joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8a13d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xea000]
push edi
jmp 0x8a13ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8a13f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8a13e0
mov eax, 1
add ebx, ebx
jne 0x8a1403
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8a1414
jne 0x8a1433
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8a1433
dec eax
add ebx, ebx
jne 0x8a1420
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8a13f8
add ebx, ebx
jne 0x8a142f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8a1485
xor ecx, ecx
sub eax, 3
jb 0x8a144b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8a14ba
sar eax, 1
mov ebp, eax
jmp 0x8a1456
add ebx, ebx
jne 0x8a1456
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8a1424
inc ecx
add ebx, ebx
jne 0x8a1464
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8a1424
add ebx, ebx
jne 0x8a1471
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8a1466
jne 0x8a1482
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8a1466
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8a14a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8a1496
jmp 0x8a13e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8a14a4
add edi, ecx
jmp 0x8a13e6
pop esi
mov edi, esi
mov ecx, 0x3fc5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8a14c2
cmp byte [edi], 0x19
jne 0x8a14c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8a14c7
lea edi, [esi + 0x49a000]
mov eax, dword [edi]
or eax, eax
je 0x8a153f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x55b30c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x55b488]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8a14f4
mov ecx, edi
jns 0x8a1523
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x55b48c]
or eax, eax
je 0x8a1539
mov dword [ebx], eax
add ebx, 4
jmp 0x8a1511
call dword [esi + 0x55b49c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x8a1570
cmp al, 0xef
ja 0x8a1563
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x8a1545
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x8a1552
mov ebp, dword [esi + 0x55b490]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8a15a4
sub esp, 0xffffff80
jmp 0x4208f0
Function at 0x6d4fa28b
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d4fa2d9
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d4fa2ea
push 0xd
pop eax
jmp 0x6d4fa314
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d4fa2ed
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d4fa7b2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d506878]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d4fdb2a
mov ebx, eax
cmp ebx, esi
je 0x6d4fa825
lea ecx, [ebp - 0x74]
call fcn.6d4f1774
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d4fd7d5
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d4fa83d
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d4fa7b2
cmp eax, esi
jne 0x6d4fa86f
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], pe_nt_image_headers32
call ebx
test eax, eax
je 0x6d4fa82d
lea ecx, [ebp - 0x74]
call fcn.6d4f1774
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d4f9c12
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d4f1774
mov eax, esi
jmp 0x6d4fa80b
Function at 0x6d4fd7d5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d506878]
jne 0x6d4fd7df
repz ret
jmp fcn.6d4fde74

Function at 0x6d4fdb2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x6d4fdb39
pop dword [ebp - 0x28]
mov eax, 0x9e737af0
sub eax, 0x31239fb7
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xcbe215a0
add dword [ebp - 0x38], 0x82702fab
mov dword [ebp - 0x34], 0xfb4bac2d
sub dword [ebp - 0x34], 0xc9185fe8
mov dword [ebp - 0x30], 0x6196e7cc
sub dword [ebp - 0x30], 0x154aa39e
mov dword [ebp - 0x2c], 0x8ae7d456
sub dword [ebp - 0x2c], 0x8ae7d456
lea eax, [ebp - 0x38]
push eax
mov eax, 0xee211d82
add eax, 0x7f2ed2a2
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x7d84e5f1
sub dword [ebp - 0x38], 0x9127c9b
mov dword [ebp - 0x34], 0xcb80cd31
add dword [ebp - 0x34], 0x75eb9444
mov dword [ebp - 0x30], 0xbe15f50f
add dword [ebp - 0x30], 0xa559775d
mov dword [ebp - 0x2c], 0x71420180
sub dword [ebp - 0x2c], 0x71420180
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xf139f946
sub eax, 0x83ea0926
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x332bb
push 0
call eax
mov ecx, 0xf15bd81c
add ecx, 0xea45f1f
mov esi, eax
mov edx, 0x8d8ca9db
add edx, 0xdfc3f225
add edx, dword [ebp - 0x28]
mov edi, 0xe056972a
add dword [ebp - 0x14], edi
mov ebx, dword [edx]
xor ebx, edi
xor dword [ebp - 4], edi
mov dword [esi], ebx
xor dword [ebp - 0x18], ebx
add esi, 0xe3016a88
add esi, 0x1cfe957c
add edx, 0xfb91da51
add edx, 0x46e25b3
loop 0x6d4fdc55
add eax, 0xcfbf
xor ebx, ebx
add ebx, eax
add eax, 0xa789c180
add eax, 0x58763e85
mov ecx, 0x3379ee18
sub ecx, 0xc62aee18
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x716010
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2b6000]
push edi
or ebp, 0xffffffff
jmp 0x716032
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x716039
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x716028
mov eax, 1
add ebx, ebx
jne 0x71604b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x71605c
jne 0x71607b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x71607b
dec eax
add ebx, ebx
jne 0x716068
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x716040
add ebx, ebx
jne 0x716077
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7160cd
xor ecx, ecx
sub eax, 3
jb 0x716093
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x716102
sar eax, 1
mov ebp, eax
jmp 0x71609e
add ebx, ebx
jne 0x71609e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x71606c
inc ecx
add ebx, ebx
jne 0x7160ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x71606c
add ebx, ebx
jne 0x7160b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7160ae
jne 0x7160ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7160ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7160ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7160de
jmp 0x71602e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7160ec
add edi, ecx
jmp 0x71602e
pop esi
mov edi, esi
mov ecx, 0x151a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x71610a
cmp byte [edi], 0xc
jne 0x71610a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x71610f
lea edi, [esi + 0x314000]
mov eax, dword [edi]
or eax, eax
je 0x716187
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x316860]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x31689c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x71613c
mov ecx, edi
jns 0x71616b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3168a0]
or eax, eax
je 0x716181
mov dword [ebx], eax
add ebx, 4
jmp 0x716159
call dword [esi + 0x3168b0]
mov ebp, dword [esi + 0x3168a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7161bb
sub esp, 0xffffff80
jmp 0x40999c
Function at 0x406e61
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x431414], 0
jne 0x406e9f
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406e75
mov dword [ecx*4 + 0x431410], eax
inc ecx
cmp ecx, 0x100
jl 0x406e70
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406ecc
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x431410]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ead
not eax
pop ebp
ret 0xc

Function at 0x906058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9061a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90606a
add dl, dl
jne 0x906089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9060dc
xor eax, eax
add dl, dl
jne 0x906096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90617d
add dl, dl
jne 0x9060a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9060d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x906075
mov eax, 1
add dl, dl
jne 0x9060ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9060e1
sub eax, ebx
mov ebx, 1
jne 0x906128
mov ecx, 1
add dl, dl
jne 0x90610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x906119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906136
cmp eax, 0x7d00
jae 0x90616d
cmp eax, 0x500
jb 0x906168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
cmp eax, 0x7f
ja 0x906170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x906075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10009023
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10009062
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10009062
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10009062
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10009062
cmp dword [ecx + 0x74], 0xe
jbe 0x10009062
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000bcdf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000bd7c
push ebx
push esi
call fcn.1000bca8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000bc3c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000bd29
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000bd7b
push edi
push eax
call fcn.1000cc9a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000bd49
call fcn.1000a784
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000bd7a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000bc3c
add esp, 0x20
test eax, eax
jne 0x1000bd68
push edi
call fcn.1000a784
jmp 0x1000bd70
push ebx
call fcn.1000a784
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000bfe9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013678
push 0x10013670
push str.FlsAlloc
push 0x1f
call fcn.1000bf05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000c01d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001214c]
call esi
jmp 0x1000c023
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000c067
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013688
push 0x10013680
push str.FlsGetValue
push 0x21
call fcn.1000bf05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000c09e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001214c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000c0a6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013690
push 0x10013688
push str.FlsSetValue
push 0x22
call fcn.1000bf05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000c0e0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001214c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10011760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001178d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001178d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x449909
Capabilities:
Parse pe header

Disassembly:
lea ebp, [edx + ebp - 0x639439f]
sub cl, cl
mov dword [esp + edx - 0x63943a3], 0x588b22ab
pop ecx
xor eax, ebx
sar cl, 0x61
bswap eax
bt edx, 0x89
rol ecx, 0xb0
lea eax, [eax + edx*2 - 0x7c1eb379]
call fcn.004e43d9
sub edi, 4
mov edx, dword [edi]
mov eax, 0xd37c9a5
xor edx, ebx
inc ax
lea ecx, [eax*8 - 0x6957417d]
ror edx, 1
shr ecx, cl
sar ax, 0x4b
adc edx, 0xeb0af9a4
add cl, ch
bswap edx
call fcn.00479f40

Function at 0x4530eb
Capabilities:
Encode data using base64

Disassembly:
adc dl, byte [eax + edx]
lea edi, [edi + ecx - 0x771529fa]
movzx eax, word [esp + ecx - 0x771529f8]
and word [esp + ecx - 0x771529f8], cx
mov word [eax + edi - 0x8c1c], dx
jnp 0x4e7017
lea eax, [ecx + eax + 0x22dea66]
neg eax
imul cx, cx
dec ecx
call fcn.004d9f6b
mov dword [esp + eax*8 - 0x460e0], esi
ret 4

Function at 0x48a198
Capabilities:
Authenticate hmac

Disassembly:
rol word [esp + eax*2 - 0x48032c72], 0x42
xor ebx, edx
call fcn.00435964

Function at 0x49331e
Capabilities:
Authenticate hmac

Disassembly:
div dword [ebp + 2]
sub eax, 0x6f209f11
not edx
cbw
not ecx
shl al, 0xe1
imul eax, eax
jo 0x401787
mov edx, dword [ecx + edi - 0x26a164f3]
mov eax, dword [edi + ecx - 0x26a164ef]
shl cx, 0xe2
or ecx, ecx
imul cx, cx
lea edi, [edi + ecx - 0x26a1ea8c]
jb 0x4ced08
call fcn.004c3d73
mov ecx, 0xc62e763f
lea eax, [ecx + ecx*2 + 0x1ab00f3a]
movzx edx, cl
mov edx, dword [edi + edx*2 - 0x7e]
xor eax, 0x8887c91e
mov ecx, dword [edi + 4]
xor eax, eax
lea edi, [edi + eax*4 + 4]
je 0x45d763
neg edx
ror cx, 4
lea edx, [edx + eax*4 - 0x1b4b9ed0]
add ecx, ecx
js 0x455134
mov ecx, dword [ebp]
mov edx, 0xee2ce30e
lea eax, [edx + edx*2 - 0x67da886c]
lea eax, [eax*8 + 0x7da281ab]
add ebp, 4
xor ecx, ebx
call fcn.00415bbd
sbb dl, 0x1a
add esi, eax
movzx eax, byte [esp + ecx*4 - 0x40000c04]
cwde
mov dword [esp + ecx - 0x10000301], esi
ret
mov cx, word [esi + 2]
sar dx, 0xe6
sets dl
js 0x48ace1
mov ecx, 0x3becea7
movzx edx, cl
inc ecx
lea esi, [esi + ecx - 0x3beceac]
shr cl, 0x65
and edx, 0x960ef50d
ror cx, 0xc1
mov edx, dword [esi + ecx*2 - 0x77dce04]
adc cl, cl
jle 0x47c707
xor edx, ebx
rol ecx, 0x14
mov eax, 0xb385c980
rol edx, 1
ror cx, 0xa
adc ecx, eax
inc edx
lea eax, [ecx + ecx*8 - 0x5568bde7]
shl eax, 0x1a
not edx
and ecx, eax
lea edx, [edx + ecx*2 - 0x6abae321]
lea ecx, [eax - 0x595e9b66]
xor ebx, edx
add ebp, edx
div cl
sar cl, 3
js 0x45f402
mov eax, 0xd944c8f
movzx edx, al
call fcn.00470c48
sub ecx, 0xd2afaf17
not edx
rol ecx, cl
and cx, cx
not eax
sar cx, 0xee
or edx, eax
sal cx, 0x8e
movzx eax, cx
mov dword [edi + eax - 0xc000], edx
jmp ebp
Function at 0x49b889
Capabilities:
Encode data using base64

Disassembly:
jae 0x418b1c
shld edx, eax, cl
mov eax, 0x47a74ebc
mov dword [esi + eax - 0x47a74ebc], edx
pop edx
movzx edx, ax
mov ecx, dword [eax + ebp - 0x47a74ebc]
btr eax, eax
lea ebp, [ebp + edx*8 - 0x275dc]
call fcn.0049b515
mov ecx, 0xfa957e86
lea edx, [ecx - 0x65c3cac5]
movzx dx, byte [edi]
mov eax, ecx
shr al, cl
bt eax, 0x2f
mov cl, byte [edi + 2]
jb 0x4cc235
adc al, al
adc edi, 2
neg eax
rol eax, 0x3f
sal dl, cl
add eax, eax
mov word [eax + edi - 0x56a81fc], dx
jg 0x504a76
mov ecx, dword [edx + ecx - 2]
lea edi, [edi + eax - 0x40001ecf]
jno 0x45768f
rol dl, 1
shl al, 0x46
sbb dl, 0x1a
inc ecx
lea eax, [eax*2 + 0x781d628]
not dl
inc cl
xor bl, dl
inc al
cwde
ror eax, cl
adc edx, esp
inc eax
jne 0x4164e5
add esi, edx
movsx edx, cl
or eax, 0x1489f9a9
cwde
pop edx
jmp esi
xor edx, 0x9f9b66be
cbw
sub byte [esp], 0xb5
add byte [esp], 0xd
xor ebx, edx
sub dword [esp], eax
lea eax, [eax*2 - 0x4371ba4c]
js 0x430c56
mov edx, 0xf20f71b5
not edx
lea ebp, [edx + ebp - 0xdf08e4c]
movzx eax, dl
mov ecx, edx
movzx ecx, word [ebp + eax*4 - 0x128]
mul eax
xor cx, bx
imul eax
ror cx, 1
cdq
neg cx
not cx
shr edx, 0xd9
imul ax
adc cx, 0x3a36
or edx, 0xdeaa8e08
neg cx
xor bx, cx
push eax
rol eax, 0xb9
cwd
lea edi, [edi + eax*4 - 0xe4f0a]
mov word [edi + eax*8 - 0x1c9e10], cx
lea ebp, [ebp + eax*2 - 0x72788]
call fcn.004313ba
mov ecx, 0x4f92923f
sar ecx, cl
movzx edx, byte [ebp + ecx*2]
lea ebp, [ecx + ebp + 1]
mov eax, 0x582ee934
inc al
btc ecx, ecx
xor dl, bl
btr ecx, ecx
neg ecx
sal ax, 0xa1
xor dl, 0x34
not ecx
add dl, 0x83
rol cl, 0xc2
jae 0x40cf5b
mov eax, 0xfeae51a0
or ax, ax
mov cx, word [edi]
adc edi, 2
cwde
lea ebp, [ebp + eax*2 - 0xa341]
movzx edx, ax
lea edx, [eax + edx*8 - 0x4077fc4b]
movzx edx, byte [ebp + eax*8 - 0x28d00]
neg eax
xor dl, bl
cwde
xor dl, 0x3e
bts eax, eax
rol dl, 1
btc ax, 0x3e
not dl
jae 0x4d225f
lea ecx, [eax + eax*2 - 0x6670dd48]
mov word [edi], dx
movsx edx, cx
sbb ebp, 3
mov edx, dword [ebp]
mov dword [esp], 0x971e4d82
xor edx, ebx
xor byte [esp + 2], cl
neg byte [esp + 3]
push eax
dec edx
xor word [esp + 4], ax
pop eax
ror edx, 1
not edx
bswap edx
sal eax, cl
adc ax, word [esp + 1]
jl 0x453126
movzx ecx, al
lea ebp, [ebp + eax*4 - 0x15aa07f4]
mov edx, dword [ebp + eax - 0x56a81fc]
push ecx
xor edx, ebx
call fcn.0050ddab
mov dword [esp + eax*4 - 4], esi
Function at 0x529693
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x5296c1
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x5296b8
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x5296b0
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x5296e2
mov esp, ebp
pop ebp
ret

Function at 0x5296e6
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x529752
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x52977f
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x52976e
xor ecx, eax
xor edx, ebx
dec edi
jne 0x52975f
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x5297a5
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x529746
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x5297d1
mov esp, ebp
pop ebp
ret 0xc