joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11487cc
Capabilities:
Encode data using xor

Disassembly:
rol ecx, 2
sub eax, 0x7625e0b4
neg ecx
lea ecx, [ecx + edx - 0x4aa75f88]
ror dl, 0x44
xor ecx, 0x4b17378d
mov dword [esp + edx - 0x6d3809a8], eax
sar byte [esp + edx - 0x6d3809a6], 0x67
neg edx
xor ebx, ecx
add edi, ecx
push edx
and al, 0xb9
not dword [esp + 4]
mov dx, word [ebp]
call fcn.0146efd8
push 0x32124712
jmp 0x11dcc1e
or ah, byte [ebx - 0x37163e2f]
stosb byte es:[edi], al
inc dword [ecx + 0x4ee]
add byte [ebx - 0x463cccfa], cl
xchg ebp, eax
mov al, byte [0xd0f76526]
sub esi, 4
mov eax, dword [esi]
xor eax, ebx
mov ecx, 0x6526a095
not eax
bswap eax
ror eax, 1
or ecx, 0x770b4f0b
not byte [esp + ecx - 0x772fef9e]
xor eax, 0xecbeb63e
or al, 0x62
adc al, dl
mov byte [0xecbeb63e], dh
inc byte [esp + ecx - 0x772fef9d]
sub ecx, dword [esp + ecx - 0x772fef9f]
call fcn.0115fa18
dec eax
sub esi, 4
inc ecx
mov ecx, 0xfb252b3b
mov edi, dword [esi]
xor edi, ebp
mov ecx, 0x7027ca5
call fcn.0122f5a3
adc edi, 4
shld ax, dx, cl
call fcn.012816ae
movsd dword es:[edi], dword [esi]
shr al, 1
sub al, 0x4a
dec edx
or al, byte [eax]
xchg ebp, eax
mov al, 0xfc
jl 0x11dcc24
inc ebx
dec esp
in al, dx
lea esp, [edx + 0x676b5098]
jge 0x11dcc15
xchg ecx, eax
sti
pushal
dec edi
adc eax, 0x4292f2be
and edx, 0x5eca02af
mov ah, 0xaf
jbe 0x11dcce3
dec edx
loopne 0x11dcc3b
inc edx
push ds
inc esi
adc eax, 0x66a2bfa2
sbb eax, 0x6a495d40
pop ss
dec ebp
fnstsw word [ebp - 0x80]
cdq
std
dec esi
in eax, 0xf0
add edi, dword [edx + 0x3f]
test byte [edx + 0x1f], al
js 0x11dcc7f
mov ecx, 0x103412a2
sbb eax, 0x84a67074
test al, 0x4a
std
mov al, 0x40
out dx, al
mov eax, dword [0x97eaea82]
push edi
pop ebp
xor edi, ecx
ret 0x45d2
rol byte [ebp - 0x21], cl
inc eax
cmp eax, 0x222f7a1a
int 0x84
jnp 0x11dcc7b
dec dword [eax - 0x694ae2]
invalid

Function at 0x1151007
Capabilities:
Encode data using xor

Disassembly:
shr byte [esp + 6], 0x62
adc ebp, ecx
jmp 0x12b5aca
call fcn.01308f25
rol edx, 2
bswap edx
lea edx, [eax + edx - 0x75bb3109]
call fcn.011722a1
sysenter
call fcn.011cbcd4
lea esp, [esp + 8]
jmp 0x11db211
Function at 0x118192d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
xchg esp, eax
sub ch, ch
push edx
xor ebx, edx
ror eax, cl
mov dword [esp], ecx
rol byte [esp], 0x83
adc esi, edx
sub ebp, 4
mov ecx, dword [ebp]
shl dword [esp + 4], 0xfa
xor ecx, ebx
inc al
js fcn.0144593c
lea edx, [eax + 0x132ee398]
ror ecx, 1
sub ecx, 0xffaa70b2
xor ax, word [esp + 1]
not ecx
lea ecx, [ecx + edx - 0x5a49a878]
call fcn.013d2656
rcr byte [0xb3d2811c], 1
push ebx
aaa
pop ebp
xchg ebx, eax
jo 0x1181911
mov bh, 0x12
mov edx, 0xe13699d9
jge 0x118190d
inc edx
dec esp
aam 0x13
and esi, dword [edx + 0x24f369ae]
in eax, 0x7e
test esi, ebp
das
push es
cmc
push 0x863465ae
wait
cmp esp, ebx
mov dh, 0
add al, 0x50
cwde
sub eax, 0xb03c1f0d
sbb eax, 0x5b7556aa
mov ebp, 0x7c78018c
test al, 0x1a
push ss
into
loop 0x11819de
mov di, 0xb456
shr dword [eax + 0x12], cl
cmp ebp, dword [edi + eax*2]
pop ecx
xchg ebp, eax
imul edx, esp, 0x591d672c
xor ecx, esi
jmp 0xb3a833be
arpl word [edx], bp
sbb ecx, dword [esi + 0x64]
mov ebp, dword [0x2cab15d2]
inc esi
stosd dword es:[edi], eax
sub al, 0x46
test al, 0x62
pushal
mov dl, bh
cmp edi, edx
js 0x1181a2a
xchg esi, eax
or dword [esi + 0x6f], edx
int1
pop edx
invalid
out dx, eax
shl dword [ecx], 1
pop ecx
jmp 0x11819d5
mov ebp, 0xf7ee33a0
int 0x26
out 0x37, eax
loopne 0x1181a07
test al, 0x7c
mov bh, 0x99
sub ebp, dword [eax]
xchg ebp, eax
xor edx, dword [eax - 0x46]
push esi
mov eax, 0xa72fa6a6
invalid

Function at 0x118b6d1
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub ebx, edx
lea esp, [esp + 8]
mov ecx, 0x22b106be
lea esi, [ecx + ecx - 0x3df39f47]
lea esi, [0x118b6d7]
lea ebp, [ebp + ecx*2 - 0x45620d80]
mov ecx, dword [ebp + ecx - 0x22b106be]
mov edx, 0xaaa48392
xor ecx, ebx
inc ecx
movsx eax, dl
xchg edx, eax
shl al, 0x82
xor ecx, 0x5db3d3ac
jmp 0x1308eb5
shr ax, 0xe4
neg al
neg ecx
inc al
and eax, edx
not eax
rol ecx, 1
sub edx, edx
neg eax
rol al, 3
dec ecx
xor ecx, 0xb5b97d34
inc al
jg 0x1457401

Function at 0x118dd96
Capabilities:
Encode data using base64

Disassembly:
inc edi
lea ecx, [ecx + esi - 0x2a91af45]
inc ecx
sete ah
call fcn.013a2151

Function at 0x11d6541
Capabilities:
Encode data using base64

Disassembly:
movzx edi, byte [edx]
xor edi, eax
jmp 0x135251d
mov dword [esp], 0x5a175083
and edi, 0xff
push 0x3730bd99
mov edi, dword [edi*4 + 0x150a4c8]
shr eax, 8
xor eax, edi
not dword [esp + 1]
inc edx
xor eax, 0x6fbbc68a
dec ecx
not dword [esp + 4]
lea esp, [esp + 8]
jne 0x1029925
mov edx, 0x839dc62e
pop edi

Function at 0x11d8e4d
Capabilities:
Encode data using xor

Disassembly:
rol eax, 2
mov dword [esp + edx*4 - 0x37b29ed4], edx
shr dl, 0xe4
setp dl
dec eax
mov dword [esp + edx*8 - 0x6f653800], edx
shl dl, 0x41
xor eax, 0xed0c6730
rol byte [esp + edx - 0xdeca6ed], 0xe5
mov dword [esp + edx*4 - 0x37b29bfc], edx
not eax
xor ebx, eax
call fcn.011d0b7c

Function at 0x12055aa
Capabilities:
Authenticate hmac

Disassembly:
xor eax, 0xfd9a8b18
dec ecx
lea esp, [esp + 0xc]
jne 0x14d4600
pop ebx
Function at 0x122ba26
Capabilities:
Encode data using xor

Disassembly:
inc ecx
push ebp
inc esi
xadd byte [esp + eax - 0x7b13e215], al
inc ecx
ror esi, 2
dec eax
mov dword [esp + ebx - 0x48a98d3f], 0x67049e21
inc ecx
movsx edi, al
inc eax
sub byte [esp + edi + 9], bh
inc edi
lea esi, [esi + eax + 0x728f79ac]
inc ecx
rol esi, 2
inc esp
movsx edx, bx
inc ecx
mov ecx, edx
sal dword [esp + ebx - 0x48a98d3c], 0xc6
inc ecx
inc esi
not dword [esp + ebx - 0x48a98d45]
dec eax
mov bh, 0x48
mov dword [esp + ebx - 0x48a98d3f], ebp
inc ecx
movzx eax, dl
inc esi
xor dword [esp + eax - 0x7b13e1f8], esi
call fcn.01135a7c
cmpsd dword [esi], dword es:[edi]
cmp byte [ecx + 0x4260bd8b], 0x3a
sahf
pop ds
lodsd eax, dword [esi]
shr dword [ecx], 1
lock xchg byte [esi + edi*4 + 0x63], bh
aam 0xe4
mov dh, 0xb3
clc
jp 0x122ba4b
mov eax, 0x24df95cb
mov dword [ebx + 0x6a], edi
test bl, dl
push ecx
cmpsd dword [esi], dword es:[edi]
add ah, byte [edi + 0x77]
cli
sar dword [edx + 0x9ea2863], 1
adc eax, 0xa4c587c8
fistp dword [edx - 0x5c5d23af]
div byte [eax + 0x70ae5797]
add cl, byte [esi - 0x6e8301f3]
mov dl, 4
push 0x18b5ad
call 0x7041572
pop ds
loop 0x122bb28
out 0xab, eax
jnp 0x122ba6e
rol byte [ebx - 0x19], 0x55
into
or eax, 0x612dfa1e
sbb dword [eax], 0x90fc2e81
sbb byte [esi + 0x5d847fd], ch
and dword [ecx - 0x7f], ebp
add al, 0x60
out 0x25, eax
xlatb
cli
jns 0x122bb04
retf 0xcfad
lodsd eax, dword [esi]
iretd
ret 0x89aa

Function at 0x1242d23
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx ecx, ax
mov dword [esp + eax - 0x1a2b75c0], eax
lea ebp, [ebp + eax - 0x1a2b75c4]
mov edx, dword [eax + ebp - 0x1a2b75c0]
je 0x1368efd
or dword [esp + eax*2 - 0x3456eb80], 0x3a06530e
xor edx, ebx
dec ecx
lea edx, [edx + eax*4 + 0x7052602e]
xchg dword [esp + eax - 0x1a2b75c0], ecx
setg al
not edx
bswap edx
rol edx, 2
sub eax, 0x54240f34
xor ebx, edx
neg word [esp + ecx - 0x3a2f77cc]
adc esi, edx
lea edx, [ecx*2 - 0x3575c7cf]
neg ax
mov dword [esp + ecx - 0x3a2f77ce], esi
ret

Function at 0x1243da7
Capabilities:
Encode data using xor

Disassembly:
inc eax
not eax
neg cl
push ecx
xor ebx, eax
mov dword [esp + ecx*2 - 0x33646ffc], edx
neg ecx
call fcn.010eaaaf
mov ecx, 0xdf2a9697
mov edx, ecx
add ebp, 4
xor eax, ebx
push ecx
shr edx, cl
inc eax
not eax
xadd cl, dh
sal ecx, cl
lea eax, [eax + edx*2 - 0x6814de3a]
bswap eax
sbb eax, 0xdb3b59a6
dec edx
setns cl
add edx, 0xc2b6d62b
xor ebx, eax
ror ecx, cl
ror dl, 1
adc edi, eax
not edx
not byte [esp + edx - 0x3d48928b]
movzx eax, byte [ebp + edx*2 - 0x7a912516]
lea ebp, [ebp + edx*2 - 0x7a912515]
call fcn.012b0732
out 0x86, eax
jge 0x1243dd5
call 0xa57ad859
ret 0x1964
Function at 0x1266967
Capabilities:
Execute syscall

Disassembly:
jno 0x11628c9
xor edx, ebp
inc ecx
movsx ebx, al
inc ecx
push esp
call fcn.0140a43f
mov eax, 0x8c3e7e35
lea ecx, [ecx + eax - 0xc83b525]
not eax
add al, ah
xor ecx, 0x6938f7b8
neg ecx
xor eax, eax
shr ax, 0x28
neg ax
adc ecx, 0xafad3ebe
add eax, 0xd5bac3b0
shl al, 0xe1
shr al, 0xc3
xor ebx, ecx
shr ax, 0xb
add eax, 0xbcb0f224
add esi, ecx
inc ecx
pop edx
dec eax
add dword [esp + edx - 0x75b68989], 0x4014c515
dec eax
lea esi, [edx + esi - 0x75b68995]
mov edx, dword [esi + ecx - 0x30fce89]
jns 0x11168ad
sysenter
pushfd
mov dword [esp], 0x11995aff
call fcn.015072b1
shl cl, 0xc3
adc word [esp + 1], cx
ror al, 1
neg al
not ecx
xor bl, al
and byte [esp + ecx - 0x5975000e], ch
rol word [esp + ecx - 0x5975000a], 0x42
lea eax, [esp + eax + 0xc]
mov byte [eax + ecx - 0x5975000f], dl
mov eax, 0x1d378531
mov dword [esp + eax - 0x1d378531], esi
ret 8

Function at 0x126ce33
Capabilities:
Execute syscall

Disassembly:
shr ecx, cl
add ax, 0x288b
xor bl, dl
xchg cx, ax
lea edi, [edi + ecx - 0xc9ed]
sar byte [esp + ecx - 0xc9e3], 0x61
mov dword [esp + ecx - 0xc9eb], eax
mov word [edi + ecx*2 - 0x193d6], dx
mov edx, dword [esp + ecx*8 - 0x64f52]
jp 0x12f97d6
mov edx, dword [ebp]
mov ecx, 0xdf1c9d06
mov eax, ecx
mov ecx, dword [edx]
mov dword [ebp], ecx
mov eax, dword [edi]
add edi, 4
mov ecx, 0xceb3ce2a
xor eax, ebx
bswap eax
shr cl, 0x82
ror cl, 0x42
not eax
xor eax, 0xa1ba453a
push ecx
sar dword [esp], 0x9b
not eax
shl ecx, cl
ror ecx, 0xb4
xor ebx, eax
mov edx, dword [esp]
add esi, eax
pop ecx
jmp esi
pop edx
pop eax
pop ecx
jno fcn.01422719
call fcn.011b1bda
mov dword [esp + eax], ecx
neg edx
shl dword [esp + eax*4], 0xff
call fcn.013f78d7
lea ebp, [ebp + ecx*8 + 4]
xor eax, ebx
and cl, dh
lea eax, [eax + ecx*4 + 0x3be716]
lea edx, [edx + ecx*8 + 0x450854b2]
or cl, 0x1f
call fcn.0136e6b7
syscall
call fcn.0120bb40

Function at 0x1274469
Capabilities:
Execute syscall

Disassembly:
and edx, edx
bswap eax
call fcn.0143e7a9
lea eax, [eax + 0x58add297]
xor ecx, ebx
lea edx, [eax + eax*4 + 0x131fbba4]
call fcn.014fbbf9
syscall
push edi
dec eax
mov dword [esp], 0xd73065dc
call fcn.012dabea
mov dword [esp + edx*2 - 0x1b03fea4], esi
ret

Function at 0x127fe8b
Capabilities:
Encode data using xor

Disassembly:
movsx eax, byte [esp + 4]
movzx ecx, byte [esi + eax*2]
xor cl, bl
dec cl
call fcn.01419c54
mov edx, 0x41809729
sar dl, 0xe5
lea ebp, [ebp + edx - 0x41809705]
in eax, 0x8d
lodsb al, byte [esi]
adc eax, 0xbe7f68fb
mov edx, dword [edx + ebp - 0x41809701]
mov eax, 0x629bd491
movsx ecx, al
lea ecx, [ecx + eax*2 - 0x4df6c0df]
xor edx, ebx
dec cl
lea edx, [edx + eax*2 - 0x4d8d3cea]
rol cl, 0xc1
call fcn.013eec9d
pushfd
inc edi
cmp ebp, dword [edx + 0x3d]
sub al, 0xcb
xchg edx, eax
pop ds
jne 0x127fea4
xchg ebp, eax
bound ebx, qword [ebx - 0x45ffc3f9]
mov byte [0x5d45bf4f], al
lodsb al, byte [esi]
jmp 0x127fea6

Function at 0x1288ae3
Capabilities:
Execute syscall

Disassembly:
mov word [ebp], dx
mov eax, 0xcda13f93
movsx edx, ax
Function at 0x128e0f7
Capabilities:
Execute syscall

Disassembly:
bswap ecx
mov dword [esp + 4], eax
xor ebx, ecx
lea edx, [eax*4 - 0x54442def]
call fcn.013c7118
syscall
push 0x2db49886
dec eax
mov dword [esp], 0x4f24a3dd
call fcn.012dabea

Function at 0x12b893e
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + eax], eax
dec edi
lea ebx, [ebx + eax + 6]

Function at 0x12c81bb
Capabilities:
Encode data using xor

Disassembly:
sbb word [esp + ecx*2 - 0xb33c16], 0x46b8
mov byte [eax + ecx - 0x599e18], dl
dec eax
bswap ecx
call fcn.012b3041

Function at 0x12d6c4f
Capabilities:
Encode data using xor

Disassembly:
add esi, 2
sar dl, 0x42
shr al, cl
call fcn.0136527e
cdq
fadd st(4)
in al, dx
dec eax
and al, 0xdb
sub dh, byte [edx - 0xa]
fcom qword [ebx + 0x63cd07cb]
int 0x63
cmp esi, dword [eax]
dec ebx
sub ch, byte [edx]
inc edi
xor al, 0x71
aaa
xchg esi, eax
or byte [eax - 0x37], 0x1c
movsb byte es:[edi], byte [esi]
out dx, eax
xlatb
jle 0x12d6c6d
or dword [eax + 0x11d3ee0f], esi
iretd

Function at 0x13036bb
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp + eax - 0x5eb5041f]
xchg word [esp + eax - 0x5eb50411], ax
mov eax, dword [eax + ebp - 0x5eb5575c]
push 0xf73aee91
xor eax, ebx
dec eax
not eax
ror eax, 1
push 0xc20f3a32
xor eax, 0xd7a4650e
mov ecx, dword [esp + 8]
add ecx, 0xffd2bab9
jmp ecx
mov word [ecx + eax - 0x5eb5041b], dx
jns 0x11615fc
in eax, 0xff
mov eax, 0xe70bb2b1
call fcn.014b3429
xor dl, byte [edi - 0x54]
sti
mov bl, 0xa1
mov ch, 0x58
fild qword [ecx]
test byte [0x2fde84a7], al
push 2
cmp dh, byte [edi + 0x516377af]
xchg ebx, eax
ja 0x13036c7
enter 0xffffffffffffb4f6, 0xffffffffffffffda
push ss
lcall 0xbece, 0x66395c3f
arpl word [esp], sp
popal
salc
mov bh, 0xf7
paddw mm3, qword [edx]
pushal
pushfd
mov bh, 0xa3
scasb al, byte es:[edi]
sub ch, dl
mov ds, word [ecx]
invalid

Function at 0x130767c
Capabilities:
Encode data using xor

Disassembly:
shr dword [esp + ecx - 0x6ea9c5dd], 0x69
lea ebp, [ebp + ecx - 0x6ea9c5e5]
mov dword [ebp + ecx - 0x6ea9c5e1], edx
pop ecx
dec dword [esp + 7]
pop eax
pop ecx
pop edx
pop edx
pop ecx
jp fcn.0149c33f
add byte [eax], al
dec eax
popal
jo 0x13076ea
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
sub eax, 0x41a4eb03

Function at 0x1308edb
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov dword [ecx], edx
mov eax, dword [ebp]
mov ecx, 0x4f318493
lea ebp, [ebp + ecx - 0x4f31848f]
xor eax, ebx
bswap eax
jmp fcn.0129ca6d
add ebp, 1
mov eax, 0x13bf1e91
sub ax, 0x3824
xor cl, bl
mov dword [esp + eax*2 - 0x277fccda], 0xdfaae10c
add cl, 0x2e
shl eax, 0xe8
and eax, eax
push eax
rol cl, 1
shr eax, 0x81
add al, 0x1c
adc cl, 0x81
xor cl, 0x8b
xor bl, cl
lea eax, [eax - 0x636fe86b]
shl byte [esp + 5], 0x61
lea ecx, [esp + ecx + 0xc]
pop eax
jno 0x12d5427
Function at 0x1337f9e
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec eax
arpl bx, bx
dec eax
mov dword [esp + edi*4 - 0x7c218], 0x9b2a1134
inc sp
and dword [esp + edi - 0x1f07b], eax
dec eax
mov dword [esp + edi*2 - 0x3e11c], 0x988eb6ba
dec esp
adc edi, ebx
inc ecx
push ecx
call fcn.010fe1fb

Function at 0x133b920
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword ss:[edx]
mov dword [esi], ecx
pop eax
pop ecx
add eax, edi
jmp eax
mov ecx, 0x9ba50db8
pushfd
sub ecx, 0xea841633
mov dword [esp + 0x10], 0xb56a61bc
mov ecx, dword [esp + ecx + 0x4edf0887]
call fcn.011c0737
add byte [eax], al
inc ebx
jb 0x133b9aa
popal
je 0x133b9ad
inc esp
dec ecx
inc edx
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [ecx - 0x2d5ed563], bh
mov edx, dword [ebp]
movsx eax, cx
sar cl, 0xc1
lea ebp, [ebp + eax - 0x2a99]
shl ax, 0xad
jnp 0x133ba23
mov edi, 0x9387fda5
push ds
aas
mov eax, 0xe706c49c
pop ss
add eax, dword [ebx - 0x587c20d]
xor ebx, 0x3d
js 0x133ba22
je 0x133b9af
rcr byte [eax], cl
pushal
sahf
cmpsd dword [esi], dword es:[edi]
ficomp dword [eax]
add byte [ecx + 0x6205876a], 6
sbb bh, ah
push cs
and dword [ebx - 0x392218f7], ebx
and byte [ecx - 6], al
and bh, byte [esi - 0x62]
arpl cx, di
sbb byte [ecx - 0x2ee7036b], cl
xor eax, 0xe3191c97
neg eax
jmp 0x149dd9d
neg ecx
xor eax, 0x9b0bdf19
dec eax
ror dl, 0xe7
push edx
shl edx, 0x95
xor ebx, eax
add edi, eax
xor edx, dword [esi + edx]
jmp 0x12b08f7

Function at 0x1349ce5
Capabilities:
Encode data using xor

Disassembly:
shrd dx, ax, cl
call 0x11632a1

Function at 0x1352514
Capabilities:
Encode data using base64

Disassembly:
pop edx
pop eax
pop ecx
jge fcn.0110bf7a

Function at 0x1368ea2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, cx
push ecx
movzx cx, byte [edx]
lea eax, [eax + eax*8 - 0x406e827b]
movzx edx, al
call fcn.01143132
mov ecx, 0x11a7b82a
mov eax, ecx
mov ax, word [eax + ebp - 0x11a7b82a]
sub ecx, ecx
mov dx, word [ebp + ecx*8 + 2]
xor cl, byte [ebp + ecx + 4]
push 0x75164cb0
add ebp, 4
call fcn.01403218
jnp 0x1445a82
jns 0x149b8d4
xor edx, 0x9ea61d20
inc ecx
inc edx
xor edx, 0x59bae21
jmp 0x10eb80a
jmp esi
Function at 0x13727a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ebx, eax
sub dword [esp + ecx - 0x7ff7efe7], edx
adc edx, edx
add esi, eax
mov eax, edi
lea edi, [edi + ecx - 0x7ff7efeb]
or word [esp + ecx - 0x7ff7efe5], cx
push ecx
neg dword [esp + ecx - 0x7ff7efe5]
mov dword [edi + ecx - 0x7ff7efe7], eax
lea eax, [ecx + ecx + 0x302c781e]
pop edx
pop edx
jp fcn.01137748
mov dword [esp + edx - 0x5be7cb66], 0xb29a53e
sub eax, 0x9d1fa086
ror dword [esp + edx - 0x5be7cb66], cl
or dword [esp + edx - 0x5be7cb66], edx
xor eax, 0xecb9c805
or edx, dword [esp + edx - 0x5be7cb66]
dec eax
xadd ecx, edx
sub word [esp + ecx - 0x7e4348c2], dx
sbb ecx, edx
neg eax
jmp 0x1242ce7

Function at 0x137ec11
Capabilities:
Encode data using xor

Disassembly:
ja 0x1450c53
inc esp
xor eax, ebp
inc cx
or ecx, edx
sbb dx, dx
inc ecx
dec eax
inc ecx
not eax
dec esp
lea esi, [ebx*2 + 0x4069c9d]
sub edi, 0x913386b6
call fcn.012d4d77
mov dword [edi], eax
sub dl, dh
ror edx, 0x4b
movzx eax, dl
lea ebp, [ebp + eax*4 - 0x134]
dec eax
jbe 0x12eecf8
mov eax, 0xec29a520
movzx dx, byte [esi]
jmp 0x11be1ed
sal eax, 0x6b
sal eax, 0xea
adc al, byte [esi + 2]
mov ecx, 0xaaa0a513
sub ecx, 0x9c1aa829
lea esi, [esi + ecx*8 - 0x742fe74e]
or cx, cx
neg cx
not dl
shr ecx, 0x88
and cl, ch
not al
add cx, cx
sal cx, 7
adc cl, cl
or dl, al
lea eax, [ecx + ecx*4 - 0xef9c0c6]
sal cl, cl
mov word [esi + ecx - 0xe0102], dx
ror ax, cl
shl ecx, 0x12
mov eax, dword [ecx + edi - 0x4080000]
movzx edx, cl
lea edi, [edi + ecx*4 - 0x101ffffc]
lea edx, [edx*4 + 0x5910da11]
xor ecx, edx
adc cx, cx
xor eax, ebx
call fcn.014558b4
fcomp qword [ebp + 0xd]
sbb eax, 0x5a940ed8
push esi
test al, 0x75
stosd dword es:[edi], eax
jg 0x11be244
sub dword [esi + 0x1cff74d1], eax
xchg ebx, eax
pop edi
clc
push es
xor eax, 0x8f71a035
sahf
sub esi, ecx
push ss
call 0x89c398c7
mov byte [esi + 0x1b], dh
sahf
dec ecx
loop 0x11be296
jns 0x11be28c
outsd dx, dword [esi]
xchg ecx, eax
dec eax
call 0xef01fad3
jns 0x11be237
jmp 0xbae155a3
or byte [esp + eax*2 - 0x454c], 0x11
adc edi, edx
rol ecx, 0x82
sar byte [esp + eax - 0x22a6], 0xc2
and cx, ax
mov dword [esp + eax*4 - 0x8a9c], edi
ret
mov eax, dword [ebp + eax*8 - 0x258]
call fcn.0125f81c
mov dword [esp + eax*2 - 0x454e], eax
neg edx
xor dword [esp + eax - 0x22a7], 0x462e9499
ja 0xb676e5
xor ebx, edx
jmp 0x12b2e09

Function at 0x138ec5c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
adc dx, 0xa012
mov ebp, esp
and dl, 0xb9
mov edx, dword [ebp + 8]
sub esp, 0x114
jmp 0x129ca83
Function at 0x1392798
Capabilities:
Encode data using xor

Disassembly:
dec eax
neg ebx
inc esi
lea ebp, [ebx + ebp + 0x7985e58e]
inc ecx
xor ebp, 0x842d9d8c
inc ecx
rol ebp, 3
inc edx
rol dword [esp + edx - 0x3c262550], 0xd3
inc ecx
dec ebp
dec ecx
lea edi, [ecx - 0x7ec44f3]
dec eax
shr edi, 0x47
dec edx
mov dword [esp + edx*2 - 0x784c4aa2], ebp
mov ebp, ebx
dec eax
ror edi, 0x49
dec eax
ror eax, 0xc
inc esi
xor dword [esp + ecx - 0x2551], ebp
dec esp
lea eax, [ebp + ebp*8 - 0x3ce9f6e4]
inc ecx
sar cl, 0x43
jp 0x1234452
push es
adc esi, dword [edx]
jnp 0x1130170
lodsb al, byte [esi]
mov bl, 0x67
mov dl, 0x42
mov byte cs:[0xb5a53d2e], al
invalid
movsd dword es:[edi], dword [esi]
xor dword [esi + 0x7e], ebp
inc eax
cwde
and bh, byte [eax]
mov eax, dword [0xe84fb6f6]
mov ecx, 0xeaf1d315
pop edx
invalid
pop ebp
dec ebp
arpl bp, bp
inc bp
cmovs ecx, edx
mov ecx, ebx
dec eax
inc ecx
dec ebp
adc edi, ebp
inc esp
mov esp, ebx
dec eax
and ebx, ecx
inc esp
movsx ebp, ax
dec ebp
or ebp, edi
inc ecx
jmp ebp
mov ecx, 0x8c0c06b4
shl ecx, 0xdb
lea edi, [ecx*2 - 0x76d62554]
mov ebp, dword [ebp - 4]
call fcn.0148ee2f
xor edx, ebx
shl word [esp + 6], 0xe9
jnp 0x12a6755
inc edx
neg edx
call fcn.010f9b5b
mov ebx, 0x93a80899
inc ecx
mov edx, 0x3c26daae
inc cx
not edx
dec edi
mov esi, dword [ebx + edx*2 - 0x784c4aa2]
dec edi
mov ebp, dword [edx + ebx - 0x3c262549]
dec edi
lea ebx, [ebx + edx*2 - 0x784c4a92]
inc ecx
push edx
dec edi
mov dword [esi + edx*2 - 0x784c4aa2], ebp
inc ebp
movzx ecx, dx
dec edx
lea esi, [esi + ecx*4 - 0x9548]
movzx eax, bx
inc ebp
mov ebp, dword [ecx + esi - 0x2551]
inc esp
xor ebp, ebp
jmp 0x113009c

Function at 0x13b4b4d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
neg ecx
neg dx
dec edx
lea ecx, [edx + ecx + 0x41eee935]
xor ecx, 0x8ea725b9
sar al, 0x21
xor ebx, ecx
shl ax, 0x66
add esi, ecx
shl eax, 0x14
sbb edx, eax
jbe fcn.01422719
mov ecx, 0x4b9d07be
push ecx
mov eax, dword [ecx + esi - 0x4b9d07be]
pop ebp
inc bp
lea edx, [ecx + ecx*4 + 0x248eddaa]
lea esi, [ebp + esi - 0x4b9d07bb]
and ecx, ebp
sbb dx, bp
mov ebp, eax
jl 0x11af933
xor ax, 0xdbd
mov dword [edi + eax*2 - 0x5c3ea73a], edx
lea edx, [ecx*4 - 0x5e644c5a]
mov dword [esp + ecx*4 - 0x3c000], edx
mov ecx, dword [ebp + ecx - 0xf000]
lea edx, [edx*2 + 0x6c0d9339]
lea ebp, [ebp + eax*2 - 0x5c3ea736]
shr dword [esp + eax*2 - 0x5c3ea73a], 0x50
pop eax
xor ecx, ebx
xor ecx, 0x8529a61d
neg eax
jb 0x12c9d96
Function at 0x13caac6
Capabilities:
Authenticate hmac

Disassembly:
mov edx, 0xd70913b5
lea ecx, [edx + edx*2 - 0x36fcf70]
add ecx, 0xb907fc3a
not eax
shr edx, cl
rol ecx, cl
mov dword [ebp + edx - 0x6b8489], eax
jbe 0x1511730
adc ch, ch
xchg esp, eax
outsd dx, dword [esi]
cmp eax, 0x4292d2e7
test dword [edi], 0xa2bf9028
pop ebx
das
inc eax
pop ebp
lodsb al, byte [esi]
invalid
xor cl, 0x10
pop eax
mov eax, 0x50019ca6
rol cl, 1
or eax, eax
sar ax, 0xa9
not cl
xadd al, ah
setp al
rol cl, 1
neg cl
xor cl, 0x2f
lea eax, [eax + eax*4 - 0x18501e77]
ror eax, 0x8c
add al, 0x2f
rol cl, 1
ror eax, 0x74
xor bl, cl
not al
jmp 0x12f7562
ror cl, 0xa4
xor eax, 0xf3095321
shl cx, 0xc5
sar ecx, 0x4d
sbb eax, 0xbf17ed06
sal cl, 0x66
rol eax, 2
sub cx, 0x5236
jge 0x1247485
dec edx
not eax
or ecx, edx
ror eax, 2
xor ebx, eax
call fcn.014097d0
xchg ah, al
add ecx, esp
mov word [ecx + eax - 0x77bb76d7], dx
jmp ebp
lea esp, [esp + 8]
je 0x12055bb
jmp 0x14d45f8
push 0xcf2e03b0
mov dword [esp], ebx
movzx ebx, byte [edx]
xor ebx, eax
push 0x50945ba3
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x10fc4b0]
shr eax, 8
xor eax, ebx
inc edx
call fcn.01114f4b
add dl, dl
lea edx, [edx*8 + 0x3629a50b]
mov eax, dword [edi + edx - 0x3985c59b]
jge fcn.0121e325
lea edi, [edx + edi - 0x3985c597]
and edx, ecx
shl ecx, 0xb1
xor eax, ebx
jmp 0x129102f

Function at 0x13f2a2a
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov ebx, dword [esp + 8]
call fcn.014f7e84
add byte [eax], al
inc edi
je 0x13f2a7b
inc ebx
push eax
add byte [ecx + 0x4b042444], cl
mov dword [esp + 4], eax
dec ebx
add byte [eax], al

Function at 0x13f96d1
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov edi, dword [esp + 0x18]
call fcn.01419a9b
mov eax, 0x99a2390d
lea ecx, [eax + 0x3f2c9639]
lea edx, [eax + eax*8 + 0x6da69984]
mov eax, dword [edi]
shl ecx, 0x92
lea edi, [edi + ecx*2 - 0x7a2ffffc]
setnp dl
xor eax, ebx
xor edx, ecx
jno 0x11ee0a0
mov edx, 0xdc1f340e
mov edx, dword [ebp]
mov eax, 0x30a6d685
movzx ax, byte ss:[edx + eax*2 - 0x614dad0a]
add ebp, 2
mov ecx, 0x3ebfb102
mov word [ecx + ebp - 0x3ebfb102], ax
movzx edx, cx
lea esi, [ecx + esi - 0x3ebfb106]
call fcn.014ecd17

Function at 0x13fb778
Capabilities:
Encode data using xor

Disassembly:
jae 0x1311fb6
xor cl, bl
call fcn.01341ab8
call fcn.014ce8f6
mov edx, eax
mov eax, dword [eax + esi - 0xaf1a]
call fcn.011796ea
mov ecx, 0x718d28e
xor cl, ch
or ecx, 0x5bb062b1
mov ax, word [esi + ecx - 0x5fb8f2fd]
lea esi, [esi + ecx - 0x5fb8f2fb]
xor cx, cx
movzx ecx, byte [ebp + ecx - 0x5fb80000]
mov edx, 0xe412f601
adc ebp, 1
or edx, 0x4d3a213e
jp 0x118b63a
xor ecx, 0xe13c69b9
add eax, eax
xadd dword [esp + edx*2], eax
lea ecx, [edx + ecx - 0x1107929f]
add dword [esp + edx], eax