joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074f9a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1005beee
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1005beee
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10075011
cmp word [ecx], dx
je 0x10075011
mov eax, dword [0x100932a4]
push edi
dec eax
push eax
push 0x10093190
call fcn.10074f38
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10075084
cmp word [eax], dx
je 0x10075084
mov eax, dword [edi]
test eax, eax
je 0x10075035
cmp word [eax], dx
je 0x10075035
lea eax, [ebp - 0x10]
push eax
call fcn.1007491b
jmp 0x1007503e
lea eax, [ebp - 0x10]
push eax
call fcn.100749b6
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100750ae
mov eax, dword [0x1009318c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10092e80
call fcn.10074f38
add esp, 0xc
test al, al
je 0x100750ae
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10075079
cmp word [eax], di
je 0x10075079
lea eax, [ebp - 0x10]
push eax
call fcn.1007491b
pop ecx
jmp 0x100750b0
lea eax, [ebp - 0x10]
push eax
call fcn.100749b6
jmp 0x10075076
mov eax, dword [edi]
test eax, eax
je 0x1007509b
cmp word [eax], dx
je 0x1007509b
lea eax, [ebp - 0x10]
push eax
call fcn.100748b2
pop ecx
jmp 0x100750ae
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10075179
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10074dbd
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10075179
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10075179
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10075179
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10075106
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1005f167
test ebx, ebx
je 0x10075174
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1005f167
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10075179
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10075179
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100633a2
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1007517b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100140f4
leave
ret
Function at 0x10075cbf
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10075ae3
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10075e2e
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10075e2e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10075de3
jg 0x10075d1b
test eax, eax
je 0x10075dd9
push 1
push 0x1000
call fcn.1005e40d
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10075d3e
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10075dd0
push 0x8000
push ebx
call fcn.10075918
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10075d67
jg 0x10075d62
cmp ecx, 0x1000
jb 0x10075d67
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1006080e
add esp, 0x10
cmp eax, 0xffffffff
je 0x10075dac
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10075d62
jl 0x10075d93
test ecx, ecx
jne 0x10075d54
push dword [ebp - 0xc]
push ebx
call fcn.10075918
push esi
call fcn.10059392
add esp, 0xc
xor ebx, ebx
jmp 0x10075e3c
cmp byte [edi + 0x24], 0
je 0x10075dc3
cmp dword [edi + 0x20], 5
jne 0x10075dc3
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10075dce
mov ebx, dword [edi + 0x18]
jmp 0x10075dd0
xor ebx, ebx
push esi
call fcn.10059392
pop ecx
jmp 0x10075e3c
test ecx, ecx
jg 0x10075da5
jl 0x10075de3
test eax, eax
jae 0x10075da5
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10062752
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10075e03
cmp byte [edi + 0x1c], 0
je 0x10075da5
jmp 0x10075e34
push ebx
call fcn.1006c109
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10075da5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10075e3c
cmp byte [edi + 0x1c], 0
je 0x10075e39
mov ebx, dword [edi + 0x18]
jmp 0x10075e3c
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10062752
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007d239
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007d10d

Function at 0x1007e4b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1007e4dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1007e4dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4015ce
Capabilities:
Check os version

Disassembly:
sub eax, eax
inc eax
dec eax
nop
and eax, 0xffffffff
mov eax, dword fs:[eax + 0x30]
inc eax
dec eax
nop
and eax, 0xffffffff
mov eax, dword [eax + 0xa4]
cmp eax, 6
jne 0x401631
push eax
pop eax
push ecx
pop ecx
push 0x4015fe
nop
dec eax
inc eax
nop
inc eax
inc eax
dec eax
dec eax
jmp 0x40160e
push eax
pop eax
push ecx
pop ecx
push dword [0x4015ca]
push eax
pop eax
push ecx
pop ecx
push 0x40162f
nop
dec eax
inc eax
nop
inc eax
inc eax
dec eax
dec eax
jmp dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
pop eax
push ecx
pop ecx
push 0x401644
nop
dec eax
inc eax
nop
inc eax
inc eax
dec eax
dec eax
jmp 0x401654
push eax
pop eax
push ecx
pop ecx
push dword [0x4015c6]
push eax
pop eax
push ecx
pop ecx
push 0x401675
nop
dec eax
inc eax
nop
inc eax
inc eax
dec eax
dec eax
jmp dword [sym.imp.KERNEL32.DLL_GetProcAddress]

Function at 0x401677
Capabilities:
Check os version

Disassembly:
sub eax, eax
inc eax
dec eax
nop
and eax, 0xffffffff
mov eax, dword fs:[eax + 0x30]
inc eax
dec eax
nop
and eax, 0xffffffff
mov eax, dword [eax + 0xa4]
cmp eax, 6
jne 0x4016dd
push eax
pop eax
push ecx
pop ecx
push 0x4016a7
nop
dec eax
inc eax
nop
inc eax
inc eax
dec eax
dec eax
jmp 0x4016b9
nop
push eax
pop eax
push ecx
pop ecx
push dword [0x4015ca]
push eax
pop eax
push ecx
pop ecx
push 0x4016db
nop
dec eax
inc eax
nop
inc eax
inc eax
dec eax
dec eax
jmp dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
pop eax
push ecx
pop ecx
push 0x4016f0
nop
dec eax
inc eax
nop
inc eax
inc eax
dec eax
dec eax
jmp 0x401702
push eax
pop eax
push ecx
pop ecx
push dword [0x4015c6]
push eax
pop eax
push ecx
pop ecx
push 0x401723
nop
dec eax
inc eax
nop
inc eax
inc eax
dec eax
dec eax
jmp dword [sym.imp.KERNEL32.DLL_GetProcAddress]
Function at 0x1000e4e3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e522
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e522
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e522
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000e522
cmp dword [ecx + 0x74], 0xe
jbe 0x1000e522
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001119f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001123c
push ebx
push esi
call fcn.10011168
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100110fc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100111e9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001123b
push edi
push eax
call fcn.1001215a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10011209
call fcn.1000fc44
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001123a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100110fc
add esp, 0x20
test eax, eax
jne 0x10011228
push edi
call fcn.1000fc44
jmp 0x10011230
push ebx
call fcn.1000fc44
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100114a9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10018888
push 0x10018880
push str.FlsAlloc
push 0x1f
call fcn.100113c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100114dd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10017150]
call esi
jmp 0x100114e3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10011527
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10018898
push 0x10018890
push str.FlsGetValue
push 0x21
call fcn.100113c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001155e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10017150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10011566
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100188a0
push 0x10018898
push str.FlsSetValue
push 0x22
call fcn.100113c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100115a0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10017150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10016c20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10016c4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10016c4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ab5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431090]
jne 0x401abf
repz ret
jmp fcn.00403258

Function at 0x40b4b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040453b
and dword [ebp - 4], 0
cmp dword [0x435640], 0
mov ebx, eax
jne 0x40b564
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b615
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b615
push eax
call fcn.004044c9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435640], eax
call esi
push eax
call fcn.004044c9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435644], eax
call esi
push eax
call fcn.004044c9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435648], eax
call esi
push eax
call fcn.004044c9
pop ecx
mov dword [0x435650], eax
test eax, eax
je 0x40b564
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004044c9
pop ecx
mov dword [0x43564c], eax
mov eax, dword [0x43564c]
cmp eax, ebx
je 0x40b5bc
cmp dword [0x435650], ebx
je 0x40b5bc
push eax
call fcn.00404544
push dword [0x435650]
mov esi, eax
call fcn.00404544
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b5bc
test edi, edi
je 0x40b5bc
call esi
test eax, eax
je 0x40b5b3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b5b3
test byte [ebp - 0xc], 1
jne 0x40b5bc
or dword [ebp + 0x10], 0x200000
jmp 0x40b5f5
mov eax, dword [0x435644]
cmp eax, ebx
je 0x40b5f5
push eax
call fcn.00404544
pop ecx
test eax, eax
je 0x40b5f5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b5f5
mov eax, dword [0x435648]
cmp eax, ebx
je 0x40b5f5
push eax
call fcn.00404544
pop ecx
test eax, eax
je 0x40b5f5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435640]
call fcn.00404544
pop ecx
test eax, eax
je 0x40b615
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b617
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xa1b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a1b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa1b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1b06a
add dl, dl
jne 0xa1b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1b0dc
xor eax, eax
add dl, dl
jne 0xa1b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1b17d
add dl, dl
jne 0xa1b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa1b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa1b075
mov eax, 1
add dl, dl
jne 0xa1b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1b0e1
sub eax, ebx
mov ebx, 1
jne 0xa1b128
mov ecx, 1
add dl, dl
jne 0xa1b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa1b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1b136
cmp eax, 0x7d00
jae 0xa1b16d
cmp eax, 0x500
jb 0xa1b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1b075
cmp eax, 0x7f
ja 0xa1b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa1b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa1b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xc97834
Capabilities:
Authenticate hmac

Disassembly:
cdq
xor bl, cl
mov dword [esp], edx
lea ecx, [esp + ecx + 4]
lea eax, [eax*8 - 0x4c719dda]
call fcn.014e04e2

Function at 0xcb5918
Capabilities:
Encode data using xor

Disassembly:
inc eax
add dh, 0x8e
inc esp
movzx ecx, cl
inc eax
shr ch, 0xa2
inc eax
neg dh
dec eax
mov dword [esp + edx - 0xc29c], 0x708e3112
inc eax
ror dh, 1
dec esp
lea ecx, [ebp*2 + 0xc11c532]
inc ecx
mov eax, eax
inc eax
sub dh, 0x22
inc esp
xor ch, dh
inc esp
movsx esi, bp
inc ecx
sar eax, 9
shl word [esp + edx - 0xc298], 0xa1
dec eax
lea esi, [esp + esi + 8]
inc edx
shr byte [esp + esi*2 - 0x9867], 0x45
dec dword [esp + edx*4 - 0x30a6d]
inc sp
mov dword [edx + esi - 0xc29c], edi
dec eax
lea edi, [edi + edx - 0xc2a0]
movsx esi, word [esp + edx - 0xc29c]
call fcn.00d32b65
push 0xd30fd3bc
mov ecx, 0xef22f722
ror dword [edi], cl
sar dword [ecx - 0x10dd08de], cl
sub edi, 4
mov eax, 0x5da52603
mov ecx, dword [edi + eax - 0x5da52603]
and dword [esp + eax - 0x5da52603], eax
xor ecx, ebx
not ecx
sar word [esp + eax - 0x5da52601], 0xcc
rol ecx, 1
push eax
imul eax, eax
lea edx, [eax*8 - 0x375db24c]
bswap ecx
or eax, dword [esp + eax - 0x3382e405]
cdq
idiv dword [esp + eax - 0x3387e606]
ror ecx, 1
neg eax
or edx, eax
xor ebx, ecx
imul edx, eax
xadd word [esp + edx*4 - 0x162], ax
adc esi, ecx
and edx, eax
call fcn.014f56cb
pop esi
mov edx, 0x532e859b
dec edx
lodsb al, byte [esi]
stosd dword es:[edi], eax
inc esp
das
jae 0xcb598e
hlt
Function at 0xccb11a
Capabilities:
Authenticate hmac

Disassembly:
rol dl, 1
xor bl, dl
add ecx, eax
jbe 0x151fc49
invalid
not ax
lea edx, [esp + edx + 0x10]
mov ecx, dword [eax + edx - 0x77a48bd1]
cwde
sal eax, 0x6f
mov dword [ebp - 2], ecx
pop eax
mov eax, dword [esp + 1]
movzx edx, al
lea ebp, [ebp + eax - 0x59e397b]
imul edx
inc edx
neg eax
pop eax
pop ecx
pop edx
jp fcn.01508028

Function at 0xcd5284
Capabilities:
Authenticate hmac

Disassembly:
dec edx
lea edi, [edi + ecx - 5]
inc ecx
xor dh, ch
dec edx
mov dword [esp + ecx*2], 0x89a2028e
inc ecx
shr esp, 0x85
inc eax
neg dh
inc eax
xor dh, 0xd
inc eax
inc dh
inc eax
neg dh
inc dx
ror dword [esp - 0x2c61c8e], 0x2a
jb 0xd00936
jae 0x14c0e5c
neg ecx
jmp 0xd0a2ac
inc eax
adc dh, 0xb4
dec esp
and ecx, ebp
inc eax
rol dh, 1
pop ecx
dec ecx
xchg esp, ebp
inc eax
add dh, 0xaa
inc ebp
btr edi, esp
inc eax
ror dh, 1
dec eax
cwde
cbw
inc esp
xor ch, dh
dec eax
add esi, esp
dec ecx
dec eax
ror al, 5
inc eax
sar ch, 0xe7
dec edx
mov dword [esi + ecx], edx
not eax
cbw
dec ebp
xor ecx, ebx
inc ecx
jmp ecx
inc cl
mov eax, dword [ebp + ecx + 2]
sal cl, cl
lea edx, [ecx*4 - 0x3af2e5d0]
adc cx, dx
mov edx, dword [ebp + ecx - 0x1a50]
adc eax, edx
mov dword [ebp + ecx - 0x1a50], eax
lea ebp, [ecx + ebp - 0x1a50]
mov eax, ecx
mov edx, dword [ecx + edi - 0x1a5d]
or ecx, eax
rol eax, 0xc1
xor ax, cx
lea edi, [edi + ecx - 0x1a5d]
inc cl
inc eax
sar cl, 0x83
xor edx, ebx
btr cx, cx
btc eax, 0x90
lea edx, [edx + ecx*2 + 0x6b89a595]
btc eax, ecx
ror eax, 0x63
call fcn.014c520a
int 0x54
jl 0x14c0f23
pop eax
inc ebx
dec edi
dec ebp
inc ebx
push esp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edx - 0x657a6e4d], bh
movsx ecx, dl
add cl, 0xb1
fild qword [ebp]
sbb edi, 3
call fcn.0152d087

Function at 0xcdb84a
Capabilities:
Authenticate hmac

Disassembly:
lea eax, [edx*4 + 0x49b79eb2]
ror ecx, 1

Function at 0xce1f7c
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
sbb ah, 0x35
cbw
inc esp
and dh, dh
pop eax
inc ecx
ror ah, 1
dec eax
lea ebp, [edx + esi*2 - 0x41e0264a]
dec ecx
bswap ecx
dec esp
bts esi, ecx
inc esp
sbb ah, dl
inc ecx
mov edi, 0x712c3c80
inc ecx
ror ah, 1
inc ecx
movsx eax, cl
dec eax
btr eax, 0x31
xor dx, 0x3118
inc ecx
not ah
sets dl
adc al, dl
dec eax
cwde
inc ebp
xor ch, ah
dec esp
add esp, esp
dec ebx
jnp 0xd2bef9
dec edx
mov dword [edx - 0x3100], ecx
xor al, dh
mov ebp, dword [edi + edx*2 - 0x6205]
dec eax
bt edx, edx
inc cx
imul edi
inc ecx
xor ebp, ebp
inc esp
movsx eax, bx
lea ebp, [ebp + edx - 0x2c0a3e2c]
inc ecx
dec dh
dec eax
cdq
ror ebp, 1
push eax
call fcn.01501d4f
Function at 0xce49cd
Capabilities:
Authenticate hmac

Disassembly:
lea ecx, [ecx + ecx*4 + 0x2c0886a6]
rol edx, 1
or eax, 0x110917b1
idiv al
xor ebx, edx
bswap eax
xadd al, cl
adc esi, edx
movsx edx, word [esp + eax*4 - 0x7f6a77b4]
mov edx, dword [ebp + eax - 0x1fda9dee]
mov dword [esp + eax*4 - 0x7f6a77b8], eax
mov ecx, dword [ebp + eax*4 - 0x7f6a77b4]
xchg dword [esp + eax*4 - 0x7f6a77b6], eax
sal dword [esp + 4], 0x21
adc ebp, 3
xor eax, dword [esp + 3]
jg 0xd2ef20
inc ecx
mov esp, 0xe4306320
dec edi
lea edi, [esp - 0x456ec3d1]
inc ecx
mov ebp, esp
dec ebp
mov esi, dword [edx]
inc ebp
mov eax, esp
dec ecx
mov eax, dword [edx + 8]
inc ecx
movzx edx, sp
inc ecx
mov ecx, esp
inc ecx
mov esi, eax
dec ebp
lea edx, [edx + edx*2 - 0xc630]
dec ebp
add edi, esp
inc ecx
adc ch, ah
inc sp
and esp, edx
dec edx
mov dword [edx + esi - 0x6320], eax
dec ecx
and eax, 0x2e38b117
dec edx
lea edi, [edi + eax - 0x24302104]
inc esi
mov edi, dword [edi + eax - 0x24302100]
inc ebp
movzx ecx, sp
inc ebp
xor edi, ebp
dec eax
sal edx, 4
inc ecx
dec edi
dec ecx
not esp
inc ecx
xor edi, 0x91140ea5
inc ecx
rol edi, 2
dec ecx
not esp
call fcn.00d31fd5
sal bp, 0x43
dec edi
mov esp, dword [edx + ecx*2 - 0x1a3f4604]
inc ecx
movzx ebx, byte [ecx + edi - 0xd1fa307]
dec ecx
lea edi, [ecx + edi - 0xd1fa307]
je 0xcea0c4
inc ecx
xor bl, ch
sub bl, 0x10
neg bl
inc esp
movzx esi, dh
ror bl, 1
inc bp
add eax, ecx
inc ecx
xor ecx, 0xce150cab
movzx eax, bp
sbb bl, 0x35
inc ecx
mov edi, 0xd59029aa
dec eax
cdq
inc cx
mul edi
ror bl, 1
shl cl, 0x63
dec ecx
idiv edi
add bp, bp
dec bl
ror bl, 1
btr eax, ebp
push ecx
not bl
inc esp
xor ch, bl
dec eax
lea ebx, [esp + ebx + 8]
dec esp
mov dword [ebx + esi*2 - 0xae14], esp
shl word [esp + esi*2 - 0xae11], 0xc1
inc eax
shl ch, 0x25
dec ebp
xchg eax, ecx
dec ebx
or ecx, dword [ecx + edx + 0x1345cc9e]
dec esi
xadd dword [esp + ecx*4 + 0x4d173258], edi
dec edi
mov esi, dword [ecx + edx + 0x1345cca6]
jo 0xc95afa
dec ecx
adc ecx, esi
cwd
dec ebx
mov dword [edx + ecx*2 + 0x268b993c], ecx
mov ebx, 0x3029cc1c
dec ecx
not ecx
dec eax
cwde
dec edi
lea edx, [edx + ecx*2 - 0x268b991a]
dec eax
mul ebx
rol ebp, 0xa9
dec esp
lea esi, [ebx + esi - 0x58c799f5]
dec esp
mov dword [esp + esi*2 - 0xae14], ebx
ret
adc edx, ecx
and al, 0x34
jle 0xd9852e
sub al, al
mov dword [ebp + eax*2 - 0x7b775600], edx
mov dword [esp + eax*2 - 0x7b775600], esi
ret 4
mov cl, byte [eax + ebp - 0x27280c33]
setne al
lea ebp, [eax + ebp - 0x27280bff]
shl edx, cl
mov dword [eax + ebp - 0x27280c01], edx
lea edx, [eax + eax*2 - 0x487f65f7]
xor ax, 0x8d18
lea edi, [edi + eax - 0x2728811d]
jne 0x1512de9
rol eax, 0x58
mov edx, dword [edi + eax - 0x19272881]
neg eax
xor edx, ebx
xadd al, ah
not edx
sal eax, 0x85
movsx ecx, al
sub cl, al
sbb edx, 0x5687278c
neg al
ror ecx, 0xa1
jne 0x152c5ed
not edx
cbw
setle al
adc ecx, ecx
sbb edx, 0xd487f3be
jmp fcn.00caed97