joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b5a2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001b5e1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001b5e1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001b5e1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001b5e1
cmp dword [ecx + 0x74], 0xe
jbe 0x1001b5e1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001e264
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001e301
push ebx
push esi
call fcn.1001e22d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001e1c1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001e2ae
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001e300
push edi
push eax
call fcn.1001f21f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001e2ce
call fcn.1001cd09
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001e2ff
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001e1c1
add esp, 0x20
test eax, eax
jne 0x1001e2ed
push edi
call fcn.1001cd09
jmp 0x1001e2f5
push ebx
call fcn.1001cd09
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001e56e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002c230
push 0x1002c228
push str.FlsAlloc
push 0x1f
call fcn.1001e48a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e5a2
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002614c]
call esi
jmp 0x1001e5a8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001e5ec
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002c240
push 0x1002c238
push str.FlsGetValue
push 0x21
call fcn.1001e48a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e623
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002614c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001e62b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002c248
push 0x1002c240
push str.FlsSetValue
push 0x22
call fcn.1001e48a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e665
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002614c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023d00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10023d2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10023d2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x709eb4
Capabilities:
Execute syscall

Disassembly:
mov edi, dword [esp + edx - 0x378c6bbd]
mov edx, dword [esp + edx - 0x378c6bb9]
pop eax
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [esp + eax*2 - 0xd77e]
mov eax, dword [esp + eax - 0x6bad]
jmp 0xc3b7f0
jmp 0xca54e9
call fcn.00c6160d
syscall
call fcn.00ba2315
add edi, eax
mov edx, dword [ebp]
mov eax, dword [edx]
movzx edx, byte [esp]
mov dword [edx + ebp - 0xb0], eax
mov dword [esp + edx - 0xb0], edi
ret
Function at 0x712b2d
Capabilities:
Authenticate hmac

Disassembly:
not dx
movzx ecx, byte [edx + ebp - 0x73bd10ab]
sal edx, 0x65
inc dl
add dx, dx
xor cl, bl
xor dx, dx
and edx, edx
pop edx
adc cl, 0xa4
xor cl, 0x23
mov edx, 0x4b929a95
shl edx, 0xa2
adc cl, 0x20
or dl, 0xf
not cl
setnp dl
sal edx, 0x97
add dl, dl
sbb cl, 0x9d
not dx
or dx, dx
btc edx, edx
rol cl, 1
shr dx, 0x81
shl dx, 0x63
not cl
xor bl, cl
add ecx, esp
ror edx, 0xe8
not edx
mov dword [edx + ecx - 0x77fff00], eax
movzx eax, dl
mov edx, dword [edx + esi - 0x77ffefc]
mov ecx, eax
jb 0xbe8aa9

Function at 0x72254c
Capabilities:
Authenticate hmac

Disassembly:
shl dl, 0x41
adc esi, eax
mov dword [esp + ecx - 0x7e124e46], ecx
movzx ecx, byte [ebp + edx*4 - 0x230]
mov eax, 0xa900769e
lea ebp, [edx + ebp - 0x8b]
cdq
push edx
xor cl, bl
sub ax, 0x9db9
btr edx, eax
adc edx, 0x3a32187
ror cl, 1
inc al
xor cl, 0x8c
and eax, dword [esp + edx - 0x3a3215f]
ror cl, 1
neg dword [esp + edx*2 - 0x74642c6]
xchg dword [esp + edx - 0x3a32165], edx
btr eax, 0x3f
sbb cl, dl
xchg dh, dl
cbw
or dword [esp + eax*2 - 0x1200003f], edx
xor bl, cl
and word [esp + edx - 0x4e46fff6], dx
sub eax, edx
lea edi, [edi + edx - 0x4e470001]
mov word [edi + edx - 0x4e46ffff], cx
pop ecx
pop eax
pop ecx
jle fcn.00bb937c
mov edx, 0x83df63b
mov ecx, dword [edi + edx*2 - 0x107bec76]
mov eax, edx
bt edx, eax
mov eax, dword [edi + edx*2 - 0x107bec72]
jb 0xb0705d
mov eax, 0xfa3d0913
neg ax
movzx ecx, ax
mov edx, dword [esi + ecx - 0xf6ed]
not ax
lea esi, [ecx + esi - 0xf6e9]
jg 0x713930
bswap eax
ror cx, 0x84
xor edx, ebx
inc edx
bt ecx, ecx
dec cl
adc cl, 0xa8
bswap edx
bswap ecx
ror edx, 2
call fcn.00b3c828
not edx
adc edi, 7
mov dword ss:[ecx], eax
movzx eax, dl
neg dl
add edx, edx
lea esi, [esi + eax - 0xc8]
neg dl
mov edx, dword [esi + eax*8 - 0x620]
movzx ecx, ax
xor eax, ecx
xor edx, ebx
sar cl, cl
bswap edx
lea eax, [ecx*4 + 0x4717d033]
xor edx, 0x33abca92
lea eax, [ecx - 0x1ae83971]
sar eax, cl
dec edx
rol cl, 0xa4
rol edx, 2
xor ebx, edx
add ebp, edx
jmp ebp
Function at 0x72ee6f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor al, bl
inc dword [esp + ecx - 0x19e]
shl ecx, 2
and ecx, dword [esp + ecx - 0x678]
neg al
xor al, 0x81
add al, 0xbc
pop ecx
neg al
xor bl, al
or ecx, ecx
rol ecx, cl
neg cx
add eax, esp
lea ecx, [ecx + 0x5f97b38a]
mov byte [eax], dl
bts ecx, 0
call fcn.00b82289
xor ecx, 0x5a1de016
ror ecx, 1
jmp 0x745ba2
sar dl, 4
mov dx, word [edi + ecx*8 - 0x970]
sub cl, 0x90
lea edi, [ecx + edi - 0x19c]
lea ebp, [ebp + ecx*8 - 0xcf1]
movsx eax, cx
mov dword [esp + ecx - 0x19e], 0x69005b2e
movzx eax, byte [ebp + ecx - 0x19e]
jnp 0x7106ca
inc esp
mov edx, dword [edi]
mov esi, 0xa20b8e0a
dec eax
add edi, 4
dec eax
lea edx, [esi - 0x1af57c69]
inc esp
xor edx, ebp
inc esp
mov esi, edx
inc cx
xadd esi, edx
je 0xcc1a3a
inc ecx
rol edx, 2
movzx ebx, dx
dec eax
lea ecx, [esi + esi*4 + 0x4a9fbfa5]
inc ecx
sub edx, 0xdc992f01
bt ecx, edx
shl edx, 0x49
shl bx, 0x45
inc ecx
ror edx, 2
dec esi
lea esp, [esi + esi - 0x5269a870]
inc ecx
ror esp, cl
inc esp
mov edi, esi
inc ecx
not edx
dec ebp
bts esp, esi
jb 0xcbe927
not ecx
rol ecx, 3
xor edx, 0x2c09818a
mul edx
neg dl
adc ecx, 0xfab80d14
xchg dx, ax
mul ax
shl edx, 0x49
bswap ecx
not ecx
btc ax, ax
xor edx, edx
shr eax, 0xd5
xor ebx, ecx
xadd eax, edx
adc ebp, ecx
xor edx, ebp
jmp edx
btr edx, eax
neg ecx
lea ecx, [ecx + edx*2 - 0x23adf7fa]
shr ax, 0x22
neg ecx
xor ebx, ecx
add esi, ecx
push edx
mov dx, word [edi + edx*2 - 0x6f54fc0]
call fcn.007d5b4f
ror cl, 1
sar dl, 0x61
xchg word [esp + edx - 0x15fd1], ax
adc cl, 0x1e
btc eax, edx
btr eax, edx
ror cl, 1
add cl, 0x15
xor bl, cl
lea ecx, [esp + ecx + 4]
pop edx
movzx dx, byte [ecx + edx*2 - 0x50012b06]
neg eax
sar eax, 0x48
mov word [edi - 4], dx
sbb edi, 4
mov ecx, eax
cbw
or ecx, ecx
jae fcn.007b8565
inc ecx
bswap edx
xor edx, ebx
inc ecx
mov eax, 0xef82db8f
inc ecx
rol edx, 1
inc ecx
shr edi, 0x73
inc ecx
dec edx
push ebp
inc ecx
shl eax, 0xdb
inc cx
sal esi, 0x88
inc esp
xor dword [esp + edx*2 - 0x5846ec40], edx
dec edx
lea ebp, [eax*2 + 0x2b82a4b6]
sub si, 0x2391
pop ebp
inc ebp
movzx ebx, ax
sar cl, 0xa5
dec ebp
arpl dx, dx
dec ecx
btc ebx, esi
dec ebp
adc ebp, edx
sub si, 0xadaa
call fcn.00c2289d
inc ecx
mov edi, 0xbc0def17
call fcn.00c2f262
jb 0xc1f73b
dec ecx
and eax, eax
inc cx
not ebx
dec eax
shr ecx, 0xde
dec eax
rol eax, 0xac
dec eax
cdq
inc cx
not edi
inc bp
or ebx, edi
cdq
inc ecx
ror al, 0xa3
inc di
mov dword [ecx + esi - 0x14a9e392], ebx
call fcn.00cee01a
Function at 0x72fe9b
Capabilities:
Manually build aes constants

Disassembly:
xor ecx, 0x9918b832
mov edx, dword [edi]
mov dword [esp], ecx
mov eax, dword [edi + 4]
shr dword [esp], cl
mov cl, byte [edi + 8]
jae 0xcb5994
syscall
call fcn.00b22e11
sub ebp, 4
mov ecx, 0x2890ae09
shl ecx, cl
mov edx, dword [ebp + ecx*2 - 0x42b82400]
mov eax, 0x661850b2
xor edx, ebx
xor cx, 0x6522
lea edx, [edx + ecx*4 + 0x5dbe8e8b]
jbe 0xc525f0
and ecx, eax
rol edx, 1
neg edx
not edx
sub edx, 0xbd19f922
cwde
bswap ecx
not edx
lea edx, [eax + edx - 0x6b910bd4]
dec eax
or al, al
rol edx, 3
xor ebx, edx
rol cx, 0xc6
push ecx
btc ax, ax
lea esi, [esi + eax - 0x50b7]
sal word [esp + ecx - 0x22500804], cl
rol ax, 0x4c
inc dword [esp + ecx*2 - 0x44a0100c]
mov dword [esi + ecx - 0x22500806], edx
call fcn.00c759c4
or byte [esp + 3], 0x3d
push 0xed2a313a
adc edi, 6
not dword [esp + 4]
push 0x732b5093
shld edx, eax, cl
mov dword [edi], edx
call fcn.00cf5c0c

Function at 0x736242
Capabilities:
Encode data using xor

Disassembly:
mov edx, eax
not ecx
mov dword [edi], ecx
bswap eax
lea ecx, [edx + eax*8 - 0x22c9575b]
jmp ebp
jmp 0xbe04a6
mov edx, 0x64bef01f
sal dl, 0x47
lea edi, [edi + edx - 0x64bef078]
bt edx, edx
mov dword ss:[ecx + edx - 0x64bef080], eax
bts dx, dx
lea ebp, [ebp + edx - 0x64bef085]
mov edx, dword [ebp + edx - 0x64bef081]
mov eax, 0x7609529a
xor edx, ebx
jmp 0xb19c4c
mov ecx, eax
xor edx, 0xd01b2392
ror edx, 3
sal cl, 0x84
neg edx
shl ecx, 0x84
btr eax, eax
sbb edx, 0x5bbe467f
or cl, cl
adc ecx, 0xd33bb8af
sub ax, 0x9514
xor edx, 0x50837c14
sal eax, cl
sbb edx, 0xeb2c2e10
bswap edx
sub eax, 0xc199d3a6
setae al
xor edx, 0xf82a7c39
imul cx, ax
lea eax, [ecx*8 + 0x3f152f3f]
ror edx, 2
dec cl
xor edx, 0xce17e430
xor ebx, edx
shr ecx, cl
rol ecx, 0xdf
cwde
add esi, edx
jmp esi
mov dword [esp], 0x5782cd36
and esi, 0xff
call fcn.00a99ac5
mov dword [esp], 0x4710672a
test eax, eax
lea esp, [esp + 0xc]
and al, 0xc
je 0xc9182e
call fcn.00bbf2b7
mov ecx, 0xfb78387
not ecx
xor cx, cx
mov ecx, dword [edi]
mov eax, 0x7b2499bd
cwde
bt eax, 0x28
mov eax, dword [edi + 4]
jb 0x73848c
mov edx, 0x448b28e0
daa
add al, 0xf
sbb byte [ecx - 0x58004a81], 0x54
cmpsd dword [esi], dword es:[edi]
push esp
inc edi
cmp eax, 0xdef2b05f
movsd dword es:[edi], dword [esi]
sub dh, byte [ebx - 0xa3ff629]
mov ch, 0
in al, dx
aam 0x1c
xor al, cl
jae 0xbe04e6
push eax
push esp
xor al, cl
jae 0xbe04c4
dec esp
aam 0x30
enter 0xffffffffffffc373, 0x34
mov ah, 0x30
enter 0xffffffffffff9373, 0x7c
aam 0x30
enter 0x2373, 0xfffffffffffffff8
or al, 0x3b
mov edx, 0xfb0e2dd1
mov esi, 0x7f4388ce
lodsd eax, dword [esi]
add bh, bh
invalid
mov eax, 0xd0389c36
jmp 0x733981

Function at 0x73cf84
Capabilities:
Encode data using base64

Disassembly:
lea eax, [esp + eax + 0xc]
mov ecx, dword [eax]
sbb esi, 4
neg byte [esp + 8]
imul edx, dword [esp + 6]
mov dword [esi], ecx
pop eax
pop eax
pop eax
jo fcn.00cb8833
Function at 0x73e0a4
Capabilities:
Encode data using xor

Disassembly:
dec edx
mov dword [esp - 0xdb58], 0xf21c4883
inc edx
ror byte [esp - 0xdb53], 0x65
bswap eax
setae cl
sbb eax, 0xcb342eba
inc edx
neg byte [esp - 0xdb53]
ror eax, 1
inc edx
dec byte [esp - 0x6da9]
inc ecx
or al, 0x37
bswap eax
inc si
xor esp, dword [esp - 0xdb57]
dec edx
mov dword [esp - 0x71e4], ebp
inc ecx
movzx ebp, dx
dec ecx
and edi, 0xb2ba573e
inc edx
xor dword [esp - 0xe3c8], eax
inc cx
shl esi, 0xcf
inc ecx
sub eax, 0xfb184c1f
pop ebp
inc esp
mov ebx, eax
inc ecx
movzx esi, dx
inc bp
imul esi, edi
dec esi
lea esi, [eax*4 - 0x60fe78e6]
inc ebx
mov ebx, dword [ecx - 0x1c794]
dec edi
lea edx, [esi + esi*4 + 0x2f39570f]
inc ecx
movzx eax, dh
dec ebp
or edi, eax
inc ecx
not ebx
inc ecx
xadd edx, ecx
inc ecx
div al
call fcn.00738c70

Function at 0x743861
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + edx - 0x3f8fcd80], ecx
sets dl
xor eax, ebx
shl dword [esp + edx - 0x3f8fcd01], 0x31
sal dl, 0x43
and byte [esp + edx - 0x3f8fcd08], 0x96
xor eax, 0xa1bbec85
sar dl, 0x67
dec eax
xor eax, 0xe7245323
add edx, ecx
xor cx, dx
call fcn.0071016b
Function at 0x743898
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, edx
push eax
lea ecx, [ecx + ecx*8 + 0x77a68326]
add edi, edx
and eax, eax
inc word [esp]
movsx edx, word [esp]
mov dl, byte [edx + esi - 2]
and ax, ax
sar word [esp], 1
adc esi, 1
xor dl, bl
cbw
xor eax, dword [esp]
ror dl, 1
not cl
add dl, 0x3e
ror dl, 1
add eax, 0x3faa9714
mov dword [esp + eax*2 - 0x7f552e24], ecx
sbb dl, 0xa4
lea ecx, [ecx + eax + 0x643cf2af]
sal al, 0xa4
xor bl, dl
shl ecx, 9
btr eax, ecx
pop eax
lea edx, [esp + edx + 4]
neg ax
mov ecx, dword [ecx + edx - 0x29272600]
movzx edx, byte [esp]
jns 0xbc0b05
lea ebp, [ebp + edx*8 - 0x684]
js 0xb7fea2
xor ebx, eax
jmp 0xa92493
add ebp, eax
lea eax, [edx + edx*4 + 0x78279e04]
mov eax, dword [edi + ecx - 0x280026]
not word [esp + ecx*4 - 0xa00093]
mov byte [esp + ecx*8 - 0x140012b], 0x9f
sal word [esp + ecx - 0x280025], 0x27
mov dl, byte [edi + ecx*2 - 0x500048]
shl dword [esp + ecx*2 - 0x50004c], cl
call fcn.00c9863f
inc ecx
dec esi
mov dword [esp + esi - 0x783ccd0c], esi
mov dword [esp + esi - 0x783ccd12], 0x14869a91
dec dword [esp + esi - 0x783ccd13]
inc ecx
rol esi, 1
inc ecx
inc esi
inc ecx
rol esi, 2
dec ecx
lea eax, [edx - 0x3ae3837e]
dec eax
bswap ebx
inc esp
movsx ebx, dh
inc ecx
neg esi
inc ecx
push edx
inc edi
lea esi, [ebx + esi - 0x722dd1ad]
dec eax
mov dword [esp + esi - 0x783ccd05], ebp
inc esi
xor dword [esp + ebx*2 - 0x1a], esi
dec edx
mov ebp, dword [esp + ebx - 5]
idiv esi
dec ebp
arpl si, si
jmp 0xb5fb73
shr ecx, 0x6a
jbe 0x7b0859
imul si
shl dword [esp + esi - 0x783ccd09], 0x2d
dec ebp
adc ebp, esi
inc esp
movzx esp, bl
dec esp
mov dword [esp + esi - 0x783ccd15], ebp
ret 0x10
mov dword [ebp + edx - 0xd0], ecx
pop ecx
js fcn.00aabce2
mov ecx, dword [edx]
sub edi, 4
mov dword [esp], eax
mov dword [edi], ecx
mov ecx, eax
ror eax, cl
sal ecx, 0x39
sbb esi, 3
ror word [esp], 0x83
cdq
dec cl
mov eax, dword [esi]
xchg word [esp + 2], dx
xor eax, ebx
call fcn.00adf3c6
mov ebx, 0xd2cf7136
mov eax, dword [0x6256ff5f]
out 0xa1, al
pop edi
dec dword [edx + 0x5fa18a3e]
call [esi]
add bh, dl
stc
jecxz 0xbc0b59
jecxz 0xbc0bd1
inc esi
invalid
mov gs, word [eax + ebp*2 + 0x5909e5b9]
mov dl, 0x43
push edi
cmp al, 0x26
jns 0xbc0ba4
invalid
invalid
xchg ecx, eax
mov cl, 0xda
fnstcw word [esi + 0x55a4b98e]
outsd dx, dword [esi]
invalid

Function at 0x74bc6c
Capabilities:
Authenticate hmac

Disassembly:
push 0x42076580
jmp 0xc59071

Function at 0x74c82e
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
sal word [esp + edx*4 - 0x2a], 0x24
mov word [ebp + edx - 0xc], ax
lea eax, [edx*4 + 0x633fef90]
call fcn.00ac970c
mov cx, word [edi]
mov eax, 0x41979520
lea edi, [eax + edi - 0x4197951e]
movsx edx, al
movzx eax, byte [eax + ebp - 0x41979520]
ror edx, 0x7e
or edx, edx
shl dl, 0x42
lea ebp, [edx + ebp + 1]
xor dl, dh
btr edx, 0x38
bt edx, edx
xor al, bl
sub al, 0x81
jmp 0xc1a505
add eax, esp
call fcn.00aa665c
rol al, 1
inc dx
xor al, 0xa5
bt dx, 0x29
bts edx, edx
lea edx, [edx + 0x7f00622a]
neg al
imul dx, dx
sbb dx, 0x4428
xor al, 0x3d
bswap edx
xor bl, al
jmp 0x758a2c
Function at 0x7538ba
Capabilities:
Encode data using xor

Disassembly:
bswap ecx
mov dword [esp + ecx*2 - 0x6570722a], ecx
not ax
jge 0xad3714
mov edx, dword [ebp]
call fcn.007e6cd5
mov edx, dword [esi]
xor edx, ebx
dec edx
jmp 0x77696d
rol edx, 2
mov ecx, dword [esp]
mov eax, ecx
xor edx, 0x5100339f
add ecx, 0x39954286
rol ecx, cl
bswap eax
not edx
inc cl
push ecx
xor ebx, edx
neg ecx
rol cx, cl
or eax, eax
adc edi, edx
lea edx, [ecx + eax*4 - 0x4bdf8c6c]
movzx dx, byte [ebp + eax - 0x2cc8c36]
not ax
sal eax, cl
sal word [esp + eax - 0x6639e47a], cl
mov cl, byte [eax + ebp - 0x6639e47e]
add dword [esp + eax - 0x6639e47c], 0x29887593
lea ebp, [ebp + eax - 0x6639e47e]
adc word [esp + eax - 0x6639e47a], ax
shr dl, cl
not ax
mov word [eax + ebp - 0x66391b7f], dx
movsx ecx, byte [esp + eax - 0x66391b7b]
not eax
movzx edx, cl
mov dword [esp + edx - 0x95], edi
ret 4
setae cl
js 0xb21de0
and dx, ax
dec dword [esp + ecx - 0x32b83901]
movzx eax, cx
imul cx, word [esp + ecx - 0x32b838ff]
mov word [ecx + edi - 0x32b82ab8], dx
movzx edx, cl
xchg word [esp + ecx*2 - 0x6570556f], ax
cbw
mov dword [esp + ecx - 0x32b82ab8], ebp
ret
bt ecx, 0x98
shr ecx, 0x4e
call fcn.007adc38

Function at 0x75b000
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x37a341bc], 0x7aa6d1b6
xor edx, ebx
pop eax
bswap edx
lea eax, [ecx + eax*8 - 0x76ce927d]
rol ax, 0x4b
not edx
shr al, 0xa4
jns 0xad09ed
mov ecx, dword [edi]
push 0x4082473d
inc ecx
mov esi, 0xe0356423
inc ecx
mov esi, esi
dec eax
add edi, 4
mov edx, 0xcc118429
inc esp
movsx edx, dh
xor ecx, ebp
movzx eax, dl
ror cx, 0xa
lea edx, [edx + eax*2 - 0x129dd466]
bts cx, ax
neg edx
xor ebx, edx
inc cl
xor cl, 0x91
adc ebp, edx
shr cl, 6
cwde
lea edx, [eax + ecx*4 - 0x526d1556]
lea esi, [esi + eax*4 - 0x1e439]
call fcn.007e9886
Function at 0x77685c
Capabilities:
Manually build aes constants

Disassembly:
lea edx, [edx + eax*2 - 0x6910233d]
bswap edx
pop ecx
not edx
dec edx
movsx ecx, ax
rol al, 0xa5
and dword [esp + eax*4 + 6], eax
bswap edx
mov dword [esp + eax*2], ecx
xchg dword [esp + eax*2 + 8], eax
xor ebx, edx
bswap eax
shl ax, 0xa
jp 0x7c4eb1
rol dword [esp + 1], 0xc2
test edx, edx
push 0xb1274593
lea esp, [esp + 0xc]
je 0xa85e1d
push ebx
mov cl, 0xcf
lahf
in al, 0x9f
dec dword [edi]
and eax, 0xff9fe4fb
pop edi
arpl di, di
in al, 0x9f
invalid
add edi, edx
add eax, dword [esp + eax - 0xf7f8]
ja 0xcee85a
sbb byte [esp + ebp*4 + 0x59877faa], 0xbf
adc edx, ecx
ja 0x7c4e79
sbb eax, 0xf39bea28
mov al, byte [0xb11c3f4]
push ebp
inc esi
cmp al, 0x8f
push ebx
stc
and ah, byte [edx]
jo 0x7c4f0e
ret
sbb byte [eax - 0x56], cl
invalid
in al, 0x97
lds edi, [ebx - 0x7e]
sbb ah, bl
sub dword [edx], ebp
movsb byte es:[edi], byte [esi]
xchg esp, eax
out 0x28, al
loope 0x7c4ed3
adc esp, dword [edi + 0x62]
mov word [edi + 0x50f49da], fs
aad 0xc9
mov dh, 4
inc esi
lodsd eax, dword [esi]
aas
out 7, eax
into
dec esi
mov ch, 0x2a
mov bh, 0x83
adc esi, ecx
jae 0x7c4eef
inc eax
sti
mov ebp, 0x60e384bf
ja 0x7c4f8e
add bh, ch
aad 0xd8
aad 0xe0
jle 0x7c4f99
sal byte [ebp - 0x3592c0c1], 1
out dx, al
mov ah, byte [ecx]
sti
mov ecx, 0xbbf33256
sub byte [esi + 0x6a], bl
add al, 0x91
sub edx, dword [ecx - 0xb76e6f1]
mov esp, esi
sub bh, byte [esi]
jl 0x7c4f43
in eax, dx
fiadd word es:[eax - 2]
popfd
mov ebx, dword [ebp - 0x5f3db7a4]
xchg dword [ebx], ebp
inc edx
mov dword [ecx + 0x53], edx
lds esp, [esi + 0x6c]
stc
jae 0x7c4ef9
adc ebp, 0x1c966b7d
imul ebx, dword [edx], 0x5138273f
mov ah, 0xb9
inc esp
salc
cmp byte [ebx + 0x3a], 0x5c
scasb al, byte es:[edi]
mov dword [0xcea9e26c], eax
cmc
or dl, byte [ebp + 0x41]
bound edx, qword [0xd4c0ff24]
inc eax
ret
ficom word [ecx + 0x5b]
xchg ebx, eax
xchg ebx, eax
repne insb byte es:[edi], dx
shr ch, cl
xchg esp, eax
sbb eax, 0xd0ee6470
cwde
stosd dword es:[edi], eax
mov al, 1
jo 0x7c4fff
out dx, al
rcr byte [eax - 0x1cfe4f55], 1
invalid
jecxz 0x7c4fa1
stosb byte es:[edi], al
pop ebp
mov ebp, fs
sub dword [ebx], esp
invalid
fidiv word [edx + 0x349fda08]
in al, 0x90
sbb bl, dl
mov ebp, 0x3c048065
fldenv [ebx]
and al, 0xf1
pop ebp
pushal
mov esi, 0x449ab01d
and bh, 0xee
ror byte [ecx + 0x40], 1
adc byte [eax + 0x57], 0x24
fidivr dword [edi + 0x4e]
jae 0xb8487312
adc eax, edx
stosb byte es:[edi], al
invalid
ja 0x7c4fce
out dx, eax
invalid
mov edx, 0x3415e4be
lea eax, [edx - 0x48693757]
bts eax, edx
not ecx
not edx
mov dword [ebp], ecx
not dx
jmp edi
neg cl
pop eax
pop eax
pop eax
jno fcn.007c6802
mov edx, 0xfe2a8e0b
mov dl, byte [edi]
mov eax, 0x1417aa8e
movzx ax, byte [edi + eax*4 - 0x505eaa36]
mov ecx, 0x2eae511b
lea edi, [edi + ecx*2 - 0x5d5ca234]
sar cx, 0xe3
xor ecx, ecx
imul dl
ror cl, 4
bt cx, cx
movsx edx, cx
mov word [edi + ecx*2], ax
cmovb cx, dx
movzx eax, dx
ror eax, 0xc8
adc ecx, dword [esi + ecx*2]
lea edx, [eax + edx*8 - 0x1fcb13dc]
lea esi, [esi + eax*4 + 4]
btc ax, 1
or eax, eax
xor ecx, ebx
xchg edx, eax
rol ecx, 2
dec dx
sub ecx, edx
push eax
add al, dl
call fcn.007302d2
Function at 0x77cfa6
Capabilities:
Authenticate hmac

Disassembly:
xadd cl, al
mov eax, dword [ebp + eax*2 - 0x2a04dbf6]
mov dword [esp], 0xd61e9f22
sub dword [esp], ecx
mov edx, dword fs:[eax]
neg dword [esp]
jp 0xb61c34
mov edx, 0xdfa1c195
mov eax, dword [edi]
mov cx, word [edi + 4]
xadd dl, dh
ja 0x73a9ca
jle 0x7b53a6
mov ecx, 0x2d1b803e
jmp 0xb669af
adc edi, 5
bt edx, edx
neg edx
jbe 0x7ea8a0
mov eax, 0xfa96539f
mov ecx, 0x7c379b81
movzx edx, al
mov edx, dword [esi + ecx - 0x7c379b81]
add cl, 0x85
lea esi, [ecx + esi - 0x7c379b02]
xor edx, ebx
xor ax, cx
jno 0xad54fe
and cx, cx
bswap edx
adc eax, ecx
lea eax, [ecx + 0x253138a5]
bt ecx, 0x18
sbb edx, 0x4fb7c6a7
and eax, 0x3701df13
shr ax, cl
bswap edx
ror edx, 1
xor ebx, edx
add ebp, edx
rol al, cl
mov ecx, dword [edi + ecx - 0x7c379b06]
not eax
mov edx, eax
jb 0xcc2558
mov eax, dword [edi + 4]
push edx
call fcn.00bfbbc6

Function at 0x77ea71
Capabilities:
Manually build aes constants

Disassembly:
inc ebp
xchg bh, al
inc edx
xor dword [esp + edi - 0x2c72], esi
inc ecx
push ebx
dec ecx
inc edx
dec ecx
lea eax, [edx + eax + 0x3f03f79c]
dec edx
mov ebp, dword [esp + edx - 0x30ebffa3]
inc ebx
mov dword [ecx + edi - 0x2c7c], esi
dec edx
sub dword [esp + edi - 0x2c7a], ebx
inc ecx
inc bl
dec edx
xor ebx, dword [esp + edi - 0x2c7a]
dec edi
lea ecx, [ecx + edi*4 - 0xb1ea]
inc ecx
mov ebx, dword [edi + edi - 0x2c74]
dec edx
lea edi, [edi + edi - 0x2c70]
xor ebx, ebp
dec edx
mov dword [esp + edi*8 - 0x163c0], eax
inc bp
bt eax, eax
dec ecx
dec edi
bswap ebx
dec esi
lea esi, [edi*2 - 0x663535a]
inc ecx
pop edi
lea ebx, [eax + ebx - 0x5d1b20cc]
neg ebx
dec ebp
xchg ebx, esi
mov esi, 0x898e9a07
dec ecx
xadd edi, eax
inc edx
lea ebx, [ebx + ebx*2 - 0x3fd69356]
dec edx
add dword [esp + ebx*2 + 0xcc5f4d8], esi
dec ecx
shl eax, 0xc7
dec esi
mov dword [esp + ebx*2 + 0xcc5f4d0], edi
dec edx
mov dword [esp + ebx*4 + 0x198be9a8], ebp
inc edx
xor dword [esp + edx*2 - 0x61d7ff5e], ebx
dec edx
mov ebp, dword [esp + ebx*2 + 0xcc5f4d8]
inc edx
rol dword [esp + ebx*8 + 0x3317d340], 0x18
dec edx
mov dword [esp + ebx*2 + 0xcc5f4d8], 0xeb6c317
dec eax
cdq
dec eax
arpl bx, bx
inc ecx
push ebx
sal word [esp + edx*4 + 0x11], 0x66
dec esp
add ebp, ebx
call fcn.00aac96a