joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100057d0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000e0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x100058ca
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x100058c3
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x100058a9
call ebx
cmp dword [ebp - 0x14], eax
jne 0x100058a9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100058a9
mov edx, dword [esi]
test edx, edx
jne 0x10005872
push 0x200
push edx
push dword [0x1000e708]
mov dword [esi + 4], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100058c3
jmp 0x1000589d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1000589d
shl eax, 3
push eax
push edx
push 0
push dword [0x1000e708]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100058c3
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10005831
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1000590f
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1000590f
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10005909
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.10005660
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x100058d6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100060eb
mov esp, ebp
pop ebp
ret
Function at 0x10037c1b
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + eax*2 - 0x6b3ae39f]
jb 0x1004e211
mov ecx, 0x3982ec32
mov edx, ecx
lea ebp, [ebp + edx - 0x3982ec36]
xor cl, 0xae
mov eax, dword [ebp + edx*2 - 0x7305d864]
xor eax, ebx
ror dx, 0xaf
not ecx
jb 0x101332e5
sub ebp, 4
call fcn.10155924
and ax, cx
movsx ecx, dl
call fcn.1002e85f
rol edx, 2
sal ax, 0x87
je 0x1019a4d9
movsx ecx, al
xor ebx, edx
sub cx, 0x7cb7
shr ax, cl
adc ebp, edx
mov ecx, dword [esi]
movzx edx, ax
jmp 0x10105a69
lea edx, [eax + 0x658cdf15]
xor ebx, ecx
ror edx, 0x28
shr al, 0x65
sbb eax, 0xd02ba88d
add ebp, ecx
pop eax
add edx, edx
mov eax, dword [edi - 4]
lea ecx, [edx*4 - 0x42d4badb]
pop edx
mov edx, dword [edi]
xor ecx, ecx
shl dword [esp + ecx*8 + 3], 0x65
or eax, edx
push ecx
movzx edx, cx
not eax
call fcn.1017b795
bswap edx
xadd cx, ax
push ecx
rol edx, 1
neg edx
push ecx
xor ebx, edx
add edi, edx
pop ecx
movsx edx, cl
shr cx, 0xed
mov edx, dword [esi + eax*2 - 0x12]
call fcn.1013c14b
sub ebp, 4
mov edx, 0xf3062a0a
movsx ecx, dx
mov ecx, dword [ebp + ecx - 0x2a0a]
xor ecx, ebx
movzx eax, dx
inc edx
shl eax, 9
neg ecx
call fcn.1015b204
lea ecx, [eax + eax*2 - 0x425089dd]
mov word [edi - 2], dx
movzx eax, byte [ebp - 6]
adc cx, 0xad88
movsx edx, cx
shl dl, 5
add ebp, 0xfffffffa
xor al, bl
call fcn.1010496c
mov ax, word [ebp]
mov dx, word [ebp + 2]
mov ecx, 0xa0dc00f
shr ecx, cl
mov cl, byte [ebp + ecx - 0x1417]
jns 0x1008aea5
inc dx
dec al
not al
inc ecx
call fcn.10098c3c
shr dword [esp + 4], 0x8a
add dx, 0xdda3
ja 0x10161f17
mov ecx, 0x1c0e7d0a
mov edx, dword [esi + ecx - 0x1c0e7d0a]
shl cx, cl
lea esi, [ecx + esi - 0x1c0e27fc]
lea eax, [ecx*8 + 0x64312930]
xor ax, cx
neg ecx
xor edx, ebx
bswap ecx
jmp 0x1014ffe1
rol edx, 3
neg ax
jle 0x100cb868
add ebp, 4
shrd ax, dx, cl
jmp 0x100c72b6
jmp 0x1002a629
shr al, 0xa7
inc edx
ror edx, 1
xor ecx, 0x128b1481
dec eax
lea ecx, [eax - 0x74779c53]
xor ebx, edx
add edi, edx
or cl, al
sete al
movzx dx, byte [eax + ebp - 0x44a2be00]
cmovns ecx, eax
cmovns eax, ecx
adc al, byte [ebp + eax - 0x44a2bdfe]
add ebp, 2
ror ecx, 0x61
call fcn.1006c579
jne 0x1008679b
lea esi, [esi + edx - 0x1d]
sub ax, ax
sub eax, edx
jae 0x10124800
xor ecx, ebx
ror ecx, 2
neg ecx
xor ecx, 0xb3a4dd18
sar edx, 0xf6
not ecx
shl dx, 0xc1
lea ecx, [ecx + edx*8 - 0x39bcfa5]
not eax
xor ecx, 0x17ad6c25
xor ebx, ecx
xor eax, eax
sub edx, eax
lea edi, [eax + edi - 4]
inc eax
mov dword [edi + eax*2 - 2], ecx
add dl, 0x92
jne fcn.100d116a
shr edx, 0xbb
inc ecx
jmp 0x10052141
not eax
adc dx, dx
sbb ecx, 0x51876889
inc ecx
neg eax
neg edx
sal edx, 0x70
xor eax, 0xa7b714b4
bswap edx
bswap eax
inc eax
not ecx
sal cl, 0x44
cmovs ecx, edx
ror eax, 1
call fcn.1016b308
rol ecx, cl
rol edx, 1
sar al, 0x85
lea edx, [ecx + edx - 0x1c4e9a4b]
jbe 0x100d3146
call fcn.101296f8
Function at 0x1003d2a5
Capabilities:
Encode data using xor

Disassembly:
or edx, 0x52b1f41a
dec eax
mov dword [esp + ecx*8 - 0x18154fa8], 0xb4885fa5
and dl, 0xbe
sub dx, 0x19a3
rol eax, 1
inc edx
ror byte [esp + ecx - 0x302a9f3], 0xa2
inc eax
dec dword [esp + ecx*2 - 0x60553ea]
pop edx
xor eax, 0x64802533
call fcn.100a5b2c
mov bl, 0xee
pop ebp
loope 0x1003d34c
mov word [edi], fs
invalid
xor bl, dl
int3
xchg ecx, eax
jb 0x1003d2f2
xlatb
ret 0x599e

Function at 0x1003f425
Capabilities:
Encode data using base64

Disassembly:
call fcn.100b819e
lea ecx, [eax + edx*8 - 0x30edb6f3]
sar cl, cl
jae fcn.1009d686
call fcn.10189159
mov word [edx], ax
lea ecx, [ebp - 2]
mov dword [esp + 8], 0xc80c2daa
mov dword [ebp - 6], ecx
mov edx, 0xec952d11
add ebp, 0xfffffffa
push edx
shl word [esp + 1], 0x67
pop ecx
pop ecx
pop edx
pop ecx
jae fcn.100b0bcf
pop edi
or byte [ecx + 0x67], ch
or dword [ebx], ecx
pop ecx
arpl word [edx + 0x696d743b], dx
inc ebx
xchg edx, eax
cmp esi, dword [ecx + ebp + 0x6a]
cmp al, 0xb6
pop ebx
sub byte [edi], bh
mov dword [0x7fb65da7], eax
and eax, 0xa9835f5
inc esi
bound ecx, qword [esi + ebx*4]
or edx, dword [ebx]
mov byte [eax + 9], bh
mov eax, 0x8ae08839
push esi
enter 0x2749, 0x28
add bh, byte [ebp + 0x3e]
push ds
xor dword [eax + 0x40], 0x3d
push ds
cmp dword [esi + 0x56], 0x35
push ds
and dword [esi], 0x22
push ds
sbb dword [eax + ecx + 3], 0xfffffffe
adc byte [eax + 0x22], ch
mov ch, 0x9c
arpl word [ebp - 0x46f3fbbc], cx
cmp dword [ebx], esp
sahf
mov ecx, 0x66c90b66
sal ecx, 7
mov dword [eax], edx
lea eax, [ecx*2 - 0x1365b064]
not word [esp + eax - 0x5fd78898]
dec ecx
mov eax, dword [eax + ebp - 0x5fd788a1]
call fcn.100b16d2
pmulld xmm0, xmmword [0x1000bb00]
call fcn.10016b60

Function at 0x10052451
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx*2 - 0x646df3c6], 0x7f99c835
pop ecx
xor ebx, eax
bswap ecx
bswap ecx
add ebp, eax
mov eax, edx
sar eax, cl
mov ecx, dword [esi + eax*2 - 0x322]
dec dx
jle 0x1015e8ee
xor bl, dl
sal byte [esp + eax*2 - 0x60210b0c], 0xe5
mov word [ebp + eax - 0x30108588], dx
pop edx
mov ecx, dword [edx + esi - 0x2000847f]
shl ax, 0x41
sal eax, 0x1a
lea esi, [eax + esi - 0x2ffffffb]
and al, 0xa0
xor ecx, ebx
rol eax, 0xca
call fcn.100ad2f3
lea edx, [edx + eax + 0x6467e150]
xor ebx, edx
add esi, edx
neg ecx
not cx
movzx ax, byte [eax + edi - 0x32a53e3e]
mov edx, dword [esp]
mov cl, byte [edi + 2]
add edi, 2
neg edx
rol dx, 0x2b
inc edx
adc al, cl
mov word [edi + edx - 0x7dfc1601], ax
call fcn.10143633
xchg byte [eax], bl
pop ebx
loope 0x100524b4
cmc
rol edx, 1
jecxz 0x10052505
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
rol edx, 1
jecxz 0x10052543
jecxz 0x100524f3
rol edx, 1
jecxz 0x1005252d
sub edi, ebp
rol edx, 1
jecxz 0x10052567
sub eax, dword [ebp - 0x3c]
rol byte [ebx + 0x2f35521a], 0x7c
and dl, byte [eax - 0x30c020c]
jge 0x10052565
inc ebp
invalid
jmp 0x36a3f96f
sub ah, dl
xchg esp, eax
call fcn.10075d1c
movzx cx, byte [ebp]
mov edx, 0xe0267b24
mov al, byte [ebp + 2]
or cl, al
not cl
lea eax, [edx*4 + 0x370b633d]
dec dx
mov word [ebp + 2], cx
mov eax, dword [esi - 4]
sub esi, 4
xor eax, ebx
call fcn.10104c72
add ah, byte [ecx]
inc esp
and al, 4
Function at 0x10058ac8
Capabilities:
Encode data using xor

Disassembly:
movzx edx, word [ebp + edx - 0x701f4002]
xor ecx, ecx
call fcn.1008fab9
xor eax, 0xbc191132
sar edx, cl
not edx
neg eax
shl edx, cl
lea eax, [eax + edx*2 - 0x52e419e7]
xadd cl, dh
xor ebx, eax
jmp 0x10169f41
dec ecx
or eax, 0x5518879f
not ecx
not edx
call fcn.1018059a
call fcn.1011dc7d
mov dword [ebp + eax - 0xae], edx
xor eax, 0x6a1c3136
seto cl
adc cx, ax
mov ecx, dword [esi + ecx - 0x5c207098]
sub eax, eax
mov edx, eax
setp al
lea esi, [eax + esi + 3]
xor ecx, ebx
rol dx, 7
adc dl, dh
lea ecx, [eax + ecx - 0x298b0405]
neg eax
sal eax, 0x71
jp 0x1018e1cd
add edi, eax
sal ecx, 0x2a
call fcn.10035f7d
add ecx, dword [esi + ecx]
xor ecx, ebx
call fcn.100c0a8b
cmp esp, dword [ebx + 0x4c72e148]
push 0xffffffffffffffd1
jecxz 0x10169f41
add ah, byte [edx + ebp*2]
shl ebx, 1
lcall 0x4ee3, 0xd16a18da
fidiv dword [edx + ebp*2 - 0x2f]
jecxz 0x10169fd3
xchg byte [eax - 0x87c2c81], bh
cmpsd dword [esi], dword es:[edi]
invalid
mov word [ecx - 0x1c5d62d8], es
inc eax
xor eax, dword [esp + eax - 0x3719237d]
rol ecx, 3
jmp 0x10155d46
xor ecx, 0x222c978b
dec eax
rol ecx, 3
lea ecx, [edx + ecx - 0x2eb59a2e]
not dl
not ecx
shr ax, 0x8e
add edx, eax
xor ebx, ecx
sar edx, 0xe2
bswap edx
or dx, ax
adc edi, ecx
sal edx, 0xd4
lea ecx, [eax*8 - 0x78c25762]
push edx
pop eax
js fcn.100d8b50

Function at 0x1006134e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sbb ecx, ecx
mov dword [ebp + ecx], eax
dec cx
push edx
mov edx, dword [ecx + esi - 0xffff]
push ecx
add byte [esp + ecx*2 - 0x1fffc], ch
lea esi, [ecx + esi - 0xfffb]
movzx eax, word [esp + ecx - 0xfffb]
jnp 0x101747ed
xor edx, ebx
ror ax, 4
lea edx, [edx + ecx - 0x298c0403]
push ecx
sbb dword [esp + ecx*2 - 0x1fff6], eax
xor edx, 0x222c978b
dec byte [esp + ecx - 0xfffa]
neg ecx
rol edx, 3
mov dword [esp + eax*4 - 0x15fab], ecx
xor al, byte [esp + eax - 0x57ea]
sbb cx, 0x5814
lea edx, [edx + eax*2 - 0x2eb64a06]
not edx
call fcn.10142283
movzx eax, byte [esi]
add esi, 1
mov edx, 0x68afff17
push edx
xor al, bl
sar edx, 0x21
ror byte [esp + edx - 0x3457ff8b], 0x42
movsx ecx, dl
xor al, 0xa
push ecx
shr dword [esp + edx*2 - 0x68afff14], cl
ror al, 1
or dx, cx
and ecx, dword [esp + edx - 0x3457ff89]
ror dl, 2
xor al, 0x33
dec dl
shl dword [esp + edx - 0x3457ffdd], cl
ror al, 1
xor bl, al
lea ebp, [ebp + edx*2 - 0x68afffc4]
mov word [edx + ebp - 0x3457ffe1], ax
inc dx
call fcn.1011e3b3
mov ecx, 0x68ae8d38
mov eax, 0xc08ee808
mov ecx, dword [ebp + ecx - 0x68ae8d38]
mov edx, 0x92853a3c
ror dx, 0xa8
adc eax, 0xaa9164a4
movzx ax, byte ss:[ecx + eax - 0x6b204cac]
lea ecx, [edx*2 + 0x2c9faf12]
jb 0x100de408
Function at 0x10099e90
Capabilities:
Encode data using base64

Disassembly:
movzx ecx, byte [esi]
xor cl, bl
sub cl, 0x24
mov edx, 0x83ace529
movsx eax, dl
rol cl, 1
shr ax, 0xee
not dx
sbb cl, 0xa4
not dx
neg edx
xor cl, 0x23
sar dx, 0xe3
push edx
xor bl, cl
shl dx, 0x46
lea ecx, [esp + ecx + 4]
xchg dword [esp + edx - 0x7c53d680], edx
xadd dl, dh
xor ax, word [ecx + eax*8]
movsx ecx, dx
not ecx
bswap edx
mov word [edi + edx - 0x5d5a537e], ax
dec cl
movsx eax, cl
shl dword [esp + edx - 0x5d5a537c], 0xae
movzx ecx, byte [esi + edx - 0x5d5a537b]
shr byte [esp + edx - 0x5d5a537b], 0x23
not al
xor cl, bl
xor byte [esp + edx - 0x5d5a537b], 0x28
shr dx, 0xc8
xor cl, 0x92
not dl
inc cl
pop edx
not eax
or dl, 0x1b
neg cl
push edx
rol word [esp + eax*4 - 0x282], 0xa8
dec cl
call fcn.1002c10e
xor ebx, edx
add edi, edx
call fcn.10053f34
jmp 0x10039be7

Function at 0x1009a2ba
Capabilities:
Encode data using base64

Disassembly:
ror ecx, 1
xor dx, 0x33be
call fcn.1010803f
mov dword [esi + edx - 0x5817bea6], eax
sub dx, 0x4a36
mov ecx, edx
pop eax
mov eax, dword [ebp + ecx - 0x58177478]
neg edx
xor eax, ebx
inc eax
or cl, 0x27
bswap eax
mov dword [esp + ecx - 0x58177477], edx
neg ecx
sub ecx, edx
rol eax, 1
pop ecx
dec eax
shr cx, cl
xadd cl, dh
add cx, cx
xor ebx, eax
bswap edx
add edi, eax
add ecx, edx
mov eax, dword [esi + ecx - 0x33f0e9c9]
sar ecx, cl
push edx
sar dword [esp + ecx - 0x19f87], 0xd0
lea esi, [esi + ecx - 0x19f7f]
or edx, ecx
movzx edx, byte [ecx + ebp - 0x19f8c]
shr ecx, 0xc9
rol byte [esp + ecx - 0xcf], 0xa5
jbe 0x1008c049
lea ebp, [ebp + ecx*2 - 0x1a3]
js 0x10077075
xor dl, bl
not dl
sub dl, 0xb4
sal dword [esp + ecx - 0xcf], cl
js 0x1004edaa
lea edx, [esp + edx + 0xc]
sar dword [esp + 3], 0x69
mov eax, 0xd4acb111
movzx ecx, word [esp + 2]
mov ax, word [edx + ecx*8 - 0x24ab8]
xchg dword [esp + ecx - 0x4956], ecx
lea edx, [ecx*2 - 0x1a5a845b]
xchg byte [esp + ecx*4 - 0x1255efc], ch
lea edi, [edi + ecx*4 - 0x1240302]
setb byte [esp + ecx - 0x4900bf]
inc byte [esp + ecx - 0x4900bd]
mov word [edi + ecx*2 - 0x920180], ax
inc dx
pop edx
pop ecx
pop edx
jge fcn.1009d686
neg ecx
add ax, 0x44b4
jae 0x1005842f

Function at 0x1009a2c6
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
and word [esp + ecx*2 - 0x2c226716], cx
sbb word [esp + ecx*2 - 0x2c226718], cx
rol edx, 2
sar dword [esp + ecx*4 - 0x5844ce30], cl
inc edx
call fcn.1018b3f8
Function at 0x100b1b2d
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [esi]
mov edx, 0x7ebd4029
rol edx, 6
mov ecx, edx
add esi, 4
xadd dl, dh
or ecx, 0x3733a01d
xor eax, ebx
shl dx, 0xcc
neg eax
jmp 0x101793c5
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.10030889
jmp 0x10076f3a
call fcn.100479ef
mov ebx, dword [esp + 4]
jns 0x100c014a
jb 0x100954a5
not bl
call 0x100b1b2d
mov dword [esp], ecx
and cx, cx
mov word [esi], dx
dec dword [esp + 4]
mov eax, dword [ebp - 5]
neg dword [esp + 3]
jle 0x1016b26f
add ebp, 0xfffffffb
sub cl, ch
shr dword [esp + 3], 0x22
xor eax, ebx
call fcn.100d0372
jne 0x100ba19a
xor ebx, edx
add edi, edx
and dword [esp + ecx - 0x6bf7bef8], eax
call fcn.10136feb
shl ecx, 0xd8
shl cl, 0xe1
ror eax, 3
add dl, cl
dec edx
dec eax
sar ecx, 0xb4
xchg dh, cl
sbb dx, 0xbd9f
bswap eax
jg 0x100b7a54
mov dword [edi + ecx - 0x23e8c3ae], eax
jb 0x100fe63c
movsx eax, cx
pop edx
pop edx
jae fcn.1009d686

Function at 0x100bab4c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor ebx, ecx
call fcn.100a63d2
push edx
lea edi, [edi + ecx*8 - 0x6fc]
push ecx
xor eax, ebx
sal word [esp + ecx*2 - 0x1bf], 0xe1
lea eax, [eax + ecx*4 - 0x2c2eed32]
inc word [esp + ecx*2 - 0x1b9]
sal edx, 0x4f
shl dword [esp + ecx - 0xdb], 0x7a
ror eax, 1
lea eax, [eax + edx + 0x1c10d12]
xor eax, 0x73a28530
or dx, dx
sar cx, 0x8a
dec eax
xor ebx, eax
or dword [esp + ecx], ecx
sbb dword [esp + ecx*8 + 7], ecx
setp dl
adc esi, eax
add cx, 0x458a
call fcn.1014f0d4

Function at 0x100e76ff
Capabilities:
Authenticate hmac

Disassembly:
bswap ecx
dec ecx
mov dword [esp + edx - 0x16233901], edx
call fcn.101624af

Function at 0x100ec6ca
Capabilities:
Encode data using base64

Disassembly:
inc edx
rol edx, 1
sal cx, 0xae
xor ebx, edx
sar eax, 0xeb
adc esi, edx
not cl
and eax, dword [esp + eax*2 + 4]
pop ecx
pop ecx
jbe fcn.1009d686

Function at 0x100f03fd
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 0x699b568e
mov edx, dword [eax + esi - 0x699b568e]
movzx ecx, al
push eax
lea esi, [esi + ecx*8 - 0x46c]
lea eax, [eax + edx - 0x6d5574b9]
xor dx, dx
bswap eax
ror eax, 2
rol dl, 0x21
sbb dword [esp + edx - 0x4022fffc], edx
sbb eax, 0x77816b9f
ror edx, 0x87
sal dword [esp + edx - 0x8045fc], 0xed
je 0x100e62b3
xor ebx, eax
inc word [esp + edx - 0x8045fc]
jl 0x10190469
add ebp, eax
lea eax, [edx + edx*4 - 0x7df06077]
lea ecx, [eax*8 - 0xde200cb]
mov edx, dword [edi + edx*8 - 0x4023000]
mov ecx, dword fs:[ecx + edx - 0x16a5eb7d]
not ax
mov dword [edi], ecx
pop ecx
pop eax
jmp ebp
Function at 0x1010d96d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.10052850
xor ebx, eax
and dword [esp + edx*4 - 0x28e0038c], 0x991c9d0e
shr ecx, cl
adc ebp, eax
mov eax, dword [esp + edx - 0xa3800e0]
pop ecx
mov ecx, dword [edi + edx*2 - 0x147001c8]
pop edx
mov dx, word ss:[ecx + edx*4 - 0x20028]
movsx ecx, al
inc eax
not al
mov cx, dx
add al, ah
mov ax, word [eax + edi - 0x8070]
mov edx, 0xdf9607ba
sar dl, 0xa1
xor edx, 0xe5ba9db5
not cx
dec dl
jge 0x1019c933
mov edx, 0xe593d383
sub esi, 4
movzx eax, dx
bswap eax
mov ecx, dword [esi]
xor ecx, ebx
shl edx, 0xe
not ecx
or edx, edx
or edx, edx
bswap ecx
lea ecx, [ecx + eax - 0x17228ffb]
not ecx
inc dl
dec edx
or eax, eax
xor ebx, ecx
dec edx
add ebp, ecx
mov edx, dword [edi]
xor al, al
or ax, word [edx]
add edi, 2
call fcn.101623c4
xor edx, edx
not ax
jbe 0x100290b5

Function at 0x1011f7dd
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp], ax
movzx ecx, dx
add word [esp + ecx - 0x2fff], 0xb11c
mov edx, dword [ecx + esi - 0x3001]
lea esi, [esi + ecx*8 - 0x18004]
xor dword [esp + ecx*2 - 0x6002], ecx
adc dword [esp + ecx*8 - 0x18008], 0xeb324392
lea ecx, [ecx*2 + 0x11309319]
xor edx, ebx
sub cx, cx
add cx, 0x8681
lea edx, [ecx + edx + 0x32d6bbbd]
movsx eax, byte [esp + ecx*2 - 0x22610d02]
bswap edx
and byte [esp + ecx - 0x11308681], cl
adc cl, byte [esp + ecx*2 - 0x22610d00]
inc edx
rol edx, 2
dec edx
neg eax
push ecx
ror word [esp + ecx - 0x113086e2], cl
not edx
sal dword [esp + ecx - 0x113086e2], cl
neg edx
call fcn.10106fe8
mov ecx, 0xcf07662a
sub esi, 1
movzx ecx, byte [esi]
xor cl, bl
mov eax, 0xb31d4517
inc cl
call fcn.1012cc80
mov dword [esp], ecx
xor eax, ebx
dec eax
xor eax, 0x5221d983
inc eax
call fcn.1014be52
mov ecx, 0xaf1b8e18
movzx ecx, byte [esi]
mov edx, 0xb7175da7
dec dl
push edx
add esi, 1
sal dx, 0xeb
xor cl, bl
movzx eax, dl
and al, 0xa1
xor cl, 0x21
shl ax, 0x2c
rol cl, 1
dec cl
not cl
sal ax, 0xc1
xor bl, cl
lea ecx, [esp + ecx + 4]
add ax, word [eax + ecx]
inc edx
setge byte [esp]
or dx, dx
sbb ebp, 2
jmp 0x1003e91c

Function at 0x1014aedf
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp]
xor edx, ebx
rol edx, 2
lea ecx, [eax*2 - 0x2567786c]
sub eax, eax
not edx
mov dword [esp + eax*8], ecx
sbb dword [esp + eax*2], ecx
call fcn.100ec6ca
Function at 0x10152985
Capabilities:
Encode data using xor

Disassembly:
pop eax
pop ecx
pop edx
pop edx
jnp fcn.100fb4c5
rol cl, 4
setbe cl
lea esi, [esi + ecx + 3]
movsx eax, cl
ror ecx, 0xc7
xor edx, ebx
neg eax
jno 0x101433e5
mov edx, 0xd8aba38b
add cl, al
movzx eax, dx
ror dl, 0xc3
mov word [eax + ebp - 0xa38b], cx
jmp edi
push ecx
xor edx, 0x2a1b9e0e
rol edx, 2
sal word [esp + ecx - 0x1fffffe], 0xee
add al, byte [eax]
add dh, bh
out dx, al
neg edx
xchg ecx, eax
xor edx, ecx
rol edx, 1
inc ecx
bswap eax
sub edx, 0x82a8d812
rol edx, 2
shr dword [esp + ecx*2], 0xcf
dec edx
lea eax, [ecx + 0x62af7cb2]
call fcn.1009d649
mov ecx, dword [ebp + 4]
mov edx, 0xea4d09b
lea ebp, [ebp + edx*2 - 0x1d49a132]
not eax
xor dl, dl
not ecx
call fcn.10160f83
pop ebx
or byte [edx - 0x1f], cl
lcall 0x3606, 0xe3d3c168
pop eax
rcl ebx, 0xe3
mul dh
dec eax
rcl ebx, 0xe3
fidivr word [edx]
sub al, 0xc1
shl ebx, cl
push 0x6e
test ah, dl
rol dword [ebx + 0x3d000d53], 1
pop esp
jo 0x101433f3
mov al, 0xd9
mov bl, 0x29
call 0x83866125
daa
invalid
xor ecx, ebx
call fcn.10119fc5
neg eax
jge 0x1018455a
mov eax, 0xed28d236
lea edx, [eax*4 + 0x5b971e3c]
lea edx, [edx + eax*8 - 0x4a5084e9]
mov eax, dword [edx + ebp - 0x2f3073db]
movzx ecx, dl
sar ecx, 0x36
mov edx, dword [ebp + ecx + 4]
lea ebp, [ecx + ebp + 8]
rol ecx, 0x5a
mov dword ss:[eax + ecx*8], edx
setb cl
mov edx, dword [ecx + esi]
je 0x10110046
mov eax, dword [esi + eax*2 - 0x21a40086]
lea edx, [ecx + ecx*8 - 0x84b046e]
xadd dword [esp + 2], ecx
shl dword [esp + 2], 0x25
mov ecx, dword [esi + 4]
jns fcn.10034bad
and word [esp + 2], 0x39ab
pop edx
adc esi, 4
or byte [esp + 2], dh
not eax
jno 0x1019b642
lea edx, [edx + edx*8 - 0x13f6eefe]
jbe 0x100600ae
not ecx
rol edx, 0xbc
and edx, dword [esp]
neg edx
and eax, ecx
sal dword [esp], 0xbd
movzx ecx, byte [esp]
mov dword [esi + ecx], eax
mov dword [esp + ecx], edi
ret

Function at 0x1016cb30
Capabilities:
Encode data using base64

Disassembly:
shr ecx, cl
movzx ecx, byte [esi + edx*2 - 0x7c079890]
lea esi, [esi + edx*2 - 0x7c07988f]
movsx eax, word [esp + edx*2 - 0x7c07988a]
shl dx, 0x23
xor cl, bl
sar byte [esp + edx - 0x3e03624c], 0x61
dec cl
not cl
shl ax, 0xc9
ror cl, 1
inc word [esp + eax - 0xeff5]
xor cl, 0xb0
push eax
xor bl, cl
lea ecx, [esp + ecx + 0x14]
rol eax, 0xff
adc dword [esp + edx - 0x3e036248], edx
sub byte [esp + edx*2 - 0x7c06c4ab], 0xa9
mov eax, dword [ecx + eax - 0x7800]
mov dword [ebp + edx*2 - 0x7c06c4b6], eax
sar byte [esp + edx - 0x3e036254], 0x67
lea ebp, [ebp + edx*2 - 0x7c06c4b6]
lea ecx, [edx*8 + 0x7b15e439]
ror cl, 0x43
pop ecx
pop eax
pop eax
pop edx
pop ecx
je fcn.100d8b50
mov edx, dword [ebp]
mov eax, 0x92a13201
add ebp, 4
lea eax, [eax*4 - 0x6e7a92c3]
xchg edx, ebp
movzx ecx, al
neg ax
mov edi, edx
jnp fcn.1016bd1d
add esi, ecx
mov edx, dword [esp + 0xc]
add edx, 0x12934b
jmp edx
bswap eax
push edx
sbb edx, ecx
mov dword [esp + edx*2 - 0x7c079892], ecx
inc eax
xor ecx, dword [esp + edx - 0x3e03cc49]
sbb dword [esp + edx - 0x3e03cc47], 0x8133e93c
push edx
xor eax, 0x4d00ff88
push ecx
xor ebx, eax
neg byte [esp + edx*2 - 0x7c079896]
add edi, eax
jmp 0x1001a9e7
Function at 0x10173cf9
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ebp]
call fcn.100bb412
or edx, edx
mov dword [esi], ecx
mov dword [esp], edx
sbb ebp, 4
lea ecx, [edx*2 - 0x72dcbd43]
jmp 0x100fe5c7

Function at 0x1018b156
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movzx ecx, dx
or cx, 0x69b1
lea esi, [esi + ecx*2 - 0xf76a]
sub dl, dl
jg 0x1019043b
and edx, ecx
xor eax, ebx
not ecx
lea edx, [edx - 0x314b9eea]
inc cl
xor eax, 0xb139d81e
dec ecx
rol eax, 2
not eax
xadd edx, ecx
inc word [esp]
shld eax, edx, cl
mov ecx, 0x271fdc0d
push ecx
lea edx, [ecx*2 - 0x4f4727c3]
mov dword [ecx + edi - 0x271fdc0d], eax
shr dword [esp + ecx - 0x271fdc09], 0x34
jnp 0x10064c7d
lea esi, [esi + ecx*2 - 0x4e3fb81e]
mov eax, 0xc38f8ea9
xchg dword [esp + ecx*2 - 0x4e3fb816], edx
mov eax, dword [ecx + esi - 0x271fdc0d]
xor eax, ebx
mov byte [esp + ecx - 0x271fdc09], dl
dec cl
shl edx, 0xfb
ror eax, 3
shl byte [esp + ecx - 0x271fdc05], 0x22
neg word [esp + ecx*2 - 0x4e3fb812]
add dl, 0x3d
xor eax, 0x3cbdfd08
lea eax, [eax + edx*4 + 0x24a466c5]
pop ecx
or cl, cl
neg eax
lea eax, [eax + ecx - 0x6551bf16]
call fcn.101647b6
call fcn.1015f040
mov eax, dword [edx + edi - 0x668be89e]
lea ecx, [edx + 0x600ef415]
mov edx, dword [edx + edi - 0x668be89a]
mov cl, byte [edi + 8]
push 0x3a0eb9a4
add edi, 6
jmp 0x10150892
sbb edx, edx
pop edx
add ecx, ecx
bswap eax
ror eax, 1
mov dword [esp], ecx