joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b3d6
Capabilities:
Shutdown system

Disassembly:
push ebx
xor eax, eax
push eax
mov dword [esp], 0
mov ebx, dword [esp + 0xc]
and ebx, 2
and ebx, ebx
jne 0x46b3f9
mov ebx, dword [esp + 0xc]
and ebx, 1
and ebx, ebx
jne 0x46b3f9
jmp 0x46b400
mov eax, 1
jmp 0x46b402
xor eax, eax
and eax, eax
je 0x46b446
call fcn.0046a4a4
and eax, eax
je 0x46b413
xor eax, eax
jmp 0x46b418
mov eax, 1
and eax, eax
je 0x46b43f
mov ebx, dword [esp + 0xc]
and ebx, 0xfffffffe
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0xc]
and ebx, 0xfffffffd
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0xc]
and ebx, 0
mov dword [esp + 0xc], ebx
jmp 0x46b446
mov dword [esp], 0x80000000
push dword [esp]
push dword [esp + 0x10]
call sub.USER32.dll_ExitWindowsEx
and eax, eax
je 0x46b49a
mov ebx, dword [esp + 0xc]
and ebx, 2
and ebx, ebx
je 0x46b472
mov ebx, dword [0x46554c]
add ebx, 0xc
mov dword [0x46554c], ebx
jmp 0x46b493
mov ebx, dword [esp + 0xc]
and ebx, 1
and ebx, ebx
je 0x46b489
mov dword [0x46554c], 0xa
jmp 0x46b493
mov dword [0x46554c], 8
mov eax, 1
jmp 0x46b4a0
xor eax, eax
jmp 0x46b4a0
add esp, 4
pop ebx
ret 4
Function at 0x4129e1
Capabilities:
Encode data using base64

Disassembly:
not ecx
call fcn.0045546b
mov eax, 0x891d912f
lea edx, [eax - 0x1c7f7ee3]
lea edi, [edx + edi - 0x6c9e1250]
mov edx, dword [edx + edi - 0x6c9e124c]
xor edx, ebx
movsx ecx, al
bts ax, 5
imul ecx, eax
sbb edx, 0x773a960c
shl ax, 0x6a
sbb cl, 0x24
not edx
bts cx, cx
btr ax, 0x11
neg al
ror edx, 2
add eax, 0x52b3a8b9
bt cx, 0x1e
neg edx
inc eax
xor ebx, edx
neg eax
add ebp, edx
mov edx, eax
mul dl
and eax, eax
mov ecx, dword [eax + esi - 0x242e1324]
jge 0x43f87c
bswap edx
dec dx
mov dx, word ss:[ecx + eax - 0x242e1324]
lea esi, [esi + eax - 0x242e1322]
mov word [esi + eax - 0x242e1324], dx
lea ecx, [eax*8 + 0x51b7d7b0]
sar cl, 0xc4
movsx edx, cx
jmp ebp
Function at 0x41e280
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], 0x41c9e12
add al, 0x1b
neg edx
and dword [esp + edx*2 - 0x7661bc0e], 0xb60b8489
xor al, 0x10
shl edx, 0x2a
pop edx
xor bl, al
imul dx, dx
xor dl, dh
bts edx, edx
adc eax, esp
mov dword [eax + edx*2 - 0x8100002], ecx
lea esi, [esi + edx*2 - 0x8100006]
imul edx, edx
mov eax, dword [esi + edx*8 - 0x40800008]
imul edx, edx
sal edx, 0xd9
xor eax, ebx
btc dx, 0x2f
mov ecx, edx
shl ecx, 0xc
lea eax, [eax + ecx*2 + 0x7703300b]
dec cl
bt cx, cx
ror eax, 1
neg eax
shr edx, cl
sbb dl, ch
jne 0x42ff0f
dec eax
bswap eax
or ecx, ecx
shr edx, 0x5e
xor ebx, eax
btc ecx, edx
add edi, eax
ror cl, 0x61
or edx, edi
jmp edx
xor edx, edx
lea esi, [esi + edx*8 - 1]
add dl, byte [esi + edx*8]
mov eax, 0x80398a15
xor dl, bl
bt eax, 3
movsx ecx, ax
sal eax, 0x85
ror dl, 1
sub eax, ecx
btc ecx, ecx
setb al
xor dl, 0xbe
sub dl, 0xb3
lea ecx, [eax*4 + 0x6c9a6a34]
lea ecx, [eax + ecx + 0x3c3c1e0a]
or ecx, ecx
xor dl, 0xb1
sal eax, 0x5c
neg cx
bts eax, 0xa0
adc dl, 0x12
not dl
sar ecx, cl
neg dl
xor bl, dl
neg ax
xchg ch, cl
add edx, esp
ror ax, 0x46
inc ecx
movzx cx, byte [edx + eax*2 - 0x2001fffe]
mov edx, eax
sbb dl, 0x12
not al
lea edi, [edi + edx - 0x1000ffee]
mov word [edi + eax - 0x1000ff00], cx
or dx, dx
bswap eax
lea esi, [esi + eax - 0xff0014]
mov eax, dword [esi + eax*2 - 0x1fe0020]
jno 0x45fc54
xor edx, ebx
sub cx, ax
and cl, ch
neg eax
neg edx
sal ecx, 0x5e
sbb edx, 0xb2df08b
cwde
sub ax, ax
xor edx, 0xbb83b880
lea edx, [eax + edx - 0x6050024c]
sal eax, 0xc5
seta cl
neg eax
neg edx
ror ecx, 0xd9
inc edx
xor ebx, edx
add ebp, edx
movsx edx, cl
push ecx
pop eax
jmp fcn.0041f988
shr byte [esp + eax + 1], 0x85
sbb byte [esp + eax], ch
not edx
sbb cl, al
pop eax
call fcn.004424c9
xor eax, ebx
bswap edx
dec dx
movzx ecx, dx
not eax
btc cx, cx
imul edx, ecx
sal dx, cl
dec eax
shr dl, 3
rol edx, cl
bswap eax
ror ecx, 0x52
btr edx, 0x36
adc edx, edx
inc eax
push edx
shl dword [esp + ecx*2 - 0x40078000], 0xf6
or ecx, ecx
not eax
sbb dl, byte [esp + ecx - 0x2003bffd]
sar ecx, 0x8d
bswap ecx
xor ebx, eax
push ecx
dec dword [esp + ecx - 0x1e0000fd]
push ecx
add ebp, eax
not edx
shl cx, 0xa
pop edx
pop edx
pop ecx
jns fcn.00434194
mov edx, 0x4a0b1825
movzx eax, dl
lea edi, [edi + eax*4 - 0x98]
mov ecx, eax
ror ax, 0x8c
sal cl, cl
mov ecx, dword [edi + edx - 0x4a0b1825]
xor ecx, ebx
dec ecx
bswap ecx
sal al, 0xe5
mul edx
cwde
rol ecx, 2
cwde
mul eax
lea eax, [edx + edx*8 + 0x468743bc]
bswap ecx
btr eax, eax
div eax
xor ebx, ecx
add ebp, ecx
push edx
not dword [esp + eax*2 - 2]
lea ecx, [eax + eax + 0x4fa0d4a8]
lea edi, [edx + edi - 4]
sal edx, 0x9d
xor edx, dword [edi + edx]
shr dword [esp + eax - 1], 0x81
not ecx
sub dword [esp + eax*8 - 8], eax
xor edx, ebx
btr ecx, eax
not cl
sbb edx, 0xfc356b8f
neg edx
jmp 0x44dd68
Function at 0x42503b
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [ebp + ecx*8 - 0x13c]
inc edx
mov dword [esp + ecx - 0x27], 0x989da88c
mov ecx, dword [ebp + ecx - 0x27]
rol dword [esp], 0xbd
ja 0x4179eb
bswap edx
xor ecx, ebx
movsx eax, dl
inc ecx
neg ecx
lea eax, [eax*8 + 0x59968c87]
inc eax
not eax
dec ecx
xor dl, dl
mul dl
ror ecx, 2
add al, dl
not ecx
pop eax
btr eax, edx
btr eax, edx
inc ecx
neg ecx
bt eax, edx
xor edx, eax
xor ebx, ecx
xor edx, edx
push edx
bt eax, 0x1a
adc edi, ecx
shl eax, 0xc1
mul al
lea ebp, [ebp + edx - 1]
shl word [esp + edx + 2], 0xcf
movzx ecx, ax
cwde
movzx eax, byte [edx + ebp]
xor al, bl
btc edx, ecx
ror ecx, 0x8b
sbb al, 0x2d
neg ecx
inc ecx
xor al, 0xb8
not al
ror al, cl
xor bl, al
lea eax, [esp + eax + 4]
jmp 0x41ff67

Function at 0x42c895
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edi + eax - 0x1d7180ee]
mov dword [esp + eax - 0x1d7180ee], ecx
xor edx, ebx
cwde
shl eax, 0x56
jnp 0x43a183
neg edx
and eax, 0xd937552d
ror edx, 1
add dword [esp + eax - 0x19000000], 0x3ab2dd32
xchg dword [esp + eax - 0x19000000], eax
inc edx
neg dword [esp + ecx - 0x52b7ebb0]
rol edx, 1
cbw
dec dword [esp + ecx - 0x52b7ebb0]
xchg byte [esp + ecx - 0x52b7ebaf], cl
xor ebx, edx
add ebp, edx
cwde
mov dx, word [esi + ecx - 0x52b7ebff]
lea esi, [esi + ecx - 0x52b7ebfd]
add cx, word [esp + ecx - 0x52b7ebff]
jle 0x441ad5
mov eax, 0x3d1acc39
cdq
imul eax, edx
lea esi, [eax + esi - 4]
mov ecx, dword [esi + eax]
xor eax, eax
add eax, 0x9c0f00a1
xor ecx, ebx
dec dl
dec eax
not ecx
sar eax, 0x58
sar word [esp + ecx - 0x52b79cfc], 0xc6
lea edi, [ecx + edi - 0x52b79cff]
rol eax, 0xd9
xor cx, word [esp + ecx - 0x52b79cfd]
movzx eax, byte [edi + ecx - 0x52b7074e]
bswap ecx
xor al, bl
ror byte [esp + ecx - 0x4e07b752], 0x82
sub cx, word [esp + ecx - 0x4e07b750]
rol al, 1
pop ecx
and cx, 0xd303
dec al
or cl, cl
rol cx, 0x8f
not al
call fcn.0043094a
Function at 0x42ca1e
Capabilities:
Authenticate hmac

Disassembly:
push 0x3920a727
inc byte [esp]
imul ecx
inc dword [esp]
mov ecx, dword [esp]
mov dword [edi + ecx*2 - 0x72414e52], edx
shl ecx, 0x7a
movzx edx, cx
call fcn.0040db1b
mov ecx, 0xfea29b2d
movsx edx, cx
sub esi, 4
mov eax, ecx
mov eax, dword [esi]
sal dx, 0xc
xor eax, ebx
push edx
lea ecx, [ecx + edx*2 - 0xee415c2]
bswap eax
sub ecx, 0xf40d1716
push ecx
rol eax, 3
sal dword [esp + 2], 0x71
not eax
jb 0x40fab3
mov dx, word [esi]
jmp 0x42be80
bswap eax
sub dword [esp + 4], ecx
ror dx, 0x85
xor ebx, eax
not cl
add edi, eax
and ecx, dword [esp + 4]
dec word [esp + ecx*4 - 0x201c]
not edx
mov cx, word [ebp + edx - 0xf97f]
movsx eax, dl
mov dx, word [edx + ebp - 0xf97d]
jne 0x4109af
mov eax, 0xf8b04ebc
lea edx, [eax*8 - 0x4774d1df]
lea esi, [esi + edx - 0x7e0da405]
mul al
mov edx, dword [esi + edx - 0x7e0da401]
xor edx, ebx
not edx
lea ebp, [eax + ebp - 0x7d]
shr eax, 0xa7
sete al
pop eax
or cx, dx
shr al, 0x85
not cx
lea edx, [eax*2 + 0x4138fa1c]
sete byte [esp + edx - 0x41391620]
call fcn.00428630
mov cx, word [esi + 2]
add esi, 2
mov eax, 0xe43aa4b9
not dx
or al, al
not cx
not eax
shr al, 0x61
sete al
and dx, cx
movsx ecx, al
mov word [esi + eax*2 - 0x378ab600], dx
lea ebp, [ebp + eax - 0x1bc55b04]
movzx edx, cl
or edx, dword [ebp + ecx]
xor eax, 0xb1f0f88
rol ax, 0x24
shl ax, 0x8f
xor edx, ebx
lea eax, [eax*4 + 0x3b59691]
cwde
bswap ecx
neg edx
ror edx, 1
not edx
add ecx, 0x1e0665af
lea edx, [eax + edx - 0x1b7bf9f4]
bts ax, ax
btc cx, cx
xor ebx, edx
bts ax, cx
bt ecx, 0xa6
adc edi, edx
movzx edx, cx
btc eax, edx
jmp edi
mov dword [esp + eax*4], eax
not word [esp + eax*4]
dec ecx
ror word [esp + eax*8], 0x2d
adc eax, eax
pop eax
rol ecx, 3
ror eax, 0x18
bswap eax
shl al, 0xa5
xor ebx, ecx
lea eax, [eax + eax*4 + 0x42002b00]
inc ax
add ebp, ecx
mov ecx, 0xa71888ae
mov ecx, dword [edi + eax - 0x47002601]
dec eax
mov eax, dword [edi + eax - 0x470025fc]
jno 0x40f954

Function at 0x42de5d
Capabilities:
Encode data using base64

Disassembly:
pop ecx
neg dword [esp]
sbb eax, 0xe204a818
xor eax, 0x885150a
jmp 0x432895
mov edx, dword [esp]
neg eax
lea eax, [edx + eax - 0x5df9666d]
movsx ecx, dl
ror eax, 3
jmp 0x447ca7
call fcn.0042e3a4
add dword [esp + edx - 0x4508610], edx
dec dx
xor ebx, ecx
jmp 0x43d08e
Function at 0x431b5e
Capabilities:
Authenticate hmac

Disassembly:
sbb dx, dx
lea esi, [edx + esi - 0x6d72fff9]
mov byte [edx + ecx - 0x6d72ffff], al
jmp edi
jb 0x418ce0
mov edx, 0x82a708e
movsx ecx, dx
imul edx, ecx
lea edi, [edi + edx*2 - 0x31911d8c]
lea eax, [ecx + edx - 0x695ae158]
mov edx, dword [edi + ecx*2 - 0xe11c]
xor edx, ebx
push eax
xor edx, 0xd596e6a1
neg dword [esp + ecx - 0x708e]
add word [esp + ecx*8 - 0x38470], ax
dec dword [esp + ecx - 0x708e]
ror edx, 2
call fcn.0044cf03
lea edx, [ecx*8 + 0x1325ec8d]
neg dx
mov eax, dword [ebp]
neg edx
or ecx, ecx
lea edx, [ecx + edx*8 + 0x223ead8f]
xor eax, ebx
xadd dx, cx
shl cx, 0xd
not dl
xor eax, 0x724ad01
shl dx, 0xa1
btc edx, 0xac
jb 0x42847f
mov edx, 0xc9abff8a
movzx ecx, dx
mov eax, ecx
lea ebp, [ebp + ecx*2 - 0x1ff18]
cdq
jmp 0x4610a8
lea eax, [eax + edx*2 - 0x6ac4a084]
or edx, edx
imul cx, dx
xor eax, 0x80ae8a9b
and cl, cl
imul dx, cx
inc eax
xor eax, 0xc13c3c3b
add edx, 0x521be83d
xor ebx, eax
add edi, eax
inc edx
mov eax, edx
btr eax, eax
mov ecx, dword [eax + esi - 0x2d72e83e]
mov al, byte [esi + eax*2 - 0x5ae5d078]
jb 0x418fe0
btc ax, 0x84
xor edx, 0xb496f2b3
inc eax
not al
je 0x430466
bswap edx
ror edx, cl
neg cl
xor ebx, edx
bt ax, ax
adc ebp, edx
mov edx, 0x161059a0
xadd dx, cx
jmp ebp
movsx eax, dx
mov edx, dword [ebp]
movsx ecx, al
mov eax, dword [ebp + ecx*8 - 0x7c]
lea ebp, [ebp + ecx - 0xc]
not edx
shr word [esp + ecx - 0xb], 0xe7
seta cl
not eax
shr ecx, 0x1b
dec ecx
or edx, eax
sar word [esp + 5], 0x8b
mov dword [esp], ecx
mov dword [ebp], edx
inc dword [esp + 2]
rol cx, 0xc1
js fcn.00440786
pop eax
pop ecx
pop ecx
jmp edi
mov dword [esp], 0x9406e894
pop ecx
sub ebp, 4
jmp 0x420e24
add edx, dword [ebp + edx*4]
sub eax, eax
setno al
shl ax, cl
xor edx, ebx
xor ecx, eax
dec ecx
push eax
bswap edx
not edx
adc dword [esp + ecx*2 - 0x1f712], eax
lea ecx, [eax + eax*8 - 0x1ee9b968]
rol edx, 2
or al, ah
not edx
xadd cx, ax
xchg word [esp + eax*2 - 0xd530], cx
xor edx, 0x8ab4b10e
sar dword [esp + eax*2 - 0xd530], 0x2f
sbb dword [esp + eax - 0x6a98], 0x64a64db9
adc ecx, dword [esp + eax*2 - 0xd530]
xor ebx, edx
neg cx
add edi, edx
mov esi, dword [ecx + esi - 0x7c6f45b9]
pop ecx
jmp fcn.00438d45

Function at 0x437d7a
Capabilities:
Encode data using base64

Disassembly:
call fcn.004431a6
lea esi, [esi + eax - 0x409db005]
shr eax, 0x84
not eax
shl cl, 0xe7
mov dword [esi], edx
movzx edx, cx
sub ecx, 0x8abf9f35
lea ebp, [ebp + edx*2 - 0x1f904]
bswap eax
mov edx, dword [ebp + edx - 0xfc80]
xor edx, ebx
add ecx, 0xbdb76110
adc cl, ch
inc edx
not edx
bt eax, 0x82
rol edx, 2
xchg ecx, eax
bswap edx
neg ecx
bts eax, ecx
sbb al, 0xb8
xor ebx, edx
add edi, edx
ror eax, 0xdc
lea edx, [ecx + eax*8 + 0x64132939]
jae fcn.00438d45
push 0xa9aaafb2
mov ecx, dword [esp]
sub esi, 4
jmp 0x45ed7b
Function at 0x439b3a
Capabilities:
Encode data using base64

Disassembly:
or ax, dx
inc cx
jge 0x43eb91
movsx edx, cl
not ax
xadd word [esp + ecx*4 - 0xfff], dx
sar ecx, 0xe7
xchg byte [esp + ecx*4 - 0x1a], cl
mov word [ebp + ecx], ax
mov dword [esp + ecx*4], edi
ret 4

Function at 0x43bfc1
Capabilities:
Encode data using base64

Disassembly:
mov edi, dword [esp + edi*2 + 0xc]
mov dword [esp + 0xc], 0x7293e6dc
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.0040fd6c

Function at 0x43cff4
Capabilities:
Encode data using base64

Disassembly:
setb byte [esp + ecx - 0x7fc00007]
imul edx, edx
xor ebx, eax
call fcn.004416ad

Function at 0x43d163
Capabilities:
Encode data using xor

Disassembly:
call 0xc225c8aa
invalid
xadd dword [esp + 8], edx
adc cl, 0xb
rol edx, 0x56
ror cl, 1
inc cl
call fcn.0041cbc0
imul ebp, dword [0x5d7d1907], 0x18fb89ee
jns 0x43d13f
add eax, 0x6aca29e7
add al, 0x19
xlatb
mov esi, dword [ebx + 0x3205e6f8]
sbb eax, 0x7948e6f9
cli
sbb byte [ebp + 0x5625e45], ch
out 0x10, eax
cdq
add al, 0xe7
cmp al, 0xa9
inc ebx
pop eax
sub eax, edx
stc
sbb byte [ecx - 0x3c683ab], dl
mov edx, 0x6d804149
mov al, 0xf0
sbb bh, dl
and al, dh
dec edi
dec ebp
mov dh, 0x75
cld
push edx
popfd
inc edx
adc byte [edi + 0x1943a828], 0x9e
mov es, word [edx]
adc eax, 0x4342f609
add byte [ebx], cl
xchg esp, eax
mov ebp, 0x186b23ff
nop
inc ebp
xor byte [ebx - 0x50], 0x41
add byte [ebp + 0x19], al
leave
xlatb
mov ebp, 0x7e3d037f
mov esi, 0xbd47a2ff
jg 0x43d1c1
sbb edi, dword [ebp + eax*2 - 0x73e37fbe]
sar dl, 1
mov eax, 0x4b05c025
mov ecx, dword [esi + eax - 0x4b05c025]
movzx edx, al
shr edx, 0x4e
adc edx, dword [eax + ecx - 0x4b05c025]
mov dword [esi + eax - 0x4b05c025], edx
lea ebp, [ebp + eax - 0x4b05c029]
movzx ecx, al
lea edx, [ecx + ecx*8 + 0x23987b1f]
mov eax, dword [ecx + ebp - 0x25]
lea ecx, [edx + ecx*2 - 0x5dc2ce58]
sal edx, 0xc2
btr ecx, 0x9f
xor eax, ebx
shl edx, cl
lea eax, [eax + edx*4 + 0x59bc900]
sete dl
push ecx
cmovae edx, dword [esp + edx*8 - 8]
neg eax
imul edx, dword [esp + ecx - 0x45d5ae5e]
jae 0x45d0dd
sbb eax, 0xb88cc796
inc dword [esp + edx - 0x4b2fea84]
shr byte [esp + edx - 0x4b2fea81], 0x26
ror eax, 1
xor ebx, eax
sar dword [esp + ecx - 0x45d5ae5e], cl
adc dx, 0x84a7
mov word [esp + edx - 0x4b2f6f2a], dx
add edi, eax
ror byte [esp + ecx - 0x45d5ae5b], 1
inc cx
xor dl, cl
mov dword [esp + ecx - 0x45d5ae5f], edi
ret

Function at 0x43ee6a
Capabilities:
Encode data using base64

Disassembly:
imul dx, cx
inc eax
not word [esp + edx - 0x1a2e8d1d]
not eax
xor ebx, eax
mov dword [esp + edx - 0x1a2e8d22], ecx
shr dl, 0x61
ror word [esp + edx*2 - 0x345d1a21], 0x63
adc edi, eax
btc ecx, 0x1f
inc dword [esp + edx - 0x1a2e8d0d]
sub ecx, ecx
lea ebp, [ebp + edx*4 - 0x68ba3445]
not dword [esp + edx - 0x1a2e8d0f]
inc dword [esp + edx*4 - 0x68ba3441]
movzx edx, byte [ebp + edx*4 - 0x68ba3444]
sbb byte [esp + ecx + 5], ch
xor dl, bl
push ecx
Function at 0x44040d
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [eax + ebp - 0x53]
mov ecx, dword [ebp + eax*4 - 0x148]
sal word [esp + eax - 0x53], 0x41
jb 0x42dd97
lea ebp, [eax + ebp - 0x4f]
push eax
dec eax
and edx, ecx
call fcn.00456e6d
xor edx, ebx
mov dword [esp + ecx*2 - 0x3f6e6], eax
xor edx, 0xa806cbf
shr ax, 0x2d
js 0x4413cb
dec edx
call fcn.004540d2
dec ecx
not dx
push eax
xor dx, 0x560a
xor ecx, 0xad8cb199
xchg edx, eax
sal word [esp + edx*2 - 0x4dcc00a6], 0xaa
add ax, dx
rol ecx, 2
rol eax, 0x84
dec dword [esp + eax - 0x61acc0cc]
jns 0x419d39
xor ebx, ecx
mul ax
shl al, 0xa2
xadd dword [esp + eax - 0x61aca240], eax
adc edi, ecx
cwde
jmp 0x4128f4

Function at 0x448682
Capabilities:
Encode data using base64

Disassembly:
add eax, ecx
xor edx, 0xebb64dbe
bswap eax
bt ax, cx
xor ebx, edx
sal eax, cl
add ebp, edx
mov cx, word [edi]
add edi, 2
lea edx, [eax + eax*4 - 0x2fd0f9ec]
lea esi, [esi + edx*2 - 0x605e0c29]
movzx eax, byte [esi + edx*2 - 0x605e0c28]
xor al, bl
and dx, dx
jns 0x455082
bswap eax
mov eax, dword [ebp]
ror word [esp + 1], 0x24
xor eax, ebx
not eax
mov byte [esp], 0x81
not ecx
rol eax, 1
mov edx, dword [esp + ecx*2 - 0xfefa54]
shr edx, cl
not eax
dec ecx
shr edx, cl
shr ecx, cl
dec eax
bswap ecx
not eax
sub edx, 0xe80bc8b6
adc dword [esp + edx - 0x17f45744], 0x87ad11a7
bswap eax
btc ecx, edx
ror dword [esp + edx*4 - 0x5fd15d10], cl
lea eax, [ecx + eax - 0xcb85f7f]
call fcn.00422180
adc dword [0x99a90104], esp
stosd dword es:[edi], eax
or esi, edi
add byte [edx + esi*4 + 0x59fefd51], dl
add al, byte ds:[ecx]
jns 0x41446c
invalid
sub byte [0x403290], al
push ecx
push edx
pushfd
mov edx, 0xcc8b30b9
mov ecx, 0x7589060b
call fcn.0042c9fa
and dl, 0x3f
movzx ecx, dl
mov edx, dword [ecx + ebp - 0x30]
jl 0x41435c
xor edx, ebx
mov eax, 0xfa55a08
mov dword [esp + ecx - 0x30], 0xaa01c493
lea edx, [edx + eax*2 - 0x19aeeb10]
and word [esp + eax*2 - 0x1f4ab410], cx
neg edx
push ecx
sub edx, 0xb88cc797
ror edx, 1
xor ebx, edx
ror ax, 0xc1
call fcn.00445d6d
mov ecx, 0x45835687
mov edx, dword [esi + ecx - 0x45835687]
xor cl, 0xbc
movsx eax, cl
mov ecx, dword [edx + eax - 0x3b]
mov dword [esi + eax*2 - 0x76], ecx
movsx edx, al
lea edi, [eax + edi - 0x3f]
lea ecx, [eax + eax*2 + 0x2a55b13]
mov edx, dword [edi + eax*2 - 0x76]
xor edx, ebx
not ax
or eax, eax
sbb cx, ax
dec edx
imul cx, ax
xchg ch, al
inc cl
not edx
bswap edx
neg edx
or ax, 0x9b91
cbw
xor edx, 0xf5bdc60d
call fcn.004202d8
Function at 0x456db1
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0x10], 0xfd49a6c7
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.0042659e

Function at 0x4575b0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
rol eax, 1
not eax
mov dword [esp + edx*2 - 0x1c000], ecx
dec eax
not eax
shr word [esp + edx - 0xdffc], 0x4c
ror word [esp + edx*8 - 0x6fffe], 0xeb
bswap eax
adc eax, 0xb186a091
shr word [esp + ecx + 8], 0x22
not eax
ja 0x465c9a
bswap edx
mov ecx, dword [ebp + eax - 0x1a39442b]
sub edx, eax
sar ax, 0xc3
xor ecx, ebx
ror al, 0x62
lea eax, [edx + 0x14307b87]
not ecx
neg ecx
bts edx, edx
xor ecx, 0x19377f84
and al, 0x1d
bswap ecx
shr dword [esp + eax - 0x253b371c], 0xc9
xor byte [esp + eax*2 - 0x4a766e37], ah
mul edx
neg ecx
pop edx
call fcn.00450058
sar byte [esp + edx*4 - 0x37ffb], 0x23
sal cx, 0xe7
inc eax
neg dword [esp + edx*4 - 0x37ff8]
je 0x4576b8
setge cl
xor ebx, eax
dec word [esp + edx - 0xe000]
push edx
xor edx, dword [esp + edx - 0xdff4]
adc edi, eax
ror byte [esp + ecx*2 + 3], 0xc6
mov dx, word [esi + ecx*2]
movsx eax, cx
adc al, 0x30
or cl, byte [esi + eax*4 - 0xbe]
cwde
lea esi, [eax + esi - 0x2e]
not al
dec ax
bts ax, ax
shr dx, cl
bswap eax
neg eax
jnp fcn.004199c4
mov word [esi + eax - 0x31c00000], dx
mov ecx, 0x222e2e2e
btr eax, 0x96
cwde
mov dword [esp + eax], edi
ret 0xc

Function at 0x45f36c
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
lea edx, [edx + eax + 0x59b0d4e]
shl cl, 0x85
neg edx
pop eax
sub edx, 0xb88cc797
inc cl
setno cl
sal ecx, cl
ror edx, 1
movsx eax, cx
xor ecx, eax
xor ebx, edx
bts ecx, eax
btc ecx, ecx
adc edi, edx
ror eax, cl
not cx
movsx edx, cl
mov edx, dword [esi + ecx*4 - 0x3ffac]
mov eax, dword [edx + ecx*2 - 0x1ffd6]
mov edx, 0x15bb6b86
mov dword [esi + ecx*4 - 0x3ffac], eax
movzx eax, cl
shl cx, cl
call fcn.0043067d
push eax
invalid
Function at 0x488c7c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x862b3c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x488cb7
add dword [esp], 5
retf

Function at 0x488e22
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x862b3c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x488e5d
add dword [esp], 5
retf

Function at 0x48c15e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00488c7c
mov dword [ebp - 4], 0
mov eax, dword [0x862b3c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x48c1be
add dword [esp], 5
retf

Function at 0x48c407
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00488c7c
mov dword [ebp - 4], 0
mov eax, dword [0x862b3c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x48c467
add dword [esp], 5
retf

Function at 0x48c655
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x862b3c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x48c690
add dword [esp], 5
retf

Function at 0x48c921
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x862b3c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x48c95c
add dword [esp], 5
retf

Function at 0x48ea2d
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x862b3c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x48ea68
add dword [esp], 5
retf
Function at 0x494d29
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x862b3c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x494d64
add dword [esp], 5
retf

Function at 0x49506e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x862b3c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4950a9
add dword [esp], 5
retf

Function at 0x495192
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4951be
add dword [esp], 5
retf

Function at 0x4954f3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x862b3c]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x49552e
add dword [esp], 5
retf