joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb7cb74
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
mov dword [edx + edi - 0x1c9d6b12], ecx
mov edx, dword [esi + edx - 0x1c9d6b12]
jmp 0xd0b1c3
not ecx
ror cl, 1
lea ebp, [ebp + ecx - 0x74c11246]
mov dword [ebp + ecx - 0x74c1123a], eax
mov dword [ebp + ecx - 0x74c1123e], edx
movsx eax, cl
bt eax, eax
movsx edx, cx
mov ecx, dword [edi + ecx - 0x74c1123e]
setae al
inc eax
lea edi, [edi + eax + 2]
mul edx
xor ecx, ebx
shl eax, 0x5f
sal eax, 0x3f
adc ax, ax
neg ecx
neg al
push edx
not ecx
ror ecx, 1
lea ecx, [ecx + eax + 0x290ae8a9]
shl dword [esp + eax], 0x61
or al, al
bswap ecx
mov word [esp + eax*2], 0x7faa
jno 0xcac302
xor ebx, ecx
not dl
add esi, ecx
mul al
jb 0xd509a3
pop eax
jno fcn.0075d2c8
mov ecx, 0x5af1a19
sub ecx, 0x33a2382c
sbb ebp, 3
mov ecx, dword [ebp]
xor ecx, ebx
call fcn.00788524
mov eax, 0xbb21e822
push eax
inc esp
mov ebp, dword [esp + 1]
inc edi
movzx ecx, byte [eax + ebp*4 - 0x2ec87a0]
inc edx
and dword [esp + ebp - 0xbb21e4], 0x6192aa1b
inc edx
xchg byte [esp + ebp - 0xbb21e1], al
dec edi
lea eax, [eax + ebp*8 - 0x5d90f3f]
inc ebp
xor cl, bh
inc edx
movsx edx, byte [esp + ebp*4 - 0x2ec879e]
call fcn.00c8a5e6
mov ecx, 0x3b808da2
lea esi, [esi + ecx*2 - 0x77011b40]
call fcn.00b7c922
mov ecx, 0x8b3eed83
rdtsc
jmp 0xb8f595

Function at 0xbd445c
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esi + edx*4 - 0x358154], eax
sub dl, cl
mov dword [esp + edx*2 - 0x1ac0aa], ecx
inc dword [esp + edx - 0xd6050]
pop edx
pop ecx
pop eax
jno fcn.00bd68ee
call fcn.00b15e2d
mov di, word [ebp]
mov esi, 0x438972b1
inc sp
mov ebp, dword [ebp + esi - 0x438972af]
inc eax
movsx eax, dh
dec eax
lea ebp, [esi + ebp - 0x438972af]
dec eax
cwde
xor esi, 0x8d38e911
Function at 0xc09ba3
Capabilities:
Encode data using base64

Disassembly:
btr ecx, ecx
xor edx, ebx
ror ecx, cl
neg edx
lea eax, [ecx*4 + 0x1a2aa914]
rol edx, 1
jmp 0x82c8ce
lea edx, [edx + ecx + 0x6eeff833]
rol edx, 3
jmp 0xd28b98
mov dword [esp], eax
dec ebx
call fcn.00bf7de7
push eax
jp 0xb235a7
inc eax
jb 0xb235bd
xchg ecx, eax
movsb byte es:[edi], byte [esi]
mov cl, 0xff
mov edx, 0xcfbfe637
sub edi, 0x43
mov bh, 0x7f
sbb al, 0x6d
push esp
add byte [esi - 0x2d], bh
iretd
mov eax, 0x818bfc
jmp 0xb235e2
mov al, pe_nt_image_headers32
invalid
fucomp st(7)
lea ebp, [ecx + ebp - 0x1022f2f7]
sar cx, 0x2c
jae 0x80726d
add dword [esi + 0x11ffce3c], 0xffffff9b
cmp bh, byte [edx + 0xb6b5c8f]
enter 0xffffffffffff83d0, 0x11
sub esi, dword [edi]
loop 0xb235a2
adc dword [ebx + 0x5c8fba3a], ebx
imul ecx, dword [ebx], 0xffffffc8
rol byte [ebx - 0x1dc8d4ef], 1
stosd dword es:[edi], eax
mov dl, 0x22
add eax, 0x93938c41
push edx
cmp eax, 0x15de29ec
or ah, byte [esi + 0x4337469f]
xchg edi, eax
jne 0xb2361f
dec esp
loope 0xb235d4
test eax, 0x22cee92a
mov al, 0x6e
xchg dword [ebx], esi
mov eax, 0xf9d18205
push ebp
cmp byte [0xc0a5b02c], ah
pop ebx
insd dword es:[edi], dx
insb byte es:[edi], dx
push ebp
sbb al, 0x3f
inc ecx
invalid
jmp 0xb2354c
ror cl, 0xa6
adc eax, ecx
xor ebx, edx
sar cx, 0x2e
add esi, edx
xor ecx, ecx
adc eax, eax
mov eax, dword [ecx + edi]
xadd cl, ch
movzx edx, cl
add cl, byte [ecx + edi + 4]
lea edx, [edx*2 + 0x37acd524]
not edx
add edi, 6
shr edx, 0xa3
sub dl, 0x85
mov byte es:[eax + edx*4 - 0x64299758], cl
call fcn.00b7168b
mov dword [esp + 4], 0x50b133b7
mov dword [edi], edx
mov eax, dword [esp + 4]
pop eax

Function at 0xc0c6a9
Capabilities:
Encode data using xor

Disassembly:
rol ecx, 1
movzx edx, al
call fcn.00baec2c
mov eax, 0xf9b8b3b6
lea edx, [eax + eax + 0x28080922]
mov eax, dword [edx + edi - 0x1b79708e]
movzx ecx, dl
dec dx
lea edi, [edi + edx - 0x1b797089]
neg dl
push eax
shr edx, cl
call fcn.00c25ebf
mov dword [esp], eax
not ecx
jmp 0xb3df2d
Function at 0xc145e1
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + edx - 0x3a2dba24], 0x43abd782
mov word [esi + ecx - 0x6caa5642], ax
xchg cl, dl
pop edx
pop edx
jne fcn.00bd68ee

Function at 0xc1f732
Capabilities:
Execute anti-debugging instructions

Disassembly:
imul ax, cx
lea edi, [eax + edi - 0x57ff30b5]
mov eax, dword [ecx + edi - 0x57ff2239]
push ecx
xor eax, ebx
movsx edx, byte [esp + ecx - 0x57ff2239]
dec edx
mov dword [esp - 0xd5a2], 0x880e0d98
dec esi
mov dword [esp - 0x1ab44], edi
dec eax
add eax, edi
inc esi
xor dword [esp - 0xd5a2], edx
call fcn.00b2f2fc
mov eax, 0x5ebeb70a
movsx ecx, ax
rdtsc
rol ecx, 0x9b
lea esi, [esi + ecx - 0x57fffdc0]
adc cx, 0x2481
mov dword [esi + ecx - 0x57ff2235], eax
mov eax, ecx
mov dword [ecx + esi - 0x57ff2239], edx
jge 0xb7bc92
test dword [ebx + 0x1e61bbb0], esi
int1
push edx
adc ah, byte [edi - 0x30]
int3

Function at 0xc29a2e
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
neg edx
push eax
xor edx, 0x130ca602
shr ecx, cl
neg cl
mov dword [esp + edx - 0x1cbba4a7], 0x7db3bd27
mov dword [edx + esi - 0x1cbba4a7], eax
ror dx, 0xab
lea edi, [edi + edx*2 - 0x397729ec]
dec byte [esp + edx - 0x1cbb94f2]
jno 0xd7a751
imul dx, dx
rol cl, 1
movzx eax, dl
shl dx, 0xaa
bswap edx
sbb cl, 0x17
ror al, 0x24
sbb al, dh
neg cl
xor bl, cl
btr dx, ax
adc ecx, esp
lea edx, [edx*4 - 0x46481ed8]
ror al, 0x44
sbb al, 0x1f
mov edx, dword [ecx + eax - 0x70]
sbb ax, 0xcc17
lea ebp, [ebp + eax*2 - 0x68b6]
push eax
mov dword [ebp + eax - 0x3459], edx
call fcn.00b1d9e4
mov edx, dword [edi + edx*4 - 0x72ee53d0]
mov eax, 0x64375792
lea eax, [eax + eax*2 + 0x1d3246a4]
sar ax, 0x4b
xor edx, ebx
movsx ecx, al
lea edx, [ecx + edx - 0x6a69f9c]
sal word [esp + ecx - 8], cl
jbe 0xbbf45c

Function at 0xc3776a
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + ebp*2 - 0x66227b1a], ecx
jae 0xb1d3f8
mov ecx, 0x4800269a
mov ecx, dword [esi + ecx - 0x4800269a]
add esi, 4
xor ecx, ebx
mov edx, 0x9a3b9b39
mov eax, edx
lea ecx, [ecx + eax - 0xc11a2fe]
rol ax, 0xc1
sub edx, edx
jp 0xcd9439
push ecx
arpl si, bp
mov edx, 0x137cdc39
or al, al
pop esi
sub eax, 0x5991bd5f
sar byte [esi - 0x2c1cef97], 1
pop es
enter 0x3b6f, 0x1d
sub edi, dword [ecx + ecx*2 - 0x35dd41ed]
mov al, byte [edi + 0x2b]
lahf
push edx
out dx, al
pop ds
xchg ecx, eax
rcl byte [0x83340eff], cl
sal byte [edi], 0xb8
push ebx
in eax, 0x9a
cmp dl, byte [edi + 1]
invalid
ror ecx, 1
idiv eax
neg ecx
xor edx, edx
adc ax, 0x7897
ror ecx, 3
neg edx
shl edx, 0x4b
not ecx
call fcn.00d3ffbd
mov edx, dword [esp]
bswap edx
xor ecx, ebx
mov eax, edx
xadd edx, eax
add dx, 0xa81e
xor ecx, 0x8c87df17
jmp 0x748f77

Function at 0xc38b1e
Capabilities:
Encode data using xor

Disassembly:
inc cx
adc ax, dx
call fcn.00d082be

Function at 0xc3c4f4
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], eax
call fcn.0082273b
cwde
mov edx, ebp
lea ebp, [eax + ebp - 4]
sbb eax, 0x8caffaa7
mov dword [ebp + eax - 0x73500559], edx
pop edx
pop eax
jg fcn.00b635ce
jmp 0x7cc655
Function at 0xc5528c
Capabilities:
Execute syscall

Disassembly:
inc esi
mov esp, dword [eax + eax - 0x40c355ae]
dec esi
lea eax, [eax + eax - 0x40c355aa]
dec ebx
lea edx, [edx + edx*4 - 0x2be498da]
call fcn.00daa261

Function at 0xc593fb
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, eax
not dx
add esi, eax
sar word [esp + ecx*2 - 0x72016a83], cl
call fcn.00b67e20
mov edx, 0x298aed29
call fcn.00d1f13b

Function at 0xc6ae96
Capabilities:
Encode data using xor

Disassembly:
inc ecx
neg dl
inc ecx
movzx ebx, ah
neg cx
dec eax
rol dword [esp + ecx - 0xffc5], 0x7e
inc ebp
xor bh, dl
inc dl
dec esi
lea edx, [esp + edx + 0x20]
dec eax
or dword [esp + ecx - 0xffc5], 0x582c328d
inc cx
add ebx, 0x4166c38f
mov dword [edx + ecx*2 - 0x1ffba], edi
inc esp
or ebx, edx
inc ecx
ror bl, 0x67
dec esp
xchg dword [esp + 0x10], ebx
dec ecx
add ebx, 0x205cf
inc ecx
jmp ebx
dec ecx
neg ebx
jle 0xb480a6

Function at 0xc6ffa5
Capabilities:
Encode data using base64

Disassembly:
xor ebx, ecx
cdq
dec edx
add esi, ecx
mov edx, dword [ebp + eax*2 - 0x2dfe]
jmp 0xc81aee
mov dword [esp + eax*8 - 0xb7f8], edx
jmp 0x7624ef
movzx ecx, ax
mov cl, byte [ebp + eax*2 - 0x2dfa]
dec word [esp + eax - 0x16fe]
dec dword [esp + eax*2 - 0x2dfe]
lea ebp, [eax + ebp - 0x16fd]
sar byte [esp + eax - 0x16fe], 0x85
shl edx, cl
movzx ecx, ax
sub eax, dword [esp + ecx*2 - 0x2dfe]
mov dword [eax + ebp - 0x4ad61601], edx
sbb ax, ax
jp 0xc2fbfd
mov edx, 0x8010bda9
mov ecx, dword [esi]
mov al, byte [esi + 4]
add esi, 6
call fcn.00ccd0a2
add byte [eax], al
add byte [ecx + 0x73], cl
push eax
jb 0xc81bbe
arpl word [ebp + 0x73], sp
jae 0xc81bc3
jb 0xc81b9c
popal
je 0xc81bcf
jb 0xc81bc1
push eax
jb 0xc81bc4
jae 0xc81bc6
outsb dx, byte [esi]
je 0xc81b64
hlt
hlt
test byte [edx + 0x6494ca10], dl
adc dl, cl
xchg esp, eax
cwd
ror dword [ecx - 0x2179bb7c], 0xbe
mov edi, 0xe903d933
Function at 0xc71b3e
Capabilities:
Encode data using xor

Disassembly:
shl eax, cl
adc esi, 3
call fcn.00b808d5
mov ecx, 0x7215dca9
lea edi, [edi + ecx - 0x7215dcad]
movsx eax, cl
mov ecx, dword [edi + ecx - 0x7215dca9]
movzx edx, al
or al, 0xbe
xor ecx, ebx
rol dx, 0xe7
sub al, dh
and dl, dl
rol ecx, 1
bswap ecx
or edx, edx
dec ecx
and dx, ax
bts dx, ax
cmovae eax, edx
bswap ecx
dec ecx
lea edx, [edx*4 + 0x439f1118]
imul eax, eax
ror ecx, 1
mul edx
push eax
imul eax
lea ecx, [ecx + eax - 0xb2bf389]
imul ax, dx
xor ebx, ecx
add ebp, ecx
xor eax, dword [eax + esi]
imul edx, edx
adc dword [esp + edx - 0x10000000], 0xb92ad528
mov ecx, dword [esp + edx*2 - 0x20000000]
mov cx, word [edx + esi - 0xffffffc]
ja 0xc99e18
mov eax, 0x67999aa2
lea ebp, [ebp + eax - 0x67999aa6]
mov ecx, eax
mov edx, dword [ebp + ecx - 0x67999aa2]
or eax, 0x9866655e
lea ecx, [eax + eax*4 + 0x543dbf82]
btr ax, ax
xor edx, ebx
xor edx, 0xc5117410
call fcn.00b6abda
loope 0xc71bda
xchg ebx, eax
jg 0xc71c1e
out 0xac, eax
ficomp dword [eax - 0x14]
jmp 0x9b059f2a
mov edx, 0x278054e9
jle 0xc71c56
xor dh, 0x7c
lodsd eax, dword [esi]
jge 0xc71c14
mov ah, 0x57
and al, 0x74
adc ch, byte [esi + 0x41]
pop ds
sahf
ret 0x3b7f
xchg esi, eax
sub ah, ah
jg 0xc71caa
lea esi, ds:[ebp - 0x2f3d9301]
mov dword [0xb7bfad16], eax
shl byte [edx + 0x5d], 1
inc esi
in al, dx
jae 0xc71c9e
cmpsd dword [esi], dword es:[edi]
inc esp
jne 0xc71cdd
or eax, 0x7abbb27f
add byte [eax + 0x6b], ch
pop esp
mov bl, 0x49
dec ebp
std
stc
sub al, byte [eax + 0x4f]
add dword [ecx], ebp
xchg byte [ecx - 0x3a68ff1b], cl
mov cl, dl
invalid
inc dword [eax]
lcall 0x8af7, 0x3294a37d
inc dword [ebp + edx*2 + 0x1761a321]
rcl byte [edx + eax*2], 0xf0
pushfd
wait
stosb byte es:[edi], al
jae 0xc71cb1
and dword [ebx + 0x14c01761], esp
inc edx
invalid
fiadd word [ecx - 0x7fe701ed]
arpl word [esi - 0x7f04ed6c], dx
dec eax
dec edi
jmp 0x91379c31
int3
and dl, dh
lea esi, [esi + edx*4 - 0x3ffffffa]
not dword [esp + edx*4 - 0x40000000]
mov word ss:[edx + eax - 0x10000000], cx
call fcn.00ba2363

Function at 0xca514b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc edx
call fcn.00d15ab9
mov dword [esp + edx - 0x6ffffffc], edx
mov dword [esp + edx - 0x70000000], edx
or dx, word [eax + edx - 0x70000000]
shl byte [esp + 0xa], 0xe6
jne 0x72d46d

Function at 0xca7684
Capabilities:
Encode data using xor

Disassembly:
out 0xa7, eax
invalid
call fcn.00d294c2
jne 0xca7654
add ebp, 0x39091a71
adc ch, byte [edi + edi*2 - 0x45]
in al, dx
inc edi
add byte [ecx], bh
nop
in al, dx
add eax, 0xd31ec2b7
in eax, dx
salc
invalid
Function at 0xcb4220
Capabilities:
Authenticate hmac

Disassembly:
bswap ecx
jmp ebp
jmp 0xd15240
movzx eax, byte [ebp + eax - 0xc000]
mov dword [esp + ecx - 0x1036], 0xa58abb80
jae 0xd93c61
xor word [esp + ecx*2 - 0x206c], cx
xor al, bl
xchg dword [esp + ecx - 0x1036], ecx
call fcn.007f91e1
add edi, 2
sub edx, 0x183b39aa
ja 0xda49f9
mov edx, 0x19a81537
movsx ecx, al
mov dword [esp + eax*2 - 0x590a9566], esi
ret
mov cl, byte [edi + 2]
push edx
jmp 0xbab341
jge 0xda5376
sal al, cl
lea ecx, [edx + 0xd259d39]
or edx, edx
mov word [edi], ax
call fcn.007effc4
bt ecx, 0x10
xor edx, 0xab0acf33
xor ebx, edx
btc ax, cx
add ebp, edx
jmp 0xb74e7c
shr al, cl
and dword [esp + edx - 0x15b], edx
mov word [esi + edx*2 - 0x2be], ax
movzx ecx, word [esp + edx - 0x15b]
setne cl
mov dword [esp + edx*2 - 0x2be], edi
ret 4

Function at 0xcbae93
Capabilities:
Encode data using xor

Disassembly:
test al, 0xf
or byte [esi + 0xffffb61], 0xca
bswap edx
bswap edx
shr cx, 0x83
or ecx, 0xb0313a8d
xor ebx, edx
mov dword [esp], ecx
and dword [esp], ecx
setne cl
adc edi, edx
not byte [esp]
push eax
ror dword [esp + 4], cl
mov ecx, dword [esi]
pop eax
add al, ah
mov eax, dword [esi + 4]
mul ecx
push 0xd3198ba9
sar dword [esp + 1], 0xcf
mov dword [esi], edx
mov edx, dword [esp + 4]
mov dword [esi + edx - 0x7ff99dfb], eax
call fcn.00ce97d6
xchg esp, eax
in eax, dx
pop esi
nop
mov ebp, dword [ecx]
sub dword [esi - 0x34eb5781], esi
xor al, 0x35
jg 0xcbae8c
adc al, 0xcb
add byte [edi], bh
xor byte [edi + edi*8], dl
xchg byte [ebx + edi*2 + 0x5d917f6a], bl
mov word [ebx + 0x7f], es
push ss
pop ebp
inc esp
mov al, byte [0x23e05e80]
mov bl, pe_nt_image_headers32
rcl dword [edi]
fist word [edi + edi*8 - 0x7e]
jl 0xcbaedf
mov edi, 0xc3dd5480
jle 0xcbaee0
xchg esi, eax
add esp, dword [eax - 0x75]
xchg esi, eax
pop esp
inc edx
fsubr qword [ecx + 0x69]
cmp byte [edx + 0xf96a7f7], al
mov bh, 0x4d
outsd dx, dword [esi]
xchg ebp, eax
add dl, ch
mov dh, 0x3c
imul edx, esp, 0x6a816b2e
cmp al, 0x1c
hlt

Function at 0xcdb5b5
Capabilities:
Encode data using xor

Disassembly:
dec esp
xor ecx, esi
dec bl
dec ebp
arpl sp, sp
inc esp
add ebx, edi
btr ax, 0xa3
dec ebp
adc esi, esp
dec ebp
and edx, ecx
setg bl
dec esp
mov ebp, ebp
inc esp
movzx esp, cx
dec eax
lea ebp, [ebp + ecx*4 - 4]
dec ebp
xchg ecx, edx
dec ebp
xadd ebx, edx
inc cx
inc ebx
inc esp
mov dword [edx + ebp - 0x7fdb0000], ebp
xchg edx, edi
inc cx
sal edx, 0xe5
jae fcn.00d9f1e9
ror cl, 3
inc ecx
ror esp, 1
inc esp
sub esp, esi
or edi, 0x7f8b43b6
mov byte [esp + edx - 0x6346694f], ch
inc ecx
neg esp
dec esp
mov dword [esp + ecx*4], edi
dec eax
xadd edi, edx
inc ebp
mov ecx, ebx
movzx eax, cl
inc esp
xor dword [esp + ecx], esp
cwd
cwde
dec ebp
lea edx, [ecx - 0x4a6432f4]
inc ecx
pop edi
jmp 0xba73b9
mov dword [esp + edx*2 - 0x4bdadf94], eax
inc eax
inc ecx
mul al
cdq
call fcn.00b3c14c
xor byte [esp + ecx*8], 0xb3
inc ecx
sbb esp, 0xaf373721
mov dword [esp + edx - 0x6346694f], edx
jmp 0xbb407a
Function at 0xcdb5dd
Capabilities:
Encode data using xor

Disassembly:
call fcn.00d04979
push ds
or al, byte [esi - 0x351e243b]
adc dl, byte ds:[edi - 0x60134344]
mov bl, 0xfa
xchg edi, eax
in al, dx
aam 0xdd
inc ecx
fst st(4)
in eax, dx
in eax, 0x15
mov ch, ch
xor dword [ecx + 0x31], eax
pop edi
adc ebx, ebx
daa
wait
in eax, dx
insb byte es:[edi], dx
add dword [ebx], esp
mov bl, 0xed
test dword [ebp + 3], 0xd9c6eccc
inc ecx
adc ebx, dword [ecx - 0x4f]
jns 0xcdb5f3
loop 0xcdb630
adc byte [ebp - 0x24120fcd], ch
inc ebp
jb 0xcdb639
mov dl, 0x47
add ebx, dword [ecx + 0x13]
add al, al
and eax, 0x81121a24
in al, dx
inc esi
adc dl, byte [esi]
adc al, byte [ecx + 0x161246ec]
fnstcw word [esi]
movsd dword es:[edi], dword [esi]
in al, dx
push ds
mov ebp, 0x5c260ad2
xor eax, 0x1a143
add byte [eax], al
or al, 0x13
sbb dl, byte [edx]
inc edi
cmp esp, dword [ecx - 0x23]
ret 0xc300

Function at 0xcf3615
Capabilities:
Encode data using xor

Disassembly:
call fcn.007b3e60
pop es
xchg bh, dh
pop ds
push ds
pop edx
xchg edx, eax
sub ebp, dword [edi]
in al, 0xe9
insd dword es:[edi], dx
leave
and byte [ecx + 0x3e], 0x14
aad 0x2d
pop ds
aam 0x7e
push ds
xor al, 0xf4
stosd dword es:[edi], eax
clc
loope 0xcf369c
into
add dword [esi], esp
add byte [edx - 0x3259ad85], dh
cmp al, 0xf
fisubr word [edi + esi*8 + 0x25]
adc al, 0x58
cwde
push cs
adc bl, cl
dec ebx
sub al, byte [ecx - 0x88a4502]
inc esp
add eax, dword [ecx]
outsb dx, byte [esi]
sub ch, dl
inc ebp
cmpsd dword [esi], dword es:[edi]
and al, 0x80
pushfd
jno 0xcf361d
cmpsb byte [esi], byte es:[edi]
bound edi, qword [edi]
invalid
popfd
test al, 0x36
mov byte [0x25448b], al

Function at 0xcff443
Capabilities:
Execute syscall

Disassembly:
xor ebx, ecx
pop edx
add esi, ecx
cbw
mov dword [esp + edx - 0x5ff1100a], esi
ret
rdtsc
pop ecx
mov ecx, 0x6730673d
lea esi, [ecx + esi - 0x67306745]
push ecx
bts cx, 0x2a
mov dword [esi + ecx - 0x67306739], eax
lea eax, [ecx*4 + 0x71324e8c]
call fcn.00c402bd
neg eax
xor ax, 0xe2bd
xor ecx, 0xdb81a20
not ecx
sub edx, edx
bt eax, 0x3e
jae 0xb834c4
sysenter
push ecx
mov ecx, 0x3811f634
mov ecx, dword [esp + ecx - 0x3811f634]
mov dword [esp], 0x6f9d2867
call fcn.00ba91de
shr byte [eax + 0x75], cl
add byte [ecx + 0x4d], dh
fsubr dword [ebp + 0x64b7ffcc]
cdq
mov edi, 0x5e8c5b1f
popal
add byte [edi - 0x2dbfc933], ah
fdivp st(2)
mov ecx, 0x97098067
test bh, bh
xchg edx, eax
mov dh, byte [0x57b5bf93]
push es
popal
shl byte [esi + 0x2e], 0xb
sbb ebp, dword [ecx - 0x80]
inc ebx
ret 0x353

Function at 0xd06d44
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp + 4], eax
mov ecx, dword [edi]
pop edx
add edi, 4
call fcn.00c4c6d2
Function at 0xd23cdb
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
push 0x5010769a
lea esp, [esp + 0x14]
je 0xd9bd7b
mov eax, 0xbf0d6d9c
shr al, 0xc7
neg eax
mov eax, dword [ebp + ebx*4]
push 0xebbd203e
push 0x697da9c
call fcn.00c04e60
inc ebp
mov ebx, 0x2f5757d1
fsubr st(5)
pop edi
inc ecx
arpl word [ebp - 0x10], si
in eax, dx
sbb byte [0xaeec8f48], ch
xchg edx, eax
add dl, byte [ebx]
lahf
mov al, 0x59
xchg ebx, eax
mov eax, dword [0x78a59f13]
mov bl, 0xed
ror dword [esi], cl
xor dword [ebx], edx
jne 0x80838b
dec eax
sbb dl, byte [ebx]
push edi
xlatb
jge 0x8083e2
pop ecx
adc bl, cl
cmpsd dword [esi], dword es:[edi]
add eax, 0x83b52012
shr ah, cl
int3
mov cl, 0x41
adc ebp, dword [edx + 0x6b]
int3
test ecx, edi
mov eax, dword [0x58f27835]
xor eax, 0x2da4a805
invalid
xor eax, 0x3558f278
add eax, 0xf02da4a8
xchg dl, cl
mov dh, 0x5c
sar dword [edx + 0x2f], 1
fdiv qword [esp + eax*8]
pop edx
das
jp 0x8083df
and dword [esi - 8], 0x41
invalid
movzx esi, byte [ecx]
push 0x9012bf26
ror dword [esp], 0x5e
xor esi, eax
mov dword [esp + 4], 0x1c089098
and esi, 0xff
dec dword [esp + 2]
jnp 0xd25f9c
add eax, edx
jmp 0x808312
shr dword [esp + 4], 0xd0
mov esi, dword [esi*4 + 0xd2bea8]
shr eax, 8
call fcn.00b75ebc
mov eax, 0x11b1f705
mov eax, dword [eax + ebp - 0x11b1f705]
mov ecx, 0xe81e5a3c
shl ecx, 0xd6
mov ecx, dword [ebp + 4]
mov edx, 0x600b3b93
push ebx
sub edx, edx
sub dx, dx
mov ebx, edx
cpuid
sbb ebp, 8
push 0x2c99b304
jmp fcn.00b2b374
mov eax, dword [ebp]
call eax
mov ebp, dword [ebp - 4]
mov ecx, 0x1f0485bc
mov dword [ecx + ebp - 0x1f0485bc], eax
movzx edx, cl
mov edi, ebp
lea edx, [edx*4 + 0x309564be]
mov ebp, 0x6422e588
dec dl
pop ebx
neg dl
pop esi
adc ebp, edx
pop ebp
jmp esi

Function at 0xd2b7fe
Capabilities:
Execute syscall

Disassembly:
xchg esi, eax
mov edx, 0x4319379c
mov edi, eax
pop eax
jmp 0xc150eb

Function at 0xd36877
Capabilities:
Encode data using base64

Disassembly:
neg al
sub al, 0x8c
mov dword [esp + edx], 0xb6b5ea83
bswap ecx
jmp 0xcdbabd

Function at 0xd4f109
Capabilities:
Encode data using base64

Disassembly:
movzx ax, byte [edi + 2]
xchg dword [esp + 8], ecx
xor cx, 0x643d
adc edi, 2
imul dl
lea edx, [ecx + 0x1b2c18a5]
mov word [edi], ax
pop ecx
pop eax
pop ecx
pop eax
jmp esi
add edi, 4
push 0xdf263e90
call fcn.00bcce24
movzx ecx, byte [ebp]
mov edx, 0x9532b12d
add ebp, 1
xadd dl, dh
push edx
mov eax, dword [esp]
xor cl, bl
xadd byte [esp + 3], dl
and word [esp], 0x10a4
imul eax, edx
xor cl, 0xa5
sub edx, dword [esp]
jl 0xdac0c8
mov eax, 0x8906441e
mov edx, eax
bts eax, eax
sbb ebp, 4
shr dl, 0x21
mov eax, dword [ebp]
btc edx, edx
mov ecx, edx
xor eax, ebx
sar dl, 0xe4
js 0xd15b4a
je 0xd38a0b
Function at 0xd5172c
Capabilities:
Authenticate hmac

Disassembly:
lea edi, [edi + eax - 0x8a4507]
movzx edx, byte [ebp + eax*4 - 0x2291424]
mov dword [esp + eax - 0x8a4509], eax
sal eax, 0x1b
lea eax, [eax*2 + 0x1c98fc86]
adc ebp, 1
xor eax, 0xdc184015
not ax
and eax, 0xf812c823
xor dl, bl
sub eax, dword [esp + eax - 0x70004020]
not word [esp + eax - 0x6f75fb15]
ror dl, 1
bt eax, eax
jb 0x7226d6
xor dl, 0x2e
push eax
push eax
rol dword [esp + eax - 0x6f75fb11], 0xa7
inc dl
pop eax
call fcn.00be3c0a
mov ecx, 0xaa9a5ca4
movzx cx, byte [esi]
pop edx
mov edx, 0x99a87e23
push edx
mov al, byte [esi + 2]
xchg byte [esp], dh
add esi, 2
not cl
not al
jmp 0x7d6a3c

Function at 0xd5353a
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, ecx
cbw
pop edx
add ebp, ecx
jmp 0xbea432

Function at 0xd5b624
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [ebp + eax*2 - 0x5ffffffc]
lea ebp, [ebp + eax*2 - 0x5ffffff8]
btc eax, 0xb5
mov dword fs:[edx + eax*2 - 0x60400000], ecx
call fcn.00c95b21
mov ecx, 0x502eff01
mov eax, ecx
ror al, 0x64
mov eax, dword [edi + eax - 0x502eff10]
mov edx, dword [edi + ecx - 0x502efefd]
xadd cl, ch
or ecx, 0x57982087
lea edi, [edi + ecx - 0x57be217f]
sub cx, cx
mov dword fs:[ecx + eax - 0x57be0000], edx
sbb cx, cx
lea ecx, [ecx*2 + 0x4827732a]
movzx edx, cx
mov ecx, dword [esi + edx*8 - 0x39950]
lea eax, [edx + edx*4 - 0x16ed954f]
rol edx, 0x4b
lea esi, [esi + edx*4 - 0xe653ffc]
xor ecx, ebx
neg edx
and dl, al
bswap ecx
dec ecx
jmp 0xd53b87
add dl, dl
xchg edx, eax
ror ecx, 2
sar dl, 0x83
sal al, 0x66
neg ecx
xor ebx, ecx
or edx, 0x4e8ea983
adc ebp, ecx
movsx ecx, dx
bts ecx, ecx
xor eax, ecx
jmp ebp
xor ecx, 0x6f914324
mov dword [esp + edx*2 - 0x160bfe60], edx
neg ecx
idiv eax
idiv eax
xor ebx, ecx
cbw
add esi, ecx
mov edx, dword [edx + ebp - 0x31018900]
sal eax, 0x5c
jne 0x761404

Function at 0xd5e4df
Capabilities:
Execute syscall

Disassembly:
or al, ah
adc cl, dl
mov edx, eax
sal eax, 0x37
mov word [edi + edx*8 - 0x38f98], cx
rol eax, 0xf8
movzx ecx, dl
mov eax, dword [ebp + eax*2 - 0x1f30000]
and ecx, 0x41116224
lea ebp, [edx + ebp - 0x71ef]
push ecx
xor eax, ebx
call fcn.00b83b57
ror ecx, 2
sal dl, 0x67
xor ebx, ecx
bswap edx
btc edx, edx
adc ebp, ecx
call fcn.00c8f7b7
push ecx
bswap eax
push edx
xor ebx, eax
shl byte [esp + edx*2 - 0x7fff7ff7], 0x84
sbb cx, 0x9206
add esi, eax
mov dword [esp + edx*2 - 0x7fff8002], esi
ret 8
jmp 0xdaf836
xor bl, dl
lea edx, [esp + edx + 0x10]
add eax, eax
mov dword [esp + eax - 0xe68], eax
mov ax, word [edx + eax - 0xe68]
movsx edx, cx
lea edi, [edi + edx*2 - 0xe6a]
jp 0xce54d1
js 0xc9945c
pop edx
mov word [edi + edx*2 - 0x1cd0], ax
pop ecx
pop edx
pop edx
ja fcn.00b14ece
syscall
call fcn.00d6d58f
pop edx
pop ecx
jmp esi