joyce8/EMBER2024-capa huggingface dataset:
Function at 0x149cb5d
Capabilities:
Encode data using base64

Disassembly:
call fcn.01449c75
dec edx
lea edi, [edi - 0x362f4a05]
dec esi
mov dword [esp - 0x362f4a09], esp
inc ecx
mov dword [esp + edi - 0x362f4a09], ecx
inc ecx
movzx ebx, cl
inc cx
sub edx, 0x87461221
xchg esp, eax
and al, 0xf7
mov ch, 0xd0
leave
dec esi
mov dword [esp - 0x362f4a09], ebp
ret
jns 0x152f996
push edx
mov dword [esp], 0x9afa7dbe
call fcn.01442334
not ecx
mov dword [edi], ecx
mov edx, 0x101bd4a6
lea eax, [edx + edx*2 - 0x4c6205c]
mov edx, dword [esi + eax*2 - 0x571abb2c]
dec al
lea ecx, [eax + eax*8 - 0x10646459]
lea esi, [esi + eax - 0x2b8d5d91]
push ecx
mov byte [esp + eax*2 - 0x571abb28], ah
xor edx, ebx
or ecx, dword [esp + eax - 0x2b8d5d95]
neg word [esp + eax*2 - 0x571abb29]
not eax
rol edx, 1
push eax
dec edx
xchg dword [esp + ecx - 0x77dfe5e4], eax
rol edx, 1
shr ax, cl
neg edx
push eax
and ax, word [esp + ecx - 0x77dfe5df]
ror dword [esp + ecx - 0x77dfe5e2], 0xe7
xor ebx, edx
call fcn.014b520f
mov eax, 0x51bc02e
mov word [eax + edi - 0x51bc02e], cx
lea edx, [eax + 0x40253a80]
mov ecx, dword [esi + eax*2 - 0xa37805c]
sub edx, edx
jle 0x14f2fad
mov eax, 0x560ac9a2
inc esp
mov edi, eax
inc ebp
mov esp, edi
dec ebp
lea eax, [eax + eax - 0x560ac9a6]
dec ecx
lea esi, [edi + eax - 0x4cfb0556]
call fcn.01459df0
shl bx, 6
dec eax
mov dword [esp + ebx*2 - 0x4e00], esi
inc ebp
lea ecx, [ecx + ebx - 0x5011649d]
dec esp
lea edi, [esi + eax + 0x21a81013]
inc ecx
not ecx
mov edx, dword [esp + ebx*2 - 0x4dfd]
dec esp
mov dword [esp + ebx - 0x26f8], esi
jns 0x150872a
lea esp, [esp + 8]
jne 0x14edd5f
pop edi
jmp 0x141908c
movzx edi, byte [edx]
jmp 0xbe1b6c
lea esi, [esi + eax - 0x51bc02a]
jge 0xc0d320
dec eax
shl dword [esp + ebx - 0x2700], 2
inc ecx
and dl, bh
inc esp
xor dword [esp + ebx - 0x26f8], ecx
mov ebp, eax
call fcn.00bd5e7c
jmp 0x14db1da

Function at 0x14bc671
Capabilities:
Encode data using base64

Disassembly:
inc esp
mov dword [edi + ebp*2 - 0x521b6e8a], edx
inc ecx
pop esp
jge fcn.01400bb8
inc ebp
mov ebx, ecx
dec edx
lea esi, [ebx*8 + 0x4b246db4]
inc ecx
xor eax, esi
call fcn.014be558
jmp 0x14c94ad
inc ecx
neg bh
sar bx, 0x26
inc ebp
sub edx, esp
inc cx
inc ebx
inc ecx
not bh
jg 0x146c2a7
dec eax
lea eax, [ecx + ebx - 0x5370ecc3]
dec ebp
lea eax, [eax + ebx*2 - 0x1b442a40]
or bx, 0x13bc
add al, 0x3f
inc ecx
mov eax, dword [eax + ebx - 0xda217be]
ja 0xc3d9ed
push ecx
inc ebp
xor dh, bh
dec esi
lea edi, [esp + edi + 8]
dec esp
xchg dword [esp + edx*4 + 0x12770], edx
inc ebp
mov edx, dword [edi + ebx - 0x6b9f005c]
dec eax
add edx, 0xb68bac26
dec eax
lea edi, [edi + ebx - 0x6b9f0060]
inc esp
and ah, byte [esp + ebx - 0x6b9f0058]
jp 0xbd5d20
dec eax
mov dword [esp + ebp*2 - 0x521b6ebe], 0x7907d05
inc ebp
xor bh, dh
inc ecx
dec bh
add ecx, esi
inc esp
mov byte [esp + ebp*2 - 0x521b6eba], bl
dec eax
sub dword [esp + ebx - 0x6b9f1715], esi
inc ecx
xor bh, 9
shl byte [esp + ebp*2 - 0x521b6ebe], 0xa1
inc ecx
ror bh, 1
inc ecx
pop ebx
inc eax
xor ch, 0x1a
jno 0x142251d
call fcn.01409471
inc esi
inc edi
or dword [esp + esi*4], 0x7555a2fd
mov bl, 0x46
invalid
Function at 0x14be558
Capabilities:
Encode data using xor

Disassembly:
bswap eax
lea eax, [ebx + eax + 0x78058bf4]
inc esp
mov edi, ecx
dec eax
mov dword [esp + ebx - 0xda217be], 0x6fbbd41e
xor eax, 0x1e121300
dec eax
or ebp, 0x4b9d01a6
push ecx
jp 0x145df9e
dec ecx
sub eax, 4
mov eax, 0x84a447a3
inc ecx
mov ebx, 0x93b5d437
movzx ebp, ax
inc esi
mov edi, dword [ebp + eax - 0x47a3]
inc ebp
xor edi, esi
push eax
call fcn.0150b2f8
inc cx
shl edi, 0xe9
dec edi
lea eax, [eax + edx*2 - 0x140]
dec edx
sar dword [esp + edx*2 - 0x13c], 0xf5
inc ebx
mov ecx, dword [eax + edx*2 - 0x13c]
call fcn.01527005
cmp al, 0x77
cwde
pop esp
and eax, 0xaa090e54
loope 0x14be590
jmp 0x1daeea31

Function at 0x14d5f13
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dx, word [eax + edi - 0x5d976c3e]
shr dword [esp + eax - 0x5d976c3a], 0xa1
and ecx, 0x7d0f4392
mov ax, word [eax + edi - 0x5d976c3c]
rol ecx, 0x23
and cx, 0x7e10
jb 0x15003e1
add cl, byte [edi + ecx - 0x20bfc]
add edi, 4
shrd dx, ax, cl
inc byte [esp + 5]
mov word [edi], dx
call fcn.01445b76
mov ebx, 0xeaadf717
inc esp
movsx esp, bx
push ebx
dec ecx
sub eax, 4
inc ebp
mov esp, dword [eax]
inc ebp
xor esp, esi
dec esp
lea ecx, [ebx + ebx*2 - 0x66f3465e]
push ebx
inc ecx
xor esp, 0x52b3129d
call fcn.0144ac97
inc ecx
mov edi, 0x9c0cd937
dec edx
lea ebx, [edi*8 - 0x76ed21ef]
dec ecx
sub eax, 2
inc ecx
mov ecx, 0x4b0b2fab
inc ebp
movzx ebx, cl
inc ecx
movzx ebp, cx
inc edi
movzx edx, word [ecx + eax - 0x4b0b2fab]
call fcn.014d560d
inc ecx
mov ebx, 0xbc2feaa1
inc ebp
movsx edx, bx
dec ecx
sub eax, 4
inc ebp
mov ecx, dword [eax]
inc ecx
movsx edx, bx
inc ebp
xor ecx, esi
movzx eax, dx
inc ebp
lea ecx, [ecx + eax*2 - 0x1c07b7c]
inc cx
inc edx
inc esp
mov edi, eax
inc ecx
rol ecx, 1
inc ebp
movsx esp, di
inc ecx
movsx ecx, bh
inc esi
lea ecx, [eax + ecx - 0xba89757]
rol ax, 0xad
inc ecx
bswap ecx
inc ecx
mov ebp, esp
inc edi
lea ecx, [ecx + ebx - 0x6482009f]
inc ecx
push esi
inc ecx
dec bh
inc esp
xor dword [esp + eax*4 - 0xf550], ecx
call fcn.01442ad7

Function at 0x14d8846
Capabilities:
Encode data using base64

Disassembly:
inc esp
movsx ecx, dx
inc ecx
not esp
dec ebp
lea edx, [ebx + ecx - 0xa7dccc9]
dec ecx
sar edx, 0x95
inc ecx
bswap esp
inc ecx
dec esp
dec eax
mov dword [esp + edx - 0x54a3099c], ebx
inc ecx
not esp
jmp 0x1532c5a
dec edx
lea esi, [edx + ecx + 0x37a50f05]
dec esp
mov dword [esp + edx - 0x54a3099c], esi
inc bx
call fcn.00bf64d4

Function at 0x14d981d
Capabilities:
Encode data using base64

Disassembly:
and dword [esp + ecx - 0xffff], 0x16001020
je 0x144f442
neg eax
sar ecx, 0x9b
rol eax, 2
xchg ecx, edx
not edx
xor ebx, eax
shr byte [esp + ecx - 0xb1], 0xc1
adc ebp, eax
bswap ecx
mov eax, dword [edi]
shr word [esp], 0xc
or cl, byte [edi + 4]
jmp 0x147fc51
inc ebp
mov edx, dword [eax]
inc ebp
xor edx, esi
call fcn.014186bb
mov eax, dword [esi]
mov ecx, 0xbf956d8d
add esi, 4
xor eax, ebx
mov edx, ecx
sub edx, ecx
xchg cl, dl
neg eax
sal cl, 3
rol eax, 1
push edx
and ecx, edx
lea eax, [ecx + eax + 0x3c38b613]
rol dl, 5
not cx
ror eax, 2
jmp 0x141e814
Function at 0x14e9841
Capabilities:
Encode data using base64

Disassembly:
jb 0x145d75f
dec eax
mov dword [esp + esi*2 - 0x622c], 0xed9ad095
inc esp
xor dword [esp + esi - 0x310e], esp
inc ebp
movsx esi, dl
dec esp
mov esi, dword [esp + esi - 0x310e]
dec ebp
arpl sp, sp
dec ebp
add ebp, esp
dec esp
mov dword [esp + esi - 0x3116], ebp
ret 8

Function at 0x14eddca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
mov dword [esp + ebx - 0xffb8], ebp
inc esp
xor dword [esp + ebx*8 - 0x7fdb8], edi
inc ecx
mov esp, 0x6f30feb8
inc cx
xchg esp, ebp
dec esp
mov esi, dword [esp + ebx*2 - 0x1ff68]
call fcn.01438272

Function at 0x14ee005
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea eax, [eax + edi - 0x2e068bb0]
dec edx
shr word [esp + ebx - 0x2f96affa], 0x21
inc ecx
mov esi, dword [eax + ebp - 0x6e4fb758]
dec esp
lea ebx, [ebp*4 - 0x3c43a7fc]
dec esp
add dword [esp + ebp - 0x6e4fb758], ebx
inc ecx
xor esi, esi
inc cx
sal edi, 0x81
jbe 0x14419de
dec ecx
sub eax, 4
jmp fcn.014ac1cd
not esi
rol esi, 1
dec edx
xor dword [esp + edi*2 - 0x5c0c2eb0], eax
inc ecx
seta bh
lea esi, [esi + eax*4 - 0x621122bb]
rol byte [esp + ebp - 0x6e4fb752], 0xc1
xor esi, 0x5613d3b5
dec eax
sub dword [esp + ebp - 0x6e4fb758], 0x8a306c90
dec esi
xor dword [esp + edi*2 - 0x5c0c2e02], edi
add word [esp + ebp - 0x6e4fb758], bx
inc esi
dec eax
bswap ebx
xor esi, 0x8824a3b1
inc ebp
movsx esp, bl
inc esp
xor dword [esp + ebp*2 - 0x2a00043e], edi
dec esp
mov esi, dword [esp + ecx*2 - 0xfa76]
dec ebp
arpl di, di
or si, bp
setp cl
dec ebp
adc ebp, edi
inc ecx
neg ebx
dec esi
lea eax, [ebp + eax - 0x15000227]
inc ecx
mov ebp, dword [eax + ebp - 0x15000223]
inc ecx
xor ebp, esi
dec edx
mov dword [esp + edx*2 - 0x446], 0x9c903aa2
inc ecx
movsx eax, dl
neg ebp
xadd cx, dx
dec ebp
dec edx
lea ebx, [edx*4 - 0x69e618f4]
dec eax
mov dword [esp + ecx*4 - 0x134f4], esi
inc ecx
push ebx
rol ebp, 3
pop ebx
dec ebp
pop esi
dec esp
mov dword [esp + ecx - 0x4d3f], esi
inc ecx
push edx
xor dword [esp + ecx*4 - 0x134f4], ebp
sal dword [esp + ecx - 0x4d3d], cl
dec esp
mov esi, dword [esp + ecx*2 - 0x9a76]
dec edx
shl dword [esp + edx - 0x223], 4
dec eax
lea edi, [edi + ecx - 0x4d43]
inc esp
movzx ecx, ax
inc ecx
mov edi, 0x6399cf07
mov dword [ecx + edi - 0x4d3f], ebp
xadd ax, cx
jp 0xc4d14f
dec eax
not dword [esp + ecx - 0x23]
pop eax
pop eax
jnp fcn.01400bb8
Function at 0x14f2dc0
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [ebp - 0xc]
or cx, 0x7b16
mov ecx, dword [ebp + 0x10]
inc si
cmovae si, si
lea esi, [edi + ebx]
cmp ax, si
cmp ch, 0x12
sar esi, 1
stc
mov eax, dword [eax + esi*4]
test dx, 0x59b9
push ecx
bt cx, si
btc cx, 0x36
mov ecx, dword [ebp + 0xc]
add eax, edx
call fcn.00bff11b
lea esp, [esp + 4]
cmc
cmp edi, 0xdb1ee81e
test eax, eax
jmp 0xc4ba14
test edi, edi
jmp 0x143904f
mov esp, ebp
pop ebp
jmp 0x149d73d
mov eax, dword [edx + 0x3c]
cmc
add eax, edx
jmp 0x151982c
je 0x14eddf7
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x14eddf1
push esi
cmc
test edx, edx
jmp 0x1494072
jge 0x14f5588
lea edi, [esi - 1]
jmp 0x14f559b
je 0x152a923
mov eax, dword [ecx + edx + 0x20]
dec edi
stc
test dx, sp
add eax, edx
cmp bp, di
clc
sub ebx, ebx
cmc
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x152a923
jmp 0xbdd087
jne 0x14eddf7
mov ecx, dword [eax + 0x78]
cmp esp, 0x6aa4000f
mov dword [ebp - 4], ecx
stc
cmp ecx, edx
test ecx, ecx
jmp 0x14c98d7
jle 0xbdd07f
mov ecx, dword [ebp - 4]
jmp 0x149cb47
je 0x14eddf7
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0xc1c585
jmp 0x152a923
ret
je 0x14eddf7
mov eax, dword [eax + 0x7c]
test si, 0x2f13
test cx, si
push ebx
stc
push edi
cmp cx, sp
mov dword [ebp - 0x10], eax
cmp esi, ebx
clc
mov dword [ebp - 8], 0xffffffff
test edi, esi
test ah, 0xba
cmp esi, 0xffff
jmp 0x14d3bd0
ja 0x14e5259
mov eax, esi
jmp 0x149d711
mov edi, dword [ecx + edx + 0x18]
test ah, ah
cmc
jmp 0xbfbf43
je 0xc0b947
sub eax, eax
mov si, 0x4605
not si
pop esi
jmp 0xc00f73
push ebp
sub ebp, ebx
bsr edx, edx
mov ebp, esp
sbb edx, esp
add dx, 0x8085
xchg dx, dx
mov edx, dword [ebp + 8]
cmp sp, 0x9aab
stc
test ch, ah
lea esp, [esp - 0x114]
jmp 0xc203d1
jle 0x152a8ea
lea ebx, [esi + 1]
ror edx, 0xbc
mov dh, 0xa4
cmp ax, 0xe03e
cmp ebx, edi
mov edx, dword [ebp + 8]
jmp 0x1465042
cmp dword [eax], 0x4550
jmp 0x1444276
mov edx, dword [ebp - 4]
cmc
stc
mov eax, dword [ebp + 8]
mov ecx, dword [edx + eax + 0x24]
lea edx, [ecx + esi*2]
xor cx, 0x683c
sal cl, 0xe
movzx eax, word [edx + eax]
sub dh, 0x31
mov ecx, dword [ebp - 4]
rcr dh, cl
shr dl, cl
btc edx, 0x37
mov edx, dword [ebp + 8]
cmp si, 0x7c83
cmp esi, ebp
Function at 0x14f6c39
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0xad0424b3
push edi
pushfd
mov edi, dword [esp + 8]
or edi, 0xf4282b99
sub ah, dh
mov dword [esp + 0xc], 0x9ad5baac
mov edi, dword [esp + edi + 0x2d3d049]
xor dword [esp + 8], 0x6b237736
add byte [esp + 8], 8
not dword [esp + 8]
shr dword [esp + 8], 0xdb
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.01442334
mov dword [edx - 0x454e8b1b], edi
pop esi
stosb byte es:[edi], al
imul edi, dword [ecx + 2], 0xffffffa1
push ebp
mov eax, 0x518cb97e
mov esp, 0xae92953a
xor al, 0x51
pop esi
movsd dword es:[edi], dword [esi]
jb 0x14f6c48
or edi, 0xe5f2aae9
mov ebx, 0xe550a9b
sub al, 0xea
stosb byte es:[edi], al
add eax, 0x56d889b8
test al, 0xa
salc
pop edx
push edx
push ecx
pushfd
jge 0x14f6d35
scasb al, byte es:[edi]
sal dword [esi + 0x21], 1
cmp esi, dword [ecx]
imul edi, dword [edx + 0x5fcfc6b3], 0x3b
inc esp
shl byte [ecx], cl
push ebp
idiv dword [ebx + 4]
xlatb
jmp 0x98d7f5d5
mov byte [edx + 0xc], bh
add bl, byte [ecx + 0x39d20cd8]
ljmp 0xc764

Function at 0x15002c3
Capabilities:
Encode data using base64

Disassembly:
push 0xac1774bd
xor esi, eax
and esi, 0xff
neg word [esp + 2]
mov esi, dword [esi*4 + 0x13d82f0]
shr eax, 8
push 0x9f29bf32
xor eax, esi
call fcn.0143a070
in al, dx
aas
mov byte [0xfb5330ed], al
push ecx
scasd eax, dword es:[edi]
mov bh, 4
xchg ecx, eax
invalid
mov dword [esp], esi
mov esi, 0x12a2ee1c
add esi, 0xbf3fd08e
movzx esi, byte [ecx]
jae 0xbed0f0

Function at 0x1503b90
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], edx
mov edx, ebx
shl word [esp + 2], 0xe4
jb 0x13fb09d

Function at 0x1503cf1
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp - 0x60], 0x81a3039d
inc cx
ror ebx, 1
add si, bp
inc cx
dec ebx
call fcn.00c22580
Function at 0x150b0ac
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov ebp, 0x3215b1b5
inc ecx
and dl, 7
dec edx
lea edi, [edi + ecx - 0x3e3c]
shr dl, 0x46
jns 0x13fb3ee
push 0x3ba6888
dec ecx
sub eax, 2
inc ebp
movzx edx, word [eax]
dec byte [esp + 2]
sar word [esp + 1], 0xa4
inc ecx
bswap edi
pop ecx
dec edx
mov dword [esp + edx*2 - 0x694c7c64], ebx
dec esi
mov dword [esp + edx - 0x34a63e32], esi
inc esi
xor dword [esp + edx - 0x34a63e32], edi
inc ebp
movsx ecx, dx
inc ecx
pop esi
inc ecx
shl cl, 0xa5
movzx ecx, ax
dec ebp
arpl di, di
dec ebx
lea eax, [ecx + edx*8 + 0x5aaa1715]
inc ecx
movsx esi, bx
ror cl, cl
dec ebp
adc ebp, edi
mov edx, ebx
inc esi
mov esp, dword [edi + edx - 0x34a63e32]
inc ecx
shr dl, 0x41
dec eax
sar edx, cl
inc esi
mov ebx, dword [edi + edx*2 - 0x694c7c2e]
jb 0xbe7243

Function at 0x151a731
Capabilities:
Encode data using base64

Disassembly:
inc edi
lea ebx, [ebx + edx*2 + 0x153bcea5]
inc ecx
xor ebx, 0xa4206987
inc ebp
lea ebx, [ebx + ebp*8 - 0x702c8bf]
inc ecx
xor ebp, edi
adc ebp, 0x3e182887
inc ecx
neg ebx
dec esi
add dword [esp + edi - 0x7f26bc07], esi
dec esp
and esp, eax
inc esi
xor dword [esp + edi - 0x7f26bc07], ebx
dec esi
mov esi, dword [esp + edi - 0x7f26bc07]
dec ebp
add edx, edi
inc ecx
mov edx, edx
dec ebp
arpl bx, bx
dec ebp
add ebp, ebx
or cl, dl
call fcn.0149ff94
pop ebx
jae 0x151a7df
jne 0x151a805
pop eax
and cl, byte [edx - 0x467af74d]
retf
inc ecx
or esp, 0x9d91eba5
inc ecx
pop esi
inc ecx
neg bh
call fcn.013d2a9f
neg edx
dec esp
cmovs ebx, ebx
inc ecx
push esi
dec eax
lea eax, [ecx*8 + 0x1e94b9b8]
inc esi
xor dword [esp + ebx*2 - 0x1c51224a], esp
inc ecx
pop esi
mov ebp, edx
dec ebp
arpl sp, sp
dec ebp
add ebp, esp
dec ebp
lea esp, [edx - 0x5db73e2]
call fcn.0148a20b
invalid

Function at 0x151c361
Capabilities:
Encode data using base64

Disassembly:
sal edx, 0xbb
rol eax, 3
shr dl, 0x85
sub dl, 0x24
and dl, cl
lea eax, [eax + edx*2 + 0x3f03ca02]
inc edx
neg eax
sal cx, 0xce
ror eax, 3
shr ecx, 0x35
setae dl
xor ebx, eax
add ebp, eax
xor edx, 0x5a024d8b
add dx, dx
mov eax, dword [ecx + edi]
ror dl, 0xc2
sub ecx, ecx
lea edi, [edi + ecx + 4]
sub edx, 0x7c1a9702
push eax
mov eax, edx
popfd
sub cl, dh
jmp ebp
call fcn.014ac11c
xor eax, ebx
bswap eax
dec eax
movsx ecx, dl
bswap eax
shl cx, 0xe5
jae 0xc0a9c4
movzx ecx, byte [esi]
jmp 0x1543a27
jmp 0x142839f

Function at 0x151fc24
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + edx - 0x6e8a0ddf], esi
inc ecx
neg bh
dec esp
lea ecx, [edx*4 - 0x16d68042]
inc ecx
rol bh, 1
dec ecx
not edx
inc esp
movzx esp, dh
dec ecx
and ebx, 0x93347219
inc ebp
xor dh, bh
dec eax
lea edi, [ebp + edi - 0x2184c3b9]
inc esp
add dword [esp + edx - 0x6e8a0dda], edx
inc sp
mov dword [edi + ebp - 0x2184c3b7], edi
pop esi
pop esi
inc ecx
pop esp
pop ebp
jne fcn.01400bb8
Function at 0x152174d
Capabilities:
Encode data using base64

Disassembly:
shl al, 0x85
lea ecx, [ecx + eax - 0xae0eccc]
inc esp
movzx esp, ax
bswap ecx
mov ebp, eax
mov edx, 0xce170f80
not al
inc ecx
call fcn.01497345
mov ebp, edx
dec esi
mov dword [esp + ebx + 0x77c49a00], ebp
ret 8
inc ecx
xor edi, 0x9a2609a3
inc ecx
pop ebx
dec eax
rol edx, 0x9b
call fcn.00bf1df7
inc ecx
bswap edx
inc ecx
not edx
inc esp
movsx edi, dl
dec eax
shl dword [esp + ebp], cl
inc ecx
dec edx
inc eax
neg ch
call fcn.013fd38c
push edx
jge 0x15217f6
jp 0x15217cf
and byte [edx - 0x485be654], cl
loope 0x15217b3
adc byte [ecx - 0x7f691362], cl
mov eax, 0x951c8d48
or eax, 0x4c0abfb1
mov dword [esp + edx - 0x662b], esp
inc ecx
shr bl, 0x87
push dword [esp + 8]
popfd
sar byte [esp + edx*2 - 0xcc66], 0x85
jb 0x1517b41
inc dword [ecx - 0x75]
or byte [ecx + 0x5a], al
inc ecx
xor ecx, esi
jmp 0xbe9699
cmc
dec dword [esi - 0x77]
dec esi
invalid
xchg esp, eax
adc al, 0x7b
invalid
add dword [edi], ecx
or edi, 0xffffff8f
int1
dec dword [ebx + 0x4d8b0855]
clc

Function at 0x1522138
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ecx - 0xffc7], 0xe91a1f0b
inc ecx
pop edi
pop ebp
pop eax
inc ecx
pop esp
pop ecx
inc ecx
pop esp
pop ecx
pop esi
pop esi
jns fcn.01400bb8

Function at 0x1528f7c
Capabilities:
Encode data using base64

Disassembly:
mov dx, word [edi + 2]
add edi, 2
not ax
mov ecx, 0xda08d18d
ror cl, 0xa3
not dx
push ecx
lea ecx, [ecx + ecx + 0x712d9913]
mov dword [esp + ecx - 0x253f3c71], ecx
or ax, dx
and word [esp + ecx - 0x253f3c70], cx
mov word [edi + ecx - 0x253f3c75], ax
mov edx, dword [esi + ecx - 0x253f3c75]
jl 0x1500345
lea esi, [esi + ecx*2 - 0x4a7e78e6]
adc word [esp + ecx - 0x253f3c74], 0xe71a
setns byte [esp + ecx - 0x253f3c71]
lea eax, [ecx + ecx + 0x4880e483]
xor edx, ebx
ror edx, 2
or eax, 0xdd3ecd00
dec edx
xadd byte [esp + ecx - 0x253f3c75], ch
pop ecx
adc ecx, dword [esp]
ror edx, 3
ror word [esp + ecx*2 - 0x583fd9], 1
and dword [esp + ecx - 0x2c1fed], 0x2186d230
push eax
inc edx
ror word [esp + ecx - 0x2c1feb], 7
xor eax, 0xe981a1bb
xor ebx, edx
add eax, 0x1514a237
adc ebp, edx
or ecx, 0xd93377b7
movzx edx, cl
dec word [esp + edx - 0xfe]
mov dword [esp + edx - 0xff], ebp
ret 4

Function at 0x152a998
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov esi, dword [eax + esi - 0x58a2]
push ebx
inc ecx
xor esi, esi
inc esp
movzx ebx, word [esp + 0xc]
call fcn.00c46282
sub dl, al
xor ecx, ebx
shr edx, 0x2b
xadd al, dh
rol ecx, 1
not ecx
inc ecx
ror ecx, 1
lea eax, [eax + edx*2 + 0x6c3f2f1c]
call fcn.00c3fb09
inc ecx
mov edi, 0xfcb1368c
call fcn.0153551d
dec ecx
lea ebx, [ecx + esi*2 - 0x1a6b3d53]
dec eax
mov dword [edx], eax
dec eax
sar esi, 0x11
dec eax
mov dword [esp + esi*2 - 0xb0a8], 0x788e903f
dec ebp
lea eax, [eax + esi*4 - 0x16154]
inc eax
rol dh, 0xa3
jns 0x148d862
mov ecx, 0xc82f2824
movsx edx, cx
lea eax, [edx + ecx + 0x77ae8011]
mov ecx, dword [esi + edx - 0x2824]
lea esi, [esi + edx*4 - 0xa08c]
jmp 0x14cf886
Function at 0x152c3ad
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec eax
add edx, 0x793d9581
dec eax
lea ebx, [edx*8 - 0x687c7451]
inc edx
xor dword [esp + ecx + 0x4d2eb8e9], ebp
call fcn.01484e8b
adc ebp, edx
and cl, 0x9a
movsx edx, ax
fild dword [ecx + edi - 0xff9a]
shr dword [esp + ecx*8 - 0x7fcd0], cl
add dword [esp + ecx - 0xff9a], ebp
ret
inc si
mov esp, dword [edi + ecx*2 - 0x82e1c36]
dec ebp
lea ecx, [ecx - 0x5145c65f]
inc dx
mov ebx, dword [edi + ecx + 0x4d2eb846]
dec esi
mov dword [esp + ecx + 0x4d2eb844], ecx
dec edx
lea edi, [edi + ecx + 0x4d2eb846]
inc sp
and esp, ebx
inc cx
not esp
inc esi
movzx edx, word [esp + ecx + 0x4d2eb846]
inc edx
movzx eax, word [esp + ecx + 0x4d2eb844]
inc si
mov dword [edi + ecx + 0x4d2eb844], esp
dec edi
lea eax, [eax + ecx + 0x4d2eb840]
inc ebx
mov ebp, dword [eax + edx - 0xb2d1]
inc edx
mov edx, dword [esp + edx - 0xb2ce]
inc ecx
pop edx
push edx
inc ecx
xor ebp, esi
inc esp
movsx ebx, dx
inc edx
lea ebp, [ebp + edx*2 + 0x16c530d6]
ror ebp, 2
inc edx
sal byte [esp + ecx + 0x4d2eb849], 0x22
inc ebp
dec esp
lea edi, [edx*8 + 0x7912f4ae]
shl dl, 0x41
ror ebp, 1
inc esp
and byte [esp + eax - 0x47bb], dl
inc ecx
shr cl, 0x23
dec esi
cmovbe ebx, dword [esp + edx + 0x4d2eb844]
dec esi
mov dword [esp + edx + 0x4d2eb844], esi
jbe 0x1496379
dec edx
ror dword [esp + ecx - 0xffff], 0xa1
xor ebx, edx
sar al, 0x24
jbe 0x14fba63

Function at 0x152e84a
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + 0x6fd2362d], esi
neg eax
inc ebp
xor dh, bh
inc edx
mov ebp, dword [esp + ecx*2 + 0x14]
dec ecx
lea edi, [edx + edi - 0x6f0e6003]
inc bp
xadd edx, ecx
inc edx
seto byte [esp + edx - 0x6f0e5fef]
inc bp
mov dword [ecx + edi - 0x6001], edi
inc ecx
pop esp
pop esi
pop edx
ja fcn.01400bb8

Function at 0x15329a3
Capabilities:
Encode data using base64

Disassembly:
dec esp
add ebp, ebp
dec esi
mov dword [esp + edi - 1], ebx
dec ebp
sub eax, edi
xadd dl, bl
inc esi
xadd dword [esp + edi*2 + 2], ecx
inc edi
mov bh, byte [edx + eax - 0x6f0e6001]
and al, 0xa1
inc ebp
xor bh, dh
inc ecx
add bh, 0x34
dec esi
lea esp, [ebx*4 - 0x6fd237e1]
inc ecx
not bh
call fcn.00bd9a77
Function at 0x1532cc5
Capabilities:
Encode data using base64

Disassembly:
dec ecx
shr esp, 0x8b
dec esi
mov dword [esp - 0x34100], ebx
inc ecx
mov eax, dword [eax + ebp - 0x1f]
inc ecx
mov ecx, 0x33840e2c
inc ecx
xor eax, esi
inc edx
shl byte [esp - 0x1a07fc], 0x84
mov ebx, ecx
ror eax, 3
ror si, 0x44
sbb ebx, esi
dec eax
shr ecx, cl
lea eax, [eax + ebx*2 - 0x7d06647]
inc esp
mov edx, ebx
bswap eax
jb 0x1510364
or cl, dh
inc eax
add cx, 0x149f
ror dl, 0x47
neg eax
sal edx, cl
call fcn.00c113ff
inc esi
mov dword [edi - 0x34100f22], edx
dec eax
sar ebp, cl
dec ecx
or edx, edi
dec edi
lea eax, [eax - 0x68201e48]
jns 0x14cea03
pop edx
sar byte es:[ebx + ebp - 0x37518d23], 3
int1
insb byte es:[edi], dx
push ecx
inc esi
jnp 0x14ef115
ror dword [ecx + edx*2 + 0x5517ab88], 0x9b
sbb dword [edx + 0x17aaf4ff], esp
stosb byte es:[edi], al
pop ss
dec eax
adc al, 0x55
cmp ebp, ebx
in eax, dx
test eax, 0x3ec7b6ed
lodsb al, byte [esi]
scasb al, byte es:[edi]
and edx, dword [eax + 0x30563b54]
xor dword [edi - 0x441a5aab], ebp
sub dword [ecx - 7], edx
add esp, 0x6a3585b0
outsb dx, byte [esi]
pop ebp
bound esp, qword [edx + eax*8 - 0x6f]
or byte [eax + esi*2], al
loopne 0x14ef115
mov bl, 0x89
int 0xd9
into
sub dword [edx + 0x15], 0x54
dec ecx
cwde
je 0x14ef140
sbb byte [ebx], bh
in eax, dx
push edx
adc eax, 0xb9d30932
fcomp dword [edx - 0x58631934]
cmpsd dword [esi], dword es:[edi]
pop esi
fist dword [esi - 0x7f]
dec ebx
movsw word es:[edi], word [esi]
inc edx
dec ebp
pushal
cmp byte [edi - 0x76], bh
mov dl, 0x81
sub ebp, dword [ecx + 0x56]
and byte [edi], dl
xchg ebp, eax
cli
dec edi
cmpsd dword [esi], dword es:[edi]
and dh, al
push esi
dec ebp
push eax
enter 0xffffffffffff8b81, 0xffffffffffffffda
rcr dh, cl
xchg ebx, eax
inc esp
imul ebp, dword [ecx], 0x44
xor byte [eax - 0x2c1a0ee3], ch
test al, 0x1d
int1
in eax, 0xd3
and al, byte [edi]
jle 0x14ef0ca
int 0x4c
test eax, 0x93b1e7c6
sub edx, dword [eax - 0x78]
cmp al, 0x4a
retf 0x942e
inc edx
sar dword [esp - 0x1a0800], 0x51
rol eax, 2
dec esi
mov dword [esp - 0xd0400], esi
neg edx
inc edx
xor dword [esp - 0x34100], eax
inc esp
movsx esi, bl
dec eax
shr edx, 0x8a
inc ecx
dec dl
inc ecx
pop esi
inc cx
neg ebx
dec eax
arpl ax, ax
dec esp
add ebp, eax
neg edx
inc ebp
and edx, edi
jle fcn.01400bb8
dec esi
mov esi, dword [esp - 0x34100f1a]
dec esp
mov dword [esp + esi - 0xaa49f32], esp
inc ecx
pop esp
dec edx
lea edi, [edi - 0x1a080795]
jmp 0x14ef092