joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1bdbe51
Capabilities:
Encode data using base64

Disassembly:
call fcn.019cf8a3
xor ecx, ebx
mul eax
xor eax, edx
shl ax, 0xa7
lea ecx, [ecx + eax - 0x6bb9a497]
adc eax, 0xcc91802f
bswap ecx
dec ecx
imul edx, dword [esp + edx*2 - 0x6a5c88c0]
mov dword [esp], 0xb396753d
and word [esp + 1], dx
ror ecx, 2
ror byte [esp + 2], 0x42
neg dl
inc eax
xor ebx, ecx
sal byte [esp + 1], 0x85
adc edi, ecx
ror edx, 0x21
sar eax, 0x31
mov si, word [esi + edx - 0x4cc14180]
rol dx, 0xe3
mov byte [esp + edx - 0x4cc10c01], ah
pop ecx
js fcn.01ace843
add dl, 0xac
lea eax, [ecx + ecx*4 + 0x1a86a597]
not ax
neg dl
xadd cx, ax
adc ecx, eax
xchg cx, ax
not dl
shl eax, 0x7c
btc ax, 0x17
lea ecx, [eax + ecx*2 - 0x4f6f8bd0]
ror dl, 1
or eax, 0x909bfe3c
dec dl
rol dl, 1
xor al, ah
bts ax, 0xaf
inc dl
or ecx, eax
sete al
not ecx
xor bl, dl
sal ecx, cl
cbw
imul ax, cx
sbb ebp, 4
or cx, ax
bts ecx, eax
mov dword [ebp], edx
sar ax, 0x83
btr cx, 0x2f
bts ecx, ecx
mov edx, dword [esi]
dec cl
not al
shl ax, 0x41
adc esi, 4
shl eax, 0x45
xor edx, ebx
not edx
and ax, ax
sbb edx, 0x6da3e705
xor edx, 0xb98332a7
xadd eax, ecx
ror eax, 0xcf
inc edx
dec eax
not edx
shl ecx, 0x77
sbb edx, 0x81973883
xadd cx, ax
xor ebx, edx
cwde
xor eax, 0x62bf88be
shr cl, 0xa1
add edi, edx
jmp fcn.0251841a
dec ebp
lea esi, [ecx + 0x272704b1]
dec esi
mov edx, dword [esp + ecx - 0x30bbe898]
inc ebp
xor esi, esp
jo 0x1b16af4
dec eax
arpl cx, cx
dec eax
adc esi, ecx
inc ecx
mov ebx, 0x2e30ae32
dec edx
mov dword [esp + ebx*2 - 0x5c615c5c], 0x9836fd23
dec esi
mov ecx, dword [ebp + ecx*2 - 0x6177d140]
inc esp
add bl, al
inc edx
movzx edi, word [esp + ebx - 0x2e30aecb]
dec edx
mov dword [esp + ebx*2 - 0x5c615daa], edi
inc esi
mov dh, byte [ebp + ebx - 0x2e30aecd]
inc edx
mov ecx, dword [esp + ebx - 0x2e30aec9]
cwd
shr dl, 0xa2
dec eax
lea ebp, [ebp + edi*2 - 0x13062]
call fcn.01ca96de

Function at 0x1be2c5a
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx - 0x630499ab], ebp
ret 0xc
xadd byte [esp + edx*2 - 0x123ce11d], dl
xor bl, al
lea eax, [esp + eax + 0xc]
sub dl, dl
push edx
sar edx, 3
mov byte [edx + eax - 0x123ce00], cl
xor edx, 0x622757ab
jne 0x1328ff7
Function at 0x1bea04d
Capabilities:
Authenticate hmac

Disassembly:
bts edx, 0x8e
xor ebx, ecx
add edi, ecx
push edx
inc dword [esp + edx - 0x63d46ff9]
imul eax, eax
mov dword [esp + edx - 0x63d46ffd], edi
ret 4
mov dword [esp], 0x358e2197
div ecx
mov ecx, 0x7b974e19
shl dword [esp + ecx - 0x7b974e19], 0x5c
neg dword [esp + ecx - 0x7b974e19]
mov dword [ebp + ecx - 0x7b974e19], edx
lea edx, [ecx + ecx*2 - 0xef15bfd]
mov dword [edx + ebp - 0x63d48e4a], eax
xor dx, 0x3614
adc al, 0x36
lea eax, [edx*8 - 0x795294d8]
mov ecx, dword [esi + edx - 0x63d4b85a]
adc dword [esp + edx - 0x63d4b85a], 0x896950e
lea esi, [esi + edx - 0x63d4b856]
sar dword [esp + edx - 0x63d4b85a], 0xd0
not dx
xor ecx, ebx
xor ecx, 0x38097ca4
neg ecx
rol al, 0xa7
inc ecx
not ecx
or dx, ax
jae 0x13279ae
cmp bh, dh
fld st(0)
shl byte [edi + 0x66d1f741], 0xb
ror byte [edi], 1
and ebp, 0xffffffd8
jae 0x1bea0c8
inc dword [ebx + 0x15a92b18]
xchg ebx, eax
mov bh, byte [0x1a78c811]
sbb dword [eax], 0x2b
test eax, 0x3d8a9315
adc eax, ecx
js 0x1bea0ef
pop es
mov dl, 0xce
popfd
xor byte [edx - 0x40917b1e], 0x4c
push esp
jo 0x1bea082
mov eax, 0x19290757
ljmp 0x1aa5
dec edi
rcl byte [ebx + 0x4a], cl
mov edx, 0x5f39d11f
add eax, dword [edi]
cli
fimul dword [eax + 0x3b295db5]
movsb byte es:[edi], byte [esi]
xchg esp, eax
dec eax
fldenv [ebx + 0x64eecf27]
pop eax
loop 0x1bea0b7
inc eax
xor dword [ecx], esi
invalid
Function at 0x1bedd64
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
btr ax, ax
lea edi, [edi + edx*8 - 0x324ca254]
mov eax, dword [edi + edx - 0x649944a]
dec edx
dec edx
sar ecx, 0xe8
xor eax, ebx
bts ecx, edx
xor eax, 0xa4b59c86
inc eax
btr ecx, ecx
neg eax
bt ecx, ecx
inc eax
xor ebx, eax
sal dl, 0xa4
shr ecx, cl
sbb cx, cx
add esi, eax
jmp 0x137409f
rol edx, 0x5f
lea edx, [edx*8 - 0x775fa36c]
jae fcn.01b51770
test eax, eax
lea esp, [esp + 0xc]
je 0x195bdd2
call fcn.01d58b77
mov eax, 0xde0a868c
movzx ecx, al
mov ecx, dword [ecx + edi - 0x8c]
lea eax, [eax*4 - 0x57438de7]
mov eax, dword [eax + edi - 0x20e68c45]
push 0x7980be3e
sar byte [esp], 3
adc edi, 3
xor edx, edx
call fcn.01954e05
mov edi, dword [edi*4 + 0x2510478]
call fcn.01a0fdde
mov ecx, 0x800ae805
mov eax, dword [edi]
xadd ecx, edx
or dl, dl
sub edx, edx
xor eax, ebx
lea eax, [edx + eax + 0x6d94e330]
rol eax, 1
rol ecx, 0x45
xor eax, 0x920d22b7
inc cl
or cx, 0x238e
not eax
inc edx
shl dl, 0x42
lea eax, [eax + edx*2 - 0x17b74e21]
jae 0x1c1bfa2
dec ebp
lea edx, [ecx - 0x55eab0f3]
inc ecx
pop edx
dec ecx
shl ebx, cl
dec ecx
shl ecx, cl
dec esi
lea ebx, [0x81118b39]
dec eax
arpl dx, dx
dec eax
adc esi, edx
inc ecx
shl ecx, cl
inc ecx
movsx ebx, ax
inc ecx
movzx edx, ah
dec esp
xor eax, esi
inc ecx
jmp eax
movzx edi, byte [edx]
push 0xa054b80
xor edi, eax
push 0x91282091
sal word [esp + 5], 0x24
and edi, 0xff
inc dword [esp + 4]
jno 0x137aa25
lea esp, [esp + 0x18]
jne 0x19439c6
mov edi, 0x27328abb
call fcn.013ae053
sub edi, 4
mov edx, 0xe6b9c787
jmp 0x138fa97
rol cl, 0xe5
sar cx, 0x43
ror eax, 1
lea edx, [edx*2 + 0x4f8e502a]
xor ebx, eax
inc cl
jnp 0x251e2f2
bswap ecx
lea ebp, [ecx + ebp - 0x7ffe95dc]
rol edx, 0xb5
shl ecx, 0xa4
sub dx, cx
mov dword [ebp + edx - 0x649944a], eax
lea eax, [ecx + edx*4 - 0x3f596364]
ja 0x12eab52
Function at 0x1c0d01a
Capabilities:
Execute syscall

Disassembly:
inc cx
or edx, ebp
inc ecx
add esp, 0xcb131830
pop edx
pop edx
pop ebx
jbe fcn.019f821c
syscall
inc ecx
push eax
pushfd
dec ecx
mov eax, 0x18056881
mov ah, 0x85
pop ss
bound esp, qword [esi + 0x41]
test eax, 0x8b4c793b
inc esp
and al, 8
dec eax
mov dword [esp + 8], 0x7a44090d
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.0130e575
ror eax, 3
dec esi
mov dword [esp + esi - 0x5f9367b7], edx
inc ecx
push eax
inc edx
not dword [esp + esi - 0x5f9367b3]
dec edx
not dword [esp + esi - 0x5f9367b7]
xor dword [esp + edx - 0x5f9367af], eax
dec ecx
not ecx
dec esp
mov edx, dword [esp + edx - 0x5f9367af]
ror word [esp + edx - 0x5f9367b4], 0xab
dec esi
lea ebp, [ecx - 0x24f869d3]
dec eax
arpl ax, ax
inc ebp
xchg ch, bl
dec edx
mov dword [esp + ecx*8 + 0x7f8f0], 0x21af3108
dec eax
adc esi, eax
sub word [esp + edx - 0x5f9367af], 0x269d
dec eax
mov dword [esp + edx - 0x5f9367b7], esi
ret 8

Function at 0x1c1579d
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Parse pe header

Disassembly:
cwde
mov dword [esp + 4], edi
sar eax, 0xe2
mov dword [esp], ebx
call fcn.013ac21e
lea esi, [esi + eax*4 - 0xf310]
btc ax, 0x95
adc word [esp + eax*2 - 0x79c4], ax
xadd word [esp + eax*2 - 0x79c6], ax
mov dword [esi + eax*2 - 0xea7a], ecx
cbw
movzx ecx, ax
pop edx
jne fcn.01d34515
movsx edx, al
mov dl, byte [edx + ebp - 0x7f]
xor dl, bl
dec eax
shr ax, 0x22
bts eax, eax
inc dl
pop eax
xor dl, 0x29
mov eax, dword [esp]
rol ax, 0xce
push eax
ror dl, 1
bts eax, eax
add al, al
shl word [esp], 0xc
not dl
lea eax, [eax + eax - 0x1f45b3e7]
xor bl, dl
neg word [esp + eax - 0x3975a8d4]
shr eax, 0xcd
ror dword [esp + eax - 0x1cbad], 0xc
mov dword [esp + eax*4 - 0x72eac], ebp
movsx ebp, ax
ja 0x13a2ac2

Function at 0x1c199e8
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xcc9e4255
call fcn.01d529e2
Function at 0x1c3c702
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
je 0x1bf4868

Function at 0x1c4d28b
Capabilities:
Encode data using base64

Disassembly:
rol ax, 5
bswap ecx
btr eax, eax
mov dword [esp + eax*2 - 0x42df85a8], 0xb816941e
xor ecx, 0xfd109211
movzx edx, al
inc ecx
pop edx
xor ecx, 0x2e015f03
ror edx, 0x2b
neg ecx
call fcn.01a88ba7

Function at 0x1c5375c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [edx + ebp - 0x32c169df]
xor al, 0xa
or eax, edx
and dword [esp + edx*2 - 0x6582d3be], eax
xor ecx, ebx
rol eax, 0xae
rol ecx, 1
cbw
not ecx
not ax
call fcn.013a6143
mov byte [esp + ecx - 0x1a68d6], 0x12
inc ecx
ror ecx, 3
call fcn.012ed198
mov edx, 0x65a54892
call fcn.01ae4607
jmp 0x13ae03b
lea esp, [esp + 4]
jne 0x1aa210f
lea edx, [eax + eax*2 + 0x6fba2635]
mov word [edx + esi - 0x32c169df], cx
mov dword [esp + edx*2 - 0x6582d3be], edx
ror dword [esp + edx*2 - 0x6582d3be], 0xc8
bt eax, 0x18
lea ebp, [ebp + edx*2 - 0x6582d3c2]
mov ecx, eax
ror eax, 0x3a
jb 0x139b4cb
lea edx, [ecx + edx - 0x618ae37]
call fcn.01cf1dd7
xor byte [ebp + 0x7f3f1369], 0x42
pushfd
jae 0x1c53797
bound ebp, qword [eax + 0x70]
xchg byte [eax + 0x20c5f740], cl
mov ebp, 0xce3d7561
xor esi, 0xffffff9a
popfd
sahf
and byte [edx], cl
shl dword [eax], cl
jnp 0x1c537e7
pop eax
xchg edx, eax
fsub qword [eax - 0x364c8b72]
xor byte [esi + 0x196fe8f7], cl
test eax, 0xb0677af7
and al, 0xe5
iretd
jns 0x1c537c1
iretd
Function at 0x1c640ff
Capabilities:
Encode data using xor

Disassembly:
mov dword [eax + ecx*8], edx
jae 0x1d527a7
sbb ecx, 0xc6aaa819
ror ecx, 1
inc ecx
neg ecx
imul eax, edx
adc ecx, 0xa881c414
imul edx
sub eax, eax
xor ecx, 0x93357315
rol eax, 0xa7
xor ebx, ecx
add dx, dx
push eax
adc edi, ecx
mov ecx, dword [edx + ebp]
btc edx, 0x9f
neg eax
lea ebp, [ebp + eax + 4]
or dword [esp + eax], ecx
popfd
mul al
sub dl, al
ja 0x1b5c139
adc eax, edi
jmp eax
dec eax
mov dword [esp + ecx - 0x3f3a0007], 0xde911688
dec esp
mov edx, dword [esp + ecx - 0x3f39ffff]
dec ebp
arpl ax, ax
mov edi, ecx
div word [esp + edx*2 + 6]
movzx ebx, cx
dec ecx
add esi, eax
dec eax
mov dword [esp + ecx - 0x3f39ffff], ebx
inc ebp
movsx eax, dh
dec eax
mov ebp, dword [ebp + edx - 0xf4d]
dec esi
lea ebx, [0x3488dab7]
inc esp
movsx ebp, word [esp + ecx*2 - 0x7e740009]
inc cx
sub ebx, 0x5b41239d
inc ecx
pop esi
jno fcn.019f821c
jmp 0x1ca973a
mov ecx, dword [esi]
mov eax, 0xc79a6e31
sar eax, 0xf5
adc esi, 3
rol al, 0xe7
cwde
xor ecx, ebx
mov edx, eax
rol ecx, 3
imul eax
jb 0x24f4d66
bswap ecx
and edx, 0xfa2b03c
jns 0x1bd5153
mov eax, 0xf033b7be
mov edx, eax
mov edx, dword [edi]
bts eax, eax
imul eax, eax
adc edi, 3
lea eax, [eax*4 + 0x7aa2d58d]
lea ebp, [ebp + eax - 0x60f7999e]
movzx eax, byte [eax + ebp - 0x60f7999d]
mov ecx, 0x979c6b2b
rol ecx, 0x52
xor al, bl
not ecx
xor ecx, ecx
xor al, 0x39
xor cl, 0x22
rol al, 1
not al
rol al, 1
shl cx, 0xeb
xor bl, al
add eax, esp
and cl, 0xaa
sbb cx, cx
jae 0x19e93f6
mul dx
xor al, byte [eax + ebp + 4]
jmp 0x1cae67c
neg dx
adc ebp, 6
btc edx, 0xa6
and dx, dx
rol dx, 0x85
mov byte [ecx], al
jmp edi
mov eax, ecx
lea ebp, [ebp + ecx - 4]
setl al
ror cx, 0xe8
adc ecx, dword [ecx + ebp]
movzx edx, ax
btc eax, 0xd
jb 0x1cabce8
xor ecx, ebx
rol ecx, 1
cwd
btr eax, edx
xadd dl, ah
inc ecx
neg edx
xor ecx, 0xc7bc643b
push edx
lea ecx, [eax + ecx + 0xaa1b927]
not edx
ror al, 0xc6
inc dl
ror ecx, 3
xor ebx, ecx
and ax, ax
bswap edx
sar dword [esp + eax], 0x39
add esi, ecx
mov dword [esp + eax], esi
ret
or dword [esp], edx
setns byte [esp]
dec dword [esp]
xor ebx, eax
add edi, eax
sal edx, 0xe7
sbb word [esp + 2], cx
call fcn.012fcf02
Function at 0x1c90af4
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
dec esp
mov edi, dword [esp + 0x78]
dec eax
mov eax, dword [esp + 0x80]
call fcn.01cb5355
push 0x718dc2b9
lea esp, [esp + 0xc]
call eax
call fcn.01d22bf6
dec eax
mov esp, ebp
inc ecx
pop esp
dec ebx
lea ebx, [ebx + ebp*8 - 0x6c560feb]
push ebx
dec esp
mov ebx, dword [esp + 8]
push dword [esp + 0x10]
popfd
dec ebp
lea edx, [ebp + ebx*4 + 0x8b12d15]
inc ecx
push edx
inc ecx
push edx
dec esp
mov ebp, dword [esp + 0x28]
dec eax
mov esi, dword [esp + 0x30]
dec eax
mov edx, dword [esp + 0x38]
dec esp
mov ecx, dword [esp + 0x40]
dec esp
mov esi, dword [esp + 0x48]
pop ebp
inc ecx
push edx
dec eax
mov ecx, dword [esp + 0x50]
bswap ebx
push ebx
dec esp
mov edx, dword [esp + ebx - 0x5defd8f5]
dec eax
mov dword [esp + ebx - 0x5defd91d], ebp
dec eax
mov edi, dword [esp + ebx - 0x5defd8ed]
dec eax
mov ebx, dword [esp + ebx - 0x5defd8e5]
jmp 0x1b14dcd

Function at 0x1c93936
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, esi
call fcn.024ff3f8
shr al, 0xc1
shl cx, cl
shl ax, 9
not dx
imul ax, ax
bts ax, ax
setae al
sbb dx, ax
lea ecx, [eax*2 + 0x799ceb85]
xor dx, 0x7f01
push eax
not eax
rol ecx, cl
ror dx, 1
xor bx, dx
pop ecx
jmp 0x1c7c992
xchg cx, ax
lea esi, [esi + eax - 0x7bdb0005]
cwde
call fcn.01ba192d
lea ecx, [edx*2 - 0x5ded6d45]
movzx edx, byte [edx + ebp - 0xe85a9f4]
xor dl, bl
cwde
inc cx
ror dl, 1
add ax, cx
bt cx, cx
cmovae eax, ecx
not dl
rol dl, 1
cbw
inc dl
inc ecx
lea ecx, [eax + ecx + 0x161ef92c]
sal cx, 0xcd
xor dl, 0x2d
shl cl, 0x65
adc eax, ecx
btc eax, ecx
xor bl, dl
jmp 0x1c9baa6
mov dword [esp + 4], 0x43124585
mov esi, dword [esi*4 + 0x1d04fc8]
jb 0x195200e
shr ecx, 8
push 0x47b241af
jmp 0x1930536
lea esi, [esi + eax - 0x53789fa7]
jmp 0x136120d

Function at 0x1c9b4b3
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
ja 0x1a5a00e
mov edx, esp
call fcn.01b27d13
mov edx, eax
movzx edx, byte [ebp + eax - 0x46bb9e3d]
xor dl, bl
inc cl
rol dl, 1
shr ax, 0x8b
call fcn.01a60bda

Function at 0x1cd9508
Capabilities:
Encode data using base64

Disassembly:
push 0x868ee639
dec eax
push 0xc331013d
push 0xf18d7ad
push 0xb2acd41f
lea esp, [esp + 0x28]
jne 0x1364504
mov eax, 0x1b17103c
pop edi
Function at 0x1cf2edd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor ecx, ebx
or dword [esp], 0x7b21a227
pop edx
add edx, edx
dec ecx
movzx eax, dx
rol ecx, 1
cwd
neg ecx
bts edx, 0x36
not ecx
call fcn.01d04463
bt ecx, eax
lea ebp, [ecx + ebp - 0x65500001]
bt cx, ax
movzx ecx, byte [ebp + ecx - 0x65500000]
lea eax, [eax + eax + 0x893598d]
bts eax, eax
add eax, eax
xor cl, bl
inc cl
shr ax, 0xe8
or eax, eax
rol cl, 1
sar ax, 0xb
btc eax, eax
setb al
xor cl, 0x34
lea eax, [eax + eax*8 - 0x777b78]
add cl, 0xa5
lea eax, [eax - 0x1d4c7ea]
xor bl, cl
cbw
add al, 2
adc ecx, esp
dec al
sub eax, 0x739d3b19
idiv al
mov byte [ecx], dl
mov ecx, 0x2aadd00b
push eax
jmp 0x19cc2e5
adc esi, 3
add byte [esp + 3], 0x16
js 0x131e5a0
dec eax
mov dword [esp + edx - 0x11d70a48], 0x1422673b
jo 0x1c340d1
inc cx
mov dword [ebx + ecx*4 - 0x2dbf8], ebx
add dword [esp + ecx*4 - 0x2dbf8], 0x500dda0
dec eax
mov dword [esp + ecx - 0xb6fe], esi
ret
dec ebp
arpl sp, sp
sar cl, 0x66
dec ecx
adc esi, esp
or dx, bx
dec ecx
div ebx
dec esp
mov ebx, dword [ebp + ecx - 0xb6fe]
inc cx
mul ecx
mov bx, word [ebp + ecx*2 - 0x16df4]
dec eax
lea ebp, [ecx + ebp - 0xb6f4]
jb 0x193e2ce
mov eax, 0xf98ca317
movsx edx, al
sal dx, 0xcb
lea esi, [esi + edx*2 - 0x17004]
mov ecx, eax
js 0x1d4a89c
not byte [esp]
shrd eax, edx, cl
mov ecx, 0x1fae2f16
rol ecx, cl
mov dword [ebp], eax
mov ecx, dword [esi]
jb 0x1328baf
Function at 0x1d06341
Capabilities:
Encode data using xor

Disassembly:
call fcn.01b9c3f9
push 0x33
xchg byte gs:[ecx - 0x3f], ah
cwde
push edx
out 1, al
pop eax
pop ebp
xor esp, dword [ebp - 0x7a]
popal
rcr dword [eax + 0x5801e652], 0x5d
cwde
fadd qword [edx]
xor al, 0xed
mov esi, 0x5e1c8892
cmp ah, byte [esi + 0x78]
fdiv qword [eax + 0x76f66015]
scasb al, byte es:[edi]
mov eax, 0xda2fae8c
enter 0x50, 0xffffffffffffffdc
aaa
mov al, byte [0xd6591e6e]
push ds
pop ecx
salc
dec esp
xchg esi, eax
shr al, 1
inc edx
ja 0x1d06347
fisttp dword [edi]
pop bp
sbb al, 0xa7
push 0xffffffffffffffde
xor bl, byte [edx + 0x62dc620f]
je 0x1d063ec
scasd eax, dword es:[edi]
inc esi
mov al, byte [0x28fa3e00]
pop edx
mov al, byte [0xb0960]
or eax, dword [eax]
dec eax
mov cl, 0xd6
invalid
pop ds
mov byte [0x1d34829d], al
push esp
mov ebp, 0x7082f9e
pop ebp
popfd
or dword [edx + 0x1c2c107], edi
fcomp dword [ecx + eax + 0x49]
xor eax, 0x4976e0eb
mov cl, 0x1c
cmpsd dword [esi], dword es:[edi]
jg 0x1d06373
inc edx
and edx, edi
mov ch, 0x4d
xor esp, edi
out dx, eax
or eax, 0x42813b4
mov cs, esi
out dx, al
or esi, 0xbbe8cdb4
salc
pop ebp
outsb dx, byte [esi]
test byte [eax], cl
push edx
test eax, 0xe67cdedc
jge 0x1d06398
dec esi
xabort 0xffffffffffffffd0
inc ebx
push ds
rol byte [ebx + 0x1e], 1
jns 0x1d063a3
pop es
aam 0xfa
push eax
popal
enter 0xffffffffffff88a1, 0xffffffffffffff89
inc dword [ebp + ecx - 0x6b088954]
loop 0x1d06441
dec edx
jne 0x1d0646f
add al, 0x2b
push edx
jae 0x1d06454
ja 0x1d0647c
and byte [esi + ebx*2 + 0x30], ah
jno 0x1d063c6
xor byte [ecx], cl
aaa
pop ebp
cdq
mov al, byte [0x118ab6e8]
int1
out 0xe6, eax
call dword [ecx + eax - 0x16]
jne 0x1d06452
inc eax
shl al, 0xd9
xchg edi, eax
add bl, cl
loop 0x1d0648d
mov bh, 0x1c
sal bh, 1
or eax, 0x15f662df
pop ecx
inc ebx
cmp eax, 0x7fa386fe
retf
adc al, 0x27
popal
fisub dword [ecx + 0x5f1b68f4]
outsd dx, dword [esi]
lcall 0xc63a, 0x20b9d76
adc al, 0x93
rcl byte [eax]
pop ebp
jmp 0x1d064b2
fcomp st(0)
cli
cmc
add al, 0x5e
mov ebp, 0x3620af7
iretd
add dword [eax - 0x3d], eax
mov al, 0xd4
mov al, byte [0xa6deb10e]
jmp dword [edx]
fcomp qword [edx - 0x67fcf52e]
mov ebp, 0xa8a92482
retf 0xbf18
idiv dword [edx - 0x3d]
mov al, 0x3b
sub eax, 0x2ee4ee0a
dec edx
stosd dword es:[edi], eax
fucomi st(5)
std
out dx, eax
jle 0x1d06528
push 0xedc99b45
push ds
out dx, al
jne 0x1d064d9
sbb dword [ebx], ecx
push ss
jge 0x1d064c2
xchg esi, eax
leave
int1
invalid
mov dh, 0x2d
jo 0x1d064dd
xchg ch, cl
test eax, 0x1b930d72
mov al, 0xd3
cmp eax, 0x9b251161
invalid
push esi
xchg ebp, eax
sbb ecx, dword [ebx - 0x55]
dec ebx
stosd dword es:[edi], eax
pop ds
leave
popal
shl byte [edx - 0x3c], cl
mov eax, dword [0x16de7a9]
sbb edi, ebx
xchg dword [edi + ebp*8], edi
inc esi
fst dword [ecx]
jo 0x1d0656a
jno 0x1d0652b
iretd
adc al, 6
fcmove st(0), st(0)
adc eax, 0x3b8a0606
mov dword [0xb1d82c00], eax
pop ecx
pop esp
fild dword [ebx - 0x615c6ffb]
sub cl, al
stc
wait
in al, 0xeb
pop esi
adc dword [esi], esp
imul ebp, dword [eax - 0x7c], 0xe3a3b35c
rcr dword [edi - 0x74], cl
mov ebx, 0x47c8dba0
push edx
cmp esp, 0xada82b61
ret 0xa9b5
Function at 0x1d1bf0a
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute syscall
Hash data using murmur3

Disassembly:
dec dl
adc esi, 1
dec byte [esp + 3]
ror dl, 0x85
xadd dl, dh
xor cl, bl
rol edx, 0xed
dec cl
not dword [esp]
xor cl, 0x39
rol byte [esp + 2], 0x44
setb dl
add cl, dl
not dl
pop edx
xor cl, 0xb1
inc edx
jno 0x1d70125
mov ecx, 0x6926b817
mov dx, word [ebp + ecx - 0x6926b817]
mov cl, byte [ebp + ecx - 0x6926b815]
mov eax, 0xbb9b289c
add ebp, 2
imul ax, ax
shl dx, cl
inc eax
bswap eax
movzx ecx, ax
mov word [eax + ebp - 0x111f9bbb], dx
shr ecx, cl
lea edi, [edi + eax - 0x111f9bbf]
jnp 0x13ac306
bts cx, 0x35
mov edx, dword [edi + ecx - 0x20]
call fcn.0137f77c
mov edx, 0x9d33e9ae
lea eax, [edx*2 + 0x2b00840d]
mul edx
mov dx, word [edi + edx*2 - 0x7c8b1bea]
movzx ecx, al
sar al, 0xc7
ja 0x1a97409
lea edi, [edi + ecx*8 - 0x2ee]
call fcn.012f6e63
mov eax, dword [ebp + ecx*8 - 0x58000]
sub dx, cx
shl ecx, 0xb3
mov edx, dword [ebp + ecx - 0x7ffffffc]
call fcn.01c39611
mov eax, 0x29a36686
mov eax, dword [esi + eax - 0x29a36686]
mov ecx, 0xaa835f1e
rol ecx, 0xda
add ecx, ecx
mov ecx, dword [esi + 4]
mov edx, 0xe2cc402
js 0x1af77c8
setae dl
lea esi, [esi + edx*2 - 0x1c5987fa]
dec edx
mov dword [eax + edx*8 - 0x71662000], ecx
movsx ecx, dx
lea ebp, [ebp + edx*2 - 0x1c598804]
mov eax, dword [edx + ebp - 0xe2cc400]
dec dx
xor eax, ebx
lea ecx, [edx + ecx + 0x169f181b]
neg eax
bswap ecx
bswap eax
jmp 0x1b31edd
not dx
add edi, eax
mov dword [esp], 0x3d296fbd
mov ax, word [ebp]
bts dx, 0x89
and dx, cx
inc ecx
adc ebp, 2
bts edx, edx
add edx, edx
xor ecx, 0x48b9b0be
movzx ecx, byte [esi]
js 0x19bd6b3
btr dx, dx
dec cl
shr edx, 0xe1
jns 0x1965c41

Function at 0x1d29e90
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub dl, dh
dec eax
not edx
call fcn.01cfc74a
jmp 0x1d54d8b
push edx
mov ecx, dword [esi + ecx*2 - 0x4950d702]
xor ecx, ebx
call fcn.01b44b7c
mov ecx, 0x2a06d087
mov edx, dword [ecx + esi - 0x2a06d087]
mov eax, dword [ecx + esi - 0x2a06d083]
dec cx
not ecx
mov cl, byte [esi + 8]
call fcn.01d6febe
mov ecx, 0xdd239907
sub ebp, 4
mov edx, dword [ebp]
lea ecx, [ecx + ecx*2 - 0x315c9b53]
mov eax, ecx
shl ecx, cl
xor edx, ebx
bswap edx
xor edx, 0xa6932699
or eax, eax
adc ax, cx
jg 0x1a076d3
inc edx
rol edx, 1
ror ecx, cl
bts cx, 0xb3
xor edx, 0x21b9f407
bswap eax
rol cx, 0x4b
ror cl, 7
xor ebx, edx
sub cl, 0x2a
js 0x2541159
adc edi, edx
movzx edx, ax
xor cl, cl
jbe 0x1d726bf
mov eax, dword [ebp]
mov ecx, 0x2282ce03
movsx edx, cl
rol edx, cl
mov dx, word [ebp + edx*8 - 0xbc]
setb cl
neg cx
lea ebp, [ebp + ecx*2 - 0x450463fa]
or ecx, 0x3f35e8bb
and cx, cx
mov word [eax + ecx - 0x3fb7fabb], dx
setno cl
mov eax, dword [esi + ecx*2 - 0x7f6ff402]
movsx edx, cl
lea esi, [esi + ecx*2 - 0x7f6ff3fe]
neg edx
dec edx
xor ecx, 0xc42f6523
xor eax, ebx
bswap edx
jmp 0x12affb9
xor ebx, ecx
call fcn.01c03c6b
adc ebp, edx
movsx edx, cx
add eax, ebp
jmp eax
mov ax, word [ecx + esi - 0x898f900]
adc cl, dh
sal edx, cl
mov dx, word [esi + ecx - 0x898f90c]
xchg ch, cl
lea ecx, [ecx + ecx*4 + 0x67b02e81]
mov cl, byte [esi + 4]
call fcn.019ad1a2
Function at 0x1d4b048
Capabilities:
Encode data using xor

Disassembly:
xor ecx, 0xb09773a7
inc edx
shr dword [esp + ecx - 0x7420], 0x87
dec esi
adc dword [esp + ecx - 0x7420], edx
inc ecx
push esi
inc ecx
xor ebp, 0x320738af
dec eax
cdq
inc edx
xor dword [esp + ecx - 0x7418], ecx
dec edx
mov dword [esp + ecx - 0x7420], 0xa8324f38
inc edx
mov dword [esp + ecx - 0x7426], 0xc22ccb3c
inc edx
movsx ebx, byte [esp + ecx*2 - 0xe848]
dec esi
mov edx, dword [esp + ecx*2 - 0xe840]
inc cx
not esi
dec eax
arpl cx, cx
inc si
or esp, dword [esp + ecx*2 - 0xe84b]
dec eax
adc esi, ecx
call fcn.0195fb75

Function at 0x1d5aa5d
Capabilities:
Execute syscall

Disassembly:
xor edx, esi
jmp 0x251ed28
dec word [esp + 7]
rol word [esp + 4], 0xa3
inc eax
push 0xbc15988f
and dword [esp], 0xa29d5db0
xor edx, 0x3e82f58c
dec ecx
push 0x89a7df0c
call fcn.0254f501

Function at 0x1d5c322
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jbe 0x193af76
push ebx
lea ebx, [ecx + eax]
or al, 0xbb
xadd eax, eax
push edi
bt eax, 3
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov esi, ebp
mov ecx, 0x3ea72b85
pop ebx
movzx edx, cx
shl edx, 0xc1
push edx
mov edi, dword [esp + ecx - 0x3ea72b81]
call fcn.02506682
cmp dword [ebp + 0xc], esi
jmp 0x1c76ba7

Function at 0x24ee53d
Capabilities:
Execute syscall

Disassembly:
neg dx
call fcn.01be7a9e
mov eax, 0xdc945e0e
ror eax, 0x7c
mov eax, dword [edi]
mov edx, dword [edi + 4]
adc edi, 3
jmp 0x1954e30