joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f7b1
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [eax - 0x6fdb765c]
neg edx
cwde
mov dword [esp + ecx - 0x7200568d], ecx
pop ecx
inc edx
cwde
neg eax
rol edx, 3
not edx
xor ebx, edx
add ebp, edx
movzx edx, cx
and cx, dx
shl edx, cl
mov edx, edi
xchg cx, ax
neg ecx
bts cx, 0x2c
lea edi, [edi + eax*2 - 0xad1e]
xadd eax, ecx
dec eax
push ecx
mov dword [edi + ecx*2 - 0xad1a], edx
sbb cx, cx
ror eax, 0xb8
pop ecx
jns fcn.004c48aa
ror eax, 3
lea eax, [ecx + eax - 0x59950662]
pop ecx
and ecx, 0xa887772b
neg eax
sub edx, ecx
rol eax, 2
push edx
sal cx, cl
not eax
pop edx
sets cl
sar cx, 0xc9
bswap eax
xor ebx, eax
add esi, eax
rol ecx, 0x39
call fcn.00427f5d
mov ecx, 0x9b3a0f35
shr cx, 0xc4
sbb ebp, 4
lea eax, [ecx*4 + 0x7032d511]
sal ax, 0x4c
mov ecx, dword [ebp]
mov edx, 0x783083af
xor ecx, ebx
not dx
lea ecx, [ecx + edx*2 + 0x44818f]
lea eax, [edx*2 + 0x5bbcfc06]
rol dl, 0xe5
neg ecx
btc eax, eax
cmovae dx, ax
lea ecx, [ecx + eax*2 + 0x23df5e43]
call fcn.004626d6
mov edx, dword [edi]
mov ecx, 0xb40c2b14
bswap ecx
mov ecx, dword [ecx + edi - 0x142b0cb0]
mov eax, 0x661337a2
lea edi, [edi + eax - 0x6613379a]
mov dword ss:[edx + eax - 0x661337a2], ecx
mov ecx, 0x2dbf2ba4
shl al, cl
mov edx, dword [esi + ecx - 0x2dbf2ba4]
xchg cx, ax
ror cl, 7
lea esi, [eax + esi - 0x66132ba0]
btc eax, ecx
dec ecx
xor edx, ebx
push ecx
xor byte [esp + eax - 0x66132ba4], 0xae
setl cl
dec edx
rol edx, cl
add dword [esp + ecx*2 - 0x5b7e6e02], 0x23127e02
inc edx
sar ecx, 0x81
sar al, 0x67
xor edx, 0x66a9a336
pop ecx
xor ebx, edx
call fcn.0043c9e2

Function at 0x444867
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsx eax, dl
btr ecx, 0x36
mov ecx, dword [esi]
mov dword [esp], 0x6eb84026
adc esi, 4
pop eax
dec dx
xor ecx, ebx
not ecx
add edx, 0xf00f8529
mov dword [esp + eax - 0x6eb84026], edx
ror ecx, 1
xadd dword [esp + eax - 0x6eb84026], eax
jne 0x4dc6bf
mov eax, 0xe3ab779a
lea ecx, [eax + eax*8 - 0x24833ee]
btr eax, ecx
mov ecx, dword [esi]
add ax, 0x3e29
mov edx, 0xb7a01418
mov eax, dword [esi + 4]
or dx, 0x8f3c
adc esi, 8
sar dl, 0xe4
call fcn.00474184

Function at 0x4463a4
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
lea edx, [ecx + edx + 0x7e196624]
sar cl, 0xa1
neg edx
call fcn.004aa1c3
Function at 0x448f89
Capabilities:
Encode data using base64

Disassembly:
adc ebp, eax
sar ecx, cl
mov ecx, dword [edi + ecx - 0xbdff]
shl edx, 0xb7
mov al, byte [edi + edx*8 - 0x3fffffc]
lea edi, [edi + edx*4 - 0x1fffffa]
shr edx, 0x6f
mov byte ss:[ecx + edx*8 - 0x800], al
movzx eax, dx
jmp ebp
and ecx, ecx
sbb eax, 0xd69aedbe
or cx, cx
call fcn.0048ba1c
mov eax, 0xb8a54029
lea edx, [eax + eax*4 + 0x1a051417]
sub edx, 0x179007a2
sbb ebp, 4
btc ax, 0x98
mov ecx, dword [ebp]
or edx, edx
add edx, 0xf857e3d
xor ecx, ebx
cwd
neg ecx
or eax, eax
jl 0x4a4ebc
mov eax, dword [esi]
add esi, 4
xor eax, ebx
mov ecx, 0x3d0087a7
ror ecx, cl
movsx edx, cl
inc eax
rol edx, 0xf3
neg eax
not eax
dec eax
not eax
or ecx, 0x1c9db92e
jnp 0x4ce32e
ror eax, 2
xadd cl, dh
sbb cx, 0xb083
or dl, ch
neg eax
shl cx, 0x48
bt edx, 0x32
sub cl, cl
bswap eax
setle cl
sar edx, 0xfe
xor ebx, eax
sub edx, 0xfd3c5d18
xchg dl, cl
add edi, eax
push edx
bts dx, 0xaf
lea eax, [edx + ecx + 0xc3b2c3b]
pop ecx
jb fcn.00418574
bts eax, ecx
sal al, 2
ror edx, 1
neg al
lea edx, [edx + ecx + 0x431fa18d]
xor ebx, edx
cwde
add esi, edx
btc cx, 0x1a
movzx edx, ax
movzx ax, byte [edi + eax - 0x100]
mov cl, byte [edi + edx*4 - 0x3fe]
btr dx, dx
lea edi, [edx + edi - 0xfe]
rol edx, 0x61
lea edx, [edx + edx - 0xe63cb7e]
setb dl
shl al, cl
btr edx, edx
bt dx, dx
mov ecx, edx
mov word [edi], ax
movzx eax, dx
setae al
jmp esi
not ecx
neg ecx
add eax, edx
xor ax, 0x6aaa
not ecx
call fcn.004e2909
xor ebx, eax
neg dx
inc edx
jnp 0x4269a2
Function at 0x45294a
Capabilities:
Encode data using base64

Disassembly:
neg ecx
sub edx, edx
neg al
mov dword [esp + edx*2], edx
lea ecx, [ecx + edx*8 + 0x3ea94cb3]
btr dx, cx
inc al
shr word [esp + edx*2 + 1], 0x66
dec cx
neg al
sub edx, dword [esp + ecx - 0x4a1bed1b]
lea ecx, [edx + edx*4 + 0xeb0ad26]
xor al, 0xe
bswap edx
xor bl, al
xor dword [esp + edx*2], 0xc7260c83
adc ecx, edx
lea esi, [edx + esi - 2]
mov word [esi + edx*8], ax
sub dl, cl
add ecx, edx
xadd byte [esp + edx*2 - 0x1b3], cl
mov edx, dword [edi + edx*2 - 0x1b4]
lea edi, [edi + ecx*2 - 0x1d615c14]
adc dword [esp + ecx*2 - 0x1d615c18], ecx
sar byte [esp + ecx*2 - 0x1d615c15], 0x87
sar ecx, cl
xor edx, ebx
dec edx
ror edx, 2
pop eax
sal ax, 7
neg edx
xadd cl, ch
not ecx
jl 0x4e4873
mov ecx, 0x4e3a4b0d
movzx cx, byte [ecx + ebp - 0x4e3a4b0d]
mov al, byte [ebp + 2]
add ebp, 2
mov edx, 0x20a9309
dec edx
neg dl
and cl, al
sar edx, 0xb5
lea eax, [edx + edx*8 + 0x7f89413c]
not cl
cdq
or dl, 0xd
mov word [ebp + edx - 0xd], cx
jg 0x4ab6e3
lea ecx, [eax*2 + 0x23841895]
mov ecx, dword [esi + edx - 0xd]
lea esi, [edx + esi - 9]
cwde
imul dx, dx
xor ecx, ebx
lea eax, [edx*4 + 0x603c4e0c]
bswap ecx
or edx, 0xd6bee52c
neg ecx
not ecx
dec al
shr edx, 0x51
neg dx
ror ecx, 1
bswap edx
xor edx, eax
xor ebx, ecx
btc eax, edx
mul al
adc eax, edx
add edi, ecx
call fcn.00452c34
dec edx
push eax
add ecx, ecx
mov dword [esp], eax
bswap edx
and al, byte [esp + 3]
push ecx
xor ebx, edx
and byte [esp + 3], cl
adc ebp, edx
rol ax, 0xe5
add ax, word [esp]
pop eax
pop ecx
jle fcn.00495cf4
Function at 0x455ba8
Capabilities:
Encode data using base64

Disassembly:
cwde
xor ebx, edx
sar al, 0x21
adc ebp, edx
shl ax, cl
movzx dx, byte [eax + edi]
sub ecx, ecx
lea eax, [eax + ecx*8 - 0x14514741]
add cl, byte [ecx + edi + 2]
add edi, 2
div al
add dl, cl
bts eax, 0x10
mov word [edi], dx
bswap eax
jmp ebp
mov dword [esp + ecx - 0x4974677d], eax
add eax, 0xa836811b
xor ebx, edx
sub ecx, 0x7c287638
add edi, edx
dec word [esp + 0xd]
neg cx
shl cl, 0xa3
mov ebp, dword [ebp]
jnp fcn.00485224
call fcn.004e020c
mov edx, 0x7d93ab85
lea edi, [edi + edx - 0x7d93ab89]
neg dx
sar dx, 0x8a
jns 0x4d9e42
inc eax
lea edx, [edx + ecx - 0x5e4938d9]
sal cl, 0x21
neg dl
xor ebx, eax
dec dx
add ecx, ecx
shl edx, 9
adc esi, eax
lea edi, [edi + edx*2 - 0x676f4004]
neg dx
sal cx, 0x48
mov ecx, dword [edi + edx*2 - 0x676ec000]
xor ecx, ebx
bswap ecx
movsx eax, dl
ror ecx, 3
push eax
neg word [esp + edx - 0x33b75ffe]
not ecx
adc al, 0x24
inc ecx
xor ebx, ecx
btc edx, eax
adc dl, byte [esp + edx - 0x33b7600d]
lea ebp, [ebp + edx*2 - 0x676ec024]
add al, al
rol dl, 0x44
mov dword [edx + ebp - 0x33b76001], ecx
lea ecx, [eax*8 - 0x1d42dd60]
shr eax, 0xcb
pop edx
jae 0x440afa
mov ecx, 0x919d7bae
mov eax, dword [esi]
shr ecx, cl
lea esi, [esi + ecx*8 - 0x1233a4]
xor eax, ebx
not ecx
ror eax, 1
movsx edx, cx
btc dx, 0x19
setb cl
dec eax
call fcn.004197df
mov ecx, 0x8e0b68bc
lea edx, [ecx*4 + 0x23368720]
or cl, dl
mov edx, dword [esi + edx - 0x5b642a10]
xor cl, cl
movsx eax, cl
lea esi, [esi + eax + 4]
xor edx, ebx
dec cx
and ax, 0x9d39
rol edx, 2
inc edx
sar cl, 0x26
bswap ecx
neg edx
lea edx, [ecx + edx - 0x2df1aee]
or al, al
jbe 0x420b90
mov eax, dword [edi + edx - 0x7d930015]
mov ecx, 0xacb20502
xor edx, 0xde3b0290
not edx
xor eax, ebx
neg eax
add ecx, ecx
sbb edx, edx
bswap eax
adc dx, cx
ror eax, 1
jmp 0x4d6cf5
Function at 0x46e134
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
inc dl
add esi, eax
push ecx
or ecx, ecx
mov eax, dword [esp + 4]
adc eax, 0xe5ae
jmp eax
add eax, esi
jmp eax
lea eax, [eax + edx + 0x12aa882e]
mov dword [esp + ecx - 0x56e10390], 0xc4a1e1b1
ror dword [esp + ecx - 0x56e10390], cl
adc dl, byte [esp + ecx - 0x56e1038e]
neg eax
rol eax, 2
xor dword [esp + ecx - 0x56e10390], ecx
adc dx, 0x918e
bswap eax
seta dl
ror eax, 1
neg dword [esp + ecx - 0x56e10390]
xor byte [esp + ecx - 0x56e1038f], dl
pop edx
not eax
ror dx, 0x47
rol edx, 0xdb
xor ebx, eax
sar cx, 0x21
adc edi, eax
neg cl
mov cx, word [ebp + ecx - 0x56e10138]
ror dx, 0xeb
adc ebp, 1
movzx eax, dx
movzx eax, byte [esi + eax*2 - 0x13cde]
add esi, 1
push edx
imul dx, dx
btr edx, 0x9f
xor al, bl
ror al, 1
and edx, 0x378ad817
shl dl, 0xc5
dec al
sal dword [esp + edx*8 - 0x10008100], 0x32
shr edx, 0x42
xor al, 0x95
rol edx, 0x44
sbb al, 0xf
call fcn.00482e87
mov edx, 0x5e0ba931
movsx ecx, dx
shr edx, cl
lea ebp, [ebp + edx*8 - 0x17829]
movzx edx, byte [edx + ebp - 0x2f05]
mov eax, ecx
and al, ah
xor dl, bl
add dl, 0x14
ror dl, 1
sal eax, 0x72
ror ax, 0x28
dec dl
neg al
ror dl, 1
sal ecx, 0xb7
cmovs ecx, eax
cwde
xor bl, dl
lea edi, [edi + eax*2 - 2]
or eax, ecx
cbw
imul eax, ecx
mov word [edi + eax], dx
not cx
call fcn.004253a3
mov edx, 0x7a2d8315
movzx ecx, dl
and dx, dx
mov eax, dword [edi + edx - 0x7a2d8315]
sal ecx, 8
mov dx, word [ecx + edi - 0x14fc]
not ecx
shr cl, 0x67
jns 0x4786d0
sub ebp, 4
mov edx, 0x9844402
mov edx, dword [ebp + edx*2 - 0x13088804]
mov ecx, 0x81003d36
xor edx, ebx
lea ecx, [ecx + ecx*8 - 0xecc2e7b]
lea edx, [edx + ecx*2 - 0x6f550ca6]
sub ecx, ecx
setns cl
xor edx, 0xf0bf6a08
add edx, ecx
xor edx, 0x1d08aa1a
mov eax, ecx
or ecx, eax
sal ecx, 0x7e
xor ebx, edx
add ecx, ecx
neg ecx
add esi, edx
mov eax, dword [edi + ecx - 0x80000000]
mov edx, dword [ecx + edi - 0x7ffffffc]
shl ecx, 0x3f
lea edi, [ecx + edi + 4]
neg cl
or eax, edx
not eax
neg ecx
mov dword [edi + ecx*8], eax
movzx eax, cx
bts ecx, eax
jae 0x446f18
adc edi, 5
and cl, 0xa0
adc cx, cx
mov word [eax], dx
lea eax, [ecx + ecx + 0x7cac50af]
lea ebp, [ebp + eax - 0x7cabf8b3]
dec ax
mov edx, dword [ebp + eax - 0x7cabf8ae]
sub eax, ecx
shr cl, 6
xor edx, ebx
rol ecx, 0x29
rol cl, 0x61
jb 0x45aa59
mov eax, dword [edi]
mov ecx, 0x7b1f0d89
mov edx, 0x21bd2f88
dec ecx
mov cx, word [ecx + eax - 0x7b1f0d88]
movzx eax, dl
btc eax, edx
lea edi, [edi + edx*2 - 0x437a5f0e]
add al, dl
mov word [edx + edi - 0x21bd2f88], cx
sar eax, 0x6b
and ax, ax
mov edx, dword [esi + edx*2 - 0x437a5f10]
lea esi, [esi + eax*2 + 4]
movzx ecx, ax
push eax
btc ecx, eax
xor edx, ebx
xor ax, word [esp + eax*2]
rol byte [esp + eax], 0xc7
xchg ecx, eax
sbb edx, eax
and al, 0x25
shr eax, 0x18
neg edx
shr cl, 0xc6
cwde
ror edx, 1
pop ecx
sub cx, ax
lea edx, [eax + edx + 0x2f8adf04]
shl cx, 0x68
sub eax, 0x9f04e80c
xor ebx, edx
shr ax, 0x8c
adc ax, ax
adc ebp, edx
idiv al
bts ecx, ecx
jb 0x425e58
jmp ebp
Function at 0x46fe0a
Capabilities:
Encode data using base64

Disassembly:
xor bl, cl
neg al
lea edi, [edx + edi - 2]
rol ax, 0x89
mov word [edi + edx], cx
or edx, dword [esi + edx*2]
add esi, 4
movsx ecx, ax
xadd dword [esp + 6], eax
or cl, 0x8e
xor edx, ebx
sar dword [esp + eax - 0x351efff6], 0x96
neg edx
idiv cl
sub eax, 0x4101c330
sbb edx, 0x9189490c
not edx
bswap edx
sal ecx, cl
Function at 0x47c9dd
Capabilities:
Encode data using base64

Disassembly:
adc edi, edx
pop ecx
pop edx
pop eax
jmp fcn.00418574

Function at 0x47f221
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xc8b21bae
btr cx, dx
lea eax, [esp + eax + 0xc]
mov dx, word [eax]
sbb edi, 1
movsx eax, byte [esp]
sar cx, 0x81
mov word [edi], dx
movsx edx, al
rol cl, 0x82
inc al
pop edx
pop ecx
pop ecx
jne fcn.004591d1
push 0x6aa89ab8
mov edx, dword [esp]
lea ecx, [edx + edx*4 - 0x13516f60]
mov ecx, dword [esi + ecx*2 - 0x3f32c70]
lea esi, [esi + edx - 0x6aa89ab4]
not edx
xor ecx, ebx
sub ecx, 0xe498a917
jmp 0x4dddd9
xchg dword [esp], edx
rol ecx, 1
not ecx
neg dl
xor byte [esp + edx - 0x6aa89a48], dh
or byte [esp + edx - 0x6aa89a48], dl
lea ecx, [ecx + edx*2 + 0x1d50b3a7]
call fcn.00481fde
mov ecx, 0x626cf87
mov ecx, dword [esi + ecx*2 - 0xc4d9f0e]
mov edx, 0x73bef303
lea esi, [esi + edx - 0x73bef2ff]
mov eax, edx
imul edx
mul eax
xor ecx, ebx
call fcn.0047a791
pop ebx
movsx eax, cx
sar eax, cl
mov edi, ecx
popfd
push edi
mov eax, dword [esp + eax - 0x54c]
push esi
mov edx, dword [esp + esi - 0x2a77]
call fcn.00491c1e
mov eax, 0x3b51d96
movsx edx, al
lea ebp, [ebp + eax - 0x3b51d9a]
imul dl
mov edx, dword [ebp + eax*4 - 0xed4af90]
movsx ecx, al
sub al, cl
xchg ch, al
xor edx, ebx
or al, 1
lea edx, [edx + eax*2 + 0x7d391499]
not edx
rol ecx, cl
jb 0x444099

Function at 0x493265
Capabilities:
Authenticate hmac

Disassembly:
ror ecx, 0xb8
mov dx, word [ebp + ecx - 0x2eef3884]
movzx eax, cx
jae 0x42eb38
xor ecx, 0xf2028db0
lea ecx, [ecx + eax*2 - 0x6cd5e4e2]
shl dl, 0xa1
neg ecx
not edx
xor ecx, 0x789e941d
bswap edx
cwde
not ecx
xor ebx, ecx
not edx
push edx
add esi, ecx
sar edx, 0x1b
pop eax
jne fcn.004cb8b7
mov edx, 0x6f1eb8bf
mov ecx, dword [esi + edx - 0x6f1eb8bf]
movzx eax, dl
bts ax, 0x31
sbb al, 0x35
lea esi, [esi + edx - 0x6f1eb8bb]
push edx
jno 0x44df53
sub ebp, 4
movzx ecx, al
mov eax, dword [ecx + ebp - 0xbf]
lea edx, [ecx*4 - 0x54e6e160]
or dl, dl
xor eax, ebx
not eax
push ecx
shr dl, 0xe2
inc eax
add dword [esp + ecx - 0x4d48b9d], eax
add edi, edx
mov edx, dword [esp + ecx*4 - 0x13522e80]
xor edx, 0x1dbbfb9e
mul eax
mov edx, dword [ebp + ecx - 0x4d48ba1]
mov dword [esp + ecx*2 - 0x9a91742], eax
jae 0x41920b
not dword [esp + ecx*2 - 0x9a9173e]
mov al, byte [ecx + ebp - 0x4d48b9d]
shl cl, 6
xor cl, cl
lea ebp, [ebp + ecx*2 - 0x9a915fa]
xor dword [esp + ecx*2 - 0x9a915fc], ecx
jle 0x49f0a9
mov byte [ecx + edx - 0x4d48b00], al
adc dword [esp + ecx*2 - 0x9a915fd], 0x24193b25
lea eax, [ecx + ecx + 0x5281f31e]
mov dword [esp + ecx*8 - 0x26a45800], edi
ret 4
lea eax, [ecx + eax + 0x64587aa4]
xchg word [esp + edx*2 - 0x59daa88], dx
shl edx, cl
not eax
xor ebx, eax
lea ecx, [ecx + ecx*2 - 0x6de2417a]
bswap edx
add edx, edx
adc edi, eax
pop edx
call fcn.004e223c
jmp 0x4da4c8
mov eax, 0x5abe9b3
imul eax, eax
mov ax, word [eax + edi - 0x8795329]
mov ecx, 0x3d325a0c
mov dx, word [edi + ecx*2 - 0x7a64b416]
Function at 0x494da0
Capabilities:
Encode data using base64

Disassembly:
xor dword [esp + ecx - 0x3ff03], ebp
ret
xor edx, ebx
not word [esp + ecx - 3]
xadd byte [esp + eax*2 - 4], ah
inc edx
bswap edx
xchg word [esp + eax*2 - 4], ax
pop ecx
ror edx, 1
push ecx
xor edx, 0xc28482b2
shr dword [esp + eax], cl
inc edx
sar dword [esp + eax], cl
neg edx
shl byte [esp + eax*2 + 1], 0xe1
dec edx
xor ebx, edx
add ebp, edx
shr cl, 0xe6
lea eax, [ecx + eax - 0x62e9ccd0]
jb 0x418b32
mov ecx, eax
shr eax, cl
mov ecx, dword [edx + eax - 3]
mov dword [edi + eax - 3], ecx
mov edx, dword [esi + eax*2 - 6]
mov ecx, eax
push ecx
not dword [esp + eax*2 - 6]
lea esi, [esi + eax*2 - 2]
not dword [esp + eax - 3]
jae 0x42752b
not ax
xor ax, 0x3eb3
sub dl, 0x8c
xchg ecx, edx
xor bx, ax
mov dword [esp + ecx - 0x34763db6], 0x5eb378a0
mov dword [esp + ecx - 0x34763dae], 0x32218684
lea ebp, [ebp + ecx - 0x34763db8]
bt edx, 1
mov word [ecx + ebp - 0x34763db6], ax
pop ecx
pop ecx
pop eax
jae fcn.004a3000
movzx cx, byte [ebp]
mov eax, 0x4bbabe81
cwde
mov al, byte [ebp + 2]
add ebp, 2
mov edx, 0x4b86bb09
bt edx, 0x15
btc dx, dx
not cl
shl dl, 0xc5
ror dx, 0xe8
and dl, 0x9e
not al
xor edx, 0xcc0979ad
and cl, al
mov word [ebp], cx
mov eax, dword [esi]
btr dx, dx
lea ecx, [edx*8 - 0x22ef7cd5]
setb dl
lea esi, [ecx + esi - 0x198b4bcf]
jb 0x4b0a79
mov edx, 0xcb8c3627
mov ecx, dword [esi]
lea eax, [edx + edx*2 + 0x5a2fd908]
sal eax, 0x94
btc eax, eax
adc esi, 4
ror eax, 0x9a
sub eax, eax
not eax
xor ecx, ebx
neg eax
ror ecx, 1
inc edx
xor eax, edx
lea ecx, [edx + ecx + 0x1e24ef01]
shr eax, 0x47
cdq
neg eax
xor ecx, 0x5819df02
call fcn.0046b3c0
push 0xd21ce738
add ebp, 4
shrd ax, dx, cl
mov word [ebp], ax
mov ecx, dword [esi]
mov edx, dword [esp]
movsx eax, dx
add esi, 4
idiv dl
xor ecx, ebx
ror dl, 0x22
xadd eax, edx
ror eax, 0x24
bswap ecx
cwd
pop edx
not ecx
jae 0x45c718
dec edx
neg ecx
ror ax, 0x65
btr dx, 0xbf
shl edx, 0x42
lea ecx, [ecx + eax - 0x27862dba]
rol eax, 0xa1
cwde
xor ebx, ecx
xadd dx, ax
neg dl
add edi, ecx
btc ax, 0xf
movzx ecx, dl
jmp edi
push ecx
xor eax, ebx
dec ecx
push edx
or edx, ecx
ror eax, 3
add word [esp + ecx*4 - 0x662d2f47], 0xaead
add dword [esp + ecx - 0x198b4bd1], 0xa92d28b
and ecx, edx
xor eax, 0xd33d331a
bt ecx, ecx
bt edx, 0x9b
xchg dx, cx
ror eax, 1
neg eax
inc dword [esp + ecx - 0x198b5bcf]
neg edx
rol edx, cl
bswap eax
or edx, ecx
xor ebx, eax
not ecx
inc cx
rol ecx, 0xe1
add edi, eax
sal byte [esp + 4], 6
pop ecx
pop eax
jmp edi
Function at 0x49d440
Capabilities:
Encode data using base64

Disassembly:
xchg byte [esp + edx - 0xb12261f], dl
xor eax, ebx
ror dl, 0xe1
xchg dword [esp + edx - 0xb122600], ecx
lea eax, [eax + edx*4 + 0x70411988]
pop ecx
ror eax, 1
bswap eax
sal ecx, 0x48
sar cx, 0x6f
lea eax, [edx + eax - 0x5fb4af27]
rol cl, 0x21
not eax
setbe dl
xor ebx, eax
lea edi, [edi + ecx*4 - 4]
mov dword [edi + edx*2 - 0x16244c02], eax
jmp 0x4ac0de
and edx, 0x2b9a66a5
jge 0x4d0fc3
shr eax, cl
dec dl
rol ecx, cl
xor al, ah
ror eax, 0xaf
ror dl, 1
inc dl
xadd cl, al
jno 0x48be03
add esi, edx
call fcn.004a7c0b
jmp fcn.004c48aa
adc ebp, ecx
movzx ecx, dl
mov dword [esp + edx - 0xb122620], ecx
xor cl, 0x24
mov eax, dword [esi + edx*4 - 0x2c489880]
adc esi, ecx
and cx, dx
jge 0x4862be
mov ecx, 0x27be8d17
neg dl
lea eax, [eax + ecx*4 + 0x238fd935]
shl dx, 0x41
sub dx, 0x928b
neg ecx
xor eax, 0x4000caa2
not ecx
ror eax, 3
bswap eax
and edx, 0x808d6b1e
inc eax
and ecx, ecx
setne cl
xor ebx, eax
shr ecx, cl
bswap edx
add edi, eax
jmp edi

Function at 0x4a7eae
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not eax
cmove ecx, dword [esp + edx*2 - 0x386f6b00]
bswap eax
jnp 0x42123a
sub edi, 4
mov eax, 0x4b186235
movzx edx, al
mov ecx, dword [edi + edx - 0x35]
ror eax, 0x5c
and ax, dx
not eax
xor ecx, ebx
ror edx, 0x46
add edx, eax
xadd edx, eax
neg ecx
jmp 0x4a2ec1
bswap ecx
ja 0x41abf8
xchg byte [esp + eax - 0x72a45e9b], ah
xor ecx, ebx
and dword [esp + eax - 0x72a4809d], edx
cmovnp dx, word [esp + eax - 0x72a4809c]
bswap ecx
shl dx, 0xc3
xor ecx, 0xf114e406
add byte [esp + eax - 0x72a4809d], 0x1f
dec ecx
dec edx
call fcn.0047fc7f
rol edx, 1
xor ebx, edx
sub ecx, ecx
adc ebp, edx
cdq
add ecx, ebp
jmp ecx
jmp fcn.0047f62b
sub ebp, 4
mov eax, 0x72a45e9d
mov dword [esp + eax - 0x72a45e9d], edx
dec cl
mov ecx, dword [ebp + eax - 0x72a45e9d]
jl 0x445fc1
jg 0x47b0bc

Function at 0x4abfdb
Capabilities:
Authenticate hmac

Disassembly:
xor bl, dl
or cl, cl
sbb cl, cl
lea edx, [esp + edx + 4]
cmovae ecx, eax
mov dword [esp], eax
cwde
or eax, dword [edx + eax*8]
sub edi, 4
xor ecx, ecx
inc dword [esp + ecx*4]
mov dword [ecx + edi], eax
movzx eax, cl
lea edx, [eax*8 + 0x613c8104]
shl word [esp + ecx], 0xce
lea ebp, [ebp + ecx*2 - 4]
and dword [esp + ecx*4], 0xa12c848a
adc ecx, dword [ebp + ecx*4]
xor ecx, ebx
pop eax
jmp 0x41921f
Function at 0x4b47ee
Capabilities:
Encode data using base64

Disassembly:
ret 8
adc edi, 2
push eax
ror ax, 0x21
shl edx, cl
mov dword [edi], edx
sub ax, ax
dec eax
pop edx
sbb ebp, 4
mov edx, dword [ebp]
dec al
movsx ecx, al
xor edx, ebx
add ax, ax
btc ax, 0x10
inc edx
idiv al
btc cx, 0x13
rol edx, 1
xor cx, ax
lea ecx, [ecx*8 + 0x61ae512f]
not edx
sub al, ch
sbb edx, 0xd6159db2
cwde
shr cx, 0xa8
xadd eax, ecx
xor ebx, edx
sal eax, 0x70
xor ax, ax
jb 0x446d0d
adc esi, edx
imul eax, ecx
jmp esi
shld dx, ax, cl
inc byte [esp + 4]
not dword [esp + 3]
mov word [edi], dx
sub ebp, 4
rol dword [esp + 4], 0xf9
jae 0x4b7b21
mov eax, dword [esi]
call fcn.0048a01f
adc edi, 4
push 0x8ea615a1
push 0x9da1ff8e
jmp 0x478f0b
xor eax, ebx
mov dword [esp], edx
neg cl
ror eax, 1
bts ecx, edx
jae 0x4d935f
mov dx, word [edi]
mov ecx, 0xcbbbe885
mov ax, word [edi + 2]
not ecx
shr ecx, cl
jbe 0x439ba5
mov cl, byte [ecx + edi - 9]
ja 0x483cef
neg edx
mov al, byte [edi + 4]
adc edi, 5
add edx, edx
inc edx
neg edx
mov byte ss:[ecx], al
movzx eax, dl
xchg edx, eax
lea ecx, [eax*2 + 0x935123a]
lea ebp, [ebp + edx*8 - 0x2fc]
btc edx, ecx
jb 0x445c6f
mov ecx, dword [ebp + edx*2 - 0x20000be]
not eax
call fcn.0045486f
mov eax, 0x5a14432f
mov edx, dword [eax + ebp - 0x5a14432f]
movsx ecx, al
xor edx, ebx
xor ax, cx
dec edx
rol byte [esp + ecx*8 - 0x175], 0x21
rol eax, cl
lea ecx, [eax + ecx*4 + 0x30a896a9]
not edx
cbw
xor edx, 0x7e322a8d
sub edx, 0xdcb1a487
push ecx
ror edx, 2
shr dword [esp + eax - 0x2180000a], 0x1c
je 0x420482
xor dword [esp + ecx - 0x5228c46f], 0xb10fdfb6
xor ebx, edx
not ecx
add esi, edx
and eax, eax
or byte [esp + eax - 0x21800008], al
movsx edx, al
mov dword [esp + eax - 0x2180000a], esi
ret 8
xor eax, 0x42bea12a
inc eax
shl byte [esp], 0xa2
rol eax, 1
xor ebx, eax
imul edx, dword [esp]
push edx
dec cl
add ebp, eax
xadd dl, dh
sar word [esp + edx - 0xa96c4f3], cl
mov dword [esp + edx*8 - 0x54b627a0], ebp
ret 4

Function at 0x4c618f
Capabilities:
Encode data using base64

Disassembly:
mul ax
not ecx
inc eax
xor ebx, ecx
call fcn.0049d440
lea eax, [eax + edx - 0x1efe9df0]
call fcn.00439282
mov ecx, dword [esi]
mov edx, 0xf91f2495
lea eax, [edx + edx - 0x12caede2]
add esi, 4
xor ecx, ebx
xchg edx, eax
inc ecx
bts edx, eax
rol ecx, 3
mul al
sub eax, eax
add eax, 0x67376d12
sbb ecx, 0xfb90d53a
cwde
jmp 0x44ca10

Function at 0x4dc703
Capabilities:
Encode data using base64

Disassembly:
xadd edx, eax
xadd dx, ax
pop edx
pop eax
pop ecx
jbe 0x440afa

Function at 0x4dd362
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
push eax
mov eax, 0x9c9ad91b
cdq
cdq
pushfd
movzx ebx, dx
push esi
xor al, bh
mov esi, ebx
jmp 0x4e0610
jmp 0x45118b
push edx
push eax
push 0x3092888b
mov dword [esp], ebp
push ebx
jmp 0x43d69b
Function at 0x4df6bb
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
movzx ecx, dl
mov cl, byte [ecx + esi - 0xd4]
neg edx
lea esi, [edx + esi - 0x17fb128]
btr dx, 0x1d
btr edx, edx
and al, cl
btc edx, edx
movzx ecx, dl
lea ecx, [ecx + ecx*2 + 0x1b821736]
not al
jb 0x4e08c0
add dl, dl
mov word [esi + edx*2 - 0x2ff2aa8], ax
movzx eax, dl
jge 0x418977
ror byte [esp + ecx - 0x23200098], 0xc3
adc edi, edx
mov edx, dword [ebp + ecx - 0x23200099]
call fcn.00448903
mov edx, 0xa013b58a
sar edx, 0x86
movzx ax, byte [esi]
jnp 0x42128d
xor edx, ebx
inc eax
xor edx, 0x46b3249e
inc edx
lea ecx, [ecx + ecx + 0x5d3f3883]
bswap edx
xor edx, 0xc239be84
not edx
add ecx, 0x4c08ac30
xor edx, 0xeba57318
mov dword [esp + eax - 0x76540001], 0xe94b906
not eax
and ecx, 0x272a8a99
xor ebx, edx
shl eax, cl
jbe 0x4ba1b8
xor eax, ebx
rol ecx, cl
ror ecx, 0xd4
sbb eax, 0x7a81a6b8
neg ecx
neg dx
rol eax, 1
inc cl
xor eax, 0x5f8d20be
sal ecx, 0xa5
ror cl, 0x21
ror eax, 3
ror dl, 4
xor ebx, eax
add ebp, eax
movzx eax, dl
jmp ebp