joyce8/EMBER2024-capa huggingface dataset:
Function at 0xde9a4d
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp + edx - 0x1ad2a5fe]
cwde
adc ebp, 3
lea ecx, [eax + eax - 0x7ed930ce]
cwde
xor edx, ebx
sub cx, word [esp + 2]
xor edx, 0xd63975a0
bswap ecx
ror edx, 2
or ax, 0xc322
inc word [esp + ecx*2 - 0x5c364cfe]
sub eax, dword [esp + ecx*2 - 0x5c364d00]
bswap edx
ror edx, cl
not byte [esp + ecx*2 - 0x5c364cfc]
xor ecx, dword [esp + ecx*2 - 0x5c364d01]
xor ebx, edx
dec dword [esp + eax - 0x5a00e7fa]
add byte [esp + eax - 0x5a00e7fb], 0x90
pop ecx
adc edi, edx
ror ecx, cl
sar word [esp + ecx - 0x400297f9], 0xed
movzx edx, word [esp + ecx - 0x400297fa]
pop eax
jnp fcn.0052afe8
shl edx, 0x2b
lea eax, [esp + eax + 4]
lea edx, [edx + edx + 0xe91fb1f]
mov word [eax], cx
lea ecx, [edx + edx*8 - 0xcea2e5]
jne 0x506acd
lcall 0x9b91, 0x17c2f5f3
push dword [esp + edx - 0x17]
cdq
insb byte es:[edi], dx
add dl, bh
pop ebp
push ebx
pop ds
add cl, dl
push edi
ret 0xfd67
mov word [esi + edx - 0x1ad2a5fe], cx
push eax
mov dword [esp + edx - 0x1ad2a5fa], edx
jo 0xd9bc19
rcr bh, cl
pop ebp
sbb ch, byte [ebp - 0x526d0385]
pop ecx
insd dword es:[edi], dx
add byte [di - 0x61], 0x3f
scasb al, byte es:[edi]
aas
mov ebx, 0xad0fc144
movsd dword es:[edi], dword [esi]
mov eax, 0xac8dc0d2
xchg byte [ebx - 0x54], bh
inc ebp
cld
stc
push ebp
xchg edi, eax
js 0xde9add
js 0xde9ad0
cld
pop ecx
mov edx, 0xfc1fd030
lodsd eax, dword [esi]
lodsb al, byte [esi]
cdq
mov bl, 0x14
mov dword [ebp - 0x19b8884b], ecx
pcmpeqb mm3, qword [edx]
inc ebp
inc eax
imul esi, dword [edx - 0xb2d8789], 0x67d38cec
fsubrp st(2)
lcall 0xebc8, 0xc6710a96
mov ecx, 0x59f2b046
dec esi
out dx, eax
call 0xcb2f4e9b
pop edi
mov edi, 0x1a0348ab
xor al, 9
push eax
test eax, 0xc6117814
adc eax, 0x640c2de8
push esi
push eax
and dh, byte [0x2de968f1]
sbb byte [eax - 0x53], bl
and eax, dword [esi + 0x59a3adc1]
sbb eax, 0xde3045d1
invalid
sub eax, 0x23ad5818
xchg cl, al
lodsd eax, dword [esi]
mov dword [0x45d11d59], eax
xor dh, bl
add eax, 0x24bb6cd4
mov ebx, 0xd151ad5c
stosb byte es:[edi], al
mov edx, 0x1feacde
inc dword [ebp + 0x24]
mov eax, 0x522bed35
sub byte [ebx - 0x7a], dl
or bh, byte [edx - 0x509a33c4]
lodsd eax, dword [esi]
inc edx
and byte [edi], 0x99
mov ebx, 0xc8c7b279
sbb dword [eax - 0x75], 0xf04b6cbb
mov byte [0xa6130576], bl
jae 0xde9ab7
pop es
cmp ecx, dword [edx - 0x60e4285a]
iretd

Function at 0xdf2197
Capabilities:
Inspect section memory permissions

Disassembly:
mov ebx, dword [esp + ebx - 0xf62c]
push edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
call fcn.00d03eb5
Function at 0xdfb31b
Capabilities:
Inspect section memory permissions

Disassembly:
sbb esi, 1
mov word [esi], cx
sar eax, 0x8c
lea eax, [eax + eax*4 + 0x14389f]
add al, al
jle fcn.00e43269
cmp ecx, 0x1abeea33
mov eax, dword [eax + 8]
test bx, 0xa68c
test ecx, edi
xor eax, ebx
test cx, 0x2a95
cmp dx, 0x78b3
push eax
test sp, dx
xor edi, ebx
jmp 0xe982d3
mov ecx, 0xaeb71da5
lea eax, [ecx - 0x2348b37b]
sub ebp, 4
jmp 0x632aa6
movsx edx, cl
cwd
mov eax, dword [ebp]
neg ecx
imul edx, ecx
jb 0x62e7bf
mov eax, ecx
add edx, esp
sar ax, 0x48
dec ax
btr eax, eax
mov cx, word [edx]
jb 0x58fbf9
mov ecx, dword [ebp]
mov eax, 0xbcbea01c
movzx edx, ax
lea ebp, [ebp + edx - 0xa018]
sal al, 0xc7
div eax
xor ecx, ebx
lea ecx, [ecx + edx*2 + 0x34f19024]
or eax, edx
and al, 0x90
setg al
not ecx
setne dl
inc ecx
not al
neg ecx
xor ebx, ecx
btr dx, 0xbc
adc esi, ecx
not al
movsx ecx, al
bts ax, cx
mov di, word [edi + edx - 0x2fd86000]
or cx, 0x5eb2
ja fcn.005544bb
ret
not ecx
call fcn.005549fb
add dl, 0xa4
ror dl, 1
xor bl, dl
rol ecx, cl
jb 0xd03bcd
mov ecx, 0x67959585
movzx eax, cx
lea ebp, [ebp + ecx - 0x67959589]
cbw
mov edx, 0xccb17e9d
mov edx, dword [eax + ebp - 0xff85]
not ax
xor edx, ebx
btc cx, ax
shl cx, cl
btr eax, ecx
dec edx
or eax, eax
neg edx
sub cl, cl
adc eax, eax
not cx
dec edx
rol cl, 0x86
rol edx, 1
shr ax, 0x6b
sal ecx, cl
sub al, ah
xor ebx, edx
add edi, edx
mov edx, ecx
or eax, eax
or eax, dword [esi + eax]
push edx
or cl, byte [ecx + esi - 0x7ffffffc]
sar dword [esp + edx - 0x80000000], 0xf3
lea esi, [edx + esi - 0x7ffffffa]
mov byte es:[edx + eax - 0x80000000], cl
movsx ecx, dl
sub dword [esp + edx - 0x80000000], 0xd9043818
mov dword [esp + edx - 0x80000000], edi
ret
jbe 0xd1a8ed
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x14]
call fcn.00e79f77
jmp 0x5bad54
mov dword [esi + 8], eax
call fcn.00443e48
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
add edi, eax
sub eax, eax
lea esp, [esp + 4]
cmc
test sp, 0xe39d
cmp dword [esi + 8], eax
jmp 0xed2135
jbe 0x607a3e
nop

Function at 0xdfff5e
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], eax
ror byte [esp + 3], 0x65
jae 0x5dbadf
mov ecx, 0xba057828
sub ebp, 4
mov edx, dword [ebp]
xor edx, ebx
not edx
lea eax, [ecx*8 - 0x2c7ad0f5]
neg cl
ror edx, 2
bswap edx
sal eax, cl
dec edx
add al, al
jp 0xdcaede
mov edx, dword [esp + 8]
add edx, 0xfff27080
jmp edx
xor ebx, edx
sub ecx, eax
adc esi, edx
push eax
mov ecx, dword [edi + eax - 0x4b000000]
mov dl, byte [edi + eax - 0x4afffffc]
or byte [esp + eax - 0x4afffffd], al
lea edi, [edi + eax - 0x4afffffa]
inc dword [esp + eax - 0x4b000000]
btc eax, eax
cbw
mov byte ss:[ecx + eax - 0x4b000001], dl
mov dword [esp + eax - 0x4b000001], esi
ret
push 0xec24e80b
jmp 0xd00644

Function at 0xe06d85
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [esp], 0xa89db88e
call fcn.005cff84
Function at 0xe06d92
Capabilities:
Inspect section memory permissions

Disassembly:
push 0xa495b92b
lea esp, [esp + 8]
jne 0xde19a3
mov eax, 0xdc89c126
jmp 0x5e6088
pop ebx
movzx eax, si
cbw
pop esi
movzx edi, al
movsx edx, ax
dec dl
pop edi
mul eax
inc dx
mul ax
mov ecx, dword [edi + edx - 0xcc6]
push edx
neg edx
adc edi, 3
neg dx
cdq
xor ecx, ebx
sal edx, 0x2b
sub dword [esp], edx
dec word [esp + 2]
rol ecx, 1
lea edx, [eax*2 - 0x6c6f1c42]
push eax
push edx
bswap ecx
lea ecx, [edx + ecx - 0x1e6fc6eb]
inc byte [esp + 0xb]
xor ecx, 0x3f3fef21
dec byte [esp + 7]
xor ebx, ecx
and al, 6
xadd al, ah
adc esi, ecx
cdq
cdq
shl eax, 0xbc
pop eax
pop eax
pop ecx
jmp esi
je 0xdfcedf
mov eax, dword [eax]
jmp 0xe401d5
mov esi, 0x250f4187
mov ebp, dword [esi + ebp - 0x250f418b]
mov dword [ebp + esi*2 - 0x4a1e830e], eax
jmp 0x48c253
mov eax, dword [eax + 0x20]
test eax, eax
jmp 0xd16b6a
call dword [fcn.0045008c]
pop edi
test ebx, ebp
shr bx, 7
or si, 0x18b
pop esi
sub al, al
pop ebx
not ecx
movzx ecx, bp
bswap cx
mov ecx, dword [ebp - 0xc]
jmp 0xd8e9d3
mov dword [ebp + 0xc], 0xfffffffe
jmp 0x624be6
mov ecx, dword [ebx]
mov eax, dword [esi + 0xc]
jmp 0xd7b3a5
call dword [fcn.0045008c]
pop edi
sar bh, cl
inc ch
sal esi, 0xa
pop esi
rcl bh, 0xbb
clc
shl cx, cl
sub al, al
xchg ecx, ebx
pop ebx
bswap cx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
jmp 0xd26302
ret 0x10
mov eax, dword [ebp]
call eax
jmp 0x4f648d
je 0xd47a23
call fcn.00432660
mov eax, dword [ebp - 0x20]
clc
jmp 0x53aa9e
je 0x571b98
mov eax, dword [ebp - 0x14]
jmp 0xdf71c8
jmp 0xd7c31d
test eax, eax
jne 0xd6c6da
mov ecx, dword [ebp - 0x14]
push ecx
jmp 0x57dec5
je 0xd81dc4
mov eax, dword [eax]
movzx cx, ch
mov ecx, dword [ebp - 0x10]
jmp 0xe52e77
mov esp, ebp
movsx ebp, bp
pop ebp
jmp 0x443809
mov eax, dword [ebx + 0x20]
cmp edx, 0xde3021b2
test eax, eax
jmp 0x48d5dd
jmp 0x483622
test byte [ebp + 0x14], 1
je 0xd7c30e
xor ebx, ebx
jmp 0xd7c312
mov edx, dword [esi + 0x58]
sub di, 0xe635
sbb edi, 0xf9a29fa1
mov edi, dword [ebp + 0xc]
cmp ebp, edi
cmp esp, 0xdfb4e23f
mov dword [ebp - 0x24], ecx
clc
sub ecx, eax
lea ecx, [ecx - 4]
cmp esi, 0xe122e2b6
jmp 0xdf51a7
mov ebx, dword [ebx + 0x24]
cmc
mov dword [ebp + 0xc], ebx
btr ebx, 0xb
or ebx, ebp
cmp ebp, edx
mov ecx, dword [ebp - 0x10]
clc
cmp edi, ecx
sub eax, eax
jmp 0xe91e63
mov dword fs:[0], ecx
mov esp, ebp
movzx ebp, bp
pop ebp
jmp 0x5a8811
call fcn.00e06d92
mov eax, 0xb6b3d0b0
and al, al
inc eax
mov eax, dword [ebp + ebx*4]
push eax
js 0xdd383b
cmp dword [ebx + 8], 0
jmp 0x5f7a5f
sar ecx, 4
mov ecx, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
cmp esi, ebp
test di, 0xb195
mov dword [ebp - 0x10], ecx
cmp si, 0x8e9e
stc
test edi, edi
jmp 0x5f0349
push eax
jmp 0x55c10b
xor eax, eax
jmp 0xe401d5
dec ebx
jmp 0xd61c8d
mov dword [ebp - 0x18], eax
jmp 0xce02a6
mov dword [ebp - 0x18], eax
jmp 0x5647fd
Function at 0xe15382
Capabilities:
Encode data using xor

Disassembly:
imul ecx, ecx
sbb ebp, 0
mov edx, ecx
movzx ecx, byte [ebp]
xor cl, bl
mov dword [esp], edx
movsx eax, word [esp]
xor cl, 0x3b
cwde
and edx, 0x39ab3e07
neg dword [esp + edx - 0x19001201]
not cl
shr edx, 2
xadd byte [esp + edx - 0x640047e], ah
neg dword [esp + edx*2 - 0xc800900]
ror cl, 1
or eax, eax
not cl
xor bl, cl
ror dword [esp + edx*8 - 0x32002400], 0x5b
dec dword [esp + edx*4 - 0x19001200]
ror byte [esp + edx*2 - 0xc8008ff], 0xa4
lea ecx, [esp + ecx + 4]
mov ax, word [edx + ecx - 0x6400480]
lea edi, [edi + edx*2 - 0xc800902]
mov word [edi + edx*2 - 0xc800900], ax
adc dword [esp + edx - 0x6400480], edx
adc al, 0x80
sti
mov edi, 0x2aac8df9
jl 0xe15403
lea ebp, [edx + ebp - 0x6400484]
call fcn.00d63de6
cli
test al, 0x9a
mov edi, 0xe9d7e8f9
hlt
sbb cl, byte [ebp - 0x5e255c2]
test bl, bh
adc al, 0x63
adc cl, bl
adc edx, dword [ecx + esi*4]
pop esi
ja 0xe153ae
daa
outsb dx, byte [esi]
jo 0xe15425
popfd
aas
jns 0xe15490
or ecx, dword [edi]
jle 0xe15443
lcall 0xc622, 0xc83c112
hlt
test byte [0xaff3abe6], dl
mov bh, 0xa2
push 0x39
xchg dword [ebp - 0x527533e3], esp
nop
pop edx
mov edx, 0xebe0e7aa
mov dword [0xa4db767e], eax
or ebp, edx
dec esi
rcl byte [edi - 0x1f3881bd], 0xf9
das
into
jns 0xe154dc
jmp 0xe153fe
pop ds
leave
push cs
inc byte [edx]
jbe 0xe15412
push 0xd2e97132
arpl word [eax + 0x70], di
inc esp
push ebx
jg 0xe15487
out 0xc6, eax
sbb ebx, dword [ecx - 0x11e3098f]
out dx, al
retf
pushal
mov edx, 0x8af6b674
jae 0xe15459
dec esp
fstp xword [edx + 0x58]
invalid
mov esi, 0x1d32cafb
outsb dx, byte [esi]
scasb al, byte es:[edi]
lodsb al, byte [esi]
mov ebx, dword [esi - 0x57]
invalid

Function at 0xe2c286
Capabilities:
Execute syscall

Disassembly:
not edx
mov dword [esp + eax - 0x10004], ecx
neg edx
call fcn.00dca175
sysenter
push edi
pushfd
mov edi, 0xa0967d31
call fcn.0051dd2e
push ebx
mov ebx, 0xf53aa5a0
pushfd
shr bl, 0x54
neg bx
test bx, 0x5892
mov ebx, dword [esp + ebx + 0xac5a504]
mov dword [esp + 4], 0xb80a8067
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.005e707d

Function at 0xe2cf3a
Capabilities:
Inspect section memory permissions

Disassembly:
sub ebp, 4
mov ecx, dword [ebp]
call fcn.00e5e9a9
jmp fcn.00608943

Function at 0xe38729
Capabilities:
Inspect section memory permissions

Disassembly:
inc dword [esp]
xor edx, edi
push 0x7d8631b8
inc eax
xor edx, 0xc4b20cbf
shr dword [esp + 1], 0xfa
setp byte [esp]
and word [esp + 2], 0x3a85
dec ecx
lea esp, [esp + 8]
jne 0xe38735
pop edi
mov edi, 0xf122af9e
imul edi, edi
movzx edi, byte [eax]
push 0xd92358ae
sal word [esp + 2], 0xa8
xor edi, edx
and edi, 0xff
mov edi, dword [edi*4 + 0x59ae4c]
and dword [esp], 0x9f029b2e
jge 0xe2edda
shr edx, 8
jmp 0x59038c
mov dword [esp], 0x3d38909c
mov dword [esp], edi
jmp 0x5ccbd8
Function at 0xe3e247
Capabilities:
Inspect section memory permissions

Disassembly:
mov edx, dword [esi + ecx - 0x7d977a0e]
mov eax, ecx
mov eax, dword [esi + eax - 0x7d977a0a]
mov ecx, dword [ecx + esi - 0x7d977a06]
call fcn.0049961d
mov edx, 0x9514ce0d
sub ebp, 4
movzx eax, dx
mov ecx, dword [ebp + eax - 0xce0d]
call fcn.00e23849
movzx eax, cx
or ecx, dword [esp + eax*2 - 0x1e704]
jne 0xdb0990
mov ecx, 0x7d977a0e
jmp 0x48c878
mov dword [ecx + edi - 0x6c23f382], edx
xor word [esp + ecx - 0x6c23f382], 0x1d02
neg eax
lea ebp, [ecx + ebp - 0x6c23f386]
neg word [esp + ecx - 0x6c23f380]
mov eax, dword [ebp + ecx - 0x6c23f382]
not ecx
pop edx
xor eax, ebx
lea eax, [edx + eax - 0x775a41fb]
xor eax, 0xf31fe4b7
or cl, 0x18
push ecx
sbb eax, 0xb7a03e9c
rol eax, 3
add cl, byte [esp + 1]
sbb edx, 0x104cd05
shr ecx, cl
xor ebx, eax
call fcn.0063dcd3
add edi, 4
mov eax, ecx
xor edx, ebx
btc ecx, 0xbc
jb 0x5e0d99
sbb cx, cx
xor edx, 0x9aa0918b
sub edx, 0x608d282b
neg edx
bt cx, 0xb8
dec edx
btc eax, eax
mov dword [esp], eax
adc eax, 0x6e2c3fa7
xor ebx, edx
sar cl, 0x63
pop eax
shr eax, 0x59
add ebp, edx
xor cx, ax
movzx edx, cl
not eax
mov ecx, dword [edi + edx*2 - 0xa2]
sar eax, 0x6d
lea edi, [edi + edx - 0x4d]
sar edx, 0xa4
push eax
sub edx, 0x970b7e9c
xor ecx, ebx
lea ecx, [ecx + edx + 0x488dc254]
cdq
ror byte [esp], 6
neg ecx
shr dl, 0xe3
sbb edx, dword [esp]
imul edx, edx
xor ecx, eax
shr al, 0x64
xor al, 0x12
xor ecx, 0x5f85fd36
sub ecx, 0xe23c8d28
sub ax, dx
or byte [esp + edx - 0xc5c1], 0x26
not ecx
xor dl, ah
ror dword [esp + edx - 0xc5f8], 0x5e
cwd
xor ebx, ecx
lea esi, [esi + edx*2 - 4]
sar dl, 0xc2
cwde
and edx, eax
mov dword [eax + esi - 0x395c], ecx
rol eax, 0x59
sal eax, 0xcb
seta byte [esp + eax - 0x39000]
pop ecx
jae fcn.0060bde0

Function at 0xe3e318
Capabilities:
Inspect section memory permissions

Disassembly:
or cx, word [esp + edx + 5]
adc ebp, eax
movzx eax, word [esp + edx*4 + 4]
xor al, byte [edi + edx]
mov dword [esp + edx*4], edx
lea edi, [edi + edx*2 + 1]
shl byte [esp + edx + 6], 0x61
xor al, bl
pop ecx
neg al
shl ecx, 0xc6
dec word [esp + ecx*2]
adc al, 0x20
neg al
sar ecx, 0x4c
setnp dl
dec al
add ecx, 0x639dc62c
xor word [esp + edx + 2], 0xa79d
btc edx, 0x94
xor bl, al
inc dword [esp + ecx - 0x639dc62c]
jne 0xcebcfe

Function at 0xe40309
Capabilities:
Encode data using xor

Disassembly:
inc edx
mul dl
sbb ecx, 0xf123921
mov dword [esp], 0x408aed2f
push eax
bts eax, 0xae
bswap ecx
xor ebx, ecx
add edi, ecx
mov esi, dword [esi]
add edx, edx
pop eax
pop eax
jno fcn.00eb4474

Function at 0xe40fb7
Capabilities:
Inspect section memory permissions

Disassembly:
sbb esi, 8
mov dword [esp], 0x342e1097
shl word [esp], 0x4b
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
jp 0x5da1c5
jae 0xd16375
Function at 0xe45220
Capabilities:
Encode data using base64

Disassembly:
add edx, 0xf9019319
setns cl
shl dl, 0x43
sbb eax, 0xa318a608
xor eax, 0xbd23fc80
and edx, 0xba9dd016
lea eax, [eax + edx*8 + 0x4a53f41c]
neg eax
sar cl, 0xe1
sets dl
bswap edx
dec eax
imul cx, cx
xor ebx, eax
add ebp, eax
mov eax, ecx
not dx
jmp ebp
lea ebp, [ebp + edx - 0x12272afd]
btr cx, 0x2b
btc cx, dx
xor eax, ebx
bt edx, edx
push ecx
inc eax
dec dl
neg eax
add ecx, ecx
dec eax
shl dl, 0xc1
jo 0xd3459b
inc byte [esp + edx - 0x12272aff]
neg eax
xor ebx, eax
add edi, eax
mov esi, dword [esi + edx*4 - 0x489cac00]
xadd edx, ecx
pop ecx
pop edx
jae fcn.0052afe8

Function at 0xe4c718
Capabilities:
Execute syscall

Disassembly:
xor edi, eax
push 0x99a53228
mov dword [esp + 4], 0x8481c21b
and edi, 0xff
mov edi, dword [edi*4 + 0xd9f990]
not dword [esp + 1]
jmp 0xe25bd5
Function at 0xe4d172
Capabilities:
Inspect section memory permissions

Disassembly:
not ecx
shl edx, 0xbd
sar dx, 0xee
neg ecx
dec al
mul dx
neg dl
dec ecx
btc edx, 0xb1
xor edx, eax
bswap ecx
shr dl, 0x22
shl edx, 0xec
xor ebx, ecx
call fcn.00ce03ef
call fcn.00e09fbe
int3
adc dword [esp + edx], edx
mov dword [esp + edx], ebx
mov ebp, 0xcaa74890
movzx ebx, bp
call int.0053b32d
xor eax, edi
call fcn.00e7f3d7
mov eax, dword [esi]
mov ecx, dword [esi + 4]
add esi, 4
mov edx, 0xeba12c10
add edx, edx
adc dx, 0x6f0b
adc eax, ecx
mov dword [esi], eax
mov ecx, dword [edi]
add edi, 4
movsx eax, dx
xor ecx, ebx
inc ax
sar al, 0x26
dec ax
sbb ecx, 0x4016cc33
mul eax
bt edx, 0x9e
jb 0x43de00
mov eax, 0x5a9c4831
mov ecx, eax
lea edi, [edi + ecx - 0x5a9c4835]
dec eax
lea edx, [ecx*8 + 0x65077804]
mov ecx, dword [ecx + edi - 0x5a9c4831]
neg edx
ror dx, 0xa1
xor ecx, ebx
dec edx
shr ax, 0x24
shr eax, 0x87
lea ecx, [ecx + eax - 0x4340ca12]
je 0xd0d86c
inc edx
and al, 0xbd
ror ecx, 3
cbw
sub eax, eax
dec ecx
shl dl, 0xc2
bswap ecx
xor ebx, ecx
bts eax, edx
adc ebp, ecx
push edx
rol eax, 0x86
rol al, 0x81
mov esi, dword [eax + esi - 0x4000]
lea ecx, [edx + eax*4 - 0x6b71ff4a]
xadd ax, dx
setb al
pop edx
jne fcn.00ec7009
mov dword [esp], 0xb5346a1c
mov ebx, dword [ebx*4 + 0x5e74d8]
jmp 0xe17a1f
adc esi, edx
pop eax
movsx edx, ax
inc cx
jmp esi
xor eax, ebx
inc edx
xor eax, 0xa98b3c88
sal dword [esp + 2], 0xbd
neg dword [esp + 4]
shl byte [esp + 3], 0x64
dec ecx
jmp 0xe575a7
mov ebx, 0xb2b03f9f
and ebx, ebx
movzx ebx, byte [edx]
jae 0xdf21ac
bswap ecx
xor ebx, eax
add ebp, eax
not dx
mov dword [esp + edx - 0x4e105fdf], ebp
ret 0xc
xor ebx, eax
jmp 0xe0979e
lea esp, [esp + 8]
jne 0xcdb62d
push 0x4a2a3f84
mov ebx, dword [esp + 4]
lea esp, [esp + 8]
not eax
mov dword [edi], eax
mov edx, 0xf39ab02e
movsx eax, dx
mov eax, dword [ebp]
shl dl, 0xc1
btr dx, 0x1c
adc ebp, 3
call fcn.0046fffa
adc esi, edx
call fcn.00dc2816
ror edx, 1
bt ecx, eax
sar eax, 0x94
sbb edx, 0x9aad4f18
rol eax, cl
bswap edx
shr al, 0xc3
dec edx
xor eax, ecx
imul ecx, eax
ror edx, 1
neg ax
sets cl
xor ebx, edx
sar al, 0x46
push ecx
jp 0x52525e
cmpsd dword [esi], dword es:[edi]
adc al, 0x34
ret 0x935
and ebx, 0xff
call fcn.00dfcba2
inc al
xadd word [esp + edx - 9], dx
xor edx, edx
xor bl, al
mov dword [esp + edx*2 + 8], edi
btr dx, dx
rol edx, 0xc2
xor dl, dl
mov dword [esp + edx*2 + 4], ebp
jle 0x4e59b1
shl ecx, cl
lea edx, [ecx + edx - 0x446bb9e0]
add al, cl
bts ecx, 0x1b
btr ecx, ecx
xor edx, 0x698fd411
shr eax, 0xd5
sbb ecx, eax
bswap edx
rol edx, 3
xor ebx, edx
neg cx
shl ecx, cl
shl eax, 0xda
add edi, edx
mov edx, dword [esi + ecx - 0x3f00000]
mov ecx, dword [edx + ecx - 0x3f00000]
mov dword [esi], ecx
mov ecx, 0x40858885
lea edx, [ecx + ecx*2 + 0x27121a3b]
rol ecx, cl
jmp edi
shr eax, 8
push 0x1490901b
ror dword [esp + 4], 0x82
jae 0x550a53
push 0xcd813625
inc byte [esp + 1]
mov edi, dword [edi*4 + 0xdf352c]
mov dword [esp + 4], 0xd30e481c
shr eax, 8
jmp 0x515cf6
jmp 0xe07c42
Function at 0xe5a3cb
Capabilities:
Execute syscall

Disassembly:
sal dword [esp], cl
mov edx, ecx
shr cx, 0xcb
mov eax, dword [ebp]
or word [esp + 2], dx
ja 0x5ccc20
sar byte [esp + edx - 0x6cc83472], 0x45
dec eax
xor eax, 0x7c804cb4
add cx, word [esp + edx - 0x6cc83472]
imul ecx, ecx
call fcn.00d12b5a
jnp 0xe4ba62
mov eax, 0xe9335730
rdtsc
mov ecx, 0x111c0ba3
xor cx, cx
neg cl
lea esi, [esi + ecx*2 - 0x22380008]
add ecx, ecx
add cl, cl
mov dword [ecx + esi - 0x2237fffc], eax
mov eax, 0xf2188d31
dec al
mov dword [esi + ecx*2 - 0x44700000], edx
mov edx, eax
dec cx
mov ecx, dword [ebp + ecx*2 - 0x4471fffe]
adc ebp, 4
xor ecx, ebx
rol eax, 0x52
bswap eax
jae 0xd628eb
dec ebx
and eax, 0x6a1c271
fsub dword [ebp - 3]
sbb dword [ecx + ecx*2], 0xdc6f021d
jmp 0x510fcd63
rol ecx, 2
xor edx, eax
and eax, edx
not dl
sbb ecx, 0xbd8f5832
btc ax, ax
add edx, edx
cbw
bswap ecx
dec edx
and dx, ax
ror ecx, 3
jmp 0xd9e48a
sar edx, 0x5e
adc dl, 0xb3
xor ebx, ecx
neg eax
add edi, ecx
call fcn.0055209c
mov ecx, 0x302ec6aa
movsx eax, cx
call fcn.00490216
not edi
shr di, 0x9f
add edi, 0x3b11a894
mov edi, dword [esp + 8]
mov dword [esp + 8], 0x9072347
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call int.0057341d
mov ecx, 0xaf8611bd
mov edx, dword [edi]
movsx eax, cx
div al
rol ecx, 0x41
mov eax, dword [eax + edi - 0x514]
bt cx, cx
sal cl, 0xc5
jae 0x4425d1
mov ecx, dword [ecx + edi - 0x5f0c2358]
push 0x52adc901
adc edi, 3
div ecx
sar dword [esp], 0x1d
push 0xca1281c
mov ecx, 0xf629bf0c
mov dword [edi], edx
mov dword [edi + 4], eax
lea edx, [ecx + 0x76967527]
mov eax, dword [edx + ebp - 0x6cc03433]
mov word [esp + edx - 0x6cc03433], dx
neg cl
lea ebp, [ebp + edx - 0x6cc0342f]
ror ecx, 0xde
btc dx, 0x86
xor eax, ebx
bts edx, ecx
add dword [esp + edx - 0x6cc83471], 0x5b8e9c05
inc eax
rol eax, 2
pop ecx
jmp 0x4e4c49

Function at 0xe5b7df
Capabilities:
Authenticate hmac
Inspect section memory permissions

Disassembly:
mov dword [esp], 0xf6f6f7ef
call fcn.00e0b0c3

Function at 0xe66dde
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x80027d63
call fcn.005e707d
Function at 0xe6cca9
Capabilities:
Encode data using xor

Disassembly:
dec eax
xor ebx, eax
bt dx, 0xbc
sar dx, 0xae
lea ecx, [ecx - 0x50c21ee3]
add ebp, eax
jmp ebp
call eax
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov esi, 0xf5293cbf
mov edi, esi
sal edi, 0xaa
mov esi, ebp
movsx ebp, di
pop ebx
pop ebp
lea edi, [edi + edi*4 - 0x5ad1987e]
movsx ecx, di
jae 0x5fb551
inc ebx
movzx edx, word [ecx - 0x20]
inc ecx
shr esi, 0xc9
inc ebp
or esp, esi
dec edi
lea ecx, [ecx + esi*4 - 0x1616c7e]
dec ebx
lea ebx, [esi + 0x12023887]
jge 0x554bb3
movzx ecx, dl
jns 0xe54980
push ebp
mov dword [esp], 0xa89aebfb
call fcn.005cff84
pop ecx
pop ecx
jmp esi
mov eax, 0x2c31c22b
mov eax, dword [ebp + eax*2 - 0x58638456]
jmp 0x431905
sal dword [esp], 0xd0
adc edi, 4
shld ax, dx, cl
mov ecx, dword [esp]
movzx edx, cx
and edx, edx
mov word [edi + ecx - 0x30b80000], ax
push ecx
mov dword [esp + edx], esi
ret 4
mov eax, dword [edi + ecx - 0x5382]
add cx, 0x9b11
jae 0xe92efe
call fcn.00cfe629
mov ebp, 0x5538671a
inc cx
xor edx, eax
xor dx, 0x6c1f
neg dx
dec dx
dec eax
lea ecx, [ebx + ebx - 0x7e7964c3]
dec ecx
ror esi, 0xef
rol dx, 1
not ebp
dec eax
btc ebp, ebp
call fcn.00515b6a
pop edi
movzx eax, cx
jp 0x4bac1a
pop ecx
sal cx, 3
mov dx, word [edi + 2]
mov cl, byte [edi + 4]
push 0x2e9030b8
jp 0x4a5483
jmp 0xd02f77
lea esp, [esp + 0x14]
jmp 0x43777b
mov ebx, edi
mov ecx, 0
sub ebx, ecx
mov ebp, 0xd400aea7
btr bp, 0xa9
lea ebp, [0xe54989]
mov ecx, 0xca87d4bf
neg ecx
mov edx, 0x8f8b043a
mov eax, dword [edi + ecx*2 - 0x6af05682]
lea edi, [edi + ecx - 0x35782b3d]
shl ecx, cl
xor eax, ebx
shl dl, cl
shr dx, 0x85
ror eax, 1
sal ecx, cl
sub dx, 0x9631
lea eax, [eax + edx - 0x6ae593df]
mov dword [esp + eax - 0x614def01], ebx
rol dl, 0x66
movzx ebx, al
mov ebp, esi
mov ebx, ecx
xchg edx, eax
and eax, eax
bts edx, 0x95
mov edx, ebx
bswap eax
adc ax, ax
shl edx, 2
not ax
mov eax, ebp
push 0x421ce606
rol word [esp + 1], 0xc8
mov dword [esp], 0x38a03c29
adc eax, edx
sub dword [esp], 0xe81c5a8
mov dword [ebp - 4], eax
test ebx, ebx
push 0xcdb51f2e
lea esp, [esp + 8]
je 0x48cb32
mov eax, 0xc027641a
mov eax, dword [ebp + ebx*4]
push eax
push 0x9ca157b6
call fcn.0048cb11
lea edi, [ecx + edi - 0xee8f]
movsx edx, cx
xor eax, ebx
rol eax, 3
or edx, edx
or dx, dx
bswap eax
lea eax, [eax + ecx*8 + 0x7014dc8a]
lea edx, [ecx*8 - 0x7b681160]
rol eax, 2
jmp 0x431780
Function at 0xe71a14
Capabilities:
Authenticate hmac
Inspect section memory permissions

Disassembly:
mov eax, dword [edi]
mov edx, 0x4db79bb2
lea edi, [edi + edx - 0x4db79bae]
lea ecx, [edx + edx*8 + 0x2433030e]
inc edx
dec dx
lea ebp, [edx + ebp - 0x4db79bb3]
shl cx, 0xaf
movzx edx, byte [ebp + edx - 0x4db79bb2]
bswap ecx
lea ecx, [ecx + 0x2c276b06]
rol cl, 0x82
xor dl, bl
add ecx, ecx
sub ecx, 0x1e3d4235
sbb dl, 0x19
and ecx, ecx
neg cx
not dl
imul cx, cx
jo 0x5d7162
inc ecx
mov ebp, 0x67898222
inc ebx
mov edx, dword [ebp + ecx - 0x67898222]
inc cx
shr ebp, 0x26
dec edi
lea ecx, [ebp + ecx - 0x67890204]
inc ebp
sbb ch, ch
jp 0x52e40b
xchg dword [esp], ecx
inc dl
not dl
xor ecx, ecx
xor dl, 0x9a
jmp 0xdabd12
call fcn.00e1c98c
mov ax, word [edi]
mov ecx, 0x33b90281
lea edi, [ecx + edi - 0x33b9027f]
movsx edx, cx
imul dx, cx
sar cx, 0x68
lea ebp, [ebp + ecx*2 - 0x67720005]
movzx edx, byte [ecx + ebp - 0x33b90002]
sar ecx, 0x67
btr ecx, ecx
push ecx
xor dl, bl
lea ecx, [ecx*8 - 0x59da3b71]
sar cx, cl
bts ecx, ecx
ror dl, cl
ror cl, 0xe7
jae 0xe6b1c9
mov eax, 0xcfba2bb6
jmp 0x4ec882

Function at 0xe77f15
Capabilities:
Encode data using xor

Disassembly:
jmp [ebx]
inc esp
adc esp, edx
call fcn.00e7b2ff
sub al, 0xa1
aaa
jb 0xd81754
jns 0xd81776
cmpsb byte [esi], byte es:[edi]
mov dword [0x3bab2854], eax
pop ss
cld
xor esp, dword [ebx*8 - 0x22efafdf]
mov bh, byte [esp + 0x637bfe70]
mov cl, 0xe7
invalid
arpl word [ecx + 0x7acc8fe7], si
fcom qword [edx - 0x4a]
push ebx
std
mov dl, 0x95
and dh, byte [ebp + 0x78]
inc eax
adc dword [edi - 0x78005009], esi
add dword [eax], eax
cmp al, ah
mov bh, 0xf7
scasd eax, dword es:[edi]
inc dword [edi - 0x1fc7ffff]
dec esi
cmpsd dword [esi], dword es:[edi]
dec eax
jmp [edx + 1]
mov al, byte [0x64fbad52]
outsd dx, dword [esi]
sub al, 0xc
and byte [ebx + 0x30], bh
jo 0xd81708
jp 0xd81742
nop
sub eax, 0x2f3705af
mov al, 0xa9
mov byte [esi + 0x6f], 0x46
cld
push ds
mov ebp, 0x64d1bd40
adc al, 0x35
pop edi
pop edi
xor al, 0x14
iretd
dec esi
mov eax, dword [esp - 0x3b319618]
dec eax
mov dword [esp + edx*2 - 0x52], ebx
dec ebp
arpl bp, bp
jae 0xd8171e
mov edx, dword [edi]
jmp 0x5965fd