joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17778ad
Capabilities:
Encode data using base64

Disassembly:
jmp 0x12dd7e3
dec ecx
xadd ebx, edi
inc ecx
mov cl, byte [esi + ebp*2 - 0x10781b3c]
dec ecx
lea esi, [ebx + edi*2 - 0x16d965cb]
jns 0x171cf55
not al
sub al, 0x13
not cl
lea ecx, [ecx*2 - 0x4b70956e]
xor bl, al
push ecx
lea eax, [esp + eax + 4]
jmp 0x17979fc
xor al, bl
jmp 0x1790925
not edx
mov dword [esp + edx - 0x59ceffff], edx
xor bl, al
shr dword [esp + edx - 0x59ceffff], 0xda
xor dx, 0x2a1d
mov dword [esp + edx - 0x59ced5e2], edi
seta dl
push ebp
push edx
not dword [esp + edx - 0x59ced501]
call fcn.0177fdfa
push 0xdd8f841d
add al, 0x8c
mov al, byte [0x9b3526e2]
lcall 0xc974, 0x3aca745a
movsd dword es:[edi], dword [esi]
mov ebx, dword [edx]
stosb byte es:[edi], al
add cl, cl
movsd dword es:[edi], dword [esi]
mov ecx, esi
mov esi, 0x8ba5c90c
inc edx
xchg byte [eax], bl
leave
movsd dword es:[edi], dword [esi]
mov esi, dword [esi - 0x4e]
and cl, cl
movsd dword es:[edi], dword [esi]
mov ebp, esi
cmp dword [ebx], esi
pop esi
and al, 0x4a
jecxz 0x17778a6
enter 0x16f6, 0x37
daa
mov bl, 0x68
xor edx, dword [eax - 0xa]
xor dword [ebx + 0x6d2547df], esp
les eax, [ebp - 0x202814d5]
loopne 0x17779a4
je 0x177792c
jecxz 0x177792d
dec dword [eax - 0x68ff8b86]
or ebp, dword [edx + edi*2 + 0x5cbc0074]
mov esp, 0x9300747a
mov byte [edx + 0x74], bh
add byte [edi + 0x747aac0b], dl
add byte [esp + ebx*2 + 0x747abc], bh
xchg ebx, eax
adc esi, ebp
pop es
cld
add ah, 0x9d
inc edi
rol edi, cl
pop ecx
xchg edi, eax
bound edi, qword [eax - 0x68b60459]
bound edi, qword [eax - 0x68b23879]
bound edi, qword [eax - 0x68c2a40d]
bound edi, qword [eax - 0x68d6743d]
bound edi, qword [eax - 0x6692bf79]
pop ss
lodsb al, byte [esi]
stosb byte es:[edi], al
retf 0xc50f
idiv byte [0x642bd4ed]
in al, 0x6a
neg dword [edx]
aam 0xa4
pushal
push ds
neg dword [edx]
aam 0xe0
pop ds
or eax, 0x12c87be1
retf 0xe78b
ror al, 1
sub al, 0x24
jmp 0x17702ed
shr ecx, 0xf2
inc al
jmp 0x177cc5c
mov dword [eax], edx
sal ecx, 0x76
call fcn.016d3380
inc ecx
mov edi, 0x83c0da2
inc ecx
mov ebp, edi
inc edi
mov edi, dword [esi + edi - 0x83c0da2]
inc esp
movzx ebx, ch
inc eax
movsx edi, ch
inc esp
mov eax, edi
inc ecx
mov eax, dword [esi + ebp - 0x83c0d9e]
jmp 0x12d9d0c

Function at 0x177baed
Capabilities:
Encode data using base64

Disassembly:
ror byte [esp + ecx + 7], 0xe2
mov dword [esp + ecx*8], ebp
ret 4
lea eax, [ecx + 0x1c285a22]
sar eax, 0x61
xor dx, bx
mov dword [esp + eax*8 - 0x5ea16884], 0xcc14f92f
mov dword [esp + eax - 0xbd42d11], 0x221e128a
xor eax, ecx
ror dx, 1
inc byte [esp + 1]
shr dword [esp + 3], 0xf4
sub ecx, 0x29bdd39e
xor dx, 0x48b0
shr eax, 0x6a
and ecx, 0xffbe2fac
neg dx
and ecx, eax
js 0x16a03b2
shl eax, 0xba
adc dx, 0x3080
shl dword [esp + ecx - 0x3fc], 0x50
sbb word [esp + ecx - 0x3ff], ax
xchg ch, al
xor bx, dx
sal ecx, 0x7c
add dword [esp + ecx + 4], eax
not eax
mov word [esi + ecx*8], dx
jg 0x12e2481
Function at 0x177cbf3
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + eax*4 - 0x7adc2138]
lea ecx, [eax + eax*8 + 0xcac0e20]
xor edx, ebx
ror edx, 1
and cl, 0x22
dec ecx
lea edx, [edx + eax - 0x615f78e]
mov dword [esp + eax - 0x1eb7084d], eax
xadd cx, ax
bswap edx
xor ecx, 0x8db042a7
xor eax, dword [esp + eax - 0x1eb757ff]
rol edx, 1
pop eax
xchg ecx, eax
mov dword [esp + ecx - 0x1eb7084d], eax
sub edx, 0x88096223
xadd word [esp + ecx*2 - 0x3d6e1098], ax
shl ax, cl
xor ebx, edx
shl eax, cl
add ebp, edx
movzx edx, word [esp + ecx*2 - 0x3d6e109a]
mov edx, esi
call fcn.0121afa8

Function at 0x177f1cf
Capabilities:
Encode data using base64

Disassembly:
sub edx, 0x26177c12
neg edx
mov ecx, 0xcabf1219
ror edx, 1
movsx eax, cl
add cl, al
bswap edx
ror cl, 0xc4
sub al, 0x1f
xor ebx, edx
mov dword [esp + eax*4 - 0x3dc], ecx
mov dword [esp + eax - 0xfa], 0x7ea5b607
xadd eax, ecx
adc ebp, edx
shr eax, 0x6b
adc cx, 0x7582
xchg word [esp + ecx - 0x766e], ax
mov eax, dword [edi + ecx - 0x7684]
lea edx, [ecx + ecx + 0x3b09c121]
lea edi, [ecx + edi - 0x7684]
adc ecx, dword [esp + edx - 0x3b0aae15]
adc ecx, dword [esp + ecx - 0x283cf98b]
mov dword [esp + ecx - 0x64c00c04], ecx
xor eax, ebx
sar dword [esp + edx - 0x3b0aae18], cl
neg dword [esp + edx*2 - 0x76155c29]
push edx
xor eax, 0x6e2ce026
ror ecx, 0x74
ror eax, 1
sal ecx, 0x1a
jbe 0x16d3006
mov edx, 0x109bca2b
call fcn.012dba23

Function at 0x17813ea
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea ecx, [ebx + ecx - 0xbd3ea45]
not esi
inc edi
movzx esp, word [ecx + ebx*2 - 0x17a7d486]
dec edx
mov dword [esp + ebx*4 - 0x2f4fa90c], eax
inc sp
xor esp, ebx
inc si
or dword [esp + ebx - 0xbd3ea3f], eax
inc cx
shr ebx, 0x88
inc cx
neg esp
sar edx, 0x29
sub word [esp + edx*2 - 0xbd3e8], dx
inc cx
sub esp, 0x4166421f
ror esp, cl
inc ecx
sar bl, 2
sbb esi, dword [esp + edx*2 - 0xbd3e6]
mov edi, ecx
inc cx
neg esp
inc cx
not esp
xadd dx, si
inc cx
xor esp, 0x8d480bbe
xor al, 0xf5
or ah, byte [ebp + 0x41669a8f]
inc esp
sal eax, cl
jl 0x1236dba
test si, 0x4fa8
Function at 0x1789a4e
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
jmp 0x1795950
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.0172fd31
xadd edx, edi
inc ecx
not esp
dec eax
inc dword [esp + ebp - 0x1280e817]
jae 0x17a1ce3
popal
mov ah, 0xf5
inc ebp
adc ch, bl
cmp eax, 0xef8e0c77
leave
cmc
and ecx, dword [esi + ecx*4]
out dx, eax
in eax, dx
leave
pop ss
or al, 0x8e
out dx, eax
test eax, 0xd999b359
pop edx
not byte [ebx + 0x280e013c]
or dword fs:[0x48c98e0e], edi
mov dword [edi + eax*4 - 0x6c421dc6], ebx
cmp dword [ebp + 0x3f], eax
dec ecx
pop esi
rcl byte [esi + 0xf]
cwde
jmp 0x1147d5dc
mov ecx, 0x4dac3706
neg eax
lea ecx, [ecx*4 - 0x49f0fd69]
inc eax
lea edx, [ecx*4 - 0x7468f05e]
not dx
xor eax, 0xd7346216
sub eax, 0x8a1b6739
and edx, edx
xor eax, 0xd905153e
or cx, dx
xchg ch, dl
sbb edx, 0x8d86d29f
xor ebx, eax
add ebp, eax
neg dx
add dx, cx
jmp ebp
inc ecx
ror esp, 2
inc ecx
not esp
dec eax
sub dword [esp + ebp - 0x1280e813], esi
adc ebp, edi
dec eax
mov dword [esp + ebp*2 - 0x2503a034], ebx
inc esp
xor dword [esp + ebp*2 - 0x2503a034], esp
sal dword [esp + ebp*2 - 0x2503a044], 0xcd
inc ecx
movzx ebx, ax
dec edx
mov ebx, dword [esp + eax*4 - 0x4a039ff0]
inc ecx
neg ebx
call fcn.017bac0b
mov edx, 0x4b92d61d
mov eax, 0x1dae54a4
mov ecx, dword [esi + eax - 0x1dae54a4]
shr edx, 0xc6
mov edx, dword ss:[ecx + eax*2 - 0x3b5ca948]
shr eax, 0xac
inc eax
mov dword [esi + eax*2 - 0x3b5cc], edx
lea edi, [edi + eax*2 - 0x3b5d0]
mov eax, dword [eax + edi - 0x1dae6]
jns 0x16cc054

Function at 0x178aa5e
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea ecx, [esp + ecx + 8]
call fcn.016f7c9c

Function at 0x179f885
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea esi, [esi + eax - 0x288c]
inc esp
shld esi, ebx, cl
inc esp
movsx ebx, bp
inc ebx
mov dword [esi + eax*2 - 0x5124], esi
inc ecx
movzx ecx, bl
inc ecx
jmp edx
push ebp
inc edi
dec eax
xor dword [esp + esi - 0x93], 0xde3f8dbd
rol edi, 3
dec eax
mov dword [esp + esi - 0x93], ebx
mov edx, ebp
dec esi
lea ebp, [eax*2 - 0x7476cfc7]
inc ecx
and ebp, ebp
xor dword [esp + esi*2 - 0x126], edi
dec eax
xor eax, 0xb20dbdba
pop ebx
dec eax
or eax, eax
add al, 0xa0
dec eax
arpl di, di
dec esp
add edx, edi
dec eax
bswap edx
shl ax, 0x28
inc ecx
setbe ch
inc ecx
mov esi, dword [esi + esi*8 - 0x498]
dec esi
lea ebx, [ebp*4 + 0x540ca423]
jp 0x1799ec0
call fcn.01723552
xor ecx, 0xf5b1f8a9
xor ebx, ecx
and eax, eax
and byte [esp + edx - 0x583f495], 0xe
call fcn.017196cf
inc edi
mov ebx, dword [esi + eax*4 - 0xa244]
inc ebx
mov cl, byte [eax + esi - 0x288a]
inc ecx
mov esp, 0xa315dbbc
js 0x16d6599
inc esp
movsx esp, dx
not bp
dec eax
bswap eax
dec esi
rol bp, 1
xor bx, bp
inc ecx
and bh, 0x86
dec edx
mov dword [esp + ebp*4], 0xf5a55095
dec edi
lea esi, [ebp + esi - 2]
inc edx
shr byte [esp + ebp + 3], cl
inc bx
mov dword [esi + ebp*2], ebp
inc edx
xor edi, dword [esp + ebp]
inc ecx
pop edi
jns fcn.0178e74d
inc cx
mov eax, dword [esi]
mov edi, 0x2d8f8bb7
inc ecx
mov cl, byte [esi + edi*2 - 0x5b1f176c]
dec ebp
lea esi, [esi + edi - 0x2d8f8bb5]
sal ax, cl
call fcn.01729d95
dec eax
lea eax, [esi + ebp - 0x59dcc6e5]
neg edi
jmp 0x1726f3b
Function at 0x179ff7c
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jae 0x1792b62
movzx eax, word [edi + eax*2 - 0x5ebafcb2]
call fcn.012d2a97
mov dword [esp + edx], eax
xor ecx, ebx
xor ecx, 0x6e2ce026
neg dx
and edx, 0x20827eb7
ror ecx, 1
neg eax
xadd byte [esp + eax - 0x49f59b9], ah
lea ecx, [ecx + eax*8 + 0x6a3b1042]
xadd dword [esp + eax - 0x49ffbbc], eax
bswap ecx
sbb ecx, 0xf1111d32
xor edx, edx
sbb dword [esp + edx], edx
not ecx
or al, byte [esp + edx*2]
lea ecx, [ecx + eax*2 + 0xedaf908]
not dl
neg ecx
dec ecx
xor ebx, ecx
ror eax, 0xbf
add eax, 0x73b25ba0
push edx
mov dword [esi + eax - 0x1c73a82c], ecx
sbb word [esp + eax - 0x1c73a823], ax
dec dl
mov word [esp + eax - 0x1c73a827], ax
movzx ecx, byte [edi + eax - 0x1c73a831]
dec byte [esp + eax - 0x1c73a824]
lea edi, [edi + eax*4 - 0x71cea0a9]
not eax
xor cl, bl
sub dl, dl
shl ax, 0x27
not cl
add dx, 0x5eaa
add eax, 0xa72b1cbd
sub edx, eax
inc cl
xor cl, 0x1e
xadd eax, edx
add cl, 0xa7
rol ax, 0xc6
xor bl, cl
call fcn.016de0d0
ror ecx, 2
ror eax, 0x1f
bswap ecx
not ecx
sub edx, 0xd0a281a9
lea eax, [eax + edx*2 - 0x356f7ed5]
xor ecx, 0x640a08bd
or edx, edx
xor ebx, ecx
xchg edx, eax
add ebp, ecx
and dx, dx
movsx ecx, dx
rol ecx, cl
lea edi, [eax + edi - 0x2f5d7e5b]
jae 0x173bdbb

Function at 0x17a1cd0
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + 0x20], ebx
inc esp
xor dword [esp + 0x20], ebp
inc esp
movsx edi, dl
call fcn.01220c59

Function at 0x17a5746
Capabilities:
Encode data using base64

Disassembly:
inc eax
xor ch, bl
inc eax
dec bh
dec eax
lea edx, [ecx*2 - 0x57c3f0e4]
inc eax
rol ch, 1
inc ecx
mov eax, 0xb991d78a
inc ecx
movsx esi, ax
dec eax
lea ecx, [eax + edi + 0x330ce894]
inc eax
dec ch
add dl, 0x9e
shr edi, 0x12
sal eax, cl
inc eax
ror ch, 1
call fcn.017bb4e2
rol dl, 1
neg dl
rol dl, 1
sub dl, 0xb7
inc eax
not dl
add dl, 0x24
mov dword [esp + ecx*2], 0x548fd1a3
not dl
shl ecx, 0x78
xor bl, dl
ror cx, 1
adc ecx, 0x86291d38
lea esi, [eax + esi - 0x2e335698]
dec cl
mov word [esi + eax*2 - 0x5c66ad2c], dx
movsx edx, cx
lea edi, [edi + eax*2 - 0x5c66ad30]
call fcn.01711859
mov eax, 0x5c1a4d8b
movsx ecx, ax
dec eax
lea edi, [eax*8 + 0x510ddba1]
dec ebp
mov esp, dword [esi + eax - 0x5c1a4d8b]
sub ax, di
inc edx
movzx ebp, byte [eax + ecx - 0x5c1a0593]
jno 0x16d4cce
dec eax
mov ebx, dword [esp + ecx*2 - 0x1dc]
dec eax
arpl si, si
dec esi
mov dword [esp + eax - 0x29ae00fa], eax
dec ecx
not edi
dec esp
add edx, esi
dec esi
mov dword [esp + edi + 0x5cb72935], edx
ret 8

Function at 0x17a667a
Capabilities:
Encode data using base64

Disassembly:
call fcn.0171ea5c
call fcn.017ae724
not eax
bswap eax
and cx, cx
call fcn.01753279
Function at 0x17a7bd7
Capabilities:
Encode data using xor

Disassembly:
adc ebp, edx
movzx edx, word [esp + eax - 0x5828fffd]
lea edx, [eax + 0x5085de0f]
mov dx, word [eax + esi - 0x58290001]
sal dword [esp + eax - 0x5828fffd], 0x73
inc byte [esp + eax - 0x5828fffb]
shr ax, 0x8f
add cl, byte [eax + esi - 0x5828fffe]
neg eax
add esi, 2
call fcn.016e685c
inc ecx
mov dword [esi + edi*4 - 0x504af084], esi
sub word [esp + edi - 0x1412bc1e], 0x8836
inc esp
mov esp, dword [esp + edi*4 - 0x504af086]
jg 0x12dd041
inc ecx
mov edi, dword [ecx + edi - 0x1412bc26]
xor edi, ebx
dec edx
sub dword [esp - 0x77caa612], 0x52b35214
call int.0175385d
inc ebp
movsx edi, bl
inc ebx
mov eax, dword [eax + ecx - 0x5abab98e]
inc esp
mov ebp, edx
xor eax, ebx
inc ecx
shr bh, 0xc3
inc ecx
push edi
pop edx
sbb eax, 0xd636a610
jmp 0x16beac9
bswap eax
ror eax, 2
inc edx
not dword [esp + eax - 0x5abab987]
inc esi
movsx esp, byte [esp + eax - 0x5abab987]
ror dword [esp + ecx - 0x31816207], cl
inc eax
call fcn.01758dd6
xadd ecx, edx
dec dl
xor ebx, eax
add ebp, eax
call fcn.0171eab4
mov ecx, 0xb938842e
push ecx
mov eax, dword [edi - 4]
jmp 0x12294a8
xor ebx, edx
sar ecx, 0x7d
jns 0x122342b
neg cx
or ecx, 0xd716190e
dec eax
neg eax
and ecx, 0xf8883106
dec cl
inc eax
jmp 0x1768703

Function at 0x17a8bfc
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov ebx, dword [esp + ebp + 0x10]
dec eax
arpl si, si
dec eax
sub ecx, edx
dec esp
adc edx, esi
dec edx
lea edi, [0x4697120b]
dec edx
mov dword [esp + ebp*2 + 0x10], 0xde93770d
dec esi
mov dword [esp + ebp*4], edx
ret 0x10
mov ebx, 0xc9bae58c
inc edx
xor dword [esp + ebp + 0x10], esi
inc edx
or byte [esp + ebp + 0xa], 0xa6
inc edx
shl dword [esp + ebp + 7], cl
jp 0x16b1511
sar ebp, 0xbd
inc ecx
xor ebx, 0x42a1f806
inc ecx
sub ebx, 0xfd02b73a
inc ecx
xor ebx, 0x1f294f03
inc ecx
sub ebx, 0xc724c81f
ror edi, 0x2a
inc ecx
xor ebx, 0x259b90bd
dec eax
mov dword [esp + ecx*2 - 0x1aec], ebx
movsx ebx, word [esp + ecx - 0xd79]
inc ecx
push eax
inc esp
xor dword [esp + eax - 0x540df3f0], ebx
dec eax
mov ebx, dword [esp + ecx - 0xd6a]
movsx edx, cl
dec ebp
arpl bx, bx
dec eax
mov dword [esp + eax - 0x540df3f0], edx
bswap edx
dec ecx
add edi, eax
dec ebp
adc edx, ebx
dec esp
xor dword [esp + eax - 0x540df400], edx
ret 0x10
xor esi, ebx
dec esi
inc dx
sub dword [esp + ebx], 0xc042173e
sbb al, 4
and dword [ecx - 9], eax
fld qword [ecx - 0x40bc590a]
xchg ebp, eax
dec esi
inc dx
shr dword [esp + ebp + 1], cl
inc dx
shr dword [esp + ebp*2 + 2], cl
ror esi, 3
inc edx
inc byte [esp + ebp*2]
inc esp
movsx eax, dl
neg esi
inc ecx
movzx eax, sp
inc ecx
push esp
push eax
dec esi
dec edx
mov dword [esp + ebp*8 + 0x10], ebx
jmp 0x16d68f8
inc ebx
mov esi, dword [ecx + ebx]
dec esi
mov dword [esp + ebx*2], ebp
jl 0x1759194
push 0xdfba9c1d
add ch, byte [edx + 0x1656ffa2]
sbb byte [edx + 0x758c0fde], bl
nop
idiv edi

Function at 0x17afc3e
Capabilities:
Encode data using base64

Disassembly:
call fcn.01220698
call fcn.0174797a
xor eax, ebx
call fcn.0172caf0
Function at 0x17b48bc
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using chaskey

Disassembly:
inc ecx
sar edi, 0x6a
inc edx
xor dword [esp - 0x77689b28], ecx
call fcn.016e5355
call fcn.012d56f8
jb 0x178c0e0
xchg ecx, eax
mov eax, 0xbd803ad9
loop 0x178c14c
pop ss
sbb al, byte [eax - 0xfea2564]
pop esp
jecxz 0x178c0ee
pushfd
ficom dword [0xe33e5cf0]
adc byte [ecx - 0x45], al
inc ecx
mov ebx, 0x2b83b70c
dec edi
or al, 0xb7
sub dword [ebx], 0x4f
lea ecx, [ecx + ebx - 0x2b83b710]
jmp 0x179b5f7
cmc
add byte [eax], al
sub edi, 4
mov edx, 0xdd033698
mov ecx, dword [edi]
rol dx, 0x6e
sbb edx, 0xc5321311
xor ecx, ebx
shl edx, 0xa9
neg ecx
movsx eax, dx
and eax, 0xcb8d1abe
inc ecx
shl eax, 0xfd
xor ecx, 0xd7346216
sub dl, al
sbb eax, 0xba8e8ca6
sub ecx, 0x8a1b6739
xor ecx, 0xd905153e
xor ebx, ecx
call fcn.017591e9
jl 0x178c0d6
in eax, 0x41
lea ecx, [ecx + ebp*4 + 0x59d4d8e]
dec eax
mov dword [esp + edi - 0x60ba1519], ebx
inc ebp
add esp, ebp
jp 0x178c0b3
push ebp
push 0xc237c937
mov ebp, dword [esp]
mov ebp, dword [esp + ebp + 0x3dc836cd]
mov dword [esp + 4], 0xae5e3035
lea esp, [esp + 4]
call fcn.0172fd31
Function at 0x17b48f6
Capabilities:
Encode data using base64

Disassembly:
jns 0x17919b2
dec esp
adc edx, esi
jmp 0x17b30c7
sal cl, 0xc1
call fcn.017241ea
inc edi
mov esp, dword [esi + ebx - 0x600]
inc eax
sub cl, ch
inc ebx
mov eax, dword [esi + ebx - 0x5fc]
dec bp
call fcn.01782ed7
dec eax
lea edi, [ebx + ebx*2 - 0x61ddeb49]
pop ebx
inc ecx
adc edi, 0x5436a408
not dx
dec eax
arpl si, si
dec ecx
cmovnp edx, ebp
inc ecx
movzx eax, ax
jne 0x16f31ba
inc ecx
mov edi, 0xbe36e539
xor dword [esp], eax
inc ecx
movsx edi, bx
inc ecx
movzx ebp, bx
inc ecx
mov eax, 0xd611e430
pop ebx
mov edx, 0xdd826a0c
dec eax
arpl ax, ax
inc ebp
movsx ebp, al
shl bp, 0xaf
jne 0x17abf98
dec edx
call fcn.0176a489
sal byte [esp + ecx*8 - 0x5dfd5722], 0x24
sbb dword [eax + 0x3c7a29cf], ebp
sbb dword [eax + 0x443239cf], ebp
sbb dword [eax + 0x6caadacf], ebp
sbb dword [eax - 0x3b5e7e31], ebp
sbb dword [eax - 0x1b7dce31], ebp
sbb dword [eax + 0x74b132cf], ebp
sbb dword [eax - 0xbbda631], ebp
sbb dword [eax + 0x34b1b2cf], ebp
sbb dword [eax + 0x225c9acf], ebp
inc eax
ror dword [ebx + 0x36], cl
cdq
loopne 0x17919f0
cld
cwde
leave
out dx, eax
dec ax
xchg esi, eax
loop 0x1791a27
popal
add eax, 0x21470c3e
pop ecx
ficom dword [ecx]
iretd
push ebx
iretd
dec esp
inc eax
xor bh, 0x20
dec esi
mov esi, dword [edi + esi + 0x61ddeb69]
dec eax
lea edi, [ebp + edx*8 - 0x3c497662]
inc esp
movzx ebx, dl
jne fcn.0178e74d
add esi, 2
mov edx, 0x86b88d0b
or al, cl
mov ecx, edx
lea ecx, [ecx + ecx*2 + 0x6d07f890]
not al
not cl
dec ecx
bswap ecx
mov word [ecx + esi - 0x4d9f3101], ax
jo 0x16b2bfc
movsx eax, cx
shl ecx, 0xed
lea edi, [edi + eax - 0x3105]
rol edx, 0x6f
mov edx, dword [edi + eax - 0x3101]
add ecx, eax
xor edx, ebx
shl ax, 0x21
inc edx
rol eax, cl
sbb cx, ax
not edx
js 0x17428da
dec eax
sal dword [esp + 8], 0x4d
inc ebp
mov dword [esi], ebp
inc ecx
pop esp
dec ecx
sub ecx, 4
inc ecx
mov eax, dword [ecx]
dec eax
inc dword [esp]
dec eax
shl dword [esp], 0x4f
xor eax, ebx
dec eax
not byte [esp + 6]
dec eax
dec dword [esp]
rol eax, 1
inc esp
mov ebx, dword [esp + 4]
sub eax, 0x2d9f898a
inc ecx
shr bl, 2
je 0x1748b82
not eax
dec ecx
dec ebx
adc eax, 0x5a1e213
dec eax
mov dword [esp], ebx
jmp 0x1765f56

Function at 0x17b70e7
Capabilities:
Encode data using xor

Disassembly:
je 0x16c0fa9
inc bx
mov dword [esi + edi*2 - 0x28644660], ebp
dec esi
mov dword [esp + edi - 0x14322330], esp
inc cx
neg eax
inc edx
ror byte [esp + edi - 0x1432232f], 0x63
dec esi
mov dword [esp + edi - 0x14322330], edx
ret
Function at 0x17bb4e2
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc ecx
mov edx, dword [ecx + esi - 0x8880]
xor edx, ebx
neg word [esp + esi - 0x8880]
dec esp
lea ebx, [edi + edi*2 - 0x27fcb56f]
dec ebp
lea eax, [esp - 0x26d300c8]
inc edx
lea edx, [edx + eax*2 - 0x7f109682]
inc ecx
push esp
call fcn.016fbb5f
dec ecx
xor ebx, eax
dec esp
lea esp, [esi*4 - 0x6c728da]
dec esp
or esp, edi
inc esp
adc byte [esp + esi - 0x8879], ch
dec ebp
lea esi, [esi + esi*2 - 0x11108]
inc ecx
setge ah
inc eax
movsx eax, ch
pop ebp
dec ebp
mov dword [esi + esi - 0x8880], eax
dec ebp
lea ecx, [ecx + esi*2 - 0x11104]
inc esp
or edi, edi
ja 0x12f7bb8
invalid
ret
mov esp, ebp
pop ebp
jmp 0x16d1fff
cmp word [edx], ax
je 0x177b5bf
xor eax, eax
cmovl esi, edi
pop esi
jmp 0x16df174
je 0x1729e86
mov eax, 0x5a4d
cmc
cmp bp, 0xdabe
jmp 0x1729e7d
mov eax, dword [edx + 0x3c]
add eax, edx
cmp di, 0xf08b
cmp dword [eax], 0x4550
jmp 0x1797188
inc ax
xchg esi, edi
dec ecx
mov eax, dword [esi + eax - 0x7ffffff9]
inc ebp
xor eax, edi
dec esp
mov esp, dword [edx + eax + 0x57c35530]
dec esi
mov dword [edx + esi + 0x57c35538], esp
inc esp
adc bh, cl
dec ebp
lea ebx, [eax + ecx*4 - 0x7beb82c2]
jne 0x1729e86
mov ecx, dword [eax + 0x78]
test ebp, eax
mov dword [ebp - 4], ecx
test edi, ecx
cmp edx, 0xa13db9a5
test ecx, ecx
je 0x1729e86
mov eax, dword [eax + 0x7c]
push ebx
stc
cmc
push edi
cmp bp, 0xc586
mov dword [ebp - 0x10], eax
clc
cmp ecx, 0x9d99139e
test ah, 0x8f
mov dword [ebp - 8], 0xffffffff
clc
stc
cmp esi, 0xffff
jmp 0x177aaa7
je 0x1729e86
mov esi, dword [ebp + 0xc]
cmp bp, 0xf220
cmc
test esi, esi
jmp 0x175598e
dec eax
mov dword [esp + eax - 0x80000000], eax
inc eax
inc ch
shr al, 0xa1
adc si, di
je 0x16bb588
inc eax
neg ch
inc eax
xor bl, ch
dec eax
shl dword [esp + edi*2 - 0x18f0], 0x19
inc esp
movzx edi, byte [esp + edi*4 - 0x31dd]
dec eax
lea ebp, [esp + ebp + 8]
inc ecx
inc eax
pop edi
inc esp
movzx ebx, cl
dec esi
mov dword [ebp + edi*2], esp
jne 0x17900bd
xor ebx, eax
add ebp, eax
sar byte [esp + edx - 0x7e79], 0x61
pop edx
pop eax
jns fcn.016a12a3
test edx, edx
jmp 0x17b539c
Function at 0x4a3cb0
Capabilities:
Authenticate hmac

Disassembly:
cdq
cld
fnstsw word [ebx]
dec ebp
fistp qword [0xc4a7f08c]
pop ebx
sbb dword [esi + 0x3a], ebx
invalid

Function at 0x4d0c78
Capabilities:
Encode data using xor

Disassembly:
ja 0x4d0cd7
adc byte [ebx - 0xf], dl
sbb al, 0xdd
adc bl, byte [ecx + 0x7904a846]
mov byte [0x3e09cb29], al
and byte [edi - 0x6fdd0903], cl
sub byte [ebx + 0x78], ah
mov dl, 0x39
mov byte [0x63197f35], al
mov eax, dword [0x89084b1b]
adc dword [ecx - 0x592b99e1], ebx
jg 0x4d0ce7
inc ecx
push 0x5055ac50
pushal
mov byte [ebx], al
or bh, byte [edi + edi*8 + 0x43]
jnp 0x4d0ce5
sbb byte [ecx + 0x38], cl
push ebx
pop ecx
or esp, dword [eax + 0x6f]
rcr eax, 1
adc eax, dword [edx]
push ebx
test al, 0x74
loopne 0x4d0c5e
sbb al, 0xd6
test dword [ebp + ecx*8 + 0x36afd2b4], ebx
test dword [ebx + 1], edx
scasd eax, dword es:[edi]
test dword ss:[ebx + 1], edx
inc ecx
push es
pushal
adc byte [ecx + ebp*4 - 0x1b89c6b0], dh
xchg edx, eax
jmp 0x81255311
or bh, byte [eax]
xchg ebx, eax
and eax, 0xfaef3813
xor dh, cl
xor ch, al
pop ds
xchg byte [ecx + edx*4 + 0x2e], cl
mov dh, 0xd
dec esp
xchg ecx, eax
mov dh, 0xd
jp 0x4d0cbd
xchg edi, eax
mov edx, dword [ecx + edi - 0x71b7a8c7]
dec ecx
aad 0x59
dec edi
and dword [ebx], edi
xchg ecx, eax
xchg byte [ebx - 0x39202a08], al
aas
pushal
and eax, 0x7d97f9d7
bnd jbe 0x4d0d7c
sbb ebp, ecx
imul ecx, dword [ebx], 0x88d0965
inc ecx
mov bl, 0xb1
clc
pop es
call 0xce5270e4
mov esi, 0xfcacb9a3
fsubr qword [edx - 0x33e94632]
fstpnce st(1), st(0)
stc
js 0x4d0d54
retf 0x9b9d
cdq
ror dword [0x8dd769eb], cl
invalid
push es
inc ecx
insb byte es:[edi], dx
xor ebp, dword [edi + 0x21d05689]
or edx, dword [ebx]
jae 0x4d0dde
xor ebp, dword [ebp - 0x371b4790]
ret
mov byte [ebp + 0x78], ah
lodsd eax, dword [esi]
jp 0x4d0dfe
cmc
push ebp
mov al, byte [0xf5926d4]
je 0x4d0e21
imul edx, ebx, 0xecee4f68
imul edi, eax, 0xa11b470e
sbb bl, al
sbb ch, byte [eax]
sub al, 4
add byte [esp + eax], ch
int3
push esp
adc al, 0x7d
ror dh, 0xaa
xor byte [edx], dl
cmp bh, byte [esi - 0x23]
les ebx, [edi]
or dword [eax], edx
dec edx
xlatb
pop esi
jnp 0x4d0ea6
inc ebx
cmpsb byte [esi], byte es:[edi]
nop
inc edx
push es
mov ebp, dword [eax + 0x5aa559b8]
sti
cli
sbb dh, byte [ecx]
cmp byte [edx], 0xed
push 0x6b058358
enter 0xffffffffffffc349, 0x51
fmul qword [ebx + ebp*8 - 0x47c709c8]
clc
sal dword [esi - 0x4c918996], cl
xor edx, esi
sbb ecx, 0xb9f1dbb0
add dword [ecx - 0x52c49216], ebx
mov dl, 0x68
cli
or bh, byte [edx - 0x79b20fb3]
daa
xchg byte [edi], ah
iretd
out 0x57, eax
hlt
Function at 0x52e67c
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x403dab
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x52b0c4]
call 0x66df18
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x403d89
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0052e5c0
mov eax, dword [ebp - 0xc]
call sym.imp.GDI32.dll_CreatePalette
xor eax, eax
push ebp
push 0x403d6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x52e746
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0052e134
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
pop ecx
call 0x658c5c
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x52e6fe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d73
mov eax, dword [ebp - 0xc]
call sym.imp.KERNEL32.dll_TlsAlloc
ret

Function at 0x5552ec
Capabilities:
Encode data using xor

Disassembly:
and ah, byte [ecx - 0x3e]
and dword [edx + 0x24], 0x9583ab9a
pop ds
sub byte [ecx - 0x2a], ah
push ecx
invalid
mov dl, 0x3f
xor dword [ecx], 0x835c40bf
inc eax
pop esp
and esi, 0xffffffc5
inc eax
pop esp
and esi, 0xffffffc5
cmovb ebx, eax
sti
jle 0x5552e7
leave
and eax, 0xfc2f03ff
mov dh, 5
cmp esp, dword [esi - 0x76]
sub dl, dh
std
sub byte [ecx], dl
jge 0x5552d0
pop edi
inc ecx
insb byte es:[edi], dx
inc ebx
insd dword es:[edi], dx
js 0x555307
xchg edx, eax
fnstsw word [edi - 0x48]
push 0xffffffffffffffa1
add dword [esi + 0x3df8c3da], esi
or ebx, ecx
mov dh, 0xaa
hlt