joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb527fb
Capabilities:
Authenticate hmac

Disassembly:
sal eax, 0xa5
sbb edx, 0x3daa5291
sal ecx, 0x47
mov dword [esp], 0xe7003eb3
cbw
bswap edx
xor ebx, edx
and dword [esp + 8], 0xf4103e05
push ecx
setns byte [esp + 0xb]
adc ebp, edx
mov dx, word [esi]
imul ecx, eax
mov ax, word [ecx + esi - 0x6b1a8ffe]
or word [esp + ecx - 0x6b1a8ffe], 0xd122
btc cx, cx
mov cl, byte [esi + ecx - 0x6b1a8ffd]
jb 0xbba712
shr word [esp + 0xc], 0x81
call fcn.006c9a76

Function at 0xb693da
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movzx eax, cl
sbb word [esp + ecx + 3], dx
lea ebp, [ebp + ecx - 1]
mov dword [esp + ecx*2 - 6], esi
ret 4
inc ax
xchg dword [esp + ecx*2 - 0x6975b122], ecx
xor ax, 0x6b4
dec ax
bt cx, cx
mov dword [esp + ecx*8], 0xab325415
ror cl, 0xa1
xor bx, ax
bts ecx, edx
or edx, dword [esp + ecx + 3]
btc ecx, ecx
mov word [ebp + ecx - 1], ax
jae 0x7b879f

Function at 0xb69411
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rol ecx, 0x67
neg edx
sar eax, 0x53
not edx
setae al
ror ecx, 0x35
shl eax, cl
xor ebx, edx
cwde
jmp fcn.00b4b3f7
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ecx
mov eax, dword [esp]
movzx ecx, byte [esp + eax - 0x800081]
mov dword [ebp + ecx*8 - 0x408], edx
mul eax
pop ebx
jo 0x777e88
xor eax, dword [esp + eax - 0x59e1f140]
dec edx
sal byte [esp + 3], 1
movzx ecx, al
xor ebx, edx
dec byte [esp + ecx*2 - 0xb7]
add edi, edx
movzx edx, word [esp + ecx*2 - 0xba]
bt eax, eax
mov eax, dword [esi + ecx*8 - 0x2e8]
sal dl, 0xe7
mov cx, word [eax + ecx*2 - 0xba]
add dl, 0xb
lea esi, [esi + edx*2 - 0x9d14]
mov word [esi + edx*2 - 0x9d16], cx
jl 0x8c6c32
mov edx, 0xa49ddb8f
mov ecx, dword [esi]
movsx eax, dx
add esi, 4
xadd eax, edx
shr dl, 0x81
cdq
xor ecx, ebx
add edx, eax
jno 0xb50972
pop ebx
bts eax, edx
lea edi, [edi + ecx - 0x85]
mov edx, dword [edi + ecx*8 - 0x408]
xor edx, ebx
sub cx, 0x8f95
inc eax
jle 0x888644
inc ax
neg al
sbb ecx, 0x9b039219
inc eax
xor ebx, ecx
add edi, ecx
neg eax
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
call fcn.00bc6aef
bswap edx
cwde
sbb edx, 0xca2d168d
jmp 0x6f109d
shl dl, 0xa1
inc ecx
shr dl, 0x46
and dx, dx
rol ecx, 1
mul dl
shl dx, 0xa4
xor ecx, 0xa030a619
bswap ecx
and edx, edx
xor al, al
dec ecx
sal dl, 0xe5
sal eax, 0xd5
sub edx, 0x4189d984
rol ecx, 2
xor ebx, ecx
add ebp, ecx
jmp 0xbe591e
mov eax, dword [ebp]
add ecx, ecx
bswap ecx
leave
mov ecx, dword [ebp + ecx*2 - 0x657c9f3e]
mov edx, 0xa9a10482
push edx
mov dword [esp + 4], ebx
lea ebx, [edx*8 + 0x2287c0ba]
cpuid
dec dword [esp]
sar word [esp + 2], 0xec
neg word [esp + 2]
sbb ebp, 7
shl word [esp + 1], 0xad
js 0x6f74ea
xchg ebp, eax
jecxz 0xb69418
cmp byte [ebx - 0x37968619], 0x4f
jmp 0xb694d7
xchg edx, ecx
adc dword [ebp - 0x6b], edx
bound esp, qword [esi]
add eax, 0xffffffff
mov edi, 0x775d68a3
lodsb al, byte [esi]
mov esp, 0xff
invalid

Function at 0xb6da93
Capabilities:
Encode data using xor

Disassembly:
ror word [esp + eax*2 + 4], 0xa3
not edx
lea edx, [edx + eax*4 - 0x4824bb0a]
dec ecx
shr cx, 0xc
ror edx, 1
sub ax, word [esp + eax*2 + 4]
call fcn.00816ec1
mov ecx, 0x1fbc072e
lea edx, [ecx + 0x553ae02f]
jmp 0x7e55cb
Function at 0xb98c59
Capabilities:
Encode data using xor

Disassembly:
bswap ecx
shl byte [esp + eax*8 + 5], 0xc5
neg dl
lea ecx, [ecx + eax - 0x4e9616ad]
adc ax, 0x60b1
shr edx, 0x4d
xor ecx, 0xd68eefab
ror eax, 0x15
sal dx, 0x82
bswap ecx
xor ebx, ecx
btc dx, dx
adc edi, ecx
not al
movzx ax, byte [esi + eax - 0x3058901]
pop ecx
mov cl, byte [esi + edx - 1]
and al, cl
rol dl, 0x45
sal dword [esp + edx - 0x20], 0xb
xor edx, edx
not al
ror byte [esp + edx*4 + 3], 2
xor edx, edx
mov word [edx + esi], ax
pop ecx
btc dx, 0x93
jae 0x812fd5
call fcn.008bf84c
mul ax
xor ecx, ebx
rol byte [esp + eax + 6], 0xe1
jb 0x7c1921

Function at 0xb98eea
Capabilities:
Encode data using xor

Disassembly:
sar dl, 0x82
not ecx
not eax
xor edx, edx
or ecx, eax
mov dword [edi + edx + 4], ecx
movsx eax, dl
and eax, edx
mov ecx, dword [esi + edx*8]
lea edx, [edx*4 + 0x6c8a7725]
lea esi, [esi + eax*8 + 4]
imul edx, eax
xor ecx, ebx
not eax
not edx
xor ecx, 0xdc18fca2
sub ecx, 0x791f1701
sub edx, edx
dec ax
rol ecx, 2
bswap ecx
cwd
xadd eax, edx
and dl, 0x37
xor ebx, ecx
call fcn.008cc47a
sahf
add edi, esi
and byte [eax - 0x7c], 0x99
push esi
enter 0xffffffffffffa81c, 0x1c
cdq
push esi
enter 0x2044, 0x2c
cdq
push esi
enter 0x61a4, 0x4c
cdq
push esi
enter 0xffffffffffff88dc, 0xffffffffffffffb4
cdq
push esi
enter 0x697c, 0x3c
cdq
push esi
enter 0x685c, 4
cdq
push esi
enter 0xffffffffffff9074, 1
mov al, ch
xor eax, 0x90bc1c2f
dec ecx
jecxz 0x897430
add al, 0xf
scasd eax, dword es:[edi]
sal byte [ebx], 1
retf
scasb al, byte es:[edi]
and esp, dword [ecx + 0x1cdbb064]
into
add bl, bh
out 0x6b, al
add byte [ecx], ah
enter 0xffffffffffffe68a, 0xffffffffffffff9b
pop eax
int1
imul esp, ebp, 0xa
neg ax
mov word [ecx + eax - 0x7b6790b6], dx
mov dword [esp + eax - 0x7b6790b6], 0x8802b904
btc ax, ax
mov edx, dword [esi + eax - 0x7b6790f6]
lea esi, [esi + eax - 0x7b6790f2]
sub word [esp + eax - 0x7b6790ee], ax
xor edx, ebx
call fcn.007b2294
mov eax, 0xfa1912b1
cwde
mov ecx, dword [edi + eax*8 - 0x9588]
lea edx, [eax + eax*8 - 0x5cf063d5]
mov eax, dword [edi + eax*4 - 0x4ac0]
ror edx, 0xf
jb 0x89740f
jmp 0x72892f
Function at 0xba15fc
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0x3b48b8a7
lea esp, [esp + 4]
call fcn.0077de78
mov ecx, 0xca042a9e
mov edx, 0xf188708
movzx cx, byte [ebp + edx - 0xf188708]
sub dl, dl
shl edx, 0xab
movsx eax, dx
xor al, byte [ebp + eax*4 + 2]
not cl
ror dl, 0xe2
neg dl
not al
bt edx, edx
or cl, al
sal edx, 0x33
movzx eax, dx
mov word [ebp + edx*2 + 2], cx
not al
movzx ecx, dx
push eax
add ecx, dword [edi + edx*2]
shl eax, 0x70
sar edx, 0x15
cmovbe eax, dword [esp + edx*4]
xor ecx, ebx
xchg dword [esp + edx], eax
xchg dword [esp + edx*4], eax
ror ecx, 3
pop edx
bts eax, eax
div eax
xor ecx, 0x770c5b11
sar eax, 0xd
sbb ecx, 0x8ea783a4
rol ecx, 1
push edx
xor ebx, ecx
add esi, ecx
call fcn.00c09ae5
js 0xba1663
push 0xedf492ea
into
rcl byte [eax - 0x1e]
mov ch, ch
into
sar byte [edx], 1
mov byte [0xd0ceedb8], al
sbb byte [eax + ebx*8 + 0x76d0ceed], ah
lodsb al, byte [esi]
outsb dx, byte [esi]
sahf
pop es
das
xor al, 0x6c
xchg dword [esi], edx
add dword [edx - 0x66ded07], ecx
mov al, 0x35
xchg edx, eax
push 1
xor ebp, dword [0x2deece86]
xor ebp, dword [0x157ab286]
xor ebp, dword [0xb527a86]
adc al, 0x2c
xchg byte [esi - 0x75], bh
mov edx, dword [edi + ecx*2 - 6]

Function at 0xba3d9a
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
pushfd
pop dword [esp + 4]
mov dword [esp], 0xf8a7b52b
mov dword [esp], esi
mov esi, 0xf18a2d87
bts si, 0x9a
push ebp
push ecx
lea esi, [esi + esi + 0x7e118706]
mov dword [esp + esi - 0x6125e204], ebx
jb 0xbad795
neg ebx
mov esi, dword [esp + ebx*2 - 0x31ebe2b2]
jbe 0x70b2bb
xor edi, esi
lodsb al, byte [esi]
ljmp 0x47d0
jmp 0x749639
movzx ecx, si
mov ebx, 0xe70a0e9b
push edi
sar ecx, 0xb8
xor ecx, 0
jmp 0x7e35c0

Function at 0xbbdc97
Capabilities:
Execute syscall

Disassembly:
push 0x2a8619ba
dec ebx
lea esp, [esp + 4]
jne 0x77b212
call fcn.00790012
inc edi
sbb dword [ecx], edx
invalid
test ebx, ebx
push 0xa2abdb9c
lea esp, [esp + 0x10]
je 0x706271
mov eax, 0x6d21659b
mov eax, dword [ebp + ebx*4]
push 0xa152c1f
rol byte [esp], 0x26
mov dword [esp], eax
jb 0x706261
mov ecx, 0x86b14434
movzx ax, byte [edi]
call fcn.006f1f33
jmp 0x77b201
Function at 0xbc94f4
Capabilities:
Encode data using xor

Disassembly:
btc cx, dx
lea eax, [eax + edx - 0xa1aa344]
not eax
sal edx, 0xfe
mov dword [esp + edx], ecx
and edx, ecx
lea eax, [eax + edx + 0xf281604]
neg dword [esp + edx]
add dl, cl
ror cx, 4
bswap eax
sbb ecx, 0x2004d9af
ja 0x7b6516
bts eax, eax
mov ecx, dword [esi]
movzx edx, al
cwd
btr edx, edx
xor ecx, ebx
sub dl, ah
xadd al, dh
or ax, 0x2034
neg ecx
sar dx, 0x4b
xadd ax, dx
inc ecx
not edx
rol dl, 0xe7
xor al, dh
xor ecx, 0x3c1a4333
call fcn.008cd0cf
sysenter
call fcn.00b92f44
movsd dword es:[edi], dword [esi]
loop 0xbc9532
sub byte [ebx - 0x379c8739], 0xd7
and ebp, edi
js 0xbc95d5
enter 0x3397, 0xffffffffffffff9f
js 0xbc95db
enter 0x12a7, 0x27
js 0xbc95e1
enter 0xffffffffffff9377, 0x47
js 0xbc95e7
enter 0xffffffffffffabef, 0xffffffffffffffa7
js 0xbc95ed
enter 0xffffffffffffabbf, 0xffffffffffffffef
js 0xbc95f3
enter 0x5b4f, 0x3b
push ecx
push dword [0x435f1e9b]
pop ebx
cmp edx, dword [ecx - 1]
xor eax, 0x435f1e9b
nop
add byte [eax - 0x2bec7294], ch
add cl, cl
and eax, 0xe2a4789b
add byte [ebx], cl
in eax, dx
loopne 0xbc95ac
mov edx, 0x97ce47e
cld
inc ebp
jl 0xbc95e8
adc al, 0x2d
mov ch, 7
push ds
adc ah, byte [edi + 0x5fff7062]
push esp
mov dl, 0xf4
sub bl, bh
add esp, dword [ebx]
inc ecx
out 0x46, eax
out 0xfc, al
invalid
cli
loop 0xbc9592
add al, 0xa4
pop edi
xchg edi, eax
mov eax, dword [0x640f74fc]
sbb byte [edx + 0xd39806b], al
sbb edi, edi
sbb edi, edi
pop esi
daa
sti
cmc
mov ebp, 0xba0e797f
cmpsb byte [esi], byte es:[edi]
arpl word [eax], bx
and byte [edx], dl
shr edi, 0xe3
adc eax, 0x3df2a60b
invalid

Function at 0xbc9a3f
Capabilities:
Encode data using xor

Disassembly:
movsx ecx, dx
ror eax, 2
imul ecx, ecx
pop ecx
mov dword [esp + edx - 0x60530000], edx
xor eax, 0x3614d31c
shr dword [esp + edx - 0x60530000], 0xea
jne 0xbfa68f
lea ebx, [edx + 0x262868a4]
cpuid
sbb edi, 8
push 0xa12f7f3d
sal word [esp + 1], 0x81
mov dword [edi + 0xc], eax
shr dword [esp], 0x90
mov eax, 0xe639b58e
push eax
mov dword [edi + 8], ebx
setns byte [esp]
mov dword [edi + 4], ecx
push eax
ror eax, 3
mov ecx, 0xb2a2d032
sar edx, 0x5d
sal dword [esp + edx - 3], 0x78
not eax
call fcn.00b94207

Function at 0xbcdd36
Capabilities:
Authenticate hmac
Check http status code

Disassembly:
mov dword [esp], edx
xor ecx, ebx
xor ecx, 0x3c01cd3b
movsx eax, dl
call fcn.00be414e
Function at 0xbd118e
Capabilities:
Encode data using xor

Disassembly:
or word [esp + eax + 2], dx
rol ecx, 1
bt edx, edx
add dword [esp + eax], eax
neg ecx
dec eax
xor ebx, ecx
sal edx, 0xc1
adc edi, ecx
mov dword [esp + edx], edi
ret
movzx dx, byte [ebp]
mov ecx, 0x51847cb2
mov eax, 0xb739a3a7
mov al, byte [ebp + ecx - 0x51847cb0]
or cl, cl
lea ebp, [ecx + ebp - 0x51847cb0]
sub cl, ch
lea ecx, [ecx*8 + 0x7b3a318e]
or ecx, ecx
and dl, al
btc ecx, ecx
sbb ecx, 0x4ab6199c
sal cl, cl
not dl
lea ecx, [ecx + ecx + 0x3bb06b82]
movsx eax, cl
mov word [ebp + ecx*2 - 0x6a00bd24], dx
mov ecx, dword [esi + ecx*2 - 0x6a00bd24]
adc esi, 4
sal ax, 0xe4
mov edx, eax
or edx, 0x8c3cf2ab
xor ecx, ebx
shr dl, 0x41
call fcn.0076fbe5
xor dword [esp + esi - 0xe2b6], ebp
inc esp
movsx edi, byte [esp + esi*2 - 0x1c583]
inc ecx
pop eax
dec esp
mov edi, dword [esp + esi - 0xe2be]
dec ecx
neg eax
dec ecx
xadd esi, ecx
inc eax
setge bh
dec eax
arpl bp, bp
dec eax
adc ebx, ebp
dec esp
lea esp, [ecx + ecx - 0xed34e5]
inc eax
inc dh
dec ebp
lea esp, [edx + esi*2 - 0x346be560]
dec ecx
mov edi, dword [ebp + esi*4 - 0x38b1c]
dec byte [esp + esi - 0xe2c3]
inc edx
mov cl, byte [esi + ebp - 0xe2bf]
inc sp
xor dword [esp + esi - 0xe2c6], eax
dec ebp
lea ebp, [ebp + esi - 0xe2c5]
inc ecx
setg dl
dec esp
mov dword [esp + esi - 0xe2bf], eax
inc esp
movsx ecx, word [esp + esi*2 - 0x1c58a]
dec eax
shr edi, cl
dec edx
mov dword [esi + ebp - 0xe2c7], edi
dec edx
lea edi, [eax + edx*8 - 0x564dcfea]
inc byte [esp + esi*8 - 0x71632]
dec eax
mov dword [esp + esi - 0xe2c7], ebx
ret 8
rol dword [esp + 7], 0xd0
test eax, eax
call fcn.007eacd4
xor cl, 0x8a
mov word [ecx + esi - 0x17afb], ax
call fcn.00b61988
cdq
idiv dword [esp + eax - 0x1000]
lea ebp, [ebp + eax*2 + 4]
not dword [esp + eax]
and dl, byte [esp + eax*4 + 3]
cdq
xor ecx, ebx
neg ax
sal al, 0xe7
jnp 0xbcee45
rol ecx, 1
sar word [esp + eax*8 + 1], 0xa3
adc dword [esp + eax*2], edx
bswap ecx
neg ecx
rol word [esp + eax*2 + 1], 0xee
jae 0x703e33
Function at 0xbd6c84
Capabilities:
Encode data using xor

Disassembly:
dec eax
cdq
dec ecx
adc ebx, ecx
dec ebp
xor esi, esp
inc ebp
movzx ecx, byte [ebx + edx + 8]
inc cx
neg esp
dec esi
lea ebx, [edx + ebx + 9]
jns 0xbbc38e
dec eax
sal eax, cl
dec eax
mov dword [esp + edx], esi
inc ebp
xor cl, bh
inc ebp
sub cl, dl
inc eax
ror bh, 0x26
cbw
inc ecx
shr dh, 0x46
inc ecx
neg cl
inc ecx
bt esi, edi
imul eax
dec esp
btr ebp, edx
inc ebp
adc cl, dl
shr byte [esp + edx + 1], 0x26
inc ecx
neg cl
inc ebp
xor bh, cl
dec eax
btr edx, esi
inc bp
mov dword [ebp + edx - 6], ecx
dec eax
ror ecx, 0x97
inc ecx
rol esp, 0x29
inc sp
sbb edx, ecx
dec ebp
lea ebp, [ebp + edx*8 - 6]
neg al
inc eax
setl ch
inc ebp
mov ecx, edx
inc ecx
pop esi
jno fcn.0085e60e
mov ecx, 0x214e3b5
ror cx, 0xc6
push ecx
movzx ecx, byte [edi + ecx*2 - 0x429af1c]
xor cl, bl
mov eax, 0x21a9af07
cdq
neg cl
lea edx, [edx + 0x5a6f924]
not dword [esp + eax*2 - 0x43535e0e]
imul dl
xor cl, 0x95
rol cl, 1
xor cl, 0x1a
bt dx, ax
dec word [esp + edx*4 - 0x169be490]
dec cl
and word [esp + edx*2 - 0xb4df246], ax
neg cl
call fcn.00b4601c
mov edx, 0x5ba71316
movzx ecx, dx
lea esi, [esi + edx - 0x5ba7131a]
and ecx, edx
mov edx, dword [esi + edx - 0x5ba71316]
movsx eax, cx
xor edx, ebx
not ecx
rol edx, 1
rol ecx, 0x6c
lea edx, [edx + eax*4 + 0x7ba0c4e1]
neg edx
inc edx
shl eax, cl
xor ebx, edx
add edi, edx
mov ecx, dword [ebp + eax*4]
rol ax, 0xab
mov edx, eax
adc edx, dword ss:[ecx + eax*8]
mov dword [ebp + eax*2], edx
movzx edx, al
shr eax, 0x85
lea ecx, [eax*8 - 0x3a668855]
xor eax, edi
jmp eax

Function at 0xbd729c
Capabilities:
Check http status code
Encode data using xor

Disassembly:
bswap edx
xor cl, 0x89
call fcn.0071a3f4
ror cl, 1
lea edx, [edx*4 + 0x6d20b731]
dec cl
add edx, edx
jle 0xc04538
xor bl, cl
pop edx
mov edx, dword [esp]
dec dl
lea ecx, [esp + ecx + 4]
mov dword [ecx + edx*8 - 0x56800], eax
shr dword [esp + edx - 0xad00], 0xac
shr edx, 0x28
je 0xbe3ab9
mov edx, dword [esi + edx*2 - 0x159]
mov eax, 0xf18ce91f
mov ecx, dword [esp]
lea esi, [esi + ecx - 5]
push eax
xor edx, ebx
inc edx
rol ecx, 0x77
ror edx, 1
sal dword [esp + ecx*4 - 0x13fffffc], 0x94
xor edx, 0xe8346a0e
or byte [esp + ecx - 0x4ffffff], cl
sub ecx, ecx
call fcn.007fb34b
ror ecx, 2
not al
call fcn.00756a42
xor edx, ebx
cwde
shl ecx, cl
js 0x88e047

Function at 0xbdbc17
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esi + ecx*4 - 0x47e00000]
lea esi, [esi + ecx - 0x11f7fffc]
movzx eax, cl
adc ecx, eax
pop ecx
xor edx, ebx
call fcn.00b2379c
Function at 0xbdbc32
Capabilities:
Encode data using base64

Disassembly:
mov esi, ebp
mov ebx, 0x47814e0f
movsx ebp, dl
pop ebx
lea ecx, [ecx*8 - 0x526a19e2]
pop edi
mov eax, ecx
pop ebp
call fcn.006f6219
xchg edi, eax
in al, dx
add dword [ecx + 0xb34bb3], ebx
int1
inc ebp
xchg dword [ebx - 0x4d], ecx
add byte [ebp + 7], cl
invalid
shr ecx, 0x41
mov dword [ebp + ecx*2 - 0x96b8], eax
lea edx, [ecx*2 + 0x152c1e1a]
jb 0x880f1d
mov ecx, 0xac1fee17
and cl, ch
mov eax, dword [esi]
mov edx, 0x84b380bf
adc esi, 4
call fcn.00bb424c
mov eax, 0x2a0ff03e
push eax
pop eax
mov eax, dword [ebp + eax*2 - 0x541fe07c]
call eax
mov edi, 0x898496b9
mov ebp, dword [ebp - 4]
movzx ecx, di
jmp 0x88d034
ror word [esp + 5], 0xc8
mov dword [ebp - 4], eax
test ebx, ebx
push 0x88fa931
lea esp, [esp + 0xc]
je 0xb93cdb
mov eax, 0x1d12d1be
push eax
push eax
mov eax, dword [ebp + ebx*4]
xor word [esp + 2], 0x1c0d
dec word [esp + 1]
ror dword [esp + 4], 0xd2
mov dword [esp + 4], eax
dec ebx
call fcn.00b93cc9
Function at 0xbe32c0
Capabilities:
Encode data using base64

Disassembly:
call fcn.007d8815
mov dx, word [esi]
mov ecx, 0xd18bee1e
inc ecx
add esi, 2
sub edi, 1
sar ecx, 0x3f
bt ecx, ecx
mov eax, ecx
movzx eax, byte [edi]
and ecx, ecx
rol cx, 0xcd
xor al, bl
sal cl, 4
btc cx, cx

Function at 0xbe4842
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x3ab2ee9d
mov dword [esp], eax
jmp 0xc124b2

Function at 0xbe8f30
Capabilities:
Authenticate hmac

Disassembly:
add esi, 4
xor ecx, ebx
movsx eax, dx
xor al, 0x10
shl edx, 0x89
lea ecx, [ecx + eax - 0x361d5633]
bts dx, dx
cwde
inc eax
neg ecx
sar edx, 0xe6
xor dl, dl
ror ecx, 1
lea ecx, [ecx + edx*2 + 0x388053b4]
sub eax, edx
xor ecx, 0x7808cf84
sar edx, 0x47
sbb al, al
sal edx, 0x96
xor ebx, ecx
sal edx, 0x46
add ebp, ecx
movzx ecx, byte [edx + esi]
lea esi, [esi + edx*8 + 1]
xor ax, 0x6f19
cmovle eax, edx
or ax, 0x7e03
xor cl, bl
btc ax, ax
adc edx, 0xe32dd31b
rol ax, 0xe6
sbb cl, 0x11
add ax, dx
lea eax, [eax + edx + 0x670d3f2e]
jae 0x751fb4
ror cl, 1
inc edx
not cl
sal edx, 0xf
adc cl, 0x22
idiv eax
xadd edx, eax
ror cl, 1
add eax, 0x5108df28
xor cl, 0x36
xor bl, cl
sal edx, 0x8b
lea eax, [eax + eax*4 - 0x45e45e63]
imul dx
push esi
jno 0x858d4f
cmovae edx, eax
bts edx, 0x2f
push ebp
shr dx, 0x61
bts edx, edx
xor eax, eax
push ebx
lea ebp, [eax + eax - 0x22e3ceff]
mov ebp, edi
shl dl, 0x25
mov ebx, ecx
mov edx, ebx
bts ax, 0x9f
shl edx, 2
jmp 0x8ac5de
jmp 0x8c7011
mov eax, ebp
jmp 0x78e747
dec eax
btr ecx, 0xa3
or edx, ecx
rol eax, 2
xadd cl, dh
xor eax, 0x1a2eb186
mov dword [esp + eax*2 - 0x5b78ae66], ebp
call fcn.007633ac
mov edx, 0x82223901
mov ecx, dword [esi]
jmp 0x847296
Function at 0xbf3042
Capabilities:
Encode data using xor

Disassembly:
dec dl
bswap eax
xor al, 0x35
xor ecx, ecx
rol dl, 1
sub dl, 0x9b
and ecx, 0xca19003b
btc ecx, 0x27
neg ecx
xor bl, dl
idiv cl
neg ecx
add edx, esp
btc eax, eax
mov cx, word [edx + ecx - 0x80]
movsx edx, ax
jae 0xbb3068
mov eax, 0xd127258a
mov eax, dword [ebp]
mov ecx, 0x3516f410
mov ecx, dword [ecx + ebp - 0x3516f40c]
mov edx, 0xed81a518
push edx
mov dword [esp], ebx
mov ebx, edx
push edx
cpuid
ror byte [esp + 3], 0xc4
sbb ebp, 7
call fcn.007cabcc
jno 0x79bf57
mov al, 0x6a
inc byte [eax + 0x56f0f2fe]
enter 0x67e2, 0x62
invalid
xor ecx, ebx
imul ax, dx
lea ecx, [ecx + eax - 0x50d9101d]
inc al
push eax
rol ecx, 2
mul ax
bswap ecx
sal dword [esp], 0x4a
xadd byte [esp + 2], al
not ecx
ror eax, 1
xor ecx, 0xa812b80e
xor edx, edx
add dword [esp + edx*2], 0x1d9d8eb3
and edx, eax
xor ebx, ecx
rol ax, 0x6c
jb 0xb63aa3
sbb ebx, dword [ecx]
add bl, byte [ecx + 0xb0be3f]
adc cl, byte [eax + 0xb0be13]
push ecx
out dx, al
xor edi, dword [esi - 0x26b6ff50]
sbb esi, dword [edi - 0x56]
add dh, bh
mov dh, 0x45
mov ch, 0x34
xchg dword [eax], eax
jge 0x8bfb49
cmc
mov al, 0x19
add dword [eax], 0x1998b366
add dword [eax], 0xcd10b106
lea eax, [eax]
mov dh, 0x4d
test eax, 0xd01a9930
xor edi, esi
popal
pop edi
jns 0x8bfbb5
invalid
xor bh, bh
mov edi, 0xff32612d
cmp dword [edi], edi
popal
xor bh, bh
jns 0x8bfb4f
popal
popal
xor bh, bh
jge 0x8bfb81
pop ds
xlatb
sahf
push ds
push ecx
mov ecx, dword [ecx + ebp - 0x12f2da7]
mov edx, 0x2a25233a
shl dl, 0x25
neg dx
lea ebp, [edx + ebp - 0x2a25dcbc]
lea eax, [edx*4 + 0x5d3cc3b2]
xor ecx, ebx
inc byte [esp + edx*2 - 0x544bb97f]
neg ax
jbe 0xbb795f
test dword [ecx - 9], 0xc5bf0fde
ror al, 0x42
adc ebp, ecx
inc byte [esp + edx + 2]
shr edx, 9
setae byte [esp + eax - 0x6bcc3571]
pop eax
jns fcn.00749c6d
mov edx, 0x98f2231
mov ecx, edx
not edx
movzx ax, byte [esi + ecx - 0x98f2231]
xadd ecx, edx
not dl
sbb edi, 2
cwde
dec ax
mov word [edi], cx
mov ecx, 0xa023a29e
lea eax, [eax*2 - 0x2866dcf8]
mov ecx, dword [esi]
add esi, 4
sub dx, 0x1fac
xor dl, ah
js 0x8bfa71
mov ecx, dword [ecx + ebp - 0x18b82004]
mov eax, edx
lea ebp, [eax + ebp - 0x2c90d405]
imul edx, edx
push ecx
movzx ecx, dx
bt eax, 0xa2
mul cx
popfd
mul dl
rol eax, 0xfa
jmp edi
call fcn.007931c3
mov ecx, 0x49b85e14
movsx edx, cl
ror dx, 0x88
movzx edx, byte [esi + ecx - 0x49b85e14]
mov eax, 0x8431a9b0
shr ecx, cl
cbw
lea esi, [ecx + esi - 0x49a]
sar ecx, cl
shr ax, 0x69
sal eax, 0x22
xor dl, bl
add ecx, eax
not dl
dec eax
jno 0x891d6b
mov edx, dword [edi]
mov ecx, 0x1b57418
lea edi, [edi + ecx*2 - 0x36ae82c]
xor edx, ebx
neg edx
dec edx
neg edx
movsx eax, cx
ror ax, 0xaa
btr ecx, ecx
inc edx
push ecx
inc dword [esp + eax - 0x61d]
not edx
dec edx
bswap edx
xor ebx, edx
shl ecx, 0x67
adc esi, edx
add word [esp + ecx - 0x5aba0c00], ax
mov ecx, dword [ebp + eax*2 - 0xc3a]
movsx edx, al
and dx, 0x5617
mov dx, word [ebp + eax*4 - 0x1870]
shr dword [esp + eax*2 - 0xc3a], 0x95
lea ebp, [ebp + eax - 0x617]
mov word ss:[eax + ecx - 0x61d], dx
mov ecx, eax
mov dword [esp + eax*8 - 0x30e8], esi
ret
mov eax, dword [ebp + eax*2 - 0x323f4c68]
push 0x99957328
jmp 0xbc2381
Function at 0xbf71e6
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edi + 4]
mov dword [esp], eax
call fcn.007396f3
xor al, byte [esi]
enter 0xffffffffffff9c80, 0
pushfd
pushal
enter 0xfffffffffffff550, 0xffffffffffffffc0
pushfd
pushal
enter 0xffffffffffffe460, 0x60
pushfd
pushal
enter 0xffffffffffffc470, 0x68
pushfd
pushal
enter 0x65f0, 0x60
pushfd
pushal
enter 0x5ca8, 0x18
pushfd
pushal
enter 0xffffffffffffad78, 0xffffffffffffffd0
pushfd
pushal
enter 0x45f0, 0x2d
invalid

Function at 0xbf7615
Capabilities:
Encode data using xor

Disassembly:
shr eax, 8
push 0xd4b1c3a8
xor eax, ebx
dec dword [esp + 8]
add word [esp + 2], 0x359f
call int.00bf5841
xchg ebp, eax
xchg ecx, eax
pop eax
add byte [ebx + 0x47], dh
dec edx
invalid

Function at 0xc0c5e3
Capabilities:
Authenticate hmac

Disassembly:
xor ecx, 0xbe3447af
or al, 0x25
mov dword [esp + eax - 0x4a2], eax
xor ebx, ecx
xor dword [esp + eax*2 - 0x948], edx
jl 0xb5281d
ja 0x8106a6
adc ebp, ecx
mov dword [esp + eax - 0x4a5], ebp
ret 4
xadd ax, dx
adc ecx, 0xa69ee4b8
btr eax, edx
xor ecx, 0xc03a6414
mov dword [esp + eax*2 - 0xc], 0xc390182f
imul eax
inc ecx
btc eax, 0x3d
cwde
shl eax, 0xc5
not ecx
jne 0x7cb120

Function at 0xc11ed8
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + esi - 0x5907f5bc], edx
dec esi
lea edx, [ebp + ecx*8 - 0x15fc3263]
inc ecx
xor esp, 0x2cb11c08
movzx eax, cx
inc edx
sal byte [esp + ecx - 0x5506], 3
shr word [esp + ecx*2 + 0x14c50acc], 0xcd
inc ecx
bswap esp
inc esp
movzx esi, bp
inc ecx
setb dl
cwde
dec esp
mov dword [esp + ecx + 0xa628564], edi
btr dx, ax
inc bp
sbb esi, ecx
jg 0x7d9a3b
inc esp
xor dword [esp + ecx*4 + 0x298a1590], esp
dec ebp
btc eax, eax
inc ecx
pop edi
dec eax
lea edi, [eax + ebp*8 - 0x23cea27d]
jae 0x812334