joyce8/EMBER2024-capa huggingface dataset:
Function at 0xda0165
Capabilities:
Encode data using xor

Disassembly:
dec ecx
inc eax
neg eax
sar dx, 0x49
inc eax
bswap eax
rol ecx, cl
btc dx, cx
ror eax, 1
or dword [esp + ecx - 0x18d903e6], edx
xadd dl, ch
jne 0xed9535
shr byte [edx], 0xcd
add ebp, 4
mov dword [esp + 8], 0xe2185985
add dword [esp + 8], ecx
xor eax, ebx
dec eax
mov dword [esp], ecx
inc word [esp + 3]
bswap eax
movsx edx, cx
jge 0x966b85
jle 0xda0134
out dx, al
in al, 0xef
sbb byte [edi], dh
movsd dword es:[edi], dword [esi]
xchg esp, eax
fsub dword [esi + 0x10]
inc esi
inc ebp
xchg esp, eax
fsub dword [esi - 0x10]
dec dword [ebp + 0x3866d894]
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
xchg esp, eax
fsub dword [esi + 0x10]
dec edi
lodsd eax, dword [esi]
cmp byte [edi + 0x66d894a5], ah
adc byte [edi - 0x53], cl
xchg esp, eax
fsub dword [esi + 0x18]
pop es
and eax, 0x9066d894
pop es
xor eax, 0x8066d894
or byte [ebp - 0x2dbc7fa6], dh
je 0xda01a6
mov ecx, 0xdd5994a
and esi, ebp
add eax, ecx
or edi, esi
fimul dword [edx]
xor byte [ebx - 0x3c68df4c], 0x4e
dec esp
call 0xa6ce44d6
invalid
dec eax
add dl, 0xbe
setb cl
neg eax
imul dx, word [esp + ecx*2 - 0x31b3ebfa]
setno cl
inc cl
xor eax, 0x28bb8b30
shr word [esp + ecx - 0x18d9f5f8], cl
btr ecx, 0x81
or dl, dl
neg eax
sar ecx, 0x1c
and dl, 0x3e
xor ebx, eax
bts ecx, 0x89
shl edx, 0xc9
jp 0x9c1691

Function at 0xdaffd0
Capabilities:
Authenticate hmac

Disassembly:
xor cl, dl
pop eax
ror cl, 1
sub cl, dl
mov eax, 0xdd33b934
ror dl, 0xe2
xor dword [esp + 8], edx
xor bl, cl
neg eax
lea ecx, [esp + ecx + 0xc]
sal word [esp + eax*2 - 0x45988d97], 0xea
cwde
movzx ax, byte [ecx + eax*8 - 0x23660]
mov cx, ax
inc dword [esp + 3]
shl dword [esp + 5], 1
movzx cx, cl
movsx eax, dx
inc dx
add dl, byte [esi + 2]
xor byte [esp + 8], ah
and cl, dl
lea edx, [eax + eax*4 + 0x63051f85]
xor cl, al
shr byte [esp + edx - 0x63051f7b], 0xa4
sub eax, eax
mov word [esi + eax*4 + 2], cx
call fcn.00947645

Function at 0xdb8342
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
bt edx, edx
pop ecx
pop eax
jae fcn.00ee70d9
inc esp
mov ebp, dword [esi]
mov edi, 0xebb7dc15
movzx edx, di
mov ebp, edi
inc esi
movzx eax, byte [edx - 0xdc16]
inc esp
movsx ebx, dx
inc sp
xchg edi, ebx
inc ebp
xor al, dl
or edi, 0xb639bf9a
inc ecx
not al
movzx eax, dx
inc esp
movsx esi, dl
dec ecx
adc ebp, esi
inc ecx
inc al
movsx ebx, bp
dec eax
lea ecx, [edi + 0x2aa2001c]
inc ecx
mul bl
inc ecx
not al
dec esp
lea ebx, [ebx*8 + 0x6a32d238]
dec eax
dec ebp
inc ecx
dec al
dec ecx
shl esi, cl
inc cx
btc esi, ebx
inc ebp
movzx edi, bx
inc ecx
xor al, 0x16
inc ecx
rol al, 1
bts edi, ecx
inc cx
sbb edi, 0xd3491036
test byte [ecx - 0x80], 0xd0
and byte [ebp + 0x32], al
ror byte [ecx + 0x2b], 1
invalid

Function at 0xdc790c
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0
inc edx
mov dword [esp + 0xc], ecx
shr bp, 0xa
movsx ebx, dx
mov dword [esp + ebx*2 - 2], edi
inc ebp
adc esi, ecx
Function at 0xdceb52
Capabilities:
Encode data using base64

Disassembly:
push edi
xor eax, 0x425293e
inc eax
movsx ecx, bh
inc ecx
mov ebx, 0x52344fb0
dec ebp
xadd ebx, ebp
adc eax, edi
inc ecx
mov edi, 0x7b106783
bswap eax
inc ecx
inc ebp
push edi
dec esi
lea eax, [edi + esi*4 + 0x5237ea3]
dec esi
mov dword [esp + ebp - 0x52344fa1], edx
dec ebp
lea edx, [ebx - 0x16fb5ee6]
jo 0xea1320
dec ecx
sal eax, cl
inc edx
xor dword [esp + ebp - 0x52344fa1], eax
inc ebp
sub esi, edx
inc cx
rol esi, cl
inc edx
add dword [esp + ebp - 0x52344fa5], 0x6308c725
dec esp
mov edx, dword [esp + ebp - 0xc743]
call fcn.00df425f
pop ecx
dec edx
mov dword [esp + ebp*4 - 4], ebp
rol eax, 2
jmp 0xe8bdbf
jmp 0x9ad70f

Function at 0xdd4c86
Capabilities:
Encode data using xor

Disassembly:
dec edi
lea ebp, [esi + ebx*8 - 0x4a48dc57]
dec esi
mov dword [esp + edi*2 - 0x1673461a], esi
dec eax
arpl bp, bp
inc ecx
pop edi
dec esp
add ecx, ebp
inc sp
mov edi, dword [eax + esi - 0x7bff]
bts edx, 0x30

Function at 0xdd6459
Capabilities:
Encode data using xor

Disassembly:
and ecx, ecx
bswap edx
or ecx, eax
rol edx, 1
sub edx, 0xfb150595
sal ax, 0xae
bswap edx
mov dword [esp + eax - 0x73ea8000], eax
shl ecx, 0xaf
sbb edx, 0xa191d59b
xor edx, 0xc10d7a9a
sub dword [esp + eax - 0x73ea7ffc], eax
call fcn.009d1629
mov ecx, 0x1aaae527
bt ecx, ecx
lea eax, [ecx*8 + 0x47a6fa07]
mov edx, dword [ebp + ecx - 0x1aaae527]
call fcn.00d84a02
jb 0xdd647d
jmp 0xdd64f4
cmp esp, dword [ecx + ecx*2 + 0x26e5fc4c]
xchg ebx, eax
mov byte [0xc67114da], al
xchg ebx, eax
mov byte [0x46182cda], al
inc esi
xchg ebx, eax
mov byte [0xe0050da], al
xchg ebx, eax
mov byte [0x1e8df0da], al
xchg ebx, eax
mov byte [0x86e810da], al
xchg ebx, eax
mov byte [0x8e1948da], al
xchg ebx, eax
mov byte [0xe7fd1cda], al
fiadd word [ecx]
jg 0xdd6506
ret

Function at 0xdd7324
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor eax, 0x9ab1dfbd
bt edx, edx
btc cx, 0xbb
bswap edx
rol eax, 3
neg edx
sar cl, 0xa3
lea eax, [edx + eax - 0x14f2ab4a]
call fcn.00e3964b
xor edx, 0x87a233b5
rol ax, 0x6a
mov dword [esp + ecx - 0xfdca], ecx
xchg dword [esp + ecx*2 - 0x1fb94], ecx
rol edx, 2
lea edx, [edx + ecx*2 - 0x3d9ddd3d]
lea eax, [ecx + ecx*2 + 0x778415a1]
btr ecx, ecx
xor ebx, edx
sub ax, 0xac17
and ecx, eax
jg 0xe0a3b1
mov edx, 0xc2066611
mov eax, edx
sal edx, 0xa7
mov eax, dword [edx + edi - 0x3330880]
sub edx, edx
mov ecx, edx
cmovl ecx, edx
xor eax, ebx
btr cx, dx
setb dl
adc ecx, edx
lea eax, [eax + edx + 0x7c9f7c28]
and edx, 0x6235c806
neg eax
add dl, 0xb3
adc dx, 0x4f90
jg 0xce7249

Function at 0xde39af
Capabilities:
Encode data using base64

Disassembly:
push 0x7ebc6186
lea esp, [esp + 0x28]
jne 0x92a545
pop edi
Function at 0xdf2009
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions

Disassembly:
pop edx
sub eax, 0x5299bd27
neg eax
not eax
mov ecx, 0x5fa55236
sar cl, 0x65
xor ebx, eax
lea edx, [ecx*2 - 0x1554d24c]
add edi, eax
bts edx, edx
movzx edx, word [esi + ecx - 0x5fa551fd]
movzx eax, cx
and eax, ecx
lea esi, [ecx + esi - 0x5fa551fb]
rol al, 0x45
sar ecx, cl
xor ecx, ecx
xor dx, bx
add ecx, ecx
bts ecx, 5
sub ecx, ecx
sbb dx, 0x7619
shl al, 0xe6
rol eax, 0x8f
imul eax, eax
rol dx, 1
shl al, 0xa3
call fcn.00e6ff41
mov eax, 0x9782fab9
mul eax
mov eax, dword [ebp + edx - 0x59abc6c9]
mov dx, word ss:[eax + edx - 0x59abc6c9]
mov eax, 0x48924999
jno 0x99aa9e
lea ebp, [ebp + eax - 0x48924997]
bts ax, 0xbc
mov word [ebp + eax - 0x48925999], dx
movsx ecx, al
sub ax, cx
dec cl
mov edx, dword [esi + eax - 0x48925a00]
rol cx, 0x6e
shl ecx, 0x90
shl ecx, 0x48
lea esi, [esi + eax - 0x489259fc]
xor edx, ebx
lea eax, [eax*8 + 0x6f881c80]
inc ecx
shl eax, cl
sbb edx, 0x5aa29593
xor edx, 0x7da74190
push eax
ror edx, 2
inc cx
bt eax, eax
btr cx, 0xad
sbb edx, 0x53831620
shr dword [esp + eax - 0x6835d900], 0x39
bswap eax
xor edx, 0x71af082
sar dword [esp + eax*2 - 0x1b26ad0], cl
xor ebx, edx
mov byte [esp + eax*2 - 0x1b26ad0], al
add edi, edx
mov dword [esp + eax - 0xd93568], edi
ret

Function at 0xdf9ea4
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions
Parse pe header

Disassembly:
movzx ecx, al
mov word [eax + ebp - 0x381b208c], dx
sbb byte [esp + eax - 0x381b208a], ch
jnp 0xe0b223
invalid
inc cl
mov dword [esp + edx*2 - 0x4560e316], edx
cbw
neg cl
mul edx
shl word [esp + edx*2 - 0x45609dc9], 0xe5
inc cl
xor edx, 0x6494018d
sbb word [esp + edx - 0x46244f66], dx
not cl
mul dword [esp + edx - 0x46244f68]
neg al
neg cl
xchg word [esp + eax - 0x381b123e], ax
xor bl, cl
add dl, 0x89
dec ax
lea ecx, [esp + ecx + 4]
movzx dx, byte [ecx + eax - 0x381b208a]
jnp 0xc44b79
xadd byte [esp + eax*2 - 0x70364113], ah
movzx ax, byte [ebp + eax - 0x381b128c]
inc ecx
lea edx, [ecx + 0x2a0fb9b2]
mov cl, byte [ebp + ecx - 0x8b]
and edx, 0x59a167a0
sub dl, 0x20
not al
pop edx
bt edx, 0x10
or edx, 0x6405143e
not cl
call fcn.00d26ea3
xchg ah, al
inc byte [esp + ecx - 0xfc91]
not edx
rol edx, 1
shl dword [esp + ecx - 0xfc93], cl
sal eax, cl
inc dword [esp + eax - 0x27f80000]
xor ebx, edx
push eax
add ebp, edx
mov edx, eax
mov dword [esp + ecx - 0xfc93], ebp
ret 4
Function at 0xdfc217
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
xadd dword [esp + ecx*2 - 0x1d4baf20], edx
cmovs ecx, dword [esp + ecx*2 - 0x1d4baf20]
adc ebp, 0xfffffffb
shr byte [esp], 0xc2
dec cl
xor eax, ebx
sub dx, 0xfb9d
jbe 0xf11cbb
ret
sete byte [esp + 2]
imul edx, edx
add al, cl
mov ecx, 0xea5d790
mov word [edi + edx - 0x374365fd], ax
mov eax, 0x32d7e84
mul eax
lea edi, [edx + edi - 0xa1908]
ror edx, cl
cdq
sar ax, 0x49
mov eax, dword [ebp + ecx*2 - 0x1d4baf24]
ja 0x931e2c
popfd
lea eax, [edx + edi + 0x558e1622]
cwd
pop edx
lea esi, [ebx*8 + 0x539c18b2]
pop edi
jmp 0xf3738c
mov ecx, 0x8f841cbf
movzx edx, cx
movzx ax, byte [edi + edx*8 - 0xe5f8]
mov dword [esp + edx*8 - 0xe5f8], ecx
not edx
mov cl, byte [edi + 2]
dec word [esp + 2]
ror edx, 0xd6
and dx, dx
and al, cl
mov ecx, 0x7abb08f
add dl, 0x3b
not al
xor ecx, dword [esp + ecx - 0x7abb08f]
ror dx, 0x6c
shr dl, 0x27
movzx ax, al
or ecx, 0xbe354db0
sar byte [esp + 3], 0x84
sbb cx, dx
mov cl, byte [edi + 4]
js 0xccb3ee
dec ecx
and ebx, esi
dec esp
adc ebx, esp
shr eax, cl
dec eax
sub ebp, ebp
inc ecx
mov dword [ebx + eax*2], edx
inc sp
xadd eax, eax
inc cx
bts esi, ecx
dec eax
cdq
dec ecx
or ebx, ecx
jmp ebx
call fcn.0095e11a
lea ebp, [ebp + esi - 0x4ee7fffc]
not cl
and esi, ecx
sal ecx, cl
mov esi, edx
mov eax, ecx
mov edx, ecx
add dl, cl
je 0xec3c91
sub ebp, 4
mov edx, 0x15044e80
mov ecx, edx
sar dl, 0xc6
mov eax, dword [ebp + edx*2 - 0x2a089dfc]
not dl
btc dx, 0x2a
xor eax, ebx
xchg ecx, edx
ror eax, 3
inc eax
or dl, 0x3b
sbb dl, cl
neg eax
not edx
bswap eax
xor eax, 0x7bbbb617
xor ebx, eax
add esi, eax
rol cx, cl
ror dx, cl
btr ecx, 0x9c
lea ebp, [ebp + ecx*2 - 0xa092805]
movzx eax, dl
sub ecx, edx
shl al, 0x27
mov al, byte [ebp + ecx*2 - 0x34124f62]
push ecx
bts cx, dx
inc dx
xor al, bl
shr dx, 0xe7
dec al
ror al, 1
and cx, word [esp + ecx - 0x1a0927b3]
dec al
rol al, 1
shr byte [esp + ecx - 0x1a0927af], 0x47
dec al
dec ecx
rol al, 1
not al
neg cx
sub dword [esp + ecx - 0x1a09d850], ecx
btc dx, dx
xor bl, al
neg dword [esp + ecx - 0x1a09d850]
pop ecx
btr cx, dx
adc eax, esp
xor cx, cx
btr edx, 0x98
add cx, word [eax + ecx*2 - 0x120000]
push edx
push edx
sub edi, 2
xadd byte [esp], dh
movsx eax, dl
push edx
mov word [edi], cx
pop eax
pop edx
pop ecx
jno fcn.00953c34
mov edx, dword [edi + edx*2 - 0x36f7cd0e]
setae cl
sar ecx, 0xda
bt ecx, eax
adc edi, 3
jmp 0xe5069e
seto cl
inc eax
not eax
not cl
sal cl, 1
bswap eax
neg byte [esp + 2]
not eax
adc word [esp], cx
and dword [esp], edx
neg eax
inc eax
shr dword [esp], cl
rol eax, 1
shr ecx, cl
call fcn.00cb7250
mov ecx, 0xdda2b8a2
mov eax, dword [esi]
shl cl, cl
mov cx, word [eax]
mov eax, 0xafac11bf
lea edx, [eax + eax - 0x43dc3cf7]
lea esi, [esi + edx*2 - 0x36f7cd0c]
mov word [esi + edx*4 - 0x6def9a1c], cx
bt dx, ax
mov ecx, 0xff388fa4
jb 0xe896b7
pop eax
jmp 0x9a404f
cwde
pop ebx
not esi
bswap esi
movzx ecx, ax
pop ebp
pop ecx
cbw
lea eax, [esi + esi - 0x5c5971ca]
pop esi
cbw
jmp 0xf2434c
Function at 0xe05c5b
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x4a2b1bae
mov edi, dword [edi*4 + 0xe92190]
shr ecx, 8
sar byte [esp + 1], 0x64
xor ecx, edi
inc dword [esp + 4]
inc eax
push 0xec0d1bbc
xor ecx, 0x440753b5
dec edx
push 0x16be46ab
not byte [esp + 4]
lea esp, [esp + 0x10]
jne 0x966766
mov eax, 0xde2b0b17
pop edi

Function at 0xe11f50
Capabilities:
Execute syscall

Disassembly:
mov dword [esp], eax
push 0xf5261ba6
call fcn.00e266fb
mov eax, 0xdda58825
movsx ecx, ax
xadd ax, cx
movzx edx, byte [edi]
rol eax, 3
xchg ecx, eax
adc eax, ecx
xor dl, bl
sub dl, 0x90
inc eax
and eax, 0xe9b1072e
not dl
sub cl, ah
jae 0xe53f11
shl ecx, cl
adc dl, 0xae
ror ax, 0x2b
lea eax, [ecx*2 + 0x79a3c51c]
sbb ecx, eax
neg dl
shr ecx, cl
push eax
jnp 0xe05f77
call fcn.009bc1d7
je 0xe53f3f
test dword [eax], eax
invalid
and cl, ch
push edi
mov eax, 0x708bee3d
rcl dword [ebx - 0x57], 0x94
mov esp, 0xf8da1088
imul esp, ebp, 0x89aa7a70
mov al, byte [0xd772ce75]
cmovle ebx, dword [edx + 0x18]
nop
lea edi, [ecx + 0x3c]
mov eax, edx
adc al, 0x9c
or eax, 0xfbfba6cb
mov eax, 0x948d8148
out 0xb6, al
div dword [edx + ebx*4 + 0x4d]
inc ebp
movsd dword es:[edi], dword [esi]
daa
js 0xe53f83
lcall 0x678, 0x27a5454d
lodsd eax, dword [esi]
xchg edx, eax
add bh, byte [edx + 0x5c1c72e4]
sbb al, 0x5c
arpl word [ecx], cx
sbb eax, dword [ecx]
fiadd word [ebx]
sub byte [ecx + 0x34], 0x68
xlatb
mov al, byte [0x28e7455c]
movsd dword es:[edi], dword [esi]
cwde
push 0x38
sub bl, dh
daa
cmp byte [eax], 0x81
xlatb
js 0xe53fc2
imul eax, dword [eax], 0xffffffed
push esi
xlatb
inc ebp
mov esp, 0x5df27716
imul ecx, dword [eax - 0x3d], 0x6c5f36f6
cld
insd dword es:[edi], dx
pushal
out 0x28, al
dec esp
pop ss
jle 0xe53f76
and byte [edx], bh
mov edi, 0xf82bf6c6
sub edi, eax
lodsb al, byte [esi]
dec ebp
neg byte [edi + edi + 0x7af20fe8]
push ecx
xor esi, esi
aas
mov dword [eax], edx
jge 0xe53f85
sbb dword [ebx - 0x775cc60], ebx
das
mov eax, 0x36927d0a
inc eax
invalid
Function at 0xe153d1
Capabilities:
Encode data using xor

Disassembly:
inc esp
movzx eax, al
dec eax
lea ecx, [eax - 0x1bd111c7]
mov ebp, ebx
rol edi, 3
add ebp, 0x4a31d17
inc ebp
movzx esi, al
dec eax
lea edx, [eax - 0x20456c58]
dec edi
neg edi
inc sp
xchg ebp, esi
inc esp
sub al, dl
dec edi
lea edi, [eax + eax*4 + 0x5982d324]
inc ecx
push edx
inc edx
xor dword [esp + eax - 0x58], edi
inc ecx
pop edx
dec eax
arpl di, di
ror ebp, cl
dec esp
adc ecx, edi
movsx edi, bx
dec eax
cdq
dec esp
mov edi, dword [esi + eax*8 - 0xb8]
inc cx
add edx, esi
dec eax
mov edi, dword [esi + eax*2 - 0x26]
inc ecx
shl eax, 0x67
inc esp
sbb al, ch
dec eax
cdq
dec eax
lea esi, [esi + eax*4 - 0x54]
inc cx
sar esi, 1
dec eax
cdq
dec esp
or edi, edi
dec eax
div ecx
dec ecx
not edi
dec eax
mul ebp
dec esp
mov dword [esi + eax*4], edi
dec ecx
xor eax, ecx
jmp eax
inc eax
or bh, 0xb8
inc ecx
btr eax, ebx
mov ebp, dword [ecx + esi - 0x128afe34]
dec esp
btc ebx, edi
inc esp
movsx esi, al
inc ecx
bswap edi
inc esp
mov edi, dword [ecx + esi - 0x128afe30]
movzx edx, di
dec eax
lea esi, [ecx + esi - 0x128afe30]
not ebp
inc ecx
not edi
dec eax
or edi, eax
cbw
inc ecx
or ebp, edi
inc ecx
inc ebx
cdq
inc cx
inc ebp
mov dword [esi + ecx - 0x128afe34], ebp
inc eax
seto bh
inc sp
sub eax, edx
sar edx, 0xd4
dec ecx
xor edx, ecx
jmp edx
inc esp
xor dl, dl
dec eax
mov dword [esp], ebp
dec eax
and ecx, ebx
dec eax
lea edx, [esp + edx + 8]
rol word [esp + 2], 7
bswap ebp
ja 0x990716
inc esp
mov eax, dword [edx]
inc eax
and byte [esp + 6], bh
inc esp
mov dword [esi - 4], eax
and bx, 0x1035
dec esp
lea ebx, [ebx + ebp*2 + 0x1103eb1b]
movsx eax, word [esp]
inc ebp
mov ebx, dword [esp - 5]
inc ecx
pop edi
sal cx, 0x4a
dec ecx
sbb esp, 5
inc cx
xchg edi, eax
inc ebp
xor ebx, edx
inc ecx
inc ebx
neg cl
inc ecx
bswap ebx
jne 0xcfd89e
inc ecx
neg ebx
inc ecx
bswap ebx
inc ecx
not ebx
inc ebp
movzx ebp, di
inc ecx
inc ebx
inc ecx
neg ebx
inc ecx
push edx
inc ecx
sal ch, 0xa1
push eax
inc esi
xor dword [esp + ebp*8 - 0x420c8], ebx
dec eax
cwde
dec esp
mov edx, dword [esp + eax*2 + 0xf6ee]
call fcn.00e11054
jg 0xe1543b
mov dl, 0xd4
and ax, word [0x66e3c216]
mov dword [0xe3c20edc], eax
mov bx, 0x36c4
ret 0x66e3
Function at 0xe1a2bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec eax
not dword [esp + 8]
rol dl, cl
movzx eax, word [esp + 8]
inc esp
mov ebp, ebx
sal ax, 4
inc esp
xor dl, dl
dec eax
shr dword [esp + eax - 0x5d8], cl
dec eax
mov dword [esp + eax - 0x5e0], 0x122a659d
dec eax
imul ecx, dword [esp + eax*2 - 0xbb8]
dec eax
lea edx, [esp + edx + 0x10]
inc esp
xadd ebp, edi
inc ecx
dec dh
dec ebp
xor ebx, ebx
inc cx
movzx ebx, byte [ebx + edx]
dec edx
sub dword [esp + ebx], 0x1a840a39
inc dx
dec dword [esp + ebx + 7]
inc dx
mov dword [esi + ebx - 2], ebx
inc edx
dec dword [esp + ebx + 8]
inc edi
mov edi, dword [esp + ebx - 5]
dec edi
lea esp, [ebx - 5]
inc ebp
xor edi, edx
dec eax
lea ecx, [eax + ecx*4 - 0x1bf96979]
inc ecx
inc edi
inc edx
rol dword [esp + ebx*4 + 0xa], 0x73
not eax
inc ecx
bswap edi
dec edx
lea ebx, [esi*2 - 0x38c35afa]
inc dx
inc dword [esp + ebx*2 + 0xe]
dec eax
btr eax, ebp
inc edi
lea edi, [ebx + edi + 0x6c84a61a]
rol bl, cl
inc esp
movzx eax, bh
inc ecx
ror edi, 1
dec esi
mov dword [esp + ebx*2 + 8], edx
inc esi
xor dword [esp + ebx + 8], edi
cbw
inc ecx
or ebx, eax
dec esi
mov edx, dword [esp + ebx + 8]
inc eax
sal ch, cl
call fcn.00e385d4
mov eax, 0x6e289622
mov eax, dword [esi + eax - 0x6e289622]
mov ecx, 0xb0282339
lea edx, [ecx*2 - 0x30686ccb]
or cx, dx
lea esi, [esi + edx*2 - 0x5fcfb34a]
shl edx, 0x2a
shl dx, 0xc3
push edx
xor eax, ebx
lea eax, [edx + eax + 0x5045bb3f]
pop ecx
not ecx
neg eax
rol cx, 0xaa
not eax
bswap eax
lea ecx, [ecx*4 - 0x4a5d4653]
shr cx, 0x6b
jbe 0xe28270
xor ebx, eax
add edi, eax
call fcn.00dc33cf
mov ecx, 0xa515c511
movzx eax, cl
xadd eax, ecx
rdtsc
shl cx, 0x24
btr cx, cx
lea ecx, [ecx + 0x76b1eab9]
lea esi, [esi + ecx - 0x76b1ebd1]
sal ecx, 0xcf
inc cl
mov dword [esi + 4], eax
bt ecx, 0x24
adc cx, cx
lea ecx, [ecx + ecx + 0x508393a5]
mov dword [esi + ecx - 0x3c4b93a9], edx
shl ecx, cl
movzx edx, cx
lea eax, [edx*4 + 0x2f3cc719]
mov edx, dword [ebp + edx*2 - 0xa400]
sar eax, 0x34
push eax
lea ebp, [ebp + eax - 0x2ef]
xor eax, dword [esp + eax*8 - 0x1798]
mov word [esp + eax*2], cx
or dword [esp + eax], 0xcf31568a
xor edx, ebx
bswap edx
neg edx
call fcn.00ee5be7
Function at 0xe21d41
Capabilities:
Authenticate hmac

Disassembly:
push 0x5aa3cc15
lea esp, [esp + 0x10]
je 0xe76935
mov eax, 0x9ebc2728
shl ax, 0x2a
mov eax, dword [ebp + ebx*4]
call fcn.00cb85a2
rol eax, cl
neg dl
neg bp
xor bl, dl
or ax, cx
adc edx, esp
or ax, bp
sal ebp, 0x21
inc ebp
mov ecx, dword [eax + edx - 0x7eaf]
lea edx, [ebp + ebp - 0x34f31476]
mov edx, ecx
shl ebp, 0x32
mov ebp, edx
js 0xdb44f6
bts cx, cx
adc dl, cl
mov eax, ecx
sar ebp, 0x74
rol dl, cl
cwde
xor ebp, 0x781672a9
sbb dl, cl
rol ebp, 0x21
jo 0xce03c9
call eax
mov ebx, 0x2f16f831
lea edi, [ebx*8 - 0x3dd1effd]
movzx ecx, bl
mov ebp, dword [ebp + ebx - 0x2f16f835]
movzx edx, bl
neg edx
mov dword [ebp + ebx - 0x2f16f831], eax
sar ebx, cl
pop ebx
pop edi
pop esi
mov eax, 0x4f001003
sar cl, 1
mov edx, dword [esi + ecx - 0x18]
shr ax, 0xb
push ecx
lea esi, [esi + ecx - 0x14]
shr cl, 0xe1
cbw
dec cx
xor edx, ebx
xor edx, 0x258c6215
sar ecx, 0xba
dec al
not edx
sar eax, 0x3e
inc cx
sbb edx, ecx
shr cl, 6
je 0xdc1209
mov eax, 0x742f619a
mov eax, dword [esi + eax - 0x742f619a]
mov ecx, 0x94b95ba0
rol cl, 0x24
movsx edx, cl
mov cx, word ss:[edx + eax - 0xa]
lea eax, [edx*8 - 0x797d97f9]
sar eax, 3
mul eax
mov ax, word [esi + eax*2 - 0xede08c4]
add dl, dl
dec dl
btc edx, edx
not cx
and dl, 0x2b
btc dx, dx
not ax
sub dx, dx
and cx, ax
jmp 0xe43834
mov dword [esp + eax*4 - 4], 0x77997803
neg edx
sub byte [esp + ecx + 3], 2
jle 0xf29ab4
bt ecx, 0x2e
xor ebx, edx
lea ecx, [ecx + ecx*2 - 0x27f8ae5f]
sal dword [esp + eax*4 - 4], 0xb4
add edi, edx
movsx edx, byte [esp + eax*4 - 4]
sub dword [esp + eax - 1], edx
mov dword [esp + eax - 1], edi
ret
jmp 0xc8cd7b
movsx eax, dl
mov word [edx + esi - 0x6286fffc], cx
cwde
xor eax, edx
push eax
mov eax, dword [edi + edx - 0x62870000]
mov ecx, 0x72847a31
xor eax, ebx
dec ecx
not eax
dec ecx
xchg edx, ecx
sub eax, 0x2e10d328
push ecx
ror eax, 2
xadd byte [esp + ecx - 0x6286fffe], ch
shl edx, 0xd
neg edx
bswap eax
xor ebx, eax
add ebp, eax
sar dword [esp + ecx - 0x628786fc], 0xf1
movzx ecx, word [edx + edi - 0x70ba1ffc]
lea edx, [edx*4 + 0x7034db96]
lea edi, [edi + edx*2 - 0x663ab726]
bt edx, 0xb9
add dword [esp + edx - 0x331d5b96], edx
xor cx, bx
sal byte [esp + edx*2 - 0x663ab72b], 7
setne byte [esp + edx - 0x331d5b92]
sbb cx, 0xc428
call fcn.00e60a8a
mov eax, 0x32158888
mul al
mov ecx, dword [eax + esi - 0x32154840]
lea esi, [esi + eax*2 - 0x642a907c]
lea edi, [eax + eax*2 - 0x5fe2e774]
jo 0xe497c3
mov ecx, 0xdcb42a00
movsx edx, cl
or dl, byte [edx + ebp]
xor dl, bl
movsx ebp, cl
jmp 0xcea898
xor edi, 0x35b48a83
mov edi, ecx
ja 0xe1695a
rol eax, 3
xor ebx, eax
mov ecx, dword [esp]
add edi, eax
movzx eax, byte [ecx + ebp + 7]
mov word [esp + ecx*8 + 0x13], cx
sar dword [esp + ecx*8 + 0xd], 0x43
not ecx
adc ebp, 8
mov dword [esp + 4], 0xaca39134
xor al, bl
sal ecx, 0xfb
ror ecx, 0x6e
rol word [esp + ecx*2 - 0x7bff9], 0x41
sbb al, 0x93
or dword [esp + ecx - 0x3dff9], ecx
neg word [esp + ecx - 0x3dfec]
pop ecx
neg al
jmp 0xe6c0d5
mov eax, 0x7108c227
mov eax, dword [ebp + eax - 0x7108c227]
jmp 0xdb6d99
Function at 0xe291aa
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
test ebx, ebx
lea esp, [esp + 0x14]
je 0xcd4008
mov eax, 0x52b7668f
mov eax, dword [ebp + ebx*4]
push 0x3b1f592b
sub dword [esp], 0xc204309a
mov dword [esp], eax
push 0x3e881a34
jge 0xddb8cd
mov eax, dword [esi]
adc esi, 4
mov edx, dword [esp + 2]
xor eax, ebx
sal dl, 0x44
xor edx, edx
sar dword [esp + edx*2 + 3], 0x5b
lea eax, [eax + edx*2 + 0x6110d91f]
lea ecx, [edx + edx*2 - 0x2278c95a]
neg eax
inc eax
lea ecx, [edx + ecx*8 + 0x3fb97791]
neg eax
or dword [esp + edx*8 + 4], ecx
xor ebx, eax
imul edx, dword [esp + edx*2 + 4]
adc edi, eax
lea ecx, [ecx + edx*8 + 0x3981229d]
push edx
sar word [esp + edx*8 + 4], 0x86
add dword [esp + edx], edi
ret 8
mov eax, 0x8a097009
lea eax, [eax + eax*8 - 0x7df83b00]
not ax
mov eax, dword [ebp + eax - 0x5c5c4aae]
jmp 0xe36df8
and dword [esp], 0xf681ac33
dec ebx
call fcn.00d0c4b7
jae 0xc4662f

Function at 0xe2b25f
Capabilities:
Execute syscall

Disassembly:
movzx dx, byte [ecx]
mov dword [esp], eax
mov word [edi - 2], dx
mov edx, 0x351b5022
jg 0xd1dd0d
sysenter
push ebx
mov dword [esp], 0x2c5c1a77
call fcn.009989b2

Function at 0xe2dc6d
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
call eax
mov edi, 0x823818a5
mov ebp, dword [ebp - 4]
lea edx, [edi + edi*8 + 0x73a03f37]
dec dx
mov dword [ebp + edx - 0x7991d03], eax
jo 0x9c8d27
mov esi, ebp
lea eax, [edi*8 + 0x353d4eb5]
mov ecx, edx
pop ebx
and ecx, edx
pop ebp
ror eax, cl
pop edi
ja 0xe6aef7
mov eax, dword [edi + edx*2 - 0xf323a06]
sub dx, dx
lea edi, [ecx + edi - 0x7991cff]
shr cx, cl
xor eax, ebx
lea edx, [edx - 0x5ee2bf9]
add edx, ecx
call fcn.00d09ed3
lea esi, [esi + ecx*2 - 0x1ee62]
shl word [esp + ecx - 0xf733], 0x66
rol dword [esp + ecx*8 - 0x7b998], 0xa3
xor edx, ebx
bt ecx, eax
inc edx
not eax
bswap edx
idiv byte [esp + ecx - 0xf732]
not edx
mov edx, 0xde2e8f3f
jmp 0xf18b40
mov ax, word [edi]
movzx ecx, dx
and cx, 0x6936
mov dx, word [ecx + edi - 0x934]
or cx, cx
xor cl, cl
btr cx, cx
lea edi, [edi + ecx*2 - 0x11fe]
dec cx
xor cl, 0x33
btr ecx, ecx
adc ax, dx
push ecx
mov word [ecx + edi - 0x8cc], ax
not cx
movzx eax, cx
mov edx, dword [esi + ecx*2 - 0x1ee66]
jmp 0xe31438