joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd35df9
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov esi, dword [esp - 0xef7f80]
dec ebp
btc ebp, esp
dec edx
inc dword [esp - 0x77bfc4]
inc ecx
btr ebp, edx
dec ebp
arpl ax, ax
inc ecx
movzx edi, ch
ror dl, 0x21
dec ebp
adc ecx, eax
inc di
mov ebp, dword [esp + edx - 0x77bfc4]
pop eax
dec esi
mov dword [esp - 0x77bfc4], esi
cdq
inc bx
mov eax, dword [esp + edx - 0x77bfc2]
shr ecx, cl
dec esp
imul esp, ebp
inc ecx
mov cl, byte [edx + ecx - 0xbf8]
dec ebp
lea edx, [edx + edx + 4]
inc cx
shld ebp, eax, cl
inc ecx
pop edi
dec eax
xadd ebp, edx
call fcn.00dd36cb
div cl
xor ebx, edx
add ebp, edx
mov dword [esp + eax], ebp
ret
add edi, 5
and al, ch
xor edx, ebx
not dword [esp]
or al, ah
inc byte [esp]
inc edx
xadd byte [esp + 1], cl
xor ecx, eax
neg al
neg edx
sal dword [esp + ecx*8 - 0x4bdb7f8], cl
not edx
lea edx, [edx + ecx*2 - 0x1164ab26]
shr ecx, cl
xchg ecx, eax
or dword [esp + eax*8], 0x6a9f8c99
xor edx, 0x94b16d91
ror al, 0x21
jno 0x9a7d0a
jmp 0xd8f9c8
mov ecx, dword [eax]
mov dword [esp], edx
lea eax, [edx - 0x20ee53e7]
xchg word [esp + 6], dx
mov edx, dword [esi]
or ecx, edx
not ecx
mov dword [esi], ecx
movsx edx, word [esp + 4]
inc byte [esp + 2]
cmovne eax, edx
mov edx, dword [edi + 1]
lea ecx, [eax*2 + 0x211bc93a]
pop ecx
jns 0xceece5
inc ebp
mov eax, dword [ebx]
push 0x77bfc420
dec ecx
add ebx, 4
inc esp
mov esp, dword [esp + 1]
inc esp
xor eax, esi
dec edx
lea eax, [0x960685a0]
inc ecx
xor eax, 0xa9311691
inc ecx
inc eax
inc esi
xadd dword [esp - 0x1deff0f], esp
inc ecx
movzx ecx, sp
dec edx
lea edx, [0x55ad5c14]
inc ecx
xor eax, 0xf4212523
mov ebp, edx
neg bp
push edx
inc ecx
dec eax
dec edx
xadd dword [esp - 0xef7f80], eax
dec ebp
lea ebp, [esp - 0x7b7c2a49]
inc ecx
rol eax, 1
inc cx
inc ebp
inc esp
mov esi, ebp
dec edx
mov dword [esp - 0x1deff08], esi
inc esi
xor dword [esp - 0x77bfbc], eax
jmp 0x9764c8

Function at 0xd3a430
Capabilities:
Encode data using xor

Disassembly:
rol al, 1
shl cl, 0x86
not al
inc ebp
mov ebp, esp
call fcn.00e69235
mov edx, 0x11ba5bbd
lea edi, [edi + edx - 0x11ba5bbe]

Function at 0xd3d3af
Capabilities:
Encode data using xor

Disassembly:
bts eax, eax
not dx
rol al, 7
push eax
ror al, 0x21
mov cx, dx
inc ax
btr eax, 0x9f
jae 0x9a9262

Function at 0xd4755d
Capabilities:
Encode data using base64

Disassembly:
movsx ecx, al
mov dword [eax + ebp - 0x5d18002f], edx
lea edx, [ecx + ecx*4 + 0x592c7c14]
sar dl, 0xa4
lea ebp, [ebp + eax - 0x5d18002f]
not dword [esp + ecx - 0x25]
push eax
pop eax
pop eax
pop ecx
jne fcn.00caa7a7
mov edx, dword [ebp]
mov eax, 0x1da4952f
mov ecx, eax
movzx cx, byte ss:[edx + eax*4 - 0x769254bc]
ror eax, 0x6f
movzx edx, ax
neg eax
lea ebp, [ebp + edx*8 - 0x1da46]
dec dl
setb al
mov word [ebp + edx*4 - 0xed20], cx
btr edx, edx
add al, al
jae 0xd973c1

Function at 0xd48b5d
Capabilities:
Encode data using base64

Disassembly:
add esi, 4
call fcn.00d54c6f
push 0x720e3218
mov edx, dword [esp + 1]
call fcn.00d5868a
Function at 0xd4c218
Capabilities:
Encode data using base64

Disassembly:
push edx
dec eax
push ecx
rol eax, 1
and dword [esp + ecx - 0x73f372a4], edx
dec byte [esp + ecx - 0x73f372a4]
rol word [esp + ecx - 0x73f372a0], 0x62
neg eax
shr edx, cl
rol dl, 0x64
lea eax, [eax + ecx + 0x421194e9]
sub dx, cx
jle 0xd5f442
mov ecx, 0xe91a9009
movsx eax, cx
movzx eax, byte [edi]
add edi, 1
mov edx, ecx
and edx, edx
neg edx
xor al, bl
jmp 0x982c63
xor ecx, ebx
xor eax, 0x853c74a0
sal al, 0xc7
not ecx
neg eax
lea ecx, [ecx + edx - 0x25d3f0f7]
jl 0xcda554
bswap ecx
inc ecx
lea edx, [edx + edx + 0x5585de30]
bswap ecx
ror ecx, 3
xor ebx, ecx
jmp 0xcd2b9f
movzx eax, byte [ebp + edx - 0x5aadcef2]
lea ecx, [edx + edx*2 + 0x24b0378a]
dec dx
lea ebp, [ebp + ecx*2 - 0x697348bf]
btr ecx, ecx
ror edx, 5
xor al, bl
dec edx
xchg ecx, edx
add ecx, ecx
sbb al, 0xb1
jmp 0xdc8f9e
add edi, ecx
bswap eax
jmp 0x9659b7
call fcn.00ccc7d9
mov ecx, 0x928709b3
movzx eax, cx
mov edx, dword [eax + edi - 0x9b3]
neg al
jae 0x964c90
lea edi, [edi + eax*4 - 0x2530]
push ecx
jns 0x98e5e8
mov ecx, 0xe5085316
and cl, 0x3e
mov ecx, dword [ebp]
mov eax, 0xf9151eb3
movzx edx, al
lea ebp, [ebp + edx*2 - 0x162]
xor ecx, ebx
not ecx
dec ecx
rol ax, 0x8e
lea eax, [eax - 0x146b0d43]
neg ecx
and dl, 0x22
not ecx
xor ecx, 0x3912c0d
shr dl, 4
rol ax, 0xec
xor ebx, ecx
rol al, 0xe5
shl dl, 0x44
lea edx, [eax + 0x2d17878a]
adc edi, ecx
bswap edx
add ax, 0x5b09
call fcn.00d279ab
bswap ecx
mov eax, 0x8f39f98a
rol edx, 0x44
dec ecx
xor ebx, ecx
add esi, ecx
lea ecx, [eax*4 - 0x785ebde7]
bt cx, 0x9e
movzx eax, byte [edi]
adc edi, 1
xor al, bl
rol dx, cl
and dword [esp + 4], ecx
sar dword [esp + 2], cl
neg al
add al, 0xb3
add dl, 0xc
call fcn.00990524
mov edx, 0x1f9a061b
mov edx, dword [esi + edx*4 - 0x7e68186c]
mov ecx, 0x32986d16
lea eax, [ecx + ecx*4 - 0x1eb32fc]
mov cx, word ss:[edx + ecx*2 - 0x6530da2c]
cbw
lea edx, [eax + eax*8 - 0x6ed23573]
lea esi, [esi + edx - 0x64abce8d]
not al
or eax, 0x752c3d3e
mov word [esi + edx - 0x64abce8f], cx
mov ecx, 0xd89f4134
not edx
inc dl
mov eax, dword [edi]
adc ecx, edx
lea edi, [edi + ecx - 0x73f372a1]
btc edx, edx
xor eax, ebx
not dl
jmp 0x962d40
inc cx
neg ebp
dec ebx
inc cx
sal esp, 0x21
not ebx
dec edx
mov dword [esp + ebp*8 - 0x298406d8], esi
inc edx
xor dword [esp + ebp - 0x53080db], ebx
inc ebp
add al, ch
pop esi
dec eax
arpl bx, bx
dec ecx
shl eax, 0x6b
call fcn.0096e480
inc eax
movzx edx, ch
popfd
push esi
push ebp
dec esp
lea edx, [edx + ebp*8 + 0x379c0fa9]
dec esp
mov edx, dword [esp + ebp - 0x430ac20a]
movzx eax, bp
dec esp
lea edi, [eax*2 - 0x59664cfa]
xchg word [esp + ebp - 0x430ac214], ax
dec esp
mov ecx, dword [esp + ebp - 0x430ac202]
jmp 0xd21b35
pop edx
xor ebx, eax
add ebp, eax
mov dword [esp + ecx - 0x73f372a5], ebp
ret
xor al, 0x2a
inc cl
shl dx, 0xe5
ror al, 1
dec cx
not al
call fcn.00d88e48
Function at 0xd4c573
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esi + 4]
adc esi, 8
mov eax, 0x5b96a49f
call fcn.00ce11e7
inc ecx
push esi
mul word [esp + edx*2 - 0x3c14ebf6]
dec eax
mov dword [esp + edx*2 - 0x3c13fffc], esi
inc cx
adc edi, 0x8d4cfb3a
cmp al, 0xc5
add al, 0xd8
lodsd eax, dword [esi]
mov cl, 0x42
xor dword [esp + edi - 0x3e6e1cbc], ecx
dec edx
mov esi, dword [esp + edi - 0x3e6e1cbc]
dec eax
arpl cx, cx
cwde
inc ecx
pop edi
dec edx
lea edi, [0xab8ae3e]
dec esp
add ecx, ecx
inc ecx
push esi
inc ebp
movzx edi, word [ebx + edx*4 - 0x78280004]
dec esi
lea ebx, [edx + ebx - 0x1e09fffc]
movzx ebp, dx
mul eax
inc sp
xor edi, esi
dec eax
mov dword [esp + edx*8 + 8], edi
rol edi, 0xee
idiv ebp
inc cx
dec edi
ror ax, 0xe4
inc cx
rol edi, 1
xchg dword [esp + edx + 5], edx
cwde
inc cx
xor edi, 0xacc14089
pushfd
pushal
sub esi, edi
call dword [eax + 0x66f8f641]
inc ecx
inc edi
add eax, ebx
inc cx
xor esi, edi
inc ecx
mov ebp, 0x2246ca2
dec eax
bswap eax
inc bp
mov dword [edx + edx - 0x5600000a], edi
or word [esp + ebx*2 - 0xeb4f], 0xc211
inc ecx
pop eax
dec ebp
lea edx, [edx + edx - 0x5600000a]
pop ecx
jle fcn.0098d067
mov cx, word [eax + ecx - 0x4f9b7b9]
call fcn.0095b61f
mov esi, 0x8d277214
lea ecx, [esi + esi*2 - 0x73c7f0]
mov edx, ecx
movzx eax, byte [edi]
xor al, bl
ror al, 1
movzx edi, dx
inc al
ror al, 1
xchg esi, edx
dec ecx
sub al, 0xaf
bt esi, edx
neg edx
sub edi, esi
xor bl, al
not edx
add eax, esp
xadd cx, si
sar si, 0x27
ja 0xd29ddb
mov edx, dword [eax + edi - 0x58fe0000]
movzx eax, si
mov dword [ebp + eax*2 - 0x1fe3c], edx
mov edx, dword [ebp + eax*4 - 0x3fc74]
ror edi, cl
mov edi, edx
dec esi
mov esi, ebp
xor ecx, eax
jnp 0xddffd6
jl 0xccae3a

Function at 0xd4c604
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x80], 0x76af4408
neg al
ror al, 1
not dx
sar byte [esp + ecx - 0x7d], 0x21
xor bl, al
btc edx, edx
lea eax, [esp + eax + 4]
dec ecx
mov cx, word [eax + ecx*2 - 0xfe]
lea eax, [edx + edx*8 + 0x36942c24]
xor byte [esp + eax*2 - 0x6d1f5dd4], 0x35
mov word [esi + eax - 0x368faeed], cx
mul eax
mov ecx, dword [edx + ebp - 0xba0ee6f]
sar al, 0xa1
btc ax, 0x3d
pop edx
lea ebp, [edx + ebp - 0x3b9a4403]
xor ecx, ebx
not ecx
dec dx
sub edx, eax
rol ecx, 2
mul ax
bts eax, edx
dec eax
not ecx
adc dx, ax
ja 0xd8d364
rol dword [esp + ecx - 0x1124d800], 0x33
mov dword [esp + ecx - 0x1124d800], edx
dec eax
inc byte [esp + ecx*4 - 0x44936000]
xor dl, dl
xor cx, cx
neg eax
shl ecx, 0xc9
lea eax, [ecx + eax + 0x4a84e1ad]
bswap eax
sal dword [esp + ecx - 0x48000000], 0x8d
adc word [esp + ecx - 0x47ffffff], cx
rol dl, 0x42
ror eax, 2
xor ebx, eax
inc byte [esp + ecx - 0x47fffffd]
bts dx, dx
mov dword [esi + ecx - 0x47fffffe], eax
not edx
rol cl, 0xc7
lea esi, [ecx + esi - 0x47fffffe]
push ecx
inc dl
movsx eax, dx
mov edx, dword [edi + ecx - 0x47fffffc]
sub al, 0x16
call fcn.00ca2ed4
call fcn.00972944
test esp, ebx
mov dl, 0x2a
aam 0x1d
mov byte [0xf41b77ea], al
lodsd eax, dword [esi]
lcall 0x3ab9, 0xc81b77ea
ljmp 0xea72
xor ecx, 0xec19229a
call fcn.00957982
Function at 0xd4db84
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov esi, dword [esp + ebp*4 - 0x3ffa4]
inc ecx
sub edi, edi
dec eax
arpl bx, bx
jle 0xca686b
add byte [eax], al
inc edi
je 0x964f21
je 0x964f34
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[edx - 0x3f64d5df], bh
movzx edi, dl
inc ecx
mov edx, dword [ebx + edi - 0x21]
dec ebp
lea ebx, [ebx + edi - 0x1d]
dec esp
lea eax, [edi - 0xb5af2d9]
call fcn.00cb67da
inc ebx
mov dword [eax + ebp - 0x3d1dcba6], eax
inc ecx
mov edx, ebp
inc eax
movzx eax, ch
inc ebx
mov ebp, dword [ebx + ebp - 0x3d1dcba6]
rol al, 1
dec esi
lea edi, [edi + ebp*8 + 0x57b3689d]
dec esp
lea eax, [edi*2 - 0x4fd8d58]
dec edi
lea ebx, [ebp + ebx - 0x3d1dcba2]
sbb eax, 0xc2e2345e
sbb edi, 0xb60b3aa9
dec ecx
bswap edi
xor ebp, esi
xor ebp, 0x10359f2c
jmp 0xe68d54
lahf
xor eax, 0x3e18e910
push eax
add byte [edi], cl
mov dh, 0x4f
invalid
shl dword [esp + ebp - 0xffdd], cl
inc dx
xchg dword [esp + ebp*8 + 0x14], eax
dec esp
add ecx, ebx
dec eax
shl eax, 0xfe
ja 0xcf44d6
inc ecx
pop edi
pop edi
pop eax
inc ecx
pop edi
jae fcn.0098d067
dec edx
mov dword [esp - 0xc08f], ebx
dec edi
lea edx, [edx - 0xc089]
xadd dword [esp + ebp - 0x6b16c08e], ecx
inc bx
mov dword [edx - 0xc08f], edi
mov eax, 0x5404eca4
inc ecx
mov ebp, 0x54ac4c8f
inc ebp
mov ebp, dword [ebx + ebp - 0x6b16c08f]
or byte [esp + ebp - 0x6b16c089], 0xae
dec eax
shl eax, 0x52
dec eax
lea edi, [eax + ebp*8 - 0x3943dce0]
dec esi
lea ebx, [ebp + ebx - 0x6b16c08b]
xadd word [esp + ebp - 0x6b16c089], di
dec esi
xchg dword [esp - 0x60478], esp
inc esp
xor ebp, esi
inc ecx
ror ebp, 3
inc ecx
xor ebp, 0xb42a608d
inc dword [esp + ecx - 0xffffff]
inc ecx
dec ebp
inc ecx
neg ebp
inc ecx
xor ebp, 0x7a8c4f1d
dec eax
cwde
inc ecx
neg ebp
dec eax
mov dword [esp + ecx - 0xffffff], esi
inc esp
xor dword [esp + ebp - 0x6b16c08f], ebp
pop esi
dec ebp
arpl bp, bp
inc eax
xor bl, ch
neg cl
dec ecx
neg esp
dec ebp
add ecx, ebp
inc esp
movsx eax, bh
inc ecx
jmp ecx
xor ebx, 0xd5b13780
dec ecx
shl ebp, 0xbd
sal dword [esp + ebp - 0xffd5], 0x98
dec cl
dec eax
mov dword [esp + ebp*2 - 0x1ffc6], esi
imul bp
inc ebp
movzx edi, si
xor dword [esp + ebp*2 - 0x1ffc6], ebx
cdq
xchg word [esp + ebp - 0xffdb], dx
jmp 0x964eb4
dec ax
dec ebp
lea ebx, [ebx + ebp*2 - 0x1ffd7]
mov edi, edx
jo 0xd02e56
xor ebx, esi
cdq
rol ecx, cl
rol ebx, 1
dec esp
mov dword [esp + ebp*2 - 0x1ffde], esp
imul di, ax
inc esp
and ah, byte [esp + ebp*2 - 0x1ffc5]
neg ebx
lea ebx, [ebp + ebx - 0x4f9483a1]
inc ecx
bswap ebp
sar dword [esp + ebp - 0xffe4], 0xa9
jb 0xd0ecad
inc eax
not bh
inc edx
lea ebp, [ebp + eax*2 - 0x7d335296]
ror ebp, 3
not ebp
inc esp
xadd bh, al
sets al
push esi
push edx
inc edx
xor dword [esp + ebp - 0x3d1dcb9e], ebp
sal dword [esp + eax + 1], 0xaa
mov esi, 0x5c026715
dec eax
mov esi, dword [esp + edi - 0x49f5786c]
dec eax
arpl bp, bp
cwde
dec esp
adc ecx, ebp
dec eax
cdq
dec esi
mov dword [esp + ebp*2 - 0x7a3b974c], ecx
ret 8
Function at 0xd4fbfe
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0xcb8b810
mov eax, dword [ebp + ebx*4]
jmp 0x985dea
add byte [edx + 0x66], 0x23
ror byte [ebx + 0xe8c8ac8], 0xe9
cmp byte [ebp - 0x43], 0x66
bt eax, eax
lea esi, [esi + eax - 0x42827d17]
sbb al, ah
and dl, cl
rol eax, 0xfd
not dl
mov word [esi], dx
lea edx, [eax*8 + 0x7195db88]
xadd dl, ah
cwd
mov eax, dword [edi]
adc edi, 4
jmp 0x98edad
push 0x4baffa30
call fcn.0099235f
test dword [0xe9ce2578], edx
push esi
mov edx, 0xe9c7901a
jle 0x985daa
add dl, byte [eax - 0x5d811639]
push es
nop
invalid
movsx ecx, dl
shl dl, 0x21
xor eax, ebx
sub edx, ecx
sal dx, 0xed
inc ecx
sbb eax, ecx
dec edx
rol eax, cl
rol ecx, cl
sbb eax, 0xf81f1d31
neg ecx
rol ecx, cl
sbb cx, cx
xor eax, 0xb5193612
sar ecx, cl
btc cx, cx
ror dx, 0xf
xor ebx, eax
add ebp, eax
sal ecx, cl
xadd dl, dh
jmp ebp
lea esp, [esp + 0xc]
jne 0x97d9a5
mov eax, 0x9d859f16
cbw
mov eax, dword [ebp]
jmp 0xd2f0aa
shr byte [esp + 6], 7
dec ebx
push 0x2500a411
jmp 0xcf0c4a
Function at 0xd4fe99
Capabilities:
Execute anti-debugging instructions

Disassembly:
mul ecx
mov dword [ebp], edx
mov ecx, 0x6e2a5e0b
lea edx, [ecx*8 - 0x7dd0fd5d]
sar ecx, cl
mov dword [ebp + ecx - 0xdc547], eax
mov eax, 0xe2bdaabb
jp 0xc7dda9
xor eax, 0xb3183023
mov dword [esp + edx - 0x76d17fff], edx
ror ecx, cl
xor ebx, eax
add ebp, eax
dec dword [esp + edx - 0x76d17fff]
movsx eax, dl
cwde
rdtsc
dec ecx
jno 0xddd922
mov ecx, 0x5eaae10e
push ecx
movsx eax, word [esp + ecx - 0x5eaae10c]
dec ecx
mov ebp, dword [edx + ecx - 0x5eaae10e]
add dword [esp + ecx - 0x5eaae10c], 0xd39b8729
dec dword [esp + ecx - 0x5eaae10e]
call fcn.00d35d08
add byte [eax], al
inc esi
jb 0xd4ff56
inc ebp
outsb dx, byte [esi]
jbe 0xd4ff5f
jb 0xd4ff67
outsb dx, byte [esi]
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0xd4ff51
je 0xd4ff72
imul ebp, dword [esi + 0x67], 0xb8005773
adc ch, 0xaa
sbb ecx, dword [ebx + 0x7bc8dd0]
jp 0xd4ff3c
push ebp
in al, 0x66
bt edx, eax
mov edx, dword [edi + eax*4 - 0x6eab5608]
sal eax, 0x1b
xor edx, ebx
add al, ah
jge 0xd8cb98
pop eax
in eax, 0xb2
sub ah, byte [ecx + 2]
not ebx
ja 0xd4ff51
int1
jle 0xd4ff00
sal dword [edi + 0x1b], cl
loope 0xd4ff42
scasd eax, dword es:[edi]
sal dword [edi + 0x1b], cl
test dword [edx + 0x77], ebx
sal dword [edi + 0x1b], cl
cmp eax, 0x77d3474c
sbb edx, dword [ecx - 0x14]
outsd dx, dword [esi]
sal dword [edi + 0x1b], cl
popal
shl byte [edi - 0x66e4882d], 0x66
xlatb
cmpsd dword [esi], dword es:[edi]
sal dword [edi + 0x1b], cl
cdq
xlatb
pop ds
jge 0xd4ff7c
sbb al, 0xda
push ebx
mov eax, dword [0xa534e4aa]
ficom dword [ebx - 0x5f]
stosb byte es:[edi], al
in al, 0x34
movsd dword es:[edi], dword [esi]
xor al, 0xa5
mov dword fs:[0xffffffff], eax
add dword [ebx], esi
out 0x4c, eax
jecxz 0xd4ff65
mov cl, 0x2b
mov cl, 0x2b
xlatb
mov ebx, 0x84a934a6
invalid
mov ecx, 0xfa4250a6
fnsave dword [ecx]
inc ebx
mov esi, 0x3fafb83c
xlatb
sub al, 0x90
mov dh, 0xf0
cmp al, 0xd5
lcall 0xc06a, 0xd72a72d6
sar byte [edi], cl
cmp eax, dword [eax]
add byte [eax], al
push edx
or ah, byte [esi - 0xe]
push es
sub eax, 0x3cf02e31
fstp dword [ebx + 0x76]
push ds
inc ebp
push ebx
sbb ebp, 7
movsx ecx, al
sub dword [esp], edx
pop ecx
jbe fcn.00caa7a7
neg dword [esp + 4]
lea ecx, [eax + eax - 0x68fb0343]
neg edx
dec edx
ror cl, 0xe2
ror edx, 2
shr ecx, cl
sub cx, cx
xor edx, 0xb3183023
inc cx
xor ebx, edx
add ebp, edx
not cx
not cl
rdtsc
call fcn.00c977b5
neg byte [esp + 3]
ror ecx, 1
movzx eax, dx
or ax, word [esp + eax - 0xffd1]
not ecx
xor eax, 0x943f22a5
or dx, 0x351f
jns 0xdc5025
inc ecx
idiv al
neg eax
xor ecx, 0x4a27de9c
add eax, eax
adc ecx, 0x11b48f29
or byte [esp + 1], 0x8f
bswap ecx
sub ax, word [esp + 2]
sar dword [esp], 0xcb
xor ebx, ecx
sub dword [esp], edx
mov dword [ebp - 8], ecx
jl 0xd7855d
xadd cl, ch
shl cl, 0x23
mov ax, word ss:[edx + eax - 0x139d8d0b]
movsx edx, cx
bts ecx, ecx
adc esi, 1
call fcn.00d37f2d
sub esi, 8
sub word [esp + 2], cx
mov dword [esi + 4], eax
mov dword [esi], edx
bt ecx, 0x3f
movzx eax, word [esp]
pop eax
jb fcn.00d5d32b
jmp 0xcce670
Function at 0xd526fd
Capabilities:
Encode data using base64

Disassembly:
adc esi, 4
div ecx
mov dword [esi], edx
neg dword [esp + 4]
mov dword [esi + 4], eax
pop ecx
pop edx
jmp ebp
sbb byte [esp + ecx - 0x1d], al
xor edx, 0x17174e88
shr cl, 0x43
ror edx, 1
xor ebx, edx
add ebp, edx
mov edx, dword [esi + ecx - 3]
mov eax, dword [esi + ecx*2 - 2]
or ecx, ecx
mov ecx, dword [esi + ecx*2 + 2]
shl byte [esp + 1], 0x23
push 0x7aa5aa00
jp 0xca0e99
mov eax, 0xd52d9939
mov ecx, 0x40a0b383
inc ecx
mov edx, dword [ebp + ecx - 0x40a0b384]
lea ebp, [ecx + ebp - 0x40a0b380]
push ecx
shr ecx, 0x33
dec dword [esp + ecx*4 - 0x2050]
xor edx, ebx
shl cl, 0x24
pop eax
bts ax, 0x82
rol edx, 2
inc ecx
and ax, ax
neg edx
not edx
btr cx, ax
lea edx, [edx + eax - 0x38690765]
xor ecx, ecx
xor eax, ecx
xor ebx, edx
add edi, edx
add ax, cx
rol cl, 0x63
add ecx, dword [esi + eax - 0x40a0b387]
mov eax, dword [eax + esi - 0x40a0b383]
mul ecx
mov dword [esi], edx
mov ecx, 0x90994a3a
mov dword [esi + 4], eax
jmp edi
or ax, ax
lea edi, [edi + ecx - 0x44390ea8]
xadd cx, ax
adc ecx, ecx
neg ecx
xor edx, ebx
bts eax, eax
dec cx
xor cx, cx
xor edx, 0xf985c183
mov dword [esp + ecx - 0x778c0000], ecx
shl cx, 0xa8
sbb edx, 0x2c356522
shr ecx, 0x1a
jb 0xccc63a
Function at 0xd57b57
Capabilities:
Encode data using base64

Disassembly:
fadd qword [edx + esi - 0x62e21415]
mov eax, dword [edx + edi - 0x62e21415]
dec edx
lea edi, [edi + edx - 0x62e21410]
xor cx, dx
xor eax, ebx
and edx, 0x79af3c2d
sbb eax, 0x5f2f8714
ror eax, 2
call fcn.00cde4d2
mov ecx, 0xe894b02e
inc ecx
movzx ebx, byte [ebx]
inc ecx
mov esp, 0x513b5d0d
inc ebp
movsx ebp, sp
inc eax
xor bl, dh
dec ebp
lea edi, [ebp - 0x4459faed]
rol bl, 1
inc cx
add esp, 0xb60f79ae
rol dword [eax - 0x574ca25], 1
inc ecx
inc edi
neg bl
inc esp
movsx esi, dx
inc esp
xchg ecx, esp
movsx ebp, cx
rol bl, 1
inc eax
xor dh, bl
dec eax
add ebx, esp
inc ecx
not ebp
inc cx
rol edi, 0xc
dec eax
mov ebp, dword [ecx + ebx - 0x513bd6bb]
dec eax
imul ecx, edx
inc ebp
mov eax, edi
dec ecx
mov dword [edx + edx - 0x36], ebp
inc eax
movsx eax, bh
jno 0xd8d4da
mov ecx, 0xdc287d01
lea edx, [ecx*4 + 0x65130aac]
mov eax, dword [ebp]
call fcn.00daaf58
or ax, word [ebp + eax*8 + 2]
mov edx, 0x6c08eda2
bt edx, edx
lea ebp, [ebp + edx - 0x6c08eda0]
adc cx, ax
movsx eax, word [esp + edx - 0x6c08eda2]
shl byte [esp + eax*8 - 0x2affd], 0x64
sar dx, 0xa6
mov word [ebp + eax*4 - 0x15800], cx
mov dword [esp + edx - 0x6c08ffb6], esi
ret
mov dword [esi + ecx - 8], edx
xor dword [esp + ecx - 8], eax
adc ecx, dword [esp + ecx*4 - 0x20]
cbw
pop edx
jnp fcn.00d5d32b
mov ecx, 0xc6974233
inc ecx
mov ecx, dword [ebx]
dec ecx
add ebx, 4
inc ecx
mov esi, 0xee143511
xor ecx, esi
rol ecx, 2
jmp 0xdab8e0
xor ebx, edx
bt ecx, 0x8b
push ecx
adc esi, edx
mov cx, word [ebp + eax*8]
jmp 0x96668d
xor ebx, edx
lea esi, [esi + ecx*2 - 0x14]
jmp 0xce0ba5
add ebp, ecx
or edx, 0x263ba796
cdq
cdq
sbb edi, 4
shr eax, 0xd4
setns dl
imul eax, edx
mov edx, dword [edi]
lea eax, [eax*2 - 0x55488ac7]
cbw
xor edx, ebx
lea edx, [edx + eax - 0x1be8e68f]
bswap edx
mov dword [esp], eax
movsx ecx, al
sub edx, 0xa6369b20
or eax, ecx
sar ecx, 0x24
bswap edx
jnp 0xda98f3
inc ecx
mov edi, dword [ebx + edx - 0x2d]
inc ecx
movsx ebx, ah
xor edi, esi
call fcn.00d5b54c
ror edx, 1
add cx, ax
setl cl
xor edx, 0xebb81e06
sar eax, 0x75
or eax, eax
jno 0xce1861
rol ecx, cl
not edx
jnp 0xd1164b
add byte [eax], al
add byte [edi + 0x65], al
je 0xda995b
imul ebp, dword [esi + 0x64], 0x4344776f
add byte [esi - 0x3f], ah
jmp 0xfa05ff18
call fcn.00d47b39
mov ecx, 0x8b06f6b8
lea edx, [ecx + ecx*8 + 0x7fa3679d]
jmp 0x964b30

Function at 0xd65fd1
Capabilities:
Encode data using base64

Disassembly:
shr dx, 0xe6
neg dx
dec eax
sal cl, 0x41
mov dword [esp + ecx*2 - 0x54], ecx
neg edx
bswap eax
and cl, cl
not edx
xor ebx, eax
add edi, eax
mov eax, dword [esi + ecx*2 - 0x54]
mov edx, dword [esi + ecx*2 - 0x50]
or cl, 0xbf
mov cl, byte [esi + ecx - 0xb7]
rol dword [esp], 3
push 0x17a3fba0
dec byte [esp + 6]
adc esi, 6
call fcn.00cae47a

Function at 0xd6ae40
Capabilities:
Authenticate hmac

Disassembly:
mov edx, 0x441526b2
sub ecx, 0x6fa04e1c
neg ecx
sal dl, 0xe5
dec ecx
sal ax, 0x87
xor ebx, ecx
mov dword [esp + edx - 0x44152640], eax
and dword [esp + edx - 0x4415263e], 0x86ad32bf
adc ebp, ecx
btr edx, edx
pop ecx
pop ecx
pop edx
jae fcn.00d5d32b
Function at 0xd73b13
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + ebx*4]
push 0x192ecaac
mov dword [esp + 4], eax
sar dword [esp], 0x77
sar dword [esp], 0xe
dec ebx
push 0xc29cd8f
jmp 0xd45bdc

Function at 0xd76320
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea edx, [edx + ebp - 0x42acb5f6]
xor edx, ebx
rol cl, 0x27
adc ecx, eax
sbb edx, 0x858e9539
add eax, eax
cbw
div al
rol edx, 3
xor cx, 0x9a83
imul cx, cx
call fcn.00db6823
inc cx
sub ebp, 0x6348e609
leave
not ax
jne 0xdd83d6
dec edi
lea ebx, [ebp + ebx - 0x76681dfb]
inc esp
movzx esp, dx
sal dx, 0xe7
xor ecx, esi
dec eax
mov dword [esp + edx - 0x42ac9c00], edx
dec esp
xchg dword [esp + edx - 0x42ac9c00], ebp
rol dword [esp + edx - 0x42ac9c00], 0x45
inc edx
lea ecx, [ecx + ebp*2 + 0x5fc44b34]
neg ecx
inc esp
movzx eax, bp
dec ecx
ror ecx, 2
mov eax, 0xd63d1630
cbw
bswap ecx
dec edx
mov dword [esp + ebp - 0x42ac9c00], esi
dec eax
ror edx, 0x2a
inc sp
add eax, ebp
inc esp
adc ebp, edx
inc edx
xor dword [esp + eax - 0xfe44], ecx
inc ecx
xadd eax, edx
pop esi
inc esp
xadd ch, ah
jne 0xd57b45
mov edx, 0xb031578f
movsx eax, dl
mov edx, dword [edi]
add edi, 4
movsx ecx, ax
jmp 0xcef7cb
inc ecx
movzx ebx, ah
dec esp
add ecx, ecx
dec ecx
lea ebp, [eax + ebx*4 + 0xb1407a2]
inc eax
sal ch, 2
inc di
mov esi, dword [ebp + edx - 0x42acb5f8]
jb 0xc7347e
Function at 0xd777ba
Capabilities:
Encode data using base64

Disassembly:
ror edx, 3
add cx, 0x629f
dec ecx
xor ebx, edx
sal ecx, 0xfa
adc edi, edx
mov edx, dword [esi + ecx - 0x78000004]
push ecx
xchg dword [esp + ecx - 0x78000000], ecx
mov eax, dword [edx + ecx - 0x78000000]
sal dword [esp + ecx - 0x77fffffe], 0x88
mov dword [esi + ecx - 0x78000004], eax
push ecx
pop ecx
lea esi, [esi + ecx - 0x78000004]
mov eax, dword [esp + ecx - 0x77fffffc]
dec dword [esp + ecx - 0x77ffffff]
sar cl, 0xa7
pop ecx
pop edx
je fcn.0096f6cc
inc ecx
mov eax, dword [edx]
mov ebx, 0xd305838d
inc esp
movsx ebp, bx
inc ebp
movzx ebp, byte [ebx]
dec eax
lea ebp, [ebx + 0x6687fb23]
inc esp
movsx edi, bp
inc ebp
mov esi, edi
inc esp
xor ch, dh
inc ecx
inc ch
dec eax
lea edx, [ebp*8 + 0x2e8eaf1c]
inc ecx
neg ch
inc ecx
xor ch, 0xb1
inc ebp
movzx eax, dh
inc ecx
dec ch
inc ecx
movzx ecx, al
dec eax
not edx
dec eax
lea ebx, [ebp + edx*2 - 0xadd35cd]
inc ecx
rol ch, 1
dec ecx
shr eax, cl
inc ecx
xor dh, ch
inc ecx
imul ebp, edi
dec esp
add ebp, esp
inc ebx
mov dword [ebp + edi*2 - 0xfd60], eax
inc sp
and eax, ebp
dec ebx
mov edi, dword [edx + edi - 0x7eac]
dec eax
imul ebx, ebp
inc eax
inc ch
dec esp
adc eax, edx
dec ebp
lea edx, [edx + ebp - 0x35a1b8f5]
inc esi
movzx ebp, byte [ebp + ebx - 0x35a1b900]
inc esp
adc eax, ebx
inc ecx
setb bh
dec ecx
bswap edi
inc esp
xor ch, dh
inc ecx
rol bh, 0x86
inc cx
inc esi
inc ecx
movzx eax, al
inc ecx
not ch
neg ebp
dec eax
xchg ebx, eax
inc ecx
sbb ch, 0x2d
dec eax
bswap eax
inc ecx
rol ch, 1
inc ecx
push eax
call fcn.00d33e7c
mov dword [esi - 4], edx
mov dword [esp], 0xb8960abe
jae 0xdb0418
mov edx, dword [ebp + 1]
rol ecx, 0xc9
pop eax
lea ebp, [ebp + ecx - 0x6b2b5da5]
xor edx, ebx
imul ecx, eax
sal cx, 0x84
xchg ecx, eax
not edx
setnp cl
lea edx, [edx + eax - 0x70b47b56]
btc eax, eax
sal cx, 0x44
sal eax, 0x62
bswap edx
inc edx
neg eax
or eax, ecx
push ecx
bswap edx
or ecx, dword [esp]
jne 0xcbeb72

Function at 0xd7b769
Capabilities:
Encode data using base64

Disassembly:
movzx eax, di
dec edi
lea edx, [eax + edx - 0x2d39f8bf]
inc esi
or dword [esp + eax - 0x2d39f8ac], eax
pop ebp
inc bx
mov dword [edx + eax - 0x2d39f8bd], ecx
inc edx
mul dword [esp + eax*2 - 0x5a73f177]
inc ecx
pop ebp
inc ecx
pop edi
jno fcn.0098d067
call fcn.00cb9fab