joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb1a15c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a165
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12f0c
test esi, esi
jl 0xb1a1ee
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12f0c
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12f0c
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov byte [ebp + ebx - 0x200d], al
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a19a
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1779c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb1a204
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a20d
mov eax, dword [ebp - 4]
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x2014]
mov eax, dword [ebp + 0xc]
mov ecx, esi
call fcn.00a12f0c
cmp dword [ebp - 0x14], 0
jl 0xb1a2a5
lea edx, [ebp - 0x1014]
lea eax, [ebp - 0x2014]
mov ecx, esi
call fcn.00a12f0c
lea edx, [ebp - 0x1014]
mov ecx, esi
mov eax, dword [ebp - 0xc]
call dword [ebp + 0x14]
mov ecx, esi
dec ecx
lea edx, [ebp - 0x2014]
lea eax, [ebp - 0x2013]
call fcn.00a12f0c
mov eax, dword [ebp - 0x10]
mov bl, byte [eax]
mov byte [ebp + esi - 0x2015], bl
xor bl, byte [ebp - 0x1014]
mov eax, dword [ebp - 0x10]
mov byte [eax], bl
dec dword [ebp - 0x14]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x14], 0
jge 0xb1a24d
lea eax, [ebp - 0x1014]
mov edx, esi
call fcn.00b1779c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb1a2bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a2c5
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12f0c
test esi, esi
jl 0xb1a34f
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12f0c
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12f0c
mov al, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a2fa
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1779c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb1a364
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a36d
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12f0c
test esi, esi
jl 0xb1a3f7
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12f0c
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12f0c
mov al, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a3a2
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1779c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb3a514
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb3a51d
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb3a9e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
lea eax, [ebp - 0x18]
call fcn.00a14dc8
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb090e0]
call fcn.00b0b058
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0xb3a9b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0b144
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb3a510
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb3a4f4
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb3a4f8
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
mov dl, byte [0xb3a9f8]
call fcn.00b0a518
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00aeccac
test al, al
je 0xb3a5f4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0a9b0
jmp 0xb3a602
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0aa30
mov eax, dword [ebp - 4]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b0aab0
xor eax, eax
push ebp
push 0xb3a669
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0a970
jmp 0xb3a651
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0xb74238]
mov eax, dword [eax]
call fcn.00a779e0
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb3a65f
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb3a632
xor eax, eax
pop edx
pop ecx
pop ecx
rcr byte [edx + 0x59], 0x59
mov dword fs:[eax], edx
jmp 0xb3a673
push 0x988a0e9e
pushfd
and word [esp + 4], 0x2b14
test word [esp + 4], 0xf1a5
call fcn.017a1339
mov ecx, dword [esi + edx*2 - 0x2611ef14]
inc edx
or edx, edx
lea esi, [esi + edx*4 - 0x4c23de28]
jp 0x17fed02
adc byte [edi - 0x419d566e], al
jnp 0xb3a65d
push ebx
lodsd eax, dword [esi]
scasb al, byte es:[edi]
mov eax, esi
stosb byte es:[edi], al
outsd dx, dword [esi]
popal
scasb al, byte es:[edi]
jmp 0xb3a660
adc ecx, 0x21b44035
xor ebx, ecx
shr edx, 0x6a
adc edi, ecx
call fcn.01823098
push 0xce983503
pushfd
add dword [esp + 4], 0xb2a1799b
jae 0x17c0abf
cmp dword [esp + 4], 0xd5813804
mov dword [esp + 4], 0x17a91a94
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.0178c5bf
not edx
push edx
xor ecx, ebx
mov eax, dword [esp]
xor ecx, 0x51988207
neg ecx
ror eax, 0x33
sar ax, 0xe6
jp 0x1851b9b
not ecx
js 0x17c0a9f
add eax, 0xc15b
jmp eax
Function at 0xb4dbf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0x40
call fcn.00b4d484
test al, al
jne 0xb4dc2c
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4dff0
mov dword [esi], 1
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5a4d
je 0xb4dc4e
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dff0
mov dword [esi], 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, 0xf8
cdq
push edx
push eax
call fcn.00b4d484
test al, al
jne 0xb4dc7d
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4dff0
mov dword [esi], 3
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
je 0xb4dcb7
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dff0
mov dword [esi], 4
mov eax, dword [ebp - 0x10]
cmp word [eax + 4], 0x14c
je 0xb4dcd7
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dff0
mov dword [esi], 5
mov eax, dword [ebp - 0x10]
test byte [eax + 0x38], 1
je 0xb4dcf5
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dff0
mov dword [esi], 6
xor eax, eax
push ebp
push 0xb4dfdb
push dword fs:[eax]
mov dword fs:[eax], esp
push ecx
pushfd
mov ecx, 0x9a07ae35
push 0x7722dd97
sub dword [esp + ecx + 0x65f851cb], 0x7b233226
lea ecx, [ecx + ecx*4 + 0x77894f88]
jl 0x17d40ee
movzx ecx, al
mov cl, byte [ecx + ebp - 0xba]
rol ax, 0x69
shr eax, 0x50
lea ebp, [eax + ebp - 0xe510]
shl eax, 0xf3
ror ax, 0x24
sal edx, cl
lea ecx, [eax*4 - 0x584bdada]
mov dword [ebp + ecx - 0x49f42526], edx
xor al, ah
mov eax, dword [esi + ecx - 0x49f42526]
rol ecx, cl
lea esi, [ecx + esi - 0x7d09498e]
jp 0x18644ec
push edx
pushfd
mov edx, 0x83093803
push ecx
cmp dl, dh
push esi
mov edx, dword [esp + edx + 0x7cf6c809]
mov dword [esp + 0xc], 0xd5357ca7
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.017d81db
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [esp + 8]
mov dword [esp + 8], 0xd53eb313
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.017d81db
ror cx, 0xa4
rol eax, 1
not ecx
inc eax
not eax
inc cl
xor dx, cx
push edx
xor ebx, eax
shr edx, 0xbe
adc edi, eax
or byte [esp + edx], dh
mov dword [esp + edx*8], edi
ret
shl ecx, 0xb2
xor eax, ebx
sub cl, cl
lea eax, [eax + ecx*2 - 0x6b907402]
movzx edx, cx
jbe 0x181e0ff
push eax
mov dword [esp + eax*2 - 0x7d7ffe7c], esi
ret 8
Function at 0xb5ea84
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0xb5ea8c
push ecx
push ebx
push esi
mov eax, 0xb5e42c
call fcn.00a17398
mov esi, dword [0xb74238]
xor eax, eax
push ebp
push 0xb5ec5e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00a130b0
cmp eax, 2
jne 0xb5eb1d
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00a13118
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00a19da8
call fcn.00aef5bc
mov ebx, 0x64
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.00a13118
mov eax, dword [ebp - 0x18]
call fcn.00a15298
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00a13118
mov eax, dword [ebp - 0x1c]
call fcn.00a1a260
test al, al
je 0xb5eb1d
push 0xa
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0xb5eadf
mov al, byte [0xb5ec6c]
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00a13118
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0xb5ec78
call fcn.00a1f388
mov eax, dword [ebp - 0x20]
call fcn.00a15298
push eax
push 0
push 0
call fcn.00a17700
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0xb5eb94
push 0x40
push 0xb5ec7c
lea edx, [ebp - 0x2c]
mov eax, dword [0xb7431c]
call fcn.00a170c8
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00ad11d0
mov eax, dword [ebp - 0x28]
call fcn.00a15298
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0xb5ec43
mov dl, 1
mov eax, dword [0xa29c7c]
call fcn.00a13f2c
mov edx, dword [0xb74230]
mov dword [edx], eax
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00aec174
test al, al
jne 0xb5ebc6
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00a13f5c
jmp 0xb5ec43
mov eax, dword [esi]
call fcn.00a77b04
lea edx, [ebp - 0x34]
mov eax, dword [esi]
call fcn.00a7825c
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00a1a6b4
mov eax, dword [ebp - 0x30]
call fcn.00a1aa08
mov ecx, dword [0xb74070]
mov eax, dword [esi]
mov edx, dword [0xb502c4]
call fcn.00a77b1c
mov ecx, dword [0xb743f4]
mov eax, dword [esi]
mov edx, dword [0xb5d328]
call fcn.00a77b1c
mov ecx, dword [0xb74108]
mov eax, dword [esi]
mov edx, dword [0xb5c52c]
call fcn.00a77b1c
mov ecx, dword [0xb742d4]
mov eax, dword [esi]
mov edx, dword [0xb5b58c]
call fcn.00a77b1c
mov eax, dword [esi]
call fcn.00a77b9c
push ebx
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb5ec65
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00a14dec
ret
Function at 0x178473f
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
sub edx, 0x6c8b9ca0
mov dword [esp + eax - 0x60c746fb], ecx
add eax, 0x2392fea3
xor ebx, edx
add ebp, edx
push eax
mov dword [esp + 4], eax
call fcn.017adf8d
mov esi, 0xfdb9c9ae
mov esp, ebp
movsx edx, si
lea ebp, [esi + edx*2 - 0x786b70e3]
pop ebp
shl esi, 0x45
jne 0x183eeb8
pop esi
lea edi, [edx + edx*8 - 0x49f8f5f9]
jp 0x177f5d5
mov ecx, 0x5188b39c
lea esi, [esi + ecx - 0x5188b39a]
xor cl, cl
or dx, ax
mov eax, 0xe204d503
not dx
sub eax, eax
jbe 0x1837863
xadd eax, ecx
mov word [ecx + esi], dx
push ecx
lea edi, [edi + ecx - 4]
call fcn.01842c3d
jb 0x17c20a5
xor eax, ebx
ror eax, 2
mov ecx, 0x448e1d38
call fcn.017c292d
ror byte [esp + eax*2 - 0x27814564], 0xe4
rol edx, 1
not edx
push eax
xor dword [esp + eax*2 - 0x27814564], 0x80adab2f
neg word [esp + eax*2 - 0x2781455e]
xor ebx, edx
add ax, word [esp + eax - 0x13c0a2b0]
xor byte [esp + eax*2 - 0x27806c38], 0xbc
adc edi, edx
mov ecx, dword [ebp + eax*4 - 0x4f00d87c]
and dword [esp + eax*2 - 0x27806c3a], eax
sal ax, 0x21
mov edx, dword [ebp + eax - 0x13c06c3a]
lea ebp, [eax + ebp - 0x13c06c36]
shl byte [esp + eax - 0x13c06c3a], 0x65
setne al
sub eax, dword [esp + eax - 0x13c06bfc]
mov dword ss:[ecx + eax*2 - 0x400d800], edx
movzx ecx, ax
adc dword [esp + eax - 0x2006bfc], 0x1d81d0b0
mov dword [esp + eax*2 - 0x400d800], edi
ret 4

Function at 0x1788784
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x57955b8c], 0xb922f395
lea ecx, [ecx + eax + 0x160b1c1b]
sub al, al
xor ebx, ecx
push eax
inc byte [esp + edx - 0x9a]
add ebp, ecx
call fcn.017dd582
Function at 0x178c5bf
Capabilities:
Encode data using base64

Disassembly:
not eax
not edx
xor eax, 0x852c5115
shr ecx, 0xda
ror cx, 0x86
inc dl
inc eax
xchg edx, ecx
add dx, dx
xor ebx, eax
xchg edx, ecx
sar edx, 0x84
sbb cx, cx
add ebp, eax
sub ecx, 0xa1320018
xadd cl, ch
xadd edx, ecx
mov ecx, dword [edx + edi - 0x6131a6d8]
mov edx, dword [edi + edx - 0x6131a6d4]
jno 0x17d400f
push 0xf5aadbbc
call fcn.01824f96
mov edx, 0x9e983934
add esi, 2
inc edx
sete dl
shl ax, cl
mov word [esi], ax
sub edi, 4
mov edx, dword [edi]
xor edx, ebx
mov eax, 0x1cb891a8
lea edx, [edx + eax*4 + 0x77a2ce7d]
mov ecx, eax
xchg ecx, eax
and eax, 0xb3b1f41f
bswap edx
jnp 0x17b77e3
mov edx, 0x2fba0e8a
mov edx, dword [edx + esi - 0x2fba0e8a]
add esi, 4
mov ecx, 0x5f29c2a3
sar ecx, 0x3d
xor edx, ebx
sub edx, 0xe891741d
xor edx, 0x4d89de13
shl ecx, 0x42
lea eax, [ecx - 0x1b4c65d4]
ja 0x17cfe41
shrd eax, edx, cl
mov ecx, 0xe61a90a1
mov dword [edi], eax
pop ecx
pop ecx
jmp esi
setne al
lea edx, [edx + eax*4 + 0x2e5c14fd]
call fcn.017e72ba
bswap eax
add cx, cx
shl dx, cl
and dl, dl
inc eax
neg eax
inc dx
neg edx
js 0x178a096
rol edx, 3
dec ax
neg edx
shr cx, cl
bswap edx
ror edx, 1
dec edx
lea eax, [ecx*2 + 0x3e37f935]
xor ebx, edx
or al, ah
xchg cl, al
adc ebp, edx
inc eax
jg 0x1831211
mov dx, word [edi + eax*2 - 0x7c6ff1fe]
lea edi, [edi + eax - 0x3e37f8fb]
sub eax, 0xd9971b1c
and eax, eax
shr ax, 0xe3
mov word ss:[ecx + eax - 0x64a01bbc], dx
call fcn.0181b323
dec cl
xor ebx, edx
sal ecx, cl
inc ecx
sal ecx, 0x75
add esi, edx
call fcn.017d907f
mov ecx, dword [ebp]
movzx eax, dl
shl ax, 0x47
not dx
xor ecx, ebx
add eax, edx
call fcn.01814485
mov edx, dword [edi]
mov dword [esp], 0xd1313316
ror word [esp + 2], 0xc1
xor edx, ebx
mov eax, 0x6fbbacae
xor edx, 0x27985e82
sal al, 0xc7
not eax
call fcn.01794162
mov ecx, dword [edi + ecx - 0xfd]
jnp 0x181a69f

Function at 0x179f8da
Capabilities:
Parse pe header

Disassembly:
sub ebx, eax
lea esp, [esp + 4]
mov ebp, 0x7f251e9b
lea ecx, [ebp*8 + 0x29b83f1b]
sal ecx, cl
lea ebp, [0x179f8e0]
jne 0x18664c3

Function at 0x17a04cd
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + eax - 0x685c95b3], ecx
ror edx, 1
or ecx, eax
call fcn.017bdbf3
call fcn.01824c7b
movzx eax, cx
lea edi, [ecx + edi - 0x2000003]
not cl
mov edx, dword [ecx + edi - 0x1ffff00]
xadd ax, cx
xor edx, ebx
xadd cl, ah
jns 0x1855f68
add edx, 0xdd309a23
ror edx, 1
not al
not edx
ror edx, 1
rol eax, cl
or ax, cx
sal cx, 0x6d
xor ebx, edx
shl ax, 0x65
rol cx, 0xc7
js 0x178e5da
Function at 0x17a1f61
Capabilities:
Parse pe header

Disassembly:
and dx, ax
xchg ecx, edi
mov ebp, ecx
jae 0x17a14a7
add ebp, eax
lea eax, [edx + edx*8 - 0x36c2ff41]
mov di, word [edi]
sar word [esp + 4], 0x61
and edx, 0xaf2df981
pop edx
pop edx
jno fcn.017ef586
mov edx, dword [ebp]
neg cl
push ecx
ja 0x1816f8c
xor edx, ebx
sal cl, 4
bswap edx
dec dword [esp]
movsx eax, word [esp]
neg dword [esp + eax - 0x2053]
dec edx
and dword [esp + eax - 0x2053], eax
adc dword [esp + eax - 0x2053], eax
lea ecx, [ecx*8 - 0x47f7da44]
rol edx, 1
xadd word [esp + eax - 0x2052], ax
lea edx, [ecx + edx - 0x30a82c93]
xchg ecx, eax
xor ebx, edx
call fcn.0179cd43
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x18]
call fcn.017fdd35
mov edx, 0x483291a3
lea edi, [edi + edx - 0x4832919b]
inc edx
mov dword [eax + edx - 0x483291a4], ecx
ror dx, 0xa1
movzx eax, dx
mov eax, dword [esi + edx - 0x483248d2]
sub dx, dx
lea esi, [esi + edx - 0x4831fffc]
movsx ecx, dx
xor eax, ebx
bswap ecx
neg eax
rol eax, 1
neg eax
ror cx, 0x6c
push edx
dec dword [esp + ecx*2]
ror eax, 2
xor ebx, eax
dec word [esp + edx - 0x4831fffe]
jns 0x17d7526
mov eax, 0xdb159006
movsx edx, ax
mov ecx, dword [edi]
movsx ebp, dx
not edx
neg al
lea edi, [edi + edx*8 - 0x37fc4]
js 0x178186f
movzx edx, cx
mov dword [esp + edx - 0xf800], esi
add ebp, eax
xchg dword [esp + ecx], ecx
movzx eax, byte [esp + ecx - 0x4830ffff]
or dword [esp + ecx - 0x4830ffff], ebp
ret
call fcn.017ff0c5
sub edi, 1
mov edx, 0xf78281a4
lea eax, [edx + edx*2 - 0x5cdbb467]
bswap eax
movzx eax, byte [edi]
xor al, bl
mov ecx, 0xd198520c
push ecx
dec al
xadd ecx, edx
xor al, 0x97
dec dx
pop edx
dec al
call fcn.01790778

Function at 0x17aebd2
Capabilities:
Parse pe header

Disassembly:
add esi, 4
jmp 0x1855f30
sal edx, 0xb0
ror eax, 2
movzx ecx, dl
xor eax, 0xd92d503f
mov dword [esp + ecx], ecx
dec ecx
call fcn.01844266
mov eax, dword [ecx]
sal edx, 0xa
sub esi, 4
shr dl, 0x82
lea ecx, [edx*8 + 0x75a50528]
mov dword [esi + ecx*4 - 0x219a94a0], eax
inc edx
xchg edx, ecx
lea ebp, [ebp + edx*8 - 0x43352944]
shr ecx, cl
movzx eax, dl
sbb dl, ah
mov eax, dword [ebp + edx*8 - 0x43352938]
shl edx, 0xd1
xor eax, ebx
dec eax
shr dx, 0x65
xor eax, 0x810ecc80
inc eax
jmp 0x17a0447
div ecx
mov dword [esi], edx
mov dword [esi + 4], eax
call fcn.017815a0
sub ebp, 1
mov edx, 0xc0921297
shr dl, 0x85
mov ecx, 0x3b092e08
movzx ecx, byte [ebp + ecx - 0x3b092e08]
or dx, 0x8cb1
xor cl, bl
mov eax, edx
not cl
bswap edx
xor cl, 0x98
inc edx
add cl, 0x87
rol edx, 0xa3
add ax, ax
ror cl, 1
xor bl, cl
dec ax
sub al, 0xa3
add ecx, esp
or eax, 0xf139f521
jne 0x184db02
mov eax, 0x49036b2b
lea edx, [eax*8 - 0x7cf0e14b]
lea edi, [edi + eax - 0x49036b2f]
ror dx, 0xab
movzx ecx, dl
jb 0x18480c1
mov edx, dword [edi + eax - 0x49036b2b]
ror cl, 0xc5
inc eax
xor edx, ebx
xor edx, 0x27985e82
inc eax
lea edx, [edx + ecx*2 + 0x52ac979e]
call fcn.017f9d96
Function at 0x17beb48
Capabilities:
Parse pe header

Disassembly:
mov eax, ecx
mov eax, dword [edi]
add cx, 0x4a19
xor eax, ebx
dec ecx
rol eax, 3
xadd ecx, edx
sal ecx, cl
dec edx
adc eax, 0x4b2ff882
rol cl, 0xc7
call fcn.0178162e
or edx, ecx
xor ebx, eax
and ecx, ecx
adc ebp, eax
mov dword [esp + edx - 0x20ee12], 0x49a02bb4
add word [esp + edx - 0x20ee12], dx
jnp 0x177b940
pop edx
jg fcn.017eb80e
sub edi, 4
mov ecx, 0x4f003fbb
mov ecx, dword [ecx + edi - 0x4f003fbb]
xor ecx, ebx
mov edx, 0x4a9ac315
lea eax, [edx + edx*4 - 0x58f5d948]
inc ecx
add eax, edx
jp 0x1800dbb
neg ecx
sal edx, 0xe9
shr dl, 0x81
bswap ecx
sal al, 0xe2
lea ecx, [ecx + edx*4 - 0x68783059]
xor ebx, ecx
add eax, 0x673c5f23
adc ebp, ecx
bswap edx
shr dx, 0x45
mov ecx, dword [esi + edx*2 - 0x540862]
movzx dx, byte ss:[edx + ecx - 0x2a0431]
add esi, 2
add eax, eax
sub al, al
ror eax, 0x2c
mov word [eax + esi - 0x1009bce3], dx
shr eax, 0xbd
and eax, eax
or eax, ebp
jmp eax

Function at 0x17c190a
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [eax + edi - 0x80000000]
setb byte [esp + eax - 0x7ffffffc]
mov eax, dword [edi + eax - 0x7ffffffc]
or ecx, 0xd6172113
mov dword [esp], 0x6838263d
jl 0x183b006
mov ecx, dword [edi + 8]
and dword [esp + 1], 0x82b5df03
adc edi, 4
jmp 0x183de91
div ecx
mov dword [edi], edx
push 0x42c7faf
call fcn.017c3642
rol al, 0x61
shl dl, 0xc7
inc ecx
shl dl, 0x61
not ecx
or ax, ax
sbb ecx, 0x921338ac
shl eax, 0xbf
xor ebx, ecx
add edi, ecx
mov eax, dword [esi + eax - 0x80000000]
call fcn.0182e0fd
mov dword [esp + eax - 0x4aa59038], edi
ret 4

Function at 0x17c20d4
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
rol edx, 2
inc ax
inc edx
xor cx, cx
rol edx, 2
not edx
mov dword [esp + eax - 0x49ebd491], 0xf33a4c9a
neg edx
bswap edx
not ecx
sal al, 3
xor ebx, edx
call fcn.017fcb9d

Function at 0x17e2dd7
Capabilities:
Parse pe header

Disassembly:
call fcn.0182d258
inc eax
ror edx, 0x18
lea ecx, [edx + edx + 0x6c93d904]
neg eax
inc eax
and ecx, ecx
xor eax, 0x32a14081
xchg cx, dx
xor ebx, eax
inc edx
rol dl, 0xc2
shl cl, 0x86
adc edi, eax
lea edx, [edx*4 - 0x184c2fe3]
not edx
movzx eax, byte [esi + edx*2 - 0x42f5a8d4]
lea esi, [esi + edx*2 - 0x42f5a8d3]
or cl, ch
jne 0x185cadf
mov ecx, 0xf1158287
or ecx, ecx
mov eax, dword [esi]
call fcn.018129dd
call fcn.017a5183
dec word [esp + eax*8 - 0x4a8dca7e]
xadd byte [esp + eax - 0x951b94e], ch
inc edx
jmp 0x17f24db
xor al, bl
shr dx, 0x82
ror al, 1
inc dl
and dx, 0xa2f
shr cl, 0x42
inc al
sal ecx, 0xdd
xor al, 0x35
sar dl, 0x82
shr edx, 0x5b
neg edx
dec al
rol ecx, 0x57
xchg dh, dl
ror al, 1
or dx, 0x2c10
xor al, dl
sar cx, 0x45
call fcn.01821d30
mov edx, 0x827f3a2
lea eax, [edx + edx*4 - 0x1f7608da]
mov ecx, edx
lea edi, [edi + edx*2 - 0x104fe748]
push eax
inc cx
lea ecx, [eax + 0x1d988295]
mov edx, dword [edx + edi - 0x827f3a2]
sub dword [esp + eax*2 - 0x12a372a0], eax
shl dword [esp + eax - 0x951b950], cl
xor edx, ebx
sar cx, cl
lea edx, [edx + ecx + 0x66d5a2bb]
neg edx
ror edx, 3
jmp 0x182e8f2

Function at 0x17e5094
Capabilities:
Parse pe header

Disassembly:
pushfd
add dword [esp + 4], 0xfe883c21
call fcn.017e2dd7