joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14f76fa
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ebx*4 - 0x46aa0004], ebp
ror bl, 0x87
inc edi
bswap edi
not bx
not dx
pop ebp
sub edi, 0xfe37b988
jmp 0x19eb53f
movsx eax, dx
mov esi, esp
sbb al, dh
and ax, 0xc434
rol ebp, 0x68
lea ebx, [ebx + esi - 0x11aa800e]
neg dl
sub bl, dh
not edi
neg edi
shl ebp, 0xf7
neg bp
bt ebx, ebp
rol edi, 1
add edi, eax
sar ebp, 0x16
mov dword [esp + ebx - 0x11aa7f2e], esi
shl dx, 0x61
mov dword [esp + ebx*4 - 0x46a9fd08], ecx
movzx ecx, bp
jbe 0x18998c5
mov ecx, 0x6cb7cc0d
rol cx, cl
lea ebp, [ebp + ecx - 0x6cb7b985]
sal cl, 0x66
mov eax, dword [ebp + ecx - 0x6cb7b940]
adc ecx, 0xfba99423
setne cl
xor eax, ebx
lea edx, [ecx + ecx + 0x138ce294]
imul dx, cx
btc cx, dx
not eax
dec dx
imul ecx, edx
add edx, edx
neg eax
dec eax
add edx, ecx
bswap eax
not eax
bswap edx
sar ecx, 0x2d
dec eax
dec ecx
sar cx, 0xee
xor ebx, eax
add esi, eax
mov edx, dword [ecx + edi]
and cx, cx
movsx eax, cl
adc ax, word [edx + ecx]
movzx edx, cl
dec ecx
xor cl, cl
lea edi, [edi + edx + 2]
btr cx, cx
mov word [edi + edx*8], ax
sbb dl, 0xa2
jmp esi

Function at 0x154a5ac
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
je 0x1942ca0

Function at 0x1569a35
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0xc]
jne 0x15bdc0e
mov esi, 0xa1949793
mov ecx, esi
pop esi

Function at 0x159699d
Capabilities:
Encode data using xor

Disassembly:
inc ebx
mov dword [ecx + ebp - 0xc916f81], eax
movsx edx, cx
mov ecx, dword [esi + ecx*8 - 0x648b7c28]
dec dx
push edx
lea esi, [esi + edx*2 - 0xdf04]
jns 0x15e6e4f
and esi, dword fs:[esi - 0x76]
adc dword [eax], edx
cmpsb byte [esi], byte es:[edi]
xor byte [0x153e6401], bh
jle 0x159699b
int 0x4d
dec ebp
push ecx
jbe 0x1596a17
int3
in al, 0x2a
je 0x15969cd
out dx, eax
iretd
jmp [eax + ebp]
xor byte [ecx], dl
mov ch, 0x57
push edi
bound ecx, qword [edi]
jle 0x1596a6c
popal
call 0xa7f2a3a6
lcall 0xf9b7, 0xa8795c74
movsb byte es:[edi], byte [esi]
jns 0x15969f4
jge 0x15969dc
int1
invalid
aaa
lcall 0x6f9e, 0xd359548
out 0xf6, al
in al, 0xe0
lock xor edx, dword [eax + edi*2]
cmp eax, dword [ecx]
or esp, 0x10
sub eax, dword [bp + di - 0x10]
inc esp
pop ecx
mov al, byte [0xb1c08b44]
adc edx, dword [ebx + 0x5f]
adc dword [ecx + eax*2 + 0x71c50352], ebp
salc
or edi, edi
push 0xa424a096
sbb al, 0xcd
test dword [ecx - 0x4b25705c], eax
inc esi
cld
std
dec edx
les eax, [ecx]
or esp, 0x10
push esi
sbb dword [edx + 0x3db14df0], esi
in al, dx
sbb esi, 0x310aa7a4
int3
add edx, edx
movzx eax, dl
xor ecx, ebx
push eax
idiv al
push edx
not ecx
shl edx, 0xf4
ror ecx, 1
pop eax
neg ecx
and dword [esp + eax*8 - 0x6f834], 0x7134dd96
ror ecx, 2
mul edx
not dl
xor ebx, ecx
add word [esp + edx - 0xd176], ax
setl dl
adc edi, ecx
mov dword [esp + edx*8 - 0x68800], edi
ret 0xc
Function at 0x15db49a
Capabilities:
Encode data using base64

Disassembly:
ror al, cl
bswap edx
rol dx, cl
dec edx
not al
inc al
push ecx
xor al, 0x96
imul ecx, dword [esp]
sal dl, cl
sbb ecx, edx
ror al, 1
dec al
xchg ch, cl
not dx
neg al
sal edx, cl
sar dword [esp + edx - 0x6546e000], 0xd2
ror al, 1
xor bl, al
add edx, edx
sar edx, 0xe8
bt cx, 0x3b
lea edi, [edi + ecx - 0x5efc794f]
mov word [edi + ecx - 0x5efc794d], ax
adc ecx, 0xf2151797
jbe 0x1674b74
lea edi, [edi + edx*8 + 0x38ceeefe]
mov dword [esp + edx*8 + 0x38ceef00], 0x2534ff97
lea ecx, [edx*8 + 0x28b16801]
neg ecx
mov word [edi + edx*2 + 0xe33bbc0], ax
je 0x173bb60
not ecx
pop eax
jbe fcn.0186d441
cdq
sub ecx, edx
xadd byte [esp + 2], dl
neg ecx
or al, byte [esp + 3]
xor ecx, edx
pop edx
xchg edx, eax
rol ecx, 1
sub ecx, 0x6eb94a26
inc ax
xor ebx, ecx
btc edx, 0x1a
setb dl
add esi, ecx
sar dl, 2
sbb edx, 0xa28a343d
shr eax, 0x33
movzx eax, byte [eax + ebp - 0x1fff]
setp dl
lea ebp, [ebp + edx - 0x59754f00]
adc edx, edx
xadd dl, dh
movsx ecx, dl
xor al, bl
xor al, 0x3d
jmp 0xcd459a
sbb dl, 0x26
pop eax
jno fcn.0157d7ff

Function at 0x15e1fdb
Capabilities:
Check for software breakpoints

Disassembly:
xchg esp, eax
movsb byte es:[edi], byte [esi]
dec esi
rol edi, 1
mov edi, 0x50e91349
inc edx
sub byte [esp - 0x100e0ba6], 0x93
inc ecx
pop eax
inc ecx
pop ebx
inc ecx
pop esi
jnp fcn.019abb67
shr eax, 8
xor eax, esi
inc edx
call fcn.0169535a
mov ah, 0xb1
in eax, dx
push ss
inc ebx
out dx, eax
mov byte [edx - 0x18], 0x74
xor ecx, dword [ebx]
add byte [ecx + esi*4 + 0x654316ed], dh
out dx, eax
jnp 0x15e1fbc
xchg ebx, eax
sbb al, 0x60
push ebx
pop edx
jecxz 0x15e1ff5
push dword [eax + 0x609dbc0e]
loopne 0x15e2000
mov al, 0xe
mov esp, 0x3e0609d
xchg edi, eax
mov edi, 0xbeb94d00
fisub dword [edx + 0x6424d069]
add byte [ebp - 0x47], cl
mov esi, 0xd069a2da
and al, 0x64
pop edi
mov dl, 0x88
lcall 0xfc2, 0x71e7a40a
adc al, 0xae
jbe 0x15e2078
salc
xlatb
scasb al, byte es:[edi]
push ss
scasb al, byte es:[edi]
cmp esp, eax
popal
dec esi
push 0xdbd61c35
outsb dx, byte [esi]
pop es
jnp 0x15e2056
jbe 0x15e204a
das
or dword [ecx - 0x69], ecx
loope 0x15e2054
mov eax, 0x2e461883
sbb ebx, dword [ebx]
mov cl, 0x1a
pop edx
cmp al, 0xcc
mov edx, 0xb2096f70
jae 0x15e1fdf
xchg esi, eax
xchg ebp, eax
invalid
outsb dx, byte [esi]
push ecx
mov eax, 0x32121cd3
xchg ebp, eax
or al, 0xce
xchg cl, dh
mov ch, 0xcc
aad 0x4d
jle 0x15e1fed
adc byte [ebp + 0x16], al
dec eax
test al, ch
rol dword [ebx - 0x1f], 0x4c
push 0x8055793d
add eax, 0x513af2ec
or eax, 0x9e183adf
xchg ecx, eax
bound ebp, qword [edi - 0x5ee2b010]
pushfd
xchg byte [ebp + 0x75], ah
jbe 0x15e20ce
scasd eax, dword es:[edi]
invalid
sbb eax, 0xe8009028
sbb byte [ebx - 0x35c07c70], ch
les edx, [ebx - 0x1d]
ret 0xd0c3
test byte [ebx + esi*2], cl
fstp qword [ecx - 0x3b]
mov byte [edi + 0x78], 0x3b
inc esi
push 0xb19062fe
mov bl, byte [0xbd1777d4]
salc
int3
Function at 0x1606b81
Capabilities:
Hash data using murmur3

Disassembly:
mul eax
inc cl
not cl
inc edx
xor bl, cl
lea ebp, [ebp + edx - 3]
mov word [edx + ebp - 1], cx
movzx ecx, dl
sub ecx, 0x1c91d131
pop edx
pop edx
pop ecx
js fcn.016b6b9d
leave
cmp byte [ebp - 0x394e9901], ah
int3
btc edx, 0x9c
mov eax, dword [edx + edi - 0x4c1d0006]
xor eax, ebx
lea eax, [ecx + eax - 0x5c06312a]
btc cx, cx
mov dword [esp + ecx - 0xa50c], edx
rol eax, 1
lea edx, [ecx + edx + 0x1e192886]
dec dword [esp + edx - 0x6a36cd98]
sets cl
lea eax, [eax + edx*2 - 0x2566bd8d]
bswap eax
cmovnp ecx, edx
sal dl, 0x64
ror eax, 2
ror edx, 0xcc
inc edx
bswap eax
xchg ch, cl
mov dword [esp + ecx*4 - 0x290], 0x67915484
dec cl
xor ebx, eax
rol cx, cl
bswap ecx
xor edx, 0xaf8e96a4
adc esi, eax
lea edi, [edx + edi - 0x778835ca]
movzx ecx, byte [edi + edx - 0x778835c9]
rol dx, 0xd
movzx eax, dl
sbb byte [esp + edx - 0x778826b2], dl
xor cl, bl
rol al, 0x41
mul word [esp + edx - 0x778826b4]
dec cl
xor cl, 0x9f
push edx
jmp 0x1592e12

Function at 0x160ad03
Capabilities:
Encode data using xor

Disassembly:
jmp 0x19839b5
xadd dword [esp + 4], edx
neg ecx
cbw
mul eax
sal edx, 0x9a
not ecx
or eax, edx
div al
and al, 0x27
bswap ecx
setb al
dec ecx
xor ebx, ecx
call fcn.017273bf
mov edx, dword [edi]
jns 0x1944d01
jo 0x160ad3b
stosb byte es:[edi], al
adc edx, dword [edx + 0x658d9a5]
adc edx, dword [edx + 0x658d9a5]
out dx, al
or eax, 0x4b69ddad
and dl, byte [eax - 0x564f5b47]
xor al, 0xc1
loope 0x160ad33
lodsd eax, dword [esi]
invalid
lea ecx, [ecx + 0xcccbc]
movzx ax, byte [esi]
movsx edx, cx
setbe cl
add cl, byte [edx + esi - 0x5cba]
add edx, edx
lea esi, [edx + esi - 0xb976]
not edx
shr al, cl
mov word [esi], ax
mov edx, dword [edi]
add edi, 4
xor edx, ebx
mov ecx, 0x9b87be9c
inc edx
movzx eax, cl
not edx
xor eax, eax
bts cx, 0x23
adc edx, eax
shl ecx, 0xf2
rol edx, 1
shl al, 0x21
bswap edx
xor ebx, edx
xchg ch, cl
jmp 0x18d248f
add ebp, edx
cdq
add eax, ebp
jmp eax
adc edi, 4
jmp 0x14eb33e
call fcn.01762970
Function at 0x1626a87
Capabilities:
Encode data using xor

Disassembly:
btr eax, ecx
lea edx, [eax + edx - 0x3bef376c]
sal ecx, cl
rol edx, 2
bt ecx, 0x29
sbb cl, ah
xor edx, 0xfa001cb7
neg al
sbb edx, 0x6e92bdb4
shr eax, 0x61
and cl, ch
bts cx, 0xb1
xor ebx, edx
cwde
shl eax, 0x57
adc esi, edx
jmp esi
mov dword [esp], 0xb5b4e32e
push 0x4f8467b5
mov cx, word [ebp + 2]
add ebp, 2
xor dword [esp + 4], 0xda130c37
mov edx, 0xed9e7a1d
adc ax, cx
xchg dword [esp + 4], edx
pop edx
mov ecx, dword [esp + edx - 0x4f8467b5]
mov word [ebp + edx - 0x4f8467b5], ax
sub edx, edx
mov ecx, dword [esi + edx*8]
sal byte [esp + edx + 3], 0xc4
ror dword [esp + edx*8], 0x59
lea esi, [esi + edx + 4]
movsx eax, word [esp + edx]
xor ecx, ebx
sub eax, 0x69f3c23
lea ecx, [ecx + edx*2 - 0x29bf56b5]
and edx, eax
not ecx
or dl, byte [esp + edx + 3]
add dl, byte [esp + edx*4 - 0x13a]
and ax, dx
rol ecx, 1
cdq
inc dword [esp]
lea ecx, [edx + ecx - 0xec38b74]
neg ecx
or byte [esp + 1], dh
cdq
shr eax, 0x27
xor ecx, 0xc31fa19d
sar edx, 0xb5
xor al, 3
je 0x1855a18
ror ecx, 2
ror dword [esp + eax - 0x1f2c002], 0xa6
jb 0x1802d98
popal
call [ecx + ecx*8]
das
cmc
dec esi
shl dword [ebx + 0x23], cl
mov dword [0xb2c2ca5c], eax
sahf
invalid
push edx
xor ebx, ecx
add edi, ecx
imul eax
lea edx, [edx*2 - 0x6d56ee76]
pop ecx
pop edx
jmp edi
sal cl, 2
not eax
lea eax, [eax + ecx*2 + 0x720155ad]
neg eax
call fcn.00d33b58
dec edx
mov dword [esp - 0xa42e], ebx
inc ecx
sar cl, 0x41
inc esi
xor dword [esp - 0xa42e], eax
inc cx
bts esp, 0xbd
dec ecx
sbb edx, ebx
dec ecx
add ebx, 0xa9a51ea3
pop ebx
inc ecx
adc ebx, 0x360bb608
dec edi
lea edi, [esp + edi - 0xa432]
inc edi
mov dword [edi - 0x290b8], eax
inc ebp
movzx eax, sp
inc ebp
mov esi, dword [edx + esi*8 - 0x52170]
dec eax
lea eax, [edx*8 + 0x7c00c73d]
bt eax, eax
inc ecx
push eax
dec edi
lea edx, [edx - 0x14858]
inc ecx
neg eax
dec esp
lea esp, [esi*8 - 0x724ed3f3]
inc esp
xor esi, ebx
inc ecx
dec esi
inc ecx
not esi
inc ecx
xor esi, 0xa205f092
inc ecx
inc esi
dec edx
mov dword [esp + 0x7249b283], ebx
inc esp
xor dword [esp + esi*2 - 0x1485c], esi
pop ebx
dec eax
xor edx, ecx
dec ebp
arpl si, si
dec edx
lea edi, [0x5232baa6]
dec ecx
adc ebp, esi
dec eax
dec edi
js fcn.019abb67
mov dword [edi + eax*2 - 0x65a81c0c], ecx
movzx ecx, ax
rol ax, cl
cwde
lea ebp, [ecx + ebp - 0xe0a]
cbw
mov edx, dword [ebp + ecx - 0xe06]
xor cx, 0xd02c
and cl, cl
xor edx, ebx
and eax, 0x6e0df6a8
shr al, 0x67
sbb ecx, 0xf7956081
bswap edx
shr ax, cl
jae 0x15c3f78
jo 0x1855b1d
stosb byte es:[edi], al
cli
sbb dword [eax + 0xe46fab4], ebx
iretd
stosd dword es:[edi], eax
ret
Function at 0x167a2f4
Capabilities:
Encode data using xor

Disassembly:
sub cl, dl
shl al, 0x26
not ax
jb 0x19822da
jo 0xcc2805
stosb byte es:[edi], al
xor esp, dword [edi - 0x7ecb326e]
out dx, al
add al, 0
add byte [eax], al
mov ecx, 0x398915a4
add byte [eax], al
add byte [ecx + 0x398915a4], bh
mov edx, ecx
mov eax, dword [ecx + esi - 0x398915a4]
xadd dx, cx
seto dl
xor eax, ebx
dec eax
lea edx, [ecx + 0x37944a9b]
add dx, dx
neg cl
rol eax, 1
add cl, 0x86
xchg edx, ecx
sbb eax, 0x9e05ba1e
not eax
btc edx, 0xa
inc edx
setle dl
xor ebx, eax
sar dl, 0xe4
dec cx
adc edi, eax
sar dl, 0x25
mov dx, word [ebp + edx*2 - 0x73122200]
dec ecx
mov eax, 0x922dad1c
cbw
mov ax, word [ebp + ecx - 0x711dc07a]
shr cx, 0xac
mov cl, byte [ebp + ecx - 0x711d0008]
jp 0x172055d
xor edx, dword [esp + ebx + 3]
cpuid
push 0x8c923238
jge 0x1955721
sbb esi, 8
neg dword [esp + 8]
sbb dword [esp + 8], 0x7b16f32f
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
call fcn.01807bbb
inc eax
pushal
mov byte [edx - 0x31a2c395], bl
mov ebp, 0xc0abd4e8
imul esi, dword [edx - 0x50], 0x60b565bd
dec ecx
pop ss
pop esi
or byte ds:[edi + edx*4], 0xa3
xor al, 0x7d
call 0x1e1e9d70
xor byte [esi - 0x49971634], cl
add ch, ch
imul edi, dword [eax + 0x5e596908], 0x8632c83f
and byte [esi], al
inc ebp
cmp eax, 0x200569be
imul esi, dword [ecx], 0x324b86d0
dec edi
movsb byte es:[edi], byte [esi]
jns 0x167a357
inc esp
inc eax
inc eax
mov al, byte [esi + 0x7e]
fcom dword [ebp + 0x496e1578]
lds ebp, [edi - 0x79cd82e8]
outsb dx, byte [esi]
xchg byte [ebx - 0x133bf75f], ah
mov ecx, 0xeab6e4bd
inc esi
add eax, 0x1ada456a
dec eax
push es
or al, byte [ebx + ebp*2 - 0x45]
invalid
sub ebp, 4
mov ecx, dword [ebp]
ror al, 0xc1
ror eax, 0xa1
movzx edx, ax
xor ecx, ebx
bt eax, 0x8d
neg ecx
xor ecx, 0x2ca02c82
not edx
cwde
sub ecx, 0x5898a109
sub ax, dx
xor ecx, 0x2c2410b0
xadd dl, al
shr dx, 0xc7
xor ebx, ecx
add esi, ecx
sub ebp, 1
lea ecx, [edx + edx*4 + 0x72343b16]
shr ecx, 0x4b
movzx ecx, byte [ebp + ecx*8 - 0x722f38]
adc al, ah
cdq
and dx, 0xcf02
xor cl, bl
dec edx
jne 0xcc27eb
mov edx, 0x5d98bd97
jmp fcn.00d6ab7f
ror cl, 1
neg cl
sar dl, 0x81
rol cl, 1
btc eax, eax
xor bl, cl
btc edx, 0x3d
cdq
add ecx, esp
add edx, dword [ecx + edx*4]
lea edi, [edi + eax - 0x7fff99c3]
lea eax, [eax + eax*4 - 0x269ff4c]
mov dword [edi + eax - 0x7d94016f], edx
lea edx, [eax + eax*8 + 0x59a941b0]
jmp fcn.0181ef92
Function at 0x169f32d
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, dword [eax + 0xc]
cmc
push ebx
push esi
push edi
neg di
clc
rcl di, 0x1c
mov edi, 1
mov esi, edi
test ax, sp
shl esi, cl
sal ch, 0x1d
mov ecx, dword [eax + 4]
xor ebx, ebx
mov dword [ebp - 0x20], edx
test sp, ax
test bl, 0xb3
sub esi, edi
cmp ebp, ebp
cmp bl, 0x1b
mov dword [ebp - 0x44], esi
mov si, ax
shld esi, esi, 0x1b
mov esi, edi
cmc
test ah, 0xb0
shl esi, cl
mov ecx, dword [ebp + 0xc]
cmc
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], bl
test di, 0xdc32
cmc
sub esi, edi
cmp di, 0xcb06
mov dword [ebp - 0x48], esi
btr si, 0x98
not si
mov esi, dword [eax]
jmp 0x18e876f
push edx
inc al
shr edx, 0x68
xor bl, al
lea eax, [esp + eax + 8]
mov edx, dword [eax + edx*4 - 0x13d0d00]
movsx eax, byte [esp]
lea ebp, [ebp + eax*8 - 4]
and cx, ax
mov dword [esp + eax + 4], ecx
shr al, 0xc4
mov dword [eax + ebp], edx
lea esi, [esi + eax*4 - 4]
or al, cl
push eax
mov ecx, dword [eax + esi]
ror byte [esp + eax + 7], 2
add word [esp + eax*4 + 6], ax
shl dword [esp + eax + 2], 0xe5
xor ecx, ebx
sar word [esp + eax*2 + 7], 0xa9
jns 0x17344c1
push ebp
mov ebp, esp
lea esp, [esp - 0x48]
mov ecx, dword [eax + 8]
rol dh, 0x1f
jmp 0x15db7f6
mov dword [ebp - 0x28], edi
jmp 0x17bfa1e
jb 0x15dcec3
bswap ecx
movzx edx, al
lea ecx, [ecx + eax*4 + 0x7a17469a]
push eax
push eax
neg ecx
xor ebx, ecx
add edi, ecx
rol byte [esp + eax*8 + 0xf], 0x43
movsx ecx, word [esp + eax + 0xc]
pop edx
pop edx
pop ecx
pop edx
pop eax
jae fcn.019720be
dec ecx
rol eax, 0x8d
jae 0x16b70f6
mov dword [ebp - 0x24], edi
jmp 0x17e0757
mov dword [ecx], ebx
btr cx, dx
sar ecx, 0x38
mov ecx, dword [ebp + 0x14]
mov dword [ecx], ebx
or cl, 0x1a
shld ecx, edx, 0x2b
mov cx, di
mov ecx, dword [eax + 4]
add ecx, esi
cmc
sbb ah, 0xa0
shl al, cl
mov eax, 0x300
cmp bx, 0xb80d
test dh, 0xb3
shl eax, cl
test edi, 0x6796b4b6
cmp si, 0xce25
mov dword [ebp - 0x3c], esi
cmp cx, bx
test ebp, 0x113bc908
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
test edx, ebx
test bp, 0xb72b
add eax, 0x736
jmp 0x16b26c2
Function at 0x16df0e0
Capabilities:
Encode data using xor

Disassembly:
push 0xdbe0a9a
or dword [esp], 0xee06619e
mov edx, dword [esp]
mov ecx, dword [ebp]
mov edx, dword [ebp + 4]
mov eax, 0x292c701d
sar ax, 0xe9
lea ebp, [ebp + eax*2 - 0x52580068]
sbb byte [esp + eax*2 - 0x5258006d], al
mov dword fs:[ecx + eax*2 - 0x52580070], edx
shl byte [esp + eax*2 - 0x5258006f], 3
lea edi, [edi + eax*2 - 0x52580074]
mov edx, dword [edi + eax*2 - 0x52580070]
not dword [esp + eax - 0x292c0038]
jnp 0x197cc2b
lea esi, [esi + eax*4 - 0x107e2ef4]
sbb cl, 0x98
rol eax, cl
movsx edx, cx
mov eax, dword [eax + esi - 0x1f8bbc04]
xor eax, ebx
sub eax, 0x8c23a21a
bswap eax
xchg dword [esp + ecx - 0x158864], edx
ror word [esp + ecx - 0x15885f], cl
inc cl
not eax
ja 0x15ec739
lea eax, [eax + ecx*4 - 0x466e20a6]
jbe 0x17681e6
mov ecx, 0x96a74694
sub edi, 4
movsx edx, cx
mov eax, dword [edi + edx*4 - 0x11a50]
or ecx, ecx
or edx, ecx
xor eax, ebx
neg eax
ror eax, 1
inc ecx
inc cl
not eax
sal edi, 0xd0
neg eax
xor ebx, eax
call fcn.0176d30a
mov dword [ebx + 0x7d7d8a42], edi
add al, 0x3d
insb byte es:[edi], dx
cld
or dl, byte [0x65d5e0d2]
jbe 0x16df146
call 0x6991e8d3
pop es
sahf
mov byte [0xb2f94a1f], al
inc eax
in eax, dx
sub edi, dword [ebx + 0x7c]
push ecx
mov cl, 0x52
popal
jge 0x16df187
push eax
ret 0x65c2
dec ecx
mov al, 2
sar dword [ebp - 0x79e6dadc], cl
ret 0xdb34
xor ebx, eax
not cl
call fcn.01914478
xor byte [esp + eax*2 - 0x5258006e], al
xor edx, ebx
call fcn.0153dd1b
mov edx, 0x7514543d
bts edx, 0x2e
mov edx, dword [ebp + edx - 0x7514543d]
mov ecx, 0x78078724
lea ebp, [ebp + ecx - 0x78078720]
xor edx, ebx
lea eax, [ecx + ecx*4 + 0x6539248d]
bswap ecx
not edx
call fcn.014f0629

Function at 0x16ea168
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], eax
dec ebx
call fcn.015c4872
mov eax, 0x2492d534
movsx edx, ax
mov ecx, dword [ebp + eax*2 - 0x4925aa68]
lea ebp, [ebp + eax*2 - 0x4925aa64]
xadd eax, edx
neg dl
xchg al, dl
xor ecx, ebx
and eax, edx
bswap eax
rol ecx, 1
neg ecx
ror al, 0x81
and edx, edx
xadd dl, ah
dec ecx
push eax
idiv ax
and dword [esp + edx - 0x2492dcae], 0xab52587
bswap ecx
shl al, 0x26
or dword [esp + edx*2 - 0x4925b95c], eax
bswap eax
inc ecx
neg ax
shr dword [esp + edx*2 - 0x4925b95c], 0x82
adc al, byte [esp + edx - 0x2492dcad]
bswap ecx
inc al
xadd dword [esp + edx*2 - 0x4925b95c], edx
not dx

Function at 0x175a229
Capabilities:
Encode data using xor

Disassembly:
movsx edx, bx
mov ebp, dword [ebp + edx*2 - 0x9e1a]
mov dword [esp + edx - 0x4f0b], ebx
mov dword [edx + ebp - 0x4f0b], eax
movsx esi, bx
jmp 0x19dadb4
Function at 0x176b0c4
Capabilities:
Authenticate hmac

Disassembly:
inc esp
movzx ecx, cl
dec esp
lea ebx, [eax*4 + 0x559149bc]
inc eax
ror dh, 1
inc eax
neg dh
inc eax
add dh, 0x1d
inc cx
xor esp, 0xc0419d32
int1
and al, byte [eax - 0x30]
invalid
not esi
inc cx
bts esi, eax
inc cx
xadd esp, eax
dec esi
rol edi, 0x1a
jb 0x16676b5
ror esi, 1
inc ecx
not esi
push ebx
push edi
inc edx
xor dword [esp + eax*4 - 0x7898d77c], esi
dec edx
mov ebx, dword [esp + eax*2 - 0x3c4c6bba]
inc ecx
push eax
dec esi
mov dword [esp + eax - 0x1e2635d1], ebx
dec eax
arpl si, si
inc edx
dec dword [esp + eax - 0x1e2635de]
dec edx
lea ecx, [eax + eax*8 - 0x2a4d927b]
bt dx, 0x2d
dec eax
add ebp, esi
dec eax
lea ecx, [ecx + edx*2 + 0x5bbf6f33]
inc dx
inc dword [esp + eax - 0x1e2635cb]
inc ebx
movzx esi, byte [eax + edx - 0x1e2635e1]
dec ecx
neg ebx
inc ecx
pop esi
dec eax
mul edx
dec edi
lea edx, [esi + edx - 0x1d2635e0]
xor al, ch
push eax
div ax
inc eax
xor dh, bl
inc eax
sub dh, 0x2b
inc eax
xor dh, 0xa6
inc eax
add dh, al
call fcn.015137e5
not cl
rol eax, 0x72
or al, 0x92
lea eax, [eax*4 - 0x154b79f6]
adc cl, 0x20
ror al, 7
mov dword [esp + eax - 0x33b90a5], edx
jae 0x18508a2
rol cl, 1
jmp 0x18822e2
adc edi, 3
div ecx
mov ecx, 0x30097424
sal ecx, cl
rol cx, 0xa6
mov dword [ecx + edi - 0x979010], edx
ror cx, 0xc9
mov dword [edi + ecx - 0x970844], eax
jbe 0x1952748
mov ecx, dword [ecx + ebp - 0x970848]
adc ebp, 4
xor ecx, ebx
mov edx, 0x4e1c043f
push edx
shr dl, 0x22
lea ecx, [ecx + edx*2 - 0x2d21191b]
mov eax, edx
not eax
ror ecx, 1
xor ecx, 0xc90a4aa6
sar eax, 0x63
dec word [esp + edx - 0x4e1c040e]
imul dx
not ecx
setno al
dec word [esp + edx - 0x4e1c0205]
call fcn.01851689
inc ecx
neg al
xor esi, ebx
mov eax, edx
imul ax, ax
inc ecx
movzx edi, dh
inc edx
lea esi, [esi - 0x6c1ada76]
inc esp
movsx ebx, dx
inc ecx
sar ah, 0x84
and di, 0x7c94
xor esi, 0xdf370621
dec ecx
inc esi
inc ecx
imul eax, esp
neg esi
jmp 0x1763ba5
inc cl
cwd
push edx
xor bl, cl
lea edx, [eax + 0x3f180630]
call fcn.015b6b23
mov edx, 0x23bc7d83
mov ecx, edx
lea edi, [edi + edx - 0x23bc7d87]
sar dl, 0x27
bt ecx, ecx
call fcn.0194b005
inc ebp
mov esp, dword [edx]
mov eax, 0x62af67b4
dec eax
lea edi, [eax + eax*8 + 0x1f230a3a]
dec eax
cdq
dec esi
lea edx, [eax + edx - 0x62af67b0]
inc esp
xor esp, ebx
inc esp
movsx ecx, al
dec esp
lea eax, [edi*2 + 0x519dd2a1]
inc ecx
ror esp, 3
dec dx
cdq
dec ebp
lea eax, [eax + 0xabf2526]
inc ecx
dec esp
dec eax
add edx, edi
inc ecx
neg esp
inc esp
movsx esi, ax
inc esp
movzx ebx, bh
imul ax
inc ecx
inc esp
movzx ecx, di
inc ecx
neg esp
dec edx
inc ecx
bswap esp
dec ecx
bswap ebx
push ebx
inc esi
xor dword [esp + esi - 0x67b4], esp
inc cx
or eax, 0x4d5b7bb5
arpl sp, sp
dec ecx
ror ecx, cl
inc ecx
not dh
dec ecx
add ebp, esp
inc ebx
mov edi, dword [edi + esi*2 - 0xce96]
inc edi
mov ebp, dword [edi + esi - 0x6747]
dec ebp
lea edi, [edi + eax - 0x62af568c]
dec ecx
xchg ebx, eax
not edi
inc ecx
not ebp
inc ecx
movsx esi, cx
inc ebp
add ebx, ebx
inc ecx
or edi, ebp
jmp 0x1930dc5
inc ebx
mov dword [edi + esi - 0x674b], edi
dec ebp
lea ebp, [ebx - 0x19d5d2e3]
inc bp
add ecx, ebp
jmp ebp
Function at 0x176cbda
Capabilities:
Authenticate hmac

Disassembly:
xor edx, 0xc939e003
lea edx, [eax + edx - 0x35f2545c]
lea ecx, [ecx*8 + 0x65323981]
rol edx, cl
sar ecx, cl
xor ebx, edx
add esi, edx
mov edx, eax
call fcn.016eb646
mov eax, 0xa48a1315
movzx edx, ax
mov ax, word [edx + edi - 0x1315]
movsx ecx, dl
mov cl, byte [edx + edi - 0x1313]
rol dl, 0x44
push edx
rol edx, 0x51
lea edi, [edx + edi - 0x26a1fffe]
shl ax, cl
movzx ecx, dx
jmp 0x14f0840
mov word [ecx + edi], ax
push ecx
xor cx, 0x8d84
shl byte [esp + edx*2 - 0x4d43fffd], 0x87
lea ebp, [ebp + edx*2 - 0x4d440004]
mov ecx, dword [ecx + ebp - 0x8d84]
or dword [esp + edx*2 - 0x4d43fffc], edx
xor ecx, ebx
xor ecx, 0xa0a7ca9a
and dl, dl
lea eax, [edx + edx*4 + 0x23baae2c]
not ecx
rol ecx, 1
neg ecx
inc ecx
sub edx, edx
or edx, edx
mul al
xor ebx, ecx
imul dx
bswap edx
adc esi, ecx
add dl, 0x84
bt edx, eax
cwd
add dword [esp + edx*8], esi
ret 4
shld edx, eax, cl
mov eax, dword [esp + 4]
mov dword [esp + eax - 0x48000000], eax
mov dword [edi + eax - 0x48000000], edx
cdq
sar edx, 0x73
jbe 0x167a80f
or edx, dword [edx + ebp]
movsx ecx, byte [esp + eax - 0x48000000]
lea ebp, [eax + ebp - 0x47fffffc]
shl word [esp + ecx*2 + 5], 0x61
dec cx
xor edx, ebx
xor cl, al
call fcn.019d7154
mov edx, dword [ebp]
mov eax, 0x9397aa03
xchg ah, al
mov ecx, dword [ebp + 4]
dec eax
add ebp, 8
push eax
mov dword [edx], ecx
mov ecx, dword [esp]
sub edi, 4
mov edx, dword [edi]
dec word [esp + 1]
shl ecx, cl
sar cx, 1
xor edx, ebx
dec edx
rol word [esp + ecx*2 - 0x5c0e51ff], 0xa8
shl eax, 0x94
ja 0xd345f8
jae 0x15a09b4
bswap eax
sar ecx, cl
shl dl, 0xc4
sub edx, 0xc21a7d11
neg eax
jmp 0x17a4988

Function at 0x1776d6b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx*2 - 0x31a1fff6], esi
or eax, dword [esp + edx - 0x18d0fffb]
mov dword [esp + edx*2 - 0x31a1fffa], edi
push edx
mov dword [esp + edx*2 - 0x31a1fffa], ebx
mov ebx, ecx
inc byte [esp + eax - 0x5bbf0008]
xchg byte [esp + edx*4 - 0x6343fffa], al
dec al
mov edx, ebx
dec eax
sbb ax, 0xb72b
sal ax, 0xcb
shl edx, 2
mov eax, ebp
add eax, edx
or dword [esp], 0x6d81291a
ja 0x1840d7d
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x1840da6
mov eax, 0x8522ee1a
add ax, ax
xor eax, 0xf1a7d8a8
mov eax, dword [ebp + ebx*4]
push eax
dec ebx
jne 0x1840d8d
mov eax, 0xec983c1f
mov eax, dword [ebp]
call fcn.018c85c4
Function at 0x1796ef5
Capabilities:
Authenticate hmac

Disassembly:
xor edx, 0x35054003
push 0xad04480f
call fcn.0163f408
sar ecx, 0x10
movzx edx, byte [ebp + ecx*2 - 0xe9d4]
push eax
xor dl, bl
sar al, 4
sbb al, cl
bswap ecx
sbb dl, 0x36
xadd word [esp + eax - 0x5bd09115], cx
rol dl, 1
div cl
jmp 0x1912ff3
dec dl
lea eax, [ecx*2 - 0x46e250d4]
not word [esp + 2]
shl byte [esp], 2
ror dl, 1
xor bl, dl
rol eax, cl
bswap ecx
sbb ecx, 0xe9135e3f
lea edx, [esp + edx + 4]
shl ecx, 0x9e
sbb cx, 0x4199
push ecx
movzx ax, byte [edx + eax*2 - 0x6291c0da]
sar ecx, cl
lea edx, [ecx*8 - 0x35774d59]
setae cl
sbb edi, 1
push edx
neg dl
mov word [edi], ax
setns byte [esp + 0xa]
seta dl
movsx eax, dl
pop ecx
pop edx
pop edx
jg fcn.016d87fd
bswap edx
xor ebx, edx
movsx ecx, ax
call fcn.01745538
xor edx, eax
neg al
add al, ah
inc ecx
inc edx
sub ax, 0xca32
adc cx, cx
bswap edx
xchg ecx, eax
xor ebx, edx
sub ax, 0x252d
setge al
add esi, edx
mov eax, dword [edi + eax - 0x5f4bda00]
lea edx, [ecx + ecx*4 - 0x1facfd1]
inc cl
mov edx, dword [edi + 4]
add ecx, 0x27ad672a
not cl
imul ecx, ecx
mov cl, byte [edi + 8]
push 0xf13f950c
push 0x7114d2a5
push 0xdda73982
adc edi, 5
ror byte [esp + 8], 0x45
jb 0x19b2911
shrd eax, edx, cl
mov edx, dword [esp + 8]
dec edx
mov dword [edi], eax
mov eax, dword [esp + 8]
movzx ecx, al
mov dword [esp + ecx - 0x60], esi
ret 8
add ecx, 0x1287a3
jmp ecx

Function at 0x1797d65
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
push 0xe138e880
mov esi, dword [esp]
ror si, 0xce
mov dword [ebp], eax
jb 0x17a8e07
call fcn.0160f9d2