joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030f0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x403183
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x403188
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40317c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [ebp - 0x20]
push ecx
push esi
call ebx
test eax, eax
je 0x403178
nop
cmp dword [ebp - 0x1c], 3
jne 0x403178
push 0x3e8
call edi
lea edx, [ebp - 0x20]
push edx
push esi
call ebx
test eax, eax
jne 0x403160
mov edi, dword [ebp - 0x24]
pop ebx
test esi, esi
je 0x403188
push esi
jmp 0x40318d
mov esi, dword [ebp - 0x24]
jmp 0x40317c
test edi, edi
je 0x403193
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00403bfe
mov esp, ebp
pop ebp
ret

Function at 0x4031b0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x410280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x403280
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x403279
push ebx
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x403254
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
je 0x40325f
cmp dword [ebp - 0x1c], 2
jne 0x40325f
push 0x1f4
call edi
lea ecx, [ebp - 0x20]
push ecx
push esi
call ebx
test eax, eax
jne 0x403222
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403bfe
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x20]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403bfe
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00403bfe
mov esp, ebp
pop ebp
ret

Function at 0x403bfe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410280]
jne 0x403c08
repz ret
jmp fcn.0040586a
Function at 0x40a1ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040687a
and dword [ebp - 0x14], 0
cmp dword [0x411cfc], 0
mov dword [ebp - 0x18], eax
jne 0x40a25e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a306
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40a306
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411cfc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411d00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411d04], eax
call edi
push eax
call esi
mov dword [0x411d0c], eax
test eax, eax
je 0x40a25e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411d08], eax
mov eax, dword [0x411d08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a2b7
cmp dword [0x411d0c], ecx
je 0x40a2b7
push eax
call esi
push dword [0x411d0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a2b7
test ebx, ebx
je 0x40a2b7
call edi
test eax, eax
je 0x40a2ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a2ae
test byte [ebp - 8], 1
jne 0x40a2b7
or dword [ebp + 0x10], 0x200000
jmp 0x40a2ea
mov eax, dword [0x411d00]
cmp eax, dword [ebp - 0x18]
je 0x40a2ea
push eax
call esi
test eax, eax
je 0x40a2ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a2ea
mov eax, dword [0x411d04]
cmp eax, dword [ebp - 0x18]
je 0x40a2ea
push eax
call esi
test eax, eax
je 0x40a2ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411cfc]
call esi
test eax, eax
je 0x40a306
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a308
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403bfe
leave
ret

Function at 0x414a58
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*2 - 0x7cafcc7e], 0x25112312
xor bl, al
lea ebp, [ebp + ecx - 0x3e57e641]
dec cl
shr cx, 0x6f
mov word [ecx + ebp - 0x3e570001], ax
xor word [esp + ecx*2 - 0x7cae0000], 0x9486
lea esi, [esi + ecx*2 - 0x7cae0006]
mov word [esp + ecx - 0x3e56ffff], dx
sar cl, cl
mov edx, dword [esi + ecx - 0x3e570000]
xor edx, ebx
movsx eax, byte [esp + ecx - 0x3e570000]
not edx
rol ecx, 0xae
jae 0x435729
lea edx, [edx + ecx - 0x21c131eb]
xor edx, 0x3e12212e
pop ecx
sal cl, 0x61
ror edx, 3
inc edx
btr cx, 0x16
call fcn.004847f0
Function at 0x4191fc
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [ebp]
pop edx
mov edx, 0xbb81f111
mov edx, dword [ebp + 4]
mov eax, 0x7106970e
lea ebp, [eax + ebp - 0x7106970a]
add ecx, edx
movzx edx, al
shl eax, 0x10
mov dword [edx + ebp - 0xe], ecx
mov ecx, eax
lea esi, [edx + esi - 0x12]
js 0x4746a6
mov dword [esp + ecx*8], ebp
ret 4
xor ebx, ecx
cbw
rol edx, 0x63
adc ebp, ecx
mov ecx, 0xb884cbf
cdq
inc dx
jmp ebp
shr cl, 0xa4
push ecx
bswap eax
neg eax
inc byte [esp + ecx - 0x4500]
push ecx
dec eax
sub byte [esp + ecx - 0x44fb], 0xb8
ja 0x4899b3
dec ecx
ror eax, 2
rol cx, 0xe3
dec eax
and cx, word [esp + ecx - 0x27fe]
and byte [esp + ecx*4], ch
bts edx, edx
neg eax
sub eax, 0xc60b21b0
xor ebx, eax
bswap ecx
add ebp, eax
lea eax, [ecx*4 + 0x3c8fea1f]
shl byte [esp + ecx*8 + 5], 0x41
jge 0x427cee
call fcn.004398cd
mov eax, 0x5a25acab
lea edx, [eax + eax - 0x4d7cd0]
mov ecx, 0xd6961b3b
lea edi, [edi + eax - 0x5a25acaf]
and cx, cx
mov edx, dword [edi + eax - 0x5a25acab]
xor edx, ebx
dec edx
rol edx, 2
neg eax
adc ecx, eax
cwde
sbb edx, 0x9831cc88
ror eax, cl
or eax, ecx
xor cl, 0xc
rol edx, 1
neg ecx
adc eax, 0x77081291
bswap ecx
xor ebx, edx
and ax, ax
adc ebp, edx
inc eax
mov edx, ecx
lea edx, [ecx*2 - 0x65e624ec]
mov edx, dword [ecx + esi - 0x63918f83]
rol cx, 0xaf
lea eax, [ecx + 0xb2e723e]
rol ecx, cl
lea esi, [eax + esi - 0x6ec039fb]
neg eax
call fcn.0047b3c7
xor ecx, ebx
rol eax, 0x36
not edx
add dx, 0x5a1e
bswap ecx
mul dl
inc ecx
shl edx, 0x61
bts eax, eax
xor ecx, 0xd5945f05
bswap ecx
dec eax
jns 0x427e76
mov ecx, 0xd3186f2d
lea edx, [ecx + ecx*4 - 0x5c4dedeb]
sub ebp, 2
btr edx, edx
ror dl, 0xa2
jb 0x4a78b3
setns dl
mov ecx, dword [esi + edx*2]
dec eax
cdq
rol eax, 0xc3
xor ecx, ebx
neg ecx
inc dx
xadd eax, edx
ror ecx, 3
xadd eax, edx
jae 0x4700a6
adc al, dl
neg ecx
jmp 0x47751a
dec eax
dec dx
rol ecx, 3
call fcn.0045512a
xor cl, 0x90
shl ecx, 0xcf
mov dword [edi + ecx*2 - 0x34300000], eax
mov eax, 0x192b2214
sar al, 0xa6
jns fcn.004dee2f
sub esi, 4
mov edx, 0x1091ee30
movsx ecx, dx
mov eax, dword [esi + edx*4 - 0x4247b8c0]
sub dx, cx
push edx
xor eax, ebx
neg byte [esp + edx*4 - 0x4243fffe]
neg byte [esp + edx*2 - 0x2121ffff]
not eax
call fcn.00451e05
movzx ecx, word [ebp]
neg dx
xor cx, bx
sub cx, 0xc681
movsx eax, dx
rol cx, 1
neg eax
shl edx, 0xb4
push edx
inc cx
call fcn.0041e79e
btc ecx, edx
mov eax, dword [eax + edi - 0x732a1e00]
adc dl, dh
or cx, dx
or dl, dh
xor eax, ebx
jmp 0x432962
Function at 0x41b76a
Capabilities:
Authenticate hmac

Disassembly:
jb 0x4c0b1a
sub cl, cl
adc esi, 8
sub ecx, ecx
ror cx, 0x6e
shl ecx, 0x8b
mov dword ss:[eax + ecx], edx
movsx eax, cx
lea ebp, [ebp + ecx*8 - 4]
push eax
or ecx, dword [ecx + ebp]
ror dword [esp + eax*2], 0x71
add ax, ax
call fcn.00417285
mov ebx, 0xa4815336
movzx ecx, bx
mov eax, ebx
mov esp, esi
lea esi, [ecx - 0x68f70157]
pop edi
bt bx, 0x83
pop ecx
mov edx, 0x70884225
setb bl
pop ebx
jae 0x470190
mov edx, 0x21b5db01
bt edx, edx
movzx eax, byte [ebp + edx*2 - 0x436bb602]
lea ecx, [edx + edx*8 + 0x7b065f92]
and edx, edx
shl cl, 0x41
lea ebp, [ebp + edx - 0x21b5db00]
setg dl
xor al, bl
dec ecx
or edx, ecx
ror ecx, 0x46
neg al
sar ecx, cl
xchg dx, cx
adc al, 0x85
xchg dx, cx
xor dl, 0x1e
xor edx, edx
neg al
lea edx, [edx + edx*8 + 0x17a79fad]
sal edx, 0x4a
ror al, 1
sal dl, 0xc3
shl edx, cl
not dl
xor bl, al
and edx, 0x9dab379f
call fcn.0045a2cc
mov ecx, 0x2d32a4b5
movzx edx, cl
btc edx, 0x17
mov edx, dword [edi + ecx - 0x2d32a4b5]
inc ecx
mov eax, dword [edi + ecx*2 - 0x5a654968]
xor cl, ch
jbe 0x4d5a72
lea edi, [edi + ecx - 0x2d32a40a]
call fcn.0045d5a0
lea edx, [eax*8 + 0x5f0dc907]
cbw
mov ecx, dword [ebp + ecx - 0x6dcb3740]
sar eax, 0xff
bswap eax
cwde
mov eax, dword [ebp + edx - 0xa9d341b]
sar byte [esp + edx*2 - 0x153a6838], 0xc3
call fcn.00434717
call fcn.00499e14
mov edx, dword [ebp]
mov ecx, 0x6e1bf58b
lea ebp, [ebp + ecx - 0x6e1bf587]
shl cx, cl
movsx eax, cx
push edx
movzx edx, cx
dec edx
popfd
lea esi, [eax + esi - 0x5804]
inc cx
rol edx, 0xf6
cdq
add edx, dword [esi + eax - 0x5800]
xor edx, ebx
bts ax, cx
rol eax, 0xea
sbb edx, 0xc1378b12
btc ecx, ecx
add al, 0x9c
cwde
xor edx, 0x2505b61f
lea eax, [eax + ecx*8 + 0x3205e23a]
ror edx, 1
not ax
bswap ecx
or cl, 0xad
not edx
cwde
jl 0x498c35
movzx eax, byte [esi]
mov edx, 0xead400c
lea esi, [edx + esi - 0xead400b]
lea ecx, [edx - 0xd6a4147]
xor al, bl
xor edx, ecx
call fcn.004441ab
inc edx
shl cx, cl
sbb eax, 0xdd1ef000
bswap eax
call fcn.00414591
mov eax, 0xc6ae0238
lea esi, [eax*2 + 0x5b25df3b]
mov edx, dword [ebp]
movzx ecx, ax
lea ebp, [ecx + ebp - 0x234]
xor ax, ax
bt si, ax
btr esi, ecx
mov esi, edx
movsx edx, cx
shl edx, 0xed
sete cl
jae 0x443370
lea edi, [esp + edi - 0x69812b27]
lea ebx, [edi + edx - 0x576b71cb]
lea edx, [eax*2 - 0x1ef94de7]
not word [esp + ecx*2 - 0x5654]
mov esp, ebx

Function at 0x4230ff
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + ecx - 0xffe7], edx
ror al, 1
sub al, 0x1f
rol cl, cl
setb cl
add cx, cx
xor bl, al
lea ebp, [ebp + edx - 0x788cfa3b]
push edx
not dword [esp + edx - 0x788cfa35]
xadd ecx, edx
mov word [edx + ebp - 0xfe02], ax
pop eax
pop edx
jnp fcn.00452de1
mov eax, 0xf3003935
mov edx, eax
btc ax, 0xb
mov eax, ebp
movsx ecx, dx
lea ebp, [ebp + ecx*8 - 0x1c9aa]
imul dx, cx
shr ecx, 0x87
mov word [ebp + ecx - 0x72], ax
mov edx, dword [esi + ecx - 0x72]
xor ecx, ecx
call fcn.0041cc9c
shr cl, 0xc4
jae 0x447fcf
xor dl, 0xb5
rol dl, 1
xadd ax, cx
shl eax, 0x9a
sbb dl, 0x22
imul eax, eax
rol dl, 1
xor bl, dl
jmp 0x489a34
Function at 0x4294c2
Capabilities:
Encode data using base64

Disassembly:
btc ecx, eax
mov word [esi], dx
imul ax, cx
mov dword [esp], ecx
sbb edi, 3
add ax, ax
mov eax, dword [edi]
movsx edx, cl
or byte [esp + edx - 0x28], ch
xor eax, ebx
ror eax, 2
imul cx, dx
lea eax, [eax + ecx - 0x28f59389]
ror eax, 1
call fcn.0042613e

Function at 0x434717
Capabilities:
Encode data using base64

Disassembly:
ror dword [esp + edx*8 - 0x54e9a0f3], 0xc5
lea ebp, [ebp + edx*2 - 0x153a683a]
call fcn.0047e3a0
mov ecx, 0xf53f1834
jmp 0x4e06bd
call fcn.0044521d
inc eax
dec edx
ror eax, 1
lea edx, [ecx + edx*2 + 0x75ab871e]
bswap eax
dec ecx
cmove dx, cx
xor ebx, eax
sar cl, 0x65
btc edx, edx
ror edx, cl
add ebp, eax
mov eax, 0x4357797
xchg edx, eax
sub ecx, ecx
adc ecx, ebp
jmp ecx
mov ecx, dword [edi]
mov edx, 0x831d4915
mov eax, dword [ecx]
push edx
mov dword [edi], eax
mov eax, dword [esi]
add esi, 4
or dl, byte [esp + 3]
movsx ecx, dl
xor eax, ebx
pop edx
btc ecx, 0
jae 0x46498d
rol eax, 1
dec eax
rol cl, 0x45
neg ecx
rol eax, 3
shr cx, 0xec
sar edx, 0xcb
jae 0x4dcf9a
jmp 0x468b5b
Function at 0x43f77c
Capabilities:
Encode data using base64

Disassembly:
add dl, 0x31
rol dl, 1
bts ecx, ecx
neg dl
not dl
shr cl, 0xc4
xor word [esp + ecx*8 - 0x73846], cx
sub eax, eax
neg dl
neg word [esp + eax + 6]
xor bl, dl
sar eax, cl
lea ebp, [ebp + eax*2 - 2]
mov word [ebp + eax*2], dx
lea esi, [esi + eax - 4]
inc word [esp + eax + 9]
cwde
mov edx, dword [esi + eax]
xadd word [esp + eax + 5], cx
not al
xor edx, ebx
xadd ecx, eax
dec edx
push ecx
imul eax, dword [esp + eax - 0xdb]
xor edx, 0x5197b5b0
inc edx
pop ecx
shr al, cl
bswap edx
neg word [esp + ecx - 0x1e0]
inc cl
jne 0x4399bf
Function at 0x44e8a8
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
neg ecx
lea ecx, [ecx + eax*2 - 0x1e8e7f0]
ror ecx, 1
jmp 0x4a684b
mov ecx, dword [esi + edx*2 - 0x1fe]
xor ecx, ebx
push eax
mov dword [esp + edx - 0xff], 0x91b8b28d
lea ecx, [ecx + eax - 0x4ac9f0df]
btc edx, 3
xchg dword [esp + edx*8 - 0x7b8], edx
xor ecx, 0x46bbe693
pop eax
lea ecx, [ecx + edx + 0xfc8732a]
sar edx, 0xd6
cmovs eax, edx
bt edx, 0x99
rol ecx, 3
mul dx
xor ebx, ecx
rol eax, 0xb1
add ebp, ecx
jmp ebp
add edx, esp
not eax
and eax, eax
mov word [edx], cx
movzx edx, al
mov ecx, eax
lea esi, [esi + edx*4 - 0x400]
jne 0x42a3ff
and cx, ax
xor edx, 0x20368f05
cwde
not edx
dec eax
add cx, cx
shl cx, 0x2a
xor ebx, edx
add edi, edx
mov edx, 0xcd9b1f05
sub ecx, ecx
xor ecx, edi
jmp ecx
or ax, ax
sub ax, ax
xor dl, 0x21
xor bl, dl
jmp 0x43605c
bswap eax
xor ebx, eax
lea ecx, [ecx + edx*8 + 0x33aaa2c]
add ecx, ecx
adc edi, eax
or cx, dx
lea eax, [ecx + ecx - 0x61e4e1c8]
mul eax
mov bp, word [ebp + eax*2 - 0x64f08388]
neg edx
jle fcn.00452de1
mov ecx, 0x21b6a006
lea eax, [ecx*2 - 0x424c08ed]
mov eax, dword [ecx + edi - 0x21b6a006]
lea edi, [edi + ecx*2 - 0x436d4008]
push eax
popfd
dec ecx
add ecx, 0xc5853314
shl ecx, cl
lea esi, [esi + ecx*2 - 0x64000004]
xor ecx, 0xf71373a5
push ecx
mov ecx, dword [esi]
mov eax, 0x26bf1abd
ja 0x419340
mov ecx, 0xfca46d94
mov edx, ecx
jmp 0x468b60
mov eax, dword [edx + esi - 0x2c10de29]
mov dword [esp + edx*2 - 0x5821bc52], edx
lea ecx, [edx*4 - 0x4d4a2eec]
xor eax, ebx
pop edx
shr edx, cl
ror eax, 2
or dx, cx
inc eax
bswap ecx
not eax
sar edx, cl
adc edx, ecx
ja 0x44d952
movzx ecx, byte [esi]
add esi, 1
xor cl, bl
imul edx, edx
sub dx, dx
rol cl, 1
not cl
movsx eax, dl
xor edx, edx
sbb cl, 0x1b
xor eax, 0xd1aa2387
ror cl, 1
not dl
sar eax, 0x1e
sbb cl, 0x2f
rol cl, 1
xor cl, 0x9d
mul al
add cl, dl
btc edx, edx
adc eax, edx
xor cl, 1
xor bl, cl
add ecx, esp
bts edx, edx
adc edx, 0x1a09598b
mov eax, dword [ecx + eax - 0x7fffff00]
lea ecx, [edx + edx*2 + 0x7c3f0684]
sbb edx, 0x3097f893
add dx, 0x9292
lea ebp, [edx + ebp - 0x6971f48e]
sub edx, edx
mov dword [ebp + edx*4], eax
btc cx, dx
movsx eax, cl
jb 0x4d1dfc
shr ecx, 0xa1
xor dword [esp + ecx - 0x68000001], edi
ret
xor ecx, 0x8b0cdd23
movzx edx, byte [esp + eax - 0x26bf1abd]
sub edx, eax
neg dx
sbb ecx, 0x69a0401c
add edx, dword [esp + eax*2 - 0x4d7e357a]
or dx, dx
neg ecx
and eax, edx
xadd eax, edx
bswap ecx
neg edx
mul eax
rol ecx, 1
and eax, edx
ror ax, 0xe9
shl eax, 0x48
lea ecx, [eax + ecx - 0x2b7a7a62]
shl eax, 0x66
xor ecx, 0xdc95c190
xor ebx, ecx
ror byte [esp + edx - 0x699399e8], 4
sar byte [esp + edx - 0x699399e6], 0x67
jne 0x4364b0
adc ebp, ecx
sar word [esp + edx - 0x699399e7], 0x2d
movzx ecx, al
mov dword [esp + ecx], ebp
ret
mov ecx, dword [esi + edx*2]
shr dl, 0x41
btr eax, eax
cwde
lea esi, [esi + edx*2 + 4]
bt edx, edx
xor ecx, ebx
cwd
add ax, 0xb330
cwde
lea ecx, [edx + ecx + 0x2d86401c]
inc dl
xor ecx, 0x29b5b8a3
call fcn.004d20ee
mov ecx, 0x41be3f15
mov eax, dword [ebp + ecx - 0x41be3f15]
bts ecx, ecx
lea ebp, [ebp + ecx - 0x41be3f11]
xor eax, ebx
not eax
rol cx, 0x87
ror eax, 1
sal cx, 0x29
movzx edx, cx
not eax
ror eax, 1
jmp 0x4ae6bb
Function at 0x455b05
Capabilities:
Encode data using base64

Disassembly:
movzx eax, cl
xor edx, ebx
push ecx
ror edx, 1
bswap edx
lea eax, [ecx + ecx*2 + 0x38097493]
lea eax, [ecx*2 + 0x6c1f4586]
dec edx
rol edx, 1
mov dword [esp + 4], eax
xor ebx, edx
add cx, 0x98a4
xchg dword [esp + 1], eax
add dword [esp + eax - 0x68c75b6c], 0x12b747aa
lea ebp, [ebp + eax - 0x68c75b73]
pop eax
seto byte [esp]
sub eax, 0xb1e402
mov dword [ebp], edx
pop edx
jae fcn.00452de1

Function at 0x462325
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [esi + edx*2 - 0x62]
mov dword [esp + edx*2 - 0x62], edx
bts edx, edx
xor ecx, ebx
or word [esp + edx - 0x20030], dx
ror edx, 9
jns 0x4a9a67
dec dx
neg edx
ror eax, 3
inc cx
shr edx, cl
xor ebx, eax
push edx
add ebp, eax
ror byte [esp + ecx], 0xa2
xor dword [esp + edx], ebp
ret

Function at 0x467a18
Capabilities:
Encode data using base64

Disassembly:
inc ecx
and dl, dl
xor ax, 0x9801
call fcn.0044f5c2
lea esi, [edx + esi - 0xc1a80e2]
xor eax, ebx
xor eax, 0x893a7f25
sub dx, dx
lea ecx, [edx*4 - 0x494a5975]
neg eax
sal cl, 0x87
btc cx, cx
lea eax, [eax + edx*2 - 0x1e3e402e]
ror eax, cl
inc eax
imul ecx, ecx
rol edx, 0xc5
rol eax, 3
inc ecx
shr byte [esp], 0x21
lea eax, [edx + eax + 0x64d73019]
not cx
ror word [esp], 0x8e
or dl, 0xa0
xor ebx, eax
pop edx
bswap ecx
rol edx, 0x97
adc ebp, eax
and dl, dh
lea eax, [ecx + edx*2 + 0x720b8d23]
jmp ebp
lea edx, [edx + ecx + 0x3221b6b0]
xor eax, 0xe91b7a2d
imul edx, edx
bt cx, cx
xadd dx, cx
xor ebx, eax
rol edx, cl
adc dx, 0x2d02
bswap edx
adc ebp, eax
neg dl
xor cl, dh
sal dx, cl
jmp ebp
mov dword [esp], 0x271680a2
add edi, 6
not word [esp]
not byte [esp + 3]
inc word [esp + 1]
shld edx, eax, cl
mov eax, dword [esp]
pop ecx
sar ax, 2
mov dword [edi], edx
sbb esi, 4
mov edx, 0x1f063608
sal edx, cl
and ecx, 0x28961a01
mov eax, dword [esi + ecx*8 - 0x40b00008]
xor eax, ebx
not edx
bt dx, 0x93
xchg dh, dl
lea eax, [eax + ecx*8 - 0x79c04d9c]
sar cx, 0xea
rol eax, 3
xadd edx, ecx
bt ecx, edx
xor eax, ecx
ror edx, cl
jae 0x44c61a
rol dl, 0x25
cdq
lea esi, [eax + esi - 0x7891]
xor ecx, ebx
dec eax
xor eax, edx
xor eax, 0x25368e15
lea ecx, [ecx + eax - 0x76dcf58e]
sbb edx, edx
jo 0x4229ac
sal dl, 0x61
not ecx
idiv ax
dec dl
neg ecx
sub ecx, 0x90b2212d
xchg edx, eax
dec edx
or edx, 0x75227a00
xor ebx, ecx
bt eax, 0xa5
cdq
adc ebp, ecx
sub eax, eax
mov cx, word [edi + eax*2]
add ax, word [edi + eax + 2]
lea edi, [edx + edi + 2]
add edx, 0x139fca96
jg 0x4ad437
bt edx, edx
and cx, ax
bswap edx
not cx
push edx
ror edx, 0x72
movzx eax, byte [esp]
mov word [eax + edi - 0x13], cx
lea eax, [edx*4 - 0x12690342]
pop eax
jmp ebp
Function at 0x467fd9
Capabilities:
Encode data using base64

Disassembly:
imul dx, dx
xor eax, ebx
inc edx
dec cx
bswap eax
call fcn.004407cd
or cx, ax
rol edx, 0x44
mov eax, edx
not cx
mov word [esi], cx
push edx
sbb edi, 4
sub dword [esp], edx
bswap edx
call fcn.004816c9
mov edx, 0x6711082f
mov ecx, dword [edx + edi - 0x6711082f]
lea eax, [edx*8 - 0x16e8aec3]
xor dx, ax
sbb eax, 0x70842fbe
mov eax, dword [edi + edx - 0x67119a96]
lea edi, [edx + edi - 0x67119a96]
sbb dl, 0x2c
btc edx, edx
add dx, dx
and ecx, eax
lea edx, [edx*4 + 0x25007618]
and dl, 0x1a
btr dx, dx
not ecx
lea eax, [edx + edx + 0x2c88bbb5]
mov dword [edi], ecx
mov ecx, edx
mov edx, dword [esi]
adc esi, 4
xchg cx, ax
call fcn.004adf65
push edx
movzx ecx, dx
lea esi, [ecx + esi - 0x2207]
neg dword [esp + ecx - 0x2203]
setnp dl
call fcn.00442d11
mov edx, 0x1e8d17bd
lea eax, [edx + edx*4 + 0x4e299239]
mov ecx, edx
mov eax, dword [edi + edx*2 - 0x3d1a2f7a]
imul dx, cx
btc cx, cx
mov ecx, dword [edi + edx - 0x1e8d8185]
lea edi, [edx + edi - 0x1e8d8181]
sal edx, 0x99
mov dword ss:[edx + eax - 0x12000000], ecx
mov ecx, dword [esi + edx*2 - 0x24000000]
sal edx, 0x15
js 0x4ad119
lea esi, [esi + edx + 4]
and edx, edx
btc edx, 0x18
movsx eax, dx
xor ecx, ebx
call fcn.004dfe5e
mov ecx, 0x8b3cbd00
mov eax, ecx
cbw
sub esi, 4
movzx edx, ax
xor ax, ax
shl edx, 0x22
mov eax, dword [esi + edx*8]
dec dx
xor eax, ebx
shr cl, 0x87
adc edx, edx
not eax
and edx, 0x6c0103a3
bts ecx, ecx
lea eax, [eax + ecx*2 - 0x783a9c58]
setb cl
sar cx, 0xef
xor eax, 0x3e12212e
add edx, ecx
ror eax, 3
sub edx, edx
inc eax
not ecx
not eax
xor ecx, edx
imul edx, edx
xor ebx, eax
bts ecx, edx
btr edx, ecx
shl cx, cl
adc edi, eax
call fcn.0046ff67
mov ecx, dword [esi]
mov eax, 0x5fbb589d
ror eax, 0x13
call fcn.0044d8e0
rol cl, 0xa4
lea esi, [esi + eax*4 - 0x68c0cd01]
mov cl, byte [eax + esi - 0x1a303340]
shr eax, 0x91
cbw
xor cl, bl
not cl
not al
inc al
xor cl, 0x13
add cl, 0x23
ror cl, 1
bts eax, eax
xor cl, 0x3d
btr eax, eax
xor bl, cl
sub eax, eax
neg al
setno al
adc ecx, esp
bt ax, ax
mov byte [ecx + eax*4 - 4], dl
jmp ebp
lea eax, [ecx + ecx - 0x504927fa]
bts cx, ax
mov ecx, dword [esi + ecx*4 - 0x100]
sal eax, 0xa8
xor ecx, ebx
btc ax, ax
movzx edx, al
shr ax, 0xa4
sbb ecx, edx
neg eax
lea edx, [edx + edx*2 - 0x547b6bc9]
lea eax, [edx*2 + 0x1daf2a3b]
xor ecx, 0x9197c323
lea ecx, [ecx + eax*2 - 0x5eb51145]
sar eax, 0x55
jnp 0x4997b0
dec dx
neg ecx
mul edx
lea edx, [eax + eax*2 - 0x6aeffef7]
xor ebx, ecx
add ebp, ecx
mov dx, word [edi + eax*2 - 0x3460677a]
sal al, 0xe6
movzx ecx, al
lea edi, [edi + eax*4 - 0x68c0ccfe]
jne 0x48b851
xor ebx, eax
call fcn.004cacc1
mov edx, 0xc38bbd20
movzx ecx, dx
mov ax, word [ecx + ebp - 0xbd20]
not dl
imul edx, ecx
mov cl, byte [ebp + ecx - 0xbd1e]
ror dl, 0xc5
and edx, edx
inc dl
adc ebp, 2
lea edx, [edx + edx*8 + 0x3718a283]
push edx
neg edx
sal ax, cl
movsx ecx, word [esp + edx - 0x47170f35]
rol cl, 0x67
mov word [ebp + edx - 0x47170f35], ax
mov eax, dword [esi + edx - 0x47170f35]
or edx, 0x1f93a88c
not cl
xor edx, edx
lea esi, [esi + edx + 4]
not byte [esp + edx]
jbe 0x45b849