joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56ac6e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x56ac90
cmp dword [edi + 0x3c], 0
jne 0x56ac90
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0057484d
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0056acbd
pop edi
pop esi
pop ebx
ret 8

Function at 0x56c321
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x56c359
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0056a296
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0056a26e
jmp 0x56c365
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x56dc9e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x56dce0
call fcn.0057484d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x56dce0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x56dcd7
xor eax, eax
jmp 0x56dce8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0056dcee
pop edi
pop esi
pop ebx
ret 4

Function at 0x574d7d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x574dab
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x574dc9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00574ce3
jmp 0x574dc9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x574dc9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00574ce3
test edi, edi
mov eax, edi
jne 0x574db3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x577b5b
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x577b83
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x577b94
push 2
call edi
test ax, ax
jge 0x577b94
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0056b956
cmp dword [esi + 0x30], ebx
jne 0x577c6e
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.0056b956
cmp eax, dword [esp + 0x34]
jne 0x577c6e
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x577c0a
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x577c4f
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x577c6e
cmp eax, 0x205
je 0x577c6e
cmp eax, 0x201
je 0x577c6e
cmp eax, 0x204
je 0x577c6e
cmp eax, ebx
jne 0x577c35
cmp dword [esp + 0x1c], 0x1b
je 0x577c6e
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x6b48d4]
jbe 0x577c64
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x577bc7
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4

Function at 0x408958
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.0040897b
mov ecx, ecx
xor dword [esi], edi
add ecx, ecx
inc esi
sub eax, eax
cmp esi, ebx
jne fcn.00408958
add ecx, ecx
dec ecx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xc768dc
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x1e1d6292
mov edi, dword [esp + eax*4 - 0x78758a44]
lea esp, [esp + 8]
mov ecx, 0x44bd6819
lea eax, [ecx + ecx*4 - 0x478be6]
not edx
xadd cx, ax
shr cx, 0xc5
add al, ah
mov dword [eax + ebp - 0x576b6881], edx
setno al
not eax
setle al
lea esi, [esi + ecx - 0x44bd0729]
shl eax, 0x23
mov eax, dword [esi + eax - 0x44a4b800]
movzx edx, cl
btc edx, edx
jb 0x10a21f6
xor edx, ebx
mov ecx, 0x90bf362f
lea eax, [ecx + ecx + 0x1aa86808]
xor cx, ax
bswap edx
ror ax, 0xe4
or cl, 0x1d
ror edx, 1
sal cx, 0x8c
lea edx, [edx + eax - 0x1606dd93]
cwde
adc ecx, ecx
rol edx, 2
add ax, ax
jae 0x1498721
mov eax, 0x75253780
movzx eax, byte [edi + eax - 0x75253780]
add edi, 1
xor al, bl
mov edx, 0x75148302
shr dx, 0x65
neg al
sub al, 0xbe
or dl, dh
or edx, 0x838b5c8c
bt edx, 0x27
neg al
rol al, 1
rol edx, 0x7e
shr dl, 4
xor edx, 0xba93c396
xor bl, al
inc edx
and edx, edx
adc edx, 0xd6bdbd15
push edi
push esi
jp 0x10d501f
push ebx
lea ebx, [edx*8 + 0x38890e3c]
sal ebx, 0xa1
mov ebx, eax
mov edx, ebx
mov eax, 0x379fab29
sal eax, 0x9b
shl edx, 2
mov eax, ebp
call fcn.012f9e89
adc ebp, 1
call fcn.01107ab5
syscall
push 0xef2b7490
pushfd
cmp dword [esp + 8], 0x319cbe03
dec eax
mov dword [esp + 8], 0xb404cd2c
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.01505c6f
mov edx, 0x41317aac
lea eax, [edx + edx + 0x2720a095]
push edx
mov ecx, dword [esi + edx - 0x41317aac]
imul word [esp + edx - 0x41317aab]
adc dword [esp + edx - 0x4131eb7f], 0xd29d8b0d
lea esi, [esi + edx - 0x4131eb7b]
xor ecx, ebx
ror dword [esp + edx - 0x4131eb7f], 0x94
inc edx
ror ecx, 1
sub dword [esp + edx - 0x4131eb80], edx
setle byte [esp + edx - 0x4131eb7e]
xchg dword [esp + edx - 0x4131eb80], edx
xor ecx, 0xf6b03f3f
mul dx
shr byte [esp + 2], 0xa6
ror ecx, 2
push eax
sar dword [esp + 4], 0x4c
adc dword [esp + 2], 0x869b73af
inc ecx
inc ax
neg ecx
ror dx, 0x6a
lea ecx, [ecx + eax + 0x616a5fc]
ror al, 0xe2
xor ebx, ecx
mul dword [esp + 3]
add edi, ecx
neg eax
not eax
movzx cx, byte [ebp + edx*8 - 0x184e98e8]
push edx
shl eax, 0x6b
lea eax, [edx + 0x36033da9]
mov al, byte [ebp + edx*2 - 0x613a638]
shl word [esp + edx*2 - 0x613a632], 7
not edx
push edx
adc ebp, 1
lea edx, [edx*2 - 0x1d6bf454]
pop edx
not cl
dec edx
not al
setne dl
inc edx
or cl, al
xchg dh, dl
sal dword [esp + 1], 0x46
mov word [ebp], cx
lea eax, [edx*2 + 0x65997ca4]
mov dword [esp + eax - 0x5f8580fc], edi
ret 8
or eax, dword [eax]
sub eax, 0x74bd6586
xor ebx, edx
add edi, edx
sar ecx, cl
xor eax, ecx
movzx dx, byte [ebp + ecx*2 - 0x217fa000]
xadd cl, al
push ecx
adc ax, word [esp + ecx - 0x10bfd006]
mov cl, byte [ebp + ecx*4 - 0x42ff4016]
jb 0x10f66bf
stosd dword es:[edi], eax
pop es
test al, 1
dec esi
cmc
sub eax, 0xa7fe1742
int1
sbb ebp, dword [ebx - 1]
or ch, bh
fldcw word [ebx - 3]
std
sbb ah, ah
add byte [edi], ah
jp 0x149871f
mov esp, 0xe3ebcb07
sbb al, 1
inc ebp
dec esi
inc ecx
fdivr qword [esi - 1]
or al, dl
mov edx, 0xcdc575f6
invalid
Function at 0xc878f3
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x6e412341], 0xe99dbf26
sub al, ch
lea esi, [esi + eax - 0x6e41231f]
call fcn.014ccc84
syscall
push ebx
call fcn.014ebd67

Function at 0xcbd5a3
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x52e8425
add esi, 6
push 0x119fcc27
call fcn.01384035

Function at 0x101f07c
Capabilities:
Encode data using xor

Disassembly:
inc ecx
inc eax
inc ecx
pop edx
inc ecx
xor eax, 0x86bdfd82
inc sp
sub ebp, esi
dec esi
lea edx, [edx + ebp*8 + 0x43a2bc05]
inc esi
lea eax, [ebx + eax + 0x6ad2e1ad]
inc ecx
div edx
cdq
inc ecx
bswap eax
mul edx
inc ecx
inc eax
inc ecx
push esi
div si
inc ecx
movzx ecx, ch
inc ebp
movzx esp, bp
inc esp
xor dword [esp + eax*4], eax
neg eax
dec eax
and edx, 0xd6b6d424
inc ecx
pop esi
call fcn.00c8328b
xor al, 0x8f
push 0xffffffffffffffe6
adc cl, bl
stosb byte es:[edi], al
jno 0x101f0a6
aam 0x9c
adc byte [edx], dl
stosb byte es:[edi], al
xchg esp, eax
shl edi, cl
adc bl, byte [eax]
daa
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
lodsb al, byte [esi]
aas
rcr byte [edi], 1
mov byte [ebx - 0x3c], ch
adc eax, dword [ecx]
fcom qword [eax]
stosd dword es:[edi], eax
shl byte [esi - 0x3b], 1
sub ecx, esp
dec esp
mov ch, 0xf4
sti
fst dword [edi - 0x29dcc4e0]
invalid

Function at 0x102d45d
Capabilities:
Encode data using base64

Disassembly:
push eax
adc esi, ecx
imul eax, dword [esp + eax - 0x37de5c11]
movzx ecx, byte [esp + eax*2 - 0x39307242]
shr ecx, cl
rdtsc
lea ecx, [ecx*8 - 0x544a1c7]
add cl, byte [esp + 3]
ror ecx, 0x9e
sbb ebp, 7
mov dword [ebp + 4], eax
mov dword [ebp], edx
pop ecx
pop eax
jmp 0x112164c

Function at 0x103572c
Capabilities:
Encode data using base64

Disassembly:
push eax
sub eax, dword [esp + eax - 0x1dd991a6]
lea edi, [edi + eax*2 + 8]
ja 0x108c7a3
mov dword [ecx + eax], edx
mov dword [esp + eax + 4], 0x63a2e034
mov dword [esp + eax], ebp
ret 0x10

Function at 0x1056c67
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1482d97
adc ebp, edx
mov dword [esp], 0x2c99613a
rdtsc
sub edi, 8
not ecx
mov dword [esp + ecx + 1], ecx
add cx, cx
mov dword [edi + ecx*4 - 0x14], eax
shl ecx, 0x1f
push ecx
xor dword [esp + ecx*8 + 8], 0x3b966a18
mov dword [edi + ecx*2], edx
pop edx
pop edx
pop eax
jns fcn.012f3110
push 0xce32bc30
sub edx, 0x7a0d1d8d
jmp 0xc87bca
bswap edx
shr dword [esp], 0xd1
xor ebx, edx
add ebp, edx
lea esp, [esp + 8]
call fcn.013680e4

Function at 0x1068b55
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esi + edx - 0x2bb7bc2d]
pop eax
mov ecx, 0xf5a96282
and cx, cx
adc esi, 4
mov dword [esp], 0x19b76428
xor edx, ebx
imul ecx, ecx
dec edx
movsx eax, byte [esp + ecx*4 - 0x262f280d]
xchg byte [esp + ecx*8 - 0x4c5e501c], cl
sub cx, 0xefa9
ror edx, 2
ror byte [esp + ecx*8 - 0x4c5ed441], 0x82
xor edx, 0x8032a486
and ecx, 0xc8318f88
seto cl
xor cl, 0x38
dec edx
sar eax, 0x13
js 0x13829ec
btr eax, 0x1b
xor ebx, edx
push ecx
rol ax, 0x6c
adc ebp, edx
mul cl
inc cx
mov dword [esp + ecx*8 - 0x400c51c8], ebp
ret 8
Function at 0x1069c5a
Capabilities:
Authenticate hmac

Disassembly:
lea eax, [eax + edx*2 - 0x371a39e2]
shr edx, cl
bswap eax
adc ecx, edx
xor dword [esp + edx*8 - 0x8f118], 0x519f211b
jle 0x146fbce
mov esi, dword [esi*4 + 0x116057c]
jb 0x156084b
mov ecx, 0xdf1e24b0
sub cx, cx
lea edx, [ecx + ecx*4 - 0x28525b49]
lea edi, [edi + edx*2 - 0x66874972]
btr edx, edx
mov edx, dword [edi + edx - 0x3343a4b7]
movsx eax, cl
xchg cx, ax
xor edx, ebx
call fcn.00c88ee0
in al, dx
xchg ecx, eax
aaa
imul ecx, dword [esi], 0x113cf876
call 0x538f88d4
invalid
push 0x95980d2d
xor esi, ecx
push 0x6b0c0e09
ror word [esp], 0xad
mov dword [esp + 8], 0xc3ad3be
and esi, 0xff
jmp 0x14ccc18
div al
xor ebx, edx
add ebp, edx
and ax, cx
sal al, 0x25
sal ax, 0xe8
mov dword [esp + ecx*4 - 0x1a06c], ebp
ret
xor word [esp + 6], 0xff3f
xor ecx, 0xb6987d3c
dec edx
lea esp, [esp + 0xc]
jne 0x1367ded
mov eax, 0xd2314607
movzx esi, al
pop esi
lea eax, [edx + eax + 0x2438790e]
setne byte [esp + edx - 0x11e23]
push edx
sar dx, 0x83
bswap eax
not eax
shl cl, 0xa1
xor eax, 0xf21a8820
xchg dword [esp + edx*4 - 0x40f0f], edx
shr edx, 0x7c
or cx, dx
inc eax
sal dword [esp + edx*2 + 3], cl
add dx, dx
not eax
call fcn.015878f3
shr ecx, 0xb1
cbw
rol edx, 2
jmp 0x1136689
sal word [esp + 9], 0x49
jp 0x10307a5
mov eax, 0x8f11c632
mov edx, eax
cwd
sub ebp, 4
mov eax, dword [ebp]
push edx
and dx, dx
movsx ecx, word [esp]
xor eax, ebx
sar dx, 0xc4
sal cl, 0x42
and word [esp], dx
dec eax
rol eax, 1
ror ecx, cl
jb 0xca4a17
sar dword [esp + 8], 0xf7
shr ecx, 8
not byte [esp + 1]
and dword [esp + 4], 0x48ad0b33
xor ecx, esi
inc word [esp + 1]
shl byte [esp + 1], 0xe7
not word [esp + 5]
inc eax
jmp 0x1152240
Function at 0x107c468
Capabilities:
Encode data using base64

Disassembly:
invalid
inc ecx
call fcn.01321a13
loope 0x107c439
loopne 0x107c47e
or dword [eax - 0x2e], esp
dec ebp
or dword [esi + 0x5fc350d], eax
push dword [eax + 0x4e]
dec esi
cmp ecx, eax
adc cl, cl
je 0x107c49b
adc dword [edi + 0x7800a76c], ecx
invalid
and dh, dh
rol dword [edi], cl
mov dl, 0x51
mov eax, dword [0x24a40173]
cmp ebx, dword [esi - 0x6d8d00ef]
aad 0xf6
mov word [edi + edi*4 + 0x51009dbc], fs
pop esp
jns 0x107c511
out dx, eax
invalid
sub eax, 0xf8af0529
mov esi, 0xf66d8f6
neg al
imul bx, bp
dec eax
mov dword [esp + esi - 0x26a507a9], ebp
ror al, 1
jmp 0x1106141
call fcn.01024833
mov eax, 0x3732bfa3
mov edx, dword [esi + eax*2 - 0x6e657f46]
lea esi, [esi + eax*2 - 0x6e657f42]
mov ecx, eax
neg eax
shr cx, 0x44
xor edx, ebx
jmp 0x13ab42f

Function at 0x1083146
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + esi*2 + 0x40efb9ac], esi
dec ecx
mov esp, ebp
dec eax
bswap esi
push edi
pushfd
dec eax
lea edi, [esi + 0x426961a]
sal esi, 0x46
dec ecx
mov esi, ebx
jp 0x1545306
mov eax, 0x2f21c5a6
call fcn.01351bea

Function at 0x1096a89
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esi, [esi + eax - 0x458fefb5]
mov dword [esp + eax - 0x458fefb5], ecx
push dword [esp + 4]
popfd
mov dword [esp + eax - 0x458fefb9], eax
rol dword [esp + eax - 0x458fefb9], 0x11
mov eax, dword [ebp + eax - 0x458fefb9]
mov edx, 0x17957982
inc dword [esp + edx*2 - 0x2f2af304]
lea ebp, [ebp + edx*4 - 0x5e55e604]
mov byte [esp + edx - 0x17957980], dl
xor eax, ebx
inc edx
inc eax
add byte [esp + edx*2 - 0x2f2af303], dh
setp dl
rol eax, 2
push edx
bswap eax
movzx ecx, dx
call fcn.0155cd95

Function at 0x10b1c47
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ecx + ecx*4 + 0x6708751e]
dec eax
dec ecx
xor ebx, eax
add esi, eax
imul edx, ecx
shr ecx, cl
movsx eax, dx
mov ax, word [ecx + edi - 0x40ea9]
mov dword [esp + ecx*2 - 0x81d52], 0x3cb5a08d
setb dl
mov cl, byte [edi + ecx*2 - 0x81d50]
jns 0x1383cd2
or dword [esp + edx*2 - 0x5dabb5fc], edx
setge dl
lea edi, [edx + edi - 0x2ed5dafe]
sal dl, 0x87
sar dword [esp + edx - 0x2ed5dafc], 0xbd
sal ax, cl
dec edx
sal dx, 0x63
mov word [edi + edx*2 - 0x5dabaff0], ax
rol dl, 6
mov dword [esp + edx - 0x2ed5d73e], esi
ret 4
Function at 0x10caddb
Capabilities:
Encode data using base64

Disassembly:
inc ecx
rol edx, 0xd4
dec eax
arpl dx, dx
dec eax
cwde
dec eax
cwde
inc ecx
and bl, ch
dec eax
adc edi, edx
call fcn.010dedf5
call fcn.0137a27d
mov ecx, eax
dec ecx
sub edi, 4
mov esi, ecx
dec esp
lea ebx, [ecx*8 + 0x2497672a]
dec eax
cdq
inc edx
xor edx, dword [edx + edi]
dec edi
lea ebp, [ebx + ebx*4 - 0x7c6ad0f9]
dec edx
lea ebx, [ecx + ebx - 0x6367df55]
inc ecx
xor edx, esi
ror edx, 1
lea edx, [eax + edx - 0x80a9987]
dec eax
sal eax, cl
push ecx
xor edx, 0xa49f33
inc esp
movzx eax, si
inc edx
inc cx
inc si
xor eax, dword [esp + eax*2 - 0x1681e]
inc ecx
neg ebp
neg edx
inc cx
add ecx, eax
xor edx, 0x7c09ff11
inc edx
sal byte [esp + eax - 0x699a], 3
sar eax, 0x5c
dec ebp
lea edx, [eax + ecx*2 - 0x64e10157]
dec esi
mov dword [esp + ebp*2 - 0x4ef3554e], esi
inc esp
movsx esp, ax
inc edx
xor dword [esp + ebp - 0x2779aaa7], edx
inc ecx
pop esi
jmp 0x10a2094

Function at 0x10cdaf5
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + esi*2 - 0x7ebb6c2c]
sub dword [esp + esi*2 - 0x13326c00], esi
pop ecx
btr cx, bp
neg edi
neg esi
bts esi, 0xba
neg esi
inc edi
add edi, eax
movzx eax, si
btr ecx, eax
mov dword [esp + esi*4 - 0x2664d7e4], ebx
mov dword [esp + esi - 0x99935e0], edx
mov esi, esp
sar al, 0xa5
jp 0x14c96ee
jae 0x137420c
jb 0x1072bef
dec ebx
call fcn.0130441f
rol al, 2
lea ecx, [ecx + esi - 0x9cd1fa]
lea edx, [eax + eax*4 + 0x73110f2c]
mov esp, ecx

Function at 0x10cfea7
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + edx*4], 0x33ace086
bswap eax
xor dword [esp + edx], 0xa1a922f
push ecx
pop ecx
rol eax, 1
sal cx, 0xed
bswap ecx
xor eax, 0xc995b16
rol eax, 1
dec dword [esp + ecx - 0x805b]
add edx, ecx
jno 0x1392fd5
mov edx, 0x50a5fcb3
mov ecx, dword [edx + edi - 0x50a5fcb3]
lea eax, [edx + edx*2 - 0x4e780274]
mov edx, dword ss:[edx + ecx - 0x50a5fcb3]
bswap eax
lea ecx, [eax + eax*4 + 0x671e319c]
mov dword [edi], edx
sub eax, ecx
idiv cl
cdq
lea ebp, [eax + ebp - 0x113dc78]
sar ax, cl
adc cl, 0x33
or ax, 0xd734
adc edx, dword [ebp + eax - 0x113ffff]
xor edx, ebx
rol edx, 3
add ecx, ecx
sbb edx, 0xb482f682
not edx
neg edx
shl ecx, 0xa
rol cl, 0x47
inc ax
lea edx, [edx + ecx - 0x57d125eb]
lea eax, [ecx*2 + 0x4aad5605]
rol edx, 1
bts ax, cx
cwde
cwde
lea edx, [eax + edx + 0x4e7fcead]
jb 0x153e4a8
lea eax, [ecx + eax + 0x6b8f2851]

Function at 0x10d5b5d
Capabilities:
Execute syscall

Disassembly:
jmp 0x157750a
bswap edx
push 0xf6b3a2a5
not edx
call fcn.00ca110e
sysenter
push ecx
mov ecx, 0x19a3d902
push ebp
mov ecx, dword [esp + ecx*2 - 0x3347b200]
mov dword [esp + 4], 0xea626196
lea esp, [esp + 4]
call fcn.013854f5
and edx, ecx
not edx
movzx ecx, ax
mov dword [eax + edi], edx
xor byte [esp + eax + 4], 0x8f
mov dword [esp + eax], esi
ret 4
Function at 0x10d8d2f
Capabilities:
Encode data using base64

Disassembly:
test ebx, ebx
lea esp, [esp + 8]
je 0xc77da3
mov eax, 0x4b5cabf
bt eax, eax
neg al
mov eax, dword [ebp + ebx*4]
jb 0x101aebb
mov eax, 0xab24d593
mov eax, dword [esi]
mov edx, 0x97a3c725
add esi, 4
call fcn.0114da85
mov edx, 0x5a3db1ba
movsx eax, dx
xadd ax, dx
lea ebp, [ebp + edx - 0x5a3db1be]
mov eax, dword [ebp + edx - 0x5a3db1ba]
lea ecx, [edx + edx*8 + 0x90a999f]
xor eax, ebx
and dx, cx
dec eax
call fcn.01533e1d
mov eax, 0xa53d42ae
not ax
jmp 0x139ac41
mov dword [ebp + ecx - 0x57bf], eax
movsx edi, cl
shr di, 0x23
mov ebx, esi
pop ebx
pop esi
pop edi
jmp esi
jg 0x156c7df
cdq
pop ds
fiadd dword [ecx]
jnp 0x101aefd
aas
dec ebx
pop es
sub al, 0x3f
push 0x1ae201eb
jne 0x101af2a
mov edi, edi
cmp al, 0x5b
dec ebp
not byte [ecx]
lcall 0x927f, 0x57501
mov al, 0xc1
out dx, eax
adc eax, 0x33ee16fd
invalid
adc al, 0x7f
sar eax, cl
out 0x45, al
sub byte [ebx - 2], dh
add esi, dword [ebx + 0xf]
pop ss
adc dword [eax], eax
inc esi
sbb edx, ebp
or dword [ebx], edx
xor edi, ebx
xor eax, 0x1815ff9d
invalid
invalid
adc eax, edx
mov dword [ebp - 4], eax
mov dword [esp + 4], 0x18061294
sar word [esp + 6], 0x2f
jbe 0xc739f2
call eax
mov ebp, dword [ebp - 4]
mov esi, 0xe1bc57bf
movsx ecx, si
jmp 0xcb5463
mov eax, dword [ebp]
jmp 0x12e23e6
call fcn.013077c2

Function at 0x10dcbb1
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edx + ebp - 1]
imul ecx, ecx
xor edx, ebx
btr eax, 0x1a
inc edx
not cl
bswap edx
cbw
shr ecx, cl
jns 0x10cb408
lea edx, [ecx + edx - 0x3c128f39]
sar ecx, 0x91
not edx
push ecx
lea ecx, [ecx + 0x38bc478d]
ror edx, 1
xor ebx, edx
pop eax
neg cl
cwde
add edi, edx
xor al, ah
jp 0x1486945
mov eax, 0xca3f0a39
lea eax, [eax + 0x548bf282]
mov ecx, dword [eax + esi - 0x1ecafcbb]
and eax, 0x2236b928
or ax, ax
btr ax, ax
mov eax, dword [eax + esi - 0x202b824]
jae 0x10f391f
mov eax, edx
inc edx
mov ebp, ecx
lea ecx, [eax + edx + 0x7699c5a7]
pop eax
jno 0x150ec92
lea ebp, [ebp + eax*4 - 0xc]
mul edx
cbw
jb 0xc731e5
push 0xc979ebe
mul ecx
dec byte [esp + 1]
mov ecx, 0x629c6b34
mov dword [esi + ecx - 0x629c6b34], edx
lea edx, [ecx + ecx - 0x79661a6b]
xor eax, edi
jmp eax

Function at 0x10e8508
Capabilities:
Encode data using base64

Disassembly:
push 0xb696d52f
mov dword [esp + 4], esi
lea esp, [esp + 4]

Function at 0x1103466
Capabilities:
Encode data using base64

Disassembly:
inc eax
neg eax
push edx
pop ecx
call fcn.0131f838
Function at 0x110d899
Capabilities:
Encode data using base64

Disassembly:
mul edx
mov dword [esp + edx - 0x7cb3b4ca], ebp
movsx ebp, dl
mul cx
lea edi, [ebp + eax + 0x6090faa0]
lea edi, [esp + ecx - 0x5c80949c]
lea ebx, [edi + edx - 0x7cb36cc8]
mul cl
bswap ebp
mov esp, ebx
mov ebx, esi
mov ebp, 0xfb3b09aa
movzx eax, bp
mov edx, eax
mov ecx, 0
sub ebx, ecx
mov eax, 0x88106f9f
cwde
call fcn.0102c02f
mov dword [esp + eax + 0x40305cfc], eax
adc dword [esp + ecx - 0x5c8094a0], 0x95833194
mov dword [esp + eax + 0x40305d00], edx
mov esi, dword [esp + eax + 0x40305d20]
not dword [esp + eax + 0x40305cfc]
cmovge ebx, dword [esp + eax + 0x40305cfc]
ror esi, 3
xor esi, 0x928820bc
inc word [esp + ecx - 0x5c80949f]
neg dword [esp + ecx - 0x5c8094a0]
lea esi, [esi + eax*2 + 0x7fd287ee]
btr ecx, ebx
xor esi, 0x4e200d94
sal bl, 0x81
jge 0x15611a0
xor eax, dword [esp + eax + 0x40305cfc]
adc esi, edx
mov dword [esp + eax + 0x15628f83], edi
mov edx, 0x88118803
jmp 0xcb4115

Function at 0x1119159
Capabilities:
Encode data using base64

Disassembly:
mul ecx
mov ecx, 0x67a88aa6
bt cx, cx
mov dword [esi + ecx - 0x67a88aa6], edx
movzx edx, byte [esp + ecx - 0x67a88a9a]
jae 0x14ad4fe
lea ecx, [ecx + 0x14a8c337]
lea eax, [ecx + ecx*2 - 0x737ba6cd]
lea edi, [ecx + edi - 0x664d8b65]
xor edx, ebx
neg edx
dec edx
rol edx, 1
sub al, ch
sub eax, ecx
sal eax, 0xb3
neg edx
neg cl
xor eax, eax
js 0x13760f7
rol edx, 1
sub eax, ecx
xchg ecx, eax
xor ebx, edx
bswap eax
shr eax, cl
and eax, eax
adc esi, edx
mov eax, dword [ebp + eax*8 - 0x25e2d30]
call fcn.013ab6a4
mov dword [ecx + esi - 0x67a88aa2], eax
sar ecx, cl
mov dword [esp + ecx*2 - 0x33d4454], edi
ret 0x10

Function at 0x112d431
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
cmovo cx, ax
bswap edx
seto cl
neg edx
xadd eax, ecx
xchg ecx, eax
sbb edx, 0xc4add61a
xadd ax, cx
inc cx
shl ax, 0x8a
neg edx
push ecx
inc word [esp + eax - 0x4a532fff]
cmovns eax, dword [esp + eax - 0x4a533000]
rol edx, 3
cwde
sar al, 0xc4
dec edx
push eax
call fcn.01509461
setno byte [esp + edx*4 - 0x5ff807fb]
xor cl, 0x8f
xor bl, cl
mul ax
lea edi, [edx + edi - 0x17fe19ab]
mov dword [esp + edx - 0x17fe19a9], 0x5a05da87
setno al
mov word [edx + edi - 0x17fe19a9], cx
not dword [esp + edx*2 - 0x2ffc334e]
pop edx
pop edx
pop ecx
jo fcn.012f3110
mov edx, dword [edi]
mov eax, 0xb5acfd98
neg ax
ror al, 0x22
adc edi, 4
mov ecx, eax
neg eax
dec cl
xor edx, ebx
sub edx, 0x8e3ceb08
sub ecx, 0xfcb84111
jne 0x1071fbe