joyce8/EMBER2024-capa huggingface dataset:
Function at 0xde1ee9
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
mov dword [esp], 0x9bcfab5
jmp 0xf9f604
lea edx, [eax*8 + 0x4090e2b7]
adc edi, 3
xor ecx, ebx
dec ecx
push eax
sal dword [esp], 0x2c
not ecx
inc ecx
push edx
and word [esp + 6], dx
ror ecx, 3
cdq
xor ebx, ecx
ror dl, 0xc5
call fcn.01052aab
cmp eax, dword [esi]
pushfd
dec ebp
test al, 0x12
xchg edx, eax
xlatb
mov dl, 0x20
add al, 0xc4
push edi
mov dh, byte [edx + 0x160c4d37]
dec ebp
int1
jnp 0xef49a6
cmp ecx, dword [edi + ebx*4 + 0x65]
enter 0xffffffffffffb227, 0x7b
stc
imul ebx, dword [0xc0d90bb2], 0x4d
push eax
pushal
loop 0xef4904
outsd dx, dword [esi]
dec ebp
adc al, 0x3a
test al, 0xb2
fiadd word [ecx]
xchg edx, eax
push esp
xor eax, 0x461c7901
sbb byte [ecx - 2], bh
sub ch, ah
sar byte [edi - 0x2fbad69a], cl
retf
sbb eax, 0x7d61a594
invalid
xor eax, 0x3510728c
ror byte [esp + 5], 0x65
push 0xbaa4a40d
dec edx
push 0x6fa43eb8
mov dword [esp + 0x10], 0x400f5d29
lea esp, [esp + 0x18]
jne 0x1031176
mov edi, 0x6827aaa2
pop edi
not eax
jmp 0x1a8aa7b
sal ecx, 0x82
xor eax, ebx
inc eax
or byte [esp + ecx - 0x390], ch
ror cl, 0x41
neg eax
bswap ecx
bswap ecx
sub eax, 0xfa03bd0b
btr ecx, edx
mov byte [esp + ecx - 0x342], 0x17
neg eax
dec eax
or cx, dx
sbb byte [esp + ecx - 0x53e8], dl
bswap edx
xor eax, 0x482bb936
jmp 0x18ace36
call fcn.00efd358
mov edx, 0x4a5b52e
mov ecx, dword [edi + edx - 0x4a5b52a]
push ebx
cpuid
call fcn.00f50c3e
lea eax, [ecx + eax - 0x7b9fe21c]
rol dl, 0x83
add word [esp + ecx - 0x53e6], cx
cmovs edx, ecx
bswap eax
xor ebx, eax
lea edx, [ecx*8 - 0x25452478]
add esi, eax
pop edx
mov dword [esp + ecx*2 - 0xa7d0], esi
ret
mov cl, byte [ebp + edx*4 - 0x6cfab284]
bt dx, dx
lea ebp, [ebp + edx - 0x1b3eaca0]
neg edx
push edx
sal eax, cl
mov dword [ebp], eax
movzx ecx, byte [esp + 3]
ror dword [esp + ecx*2 - 0x1c5], 0x4f
mov eax, dword [edi + ecx - 0xe4]
not dl
dec dx
lea edi, [edi + ecx*8 - 0x71c]
jae 0x10653f6
mov edx, dword [ebp]
mov eax, 0xecb2b43e
lea ecx, [eax*4 - 0x3663a964]
mov eax, dword ss:[edx + ecx - 0x7c672794]
push ecx
mov dword [ebp + ecx - 0x7c672794], eax
pop ecx
jmp 0x1817964
mov dword [ebp], eax
mov eax, 0xae838784
mov ecx, dword [edi]
neg ax
jne 0xef48ec
sar al, 0x84
jnp 0xe9c536
push 0x1266aa4
mov edx, 0x1b3eaca2
mov eax, dword [edx + ebp - 0x1b3eaca2]
jmp 0x1965650

Function at 0xde2673
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jne 0x18b5fd1

Function at 0xde4888
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0xdf5b78f0
call fcn.01a83518

Function at 0xdeeaf5
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x20]
je 0xf44b44
push 0x37ab7218
sar byte [esp + 3], 0x83
sal dword [esp], 0x49
mov dword [esp], edi
Function at 0xdf089d
Capabilities:
Encode data using xor

Disassembly:
dec ecx
dec edx
sar edx, 0x74
sal eax, 0x98
xor ebx, ecx
lea eax, [edx*8 + 0x4a3e848c]
add edi, ecx
dec dx
mov dword [esp + eax - 0x4a3e5674], edx
pop edx
pop ecx
jne fcn.0182fdb4
push ecx
inc ecx
les ecx, [ecx + 0x292aa05b]
mov dl, cl
mov edx, 0x89b3b395
mov dh, byte [0x11f557eb]
inc esi
mov al, byte gs:[0x76399276]
mov ecx, 0x2bcf8c0a
or dword [ecx + 0x8155698], 0xfffffff5
scasb al, byte es:[edi]
mov ebp, 0x8b7603fb
sar byte [edi], cl
or ah, byte [edi - 0x35d73799]
mov dword [ebx], ebp
mov bh, 0x68
cmc
and byte [esi], bh
leave
retf 0x95ba
enter 0xffffffffffffca28, 0xffffffffffffff89
sub esi, dword [edi + 0x20f2f568]
leave
ja 0xdf094e
xor bl, byte [ebp - 0x59]
push ebx
jbe 0xdf08cb
mov ch, 0xff
mov bh, 0xa
xor dword [esi], ebx
jno 0xdf0951
mov dword [edx - 0xaa69dbf], ecx
xchg ebp, eax
dec edi
aas
arpl word [esi + 0x2c], si
inc edx
push es
das
lodsb al, byte [esi]
pop esi
ret
sahf
dec esp
jg 0xdf09cf
jge 0xdf08f4
mov eax, dword [0xbc532183]
dec eax
and ebx, esi
stosb byte es:[edi], al
and dword [ecx], 0x53
mov esp, 0xaaf32148
idiv dword [edi - 0x22]
mov esp, 0xdeb3395c
sub al, 0x87
sub dh, byte [eax - 0x6f]
sahf
mov al, 0x73
movsd dword es:[edi], dword [esi]
and dword [edx - 0x1eb9553c], esi
scasb al, byte es:[edi]
into
retf
cmp edx, dword [ebp - 0x7f67b883]
invalid
and dword [ebx], edi
xchg byte [ecx - 0x7eb855ca], bl
mov bl, al
mov eax, dword [0x9df1bcc4]
mov eax, 0xbc75090
push 0xca94243b
inc edi
jl 0xdf0a32
sbb eax, 0xb4edc56b
sbb dword [eax - 0x5f], 0x6bdd974a
add dword [edx + 0x32], ebx
mov byte [0x98154382], al
mov ebx, fs
lea eax, [eax + 0x183369ff]
sahf
add al, 0x97
lds ebp, [edx + 0x58]
cmp ch, byte [eax - 0x622d4f97]
xor al, 0xba
cmc
cmp dword [eax + ecx*8 - 0x79845240], ebx
lodsd eax, dword [esi]
jnp 0xdf09a3
and byte [edx + 0x42d39c85], bh
add byte [ebp + 0x421856e4], ch
mov byte [edx], ah
not dl
and dword [esi - 0x5e], ebx
adc eax, 0x3ee6e01b
fcomp dword [eax - 0x682d2023]
loopne 0xdf0a1a
fcomp dword ds:[eax - 0x682d2023]
dec esp
mov al, 0xfb
aaa
mov edx, 0x1ce5b5
xchg ebx, eax
jp 0xdf09eb
salc
adc ch, bl
mov eax, dword [0x5c18ec05]
inc esp
push edi
test eax, 0x8982c937
cmp al, byte [esi - 0x1f]
mov byte [0x50373381], al
test dword [edi - 0x2a6ee6e9], esi
test dword [eax - 0x77], esi
aad 0x1e
push 0xda97d693
in al, dx
push ebp
int1
cli
jge 0xdf0af4
inc esp
invalid
aaa
mov eax, 0x6f414968
push esi
add eax, dword [edi + edi*4]
invalid

Function at 0xe48609
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], eax
sub ax, word [esp]
mov word ss:[ecx], dx
mov ecx, eax
shr ecx, 0x70
xor word [esp + ecx*2 - 0x1cd54], ax
lea esi, [esi + ecx - 0xe6ae]
mov eax, dword [esi + ecx - 0xe6aa]
push ecx
xor eax, ebx
not ecx
bswap eax
add ecx, 0x980d2ebd
rol ecx, 0x96
adc cx, word [esp + ecx*2 - 0x94c0620]
xor eax, 0xf68cdf19
bswap eax
not eax
call fcn.01a17367
Function at 0xe615c0
Capabilities:
Encode data using base64

Disassembly:
jne 0xeb865b
sbb esi, 7
jmp 0x100e303
bt eax, 0xb6
sub eax, eax
mov dword [eax + esi], ecx
mov ecx, dword [edi + eax*4]
sbb eax, 0x7e2fa885
adc edi, 3
xor ecx, ebx
bswap ecx
call fcn.01a60323
rol cx, 1
jmp 0x1960d39
mov dword [esp], 0x33093d05
call fcn.01916cdc
js 0xd96a27
ror ecx, 1
add ecx, 0x8582bd28
xor ecx, 0x76b6081f
div eax
rol ecx, 1
bts eax, eax
btr eax, edx
xor ebx, ecx
rol eax, 0xbf
add ebp, ecx
mov ecx, edx
or cx, ax
jle fcn.00e6e49e
movzx edx, cl
movzx ecx, word [edi + edx - 0x13]
shl edx, 0x4a
and edx, edx
movzx eax, dl
lea edi, [edx + edi - 0x4bfe]
bts eax, eax
xor cx, bx
neg cx
add cx, ax
and dx, 0xc084
shl al, 0xc3
bt edx, 0xb3
not cx
adc eax, edx
jns 0xebec6d
cwde
add eax, 0xdbae0920
neg cx
shr edx, 0x2f
neg dx
xor bx, cx
shl ax, 0xa7
xchg dh, al
lea esi, [esi + edx - 2]
bt dx, ax
mov word [esi + edx*2], cx
sar al, 0xa5
btc eax, 0x94
mov eax, dword [edi + edx*2]
lea edi, [edi + edx*2 + 4]
movzx ecx, dl
shl edx, 0xc3
bt ecx, edx
xor eax, ebx
xchg dx, cx
lea eax, [eax + edx + 0x6f02b32a]
xor cx, 0xc1b0
neg cl
sal cx, 5
bswap eax
xor eax, 0xc10a840d
imul edx, ecx
bts edx, edx
xor edx, 0x7d37c729
lea eax, [eax + ecx*4 - 0x7c3f44bc]
xor ebx, eax
add ebp, eax
inc cl
shl cl, 0xa6
ja fcn.00fc7ff1

Function at 0xe68484
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x78206d24
dec eax
push 0xa088ca19
lea esp, [esp + 0xc]
jne 0x1031140
pop esi

Function at 0xe6b95c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xdb933d2f
and edi, 0xff
inc word [esp + 2]
mov edi, dword [edi*4 + 0xeb07ac]
rol word [esp], 0xc8
shr eax, 8
jmp 0x19547b5
inc dword [esp]
xor eax, edi
push 0x3d806da3
inc ecx
xor byte [esp], 0x1c
or word [esp + 5], 0xc12e
push 0x90b63f39
xor eax, 0xfeaaccb3
dec edx
jmp 0x1984c7c
call fcn.01ad34e3

Function at 0xe7e9a1
Capabilities:
Check for software breakpoints
Encode data using base64
Manually build aes constants

Disassembly:
inc ecx
not edx
inc ecx
neg edx
inc ecx
ror edx, 1
inc edi
lea edx, [edx + 0x3b4c5993]
inc esp
mov ecx, eax
dec edx
mov dword [esp - 0x141ce180], edi
inc ecx
rol edx, 1
dec esi
mov dword [esp - 0x2839c300], esi
dec esp
bt edi, ebp
inc cx
imul edi, ebp
dec edx
lea ecx, [edi - 0x25790b55]
inc esi
xor dword [esp - 0x141ce180], edx
xchg ch, al
push eax
pop eax
inc ecx
pop esi
movzx esi, cx
push edi
call fcn.01a2f311
Function at 0xeb6915
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xchg esp, eax
or edi, dword [ecx + 0x63852583]
lea edi, [edi + ecx - 0x6385257f]
xor eax, ebx
xor cl, cl
bswap edx
inc eax
jmp 0x1a7c2a6
call fcn.018d1c57
adc eax, 0x3b272eba
jge 0xeb68e7
and bh, dl
inc edi
jae 0xeb699e
jg 0xeb68e8
invalid
inc edi
sahf
sub dword [0x967dc403], esp
sbb bh, byte ss:[eax + 0x206b50c3]
cmp eax, dword [edi]
rcl dword [ebp - 0x55], 0x47
cmp byte [edx - 0x633b5f45], ch
xchg edx, eax
pushfd
mov eax, 0x685f2810
imul edi, dword [ebx], 0xa15c8eaa
neg dword [ecx + 0x38ff65a7]
out dx, eax
insd dword es:[edi], dx
add al, bl
out 0xe0, al
lea ebx, [ebp + 0x5d]
pop ebx
iretd
jl 0xeb6a12
bound esp, qword [ecx]
inc ebp
loopne 0xeb6950
and ecx, 0xff77418a
push esp
ficom word [ebx - 0x1c9ebee2]
inc eax
invalid
loopne 0xeb6a6f
push 0xfffffffffffffff4
pop ecx
imul esp, dword [esi], 0xffffffac
invalid
or byte [ebx + ebp + 0x55efebd3], dh
sub al, byte fs:[0xde20926b]
leave
wait
test esi, ebx
loope 0xeb6ac4
sal byte [edx + 0x1ee6b621], 1
jle 0xeb6aa5
invalid
xchg edx, eax
sahf
invalid
and edx, esp
dec edx
jp 0xeb6a68
cmp ebp, dword [esi]
jne 0xeb6b22
loope 0xeb6aa6
push esp
div dword [eax]
and edx, edi
rcr dword [ecx], 0x1f
stosd dword es:[edi], eax
dec ebp
jne 0xeb6b45
jecxz 0xeb6ac7
sub byte [ecx + 0x5054487c], cl
xor ch, 0xe9
salc
test al, 0x58
xchg dword [ebx + esi*2 - 0x29], ebp
cmp byte [edi + 0x34], bl
xchg edi, eax
stosd dword es:[edi], eax
sti
dec esp
mov edx, 0xfb182860
test eax, 0x95ae5479
hlt
ret
jb 0xeb6ad7
ret
invalid
xchg edi, eax
aam 0x57
in al, dx
insd dword es:[edi], dx
push cs
mov ebp, 0x47a4edb0
xor dword [edx - 0x4a921cd7], 0xfb50f47b
jp 0xeb6b09
out dx, al
fst qword [eax]
fstp qword [edi]
xchg esp, eax
mov byte [esi - 0x39858619], bl
arpl word [ebx], cx
or byte [ecx], ch
loop 0xeb6baa
dec esp
sar byte [0x70110f08], 1
cmp eax, 0x70110f08
jb 0xeb6bf6
ja 0xeb6b22
xchg esp, eax
enter 0x3122, 0x2c
sub dword [ecx + 0x55], edi
imul ecx, dword [eax + 0x10], 0x77821b11
cmp al, 0x89
scasb al, byte es:[edi]
jns 0xeb6b18
pop eax
xor ecx, dword [edx + edx*8 + 0x46]
in al, 0x4d
fst qword [eax - 0x51d6c8d2]
dec ecx
xor al, 0xa8
rol byte [ebp + 0x486449d], cl
adc al, 0x98
lodsd eax, dword [esi]
in al, 0x24
or dword [edi], eax
pop es
jnp 0xeb6bff
and byte [ebp + 0x3de029fb], dh
out dx, al
test dword [ebx + 0x3052b350], eax
int1
imul ecx, ebp, 0x79be2453
fld xword [ebp - 0x176c6b6e]
test dword [ecx + 0x131096ad], ecx
and al, 0xfa
mov dword [edi + 0x577aff92], edx
mul byte [edi + 0x70]
sub al, 0xf8
dec edi
jns 0xeb6b71
in eax, 0x39
push edx
dec ebx
jge 0xeb6c01
lcall 0x5302, 0xa0c0a2d
push es
inc ebp
js 0xeb6c4f
mov ebp, 0x924bbc92
outsd dx, dword [esi]
add eax, 0x596ac2a5
inc eax
mov edx, 0x89a82274
clc
movsd dword es:[edi], dword [esi]
ret 0x596a
mov eax, edi
push es
retf
pop ss
retf 0x1738
rol eax, 2
dec cx
sub cl, dh
call fcn.00ef6b19
Function at 0xec51a6
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
pop ecx
add ebp, eax
lea eax, [edx - 0x78f1e253]
cwd
sal dl, 0xa5
mov cx, word [esi + edx - 0x61c1ffe0]
lea esi, [esi + edx - 0x61c1ffde]
sal ax, 0xe2
movzx eax, byte [edi + edx - 0x61c1ffe0]
lea edi, [edi + edx - 0x61c1ffdf]
xor al, bl
rol edx, 0xfb
setb dl
sbb dl, dh
rol al, 1
sub dx, dx
push edx
adc al, 1
rol edx, 0x9a
sub edx, 0xf13f181c
neg edx
ror al, 1
sal byte [esp], 0x81
sub byte [esp + 1], dl
add byte [esp], dl
neg al
call fcn.01010c69
mov ecx, 0x3329dd2c
dec cl
neg cx
lea esi, [esi + ecx*2 - 0x665245ae]
lea edx, [ecx*8 - 0x7efbe74e]
mov ecx, dword [esi + ecx - 0x332922d5]
sub edx, edx
movsx eax, dx
jno 0x1ab2d26
jle fcn.01b07c9f
mov ecx, 0xe432e486
bts ecx, ecx
jae 0x187d9d1

Function at 0xed6ba8
Capabilities:
Encode data using base64

Disassembly:
bts edx, edx
sbb al, 0x8e
ror dl, 0x23
xor bl, al
mov dword [esp + edx - 0xfff8], edx
lea eax, [esp + eax + 8]
imul edx, edx
imul edx, edx
inc edx
mov byte [eax], cl
sbb esi, 3
movsx ecx, byte [esp]
mov ecx, dword [esi]
movsx eax, dl
sub edx, 0x5f1c5699
sbb edx, 0xa8a81f8e
xor ecx, ebx
not ecx
idiv al
dec edx
xchg edx, eax
neg ecx
ror eax, 0xea
dec dword [esp + edx + 3]
jno 0xff6850
lea ecx, [edx + ecx - 0x2bb7901f]
add dx, word [esp + edx + 2]
shr dword [esp + edx - 0x5c01], 0x70
push edx
xor ecx, 0xd90a5118
neg edx
ror ax, 0x88
bswap eax
sbb ecx, 0x9f809e89
jmp 0x104e55c
pop edx
neg dword [esp + edx*2 - 0xb801]
xor ebx, ecx
not word [esp + edx*2 - 0xb800]
neg dword [esp + edx*4 - 0x17000]
sar ax, 0x2e
add ebp, ecx
mov dword [esp + edx*2 - 0xb802], ebp
ret 4

Function at 0xee2bd4
Capabilities:
Encode data using base64

Disassembly:
neg dword [esp + 5]
push 0x8aa0e4a1
inc edx
push 0xb59f3390
call fcn.01abe63d
cmp esi, 0x211e00bd
stc
Function at 0xefd3ec
Capabilities:
Encode data using base64

Disassembly:
rol ecx, 0xc2
ror eax, 3
sal cx, cl
bswap eax
inc word [esp + edx - 0x1d1]
rol eax, 3
and ecx, dword [esp + edx*4 - 0x74f]
lea edx, [ecx + edx*8 - 0x5e563166]
mov dword [esp + ecx*8 - 0x208d0000], edx
xor eax, 0xbcb22d05
xor ebx, eax
sal dl, 1
sar cl, 0xa6
jp 0x1032f71
mov ebp, 0x5fb6318a
dec ebp
lea eax, [eax + ebp - 0x5fb6318e]
dec esp
lea esp, [ebp + ebp*4 + 0x6d35bd3c]
inc edx
mov edx, dword [ebp + eax - 0x5fb6318a]
dec ecx
lea ecx, [esp + ebp*4 - 0x530df9]
inc ecx
xor edx, esi
sub edx, 0xa483a98b
inc ecx
mov ebp, 0xf69fa327
inc ecx
ror esp, cl
rol edx, 1
inc edx
inc ecx
movzx edi, bp
dec eax
xor ecx, ecx
not edx
inc ecx
sal esp, 2
rol edx, 1
inc ebp
mov edi, esp
inc ebp
mov edx, ebp
inc ebp
xchg ch, dl
inc ecx
push esi
xor dword [esp + ebp - 0x5fb6318a], edx
inc ecx
pop esi
dec eax
arpl dx, dx
inc eax
movzx esi, bh
dec ecx
neg edi
imul edi, esi
dec eax
adc ebx, edx
inc ecx
ror dl, 0xc6
inc cx
xadd esp, ebp
inc ebx
mov ebp, dword [ebx - 0x7896cf52]
inc ebp
movsx ecx, dx
inc ecx
sar ch, 0x66
dec ecx
cmovns esi, esp
inc ecx
mov edx, dword [ebx + ecx + 4]
not si
dec ecx
jbe 0x1a9a2d7
adc esi, eax
add dword [esp + ecx*4 - 0x10467ff9], edx
movzx eax, cx
rol eax, 0x30
pop eax
pop edx
pop eax
pop eax
jne fcn.017f4682
mov word [esi], dx
btr eax, eax
lea edx, [ecx + eax + 0x3d918830]
dec cl
mov edx, dword [edi]
adc edi, 3
or eax, 0x522defac
cmovle eax, ecx
xor edx, ebx
shr ecx, cl
bswap edx
rol edx, 3
push eax
rol dword [esp + ecx - 0x10f4], 0x7f
inc edx
or eax, ecx
not edx
neg cl
shl eax, 0xd2
xor ebx, edx
add ebp, edx
lea edx, [ecx + eax*2 + 0x2582341b]
sar dword [esp + eax - 0x5bdc0000], cl
mov dword [esp + ecx*8 - 0x8060], ebp
ret

Function at 0xefd4c4
Capabilities:
Encode data using base64

Disassembly:
and esi, 0xff
mov dword [esp], 0xf8322530
jmp 0x1ae79e9

Function at 0xefeeea
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0xfe55c78d
mov dword [esp + 4], 0x75c9ca8e
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.01900902
mov ecx, 0x243a1312
imul ecx, ecx
sbb esi, 3
movsx eax, cl
mov eax, dword [esi + eax - 0x44]
xor eax, ebx
movzx edx, cx
sub eax, 0xaa84c235
ror eax, 2
xor eax, 0x458ff519
add ecx, edx
lea eax, [ecx + eax - 0x68e206e]
lea ecx, [edx*2 - 0x1ce499d3]
xor ecx, 0x4e3550a2
xor ebx, eax
btr edx, ecx
neg ecx
ror dx, 0xca
adc ebp, eax
movzx eax, cx
mov ecx, dword [edi + ecx - 0x52d66fe9]
lea eax, [eax*2 + 0x65bb691a]
call fcn.01a650ec
sal dword [esp], cl
xor bx, dx
btr eax, ecx
sub ecx, eax
sbb edi, 1
lea eax, [ecx + ecx*8 - 0x29dda1e0]
sar cx, cl
sbb ecx, ecx
mov word [edi], dx
pop ecx
jl fcn.00effa0e

Function at 0xf00fe6
Capabilities:
Check http status code
Encode data using base64

Disassembly:
lea eax, [edx + ebx*4 - 0x2d6ab34d]
neg edi
lea edi, [edi + eax*2 - 0x5f1f9e35]
not edi
btr eax, edx
btc eax, 0xbd
add edi, ecx
add eax, 0x44212891
mov dword [esp + eax - 0x6081347f], eax
mov dword [esp + eax - 0x6081345f], esi
mov dword [esp + eax - 0x6081345b], ebp
ror byte [esp + eax - 0x6081347d], 0xe1
lea esi, [esp + eax - 0x6081347b]
push ebx
xadd ebx, edx
lea edx, [esi + eax - 0x6081354b]
mov esp, edx
Function at 0xf01429
Capabilities:
Encode data using base64

Disassembly:
push 0x5e39dd11
lea esp, [esp + 0x1c]
je 0x191fafd
jmp 0x17dea86
mov eax, 0xc5091a8f
xor ax, ax
mov eax, dword [ebp + ebx*4]
push 0xd8a987a2
call fcn.01ab9b5f
mov dword [esp + 4], 0x6e13712f
mov ebx, dword [esp + 0x18]
jmp 0xfdb32b
mov eax, dword [ebp]
call fcn.00ee2e65
mov eax, 0xb0b79c8b
mov ecx, 0x8fb3678a
sub ebp, 4
mov edx, eax
lea ecx, [edx*4 + 0x492d062e]
not cx
mov eax, dword [ebp + ecx*8 - 0x605c3d28]
sal dl, 0xc4
sal dl, 0xc1
xor eax, ebx
btc cx, dx
not eax
jb 0x1816c01
not cl
sal edx, 0xd2
sbb edx, edx
sal dx, 0x26
or al, cl
call fcn.00eb0c97

Function at 0xf07f39
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push 0x2c802da9
ror word [esp + 0xe], 0x27
sar byte [esp + 1], 0x81
test edx, edx
lea esp, [esp + 0x10]
je 0x18d3f34
push 0x4fb93da9
mov dword [esp], esi
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
push 0x891420af
mov esi, dword [esi*4 + 0x1a589bc]
shr eax, 8
xor eax, esi
inc ecx
ror dword [esp], 0xce
xor eax, 0xea4419c
dec edx
lea esp, [esp + 4]
jne 0xf07f60
mov esi, 0xde0bac36
jmp 0x18d3f33
pop esi
mov edx, 0x663d1b1c
mov ecx, edx
btc dx, cx
not eax
btr edx, edx
mov dword [edx + ebp - 0x663d0b1c], eax
jmp edi
Function at 0xf259e5
Capabilities:
Encode data using xor

Disassembly:
ror dl, 1
or byte [esp + eax*2 - 0x401c72e], ah
or cx, cx
or al, byte [esp + eax - 0x200e394]
xor dl, 0x31
shl dword [esp + eax*4 - 0x8038ff0], 0xee
sbb dl, 0x2a
btr ecx, 0x9c
rol dl, 1
imul eax, dword [esp + eax*4 - 0x8038ff0]
mov dword [esp + ecx - 0x2ed40], 0xb78a2a2d
adc dl, al
sub byte [esp + eax - 0x5895bffd], 0xa4
btc eax, ecx
xor bl, dl
xadd byte [esp + eax - 0x5895bffc], al
inc al
lea edi, [edi + ecx - 0x2ed42]
inc eax
bts eax, 0xac
mov word [edi + ecx - 0x2ed40], dx
movsx edx, al
pop eax
pop eax
jae fcn.00effa0e
loop 0xf25aa7
jb 0xf25a0a
retf 0x61e2
stosd dword es:[edi], eax
popal
cmpsb byte [esi], byte es:[edi]
add al, 6
stosb byte es:[edi], al
popal
adc dword [ecx + 0x3c], edi
outsb dx, byte [esi]
cld
insb byte es:[edi], dx
salc
sahf
xchg byte [ecx + edi*2], ch
cmp bh, byte [ebx - 0x5941e237]
loope 0xf25ab5
in al, 0x78
push 0x4d
mov esp, 0xa7cd0ed8
aad 0x8c
dec eax
cdq
adc dl, byte [edi + ebx + 0x3b1d159d]
pop ebp
mov bh, 0x9a
push eax
sbb byte [esi], dl
jge 0xf25a77
jns 0xf25acb
mov ch, 0xec
fmul st(5), st(0)
imul edx, dword [eax + 0x724ddfc0], 0x8fcd313
mov ebp, 0x39d62ae
nop
rcr bh, 0x4d
jb 0xf25ace
sar esp, cl
or byte [ebp + 0x39d62ae], bh
dec esp
cdq
mov al, byte [0x8562c0a9]
out 0xde, al
mov byte [0x7fc6e2a9], al
fisub word [edx + 0x7fc6e2a9]
loop 0xf25a96
jg 0xf25ace
cld
mov bh, 0xb5
imul esi, dword [edx + 0x24851c28], 0xffffffb7
cwde
inc ecx
push ds
adc al, byte [0xf6fb5378]
je 0xf25a96
add byte [edx + 0x242b5661], ch
jo 0xf25b68
mov cl, 0x95
sub eax, 0x318d2291
mov ebx, dword [edi + 0x78b086ce]
sub edi, esi
test eax, 0x98fb9f3a
push dword [eax + eax*2 - 7]
popal
jle 0xf25a9b
dec esi
cmpsb byte [esi], byte es:[edi]
or ebx, ebp
sbb esp, 0x33f962c2
xchg edx, eax
sub byte [bp + di - 0x6522], ah
sbb eax, 0xac8c910
mov cl, byte [ebx + 0x60]
mov ecx, 0xa0fd9da8
insd dword es:[edi], dx
pop ebx
aad 0x1c
mov edi, 0xe619519
xlatb
mov bh, 0x92
dec ecx
cmp ecx, eax
invalid
in al, 0xc6
push 0xfffffffffffffff0
and bh, byte [edi + 0x66f728d5]
rcr dh, 1
mov edx, 0x12690dec
into
xlatb
mov dh, 0x65
add al, 1
pop ebx
invalid

Function at 0xf2e78b
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov dword [esp + 8], ecx
mov edi, dword [esp + 0xc]
movzx edx, cx
adc dx, word [esp + edx - 0x8c12]
mov ecx, dword [edx + edi - 0xd3a7]
mov dword [esp + edx - 0xd39b], 0x87933d04
jno 0xf16afa
mov edx, 0x6ca03cba
movsx eax, dx
btc dx, dx
movzx dx, byte [edi + eax*8 - 0x1e5d0]
mov cl, byte [edi + eax*2 - 0x7972]
lea edi, [edi + eax - 0x3cb8]
lea eax, [eax*4 + 0x5dbbfd38]
jb 0x1a657d3
sal dl, cl
mov word [edi + eax - 0x5dbcf020], dx
movzx edx, al
lea ecx, [eax + eax - 0x3ae7b1e0]
lea esi, [esi + eax - 0x5dbcf024]
btr cx, cx
mov edx, dword [esi + eax - 0x5dbcf020]
dec cx
xor edx, ebx
or cx, cx
lea ecx, [ecx*2 - 0x12695fcf]
lea edx, [edx + ecx - 0x13ae4850]
push eax
lea eax, [ecx + eax*2 + 0x7e91bc9d]
shl eax, cl
not edx
sets al
ror eax, 0x44
add eax, dword [esp + eax - 0x4ce6000]
inc edx
bswap edx
call fcn.018635ff
Function at 0xf540a0
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor cl, 0x8c
dec eax
mov dword [esp + eax*2 - 0xd598c36], eax
inc ecx
movzx ebp, bh
dec esp
lea esp, [esi + edi*8 - 0x395b3cf6]
inc ebp
xor dh, cl
cwd
dec eax
not dword [esp + eax - 0x6acc61b]
dec ebp
lea ebx, [ebx + eax*2 - 0xd598c3e]
dec ebp
mov dword [ebx + eax*2 - 0xd598c36], ecx
inc ecx
pop ebp
dec eax
lea edx, [eax + ebp*8 - 0x7a4b84d0]
inc cx
sar ebp, 0x4a
dec ebp
lea eax, [eax + eax - 0x6acc61f]
inc ecx
mov esi, dword [eax + eax*2 - 0xd598c36]
inc ecx
xor esi, esi
cdq
inc ecx
mov edx, 0x3b8d7086
inc ebp
or ah, ah
lea esi, [eax + esi + 0x5ceb65fb]
bswap esi
lea esi, [eax + esi + 0x562a89]
ror esi, 1
inc ecx
push esi
dec eax
lea ecx, [edi + eax*2 + 0x5a24435]
inc ecx
shl ah, 0xc6
je 0xfcae5c
xor dword [esp + eax - 0x6acc61b], esi
dec ecx
xchg ebp, ebp
jmp 0xee375c
dec eax
lea esi, [esp + esi + 8]
inc eax
or ch, cl
inc sp
mov dword [esi + edx - 1], edx
cwd
dec eax
mov dword [esp + edx], ecx
dec eax
mov dword [esp + edx], ebx
ret

Function at 0xf85c49
Capabilities:
Execute syscall

Disassembly:
mov cl, byte [esi + ecx*4 - 0x2ce5e89c]
push 0x55ab9d88
sal dword [esp + 8], 0xe6
adc esi, 6
shrd eax, edx, cl
mov dword [esi], eax
call fcn.00f36997
syscall
push ecx
pushfd
dec eax
mov ecx, 0x25b172bc
and byte [eax + eax*4], ah
shr al, cl
inc esi
dec dword [edi + 0x24443100]
add al, 0x64
mov edx, dword [ecx]

Function at 0xf9c37f
Capabilities:
Authenticate hmac

Disassembly:
mov edx, 0xae37f094
mov ecx, dword [ebp]
mov al, byte [ebp + 4]
sar dx, 0x23
adc ebp, 5
ror dl, 0x42
inc dx
xor edx, edx
mov byte es:[ecx + edx*2], al
sub dx, dx
sal dl, 0xc1
lea esi, [esi + edx*4 - 4]
adc edx, dword [esi + edx*2]
mov eax, 0x12b828a3
movsx ecx, ax
xor edx, ebx
xor edx, 0xf6a0c398
neg edx
neg eax
not edx
inc cl
sbb edx, 0xcd21c188
call fcn.00ddc618
mov dword [esp], edi
push 0x17b7cca5
push 0xbd0b1b31
jmp 0x1060672
add edx, ebp
jmp edx
mov dword [esp + 4], esi
mov edi, dword [esp]
pushfd
pop esi
mov dword [esp], esi
lea esi, [edi + edi*4 - 0x47ef2c5b]
mov esi, edx
sal edi, 0xa6
not di
ror di, 0x46
mov edi, eax
call fcn.00db44c1
sub ebp, 4
mov eax, 0x66a2b0b1
movsx edx, al
mov ecx, dword [ebp + eax - 0x66a2b0b1]
push edx
imul dl
xor ecx, ebx
bts ax, 0x82
neg dword [esp + eax - 0x66a21865]
call fcn.01ae29e0
push edx
lea edi, [edx + edi - 0xe146af5]
sal dx, 0xe
ror byte [esp + edx*8 - 0x70a40000], 0xe7
xor al, bl
shl edx, 0x3f
dec al
add edx, edx
add dword [esp + edx*8], edx
add edx, edx
ror al, 1
and dword [esp + edx], edx
sar dword [esp + edx*2], 0x52
shr edx, 0x5e
not al
shl dl, 0x42
ror al, 1
inc dx
add al, dl
xor bl, al
mov dword [esp + edx - 1], 0xe2328cbf
sal edx, 0xce
setp dl
lea eax, [esp + eax + 4]
mov dword [eax + edx*2 - 0x8002], ecx
mov ecx, dword [edx + edi - 0x4001]
jp 0x18d7155
jns 0x1ab14f9
idiv edx
not ecx
and dx, dx
cbw
btr edx, edx
xor ebx, ecx
add ebp, ecx
jmp 0xfc8d5e
jb 0x19459fa
jmp 0xf6a77d
or dl, byte [esp + edx - 0x3ffe]
lea edi, [edi + edx*2 - 0x81c2]
pop edx
xor ecx, ebx
movsx eax, dl
sar dl, 4
cdq
adc ecx, 0x4514aaff
ror eax, 0x1d
bswap ecx
bt eax, eax
lea ecx, [ecx + edx - 0x6f670f53]
jb 0x1a8994d