joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a1d8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fa35]
fstp qword [ebp - 0x14]
push 0x3fc00000
fld qword [ebp - 0x14]
call fcn.1000117d
push eax
call fcn.100025b8
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fa3d]
fstp qword [ebp - 0x14]
push 0x3fd9999a
fld qword [ebp - 0x14]
call fcn.1000117d
push eax
call fcn.100025b8
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fa45]
fstp qword [ebp - 0x14]
fild dword [0x10030337]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x1002fa35]
fstp qword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
fld qword [ebp - 0x24]
call fcn.1000117d
push eax
fld qword [ebp - 0x14]
call fcn.1000117d
push eax
call fcn.100023ec
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fa4d]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x1000ac00
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100304cb
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100304c7
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100304cb]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000a313
push 0x186
push 0x401349e
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1000ac0c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fa75]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x1000ae55
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100304d3
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100304cf
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100304d3]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000acaa
push 0x7b
push 0x401268c
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1000b47c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fb37]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fb3f]
fstp qword [ebp - 0x14]
push 5
fld qword [ebp - 0x14]
call fcn.1000117d
push eax
call fcn.10001c94
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [0x100304d7]
test ebx, ebx
je 0x1000b4ee
push ebx
call fcn.1001084d
add esp, 4
pop eax
mov dword [0x100304d7], eax
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000b536
push 0x96
push 0x4013454
push 6
call fcn.10010853
add esp, 0xc
push 0x1000b75f
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100304df
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100304db
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100304df]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000b5a4
push 0x109
push 0x4013454
push 6
call fcn.10010853
add esp, 0xc
fild dword [0x1003033b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fb47]
fstp qword [ebp - 0x14]
mov eax, 0x1002fb4f
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
fld qword [ebp - 0x14]
call fcn.1000117d
push eax
call fcn.10005253
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1000b5e3
push ebx
call fcn.1001084d
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x1000b76b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fb73]
fstp qword [ebp - 0x14]
mov eax, 0x1002fb7b
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
fld qword [ebp - 0x14]
call fcn.1000117d
push eax
call fcn.1000386f
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1000b7ba
push ebx
call fcn.1001084d
add esp, 4
fild dword [0x10030337]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fb8b]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x1000b9fa
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100304e7
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100304e3
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100304e7]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000b848
push 0x12e
push 0x40134cf
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1000cc38
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030347]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002fdcb]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x1000db6a
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x100304f3
push dword [ebp - 8]
push dword [ebp - 4]
push 0x100304ef
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x100304f3]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000ccd6
push 0x7b
push 0x401686d
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1001039d
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.100058ad
xor ecx, ecx
push eax
lea eax, [ebp - 4]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x100104ce
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.10002870
push ebx
push ecx
mov eax, dword [ebp - 4]
dec eax
jns 0x100103f7
push 0x34
push 0x4016e2b
push 4
call fcn.10010853
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x10010414
push 0x34
push 0x4016e2b
push 1
call fcn.10010853
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp - 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1001044a
push 0x34
push 0x4016e2b
push 6
call fcn.10010853
add esp, 0xc
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.10002870
push ebx
push ecx
mov eax, dword [ebp - 4]
dec eax
jns 0x10010473
push 0x55
push 0x4016e2b
push 4
call fcn.10010853
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x10010490
push 0x55
push 0x4016e2b
push 1
call fcn.10010853
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp - 8]
push dword [ebx]
xor eax, eax
call dword [0x1003051f]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100104c6
push 0x55
push 0x4016e2b
push 6
call fcn.10010853
add esp, 0xc
pop eax
pop ebx
pop ecx
jmp 0x100103c0
add esp, 0xc
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.1001084d
add esp, 4
mov eax, 0x1002f3ea
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10011d90
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10011df9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.10010b10
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x100137a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x10013806
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x10013806
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x100137e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x10013b90
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x10013bc8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x100148b0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
jne 0x100148f9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x10014d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10029970
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.10014920
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.100149a0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.100149a0
lea ecx, [esi + 0xc]
call fcn.100233c4
lea ecx, [esi + 0x10]
call fcn.100233c4
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.10015f40
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.10015f40
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.10015f40
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.10023439
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10023439
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4944204
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x14dc5ff2
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0xfd24d6
Capabilities:
Encode data using base64

Disassembly:
adc al, 0x9c
btr edx, 9
xor dword [esp + 4], 0x373c069b
adc dword [esp + 4], edx
rol al, 1
add al, 0xaa
xor al, 0x32
lea edx, [edx*4 - 0x4cdb8bcf]
sub edx, 0xd2ac8214
dec al
and dx, dx
add edx, 0xdb18e61e
xor bl, al
and word [esp + 6], 0x1f9b
xchg word [esp + 5], dx
mov dword [esp], edx
mov dword [esp + 4], edi
jge 0x100216a
lea edx, [eax + edx - 0x2deb4980]
imul eax, eax
sal ecx, cl
inc ax
xor edx, 0xbbbff8b2
dec cx
neg edx
sub edx, 0x90312e03
cwde
imul ecx, ecx
setno al
not edx
and eax, eax
dec ecx
xor ebx, edx
btr eax, eax
adc esi, edx
jmp 0x1aa32eb
mov dword [esp], esi
sar edx, 0x4f
push edx
xchg dword [esp], edx
mov dword [esp], ebx
mov ebx, eax
movzx eax, dl
mov edx, ebx
setbe al
shl edx, 2
sar eax, 0xa6
sal al, 0x41
lea eax, [eax*2 - 0x7d590652]
mov eax, ebp
push 0x9da14906
push 0x83266a00
rol dword [esp + 4], 0x45
add eax, edx
neg dword [esp + 3]
call fcn.019d79d7
pop ebp
mov ebp, dword [esp + ebp*4 - 0x5401ded4]
mov ebx, dword [esp + 0x18]
jmp 0x1a70a42
lea esp, [esp + 0x1c]
ret
mov ax, word [ebp + 2]
adc ebp, 1
or cx, ax
mov edx, 0x4ead1e94
not cx
bswap edx
sal edx, 1
mov word [ebp + edx*2 - 0x507ab538], cx
movzx ecx, dl
jmp esi
jmp 0x19cc0b6
sub cl, ch
setb cl
mov cx, word [ecx + ebp - 0x80e8001]
js 0x1a6122e
not dl
rol eax, 0x62
neg eax
not ax
xor bl, dl
add edx, esp
bts ax, ax
btr eax, 0x8b
call fcn.01a96e70

Function at 0xfd4bba
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp + ecx*2 - 0xcc22], eax
bswap edx
and dword [esp + ecx*4 - 0x19844], eax
rol edx, 1
neg byte [esp + ecx*4 - 0x19843]
xor ebx, edx
neg ax
add ebp, edx
movsx edx, cl
add ecx, eax
pop eax
ja fcn.01002e95
mov edx, 0x4b87581f
mov edx, dword [edx + ebp - 0x4b87581f]
movzx ax, byte [edx]
mov edx, 0x79173fb5
sar edx, 0x5c
call fcn.010bb68f

Function at 0xfdbda8
Capabilities:
Encode data using base64

Disassembly:
not edx
and al, al
pop eax
xor ebx, edx
lea edi, [edi + ecx - 4]
movsx eax, cl
lea eax, [ecx + ecx + 0x18acc436]
mov dword [edi + ecx*2], edx
pop eax
pop eax
jmp fcn.01002e95
Function at 0xfe2610
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x98b75e11
mov dword [edi], edx
mov edx, ecx
mov dword [esp], ecx
call fcn.01a3c7aa
mov edx, 0x8bd838a
lea ebp, [edx + ebp - 0x8bd838e]
mov eax, dword [ebp + edx*2 - 0x117b0714]
and dl, dh
adc dl, dh
xor eax, ebx
lea edx, [edx + edx*4 - 0x7d7911f6]
movsx ecx, dl
inc eax
btc ecx, edx
lea edx, [ecx*8 - 0x2849d572]
ror eax, 3
dec eax
shl cl, 0x86
shl edx, 0xe5
not eax
sal ecx, 0x73
rol eax, 3
dec eax
not eax
call fcn.0118cd10
mov eax, 0x20855db2
mov eax, dword [esi + eax - 0x20855db2]
jmp 0x1060ca3
mov edx, 0xa304851a
add esi, 4
lea ecx, [edx + edx*8 + 0x713fdebb]
add edx, ecx
imul edx, edx
xor eax, ebx
or dx, dx
lea eax, [eax + edx - 0x2bb83549]
lea ecx, [edx + edx*4 - 0x2a41d15d]
rol eax, 3
rol dl, 0x67
sbb eax, 0x49ba7b9d
sar cx, 0x2d
rol eax, 1
xadd edx, ecx
xor ebx, eax
add ebp, eax
mov eax, edx
shl cl, 1
xadd ecx, edx
mov edi, dword [edi]
jno fcn.01002e95
lea ecx, [edx*2 - 0x3681200]
bswap eax
xor ebx, eax
and edx, edx
neg dl
adc ebp, eax
jmp ebp

Function at 0xff56ee
Capabilities:
Encode data using base64

Disassembly:
or eax, 0x5182d124
adc esi, ecx
mov dword [esp], 0xfb10e8a2
add edx, dword [esp + 3]
cwde
mov ax, word [edx + edi - 0x4490e6fb]
lea edi, [edi + edx - 0x4490e6f9]
mov ecx, 0xa204cbf
sub ecx, dword [esp + edx - 0x4490e6f8]
and dword [esp + edx - 0x4490e6f8], edx
lea ebp, [ebp + edx - 0x4490e6fc]
btc cx, 0x22
lea ecx, [ecx + 0x4007e726]
movzx ecx, byte [edx + ebp - 0x4490e6fb]
shr edx, 0xf4
sbb dword [esp + edx - 0x445], edx
dec word [esp + edx - 0x444]
xor cl, bl
not dl
mov byte [esp + edx*2 - 0x966], dl
btr edx, 0x17
xor cl, 0x90
rol cl, 1
btc edx, edx
neg edx
neg cl
xor cl, 0x99
shl edx, 0x7a
js 0x106e8be
xor bl, cl
lea ecx, [esp + ecx + 8]
call fcn.010bfb50
mov edx, 0x623eaf96
lea edi, [edi + edx - 0x623eaf9a]
call fcn.01bac85a

Function at 0xff5793
Capabilities:
Encode data using base64

Disassembly:
push esi
mov dword [esp + 4], 0xac51c28f
lea esp, [esp + 4]
call fcn.010424d9

Function at 0x10021ff
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x44bb7d1a], ecx
add dl, 0xaa
inc dword [esp + ecx - 0x44bb7d1a]
dec eax
or dword [esp + ecx - 0x44bb7d1a], eax
xor bl, dl
jmp 0x1b9e2f7

Function at 0x100b2a6
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
call eax
mov esi, 0x41b3fc1a
lea ecx, [esi + esi + 0x52325821]
mov ebp, dword [ebp + esi - 0x41b3fc1e]
xor ecx, 0x60b0e8e
mov dword [esi + ebp - 0x41b3fc1a], eax
jne 0x11e6801
mov edx, ecx
mov edi, ebp
cmovne edx, esi
lea esi, [edx + ecx*8 - 0x6e041df]
pop ebx
movsx eax, cl
movsx ebp, dx
neg ecx
pop ebp
rol cx, cl
imul si, dx
xor ax, dx
pop esi
mul cl
mov ecx, dword [esi + ecx - 0x2c6e24b4]
xadd eax, edx
xor edx, edx
lea esi, [esi + edx + 4]
call fcn.011927d9
jle 0x10a72a7
Function at 0x100c154
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jb 0x10c1387
neg edx
dec eax
xor ebx, edx
bts ecx, 0x1d
setb al
add ebp, edx
mul al
pop eax
jmp ebp
mov ecx, edx
mov eax, dword [esi + edx - 0x400000]
shr ecx, 0x44
rol cx, 0x82
lea esi, [edx + esi - 0x3ffffc]
sbb ecx, edx
rol dx, 0x4b
xor eax, ebx
sal ecx, 0x1c
shr ecx, 0x5d
dec eax
neg eax
shl dx, 0x47
sar edx, 0x78
ror edx, 0x8e

Function at 0x1014c62
Capabilities:
Authenticate hmac

Disassembly:
bswap edx
lea edx, [edi + edx - 0x54ac08f8]
jp 0x1ab31be
push 0xda28dd3d
and edx, 0xfffffffc
sub edx, ecx
mov esp, edx
push 0x85046321
mov dword [esp], edi
mov edi, 0x56a80406
push esi
movzx esi, di
jmp 0x1089cc0
rol edx, 1
xor cx, 0x621
inc edx
jmp 0x1b9d61d
push edi
pushfd
pop edi
mov dword [esp + esi*2 - 0x80c], edi
mov esi, eax
mov edi, 0xa2149c07
sub edi, edi
btc di, di
mov edi, edx
push 0x1bbc039a
neg dword [esp]
cld
push 0x1a810103
shr byte [esp + 6], 0x63
rep movsb byte es:[edi], byte [esi]
push dword [esp + 8]
popfd
mov edi, 0xc38b5a3f
pop esi
mov esi, dword [esp + esi - 0x1a8100fb]
mov dword [esp + 8], 0x57978188
lea edi, [edi + edi*4 - 0x2afc685e]
mov edi, dword [esp + 0xc]
lea esp, [esp + 0x10]
call fcn.010ed5e1
mov ecx, 0xf1ac8d20
fild dword [ebp]
mov eax, ecx
mov edx, eax
shl ecx, 0x2b
lea esi, [esi + ecx - 0x64690004]
mov eax, dword [esi + ecx - 0x64690000]
rol dl, 0x41
sal ecx, 0xc8
and ecx, edx
xor eax, ebx
not ecx
xadd edx, ecx
adc cx, 0x66a4
ror eax, 1
not eax
dec eax
sar ecx, cl
sal ecx, 5
bswap eax
lea eax, [ecx + eax - 0x4cac9537]
not ecx
xchg cx, dx
xor eax, 0xaba1753b
btc edx, 0x3f
xor ebx, eax
rol edx, 0x8f
shr cl, 0x67
adc dx, 0x170d
adc edi, eax
jmp edi
mov eax, edx
lea ebp, [edx + ebp - 0xc01af4]
xadd dl, ah
mov word [edx + ebp - 0xc01a10], cx
sal dl, 0x41
jmp edi
xor al, 8
xor bl, al
neg edx
dec word [esp + 2]
call fcn.019d48a8
movzx cx, byte ss:[edx + eax - 0xd8ef]
pop edx
jno 0x10a8ac6
mov ecx, 0x6c995d9b
movzx eax, cl
movzx dx, byte [ebp + eax*2 - 0x136]
xor cx, 0x582b
mov al, byte [ebp + eax*8 - 0x4d6]
imul ecx, ecx
xor ecx, 0x6cb5c5ab
lea ebp, [ebp + ecx*2 - 0x406b3954]
add ecx, 0x972d07b4
push ecx
not dl
jle 0x1a5d1d7
sub esi, 4
mov ecx, 0x2324e3a6
mov edx, dword [ecx + esi - 0x2324e3a6]
movsx eax, cl
lea ecx, [eax + eax + 0x1c875532]
xor edx, ebx
jmp 0x1024a4b

Function at 0x1025013
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xa7ac2528
lea esp, [esp + 4]
Function at 0x102502a
Capabilities:
Encode data using base64

Disassembly:
and al, 0
sub byte [0x648da7ac], ah
and al, 4
jne 0x1a115a6
call fcn.0105879d
neg al
ror edx, 1
mov dword [esp + ecx - 0x1ca4a33e], ecx
inc edx
inc cx
neg dword [esp + eax*2 - 0x75135381]
rol dword [esp + eax - 0x3a89a9b9], cl
xor ebx, edx
cbw
add ebp, edx
mov ecx, edi
lea edi, [edi + eax*2 - 0x7513ff84]
xor eax, eax
ror byte [esp + eax*4 + 8], 0x63
mov word [edi + eax], cx
push eax
pop ecx
pop eax
pop ecx
pop eax
je fcn.01002e95
mov ch, 0x7a
pop ebx
in eax, dx
adc ch, byte [edx + 0x3c]
aad 0xde
adc cl, byte [edi + 0xa]
jl 0x1025015
lodsd eax, dword [esi]
inc ebp
cmp dword [0x706bead], 0x2f
sal byte [edx - 0x39], 1
or eax, 0x6cb2d986
shr byte [ebp + 0x76ff7fad], 1
cdq
mov bh, 0xad
pop ss
mov cl, 0x49
push edx
ud0
mov eax, 0xb616aab9
neg eax
shl eax, 0x6f
mov eax, dword [ebp + ebx*4]
push 0x403897b3
dec dword [esp]
mov dword [esp], eax
jae 0x1164fde
fsub qword [edx]
ljmp 0x6f8d
Function at 0x102f119
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1a5f382
mov ah, 0x16
xchg ebx, ebp
invalid
mov edx, dword [edi + 4]
add edi, 8
or byte [eax], al
add byte [eax], al
mov dword [ecx], edx
adc al, 0x21
bt eax, 0xb5
mov edx, eax
cwde
mov eax, dword [esi]
adc esi, 4
xor eax, ebx
lea ecx, [edx*2 - 0x6d5ed85e]
shr edx, 0xdb
ror eax, 1
not eax
sar edx, cl
call fcn.019a8491
jg 0x103fc0f
jns 0x103fcb3
sahf
test word [edi + ecx*4 + 0x71ac96ad], 0x8e52
jp 0xa25616c0
clc
or ch, ch
xchg edi, eax
jns 0x103fbf5
push edx
add eax, 0xec778b05
adc bh, al
in eax, 0xde
test eax, 0xf21aaad
lodsd eax, dword [esi]
push ecx
jno 0x103fc14
invalid
add byte [ecx], dh
and dword [ebp + 0x53], esi
hlt
mov eax, 0x220b3999
pop ebx
mov edx, 0x13a0151d
not ecx
or dx, dx
mov eax, 0xdd25f58f
call fcn.010af262
popal
push ebx
jg 0x1092b3e
mov ebp, 0xa206cd42
push ecx
inc ecx
cmp byte [esp + ebx - 0x1d53a65e], al
pop ebp
add dword [ecx], 0xfd62190f
invalid
add dword [esi + 0x78], eax
xor edi, dword [esi - 6]
js 0x1092b73
jle 0x1092b3c
dec edi
invalid
dec ah
stc
push ecx
mov dword [0xfe19ca35], eax
test ch, al
mov eax, 0x2c2663f2
push ebx
pop es
insb byte es:[edi], dx
add ecx, esi
pop esi
push ebx
pop eax
cmc
cdq
add dword [0xd30ed636], ebp
adc al, byte [ecx]
add byte [eax], al
add ah, ah
ljmp 0x17d7
jmp 0x19b44bf
mov ebx, 0x8711c5a3
movzx ebx, byte [edx]
jmp 0x1150d5e
xor ebx, ecx
and ebx, 0xff
call fcn.01999275
mov ecx, dword [edi]
mov eax, 0xdb178205
jmp 0x103fc09
lea esp, [esp + 0x10]
jne 0x12d5c99
mov edx, 0x71b2812f
jmp 0x1092aae

Function at 0x1049cac
Capabilities:
Encode data using base64

Disassembly:
inc dword [esp]
pop eax
xor cl, bl
inc dl
sub edx, edx
xor dx, ax
xor cl, 4
dec cl
rol cl, 1
push edx
lea edx, [eax + eax - 0x1f6454f8]
add eax, 0xd79fc72a
not cl
sar byte [esp], 0x41
xor bl, cl
xadd byte [esp + 3], dl
pop edx
adc ecx, esp
bts edx, eax
mul dx
btc edx, edx
mov dx, word [ecx + edx*2 - 0x5800047a]
movsx ecx, ax
inc ax
sbb eax, ecx
sbb edi, 1
dec cx
cwde
and eax, ecx
mov word [eax + edi - 1], dx
jae fcn.01002e95
jl 0x1055def
retf 0x2d0f
mov edx, dword [esi]
mov ecx, 0x903265b7
mov dword [esp], ecx
add esi, 4
movzx eax, cl
neg eax
and dword [esp], ecx
xor edx, ebx
add cx, cx
btc cx, cx
sal eax, 0x8e
xor edx, 0xfdadfabb
inc word [esp + 2]
bt ax, 0x25
ror edx, 1
mov dword [esp], ecx
neg ecx
inc edx
pop ecx
not edx
xor ecx, ecx
ror cl, 0x82
adc eax, ecx
bswap edx
bts ax, cx
xor ebx, edx
add ebp, edx
sal cl, 0x43
or cl, byte [esi + ecx*8]
push eax
lea edx, [eax + eax*4 - 0x7a60bd5a]
add esi, 1
jmp 0x100456c