joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb5be21
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov ecx, dword [edx + ebp - 0x5f8fc480]
movsx eax, dx
xor eax, eax
not eax
lea ebp, [ebp + edx - 0x5f8fc47c]
dec eax
not dl
rol dx, 0x23
xor ecx, ebx
not ecx
shl dx, 0xf
add al, 0x28
neg ecx
ror edx, 0xde
inc al
ror ecx, 1
xor ecx, 0x1b27eaa8
not dl
sub ecx, 0x9782ee1a
neg ax
cwde
dec dx
xor ecx, 0xf6b39d22
bt eax, 0xa3
shr dx, 0x28
bswap eax
dec ecx
btc edx, edx
dec eax
rol dl, 0xc7
xor ebx, ecx
add esi, ecx
jmp esi
inc ecx
bswap eax
not bl
inc eax
xor ch, bl
dec edi
lea edx, [edi + edi*4 + 0x6a8c1494]
inc ecx
movzx edx, dl
dec eax
lea ebx, [esp + ebx + 8]
or ecx, 0xfe0a4823
dec edx
and dword [esp + eax*2 - 0x7ca7d662], 0x6a9b8eb3
inc dx
mov edx, dword [ebx + eax*2 - 0x7ca7d662]
dec edx
lea eax, [eax*4 + 0x6536b39b]
inc ecx
shl edx, 0xee
inc edx
sets byte [esp + eax*2 - 0x7ca7d660]
dec edi
lea ecx, [ecx + eax*2 - 0x7ca7d664]
inc cx
sal edi, 0xc4
dec ecx
sal edx, 0xec
inc si
and dword [esp + eax - 0x3e53eb30], edx
inc bx
mov dword [ecx + eax*2 - 0x7ca7d662], edx
inc ebp
bt esi, eax
inc esi
mov esi, dword [edi + eax - 0x3e53eb31]
inc edx
setae byte [esp + eax*2 - 0x7ca7d65e]
dec ecx
lea edi, [eax + edi - 0x3e53eb2d]
ror cx, 5
inc esp
xor esi, ebp
inc ecx
inc esi
inc ebp
or bh, bl
inc dx
rol dword [esp + eax - 0x3e53eb2d], cl
dec esi
xadd dword [esp + eax - 0x3e53eb31], edi
inc ecx
not esi
inc ecx
neg esi
shl eax, cl
dec esi
xor dword [esp + eax - 0x3e53eb31], eax
inc ecx
bswap esi
inc ecx
push edx
inc esi
and byte [esp + edi - 0x6a0000a4], bl
inc ecx
dec esi
inc ecx
xor esi, 0xe499700e
inc cx
dec edx
inc ebp
movzx esp, bx
inc cx
sal ebx, 4
dec edx
mov dword [esp + eax - 0x3e53eb29], ebp
jns 0xbd6821
dec eax
imul ecx
inc esi
xor dword [esp + edi - 0x6a0000a8], esi
inc ecx
ror edi, cl
jae 0xc8247c
dec ebp
add edi, esi
inc esp
xor eax, ebp
inc ecx
xor eax, 0x23225a3d
push edx
dec eax
lea eax, [esi + edx*4 - 0x78d7ece4]
not esi
inc ecx
ror eax, 3
inc ecx
add esp, 0x59b5472b
inc ecx
push esp
inc ecx
xor eax, 0xbe204697
inc ecx
dec eax
inc esp
movsx ebx, al
inc ecx
pop ebx
inc ecx
ror eax, 2
inc ecx
pop edx
inc ebp
bts ebx, ebx
dec eax
bt esi, edx
push ebp
inc edx
bswap edx
mov ebp, 0x6c1f203c
inc esp
xor dword [esp + edx - 0x6cffffff], eax
pop ebp
jmp 0x7959aa
call fcn.00be30b4
mov ecx, 0x5fa17ebd
movzx edx, cl
dec edx
mov ecx, dword [ecx + edi - 0x5fa17ebd]
lea edx, [edx*2 + 0x5f8ff19a]
movzx eax, dx
btc ax, 8
mov al, byte [edi + edx - 0x5f8ff30e]
shl dx, 0x66
lea edi, [edi + edx - 0x5f8fc47a]
mov byte ss:[ecx + edx - 0x5f8fc480], al
jnp 0x76d378
movzx ebx, byte [edi]
inc ecx
mov edi, 0xaca1f039
dec edi
lea eax, [edi + edi*8 + 0x2039c636]
inc ecx
mov ebx, 0xc729533e
dec eax
add edi, 1
inc bp
bts eax, ebx
inc eax
xor bl, ch
inc ecx
mov ecx, edi
rol cx, 0xe8
inc esp
movsx esi, cl
neg bl
not bl
neg bl
inc bp
bt edi, eax
inc ecx
push esi
adc bl, 4
inc bp
xchg ebx, eax
jmp 0x78f819
dec edx
mov ebp, dword [esp + edi - 0x160d3f8]
bt ax, 0x9e
dec ebp
arpl si, si
inc edx
setae byte [esp + edi*2 - 0x2c1a800]
dec ebp
adc ebp, esi
pop edx
pop ebx
jmp fcn.0079a4c9
Function at 0xb62a1e
Capabilities:
Encode data using xor

Disassembly:
inc bp
imul esi, edx
inc ebp
mov dword [ecx + edx - 4], eax
xchg esi, eax
inc ebp
movzx eax, dx
inc esp
mov esi, dword [eax + edi - 0x336a2208]
dec eax
mov dword [esp + eax - 0x336a220c], eax
dec eax
inc eax
dec edx
lea edx, [esi + eax*2 - 0x72e32548]
inc esp
xor esi, ebp
inc ecx
bswap esi
inc ebp
lea esi, [esi + eax*2 - 0x3b8fc67]
dec eax
not dword [esp + edx*2 + 0x5475d140]
inc ebp
movsx esp, ax
dec ecx
inc esp
inc ecx
neg esi
inc cx
or edx, edx
inc ecx
pop esp
inc ebp
lea esi, [esi + edx - 0x22619f8e]
inc ebp
adc edx, edx
push ebp
push edx
inc esp
xor dword [esp + eax - 0x336a2205], esi
dec word [esp + eax - 0x336a220b]
mov ecx, edx
inc ecx
dec ah
dec eax
mov ebp, dword [esp + eax - 0x336a2205]
xor esi, 0x9189be38
dec ebp
arpl si, si
cwde
dec ebp
adc ebp, esi
movzx esi, word [edi + eax - 0x2205]
inc ecx
and edx, eax
dec eax
lea edi, [edi + eax - 0x2203]
movsx ebx, dl
inc ecx
pop esi
dec eax
mov dword [esp + eax - 0x220d], ecx
xor si, bp
inc ecx
push esp
dec eax
rol dword [esp + eax - 0x2205], 0x25
not si
and dword [esp + eax - 0x2204], edx
dec si
rol si, 1
dec ecx
shl eax, 0xe3
call fcn.0074aa21
Function at 0xb6b5d2
Capabilities:
Encode data using xor

Disassembly:
movsx ecx, dx
mov eax, edx
dec ebp
mov dword [ecx], edx
inc esp
movsx esi, dl
inc esp
mov ebx, ecx
dec ecx
ror ebx, cl
inc esi
mov eax, dword [edi + esi*2 - 0xaa]
dec ecx
adc ebx, 0xd6968505
dec ebp
lea edx, [ebx + ecx*2 + 0x7b01ba1f]
dec ebx
lea ebx, [ebx + edx*2 + 0x5a1d812e]
dec edx
lea edi, [edi + esi*2 - 0xa6]
inc esp
xor eax, ebp
inc ecx
sub al, dh
dec eax
neg edx
inc ecx
xor eax, 0x1a2c61aa
inc ecx
rol eax, 1
inc ebp
movzx edi, bl
inc ecx
dec eax
inc cx
neg edx
dec esi
lea ebx, [edx*8 + 0x78b71bb5]
dec ecx
not edx
inc ecx
bswap eax
inc ecx
ror eax, 3
push ebp
inc esi
xor dword [esp + esi*8 - 0x2a8], eax
inc ecx
bts esi, eax
inc ecx
sub esi, 0xf3aaf836
pop ebp
inc ecx
movzx esi, bh
dec ebp
arpl ax, ax
adc bl, dl
inc eax
sbb dl, dh
dec ebp
adc ebp, eax
inc ecx
dec dl
dec eax
xchg ecx, edx
inc esp
xadd dl, bl
inc ecx
jmp ebp
neg ecx
xadd dword [esp + ecx - 0x6c], ecx
xor eax, ebx
sar edx, 3
xor eax, 0x41d15a3
pop ecx
lea ecx, [edx + edx - 0x234cddf2]
xor edx, ecx
neg eax
btr ecx, ecx
push ecx
sar dword [esp + edx*2 - 0x4699bc00], cl
dec eax
call fcn.0073e906
add bl, 0x16
inc esp
movzx edx, byte [esp + ecx*2 - 0x12621]
inc ecx
pop eax
not byte [esp + ecx - 0x9314]
neg bl
ror word [esp + ecx*4 - 0x24c50], 5
dec eax
not dword [esp + ecx*8 - 0x498a8]
call fcn.00bb7a0b
pop ebx
aaa
cli
jnp 0xb6b59b
jecxz 0xb6b635
in al, 0x85
sahf
xchg ebx, eax
mov ebx, 0xd885e42f
not ebx
das
in al, 0x85
test byte [edi + 0x51f9d8c], ah
test dword [edi + 0x51f9d8c], eax
xor esi, dword [edi - 0x7c]
out dx, al
add eax, 0x516dfcb3
stc
outsb dx, byte [esi]
mov ecx, 0xab58a8a3
xchg esp, eax
push ss
sti
push esi
cmp al, 0x44
dec edx
loop 0xb6b613
inc edx
jne fcn.00b6b661
sub esp, dword [eax + esi*4 + 0x3126ec9b]
xor al, 0x6c
movsb byte es:[edi], byte [esi]
mov al, 0x9b
in al, dx
xor dword es:[esp + ebp*2], esi
sub edx, ebx
lcall 0xfeda, 0x296c6ce9
push ebp
inc eax
insb byte es:[edi], dx
sub edx, ebx
stosb byte es:[edi], al
fstp qword [eax - 0x59]
push 0x8d05b6cf
mov ah, 0x31
mov edx, 0x830fffff
lcall 0x748b, 0x44ffc29d
inc esp
mov esi, dword [edx + edi + 3]
and dword [esp + edx + 0xa], 0x9945f1a
mov byte [esp + edx + 0xa], 0xe
dec edx
lea edi, [edi + edx - 0x62a726f9]
inc ecx
movzx eax, ax
neg dx
inc esp
xor esi, ebp
inc edx
movsx esi, byte [esp + edx - 0x62a726f3]
dec eax
inc esi
inc ecx
bswap esi
dec ecx
mul edi
inc esp
and bh, bl
inc ebp
adc esi, eax
add al, bh
and si, dx
inc ecx
neg esi
shl bx, 0xe2
neg word [esp + edx*2 + 0xf]
dec ecx
ror edi, cl
inc esp
adc esi, edx
dec esp
lea esp, [ecx*2 - 0x7648866b]
inc esi
xor eax, dword [esp + edx - 0x62a726ee]
inc ecx
rol esi, 2
shl word [esp + edx + 9], 0xca
call fcn.00cd65a4
mov edx, 0x309e15aa
dec ecx
mov ebx, dword [ecx + edx - 0x309e15aa]
not edx
dec esp
mov edx, dword [ebx]
jmp 0x718959
Function at 0xb71e17
Capabilities:
Authenticate hmac

Disassembly:
movsx ecx, dx
add edi, eax
movzx eax, dl
dec edx
rol eax, 0x23
xor al, byte [esi + ecx*8]
not ecx
mov cl, byte [esi + 2]
sub edx, 0x89c410
or dx, dx
jns 0xb6300e
mov word [esi + edx*2 - 0x1120130], ax
movzx ecx, dx
ror edx, 0xc3
btr dx, dx
jmp edi
adc esi, 2
not edx
shr dx, 0xe9
shr al, cl
ror dl, 0xe2
jb 0x7df789
lea edx, [esp + edx + 4]
rol cl, 0x66
bts eax, eax
mov dword [esp + eax*2 - 2], ecx
mov eax, dword [edx + eax*2 - 2]
pop ecx
mov edx, 0xb303910c
add dx, dx
mov edx, eax
lea eax, [ecx + ecx*2 - 0x5078b579]
shr eax, 0x7c
not eax
movzx eax, byte [esi - 2]
inc cl
xor al, bl
rol al, cl
shl cl, cl
shl cl, cl
sub cx, 0x580d
sbb al, 0xb5
sub ecx, ecx
xor al, 0x1c
btc ecx, ecx
inc ecx
ror al, 1
xor bl, al
call fcn.00c70f7b
mov ecx, 0x8eac0995
sal cl, 0x44
movsx edx, cx
mov dx, word [edx + ebp - 0x950]
bt ecx, 0xaa
xor ecx, 0xc48b3f23
mov ax, word [ecx + ebp - 0x4a273671]
bts ecx, ecx
sbb ecx, 0x91832119
ror cl, 0x66
mov cl, byte [ebp + 4]
js 0xb52911
xor ebx, eax
shl edx, 0x1f
jp 0x7dea7f
mov ecx, 0xcfbe619b
mov ecx, dword [ebp]
mov eax, 0x9ab5f5a1
add ebp, 4
shl ax, 0xcd
xor ecx, ebx
neg eax
neg ecx
sar al, 0x41
btr eax, 0xaf
ror ecx, 3
lea eax, [eax + eax*2 - 0x23c41bd3]
inc ax
sal ax, 0x47
bswap ecx
sar al, 0xe1
sar al, 6
sub ax, 0x9927
lea ecx, [ecx + eax - 0x1dc82215]
sbb al, ah
xor ebx, ecx
add esi, ecx
lea ecx, [eax - 0x36cb3c7]
mov ecx, dword [eax + edi - 0xc1b7d5b]
sal eax, 0xca
mov eax, dword [edi + eax - 0x6df56bfc]
push 0xf3a31dba
inc word [esp + 2]
adc edi, 4
mov dword [esp], 0xd1ad79b3
sar dword [esp], 0x95
call fcn.00a8e05c

Function at 0xb7991f
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
mov ecx, dword [esi + edx - 0x60f6840]
sal eax, 4
cwde
cbw
xor ecx, ebx
mov dword [esp + edx*8 - 0x307b4200], eax
sub word [esp + edx - 0x60f6840], 0xebbb
sbb ecx, 0xe49d5522
mov word [esp + edx - 0x60f683f], 0x7c9e
btr dx, dx
ror ecx, 1
bts edx, 0xa2
neg ecx
dec ecx
xadd dword [esp + edx - 0x60f6844], edx
not ecx
adc ecx, 0x3a3babac
pop edx
xor ebx, ecx
inc dl
lea edi, [edx + edi - 0x58c066e]
btr eax, edx
mul eax
mov dword [edi + eax*4 - 0x441000], ecx
mov ecx, 0x2e34ef30
lea edx, [ecx + edx - 0x6ce7b244]
lea esi, [esi + eax*2 - 0x220804]
sbb dl, ah
mov ecx, dword [esi + eax*4 - 0x441000]
xor ecx, ebx
push eax
cdq
ror ecx, 1
neg ecx
shl dl, 0x67
mul al
rol byte [esp + edx + 1], 0x23
not ecx
not dx
adc eax, 0xbd952eb8
push eax
ror ecx, 1
ror dword [esp + edx*8 - 0x7fff8], 0x85
sub eax, edx
call fcn.00a91b6d
Function at 0xb831af
Capabilities:
Encode data using xor

Disassembly:
sar dword [esp], 9
ror dword [esp + 2], 0x76
dec eax
call fcn.00c84e15
mov eax, 0x4aab3ebc
cwde
mov ax, word [eax + ebp - 0x3ebe]
xor ax, bx
call fcn.00b39ef1
and byte [eax - 0x7a], dh
jge 0x77b458
push ebp
invalid
inc cx
ror eax, 1
pop ebx
dec edx
lea esi, [edi*4 + 0x1a12e10b]
dec esi
mov dword [esp + edx*2 - 0xda44], edi
inc cx
add eax, 0x4166cba4
sal esi, cl
inc ecx
adc edx, 0x192195a2
inc cx
not eax
dec ecx
cmovp edx, esi
inc cx
xor eax, 0x41669eae
not eax
inc cx
sub eax, 0x8d4ef583
and al, 0xb5
or ch, byte [esi]
adc byte [ebx + 0x4c46de9], bh
add byte [ebx], dh
xor esi, edx
push 0x90adfdbe
and esi, 0xff
mov esi, dword [esi*4 + 0xb25f00]
mov dword [esp + 4], 0x8f88c43e
inc dword [esp + 4]
shr dword [esp + 4], 0x86
shr edx, 8
not word [esp + 2]
xor edx, esi
not byte [esp + 6]
inc ecx
xor edx, 0x1b9c64b7
jmp 0x77b458

Function at 0xb8be8f
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [ebp + edx - 0x7fd10465]
movzx eax, dl
lea edx, [edx + eax*2 - 0x7558e0fb]
jbe 0xbf5b61
mov edx, dword [edx + ebp - 0xa782430]
jnp 0xbfc9f3
in eax, dx
jp 0xb8beff
jge 0xb8bf18
push 0x22a7effd
sbb eax, 0xb0cf0a33
add byte [esi], cl
and ah, byte [esi]
or cl, ch
jae 0xb8bf13
ljmp 0xca71:0x73cd0a96
push 0xd
cmp byte [ebx], dh
les ebx, [edi]
stc
cmp bl, ch
les ebx, [edi]
rcl dword [ebx - 0x3c], 0x5f
add byte [ecx - 0x2b3d35ba], ah
mov eax, dword [0xd4c2ca46]
pop esi
cmp dword [ebx - 0x1f], ecx
cmp esp, dword [esi + 0x1f]
mov al, byte [0xeb140729]
lds esi, [eax]
iretd
call fcn.00b1774a
add edx, esp
mov byte [edx + ecx*2], al
movzx eax, cx
add ecx, dword [esi + ecx*2 - 5]
lea esi, [esi + eax*4 - 5]
cdq
mul edx
push eax
xor ecx, ebx
shr eax, 0xd1
xor ecx, 0xd484c63c
and eax, dword [esp + eax]
bswap ecx
shl eax, 0xd2
neg ecx
not dword [esp + eax*4]
inc eax
bswap ecx
xor ebx, ecx
shr edx, 0xd4
setae byte [esp + eax]
cdq
adc ebp, ecx
movzx ecx, byte [esp + eax*8 - 8]
mov ecx, dword [edi + eax*8 - 6]
mov eax, dword [edi + eax*4 + 2]
not ecx
call fcn.00b65364
mov eax, dword [edi]
mov edx, 0x8209a1a6
add edi, 4
imul edx, edx
mov esi, eax
mov ecx, edx
xadd dx, cx
lea ebp, [ecx*2 + 0x45137e1a]
mov ebp, edi
bt edx, edx
shl ecx, cl
movsx eax, dx
jne fcn.00b8297b

Function at 0xb8eb00
Capabilities:
Authenticate hmac

Disassembly:
adc al, 0x82
xor ecx, ecx
xor bl, al
call fcn.007d5fea
add ecx, 0xb6a53d11
xor al, bl
add al, 0x2e
bts dx, cx
mov dword [esp], 0x7164ea4
xor al, 0x26
shl byte [esp + 3], cl
sbb al, 0x99
shr edx, cl
shr edx, 0x53
btc edx, 0x20
not al
sub dx, dx
jp 0x743856
mov edx, 0xe1b7a4ad
movzx eax, dl
lea esi, [esi + eax - 0xb1]
sal al, 0x24
xor eax, 0x318eca9f
mov ecx, dword [eax + esi - 0x318eca4f]
adc eax, edx
shl dx, 0xcc
sar edx, 0xa1
xor ecx, ebx
ror al, 0xa3
not ecx
mul ax
rol ecx, 1
inc eax
lea edx, [edx + eax*2 + 0x711bf88d]
or al, 0xad
dec ecx
add ax, 0xd51d
adc eax, 0x27aba09c
bt eax, eax
neg ecx
cdq
shr eax, 0x50
bswap ecx
mul eax
xor ebx, ecx
inc dl
add ebp, ecx
add ax, 0xbb25
xor eax, edx
mov ecx, dword [edi + edx*2 - 2]
mov al, byte [edi + edx + 3]
jp 0xaa48af
movzx edx, cl
call fcn.00b9ef60
Function at 0xb93bff
Capabilities:
Execute syscall

Disassembly:
not word [esp + esi*2 - 0x5e3531ad]
dec ebp
adc ebp, edx
dec eax
mov dword [esp + esi - 0x2f1a98d0], ebx
inc esp
movzx edx, byte [esi + edi - 0x2f1a98d0]
dec ecx
bt edi, 0x80
dec eax
lea edi, [edi + esi - 0x2f1a98cf]
inc esp
xor dl, ch
inc esp
add dl, cl
dec eax
sar dword [esp + esi*2 - 0x5e3531ad], 0xb
inc ecx
movzx eax, ax
inc ecx
not dl
sal byte [esp + esi - 0x2f1a98cc], cl
cwde
inc ecx
cmove ebx, edi
inc ecx
sbb dl, 0xa6
dec edx
add dword [esp + esi - 0x4c2d], 0x6bbb610d
call fcn.00b79c29
sysenter
push edi
mov dword [esp], 0x256d455b
call fcn.00cbe7fa
mov eax, dword [ecx + edx*4 - 0x3a288004]
mov edx, dword [edi + edx*4 - 0x3a288004]
not eax
not edx
call fcn.00abc9b2
inc edx
dec edx
mov ebp, dword [esp + esi - 0x4c63]
inc esp
sbb esi, ebx
dec ebp
arpl dx, dx
ja 0x70db3a
not dx
xor ebx, ecx
jmp 0xc3792f

Function at 0xb974a1
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [eax + esi - 0x47e0]
xor edx, ebx
mov dword [esp + eax - 0x47e0], eax
movsx ecx, ax
sal byte [esp + eax*8 - 0x23eff], 0x85
bswap edx
ror ax, 0x23
and cx, 0xe713
neg word [esp + eax - 0x8fa]
neg edx
btr eax, 0x39
inc eax
shr dword [esp + eax - 0x8fd], 5
inc edx
sar cx, 0xa5
sbb ecx, ecx
ror edx, 1
call fcn.00c676f0

Function at 0xbab77d
Capabilities:
Encode data using xor

Disassembly:
shr cl, 0xa2
ror edx, 2
inc ax
dec edx
sal ecx, cl
bswap edx
rol ecx, 0xb7
shl ecx, 0x63
rol edx, 2
lea edx, [edx + ecx*8 + 0x7f3d2229]
not cx
cbw
neg cx
xor ebx, edx
dec eax
cbw
add edi, edx
bt ecx, eax
movzx edx, cx
mov dl, byte [esi + ecx*2 - 0xc00002]
mov cl, byte [esi + ecx - 0x5fffff]
shr eax, 0x8d
xadd al, ah
lea esi, [esi + eax - 0x5f8fd]
shr dl, cl
lea ecx, [eax + 0xb188318]
add ecx, eax
cwde
mov word [ecx + esi - 0xb247516], dx
setb al
movsx edx, ax
adc al, 0xb8
jmp edi
sub cl, ah
xor edx, ebx
bswap eax
shr ax, 0x8c
xor edx, 0x60977603
jmp 0x7cba4a
rol ecx, 2
dec ecx
inc word [esp + edx - 0x96ef3ca]
jp 0xc7b353
movzx eax, dl
neg ecx
xor edx, 0x3d36f72b
xor ebx, ecx
or ax, word [esp + edx - 0x345804e4]
jne 0xcb7f13
mov eax, 0x61bab7a0
mov edx, dword [ebp + eax - 0x61bab7a0]
cbw
mov ecx, eax
not ecx
lea ebp, [ebp + eax - 0x61baff9c]
bt cx, 0xaf
jae 0xa8430e
pop edx
rol ecx, 1
movzx edx, byte [esp + eax - 0x3fcf0790]
neg ecx
jmp 0xcbb9ff
Function at 0xbb2453
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec ecx
sal esp, cl
inc ecx
neg edi
xor edx, 0x2385bd89
dec eax
mov dword [esp + edx*2 - 0x470b7b0a], 0x489a4fab
dec edx
mov dword [esp - 0x152c2a60], ebp
inc esi
xor dword [esp - 0x152c2a60], edi
inc ecx
dec ebx
sal ax, 0x6f
inc ecx
shl dh, 0xc6
dec edx
mov ebp, dword [esp - 0x152c2a60]
inc cx
not esi
inc cx
sar esi, 0xec
dec ebp
arpl di, di
dec ecx
or ebx, 0x570aaa07
inc ecx
mul ah
dec ebp
adc ebp, edi
inc cx
neg esp
dec ecx
sub esp, 0xa58bbd07
pop ebx
pop eax
pop eax
pop esi
pop edx
jb fcn.0079a4c9

Function at 0xbb4f0a
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [ebp + ecx - 0x6306f992]
mov eax, 0xeb8b07bb
add edx, ecx
inc eax
cbw
mov dword [ebp + 6], edx
mov dword [esp], 0x4631b426
movsx ecx, word [esp]
sal ax, 0x4c
mov ax, 0
mov word [ebp + 4], ax
shl ecx, 0x45
movzx eax, word [esp]
not cl
lea ebp, [ebp + eax - 0xb422]
bt ax, 0x10
lea edx, [ecx - 0x476cbbcf]
jae 0xb4ea57

Function at 0xbb6a1f
Capabilities:
Manually build aes constants

Disassembly:
sets al
sal edx, 2
mov eax, ebp
jmp 0xafbdb0
push 0x36026125
rol dword [esp], 0xf2
add eax, edx
ror byte [esp], 0x61
call fcn.00c4e31a
xor ebx, edx
not ecx
add edi, edx
sar eax, 0xf6
je fcn.00cb8833
not ecx
mov dword [esp + edx], eax
bswap edx
call fcn.00ae073d
mov edx, 0x439fd9d
movsx ecx, dx
movzx ax, byte [edi + edx*4 - 0x10e7f674]
neg edx
ror cx, 0xab
adc dx, cx
mov cl, byte [edi + 2]
sbb edx, edx
bswap edx
lea edi, [edi + edx*2 + 2]
shl al, cl
btc edx, edx
jb 0xcadb09
mov word [edi + edx*4 - 4], ax
lea esi, [edx + esi - 5]
mov ecx, dword [esi + edx*4 - 4]
movsx eax, dx
and edx, eax
neg edx
xor ecx, ebx
bt dx, dx
bts edx, eax
or dl, al
xor ecx, edx
and al, al
setle al
call fcn.00b5d5d3
mov ecx, eax
sar ax, 0x8a
pop ebx
setbe cl
jns fcn.00c409cb
js 0xa906ac
mov eax, 0xd4056a31
mov dword [edi + 8], ebx
movsx ebx, al
bswap eax
lea ebx, [eax + 0x6a2dcd96]
mov dword [edi + eax*2 - 0x62d40ba4], ecx
and ebx, 0xb48ed1ba
mov dword [eax + edi - 0x316a05d4], edx
jl 0xca9088
Function at 0xbc45a0
Capabilities:
Authenticate hmac

Disassembly:
mul edx
mov eax, dword [ebp + eax*2 - 0x4a76726e]
movzx edx, byte [esi - 5]
xor dl, bl
mov ecx, 0x8012589f
inc dl
bt ecx, ecx
ror dl, 1
xor cl, cl
dec ecx
adc dl, 0xbc
bswap ecx
ror dl, 1
and cl, 0x3b
not dl
bts ecx, 0x3e
sbb dl, cl
or cx, cx
xor bl, dl
dec cx
or ecx, ecx
neg cx
add edx, esp
bts ecx, ecx
mov dword [edx], eax
mov eax, dword [esi - 9]
lea edx, [ecx*2 - 0x5ce783cd]
adc esi, 0xfffffff7
push ecx
sub byte [esp + 3], 0x26
sal dword [esp], cl
xor eax, ebx
inc dword [esp]
xor eax, 0x3506d338
add dx, dx
ror eax, 2
dec ecx
bswap eax
shl byte [esp], cl
sbb eax, 0x979e440d
and dword [esp], ecx
call fcn.00caddbe
mov eax, 0x1904d81c
xor eax, 0x200ec230
movzx ecx, byte [ebp + eax - 0x390a1a2c]
mov ebp, 0xd12da921
movzx edx, ax
xor cl, bl
shl ebp, 0xc7
dec cl
xor cl, 0xb
neg eax
cmovp bp, ax
cbw
inc cl
bt edx, eax
neg cl
cdq
push eax
xor bl, cl
pop eax
add ecx, esp
mov edx, dword [ecx]
mov ecx, edx
bt ax, ax
sar eax, 0x2a
mov ebp, ecx
jp 0xaaff1b
jne fcn.00c6b6b7
xor dx, dx
neg dx
xor ebx, ecx
and eax, eax
dec dl
mov dword [ebp - 4], ecx
jne 0x7b9c9f
shld eax, edx, cl
call fcn.00cab88a
jmp 0x7bed6c

Function at 0xbc5ae1
Capabilities:
Authenticate hmac

Disassembly:
mov edx, 0x943e262a
movsx ecx, dx
lea edx, [esp + ecx*4 - 0x9850]
mov ecx, dword [edx + ecx - 0x262a]
mov edx, 0x953b0d80
lea ebx, [edx*4 - 0x7ac70f5e]
mov dword [esi - 4], ecx
shl edx, 0x4d
lea eax, [edx - 0x5a683142]
lea esp, [edx + esi - 0x61b00004]
mov edi, edx
pop ebp
and di, 0xd81
popfd
not edi
cbw
not ebx
pop eax
call fcn.00c143a5
pushfd
mov dword [esp + 4], 0x3229afc4
lea esp, [esp + 4]
call int.0078321f
jmp 0xa82d3a

Function at 0xbc8684
Capabilities:
Encode data using xor

Disassembly:
not dl
inc ecx
not esp
inc ecx
sar al, 0xe4
inc ecx
push edx
dec edx
lea ecx, [eax + edi + 0x2f9a3697]
inc ecx
rol esp, 3
dec edx
mov dword [esp + eax*2 - 0x19fd8], ebp
call fcn.007192b5

Function at 0xbcc905
Capabilities:
Encode data using xor

Disassembly:
neg dword [esp]
mov eax, 0xb8b1fda7
mov dword [ecx], edx
lea ecx, [eax + eax*8 - 0x87d1e4a]
inc cx
lea edx, [ecx + eax*4 - 0x386aaaf5]
mov dword [esp + edx*2 - 0x4044307a], edi
ret
lea eax, [esp + eax + 4]
sal cx, 0x6e
mov dword [esp], ecx
ror ecx, 0xc8
mov byte [eax + ecx*2 - 0x1300000], dl
mov edx, dword [ebp + ecx*2 - 0x1300000]
setne cl
and dword [esp + ecx - 0x980000], 0xa20cbf09
lea ebp, [ebp + ecx - 0x97fffc]
lea ecx, [esp + ecx - 0x97ffb0]
jne 0xb2709b
jp 0xbcc977
ja 0xbcc9a3
xor byte [esi - 0x4d], ah
mov dword [0x9e71c6a8], eax
stc
invalid
inc dword [ecx - 0x75]
xchg esp, eax
adc dword [eax + eax], eax
add byte [eax - 0x40be3975], al
and ebp, 0xf
or byte [ecx - 0x76], al
dec esp
pop ecx
or byte [ebp + 0x1a], al
inc esp
add ah, dh
dec esi
lea ecx, [ebx + ecx + 6]
sal ebx, 0xda
inc ecx
shrd eax, edx, cl
inc cx
shl esi, 0xc9
leave
inc ecx
btc edi, ebx
call fcn.007dbd5a
inc ecx
pop esi
jmp fcn.0079a4c9
Function at 0xbcd2dc
Capabilities:
Encode data using xor

Disassembly:
xor eax, ebx
mov edx, 0xc70aef1a
mov ecx, edx
push ecx
rol eax, 2
bswap eax
sar edx, 0x61
ror eax, 2
neg eax
bts edx, edx
dec eax
xor ebx, eax
neg dl
mov dword [esp + 8], ecx
add esi, eax
sub word [esp + 8], 0x2593
mov dx, 0
lea eax, [ecx*2 - 0x4cfd3df0]
mov dword [esp + eax - 0x4118a040], ecx
mov word [edi + eax - 0x4118a048], dx
add al, ch
jbe 0xcd6fe8
lea edx, [eax*4 - 0x1ae188f5]
mov dx, word [esi + edx - 0x297e8bd3]
mov ecx, eax
ror eax, 0xf9
mov ax, word [esi + 2]
lea ecx, [ecx + ecx + 0x4f169a85]
add ecx, 0x2b3fab0c
mov cl, byte [esi + 4]
push 0x43b8883e
inc byte [esp + 1]
not byte [esp + 1]
adc esi, 4
shld dx, ax, cl
sal byte [esp + 1], 0x64
inc byte [esp + 3]
mov eax, 0xc793cd95
mov word [esi], dx
movsx edx, ax
sbb ebp, 3
jmp 0xcc5e74
movzx eax, byte [ebp + eax - 0x4118a02d]
sbb ebp, 0xfffffff8
lea edx, [ecx + ecx*8 - 0x696d1dd2]
pop edx
xor al, bl
add dl, ch
dec cl
not al
sal dword [esp + 3], 0x70
ror al, 1
jmp 0xb8f7d4

Function at 0xbd1f94
Capabilities:
Authenticate hmac

Disassembly:
xor word [esp + 0xa], 0xe29
test edx, edx
push 0xa900b22f
push 0x1c9f860a
lea esp, [esp + 0x14]
je 0x7782a1
push ebx