joyce8/EMBER2024-capa huggingface dataset:
Function at 0x570a70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x5cf36c], 1
je 0x570a85
call fcn.005706f0
mov eax, dword [0x59ae84]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x570ab0
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00570470
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x570a9c
test esi, esi
je 0x570a9c
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x18], eax
sub esp, 0x10
lea eax, [esi + 0x38]
mov dword [esp], eax
call fcn.0056ff50
cmp eax, 1
je 0x570bcd
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
call ebp
lea edx, [esi + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x59792a
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x59ae84]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x59792a
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00570290
lea esi, [esi]
lea esi, [esi]
call sub.msvcrt.dll_abort
mov eax, dword [0x14]
ud2
Function at 0x570be0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x570c10
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x570ce0
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x570d10
cmp eax, 3
jne 0x570bfa
mov eax, dword [0x59ae84]
cmp eax, 0xffffffff
je 0x570bfa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x570bfa
test byte [eax + 0x20], 0x30
je 0x570d40
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x570c53
call fcn.00570790
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x570c85
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x570c77
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0056f0e0
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0056ff50
cmp eax, 1
je 0x570dc0
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x570e30
mov eax, dword [0x59ae84]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x570bfa
mov eax, dword [0x5cf348]
test eax, eax
je 0x570bfa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x5cf348], 0
sub esp, 4
jmp 0x570bfa
mov dword [esp + 4], 0x56ffc0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x5cf348], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x570dc8
test eax, eax
je 0x570d5a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x570d77
call fcn.00570790
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x570e10
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x570da0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.0056f0e0
mov dword [esp], esi
call fcn.0056ff50
cmp eax, 1
jne 0x570ca4
call fcn.00570290
lea esi, [esi]
test eax, eax
je 0x570dd8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.0056f0e0
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0056ff50
cmp eax, 1
je 0x570dc0
mov dword [ebx + 0x38], 0xffffffff
jmp 0x570bfa
mov dword [esp], edi
call fcn.0056f0e0
mov dword [esp], esi
call fcn.0056ff50
cmp eax, 1
jne 0x570dfa
jmp 0x570dc0
mov eax, ebx
call fcn.00570530
jmp 0x570cb9
Function at 0x5716a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00570a70
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x5716c2
call fcn.00570790
test byte [ebx + 0x20], 0x30
jne 0x5716dc
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x59ae84]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x57171f
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x571763
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x571712
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x571728
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov dword [ebx + 0x14], 0
mov eax, ebx
call fcn.005706d0
mov eax, dword [0x59ae84]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x57171f
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x571777
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jmp 0x571742
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3852456f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4ac13479
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x7e4b2d9e
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x7fc00ec6
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x17ec4beb
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x1c40720a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x583d59d6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x7f2e4a91
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x7f21c5
Capabilities:
Encode data using base64

Disassembly:
ror dl, 1
not dl
mov dword [esp + 8], eax
sub dl, 2
mov dword [esp], 0xcf2734bb
xchg dword [esp + 1], eax
sar dword [esp + eax - 0x1acf272f], 0xf
rol dl, 1
pop eax
call fcn.008f0e5d
mov ecx, dword [edi]
mov eax, 0xac2e0e0f
mov eax, dword [edi + 4]
call fcn.00cd0bfe

Function at 0x7f97fc
Capabilities:
Encode data using base64

Disassembly:
shl edx, 2
mov eax, ebp
mov dword [esp], 0xb63bf5a9
add eax, edx
mov dword [ebp - 4], eax
push 0xfda6ac98
test ebx, ebx
lea esp, [esp + 8]
je 0x81aaa9

Function at 0x7fa795
Capabilities:
Encode data using base64

Disassembly:
sub ebp, 2
jmp 0x843aea
mov word [ebp], dx
lea esp, [esp + 8]
jmp fcn.008924f9

Function at 0x7fd867
Capabilities:
Encode data using base64

Disassembly:
mov edi, dword [ebp]
jbe 0xd396f2
push ebx
call fcn.008f1a60
mov edi, 0xcd9e513d
sal di, 0x4e
jne 0x7f3008
mov dl, byte [edi]
mov eax, 0xcd23c180
movzx ax, byte [edi + 2]
call fcn.00d3711a
mov dword [esi], ecx
push 0x1c1640bc
not byte [esp + 2]
lea esp, [esp + 4]
jmp fcn.00ce6539
mov ebp, dword [edi]
push 0xc1850abb
call fcn.00cd7314
mov edi, 0x5919d707
lea edx, [edi*4 - 0x75d92b56]
lea ebp, [ebp + edi - 0x5919d708]
push edx
shl edi, 0x4f
movzx edx, byte [ebp]
inc word [esp + 2]
xor dl, bl
sal edi, 0x3a
dec dl
shl dword [esp + edi*2], 0xe2
xchg word [esp + edi + 1], di
neg dl
push edi
rol dl, 1
shl edi, 0xe4
add dword [esp + edi*8 - 0x1e617c], edi
not dl
call fcn.00d36fca
jmp 0x8d9cab
jmp 0x971613
sub esi, 4
jmp 0xcc050e
jmp 0x826b2e
push 0xa323fd03
add ebp, 4
mov dword [esp], edi
call fcn.00d18a36
add byte [eax], al
add byte [edi + 0x65], al
je 0xd3974f
jne 0xd39780
jb 0xd39775
outsb dx, byte [esi]
je 0xd39763
jb 0xd39784
arpl word [ebp + 0x73], sp
jae 0xd39763
add byte fs:[eax + 1], ch
mov al, 0x17
jmp 0x8782d1
add byte [eax], al
add byte [eax + 0xc], ch
jns 0xd39778
sub ecx, dword [ecx - 0x72ffdaac]
and al, 4
jmp fcn.00898cc0
jmp dword [esi + 3]
adc al, 0xb6
dec dword [edi]
test dword [esi + edx*8 - 0x7c990009], esi
clc
jmp 0x98f1b9
pop edx
invalid

Function at 0x81aa9e
Capabilities:
Encode data using base64

Disassembly:
jmp 0xcdf9d0
dec ebx
lea esp, [esp + 4]
jne 0x7f981f
jmp 0x85e717
call fcn.00840c30
mov eax, 0x8f8be89e
xor eax, eax
add eax, dword [ebp + ebx*4]
jmp 0x89c0da

Function at 0x864f10
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.008924f9

Function at 0x870e99
Capabilities:
Encode data using xor

Disassembly:
add al, 0xaa
push 0xda19e40b
xor al, 0x9a
inc al
xor al, 0x2c
dec al
xor al, 0x35
mov dword [esp + 4], 0x510461a8
inc al
xor al, 0x1c
ror al, 1
rol byte [esp + 5], 0xc6
not byte [esp + 7]
dec al
xor al, 8
ror al, 1
xor bl, al
jmp 0x9a1efe
mov dword [eax], edx
lea esp, [esp + 8]
jns fcn.00943d36
rol byte [ebx], 0x73
xor eax, 0x74f9cbb5
fbstp tbyte [edx]
sbb byte [esi - 0x12], ah
invalid
shr dword [esp + 3], 0x8b
lea eax, [esp + eax + 8]
jne 0x8d6d66
sysenter
call fcn.00d01291
invalid

Function at 0x873c84
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp + 4], eax
mov dword [ebp], edx
jmp 0xcfc9b0
lea esp, [esp + 4]
jmp fcn.008924f9
Function at 0x876839
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
adc esi, edx
mov edi, esp
jmp 0x8f7a5c
mov eax, dword [edx + 0x3c]
lea eax, [eax + edx]
cmp dword [eax], 0x4550
jmp 0x8ab791
ret
movzx ebp, dx
dec esi
xor esi, 0x62bde587
bswap esi
rol esi, 1
sal dl, 0x47
mov dword [esp + eax*2 - 0x465a932c], edi
and edx, 0x8a29580c
mov edx, 0
mov edi, ebp
mov dword [esp + eax - 0x232d4986], edx
ja 0x7fd9bb
je 0x89c140
mov eax, 0x5a4d
cmp bp, 0xa42b
cmp word [edx], ax
jmp 0x89c13a
mov eax, dword [ebp - 0xc]
not ch
test ecx, edx
ror cx, cl
mov ecx, dword [ebp + 0x10]
bt esi, 0x16
lea esi, [edi + ebx]
sar esi, 1
test dx, 0xa595
jmp 0x904c61
dec edi
test ebp, ebx
lea eax, [eax + edx]
cmp esi, esi
test bp, 0x5cb5
sub ebx, ebx
stc
cmc
mov dword [ebp - 0xc], eax
cmp esp, ebp
cmc
test edi, edi
jmp 0x8e626a
ja 0xcc9a52
mov eax, esi
cmp si, dx
sub eax, dword [ecx + edx + 0x10]
jmp 0x804ab6
je 0x808acb
sub eax, eax
movzx esi, dx
pop esi
jmp 0xd22f4a
jne 0x89c140
mov ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
clc
stc
test ecx, ecx
je 0x89c140
mov eax, dword [eax + 0x7c]
cmc
push ebx
test di, sp
push edi
test esp, edi
mov dword [ebp - 0x10], eax
test bp, si
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0x88cf5b
jl 0x88c366
jmp 0x87a448
lea eax, [edi + eax - 0x232d4a7e]
push ebp
mov eax, dword [eax + esi*4]
clc
push ecx
dec ecx
btr cx, ax
movzx ecx, ax
mov ecx, dword [ebp + 0xc]
add eax, edx
call fcn.009230cf
add esp, 4
cmp ah, al
cmp bp, 0x87ba
test eax, eax
jge 0xccdc7d
lea edi, [esi - 1]
jmp 0xd57eaa
test edi, edi
jmp 0xd19bbc
pop ebp
jmp 0x80aedd
mov edi, dword [ecx + edx + 0x18]
stc
jmp 0x90bbd1
jle 0x88c328
lea ebx, [esi + 1]
rcl edx, 0x85
cmp ebx, edi
mov dx, 0x2f02
mov edx, dword [ebp + 8]
jle 0x87a43e
mov ecx, dword [ebp - 4]
jmp 0xce4770
je 0x88c366
mov eax, dword [ecx + edx + 0x20]
jmp 0x88168e
mov esp, ebp
jmp 0x923d50
jmp 0xccdc89

Function at 0x87c4c5
Capabilities:
Encode data using base64

Disassembly:
push 0xad9d2880
mov ebp, dword [ebp]
mov dword [esp + 4], 0xd03b2c26
lea esp, [esp + 8]
jmp fcn.008924f9
Function at 0x87f1b4
Capabilities:
Encode data using base64

Disassembly:
adc edi, 6
mov byte ss:[ecx], dl
call fcn.00d22f01
mov dword [esp], 0xe01ad0ab
mov ecx, dword [edi]
xor word [esp], 0x1e16
mov dl, byte [edi + 4]
jae 0x881ddc
movsb byte es:[edi], byte [esi]
ljmp 0xf2
jae 0x82af00
adc dl, bh
fstp qword [ebp - 0x5da9332]
xlatb
not dword [ecx - 0x782b5375]
in eax, 0xac
dec ebx
not byte [eax + 0x6e3d0d2a]
lodsb al, byte [esi]
pop esp
movsb byte es:[edi], byte [esi]
xchg byte [esi], ah
movsd dword es:[edi], dword [esi]
fucomi st(1)
scasb al, byte es:[edi]
xor dword [ebx], 0x55
inc edi
pushal
sub byte [ebx + 0x69], bh
stc
mov dword [ebp + 0x499f1d5a], 0x212c23c
or dh, byte [ebx - 0x53]
sbb dword [edi], 0xffffff99
pop es
push esp
add al, cl
lds esp, [ecx]
mov eax, 0xd528cc8f
jecxz 0x881dbd
pop edx
adc edi, edx
dec esi
cmp byte [edx - 0x67], cl
mov ch, 0x1f
aas
adc eax, 0xd9eff31e
inc eax
mov dh, 0xc4
aas
je 0x881eb3
jmp 0x881ea0
sbb byte [eax], ah
inc esi
pushfd
mov ebx, 0xfbb23063
jl 0x881e70
dec eax
or eax, 0xdb51373f
and eax, 0x25c5fbdb
pop fs
int1
lodsb al, byte cs:[esi]
imul edi, eax, 0x5f
int3
in eax, dx
inc ecx
invalid
jl 0x881e6d
mov eax, eax
out 0, al
pop ds
jp 0x881e6d
mul edx
push ds
push 0xa3fdb63d
push 0x4ecee31c
int1
mov bh, 0xb3
ljmp 0x69e3

Function at 0x881d72
Capabilities:
Encode data using base64

Disassembly:
sbb edi, 2
jmp 0x9154ba
ja 0x862646
mov word [edi], dx
lea esp, [esp + 4]
jmp fcn.0081f416

Function at 0x888610
Capabilities:
Encode data using xor

Disassembly:
add esi, 1
xor dl, bl
ror dl, 1
mov dword [esp], 0x71840a00
push 0x751210ac
call fcn.008e3e9c
rcr ebx, 1
sal byte [ebx], 1
outsd dx, dword [esi]
fist dword [0xf7ba902d]
cmp eax, 0x64cb7ff6
xor dl, byte [ebp - 0x56]
mov al, byte [0xbfe76903]
pop ebp
add edi, dword [edi - 0x1e4c9d12]
mov bl, byte [eax + 3]
dec eax
cmp byte [edx + 0x452ad767], 0x5b
neg byte [ebx - 0x1d]
les ebp, [ebx + 0x379d276a]
pushfd
insb byte es:[edi], dx
or bh, cl
push 0x705fad60
mov ebp, dword [edi - 0x1b]
add dword [ebp - 0x6b331b27], eax
inc esp
fst qword [ebp - 0x1fd7b7e9]
push edx
dec edi
jle 0x888617
rcl eax, cl
retf 0x4c7
arpl ax, si
lea ecx, [ebx]
dec ebp
inc eax
xlatb
or ebx, esp
cmp ecx, edx
jbe 0x888702
and byte [esi + 6], al
and al, 0xac
stosb byte es:[edi], al
mov ebx, 0xc7f2a839
mov eax, dword [0xcf989cd5]
sub ah, byte [esi - 0x4fc1ba75]
std
dec ebp
les esp, [esi]
shr dword [ecx - 0x73], cl
test dword [esi + 0x48], eax
or dword [edx - 0x5e5bc968], 0x7cab6689
mov eax, dword [0x697ca7d1]
lahf
pop edx
stc
pop edx
xlatb
cmp eax, esi
mov al, byte [0x757aa442]
and eax, 0x36ff199b
outsb dx, byte [esi]
std
xchg edx, eax
ret 0x4fbf
bound esi, qword [ecx - 0x5ab2b939]
mov al, 0xcc
inc esp
pushfd
lds ebp, [ecx + 0x31]
pushal
sbb eax, 0x76f733f2
invalid

Function at 0x88d1f5
Capabilities:
Encode data using base64

Disassembly:
sub ebp, 2
mov word [ebp], ax
push 0xd0a93ea8
jmp 0x8a737c
dec ax
neg word [esp + 6]
xor bx, ax
jmp 0x82add0

Function at 0x899ba4
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x678db61c
sub ebp, 4
mov dword [ebp], edx
lea esp, [esp + 4]
jmp fcn.008924f9
Function at 0x89bddc
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jmp fcn.008924f9
sub ebp, 4
mov dword [ebp], edx
jmp 0x8991ef

Function at 0x8bf3f0
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], eax
lea esp, [esp + 8]
jmp fcn.008924f9

Function at 0x8cf55a
Capabilities:
Encode data using base64

Disassembly:
mov ebx, 0xd5bdba8e
push ebx
mov ebx, dword [esp + 0xc]
lea esp, [esp + 0x10]
jmp fcn.008924f9

Function at 0x8d2256
Capabilities:
Encode data using xor

Disassembly:
mov dh, byte [ebp + ebx - 0x3e280844]
and al, 6
mov eax, 0x7cc1fa03
and al, 6
enter 0xffffffffffffe38b, 0xffffffffffffffba
stosb byte es:[edi], al
imul edx, dword [0x6a55e853], 0xfffffffc
invalid
mov edx, 0x53156baa
call fcn.00898cab
mov eax, 0x7e249e32
movsx ecx, al
push eax
mov eax, dword [ecx + esi - 0x32]
movzx edi, cx
pop edi
lea esi, [esi + ecx*8 - 0x18c]
mov ebp, edi
mov edx, ebp
mov edi, eax
movsx eax, dx
sal ebp, cl
sub eax, ecx
mov ebp, esi
sub eax, 0x86a819bf
xor dl, 0xad
jno 0xd33aba
fbld tbyte [eax]
das
jl 0x8d22e4
popfd
in al, dx
sar dword [edi + eax*2], cl
jae 0x8d2309
scasd eax, dword es:[edi]
jo 0x8d2309
cld
je 0x8d22b2
mov eax, 0xb5eb6097
and al, 0xa
scasb al, byte es:[edi]
jbe 0x8d2238
or esi, edi
push edi
sub dh, byte [eax + ecx*2 + 0x534e21bb]
leave
sbb bh, byte [esi]
outsd dx, dword [esi]
and dword [esi], ebp
and dword [ecx + 0x565a1d01], edi
push esi
stosb byte es:[edi], al
mov eax, dword [eax - 0x64108f51]
popal
shl byte [ebp - 3], 1
in al, 0x5f
pop edi
xor ebx, ecx
jp 0x8d22bc
adc byte [eax + 0x19e9cbd1], dl
or dword [ebx], 0x6a9653c6
cdq
insb byte es:[edi], dx
sbb esi, dword [ebp - 0x40]
cwde
scasb al, byte es:[edi]
test eax, 0x8975695f
cmp byte [ebx], ch
pop ss
loopne 0x8d22fd
pop edi
imul esi, dword [ebp - 0x77], 0xe0172b38
adc ah, bh
cld
push 0xffffffffffffff97
invalid
lodsd eax, dword [esi]
add dword es:[esi], edi
mov ecx, 0xf0b6ee6b
jl 0x8d22cf
mov ecx, 0x5e2bf4c7
call 0xceb0e519
jne 0x8d2365
invalid
imul eax, dword [eax + 0x5f2cad35], 0x43b04c4d
mov dh, 0xf0
cli
and dword [edx], ebx
sub byte fs:[ebx + eax], 0x55
fbstp tbyte [ecx - 0x395d1b84]
dec ebx
pop esp
cmpsb byte [esi], byte es:[edi]
mov byte [0xa65c4bc6], al
pop ss
add al, 0x73
inc esp
mov al, byte [0x121507ef]
cmp dword [eax - 0x715811e0], 0x1b
out 0xc6, eax
pop esp
jno 0x8d23ba
lds edx, fs:[ecx + esi*4 + 0xeb0ddc]
in al, dx
insd dword es:[edi], dx
jo 0x8d2381
lahf
sbb eax, dword [eax - 0x44]
popfd
jnp 0x8d2379
stc
jnp 0x8d232c
sub byte [edx + 0x3fa7450e], ch
cmp al, 0x3e
mov al, byte [eax]
cld
add ah, bh
psubw mm0, mm7
mov eax, 0x11574ed2
xchg esi, eax
xchg esp, eax
xchg ebx, eax
scasb al, byte es:[edi]
pop ss
cmpsd dword [esi], dword es:[edi]
mov edi, gs
adc esp, dword [edx + 0x3351157]
mov byte [0x3351157], al
add dword [ecx - 0x69c14de7], eax
mov dl, 0x3e
xchg esi, eax
invalid
das
popfd
invalid
call fcn.00943d29
mov esi, eax
mov edi, ecx
xor dx, dx
setne dl
mov esi, ebp
mov dword [esp], 0x58544b4
pop ecx
jae 0x8d224c

Function at 0x8d92a0
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], edx
lea esp, [esp + 0xc]
jmp fcn.008924f9
Function at 0x8e0d59
Capabilities:
Encode data using xor

Disassembly:
mov cx, word [edx]
call fcn.0082ae68
inc esp
xor bh, ch
ret 0x84e2
call fcn.008655c8
mov edx, 0xf0c95a5
inc edx
mov edx, dword [edx + ebp - 0xf0c95a6]
jg 0xcc0954
insb byte es:[edi], dx
sbb byte [eax + 0x437354e6], al
adc byte [edx + 0x3b], dh
insb byte es:[edi], dx
clc
in al, 0x22
adc eax, dword [ebx + 0x8b89fe5]
in eax, 7
xor eax, 0xe3e4df07
pop ss
call 0x39b15353
push ds
insd dword es:[edi], dx
jg 0x8e0dc9
dec ecx
sbb al, 0xc3
in eax, 0x9f
or eax, 0x4e649a97
or esp, ebp
jg 0x8e0dee
and al, 0xf1
inc edi
sbb eax, 0x81950bce
repne cmpsd dword [esi], dword es:[edi]
pop ss
sbb dword [edi + 0x58], ebx
sti
test dl, cl
inc eax
inc edi
mov edx, 0x790bad34
mov al, cl
xchg edi, eax
push cs
dec eax
cmp cl, byte [ecx + 0x53cd54c2]
and dword [edx], edx
or eax, 0x69fe1b4
mov ah, 0xe1
lahf
push es
push eax
insd dword es:[edi], dx
or al, 0x9b
clc
or eax, 0xace7c468
add bl, byte [ebx + 0x470c7f0d]
mov ecx, 0x1d6a23f9
xor al, bh
sahf
push esp
jae 0x8e0dcb
mov al, 0x4a
add ebp, dword [ecx + eax*2 - 0x7f]
out 0xfd, eax
fiadd dword [edx]
push ecx
sub esp, dword [edx + 0x55]
js 0x8e0e28
ret
dec edx
scasd eax, dword es:[edi]
cmp al, 0xf
aad 0x1f
and eax, 0x9b6acb
xchg esp, eax
leave
jnp 0x8e0e27
sub bl, dl
invalid
mov ecx, 0xa89c3009
jno 0x8c4800

Function at 0x8e28bc
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [esp + 0x1c]
lea esp, [esp + 0x20]
jmp fcn.008924f9

Function at 0x8e3d6a
Capabilities:
Encode data using base64

Disassembly:
jmp fcn.0085eca6
push esi
ror dl, 1
inc esi
bswap esi
add dl, 0x1e
not word [esp + 2]
pop esi
rol dl, 1
inc esi
shr esi, 0xe
mov dword [esp + esi*8 - 0x89610], 0x6911cb9d
not dl
xor bl, dl
sub esi, 0x40995f36
lea edx, [esp + edx + 4]
jns 0x8deaab
push esi
jbe 0x917342
mov edx, 0x2b9150a4
movzx dx, byte [edi + edx - 0x2b9150a4]
mov ecx, 0xbc17a1a6
push ecx
mov byte [esp + 3], cl
mov cl, byte [edi + 2]
add edi, 2
not byte [esp]
shr dl, cl
mov word [edi], dx
lea esp, [esp + 4]
jmp fcn.0086d698
mov esi, dword [edx]
sub ebp, 4
not byte [esp + 7]
mov dword [ebp], esi
push 0x83aae627
lea esp, [esp + 0xc]
jmp fcn.008924f9

Function at 0x8e9a90
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp], ax
lea esp, [esp + 8]
jmp fcn.008924f9

Function at 0x8e9f36
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp], si
lea esp, [esp + 4]
jmp fcn.008924f9

Function at 0x8f4d3b
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov byte [esp + 6], 0x39
bswap eax
sub eax, 0x7367132
xor ebx, eax
sub ebp, 4
mov dword [ebp], eax
push 0xccb8e73a
lea esp, [esp + 0xc]
jmp fcn.008924f9
jmp 0x8e2d52