joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1040ab7f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
or edx, edx
not cl
xor bl, cl
lea eax, [eax + eax*4 - 0x16406d62]
dec eax
sal edx, 0x44
lea ecx, [esp + ecx + 8]
mov eax, dword [ecx]
not dl
and edx, dword [esp + 4]
dec dx
lea ebp, [ebp + edx*2 - 0x7fffff2e]
rol edx, 0xca
movzx ecx, dl
shr ecx, 0xff
mov dword [ebp + ecx*2], eax
movzx eax, cl
and ax, dx
sets cl
pop edx
pop eax
jns fcn.103f288f
mov edx, 0x4bbb4bac
ror dl, 0x21
jb 0x104b5fab
mov dl, byte [esi + edx - 0x4bbb4b56]
mov ecx, 0xf9ac72ad
movzx ax, byte [esi + 2]
rol ecx, 0x4c
shr cx, 0xa9
add esi, 2
or cx, cx
jp 0x1045be45
imul dl
call fcn.1045d597
or ecx, eax
not edx
neg al
neg edx
lea eax, [eax*8 - 0x29cbd5fb]
ror edx, 2
xor ebx, edx
add ebp, edx
shl ecx, 0xb2
mov eax, dword [esi + eax - 0x1d0b3205]
movsx edx, cl
or edx, edx
or cl, byte [esi + edx*8 + 4]
rol dl, 0x84
rol edx, 0x74
lea esi, [edx + esi + 2]
ror edx, 0x13
jae 0x104e0072
shr ecx, cl
mov ecx, dword [ebp + ecx - 0x7fffe8c0]
lea ebp, [ebp + edx - 0x418ed17d]
lea eax, [edx + edx + 0x1d293032]
xor ecx, ebx
dec al
jp 0x104cf64b
xor ebx, edx
mov dword [esp + 8], eax
add esi, edx
call fcn.105029c5
mov ecx, 0xe88713ab
mov edx, ecx
mov edx, dword [edi]
add edi, 4
sub ecx, 0xbfac1e1b
xor edx, ebx
mov eax, ecx
neg cl
je 0x10451fe3
not edx
add ax, ax
shl al, 0xa7
lea edx, [edx + eax*2 - 0x765a62bf]
and eax, ecx
jge 0x10475b8f
inc ecx
and al, dl
or dl, dl
adc edx, 0x7c993d10
ror ecx, 1
inc ecx
lea eax, [edx*2 - 0x6a7a66fe]
ror ecx, 3
rol dl, 0x86
neg dl
shr dx, 0xcf
xor ebx, ecx
inc edx
dec edx
setg dl
add edi, ecx
jmp 0x103e92d5
sal eax, cl
ror edx, 0xa7
mov dword [esi + edx], eax
call fcn.10480f18

Function at 0x1040b967
Capabilities:
Encode data using xor

Disassembly:
idiv ecx
mov dword [esi], edx
mov ecx, 0x760cf5b3
inc cl
mov dword [esi + ecx - 0x760cf5b0], eax
mov ecx, dword [ebp + ecx - 0x760cf5b4]
mov eax, 0x29a58021
lea edx, [eax + eax*2 - 0x23686970]
call fcn.1048f898
mov edx, 0x4c21bd38
mov edx, dword [edx + esi - 0x4c21bd38]
mov eax, 0xc7828834
shr eax, 0xf4
movzx ax, byte ss:[eax + edx - 0xc78]
mov ecx, 0xceb9728b
push ecx
adc esi, 2
push ecx
mov word [esi], ax
movzx edx, cl
lea eax, [ecx + edx*2 + 0x6c1ebd2c]
mov ecx, dword [ebp + edx*4 - 0x22c]
call fcn.104488fa
cmc
and dword [esi - 0x4bdb0811], edi
cmp edi, esi
add ch, bl
dec edi
cmp dword [edi - 0x34f2a930], edx
call 0xb90e54f0
xor dh, al
add al, 0xcf
push 0x7bff1410
push esp
scasd eax, dword es:[edi]
idiv dword [edi + esi]
out dx, al
mov byte [0x5fb8c0f6], al
pop edx
xchg ebx, eax
jne 0x1040b9dd
test dword [edx], 0x97394feb
rcl byte [esi + 0xd]
retf
cmpsb byte [esi], byte es:[edi]
rcr dword [edi], cl
xor al, 0x37
invalid

Function at 0x10411e2a
Capabilities:
Encode data using xor

Disassembly:
xor bx, dx
xchg word [esp + ecx - 0x7eb31dec], cx
call fcn.10524ad2
push ecx
or eax, 0xd00008a6
lodsd eax, dword [esi]
xchg edx, eax
invalid
Function at 0x10416ebd
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax + edi - 0xfa18f85]
xor ecx, ebx
ror ecx, 2
lea ecx, [ecx + eax*2 + 0x74f2cf8b]
mov dword [esp + eax - 0xfa18f85], eax
mov edx, eax
xor dx, word [esp + eax*2 - 0x1f431f0a]
rol ecx, 1
or ax, word [esp + eax - 0xfa18f85]
bswap ecx
lea ecx, [eax + ecx - 0x1ddccb09]
jle 0x10460f7e
xchg dword [esp + eax - 0xfa18f85], edx
shr dword [esp + eax - 0xfa18f85], 0x30
ror ecx, 1
inc edx
jno 0x10499cc5
call fcn.104aaf60
Function at 0x104193f1
Capabilities:
Encode data using base64

Disassembly:
inc al
mov word ss:[ecx], dx
call fcn.10460a9e
xor word [esp + 2], 0xf408
ror dl, 1
mov ecx, dword [esp]
xor dl, 0xba
neg byte [esp]
inc cx
rol ecx, 0x34
xor bl, dl
shl ecx, 0xf1
lea edx, [esp + edx + 4]
adc cx, 0x7e38
sar ecx, cl
mov dword [edx + ecx*4 - 0x198], eax
jb 0x10465494
mov edx, 0xa58dc1ae
mov eax, 0xd5a33182
sub ebp, 2
rol dl, 0x26
movzx ecx, word [ebp]
sar edx, 2
shr eax, 0xf4
setp dl
xor cx, bx
sar eax, 0x3d
not cx
neg cx
not ax
bswap edx
xor dl, 5
inc cx
and ax, dx
shl ax, 0x46
sal edx, 0xdb
rol cx, 1
sar dl, 0x62
sal dx, 0xc5
call fcn.10531743
rol dl, 1
push eax
mov word [esp + 3], ax
dec dl
mov ecx, eax
push eax
not dl
xor bl, dl
shl al, 0x21
push ecx
not ax
lea edi, [edi + ecx*2 - 2]
sal word [esp + ecx*2 + 0x12], 0xeb
push ecx
mov word [edi + ecx*8], dx
pop edx
pop edx
pop edx
pop ecx
pop eax
pop eax
ja fcn.10439d66
xor ebx, eax
mov dword [esp + ecx*2 - 0x61225602], edx
shl dx, cl
sal edx, 0xfc
adc ebp, eax
mov cx, word [ecx + esi - 0x30912b01]
add dx, word [esi + 2]
sal word [esp + 8], 2
adc esi, 2
mov eax, dword [esp + 8]
rol eax, 0x2d
and cx, dx
pop edx
sar al, 0x23
not cx
pop edx
mov word [esi + eax - 0x7430dfe], cx
js 0x105299ee
not eax
neg word [esp + edx - 0x7aea3c80]
shr edx, 0x8a
bswap eax
push edx
not eax
movsx ecx, dl
xor ebx, eax
neg byte [esp + edx*2 - 0x3d751a]
adc word [esp + edx*4 - 0x7aea36], cx
add ebp, eax
xadd cx, dx
jo 0x103ffd7a
mov dx, word [esi + edx*2 - 0x3dff1e]
mov ax, word [esi + 2]
xor cl, cl
not byte [esp + 1]
adc esi, 2
jmp 0x1049f55a
jnp 0x104651d5
dec al
xadd word [esp], cx
not al
push ecx
dec ecx
sbb al, 0x3b
not cl
push ecx
xor ecx, ecx
rol al, 1
not al
xor bl, al
lea eax, [esp + eax + 0xc]
dec byte [esp + ecx + 0xa]
rol ecx, 0x1b
mov dword [eax + ecx*2], edx
or word [esp + ecx + 0xa], cx
neg dword [esp + ecx + 8]
mov dword [esp + ecx], edi
ret 8
neg word [esp + 6]
not dx
sar cx, 0x2d
not ax
sbb ecx, ecx
or dx, ax
movsx eax, cx
mov word [esi], dx
call fcn.10520409
mov eax, 0x58058b2e
movzx edx, ax
lea ebp, [ebp + edx*8 - 0x45974]
shr edx, 0xb4
xor edx, dword [ebp + eax - 0x58058b2e]
shl eax, 0x5d
sal al, 0x22
xor edx, ebx
lea ecx, [eax + eax*8 - 0x57c8a878]
shr cx, 0xe2
xor edx, 0xd842f39
and ax, 0x199e
sbb al, 0x90
cmova ecx, eax
not edx
dec cx
rol ax, cl
push eax
ror edx, cl
neg ecx
xor word [esp + 2], 0x983b
inc edx
rol eax, 0xe8
jb 0x103fe90f
dec ecx
xor ebx, edx
inc dword [esp + eax*2 - 0x1c180]
neg word [esp + eax - 0xe0bf]
add edi, edx
add word [esp + eax*2 - 0x1c17f], 0xa52d
mov edx, dword [esi + eax - 0xe0c0]
jno 0x104d35ee
jnp 0x103f832c
setg al
lea esi, [eax + esi - 0xdffc]
cmovo ecx, eax
adc dword [esp + eax*8 - 0x70000], eax
lea ecx, [ecx*4 - 0x34e7a5c8]
lea ebp, [ebp + eax - 0xe001]
neg eax
movzx eax, byte [ebp]
xor al, bl
neg cx
jge 0x10461ea6
adc dx, 0xa7a6
not eax
add ecx, 0x30a315ac
xor ebx, eax
sar ecx, cl
adc edi, eax
mov eax, dword [esi + ecx - 7]
neg edx
neg edx
xadd cl, dl
mov dl, byte [esi + ecx*4 - 0x2b0]
lea esi, [esi + ecx*4 - 0x2ae]
sub ecx, ecx
ror cl, 5
mov byte ss:[ecx + eax], dl
mov edx, 0x7cadc599
adc cx, dx
sbb dx, cx
jmp edi
inc dl
mov dword [esp + eax*2 - 0xe861bfc], ebp
ret
Function at 0x10426b44
Capabilities:
Encode data using xor

Disassembly:
inc ecx
neg ecx
ror ax, 0x61
not ax
inc ecx
mov dword [esp + eax*2 - 0x7fda], eax
mov dword [esp + edx - 0x20], 0xd2cd820
inc eax
not ecx
sets byte [esp + eax - 0x3fea]
jle 0x1049ce8b
sub ecx, 0xa18f7020
rol ecx, 2
shr eax, 0x2a
call fcn.1049b461
mov ecx, 0x29a2ed13
jmp 0x104b713f
mov ax, word [esi + ecx*2 - 0x5345da26]
mov dx, word [esi + ecx*2 - 0x5345da24]
inc cl
dec esi
fisub dword [0x8b66acba]
xchg esp, eax
dec esi
fsub qword [0xc1feacba]
jp 0x10505b1c
ja 0x104b7142
mov ch, 0xef
or esi, edx
jl 0x104b7191
idiv dword [edx - 0x68cd7887]
push eax
call 0xcb343230
push ebx
invalid
js 0x104b71b3
sbb al, byte [edi]
add dword [edx + 0x5924efbd], 0x7d
xor esp, dword [edi + 0x41]
into
inc esi
mov eax, 0x1212e107
and al, 0x95
enter 0x7a9b, 0xffffffffffffffe3
call [edi]
out dx, eax
or byte [edx - 0x564e6928], bl
adc dword [eax], esp
fcom dword [esi + 0x2011a9b1]
outsd dx, dword [esi]
sbb byte [eax + 0x40], 5
cld
or al, 0x9a
jns 0x104b71f3
xchg dword [esi], eax
sbb dl, dl
pop ss
in eax, 0x20
salc
pushal
jmp ebp
mov dl, 0xaa
not dword [0x8be8031a]
add ebp, eax
mov eax, dword [edi]
ror ecx, 0x15
mov cl, byte [esi + ecx*2 - 0x2ed14296]
call fcn.104bf37d

Function at 0x1042890e
Capabilities:
Encode data using base64

Disassembly:
sbb edi, 4
xor word [esp + 2], 0x7c15
mov dword [edi], edx
pop ecx
jge fcn.10439d66
xor eax, 0x3d3a9225
xor ebx, eax
bswap ecx
mov dword [esp + ecx*2 - 0x72480208], 0xc49a2584
and edx, 0xbc2def20
adc ebp, eax
push edx
movzx eax, byte [ecx + esi - 0x39240104]
lea esi, [esi + ecx*2 - 0x72480207]
sub dx, cx
shr dl, 0xc3
shr dx, cl
xor al, bl
xor al, 0x86
sar byte [esp + ecx*2 - 0x724801ff], 0x42
and dword [esp + ecx*2 - 0x72480201], 0x421f09bd
adc edx, 0x2e3c3437
inc al
and byte [esp + ecx*2 - 0x72480200], 0x31
inc edx
pop edx
ror al, 1
and dword [esp + ecx - 0x39240100], 0xfa2c7c88
sub ecx, edx
add al, 0xa7
lea ecx, [edx*2 - 0x52723655]
xor bl, al
ror edx, cl
jb 0x1042ca5e
lea eax, [esp + eax + 8]
setb cl
mov edx, dword [eax + edx - 0x64130020]
pop ecx
jae 0x1041b1c5
sub esi, 4
mov edx, 0xa139d337
mov ecx, 0xa891aa8
push ecx
mov eax, dword [esi + ecx*4 - 0x2a246aa0]
shr cl, 0xa6
xor eax, ebx
jmp 0x103fd990
Function at 0x1042a00c
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x6631e59d
mov dword [esi + ecx - 0x6631e599], eax
lea edx, [ecx*8 + 0x55036319]
movzx eax, cx
mov eax, dword [ebp + eax - 0xe59d]
add cx, 0xa919
add edx, edx
mov dword [esp + ecx - 0x66318eb6], ecx
lea ebp, [ecx + ebp - 0x66318eb2]
xor eax, ebx
ror edx, 0xcc
mov dword [esp + ecx - 0x66318eb2], ecx
lea ecx, [edx + ecx*8 + 0x3035139b]
ror eax, 1
or cx, dx
and edx, ecx
call fcn.1046b6bd
movzx ax, byte [ebp]
mov edx, 0xab1a1ac
sar edx, 0x37
mov cl, byte [ebp + edx - 0x13]
not edx
adc ebp, 2
jmp 0x10490930
neg al
sub ecx, 0xf93ee3af
ror al, 1
neg cx
adc dl, dl
dec al
inc edx
setg cl
xor bl, al
add eax, esp
jmp fcn.104d69b9
rol edx, 0xac
sar dl, 0x24
shr al, cl
xor edx, edx
mov word [ebp + edx*8], ax
lea eax, [edx*4 + 0x6d9c65b2]
adc edx, dword [edx + edi]
jmp 0x1050177e
or ecx, 0x1103cd36
rol cl, 4
not edx
call fcn.1050315b
sub edi, 4
mov eax, dword [edi]
mov edx, 0xac11659b
xor eax, ebx
lea ecx, [edx + edx - 0x3fe98671]
lea edx, [ecx*4 - 0x25ca3adb]
rol eax, 1
jmp 0x104e9ba5
xor edx, ebx
not ecx
lea ecx, [eax + eax*2 - 0x714ac2cb]
xor edx, 0xd6366111
jmp 0x10499321
push eax
mov dword [esp + eax - 0x269c], edi
ret 8
or edx, 0x49b161af
cmovp cx, dx
xor eax, 0xd69ecc22
ror ecx, cl
dec ecx
sal ecx, 0x78
ror eax, 1
dec eax
ror ecx, 0xde
bswap eax
xor ebx, eax
add ebp, eax
ror edx, 0x5f
lea ecx, [edx + 0x75ab3dad]
adc cx, dx
lea edi, [edi + ecx - 0x6d2324ab]
movzx eax, byte [edi + ecx - 0x6d2324aa]
dec ecx
dec ecx
xor al, bl
lea ecx, [edx - 0x175a9a65]
add al, 0x80
sub edx, 0x703f08bf
js 0x1045d2e3
jmp 0x1051677f
push eax
xor ebx, edx
push ecx
shl cx, 0x67
add edi, edx
jmp 0x104e6a2f
fld dword [ebx]
int1
mov dword [esp + edx - 0x400000ff], esi
ret 4
movzx ecx, ax
lea edi, [edi + ecx*8 - 0x32d8c]
xadd cx, ax
js 0x104d7fd7
fidivr dword [ebx]
jb 0x1050174d
sub dword [ebx + 0x74], ebp
mov dword [eax + 0x4c24d068], 0x60642895
imul ebp, dword [esi - 0x49], 0x9d890dea
sub byte [edi + 0x3277e975], ah
sbb dword [esp + esi*8 - 0x44], 0x362022f3
mov ebx, 0x1da2528a
mov cs, eax
insd dword es:[edi], dx
mov byte [0x1420325a], al
invalid
add ebp, 4
xor edx, ebx
neg edx
mov ecx, 0x641749a7
and ecx, ecx
sbb edx, 0x611c7c24
movzx eax, cx
not edx
add cx, ax
neg edx
xchg cx, ax
lea ecx, [eax + eax + 0x360a3d25]
sal ax, cl
lea edx, [edx + ecx*4 - 0x528fab6b]
sbb cl, 0x23
jae 0x104fa54e
pop eax
pop edx
pop edx
pop ecx
or ecx, edi
jmp ecx

Function at 0x1042b330
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esi + 4], eax
mov edx, 0x7786c112
call fcn.1049bbea
Function at 0x1043405e
Capabilities:
Authenticate hmac

Disassembly:
shrd dx, ax, cl
mov word [ebp], dx
sub esi, 4
mov eax, 0x1708cd0d
mov eax, dword [eax + esi - 0x1708cd0d]
mov ecx, 0x5a1c2711
xor eax, ebx
movzx edx, cx
dec edx
ror eax, 3
shr edx, cl
xor ecx, 0xfb0fd724
sbb edx, 0xe11d318b
not eax
shr cl, 0x64
adc edx, 0x782b269e
sbb dx, 0x9002
sbb eax, 0x820f20a0
sub ecx, ecx
sar cl, 0xe7
ror eax, 2
shl ecx, 0x5f
xor ebx, eax
call fcn.104981e0
xor ebx, eax
bswap edx
shr edx, cl
lea esi, [edx + esi - 5]
add cl, cl
add dx, dx
not edx
mov dword [esi + ecx*2 - 0x1fffc], eax
neg cx
mov dword [esp + ecx - 2], ecx
pop eax
pop eax
jne fcn.10404a3d
call fcn.104d543b
mov dx, word [ebp + edx - 0x7410f2a3]
mov ecx, 0x30bfef0d
dec cx
mov ax, word [ebp + ecx*2 - 0x617fde16]
mov cl, byte [ecx + ebp - 0x30bfef08]
jp 0x105088c9
jmp 0x104aaea3
jmp 0x1041ed2b
add ebp, 4
jmp 0x104922fd

Function at 0x10437828
Capabilities:
Authenticate hmac

Disassembly:
shl ecx, cl
or cl, byte [esi + ecx - 0x7d7ffffe]
call fcn.1042f59d
call fcn.1040c3ea

Function at 0x1043a747
Capabilities:
Encode data using xor

Disassembly:
or al, 0x35
or byte [edx + 0x1171e8e4], 0xc
add byte [ebx + 0x4c78107], cl
mov eax, dword [edi]
add edi, 4
lea ecx, [ecx + ecx*2 + 0x503047bb]
xor eax, ebx
jno 0x1043a740
or al, 0
xor eax, ebx
call fcn.104aef84
mov dword [esp], 0xefbcc53b
add cx, dx
mov word [esi], cx
call fcn.1051fe39
neg cl
mov word [esi], dx
call fcn.104dbeac
jp 0x1043a7d4
dec esp
adc byte [ecx + ecx*8], bh
loop 0x1043a72d
cwde
jb 0x1043a727
outsb dx, byte [esi]
enter 0xfffffffffffff0c8, 0xffffffffffffffa4
outsd dx, dword [esi]
xor al, 0x47
dec edi
push 0xfc28810a
xchg ecx, eax
xchg al, al
enter 0x5ad4, 0xffffffffffffffce
xor dh, byte [edi - 0x6d]
je 0x1043a77d
xor eax, 0xeeb3af7
xor eax, 0x4c32a697
invalid
leave
sbb ebx, dword [edx]
mov ebx, dword [ecx - 0x12]
in eax, 0x9d
jmp 0x1043a80c
xchg edx, eax
test eax, 0xf2c1d933
sbb dword [edi], ecx
test dword [eax + ebp*2], edi
add al, byte [eax]
mov edx, 0xf501af1d
movsx ecx, dl
mov eax, dword [ebp + ecx*4 - 0x74]
jmp 0x1048d7a2
lea ebp, [ebp + ecx - 0x19]
xor eax, ebx
xor dx, dx
rol eax, 2
add cx, dx
push edx
neg dword [esp + ecx*2 - 0x3a]
sub eax, 0xed8b3510
rol eax, 1
xor eax, 0xf8340d22
rol eax, 3
shl word [esp + ecx*2 - 0x39], 0x2b
call fcn.10505cf0

Function at 0x104445ed
Capabilities:
Encode data using base64

Disassembly:
add ebp, ecx
mov dword [esp + edx - 0x5b91cd01], 0xaf1db4a6
add eax, dword [esp + edx - 0x5b91ccf9]
movsx ecx, dx
mov ecx, dword [esi + eax - 0x2354c18b]
lea esi, [esi + eax - 0x2354c187]
not dword [esp + eax*2 - 0x46a9830e]
mov dword [esp + edx - 0x5b91ccf9], ecx
shr byte [esp + eax*2 - 0x46a98313], 0x41
push eax
sar dl, 0xc6
push dword [esp + 0xc]
popfd
and al, al
call fcn.1040f705
rol byte [esp], 0x21
not word [esp + 4]
mov cl, byte [esi + 2]
shl eax, 0x8c
add esi, 2
call fcn.104a47bd
Function at 0x1044f1d2
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + edx + 0x512d8730]
bswap eax
add dx, dx
jl 0x1049ffde
xor ecx, dword [ebp + eax - 0x9a6b4e7]
or edx, eax
lea ebp, [ebp + eax*2 - 0x134d69ca]
call fcn.104ee695
not edx
call fcn.104f53bd
call fcn.1046bacf
lea edi, [edi + ecx - 0x2484e4ba]
xor eax, ebx
neg dx
add edx, ecx
inc eax
jmp 0x103e0200
lea eax, [eax + ecx - 0x234b75fe]
call fcn.104281e2

Function at 0x104584db
Capabilities:
Encode data using xor

Disassembly:
dec ecx
ror ecx, 2
shl edx, 0x93
setbe al
mov dword [esp + eax - 0xbdfc], edx
xor ebx, ecx
mov dword [esp + eax*4 - 0x2f800], 0x98323219
sub dl, 0x83
add ebp, ecx
shl dword [esp + eax - 0xbdf8], 0x70
jp 0x1042c824
push 0x5a1015ae
mov ecx, 0xcc13ce13
jmp 0x10513150
or word [esp], cx
mov edx, dword [edi]
movsx eax, byte [esp]
setnp al
xor edx, ebx
call fcn.104f22a2
sub edi, 4
shr byte [esp], 0x21
jl 0x104e00e0
add esi, 2
movzx eax, byte [ebp]
call fcn.104d8e82
imul ebx, dword [ebx + 0x504cc2c9], 0x15
cli
push ecx
test al, 0x5a
and eax, 0x85453d52
add al, 0x7b
imul dword [ebp - 0x65bdba38]
ret 0x637b

Function at 0x10458bf3
Capabilities:
Encode data using xor

Disassembly:
bswap edx
lea ebp, [ebp + edx*2 - 0x6dd3203e]
call fcn.10525dd7

Function at 0x10458e22
Capabilities:
Encode data using base64

Disassembly:
push 0xe8fcca4
pushfd
or dword [esp + 4], 0x3f9dd3ab
push ebx
mov dword [esp + 0xc], 0xf290ae96
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.10507915

Function at 0x1045b9a0
Capabilities:
Encode data using base64

Disassembly:
neg ecx
call fcn.10501ae9
rol cx, 0x8a
setnp dl
neg eax
neg edx
rol edx, 0x82
xor ebx, eax
shr ecx, 0x5b
add cx, 0x9b2c
adc edi, eax
call fcn.10459d62
xor cl, bl
sub cl, 0x34
ror cl, 1
dec dword [esp + 4]
inc cl
rol cl, 1
mov dword [esp], 0xc0b00c3d
inc cl
shr word [esp + 4], 0x42
neg cl
push 0x28a497b4
mov edx, dword [esp + 8]
inc cl
xor cl, 0x24
ror cl, 1
sub cl, 0x34
call fcn.10481f85
sub ebp, 4
mov eax, dword [ebp]
xor eax, ebx
mov ecx, 0xe9342807
movzx edx, cx
dec eax
neg eax
xor cx, cx
lea eax, [eax + edx*4 + 0x1da64f96]
jno 0x103e35fd
xor ecx, ebx
sal dword [esp + eax - 0x2d39c624], 0x3e
add eax, eax
bswap ecx
sal word [esp + eax - 0x5a738c47], 0xa6
je 0x103e1aaf
mov edx, dword [esi]
mov ecx, 0x9d3f2b11
movsx eax, cx
push ecx
mov al, byte [esi + eax - 0x2b0d]
add esi, 6
sub dword [esp], ecx
mov byte ss:[edx], al
call fcn.10448d9d

Function at 0x1045d597
Capabilities:
Authenticate hmac
Encode data using base64
Packed with generic packer

Disassembly:
mov word [esi], ax
mov dword [esp], 0xa68b7621
sub edi, 4
lea edx, [ecx + ecx*4 - 0x257fe4c4]
shl ecx, cl
mov eax, dword [edi + ecx*2 - 0x6f0000]
sar dword [esp + ecx*8 - 0x1bc0000], 0x3c
jp 0x104b3bbb
mov eax, 0x64b9b5ac
jmp 0x103e938a
sbb dword [esp + ecx*2 - 0x6f0000], 0x719ac617
xor eax, ebx
or edx, 0x31a124a7
js 0x104da229

Function at 0x1045f957
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + eax*4 - 0x2fa40000]
add dl, 0xb0
not edx
inc ecx
xor eax, ebx
rol eax, 2
lea eax, [eax + ecx*4 - 0x59bb9735]
call fcn.10422781
Function at 0x104661ae
Capabilities:
Authenticate hmac

Disassembly:
rol word [esp + edx + 0xd], 0x43
neg al
xor bl, al
mov dword [esp + edx*2 + 4], ecx
shl dword [esp + edx*4 + 0xb], 0x12
lea eax, [esp + eax + 0x10]
mov dword [esp + edx*4], edx
rol cx, 0xa1
shr ecx, 0x1d
adc cl, byte [eax + edx*2]
jmp 0x1051c156

Function at 0x1046bacf
Capabilities:
Encode data using base64

Disassembly:
sub word [esp + eax - 0x3fffff], cx
bswap edx
xor ebx, edx
jmp 0x10497e1f
mov dword [esp + eax*4 - 0x1000000], eax
lea edx, [edx + eax*4 + 0x44ad6b2b]
or byte [esp + eax - 0x3ffffe], cl
jg 0x104302e7
call fcn.103e018b

Function at 0x1048d01c
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
add al, 0xb0
xor al, 0xae
and dl, dh
inc al
add dx, 0x191
call fcn.104dc3bd
mov edx, dword [edi + eax - 0x183d4e09]
inc cl
lea edi, [edi + eax - 0x183d4e05]
or al, 0x32
not eax
xor edx, ebx
rol cl, cl
bswap edx
rol ecx, 0x72
dec al
add cx, ax
rol edx, 1
push ecx
xor ecx, dword [esp + ecx*2 - 0x11ab86]
bswap edx
neg dword [esp + ecx]
ror word [esp + ecx*2 + 1], 0xaf
pop ecx
ror edx, 2
bswap ecx
xor al, 0xab
sub cl, ch
xor ebx, edx
ror cx, 1
sub ax, cx
add ebp, edx
lea edx, [eax*4 + 0x10b6d982]
jmp ebp
xor eax, 0x3db45882
not edx
dec edx
mov dword [esp], eax
ror edx, 2
xor ebx, edx
not eax
add edi, edx
sal al, 0x21
rol dword [esp + eax - 0xa79480c], cl
mov dx, word [esi + eax*2 - 0x14f29018]
setae byte [esp + eax*2 - 0x14f29015]
call fcn.104eefa9
neg ecx
inc cx
bswap edx
and ecx, 0x68ad91ac
sbb edx, 0x73094a93
dec eax
shr dword [esp + ecx - 0x40218000], 0x59
adc ax, word [esp + ecx - 0x40217ffe]
ror edx, 1
pop eax
neg ecx
lea edx, [edx + eax + 0x480d73f9]
ror eax, 0x32
dec eax
xor ebx, edx
and cx, 0xf397
adc ebp, edx
inc ecx
shl ecx, cl
movzx eax, byte [edi + ecx - 0x7fbd0002]
ror cl, cl
adc cx, cx
lea edx, [ecx*4 - 0x53d494dc]
lea edi, [edi + ecx - 0x7fbd0100]
inc edx
xor al, bl
or cx, 0x2519
inc cl
shl ecx, 0x5f
not al
jb 0x104054ae

Function at 0x10499d63
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
xor dx, 0xbd22
not cl
and ax, dx
xadd eax, edx
neg cl
rol eax, 0x50
xor bl, cl
or ax, 0xca5
adc ecx, esp
sar eax, 0x78
add edx, dword [ecx + edx]
mov ecx, 0x999ae80d
and cx, 0x17a5
sar eax, 0x21
sbb esi, 4
shl al, cl
mov dword [esi], edx
je fcn.10404a3d
rol edx, 3
sub edx, 0x83aa272b
rol edx, 2
call fcn.10435593
push 0xb8a9f080
mov dword ss:[ecx], edx
mov edx, 0x553f5928
mov dword [esp + edx - 0x553f591c], edx
mov edx, dword [esp + 4]
add edx, 0xfff85558
jmp edx
and ecx, ecx
shl dword [esp], cl
mov word [ebp], ax
cmova ecx, dword [esp]
sub esi, 4
pop ecx
mov edx, dword [esi + ecx*4 - 0x62400000]
xor edx, ebx
movsx eax, cl
sar cx, 0x4d
jp 0x1045f7e8
xor eax, 0x341a7c30
xor ebx, eax
and dl, 0x9a
and cx, cx
adc ebp, eax
shl cx, 0x87
mov eax, ecx
xadd ax, cx
movzx ecx, byte [ecx + edi - 0x5e261b80]
adc dl, 0xb0
lea edi, [edx + edi - 0x73fb82af]
not edx
xor cl, bl
dec ax
sar eax, 0x3d
xor cl, 0xaf
sub cl, 0xbc
jmp 0x103f13e1
add ebp, 2
shl word [esp + 4], 0x8f
and ax, dx
neg word [esp + 6]
pop edx
not ax
jns 0x104648f0
Function at 0x1049d27c
Capabilities:
Encode data using base64

Disassembly:
add ebp, 4
sar ecx, 0xca
xor eax, ebx
dec ecx
sub eax, 0xd0b479a1
lea edx, [ecx + 0x15288a86]
not eax
mov dword [esp + edx*2 - 0x2a306bc4], 0x343b39a7
rol eax, 1
dec eax
or dword [esp + edx*4 - 0x5460d788], 0xc4299095
adc edx, edx
xor ebx, eax
add edi, eax
and dl, byte [esp + edx*2 - 0x5460d788]
movsx eax, word [esp + edx*2 - 0x5460d708]
mov edx, dword [esi + edx*2 - 0x5460d708]
ja 0x104f7a7b
shr al, 0x85
jne 0x1050aab4
push 0xf831ff29
shr dword [esp], 0x3f
shl dword [esp], 0x49
mov eax, dword [esi]
movzx dx, byte ss:[eax]

Function at 0x104af271
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp + ecx - 0x72], dx
mov edx, ecx
xor edx, ecx
sbb cl, ch
pop edx
pop ecx
jg fcn.105013e9

Function at 0x104b4261
Capabilities:
Encode data using base64

Disassembly:
sub eax, 0xf12a0dae
lea edx, [eax + edx - 0x6390388a]
rol al, cl
xor edx, 0x1a019637
rol edx, 1
call fcn.104df671
mov edx, dword [eax + ebp - 0x27]
xor edx, ebx
lea edx, [edx + eax*4 - 0x4b3bf748]
not edx
mov dword [esp + ecx - 0x68f1de4f], ecx
sar cl, 0x21
ror edx, 2
jmp 0x10494ab1

Function at 0x104cf563
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esi + eax - 0x421fcbf]
lea ecx, [eax + eax*4 - 0x7e5c146d]
mov eax, dword [esi + eax*4 - 0x1087f2f8]
xor cl, ch
dec ecx
mov ecx, dword [esi + 8]
call fcn.104e66f7
sub ax, cx
sal ax, 0xe8
adc esi, edx
mov dword [esp + ecx], 0xc80dccaa
mov bp, word [ecx + ebp]
sar cx, 0xa1
jbe 0x1050ae12
mov eax, 0x421fcbf
movsx edx, ax
jmp 0x1046ba65
rol ecx, 0xba
pop ecx
pop ecx
pop eax
pop ecx
je fcn.103f288f

Function at 0x104cf9eb
Capabilities:
Encode data using base64

Disassembly:
dec ecx
lea ebp, [ebp + ecx*2 - 0x1f1dbfd2]
mov byte [eax + ecx*4 - 0x3e3b7fb0], dl
rol dword [esp + ecx - 0xf8edfec], cl
sub byte [esp + ecx*2 - 0x1f1dbfd8], cl
or cl, 0xf
mov dword [esp + ecx - 0xf8edfef], edi
ret
bswap eax
neg cx
not eax
dec cx
neg eax
bswap edx
xor dx, 0x829a
xor ebx, eax
dec dl
add edi, eax
movzx eax, dx
mov dword [esp + edx - 0x13200c94], 0x733a4688
mov eax, dword [edx + ebp - 0x13200c94]
inc cx
shr dword [esp + edx - 0x13200c94], 0x5f
dec dword [esp + ecx*8 - 0x7c76ff68]
mov dl, byte [ebp + edx*2 - 0x26401924]
jle 0x1046109f

Function at 0x104d7dc6
Capabilities:
Encode data using xor

Disassembly:
ror cl, 1
xor bl, cl
sal eax, 0x90
mov dword [esp], eax
call fcn.103f130f
not cx
not dx
or cx, dx
mov edx, 0xb721fe2a