joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7673b0
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x82
mov byte [ebp + 0x3d781], bl
xlatb
add eax, dword [eax]
add byte [eax], al
movsx ecx, dl
mov edx, dword [edi + edx*8 - 0x10574]
add ecx, 0xf48f0d80
add dword [esp + 8], ecx
mov cl, byte [edi + 8]
push 0xa5a86f29
call fcn.00c5055c
sal dword [edi], 1
pop es
mov ebx, 0xe5753a76
adc al, byte [ecx]
add al, 0x48
lcall 0xb9ec, 0x17928713
pop eax
nop
xchg ebx, eax
mov ah, 0xec
mov bh, 0xb4
js 0x767393
adc al, dl
push cs
and al, 0xec
inc esp
inc esi
dec eax
paddsb mm1, qword [esi - 0xd]
xchg esp, eax
outsd dx, dword [esi]
dec esp
in eax, dx
xor byte [edi + 0x14e6ed10], ah
add edi, 0x13
sub eax, 0xed03d65a
jno 0x767398
push es
mov word [ebx], gs
in eax, dx
lahf
sal byte [ecx + 0x6b53ec54], 1
fst dword [ebx]
lodsd eax, dword [esi]
lahf
adc al, 0x6a
jp 0x767433
xchg edx, eax
cwde
sub dword [eax - 0x13], 0x12d4f75a
pop es
outsd dx, dword [esi]
cmc
or esp, eax
adc dword [ecx + ebp*4], edx
mov eax, dword [1]
stc
add byte [eax], al
add cl, bh
mov ebp, 0x1a118
add byte [eax], al
cmp ah, byte [ebx - 0x328ed960]
jnp 0x767466
aam 0xa7
jmp 0x7674b9
sub eax, eax
sbb eax, 0x9c9fc1c6
and dword [ebp + eax*8 - 0x612f2b55], 0xffffffa8
movsb byte es:[edi], byte [esi]
lds ebp, [ebx - 0x57612f2c]
ret
leave
mov eax, 0x25696f04
inc ebx
adc ch, 0xbc
push ebp
xor eax, 0xffd656ea
pop ecx
push 0xffffffffffffffac
loope 0x767497
je 0x76746d
jne 0x76750a
dec edi
sbb edi, dword [ecx - 0x7b]
push esp
lcall 0xda8e, 0xa9d19765
sub dl, byte [edx + 0x151d7d9a]
into
and dword [eax + 0x46b8a139], ebx
cli
add dl, cl
jmp 0x6b0eb87a
and dl, cl
fnstsw word [eax + 0x1e]
mov dl, 0xf
push cs
cwde
mov dword [eax], edx
je 0x767489
jno 0x76745e
inc eax
in eax, dx
mov eax, 0x3e14ae91
dec esi
mov byte [0x38eae43c], al
dec ebp
invalid
xor ebx, esp
jg 0x767478
adc bh, byte [eax - 0x49]
ficom word [edx]
mov eax, ss
adc dword [0x552633ed], eax
dec esp
pop esi
pop ebx
cmp dword [edx], ebx
sbb ebx, dword [edx + 0x6a]
dec esp
push 0x4c
lea edx, [edx + eax*8]
pop es
mov dl, byte [esp + ebp*8 - 6]
and byte [esi - 0x46], cl
cmp eax, 0x51764bc8
cld
jno 0x7674f2
test eax, 0x754259ab
or esp, dword [edi]
sub edx, ebp
hlt

Function at 0x76abe6
Capabilities:
Encode data using xor

Disassembly:
pop ecx
pop eax
pop edx
pop eax
pop eax
pop edx
jbe fcn.00ba4ac8
invalid

Function at 0x77e04e
Capabilities:
Execute syscall

Disassembly:
dec eax
mov dword [esp], edx
btc edx, 0x26
xor ebx, eax
not dx
imul dx, cx
add ebp, eax
movzx eax, byte [esi]
neg ecx
lea esi, [ecx + esi - 0xb080]
not ecx
xor al, bl
shr byte [esp + 4], 0xa2
call fcn.00cd80ea
syscall
inc ecx
push ecx
dec eax
mov dword [esp], 0x1e0517fe
call fcn.00b6d40e
call fcn.00cc45b2
Function at 0x7b249a
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x9421ddbf
mov dword [ebp - 4], eax
mov dword [esp + 8], 0xff9505ad
test ebx, ebx
call fcn.00d0dd77
push edi
dec eax
mov dword [esp], 0x1e8347c2
call fcn.00b6d40e
mov ecx, 0x368ae127
mov eax, dword [esi + ecx*2 - 0x6d15c24e]
or ecx, ecx
mov cl, byte [esi + ecx*2 - 0x6d15c24a]
mov edx, 0xa987639e
shr edx, 0x8b
sub dl, 0x8d
lea esi, [edx + esi - 0x15305d]
sub edx, edx
shr eax, cl
mov dword [esi + edx], eax
lea eax, [edx + edx*2 - 0x19786441]
lea edi, [edi + edx*8 - 4]
not dl
mov ecx, dword [edi + edx - 0xff]
xor ecx, ebx
sar al, 0xc6
js 0xd29a1a

Function at 0x7b64ea
Capabilities:
Authenticate hmac
Encrypt data using chaskey

Disassembly:
neg eax
mov dword [esp + ecx*2 - 0xc70c], ecx
neg dx
xor ebx, eax
sal cl, 0x27
inc byte [esp + ecx*2 - 0xc5fd]

Function at 0x7be8cb
Capabilities:
Encode data using xor

Disassembly:
lea eax, [ecx - 0x3c7e0ef6]
neg dl
rol eax, 0xd6
call fcn.00b503df
fcmovb st(0), st(4)
sbb edi, dword [edx - 0x6553e781]
adc bh, byte [esp - 0x715ed3a]
inc eax
adc esp, ebp
inc eax
push esi
adc eax, 0x8edd12d5
fimul dword [edi - 3]
adc al, byte [ebx + 0x1382721c]
lahf
test al, 0xf
in al, dx
and esp, dword [eax]
or byte [ecx + 0x5c6fecac], ch
inc edx
mov esi, 0x3c342a12
in al, dx
inc edx
jbe 0x7be985
pop ss
in al, dx
jle 0x7be957
les edx, [ebp + 0x54]
in eax, dx
pushal
popfd
or ch, ch
div byte [ecx + edi*4]
fist word [ebx]
sub al, 0xb2
in al, dx
sbb ebp, ebp
je 0x7be93f
push ds
mov dh, 0x33
in eax, dx
in al, 0x38
add ebp, esi
in eax, dx
sbb eax, 0xf6bf3cbd
xchg ebp, eax
imul edx, dword [edi - 5], 0x6e53e719
push ebx
outsb dx, byte [esi]
sbb al, 0x1c
hlt
fldcw word [ebp + 0x15f90fd]
add byte [eax], al
add byte [ecx], ch
test dword [esi], esp
cmp eax, 0xedd009eb
scasd eax, dword es:[edi]
mov eax, dword [0x2486b652]
test dword [ecx + edx*8], 0x42bfbe6f
invalid
add byte [eax], al
add byte [eax], al
pushal
jb 0x7be9e6
rcl byte [eax - 0x80]
retf 0x64ed
iretd
popfd
sbb byte [edx], ch
call 0xebb7b08d
adc ebp, dword [ebp + 0x13c07dda]
and eax, 0x12835ac0
xchg edx, eax
fist word [edx]
nop
enter 0x8b6, 0xffffffffffffffec
aas
push ss
jecxz 0x7be9d3
adc bh, byte [edi]
add bh, byte [ecx + 0x5cb912e4]
test byte [ebx + 0x165edf13], bl
fistp word [esi + 0x16]
in al, dx
mov al, byte [0xb55f5013]
in al, dx
jns 0x7bea13
mov ah, 0xa7
adc al, byte [edx - 0x3613da3e]
xchg esi, eax
test byte [esi], cl
in al, dx
jle 0x7bea48
adc al, 0xa3
dec ebp
in eax, dx
mov al, 0x6b
adc ebp, ebp
out 0xf4, al
dec edi
invalid
rcr dword [ebx + 0x1a023], 1
add byte [eax], al
call 0x29b94248
vpcmov xmm3, xmm7, xmm3, xmm13
fcom qword [0x9ba141bb]
inc ebp
push ss
test ecx, eax
fadd dword [ebp + 0x598e2e33]
inc ebx
rcr eax, 0x85
xor ebp, dword [esi]
mov ds, word [ecx + 0x43]
mov ah, 0xcf
sub al, 0x7a
scasd eax, dword es:[edi]
xor dl, dl
add eax, 0x8c36dd36
push 6
mov byte [ebx - 0x419f5696], al
wait
or eax, 0x853d2dfb
jge 0x7bea64
sbb al, byte [edi + 0x1a298d7c]
adc bl, ch
jl 0x7bea92
invalid
Function at 0x7c8f78
Capabilities:
Encode data using base64

Disassembly:
call fcn.00d44963
mov dword [ebp - 4], eax
mov dword [esp], 0xf8275e1e
rol dword [esp], 0x13
test ebx, ebx
lea esp, [esp + 0x10]
je 0x82aa6f
mov eax, 0x28beb2b9
xor al, ah
mov eax, dword [ebp + ebx*4]
push 0x488943a1
inc dword [esp]
mov dword [esp], eax
push 0x80a95604
neg word [esp + 2]
dec ebx
push 0x3410ec88
jmp 0xc5c1ff
bts dx, 0xa5
setb dl
adc ebp, 1
and cl, al
mov dword [esp], 0xcabc2f26
not cl
btc edx, edx
jae 0x7e6960
mov dx, word [edi + ecx - 0x4935a689]
or ecx, 0x1bae54a3
mov ax, word [edi + ecx - 0x5bbff6a9]
and cx, cx
neg cx
rol cx, 0x83
lea edi, [edi + ecx - 0x5bbf4aa6]
btc ecx, ecx
neg ecx
btc cx, 0x90
adc dx, ax
jmp 0xc9b61c
mov word [ebp], cx
sal dword [esp], 0xe8
xor dword [esp], edx
mov edx, dword [edi]
call fcn.00d6f4ee
mov edi, 0xbe38e33b
inc esp
movzx ecx, bh
dec ecx
shl ecx, 0xdb
inc ecx
mov ecx, dword [eax]
dec eax
sub edi, edi
movzx eax, di
inc ebp
btr ecx, ecx
dec ebp
lea eax, [eax + edi + 4]
bt edi, eax
cwde
inc ecx
xor ecx, edi
neg ecx
inc ebp
movzx ebx, cx
rol ecx, 3
dec esi
lea edx, [ebx*4 - 0xc4f96e4]
sal eax, 7
neg ecx
inc ecx
movsx ebx, dl
inc ecx
lea ecx, [edx + ecx - 0x7e67fada]
inc esp
mov ebp, edi
dec edi
lea esp, [ebp + edx*2 + 0x2ab40c28]
inc ecx
xadd edx, ebx
neg ecx
sal ax, 0xaf
ror ecx, 1
dec ecx
rol edx, 0x5b
inc ecx
push edi
xor dword [esp + eax*4], ecx
call fcn.00b2c3ba
lea esp, [esp + 8]
jne 0x76bcc9
call fcn.00ca2a2a
lea edx, [edx + ecx*8 + 0x7598a990]
xor byte [esp + ecx*8 - 0xdff], 0xa8
call fcn.00b1b7b8
dec eax
arpl di, di
dec esp
add esi, edi
inc esp
add bl, byte [esp + esi - 0xef12]
inc esp
mov ebx, dword [esi + ebp - 0xef14]
dec esp
mov dword [esp + esi*2 - 0x1de20], edx
mov cl, byte [ebp + esi*4 - 0x3bc4c]
dec eax
rol dword [esp + esi*2 - 0x1de20], 0x99
call fcn.007280e9
movsx ecx, dl
jmp fcn.00b8d382
xor cl, 0x16
sub byte [esp + 1], 0x9d
call fcn.00c359e8
jl 0xc383d8
jmp 0xc3844d
daa
wait
cdq
setp byte [eax]
daa
and eax, 0x478a33e2
lcall 0x8a33, 0xe2252728
inc edi
xor dword [ebx + 0x53], ebp
out 0x93, eax
mov bh, 9
pand mm7, qword [ebx - 0x65996fc6]
sbb dword [ecx - 0x77ab32ba], ebp
invalid
stosd dword es:[edi], eax
adc ebx, dword gs:[0xc4028d09]
lodsb al, byte [esi]
fcom qword [ecx]
je 0xc38478
adc ebp, dword [ecx]
ja 0xc3848d
mov ecx, 0xf0faec75
invalid
jne 0xc3843b
cli
invalid

Function at 0x7da678
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 0xe31e3fac
call fcn.00b76840
add esi, 2
sal dl, 0x65
mov word [esi], ax
call fcn.00c72d11
dec ebx
push 0x902a968d
jmp 0xdaa25c
lea esp, [esp + 8]
jne 0x77477c
mov eax, dword [ebp]
push 0xb7897f86
call fcn.007d45c0
mov ecx, 0x148d6c9d
lea ebp, [ecx + ebp - 0x148d6ca1]
mov ecx, dword [ecx + ebp - 0x148d6c9d]
mov eax, 0x60b420b3
sar ax, 0xc4
call fcn.00768c3b
jmp 0xd9eac8
Function at 0x7da7c3
Capabilities:
Encode data using xor

Disassembly:
sar dword [esp + eax*2 - 0x3e], 0xb3
movzx ecx, byte [eax + ebp - 0x21]
mov dword [esp + eax - 0x21], eax
xor cl, bl
cdq
pop eax
add cl, 0xb6
xor cl, 0x20
bts eax, 0x1f
pop ds
setb al
add edx, edx
neg cl
sub al, dh
imul dword [esp + edx]
xor cl, 0x16
xor bl, cl
cdq
inc word [esp + eax - 0x80000000]
call fcn.00c78eaf
add dword [eax - 0x3e], ebp
jle 0x7da7de
invalid

Function at 0x7deec0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov ecx, dword [esi + ecx - 0x519e1167]
inc edx
not edx
shr edx, 0xe8
mov dword [esp + edx - 0xffffee], ebx
cpuid
jbe 0xd3896e
push 0x4514bf28
push 0x42036c94
sbb esi, 7
mov dword [esi + 0xc], eax
mov eax, 0x2e825c1a
xadd word [esp + eax - 0x2e825c14], ax
cwde
mov dword [esi + eax*8 - 0x22898], ebx
call fcn.00d0391e
mov eax, 0xa2a83c14
movzx ecx, ax
bts ecx, ecx
mov edx, dword [ebp + ecx - 0x103c14]
jae 0xd568f9
lea ebp, [ebp + ecx - 0x103c10]
xor edx, ebx
sal ax, 0xad
jns 0x752d44
adc eax, 0x1e96eb90
dec edx
bts ax, ax
inc ax
bswap edx
rol edx, 3
bswap edx
xor ebx, edx
not ax
ror cl, 0x62
adc esi, edx
cdq
cbw
rol dl, 0x85
mov edx, dword [ecx + edi - 0x103c05]
inc ecx
sbb cl, ah
rol eax, 0xfb
lea edi, [edi + ecx*4 - 0x40f010]
jne 0x7901eb
mov ecx, dword [edi]
mov esi, 0xac12c722
mov edx, 0x1a29b2bb
lea eax, [edx*8 + 0x2830fdb1]
lea edi, [edi + edx*2 - 0x34536572]
not ax
mov esi, ecx
dec eax
jle 0x808cb8

Function at 0x7e0017
Capabilities:
Encode data using xor

Disassembly:
xor bl, cl
cdq
neg ax
mov dword [esp + edx*2], edx
lea ebp, [ebp + edx*4 - 2]
sub word [esp + edx + 2], 0x9226
shl edx, 0xbe
mov word [ebp + edx], cx
lea ecx, [edx + eax*4 + 0xf37ee04]
call fcn.00d0df23

Function at 0x7ebdc1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
div dl
inc dword [esp + eax + 4]
ror ecx, 1
mul eax
btc edx, 0x3b
bswap ecx
mov dword [esp + edx - 0x8000000], 0x22a78f9c
sbb ecx, 0x80003b96
sal dl, 1
sbb dl, al
rol dword [esp + edx*4 - 0x1ffffffc], 0x24
ror ecx, 3
xor ebx, ecx
add esi, ecx
btr edx, eax
jae 0xd3b8e4

Function at 0x7ee01a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + edx - 0x682913a1], 0x673ecb21
rol word [esp + edx - 0x682913a1], 0x29
inc eax
xor ebx, eax
sal dword [esp + ecx], 0x70
setbe dl
adc ebp, eax
mov eax, 0x51954a3a
shl ecx, 0x30
jbe 0xd02ffd
bswap eax
ror ecx, 0x11
ror dl, 0x87
neg eax
call fcn.00cb9327
xor cl, byte [edx + esi - 0x68291300]
lea esi, [esi + eax - 0x51954a39]
xor cl, bl
rol cl, 1
neg cl
dec dword [esp + edx - 0x68291300]
jne 0xcd6704
Function at 0x7f5206
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea esp, [esp + 4]
je 0x7f70a4
call fcn.007f8440
sbb eax, 0xf2881a81
or edx, 0xbd9d2d39
bswap eax
push edx
xor edx, edx
xor ebx, eax
shr word [esp + edx*2], 0x22
inc cl
adc edi, eax
call fcn.0083734e
lea esp, [esp + 0xc]
call eax
mov ecx, 0xcb3c7393
movzx edx, cx
mov ebp, dword [ebp + edx*2 - 0xe72a]
xor ecx, edx
mov dword [edx + ebp - 0x7393], eax
movzx eax, dx
cdq
call fcn.00784365
lea esp, [esp + 8]
call eax
mov edx, 0x9f990291
dec edx
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
jno 0xb84a88
mov edx, dword [edi]
jmp 0xd04c1a
mov ecx, 0x170debbd
lea edx, [ecx + ecx*4 - 0x2487d49]
not eax
sub edx, edx
seta dl
mov dword [esi + ecx*4 - 0x5c37aef4], eax
lea edi, [ecx + edi - 0x170debc1]
lea eax, [edx*2 - 0x45c079d3]
adc edx, dword [edi + ecx - 0x170debbd]
xor ax, 0x5732
neg eax
neg cx
xor edx, ebx
push eax
rol edx, 2
not ecx
shl ecx, 1
imul ecx, ecx
dec edx
xor edx, 0x5600d216
xchg dword [esp + ecx - 0x220ac840], ecx
btr eax, eax
rol edx, 3
jmp 0xbb89d2
mov dword [esp], 0xd72e1287
jmp 0x7af8b8
mov eax, dword [edi]
mov edx, 0xc384e31b
push edx
mov ecx, edx
mov edx, dword [edi + 4]
ror ecx, 0x22
mov cl, byte [edi + 8]
jb 0xd10ffd
movsx esi, dx
movzx ebx, dl
mov edi, ebp
shl esi, 0xbc
pop ebx
pop ebp
and edx, 0x5a239f10
jg 0xc941bd
mov eax, 0x982302b1
jmp 0xb49af2
pop esi
lea eax, [edx + edx*2 + 0x5901bf8d]
and dx, dx
setg al
mov eax, dword [esi + edx*4 - 0x68040840]
ror edx, 0x84
xor edx, edx
mov ecx, edx
lea esi, [esi + ecx*2 + 4]
shl ecx, 0xc1
and cl, cl
xor eax, ebx
jmp 0xc5c21f
call fcn.00cd11be
ja 0xbb1b38
mov ecx, 0x9a8e4c99
add edi, 4
bts cx, 0x32
imul ecx, ecx
lea eax, [ecx + 0x3e9761b8]
xor edx, ebx
neg ecx
lea eax, [eax + eax*8 + 0x3523389e]
xor eax, eax
inc edx
rol al, 0xe1
sal al, 0x41
ror edx, 2
push ecx
call fcn.00b7b320
mov edx, 0x309b2037
lea ecx, [edx*2 + 0x5732b8b5]
lea eax, [edx + ecx - 0x3ff75dc4]
lea ebp, [edx + ebp - 0x309b203b]
shr al, cl
bt ecx, eax
imul ecx, edx
mov eax, dword [edx + ebp - 0x309b2037]
btr dx, dx
bts cx, cx
inc edx
xor eax, ebx
or dx, cx
rol eax, 1
sub ecx, 0xbcb06088
not ecx
xor eax, 0xf2011895
bt dx, cx
jb 0x7da6dd
push 0x89af4105
xor esi, ecx
and esi, 0xff
shr dword [esp], 0x3a
push 0xfdb853b0
mov esi, dword [esi*4 + 0xd31504]
shr ecx, 8
call fcn.007ccd91
push 0xcd2ff1ab
call fcn.0074f92a
rol ecx, 3
xor dl, dl
xchg dword [esp + eax - 0xff], edx
call fcn.00ca29fd
mov ecx, dword [esi]
mov edx, 0x6d3e3c38
neg dl
mov edx, dword [esi + edx - 0x6d3e3cc4]
push 0x930c309c
adc esi, 3
dec dword [esp]
xor eax, eax
test edx, edx
jmp 0xb27679

Function at 0x7fc6be
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], eax
movzx ecx, byte [ebp]
add eax, 0x29a11a9
Function at 0x80be2f
Capabilities:
Authenticate hmac

Disassembly:
push 0xdb318a97
call fcn.00c3d249
mov esi, 0x73005fb1
dec esp
lea ebx, [esi*2 - 0x4c74bdd1]
dec esp
mov esp, dword [ebp + esi - 0x73005fb1]
inc ebp
movzx edx, bx
dec edx
mov esi, dword [ebp + edx*2 - 0x31a]
dec ecx
neg edx
dec edx
lea ebx, [edx*8 + 0x2a8f0f1d]
dec ecx
lea ebp, [edx + ebp + 0x1a1]
inc ecx
shl dl, 0xc1
movsx ecx, bx
dec ecx
adc edx, 0xe31e0d1e
dec ebx
mov dword [esp + edx + 0x1ce1f404], esi
mov edi, 0xd28149cb
push ds
or eax, 0x894be31e
mov ah, 0x14
add al, 0xf4
loope 0x80be9f
inc esp
movzx ecx, cl
inc ebx
mov edi, dword [eax + edx*4 + 0x7387d010]
dec ecx
rol edx, 0x5c
inc ecx
mov esi, ebx
bswap ecx
dec esi
lea eax, [ebx + eax - 0x2a8f0291]
inc ecx
aad 0x41
xor edi, edi
xor edi, 0x7ea26a29
inc cx
and ebx, ebx
not edi
inc esp
movzx esp, cl
rol edi, 1
inc edi
neg edi
inc ecx
bt ebx, 9
jae 0x8289eb
mov edx, 0xe04d761e
fild word [0x6652e057]
push ss
push esi
loopne 0x80bf3d
push 0xffffffffffffffae
scasb al, byte es:[edi]
popal
loopne 0x80be93
pop esi
js 0x80be72
pop ds
mov al, byte [0xe020da97]
invalid
sub eax, 0x5c18e83
shl al, 0x87
inc edx
or al, al
xor ebx, edx
bts cx, cx
add byte [esp + ecx - 0x1075], 0x15
adc esi, edx
mov dword [esp + eax - 0x3e717c00], esi
ret 4

Function at 0x81bde1
Capabilities:
Encode data using base64

Disassembly:
call fcn.00d634ab
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x81be53
push ebx
jb 0x81be68
imul esp, dword [ebx + 0x65], 0xf12ce800
cld
invalid
pushfd
inc eax
les ebp, [0xbf398c12]
invalid
invalid

Function at 0x829c2f
Capabilities:
Encode data using base64

Disassembly:
call fcn.00b14375
movzx dx, byte [edi]
mov cl, byte [edi + 2]
mov eax, 0xb3a71a99
lea eax, [eax + eax*4 - 0x78c45afe]
btr eax, 0x86
lea edi, [edi + eax - 0x97f29bd]
sar al, 5
shl dl, cl
movsx ecx, ax
xor eax, ecx
mov word [eax + edi - 0x97f0000], dx
rol cx, 0xad
jbe 0xc700cb
lea edx, [ecx*8 - 0x4aed82ff]
sal ecx, 0xf3
pop ecx
pop ecx
pop ecx
jbe fcn.00b14ece
ja 0x829caf
adc edi, dword [eax]
cmp ecx, dword [edi + 0x2b3f20b]
aad 0xbd
dec ecx
aad 0xd8
and bl, al
in al, dx
lahf
jne 0x829c38
xchg edx, eax
mov al, byte [0x2cac644c]
add dword [esi - 0x47d0bd6f], edx
aaa
into
invalid
out 0xa8, eax
fstpnce st(3), st(0)
invalid

Function at 0xb11138
Capabilities:
Encode data using xor

Disassembly:
not dx
rol ecx, 3
call fcn.00ba0562
Function at 0xb22e32
Capabilities:
Encode data using xor

Disassembly:
dec ebp
lea eax, [eax + edi - 0x3d7b]
dec eax
mov dword [esp + edi - 0x3d7f], 0xd882c73b
inc eax
and bh, bh
inc ecx
movzx edx, ah
inc ecx
xor eax, edi
inc ecx
sub ah, 0xb2
lea eax, [eax + ebx*2 - 0x45f5fcfc]
dec esp
add ecx, edx
neg eax
xor eax, 0x7984d3be
inc cx
ror edx, 0x42
inc eax
dec eax
inc edx
inc ecx
sub edx, 0x2daff81f
inc edx
ror byte [esp - 0x43], 0xc4
neg eax
inc ecx
sar ecx, 0xdd
jns 0xcd7088
mov byte [edx - 0x2d], ch
loop 0xb22ea5
fnstenv [esi]
invalid
dec ecx
add ch, byte [ebx]
adc bl, byte [ebp - 0x1303d913]
lcall 0x903a, 0x12387353
sub dword [bx + si], edx
adc dl, byte [ebx + 0x136f1449]
retf 0xe2ce
iretd
cmp dword [edi + 0x57], ebp
ja 0xcd700b
push ecx
lea edi, [edi + ecx - 0x6f88a88d]
call fcn.00d210a3
dec esp
mov dword [esp + edi*2 - 0x7af6], edi
inc ebp
movsx ebx, ah
inc ecx
mov edi, 0x77168388
dec eax
sub ebx, dword [esp + edi - 0x3d7f]
xor dword [esp + edi*2 - 0x7af6], eax
dec esi
mov edi, dword [esp - 0x130]
dec edx
lea edx, [0x178f0021]
dec esp
xadd dword [esp + edi - 0x3d7f], esp
push edx
dec eax
arpl ax, ax
dec esp
adc esi, eax
inc ecx
mov eax, ecx
call fcn.007336ec
or al, 0x48
inc ebp
add eax, 0xf2eb471f
loopne 0xcd7076
das
retf 0xe0d6

Function at 0xb32f91
Capabilities:
Authenticate hmac

Disassembly:
dec edi
lea eax, [ebx + eax - 2]
dec esp
mov dword [esp + eax - 0x85c], ecx
push esi
inc ecx
xor dl, bh
dec edx
add dword [esp + ebx + 5], 0x6125148b
rol dword [esp + eax*2 - 0x10b6], 0x39
inc ecx
sbb esi, ebp
neg dl
dec eax
dec eax
dec edx
lea ebx, [0xdbbd800e]
dec eax
shr dword [esp + eax - 0x853], 0x51
inc ecx
sub dl, ch
xchg dword [esp + eax*8 - 0x42d4], esi
xor dl, 0x38
bt esi, eax
inc ecx
sbb dl, ch
dec eax
mov dword [esp + esi - 0x69f0], 0x90f3b00
div al
shr byte [esp + esi - 0x69ec], 0x85
inc esp
xor bh, dl
rol byte [esp + esi - 0x69e9], 0x64
inc sp
sbb ecx, ecx
dec eax
lea edx, [esp + edx + 0x18]
inc ecx
rol ch, 0x44
inc sp
mov ebx, dword [edx + esi*4 - 0x1a800]
shr al, 0x64
inc ecx
push edx
movzx edi, word [esp + esi - 0x69e8]
dec eax
lea ebp, [esi + ebp - 0x6a02]
inc bp
sub ecx, esp
inc ecx
sbb ecx, 0x6219ff32
inc sp
mov dword [ebp + esi - 0x6a00], ebx
inc ecx
neg esp
dec ecx
lea edx, [edx + esi*4 + 0x7ca6559f]
inc esp
adc edx, dword [esp + esi*2 - 0xd3fe]
inc ecx
pop ecx
inc ecx
pop ebx
pop eax
pop eax
jno fcn.00d9f1e9

Function at 0xb34b55
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov dword [esp + ebx*2 - 0x52c8324], ebp
mov ebp, ebx
dec bx
mov dword [esp + ebx - 0x2964193], edi
btc ebp, ebp
bswap ebx
jb 0xb8d37c
push esi
call fcn.007ebbe3
Function at 0xb34d0f
Capabilities:
Encode data using xor

Disassembly:
adc esi, ecx
movzx ecx, al
btr dx, 5
call fcn.00b7b275
bswap edx
lea eax, [eax + eax*2 - 0x5843d2e5]
btr ax, ax
btc ecx, eax
not edx
sbb ecx, eax
rol edx, 1
inc edx
xor cx, cx
jae 0xc2c6dc
dec ecx
xor edx, edx
movsx eax, dl
bswap ecx
not dl
xor ecx, 0xbb12fb09
cdq
xor ebx, ecx
add eax, eax
je 0x73b824
lea esp, [esp + 4]
call eax
mov edi, 0x40ae54a0
mov ebp, dword [ebp + edi - 0x40ae54a4]
mov ebx, edi
btc ebx, edi
shl edi, 0x24
mov dword [ebp + ebx - 0x40ae54a1], eax
movzx ecx, bl
movsx esi, bl
neg di
mov edi, ebp
jns 0xd395cb
lea esi, [esi*8 + 0x2a03c9a]
pop ebx
cmovb ecx, esi
pop ebp
sbb ecx, esi
lea eax, [ecx*2 - 0x27078ff]
movzx edx, ax
pop esi
sub cl, al
mul edx
sbb cx, cx
mov edx, dword [esi + edx - 0x85b5]
adc esi, 3
salc
add eax, dword [eax]
add byte [eax], al
xor edx, ebx
sub edx, ecx
btc cx, ax
btc eax, eax
jae 0x7de9f3
jle 0xb34dd2
scasd eax, dword es:[edi]
pop ebx
and byte [edi + 1], cl
adc dl, byte [edi - 0x54]
imul edx, esi, 0xffffffec
salc
sar byte [esi], cl
adc dl, byte [edx]
cmp dh, byte [edx]
cmp dl, byte fs:[edx]
jg 0xb34d69
pop ecx
inc ebp
adc edx, dword [ebx - 0x7d]
enter 0xffffffffffffafec, 0xffffffffffffffdc
test byte [edx + 0x58cdec6b], al
imul edi, dword [ecx + 0x12], 0xecfb1f2e
xchg dword [edx + 0x4ecd059], esp
rcl byte [eax], cl
jle 0xb34d4c
in eax, dx
mov ah, 0xb6
iretd
in al, dx
mov edx, dword [edx - 6]
adc dh, dh
wait
in eax, dx
push esp
pop esi
add dword [eax], eax
add byte [eax], al
dec edx
aad 0xf2
invalid
dec al
rol edx, 1
call fcn.007f29d4
sbb cl, byte [ecx]
mov ebp, 0x5cdfab32
adc ebx, dword [edx]
lcall 0x48e8, 0x13ffde4c
xor eax, 0x433eeded
outsd dx, dword [esi]
adc esi, dword [edi - 0x56]
add eax, 0xbfac1344
mov al, 0x22
pop es
adc dl, byte [edx + ebp*8]
pop ebx
adc ah, bl
clc
into
mov esp, gs
outsd dx, dword [esi]
pop esi
wait
dec eax
adc dh, bh
out dx, eax
mov dl, 0xc1
pushal
adc ch, byte [ecx + 0x131ffc84]
pop es
xchg edx, eax
in al, dx
cdq
rol byte [eax], 1
daa
xor esp, ebp
xchg sp, ax
int3
call fcn.00b4a508
mov ecx, 0xcb1a4d90
add edi, 2
add dl, al
dec cx
lea eax, [ecx + ecx*4 - 0x3f0ff6c]
mov word [edi], dx
mov edx, dword [ebp]
shr al, 0xc7
adc eax, 0xb79fb41b
shr ax, 0xa1
adc ebp, 4
bts ecx, eax
sub eax, eax
xor edx, ebx
neg edx
call fcn.00d44712

Function at 0xb4f208
Capabilities:
Execute syscall

Disassembly:
mov ecx, 0xcb939b0b
sal dword [esp], 0x55
sbb eax, 0x46b09595
mov word [esp + 2], 0x5cba
ror eax, 1
inc eax
neg ecx
dec ecx
shl ecx, 0x77
xor ebx, eax
not ecx
mov edx, dword [esp]
jmp 0xd05969
add ebp, edx
mov dword [esp + ecx*8 - 0x6bc681c0], 0x4bbb991b
or ax, cx
jo 0x80cf74
mov edx, dword [ecx + esi - 0xd78d038]
cwde
sal eax, 0xcb
call fcn.00be6bc2
sysenter
push 0xce2a478a
mov dword [esp], 0x9fdb647a
call fcn.00caf915
pop edx
push edx
xor ebx, eax
add word [esp], dx
adc ebp, eax
movzx ecx, dx
xchg word [esp + ecx*2 - 0xf034], cx
call fcn.00c9294f
mov ecx, dword fs:[eax + edx - 0x7c3f0006]
mov dword [ebp + edx - 0x7c3f0006], ecx
lea ecx, [edx - 0x1cdb67d7]
movzx eax, dx
mov dword [esp + edx - 0x7c3f0006], esi
ret 0x1c
add ebp, eax
call fcn.00bccbed
Function at 0xb505b7
Capabilities:
Encode data using xor

Disassembly:
or eax, dword [eax]
inc cx
and eax, ebp
inc ecx
xor edx, edi
dec edx
neg edx
dec edx
mov dword [esp + ebx - 0x4c04ad6a], esi
call fcn.00b89376
add dword [esi + 0x20], 0x9f2cbe90
dec ebx
jg 0xb50586
mov edi, 0x351a00b5
wait
push 0xffffffffffffffff
sbb edi, ebp
rcl byte [edi + edi*2]
cwde
or byte [edi], ah
cmp eax, 0xef58e37f
fiadd word [eax - 0x3277767d]
and byte [eax + 0x12], 0x74
sub bh, bh
invalid

Function at 0xb64809
Capabilities:
Authenticate hmac

Disassembly:
or ecx, 0xda820d80
call fcn.00d65536
or eax, edi
invalid

Function at 0xb6c159
Capabilities:
Encode data using xor

Disassembly:
xor bl, cl
mov dword [esp + eax - 0x53f4], ebp
xadd dl, ah
mov dword [esp + eax - 0x7efc], eax
mov dword [esp + eax - 0x7ef8], esi
sbb ax, dx
mov dword [esp + eax - 0x7f2d], eax
add al, 0x81
invalid
movsx ebp, word [esp + eax*4 - 0x1fcb0]
mov dword [esp + eax - 0x7f29], ebx
jg 0xb6f7b0
inc esi
or ecx, dword ss:[edx + 0x6a0283cb]
dec eax
or ch, byte [ebp - 0x5d]
sbb eax, 0x36edcd4a
cdq
in eax, 0xf5
sbb eax, 0x68b5b20a
xor al, 0x70
jle 0xb6c192
jne 0xb6c168
wait
wait
jne 0xb6c1d0
daa
mov al, byte [0x987f0ab5]
push ecx
push 0x2f
aam 0xa3
movsb byte es:[edi], byte [esi]
mov dh, 0x45
dec edx
aad 0xb5
cmp eax, 0xdfd655c5
test byte [ebp + 0x6c655f96], dh
insb byte es:[edi], dx
dec edx
js 0xb6c17d
sar dword [edx + 0x34f810f4], cl
ljmp 0xb8e2
mov ebp, edi
mov ebx, edx
sar dword [esp + eax*2 - 0xfe5a], 0xe
inc bx
mov ebx, ecx
and edx, 0x96a870ac
mov edx, ebx
ror eax, 0xee
neg ax
xchg byte [esp + 1], al
shl edx, 2
sub word [esp + 2], ax
shl word [esp], 0xe5
mov eax, ebp
sbb dword [esp], 0x51b519a5
add eax, edx
jmp 0x7d5deb

Function at 0xb6cbcd
Capabilities:
Encode data using xor

Disassembly:
call fcn.00bedd78
adc edi, 3
mov dword [esp], 0xfc931030
xor eax, ebx
inc eax
push 0x222bed21
jmp 0x76a23a
jp 0xcbb5ce
not ecx
inc ecx
shr byte [esp + edx*2 - 0x6f581a31], 0x42
rol byte [esp + edx*2 - 0x6f581a2f], 0xe6
pop eax
jp 0xb19c72

Function at 0xb6e1ee
Capabilities:
Authenticate hmac

Disassembly:
call fcn.00836229
mov eax, 0x4500adbf
movzx edx, byte [ebp + eax - 0x4500adbf]
lea ebp, [ebp + eax - 0x4500adbe]
xor dl, bl
mov ecx, eax
add ecx, 0x57017722
ror cx, cl
rol dl, 1
btc ecx, ecx
neg dl
jmp 0xcd3fbe