joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b7c5f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor bl, dl
shl eax, 0x4b
mov dword [esp + eax - 0x74d7a7f0], edi
mov dword [esp + eax - 0x74d7a7fc], eax
shl eax, 0xf1
mov dword [esp + eax - 0x4ffffff4], ebp
movsx ebp, al
shl ax, 0x85
mov dword [esp + eax - 0x4ffffff8], ebx
xor ebp, esi
shl ax, 0xc3
mov ebx, edx
lea edx, [eax*4 + 0x2218a784]
mov edx, ebx
shl edx, 2
call fcn.0226fc76
jmp 0x22df703
call fcn.02221928

Function at 0x1b83d32
Capabilities:
Parse pe header

Disassembly:
push ebp
shld bp, bx, 0xa0
mov ebp, esp
test bx, 0x5009
add dh, 0x38
mov edx, dword [ebp + 8]
jmp 0x2160be9
je 0x2259c9a
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x2259c94
sub esp, 0x114
push esi
cmp si, ax
test ebx, esp
test edx, edx
je 0x2259c9a
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x1c11354

Function at 0x1b89336
Capabilities:
Get number of processors

Disassembly:
ror ecx, 3
ror al, 0x21
and al, dl
neg ecx
and dword [esp + 4], edx
dec ecx
ror word [esp + 4], 0xca
mov dword [esp], edx
bswap ecx
jae 0x21a7db5
add byte [eax], al
inc edi
je 0x1b893b0
js 0x1b893d3
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x1b89365
movzx ax, byte [edi]
mov ecx, 0xa8aeb0b0
call fcn.01b5a6a0
mov ecx, 0x8ba11db8
sub edi, 4
call fcn.021b3d10
inc esp
movsx esp, dl
dec esp
lea ecx, [edx*2 + 0x139bc602]
inc ecx
mov eax, esp
neg ecx
dec eax
lea ebp, [edx + edx*8 - 0x2c5103eb]
dec ebx
lea edi, [esp - 0x3bda5e71]
dec ecx
not ecx
inc ecx
lea ecx, [esp + ecx - 0x5e6ba781]
inc ecx
sar ecx, 0xad
inc esp
sub ah, byte [esp + 3]
xor ecx, 0xfe012029
jmp 0x1c196ec
sar edi, 0xa4
dec eax
arpl cx, cx
js 0x23225ec
inc ecx
xor edx, 0x81a7b9a4
pop edx
dec edx
or dword [esp - 0xc0], 0xed2be81b
inc edx
not byte [esp - 0xb9]
inc ecx
rol edx, 3
inc ecx
movsx edx, ah
inc dx
sal dword [esp - 0x300], 0xe1
inc ecx
bswap edx
mov eax, 0xf88b716
inc ecx
ror edx, 1
inc edx
xadd dword [esp - 0x17f], eax
inc ecx
shl esi, 0x2b
dec edx
mov dword [esp - 0x600], ebx
inc ecx
sbb esi, 0x2d934a80
dec edx
lea ebp, [edx + ecx*8 - 0xfd8c9d6]
inc esi
xor dword [esp - 0x300], edx
call fcn.022e0d65
inc eax
dec ecx
bswap ecx
sub byte [esp], 0xc
inc ecx
dec cl
inc ecx
inc ecx
dec eax
mov dword [esp], ebx
xor dword [esp], ecx
pop ebx
jmp 0x1b9a159

Function at 0x1b9478d
Capabilities:
Get number of processors

Disassembly:
mov dword [esp], 0x3eae3dac
mov edx, dword [ebp + 4]
add ebp, 8
mov dword ss:[eax], edx
xchg dword [esp], ecx
inc byte [esp + ecx - 0x3eae3dab]
or word [esp + ecx*2 - 0x7d5c7b56], cx
mov eax, dword [esi + ecx*2 - 0x7d5c7b58]
js 0x1cf148b
Function at 0x1b9ffbe
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx + ecx - 0xde46de]
mov eax, dword [esp + ecx*2 - 0x4cc27414]
sal dword [esp + ecx*2 - 0x4cc27414], 0xdf
rol edx, 2
mov byte [esp + ecx*2 - 0x4cc27411], ch
and al, ah
pop eax
cmp eax, 0x4cb4c1b3
in al, dx
mov edi, dword [0xc2c1dfb3]
add cl, byte [eax - 0x7410b354]
cmp eax, 0x58c422b3
neg edx
rol word [esp + ecx*2 - 0x4cc27417], cl
lea edx, [edx + ecx*2 - 0x70c51bb0]
call fcn.020a5506
cmp byte [ecx + 0x59], bh
out 0x78, al
mul ecx
mov word [eax + 0x39], cs
push ss
wait
xor dword [eax], esi
sahf
mov eax, 0x84a66035
push cs
sti
and byte [eax + 6], bl
je 0x1b9ffca
cld
mov esi, 0x781febd2
rcr dword [0x63cf003a], cl
imul esi, dword [eax - 0x56a89496], 0x6b86f824
leave
call [edi + 0x6d]
invalid

Function at 0x1baffe2
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + eax - 0x17fc]
call fcn.0217c777

Function at 0x1bb7cc9
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0x2e35d089
lea eax, [edx*4 + 0x2e0d4f20]
pop eax
pop eax
pop ecx
pop edx
ja fcn.01d05a40
and dx, cx
xor eax, ebx
and ecx, edx
lea eax, [eax + edx - 0x753ff3b3]
push ecx
push ecx
sal word [esp + edx - 0x2d801885], 0x41
rol eax, 2
bswap eax
pop ecx
rol eax, 1
sar cx, 0x4d
neg dl
sbb ecx, ecx
bswap eax
call fcn.01cf8eeb
call fcn.02232242

Function at 0x1bc1a80
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x167aef6a
call fcn.022f55a5

Function at 0x1bc1a8d
Capabilities:
Encode data using base64

Disassembly:
xor ecx, dword [ecx + esi]
add esi, 4
not dword [esp + 8]
xor ecx, ebx
ror ecx, 1
not ecx
ror ecx, 1
bswap ecx
call fcn.02217a9e

Function at 0x1bd7eaf
Capabilities:
Encode data using xor

Disassembly:
sar edx, 0x90
xor bl, cl
lea ebp, [edx + ebp - 2]
or dl, 0x2d
mov word [edx + ebp - 0x2d], cx
neg edx
call fcn.0225bd85
xor edi, edx
and edi, 0xff
jmp 0x21db860

Function at 0x1bdfb63
Capabilities:
Get number of processors

Disassembly:
lea ecx, [eax*4 - 0x6e5cdbf5]
shl eax, 0x27
xor edx, ebx
add al, ch
sete cl
mov dword [esp], ecx
not edx
adc eax, eax
inc edx
and dword [esp + eax - 0x21490490], ecx
or dword [esp + eax*2 - 0x42920920], 0x1315920f
ror cx, 0x2a
ror edx, 1
xor dword [esp + eax - 0x21490490], 0x168b1124
jne 0x1c11289
mov edx, 0x3d9eccbd
mov ecx, dword [esi + edx - 0x3d9eccbd]
lea esi, [esi + edx*2 - 0x7b3d9976]
xor ecx, ebx
sal edx, 0xb3
or edx, edx
jno 0x1d1fab0
inc ecx
movsx edx, bl
inc edi
mov dword [eax + edx*2 - 0x70b982b4], esi
sal dl, 0x65
inc edx
rol dword [esp + ecx - 0x4df347ff], 0xc1
inc ecx
pop esp
inc ecx
jmp edi
ror ecx, 3
or dl, dl
call fcn.01c45254

Function at 0x1bdfe03
Capabilities:
Authenticate hmac

Disassembly:
xor edx, ebx
movsx eax, byte [esp + 4]
neg edx
sar cl, 0x67
mov dword [esp], ecx
xchg byte [esp + 5], ah
rol edx, 3
neg edx
bswap edx
mov dword [esp + 4], 0x1c103526
jmp 0x22a8a4a
bswap ecx
xor ebx, edx
jmp 0x2271cef

Function at 0x1be0646
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x7a021fb7
lea eax, [eax + ecx*2 - 0x7bfa3031]
pop edx
ror byte [esp + ecx - 0x7a021fb1], 0xa4
xor eax, 0x6c240a87
call fcn.021c0356
Function at 0x1be0f5e
Capabilities:
Encode data using base64

Disassembly:
inc ebp
movzx ebx, dh
inc esp
xor ecx, ebx
inc ecx
ror ecx, 1
inc ecx
sub ecx, 0xc8bbab0e
inc dx
neg dword [esp + ebx - 0x86]
inc ecx
movsx ecx, bp
inc ecx
not ecx
inc edx
shr byte [esp + ebx - 0x7f], 0x85
dec edx
mov dword [esp + ebx - 0x8e], eax
add bp, 0x3936
inc ecx
neg ecx
inc esi
or ebp, dword [esp + ebx - 0x86]
dec esi
xchg dword [esp + ebx*2 - 0x114], esi
inc dx
neg dword [esp + ebx*2 - 0x11b]
inc ecx
ror ecx, 2
dec ecx
not ebp
inc dx
xchg dword [esp + ebx - 0x89], ecx
inc ecx
bswap ecx
inc ecx
not ecx
inc ecx
pop esp
inc ecx
rol ecx, 1
dec edi
lea esi, [esp + ebp + 0x4ab22a0]
call fcn.0219fd59

Function at 0x1be0fd6
Capabilities:
Encode data using base64

Disassembly:
add dword [esp + ecx - 0x4d9cfca], eax
inc dl
bswap ecx
dec dword [esp + eax*2 - 0x19e6c]
lea eax, [ecx + ecx*4 - 0x2ff456d4]
not dl
je 0x1c0fdeb
neg al
sub dl, 0x12
add eax, 0xdc13f599
pop ecx
or ecx, ecx
xor bl, dl
sar cx, cl
add eax, eax
add edx, esp
xor eax, 0xc9b31c26
movzx ax, byte [edx + ecx*4 - 0x109cfdc0]
ja 0x211e1c1
ror eax, 1
not cx
inc eax
sar ecx, 0x43
setae dl
rol eax, 1
or edx, 0x18a7d04
mov dword [esp + ecx*8 - 0x26ce7e50], ecx
xor ebx, eax
or edx, 0x91b79e30
xor word [esp + ecx - 0x4d9cfc9], dx
adc ebp, eax
movzx edx, byte [esi + ecx*4 - 0x13673f28]
rol word [esp + ecx*2 - 0x9b39f94], 0xcc
movzx eax, cx
lea esi, [esi + ecx*2 - 0x9b39f93]
xor dl, bl
neg al
ror dl, 1
jmp 0x1bb7c7e
jmp ebp
rol cl, 6
lea edi, [edi + ecx*4 - 0x109cfc72]
movzx edx, cx
mov word [edi + edx - 0x3f1c], ax
movsx eax, dl
jne fcn.021f6ccb

Function at 0x1be7dcc
Capabilities:
Encode data using base64

Disassembly:
add edi, 4
mov edx, 0xfd071183
shr dx, 0xc3
inc dl
xor eax, ebx
lea ecx, [edx + edx*4 + 0x4eb6ba28]
and ecx, 0xe086b406
rol edx, cl
neg eax
mov dword [esp + ecx - 0x20808404], edx
shr edx, cl
ror eax, 1
inc eax
or dl, ch
not eax
setp dl
rol eax, 1
sar edx, 0xb7
lea eax, [eax + ecx*8 - 0x3c81eb96]
bswap eax
pop ecx
sar cx, 0xc
ror ecx, cl
lea eax, [eax + edx*4 + 0x58a92a5]
bswap eax
mov dword [esp + edx*8 - 0xc8], 0x863ccab9
inc eax
neg eax
mov dword [esp + edx*8 - 0xcc], ecx
ror ecx, 0x23
lea eax, [edx + eax - 0x38188bd]
neg eax
bswap edx
rol dword [esp + edx - 0x19fffff8], 0xa6
sub eax, 0xff01809e
shr word [esp + edx - 0x19fffffd], 0xa9
xor eax, 0xe41f7633
jmp 0x21bbe4a
xor ebx, eax
call fcn.02173ea6
rol dx, 0xcf
jae 0x1c424d1
Function at 0x1bea3a6
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], ecx
sbb ebp, 4
pop eax
mov dword [ebp], edx
sub edi, 4
xadd cx, ax
movzx edx, al
neg edx
mov eax, dword [edi]
sal cx, 0x6f
jns HeapReAlloc
dec edx
add esi, 4
not eax
not dl
xor dl, 4
neg dx
not ecx
setge dl
or eax, ecx
mov ecx, 0xb22ca793
xchg edx, ecx
shr dl, 0x44
mov dword [esi], eax
sbb ebp, 4
add edx, 0x8b84b710
inc ecx
jb 0x22a4e33
xor eax, ebx
or dl, cl
rol eax, 1
and ecx, ecx
rol edx, 9
jb 0x228f20f
mov eax, 0xc91236a7
movsx ecx, ax
lea edx, [ecx + 0x48a62c00]
mov eax, dword [ebp + ecx*4 - 0xda9c]
call fcn.022d9bda
xor eax, 0xac25931f
neg eax
dec cl
ror cx, 0xcb
ror eax, 3
xor ebx, eax
add esi, eax
xor cx, 0x1d8c
setne cl
jns 0x21740ad
mov eax, dword [ebp + edx*2 - 0x7b62bc32]
sub ecx, ecx
xor eax, ebx
lea edx, [ecx + edx - 0x6773b9d0]
and dx, dx
xor eax, 0x40b01dbf
call fcn.01bed503

Function at 0x1bf88d2
Capabilities:
Encode data using base64

Disassembly:
dec ebp
add edi, esi
dec edx
mov dword [esp + ebx], 0xf03fdd96
call fcn.0217434b

Function at 0x1c09ef5
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + edx - 0x33980b88], ebx
sub ebp, 0x980d002c
inc eax
ror bh, 0x44
inc esp
xor dword [esp + ebp - 0x67f3005c], ebx
dec eax
mov ebx, dword [esp + edx - 0x33980b88]
shr di, 0x85
dec ebp
arpl bx, bx
dec ecx
dec esi
inc eax
xor bh, 0x81
inc ecx
inc esi
dec ebp
adc edi, ebx
call fcn.01cf12ea

Function at 0x1c1133f
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea edi, [edi + edx*4 - 0x428f00d8]
mov edx, dword [edi + edx*2 - 0x2147806a]
xor edx, ebx
call fcn.01ba498a
Function at 0x1c39448
Capabilities:
Encode data using base64

Disassembly:
sub ecx, 0x553ae806
dec eax
add esi, 4
inc ecx
mov ebx, 0xdc010139
inc ebp
mov esi, ebx
xor edx, ebx
jmp 0x21dfb2b
xor ecx, 0xbeb77529
mov dword [esp], eax
neg ax
ror ecx, 2
sar ax, 0xa5
and edx, 0x6eac9f39
xor dword [esp + edx - 0x2a8c9f37], 0xbe094492
xor ebx, ecx
inc dx
js 0x230773b
jnp 0x1cf77ae
movzx eax, byte [esi]
inc ecx
mov esi, 0x929b848a
dec ebx
lea edi, [esi + esi + 0x788fea10]
dec eax
add esi, 1
call fcn.0218e86b
mov eax, 0x26bcf03c
lea edx, [eax + eax*4 + 0x6827f4b0]
lea edi, [eax + edi - 0x26bcf040]
not edx
lea eax, [eax*4 - 0x74f6bbd8]
movzx ecx, dl
mov eax, dword [edi + eax - 0x25fd0518]
call fcn.01c5b5a1
sal al, 0xa7
dec edx
inc ecx
push ebx
bswap edx
sub edx, 0x2225840b
shr dword [esp + 1], 0x21
jnp 0x20fafd1
mov edx, 0x8314700b
shl edx, 0x54
mov eax, edx
mov edx, dword [esi + edx - 0xb00000]
movsx ecx, ax
or ecx, eax
or cx, cx
mov eax, dword [esi + eax*2 - 0x15ffffc]
xadd cl, ch
jl 0x1c5b302
lea esi, [esi + ecx - 0xaffffc]
call fcn.01d21df7
mov ecx, dword [edi + edx - 0x66c79eb4]
xor ecx, ebx
shl dl, 0x26
inc ecx
dec eax
not ecx
setl dl
sal edx, 0x61
setge al
ror ecx, 2
jmp 0x1ba53ec
rol byte [esp + edx - 0x2a8c9f32], 0x45
adc edi, ecx
ror eax, 0x13
inc byte [esp + edx*2 - 0x55193e70]
mov eax, dword [esi + edx*2 - 0x55193e72]
add word [esp + edx - 0x2a8c9f36], dx
jl 0x1c46f52
mov edx, dword [esi]
jmp 0x1c1fad4

Function at 0x1c3b8e1
Capabilities:
Authenticate hmac

Disassembly:
ror word [esp + 5], 0x8b
sub esi, 0xc
mov dword [esi + 0xc], eax
shr dword [esp + 0xc], 0x44
mov dword [esi + 8], ebx
mov dword [esi + 4], ecx
mov dword [esp], 0x28b8acb7
mov dword [esi], edx
jb 0x21e34a1
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 8]
pop edx
pop eax
pop eax
pop edx
pop edx
jnp 0x22c2bfd
sub ebp, 4
mov eax, dword [ebp]
mov edx, 0xea3f6294
call fcn.0227f100
call fcn.021cf499
sal edx, 0x96
ror ecx, 1
sar edx, 0x7c
inc ecx
not dx
rol ecx, 3
neg edx
xor ebx, ecx
or dx, 0xf513
xor ax, 0x46b1
xor eax, edx
adc ebp, ecx
mov eax, dword [esi]
movzx ecx, dl
mov ecx, dword [esi + ecx*2 - 0x22]
not edx
lea esi, [edx + esi - 0xae4]
mov dword ss:[eax + edx*2 - 0x15d8], ecx
call fcn.020d9779
Function at 0x1c3d933
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
inc edx
shl dword [esp - 0x28d96418], 0x55
inc ecx
inc edx
ror ecx, 3
jmp 0x21dcbac
rol al, 0xc2
inc ecx
lea esi, [esi + eax - 0x76d6]
push ecx
xor edx, ebx
rol al, 0xc7
jb 0x212ee32
add byte [eax], al
push edx
insb byte es:[edi], dx
popal
jae 0x1c0a530
dec ebp
jne 0x1c0a542
js fcn.01c0a4d1
and al, cl
push ecx
xor edx, ebx
rol eax, 0x55
lea edx, [edx + eax + 0x676d729e]
adc eax, 0xc0be6b0c
bswap edx
sar word [esp + ecx - 0x7fd2324e], 0x62
mov esi, 0x66ca0fc0
sar dword [esp + ecx - 0x7fd2324e], 0x62
lea edx, [eax + edx + 0x1f29547e]
mov dword [esp + ecx - 0x7fd2324b], eax
adc eax, ecx
bswap edx
add word [esp + eax - 0x40adbb76], 0x3716
xor al, byte [esp + eax - 0x40adbb7b]
not edx
xadd dword [esp + eax - 0x40adbb35], ecx
xor ebx, edx
add ebp, edx
pop eax
and byte [esp + ecx - 0x4005b9d3], 0x3a
adc eax, eax
mov dword [esp + ecx - 0x4005b9d6], ebp
ret 4
dec dword [esp + eax - 0xce3]
pop edx
pop ecx
pop eax
pop eax
pop ecx
pop eax
pop eax
pop ecx
jne fcn.02199163
mov ecx, 0xde8776b6
movsx eax, cx
mov edx, dword [esi + eax - 0x76b6]
jmp 0x1c0a4ab
xor ecx, ebx
dec edx
xor dword [esp - 0xa365908], 0xb7965e0a
inc edx
movzx edx, word [esp - 0xa365906]
inc edx
mov byte [esp - 0x51b2c83e], 0x20
not ecx
inc ecx
shl esi, 0xb
dec esi
lea ecx, [0x36360bbe]
inc ecx
push ebx
inc ecx
inc ebp
movzx ebp, dl
jmp 0x1b5cad6
and dword [esp + eax - 0x766d], eax
inc edx
rol al, 0xc2
neg edx
xadd word [esp + eax*4 - 0x1dad3], cx
call fcn.022196e4
inc ecx
mov esp, 0xa365908
dec ecx
lea ebp, [esp + 0x7d08af87]
inc ecx
push esp
inc edx
mov ecx, dword [esi - 0x28d96420]
dec esi
lea esi, [0x680de092]
dec eax
shr ebp, 0x44
dec edx
lea esi, [esi - 0x28d9641c]
dec ebp
lea edx, [esp + ebp*4 + 0x712f82bb]
dec edi
lea ebx, [esp + edx*2 - 0x185ff7cb]
jp 0x1d0d900
pop eax
sub ecx, 0x9810a588
call fcn.022e5a79

Function at 0x1c3efde
Capabilities:
Encode data using base64

Disassembly:
inc eax
call fcn.01b6ef02
mov edx, 0xcb3631e1
in eax, dx
movsd dword es:[edi], dword [esi]
mov ecx, 0x5ff8f631
fistp qword [esi + edx*2]
jle 0x1c3f026
sub eax, 0xece5f653
push ebx
mul ch
in al, dx
lea ebp, [ecx - 0x53bd79e2]
lodsd eax, dword [esi]
mov dword [ecx - 0x2d], ebp
aaa
jbe 0x1c3eff6
cdq
jne 0x1c3f050
xchg esi, eax
mov esi, dword [ebx - 0x50]
fprem
or byte [ecx + 0x57], cl
invalid
jg 0x1c3f02d
sbb al, byte [ebx - 0x7501efa4]
stosd dword es:[edi], eax
inc eax
and dword [edi - 0x69cc5770], 0x11
dec eax
xchg ebp, eax
mov ch, byte [ebx - 0x6f587cc0]
test al, 0x33
xchg esi, eax
adc dword [eax - 0x6b], ecx
invalid
mov esi, ebx
bound ebp, qword [0xa4103307]
fdivr st(4)
push ds
aaa
outsd dx, dword [esi]
pop ds
mov eax, dword [0xeed8176d]
lcall 0xc731, 0x695b7ad7
sub esi, esi
sbb ah, bl
push esp
pushal
cmp ch, cl
wait
invalid

Function at 0x1c3f580
Capabilities:
Execute syscall

Disassembly:
shl byte [esp + 4], 0xe5
neg eax
xor ebx, eax
sal ecx, cl
sub ecx, 0x68a95d3d
adc ebp, eax
int 0x2e
call fcn.01b2fc6a
Function at 0x1c453c1
Capabilities:
Encode data using base64

Disassembly:
not edx
mov eax, 0x2297e615
sub al, ah
mov dword [esi + eax*2 - 0x452fcc5e], edx
lea ebp, [ebp + eax - 0x2297e633]
lea edx, [eax + eax*4 - 0x45968cf]
sal edx, 0xb7
mov ecx, dword [ebp + eax - 0x2297e62f]
int 0x19
push 0x80948ddd
xor dword [edi - 0xd3e045a], edx
mov bh, 0x8b
mov word [0xdd6819d1], es
call fcn.01b9eaa5
ror edx, 2
sar ax, 0x66
sar cl, 3
lea edx, [ecx + edx - 0x5b53af11]
ror edx, 2
shl eax, 0x79
xor ebx, edx
call fcn.01c13cd7
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
add ebp, 8
mov edx, 0x7f14d3ac
mov dword [ecx + edx - 0x7f14d3ac], eax
movzx ecx, dl
lea eax, [edx - 0x3c5ba77c]
lea edi, [edi + edx - 0x7f14d3b0]
call fcn.01b44b56
jns 0x1b3217c
mov ebx, 0xb1a73640
aas
dec ebp
ret 0x9d9
adc esi, 4
push 0x9e192da7
xor edx, edx
jmp 0x1c5a75b
inc cx
neg ebp
call fcn.022aad85
xor ecx, 0xb0ea02
mov dword [esp + eax - 0x27004540], eax
sar eax, 0xf5
rol word [esp + eax*8 - 0x9be], 0xab
ror ecx, 3
jmp 0x1cebb1d
test eax, eax
push 0xb23da8b4
lea esp, [esp + 8]
je 0x1b32169
call fcn.02175d0a
or dword [esp + eax - 0x138], edx
ror dword [esp + eax - 0x138], 0x7e
xor ecx, 0x8834d100
shl edx, 0xaa
add ax, word [esp + eax*2 - 0x270]
neg ecx
ror ecx, 2
bswap ecx
lea ecx, [ecx + edx - 0x55e9656a]
neg ax
sal eax, 0x23
xor ebx, ecx
add ebp, ecx
sal dword [esp + eax*2 - 0xe6da0], 0x39
or dword [esp + edx - 0x7403ec00], eax
mov di, word [edi + edx - 0x7403ec00]
xor edx, eax
add dword [esp + eax - 0x736d0], 0xed1e8f82
shl word [esp + eax - 0x736cf], 0xe3
pop ecx
jp fcn.021f6ccb
inc ecx
push esi
jmp 0x2312990
inc esp
xor byte [esp + 7], cl
inc edi
lea esi, [esi + ecx + 0x1a3750ca]
inc ecx
rol esi, 1
or word [esp + 5], 0x7594
inc ecx
bswap esi
call fcn.0210e51a
mov edx, 0x60241c23
lea edx, [edx + 0x6a38291]
call fcn.01bdd0c9
inc cx
rol ebp, 1
inc si
and dword [esp + edx - 0x191b31f6], ebx
inc edx
movzx ebp, byte [esp + edx*4 - 0x646cc801]
jbe 0x1ba5450
jae 0x1b8b272
adc edi, ecx
sub dword [esp + edx*8 - 0x1669dfce], 0xb4946d3b
push edx
pop eax
pop edx
pop edx
jne fcn.01d05a40
add eax, 0x5e02d88b
cmp eax, 0x57b41087
hlt
inc esp
xor esi, ebx
movsx edi, dl
inc ecx
xor esi, 0xbf36e4be
jmp 0x21cb60f
inc esp
mov esi, dword [esi]
dec eax
add esi, 4
dec esp
lea edx, [edx - 0x4dcef9d1]
jmp 0x2267e11

Function at 0x1cdf13b
Capabilities:
Encode data using base64

Disassembly:
push 0x4c852b82
lea esp, [esp + 0x10]
je 0x208bd0e
push esi
Function at 0x1ce7a5d
Capabilities:
Encode data using base64

Disassembly:
movsx eax, dl
mov ecx, dword [esi]
add dx, 0xb40b
not eax
xchg edx, eax
lea esi, [edx + esi - 0x21]
neg eax
call fcn.02276901
sub eax, ecx
xor edx, ebx
shr ax, 0x4a
sar ecx, 0xdd
dec ecx
ror edx, 1
neg edx
lea edx, [edx + eax*2 + 0x191c8f01]
neg edx
xor ebx, edx
xor ecx, ecx
neg al
shr ecx, 0x45
adc ebp, edx
or ax, 0x21bd
mov edx, 0x6f3d7083
add ecx, edx
movzx ax, byte [edi + edx - 0x6f3d7083]
call fcn.0218bad2
mov dword [esp], 0x2b2f14f4
call fcn.0211c32c
mov ecx, 0xfe174418
shl cl, 0xa6
adc esi, 2
lea edx, [ecx*8 - 0x30cc017d]
neg edx
xor ax, bx
sar ecx, 0x26
adc dl, 0xab
ror ax, 1
xor ax, 0x692c
jmp 0x21f0287
jmp 0x1c0a456
neg ax
neg edx
lea ecx, [ecx*4 + 0x703d1c1f]
not ax
not dx
ror ax, 1
lea ecx, [ecx*2 - 0x4b62aacc]
xadd dx, cx
sal edx, cl
xor bx, ax
sal cx, 0x83
lea edx, [edx + ecx + 0xc20e322]
sal cx, 0xa9
sbb ebp, 2
mov word [ebp], ax
jmp 0x21a61bd

Function at 0x1ceadd6
Capabilities:
Encode data using xor

Disassembly:
dec al
or edx, 0x52aa479f
ror ecx, 2
shr edx, 0xfc
pop eax
mov dword [esp + edx - 0xf], edx
xor ebx, ecx
call fcn.0227f559
sub edi, 4
mov eax, 0xe2325406
mov edx, dword [edi]
lea ecx, [eax + eax*2 + 0x40a39d0d]
xor edx, ebx
add ecx, 0xe013dd87
jo 0x22826b0
not edx
xadd cl, al
lea edx, [edx + ecx + 0x1fead7d7]
call fcn.01b49329
in al, dx
sub byte [esi], ch
and ah, 0xa6
xchg esi, eax
mov esp, ss
push 0xf3fe9b61
push ecx
aas
inc edx
and byte [esi + 0x11], bh
mov dl, byte [0x2b4695fc]
jns 0x1ceae3b
push es
in eax, 0xe5
invalid
xchg ebp, eax
inc esi
sub edi, dword [ecx - 5]
mov dword [0xc0dbbefb], eax
cld
push es
jge 0x1ceade5
pop ds
nop
add byte [ebp - 0x6b], dh
ja 0x1ceae1f
mov eax, 0x49a36029
inc edx
scasb al, byte es:[edi]
push 0x468ab65
shr dword [ecx + 0x44137962], 1
mov al, byte gs:[0x70116f46]
popal
add al, 0x52
adc dword [ecx + 0x46df628c], esi
wait
jmp 0x1ceaee7
inc esp
cdq
and ebx, dword [esi + 0x1b072722]
fcomp dword [ebx - 0x14]
or dword [edi + ebp*8], esi
dec ebx
and dh, byte [edi + 0x31]
xchg edx, eax
xor byte [edi], 0x95
aaa
xchg ebp, eax
sub esp, dword [edi - 0x21]
pop edx
xor eax, 0x7e0068f9
fcomp dword [eax + ebx*2 - 0x55e3ce91]
pushfd
pop eax
outsd dx, dword [esi]
xor dword [edx + ebp*4], ebx
jl 0x1ceaedb
or bl, byte [ecx - 0x5c970aa8]
mov dword [0x68b9dbb0], eax
and eax, 0xb9b9d454
add eax, 0xf1b45bbc
mov esp, eax
dec eax
outsd dx, dword [esi]
jecxz 0x1ceaec6
dec edi
and byte [ecx - 0x4a], cl
mov word [edi], gs
fadd dword [ebp - 0xa241cd0]
pop edx
test al, 0x97
dec ecx
mov ch, 0x2b
pushal
adc al, 0x7c
retf 0x295e
Function at 0x1cede7e
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], edx
mov ecx, dword [esi]
mov eax, 0x8fb395b5
add ax, ax
add esi, 4
xor ecx, ebx
mov dword [esp + 4], eax
not word [esp + 0xe]
neg ecx
bswap ecx
sub byte [esp + 4], 0x3d
sbb eax, 0x6b2eb885
xor ecx, 0x7c239294
push eax
not ecx
mov edx, eax
neg dx
mov dword [esp + eax - 0x248472e1], 0x1f0f9e2c
lea ecx, [edx + ecx - 0x1cdf3884]
shl word [esp + edx*2 - 0x49091a2d], 5
bswap ecx
shr edx, 0xa9
not ecx
shl eax, 0x3f
sub byte [esp + eax - 0x7fffffef], al
and word [esp + edx*8 - 0x921227], dx
dec ecx
xor ecx, 0x2b8545b5
call fcn.022ef472
mov eax, dword [edi]
mov cl, byte [edi + 4]
mov edx, 0xdd0f7090
sal edx, 0x71
adc edi, 2
jmp 0x21893c7
shl dl, 0xc7
shr dx, 0x6e
shr eax, cl
or dl, dl
movsx ecx, dl
mov dword [edi + ecx*2], eax
movzx eax, dx
jbe 0x213336b

Function at 0x1cf52d8
Capabilities:
Authenticate hmac

Disassembly:
lea esi, [esi + edx*2 - 0x54655964]
mov dword [esp + edx - 0x2a32acac], 0x8b964a85
push edx
rol edx, 0xd1
xor eax, ebx
lea ecx, [edx + edx*4 + 0x412823a9]
rol eax, cl
lea eax, [eax + edx*2 + 0x2153a0ee]
add dword [esp + edx - 0x59685465], ecx
mov dword [esp + edx - 0x59685461], edx
not eax
jne 0x20e236f
call fcn.01d09dc3
mov edx, 0x33898186
xor edx, edx
lea eax, [edx*8 - 0x14db9c7d]
mov eax, dword [edx + edi]
movsx ecx, dl
adc ecx, edx
push edx
lea edi, [edi + ecx + 4]
dec cx
rol dword [esp + edx], 0xfc
xor eax, ebx
dec dword [esp + edx*8]
xor eax, 0x82ad21a1
shr cl, 0xa3
and cx, dx
adc eax, 0xdd8c5108
shr cx, 0x24
not dl
push edx
rol eax, 3
add edx, dword [esp + edx - 0xff]
lea eax, [eax + edx*2 - 0x4abcb127]
adc ecx, 0x34b22c2e
call fcn.0219fd88
mov eax, ebp
sub ebp, 2
mov ecx, 0xf3327f8a
mov word [ebp], ax
dec ecx
movsx edx, cl
lea eax, [ecx + ecx + 0x3eadf807]
mov eax, dword [eax + edi - 0x2512f719]
add edi, 4
add edx, 0x9a887e37
sal dl, 2
sar dl, 0xe7
xor eax, ebx
inc eax
and dl, cl
jbe 0x219e50f
cmovns ecx, edx
neg eax
shr word [esp + edx - 0x5968545d], 0x2e
xor ebx, eax
sub dl, byte [esp + ecx - 0x5968545d]
jae 0x2292fab
mov eax, dword [ebp]
mov edx, 0x1a202019
mov edx, dword [ebp + edx*2 - 0x3440402e]
mov ecx, 0x3f887e86
and cl, 0xaa
setb cl
or cl, byte [ecx + ebp - 0x3f887df8]
push 0xb6a7c384
add ebp, 6
shld eax, edx, cl
mov ecx, 0x723d7ae
xor cx, cx
pop ecx
mov dword [ecx + ebp + 0x49583c7c], eax
mov eax, ecx
call fcn.01ce8385
mov ecx, dword [ebp + eax - 0xdf40]
ror word [esp + eax - 0xdf38], 0xa6
setae byte [esp + eax - 0xdf34]
push eax
mov ax, word [eax + ebp - 0xdf3c]