joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc813e4
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edi]
sal ecx, cl
and cx, cx
xor edx, ebx
mov eax, ecx
shl ecx, 0xa2
adc cx, cx
sbb edx, 0xf1bdc801
shl ecx, 0x7a
neg eax
bswap edx
shl eax, 0x29
mov dword [esp + ecx - 0x4000000], eax
rol edx, 2
rol cx, 0xb
inc edx
and eax, dword [esp + ecx - 0x4000000]
adc cx, ax
lea ecx, [ecx + ecx*2 - 0x7373306d]
xor ebx, edx
ror eax, 0x4d
jb 0xd81cd9
mov dword [esi + eax*2 - 0x51004], edx
movzx edx, al
or dl, byte [edi + eax*4 - 0xa1ffc]
not ecx
xor dl, bl
sal word [esp + eax - 0x287fe], 0xc
not dl
cbw
rol ecx, cl
sal dword [esp + eax - 0x20000], 0x79
adc dl, 0xbe
bts eax, eax
shl word [esp + ecx - 0x3306c676], 0xc6
xor dl, 4
sub eax, dword [esp + eax*2 - 0x40002]
sar byte [esp + ecx - 0x3306c674], 0xa5
adc dl, 0x89
add dword [esp + ecx - 0x3306c677], eax
xchg word [esp + ecx - 0x3306c676], ax
ror ax, 0xc1
rol dl, 1
xchg word [esp + eax*4 - 0x80400], cx
xor bl, dl
lea edx, [esp + edx + 4]
sub al, ah
not word [esp + ecx*2 - 0x660c0202]
shl word [esp + ecx - 0x33060101], cl
mov eax, dword [edx + eax - 0x201ff]
mov dword [esi + ecx*2 - 0x660c020a], eax
lea esi, [ecx + esi - 0x33060109]
mov eax, dword [edi + ecx*2 - 0x660c01fd]
mov edx, ecx
lea edi, [ecx + edi - 0x330600f8]
lea edx, [edx + ecx*2 + 0x47383e17]
sub dword [esp + ecx - 0x33060101], edx
shl word [esp + ecx - 0x33060101], cl
xor eax, ebx
ror dx, cl
jb 0xdb56c7
xor eax, 0x1e082aad
inc dx
mov dword [esp + ecx - 0x33060101], ecx
call fcn.00e6874d
mov ecx, 0x72a566b1
mov eax, dword [ecx + esi - 0x72a566b1]
mov dx, word ss:[eax + ecx - 0x72a566b1]
mov word [esi + ecx - 0x72a566af], dx
bts ecx, ecx
mov edx, ecx
movsx eax, cx
lea eax, [ecx + esi - 0x72a766af]
neg cl
mov dword [esi + ecx - 0x72a76651], eax
movzx eax, cl
xadd edx, eax
lea esi, [ecx + esi - 0x72a76651]
mul cx
cbw
mov edx, dword [edi + ecx - 0x72a76653]
adc cl, 0x35
lea edi, [edi + eax - 0x72a7ffa3]
dec cl
xchg cl, al
xor edx, ebx
neg edx
call fcn.00cf0cb4
ret 4
Function at 0xc83239
Capabilities:
Encode data using xor

Disassembly:
lea esi, [eax*2 + 0x6a07420b]
inc ebp
and esi, esp
dec esp
adc ecx, ebp
inc ecx
mul esi
inc ecx
sub al, 0x21
dec esi
mov dword [esp - 0x66935b90], edi
dec edi
mov esp, dword [esp + edx - 0x66935b98]
call fcn.00ce4bfe
mov eax, 0x6c184a0f
movsx ecx, al
mov ebp, eax
inc edx
mov ebp, dword [eax + ebx - 0x6c184a0f]
dec ebp
lea ebx, [ebx + ecx - 0xb]
inc esp
mov esi, ecx
inc esp
movsx esp, cx
xor ebp, esi
inc ecx
mov eax, 0x4a820021
movzx edi, ax
bswap ebp
call fcn.00cd12c5
sbb edi, 3
mov eax, dword [edi]
call fcn.00d048e0
fild word [ebx]
add byte [eax], al
add byte [ebx + 0x169ae807], cl
or byte [eax], al
xor ch, byte [eax]
scasb al, byte es:[edi]
sub cl, byte [edi]
jp 0xc8323a
push ds
imul ebx, dword [ebx], 0xffffffeb
js 0xc831e0
push ds
imul ebx, dword [ebx], 0xffffffbf
je 0xc8324e
push ds
imul ebx, dword [ebx], 0xffffffcb
dec ebp
push ds
imul ebx, dword [ebx], 0x3b
adc dh, byte [ebp + 0x1e]
imul ebx, dword [ebx], 0x57
mov edx, 0x1b6b1e05
das
loopne 0xc8320e
push ds
imul ebx, dword [ebx], 0xffffffd7
lodsb al, byte [esi]
mov edi, 0xc31b5e12
inc esi
or byte [ebx + 0x1c], ah
mov cl, 0xb0
mov ecx, 0xa2743a19
enter 0xfffffffffffffb00, 0xffffffffffffff9b
aam 0xa0
scasd eax, dword es:[edi]
adc dword [ebx - 0x3a599ef0], ecx
fld dword [ebx + 0x10]
popal
cmpsb byte [esi], byte es:[edi]
mov ecx, gs
jae 0xc832ac
popal
cmpsb byte [esi], byte es:[edi]
int3
and edx, dword [eax]
popal
cmpsb byte [esi], byte es:[edi]
fst st(1)
dec ebx
adc byte [ecx - 0x5a], ah
aam 0xe9
ret 0x63fc

Function at 0xc83fed
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
call fcn.00d597d5
mov eax, 0x8d1e3b82
call fcn.00de8c64

Function at 0xc8e820
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
ror eax, 2
inc eax
not edx
xor eax, 0x3d85679c
bt ecx, ecx
mov dword [esp + edx*4 - 0x6babf310], edx
add edx, 0x9fa27294
not eax
or dx, word [esp + ecx - 0x33a]
ror eax, 1
and ecx, ecx
xor eax, 0xf2a39283
push edx
jmp 0xd23fb5
sub eax, 0xaa322fb3
sub ecx, ecx
shl cl, 0x46
dec dl
xor ebx, eax
bt edx, edx
adc ecx, ecx
shl dl, 0x21
add ebp, eax
xor cx, cx
movzx dx, byte [esi + ecx]
adc cl, byte [ecx + esi + 2]
add esi, 2
add dl, cl
mov word [esi], dx
call fcn.00972f42

Function at 0xc94348
Capabilities:
Encode data using base64

Disassembly:
ror dword [esp + 7], 0xc9
adc ebp, 3
call fcn.00d32dac
dec ebp
arpl ax, ax
inc bp
sub ebp, edi
jno 0xdbea9d
call fcn.00d82b0b
add byte [eax], al
dec esp
outsd dx, dword [esi]
popal
push edx
jae 0xc943e3
jne 0xc943e8
arpl word [ebp], sp
sysenter
call fcn.00d158b9
bound eax, qword [0x69e5acb6]
push ebx
adc ecx, dword [edx - 0x576dec4f]
invalid
imul edx, dword [ebx + 0x13], 0x9213b18a
test al, 0xc7
sti
dec ecx
inc esp
cmp esp, edi
xchg ebx, eax
mov ch, 0x8e

Function at 0xc977b5
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + ecx*2 - 0x4dc884cd]
sub esi, 8
pop ecx
mov dword [esi + 4], eax
mov eax, 0x8cb49c82
and ax, 0x39bc
mov dword [esi], edx
rol ax, 0x2c
movzx ecx, ax
jns fcn.00d5d32b
Function at 0xca535e
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov eax, dword [esi + 4]
call fcn.00cabf2e

Function at 0xca5367
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
bt eax, eax
add eax, eax
xor cl, bl
add dx, word [esp + eax*4 + 5]
rol cl, 1
mov dword [esp + eax], 0x22b94f0a
ror dx, 0xa6
sbb cl, 0x36
and al, byte [esp + eax*2 + 6]
rol cl, 1
neg cl
ror cl, 1
rol edx, 0xb4
cwde
xor bl, cl
dec dword [esp + eax + 4]
push edx
imul eax, dword [esp + eax + 8]
lea ecx, [esp + ecx + 0xc]
cwd
add eax, dword [eax + ecx]
sub dx, dx
mov dword [esi + edx*8 - 0x31f80008], eax
movsx eax, word [esp + edx - 0x63efff8]
lea esi, [esi + edx*2 - 0xc7e0008]
pop edx
pop ecx
pop ecx
jae fcn.00d5d32b
invalid

Function at 0xca6fee
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
push 0x9c0ae19b
mov dword [esp + 4], 0x1e1ee837
lea esp, [esp + 4]
call fcn.00d4ad25
mov eax, 0xe8ae3b34
mov eax, dword [esi]
mov edx, 0x3bb1b5a3
shr edx, 0x37
mov edx, dword [esi + edx - 0x73]
ja 0xcb56fd
inc ecx
mov esp, 0xbb8af084
dec ecx
mov eax, dword [edx]
inc ecx
push esp
mov edx, 0xadb0b087
xchg dword [esp + 3], edx
mov dx, word ss:[eax + edx*4 - 0x2ec]
mov di, dx
dec eax
xor dword [esp], 0xca236fb1
dec edi
lea edi, [esp - 0x1b4873df]
inc cx
mov ecx, dword [edx + 8]
mov edx, 0x6b2a4626
inc ebp
movsx esi, sp
or di, cx
inc cx
inc esp
not di
jno 0xd080d3
bt dx, 0x8a
neg ecx
call fcn.00de9c6e
adc esi, 4
push 0x83041335
xor ecx, ecx
inc dword [esp]
jne 0xbf4193
Function at 0xcaa837
Capabilities:
Encode data using base64

Disassembly:
rol dword [esp + 4], 0x41
jo 0xd5c03d
mov edx, dword [esi]
mov al, byte [esi + 4]
mov ecx, 0x150c331c
shl cl, 0x25
lea esi, [esi + ecx - 0x150c337a]
sbb cl, cl
not ecx
and ecx, ecx
mov byte [edx], al
jne 0xd4437a
push 0x801467a1
neg dword [esp]
mov eax, 0x50ded0b
mov eax, dword [edi + eax*8 - 0x286f6858]
xor eax, ebx
mov edx, dword [esp]
sar dword [esp + edx - 0x7feb985f], 2
not dword [esp + edx - 0x7feb985f]
xor eax, 0x1e9e1c1c
rol dword [esp + edx - 0x7feb985f], 0xfe
mov ecx, edx
push edx
not eax
jae 0xd70102
pop eax
pop edx
pop edx
pop eax
pop eax
jmp ebp
inc byte [esp + 3]
xor eax, 0x1e9e1c1c
dec edx
not eax
push ecx
xor edx, 0x3e07cc14
and dword [esp], ecx
rol eax, 1
mov word [esp + 2], 0xdeaf
not eax
pop ecx
xor ebx, eax
ror edx, 0x5d
bswap edx
inc dx
mov dword [ebp - 8], eax
mov eax, edx
ror dword [esp], 0xa
lea ecx, [edx + edx*4 + 0x30ae5e0d]
sbb ebp, 7
push ecx
xor word [esp + 4], ax
pop edx
pop eax
jns fcn.00caa7a7
sbb edi, 4
mov eax, dword [edi]
call fcn.00dbf231
add byte [esp + ecx - 0x7feb9858], cl
sar dl, 0x47
rol eax, 1
not eax
ror dword [esp + ecx - 0x7feb985c], 0x94
xor ebx, eax
mov dword [edx + ebp - 0x7feb9804], eax
mov edx, dword [ecx + edi - 0x7feb985b]
mov eax, ecx
sar eax, cl
setbe al
xor edx, ebx
imul eax, ecx
shl word [esp + eax - 0x7feb985b], 0xa1
sbb byte [esp + ecx - 0x7feb985d], 0x9b
neg edx
neg cl
lea edx, [edx + ecx + 0x3b45ca08]
ror edx, 2
rol cl, cl
lea edx, [eax + edx - 0x4059ebbc]
not eax
pop ecx
rol edx, 3
lea edx, [edx + eax - 0x28547200]
lea eax, [ecx - 0x426e1970]
ror cx, 0x61
xor ebx, edx
xchg dword [esp], eax
add esi, edx
mov eax, dword [edi + 8]
movsx edx, cx
sub edi, 0xfffffff4
not ecx
lea ecx, [edx + ecx*4 - 0x117200de]
shl ecx, cl
xor eax, ebx
jmp 0xd106b0

Function at 0xcae50e
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec eax
mov dword [esp + ebx - 0x1061], edi
dec ecx
rol ebp, 0xa2
inc ecx
bswap esp
inc dx
or dword [esp + edi - 0x2c482066], edx
dec eax
mov dword [esp + ebx*2 - 0x20ba], edx
dec edx
mov dword [esp + edi*2 - 0x589040c4], esi
jne 0xdd81f7
dec eax
xor eax, 0x76b3dba9
inc edx
mov dword [esp + edi*2 - 0x589040cb], edx
inc esi
xor dword [esp + edi - 0x2c48205a], esp
inc ecx
shr al, 0xc5
shr edi, 0x79
dec edx
mov esi, dword [esp + edi*2 - 0x589040c4]
dec ecx
mul edi
dec eax
cdq
dec ebp
arpl sp, sp
cbw
movzx ecx, dx
jae 0xdd6dcd
mov dword [ecx + ebp - 0x95f7234], eax
sbb dword [esp + ecx - 0x95f7230], ecx
xor edx, dword [esp + ecx - 0x95f7230]
mov edx, dword [ebp + ecx*8 - 0x4afb9184]
movzx ecx, byte [edi + ecx*2 - 0x12bee45b]
sbb edi, 0xfffffffa
call fcn.00d03a20
inc sp
xor ebp, esi
inc esi
xchg dword [esp + edi - 0x2c48205c], esi
dec ebp
adc ecx, esp
inc ecx
push ebp
inc dx
mov ebp, dword [ebx + edx - 0x1061]
dec ecx
div esi
inc sp
add eax, dword [esp + ebx - 0x1054]
dec ebp
lea edx, [edx + ebx*2 - 0x20c0]
inc edi
movzx ebp, word [edi + ebx - 0x2c48206a]
inc edx
adc byte [esp + edi - 0x2c48205f], bh
sets bl
dec ecx
xor esi, 0x6d3eaa13
dec ebp
lea ebx, [ebx + ebx - 0xffe]
inc edx
div dword [esp + edi - 0x2c482069]
jmp 0xd29526
Function at 0xcb38e0
Capabilities:
Encode data using base64

Disassembly:
xor dl, 0x8d
mov dword [esp + eax*2 - 0x1651a52c], eax
bts cx, cx
dec dl
neg dl
imul eax, ecx
adc dl, 0x33
xor dl, 0x97
xchg dword [esp + eax - 0x6329f72e], eax
or al, byte [esp + eax - 0xb28d294]
jle 0xda7917
dec dl
xchg byte [esp + eax - 0xb28d2bd], ah
bt ecx, ecx
btr ecx, eax
ror dl, 1
add ecx, ecx
and ax, word [esp + eax - 0xb2829be]
xor bl, dl
lea edx, [esp + edx + 4]
sar ecx, 0x76
pop eax
call fcn.00dab947

Function at 0xcb3a64
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [esi]
movsx ecx, ax
mov eax, dword [esi + 4]
jo 0xc9d634
shr cx, 1
rcr eax, cl
mov ecx, 0x2e05c73c
mov dword [esi + ecx*2 - 0x5c0b8e78], eax
ror cx, 0xa4
mov edx, dword [ebp + ecx - 0x2e05cc73]
push ecx
lea ebp, [ebp + ecx*2 - 0x5c0b98e2]
xor word [esp + ecx*2 - 0x5c0b98e6], cx
or ecx, dword [esp + ecx*2 - 0x5c0b98e6]
lea eax, [ecx*2 + 0x101c8510]
xor edx, ebx
dec edx
shr cx, 0xa
ror edx, 1
xor edx, 0xec388807
btr eax, 0x35
cbw
pop eax
dec edx
xor ebx, edx
add edi, edx
jmp edi
dec eax
mov dword [esp + ebp - 0xd393], esi
inc ebp
xadd eax, ebp
inc cx
rol eax, 0xab
inc cx
btr esp, 0x1a
inc esp
xor dword [esp + ebp - 0xd393], esi
inc eax
and ch, 0x94
dec bp
dec ecx
shl eax, cl
pop esi
inc cx
shr esp, 0xec
dec edx
lea edi, [ebp*8 - 0x2f6f7647]
dec ebp
arpl si, si
dec eax
sal ecx, 0xd9
inc ecx
push eax
call fcn.0095c8a1
mov eax, 0x99bd8ca1
rol al, 0x61
jo 0x97b114
inc ecx
movzx ebx, byte [ebx]
inc eax
xor bl, dh
mov ebp, 0x72dae37
inc eax
movzx edx, ch
push edx
neg bl
inc esp
movzx edi, word [esp + ebp*2 - 0xe5b5c6d]
not bl
dec ecx
imul ebp, edi
inc ecx
dec bh
sal edx, 0x5c
adc bl, 0x8e
dec ecx
lea ebp, [edi + ebp - 0x71df8161]
push ebp
inc ecx
xor bl, bh
inc ebp
mov esi, edi
inc ecx
not dh
inc eax
xor dh, bl
call fcn.00d3c1a8
Function at 0xcb6f84
Capabilities:
Authenticate hmac

Disassembly:
lea edi, [edi + ecx*2 - 0x74d80951]
imul ecx, ecx
xor al, bl
movzx edx, cl
bswap edx
rol al, 1
sar edx, 0x5c
shl ecx, 0x61
add edx, dword [esp + ecx - 0x484b373a]
dec al
rol dl, 0x62
inc edx
pop ecx
neg al
dec edx
call fcn.00d0aed6
invalid

Function at 0xcb8f23
Capabilities:
Encode data using base64

Disassembly:
pop ecx
lea ebp, [eax + ebp - 0xb]
jp 0xda50fd
movzx ecx, al
call fcn.00db9b42
add byte [eax], al
add byte [ebp + 0x75], cl
insb byte es:[edi], dx
inc esp
imul esi, dword [esi], 0x3b8510b8
xchg esp, eax
lea ecx, [eax + 0x3f98cb26]
movzx ecx, byte [edi]
mov edi, 0xce3fd296
dec al
xor cl, bl
sub di, 0xfa21

Function at 0xcbb256
Capabilities:
Encode data using xor

Disassembly:
pop edi
xor ebp, 0xb434a19f
inc cx
mov eax, dword [0x4166b434]
bt edi, 0xa1
dec esp
lea ebp, [ecx*2 - 0x2fc663c7]
sbb ebp, 0xc307911f
ror ebp, 1
inc esp
movsx eax, dx
dec esp
imul esp, ebx
movzx edi, bl
push esi
dec ecx
sar esp, 0x13
inc cx
shl esp, 0x46
xor dword [esp + edx*2], ebp
inc ecx
shr ch, 0x62
inc cx
and eax, 0x81486e89
out dx, eax
je 0xcbb25a
rcr byte [esi + 0x41], 0xff
ror byte [eax + 0x63], 0xed
inc esp
xadd edi, esp
inc ecx
div esi
inc ebp
imul ebp, ebp
dec esp
add ecx, ebp
dec eax
lea eax, [edx + 0x59ab3112]
dec ebp
add edi, ecx
inc ecx
jmp edi

Function at 0xcbdb71
Capabilities:
Encode data using base64

Disassembly:
call fcn.00db8eac
mov ecx, 0x1923cad
mov edx, 0xaa2aa58f
mov ecx, dword [edi + ecx - 0x1923cad]
xor ecx, ebx
lea ecx, [edx + ecx + 0x51db498c]
ror ecx, 3
movsx eax, dx
imul ax
jae 0xe6cdc2
bswap ecx
xchg ah, dl
call fcn.00d3ab99
inc dword [esp + edx - 0x2c3d700]
pop eax
jns fcn.00d7facf
Function at 0xcc4b7a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov cx, word [edx + eax - 0x4cf4530f]
jle 0xce5d25
mov dword [ebp - 0x2c], edi
je 0x994055
mov ecx, eax
mov eax, 0x400
bts di, sp
inc edi
mov edi, edx
movzx edx, ax
bswap eax
btc eax, ecx
setb ah
mov eax, edx
shl edx, 0x10
clc
cmp sp, 0xd787
or eax, edx
cmp cx, 0xfd80
stc
shr ecx, 1
jmp 0xcfbe9c
mov word [eax + esi - 0x4cf45311], cx
mov dword [esp + eax - 0x4cf4530f], 0x8b20532d
mov edx, 0xba28cab6
div byte [esp + eax - 0x4cf4530a]
movzx ecx, word [eax + ebp - 0x4cf47191]
lea ebp, [ebp + eax - 0x4cf4718f]
xor cx, bx
cwde
rol dl, 0x46
or dl, byte [esp + eax - 0x718f]
sbb cx, 0x6784
cwde
mul word [esp + eax*8 - 0x38cac]
inc ax
not cx
neg cx
shr dx, 0xe3
ror dword [esp + eax*2 - 0x287a], 0x5c
add edx, 0x53bfa605
adc cx, 0x5800
not al
ror edx, 0x5d
ror cx, 1
and dword [esp + eax*4 - 0x5300], 0x8019f037
xor bx, cx
shr ax, 0x4b
neg dword [esp + eax - 2]
mul dword [esp + eax + 2]
mov word [esi + edx*2 - 6], cx
lea ecx, [eax*4 - 0x37538a4c]
rol ecx, cl
lea esi, [ecx + esi - 0x3348c703]
cwd
pop edx
pop ecx
jb fcn.0096f6cc
mov dword [ebp - 0x28], edi
jmp 0xd6e523
mov dword [ebp - 0x24], edi
jmp 0xce00ad

Function at 0xcc7531
Capabilities:
Encode data using base64

Disassembly:
bt cx, dx
lea edi, [edx + edi - 0x2191742e]
call fcn.00986f8f
mov ecx, 0x28949c04
or ecx, ecx
inc ecx
mov edi, dword [ebx + ecx - 0x28949c04]
dec ebp
lea ebx, [ebx + ecx - 0x28949c00]
neg cl
xor edi, esi
inc esp
movzx esi, cx
call fcn.0096e4d5
xor ax, bx
inc ax
mov dword [esp], edx
rol ax, 1
xor dword [esp + 1], ecx
sbb ax, 0xd0a1
ror ax, 1
dec dl
or dx, dx
dec dword [esp + 2]
xor bx, ax
and ecx, edx
mov word [esi + 2], ax
xor word [esp + 1], cx
neg edx
lea esi, [esi + edx*2 - 0x45d0d084]
rol edx, 0xd7
mov eax, dword [edi + edx - 0x21917432]
jne 0x98f17c

Function at 0xccc927
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
ror ecx, 1
imul eax
xor ebx, ecx
add esi, ecx
cdq
mov ecx, edx
or dx, word [ebp + edx*2 + 2]
lea ebp, [ebp + eax*2 + 4]
and eax, eax
mov dword [esp + eax], 0xa33b150d
add al, byte [edi + eax*2 + 4]
rol cl, 0x26
lea edi, [ecx + edi + 5]
xor al, bl
call fcn.00de9bc4

Function at 0xccd021
Capabilities:
Authenticate hmac

Disassembly:
bswap ecx
sbb ecx, 0x9515f422
rol ecx, 1
xor eax, eax
bts eax, edx
mov dword [esp + eax*2 - 0x100], eax
xor ebx, ecx
xadd al, ah
call fcn.0097594e

Function at 0xccd05b
Capabilities:
Authenticate hmac

Disassembly:
dec eax
mov dword [esp], 0x540e51ff
call fcn.00d613cd
Function at 0xccd96e
Capabilities:
Encode data using base64

Disassembly:
dec eax
shr ecx, cl
inc ecx
xor eax, 0xebd1f00
dec esp
mov dword [esp + ecx*2], edi
inc ecx
dec eax
inc ecx
rol eax, 1
shr dword [esp + ecx + 1], 0x9d
inc ecx
sal esi, 0x92
dec eax
add dword [esp + ecx], esi
inc esp
xor dword [esp + ecx], eax
pop esi
movzx eax, bp
xchg ecx, eax
dec ebp
arpl ax, ax
inc cl
ror eax, cl
inc ecx
setae ch
dec ebp
adc ecx, eax
inc bp
mov ebp, dword [edx + ecx - 0xbe50]
inc eax
movzx edx, ch
inc ecx
ror ah, 0xa5
inc edx
add al, byte [ecx + ebx - 0xbe49]
inc esp
movzx eax, bx
inc cx
shr esi, cl
inc ecx
adc esi, 0x5926cc32
dec ebp
lea ebx, [ebx + ecx*4 - 0x2f932]
inc ecx
sub ch, ah
inc eax
xor al, dh
inc cx
imul edx, edi
inc ebp
sub dh, dh
rol al, 1
inc esp
and bh, bh
inc ebp
or ah, al
adc al, 0x1f
dec esp
xchg ecx, esi
xor al, 0x8d
inc cx
inc esp
inc ebp
xadd ah, al
push edi
rol al, 1
dec bp
inc ecx
pop esi
inc eax
xor dh, al
dec esp
lea esi, [ebx*2 - 0xcf7a959]
ror edx, 0x2b
dec ebp
sub eax, esi
dec eax
add eax, esp
not cl
call fcn.00d12c5f

Function at 0xcd0a6e
Capabilities:
Encode data using base64

Disassembly:
movsx edx, ax
or edx, dword [edx + ebp]
movsx ecx, ax
lea ebp, [ecx + ebp + 4]
shl cx, 0xe5
shl cl, 0xc1
call fcn.00cb5a23
mov edx, 0x6a86acad
lea eax, [edx + edx*8 - 0x6a5054c9]
lea edi, [edi + eax - 0x546bbd50]
mov eax, dword [edi + eax - 0x546bbd4c]
rol edx, 0x69
movsx ecx, dl
call fcn.0095ee4b
lea eax, [edx + edx - 0x6de5a762]
sbb esi, 2
shr word [esp + 3], 0xc4
mul ax
mov word [esi], cx
pop eax
pop edx
jo fcn.0096f6cc

Function at 0xcd0ace
Capabilities:
Encode data using base64

Disassembly:
inc ecx
btc dx, cx
xor ebx, eax
pop ecx
add esi, eax
not dword [esp]
call fcn.00ce76d1
xor eax, ebx
ror cx, 0x28
shl edx, 0x99
btr dx, 0xbd
ror eax, 1
push edx
dec ecx
dec dl
lea eax, [eax + ecx*2 + 0x1d0aee94]
rol eax, 1
inc eax
jmp 0xc81869
xor ecx, 0x1e9e1c1c
movsx eax, dx
not ecx
xadd dl, dh
rol ecx, 1
pop eax
not ecx
mov eax, 0x8a241217
xor ebx, ecx
neg eax
not eax
sub edx, eax
mov dword [ebp + edx - 0x1ba3ee72], ecx
push eax
add word [esp + edx - 0x1ba3ee60], 0x1ebf
lea ebp, [ebp + edx*2 - 0x3747dcdc]
pop edx
pop ecx
pop eax
jg fcn.00caa7a7
movsx eax, cl
mov ecx, dword [ecx + edx - 0xa81c774]
mov dword [eax + ebp - 0x78], ecx
cwde
movsx ecx, ax
push eax
mov eax, dword [eax + edi - 0x73]
movzx edx, word [esp + ecx - 0x74]
and ecx, edx
lea edx, [edx + edx - 0x6aee7f4e]
lea edi, [edi + ecx - 0x6f]
adc byte [esp + ecx*8 - 0x39f], 0x14
rol dl, 0xe5
jbe 0xcb25ac
mul edi
inc esi
mov ebp, dword [edi + ebx - 0xf03c6]
inc cx
xadd eax, edx
inc ecx
mov ebx, eax
dec ebp
lea ebx, [ebx + ecx - 0x3c0f197f]
inc esp
mov esp, eax
inc esp
mov esi, ebp
inc ecx
shr esp, 0xb3
inc esp
xor ebp, esi
inc ecx
xor ebp, 0x10359f2c
dec eax
lea edi, [edx - 0x4b1ddb]
inc eax
and bh, 0x1a
dec dx
inc ecx
sbb ebp, 0x872ba0b6
dec edx
lea ebx, [esi*4 + 0x368daf35]
sub di, bp
inc ecx
ror ebp, cl
inc ecx
not ebp
inc eax
sub al, bh
jbe 0xdbeb55
Function at 0xcd0dba
Capabilities:
Encode data using base64

Disassembly:
shld edx, eax, cl
mov ecx, dword [esp + 6]
rol cx, 0x6d
mov dword [esi], edx
lea eax, [ecx + ecx*2 + 0x318121ba]
lea edx, [eax + ecx*2 + 0x402ea091]
mov dword [esp + eax - 0x529282d3], ecx
lea edi, [edi + eax - 0x529282e3]
div al
xchg dword [esp + eax - 0x5292358c], edx
lea edx, [edx*2 - 0x37a9fe6]
mov eax, dword [eax + edi - 0x52923596]
sal ecx, 0x58
xchg dword [esp + 5], ecx
xor eax, ebx
ror cl, 0xc2
rol eax, 1
bswap eax
not dword [esp + 0xa]
lea ecx, [ecx*2 + 0x62a448c]
inc eax
ror eax, 3
sal ecx, cl
call fcn.00de8c90
call fcn.00c75de7
cmc
Function at 0xcd5475
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax], 0xcd1254be
sal edx, 2
or eax, ebp
inc dword [esp]
add eax, edx
jmp 0xd4786c
jmp fcn.00ca6943

Function at 0xcd805d
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x64807234
and al, 2
or al, 0x66
and ecx, 0xe8132a00
sub dx, 0x7b15
inc cx
jge 0xda4bbf
mov dword [esp + 8], eax
call fcn.00cf7b67
pop eax
or eax, dword [ecx + 0x263437b]
dec esi
jo 0xcd80b0
dec ecx
inc edi
add cl, byte [esi + 0x70]
push eax
push edi
dec ebx
add cl, byte [esi + 0x70]
pushal
push ebx
mov bl, 0xb9
push edi
jo 0xcd80c2
mov edx, 0x2c74628f
pop esp
pop esp
bound ecx, qword [ebx + 0x10f347]
jns 0xcd8040
sbb ebx, dword [ebp - 0x2c]
pop esp
in eax, 0xd4
ficomp word [ebx - 0x12]
inc byte [edi - 0x1c5c1bb0]
loop 0xcd8103
jnp 0xcd8092
and byte [ecx + 0x70], al
les edi, [ecx + 0x473b1afe]
xor al, 0x64
xchg edi, eax
and byte [esi + eax*2 + 0x59d6912f], ah
inc esi
das
xchg ecx, eax
salc
pop ecx
mov dword [0x3a199b86], eax
add eax, 0x4f566c37
cld
or dword [edi], esi
das
pop ebp
in al, dx
xchg edi, eax
invalid
lahf
fadd dword [esi - 0x238716f3]
push esi
imul ebp, dword [esi], 0x24
mov dword gs:[ebx + 0x71a88ea5], ebp
xchg esp, eax
aam 0x87
and ebx, esp
sbb al, 0xc
outsb dx, byte [esi]
pop es
sbb byte [ebp - 0x28], bh
pop ss
fistp qword [ecx - 0x68cc8b2c]
adc eax, 0x93c352f0
sbb al, 8
sbb al, 0x8c
invalid
mov cx, word [esi + 2]
and dl, byte [esp]
mov ax, word [esi + 4]
btc edx, 0x90
dec edx
not cx
adc dl, dl
not ax
or cx, ax
shr edx, 0x88
and edx, edx
movsx eax, word [esp + edx*2 - 0x1f89308]
mov word [esi + edx*2 - 0x1f89304], cx
mov ecx, edx
lea esi, [esi + edx*2 - 0x1f89304]
imul dword [esp + edx - 0xfc4984]
or ecx, dword [esp + eax*2 - 0x4cd18f20]
adc cl, byte [esp + eax*2 - 0x4cd18f1f]
mov dword [esp + eax - 0x2668c790], ebp
ret

Function at 0xcd9237
Capabilities:
Authenticate hmac

Disassembly:
pop edi
pop ecx
push edx
mov ebx, edx
mov ebx, dword [esp + edx - 0x5033]
mov edx, dword [esp + edx*2 - 0xa066]
mov edi, dword [esp]
jmp 0xd75fa7
idiv al
mul edx
xor ebx, ecx
not dl
add edi, ecx
movsx ecx, al
and cx, ax
mov eax, dword [ecx + esi - 0x14]
seto cl
xor edx, 0x2ba79e09
add cl, byte [ecx + ebp + 4]
sub ebp, 0xfffffffb
dec dx
bt edx, edx
neg edx
xor cl, bl
shl edx, 0xfe
xor edx, edx
sub dx, 0x4421
dec cl
add edx, edx
sub dx, dx
call fcn.00cd91c5
mov edi, dword [esp + edi*2 - 0xa062]
mov ebp, 0xcaaba211
mov ebp, dword [esp + 0x10]
mov esi, 0x3b421c
push esi
call fcn.00cbdbbf
mov eax, esi
mov dword [esi - 4], eax
mov edx, 0x43b2a2bf
lea ecx, [edx + edx*4 - 0x6b42b5d4]
mov ecx, dword [ebp + edx - 0x43b2a2bf]
inc dl
jnp 0xce1230
xor ecx, ebx
ror ecx, 3
dec ecx
neg edx
movsx eax, dl
dec dx
rol ecx, 3
dec edx
dec ecx
xadd edx, eax
rol ecx, 3
btc ax, ax
bswap ecx
jb 0xd28f13