joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc631
Capabilities:
Encode data using xor

Disassembly:
bswap edx
btc cx, dx
adc esi, eax
dec ecx
xadd ecx, edx
movzx ecx, byte [ebp]
movsx eax, dx
lea ebp, [ebp + eax - 0x360a]
jb 0xd91807
mov ecx, 0x53b34317
mov ecx, dword [ebp + ecx - 0x53b34317]
mov edx, 0xc3a9bd1c
movzx eax, dx
lea ebp, [eax + ebp - 0xbd18]
push edx
xor ecx, ebx
ror eax, 0x96
rol word [esp + eax - 0x2f46ffe], 0x6f
ror ecx, 3
mul dl
sbb ecx, 0xc7998f3a
div dl
sub eax, eax
bswap ecx
or dword [esp + eax], eax
not ecx
xor ebx, ecx
sal eax, 0xb0
add word [esp + eax + 2], 0xf233
cwd
add esi, ecx
cwde
and al, al
mov edx, dword [eax + edi]
and al, al
adc ax, ax
not word [esp + eax*8 + 2]
xor eax, dword [eax + edi + 4]
call fcn.00ecc5df
bswap eax
bts edx, edx
rol edx, 0xf6
rol eax, 3
mov dword [esp], ecx
inc eax
xor ebx, eax
jmp 0x4cbc2a
dec byte [esp + eax - 0x360b]
jp 0xcddb97
xor cl, bl
and dl, 0xb8
xor cl, 0x31
sar dx, 0xe9
ror cl, 1
dec dl
rol dword [esp + eax*2 - 0x6c16], 0xe8
inc cl
neg cl
xor bl, cl
and al, 0x95
adc eax, 0x836b431
ror edx, 0xaa
lea edi, [edi + edx*4 - 0x1ad7b402]
sub eax, dword [esp + edx*2 - 0xd6bda00]
mov word [edx + edi - 0x6b5ed00], cx
adc byte [esp + edx*8 - 0x35af67ff], dl
pop edx
jae fcn.005544bb
retf 0x8daa
jmp 0xd918d4
mov dh, 0x83
pushfd
add al, byte [ebp - 0x7bd8d3]
jbe 0xd9183a
inc edi
jmp [edi]
mov cl, 0xdf
or ebx, ebx
jnp 0xd9187e
leave
call esi
jecxz 0xd91947
jg 0xd91931
sbb al, 0x59
mov dword [0x8d334d87], eax
inc eax
add eax, 0x5ef15210
int1
pop esi
mov dword [ecx + 0x19], 0x615b3b23
lahf
mov eax, dword [0x934bf2ea]
dec edi
or eax, dword [edi + 0x31]
call esi
jecxz 0xd9196b
jp 0xd918ec
test dword [ebx + 0x2c], 0x9720b75f
daa
int1
and dl, 0x7e
loop 0xd91990
movsb byte es:[edi], byte [esi]
cmc
int3
and al, byte [ecx - 0x76]
mov dword [esi + 0x70], ebp
sbb esi, esp
test al, 0xa5
push ds
out dx, al
stosb byte es:[edi], al
add ch, ah
and dword [ebx], edi
popfd
inc edx
inc byte [ebx - 0x70]
lodsd eax, dword [esi]
sbb ecx, dword [ebx - 0x4141686c]
jg 0xd91910
lahf
mov esi, 0xfc021216
jp 0xd9193c
mov ah, 0x12
leave
add dword [ebp - 0x44fc2c7e], edx
sbb ah, byte [eax - 0x34ae70ec]
mov ebp, 0x4700231a
inc edi
in eax, 0x22
xlatb
xor eax, 0xa65342ad
pop ds
inc ecx
pop esi
add ah, ah
js 0xd91995
popal
leave
add cl, byte [eax - 0x22]
mov ebp, 0xc2f89d6c
aas
lea eax, [ebx - 0x55]
jmp edx
dec esp
xor al, byte [edx]
inc edi
invalid
xor ebx, dword [edi + 0x25]
std
mov cl, 0x2b
arpl word [ebp - 2], di
jne 0xd91990
invalid
Function at 0x503dfe
Capabilities:
Authenticate hmac

Disassembly:
add cx, 0xbea7
inc al
not cx
push eax
add cx, ax
shr dl, 7
adc dx, 0x3423
xor bx, cx
lea edi, [eax + edi - 3]
mov word [edi + eax - 1], cx
movzx ecx, ax
ror dword [esp + eax*2 - 2], 0x7f
inc al
pop edx
pop edx
jno fcn.00dc9a26
mov edx, 0x8abfa31c
mov ecx, 0x139f5137
lea ebp, [ebp + ecx*2 - 0x273ea272]
sal edx, 0x90
jne 0xd34221
je 0xe4c431
xor ecx, ebx
dec ecx
ror ecx, 2
not dl
mul dx
inc ecx
and dl, dh
setae dl
jl 0x54514a
xor ecx, 0x8983aa6
bswap edx
shr edx, 0xe4
and edx, edx
bswap ecx
btr edx, eax
and dl, 0x3e
btc eax, eax
lea ecx, [ecx + edx*2 - 0x58c284b6]
and al, dh
add dl, dh
or edx, 0x2f207e20
xor ecx, 0xeb275093
jmp 0xe980aa
shr eax, cl
movzx ecx, dl
neg ecx
sbb ecx, 0xe396e0bc
mov dword [ecx + esi - 0x1c691f44], eax
lea eax, [ecx + 0x3e8c5c34]
cwde
sub eax, 0x47819538
jmp ebp
or al, 0x96
dec ecx
div eax
bt edx, 0x8e
mov dword [esp + eax*4 - 4], 0x9e9b12b4
bswap ecx
xor ebx, ecx
add edx, edx
div word [esp + eax + 2]
inc word [esp + eax*2 + 2]
add ebp, ecx
mov esi, dword [esi + edx - 1]
pop edx
lea ecx, [edx*8 - 0x5fd93dda]
idiv cx
pop edx
jmp fcn.00ec7009
rol dl, 0xa3
xor ebx, ecx
add ebp, ecx
mov ecx, edx
mov eax, dword [edx + esi - 0x2f37ff6f]
shr dl, 0x66
setbe dl
sar edx, 0x58
mov cl, byte [esi + edx*8 - 0x174]
not edx
btr dx, dx
adc esi, 2
sub dx, dx
and edx, edx
jl 0x58b3cf
Function at 0x508a4e
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
je 0x48fc42
Function at 0x51adff
Capabilities:
Encode data using base64

Disassembly:
into
out 0xb9, eax
or dl, dl
lea edi, [edi + edx - 0x46183139]
movsx ecx, dl
sal ecx, cl
sbb ecx, ecx
push eax
xchg ch, cl
btr cx, cx
popfd
imul cx, cx
lea ebp, [edx + ebp - 0x46183141]
call fcn.00478434
jl 0xed157e
jno 0xe5f98d
mov ecx, 0x78077e3d
mov eax, ecx
mov edx, esi
ror eax, 0x27
neg ecx
or ecx, ecx
lea esi, [esi + eax - 0x7af00efe]
btc eax, ecx
and al, al
btr eax, 0
mov word [esi + eax - 0x7af00ef4], dx
dec al
jle 0xcdd14b
jg 0x51add4
shr byte [esi + ecx], 1
push ss
mov edi, 0xc1e781a8
mov eax, 0xc9ac00cb
inc ebx
pop eax
and al, 0x43
popfd
aas
dec edx
fucomi st(3)
cmc
aad 0x57
cmp eax, dword [ecx + ebx + 0x67241bba]
daa
push edi
jecxz 0x51ae4c
xchg esp, eax
adc byte es:[edx + 0x52], dl
int 0xb6
pop ebp
call 0xe2766eb6
mov ecx, 0xb977d549
and eax, 0xe9c2a702
cmpsb byte [esi], byte es:[edi]
popfd
das
movsd dword es:[edi], dword [esi]
push 0xe5d42ada
inc ecx
int1
push es
xchg esi, eax
add ebp, esp
dec esi
mov dl, 0xe0
adc al, 0xc6
sbb ebp, ebx
mov esi, 0xdab23aa8
dec edx
xchg ebp, eax
add dword [eax + 0x7e], esi
cmc
mov esi, 0xb6d5a25e
aad 0xb6
lodsd eax, dword [esi]
lahf
adc ebp, dword [edx]
lodsb al, byte [esi]
loopne 0x51aec5
scasb al, byte es:[edi]
mov al, byte [0x2c4efc1e]
mov esp, 0xd6e2371c
sub esi, dword [eax]
std
dec ecx
sub cl, byte [edx + 0x29b17ad1]
xchg eax, esi
mov edi, 0xebd3d5a9
xchg byte fs:[ebx - 0x2b], cl
mov dh, 0x91
aad 0xb6
xchg ecx, eax
test cl, al
sub esp, dword [esi + 0x72a4b30]
pop ds
and eax, 0x7cd43fa2
push ebx
cmp dword [esi - 0x2b], ecx
loopne 0x51ae9d
mov dh, byte [ebx]
mov ecx, dword [edi + eax - 0x7af00ef3]
lea edi, [edi + eax - 0x7af00eef]
movsx edx, ax
ror al, 0x82
jne 0xe86e52
sub cx, cx
xor ecx, ebx
ror edx, 0x96
dec dx
jp 0xd095b9
call fcn.00e8aff3

Function at 0x51b6e8
Capabilities:
Encode data using base64

Disassembly:
inc ecx
or esp, 0x9d941fa1
dec eax
mov dword [esp + edx - 0x7a], 0xa6ad831a
inc ebp
sbb bh, dl
dec esp
xchg esi, esp
inc ecx
shl edx, 0x2e
inc ecx
ror bh, 1
inc ebp
xor al, bh
mov ebx, 0x4a10bcb1
dec esi
lea edi, [esp + edi + 8]
inc bx
inc ecx
mov ecx, dword [edi + edx*2 - 0xf4]
cwde
or dword [esp + edx*2 - 0xf2], 0xbbbb8203
dec esi
lea ebx, [edx + ebx - 0x7e]
inc ecx
mov dword [ebx + edx*2 - 0xf4], ecx
dec eax
or edx, dword [esp + edx*4 - 0x1e8]

Function at 0x51ee5e
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], edx
jp fcn.005d7de7
pop edx
pop ecx
pop eax
pop ecx
pop eax
jmp esi
Function at 0x5250c6
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0xffff743c
inc ebx
xor ecx, ebx
movzx edx, ax
xor ecx, 0xf71c3303
sbb al, 0xf7
xor ax, dx
ror ecx, 1
call fcn.00e06cdb
ja 0xeb7689
push ds
cmp eax, 0xba49c02c
cmp ebx, esi
lea eax, [ecx - 0x3a6a1b8b]
rcr byte [0x6236597b], 0x7e
fidiv word [edi + ecx]
jnp 0x5250cf
popfd
jbe 0x52517c
js 0x5250bf
out dx, eax
int3
aad 0xc6
iretd
mov ebp, esi
mov ebx, edx
bts edx, 0xb0
mov ebx, eax
push edx
push edx
shr dword [esp + 2], 0xc9
mov edx, ebx
pop eax
xor dword [esp], 0x8da51d00
pop eax
shl edx, 2
btc eax, eax
jae 0x610c3d
not cx
mul ecx
mov eax, dword [ebp + eax*4 - 0x7b8450c8]
or dl, cl
xor eax, ebx
btr ecx, edx
xor eax, 0x6c3db894
shl cx, cl
lea eax, [eax + ecx*4 - 0x44b1b8b5]
or dx, cx
not eax
lea eax, [ecx + eax - 0x13892b3d]
call fcn.00e8f6c2

Function at 0x5451d4
Capabilities:
Authenticate hmac

Disassembly:
mov esp, ebp
mov bp, 0xea88
movsx ebp, si
pop ebp
ret 0x10
push eax
call dword [fcn.0045008c]
pop edi
pop esi
bsf bx, ax
adc cx, si
xor al, al
pop ebx
movsx cx, cl
mov ecx, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
jmp 0x51adbb
call fcn.00591c34
mov eax, 0x6fad2726
dec eax
movzx eax, byte [ebp + eax - 0x6fad2725]
mov edx, 0xb3352c8c
movzx ecx, dx
lea ebp, [ecx + ebp - 0x2c8b]
xor dx, 0xee0a
xor al, bl
ror al, 1
add ecx, ecx
sbb dl, cl
imul dx, cx
adc al, 0x2b
sub dl, ch
rol dx, 0x21
ror al, 1
add al, 0x9b
imul edx, edx
xor al, cl
lea ecx, [edx*8 + 0x19901986]
sub al, 0x8a
xor bl, al
add cl, 0x36
adc eax, esp
imul dx, dx
seto dl
not edx
mov cx, word [eax + edx*4 - 0x6b4a97f8]
movzx eax, dx
lea esi, [esi + edx*4 - 0x6b4a97fa]
call fcn.00de9a4d
cmp cx, sp
mov dword [ebp - 0x20], ebx
cmp dword [ebx + 4], edi
je 0xde19b6
inc eax
cmp bx, sp
clc
add edx, 4
jmp 0x60047e
cmp eax, ecx
jmp 0xd81f68
mov ebx, dword [edx]
cmc
jmp 0x54524b
jb 0x632ff7
mov eax, dword [ebp - 0x14]
jmp 0x51d2f6

Function at 0x5484f6
Capabilities:
Encode data using base64

Disassembly:
xor ebx, edx
add esi, edx
shl cx, 0xc5
pop eax
pop edx
pop edx
jbe 0xe282c3
lea edi, [edi + eax*4 - 0x426f1297]
inc ecx
sar eax, cl
neg ecx
xor dl, bl
not dl
ror dl, 1
btc eax, ecx
mov dword [esp + ecx - 0x25e63144], ecx
inc dl
shr cl, cl
and ecx, 0x2e14a51d
not eax
neg dl
xadd byte [esp + ecx*2 - 0x48084207], cl
jns 0x5cb1dd
xor ecx, eax
xor bl, dl
sub dword [esp], eax
bswap eax
lea edx, [esp + edx + 4]
push eax
mov eax, dword [edx]
movsx edx, cx
sbb ebp, 3
and ecx, dword [esp + 4]
sub ecx, dword [esp + ecx*8 - 0xf10a2ac]
mov dword [ebp], eax
call fcn.00493862
or ax, ax
not dl
btc cx, 0x81
shl cx, 0xeb
adc dl, 0x31
rol dl, 1
push ecx
xor bl, dl
and ecx, dword [esp + eax*2]
lea edx, [esp + edx + 4]
neg al
jp 0x6074f8
mov cx, word [edx + eax]
btr ax, ax
push eax
lea edi, [eax + edi - 2]
mov word [edi + eax], cx
mov edx, dword [ebp + eax*2]
push eax
dec dword [esp + eax + 4]
lea ebp, [ebp + eax*2 + 4]
dec word [esp + eax + 2]
lea ecx, [eax - 0x4bd43fe0]
pop ecx
xor edx, ebx
push eax
dec ax
rol edx, 1
rol al, 0x65
bt ecx, 0x16
lea edx, [edx + ecx - 0x6fe63151]
neg edx
or dword [esp + eax - 0xfff7], eax
ror edx, 2
and byte [esp + eax - 0xfff4], cl
jae 0x4eecff
Function at 0x55a82a
Capabilities:
Encode data using xor

Disassembly:
dec dl
mov dword [esp + eax*2 - 0x6a], eax
sal ax, 0x2d
or eax, eax
xor bl, dl
lea edx, [esp + edx + 0x10]
pop eax
push eax
mov dword [esp + eax - 0x2d], 0x60ac88b2
mov byte [edx + eax*2 - 0x6a], cl
movzx ecx, word [esp + eax*2 - 0x67]
shr dword [esp + eax*2 - 0x5e], 0xf3
lea edi, [eax + edi - 0x39]
mov eax, dword [edi + eax*2 - 0x6a]
push ecx
pop ecx
inc dword [esp + ecx*4 + 0xc]
xor eax, ebx
sub eax, 0x8dbc5285
mov edx, dword [esp + ecx + 8]
rol edx, 0x73
inc byte [esp + ecx + 0xd]
rol eax, 2
ror word [esp + ecx*4 + 3], 0x8c
not eax
lea edx, [edx + edx*4 + 0x71b6b421]
ror eax, 1
pop ecx
inc dl
lea ecx, [edx - 0x564dcad6]
xor eax, 0x53bee239
bt ecx, ecx
call fcn.00d1aa4c

Function at 0x57341d
Capabilities:
Encode data using base64

Disassembly:
call fcn.004aa997
xor ebx, edx
div cl
ror cl, 0x43
add edi, edx
pop edx
sar ax, 0x61
inc ax
rdtsc
jno 0xeca355
sbb ecx, 0x172d5310
shr cl, cl
lea esi, [esi + ecx - 0x681c940f]
bt cx, cx
bts cx, 0x92
mov dword [esi + ecx - 0x681c9403], eax
movzx eax, cx
neg ecx
mov dword [esi + eax*4 - 0x2501c], edx
cdq
btr edx, 0x1c
neg cx
jno fcn.00e43269

Function at 0x584dc1
Capabilities:
Encode data using xor

Disassembly:
call fcn.00528fed
inc ecx
arpl di, dx
test edx, edx
add eax, 0x81935346
xchg dword [ebp + 0x53], eax
pop esi
cmpsb byte [esi], byte es:[edi]
invalid

Function at 0x587e13
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + 4], 0xfe33dc9f
mov ebp, dword [ebp - 4]
mov esi, 0x1795a4a7
movsx edi, si
mov dword [esp + esi - 0x1795a4a7], edi
mov dword [ebp + esi*2 - 0x2f2b494e], eax
dec byte [esp + esi - 0x1795a4a2]
call fcn.0051db81

Function at 0x592d0f
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [esp + ecx*2 - 0x53961fc0], edx
xor eax, ebx
bswap eax
jmp 0xcf0d42
neg edx
push ecx
lea eax, [ecx + eax + 0x6ce00e37]
sar word [esp + ecx*2 - 0x53961fbe], 0x42
neg dword [esp + ecx - 0x29cb0fe0]
jae 0x638bd8
xor eax, 0xa5bb90b2
or ecx, dword [esp + ecx - 0x29cb0fe0]
dec eax
jmp 0x590375

Function at 0x5953ce
Capabilities:
Encode data using base64

Disassembly:
jmp 0xd4ac62
lea esp, [esp + 0x18]
je 0xe9db71

Function at 0x5a0579
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [ebp*2 - 0x3dca7580]
xor bp, 0x64b1
cmp bp, 0x51ab
mov ebp, dword [esp + 0xc]
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call int.0057341d
mov eax, 0x75835d08
jmp 0x508a6b
Function at 0x5c5e69
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [ebp]
btr ecx, edx
adc ebp, 3
add cx, 0x482c
xor eax, ebx
sar byte [esp + 2], 0x44
or cx, 0x3f84
lea eax, [eax + edx - 0x623fa291]
jge 0x56478b
xor ebx, edx
call fcn.00d4a297
shr byte [esp], 0x84
sar ecx, 0x48
ror eax, 1
xor eax, 0x3122dc99
inc ecx
or ecx, 0xb899bb92
ror eax, 1
bt edx, 0x82
ror word [esp + 1], 0x8a
shl edx, cl
xor ebx, eax
imul ecx, dword [esp]
shl dx, cl
inc dl
adc edi, eax
mov dword [esp + ecx*2 - 0x59605b48], edi
ret
push edi
call fcn.00e0e64f
lea esp, [esp + 0xc]
jne 0xd35998
mov ecx, 0xa89d9691
pop ebx
mov eax, 0xbf945e11
movsx ecx, al
push eax
not edx
add word [esp + ecx*4 - 0x42], cx
mov dword [ecx + esi - 0x11], edx
shr eax, 0xe2
cdq
xor word [esp + eax*2 - 0x5fca2f07], dx
lea edi, [ecx + edi - 0x15]
adc edx, dword [eax + edi - 0x2fe51784]
shr al, 0x43
bt eax, eax
xor edx, ebx
and dword [esp + eax - 0x2fe51710], 0xe4178b90
neg edx
lea edx, [edx + ecx*2 - 0x720c9bd7]
cbw
neg edx
lea edx, [eax + edx + 0x3dcb4e98]
or word [esp + eax - 0x2fe5000e], cx
rol edx, 1
sal cx, 0x29
sbb al, byte [esp + eax - 0x2fe5000f]
xor edx, 0x1284372b
idiv al
neg edx
shl ax, 0xaf
xor ecx, 0x4b232186
rol edx, 2
not ecx
lea edx, [edx + eax*2 + 0x4a6cac1b]
shr eax, 0x27
sar ecx, 0x6a
jp 0xde1a69
mov eax, 0x53a2a5a1
lea ebp, [eax + ebp - 0x53a2a5a5]
mov eax, dword [ebp + eax - 0x53a2a5a1]
mov ecx, 0xc176d34
movsx edx, cx
inc ecx
xor eax, ebx
xadd dl, ch
lea eax, [eax + ecx*4 + 0x4eae01ae]
bswap eax
bt dx, dx
dec eax
not dx
neg eax
call fcn.00538c2e
mov edx, 0xd83b120c
mov ecx, edx
mov dx, word [esi]
movsx eax, cx
inc al
call fcn.005f79a0
jmp 0x484b49
movzx ebx, byte [ecx]
jmp 0x61f430
movzx eax, byte [ebp + eax*2 - 0x62bc001c]
adc ebp, 1
jmp 0xe8854f
sub edx, 0x971a1a85
dec al
push edx
not al
xor al, 0x11
rol edx, 0x39
xor bl, al
rol dword [esp + edx - 0x780d9bdc], 0xa6
adc dl, byte [esp + edx - 0x780d9bdc]
lea eax, [esp + eax + 4]
sal dl, 0x22
sbb dx, word [esp + edx - 0x780d9b77]
neg edx
mov word [eax], cx
or dword [esp], 0x728fed26
mov ecx, dword [esp]
jp 0x44392b
rol edx, 1
not cl
sub byte [esp + eax*2 - 0xbf95fd], 0x82
jge 0xe24051
mov edx, 0xcea19cbe
lea ecx, [edx - 0x61c836e2]
movsx eax, cl
mov cx, word [ecx + esi - 0x6cd965dc]
sub eax, edx
lea esi, [esi + eax*2 - 0x62bcc63a]
and ax, dx
sbb al, 0x10
jg 0xd7d0c6
xor ebx, edx
bt ax, 3
neg ecx
jno 0xe56103
add ebp, edx
cdq
mov dword [esp + eax - 0x5fcb00], ebp
ret
imul edx, edx
xchg dh, dl
xor al, bl
add edx, edx
inc al
not dl
ror al, 1
or edx, edx
adc al, 0x3e
btc dx, 0x92
ror al, 1
jmp 0xda7117
Function at 0x5c6d55
Capabilities:
Authenticate hmac
Inspect section memory permissions

Disassembly:
xor bx, cx
lea edi, [edi + edx*2 - 0x4e444d1c]
call fcn.00520d23
xor eax, 0x5e8c2f81
mov word [esp + 1], 0x642c
add cl, byte [esp + 2]
shr edx, cl
lea eax, [eax + ecx - 0x35dbd268]
xor ebx, eax
and dword [esp + edx*2 - 0x3ec8c], 0xc6b91085
inc edx
adc esi, eax
mov dword [esp + edx - 0x1f647], esi
ret
mov word [esi + edx], ax
and byte [esp + edx], 5
xchg dh, cl
lea edi, [edi + edx - 4]
movzx eax, cx
xor ecx, dword [edx + edi]
sub byte [esp + edx + 2], 0x1f
imul ax
dec dword [esp + edx]
xor ecx, ebx
lea edx, [eax*2 + 0x2f07ef86]
ror ecx, 1
shl edx, 0x6b
xor ecx, 0xcc148425
dec ecx
sub dword [esp + edx - 0x3f7c3000], eax
mov word [esp + edx - 0x3f7c2fff], dx
neg edx
bswap ecx
push eax
sar eax, 0x6e
xor ebx, ecx
inc eax
add dx, word [esp + eax*4 - 3]
adc ebp, ecx
sar eax, 0x82
cwde
shr dx, 0xc
pop ecx
pop ecx
jns fcn.00ec7009
pop es
popal
ret 0x38a
add cl, al
shl eax, 0x5d
and dword [esp + edx], eax
rol cl, 1
xadd byte [esp + edx + 1], ah
or al, al
neg cl
xor bl, cl
lea ecx, [esp + ecx + 4]
rol dword [esp + edx], 0x9d
xadd dl, al
xor al, byte [ecx + edx*8]
lea esi, [edx + esi - 2]
movsx ecx, dx
xor edx, ecx
jbe 0x4a2dc9
push ecx
push ecx
mov dword [esp + ecx - 0xfe], esi
ret 4
xor eax, eax
xor edx, ebx
call fcn.00562d6b
mov edx, 0x8d262227
mov eax, edx
sub ebp, 2
movsx ecx, dx
shl ax, cl
add ax, cx
mov cx, word [ebp + ecx - 0x2227]
xor cx, bx
bswap edx
lea eax, [eax + eax*4 + 0x7c06da08]
ror cx, 1
add cx, 0xa38e
rol eax, 0x91
neg cx
rol cx, 1
or eax, edx
jb 0x50e6c3
ja 0x47ade7
neg cl
add esi, eax
jmp 0x59a312

Function at 0x5d1534
Capabilities:
Encode data using xor

Disassembly:
sar cx, 0xc5
xor ebx, edx
bt cx, cx
jb 0xdc39cc

Function at 0x5db273
Capabilities:
Inspect section memory permissions

Disassembly:
sar eax, 0xb2
mov dword [esi + ecx - 0x4fbf72d1], edx
not eax
pop eax
pop eax
jp fcn.00e43269
add dword [ecx], eax
jmp 0x608937
adc dword [ecx + 4], edx
mov edx, dword [esp + 0x18]
cmp sp, 0xca94

Function at 0x5f30b6
Capabilities:
Inspect section memory permissions

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x14]
call fcn.00e17c24

Function at 0x604428
Capabilities:
Encode data using base64

Disassembly:
adc esi, 4
call fcn.0051ee6d

Function at 0x607c51
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xfffffffc
ror byte [esp + 0xa], 0x61
call fcn.00cdebcc
lahf
adc dword [esi], ebx
shr ah, 0x17
pop ss
in al, dx
lea ebp, [ecx + ebx*2]
salc
xchg ebp, eax
popal
xor dword gs:[ecx + 0x59], ecx
wait
inc ebx
push es
shufps xmm7, xmm0, 0xaf
jbe 0x607c6c
int1
xchg ebx, eax
invalid
Function at 0x624d7b
Capabilities:
Inspect section memory permissions

Disassembly:
push eax
push eax
cmove ax, bx
push edi
mov eax, esi
call fcn.00d0a8e6
test al, al
jne 0xd9f845
call fcn.00dc2bc0
test eax, eax
jmp 0xcfac92
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
mov ecx, 0x452dfb39
movzx ax, al
push esi
mov ch, al
mov esi, dword [ebp + 0xc]
push edi
movsx eax, sp
setns ch
lahf
mov edi, dword [ebp + 8]
lea eax, [esp + 0x28]
push eax
mov eax, esi
bswap cx
mov ecx, edi
jmp 0x5f895a
jne 0x557c3b
mov ebx, dword [ebp + 0x10]
cwd
mov edx, dword [esp + 0x7c]
push ebx
jmp 0x51b5c0
jmp 0xd6690b
mov edi, dword [ebx + 0x3c]
bsf cx, bp
rol esi, 0x1e
cmc
movzx ecx, word [edi + ebx + 0x14]
add edi, ebx
sub si, di
xor edx, edx
dec si
rol si, 0xb6
lea esi, [ecx + edi + 0x18]
mov dword [esp + 0x1c], edi
test bp, 0x9fa1
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], 0
stc
cmp dx, word [edi + 6]
jmp 0xe3aadd
jae 0xd1bca7
add esi, 0x10
jmp 0xd16bd2

Function at 0x62861e
Capabilities:
Inspect section memory permissions

Disassembly:
bswap eax
ror edx, 0xf7
adc dword [esp + 4], edx
xor ebx, eax
push edx
add ebp, eax
or dword [esp], edx
sbb edi, 1
mov dword [esp + 4], edx
mov eax, edx
movzx eax, byte [edi]
rol word [esp + 2], 0x4c
not edx
xor al, bl
sub al, 0x36
dec edx
xor al, dl
jmp 0xdc8e14
neg al
shr edx, 0x7a
jb 0xe097a9
Function at 0x62e687
Capabilities:
Encode data using xor

Disassembly:
lea edx, [esp + edx + 4]
bts eax, 0x90
mov dword [eax + edx - 0x100ff], ecx
call fcn.00d069cd
mov ecx, dword [esi]
mov eax, 0xccb32c20
lea edx, [eax + eax*4 - 0x52774350]
inc al
mov edx, dword ss:[ecx]
mov ecx, eax
mov dword [esi], edx
not eax
mov dword [esp + eax*2 - 0x6699a7bc], ebp
ret 8
sbb eax, 0xa18ac91b
call fcn.005c2d08
sal cx, 0x23
adc esi, eax
movzx eax, cx
call fcn.0063237b
inc edx
inc cl
setle cl
xor ebx, edx
not al
add al, cl
adc edi, edx
cwde
sar cl, cl
and al, cl
mov dx, word [esi + eax*2]
bts ecx, ecx
dec ecx
shr cl, 0x87
mov cx, word [esi + eax*4 + 2]
bts eax, 0xae
push eax
xchg ah, al
lea esi, [esi + eax - 0x3e]
sub eax, eax
not dx
btc ax, ax
shr byte [esp + eax - 1], 0xa7
jns 0xd31fd9
mov ecx, 0xc59c79b5
mov eax, ecx
mov eax, dword [edi]
add edi, 4
mov edx, 0x320a873c
inc dx
xor eax, ebx
dec ecx
sal edx, 0xa9
bswap eax
not dl
adc edx, ecx
inc eax
and cl, dl
sar cl, 0x42
setnp dl
neg eax
lea eax, [ecx + eax + 0xa757f9b]
rol eax, 3
call fcn.00de5d61
shr al, 0xa3
or al, 2
rol edx, 2
shl al, 0xc7
neg edx
sar ecx, 0xf
xor ebx, edx
rol cl, 0x83
jae 0x438882
call fcn.00cec557
call fcn.0051d90f
xor edx, 0xc3978c38
dec eax
push 0x7d11bea7
call fcn.00d8d6df
mov edx, 0x66a9a18f
mov ecx, dword [esi + edx - 0x66a9a18f]
movzx ax, byte [ecx + edx - 0x66a9a18f]
lea esi, [esi + edx - 0x66a9a18d]
neg edx
inc edx
rol edx, 0x24
mov word [esi], ax
mov eax, dword [edi]
adc edi, 3
sub edx, edx
mov ecx, edx
add dl, 0x3e
xor eax, ebx
sub edx, ecx
bswap ecx
rol eax, 2
sub ecx, edx
jno 0x5a8dc9
sal dx, 0x41
inc dl
lea eax, [eax + ecx*2 - 0x46a32523]
adc dl, cl
setns cl
not eax
adc cl, ch
bt edx, ecx
rol ecx, cl
xor ebx, eax
jmp 0x5ed4ce
not cx
and dx, cx
bts eax, 0x22
inc dword [esp + eax - 5]
sar word [esp + eax - 4], 0x6b
mov word [esi + eax - 5], dx
inc byte [esp + eax*2 - 8]
mov dword [esp + eax - 5], edi
ret
Function at 0x62fadc
Capabilities:
Encode data using base64

Disassembly:
sub ebp, 4
movsx eax, dx
mov edx, dword [ebp + eax*2 - 0xcd2e]
mov dword [esp + eax - 0x6697], eax
xor edx, ebx
inc dword [esp + eax - 0x6697]
push eax
rol edx, 3
add edx, 0xccad03bc
movsx ecx, byte [esp + eax - 0x6693]
and dword [esp + eax*8 - 0x334b6], 0x59a6aa36
ror edx, 3
bswap edx
sar word [esp + eax - 0x6691], 0x44
and word [esp + eax*2 - 0xcd2e], ax
xor edx, 0xc585d484
sar byte [esp + eax - 0x6695], 0xc7
mov word [esp + eax - 0x6691], ax
sal dword [esp + eax*8 - 0x334b4], cl
lea edx, [eax + edx + 0x3821aed]
xchg ecx, eax
bts cx, 0xb6
cwde
not edx
xor ebx, edx
add esi, edx
movsx edx, cl
call fcn.0052b101
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, 0x2146e0f
push ebx
inc edx
push edx
cpuid
not dword [esp]
sub esi, 8
sal dword [esp], 0x21
push 0xf9aad898
mov dword [esi + 0xc], eax
mov eax, 0x60ade388
ror ax, 0xcb
mov dword [esi + eax - 0x60ad7114], ebx
cwde
movzx ebx, word [esp + eax*4 - 0x1c46c]
adc dword [esp + eax - 0x711b], eax
mov dword [esi + eax*2 - 0xe234], ecx
setnp byte [esp + eax*2 - 0xe238]
add word [esp + eax*4 - 0x1c46f], 0x9e0b
div byte [esp + ebx - 0x23db]
mov dword [esi + eax - 0xce73], edx
mov edx, eax
lea eax, [eax + 0x7f05260c]
mov ebx, dword [esp + eax - 0x7f05f477]
mov dword [esp + eax - 0x7f05f477], 0x76aa74a8
lea ebp, [ebp + eax - 0x7f05f483]
sal dword [esp + edx - 0xce6f], 0xd4
adc al, byte [esp + edx*2 - 0x19cdc]
movsx ecx, byte [esp + edx - 0xce73]
mov edx, dword [eax + ebp - 0x7f05f429]
xchg dword [esp + eax - 0x7f05f423], ecx
dec cl
sub word [esp + eax - 0x7f05f420], 0x988a
xor edx, ebx
lea ecx, [ecx*4 - 0x44731ed5]
sar word [esp + eax - 0x7f05f423], 7
cwde
dec edx
ror edx, 1
not ecx
call fcn.00d3a2d4
mov cl, byte [ebp + ecx*2 - 0x23eb42a8]
call fcn.00d68037
mov ecx, 0xa935ccbc
lea edx, [ecx + ecx*8 + 0x2142513]
mov edx, edi
jmp 0x554497

Function at 0x630c0e
Capabilities:
Inspect section memory permissions

Disassembly:
lea ebp, [ecx + ebp - 0x2a]
xor eax, ebx
sub eax, 0xdb94fd01
btr edx, edx
inc ecx
xor eax, 0x6f06f518
call fcn.00477a5a
call fcn.00e4aca1
mov edx, 0xc926582e
mov eax, dword [ebp]
movzx ecx, dl
bt edx, ecx
jb 0x4b3e08
test ebx, ebx
lea esp, [esp + 8]
je 0x5580ce
mov eax, 0x592f06a1
mov eax, dword [ebp + ebx*4]
push eax
call fcn.00e0c997