joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7e239b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add al, byte [edx + eax]
mov word [edi + ecx*8 - 0x4d9c5c7a], ax
movsx edx, cl
lea edi, [edi + ecx - 0x9b38b91]
lea eax, [edx + edx*4 + 0x79220e83]
pop edx
pop edx
pop ecx
jmp fcn.00c9bff2

Function at 0x804f51
Capabilities:
Encode data using xor

Disassembly:
pop ebx
movzx ebx, byte [eax]
push 0x53b2df05
sub dword [esp], 0x889985b5
xor ebx, ecx
inc dword [esp]
shl byte [esp], 6
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x844958]
inc dword [esp]
inc dword [esp]
inc byte [esp + 1]
shr ecx, 8
xor ecx, ebx
push 0x3318e537
inc eax
call fcn.0086ea6a

Function at 0x808a40
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + eax*2 - 0xe41900], ebx
inc ecx
mov ecx, ebp
dec eax
lea esi, [eax + esi - 0x720c84]
cdq
dec eax
neg dword [esp + eax - 0x720c7d]
inc esp
movzx edi, bl
inc edx
xor dl, byte [eax + ebx - 0x720c88]
dec ebp
lea ebx, [ebx + eax*8 - 0x390643f]
inc cx
neg esi
inc ecx
xor dl, cl
inc ecx
neg ch
inc ecx
not eax
inc ecx
neg edi
xor dl, 0x10
cwde
inc ecx
pop edi
dec eax
add dword [esp + eax - 0xc82], ecx
inc dl
inc ecx
sar ch, 0x87
dec edi
lea edx, [edi + eax*2 - 0x704c8fca]
rol dl, 1
neg dl
inc esp
xor cl, dl
inc cx
btr edx, eax
inc ecx
rol ah, 0xe1
call fcn.00cef5d2
pop esi
adc eax, 0x935c0104
jmp 0xb9dfbe37
dec edx
mov dword [esp + ebp*4 - 0x64], eax
inc ecx
neg edi
dec edx
lea edx, [eax*2 - 0x1ff70051]
inc ebp
lea edi, [edi + eax - 0x3c354a9f]
inc esp
movsx esi, al
dec eax
xchg dword [esp + eax*2 - 0x39064000], edi
inc ecx
neg edi
inc eax
movsx ebx, bh
sal bl, 0xe7
dec eax
ror dword [esp + eax*2 - 0x39064000], 0xb8
inc ecx
inc edi
inc esp
movsx edx, word [esp + eax*2 - 0x39063ffe]
push edi
dec esp
mov dword [esp + eax*2 - 0x39063ff0], ecx
inc cx
imul ebp
inc ecx
pop eax
inc byte [esp + eax*2 - 0x39063ffe]
inc esp
xor dword [esp + eax - 0x1c831ff8], edi
neg word [esp + eax*2 - 0x39063ffc]
dec esp
mov ecx, dword [esp + eax - 0x1c831ff8]
dec eax
ror eax, 0xc6
inc ebp
xchg edx, ebp
inc sp
or eax, eax
dec ebp
arpl di, di
inc ecx
push eax
inc eax
setne bh
and word [esp + eax*4 - 0x1c831f5], dx
dec ecx
adc ebp, edi
dec ecx
btc esi, 0xbb
inc esp
movsx esp, bx
btc eax, edx
mov edi, dword [edi + esi - 0x1c832001]
jae 0x78bd75
mov edx, 0x16a05228
or edx, edx
mov edx, esi
sbb esi, 4
mov eax, 0xc31dd495
mov dword [esi], edx
mov edx, eax
sub edi, 4
mov eax, dword [edi]
movsx ecx, dl
xor eax, ebx
bt cx, cx
and ecx, 0xc5bd6c21
shr edx, cl
sbb eax, 0x6a2a3807
xor eax, 0x48a0e716
neg eax
shl edx, cl
inc eax
inc edx
jno 0x8bc9fb
shl edx, cl
xor ebx, eax
inc ecx
shl ecx, cl
add ebp, eax
movsx eax, dl
sar cl, 0xa4
je fcn.00909547

Function at 0x80b048
Capabilities:
Encode data using xor

Disassembly:
jmp 0x9236b4
dec eax
call fcn.00868432
mov edx, 0xdb1f790a
call fcn.007c07b2
mov eax, 0x6c228fac
movsx ecx, al
lea edi, [eax + edi - 0x6c228fb0]
movzx edx, ax
lea edx, [eax*4 - 0x2c763dcb]
shr ecx, cl
mov edx, dword [edi + ecx*2 - 0x1ffffe]
xor edx, ebx
dec edx
dec ax
inc cl
ror edx, 3
bts cx, cx
btr ecx, ecx
rol eax, cl
sbb edx, 0xe9028c03
xor edx, 0x129a95b3
btr ecx, ecx
sub al, al
rol ecx, 0x66
bswap edx
neg eax
xor ebx, edx
Function at 0x80f6d4
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc bp
cmovs esi, ebp
neg ebx
inc ebx
inc cx
rol esi, 0xcb
mov edi, 0x6a95d883
dec ecx
dec edi
dec esi
mov dword [esp + ebp*2 - 0x3c545116], ecx
inc ebp
movsx edx, di
dec edx
mov dword [esp + ebp - 0x1e2a288f], edi
pop edi
inc edx
xor dword [esp + ebp - 0x1e2a288f], ebx
push ecx
dec esi
mov ecx, dword [esp + ebp - 0x1e2a2887]
rol cx, cl
dec eax
arpl bx, bx
jae 0x77b7ac
dec eax
add ebp, ebx
bt cx, 0x8e
dec ecx
dec edi
inc edx
add byte [esp + ebp*2 - 0x3c545117], 0x84
inc esi
mov esi, dword [esi + ebp*4 - 0x78a8a23c]
dec edx
sar dword [esp + ebp - 0x1e2a288f], cl
dec esi
mov dword [esp + ebp*2 - 0x3c545116], ebp
inc ecx
seta al
inc edi
mov dl, byte [ebx + ebp - 0x1e2a288b]
inc edx
sar byte [esp + ebp*2 - 0x3c54511c], 0x82
dec esi
lea esp, [ebp*4 - 0x5ed12173]
inc ebp
xor dl, cl
inc edx
movzx eax, byte [esp + ebp - 0x1e2a2883]
inc eax
dec ecx
sar esp, 0xa
inc ecx
xor dl, 0x10
inc ecx
btr esp, 0x1a
sar cl, 0x65
inc ebp
adc dl, al
cbw
inc ecx
rol dl, 1
inc edx
mov byte [esp + ebp - 0x1e2a288b], bh
inc ecx
neg dl
dec edx
add ecx, dword [esp + ebp*4 - 0x78a8a238]
dec edx
dec dword [esp + ebp*2 - 0x3c545116]
inc ebp
xor cl, dl
inc ecx
or eax, ebp
inc edx
shr byte [esp + ebp*4 - 0x78a8a230], 0xe3
dec esi
lea edx, [esp + edx + 0x10]
inc edi
mov dword [ebp + edx - 0x1e2a288f], esi
inc edx
xchg dword [esp + ebp*2 - 0x3c545117], edi
dec ecx
ror ebp, 0x7e
dec edi
mov esp, dword [ebx + ebp - 0x78a8a237]
inc dx
and dword [esp + ebp - 0x78a8a23b], edx
inc esi
movsx edx, word [esp + eax - 0x70e76cf9]
dec ebp
xor esp, ecx
dec ecx
dec esp
inc edx
mul byte [esp + ebp - 0x78a8a22e]
dec ecx
xor esp, 0xba1bfaa5
jmp 0x799dcf

Function at 0x80f97f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov esi, 0x130162ba
mov ebp, edx
mov dword [esp + ecx*4 - 0x1a8ec], esi
sub cx, 0x4e92
push ecx
mov esi, edi
xchg dword [esp + ecx*2 - 0x374e], ecx
pop eax
pop edx
jg 0x97dbad
Function at 0x81093c
Capabilities:
Encode data using xor

Disassembly:
push 0xee283084
xor edx, 0x89096aaa
inc edx
jmp 0xcd73e2
mov dword [esp + 8], 0x3309a59d
not dword [esp + 0xb]
xor ebx, edx
call fcn.00c83bf8
mov edx, 0xc92f1404
mov ecx, 0xd90e93be
bt ecx, ecx
sbb edi, 3
btr ecx, edx
neg dx
not ecx
mov eax, dword [edi + ecx - 0x26f16c51]
dec ecx
xor eax, ebx
btc edx, ecx
inc cl
xor eax, 0xd9a3371b
dec eax
xor edx, 0x5d8da0ab
imul ecx, edx
bswap eax
xadd ecx, edx
neg cx
xor cx, cx
sbb eax, 0xda0b7c26
neg dx
shr ecx, 0x37
neg eax
xor edx, edx
and dl, 0x93
xor ebx, eax
xchg ecx, edx
xor dl, 0xc
adc ebp, eax
xadd cx, dx
or edx, edx
adc cx, dx
mov ecx, dword [esi + edx]
movzx eax, dl
or ax, word [esi + eax*8 + 4]
call fcn.00c6d2d1
aad 0xdc
mov cl, 1
pop es
test al, 0x20
add byte [ebx + eax*4], cl
pop ss
js 0xcd749b
add al, ch
js 0xcd74df
invalid
push 0x54f2055d
leave
stc
sub eax, 0x8e134b1e
daa
jnp 0xcd74c1
test eax, 0x3f10f40c
stosb byte es:[edi], al
push ebp
int1
add ah, ah
jbe 0xcd7501
xor dword [eax - 0x10], ebx
xor byte [ecx - 0x60da6d65], 0x90
rcr dword [ebx + esi*8 + 0x15ae029d], 1
jg 0xcd7510
salc
push 0xbf8206b8
fld dword [ebx + 0x72625d9c]
pop ss
adc dword [ecx], edx
wait
add dword [eax], ebp
cld
xor eax, 0xfe3a266f
outsd dx, dword [esi]
cmp bh, dh
xchg ecx, eax
imul edx, edi, 0xe3d6870f
pop ebp
mov bh, bh
push ds
add dword [ebx + 0x5f5bdd83], ebp
sub eax, dword [eax]
add byte [eax], al
add dl, dh
sub eax, 0x4ef2ecfb
cmc
shl byte [esi + 0x4d77d680], 1
cmpsb byte [esi], byte es:[edi]
adc dh, 0x77
dec ebp
mov ch, 0x33
sub dword [edx + 0x876fc70], edx
push ds
stc
stc
dec ecx
in eax, 0x40
mov esi, 0x41894dda
invalid

Function at 0x81e2f7
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push 0x6a044223
lea esp, [esp + 0xc]
jne 0xd0070f
Function at 0x821e86
Capabilities:
Encode data using base64

Disassembly:
push edi
dec edx
neg dword [esp + edi*2 - 0x2dc697da]
inc edi
mov edi, dword [ebx + edi*2 - 0x2dc697e0]
dec eax
rol dword [esp + edi*4 - 0x21], 0x7e
dec edi
lea ebx, [ebx + esi - 4]
js 0x8116b5
mov eax, dword [esi + eax - 0x6ba28520]
mov cl, byte [esi + 4]
inc bp
xor esp, edi
dec esi
mov dword [esp + edi - 0x16e34bf0], esp
dec esi
lea eax, [esp + eax + 8]
inc bx
mov dword [eax + edi - 0x16e34bf0], eax
jg 0x755249
mov edx, 0xb2062fb1
inc dl
jge 0x809b92
mov eax, dword [ebp]
shl edx, 0x7e
sal edx, 0xb9
add edx, dword [edx + ebp + 4]
add eax, edx
mov ecx, 0xa6a0af38
lea edx, [ecx + ecx*8 + 0x17329a24]
imul ecx, ecx
mov dword [ebp + ecx - 0x1ded9c3c], eax
mov edx, dword [esi + ecx*4 - 0x77b67104]
movsx eax, cx
bswap eax
ror eax, 0x61
xor edx, ebx
dec al
inc ax
neg ecx
inc edx
xor edx, 0xd7382c06
neg ecx
ja 0x760cf4
shl ax, 0xe7
neg edx
not edx
xor eax, 0xc30c161b
rol edx, 2
sub al, 0x12
xadd cx, ax
add eax, ecx
xor ebx, edx
xchg cx, ax
ror al, 0x21
add edi, edx
btr eax, ecx
neg al
bt ax, 0x98
movzx ecx, byte [ecx + esi - 0x1ded220e]
xor cl, bl
cbw
cdq
neg cl
add cl, 0xa
cwde
inc edx
xor cl, 0xb5
shl eax, 0x49
inc dl
not cl
xor bl, cl
add ecx, esp
mov eax, dword [ecx + eax - 0x3800]
inc edx
mov dword [ebp + edx*2 - 4], eax
lea ecx, [edx*4 - 0x106a46e2]
mov edx, dword [esi + edx*8 - 0x19]
jne 0xc460ac
ror edx, cl
bts eax, 0xb4
not edx
setb cl
cwde
ror ax, cl
neg edx
lea ecx, [ecx + eax*4 + 0x611d5a7]
xadd ax, cx
xor ebx, edx
mov dword [ebp + ecx - 0x2bbf1262], edx
mov edx, eax
imul ecx
add ecx, eax
lea ebp, [ebp + eax - 0x1a8f0848]
jno fcn.00754c95
mov ecx, dword [ebp]
add ebp, 4
mov edx, 0x4c98a603
dec edx
xor ecx, ebx
ror ecx, 2
lea eax, [edx + edx*4 + 0x7bbd6aae]
sub ecx, 0xac876281
xor edx, edx
mul edx
shl dl, 0xe4
not ecx
rol ecx, 1
xor ebx, ecx
ror edx, 0xd4
inc ax
cdq
adc edi, ecx
bt eax, 0x36
add edx, dword [esi + edx*8]
movsx ecx, al
mov eax, dword [esi + eax + 3]
bts cx, cx
shl ecx, 0x94
xor cl, byte [esi + ecx*2 - 0x5ffff8]
add esi, 6
shrd edx, eax, cl
mov ecx, 0x5a37f7bf
inc cl
mov dword [esi + ecx - 0x5a37f7c0], edx
sar ecx, 0x86
jmp edi
sub esi, 9
lea eax, [ecx + ecx*4 + 0x2b2cba3d]
rol ecx, 0xc5
xor edx, ebx
imul eax, ecx
btc ecx, ecx
dec edx
inc ecx
xchg ecx, eax
rol edx, 3
sar cx, 0x6d
jns 0xcf8122
bswap edx
sbb edx, 0xd9271109
sal al, cl
bswap edx
jb 0x96cf3a
Function at 0x821f6a
Capabilities:
Encode data using base64

Disassembly:
pop eax
jne fcn.0073c0e6
call fcn.00815591
xor word [esp + 4], cx
mov cl, byte [esi + 8]
mov dword [esp], 0x433e773f
shl byte [esp + 2], 0xc4
js 0x830984
adc esi, 5
shr dword [esp + 1], 0xe1
jb 0x9aa9b9
shld edx, eax, cl
mov ecx, dword [esp + 4]
jmp 0xcf2e8f
mov dword [esi], edx
sar dword [esp], 0xef
sbb ebp, 4
lea edx, [ecx*8 + 0x938fea0]
push edx
call fcn.00964c1a
inc cx
adc ecx, eax
dec eax
mov dword [esi + eax - 0xa], edx
inc ecx
bswap eax
inc ebp
mov edi, dword [ebx + eax*2 - 0x14]
jl 0x7cdf49
not di
dec ebp
lea ebx, [ebx + eax - 6]
dec ecx
xadd eax, ecx
dec ecx
btr esp, edi
inc ebp
xor edi, ecx
dec eax
bswap ecx
inc ecx
neg edi
inc ecx
xor edi, 0xec032d99
dec eax
cdq
shl di, 0x27
inc ecx
ror edi, 1
dec ecx
idiv edx
dec ecx
bt ebp, edi
inc ecx
not edi
inc ecx
push ecx
inc esp
xor dword [esp + eax], edi
inc ecx
pop ecx
imul ecx, edi
inc ecx
ror ah, 0xe5
dec ebp
arpl di, di
call fcn.009114d0
lea esp, [esp + 0x10]
ret
Function at 0x8297af
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push 0xe82ae28d
call fcn.008d19a5

Function at 0x82a27d
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
cwde
movzx ebp, ax
pushfd
pop ebx
mov dword [esp + eax - 0x5f9e], ebx
movzx ecx, al

Function at 0x82be38
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.009a6885
mov edx, 0x26bb4c1c
mov ecx, dword [ebp + edx*2 - 0x4d769838]
add dl, 0x90
lea eax, [esp + edx - 0x26bb4c94]
shr edx, 0x3c
mov dword [eax + edx*8 - 0x10], ecx
mov edx, dword [edx + esi - 6]
push 0xf92b4784
xor edx, ebx
mov ecx, 0xbc2ffb18
neg byte [esp + 2]
ror cx, 0xa6
not edx
neg edx
not dword [esp]
ror byte [esp], 0xc3
bswap ecx
not edx
movsx eax, cl
xor edx, 0x4ab7049f
neg edx
add ax, 0x505
xchg dword [esp], ecx
bswap edx
lea edx, [edx + ecx - 0x57d87e19]
sar ecx, 0x43
shr al, 0x26
sar ecx, cl
rol edx, 3
xor ebx, edx
inc cl
call fcn.0092c4af
shr word [esp + edx + 3], 0xe1
add ax, dx
adc ecx, edx
rol ecx, 1
xor edx, dword [esp + edx + 3]
jns 0xd00f55
add cx, 0x2294
dec dl
ror dl, 1
inc dl
shl cl, 0x83
lea ecx, [ecx + ecx*8 + 0x3490568c]
neg dl
not cx
xchg cx, ax
bt cx, ax
rol dl, 1
inc eax
not dl
sal ecx, cl
adc ax, cx
xadd eax, ecx
adc dl, 0xa0
jmp 0x76f93a
xor ebx, ecx
not edx
call fcn.00c86681
mov dword [esp + ecx - 0x1f140f0f], ecx
mov ebp, dword [esp + ecx*2 - 0x3e281e1a]
mov esi, dword [esp + esi - 0xf03]
jmp 0x783a0c

Function at 0x8343de
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc bp
mov dword [eax + esi - 0xb13300], edi
js 0x86cfba
inc ebx
mov ecx, dword [ebx + eax - 0xb132ff]
inc ecx
xor ecx, ecx
dec eax
lea edi, [ebx - 0x497ef47f]
call fcn.009230c7
inc edx
inc eax
mov word [eax + edi - 1], cx
ror eax, 0xf8
jns fcn.00c9bff2
xor bx, dx
dec dx
inc dx
movzx ecx, byte [edx + edx - 0xfa73b89]
dec eax
lea esi, [esi + edx - 0xfa73b8b]
inc sp
xchg dword [esp + edx - 0xfa73b84], eax
inc ecx
mov ebp, 0x56b65f84
inc cx
not ebp
mov word [esi + edx*4 - 0x3e9cee24], cx
dec dword [esp + edx - 0xfa73b87]
inc ebp
mov edx, dword [ebx + edx - 0xfa73b89]
inc sp
xchg dword [esp + edx - 0xfa73b7d], ebp
sal byte [esp + edx - 0xfa73b88], 0x81
inc ecx
shl ch, 0x87
dec ebp
lea ebx, [ebx + edx - 0xfa73b85]
inc ebp
xor edx, ecx
inc edi
lea edx, [edx + ebp*2 + 0x1342d71f]
dec eax
xadd dword [esp + edx - 0xfa73b81], eax
call fcn.008a7b96
sbb edi, dword [edi + 7]
insd dword es:[edi], dx
push cs
xor bh, 0x45
int1
aaa
jmp 0xe9c2d033
Function at 0x835706
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
bts eax, eax
xor edx, ebx
dec eax
not cx
xadd eax, ecx
ror edx, 2
sub edx, 0xff1afc8a
add ax, cx
ror edx, 3
bswap edx
add ax, 0x4d30
dec eax
inc ecx
xor ebx, edx
xor cl, al
adc edi, edx
movzx edx, cx
or ecx, ecx
mov edx, esi
jnp 0x8d428d
setl cl
lea esi, [ecx + esi - 0x3e8ae402]
jl 0x78a199
call fcn.00d0e834
lea edx, [edx + eax*2 - 0x6107c1cd]
sal eax, 0x4e
xor edx, 0x5294b0b5
ror edx, 2
inc edx
xor ebx, edx
add edi, edx
push eax
push eax
rdtsc
mov ecx, dword [esp + 6]
lea esi, [esi + ecx*2 - 0x8204f84]
shr dword [esp + ecx - 0x41027bc], 0xca
jns 0x8a7e7d
mov dword [esp], 0x408c1099
call fcn.00879abd
mov edx, 0xd016259c
movzx ecx, dx
lea ebp, [ebp + ecx*8 - 0x12ce4]
shr cx, 3
mov eax, 0x3e8ae4af
mov edx, dword [ecx + ebp - 0x4b3]
jns 0x7d373d
dec esp
mov esp, dword [esi]
inc ecx
mov esi, 0x3b3edf9e
dec edx
lea edi, [esi*8 - 0x16ccacda]
dec esi
lea edx, [edi + esi*8 - 0x7b41ead7]
dec edx
lea esi, [esi + esi - 0x3b3edf96]
inc ebp
movsx ebp, dh
push edi
inc dx
inc dword [esp + esi - 0x3b3edf9d]
inc ebx
movzx ecx, byte [ebx + esi*2 - 0x767dbf3c]
inc ecx
shr ch, 0xe7
dec edi
lea ebx, [ebx + esi*2 - 0x767dbf3b]
inc eax
sal bh, 0x41
inc ecx
mov edi, 0xdd9891b4
inc ecx
xor cl, cl
dec edx
neg dword [esp + esi*2 - 0x767dbf3c]
inc esi
adc byte [esp + esi*2 - 0x767dbf3c], dh
inc ecx
shr edx, 0x63
adc cl, 0xa9
pop edi
xor cl, 0xb
dec ecx
lea ebx, [ebp - 0x62eab167]
dec ecx
lea eax, [edx + edi - 0x20da51f4]
not cl
dec eax
mul eax
dec ebp
xchg edi, edx
inc eax
shl bh, 0x81
neg byte [esp + ecx*2 - 0x8204f71]
mov dword [esi + ecx*2 - 0x8204f78], eax
call fcn.00744dcf
Function at 0x836abd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov eax, 0xb086c6b2
mov dword [edi + 8], ebx
sbb eax, eax
movsx ebx, word [esp + 4]
rol dword [esp + 0xc], 0xac
mov dword [edi + 4], ecx
sar ebx, 0xba
movzx ecx, byte [esp + 4]
mov dword [edi + ecx*4 - 0x118], edx
xchg ebx, eax
push ecx
mov ebx, dword [esp + ecx - 0x32]
xchg byte [esp + ecx - 0x3e], al
pop ecx
pop edx
pop edx
pop edx
pop edx
pop eax
js fcn.00c9bff2
inc ecx
mov esp, 0xccadf6ad
call fcn.0098375b
mov eax, 0xf60ea682
and eax, eax
movzx ecx, ax
mov ecx, dword [esi + ecx*4 - 0x29a08]
inc eax
mov edx, dword [esi + 4]
call fcn.00776aa3
Function at 0x844570
Capabilities:
Authenticate hmac

Disassembly:
push edx
pop ecx
pop edx
pop edx
jns fcn.009542f2

Function at 0x8460e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec eax
mov dword [esp + edx], ebp
ret
lea ebp, [ebp + ecx - 0x25ae1bbb]
shr ecx, 0x5c
rol ecx, cl
mov dword [esp + ecx - 8], 0x7881cf0a
mov eax, dword [ebp + ecx*4 - 0x20]
mov edx, dword [esp + ecx*8 - 0x40]
xor eax, ebx
bswap eax
call fcn.008cb7b3
inc ecx
mov ecx, esp
inc esp
movzx eax, bl
inc ecx
push ecx
dec eax
neg ebx
inc ebp
sbb eax, esp
inc esp
xor dword [esp + eax*4 - 0x305c], edi
inc esp
movzx edx, cx
inc ecx
idiv al
inc ecx
pop ecx
inc bp
and ebp, ebp
cdq
dec eax
bswap ebx
dec ebp
arpl di, di
inc sp
or eax, ebx
dec ecx
adc ebp, edi
dec ecx
dec esp
inc cx
ror ebp, 0xa
sal eax, 0xaf
dec esp
mov edx, dword [esi + eax*4 - 0x1e500008]
inc ecx
xchg ch, dl
inc cx
btr ebp, eax
dec ecx
adc esi, 0x7b1c4ad
dec esi
mov ebp, dword [eax + edx - 0x7940000]
inc ecx
push eax
dec eax
shr dword [esp + eax*2 - 0xf280000], cl
inc esp
mov edi, eax
dec eax
mov edi, dword [esi + eax*2 - 0xf280000]
inc dword [esp + eax*4 - 0x1e4fffff]
shr byte [esp + eax - 0x793fffc], 0xa5
imul dword [esp + eax - 0x793fffc]
dec ecx
not ebp
inc ebp
btr edi, esp
dec eax
not edi
dec esp
and ebp, edi
mov dword [esp + eax*8 + 4], 0xe98d5e2d
sub cx, 0x93d
dec esp
mov dword [esi + eax], ebp
inc ecx
inc bh
jg 0x834063
mov ecx, 0xf79b68ac
inc esp
movzx esi, cl
mov eax, 0x1600972f
inc edi
mov edi, dword [ebx + esi*2 - 0x158]
shl al, 0x85
inc ebp
xor edi, ecx
inc ecx
inc edi
inc ecx
movzx ebx, dh
inc ecx
rol edi, 1
mov edx, ecx
dec ebp
lea esp, [esi + eax + 0x3a96de24]
inc ecx
bswap edi
movzx edi, ax
dec eax
cwde
inc ecx
rol edi, 3
imul bl
inc ecx
dec ah
inc ecx
inc edi
dec eax
cwde
inc esp
movzx edx, ax
inc ecx
not edi
add bx, 0x6b0d
inc ecx
push ecx
call fcn.008997ca

Function at 0x846214
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xca009e05
dec eax
mov dword [esp + 0x10], 0xe876ddc1
dec eax
lea esp, [esp + 0x10]
call fcn.00c7a401

Function at 0x848827
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp + edx], edx
sbb ecx, 0x803c2d2a
neg dword [esp + edx]
xor ebx, ecx
add esi, ecx
lea ebp, [edx + ebp - 1]
btc dx, ax
mov ecx, dword [esp + eax - 0x722d458c]
xchg edx, eax
movzx edx, byte [ebp + edx - 0x722d458c]
xor dl, bl
inc cl
inc al
xor dl, 0x96
not byte [esp + eax - 0x1001]
shr ecx, cl
bswap ecx
not dl
xor eax, 0x262a3da3
sbb dword [esp + eax - 0x262a2da2], ecx
dec dl
sal ecx, 0xd0
adc eax, dword [esp + ecx*2]
ror dl, 1
sar ax, 0xa5
or cx, 0xe212
inc dl
btr ax, ax
rol ax, 0x45
neg dl
sub eax, eax
rol dl, 1
ror cx, 0xc2
push eax
not dl
jb 0x903b65
and ax, cx
inc dword [esp + eax + 4]
adc dl, 0xa0
xor bl, dl
lea edx, [esp + edx + 8]
movzx cx, byte [edx + eax*2]
movzx edx, al
sub byte [esp + edx + 4], al
lea edi, [eax + edi - 2]
sar edx, 0x22
cmovne eax, dword [esp + eax*4 + 4]
mov word [edi + eax*2], cx
lea edx, [edx + edx + 0x2621870c]
movzx ecx, word [esp + eax + 4]
setb cl
pop ecx
pop eax
jp fcn.00c9bff2
Function at 0x849e10
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sal dx, 0x43
xor ebx, eax
call fcn.00887928
sub ecx, 0xa49c7025
sal byte [esp + eax*8], 0xa3
or edx, edx
ror ecx, 3
xchg dword [esp + eax], edx
cbw
shr dword [esp + eax*2], 0xbc
not ecx
xor al, dl
sar dword [esp + eax - 0xa0], 0xad
lea ecx, [ecx + eax*4 - 0x579da98b]
xchg word [esp + eax*2 - 0x13f], ax
and word [esp + eax + 1], ax
adc dl, byte [esp + eax + 2]
bswap ecx
jp 0x8b1cbf
call fcn.007aba88

Function at 0x84f2f9
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor ebx, eax
neg dx
add edi, eax
or dl, 0x8b
pop eax
jp fcn.00c67487
mov ecx, 0xb8a14697
mov eax, ecx
inc sp
movzx edx, byte [esi]
jmp 0xc4b75e
movzx edx, al
sar dx, 0xc6
mov cl, byte [esi + edx*8 - 0xe]
movzx ebx, dx
xor edx, 0x26bd1420
dec eax
xadd ebx, eax
inc esp
or dl, cl
inc ecx
not dl
inc ecx
mov eax, 0x12172b01
inc ecx
movsx ecx, ax
inc sp
mov dword [esi + eax*8 - 0xe], edx
btc dx, 0xa4
inc esi
mov esp, dword [eax + ebx - 2]
inc ebp
xor esp, ecx
inc ecx
inc esp
call fcn.0085eb70

Function at 0x8503fc
Capabilities:
Authenticate hmac

Disassembly:
lea edx, [ecx + ecx*4 - 0x7079d97a]
shr ecx, cl
not al
mov word [esi + ecx*4 - 0x846], ax
movzx edx, word [edi + ecx*4 - 0x84a]
mov dword [esp + ecx*8 - 0x1090], ecx
xor dx, bx
sal dword [esp + ecx - 0x212], 0xe
sbb ecx, 0xd184072d
xadd dword [esp + ecx - 0x2e7bfae5], ecx
not dx
sub byte [esp + ecx*8 - 0x423fffd], ch
neg dx
movsx eax, byte [esp + ecx*2 - 0x1090000]
rol dx, 1
xor al, byte [esp + ecx - 0x847fff]
sets cl
xor dx, 0x3538
call fcn.0092f54d

Function at 0x8514c2
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ecx - 0x40f89378], edx
pushfd
dec esp
lea ebp, [0xff7aeb2e]
inc ebp
movzx esp, bh
dec esi
mov dword [esp - 0x57], ebp
inc cx
bts esp, 4
inc esi
mov ebx, dword [esp - 0x17]
inc ebp
mov edx, edi
inc ecx
neg ebx
dec ebx
lea ebx, [edx + 0x75982a21]
inc cx
shr edi, 9
dec ebp
and edi, edx
inc ecx
inc ebx
inc ebp
mov ecx, eax
dec ecx
neg edi
inc ebp
movsx esi, dx
inc ecx
bswap ebx
dec ebp
xor esp, eax
dec ebp
or edi, edx
inc ecx
rol ebx, 2
inc sp
bt ebx, edi
inc ebp
add ebx, edi
jmp 0xc7a353
dec ebp
add ebx, ebp
inc ecx
ror ecx, 0x6d
dec ecx
sbb ebx, edi
dec esp
cmovno esi, ebx
dec edx
mov dword [esp + edi + 0x79], esi
movsx esi, bx
inc ecx
movsx edx, bh
inc ecx
and esp, 0xecafef20
dec edx
mov dword [esp + edi + 0x81], eax
sal ebx, 0xc1
inc ecx
ror ah, 0xa6
dec eax
mov esi, esp
ja 0xcbdb27
dec ecx
sal ecx, cl
inc ecx
mov ebp, 0xdeb835a3
dec esi
lea edi, [esi + edi*2 - 0x1fe]
inc ecx
and bh, 0xf0
inc ecx
push edx
inc ecx
neg esp
dec ecx
mov esp, edi
Function at 0x852356
Capabilities:
Encode data using base64

Disassembly:
xor bl, al
sub cl, ch
jbe 0x8fa8f1
mov dword [esp + eax - 0x4c6a1b23], edi
ret
mov ecx, dword [esi]
sub eax, eax
mov dword [esp + eax], eax
shl ax, 0x8e
or eax, dword [esi + eax*2 + 4]
call fcn.009365a9
mov ecx, 0x3abd9620
xor cl, cl
inc al
add ecx, ecx
btr ecx, 0xb0
rol al, 1
add ecx, ecx
and cl, ch
je 0x7c7f25
mov eax, edx
mov eax, dword [ebp + edx*2 - 0x4a207a9a]
lea ecx, [edx*8 + 0x41b3cf13]
setge cl
xchg ebp, eax
sete cl
mov esi, eax
xadd ecx, edx
jne 0x99649a
mov ecx, 0x92b0b11e
lea eax, [ecx + ecx*4 - 0x50f45372]
movzx edx, cx
mov edx, dword [ebp + edx*2 - 0x1623c]
xor edx, ebx
sub edx, 0x2a8fcbb8
cwde
or al, cl
bswap edx
neg edx
push ecx
pop eax
shl eax, 0xab
xor edx, 0x2c95fb3a
bswap eax
rol eax, 7
sar eax, 0x4c
xor ebx, edx
ror ecx, 0x9c
adc edi, edx
inc cl
cwde
movsx edx, al
mov eax, dword [esi + ecx*2 - 0x561623d4]
setl cl
mov edx, dword [esi + ecx - 0x2b0b10fd]
and eax, edx
or cx, 0xe2ae
not eax
mov dword [esi + ecx - 0x2b0bf3ab], eax
mov eax, ecx
mov ecx, dword [ebp + eax - 0x2b0bf3ab]
movzx edx, ax
not ax
lea ebp, [eax + ebp - 0x2b0b0c48]
xchg edx, eax
neg eax
xor ecx, ebx
xor ecx, 0x4f218805
call fcn.00c931f3
bt ecx, ecx
adc eax, esp
btr ecx, 0x25
adc ecx, ecx
shr ecx, cl
mov dword [eax + ecx*4 - 0x1abd0], edx
mov eax, ecx
mov ecx, dword [edi + ecx - 0x6af2]
cdq
shl eax, 0x6c
lea edi, [edi + eax*4 - 0x1abcfffa]
dec eax
cwde
dec edx
xor ecx, ebx
lea edx, [edx + edx*4 - 0x73e4f373]
ror dl, 0xa1
dec ecx
not al
mul eax
xor ecx, 0x6d05191a
jmp 0x74c0e2

Function at 0x852434
Capabilities:
Encode data using base64

Disassembly:
push ecx
mov eax, dword [edi + ecx - 0x5783e06b]
js 0xcb6c2e
lea edi, [edi + ecx - 0x5783e067]
adc edx, dword [esp + ecx - 0x5783e05b]
xor eax, ebx
xchg byte [esp + ecx - 0x5783e059], dh
not eax
ror edx, cl
push edx
bswap eax
adc dl, ch
mov dword [esp + ecx - 0x5783e063], 0x2092580b
rol eax, 1
neg eax
shr dl, 0x24
not ecx
imul cx, dx
xor ebx, eax
sar ecx, 0x68
btc dx, cx
add esi, eax
mov word [esp + 0x13], dx
not ecx
pop eax
pop eax
pop edx
pop ecx
pop edx
pop ecx
jmp fcn.00882a69

Function at 0x853ded
Capabilities:
Encode data using base64

Disassembly:
inc ecx
movsx edi, ch
inc ecx
not bh
call fcn.00889c8b

Function at 0x854d71
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + esi*4 - 0x6e91c], 0x3923f16
dec esi
mov ecx, dword [esp + esi - 0x1ba2f]
dec ebp
arpl bp, bp
dec ecx
add ebp, ebp
inc ebp
add bh, dl
inc si
mov esi, dword [esi + esi*2 - 0x3748e]
inc edi
movzx eax, byte [ebx + edi - 0x9d45]
inc esi
movsx ebp, byte [esp + edi*2 - 0x13a91]
dec esi
mov dword [esp + edi - 0x9d41], ebp
inc ebp
xor al, cl
jmp 0x8669fb

Function at 0x855b02
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor ebx, edx
shr eax, cl
cbw
add esi, edx
mov ecx, dword [ebp + eax*4 - 0x49ebfed8]
lea ebp, [ebp + eax*2 - 0x24f5ff66]
inc byte [esp + eax*2 - 0x24f5ff6a]
movzx edx, byte [edi + eax*4 - 0x49ebfed8]
mov dword [esp + eax - 0x127affb7], eax
sub eax, dword [esp + eax*4 - 0x49ebfed8]
sbb edi, 0xfffffffa
xor dl, bl
ror dl, 1
xchg word [esp + 6], ax
add eax, eax
pop eax
sbb dl, 0x8b
jmp 0x7bee1f