joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47170d
Capabilities:
Authenticate hmac

Disassembly:
jmp ebp
mov word [edi + edx*2], cx
shl dx, 2
mov ecx, edx
xor edx, ebp
jmp edx
mov ax, word [edi]
sar cx, 0x6d
neg cx
mov dword [esp], 0xcbaa0db9
adc edi, 1
add cl, cl
sbb ecx, 0x2d37a91a
xor dword [esp], ecx
movzx edx, byte [esi]
pop ecx
sub ecx, ecx
jae 0x494bfc
bt ecx, 7
sar eax, cl
lea esi, [esi + ecx*2 - 0xbe51c06]
jne 0x4c2f72
add ebp, 4
xor ecx, ebx
pop edx
movsx eax, dl
xor ecx, 0xb40ce50e
sub ecx, 0x84a9f1ac
call fcn.004939e1
sbb dl, 0x8e
xor eax, ebx
call fcn.004e4846
mov eax, 0x561a0cb5
cwde
movsx ecx, al
mov eax, dword [esi + eax - 0xcb5]
lea edx, [ecx*8 + 0x759d878b]
btc dx, dx
shl dx, 0x48
lea esi, [esi + edx - 0x759d3afc]
je 0x48439a
sar cx, 0x81
xor eax, ebx
neg cx
jge 0x4bc1af
call fcn.00467bfe
btc ecx, edx
rol eax, 2
bts cx, cx
shl dx, 0x6f
xor ebx, eax
bswap ecx
add ebp, eax
rol cx, 0x24
movzx ecx, byte [esi]
rol dl, 0xe1
adc esi, 1
movzx eax, dl
lea eax, [edx + edx*4 + 0x69839996]
xor cl, bl
shr dx, 1
or edx, 0xdb363a0d
lea edx, [edx + 0x70309391]
inc cl
shl edx, 0xca
xadd edx, eax
xor cl, 0x2e
ror eax, 0xa
neg cl
not cl
add cl, 0x3a
ror ax, 9
push eax
xor bl, cl
shl word [esp + eax - 0x26cf66], 0xaf
lea edi, [eax + edi - 0x26cf68]
shl dl, 0xe7
mov word [edi + eax*4 - 0x9b3d98], cx
movsx ecx, ax
pop edx
jb fcn.00425fbc
lea esi, [esi + ecx*4 + 1]
bswap ecx
xor dl, bl
sar cl, 2
shr cl, 0x22
inc dl
neg dl
rol dl, 1
sub ecx, 0xd9075c88
shl ecx, cl
shr ecx, 0x6a
sbb dl, 0x99
and ecx, 0x3cbb94a4
setno cl
xor bl, dl
btc cx, cx
not cl
adc edx, esp
mov byte [edx + ecx - 0x1a00fc], al
shr ecx, 0x6b
mov eax, 0x55800618
mov edx, dword [esi + ecx - 0x340]
push eax
lea esi, [ecx + esi - 0x33c]
xor edx, ebx
or ax, word [esp + ecx*2 - 0x67e]
bts ax, 0x8e
neg edx
xchg byte [esp + ecx - 0x33e], ah
xadd byte [esp + ecx - 0x33d], al
lea edx, [edx + ecx + 0x21aa0efb]
neg cx
not edx
seta cl
bts ecx, 0x94
xor edx, 0x761e4dbd
bswap edx
neg eax
rol cl, 7
inc dword [esp + ecx - 0x10fc00]
xor ebx, edx
xchg dword [esp + ecx*8 - 0x87e000], ecx
add dword [esp], eax
imul ecx, ecx
add ebp, edx
pop edx
jmp ebp
xor ax, dx
xor ebx, ecx
inc eax
pop eax
add ebp, ecx
sub eax, 0xfe35dead
cwd
jnp 0x426ad2
lea edx, [edx + edx*4 - 0x7f4e4768]
rol eax, 3
dec eax
or dx, 0x4307
lea edx, [edx*4 - 0x67793bd0]
bswap eax
or cx, dx
lea eax, [eax + edx - 0x3d6ad9a0]
jnp 0x4897c1
sbb ecx, 0x450a1a2d
xadd eax, ecx
mov word [esi + ecx - 0x17d8000], dx
mov edx, eax
jle 0x4ba930
xor eax, edx
btc dx, cx
xor ebx, eax
add ebp, eax
movsx eax, dx
cbw
mov edx, dword [edi]
movzx cx, byte [edx]
cdq
add edi, 2
idiv edx
imul eax, eax
jb 0x42812f
cwde
lea ecx, [edx + ecx + 0x8ebac69]
mul dword [esp]
jo 0x4a83ef
Function at 0x486384
Capabilities:
Authenticate hmac

Disassembly:
xor edx, ebx
rol edx, 1
not edx
mov dword [esp + ecx*2], 0x67a814b1
push eax
neg edx
push ecx
shr al, 0x44
sal ecx, 0x53
inc edx
call fcn.004a7607
mov edx, 0xa9b6de03
mov eax, dword [esi]
lea ecx, [edx + 0x40016f1c]
sub cl, cl
adc esi, 4
shl ecx, 0x9d
imul ecx, ecx
push ecx
xor eax, ebx
add word [esp + ecx + 1], cx
bt edx, 0xf
rol eax, 1
sar dword [esp + ecx], 0x5e
lea eax, [eax + edx + 0x275ad0ad]
or cx, 0x77b6
ror eax, 1
dec ecx
call fcn.004ab1bd
mov ecx, 0x92312293
bts ecx, ecx
mov eax, 0x97857da9
mov eax, dword [esi]
mov edx, ecx
adc ecx, ecx
inc cx
lea esi, [esi + ecx*2 - 0x48e48a4a]
sar cx, cl
or cl, dh
xor eax, ebx
ror edx, cl
inc eax
dec ecx
add edx, edx
not eax
ror edx, 0x14
inc ecx
dec dl
neg eax
imul dx, cx
sal edx, cl
rol cx, cl
lea eax, [eax + ecx*8 - 0x47134aea]
lea edx, [edx + ecx*2 + 0x7e200d8e]
shr edx, 0x78
xor ebx, eax
shr dl, 0x23
call fcn.0049aa13
mov eax, 0x5ea907bf
mov ecx, eax
lea ecx, [ecx + eax*2 - 0x60545378]
mov dx, word [ebp + eax - 0x5ea907bf]
bt eax, ecx
mov ax, word [ebp + eax - 0x5ea907bd]
bts ecx, 0x1e
or ecx, ecx
jo 0x488a50
mov cl, byte [ebp + 4]
call fcn.004e53af
Function at 0x48991b
Capabilities:
Encode data using base64

Disassembly:
not ecx
not ax
sub ax, 0x6914
and ecx, ecx
btr ecx, 0xb3
xor bx, ax
lea ebp, [edx + ebp - 0xd3866bd]
mov dword [esp + edx - 0xd3866bb], edx
mov word [edx + ebp - 0xd3866bb], ax
pop edx
lea esi, [esi + edx*2 - 0x1a70cd7a]
call fcn.004a6002

Function at 0x48c981
Capabilities:
Encode data using base64

Disassembly:
shr ecx, cl
inc cl
not dl
setp cl
xor ecx, ecx
adc ecx, 0x3bb5c78c
and al, dl
mov dword [esp + ecx*2 - 0x776b8f18], ecx
lea ecx, [ecx + ecx*4 + 0xf192a0e]
sar word [esp + ecx - 0x39a60fca], cl
mov word [ecx + esi - 0x39a60fca], ax
bt cx, cx
mov edx, dword [ebp + ecx*2 - 0x734c1f94]
rol dword [esp + ecx*2 - 0x734c1f94], 0xf2
lea ebp, [ebp + ecx*2 - 0x734c1f90]
movzx eax, cl
xor edx, ebx
rol eax, cl
setae al
lea ecx, [ecx + eax + 0x7266924]
dec edx
imul eax, dword [esp + eax*2 - 0x65002]
add eax, dword [esp + ecx - 0x40cfa0ef]
not ecx
ror edx, 1
shr al, 0xc5
jbe 0x4c4651
and word [esp + 1], cx
neg edx
cwde
sar eax, cl
setns cl
rol edx, 3
sar byte [esp + eax + 3], 0x47
sar al, 0x43
xor ebx, edx
btc eax, eax
or dword [esp + eax*2 - 2], eax
adc edi, edx
div al
inc ecx
mov dword [esp + eax*8 - 8], edi
ret
ror dl, cl
btr ecx, 0xa
xor dl, 0x3d
call fcn.00447f28
dec edx
push eax
div cl
bt ecx, eax
xor edx, 0x9197c323
btc eax, ecx
lea edx, [edx + ecx - 0x7543fe90]
push eax
neg edx
or dword [esp + eax*4 - 0x7fd], eax
cmova eax, dword [esp + eax - 0x1ff]
xor ebx, edx
not word [esp + eax - 0x1fffffd]
ror eax, cl
push eax
adc ebp, edx
or ax, word [eax + edi - 0x1010000]
add edi, 2
movzx edx, byte [esp + 2]
sar word [esp + edx + 8], 0xa2
sub esi, edx
mov dl, byte [esi + edx*2 - 2]
bswap ecx
sal ecx, 0x1d
xor word [esp + 2], cx
xor dl, bl
ror word [esp + 2], 0xc4
sbb cl, ch
adc cx, word [esp + 9]
xor dl, cl
xor cx, 0xceb9
shr dword [esp + 8], 0x7c
xor dl, 0x13
bswap ecx
add dl, 0x23
shr ecx, 0xaa
inc cx
jl 0x4a6c9f
Function at 0x48de9e
Capabilities:
Encode data using base64

Disassembly:
ror dword [esp + ecx - 0x74240400], 0x6b
lea esi, [esi + ecx - 0x74240402]
shr ecx, 0xe1
mov word [esi + ecx - 0x3a120200], dx
mov eax, ecx
ror dword [esp + ecx - 0x3a120200], 0xf
cwde
pop eax
jp fcn.0045365a
mov edx, 0x1e1b5691
lea edi, [edi + edx*2 - 0x3c36ad26]
rol edx, 0x9e
mov eax, dword [edi + edx - 0x4786d5a4]
jae 0x4b5866
or word [esp + ecx - 0x74240400], 0x4aae
jno 0x4720cf
mul eax
dec ecx
btc edx, 4
shr edx, 0x13
add eax, 0xecb7d30e
xor ebx, ecx
sal eax, 0x99
add edi, ecx
mov ebp, dword [ebp + edx*2]
jmp fcn.004c3252
xor bl, al
lea edx, [edx + ecx*2 - 0xf71e173]
bts dx, cx
sal dx, 0x2e
lea eax, [esp + eax + 4]
movzx dx, byte [eax + ecx - 0x74240400]
jne 0x42a98a
sub esi, 4
mov eax, dword [esi]
xor eax, ebx
mov edx, 0xcb25c4ae
bswap eax
mov ecx, edx
call fcn.004d6baf
call fcn.004afdcd
mov eax, 0xaa0a4e36
sal eax, 0xa8
lea esi, [esi + eax - 0xa4e3604]
mov ecx, dword [esi + eax - 0xa4e3600]
lea eax, [eax*4 + 0x3699f588]
xadd al, ah
xor ecx, ebx
lea eax, [eax + eax*4 + 0x223d8b99]
shl eax, 0x3d
mov edx, eax
dec ecx
btc edx, eax
bswap ecx
neg edx
sbb ecx, 0xdb0994b4
ror ecx, 1
bts edx, 0xb4
ror ax, 0xc3
inc al
xor ebx, ecx
add ebp, ecx
ror dx, 3
mov ecx, eax
mov dx, word [edi + eax - 0x40000001]
setae cl
mov ax, word [edi + ecx*2 - 0x7ffffffe]
dec cl
lea edi, [ecx + edi - 0x400000fd]
or dx, ax
mov eax, ecx
not dx
inc cx
bts eax, 0xa7
ror cl, 2
mov word [ecx + edi - 0x40000100], dx
dec cl
cwde
jmp ebp
bswap eax
lea ecx, [edx - 0x585683e1]
not eax
pop edx
ror ecx, 0xce
movsx edx, cx
neg eax
xor eax, 0x1b9d0b94
shl dl, 0x81
dec eax
not eax
bts edx, 7
sbb dx, cx
xor ebx, eax
add edi, eax
movzx eax, byte [ebp]
neg dx
adc ebp, 0
not dx
btc ecx, 0x32
xor al, bl
xadd cx, dx
inc cx
inc al
bswap ecx
neg al
ror ecx, cl
rol cx, 0xeb
sar cx, 0xce
xor al, 0x3d
add cx, cx
adc al, 0x2a
push edx
xor cl, byte [esp + ecx - 0x7424fffb]
sal cx, 0x8a
rol al, 1
jmp 0x4709ce
mov ecx, edx
sar edx, 0x58
xor eax, ebx
inc dl
neg edx
xor eax, 0x48083b2a
inc ecx
dec eax
rol ecx, 0x22
bswap eax
xor ecx, edx
ror eax, 3
shr ecx, 0xce
xor ebx, eax
shl dx, 0xe1
add ebp, eax
bt cx, cx
sbb edx, edx
lea edi, [edi + ecx*2 - 0x70f25]
bts ecx, edx
inc edx
mov eax, edx
mov dl, byte [edi + edx - 1]
sar al, 0x25
adc eax, 0x23a2dc97
xor dl, bl
ror ecx, 0xbe
sal cx, cl
cwde
neg dl
sub dl, 0x1c
shl ax, 0x4c
bts ax, cx
ror cx, 0xe5
neg dl
and al, 0x84
add cl, 8
call fcn.0047f557
lea esi, [edx + esi - 0x7ffffffc]
rol eax, 0xc4
sal edx, 0x42
add edx, edx
xor ecx, ebx
neg ax
lea edx, [edx + eax*4 + 0x3b38708d]
inc dx
bswap ecx
rol eax, 0x1c
sbb ecx, 0xa833b025
bswap ecx
neg ecx
push edx
not edx
push edx
not ecx
or al, 0xb1
sbb word [esp + eax*8 - 0x585], dx
jle 0x4e131d
Function at 0x49119a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp], edx
shr al, cl
movzx ecx, word [esp]
mov word [edi + ecx*4 - 0x12840], ax
sub dword [esp + ecx - 0x4a0c], ecx
sal edx, 0xc9
lea esi, [edx + esi - 0x62942004]
bts ecx, 0x9f
and cl, byte [esp + edx - 0x62941ffb]
mov ecx, dword [edx + esi - 0x62942000]
movzx eax, dx
xor dword [esp + edx - 0x62941fff], eax
dec word [esp + eax*2 - 0x4000]
xor ecx, ebx
pop eax
cdq
shl word [esp + 1], 0x27
sbb ecx, edx
sar al, 6
neg ecx
sal edx, 4
shl al, 0x41
sbb ecx, 0x850e843e
mul byte [esp]
and eax, 0x2bb8eb11
js 0x4e6a48
neg ecx
xadd dx, ax
xchg byte [esp + eax - 0x2990ffee], al
sar edx, 0x3f
sbb ecx, 0xc996a61d
sar ax, 0xf
bswap edx
idiv dx
rol ecx, 2
sal dword [esp + eax*2 - 0x53200002], 0xbe
sbb edx, eax
pop edx
xor ebx, ecx
add ebp, ecx
or edx, ebp
jmp edx
inc ecx
rol ecx, cl
mov byte [eax], dl
movsx eax, cl
movzx edx, cx
imul dx, cx
jmp edi
not ecx
xor ebx, ecx
add eax, 0xbe35b42b
mov dword [esp + eax*2 - 0x7a22de0], edx
lea ebp, [eax + ebp - 0x3d116f4]
mul eax
mul eax
mov dword [ebp + edx*4 - 0x783bbac], ecx
pop edx
pop edx
pop ecx
jb fcn.004e3209
mov eax, 0x8f34bf10
sub ebp, 4
mov edx, dword [ebp]
movsx ecx, ax
xor edx, ebx
imul ecx, ecx
sbb edx, 0xe18c0491
ror edx, 1
sar eax, 0x2f
and al, ah
lea edx, [edx + eax - 0x62736085]
rol edx, 1
cbw
inc cl
lea edx, [ecx + edx - 0x73857e8b]
cbw
ror ax, cl
bswap edx
not edx
sbb ecx, 0x6531f29c
xor ebx, edx
ror cx, cl
sub eax, eax
cbw
adc edi, edx
sal ecx, cl
add eax, dword [eax + esi]
movsx edx, cl
neg cl
not dl
mov dl, byte [edx + esi - 0xfb]
lea esi, [esi + ecx - 0x7b97fffa]
je 0x4bf760

Function at 0x49ca22
Capabilities:
Encode data using base64

Disassembly:
pop eax
add eax, 0x24e63
jmp eax
push edx
sbb eax, 0x362d1b10
lea edx, [edx + ecx - 0x50d28a55]
xor ebx, eax
sub esi, 4
not dl
inc ecx
mov dword [esi], eax
sete byte [esp + 2]
and dl, ch
sbb ebp, 4
not ecx
shr ecx, 0xa9
pop eax
mov ecx, dword [ecx + ebp - 0x57288]
xor ecx, ebx
inc eax
ror eax, 0xad
inc ecx
jmp 0x4b6d43
btc cx, cx
bswap edx
btc ecx, 0x9c
not edx
lea edx, [edx + eax + 0x58572209]
inc dword [esp + ecx - 0x615de685]
shl dword [esp + ecx - 0x615de685], cl
setp cl
xor ebx, edx
add edi, edx
inc eax
mov edx, dword [esp + ecx - 0x615de601]
mov edx, dword [esi + ecx - 0x615de601]
jp 0x41e585
mov cl, byte [esi + ecx - 0x615de5fd]
add esi, 6
not al
or dword [esp], eax
sbb eax, dword [esp]
mov byte ss:[edx], cl
pop eax
jmp edi
sub edx, 0xa9360c9b
shl eax, cl
js 0x4603d8
mov ecx, 0xe6087f1c
mov edx, 0xb8b4ca87
and dl, ch
sbb ebp, 4
ror ecx, cl
mov eax, dword [ebp + ecx - 0x6087f1ce]
shr edx, cl
xor eax, ebx
lea ecx, [edx*2 - 0x16267e3]
lea eax, [ecx + eax - 0x87eda1a]
bswap eax
sal ecx, cl
not edx
neg eax
neg dx
not eax
jne 0x435405
mov dword [esp], 0x2020d79f
not ecx
xor edx, ebx
shl eax, 0xe6
neg edx
jmp 0x48de50
neg ecx
neg eax
lea ecx, [ecx + edx - 0x3b9330be]
neg ecx
ror ecx, 3
push eax
call fcn.0042a9fb
Function at 0x49d92b
Capabilities:
Encode data using base64

Disassembly:
bswap edx
bt cx, cx
bswap ecx
sbb edx, 0xdb0994b5
ror edx, 1
xor ebx, edx
not ecx
or ecx, ecx
ror ecx, cl
add ebp, edx
mov cx, word [edi]
shl word [esp + 4], 0xa1
call fcn.004d2f7f
Function at 0x4ae695
Capabilities:
Encode data using base64

Disassembly:
sub ecx, 0x869fb28b
bt edx, eax
lea edx, [eax + edx*4 - 0xe6aac5]
sal dl, 0x86
xor ecx, 0x1898f307
add eax, eax
xor eax, 0x4f8d3a92
xadd dx, ax
dec ecx
ror ecx, 2
xor dx, 0xcf38
inc ecx
and byte [esp + eax - 0x4f8d35fd], 0x2c
xor ebx, ecx
add ebp, ecx
lea ecx, [eax*4 + 0x31124db3]
mov dword [esp + eax - 0x4f8d3600], ebp
ret
mov dword [esp + eax - 1], eax
not ecx
jne 0x47b595

Function at 0x4bd661
Capabilities:
Encode data using xor

Disassembly:
jl 0x44229f
adc ebp, 8
mov dword ss:[ecx], edx
mov edx, 0x8923b297
movsx ecx, dx
rol edx, 0xb1
lea esi, [edx + esi - 0x652f124b]
adc edx, ecx
btc cx, 0xac
mov ecx, dword [edx + esi - 0x652ec4df]
xor ecx, ebx
movsx eax, dl
call fcn.004916b7
shrd dx, ax, cl
pop ecx
mov word [esi + ecx - 0x75804197], dx
movsx edx, cx
lea ebp, [ebp + edx - 0x419b]
not dl
sal ecx, cl
or edx, ecx
mov ecx, dword [ebp]
bswap edx
sub edx, edx
xor ecx, ebx
lea eax, [edx*8 + 0xd2ecc35]
not dl
shl ax, 0xc3
rol ecx, 1
dec al
ror al, 7
ror eax, 0x4a
lea ecx, [ecx + eax*2 + 0x3a94777b]
sbb eax, edx
bswap ecx
add dx, dx
xchg dl, al
lea ecx, [ecx + edx*4 + 0x4a1344b6]
not eax
inc dx
mul edx
xor ebx, ecx
imul edx, edx
adc edi, ecx
shl dx, 0x67
not al
jmp edi
lea eax, [edx + edx*4 - 0x7b4cdb5e]
xchg dx, ax
add esi, 4
xor ecx, ebx
bt edx, edx
ror edx, 2
jae 0x454f5c
rol ecx, 3
dec eax
xadd eax, edx
neg ecx
bts eax, 0x9a
mul eax
lea ecx, [ecx + edx*2 - 0x41369626]
sub eax, 0x9e26f739
bswap ecx
not ecx
ror ecx, 3
div eax
rol al, 6
dec ecx
sub al, ah
xor ebx, ecx
bswap edx
add edi, ecx
mov ebp, dword [eax + ebp - 0x6f208fcb]
push edx
pop edx
jmp fcn.004c3252
mov dword [esp], 0x75804196
add esi, 4
inc dword [esp]
jge 0x4416ab
mov edx, 0xab0f9690
movzx ecx, dx
xor cl, cl
mov ecx, dword [ebp + ecx - 0x9600]
mov edx, dword [ebp + 4]
jns 0x417ed0
mov ecx, 0xee84f403
lea eax, [ecx*4 + 0x5227df1a]
lea edx, [ecx + 0x5580de85]
mov ecx, dword [esi + eax*4 - 0x30eebc98]
btc dx, ax
lea esi, [esi + eax*2 - 0x18775e48]
dec al
sbb ax, 0x9593
xor ecx, ebx
inc dl
lea ecx, [ecx + eax*8 + 0x7a585821]
jp 0x469d95
mov edx, 0xe1bce434
mov ecx, dword [esi]
jmp 0x449e41
Function at 0x4c7e98
Capabilities:
Authenticate hmac

Disassembly:
adc ebp, 6
shld edx, eax, cl
mov ecx, 0xb819abbc
ror cx, 0x84
mov dword [ebp], edx
movzx edx, cx
ror ecx, 0xea
setb dl
jmp edi
bswap ecx
sbb ecx, 0xdb0994b4
ror ecx, 1
xadd dx, ax
xor ebx, ecx
shr ax, 0xf
dec eax
inc edx
add ebp, ecx
lea edx, [edx + eax - 0x46641147]
jmp 0x4c7cb7
jmp 0x4d98a4
xor word [esp + 6], cx
call fcn.004d84a9
mov edx, 0x73057e00
movsx ecx, dl
sub ecx, edx
lea esi, [esi + edx - 0x73057e04]
xor dl, ch
jno 0x4c9d3b
mov ecx, dword [esi + edx - 0x73057e82]
mov eax, 0xc0838624
xor ecx, ebx
dec ecx
add eax, edx
sar eax, 0xfa
jp 0x4c0530
mov ecx, dword [esi]
mov eax, 0x87139c16
lea eax, [eax*2 + 0x68071ea5]
lea edx, [eax + eax*4 - 0x34caf367]
lea esi, [esi + edx*4 - 0x6872fab4]
cwde
bts dx, ax
xor ecx, ebx
bswap edx
sub edx, eax
ror ecx, 2
shr al, 0xa6
adc ax, 0x4a34
ror eax, 0x8e
sbb ecx, 0x849fa927
sar al, 0x21
not ecx
imul eax, edx
imul ax, dx
rol ecx, 1
xor ebx, ecx
cwd
add edi, ecx
cbw
mov edx, dword [ebp]
movsx ecx, al
dec ax
bswap ecx
mov eax, dword [ebp + 4]
shr cx, 0xad
shr ecx, 0x8d
mov cl, byte [ebp + ecx*4 - 0x1a3fd8]
jae 0x496d79
lea edx, [ecx + ecx*8 + 0x369f0e38]
shl edx, cl
sbb eax, 0x733a870a
not dx
neg eax
sub edx, edx
bts ecx, 0xa
sbb eax, 0xa2bd8526
btc ecx, ecx
neg eax
xor eax, 0xc48b3c1d
bswap eax
dec ecx
xor ebx, eax
call fcn.004d03f4
movzx edx, ax
js fcn.004a90e3
mov edx, ecx
add dword [esp], ecx
pop ecx
pop edx
jmp ebp
mov cx, word [edi + edx*2 - 0x5942da8e]
rol edx, 0xb7
lea edx, [edx + edx*8 - 0x2566b27a]
mul edx
mov ax, word [edi + eax - 0x651ddc12]
neg dx
adc edi, 1
sub edx, edx
dec edx
xor cx, dx
xor ax, dx
lea edx, [edx*4 - 0x6cc1e467]
btr edx, edx
ror edx, 0x2e
and cx, ax
call fcn.00495eaa

Function at 0x4c9fb2
Capabilities:
Encode data using base64

Disassembly:
ror dword [esp + 4], 0x15
mov word [ebp], dx
push eax
mov eax, dword [esi]
adc esi, 3
push 0x4ba9a632
mov edx, 0x4b9facb8
xor eax, ebx
neg dword [esp + edx - 0x4b9facb7]
bswap eax
or byte [esp + edx - 0x4b9facb1], dh
sub dword [esp + edx - 0x4b9facac], edx
lea eax, [edx + eax + 0x1386b0f2]
je 0x47ddec
ror eax, 1
and dl, dh
not eax
xor ebx, eax
call fcn.004de564
mov eax, 0xe4a6fe04
mov edx, eax
mov ecx, dword [ebp]
shl eax, 0x6b
not dl
lea ebp, [ebp + eax*2 - 0x6fe03ffc]
xor ecx, ebx
call fcn.0041f264
xor ecx, ebx
dec al
lea ecx, [ecx + eax*4 - 0x755b42a9]
mov dword [esp + eax - 0x3c3f3f16], 0x383dd23
push eax
jle 0x47a212
neg ecx
or dx, 0xa3bf
call fcn.00422b7f
Function at 0x4e09ba
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [eax + edx*8 + 0x4b8ec99c]
call fcn.004964b9
lea ebp, [ebp + ecx*2 + 2]
call fcn.00443bff
mov edx, 0x582a5718
mov ecx, 0xb602488a
mov eax, 0x91a91d0c
mov ecx, dword [esi + edx - 0x582a5718]
sal al, 0xc2
mul al
dec edx
mov edx, dword [esi + edx - 0x582a5713]
adc esi, 3
sal eax, 0x3d
btc eax, 0x1a
shr eax, 0x7b
add ecx, edx
mov dword [eax + esi], ecx
movzx edx, al
lea ebp, [ebp + eax - 4]
lea ecx, [eax*8 + 0x5002bc03]
shr eax, cl
or cl, ch
mov ecx, dword [ebp + eax]
xor ecx, ebx
push edx
not ecx
pop edx
call fcn.0041d45b
sub esi, 4
jmp 0x4a3f42
mov ecx, dword [esi]
mov edx, 0xba9c1191
lea eax, [edx*8 + 0x31aabb8a]
call fcn.0048ddbf
mov eax, dword [esi]
mov edx, 0x19347100
call fcn.00440399
mov eax, 0xb52fe938
mov ecx, 0xe690ceb9
call fcn.004b17e2
mov eax, 0xbf2f7811
mov edx, eax
sub esi, 4
jmp 0x41bb7b
add ecx, 0x5e226f9f
mov edx, 0x86318f8b
imul dx, dx
rol ecx, 2
lea ecx, [ecx + edx*2 - 0x3daec54b]
xor ecx, 0xf0a4141a
xor ebx, ecx
mov eax, edx
dec edx
add edi, ecx
dec dx
lea ecx, [edx + edx*8 + 0x5a848228]
mov dword [esp + ecx*2 - 0x248586aa], 0x1d0bd4a1
movzx ax, byte [ebp + ecx*4 - 0x490b0d5c]
not dl
and ecx, 0x58b059b2
sal cl, 0x61
mov dl, byte [ebp + ecx*4 - 0x4001048e]
xor ecx, 0x1a28483b
sar ecx, cl
jns 0x473ae3

Function at 0x4e6222
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x8f850c81
mov eax, dword [esi]
add esi, 4
xor eax, ebx
dec eax
sub ecx, 0xf43be18d
add cl, cl
xor eax, 0xa1b820af
mov dword [esp], ecx
movzx edx, word [esp]
neg eax
inc eax
neg word [esp + edx*4 - 0xab9f]
xor ebx, eax
and edx, 0xe4155d06
adc edi, eax
mov eax, dword [edx + ebp - 0x800]
lea ebp, [ebp + edx - 0x7fc]
neg edx
mov word [esp + 1], cx
mov dword [esp], eax
sub cl, 0x2d
popfd
ror dl, 0x65
shr cx, 0xec
js 0x46938a
jmp edi
Function at 0x401290
Capabilities:
Encode data using xor

Disassembly:
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401295
sub eax, edx
push esi
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.004073fe
add esp, 4
test eax, eax
jne 0x4012b3
pop esi
ret
push edi
mov edi, eax
mov ecx, ebx
sub edi, ebx
lea ebx, [ebx]
mov dl, byte [ecx]
mov byte [edi + ecx], dl
inc ecx
test dl, dl
jne 0x4012c0
xor ecx, ecx
pop edi
test esi, esi
je 0x4012da
xor byte [ecx + eax], 0x33
inc ecx
cmp ecx, esi
jb 0x4012d1
xor ecx, ecx
test esi, esi
je 0x4012e9
xor byte [ecx + eax], 0x88
inc ecx
cmp ecx, esi
jb 0x4012e0
pop esi
ret

Function at 0x401410
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
push edi
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x10
push edi
mov dword [ebp - 4], edi
call esi
cmp eax, 0x6f
je 0x40143e
pop edi
mov eax, str.Error
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ebx
push ecx
call fcn.004073fe
add esp, 4
lea edx, [ebp - 4]
push edx
mov ebx, eax
push ebx
push edi
push 0x10
push edi
mov dword [ebp - 0xc], ebx
call esi
cmp ebx, edi
je 0x4014e5
mov dword [ebp - 8], ebx
mov ebx, dword [sym.imp.WS2_32.dll_inet_ntoa]
lea esp, [esp]
mov eax, dword [ebp - 8]
cmp dword [eax + 0x44], 1
jne 0x4014d8
mov esi, dword [eax + 0x10]
test esi, esi
je 0x4014d8
mov eax, dword [esi + 0xc]
cmp word [eax], 2
jne 0x4014ce
mov eax, dword [eax + 4]
push eax
call ebx
mov edi, eax
push 0x2e
push edi
call fcn.004075e0
add esp, 8
test eax, eax
je 0x4014ce
mov ecx, 0x41f428
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4014c5
test dl, dl
je 0x4014c1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4014c5
add eax, 2
add ecx, 2
test dl, dl
jne 0x4014a5
xor eax, eax
jmp 0x4014ca
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4014ee
mov esi, dword [esi + 8]
test esi, esi
jne 0x401480
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
test eax, eax
jne 0x401470
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00406a50
add esp, 4
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401500
Capabilities:
Compare security identifiers
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x422690]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x124], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [ebp - 0x114]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401559
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406a41
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x114]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 2
push ecx
call edi
mov ebx, dword [ebp - 0x120]
push ebx
call fcn.004073fe
add esp, 4
lea edx, [ebp - 0x120]
push edx
push ebx
mov esi, eax
mov eax, dword [ebp - 0x114]
push esi
push 2
push eax
call edi
test eax, eax
jne 0x4015ca
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00406a50
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406a41
mov esp, ebp
pop ebp
ret
xor edi, edi
lea edx, [ebp - 0x11c]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x110], edi
mov word [ebp - 0x10c], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401645
cmp dword [esi], edi
jbe 0x401638
lea ebx, [esi + 4]
nop
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x11c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40162e
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x401610
jmp 0x401638
mov dword [ebp - 0x118], 1
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.00406a50
mov ecx, dword [ebp - 0x114]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x118], 0
je 0x401682
lea edi, [ebp - 0x108]
dec edi
jmp 0x401670
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401670
mov dx, word [0x41f3b4]
mov word [edi], dx
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
jmp 0x401690
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401690
sub eax, edx
inc eax
push eax
call fcn.004073fe
lea ecx, [ebp - 0x108]
mov esi, eax
mov edx, ecx
add esp, 4
sub esi, edx
nop
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x4016b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406a41
mov esp, ebp
pop ebp
ret