joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb18c80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xb18ca3
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
mov dl, byte [esi]
mov al, 0xe
call fcn.00b18ba0
push eax
mov ebp, ebx
and ebp, 0xff
mov eax, ebp
inc eax
and eax, 3
mov dl, byte [esp + eax + 8]
mov al, 0xb
call fcn.00b18ba0
pop edx
xor dl, al
push edx
mov eax, ebp
add eax, 2
and eax, 3
mov dl, byte [esp + eax + 8]
mov al, 0xd
call fcn.00b18ba0
pop edx
xor dl, al
push edx
add ebp, 3
and ebp, 3
mov dl, byte [esp + ebp + 8]
mov al, 9
call fcn.00b18ba0
pop edx
xor dl, al
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xb18cbb
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0xb18c99
lea eax, [esp + 4]
mov edx, 4
call fcn.00b177a4
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb18d54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
lea ebp, [esp + 0x10]
mov byte [esp + 0xc], 0
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0x14], eax
xor eax, eax
mov al, byte [esp + 0xc]
add eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov esi, eax
mov eax, esi
mov dword [ebp], eax
mov edx, edi
mov eax, ebx
call fcn.00b18d40
mov edx, dword [ebp]
xor byte [edx], al
inc ebx
add esi, 4
cmp bl, 4
jne 0xb18d92
inc byte [esp + 0xc]
inc dword [esp + 0x14]
cmp byte [esp + 0xc], 4
jne 0xb18d79
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb19f30
Capabilities:
Encode data using xor

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, ecx
dec eax
test eax, eax
jl 0xb19f57
inc eax
mov edx, dword [esp + 4]
mov dl, byte [edx]
mov ecx, dword [esp]
xor byte [ecx], dl
inc dword [esp]
inc dword [esp + 4]
dec eax
jne 0xb19f42
pop ecx
pop edx
ret
Function at 0xb1a164
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a16d
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12f0c
test esi, esi
jl 0xb1a1f6
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12f0c
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12f0c
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov byte [ebp + ebx - 0x200d], al
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a1a2
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b177a4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb1a20c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a215
mov eax, dword [ebp - 4]
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x2014]
mov eax, dword [ebp + 0xc]
mov ecx, esi
call fcn.00a12f0c
cmp dword [ebp - 0x14], 0
jl 0xb1a2ad
lea edx, [ebp - 0x1014]
lea eax, [ebp - 0x2014]
mov ecx, esi
call fcn.00a12f0c
lea edx, [ebp - 0x1014]
mov ecx, esi
mov eax, dword [ebp - 0xc]
call dword [ebp + 0x14]
mov ecx, esi
dec ecx
lea edx, [ebp - 0x2014]
lea eax, [ebp - 0x2013]
call fcn.00a12f0c
mov eax, dword [ebp - 0x10]
mov bl, byte [eax]
mov byte [ebp + esi - 0x2015], bl
xor bl, byte [ebp - 0x1014]
mov eax, dword [ebp - 0x10]
mov byte [eax], bl
dec dword [ebp - 0x14]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x14], 0
jge 0xb1a255
lea eax, [ebp - 0x1014]
mov edx, esi
call fcn.00b177a4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb1a2c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a2cd
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12f0c
test esi, esi
jl 0xb1a357
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12f0c
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12f0c
mov al, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a302
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b177a4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb1a36c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a375
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12f0c
test esi, esi
jl 0xb1a3ff
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12f0c
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12f0c
mov al, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a3aa
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b177a4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb3a4d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb3a4d9
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb3a9a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
lea eax, [ebp - 0x18]
call fcn.00a14dc8
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb090e8]
call fcn.00b0b060
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0xb3a973
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0b14c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb3a4cc
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb3a4b0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb3a4b4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
mov dl, byte [0xb3a9b4]
call fcn.00b0a520
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00aeccb4
test al, al
je 0xb3a5b0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0a9b8
jmp 0xb3a5be
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0aa38
mov eax, dword [ebp - 4]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b0aab8
xor eax, eax
push ebp
push 0xb3a625
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0a978
jmp 0xb3a60d
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0xb74238]
mov eax, dword [eax]
call fcn.00a779e8
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb3a61b
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb3a5ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb3a62f
push ebx
pushfd
mov ebx, 0x2d36dc0b
shr ebx, 0x37
neg ebx
neg bl
mov ebx, dword [esp + 4]
mov dword [esp + 4], 0x57b228b3
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.0178340b
add ebx, dword [eax - 0x52]
in al, 0xfa
pop ebx
fldcw word [ecx + 0x16cda7c3]
lar eax, word [ebx - 0x7c]
call 0x3d5c6b
or eax, 0x7c343580
pop ss
dec eax
dec ecx
mov ebx, 0x9b392ec3
or byte [eax - 0x73], dh
lodsb al, byte [esi]
mov dword [0xbdcd98e5], eax
scasb al, byte es:[edi]
add esi, dword [eax]
push ss
dec eax
invalid
Function at 0xb4dbb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0x40
call fcn.00b4d3ec
test al, al
jne 0xb4dbec
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb0
mov dword [esi], 1
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5a4d
je 0xb4dc0e
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb0
mov dword [esi], 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, 0xf8
cdq
push edx
push eax
call fcn.00b4d3ec
test al, al
jne 0xb4dc3d
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb0
mov dword [esi], 3
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
je 0xb4dc77
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb0
mov dword [esi], 4
mov eax, dword [ebp - 0x10]
cmp word [eax + 4], 0x14c
je 0xb4dc97
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb0
mov dword [esi], 5
mov eax, dword [ebp - 0x10]
test byte [eax + 0x38], 1
je 0xb4dcb5
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb0
mov dword [esi], 6
xor eax, eax
push ebp
push 0xb4df9b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.01844211
outsd dx, dword [esi]
add edx, dword [ecx + 0x5c452dfc]
not dword [eax + 0x6fb651bc]
add ebx, dword [eax - 0x436ee966]
or al, 0xfc
cmpsd dword [esi], dword es:[edi]
bound esp, qword [esp + edi*4 - 0x7c9ab45d]
retf
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0xb5ea44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0xb5ea4c
push ecx
push ebx
push esi
mov eax, 0xb5e3ec
call fcn.00a17398
mov esi, dword [0xb74238]
xor eax, eax
push ebp
push 0xb5ec1e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00a130b0
cmp eax, 2
jne 0xb5eadd
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00a13118
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00a19db0
call fcn.00aef5c4
mov ebx, 0x64
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.00a13118
mov eax, dword [ebp - 0x18]
call fcn.00a15298
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00a13118
mov eax, dword [ebp - 0x1c]
call fcn.00a1a268
test al, al
je 0xb5eadd
push 0xa
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0xb5ea9f
mov al, byte [0xb5ec2c]
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00a13118
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0xb5ec38
call fcn.00a1f390
mov eax, dword [ebp - 0x20]
call fcn.00a15298
push eax
push 0
push 0
call fcn.00a17700
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0xb5eb54
push 0x40
push 0xb5ec3c
lea edx, [ebp - 0x2c]
mov eax, dword [0xb7431c]
call fcn.00a170c8
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00ad11d8
mov eax, dword [ebp - 0x28]
call fcn.00a15298
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0xb5ec03
mov dl, 1
mov eax, dword [0xa29c84]
call fcn.00a13f2c
mov edx, dword [0xb74230]
mov dword [edx], eax
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00aec17c
test al, al
jne 0xb5eb86
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00a13f5c
jmp 0xb5ec03
mov eax, dword [esi]
call fcn.00a77b0c
lea edx, [ebp - 0x34]
mov eax, dword [esi]
call fcn.00a78264
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00a1a6bc
mov eax, dword [ebp - 0x30]
call fcn.00a1aa10
mov ecx, dword [0xb74070]
mov eax, dword [esi]
mov edx, dword [0xb50284]
call fcn.00a77b24
mov ecx, dword [0xb743f4]
mov eax, dword [esi]
mov edx, dword [0xb5d2e8]
call fcn.00a77b24
mov ecx, dword [0xb74108]
mov eax, dword [esi]
mov edx, dword [0xb5c4ec]
call fcn.00a77b24
mov ecx, dword [0xb742d4]
mov eax, dword [esi]
mov edx, dword [0xb5b54c]
call fcn.00a77b24
mov eax, dword [esi]
call fcn.00a77ba4
push ebx
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb5ec25
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00a14dec
ret

Function at 0x1779e67
Capabilities:
Encode data using base64

Disassembly:
add edi, 4
shld dx, ax, cl
mov dword [esp], 0x4e8d592b
call fcn.017a6911

Function at 0x1779e7d
Capabilities:
Encode data using base64

Disassembly:
call fcn.01785525
rol eax, 1
dec eax
bswap eax
push 0xdd299c1b
inc eax
neg eax
xor ebx, eax
sar dword [esp + 6], 0xc2
mov edx, 0xdcaa2984
xor dword [esp + 3], 0x55a5553d
adc ebp, eax
shr dl, 0x27
jns 0x181e787
mov ecx, dword [esi]
movsx eax, byte [esp + 2]
lea esi, [eax + esi - 0x25]
add edx, dword [esp + eax - 0x21]
sal dl, 0xe3
mov al, byte [edi + edx - 0x61672d10]
call fcn.017d6234
Function at 0x178a7dc
Capabilities:
Encode data using base64

Disassembly:
neg al
xor al, 0xaa
neg cl
mov dword [esp + edx - 0x6f0cffa0], 0x162e1396
xor bl, al
shr ecx, 0xf8
adc dword [esp + ecx*4 - 0x238], 0xbd8b7727
lea ebp, [ebp + ecx - 0x92]
add ecx, 0xb983173b
mov dword [esp + edx - 0x6f0cff98], edx
shl word [esp + edx - 0x6f0cff9c], 0xd
mov word [ebp + edx - 0x6f0cffa0], ax
pop ecx
inc edx
pop ecx
pop eax
jg fcn.01843c11

Function at 0x1794e42
Capabilities:
Encode data using base64

Disassembly:
bswap edx
push eax
not edx
ror cx, cl
rol cl, 4
bswap ecx
ror edx, 2
lea edx, [edx + eax*2 - 0x1c2a37a7]
neg cx
or cx, ax
xadd byte [esp + eax*8], ch
xor edx, 0x9382bb32
not ecx
not edx
bswap eax
mov dword [esp + eax + 4], eax
rol edx, 3
xor ebx, edx
shl dword [esp + eax + 1], cl
sub cx, ax
adc esi, edx
shl ecx, cl
movzx ecx, byte [edi + ecx - 0x80000000]
movzx edx, word [esp + eax*4 + 4]
jp 0x1811ee6

Function at 0x1794e96
Capabilities:
Encode data using base64

Disassembly:
mov edx, eax
shr ecx, 0x59
mov ecx, ebp
call fcn.017c3186
call fcn.01856ff3
mov byte [ecx], dl
mov ecx, 0x92eb10a
lea eax, [ecx + 0x738aab0e]
lea ebp, [ebp + ecx*4 - 0x24bac42c]
movsx edx, cx
sal cl, 1
mov ecx, dword [ebp + ecx - 0x92eb114]
neg eax
inc eax
jb 0x17d2148
xor ecx, ebx
lea ecx, [ecx + eax*2 - 0x73e7b0b0]
ror dx, 0x8f
not ecx
sar edx, 0x2b
push edx
neg ecx
call fcn.017a4b80
lea ecx, [eax*2 + 0x7619e081]
push ecx
mov dword [esp + ecx - 0x4931b1eb], esi
ret 4

Function at 0x17a04d6
Capabilities:
Encode data using base64

Disassembly:
shl esi, 3
stc
or eax, esi
adc esi, 0x47b115aa
mov esi, eax
cmc
sub eax, eax
mov dword [esp + 8], eax
test ecx, 0xe29ae19b
cmp dword [esp + 8], 0x20
jmp 0x18224ed
shr eax, 8
xor eax, esi
stc
and eax, 0xff00ff
cmc
clc
xor esi, eax
clc
jmp 0x184fcac
lea ecx, [esp + ecx + 0x18]
mov dword [esp + 0x12], 0x96b316ab
call fcn.0184e4ca
cmp bh, al
clc
shl eax, 4
test esi, 0xda17208a
xor esi, eax
cmp bp, 0xc5a9
neg eax
shl al, 0x89
mov eax, ecx
cmp ebp, 0xb1268b05
shr eax, 0x10
clc
jmp 0x17e9f81
lea eax, [eax + eax]
clc
test ebp, ebp
xor esi, eax
sar al, cl
test ebx, esp
rcr eax, 0xa1
mov eax, ecx
shr eax, 0x1d
test bx, si
stc
shl ecx, 3
or eax, ecx
sal cx, 0x89
stc
mov ecx, eax
sar eax, cl
cmp ebx, 0x8ebe390e
mov eax, esi
cmp ebx, 0xed22b58f
test ebx, 0x28a1d99b
shr eax, 0x1d
jmp 0x17801b0
xor eax, ecx
cmc
and eax, 0x55555555
test sp, di
xor ecx, eax
jmp 0x17c1211
xor eax, esi
cmp ecx, eax
cmc
and eax, 0xffff
test dl, 0x1a
cmc
xor esi, eax
test ebp, esp
shl eax, 0x10
jmp 0x183e946
shl eax, 2
xor esi, eax
test sp, bp
mov eax, ecx
cmp di, 0xce8e
jmp 0x178eb8b
jge 0x17d3e2e
xor ecx, eax
mov eax, esi
stc
shr eax, 2
cmp edx, 0x6724b025
test ax, 0x42a4
xor eax, ecx
cmp bx, cx
cmp ebx, 0xd5986088
and eax, 0x33333333
cmc
test esi, 0xd512262f
xor ecx, eax
jmp 0x17ee152
shl eax, 8
cmp sp, 0xc7af
clc
xor ecx, eax
mov eax, esi
test si, 0xa038
stc
shr eax, 1
test cx, si
jmp 0x17e492e

Function at 0x17a8301
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0xc], 0x41efee79
lea esp, [esp + 0xc]
call fcn.01849679
clc

Function at 0x17aaad3
Capabilities:
Parse pe header

Disassembly:
pop eax
pop edx
pop eax
jle fcn.01843c11
Function at 0x17b18db
Capabilities:
Encode data using base64

Disassembly:
bswap eax
movsx edx, cx
call fcn.01783bf0

Function at 0x17b1a7b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea ecx, [edx + edx*2 - 0x21729256]
movzx eax, byte [ecx + ebp - 0x6e5d8fe]
mov dword [esp + ecx - 0x6e5d8fe], edx
xor al, bl
sal byte [esp + ecx*2 - 0xdcbb1fa], 0xe7
or cl, 0x94
dec al
ror al, 1
or dword [esp + ecx - 0x6e5d8fe], ecx
dec word [esp + ecx*8 - 0x372ec7ef]
xor al, 0x1d
jmp 0x17e27bc
not al
ror dword [esp + ecx - 0x6e5d8fe], 0xa9
not dword [esp + ecx - 0x6e5d8fe]
ror cx, 0x21
xor bl, al
lea eax, [esp + eax + 4]
inc dword [esp + ecx - 0x6e56c7f]
neg cx
mov ecx, dword [eax + ecx*2 - 0xdcb2702]
neg edx
lea esi, [edx + esi - 0x47e286e8]
mov eax, edx
call fcn.0178a439
mov ecx, 0x772bf223
mov ax, word [edi + ecx - 0x772bf223]
mov dx, word [edi + ecx - 0x772bf221]
sal ecx, cl
mov cl, byte [edi + 4]
js 0x17ac0a9

Function at 0x17cbbb0
Capabilities:
Authenticate hmac

Disassembly:
pop edx
mov word es:[eax], cx
inc edx
call fcn.017d03f8
mov dword [ebp + ecx*8 - 0x3cc8c0d0], edx
mov dword [esp + ecx - 0x799181a], ecx
add ecx, dword [esp + ecx - 0x7991816]
mov dword [ebp + 4], eax
lea edx, [ecx + ecx*8 - 0x7cf6ff74]
mov eax, 0xb982d082
lea edi, [edi + edx - 0x6ab36d88]
sbb al, byte [esp + edx - 0x6ab36d7d]
bswap edx
mov ecx, dword [edi]
inc eax
xor dword [esp + 3], eax
and dl, 0x18
xor ecx, ebx
pop eax
call fcn.0177cb82
or cx, word [esi + edx*8 - 0x4292476c]
lea esi, [esi + edx - 0x85248e8]
jmp 0x17ba96c

Function at 0x17e0f01
Capabilities:
Encode data using base64

Disassembly:
sub cl, 0x3c
mov dword [esp + edx - 0x5a400000], eax
xor bl, cl
not word [esp + eax - 0x638c10b8]
lea ecx, [esp + ecx + 4]
neg al
bswap eax
add dl, byte [ecx + eax - 0x46108c63]
movzx ecx, ax
and cl, byte [esp + eax - 0x46108c60]
lea ebp, [ebp + ecx*2 - 0x11802]
mov word [ecx + ebp - 0x8c00], dx
adc dword [esp + eax - 0x46108c63], 0xee8e3b22
mov edx, dword [edi + ecx - 0x8c00]
setns al
call fcn.01841415
xor eax, ebx
dec dx
sub cl, cl
call fcn.01833668

Function at 0x17e3f02
Capabilities:
Encode data using base64

Disassembly:
call fcn.0179e4ea
not eax
lea ecx, [edx*4 - 0x7a782ceb]
sbb eax, 0xd8343e1d
shr cl, 0xc2
mov dword [esp + edx], 0x643433bd
xor ebx, eax
ror edx, cl
sbb edx, 0x7fab550e
jae 0x18472fd
add ebp, eax
ror cl, 0xc1
and cx, dx
call fcn.0186837f

Function at 0x17e55bf
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0xc], 0x21302eea
lea esp, [esp + 0xc]
call fcn.01780bb4
call fcn.018203f1
stc
cmc

Function at 0x180e4e6
Capabilities:
Encode data using base64

Disassembly:
mov ecx, edx
mov dword [esp], 0xc1ab77a0
mov edx, dword [esi + 4]
call fcn.017f3a56
add cl, 0x3d
movsx eax, dl
neg cl
pop edx
ror eax, 0x33
adc byte [esp + 3], ah
xor bl, cl
ror eax, 0xb
sar ax, 0x41
sub al, al
sbb ebp, 2
ror al, 0xc5
sar dword [esp + 0xc], 0x81
mov word [ebp], cx
and eax, eax
sar al, 0xe1
mov ecx, 0xebb2071f
pop edx
pop ecx
pop edx
pop ecx
je fcn.017e5072
call fcn.00b509b5
Function at 0x181d2e5
Capabilities:
Encode data using base64

Disassembly:
neg al
dec edx
or ecx, eax
bswap edx
xor edx, 0x7132eaba
sub dword [esp + eax - 0x3459], 0x57388896
bswap edx
jnp 0x17a8899
inc dl
neg dx
lea ebp, [ebp + edx - 0x5d1a17e6]
sal edx, 0x59
or cx, ax
movsx eax, dl
call fcn.01868a29
mov eax, 0xa11b3684
mov edx, dword [edi]
movzx ecx, ax
mov ecx, dword [edi + ecx*8 - 0x1b41c]
ror al, 0x83
jb 0x17c2e5c
movzx dx, byte [ebp]
mov ecx, 0x4038fe3d
call fcn.017efe50
dec eax
ror eax, 1
movzx ecx, dx
sal byte [esp + ecx + 3], 0x85
ror ecx, 0x2a
xor eax, 0x5d273e17
xor cx, 0xef8f
xor ebx, eax
dec ecx
neg ecx
inc ecx
add esi, eax
xor word [esp + 1], dx
and dl, 0x3e
xor dx, word [ebp]
pop eax
jmp 0x181669f
setno cl
rol edx, 2
push ecx
lea ecx, [eax + ecx - 0x1bc28b55]
and cx, word [esp + eax - 0x3453]
sbb edx, 0x8e35a30b
shl al, 0x46
jbe 0x1822a0a
mov edx, 0x2b839aa5
call fcn.0182c8c3
and al, ah
adc edi, 8
xor eax, 0xa806bd11
mov dword fs:[eax + edx - 0x91d8b01], ecx
sub eax, eax
lea ebp, [ebp + eax - 4]
adc eax, dword [ebp + eax]
mov ecx, 0xae1e24a1
xor eax, ebx
lea edx, [ecx + ecx*8 - 0x367064f3]
inc eax
shl edx, cl
neg eax
lea edx, [edx + ecx*4 - 0x58c1ebcf]
bswap eax
sal edx, 0x2a
bswap ecx
lea edx, [ecx + ecx*2 - 0x2769e1de]
lea eax, [ecx + eax - 0x7e84b4ad]
lea ecx, [edx*8 - 0x4a7c8c50]
inc ecx
bswap eax
sal edx, cl
inc edx
xor ebx, eax
shl ecx, 0x6f
add esi, eax
lea eax, [ecx*4 + 0x59342038]
and ecx, edx
sub cx, ax
jmp esi
xor edx, ebx
jmp 0x1781474
mov edx, dword [edi + eax*2 - 0x6946]
mov dword [esp + eax*4 - 0xd28c], eax
ror word [esp + eax - 0x34a3], cl
jae 0x181354d

Function at 0x182090a
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edi]
add edi, 4
pop ecx
xor edx, ebx
call fcn.017a382d

Function at 0x182091a
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
push eax
xor ecx, 0xf5beff09
sar edx, 0x21
shl edx, 0x78
mov dword [esp + edx*4 - 0x3bfffffc], eax
rol ecx, 1
pop edx
xor ebx, ecx
add edi, ecx
rol eax, 0x9c
rol al, 0x41
adc eax, 0x7c0a8d2b
lea ebp, [ebp + edx - 0x6aa53413]
movzx edx, byte [ebp + edx - 0x6aa53412]
movsx ecx, ax
jae 0x17a7ca5