joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12076e4
Capabilities:
Encode data using base64

Disassembly:
jb 0x1014c56
lea ecx, [edx + ecx + 0x30ce3c68]
mov dword [esp], edx
push eax
bswap ecx
btc ax, ax
xor edx, eax
xor ebx, ecx
add edi, ecx
pop eax
xchg byte [esp + edx - 0x7f27d8b2], dh
mov edx, dword [edx + ebp - 0x7f27d8b4]
shr dword [esp], 0x4e
mov eax, dword [ebp + 4]
mov ecx, 0x588bd68c
sar cx, cl
mov cl, byte [ecx + ebp - 0x588bfff5]

Function at 0x1208a03
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x10]
je 0x18eb93f
mov eax, dword [ebp + ebx*4]
jmp 0x1025041
mov eax, dword [ebp]
jmp 0x191b260

Function at 0x1208ec2
Capabilities:
Authenticate hmac

Disassembly:
jbe 0x10151ff
dec eax
mov dword [esp + ecx - 0x34], edx
inc ebp
xor al, dh
inc ecx
not dl
not byte [esp + ecx*2 - 0x67]
movzx eax, byte [esp + ecx*2 - 0x68]
inc ebp
sub al, dl
dec eax
inc dword [esp + ecx*2 - 0x68]
dec eax
xadd eax, ebx
inc ebp
xor al, dl
call fcn.018f191c

Function at 0x120de64
Capabilities:
Encode data using base64

Disassembly:
push 0x8d944ab2
mov dword [ebp + 0xc], eax
mov eax, 0x840da29c
neg eax
mov dword [eax + ebp - 0x7bf25d5c], ebx
mov dword [ebp + eax - 0x7bf25d60], ecx
mov dword [ebp + eax - 0x7bf25d64], edx
mov edx, dword [esp + eax - 0x7bf25d64]
mov ebx, dword [esp + eax - 0x7bf25d5c]
xchg dword [esp + eax - 0x7bf25d64], edx
pop edx
pop ecx
pop eax
jne fcn.0121e846
lea esp, [esp + 0x18]
jne 0xfa6945
mov eax, 0xb4189987
lea ecx, [eax*4 + 0x198ff35]
pop esi

Function at 0x121fb7c
Capabilities:
Encode data using base64

Disassembly:
jb 0x194cb48
dec edx
lea eax, [ecx*4 - 0x35e5c95d]
neg edx
sar ax, 0xa1
pop eax
bt eax, eax
xor ebx, edx
jmp 0x1211fa9
xor edx, 0x979aa684
inc byte [esp + 9]
dec eax
push 0xfe8a25a4
jmp 0x120dea6

Function at 0x122441d
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
sub ebp, 0x838d9e91
neg ebp
inc ecx
push ecx
cbw
or word [esp + 0xc], 0x1f01
dec esp
mov dword [esp + 8], esi
not word [esp + 4]
inc ecx
push edx
sar byte [esp + 0xd], 0xe6
xor dword [esp + 0x10], ebp
dec eax
idiv dword [esp + 8]
dec eax
or dword [esp + 7], edx
dec esp
mov esi, dword [esp + 0x10]
movsx ecx, al
inc cx
xchg edx, edx
inc ebp
movzx eax, dx
dec eax
arpl bp, bp
dec edx
inc dword [esp + eax - 0x6d59]
dec eax
adc esi, ebp
inc ecx
movzx ebx, al
inc edx
movzx edi, word [esp + eax - 0x6d57]
shr edx, 8
mov dword [esp], 0x80ac8b94
xor edx, edi
push 0x5201dba
inc ecx
push 0xd6290bb1
mov dword [esp + 0xc], 0x683ccb0
xor edx, 0x9401aa25
jmp 0x19110a1
dec eax
call fcn.00feefe6
dec edi
pop eax
pop es
mov dword [0x30427bc8], eax
sub ebx, dword [eax - 0x7fec4e55]
mov ch, 0xee
xor bh, ah
out dx, eax
mov edx, 0xf316a0ab
dec esp
lea esp, [edx - 0x1c71e9f3]
inc esp
movsx ecx, dl
dec ecx
sub ebp, 4
inc cx
btc esp, edx
inc ecx
mov ebp, dword [ebp]
inc ecx
push esp
inc ecx
xor ebp, esi
inc ecx
movsx eax, cl
dec eax
lea eax, [eax*4 - 0x6f44f7cf]
dec eax
shl dword [esp], 0xfc
rol ebp, 2
dec ebp
inc esp
movsx edx, byte [esp + 3]
neg ebp
dec ecx
shl esp, 0x46
dec esp
or edx, eax
inc ecx
not cl
rol ebp, 2
dec word [esp]
jle 0x1063d32
Function at 0x122878e
Capabilities:
Encode data using base64

Disassembly:
dec ecx
bts edi, 0xb5
inc edx
movzx ebp, byte [esp + ecx - 0x2d23]
inc ecx
xor eax, 0x7a33df01
inc ecx
rol eax, 1
inc ecx
inc eax
inc ecx
imul edx
dec esp
mov dword [esp + ecx*2 + 0x6cdb3fa8], esi
inc esp
xor dword [esp + ecx + 0x366d9fdc], eax
bts eax, 0x30
inc ecx
bswap ecx
dec esp
mov esi, dword [esp + ecx + 0x366d9fdc]
mov ebx, 0x2796dfbd
movsx edi, bx
dec ebp
arpl ax, ax
dec eax
mov dword [esp + ecx + 0x366d9fdc], ecx
dec ecx
add esi, eax
dec eax
ror eax, cl
shr edx, cl
shr bx, 0xa2
dec ebp
lea ebp, [ebp + ecx + 0x366d9fc8]
inc ecx
pop ecx
inc ecx
mov ecx, 0xe3096913
ja 0x18e1a2c
inc edx
adc edx, dword [ecx + ebp + 0x366d9fcc]
bts ecx, 0x1c
inc ecx
xor edx, esi
neg cx
inc word [esp + ebp - 0xfc]
rol word [esp + ebp - 0xff], cl
Function at 0x122d7d4
Capabilities:
Encode data using base64

Disassembly:
add byte [ecx - 0x7cffdbbc], cl
out dx, al
push es
mul dx
xor cl, bl
lea eax, [eax + 0x239d46b5]
neg edx
xor cl, 0x3a
mul dword [esp + eax*2 - 0x4739171f]
not dword [esp + edx - 0x21f18fee]
not dword [esp + edx*2 - 0x43e3200c]
dec cl
xadd dl, dh
sbb edx, 0x188beea2
xor cl, 0xb7
shl dl, 0x24
jne 0x195d353
movsx ecx, dx
mov edx, dword [ebp + edx - 0x408abb41]
xor cl, 0x2d
xadd al, ah
add ax, ax
mov eax, dword [ebp + 4]
pop ecx
jne 0x12269dd
je 0x122d790
xor dl, byte [ecx]
call 0xa5d323d0
or al, 0xe1
aad 0x47
xchg esp, eax
movsb byte es:[edi], byte [esi]
or al, 0xe1
invalid
inc cl
ror cl, 1
add dword [esp + edx*2 - 0x12ca2e6b], eax
bswap edx
sbb eax, edx
inc cl
lea edx, [edx*8 + 0x78182092]
bt edx, eax
or dword [esp + eax - 0x4150da31], edx
xor bl, cl
mul eax
lea ecx, [esp + ecx + 0x1c]
shl edx, 0xfb
not edx
sar edx, 0x74
movzx dx, byte [ecx + eax*2 - 0xa3c9df2]
push eax
movsx ecx, ax
mov word [ebp + eax - 0x51e4ef9], dx
mov dword [esp + eax*4 - 0x14793be4], edi
ret 0x1c
Function at 0x1234208
Capabilities:
Encode data using base64

Disassembly:
jb 0x1954f66
mov eax, 0xd93525a2
btr eax, 0x80
mov edx, dword [ebp]
xor eax, eax
sal ax, 0x8f
mov cl, byte [eax + ebp + 4]
dec eax
adc eax, eax
sal edx, cl
movsx ecx, al
mov dword [ebp + 2], edx
mov edx, dword [esi - 4]
xor edx, ebx
btr ecx, ecx
bts eax, ecx
sbb edx, 0xce855921
ror edx, 1
cbw
cwde
sar al, 0x83
bswap edx
dec cx
neg edx
sar cl, 0xa1
sub edx, eax
neg edx
xor ebx, edx
add edi, edx
cbw
cbw
mov cx, word [ebp + 2]
ror ax, 0xcb
neg eax
movsx edx, al
lea ebp, [ebp + eax*8 - 4]
bt ax, ax
and edx, 0x488c6088
or dl, byte [esi + eax*2 - 7]
ror ax, 7
lea esi, [esi + eax*2 - 0x405]
shr eax, 4
add ax, ax
push eax
xor dl, bl
sal ax, 0xe7
inc dl
not dl
shr eax, 0xf2
rol dl, 1
neg eax
neg eax
sub word [esp + eax + 1], ax
adc dl, 0x35
inc byte [esp + eax*4 + 3]
or al, 0x94
xor dl, 0x1c
and byte [esp + eax - 0x91], al
xor bl, dl
lea edx, [esp + edx + 4]
shl al, 0x86
call fcn.019257d1
xor ecx, ebx
shl dword [esp + 0xc], 0xd4
inc eax
rol dword [esp + 0xc], 0x69
jb 0x12003b7
dec edx
push 0xd82c5d94
call fcn.01229393
neg byte [esp]
inc ecx
movzx ecx, byte [ebp - 1]
inc ecx
xor cl, dh
dec eax
not dword [esp]
mov eax, 0xbc85e691
add cl, 5
ror cl, 1
dec esp
lea edi, [eax*4 + 0x7c18c81e]
neg cl
inc ebp
movzx ecx, di
not cl
inc edx
movsx edx, byte [esp + ecx - 0x625f]
rol cl, 1
inc edx
idiv byte [esp + ecx - 0x6260]
inc esp
xor dh, cl
dec esp
lea eax, [eax + 0x601265b6]
dec esp
lea ecx, [edx + edx + 0x2a28ad1a]
dec eax
lea ecx, [esp + ecx + 8]
cdq
inc ecx
btr eax, 0x8d
dec ecx
mov dword [eax + ecx - 0x1c981751], edi
inc ecx
movsx ebp, al
inc edx
sar byte [esp + eax - 0x1c98174d], 0x86
inc esi
mov ecx, dword [ebp + ebp - 0x56]
inc ebp
xor ecx, esi
dec eax
lea edi, [eax*4 - 0x15d9407e]
inc edi
lea ecx, [ecx + eax*2 - 0xd7cd11d]
inc ecx
mov esp, 0xbb98e11b
call fcn.0120792f
xor ecx, 0x3e0c4d38
mov dword [esp + 4], 0xb20ac31d
mov dword [esp + 8], 0xbd33fb92
jmp 0x18d1834

Function at 0x1237040
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
neg edx
mov dword [esp + edx*4], ebx
neg edx
call fcn.018d36db
xor eax, ebx
sar ecx, 0xb6
sal dx, 0xe7
not eax
bswap eax
xchg edx, ecx
adc edx, 0xbd216a07
inc eax
not eax
lea edx, [edx*4 - 0x5354fbda]
btc ecx, 0x1b
lea eax, [eax + ecx*2 - 0x7b9562b4]
sbb edx, ecx
sub dx, dx
not edx
neg eax
or cx, dx
sal edx, 0xa3
xor ebx, eax
ror ecx, 0xfe
add dl, dl
add edi, eax
sar cx, 0xe2
jae fcn.019143e0
lea esi, [edx + esi - 0x1d99df2b]
lea ecx, [edx + edx*4 - 0x5fea8b6f]
mov eax, ecx
mov ecx, dword [edx + esi - 0x1d99df27]
xor ecx, ebx
sub dl, al
dec ecx
imul ax, ax
dec dx
rol ecx, 2
cwde
neg eax
push edx
sbb ecx, 0xadb7c41c
ror ecx, 2
add ax, word [esp + edx - 0x1d99dfd2]
sal byte [esp + edx - 0x1d99dfd1], 0xe6
bswap ecx
shl dl, 0x86
Function at 0x123999c
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
rol dl, 0xe1
rol ebx, 2
dec eax
mov dword [esp + eax - 0x473e], edx
mov ebp, dword [esp + eax*4 - 0x11d04]
lea ebx, [ebx + eax + 0x3bb0cabd]
neg ebx
inc eax
imul bh
pop eax
sbb ebx, edx
inc dx
xadd dword [esp - 0x95], edi
dec esi
mov dword [esp - 0x132], esi
push edx
inc edx
xor dword [esp - 0x8d], ebx
inc esp
movzx eax, ch
dec esi
mov esi, dword [esp - 0x12a]
inc di
call fcn.0191b137

Function at 0x18d4569
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
movzx edx, cl
mov dword [esp + edx - 0xa3], edi
ret 4
mov dword [edx], eax
lea ecx, [ecx + 0x40b436a4]
jns 0x10332f2
not ax
bswap edx
ror cl, cl
xor ebx, edx
pop eax
imul cx, cx
add edi, edx
lea eax, [ecx + ecx*8 + 0x38b8e8ad]
mov eax, dword [ecx + ebp - 0xe3fe]
movzx edx, cx
bt dx, cx
lea ebp, [ecx + ebp - 0xe3fa]
movzx edx, byte [ecx + esi - 0xe405]
imul ecx, ecx
adc esi, 0xfffffffa
btc ecx, ecx
setae cl
setae byte [esp]
xor dl, bl
add cx, cx
dec dl
xchg byte [esp + 3], cl
not cl
mov dword [esp], ecx
xor dl, 0x8c
push ecx
not dl
sar cl, 0x46
add cx, word [esp + 2]
or cx, 0xa824
neg dl
not ecx
xor ecx, ecx
not ecx
xor bl, dl
or byte [esp + 7], 0x28
lea edx, [esp + edx + 8]
add dword [esp + 4], 0x89ab3ba8
jl 0x1042188

Function at 0x18d9ddd
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov dword [esp], 0x251f1432
call fcn.01949bff
not al
or dl, al
inc ecx
shl dl, 0x81
inc cx
or ebp, edx
inc bx
mov dword [ebx - 0x3a02], edx
inc edi
mov edi, dword [ebp - 0x1d06]
inc ecx
movsx ecx, sp
inc ebp
xor edi, esi
inc ecx
movsx edi, dx
dec ebx
lea ecx, [ecx + edx*2 - 0x36fe63e5]
inc ecx
dec edi
inc ecx
rol edi, 2
inc eax
rol bh, cl
inc ecx
bswap edi
call fcn.0190c28c
pop edi
push esp
pop ss
xchg ecx, eax
loop 0x18d9e51
inc edi
sub eax, 0xa394b808
cmp cl, byte [esp + ebx*8 + 0x3cfc141]
inc ecx
ror edi, 3
inc esp
movzx esp, bl
cdq
movsx ecx, bx
inc ecx
neg edi
inc esp
xor edx, edx
dec edx
lea ebp, [eax*2 + 0x46919397]
movzx edi, cx
dec esp
mov dword [esp + edx], esi
dec eax
btr ebp, eax
call fcn.01960d29
push 0x7801d588
push 0x7e3cd8aa
lea esp, [esp + 0x18]
ret
Function at 0x18e006f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc ecx
pop esp
shr dx, 0xe9
inc ecx
inc ecx
shr ebp, 0x3f
call fcn.01228820
mov edx, 0x1021f16
movsx ecx, dx
lea esi, [edx + esi - 0x1021f17]
xadd edx, ecx
or edx, 0xdd97e80a
movzx ecx, byte [ecx + esi - 0x1021f16]
mov eax, edx
push edx
xor cl, bl
sub cl, 0xa5
xor cl, 0xb4
add cl, 0x9e
neg cl
shl ax, 0x89
not cl
sub eax, dword [esp]
xor bl, cl
mul byte [esp + 1]
neg dx
lea ecx, [esp + ecx + 4]
mov dx, word [ecx]
sar ax, 0xed
sbb ebp, 1
mov word [ebp], dx
call fcn.0103a64d
dec ecx
jge 0x105631c
test ah, dl
pop edx
push eax
adc dl, byte [edi]
cwde
mov byte [ecx - 0x3d4d64c4], ah
jmp 0x1056376
xchg edi, eax
inc cx
mov dword [ebx + edi*2 - 0x286], ebx
js 0x105627f
inc ebp
movzx edx, bh
dec eax
mov dword [esp + edi*4 - 0x504], edi
dec eax
mov dword [esp + edi - 0x143], esi
ret 8
dec esi
mov esi, dword [esp + ecx - 0x7115012c]
inc esp
mov eax, eax
dec esp
mov dword [esp + edi*8 - 0x9a0], ecx
dec ebp
arpl dx, dx
dec ecx
add esi, edx
dec esi
mov ecx, dword [edi + ebx - 0x134]
cbw
inc ecx
mov bl, byte [ecx + edi*4 - 0x4d0]
inc cx
xadd edi, edi
dec ebp
lea ebx, [ebx + edi - 0x13d]
shr ax, cl
jne 0x18cf078
inc ecx
mov edx, 0x6f9c0e39
inc ecx
movsx ecx, dx
dec edi
lea ebp, [ebp + edx - 0x6f9c0e3d]
inc esp
movzx ecx, cx
inc esp
movzx esp, cx
inc edi
mov esp, dword [ebp + edx - 0x6f9c0e39]
dec ecx
dec edx
inc ebp
xor esp, esi
inc esp
mov eax, ecx
inc ecx
sub esp, 0xa8aa8628
jmp 0x18e944e

Function at 0x18e3996
Capabilities:
Encode data using base64

Disassembly:
pushfd
shr dword [esp + edi*2 - 0x7b471a16], 0x28
add di, di
mov edi, dword [esp + edi - 0x3da31a12]
mov dword [esp + 0xc], 0x227f97d0
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.00fd86b2
stc
test ebx, esp

Function at 0x18e54f1
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [ebx*4 + 0xfda424]
mov dword [esp], 0x45b65797
neg dword [esp]
xor byte [esp + 1], 0x9e
shr edx, 8
xor edx, ebx
inc eax
jmp 0x1000f84
jmp 0x1206f12

Function at 0x18e5cae
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea edx, [edx + eax - 0x5a7597c]
mov dword [esp + ecx - 0x13c26249], eax
ror edx, 1
call fcn.00fb0b71
mov edi, 0x7e89a89e
dec ebp
lea ebp, [ebp + edi - 0x7e89a8a2]
inc eax
movsx eax, bh
inc ebp
mov edx, dword [ebp + edi - 0x7e89a89e]
dec eax
lea ebx, [eax*2 - 0x187c325c]
dec esp
lea esp, [eax + ebx*2 + 0x622b0cab]
inc ebp
xor edx, esi
inc ecx
sub edx, 0x790495bd
inc ecx
bswap edx
inc sp
or esp, edi
ja 0x194d6b6
mov eax, 0x15abdfa4
lea edx, [eax + eax*4 - 0x640616d]
sal eax, 0x38
movzx edx, byte [esi + edx - 0x661afcc8]
xor dl, bl
neg dl
xor dl, 0x2d
lea ecx, [eax + eax*2 + 0x290f13bb]
jmp 0x10012d2
inc ebp
lea edx, [edx + edi - 0x69514a0a]
inc ebp
btc esp, esp
or edi, edi
dec esp
lea edi, [ebx*8 + 0x7b38c001]
inc ecx
ror edx, 3
call fcn.01904870

Function at 0x18ed665
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor

Disassembly:
mov ecx, dword [esi + ecx*8 - 0x58]
mov dword [esp], eax
movsx edx, al
xor ecx, ebx
bts eax, eax
Function at 0x18eea35
Capabilities:
Encode data using base64

Disassembly:
call fcn.01229ad2
mov dword fs:[edx], ecx
push eax
movzx ecx, ax
shl al, 0xe5
mov edx, dword [ebp + ecx*4 - 0x24cbc]
lea ebp, [ebp + ecx - 0x9325]
lea ecx, [esp + ecx - 0x9309]
sar eax, 0x14
lea eax, [eax + eax*4 + 0x5618672f]
mov dword [ecx + eax - 0x5618672a], edx
mov edx, 0x179145bc
push eax
mov eax, dword [esi + edx*2 - 0x2f228b7c]
movsx ecx, dx
add edx, 0xbab3b010
lea esi, [esi + ecx*8 - 0x22de4]
xor eax, ebx
or dword [esp + ecx - 0x45b8], ecx
bswap eax
sal cl, 0xc1
rol eax, 2
neg eax
rol eax, 1
neg ecx
sub cx, word [esp + 3]
xor eax, 0x422a5db3
xor ebx, eax
add edi, eax
neg ecx
mov dword [esp + ecx - 0x2ce], edi
ret 4
jb 0xfe3cb6
xor ebx, ecx
dec byte [esp + 2]
or dword [esp + 4], 0xb296ecb8
rol dword [esp + 4], 0x55
add edi, ecx
lea esp, [esp + 8]
jmp 0x1061f43
ror ecx, 1
mov dword [esp], 0xf9b4ce8b
shr dword [esp], 0x69
not ecx
push 0xa6941786
jne 0x121bbaa
xchg esp, esi
sub eax, dword [ecx - 0x63]
jae 0x18eea95
xchg edx, eax
sub al, byte [ecx - 0x5b]
arpl word [0xf5412a92], cx
pop ds
add dword [edx + 0x23e9412a], edx
or eax, 0xe5412a92
inc edi
or dl, byte [edi - 0x9df4f18]
aad 0x48
scasd eax, dword es:[edi]
sbb dword [edx + 0x478fe0ca], 0xfffffff2
mov dword [eax], ebx
popal
popfd
out 0x38, al
nop
push ebp
ret
adc al, 0x4c
mov dword [0xc4caed46], eax
cmp al, 0x50
mov edx, 0x5691a67e
or byte [ebx + ebx*2 + 0x79afe486], 0xb8
mov byte [ebp - 0x40564d76], cl
xlatb
aam 0x96
lds esi, [ebp - 0x52]
cmp dword [eax + 0x2e], ecx
leave
inc ecx
scasb al, byte es:[edi]
cmp dword [eax - 0x77], ecx
cmc
scasb al, byte es:[edi]
cmp dword [eax - 0x41], ecx
in eax, dx
lahf
and cl, byte [edi - 0x4703a975]
test eax, 0x3363354d
ror dword [edx], cl
les ecx, [edi]
shl al, 0x81
fisub dword [ecx]
sub al, 0x85
std
ror eax, 0x64
add al, al
cwde
neg edx
lea edx, [eax + edx + 0x1e1814e7]
bswap edx
lea ecx, [eax + eax*4 + 0x43a8ef10]
bswap ecx
lea edx, [edx + ecx*2 + 0x42fb7683]
bswap ecx
xor ebx, edx
call fcn.01054843
push 0xe9a8b62e
mov ecx, dword [esp + 0xc]
xor bl, al
mov dword [esp + ecx*2 - 0x3d30698], ecx
lea ecx, [ecx*2 - 0x3bcf21d8]
lea eax, [esp + eax + 0x10]
bt ecx, 0x39
not cl
mov word [eax], dx

Function at 0x18fc113
Capabilities:
Encode data using base64

Disassembly:
call fcn.0193995e
dec eax
dec eax
jmp 0x104d506
Function at 0x18fd57a
Capabilities:
Encode data using base64

Disassembly:
push edx
sar dl, cl
xor ebx, eax
sal edx, 9
rol dword [esp + edx*4 - 0x5c000000], cl
lea ebp, [ebp + edx*2 - 0x2e000004]
dec ecx
mov dword [edx + ebp - 0x17000000], eax
shr word [esp + edx - 0x17000000], 0xe2
pop edx
jns fcn.019143e0
push 0xe8234284
push 0xd98caa87
lea esp, [esp + 0x14]
je 0x1047d88
call fcn.0197a295
and byte [esp + ecx*2 - 0x66ffffff], 4
sbb eax, 0x8f9a7539
dec byte [esp + ecx*2 - 0x66ffffff]
not word [esp + ecx - 0x33800000]
xor ebx, eax
btr edx, edx
shl edx, 0x70
adc edi, eax
rol word [esp + edx - 0x638b0000], 1
lea eax, [edx + edx*2 - 0x1cfd92d9]
lea esi, [esi + edx - 0x638b0004]
ror dl, 0x84
mov eax, dword [ecx + esi - 0x33800000]
xor eax, ebx
dec eax
xor cl, dl
bswap ecx
xadd cx, dx
bswap eax
inc byte [esp + ecx*8 - 0x40198]
neg eax
pop ecx
xor eax, 0xd20f6e14
not eax
jmp 0x120a2dc

Function at 0x18fe8b7
Capabilities:
Encode data using base64

Disassembly:
inc cx
ror edi, 1
call fcn.0101d119

Function at 0x18fe8c0
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x4ab4a480
call fcn.018dd199
mov edi, 0x6fa759ae
dec esi
lea ebp, [edi + ebp - 0x6fa759b2]
jmp 0x190f96e
inc esp
mov edx, edi
inc esp
movzx esp, di
inc ecx
mov edx, dword [ebp + edi - 0x6fa759ae]
inc ecx
xor edx, esi
inc ecx
sal edx, 0x84
and edi, 0x9f9ea780
movsx ebx, di
rol edx, 1
inc ebp
movsx edi, dl
dec ecx
ror esp, 0xb0
lea edx, [edx + edi*8 + 0x4fd4cd09]
dec ebx
lea ecx, [edx + edi*8 + 0x6b15db6]
inc ecx
movsx ebp, dl
bswap edx
inc ecx
mov eax, 0xb4bc0d24
dec eax
inc ebx
neg edx
rol edx, 3
inc bp
xor edi, edi
dec eax
ror ebp, 0xd2
inc ecx
push esi
inc ecx
add edi, 0x5002baa0
xor dword [esp + edi*8 - 0x7c300c00], edx
inc ecx
push edx
movzx eax, word [esp + edi - 0xf86017f]
dec esp
mov esi, dword [esp + edi*2 - 0x1f0c02f8]
dec eax
arpl dx, dx
dec eax
mov dword [esp + edi*2 - 0x1f0c02f8], 0x23ad41af
pop eax
inc sp
btr ebp, eax
dec eax
add esi, edx
dec eax
not edi
movzx edx, word [esp + edi*2 + 0x1f0c0306]
dec esi
mov ecx, dword [edi + ebx + 0xf860181]
inc ebp
mov bh, byte [ebx + edi + 0xf860189]
dec ecx
shr edx, cl
dec esi
lea ebx, [edi + ebx + 0xf86018b]
inc cx
adc edx, 0xff413b05
enter 0xffffffffffff8845, 0xffffffffffffffbc
stc
or byte [eax + esi], cl
jl 0x190fa78
movzx ecx, word [esp + edi*2 + 0x1f0c0306]
dec eax
mul dword [esp + edi*2 + 0x1f0c0302]
dec eax
mov dword [esp + edi + 0xf860181], esi
ret
Function at 0x190309f
Capabilities:
Encode data using base64
Execute syscall

Disassembly:
mov dword [ebp - 4], eax
call fcn.0101d2b0
syscall
inc ecx
push edi
dec ecx
mov edi, 0x392db581
cmp eax, 0x4c968210
mov edi, dword [esp]
dec eax
mov dword [esp], 0x10986413
call fcn.01237ef1
mov dword [esp], 0x351e76a2
add eax, edx
rol word [esp + 2], 9
or byte [esp + 2], 0x20
jp 0xf976e6

Function at 0x1905e27
Capabilities:
Encode data using base64

Disassembly:
ror dl, 1
dec eax
add ecx, 0x58925e94
neg dl
dec ebx
lea ebx, [esp + edx + 0x198ea489]
inc dl
inc bp
btr eax, eax
inc ecx
sbb ebx, ecx
call fcn.0106fd87

Function at 0x1905e49
Capabilities:
Encode data using base64

Disassembly:
adc edi, ecx
rol edx, 0x56
jae 0xffd04a
jmp edi
cbw
mov eax, dword [eax + ebp - 0x9d0079]
call fcn.012069cb
sal cx, 0x6c
adc ax, cx
xor edx, ebx
inc cx
bt eax, eax
not edx
sbb ecx, eax
sbb ecx, ecx
bswap edx
cwde
inc eax
neg edx
and cx, 0x4ea6
add al, cl
xor edx, 0x6daf750c
xor ebx, edx
imul ecx, eax
btr eax, eax
add edi, edx
imul eax, ecx
inc cl
neg eax
xor eax, edi
jmp eax
jp 0xfb25b3
xor al, bl
call fcn.00fe2c42

Function at 0x190a91e
Capabilities:
Encode data using xor

Disassembly:
sbb esi, 4
mov edx, dword [esi]
mov dword [esp], 0xc331cb88
dec cl
xor ecx, ecx
xor edx, ebx
or ax, ax
or eax, eax
setg byte [esp + ecx + 1]
and byte [esp + ecx*2 + 1], 0x96
xor edx, 0xa121f36
dec edx
add ecx, eax
rol edx, cl
sub edx, 0xb4356481
rol edx, cl
shr ecx, 0xd5
btc cx, cx
xor ebx, edx
add ecx, ecx
sal ecx, cl
add edi, edx
pop eax
shr cx, 0x6e
call fcn.018fda6c
pushfd
fsub qword [ebp + 0x4e40f6dc]
mov edx, 0x8b6dca4
jle 0x190a936
movsb byte es:[edi], byte [esi]
fcom qword [esi - 0x5b4585a4]
fsubr st(2), st(0)
inc eax
push es
mov edx, 0x89edca4
or eax, 0xbd3ec0e0
cmp ebp, 0x557232c6
stc
jl 0x190a99f
mov esp, dword [esi - 0x4a324b2c]
xlatb
mov ch, 0xd7
aam 0x33
adc ch, dh
je 0x190a9b1
hlt
dec eax
jmp 0x297dbe5b
Function at 0x190c7c3
Capabilities:
Encode data using base64

Disassembly:
mov dword [edx + ebp - 0x1000006], ecx
lea ebp, [ebp + edx*8 - 0x8000006]
pop ecx
pop edx
je fcn.0121e846
not al
xor bl, al
shr dl, 0x42
lea eax, [esp + eax + 8]
movzx cx, byte [eax + ecx*2 - 0x1ffff540]
not dword [esp + edx*2 - 0x10c32]
lea eax, [edx*8 - 0x775530c4]
js 0xfa3a75
mov word [ebp + edx*2 - 0x10c38], cx
movzx eax, byte [esi + edx*4 - 0x21872]
mov dword [esp + edx*2 - 0x10c36], 0xca18c809
and edx, 0x58a5a628
lea esi, [esi + edx*8 - 0x43046]
sar dl, 6
not dl
xor al, bl
xor al, dl
sub al, 0x98
movsx ecx, word [esp + edx*8 - 0x437f5]
push ecx
xor al, dl
sub dl, byte [esp + edx*4 - 0x21bf4]
adc al, 0x2d
pop edx
sub dl, byte [esp + edx*2 - 0x191]
xor bl, al
bts edx, edx
adc dword [esp + edx*2 - 2], 0x6409ef8d
lea eax, [esp + eax + 8]
or dword [esp + edx*2], ecx
neg cx
shl edx, 0xb8
mov ecx, dword [eax + edx*2 - 0x2000000]
shl dword [esp + edx - 0xfffffc], 0x75
jae 0x1070594
sub esi, 4
mov ecx, dword [esi]
xor ecx, ebx
call fcn.01236407
sub esi, 1
mov ecx, 0xe01393b9
dec ecx
movzx edx, byte [esi]
xor dl, bl
xor ecx, ecx
ror dl, 1
neg dl
not dl
add dl, 0x13
bt ecx, 0x39
lea eax, [ecx + ecx*4 + 0x55bcd5bc]
inc eax
neg dl
jmp 0x1931ec2
mov word [ebp], dx
sub esi, 4
mov ecx, dword [esi]
xor ecx, ebx
lea edx, [eax + 0x419bc38d]
not al
not ecx
cwd
neg eax
inc ecx
not ax
imul edx
neg ecx
add eax, 0xfc3aa114
div al
ror ecx, 1
cdq
and dx, dx
js 0xfb1cb4
rol al, cl
lea esi, [esi + ecx*2 - 6]
not ecx
cbw
add ecx, ecx
mov ecx, dword [esi]
movsx edx, ax
call fcn.0196d946
xor bl, dl
xadd cl, ch
inc eax
lea eax, [ecx + ecx*2 - 0x4ec30252]
lea ebp, [ecx + ebp - 4]
inc cx
mov dword [ebp + ecx*8 - 8], edx
dec eax
jl 0x19287f4
shr word [esp + 2], 0x86
push 0x581e6e12
shrd edx, eax, cl
shr word [esp], 0x8e
mov eax, 0x70b7ca21
mov dword [ebp + eax - 0x70b7ca21], edx
movsx edx, ax
mov ecx, edx
lea esi, [esi + eax - 0x70b7ca25]
mov eax, dword [esi + eax - 0x70b7ca21]
sar dword [esp], 0x30
xor eax, ebx
imul cx, dx
inc eax
xor eax, 0xdd8575b2
mov word [esp + 4], cx
not eax
or ecx, ecx
neg eax
neg dword [esp + 8]
lea eax, [edx + eax - 0x77460b8d]
js 0x1912fae
not eax
sal edx, 0x55
bt ecx, 0xbf
xor ebx, eax
and dx, 0x211
adc edi, eax
xor cl, ch
inc ecx
add dword [esp + edx - 0x441ffffb], 0xb4160710
mov dword [esp + edx - 0x44200000], edi
ret 8