joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c3729
Capabilities:
Manually build aes constants

Disassembly:
push 0x4b9d7407
jmp 0x611637
lea esp, [esp + 0xc]
je 0x622e96
jmp 0x60c672

Function at 0x5c55fd
Capabilities:
Encode data using base64

Disassembly:
neg eax
shr cl, 0xe1
dec edx
or cx, cx
sbb eax, 0xe3332a3b
rol ecx, 0xc3
bswap eax
xor ebx, eax
neg edx
add ebp, eax
mov ax, word [ecx + esi]
call fcn.00652d2d
xor eax, ebx
not cl
lea eax, [eax + ecx + 0x608f5022]
dec cx
rol eax, 1
add edx, edx
shl dl, 0x41
dec eax
sal cx, 0xc2
rol edx, 0xdd
rol dword [esp + ecx*4 - 0x1efdc], cl
not eax
dec cx
bts cx, 0x27
sub edx, 0x889c71a6
xor ebx, eax
mov dword [esp + ecx*4 - 0x1efdc], ecx
imul dx, word [esp + edx - 0x776395d7]
rol ecx, 0xfc
add ebp, eax
movzx eax, dl
dec cx
sal eax, cl
pop eax
pop eax
jns fcn.0059f19a
mov eax, 0xde9b89b2
mov ecx, dword [esi]
call fcn.00607c97
call fcn.0057702c
mov ecx, 0x9da9a7a6
sub edi, 4
mov edx, ecx
mov eax, dword [edi]
bts edx, 0xad
rol dx, 0xcc
xor eax, ebx
and ecx, ecx
ror edx, cl
je 0x5aed88
rol eax, 2
or cx, dx
lea ecx, [edx*2 - 0x22e43570]
push ecx
inc eax
btc dx, dx
bswap eax
push ecx
not dx
lea eax, [eax + ecx - 0x7056995e]
mov byte [esp], 0x10
not eax
adc edx, 0x8613a31f
xor ebx, eax
dec edx
ror byte [esp + edx - 0x7089fb72], cl
adc ebp, eax
btc edx, edx
movzx eax, dl
cwde
mov ecx, dword [edx + esi - 0x7099fb74]
mov edx, dword [esi + edx - 0x7099fb70]
push eax
sbb eax, eax
lea esi, [esi + eax*2 + 8]
sar ax, 0x6f
mov dword ss:[eax + ecx], edx
and dword [esp + eax*4 + 6], eax
lea ecx, [eax + eax*2 + 0x6c2f42ad]
mov dword [esp + eax], ebp
ret 8
Function at 0x5c7c3a
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
inc eax
movsx eax, dh
bswap ebx
rol ebx, 1
inc esp
movzx esi, ax
movsx edi, ax
inc ecx
inc cl
sub ebx, 0xb7363d89
inc edx
mov dword [esp + ecx - 0x22], 0xeca75837
inc ecx
movsx ecx, si
inc edx
movzx edx, word [esp + ecx*4 - 0xad]
rol ebx, 3
dec eax
bswap edx
dec esp
mov dword [esp + esi - 0x73b43125], edi
call fcn.0057c25f
sbb edx, 0x12b0b92f
not eax
mov dword [esp], edx
js 0x61272b
ror si, 0xa1
dec edi
lea ebx, [ecx + ebx - 0x6220ebbe]
inc ebp
xor dh, bh
pop eax
movsx ebp, cx
jmp 0x60da3c
inc ecx
neg dh
inc dx
ror dword [esp + ecx - 0x6220ebab], 0x21
dec ecx
bts eax, eax
dec ecx
ror eax, 0x9f
inc ecx
sbb dh, 0x1d
inc edx
add cl, byte [esp + ecx - 0x6220ebae]
pop edx
rol bx, 0x25
inc ecx
ror dh, 1
ror si, 0xe
push cs
inc ecx
sar dl, 0x61
dec eax
sbb eax, 0x723efc0a
inc ecx
sbb dh, 0xbc
inc ecx
not dh
and dx, cx
btr esi, ebx
dec ecx
bswap eax
inc ecx
inc dh
inc ecx
xchg ecx, edx
inc ebp
add eax, edx
inc ecx
neg dh
inc ebp
xor bh, dh
mov edi, 0xeea1d002
dec eax
or edx, ecx
inc esp
and edx, edx
dec esp
adc esi, esp
dec edi
mov ecx, dword [esi + edx*4 - 0x3ae60]
dec edi
mov dword [edx + ebp - 0xeba8], ecx
inc eax
inc dh
dec esp
lea esi, [ecx + eax - 0xc6e2efa]
dec ecx
neg eax
dec edi
lea ebp, [ebp + edx - 0xeba8]
dec eax
inc ebp
dec eax
neg ecx
jb fcn.00656530
ja 0x60db01
in al, 0xb
scasb al, byte es:[edi]
sti
psubusb mm3, qword [eax]
xchg ebp, eax
stosd dword es:[edi], eax
loop 0x60da68
test byte [ecx + 0x706543fe], ah
dec esi
sub eax, 0x49bd9a0d
sub ebx, 4
push 0xdb99c203
mov esi, 0x73b4312d
push esi
inc ecx
mov ebx, dword [ebx + esi - 0x73b4312d]
inc ecx
xor ebx, edi
inc esp
movsx ecx, dh
ror esi, cl
dec ebx
mov word [ecx + 0x33], es
fild word [edi + ecx - 0x42]
into
jmp 0x588878
dec eax
dec ecx
xadd ecx, edx
ror eax, 1
xor ebx, eax
xadd cx, dx
and word [esp + ecx - 0x7e328e35], dx
adc ebp, eax
call fcn.005815ef
call int.00599ebb
or ah, 0x2c
and eax, eax
and bl, ah
cld
daa
push ebx
lcall 0x6667, 0x5327a083
mov cl, 0x94
daa
push ebx
xor bl, dh
adc eax, 0x99a2f46c
test byte [0x47d60e2d], bl
stc
sub dh, dl
push dword [edi + esi*4 - 0x3fd16610]
and al, 0x60
push esi
push edi
cli
jnp 0x61272d
cld
mov edi, 0x99fefb61
out 0xda, al
test ebx, edi
cdq
xor al, 0x6b
cmpsd dword [esi], dword es:[edi]
sar dh, cl
cdq
push cs
outsd dx, dword [esi]
xchg ebx, eax
sar dh, cl
cdq
or bh, byte [edi - 0x65]
sar dh, cl
cdq
jl 0x6127f5
invalid
popal
invalid

Function at 0x5c91ff
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
not edx
mov ecx, dword [edi + ecx - 0x18badb92]
mov dword [esp + eax - 0x92], edx
push edx
xor ecx, ebx
xor dword [esp + eax - 0x8f], 0x7aa75614
lea ecx, [eax + ecx + 0x608f6e8f]
jg 0x5961bd
mov eax, 0x3b89b22c
dec ebp
lea ebx, [ebx + eax*2 - 0x7713645c]
dec eax
or eax, eax
inc ebp
mov edx, dword [ebx + eax*2 - 0x77136458]
dec esp
lea ecx, [eax*8 - 0xf64c57a]
dec ecx
sbb eax, ecx
inc cx
sar ecx, 0x2f
inc ebp
xor edx, edi
inc ecx
mov ebp, ecx
inc ecx
neg edx
dec ecx
bts ecx, 0x3c
Function at 0x5c9ef9
Capabilities:
Encode data using xor

Disassembly:
setnp dl
push ebx
cpuid
call fcn.00603960
lea ecx, [esp + 0x3c]
mov dword [esp], edx
mov byte [ecx], al
lea eax, [edx*8 - 0x7c16bd6]
mov ecx, dword [edi + eax - 0x594a98f6]
mov dword [esp + eax - 0x594a98f2], eax
xor ecx, ebx
cdq
push eax
xor dword [esp + edx*2 + 4], edx
xor ecx, 0xd60d6d9b
mul eax
dec ecx
and edx, edx
bts edx, eax
cmovb dx, ax
xor ecx, 0xf03fd486
bts edx, eax
neg ecx
rol edx, 0x5e
jae 0x580b19
xor ebx, ecx
shl dword [esp + edx - 0x7c91131], 0x5f
not eax
neg word [esp + edx - 0x7c91130]
adc ebp, ecx
pop edx
movzx ecx, byte [edx + edi - 0x594a98f7]
btr edx, 1
and dl, 0x9d
lea edi, [edi + edx - 0x594a9895]
xor cl, bl
dec dx
or eax, dword [esp + edx - 0x594a988f]
dec cl
shr dword [esp + edx - 0x594a988f], 0x61
not word [esp + edx - 0x594a988f]
ror cl, 1
ror dl, 0xe6
imul edx
pop edx
neg cl
dec eax
idiv eax
sar eax, 0x1d
add cl, al
sar ax, 0x21
ror cl, 1
sub cl, al
ror edx, 0xc3
ror dx, 0x4e
idiv dl
xor cl, 0x33
xor bl, cl
mul dl
lea eax, [edx + eax*4 + 0x2cb572a0]
sbb al, 0x96
add ecx, esp
cdq
btr eax, 0x81
bt eax, eax
movzx ax, byte [ecx + edx*2]
lea ecx, [edx + edx*8 + 0x6accc9b]
xor cl, dl
sal edx, 0xca
mov word [esi + edx*4 + 2], ax
not edx
and dx, 0xa3a8
lea esi, [esi + ecx*8 - 0x356664d6]
jmp ebp

Function at 0x5ca88b
Capabilities:
Manually build aes constants

Disassembly:
xor edx, ebx
shl cx, 0xc5
lea edx, [edx + eax*2 + 0x220caf7a]
sbb ax, ax
dec eax
ror edx, 3
btr eax, 0xb6
neg cl
or al, 0x1b
dec edx
call fcn.0059badd
mov dword [edi + 8], 0
cmp cl, 0x2d
jb 0x62db86
push esi
xadd ax, ax
movzx esi, cl
bsf edx, ecx
mov eax, 0x6c16c16d
sub dx, si
mul esi
setbe ah
shr ax, 0x8e
mov eax, esi
sub eax, edx
rol esi, 0x12
shrd esi, edi, 0x3a
shr eax, 1
jmp 0x5983e7
lea eax, [eax + edx]
cmc
xadd esi, edx
inc si
shr eax, 5
bsf dx, sp
movzx eax, al
bt esi, eax
not si
mov edx, eax
pop esi
lea esp, [esp + 0xc]
jne 0x60c673
jmp 0x622e8b
mov ebx, 0x56a14c26
mov edx, 0x5792d22d
pop ebx
not ecx
mov dword [esi], ecx
sub edi, 4
mov ecx, 0xef803a9e
mov edx, dword [edi]
movsx eax, cx
dec ecx
jno 0x580f55

Function at 0x5d7092
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
mov eax, eax
ror edi, 1
bswap edi
inc ecx
movsx edx, cx
dec esi
mov dword [esp + ecx*2 - 0x30cc0eb6], edi
xor dword [esp + ebp - 0x7d8f44ae], edi
cdq
rol cl, 0x23
inc ecx
pop edi
call fcn.0064ad67
jb 0x580f77
mov eax, 1
ret

Function at 0x5d73d8
Capabilities:
Encode data using base64

Disassembly:
ror eax, 3
dec word [esp + edx - 0x7fffff00]
sal word [esp + edx - 0x7ffffeff], 0xad
xor ebx, eax
lea ecx, [ecx*8 + 0x4892f79f]
add dword [esp + ecx - 0x8d7379f], edx
add ebp, eax
rol dx, 0xa9
pop ecx
jae fcn.0059f19a
bswap edx
sar dl, 0xe2
not eax
mov dword [esp + edx - 0x7fffffff], ecx
seta dl
neg eax
btr ecx, 0x91
jb 0x5a8aa5
Function at 0x5d7b54
Capabilities:
Encode data using base64

Disassembly:
inc ecx
inc al
dec eax
mov dword [esp + ebx - 0x97b2], ebx
inc ecx
neg al
inc esp
xchg dl, dl
movzx esi, word [esp + ebx - 0x97b1]
dec esp
btc ebp, edx
inc ecx
adc al, 0x37
inc ecx
not al
inc ecx
movzx eax, dl
dec ecx
mul edx
inc ecx
inc al
inc ebp
xor bh, al
inc edx
xadd byte [esp + edx - 0x59], dl
dec eax
mov dword [esp + ebx*4 - 0x25ee8], eax
dec esi
lea eax, [esp + eax + 0x10]
inc ecx
mov byte [eax + ebx*2 - 0x12f74], bh
inc edi
mov dl, byte [ebx + esi - 0x5528684c]
inc cx
div esi
dec ebp
lea ebx, [ebx + ebx*4 - 0x25eee]
call fcn.005b81ca
or al, ah
jg 0x5d7bc3
inc ecx
xor al, 0x45
invalid
call ebp
xchg esi, eax
pushfd
inc ebp
invalid

Function at 0x5d83fd
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea ebx, [ebx + edx - 0x398fbd81]
call fcn.005d8e61
shl ebx, cl
Function at 0x5de14c
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + esi - 0x18228], 0x41a752a3
rol ax, 0xe1
rol cl, 1
sub cl, dl
dec eax
sar ebp, 8
call fcn.005a4427

Function at 0x5dfd44
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + ecx*4 - 0xeea0]
movzx ecx, byte [ecx + edi - 0x3baf]
mov edx, 0x722be3d
or word [esp + edx - 0x722be3c], 0xbc9f
shl dword [esp + edx*2 - 0xe457c7a], 0xf4
lea edi, [edi + edx*4 - 0x1c8af8f9]
xor cl, bl
call fcn.005cf22c
not eax
ror eax, 1
push edx
inc edx
inc byte [esp + ecx*8 + 0xa48d001]
inc si
xchg dword [esp + ecx + 0x1491a0b], edx
inc ecx
sub eax, edx
dec ecx
inc ecx
dec esi
mov dword [esp + ecx*2 + 0x292340a], edi
shr cl, 0x67
inc edx
xor dword [esp + ecx + 0x1491a0d], eax
neg cx
dec ecx
dec ecx
inc dx
xchg dword [esp + ecx + 0x1491a09], ebp
dec esi
mov edi, dword [esp + ecx*4 + 0x5246808]
inc ebx
mov dword [ebp + ecx*2 + 0x29233ee], eax
dec edx
mov dword [esp + ecx*2 + 0x292340c], 0x840ce5ab
call fcn.0062a134
inc ecx
mov edx, 0x53a1133b
call fcn.0059eb9b
ror edx, 2
xor edx, 0x463345b8
sar word [esp + eax*2 - 0x446ea848], 0x6d
xor ebx, edx
and eax, 0x6514d1b8
adc ebp, edx
mov ax, word [esi + eax*2 - 0x4028a03a]
xchg dword [esp], ecx
jmp 0x5c472a
dec edx
mov dword [esp + ecx*2 + 0x29233fc], 0xc5b89ea6
inc eax
neg eax
jmp 0x5cb306
Function at 0x5fce0c
Capabilities:
Encode data using base64

Disassembly:
or cl, dl
mov eax, dword [edi + ecx - 0x5ea66f8e]
ror ecx, 0xbb
add cx, cx
mov dword [esp + edx - 0x5ea66f8e], ecx
xor eax, ebx
inc eax
rol cl, 0xa6
not eax
jae 0x55f0c6
bt ecx, ecx
dec eax

Function at 0x5ff1ff
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
movzx edx, cx
neg byte [esp + edx - 0x129d]
neg byte [esp + edx - 0x129e]
inc eax
bt edx, 0xaa
adc edx, ecx
xor eax, 0x35b35192
pop edx
lea edx, [ecx + ecx - 0x6642a3e0]
rol cx, 0xac
rol eax, 2
add dx, cx
or word [esp], 0x33b4
not eax
pop edx
imul edx, ecx
xor eax, 0xdca2d989
call fcn.00628483
mov ecx, 0xfe901524
dec ecx
sub ebx, 4
inc ecx
mov ecx, 0xda61805
dec eax
lea eax, [ecx*4 + 0x7f279f1d]
inc ebx
mov ebx, dword [ebx + ecx*2 - 0x1b4c300a]
dec eax
dec eax
cbw
inc ecx
xor ebx, edi
movzx esi, al
inc si
not ebx
call fcn.005d6cdf
mov ecx, 0x629a8fa5
mov dx, word [esi + ecx - 0x629a8fa5]
movsx eax, cl
sal eax, cl
add ax, 0x3b04
lea esi, [esi + ecx - 0x629a8fa3]
not eax
jge 0x62081a
add cx, cx
lea edi, [edi + eax*2 - 0x1a0b7]
movzx eax, byte [edi + ecx - 0x629a1f4a]
bt cx, 0xad
neg cx
xor al, bl
push ecx
inc al
imul ecx, ecx
neg al
neg ecx
sar cx, 4
neg cx
dec al
xor al, 0x96
jmp 0x5a522e
Function at 0x603960
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov esi, 0xc29ab9b5
dec esp
lea esi, [esi*8 + 0x199bc397]
dec eax
shl esi, 0xd8
dec ecx
sbb ebx, 4
inc ebp
mov ecx, dword [ebx]
dec esi
lea eax, [esi*2 + 0xdbce81d]
mov ebx, esi
inc ebp
xor ecx, edi
inc ecx
neg ecx
inc ecx
shr dh, 0xa1
inc esi
lea ecx, [ebx + ecx - 0xaf622ec]
inc ecx
ror ecx, 3
inc ecx
not ecx
dec ecx
not esi
inc ecx
push edi
jmp fcn.005b89c1
dec ebp
lea ebx, [ebx + ecx*4 - 5]
jo 0x580aa8
dec ecx
shr esi, 0x62
cwde
inc ebp
xor dl, bh
cbw
inc ecx
not dl
dec esp
lea eax, [ecx + ebx - 0x5dd7a3ec]
dec eax
cdq
inc ecx
rol dl, 1
inc edi
inc sp
or eax, dword [esp + ecx*2 + 4]
dec edi
inc ecx
dec dl
inc esp
xadd dh, dh
inc ecx
xor dl, 0x84
inc ecx
not dl
inc ecx
rol dl, 1
inc edx
and dword [esp + eax + 0x5dd721c2], edx
inc ecx
adc dl, 0x8f
inc esp
add byte [esp + ecx + 7], al
mov byte [esp + ecx + 2], 0x25
dec ecx
inc esp
xor dl, cl
shr dword [esp + ebp*4 - 0x1b8c], cl
cwd
call fcn.00666feb
call fcn.00662987
jne 0x604ebc
mov edi, 0xc7b6350b
inc bp
movzx ecx, byte [ebp]
dec esp
lea eax, [edi + 0x3a3f1a1f]
dec ecx
lea edx, [eax + edi + 0x4b1ae39c]
inc sp
btc edi, eax
inc ecx
mov bl, byte [ebp + 2]
inc ecx
movsx ecx, al
inc ecx
movzx ebp, al
inc esp
and cl, bl
dec esp
lea esi, [edi + ecx*4 + 0xa2b8fb7]
inc edx
dec ecx
sal esi, 0x28
inc ecx
not cl
inc bp
mov dword [ebp + edx - 0x14c667d0], ecx
inc ecx
movzx eax, dh
mov ebx, ebp
inc ecx
mov edx, dword [ebx + edx*2 - 0x298ccfa8]
inc ecx
movsx esi, ax
dec eax
bts eax, 0x2d
inc ecx
xor edx, edi
push edi
lea edx, [edx + ebp*4 + 0xf06296c]
dec eax
sar ecx, 0x13
inc ecx
sar dh, 0x83
xor edx, 0x53b81eac
inc esp
mov edx, dword [esp + ecx]
idiv byte [esp + ecx*8 + 3]
lea edx, [edi + edx + 0x10805782]
inc sp
btr eax, esi
xor edx, 0xa530cf01
rol edx, 1
inc eax
div dh
dec eax
imul ebp, ebx
inc sp
or esi, dword [esp + ecx + 3]
bswap edx
xadd bx, ax
shl ecx, 0x37
inc ecx
inc edx
dec esp
mov dword [esp + ecx], edi
xor dword [esp + ecx*8], edx
dec eax
rol ecx, 0xa7
dec ecx
shl edx, 0x5a
inc ecx
pop edi
push ecx
inc cx
dec esi
inc ebp
movsx ecx, dl
dec eax
arpl dx, dx
inc cx
not edx
inc sp
sub dword [esp + ecx + 5], eax
dec esp
add esp, edx
inc eax
sar bh, 0x42
adc dword [esp + ecx*2], eax
inc ebp
movzx edx, byte [ebx + ecx - 5]
jns 0x5e2cdb
inc eax
adc bh, 0x24
dec eax
lea ecx, [eax*2 + 0x29313702]
jmp 0x653517
push ebp
inc esp
xor bh, bh
mul bl
dec eax
lea edi, [esp + edi + 8]
shl ebx, cl
call fcn.00622eb2
sbb ecx, dword [edi + 0x59]
mov ah, 0x3f
add eax, 0xc4523f16
cwde
cdq
add esp, dword [edi]
push edx
les ebx, [eax + 0x520b2ec9]
les ebx, [eax - 0x5ca58e03]
xor dword [0x58ba6f66], 0x85882999
imul eax, dword [edi + 0x4d], 0xfffffff3
ror byte [edi + 0x18], 1
pop es
or edi, edi
invalid
Function at 0x60776d
Capabilities:
Encode data using base64

Disassembly:
add ebp, eax
movsx eax, byte [esp + 4]
mov dword [esp + eax*2], ebp
ret 4
sub edi, 4
rol eax, 0x36
mov eax, dword [edi]
mov edx, 0xd90f5f19
not dl
push edx
xor eax, ebx
xor dx, 0x3c9c
lea ecx, [edx*4 + 0x7f26129b]
adc eax, 0x220d24b6
ror cx, cl
mov dword [esp + 4], ecx
ror eax, 3
dec word [esp + 6]
dec eax
shr dword [esp + 4], 0xab
xor edx, 0x70a1de10
dec byte [esp + 4]
ror eax, 2
shl dword [esp + 4], cl
xor ebx, eax
add edx, dword [esp]
jle 0x5e6844
add cl, byte [esp + eax - 0x52bba091]
cwde
xor bx, dx
cbw
xadd ax, cx
mov word [esi], dx
push ecx
xchg dword [esp + 4], ecx
movzx edx, word [edi - 8]
btr ecx, 0x80
bswap eax
adc edi, 0xfffffff7
pop ecx
cbw
sub eax, eax
xor dx, bx
ror dx, 1
neg dx
pop ecx
rol eax, cl
inc dx
and cx, ax
shl ecx, 0xdc
neg dx
sar ecx, 0xee
dec eax
adc cx, ax
xor bx, dx
btr cx, ax
adc eax, 0xff8e7307
cmova cx, ax
mov word [esi + ecx - 0x8001], dx
btr ecx, ecx
lea esi, [esi + ecx*2 - 0x10000]
jae fcn.0059f19a

Function at 0x60d140
Capabilities:
Encode data using base64

Disassembly:
inc ecx
sal cl, cl
inc ecx
sal eax, 0x29
cbw
inc bp
mov dword [ebp + ebp*2 + 0x278144c0], ecx
dec eax
and ebx, 0xcb60611
jb 0x5e2254
inc ecx
jmp esp
imul dword [esp + edx*2]
ror ecx, 3
add edx, eax
adc dl, ah
or dword [esp], eax
lea ecx, [ecx + edx - 0x30d4b554]
shr ax, 0xa1
xor ebx, ecx
add ebp, ecx
bt edx, 0x82
pop eax
jae fcn.0059f19a
sal edx, 2
mov eax, ebp
not dword [esp]
rol dword [esp], 0xea
call fcn.005e64cd
sar dword [esp], 0xd
pop edx
pop ecx
jmp ebp
inc ecx
neg esi
inc edx
inc byte [esp + edx*2 - 0x6e4068d2]
dec ebp
inc ecx
bswap esi
inc dx
sub edx, dword [esp + edx - 0x37203469]
jne 0x5ba0d8
inc ebx
mov esi, dword [ebx + edx*2 - 0x48759659]
jb 0x655f45
inc ecx
xor esi, edi
call fcn.00653a31
dec esp
mov dword [esp + ecx*2 + 0x1a8617da], edi
inc esp
xor dword [esp + ecx*4 + 0x350c2fb4], eax
inc ecx
pop edi
dec ebp
arpl ax, ax
sub bx, ax
dec esp
bt ebp, edx
dec ebp
adc esp, eax
mul ebp
inc bp
movzx ecx, byte [ebp + ecx*4 + 0x350c2fb4]
movsx esi, dx
add bx, ax
dec eax
add eax, 0x99af5293
inc edx
mov cl, byte [ecx + ebp + 0xd430bef]
inc esp
movsx eax, ch
ror ebx, 0xff
inc eax
shr bh, 0x82
dec ebp
lea ebp, [ebp + eax + 0x5c50ad6f]
dec ecx
or edx, eax
jae 0x5b9423
cdq
xor edx, edx
rol ecx, 3
cwd
lea eax, [edx*8 - 0x20e91862]
neg ecx
btc ax, 0x80
pop eax
bswap ecx
sar ax, 0x28
jb 0x5bfbca
Function at 0x60d156
Capabilities:
Encode data using xor

Disassembly:
inc ecx
or edx, 0xd3364503
inc ecx
xor dh, bh
dec eax
mov dword [esp + ebx - 0x62194871], 0x8086de8e
dec esp
mov dword [esp + ebp - 0x6219b787], edx
inc eax
sub dh, al
inc esp
mov eax, ecx
cdq
inc eax
xor dh, dl
inc eax
sal ch, 0x62
add ecx, dword [esp + ebx - 0x62194873]
inc eax
rol dh, 1
inc eax
xor dh, dl
call fcn.00657309
xchg esp, ecx
mov ebp, 0xd5463fb1
cld
mov dh, 0xc1
cwde
mov ss, ebp
in al, 0xb6
rcr dword [eax - 0x497346ca], 0xc1
cwde
push edx
out dx, al
lds edx, [0x79a26630]
mov esp, 0x1e5b299c
pop dword [edx + 0x4d]
push 0x70184a34
and byte [ecx + ebp*2 - 0x3e], cl
cdq
jbe 0x60d16d
mov cl, 0x24
call [ecx + 0x24c9bd14]
call [ecx + 0x24b1053c]
call [ecx + 0x609f2b28]
add dword [ebx], eax
inc ebx
mov esi, 0x7f393fb1
dec edi
mov ch, 0xc1
cwde
sub dword [ebx + eax - 0x4b], ebx
rcr dword [eax - 0x4a90bdb3], 0xc1
cwde
mov cl, 0xd
xlatb
invalid

Function at 0x60d471
Capabilities:
Encode data using base64

Disassembly:
inc ecx
push edx
dec esp
lea esp, [0xfff76a18]
dec ebp
lea eax, [edx - 0x11ca33d8]
dec ecx
sub ebx, 4
call fcn.0055ddc4

Function at 0x60f3d6
Capabilities:
Encode data using base64

Disassembly:
shr ebx, 0xa
inc ecx
neg cl
dec edx
mov dword [esp + esi*4 + 0x6bbd7c1c], 0x73bcb37
inc dx
xchg dword [esp + esi + 0x1aef5f0b], edi
or ax, 0xe8bc
inc ecx
sbb cl, 0x8b
inc edx
ror dword [esp + esi*4 + 0x6bbd7c20], cl
jae 0x57ac92

Function at 0x60f9a0
Capabilities:
Encode data using base64

Disassembly:
bswap ebx
xor ebx, 0x4aa5723c
dec ecx
add eax, esi
adc bp, 0x1321
inc dx
xor dword [esp + edx - 0x11b8], edi
sbb ebx, 0xbf996b31
bswap ebx
inc ecx
not dh
inc edx
rol dword [esp + edx - 0x11bc], cl
inc ebx
dec eax
cdq
not bp
inc sp
imul ecx, edx
rol ebx, 1
sal byte [esp + edx + 4], 0xe2
lea ebx, [ebp + ebx - 0x2e88fa11]
cwd
dec esp
mov dword [esp + edx], edi
xor dword [esp + edx*8], ebx
inc ecx
inc ecx
inc ecx
mov edi, 0x28098a07
cdq
inc ecx
pop edi
dec eax
arpl bx, bx
js 0x637517
dec eax
mul esi
dec esp
add esp, ebx
sal ebp, 0x33
inc sp
adc ecx, eax
inc ecx
jmp esp
rol ecx, 2
not ecx
neg edx
rol edx, 0xf4
inc eax
bswap ecx
and edx, 0x198c1500
xor ebx, ecx
xadd ax, dx
sub dx, 0x7ac
jno 0x5e9102
inc cx
movzx edi, byte [ebp]
inc ecx
mov cl, byte [ebp + 2]
mov ebp, 0xc53311bd
push ebp
mov ebx, ebp
dec ecx
add ebp, 2
mov edx, ebx
and dword [esp + 2], ebp
inc eax
sal bh, cl
pop esi
dec eax
lea ecx, [ebp + ebp*8 + 0x4a997f06]
inc dx
mov dword [esi + ebp - 0x13111bd], edi
dec eax
lea eax, [ebp*8 - 0x2465db6a]
shr ax, cl
inc esp
movsx edx, dx
dec edi
lea ebx, [ebx + edx*4 - 0x46f8]
dec ebp
lea ecx, [edx + 0x66280d20]
inc ecx
mov esi, 0xcd031d1a
inc edx
mov ebx, dword [esi + ebx - 0x13111bd]
neg esi
inc ecx
xor ebx, edi
inc ebp
movzx eax, cl
sub ebx, 0xe595188d
inc ecx
push esi
mov edi, 0x7b84e915
ror ebx, 1
inc eax
div bh
jmp 0x57b45b
dec eax
ror dword [esp + ebx + 0x60f2c833], 0x7b
inc ecx
mov ecx, dword [ebx + ebx + 0x60f2c81e]
inc ecx
xor ecx, edi
call fcn.0063d66f
mov eax, 0xa5933bb5
mov edx, eax
xchg dx, ax
sub edi, 4
mov ecx, dword [edi]
btr edx, edx
sar ax, 0xe3
xor ecx, ebx
bts dx, ax
sbb dx, ax
bts eax, edx
not ecx
sal eax, 0xe7
cwde
jae 0x581473
Function at 0x6126a5
Capabilities:
Encode data using base64

Disassembly:
mov edx, esp
inc ecx
rol cl, 0xc1
movsx eax, cx
mov ecx, 0x64
dec eax
bt ax, 0xbe
not eax
lea eax, [esi + eax*2 - 0x7e2a]
jb 0x5e4339
push 0xd719fe94
setae byte [esp + 2]
and eax, 0xfffffffc
ror word [esp + 1], 0xa9
jae 0x5fce00
call fcn.00643cb3
inc dl
shl ax, 0xe1
dec ax
xadd ecx, eax
rol dl, 1
cwde
xor bl, dl
btc eax, 0x94
dec ax
adc edx, esp
sal ecx, cl
mov ecx, dword [ecx + edx - 0x491ea800]
cdq
shl byte [esp + 3], 0xc1
sub eax, ecx
jmp 0x621696
rol word [esp + 4], 0x84
cmp esi, ecx
lea esp, [esp + 8]
ja 0x5f8cb1
mov edx, 0x7824319e
lea ecx, [edx*4 - 0x31c404e4]
jmp 0x5b6db1

Function at 0x6127ac
Capabilities:
Encode data using base64

Disassembly:
inc ecx
movzx ebx, byte [ebx + ebp - 0x1587cbb9]
call fcn.005a082d
sub edi, 1
mov edx, 0x4fa5b090
movzx ecx, byte [edi + edx - 0x4fa5b090]
xor cl, bl
call fcn.005ac35c

Function at 0x61286b
Capabilities:
Encode data using base64

Disassembly:
setb al
xor ebx, ecx
sar dword [esp + edx*2 - 0x2fffa], 0x45
rol ax, 0xcc
lea eax, [edx + 0x74a034ac]
adc ebp, ecx
mov dword [esp + edx - 0x17fff], ebp
ret 4
mov dword [esp], edx
movzx ecx, word [esp]
mov word [esi + ecx*4 - 0x3fe04], ax
inc byte [esp + ecx - 0xff7b]
setl byte [esp + ecx*4 - 0x3fe00]
dec ecx
lea edi, [edi + ecx - 0xff84]
btr edx, 5
mov ecx, dword [edi + ecx*2 - 0x1ff00]
mov eax, dword [esp + 1]
shl dword [esp + eax*8 - 0xffffff5], 0xbe
xor ecx, ebx
mul dword [esp + eax*4 - 0x7fffffc]
btc eax, eax
not ecx
sub eax, 0xe231639d
or ax, dx
rol ecx, 2
not ecx
btr dx, 0xbf
ror byte [esp + edx*8 - 0xbfff3], 0x84
bswap ecx
rol byte [esp + edx*4 - 0x5fff9], 0x47
jae 0x592fec
mov eax, 0x5a23568d
xor ax, 0xb89e
movzx ecx, ax
lea edi, [eax + edi - 0x5a23ee17]
mov edx, dword [eax + edi - 0x5a23ee13]
xor edx, ebx
sub ax, 0xbd28
xor edx, 0x43257214
lea eax, [ecx*4 + 0x1680f498]
inc edx
btr cx, 0xac
ror eax, cl
adc al, al
rol edx, 1
neg edx
add cx, 0x66bc
ror al, 0xc1
js 0x58e802
not edx
adc cl, 0x28
xor ecx, eax
xor edx, 0xd5ba0da3
xor ebx, edx
call fcn.0060ed3e

Function at 0x6238e9
Capabilities:
Encode data using xor

Disassembly:
shr word [esp + ebx*2 - 0xe3cf], 0x82
dec esp
bts ebx, edx
inc eax
shl dh, cl
inc bx
mov dword [ebp + ecx*4 - 0x19c], esi
dec edx
mov dword [esp + ecx*2 - 0xc6], 0xa59ddca9
jmp 0x62c43b
dec ebp
adc esp, esi
dec ecx
idiv ecx
mul di
jno 0x5e6359
inc dx
movzx esi, byte [eax + ebp - 0xb5e5]
rol eax, 0x58
dec eax
xchg dword [esp + ebx*2 - 0x9263], edi
inc ecx
mov cl, byte [ebp + ebx*8 - 0x2499e]
inc sp
xadd ebx, eax
cdq
dec ebp
lea ebp, [ebp + ebx*2 - 0xe3d0]
jnp 0x594174
movzx ebx, cl
movzx eax, di
inc ecx
rol esi, 3
inc ecx
xor esi, 0x1123ba2e
dec esi
mov dword [esp + ecx - 0xc0a0], edi
inc ecx
movzx ebp, cx
inc esi
xor dword [esp + ecx - 0xc0a0], esi
dec esi
mov edi, dword [esp + ecx*2 - 0x18148]
dec ebp
arpl si, si
dec esp
or ecx, esi
jnp 0x5b9911
inc edx
not dword [esp + ecx - 0x5f]
dec esi
mov dword [esp + ecx*8 - 0x338], esp
ret 8
Function at 0x623d7e
Capabilities:
Encode data using base64

Disassembly:
inc dx
mul dword [esp + eax*2 - 0x8cd9]
inc edx
shl byte [esp + eax*4 - 0x119c3], 0x43
dec eax
dec ebx
inc esi
mov edx, dword [esp + eax - 0x4669]
dec eax
neg ebx
dec edx
lea ebx, [ebx + eax*4 - 0x6145a945]
dec ecx
not eax
dec eax
neg ebx
dec esp
xor edi, ebx
dec edi
lea ebp, [ebp + eax*2 + 0x8ce0]
inc ecx
movsx esi, dl
dec edx
lea ecx, [esi + esi*4 - 0x48f42a5b]
btr ecx, 0xb2
dec ebx
mov dword [eax + ebp + 0x4674], ebx
pop esi
inc ecx
movsx esi, cl
pop ecx
jae fcn.00656530

Function at 0x62f4d3
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*2 - 0x5c726e28], ecx
mov eax, dword [edx + ecx*2 - 0x5c726e28]
push ecx
rol dword [esp + ecx*2 - 0x5c726e14], cl
rol word [esp + ecx - 0x2e3936ff], 0x25
lea esi, [esi + ecx*2 - 0x5c726e2c]
mov edx, 0xf618d105
imul edx, dword [esp + ecx*2 - 0x5c726e14]
sub byte [esp + ecx*2 - 0x5c726e21], cl
mov dword [esi + ecx*2 - 0x5c726e28], eax
seto cl
xchg word [esp + ecx - 0x2e3936f5], cx
jns 0x5969fa

Function at 0x63562b
Capabilities:
Encode data using base64

Disassembly:
inc esp
xchg edx, esi
inc ecx
movzx eax, byte [ebx + ebp*2 - 0x1abf8]
inc ecx
xor al, bh
sub al, 0x32
dec ecx
and esi, 0xa3b81f1e
mov byte [esp + ebp - 0xd5f6], 0x22
ror al, 1
add al, 0xb
rol al, 1
dec esp
xchg ebp, edx
dec eax
shl ebx, 0xcd
inc esp
xor bh, al
dec eax
and ebp, 0xab1e8f00
dec eax
lea eax, [esp + eax + 0x18]
call fcn.0060a8dc
dec edx
mov dword [esp + edx - 0x25600000], 0xcd905daf
dec esp
mov edi, dword [esp + ebp - 0xd5f4]
inc ecx
bswap ecx
push eax
dec eax
dec dword [esp + ebp - 0xd5f4]
dec ebp
arpl ax, ax
sal ax, cl
shr dx, 0x41
dec ebp
add esp, eax
dec esp
mov dword [esp + ebp - 0xd5ec], esi
dec ecx
mov edi, dword [ebp + edx*8 - 0x19980008]
inc ecx
ror dl, 0xe5
dec esi
lea ebp, [ebp + ebp - 0xd5f4]
dec esi
lea ebx, [ebp + ebx - 0xd5fd]
jae 0x5d52f5

Function at 0x6398bf
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea ebx, [ebx + ecx - 0xeaa2]
dec esi
lea esi, [ecx + ecx*4 + 0x24af1522]
dec ecx
xchg ecx, ecx
inc ebp
mov edx, dword [ebx + ecx - 0xea9e]
dec eax
lea ebx, [ecx*4 + 0x58a417a8]
inc ebp
xor edx, edi
call fcn.005a2721