joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcf0e5f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push 0xf138c801
mov dword [esp + 4], ebx
lea esp, [esp + 4]

Function at 0xcf2271
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
mov ebx, 0xa68b170c
movzx edx, bx
mov dword [ebp + edx*8 - 0xb860], eax
shr bx, 0xce
xor ebx, ebx
pop ebx
call fcn.009a2418
mov edx, 0x769fbe94
push edx
movsx eax, dl
mov edx, dword [edx + ebp - 0x769fbe94]
btc ax, 0x8e
shl eax, 0x3e
sar ax, 0xad
mov ecx, dword [eax + ebp + 4]
lea ebp, [ebp + eax*2 + 8]
not dword [esp + eax]
cwde
mov dword [edx + eax*8], ecx
xor eax, dword [edi + eax*2]
mov edx, 0x97ba5619
add edi, 4
sub dl, dl
xor eax, ebx
or byte [esp + 1], dh
movsx ecx, dx
xor cl, byte [esp + ecx*2 - 0xac00]
dec eax
bt cx, 0x93
btr edx, 1
shl cl, 0xc5
not eax
xor byte [esp + ecx - 0x565d], ch
ror eax, 1
btc ecx, 0x96
not dx
not eax
bts edx, 0xa1
call fcn.00d0bd57
mov ecx, 0x3d2f861e
or cx, 0x9a81
movsx eax, cx
mov eax, edi
jl 0x8e3b36
mov cx, word [edx + eax - 0x9367ad]
lea esi, [esi + edx - 0x9367af]
xor dword [esp + edx - 0x9367a9], 0xb633bcbd
mov word [edx + esi - 0x9367ad], cx
inc dword [esp + edx - 0x9367a5]
call fcn.009b39e1
jae fcn.00c833ea
dec ebx
lea esp, [esp + 4]
jne 0xcef5b9
mov eax, 0x414a319
mov eax, dword [ebp + eax*8 - 0x20a518c8]
push 0x9d8550ae
push 0xe5319513
jmp 0x7ad157
lea edi, [ecx + edi - 0x3d2f9ea1]
push ecx
sar dword [esp + ecx - 0x3d2f9e9f], cl
mov word [edi + ecx*2 - 0x7a5f3d3e], ax
lea esi, [esi + ecx*2 - 0x7a5f3d42]
movzx edx, word [esp + ecx*2 - 0x7a5f3d3e]
mov eax, dword [ecx + esi - 0x3d2f9e9f]
xor eax, ebx
push edx
not eax
push ecx
call fcn.00c3f45e
mov eax, 0xda33d616
neg eax
mov eax, dword [ebp + ebx*4]
push 0x71229bb3
mov dword [esp], eax
call 0x86bf5b
lea ebp, [edx + ebp - 0x936081]
bt dx, cx
movsx eax, cl
movzx eax, byte [ebp + edx*8 - 0x49b0400]
xor al, bl
or dx, 0x672d
xor al, cl
mov dword [esp + ecx - 0x437fffff], edx
imul cx, dx
inc al
shl dword [esp + ecx - 0x437f984f], 0xc3
not cx
rol al, 1
neg al
xor bl, al
push ecx
neg word [esp + ecx - 0x437f67a6]
sar word [esp + ecx - 0x437f67ab], cl
lea eax, [esp + eax + 0xc]
jb 0x86bf2d
Function at 0xcf76c8
Capabilities:
Encode data using base64

Disassembly:
call fcn.00c4f793
push 0x33a39
add eax, edx
mov dword [esp + 4], 0x95945d00
dec word [esp + 0xa]
neg dword [esp + 7]
mov dword [ebp - 4], eax
inc dword [esp + 5]
shl dword [esp + 1], 0x5a
test ebx, ebx
jmp 0x954bbc

Function at 0xcf7900
Capabilities:
Encode data using xor

Disassembly:
call fcn.008b7e75
je 0x738bf1
lgdt [esi + 0x4ddfd9]
dec ecx
cmp bl, byte [esi - 0x2f]
fisttp word [ebp]
jns 0x738c20
mov dh, 0x79
fisttp word [ebp]
std
push ebx
push esi
mov ecx, 0x1004ddf
sub dword [esi - 0x3083dfa0], ebx
xchg ebx, eax
sub al, 0xc7
pop ss
inc edx
pushal
sar dword [ecx - 0x248e3ab6], 0xfe
invalid
cmc
or byte [ecx + 0x5d], ch
jge 0x738c53
imul ecx, edi, 0xcb96fa09
adc byte [esi - 0x73], dh
rol byte [edi + 0x131cb8b7], cl
enter 0xffffffffffffb8a3, 0xffffffffffffffff
push edx
jl 0x738c67
enter 0xfffffffffffffef6, 0xffffffffffffffce
pop esi
sahf
mov byte [0xb40f7a50], al
ret
loop 0x738c91
add dl, byte [ecx + 0x52]
imul eax, edi, 0xcc62cff4
pop esi
ret
iretd
iretd
mov ebx, edi
inc edx
popal
or eax, 0xc4d66987
xchg byte [ebp + 0x1e707176], bh
mov esp, 0x28917625
jbe 0x738c5b
and eax, 0x17ec8d76
test eax, 0x747189db
xchg eax, eax
lcall 0x5b5d, 0x795d106b
sbb esp, edx
test eax, 0xf3a8e4d5
xor bh, byte [edi + 0x2e2d766e]
mov dl, 0xe9
inc ecx
je 0x738c47
cmp al, 0xe2
daa
xor ebp, dword [ecx + 0x43]
pop esi
test eax, esi
fistp qword [esi + 0x4e1ba0f5]
imul esp, dword [edx], 0xffffffe5
jno 0x738cc7
push ss
je 0x738c88
sbb byte [ebp - 0x5b], 7
lcall 0x126e, 0x5d5f1122
test byte [edi + 0x3a], bh
xor edi, edx
mov bh, 0xac
fmul st(3), st(0)
ret 0x7fac
dec eax
lea esi, [esi + eax + 0x420eb4a4]
dec eax
mov esi, dword [esp + 0x78]
dec eax
mov dword [esp + 0x20], eax
dec eax
lea eax, [eax + eax - 0x2a7ec748]
push eax
dec eax
mov eax, dword [esp + 0x88]
jmp 0x738bc7
dec eax
mov edi, dword [esp + ebp + 0x70c24379]
dec esp
lea esp, [ebp + eax*4 + 0x42836093]
inc ecx
push eax
pop eax
dec edx
mov ebp, dword [esp + eax*4 + 0x40]
dec esi
mov ecx, dword [esp + eax + 0x48]
dec esi
mov ebp, dword [esp + eax + 0x50]
inc ecx
movsx esi, sp
cwde
cbw
dec edx
mov ecx, dword [esp + eax*8 + 0x58]
dec edx
lea esi, [eax*8 - 0x4c654b4c]
dec esi
mov eax, dword [esp + eax*2 + 0x60]
dec esp
mov esp, dword [esp + eax*4 + 0x68]
inc ecx
pop edx
inc ecx
pop edi
dec esp
mov edx, dword [esp + eax*4 + 0x60]
push eax
dec eax
lea eax, [eax + esi - 0x7cd548c9]
dec eax
lea esi, [eax + esi - 0x57707573]
dec esp
mov edi, dword [esp + 0x70]
jmp 0x7fd9f5

Function at 0xcf807d
Capabilities:
Authenticate hmac

Disassembly:
imul eax, dword [esp + edx*8 + 8]
adc cl, 0x35
xor bl, cl
lea ecx, [esp + ecx + 0x18]
or edx, dword [ecx + edx*4]
mov ecx, 0xa6b37298
mov dword [esi + eax*8 - 4], edx
ror al, 0x41
lea esi, [eax + esi - 4]
sal ax, 0xc8
cbw
pop eax
pop eax
pop ecx
pop edx
pop eax
pop ecx
jns fcn.009542f2
Function at 0xcfd96c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.008d91c6
inc ecx
mov esp, 0xa8b986bc
dec ebp
mov eax, dword [ebx]
inc ebp
movzx edx, sp
jmp 0x7a29ae
xor edx, edx
test eax, eax
jmp 0x83429e

Function at 0xcfe8a0
Capabilities:
Hash data using murmur3

Disassembly:
inc edx
or cl, 0x1d
or dword [esp + eax*2 - 0x5bd1043e], ecx
bswap edx
xor ebx, edx
lea ecx, [ecx*4 + 0x72a0432b]
add esi, edx
pop eax
mul dword [esp + ecx - 0x132d8d27]
mov eax, dword [ecx + ebp - 0x132d8d27]
jno 0xc5116d
mov edx, dword [ebp + ecx*2 - 0x265b1a4a]
dec dword [esp + ecx - 0x132d8d27]
btr cx, cx
mov cl, byte [ebp + ecx*4 - 0x4cb63494]
adc ebp, 6
push 0x7f99baae
shld eax, edx, cl
pop edx
sub dword [esp + edx - 0x7f99baae], edx
adc dword [esp + edx - 0x7f99baae], edx
mov dword [edx + ebp - 0x7f99baae], eax
rol word [esp + edx - 0x7f99baae], 0x46
mov dword [esp + edx - 0x7f99baae], esi
ret
bswap ecx
not ecx
xadd byte [esp + edx*4 - 0x70967d98], dh
inc ecx
rol word [esp + edx*4 - 0x70940196], 0xa
adc word [esp + edx*2 - 0x384a00cc], 0xbe88
sal ax, 0x49
xor ebx, ecx
cdq
btr ax, 0xbc
call fcn.00791266
adc dword [esp + eax - 0x4b5b], eax
lea ebp, [ebp + eax*8 - 0x25afe]
add dword [esp + eax - 0x4b5e], 0x2691703c
btr ax, ax
xor cl, bl
rol eax, 0x21
jb 0xcbee65
xor cl, 0x94
call fcn.00c95639
mov dword [esi + ecx*2 - 0x3604], eax
lea ebp, [ebp + ecx - 0x1b06]
lea edx, [ecx + ecx*2 + 0x1c251599]
mov ecx, dword [ebp + ecx - 0x1b02]
xor ecx, ebx
xchg dh, dl
movzx eax, dl
rol ecx, 2
rol eax, 0xd
push eax
jae 0x7baf98
mov edx, eax
mov eax, dword [esi + edx - 0x68820000]
shl dl, 4
add dx, cx
bts eax, 0xa2
rol edx, 1
lea eax, [eax + 0x7f902cac]
mov dword [esp + eax*2 - 0x5bd10442], ecx
jmp 0x783d3d

Function at 0xcfec1d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp], 0x8208243e
push 0xb1ad5384
adc eax, edx
mov dword [ebp - 4], eax
shl dword [esp + 2], 0xb6
test ebx, ebx
call fcn.007d64de
Function at 0xd00705
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.00909c9d
call fcn.007d448c
adc ebp, edx
lea esp, [esp + 8]
push 0x2636f18f
call fcn.00789a4c
mov dword [esp], eax
jae 0x97dc41
mov edx, 0x930993a2
lea eax, [edx + edx*2 - 0x775dbd63]
mul dx
mov edx, dword [ebp + eax - 0x41bea5e6]
lea ebp, [ebp + eax - 0x41bea5e2]
xor edx, ebx
mov ecx, 0x8e36e41b
sal ecx, 0x6c
sbb al, ch
neg edx
xor edx, 0x459e78aa
add cx, ax
not edx
shl eax, cl
or eax, eax
neg edx
xor ebx, edx
or al, 0x2d
adc ax, ax
sub ecx, ecx
adc edi, edx
xor cl, byte [ebp + ecx*2]
movsx edx, al
imul dl
lea ebp, [ebp + edx*8 - 0x2cf]
call fcn.00c4faea
jae 0xcd0259
lea esp, [esp + 0x14]
je 0x81e306
mov eax, 0xb089e2ab
mov eax, dword [ebp + ebx*4]
push 0xeb306794
ror word [esp + 1], 0x89
jae 0x96e7ae
movzx dx, byte [esi]
mov al, byte [esi + 2]
mov ecx, 0x80163bf
lea ecx, [ecx*8 + 0x31016d14]
ror ecx, cl
adc esi, 1
imul cx, cx
setno cl
or dl, al
rol ecx, 0x95
dec ecx
movzx eax, cl
not dl
lea eax, [ecx - 0x7d76d8d0]
mov word [eax + esi - 0x29f4022], dx
cdq
inc al
mov ecx, dword [ebp + eax*2 - 0x53e8046]
lea ebp, [eax + ebp - 0x29f401f]
dec eax
xor ecx, ebx
lea ecx, [ecx + eax - 0x5b3e7e3f]
shr ax, 0xc4
neg ecx
jmp 0x773083

Function at 0xd00962
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add eax, eax
or cl, dl
dec eax
push eax
cwde
not cl
lea edx, [eax*2 + 0x3e3da4b6]
mov word [eax + esi - 0x2125], cx
xor eax, 0x788c481c
mov edx, dword [ebp + edx*2 - 0x7c7bce00]
bts eax, eax
bts eax, eax
lea ecx, [eax*8 + 0x3032c0a6]
lea ebp, [eax + ebp - 0x7a8c6935]
and eax, eax
xor edx, ebx
pop eax
bswap eax
rol edx, 1
cwde
lea edx, [edx + eax*4 - 0x197049c]
bswap edx
xor edx, 0xc0309c2f
sub cx, 0xf716
lea edx, [edx + eax - 0x9a8b9c]
or ecx, 0x6e2b7e0a
xor ebx, edx
div cl
add edi, edx
sal eax, cl
jmp edi
dec cl
cmovge ecx, eax
xor ebx, edx
add eax, ecx
add esi, edx
movzx edx, byte [ebp - 8]
pop eax
movsx eax, cl
lea ebp, [ebp + eax*2 - 0xd8]
and eax, eax
rol cx, 0x87
xor dl, bl
xor dl, 0x95
dec dl
add ecx, ecx
neg dl
bt ax, cx
adc dl, 0x9f
xor bl, dl
bt ecx, 0x8e
add edx, esp
sub ecx, ecx
adc ecx, dword [edx + ecx*8]
push eax
sub word [esp + eax - 0x66], 0xe994
sbb al, al
mov dword [eax + edi - 0x101], ecx
bt eax, eax
or ax, ax
lea edi, [edi + eax*8 - 0x7fa]
pop eax
jno fcn.00c9bff2
mov ecx, 0xf2368305
movzx cx, byte [esi]
mov edx, 0x31aa9093
movzx eax, dx
and edx, eax
mov dl, byte [edx + esi - 0x9091]
lea esi, [esi + eax - 0x9091]
jno 0xcd3a25
Function at 0xd03ec9
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov edx, dword [esp + edx - 0x3184cd6e]
dec esp
mov edi, dword [esp + esi - 0x19b5]
push esi
dec eax
mov dword [esp + eax - 0x318419e4], 0xfb1c2f2f
dec eax
mov esi, dword [esp + eax - 0x318419a5]
xchg dword [esp + eax*2 - 0x6308344b], eax
call fcn.00d05872
xchg cl, dl
rol eax, 2
sal ecx, 0xbc
not ecx
not cx
lea eax, [eax + edx*4 - 0x41132822]
shl edx, 0xd0
xor ebx, eax
not cl
add esi, eax
movzx edx, byte [edi + edx - 0x80000000]
and cx, cx
adc edi, 1
mov eax, ecx
xchg ch, cl
xor dl, bl
sar ax, 0xc1
adc dl, 0x24
and ecx, eax
ror eax, 0x32
rol dl, 1
rol cl, 0xe1
setno al
sbb dl, 0x82
ror dl, 1
sub al, ch
dec cl
adc dl, 0x86
sar cl, 0x84
xor bl, dl
ror eax, cl
or cx, cx
sar al, 0xe2
add edx, esp
sub cx, cx
xor cl, 0xb3
adc ecx, eax
mov cx, word [edx]
lea edx, [eax - 0x5e4c265b]
sbb edx, 0xb4097599
lea ebp, [ebp + edx - 0x6dea620d]
mov word [ebp + edx - 0x6dea620b], cx
jbe 0x9185b9
call fcn.00915115
inc ecx
push esp
inc bp
xchg edx, eax
dec esp
mov eax, dword [esp + eax - 0x318419d5]
jmp 0x929e70
and edx, eax
sal al, 0x41
je fcn.00882a69
jl 0x9185f3
in eax, dx
add dword [esi], ebx
push ecx
shr dword [edi + 0x4613d100], 1
jmp 0x3d9235a6
shr dword [edi + 0x5ef82d00], 1
inc eax
sahf
iretd
mov ebp, 0x49630000
mov fs, word [ebx]
mov dh, byte [esi + 0x2af97808]
adc al, 0xc6
or bh, dh
lahf
jg 0x9185df
inc edx
popal
ror byte [ebx + eax*4], 0xc5
lcall 0xf0ed, 0xd68f6ffa
push esp
pop edi
fist word [edx + 0x27]
mov eax, dword [0x6f13b9f7]
sahf
or edi, edi
push edx
jl 0x91864f
enter 0xffffffffffffc339, 0xffffffffffffff9b
int 0xf5
xchg esi, eax
invalid
sub esi, eax
pop edx
mov ah, 0x1f
mov byte [0xfd7ca2d5], al
push esp
sahf
add byte [ecx], bh
mov dword [0xd4], eax
add byte [edi], ch
add byte [eax], al
add byte [eax], al
das
dec edi
pop es
adc ebp, dword [edi]
sub al, 9
das
jnp 0x91863f
sub cl, byte [eax - 0x43d9b7b0]
invalid
inc edx
movzx esi, word [esp + edx - 0x3184cd9e]
dec esi
mov esp, dword [esp + edx - 0x3184cd7e]
jmp 0xce15f7
push esi
jmp 0x7c0ac9
test ecx, ecx
jmp 0x8079f0

Function at 0xd046b8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor bl, cl
and eax, dword [esp + edx - 0xe0f013]
adc dx, word [esp + edx*2 - 0x1c1e033]
sal al, 4
lea ecx, [esp + ecx + 0x10]
bts eax, 0x9f
cwde
movzx dx, byte [ecx + edx*2 - 0x1c1e04e]
mov word [edi + eax - 2], dx
dec eax
lea edx, [eax + eax - 0x1ae70d64]
sbb edi, 1
pop edx
pop ecx
pop ecx
pop eax
jmp fcn.00c9bff2
mov dword [esp + eax - 0x2194fe7f], 0x72396e23
mov ecx, dword [edx + eax*2 - 0x4329fcfe]
lea edx, [eax*8 - 0x11dd8544]
btc eax, edx
xor dword [esp + eax - 0x2184fe7f], eax
mov dword [ebp + eax*2 - 0x4309fd06], ecx
call fcn.00cfa16a
xor cl, bl
ror cl, 1
bts eax, eax
ror eax, 0xa3
not eax
neg cl
inc word [esp + edx*2 - 0x1fff5]
xadd edx, eax
bswap edx
sbb cl, 0xb7
ror byte [esp + edx - 0xe0f017], 0x81
sbb dword [esp + edx - 0xe0f01c], edx
adc eax, 0xfebea995
ror cl, 1
jmp 0x842d10
Function at 0xd0909e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
adc ebp, 3
lea edx, [eax + eax*8 + 0x38262fb8]
and dx, 0xbb1d
not edx
xor ecx, ebx
btr dx, dx
cbw
imul eax
xor ecx, 0x5103e908
not dword [esp + edx*4 + 4]
mov dword [esp + edx*8 + 4], eax
call fcn.00c411b2

Function at 0xd09a5e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rol edx, 1
ror al, 6
adc ecx, ecx
adc al, 0xa9
not edx
sub ecx, dword [esp + 1]
jne 0x839e79
imul ax, ax
xor ebx, edx
add edi, edx
mov dword [esp + ecx - 0x129b41ee], edi
ret 4
adc al, ah
xor edx, ebx
mov dword [esp + eax - 0x1b021223], eax
sal ecx, 0x28
btr ecx, 0xab
ror edx, 1
mov dword [esp + eax*4 - 0x6c08489c], eax
dec al
lea eax, [eax*4 + 0x31baf730]
sub edx, 0x43369e33
rol dword [esp + 2], 0x86
xor edx, 0x6e079324
add dword [esp + 3], 0x5e822280
jge 0x78f61c

Function at 0xd09ee9
Capabilities:
Encode data using base64

Disassembly:
jb 0x8ef5fc
ljmp 0x6141:0xa345a152
shr edx, 2
movsx ecx, dx
mov eax, dword [edx + edi - 0x24631e3c]
mov dword [esp + edx - 0x24631e3c], 0x5d86518c
imul dx, word [esp + edx - 0x24631e3c]
call fcn.007db324
mov ecx, 0xd1bdc5ae
btr ecx, ecx
mov edx, ecx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
and edx, 0x782e46a5
ror edx, 0x32
push ebx
lea ebx, [edx + 0x7a136b05]
btr ebx, edx
cpuid
jb 0x901976
mov ecx, 0xb214fe32
mov eax, ecx
movzx edx, cl
mov edx, dword [esi + edx - 0x36]
xor edx, ebx
not edx
ror cl, 0x41
bswap edx
xor edx, 0xcebb4638
lea eax, [eax*4 + 0x642243b7]
rol cx, 0x4d
dec cx
neg edx
bt cx, cx
xor ebx, edx
xor al, ah
add al, al
or ax, cx
mov dword [ebp + eax - 0x2c763fca], edx
movsx edx, ax
mov edx, dword [eax + ebp - 0x2c763fca]
mov eax, dword [ebp + eax*2 - 0x58ec7f8c]
btr ecx, ecx
sar cl, cl
or edx, eax
not edx
and cl, ch
adc cl, cl
mov dword [ebp], edx
movzx edx, cx
sar ecx, 0xa
adc ecx, ecx
mov edx, dword [esi + edx*2 - 0x7ec8]
sub ecx, 0x48386b9e
adc esi, 0xfffffff8
shl cl, cl
xor edx, ebx
jmp 0xc8e02c
Function at 0xd0c10d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rol eax, 0x22
xor ecx, ebx
bswap edx
lea ecx, [ecx + edx + 0x40736a66]
bswap ecx
sal al, 0xc5
dec ecx
call fcn.00863468
out dx, al
or dh, byte [esi]
neg ecx
shr ax, 0x49
cmovne dx, ax
xor eax, edx
rol ecx, 2
btc eax, edx
jb 0x90aa9a
sal edx, 0x8a
ror ax, 0x84
lea ebp, [ebp + eax - 0x800a]
jne 0x81c6f8
mov dword [esp + eax*2 - 0x47800048], eax
shr edx, cl
shr dword [esp + eax*2 - 0x47800040], 0x58
cwde
mov dword [esi + eax*2 - 0x48], edx
call fcn.009a0298
test eax, 0xe9c37e52
pop edx
inc edi
inc ebx
add dword [eax - 0x6f1dba77], 0xffffffe7
jl 0xd0c0de
sub byte [esi - 0xa831870], bl
push ecx
out dx, eax
cwde
loopne 0xd0c1c0
int 9
hlt
dec esi
in al, 0xd3
dec esp
loopne 0xd0c22d
xadd dword [esp + ecx*8 - 0x7f], ecx
lea esi, [esi + ecx*4 - 0x3ff8]
shr ecx, 0x83
mov dword ss:[edx + ecx*8 - 0x1000], eax
mov dword [esp + ecx*2 - 0x400], edi
ret
push ecx
add al, 4
xor al, 0x26
add cx, dx
adc dl, ch
sbb al, 0x8b
sub cx, 0x68a2
ror word [esp + edx + 2], 0x49
neg ecx
xor bl, al
sub cl, byte [esp + edx*2 + 3]
inc ecx
lea edx, [edx + ecx*8 + 0xc993585]
lea eax, [esp + eax + 8]
movzx cx, byte [eax + edx*2 - 0x1928f53a]
lea esi, [esi + edx*2 - 0x1928f53c]
movzx eax, dx
mov word [esi + edx*4 - 0x3251ea74], cx
lea ebp, [ebp + edx - 0xc947aa1]
mov eax, dword [ebp + edx*2 - 0x1928f53a]
rol dword [esp + edx*2 - 0x1928f536], 0xb9
lea ecx, [edx + edx*2 - 0x2cd36cd9]
xor eax, ebx
push ecx
xor dx, 0x2386
je 0x99970a
inc eax
sar ecx, 0x39
rol eax, 3
dec eax
sub dx, 0x4737
adc edx, 0x63ac97b2
rol eax, 1
neg eax
sub dword [esp + edx - 0x7040a996], ecx
inc dword [esp + edx - 0x7040a993]
ror eax, 2
lea ecx, [ecx + ecx*8 + 0x39aa57b0]
xor ebx, eax
add edi, eax
pop edx
pop eax
pop eax
jmp fcn.00c570a1
Function at 0xd0c95e
Capabilities:
Encode data using xor

Disassembly:
sar byte [esp + edx + 2], 0xa7
lea ecx, [esp + ecx + 4]
and dl, ah
inc word [esp + edx*8 + 2]
jl 0x83268b
or eax, dword [edx + ecx]
lea ecx, [edx*8 + 0x78223b8c]
call fcn.008adb31
mov ecx, 0xff9f85b0
movsx edx, cx
movzx eax, cl
lea esi, [eax + esi - 0xb4]
shl edx, 0x51
mov eax, dword [esi + edx*2 - 0x16c00000]
ror cl, 0x21
sar edx, cl
dec cx
xor eax, ebx
inc edx
inc eax
add ecx, 0xe01b3602
add dx, 0x2d24
shr cl, 0x23
xor eax, 0xa1b6fc9b
lea edx, [ecx*8 + 0x41ba632a]
dec eax
or cl, 0xbc
btc cx, 0xb1
ror eax, 3
btr ecx, ecx
sub cl, cl
xor ebx, eax
add edi, eax
bswap edx
mov eax, dword [ebp]
lea ecx, [edx + edx + 0x6fabf834]
bts cx, 0x93
shr cl, 0x42
mov cl, byte [ebp + ecx - 0x7423182a]
adc ebp, 1
sal dl, 0xc6
add edx, edx
inc edx
sal eax, cl
mov ecx, 0x48b6fe9b
mov dword [edx + ebp - 0x4772181], eax
push edx
xor byte [esp + edx - 0x4772181], 0x17
mov eax, ecx
mov dword [esp + edx*4 - 0x11dc8604], edi
ret
ror cl, 1
xor cl, 0x2c
inc eax
shr dword [esp + edx], 0x16
rol cl, 1
mul byte [esp + edx*2 + 3]
xchg word [esp + eax + 1], dx
cbw
sbb cl, 0x1f
bts dx, ax
rol eax, 0xbf
shl ax, 0xe
xor bl, cl
sal eax, 0xc3
jbe 0x738e45
jmp 0x833d4c
and eax, ecx
dec edx
call fcn.008584ee
add esi, 4
call fcn.00c3fffb
shl dx, 0x85
xor cl, bl
cwde
mov dword [esp + edx], edx
sal al, 0xa2
xor cl, 1
sub word [esp + edx], 0xf32d
sbb cl, dl
inc dx
xor edx, 0x4eb7ef9a
shr dl, 0xa3
rol cl, 1
btc edx, eax
cdq
shl eax, 0x48
dec cl
ror cl, 1
and dl, 0xa
ror edx, 0xf0
sal word [esp + edx], 0xe6
adc cl, dl
add ax, 0xd1a1
ror edx, 0x1e
js 0x73c422
lea esi, [esi + edx - 0x7f]
mov dword [esp + ecx*2 - 0x1fffe], eax
popfd
mov eax, ecx
jmp edi

Function at 0xd0e187
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0x2c3e71be
rol eax, 3
inc ecx
push ecx
inc ecx
movsx edi, al
xor dword [esp + edx*2], eax
inc ecx
pop ecx
inc esp
movzx esi, bh
dec ecx
lea ebx, [eax + edx - 0x67ec636b]
dec eax
arpl ax, ax
inc ebp
mov ebp, eax
inc cx
dec edi
dec eax
bswap edi
dec eax
add ebp, eax
dec eax
mov esi, dword [edx + esi]
bts bx, di
jb fcn.0073c0e6
mov esi, dword [esp + 0xc]
pop ebx
push 0x98a5942b
mov ecx, dword [esp + 0x10]
not dword [esp]
call fcn.007bb871
mov edx, 0xb2bb982b
inc ecx
mov eax, dword [ebx]
dec eax
xor edx, edx
dec ebp
lea ebx, [ebx + edx*2 + 4]
inc ecx
xor eax, ecx
rol eax, 1
inc esp
movsx eax, dl
inc esp
movsx edi, dl
lea eax, [eax + edx + 0x130a559b]
jmp 0x76fa7c
Function at 0xd101bc
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor

Disassembly:
inc ecx
push ecx
dec edx
lea eax, [edx*8 + 0x399c3d92]
inc ecx
bts edi, 0x27
inc edx
xor dword [esp + edi - 0xaaa5d91], ebx
inc ebp
mov esp, eax
inc ecx
pop ecx
dec eax
arpl bx, bx
dec eax
and edx, ecx
dec ecx
mul edi
dec eax
adc ebp, ebx
inc ecx
mov ebx, esp
inc ecx
xchg esp, eax
dec esp
mov esp, dword [edi + esi - 0x65ae3e08]
inc ecx
xchg dl, cl
inc ebp
movsx esi, dx
inc bx
movzx edi, byte [esp + edi*2 - 0x1554bb22]
inc ecx
dec al
dec ecx
lea esi, [edi + esi - 0xaaa5d8b]
mov word [esi + ecx + 0x4997642b], di
dec eax
lea edi, [ebx - 0x5c4f6458]
cwde
dec eax
div eax
dec eax
add edx, ebp
jmp edx
lea eax, [esp + eax + 4]
imul ecx, edx
push edx
push ecx
xor dl, byte [eax + edx*2]
mov word [ecx + esi - 4], dx
pop ecx
movzx edx, cl
imul edx, ecx
lea esi, [esi + ecx - 4]
shl byte [esp + ecx], 2
not edx
pop edx
pop ecx
jbe fcn.009542f2
mov edx, 0x393ecb8d
lea ecx, [edx + edx*4 - 0x1ff42fe8]
lea ecx, [edx + 0x22b4ed31]
movzx edx, byte [edx + ebp - 0x393ecb8e]
and ecx, ecx
movsx eax, cx
xor dl, bl
inc al
call fcn.009aec0c
add cx, 0x8c02
sub al, 0x9f
bt ax, 0x8b
xor bx, cx
mov word [ebp + eax*2 - 0x1f07b4e6], cx
mov dword [esp + eax*4 - 0x3e0f69bc], 0xeb0eb61b
imul byte [esp + eax*2 - 0x1f07b4de]
lea ebp, [eax + ebp - 0xf830bbd]
pop eax
jo fcn.00882a69
inc ecx
mov ebx, dword [ebx]
mov edi, 0x65ae3e08
inc ecx
mov edi, 0xaaa5d91
dec esi
lea ebx, [edi + ebx - 0x65ae3e04]
dec esi
lea edx, [edi + edi*8 + 0x619b3b8]
inc ecx
xor ebx, ecx
ror ebx, 1
dec ebx
lea ecx, [edi + edi*4 - 0x7eeb37f5]
inc ebp
movsx ebp, dl
movzx edx, cx
lea ebx, [ebx + ecx*4 + 0x6abfdbc2]
inc ebp
movzx eax, dx
dec ecx
add edx, 0xdd8c2c8d
rol ebx, 1
inc ebp
or ebp, edi
not ebx
jne 0x855388
or dword [esp + eax - 0x61936333], 0x8faf8eb6
xchg dword [esp + eax - 0x6193632f], eax
rol edx, 1
neg edx
cwde
not edx
dec edx
xor ebx, edx
add esi, edx
cbw
cwde
mov ecx, eax
mov al, byte [ebp + eax - 0xa]
ror dword [esp + ecx*4 - 0xd], cl
movzx edx, word [esp + ecx*8 - 0x1c]
or ecx, 0xa39b3d89
lea ebp, [ebp + edx*2 - 0x1fe04]
inc dx
jo 0x920d87
shr cl, 0x86
xor al, bl
not al
and byte [esp + edx - 0xff00], ch
inc al
sar byte [esp + edx - 0xfef6], cl
shr ecx, 0x19
sbb cx, word [esp + ecx*2 - 0x9e]
xor al, 0xf
imul ecx, edx
bts edx, 0x23
ror al, 1
shl cl, 0xe3
xor bl, al
lea eax, [esp + eax + 0xc]
mov ecx, dword [eax + ecx*2 - 0x29f5e00]
movzx eax, byte [esp + edx - 0xff00]
xor byte [esp + edx*8 - 0x7f838], 0x8b
bts edx, 0x9f
mov dword [edi + eax*2 - 0xce], ecx
lea edi, [eax + edi - 0x6b]
pop ecx
pop ecx
pop edx
jae fcn.00c9bff2
mov edx, 0x2ab46d25
mov ecx, dword [esi + edx*2 - 0x5568da4a]
lea eax, [edx + edx*4 + 0x50ba8f31]
inc eax
mul edx
movzx dx, byte [ecx + edx - 0x66192d2]
movsx ecx, ax
lea esi, [esi + eax*8 - 0x2f4d07b6]
call fcn.00d02e67
not edx
dec dx
mov ebp, edi
mov ebx, edx
sub ebx, eax
mov ebx, ecx
setns dl
setno dl
mov edx, ebx
ror al, 0x46
xadd al, ah
sal edx, 2
mov eax, ebp
call fcn.007551ff
xchg dword [esp + eax*8], eax
ror ecx, 3
xor ebx, ecx
call fcn.00c9b0e8
Function at 0x40faa4
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push esi
push eax
push 1
push eax
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x40fad9
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
leave
ret
push str.unable_to_create_tls_index
lea ecx, [ebp - 0x1c]
call fcn.004045d0
push 0x4161cc
lea eax, [ebp - 0x1c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x410100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call fcn.004102c1
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41011c
mov dword [eax], ecx
jmp 0x41011e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410190
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x464f54
Capabilities:
Encode data using xor

Disassembly:
jg 0x464fbf
or eax, 0x9a7716e4
push 0x5b7bc56d
out dx, eax
dec edx
mov dh, 0x3f
mov esp, 0x635e53b9
in al, 0x2c
push eax
jnp 0x464fdf
mov ecx, 0x7a160f66
jne 0x464f76
invalid
inc esp
sbb eax, 0xcf7f4d96
or edi, edi
stosd dword es:[edi], eax
sub al, 0x81
inc ebx
pushfd
out 0x7b, eax
xchg ebx, eax
invalid
mov ecx, 0xf87893ca
test eax, 0xf7dc6863
inc ebx
add dword [ecx - 0x3ad34f33], edi
sub al, 0xc5
cmp eax, 0x6dc1af0d
xor al, 0x51
ja 0x464fa6
out 0xec, al
in al, dx
mov ecx, 0x66757289
dec esp
xchg ebp, eax
xlatb
sub eax, 0xca805a2c
add byte [esi], al
in al, dx
pushal
jbe 0x464fe2
push eax
jnp 0x46504f
aaa
inc ebx
mov dword [eax], esi
loopne 0x464fb5
jae 0x464fff
std
pop ecx
jmp [eax - 0x381f8357]
out dx, al
invalid
invalid
wait
les esp, [eax - 0x4bd7787]
inc edx
sub dword [eax + edx*8 + 0x60], eax
inc esp
shl byte [eax + 7], 1
pop es
or ah, byte [ebp - 8]
pop esp
sub eax, 0xa56af470
ror dword [esi - 0xf00c3dd], 0x7b
push ss
or esi, dword [ecx + 0x2d]
inc esp
xor dword [esi + 0x3b], edi
mov fs, word [ebx]
cmp al, 0xff
invalid
sub eax, 0x3b7e3144
jno 0x46505d
dec eax
sti
xchg esi, eax
mov ebx, 0x7df0ebe1
cmp edi, 0x771129f2
push cs
wait
cmp bh, dh
add ebx, dword [edx + 0x31]
mov dh, 0x93
loope 0x465066
je 0x465009
and byte [eax], cl
bound ebx, qword [ebp + 0xae442db]
jbe 0x465046
fcomi st(7)
jbe 0x465052
fisttp dword [ebp - 0x5b8e8f4a]
adc byte [0x4622478c], dh
mov word [ebp - 0x79f04b74], fs
cmp dword [ecx - 0x96], 0x17af7bf0
xor ah, byte [ebx - 0x62]
dec eax
invalid