joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf996d9
Capabilities:
Encode data using base64

Disassembly:
mov word [edi - 2], cx
mov eax, dword [esi + 1]
add esi, 5
xor eax, ebx
mov edx, 0xa3a8038c
shl edx, 0xa2
xor word [esp + 4], 0xfd8f
dec eax
rol eax, 2
call fcn.00b4a96e
mov edx, 0xe3998b8
movsx ecx, dl
sar dl, 0x21
mov edx, dword [edx + edi - 0xe3998dc]
mov eax, ecx
push eax
movzx eax, byte [esi]
xor al, bl
dec al
pop ecx
neg al
call fcn.00faf716
mov dword [esp + 4], 0xd93d0686
movzx edx, byte [esi]
add esi, 1
xor dl, bl
sub dword [esp + 4], ecx
shr ecx, cl
rol dl, 1
mov eax, ecx
dec dl
inc eax
ror al, 7
neg dl
add dl, 0x8f
mov dword [esp + ecx - 0xfb81], eax
pop ecx
call fcn.00fc5c4a
cmc
cmp esi, edi

Function at 0xf99793
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + eax - 0x4bbbbf91], esi
xor dword [esp + eax - 0x4bbbbf91], ebp
dec edx
mov esi, dword [esp + edx - 0xff90]
inc si
xchg dword [esp + edx - 0xff93], edx
dec eax
arpl bp, bp
call fcn.00f9e12f
mov edx, dword [edi]
mov ecx, 0xec837f05
jmp 0x1153845
mov esi, ecx
add edi, 4
xchg esi, ecx
movzx eax, cl
mov esi, edx
neg cl
ror ecx, cl
je 0xb344e0
jb 0xb8cac0

Function at 0xf9af80
Capabilities:
Encode data using base64

Disassembly:
push 0x5f00b42c
lea esp, [esp + 0xc]
jne 0xb18d04

Function at 0xf9cd68
Capabilities:
Encode data using base64

Disassembly:
inc edx
add al, 0
jp 0x100caed
jno 0xf9cd04
dec ecx
ror ch, 0x5e
scasb al, byte es:[edi]
mov esp, 0x78cc5655
cdq
aam 0x55
push esi
int3
inc bp
and esp, ebp
call fcn.011aaa35
inc esp
movzx esp, dl
jmp 0x114c5b9
inc ecx
xor ecx, 0x22250a7
inc ecx
movzx ebp, ax
inc ecx
bswap ecx
inc ecx
inc ecx
dec edx
lea eax, [eax*2 - 0x5c44d4fd]
dec eax
shl eax, 0xd7
dec eax
adc edx, 0x22b038b9
inc ecx
neg ecx
inc ecx
xor ecx, 0x201c939c
shr ax, 0x25
call fcn.01193d58

Function at 0xfa7ab5
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec byte [esp + edx - 0x189d4a80]
lea ecx, [esp + ecx + 8]
sal al, 0x64
sbb eax, edx
lea eax, [edx*2 - 0x6792b59]
mov ax, word [ecx + eax*2 - 0x5582d36a]
xchg byte [esp + edx - 0x189d4a80], dl
mov dx, word [edi + edx - 0x189d4a33]
mov ecx, dword [esp + 4]
mov dword [esp], ecx
adc ecx, ecx
or ax, dx
not ax
xchg byte [esp + ecx*4 - 0x39cac0fd], cl
lea ecx, [ecx*8 - 0xb432d60]
ror ecx, 0x8d
mov word [edi], ax
lea eax, [ecx*2 - 0x3c57715d]
xchg dword [esp + eax*2 - 0x625e278c], ecx
mov ecx, dword [esi + ecx - 0x58204038]
adc ax, word [esp + eax - 0x312f13c5]
lea esi, [esi + eax*2 - 0x625eacaf]
movsx edx, al
sets dl
xor ecx, ebx
lea edx, [eax + edx*8 + 0x68991c17]
bswap ecx
call fcn.00b402eb
push 0xc8bd563e
mov dword [esp], esi

Function at 0xfaae9e
Capabilities:
Encode data using base64

Disassembly:
ror eax, 2
shl byte [esp + ecx - 0x21076f8a], 4
dec eax
xor ebx, eax
call fcn.0116a6d2
Function at 0xfb105a
Capabilities:
Encode data using base64

Disassembly:
pop eax
movsx eax, dl
xor ebx, ecx
add ebp, ecx
mov di, word [edi + edx - 0x3a7ae800]
and dx, ax
pop edx
jbe fcn.00fa3df3
rol ax, cl
rol edx, 1
inc edx
inc ax
not edx
add edx, eax
xchg byte [esp + ecx*2 - 0x154], al
xor ebx, edx
and dword [esp + ecx*2 - 0x156], 0x2834e3e
lea eax, [ecx + ecx*4 - 0xa649f5b]
adc ebp, edx
call fcn.00b04cb4
call fcn.0113c559

Function at 0xfb10a8
Capabilities:
Encode data using base64

Disassembly:
pop eax
shr ecx, 0x4b
xor edx, 0x82003101
xor ebx, edx
pop ecx
add ecx, 0x614971
jmp ecx
sbb dword [esp + ecx - 0xa9060], eax
bswap edx
jns 0xaf8f6a

Function at 0xfbbd93
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*2 - 0xca], ebp
ret 4
lea ecx, [edx + edx*4 - 0x16fdc4e5]
mov dx, word [ebp + ecx - 0x65c78ccd]
mov dword [esp + ecx - 0x65c78ccf], ecx
shl byte [esp + ecx - 0x65c78ccc], 0x27
mov cl, byte [ebp + ecx - 0x65c78ccb]
call int.00b18f05
mov ecx, 0x968ff888
or ecx, 0x230db32e
adc dl, 0x24
lea ecx, [ecx*4 + 0x562f4233]
sub cl, ch
push ecx
not dl
adc dl, 0xb9
xor bl, dl
dec ecx
dec byte [esp + ecx*2 - 0x68de6172]
not ecx
lea edx, [esp + edx + 4]
mov byte [edx], al
mov ecx, dword [esi - 5]
dec dword [esp]
xor ecx, ebx
not byte [esp + 1]
not ecx
bswap ecx
not ecx
call fcn.011611ee
call fcn.0100b23f
push 0xcdb09414
add edi, 4
push 0x660d849a
shld ax, dx, cl
dec dword [esp + 3]
mov word [edi], ax
mov edx, dword [esp + 3]
movzx ecx, dl
js 0xb253f1
mov edx, dword [edi]
mov eax, 0x5b87b716
mov ecx, eax
mov eax, dword [edi + eax - 0x5b87b712]
bswap ecx
push ecx
add byte [esp + ecx - 0x16b78759], 0xa0
mov ecx, dword [edi + ecx - 0x16b78753]
add edi, 4
div ecx
mov dword [edi], edx
jmp 0x1120fec

Function at 0xfc2a65
Capabilities:
Encode data using base64

Disassembly:
neg ecx
sub ecx, 0xdba0f998
call fcn.0119031b

Function at 0xfc2a72
Capabilities:
Encode data using base64

Disassembly:
neg al
mov dword [esp + edx - 0x4771e398], ecx
xchg edx, ecx
rol dword [esp + edx*2 - 0x6857d876], 0xe2
xor bl, al
inc dl
call fcn.00acb262
Function at 0xfc2a8e
Capabilities:
Encode data using base64

Disassembly:
sub al, al
mov eax, dword [esi]
movsx edx, word [esp]
xor eax, ebx
dec ecx
xadd word [esp + edx*4 - 0xacdc], cx
sar dx, 0x41
inc eax
inc edx
xchg cx, dx
and byte [esp + edx - 0x2b35], ch
ror eax, 1
xchg dh, cl
xor byte [esp + edx - 0x9c36], dh
not eax
not word [esp + edx - 0x9c37]
push edx
not dword [esp + edx - 0x9c36]
xor eax, 0x381b100a
xchg dword [esp + edx*2 - 0x1386e], ecx
ror word [esp + edx*2 - 0x1386b], 0x67
setae cl
bswap eax
xor ebx, eax
add edi, eax
shl dl, cl
xadd ecx, edx
mov eax, dword [ebp + 2]
sub dx, word [esp + 6]
sal edx, cl
shr edx, 0x99
lea ebp, [ebp + edx*8 - 0x32a]
xadd dx, cx
movzx edx, byte [esi + edx*2 - 0x1ffa6]
adc cl, cl
adc esi, 5
lea ecx, [ecx*4 - 0x4e1eb70]
xor dl, bl
inc dl
inc cl
sal ecx, cl
neg dl
sar dword [esp + 2], cl
dec dl
rol dl, 1
xor bl, dl
lea edx, [esp + edx + 8]
pop ecx
lea ecx, [ecx*4 - 0x12e385fb]
mov dword [edx], eax
sal ecx, cl
mov eax, dword [esp]
movzx edx, cl
mov dword [esp + edx*4], edi
ret
mov edx, dword [ebp]
mov dword [esp], eax
mov byte [esp + 2], al
mov cl, byte [ebp + 4]
jmp 0x1151baa
shl edx, cl
lea ecx, [eax*8 + 0x6b257cba]
and cx, 0x9e96
mov dword [ebp + 2], edx
sar cl, 0x21
jno 0xb0acd7

Function at 0xfc74cc
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0x6f33ab1a
mov dword ss:[edx + ecx - 0x6f33ab1a], eax
mov dword [esp + edx - 0x6f33ab1a], edx
pop edx
movzx eax, byte [edx + esi - 0x6f33ab1a]
call fcn.00f9db1d

Function at 0xfcc18e
Capabilities:
Encode data using base64

Disassembly:
movzx eax, dl
mov word [ebp + edx*8 + 2], cx
pop eax
movzx eax, word [esi + edx*2 + 4]
movzx ecx, dl
ror cx, 0x6b
lea edx, [edx + 0x579e45be]
lea esi, [edx + esi - 0x579e45b8]
sub cl, ch
neg cl
xor ax, bx
add ax, 0x3c8e
or ecx, ecx
sar edx, 0xad
not ax
dec ax
dec cx
dec cl
not ax
sal edx, cl
neg dl
xor bx, ax
shr edx, cl
ja 0xf98243

Function at 0xfcc1dd
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0x9b1d6a39
call fcn.00b2c6c2
dec byte [esp + ecx*2 + 1]
push ecx
bswap edx
sal eax, 0xbe
jae 0x1004cf7
sal ecx, 0x27
lea edx, [ecx + ecx*4 - 0x39c0137b]
mov dword [edx + edi - 0x52955485], eax
mov edx, dword [esi + edx - 0x52955484]
dec dword [esp + ecx - 0x4f4447fc]
movzx eax, cl
sal ecx, 0xfc
lea esi, [esi + eax*2 + 5]
not dword [esp + eax + 4]
neg eax
pop eax
xor edx, ebx
ror edx, 2
movsx eax, cx
not edx
rol ecx, 0xb4
jb 0xb7d81b
shr cl, 5
neg edx
rol word [esp + ecx*2 + 2], 0x4b
sub edx, 0xdba0f998
jmp 0xfb104a
Function at 0xfd573b
Capabilities:
Encode data using xor

Disassembly:
xchg dl, al
xor ebx, ecx
ror edx, 0xea
sar ax, 0x83
adc ebp, ecx
mov dword [esp + eax*4 - 0x5c], 0x7b334aa6
ror ax, 0x28
movsx ecx, dx
lea esi, [esi + eax*4 - 0x5c02]
bswap edx
mov ax, word [edx + esi - 0x1f28429f]
add ecx, ecx
xor ax, bx
shl dx, 0xe9
rol ax, 1
push ecx
sar dword [esp + edx*2 - 0x3e507bf8], cl
dec ax
lea ecx, [ecx + edx*2 + 0x31288a82]
rol ax, 1
dec ax
mov ch, byte [eax]
xor dword [esi - 0x2f], esp
shl byte [esi - 1], 0xc8
shr word [esp + edx - 0x1f283dff], 0xe3
neg ax
pop edx
inc ax
xor bx, ax
lea edi, [edi + edx*4 - 0x28fa]
call fcn.00b09185
aad 0x19
call 0xdda4a2be
pop ds
xchg bh, ah
mov ebx, 0x861fc4b3
out 0x7b, eax
dec edi
fcomp dword [edi]
xchg bh, ah
inc edi
inc ebx
cmp al, 0xb0
cmp byte gs:[ebx*8 - 0x4257db0c], dl
mov ah, 0x6d
outsd dx, dword [esi]
inc ebx
mov bl, 0x73
fsub st(6)
fistp word [ebp + 0x3f]
push ecx
xor bh, byte [0x25c2eff3]
jl 0xfd57ba
xor al, 0xe4
out dx, al
push ecx
cmpsb byte [esi], byte es:[edi]
popfd
faddp st(2)
mov cl, 0xf1
scasd eax, dword es:[edi]
and ah, 0xa8
mov byte [esi], bl
lodsd eax, dword [esi]
jno 0xfd5869
jae 0xfd5844
dec ebp
adc byte [eax - 0xf], bl
clc
add ebx, dword [edi + 0x510f8287]
je 0xfd5783
aam 0x6d
iretd
scasb al, byte es:[edi]
adc byte [ecx], bl
adc byte [esi + 0x46038624], al
add byte [ecx - 0x4c0c77f1], dh
aam 0xb4
dec eax
xchg edi, eax
outsb dx, byte [esi]
adc esi, dword [ebp + 0x441a0e7e]
mov ah, 0xef
push ebp
mov esp, 0xa5410e78
xlatb
pop esi
cli
sub esp, dword [ebp + ebx*2 - 0x47242493]
jno 0xfd57f5
sub eax, 0xe16a3cce
das
add byte [ebx], al
mov al, byte [0xecf0965d]
push ds
add dh, byte [ecx - 0x26]
lcall 0xd3b7, 0x10854081
xchg edx, eax
jl 0xfd58bf
jge 0xfd5835
or bl, bh
dec esp
mov esp, fs
pushal
lodsd eax, dword [esi]
dec dword [esi + esi*8 + 0x299979d5]
insb byte es:[edi], dx
mov ebp, 0xab9b4aa3
sbb al, 0xef
not dword [esi]
mov al, byte [0x40395b99]
adc al, 0x45
int 0x30
les ebp, [edi]
add byte [ebx + 0x6a], cl
invalid
push ds
sbb eax, 0xb8991c3a
push esi
add cl, byte [ecx]
ret

Function at 0xfd9c18
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc esp
xor ebp, esi
inc edi
lea ebp, [ebp + eax*4 + 0x5854d282]
inc cx
shl esp, 0x4c
rol al, 2
inc ecx
xor ebp, 0xc881289e
dec eax
mov dword [esp + edx - 0x4b967901], ebp
inc ecx
sal ecx, 0x7d
inc eax
sbb ch, 0x99
inc edi
lea ebp, [ebp + eax*4 + 0x5e9de5d7]
jg 0x116fbc7
call fcn.00f9f8d3
mov ecx, 0x5703d18e
call fcn.00b5627d
Function at 0xfd9c50
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push edx
movzx ecx, byte [esi + eax - 0x43390000]
sbb edx, edx
xor cl, bl
sar eax, 0x22
add dword [esp + eax - 0x10ce4000], edx
sar byte [esp + eax*2 - 0x219c7fff], 0xc4
rol cl, 1
shl eax, 0x9e
xor cl, 0x1b
rol word [esp + eax + 2], 0x68
inc cl
ror cl, 1
rol dx, 0xa3
mov dword [esp + eax], eax
xor cl, 0xac
xor bl, cl
ror byte [esp + eax*8 + 2], 0x41
push edx
lea ecx, [esp + ecx + 8]
xor ax, word [eax + ecx]
jmp 0x1163233
xor ecx, 0x3fb94d0e
lea esi, [esi + ecx - 0x5d85d371]
adc dl, cl
and dword [esp + ecx - 0x5d85d373], ecx
xor eax, ebx
dec eax
and dword [esp + ecx - 0x5d85d372], edx
shr byte [esp + ecx - 0x5d85d36f], 0xe4
xor eax, 0x91b2820e
xor dword [esp + ecx - 0x5d85d376], 0x553749b8
inc eax
mov byte [esp + ecx - 0x5d85d376], dh
shr ecx, 0x27
not dx
rol eax, 3
call fcn.0101ada1
xor ebx, edx
add ebp, edx
call fcn.010ada5b
mov ecx, 0x442f1a3d
mov cx, word [edi + ecx - 0x442f1a3d]
mov dx, word [edi + 2]
mov eax, 0xc7214339
and cx, dx
sal eax, 0xd0
lea edx, [eax + 0x6812ff0b]
not cx
mov word [edi + eax - 0x4338fffe], cx
jbe 0xaf3201
inc ebx
outsb dx, byte [esi]
jae 0xfd9d0c
dec ecx
outsb dx, byte [esi]
jne 0xfd9cd6
and eax, 0x537962e9
sub al, 8
mov esp, 0xca8c1aa2
invalid
invalid

Function at 0xfe5979
Capabilities:
Encode data using base64

Disassembly:
mov ax, word [edi + eax - 0x79a46ab1]
mov dx, word [ecx + edi - 0x6720d40d]
mov cl, byte [edi + ecx - 0x6720d40b]
jmp 0x11707b9
xor cl, 0xa6
mov dword [esp], edx
call fcn.00acbf68
jmp 0x11586d2
push 0x63909030
call fcn.00fb0815
mov edx, 0xf936f329
mov edx, dword [esi]
add esi, 4
mov eax, 0x79a41620
xor edx, ebx
movsx ecx, ax
inc ax
xadd cl, ah
inc edx
or ecx, eax
xor edx, 0x4ca709ad
inc edx
xor ecx, 0x1e84e238
js 0x112bddf
ror edx, 2
xor ebx, edx
or ax, 0x6a90
adc ebp, edx
jmp 0xacd90d
jmp 0xfbbe08
Function at 0xfe6d8c
Capabilities:
Encode data using xor

Disassembly:
inc esp
xor dword [esp + ebp*2 - 6], eax
dec eax
or edx, 0xfe3b948a
dec eax
shl ebp, 0x3f
pop esi
dec ecx
xor ecx, ecx
dec ebp
arpl ax, ax
shl ebx, 0x59
dec ebp
sub ecx, esp
inc esp
add ch, cl
dec ecx
add edi, eax
inc ecx
neg dl
jnp fcn.00b112ff
mov eax, 0x16961108
mov edx, dword [ebp + eax*4 - 0x5a584420]
neg eax
mov ecx, dword [ebp + 4]
dec eax
neg al
mov dword [edx], ecx
movsx edx, ax
lea ecx, [edx*4 - 0x1e7a205d]
mov ecx, dword [esi]
rol dl, 0xe1
xor ecx, ebx
inc edx
add ecx, 0x438139b0
not ecx
xor ecx, 0x972fdda6
rol dl, 0xc7
push eax
not ecx
ror dl, 0xe2
xor ebx, ecx
call fcn.00b18ac4
js 0xfa7ee5
rol eax, 1
retf 0x33e2
xchg edx, eax
jnp 0xfa7ec6
push ecx
or esp, dword [ebp - 0x61]
in al, 0x82
adc eax, 0x869f650b
stosb byte es:[edi], al
pop ebp
or esp, dword [ebp - 0x61]
lahf
invalid
inc edi
mov eax, dword [esi + ebp - 0x8aeb]
inc esp
xor eax, esi
inc ecx
sub eax, 0xd6051182
dec eax
mov dword [esp + edx - 0x462f322b], 0xeb899d07
inc edx
movzx ebx, byte [esp + ebp*2 - 0x115d4]
inc ecx
xor eax, 0xc881289e
dec edx
and ebp, dword [esp + ebp*2 - 0x115d6]
inc ecx
sbb eax, 0xcfbbfe2d
inc ecx
bswap eax
inc edx
sub dword [esp + ebp - 0x8aeb], 0xc8ae3c16
or ecx, 0x9b9bd1aa
inc ecx
neg eax
inc esp
xchg byte [esp + edx - 0x462f3226], ah
inc ecx
sub eax, 0x9cab8a3d
dec eax
sub eax, ecx
inc edx
xor ebx, dword [esp + ebp - 0x8aea]
inc ecx
ror eax, 2
shr dword [esp + edx - 0x462f3227], 0x57
inc cx
adc ebx, ebp
inc ecx
bswap eax
jne 0x117ec28
setnp dl
lea esi, [edx + esi - 0xe7c1efd]
jb 0x1151b37
lea eax, [ecx - 0x27d01ef4]
sar eax, cl
add esi, 4
xor edx, ebx
bswap edx
xor al, al
dec al
xor eax, 0x57b3db38
inc edx
neg edx
dec cl
rol edx, 3
inc edx
push ecx
xor ebx, edx
shl ecx, 0xae
adc edi, edx
lea ecx, [eax + ecx*4 + 0x5e1d448e]
dec cx
mov edx, dword [ebp]
sub al, cl
mov cx, word [ebp + 4]
jne 0x10a5294
neg eax
not edx
ror eax, 1
lea edx, [edx + edx*8 - 0x27513e72]
sar cl, 3
sbb ecx, ecx
lea eax, [ecx + eax + 0x77004a9a]
adc dl, cl
rol eax, 3
xadd dx, cx
sbb eax, 0xbf15678e
rol ecx, cl
rol eax, 2
not cl
rol cx, 0xa4
sbb eax, 0x752db22a
dec cx
bswap eax
sub edx, edx
xor ebx, eax
dec ecx
neg ecx
add ebp, eax
add edx, ecx
fild dword [edi]
sbb dx, cx
jmp ebp
ror ecx, 2
not ecx
neg ecx
movsx ebp, dl
push esi
inc edx
xor dword [esp + ecx - 0x17b2a715], ecx
inc esp
movsx edx, bx
inc esp
xchg bl, ah
pop esi
inc ebp
movzx ebp, cl
dec esi
lea edx, [0x84035490]
inc ecx
movsx eax, dl
dec eax
arpl cx, cx
dec eax
add edi, ecx
inc ecx
neg dl
dec ebp
lea edi, [edx + eax*4 - 0x2d460971]
dec edi
mov esp, dword [ebx + ecx*2 - 0x2f654e2a]
dec ebx
mov edx, dword [ebx + ecx*4 - 0x5eca9c4c]
dec ecx
xor ebp, 0x51017836
inc ebx
mov cl, byte [ebx + ecx - 0x17b2a705]
sar ebx, 0x52
jnp 0xaf7c0c
mov edx, dword [esi]
mov eax, 0x569f8a0d
rol al, 0x41
xor eax, ebx
mov ecx, 0x528f9989
ror edx, 0x31
lea eax, [eax + ecx*4 - 0x5a1ee89f]
jae 0x1002e7d
inc cx
inc ecx
movzx edx, bl
xor ecx, 0x8d365608
jmp 0x10b714b
dec eax
mov dword [esp + edx - 0x462f322b], esi
dec eax
sar ebx, 0xfb
je 0xb952b4
jmp 0xfa7e8b
Function at 0xfed635
Capabilities:
Encode data using base64

Disassembly:
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x1194e14

Function at 0xfefcfc
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax], edx
add ebp, ecx
add eax, edx
pop eax
movsx ecx, ax
mov eax, dword [edi + ecx*8 - 0x2b08]
mov ecx, dword [ecx + edi - 0x55d]
sub dx, 0x9888
adc edx, edx
xor edx, edx
adc eax, ecx
xor dx, word [edi + edx*2 + 8]
sub edi, 0xfffffff6
call fcn.00fd8638

Function at 0xff2c9d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x6750d900], eax
lea esi, [eax + esi - 0x6750d8fc]
call fcn.01003bdf

Function at 0xffc233
Capabilities:
Encode data using base64

Disassembly:
dec esp
xchg dword [esp + ecx - 0x2c9], eax
inc ecx
not ah
inc ecx
xor dh, ah
dec esi
lea esp, [esp + 0x18]
inc ecx
mov byte [esp + ecx*2 - 0x5a2], al
inc ecx
mov ecx, 0x8112a83a
dec ebx
lea eax, [eax + edi*2 + 0x299c8d34]
call fcn.00b915c0

Function at 0xffefe7
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], ecx
xor edx, ebx
shr cl, 0x86
bswap edx
shr ecx, 0x52
sal cx, 8
call fcn.00b65f1b
mov dx, word [edi]
mov eax, 0x2593c107
ror al, 0x42
setb al
mov cx, word [edi + eax*2 - 0x4b278200]
lea edi, [edi + eax - 0x2593c0ff]
jae fcn.00b152dd
bswap eax
add dx, cx
call fcn.010b7e5e

Function at 0xfffb07
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
mov edx, dword [esp + 4]
push eax
dec ecx
inc edx
sal word [esp + edx*2 - 0x787fb52d], 0x81
sal word [esp + edx*2 - 0x787fb534], 0x82
xor ecx, 0xa286ab8a
bswap ecx
ror ax, 0xcf
xor ecx, 0x82003101
add edx, eax
mov dword [esp + 4], 0x303e93a6
xor ebx, ecx
rol dword [esp + 6], 0x3b
call fcn.010b4fd3
Function at 0x1002ef1
Capabilities:
Encode data using xor

Disassembly:
call fcn.010aa4f1
mov ecx, 0x638f8600
pop ebp
add byte [ecx + 0x638f8600], bh
mov edx, ecx
mov eax, dword [esi + ecx - 0x638f8600]
movsx edi, cl
xor eax, ebx
rol di, 0xab
ror eax, 2
xor cl, ch
not eax
sets dl
neg eax
sub eax, 0xdba0f998
bswap eax
or edx, edx
jae 0xf9bf66
inc ebx
imul esp, dword [edx + 0x77], 0x42667d5d
cmp ecx, ebp
adc byte [ebx - 0x6cfb45fa], cl
pop es
jg 0xad8ab6
push cs
cmp byte [esi - 0x3f3cccca], cl
stc
inc ebp
rol cl, 6
shl ecx, 0x24
lea eax, [eax + edx - 0x3b865954]
add dx, cx
not eax
push ecx
xor eax, 0x972fdda6
not eax
inc dl
sete byte [esp + edx - 0x7f071304]
xor ebx, eax
mov dword [ebp + ecx - 0x68e38004], eax
xchg dword [esp + edx - 0x7f071305], ecx
sal dword [esp + ecx - 0x68e30000], 0xa4
sbb word [esp + edx - 0x7f071305], 0xd3ad
mov eax, dword [esi + ecx - 0x68e2fffc]
xor cl, cl
ror dword [esp + ecx - 0x68e30000], 0x41
xor eax, ebx
dec eax
jmp 0xafbc1f
jmp 0x118e37b
xor ebx, eax
sal dl, cl
adc ebp, eax
lea eax, [ecx*2 + 0x18881308]
inc al
jg 0x11970b1
sal al, 0x45
ror ecx, 2
dec dl
rol al, 0x84
xor ebx, ecx
sub dl, ah
adc edi, ecx
mov dword [esp + edx], 0xdf351abc
or dx, ax
pop eax
mov dx, word [ebp + edx - 0xff00]
bswap eax
mov ecx, eax
mov ax, word [ebp + 2]
adc ebp, 2
and dx, ax
not dx
jmp 0xad8ab3
xor cl, bl
inc eax
xchg edx, eax
rol cl, 1
sub cl, 0x96
ror cl, 1
call fcn.00b112f0
xor esi, eax
push 0x853a0b9d
and esi, 0xff
jmp 0x101b74d
not eax
call fcn.00fd639e
mov eax, 0x3314dea1
mov ecx, dword [esi + eax*2 - 0x6629bd42]
add al, ah
or ax, ax
inc eax
lea esi, [esi + eax*2 - 0x6629bcfc]
rol al, 0x42
mov edx, 0x9e194ca7
ror ax, 0x25
xor ecx, ebx
dec al
sub ecx, 0xf29e952d
bswap ecx
and dl, dl
or edx, edx
rol ecx, 3
sar eax, 0x1a
jp 0xb1adc5
movzx ecx, byte [esi + ecx - 0x638f8682]
lea esi, [edx + esi - 0x638f863b]
jnp 0x1154f48

Function at 0x10033e3
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea esi, [esp + esi - 0x521]
dec edx
sar dword [esp + edx - 0x472aa510], 0x9f
pop ebp
xor ecx, esi
inc edx
lea ecx, [ecx + 0x3488fd3f]
inc ecx
inc bh
dec eax
neg edx
inc dx
sbb dword [esp - 0x519], 0xf181548f
test dword [ebp + 0x12], ebx
test cl, al
leave
add eax, dword [edx - 0x7f]
test byte [ebx + edi*8], dl
pop edx
aad 0xb8
movsd dword es:[edi], dword [esi]
fist dword [edi - 0x7372be96]
or dl, byte [eax]
movsd dword es:[edi], dword [esi]
jns 0x1003486
inc esi
mov ecx, dword [esp + edx - 0x472aa515]
dec edx
mov dword [esp + edx - 0x472aa506], esi
inc edx
xor dword [esp - 0xa20], ecx
inc edx
xor dword [esp - 0xa2b], 0xdb1e95ab
dec edx
mov esi, dword [esp - 0x504]
jg 0xfc2828
dec eax
arpl cx, cx
jno 0x1170eb1
add al, bh
inc dword [ebp + 0xf]
mov dh, 0xcd
inc esi
and byte [esp + ecx + 0x12], dl
call fcn.00fa12e9
Function at 0x1010af5
Capabilities:
Encode data using xor

Disassembly:
shl dword [esp + eax + 5], 0x96
pop ecx
pop edx
pop ecx
jp fcn.010a18ab
test eax, eax
lea esp, [esp + 4]
je 0x1120eca
jmp 0x1120e58
push 0xada7c9bf
mov dword [esp], ebx
mov ebx, 0xa43bd18c
shl ebx, 0xf
and ebx, ebx
movzx ebx, byte [ecx]
push 0xcc288e24
xor ebx, edx
ror dword [esp], 0x58
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x1140624]
shr byte [esp], 0xc1
shr edx, 8
xor edx, ebx
inc ecx
push 0xac133422
xor edx, 0x7993d311
inc byte [esp + 2]
dec eax
not word [esp + 3]
push 0x1882a534
lea esp, [esp + 0xc]
jne 0x1120e60
push 0x289aabb2
and dword [esp], 0x9b999924
neg dword [esp]
mov ebx, dword [esp + 4]
lea esp, [esp + 8]
not edx
mov ecx, 0xdc152401
mov dword [edi + 4], edx
movsx edx, cx
movzx ecx, byte [esi + edx - 0x23fd]
mov eax, edx
neg dl
lea esi, [esi + edx - 0x24fa]
neg ax
call fcn.00f98251

Function at 0x101234f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push edx
sub dx, dx
sbb edi, 0xfffffff4
add dx, dx
inc edx
movzx edx, byte [esi - 5]
add dword [esp + 0xc], 0x7a97ec1a
adc esi, 0xfffffffb
call fcn.0113e329
dec dl
xor word [esp + edx - 0x137266df], ax
adc ebp, ecx
sal edx, 0xa9
mov eax, dword [edi + eax - 0x137248ba]
jae 0xb41215
dec dl
rol byte [esp + 1], 0x47
rol dl, 1
sub ecx, 0xb8367d2f
or cx, cx
adc dl, 0x30
ror dl, 1
xor word [esp + ecx - 0x1220bd1], 0xcfb2
not word [esp + ecx - 0x1220bd0]
neg dl
not cl
sar byte [esp + ecx - 0x1220b2e], 0x21
sbb ecx, ecx
xor bl, dl
lea edx, [esp + edx + 4]
call fcn.00b22a97

Function at 0x10167cc
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0xc], edx
neg eax
rol eax, 1
lea edx, [edx*8 + 0x7103cc3d]
dec dl
not eax
neg eax
push edx
dec word [esp]
push edx
bswap eax
movzx ecx, word [esp + 0x13]
mov dword [esp + ecx - 0x9923], 0xc5b18886
not dword [esp + ecx - 0x991f]
lea eax, [eax + ecx*8 - 0x3738400f]
xor ebx, eax
add ebp, eax
mov eax, ecx
call fcn.00b99788

Function at 0x1020649
Capabilities:
Encode data using base64

Disassembly:
neg edx
sal ecx, cl
sar eax, 0x83
xor ebx, edx
mov dword [esp + eax - 0x164e622], eax
add ebp, edx
call fcn.011639dd

Function at 0x1020660
Capabilities:
Encode data using base64

Disassembly:
bswap edx
xor edx, 0xd537c6a1
xor ebx, edx
or eax, eax
adc ebp, edx
push ecx
shl eax, 0x3f
call fcn.00b1b5cc

Function at 0x10293b1
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx*2 - 0x13c], ebp
ret 4
lea ecx, [esp + ecx + 8]
xadd dword [esp + eax - 0x3545ce1d], eax
neg edx
mov dword [esp + eax - 0x62], edx
mov al, byte [ecx + eax*2 - 0xc4]
ja 0x10385c6
and dx, dx
movzx ecx, dl
mov word [edi + ecx*2 - 0x13c], ax
ror dword [esp + ecx - 0x9a], cl
movsx eax, dx
jnp 0xfe6f71
Function at 0x10338a3
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push 0xf72bea0f
and edi, 0xff
mov edi, dword [edi*4 + 0x11aef48]
shr edx, 8
xor edx, edi
inc ecx
xor edx, 0x2c107db3
dec eax
call fcn.01199fe3
and cl, 0x36
and dword [esp], ecx
not eax
xor ebx, eax
or dword [esp], ecx
dec dword [esp]
mov dword [ebp - 2], eax
mov edx, 0x28001425
dec dword [esp + edx*2 - 0x5000284a]
lea ebp, [edx + ebp - 0x28001427]
setne byte [esp + edx*2 - 0x5000284a]
dec edx
mov ecx, dword [esi + edx*2 - 0x50002844]
lea esi, [edx + esi - 0x2800141c]
xor ecx, ebx
jmp 0xfab0e3

Function at 0x1036f22
Capabilities:
Encode data using xor

Disassembly:
mov dx, word [edi]
mov cx, word [edi + 2]
mov eax, 0xcc39b806
or dx, cx
lea ecx, [eax*4 + 0x532b2bb7]
rol eax, 0x37
not dx
push es
mov eax, 0xb66cc39
ror dword [ebp + 0x2bb7850c], 1
sub edx, dword [ebx - 0x3f]
sal byte [edi], 0x66
not edx
mov word [edi + eax*8 - 0x1b30e6de], dx
jae 0x112c78e
cmp byte [ebx], dl
pop eax
xchg ebx, eax
stosd dword es:[edi], eax
lcall 0x8aab, 0xb7a3156f
outsd dx, dword [esi]
adc eax, 0xaa9bcfa3
outsd dx, dword [esi]
adc eax, 0xcedf9ba3
outsd dx, dword [esi]
adc eax, 0x86a79fa3
outsd dx, dword [esi]
adc eax, 0xa2c3bfa3
xor byte fs:[edx + 0x496662f2], 0x52
jge 0xfe2b35
xor eax, dword [esi - 0x3f]
pushal
xor al, 0xc4
mov ebp, 0x3811c477
insd dword es:[edi], dx
int3
add ebp, 4
mov dword [esp], edx
mov eax, dword [esp]
call fcn.00b34195
jmp 0xfe2b2d
mov eax, dword [esi + eax - 0x3661cdc]
jae 0xfbf23c
push eax
sub cl, byte [ebp + 0x59d99eec]
or dl, byte [ecx - 0xf0f6086]
and dl, byte [ecx - 0x66916086]
ljmp 0xd25e

Function at 0x103b001
Capabilities:
Encode data using base64

Disassembly:
inc ecx
sub ecx, 0x7f878411
inc ecx
bswap ecx
dec eax
mov dword [esp + 0x10], esi
call fcn.0103741d