.004ab3b4
mov ecx, esi
call fcn.0046e450
cmp dword [esp + 0x38], 1
jne 0x46e2e5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004ab51e
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x470d00
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x470d33
push esi
call fcn.00473e00
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x470d2c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x470db9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x470da2
mov eax, dword [esi + 8]
test eax, eax
je 0x470d57
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x470d9e
cmp eax, 2
je 0x470da2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x470d4a
cmp eax, 3
je 0x470d7d
cmp eax, 1
jne 0x470d4a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x470d4a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x470d4a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00470de0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x470dc8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00470de0
add esp, 4
pop esi
ret
Function at 0x482cf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x482d3c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x482d3c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x482d26
push eax
call ebp
test ax, ax
jl 0x482d34
inc esi
add edi, 4
cmp esi, 6
jb 0x482d18
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004829f0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x487da0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x487e43
test eax, eax
jbe 0x487e43
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x487e43
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x487dee
xor esi, esi
jmp 0x487df4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x487e1f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0048c020
add esi, eax
push esi
mov ebx, esi
call fcn.0048c020
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x487e00
pop ebp
test edi, edi
pop edi
jne 0x487e43
test ebx, ebx
je 0x487e43
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004977e0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x487f85
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x48809d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x48809d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004a8aa1
mov esi, eax
test esi, esi
je 0x48809d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x48809d
mov ecx, esi
call fcn.00487ef0
cmp edi, eax
jge 0x48809d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x488023
mov dword [esp + 0x34], 1
jmp 0x48807e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x48809d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004874a0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4a9444
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a947c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a74d1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a74a9
jmp 0x4a9488
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4aab3a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4aab7c
call fcn.004b09f3
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4aab7c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4aab73
xor eax, eax
jmp 0x4aab84
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004aab8a
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b0f23
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b0f51
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b0f6f
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b0e89
jmp 0x4b0f6f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b0f6f
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b0e89
test edi, edi
mov eax, edi
jne 0x4b0f59
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0xcc31f8
Capabilities:
Authenticate hmac

Disassembly:
xor edi, ecx
pop edx
dec eax
lea ebx, [ebx + ecx*8 - 2]
inc sp
mov dword [ebx + edi*2 - 0x33f52c2], ebp
inc esp
movzx ebx, bh
dec eax
cdq
neg edx
dec esi
lea esp, [ecx - 4]
inc ecx
sal dl, 0xe4
inc ecx
rol bh, 0x85
dec eax
adc eax, 0x18363b86
inc ebp
mov eax, dword [esp + edi*2 - 0x33f52c2]
add ax, cx
ror ecx, 0x6d
dec eax
adc edi, 0x6a97bd04
inc ebp
xor eax, esi
inc ecx
dec eax
inc ebp
add ebx, ebx
inc ecx
xor eax, 0x5f210fa8
btc edi, 0x30
inc esp
adc eax, ecx
inc ecx
xor eax, 0x33bf350b
inc ax
inc ecx
inc eax
dec esp
imul edx, edx
dec eax
and ecx, 0x5e820797
inc ebp
add ebx, edi
inc ecx
push esi
cwd
inc esp
cmova edx, edi
inc esp
imul ebx, edi
inc esi
xor dword [esp + edx - 0x6c366665], eax
dec eax
or edi, 0x9b1c5d85
push edi
inc ebp
movsx ebp, dx
dec esp
mov esi, dword [esp + edi + 0xc18023]
dec esi
lea ebp, [edx + ebx*8 - 0x54779f56]
dec edx
shl dword [esp + edx - 0x6c366665], 0x2d
ja 0x14aa29d
dec ebp
arpl ax, ax
dec ecx
add esi, eax
dec edx
mov dword [esp + edx - 0x6c36665d], edi
inc ecx
neg ebx
pop eax
pop ecx
jns fcn.014429a1
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, 0xd927d704
add ebp, 4
add edx, eax
movsx eax, cx
mov dword [ebp], edx
mov edx, dword [esi]
call fcn.0155dfc8
dec eax
mov dword [esp + edx - 0x600f3e1e], edx
inc ebp
mov ebp, dword [esp + edx - 0x600f3e1e]
dec eax
lea edi, [edx + edx*4 + 0x7f9453bb]
inc ebp
xor ebp, esi
call fcn.0150d567
Function at 0xcc99d2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [edx + ecx - 0x1ffec000]
mov dword [esp + eax - 0xe0024], eax
jnp 0x1452735
mov dword [ebp + eax*4 - 0x380094], ecx
mov edx, dword [esp + eax*8 - 0x700120]
ror eax, 0xe
jne 0x1434997
xor cl, byte [ebp + edx - 0x69b2b5cb]
shl ax, cl
lea ecx, [edx*8 - 0x7c5411c3]
mov word [ebp + edx - 0x69b2b5cb], ax
jmp 0xce7b8a
mov ecx, dword [ebp + ecx - 0x4158007c]
btr edx, 0x31
lea ebp, [edx + ebp - 0x7c]
xor dword [ebp + 0xf842a6c], ecx
mov bl, 0xd2
btr edx, edx
or dx, dx
not eax
btr edx, edx
not ecx
shr edx, 0xed
bswap edx
setae dl
or eax, ecx
call fcn.015a2935
xor dword [eax], 0xffffffa9
xlatb
mov cl, 0x79
sar dword [edi - 0x1a], 1
je 0xce66e8
retf 0x930f
jne 0xce66e2
jg 0xce66f9
or byte [ebp - 0x19802eaf], cl
and al, 0xcd
arpl word [ebp + 0x46e049db], cx
pop edx
inc edx
or eax, 0xec562574
xchg edi, eax
invalid
sal ecx, cl
lea ebp, [edx + ebp - 0x69b2b5cb]
movsx eax, cl
mov edx, dword [esi + edx - 0x69b2b5cf]
push ecx
sal dword [esp + eax], 0x1d
lea esi, [esi + eax*8 + 4]
and ax, cx
xor edx, ebx
bswap edx
pop ecx
xor cl, ch
not cl
ror edx, 1
bswap edx
sar ecx, 0x28
sal ecx, 0x9c
and ax, 0xa5a2
neg edx
xor ebx, edx
xadd al, ch
sub ecx, eax
adc edi, edx
push eax
push eax
add dword [esp + ecx], edi
ret 4
mov edx, dword [edx + esi - 0xe0023]
shl dword [esp + eax*2 - 0x1200070], 0x4f
movzx ecx, ax
call fcn.01542687
lea esi, [ecx + esi - 0x7bb1f433]
shl cl, 0xa2
xor edx, ebx
lea eax, [ecx*2 - 0x70e137f7]
shl eax, 0xe7
neg edx
ror al, 0x61
idiv al
dec eax
xor edx, 0x98a26cbf
sub edx, 0xbb215f15
ror edx, 2
neg edx
xor edx, 0xd73724a4
xchg ecx, eax
xor ebx, edx
inc ax
add edi, edx
sub eax, ecx
and cx, 0x33a9
mov eax, dword [ebp + ecx - 0x41580080]
movzx edx, cl
jns 0xce66d9
Function at 0xccb5e3
Capabilities:
Encode data using xor

Disassembly:
dec eax
xor ebx, eax
add edi, eax
mov dword [esp + edx*2 - 0x1fffe], 0xbd1e7090
movzx edx, byte [esi + edx - 0xfffb]
sal cx, cl
sbb esi, 0xfffffffb
push ecx
xor cx, cx
xor dl, bl
jmp 0x14475d0
movsx eax, cx
push eax
sub dl, 0xa0
not dl
or cl, al
dec dl
lea ecx, [eax*8 - 0x7d7a75b]
or dword [esp + eax*8 + 8], eax
ror eax, 0xd
rol dl, 1
sub byte [esp + eax*2 + 0xb], cl
neg dl
xor bl, dl
lea edx, [esp + edx + 0xc]
add eax, dword [edx + eax]
xor dword [esp + 8], 0x13b8e19
lea edx, [ecx*2 - 0x16786fd0]
mov dword [ebp - 4], eax
xadd dl, dh
sbb ebp, 4
dec cl
lea eax, [ecx + edx*2 + 0x5f854f3f]
pop edx
pop edx
pop eax
jne fcn.014a9a0a
inc ecx
mov ebx, 0x12bf32b5
inc ebp
movsx eax, bl
dec edi
lea esp, [esp + ebx - 0x12bf32b9]
inc ebp
movzx edx, bl
inc ebx
mov edi, dword [esp + ebx*2 - 0x257e656a]
dec edi
lea ecx, [ebx + ebx*4 + 0x7c90e613]
inc ecx
xor edi, esi
inc ecx
movsx ebp, al
inc ebp
movzx edi, dx
ror edi, 2
not edi
inc edx
lea edi, [edi + ebx - 0x56de0fd4]
xor edi, 0x68b45a24
dec ebp
imul edi, edi
inc edx
lea edi, [edi + ebx*4 + 0x7f874f65]
inc ecx
inc eax
dec ecx
btr edi, 0xa1
inc ecx
xor cl, 0x3b
inc ecx
push esi
dec ebp
xor edi, edx
dec edx
lea ecx, [edx*8 + 0x780f1a04]
inc edx
xor dword [esp + ebx*2 - 0x257e656a], edi
inc ecx
xchg edi, ecx
inc ecx
pop esi
inc ecx
bt edx, ecx
inc cx
shr eax, 0xe2
dec eax
bswap ecx
dec eax
arpl di, di
inc ecx
movzx eax, dl
inc ecx
mov edx, eax
inc ecx
cmovs edx, edi
dec eax
add esi, edi
inc ecx
neg ebx
inc esi
mov ebx, dword [ebx + edx - 0xb5]
imul dx
dec ecx
not ecx
shr al, 0xe1
inc esi
mov ecx, dword [ebx + edx*8 - 0x5a4]
inc esp
bts ecx, edi
jae 0x153c6f1
Function at 0xce53aa
Capabilities:
Encode data using xor

Disassembly:
dec eax
sar edi, 0xfe
mov word [ebx + edi], cx
inc ebp
mov eax, dword [esp + edi*2 - 6]
dec eax
cwde
dec esp
mov dword [esp + edi], edx
inc dword [esp + edi*2 + 0x22]
dec esi
lea esp, [edi - 6]
dec edi
lea edi, [edi + edx*2 - 0x7e683b7d]
inc esp
sub byte [esp + edi + 0x18], dl
inc ebp
xor eax, esi
dec eax
cdq
btr eax, 0x1b
jae 0x15570be
sbb eax, 0x2f22ff1b
neg edx
not edx
dec cx
rol eax, 1
call fcn.01468d0e
jmp 0x1472144
movzx ax, byte [ebp]
mov ecx, 0x61189b39
lea edx, [ecx*4 + 0x5032518b]
shr dl, 0xe7
mov cl, byte [ebp + ecx - 0x61189b37]
sbb edx, edx
push edx
or al, cl
jmp 0x151f0cd
jmp 0x143ade3
xor al, dl
sal dx, 0x28
mov ecx, edx
mov word [ebp + 2], ax
jnp 0xcd0de0
jbe 0x1562c6b
cmovp edx, dword [esp + edx - 1]
rol eax, 0xb
xor ecx, ebx
cwde
cbw
call fcn.01473717
dec esi
push edx
or dword [edi + 0x66e2b2b4], eax
push ebx
push eax
adc eax, ecx
or al, 0xb7
invalid
inc ecx
ror eax, 1
inc ecx
neg eax
inc ecx
rol eax, 1
dec ecx
sal edi, 0x2a
inc esp
sbb eax, edi
dec byte [esp + edi + 0x18]
inc ecx
neg eax
inc ecx
rol eax, 1
cdq
sar dword [esp + edi + 0x13], 0x2a
inc ecx
neg eax
inc esp
sub bl, al
ror word [esp + edi*2 + 0x12], 0x83
inc ecx
sbb eax, 0xcfa8630b
mov byte [esp + eax*2 + 0x19], 0xc
dec eax
inc edx
inc ecx
ror eax, 1
shr edx, 0xf5
inc ebp
bt edi, edi
dec esp
mov dword [esp + edi*2 + 0x20], esi
dec eax
lea ecx, [edi + 0x1c983712]
dec eax
mov dword [esp + edi*2 + 8], 0x4c993f34
inc esp
xor dword [esp + edi + 0x20], eax
dec esp
xor dword [esp + edi + 2], edi
inc cx
adc ecx, 0x8b4c9591
je 0x1557168
and byte [eax - 0x7f], cl
cmp al, 0x16
xchg ebp, eax
cld
adc dword [esp + eax*2 + 0x1b], esi
pop esp
cmp al, 0x1c
inc cx
sar ebx, 0xcb
dec ebp
arpl ax, ax
dec ecx
adc esi, eax
dec eax
mov dword [esp + edi*4], esi
ret 0x20
sahf
in eax, dx
dec dword [ecx + 0x54]
adc al, 0x97
mov dh, byte [eax + 0x587160cd]
xor dl, ah
add al, 0xbe
loope 0x1557199
movsx eax, word [esp]
mov ecx, dword [esi]
shr edx, 0x1f
lea esi, [edx + esi + 3]
jb 0x1538c65

Function at 0x1439bc2
Capabilities:
Authenticate hmac

Disassembly:
add bx, 0xb298
mov ebx, 0xc11c1aa8
jge 0x159b453
mov esi, 0xc11bc01
jns fcn.0158bff8
mov ebx, dword [esp + esi - 0xc11bbf1]
test esi, 0xfe3d72ab
mov si, 0x6b0a
not esi
jle 0x159b453
call fcn.0158bff8
adc dl, dh
ror byte [esp + eax*2 + 5], 0x24
xor bl, cl
btc edx, 0xbd
lea ecx, [esp + ecx + 8]
rol dword [esp + eax*8 + 4], 0x5c
add eax, dword [eax + ecx]
push edx
mov dword [ebp], eax
pop ecx
pop edx
pop edx
jmp edi

Function at 0x146ec4d
Capabilities:
Encode data using xor

Disassembly:
shr edi, 8
push 0x398f3a1e
xor edi, ebx
jmp 0x14b867f
shl byte [esp + 0x12], 0xc4
dec ecx
inc eax
dec eax
mov dword [esp + 8], 0xdb321e0b
xor edi, 0xe9af71bc
add word [esp + 0x1a], 0xaf15
shl dword [esp + 6], 0x8d
dec eax
dec eax
jmp 0xcc20e7

Function at 0x146f274
Capabilities:
Encrypt data using chaskey

Disassembly:
push ebx
mov ebx, ebp
push ecx
mov dword [esp], 0xf6bd091f
mov byte [esp + 1], 9
mov dword [esp], ebp
mov ebp, 0x16bb8c11
lea ebp, [ebp*4 - 0x39ce71d5]
jmp 0x1432be5
Function at 0x146f751
Capabilities:
Encode data using xor

Disassembly:
push edx
mov eax, dword [ebp]
mov cx, word [eax]
mov word [ebp + 2], cx
mov edx, dword [esi]
ror byte [esp + 3], 0x26
mov eax, dword [esp]
mov ecx, 0xe787e48f
xor edx, ebx
bswap edx
not byte [esp + 2]
xor edx, 0xe42ef1af
and dword [esp], ecx
jge 0x1540d66
btc ax, cx
ror edx, 2
neg byte [esp + 1]
seta al
inc edx
add cl, al
not al
xor ebx, edx
dec eax
neg cl
add edi, edx
neg eax
bts ecx, ecx
mov dx, word [ebp + eax - 0x6dc65600]
sub word [esp + eax - 0x6dc65602], 0x9c9b
neg eax
pop eax
adc ebp, 3
movzx ecx, byte [esi + 4]
sub eax, eax
sal eax, 0x5a
lea esi, [eax + esi + 5]
xor cl, bl
dec eax
dec ax
inc cl
ror eax, 8
ror eax, 0x1f
neg cl
imul eax, eax
not ax
adc cl, al
shl ax, 0xa7
sar eax, 0xac
ror eax, 0xdd
rol cl, 1
idiv al
lea eax, [eax*4 + 0x7e9b4e2f]
and eax, eax
adc cl, 0xa2
neg eax
lea eax, [eax - 0x6e4de063]
push eax
ror cl, 1
btr eax, 0x23
shl eax, 0x43
inc cl
or eax, eax
call fcn.00cc081d
call fcn.0156b86f
xor eax, ebx
bswap eax
mov ecx, 0x79299c11
xor eax, 0xff210384
xadd dword [esp + ecx - 0x79299c11], ecx
sal ecx, cl
bswap eax
pop ecx
not eax
movsx edx, cx
call fcn.00ccc39f
mov edx, 0xa439291a
jmp 0xcbc2a4
sub byte [esp + eax - 0x674e], 0x8e
mov dword [esp + eax*8 - 0x33a90], edi
ret 4

Function at 0x148d2f3
Capabilities:
Check http status code

Disassembly:
jnp 0x151380e
jle 0x148d280
das
salc
xor al, 0xc8
stc
out 0x25, eax
enter 0x64cc, 0xfffffffffffffff9
out 0x81, eax
cmp al, 0xc8
stc
out 0xf5, eax
mov byte [eax - 0x13151900], dh
ja 0x148d370
loopne 0x148d38c
mov ebx, 0x2e4b54ab
shr edi, cl
xor byte [ecx + 0x4fdbbc0d], ch
into
sbb eax, 0x4e7bf263
and ecx, dword [ebx - 0x6111c277]
mov eax, esp
add eax, edi
jl 0x148d350
hlt
xor ecx, edx
pop es
pop ebx
dec eax
ret
pop ebp
fstp qword [ecx]
and dl, 0xb0
ret 0x9410
inc ebx
push es
out dx, eax
mov bh, 0xb6
out 0x19, al
xchg ebp, eax
sub edx, 0xf7694979
and eax, 0x5bfd5b09
iretd
or al, dl
mov dword [esp], ecx
rol dword [esp], cl
mov word [ebp + 2], ax
movsx edx, byte [esp]
movzx eax, dx
mov eax, dword [ebp + eax*2 - 0xd6]
call fcn.00cc248b
pop ecx
pop eax
push cs
mov ch, 0x90
stosd dword es:[edi], eax
out 0x42, eax
jg 0x151387c
or dh, ch
or al, 0xbd
invalid
sti
outsd dx, dword [esi]
salc
cdq
cmp dword [esi - 0x465b1820], ecx
imul ecx, dword [esi + 0x7144e7e0], 0xe7e08e41
xchg esp, eax
int 0x55
ljmp 0xf9b3