joyce8/EMBER2024-capa huggingface dataset:
Function at 0x856d75
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rol eax, 1
bswap eax
bts edx, ecx
jb fcn.007b4ce3
sbb eax, 0x921c3396
pop ecx
not edx
bswap eax
inc dl
movsx ecx, dl
xor ebx, eax
and byte [esp], dl
sub ecx, ecx
bswap ecx
adc edi, eax
pop ecx
pop edx
jmp fcn.009542f2

Function at 0x858d57
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
pop edx
xor ecx, ebx
not ecx
mov dword [esp], 0xeeb496ae
mov eax, dword [esp]
lea edx, [eax - 0x1e4c29eb]
neg ecx
btr ax, 0xaa
not ecx
xor ecx, 0x4ab7049f
neg al
dec dword [esp]
sub eax, edx
neg ecx
xor dword [esp + eax*4 - 0x7930963c], eax
setae dl
bswap ecx
lea ecx, [ecx + eax - 0x6ff9eb39]
or eax, eax
rol ecx, 3
xor edx, eax
setns al
xor ebx, ecx
shr edx, 0x3b
sar word [esp + eax - 0x1e4c24ff], 0xe1
dec dl
add edi, ecx
lea esi, [esi + eax*4 - 0x79309402]
sar word [esp + edx*2 - 0x2e], 0xcb
pop edx
imul ax
movzx eax, word [esi + eax - 0x1e4c0000]
xor ax, bx
xor dl, 0xb7
lea ecx, [edx*2 - 0x2be86de8]
dec ax
shr ecx, cl
cmovne dx, cx
btc edx, 0x98
neg ax
add edx, edx
push ecx
and edx, 0xd97d60c
adc ax, 0x8098
inc edx
rol byte [esp + edx*2 - 0x1b282400], 0x21
xor ax, 0x1cb5
lea ecx, [ecx + ecx*4 + 0x4492fdac]
add edx, edx
dec edx
inc ax
neg edx
not edx
ror ax, 1
or ecx, 0xa19c2f95
xor bx, ax
lea ebp, [edx + ebp - 0x1b282402]
xadd dword [esp + edx*4 - 0x6ca09000], edx
neg dl
neg cl
mov word [ebp + edx*2 - 0x1b7e], ax
imul dx, cx
pop ecx
jb fcn.00754c95

Function at 0x85a8bf
Capabilities:
Encode data using base64

Disassembly:
xor edx, esi
call fcn.0073b368
not ecx
mov eax, edx
sar al, 0x87
dec ecx
jmp 0xd03ead

Function at 0x85ec0a
Capabilities:
Encode data using base64

Disassembly:
pushfd
mov edx, 0xd819a199
xor edx, edx
mov edx, dword [esp + 8]
mov dword [esp + 8], 0xb576c37a
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.00912a97

Function at 0x860b96
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp], 0xe0005c23
jmp 0x89a614
cmp esi, edx
jmp 0x7d9b09
Function at 0x8617f9
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esi + eax*2 - 0x2b65599e], ecx
movzx ebx, ax
mov dword [esp + ebx*2 - 0x159a2], ebx
mov dword [esi + eax - 0x15b2acd1], edx
sar ax, 0xe1
movsx ecx, ax
btc bx, 0xb5
mov ebx, dword [esp + eax*2 - 0x2b65acc8]
lea edi, [edi + eax*4 - 0x56cb59a4]
push eax
lea edx, [eax*8 + 0x5cb902ba]
mov ecx, dword [eax + edi - 0x15b2d668]
xor ecx, ebx
dec byte [esp + eax - 0x15b2d65d]
idiv dword [esp + eax - 0x15b2d660]
and edx, dword [esp + eax - 0x7f88eef5]
ror ecx, 1
not eax
sal al, 0x81
not ecx
not dl
rol ecx, 1
lea ecx, [ecx + edx*2 + 0x3842b92d]
shl eax, 0xc6
not edx
cdq
xor ebx, ecx
add ebp, ecx
shl byte [esp + eax*2 - 0x3b8881f7], 0x65
pop ecx
pop eax
pop edx
pop ecx
jb fcn.00909547
mov edx, 0xb0840a2d
movzx eax, dx
lea esi, [esi + eax - 0xa31]
sar edx, 0xc
mov edx, dword [esi + eax*2 - 0x145a]
xor edx, ebx
sar eax, 0xf9
add al, 0xa5
btc ax, ax
rol edx, 1
shl al, 0xc3
bswap edx
sar ax, 0x24
adc edx, 0xc52e29b4
sal eax, 0xe2
ror eax, 0x79
not edx
bswap eax
add eax, 0xb0249006
neg edx
xor ebx, edx
lea eax, [eax*8 + 0x6f1db481]
add edi, edx
sub esi, 1
movzx edx, byte [esi]
xor dl, bl
neg al
jg 0x9af357
ror cl, 1
ror ax, 0x64
add dword [esp + 1], eax
dec cl
ror cl, 1
add dword [esp + 4], eax
xor bl, cl
lea ecx, [esp + ecx + 8]
sub byte [esp + 2], al
mov byte [ecx], dl
xchg word [esp + 6], ax
lea edx, [eax*8 + 0x2d362b12]
add byte [esp + edx - 0x2d32d93b], dh
mov cx, 0x1c
neg byte [esp + edx - 0x2d32d93e]
cbw
mov word [esi + edx - 0x2d32d940], cx
lea ecx, [eax + edx*8 + 0x61130028]
mov dword [esp + edx - 0x2d32d93e], eax
ror cl, 0x85
lea esi, [edx + esi - 0x2d32d940]
shr eax, cl
and ecx, edx
push edx
mov dword [esp + eax - 0x1ff], edi
ret 8

Function at 0x86750f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
cdq
rol dl, 0x81
mov ebx, dword [esp + 4]
xadd al, cl
pop ecx
pop edx
jb fcn.00c9bff2
jmp 0x89c822
mov ecx, 0xfd021109
mov edx, dword [ebp - 4]
lea eax, [ecx + ecx*2 - 0x3c5c55fb]
neg ecx
xor edx, ebx
push eax
sub cl, 0x95
push eax
neg edx
xadd word [esp + ecx - 0x2fdee5e], cx
sbb ecx, eax
and dword [esp + ecx - 0x4853fffb], 0xc2ac4e33

Function at 0x868432
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea esp, [esp + 0x1c]
jne 0x8037cc
pop edi
Function at 0x86a338
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push 0x4ab84fa7
jmp 0x911620
shl eax, 0x72
sal word [esp + eax - 0x6f000000], 0x4c
xor bl, cl
mov dword [esp + eax - 0x6f000000], edx
lea ecx, [esp + ecx + 4]
shr al, 0xa1
and dl, byte [esp + eax - 0x6effffff]
pop edx
mov eax, dword [ecx + edx*2 + 0x5ffffc00]
lea ecx, [edx + edx + 0x3037ab80]
or cl, 0x95
mov dword [edi + edx*2 + 0x5ffffbfc], eax
mov eax, ecx
mov edx, dword [ebp + edx + 0x2ffffdfb]
cwde
not eax
xor eax, 0x3813af9b
xor edx, ebx
push ecx
pop eax
not edx
xor edx, 0xcb958c33
or cx, cx
not edx
xchg ch, cl
sar al, 0xc2
shl cl, 0x27
adc edx, 0x398a7139
inc eax
dec al
sar ecx, 0xde
xor ebx, edx
mov dword [edi - 8], edx
add edi, 0xfffffff8
mov ecx, dword [ebp - 9]
movzx edx, al
and al, dl
jns 0x7d2ef6
lea ebp, [ebp + edx*2 - 0x1d3]
sal dx, 1
cdq
xor ecx, ebx
xor ecx, 0x58120225
lea ecx, [eax + ecx - 0x79934333]
and edx, edx
shl eax, 0xae
push eax
ror ecx, 1
and byte [esp + 2], ah
sbb ecx, 0x139e7797
and edx, 0xcb23eb2f
dec eax
setnp byte [esp]
xor ebx, ecx
not eax
and eax, 0x5f3b4a88
sal eax, 0x37
adc esi, ecx
pop edx
jmp fcn.00c9bff2
push 0x6834ea88
pushfd
or byte [esp + 4], 0xa8
mov dword [esp + 8], 0x814bc2f3
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.00cb8079
mov ecx, 0x6fb06aa1
movzx ecx, byte [ebp + ecx - 0x6fb06aa2]
push 0xdb19200d
mov eax, dword [esp]
movsx edx, ax
xor cl, bl
shr dword [esp + edx - 0x200d], 0x87
rol cl, 1
inc cl
rol edx, 0x1c
neg byte [esp]
rol word [esp + 1], 0x87
ror cl, 1
xchg dword [esp], eax
xor dword [esp + eax*2 - 0x232b780], 0x7e8d1b04
adc cl, 7
jmp 0x849eb3
dec dword [esp]
add ebp, 4
xor edx, ebx
call fcn.00764b84
inc ecx
dec dl
inc ecx
push ebp
dec ecx
adc ebp, edi
inc esp
xor byte [esp + eax*2 - 0x6526], ah
inc ecx
not ah
dec esp
mov esi, dword [esi + eax - 0x3295]
dec edx
mov ebx, dword [eax + esi - 0x3295]
dec eax
cdq
jne 0x949e14
mov edi, 0x2b97bfba
inc ecx
mov edx, dword [ebx + edi - 0x2b97bfba]
inc esp
movzx esi, bh
movzx eax, di
inc ecx
movsx ecx, si
dec esi
lea ebx, [edi + ebx - 0x2b97bfb6]
dec esi
lea edx, [esi*2 - 0x7d17f42]
inc ecx
xor edx, ecx
inc esp
movsx eax, bh
shl di, 0xa2
movzx ebx, cx
inc edx
rol edx, 1
inc ebp
movsx ebp, al
dec esi
lea edi, [ebp*4 - 0x4f75295f]
dec ecx
shl esi, cl
xor edx, 0xe99161a9
inc edx
not edx
inc ecx
push ecx
inc esp
add bh, bh
xor dword [esp + edi - 0x2b97fee8], edx
inc ecx
pop ecx
dec esi
lea esp, [eax*8 - 0x62ffe962]
shr cx, 0x2f
dec eax
arpl dx, dx
call fcn.007b4b13
inc ecx
and ecx, edx
dec eax
mov dword [eax + esi - 0x3295], ebx
inc ecx
push ebp
inc ecx
pop eax
bswap edi
dec eax
mov dword [esp + eax*4 - 0xca54], ebp
ret 8
Function at 0x86bf5b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
mov ebx, 0xa68b170c
movzx edx, bx
mov dword [ebp + edx*8 - 0xb860], eax
shr bx, 0xce
xor ebx, ebx
pop ebx
call fcn.009a2418
mov edx, 0x769fbe94
push edx
movsx eax, dl
mov edx, dword [edx + ebp - 0x769fbe94]
btc ax, 0x8e
shl eax, 0x3e
sar ax, 0xad
mov ecx, dword [eax + ebp + 4]
lea ebp, [ebp + eax*2 + 8]
not dword [esp + eax]
cwde
mov dword [edx + eax*8], ecx
xor eax, dword [edi + eax*2]
mov edx, 0x97ba5619
add edi, 4
sub dl, dl
xor eax, ebx
or byte [esp + 1], dh
movsx ecx, dx
xor cl, byte [esp + ecx*2 - 0xac00]
dec eax
bt cx, 0x93
btr edx, 1
shl cl, 0xc5
not eax
xor byte [esp + ecx - 0x565d], ch
ror eax, 1
btc ecx, 0x96
not dx
not eax
bts edx, 0xa1
call fcn.00d0bd57
mov ecx, 0x3d2f861e
or cx, 0x9a81
movsx eax, cx
mov eax, edi
jl 0x8e3b36
mov cx, word [edx + eax - 0x9367ad]
lea esi, [esi + edx - 0x9367af]
xor dword [esp + edx - 0x9367a9], 0xb633bcbd
mov word [edx + esi - 0x9367ad], cx
inc dword [esp + edx - 0x9367a5]
call fcn.009b39e1
jae fcn.00c833ea
dec ebx
lea esp, [esp + 4]
jne 0xcef5b9
mov eax, 0x414a319
mov eax, dword [ebp + eax*8 - 0x20a518c8]
push 0x9d8550ae
push 0xe5319513
jmp 0x7ad157
lea edi, [ecx + edi - 0x3d2f9ea1]
push ecx
sar dword [esp + ecx - 0x3d2f9e9f], cl
mov word [edi + ecx*2 - 0x7a5f3d3e], ax
lea esi, [esi + ecx*2 - 0x7a5f3d42]
movzx edx, word [esp + ecx*2 - 0x7a5f3d3e]
mov eax, dword [ecx + esi - 0x3d2f9e9f]
xor eax, ebx
push edx
not eax
push ecx
call fcn.00c3f45e
mov eax, 0xda33d616
neg eax
mov eax, dword [ebp + ebx*4]
push 0x71229bb3
mov dword [esp], eax
call 0x86bf5b
lea ebp, [edx + ebp - 0x936081]
bt dx, cx
movsx eax, cl
movzx eax, byte [ebp + edx*8 - 0x49b0400]
xor al, bl
or dx, 0x672d
xor al, cl
mov dword [esp + ecx - 0x437fffff], edx
imul cx, dx
inc al
shl dword [esp + ecx - 0x437f984f], 0xc3
not cx
rol al, 1
neg al
xor bl, al
push ecx
neg word [esp + ecx - 0x437f67a6]
sar word [esp + ecx - 0x437f67ab], cl
lea eax, [esp + eax + 0xc]
jb 0x86bf2d

Function at 0x86e787
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
ror eax, 2
not cl
bts dx, dx
neg eax
btr ecx, ecx
not edx
xor ebx, eax
neg edx
sal dx, 0x8d
mov dword [esp + edx - 0x68c44000], 0xab14488
add esi, eax
mov eax, dword [edx + ebp - 0x68c44000]
shr byte [esp + edx - 0x68c43ffe], 0xe3
xchg dword [esp + edx - 0x68c44000], edx
mov cl, byte [edx + ebp - 0xa164484]
jnp 0x77a4f3
Function at 0x86f3b6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x6320cf0d], eax
sub ecx, 0xfe2a3e9b
lea eax, [eax + edx*2 - 0x78c206d0]
pop edx
xor ax, 0xa11
xor ebx, ecx
xor dx, dx
rol edx, 0xc3
sar edx, 0xd7
adc esi, ecx
mov eax, dword [edi + edx*2 - 0x64]
and dl, dl
bts edx, edx
mov cl, byte [edi + edx*4 - 0x1000c4]
jb 0xc9d2d6
sar edx, 0x44
dec edx
shr eax, cl
movzx ecx, dx
jmp 0x96ed7d
xadd edx, ecx
mov dword [edx + edi - 0x8002], eax
movsx eax, cx
mov ecx, dword [ebp + edx - 0x800c]
and edx, edx
xchg edx, eax
lea ebp, [ebp + edx*4 - 0x10010]
or eax, eax
not edx
xor ecx, ebx
sub dx, 0x6b27
sal dx, 0x81
lea ecx, [ecx + edx - 0x49f8eb7c]
not ecx
xor al, 0xb5
bswap ecx
xchg al, dl
bts edx, 0x24
ror ecx, 3
div al
cdq
xchg edx, eax
not ecx
or al, ah
sub eax, edx
je 0x81484f
sbb ecx, 0xb58635a1
rol ecx, 1
lea eax, [eax*4 - 0x45568661]
jmp 0xc79b2d

Function at 0x878ea8
Capabilities:
Authenticate hmac

Disassembly:
adc ebp, edx
mov edx, ecx
btc dx, ax
pop ecx
jb fcn.0087275e
rol eax, 1
ror edx, 0x5c
setb byte [esp + edx*2 - 0x6544b7b0]
neg eax
inc dx
sal edx, 0x35
xor ebx, eax
not edx
not dl
xor dword [esp], edx
adc esi, eax
jmp 0xc87e38
not dx
lea ecx, [edx - 0x435beec8]
pop edx
pop ecx
jmp fcn.00882a69

Function at 0x87b2a4
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
push edx
mov dword [esp + 4], 0xe69de7c7
lea esp, [esp + 4]
call int.00c79305
mov ecx, 0xaa08d33c
rol ecx, 0x66
lea edx, [ecx + ecx - 0x5763615a]
movzx ecx, byte [edi]
adc edi, 1
inc edx
bt edx, 0x88
xor cl, bl
jmp 0xc975ed
rol cl, 1
dec cl
mov eax, edx
rol cl, 1
btc edx, 0x84
and dl, 2
sub ax, dx
not cl
jge 0x8b0612
Function at 0x87cacc
Capabilities:
Encode data using base64

Disassembly:
lea edx, [eax*8 + 0x72b83fb8]
push edx
not cl
dec cl
or byte [esp + eax + 3], 0xf
ror cl, 1
ror dl, 0xc5
xadd dl, dh
push edx
neg cl
cdq
and edx, edx
jns 0x978eb5
mov ecx, 0x1aa639b3
movsx eax, cl
movzx ecx, byte [ecx + ebp - 0x1aa639b4]
xor cl, bl
jmp 0x97ca2d
xor cl, 0x95
dec cl
push eax
push eax
pop edx
neg cl
shl ax, 0xaa
and dl, ah
adc cl, 0x9f
jmp 0xcaf6e3
bswap edx
push eax
xor bl, cl
inc byte [esp]
lea ecx, [esp + ecx + 8]
not dword [esp + 1]
neg al
shl dword [esp + 4], 0x34
mov eax, dword [ecx]
mov edx, eax
mov ecx, 0x3820d89c
mov ecx, dword [edx + ecx*2 - 0x7041b138]
adc dword [esp + 3], 0xd887d1b6
mov edx, dword [esp]
mov dword [edi - 4], ecx
movsx ecx, dx
mov ecx, dword [ebp + ecx*2 - 0x6607]
btr edx, edx
inc dword [esp + 1]
sbb ebp, 5
add dword [esp + 3], edx
xor edx, edx
imul edx, edx
xor ecx, ebx
not byte [esp + edx*8 + 7]
dec ecx
call fcn.00ce6da0
mov eax, 0x2e8ea304
movzx edx, ax
mov ecx, dword [edi + edx - 0xa304]
dec ax
push eax
or al, 0x1d
movzx dx, byte ss:[ecx + eax - 0x2e8ea31f]
cbw
mov cx, dx
shr eax, 0xa1
mov edx, 0xb61c3030
movzx cx, cl
or ax, ax
cwd
mul byte [esp + eax*2 - 0x2e8e001c]
mov al, byte [edi + eax*4 - 0x5d1c2144]
pop edx
jae 0x8b0609
lea edx, [edx + edx + 0x641246b7]
not cl
xchg dh, dl
not al
and dx, dx
setle dl
and dl, 0x2e
and cl, al
mov word [edi + 4], cx
lea eax, [edx + edx*4 - 0x7bd14aed]
sar ax, 0xc1
mov ecx, dword [esi + eax - 0x4a1d330d]
imul ax
jno 0x91c656
inc eax
xor ecx, ebx
shr al, 3
jp 0x91de35
jmp 0xbef7a17d

Function at 0x88108e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp + ecx*2 - 0xa], ecx
add al, 0xa0
xor bl, al
btr edx, ecx
lea eax, [esp + eax + 4]
jae 0x8ef388
movzx dx, byte [eax + ecx - 5]
movsx eax, cx
lea edi, [edi + ecx*4 - 0x16]
adc cx, ax
inc word [esp + ecx - 0xb]
mov word [edi + ecx - 0xb], dx
sar word [esp + ecx*4 - 0x2a], cl
movsx edx, byte [esp + ecx - 0xb]
adc ecx, dword [esp + ecx - 0xb]
lea ebp, [ecx + ebp - 0x15]
mov ecx, dword [ebp + ecx - 0x11]
adc edx, edx
idiv al
push edx
xor ecx, ebx
neg ecx
xchg edx, eax
push eax
jmp 0x95e67d
mov eax, dword [esi + ecx*4 - 0x4c]
neg cl
sub ecx, ecx
lea esi, [esi + ecx + 8]
btc cx, 0x26
mov dword ss:[ecx + edx - 0x40], eax
sar ecx, 0x8a
lea eax, [ecx + ecx*4 + 0x438be120]
lea ebp, [ebp + ecx - 4]
adc cl, 0x3f
mov eax, dword [ebp + ecx - 0x3f]
movzx edx, cx
xor eax, ebx
ror ecx, cl
shr dx, 0x67
not eax
neg edx
bswap ecx
rol word [esp + eax - 5], 0xc9
ror ecx, 2
cdq
bts eax, edx
or al, 0x92
xor ecx, 0x551ea6bc
xor ax, word [esp + eax - 0x95]
add eax, dword [esp + eax - 0x97]
setp dl
sbb ecx, 0x803c2d2a
push eax
mul dl
xor ebx, ecx
rol byte [esp + eax - 0x9d], 0xe1
jno 0x95fb2f
sbb dword [esp + eax*2 - 0x13c], edx
adc esi, ecx
pop edx
pop ecx
pop ecx
pop edx
jmp fcn.00c9bff2

Function at 0x8813be
Capabilities:
Encode data using base64

Disassembly:
jmp 0xcd9ece
lea esp, [esp + 0xc]
jne 0x75160a

Function at 0x882a7a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub dl, 0xa3
sal ecx, cl
shl ecx, 0x92
jbe 0xc9b2f2
call fcn.00831b38
xor bl, dl
push ecx
lea edx, [esp + edx + 0xc]
call fcn.009a12e8
Function at 0x88349e
Capabilities:
Encode data using base64

Disassembly:
sub ax, cx
mov al, byte [esi + ecx - 0x2474b9a0]
adc cx, 0x8e0d
not ecx
shl ecx, cl
not dl
not al
push ecx
shr ecx, 0x77
and dl, al
movzx eax, cl
dec eax
mov word [esi + ecx - 0xe1], dx
mov al, byte [ebp + ecx*2 - 0x1bd]
lea ebp, [ecx + ebp - 0xdb]
shl ecx, 0xed
xor cl, cl
mov dword [esp + ecx*8 - 0xe0fffc], 0xf53f9f9d
xor al, bl
bswap ecx
rol al, 1
sub al, 7
call fcn.008df707
Function at 0x889e9d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sbb esi, 7
mov dword [esp], 0x871d2d25
mov dword [esi + 0xc], eax
pop eax
ror ax, 0x2c
mov dword [esi + 8], ebx
mov dword [esi + 4], ecx
sbb eax, eax
xadd al, ah
mov dword [esi], edx
pop ebx
neg eax
call fcn.008c21a3
lea esp, [esp + 0x10]
je 0x957de0
jmp 0x957dbe
mov eax, dword [ebp + ebx*4]
push 0xcbb4132e
xor dword [esp], 0xc7b31ab2
jo 0xc8728c
mov dword [esp], eax
dec ebx
jne 0x889ed5
push 0x75939414
mov eax, 0x54a0b43e
bswap eax
mov eax, dword [eax + ebp - 0x3eb4a054]
not dword [esp]
call fcn.007377c8
wait
mov eax, dword [0x134e0107]
sbb eax, 0xd19e4a7b
or dl, bh
add byte [0xa3996d8], ah
xlatb
add byte [ecx + 0xa51beda], cl
xlatb
add ch, dh
cdq
out dx, al
invalid
Function at 0x88f702
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov ecx, dword [esp + edi + 5]
inc edx
xadd byte [esp + edi*2 - 0xb], cl
dec ebp
arpl ax, ax
pop ecx
dec edx
mov dword [esp + edi - 3], ecx
dec ebp
and esi, esi
dec ecx
adc ebp, eax
dec ecx
mul edi
idiv word [esp + edx + 9]
dec eax
mov dword [esp + edx*2 - 0x90e], ebp
ret 8
dec edx
lea esi, [esi + edi*8 - 0x56]
dec edx
mov dword [esp + edi - 0xb], eax
inc cx
sal esp, cl
inc si
mov dword [esi + edi*8 - 0x58], esp
inc esi
movzx eax, word [esp + edi*8 - 0x56]
inc ecx
push eax
inc edi
mov eax, dword [ebx + eax*2 - 0xeb7e]
inc dx
sar dword [esp + edi - 2], 0x8c
jae 0x7ba87c
inc bp
btr edx, edx
dec edi
lea ebx, [ebx + edi*2 - 0x12]
mov ecx, eax
inc ebp
xor eax, ecx
sub byte [esp + ecx - 0x75bfdf3e], cl
inc edx
sub dword [esp + edi - 2], ecx
inc esp
movsx ebp, cx
inc ecx
not eax
inc ebp
movzx esi, dx
inc ecx
ror eax, 3
inc ecx
shr ebp, 0x90
inc dx
xor edx, dword [esp + edi*4 - 0x2b]
inc edx
rol byte [esp + edi*2 - 0xf], 0x26
inc ecx
bswap eax
inc ecx
dec eax
inc ecx
neg ch
push edx
dec ecx
ror ebp, cl
inc ecx
not eax
inc ecx
neg eax
inc ecx
movsx ebx, dl
dec esi
mov dword [esp + edi + 5], ecx
dec esp
btc eax, esi
inc edx
not byte [esp + edi]
inc cx
neg ebp
inc esi
xor dword [esp + edi*8 - 0x48], eax
inc edx
sar dword [esp + edi*2 - 0x16], 0x29
jbe 0x84ad00
mov eax, 0x49079d2b

Function at 0x891301
Capabilities:
Encode data using xor

Disassembly:
push edx
xor ecx, 0xf1155ca7
adc ax, 0x989e
xchg dword [esp + edx - 0x62bb5883], edx
and dword [esp + edx*2 - 0x18c576ae], ecx
ror cl, 1
xor bx, ax
not dword [esp + edx*2 - 0x18c576ac]
mov word [edi + edx*2 - 0x18c576b2], ax
sub edx, dword [esp + edx - 0xc62bb54]
mov ecx, dword [esi + edx - 0x6f1e0c5f]
push edx
rol edx, 0x3d
xor ecx, ebx
add dx, 0xf037
dec word [esp + edx*2 - 0x5bc76381]
rol ecx, 1
dec ecx
jmp 0x863ef5
movsx eax, dx
sar byte [esp + edx - 0x2de3b1ba], 7
xor ecx, 0x33b9922f
dec ecx
neg ecx
rol eax, 0x4e
and eax, eax
ror ecx, 1
lea edx, [edx*2 + 0xcb64697]
inc ecx
neg dx
and dl, byte [esp + edx - 0x687d55dc]
bswap ecx
add dword [esp + edx - 0x687d559c], edx
not ecx
xor ebx, ecx
inc eax
add ebp, ecx
movzx edx, byte [esi + edx - 0x687d55ab]
call fcn.00866da9
not edx
ror edx, 1
cwde
call fcn.0092edba
mov edx, 0x6d2ea1ba
movsx eax, dx
movzx edx, byte [ebp + edx - 0x6d2ea1bb]
and al, 0x2a
jno 0xcf41b2
mov eax, 0xea255c32
movzx eax, word [esi - 2]
xor ax, bx
mov edx, 0x62bb4522
rol ax, 1
imul dx, dx
neg ax
movsx ecx, dx
sar ecx, cl
push ecx
dec ax
xor dword [esp + edx - 0x62bb5884], edx
inc ecx
not ax
jns 0x7e0bd6
xor dl, bl
cwde
movzx ecx, al
inc cl
not dl
sar ax, cl
cwde
rol dl, 1
xor al, al
js 0x954607
or ax, 0xd5ab
adc dl, 0x1f
xor cl, 0xab
and ecx, ecx
not dl
call fcn.007c2f8e
mov ecx, 0x949f420d
mov word [esi], dx
or ecx, ecx
mov ecx, dword [ebp]
mov eax, 0xff161588
adc ebp, 4
movsx edx, al
dec edx
xor ecx, ebx
bts edx, eax
setb al
shr al, 0xc5
inc ecx
ror eax, 0x90
not ecx
cwd
lea ecx, [eax + ecx + 0x60b594eb]
xor ecx, 0xeeb02e90
and edx, eax
rol ecx, 3
and al, 0x25
neg ecx
bt eax, edx
shl eax, 0x74
sal dl, 5
xor ebx, ecx
xor dl, ah
btr dx, 0xb4
adc edi, ecx
shr edx, 0xb6
shl edx, 0xf2
sal al, 0x66
jmp edi
Function at 0x892517
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp], ecx
ror word [esp + 1], 0xc1
not edx
pop ecx
mov dword [edi], edx
lea eax, [esp + 0x24]
mov ecx, dword [eax]
mov edx, 0x6bb405aa
movzx eax, dl
cdq
mov dword [edi + edx - 4], ecx
mov ecx, edx
btc dx, 0xa8
lea edi, [edi + eax*2 - 0x158]
bt dx, 0x22
bswap edx
shl eax, 0x2c
jp fcn.0087275e

Function at 0x895a23
Capabilities:
Encode data using xor

Disassembly:
ror ecx, 1
pop edi
ror dl, 0xa3
neg ecx
dec esp
or esp, ebx
inc edx
shr dword [esp + esi*2 - 0xa9], 0x2a
dec esi
mov dword [esp + edi - 0x54a43020], ecx
call fcn.009c175d
inc esp
dec esp
mov byte [0x440424fe], al
wait
cmp bl, bl
and byte [eax - 0x17], ah
call 0x964a426
invalid

Function at 0x89a445
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jne 0x780f18

Function at 0x89afdf
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
sub esi, 4
movsx ecx, dx
movsx eax, cl
mov eax, dword [esi]
dec cx
add cx, dx
pop edx
xor eax, ebx
add eax, 0x4302bdbc
bswap ecx
add cl, ch
lea edx, [ecx + ecx*2 - 0x21670f46]
rol eax, 3
inc dx
lea eax, [eax + ecx*4 - 0x5ff4e6a0]
ror cl, 0x81
not dx
call fcn.007470a3

Function at 0x89d7a4
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor ebx, eax
mov dword [esp], 0xc8a4fdbc
and ebx, 0xff
or byte [esp + 2], 0x2e
push 0x9d962dbe
mov ebx, dword [ebx*4 + 0x779d64]
adc byte [esp + 3], 0xa6
call fcn.008e6c27

Function at 0x89dfe4
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp + eax*4 - 0x32c], 0x441b5824
add esi, edx
btc eax, eax
mov edx, edi
or eax, ecx
and cl, cl
ror ax, 0x2c
lea edi, [edi + eax*2 - 0x3a131dec]
shr ecx, 0x83
lea ecx, [ecx + eax*4 + 0x5f3f5997]
mov word [edi + eax*2 - 0x3a131dea], dx
pop edx
pop eax
jne fcn.00c9bff2
Function at 0x8a1395
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
btc cx, 0x99
sbb cl, dl
ror eax, 2
push edx
and edx, edx
lea eax, [eax + ecx + 0x791828bf]
not eax
ror eax, 3
xor ebx, eax
sar word [esp + ecx - 0x3a84a6cb], cl
push edx
adc ebp, eax
mov edx, dword [edi + ecx*2 - 0x75094d98]
mov dword [esp + ecx*2 - 0x75094d90], ecx
dec dword [esp + ecx*2 - 0x75094d95]
call fcn.00c4758f
xadd cl, ch
movzx edx, word [ebp - 2]
sbb al, 0x33
sbb ax, 0xfc83
xor dx, bx
btc ax, cx
rol dx, 1
add ecx, ecx
xor dx, 0x6fa7
lea eax, [eax*4 - 0x7fd65b72]
bt ecx, 0x36
not dx
not ax
bt ax, 0xbc
adc dx, 0x3b18
bswap ecx
or eax, ecx
idiv al
neg dx
xor bx, dx
mov word [esi], dx
not ecx
rol ax, 0xe1
btc ecx, eax
mov edx, dword [ebp + ecx - 0x2522000a]
cbw
lea ebp, [ebp + ecx - 0x2522000a]
xor edx, ebx
dec edx
not edx
dec ecx
call fcn.00788981
mov ecx, 0xd039812b
and ecx, ecx
sbb esi, 4
movzx edx, cx
mov ecx, dword [esi + edx - 0x812b]
ror edx, 0x79
movsx eax, dl
mul edx
xor ecx, ebx
push eax
xadd dl, ah
lea ecx, [ecx + eax + 0x520031]
call fcn.0088c070
mov eax, 0x4b0e110b
movzx dx, byte [ebp + eax - 0x4b0e110b]
lea ecx, [eax + eax*8 - 0x46c1c1f7]
mov cl, byte [ebp + eax - 0x4b0e1109]
xor eax, 0xdc80129b
and eax, eax
adc ebp, 2
bt eax, 0xaf
rol al, 0xa4
ror eax, 0xd4
not dl
ror eax, 0x3d
jb 0x99b45c
not cl
and dl, cl
lea ecx, [eax*4 - 0xece5674]
mov word [ebp + eax*2 - 0x309978e], dx
bswap ecx
lea esi, [esi + eax - 0x184cbcb]
add ecx, 0xdab439f
mov edx, dword [esi + eax*2 - 0x309978e]
sbb ecx, 0xf2b8d929
adc ecx, 0x8fb3219c
cwde
xor edx, ebx
bts ax, ax
jb 0x90498a
dec edx
dec al
bswap edx
imul eax, ecx
or eax, eax
ror edx, 2
call fcn.0090967f
add byte [eax], al
inc ebx
jb fcn.00904a06
popal
je 0x904a09
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x904a0a
je 0x904a14
bound ebp, qword [ebp + 0x42]
imul esi, dword [ebp + ebp*2 + 0x61], 0xc8d00070
ror al, 1
mov al, byte [0x8bca911e]
lodsb al, byte [esi]
inc esp
movsb byte es:[edi], byte [esi]
push ds
xchg ecx, eax
retf 0x15e8
push ds
xchg ecx, eax
retf 0xac8b
sar cx, 0xf

Function at 0x8a1fc2
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea ecx, [eax + eax*2 + 0x1714d9a6]
and ax, word [esp + ecx*2 - 0x2c772e3c]
lea edi, [ecx + edi - 0x163b9727]
push eax
xchg dword [esp + ecx*2 - 0x2c772e46], ecx
movsx edx, word [esp + 8]
pop edx
pop edx
pop edx
pop ecx
jae fcn.00c9bff2
mov ecx, 0x21b9e891
inc esp
movsx edi, cx
inc esp
movzx esi, cx
inc ebp
mov ebp, dword [ebx + ecx - 0x21b9e891]
dec ebp
lea ebx, [ebx + ecx*2 - 0x4373d11e]
movsx edi, cx
inc ecx
movsx ebx, bh
inc esp
movsx eax, di
inc ebp
xor ebp, ecx
inc ecx
not ebp
inc ecx
movsx eax, ax
dec ebp
xor edi, eax
call fcn.009b6c2b

Function at 0x8a91c0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp + edx - 0x60894908], 0x810b9e92
neg cl
xadd dword [esp + edx - 0x60894908], edx
not cl
setno byte [esp]
shl al, 2
not dword [esp]
sbb cl, 0x38
btc edx, 0xbd
or dword [esp], 0x7fa51b87
pop edx
neg cl
ror cl, 1
and dl, dl
xadd edx, eax
xor cl, 0x9c
and ax, dx
setne al
xor bl, cl
cwde
lea esi, [esi + eax*4 - 0x2006]
jmp 0x883f28