joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa8e05c
Capabilities:
Authenticate hmac

Disassembly:
xor edx, edx
push 0xdb2f3abc
test eax, eax
call fcn.0078347f

Function at 0xa8e75f
Capabilities:
Encode data using base64

Disassembly:
adc edi, 0xfffffffe
inc word [esp + 5]
call fcn.00b4b846
sub ecx, 0xab62135
movzx eax, dx
ror dx, 0xe2
rol dl, 0xe5
ror ecx, 1
inc ecx
or ax, dx
neg ecx
xor ebx, ecx
add ebp, ecx
mov ecx, dword [edi + eax*2 - 0x1ff6c]
rol edx, 0xbb
jb 0xbb251c

Function at 0xa93a0e
Capabilities:
Encode data using xor

Disassembly:
pop edx
lea edi, [edi + eax - 0x10002282]
mov edx, eax
and edx, 0x462ba734
mov word [edi + eax*2 - 0x20004500], cx
mov edx, dword [esi + eax*2 - 0x20004500]
jp 0xce8f82
cmp edi, dword [esi + 0x282ac71c]
pop dword [edx]
push 0xa7042afe
or ch, byte [eax - 2]
sub dh, byte [ebx + ecx]
inc esi
push 0xb5902afe
mov eax, 0xff7214c3
invalid

Function at 0xa97ea5
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + ecx*4 - 0x10634], ecx
xor eax, ebx
sal dl, 0x41
sub ecx, ecx
inc eax
add dl, dh
ror eax, 1
bswap eax
pop edx
neg dx
shl cl, 0x43
neg eax
add dword [esp + ecx*2], edx
sal cl, 0x81
not eax
xor edx, dword [esp + ecx]
rol dx, 0x42
shl ecx, 0xf
xor ebx, eax
push edx
shl cx, 0x41
adc edi, eax
add ecx, dword [esi + ecx]
shr dword [esp + edx - 0x74efdecb], 0xbf
neg edx
mov eax, dword [esi + 4]
shr edx, 0x24
and ecx, eax
add dword [esp + edx*2 - 0x11620423], edx
pop edx
not ecx
sal edx, 0xad
or edx, edx
xor word [esp + 2], 0x2caf
mov dword [esi + 4], ecx
sbb esi, 0xfffffffc
call fcn.00b32da1
dec edx
mov ebp, dword [esp + eax*4 - 0x2a4]
call fcn.00b5b213
inc cx
rol esp, 1
inc ecx
mov eax, esi
dec eax
cwde
inc ecx
pop edx
inc cx
sub esp, 0xe9c00e22
inc ebx
inc ebp
xadd dl, dh
inc cx
neg esp
sub eax, esi
call fcn.00b50ca1
xor edx, ebx
call fcn.00c7d735
add edi, edx
mov edx, dword [eax + ebp - 4]
xor eax, dword ss:[edx + eax*8]
lea edx, [ecx - 0x3061ab54]
not cl
neg edx
mov dword [ebp + ecx*2 - 0x19a], eax
lea ebp, [ecx + ebp - 0xcf]
push ecx
movsx eax, cl
pop eax
jnp fcn.007c6802

Function at 0xa9fed1
Capabilities:
Authenticate hmac

Disassembly:
jns 0xccb5f0
inc eax
mov dword [esp + 4], 0x672af515
bswap eax
jmp 0xa8e742
adc esi, eax
lea eax, [ecx + edx*8 + 0x719b2c2b]
pop ecx
jmp esi
jb 0xba45cc
dec word [esp + 1]
dec dword [esp]
rol eax, 2
neg cx
bt cx, dx
pop ecx
bswap eax
push ecx
dec byte [esp]
xor ebx, eax
shr dx, 0x65
jae 0xc789c4
Function at 0xaaf4fc
Capabilities:
Authenticate hmac

Disassembly:
dec ecx
sub esi, 0x5c982603
xor bp, dx
div al
dec ecx
sar esi, 0x4f
inc bx
mov dword [ecx + edx*2 - 0x13da4], edx
inc ecx
xor esi, esp
dec edi
lea ecx, [edx + ecx - 0x9ed5]
dec ecx
neg edx
neg ax
inc ecx
pop edx
inc ecx
pop edx
pop edx
jno fcn.0079a4c9
mov edx, 0x7ba2573e
push edx
mov eax, dword [ebp + edx - 0x7ba2573e]
movzx ecx, dl
sub ecx, 0xe293332
and edx, 0xa4985b95
lea ebp, [ebp + edx*2 - 0x4100a624]
xor eax, ebx
neg dword [esp + edx - 0x20805314]
bswap eax
sub ecx, edx
jnp 0xaea891
dec eax
lea esp, [esp + 0xa8]
retf
and dl, byte [esp + edx - 0x2080ace9]
neg eax
sar dword [esp + edx*2 - 0x41015908], 0x83
rol eax, 1
xchg ch, cl
xor ebx, eax
xchg byte [esp + edx - 0x2080ac84], ch
sub byte [esp + edx - 0x2080ac82], ch
dec dx
adc esi, eax
sal dx, 0xcc
or cx, word [esp + edx*2 - 0x41005fff]
ror edx, cl
mov edi, dword [edx + edi - 0x4018001]
sub byte [esp + edx*4 - 0x10060001], 0x36
lea ecx, [ecx*4 - 0xe76d760]
pop eax
jnp fcn.00bb937c
and dl, byte [ebx - 0x1f85468]
xchg esi, eax
inc ebx
sub bl, bl
out dx, al
xchg esi, eax
inc ebx
xor al, 0xa2
mov edx, 0x76436596
sti
adc al, byte [ebp - 0x6a5c2dbc]
pop ecx
mov cl, 5
cmp byte [edi + edx], bh
loope 0xad6313
adc ecx, dword [ecx + 0xe11728]
xchg esi, eax
cmp eax, 0x1a9ce00
sbb al, 3
sbb eax, ecx
shl edx, 0x61
neg dx
dec eax
jmp 0xad6298

Function at 0xaaff74
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], ecx
movzx eax, byte [esp]
mov ax, dx
not dword [esp]
inc cx
movzx ax, al
bswap ecx
mov edx, 0x3f3ae389
mov dl, byte [edi + edx - 0x3f3ae38b]
dec ecx
and al, dl
not al
mov word [edi + ecx - 0x4de011ef], ax
lea edi, [edi + ecx - 0x4de011ef]
inc word [esp + ecx - 0x4de011eb]
pop eax
jg fcn.007b8565
xor ebx, eax
add edi, eax
neg edx
and cl, ch
js 0xbb4f8d
mov dword [esp + ecx*2 - 0x4000000], edi
ret 8

Function at 0xab5fa6
Capabilities:
Authenticate hmac

Disassembly:
sar word [esp + 6], 0xa4
jb 0xaf8d92
xor ecx, edi
call fcn.00c0377e

Function at 0xab815f
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
mov eax, edx
inc ecx
xor ch, ah
not bl
dec esi
lea esp, [esp + 8]
inc ebx
mov dword [esp + edi - 0x5713], edx
inc ecx
div bh
dec esi
mov ebx, dword [edi + edi - 0x5712]
dec esi
mov dword [esp + edx*2 - 0x26], eax
dec esp
xor ebx, ebp
inc ebp
movsx esp, dx
inc ecx
pop eax
neg al
dec ecx
ror ebx, 1
inc esp
or bh, cl
dec ecx
dec ebx
inc ecx
and ah, 0x8f
dec ecx
not ebx
dec eax
bswap ebx
dec ecx
ror ebx, 7
inc cx
sal esp, 0x23
inc eax
movzx edx, dh
dec ecx
bts eax, 0x35
dec ecx
xor ebp, ebx
dec eax
bswap ecx
inc ecx
btc edi, 0x18
dec edi
mov dword [ecx + edi*2 - 0x200ae2a], ebx
jae 0xbb5032
jmp 0xc8beb4
mov dword [edx], ecx
mov eax, dword [ebp]
mov ecx, 0x969c90
shl ecx, cl
movsx edx, cl
lea ebp, [edx + ebp + 4]
js 0xafb910
Function at 0xad3042
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.00ae0df9
push 0x17a62402
inc dword [esp]
mov edx, 0xec8ff380
mov edx, dword [edi]
rol byte [esp + 2], 0x44
and dword [esp], 0x4921a21a
mov eax, dword [edi + 4]
mov ecx, dword [esp]
neg dword [esp + ecx*4 - 0x4808008]
jne 0x7e056b

Function at 0xad3379
Capabilities:
Encode data using base64

Disassembly:
dec ebp
lea eax, [eax + ebx*8 + 0x17a166a0]
dec eax
lea edi, [edi + ebx - 0x105a6f1c]
pop ecx
inc ebp
mov edx, eax
inc ebp
movzx ebx, dx
inc eax
xor dl, ch
dec ecx
sal esi, cl
bts ecx, 4
not dl
ror dl, 1
inc esp
xadd byte [esp + ebx*2 - 0x20b4de42], al
dec ecx
inc edx
xor dl, 0x22
inc ebx
rol byte [esp + ebx*4 - 0x4169bc82], 0x41
adc dl, 0x36
inc cx
rol edi, 0x2c
movsx esi, cl
inc edx
movzx eax, word [esp + ebx*8 - 0x6fec7]
not dl
adc dl, 0x1b
dec eax
sal dword [esp + ebx*2 - 0x20b4de44], 0x2f
inc cx
neg ebx
not dl
dec eax
cmovbe ebx, dword [esp + ebx*4 - 0x4169bc88]
dec esp
or esp, dword [esp + ecx*2 - 0x215db92e]
inc eax
xor ch, dl
dec eax
lea edx, [esp + edx + 8]
mov dword [esp + ecx*2 - 0x215db92b], 0x76142da5
inc ecx
pop edx
dec eax
mov esi, dword [ecx + edx - 0x10aedc97]
dec eax
bts ebx, 0x8b
dec ecx
ror esi, cl
cwde
dec ecx
mov dword [ecx + ecx*2 - 0x215db936], esi
push ebx
jb 0xb94a45
shr ebp, 0x9b
dec eax
mov ebp, dword [esp + ebx*2 - 0x1870]
inc esp
or bl, byte [esp + ebx*2 - 0x1876]
dec ebp
xchg ebx, esp
dec eax
lea ecx, [ebx + 0x521ee692]
dec eax
arpl si, si
inc ecx
pop esi
dec esp
mov dword [esp + ebx - 0xc38], esp
dec esp
adc ebp, esi
inc cx
neg edx
inc ecx
sbb edi, 0xea1c991c
dec esp
lea ebx, [esp + ebx - 0xc08]
inc ecx
sub ebx, edi
dec edi
mov edx, dword [ebx + eax*2 - 0x62]
inc ebp
sbb edi, eax
sar word [esp + ebx - 0x105a6f13], 0xad
dec edi
mov dword [ecx + eax - 0x31], edx
inc esp
mov esi, dword [esp + ebx - 0x105a6f21]
inc ecx
movzx edx, byte [eax + edi - 0x2d]
jae 0x7c59a2
dec esp
mov dword [esp + ecx*2 - 0x215db92e], ebx
dec esi
lea ecx, [ecx + ecx - 0x10aedc9f]
inc ecx
pop esp
jb fcn.0079a4c9
mov ecx, dword [edi]
inc ecx
mov edi, 0x7b0e4b8b
xor ecx, ebp
mov eax, 0xa8b7a481
inc ecx
movzx ebx, bh
inc ecx
inc ecx
sar bh, 1
xor ecx, 0x8c985d05
jmp 0xcc9da9

Function at 0xad3828
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [ebp + eax - 0x60ac69a0]
pop eax
xor edx, ebx
rol edx, 3
bswap ecx
neg ecx
add ecx, 0x830febb3
xor edx, 0x5b129918
add eax, eax
dec edx
ror edx, 1
sal eax, 0x96
sbb cx, ax
sub ax, 0x8ea1
neg edx
and ecx, eax
btc ax, cx
bswap edx
cwde
call fcn.00b1b1a9
xor al, 0x2d
call fcn.00c98efb
sbb dx, 0xb929
inc cx
xadd eax, ecx
xor bx, dx
mov dword [esp + eax - 0x60ac69a6], ecx
mov word [edi + eax - 0x60ac69a8], dx
rol cl, 0x26
jb 0x76c793
Function at 0xae073d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movzx ecx, byte [ebp + ecx*2 - 0x7d437002]
shl eax, 0x59
not dword [esp + eax + 8]
lea ebp, [ebp + eax*2 + 5]
xchg dword [esp + eax + 8], eax
dec dword [esp + eax - 0xffe08]
xor cl, bl
sub cl, 3
rol eax, 0xb4
ror cl, 1
shr eax, 0xfb
sub eax, dword [esp + eax*8 - 0xdc]
dec eax
sbb cl, 6
shr eax, 0x79
pop eax
ror cl, 1
xor bl, cl
not byte [esp + 1]
lea ecx, [esp + ecx + 8]
inc byte [esp + 4]
dec dword [esp + 2]
not eax
mov byte [ecx + eax*2 - 0x10ffe], dl
and word [esp + eax*8 - 0x43ff7], ax
mov dword [esp + eax*2 - 0x10ffe], edi
ret 4
xor ebx, ecx
bt ax, 0x13
mov dword [esp + edx], eax
add edi, ecx
ror dword [esp + edx*4 + 3], 0xdc
sal edx, 0x41
xor dx, word [edx + esi + 2]
shl ax, 0x2a
lea ecx, [eax*4 + 0x3ea3d803]
je 0xbc134d
lea esi, [esi + ecx*2 - 0x7d437002]
push eax
imul eax, ecx
jo 0x7eb5cf
adc ebp, 6
call fcn.00adcdd8

Function at 0xae0df9
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x1c]
jne 0xb6245a
mov ecx, 0x7937a9ac
call fcn.007af289

Function at 0xae2a6b
Capabilities:
Authenticate hmac

Disassembly:
movsx eax, byte [esp + ecx*2 - 0x716]
mov dword [esp + ecx - 0x38f], edi
ret 8
lea edx, [esp + edx + 8]
mov dword [esp + ecx - 0x38f], 0x298c4196
xor eax, dword [esp + eax*2 - 0x4f1e305a]
ror al, 0xc5
mov eax, dword [ecx + edx - 0x38f]
movzx edx, cl
push ecx
mov dword [ecx + esi - 0x38f], eax
ja 0x717ad9

Function at 0xae9415
Capabilities:
Encode data using xor

Disassembly:
movzx dx, byte [eax + ecx*2 - 0x740a357a]
mov word [ecx + edi - 0x3a051ac1], dx
rol ecx, cl
movzx ecx, byte [ebp + 2]
add word [esp + 4], 0x6938
mov eax, 0xc83f8a9b
xor cl, bl
dec eax
push eax
mov edx, dword [esp]
xor cl, 0x87
xor word [esp + 1], 0x1b99
cdq
pop eax
neg cl
btc edx, 0xbd
cwde
xor cl, 0x84
neg cl
cwde
xor cl, dl
call fcn.00ab242b
aas
push eax
pop edi
jge 0xae9418
xchg esp, eax
dec eax
xchg dl, cl
cmc
mov esp, dword [esi - 0x77]
xchg esp, eax
cmp dword [edi], edi
in eax, 0xfa
invalid
mov edx, 0x46d9f4c3
mov edx, esp
adc ebp, ecx
fdivr dword [ecx]
jg 0xae94e7
add al, 0x20
invalid
Function at 0xaea52a
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + edx - 0x41e24], edx
push edx
xor ebx, eax
call fcn.00c53b44
lea ecx, [esp + ecx + 4]
add ax, ax
mov dword [ecx], edx
mov edx, eax
jle 0xab5b2a
movzx eax, word [ebp - 3]
mov dword [esp], edx
xor ax, bx
rol edx, 0x5d
lea ecx, [edx + edx*2 - 0x3535673]
sar word [esp + ecx - 0x10890461], cl
adc ax, 0xe0a8
xor cl, 0x83
neg edx
neg ax
mov dword [esp + ecx*4 - 0x42241384], ecx
sub dx, dx
adc ax, 0x218e
sub dx, 0xa63f
and edx, edx
neg ax
xor ax, 0x4f9c
and word [esp + ecx - 0x108904e0], 0x1eb9
inc ecx
neg dword [esp + ecx - 0x108904e2]
dec ax
call fcn.00b1c752
shr edx, 0x36
not cx
sbb cx, 0x1baa
inc edx
not dx
xor bx, cx
pop eax
and eax, edx
mov word [edi + edx - 0xffff], cx
movzx ecx, dl
mov cl, byte [esi + edx - 0x10004]
lea esi, [esi + edx - 0x10004]
sar dl, 0x47
jb 0xb91c63
lea esp, [ecx + 0x5f]
jge 0xaea5e0
sbb bh, ch
and al, 0x8c
pop ds
fadd qword [eax]
out dx, eax
and al, 0x8c
outsd dx, dword [esi]
mov eax, 0x8c24ef58
daa
int3
xor cl, bl
and al, 0x36
sbb al, ah
neg cl
and eax, 0x94199718
xor cl, 0x3b
rol cl, 1
and edx, edx
adc cl, dl
dec dl
inc dl
xor bl, cl
btr ax, ax
adc ecx, esp
mov eax, dword [ecx + edx - 0xffff]
call fcn.00752a68

Function at 0xaeb099
Capabilities:
Authenticate hmac

Disassembly:
jb 0xc45c39
sbb edi, 4
sal eax, 0x98
mov dword [edi], ecx
call fcn.00c9d861
jmp fcn.00c4ce27
pop ecx
movzx edx, byte [esi - 1]
xor dl, bl
mov eax, 0xb837bb1b
movsx ecx, al
not dl
ror dl, 1
sub dl, 0xa6
sub ecx, 0x829ecc17
neg dl
sub cl, cl
not ax
bts ax, 7
xor bl, dl
or eax, 0x8327308d
jae 0xcb13b6
syscall
call fcn.0076bc0a
adc edx, esp
dec eax
btr ecx, ecx
sar ax, 0x8e
mov eax, dword [edx + ecx - 0x7d613400]
adc cx, cx
jb 0xcc78df
mov dword [edi + ecx - 0x7d616805], eax
mov eax, dword [esi + ecx - 0x7d616806]
lea edx, [ecx + ecx*8 - 0x3f621470]
xor eax, ebx
jmp 0xac4941
rol dl, 1
add ax, 0x7212
or eax, ecx
dec dl
or cx, 0xa1a6
bswap ecx
sbb eax, 0x2b18ff2f
xor bl, dl
sar ecx, 0xd4
adc edx, esp
sal eax, cl
bt ax, ax
lea eax, [ecx + eax + 0x10a0a22f]
mov ecx, dword [edx]
jae 0x7b410e
Function at 0xaf81bf
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, 0xdfbcdb0e
inc esp
mov esp, dword [edi]
movzx edx, bl
dec eax
lea edi, [edi + edx - 0xa]
inc esp
xor esp, ebp
mov eax, 0x22bc202a
dec eax
mov dword [esp + edx - 0xe], edx
inc ecx
bswap esp
imul ebx, dword [esp + edx - 0xc]
inc ecx
rol esp, 1
movzx ecx, byte [esp + ebx + 2]
inc ecx
inc esp
dec eax
bts eax, edx
dec eax
mov dword [esp + ebx + 8], eax
inc ecx
rol esp, 1
div dword [esp + ebx + 8]
inc ecx
xor esp, 0xfc823a26
inc esp
movsx edx, bx
mul word [esp + ebx*2 + 4]
inc ecx
mov eax, 0xbe035e93
inc ecx
ror esp, 2
inc ebp
movzx ebx, ax
cwde
dec edx
lea esi, [edx*4 - 0x7eeb5ed]
inc edi
lea esp, [esp + eax + 0x1b9c440d]
dec ecx
dec edx
inc ecx
xadd bl, dh
dec eax
mov dword [esp + ebx*4 + 8], ebp
sal byte [esp + ebx + 7], 0x45
inc esp
xor dword [esp + ebx + 8], esp
sar si, 0x2c
inc ecx
inc ebx
pop edx
pop ebp
jbe 0xb7b021
movzx eax, byte [edi]
mov esi, 0x97898986
inc esp
movsx esp, si
inc eax
xor al, ch
inc ecx
xor esi, esp
dec al
not al
inc ebp
movsx edx, ah
rol si, 0x62
inc ebp
movzx ebx, ah
inc al
inc ecx
shl ah, 0x83
not al
inc eax
xor ch, al
inc ecx
imul esi, ebx
dec eax
add eax, esp
inc cx
or edx, 0x8d4ed6a9
xor al, 0xd5
cmp al, 0x9b
or al, 0x5f
dec esi
mov eax, dword [eax + ebx*2 - 0x10c]
inc ecx
inc edx
inc ecx
movsx ecx, dx
dec edi
mov dword [ecx + ebx - 0x8e], eax
push ecx
dec edi
lea esi, [ebx + ecx - 0x8e]
inc ecx
movzx edx, bl
jl 0xbfc78a
mov edx, 0x60d013f
lea ebp, [edx + ebp - 0x60d0140]
mov ecx, edx
jmp 0xbe8a11
dec esp
xadd edx, eax
dec ebp
arpl sp, sp
inc ebp
mov esi, edx
inc cx
shl ebx, 0x42
inc ecx
bts esi, 0x3b
dec ebp
add ebp, esp
inc ebp
movzx esp, bl
inc esp
btr edx, esp
dec esp
lea edi, [esi*4 + 0x218ca5b3]
inc si
mov esi, dword [ebx + ecx]
inc ecx
add cl, byte [ecx + ebx + 2]
dec ebp
lea ecx, [ecx + ebx + 2]
inc cx
shr esi, cl
jmp 0xce7765
movzx eax, dl
movzx edx, byte [edx + ebp - 0x60d013f]
xor dl, bl
and ax, ax
sbb dl, 8
rol dl, 1
ror ecx, 0xd5
setb cl
cwde
adc dl, 0xf
sub al, 0xbb
rol ecx, 0x1a
ror dl, 1
sal eax, 0xc5
ror ecx, 0x28
xor bl, dl
btc eax, eax
push ecx
lea edx, [esp + edx + 4]
sub dword [esp + eax - 0x1081], ecx
and cx, ax
add cl, ah
mov ax, word [edx + eax*4 - 0x4204]
mov edx, dword [esp]
or cl, 0xa4
add cl, ch
lea esi, [edx + esi - 2]
mov word [esi + edx*2], ax
lea ebp, [edx + ebp - 4]
mov ecx, dword [ebp + edx]
push edx
add edx, dword [esp + edx*2 + 4]

Function at 0xafa32b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x5b0e6b82
sal byte [esp + 3], 0x62
dec ebx
lea esp, [esp + 4]
jne 0xc172f8
Function at 0xafc9f0
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
movsx eax, dx
movzx edx, byte [ebp + edx - 0x613ee59e]
btc eax, eax
and eax, 0x189d4804
xor eax, 0xad3edb8f
xor dl, bl
ror eax, 0x9c
adc dl, 0x91
btc eax, eax
bswap eax
neg dl
dec al
rol eax, 0x2f
adc dl, 0x94
push eax
xchg byte [esp + eax*4 - 0x72a3776e], al
ror byte [esp + eax*2 - 0x3951bb4f], 0x26
ror dl, 1
add dl, 0xac
jmp 0xaa959d
xor bl, dl
neg ax
dec al
shr dword [esp + eax*2 - 0x395044ae], 0x8d
mov dword [esp + eax - 0x1ca82257], ebp
add al, al
movzx ebp, ax
lea eax, [ebp + ebp*4 - 0x54d59757]
push edi
push ebx
and ebp, 0x3a818409
jl fcn.0078c320
mov ebp, esi
mov ebx, eax
mov ebx, edx
inc eax
mov edx, ebx
sal edx, 2
sar ax, 0xa4
mov eax, ebp
push 0x8dba3837
push 0xa29d46b7
adc eax, edx
xor byte [esp + 4], 0x3a
mov dword [ebp - 4], eax
sar dword [esp + 4], 0xd8
test ebx, ebx
jmp 0xc1ba92
mov dword [edi], eax
mov dword [esp], 0xf51f382e
neg dword [esp + 0xc]
pop eax
pop edx
pop edx
pop edx
jle fcn.00c02781
mov edx, 0xac27dcb3
rol edx, 0x23
inc dx
lea ebp, [ebp + edx - 0x613ee59f]
or dx, dx
jno 0x77ff99
push 0xbf141b8f
call fcn.007bfc77
lea ecx, [esp + 4]
mov eax, 0xcab7aba3
neg ax
mov edx, dword [ecx]
adc eax, eax
movzx ecx, al
mov dword [edi + ecx*2 - 0x17a], edx
movzx edx, cl
dec cl
add al, 0x28
mov ecx, dword [esi + ecx - 0xbe]
ror ax, 0x27
bswap eax
xor ecx, ebx
sar edx, 0x57
not eax
dec ecx
not dx
btr edx, eax
rol ax, 0x4d
xor ecx, 0xd51652aa
not ecx
cwde
add eax, 0x2e235d2d
xor dx, dx
dec ecx
bt eax, eax
neg ecx
xor ebx, ecx
inc dx
or ax, dx
adc ebp, ecx
inc edx
movzx eax, word [eax + esi - 0x2e23af61]
movsx ecx, dl
sal dx, 0x64
inc cl
lea esi, [esi + edx*8 - 0x106]
jnp 0xbfc07a
xor ax, bx
sub cl, cl
add cx, cx
sbb dx, cx
not ax
adc ax, 0xa33c
ror cx, 2
neg ax
lea edx, [ecx + ecx*4 - 0x1c75b280]
ror ax, 1
add ax, 0xe9a9
sal dx, 6
ja 0x7b6c72
xor bx, ax
mov word [edi + ecx - 6], ax
lea ecx, [ecx - 0x18c53271]
movzx eax, cl
lea ecx, [esp + eax*8 - 0x470]
and eax, edx
mov edx, dword [ecx + eax*2]
dec ax
movzx ecx, al
mov dword [edi + eax - 0x10009], edx
lea edi, [edi + eax*2 - 0x20008]
call fcn.00cfcb0d
lea esp, [esp + 8]
je 0xbfa894
mov eax, dword [ebp + ebx*4]
call fcn.0071727d
mov eax, 0xc0f46af
ror al, 0x85
mov ecx, eax
mov edx, dword [ebp + ecx - 0xc0f467d]
dec eax
div al
dec ecx
lea ebp, [eax + ebp - 0xc0f408d]
and cl, ah
add cx, ax
sub cl, cl
xor edx, ebx
lea edx, [edx + eax*2 - 0x2aa709b5]
call fcn.00cc1ac7
jmp 0xb38fd7
not word [esp + 1]
jmp 0xbbac93
Function at 0xb2bc97
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
call fcn.00aecb14
mov dword [esp], 0x8e012a29
jmp 0xb3b252
inc edx
xor eax, 0x768303b2
dec byte [esp + 9]
mov dword [esp + 0x10], 0xcc06171b
inc byte [esp + 0xa]
dec ecx
lea esp, [esp + 0x14]
jne 0xb6cc67
mov ecx, 0x680b5f8f
call fcn.0079c327
ret 0x53ff
mov ebx, 0x4089492c
imul bx, bx
movzx ebx, byte [edx + ebx - 0x40891f90]
jb 0xb1cb71
and byte [eax], cl
inc edi
jge 0xb6cc64
cmp eax, 0xea8c3c86
jns 0xb6ccdf
xchg byte [esp + ecx*4], bh
mov ah, byte [ecx]
inc ebp
xchg byte [esp + ecx*4], bh
mov byte [0xec9b0d39], al
fst dword [ecx]
insb byte es:[edi], dx
adc ecx, dword [ebx - 0xf]
fdivr st(2)
daa
adc edi, dword [eax - 0x3d]
jae 0xb6ccd3
mov dword [0x73c378ab], eax
fdivr qword [ebx]
mov ebp, dword [edx]
aad 0x4e
fbld tbyte [eax + 0x6dcf79c4]
mov edi, 0xb58dd939
mov esp, 0x205adbc5
or eax, 0xec71426d
dec ebp
cmp dword [edx + 0x5859e6c2], edx
stc
lcall 0xfd98, 0x49c31f13
dec ecx
cwde
std
invalid

Function at 0xb332a9
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
pop ecx
mov eax, dword ss:[edx]
mov ecx, 0x7f0b94a9
movsx edx, cl
mov dword [ecx + esi - 0x7f0b94a9], eax
sal dx, cl
jns 0xb7f092
mov ecx, 0xc53051bd
mov ecx, dword [edi + 4]
mov edx, 0xfa2aa48f
sbb edi, 0xfffffff8
push edx
lea eax, [esp + 8]
sal dx, 0x86
mov dword [eax], ecx
call fcn.00af1ef2
lea ebp, [ebp + ecx - 0x7f0b94ad]
mov edx, dword [ebp + ecx - 0x7f0b94a9]
xor ecx, ecx
call fcn.00bc01e7

Function at 0xb332e7
Capabilities:
Parse pe header

Disassembly:
not edx
call fcn.00c63f79
sub ebp, 4
mov eax, 0xe71e041c
movzx ecx, ax
bt ax, 0xa1
mov ecx, dword [ebp + ecx*2 - 0x838]
lea edx, [eax - 0x125a0246]
dec eax
jae 0xb5275e
movzx ecx, dx
mov dword [edx + ebp - 0x58befffc], eax
movsx eax, cl
or eax, dword [esi + ecx*2 - 4]
push edx
push ecx
or dword [esp + edx - 0x58befffc], edx
xor eax, ebx
push edx
call fcn.0076465b
sysenter
push edi
pushfd
mov edi, 0x9928cfa4
mov edi, dword [esp + edi + 0x66d73060]
mov dword [esp + 4], 0x3e84c52d
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00ca25fd
mov edx, dword [edi + eax - 0x8189]
rol al, 0x25
mov dword [esp + eax - 0x81b1], eax
lea edi, [eax + edi - 0x81ad]
dec eax
not ecx
shl al, 0x27
jnp 0x77d965
jae 0xb127e3

Function at 0xb4cbf0
Capabilities:
Encode data using xor

Disassembly:
adc esi, 1
call fcn.007cb5cf
lea edi, [edi + eax*4 - 0x13d33f50]
jnp 0x7d1282
inc ecx
mov ebx, 0xcc2c3b02
dec esi
lea edx, [ebx*2 - 0x355fe71]
inc esp
movzx esp, byte [edi]
inc ebp
movsx esi, dx
inc ecx
mov eax, edx
inc ecx
push edx
inc esp
xor ah, ch
dec eax
cdq
inc ecx
neg ah
dec edx
div dword [esp + esi - 0x7793]
inc ecx
sub ah, 0x2a
dec esp
lea ebp, [eax*8 + 0x6d162e8b]
inc ecx
xor ah, 0x2d
bts ax, 0x98
inc edx
ror dword [esp + esi*4 - 0x1de4b], 0x6d
dec eax
shl dword [esp + eax - 0x100], 0x5c
inc ecx
adc ah, 0x3b
dec eax
cwde
inc esi
sub dword [esp + esi - 0x7793], esi
inc ecx
xor ch, ah
inc ecx
push ebx
inc edx
add byte [esp + esi - 0x7784], dl
movzx ecx, al
dec esi
lea esp, [esp + 0x10]
call fcn.00bd2146
mov eax, 0x773440ad
call fcn.00ae009e
Function at 0xb4d187
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [ebp]
mov edx, 0x51197e8d
add byte [edx + 0x51197e8d], bh
push edx
movsx ecx, word [esp + edx - 0x51197e8d]
mov cl, byte [ebp + ecx*2 - 0xfd16]
lea ebp, [edx + ebp - 0x51197e87]
mov dword [esp + edx - 0x51197e89], edx
inc edx
imul edx, dword [esp + edx - 0x51197e8c]
mov byte ss:[eax], cl
sbb esi, 3
movsx ecx, word [esp + 3]
mov ecx, dword [esi]
shl dx, 0x83
push edx
sub dx, 0xec35
xor ecx, ebx
call fcn.0079cbd1
test byte [0xe1797d45], dl
xchg edx, eax
jecxz 0xb4d18a
adc ebx, esp
pop edi
xor esp, dword [eax - 0x3c48ff44]
das
sal dword gs:[ebx], 0xbf
out 0x6c, eax
sbb al, 0x58
mov ch, 0xba
mov byte [0xff435eb5], al
cmp dword [ebp - 0x3f], esp
wait
mov word ds:[esi - 0x53], cs
adc dword [esi + 0x3015d9ee], eax
fild word [eax + eax - 6]
push ss
leave
pop ebp
pushfd
pop ds
jmp dword [edx - 0x6ef311c6]

Function at 0xb50b27
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + ecx*2 - 0xb8000], ecx
mov word [edi + ecx - 0x5c000], ax
jns 0xcf16cb