joyce8/EMBER2024-capa huggingface dataset:
Function at 0x217dd47
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], esi
push 0xef351e31
mov esi, 0xad886b27
sal dword [esp], 0x51
movzx esi, byte [edx]
xor esi, ecx
shl word [esp], 0xd
and esi, 0xff
mov esi, dword [esi*4 + 0x22ade48]
shr ecx, 8
xor ecx, esi
inc edx
xor ecx, 0x8802a23
or byte [esp], 0x90
dec eax
lea esp, [esp + 4]
jne 0x217dd4a
mov eax, 0x4a80d2bd
neg al
jne 0x22bce3e
dec edx
call fcn.0222e980
pop esi
push 0xdc172a93
inc byte [esp + 2]
not ecx
dec byte [esp]
mov dword [esi], ecx
push 0x6a016e86
sub edi, 4
mov edx, dword [edi]
xor edx, ebx
push 0x72bb9ab8
jmp 0x2270141

Function at 0x217e452
Capabilities:
Encode data using base64

Disassembly:
sbb ecx, 0xf7a47c20
pop edx
rol ecx, 1
dec ecx
shr ax, 0xef
not dx
bswap ecx
call fcn.01c5e8b2
mov ecx, 0x432908be
lea edx, [ecx*8 + 0x17972089]
mov ecx, dword [ebp + edx*2 - 0x61beccf2]
lea eax, [edx + 0x4b99fe1f]
shl dl, 0xe6
or ax, 0x3c85
mov dl, byte [ebp + edx - 0x30df663c]
sar al, 0x62
call fcn.022a5d40
cld
push edx
mov ecx, dword [edi + eax - 0x3e9500e]
sub eax, dword [esp + eax - 0x3e9500a]
xor ecx, ebx
sar eax, 0x9a
jp 0x1bbdbfc
dec edx
lea esi, [esi + ebp - 0x6d17a214]
dec eax
mov dword [esp + ebp - 0xa218], 0x51046711
sar bp, 0xc1
inc esp
xor esi, ebx
inc edx
xadd dword [esp + ebp - 0x6d17a216], ecx
jae 0x21fb68f
mov dword [0xd1431760], eax
pop ds
leave
jne 0x217e437
adc bl, byte es:[0xe1896281]
pop ss
sbb eax, 0xd3278f40
mov bh, 0x98
or eax, 0x36197407
push esp
adc dword [esi - 0x51], ebp
clc
aaa
scasd eax, dword es:[edi]
stc
sahf
push ss
inc dword [ecx + 0x38]
dec edx
sbb al, 0xb7
or dl, al
mov eax, dword [0x5a0667cc]
retf
jnp 0x1c087c1
push edx
and ah, ah
outsd dx, dword [esi]
pushal
push 0x55fc72c
mov dword [0xcf0052cd], eax
add byte [edi - 0x72d46beb], cl
mov dword [0x824b9f5f], eax
mov ecx, dword [esi]
push esp
arpl word [esi + ebp*4], bx
pop edi
lahf
dec ebx
or byte [ebx + 0x1c63540e], 0xae
js 0x21fb6ad
retf 0xccb2

Function at 0x21976a8
Capabilities:
Encode data using base64

Disassembly:
push edi
inc edx
xor dword [esp + ebp*4 + 0x18], ebp
dec edx
mov ebx, dword [esp + ebp + 0x18]
inc ebp
movsx ebx, bp
dec eax
mov dword [esp + edx - 0x7929fce8], 0x1716f49d
dec eax
arpl bp, bp
call fcn.022fd0fd
add ebp, eax
mov edx, dword [esi + ecx - 0x1bf4ff00]
push ecx
add cx, 0x43b4
movzx ax, byte [ecx + edx - 0x1bf442b4]
not dword [esp + ecx*2 - 0x37e88563]
mov edx, ecx
lea esi, [ecx + esi - 0x1bf442b2]
setg byte [esp + ecx - 0x1bf442af]
rol dword [esp + ecx - 0x1bf442a8], 0x3b
mov word [esi + ecx*2 - 0x37e88568], ax
sbb cx, 0xa1bd
call fcn.021e366f
stc
test ch, dl

Function at 0x21b0b1f
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esi + eax*2 - 0x61d5fdf6]
xadd dx, ax
add edi, ecx
mov dword [esp + edx - 0x295d3b13], 0x51864b13
mov edx, dword [esi + eax*2 - 0x61d5fbfa]
inc eax
xchg ah, al
jnp 0x1c5f227
sal eax, 0xff
rol cl, 1
call fcn.02303b76
mov eax, 0xc2372db1
sub ebp, 4
mov eax, dword [ebp]
mov ecx, 0xfc365d95
mov edx, ecx
xor eax, ebx
shl cl, 0x43
inc eax
neg eax
sub eax, 0x4c1aca2c
rol eax, 2
sal dx, cl
rol edx, 0xed
sar dl, 0x84
sbb eax, 0x9299ec17
ror eax, 3
rol dl, 7
and cx, 0x1720
jge 0x1d1df1d
Function at 0x21ca23b
Capabilities:
Encode data using base64

Disassembly:
push 0x52103b89
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x21c7184]
shr edx, 8
xor edx, ebx
inc ecx
inc word [esp + 2]
mov dword [esp + 4], 0x1411b287
xor edx, 0xd82956ab
sar dword [esp + 1], 0xfa
dec eax
call fcn.022e3c0a

Function at 0x21db925
Capabilities:
Encode data using base64

Disassembly:
and dl, 0x3c
xor ecx, 0x73bb411e
inc dl
inc al
sub ecx, edx
ror ecx, 1
bswap eax
add ecx, edx
bswap ecx
or al, dh
adc ecx, edx
inc dx
xor dl, dl
je 0x1b7ac15
call fcn.01ce5da7
mov ecx, dword [esi]
mov eax, 0x28aceca4
xor eax, eax
movsx edx, ax
lea esi, [esi + eax + 4]
sar edx, 0xcd
not ax
rol eax, 0x43
xor ecx, ebx
ror edx, 0x91
adc ecx, 0xbf24a40c
jmp 0x1c09ecf
neg cl
and ax, dx
sar al, 0x61
sbb cl, 0x34
neg cl
call fcn.01b4e144
mov edx, 0x599aa828
lea edi, [edi + edx - 0x599aa82c]
call fcn.01c35161
inc eax
mov dword [esp + edx - 0x17d5a6e], ecx
dec dx
ror eax, 1
sar cx, 0x21
xor ebx, eax
sal dword [esp + edx*4 - 0x5f569b4], 0x65
sub edx, 0xcd8e133f
add cx, cx
lea ebp, [ebp + edx*2 - 0x67de8e60]
push edx
mov dword [ebp + edx*2 - 0x67de8e5c], eax
shr dword [esp + edx*2 - 0x67de8e54], 0x9d
sub byte [esp + edx - 0x33ef4723], cl
mov edx, dword [edi + edx*2 - 0x67de8e5c]
movzx eax, cx
dec word [esp + eax*8 - 0x74fdb]
lea edi, [edi + eax - 0xe9f8]
ror cx, 7
xor edx, ebx
inc byte [esp + eax - 0xe9f3]
dec edx
not edx
bswap edx
bswap eax
sal ax, 0xe8
xor edx, 0x7fa492aa
not ecx
jmp 0x213988a

Function at 0x21dfaea
Capabilities:
Encode data using base64

Disassembly:
inc ecx
push ebp
dec ecx
add eax, 4
inc ecx
movzx eax, bl
inc ebp
mov dword [eax + eax*2 - 0x13e], esp
dec esp
mov dword [esp + eax*2 - 0x136], ebx
inc esp
mov esi, dword [eax + esi - 0x9f]
inc ecx
movzx edi, bx
dec eax
lea esi, [eax + esi - 0x9b]
sub byte [esp + eax*2 - 0x135], al
inc esp
xor esi, ebx
push edi
call fcn.01c2fbad

Function at 0x21e1443
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], edi
lea esp, [esp + 4]
movzx edi, byte [edx]
push 0x3d154f98
xor edi, eax
and edi, 0xff
mov edi, dword [edi*4 + 0x21685d8]
shr eax, 8
xor eax, edi
neg byte [esp + 1]
inc edx
push 0x120c202
xor eax, 0x9a307a7
dec ecx
lea esp, [esp + 8]
jne 0x21e144b
jmp 0x21e66a2
mov edi, 0x888667b1
pop edi
not eax
jmp 0x231b53c
mov dword [esi], eax
sub edi, 4
mov eax, dword [edi]
mov ecx, 0x748ace1f
xor eax, ebx
jmp 0x2078fb0
Function at 0x21ecb70
Capabilities:
Encode data using base64

Disassembly:
mov cx, word [ecx + edi - 0x572648a2]
mov ax, word [edi + 2]
add edi, 2
mov edx, 0x3b2076a3
neg dx
sal edx, 0x3a
not cx
not ax
push edx
jns 0x218fc0c
mov edx, dword [eax + esi - 0x4a3d4e87]
movzx ecx, ax
sub eax, 0x7b34411c
mov cl, byte [ecx + esi - 0x4e83]
and eax, eax
add eax, 0x6799a79b
lea esi, [esi + eax*2 - 0x6d456a06]
jno 0x22ea005
xchg byte [esp + 9], al
add esi, edx
mov edx, eax
ror dword [esp + 0xc], 0xa6
jae 0x230246e
mov edx, dword [ebp]
and dword [esp + 4], eax
mov ecx, dword [ebp + 4]
ja 0x22c4ae6
mov eax, 0x4a3d4e0f
rol al, 7
jb 0x21cf4d2
setb cl
not ax
lea ecx, [ecx + edx*8 - 0x15c82b5b]
jo 0x222fecd
jns 0x22758e4
movzx eax, dx
and eax, 0xd32fc7b0
xor ebx, ecx
add edi, ecx
dec edx
movsx ecx, dl
ror edx, cl
mov dx, word [eax + ebp - 0xc480]
jne 0x2324089
mov ecx, 0xc2100123
sar ecx, cl
push ecx
mov dx, word [edi]
mov byte [esp], ch
mov ax, word [edi + 2]
jp 0x22b6db9
sub edi, 4
mov eax, 0xe9158191
movzx ecx, al
mov ecx, dword [edi + ecx - 0x91]
neg al
sar eax, 0xa5
xor ecx, ebx
movzx edx, al
rol al, 7
dec ecx
not ecx
xor eax, edx
rol eax, 0xaa
bswap ecx
jp 0x2286ff0
inc esp
mov ebp, dword [esi]
inc ecx
mov ecx, 0x83800c37
inc ecx
movsx ecx, cx
dec eax
lea esi, [ecx + esi - 0xc33]
call fcn.01cf6005
pop edx
inc eax
call fcn.020eea19
mov ecx, 0x572648a2
jmp 0x1cdbad5
shr edx, 0x88
bswap eax
call fcn.01bbc24b
mov edx, ebx
call fcn.022fec3a
neg edx
xor edx, 0x473ff3b2
neg edx
mov ecx, dword [esp]
sal dword [esp + ecx - 0x58f87b9], cl
xor ebx, edx
rol ecx, cl
add ebp, edx
ror word [esp + ecx - 0x720b1f0f], cl
shl byte [esp + ecx - 0x720b1f0e], 0x82
call fcn.02311cea
invalid
sbb ax, 0x2f90
not ax
xadd dl, cl
or dl, 0xa2
inc ax
xor bx, ax
or edx, edx
shl ecx, 0x70
or ecx, ecx
lea esi, [esi + edx - 0xb1]
neg edx
mov word [esi], ax
or ecx, ecx
call fcn.02280eb3
call fcn.021c9a32
mov eax, dword [esi]
add esi, 4
mov ecx, 0x21973a9a
inc cx
dec cx
xor eax, ebx
ror ecx, 0x39
and cx, cx
movzx edx, cx
xor eax, 0xb0ea02
not dl
shr cl, 0xa1
sets cl
ror eax, 3
xor eax, 0x8834d100
xor ecx, ecx
neg eax
ror eax, 2
jmp 0x224c812
adc ebp, 4
add edx, ecx
movsx ecx, byte [esp + 4]
mov dword [ebp + ecx*4 - 0x160], edx
add ax, 0xd58a
mov dword [esp + ecx*8 - 0x2c0], esi
ret 0xc
shl dword [esp + edx - 0x40000000], 0xb9
dec dword [esp + edx*2 - 0x80000000]
neg eax
ror ecx, 0x55
or dl, dh
rol eax, cl
sal edx, 0x1d
jp 0x22c2e8d
xadd ecx, eax
mov ax, word [ebp + ecx*8 - 0x62206]
lea ebp, [ebp + ecx*2 - 0x18880]
je 0x1bc79a0
sal ecx, cl
xor byte [esp + ecx*2 - 0x31101], 0x23
adc dx, ax
mov word [ebp + ecx - 0x18882], dx
ror dword [esp + ecx - 0x18882], cl
lea eax, [ecx - 0x63c206f9]
mov dword [esp + ecx - 0x18882], edi
ret

Function at 0x21f2933
Capabilities:
Encode data using base64

Disassembly:
test ebx, ebx
lea esp, [esp + 4]
je 0x222573d
mov eax, 0x79acc224
push 0x902ab68f
call fcn.01d1c124
Function at 0x21fb110
Capabilities:
Encode data using base64

Disassembly:
pop edx
pop ecx
jl fcn.022a833e
mov dword [esp + ecx*2 + 0x49da96be], ebp
ret
add esi, 2
push 0xdb12b4a1
mov edx, dword [esp + 4]
add ax, cx
pop ecx
not dword [esp + ecx + 0x24ed4b5f]
mov word [ecx + esi + 0x24ed4b5f], ax
add dl, byte [esp + ecx*2 + 0x49da96c0]
jne 0x217c535
bswap eax
inc edx
and edx, 0xb1826c31
rol eax, 1
inc ecx
xor ebx, eax
dec dl
mov dword [esp + ecx*2 - 0x2eecc2], 0x8b0eb30d
xor dword [esp + edx*2 - 0x410489fa], ecx
adc esi, eax
or dl, 0x90
mov bp, word [edx + ebp - 0x208244ff]
rol byte [esp + edx - 0x208244f9], cl
js 0x1b874ee
mov edx, 0x730cbd18
lea edi, [edx + edi - 0x730cbd1c]
movsx eax, dl
mov edx, dword [edi + eax*2 - 0x30]
xor edx, ebx
movzx ecx, al
shr cx, 0xc1
adc cx, cx
ror edx, 2
sub edx, 0xe2399ab3
ror eax, cl
sal ecx, 0x66
xor edx, 0xd608a4bd
neg edx
push ecx
xor ebx, edx
add ebp, edx
mov ax, word [ecx + esi - 0x600]
not word [esp + ecx*2 - 0xbff]
sub dword [esp + ecx*2 - 0xc00], 0x5dbb63b2
sbb ecx, dword [esp + ecx - 0x600]
mov cx, word [esi + ecx - 0x5cbb70af]
jno 0x21ad349
add byte [eax], al
inc edi
je 0x21fb1ff
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
inc esp
popal
je 0x21fb229
add bh, dh
fcomp dword [ecx - 9]
fld dword [edx + 3]
ret 0x8c8d
xchg edx, eax
ret 0xf41
add al, 0
add byte [eax], al

Function at 0x220522b
Capabilities:
Encode data using base64

Disassembly:
movzx edx, byte [ebp + ecx*2 - 0x1400800]
shl ecx, 0x77
dec cx
neg cx
xor dl, bl
mov dword [esp + ecx - 1], ecx
neg ecx
neg dl
call fcn.021d92da

Function at 0x220524b
Capabilities:
Encode data using base64

Disassembly:
inc dx
inc sp
add esi, edi
xor ebp, 0x5896cdb2
sar di, 0xa6
inc ecx
movsx ecx, dx
bswap ebp
call fcn.01d17fd6
bswap edx
call fcn.022c3b49
ror ebp, 3
inc esp
mov esp, edx
add di, 0x17a1
dec ebp
inc cx
dec ebx
ror ebp, 1
inc ebp
movsx edx, sp
dec ebp
jmp 0x1bea406

Function at 0x2225721
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov eax, dword [ebp + ebx*4]
mov dword [esp], eax
push 0x6d945184
sar byte [esp + 1], 0xe5
dec ebx
lea esp, [esp + 4]
jne 0x21f293f

Function at 0x223357c
Capabilities:
Encode data using xor

Disassembly:
add eax, dword [esi + eax]
dec ecx
lea edx, [ecx + 0x1b10a80a]
lea esi, [ecx + esi - 0x3b]
inc dx
xor eax, ebx
inc eax
bswap eax
rol cl, 0x26
lea eax, [eax + ecx*2 - 0x4493e636]
jb 0x21a52dc
sub ecx, eax
adc dx, 0xd425
shl cl, 0x26
pop ecx
sbb eax, eax
xor dx, ax
not eax
mov ecx, eax
and cl, al
neg dx
xor bx, dx
ror eax, 0xec
lea ebp, [ebp + eax*4 - 2]
adc cl, 0x84
sal cl, cl
mov word [ebp + eax*4], dx
jne 0x1c4c09c
Function at 0x223c8ce
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
call fcn.01d0e713
sub byte [esp + eax*2 + 4], ch
add ebp, edx
neg dword [esp + eax + 3]
xor dword [esp + eax*8 - 4], eax
rol al, 0x81
mov ecx, edi
adc dword [esp + eax*8 - 0xc], eax
lea edi, [edi + eax - 6]
xchg ah, al
push eax
movzx edx, word [esp + eax - 0x200]
mov dword [edi + eax*4 - 0x800], ecx
sbb eax, 0xee11cd97
pop edx
pop edx
pop eax
jns fcn.021f6ccb
mov ecx, 0xb99375a6
mov ecx, dword [esi]
mov edx, 0x522e83bc
lea esi, [esi + edx - 0x522e83b8]
rol dx, 0xa5
jae 0x1b6f121
pop eax
leave
inc edi
push esp
mov dword [edx - 0x1455ccec], edx
jmp 0xdacdfc7a

Function at 0x2247aba
Capabilities:
Encode data using base64

Disassembly:
sar dword [esp + 0xb], 0x3f
pop eax
pop ecx
pop edx
pop edx
jp fcn.01c19045

Function at 0x22524de
Capabilities:
Encode data using base64

Disassembly:
lea eax, [edx + edx*8 - 0x3b7fe8f3]
lea esi, [esi + eax - 0x43a53040]
jp 0x22660d2
not ecx
mov dword [esp + 4], 0x35b1c2bb
bswap ecx
mov edx, dword [esp + 4]
sal word [esp + edx*2 - 0x6b638570], 0x84
neg ecx
or dword [esp + edx - 0x35b1c2b9], edx
shl edx, 0xa1
lea eax, [edx*2 + 0x7897cb97]
lea ecx, [edx + ecx + 0x53b953ac]
ror ecx, 3
xor ebx, ecx
jmp 0x229c10f
xor ecx, ebx
mov dword [esp + edx - 0x47041f3f], 0x372c4a86
neg ecx
jmp 0x229629a
rol ecx, 2
not ecx
rol ecx, 1
not dword [esp + eax - 0x43a53044]
pop eax
xor ebx, ecx
xor eax, eax
shl edx, 0x9f
add edi, ecx
movsx ecx, al
xor eax, edi
jmp eax
call fcn.01cfa9e7
mov edx, 0xcba464a2
mov ax, word [esi]
mov ecx, edx
add esi, 2
sub cl, dh
jo 0x1b6f143

Function at 0x22635ae
Capabilities:
Get number of processors

Disassembly:
bswap edx
xor edx, 0xd6b8e20f
neg edx
call 0x1c3943f
push ebp
mov ebp, esp
cmc
cmp eax, 0xb50ec71f
clc
sub esp, 0x10c
cmc
push ebx
push esi
cmc
push edi
mov edi, eax
jmp 0x219f64f

Function at 0x2270617
Capabilities:
Encode data using base64

Disassembly:
push ecx
not edx
not ax
mov dword [esp + ecx*4 + 4], ecx
lea edx, [eax + edx - 0x7f85be6d]
dec al
xor ebx, edx
xadd dword [esp + ecx*2 + 2], ecx
lea eax, [ecx + ecx*2 + 0x12098dbd]
ror cx, 0x2f
adc ebp, edx
call fcn.020e34f4
lea eax, [eax + ecx*2 - 0x697451a6]
neg ecx
neg eax
inc edx
cmovle dx, cx
not eax
bswap ecx
bswap eax
xor ebx, eax
add ebp, eax
not edx
mov eax, dword [ecx + esi - 0x39b1dfff]
inc cx
call fcn.022d258d
Function at 0x2270b03
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
jle 0x1cff1c9
not ecx
dec dl
inc ecx
call fcn.021091bb
mov edx, 0x48a0753d
sub dx, dx
movzx eax, dx
or eax, dword [esi + eax*4]
lea edx, [edx + edx*2 + 0x3b0f4d26]
lea esi, [edx + esi - 0x14ef4d22]
and dx, dx
push edx
xor eax, ebx
mov ecx, 0xc016423c
lea eax, [eax + edx*4 + 0x63d51026]
and ecx, 0xb5123786
je 0x21e82ab
bswap eax
lea eax, [eax + edx*2 + 0x7939dbc2]
pop ecx
ror eax, 2
dec edx
xor eax, 0x8d992025
shr cx, 0x6c
xor ebx, eax
or dx, cx
xadd cl, dl
adc ebp, eax
movzx eax, cl
xor ax, cx
mov edx, dword [edi + edx - 0x14ef4d04]
jae 0x22f95a3
jmp 0x1c46fce
not dx
movzx ecx, al
and cl, cl
add al, 0x9e
mov word [ebp + eax - 0x4469e], dx
sal cl, 0x85
not cl
mov ecx, dword [esi + eax - 0x4469e]
lea esi, [esi + eax - 0x4469a]
movsx edx, al
or dx, ax
xor ecx, ebx
push edx
shr edx, 1
lea ecx, [ecx + eax - 0x31a8a1b7]
ror ecx, 2
dec dx
jle 0x1bdd2bf
not ax
bswap edx
mov dword [esp + 0xc], eax
sal dword [esp + 0x14], 0x90
ror edx, 1
pop ecx
dec al
xor edx, 0x9496ada2
xor ebx, edx
pop ecx
add ecx, 0x48c918
jmp ecx
adc esi, 2
add cx, dx
call fcn.01bee20a
mov dx, word [ebp]
mov eax, 0x583b5118
sal eax, 0xd3
movzx ecx, ax
add cx, word [ebp + ecx*4 + 2]
add ebp, 2
rol eax, 0xf3
and dx, cx
jmp 0x20ea84e
inc cx
xor ax, word [ecx + edi - 0x14ef0026]
lea ecx, [ecx - 0x374d42ed]
bswap ecx
lea edi, [edi + ecx - 0x3dbda1d7]
shr ecx, 0xac
mov word [edx + ecx - 0x3dbda], ax
jmp ebp

Function at 0x2271091
Capabilities:
Encode data using xor

Disassembly:
dec cl
mov dword [esp + eax - 0x68917708], eax
ror cl, 1
or ax, ax
mov dword [esp + eax - 0x68917704], 0xc89d5403
mov edx, eax
inc cl
or eax, 0xce8a97a2
sbb eax, dword [esp + edx - 0x68917708]
inc ax
neg cl
jmp 0x2176fdb

Function at 0x227646a
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, eax
call fcn.021b9d94
mov dword [esp], ebx
mov ebx, 0x961bb48a
movzx ebx, byte [edx]
jmp 0x226ed2a
Function at 0x2278178
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x76870db7
shr edx, cl
mov dword [esi + eax*2], edx
call fcn.01bd2be5
mov ax, word [ebp]
mov ecx, 0x703d199d
movzx edx, cx
jmp 0x1be9742
lea ebp, [ebp + ecx - 0x703d199b]
xor edx, edx
movzx ecx, byte [esi + ecx - 0x703d199d]
lea esi, [esi + edx*2 + 1]
xor cl, bl
xor edx, edx
not dl
sbb cl, 0x3d
neg cl
call fcn.01be1fd0
mov eax, 0x85388f9e
movzx edi, al
mov edx, edi
mov esp, ebp
call fcn.02266cff
mov eax, 0x66097b03
lea edi, [eax + edi - 0x66097b07]
lea ecx, [eax*2 + 0x42564ac]
mov ecx, dword [eax + edi - 0x66097b03]
jmp 0x22cb76c
xor ebx, ecx
add esi, ecx
mov ecx, dword [ebp + edx*4 - 0x3fc]
shr byte [esp + edx - 0xff], 0xe7
mov eax, dword ss:[ecx + edx*4 - 0x3fc]
push edx
lea edx, [edx + edx*4 - 0x2ae59c46]
mov dword [ebp], eax
sub edx, dword [esp + 2]
dec byte [esp + 3]
pop edx
pop ecx
add ecx, esi
jmp ecx
neg cx
mov edx, dword [ecx + edi - 0xc01dcd3]
xor edx, ebx
rol cx, 0x4a
jae 0x22a6892
shr cx, 0xc
bswap edx
lea edx, [edx + ecx*2 + 0x4b06300a]
call fcn.020ff9a1
mov ecx, dword [esp + 4]
call fcn.01bab8a5
call fcn.02275093
lea ecx, [ecx + eax*2 - 0x8f56944]
not ecx
dec dl
call fcn.020aaecc
mov ecx, 0xc01232d
movsx eax, cl
lea edi, [edi + ecx*8 - 0x6009196c]
jmp 0x2162298
sub eax, eax
jae 0x1be127b
mov eax, dword [0xc7431e57]
fiadd word [edi - 0x7b63fa6f]
xchg esi, eax
cmpsb byte [esi], byte es:[edi]
invalid
lea edx, [eax + 0x761d5805]
xor ecx, ebx
bswap eax
sub eax, eax
xadd eax, edx
lea ecx, [edx + ecx + 0x25015495]
shl ax, 0x4d
push edx
ror ecx, 1
neg dword [esp + edx]
neg ecx
dec dl
and ax, 0x35a9
adc al, 0x12
dec ecx
ror ecx, 2
bswap ecx
jmp 0x1c1ed4c

Function at 0x227c42a
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [ebp + edx - 0x5708]
jl 0x1c09fb3
arpl bp, di
pushal
aas
clc
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
invalid
adc edx, dword [ecx - 0x364b1f24]
fidivr dword [edi - 0x6901a0ad]
cld
les ebp, [esi - 0x576c9f27]
push edi
sbb ebp, dword [edx + 0x4e]
sub bl, byte [ebx - 0x6d]
cwde
insd dword es:[edi], dx
jle 0x1c5390a
pop ss
and cl, al
and dword [edi], ebx
salc
lodsb al, byte [esi]
dec ebx
xchg edi, eax
retf 0x45a7
jle 0x1c539c0
scasd eax, dword es:[edi]
test al, 0xfd
lea esi, [esi - 0x50]
stc
or ebp, dword [ebp - 0x421479b1]
rol dh, 0x86
test al, 0x36
daa
or esp, esp
stosd dword es:[edi], eax
in eax, dx
dec edi
mov cl, 0x24
pop ss
mov al, 0x82
scasd eax, dword es:[edi]
sbb dword [ebp + 0x23], ebp
scasb al, byte es:[edi]
jb 0x1c53946
das
cdq
inc ebx
add ebp, esp
fucomi st(2)
cdq
mov dword [0x4681e2fc], eax
xor ah, al
ljmp 0x8442
call fcn.021854e0
mov ecx, 0xf78fab86
add ecx, ecx
movsx eax, cl
mov eax, dword [ebp + eax*8 - 0x60]
movsx edx, cx
jb 0x1be0639
push cs
push 0x21bf309
ljmp 0x33
Function at 0x2280072
Capabilities:
Get number of processors

Disassembly:
jmp 0x22b3500
xor ebx, ecx
sar edx, 0x43
add ebp, ecx
mov dword [esp + edx + 2], eax
sar byte [esp + edx*2 + 2], 0x63
setb byte [esp + edx*4 - 4]
mov dl, byte [edx + esi - 2]
xor al, byte [esi + 2]
mov ecx, dword [esp + 3]
or ecx, ecx
adc esi, 2
xchg word [esp + 5], cx
add dl, al
rol dword [esp + 4], 0xb4
xchg byte [esp + 5], ch
mov word [esi], dx
jb 0x22a3e9b
add cl, byte [esp + ecx - 0x1500]
lea edx, [ecx + 0x60b2359b]
mov dword [esp + ecx*4 - 0x5400], edi
ret 4
lea ecx, [ecx + edx + 0x2c026b96]
push eax
sar dl, 7
cmovb eax, edx
not ecx
not dx
bswap edx
ror ecx, 1
xchg edx, eax
sub dl, 0xe
bswap ecx
not edx
jae 0x21b30a0
jmp 0x218aa25
not eax
xor ebx, eax
xchg byte [esp + ecx*2], ch
add edi, eax
jmp 0x226570e

Function at 0x22802c2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc48cc480
mov eax, dword [ebp]
mov ecx, 0xe98e6b28
sub ecx, ecx
lea edx, [ecx - 0x58ccfef2]
push ebx
and ecx, 0x10a7f620
call fcn.0227a3cf
mov dword ss:[eax + ecx*2 - 0x4d7b931e], edx
mov eax, dword [esi + ecx*2 - 0x4d7b931e]
movsx edx, cx
and ecx, 0xa90a612a
pop ecx
adc esi, 4
bswap edx
xor eax, ebx
or edx, edx
lea ecx, [edx + edx*8 - 0x1bc964e4]
sar edx, 0xd6
adc eax, 0x9b4c7b4
call fcn.022ee9bb
jmp 0x228f17a
jmp 0x1b6b6e2

Function at 0x2286da5
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x993b9732
add eax, 0x4121b482
call fcn.01c4ee03
xor dl, dh
call fcn.01cdcb0b
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
mul ecx
mov dword [ebp], edx
mov dword [ebp + 4], eax
mov ecx, dword [esi]
mov edx, 0xca27cf1c
ror edx, 0xe1
lea esi, [esi + edx - 0x6513e78a]
call fcn.021e8cc5
jmp 0x1d1f98e
lea eax, [eax + ecx - 0x70ab85bd]
sbb cl, ch
rol ecx, 0x35
adc cl, cl
rol eax, 2
xor eax, 0x5e81fa8d
ror eax, 2
not dl
xor edx, 0x533e4c85
neg cl
xor ebx, eax
and dl, cl
adc esi, eax
mov edx, dword [ecx + ebp - 0x2fc000dd]
movzx eax, cx
add cl, ah
mov cx, word [ecx + ebp - 0x2fc000d9]
lea ebp, [ebp + eax*2 - 0x1b4]
mov word [edx + eax*2 - 0x1ba], cx
jmp esi
ror edx, 1
not al
sar eax, 0x88
jp 0x2184b5e
movzx edx, ax
mov word [edx + ebp - 0xff94], cx
lea ecx, [edx + eax*8 - 0x69c55bcd]
sal eax, cl
and dl, 0x30
mov ecx, dword [edi + edx - 0xff10]
lea edi, [edi + edx - 0xff0c]
xor ecx, ebx
sub edx, 0x332f393b
sub ecx, 0x19864233
jmp 0x22b3ec8
mov edx, dword [ecx + edi - 0xf64a000]
mov dword [esp + eax - 0xf64a12c], 0xa1a76c93
xadd byte [esp + eax*2 - 0x1ec94258], cl
lea edi, [edi + eax - 0xf64a128]
sar cl, 0xe1
or cx, 0x13bd
xor eax, 0x6da95436
xor edx, ebx
rol cx, 0x45
pop ecx
xor al, cl
xor edx, 0x7b0e2119
dec ecx
jne 0x1d1104b
mov edx, dword [edi]
call fcn.01bc78af
mov ecx, 0x8e185f0a
sub edi, 4
shr cx, cl
lea edx, [ecx*8 - 0x59561ee6]
movsx eax, dx
mov eax, dword [edx + edi - 0x1769e1d2]
dec ecx
sub ecx, ecx
xor eax, ebx
bswap ecx
xor cx, 0x8907
js 0x1cf1dad
jmp 0x1c4fcb4

Function at 0x228791d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not edx
not ecx
not eax
push edx
ror edx, 0xb7
and ecx, eax
xadd word [esp + 0xa], dx
call fcn.01b83fcc
Function at 0x228bb94
Capabilities:
Encode data using base64

Disassembly:
add ebp, eax
movsx eax, cl
jmp ebp
pop eax
jg fcn.022a833e
call fcn.01b7ac86
and ax, cx
bswap edx
xchg cx, ax
lea ecx, [ecx*8 + 0x3ca16485]
xor ebx, edx
push eax
add esi, edx
movzx edx, byte [esp + ecx*2 - 0xc92f8fa]
call fcn.01cf15c8
not cx
bswap edx
sub cx, 0x2f90
xchg al, dl
xor eax, eax
not cx
rol ax, 0xa1
inc cx
xor bx, cx
push eax
sal ax, 0xcd
ror edx, 0x48
lea esi, [esi + eax*8 - 2]
xor eax, 0xc960301
sar edx, 0xc2
and eax, dword [esp + eax*8 - 0x64b01808]
mov word [esi + eax*2], cx
lea ebp, [ebp + eax - 4]
mov ecx, 0xa09cc708
sub byte [esp + eax], ch
add eax, dword [ebp + eax]
add byte [esp + edx + 3], dl
add edx, 0xd1ad293a
xor eax, ebx
neg dl
call fcn.0226a140
neg eax
not eax
or ecx, 0x85b2d807
xor ebx, eax
jmp 0x1b5a598
movzx ax, byte [edx + eax*2 - 0x787283b0]
shl cl, 0xa5
mov dword [esp + ecx - 0x300], ecx
or dword [esp + ecx - 0x300], ecx
lea ebp, [ebp + ecx*8 - 0x1802]
mov word [ebp + ecx*2 - 0x600], ax
movsx eax, word [esp + ecx*2 - 0x600]
jae 0x2195ad0
call fcn.01b33d78
sub edx, 0xd18bf416
bswap edx
movzx eax, cl
jmp 0x226faab

Function at 0x229c0d6
Capabilities:
Encode data using base64

Disassembly:
push dword [esp + 8]
popfd
mov esi, dword [esp + 0xc]
call fcn.01bdf4a1
mov ecx, 0x16a4868b
mov eax, dword [edi + ecx - 0x16a4868b]
rol cx, cl
lea edi, [edi + ecx*4 - 0x5a9170cc]
lea edx, [ecx*4 - 0x34f8ec9]
xor eax, ebx
lea eax, [ecx + eax - 0x5e64375d]
call fcn.023095d3

Function at 0x22a301d
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
xor ecx, ebx
sub dl, dh
inc ecx
not ecx
sal dx, 0x43
bswap ecx
mov eax, 0xd08cb7b8
dec ecx
mov dword [esp], edx
pop eax
xor ebx, ecx
dec ax
dec eax
add ebp, ecx
rol dl, 2
and edx, eax
rdtsc
sbb esi, 8
push 0x5213f694
call fcn.02217012

Function at 0x22ae736
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
xor eax, 0xb5813e3a
jmp 0x21421da
xor ecx, ebx
mov dword [esp + edx*2 - 0x48], 0x319cd1b1
xchg edx, eax
sar al, 0xa7
rol ecx, 1
sar eax, 0xb3
sbb ecx, 0xa10b2a0e
call fcn.0231eace
mov eax, dword [esi]
mov edx, 0x7c9ffc2a
lea ecx, [edx + edx*8 - 0x7cef69f2]
lea esi, [edx + esi - 0x7c9ffc26]
xadd dl, cl
jp 0x222b330
mov edx, 0x54b48588
jmp 0x1c46eb1

Function at 0x22be006
Capabilities:
Encode data using base64

Disassembly:
sar ax, 0x45
shr dl, cl
mov word [eax + ebp - 0x27b], dx
rol ax, 0xc8
movzx edx, al
mov dword [esp + eax*4 - 0x1ec08], edi
ret
inc dword [esp + ecx - 0x6983b33]
not edx
lea edx, [edx + ecx*8 + 0x6d6b98d0]
add ecx, ecx
mov dword [esp + ecx - 0xd30766e], ecx
pop ecx
xor ebx, edx
add edi, edx
movzx edx, cl
sar cl, 0x45
mov dl, byte [ebp + ecx - 0xd307603]
add byte [esp + ecx - 0xd307603], 0x89
adc ecx, 0x5db8088a
sbb ax, word [esp + eax*8 - 0x2802f]
mov cl, byte [ebp + eax - 0x4fb4]
shl al, 0x23
add al, al
jbe 0x231732d
push ebx
mov edx, 0x9aa578b9
movsx ecx, dl
cpuid
sub ebp, 0xc
mov dword [ebp + 0xc], eax
call fcn.022d5c68
lea ebp, [ebp + eax*8 - 0x27afe]
rol byte [esp + eax*2 - 0x9ebe], 0xe4
jp 0x22ac43e