joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc9000e
Capabilities:
Encode data using base64

Disassembly:
ror cl, 1
inc sp
sub esi, dword [esp + esi*2 - 0x19b101f4]
inc cx
rol edx, 0x46
shl dword [esp + esi - 0xcd880f3], 0x54
xor cl, 0xac
inc ecx
mov edi, ecx
dec cl
rol cl, 1
inc esp
xor ah, cl
inc ecx
pop ebp
push esi
dec eax
lea ecx, [esp + ecx + 0x10]
inc sp
mov ebx, dword [esi + ecx - 0xcd880fe]
dec ecx
btc ecx, 0x3a
mov ecx, eax
rol byte [esp + esi - 0xcd880fb], 0x46
dec eax
lea ebp, [ebp + edx*2 - 2]
inc sp
cmovae ecx, dword [esp + esi*2 - 0x19b101f2]
inc ecx
setb dh
inc sp
mov dword [edx + ebp], ebx
setb cl
pop ecx
pop esi
jb fcn.011a3bd5

Function at 0xc90076
Capabilities:
Encode data using base64

Disassembly:
xor ebx, ecx
add ebp, ecx
not eax
mov edx, edi
movsx ecx, al
lea ecx, [ecx + eax*8 + 0x67104aa9]
ror ax, 0xe3
mov dword [edi + eax*4 - 0x8004], edx
inc dword [esp + eax*2 - 0x3ffc]
lea edi, [edi + eax - 0x2004]
pop eax
pop ecx
jne fcn.00c19dd7

Function at 0xc92158
Capabilities:
Encode data using base64

Disassembly:
dec ecx
bts esi, 0x3a
inc ecx
adc dl, 0x82
inc ecx
rol dl, 1
inc eax
movsx esi, bh
inc cx
and ecx, ecx
inc ebp
xor ah, dl
inc esp
sub byte [esp + ecx + 0xf58e], ch
call fcn.00e9b22c
neg dl
not dl
xchg ecx, eax
sub dl, 0x8c
xor bl, dl
push eax
sal ax, 0xee
je 0xe6f05c
dec eax
lea ebp, [ebp + ecx - 0x6290a23]
dec eax
or ecx, edi
dec eax
mov dword [esp + ecx*2 + 2], 0x8f28068b
inc ebp
movzx edx, byte [edi + ecx*2 + 6]
inc ecx
movzx edx, cx
dec ebp
lea edi, [edi + ecx*4 + 9]
dec ecx
ror ebp, cl
push edx
inc ebp
xor dl, ah
dec eax
and edx, 0x448a71b3
and dword [esp + ecx*8 + 0x10], 0xa3a40298
inc ecx
dec eax
inc ecx
adc dl, 0xbc
inc ecx
push esi
inc ecx
rol dl, 1
inc ecx
sub dl, 0x8a
dec ecx
imul ecx, esi
inc ecx
neg dl
inc ecx
xor dl, 0x19
jmp 0xb889d9
lea edx, [esp + edx + 4]
call fcn.00e8ed70

Function at 0xc92690
Capabilities:
Encode data using base64

Disassembly:
mov edi, 0xd315b71b
sar edi, 0x74
movzx edi, byte [eax]
push 0xe134e103
push 0xe491558d
rol dword [esp + 2], 0x41
xor edi, ecx
and edi, 0xff
mov edi, dword [edi*4 + 0xb8fa8c]
call fcn.00ca2a64
xor ecx, 0x801b14ad
sar dword [esp + 0x13], 0x41
dec edx
push 0x2bb3fe30
lea esp, [esp + 0x1c]
jne 0xc30d91
call fcn.011671fb

Function at 0xc926b0
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0xc], 0xa7144dab
lea esp, [esp + 0xc]
call fcn.00c9de6a

Function at 0xc97bba
Capabilities:
Execute syscall

Disassembly:
xor eax, ebx
inc eax
xchg ch, dl
rol ecx, 0x44
mov dword [esp + edx - 0x1706], edx
not eax
add ecx, 0x4f8698ab
jp 0x11e22d2
syscall
push ecx
dec eax
mov dword [esp], 0xc9ad5b44
call fcn.00b8835b
in eax, 0x4f
ret
sub dl, byte [esp + edx*2 - 0x2e0b]
neg eax
and cl, byte [esp + edx*2 - 0x2fde]
dec cx
dec eax
and dl, dh
xor dx, 0x798b
xor ebx, eax
xor dx, word [esp + ecx - 0x5b19d502]
sbb cx, word [esp + edx*2 - 0xdd34]
shl edx, cl
mov dword [ecx + ebp - 0x5b19d4ff], eax
btr dx, cx
lea ebp, [ebp + edx*8 - 0x1ba67c]
inc dword [esp + edx*4 - 0xdd340]
mov dword [esp + edx - 0x374d0], edi
ret
Function at 0xc9f4e1
Capabilities:
Encode data using base64

Disassembly:
call fcn.011bc639
movsx edx, cl
neg edx
mov cl, byte [esi + ecx - 0x7ab92efc]
sal dword [esp + 4], 0xca
not edx
push edx
sal eax, cl
call fcn.0117387b
mov eax, 0xec8daa06
mov eax, ebp
jmp 0xb9aa04

Function at 0xca32fa
Capabilities:
Encode data using base64

Disassembly:
dec eax
sal cx, 0x44
xor word [esp + edx - 0x8a4fe7b], cx
mov dword [esp + edx - 0x8a4fe85], edx
ror eax, 3
xor ebx, eax
add ebp, eax
sub dx, word [esp + edx*2 - 0x1149fd07]
lea eax, [edx*2 + 0x30b1988c]
movzx eax, byte [esi + edx*2 - 0x11499cf6]
btr dx, 0x1f
adc edx, ecx
not word [esp + ecx - 0x51ec07d7]
lea esi, [ecx + esi - 0x51ec07db]
sal cl, 0x24
rol cl, 0x81
jbe 0xca5d1f
xor al, bl
xor ecx, 0xc1b45f0c
dec al
ror al, 1
xor al, 0xb4
add al, 0x8d
jmp 0xeb5df1
xor dl, 0x2a
lea eax, [esp + eax + 0xc]
setne byte [esp + edx - 0x5a90e022]
add dword [esp + edx - 0x5a90e029], edx
movzx dx, byte [eax + edx - 0x5a90e02a]
mov word [edi], dx
neg cx
btr cx, cx
pop ecx
pop eax
pop edx
jmp ebp
sal dx, cl
xor al, 0x24
xor bl, al
jmp 0xe96538

Function at 0xca4d28
Capabilities:
Encode data using base64

Disassembly:
inc ebp
xor eax, esp
not al
dec esp
mov dword [esp + eax - 0x2457], ebx
inc ecx
shl dl, 0x64
inc ecx
rol eax, 3
inc ecx
dec eax
inc ecx
xor eax, 0x9e1fd0a3
inc dx
mov dword [esp + ecx - 0x584cf70a], 0xc041a70c
lds esp, [ebx]
cbw
inc esi
lea eax, [eax + eax - 0x731f19ea]
inc ecx
ror eax, 2
neg byte [esp + eax*2 - 0xab]
dec eax
dec dword [esp + eax - 0x4f]
inc ecx
not eax
inc eax
idiv bh
cbw
inc ecx
pop esi
dec esp
mov dword [esp + eax - 1], esp
inc esp
xor dword [esp + eax*4 - 4], eax
dec eax
cwde
inc ecx
pop esp
inc ecx
xchg dh, cl
inc sp
btc ecx, ebp
dec eax
cwde
dec ebp
arpl ax, ax
dec ecx
sal ecx, 0x38
dec ecx
add ebx, eax
idiv cl
bswap eax
xor ax, cx
jno fcn.011a3bd5

Function at 0xe4a5a0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
push 0xeb11bcbb
mov ecx, dword [esp]
mov cl, byte [ebp + 8]
shld eax, edx, cl
mov dword [esp + 4], 0xd62a4706
call fcn.00c76d6b
mov edx, 0x401edf1d
mov edx, dword ss:[ecx + edx - 0x401edf1d]
mov ecx, 0x641b0c0f
movsx eax, cl
mov dword [ebp + eax - 0xf], edx
jmp 0xc2491f

Function at 0xe5203a
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*2 - 0x1cf5c], edx
lea esi, [esi + ecx - 0xe7b2]
mov ecx, dword [esi + ecx - 0xe7ae]
lea eax, [edx*4 + 0x30ad8e0c]
pop eax
mul edx
xor ecx, ebx
push eax
not ecx
sub edx, edx
xor ecx, 0x3f912e83
call fcn.00ee912d
shl byte [esp + 5], 0xa3
xor eax, 0x7b259cb7
dec dword [esp + 3]
jnp 0xca5274
Function at 0xe52f2f
Capabilities:
Encode data using base64

Disassembly:
push ecx
movzx eax, cl
xor edx, ebx
bts ecx, 0x18
sal eax, 0x94
neg edx
inc edx
cbw
bswap edx
bswap eax
shl ecx, cl
neg edx
mov dword [esp + ecx - 0x7589489c], eax
dec ecx
xor ebx, edx
bt cx, 0xa4
ror ecx, 0xcf
add edi, edx
bts ecx, ecx
mov edx, dword [esi + eax - 0x5004]
dec al
sbb cx, cx
push ecx
lea esi, [eax + esi - 0x4fff]
movzx ecx, byte [eax + ebp - 0x5003]
xchg word [esp + eax*8 - 0x28016], ax
lea ebp, [eax + ebp - 0x913d]
shl dword [esp + eax - 0x9136], 0xcf
adc al, ah
xor cl, bl
or eax, eax
not dword [esp + eax - 0x91ce]
rol cl, 1
sar eax, 0x39
xchg byte [esp + eax*2 + 3], ah
shr eax, 0x3e
adc cl, 0xa5
or byte [esp + eax + 0xb], ah
not cl
adc ax, 0x7980
rol cl, 1
jmp 0x117ce7b

Function at 0xe5806a
Capabilities:
Encode data using base64

Disassembly:
shl word [esp + 0x11], 0xe6
test eax, eax
push 0x26842d07
mov dword [esp + 8], 0x122db12e
mov dword [esp + 4], 0x75b5d0a9
lea esp, [esp + 0x18]
je 0xe54e1a
push 0xd28a400d
call fcn.00b7ffc6
Function at 0xe61db5
Capabilities:
Encode data using base64

Disassembly:
bswap edx
jno 0xe734af
bt ecx, eax
dec edx
mov dword [esp + ecx - 0x2a4e61d7], eax
push ecx
ror edx, 1
xor ebx, edx
lea ecx, [eax + ecx*4 - 0x74dcaac8]
imul ecx, ecx
not word [esp + 4]
add ebp, edx
ror word [esp + 5], 0xc5
mov eax, dword [edi]
mov edx, 0x4305579d
rol word [esp + edx - 0x4305579b], 0x81
mov dl, byte [edi + edx - 0x43055799]
sub cl, cl
dec cx
adc edi, 6
xor dword [esp], ecx
sar ecx, 0x1a
mov byte ss:[eax], dl
movzx edx, cx
inc word [esp + edx - 0xfffa]
mov dword [esp + edx*8 - 0x7fff0], ebp
ret 4

Function at 0xe65bd3
Capabilities:
Encode data using base64

Disassembly:
add edi, edx
rol word [esp + eax - 0x5eba], cl
and dword [esp + eax*2 - 0xbd76], 0x909cbc2a
mov dword [esp + eax*2 - 0xbd76], edi
ret 0xc
not edx
rol edx, 1
neg edx
movzx ecx, al
push ecx
ror edx, 3
lea eax, [eax + ecx*4 + 0x78075b33]
cwde
xor ebx, edx
ror ecx, cl
sub ax, 0xc7a9
jge 0xc8f111
push 0xcfa6b31e
push 0x29162b33
mov eax, 0xd00ef69e
mov ecx, dword [esi]
movzx edx, ax
cwd
lea esi, [esi + edx*2 - 0x1fffa]
sal ax, 0xe5
dec ax
xor ecx, ebx
neg edx
xor ecx, 0x54bf3291
sub ax, word [esp]
cwd
rol ecx, 2
xchg dword [esp + 4], edx
xchg edx, eax
imul eax, dword [esp + 4]
not ecx
sub eax, dword [esp + eax*2 - 0x60b299c0]
and al, dh
bswap ecx
call fcn.00eb8f83

Function at 0xe7b575
Capabilities:
Encode data using base64

Disassembly:
inc ecx
jmp 0xec1a96
mov dword [esp], 0xfebb70af
xor edx, 0x6ea1baa0
sar word [esp + 6], 0x6d
dec eax
lea esp, [esp + 8]
jne 0xc3aa17
call fcn.00eb2c07

Function at 0xe7c05c
Capabilities:
Encode data using xor

Disassembly:
sbb esi, 5
xor dl, bl
sal eax, 0x33
call fcn.00c8ebcf
cmp al, 0xdd
nop
jp 0xe7c05f
and al, 0x84
hlt

Function at 0xe81593
Capabilities:
Encode data using base64

Disassembly:
xor ebx, edx
add edi, edx
mov dword [esp + ecx - 0x8000], edi
ret
dec al
xchg dword [esp + edx*2 - 0x20463c44], edx
xor al, dl
add al, dl
rol al, 1
add word [esp + ecx - 0x7bead96d], cx
adc al, dl
xor bl, al
lea eax, [esp + eax + 8]
jmp 0xb96ef9
sbb edx, 0xc5a2a892
neg cl
mov dword [esp + ecx*4], eax
xor edx, 0x83969790
not edx
pop eax
btc ecx, 0xaf
jae 0xb5650d
sbb edi, 4
sub word [esp + 2], dx
inc dl
not dx
mov eax, dword [edi]
movzx ecx, dx
shl edx, 0x52
xor eax, ebx
pop ecx
xor eax, 0xf4a68d20
not eax
call fcn.00c2e232
inc ecx
rol edx, 3
inc cx
add esi, 0x54411897
inc esp
xor dword [esp + edx*2 - 0xd7b2], edx
not dl
inc ecx
pop esp
push edi
dec ebp
arpl dx, dx
call fcn.00c64deb
mov edx, 0xa4adafb3
lea eax, [edx*2 - 0x666beffa]
movsx ecx, ax
mov ecx, dword [esi + ecx*2 - 0xdedc]
and dl, dl
xor ecx, ebx
bt eax, 0x35
lea ecx, [ecx + edx + 0x5879c472]
bswap ecx
xadd eax, edx
or eax, edx
adc edx, edx
rol ecx, 2
sub ecx, 0xb0b3ee35
bts eax, edx
jae 0xefeac3
xor ebx, ecx
add edi, ecx
jmp 0xeb9404
not eax
or edx, 0x52b0e8a7
movzx eax, byte [esi + eax*4 - 0x60020205]
mov ecx, edx
or edx, 0xd8194906
sbb esi, 5
add edx, 0x30231e23
push ecx
xor al, bl
push ecx
rol al, 1
lea ecx, [edx + edx*2 + 0x4b817f09]
or byte [esp + edx*4 - 0x408c7884], 0x9c
jae 0xbf806c
Function at 0xe8dbac
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
sub ax, 0x237
xor edx, 0x198b86a6
mov dword [esp], 0x8f0f441f
rol edx, 2
movsx ecx, ax
and cx, cx
neg edx
shl word [esp + ecx - 0x6d4e], 0x23
sub cx, ax
dec eax
xor edx, 0xff2ab91c
lea eax, [eax*4 - 0x6171dfdd]
btr eax, eax
shr ecx, 0xe1
xor ebx, edx
add esi, edx
imul ecx
sar ax, 0x65
or ax, word [ebp + edx*2]
xor edx, edx
shr word [esp + ecx + 2], 0x61
shr dx, 0x4f
or dx, word [ebp + ecx + 2]
or cl, byte [ecx + ebp + 4]
or word [esp], 0x8528
call fcn.00c03193
mov cl, 0x2b
ja 0xe8dbae
xor esi, dword [edi + 0x4f]
invalid
Function at 0xea0feb
Capabilities:
Encode data using base64

Disassembly:
pushfd
mov dword [esp + 4], 0xc0c86b6b
lea esp, [esp + 4]
call fcn.00e5d901

Function at 0xea10c6
Capabilities:
Encode data using xor

Disassembly:
inc ecx
inc cl
dec eax
mov dword [esp + edx*2], 0xb5b0b881
inc cx
mul esi
inc ecx
movsx edi, si
inc ecx
xor cl, 0x8c
dec eax
div dword [esp + edx - 0xa51b]
dec eax
shr ecx, 0x66
inc ecx
dec cl
dec ecx
sub edi, eax
inc ecx
rol cl, 1
dec eax
lea ecx, [edi*4 + 0x65873e8a]
inc ebp
xor ah, cl
inc ecx
and ebp, 0xac10f1b9
inc edx
sbb dword [esp + eax*2 - 0x31a3], edx
dec eax
sub edx, 0xc03f39b7
dec esi
lea ecx, [esp + ecx + 0x18]
dec edx
inc dword [esp + eax*2 - 0x31a2]
inc dx
adc dword [esp + eax*8 - 0xc6c7], 0x8b4366ac
mov esp, 0xffe72708
inc dword [ecx - 0x7f]
loopne 0xea10e9
adc al, 0x80
mov eax, dword [edx - 0x77]
mov esp, 0xffef6405
dec dword [ecx + 0xf]
int 0x4a
lea ebp, [ebp + eax - 0x109c]
dec ecx
sar eax, 0x4d
inc ecx
pop eax
pop edi
pop edx
jb fcn.011a3bd5
mov edx, 0xa3ab4808
add edx, edx
movsx ecx, dl
lea ebp, [ebp + ecx*2 - 0x24]
mov edx, dword [ecx + ebp - 0x10]
dec cl
call fcn.00e9bc3f

Function at 0xea54e0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec eax
lea ebp, [ebp + edx - 8]
dec eax
lea esi, [edi*4 + 0x1ba17ea0]
dec ebp
lea ebx, [esi + 0x1a032d91]
dec eax
cdq
pop esi
inc ecx
pop eax
pop edx
pop edi
inc ecx
pop ebp
jp fcn.011a3bd5
neg ecx
xor edx, 0x838973a0
and eax, ecx
shr eax, 0xea
sete cl
ror edx, 1
inc cl
dec eax
js fcn.00e70edf
lea edx, [edx + ecx*2 + 0x7139b919]
xor ebx, edx
bswap ecx
ror ecx, 0xae
mov dword [ebp + ecx*2 - 0xc00804], edx
mov edx, dword [edi + ecx*2 - 0xc00808]
sub al, 0xa3
add ecx, eax
lea edi, [edi + eax*4 - 0x17fd78]
adc ax, ax
bts eax, eax
cbw
xor edx, ebx
jmp 0xe57ffe

Function at 0xea7c97
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [eax + ebp - 0x82aff8b]
seta al
inc byte [esp + eax*2 - 0x1055fdfb]
xor ecx, ebx
xor ax, 0xb791
inc al
not ax
rol ecx, 2
and dword [esp + eax*2 - 0x10556ed5], eax
lea ecx, [ecx + eax*4 - 0x1c109201]
sar dword [esp + eax - 0x82ab76c], 0xf2
sar al, 0x85
ror ecx, 2
sar eax, 0x11
xor ecx, 0x8f9a2613
neg ecx
call fcn.011e2d06
lea ebp, [ebp + eax*2 - 0x10551916]
mov word [esp + eax - 0x82a8c85], 0x7bac
movzx edx, word [ebp + eax*2 - 0x10551914]
xor dx, bx
lea ecx, [eax + 0x13a58295]
ror dx, 1
cbw
sub dx, 0x8c24
mov dword [esp + eax - 0x82aff8a], ecx
bt ecx, eax
rol dx, 1
add cx, ax
shr dword [esp + eax*8 - 0x4157fc4f], cl
inc al
inc dx
ror word [esp + eax - 0x82aff87], cl
sbb ecx, dword [esp + eax - 0x82aff87]
push ecx
xor bx, dx
lea esi, [esi + eax*2 - 0x1055ff18]
mov word [esi + eax - 0x82aff8b], dx
lea ebp, [ebp + eax - 0x82aff8f]
shr byte [esp + eax*4 - 0x20abfe29], 0x43
jns 0xb4954b
inc ecx
mov ebx, 0xc103a332
dec ebx
lea eax, [ebx + ebx*4 - 0x6b456061]
inc esp
movzx ebp, al
inc edi
mov ebx, dword [edi + ebp*2 - 0x132]
call fcn.00c7e967
Function at 0xea8a8a
Capabilities:
Encode data using xor

Disassembly:
shrd eax, edx, cl
pop edx
add edx, 0xffee6260
jmp edx
adc ebp, 6
add dword [esp + 4], 0x4a07e633
dec dword [esp + 4]
jp 0xc87b77
inc esp
outsb dx, byte [esi]
call 0xf87f9663
aad 0x3b
add byte [edi], 0xef
nop
test al, 0xcf
cmpsb byte [esi], byte es:[edi]
pop es
out dx, eax
nop
pop edi
fiadd word [edi]
out dx, eax
nop
invalid

Function at 0xeac3cb
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
neg ecx
mov dword [esp], 0xda8fada2
mov eax, 0x833ca17
dec ecx
or word [esp + eax - 0x833ca0e], dx
xor ebx, ecx
add edi, ecx
cwd
movzx eax, byte [ebp + eax*4 - 0x20cf2858]
add byte [esp + 0xb], 0xb2
movsx ecx, dl
xor al, bl
add dword [esp + 9], 0x790f3183
mov dword [esp + 4], ecx
neg al
bts ecx, 0x80
xor al, 0xb1
xor al, cl
bswap ecx
btc edx, 0xb9
add al, dl
push edx
inc edx
ror al, 1
xor al, 0xaa
sal ecx, cl
imul ecx, dword [esp + ecx - 0x7ffffff3]
call fcn.011ba1db

Function at 0xeac7fa
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor bx, dx
cbw
not cx
lea ebp, [ebp + eax*2 - 0x40000002]
Function at 0xeac829
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
rol cl, 1
call fcn.00c403bd
sbb esi, 1
movzx eax, byte [esi]
mov edx, 0xa8a8e715
xor al, bl
dec al
ror dl, 0x61
imul edx, edx
rol edx, 0xbb
ror al, 1
push edx
add al, 0x3d
shl dl, 3
xor dl, 0x1b
dec dword [esp + edx - 0x26b45283]
xor al, 0x95
xor bl, al
sub dx, dx
jp 0x118d734
sbb eax, 0xb11b2f1e
neg eax
call fcn.00b58a75
mov ecx, 0xe7b38501
movsx eax, cx
push eax
mov dx, word [ebp]
sub dword [esp], ecx
bts eax, 0xbf
not eax
mov ax, word [ebp + eax - 0x7afc]
mov cl, byte [ebp + 4]
sar word [esp + 1], 0xea
shr dword [esp], 0x7b
adc ebp, 4
rol word [esp + 2], 0xe5
shld dx, ax, cl
mov ecx, 0x231eb19
mov word [ecx + ebp - 0x231eb19], dx
add ecx, 0xc10bf9b5
push ecx
call fcn.00c17d8e
inc ecx
mov ecx, dword [edi]
dec ecx
add edi, 4
inc ecx
mov eax, 0x422fb137
inc ecx
xor ecx, esp
dec ebx
lea eax, [eax + eax - 0x8545feb]
inc ebp
movsx ebx, ax
inc ecx
movzx edi, ax
mov edx, 0x6baeeb3d
ror ecx, 1
inc esp
mov esi, edx
sub ecx, 0x8fad0ba4
inc sp
and esi, eax
cwde
dec eax
lea esi, [edx + edi*4 + 0x238470a4]
ror ecx, 2
bswap ecx
imul dx
inc ecx
push esp
xor dword [esp + eax*2 - 0x1b46e], ecx
dec ebp
imul esi, eax
inc eax
adc bh, al
inc ecx
neg ebx
inc ecx
pop esp
inc esp
movsx edx, di
push edi
dec ecx
btr edx, 0x33
dec eax
arpl cx, cx
dec ecx
lea eax, [eax + 0x59bc3c2c]
inc dx
dec dword [esp + ebx*8 - 0x27643]
inc eax
dec dh
dec eax
adc ebx, ecx
inc cx
add eax, 0xc74af205
test byte [esp + eax*8], al
pop esp
sar byte [ebp + 0x2397b624], 1
inc eax
adc bh, 0xa8
dec ecx
mov ecx, dword [eax + ebp - 0x422fa33c]
inc dx
sbb dword [esp + eax - 0x422fa338], eax
dec edx
lea ebp, [ebp + eax - 0x422fa334]
dec edx
mov dword [esp + eax - 0x422fa33c], ecx
popfd
inc esp
movsx ecx, ax
dec eax
sub edx, esi
inc eax
sets bh
jmp ebx
xor cl, al
sal al, 0x81
adc al, ah
mov dword [esp + eax - 0xfffe], eax
adc cl, 6
and ax, word [esp + eax*4 - 0x3fff7]
rol cl, 1
neg eax
add eax, dword [esp]
jle 0xc3cf20
adc cl, 0xa3
shr ax, 0x8d
add al, 0x24
jp 0xc19fba
jle 0xc19ded

Function at 0xeac85f
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0xf69d5e28
cld
push 0xec2c299b
push 0x622b5413
rol byte [esp + 0x10], 0x47
rep movsb byte es:[edi], byte [esi]
push dword [esp + 0x18]
popfd
dec eax
lea esp, [esp + 0x20]
call fcn.00c387d5

Function at 0xead26d
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xe39fa3a9
mov edx, 0x3da64d99
lea ebp, [edx + ebp - 0x3da64d9d]
xor dword [esp + edx - 0x3da64d99], edx
movsx ecx, dl
movzx eax, dx
mov ecx, dword [ebp + edx*2 - 0x7b4c9b32]
btr dx, ax
sub byte [esp + eax*2 - 0x9b31], al
add dword [esp + edx - 0x3da64d99], eax
xor ecx, ebx
cwde
bswap ecx
call fcn.011791e9

Function at 0xeafaa7
Capabilities:
Encode data using base64

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.00e5d901
jno 0xc36bb5
Function at 0xeb68a0
Capabilities:
Encode data using base64

Disassembly:
inc dx
inc dword [esp + ebx - 0x78a11e34]
neg edi
dec edx
dec dword [esp + eax - 0x78a102]
dec edi
lea eax, [ebx + eax*2 + 0x4798ff06]
inc dx
neg dword [esp + ebx - 0x78a11e33]
inc ecx
lea edi, [ebx + edi - 0x6974f826]
bswap edi
inc edx
rol dword [esp + ebx - 0x78a11e39], cl
dec esp
mov dword [esp + ecx - 0x78a100ab], esp
movsx eax, cl
xor dword [esp + ecx - 0x78a100ab], edi
inc ecx
xadd al, al
inc ecx
pop esp
inc esp
mov edx, ecx
inc ecx
movsx esi, dx
dec eax
arpl di, di
dec eax
adc ebx, edi
inc ecx
mov edx, eax
inc esp
movzx esi, si
jmp ebx
inc edx
seto byte [esp + ebx - 0x78a102aa]
dec edi
lea edi, [ebx + edi - 0x78a102a7]
inc ecx
xor edi, esp
inc bp
imul ebx, ebx
inc edx
lea edi, [edi + eax + 0x442f03b3]
inc edx
mov ecx, dword [esp + ebx - 0x78a11e39]
ror edi, 3
jmp 0xc3f428
mov edi, 0x78a102ab
dec eax
mov dword [esp + edi - 0x78a102ab], edi
mov esi, dword [ebp + edi - 0x78a102ab]
mov cl, byte [ebp + edi - 0x78a102a7]
sub byte [esp + edi - 0x78a102a4], 0x82
dec eax
lea ebp, [ebp + edi - 0x78a102a9]
shr esi, cl
inc esp
mov ebx, edi
inc edx
mov dword [ebp + ebx - 0x78a102ab], esi
dec eax
and dword [esp + edi - 0x78a102ab], edi
inc esp
mov eax, dword [esp + edi - 0x78a102aa]
inc edx
mov edi, dword [edi + edi - 0x78a102ab]
jge 0xc6bf47

Function at 0xebb192
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
neg esi
inc ebp
mov ebx, ebp
inc cx
btc ebx, 0xad
dec esi
lea eax, [eax + ecx - 0x64758bda]
dec esi
bswap esi
dec esi
mov dword [esp + ebx*8 - 0x10528], esp
cwd
inc edx
xor dword [esp + ebx - 0x20a5], esi
inc ecx
pop esp
dec eax
rol edx, 0x91
push edx
dec eax
arpl si, si
inc dx
or dword [esp + ebx - 0x20a0], ecx
dec eax
adc ebx, esi
inc ecx
mov edx, 0x359c5138
inc ecx
pop esi
jmp ebx
xor esi, 0x3bdceae
inc sp
and ecx, ecx
dec esp
mov dword [esp], ecx
jle 0xe6409f

Function at 0xebe49a
Capabilities:
Encode data using base64

Disassembly:
not ecx
ror ecx, 3
call fcn.00eb9dac

Function at 0xec037a
Capabilities:
Encode data using base64

Disassembly:
inc ebp
adc cl, al
inc esp
xadd ecx, esi
inc ecx
seto dh
inc ecx
ror cl, 1
inc cx
shr edx, 0x6c
inc ecx
movzx eax, bl
inc ecx
adc cl, 0x96
add si, di
inc cx
sar esi, 0x4b
inc cx
btr ebx, 0xac
inc ebp
xor ah, cl
dec esp
add ecx, esp
cdq
dec ebp
imul eax, esi
inc edi
mov ebx, dword [ecx + esi - 0x5b65fffd]
inc ecx
push ebp
xadd edi, esi
dec eax
xor edx, eax
inc ebp
mov dword [ebp + ebp + 0x1562113f], ebx
inc ebp
movsx ecx, bp
inc esi
xor byte [esp + ebp + 0x15621143], dl
dec ecx
sbb ebp, edx
pop edx
jmp fcn.011a3bd5
dec esi
mov dword [esp + ebp + 0x15621143], esi
inc esi
mov eax, dword [esp + ebp + 0x15621147]
dec edi
lea edi, [ebp + edi + 0x15621148]
pop esi
dec edx
lea edx, [eax*2 - 0x6c746377]
dec ecx
inc ebp
inc ebp
xor cl, ah
inc bp
btc ebp, eax
sar si, 0xa3
inc ecx
inc dh
inc ecx
sbb cl, 0x92
inc ebp
movzx edx, si
inc ecx
ror cl, 1
dec eax
xadd esi, edx
jno 0xb923af
ror al, 0x44
movsx ecx, al
adc cl, byte [esi + ecx*2 + 4]
call fcn.00e79f45
Function at 0xec2759
Capabilities:
Execute syscall

Disassembly:
call fcn.0118ea97
syscall
call fcn.01181d27
xor edx, 0x27ab0682
movzx eax, cl
xor ebx, edx
push ecx
cwde
add edi, edx
lea edx, [ecx*4 + 0x6275190]
mov dword [esp + eax - 0x56], edi
ret 8

Function at 0xecfc31
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0x2b756bfd
lea esp, [esp + 4]
call fcn.00c0905c

Function at 0xed3d35
Capabilities:
Encode data using base64

Disassembly:
xor cl, 0x32
ror edx, 0x22
sub dx, dx
sbb cl, 0x20
xor bl, cl
xor edx, dword [esp + edx*2 - 0xfd5fffc]
adc word [esp + edx - 0x1846fffa], dx
mov dword [esp + edx*2 - 0x308e0000], 0xeba0d
lea ecx, [esp + ecx + 8]
inc edx
mov dword [ecx + edx*4 - 0x611c0004], eax
rol dword [esp + edx*2 - 0x308dfffe], 0x21
lea edi, [edi + edx - 0x18470005]
mov edx, dword [edi + edx*4 - 0x611c0004]
xor edx, ebx
mov eax, 0x25138815
neg edx
dec dword [esp + eax*2 - 0x4a27102a]
xor dword [esp + eax - 0x25138814], eax
lea edx, [edx + eax + 0x39f95d99]
add word [esp + eax*2 - 0x4a271026], ax
jl 0x11a5bd9
xor bl, cl
mov word [esi - 2], cx
mov ecx, dword [esp]
dec ecx
xor cl, ah
mov edx, dword [ebp + 1]
adc dword [esp], 0xaf8ba629
sub word [esp], 0x8eac
xor edx, ebx
ror cx, 0x2f
ror edx, 2
bswap edx
xor cx, 0xb25
xor edx, 0x56335924
not byte [esp]
call fcn.00b61033
rol dx, 0x6c
inc esi
xchg dword [esp + esi - 0x31539a43], ebp
inc ebx
mov byte [ecx + esi*2 - 0x62a7348c], al
dec edx
mov dword [esp + esi*2 - 0x62a7348c], ebx
ret
cli
call fcn.0117e983
cmp dl, ch
js 0x11a5bb5
ja 0x11a5bfc
and ebx, dword [edx + 0x5b1e2996]
invalid
mov edx, 0x69bfe21
or eax, 0x293fb316
cdq
or al, 0x22
sar byte [ecx + ebp*8 - 0x70], cl
fdiv qword [eax - 0x1bcae92a]
popfd
add eax, 0x3eb9169c
aaa
int3
Function at 0xeda322
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jne 0x1182fc2
mov eax, 0x2aa2f437
call fcn.00eed21f
ror dl, 1
dec ecx
neg dl
dec cx
add eax, 0x7034ac85
bts ecx, eax
xor bl, dl
lea edx, [esp + edx + 0xc]
and word [esp + eax - 0x2d1d498b], ax
dec cl
mov eax, dword [edx + eax*2 - 0x5a3a931c]
lea edx, [ecx*4 - 0x17de1853]
mov dword [edi + edx - 0xf0d8f61], eax
js 0x11d867b
sub esi, 4
mov eax, 0x1e0e2b97
mov edx, dword [eax + esi - 0x1e0e2b97]
xor edx, ebx
lea edx, [eax + edx - 0x6b3ad629]
add al, ah
jle 0x11a7546
inc word [esp + 2]
test ebx, ebx
lea esp, [esp + 8]
je 0xeda32c
mov eax, dword [ebp + ebx*4]
call fcn.011b2efc
inc ecx
mov ecx, 0xe7a0bd08
inc ebp
mov edx, dword [edi]
dec edx
lea edx, [ecx*2 + 0x7223638c]
inc ecx
movzx eax, cx
dec ebp
lea edi, [edi + eax - 0xbd04]
cwde
movsx esi, al
dec esp
lea ebp, [eax + eax*4 + 0x11bb1512]
inc ebp
xor edx, esp
call fcn.01182bf3
int 0xf
lcall 0xd355, 0x69be34aa
add byte [esi - 0x662db37c], ah
push ds
xor edi, dword [ebx + 0x70cdc066]
wait
mov bl, 0x36
inc ebp
insd dword es:[edi], dx
push ss
fiadd dword [ebx]
mov ah, 0xdc
push 0xa2cdd12d
push ebp
inc ebp
jo 0x1182fb1
loopne 0x118303d
sub word [ecx - 0x2e5c3aaf], cx
inc edi
sub ecx, dword [edi + 0x3c831ea4]
lodsb al, byte [esi]
jns 0x1183043
invalid
daa
int 0xe2
lcall 0xd333, 0x699e348b
cld
cmpsb byte [esi], byte es:[edi]
and byte [ebp - 0x51], cl
sahf
imul esi, dword [ebx], 0x20a6fcd3
dec ebp
scasd eax, dword es:[edi]
cdq
clc
xor ebx, dword [edi + 0x14cdec66]
wait
iretd
mov ebp, dword [ebp + ecx*8 - 0x14f59468]
cdq
setle cl
bts eax, edx
jb fcn.00c09751
rol edx, 1
lea eax, [eax + eax*2 + 0xb8c2b09]
lea ecx, [eax + eax*4 + 0x60ce5a8]
xor edx, 0xd4382aa9
lea eax, [ecx + ecx*8 - 0x28598ec5]
not cx
dec edx
btc eax, 0x26
btc ecx, eax
xor ebx, edx
add edi, edx
lea edx, [eax*2 + 0x9b4a23d]
inc ecx
jg 0x118bb9d
sub cl, byte [esp + edx*2 - 0x1e1b1ebf]
mov dword [esp + edx - 0xf0d8f61], ebp
ret 8

Function at 0xedaa22
Capabilities:
Encode data using xor

Disassembly:
xor ebx, edx
add ebp, edx
pop ecx
pop ecx
pop edx
pop edx
jmp fcn.00c19dd7
lea esi, [esi + eax - 0x18b49958]
push eax
xor edx, ebx
lea edx, [edx + eax*4 + 0x5d6417b9]
not edx
mov ecx, eax
lea eax, [eax*2 + 0x28285cb4]
inc edx
not edx
bts eax, ecx
mov dword [esp + ecx*4 - 0x62d2656c], ecx
jb 0xe57b75