joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c996
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 4], bl
jne 0x45c9e5
cmp dword [esi + 0xc], ebx
jne 0x45c9e1
push edi
mov edi, dword [0x49e100]
push ebx
push ebx
push 1
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [0x4bf204], eax
call edi
mov dword [esi + 0x10], eax
lea eax, [esi + 8]
push eax
push ebx
push esi
push dword [esp + 0x1c]
mov byte [0x4bf200], 1
push ebx
push ebx
call fcn.00466e8b
add esp, 0x18
mov dword [esi + 0xc], eax
pop edi
mov byte [esi + 4], 1
pop esi
mov al, 1
pop ebx
ret 4

Function at 0x45d729
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [0x49e428]
test eax, eax
jne 0x45d78a
push ebx
push edi
mov edi, dword [0x49e418]
push 5
push dword [esi + 4]
call edi
mov eax, dword [esi + 0x2c]
test eax, eax
mov ebx, dword [0x49e4a8]
je 0x45d768
push dword [eax + 4]
call ebx
test eax, eax
je 0x45d768
mov eax, dword [esi + 0x2c]
push 0
push dword [eax + 4]
call edi
mov eax, dword [esi + 0x28]
test eax, eax
je 0x45d782
push dword [eax + 4]
call ebx
test eax, eax
je 0x45d782
mov eax, dword [esi + 0x28]
push 0
push dword [eax + 4]
call edi
inc dword [0x4bf24c]
pop edi
pop ebx
xor eax, eax
pop esi
ret 0x10

Function at 0x45d891
Capabilities:
Find taskbar

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
push edi
push 0x49f9e8
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call dword [0x49e4dc]
cmp eax, edi
je 0x45d8bc
push esi
push eax
call dword [0x49e4e0]
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x45e1e4
Capabilities:
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0xa98]
sub esp, 0xb18
mov eax, dword [0x4bc660]
xor eax, ebp
mov dword [ebp + 0xa94], eax
push ebx
mov ebx, dword [ebp + 0xaa0]
push esi
push edi
push dword [ebp + 0xab4]
mov eax, ecx
lea ecx, [eax + 0x38]
call fcn.0045ddd4
mov esi, eax
mov ecx, 0x18c
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x58]
xor esi, esi
push esi
push 0x410
call dword [0x49e11c]
mov edi, eax
cmp edi, esi
je 0x45e268
push 0x104
lea eax, [ebp + 0x88c]
push eax
push esi
push edi
call fcn.00492628
lea eax, [ebp + 0x88c]
push eax
push 0x4a4fa4
call fcn.0046abc4
pop ecx
pop ecx
push edi
call dword [0x49e344]
push 0x100
push 0x2b4
lea eax, [ebp + 0x5d8]
push eax
push esi
lea eax, [ebp + 0x88c]
push eax
call dword [0x49e3c4]
test eax, eax
jl 0x45e294
mov eax, dword [ebp + 0x5d8]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x64]
mov dword [ebp - 0x5c], esi
call dword [0x49e450]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x5c]
call fcn.0045d987
push dword [ebx]
call dword [0x49e07c]
push dword [ebx]
mov esi, dword [0x49e084]
mov edi, eax
mov dword [ebp - 0x60], edi
call esi
push edi
call esi
push dword [ebp - 0x5c]
push edi
call dword [0x49e08c]
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040a3d2
mov eax, dword [ebp + 0xaa8]
push 3
push 0
push 0
push 0x10
push 0x10
push dword [ebp - 0x64]
add eax, 0xc
push eax
mov eax, dword [ebp + 0xaa4]
add eax, 0xe
push eax
push dword [ebx]
call dword [0x49e43c]
mov esi, dword [0x49e088]
push 0xffffffffffffffff
push edi
call esi
lea ecx, [ebp - 0x60]
call fcn.0040a281
push 0xffffffffffffffff
push dword [ebx]
call esi
push dword [ebp - 0x68]
mov esi, dword [0x49e06c]
call esi
push dword [ebp - 0x6c]
call esi
push dword [ebp - 0x64]
call dword [0x49e44c]
cmp dword [ebp - 0x60], 0
je 0x45e349
push dword [ebp - 0x60]
call dword [0x49e080]
cmp dword [ebp - 0x5c], 0
je 0x45e354
push dword [ebp - 0x5c]
call esi
mov ecx, dword [ebp + 0xa94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004648e8
add ebp, 0xa98
leave
ret 0x18
Function at 0x462447
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [0x49e42c]
push 0
push 0
push 0x465
push eax
call dword [0x49e4f4]
push 0
push dword [esi + 4]
call dword [0x49e418]
xor eax, eax
pop esi
ret 0x10
Function at 0x4631c8
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.00462a11
push dword [esi + 4]
call dword [0x49e42c]
push 0
push 0
push 0x465
push eax
call dword [0x49e4f4]
push 0
push dword [esi + 4]
call dword [0x49e418]
xor eax, eax
pop esi
ret 0x10

Function at 0x463382
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x18
mov eax, dword [0x4bc660]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [0x49e4a4]
xor ebp, ebp
push ebp
push ebp
mov ebx, 0xf0
mov esi, ecx
push ebx
push dword [esi + 0x24]
call edi
push ebp
neg eax
push ebp
sbb eax, eax
push ebx
push dword [esi + 0x28]
neg eax
mov dword [esi + 0x78], eax
call edi
push ebp
neg eax
push ebp
sbb eax, eax
push ebx
push dword [esi + 0x30]
neg eax
mov dword [esi + 0x7c], eax
call edi
push ebp
neg eax
push ebp
sbb eax, eax
push ebx
push dword [esi + 0x34]
neg eax
mov dword [esi + 0x80], eax
call edi
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x88], eax
push 0xa
lea eax, [esp + 0x14]
push eax
push dword [esi + 0x4c]
call dword [0x49e460]
lea eax, [esp + 0x10]
push eax
call fcn.0046abbf
cmp eax, ebp
mov ebx, dword [0x49e4f0]
pop ecx
mov dword [esi + 0x84], eax
jg 0x463429
mov dword [esi + 0x84], 1
push 0x4a00f0
jmp 0x46343d
mov ecx, 0x2800
cmp eax, ecx
jle 0x46344f
mov dword [esi + 0x84], ecx
push str.10240
push dword [esi + 0x4c]
call ebx
push 0xffffffffffffffff
push ebp
push 0xb1
push dword [esi + 0x4c]
call edi
push 0xa
lea eax, [esp + 0x14]
push eax
push dword [esi + 0x50]
call dword [0x49e460]
lea eax, [esp + 0x10]
push eax
call fcn.0046abbf
cmp eax, ebp
pop ecx
mov dword [esi + 0x8c], eax
jg 0x463485
mov dword [esi + 0x8c], 1
push 0x4a00f0
jmp 0x463499
mov ecx, 0x2800
cmp eax, ecx
jle 0x4634ab
mov dword [esi + 0x8c], ecx
push str.10240
push dword [esi + 0x50]
call ebx
push 0xffffffffffffffff
push ebp
push 0xb1
push dword [esi + 0x50]
call edi
mov ecx, esi
call fcn.00462e43
push 1
push ebp
push dword [esi + 4]
call dword [0x49e400]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004648e8
add esp, 0x18
ret 0x10
Function at 0x490840
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x49bf78
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4bc660]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x4906f0
push 0
push 0
call fcn.00466e8b
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4908ab
lea ecx, [esp + 0x10]
call fcn.00466195
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.00412297
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x4908d1
cmp eax, 0xffffffff
je 0x4908d1
push eax
call dword [0x49e344]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [0x49e298]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0xb51cf1
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*8 - 0x7ae00000], 0x5a1c548c
not edx
rol ax, 0x48
or cl, 7
rol edx, 1
and eax, 0xe0039a38
call fcn.01177d4e
movzx ax, byte [ebp]
mov cl, byte [ebp + 2]
or al, cl
not al
mov edx, 0xd8a9ac96
movsx ecx, dl
mov word [ebp + 2], ax
push edx
shr dx, 0xe3
mov dword [esp], ecx
movzx ax, byte [ebp + 2]
xadd byte [esp + 1], cl
mov cl, byte [ebp + 4]
add al, cl
sal word [esp], 0xa6
movzx ecx, dl
mov word [ecx + ebp - 0x8e], ax
sub word [esp + ecx - 0x92], 0x1e06
mov eax, edx
js 0x11b9b41
lea ebp, [ebp + ecx*4 - 0x244]
bt cx, dx
div cl
mov edx, dword [esi + ecx*4 - 0x24c]
lea esi, [ecx + esi - 0x96]
xadd word [esp + ecx*4 - 0x247], cx
xor edx, ebx
inc ax
jge 0xe64af5
mov edx, 0x81864f22
sub ebp, 4
movzx eax, dx
add eax, edx
mov ecx, dword [ebp]
xor ecx, ebx
call fcn.00c56fa0
call fcn.00e4e1cb
mov ecx, 0xa81754a2
push ecx
mov edx, dword [ebp]
add ebp, 4
rol cx, 0x81
sbb cx, cx
adc cl, byte [esp + 1]
xor edx, ebx
inc ecx
sub word [esp], cx
ror edx, 3
xchg dword [esp], ecx
shl byte [esp + 3], 6
mov eax, 0xdf01b420
dec edx
shl ax, cl
sub cl, 0xb8
ror edx, 1
ror ecx, cl
bswap eax
lea edx, [eax + edx - 0x3a8d7575]
ror eax, 0x6e
lea ecx, [eax*8 - 0x7e77cdf7]
not edx
imul ax, cx
xor ebx, edx
bt ecx, 0x8b
adc edi, edx
movzx edx, byte [esp + eax - 0x77c0000]
xor dword [esp + eax*4 - 0x1df00000], 0xfd1bca85
add ax, word [esi + eax*4 - 0x1df00000]
ror dl, 0xe1
not dx
mov cl, byte [esi + edx*2 - 0x1fea8]
adc dx, 0xe8a
lea edx, [edx + edx*2 + 0x933c825]
lea esi, [esi + edx - 0x933f1c3]
xor dx, dx
dec edx
sub edx, dword [esp + edx*8 - 0x4997fff8]
shl ax, cl
mov word [esi + edx*2 - 0x184c6a5e], ax
push edx
mov dword [esp + edx*4 - 0x3098d4bc], edi
ret 4
Function at 0xb577e7
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not cl
mov ecx, dword [esp + ecx - 0x78af]
call fcn.011cd2c5
mov edx, dword [ebp]
mov eax, 0x1b01610b
lea ecx, [eax + eax*2 + 0x7fb0e9b0]
cwde
mov ecx, dword fs:[edx + eax - 0x610b]
movsx edx, al
mov dword [ebp + eax*8 - 0x30858], ecx
btr edx, eax
neg edx
mov eax, dword [ebp + eax*2 - 0xc216]
not dx
mov ecx, edx
adc ebp, 3
bts cx, cx
sar ecx, 0x25
shr edx, 0x6f
movzx edx, byte [esi + edx*2 - 0x3fffd]
xor dl, bl
imul cx, cx
adc dl, 0xa0
add ecx, 0x7d311496
sub cx, cx
xor dl, 0xa2
not ecx
xor ecx, 0x25afb518
shr cx, 0x6f
not dl
sbb dl, cl
lea ecx, [ecx*2 - 0xc7027c5]
rol cx, 0xc4
not dl
imul ecx, ecx
neg ecx
inc dl
shl cx, 0xc7
shr ecx, 0xdc
btc ecx, 0xbc
xor bl, dl
xor cx, cx
adc edx, esp
shl cl, 0x42
mov dword [edx + ecx*2 - 0x20000000], eax
shr ecx, 0x89
movzx edx, cx
mov eax, dword [esi + ecx - 0x80005]
lea esi, [esi + ecx*2 - 0x100005]
xor eax, ebx
rol cl, 0xa7
neg eax
not edx
bt cx, dx
jae 0xb5a904
inc ecx
mov esi, 0x360d0c29
dec ebx
lea eax, [esi + esi*4 - 0x18ce6055]
inc ebp
movsx ebp, si
inc esi
mov edx, dword [ebp + esi - 0x360d0c29]
inc edi
movzx ebx, byte [esi + edi - 0x360d0c29]
inc ecx
movzx esi, dh
dec eax
cwde
inc ebp
xor bl, ah
bt esi, eax
inc ecx
inc bl
dec eax
cdq
movzx ecx, ax
bt edx, 0x8d
inc ecx
rol bl, 1
imul cx
jb 0x1197830
xor edx, ebx
shr dword [esp + 4], 0x39
call fcn.00edc3c9
sbb eax, 0xc5a2a892
bts ecx, ecx
xor eax, 0x83969790
rol ecx, 0xa1
sub cl, 0x1b
xor eax, edx
xor ebx, eax
add dl, dl
ja 0xe8f6c9
add edi, eax
bts ecx, edx
jmp edi
or ecx, 0xd435b004
inc edx
not ax
shl ecx, 0x88
neg cx
not edx
xor ebx, edx
sal ax, 0x8a
xadd eax, ecx
rol eax, 0xf8
adc edi, edx
or ax, ax
mov edx, esi
sal ax, 0x2f
and eax, ecx
ror eax, 0xba
lea esi, [eax + esi - 0x28000002]
shl ecx, 0xce
shr al, 6
mov word [ecx + esi - 0x40000000], dx
not eax
jae fcn.011d0d7c

Function at 0xb5adda
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esi + edx - 0x74a801b8]
cwde
ror ecx, cl
mov cl, byte [esi + eax - 0x3fc]
shl al, 0x22
mov dword [esp + eax - 0x400], 0xec07630b
cbw
shl edx, cl
ror byte [esp + eax*4 + 3], 1
cbw
mov dword [esi + eax*2 + 2], edx
call fcn.01197b65
add byte [eax], al
add byte [eax + ebp*2 + 0x72], dl
popal
xor esi, dword fs:[edx]
inc esi
imul esi, dword [edx + 0x73], 0x8c890074
mov dword [esp + edx*4 - 0x11714], ecx
add ebp, eax
rol byte [esp + edx*4 - 0x1170f], 0xe1
jno 0xf01bdd
movzx ecx, byte [esi + edx*2 - 0x8b86]
lea esi, [edx + esi - 0x45c0]
xor cl, bl
imul edx, edx
rol cl, 1
mov eax, edx
cbw
xor al, ah
inc cl
xor cl, 0xb9
inc eax
sub cl, 0x81
xor eax, dword [esp + edx - 0x1303c989]
imul edx, eax
call fcn.00ed5cbb
call fcn.00ead26d
Function at 0xb68627
Capabilities:
Encode data using base64

Disassembly:
lea edx, [ecx + edx + 0x10120519]
not edx
xor edx, 0x751f023d
inc ax
cwde
rol cl, 0x46
xor ebx, edx
xor ecx, ecx
rol dword [esp + ecx + 4], 0xba
xor ecx, eax
adc ebp, edx
not dword [esp + 4]
mov edx, dword [esp + 4]
cwde
mov ax, word [edx + edi - 0x30f8291e]
sar dl, 0x85
btc dx, 0x13
inc cx
lea edi, [edx + edi - 0x30f82905]
xor ecx, 0x699d5b2
movzx edx, byte [esi + edx*2 - 0x61f0520e]
adc esi, 5
call fcn.00b7eff7
pop edx
inc cx
mov eax, 0x2abd8c1d
xor bx, cx
not eax
rol eax, 0xb1
sbb esi, 2
call fcn.00c3b83a
or byte [esp + 2], 0x99
sal dword [esp + 4], 0x3c
mov word [edi + 2], dx
setnp byte [esp + 2]
mov dword [esp + 4], ecx
mov edx, dword [esi]
movsx eax, cl
xor edx, ebx
neg edx
or dword [esp + 3], ecx
lea ecx, [ecx + ecx + 0x6b250dac]
js 0xb55e91
fdiv qword [ecx + 0x29]
invalid

Function at 0xb6a758
Capabilities:
Encode data using base64

Disassembly:
inc eax
lea ecx, [ecx + edx*2 + 0x19e1eaf6]
btc edx, eax
rol ecx, 2
dec ecx
ror ecx, 2
or al, 0xb5
ror edx, 0xda
cdq
xor ebx, ecx
div eax
shr dx, 0xad
jae 0xc68e11
adc edi, ecx
mov dword [esp + edx], edx
jmp 0x11c0f05
mov eax, dword [esi + edx*2]
sal dl, 0xa6
dec edx
lea ecx, [edx*2 + 0x54978308]
mov edx, dword ss:[ecx + eax - 0x54978306]
and ecx, 0xd91812b7
mov dword [ecx + esi - 0x50100206], edx
ror ecx, 0xc8
inc ecx
xor dword [esp + ecx*4 - 0x1940400c], edi
ret

Function at 0xb73ed0
Capabilities:
Encode data using base64

Disassembly:
pop eax
not edx
call 0xb93064
mov eax, 0xfeac2b8f
mul eax
mov eax, dword [edi + eax - 0x539159e1]
mov ecx, dword [edi + 4]
adc edi, 7
mov dword ss:[eax], ecx
lea eax, [edx*2 - 0x5e582bdc]
mov eax, dword [esi]
add edx, edx
adc esi, 3
neg dx
lea ecx, [edx + edx*4 + 0x23be1dac]
btr dx, cx
xor eax, ebx
not dl
jmp 0x11a96cb

Function at 0xb74955
Capabilities:
Encode data using base64

Disassembly:
inc ecx
rol ebx, 1
inc ecx
bswap ebx
movzx edi, dl
dec eax
mov dword [esp + esi], esi
jmp 0xc90124

Function at 0xb796c8
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*2 - 0x1c485824], ecx
lea esi, [esi + ecx*2 - 0x1c485820]
sal cl, 0xc3
movzx edx, cx
xor eax, ebx
or cx, dx
not eax
not dx
rol eax, 2
jmp 0xed82ad
push edx
not eax
btr dx, dx
lea eax, [eax + ecx*2 + 0x544b817a]
sub cx, 0x11b2
mov dword [esp + ecx*2 - 0x1c4835bb], 0x730902bd
sub byte [esp + ecx - 0xe241add], ch
xor ebx, eax
or edx, ecx
adc ebp, eax
sal dx, 0xc5
call fcn.00e688f0

Function at 0xb7dd81
Capabilities:
Encode data using base64

Disassembly:
jmp 0x119548f
xor ebx, ecx
mov dword [esp], 0x790e79b
neg dword [esp]
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x11c8fd8]
push 0x773d5a91
jmp 0xe54dc9
jmp 0xc8b73a
Function at 0xb7f99e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp], eax
jae 0xe55cdc
mov eax, dword [edi]
mov edx, 0x27263913
neg dx
mov ecx, edx
mov edx, dword [edi + edx*2 - 0x4e4d8dd6]
ror cl, 0x41
sar ecx, cl
dec cx
lea edi, [edi + ecx*8 - 0x4d4]
dec ecx
lea ecx, [ecx + ecx*2 + 0xb0afd00]
shr cl, 0xc3
not eax
sbb ecx, 0x720c2182
not edx
btc ecx, ecx
bswap ecx
adc ecx, 0xd23d1425
and eax, edx
dec ecx
movzx edx, cl
call fcn.0116d77c
mov eax, 0xd38bb816
jmp 0xc88305
jmp 0xb57c03
push 0x9127899f
dec ebx
jmp 0xb93dd8

Function at 0xb8675a
Capabilities:
Encode data using base64

Disassembly:
and esi, 0xff
mov esi, dword [esi*4 + 0xc4ae18]
jmp 0xebdba0
lea esp, [esp + 0xc]
je 0x11646ba
push 0x5e94e091
mov dword [esp], esi
mov esi, 0x9a0c6c25
sar esi, 0xd5
sub si, 0x17
movzx esi, byte [ecx]
push 0xe48e80a5
je 0x117f767
neg word [esp + 2]
xor esi, eax
jmp 0xb46a7e
adc ebp, 3
rol dword [esp + 6], 0xc7
jb 0xb8fa74
xor eax, eax
test edx, edx
jmp 0xb8038c
mov edx, 0x19837b80
not eax
lea ecx, [edx*8 + 0x54836320]
mov dword [ebp + edx*2 - 0x3306f700], eax
lea eax, [ecx + ecx*2 + 0x37a9160b]
not ecx
jmp esi

Function at 0xb8fa7d
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x89386efd
call fcn.00c0905c
xor ecx, ebp
lodsd eax, dword [esi]
adc al, 0x1b
cmp byte [ebx], 0x24
sbb al, 0xf7
xor dword [ebp + 0x15], 0x1245176e
sbb dword [eax + edx*8 - 0x1fdd788a], esi
jno 0xb8fa94
cwde
mov cl, 0x78
imul ecx, dword [esi], 0x9f1e7f81
pushfd
ror byte [esi - 0x63853f7], 0xb3
std
into
pushal
and eax, 0x8617c9cd
pop eax
lodsd eax, dword [esi]
mov dword [eax], edx
push 0x39aafeaa
mov dword [0xa4093c67], eax
adc cl, cl
add al, 0xac
popfd
pop edi
xor al, 0xab
ljmp 0x5573
Function at 0xb90c67
Capabilities:
Encode data using base64

Disassembly:
mov eax, edx
cwde
xor ecx, ebx
xor edx, eax
btc dx, ax
bswap ecx
xor ecx, 0xeead4a12
shr edx, 0x19
neg al
not al
neg ecx
rol ecx, 3
btc edx, eax
sub edx, eax
xor ebx, ecx
shl edx, 1
adc esi, ecx
mov ecx, edx
sal eax, 0xa7
adc eax, 0x140c262b
mov ecx, dword [edx + ebp - 0x200550]
sbb eax, eax
add eax, eax
add edx, eax
mov edx, dword [ebp + edx - 0x20054a]
adc ax, 0xca99
bswap eax
adc ebp, 7
mov dword ss:[ecx], edx
movzx edx, ax
jmp esi
lea esp, [esp + 8]
jne 0xe8a344
push 0x53b05083
mov eax, dword [ebp]
call fcn.011ba2b1
inc ecx
not esi
dec ecx
lea ebp, [ebp + ebp - 0x303633dd]
inc ebp
movsx eax, si
inc ecx
sub dl, cl
cbw
inc eax
shl bh, cl
inc ecx
mov ecx, ebp
call fcn.00e8a2a7

Function at 0xb90c7f
Capabilities:
Encode data using base64

Disassembly:
js 0xc315f7
call fcn.00c397ab
xor ecx, ebx
mov eax, edx
sub edx, 0x180360b4
jb 0x11b3b14
Function at 0xb94621
Capabilities:
Encode data using base64

Disassembly:
adc edi, 5
push 0x88800221
shrd edx, eax, cl
mov dword [esp + 4], 0x7286f30a
mov dword [edi], edx
call fcn.00c86e7d
mov eax, 0x54af4381
mov ecx, dword [ebp + eax - 0x54af4385]
xor ecx, ebx
mov edx, 0x268d8c98
cwde
inc ax
dec ecx
btr ax, dx
xor ecx, 0xefaea507
shl dl, 0x62
lea ecx, [ecx + edx*4 + 0x1d17796]
ror ecx, 1
sar ax, 7
cwde
bswap ecx
xor ebx, ecx
xadd dx, ax
add al, 0xad
sbb edx, edx
add edi, ecx
cbw
movzx edx, byte [ebp + eax*8 - 0x6d]
xor dl, bl
sub dl, 0x37
lea ecx, [eax - 0x2ccd13f2]
sar ax, 0xa1
neg dl
shl al, 0x27
bt eax, ecx
cbw
xor dl, 0x89
not ecx
jmp 0xc30fdb
sub dl, 5
shr eax, 0xf9
rol dl, 1
shl cx, cl
bts ecx, eax
shr ecx, cl
adc dl, 0xa
ror dl, 1
not ecx
xadd eax, ecx
inc eax
dec dl
sal al, 0x21
jp 0xb889fd

Function at 0xb95446
Capabilities:
Encode data using base64

Disassembly:
mov dword [edx], ecx
lea ecx, [eax + 0x79af083a]
lea ebp, [ebp + ecx - 0x62cf4442]
mov ecx, dword [ebp + ecx - 0x62cf443e]
mov dword [esp], eax
xor ecx, ebx
call fcn.00c779e7
test esp, edi

Function at 0xb961ea
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x79166815
xor ax, ax
mov ecx, eax
not edx
inc ax
dec ecx
mov dword [ebp + eax - 0x79160001], edx
push eax
btr eax, 7
call fcn.00b56e4d
mov ecx, 0x7e97b88f
and cl, 0xaa
lea edi, [edi + ecx - 0x7e97b88e]
movzx eax, cl
cwde
mov edx, dword [edi + ecx - 0x7e97b88a]
adc cx, 0x5487
and cx, cx
sbb cl, ch
xor edx, ebx
lea ecx, [eax*8 + 0x1eb72994]
call fcn.00ebbb74
mov ax, word [ebp]
mov dx, word [ebp + 2]
add ebp, 2
mov ecx, 0xe696d48c
not ax
not dx
and cl, ch
lea ecx, [ecx*8 + 0x78002235]
and ax, dx
mov word [ebp], ax
lea edx, [ecx*2 - 0x3670abeb]
and edx, 0x35a7d523
lea edi, [edi + edx - 0x20a4c027]
bts edx, 0x9a
mov edx, dword [edx + edi - 0x24a4c023]
btr ecx, ecx
xor edx, ebx
mov eax, ecx
bswap edx
inc al
not eax
or ecx, eax
lea edx, [ecx + edx - 0x61c4874d]
rol eax, cl
neg edx
dec edx
bt ecx, 0x22
neg edx
call fcn.00c0d76b
lea esp, [esp + 0x10]
je 0xb52ae6
jmp 0xc3aa0e
push 0x14053f84
mov dword [esp], ebx
mov ebx, 0x9facf4ae
movzx ebx, byte [ecx]
xor ebx, edx
push 0x4514d8b3
jmp 0xc739b4
and ebx, 0xff
mov ebx, dword [ebx*4 + 0xe91df0]
sal dword [esp], 0x74
shr edx, 8
xor edx, ebx
neg byte [esp + 3]
call fcn.00e7b575
Function at 0xb9d25a
Capabilities:
Encode data using xor

Disassembly:
jmp edi
xor ebx, eax
add edi, eax
movsx eax, cx
sub ecx, edx
jle 0xb5b9ae
mov ecx, 0x6233e68a
movsx eax, cx
movzx ax, byte [ebp + ecx - 0x6233e68a]
push ecx
mov cl, byte [ebp + ecx - 0x6233e688]
sar byte [esp + 1], 0x85
mov edx, dword [esp]
lea ebp, [edx + ebp - 0x6233ff88]
sbb dl, 0x39
sub dword [esp + edx - 0x6233ff51], edx
shr al, cl
sal edx, 0x4b
mov word [ebp], ax
mov eax, edx
lea ecx, [edx*2 + 0x9823415]
lea edi, [edi + ecx - 0x49774419]
btr ecx, eax
mul edx
add cx, ax
mov eax, dword [edx + edi - 0x63f92a1d]
add ecx, edx
push edx
xor eax, ebx
bt ecx, ecx
leave
sbb edx, 0x1680bab3
ror eax, 3
rol dword [esp + edx - 0x4d786f69], cl
ror dl, 0xe6
adc cl, byte [esp + edx - 0x4d786fa2]
sbb eax, 0xd4a04225
bswap eax
xchg cl, dl
rol word [esp + edx - 0x4d786f2d], 0xa5
shl byte [esp + edx - 0x4d786f2c], 0xc1
lea eax, [eax + edx - 0x6a997cee]
inc ecx
xchg dx, cx
push edx
xor eax, 0xc039831d
add cx, word [esp + edx - 0x4d786ea8]
xor dx, cx
rol eax, 2
xchg word [esp + edx - 0x4d78d1fb], cx
xor ebx, eax
call fcn.0118efcb
in eax, 0x83
adc ah, byte [edi + esi*2 - 0x1e]
jge 0xb74b49
jmp 0xb74bbe
sbb eax, 0x4908eb95
mov bl, 0xa0
ja 0xb74bca
pop es
and edx, edx
dec ecx
push ebp
mov edx, 0x28a9dc3b
imul esp, dword [esi], 3
rol bl, cl
enter 0x1523, 0xffffffffffffffc3
inc esp
invalid
xchg edx, ecx
xor eax, ebx
not edx
lea eax, [eax + ecx*8 - 0x732c4008]
xor eax, 0xae30e598
mov dword [esp + ecx], 0x14ae1d84
pop ecx
dec eax
and cx, 0xc891
neg ecx
xor eax, 0x87062ca6
jmp 0xb74ad7
Function at 0xbf8d94
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x140
call fcn.00c21e37
dec eax
mov dword [esp], 0x3cbfce8f
dec ecx
cmp ebp, ebx
push 0xbbe0c23
push 0xf2249d98
jmp 0xca6262
dec eax
lea esp, [esp + 0x18]
ja 0xeac884
dec eax
mov eax, esp
jmp 0xb8f9e2
Function at 0xc04db1
Capabilities:
Encode data using base64

Disassembly:
mov dword [esi + 0xc], eax
mov dword [esp], 0x8030aa6
push 0xd71d4e05
jmp 0xea0ffd
mov dword [esp + eax - 0x2f3db11b], 0x24ae9b38
add eax, 0x39a7da3e
pop eax
pop ecx
pop eax
pop ecx
jae fcn.01181cee
inc esp
mov ecx, esi
dec esi
lea edi, [edx + edi + 4]
dec eax
imul eax, edi
inc eax
not dh
inc ebp
xor eax, esp
inc ecx
sub eax, 0xf008213d
add edi, eax
inc ecx
ror eax, 1
inc ecx
not eax
inc edi
lea eax, [eax + ebp*2 - 0x138eb202]
sal si, 0xe
inc ecx
bswap eax
inc esp
movzx edx, dx
dec esp
sub edx, ecx
inc esp
and ebp, eax
inc ecx
inc eax
inc ecx
push esp
inc al
inc esp
xor dword [esp + edx], eax
inc ecx
pop esp
dec ebp
arpl ax, ax
bswap edi
inc ecx
rol cl, 0x82
btr esi, eax
dec ecx
adc ebx, eax
dec eax
add edx, ebx
jmp edx
mov dword [esi + 8], ebx
rol byte [esp + 3], 0x26
shr byte [esp + 6], 0x67
mov dword [esi + 4], ecx
mov eax, 0x2f3db127
mov ecx, dword [esp + eax - 0x2f3db126]
mov dword [eax + esi - 0x2f3db127], edx
mov ebx, dword [esp + eax - 0x2f3db11b]
jae 0xe8b625

Function at 0xc0a9cd
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov ecx, dword [edi + eax - 0x8550]
dec esp
mov dword [esp + eax - 0x8548], ecx
neg edi
inc esp
btc edx, ebp
dec ebp
lea edi, [edi + edi - 0x4480585]
inc ecx
xor ecx, esp
inc cx
dec esi
lea ecx, [ecx + eax - 0x7c0453f3]
dec eax
rol dword [esp + edi*2 - 0x8900b0a], 0x64
cbw
cbw
rol ecx, 3
inc ecx
dec eax
mov dword [esp + edi - 0x4480589], 0x1726eda6
inc esp
movsx edx, ax
idiv dword [esp + edi*2 - 0x8900b08]
xor ecx, 0x8313d199
dec eax
rol dword [esp + edi*2 - 0x8900b0a], 0xbf
mov word [esp + edi*2 - 0x8900b06], ax
inc cx
sub eax, 0x8c8d0930
jns 0xc0aa01
ret

Function at 0xc0f46f
Capabilities:
Encode data using base64

Disassembly:
call fcn.00c2e651
mov eax, ecx
xor edx, ebx
xor cx, cx
or al, 0x8b
sal cl, 5
sbb edx, 0x40ba7399
rol edx, 3
sar cl, 0x65
js 0xb764f5
sbb edx, 0x4a9aeab7
push eax
ror byte [esp + 3], 0xe6
jb 0xc26afa
ror edx, 2
sar byte [esp + 1], 0xe5
ror dword [esp], 0xa3
js 0x11b2c11
inc edx
xor ebx, edx
ror byte [esp + 2], 0x81
sar ecx, 0xc5
adc edi, edx