joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104e8b1
Capabilities:
Authenticate hmac

Disassembly:
neg eax
mov dword [esp + edx*2 - 0x285c93ae], ecx
inc eax
dec edx
jle 0x1ac6a67
not eax
ror dword [esp + ecx - 0x6086f14d], 0x3e
xor edx, dword [esp + edx*2 - 0x285c93ac]
or edx, ecx
neg eax
sar dl, 0x87
mov byte [esp + ecx - 0x6086f14d], dh
xor ecx, edx
inc eax
add word [esp + 2], 0x71bd
or byte [esp + 1], dh
neg eax
rol cx, 0x8c
and ecx, dword [esp]
rol byte [esp + 2], 0x81
xor ebx, eax
btc edx, ecx
dec dword [esp]
inc cx
adc esi, eax
dec ecx
ror word [esp], cl
and ecx, 0xf59a222c
mov eax, dword [ebp]
pop ecx
btc cx, cx
bt edx, 0x27
mov dx, word [ebp + 4]
neg cl
adc ebp, 5
add cx, cx
btr ecx, ecx
mov word ss:[eax], dx
movsx edx, cx
add ecx, 0x6e2e141f
jmp esi

Function at 0x104f8e7
Capabilities:
Encode data using xor

Disassembly:
ror eax, 3
xor cx, 0x9ca5
xor dx, cx
mov dword [esp], ecx
inc eax
ror cl, 1
neg dword [esp + 1]
xor ebx, eax
dec cx
add esi, eax
pop edx
mov eax, dword [ebp]
ror dl, 0xa5
not word [esp + 2]
mov ecx, dword [eax]
jae 0x1a06b7c
movsx eax, byte [esp]
idiv byte [esp]
mov dword [ebp], ecx
bts dx, 0xa8
lea ecx, [edx + eax*2 - 0x1c7a4156]
pop edx
jmp esi

Function at 0x1071886
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
je 0x12f135c
mov dword [esp + ecx - 0xd0000], eax
add ebp, edx
shr dword [esp + ecx*2 - 0x1a0000], 1
xor word [esp + ecx - 0xd0000], 0x481f
shr eax, 0x41
pop edx
jne fcn.01002e95
push 0xfe86209b
jmp 0xfd41df
Function at 0x1071cdc
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
lea esp, [esp + 8]
call eax
mov ecx, 0xba87ed1d
lea edx, [ecx*8 - 0x6bf08a6c]
mov ebp, dword [ebp + edx - 0x684ede80]
dec cl
xchg cx, dx
mov dword [ebp + edx - 0x684eed1c], eax
movsx eax, dx
mov ebx, edx
lea esi, [eax + ecx + 0x4ea8350e]
mov edi, ebp
imul dl
not si
or esi, esi
pop ebx
jnp 0x1a7f76b
pop ebp
not dx
neg si
pop esi
call fcn.011921d1
mov dword [esp], eax
mov edx, dword [ebp]
rol dword [esp], 0x5b
mov ecx, dword [ebp + 4]
cwde
and eax, eax
lea ebp, [ebp + eax*4 - 0x16678]
btc ax, 0x10
shl eax, 0xb9
sbb al, 0x27
not edx
xchg dword [esp + eax - 0x3c0000d8], eax
not ecx
bt eax, eax
shr ax, 0xce
sal al, 0xe3
and edx, ecx
sar word [esp], 0xe1
sar ax, 0x2b
rol word [esp + 1], 0x2f
mov dword [ebp], edx
movzx ecx, al
not eax
lea edi, [edi + eax*2 - 0x6f00002]
or word [esp + eax*2 - 0x6effffc], ax
mov edx, ecx
adc edx, dword [edi + eax - 0x377ffff]
push ecx
neg eax
xor edx, ebx
not edx
lea edx, [eax + edx - 0x7d044ac4]
jmp 0x12eed89
sal eax, 0x3a
sar cx, 0xf
ror edx, 2
and eax, dword [esp + eax - 0x3fffffe]
jns 0x1a99900
push 0x52198b20
mov ecx, dword [esp + 4]
lea edi, [edi + ecx - 0x5fbe00ab]
inc word [esp + ecx - 0x5fbe00a0]
bt ecx, 0xbc
shr cx, 0x41
mov dword [edi + ecx - 0x5fbe004d], eax
setl byte [esp + ecx - 0x5fbe004e]
mov dword [ecx + edi - 0x5fbe0051], edx
jne 0x1ab6713
call fcn.01019135
or ecx, dword [esp + ecx*8]
sbb cx, word [esp + ecx - 0x5fbe0050]
neg ecx
pop ecx
pop eax
jne fcn.01002e95
mov ecx, 0xeeb3aba6
movsx edx, cx
push ecx
sub edi, 1
lea edx, [edx*8 - 0x634f4a75]
inc byte [esp]
movzx edx, byte [edi]
btr ecx, 0x1f
lea eax, [ecx + ecx*8 + 0x59167aa6]
neg cx
xor dl, bl
sub eax, eax
adc dl, 0xb3
not cx
not dl
dec dl
cbw
rol dl, 1
mov byte [esp + eax + 2], al
jmp 0x1aeb0ae
and eax, 0x73acb82b
sbb dl, 0x28
add ecx, 0x4e31d3ba
neg dl
shl cx, 0xec
and word [esp + eax + 1], 0xad20
shr ecx, 0xbb
adc dl, 0x28
rol dl, 1
xchg ah, cl
ror word [esp + ecx*2 + 2], 0x63
sar ecx, 0x52
neg dl
not eax
and eax, 0x5d3c0485
xor dl, 0x14
btc cx, cx
xor eax, ecx
rol dl, cl
xchg cx, ax
xor bl, dl
sub ecx, 0x2320b09c
pop eax
add edx, esp
ror ecx, 0x31
xchg cx, ax
mov eax, dword [edx + eax*4 - 0x7701b9bc]
mov edx, ecx
sbb esi, 3
mov dword [esi], eax
sub edi, 4
add edx, ecx
sbb ecx, edx
sbb edx, edx
mov eax, dword [edi + edx*2]
xor eax, ebx
btr edx, ecx
and cx, dx
dec eax
add edx, edx
sub edx, edx
push edx
xor eax, 0x2427479e
rol word [esp + ecx - 0x580afffe], 0xe3
push edx
ror eax, 3
not eax
call fcn.01a6d00c
dec edx
lea ebx, [ecx*8 + 0x619abc82]
inc ecx
rol ebp, 0xa4
dec ecx
lea esi, [ecx + esi - 0x2eaa3619]
jb 0x1ba2ad8
dec eax
shl edx, cl
inc cx
xor eax, edi
mov ecx, 0xb6919f15
dec eax
mov dword [esi + edi - 0x80ebe5], edx
inc ecx
or bl, 0x23
inc ecx
jmp eax

Function at 0x107d6a3
Capabilities:
Encode data using base64

Disassembly:
sbb word [esp + 4], 0x83bb
xor ebx, ecx
push 0x4630472d
push 0x2d8934a3
xor dword [esp + 0xf], 0x66874da9
adc ebp, ecx
lea esp, [esp + 0x14]
jmp 0x112cb98
call fcn.010112ee
Function at 0x1084b59
Capabilities:
Encode data using xor

Disassembly:
dec cl
xor cl, 0x34
rol cl, 1
cwde
shr eax, 0xc8
dec cl
push eax
xor cl, 0x28
push eax
rol ax, 0x2f
not cl
xor ax, word [esp + eax*8]
bt ax, ax
ror cl, 1
shr ax, 0x4b
add eax, dword [esp + eax + 4]
dec cl
sub word [esp + eax*8 + 3], 0x6184
btc eax, 0x37
adc dword [esp + eax - 0x7ffffd], 0x97b2f6ac
xor bl, cl
cwde
lea ecx, [esp + ecx + 0xc]
mov word [ecx + eax*4], dx
mov edx, eax
cdq
cdq
lea edi, [edi + eax*4 - 4]
mov ecx, dword [edi + eax]
or dx, 0x611c
xor ecx, ebx
call fcn.0102982d
rcl dword [edi]
xor dword [edi + 0xcbb2378], esp
xor al, 0x94
pop bx
fadd qword [edi]
add al, 2
test byte [ecx - 7], ch
lcall 0x2c47, 0x5e0686b3
sal dh, 1
movsb byte es:[edi], byte es:[esi]
lahf
mov bl, 0xf6
sti
clc
popfd
mov dh, 0xf6
lodsb al, byte gs:[esi]
rcr dword [ecx + edi*8 + 0x33], 0xf9
sahf
xor esi, 0xffffffc4
jl 0x1084b9b
movsd dword es:[edi], dword [esi]
les edx, [ecx - 0x59c1e8e1]
aad 0xa
xor al, 0x31
mov eax, 0xea0dfcd3
add eax, 0x84469488
fld xword [edi + 0x8f97961]
mov al, 0xbe
adc ecx, dword [eax]
sar dword [ecx - 0x25], cl
in al, dx
or byte [ebx + edx*4], 0x78
cmp eax, dword [ecx]
outsb dx, byte [esi]
xchg ebp, eax
test eax, 0x574d5615
push eax
test dword [eax - 0x15], ebx
jge 0xc6c2c715
loope 0x1084c45
inc ebp
or al, 0xd1
sbb dword [edi - 6], edi
push edx
adc eax, 0x25aa3902
inc edi
cmc
add eax, 0x9f2787e3
xchg dword [edi], esp
lahf
or edi, edi
test eax, 0x200c98e0
mov cl, 0xf4
cld
test eax, 0xdf386465
cmp ebx, dword [ebp + 0x6d]
outsb dx, byte [esi]
imul ecx, dword [ebx + 0x6b3c5f72], 0x7343c738
movsd dword es:[edi], dword [esi]
add dword [ebx], eax
out dx, al
pushfd
push cs
cmc
stosb byte es:[edi], al
outsd dx, dword [esi]
test dl, ah
push esp
outsd dx, dword [esi]
xor al, 0xd7
rcr dword [eax + ebx*4 - 0x7f0630d2], cl
imul esp, dword [edi], 1
xor dword [esi], ecx
stc
sub byte [ebx + 0x24], 0x27
add dword [ecx], esi
push cs
clc
loopne 0x1084cbc
push esi
pop edx
je 0x1084c2e
in eax, 0xcc
mov eax, 0x80fe88fe
add esp, edi
mov ebx, 0x3802fe5c
pop esp
or al, 0xed
fistp dword [ecx + 0x748109ea]
xor byte [esp + ecx + 5], 0xd0
cdq
jl 0x1084c40
and esi, dword [edi]
xor dword [ecx - 0x5e], ebp
les ecx, [ebx]
dec ebx
pop esp
stosb byte es:[edi], al
int 0xd5
xchg ebp, ebp
das
sbb dword [ebx + 0x2b0d254d], ebp
sub dword [esp + ebx*4 - 0x29fe6cfa], esp
push es
xchg ebx, eax
add esi, edx
jp 0x1084cc0
popal
xor dword [ebp + 0x5fcd28a2], ebp
add bl, byte [edx + 0x7434e97d]
or byte [0xfbfed3d8], 0xb7
jmp 0x1084c75
Function at 0x108f800
Capabilities:
Encode data using base64

Disassembly:
call fcn.01a1a2d0
jb 0x108f82f
lcall 0xa588, 0x47b64d8
fidivr dword [esi + 0x7f]
jo 0x108f87d
jg 0x108f87f
lea ecx, [edx + edx - 0x674bb066]
sub eax, 0xb6af278f
xor eax, 0x850e5580
bswap eax
push edx
xor ebx, eax
xadd cl, dl
neg dl
ror edx, 0x46
adc ebp, eax
shl edx, 0xc6
add ecx, ecx
sbb cl, cl
mov edx, dword [esi + ecx*2 - 0x6372a800]
jns 0x12c8335
push 0x7f2d01bc
mov ecx, dword [esp]
movzx dx, byte [ebp + ecx - 0x7f2d01bc]
mov al, byte [ebp + ecx - 0x7f2d01ba]
dec dword [esp + ecx - 0x7f2d01bc]
lea ecx, [ecx + ecx*4 + 0x428fe2a2]
shl byte [esp], 0xe1
adc ebp, 1
add cl, ch
and dl, al
add dword [esp], ecx
inc dword [esp]
not dl
movzx eax, cl
jb 0x1328f2c
mov word [esp + eax*2], cs
inc esp
invalid
lea esi, [esi + ecx - 0x31b953fc]
bts ecx, ecx
shr dword [esp + ecx - 0x31b95401], cl
xor edx, ebx
lea edx, [edx + ecx + 0x6e07881]
or dword [esp + ecx - 0x31b95401], ecx
neg ecx
not edx
xor edx, 0xa11c5f18
neg edx
call fcn.0103d243
mov word [ebp + eax*8 - 0x1c8], dx
lea edi, [edi + eax*2 - 0x76]
bswap ecx
mul byte [esp + ecx - 0x39eb70bc]
or al, cl
mov edx, dword [edi + ecx - 0x39eb70be]
xor edx, ebx
dec edx
not edx
push eax
push eax
ror edx, 2
pop ecx
sub dword [esp + eax - 0x22fb], ecx
not edx
xor eax, dword [esp + ecx - 0x22fb]
xor ebx, edx
xadd dword [esp + ecx*4 - 0x8bfb], ecx
adc esi, edx
mov dword [esp + eax*2 - 0x7b3bd69a], ecx
mov dword [esp + eax - 0x3d9deb4e], esi
ret 4

Function at 0x109352c
Capabilities:
Encode data using xor

Disassembly:
xor ebx, edx
add ebp, edx
ror ecx, cl
mov dword [esp + eax - 0x30593000], ebp
ret 0xc
mov edx, dword [esi]
inc dword [esp + 6]
movsx eax, cx
lea esi, [esi + eax*4 - 0xf0dc]
xor edx, ebx
rol eax, 0x49
neg edx
xor word [esp + eax - 0x786ff8], cx
adc cl, byte [esp + eax - 0x786ff5]
rol edx, 1
mov dword [esp + eax - 0x787000], ecx
mov dword [esp + eax*8 - 0x3c37ff4], 0x33188d05
imul eax, ecx
sbb edx, 0xacb55c95
rol cl, 0x22
neg edx
inc dword [esp + eax - 0x30592fff]
js 0x101ca7f
add al, 1
shl byte [esi - 0x277f031], 1
xchg esp, eax
clc
jmp [edi + 0x30]
outsd dx, dword [esi]
xor byte [edx + esi + 0x25], ah
cmc
push es
clc
sbb ch, ch
xor byte [ecx - 0x74], bh
push edx
mov byte [0xfc777422], al
adc al, bh
jb 0x1093577
mov ecx, 0x1f213dad
lodsd eax, dword [esi]
invalid
Function at 0x1094350
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [esp], edx
lea edx, [edx*2 - 0x48cec2e3]
bswap eax
rol ecx, 0xe3
inc eax
xor ebx, eax
add ebp, eax
movzx eax, byte [esi]
add esi, 1
xor al, bl
add al, 0x95
or ecx, 0xa7311993
rol al, 1
add al, 0x2a
lea ecx, [edx*4 + 0x140124a3]
lea edx, [edx + ecx - 0x7a5c4ed5]
not al
and dword [esp + edx - 0x2d9b0737], edx
and byte [esp + edx - 0x2d9b0735], 0x83
ror al, 1
xor bl, al
call fcn.0132b1a4
jae 0x11d8067
mov ecx, 0xcb0d8b89
mov edx, ecx
mov ax, word [ebp]
btc cx, dx
sar dl, 0xc3
mov dx, word [ebp + 2]
add cl, 0xb3
jns 0x1160900
jo 0x109442e
popfd
lea edx, [ecx]
int1
cwde
xor al, 0x6b
push edx
stc
sbb al, 0x95
lodsd eax, dword [esi]
and dword [ecx + 0x45926ebf], edi
mov ch, 0xae
dec eax
out dx, al
adc bl, byte [eax - 0x35528737]
loop 0x1094430
invalid
add dword [eax], eax
add byte [eax], al
loop 0x1094455
out dx, eax
cmp ah, cl
inc ebx
pop ss
aaa
inc edx
cli
add cl, byte [eax + 0x193577f3]
pop es
int1
cld
insd dword es:[edi], dx
adc ebp, ebp
inc ebp
invalid
xor ch, byte [eax + 0x3d]
rcr byte [edx + ebx*4], 0xbe
retf 0xa362
mov cl, byte [ebp + 4]
push 0x8099c823
shr word [esp + 1], 0xe9
jbe 0x10effc4
xchg dword [esp + 4], edx
lea eax, [edx*2 + 0x9bdf982]
mov dword [esp + eax - 0x51d29982], ebp
ret 4
adc edi, 4
push 0x14beeb99
call fcn.011571c9
push 0x64b8aa34
mov eax, 0xe006c490
ror eax, 0xb
mov edx, dword [edi]
lea ecx, [eax + eax*4 + 0xcbeef1f]
mov al, byte [edx]
movzx edx, cl
sub dword [esp + edx*2 - 0xae], ecx
and dx, 0xf985
lea edi, [edx + edi - 3]
sar edx, cl
xor edx, 0xc0ac06b3
adc dl, dl
mov word [edi], ax
mov word [esp + 2], dx
pop eax
jae 0x1176f3e
lea ebp, [ebp + eax*8 - 0x3335b6ec]
sub dl, al
sal dx, 0x66
sar dx, 0xe1
mov ecx, dword [ebp + eax*2 - 0xccd6dba]
ja 0x1a78c46
xor ecx, ebx
ror dl, 0xc2
and edx, edx
ror eax, 0xc8
ror ecx, 3
btr edx, eax
cdq
call fcn.011ca025
test ebx, esp
cmp ecx, 0x13283b80

Function at 0x109ace2
Capabilities:
Encode data using base64

Disassembly:
call fcn.010a943d
not edx
lea eax, [ecx + ecx*8 + 0x661d3bbc]
call fcn.0108f3d6
mov ax, word [esi]
xchg dword [esp + 8], edx
sub ecx, 0x1d9d9793
mov dx, word [esi + 2]
call fcn.011ab987
mov dx, word [edi]
mov ax, word [edi + 2]
mov ecx, 0x94075e28
mov cl, byte [edi + 4]
jmp 0xfdbd95
Function at 0x109d06b
Capabilities:
Authenticate hmac

Disassembly:
inc eax
mov dword [esp + 4], 0x139d730f
push 0xac91e281
ror eax, 1
sub byte [esp + 0xb], 0x23
js 0x11b6f6e
mov eax, 0x811006a4
movzx edx, ax
mov eax, dword [esi + edx*2 - 0xd48]
mov ecx, edx
imul ecx, ecx
adc cl, dl
lea esi, [esi + edx*2 - 0xd44]
push ecx
add cx, 0x9a0b
xor eax, ebx
bswap edx
lea edx, [ecx*4 - 0x276a3f7d]
not dword [esp + ecx*4 - 0xb2cefc]
neg eax
dec eax
pop ecx
inc ecx
dec ecx
rol eax, 3
not cl
sub eax, 0x4faa88b4
xor ebx, eax
sub edx, edx
sal dl, 0x22
btc dx, dx
adc ebp, eax
movzx ecx, byte [esi + edx - 1]
movsx eax, dx
and dx, dx
rol eax, 0x50
adc esi, edx
or edx, 0x79aa11b1
btr eax, 0xa9
jae 0x1a4d3c8
mov eax, 0x841ac026
sub esi, 4
movsx edx, al
shr al, 0xc1
mov eax, dword [esi + edx*8 - 0x130]
lea ecx, [edx + edx*2 - 0x26677c72]
sub ecx, edx
cmovno ecx, edx
xor eax, ebx
ror dl, 0xc4
xor ecx, ecx
inc eax
xor cx, 0x4d3e
ror ecx, 0xfa
neg eax
neg edx
not eax
ror eax, 1
sub ecx, 0x73317c3b
adc ecx, ecx
xor ebx, eax
add edi, eax
not ecx
sub esi, 1
btc ecx, 0xc
lea eax, [ecx + ecx*2 + 0x733ebfa8]
movzx eax, byte [esi + eax - 0x25f39c04]
shl dl, 0x21
add ecx, ecx
lea ecx, [edx + edx*2 - 0x6ecec363]
xor al, bl
ror al, 1
call fcn.0119a3fe
xor ebx, eax
mov dword [esp + 0x10], 0x2d80f217
add esi, eax
jmp 0x132fbbb
jmp 0x10e1bce
xor cl, bl
not edx
cwde
add cl, 0xb3
lea edx, [edx*2 + 0x729ecf36]
shl dx, 0x86
xchg edx, eax
ror cl, 1
xor al, ah
not cl
sar edx, 0xda
mul eax
sbb cl, 0xc
ror eax, 0x8b
neg cl
push edx
btr edx, eax
xor bl, cl
lea edi, [edi + edx*2 - 0x7e96e0fc]
mov dword [esp + edx*2 - 0x7e96e0fa], 0x6c024321
btr ax, 0xc
xchg dx, ax
mov word [edi + edx*2 - 0x7e971f54], cx
ror word [esp + edx - 0x3f4b8faa], 0x4a
sub ax, dx
movsx ecx, ax
pop eax
js fcn.012f61d2

Function at 0x10bae60
Capabilities:
Encode data using base64

Disassembly:
xor bl, cl
or eax, 0xee18ba2e
push eax
div eax
lea ecx, [esp + ecx + 0x14]
sub ax, word [esp + eax - 0xbeb58e]
cdq
mov ax, word [ecx + eax - 0xbe3f81]
push edx
lea ecx, [edx + edx - 0x136b3060]
lea edi, [edx + edi - 2]
mov word [edi + edx], ax
pop ecx
pop edx
pop edx
pop ecx
pop edx
pop eax
jns fcn.01002e95

Function at 0x10bb94a
Capabilities:
Encode data using base64

Disassembly:
not ecx
mov dword [esp + edx - 0x5fc30000], 0x65a57999
rol edx, 0xa1
xor ebx, ecx
cbw
lea edx, [eax + edx + 0x67067f10]
sub dword [esp], 0xe3195c16
sbb edi, 3
mov dword [edi], ecx
xchg edx, eax
mov edx, dword [esi]
or byte [esp + 2], 0x17
movsx ecx, word [esp]
lea esi, [esi + ecx*2 - 0x3b02]
dec word [esp + ecx - 0x1d81]
sar eax, cl
xor edx, ebx
or al, al
shr eax, 1
btr eax, 0x33
ror edx, 1
jmp 0x19aac14
sub dword [esp + eax - 0x7ac2b7ec], 0x58963b00
mov dword [esp + ecx*8 - 0xec18], 0xf6a1a3a1
xor edx, 0x9d2b3629
push ecx
ror ecx, 0x61
jo 0x1ad59cf
not edx
and ecx, 0x1a02301d
adc edx, ecx
xor ebx, edx
add ebp, edx
pop edx
pop eax
jmp fcn.01002e95
Function at 0x10c48b5
Capabilities:
Encode data using base64

Disassembly:
dec ebx
push 0xdb6b3bd
call fcn.01151d72
push 0xdd36dd2d
mov dword [esp + 4], eax
sub dword [esp], 0xb887c97
shl word [esp + 2], 0x84
jns 0x107fa83
mov edx, 0xa7187f23
and dl, dh
mov cx, word [esi + 4]
imul edx, edx
sar edx, 0xba
and edx, 0x4f0a5c98
lea esi, [esi + edx - 0x4f0a5c82]
sbb dl, dl
mov word ss:[eax + edx - 0x4f0a5c00], cx
lea edi, [edi + edx - 0x4f0a5c04]
lea ecx, [edx + edx - 0x74d7c55f]
mov eax, 0x8b895326
mov eax, dword [ecx + edi - 0x293cf2a1]
xadd dx, cx
xor eax, ebx
and dx, 0x6114
bswap eax
call fcn.00fe0998
Function at 0x10d4dd3
Capabilities:
Encode data using xor

Disassembly:
movzx edx, byte [esi + eax*2 - 0x7a00]
pop eax
add esi, 1
mov eax, 0x3a71636
sal ax, 0xa8
xor dl, bl
bswap eax
dec dl
or ax, ax
neg dl
imul eax, eax
imul eax, eax
sbb dl, 0xa2
not dl
and eax, 0xa893392c
setge byte [esp + eax - 0x8803000]
xor bl, dl
mov dword [esp + eax*4 - 0x2200c000], esi
sub eax, eax
inc ax
setne al
push ebp
movsx ebp, al
call fcn.0107d5a4
mov ch, 0x9c
loopne 0x10d4dff
lahf
rol ecx, 0xd9
rcr ch, cl
retf

Function at 0x10dd0ed
Capabilities:
Encode data using xor

Disassembly:
add ebp, edx
mov dword [esp + eax - 0x459bf4cc], 0x27171e13
mov ecx, dword [edi + eax - 0x459bf4cc]
cwde
or esp, dword [edx + edi*4 - 0x68]
shr byte [esp + 4], 0xe1
mov eax, dword [edi + 4]
neg word [esp + 4]
jp 0x1108574
lodsd eax, dword [esi]
inc byte [eax - 0x239d75ee]
push ecx
add eax, 0xf86aafed
inc eax
push edx
and eax, 0x5e52e607
jle 0x10dd143
stosd dword es:[edi], eax
or ecx, dword [ebp + 0x2022517]
dec ebp
inc esp
push esp
jbe 0x10dd18a
push edi
pop edi
out 0x1d, al
insb byte es:[edi], dx
push edx
xchg dword [0x4f5fad92], esi
dec edi
xchg esi, eax
imul edx, dword [edx + 0x6180fb73], 0xe0b612e9
jg 0x10dd0fe
and al, 0xbc
and ch, dh
paddsw mm2, qword [ecx + 0x524a47b4]
sti
mov eax, 0xe80052ec
pop ecx
adc al, 1
lea ebx, [ecx + 0x4d08bddb]
mov edx, 0x69527ceb
dec ebx
mov bh, 0x19
test ebp, esi
jecxz 0x10dd183
xchg edx, eax
jmp ebx
or al, 0x77
push es
or eax, dword [esi - 0x4e]
fsub st(5), st(0)
fsub st(5), st(0)
salc
jae 0x10dd1c5
xchg dword [ecx], ebx
clc
insd dword es:[edi], dx
vmread dword [ecx + 0x45], esp
inc ebp
ror byte [ebx], 1
xor eax, 0xd7340221
enter 0xffffffffffffb42e, 0x4c
inc esi
test al, 0xc4
sbb al, 0xb4
sub ecx, esi
bound eax, qword [ebp - 0x63]
pop esi
aas
adc dword [esi - 0x5d564460], 0xffffffde
mov edx, dword [edi]
xchg edx, eax
sbb ecx, dword [ecx]
sub dword [esi + 0x4d], eax
fldcw word [edi]
neg dword [esi + 0x1b75ca8c]
mov edx, cs
jne 0x10dd1e4
pop es
xchg edx, eax
or eax, 0xb2ba9e78
and ecx, edx
fiadd word [ecx - 0x420d515b]
sti
adc ah, byte cs:[ebp + ebp + 0x525aebb7]
scasd eax, dword es:[edi]
pop ds
dec eax
mov eax, dword [0xd843636d]
mov edi, 0x3eeeed21
mov bh, 0x52
jl 0x10dd198
add dh, byte [eax]
invalid
adc edi, 7
mov edx, 0x9fb463a7
shr word [esp + 3], 3
mov dword es:[ecx], eax
pop edx
pop ecx
jmp ebp

Function at 0x10df3bd
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [ecx + esi - 0x24b81fed]
jb 0x106e255
mov dword [esp + ecx*2 - 0x49703fda], eax
xor edx, ebx
lea edx, [edx + ecx*8 - 0x33096041]
xor edx, 0xc810ae02
inc ax
lea eax, [eax*8 + 0x41bbca2e]
sub edx, 0xccb1df2b
call fcn.01a28dc1
mov eax, 0xeb85353e
add al, ah
sbb ebp, 4
movzx ecx, ax
cwde
btr ax, cx
mov eax, dword [ebp + eax - 0x3573]
rol cx, 0x4a
btr ecx, ecx
xor eax, ebx
shl cl, 0xa2
ror eax, 1
ror ecx, cl
bswap eax
shr cx, 0xe
sub cl, cl
bt ecx, ecx
ror eax, 3
ror cx, 0xa5
sar cx, 0x8a
dec eax
shl ecx, 0xb7
not eax
bswap eax
imul ecx, ecx
xor ebx, eax
inc cx
neg cx
add esi, eax
movzx eax, cl
not cl
mov ecx, dword [ecx + edi - 0xff00]
mov eax, dword [edi + eax*2 - 0x1fa]
call fcn.01adc7c3
Function at 0x10e6b06
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.00fe5b81
shl byte [esp + ecx - 0x691a32fc], 0x66
inc eax
rol edx, cl
or word [esp + ecx - 0x691a32fa], dx
neg eax
xor byte [esp + ecx - 0x691a32f9], ch
or edx, edx
not eax
ror eax, 1
xadd cx, dx
call fcn.01a155c1
Function at 0x10f2368
Capabilities:
Encode data using base64

Disassembly:
xor ebx, ecx
sub dl, al
adc ebp, ecx
pop eax
pop eax
pop eax
jmp fcn.01002e95

Function at 0x10f892e
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1a925c6
call fcn.019fdada
mov eax, 0x57878539
movsx ebx, ax
dec eax
mov edi, dword [eax + esi - 0x57878539]
inc esp
movsx esp, al
dec eax
mov eax, dword [eax + esi - 0x57878531]
call fcn.010b1ef8

Function at 0x10f8e8f
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [ebp + ecx*4 - 0xee]
mov edx, 0xad828b98
adc ebp, 2
sal al, cl
movzx ecx, dl
mov word [ebp + ecx*2 - 0x130], ax
lea edi, [edi + ecx*4 - 0x264]
inc edx
mov eax, 0x3b800e06
not dx
mov edx, dword [edi + ecx*2 - 0x130]
lea ecx, [ecx + ecx*2 - 0x61562379]
xor edx, ebx
bswap edx
ror al, 7
not edx
ror edx, 2
add al, 0x1e
lea edx, [ecx + edx + 0x2b750959]
ror ecx, 0xd0
shl ecx, cl
xor ebx, edx
inc eax
bt ecx, eax
dec al
adc esi, edx
sal ecx, 0x72
movsx edx, ax
jmp esi
dec al
rol cx, 0xab
dec edx
rol ax, cl
xor cx, 0xbf20
rol edx, 2
mov dword [esp], 0x94b82b88
add ecx, dword [esp + 4]
jg 0xfebe58
dec edx
call fcn.011a154c

Function at 0x111447c
Capabilities:
Encode data using base64

Disassembly:
sub eax, 0xf3038b9f
xor ebx, edx
push ecx
add ebp, edx
lea ecx, [eax + 0xca22c10]
pop ecx
pop ecx
pop edx
jmp fcn.01002e95

Function at 0x1125842
Capabilities:
Encode data using base64

Disassembly:
rol edx, 1
xor ebx, edx
btc ax, 0xb0
mov dword [esp + ecx*8 - 0x31600], eax
dec byte [esp + ecx*2 - 0xc57e]
add ebp, edx
pop eax
pop edx
jmp fcn.01002e95

Function at 0x112ce8d
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ecx + edi - 0x6953e8]
lea edx, [edx*8 - 0xd5ce6d7]
push edx
mov dword [esp + 0x14], ebx
jae 0x10df49c
Function at 0x1142f40
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xchg cl, al
xor edx, ebx
neg eax
lea edx, [edx + ecx - 0x71b88805]
sbb ecx, ecx
bswap edx
and eax, eax
bts eax, 0x20
sbb edx, 0x14afb4ae
rol edx, 3
neg edx
rol al, 0x67
lea eax, [ecx*8 - 0x6dcb30e7]
xor ebx, edx
add esi, edx
jmp esi
lea eax, [eax + ecx + 0x16132883]
ror eax, 1
dec edx
jle 0x10c13d8
xchg dword [esp + edx - 0x78], ecx
lea eax, [eax + ecx*2 + 0x70184b1a]
not eax
call fcn.011316ae
mov eax, 0xcd85a12b
xadd al, ah
cdq
mov eax, dword [ebp]
bt edx, edx
sbb edx, 0x9125bd93
bts edx, edx
mov cx, word [ebp + edx - 0x6eda4a67]
lea ebp, [ebp + edx - 0x6eda4a65]
setb dl
mov word ss:[eax + edx - 0x6eda4a00], cx
mov eax, edx
lea ecx, [edx + eax*2 + 0x250c408e]
and eax, 0xce2b752d
lea edi, [edx + edi - 0x6eda4a04]
not edx
mov edx, dword [eax + edi - 0x4e0a4000]
ror eax, 0xcb
ja 0x10b25b3
mov eax, 0xf729db9d
mov ecx, eax
mov ecx, dword [ebp]
xor ecx, ebx
dec eax
movzx edx, ax
inc ecx
xor ecx, 0xd9ab5899
rol edx, 0xa2
jae 0x19fb196
inc ax
dec ecx
div eax
rol ecx, 3
cwde
btc eax, 0xb1
sbb ecx, 0xe62f1b87
rol edx, 0xe1
neg eax
inc al
not ecx
rol ax, 0xe
not edx
imul edx, eax
bswap ecx
rol dl, 0xa6
xor ebx, ecx
call fcn.01155e3f
xor cx, cx
lea edx, [edx + ecx - 0x7ff0df7b]
xchg ecx, eax
xor ebx, edx
add ebp, edx
mov edx, dword [ecx + esi - 0x5314]
bts ecx, ecx
rol cx, 1
mov cx, word [esi + ecx - 0x10a624]
adc esi, 2
shr cx, 1
rcr edx, cl
mov dword [esi], edx
mov ecx, 0xf539fe8c
inc eax
jmp ebp

Function at 0x1147350
Capabilities:
Encode data using xor

Disassembly:
inc word [esp + 6]
jg 0x1ad923d
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
mov edx, 0x361e7eb3
and edx, edx
push ebx
cpuid
call fcn.011ae3d9

Function at 0x11552aa
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xceced21
call fcn.010139a7

Function at 0x115d057
Capabilities:
Encode data using base64

Disassembly:
ror ecx, 1
lea eax, [edx + edx*8 + 0x79319a9f]
cdq
inc ecx
sub dl, al
dec eax
rol dl, 0x61
not ecx
bswap ecx
xor ebx, ecx
add ebp, ecx
pop edx
jmp fcn.01002e95

Function at 0x115d16a
Capabilities:
Check for software breakpoints

Disassembly:
or eax, eax
shl al, 0x41
rol ecx, 1
imul edx
xor ebx, ecx
add dword [esp + 8], eax
adc ebp, ecx
mov dword [esp], eax
idiv dword [esp + 2]
call fcn.01316bf4