joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d078
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x420630]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x40d0e8
test edx, edx
jne 0x40d0c4
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x40d0f7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x40d097
call dbg.fc_key_init_once
mov eax, dword [0x420630]
mov edx, dword [eax + 0x28]
jmp 0x40d090
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
lea esi, [esi]

Function at 0x40d1dc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov eax, dword [0x420630]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x40d2c1
test edx, edx
jne 0x40d260
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x40d253
lea esi, [ebp - 0x20]
jmp 0x40d213
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x40d24a
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], 1
call eax
cmp eax, 6
je 0x40d288
cmp eax, 8
jne 0x40d2b4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
jne 0x40d210
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x40d1ff
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40d258
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
call dbg.fc_key_init_once
mov eax, dword [0x420630]
mov edx, dword [eax + 0x28]
jmp 0x40d1f8
Function at 0x40d2d4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x40d2f8
mov dword [esp], ebx
call dbg._Unwind_SjLj_RaiseException
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [0x420630]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x40d34c
test edx, edx
jne 0x40d328
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x40d35c
call sym._abort
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x40d30b
call dbg.fc_key_init_once
mov eax, dword [0x420630]
mov edx, dword [eax + 0x28]
jmp 0x40d304
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop

Function at 0x40d3f8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x420630]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x40d47c
test edx, edx
jne 0x40d458
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x40d43c
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
je 0x40d44d
call sym._abort
nop
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40d435
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x40d417
call dbg.fc_key_init_once
mov eax, dword [0x420630]
mov edx, dword [eax + 0x28]
jmp 0x40d410
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0xa4417cf
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x59af624b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10010700
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10010891
pushal
mov esi, section..seg
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x1001072a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10010731
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10010720
mov eax, 1
add ebx, ebx
jne 0x10010743
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10010738
jne 0x10010754
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10010738
xor ecx, ecx
sub eax, 3
jb 0x10010768
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100107da
mov ebp, eax
add ebx, ebx
jne 0x10010773
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10010780
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x100107a4
inc ecx
add ebx, ebx
jne 0x10010790
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10010785
jne 0x100107a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10010785
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100107c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100107b5
jmp 0x10010726
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100107c4
add edi, ecx
jmp 0x10010726
pop esi
mov edi, esi
mov ecx, 0x281
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100107e2
cmp byte [edi], 1
jne 0x100107e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100107e7
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x1001085f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10f58]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10fe4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10010814
mov ecx, edi
jns 0x10010843
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10fe8]
or eax, eax
je 0x10010859
mov dword [ebx], eax
add ebx, 4
jmp 0x10010831
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10010890
cmp al, 0xef
ja 0x10010883
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10010865
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10010872
popal
jmp 0x1000547e
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x1d651dd0
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x263e63b7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10cd6402
Capabilities:
Encode data using base64

Disassembly:
pop edx
ror cl, 1
mov edx, 0xd2a0bf97
dec edx
not dx
add cl, 0x2e
neg cl
btr dx, dx
dec cl
xor bl, cl
sub edx, edx
adc ecx, esp
btc edx, 3
xor edx, edx
mov dword [edx + ecx], eax
adc edx, dword [edi + edx - 5]
xor edx, ebx
mov ecx, 0x9f870326
movzx eax, cx
inc edx
ror ecx, 0xc1
bt eax, ecx
ror edx, 1
xchg cx, ax
jmp 0x118d8c3e
sub ecx, ecx
sbb al, dl
or dx, cx
xor al, 0xa8
ror al, 1
call fcn.11187090
inc cx
xor al, bl
inc edx
rol edx, 0x48
bswap edx
neg al
inc dl
jge 0x10d2839d
neg edx
bts eax, 0xaf
neg eax
sbb cl, 0x39
rol edx, 3
xor ebx, edx
inc ax
shl ax, cl
adc ax, ax
add esi, edx
bt eax, 0x97
cdq
movzx eax, byte [edi + ecx - 0x4fc303f2]
or dl, 0x97
sar ecx, cl
lea edi, [ecx + edi - 0x4fc36]
jns 0x10d58e2f
lds edx, [ebp + 0x7f238b66]
sub byte [ecx - 0x7473d940], dh
adc byte [edi - 0x6b], 0x7c
pop ds
xor eax, 0x6ee4d7d1
ja 0x118d8cd7
push 0xdedd1808
retf
or ecx, edi
invalid

Function at 0x10cd7323
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ebp - 0x3d4c0168], 0xdc0b158d

Function at 0x10cd7c77
Capabilities:
Encode data using base64

Disassembly:
shl cl, 0xa4
not edx
bswap edx
xor word [esp + eax*4 - 0x3fffff9], cx
xchg word [esp + eax - 0xfffff4], ax
call fcn.118cd7bc
mov byte [ecx], al
mov edx, 0x2e9e4fa6
push edx
mov ecx, dword [edx + ebp - 0x2e9e4fa4]
inc dl
lea eax, [edx + edx*2 - 0x71c02156]
movzx eax, byte [edi + eax*4 - 0x686b3682]
lea edi, [edi + edx - 0x2e9e4fad]
sub edx, edx
xor al, bl
xor al, 8
bt edx, edx
add byte [esp + edx + 9], dl
ror al, 1
add al, 0x2e
shr dx, 0xaa
bt edx, edx
sub dl, byte [esp + edx + 0xb]
neg al
shr dword [esp + edx*8 + 8], 0x74
dec al
not word [esp + edx*4 + 6]
shl byte [esp + edx + 6], 0xa1
sar dword [esp + edx*2 + 7], 0xe
xor bl, al
shl dl, 0xe1
lea edx, [edx*4 - 0x1c0a772]
neg edx
lea eax, [esp + eax + 0xc]
adc dl, 0x26
neg dx
mov dword [eax + edx - 0x1c05867], ecx
mov eax, dword [ebp + edx*2 - 0x380b0c8]
movzx dx, byte [eax + edx*8 - 0xe02c338]
neg word [esp]
jp 0x111a55cc
mov word [ebp + 8], dx
mov eax, 0xbe9936be
sbb ebp, 0xfffffff7
mul dword [esp + 4]
and al, byte [esp + eax - 0x5e343ca5]
mov ecx, 0xab8ecd99
mov dword [esp + edx*4 - 0x1062c], esi
ret 8
Function at 0x10ce1785
Capabilities:
Encode data using xor

Disassembly:
shld edx, eax, cl
mov dword [ebp], edx
call 0x10d4a8f0
dec edi
jle 0x10ce17e1
push edi
pop es
mov edx, 0x951302c7
mov edi, 0x74e92dfb
adc eax, 0x656f6841
adc ah, byte [eax - 0x47eedb29]
mov ah, 0xcd
and ecx, dword [esi + 0x656f6841]
adc ah, byte [eax - 0x5eeedb29]
mov ebx, 0x65fa29c7
jo 0x10ce1818
sub eax, 0x411574e9
push 0xa012656f
xlatb
and al, 0x11
mov eax, 0x8e23cdb4
inc ecx
push 0xa012656f
xlatb
and al, 0x11
mov eax, dword [0xfa29c7bb]
jo 0x10ce1818
inc ebp
xor cl, byte [esi]
mov ds, esi
adc dword [edi - 0x56a2dbce], ebp
pop ds
imul byte [ebx + 0x12]
cld
jbe 0x10ce17b0
loopne 0x10ce179d
inc edi
imul edi, dword [ebp - 0x1a], 0xe3d4be09
push ebx
pop eax
jg 0x10ce1821
or al, 0x27
cmc
jmp 0x10ce1827
arpl word [esi + 6], cx
jmp 0x2242601b
loop 0x10ce184e
fst qword [0x630d0637]
xchg ecx, eax
std
mov ah, 0x17
jmp 0x6c67eb24
cdq
pop ebx
scasd eax, dword es:[edi]
nop
fnstenv [ebx - 0x4a5c05d6]
pop eax
add bh, byte [edx - 0x1a]
rep movsd dword es:[edi], dword [esi]
scasb al, byte es:[edi]
dec edx
sub eax, dword [ecx - 0x401f6f8b]
xchg ecx, eax
enter 0x1084, 0xffffffffffffffce
xor dword [eax - 0x39385bd8], ebp
clc
inc eax
jg 0x10ce17fa
stosd dword es:[edi], eax
das
pop es
mov edi, 0xae0f5c79
stc
out 0x64, eax
cmp dword [eax], edx
test al, 0xab
push esp
add dh, bh
add byte [esi], dh
jp 0x10ce18a1
call [ebp + 0x79012034]
inc ecx
mov cl, 0x3c
jne 0x10ce18e1
inc esp
fptan
xchg ebx, eax
sbb byte [edx + 0x26b74c1f], ch
stosb byte es:[edi], al
pop ds
dec esp
mov bh, 0x26
ja 0x10ce18aa
mov ecx, 0x593a9cab
push esi
and al, 0x39
sbb byte [eax], bh
add esp, dword [ecx + 0x4c8d5913]
wait
loop 0x10ce1874
sub eax, dword [edx - 0x11327a34]
retf
mov dh, 0xcd
invalid
insb byte es:[edi], dx
adc dword [edx + esi*2 + 0x394e4a80], edi
loopne 0x10ce18b6
mov eax, dword [0xef82b2b2]
mov dl, 0x82
out dx, eax
cmpsd dword [esi], dword es:[edi]
loop 0x10ce1860
cmp eax, 0x30389c60
popal
mov esp, 0x9161803d
jb 0x10ce190a
dec esi
xchg esi, eax
outsd dx, dword [esi]
pop ss
mov esi, 0x15aec57f
cmp byte [edx + 0x12], bl
inc edx
adc dword [eax - 0x676d3ccb], 0x4553b134
movsb byte es:[edi], byte [esi]
les ebp, [edx + esi*8 - 0x5e27cdd6]
ficom word [eax]
jmp 0xd77167b9
ret 0xad40
Function at 0x10ceacec
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + ecx - 0x4c32fff8], edi
dec edx
mov dword [esp + ecx - 0x4c330000], 0xa021a386
inc cx
btc ecx, 0x14
inc ecx
push ebp
inc esi
xor dword [esp + ecx - 0x4c330000], edx
inc ecx
pop esi
inc dx
shr dword [esp + ecx - 0x4c33000e], 0x28
dec esi
mov edi, dword [esp + ecx - 0x4c330008]
dec edx
lea esi, [ecx*2 - 0x65efeac5]
inc ecx
shl ch, 0xe3
dec esp
lea ebp, [esi*4 + 0x4a18c20e]
dec ebp
arpl dx, dx
dec ebp
adc ebx, edx
inc edx
movzx edi, word [esp + ecx - 0x4c33000f]
inc bp
mov ebp, dword [ecx + ebp - 0x4c330010]
dec edx
mov dword [esp + ecx - 0x4c330008], edi
inc ecx
mov esp, 0xb2015b1b
pop esi
dec edx
lea ebp, [ebp + ecx - 0x4c33000e]
inc esp
movsx edx, cl
inc byte [esp + edi*2 - 0x1413f]
inc esi
movzx eax, byte [esp + ecx - 0x4c33000c]
dec ecx
lea ebx, [ecx + ebx - 0x4c330012]
add cx, word [esp + edi - 0xa09d]
inc ecx
shr dl, cl
dec eax
dec ecx
inc ebp
movzx ecx, word [ecx + ebx - 0x4c330010]
setle cl
inc ecx
shl ah, 0xc6
inc bp
xor ecx, edi
dec eax
neg dword [esp + edi - 0xa0a3]
inc ecx
xor dh, ah
call fcn.10d018e2
inc sp
movzx ecx, byte [ebp]
jmp 0x111b4df7
mov eax, 0x7681612a
movzx ecx, al
mov cl, byte [ebp + ecx*2 - 0x52]
add ax, ax
dec eax
lea ebp, [ebp + eax - 0x7681c252]
jae 0x10d0f751

Function at 0x10cf129f
Capabilities:
Encode data using base64

Disassembly:
push ebp
dec eax
mov ebp, dword [esp + 0x20]
jmp 0x11181597
call fcn.10ce9a72
Function at 0x10cf51a1
Capabilities:
Encode data using base64

Disassembly:
dec edx
lea ebx, [ebx + edx + 0xf5da8fd]
inc esp
movzx ecx, si
dec ecx
btr ebp, esi
inc cx
xor ecx, edi
dec eax
lea edx, [esi*4 - 0x74cdb2fb]
not cx
xor esi, edi
inc ecx
setge al
dec cx
dec edx
lea eax, [edi + ebp*2 + 0x4391a0ad]
inc ecx
xchg al, dl
xor cx, 0x7c9b
ror cx, 1
call fcn.10cf8679
stc
xor esi, esi
cmp dx, si
or eax, 0xffffffff
test sp, sp
jmp 0x1116af66
rol eax, 0x68
lea ecx, [esp + ecx + 4]
mov dword [esp + eax - 0x3ced0e6d], 0x66098299
dec eax
mov byte [esp + eax*2 - 0x79da1cd5], al
mov byte [ecx + eax*2 - 0x79da1cd8], dl
call fcn.1116dbea
mov edi, 0xb2b9cc0c
dec eax
sub ebx, 4
dec eax
ror edi, 0x39
dec eax
sub edi, edi
inc esp
mov ecx, dword [edi + ebx]
or edi, 0xe7a56a13
inc ebp
xor ecx, edi
inc ecx
not ecx
dec esp
lea ebp, [edi + edi + 0x7536cb38]
inc ecx
sub bh, ch
call fcn.118ec51a
inc ecx
mov ebp, 0xaf02db93
dec esp
mov eax, dword [ebp]
inc ebp
mov esp, ebp
inc ecx
movsx esi, bp
inc cx
mov ecx, dword [eax]
inc ecx
or esi, esp
dec eax
sar esi, 0x7d
mov word [esi + ebp + 6], cx
mov edx, 0x4f16f811
inc sp
mov eax, dword [ebp + esi + 6]
dec eax
lea ecx, [edx + edx*2 - 0x175362d0]
dec esp
lea edx, [esi + esi*8 - 0xf5d56fd]
inc sp
mov esi, dword [ebp + esi*2 + 8]
inc bp
adc eax, esi
inc sp
mov dword [ebp + esi*4 + 8], eax
jmp 0x11187672
dec eax
lea edi, [edx + esi*2 + 0x4021bfb0]
inc ecx
inc esp
inc ecx
mov esi, 0xe68e14b0
dec ecx
add esi, ebp
inc ecx
xor esp, 0x5e07b6b7
inc ecx
rol esp, 1
inc edi
lea esp, [esp + ebp*2 - 0x7ed9d576]
dec ecx
xadd esi, edi
inc ecx
push edi
dec esp
lea eax, [ecx + edi*4 + 0xf3b931e]
inc esi
xor dword [esp + edx + 0xf5da903], esp
inc ecx
pop edi
inc sp
and esi, edx
dec ebp
arpl sp, sp
setnp cl
inc ebp
adc ch, dl
dec ebp
add ebx, esp
movzx ecx, word [edx + ebx - 0x4f16f817]
jmp 0x10ce8818
inc edi
test bh, dh
test sp, 0x949c
or esi, edx
jmp 0x11172a47
sub edi, edi
cmp ecx, dword [ebp - 0x40]
jmp 0x111b7b6a
inc ecx
clc
stc
cmp edi, 5
jmp 0x11831fb5
inc esp
mov esp, dword [ebx + esi*8 - 4]
inc cx
neg edx
inc ebp
xor esp, edi
jmp 0x10d159f8
je 0x118d3aa1
movzx edx, byte [ecx]
cmc
cmp edx, ebp
clc
shl esi, 8
jmp 0x10d19c82
jl 0x1116af68
mov dword [ebp - 8], ecx
sar dh, cl
lea esp, [esp]
dec dh

Function at 0x10cf7c97
Capabilities:
Encode data using base64

Disassembly:
mov edx, ebp
push 0x8eb86f30
sub ebp, 2
mov eax, 0xe19fd09a
sub word [esp], 0x4fb4
mov word [ebp], dx
lea edx, [eax*4 + 0x3699b31a]
lea ecx, [eax - 0x1a486964]
sbb edi, 4
call fcn.10d382c3
dec esp
add ebx, esi
dec edx
lea edi, [0x5f3a0d85]
dec eax
lea ebx, [ebx + eax - 0x2d]
dec esp
mov dword [esp + eax*2 - 0x58], esp
dec eax
inc dword [esp + eax*2 - 0x58]
setns byte [esp + eax - 0x2c]
inc esp
movzx esi, byte [ebx + eax*2 - 0x58]
inc ebp
xor dh, bh
mov dword [esp + eax*4 - 0xac], ecx
inc ecx
inc dh
inc ecx
rol dh, 1
inc ecx
inc dh
or al, 0xa
inc ecx
neg ch
inc cx
inc ebp
inc ecx
xor dh, 0x9c
and dword [esp + edx*2 + 1], ecx
shl di, 0x8d
inc ebp
xor bh, dh
cbw
dec eax
lea ebp, [ebp + eax - 0x30]
inc sp
mov dword [eax + ebp - 0x2e], esi
inc cx
shr edx, 0x8d
inc ecx
pop eax
jae fcn.10cf108c
Function at 0x10d02b6e
Capabilities:
Encode data using base64

Disassembly:
movzx ecx, dl
lea edi, [edi + ecx - 0xb5]
sar ecx, 0xc1
xor eax, ebx
sar edx, cl
lea ecx, [ecx*2 + 0x6d305517]
inc eax
dec dx
not dx
not eax
ror dword [esp + ecx - 0x6d3055bd], 0x7f
setnp cl
neg eax
and dword [esp + ecx - 0x6d3054f8], edx
call fcn.10d2a1db
mov edx, 0xcd05aa3a
mov edx, dword [edi - 4]
mov ecx, 0xd5235915
xor edx, ebx
dec edx
bt ecx, ecx
add cx, 0xeea6
mov eax, 0xfa4b213
ror edx, 2
inc edx
shl ax, 0x42
js 0x111bc7ca
mov ecx, 0x802800af
lea eax, [ecx - 0x5dff3e44]
and ax, cx
mov eax, dword [eax + ebp - 0x2228002b]
movzx edx, cx
movzx ecx, byte [edi + edx*2 - 0x15f]
xor cl, bl
and dl, dl
ja 0x118faa50
inc bp
mov eax, dword [ebp + ebx - 0x551c]
inc bp
xor eax, edi
inc ebp
movzx esi, ch
movzx ecx, ax
inc cx
add eax, 0x98489a13
inc esp
movsx esp, cx
inc cx
neg eax
dec esi
lea ecx, [ecx + ebp - 0x565b604b]
inc ebp
movzx edx, bp
inc ecx
dec dl
inc cx
sub eax, 0xc166f589
shr byte [ecx], 0x66
inc ecx
not eax
inc ebp
adc dh, dh
dec eax
cdq
inc cx
dec eax
inc ecx
movzx esi, dh
call fcn.1117b05e
ror dword [esp + ecx - 0x2df0], 0x71
div byte [esp + ecx*2 - 0x5be0]
xor edx, 0x508d919c
xor ebx, edx
pop ecx
xadd eax, ecx
adc esi, edx
bts cx, ax
shr cl, 0xc4
cbw
movzx dx, byte [ebp + ecx*2 - 0x111fc]
cwde
or cl, byte [ebp + ecx*8 - 0x447fa]
sub eax, eax
not al
ror ax, 0xf
shl dl, cl
lea ecx, [eax + eax*4 + 0x4b41606]
mov word [eax + ebp - 0x1f8], dx
lea ebp, [ebp + eax - 0x1f8]
xor al, 0x86
movsx edx, al
jmp esi
xor cl, 8
push edx
ror cl, 1
imul dx, word [esp + edx*8 - 0x576]
adc cl, 0x2e
rol edx, 0x5d
imul dx, dx
sub dword [esp + edx*4], 0xbb194b3b
neg cl
sar word [esp + edx*2 + 1], 0x41
xor edx, 0x92bbd50f
dec cl
xor bl, cl
lea ecx, [esp + ecx + 4]
not dx
bts edx, 0x97
mov byte [esp], dl
mov dword [ecx], eax
mov ecx, edx
mov edx, dword [edi - 5]
movzx eax, word [esp]
lea edi, [edi + eax*4 - 0x16bc5]
cmovb ecx, eax
xor edx, ebx
dec al
xchg dword [esp + ecx*2 - 0xb5e0], eax
inc edx
shr eax, 0xd2
shr ax, 0xe5
neg edx
xadd word [esp + ecx*2 - 0xb5de], cx
ror byte [esp + ecx + 3], 0x81
xadd word [esp + ecx + 2], cx
dec edx
jmp 0x118c6d32
Function at 0x10d04d3f
Capabilities:
Encode data using base64

Disassembly:
inc esp
mov esp, eax
dec eax
mov edi, dword [esp + ebp*2 - 0x5e]
dec esp
mov dword [esp + ebp - 0x2b], esp
inc ebp
mov ecx, esp
dec esp
mov ecx, dword [esp + ebp - 0x23]
dec eax
mov dword [esp + ebp*8 - 0x188], eax
call fcn.118f737d
not edx
inc ecx
movzx eax, dl
not di
inc cx
sar edx, 0xa8
ror edx, 1
inc ebp
btc ecx, ecx
dec ebp
adc ecx, esi
dec edx
inc ebp
mov esp, ecx
inc ecx
push edi
xor dword [esp + edi*4 - 0x1c424], edx
dec esp
lea edi, [eax + edi + 0x42877c39]
inc cx
inc esp
dec ecx
shl esi, 0x6a
inc ecx
pop edi
inc cx
shr esi, 0x6b
dec eax
arpl dx, dx
dec eax
sub eax, eax
inc ecx
bswap esp
dec esp
adc ebx, edx
mov dx, word [edi + ebp - 0x7109]
dec eax
lea edi, [esp + edi*2 - 0xe1f2]
dec ebx
lea ecx, [esi + edx - 0xfc4d963]
jmp 0x1117c031
dec eax
or edx, 0xd5122295
inc esp
mov ebp, eax
dec ebp
xor eax, edi
inc ecx
inc esi
push ecx
inc edx
inc dword [esp + edx - 0x612cff8d]
dec ecx
ror eax, 1
dec ecx
neg eax
dec eax
add dword [esp + esi + 0x336426d5], 0xc60b5b00
dec ecx
rol eax, 5
inc word [esp + esi + 0x336426d5]
jnp 0x118f29c3
dec eax
inc esi
mov byte [edi + eax*4], dl
inc ecx
mul ecx
inc esp
adc cl, dh
dec ebp
mov eax, dword [edx + ebx - 0x612cff9a]
dec eax
lea esi, [edx - 0x336426d5]
dec eax
movsx edi, cl
dec edx
lea ebx, [ebx + edx - 0x612cff9a]
jbe 0x11169d81
inc ecx
xadd ecx, ecx
dec ebp
sub eax, esi
dec ecx
btc esp, 3
inc ecx
setb dh
inc si
or dword [esp + ecx - 0x13c14240], edx
dec ebp
xor edi, eax
dec ecx
btc esp, 0xa6
dec esp
lea ebp, [eax*8 - 0x2c5de2c6]
dec esp
lea edx, [edi*2 + 0x3d08f680]
dec esi
mov dword [ebp + ecx*4 - 0x4f050906], eax
inc ecx
inc ebp
dec eax
add edx, edx
dec eax
sar eax, cl
dec esi
lea esi, [esp + ecx*4 - 0x4f0508b0]
inc ecx
sar ebp, 0x14
inc esp
movsx eax, dx
dec edi
mov ebp, dword [ecx + esi - 0x13c14240]
inc dx
xor esi, dword [esp + ecx - 0x13c1423b]
dec eax
sbb ecx, 0x8a18deb2
inc eax
ror dh, 0xa1
dec esi
mov dword [ebp + ecx - 0x13c1424e], ebp
inc edx
inc dword [esp + ecx - 0x13c1423e]
dec esi
add eax, dword [esp + ecx - 0x13c14240]
dec si
dec edx
lea ebp, [ebp + ecx - 0x13c1424e]
pop eax
js fcn.10cf108c
Function at 0x10d096f3
Capabilities:
Encode data using xor

Disassembly:
dec eax
xor ecx, dword [edx + ebp]
dec eax
shl eax, 0x9c
inc bp
imul esi, eax
call fcn.118c0b85
and eax, 0x32b796c2
lea eax, [esi - 0x2a]
jp 0x10d096dc
or eax, 0x69c1fb33
add dword [eax + ecx*2 - 0x760edccd], eax
inc ecx
test byte [eax + 0x33], cl
inc ebx
loope 0x10d0973c
xor edi, ebx
shr dword [ecx + 1], 0x84
dec eax
xor esp, dword [ebx]
int1
mov dword [ecx - 0x7c], eax
dec eax
xor eax, dword [ebx - 0x1f]
sbb dword [ecx], edx
test byte [eax + 0x33], cl
push ebx
xchg ecx, eax
cmp dword [ecx + 0x61334884], ebx
adc dword [eax + ecx*2 + 0x39915333], eax
cdq
test byte [eax + 0x33], cl
popal
inc ebp
push ebx
int 0x95
jno 0x10d097a5
jae 0x10d097a3
jmp 0xf224af59
mov edi, 0x3544dc5a
push 0x866e5baf
lcall 0xe093, 0xbdd12183
rcr esi, cl
and dword [ecx], 0xffffffd1
mov ebp, 0xded3e093
inc esp
jns 0x10d09747
or al, 0x19
imul ecx, esp, 0x946e797d
loopne 0x10d09711
pop ecx
sbb byte [esi + 0x39ba1879], ah
mov eax, 0xba187956
mov ebp, 0x18792e20
mov edx, 0x79b66829
sbb byte [edx + 0x7976b8f9], bh
sbb byte [edx + 0x790ed3e1], bh
sbb byte [edx + 0x797ee005], bh
sbb byte [edx + 0x2c1ed599], bh
cmp ecx, edx
cmp byte [0x56768966], ah
test byte [eax - 0x5e772381], ch
stosd dword es:[edi], eax
jecxz 0x10d097ff
aaa
cdq
mov byte [ecx + 0x2b], dl
sal dword [ebx], cl
aaa
cdq
mov byte [ecx], dl
inc ebx
pop ebx
sal dword [edi], cl
cdq
mov byte [ecx], dl
and eax, dword [ebx]
sal dword [edi], cl
cdq
mov byte [ebx], ch
test byte [edx + 0x21fdf76], 0xc0
mov ebp, 0xe7f2c352
xor byte [eax + esi*4], al
outsd dx, dword [esi]
xchg ebp, eax
invalid
mov edx, 0x76d44933
sbb byte [edx + 0x760cd273], bh
sbb byte [edx + 0x2c114f37], bh
cmp dword [eax - 8], edx
add dl, 0x9e
or byte [0x3c313c47], ah
mov ecx, 0xefddd066
cld
invalid

Function at 0x10d0d254
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp + ecx*8 - 0x7fffe], dx
mov edx, dword [ecx + edi - 0x10004]
xor edx, ebx
call fcn.111ba9b4

Function at 0x10d11fda
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + eax - 0x4b45866e]
ror ecx, 1
cwd
neg ecx
bt eax, eax
bswap ecx
xor ebx, ecx
call fcn.118ba4cb