joyce8/EMBER2024-capa huggingface dataset:
Function at 0x772299
Capabilities:
Authenticate hmac

Disassembly:
xchg bh, bl
mov edi, dword [esp + 0x20]
call fcn.007c63ea
bts ax, dx
ror ecx, 1
not dword [esp + eax*2 - 0x510bea76]
xor dl, ah
lea ecx, [ecx + eax*2 + 0x23995894]
xchg byte [esp + eax - 0x2885f539], al
call fcn.00b660f7
adc edi, 4
neg ecx
xor eax, ebx
lea eax, [eax + ecx*4 + 0x17907fe3]
neg eax
movsx edx, cx
rol eax, 3
call fcn.00d3e199
inc esp
mov ebx, dword [ebp - 4]
mov edi, 0xed89a3a4
inc esp
movzx ecx, di
inc ebp
xor ebx, eax
mov eax, edi
inc ecx
sub ebx, 0xb9bc5cb7
inc ebp
movsx edx, cl
movzx ebx, ax
inc ecx
neg ebx
shr ax, 0x41
dec eax
cdq
inc ecx
ror ebx, 2
inc ecx
bswap ebx
inc esp
mov esi, eax
inc ecx
push eax
inc esi
xor dword [esp + ecx*2 - 0x14748], ebx
dec eax
lea ecx, [edx + eax*8 - 0x33c9b85e]
inc cx
ror esi, 0xe9
inc ecx
pop eax
jb 0x766ab9

Function at 0x7972a0
Capabilities:
Authenticate hmac

Disassembly:
lea edi, [edi + eax - 0xf2c1406]
cbw
cmovo ecx, eax
bswap eax
mov dword [edi + eax*2 - 0x400581e], edx
and ax, 0x8c3d
mov dword [esp + eax*8 - 0x10006068], ecx
lea esi, [esi + eax*4 - 0x8003038]
mov eax, dword [esi + eax - 0x2000c0d]
pop edx
xor eax, ebx
bswap eax
dec cl
btr edx, 0x22
rol eax, cl
and ecx, ecx
setae dl
call fcn.00aa8db4
Function at 0x79bb54
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edi + eax*2 - 0x220a6e24]
movsx edx, ax
xor ecx, ebx
jmp 0xb6e06b
mov dword [esp + edx - 0x38ace962], edx
add ebp, eax
ror byte [esp + edx*2 - 0x7159d2c0], cl
rdtsc
pop ecx
adc cl, 4
xadd word [esp + ecx*2 - 0x7159d2cb], cx
lea edi, [edi + ecx - 0x38ac7160]
jne 0xb72572
mov dx, word [edi + eax*2 - 0x8fa8]
lea edi, [edi + eax*4 - 0x11f4e]
rol eax, cl
lea esi, [esi + eax*2 - 0x23ea01]
inc ecx
js 0xb42537
mov ecx, dword [edi]
mov eax, 0x11053714
jmp 0x7530f7
sal ax, cl
movzx eax, byte [esi + eax*8 - 0x8c0000]
shl cl, 0xa6
xor al, bl
sar ecx, 0xbc
dec al
neg cx
neg al
dec al
dec cl
bt cx, 0x83
shl cx, 0xcf
rol al, 1
sub al, 0xb7
or cl, 0x19
and ecx, ecx
sar ecx, cl
xor al, cl
inc ecx
and cl, 0xbc
dec al
dec cx
call fcn.00c573f0
inc ax
sal al, 0x81
ror ecx, 1
imul eax, edx
add dx, dx
cdq
xor ecx, 0x8939a58b
sar edx, 0xf4
shl dx, 0xc2
inc ecx
ror ecx, 1
neg ecx
sub dx, ax
or dl, dh
xor ebx, ecx
add ebp, ecx
mov dx, word [esi + eax - 0x73425548]
btc eax, eax
mov ax, word [esi + eax - 0x73425446]
mov ecx, 0x3203e115
mov cl, byte [esi + ecx*2 - 0x6407c226]
adc esi, 3
jmp 0xd233a4
and ecx, 0xd737411d
mov dword [edi + ecx*2 - 0x2048822c], eax
mov dword [edi + ecx*4 - 0x40910460], edx
inc cl
movzx eax, cl
mov edx, 0x238396a8
pop ecx
jg fcn.00a9ba64
movzx eax, cl
rol edx, 2
or cx, cx
bts cx, ax
bt eax, 0xbf
xor edx, 0x679c0128
neg cx
not al
xchg cx, ax
rol edx, 1
not edx
add cx, cx
xor ebx, edx
add ebp, edx
movsx edx, ax
bt edx, 0x38
jae 0x7a428f

Function at 0x7a4737
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx - 0x4b9eec0c], edx
mov ax, word [edi + edx - 0x4b9eec0c]
sub dword [esp + edx - 0x4b9eec0c], 0x699f94a6
add dword [esp + edx - 0x4b9eec0c], 0xf09d559f
mov dx, word [edi + edx - 0x4b9eec0a]
call fcn.00779331
Function at 0x7aa895
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov dword [esp], 0x6c1ee7b7
shrd eax, edx, cl
mov ecx, eax
mov edx, dword [esp]
pop edx
lea edx, [esp + edx - 0x6c1ee77b]
mov eax, 0xf31b6487
push eax
mov dword [edx], ecx
movsx ecx, ax
not word [esp + ecx*8 - 0x32438]
push eax
mov eax, dword [ebp + ecx*4 - 0x19220]
dec dword [esp + ecx - 0x6483]
sar ecx, 0xaa
lea ebp, [ebp + ecx - 0x1d]
movsx edx, cx
pop edx
jae 0xb9741d
shl ax, 0xef
xor bl, cl
sub dword [esp + eax*2 - 0x68000000], 0xa817b934
shr al, 0x45
jae 0x7e3416
push edx
rol cx, 1
btr edx, 5
xor word [esp + 6], dx
shl word [esp + 4], 0x6e
neg cx
jmp 0xcf13ac
invalid
call fcn.007d1fe3
jmp 0x7e340e
lea ecx, [esp + ecx + 8]
not dword [esp + eax - 0x33ffffff]
ror dword [esp + eax - 0x33fffffc], 0x93
xchg ebx, eax
inc eax
mov dword [ecx + eax*2 - 0x68000002], edx
jne 0xb9178d
and dword [esi], edx
wait
jb 0x7e33f1
jae 0x7e340c
mov esp, 0x47898562
arpl word [edi], bx
wait
mov byte [0x9ff071d4], al
mov bh, 0xa
sbb byte [ecx + 0x13], 0x86
je 0x7e34c9
jp 0x7e340e
mov dword [ebx], eax
je 0x7e3428
arpl word [eax + 6], cx
test ecx, ebp
sub edi, eax
inc ebx
jns 0x7e33f7
mov bh, 0x38
or ecx, esi
mov dl, pe_nt_image_headers32
and dword [edx + 0x29e175be], 0xffd545aa
ret 0xcf8e
or esp, 0x47
ljmp 0x4811
push eax
and eax, dword [esp + eax*2 - 0x68000001]
mov eax, dword [ebp + eax*2 - 0x7ffffff]
ja 0xc69f38
xor eax, ebx
xchg word [esp + ecx - 0x18], cx
xor eax, 0x370a34b1
sub ecx, 0x7d336eaa
sal cl, 0xc5
not eax
dec cl
lea edx, [edx - 0x4ef0eae3]
shr dword [esp], 0xea
xor eax, 0xb883826
rol dx, 0x62
not edx
lea eax, [eax + edx - 0x667b1024]
sar dx, 0x8b
bt edx, ecx
ror cl, 0x61
xor ebx, eax
add edi, eax
sar dword [esp + edx - 0x5bd50003], 0x2d
shr cx, 0x6f
mov dword [esp + edx - 0x5bd50003], edi
ret
xchg dx, cx
shl cx, 0x25
ror eax, 3
pop edx
lea eax, [eax + ecx + 0x358a0742]
xor ebx, eax
dec dx
sar ecx, 0x13
shr byte [esp + edx + 0x4448a453], 0x41
add esi, eax
neg cx
add dword [esp + edx + 0x4448a452], 0x623c6c9b
inc ecx
mov eax, dword [edx + edi + 0x4448a456]
setbe byte [esp + ecx + 5]
sal dx, 4
lea edi, [edi + edx + 0x444844b0]
ror dx, 0xa7
or ecx, edx
seta dl
movzx ecx, byte [ebp + edx + 0x44483f04]
sal dx, 0x89
sar dword [esp + edx + 0x4448fe08], 0x9e
lea ebp, [ebp + edx + 0x4448fe06]
call fcn.00af9ab2
push 0xbbb75bb7
xor eax, ebx
sal dword [esp + 9], 0x84
mov edx, dword [esp + 0xc]
not eax
movsx ecx, dl
ror eax, 1
inc eax
jmp 0xc0e21c
rol word [esp + 2], 0x26
push edx
inc cx
movzx eax, dl
not cx
sub cx, 0x719d
xor bx, cx
lea esi, [esi + eax*2 - 0x11a]
push eax
inc eax
btr eax, edx
mov word [eax + esi - 0x8d], cx
movzx ecx, ax
neg eax
cmovo cx, dx
mov edx, dword [edi + ecx - 0x8d]
lea edi, [edi + ecx*2 - 0x116]
cbw
xor edx, ebx
rol byte [esp + ecx - 0x87], 0xe6
xchg dword [esp + ecx - 0x8c], eax
lea edx, [ecx + edx - 0x54b1bf3e]
bswap edx
add eax, eax
ror edx, 1
inc edx
neg eax
sar word [esp + ecx*4 - 0x22b], 0xc
neg cl
xor ebx, edx
xor byte [esp + ecx*8 - 0x396], ah
adc ebp, edx
pop eax
pop eax
pop edx
pop ecx
jmp fcn.00bf54ab
Function at 0x7afd15
Capabilities:
Authenticate hmac

Disassembly:
add ax, cx
mov ecx, dword [edx + ecx*2 - 0x6d9fa1ec]
dec eax
movsx edx, al
mov dword [edi - 4], ecx
lea edx, [edx*2 - 0x38f887ee]
lea ecx, [eax*2 - 0x42dcc7d2]
lea edi, [ecx + edi - 0x4350e740]
btc edx, ecx
pop eax
pop edx
pop ecx
pop edx
jae fcn.00a9ba64
mov edx, 0xabeaa10
mov cx, word [edi + edx*2 - 0x157d5420]
mov ax, word [edi + edx - 0xabeaa0e]
shr dl, 0xe7
lea edi, [edx + edi - 0xabea9fe]
not edx
ror edx, 0x16
or cx, ax
jmp 0xb80dff
sub edx, edx
not cx
mov eax, edx
mov word [edi + edx*8], cx
setg al
call fcn.00d2fafe
neg dl
sub dl, cl
xor dl, cl
ror ecx, 0xb4
jae 0xbe1edf
sbb ecx, ecx
xor bl, dl
and dword [esp], 0x50271f0d
dec cx
xor dword [esp], ecx
lea edx, [esp + edx + 4]
mov dword [edx], eax
lea edx, [ecx*8 + 0x739eca30]
lea ecx, [ecx + ecx*8 + 0x25215f15]
mov eax, dword [ecx + ebp - 0x25215efe]
dec edx
sbb cx, dx
xor eax, ebx
pop ecx
bswap eax
lea eax, [eax + ecx + 0x2fa8e98d]
jmp 0xc4615c
xor ebx, eax
sub ecx, dword [esp]
mov dword [edi], eax
pop ecx
dec ecx
and dx, dx
movzx edx, byte [ebp + 9]
sbb ebp, 0xfffffff6
xor dl, bl
shr ecx, 0x97
inc dl
movzx eax, cx
not dl
add ax, 0x7f34
rol dl, 1
bswap eax
bts cx, ax
neg dl
not eax
ror eax, 0x6a
xor bl, dl
bswap eax
or eax, 0xc92d139b
sar cx, 0x2c
mov word [ecx + edi - 2], dx
adc ecx, 0xce23763f
jae 0xc2bf8f
add cl, 0xa4
sbb edi, 2
lea eax, [ecx + ecx - 0x524201eb]
push ecx
pop ecx
jmp fcn.00aa83ef
push ecx
xor eax, 0xb59278a4
not edx
not cx
and ecx, ecx
bswap eax
dec eax
jmp 0xbd88cb

Function at 0x7b3dd5
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [edi]
mov ecx, dword [edi + 4]
call fcn.00b6f713
inc dx
btc edx, 0x36
dec ecx
bswap edx
bswap edx
ror edx, 0x7b
not ecx
sar edx, 0xd7
xor ebx, ecx
neg edx
bswap eax
add ebp, ecx
mul ax
mov ecx, eax
sar dx, 0xe5
rdtsc
bt ecx, ecx
neg cl
lea edi, [edi + ecx - 0xe9e7f8]
lea ecx, [ecx*2 - 0x6e7c2fa]
ror ecx, 0x42
adc ecx, 0x3cb48c1a
mov dword [edi + 4], eax
inc ecx
lea eax, [ecx*8 + 0x26ae3501]
mov dword [eax + edi - 0x22aafa9], edx
mov edx, ecx
xor edx, ecx
jge fcn.00be75f1
mov eax, 0x2eb6b226
bts ax, 0x30
lea ecx, [eax + eax + 0x39015218]
movzx ecx, byte [edi + eax*2 - 0x5d6d644e]
mov edx, 0x23a5e439
setae dl
call fcn.00b6a771
or al, 0x1b
sub ax, ax
not edx
shr eax, 0xc6
dec al
not ecx
xor ax, 0xf5be
setl al
bt ax, ax
and edx, ecx
call fcn.007b00c1

Function at 0x7bc8b7
Capabilities:
Authenticate hmac

Disassembly:
push ecx
rol dword [esp + edx*2 - 2], 0x5c
pop edx
pop ecx
pop ecx
pop eax
jae fcn.00bbc35d
inc cl
rol dx, 0x6c
inc edx
not edx
xor bl, cl
dec al
add ecx, esp
mov eax, dword [ecx + eax - 0x6fb6d213]
lea esi, [esi + edx*4 - 0x13ef33cf]
not si
mov esi, eax
jmp 0xcaa6c4
Function at 0x7d33ba
Capabilities:
Encode data using base64

Disassembly:
mov edi, edx
mov dword [esp], 0x7f0a5610
pop eax
jae 0xcaa6c4
push 0xcc2c469e
dec ebx
jmp 0xcf92db
call fcn.00b7d66d
call fcn.00d319c7
mov ecx, 0xeaa6e121
btc ecx, ecx
mov edx, dword [edi]
lea ecx, [ecx*4 + 0x5fad0e94]
btc ecx, 0x31
lea edi, [edi + ecx - 0xa4a931c]
xchg ch, cl
lea ecx, [ecx + ecx*2 + 0x758e2680]
movzx eax, cx
xor edx, ebx
lea edx, [edx + eax*2 - 0x54b2cf23]
add ax, cx
shl ecx, 0x19
bswap edx
cmove eax, ecx
btc ax, cx
dec eax
ror edx, 1
inc edx
xadd eax, ecx
sal eax, cl
xor ebx, edx
cbw
xadd ecx, eax
adc ebp, edx
lea edx, [eax*2 - 0x3bed7a6b]
movzx ecx, word [ecx + edi - 0x41c81072]
shl al, 0xe7
setp al
xadd dx, ax
lea edi, [edi + eax - 0xa677]
or dx, ax
xor cx, bx
call fcn.00bb4214
Function at 0x7de461
Capabilities:
Encode data using xor

Disassembly:
xor edx, esi
mov dword [esp + 4], 0x6e2e2980
inc eax
jmp 0xb80615

Function at 0x7df3b2
Capabilities:
Encode data using xor

Disassembly:
dec esi
lea ebx, [ecx*8 + 0x55a06b82]
dec eax
lea ebp, [eax + ebp + 0x5ee90066]
movsx ecx, byte [esp + esi*8 - 0x5fdd]
inc ecx
xor edx, eax
rol edx, 3
inc ecx
add edx, 0x62809083
lea edx, [edx + esi*4 + 0x579afd84]
inc eax
setbe dh
bswap edx
push eax
sbb word [esp + eax + 0x5ee9007c], 0xe32b
lea edx, [eax + edx + 0x71eebfec]
dec ecx
neg edx
dec eax
lea ecx, [eax*4 - 0x4b60abcf]
dec esp
mov dword [esp + esi*8 - 0x5fe0], eax
xor dword [esp + esi*4 - 0x2fdc], edx
dec eax
mov dword [esp + esi - 0xbe9], 0xa016da14
dec eax
neg ebx
not dword [esp + eax + 0x5ee90081]
dec esp
mov eax, dword [esp + eax + 0x5ee90094]
inc esp
mov esi, esi
inc cx
ror ecx, cl
shr esi, cl
dec eax
arpl dx, dx
dec eax
mov dword [esp + esi - 0x5f8], 0x12a3488b
inc ecx
seto cl
inc ecx
sub ebx, 0x85b29409
dec esp
adc esp, edx
dec eax
and eax, 0x3912151e
pop esi
inc ecx
pop ecx
pop ecx
pop eax
inc ecx
pop edx
pop edx
ja fcn.00cb64ad
and ecx, eax
sal dword [esp + 3], 0xd1
not word [esp + 2]
mov eax, 0xbc30ad85
mov dword [edi + 4], ecx
pop edx
shr eax, 0xaa
mov eax, dword [ebp + eax - 0x2f0c2b]
mov ecx, edx
xor eax, ebx
sub eax, 0x80a1c5a2
and ecx, ecx
xchg dword [esp], ecx
inc byte [esp + ecx - 0x7e24fbfe]
xor eax, 0xd29b6e8b
and word [esp + ecx - 0x7e24fbff], 0x35ab
rol dword [esp + ecx - 0x7e24fc00], 0xfc
bswap eax
ror eax, 1
sal dword [esp + ecx - 0x7e24fc00], 0x6b
or ecx, dword [esp + ecx - 0x7e24fc00]
not eax
neg ecx
jg 0xc3bc2e
push edx
xor ebx, eax
xadd byte [esp + ecx - 0x11a03fd], dl
add esi, eax
rol dword [esp + ecx*2 - 0x23407fc], 0xda
movsx eax, cx
mov ecx, dword [edi + ecx - 0x11a03fc]
neg byte [esp + eax - 0x3f9]
mov eax, dword [edi + eax - 0x3f8]
not edx
sbb dx, dx
or ecx, eax
lea eax, [edx + edx - 0x2d896d8]
not ecx
mov dword [edi + 8], ecx
ror ax, 0xe9
mov eax, dword [ebp + 4]
mov ecx, edx
lea ebp, [ecx + ebp - 0xdfff7]
xor eax, ebx
neg ecx
dec dword [esp + 4]
lea ecx, [edx + ecx*2 - 0x5dc852d1]
neg eax
inc eax
imul ecx, dword [esp + 4]
shr cx, 1
bts dx, cx
xor eax, 0x8a30a209
rol dword [esp + ecx*2 - 0x6d5618cc], cl
shr dx, 0xc3
shl byte [esp + ecx*2 - 0x6d5618d0], 0xa2
neg eax
inc eax
xor ebx, eax
pop ecx
inc cx
jo 0xd53784
mov dword [edi + 4], eax
push edx
push edx
btc edx, 0x89
sbb edi, 0xfffffffb
mov eax, edx
and dword [esp + eax - 0xd1df7], eax
mov dword [esp + eax*2 - 0x1a3bfe], esi
ret 8
call fcn.007c8f29

Function at 0x7eaaf3
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
sar word [esp + 0x11], 0xac
call fcn.00c436c8
dec ecx
mov eax, dword [edi]
inc ecx
mov ebx, 0x47808d2d
inc ecx
movzx edi, bl
dec edi
mov ecx, dword [ebx + edi - 0x47808d25]
mov esi, 0x7d99e4b1
inc ecx
movsx ecx, bl
dec ecx
or eax, ecx
dec eax
not eax
dec eax
sub esi, ecx
dec ebx
mov dword [ebx + edi - 0x47808d25], eax
inc esp
movzx esi, dh
mov esi, dword [ebp + edi - 0x31]
inc ecx
movsx eax, bx
jns 0x763903
Function at 0x7f68d6
Capabilities:
Encode data using xor

Disassembly:
dec edi
lea edi, [esi + edi - 0x39a2]
inc edx
mov eax, dword [ebp + esi - 0x39a0]
dec edx
mov dword [esp + esi - 0x3992], ecx
dec ecx
lea ebp, [esi + ebp - 0x39a0]
inc ecx
movzx edx, ch
inc ecx
xor eax, eax
and cl, 0x10
dec ecx
dec ebp
dec eax
lea ebx, [edi*4 + 0x1daab383]
ror eax, 1
inc ecx
xor dl, bl
inc esi
xchg byte [esp + esi - 0x398c], cl
inc ecx
lea eax, [ecx + eax + 0x3d77937c]
bswap eax
ror ecx, 0xf9
inc ecx
push edx
sar byte [esp + ecx - 0x539c885b], cl
inc ecx
adc eax, ecx
btr ecx, edx
sub si, 0xb34
inc ecx
pop ebx
ror eax, 2
inc ecx
sub esi, 0x6587a9bb
add bx, 0x19a6
lea eax, [ecx + eax - 0x48eb3ed5]
inc esp
or esi, dword [esp + ecx - 0x539c8852]
inc cx
adc ecx, 0x2348ef20
not ecx
enter 0x5d41, 0xffffffffffffffff
enter 0xffffffffffffac81, 0x74
jl 0x7f6900
sti
stc
add ebx, dword [eax + 0x30]
xchg ebx, eax
dec eax
xor edi, dword [esp + ecx - 0x539c8861]
xor eax, 0xde90139b
dec ecx
shl ecx, 0x67
inc ecx
ror esi, cl
dec esi
mov dword [esp + esi - 0x79a79df5], eax
inc edx
and byte [esp + esi - 0x79a79df8], 0x3c
inc esp
or byte [esp + ecx - 0x539c8862], dl
dec edx
sub dword [esp + esi - 0x79a79dfd], 0x2b861395
xor dword [esp + esi - 0x302363c], eax
inc eax
sub byte [esp + ecx - 0x539c8864], bh
dec ebp
sub ecx, ebp
inc esi
movzx eax, byte [esp + esi - 0x79a79dfb]
dec esp
mov eax, dword [esp + ecx - 0x539c885c]
dec eax
arpl ax, ax
dec eax
not edx
inc cx
dec esi
dec esp
adc esp, eax
inc ecx
mov eax, edx
dec word [esp + esi*2 - 0x6046c83]
dec edx
mov dword [esp + esi - 0x79a79df4], 0x6703040a
inc ecx
pop edx
pop ecx
jl fcn.00cb64ad
Function at 0x7f7598
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x9da66f3a
lea edx, [ecx*8 - 0x6dd1563]
sal ecx, cl
not eax
shr cx, 0xe4
mov dword [edi], eax
call fcn.00bbaf71
lea esp, [esp + 0x10]
je 0x7f56b2
jmp 0xb47a69
push edi
mov edi, 0xe5bfea87
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
call fcn.007a4ffd
mov eax, ebp
call fcn.00cc398a
mov edx, 0x4891aa92
lea ebp, [ebp + edx - 0x4891aa96]
lea ecx, [edx*2 - 0x1159d75d]
not dx
mov eax, dword [ecx + ebp - 0x7fc97dc7]
not dl
xchg dx, cx
bts ecx, 0xbd
xor eax, ebx
jmp 0xcd6e65
call fcn.00be23c1
call fcn.00c10fed
xor bl, dl
push 0x1015932b
mov eax, 0x20aef7a7
lea edx, [esp + edx + 0xc]
shl dword [esp + eax - 0x20aef7a3], 0x42
mov dword [edx + eax*2 - 0x415def4e], ecx
pop ecx
mov dword [esp + eax*2 - 0x415def4e], esi
ret 4
rol eax, 3
lea eax, [edx + eax + 0x46e06d3b]
xor ebx, eax
call fcn.00ba0936
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edx, 0x4d0e92ae
not ecx
xadd dl, dh
not eax
sar dx, 0xef
sub dx, 0xb81f
or ecx, eax
imul edx, edx
btr dx, dx
mov edx, ecx
mov ecx, 0xecac2084
movzx ecx, byte [ebp - 1]
mov eax, 0xf3296704
ror eax, 0xda
xor cl, bl
btr eax, 0xb5
ror cl, 1
dec cl
shr ax, 0xe6
cbw
neg eax
rol cl, 1
sar al, 0x27
add ax, ax
cwde
neg cl
bt ax, 0xbd
jb 0xc15654
not cl
xor bl, cl
btr ax, ax
add ecx, esp
sub ax, ax
mov dword [ecx], edx
not ax
mov eax, dword [ebp - 5]
xor eax, ebx
xor eax, 0xb80692b
jmp 0xd1ee86
bswap eax
dec ecx
inc dx
bswap edx
sub eax, 0x32a7ae23
bswap eax
lea eax, [edx + eax + 0x198ccb4f]
xor edx, ecx
jl 0xbb3367
mov edx, 0x9e87f913
or edx, edx
mov eax, dword [ebp]
adc ebp, 4
shl dl, 0x84
xor eax, ebx
movsx ecx, dx
xor cl, dl
cmove cx, dx
not eax
lea edx, [edx + edx - 0x3a54914f]
shl cl, 0xa5
sbb eax, 0xab32a997
rol dx, 0x68
neg eax
btc dx, 0x27
jae 0xbe3e37
add edi, 6
shrd edx, eax, cl
mov ecx, dword [esp]
mov dword [edi], edx
rol ecx, cl
mov edx, ecx
inc ecx
mov dword [esp + edx - 0x2ca5b6b2], ebp
ret
mov edx, 0x8fbe628a
ror eax, 3
inc edx
jns 0xc7d4b8
sub eax, 0x702e21b0
xor eax, 0x190fce2b
call fcn.00aa3c70

Function at 0xab43e3
Capabilities:
Encode data using base64

Disassembly:
sub esi, 4
mov ecx, edx
mov dword [esp], ecx
shl dword [esp + 2], 0x54
pop eax
pop eax
pop eax
pop edx
ja fcn.00ba8982
setns al
setbe al
lea esi, [esi + eax - 0x2200e9fb]
xor cl, bl
mov dword [esp + eax - 0x2200ea01], eax
add cl, 0xb3
btc eax, eax
not eax
rol cl, 1
and ax, 0x2911
lea eax, [eax + eax*4 + 0x48bb0734]
sar byte [esp + 1], 0x44
sbb cl, 0xff
or dword [esp + 4], eax
sub al, 0x89
seta al
xor cl, 6
add cl, 0x96
bts ax, 0x2c
jae 0xd2bb07
pop eax
not cl
and dword [esp + eax*2 - 0x4401fc02], eax
push eax
xor bl, cl
call fcn.00bffb21
Function at 0xab81cf
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
rol ecx, 1
xchg byte [esp + eax*2 - 0x25], dh
xchg dx, ax
inc ecx
ror dx, 0x4b
xor ebx, ecx
or edx, dword [esp + eax - 0xb7]
cmovns edx, dword [esp + eax - 0xb7]
adc esi, ecx
pop eax
pop edx
jmp fcn.00aa83ef
movzx edx, ax
mov edx, dword [ecx + edx*2 - 0x1cf28]
mov dword [esp + eax - 0x5781e794], 0x9806cd11
movzx ecx, al
mov dword [edi + ecx - 0x94], edx
cbw
mov edx, dword [esi + ecx*4 - 0x254]
dec word [esp + eax - 0x5781ff94]
jle 0xab81a7
lea esi, [esi + eax - 0x5781ff98]
xor edx, ebx
lea edx, [edx + eax + 0x5f31b22b]
bswap edx
call fcn.00c7355a
neg eax
ror cl, 1
call fcn.007b9082
mov eax, dword [esi]
mov ecx, 0x4bbfdd15
mov dl, byte [ecx + esi - 0x4bbfdd11]
imul ecx, ecx
adc esi, 5
not cx
sal ecx, 0x4f
bt cx, cx
mov byte ss:[eax], dl
movzx edx, cl
lea eax, [ecx + edx*8 - 0x7c7b2ce1]
call fcn.00b82c51
sub eax, 0x48f0ca13
in eax, 0x66
mov esp, 0x86cee1c3
dec ecx
xchg esp, eax
jbe 0xab81fd
add eax, 0x9ab8de39
cwde
int1
dec esi
inc byte [ebp + ecx*8 - 0x48]
rcr byte [eax + 0x63], cl
mov ch, 0xb1
sti
xor al, 0xb7
or byte [eax + 0x1f], 4
invalid
Function at 0xac9fc8
Capabilities:
Authenticate hmac

Disassembly:
shr ecx, 8
push 0xbe1a9891
push 0xd220503f
xor ecx, esi
inc edx
xor ecx, 0x5e9e293c
shr dword [esp + 0xa], 0xba
call fcn.00c689f8
pop eax
jmp esi
xor ecx, ebx
mul eax
adc edx, edx
lea ecx, [ecx + edx - 0x4b4b8124]
bswap edx
imul dl
adc edx, edx
rol ecx, 3
dec edx
jns 0xc7a216
push 0x3b059624
mov dword [esp + 4], esi
lea esp, [esp + 4]
mov esi, 0x8c3398b6
bts esi, esi
movzx esi, byte [edx]
xor esi, ecx
push 0x822bbb93
ror dword [esp], 0x9e
and esi, 0xff
push 0x5126c1a6
rol dword [esp + 4], 0xdb
jb 0xb03117
mov esi, dword [esi*4 + 0x76ab70]
push 0x43873db4
jae 0xc31cd9
jae 0xaa8e4b
mov eax, 0x6b93a5ab
movzx edx, byte [edi + eax - 0x6b93a5ab]
lea ecx, [eax*4 + 0x709bd01a]
and cl, cl
lea edi, [edi + eax - 0x6b93a5aa]
xor dl, bl
sal al, 0xa4
or cl, 0xae
imul eax, eax
not dl
xadd cx, ax
ror dl, 1
rol ecx, 0x7e
xor dl, 0xb2
dec ecx
neg dl
dec cl
dec eax
xor bl, dl
lea eax, [eax + eax*4 - 0x4e6935d5]
add edx, esp
not ecx
mov cx, word [ecx + edx - 0x78455006]
sub esi, 2
mov word [esi], cx
mov ecx, dword [edi]
and eax, eax
movsx edx, al
adc edi, 4
ror ax, 0x21
jae 0xaae7ef
mov eax, dword [esi]
mov ecx, 0xe2ae5c20
mov edx, ecx
or cl, dl
mov edx, dword [esi + 4]
ja 0xb0bdde
mov edx, 0xe8158aaf
push edx
mov eax, dword [edi - 4]
not dword [esp]
sub edx, dword [esp]
xor eax, ebx
movzx ecx, dl
or word [esp + ecx - 0x5f], 0x28b2
neg eax
xchg dword [esp + ecx - 0x5f], edx
inc eax
bswap eax
or dx, dx
xor eax, 0xd2aa3d8a
push edx
xor ebx, eax
mov dword [ecx + esi - 0x63], eax
sub ecx, dword [esp + edx*2 - 0x2fd4fbe1]
mov eax, dword [edi + edx*4 - 0x5fa9f7d0]
lea edi, [edi + edx*2 - 0x2fd4fbec]
add dword [esp + edx - 0x17ea7df1], edx
jp 0xd2cbcd
mov ecx, dword [edi]
mov eax, 0x9e134831
mov edx, eax
add edi, 4
and al, 6
xor ecx, ebx
sub ecx, 0xb63b2fb0
add ax, 0x680e
and dx, dx
setb al
bswap ecx
neg ecx
cwde
call fcn.00768c35
call fcn.00ceb11c
mov byte [esp + edx - 0x17ea7def], 0x9c
xor eax, ebx
bt edx, edx
neg eax
bts cx, 0x95
dec dword [esp + edx*2 - 0x2fd4fbe0]
sbb edx, edx
not eax
pop ecx
lea edx, [edx + ecx*8 - 0xd50d744]
xchg byte [esp + 3], dh
neg eax
call fcn.00b9d2a5
pop eax
pop ecx
jbe fcn.00be75f1
inc ebp
movsx ebp, dl
inc esp
mov esi, dword [esi + ebp - 0x2931750e]
inc ebp
xor esi, eax
inc eax
movsx eax, bh
jmp 0x7fa93b
Function at 0xacfb2f
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x2491380c
call fcn.00c77aca
inc ecx
mov ebp, 0x3da78f38
inc bx
mov edi, dword [edi + ebp*2 - 0x7b4f1e70]
inc ebp
mov ebx, ebp
inc ebx
mov cl, byte [edi + ebp - 0x3da78f36]
inc ecx
pop ebp
dec esi
mov dword [esp + ebx - 0x3da78f38], ebx
inc edx
movzx ebx, byte [esp + ebx*2 - 0x7b4f1e6c]
dec esi
lea edi, [ebx + edi + 2]
inc ecx
movzx esi, bl
sal di, cl
inc bx
mov dword [edi + ebx*2 - 0x7b4f1e70], edi
push ebx
inc ebp
movzx ebp, bl
inc ecx
shl bl, 0x45
dec edx
lea ebp, [ebp + ebx - 0x3da78f04]
inc esi
or bl, byte [esp + ebx*2 - 0x7b4f1df4]
inc edx
add dword [esp + ebx*2 - 0x7b4f1dff], 0x96beda25
inc ecx
movsx eax, ch
inc esp
mov ebp, dword [ebx + ebp]
inc ebp
xor ebp, eax
not dword [esp + ebx + 7]
inc ecx
dec ebp
push esi
mov edi, 0x512bad87
mul esi
inc ecx
neg ebp
dec eax
lea ecx, [edi + 0x69a4e30f]
inc esi
mov edx, dword [esp + ebx - 0x3da78eed]
inc ecx
mul ebx
inc ecx
bswap ebp
jo 0xd31101

Function at 0xaf113d
Capabilities:
Encode data using base64

Disassembly:
inc edi
lea esi, [esi + ebp - 0x65b8e9b8]
ror byte [esp + ecx*4 + 4], 2
and word [esp + ecx + 8], cx
bt ax, 0x33
dec esi
mov dword [esp + ebp - 0x78bea930], eax
jb 0xc033a9
call fcn.007c3994
Function at 0xaf214e
Capabilities:
Encode data using base64

Disassembly:
movzx si, byte [ecx + eax - 0xe8]
dec eax
ror eax, 0x63
inc ecx
pop esi
inc bx
mov dword [edi + esi - 4], esi
dec edi
lea edi, [esi + edi - 4]
dec eax
rol eax, 0x23
sub edi, 0x87b7fb15
jg fcn.00cb64ad
shr edx, 8
shr dword [esp + 8], 0xc6
jp 0x7ed748
inc esp
mov edx, dword [ebp - 4]
inc ebp
xor edx, eax
inc ecx
inc edx
inc ecx
mov esi, 0xb1929c19
inc ecx
movsx eax, si
dec eax
lea edi, [eax + eax*4 - 0x71775145]
inc ecx
ror edx, 1
dec esi
lea ebx, [esi*4 - 0x66d752ee]
inc di
inc ecx
movzx esi, si
inc ecx
inc edx
inc ecx
neg edx
dec eax
cdq
dec eax
and esi, 0xf3909fbc
inc cx
neg esi
inc ecx
push eax
jge 0xb37588
inc esp
xor dword [esp + esi*4 - 0x27060], edx
inc esp
movzx ebp, bh
inc ecx
pop eax
dec ebx
lea ecx, [ebp + ebp*2 + 0x4b6f385]
dec ebp
arpl dx, dx
inc cx
inc esi
dec ebp
add esp, edx
jmp 0xc75187
sar dword [esp + eax - 0xe6], 0x85
dec eax
lea ecx, [esp + ecx + 8]
jp 0xabf949
mov al, byte [0xadf260be]
mov eax, 0xd19136c2
test al, 0x48
push 0x2921a2a
lodsb al, byte [esi]
dec eax
pop ecx
sbb dl, byte [edx]
stosb byte es:[edi], al
add ch, byte [eax + ecx*2 + 0x120ba29f]
add ch, byte [eax + ecx*2 - 0x4e630db0]
xchg esp, eax
cld
push ebx
inc edi
das
mov edx, 0xf17e527c
int 0x5a
invalid
or si, ax
rol ax, 0x29
or dx, word [esi + ebp - 0x9c1f]
dec ebp
lea ecx, [ebp + edi*2 - 0x5c4679e6]
inc esp
movsx edx, di
bswap ecx
inc cx
xor edx, eax
inc cx
xchg esi, edi
inc eax
movzx ebx, bh
ror ecx, 0x41
ror dx, 1
inc ecx
xor edx, 0x5baca687
inc ebp
xor ch, ch
xor dx, 0x35bc
inc ecx
sar dh, 0x82
inc dx
xor dx, 0xa09f
dec ecx
btc edx, ebx
sar ecx, cl
neg dx
dec esp
imul ebp, ecx
inc sp
xor eax, edx
push esi
dec eax
inc ebx
inc cx
mov dword [edi + esi - 0x9c1b], edx
dec ebx
cdq
inc edx
movzx ecx, byte [ebp + ebp*2 - 7]
sar si, 0xec
sal si, 0x89
dec eax
lea ebp, [esi + ebp - 0xf207]
inc ecx
xor cl, al
dec eax
shl eax, 0xb9
dec eax
btr ebx, 0x16
sbb cl, dl
xor cl, dl
inc sp
xor dword [esp + esi - 0xf1fc], ebp
sbb dx, 0xa020
and ax, 0x8a9d
rol cl, 1
inc cl
dec ebp
xadd ecx, ebx
dec eax
shr ebx, 0x8f
dec al
xor cl, 0x14
btr ebx, edx
inc eax
and al, bh
dec eax
cwde
inc esp
xor al, cl
inc esp
and dword [esp + eax - 0xe8], ebp
jp 0xbe2ee6
mov ebx, 0x33f495d0
xlatb
mov edx, 0x4ba78afd
xchg esi, eax
std
mov ah, byte [edi - 0x2214ca9]
mov ah, byte [edi + 0x1e7a8f0f]
xor dword [eax + 0x1d1d8dc7], ebp
or ecx, dword [eax + 0x67f6c04d]
add esi, dword [ebp - 0xc]
loop 0xc752f8
cli
mov ebp, dword [ecx - 0xdf78809]
or eax, 0x84bff209
mov edi, 0x4b566
add dword cs:[esi + 0x2e], 0xbef5b82f
shr byte [0x1a51bcc0], cl
cmpsb byte [esi], byte es:[edi]
ret 0xe2c
stc
add al, 0x6a
retf