joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10502bc
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
dec edi
lea edx, [edi + 0x1f242323]
dec esi
mov dword [esp + edi - 0x5d3d5ef9], edi
inc ecx
dec ecx
pop ebp
inc ecx
imul bh
inc ecx
rol ecx, 1
dec esp
lea eax, [ebp*2 - 0x35dd657]
inc sp
btc eax, edi
inc ecx
inc edi
inc esp
adc ecx, edx
rol cl, 0x45
inc ecx
shl ah, 0xc5
inc ecx
rol ecx, 1
inc bp
bt edi, edi
inc ecx
push esi
inc ecx
add dl, 5
sete al
inc esp
xor dword [esp + ebp - 0x5d3d5ef9], ecx
idiv ebp
inc ecx
pop esi
dec eax
sub ebp, 0x5d10acb6
dec eax
add edi, 0xa19cdbd
dec ebp
arpl cx, cx
dec ecx
adc esi, ecx
dec eax
lea edx, [ebp*4 - 0xeef39da]
inc esp
bts eax, eax
inc ecx
inc dl
dec esi
lea ebp, [ebp + ebp - 0x2cb24b]
inc ecx
and edx, esp
inc ecx
imul edi, eax
dec edx
mov ebx, dword [ebp + ebp - 0x2cb243]
dec ecx
xor ebx, esi
inc esp
mov ecx, edx
dec eax
not ebx
xadd eax, edx
dec eax
neg ebx
dec eax
bt ecx, 0
inc eax
setb bh
inc eax
shr ch, 0xe1
dec eax
rol ebx, 4
dec ecx
bts eax, edi
or al, 0x81
dec eax
xor ebx, 0xd0b0c1aa
dec eax
not ebx
sal dl, 0xa5
dec ebp
lea eax, [edi - 0x62e620c5]
dec eax
rol ebx, 1
dec ecx
inc eax
dec eax
xor ebx, 0x6d88e284
shr al, 0x26
dec esp
sbb ecx, ecx
dec eax
lea ebx, [ebx + ebp*4 + 0x5e6809a8]
add ax, 0x69a8
inc cx
bt eax, 0xa3
dec ebp
btr edx, esp
dec eax
not ebx
dec eax
cwde
dec eax
cwde
dec eax
ror ebx, 3
inc ecx
xor ah, 0x8a
inc sp
btc edi, eax
not ax
dec eax
not ebx
btc di, 0x22
inc ecx
not cl
dec eax
rol eax, 0xc3
dec esp
xor esi, ebx
dec ebp
lea ebx, [ebx + ebp*2 - 0x59644a]
dec edx
mov dword [ebp + ebx - 0x2cb221], ebx
dec eax
shl ebp, 0x30
cwd
inc eax
sbb ch, bh
jle fcn.019363ab
mov edx, 0xa6a3d126
mov eax, dword [ebp]
movsx ecx, dx
mov cl, byte [ebp + 4]
and edx, edx
setl dl
shl eax, cl
lea ecx, [edx*8 + 0x10b83bb8]
or edx, edx
xor dx, 0x2db1
mov dword [ecx + ebp - 0x45d6c3be], eax
lea eax, [ecx + edx*2 - 0xf5928c1]
mov ecx, dword [esi + ecx - 0x45d6c3c4]
push eax
xor ecx, ebx
and word [esp + 2], ax
or dword [esp], edx
dec ecx
ror ax, 0x4e
xchg byte [esp], al
rol ecx, 2
lea eax, [edx - 0x6c55fec5]
sub ax, ax
sar eax, 0x66
sbb ecx, 0xadb7c41d
ror ecx, 2
and dx, ax
cwde
call fcn.0190825b
dec eax
rol ecx, 2
neg ecx
imul ax
btc ax, dx
rol ecx, 1
jmp 0x18e8376
xor ecx, 0x422a5db3
sal edx, 0x2c
xor ebx, ecx
btr eax, 0x25
push edx
add dword [esp + eax - 0x3f088551], eax
adc edi, ecx
cwd
mov ecx, dword [eax + ebp - 0x3f088551]
sal word [esp + eax - 0x3f08854f], 0x8d
sar edx, 0x33
sub byte [esp + eax*2 - 0x7e110a9f], 0xa0
movzx edx, byte [esi + eax*2 - 0x7e110aa7]
btc eax, 0x39
lea eax, [eax + eax*8 + 0x6104073c]
sbb esi, 4
bts eax, 0x39
shr eax, 0x45
xor dl, bl
btr eax, 0x32
xor eax, 0x97231a24
cbw
dec dl
rol dl, 1
sal eax, 0xc8
not eax
neg ax
neg dl
shr al, 0xe6
and al, ah
not dl
and byte [esp + 3], ah
xor bl, dl
lea edx, [esp + edx + 4]
mov dword [edx], ecx
sal dword [esp], 0x59
mov edx, dword [esp]
lea eax, [esp + 0x1c]
adc dl, byte [eax]
sal byte [esp], 0xc1
mov word [ebp + 2], dx
sbb ebp, 0xfffffffe
pop ecx
jmp edi
Function at 0x10519a8
Capabilities:
Encode data using base64

Disassembly:
rol ax, 0xc7
adc dl, 0x2d
add ecx, 0x4403f615
sal byte [esp + 2], 0xc1
btc cx, ax
xor bl, dl
jmp 0xfe3d75
ror eax, 1
neg byte [esp]
not eax
xor ebx, eax
call 0x1965219
neg eax
mov dword [esp], 0x5a284a00
xor dword [esp], 0x670c8687
push 0x9110dc91
xor eax, 0x4c3c1d8a
jmp 0x120420f
inc ecx
push esi
sal ebp, 6
inc ebp
movzx esi, al
inc esp
xor dword [esp + edi*4 - 0xb4a0], edi
dec eax
lea eax, [edi - 0x5a4ff1c4]
dec edx
lea edi, [ebx + edx + 0x3412253b]
inc ecx
pop esi
xor eax, ebp
call fcn.018d5ffd
xor byte [esp + 0xd], 0x1f
jp 0x1021bf4
mov eax, 0xd11caabc
sub esi, 4
rol eax, 0xc4
bswap eax
mov edx, eax
mov edx, dword [esi]
xor edx, ebx
btc eax, 1
mov ecx, eax
lea edx, [edx + ecx - 0xd03a67f]
sbb eax, 0x3007e0a7
ror edx, 1
xor edx, 0x6e1fa834
push eax
neg ax
setle al
sbb edx, 0xc804e1ae
add dword [esp], 0x6a234533
pop eax
xor ebx, edx
add edi, edx
bt ecx, ecx
lea esi, [esi + eax - 0x7c72ea0]
movzx edx, byte [esi + eax*2 - 0xf8e5d3e]
inc ax
xor cx, ax
cwde
xor dl, bl
not dl
cbw
sub dl, 0x98
push ecx
shr dword [esp + eax*2 - 0x1ff40], cl
sbb ecx, 0x7e1d921f
not dl
neg eax
js 0xfdeb25
mov eax, 0xb284b294
dec ecx
mov edx, dword [ebx]
dec eax
bts eax, eax
mov ecx, 0x90af9d1b
mov ebx, 0x602ea234
inc ecx
movzx ebx, byte [ebp + ebx - 0x602ea235]
jae 0x18ebd22
rol bl, 1
neg bl
dec edx
lea edi, [edi + ecx*2 + 0xa314d92]
inc esp
or cl, bh
adc bl, 0xbb
sal ecx, 0x5c
inc esp
xor dh, bl
call fcn.01014d7f
dec bl
jmp 0x12132c0
mov edi, eax
inc esp
movzx ecx, al
inc ecx
xor bl, dh
inc cx
xchg ecx, edi
cwde
rol bl, 1
inc eax
inc bh
jp 0x18e0068
inc ecx
not esp
inc ecx
not edi
inc edi
lea edi, [edi - 0x7fa874f8]
inc ecx
movsx ebp, ah
inc ebp
movzx ecx, ah
jne 0x105d8c5

Function at 0x1056f54
Capabilities:
Authenticate hmac

Disassembly:
dec dword [esp + 4]
test ebx, ebx
jmp 0x19000be
call 0x105d770
Function at 0x1058470
Capabilities:
Encode data using base64

Disassembly:
add edi, eax
call fcn.010143ee
mov ecx, 0x89147388
inc bp
mov ecx, dword [ebx]
mov eax, 0xd414e003
dec esp
lea eax, [ecx*4 - 0x75c399ff]
inc esp
movzx esp, al
inc bx
mov ecx, dword [esp + ebx - 1]
inc sp
xadd eax, eax
dec ecx
shr esp, 0x3c
inc ebp
xchg ah, al
dec edi
lea ebx, [esp + ebx - 1]
inc ebp
movzx edi, ah
inc ecx
mov ebx, eax
dec ebp
bt eax, esp
inc sp
adc ecx, ecx
inc ecx
movzx ebp, sp
inc di
mov dword [ebx - 0xc], ecx
push ebx
inc edx
sub dword [esp - 2], 0x8c238d04
dec esi
lea ecx, [0x46b8393f]
dec edi
lea ebp, [ebp - 7]
inc cx
and eax, eax
dec eax
cdq
inc edi
mov edx, dword [ebp - 6]
inc ecx
ror al, 0xa2
inc ebp
xor edx, esi
dec edx
sub ebp, dword [esp - 3]
inc esp
adc edx, edx
inc ecx
rol edx, 1
dec ecx
rol esp, 0xb0
inc esi
sbb byte [esp + edi - 3], cl
inc ecx
not edx
jne 0x195e0d9
dec edx
ror dword [esp + eax - 0x4c3f4fb5], 0xb0
inc ebp
adc esp, edi
inc ecx
ror esp, 3
dec edx
neg dword [esp + edx + 0x64c6b4b6]
inc ecx
xchg al, ch
inc ebp
add edi, eax
dec esi
mov dword [esp + eax - 0x4c3f4f01], esi
inc esi
xor dword [esp + eax - 0x4c3f4f01], esp
inc ecx
push ecx
dec esi
mov esi, dword [esp + eax - 0x4c3f4ef9]
inc edx
sub byte [esp + ecx - 0x4c3f4fb0], ch
dec ebp
arpl sp, sp
pop edi
inc ecx
rol dl, 0x44
dec ecx
adc esi, esp
dec esi
lea esp, [edi + edx*2 + 0x46029bb7]
dec ecx
shl edi, 0x4b
pop edx
jns fcn.019363ab
inc ebp
xor esp, esp
mov edi, 0x98825c9f
inc ecx
dec edx
inc edx
imul byte [esp + 1]
dec esi
mov dword [esp], esi
dec eax
sar edx, 0xab
inc esi
xor dword [esp], edx
inc ecx
push ecx
bt ebp, 0x1a
dec esi
mov esi, dword [esp + 8]
dec ebp
arpl dx, dx
dec ecx
adc esi, edx
dec edx
mov dword [esp], esi
ret 8

Function at 0x105f8f0
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [ebp + eax*2]
push eax
sbb dword [esp + eax*2 + 0xb], eax
shl edx, cl
mov dword [eax + ebp - 2], edx
lea ebp, [ebp + eax*2 - 2]
call fcn.01062ce9
dec ebx
dec eax
adc byte [edi + 0x214c7fe7], al
sub al, 0x83
xchg esp, eax
lodsd eax, dword [esi]
adc dword [ebx - 0x77da3670], edx
cmc

Function at 0x1065e99
Capabilities:
Encode data using base64

Disassembly:
pop ecx
dec al
movsx ecx, dl
btc ecx, ecx
neg al
add al, cl
not edx
rol edx, cl
xor al, dl
jmp 0xfa230f
Function at 0x106bc55
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov eax, dword [ecx + ebp - 0x29680200]
shr ecx, 0xeb
or edx, edx
mov ecx, dword [edx + ebp - 0x48ed2fb4]
rol dl, 0x86
mov dword [esp + edx - 0x48ed2f2e], edx
mov dword [esp + edx - 0x48ed2f2a], ebx
btc edx, edx
cpuid
sbb ebp, 8
mov dword [ebp + 0xc], eax
sar word [esp + 1], 0xd
mov dword [ebp + 8], ebx
mov eax, dword [esp]
mov ebx, eax
mov dword [ebp + ebx - 0x48ffff2a], ecx
mov ecx, 0xd4a2c907
pop ecx
mov dword [ebx + ebp - 0x48ffff2e], edx
jae 0x19043cf
pop edi
inc ecx
movzx edx, ch
inc ecx
movsx ecx, dl
dec eax
ror eax, cl
inc ecx
pop esi
inc esp
mov ebx, ebx
dec ecx
dec ebp
sal edx, 0xed
pop ebx
and ecx, eax
dec esp
imul ebp, edx
cdq
inc ecx
pop ebp
inc esp
bt ecx, edx
inc esp
movzx edi, dl
dec ebp
lea esp, [edi + ecx*4 - 0x76e4cdc8]
pop ecx
jae 0x190639e
adc eax, esp
bts cx, cx
mov byte [eax + ecx - 1], dl
mov edx, dword [esi + ecx*4 - 9]
bt ecx, ecx
movsx eax, cx
adc al, ch
lea esi, [esi + ecx - 6]
lea ecx, [ecx*2 + 0x796b99e]
xor edx, ebx
neg edx
bswap eax
bswap edx
dec eax
sub eax, 0xff05751d
not edx
add cx, 0xab6
rol edx, 1
push eax
shl dword [esp + ecx*4 - 0x1e5b1158], cl
dec edx
ror eax, cl
jae 0x120abb4
push eax
ror edx, 3
pop ecx
xor ebx, edx
dec eax
bswap eax
add edi, edx
lea ecx, [eax + ecx*4 + 0x41302626]
lea ecx, [ebp + eax*4 - 0x1a20afa6]
movsx edx, ax
xor eax, dword [esp + eax - 0x6882bea]
mov dword [ebp + edx - 0x2bec], ecx
add dl, 0x87
shr byte [esp + edx*2 - 0x56e1], 0xe2
rol dx, 0x2a
lea ebp, [ebp + edx*2 - 0x1895c]
rol word [esp + edx*2 - 0x18959], 0x2b
sar dword [esp + edx - 0xc4ad], 0xe3
pop eax
jne fcn.0121e846
dec eax
bt ecx, 0x18
dec ebp
arpl ax, ax
inc esp
or cl, dl
sbb edx, eax
not edx
dec ecx
add esi, eax
dec ecx
sar ecx, 0x32
inc cx
sar edx, 0x6a
dec eax
adc edi, ecx
jno fcn.019363ab
mov ebp, 0x59bd2cb3
movsx ecx, bp
dec ebp
mov eax, dword [ebx + ecx*2 - 0x5966]
dec esi
mov edi, dword [ebp + ebx - 0x59bd2cab]
dec esi
lea ebx, [ebp + ebx - 0x59bd2cab]
inc esp
movzx edx, cx
movsx eax, cx
dec eax
lea edi, [ebp*4 - 0x214e7a78]
dec ebp
or eax, edi
dec ecx
not eax
inc esp
mov edi, eax
inc esp
movsx esp, ch
dec ebp
mov dword [ebx + ecx - 0x2cb3], eax
dec ebp
lea ebp, [ebp + ecx*2 - 0x596a]
not bp
mov ebx, ecx
inc ebp
mov ecx, dword [ebp + ebp - 0x59bdd34c]
push ebp
inc ebp
xor ecx, esi
dec eax
cdq
inc dword [esp + ebp - 0x59bdd34c]
add byte [esp + ecx - 0x2cb0], bl
inc ecx
not ecx
inc eax
and byte [esp + ecx - 0x2caf], bh
rol ecx, cl
inc ecx
rol ecx, cl
mul ecx
inc bp
imul edi, esp
inc ecx
xor ecx, 0x359ec197
jmp 0x105229d
add eax, ecx
dec eax
inc ebp
movzx eax, bh
call fcn.0191809a

Function at 0x106cf40
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop esp
jns fcn.019363ab
mov ecx, 0x4a9b3f85
mov edx, dword [ecx + ebp - 0x4a9b3f85]
sar cl, cl
mov eax, ecx
lea ebp, [ebp + ecx - 0x4a9b3ff8]
push edx
lea edx, [ecx*2 - 0x3877a4cc]
add dl, 0x3f
popfd
lea esi, [ecx + esi - 0x4a9b4000]
cdq
add edx, dword [ecx + esi - 0x4a9b3ffc]
sub ax, ax
xor edx, ebx
btc eax, eax
cbw
call fcn.018de22d
Function at 0x106f346
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
neg al
call fcn.019347fe
mov ecx, 0x14a7e6a5
bts ecx, 0xb3
sbb cl, 0x9e
lea esi, [esi + ecx*4 - 0x52bf9820]
mov ecx, dword [ecx + esi - 0x14afe607]
call fcn.012311e0

Function at 0x106f4b5
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx - 0x55b2731b], 0x7091d3b4
movzx eax, byte [esi + edx - 0x55b2731b]
bts ecx, edx
lea ecx, [edx - 0x7beeb153]
setb byte [esp + edx - 0x55b2731b]
xor al, bl
bt ecx, 0x37
sbb dx, word [esp + edx - 0x55b2731b]
inc dx
neg al
pop ecx
lea edx, [edx - 0x126770db]
shr cx, 0x85
ror al, 1
sub al, 0x90
xchg ecx, edx
xadd edx, ecx
not al
bts ecx, 0xa9
sub ecx, edx

Function at 0x106f5a6
Capabilities:
Encode data using base64

Disassembly:
sal edx, 0x6d
inc ecx
rol ecx, 3
sub eax, edx
neg eax
xor ebx, ecx
add edi, ecx
mov ecx, 0x551dc921
sar cx, 0xee
cwde
fcomp qword [edx + ebp - 0x5a064000]
jmp edi
push edx
mov edx, 0x550de89a
mov edx, dword [esp + edx - 0x550de89a]
mov dword [esp], 0x2283dd60
call fcn.00fd86b2
and ebp, edx
dec esi
sti
shl dword [edi + 0x31], 1
xlatb
push esp
sti
test eax, 0x54d7357b
sti
in eax, dx
pop edi
cmp edi, edx
push esp
sti
mov eax, dword [0x54d72127]
sti
leave
invalid
mov word [ebp + eax*8 - 0x148], dx
cwde
pop eax
pop eax
pop eax
jne fcn.0121e846
adc al, dl
ror cx, 0xc4
sar ecx, 0x2d
mov edx, ecx
mov word [ebp + ecx*2 - 0x206a6], ax
shl ecx, 0xd2
mov eax, edx
jmp edi
sal byte [esp + 7], 0x86
not edx
jb 0x195113b
shr byte [esp + 0xd], 0xe3
inc byte [esp + 0xf]
xor ebx, edx
sar dword [esp + 6], 0xbd
and dword [esp + 6], 0xdd01d5b2
adc dword [esp + 0xc], 0x72b4f7bb
adc edi, edx
jmp 0x18d7e69
lea ebp, [eax + ebp - 0x2b]
jns 0x10096f7
lea esp, [esp + 0x10]
jmp 0xfab8f7
mov dword [esp + edx*2 - 0x7c41060], 0x1f3e0316
not eax
lea ecx, [esp + ecx + 0xc]
adc dword [esp + edx - 0x3e20828], 0xe0225a93
neg word [esp + edx*8 - 0x1f10417d]
lea edx, [eax*8 + 0x593f49a]
mov dx, word [edx + ecx - 0x40d3f48a]
shr eax, 0xda
jae 0xf9e07f
jbe 0x122afd6
Function at 0x11f458d
Capabilities:
Authenticate hmac

Disassembly:
add al, byte [esp + ecx - 0x1ffe]
bswap edx
xor ebx, edx
add al, cl
adc edi, edx
movsx edx, byte [esp + ecx*4 - 0x8004]
xor ax, 0xc0b3
inc byte [esp + ecx*2 - 0x4001]
mov dl, byte [esi + ecx*8 - 0x1000d]
btc ecx, eax
lea esi, [esi + ecx*2 - 0x4087]
sar cx, cl
lea ecx, [eax + eax*8 - 0x39e29e66]
call fcn.0197750f
inc esp
movzx ecx, bp
inc eax
inc edx
and byte [esp + edx - 0x9477], bh
dec edi
lea esp, [edx + edi*4 - 0x1944815b]
dec ecx
neg eax
xor eax, 0xad1365a1
inc eax
movzx ecx, ch
lea eax, [eax + edx - 0x76cddf8]
inc ecx
dec eax
dec esi
mov dword [esp + edx - 0x9472], esi
inc edx
xor dword [esp + edx - 0x9472], eax
ror dword [esp + ebx - 0x67ffffed], 0xea
inc cx
btc edx, 0xbf
setae bl
dec esi
mov esi, dword [esp + edx - 0x1472]
jb 0x1217bb8
jmp 0x1964d6a
sub dx, 0x6e10
dec esi
mov dword [esp + edx - 0x1482], ecx
dec eax
adc esi, eax
rol bl, 3
dec edx
mov dword [esp + edx - 0x148a], ebx
dec edx
mov dword [esp + edx*2 - 0x2914], esi
ret 0x18
dec eax
arpl ax, ax
jb 0x1203e26
inc ecx
mov edx, 0x4b0fe01a
dec edi
lea ebp, [ebp + edx - 0x4b0fe01e]
inc ecx
mov ebp, edx
inc edx
mov ecx, dword [ebp + ebp - 0x4b0fe01a]
inc ebp
mov esp, edx
inc ecx
xor ecx, esi
inc esp
mov ecx, ebp
rol ecx, 1
neg ecx
inc ecx
mov edi, ecx
dec ebp
lea edi, [esp + edi*2 + 0x79949337]
dec ecx
btc edi, edi
xor ecx, 0xd8249222
inc cx
dec edx
inc ecx
shr cl, 6
neg ecx
inc eax
and bh, 0x3a
sbb ecx, 0x92b68235
inc ecx
mov eax, 0x843e8f37
inc ecx
push esi
inc edx
xor dword [esp - 0x4b0fe01a], ecx
inc bp
btr edx, edx
dec ebp
imul edx, ecx
inc ebp
btr edi, edi
inc ecx
pop esi
dec eax
arpl cx, cx
inc bp
imul eax, edi
dec eax
neg ebp
dec eax
add esi, ecx
inc bp
btc ecx, ecx
dec ecx
mov ecx, dword [ebx + ebp + 0x4b0fe01a]
inc sp
mov esp, dword [ecx + ebp + 0x4b0fe01a]
inc bp
btc edx, edi
inc ecx
btr edx, 0xaa
ror edi, 0xa3
dec ebp
lea ebx, [ebx + ebp + 0x4b0fe020]
inc cx
and eax, 0xd7f7a894
inc di
mov dword [ebx + edx - 0x588ce020], esp
dec eax
ror ebp, 0x84
mov edx, ebp
jmp esi
mov edx, 0xd3963914
mov eax, ebp
movsx ecx, dl
push ecx
mov word [ecx + ebp - 0x16], ax
movsx eax, word [esp + ecx*8 - 0xa0]
or byte [esp + ecx*2 - 0x26], 0xaa
bts dx, cx
mov edx, dword [esi + ecx*2 - 0x2c]
xor edx, ebx
bswap edx
shr ax, 0xa1
sbb eax, 0xf23ddf97
neg edx
inc edx
xadd cx, ax
setno cl
xor edx, 0xd52eeb1b
jmp 0x1034e76
Function at 0x11fae70
Capabilities:
Encode data using base64

Disassembly:
inc edx
mov ebp, dword [edi + ebp - 0x42bb]
inc ecx
sal bh, 0x63
call fcn.0101bfba
invalid
scasd eax, dword es:[edi]
ror byte [edi], cl
scasd eax, dword es:[edi]
rcl al, cl
sal byte [eax], 0xc0
out 0xd0, eax
sar dh, 0xca
or dx, 0x3a2b
shr edx, 0x13
inc al
xor word [esp + edx - 0xac1], dx
ror edx, 0xef
push edx
neg al
and dl, dl
call fcn.0120857d
pop edi
push esp
pop ss
xchg ebp, eax
call 0x144dfaa5
mov esi, 0xf410a288
inc bp
movzx esp, byte [ebx]
mov eax, 0x9118dd0a
movzx edi, ax
dec eax
or bl, ch
sbb byte [ecx + 0x48f8b70f], dl
cwde
inc esi
mov dl, byte [eax + ebx + 0x6ee722f8]
movsx ecx, ax
inc ebp
and ah, dl
jmp 0x12294f3
imul ebp, dword [edx - 0x17b4ff91], 0x5b
cmp eax, 0x94e3ffe4
dec ebx
call fcn.0103ebd1
jecxz 0x11fae0c
pop esp
pop esi
add edx, dword [ebp + 0x5e4696d3]
sub esi, dword [ebp + 0x5e4696cb]
mov ch, 0xcb
xchg esi, eax
inc esi
pop esi
push ebx
cdq
out dx, eax
xchg esi, eax
inc esi
pop esi
ja 0x11fae4f
out 0x96, eax
inc esi
pop esi
jg 0x11fae81
movsb byte es:[edi], byte [esi]
adc esp, ebp
fdivr qword [edi]
jo 0x11fae6c
and al, 0xb0
pop ecx
ljmp 0xc49f
inc ecx
mov ecx, 0x79a7de87
inc ecx
not ah
movzx ebx, cx
ror di, cl
movzx edx, di
inc si
mov dword [eax + ebx + 0x6ee722f8], esp
shr dx, 8
inc ecx
mov eax, 0x983417a2
dec edx
mov eax, dword [eax + ebx + 0x6ee722f8]
inc sp
adc ecx, ebx
inc edx
mov cl, byte [edi + ebx - 0x42ad]
jl 0x1232974
ror byte [esp], cl
inc ecx
xor bh, 0x3f
dec esp
mov dword [esp], esi
inc ecx
btr edx, ecx
dec cx
movsx edi, cl
inc esp
xor dword [esp], ecx
inc esp
movsx eax, cl
inc ecx
pop esi
inc esp
mov esp, edx
inc ebp
btr eax, edi
dec eax
shl ebp, cl
dec ebp
arpl cx, cx
dec ecx
ror edi, cl
dec edx
lea ebx, [0xadb6b6a8]
sar dx, 0x22
inc sp
bt ebx, eax
dec eax
sal eax, cl
dec ecx
mov dword [ebx + edi*2 - 0x856a], eax
dec esp
lea edi, [ebx - 0x274f05d3]
inc cx
sal edi, 0x24
inc ecx
mov eax, eax
dec esi
lea ebx, [edi + ebx - 0x42b3]
inc esp
xadd edx, ecx
jae 0x105d977

Function at 0x11fd4e6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
pop edx
bt ax, 0x21
add edi, ecx
and word [esp + eax - 0x44b131e6], ax
imul dword [esp + eax - 0x44b131e7]
adc eax, eax
mov dx, word [ebp + eax - 0x422822bb]
mov ax, word [ebp + eax - 0x422822b9]
mov ecx, 0x3ca19c37
not ecx
mov cl, byte [ebp + 4]
jle 0x19782c8
adc ebp, 3
shrd dx, ax, cl
mov word [ebp], dx
pop ecx
jmp edi
Function at 0x11feb7d
Capabilities:
Encode data using base64

Disassembly:
cdq
inc ecx
sub bl, al
dec edi
lea ebp, [ebp + eax - 4]
inc edx
mov ebp, dword [edi + ebp - 0x80000000]
inc ecx
xor ebp, esi
inc esp
movzx edi, dl
dec ebp
dec ecx
btc esp, edi
neg ebp
dec esp
mov dword [esp + edi - 0x80000000], edi
mul ebx
xor ebp, 0x81e7821
inc dx
xor dword [esp + eax + 5], ebx
inc ecx
pop eax
dec ebp
push ebx
rol ebp, 1
dec eax
div dword [esp + edx*8 - 0x7320f468]
inc ebp
inc esp
add dword [esp + edx - 0x157cabda], eax
rol ebp, 1
dec esp
mov dword [esp + edi - 0x80000000], esi
xor dword [esp + edx - 0x157cabda], ebp
push eax
dec esp
mov esi, dword [esp + edi - 0x7ffffff8]
inc ecx
pop esp
dec eax
mov dword [esp + edx*2 - 0x2af957b4], eax
dec eax
arpl bp, bp
shl al, 0x63
inc esp
movsx edx, bh
dec eax
add esi, ebp
inc sp
add edi, dword [esp + edi - 0x7ffffffb]
pop ecx
jae fcn.019363ab
mov eax, 0x692e67a7
mov ecx, dword [ebp + eax - 0x692e67a7]
mov edx, dword ss:[ecx + eax - 0x692e67a7]
neg eax
sar al, 0x47
mov dword [ebp], edx
mov ecx, dword [esi - 4]
adc eax, eax
dec al
movzx edx, ax
lea esi, [esi + edx*4 - 0xc004]
xor ecx, ebx
shl dl, 0x27
loop 0x11fec68
mul eax
jae 0x197948c
lea ecx, [eax + ecx + 0x533024bc]
rol dl, 0x24
bswap ecx
ror al, 0x41
xor ecx, 0x9aab580b
xadd eax, edx
or eax, 0x8e31d09d
bts eax, 0xd
rol ecx, 1
inc eax
rol dx, 6
lea eax, [edx*8 + 0x21cf8b]
dec ecx
neg ecx
xor ebx, ecx
cdq
add edi, ecx
shr edx, 0xa6
movzx ecx, ax
adc edx, dword [ebp + edx]
sal ecx, 0x78
jb 0x196669d
xor cx, word [eax + edx - 0x4821cf8b]
movsx edx, al
mov word [ebp + eax - 0x4821cf89], cx
sub ax, 0xb38
not edx
lea ebp, [eax + ebp - 0x4821c451]
add ax, dx
jmp edi
sub dword [esp + ecx - 0x6023980a], 0xfa8c3487
mov eax, edx
mov dword [esp + ecx - 0x6023980a], edi
ret
Function at 0x11fed78
Capabilities:
Encode data using base64

Disassembly:
inc ebp
xor al, dh
inc ecx
ror al, 1
inc ecx
xor al, 0xa4
mov ebp, 0x411b6930
dec eax
mov dword [esp + ebp - 0x411b6930], 0xcf870c9d
inc ecx
ror al, 1
neg word [esp + ebp - 0x411b692e]
inc esp
and cl, bl
inc ecx
adc al, 0x9f
dec eax
imul ebx
pop eax
cbw
inc ecx
ror al, 1
imul edx
jb 0x191eee4
inc edx
xor ebx, edx
add edi, edx
bt eax, 0x2c
push eax
shl ax, 0x62
mov dx, word [ebp + eax - 0x749e]
lea ebp, [eax + ebp - 0x749c]
sar eax, 0xf4
neg cx
not byte [esp + eax + 1]
movzx ecx, byte [esi + eax - 5]
inc ax
lea eax, [eax*8 + 0x5998eca5]
lea eax, [eax + 0x2a38010f]
adc esi, 0xfffffffa
pop eax
xchg dword [esp + eax - 0x2228], eax
xor cl, bl
neg cl
inc eax
xor cl, 0x98
rol cl, 1
shr dword [esp + eax - 0x1ba5001], 0x48
adc cl, 0xb9
dec ax
and eax, eax
not cl
cwde
sar ax, 0x2b
xor bl, cl
inc ax
jo 0xfd8709
lea ecx, [esp + ecx + 4]
not dword [esp + eax*8 - 0x58]
and eax, dword [esp + eax - 0xb]
mov word [ecx + eax - 9], dx
movzx edx, al
mov dword [esp + eax*8 - 0x48], edi
ret
push edi
inc cx
mov dword [ebx + edi - 0xd9], ebp
dec eax
add ecx, eax
pop ecx
inc ecx
inc ah
dec edi
lea ebp, [ebp + edx - 0x7d3e63ab]
inc ebp
movsx edi, cx
inc ecx
rol ah, 0xe5
dec ebp
add ecx, edi
inc ebx
mov eax, dword [edx + ebp - 0x7d3e63a7]
inc ecx
dec dl
inc ecx
xor eax, esi
push ecx
inc ecx
push esp
inc eax
inc ecx
sub edx, esp
inc ebp
bts eax, esp
inc edx
shl byte [esp + edx - 0x7d3e6398], 0xc3
neg eax
inc ecx
sal ecx, 0xf1
bswap eax
inc si
mov dword [esp + edx - 0x7d3e6398], edx
dec eax
lea ecx, [edx + edi - 0x4f68094a]
sbb eax, 0xec34c489
ror eax, 2
inc cx
neg ecx
inc edx
lea eax, [eax + edx*2 - 0x50f8531e]
jl 0x196ad0e
xor eax, 0x721afa96
inc ecx
movzx ebp, ax
inc ecx
not edx
dec esp
mov dword [esp + edi*2 - 0x1aa], esi
dec ecx
dec esp
dec esi
xchg dword [esp + ecx - 0x76400000], edi
push ebp
inc edx
xor dword [esp + ecx - 0x763ffff0], eax
dec esi
mov esi, dword [esp + ecx - 0x763ffff0]
inc ecx
sub ch, al
inc ecx
add dl, dl
dec eax
arpl ax, ax
inc ecx
push esp
dec ecx
add ecx, edi
setle byte [esp + edi*2 - 0x1ae]
dec eax
adc esi, eax
pop ebp
pop edx
inc ecx
setb ah
inc ebp
xor dh, al
bt ebp, edx
jb 0x123613d
inc ecx
inc edi
dec esp
adc eax, esp
inc cx
rol ecx, cl
mul dl
inc ecx
sub ebp, esp
inc ecx
mov ebx, dword [eax + edx*2 - 0x82]
rol ecx, cl
dec ebp
lea ebx, [ebx + edx*2 - 0x86]
inc ecx
div bh
inc ecx
mov dword [ebx + edx - 0x41], ebx
dec edx
lea eax, [0xcc1f0215]
jmp fcn.019363ab
inc esp
movzx ecx, ch
inc ecx
rol edi, 1
inc ecx
movsx ecx, cl
dec esp
mov dword [esp + edi - 0x95], esi
inc ecx
pop eax
dec eax
shl ecx, 0x9b
inc esp
xor dword [esp + edx*4], edi
not edi
inc ecx
mov eax, edx
inc ecx
pop esi
sar dl, 0x85
inc cx
btc ecx, 0x24
dec ebp
arpl di, di
dec ecx
add esi, edi
inc ecx
xchg dl, ch
dec ecx
sal ecx, 0xef
dec ebp
lea ebp, [ebp + edx - 8]
dec ebp
mov eax, dword [ebp + edx*4]
dec ebp
xor eax, esi
xor eax, edx
inc esp
movsx edi, ch
dec ecx
not eax
cwd
rol edi, 0x7a
sub di, 0x4d87
dec ecx
neg eax
dec ebp
lea edx, [ecx + 0x60323a8a]