joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbdd96b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
inc eax
lea ecx, [ecx + 0x1cbe701f]
bswap eax
lea eax, [eax + ecx - 0x69a95425]
ror byte [esp + ecx - 0x1ea6f514], 0x46
jae 0xd602da
xor ebx, eax
ror dl, 0x47
adc esi, eax
dec dword [esp + edx - 0x3d109f03]
inc cl
ror ecx, 0x52
pop eax
pop edx
pop edx
pop eax
jb fcn.00aa83ef

Function at 0xbddd63
Capabilities:
Encode data using xor

Disassembly:
dec edi
lea edi, [edx + edi - 0x47]
inc esp
movzx ecx, byte [esp + ebx - 0x7ebf9fab]
rol byte [esp + ebx - 0x7ebf9fa4], 0x82
inc esp
mov esi, dword [ebx + ebp - 0x7ebf9fb6]
dec eax
lea ebp, [edi + ebp - 0x7f341505]
inc sp
and ecx, edx
inc ebp
xor esi, eax
movsx ecx, dx
inc esp
bt ebx, ecx
dec eax
cwde
inc esi
lea esi, [ebx + esi - 0x36bd1dad]
inc cx
div edx
add ecx, edx
div bl
inc ecx
neg esi
sub dword [esp + edi - 0x7f3414f2], 0x7c808b13
mul bx
inc ebp
sbb esi, ecx
inc ecx
neg esi
dec esp
mov dword [esp + ebx - 0x7ebf9fa1], eax
inc esp
xor dword [esp + edi - 0x7f3414f0], esi
dec esp
mov eax, dword [esp + ebx - 0x7ebf9fa1]
inc word [esp + ebx - 0x7ebf9faa]
dec ebp
arpl si, si
dec eax
mov dword [esp + ebx - 0x7ebf9fa1], eax
sar dword [esp + ebx - 0x7ebf9fa0], 0xf6
dec ebp
adc esp, esi
push ecx
dec esp
or dword [esp + ebx - 0x7ebf9fb1], esp
ret 0x18
jnp 0x76f1e5
push 0x3b9cf504
pushfd
shr dword [esp + 4], 0x61
cmp byte [esp + 4], 0x31
jg 0xb81b37
je 0xb81b2b
not byte [esp + 4]
mov dword [esp + 4], 0xa288e532
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00b520e1
dec ecx
neg esi
inc ecx
movsx eax, dx
ror cl, 1
cdq
dec eax
lea edi, [edx + eax*2 + 0x7f3414b2]
inc word [esp + edi - 0x7f341540]
inc cl
ror cl, 1
add cl, 0x30
dec eax
mov dword [esp + ebx - 0x7ebf9fa9], ebx
inc ebp
movzx ebx, dx
xor cl, 0xa9
shr dl, 0x66
inc eax
shr bh, 0x47
inc sp
sub ebx, edx
sbb cl, 0x2c
xor cl, 0xbe
inc esp
xor al, cl
dec eax
lea ecx, [esp + ecx + 0x18]
sal al, 0x21
dec esp
mov ebx, dword [ebx + ecx - 0x7ebf9fb1]
dec esi
mov dword [ebx + edi - 0x7ebf9fa9], ebx
dec eax
mov dword [esp + ebx - 0x7ebf9fb1], edx
ja 0xb81b05
mov edx, 0xed02ed09
lea ecx, [edx - 0x5975e4da]
mov cx, word [edi]
movsx eax, dl
cdq
xor dx, word [edi + edx + 2]
or al, al
add al, ah
sal ax, 0xa
lea edi, [edi + eax*8 - 0x11ffe]
not cx
not dx
jnp 0xcd1286
setp al
bts eax, eax
and cx, dx
imul al
not ax
rol ax, 0xb
mov word [edi + eax*8 - 0x5bff8], cx
mov ecx, dword [esi + eax*2 - 0x16ffe]
movsx edx, al
lea esi, [esi + eax*2 - 0x16ffa]
adc eax, 0xdfae9d8f
and dl, dl
jno 0x7ee2de

Function at 0xbedf2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
call eax
mov edx, 0xd325948f
sar dl, 0xa3
mov ebp, dword [ebp - 4]
call fcn.007d59c3

Function at 0xbee651
Capabilities:
Encode data using base64

Disassembly:
push 0x3b38bf26
push 0x620b68a
and edi, 0xff
mov edi, dword [edi*4 + 0xc58fcc]
mov dword [esp + 8], 0xe0b38d24
jmp 0xca7699
Function at 0xc0aa39
Capabilities:
Manually build aes constants

Disassembly:
bswap eax
pop ecx
mov ecx, edx
sbb ecx, ecx
not eax
inc eax
ror eax, 1
sub ecx, 0xa0b9cb3a
mov dword [esp + edx - 0x15a], edx
neg eax
btc edx, edx
mov dword [esp + edx*2 - 0x80002b0], edx
xor ebx, eax
shr dword [esp + edx - 0x4000158], cl
sub dl, cl
add ebp, eax
neg byte [esp + edx*2 - 0x8000321]
inc dl
sub byte [esp + edx - 0x4000193], dh
movzx edx, byte [esi + edx*4 - 0x10000659]
call fcn.007749ae

Function at 0xc0b141
Capabilities:
Encode data using xor

Disassembly:
ror eax, 1
dec esi
mov dword [esp + edx - 0x4a5a9ec9], eax
inc esp
movzx eax, dl
inc edx
xor dword [esp + ecx - 0x40800000], eax
inc ecx
pop eax
inc ecx
btr edx, esi
dec eax
arpl ax, ax
sal cl, 0xc4
shr si, 0xc9
inc ecx
shr dl, 0xa4
dec esp
add esp, eax
dec esp
bt edx, esi
dec ecx
mov eax, dword [edi + edi - 0x4a5a9eef]
inc ecx
movzx ebx, bl
dec ecx
neg esi
adc bx, 0x6839
dec edi
mov esi, dword [edi + ecx - 0x407ffff8]
not cl
inc esp
btr edi, ebx
dec edx
inc edx
mov cl, byte [edi + edi - 0x4a5a9edf]
inc cx
or edi, ecx
sar di, 0xe9
dec edi
lea edi, [ecx + edi - 0x407ffff6]
dec ebp
sbb ecx, ecx
call fcn.00bfff22
push 0xea1c5eb9
sub edi, 4
mov eax, 0x69883b26
pop edx
mov edx, dword [eax + edi - 0x69883b26]
bswap eax
xor edx, ebx
neg eax
neg edx
movzx ecx, ax
bswap edx
ror edx, 1
shl eax, 0x94
jp 0xd4455b
call dword [edi - 0x78]
push ebx
mov byte [0x21c4b44f], al
inc edi
aam 0xef
stc
mov bh, 0x32
mov bh, 0xc3
and bl, dl
sbb al, 0x7f
jl 0xc0b270
mov dh, 0xa
les edx, [ebp + 0x472b8bab]
ror dh, cl
xchg esi, eax
dec byte [esi + eax*8]
or al, 0xc6
dec eax
fisub dword [esi - 0x434ad333]
cmp edi, dword [esi - 0x55]
xor ecx, ebx
push esp
scasd eax, dword es:[edi]
clc
jnp 0xc0b205
ret 0xfffe
mov ecx, dword [ecx - 0x56506db8]
jge 0xc0b209
xor byte [ebp + 0x47], bh
cdq
outsd dx, dword [esi]
cmpsd dword [esi], dword es:[edi]
inc ebx
mov al, 0x7c
jle 0xc0b299
fsubr qword [esi + eax*2 - 0x51d9076d]
popfd
insb byte es:[edi], dx
invalid
invalid

Function at 0xc161da
Capabilities:
Encode data using xor

Disassembly:
xor cl, bl
neg dword [esp + eax - 0x15fffff6]
push edx
sbb cl, al
cdq
imul edx, dword [esp + edx]
and word [esp + edx + 0x11], ax
rol cl, 1
pop eax
shl eax, 0xf4
push edx
xor cl, 0xd
add cl, 0xac
bt edx, 0xb5
xor bl, cl
imul dx
sal ax, 0xee
sal dl, 0x61
lea ecx, [esp + ecx + 0x14]
xor al, 0x95
neg al
add edx, dword [ecx + edx*8]
movsx ecx, al
sar word [esp + ecx - 0x5e], cl
cmovp ecx, eax
mov dword [edi + ecx*2 - 0xda], edx
lea edi, [edi + ecx - 0x6f]
ror byte [esp + ecx - 0x68], 0x61
pop ecx
pop edx
pop eax
pop edx
pop edx
jg fcn.00a9ba64
Function at 0xc17db1
Capabilities:
Encode data using base64

Disassembly:
xor dword [esp], 0x643cfe1b
shl dword [esp], 0x4f
sal cx, 0xce
mov ecx, dword [eax + edi]
not eax
shl ax, 0xe6
bts eax, 0x19
mov eax, dword [edi + 4]
mul ecx
mov ecx, 0xbea429ae
or cx, cx
push ecx
mov dword [edi], edx
mov dword [edi + 4], eax
ror cl, 0x43
pop edx
jmp esi
inc eax
dec dword [esp]
ror dword [esp + 8], 0x17
xor ecx, 0xc8bf9632
jmp 0xaf7f26
push 0x7ca24036
shr ecx, 8
inc word [esp + 8]
inc dword [esp]
xor ecx, esi
shl word [esp + 0xa], 0xa
jne 0xbe1cbb
mov edx, 0xa73d8231
sub edi, 4
lea ecx, [edx*4 - 0x47c396ed]
btc dx, 0x3d
neg edx
mov eax, dword [edi + ecx - 0x553271d7]
rol ecx, 0x19
sal cl, 1
xor eax, ebx
lea edx, [edx + edx*2 + 0x3d0c850d]
ror eax, 1
or dl, cl
xchg edx, ecx
xor edx, 0xb20be8a1
bswap eax
btr dx, cx
adc edx, edx
ror eax, 2
dec eax
call fcn.00772384
mov edx, dword [ebp]
mov eax, 0x19890b02
or eax, eax
lea ebp, [ebp + eax*2 - 0x33121600]
xor edx, ebx
not eax
add edx, 0x2b971b27
movzx ecx, al
lea ecx, [eax + ecx*8 - 0x43729eee]
shl eax, cl
neg edx
sub edx, 0x9e13c439
bt ecx, eax
not edx
shl ecx, 0x28
add ecx, ecx
rol ecx, 0xc9
lea edx, [edx + ecx*2 - 0x5e159f01]
sar cx, 0xaf
setne cl
rol edx, 1
sar ax, 0xa1
ror ecx, 0x7c
sbb edx, 0xfab36112
or eax, eax
ror edx, 3
and ecx, ecx
xor ebx, edx
dec ecx
cwde
add esi, edx
jmp 0xb1a451
Function at 0xc1e1c9
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey

Disassembly:
bswap eax
lea eax, [ecx + eax + 0x6e2978fa]
neg eax
not cx
xadd word [esp + edx - 0x61c2fffe], dx
not word [esp + edx - 0x61c2b85f]
xor ebx, eax
rol dword [esp + edx - 0x61c2b861], cl
sub ecx, ecx
rol dword [esp + ecx], 0x81
adc esi, eax
mov dword [esp + ecx*2], esi
ret
mov eax, dword [esp + 4]
xchg byte [esp + eax*4 - 0x2230b825], al
not dl
shl byte [esp + eax - 0x88c2e04], 0xe6
jne 0xcde1db
jmp 0xbeef87
xor edx, ebx
movsx ecx, al
not edx
add ax, ax
and eax, ecx
setae cl
inc edx
call fcn.00c6031f
mov cl, byte [edi + ecx - 0x88c2e09]
not al
mov dword [esp + edx - 0x88c2e0b], edx
lea edx, [edx + edx*4 + 0x52a4dc2a]
not cl
bswap edx
or al, cl
push edx
movzx ecx, dl
mov cx, ax
movzx cx, cl
btr edx, edx
mov dl, byte [edx + edi - 0x41c26179]
jae 0xce611a
not cl
jb 0xb7f825
and cl, dl
or al, al
mov word [eax + edi - 0x88c2e04], cx
cwde
lea edi, [edi + eax*8 - 0x1703c]
mov eax, dword [ebp + eax - 0x2e08]
mov edx, 0x2b8ba638
pop edx
lea ebp, [ebp + edx - 0x61c26179]
dec dx
lea ecx, [edx + edx*8 - 0x79e79556]
sar dl, 0x81
xor eax, ebx
bswap eax
inc dx
shr dword [esp + edx - 0x61c2613f], cl
dec eax
rol eax, 1
bswap eax
bt ecx, 0x28
sal ecx, cl
add cx, dx
rol eax, 1
lea eax, [eax + edx + 0x1e74975b]
xadd byte [esp + edx - 0x61c2613e], ch
sbb dword [esp + ecx - 0x7b7630bf], ecx
xor dx, dx
ror eax, 3
not cl
dec dx
jne 0x7d908b
mov ecx, 0x7d2ba5be
movzx edx, cl
mov eax, dword [edi + ecx - 0x7d2ba5be]
mov dl, byte [edx + edi - 0xba]
bt ecx, ecx
bt ecx, 0x9d
rol cx, 0xc7
lea edi, [ecx + edi - 0x7d2bdf4c]
jb 0xbc77cf
sub ecx, ecx
mov byte ss:[eax + ecx], dl
movsx eax, cl
xchg cx, ax
xor ecx, dword [esi + ecx*4]
lea edx, [eax - 0xc64ca4c]
lea esi, [eax + esi + 4]
cbw
not ax
and al, 0xa0
xor ecx, ebx
bt edx, eax
push eax
xchg dword [esp + eax - 0xffa0], eax
ror ecx, 2
cwd
not ecx
not dx
btr edx, eax
xor ecx, 0x324a2a4
shl byte [esp + eax - 0xff9e], 0x61
xor dword [esp + eax - 0xffa0], edx
rol ecx, 2
pop edx
btc edx, 0x2c
dec ecx
bts ax, dx
ror ax, 0x84
xor ebx, ecx
bts eax, 0xa8
add ebp, ecx
movzx ecx, al
call fcn.00cc9df1
call fcn.00abb703
Function at 0xc207b0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x5fa989a4], eax
js 0xc67392
call fcn.00b9c590
mov word [edi + eax - 0x5fa989a4], dx
not dword [esp + eax - 0x5fa989a1]
or eax, eax
mov eax, dword [ebp + eax - 0x5fa989a4]
sar dword [esp + 4], 0x4f
adc ebp, 3
mov ecx, 0x66263c1c
xor eax, ebx
sub eax, 0xe129211d
neg word [esp + ecx - 0x66263c1b]
neg ecx
lea edx, [ecx*8 - 0x1a541371]
ror eax, 1
not dx
push ecx
inc eax
and dword [esp + 6], edx
btc edx, 0x20
bswap eax
setae byte [esp + 1]
dec dl
rol dword [esp + 2], cl
sbb eax, 0x4b025f06
lea edx, [ecx + edx*2 + 0x1987b5a3]
dec edx
xor ebx, eax
and cl, cl
and cx, cx
sar dword [esp + edx*2 - 0x38aec444], cl
add esi, eax
or word [esp + edx*4 - 0x715d8898], cx
pop ecx
pop eax
pop edx
jl fcn.00aa83ef
inc ecx
mov esi, 0x4f30b525
inc ebp
xor byte [edi + 0x45], cl
movzx ebx, dh
call fcn.00759731
inc ebx
stc
js 0xc67420
add dword [edx - 0x138d2ea2], ecx
in al, dx
fadd qword [ecx - 0x26]
push es
sal dword [edx - 0x14], 1
jle 0xc6747f
rol byte [edx], cl
and bh, byte [edx - 0x44e59501]
xchg edx, eax
sal word [ebx], 1
mov al, 0xcb
sbb dword [edx + edx*8], ebx
mov dword [ecx - 0x5a], esi
add byte [eax + edi*4 + 0x60b62113], dl
or dword [esi + ebx*2 + 0x4f], 8
test al, 0x95
and dword [esi + 0x5e4c8360], esi
dec edi
or byte [esi], ch
test al, 0x95
mov bh, 0x88
pop ecx
scasb al, byte es:[edi]
mov ecx, 0x1e35337
mov edi, ss
push 0xf33a7a6a
push ds
loop 0xc674d6
cmp dh, byte [esi + 0x5d]
jle 0xc674af
pop esi
std
enter 0xffffffffffffc122, 0xffffffffffffffe2
mov bl, 0x7b
aam 0xc3
popal
pop edx
xor ebp, dword [eax - 0x8968a8]
loop 0xc67434
jnp 0xc67457
ret
jbe 0xc6748b
jmp [ecx - 0x8004873]
test eax, 0xf7ffb78d
in al, 0x28
jmp 0x3d0bf3
int 0x1a
mov byte [0x641a1295], al
aaa
test byte [eax + 0x52], bh
pop es
mov eax, 0x136d7814
xor dword [ebp + esi - 0x3bfdc3d3], edi
stosb byte es:[edi], al
mov ebx, 0x630b68c1
sbb esi, dword [ebp + 0x5f]
adc dword [ebx - 0x2f], 0x81214981
and dword [esi + 4], edi
out 0xa0, al
and dword [ecx], 0xa0e6047e
push edi
test al, ah
add eax, 0xb4b6c61
jp 0xc6755d
in al, dx
dec dword [ecx]
sahf
scasd eax, dword es:[edi]
jg 0xc6748a
mov esp, 0x35914a6c
sbb ebp, dword [0x2082e00c]
retf 0xa65e
pushfd
imul ebp, edx, 0x64087fe0
jl 0xc675d3
adc eax, 0x721f1c00
lds edi, [esp + eax*2 - 2]
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
mov ebx, 0x3fd02ea4
movsb byte es:[edi], byte [esi]
sar byte cs:[edi], 1
and ch, bl
lds ecx, [ecx + 0x23eb8b38]
fisub word [eax + 0x46]
dec eax
push ebx
cmp byte [edi], 0xb5
not ebp
shl byte [ecx - 0x367adbb6], cl
pop ecx
push ebx
mov edi, dword [edx]
out dx, eax
sbb dword [esi - 0x68], edi
jbe 0xc675fc
idiv byte [ebp + esi*2 - 0x56]
nop
cld
push edx
insb byte es:[edi], dx
out dx, al
or eax, 0x9a2948e0
push 0xffffffffffffffbc
jg 0xc67572
ret 0x78f8
retf
fnstcw word [ecx]
salc
invalid

Function at 0xc21ca3
Capabilities:
Encrypt data using chaskey

Disassembly:
mov edx, 0x1a150f9f
mov edx, dword [edx + esi - 0x1a150f9f]
mov ecx, dword [esi + 4]
call fcn.00c6a04c
Function at 0xc220fb
Capabilities:
Encode data using xor

Disassembly:
xchg word [esp + eax - 0x6932167b], dx
call fcn.00c526ab
dec esp
mov dword [esp + edi - 0x2e], eax
xor dword [esp + edi - 0x2e], esi
dec eax
lea ebx, [eax + edi - 0x665d995f]
dec eax
dec eax
inc sp
bt edi, esi
inc ecx
pop eax
dec esi
lea ecx, [esi*2 - 0x37d57dd6]
dec eax
cwde
dec eax
arpl si, si
and al, 0xa8
dec eax
inc eax
dec esp
adc esp, esi
dec eax
cdq
inc cx
sal esi, 0x6c
dec ebp
mov esi, dword [edi + edi*2 - 0x54]
dec ebp
lea edi, [edi + edi*4 - 0xa8]
inc esp
mov edx, edi
movzx edx, byte [ebp + edi - 0x33]
dec edx
lea ebp, [ebp + ebx - 0x47808d32]
inc ecx
xor dl, al
dec eax
add ebx, 0x25826904
not dl
inc ebp
mov ebp, edx
cmovge eax, edi
mov esi, edi
dec dl
not dl
inc sp
xor ebx, edi
sbb dl, 0x93
inc esp
xadd bh, dl
shr edi, cl
dec ebp
add ecx, ebx
neg dl
inc cx
inc ecx
not ax
inc ecx
shr dl, 1
rol dl, 1
call fcn.00bfd88a
js 0xc2213c
nop
hlt
Function at 0xc31482
Capabilities:
Execute syscall

Disassembly:
lea edi, [edi + edx*2 + 4]
movsx eax, byte [esp + edx]
xchg word [esp + edx + 2], dx
inc byte [esp + edx - 0xfffe]
xor ecx, ebx
inc word [esp + edx - 0xfffd]
seto al
xor eax, dword [esp + edx - 0xffff]
rol ecx, 3
sub ecx, 0x91a16897
call fcn.00b248bb
sub ecx, 0x519a8a29
sub byte [esp], 0x35
cwde
neg ecx
dec ecx
pop eax
ror ecx, 1
sar ax, 0x27
movzx edx, al
sal ax, 0x6c
xor ebx, ecx
add edi, ecx
rol eax, 0xd5
jae fcn.00ba7e32
bt edx, ecx
lea eax, [ecx*8 - 0x5361cb7d]
mov eax, dword [ebp + ecx*4 - 0x70dc765c]
setae dl
bts dx, 0x2c
lea ebp, [ebp + ecx - 0x1c371d93]
sal edx, cl
xadd ecx, edx
xor eax, ebx
imul ecx, edx
xor eax, 0xa10c8bb5
xchg ch, cl
push ecx
lea edx, [ecx*4 - 0x9dbd3d5]
rol eax, 1
ror dx, cl
jae 0xd25545
inc eax
call fcn.007e4f60
add dword [esp], 0xc21fd23a
shld edx, eax, cl
push 0x1a36a49f
neg dword [esp + 4]
mov dword [esi], edx
setg byte [esp + 4]
pop ecx
pop edx
jmp ebp
inc cx
xor al, 0x34
mov dword [esp], 0xc32c412d
lea ecx, [ecx*4 - 0xae82c69]
sub al, 0x99
not ecx
xor bl, al
imul ecx, ecx
neg cl
lea eax, [esp + eax + 4]
bt ecx, ecx
mov byte [eax + ecx - 0x6b57fec0], dl
pop ecx
movsx edx, cl
mov ecx, dword [esi + edx*8 - 0x167]
movzx eax, dx
xor ecx, ebx
or edx, 0x60bb16ab
push eax
xor dword [esp + eax*2 - 0x5a], edx
lea ecx, [ecx + edx - 0x6774b6d9]
shr byte [esp + eax*4 - 0xb4], 0xa3
adc dword [esp + eax - 0x2d], 0xc3987c3e
imul dx
rol ecx, 3
sub eax, 0xda3c4139
inc ecx
shr dword [esp + edx - 0x60bb0003], 0xd0
jb 0xd0ff21
sar al, 0xe1
lea ebp, [eax + ebp - 0x787497d8]
cwde
cbw
xor ecx, ebx
jmp 0xb50815
not ecx
sbb ecx, 0xa832be1e
xor ecx, 0xc492383b
ror ecx, 1
add dword [esp + eax*2 - 0x4b897714], 0xaa19b40d
xor ebx, ecx
cwde
add ebp, ecx
mul dl
movzx edx, byte [esi + edx - 0x60bafffe]
lea ecx, [eax + eax*2 - 0x25d87b79]
xor dl, bl
xadd ecx, eax
bswap eax
sub dl, cl
cwde
push eax
idiv byte [esp + eax - 0x24d3]
ror dl, 1
shr ax, 0x66
idiv byte [esp + eax*2 - 0x1e3]
add ecx, 0x1cbe39a9
neg dl
ror dl, 1
pop ecx
or byte [esp + eax*2 - 0x340c], ah
not dl
cwde
xor bl, dl
cwde
rol eax, cl
mov word [eax + edi - 0x18000068], dx
pop edx
bt eax, ecx
movzx eax, byte [esi + eax*2 - 0x300000ca]
inc dx
btr edx, ecx
lea esi, [esi + ecx*8 - 0x126c9]
sar ecx, cl
and cl, dl
inc cx
xor al, bl
and dx, dx
setl cl
neg al
sub al, cl
sub ecx, ecx
call fcn.00ba0a55
mov eax, 0xb10b6b17
movzx edx, al
movzx ax, byte [esi + edx*2 - 0x2e]
mov ecx, edx
mov cl, byte [esi + edx*4 - 0x5a]
add edx, edx
dec dx
xor edx, edx
lea esi, [esi + edx + 2]
or dl, dl
shl al, cl
push edx
mov word [esi + edx*2], ax
rol dword [esp + edx], 0x36
dec dword [esp + edx]
lea ecx, [edx*4 + 0x4dafd6bd]
mov ecx, dword [edi + edx*2]
jae 0xb1f67b
dec ecx
xor ebx, ecx
rol edx, 0x18
adc dl, byte [esp + 2]
add ebp, ecx
xor eax, 0xdd1d9d2c
idiv ax
mov dword [esp + eax - 0x4793eab0], ebp
ret
Function at 0xc3b8e5
Capabilities:
Encode data using base64

Disassembly:
neg eax
sal word [esp + ecx - 0xfe3f], 0xaa
inc ecx
shl dl, 0xe1
dec esp
lea ebp, [ecx*8 - 0x5cf33aeb]
dec eax
ror eax, 2
inc cx
rol edx, 0xa7
inc ebp
movzx esi, dx
inc ecx
sal esi, 0x38
dec esp
mov dword [esp + ecx - 0xfe27], eax
dec eax
or dword [esp + ecx - 0xfe2f], 0x3346596
inc ecx
shr ebx, cl
sar esi, cl
inc edx
xor dword [esp + ebx + 0x17], eax
inc ecx
pop ebp
inc ecx
xor dh, dh
dec esi
mov eax, dword [esp + ebx + 0xf]
call fcn.00b5c6ef
sub ebp, 4
mov edx, 0xb022f391
mov edx, dword [ebp]
mov eax, 0xaf31a423
xor edx, ebx
not edx
lea ecx, [eax*8 + 0x32a53180]
inc edx
cbw
neg edx
dec edx
sub ecx, eax
xchg ecx, eax
push ecx
bswap edx
sbb byte [esp + 1], ch
inc byte [esp]
neg edx
not edx
neg ecx
rol dword [esp + ecx - 0x50ceffdd], 0x3f
xor ebx, edx
call fcn.00b0daaa
inc ecx
push ecx
dec eax
shr dword [esp + ecx*2 - 0x1fc7e], cl
mov eax, dword [ecx + ebp - 0xfe3f]
inc ecx
xor eax, eax
dec edx
lea ebx, [edx + ebx*2 + 0x19a4e989]
not eax
dec eax
mov dword [esp + ecx - 0xfe37], 0xf3959e38
inc esp
movsx edx, dx
dec eax
jmp 0xace4fb

Function at 0xc460fb
Capabilities:
Authenticate hmac

Disassembly:
sbb cl, al
xchg word [esp + eax - 0x48c7fff6], dx
not cl
dec byte [esp + eax - 0x48c7fffa]
mov dword [esp + edx - 0xffdc], edx
xor bl, cl
or edx, 0x6f29ba97
ror edx, 0x14
cdq
lea ecx, [esp + ecx + 0xc]
lea edx, [edx*4 + 0x6c0062ba]
dec ax
mov ax, word [ecx + eax - 0x48c8ffff]
xchg dword [esp + edx - 0x6c0062b2], edx
lea esi, [esi + edx*2 - 0x14bb7e]
mov word [esi + edx*2 - 0x14bb7c], ax
ja 0xcd3a13
pop ecx
pop edx
pop ecx
js fcn.00ba8982
dec edx
and word [esp + ecx*2 - 0x3923600], 0x33be
movzx eax, cx
bswap edx
shr dword [esp + ecx - 0x1c91b00], 0x96
ror al, 0x45
xor edx, 0xce21351e
sal ax, 7
Function at 0xc6886c
Capabilities:
Encode data using xor

Disassembly:
ror cl, 1
pop edx
xor bl, cl
push eax
lea ecx, [esp + ecx + 0xc]
mov edx, dword [esp + eax - 0xb979]
rol edx, 0x70
push edx
mov edx, dword [ecx + eax*4 - 0x2e604]
mov dword [esi + eax*4 - 0x2e60a], edx
mov edx, dword [esp + eax - 0xb975]
neg dx
and edx, edx
lea esi, [esi + eax*4 - 0x2e60a]
pop ecx
pop eax
pop eax
pop eax
ja fcn.00ba8982
not edi
dec eax
shr eax, 0xa2
inc cx
inc ebx
inc ecx
push eax
inc edx
xor dword [esp + ecx*2 - 2], edi
dec eax
xor esi, 0xb01efc9e
inc ecx
add esi, ebx
inc cx
imul esi
inc ecx
pop eax
inc ecx
sbb ebx, 0x121e6d12
inc ecx
mov ebx, esi
setbe al
dec eax
arpl di, di
dec esp
adc esp, edi
inc bx
movzx esi, byte [ecx + edi - 1]
dec eax
lea edi, [eax*8 - 0x6d494c80]
inc esp
movsx ebp, di
inc edx
add al, byte [eax + edi + 2]
inc ecx
bswap ebp
inc ecx
xor dh, ch
inc ecx
xor al, ch
dec eax
btc edi, 0xbc
inc eax
and dh, al
inc cx
sub ecx, 0x72e88d0d
jl 0xc688f9
dec dword [ebx + 0x2ef81d7]
add byte [eax], al
add byte [eax - 0x6fe162f2], bh
mov word [edi], dx
call fcn.00c07a24
Function at 0xc7edb8
Capabilities:
Encode data using base64

Disassembly:
bt eax, eax
lea esi, [esi + eax*2 - 0x613188c6]
neg ax
push eax
mov word [edx + eax - 0x30983b9a], cx
jle 0xc3fabe
btr ax, 0xa0
lea eax, [eax + eax*2 + 0x50bb4402]
sbb edi, 4
sub byte [esp + 1], 0xb0
mov edx, dword [edi]
xor edx, ebx
call fcn.00d427ac
xor edx, 0x6d186486
movzx eax, cx
neg edx
neg cx
not al
xor edx, 0x7789a7b7
bswap eax
jmp 0xd0b0c2
inc cx
imul ebx, ebx
dec eax
arpl si, si
dec esp
adc esp, esi
sal edi, 0x1a
or dl, 0x3e
cwd
inc bx
mov ecx, dword [ecx + edi - 0x5724]
inc ecx
mul cl
dec esp
imul ebx, edx
dec ecx
sar ecx, 0x48
dec edi
lea edi, [ecx + edi - 0x4f]
dec edx
lea esi, [esp + ecx + 0xd9]
bswap eax
dec ebp
sbb ebp, ebx
inc ecx
mov byte [ecx + esi - 0x57], cl
inc esp
xor ebx, ebx
dec eax
rol edi, 0x36
dec ecx
or edi, esp
jmp edi
ror ax, 0xc8
shr cx, 0x45
pop ecx
xor edx, 0xaf369fa7
bt eax, ecx
add al, 0xbb
and al, ch
xor ebx, edx
xadd ax, cx
add ebp, edx
movzx edx, al
shr ax, 0x26
xor eax, edx
mov ecx, dword [edi + eax - 0x72]
imul eax
and edx, eax
shl dl, 0x43
lea edi, [eax + edi - 0x32c0]
shr edx, 0x5a
xor ecx, ebx
or dx, ax
lea ecx, [ecx + eax + 0x71839775]
neg edx
neg dl
bswap ecx
xor ecx, 0xf288d622
inc edx
jl 0xc3d205
inc ecx
sbb dh, 0x12
movsx ebx, al
inc ecx
movzx ecx, dx
inc ebp
xor al, dh
dec ebp
btc edx, edx
inc di
mov dword [edi + ecx - 0x5724], esi
inc edx
mov esi, dword [ebp + ecx*2 - 0xae5b]
inc ecx
mov esi, 0x60802fad
ror cl, cl
dec ecx
xchg esi, ecx
dec ecx
lea ebp, [ecx + ebp - 0x5731]
inc sp
btc eax, ebp
inc ecx
xor esi, eax
sub esi, 0xaaa51333
inc ecx
dec ebx
ror esi, 1
inc esi
inc ax
inc ecx
not esi
not esi
inc ecx
push eax
cdq
inc ecx
setg dh
inc edx
xor dword [esp + ecx - 0x572a], esi
inc ecx
pop eax
jmp 0xb67f54
bswap eax
neg ecx
mov dword [esp + edx - 0x769d7326], ecx
not eax
sal ecx, cl
dec cx
neg edx
sbb eax, 0xbc0fd027
rol eax, 1
shr cl, 0xe3
jnp 0xd43a82
xor ecx, eax
ror edx, 1
sub al, 0xae
xor ebx, edx
dec ecx
bts ecx, ecx
add ebp, edx
jmp ebp
dec ax
lea edx, [edx + eax + 0x2621a3a2]
xor eax, ecx
ror edx, 3
dec ax
bts eax, eax
xchg ecx, eax
lea edx, [edx + eax*4 + 0x6e30499e]
jae 0x78db04
jb 0xd399f8
sal cx, 0xcc
neg edx
dec ecx
rol edx, 2
and eax, eax
shr eax, cl
push eax
xor ebx, edx
sar eax, 0x77
sets al
adc ebp, edx
push eax
shl word [esp + eax + 5], 0xa1
sub al, 0x20
pop eax
pop eax
jb fcn.00be75f1
jns 0xb7dd14
mov eax, 0xec22a01b
movzx edx, byte [esi]
add eax, 0x8265903
mov ecx, eax
setl cl
adc esi, 1
shr ax, cl
xor dl, bl
lea eax, [ecx*4 + 0x5d0f040c]
add dl, cl
bswap ecx
not eax
neg eax
ror dl, 1
neg dl
sar eax, cl
ror dl, 1
and ax, cx
or ecx, ecx
sub cx, ax
not dl
not ecx
rol eax, 0x21
xor bl, dl
bswap eax
shr ecx, 0x67
lea ecx, [ecx + ecx*4 + 0x45bbf490]
lea edi, [edi + ecx - 0x4fa837bd]
add al, ah
btr cx, 0x91
shr ecx, cl
mov word [edi + ecx - 0x27], dx
movsx edx, al
imul ax
add edx, dword [ecx + esi - 0x27]
lea esi, [esi + ecx - 0x23]
rol cx, cl
dec ecx
xor edx, ebx
jmp 0xd1f96c
Function at 0xc8bffd
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
rol eax, 2
neg eax
not eax
and cl, dl
xor eax, 0x63b35410
rol dl, 0xc6
rol eax, 3
bt ecx, 0xb7
inc edx
xor ebx, eax
not cx
mov dword [esp + ecx - 0x5f4a53be], ecx
or ecx, edx
adc ebp, eax
shl word [esp + ecx - 0x5f4f73fe], 0xe9
and cx, 0x65b5
not edx
mov eax, dword [edi + ecx - 0x5f4f61b5]
sar dl, 0x87
lea edi, [edi + ecx - 0x5f4f61b1]
sub cx, cx
and ecx, 0x730c9031
push edx
mov dword [esp + ecx - 0x530bfffc], eax
jne 0xaaa6cb

Function at 0xc99cc7
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + edx*2 - 0x7528cf71]
mov dword [esp + edx*2 - 0x7528cf72], edx
xor al, bl
xor al, 0xa3
ror al, 1
ror edx, 0x3f
mov dword [esp + edx - 0x7528cf6e], edx
btr dx, dx
neg al
call fcn.00ad6b02
fsubr st(0)
adc cl, dh
jecxz 0xc99cef
call [eax - 0x1d0e88ef]
rcl dword [ecx + 0x75ec7d39]
out dx, al
cwde
adc dword [edi - 0xf], esi
loop fcn.00c99cc7
xchg ecx, eax
cmp dword [ebp - 0x14], edi
jne 0xc99cea
inc ebp
mov eax, dword [0xd3ec7d39]
mov dh, 0x3d
jmp 0x74c952d3

Function at 0xc9a0e9
Capabilities:
Authenticate hmac

Disassembly:
neg edx
btr cx, cx
sar ecx, 0x38
add ax, 0x678d
lea edx, [edx + eax*4 - 0x479ccb69]
mov dword [esp + edx*4 - 0x51130000], edx
inc dword [esp + edx*4 - 0x51130000]
xor cl, bl
rol cl, 1
not dl
add cl, dl
dec edx
ror cl, 1
neg cl
mov word [esp + edx*4 - 0x511303f6], dx
inc dx
jp 0xd0dab9
add cl, 0xa7
or dx, dx
jge 0xc09ff9
call 0xd322a2

Function at 0xc9a62c
Capabilities:
Authenticate hmac

Disassembly:
add ebp, edx
movsx edx, byte [esp + eax - 0x56a3904b]
mov dl, byte [esi + edx*2 - 0x48]
mov cl, byte [esi + eax - 0x56a3904d]
imul ax, word [esp + eax - 0x56a39049]
and dl, cl
push eax
pop ecx
not word [esp + eax - 0x56a32dbd]
not dl
dec eax
xchg dword [esp + eax - 0x56a32dbd], ecx
mov cx, dx
dec ax
sar dword [esp + eax - 0x56a32dbd], 0x36
movzx edx, byte [edi + eax - 0x56a32dc5]
xor dl, bl
xchg dword [esp + eax - 0x56a32dbf], eax
dec dword [esp + 3]
ror ax, 0xa9
rol dl, 1
neg dl
ror dl, 1
xchg dword [esp + 2], eax
dec al
shr al, 0xe6
not dl
sbb ax, 0x318b
inc dl
sub dword [esp + 4], eax
xor bl, dl
sal byte [esp + 1], 0x86
call fcn.00d36b0f
mov dword [esp + 4], 0xd39ef924
inc edx
ror edx, 3
imul eax, eax
ror eax, 0x5c
xor ebx, edx
mov dword [esp + eax - 0x56a3904f], eax
dec ecx
js 0x7b7df7