joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa14807
Capabilities:
Encode data using base64

Disassembly:
bts eax, eax
shl edx, 2
neg eax
jge 0x8d1922
mov eax, 0xa9119eb6
lea ecx, [eax + eax + 0x71aeb229]
cdq
movzx eax, byte [edi - 1]
xadd dl, dh
xor al, bl
bt cx, dx
and cl, dh
xor cx, cx
adc al, 0x20
inc cl
rol al, cl
xadd dl, cl
xchg edx, ecx
adc al, 0xac
rol al, 1
xadd dl, dh
bswap ecx
inc edx
adc al, 0x25
ror al, 1
xor bl, al
jmp 0xde7c41
shl eax, 0xd3
mov eax, ebp
ror word [esp + 3], 0xa1
jae 0x9a4156
dec dword [esp + 3]
adc eax, edx
call fcn.009feb39
mov dword [edx], eax
mov eax, 0xf6934b05
mov edx, dword [edi]
shr ax, 0x47
movsx ecx, ax
ror ecx, 0x2b
xor edx, ebx
and eax, dword [esp + ecx - 0x12c00000]
dec dword [esp + eax - 6]
inc edx
btc eax, ecx
inc word [esp + eax - 5]
bts ecx, 0xa3
bswap edx
push eax
shl ax, 0xe5
xor edx, 0x5ea0249d
inc cl
or cl, 0xa2
not byte [esp + eax*4 - 0x37f]
dec edx
xor edx, 0x1ab8f483
dec dword [esp + eax*2 - 0x1c0]
inc byte [esp + eax*4 - 0x37f]
lea edx, [edx + eax*2 - 0x1f37bde9]
lea eax, [eax + ecx*4 + 0x742f149c]
xor ebx, edx
mov dword [esp + ecx*4 - 0x4b0002a4], ecx
add esi, edx
cwde
mov edx, dword [edi + eax*2 - 0x304c]
or cl, byte [esp + eax - 0x181d]
and ecx, 0xf7b93b3b
lea edi, [eax + edi - 0x1820]
jp 0xdc54c8
bswap ecx
xor edx, ebx
rol ax, 0xc9
not edx
xchg byte [esp + eax*2 - 0xa055], al
shl dword [esp + ecx*2 - 0x7601001c], cl
xor edx, 0x5d188801
xchg dword [esp + eax - 0x500e], ecx
neg edx
sar dword [esp + eax*4 - 0x14042], cl
dec eax
ror edx, 2
sub ecx, ecx
btr ecx, ecx
xor ebx, edx
xor al, 0x1c
ror cl, 0x23
sar word [esp + eax*2 - 0xa015], 0xe7
mov dword [ebp + eax - 0x5005], edx
movsx edx, cl
lea ebp, [ebp + eax - 0x5005]
dec edx
mov dword [esp + eax*2 - 0xa01a], esi
ret 8
and word [esp + eax - 0x98ba], ax
adc cl, 0x39
xor bl, cl
mov dword [esp + eax*2 - 0x13180], eax
mov dword [esp + eax*4 - 0x262f4], edi
mov dword [esp + eax*2 - 0x13178], esi
cbw
bt edx, 0x38
btc edx, 0x29
mov dword [esp + eax*2 - 0x1ff7c], ebx
push eax
mov ebx, ecx
sbb eax, edx
not eax
adc word [esp + 5], 0x8d3e
mov edx, ebx
js 0x8d157d
xor eax, ebx
neg eax
xchg word [esp + 2], dx
lea eax, [eax + edx*2 - 0x3d98eb6e]
xchg dword [esp], edx
not eax
ror eax, 3
xor ebx, eax
sar dx, 0xc9
sub byte [esp + edx*8 - 0x258ffff8], dl
adc esi, eax
movzx edx, byte [edi + edx*4 - 0x12c7fff4]
mov ecx, 0xd5010e0b
sal cx, 0x8f
sbb edi, 0xfffffff6
xor dl, bl
sub byte [esp + 1], cl
shr cx, 0xb
call fcn.00d7a0d0
inc eax
xchg cx, dx
xchg cx, dx
rol eax, 2
xor ebx, eax
bts edx, ecx
shl ecx, 0x18
add esi, eax
call int.0093995c
call fcn.008dc292
lea edx, [edx*8 - 0x2fdd2d41]
sar cx, 0xa4
add eax, esp
xor dx, 0x463e
add dl, dl
mov edx, dword [eax]
rol cx, 0x61
mov dword [ebp - 4], edx
mov eax, dword [edi - 5]
xor eax, ebx
movsx edx, cl
lea ecx, [ecx + ecx*2 - 0x66703af4]
bswap eax
neg eax
add edx, ecx
jl 0xd76a3e

Function at 0xa14e58
Capabilities:
Encode data using xor

Disassembly:
inc cx
sub esp, 0x4a5a4207
mov dword [esp + ecx*8 - 0x71c40], esi
inc esi
xor dword [esp + eax - 0x3f940029], edx
pop esi
dec cl
dec eax
bts ebp, 0x3e
dec ebp
arpl dx, dx
call fcn.009bc8c1
Function at 0xa17aca
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
add cl, 0x1e
xor dl, 0x20
push edx
rol cl, 1
inc dword [esp + 8]
jl 0x98f8f0
dec cl
not cl
xor bl, cl
sar dl, 0x41
jle 0xdd5fe8
lea edx, [edx*4 - 0x63d192fd]
mov eax, dword [ebp + ecx - 0x60f9e92e]
sar ecx, cl
movzx ecx, byte [edi + ecx*2 - 0x307cf3]
mov dword [esp], 0xf723ed88
sar dl, 0x61
jno 0xda321a
xor cl, bl
ror cl, 1
jmp 0x8afe66
lea ecx, [esp + ecx + 0xc]
push edx
bts edx, 0xa
sal dword [esp + 0xc], 0x26
mov dword [ecx], eax
neg word [esp + 1]
lea eax, [edx*4 + 0x2aba6920]
call fcn.00a407e6

Function at 0xa199bd
Capabilities:
Encode data using base64

Disassembly:
sar dl, cl
neg eax
not ecx
shr cl, 0x61
dec dx
xor ebx, eax
add esi, eax
movzx eax, cl
movzx edx, byte [edi + eax - 0x3d]
not eax
add edi, 1
bts ecx, ecx
xor dl, bl
call fcn.008dcfc1
mov ecx, 0x3785d6b6
mov edx, ecx
lea edi, [edi + ecx - 0x3785d6ba]
movzx eax, cx
mov eax, dword [edi + ecx - 0x3785d6b6]
call fcn.00dbfaa7
shl edx, cl
dec edx
xadd cl, ch
lea edi, [edi + ecx - 0x798685cb]
xor eax, ebx
xor edx, ecx
xadd cx, dx
add ecx, 0xf098fea5
lea eax, [eax + edx - 0x4ec47d92]
bswap eax
xor eax, 0xafa190a2
not dl
not dx
btc dx, 0x84
bswap eax
btr cx, 0xb1
jb 0x8d82ad
btr ecx, ecx
lea eax, [ecx + eax + 0x6667137d]
jae 0x8dc6d3
movzx ecx, byte [edi + edx*8 - 0x7f00e]
shr edx, 0x8f
js 0x9d17a8
cwde
lea edi, [edx + edi - 7]
shr eax, 0xa3
xor cl, bl
add cl, dl
shr dx, 0x43
mov dword [esp + edx], 0xc8b94634
rol cl, 1
ror edx, 0xab
inc dword [esp + edx]
and edx, edx
not cl
call fcn.0088e4f2

Function at 0xa28ff1
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec esi
or dword [esp + edx - 0x74a200ee], eax
rol ecx, 1
call fcn.00d6a311

Function at 0xa32739
Capabilities:
Encode data using xor

Disassembly:
inc ecx
ror esi, 1
dec eax
mov dword [esp + ebp*2 - 0x1ff84], esi
inc esp
xor dword [esp + ebp*4 - 0x3ff08], esi
call fcn.00a01d97
Function at 0xa37a19
Capabilities:
Encode data using base64

Disassembly:
btr edx, 4
xor eax, 0xe78ba03d
jmp 0x9abffe
movzx edx, cl
lea ebp, [ebp + edx*4 - 0x1f8]
lea eax, [ecx + ecx*4 - 0xd50fde7]
shr edx, 0x65
mov dword [esp + ecx - 0x19afd980], esi
ret 0xc
inc edx
mov dword [ebx + ebp - 0x35122023], edx
dec eax
lea edi, [edi*4 + 0x18338aa0]
jg fcn.00a14fd9
neg eax
dec edx
xadd dx, cx
and ecx, 0x150a9e17
xor ebx, eax
inc dword [esp + ecx*2 - 0x1403f8]
setp byte [esp + ecx*8 - 0x500ffd]
sal dword [esp + edx - 0x6b39d0d6], 0x48
add esi, eax
movzx eax, word [esp + ecx*2 - 0x1403f8]
mov eax, dword [ebp + ecx*4 - 0x2807fc]
push ecx
mov ecx, dword [eax + edx - 0x6b39d0d9]
jmp 0xe16999
btr dx, 0x3d
rol eax, 2
mov ecx, edx
lea eax, [eax + edx - 0x18283dad]
push edx
or byte [esp + ecx - 0x6b39c5ae], dh
mov dword [esp + edx - 0x6b39c5ad], ecx
rol eax, 2
sar cl, 0xc1
dec eax
xor dx, cx
btc edx, edx
setb cl
rol eax, 2
ror ecx, 0x4a
jae 0x9505aa
inc ecx
mov ebp, 0x6a2440b
inc ecx
mov ecx, ebp
dec ebx
lea eax, [ebp + ebp*2 + 0x34875eb6]
inc edi
mov esp, dword [edi + ebp - 0x6a2440b]
movzx edi, cx
sub ax, di
inc ecx
movsx ebp, bp
dec edi
lea edi, [edi + ebp*4 - 0x1a891028]
inc esp
xor esp, esi
inc esp
mov eax, eax
inc cx
and ecx, eax
inc ecx
inc esp
shr ecx, cl
inc ebp
mov ecx, eax
inc ecx
shr eax, 0xfc
inc ecx
rol esp, 1
inc eax
movzx edx, ch
inc ecx
sub esp, 0xd78cf131
inc ecx
not esp
inc eax
xchg bh, cl
dec eax
lea ebp, [edi*8 + 0x668ede14]
inc esp
movzx esi, cx
inc ecx
xor esp, 0x4780ed98
dec eax
bt ebp, edx
and cl, 0x33
push esi
inc esp
xor dword [esp + ecx*2 - 0xd4406], esp
dec ecx
sal ebp, cl
btc cx, cx
pop esi
inc ebp
bt eax, ebp
dec eax
not ebp
dec esp
xchg ebp, eax
dec ebp
arpl sp, sp
inc sp
add esi, edx
dec eax
rol ebp, cl
bt bp, 0xb4
dec ebp
adc ebx, esp
inc ecx
shl cl, 0xa7
inc esp
sbb cl, cl
rdtsc
sar ecx, 0x81
inc ebp
btc ecx, esi
dec ebp
and ecx, esi
dec ecx
lea ebx, [ebp + ebx - 0x35122060]
dec esp
xor ecx, ecx
inc ebp
adc ch, al
jge 0xa48b66
inc ecx
mov ecx, 0xfcb57cb7
dec esp
mov eax, dword [ebx]
dec edi
lea ecx, [ecx + ecx*2 + 0x242ae12a]
inc esp
mov cl, byte [ebx + 8]
mov eax, 0xb6377608
dec eax
add ebx, 0xa
dec esp
lea esi, [eax + eax*4 + 0x729e2c35]
movsx ebp, al
ror eax, 0x52
inc esi
mov byte [ebp + eax - 8], cl
inc ecx
mov eax, dword [edi + ebp*2 - 0x10]
dec esi
lea edi, [ebp + edi - 4]
xor eax, esi
dec eax
inc eax
movzx edx, ch
inc ecx
mov dword [ebp + ebx - 0x3512201f], eax
inc ecx
mov eax, esi
jno 0x98857c
sal edx, 0xaa
mov dword [ebp + edx - 0x6b39d0d5], ecx
movzx ecx, byte [esp + edx - 0x6b39d0cd]
push edx
ror cx, 0x45
mov eax, dword [ebp + ecx - 0x9001]
or cl, 0x36
sbb cx, word [esp + ecx*4 - 0x240cd]
pop ecx
mov edx, dword [ebp + edx - 0x6b39d0d1]
lea ecx, [ecx + ecx + 0x433c3818]
add eax, edx
push ecx
pop ecx
sal cl, 6
mov dword [ebp + ecx*4 - 0x66bf65f8], eax
js 0x971ee4
Function at 0xa43c66
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx*2 - 0xbabfe2a], edx
add esi, ecx
xadd eax, edx
movzx ax, byte [ebp]
mov cl, byte [ebp + 2]
lea edx, [edx - 0x44645dd2]
ror dl, 0x63
shl dx, 0x6f
lea ebp, [ebp + edx - 0x479b7ffe]
setae dl
shl dx, 0x47
add dx, dx
not al
not cl
btc edx, edx
add dl, 0x88
and al, cl
add dword [esp + edx - 0x479b017d], 0x852dcfae
or byte [esp + edx - 0x479b0182], dl
not dx
mov word [ebp + edx - 0x479bfe76], ax
mov dword [esp + edx - 0x479bfe76], 0x63086f1b
jg 0x99da8c
lea eax, [edx + edx*8 - 0x414d2c67]
mov dword [esp + eax - 0x432ec5bf], esi
ret 0xc

Function at 0xa4a53c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xd7a3bc37
xor ecx, ebx
add word [esp], 0xb32d
shr dword [esp], 0x12
xor ecx, 0x791b87ac
shl word [esp], 0x8b
jp 0xa01a6e

Function at 0xa4d890
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x59ad6fa7
movsx eax, cl
lea edi, [edi + ecx - 0x59ad6fa9]
mov edx, ecx
mov dword [esp + ecx - 0x59ad6fa7], 0x194db07
movzx ecx, word [edi + ecx - 0x59ad6fa7]
call fcn.008bf468

Function at 0xa4d90a
Capabilities:
Encode data using base64

Disassembly:
inc al
shr al, 0x44
mov eax, ebp
jae 0xa11c8d
lcall 0x6460, 0x6a00a040
add byte [esi - 0x58], ah
sub eax, dword [eax]
test dword [esi - 0x5e6f1aec], esi
pop edx
add byte [eax + ebp*8], al
aas
add byte [eax], ah
xchg esi, eax
invalid
Function at 0xa4f35c
Capabilities:
Encode data using base64

Disassembly:
dec esp
adc ebx, edi
call fcn.00d7bef2
ror ecx, 0xf7
lea edi, [edi + ecx + 4]
sar ecx, 0x3e
not cx
xor edx, ebx
push ecx
shr ecx, 0x3d
bswap eax
adc edx, 0xcc8a2016
mov dword [esp + ecx], ecx
not word [esp + ecx*8 + 2]
neg ax
xor edx, 0x31197a11
not byte [esp + ecx*2 + 2]
xchg byte [esp + ecx*2 + 2], cl
lea edx, [ecx + edx + 0x4f24918e]
sal cx, 0x83
xadd dword [esp + ecx*8], eax
neg edx
sal ecx, 7
jbe 0xa2e09c
mov eax, 0x8da15aba
movsx edx, ax
mov edx, dword [edx + edi - 0x5aba]
push eax
add edi, 4
xor edx, ebx
dec dword [esp]
jns 0x94da65
pop eax
bswap edx
cbw
je 0xdd8dd7
xor edx, 0x549af09a
lea ecx, [eax + eax*2 - 0x1c51f5f0]
rol al, 0x61
rol edx, 3
sar ecx, cl
shr cl, 0x86
jp 0xa46a4f
mov eax, dword [eax + ebp - 0x2cbf8eb3]
mov dword [esp], 0x9a004ca7
mov edx, 0xcc135499
lea ecx, [edx + edx*8 - 0x63e9adf2]
mov cx, word [eax]
add dl, 0xba
push edx
xor dword [esp + 2], edx
adc ebp, 2
ror byte [esp], 5
movzx eax, dx
mov word [ebp + eax*8 - 0x2a298], cx
jae 0x9a347e
lea edi, [eax + edi - 0x5457]
and byte [esp + eax - 0x5452], dh
push edx
movzx ecx, ax
mov eax, dword [edi + ecx*8 - 0x2a298]
add ecx, ecx
xor eax, ebx
bswap ecx
xor cx, word [esp]
shr byte [esp], 0xa1
bswap eax
add byte [esp + 9], 0x1a
rol eax, 1
call fcn.008d77ae
dec ecx
sal edx, 0xb3
dec edx
mov esi, dword [esp + ebp - 0x2bc0]
dec edx
ror dword [esp + ebp*4 - 0xaf20], 0x64
dec eax
arpl di, di
inc edx
dec dword [esp + ebp*2 - 0x5790]
jne 0x8969d0
mov edi, 0xb70aa3a6
dec esp
lea eax, [edi + 0x2338da2c]
inc ebp
movsx ecx, al
dec eax
mov esp, ebx
inc cx
inc eax
call fcn.009c6637
neg ecx
sal cl, 0xa7
neg dl
shr eax, 0x4b
rol dl, 1
sar ecx, 0x9a
btr ecx, ecx
neg dl
add ecx, 0xb4912a36
rol dl, 1
lea eax, [eax*8 + 0x450caf2a]
jmp 0xe12db4
xor bl, dl
cwde
call fcn.00956d5f
Function at 0xa54036
Capabilities:
Encode data using xor

Disassembly:
xor ebp, esi
dec edx
mov dword [esp + edx - 0xaf16], eax
xor ebp, 0x320039ae
inc ax
inc edx
movzx ecx, byte [esp + edx - 0xaf16]
dec esp
lea esi, [edi + edi*4 + 0x7d0b189d]
inc ebp
inc edx
shr dword [esp + edx - 0xaf12], cl
xor ebp, 0x58b21a8
inc ebp
mov ecx, edx
sub ebp, 0x95045216
dec ecx
bts ecx, eax
inc si
and dword [esp + edx - 0xaf10], eax
ror ebp, 1
inc esi
sub byte [esp + edx*2 - 0x15e2b], cl
xor ebp, 0x91056104
not ebp
dec edx
dec dword [esp + edx - 0xaf16]
xor ebp, 0x858f39a4
sal ecx, 0xc1
bts ecx, 0x10
rol ebp, 3
dec edx
mov dword [esp + edx - 0xaf16], esi
inc ecx
shr al, 0xc7
movsx esi, al
inc edx
xor dword [esp + edx*2 - 0x15e2c], ebp
inc eax
inc bh
inc ebp
movsx ebp, cl
dec eax
sub esi, 0xf08e71bd
pop esi
inc ebp
adc ch, cl
ror ax, 0xae
call fcn.00955cf6
scasd eax, dword es:[edi]
pop esp
jns 0xa54093
invalid
cmp edx, dword [ebx]
dec dword [ebp + 0x79]
jp 0xa54123
pop esp
lodsb al, byte [esi]
push esi
push 0x26
jno 0xa54160
loope 0xa54111
sub ah, bh
mov ch, 0xec
add byte [ecx + 0xe], bh
leave
cmp dl, byte [esi - 0x4c]
div byte [ebx]
bound edx, qword [ecx - 0x186c7345]
fstpnce st(2), st(0)
insd dword es:[edi], dx
push edi
jae 0xa54148
add dword [eax + 0x11], eax
fbld tbyte [ecx - 0x7623ace9]
mov eax, dword [0x89dc5317]
jb 0xa54098
aam 0x37
push esp
or byte [eax], cl
popfd
sti
and ecx, dword [esi - 0x40]
adc dl, byte [edi]
pop ss
inc eax
arpl word ds:[edx - 0x49a5875d], si
popal
pop ds
jae 0xa5412c
frstor dword [ecx + 0x7a755a33]
or al, 0x66
and ah, byte [ebx]
xor byte [ebp - 0x594c4e8], cl
movsd dword es:[edi], dword [esi]
sar dword [esi], cl
xchg esi, eax
stosb byte es:[edi], al
dec ebx
mov ecx, 0xc0f46c43
invalid
insb byte es:[edi], dx
hlt
invalid
sbb al, byte [ecx + 0x66]
mov bh, dh
pushfd
cli
movsd dword es:[edi], dword [esi]
rcr dword [esi - 0x68883915], cl
call 0x35402fa4
mul dword [esi + 0x57]
adc eax, 0x5dd0e975
dec edi
cli
movsd dword es:[edi], dword [esi]
rcl edx, cl
mov eax, 0x6a3fbe3b
out 0x83, al
jecxz 0xa5416b
invalid
mov dword [0x2c5a0511], ebp
popal
add cl, byte [ebx]
mov dl, 0x32
cmc
sbb eax, 0xb56d76c8
sar dword [ebx - 0x57552a9], 1
movsd dword es:[edi], dword [esi]
sar dword [esi], cl
xor dh, cl
salc
pop eax
sub dh, byte [ebx]
mov ah, 0xc5
sub byte [edx], bh
bound ecx, qword [ebx + 4]
and bh, ah
jbe 0xa541ab
lds ebp, [eax]
cmp ah, byte [edx + 0x4b]
add al, 0x20
out 0x76, eax
not byte [esi]
push ss
cmp al, 0xd3
pmaxsw mm0, qword [0xe8612c5a]
jl 0xa541d6
lds ebp, [ebp + 0x13]
adc al, 6
mov dword [0xcdccf599], eax
pop ecx
jo 0xa5415e
sub edi, ebx
mov byte [ebp - 0x533bb76], al
movsd dword es:[edi], dword [esi]
rcl dword [edx + 0x35], cl
mov al, 0x6c
xor al, 0xe9
invalid

Function at 0xa5dda3
Capabilities:
Encode data using base64

Disassembly:
shl dx, 0xa3
xor eax, 0x5ea0249d
dec eax
xor eax, 0x1ab8f483
shl edx, 0xd2
call fcn.00a018f1
Function at 0xa5f709
Capabilities:
Encode data using base64

Disassembly:
sal dl, cl
xadd cx, dx
sbb eax, 0xee2ac836
jmp 0xa08bb2
rol eax, 1
sal dl, 0xc5
shr ecx, cl
xor ebx, eax
not cl
bts ecx, edx
bts cx, 0x96
add esi, eax
not dx
mov dx, word [ebp + ecx*4 - 0x354]
movzx eax, cx
mov cl, byte [ebp + ecx*2 - 0x1a8]
or eax, eax
lea ebp, [ebp + eax*4 - 0x352]
sar ax, 0x48
shr dx, cl
push eax
mov ecx, dword [esp + eax*2]
ror cl, 4
mov word [ebp + eax*4], dx
or dword [esp + eax*2], esi
ret
xor eax, 0x1ab8f483
lea ecx, [ecx + edx*8 + 0x23882d99]
mov dword [esp + ecx*4 - 0x4e49982c], ecx
lea eax, [eax + ecx*2 - 0x465c883f]
ror dword [esp + ecx - 0x1392660b], cl
xor ebx, eax
add esi, eax
not dword [esp + ecx - 0x1392660b]
inc cx
mov ecx, dword [edi + ecx*2 - 0x2724cc18]
call fcn.00a007e9
sub edi, 4
mov eax, dword [edi]
mov ecx, 0x560f6aab
xor eax, ebx
sal cl, 0x65
rol eax, 3
btc ecx, ecx
jae 0xd8e178
mov edx, 0xc6b106ac
neg eax
jmp 0x99bbd9

Function at 0xa5f762
Capabilities:
Encode data using base64

Disassembly:
add eax, eax
adc edx, esp
rol ax, 0xeb
mov word [edx], cx
mov eax, dword [edi]
mov ecx, 0x85a270b2
adc edi, 4
push ecx
lea ecx, [ecx*4 + 0x1c04ab1c]
ror cl, cl
xor eax, ebx
dec dword [esp + ecx*2 - 0x651cda9c]
sar dword [esp + ecx - 0x328e6d4e], 0xa1
mov edx, ecx
bswap eax
bt cx, cx
not dx
xadd byte [esp + ecx - 0x328e6d4e], dl
rol eax, 1
neg cx
add dx, dx
btr ecx, 0xbf
not eax
jb 0x94b6da
neg dword [esp + ecx*2 - 0x651d2564]
and cx, cx
rol eax, 1
btc edx, ecx
xor ebx, eax
and dword [esp + edx - 0x328a24b0], 0xa70bde3c
ror cx, 7
call fcn.00962814
xor ebx, eax
call fcn.009490d0
mov ecx, 0xe79f443f
sub edi, 4
mov eax, dword [edi]
call fcn.00947813
fdivr qword [ebp + 0x50]
add al, 0xe5
jl 0xa5f7f6
push eax
popal
bts edx, eax
movzx edx, byte [edi + eax*2 - 0xda74]
add ax, 0xebad
sbb al, al
lea eax, [eax + eax*8 - 0x33feb2d1]
adc edi, 0
xor al, 2
bts eax, 0x3f
setae al
xor dl, bl
add dl, 0x11
cwde
rol dl, 1
dec eax
ror eax, 0xcd
sar al, 0x24
adc dl, 0x95
add al, ah
btc eax, eax
setb al
xor dl, 0xb7
xor bl, dl
shl ax, 0x45
jns 0x956541
Function at 0xa643c0
Capabilities:
Encode data using base64

Disassembly:
add esi, edx
sar cx, 0x46
xchg ecx, eax
mov ax, word [ebp]
mov edx, ecx
bt edx, ecx
mov cl, byte [ebp + 2]
jb 0xd78aed
adc edx, edx
not dx
adc ebp, 1
sar edx, 0xf5
bswap edx
sal ax, cl
mov word [ebp], ax
ror edx, 0xeb
jmp esi
dec ecx
bswap ecx
dec eax
cwde
inc esp
mov esp, dword [ebx + edx*2 + 4]
dec eax
lea edx, [ecx*2 - 0x1863ff48]
inc ecx
neg ecx
inc ecx
push eax
dec eax
lea ebx, [ebx + edx*2 + 0x30c7fdc8]
dec esp
adc dword [esp + edx + 0x1863fefa], eax
inc cx
sal eax, 0xe6
dec eax
cdq
inc ecx
adc ebp, esp
shl eax, 0xd
mov dword [ebx + edx*2], ebp
jp 0xdc7759
xor ebx, edx
ror eax, 0xd6
cwde
jb 0xa5dc85
add esi, ecx
bt ax, ax
mov eax, dword [edx + ebp - 0xe8013ac]
mov cl, byte [ebp + edx*4 - 0x3a004eac]
sal dl, 0x25
bt edx, edx
jae 0x9630a1
mov eax, 0x71b789e
movsx edx, ax
inc edx
mov edx, dword [eax + ebp - 0x71b789e]
movzx eax, byte [edi + eax*2 - 0xe36f13c]
mov ecx, 0x7a1a418a
rol cx, cl
xor al, bl
ror al, 1
rol ecx, cl
adc al, 0x1e
or cx, 0x6a35
inc cx
rol al, 1
dec al
dec ecx
setno cl
not al
sar cl, 0xe1
call fcn.00dfb019
dec eax
or ecx, eax
inc ecx
push ecx
dec esp
adc dword [esp + edx*2], ebx
ret 0x20

Function at 0xd7dc9a
Capabilities:
Encode data using base64

Disassembly:
sbb al, 0x89
push edx
call fcn.00899994
mov edx, 0xd8aed08f
call fcn.00a191fb
setl byte [esp + edx - 0x2ab4065]
movzx eax, byte [edi + edx*2 - 0x55680e2]
shr edx, 0xeb
xor dl, 0xd
lea edi, [edi + edx*2 - 0xaad0]
mov dword [esp + edx - 0x5565], edx
jbe 0x8941e6
xor al, bl
not dword [esp + edx*2 - 0xaac2]
push edx
add al, 0xb3
or dword [esp + edx*2 - 0xaac9], edx
not al
neg al
rol al, 1
neg dword [esp + edx*4 - 0x15588]
jb 0x8b9a4c

Function at 0xd86263
Capabilities:
Encode data using base64

Disassembly:
dec edx
lea eax, [ecx*4 - 0x4c826d7]
inc ecx
inc ecx
inc ecx
ror al, 0x41
inc ebp
add al, dh
inc ecx
not ecx
dec ebp
sub edx, eax
add dx, 0x73af
inc ecx
rol ecx, 1
push ebp
inc sp
xchg dword [esp + 4], esi
dec word [esp + 4]
dec eax
mov dword [esp], esi
inc ecx
sal dl, 0x81
inc ebp
movzx ebp, sp
inc esi
xor dword [esp + ebp*4 - 0x343c0], ecx
neg dx
inc bp
xadd edx, eax
dec edx
lea edi, [ebp*2 - 0x56f81350]
pop esi
inc ecx
mov ecx, ebp
inc ebp
or al, al
dec ebp
arpl cx, cx
dec ebp
adc ebx, ecx
inc eax
sub ch, 0xa8
inc edi
movzx edx, byte [edi + ebp*4 - 0x343c0]
inc esp
bt edi, eax
dec edi
lea edi, [edi + ebp - 0xd0ef]
inc ecx
shr ah, 2
inc esp
xor dl, dh
inc ecx
xor dl, 0xa6
inc cx
or ebp, 0xd0413e14
retf 0x8041
dec ecx
add esi, 0x42e1a26
inc esp
xor ecx, esi
jmp 0x9f97da
dec esp
lea edx, [edx + edx*8 - 0x6c77af69]
dec ebx
lea ebp, [esp - 0x70713946]
inc ecx
neg ecx
inc ecx
inc ecx
inc ecx
rol dl, 0xc1
inc ecx
xor ecx, 0xae2ad282
jmp 0x954ae2
dec eax
mov dword [esp], 0x5582cf3f
inc ecx
shr ecx, 8
sal word [esp + 6], 0xa8
ja 0x9f5c06
ja 0x8c9e28
inc esp
xor ecx, esi
not word [esp + 3]
call fcn.009fb9e1
inc eax
rol bh, 0x83
inc edx
xor dword [esp + ebp*2 - 0x21596854], eax
call fcn.00a379e6
Function at 0xd88ba0
Capabilities:
Authenticate hmac

Disassembly:
bswap eax
mov dword [esp + edx - 0x73638a36], edx
neg eax
btr dx, dx
ror cl, cl
rol eax, 1
xor word [esp + edx - 0x73638a35], 0xf7bd
not eax
sbb cx, 0x8781
mov dword [esp + edx - 0x73638a2e], 0xa8035b38
xor ebx, eax
shr ecx, 0x46
ror dword [esp + edx - 0x73638a36], cl
xchg word [esp + ecx - 0x36001db], cx
add esi, eax
push ecx
mov eax, dword [ebp + edx - 0x73638a36]
call fcn.008db616
sar dword [edx + eax*2 + 0x22], 0xec
pop esp
jne 0xd88c3a
adc eax, 0xe9b629e4
aas
test byte [edi + 0x57], 0x17
imul dword [ebx + 0x47]
dec ebx
push 0xffffffffffffff8b
invalid
dec ecx
xor ebx, ecx
shl al, 0xe5
mov dword [ebp + edx*2 - 4], ecx
movzx ecx, al
xor edx, dword [ebp + edx*2 - 4]
inc ecx
setle al
mov cx, word [edx + ecx*2 - 0x102]
mov edx, eax
mov word [ebp - 2], cx
ror dl, 0xe2
movsx ecx, ax
xor dx, 0x109
adc ebp, 0xfffffffe
add dx, 0x1e09
mov edx, dword [edi + 4]
sbb edi, 0xfffffff8
btc ecx, ecx
xor edx, ebx
bswap ecx
ror cl, 0x44
ror edx, 2
lea edx, [edx + eax - 0x59e4575f]
inc eax
shl ecx, 0x5c
call fcn.009a57f6
or al, ah
shr cl, 0xc5
xor edx, 0xe5281293
btr eax, 0x9c
rol edx, 1
lea edx, [edx + ecx - 0x5d5fda4c]
call fcn.0098c7c3

Function at 0xd8b9d4
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
bts eax, eax
bswap edx
mov dword [esp], eax
movzx ecx, al
neg edx
inc edx
rol edx, 2
neg byte [esp + ecx*2 - 0xfb]
cmove eax, dword [esp + ecx - 0x7e]
add cx, 0xf392
xor ebx, edx
or dword [esp + ecx - 0xf410], ecx
adc esi, edx
pop ecx
movzx eax, word [edi - 6]
xor ax, bx
call fcn.00a5ae6e

Function at 0xd9017f
Capabilities:
Encode data using base64

Disassembly:
xor al, byte [esp + eax*2 - 0x35fc929c]
not edx
call fcn.00dedc08
aad 0x7b
stosd dword es:[edi], eax
xor byte [ebp - 0x70a43368], 0xcb
movsd dword es:[edi], dword [esi]
push edx
push esp
outsd dx, dword [esi]
invalid

Function at 0xd911c9
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
pop eax
not edx
lea edx, [ecx + edx + 0x2c0306b2]
jmp 0xdb79e2
xor edx, 0xaf366fa2
movsx eax, cl

Function at 0xd924e8
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
add ecx, ecx
adc esi, eax
lea eax, [edx + ecx*4 - 0x215e52e0]
bswap ecx
mov ax, word [ecx + ebp - 0x20000]
pop edx
dec al
mov edx, 0x13b16607
pop edx
ror al, 1
sal byte [esp + 1], 1
bts edx, 4
sub edx, edx
inc al
not dword [esp + edx*4]
not al
rol byte [esp + edx + 1], 0x21
xor bl, al
inc byte [esp + edx*2 + 2]
xor dword [esp + edx], edx
mov dword [esp + edx], edi
bts dx, dx
add dl, dl
jae 0xe13c16
push esi
lea edx, [edx + edx*8 + 0x4fb43039]
jg 0x996e64
mov eax, dword [edi]
mov ecx, 0x32a03ca9
lea edi, [edi + ecx - 0x32a03ca5]
sal ecx, cl
xor eax, ebx
or cx, cx
and cl, cl
bswap eax
movsx edx, cx
setle cl
sub ecx, ecx
rol eax, 1
shr dx, 0x6f
neg ecx
not cl
xor eax, 0x8f9ef9ad
not edx
add eax, edx
btr ecx, ecx
adc ecx, edx
inc cx
rol eax, 2
shl cx, 0x21
sete cl
jg 0x9aae44
Function at 0xd98312
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x64a73c09
mov edx, ecx
mov edx, dword [ecx + edi - 0x64a73c09]
movsx eax, cx
cwde
lea edi, [ecx + edi - 0x64a73c05]
call fcn.00d911c9
lea ecx, [edi + ecx + 0x1ded3f7c]
je 0xe041c4
adc word [esp + edi - 0x3c9c72a3], 0x609c
not ecx
inc ecx
dec cl
dec eax
sbb dword [esp + edi - 0x3c9c72a6], 0xce22b68d
inc ecx
inc esp
xor ecx, 0xd4a2a5b3
dec edx
lea edx, [0xdc226b12]
lea ecx, [ecx + edi - 0x86ad971]
cwde
call fcn.00dc2085
mov eax, 0xaaaa47ae
push eax
mov eax, dword [ebp]
sar dword [esp], 0x9d
mov edx, dword [esp]
movzx dx, byte ss:[eax]
ror dword [esp], 0x9c
mov eax, 0x74862905
lea ecx, [eax*8 - 0x29552fd1]
mov word [ebp + ecx - 0x7adc1855], dx
rol byte [esp + ecx - 0x7adc1856], 1
movzx ax, byte [ebp + eax - 0x74862903]
mov cl, byte [ebp + ecx - 0x7adc1853]
mov edx, 0x1826653c
bts edx, 0x1f
ror edx, 0x53
not al
sar edx, 0x6c
ror dword [esp], 0x72
not cl
or al, cl
movzx ecx, dl
mov word [ebp + ecx*4 - 0x1e0], ax
dec byte [esp + ecx - 0x77]
call fcn.00975da2
not dl
sub cl, byte [esp + 8]
push ecx
call fcn.009d7e57
jmp 0x9b52a2
call fcn.00a53f91
mov edx, 0xa779205d
cmp dl, byte [esi - 1]
call 0x571b318b
jmp dword [ecx - 0x133adfa1]