joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ea0e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00416094
push ebx
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040e548
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0
jne 0x40ea43
xor eax, eax
jmp 0x40ebb3
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x3ff
push dword [ebp + 0x18]
lea eax, [ebp - 0x804]
push eax
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ea8a
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40ebb3
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x1014], eax
jmp 0x40eb43
lea eax, [ebp - 0x804]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40eb89
lea eax, [ebp - 0x804]
mov dword [ebp - 0x100c], eax
mov eax, dword [ebp - 0x100c]
push dword [eax]
push 0x41b884
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40eb89
mov dword [ebp - 0x1008], 0
jmp 0x40eb02
inc dword [ebp - 0x1008]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x1008]
cmp dword [eax], ecx
jle 0x40eb31
mov eax, dword [ebp - 0x1008]
mov al, byte [ebp + eax - 0x804]
mov ecx, dword [ebp - 0x1008]
mov edx, dword [ebp + 0x1c]
mov byte [ecx + edx], al
jmp 0x40eafc
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp + 0x1c]
mov byte [eax + ecx], 0
jmp 0x40eb89
cmp dword [ebp - 0x1014], 1
jl 0x40eaed
cmp dword [ebp - 0x1014], 2
jle 0x40ea9a
cmp dword [ebp - 0x1014], 4
jl 0x40eaed
cmp dword [ebp - 0x1014], 5
jle 0x40eaaf
cmp dword [ebp - 0x1014], 7
je 0x40ea9a
jmp 0x40eaed
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40eba9
xor eax, eax
jmp 0x40ebb3
mov eax, 1
jmp 0x40ebb3
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x40ebba
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040e548
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40ebe2
xor eax, eax
jmp 0x40ec15
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x40ec0e
mov eax, 1
jmp 0x40ec10
xor eax, eax
jmp 0x40ec15
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40ee07
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 5
lea eax, [ebp - 0x18]
push eax
push 0
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x40ee8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x40ee84
lea eax, [ebp - 0x18]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40ee7f
xor eax, eax
jmp 0x40ef9b
jmp 0x40ee8b
xor eax, eax
jmp 0x40ef9b
lea eax, [ebp - 8]
push eax
push 0
push 0
push 2
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40eead
xor eax, eax
jmp 0x40ef9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x40eec3
xor eax, eax
jmp 0x40ef9b
mov eax, dword [ebp - 8]
add eax, 3
and al, 0xfc
call fcn.00416094
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x10], 0
jne 0x40eee4
xor eax, eax
jmp 0x40ef9b
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push 2
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40ef08
xor eax, eax
jmp 0x40ef9b
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40ef3a
xor eax, eax
jmp 0x40ef9b
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
jmp 0x40ef50
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp dword [eax], ecx
jbe 0x40ef8a
push dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push dword [ecx + eax*8 + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40ef85
mov dword [ebp - 0x14], 1
jmp 0x40ef8a
jmp 0x40ef4d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x14]
jmp 0x40ef9b
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fad3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetRectEmpty]
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40fb12
xor eax, eax
jmp 0x40fb8f
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 0xc], eax
xor eax, eax
jmp 0x40fb8f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410503
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
push edi
call fcn.0041068f
mov dword [ebp - 0x1c], 1
cmp dword [ebp + 0x10], 0
je 0x410529
mov dword [ebp - 0x1c], 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x410541
xor eax, eax
jmp 0x410688
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x410559
xor eax, eax
jmp 0x410688
push 0xfffffffffffffff4
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov word [ebp - 0x74], ax
movsx eax, word [ebp - 0x74]
cmp eax, 0x514
je 0x41057e
xor eax, eax
jmp 0x410688
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
cmp eax, 0x23
jle 0x4105a1
xor eax, eax
jmp 0x410688
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x50
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameA]
push str.static
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4105e7
xor eax, eax
jmp 0x410688
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and eax, 0xf
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 7
je 0x41060f
xor eax, eax
jmp 0x410688
mov eax, dword [ebp + 0x10]
mov dword [0x41b88c], eax
push 0
push dword [0x4194ec]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x50000000
push str.CutWinName
push 0x41b8b4
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 0x78], eax
push dword [ebp - 0x78]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x410675
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push dword [ebp - 0x78]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x78]
jmp 0x410688
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x414710
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
lea eax, [esp]
push ebx
push esi
push edi
mov esi, dword [esp + 0x118]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push eax
call edi
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x11c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push esi
call edi
pop edi
cmp ebx, 1
sbb eax, eax
pop esi
inc eax
pop ebx
add esp, 0x108
ret 8

Function at 0x4155f0
Capabilities:
Encode data using xor

Disassembly:
mov dl, 1
mov al, byte [esp + 4]
test al, al
je 0x415608
mov cl, al
shr al, 1
and cl, 1
xor dl, cl
test al, al
jne 0x4155fa
xor eax, eax
mov al, dl
ret 4

Function at 0x4160c1
Capabilities:
Accept command line arguments
Query environment variable
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x416d34
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x41bd30], eax
mov al, ah
and eax, 0xff
mov dword [0x41bd3c], eax
mov eax, dword [0x41bd30]
shr dword [0x41bd30], 0x10
and eax, 0xff
mov dword [0x41bd38], eax
shl eax, 8
add eax, dword [0x41bd3c]
mov dword [0x41bd34], eax
call fcn.00416c8a
mov dword [ebp - 4], 0
call fcn.00416b9c
call fcn.00416b91
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x419d2c], eax
call fcn.00416705
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [0x41baec], eax
call fcn.0041663a
call fcn.004162ff
mov esi, dword [0x419d2c]
mov al, byte [esi]
cmp al, 0x22
jne 0x41617f
mov al, byte [ebp - 0x28]
inc esi
mov al, byte [esi]
test al, al
je 0x416177
cmp al, 0x22
jne 0x41616c
cmp byte [esi], 0x22
jne 0x416189
inc esi
jmp 0x416189
cmp al, 0x20
jbe 0x416189
inc esi
cmp byte [esi], 0x20
ja 0x416183
cmp byte [esi], 0
je 0x416199
cmp byte [esi], 0x20
ja 0x416199
inc esi
cmp byte [esi], 0
jne 0x41618e
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x4161b9
movzx eax, word [ebp - 0x40]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0041632f
jmp 0x4161f5
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416351
Capabilities:
Terminate process

Disassembly:
mov dword [0x41bd68], 1
cmp dword [esp + 8], 0
push ebx
push esi
mov ebx, dword [esp + 0x14]
mov byte [0x41bd64], bl
jne 0x4163ad
cmp dword [0x419d28], 0
je 0x41639b
mov esi, dword [0x419d20]
sub esi, 4
cmp dword [0x419d28], esi
ja 0x41639b
mov eax, dword [esi]
test eax, eax
je 0x416390
call eax
sub esi, 4
cmp dword [0x419d28], esi
jbe 0x416388
push 0x41c608
push 0x41c604
call fcn.004163d0
add esp, 8
push 0x41c610
push 0x41c60c
call fcn.004163d0
add esp, 8
test ebx, ebx
jne 0x4163cd
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
ret
Function at 0x41814b
Capabilities:
Set environment variable

Disassembly:
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
test esi, esi
je 0x41833b
push 0x3d
push esi
call fcn.00418567
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x41833b
cmp ebp, esi
je 0x41833b
cmp byte [ebp + 1], 1
sbb eax, eax
mov ecx, dword [0x41bd50]
neg eax
mov dword [esp + 0x10], eax
cmp dword [0x41bd4c], ecx
jne 0x4181a8
mov eax, dword [0x41bd4c]
push eax
call fcn.004183a5
add esp, 4
mov dword [0x41bd4c], eax
cmp dword [0x41bd4c], 0
jne 0x418237
cmp dword [esp + 0x1c], 0
je 0x4181d3
cmp dword [0x41bd54], 0
je 0x4181d3
call fcn.00417dc3
test eax, eax
je 0x418237
jmp 0x41833b
cmp dword [esp + 0x10], 0
je 0x4181e1
xor eax, eax
jmp 0x418340
cmp dword [0x41bd4c], 0
jne 0x41820c
push 4
call fcn.00417050
add esp, 4
mov dword [0x41bd4c], eax
test eax, eax
je 0x41833b
mov eax, dword [0x41bd4c]
mov dword [eax], 0
cmp dword [0x41bd54], 0
jne 0x418237
push 4
call fcn.00417050
add esp, 4
mov dword [0x41bd54], eax
test eax, eax
je 0x41833b
mov eax, dword [0x41bd54]
mov dword [eax], 0
mov edi, dword [0x41bd4c]
sub ebp, esi
push ebp
push esi
call fcn.00418348
add esp, 8
mov ebx, eax
test ebx, ebx
jl 0x41828d
cmp dword [edi], 0
je 0x41828d
cmp dword [esp + 0x10], 0
je 0x418288
lea eax, [edi + ebx*4]
cmp dword [eax], 0
je 0x418271
mov ecx, dword [eax + 4]
inc ebx
mov dword [eax], ecx
add eax, 4
cmp dword [eax], 0
jne 0x418263
lea eax, [ebx*4]
push eax
push edi
call fcn.00418415
add esp, 8
test eax, eax
je 0x4182c8
jmp 0x4182c3
mov dword [edi + ebx*4], esi
jmp 0x4182c8
cmp dword [esp + 0x10], 0
jne 0x418337
test ebx, ebx
jge 0x41829e
neg ebx
lea eax, [ebx*4 + 8]
push eax
push edi
call fcn.00418415
add esp, 8
test eax, eax
je 0x41833b
lea ecx, [eax + ebx*4]
mov dword [ecx], esi
mov dword [ecx + 4], 0
mov dword [0x41bd4c], eax
cmp dword [esp + 0x1c], 0
je 0x418333
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00417050
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x418333
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 1
sbb eax, eax
lea ecx, [ebp + ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov byte [ecx], 0
lea ecx, [ecx + 1]
and eax, ecx
push eax
push ebx
call ebp
push ebx
call fcn.004173e9
add esp, 4
xor eax, eax
jmp 0x418340
xor eax, eax
jmp 0x418340
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x100a4f1e
Capabilities:
Encode data using xor

Disassembly:
xor al, byte [ebx]
retf 0x8103
and eax, dword [esp + 4]
lea ecx, [ecx + eax*2 - 0x2f0f97aa]
add byte [esp + eax + 0xa], 0x2d
movzx edx, byte [esp + eax*2 + 5]
call fcn.1011c4bd
and ebp, esi
jp 0x100a4ecc
or dword [esi], ebp
inc edx
out dx, al
sub byte [ecx + 0x2e], 0x65
inc edx
push esi
mov ah, 0x49
inc edx
jle 0x100a4ed6
or dword [esi], ebp
inc edx
sahf
lodsb al, byte [esi]
and dword [esi], ebp
inc edx
scasb al, byte es:[edi]
test byte [ecx + 0x2e], ah
inc edx
inc esi
in al, 0xd9
inc edx
invalid

Function at 0x100af91d
Capabilities:
Encode data using xor

Disassembly:
or al, 0x27
adc eax, 0xce2e541
daa
int 0x7b
invalid
push 0x93196a37
call fcn.1009692b
jne 0x100af95d
cdq
enter 0xffffffffffffc6de, 0xffffffffffffffc0
and byte [ebx - 0x7b], ah
add dl, 0xc0
and byte [ebx - 0x3f], ah
pop esi
xchg edx, eax
shl byte [eax], 0x63
add byte [esi + 0x5a], ah
sub al, byte [ebx - 0x37]
stosb byte es:[edi], al
mov ebp, 0xda32a863
pushal
pushfd
xor ah, byte [esi]
leave
jecxz 0x100af92a
cmc
dec eax
cmpsb byte [esi], byte es:[edi]
loope 0x100af96a
shl byte [edx + edx*8 + 0x73eff26f], 0x27
test al, 0xad
add al, 0x93
pop edx
push ecx
add byte [edi - 0xc06d3b], dh
dec eax
lodsd eax, dword [esi]
jae 0x100af9bd
push edx
in al, 0x6a
or edi, ecx
sar dword [esi], cl
clc
adc dword [edx], edx
sbb eax, 0x13cd1a28
jge 0x100af9d1
push eax
jno 0x100af908
in al, dx
jmp [edx + 0x20]
mov dl, 0xc7
stosd dword es:[edi], eax
push ebp
push 0xe8869129
pop eax
call 0xc177eb3f
sbb dh, ch
jle 0x100af9b0
insb byte es:[edi], dx
mov cl, 0x18
out dx, al
retf 0x119f
dec edx
aam 0x25
arpl cx, bp
je 0x100afa11
ret 0x36ec
or eax, 0x6fea16ce
mov word [ecx + 9], ds
ficom word [esi + 0x24]
in eax, 0x64
mov word [edx + 0x22f96684], gs
sub byte [ecx - 0x1f], dl
ljmp 0x8c39
Function at 0x100be332
Capabilities:
Encode data using xor

Disassembly:
test byte [esi*4 + 0x45bcc64e], dl
movzx ecx, sp
inc ecx
pop edi
dec esp
lea ebx, [ebp + ebx*2 + 0x8be83a2]
call fcn.1014f09d
dec eax
mov dword [esp], 0xe035304
inc ecx
mov eax, dword [eax]
dec ecx
add eax, 4
inc ecx
xor eax, edi
mov ebx, dword [esp]
push ebx
xor eax, 0xf431d43a
lea eax, [eax + ebx + 0x4f3c700d]
dec eax
shr dword [esp + ebx - 0xe035303], 0x8f
dec eax
lea ebp, [ebx + 0x30911a88]
xor eax, 0x7facbb83
inc ecx
pop ebx
mov ebx, 0x5b417fac
call fcn.10103b37
daa
cwde
enter 0xffffffffffffe844, 0xffffffffffffffda
and dword [ebx - 0x4d], esp
mov al, dh
fisub dword [ecx]
arpl word [edx + 0x58], di
fcomp st(2)
and dword [ebx - 0x3d], esp
jo 0x100be319
leave
inc edx
arpl di, bp
out dx, eax
lodsb al, byte [esi]
adc edx, dword [edi - 0x39]
or dword [edi + 0x1d9fc338], esi
stc
mov bl, 0xa5
lodsd eax, dword [esi]
mov al, byte [ecx]
adc al, 0x2b
push cs
mov bh, 0xa8
outsd dx, dword [esi]
dec esi
mov byte [0xd900efae], al
jnp 0x100be3ed
stosd dword es:[edi], eax
mov ebp, 0x43aec112
je 0x100be36b
push ebp
and byte [edi], al
add eax, dword [eax + 0x39]
add byte [eax], al
adc dword [eax - 0x1822a124], 0xffffffe1
adc byte [esi], dl
cmp ecx, dword [eax - 0x48f3d19e]
test eax, 0xc8f03e79
imul edi, ebp, 0xc8f03e59
int1
invalid
add edx, ebx
and dword [ebx + 0xa], esp
add dword [0x9f6321da], edx
and eax, 0x6321da79
jecxz 0x100be390
insd dword es:[edi], dx
fisub dword [ecx]
arpl word [esi - 0x1f], bp
xor eax, 0x466321da
xchg ecx, eax
test dword [ebp + 0x3d], esp
arpl word [ecx + 0x14], ax
jl 0x100be420
aaa
in al, dx
or al, 0x9c
cmp byte [edx - 0x65], ch
aaa
invalid
popfd
mov ebp, 0x6d1dc8f2
fnstsw word [ebp + 0x3ff5c8f2]
mov ch, 0xbd
enter 0x7525, 0xffffffffffffffcd
mov ebp, 0x1555c8f2
sbb al, 0xf0
dec eax
ror byte [edi - 0x73], 1
test byte [eax], bl
arpl di, di
invalid

Function at 0x100beb86
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], edx
mov ecx, dword [ebp]
bts ax, ax
adc ebp, 4
call fcn.100cc6bf
pushfd
push ebp
call fcn.1016e065
mov ecx, 0xebc6f35
movsx edx, cl
lea edx, [edx*2 - 0x3e7fe4f]
mov edx, dword [ebp + ecx - 0xebc6f35]
lea ebp, [ebp + ecx*8 - 0x75e379a4]
xor edx, ebx
lea ecx, [ecx + ecx*8 - 0x7d4db07d]
rol edx, 1
movzx eax, cl
bt eax, ecx
btr ecx, ecx
neg edx
add al, 0x29
inc edx
bswap edx
btr eax, 0x83
not edx
jae 0x10120755
xor ebx, edx
add esi, edx
sal ax, 0xe7
jns 0x101cf3fd
mov word [edi + ecx*4 - 0x3a91c338], ax
adc ecx, 0xd1205117
jmp esi
movzx ax, byte [edi + ecx*4 - 0x1d48e180]
or cl, 0x27
and ecx, ecx
ror ecx, 0xff
mov dl, byte [edi + ecx*8 - 0x7523866e]
lea edi, [edi + ecx - 0xea470cc]
or cx, cx
not al
not dl
or al, dl
movzx edx, cx
sal dl, 1
jp 0x100d8d35
Function at 0x100c0811
Capabilities:
Encode data using base64

Disassembly:
movzx ecx, dl
rol eax, 1
or dword [esp + ecx*4 - 0x38c], edx
xor edx, ecx
bswap eax
sar dx, 0x28
mov dword [esp + ecx*4 - 0x390], ecx
inc ecx
lea eax, [edx + eax - 0x436f0ed0]
jae 0x1011a861
bswap eax
xadd ecx, edx
sbb edx, 0x810f6628
xor ebx, eax
add esi, eax
add dx, cx
sub ecx, 0xef153d36
adc edx, 0xfe1d3184
mov eax, dword [edi + edx - 0x7d0dcd29]
or dword [esp + edx - 0x7d0dcd21], edx
mov edx, dword ss:[eax + edx - 0x7d0dcd25]
lea eax, [ecx*2 + 0x2403c497]
xadd ax, cx
sal eax, 0xd2
mov dword [edi + eax*2 - 0x7cf00004], edx
lea edi, [eax + edi - 0x3e780004]
pop ecx
movsx edx, cx
btr eax, edx
pop eax
jae fcn.1010fc47

Function at 0x100c32b2
Capabilities:
Encode data using base64

Disassembly:
inc esp
xor dword [esp + eax + 0x11], ebx
xchg word [esp + edx - 0xbbfff5], bx
dec eax
shr ebx, cl
dec eax
sar ebx, 0xfd
dec esp
mov edi, dword [esp + edx*8 - 0x5dffff0]
movzx edi, dx
dec ebp
arpl bx, bx
inc ecx
mov esp, 0x3b303bc
dec ebp
adc edx, ebx
dec eax
mov dword [esp + edx*8 - 0x5e00000], 0xc010b2b2
inc esi
movzx esi, word [edx + eax - 0xbbfffb]
dec eax
inc dword [esp + edx - 0xbbfffc]
dec eax
shl dword [esp + edx - 0xbbfff8], 0x3e
shr cx, 0x68
dec ebp
lea eax, [eax + edx*4 - 0x2effff9]
inc bp
xor esi, edi
dec eax
add esi, 0x9f303a89
ror word [esp + edx*4 - 0x2effff6], 0x6d
inc cx
rol esi, 1
dec eax
imul ecx
inc cx
neg esi
dec eax
mov dword [esp + edx + 0x11], 0x67af9233
inc cx
ror esi, 1
inc sp
add esi, edx
jmp 0x1012c157
inc cx
xor esi, 0x543194b8
adc al, 6
inc sp
sbb esi, edx
inc esp
or byte [esp + edx + 0x13], ah
shl al, 0xe2
sbb ax, 0x869f
inc bp
xor edi, esi
call fcn.1009ed12
neg edx
xor ecx, 0x1022f416
lea edx, [edx + eax - 0x13c6525e]
lea ecx, [eax*2 - 0x4e4d44d2]
inc ax
bswap edx
dec edx

Function at 0x100d98d9
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
pop eax
neg edx
mov dword [esp + 4], 0xb419a8a7
mov dword [esp + 1], ecx
xor edx, 0xadb1611f
sal ecx, 7
inc edx
sar dword [esp + 4], 0x9d
add cx, 0xe08e
mov eax, 0x7dabd937
xor ebx, edx
bswap eax
push eax
shr eax, 0x5c
adc esi, edx
cwde
sar byte [esp + eax + 5], 3
mov edx, eax
mov cl, byte [eax + edi - 3]
inc eax
mov al, byte [edi + eax - 2]
or dl, byte [esp + edx*8 - 0x18]
lea edi, [edi + edx - 0x7d]
setl byte [esp + edx - 0x77]
jae 0x1012de6a
jmp 0x100a4d74
imul cl
mov dword [esp + edx - 0x79], edx
mov word [edi + edx*2 - 0xfe], ax
mov dword [esp + edx*4 - 0x1fc], esi
ret 8
Function at 0x100e1107
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp], 0x7d84a7bb
inc esp
movzx esi, byte [esp + 2]
neg ebp
sub ebp, 0x8289e52e
inc ecx
movsx edi, cx
dec esi
mov dword [esp + esi - 0x7c], edi
inc ebp
mov ebx, esi
inc ecx
push ebx
inc ecx
shr bl, cl
inc edx
xor dword [esp + esi*2 - 0xf8], ebp
dec esi
mov edi, dword [esp + esi - 0x74]
inc ebx
mov dword [esi + ebp - 0x80], ebp
inc cx
neg ebx
dec edi
lea ebp, [ebp + esi*2 - 0x104]
jo 0x100ecdb2
dec esi
mov dword [esp + esi - 0x74], ecx
inc edi
mov esp, dword [eax + esi*4 - 0x20c]
jb 0x10156710
movzx ebx, cx
dec esp
lea ecx, [ebx + esi*2 + 0x471ef718]
inc ecx
neg esp
inc eax
or dh, 8
sar cl, 0xe7
push esi
inc ecx
ror esp, 2
inc ecx
not esp
inc ebp
mov ebx, ecx
dec esp
mov dword [esp + ebx - 0x2199], edi
dec cl
inc ecx
movsx edi, cl
inc esp
xor dword [esp + ebx*2 - 0x4332], esp
inc eax
sar bh, 0x87
dec cx
shr cl, 0xc1
inc ecx
pop edi
dec ebp
arpl sp, sp
dec ebp
add edx, esp
dec ebp
mov ebx, dword [ebp + ebx - 0x2199]
dec edx
lea edx, [esi + ecx - 0x19715660]
push ecx
inc esi
mov esi, dword [ebx + ebx - 0x2199]
dec ebp
lea ebp, [ebp + ebx*2 - 0x432e]
inc ebp
mov dword [ebp + ebx*8 - 0x10cc8], esi
dec esp
mov dword [esp + ebx - 0x2199], edx
ret
dec edi
lea eax, [eax + esi*2 - 0x100]
inc ecx
movzx eax, cl
inc ebp
xor esp, edi
dec eax
lea ebx, [eax*8 - 0x75d03feb]
inc edi
lea esp, [esp + esi*8 - 0x2bbfd3c]
dec ecx
sal ecx, cl
inc ecx
neg esp
inc ecx
pop esi
movsx esi, cx
inc ecx
dec esp
dec eax
and ebx, 0x570f5034
dec eax
ror dword [esp + edi*2 - 0x2f34], cl
call fcn.1009a221
add ebp, dword [edx - 0xfd7377a]
pop esi
aas
arpl word [ebx], ax
adc al, 0xb8
pop esi
aas
arpl bx, ax
nop
mov ah, 0x5e
aas
arpl word [edi], cx
lodsb al, byte [esi]
push eax
mov ah, 0x5b
arpl bx, cx
xchg esp, eax
aaa
leave
xor al, byte [esi + 0xd]
invalid

Function at 0x100e6157
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [ecx + eax - 0x421ad53c]
shl byte [esp + eax - 0x421ad537], 0xc7
mov ecx, 0x8122f03
mov dword [eax + edi - 0x421ad53c], edx
ja 0x100a5f34

Function at 0x100e64da
Capabilities:
Encode data using base64

Disassembly:
inc byte [esp + edi*4 + 0xe]
ror dl, 1
inc bp
dec eax
lea ebx, [esi + edi*4 + 0x18b7a02e]
inc ebp
movzx esi, cl
sub dl, 0x88
inc esp
xor bh, dl
dec eax
lea edx, [esp + edx + 0x10]
dec eax
sar ebx, 0xfe
rol word [esp + edi + 0xe], 0x23
inc esp
mov byte [edx + edi*2], bl
dec eax
mov dword [esp + edi*2], ebx
shr bp, 0x27
inc ecx
xor bl, byte [eax + edi*8 + 1]
rol word [esp + edi + 1], 0x45
inc ecx
xor bl, bh
inc cx
btc esi, esi
sbb bl, 0x24
dec edi
lea esp, [esi + esi + 0x23051482]
ror bl, 1
dec eax
rol ebp, 0xc1
inc eax
sbb bl, bh
not bl
dec esp
xchg dword [esp + edi + 8], esp
dec eax
xor dword [esp + edi + 8], edi
jp 0x1016de4f