joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe6a2dc
Capabilities:
Encode data using base64

Disassembly:
jmp 0xf7a82b
lea esp, [esp + 0xc]
jne 0x14cb717

Function at 0xe744a3
Capabilities:
Manually build aes constants

Disassembly:
inc ebp
lea ecx, [ecx + ecx + 0x1b55c71d]
inc ecx
rol ecx, 1
dec eax
cdq
dec eax
mov dword [esp + eax - 0x15b1a5a9], edx
inc esp
mov ebp, eax
inc esi
lea ecx, [ecx + ecx - 0x17a871db]
cbw
inc ecx
bswap ecx
or al, al
mul dword [esp + eax - 0x15b1ffa6]
dec eax
adc dword [esp + ecx - 0x69bae193], edi
dec eax
sub eax, 0x6c34c431
jle 0x149835a
inc ecx
mov ecx, 0x97a6f60a
dec edi
lea edi, [ecx + ecx*2 - 0x344bc666]
dec ecx
mov ebp, dword [eax]
inc cx
shl ecx, 4
inc ecx
movzx esi, bh
inc ebp
mov esp, dword [eax + esi - 0xb0]
inc ebp
movzx ebp, cl
dec esi
lea eax, [esi + eax - 0xac]
dec esi
lea edx, [ebp*8 + 0xe2b00ae]
dec edi
lea esi, [edx + edi + 0x4895f1a2]
inc ecx
sar ecx, 0x73
inc esp
mov dword [ebp + esi*2 - 0x170], esp
js 0xeea078
clc
or eax, 0x477dffaf
and eax, 0x7436ce7
sahf
xchg edi, eax
ror dword [ebx], cl
mov byte [0x31d7b214], al
out 0x79, al
outsb dx, byte fs:[esi]
ljmp 0x4866
inc ecx
movzx eax, cl
inc ecx
xadd ecx, eax
inc ecx
mov eax, dword [ebx + esi*2 - 0x170]
dec ebp
lea ebx, [ebx + esi*2 - 0x16c]
jne 0x148e5b0
btc dx, dx
rol al, 1
not dl
lea edx, [edx + edx*4 + 0x2c37a629]
movzx ecx, word [esp]
not al
xadd edx, ecx
push edx
ror dx, 0x2b
dec al
not ecx
ror al, 1
inc dword [esp + ecx - 0x606770a5]
inc al
sub byte [esp + ecx - 0x606770a7], dh
or ecx, 0x631a9c36
xor edx, edx
not al
sbb dword [esp + edx*2 + 4], ecx
call fcn.00f6b877
mov edx, dword [ebp]
mov eax, 0x45300c1c
lea ebp, [ebp + eax - 0x45300c18]
lea eax, [eax + eax*4 - 0x56dbfcf2]
bts eax, eax
xor edx, ebx
movzx ecx, ax
sub al, 0x21
lea edx, [edx + eax - 0x642217f9]
neg edx
sal ecx, cl
ror edx, 1
dec ax
lea edx, [ecx + edx + 0x42ad54ba]
lea eax, [eax - 0x19c02476]
and ecx, ecx
bswap ecx
rol edx, 3
cbw
sal eax, 4
bt ecx, 0xad
xor ebx, edx
imul cx, cx
jae 0xebaad8

Function at 0xe79656
Capabilities:
Execute syscall

Disassembly:
inc eax
neg cx
neg eax
dec edx
not edx
xor ebx, eax
xadd edx, ecx
shl edx, 0xbb
sal dl, 0x21
mov dword [esi + edx - 0x58000008], eax
sar cx, cl
inc edx
lea esi, [edx + esi - 0x58000009]
mov eax, 0x86098a19
bt dx, cx
pop ecx
pop eax
pop eax
pop ecx
pop ecx
pop eax
pop edx
jae fcn.014ccc6f
sysenter
push edx
mov dword [esp], 0x8ae4583c
call fcn.00eb1263
mov edx, 0x22a5e290
call fcn.014c1684
dec eax
lea eax, [ebp*2 + 0x6b8e5289]
mov edx, ebp
dec ecx
add eax, 6
inc ebp
shrd ecx, ebp, cl
inc ebp
mov dword [eax], ecx
cbw
inc ecx
mov ebp, dword [ebx]
movsx esi, ax
dec ecx
add ebx, 4
xor ebp, edi
inc esp
mov esi, eax
inc ebp
movsx ebp, dh
dec ecx
dec ebp
neg ebp
inc ebp
call fcn.00f949ad
Function at 0xe7b0f7
Capabilities:
Manually build aes constants

Disassembly:
neg edx
sub edx, 0xbf064c22
bswap edx
movsx ecx, ax
xadd al, ah
call fcn.00ea2871
sub esi, 4
mov edx, dword [esi]
push 0x9a99163b
xor edx, ebx
push 0xc09ce991
call fcn.00e7278f
neg ecx
bswap edx
push ecx
jnp 0xe7bfc2
inc ecx
mov ebp, 0xf0377d19
inc ebp
mov ecx, dword [ebx]
dec ecx
add ebx, 4
inc esp
xor ecx, edi
jmp 0x14ac033
rol edx, 3
sar ecx, cl
cbw
xor edx, 0x61398a8b
bt eax, ecx
ror edx, 1
rol byte [esp + ecx*2], cl
sbb dword [esp + ecx + 0xe], 0xe63bc905
sal dword [esp + ecx + 9], 0xcf
inc edx
pop eax
sar word [esp + eax - 0x5877c712], cl
or byte [esp + eax - 0x5877c70d], ch
bswap edx
and cl, 0x16
call fcn.014a0b85
inc bp
mov dword [eax + edx*4 + 0x34bdd106], ebp
inc ebp
movzx ebp, sp
ror si, 0xe9
dec ebp
lea eax, [eax + edx*2 + 0x1a5ee87e]
inc ecx
pop esi
inc ecx
pop ecx
inc ecx
pop esi
inc ecx
pop edx
jb fcn.00fa7e93
dec edi
lea ebx, [esi + ebx - 0x72999b13]
inc esp
xor ebp, edi
movsx esi, ax
inc ecx
not ebp
inc ecx
sub ebp, 0xa2996e12
jmp 0xf8d0e7
dec esp
lea ecx, [eax + edx*2 + 0x75ac5932]
call fcn.00f8b9af
inc ecx
bswap ecx
inc ecx
movsx edx, ch
inc ecx
rol ecx, 1
inc ecx
xor ecx, 0x727c99f
inc ecx
inc ecx
inc esp
movsx esp, dl
inc ebp
mov edx, esp
push edi
dec ecx
xor edx, 0xdc34c493
inc esp
xor dword [esp + edx - 0x19], ecx
movzx esi, dx
pop edi
dec ecx
inc edx
inc ecx
movsx ecx, ch
dec esi
lea esi, [0x188dd12b]
dec ebp
arpl cx, cx
je 0xfb60bb
dec ecx
shl esi, cl
jns 0xf99549

Function at 0xe86107
Capabilities:
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
xor ecx, 0x21303835
xor ebx, ecx
and eax, eax
btc edx, eax
adc edi, ecx
btc eax, eax
push edx
mov ecx, dword [esi + eax*4 - 0x46347cac]
and edx, eax
mov edx, dword ss:[ecx + eax - 0x118d1f2b]
movsx ecx, al
neg eax
sal eax, 0xd9
mov dword [esi + ecx - 0x2b], edx
js 0x14a0b01
or cl, dl
rol eax, 0x35
mov word [edi + eax*4 - 0x1fffe], cx
mov ecx, 0xc8bf4085
mov ecx, dword [esi + eax*8 - 0x40004]
xor ecx, ebx
call fcn.00eab506
bt dx, dx
xor eax, ebx
bswap ecx
jmp 0xedca2c
inc edx
mov dword [ecx + edx*8 - 0x1a8], eax
mov eax, dword [edx + esi - 0x39]
lea esi, [esi + edx*4 - 0xd8]
mov dword [esp + edx*8 - 0x1a8], edx
xor eax, ebx
xor eax, 0xb10af591
pop ecx
not cl
lea eax, [eax + edx*4 + 0x442b454b]
call fcn.014e4f4e
mov eax, 0x118d8fbe
cdq
jmp 0x14a420d
mov ecx, dword [ebp + eax - 0x118d8fbe]
xchg dx, ax
sub dl, al
lea ebp, [ebp + edx - 0x8fba]
inc al
or eax, eax
bts ax, dx
xor ecx, ebx
btc ax, dx
xor ecx, 0x9ebd10b8
not ecx
btc eax, 0x2d
div dl
inc al
inc ecx
neg ecx
not edx
lea ecx, [eax + ecx - 0x513ebedb]
dec al
jg 0xe6a7a6
Function at 0xe915fb
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Manually build aes constants

Disassembly:
not dword [esp + edx*4 - 0x364800e2]
inc ecx
adc cl, 0x80
xor dword [esp + edx - 0xd920029], esi
dec eax
mov edi, dword [esp + edx*2 - 0x1b240062]
dec eax
cwde
not dx
dec eax
arpl si, si
dec eax
add ebx, esi
inc ecx
and cl, ch
dec eax
shl edx, cl
dec eax
mov dword [esp + ecx*2 - 0x6b346e60], eax
dec ebx
lea ecx, [ebp + eax - 0xd920031]
jbe 0x14b7557
xor esi, edi
inc eax
xor ch, 0xd
push eax
lea esi, [esi + ecx*4 - 0x4dcb8736]
inc eax
not ch
dec eax
mov dword [esp + edx*8 - 0x6c9001c0], 0xb6ba6eb1
sal al, 0x24
neg esi
lea esi, [edx + esi - 0x32c361d3]
inc esp
xchg dword [esp + edx*2 - 0x1b24005f], esp
ror esi, 1
rol byte [esp + edx*4 - 0x364800d1], 0x64
dec eax
mov dword [esp + edx - 0xd920029], edi
jb 0xe8665e

Function at 0xe96c03
Capabilities:
Manually build aes constants

Disassembly:
dec esp
lea esi, [ecx + 0xf2d5f0d]
dec ebp
lea ebx, [ebx + ebp - 0x75421e4e]
inc ecx
rol dl, 0xc6
neg dword [esp + ebp - 0x75421e51]
xor eax, edi
ror eax, 3
inc esi
or byte [esp + edx*8 - 0x20a1e939], bh
call fcn.014d4240
mov edx, 0x4034d2b2
mov eax, edx
mul al
movzx ecx, byte [ebp + edx - 0x4034d2b2]
and eax, eax
ror edx, 0xea
lea ebp, [ebp + eax - 0x40347bc3]
xor cl, bl
imul eax
adc dl, ah
xor eax, 0xf8a8753b
inc cl
add edx, edx
or edx, edx
ror cl, 1
xadd edx, eax
neg cl
xor ax, ax
jle 0xd61a6f
inc esp
mov ebp, dword [ebp + ecx - 0x75421e53]
dec edx
mov dword [esp + 0x6c40cc65], 0x63b55b2
inc edx
sete byte [esp + 0x6c40cc6d]
inc edi
mov dword [eax + 0x6c40cc61], ebp
inc ebx
mov eax, dword [ebx + edi - 0x5e44]
movzx ecx, dl
jnp 0xe8e283
mov ax, word [edi + ecx - 0x8808d0f]
sar ecx, 9
lea edi, [edi + ecx - 0x44044]
and dx, ax
not dx
mov word [edi + ecx*8 - 0x220230], dx
lea eax, [ecx*8 + 0xc10bd3f]
movsx edx, cl
lea esi, [esi + ecx*2 - 0x88090]
rol edx, 0xad
call fcn.014d9e13
mov dx, word [edx + ecx - 0x77cc50da]
mov word [esi - 2], dx
movzx ecx, byte [esp + 3]
rol eax, 0xc4
lea esi, [esi + ecx*8 - 0x18a]
lea edx, [ecx + ecx*2 + 0x1031f13]
mov eax, dword [ebp + ecx*2 - 0x60]
xadd dword [esp + ecx - 0x29], edx
inc dword [esp + ecx - 0x29]
lea ebp, [ebp + ecx*8 - 0x182]
xor eax, ebx
sar word [esp + ecx*2 - 0x62], 0x8f
seta cl
rol eax, 1
xchg word [esp + ecx*4 + 5], cx
dec eax
add edx, 0xbc232636
setbe byte [esp + ecx*2 - 0x13ed3]
push ecx
bswap eax
sal dx, 0xec
neg eax
dec cl
jle 0xebf483
shl ecx, 0xcf
rol eax, 2
or edx, edx
rol dl, 0xa1
xor ebx, eax
add edi, eax
pop ecx
pop edx
pop edx
pop ecx
jmp fcn.014ccc6f
Function at 0xe9f275
Capabilities:
Encode data using xor

Disassembly:
add cx, 0x6d1d
xor ax, bx
xchg dword [esp + ecx*4 - 0x1b474], ecx
btc ecx, 0x84
not ax
ror ax, 1
jmp 0xebd119
mov dword [esp + eax - 2], edx
not ecx
lea ecx, [ecx + eax*2 - 0x312f3ca2]
xor ecx, 0x53b93a12
cdq
dec ecx
xor word [esp + eax - 1], dx
neg ecx
not ecx
or dx, 0x5421
push edx
xchg dword [esp + eax + 2], eax
inc esp
add al, 2
xor ebx, ecx
ror edx, 0xa1
add edi, ecx
xor ax, word [eax + ebp + 5]
sar edx, 0xf4
add edx, edx
movzx ecx, dl
lea ebp, [ebp + ecx*2 + 7]
jno 0xe6d26d
inc esp
cmp byte [ecx], bl
dec esp
rol byte [edx + 0x5399daba], 0xc0
cwde
sal byte [edx - 0x793fac67], 0xd4
xchg byte [ecx - 0x614b3fad], bl
xchg dl, dh
movsd dword es:[edi], dword [esi]
insd dword es:[edi], dx
sar byte [ebp - 0x5956e74], 0x88
jne 0xf7b9da2d
test dword [ecx + 0x43], ebx
xchg ecx, eax
aad 0x3e
xchg bl, al
cmc
shl ecx, 1
dec edx
xchg bl, al
cmc
lodsd eax, dword [esi]
xchg ecx, eax
pop esi
xchg bl, al
cmc
inc ecx
cmp byte [eax + 0x711f8522], dl
sar eax, cl
ror ch, 0xcb
mov cl, 0xd0
test eax, eax
in eax, dx
jecxz 0xe9f29a
rol byte [ebp - 0x4e2c3240], 1
rol byte [ebp - 0x46587c40], 1
mov eax, dword [0xe6c0bbec]
mov ah, 0x4b
shl dh, 0xb4
dec ebx
inc byte [ebp + 0x48850e10]
getsec
or al, byte [ecx + ebx*2 - 0x1dd692bd]
xchg ebx, eax
cmc
sbb eax, 0xc387c615
cmc
sub dword [ecx], ebp
rol byte [edi - 0x7bd20a3d], cl
xchg ecx, eax
and al, byte [ebp - 0x74220867]
mov esi, 0xde035347
idiv byte [esi + 0x3b5d1d5b]
loop 0xe9f31c
mov esi, 0x77f39c7c
rol byte [esi - 0x2cc92b76], cl
sahf
push ss
adc eax, 0x7b9258b5
stc
pop edx
out dx, eax
xlatb
cmc
test dword [ebx - 0xdaf63c5], 0xf45a676a
pop edx
push cs
mov byte [eax + 0x790f68], ah
mov al, 0x3a
sub byte [edi - 0xd], dl
add ch, ah
add dword [ebx - 0x773b8b14], 0x5c1a8bcd
pushfd
and bh, byte [edi]
mov ch, 0x77
mov dl, 5
inc ecx
mov esi, 0x3b8a70e2
leave
aam 3
cmp ebp, dword [esi + 0x7b858316]
xchg edx, eax
dec ecx
or al, 0x7d
pop ebp
sbb dword [edi - 0x2460bdc1], 0x6be8b07e
inc esp
mov al, 0x23
cli
out dx, eax
nop
cmp bh, bh
cmp dl, byte [edx]
cmp esp, ebx
push ebx
mov ch, 0xdc
out 0x77, eax
mov ch, 0x7b
mov eax, dword [0x5f1fd3e5]
psubd mm6, qword [ebx - 0x54b2a2ce]
rol byte [eax], cl
ret 0x3c4
jmp 0xef3972
neg ax
push edx
shl cl, 0xc2
ror ax, 1
xor bx, ax
or cl, byte [esp + ecx*8 - 0x2a61a]
ror dx, 0xe9
mov word [esi + ecx*4 - 0x15310], ax
dec cx
btr ecx, edx
bts edx, 0x3c
mov dword [esp + ecx - 0x54c3], edi
ret 8

Function at 0xea6140
Capabilities:
Manually build aes constants

Disassembly:
mov eax, dword [esp + 9]
bts eax, 0x2f
mov word [ecx + eax - 0x7b79db4e], dx
shr dword [esp + eax - 0x7b79db43], 0x26
mov ecx, eax
lea eax, [ecx + 0x67085d23]
mov dword [esp + ecx - 0x7b79db4e], ebp
ret 0x10
lea ecx, [esp + ecx + 0x14]
jno 0xe7b502
dec eax
ror dword [esp + edx - 0x6aab4b81], 0xaa
cbw
pop ecx
pop edx
pop ecx
inc ecx
pop edx
pop ecx
jae fcn.00fa7e93
inc bx
mov dword [ebp + eax - 0xc3f0], eax
inc ecx
sal edi, 0x71
dec edx
mov dword [esp + edi], ebx
ret 0x10
neg al
sub word [esp + eax - 0x1479dc02], 0xadab
neg cl
rol eax, 0x18
xor bl, cl
xadd dword [esp + eax - 0x131479ce], eax
pop eax
jp 0xea11aa
Function at 0xebe9ab
Capabilities:
Encode data using base64

Disassembly:
add ebp, edx
mov dword [esp + ecx*4], ecx
mov word [esp + ecx], 0x8689
xor ax, word [edi + ecx*2]
movsx edx, cx
lea edi, [edi + ecx + 2]
call fcn.014a4c6f
xor ecx, edi
inc bp
xchg ebp, ecx
inc ebp
or edi, edi
jg 0xf97af2
not ecx
dec ebp
lea esp, [ebp + eax*2 + 0x28a5251f]
inc bp
xchg ebp, esp
sal eax, 0x35
sbb ecx, 0xa2996e11
movsx ebp, ax
inc ecx
bts edi, 0xa4
xor ecx, 0x668bb72d
dec ecx
sub esp, 0x10318125
inc ecx
rol ecx, 0x89
not ecx
dec ecx
sbb ebp, ecx
inc ecx
imul esp
jb 0x149a55d
mov eax, dword [ebp]
mov edx, 0x2f903c2c
movzx ecx, dx
lea ebp, [ebp + edx*2 - 0x5f207854]
and cx, dx
jo 0xe9ac15
call fcn.014a694f

Function at 0xebf883
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
mov esi, 0x31109516
call fcn.00e6dcbe
push ebp
mov ebp, esp
clc
test esi, 0xecac2f0a
jmp 0xfbb028
lea ecx, [ecx]
not cl
inc cl
push ecx
push ebx
xadd bx, bx
push esi
and bh, 0x26
stc
push edi
add esi, 0xe73fe7b7
bt edi, 5
sal esi, 0x3b
mov edi, eax
sbb ebx, 0xee181d2f
mov esi, ecx
bts bx, si
or al, 0x2b
sub edx, edx
movzx ebx, bx
jmp 0xec2eb6

Function at 0xec2751
Capabilities:
Execute syscall

Disassembly:
dec ebx
mov edx, dword [esi + ecx - 0x1bb7425]
dec edi
lea esp, [ecx + edx + 0xbb21e95]
dec esp
mov dword [esp + ebp*2 - 0x4c], esp
inc edx
mov dword [esp + ecx*2 - 0x376e847], ebp
dec ebx
mov dword [ecx + eax - 0x1bb742d], edx
dec ebp
lea eax, [eax + ebp - 0x2e]
inc ecx
shl edx, 0x4a
dec edx
neg dword [esp + ecx*8 - 0xddba128]
call fcn.014bf90e
syscall
push ebp
pushfd
dec eax
mov ebp, 0x4fa91f2d
cmp al, byte [ebx - 0x78]
xlatb
dec eax
shr ebp, 0xbe
dec eax
mov ebp, dword [esp + ebp*8 - 0x10]
dec eax
mov dword [esp + 8], 0x43951280
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.00ebf290
Function at 0xec77e6
Capabilities:
Manually build aes constants

Disassembly:
mov eax, 0x6029c809
mov ecx, dword [eax + ebp - 0x6029c809]
lea ebp, [eax + ebp - 0x6029c805]
mov dword [esp + eax - 0x6029c805], eax
btc ax, 0x35
call fcn.00ebbbad
mov edx, 0xa021ec1f
mov ax, word [eax + esi - 0x8a5]
xor ax, bx
ror ax, 1
xor dx, 0x9ba9
neg ax
movzx ecx, dl
not edx
rol ax, 1
dec ax
btr cx, dx
btc edx, ecx
add edx, edx
xor bx, ax
dec dl
lea edx, [ecx*4 + 0x7a1acb0a]
mov word [edi + edx - 0x7a1acde2], ax
btc ecx, edx
mov ecx, dword [edx + esi - 0x7a1acde9]
movsx eax, dx
bts dx, dx
lea esi, [esi + edx - 0x7a1acded]
push edx
jae 0xfb6232
mov eax, 0xe887abba
mov ecx, 0x3c86eb25
mov eax, dword [ebp + ecx - 0x3c86eb25]
lea ebp, [ebp + ecx*2 - 0x790dd646]
push ecx
xor eax, ebx
ror eax, 1
lea edx, [ecx + 0xdbb7338]
neg eax
bswap ecx
lea eax, [eax + ecx*4 + 0x42dfcd25]
xor eax, 0x3cbe5f85
bt ecx, 0x88
sal byte [esp + ecx - 0x25eb8639], 0xc1
dec eax
pop edx
bts ecx, edx
jb 0xfbd6e6
neg ecx
neg eax
dec dword [esp + eax*2 - 2]
sar al, 0x23
inc ecx
neg ecx
inc eax
or ax, word [esp + eax*2 - 1]
jns 0x14cc4e9
xor ecx, ebx
sar eax, 0xfa
adc byte [esp + edx - 0x7a1acde4], al
bswap ecx
jns 0xedb56f
ror eax, 2
sal ecx, 0x9b
sub ecx, 0x1a01aa08
btr cx, dx
xor ebx, eax
add edi, eax
inc ecx
mov eax, edx
shl eax, 0xaa
mov dx, word [esi + edx - 0x7886eb25]
mov ax, word [eax + esi - 0x1bac93fe]
btc cx, cx
adc esi, 2
sal ecx, cl
jbe 0x1497448
not dx
add cx, cx
call fcn.014e6199
bswap ecx
ror ecx, 1
rol dword [esp + edx - 0x7a1acde6], 0xba
bswap edx
xor ebx, ecx
div dl
add ebp, ecx
call fcn.00ef3407
dec esp
lea ecx, [ebp*8 - 0xb67e64a]
dec ebp
arpl si, si
dec eax
neg ebp
dec eax
xadd ebp, edx
dec ecx
add ebx, esi
btc edx, edx
dec ecx
add ebp, dword [eax + ebp*2]
dec ebp
mov edi, dword [eax + edx*4 - 0x8075cc]
inc ecx
mov cl, byte [eax + edx - 0x201d65]
mov esi, 0x9f006d12
inc bp
add ebp, ecx
dec ebp
lea eax, [eax + edx*2 - 0x403ae0]
dec esp
shrd ebp, edi, cl
dec ecx
btc ebp, edx
bswap edx
dec edx
mov dword [edx + eax - 0x751d2000], ebp
inc ecx
movsx ebp, cl
jmp ebx
Function at 0xeca010
Capabilities:
Authenticate hmac

Disassembly:
call fcn.014d2028
mov edx, 0xaf077004
mov edx, dword [ebp]
mov ecx, 0xbb16528a
add ebp, 4
xor edx, ebx
lea edx, [edx + ecx - 0x4be96bd4]
call fcn.00eaa6d5
sahf
nop
xchg edi, eax
mov cl, 0x36
imul ebp, dword [ebx - 0x10], 0x65
sub dh, byte [edx]
jle 0xeca067
imul esi, eax, 0x65
push edx
pop esi
jle 0xeca0ac
adc eax, ebp
in eax, 0x5c
adc al, 0x6a
pop esi
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x4a2a8c00]
mov ebp, 0xca54cb00
and dword [eax + eax + 0x5f7003c0], edx
cwde
adc al, 0x83
daa
clc
jbe 0xeca023
mov eax, 0x3e7f40b7
mov bh, 0x40
jg 0xeca0ad
rol ebx, 0x98
lcall 0x408f, 0x2208628
fcomp qword [ebx + 0x44df7cda]
call [esi - 0x67]
lodsb al, byte [esi]
js 0xeca0c9
jg 0xeca0bd
adc ch, byte [eax + 0x27f4478]
adc dl, byte [eax - 0x1e80bb88]
push es
loop 0xeca06a
mov bl, pe_nt_image_headers32
cmp dword [edx - 0x213e7ea7], eax
pop ecx
add ecx, 0x14ede
cld
inc ebp
sub edi, esp
inc ebx
mov edx, dword [edi + ebx - 0x7a6f0000]
inc ecx
push edi
inc esi
mov ebp, dword [esp + edi - 0x7a6efffc]
inc edx
mov esi, dword [esp + ebp*2 + 3]
dec edi
lea ebx, [ebx + ebp*4 + 4]
inc cx
cmp al, 4
add byte [ecx + 0x748b4285], dl
insb byte es:[edi], dx
add ecx, dword [edi - 0x73]
pop esp
stosd dword es:[edi], eax
add al, 0x66
inc ecx
dec edi
inc ecx
sar edi, 0xec
xor edx, edi
inc ecx
sal edi, 3

Function at 0xed31e3
Capabilities:
Manually build aes constants

Disassembly:
mov edx, dword [edi + edx - 0x64a10214]
mov dword [esp], 0xb81d2985
mov cl, byte [edi + 8]
shl dword [esp], 0x52

Function at 0xed34e0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc eax
sar ch, cl
inc ebp
lea esi, [esi + esi*2 + 0xa0fa5f6]
call fcn.00ea7f5d

Function at 0xedcbf2
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
ror ecx, 1
neg edx
inc ecx
bswap edx
xor ecx, 0xb81bb7bb
sub ecx, 0xbb35641a
shr edx, 0x36
cbw
xor ebx, ecx
mov dword [esp + edx*2 - 0x96], eax
imul ax, word [esp + edx*2 - 0x94]
add edi, ecx
or dword [esp + edx*2 - 0x96], 0xac3ed083
shr edx, 0x7e
jbe 0xf8ea59
mov esi, dword [esi + edx*4]
ror edx, 0x5a
pop eax
jbe fcn.014ccc6f
shl ecx, 0x4e
push eax
mov dword [esp + ecx - 0x3ec34000], edi
ret
Function at 0xedcc32
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec edi
lea eax, [ecx + eax - 0x26]
inc ebp
mov esi, ecx
inc ecx
xadd cl, ch
dec edi
mov dword [edx + ecx*2 - 0xd8], esp
inc edx
movzx edx, byte [esp + ecx*2 - 0xd6]
inc dx
dec dword [esp + ecx - 0x69]
inc ecx
mov ebp, 0xfb1d589
inc ebx
mov ebp, dword [ebx + ecx*2 - 0xd8]
dec edi
lea ebx, [ebx + ecx*2 - 0xd4]
xor ebp, edi
not ebp
jmp 0x148aefa
call fcn.01493f3b
mov edx, 0x350fa405
mov edx, dword [esi + edx*2 - 0x6a1f480a]
mov ecx, dword [esi + 4]
mov eax, 0x781afb20
push eax
sar ax, 0xc
mov dword ss:[edx + eax - 0x781affff], ecx
not dword [esp + eax - 0x781affff]
jp 0x14dcbfa
mov ecx, 0x8d3ef036
inc esp
movzx esp, cl
movsx ebp, cx
dec edi
mov edx, dword [esp + eax - 0x36]
push ebp
inc esi
movzx ecx, byte [esp - 0x36]
inc esi
add byte [esp - 0x30], cl
dec edi
mov esp, dword [esp + eax - 0x2e]
ja 0xec1ef3
xor ebp, 0x5abbc53a
inc esp
mov edx, ecx
bswap ebp
inc edx
mov eax, dword [esp + esi*2 - 0x6b]
inc edx
neg byte [esp + ecx - 0x68]
ror ebp, 3
sub cx, 0x4a1e
dec edx
mul dword [esp + ecx - 0x6c]
call fcn.014a8237
adc cl, 0x31
inc eax
jmp 0xf73ea7
not ecx
idiv byte [esp + eax*2]
shl eax, 0x56
sbb ecx, 0xe43a1db8
call fcn.01490db8
adc dword [esp + eax - 0x781affff], eax
mov ecx, dword [ebp + eax - 0x781affff]
movsx edx, word [esp + eax - 0x781affff]
ror word [esp + eax - 0x781afffd], 0x24
lea ebp, [edx + ebp - 0x4db]
jp 0x14a59f5
xor ecx, ebx
neg ecx
and eax, edx
adc eax, dword [esp + eax*2 - 0x9be]
inc ecx
rol dx, 0xca
sar dl, 0x27
bswap ecx
adc ecx, 0xbbafe807
xor ebx, ecx
add edi, ecx
neg dword [esp + eax*2 - 0x137c]
cwde
call fcn.014cb249

Function at 0xee9489
Capabilities:
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
add al, 0x17
mov word [edi], dx
push ecx
pop edx
pop eax
pop edx
jnp fcn.00e671b6
mov eax, 0x33176f82
dec esp
lea edx, [eax*4 - 0x2d610fdc]
inc ecx
mov ecx, dword [ebx + eax*2 - 0x662edf04]
inc ebp
movsx esi, dl
dec edi
lea ebx, [ebx + esi*8 - 0x15c]
xor ecx, edi
xor ecx, 0xa89b4e29
inc esp
movzx esp, al
dec ecx
inc ecx
push edx
inc ecx
not esp
neg ecx
inc ecx
movsx esi, ah
inc sp
and dword [esp + eax - 0x33176f7c], edx
lea ecx, [ecx + eax - 0x236a3f72]
inc ecx
movzx edx, ah
dec esp
sbb dword [esp + eax - 0x33176f82], esi
lea ecx, [esp + ecx + 8]
mov dx, word [ecx]
movsx ecx, ax
mov dword [esp], 0xab2f320b
sub edi, 2
jmp 0xeb26ad

Function at 0xeea4ca
Capabilities:
Authenticate hmac

Disassembly:
adc esi, 5
shld edx, eax, cl
jmp 0x14d4723
mov edx, dword [esi + edx - 0x4c942225]
pop ecx
mov eax, dword [esi + 4]
mov ecx, 0xda316509
mov cl, byte [esi + 8]
push 0x6b1a2c9b
jb 0xf7e1bd
mov ecx, 0x92907fba
mov edx, dword [ebp]
lea ecx, [ecx + ecx - 0x32c7e1d6]
movsx eax, cx
lea ebp, [ebp + eax*8 - 0xecec]
xor edx, ebx
sub eax, eax
sbb al, ah
call fcn.00e7a6ac
jb 0xed44fb
movzx ecx, byte [eax + esi - 0x379eadcf]
jno 0x14c89bb
Function at 0xeecf47
Capabilities:
Get number of processors

Disassembly:
inc ecx
mov esi, esp
inc ecx
dec ch
inc ecx
neg ch
inc ecx
xor bh, ch
dec eax
lea eax, [ebp*4 - 0x6e61461]
dec ebp
btc esp, esp
dec esp
adc ebp, esp
inc edx
mov dword [esi + ebp - 0x28f2c03f], edx
inc ebp
mov esi, dword [ebx + esi - 0x28f2c03f]
dec si
jne 0xf76f7b
inc ecx
not ch
jae 0xea35d2
call eax
ret
inc esp
xor edx, dword [esp + ebp - 0x9847]
dec esi
lea esi, [esp + esi + 0x18]
jnp 0xfa6a38
pop ebp
dec eax
adc ebp, 0xffa3bc22
jmp ebp
dec ebp
lea ebx, [ebx + esi - 0x28f2c03a]
inc esp
mov ebp, eax
inc esp
xor esi, edi
mov ecx, 0xb0a6989e
inc ecx
ror esi, 3
inc ecx
xor esi, 0x139ba9a2
dec ecx
add esi, ebp
inc ecx
dec esi
inc ebp
movsx edx, ah
inc ecx
movsx edx, bh
inc ecx
add cl, bh
inc ecx
rol esi, 1
dec esp
lea ecx, [ebp + eax*4 - 0x40c9dad2]
inc ecx
neg esi
inc ebp
xor edx, esp
push edi
bts si, si
jb 0xe99551
inc ecx
mov esp, 0xd3141826
dec edx
lea edx, [0x413059a9]
xor cx, di
inc ebp
mov edx, esp
inc ebp
movzx esi, ah
inc cx
dec edx
lea eax, [edx*2 + 0x128e539a]
dec dl
dec ecx
inc esp
ror cx, 1
inc ebp
mov edi, edx
add cx, 0x9024
dec ecx
mul esi
inc ebp
movzx ecx, dl
xor cx, 0x4c11
sal edx, 0xa6
neg cx
inc cx
bts edx, 0x20
inc ecx
movzx esi, dh
not si
xor cx, 0xdab2
ror dx, 0x4a
jae 0xec71a9
mov ecx, dword fs:[0x30]
mov edx, dword [ecx + 0x18]
jmp 0xfae227
jae 0xec8ea1
push eax
mov ax, 0x7802
movzx eax, cx
mov ax, di
push 0
push edx
movsx ax, dl
movsx eax, dx
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0xecc1dd
Function at 0xf6e7c5
Capabilities:
Manually build aes constants

Disassembly:
pop ebx
call fcn.014b6d03
dec eax
arpl si, si
dec ebp
adc ebp, esi
dec ecx
cmove ecx, esp
dec eax
adc ebx, esi
inc esp
or dl, dl
inc ebp
sub edx, edx
dec edi
xor edx, dword [eax]
cdq
inc cx
imul ebp, esi
inc cx
sar esp, 0x4c
dec edi
mov ebp, dword [eax + 8]
inc ebp
movzx edi, sp
jbe 0xec958a
bt edx, 0x28
xor eax, ebx
bt ecx, edx
adc ecx, edx
rol eax, 1
btc edx, ecx
imul edx, ecx
bswap eax
xor eax, 0xdd0b5c0a
rol dl, 0xe1
bswap edx
jno 0xef2884
mov eax, dword [eax + edi - 0x5277b570]
jne 0xeee315
inc ecx
sal esp, cl
dec ecx
add ebx, edi
dec ecx
lea edx, [eax + ebp - 0xd2b9]
dec edx
mov dword [esp + ecx + 0x67c7e5d4], eax
mov dword [esp + ebp*2 - 0x1a573], eax
dec ecx
mov dword [eax + ebp*2 - 0x1a57e], edx
inc esp
xchg byte [esp + ebp*8 - 0x695da], ch
dec edi
lea eax, [ecx + eax + 0x67c7e5c8]
inc edx
neg byte [esp + ecx + 0x67c7e5cd]
jne 0xf8231c
mov eax, 0xeabb5b10
lea edx, [eax*2 + 0x722bfa1d]
and edx, 0x62a7cb0d
mov eax, dword [ebp + edx - 0x42a2800d]
lea ecx, [edx + edx + 0x6390b98c]
push edx
lea ebp, [edx + ebp - 0x42a28009]
xor eax, ebx
call fcn.00fa8f6b
call fcn.00f97db8
pop edx
lea edi, [edx + edi - 0x5277b56b]
lea edx, [edx*8 + 0x70d0b0b]
call fcn.00fc27d1
inc ecx
ror edi, 1
inc ecx
pop esi
inc ebp
movsx edx, cx
pop ecx
dec eax
mov dword [esp + ebp - 0xd2b5], edi
dec eax
shl esi, 0x88
mov edi, dword [esp + ebp*2 - 0x1a579]
inc esp
xor dword [esp + ebp*4 - 0x34aec], edi
dec eax
or dword [esp + ebp - 0xd2bd], ebp
inc esp
or ah, ch
dec ecx
mul ecx
dec edx
mov edi, dword [esp + ecx + 0x67c7e5d4]
dec ecx
mul ecx
dec ebp
arpl di, di
inc ecx
mul ecx
jb 0xe9a72d
mov dword [ebp], eax
mov edi, ebp
jne 0xe9118e
lea ecx, [eax + eax*4 + 0x5b9ff508]
xor bl, dl
neg ecx
imul eax, eax
lea edx, [esp + edx + 4]
xadd dword [esp + eax - 0x4a11e404], ecx
not cx
mov eax, dword [edx + eax - 0x4a11e404]
pop edx
mov dword [edi - 4], eax
sub cx, 0x8214
call fcn.00f8bb50
dec ecx
add ebx, esp
call fcn.00ee7043
xor dword [esp], 0x6b1b7927
rol al, 1
call fcn.00ef66cd
dec esi
and dword [esp + ecx + 0x67c7e5d2], ecx
inc ecx
pop ebp
pop eax
jg fcn.00fa7e93