joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ffc87
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1012189c
push 0x10121894
push str.FlsAlloc
push 0x1f
call fcn.100ffab2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100ffcbb
push dword [ebp + 8]
mov ecx, esi
call dword [0x10118334]
call esi
jmp 0x100ffcc1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100ffd05
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101218ac
push 0x101218a4
push str.FlsGetValue
push 0x21
call fcn.100ffab2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100ffd3c
push dword [ebp + 8]
mov ecx, esi
call dword [0x10118334]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100ffd44
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101218b4
push 0x101218ac
push str.FlsSetValue
push 0x22
call fcn.100ffab2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100ffd7e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10118334]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x100ffe1c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.GetTempPath2W
push 0x10121754
push str.GetTempPath2W
push 5
call fcn.100ffab2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100ffe56
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10118334]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetTempPathW]
Function at 0x1010830f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x101083ac
push ebx
push esi
call fcn.101082d8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10106701
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10108359
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x101083ab
push edi
push eax
call fcn.100ff762
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10108379
call fcn.100fc54d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x101083aa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10106701
add esp, 0x20
test eax, eax
jne 0x10108398
push edi
call fcn.100fc54d
jmp 0x101083a0
push ebx
call fcn.100fc54d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x101083af
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x101083c0
pop esi
ret
push ebx
push edi
push esi
call fcn.101082d8
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100ff762
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x101083e8
push ebx
push esi
push edi
call fcn.100d3260
add esp, 0xc
push 0
call fcn.100fc54d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10108b42
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1010865d
Function at 0x1010d113
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100fccf2
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1010d182
cmp esi, dword [ebp - 4]
je 0x1010d17d
cmp dword [ebp + 0xc], 0
je 0x1010d17d
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1010d15a
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1010cc65
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1010d184
xor eax, eax
inc eax
jmp 0x1010d184
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1010d1e9
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10138018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100fccf2
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100fccf2
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1010d260
cmp word [ecx], dx
je 0x1010d260
mov eax, dword [0x10122704]
push edi
dec eax
push eax
push 0x101225f0
call fcn.1010d188
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1010d2d3
cmp word [eax], dx
je 0x1010d2d3
mov eax, dword [edi]
test eax, eax
je 0x1010d284
cmp word [eax], dx
je 0x1010d284
lea eax, [ebp - 0x10]
push eax
call fcn.1010cb6b
jmp 0x1010d28d
lea eax, [ebp - 0x10]
push eax
call fcn.1010cc06
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1010d2fd
mov eax, dword [0x101225ec]
push dword [ebp - 0x14]
dec eax
push eax
push 0x101222e0
call fcn.1010d188
add esp, 0xc
test al, al
je 0x1010d2fd
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1010d2c8
cmp word [eax], di
je 0x1010d2c8
lea eax, [ebp - 0x10]
push eax
call fcn.1010cb6b
pop ecx
jmp 0x1010d2ff
lea eax, [ebp - 0x10]
push eax
call fcn.1010cc06
jmp 0x1010d2c5
mov eax, dword [edi]
test eax, eax
je 0x1010d2ea
cmp word [eax], dx
je 0x1010d2ea
lea eax, [ebp - 0x10]
push eax
call fcn.1010cb20
pop ecx
jmp 0x1010d2fd
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1010d3c8
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1010d00d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1010d3c8
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1010d3c8
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1010d3c8
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1010d355
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100fff62
test ebx, ebx
je 0x1010d3c3
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100fff62
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1010d3c8
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1010d3c8
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100ea275
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1010d3ca
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008550c
leave
ret
Function at 0x101108c9
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10110845
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10110a38
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10110a38
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x101109ed
jg 0x10110925
test eax, eax
je 0x101109e3
push 1
push 0x1000
call fcn.100ff7b0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10110948
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x101109da
push 0x8000
push ebx
call fcn.10110776
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10110971
jg 0x1011096c
cmp ecx, 0x1000
jb 0x10110971
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.101034d3
add esp, 0x10
cmp eax, 0xffffffff
je 0x101109b6
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1011096c
jl 0x1011099d
test ecx, ecx
jne 0x1011095e
push dword [ebp - 0xc]
push ebx
call fcn.10110776
push esi
call fcn.100fc54d
add esp, 0xc
xor ebx, ebx
jmp 0x10110a46
cmp byte [edi + 0x24], 0
je 0x101109cd
cmp dword [edi + 0x20], 5
jne 0x101109cd
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x101109d8
mov ebx, dword [edi + 0x18]
jmp 0x101109da
xor ebx, ebx
push esi
call fcn.100fc54d
pop ecx
jmp 0x10110a46
test ecx, ecx
jg 0x101109af
jl 0x101109ed
test eax, eax
jae 0x101109af
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.101038f5
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10110a0d
cmp byte [edi + 0x1c], 0
je 0x101109af
jmp 0x10110a3e
push ebx
call fcn.1010b021
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x101109af
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10110a46
cmp byte [edi + 0x1c], 0
je 0x10110a43
mov ebx, dword [edi + 0x18]
jmp 0x10110a46
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.101038f5
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1033ba0c
Capabilities:
Authenticate hmac

Disassembly:
rol ecx, 0xa1
and ecx, 0xf0a200ab
adc al, dl
mov dword [esp + ecx - 0x10220009], ecx
dec byte [esp + ecx - 0x10220006]
xchg byte [esp + ecx*2 - 0x2044000f], cl
mov word [ebp + ecx*4 - 0x4088003c], ax
movzx edx, cx
xor edx, edx
inc dx
mov ecx, dword [ecx + esi - 0x1022000f]
xchg dh, dl
jl fcn.104132b4
jae 0x103af27c

Function at 0x1033fb41
Capabilities:
Encode data using base64

Disassembly:
mov ebp, dword [ebp + ecx*8]
or cl, ah
pop eax
pop edx
jp fcn.1045c6b7
Function at 0x10341840
Capabilities:
Encode data using base64

Disassembly:
movzx ecx, dl
mov edx, dword [ecx + ebp - 0xfe]
call fcn.103d35c7

Function at 0x103431cd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub edi, 4
mov edx, dword [edi]
mov ecx, dword [esp + 4]
push ecx
not ecx
xor edx, ebx
neg edx
call fcn.1039ce94
xor eax, ebx
push 0xb936cc9a
shl dword [esp], 0x9e
neg eax
shr dword [esp], 0x34
ja 0x103bf4cb
mov eax, 0x93817794
lea ecx, [eax + eax*4 + 0x46332a84]
lea esi, [esi + ecx*2 - 0x4f7500d4]
mov edx, dword [ecx + esi - 0x27ba8068]
xor edx, ebx
xadd ecx, eax
sbb cl, cl
call fcn.10403ca3
rol eax, 1
call fcn.1042b436
mov ecx, 0x40312d88
lea edi, [edi + ecx - 0x40312d8c]
mov eax, ecx
shr ecx, 0x39
mov ecx, dword [edi + ecx - 0x20]
rol eax, 6
and eax, eax
xor ecx, ebx
call fcn.10345872
lea ecx, [edx*4 - 0x605b5f62]
bswap eax
not eax
jmp 0x103a2942
mov edx, dword [edi + edx*2 - 0x1fa4a]
and ecx, 0x88ad69b5
mov eax, dword [edi + 4]
xchg byte [esp + 2], ch
adc edi, 4
dec ecx
neg ecx
add edx, eax
push ecx
inc dword [esp + ecx - 0x775bff7c]
sar cx, 0xe8
mov dword [edi + ecx - 0x775bffff], edx
lea eax, [ecx + ecx*2 - 0x38f707e3]
movsx edx, word [esp + ecx - 0x775bfffc]
rol cx, 0xaa
mov dword [esp + eax*2 - 0x5a39f034], ebp
ret 4
rol dword [esp + edx - 0x800], 0xd9
xor eax, 0x33a580a8
add dx, 0xf525
xor ebx, eax
sar word [esp + edx*2 - 0x1fa4a], 0x2c
xor cx, 0x811b
adc ebp, eax
sal word [esp + edx*2 - 0x1fa4a], 0x81
jno 0x103845c7
dec eax
mov ecx, dword [esp]
jmp 0x10426d6f
movsx edx, word [esp + ecx*2 - 0x1000]
xor eax, 0x161ad688
xchg dword [esp + edx*8 - 0x4000], ecx
jmp 0x10343da7
Function at 0x103553b2
Capabilities:
Encode data using xor

Disassembly:
neg eax
neg ecx
bswap eax
dec eax
sal word [esp + 5], cl

Function at 0x1036b2f5
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + eax - 0x7ab0f922]
mov ecx, dword [edi + eax - 0x7ab0f91e]
cmovge eax, dword [esp + eax - 0x7ab0f91a]
movzx edx, al
sub dword [esp + eax - 0x2c1], eax
xor ecx, ebx
inc dl
xor ecx, 0x630fc93
shr dword [esp + eax*2 - 0x580], 0x91
rol ecx, 1
dec edx
not edx
inc ecx
sal dl, 0x87
inc eax
xor ecx, 0xb2a71aa1
or dword [esp + eax - 0x2c0], 0xdcb69c1f
lea edx, [eax + edx*8 - 0x574719e2]
dec ecx
and edx, eax
xor ebx, ecx
shr word [esp + eax*4 - 0xb0b], 0xce
xadd al, dh
neg eax
add esi, ecx
mov dword [esp + edx*4 - 0x30f04], esi
ret 4
not cx
mov eax, 0x7ab0f91e
shr dword [esp + eax - 0x7ab0f91a], 0xd6
and ax, ax
or dx, cx
or eax, eax
mov dword [esp + eax - 0x7ab0f91e], eax
ja 0x1045bc90
in eax, 0xf
xchg edx, eax
ret 0xc1d0
mov word [eax + ebp - 0x7ab0f91e], dx
jns 0x103505ab
fidivr word [ebp + esi*8 + 0x4aef7d6e]
jle 0x1045bc5f
inc dword [ebx - 0x663b4216]
mov byte [edi + 0x4f70fa24], 0xa5
in eax, dx
inc eax
add byte [eax - 0x3b], dl
mov ch, byte [edx + edi*2 - 0x7854aded]
mov es, word [ebx]
xchg byte [ecx + 0x2153a3e7], ch
push ebp
out dx, al
mov ah, 0x95
xor dword [edx - 0x53e6eea7], esi
lea esi, [ebp + 1]
add eax, 0x606ac28d
movsd dword es:[edi], dword [esi]
out dx, eax
inc edx
invalid

Function at 0x103733ef
Capabilities:
Encode data using base64

Disassembly:
movsx edx, al
ror cl, 1
dec eax
neg edx
xor bl, cl
sar al, 0x25
xor ax, ax
lea ecx, [esp + ecx + 0x18]
sar edx, 0x8d
add al, byte [ecx]
mov ecx, 0x619e8f9a
lea ebp, [ebp + ecx - 0x619e8f9c]
sal cl, 0xc1
neg dx
adc ecx, ecx
mov word [ebp], ax
lea eax, [ecx - 0x46c49ddb]
sbb dword [esp + eax - 0x7c78807e], 0x400020aa
pop edx
pop ecx
pop ecx
pop ecx
pop ecx
pop edx
jno fcn.1039caee
Function at 0x10387cb5
Capabilities:
Encode data using xor

Disassembly:
mov word [edi + eax - 0x28d50090], dx
ja 0x1044482f
call fcn.103f05ad
mov ecx, 0x6021843e
movzx edx, cx
lea esi, [esi + edx - 0x8442]
lea eax, [ecx + edx*4 + 0x14a0b41e]
and cx, ax
jne 0x104034f9
jl 0x10387d18
out dx, eax
sal byte [0x2c2d2186], cl
retf 0xbdf2
mov fs, word [0xd0ca237d]
lodsb al, byte [esi]
mov ah, 0x51
leave
leave
mov byte [0xe6fd8cfd], al
and eax, 0x75051eb2
pop eax
invalid
mov eax, dword [esi + edx*2 - 0x1087c]
call fcn.1045d66b
push 0x3ca68309
pushfd
neg dword [esp + 4]
jge 0x1040351c
mov word [esp + 4], 0x980
or dword [esp + 4], 0xaca0a522
cmp dword [esp + 4], 0xc9ae2d2d
call fcn.10405de0
dec ebp
push es
push 0xffffffffffffffba
cli
jo 0x1040357e
xlatb
sbb edx, dword [ecx - 0x39545845]
mov ebp, 0x1cf3e96b
out dx, eax
xchg esp, eax
pushfd
xor byte [edx + 0x7f], cl
outsd dx, dword [esi]
fsub qword [esi]
pop es
loop 0x10403532
pop esi
mov edx, 0x390176b9
xor bh, byte [esi + 0x44]
das
cmc
int3
jnp 0x10403562
push edx
adc eax, 0xcb133fe1
aas
adc ecx, ebx
sub dword [esi - 0x1106ff01], eax
leave
aaa
outsb dx, byte [esi]
mov edx, 0x99cc3e76
sub dl, byte [eax - 0x2f6b913a]
aaa
xchg esp, eax
sal byte [edi], 1
jae 0x1040358e
jne 0x1040355d
loop 0x104035a6
and eax, 0xde59eaa6
cmpsb byte [esi], byte es:[edi]
sub al, 0x4f
invalid
mov byte [0x344ded64], al
mov byte [esi + 0x5a56aaae], bh
pop eax
adc dword [esi - 0x1b], esi
fistp qword [ebp + 0x43]
and esi, ecx
dec esp
adc al, 0xed
imul edi, edx, 0x4c
cli
dec esp
loope 0x10403577
into
movsb byte es:[edi], byte [esi]
popal
aam 0x51
into
sti
jp 0x1040359a
enter 0xffffffffffffc3ae, 0xe
cmp ah, byte [eax - 0x63f8fe7]
sar cl, 0x81
mov edx, dword [ebp + 4]
mov cl, byte [ebp + 8]
add ebp, 6
shld eax, edx, cl
push 0x56850434

Function at 0x1038c61b
Capabilities:
Authenticate hmac

Disassembly:
jle 0x1034405b
add ebp, ecx
mov edx, dword [esp + 8]
add edx, 0xfff6873d
jmp edx
neg edx
add cx, cx
bswap edx
lea edx, [edx + eax*4 - 0x5bfe88d6]
ror ax, cl
push eax
rol ecx, cl
rol edx, 2
add al, cl
lea eax, [eax*2 - 0x66f069de]
xor ebx, edx
or dword [esp], eax
sets cl
jno 0x1039ce61
adc eax, dword [edx + edi]
push edx
mov dword [esp + edx + 4], 0xb42adf9c
jmp 0x103b9ccc
mov ecx, dword [edx + eax]
add edx, edx
movsx eax, word [esp + edx*4 + 4]
add ax, ax
mov dword [edx + edi], ecx
jbe 0x103ea9b5
mov eax, 0x7b03abb0
and eax, 0x90bedfa5
lea esi, [esi + eax*4 - 0x400a2e84]
movsx ecx, ax
or ax, 0x2989
js 0x1043e889
add dword [esp + edx*4], esi
ret 4
mov edx, dword [esi + eax*4 - 0x400aaea4]
adc ecx, eax
xadd al, cl
xor edx, ebx
not al
and ecx, eax
adc eax, ecx
neg edx
neg cx
lea edx, [edx + eax*4 + 0x440ed3a8]
jle 0x100580ca
mov ecx, 0xd820662f
lea edx, [ecx - 0x45db3dd4]
sub edi, 4
shr cx, cl
call fcn.103b347a
Function at 0x10390575
Capabilities:
Hash data using murmur3

Disassembly:
mov cl, byte [edi + eax*2 - 0xd0d10fe]
adc al, al
lea edi, [edi + eax*8 - 0x34344006]
shr dx, cl
jmp 0x1040f00e
lea esi, [esi + eax - 0x1a892d21]
neg al
pop ecx
movzx ecx, byte [esi + eax*2 - 0x35125bc0]
jl 0x104147e0
mov edx, 0x3f959f3e
mov ecx, edi
lea eax, [edx + edx*2 - 0x41479e55]
lea edi, [edi + edx*2 - 0x7f2b3e7e]
xor eax, eax
call fcn.103bf7f2
jne fcn.1045c6b7
sub esi, 4
mov ecx, 0x701708b6
ror cx, 0xc9
mov eax, dword [esi + ecx - 0x70175b04]
xor eax, ebx
sar ecx, 0x17
movsx edx, cx
bswap eax
setp dl
shl edx, 0xd0
jbe 0x104124a3
mov word [eax + edi - 0x6868801], dx
lea ebp, [eax + ebp - 0x6868805]
mov edx, dword [ebp + eax*8 - 0x34344008]
movzx ecx, al
xor edx, ebx
neg edx
call fcn.1042234b
adc eax, 0xa1399830
not eax
bswap ecx
bswap eax
sal cl, 0xc4
shr edx, 0x43
rol eax, 3
neg eax
xor ebx, eax
add edi, eax
mov ax, word [ebp + edx]
sal dx, 0xa3
xor ecx, edx
add dx, word [ebp + edx*2 + 2]
call fcn.1042408c
jb 0x1038ddab
call fcn.103e857b
lea edx, [ecx*4 - 0x596f93e5]
mov word [ecx + ebp - 0x468a3391], ax
rol cx, 0xd
jae 0x1039aa30
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov ecx, 0xc99f2aac
mov cl, byte [edi + 8]
call fcn.1033b1f9
lea esi, [esi + edx - 0x6410df1c]
mov ecx, edx
movsx eax, dl
mov eax, dword [edx + esi - 0x6410df18]
dec cl
cmovne ecx, edx
xor eax, ebx
not ecx
shr edx, cl
bswap eax
neg eax
add ecx, edx
adc edx, edx
shl edx, 0x42
lea eax, [eax + ecx + 0x8cf7d19]
inc edx
dec dx
bswap eax
xor ebx, eax
and dx, dx
adc ebp, eax
mov edx, dword [edi + edx*2 - 0xc821be0]
lea eax, [ecx + ecx*4 - 0x6e6049d3]
neg ecx
call fcn.1045ff08
push eax
sar byte [esp + 2], 0x63
xor dl, 0x83
call fcn.103abd43

Function at 0x10390ef9
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
neg edx
add edx, 0x8796b5ac
mov dword [esp + ecx*4], 0xf2a2e33b
xor ebx, edx
bswap eax
add ebp, edx
add ecx, eax
lea esi, [esi + ecx - 1]
jns 0x10457c55
mov ecx, 0xe7aeb705
sub edi, 4
mov ecx, dword [edi]
mov edx, 0x4038ba1f
and edx, edx
xor ecx, ebx
call fcn.10341687
xor al, byte [ecx + esi]
xor al, bl
neg al
sub al, 0x21
movzx edx, byte [esp + ecx*2]
ror al, 1
add al, 0x9b
xor bl, al
sal byte [esp + ecx + 1], 0x22
shl edx, 0x3e
lea eax, [esp + eax + 4]
add cx, word [ecx + eax]
sub edi, 2
rol edx, 0x39
mov word [edx + edi - 0x1800000], cx
rol dx, 0xc1
movzx eax, dx
or eax, 0xe4afa535
pop ecx
jle fcn.10340606
mov dword fs:[edx], ecx
jmp 0x10440a59

Function at 0x10399dab
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea edx, [esp + edx + 0x1c]
rol al, 7
add cl, ch
mov eax, dword [eax + edx - 0x1f4b8753]
lea edx, [ecx + 0x5db74d87]
lea edi, [ecx + edi - 0x69a00004]
and cl, dh
mov dword [ecx + edi - 0x69a00000], eax
mov eax, 0x8885bc92
pop ecx
pop eax
pop eax
pop eax
pop ecx
pop edx
pop ecx
jae fcn.10340606

Function at 0x1039a3ea
Capabilities:
Authenticate hmac

Disassembly:
add dword [esp], 0xefc603fa
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.10436b09
Function at 0x1039a502
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, 0xd208f89d
mov eax, dword [esi]
and cl, cl
sub cx, cx
mov dword [esp], ecx
adc esi, 4
movsx edx, cx
xor eax, ebx
ror ecx, 0xa7
jb 0x103cc571
not eax
shl ecx, 0xaf
not dl
xchg word [esp + ecx - 0x7ffffff], dx
dec eax
jmp 0x10343222

Function at 0x103b9158
Capabilities:
Authenticate hmac

Disassembly:
xor cl, 0x17
shl edx, 0xfe
inc cl
inc dl
neg cl
call fcn.1046d19c

Function at 0x103b9169
Capabilities:
Authenticate hmac

Disassembly:
or cl, byte [ebp + 2]
mov dword [esp], 0x859f8024
add ebp, 2
shr dl, cl
call fcn.103e5d83

Function at 0x103bb2d1
Capabilities:
Encode data using base64

Disassembly:
jp 0x103f768c
sub esi, 4
mov ecx, 0x77ae8837
or ecx, 0x6928063b
movsx edx, cx
mov eax, dword [esi + ecx - 0x7fae8e3f]
inc cx
push edx
lea edx, [ecx*8 + 0x1e9139ad]
xor eax, ebx
sar ecx, 0x7a
not dx
not ecx
rol eax, 3
bswap eax
not ecx
sub dword [esp + ecx*8 - 0xf8], ecx
lea eax, [eax + ecx - 0x553a4dd0]
cmovbe edx, dword [esp + ecx - 0x1f]
ja 0x103ba93e
not edx
neg edx
xor ebx, edx
add esi, edx
lea edx, [eax*2 - 0x6ecb2d61]
add cx, word [edi + eax - 0x328f3288]
jmp 0x103b9a9e
add eax, dword [esp + eax*2 - 0x651e6510]
mov dx, word [edi + eax - 0x651e650f]
lea edi, [edi + eax - 0x651e650f]
adc ax, 0x7ba7
or cx, dx
not cx
jmp 0x10438af9
jae 0x1046a58d
lea ecx, [edx + ecx + 0x42c656bd]
shl eax, 0x23
bswap ecx
push eax
call fcn.1039c314
push 0xd71898bc
sub ebp, 4
mov eax, 0xe3b7779d
mov edx, dword [ebp]
movsx ecx, ax
sub word [esp + ecx - 0x779c], ax
xor edx, ebx
and al, ch
jge 0x1043d2c0
xor edx, 0xbf0f391c
or word [esp + eax*2 - 0x651e6510], ax
sbb edx, 0xb632bc99
ror cl, 0x81
shl cx, 0xc
jae 0x1038ee98
pop ecx
mov dword [edi], eax
mov byte [esp], 0xb6
pop eax
jmp ebp
mov word [edi + eax - 0x651ee0b8], cx
movsx ecx, byte [esp + eax - 0x651ee0b8]
sar dword [esp + eax - 0x651ee0b8], cl
mov dword [esp + eax - 0x651ee0b8], esi
ret
mov byte [esp + ecx - 0x779c], al
bswap edx
rol edx, 3
sub eax, dword [esp + ecx*8 - 0x3bce8]
sal word [esp + eax*2 - 0x182ec2b0], 0x26
bswap edx
lea eax, [eax + ecx + 0x5a3940b8]
not ax
sal ecx, 0x8d
inc edx
shl eax, 0x63
mov dword [esp + eax - 0x328f3288], eax
not edx
setns byte [esp + eax - 0x328f3288]
jbe 0x1035ee71
ror eax, 1
neg cl
sub cx, word [esp + ecx - 0xe1]
dec cx
xor ebx, eax
or dx, dx
shr ecx, 0x35
adc edi, eax
sal dword [esp + ecx*4], 0xc8
movsx eax, cl
neg eax
mov ebp, dword [ebp + ecx]
lea eax, [edx - 0x71ce0bd2]
pop edx
jge fcn.1045c6b7
pop ecx
pop edx
pop eax
pop eax
jmp fcn.1043cbe4

Function at 0x103c06d1
Capabilities:
Authenticate hmac

Disassembly:
shl edx, 0x33
sbb ecx, 0xca0a353b
rol dl, 0x86
mov dword [esp + edx*4 - 0x1d800000], 0x4e1d4c9b
sub word [esp + edx*2 - 0xec00000], dx
neg ecx
jmp 0x1040a522

Function at 0x103d65a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
pushfd
mov ebx, 0xbf19e487
lea ebx, [ebx + ebx*4 - 0x7949d1]
add ebx, 0x59a9f806
xor bx, 0x6fa1
mov dword [esp + 8], 0x1135de76
mov ebx, dword [esp + 4]
jbe 0x103d65a9
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.1037fcf2
call fcn.10340f25