joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa915ea
Capabilities:
Hash data using murmur3

Disassembly:
movzx edx, word [esp + ebp*2 - 0x13e4a]
inc ebp
mov eax, dword [ecx + ebp*2 - 0x13e54]
xadd dl, dh
dec eax
mov dword [esp + ebp - 0x9f2a], 0xff2c43a4
inc ebp
movsx ebp, ah
inc ebp
xor eax, edi
inc ecx
pop edx
bts ecx, 0x81
not edx
inc ecx
inc eax
inc ecx
movzx esi, dl
inc ecx
not eax
dec eax
inc ecx
inc ecx
xor eax, 0x248eaf0b
inc ecx
pop edx
jmp 0xbb77e1
call fcn.00afbe7a
add byte [eax], al
inc edi
je 0xbb783f
je 0xbb7860
imul ebp, dword [esi + 0x67], 0x65707954
push edi
add byte [eax + 0x2e1dfc16], bh
rol eax, 0xd
mov ecx, dword [esi]
lea edx, [eax + eax*8 - 0x4379b379]
bts eax, edx
movzx ax, byte [ecx + edx - 0x781f4062]
lea esi, [esi + edx - 0x781f4060]
mov word [esi + edx - 0x781f4062], ax
mov eax, edx
lea ebp, [ebp + eax - 0x781f4066]
lea ecx, [edx + edx*8 + 0x4fb8fe0b]
mov edx, dword [ebp + edx - 0x781f4062]
xor edx, ebx
add al, cl
jnp 0xcfc6bc
jmp 0xcd42a5
rol edx, 2
neg edx
neg eax
ror ax, 0xe8
cwde
ror edx, 1
rol ax, 0x69
xor ebx, edx
add edi, edx
jmp edi
ror cx, 0x4a
inc edx
jmp 0xc6c014

Function at 0xa98847
Capabilities:
Execute syscall

Disassembly:
rol edx, 1
shl cl, 0x45
push eax
bswap edx
xor eax, dword [esp + ecx - 0x62991e9c]
neg cl
adc edx, eax
lea eax, [ecx*4 - 0x1b591d77]
xor ebx, edx
xchg byte [esp + eax - 0x6f0b5c03], al
push eax
xadd ecx, eax
adc ebp, edx
and cx, cx
mov di, word [eax + edi - 0x62991e60]
sar word [esp + eax - 0x62991e58], cl
shl dword [esp + eax - 0x62991e60], 0x52
pop edx
pop edx
pop edx
jne fcn.00d0eefc
lea eax, [edx + edx*4 - 0x76cae8d5]
mov word [edi + edx*2 - 0x80000000], cx
sbb al, 0x25
mov dword [esp + edx*2 - 0x80000000], ebp
ret
bswap edx
mov dword [esp + ecx - 0x62991eca], eax
xor cl, byte [esp + ecx - 0x62991eca]
jne 0x7311f8
sysenter
push 0x249b5b95
pushfd
test dword [esp + 4], 0x280dd520
mov dword [esp + 4], 0x2fad9ad6
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00bda7a2
Function at 0xab563b
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
and ecx, 0x39996fbb
call fcn.00c1de94

Function at 0xab888a
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xca1e50bb
mov dword [esp], 0x1b2e0716
dec byte [esp]
jno 0x745e40
mov ecx, 0xbe094994
mov edx, dword [edi]
mov eax, 0x8fbbb3a7
rol ecx, 0x90
lea edi, [edi + ecx - 0x4994be05]
sal ecx, cl
dec ecx
xor edx, ebx
inc edx
sar cl, 0xa4
shl cx, 0x21
bswap edx
shl al, 0x82
bts eax, eax
push eax
not edx
bswap edx
not word [esp + ecx - 0x297c23fe]
and al, ah
inc edx
push ecx
and cx, 0x970d
xor ebx, edx
ror eax, 0xd5
sar word [esp + ecx*2 - 0x52f80612], 0x42
bts ecx, 0xa4
adc ebp, edx
movsx edx, al
xadd dword [esp + ecx*2 - 0x52f80638], edx
movzx ecx, byte [ecx + edi - 0x297c031c]
cwde
adc dl, ah
ja 0x747bcf
lea edi, [edi + edx*2 - 0x52f84705]
btr edx, 0x11
not word [esp + edx*2 - 0x52f84704]
add edx, dword [esp + edx*2 - 0x52f84702]
xor cl, bl
jmp 0xbfcdf5
lea edx, [eax - 0xa621274]
sub cl, 0x23
pop eax
xor cl, 5
sub cl, 2
ror cl, 1
inc byte [esp + 2]
sar byte [esp + 3], 0xe3
ror ax, 0xea
adc cl, 0x26
sar byte [esp], 0x85
xchg word [esp], ax
sar word [esp], 0xc4
xor bl, cl
sub esi, 2
or edx, dword [esp]
sal dl, 0xe1
adc al, dh
mov word [esi], cx
pop edx
jno fcn.00ab92a2

Function at 0xac65b9
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x31640b0
call fcn.00d69195
mov edx, 0xf1b59391
mov eax, 0x39828721
mov edx, dword [ebp + eax*2 - 0x73050e42]
bts ax, 0x2d
mov eax, dword [ebp + eax - 0x3982a71d]
jae 0xd0d6c1

Function at 0xae36b0
Capabilities:
Encode data using base64

Disassembly:
not edx
shr edx, 0x79
rol ecx, 1
inc eax
xor ebx, ecx
push edx
rol edx, 0xa
adc eax, 0x7b0d2601
adc ebp, ecx
add dx, word [esp + edx - 0x7400]
shr eax, 0xbd
movzx ecx, ax
mov dx, word [edx + edi - 0x741d]
sub ecx, 0xa48cec31
mov cl, byte [edi + eax - 1]
inc dword [esp + eax - 3]
call fcn.00cea47d
push edx
sub dword [esp + 3], edx
xor ebx, ecx
add ebp, ecx
pop eax
pop ecx
pop eax
jmp fcn.00d0eefc
xor eax, ebx
dec eax
or edx, ecx
neg ecx
mov dword [esp + ecx*2 - 0x5288ef9e], edx
not eax
and word [esp + ecx - 0x294477ca], cx
lea eax, [eax + ecx*2 + 0x5d117003]
rol byte [esp + ecx*2 - 0x5288ef9d], 0x83
sar edx, cl
bswap eax
xor ebx, eax
push ecx
shr edx, cl
jp 0xd14cfe
mov edx, 0xbcb9e40b
mov edx, dword [esi]
push 0xee9d6a3b
add esi, 4
shl word [esp + 2], 0x66
mov ecx, dword [esp]
call fcn.00d18ee8
adc esi, eax
inc edx
pop ecx
pop edx
pop edx
jg fcn.00b016e0
sar byte [esp + ecx - 0x45e79e9e], 0x46
rol edx, 1
dec eax
xadd al, cl
sal byte [esp + ecx - 0x45e79ef9], 0xc1
not edx
sete al
ror edx, 1
jmp 0xd590a8
dec eax
neg edx
and cx, 0x4ea4
not edx
push ecx
bswap edx
lea ecx, [eax + eax*2 - 0x68795555]
neg ecx
lea edx, [edx + eax - 0xcc0505e]
ja 0xa7702d
inc cl
js 0xba867a
xor ebx, edx
bt ecx, 0x8a
adc ebp, edx
mov dword [esp + ecx - 0x68795859], ebp
ret 0xc
Function at 0xb00265
Capabilities:
Execute syscall

Disassembly:
add esi, 4
movsx eax, cx
xor edx, ebx
neg edx
add edx, 0xb1da421
sar eax, 0xde
bswap edx
sbb ax, 0xa5bf
neg edx
cbw
call fcn.00c4b797
inc ecx
sar dl, 0x65
dec esp
mov dword [esp + eax - 0x8b], esp
dec ebp
arpl bp, bp
mov ecx, 0x4c3fd02e
dec ebp
add esi, ebp
inc ebp
movzx ebp, bx
dec eax
sal dword [esp + eax*2 - 0x116], cl
movzx ebx, word [esp + eax - 0x88]
rdtsc
inc esp
and dword [esp + ebp - 0x8c], edx
inc eax
add ch, bl
inc ecx
bswap edx
dec edx
lea edi, [edi + edx*8 - 0xbc6648]
inc ecx
setns ch
jno 0xb45013
bts ax, cx
xor ebx, edx
push eax
sar cx, 0xb
neg eax
add edi, edx
pop edx
jmp fcn.00b465bb
dec edx
add ebx, dword [esp + edx*2 - 0x2f1990]
inc edx
mov dword [edi + edx - 0x178cc4], eax
jo 0xba18c7
dec eax
bt ebx, ebp
inc ecx
mov dword [edx + edi - 0x178cc8], edx
inc ecx
or bl, 0xac
inc dx
sub dword [esp + edx - 0x178cc8], 0xf5e62ac
test dword [ebp + 0x1c], edx
adc byte [eax], al
mov eax, 0x358a5db6
sar ax, 0xaf
shr ax, 0x64
mov dx, word [ebp + eax*2 - 0x6b140000]
movzx ecx, al
lea ebp, [ebp + eax*2 - 0x6b13fffe]
sbb cx, ax
jno 0xbfe38d
mov ecx, 0x928d9f9a
mov edx, ecx
movsx eax, cl
mov dx, word [esi]
sub al, 0x1e
mov ax, word [esi + 2]
mov cl, byte [esi + 4]
jl 0x7469d8
mov edx, dword [esi]
mov ecx, 0xdab2c33e
jmp 0x7702d7
dec edx
lea ebx, [ebx*8 + 0x60097d0e]
xor dword [esp + ecx - 0x8831], eax
inc esp
xchg ecx, eax
dec ecx
sal esp, 0x7a
inc ecx
pop edi
dec eax
ror ebx, cl
dec eax
neg ebx
dec eax
arpl ax, ax
dec esp
add esi, eax
dec esi
lea edx, [ecx + eax*2 + 0x63119531]
push ecx
dec edi
lea ecx, [ecx + eax*4 - 0x220c6]
call fcn.00d1f7ff

Function at 0xb0122f
Capabilities:
Encode data using xor

Disassembly:
movzx eax, dx
mov dword [esp + eax*2 - 0x13850], 0x21291611
xor ecx, ebx
lea edx, [edx*2 + 0x79962627]
not ecx
lea ecx, [edx + ecx - 0x3c8dd9e6]
sub al, 0x9e
ror byte [esp + edx - 0x79955e74], 0x44
xor ecx, 0xb92bc0d
sub dword [esp + edx - 0x79955e77], eax
cdq
sbb edx, dword [esp + edx]
bswap ecx
adc eax, 0x4128dea1
jae 0xbbeffd
invalid
cwde
lea ecx, [ecx + eax - 0x3036d2bf]
rol dword [esp + eax - 0x7b2c], 0x3e
jbe 0xd89c80
dec edx
pop esp
jo 0xbbefb4
sbb ecx, dword [ebx + 0x17715761]
add edi, ecx
test al, 0x14
mov bl, 0xfa
lcall 0x73b4, 0xa769daa8
push edi
invalid

Function at 0xb0301b
Capabilities:
Authenticate hmac

Disassembly:
sal edx, 0x5c
not cl
mov dword [esp + eax - 0x5b5915eb], edx
dec dl
rol cl, 1
rol eax, 0x8a
sal byte [esp + eax - 0x6457ad6b], 0x27
xor bl, cl
lea ecx, [esp + ecx + 4]
mov ax, word [ecx + eax - 0x6457ad6d]
movsx ecx, dl
sub edi, 2
sub ecx, ecx
mov word [edi + ecx*8], ax
lea eax, [ecx*8 - 0x31f3f8cc]
sar edx, 0x35
sal eax, 0xb7
pop eax
jb fcn.00d0eefc
Function at 0xb2f37c
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], ecx
pop eax
pop eax
jle fcn.00c2e966
jmp 0xbcd262
mov ecx, dword [edi]
mov edx, 0x6f1e2898
neg dl
xadd dl, dh
lea edi, [edi + edx - 0x6f1e688c]
xor ecx, ebx
sal dl, 0x81
shl dx, 0x84
lea ecx, [ecx + edx*2 + 0x1b6bec17]
xor edx, edx
jno 0xd51b16
mov ebp, 0xe027ef11
mov ecx, dword [esi]
lea eax, [ebp + ebp*4 - 0x68ffb156]
cdq
ror edx, 4
adc esi, 3
xadd dl, ah
mov edi, ecx
adc ebp, 0x3d0f1911
mov ebp, esi
jg 0xcb963c
lea ebp, [ebp + edx - 0x726cee0c]
pop edx
bswap edx
sbb edx, edx
add cl, al
mov eax, 0x25a9b7a9
mov word [ebp + eax*2 - 0x4b536f52], cx
movsx ecx, al
sar al, 0x45
mov dword [esp + eax*2 - 0x4b536ffa], edi
ret
neg ecx
sub ecx, 0xd41ec398
not ecx
sub dl, dl
movzx eax, dx
sbb ecx, 0xeaa2c002
and al, ah
sar eax, 0x2e
rol ecx, 2
inc edx
add edx, 0x6949aa0
cwde
neg ecx
shr edx, 0x92
inc ecx
shl edx, 0xff
sub dx, 0xe78f
xor ebx, ecx
or eax, eax
ror eax, 0xf2
sal ax, 8
adc ebp, ecx
btc eax, edx
rdtsc
mov ecx, 0x3cb3a79f
lea esi, [esi + ecx - 0x3cb3a7a7]
lea ecx, [ecx + ecx + 0x269445bc]
mov dword [esi + 4], eax
mov dword [esi], edx
mov eax, ecx
movsx edx, al
jae fcn.00ab92a2
add edi, eax
add dl, dl
movzx cx, byte [ebp + ecx*2 - 0x15404]
mov al, byte [ebp + edx - 0x726cee0c]
jle 0xc29d43

Function at 0xb2f5b2
Capabilities:
Encode data using xor

Disassembly:
jmp esi
shl edx, 0xea
call fcn.00b55bfd
jecxz 0xb2f615
jns 0xb2f55b
mov dl, 0x8e
push 0x4d28757
invalid
inc esp
xchg byte [eax + 0x10], ch
xor ebp, ebp
sub byte [esi - 0x59], bl
invalid
dec edi
inc edi
lock xor ecx, dword [ebx + 0x6a017f]
jnp 0xb2f5d4
xchg ah, ah
lcall 0x9446, 0xe8177572
adc byte [edx + edx + 0x5d], ch
mov edi, 0x181e17af
xlatb
dec ebx
mov ebx, 0x5d4bfca6
wait
test al, 0xe8
lahf
cmpsd dword [esi], dword es:[edi]
xchg ebp, esi
invalid

Function at 0xb36cd2
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x99a7e295
sub dword [esp], 0xb1109606
mov dword [esp], eax
push 0x712ab817
shr byte [esp + 2], 0x66
dec ebx
jmp 0xb8b6c4

Function at 0xb36d93
Capabilities:
Encode data using base64

Disassembly:
movsx edx, al
sbb dx, dx
or edx, dword [esi + eax*4]
inc cx
neg ax
lea esi, [esi + eax*4 + 4]
ja 0xd35473
shr ecx, 0xce
mov dword [esp + eax*2], eax
xor edx, ebx
call fcn.00ccbf67
lea ecx, [ecx + ecx*2 - 0xe4c6754]
sub eax, 0x2d343318
bt edx, 0x3f
xadd dx, cx
or cx, dx
xor eax, 0xe503fe92
not eax
dec eax
or ecx, ecx
bswap eax
btr ecx, edx
xor edx, 0xa8fa522
rol eax, 1
sal ecx, cl
sub cl, 0x21
xor ebx, eax
neg cx
or ecx, ecx
adc edi, eax
jmp edi

Function at 0xb44d3d
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
ror ax, 1
dec ax
ror dword [esp + edx*2], 0xb4
xor ax, 0x258d
rol ecx, 0x23
and dword [esp + edx], edx
sbb ax, 0x5815
inc ecx
cmovns ecx, edx
not ax
or dl, cl
rol cx, 0x8a
jae 0x726d73
xor ebx, ecx
add ebp, ecx
movzx ecx, dx
bswap edx
lea edi, [eax + edi - 0x2800002]
mov dword [esp + eax - 0x2800000], 0x4b16c49a
cdq
movzx eax, word [eax + edi - 0x2800000]
shr dl, cl
ja 0xcaf62f
xor dl, ch
xor ax, bx
add ax, 0xe38
neg dx
sub ecx, ecx
xor ax, 0x22aa
jmp 0x751a9e
Function at 0xb573e5
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x4792b368], 0x92ab638c
sbb ecx, 0x8006210c
xor ecx, 0x8eb1ef17
sub dword [esp + eax - 0x4792b368], 0x8211588b
lea ecx, [ecx + eax - 0x4dae6c00]
pop eax
sub dl, dh
ror ecx, 1
btr ax, ax
xor ecx, 0x2d9b0d33
dec edx
bswap eax
call fcn.00744837

Function at 0xb59834
Capabilities:
Authenticate hmac

Disassembly:
neg eax
rol eax, 2
inc cl
mov dword [esp + 4], ecx
dec eax
push edx
call fcn.00cad8fe

Function at 0xb614a5
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx - 0x4cad66f8], eax
mov ecx, dword [edx + ebp - 0x4cad66f8]
cbw
call fcn.00783d38
js 0xb6144f
add al, 0x76
fstp qword [edi]
pop ss

Function at 0xb79b53
Capabilities:
Encode data using xor

Disassembly:
adc esi, eax
lea ecx, [ecx*8 + 0x3cb94289]
movzx ax, byte [edx + edi - 0x78000000]
mov cl, byte [edx + edi - 0x77fffffe]
call fcn.00bb8915
push edi
mov dword [esp + 4], 0x46377801
lea esp, [esp + 4]
call fcn.00af1ca3
add edi, edx
call fcn.00d53310
mov edx, 0x77b2fe2e
lea edx, [edx + edx*8 - 0x6575c5ea]
movzx ecx, dl
mov ecx, dword [ecx + ebp - 0xb4]
movzx eax, dl
lea ebp, [ebp + eax*2 - 0x164]
rol edx, 0x25
xor ecx, ebx
push edx
cwd
ror ecx, 1
neg eax
inc word [esp + 2]
shr dl, 0x41
not ecx
neg ecx
shl eax, 0x67
not ecx
dec word [esp + 2]
call fcn.00b7c729
push 0x8184f601
sub edi, 2
shr dword [esp], 0xb8
movzx edx, word [edi]
mov ecx, dword [esp]
xor dx, bx
bts ecx, 0x2f
movsx eax, byte [esp + ecx*8 - 0x40408]
rol dx, cl
sub dword [esp + ecx - 0x8081], eax
ror eax, 0x6c
adc cl, 0x36
xor dx, 0xdf9d
add dx, ax
xor word [esp + ecx - 0x80b8], ax
neg cx
xor dx, 0x9e3a
cbw
sub dx, 0x4807
xor bx, dx
lea ebp, [ecx + ebp - 0x7f4a]
mov word [ebp + ecx*2 - 0xfe90], dx
lea edi, [edi + ecx*2 - 0xfe94]
mov edx, dword [edi + ecx*8 - 0x3fa40]
inc ecx
ror dword [esp + ecx - 0x7f49], 0x3b
xor edx, ebx
or eax, eax
xor edx, 0xe929d05
ror edx, 2
or al, al
neg edx
cwde
push ecx
pop eax
ror edx, 1
sar cx, cl
dec edx
bts eax, eax
xor ebx, edx
shl eax, 0x8c
adc esi, edx
or ecx, eax
movzx edx, al
pop edx
jae fcn.00b6d6da
inc eax
rol eax, 1
sal edx, cl
xor ebx, eax
xor ebx, eax
ror dx, 0x4b
jae 0xb1f98b
mov al, 0xe6
xchg dh, dl
not ebp
add byte [0xed79d3], bl
pop edi
or edx, dword [edi]
jnp 0xb79c65
add cl, dh
les edx, [ebx - 1]
jno 0xb79c55
push cs
fild dword [eax]
invalid
Function at 0xb7bbf1
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [ebp + ecx - 0x71c4c06a]
mov eax, 0x732c9196
lea ebp, [ebp + eax - 0x732c9194]
shr edx, cl
shr eax, 0xf5
mov dword [esp + eax - 0x399], eax
mov dword [ebp + eax*2 - 0x732], edx
movsx ecx, ax
xchg byte [esp + eax - 0x398], cl
lea edi, [edi + eax*2 - 0x736]
and eax, ecx
mov edx, dword [edi + eax*4 - 0xc04]
add ecx, dword [esp + ecx - 0x303]
xor edx, ebx
xor cl, byte [esp + eax - 0x2fc]
cmova eax, dword [esp + eax*8 - 0x1804]
btc eax, 0x33
ror edx, 3
not edx
btc ecx, ecx
shr ecx, 0x55
lea edx, [ecx + edx - 0x6aadfb14]
shr ecx, 2
shr dword [esp + ecx - 0x1f], 0xce
xor edx, 0xdba718a9
rol edx, 3
not edx
inc edx
or cl, 0x1e
or ecx, ecx
sar word [esp + ecx*2 - 0x7a], 0x6d
bswap edx
neg dword [esp + ecx - 0x3d]
adc word [esp + ecx*4 - 0xf4], cx
mov dword [esp + ecx*2 - 0x7c], 0xb58770bd
not edx
jp 0xb476a7
xor edx, 0x2822962d
bswap eax
xor ebx, edx
add esi, edx
cwde
mov dword [esp + ecx*2 - 0x7c], esi
ret 4

Function at 0xb8898c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xb93928
sbb ecx, 0x89822901
and eax, edx
bswap ecx
cmovnp eax, dword [esp + eax - 0x1a08fffb]
dec ax
sar eax, 0x86
neg ecx
ror ecx, 3
add dword [esp + eax*2 - 0xd047f9], eax
pop edx
xor ebx, ecx
add ebp, ecx
add edx, 0xe080cf29
setge dl
mov dword [esp + eax*2 - 0xd04800], ebp
ret 4
shld edx, eax, cl
mov eax, 0x3c334d86
movzx ecx, al
mov dword [ecx + edi - 0x86], edx
btr ax, 0xf
lea esi, [esi + eax - 0x3c334d8a]
mov dword [esp + eax - 0x3c334d86], ecx
shl word [esp + eax - 0x3c334d7d], cl
lea edx, [eax*2 - 0x3dd989e5]
mov ecx, dword [eax + esi - 0x3c334d86]
shr eax, 0xc1
xor word [esp + eax - 0x1e19a6c0], ax
xor ecx, ebx
sub byte [esp + eax*2 - 0x3c334d85], al
jnp 0xb8dc84
aaa
xor eax, 0x6fab0f8a
push 0xfffffffffffffff8
mov edx, esi
lodsb al, byte [esi]
adc dword [ecx - 0x54], esi
push dword [edx]
dec edx
jbe 0xb939bf
mov eax, 0xec8e2fbf
jo 0xb9392b
sti
sbb ecx, dword [ecx - 0x3fb9f072]
jb 0xb939fb
and eax, 0x72bc8cf0
mov ebx, 0x418aaf4d
push esi
sal dword [ebx + 0x57], 1
mov dword [0x8cebcf81], eax
retf
invalid
xor eax, 0xfd3f7921
and dword [eax - 0x6c6e3f54], edx
add byte [eax + 0x33adbfc0], ah
xchg esi, eax
inc eax
aam 0x72
push 0x65
inc ecx
inc eax
add eax, 0x95c09e5c
push ecx
aaa
and al, 0x69
aas
invalid
Function at 0xb9436f
Capabilities:
Encode data using base64

Disassembly:
dec ecx
xor ebp, 0xe03885ad
xor dword [esp + ecx], ebx
inc esp
movsx edi, ax
inc ecx
pop edi
inc ecx
or cl, ah
inc esp
movsx ebx, dh
inc cx
sub edx, ebx
dec eax
arpl bx, bx
dec esp
adc esi, ebx
dec eax
mov eax, dword [edi + ecx*2]
inc cx
dec esp
sar cx, 0x46
inc ebp
mov ah, byte [esp + edi - 0x357f7]
rol esi, 1
inc ebp
movsx edx, bx
dec eax
lea edi, [edi + ecx*2 + 0xa]
dec esp
lea eax, [ebp*8 + 0x6797ca0a]
inc cx
sal edx, 0x6e
inc ecx
sbb ebp, 0x6f06f039
inc esp
mov byte [eax + ecx], ah
dec ecx
adc ecx, esi
jmp ecx
pop ecx
pop ecx
jae fcn.00b44bdd
add eax, 0xd33f83b3
not edx
mov dword [esp + eax - 0x76f11b48], eax
xadd word [esp + eax - 0x76f11b47], ax
lea edx, [edx + eax - 0x7f81aca1]
xor ebx, edx
add edi, edx
mov edx, dword [esp + eax - 0x76f1f118]
mov dword [esp + eax - 0x76f1f11b], 0xebb88cb3
ror eax, cl
mov bp, word [ecx + ebp - 0x7c049fa3]
bts ecx, 0x18
jae 0xb7acb2
mov ecx, 0x8b937f81
mov ebx, 0xb58f47b9
dec cx
dec ecx
sub ecx, 4
inc ecx
mov edx, dword [ecx]
inc ecx
xor edx, edi
dec esp
lea ebx, [ebx*8 - 0x4a708fca]
ror edx, 2
dec edx
inc ecx
and ebx, ebx
dec ebx
lea ecx, [ebx + ebx - 0x1adac161]
bswap edx
dec edx
lea eax, [ebx + ebx*8 - 0x41756d5c]
dec eax
bt ecx, 0x95
lea edx, [edx + ebx*8 - 0x228c55b1]
mov ebp, 0xab2a5e96
inc esp
movzx edx, cl
inc esp
mov esp, ebp
inc ecx
push edi
inc eax
movsx esi, ch
dec ecx
cmovae ebx, esp
xor dword [esp + ebx*2 - 0x40120b70], edx
inc esp
movzx ebp, bp
inc esp
xor esp, ebp
dec ecx
neg edx
inc ecx
pop edi
dec eax
arpl dx, dx
dec eax
cwde
sbb esi, ebx
dec eax
neg ebp
dec esp
add esi, edx
inc ecx
xor al, ah
dec ebp
lea ecx, [ecx + ebx*2 - 0x40120b72]
inc ecx
sets dl
jg 0xba6367
inc edx
movzx ebx, word [ebx + ecx - 0x200905b8]
inc ecx
push ebx
inc cx
xor ebx, edi
cwde
shr cx, 0xa8
inc cx
neg edx
inc cx
sbb ebx, esp
cdq
dec eax
xor dword [esp + eax - 0x84c], eax
jbe 0x76e728
ror bx, 1
jmp 0xd03db0
inc esp
mov byte [esp + eax*4 - 0x2130], ch
neg bx
sar dword [esp + eax - 0x848], cl
not bx
neg bx
dec edi
lea eax, [esp + edx - 0x2aeebeed]
inc sp
xor edi, ebx
dec eax
lea ebx, [esp + ebx + 8]
pop eax
inc esp
mov ebx, dword [eax + ebx - 0x6209a596]
inc ecx
mov ebx, eax
dec edx
lea edi, [edi + edx + 0xfefc]
jmp 0xccb5dc

Function at 0xb9ccc5
Capabilities:
Execute syscall

Disassembly:
dec esi
mov dword [esp + edx - 0x3306], edi
dec eax
shr ecx, 0xe2
inc esi
movsx ebx, word [esp + edx*4 - 0xcc4f]
inc cx
ror esp, 0x6d
inc esi
xor dword [esp + edx - 0x3306], eax
dec eax
mov dword [esp + eax - 0x11], edx
dec esi
mov edi, dword [esp + edx - 0x3306]
call fcn.00a844a4
sysenter
push ebp
mov ebp, 0x87b2fe84
mov ebp, dword [esp + ebp + 0x784d017c]
mov dword [esp], 0xe90ab501
call fcn.00af1ca3
Function at 0xb9ff66
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
and al, 1
sub dword [eax + esi*4 + 0x246cc1d8], edx
add dword [ecx + eax*4 - 0x2f], eax
xor esi, edi
xchg esp, eax
xor dword [ebx], esi
fld dword [ebx]
ret 0xf903
bt ecx, edx
xor bx, ax
mov dword [esp + ecx - 0x3d0cd81b], edx
lea edi, [edi + edx - 0x5aff3026]
mov word [edi + ecx*2 - 0x7a19b036], ax
or edx, 0xf500c636
mov eax, dword [ebp + ecx*2 - 0x7a19b036]
rol cl, 0xc1
sal dword [esp + ecx - 0x3d0cd82e], 0xf4
dec dword [esp + ecx*2 - 0x7a19b06c]
lea ebp, [ebp + ecx - 0x3d0cd832]
or ecx, ecx
xor eax, ebx
xor eax, 0x613ca72a
shr ecx, 0x31
call fcn.00ae2c7f
aam 0x20
jns 0xb9ff41
ret 0xc90b
in eax, 0x45
mov edx, 0xc932d638
fldcw word [eax]
pop es
or ecx, dword [ebx]
and bh, al
wait
pop esi
sub dword [edx], esi
pop es
jae 0xb9fff8
or al, 0xd9
js 0xb9ffa7
sub al, 0x95
in al, 0x78
xchg dword [ebx + edi*4 + 0x19be38f3], ebp
jbe 0xb9fff8
pop es
cli
xchg edi, eax
dec esi
in al, dx
cmp byte [ebx - 0x12329183], ch
scasb al, byte es:[edi]
push 0xff4a4997
in eax, 0x2f
pop es
inc esp
and eax, 0xa7f02462
lahf
lds edi, [eax - 0x6da9ce47]
push 0xffffffffffffffd4
scasd eax, dword es:[edi]
cmp byte [ebp - 0x5320acb8], bl
insb byte es:[edi], dx
invalid

Function at 0xba4358
Capabilities:
Authenticate hmac

Disassembly:
inc edi
mov ebp, dword [ecx]
inc ecx
movsx edx, ah
inc ebp
xor ebp, edi
inc ecx
mov eax, esp
inc ecx
ror ebp, 2
pop ebx
inc ecx
bswap ebp
inc ecx
movzx ecx, ah
dec ecx
lea ebx, [esp + esi*4 - 0x3e4047d]
push ecx
inc ecx
inc ebp
dec cx
rol dl, 0x65
not dl
inc ecx
not ebp
inc dx
xor dword [esp + 5], eax
inc edx
ror byte [esp + 7], 0x22
dec esi
or dword [esp], edi
jmp 0xcd839b

Function at 0xba810c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, 0xa5a4d286
inc eax
sub edx, 0xcd9f5820
shl dword [esp], cl
xor dword [esp], eax
xor edx, 0xad147185
sar ecx, cl
xor byte [esp], ch
xor ebx, edx
ror eax, 0x34
xchg word [esp + eax - 0x59aecb71], ax
sub cx, 0x7998
add ebp, edx
cwde
mov dword [esp + eax - 0x65f9], ebp
ret
sub ax, ax
lea edi, [eax + edi - 0x2eabfffe]
ror eax, 0xb5
add eax, eax
shr dl, cl
mov dword [esp], eax
btr eax, eax
mov word [edi], dx
lea eax, [eax - 0x8ea67ff]
movzx ecx, al
dec cl
mov edx, dword [esi + ecx - 0xea]
lea esi, [esi + ecx*8 - 0x74c]
xor edx, ebx
rol ecx, cl
sal dword [esp + ecx*8 - 0x1d4000], 0x50
push eax
bswap edx
and byte [esp + ecx - 0x3a800], ch
pop ecx
inc edx
dec dword [esp]
jns 0xd13566
mov eax, 0x94b28cb9
lea ecx, [eax*4 - 0x1fc7769]
mov edx, ecx
mov eax, dword [ebp + ecx - 0x50cdbb7b]
inc cx
and edx, edx
mov ecx, dword [ebp + ecx - 0x50cdbb78]
not edx
jp 0xafbdbf
Function at 0xbae2a9
Capabilities:
Encode data using base64

Disassembly:
dec ebx
call fcn.00bd4e65
jb 0x75c425
mov ecx, 0xc3038d8c
movsx edx, cx
sub cx, 0x772b
mov ecx, dword [esi]
ror dx, 0x85
adc esi, 4
xor ecx, ebx
lea eax, [edx*4 + 0x7fb4e403]
sub ecx, 0x470aea1c
cwde
neg edx
xor ecx, 0x19910c18
cwde
ror eax, 0x15
ror ecx, 3
sar edx, 0x1e
xadd eax, edx
lea ecx, [ecx + edx*2 - 0xb1223af]
rol al, 0xc2
bswap edx
rol ecx, 1
sal edx, 0x3a
sub ax, ax
and edx, eax
xor ebx, ecx
xchg edx, eax
add edi, ecx
lea ecx, [eax - 0x24e5684a]
neg dx
add cl, dh
movzx ecx, byte [esi + edx*8 - 0x1d680000]

Function at 0xbb7e2a
Capabilities:
Encode data using base64

Disassembly:
neg byte [esp + ecx*2 - 0x7ffffffd]
neg edx
or eax, 0xf11e4c11
rol edx, 2
dec cx
lea edx, [edx + ecx*2 - 0x5c65fce5]
dec dword [esp + ecx - 0x4000ffff]
not eax
xor ebx, edx
pop ecx
add ebp, edx
add ecx, ecx
movzx edx, al
jb 0xd6ff33
jo 0xbbf1d7
bswap edx
dec edx
mov dword [esp + ecx - 0x40000000], 0x401fee09
jmp 0xaeffdc
mov cx, word [edi + ecx - 0x348d2524]
push eax
inc al
js 0xd69098
mov eax, dword [edi + eax*2 - 0x48305dc]
shr dx, 0xed
sbb edx, edx
lea edi, [edx + edi + 4]
inc dx
not edx
shl ecx, 1
movzx ecx, byte [esi + ecx*2 - 0xff7040]
lea edx, [edx*8 - 0x87f50e7]
jne 0xb476a7
lcall 0x1020, 0x42bdbf7d
sahf
jge 0xd6ff22
mov ebp, 0x9e102042
fucompi st(5)
loope 0xd6ff8b
push eax
mov al, byte [0x5fe013b6]
and byte [edi + 0x41203698], dl
sbb dword [ecx], ebx
mov al, 0x3d
pop edi
cmp ecx, 0x9ed3dfc2
mov ch, 0xc3
mov al, byte [0x72f217de]
mov al, byte [0x75a2f57]
push edi
das
pop edx
pop es
dec ecx
and byte [ebx - 0x13], bh
rcr edi, 1
fcmovne st(0), st(1)
jbe 0xd6ff61
daa
adc ah, bh
add byte [eax + 0x1ed6e48], 0x3d
mov dword [0xd31e0d04], eax
popal
dec esi
push es
std
std
sbb cl, byte [eax + eax - 0x41]
jnp 0xd6ffdc
add eax, esp
add dword [ebx + 0x7e00fc41], esp
sbb bl, cl
or eax, 0x4e61ff41
mov ch, 0x89
add ch, bh
invalid
and dl, dl
neg edx
btc edx, 0xa8
cwd
rol ecx, 2
mov dword [esp + eax - 0x1346ffff], eax
xchg dx, ax
sub ax, word [esp + eax*4 - 0x4d1bfffc]
xor ecx, 0xed0b37ab
or al, 8
and byte [esp + edx - 0x75f4fffe], dh
xor ebx, ecx
add ebp, ecx
mov eax, dword [edi + eax - 0x13460008]
mov ecx, dword [edi + edx - 0x75f4fffb]
call fcn.00c21013
mov cx, word [edi]
mov dx, word [edi + 2]
mov eax, 0x703f10b6
lea edi, [eax + edi - 0x703f10b4]
btc ax, ax
sar eax, 0xc1
adc ax, ax
add cx, dx
lea edx, [eax*8 + 0x5bafd0aa]
sar eax, 0x66
add dl, ah
mov word [edx + edi - 0x1ca858d6], cx
sar ax, 0xe4
shl eax, 0xb0
lea esi, [esi + eax - 0x7c40004]
adc edx, edx
mov ecx, dword [esi + eax*2 - 0xf880000]
xor ecx, ebx
bswap edx
dec dx
lea ecx, [ecx + eax*2 + 0x27017003]
xadd al, dl
inc eax
lea edx, [edx + edx*2 - 0x6d79677e]
ror ecx, 3
not eax
bswap ecx
ror al, 0x83
xadd dl, al
ror ecx, 2
bt eax, edx
xor ebx, ecx
bt edx, edx
shl edx, 0x93
adc ebp, ecx
btr ax, dx
cdq
jmp ebp

Function at 0xbc370c
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, 0x271c1c3e
lea esi, [esi + ecx - 0x271c1c3a]
mov dword [esp + ecx - 0x271c1c3e], ecx
mov edx, ecx
add dword [esp + edx - 0x271c1c3e], edx
xor eax, ebx
jmp 0xcfc4bf