joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc9e9b8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not cl
dec al
and dl, cl
sar ax, 0x8a
xor dword [esp + eax - 0x681a000d], eax
mov word [eax + esi - 0x681a000c], dx
adc eax, dword [esp + eax - 0x681a000d]
movsx ecx, ax
mov ecx, dword [ebp - 4]
not dword [esp + 4]
adc ebp, 0xfffffffc
cdq
or eax, edx
idiv eax
xor ecx, ebx
btr ax, 0x3d
not ecx
imul dword [esp + eax*2 + 2]
jno 0xc66cff
xchg dword [esp + 4], edx
xchg word [esp + edx*8 - 0x44c], dx
mov dword [esp + edx - 0x9186], ebx
mov dword [esp + edx*4 - 0x24628], 0x1ab001a1
mov ebx, 0xb1971416
cpuid
inc byte [esp + 1]
sete byte [esp]
push 0xd4271e08
sub ebp, 8
call fcn.009348e5
mov edx, 0x7726b70c
movzx ax, byte [edx + esi - 0x7726b70c]
mov cl, byte [edx + esi - 0x7726b70a]
bt edx, edx
shr dl, 0xa7
ror dx, 0x2b
not al
shr edx, 0xcb
adc edx, edx
not cl
bswap edx
sbb dl, 0x9b
setae dl
and al, cl
sub edx, 0x3ba426b8
mov dx, ax
mov ecx, 0x898c0480
lea eax, [ecx + ecx*4 - 0x6765297d]
movzx dx, dl
mov cl, byte [esi + eax - 0x4856ecff]
ror eax, 0xed
push eax
not dl
push eax
jnp 0x91f2a4
jns 0x7d3020

Function at 0xca1be8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea esi, [esi + edx - 0x16]
lea ecx, [edx + edx*2 - 0x4fc9b6e4]
sub cx, 0x9b99
mov word [esi + edx*8 - 0xa0], ax
call fcn.009b4bef
push edx
shr byte [esp + eax - 0xa], 0xa3
sbb cl, 0x27
rol edx, 5
push edx
rol cl, 1
cwde
rol edx, 0xce
sbb dword [esp + eax - 6], eax
adc cl, 0x37
dec al
rol cl, 1
xor dx, dx
cwd
shl al, 0xc4
adc cl, 0x39
neg word [esp + eax - 0x8f]
ror cl, 1
not cl
bts eax, 0x3f
xor cl, 0x96
neg edx
xor bl, cl
push edx
and edx, 0xcb288019
lea ecx, [esp + ecx + 0xc]
mov eax, dword [ecx + edx - 0x43200000]
sar byte [esp + edx - 0x431ffffb], 0x21
mov dword [edx + edi - 0x43200004], eax
lea eax, [edx*8 + 0x48936336]
je 0x943791
dec dword [esp + eax - 0x61936336]
mov edx, dword [ebp + edx - 0x43200005]
and ax, ax
xor edx, ebx
jmp 0xd10296

Function at 0xca1df1
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
call eax
mov edi, 0xdc3b37a0
mov ebx, edi
mov ebp, dword [ebp - 4]
call fcn.007a741b
not eax
mov eax, ebp
add eax, edx
push 0x831d1981
jmp 0xc78b97
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0xc87a24
mov eax, dword [ebp + ebx*4]
push 0x14b77139
call fcn.00d00bc5
call 0x7a42c3
mov eax, dword [ebp]
push 0x7395860e
mov dword [esp], 0xe396393e
jmp 0x8f6795

Function at 0xca7c29
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
lea eax, [esp + eax + 4]
bts edx, 0x83
mov edx, dword [ecx + eax - 0xb40]
movsx eax, cx
mov dword [esp + ecx - 0xb40], eax
jae 0xca0834
adc esi, 3
push 0x81e8b89
not byte [esp + 5]
shld dx, ax, cl
rol byte [esp + 7], 0x43
mov eax, 0xc81ac99d
adc eax, eax
mov word [esi], dx
movzx edx, word [esp + 4]
shl dx, 0x49
mov ecx, dword [ebp + edx*8 - 0x8000]
lea ebp, [ebp + edx - 0xffc]
xor ecx, ebx
not ecx
imul ax
bswap ecx
call fcn.0075f4d9

Function at 0xca8c64
Capabilities:
Authenticate hmac

Disassembly:
mov ebp, edx
sal eax, 0x31
mov edi, esi
mov ecx, eax
jae 0x97e992
Function at 0xca95e8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov eax, dword [ebp]
mov ecx, dword [esp]
mov dx, word [ecx + ebp - 0x3ba1c611]
btr cx, cx
sar word [esp + ecx*2 - 0x77438c29], 0xe
lea ebp, [ecx + ebp - 0x3ba1c60f]
mov word [ecx + eax - 0x3ba1c615], dx
mov edx, dword [esp + ecx*2 - 0x77438c2a]
dec byte [esp + ecx - 0x3ba1c613]
jg 0x73e3d0
mov edx, dword [edi + ecx - 0x3ba1c615]
lea edi, [edi + ecx - 0x3ba1c611]
sub dword [esp + ecx*2 - 0x77438c2a], 0x41a5c9a4
xadd cl, ch
xor edx, ebx
jmp 0x82f68e
bswap ecx
sub ecx, 0xdf95e8a4
mov dword [esp + edx - 1], 0x8cb994be
sar eax, 0xe
xor ebx, ecx
add edi, ecx
mov ecx, dword [ebp + edx + 3]
push edx
xor ecx, ebx
bswap ecx
sub ecx, 0xd9943d82
cdq
neg ecx
xadd word [esp + 4], dx
ror ecx, 1
call fcn.00ccbcc6
push 0x3ba1c62a
sar byte [esp], 0x41
jg 0x76265e

Function at 0xcb07bc
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
bt eax, 0xbc
mov dword [esp], 0x6eaeda25
adc esi, 2
shr al, 0xe3
sal edx, cl
mov dword [esi], edx
mov edx, 0xed8a5216
or eax, eax
mov edx, dword [ebp]
movsx ecx, ax
btr ax, 0x25
lea ebp, [ecx + ebp - 0x4d13]
xor edx, ebx
lea edx, [edx + eax - 0x798cd080]
dec cx
not edx
xor edx, 0xa3aa3334
not edx
rol edx, 1
call fcn.00c9915c
Function at 0xcb7386
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push eax
not word [esp + 2]
dec cl
jmp 0x835f0d
setb byte [esp + 5]
xor ebx, eax
dec word [esp + 3]
jl 0x9b50a0
jge 0x949086
mov edx, 0xcda7cf0c
call fcn.00842bd6
mov dx, word [edi]
mov ecx, 0x9c20972c
bt ecx, 0xb7
sal cl, 0x83
adc edi, 1
not ecx
lea ebp, [ebp + ecx - 0x63df68a0]
movzx ecx, byte [ebp + ecx - 0x63df689f]
xor cl, bl
mov eax, 0xf60f87b6
shl al, 0x61
inc cl
xchg ah, al
btc eax, 0xa7
xor cl, 9
inc cl
ror cl, 1
jmp 0x75998e
xor bl, cl
dec eax
call fcn.00d11a17
inc cx
neg eax
dec eax
lea eax, [ebx + 0xf345786]
dec ecx
rol edi, 7
dec ecx
dec edi
dec eax
shl dword [esp + edx], 0xe
inc edx
cwd
dec ecx
rol edi, 7
inc edx
sal dword [esp + eax - 0x7b4dbffd], 0xc8
dec ecx
xor edi, 0x2f1400b7
inc cx
dec esi
inc esi
add byte [esp + eax - 0x7b4dbffe], ch
adc ax, word [esp + edx*4 - 0x3fff7]
dec ecx
bswap edi
inc esp
movsx edx, word [esp + edx - 0xfffb]
dec edx
shl dword [esp + eax - 0x7b4dbfff], cl
inc esp
mov esp, dword [esp + edx - 0xffff]
dec ebp
xor ecx, edi
dec eax
mov dword [esp + edx*2 - 0x1fffe], ebx
not bl
dec edx
lea esi, [esi + eax - 0x7b4dc007]
call fcn.00940e5f
bts eax, 0xb0
bt edx, 0x15
mov ecx, dword [ebp + edx*2 - 0x3142]
jb 0x959b57
sbb dx, 0x9b84
jge 0x86693a
inc ecx
pop ecx
not edx
inc ecx
movzx ecx, di
dec eax
shr edx, 0x64
dec eax
arpl ax, ax
ror cl, 0xe1
push ebx
inc ecx
setbe al
dec eax
adc ebp, eax
dec eax
inc dword [esp + edx]
inc ecx
push edi
dec ecx
cmovge edi, edi
dec edi
mov edi, dword [ebx + eax - 0x7b4d4001]
dec esp
lea ebp, [ecx*8 + 0x259752ab]
inc si
add ebp, dword [esp + eax - 0x7b4d3ff3]
dec edi
lea ebx, [eax + ebx - 0x7b4d3ff9]
pop ecx
inc edx
sets byte [esp + eax - 0x7b4d3fff]
dec ebp
xor edi, ecx
dec esi
lea edi, [edx + edi + 0x4bb9beb3]
jmp 0x973310
dec eax
mov dword [esp], 0x2602aeae
not dword [esp + 4]
bswap eax
not eax
rol dword [esp + 3], 0x49
jae 0x76bc74
mov ecx, 0xd488511f
sal ecx, 0xf6
movzx ecx, byte [ecx + edi - 0x47c00001]
mov eax, 0x5e884cb0
xor cl, bl
lea eax, [eax + eax - 0x4366e5c9]
sub cl, 0x9e
movsx edx, al
dec eax
rol cl, 1
imul eax
div eax
sar eax, 0x5b
neg cl
shl eax, 0xc2
rol cl, 1
shl dx, 0xef
xor bl, cl
add ecx, esp
imul dx, ax
add eax, eax
call fcn.00c940be

Function at 0xcb762d
Capabilities:
Encode data using xor

Disassembly:
rol dl, 1
add dl, 0x25
push eax
bt eax, 0x1d
and cl, al
neg dl
xor dl, 0x33
neg dl
xor dl, al
add dl, al
pop ecx
add eax, 0x960c199c
jb 0xc39314
lea edx, [edx + ecx*2 - 0x29395a36]
dec ecx
mov eax, ecx
xor edx, 0x74321a88
sar al, 0xa6
ror edx, 2
btc ax, ax
not edx
xor ebx, edx
rol eax, 0x21
adc edi, edx
mov ecx, dword [eax + esi - 2]
lea edx, [eax + 0x2487529c]
mov eax, dword [ecx + eax*2 - 4]
mov dword [edx + esi - 0x2487529e], eax
shl dl, 0x41
jmp edi
sar cx, 0x45
mov eax, dword [ecx + ebp - 0x4b26fd08]
mov dword [esp + ecx - 0x4b26fd04], 0x951e0a3e
push ecx
btc edx, ecx
lea ebp, [ebp + edx*2 - 0x1411c]
xor eax, ebx
call fcn.0078506d
mov eax, 0xbc089baf
movsx ecx, ax
lea ecx, [eax + eax*2 - 0x684ea7c1]
movzx edx, byte [ebp]
add ebp, 1
bts eax, eax
or ax, ax
xor dl, bl
neg cl
sbb eax, eax
jb 0x882d46
Function at 0xcbca93
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sbb eax, 0xf93ec97f
btc edx, edx
sar word [esp + ecx - 0x649765b4], 0xcc
call fcn.0098ddf4

Function at 0xcbf6c3
Capabilities:
Encode data using xor

Disassembly:
adc byte [esp + eax - 0x4e49bb64], 0x3c
mov edx, dword [ebp + edx - 0x18c20000]
shr eax, 0x28
xor edx, ebx
xor al, al
shl eax, 0x46
movzx ecx, ax
lea edx, [edx + eax*4 + 0x4840a8ac]
bt ecx, 0x2d
ror edx, 2
dec edx
or eax, dword [esp + eax - 0x13924000]
add eax, 0x25199f07
xor edx, 0x38117b22
not dword [esp + ecx*8 - 0x20000]
not dword [esp + ecx*4 - 0x10000]
xor ebx, edx
or byte [esp + ecx - 0x3fff], ah
adc word [esp + ecx - 0x3ffe], 0xc61f
bt ax, 0x95
lea esi, [esi + ecx*4 - 0x10004]
setae al
mov dword [esi + ecx*4 - 0x10000], edx
jb 0xcf00d7
pop edx
jae fcn.007ab5dc
adc edx, ecx
mov ecx, eax
mov dword [esi + 4], edx
ror dword [esp + 4], cl
dec eax
mov ecx, dword [ebp]
xor ecx, ebx
call fcn.0077d094
rol al, 0xc1
xor ecx, 0x46b3173e
mov bl, 0x46
rol ecx, 3
mov dword [esp + edx - 0x18c2e555], eax
neg dl
imul ax
xor ebx, ecx
add edi, ecx
lea ebp, [ebp + edx*2 - 0x31840026]
shr dl, 0x65
je 0x870415
mov byte [edx], ch
pop ecx
add dword [ebp - 0x68], ebx
cmp ebx, dword [0x620d597a]
or dword [ecx + 0x7d12ea00], 0x898132
fiadd dword [ecx - 0x767e25ab]
add byte [edx + 0x1a], bl
insd dword es:[edi], dx
push ebx
jle 0xcbf6ca
iretd
Function at 0xcc1517
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not ecx
neg ecx
mul dl
shr al, 0xa7
shl eax, 0xd
not ecx
add ax, ax
xor ebx, ecx
add esi, ecx
btr eax, 0x24
imul edx
xor eax, 0x8d930232
jmp esi
bt edx, edx
jb 0x9a6079
mov dword [esp + ecx - 0x7fa79212], ecx
lea ebp, [ebp + ecx - 0x7fa79214]
mov dword [esp + ecx - 0x7fa79216], ecx
and dx, ax
xor cl, ch
pop ecx
sar cl, 0x27
not dx
mov word [ebp + ecx - 0x7fa79200], dx
mov ecx, dword [edi + ecx - 0x7fa79200]
mov eax, 0x3b13c2ba
movsx edx, al
shr edx, 0x49
lea edi, [eax + edi - 0x3b13c2b6]
adc eax, dword [esp + eax - 0x3b13c2ba]
shl dword [esp + edx - 0x7fffff], 0xe6
inc edx
xor ecx, ebx
mul edx
sar eax, 0x8d
pop eax
ror ecx, 3
bswap ecx
jmp 0xc8ecd9
Function at 0xcc5893
Capabilities:
Encode data using xor

Disassembly:
ror eax, 0x61
mov eax, dword [edi + edx*4 - 0x27b43b5c]
sbb cl, dl
jge 0xcc8dad
bswap ecx
cmovb ax, dx
lea ecx, [ecx + eax*4 + 0x22f86c87]
sub edx, edx
adc eax, eax
mul eax
xor ecx, 0x7f08efbf
xor ebx, ecx
call fcn.0089c78b
or edx, dword [eax - 0x36]
adc al, 0xb7
out 0x7a, eax
salc
jl 0x746190
jmp 0x74618b
adc al, 0x54
mov word [esi], ss
imul edi, dword [esi], 0xffffffd7
xlatb
dec esp
mov word [esi], ss
imul edi, dword [esp + ebx], 0x6c
mov word [esi], ss
imul ecx, edx, 0xffffffca
salc
jmp 0x5e0275bd
fld dword [esi]
mov cl, 0xe9
sbb eax, dword [eax]
xor byte [eax], al
mov eax, 0x19bc383
mov ecx, 0xeeb54824
imul eax, eax
lea edi, [edi + eax - 0x5bf2d50d]
lea edx, [ecx + 0x1b37c6b3]
jb 0x74614d
mov dword [edi + edx + 4], eax
adc dx, dx
mov eax, edx
or edx, eax
mov ecx, dword [edx + edi + 4]
sal al, 0xc6
or eax, eax
xor dword [esp + edx*2], 0xa0992b91
lea edi, [edi + edx*4 + 8]
and eax, edx
sar dword [esp + eax*4], 0x17
inc al
mov al, byte [edx + esi - 1]
xchg dword [esp + edx*4], edx
adc byte [esp + edx - 0x3e], dl
xor al, bl
btc edx, 0x3f
neg al
mov dword [esp], edx
sal dword [esp], 0x65
call fcn.009452bd
mov dword [0x57f3afb1], eax
sahf
imul edi, dword [eax + eax*2], 0
and byte [edi], dl
invalid
add cl, al
je 0x99c05c
add byte [ebp - 0x18], ah
jle 0x99bfcf
cli
jmp dword [ebx + 0x57f3afb1]
add byte [eax], ah
adc al, 0xa7
and bl, byte [esp + edx*8 + 0x7f]
bound edx, qword [esi + ecx*4]
cld
test dword [ecx], 0xcd193614
jecxz 0x99c048
jmp 0x99c064
push es
imul ebp, dword [ebp + 0x79], 0xfffffffc
push ebx
mov al, byte [0x6198a85d]
pop ebp
test al, 0x98
popal
cmpsd dword [esi], dword es:[edi]
jae 0x99c071
inc ebx
outsd dx, dword [esi]
push cs
jb 0x99c034
out 0x7a, al
xchg esp, eax
jp 0x99c007
mov ch, 0x79
and dh, byte [ebp + 0x24]
dec esp
mov word [esi - 0x5d], es
pushal
mov ah, 0x7f
xor edx, dword [ebx + 0x7805dc4c]
cmp byte [ecx - 0x15], bl
in eax, 0x6d
invalid
push edx
shr eax, cl
xchg dword [esp + edx - 0x80000000], edx
sub edx, edx
jns 0x99bff7
mov dl, byte [edi + 2]
and al, dl
mov edx, 0xa1aed801
ror edx, 0x89
not al
lea ecx, [edx - 0x1c415ee4]
mov dword [esp + edx*4 - 0x3435db0], 0x429891a0
mov word [edi + edx*2 - 0x1a1aed6], ax
pop ecx
sal edx, 0x1d
mov eax, dword [ecx + edi - 0x4298919e]
mov cl, byte [edx + edi - 0x7ffffffa]
neg edx
jo 0xcb6037
sar cl, 1
xor eax, ebx
push edx
sal word [esp + edx - 0x9ed0ed5], cl
xor eax, 0xdb0f4910
call fcn.00cb0266
Function at 0xccd3da
Capabilities:
Encode data using base64

Disassembly:
cwde
bswap edx
inc edx
bswap edx
and ecx, 0xafb7711e
rol cl, 0xa1
lea ecx, [ecx + ecx*2 - 0x2ec51868]
neg edx
shl ecx, 0x12
xor ebx, edx
add esi, edx
movzx edx, ax
shr eax, 0xda
mov al, byte [edi + eax*2 - 0x7a]
xor cl, 0x9b
xor dx, dx
bswap edx
lea edi, [ecx + edi - 0x6c100096]
neg cl
xor al, bl
bswap edx
bts cx, 0xc
shl edx, 0xd7
dec al
rol edx, cl
btc edx, 0x9e
dec ecx
xor al, 0x3c
sal ecx, 0xa2
sbb ecx, edx
not al
btr dx, cx
ror al, 1
bts ecx, edx
neg al
inc al
xor bl, al
push edx
lea eax, [esp + eax + 4]
add edx, 0x7e8e8d24
seta byte [esp + ecx - 0x7040418f]
neg ecx
mov ecx, dword [eax]
mov dword [ebp], ecx
pop ecx
jmp esi
cbw
mov word [eax + ebp - 0x479bfffc], cx
movzx cx, byte [ebp + eax - 0x479bfffc]
imul eax, eax
mov al, byte [ebp + 4]
rol dword [esp + 4], 0x8a
jb 0x920e43
mov dword [esp], 0x18bbc68c
or cl, al
mov edx, 0x9ba7ed12
not cl
inc dx
lea eax, [edx + edx*8 - 0x5cd030d8]
shl dword [esp + eax*2 - 0x382e49a3], 0x8e
mov word [eax + ebp - 0x1c1724cf], cx
call fcn.00c4ecda
mov eax, 0x9f23da06
mov eax, dword [ebp]
mov ecx, 0x2d02dc9d
lea edx, [esp + ecx*2 - 0x5a05b8fa]
mov dword [edx + ecx*2 - 0x5a05b93a], eax
movsx eax, cx
ror ecx, 0xc3
mov edx, dword [edi]
sar cl, 0x63
inc al
xor edx, ebx
btr eax, eax
jb 0x86cc22
call fcn.007378f4

Function at 0xcceef0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
bswap eax
rol ecx, 2
sub ecx, 0xa6a01f35
sar dl, 0x86
rol ax, 0x49
bswap ecx
or eax, 0x11b03a2f
rol dl, 0xe3
xchg dx, ax
ror ecx, 1
xor ebx, ecx
mul ax
cdq
rol dl, 0xe1
add edi, ecx
shr edx, 0x58
call fcn.007fffb6
call fcn.00c7720d
sub esi, 4
mov ecx, 0x523e650e
movsx edx, cl
lea eax, [edx*4 - 0x10c4d9dd]
mov eax, dword [esi + ecx - 0x523e650e]
xor cl, dh
ror cx, 0x8c
not dx
xor eax, ebx
neg cx
inc eax
not dl
lea ecx, [edx + edx - 0x78d63745]
btc ecx, ecx
not eax
not edx
shr ecx, 0x27
lea eax, [eax + ecx*2 - 0x42435a1d]
sal edx, cl
rol eax, 2
btc edx, 0x37
xor ecx, 0x509b8985
sbb eax, 0x8692638f
dec dl
inc ecx
ror eax, 1
and ecx, 0x2418642f
shr cx, cl
xor ebx, eax
lea ecx, [ecx + ecx*4 + 0x7e0bfd22]
sub edx, 0xa9a9b121
adc edi, eax
push edx
movsx eax, dx
mov dx, word [ebp + edx - 0x36f46fde]
btr cx, ax
mov cl, byte [ebp + eax*8 - 0x37eee]
setb al
call fcn.00ca3d8d
mov edx, 0x51a13b82
mov edx, dword [edx + ebp - 0x51a13b82]
mov ecx, 0x869c9e3f
lea ecx, [ecx + 0x529dd2a6]
add ebp, 4
bswap ecx
add ecx, 0x4bbffbb2
xor edx, ebx
lea ecx, [ecx*8 + 0xb961521]
sub edx, 0x7a144a0d
lea ecx, [ecx + 0x5f25b3a4]
shr ecx, cl
lea eax, [ecx*4 - 0x41e90180]
bswap edx
inc edx
btr ecx, 0xba
call fcn.00c52642
mov ecx, 0x1abf083d
mov eax, dword [ecx + esi - 0x1abf083d]
xor ecx, ecx
mov edx, dword [ecx + esi + 4]
neg cl
not eax
sbb ecx, ecx
not edx
shl cx, 0x8d
neg ecx
or eax, edx
lea edx, [ecx + ecx*2 - 0x58406b72]
sub edx, ecx
mov dword [esi + ecx*4 + 4], eax
mov eax, edx
or ecx, dword [ebp + ecx*2 - 4]
add ebp, 0xfffffffc
or edx, edx
xor ecx, ebx
jmp 0x909ed2
Function at 0xcd2722
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
add edi, eax
movsx eax, dx
xor cl, byte [esp + edx*2]
bt edx, 0xaf
pop edx
pop ecx
jae fcn.00754c95
mov edx, 0x8412df94
mov ecx, edx
mov dx, word [esi]
mov ax, word [esi + 2]
jmp 0x8f4381
xor eax, 0x31b7e327
shl dword [esp + 2], 0xad
ror edx, cl
ror eax, 2
rol word [esp + 1], 0xa2
inc cx
xor edx, edx
neg eax
ror word [esp + edx + 4], 0x6d
lea ecx, [ecx + ecx + 0x6104601d]
sbb eax, edx
sal ecx, cl
not ecx
ja 0x7a40f4
mov ecx, 0xad2c76a0
movzx ecx, byte [ebp]
mov edx, 0xbbb93682
xor cl, bl
jmp 0x90a056
mov ebp, esi
movzx ebx, dl
mov dword [esp + edx + 4], 0xf33d9596
jle 0x8246a5
neg eax
sub eax, 0xf681a833
shl edx, 0x1d
ror eax, 3
add edx, edx
lea edx, [edx + edx*8 - 0x1e67bae8]
xchg byte [esp + edx - 0x6198450f], dl
xor ebx, eax
pop edx
rol dword [esp + 8], 0x84
sbb ebp, 4
mov dword [ebp], eax
pop ecx
sub esi, 4
mov eax, ecx
mov eax, dword [esi]
xor eax, ebx
sar edx, 0xaa
ja 0x8c0c8a

Function at 0xcd5cf2
Capabilities:
Encode data using base64

Disassembly:
xor edx, 0xa00ec489
neg edx
not edx
bt ecx, eax
and eax, eax
xor edx, 0xfebddcb5
shl ecx, 0x4f
sub al, ch
call fcn.0085b1e7
push 0x64ffde41
call fcn.00c7a401
Function at 0xcd8388
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push edx
mov ecx, dword [ebp]
imul dx
dec ax
xor ecx, ebx
cdq
and al, 0x8f
ror ecx, 2
sal eax, 0x28
xor ax, 0x6c98
bswap ecx
cwde
rol ecx, 1
neg eax
cwde
sub ecx, edx
rol edx, 0xa4
rol eax, 0x61
xchg dword [esp + eax - 0x3cc7], edx
xor ebx, ecx
dec dword [esp + eax*2 - 0x79a0]
cbw
add edi, ecx
mov dword [esp + eax - 0xffd0], edi
ret 0xc
mov word [ecx], dx
not ax
movsx ecx, byte [esp + 8]
mov edx, dword [esp + 8]
sub ebp, 4
dec word [esp + 7]
jnp 0x8d0190

Function at 0xcd83a9
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea eax, [eax*2 - 0x50e9afd2]
sub eax, edx
not ecx
xor ebx, ecx
mov dword [esi + edx*2 - 0x8008], ecx
mov ecx, eax
imul ax, word [esp + edx - 0x3ffc]
movzx edx, byte [ebp + edx - 0x400d]
bt eax, eax
push eax
lea ebp, [ebp + eax - 0x71fa15ef]
sub byte [esp + ecx - 0x71fa11f9], ch
shl ecx, cl
call fcn.009b471d

Function at 0xcd89fd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea edx, [esp + 0x1c]
mov eax, ecx
push eax
cbw
mov eax, dword [edx]
xadd dword [esp], ecx
mov dword [esi - 4], eax
add ecx, 0x7b2f8996
jns 0x977c72
movzx ecx, al
not ecx
mov eax, dword [edi + eax*4 - 0x28cc0194]
setae byte [esp + 1]
add ecx, 0x8d060c3f
or byte [esp + 3], 0x8b
sbb edi, 0xfffffff8
btc ecx, ecx
or edx, eax
xor dword [esp], ecx
push ecx
lea eax, [ecx*4 - 0x69f7cdf2]
not edx
not cl
mov ecx, edx
cwde
movzx edx, byte [ebp + eax - 0x6173]
sar eax, 0xcb
not edx
call fcn.008fc07b
mov ecx, 0xc43cefbb
mov ecx, dword [ebp - 4]
mov eax, 0xf196f785
lea edx, [eax + 0x1c0b8193]
btc dx, dx
xor ecx, ebx
imul dx
bts ax, dx
or edx, edx
inc ecx
lea edx, [edx + 0x372b6e11]
xor dl, al
ror ecx, 2
sar ax, 0xa1
lea ecx, [ecx + edx - 0x67d99999]
ror al, 0xc5
adc dl, dh
bswap ecx
not edx
mul edx
inc edx
not ecx
xor ebx, ecx
push eax
sar byte [esp + eax*4 - 0x28cde995], 0xc1
adc esi, ecx
rol word [esp + eax*2 - 0x1466f4cc], 3
cbw
mov edx, dword [edi + eax*2 - 0x146600cc]
jb 0xc6cc2c
mov eax, 0x430e75b3
movsx edx, ax
mov dx, word [esi + edx - 0x75b3]
or ax, ax
movzx ecx, ax
mov cx, word [esi + ecx - 0x75b1]
lea eax, [eax*2 - 0x6b7342f1]
call fcn.007bda8e
mov ecx, 0xc1045809
jmp 0x7ddfa6

Function at 0xcda1a8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
neg al
pop ecx
sar edx, 0x52
adc al, 0x9e
lea edx, [edx + edx*4 + 0x5dacafb3]
xor bl, al
mov ecx, edx
add eax, esp
ror ecx, cl
not cl
mov edx, dword [eax + ecx - 0x78debba6]
lea edi, [edi + ecx - 0x78debbaa]
shl cl, 0x26
movzx eax, cx
bswap eax
mov dword [edi + ecx - 0x78debb80], edx
mov edx, ecx
mul dl
btc edx, ecx
jae fcn.00c9bff2
mov al, byte [0xfc1ecd38]
or cl, 0xcf
imul ebp, dword [ebp + 0x5100c9b7], 3
mov edi, 0x7f14fdb5
add edi, dword [ecx]
cmpsd dword [esi], dword es:[edi]
imul edx, esi, 0x6e2fbe87
add bh, al
sal bh, cl
jle 0xcda24d
add bh, al
ret 0x72e3
Function at 0xcdeba0
Capabilities:
Encode data using base64

Disassembly:
ror ax, 1
sub ax, dx
or dl, cl
neg ax
xor bx, ax
mov word [esi + edx - 0x21000fd], ax
xor edx, ecx
mov dword [esp], 0x96113709
movzx edx, byte [ebp - 7]
mov eax, ecx
neg cl
adc ebp, 0xfffffff8
xadd dword [esp], eax
sal eax, cl
jb 0x9c4698

Function at 0xce15e8
Capabilities:
Encode data using base64

Disassembly:
add dl, byte [esp + edx - 0xae0bbcf]
mov edx, dword [edi + edx*2 - 0x15c177d4]
mov ecx, 0x1d022a8a
rol al, 5
lea edi, [edi + ecx*2 - 0x3a04551c]
xor ax, 0x20b2
idiv cl
xor edx, ebx
neg al
xchg ch, al
xchg byte [esp + ecx*2 - 0x3a05770f], al
inc edx
xor edx, 0xde0ed6a4
and ecx, 0x210974b8
cwde
inc edx
mov dword [esp + ecx - 0x1003088], 0x90bd030e
xor edx, 0xd489e7bb
sal eax, cl
inc ecx
and al, 0x16
rol edx, 2
sal cx, cl
adc ecx, ecx
jno 0x751c2b
mov edx, 0x34027013
movzx edi, dl
mov ecx, 0x1b1c772f
movzx ecx, byte [ebp + edx*2 - 0x6804e026]
push edx
call fcn.008ef8b4
mov ecx, 0xeb0f503a
neg ecx
movzx eax, cl
mov edx, dword [ecx + esi - 0x14f0afc6]
call fcn.0092ec4c
not al
lea esi, [esi + edx*8 - 0x5705deb8]
ja 0x879740

Function at 0xce6b1b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea ebp, [ebp + edx - 0xfffffe]
and byte [esp + edx*2 - 0x1fffffb], 0x3f
sub dword [esp + edx*4 - 0x3fffffe], edx
add dx, dx
adc al, cl
or edx, edx
pop ecx
and edx, dword [esp + edx - 0xfffffd]
mov word [ebp + edx], ax
jno 0xcd3de7
xchg ebx, eax
retf
mov dword [esp + edx - 0x40000001], edx
movzx ax, byte [edx + ebp - 0x40000001]
shl dword [esp + edx - 0x40000001], 0xe4
shl edx, 0x18
sar dl, 0x21
mov cl, byte [ebp + edx*2 - 0x1fffffe]
inc byte [esp + edx - 0xfffff7]
jae 0x82995b

Function at 0xceb240
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp], 0xb52ce77c
call fcn.00912a97

Function at 0xcec12b
Capabilities:
Encode data using xor

Disassembly:
inc esp
movsx eax, dx
movzx ecx, bl
inc ecx
inc edx
inc ecx
shl esi, 0xd0
inc ecx
not edx
mov eax, 0xd9009fae
inc ecx
sbb edx, 0x9a8c7d86
dec eax
cdq
cwde
inc ecx
bswap edx
dec eax
mov dword [esp + edx*2], 0x601c1102
dec esp
mov dword [esp + edx], ecx
inc esp
xor dword [esp + edx], edx
inc ecx
pop ecx
dec ebp
arpl dx, dx
dec eax
sub ecx, 0xfa146333
sal eax, cl
dec ecx
add ebp, edx
dec esi
lea esi, [ebp*2 - 0x5f6f4eca]
dec eax
mov eax, dword [edx + esi]
dec esp
mov esi, dword [esi + edx + 8]
dec eax
lea esi, [esi + edx + 0x10]
not edx
call fcn.007ff1ab

Function at 0xced0e5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
shr al, 0xa7
mul eax
lea edi, [edi + ecx*2 - 0xa]
pop eax
pop eax
pop eax
pop eax
jb fcn.0087275e
bts eax, 0xb5
add edx, esp
mov byte [edx], cl
mov edx, eax
movzx ecx, dl
jmp edi

Function at 0xcee9c1
Capabilities:
Encode data using xor

Disassembly:
push 0xf39f6990
xor ebx, edx
mov dword [esp + 8], 0xf3bf3c9c
call fcn.00764b18
dec dword [esp + 0xc]
shr dword [esp + 0xc], 0x6d
sbb edx, 0xfd83549c
jmp 0x7bf167

Function at 0xcef59f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
push 0xfe9c42ab
push 0x639d6997
lea esp, [esp + 0x14]
je 0x86bf6c