joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1a6faa7
Capabilities:
Encode data using xor

Disassembly:
not edx
sbb ebp, 1
sub dl, 0x8f
mov word [ebp], cx
sbb edi, 4
sal byte [esp + 2], 0xa5
xchg dword [esp], edx
lea ecx, [eax*8 + 0x7b950c28]
mov eax, dword [edi + ecx*2 - 0x50e5cbd0]
dec dword [esp + ecx*2 - 0x50e5cbd0]
rol ecx, 0xe7
xor eax, ebx
btc dx, cx
not byte [esp + ecx - 0x3972f413]
inc eax
pop ecx
xor eax, 0x3913c595
btr cx, dx
or ecx, edx
inc cx
lea eax, [eax + ecx - 0x6be7ed2b]
jnp 0x192a300
sub edx, edx
call fcn.013b2ba1
mov ecx, dword [esi + edx - 0x6e37bfaf]
xor dl, 5
shr eax, 0x2d
lea esi, [edx + esi - 0x6e37bfa6]
bswap eax
xor ecx, ebx
shr al, 0x21
cwde
or al, al
neg ecx
xchg ah, al
sub ecx, 0xcf0c922b
call fcn.012cdade
neg al
and dx, 0x77b4
not cl
imul ecx, edx
adc al, cl
xor ecx, edx
adc dl, dl
xor bl, al
ror dx, 0x8c
adc byte [esp + edx - 0x3d853fff], ch
imul dx, cx
lea eax, [esp + eax + 4]
inc dx
mov cx, word [edx + eax - 0x3d85a001]
mov eax, 0x959bbb38
jno 0x136cc18
mov ebx, 0x483cc7cd
xor al, 0x6a
salc
push 0xffffffffffffffd6
push ds
daa
xor eax, 0x6d4e63c0
cmp dl, bh
popfd
clc
cdq
imul dword [ecx - 5]
out dx, al
lodsd eax, dword [esi]
cmp eax, 0xd5abc4b2
and al, 0x74
mov dh, 0xa6
xchg byte [ebx], dh
wait
push ss
idiv ch
dec ecx
not edx
stosd dword es:[edi], eax
adc esi, dword [edx + 0x59]
sbb dword [ecx + ebp*2 - 0x5ec78a9d], esi
xchg ebp, eax
xor esi, esi
arpl word [edi], ax
mov al, byte [0xec7b2ab8]
fsubr dword [ebp - 0x6d433150]
push cs
das
xor byte [edx], cl
pinsrw xmm1, word [ecx], 0x11
or dword [ebp + 0x2a596922], 0x5944d9b4
add ah, byte [edx]
enter 0xd5b, 1
mov dword [0x9a1b44ca], eax
dec esi
rcr dword [ebx + ecx*2 + 0x52], cl
call 0xe1a1c5e5
lcall 0xf84b, 0xa1252a17
push eax
pop ebp
and eax, 0x7b055056
pop ds
out dx, eax
out 0x3c, eax
pop ds
jnp 0x1954101
ffree st(4)
xor dword [edx + edi - 0x60f841ce], 0x7e99e6e0
in eax, dx
xor dword [esi + 0x46], ebp
inc ecx
mov bl, 0x57
invalid
lea esp, [esp + 0x18]
je 0x1b415ed
call fcn.01333b99
mov edx, 0x6e37bfaf
movsx eax, dx
jmp 0x1954091

Function at 0x1a753b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, ebx
imul al
shr dl, 0xc4
cwde
bswap ecx
neg edx
rol ecx, 2
neg ecx

Function at 0x1a77086
Capabilities:
Encode data using xor

Disassembly:
sar ecx, cl
mov word [ecx + esi - 1], dx
or eax, 0x6c3469ba
pop eax
movsx eax, cx
lea ebp, [ebp + ecx*4 - 8]
jne 0x1b7610e
test dword [esi - 0x10], ebp
sldt word [ecx - 0xa]
loopne 0x1a770b3
inc ecx
mul al
btr eax, eax
mov bl, 0xc0
rol ecx, 1
lea eax, [eax*4 + 0x55279d94]
sub edx, 0xf021b335
and eax, esi
bswap ecx
sal al, 3
rol eax, 0x4c
and ax, ax
xor ebx, ecx
xchg dx, ax
add edi, ecx
cwde
lea ebp, [ebp + eax*2 - 0x9998]
not edx
mov ax, word [ebp + eax*4 - 0x1332c]
xor ax, bx
dec ax
not dl
neg dl
sub edx, 0x80a88af
not ax
shl dl, 7
call fcn.01d1bfce
neg bl
and eax, 0x19ee6886
mov esp, dword [edx - 0x2f6561d8]
add al, 0x69
loope 0x1a7709b
pop ss
pop edi
fild dword [eax]
in eax, dx
mov byte [0xca1f910f], al
pop esp
mov ecx, 0xbaa8ea65
adc ah, byte [eax + edx*2 + 0x17]
add eax, 0xb58129ea
neg dword [edx + 0x4b]
out 0x5a, al
push edi
or al, byte [eax + edi*8 + 0x42]
adc ebp, edx
out dx, eax
invalid
Function at 0x1a77304
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
add edi, eax
xchg dword [esp], edx
lea ebp, [ebp + edx - 4]
and dword [esp + edx*2], 0x4f24e53b
movzx eax, byte [esp + edx]
or edx, dword [esp + edx]
mov edx, dword [ebp + eax*8 - 0x150]
sal dword [esp + eax - 0x2a], 0x74
rol eax, 0xf7
sub ecx, eax
xor edx, ebx
neg eax
sub ax, cx
xor edx, 0xbe3c0cb8
pop eax
lea edx, [edx + eax*2 + 0x2f48ff3b]
bt ecx, eax
inc cl
jne 0x12cece4
mov ecx, 0x6888548e
mov eax, dword [ebp + ecx - 0x6888548e]
xor eax, ebx
mov edx, ecx
mov dword [esp + ecx - 0x6888548e], 0xa28f718c
pop edx
sub eax, 0xc5abbf2b
sub edx, edx
sal edx, cl
ror eax, 2
push edx
rol ecx, 0xd5
lea eax, [eax + ecx - 0x48e7e5c]
xor cx, word [esp + edx*2 + 2]
dec dl
xor eax, 0x2c176e8b
add edx, 0x9199562f
btr ecx, 0x83
jb 0x12e5a0f
adc eax, 0x34f3bf55
jb 0x1a77392
iretd
adc dword [edx + 0x2b5d0b98], esp
out 0xf1, eax
mov byte [esi + 0x2f5e7309], bh
in eax, 0xeb
xor byte [edi], 0x73
or eax, 0xce1eb5c3
inc ecx
xchg edx, eax
dec esp
sub byte [esi + 0x20fca180], bh
add ebp, dword [ecx - 0x769ce8b3]
sti
and eax, 0xa59664b4
xchg esi, eax
movsd dword es:[edi], dword [esi]
dec edi
add byte [eax + 0x15a5606d], ah
adc edx, 8
sbb byte [edx + eax], cl
lahf
pop ebx
je 0x1a77367
mov al, byte [0xb3d6cca9]
inc edx
inc esp
pop ecx
int3
Function at 0x1a89e94
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi], eax
sub ebp, 4
movsx eax, cx
mov eax, dword [ebp + eax*4 - 0xd854]
xor eax, ebx
sub ecx, 0xe896680b
call fcn.01b9ab48
lea ebp, [ebp + edx - 0x3707]
sub ecx, edx
sar cx, 0x61
ror cx, 0xcc
mov eax, dword [ebp + edx - 0x3703]
setp cl
ror edx, cl
neg cl
xor eax, ebx
push edx
lea edx, [edx*8 - 0x2fe5b2d9]
lea eax, [eax + edx - 0x3474c3fd]
inc cl
bswap eax
sub eax, 0xc8b93e2d
sal word [esp], 0x83
or byte [esp + 2], cl
shr dl, 0x24
rol eax, 3
sub eax, 0x9d9d6405
xchg byte [esp + 1], dl
shr byte [esp + 3], 0x87
xor eax, 0x8e85b881
ror cl, 0xe1
xadd dword [esp], edx
rol eax, 2
inc edx
sub dword [esp + edx*4 - 0x4000824], edx
sbb dword [esp + edx - 0x1000209], edx
xor eax, 0xb9a26cbd
not cx
xor ebx, eax
neg byte [esp + edx*2 - 0x2000411]
add edi, eax
pop ecx
mov dx, word [edx + esi - 0x1000209]
mov eax, ecx
jmp 0x1a88c40
sete cl
movzx ax, byte [ecx + edi - 0x229d4c00]
xadd ecx, edx
adc dl, byte [edi + edx - 0x229d4bfe]
neg cl
push ecx
lea edi, [edi + ecx - 0x4bc650ee]
not al
adc ecx, dword [esp + ecx - 0x4bc650f0]
pop ecx
not dl
shl ecx, 0xd5
or al, dl
mov word [edi + ecx*2 - 0x3c000000], ax
movzx eax, cl
and cx, 0x6432
bswap eax
or eax, esi
jmp eax
mov ax, word [esi + 2]
mov cl, byte [esi + 4]
call fcn.01a1e70f
mov ecx, 0x71a62f1a
lea ebp, [ecx + ebp - 0x71a62f1e]
movsx eax, cl
mov eax, dword [ebp + ecx - 0x71a62f1a]
lea edx, [ecx*8 - 0x5df7b441]
xor eax, ebx
sub eax, 0x792e0c92
bswap eax
and ecx, 0x2eae9802
sbb eax, 0xe7b84025
inc dx
lea ecx, [edx*2 - 0x3bd9d5f8]
not eax
xor cl, 7
and edx, 0x39ad0d37
xor ebx, eax
btc ecx, 0xb2
neg cx
add esi, eax
or cx, dx
jp 0x134db02
imul ecx
mov ecx, 0xb8294f3c
add ecx, ecx
mov dword [esp + ecx - 0x70529e78], ecx
mov dword [ecx + edi - 0x70529e78], edx
ja 0x12e135f
mov dword [edi + ecx - 0x70529e74], eax
push ecx
lea ebp, [ebp + ecx - 0x70529e7c]
mov edx, dword [ecx + ebp - 0x70529e78]
movsx eax, cl
xor edx, ebx
xor edx, 0xba0c9202
lea edx, [edx + eax*2 - 0x27bad116]
ror edx, 1
pop eax
lea edx, [edx + ecx + 0x6bbcc50b]
add eax, 0xae1848bf
mov byte [esp + ecx - 0x70529e78], 0x32
jns 0x1ca2d43
xchg edx, eax
add bh, byte [edi + 0x4206ca01]
xor dword [0x6abba000], 0x196921ca
sbb bh, byte [edx + ecx*8 - 0x47]
adc eax, 0xbf35905f
push edi
arpl dx, cx
lds eax, [ebp + 0x4d3596b7]
xchg ebp, eax
sbb eax, 0xf435af8c
nop
or dword [ecx - 0x36], 0xa01d5e56
xor eax, 0xc7d2cede
push es
sbb ecx, dword [ebp + 0x44ab4a7b]
invalid
xor ebx, edx
xor eax, dword [esp + eax - 0x1e6ae737]
adc esi, edx
lea edx, [ecx - 0x4543bcb]
cwd
mov dword [esp + ecx - 0x70529e78], esi
ret
Function at 0x1aab887
Capabilities:
Encode data using xor

Disassembly:
cmovb ax, cx
xor edx, ebx
bts cx, 0x3d
inc ax
inc ecx
lea edx, [edx + eax*4 - 0x70975a0f]
sets cl
div cl
sal ax, cl
rol edx, cl
dec edx
xor ecx, 0x198b371e
sub ecx, eax
bswap edx
bts ecx, eax
xor ebx, edx
inc ecx
lea edi, [edi + eax - 0x202]
btc ecx, eax
and eax, 0x4ebeac9f
mov dword [edi + eax*8 - 0x4f0], edx
jne fcn.01cc30f9
bts dx, cx
xor eax, ebx
or edx, ecx
sar cx, 0x67
neg eax
mov dword [esp + ecx*8 - 0x1f7f880], ecx
or dword [esp + ecx - 0x3eff10], 0xaba8460a
add word [esp + ecx - 0x3eff10], dx
rol eax, 1
inc eax
xchg dword [esp + ecx - 0x3eff10], ecx
ror eax, 3
sar cl, 0x83
bswap eax
xor ebx, eax
xor dl, ch
adc dword [esp + edx - 0x5bffdf05], 0x4b06d325
pop edx
adc ebp, eax
movzx eax, cl
lea esi, [edx + esi - 0x4b45d239]
ror dx, 0xc9
mov edx, dword [edx + esi - 0x4b451ae9]
bts ecx, ecx
jae 0x1a0d325

Function at 0x1abedb8
Capabilities:
Encode data using xor

Disassembly:
or edx, ecx
sub byte [esp + eax - 0x7128dcfc], ah
or eax, dword [esp + eax - 0x7128dcf9]
xadd dword [esp + 4], eax
not edx
movzx ecx, word [esp + 4]
not cl
mov dword [ebp + ecx - 0xfe05], edx
call fcn.01c49e86
mov dword [esp], 0x27219dbf
xor ebx, ecx
imul dword [esp + 1]
sal edx, 0x32
adc edi, ecx
mov edx, dword [edx + ebp - 0x6b900000]
movsx ecx, ax
mov ecx, dword [ebp + eax - 0x7128dcf8]
or ax, ax
inc dword [esp + eax - 0x7128dcf9]
lea ebp, [ebp + eax - 0x7128dcf8]
bts eax, eax
jb 0x192a3a5
sub dl, dh
and edx, 0x2128e42e
mov byte ss:[eax + edx*2 - 0x2414040], cl
sbb dl, dl
inc dx
movsx eax, dl
jmp edi

Function at 0x1aeb901
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0xc]
je 0x2551763
Function at 0x1af0604
Capabilities:
Authenticate hmac

Disassembly:
ror al, 0xa2
inc ebp
xadd ch, ah
jg 0x1921387
inc ebp
movzx ebp, byte [edi + edi*2]
inc esp
movsx ecx, ax
dec ecx
mul ecx
jno 0x1be4a0a
mov ecx, 0x3724f087
lea eax, [ecx + ecx - 0x4a6abede]
btc ecx, eax
lea ebp, [ebp + ecx*2 - 0x6e4be112]
mov edx, 0xc9842396
mov eax, dword [ecx + ebp - 0x3725f087]
bts cx, cx
xor eax, ebx
add dl, dh
lea eax, [ecx + eax + 0x21eb7a2e]
not eax
bt ecx, edx
lea eax, [eax + edx - 0x62684c31]
or dx, cx
neg ecx
not eax
inc ecx
xor ebx, eax
or dx, 0xd21b
sbb ecx, edx
add edi, eax
xadd dl, ch
mov si, word [esi]
lea eax, [ecx*2 + 0x570e7805]
jne fcn.01bc041e
inc ecx
ror esi, 2
bswap eax
inc ecx
push ebx
dec esp
mov dword [esp + edx*4], edx
inc esp
xadd bl, ch
inc esp
xor dword [esp + edx], esi
or dx, ax
inc ecx
pop edx
inc ecx
setg cl
dec ebp
arpl si, si
dec ecx
adc esi, esi
rol bl, 0x47
jae fcn.019f821c
ror dl, 0x45
xor ecx, ebx
rol ecx, 2
neg ecx
shl edx, 0x3d
push eax
mul dl
xor ecx, 0xb28bf2ac
sub ecx, 0xf4a02cad
xor word [esp + edx + 2], ax
ror word [esp + edx], 0xa9
setp byte [esp + edx*4 + 1]
bswap ecx
xor ebx, ecx
add ebp, ecx
lea ecx, [eax + edx + 0x121ccf0d]
mov dword [esp + edx*2], ebp
ret
xchg dword [esp + ebx - 0x517d2587], ecx
bt ebx, 0x86
inc ecx
ror al, 1
inc cx
rol ebx, 0xf
dec esi
mov dword [esp + esi*4 - 0x23000000], ebx
inc ecx
xor al, 0x14
add ax, word [esp + ebx - 0x517d2576]
inc ecx
neg al
neg word [esp + ebx - 0x517d2583]
inc ebp
sbb al, dh
dec eax
cwde
inc ecx
ror al, 1
rol ax, 1
inc ebp
xor dl, al
dec esi
lea eax, [esp + eax + 0x20]
inc cx
mov ebx, dword [eax + ebx - 0x517d2594]
mul edx
inc edx
sbb dword [esp + esi - 0x8bfffed], 0x1b86e5ac
inc cx
mul esi
dec edx
lea ebp, [ebp + esi - 0x8c00002]
inc dx
mov dword [ebp + esi*2 - 0x11800000], ebx
inc edx
neg dword [esp + esi - 0x8bffffb]
inc edx
mov dword [esp + esi - 0x8bfffe8], eax
js 0x12fce32
inc ecx
pop esp
inc ecx
pop ebp
pop edi
inc ecx
pop ebx
jno fcn.019f821c
lodsb al, byte [esi]
push edi
pop esi
mov ebp, 0x460a4322
leave
mov dword [0x2cfb4397], ebp
adc cl, al
dec ecx
mov ebp, dword [ebp - 0x61971bb5]
or dword [ebx + 0x40383367], edx
les esi, [edx + 0x39e7bcea]
xor byte [edi - 0x14], bl
lodsd eax, dword [esi]
sahf
invalid
Function at 0x1b0fa56
Capabilities:
Encode data using xor

Disassembly:
not dword [esp + 0xc]
lea esp, [esp + 0x10]
jmp 0x1d6c0b6
inc edx
mov dword [esp + 4], 0x560ca285
xor edx, 0xb21ae1b6
push 0x4cb59498
xor ebx, edx
add esi, edx
jmp 0x13591b1
in eax, 0xcc
arpl word [ebx + edx + 0x7b27183d], si
lcall 0x38cd, 0x11af3a5d
fcom qword [edx]
imul esi, dword [edi + ebx*2], 0xffffff82
cmp byte [esi - 0x57], dl
out dx, al
sbb esp, dword [edi - 0x6c]
fisttp qword [ebx - 0x4b]
mov dh, byte [ecx]
push es
lcall 0x76af, 0x640f26b1
xor byte [esi + esi*2 + 0x7ca1ce7], ah
aam 7
push 0xffffffffffffffed
pushfd
push 0xffffffffffffffc9
invalid
call fcn.01a5d303
jbe 0x1d6c050
mov byte [0x33a5ecb1], al
mov ebp, 0x54445e4d
and al, 0xaa
dec ebp
lcall 0xc5ff, 0xb3862639
cmp al, 0x4f
sub byte [edx], bh
mov ah, byte [ebx - 0x980b0bd]
sbb byte [edx + 0x607a1854], dh
jp 0x1d6c141
movsd dword es:[edi], dword [esi]
mov bl, 0x8b
outsb dx, byte [esi]
cdq
inc esi
nop
mov byte [0x9d2246e2], al
xor byte [0xb9370b18], ch
out 0xb1, al
xchg edx, eax
inc esp
dec edx
mov dh, 0x69
sal al, cl
cmp dword [ebp - 2], edx
sahf
xor dword [ecx*2 + 0x6a515b42], edx
lcall 0xe405, 0x2a7d2835
jnp 0x1d6c0f7
mov ebp, 0x829bc0a7
xor esi, esi
jbe 0x1d6c0df
hlt
mov dword [0x6acc18ed], eax
mov ecx, 0xdd58330a
hlt

Function at 0x1b1babf
Capabilities:
Execute syscall

Disassembly:
shr ecx, cl
lea esi, [esi + ecx*4 - 0x2c9fc]
mov dword [esp + ecx - 0xb27e], eax
sub ax, word [esp + ecx*4 - 0x2c9f8]
xor dword [esp + ecx - 0xb27e], 0xde12ce1f
mov edx, dword [esi + ecx*8 - 0x593f0]
inc dword [esp + ecx - 0xb27e]
xor edx, ebx
not ecx
bswap edx
call fcn.01c6c57e
sysenter
push ebp
mov ebp, 0xf0ace594
call fcn.019cf6c7
mov ecx, 0x27afe81a
lea eax, [ecx + ecx*4 - 0x675edcdf]
mov edx, 0x26238a88
mov edx, dword [ecx + esi - 0x27afe81a]
cbw
push ecx
mov cl, byte [esi + ecx - 0x27afe816]
sar dword [esp + eax - 0x5f10ffa3], 0xed
lea esi, [eax + esi - 0x5f10ff9d]
not al
mov byte ss:[edx + eax - 0x5f10ff5c], cl
bts eax, 3
imul byte [esp + eax - 0x5f10ff59]
lea ebp, [ebp + eax - 0x5f100004]
movzx ecx, ax
movzx edx, cx
mov eax, dword [eax + ebp - 0x5f100000]
xadd cl, ch
dec ecx
rol dword [esp + edx], cl
xor eax, ebx
neg eax
add byte [esp + edx*2], 0x86
sbb eax, 0xc22fb8bb
and edx, 0x2d120717
neg cx
xor dx, dx
bswap eax
sal word [esp + edx + 1], cl
sal dl, cl
xadd dword [esp + edx*2], ecx
sbb eax, edx
xor ebx, eax
shr dword [esp + edx*8], cl
sub word [esp + edx*2 + 2], 0xbc86
inc ecx
add edi, eax
mov dword [esp + edx], edi
ret
Function at 0x1b26b99
Capabilities:
Authenticate hmac

Disassembly:
xor eax, eax
push 0x951d3116
inc dword [esp + 2]
test edx, edx
push 0x55b13e36
push 0x190bd70b
lea esp, [esp + 0x10]
je 0x1af01c8
call fcn.01b1603b
mov dword [esp], 0x451ec91a
adc edi, 3
sal dword [esp], 0xfb
rol word [esp + 1], 0xad
ja 0x19eccf5
mov edx, dword [edi]
add edi, 4
mov ecx, 0x8a1d1f11
push edx
movzx edx, cx
movzx eax, dx
popfd
btr edx, ecx
lea esi, [edx + esi - 0x1f15]
sub dl, dh
mov ecx, dword [edx + esi - 0x1ff2]
bts dx, dx
xor ecx, ebx
rol ecx, 1
xor eax, eax
lea ecx, [ecx + edx*4 - 0x6192d8f]
xchg edx, eax
xor ecx, 0x23fdf0a
shl dl, 0x65
btc dx, ax
imul edx, eax
inc ecx
shl edx, 0x75
sar edx, 0xab
cwd
xor ebx, ecx
add ebp, ecx
jmp ebp

Function at 0x1b2ea80
Capabilities:
Parse pe header

Disassembly:
xor ebx, eax
jmp 0x1a2bd55
inc ecx
shl eax, 0xa6
inc ecx
not esi
sar dx, cl
inc esi
lea esi, [edx + esi - 0x68208038]
inc esp
mov ecx, edx
not cl
rol edx, 2
mov dword [esp + ecx*2 - 0x1f516], ecx
call fcn.01d72743
dec ecx
sbb edi, 3
inc esp
xadd bl, bl
inc esp
movzx eax, al
inc edi
mov esi, dword [edi + eax*2 - 0x50]
inc ebp
add al, ch
inc ecx
sub ebx, ebp
cwde
inc ebp
xor esi, edx
mov ecx, 0x1602c28a
inc ecx
xor esi, 0x66b5553d
mov edi, eax
inc ebp
imul ebx, ebx
inc ebp
lea esi, [esi + edx + 0x52019615]
dec eax
cdq
jo 0x1921370
mov edx, 0xbf1ce437
lea edx, [edx*4 + 0x4c3ae2ac]
movzx eax, dx
mov eax, dword [edx + edi - 0x48ae7388]
shl edx, 0xb
movsx ecx, dl
not edx
lea edi, [edi + ecx + 4]
dec cx
xor eax, ebx
shr edx, 0x5c
not edx
lea ecx, [ecx + 0x1600b888]
bswap eax
inc eax
bswap eax
rol cx, cl
lea eax, [edx + eax - 0x63f69ce3]
setb cl
neg eax
jmp 0x1346047

Function at 0x1b5b482
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
bswap ecx
xadd edx, eax
xor ecx, 0xf1a0f3c
sub ecx, 0x878fd484
or edx, 0xc92a3bb6
cbw
imul dx, ax
ror ecx, 1
cdq
idiv ax
btr eax, 0x2b
xor ebx, ecx
add edi, ecx
btc ax, 0xbd
xor dx, word [edx + ebp]
movzx ecx, ax
xchg ch, al
xadd ax, cx
mov cx, word [eax + ebp - 0x211f]
cwde
sal ax, 0x89
btr eax, 0x83
lea ebp, [ebp + eax*4 - 0x107fe]
btr eax, eax
or dx, cx
lea ecx, [eax + eax - 0x537d854f]
imul ax, ax
setae al
not dx
not ecx
btc eax, eax
btc ax, 0xa9
mov word [ebp + eax - 0x201], dx
bts cx, 0x9d
imul eax
xor edx, edi
jmp edx
mov ecx, dword [esi]
mov edx, 0xfdb84105
mov eax, edx
shr dl, 0x67
adc esi, 4
xadd eax, edx
shr eax, 0xf
sal ax, 1
xor ecx, ebx
dec ecx
cwde
imul edx
jb 0x12e614e
call fcn.01a0edd6
jmp 0x19c423b
Function at 0x1b65b0a
Capabilities:
Encode data using base64

Disassembly:
xor dl, 0x3d
dec edx
mov dword [esp + eax - 0xbf16], 0x2c13eb26
inc si
add dword [esp + eax*8 - 0x5f8ab], esp
inc dl
inc ecx
add eax, 0xd90b002b
ror dl, 1
xor dl, 0x9e
inc ecx
push eax
inc edx
dec dword [esp + ecx - 0x53ae017d]
mov eax, 0xa2ab07bc
inc esp
xor dl, dl
dec edx
lea ebp, [ebp + ecx - 0x53ae018e]
cwde
dec edx
mov dword [ebp + ecx - 0x53ae0186], edx
jmp 0x1ce8f5d
inc edx
movzx ecx, byte [esp + ecx - 0x53ae0176]
dec ebp
lea edi, [edi + ecx*4 - 8]
inc ecx
mov esi, 0x3f2407a1
movzx ebx, ax
inc edi
mov esp, dword [edi + ecx - 0x53ae0186]
inc ebp
xor esp, edx
inc esp
sub esp, ecx
inc ecx
rol esp, cl
dec eax
cwde
inc ebp
lea esp, [esp + eax*2 - 0x2512021e]
pop eax
inc ecx
bswap esp
ror ax, 0x61
inc edi
lea esp, [ecx - 0x5ad3c329]
movzx edi, cx
dec esp
mov dword [esp + ecx*2 + 6], edx
setb bl
inc esi
xor dword [esp + ecx - 0x53ae017e], esp
inc ebp
mov edx, esi
dec esi
mov edx, dword [esp + ecx - 0x53ae017e]
dec ebp
arpl sp, sp
push edi
inc ebp
movzx ebp, al
dec ecx
add esi, esp
inc ecx
shr eax, 0x90
inc esp
xadd cl, al
dec edx
mov dword [esp + eax*2 - 0x1b1f2], 0x48389c19
pop eax
inc ecx
pop ebx
inc ecx
pop eax
jno fcn.019f821c
imul ecx, ecx
lea ebp, [ebp + ecx - 0x494f]
or dx, ax
call fcn.01a043da

Function at 0x1b6f40d
Capabilities:
Encode data using base64

Disassembly:
mov word [edi + ecx - 0x4427ee1c], ax
jp 0x1a98dba
lea edi, [edi + ecx - 0x613b5c7b]
and cx, cx
shr cx, cl
mov word [edx + ecx - 0x613b2e40], ax
lea esi, [esi + ecx - 0x613b2e44]
mov edx, 0x2e04b709
neg ecx
movsx eax, dx
mov eax, dword [esi + edx - 0x2e04b709]
setle cl
jle 0x135d100
bt ecx, ecx
ror cx, 0xce
lea esi, [edx + esi - 0x51b3982c]
mov edx, dword [ecx + esi - 0x4427b873]
or ecx, ecx
lea eax, [ecx + ecx*2 + 0x643e0e23]
xor edx, ebx
not edx
or cl, 0x3f
xor ax, ax
jo 0x1b47eff
neg edx
call fcn.01396b3b
btr dx, ax
dec edx
xor ecx, ebx
neg dword [esp + eax*2 - 0x1a79d66a]
xor ecx, 0x38132780
cwd
ror ecx, 1
neg ecx
pop edx
lea ecx, [ecx + eax + 0x497a3de2]
shl dl, 0xc3
call fcn.01b2cd2f
mov dword [esp + eax - 0x7ffff78], ebp
mov ebp, 0x693d0697
btc bp, bp
ror ebp, 0x41
push edi
push ebx
adc ebp, 0xfa8cbb04
lea ebx, [eax + ebp*4 - 0x697513ea]
or bl, 0x8e
mov ebp, esi
add eax, 0xd4bcac39
sbb bx, ax
mov ebx, edx
lea edx, [eax + eax*8 - 0x2f5290f8]
mov edx, ebx
sub ax, ax
dec ax
shl edx, 2
sar eax, 8
bts ax, 2
mov eax, ebp
call fcn.01a5db18
mov eax, 0x52a48b08
lea esi, [esi + eax - 0x52a48b0a]
movzx eax, word [esi + eax - 0x52a48b08]
jmp 0x1cc02a1
shl edx, 0x5a
lea edx, [ecx*2 + 0x4e89afba]
lea edi, [edi + edx - 0x51b3982a]
lea ecx, [edx + edx*2 + 0x4f0d25a4]
js 0x13047f5
xor ax, bx
mov ecx, 0x8194f437
bt cx, 0x2b
movzx edx, cl
inc ax
add edx, ecx
rol ax, 1
dec ax
ror edx, cl
neg ax
ror dx, 0x8b
xor bx, ax
jmp 0x1c5d474
Function at 0x1b760cb
Capabilities:
Execute syscall

Disassembly:
not cl
call fcn.019c5a4a
sub ebp, 4
btr cx, cx
sar edx, cl
not dl
mov eax, dword [ebp]
sub edx, ecx
add ecx, edx
xor eax, ebx
bswap eax
sub edx, ecx
inc eax
inc ecx
xchg ecx, edx
shl dx, cl
ror eax, 3
or cx, cx
inc eax
inc dx
xor ebx, eax
neg ecx
add edi, eax
movzx eax, dl
jmp edi
bswap eax
xor ebx, eax
shl edx, cl
mov dword [esp + ecx*2 - 0x12362], 0xb1ab580c
adc esi, eax
mov edx, dword [edi + ecx*2 - 0x12362]
sar cl, 0x83
mov cx, word [edi + ecx*2 - 0x123e8]
mov eax, 0x10361713
bts ax, 0xaf
not byte [esp + eax - 0x10369713]
lea edi, [edi + eax*2 - 0x206d2e24]
jae 0x2548e3c
cdq
mov ecx, dword [ecx + ebp - 1]
shl dx, 0xc1
adc edx, eax
xor ecx, ebx
xor al, dl
call fcn.019fa47b
movzx ecx, dx
xor eax, ebx
neg eax
lea eax, [eax + ecx - 0x5aa52439]
sub cx, dx
bts cx, cx
ror eax, 3
rol dl, cl
not eax
xor ebx, eax
inc dl
add edi, eax
push ecx
dec edx
mov eax, ecx
mov cl, byte [esi + ecx*8 - 8]
not dx
sal dx, 0xc4
adc esi, eax
dec dl
and edx, 0x6d87ec15
xor cl, bl
and byte [esp + eax], dl
jbe 0x1317f98
sysenter
call fcn.01a7943b
and word [esp + eax - 0x10369712], ax
dec eax
shr cx, 1
push eax
lea eax, [eax*4 + 0x42168baf]
rcr edx, cl
mov dword [edi], edx
movzx ecx, ax
movzx edx, byte [esp + ecx - 0xe7f3]
mov dword [esp + ecx - 0xe7f7], esi
ret 4

Function at 0x1b7d828
Capabilities:
Authenticate hmac

Disassembly:
push 0x12088409
call fcn.02553e01
mov ecx, 0x39ee43d
mov edx, ecx
lea esi, [esi + ecx*2 - 0x73dc87b]
movzx eax, byte [ecx + esi - 0x39ee43d]
xor al, bl
ror dl, 0x82
neg al
push edx
rol al, 1
sar dword [esp + ecx - 0x39ee43d], 0x67
inc al
rol al, 1
bt dx, 0x89
not edx
xor al, 0xad
not al
inc al
sal cx, 0x6e
add cx, dx
rol al, 1
sub al, 0x89
xor al, 0x8f
neg ecx
inc cl
xor bl, al
sub edi, 2
ror word [esp + 1], 0xad
mov word [edi], ax
inc word [esp + 2]
sbb esi, 4
movzx eax, word [esp]
mov eax, dword [esi + eax*8 - 0x74640]
xor eax, ebx
call fcn.01cb04ac
movzx eax, dl
mov eax, dword [ebp + eax]
shl edx, 0x5c
dec dx
lea ebp, [edx + ebp - 0x4000fffb]
inc dx
rol edx, 0xa8
adc ecx, eax
mov eax, edx
lea edx, [eax + edx*4 - 0x2b6d7246]
call fcn.0251b20f
Function at 0x1ba04c2
Capabilities:
Encode data using xor

Disassembly:
dec dword [esp]
je 0x1be61f4
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x192ccd7
push 0xb701b390
lea esp, [esp + 8]
je 0x137388d
mov eax, 0x91bfbaaa
or eax, 0x1f9a9013
xor eax, 0x243d0e16
mov eax, dword [ebp + ebx*4]
push eax
dec ebx
jne 0x1373872
push 0x3ba7ce05
call fcn.01c1f6fd
jmp 0x1373863
xor cl, 0x17
cwd
sub edx, 0xdb0e79a1
pop edx
ror cl, 1
cwde
dec cl
sub al, al
xor bl, cl
lea edx, [eax*8 - 0x3458e95b]
xor eax, edx
push esi
cwde
btc edx, eax
rol eax, 0x6b
push ebp
add al, 0xbf
imul eax, eax
push ebx
mov ebp, 0xcb9cc48e
movsx ebx, dl
mov ebp, edi
mov ebx, ecx
and eax, eax
shr edx, 0x23
sete dl
mov edx, ebx
sal edx, 2
mov eax, ebp
push 0xf53ac227
add eax, edx
jmp 0x130e5ef
sbb ecx, eax
and edx, edx
call fcn.02525f88

Function at 0x1bc6cb5
Capabilities:
Execute syscall

Disassembly:
neg cl
mov dword [esp + eax*2 - 0x522ddb52], edx
xor cl, dl
ror eax, 0x33
xor dl, 0xa4
ror cl, 1
or dx, word [esp + 0xa]
dec cl
sar ax, 0x62
cdq
rol cl, 1
cwde
shr dword [esp + eax - 0x1943], 0xb1
sub cl, dl
mul word [esp + eax - 0x1943]
cwde
xor bl, cl
sub eax, dword [esp + eax*2 - 0x4d6b]
sub word [esp + eax - 0x1eaf], dx
xchg ah, dl
lea ebp, [ebp + eax - 0xcabd]
ror word [esp + eax - 0xcab5], 0xe5
mov dword [ebp + eax - 0xcab9], ecx
movzx ecx, ax
pop eax
pop edx
pop eax
jne fcn.0251841a

Function at 0x1bd7b8f
Capabilities:
Encode data using xor

Disassembly:
lea eax, [edx*8 + 0x4f2938bc]
rol ecx, 2
mov dword [esp + edx*2 - 0x601c4414], eax
cdq
shl dword [esp], 3
xor ecx, edx
idiv dword [esp]
call fcn.01a919dd
cmp bl, dl
xor edx, dword [0x9d11c0d6]
xor dword [esi + 0x30], eax
xchg edx, eax
invalid

Function at 0x1bdbdf4
Capabilities:
Encode data using base64

Disassembly:
not cl
neg cl
imul ax
bt eax, edx
lea edx, [eax + edx*4 - 0x3fda287c]
inc cl
mov dword [esp + eax*8 - 0x35002000], eax
cdq
sub word [esp + edx], dx
xor bl, cl
lea ecx, [esp + ecx + 4]
cbw
mov dword [esp + edx*2], eax
ror dword [esp + edx], 0xac
or edx, dword [edx + ecx]
xor ax, 0x9b3e
bts eax, 0x97
lea edi, [edi + eax*2 - 0xd413680]
mov dword [edi + eax - 0x6a09b3e], edx
and al, 0xa
push eax
sub dword [esp + eax*2 - 0xd413612], 0x90a3f06
pop edx
pop ecx
ja fcn.0250d21a