joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024d33
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10024d55
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10024d55
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10024d55
ret
cmp word [ebx + 4], 0x14c
jne 0x10024d55
test word [ebx + 0x16], 2
je 0x10024d55
test word [ebx + 0x16], 0x100
je 0x10024d55
cmp word [ebx + 0x18], 0x10b
jne 0x10024d55
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10024d55
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10024de1
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10024d75
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1000bcc0
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10024d55
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x10024de1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10024d55
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10024d55
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10024d55
ret
cmp word [ebx + 4], 0x14c
jne 0x10024d55
test word [ebx + 0x16], 2
je 0x10024d55
test word [ebx + 0x16], 0x100
je 0x10024d55
cmp word [ebx + 0x18], 0x10b
jne 0x10024d55
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10024d55
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10024de1
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10024d75
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1000bcc0
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10024d55
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x10024e98
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10024ef1
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10024e98
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10024ea7
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042ab4a
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10024ef8
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000bd6e
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10024f97
add edi, 4
add eax, 2
dec ecx
jne 0x10024edd
call 0x10024f44
loope 0x10024f3a
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10024f94
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10024fa5
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10024f58
cmp eax, ecx
ja 0x10024f58
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10024fe2
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10024fd8
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000c24d
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10024ea7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10024ef1
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10024e98
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10024ea7
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042ab4a
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10024ef8
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000bd6e
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10024f97
add edi, 4
add eax, 2
dec ecx
jne 0x10024edd
call 0x10024f44
loope 0x10024f3a
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10024f94
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10024fa5
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10024f58
cmp eax, ecx
ja 0x10024f58
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10024fe2
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10024fd8
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000c24d
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0xb9426f
Capabilities:
Encode data using xor

Disassembly:
inc cx
xor edi, 0x894ed512
movsb byte es:[edi], byte [esi]
and al, 0xbe
fcom dword [edx + edx*4 + 0x2484c74a]
invalid

Function at 0xbaf45e
Capabilities:
Encode data using base64

Disassembly:
fbld tbyte [edi - 0x7c]
mov ch, 0x97
lea edx, [edi]
invalid
rol cx, 0x68
lea edi, [edi + ecx*2 - 0x17df8]
mov dword ss:[ecx + edx - 0xbf00], eax
jne 0x140abf8
test byte [ecx], dl
add byte [ecx - 1], al
dec dword [edi]
test dword [ebp + 0x17], ebx
mov dword [eax], eax
sbb bl, byte [edx]
push ss
push cs
outsd dx, dword [esi]
push 0xe048cfa2
xlatb
push esi
test dword [esi - 0x2ffdf957], esi
mov dl, 0x79
jle 0xb794f8
insd dword es:[edi], dx
mov dh, 0x3d
push 0xffffffffffffffbe
mov bh, 0x9e
test eax, 0x4b49b138
dec ecx
dec ebx
and al, 0x61
pop edi
dec eax
outsd dx, dword [esi]
dec eax
push ds
pushfd
mov ebx, 0x9b975054
sub ecx, dword [ecx + 0x3b]
jl 0xb79461
ror dword [eax - 0x69], 0xe1
sbb al, 0xb3
cli
xor eax, dword [eax + 0x67]
fsub st(7), st(0)
or edx, dword [ecx + ebx*4 - 0x57]
bound edx, qword [edi]
test esi, ebp
cmp al, 0xa8
mov ch, 0xd8
pushal
pop ss
dec edx
invalid
xchg ecx, eax
sbb ah, byte [ecx]
jns 0xb7948f
push eax
and al, 0x40
mov edx, edx
imul ebp, dword [edi - 0x17589898], 0x1a
sbb al, 0xa2
loope 0xb794bb
aaa
cmp edi, eax
invalid
sbb edi, 0xc
jmp 0x13ed2c3
mov edx, dword [esi]
mov eax, 0x1b079e93
rol ax, 0xed
lea esi, [esi + eax - 0x1b0773ce]
pop eax
mov ecx, 0xdf1ad4b3
jae 0xbd282e
dec ecx
add esi, edi
dec ecx
ror edx, 0xad
inc cx
sub esi, 0x8d4a6729
pushfd
imul edi, dword [eax + 0xffffffe], 0xffffffbf
ljmp 0xe618
xor edx, ebx
add edx, 0x1854592
movsx eax, cl
or al, cl
cmovnp eax, ecx
neg edx
not edx
not cl
and eax, 0x7f1d0592
lea edx, [edx + eax - 0x446a0ff0]
lea ecx, [eax + ecx*4 + 0x7e1f303a]
sar ecx, cl
add eax, 0xeb8e47b8
rol edx, 1
shr ecx, 0x54
xor ebx, edx
call fcn.01416cd3
mov eax, dword [edi + ecx*2 - 0x17a]
jae 0xb79482
call fcn.00bdbbf3
xor ecx, ecx
mov edx, dword [ecx + esi]
call fcn.00b8167b
cpuid
jl 0xb8d8d1
Function at 0xbc5d09
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov dword [esp + ebp - 0xf5dd], ecx
dec eax
mov dword [esp + ebp - 0xf5fd], 0xf490a4ac
inc esp
xor dword [esp + ebp - 0xf5dd], edx
inc ecx
mov edi, 0xc0082137
dec esp
mov ecx, dword [esp + ebp - 0xf5dd]
dec eax
mov dword [esp + ebp - 0xf605], edx
call fcn.00ba8544
or cl, byte [eax]
lodsb al, byte [esi]
or byte [di], ah
xchg edi, eax
xchg ebp, eax
or al, byte [edi + 0x7d]
mov esi, 0x6c70f56f
pushfd
xor dword [0x3cc68d35], ecx
or bl, bl
sbb dword [edx + 0x70e1750a], 0xcf43da9f
adc byte [ebx + 0x7df46922], dl
jno 0xbc5dc9
mov ecx, dword [edx]
jns 0xbc5dde
xchg edx, eax
or dh, bl
shr dword [edi - 0x1bab0a88], 0x17
cmc
adc byte [eax - 0xa9a8d4a], bl
mov dh, 0x72
cmc
push ebx
cmp byte [edi - 0xb], ch
ror ebx, 1
adc dword [ebp + 0x337a360a], edx
retf
sub edi, dword [ecx + 8]
jp 0xbc5d7e
xchg byte [ecx], ah
in eax, dx
sbb dword [edx + ecx + 0x55], esi
inc edx
cmp eax, dword [esi + 0x40]
lcall 0x45f6, 0x52756ac4
int1
dec ecx
test byte [ebp - 0xf], 0x49
sbb dword [edx + ecx*8], ebx
inc esi
cdq
movsb byte es:[edi], byte [esi]
into
inc esp
fist dword [ecx]
dec esp
mov bh, 0xaa
test eax, 0xc13ab030
or eax, 0xf471f6cb
adc ch, cl
fbld tbyte [edx - 0x61]
push eax
pushal
daa
test byte [ebx], ah
ljmp 0x6635

Function at 0xbd4439
Capabilities:
Authenticate hmac
Encrypt data using chaskey

Disassembly:
rol cl, 1
call fcn.0141c8da
add ebp, eax
not cx
neg cx
push ecx
movzx ecx, byte [esi]
add esi, 1
movsx eax, dx
xor cl, bl
shr edx, 0xa7
ja 0xb7787b
Function at 0xbe54dc
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x7f163fbe
dec edx
inc esp
mov edi, dword [esp]
call fcn.00bdbc06

Function at 0xbe5507
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp + 8], 0x309a6f9e
lea esp, [esp + 8]
call fcn.00bf8307

Function at 0xbf836f
Capabilities:
Encode data using xor

Disassembly:
jle 0x13e0f2c
xor ebx, eax
sal edx, cl
not ecx
adc ebp, eax
push ecx
shl dx, 0x63
mov dword [esp + ecx - 0x567e0321], 0x5abea997
mov edx, dword [ecx + edi - 0x567e0325]
sar ecx, 0xff
not dword [esp + ecx + 8]
add ecx, dword [edi + ecx*4 + 4]
mov eax, 0x231ce2b
shr word [esp + eax - 0x231ce26], 0x8a
shl ax, 0x8d
lea edi, [eax + edi - 0x2315ffc]
pop eax
dec ax
or edx, ecx
movsx ecx, al
not edx
sar ecx, cl
ror dword [edi], 1
mov esi, 0xd3d2f7c8
stc
mov dword [edi + eax - 0x567e0324], edx
call fcn.00b90d8d
push eax
test dword [ecx], ebp
sub dword [ebp + 0x2b], ebx
stc
dec eax
add eax, 0x38764245
mov bh, 0xce
stc
xor byte [edx + 0x49], 0xd3
jl 0xbf83bd
daa
dec ebp
pop ss
adc byte [ebx - 0x41acb666], dl
dec ecx
dec eax
lodsb al, byte [esi]
wait
in al, dx
inc esi
mov dh, 0x45
sub dh, byte [ebp + 0x5e79b7a8]
retf 0x446b
or ecx, eax
not ecx
lea edx, [edx*2 + 0x44915f82]
not dl
mov eax, edx
mov dword [edi + eax - 0x5b7c9a07], ecx
ror eax, 0xdd
mov edx, dword [esi + edx - 0x5b7c9a07]
movzx ecx, al
sar ecx, 0x53
dec eax
lea esi, [esi + ecx + 4]
xor edx, ebx
dec ax
bswap edx
neg edx
lea edx, [eax + edx - 0x75617ba8]
not edx
sal al, 0x82
lea eax, [ecx + ecx*4 - 0x43438dfb]
xor ebx, edx
sub eax, ecx
and ecx, eax
xadd al, ch
adc ebp, edx
xadd eax, ecx
xor ax, ax
jmp ebp
lea edi, [edi + edx - 0xb6fffc]
lea edx, [edx + edx*8 + 0x5069dbb]
jae 0xc76704
call fcn.00bdc521
Function at 0xc070b7
Capabilities:
Encode data using xor

Disassembly:
jmp esi
inc ecx
inc eax
inc si
or dword [esp + edi*2 - 0x1de80], ebx
inc ecx
neg eax
inc ebp
movsx esi, di
inc ecx
rol eax, 1
not al
dec eax
ror eax, 0xff
inc ecx
xor eax, 0xb98e6339
inc edx
rol byte [esp + edi - 0xef3b], 5
pop ebp
inc edx
shr byte [esp + edi*4 - 0x3bd05], cl
dec esi
mov dword [esp + edi - 0xef43], ecx
dec ebp
or esi, edi
inc esi
xor dword [esp + edi*2 - 0x1de86], eax
sub cl, ch
inc ecx
pop ecx
jb 0x142416c
inc esi
mov eax, dword [ebx + edi*4 - 0x3bd0c]
dec edx
mov dword [esp + edi*2 - 0x1de86], 0x2a62d88
inc ecx
push edi
inc ebp
xor eax, ecx
dec esp
lea ebx, [eax*2 + 0x5b2bf789]
jmp 0xbce57e
dec ecx
add esi, eax
jmp 0xbab7b9
dec ebp
arpl ax, ax
jg 0x148eb15
inc esp
movzx edx, bp
jne 0x13d9824
lahf
push 0xe0e7c3fc
push 0x48
mov dword [0x4849b913], eax
jg 0x148eb70
mov dh, 0xb7
test edx, ebp
sbb byte [eax - 0x4a], bl
xchg ecx, eax
mov dh, 0x67
wait
inc ebp
mov byte [0x2ce25196], al
mov bh, 0xbd
cli
jmp 0x148eb0b
mov al, 0x74
dec ecx
xchg byte [eax - 0xa39b498], dh
mov esp, edx
dec esp
pop es
jo 0x148ebe4
push esp
mov ch, 0x59
invalid
std
and byte [ecx + 0x6d69da55], bl
jb 0x148ebed
jmp dword [ecx + 0x7ca0d06e]
mov eax, dword [0x7ca0d06e]
sub byte [edi - 0x1668ea5a], ah
lodsb al, byte [si]
in al, 0x89
xlatb
salc
mov edx, 0x70340c53
pop ebx
xchg ebx, eax
sbb al, 0x40
clc
and byte [ecx - 0x1feb1655], bh
pop edx
ret

Function at 0xc35d56
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0xbd8187
mov eax, 0x5a4d
cmp bp, bx
cmc
cmp word [edx], ax
je 0xbe54a9
mov eax, dword [edx + 0x3c]
cmp cl, dh
lea eax, [eax + edx]
cmp dword [eax], 0x4550
jmp 0x13f732b
push ebp
cdq
ror ebp, 0xb
mov ebp, esp
and edx, 0xcd09c2ac
test si, 0x4517
shld dx, di, 0xe
mov edx, dword [ebp + 8]
lea esp, [esp - 0x114]
cmp si, 0x600a
test ebp, 0x7910ef07
push esi
test edx, edx
je 0xbd8187
mov esi, dword [ebp + 0xc]
cmp cl, 0x86
test esi, esi
jmp 0xbd816f
Function at 0xc4b2fe
Capabilities:
Authenticate hmac

Disassembly:
test byte [eax + ecx*4 + 0x36], cl
cmc
call 0x57fa95e
xor eax, dword [esp + edx*4 - 0x55799240]
call fcn.00c444a7
mov edi, dword [0x8ed8ef63]
or dword [ecx - 0x12], ecx
inc ecx
ficomp dword [ebp + ecx*2 + 0x76]
jno 0xc4b2ba
loope 0xc4b366
xor dh, byte [edx - 0x3106b7ce]
loopne 0xc4b362
mov dh, 0x28
inc edi
mov ecx, 0x5374b7d3
invalid
test byte [eax - 1], 0x62
push ds
inc ebx
jno 0xc4b3bf
imul edx, dword [edx - 0x1eba6fb7], 0x3c928fcd
pop esp
cmp al, 0x5c
imul edi, dword [ebx + 0x315ee971], 0xb
jno 0xc4b351
pop esi
xor dword [ebx], ecx
in al, dx
xor bh, byte [edi]
inc esi
div byte [edi]
add ch, bh
wait
mov dword [ebx], eax
pushfd
aam 0x53
ud0
dec ecx
into
jno 0xc4b3dc
sbb dword [edx - 0x63], 0x20
popfd
cmp al, 0x21
push esi
push ds
inc esi
test byte [ebx], bh
sbb eax, 0x220864f
mov al, 0xbd
mov cl, 0x7b
popfd
retf
loope 0xc4b366
jb 0xc4b419
lea ebx, [edx - 0x10]
sahf
pop ds
xchg esi, eax
or cl, byte [edi - 0x62]
test bl, bh
nop
movsb byte es:[edi], byte [esi]
xchg ecx, eax
dec esi
js 0xc4b391
jb 0xc4b3bf
invalid
pop edi
out dx, al
add dword [ebp + ebp*4 + 0x61205d2c], 0xffffffa7
inc esi
or dword [ebp + ecx*8 - 0x78], edx
cmp dword [esi + esi*4 - 0x1cd3f67b], 0xffffffdd
nop
daa
xchg esi, eax
lea ebp, [edx - 0xa]
push edx
aas
sbb eax, 0x8d22e078
bnd retf 0x85e6
add al, 0x10
dec esi
dec ebx
xor dword [edx + ecx*4 - 0x3f], edx
scasb al, byte es:[edi]
sal ebx, 1
cmp ecx, dword [ecx + 0x62]
xchg esp, eax
scasb al, byte es:[edi]
popal
lds esi, cs:[esp + edx*8 + 0x626b5be4]
sub dword [ecx - 0x6b6025c3], edx
sbb cl, byte [eax]
cmpsd dword [esi], dword es:[edi]
push ecx
xchg ecx, eax
invalid

Function at 0xc6c4fa
Capabilities:
Encode data using xor

Disassembly:
inc edx
sub dword [esp - 0xfc], 0x3439e0a1
dec esi
mov dword [esp - 0x82], esp
inc si
mov dword [edi - 0x104], ebx
ror cl, cl
dec ecx
lea ebx, [esp + ebx - 0x45]
inc esp
mov edx, ecx
call fcn.00c2c996

Function at 0x13aab17
Capabilities:
Encode data using xor

Disassembly:
add edx, dword [ecx + edi - 0x2c000000]
mov dword [esp + ecx*2 - 0x58000000], 0x84342e92
xor al, 0x84
push ecx
call fcn.013be1a0
scasb al, byte es:[edi]
and eax, 0x989f0f9b
popfd
inc edx
dec ecx
sbb al, 0x2b
imul ecx, dword [eax], 0x3dfa55b7
pop ebp
mov bl, 0xad
stosb byte es:[edi], al
js 0x13aab26
mov bh, 0xe9
push ebp
xor esi, dword [esi + 0x3c073106]
dec eax
retf
Function at 0x13e4058
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
inc ecx
not esi
inc ecx
not ebx
inc ecx
bswap esi
dec esi
add dword [esp + 8], ecx
inc esi
xor dword [esp + 8], esi
dec edx
shl dword [esp], 0xea
dec ebp
xchg eax, esp
dec esi
mov ecx, dword [esp - 3]
dec edx
lea edi, [edi - 0x5c]
neg dl
inc dx
add dword [esp - 0x13], eax
shr al, 0x85
inc esi
mov dword [edi - 0x16], esi
inc ecx
pop esp
inc ecx
pop edx
jae fcn.0145e2a5
invalid
jmp 0xc02054
jmp esi
inc esi
mov esi, dword [ebx]
dec edx
sbb dword [esp], ebp
push eax
inc ebp
xor esi, ecx
inc ecx
ror esi, 2
dec esp
lea edi, [ebp*4 + 0x6fafd612]
inc ecx
bswap esi
inc ecx
dec dl
jnp 0xb809b7
inc esp
xor dword [esp + edx*2 - 0x11c], esp
shr dx, 0xec
inc ecx
pop ecx
dec ebp
arpl sp, sp
dec ecx
bswap ebx
dec ecx
adc esi, esp
dec esp
mov esp, dword [edx + edi]
inc bp
xchg ebp, edx
not edx
jmp 0x13de10e
dec ebx
mov ecx, dword [esp + edx*2 - 0x16660]
dec edx
mov dword [edi + edx - 0xb330], ecx
jmp 0xbe5ce8
dec eax
dec eax
add esi, ebp
dec esp
mov eax, edi
dec eax
lea edi, [edi + eax - 0x5cb6be9c]
inc ecx
ror ch, 7
dec eax
mov dword [esp + eax - 0x5cb6be98], 0x5e92ff3e
inc esp
mov dword [ecx + edi - 0xbb5fe83], eax
pop eax
jae fcn.0145e2a5
inc esi
xor dword [esp], edi
dec ecx
or eax, edx
inc ecx
pop ecx
inc ecx
movzx ebp, bp
dec esi
lea esi, [0x7aac02b]
neg bp
dec ebp
arpl di, di
inc sp
xchg ebp, edx
dec ecx
add esi, edi
inc cx
sub esi, 0x46550788
and ebx, dword [esp + 2]
dec edx
lea ebx, [ebx - 4]
je 0xc22753
Function at 0x13e437f
Capabilities:
Encode data using xor

Disassembly:
sub eax, ecx
or ecx, 0xbd112e88
lea ecx, [edx + edx*4 - 0x260fb78]
not cl
xor ebx, eax
not cx
add ebp, eax
call fcn.013c5af1
dec ecx
rol esp, 0x7f
dec eax
mov dword [esp + eax - 0x5fd3], edx
inc sp
mov dword [eax + edi - 0x5fd3], edx
movzx ebp, word [esp + eax*2 - 0xbfa4]
push ecx
dec eax
shl dword [esp + eax*2 - 0xbfa5], cl
dec eax
lea ebx, [eax + ebx - 0x5fd7]
inc sp
xadd ebp, edi
call fcn.013eaa78
inc edx
add ebp, eax
movzx ax, byte [edi]
lea edx, [edx + 0xf0e011c]
mov cl, byte [edi + edx*8 - 0x786c2156]
and dword [esp + edx - 0xf0d842b], edx
cmovs edx, dword [esp + edx - 0xf0d8427]
lea edi, [edi + edx*2 - 0x1e1b0854]
xor dl, 0x27
neg edx
jb 0x1447d8e
mov edx, 0xa6b2063a
or edx, edx
movsx eax, dl
mov eax, dword [esi + eax - 0x3a]
adc esi, 4
shr dx, 0xa4
sub dl, 0x2c
xor eax, ebx
xor dl, dh
setge dl
and dl, dh
inc eax
lea ecx, [edx + edx*8 + 0x2d3cfb05]
call fcn.00c10eec
mov edx, 0x8624f221
lea eax, [edx + edx - 0x3a55ef7c]
fcomp qword [edi]
ror al, 0x41
mov eax, dword [esi]
xor dl, dh
add dx, 0x8d2e
movzx ecx, dl
lea esi, [esi + ecx*8 - 4]
xor eax, ebx
and cl, dh
sal cl, 0xe2
inc eax
neg ecx
not eax
rol ecx, 0x93
sub cl, dl
sar ecx, cl
ror eax, 2
inc ecx
jns 0x13e1e68
call fcn.00ba40cd
mov edx, 0x51be3114
mov edx, dword [esi + edx - 0x51be3114]
mov eax, 0x74a23484
call fcn.01450857
dec eax
add esi, edx
inc ecx
movsx ebp, ah
dec ebx
lea eax, [ebp + edx - 0x3cc4b8d3]
dec esi
mov edi, dword [edi - 0x4e00]
call fcn.014848ea
adc al, byte [edx + ebx*8 - 2]
clc
adc dword [ecx], edi
dec eax
push 5
dec eax
xlatb
dec ecx
sub cl, byte [0x31ba1437]
add esi, eax
mov dl, 0xa3
dec eax
sbb bl, byte [ebp - 0x45]
dec ecx
dec ecx
mov cs, edi
test byte [esi - 0x6d66614e], dh
inc ebp
dec ecx
cmp eax, 0xb70f660a
xor al, 0x9b
xor bl, byte [edx - 0x4d]
fcomp st(7)
ja 0x13e44ae
mov bh, 0xc
push 0xb3bdba12
inc edi
push ss
cdq
outsd dx, dword [esi]
out dx, eax
push ebx
inc esi
pushfd
sal dword [ebx], 1
sal dword [ebx + 0x3786ac67], 1
inc edi
in eax, 0x11
mov edi, es
jb 0x13e44d1
rcr dword [ecx], cl
shl bl, 1
cmp dword [ebx - 0x22], edi
salc
test dword [esi + 0x3b], edx
cmp al, 0xcf
jne 0x13e453b
jns 0x13e4545
pop edx
adc ecx, dword [ecx + 0x5e2669fc]
movsb byte es:[edi], byte [esi]
cmp eax, 0x53371111
aas
imul ebp, dword [edx + edi*2 + 0x30f178e4], 0xdc3e83b
jae 0x13e453f
clc
or dl, dh
pop eax
imul dword [edx]
push ebx
cwde
push 0x7f
dec eax
adc eax, 0xbf6b226
imul eax, dword [ebx], 0x2d
push esp
iretd
out dx, al
jp 0x13e458f
sbb ah, 0xbc
adc ebx, dword [ebx - 0x13ba031f]
in al, dx
jg 0x13e4530
dec edi
out dx, al
je 0x13e45bc
pop ss
mov eax, 0xca516b13
enter 0xffffffffffffec45, 0xffffffffffffff9f
imul edx, dword [ecx - 0x36], 0xffffffc8
inc ebp
in al, dx
lahf
mov ecx, esp
out dx, al
mov dl, 0x8c
test byte [esi], al
mov al, 0x13
sub ecx, dword [edx - 0x3bdfeed0]
cli
dec ebx
in al, dx
loope 0x13e453f
aaa
pop edi
dec edx
out dx, al
inc edi
out 0xfe, al
invalid
mov dword [edi + esi*2 - 0x129fe], ebx
inc ecx
pop eax
dec ecx
add eax, 0xff7a3357
inc ecx
jmp eax
sal al, cl
sub edx, 0x5f9f6a26
mov word [edi], ax
dec dword [esp + 1]
setae byte [esp + 4]
pop ecx
pop ecx
jmp ebp
Function at 0x13f3b46
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
sub bh, 0xae
dec eax
add esi, edx
dec ecx
inc edi
dec edx
mov dword [esp + edi - 0xe32a4ce], ecx
inc dx
dec dword [esp + edi*4 - 0x38ca9367]
inc edx
mov edi, dword [edi + edi*2 - 0x1c6549bc]
inc ecx
ror bh, 0xe4
inc edx
movsx ebp, word [esp + edi*2 - 0x1c6549ca]
inc edx
shr dword [esp + edi*2 - 0x1c6549c7], 6
inc ecx
pop edx
pop eax
inc ecx
pop esi
jns fcn.0145e2a5
call fcn.013b3215
xor edx, 0x2c18f82c
rol edx, 1
sar cx, 0x88
xor edx, 0x7fb7fa85
dec esi
mov dword [esp + edi*4 - 0x38ca921c], ecx
dec eax
mov dword [esp + ecx - 0x6622fff8], 0x959d7404
inc edx
xor dword [esp + edi - 0xe32a47b], edx
dec eax
mov dword [esp + ecx - 0x66230000], 0x53b561af
dec esp
mov ecx, dword [esp + ecx - 0x6622fff0]
dec eax
arpl dx, dx
dec esi
or esi, dword [esp + edi - 0xe32a483]
jl 0xb897fe

Function at 0x13f3bc8
Capabilities:
Authenticate hmac

Disassembly:
push ecx
pop eax
pop edx
pop ecx
pop ecx
pop eax
pop edx
pop ecx
pop edx
jbe fcn.0146681a

Function at 0x1411f1f
Capabilities:
Encode data using xor

Disassembly:
lea edx, [eax*2 + 0x127fb0e]
pop edx
pop eax
js fcn.0146681a

Function at 0x145089a
Capabilities:
Encode data using xor

Disassembly:
and cx, 0x4602
lea eax, [eax + edx - 0x4df7994d]
add dx, cx
ror eax, 3
mov dword [esp + edx - 0x6fff45e6], 0xc0ffbbe
sub ecx, 0xbeb6f3ac
neg eax
inc eax
xchg dx, cx
xor ebx, eax
xchg dword [esp + edx - 0x6fff5256], ecx
sub cl, dl
ror ecx, cl
adc ebp, eax
xadd byte [esp + ecx - 0x680c0ffa], dl
mov edx, dword [edi + ecx - 0x680c0ffb]
push ecx
mov al, byte [ecx + edi - 0x680c0ff7]
lea edi, [edi + ecx - 0x680c0ff5]
xchg edi, eax
not byte [esp + ecx - 0x680c0ff7]
or eax, esi
xchg edi, eax
mov byte [edx + ecx - 0x680c0ffb], al
push ecx
pop ecx
call fcn.013f8416
test byte [esi - 0x34039d5c], al
xor al, 0x88
dec eax
xchg ecx, eax
pushal
fisttp qword [ebp + edi*2 + 0x7a]
and eax, 0x8394860
mov bl, 0x49
loop 0x14508f3
pop edx
mov esp, 0x37c13b7
push edx
mov dh, 0x4f
push 0x2c45917c
js 0x14508ed
stc
mov bh, 0x7b
cmp al, 0xf0
int3
Function at 0x1474bcf
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov edx, dword [esp + edi*8 - 0x47dc8]
call fcn.0140125a
dec ecx
lea ebx, [ebx + ebx - 0x453d]
inc ebp
movzx ebp, bl
inc dword [ebp + 0xf]
mov dh, 0xeb
inc cx
neg ebp
inc ebp
mov edi, dword [ebx + ebx - 0x4539]
inc ebp
movzx esi, ch
dec esp
cmovb ebp, edx
inc ebp
xor edi, ecx
inc esp
movzx eax, dx
inc ebp
movsx esp, bp
inc ecx
bswap edi
inc ecx
push ebp
dec esi
and eax, dword [esp + ebx*2 - 0x8a72]
inc edi
lea edi, [edi + ebp + 0x19573d5e]
call fcn.0148e399
mov al, byte [0xa51bdecb]
or dl, byte [0x3a3d4cdf]
push eax
bound ecx, qword [eax + 0x79]
jge 0x1474be3
dec ecx
mov edx, 0xb7be2f8d
ja 0x1474c52
jbe 0x1474c8c
mov dh, 0x47
pushal
or dword [ebx - 0x74b3afbb], edx
mov word [edi + esi*4], fs
jnp 0x1474c86
test esi, ecx
mov dh, 0xef
int1
add ecx, dword [ecx - 0x45]
mov edi, 0xb6c2acb8
sbb al, 0x1b
or bl, al
dec eax
mov ebp, 0x734bb48e
movsd dword es:[edi], dword [esi]
sub eax, 0x1e454f37
bound ebx, qword [eax - 0x486cde5f]
dec ebx
loopne 0x1474c5b
test dh, ah
mov byte [edi - 2], ah
cmc
call 0x4eff1fdd
invalid
faddp st(4)
and bh, byte [ecx + ebp*8 + 0x76b32f70]
das
mov bl, 0x76
outsb dx, byte cs:[esi]
in eax, dx
mov esp, 0x90c3261c
inc esp
pop ebx
rcr byte [ebx], 0x43
int3