joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d243c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5d24de
cmp dword [ebx + 0xac], 0
jne 0x5d24d8
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5d2378
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5d24d8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5d249e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5d24d8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004abfe0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5d24ad
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5d271c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x626728]
cmp dword [eax + 0x188], 0
je 0x5d2896
test bl, bl
jne 0x5d27e1
cmp dword [esi + 0xb4], 0
jne 0x5d27d6
mov eax, esi
call fcn.005d56e0
push eax
push 0x5d2610
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5d27a7
mov eax, dword [0x626728]
cmp byte [eax + 0xeb], 0
je 0x5d27a7
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5d2788
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d27a7
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d2790
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d27d6
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004abfe0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d27b6
inc dword [esi + 0xb4]
jmp 0x5d2896
cmp dword [esi + 0xb4], 0
jle 0x5d2896
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5d2896
cmp dword [esi + 0x58], 0
je 0x5d284b
mov eax, dword [0x626728]
cmp byte [eax + 0xeb], 0
je 0x5d284b
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5d282c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d284b
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d2834
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d287a
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004abfe0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d285a
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5c43ac]
call fcn.0040b3d0
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5d34f0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5d354d
cmp byte [ebx + 0xeb], 0
jne 0x5d354d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409478
mov eax, dword [esi]
test eax, eax
je 0x5d353a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5d355a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.004096d0
jmp 0x5d355a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.004096d0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5d4e0c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5d4e7d
mov eax, esi
call fcn.0052a2b0
test al, al
je 0x5d4e7d
mov eax, dword [ebx + 0x98]
call fcn.00529ee0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5d4e7d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x114]
test al, al
je 0x5d4e6e
push 0
mov eax, dword [ebx + 0x98]
call fcn.00529ee0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.00520bd8
jmp 0x5d4e7d
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005d4c44
pop esi
pop ebx
ret
Function at 0x5d9764
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5d97de
mov eax, dword [ebx + 8]
call fcn.00529ee0
mov ecx, eax
mov dl, 1
mov eax, dword [0x536174]
call fcn.005242a0
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.0053a928
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5d905c
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00529ee0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00529ee0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5d9854
mov eax, dword [ebx + 8]
call fcn.00529ee0
mov ecx, eax
mov dl, 1
mov eax, dword [0x536174]
call fcn.005242a0
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.0053a928
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5d90a8
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00529ee0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00529ee0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5d98c0
mov eax, dword [ebx + 8]
call fcn.00529ee0
mov ecx, eax
mov dl, 1
mov eax, dword [0x536be8]
call fcn.005242a0
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x290], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.00529ee0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.00529ee0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x100058a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0xfe
and eax, 0xff
push esi
cdq
idiv ecx
xor esi, esi
inc dl
cmp dword [esp + 0xc], esi
jle 0x100058a2
mov eax, dword [esp + 8]
mov cl, dl
add eax, esi
xor cl, byte [eax]
add cl, dl
inc esi
cmp esi, dword [esp + 0xc]
mov byte [eax], cl
jl 0x1000588d
pop esi
ret

Function at 0x1000a63d
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push 1
xor edi, edi
pop eax
cmp ebx, eax
jl 0x1000a588
cmp ebx, 8
jle 0x1000a58a
xor eax, eax
mov esi, dword [esp + 0x10]
push 0x10015d90
push eax
push esi
call fcn.1000910f
lea ecx, [esi + 0x6af68]
lea eax, [esi + 0x6af70]
add esp, 0xc
cmp dword [ecx], edi
mov dword [eax], edi
jne 0x1000a5bb
mov dword [eax], 1
mov dword [ecx], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af68]
push edi
push eax
mov dword [esi + 0x6af64], edi
call fcn.1000ccec
mov eax, ebx
add esp, 0xc
shl eax, 3
cmp ebx, 2
movzx ecx, word [eax + 0x1000fc2a]
mov dword [esi + 0x6af90], ecx
movzx ecx, word [eax + 0x1000fc28]
mov dword [esi + 0x6af94], ecx
movzx ecx, word [eax + 0x1000fc2c]
mov dword [esi + 0x6af98], ecx
movzx eax, word [eax + 0x1000fc2e]
mov dword [esi + 0x6af8c], eax
jg 0x1000a61d
mov eax, dword [esp + 0x18]
or byte [eax], 4
jmp 0x1000a629
cmp ebx, 8
jl 0x1000a629
mov eax, dword [esp + 0x18]
or byte [eax], 2
lea ebx, [esi + 0x1af68]
push 0x10000
push ebx
push esi
mov dword [esi + 0x6af7c], edi
mov dword [esi + 0x6af6c], edi
call dword [esi + 9]
add esp, 0xc
cmp eax, edi
mov dword [esi + 0x6af88], eax
je 0x1000a699
cmp eax, 0xffffffff
je 0x1000a699
cmp eax, 0x106
mov dword [esi + 0x6af84], edi
jae 0x1000a66b
push esi
call fcn.1000a870
pop ecx
mov dword [esi + 0x6af74], edi
movzx eax, byte [ebx + edi]
mov ecx, dword [esi + 0x6af74]
and eax, 0x7fff
and ecx, 0x3ff
shl ecx, 5
xor eax, ecx
inc edi
cmp edi, 2
mov dword [esi + 0x6af74], eax
jb 0x1000a671
jmp 0x1000a6a9
mov dword [esi + 0x6af84], 1
mov dword [esi + 0x6af88], edi
pop edi
pop esi
pop ebx
ret
Function at 0x1000a9ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
xor edi, edi
mov eax, dword [esi + 0x6af88]
mov dword [esi + 0x6af78], 2
test eax, eax
je 0x1000abb5
push ebx
mov ebx, 0x7fff
cmp eax, 3
jb 0x1000aa13
mov ecx, dword [esi + 0x6af7c]
mov edx, dword [esi + 0x6af74]
and edx, 0x3ff
movzx eax, byte [ecx + esi + 0x1af6a]
and eax, ebx
shl edx, 5
xor eax, edx
and ecx, ebx
mov dword [esi + 0x6af74], eax
mov ebp, dword [esi + eax*4 + 0x4af68]
mov dword [esi + ecx*4 + 0x2af68], ebp
mov eax, dword [esi + 0x6af74]
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af68], ecx
test ebp, ebp
je 0x1000aa4f
mov eax, dword [esi + 0x6af7c]
sub eax, ebp
cmp eax, 0x7efa
ja 0x1000aa4f
mov ecx, dword [esi + 0x6af88]
lea eax, [esi + 0x6af98]
cmp dword [eax], ecx
jbe 0x1000aa38
mov dword [eax], ecx
push ebp
push esi
call fcn.1000a6ad
mov edi, eax
mov eax, dword [esi + 0x6af88]
pop ecx
cmp edi, eax
pop ecx
jbe 0x1000aa4f
mov edi, eax
cmp edi, 3
jb 0x1000ab2c
lea eax, [edi - 3]
push eax
mov eax, dword [esi + 0x6af7c]
sub eax, dword [esi + 0x6af80]
push eax
push esi
call fcn.10009ee1
sub dword [esi + 0x6af88], edi
add esp, 0xc
cmp edi, dword [esi + 0x6af90]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6af88]
ja 0x1000aae5
cmp eax, 3
jb 0x1000aae5
dec edi
inc dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af7c]
mov edx, dword [esi + 0x6af74]
movzx eax, byte [esi + ecx + 0x1af6a]
and edx, 0x3ff
and eax, ebx
shl edx, 5
xor eax, edx
and ecx, ebx
mov dword [esi + 0x6af74], eax
dec edi
mov ebp, dword [esi + eax*4 + 0x4af68]
mov dword [esi + ecx*4 + 0x2af68], ebp
mov eax, dword [esi + 0x6af74]
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af68], ecx
jne 0x1000aa90
jmp 0x1000ab50
add dword [esi + 0x6af7c], edi
mov eax, dword [esi + 0x6af7c]
lea edx, [esi + 0x6af74]
push 0x10015dec
lea ecx, [eax + esi]
push 1
push esi
xor edi, edi
movzx eax, byte [ecx + 0x1af68]
mov dword [edx], eax
and eax, 0x3ff
movzx ecx, byte [ecx + 0x1af69]
and ecx, ebx
shl eax, 5
xor ecx, eax
mov dword [edx], ecx
call fcn.1000910f
add esp, 0xc
jmp 0x1000ab56
mov eax, dword [esi + 0x6af7c]
movzx eax, byte [eax + esi + 0x1af68]
push eax
push 0
push esi
call fcn.10009ee1
add esp, 0xc
dec dword [esi + 0x6af88]
mov dword [esp + 0x14], eax
inc dword [esi + 0x6af7c]
cmp dword [esp + 0x14], 0
je 0x1000ab93
mov eax, dword [esi + 0x6af6c]
test eax, eax
jl 0x1000ab70
lea ecx, [eax + esi + 0x1af68]
jmp 0x1000ab72
xor ecx, ecx
mov edx, dword [esi + 0x6af7c]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.10009cd9
mov eax, dword [esi + 0x6af7c]
add esp, 0x10
mov dword [esi + 0x6af6c], eax
cmp dword [esi + 0x6af88], 0x106
jae 0x1000aba6
push esi
call fcn.1000a870
pop ecx
mov eax, dword [esi + 0x6af88]
test eax, eax
jne 0x1000a9c4
pop ebx
mov eax, dword [esi + 0x6af6c]
test eax, eax
jl 0x1000abc8
lea ecx, [eax + esi + 0x1af68]
jmp 0x1000abca
xor ecx, ecx
mov edx, dword [esi + 0x6af7c]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.10009cd9
add esp, 0x10
pop edi
pop esi
pop ebp
ret
Function at 0x1000b70d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1000b71b
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x1000b7fc
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x1000fc78]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x1000fc78]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x1000fc78]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x1000fc78]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x1000fc78]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x1000fc78]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x1000fc78]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x1000fc78]
xor eax, esi
inc edx
dec edi
jne 0x1000b738
pop ebx
cmp dword [ebp + 0x10], 0
je 0x1000b81d
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x1000fc78]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x1000b802
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x1000b823
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x1000fc78]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x1000fc78]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x10028891
Capabilities:
Hash data with crc32

Disassembly:
push edi
xchg dword [esp + 0x10], edi
movzx di, al
mov edi, 0x1000b7d7
pushal
jmp 0x1002e9a6
mov edi, dword [edi + 0x1b959]
call fcn.10022dfe
Function at 0x1003a2f3
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
cmp cl, 1
test eax, eax
push esp
jmp 0x10045168
test bh, ch
pushal
sub esp, 0xffffffe0
jb 0x10040b41
test edx, edx
call fcn.1004519c
push 0x2e8d5bb1
call fcn.1003fd74
jnp 0x10040b5e
in eax, dx
ret
or dword ds:[eax - 0x41], 0x72
popfd
imul edx, dword [ebx + 0xc], 0xffffffae
mov eax, dword [0xed3cf55b]
aaa
fld st(5)
movsb byte es:[edi], byte [esi]
cmp al, 0xd5
dec eax
mov ecx, 0xe9d4652
mov eax, 0x1a0fbb2c
cmp al, 0x3d
clc
scasb al, byte es:[edi]
or eax, 0xe20976cc
test ebx, esp
invalid
push dword [esp + 8]
mov word [esp], dx
lea esp, [esp + 0x10]
je 0x10041ff6
test cl, dl
rol esi, cl
mov esi, dword [eax + 0x3c]
shld edx, eax, cl
bt si, sp
cmc
movzx edx, dl
add esi, eax
bsf dx, dx
sbb dl, cl
mov edx, dword [esi + 0x78]
jmp 0x1003a609

Function at 0x1003a900
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x5c]
ja 0x1003fd8d
push 0xe9d8d046
lea esp, [esp + 4]
jb 0x1003e220
pushfd
bt bp, di
bt edi, 0x12
cmp byte [edi - 1], 0
mov byte [esp], 0xa6
lea esp, [esp + 4]
jne 0x1003d127
clc
pushal
lea edi, [edx - 0x552addcd]
mov edi, dword [edx + 0x24]
mov byte [esp], cl
mov byte [esp], 0x9e
pushal
mov dword [esp + 4], 0x1998bbce
add edi, eax
call fcn.1004280c

Function at 0x1003b2b7
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jne 0x10041ff6
shld esi, esp, cl
inc ch
shl ch, cl
ror ch, cl
mov ecx, edi
adc si, si
sar esi, cl
call fcn.10040628

Function at 0x1003b81d
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x2c]
ja 0x1003bbe6
sal al, 7
add al, 0x1c
pushal
sub ebx, edi
pushfd
rcl al, cl
bswap di
add al, al
lea esp, [esp + 0x24]
add ebx, esp
btc di, 0xf
movsx edi, dl
movzx di, al
test dx, 0x7e2b
mov edi, ebx
mov al, ah
rol al, cl
add al, cl
stc
mov al, 0x2e
clc
repne scasb al, byte es:[edi]
pushal
pushfd
lea esp, [esp + 0x24]
jne 0x1003de75
setl ah
mov byte [edi - 1], 0
pushal
mov dword [esp + 0x1c], ebx
pop eax
lea eax, [0x1003ac01]
call fcn.1004494e
ror bl, 3
rol bx, 0xe
stc
mov ebx, eax
clc
pushfd
mov byte [esp], dh
cmp byte [edi], 0x23
pushfd
lea esp, [esp + 8]
jne 0x1003b1a2
push 0x6c556cec
lea esp, [esp + 4]
jmp 0x1003bc38

Function at 0x1003bc07
Capabilities:
Encode data using base64

Disassembly:
mov word [esp + 4], 0x9e13
lea esp, [esp + 0x30]
ja 0x1003fd8d
call fcn.1003f151
rcr bx, 0xe
mov ebx, eax
pushal
mov byte [esp + 4], 0xe3
pushal
cmp byte [edi], 0x23
pushfd
lea esp, [esp + 0x44]
jne 0x1003b1a2

Function at 0x1003be6d
Capabilities:
Encode data using base64

Disassembly:
bt esi, ebp
xor al, al
mov word [esp], 0xb4e7
cmc
jmp 0x1003b570
Function at 0x1003c527
Capabilities:
Encode data using base64

Disassembly:
push dword [esp + 0xc]
pushal
lea esp, [esp + 0x3c]
jne 0x10041ff6
cmc
bt edx, 4
xadd cx, si
mov si, 0x3b01
mov ecx, edi
sar si, 7
or si, 0x607c
sub ecx, ebx
neg si
rcr esi, 0xb
add si, sp
mov esi, esp
clc
stc
pushal
sub edi, 4
clc
pushfd
clc
stc
push dword [edi]
pop dword [esp + 0x20]
lea esp, [esp + 0x20]
js 0x1003c6f4
test ebx, 0x9f557ae0
pushal
stc
cmp edi, ebx
push dword [esp]
pushfd
lea esp, [esp + 0x28]
ja 0x1003bbe6
and al, 0x74
sub ebx, edi
shrd di, di, 1
add ebx, esp
mov di, ax
mov edi, ebx
sub al, cl
pushal
rcl al, cl
cmp si, 0xf102
mov al, 0x2e
cmc
mov dword [esp + 8], ecx
repne scasb al, byte es:[edi]
mov word [esp], ax
pushal
mov byte [esp], 0x83
mov word [esp], 0xdd6c
lea esp, [esp + 0x40]
jne 0x1003de75
movsx ax, cl
not eax
pushal
setno ah
mov byte [edi - 1], 0
jmp 0x1003be43
jmp 0x1004009b
cmp al, bh

Function at 0x1003c673
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x104
pushal
bt bp, 2

Function at 0x1003cc45
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jae 0x10041ffe
cmc
movsx cx, al
mov ebx, eax
bswap cx
pushal
sbb cx, 0xfaeb
mov edi, eax
btc cx, si
bsr cx, di
jmp 0x1003e4b3
rcr cx, 0xb
mov ecx, 0x104
mov word [esp], 0x7329
test cl, 0xdd
stc
cmp edx, edi
xor al, al
lea esp, [esp + 0x20]
js 0x1004539f
cmc
repne scasb al, byte es:[edi]
pushal
lea esp, [esp + 0x20]
jne 0x10041ff6
bsr si, bp
xadd ecx, esi
rcl cl, 5
sal si, cl
mov ecx, edi
shl si, cl
clc
sub ecx, ebx
test bh, dh
movsx esi, al
test cl, 0xa6
and si, 0x25a5
mov esi, esp
stc
bt eax, eax
call fcn.10042e6e
pushfd
lea esp, [esp + 0x28]
jne 0x10041ff6
dec si
not si
xor ch, 0xa3
cmc
mov ecx, edi
shrd si, ax, cl
btr si, 0xc
call fcn.1003fec6
bt si, cx
test bh, 0x3f
cmp ah, 0xf6
stc
repne scasb al, byte es:[edi]
pushfd
pushal
jmp 0x1003fb9b
Function at 0x1003f151
Capabilities:
Encode data using base64

Disassembly:
cmp byte [edi - 1], 0
push 0xb9479fb
push dword [esp]
push dword [esp]
lea esp, [esp + 0xc]
jne 0x1003d127
shld di, di, cl
sub edi, 0x245ab7db
adc di, 0xbdf6
cmp di, 0x268e
mov edi, dword [edx + 0x24]
stc
add edi, eax
stc
stc
pushfd
push ecx
movzx ecx, word [edi + ecx*2]
stc
lea edi, [edi + 0x1ed92700]
btr di, bx
btr di, bx
mov edi, dword [edx + 0x1c]
mov byte [esp + 4], dh
add edi, eax
pushfd
mov edi, dword [edi + ecx*4]
bt dx, dx
clc
test edi, edi
jmp 0x1003ac22
lea esp, [esp + 0xc]
je 0x10041ff6
pushfd
add eax, edi
mov byte [esp], 0xde
pushal
cmc
cmp eax, edx
pushal
lea esp, [esp + 0x44]
jb 0x10041ffe
stc
clc
jmp 0x1003d717
stc
cmp eax, dword [ebp - 0x10]
pushfd
push edx
pushal
pushfd
lea esp, [esp + 0x2c]
jae 0x10041ffe
rcl cl, cl
movzx cx, dl
bt ax, 0xa
xadd cl, bl
mov ebx, eax
adc di, 0x3c8d
btc cx, di
shld di, si, cl
bsf cx, di
mov edi, eax
pushfd
not cl
or ecx, esp
rcr ch, 6
mov ecx, 0x104
clc
jmp 0x1003a68e
lea esp, [esp + 4]
jb 0x1003e220
jmp 0x1003a956

Function at 0x1003f176
Capabilities:
Encode data using base64

Disassembly:
call fcn.1003b56b
cmp byte [edi - 1], 0
mov byte [esp], dl
push 0x87566469
push dword [esp + 4]
lea esp, [esp + 0xc]
jne 0x1003d127
shrd di, bp, 1
mov edi, 0xfc71ac5a
xor di, 0x8b49
pushfd
mov edi, dword [edx + 0x24]
pushfd
mov word [esp + 4], 0xe6f1
add edi, eax
pushfd
movzx ecx, word [edi + ecx*2]
pop edi
mov edi, dword [edx + 0x1c]
bt sp, sp
add edi, eax
cmc
cmc
mov edi, dword [edi + ecx*4]
clc
test edi, edi
jmp 0x1003c3fa

Function at 0x1003fb7a
Capabilities:
Encode data using base64

Disassembly:
cmp al, byte [edi]
bswap ax
bswap ax
lea edi, [edi + 1]
movsx ax, cl
call fcn.1003f58a

Function at 0x1003fd74
Capabilities:
Encode data using base64

Disassembly:
test edx, edx
mov word [esp + 4], bx
pushal
push dword [esp]
jmp 0x1003b8d6

Function at 0x1004082d
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x54]
je 0x10041ff6
cmc
add eax, edi
stc
cmp eax, edx
call fcn.10043cfa
inc ecx
sub esi, edi
push ebx
ret
mov byte [esp], dl
add edi, eax
mov dword [esp], 0x8f446cd1
clc
mov edi, dword [edi + ecx*4]
test bh, bl
test edi, edi
jmp 0x10043e70
jmp 0x1003eedc

Function at 0x10040e03
Capabilities:
Encode data using base64

Disassembly:
push 0xf8f3da2a
movzx ecx, word [edi + ecx*2]
sal di, cl
sub di, sp
bsr edi, esi
push dword [esp]
mov edi, dword [edx + 0x1c]
pushfd
test cl, dh
call fcn.1004082d
lea esp, [esp + 0x14]
jb 0x10041ffe
test al, 0x7d
cmp eax, dword [ebp - 0x10]
jmp 0x1004508b
jmp 0x10040de3

Function at 0x100410a5
Capabilities:
Encode data using base64

Disassembly:
mov eax, edx
sub al, 0x9c
shl al, 4
bt di, di
add edi, 1
dec al
sub al, cl
mov al, byte [edi]
cmc
push 0x7179fe29
pushal
cmc
test al, al
jmp 0x1003c608

Function at 0x1004215c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0x28], 0x10043e95
push esp
call fcn.100440f4
lea esp, [esp + 8]
jae 0x10041ffe
shld bx, dx, cl
bsr ebx, eax
btc ebx, ebp
not di
mov ebx, eax
neg ch
mov edi, eax
mov ecx, 0xc32b9e4c
mov ecx, edx
setle cl
mov ecx, 0x104
jmp 0x1003aae0
Function at 0x1004280c
Capabilities:
Encode data using base64

Disassembly:
push 0xf8f3da2a
movzx ecx, word [edi + ecx*2]
sal di, cl
sub di, sp
bsr edi, esi
push dword [esp]
mov edi, dword [edx + 0x1c]
pushfd
test cl, dh
call fcn.1004082d
lea esp, [esp + 0x14]
jb 0x10041ffe
test al, 0x7d
cmp eax, dword [ebp - 0x10]
jmp 0x1004508b
jmp 0x10040de3

Function at 0x10043119
Capabilities:
Encode data using base64

Disassembly:
pushal
jmp 0x10040ad6
push 0xf4ae50b1
cmp eax, dword [ebp - 0x10]
jmp 0x1003c11a
lea esp, [esp + 0x24]
jae 0x10041ffe
sub ch, 0x6b
call fcn.1003f9d6
push ebx
aaa
or edi, dword [eax]
ret
lea esp, [esp + 0x10]
jb 0x10041ffe
test si, 0xc142
jl 0x1003f7e3
push 0x6e29fc72
mov word [esp], si
cmp eax, dword [ebp - 0x10]
jmp fcn.1003c6ec

Function at 0x1004334b
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 4], ecx
lea esp, [esp + 8]
jbe 0x10041ff6
movsx edi, dl
ror di, 0xb
rcl di, cl
sub ecx, 1
jmp 0x10041791

Function at 0x10043590
Capabilities:
Encode data using base64

Disassembly:
jmp 0x10043c95
pushfd
mov byte [esp + 8], dl
mov dword [esp], ebp
lea esp, [esp + 0xc]
ja 0x1003bbe6
and al, bh
sub ebx, edi
cmc
add al, dl
ror edi, cl
push 0x819b9b0b
sub esp, 0xfffffffc
add ebx, esp
add di, 0x7b14
mov edi, ebx
sal al, 2
mov al, 0x2e
bt bx, 5
clc
repne scasb al, byte es:[edi]
jmp 0x100419bf
jne 0x1003de75
not al
call fcn.1003c27a

Function at 0x100435ce
Capabilities:
Encode data using base64

Disassembly:
push esi
neg al
push edi
aaa
clc
aam 0xa
push ebx
cmc
sal eax, 0xb
push edx
ror ax, cl
pushfd
stc
mov eax, dword [ebp + 8]
call fcn.1003a2f3
adc ah, dh
push ebp
rcr al, 1
neg eax
neg al
mov ebp, esp
aad 0xf3
btc eax, 1
sub esp, 0x10
jmp 0x10043268

Function at 0x10043cfa
Capabilities:
Encode data using base64

Disassembly:
btc ecx, esi
lea esp, [esp + 4]
jb 0x10041ffe
clc
stc
call fcn.1003cc06
and al, 0x50
lodsb al, byte [esi]
add al, 0xc3
xchg ebp, eax
out dx, eax
aaa
jg 0x10043cc7
div dword [esi]
xor eax, 0x873a31e4
pop ecx
or byte [edx + 0x3a], ah
inc esi
imul edx, edx, 0x1462487
inc ebp
sahf
movsd dword es:[edi], dword [esi]
mov al, 0x9e
mov dl, ch
pushfd
aam 0x9d
push ebx
adc dl, dl
adc al, 0xd9
mov ch, 0x2a
ror byte [edx - 0x7583f728], 1
xlatb
mov al, 0x58
push 0xffffffffffffff84
loope 0x10043d4d
sti
test esi, ebp
push 0xffffffffffffffc4
stosb byte es:[edi], al
adc ebp, dword ds:[0xd26946cd]
adc ebp, dword [0xd26946cd]
xchg edi, eax
xor al, 0xc8
lahf
inc ebp
sahf
movsd dword es:[edi], dword [esi]
or ebp, edx
add al, 0x52
invalid

Function at 0x100441fb
Capabilities:
Encode data using base64

Disassembly:
ror al, 5
stc
cmp al, byte [edi]
call fcn.100434b6
test al, ah
sub al, 0xc4
jmp 0x1003cc0b