joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49aa98
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
cmp byte [ebx + 0x98], 0
je 0x49ab7b
test byte [ebx + 0x1c], 0x10
jne 0x49ab7b
xor eax, eax
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x416704]
call fcn.004032a4
mov dword [ebx + 0xcc], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x445c14]
call fcn.00456108
mov esi, eax
mov dword [ebx + 0xc4], esi
mov byte [esi + 0x42], 1
mov dl, 3
mov eax, esi
call fcn.004570fc
push 0x4009
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, dword [ebx + 0x84]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, eax
mov eax, esi
call fcn.00456464
test edi, edi
jne 0x49ab4a
mov ecx, ebx
mov dl, 1
mov eax, dword [0x457e14]
call fcn.00459308
mov esi, eax
mov dword [ebx + 0x80], esi
mov edx, dword [ebx + 0x8c]
mov eax, esi
call fcn.0045b21c
jmp 0x49ab50
mov dword [ebx + 0x80], edi
mov edx, dword [ebx + 0xc4]
mov eax, dword [ebx + 0x80]
call fcn.0045bcdc
mov eax, ebx
call fcn.0049a8e4
mov ecx, dword [ebx + 0x84]
mov edx, dword [ebx + 0x80]
mov eax, ebx
call fcn.0049a178
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4056a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xfe78
call fcn.00415e50
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0xfe74], eax
mov eax, dword [ebp + 0x10]
push 0x3ff
mov dword [ebp - 0xfe70], eax
lea eax, [ebp - 0x413]
push 0
push eax
mov byte [ebp - 0x414], 0
call fcn.00415320
xor eax, eax
mov byte [ebp - 0x10], 0
push 0xfa00
push eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
lea eax, [ebp - 0xfe14]
push eax
call fcn.00415320
add esp, 0x18
lea eax, [ebp - 0xfe14]
mov ecx, ebx
push esi
push eax
call fcn.00405540
push 0x405680
push 0xc80
push dword [ebx]
lea eax, [ebp - 0xfe14]
push eax
call fcn.00413460
xor edi, edi
add esp, 0x10
cmp dword [ebx], edi
jle 0x40578f
lea esi, [ebp - 0xfe14]
lea eax, [esi + 0x480]
push eax
lea eax, [ebp - 0x414]
push 0x400
push eax
call fcn.00411d60
push 0x4334a0
push esi
call fcn.00411b8b
add esp, 0x14
test eax, eax
jne 0x405784
push 6
lea eax, [esi + 0x80]
push eax
lea eax, [ebp - 0x10]
push 7
push eax
call fcn.00411cbc
add esp, 0x10
inc edi
add esi, 0xc80
cmp edi, dword [ebx]
jl 0x405743
mov eax, dword [ebp - 0xfe70]
cmp byte [eax], 0
je 0x4057af
push eax
lea eax, [ebp - 0x414]
push 0x400
push eax
call fcn.00411d60
add esp, 0xc
cmp byte [ebp - 0x10], 0
je 0x4057cd
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x414]
push 0x400
push eax
call fcn.00411d60
add esp, 0xc
lea edx, [ebp - 0xfe70]
lea ecx, [ebp - 0x414]
call fcn.004050b0
mov edi, dword [ebp - 0xfe70]
mov esi, edi
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x4057f0
push 0x58
lea eax, [ebp - 0xfe6c]
sub esi, ecx
push 0
push eax
call fcn.00415320
add esp, 0xc
mov dword [ebp - 0xfe58], 0
lea ecx, [ebp - 0xfe6c]
mov dword [ebp - 0xfe5c], 0
mov dword [ebp - 0xfe6c], 0x67452301
mov dword [ebp - 0xfe68], 0xefcdab89
push esi
push edi
mov dword [ebp - 0xfe64], 0x98badcfe
mov dword [ebp - 0xfe60], 0x10325476
call fcn.004058d0
push dword [ebp - 0xfe74]
lea ecx, [ebp - 0xfe6c]
call fcn.004059a0
push edi
call fcn.00411712
mov ecx, dword [ebp - 8]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00411717
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x78
mov esi, ecx
call fcn.00412002
mov edi, eax
add esp, 4
test edi, edi
je 0x4089b0
mov edx, dword [esi + 0x414]
mov dword [edi + 0x14], edx
mov dword [edi + 0x2c], 0x4317ec
mov byte [edi + 0x5c], 1
push 0
push dword [esi]
mov dword [0x489918], edi
mov byte [esi + 0x60d], 0
call dword [0x42b2cc]
lea eax, [esi + 0x610]
mov ecx, edi
push eax
push eax
lea eax, [esi + 0x60f]
push eax
push dword [esi]
call fcn.0040cdc0
jmp 0x4089b2
xor edi, edi
push esi
push 0
push 0x406890
call fcn.00413060
mov esi, dword [0x42b2e4]
lea eax, [ebp - 0x1c]
add esp, 0xc
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x18], xmm0
push 0
push 0
push 0
push eax
movq qword [ebp - 8], xmm0
call esi
test eax, eax
je 0x408a12
mov ebx, dword [0x42b2dc]
lea eax, [ebp - 0x1c]
push eax
call ebx
lea eax, [ebp - 0x1c]
push eax
call dword [0x42b2e0]
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x4089f2
test edi, edi
je 0x408a4e
push dword [edi + 0x20]
mov esi, dword [0x42b05c]
call esi
push dword [edi + 0x24]
call esi
push dword [edi + 0x28]
call dword [0x42b050]
mov dword [edi + 0x2c], 0x4317ec
push dword [edi + 0x48]
call esi
push dword [edi + 0x4c]
call esi
push dword [edi + 0x50]
call esi
push edi
call fcn.00411712
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408a60
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
mov esi, ecx
call fcn.004076c0
test eax, eax
je 0x408a96
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411717
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x65
mov dword [ebp - 0x28], 0x68005a
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x440075
push eax
mov dword [ebp - 0x20], 0x6e006f
mov dword [ebp - 0x1c], 0x460067
mov dword [ebp - 0x18], 0x6e0061
mov dword [ebp - 0x14], 0x590067
mov dword [ebp - 0x10], 0x2e0075
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x220065
call fcn.0040be70
test eax, eax
push esi
setne al
push 0
push 0x408930
mov byte [esi + 0x60e], al
call fcn.00413060
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.00411717
mov esp, ebp
pop ebp
ret 4

Function at 0x40a350
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x489844]
sub eax, 0x8005
je 0x40a395
dec eax
jne 0x40a39f
lea eax, [esi + 0xc2c]
push eax
push 2
call dword [0x42b250]
push esi
push 0
push 0x40b040
mov byte [esi + 0x60c], 0
call fcn.00413060
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret 4
push 1
push dword [esi]
call dword [0x42b2cc]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40a470
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x58c], 2
jle 0x40a548
call fcn.0040a3b0
test al, al
jne 0x40a503
push esi
push 0
push dword [edi]
mov byte [edi + 0x60d], al
call dword [0x42b2cc]
mov eax, dword [edi]
lea esi, [edi + 0xc2c]
push 0x81
push dword [edi + 0x414]
mov dword [esi], 0x3bc
mov dword [edi + 0xc30], eax
mov dword [edi + 0xc34], 0x81
mov dword [edi + 0xc38], 3
call dword [0x42b284]
push esi
push 0
mov dword [edi + 0xc40], eax
mov dword [edi + 0xc3c], 0x40a
mov dword [edi + 0xf4c], 0xbb8
mov dword [edi + 0xfd0], 0
call dword [0x42b250]
pop esi
pop edi
ret
mov eax, dword [edi + 0x40c]
test eax, eax
je 0x40a52f
push pe_nt_image_headers32
push 0
push 0
push 0xf001f
push eax
call dword [0x42b084]
push eax
mov dword [eax], 0
call dword [0x42b088]
push edi
push 0
push 0x40b040
mov byte [edi + 0x60c], 0
call fcn.00413060
add esp, 0xc
pop edi
ret
push 0x41
push 0x433754
push 0x433760
push 0
call dword [0x42b2e8]
cmp eax, 1
jne 0x40a5aa
lea eax, [edi + 0xc2c]
push eax
push 2
call dword [0x42b250]
add edi, 0x1068
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x40a580
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a580
sub ecx, edx
cmp ecx, 5
jbe 0x40a5a2
push 5
push 0
push 0
push edi
push 0x433784
push 0
call dword [0x42b254]
push 0
call dword [0x42b2b4]
pop edi
ret
Function at 0x40b6e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov dword [ebp - 4], eax
cmp byte [eax + 0x60a], 0
jne 0x40b79b
push ebx
mov byte [eax + 0x60a], 1
mov ebx, dword [eax + 0x618]
sub ebx, dword [eax + 0x614]
push esi
sar ebx, 2
xor esi, esi
test ebx, ebx
je 0x40b789
mov ecx, dword [eax + 0x614]
mov eax, dword [eax + 0x618]
sub eax, ecx
mov dword [ebp - 0xc], ecx
sar eax, 2
mov dword [ebp - 8], eax
push edi
mov edi, edi
cmp eax, esi
jbe 0x40b7a1
mov edi, dword [ecx + esi*4]
test edi, edi
je 0x40b775
mov eax, 0x4334b8
lea ecx, [edi + 0x800]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40b766
test dl, dl
je 0x40b762
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40b766
add ecx, 2
add eax, 2
test dl, dl
jne 0x40b746
xor eax, eax
jmp 0x40b76b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b77c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc esi
cmp esi, ebx
jb 0x40b730
jmp 0x40b785
mov al, byte [ebp + 8]
mov byte [edi + 0x102d], al
mov eax, dword [ebp - 4]
pop edi
push eax
push 0
push 0x40b040
call fcn.00413060
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x433bc8
call fcn.004280ec
int3
Function at 0x40f5b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40f5bb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x40f685
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
dec edi
jne 0x40f5d0
pop edi
test esi, esi
je 0x40f6aa
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x431840]
dec esi
jne 0x40f690
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x121a66c
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
push ebp
bswap dx
xchg ebp, edx
sub bp, 0xac3b
mov ebp, esp
sub edx, ebx
mov edx, dword [ebp + 8]
sub esp, 0x114
push esi
test esp, esi
test edx, edx
jmp 0x1777e8b
je 0x136646d
mov esi, dword [ebp + 0xc]
cmp esi, edi
test dx, 0x842e
jmp 0x177c65d
test esi, esi
je 0x136646d
mov eax, 0x5a4d

Function at 0x121e46c
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x8cb76f14
neg eax
rol edx, 0x44
mov dword [esp + edx - 0x32040b16], ecx
inc eax
bswap edx
xor eax, 0x44807581
jmp 0x126f337
pop edx
not eax
push edx
call 0x126f585
inc ebp
mov ebp, dword [esi]
inc ecx
inc ecx
mov ebx, dword [esi + 4]
inc ecx
mov ebx, 0xccbb373a
dec ecx
add esi, 4
inc ecx
not ebp
inc ecx
movsx ebp, bx
inc esp
xadd ebp, ebx
dec esp
lea edx, [ebp + ebp - 0x67625df9]
not ebx
inc ecx
neg dl
call fcn.01221049
xor ecx, ebx
shl al, 0xa1
ror eax, 0xec
inc ecx
lea edx, [eax*8 - 0x34d39d6c]
sal eax, 0x92
push edx
xor ecx, 0xa09fbe39
call fcn.01257f25
salc
inc esp
daa
xlatb
adc ebx, edi
add ebx, ebx
push ss
fbld tbyte [esi - 0x75]
dec esp
and eax, 0x40a7e804
cli
inc dword [ecx - 0x3f]
inc ecx
shl ecx, 0x9a
xor di, cx
call fcn.013b2cf1
mov ecx, 0xf185ca8f
neg cl
sub esi, 4
sub ecx, ecx
jo 0x12759c3
mov eax, dword [esi + ecx*4]
ror ecx, 0x9a
push ecx
xor eax, ebx
call fcn.013651f9
into
dec edx
and eax, 0xf6b4d080
pop ebx
pushal
fldcw word [ecx + 0x6568ebbd]
sal ebp, 0x89
iretd
inc word [esp + 2]
not dx
rol cl, cl
adc ecx, 0xe38d5ba8
ror dword [esp], cl
and ax, dx
pop ecx
movsx edx, cx
jmp 0x1326a4f
mov word [ebp + ecx - 0x710], ax
lea eax, [ecx + ecx*4 + 0x7954eb8]
not al
lea esi, [esi + ecx*4 - 0x1c44]
mov edx, dword [esi + ecx*2 - 0xe20]
sal cl, 0x44
dec ax
xor edx, ebx
sal ecx, 0x54
add cx, 0xb1b1
lea edx, [edx + eax*2 + 0x17e9b13a]
sal ecx, 0x3c
not edx
bswap edx
dec edx
or cx, ax
sete al
xor ebx, edx
rol eax, cl
adc edi, edx
jmp 0x137ca0f
xor eax, 0x9e944c1d
sar cl, 1
jmp edi

Function at 0x12319a4
Capabilities:
Execute syscall

Disassembly:
dec eax
or esi, ebx
dec eax
not esi
call fcn.0127cf0a
sysenter
pushfd
mov dword [esp], 0xe4128420
call fcn.0137ab9d

Function at 0x1239f6e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xee189e9e
pushfd
mov edi, 0x2c2b3d35
call fcn.0127f540
call fcn.01324fc6
Function at 0x123ca30
Capabilities:
Authenticate hmac

Disassembly:
add al, 0xff
dec eax
dec cl
ror ax, 0xe1
neg cl
xor bl, cl
inc eax
lea ecx, [esp + ecx + 4]
loope 0x123ca04
fnstenv [edx]
fld dword [eax - 0x73]
dec esp
or al, 4
mov word [esp + eax - 1], ax
mov dword [eax + ecx - 1], edx
mov edx, dword [eax + esi - 6]
xor dword [esp + eax - 1], eax
movsx ecx, ax
je 0x1397481
sub esi, 4
call fcn.01781348
pop edx
inc ebp
in al, 0xc1
mov ch, 0x1a
inc esi
js 0x123ca78
lahf
aad 0x26
push 0x70
xor al, 0x9f
aad 0x6e
adc cl, byte [esp + esi]
lahf
aad 0x12
jle 0x123ca85
xor al, 0x9f
aad 0x6e
cmp cl, byte [eax]
xor al, 0x9f
aad 0x16
mov ebx, 0x7dccbc4c
mov ecx, 0xcbfd23ad
retf
dec edx
pop ecx
jg 0x123ca0c
cwde
mov ebx, dword [esi + edx + 0x5f]
int3
push ss
pop edi
enter 0xffffffffffffff8c, 0x5c
push ss
pop edi
clc
loopne 0x123ca53
pop esp
push ss
pop edi
cmp ebp, dword [ebx - 0x75]
invalid
shl cl, 0xa2
not dl
sal cl, 0x42
dec dl
neg ax
sub eax, 0xc4b84aa5
and cx, ax
xor bl, dl
shl ecx, 0x1b
shr eax, 0x42
dec cl
adc edx, esp
ror ecx, 0x72
call fcn.013746c9
xor dl, bl
xadd cl, ah
js 0x13a825e
shr cx, 0x87
xor al, bl
add al, 0xa0
sub cx, cx
sar ecx, 0xfa
ror al, 1
push ecx
sal ecx, 0x45
adc al, 6
dec dword [esp + ecx*2]
ror cx, 0x84
add ecx, ecx
xor al, 0x81
shl cl, 0x21
shr ecx, 0x85
ror al, 1
sar byte [esp + ecx], 0x82
call fcn.013b15d8
lea esi, [esi + eax*2 - 7]
lea eax, [eax + ecx*4 + 0x2fad3e20]
xor edx, ebx
add edx, ecx
pop ecx
ror eax, 0x61
xor edx, 0xa09fbe39
shl eax, 0xf
bswap edx
call fcn.012753b8
dec cx
mul ebp
movsx ebx, cx
inc esp
movsx edx, cx
inc ecx
mov dword [esi + ecx + 0x6b65f359], edx
dec eax
sar ebx, cl
call fcn.01323aeb
mov ecx, 0xb8b38fa0
lea eax, [ecx + ecx*2 + 0x73a68c2b]
and cl, cl
sbb esi, 1
movzx edx, byte [esi]
jmp 0x1365172
neg cx
sub dl, 0x80
or ax, cx
neg dl
xor dl, 0x9b
and cl, ah
jne 0x1265f53
Function at 0x1247bcf
Capabilities:
Encode data using base64

Disassembly:
push edi
inc esp
xor dword [esp], eax
pop edi
shr dx, 0x85
dec ebp
arpl ax, ax
inc esp
movzx ebx, ax
dec eax
xchg edx, eax
dec esp
lea ecx, [eax*8 - 0x41ff0fc9]
dec ebp
adc edi, eax
inc ecx
jmp edi
inc eax
xor bh, dl
dec eax
lea edx, [esp + edx + 0x20]
inc si
add eax, dword [edx + ebp - 0x3a12e06e]
dec eax
mov dword [esp + ebp], ebp
dec edx
lea ecx, [ebp*8 + 0x5cabfda2]
inc dx
not dword [esp + ebp - 0x3a12e069]
dec edi
lea esi, [ebp + esi - 0x3a12e070]
dec eax
lea edx, [esi*4 - 0x3e63ef1]
inc di
mov dword [esi + ebp*2 - 0x7425c0dc], eax
jmp 0x13323aa
inc ecx
mov edi, 0x31a3891c
inc esi
movzx edi, byte [ecx + edi - 0x31a3891c]
jmp 0x136d4fb
inc cx
sal edx, 0x6f
pop ecx
inc ecx
pop eax
pop eax
inc ecx
pop ecx
jb fcn.0136d40d
push edi
pushfd
mov edi, 0xd7905123
push ebp
mov edi, dword [esp + edi*2 + 0x50df5dc2]
mov dword [esp + 8], 0xe4166a6c
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.0137ab9d
movzx ax, byte [ebp]
mov ecx, 0x2c922502
lea edx, [ecx + ecx*8 + 0x52ab8baf]
shl ecx, 0x27
or cl, byte [ebp + ecx - 0x491280fe]
push edx
add dword [esp], edx
neg dword [esp]
add ebp, 2
not al
not cl
xor dx, dx
and al, cl
shl dl, 0x47
inc dl
mov word [ebp], ax
sbb esi, 4
mov ecx, dword [esi]
mov eax, 0x6daf2eb8
pop edx
dec edx
xor ecx, ebx
call fcn.01340892
dec eax
lea esp, [esp + 0x18]
jne 0x132dfb7
inc ecx
pop edi
mov esi, 0x1bd5fa5
inc esp
mov eax, esi
inc ecx
or al, 0xb8
pop edi
inc ecx
not ecx
mov esi, 0xb022f6a4
inc ebp
mov dword [esi], ecx
dec eax
lea edx, [esi + esi*8 - 0x45efc2e2]
inc ebp
mov eax, dword [esp]
push edx
dec ecx
add esp, 4
inc esp
xor eax, edi
inc ecx
inc eax
inc ecx
xor eax, 0xe881e607
inc ecx
inc eax
inc ecx
bswap eax
inc esp
movsx edx, dx
pop eax
inc ecx
ror eax, 2
jmp 0x176eddc
jmp 0x13915ea
push 0xc38ee19f
inc ebp
xor edi, ecx
call fcn.012669a9
mov ebp, eax
inc ecx
neg eax
jmp 0x1222ec9
Function at 0x124d494
Capabilities:
Encode data using base64

Disassembly:
inc ecx
shr dl, 0x45
dec edi
lea eax, [ebx + ebx*2 - 0x2c7d72f6]
inc edx
lea ebx, [ebx + ebx*4 - 0x6aea084c]
add esi, esi
pop esi
ror ebx, 1
dec ecx
lea edx, [ebx + esi - 0x55730bdc]
jmp 0x1325a16
shl dx, cl
mov word [ebp + eax - 0x65963d3d], dx
mov dword [esp + eax - 0x65963d3d], eax
lea esi, [esi + eax - 0x65963d41]
movzx edx, ax
mov ecx, dword [esi + edx - 0x3d3d]
call fcn.01230093
inc ecx
sar ebx, 0x54
not ecx
inc edx
lea ecx, [ecx + ebx*2 + 0x17b6e137]
jns 0x133a04f
not ebx
inc dx
sal dword [esp + ebx - 0x58891fb3], 3
dec ebp
sbb ebp, ebx
neg ebx
dec esi
lea ecx, [esi + ebp*2 - 0x19fda3ff]
inc ecx
push ebx
dec ebx
call fcn.0132273b
inc ecx
movsx edx, dl
inc esp
adc ch, dl
rol ecx, 3
inc ecx
movsx ebx, bx
mov esi, 0x248b5ab3
inc esp
movzx eax, bx
lea ecx, [ecx + esi*8 - 0x7a545e6e]
dec ecx
and edx, ebx
bswap ecx
dec eax
lea eax, [esi + 0x35b9078a]
and ebp, ebp
push edi
inc ecx
push ebx
dec edx
adc dword [esp + ebx - 0x5e9], 0x273654a9
inc edx
xor dword [esp + ebx - 0x5e1], ecx
dec edx
and dword [esp + ebx*4 - 0x17a4], 0x521c0a18
inc edx
xor dword [esp + ebx - 0x5e5], 0x59a8d916
dec edx
mov edi, dword [esp + ebx - 0x5e1]
dec eax
shr eax, 0x3d
inc ecx
bswap ebx
dec eax
arpl cx, cx
dec eax
and esi, ebp
dec esp
adc edi, ecx
inc di
add edx, dword [esp + ebp*2 + 2]
call fcn.0176bc1a
inc ecx
mov ebx, dword [esp]
inc ecx
mov ebx, 0x58891fb7
inc ebp
movzx edx, bl
dec edi
lea esp, [ebx - 0x58891fb3]
inc ebp
movsx ebp, bx
mov esi, 0x560836ba
xor ebx, edi
bswap ebx
inc ecx
bswap edx
inc edx
lea ebx, [ebx + ebx*2 + 0x317f6513]
inc ecx
push edx
inc ecx
push ebx
neg ebx
jmp 0x121dc63

Function at 0x125f543
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
ror ecx, 1
rol dl, 0x25
sub edx, 0xf502978e
xor ecx, 0xdaa11f19
inc dword [esp + edx*2 - 0x468b2d54]
movsx eax, dl
lea ecx, [edx + ecx - 0x37ff8539]
inc edx
bswap ecx
inc dx
shl byte [esp + edx - 0x234596a8], 0xa7
not dl
xor ebx, ecx
add edi, ecx
movzx ecx, word [esp + edx - 0x2345964d]
bswap edx
add cx, word [esi + ecx - 6]
lea esi, [edx + esi - 0x51964529]
pop edx
call fcn.013961a3
sub al, 0x3e
xor cl, bl
add word [esp + eax*2 - 0xffca], ax
jno 0x139a058
inc ecx
mov eax, eax
inc ecx
not edx
neg cx
ror ebp, cl
movsx edx, al
inc ecx
neg edx
dec ecx
shr eax, 0x7e
jae 0x1776b51
xor eax, eax
not cl
dec cl
call fcn.0179e19c
dec cl
rol al, 0x42
jb 0x13500ea
inc ecx
xor cl, 0xbe
mov esi, dword [esp + 3]
inc ecx
ror cl, 1
call fcn.012306b9
dec eax
lea ebx, [ecx*2 + 0x4cae6a2b]
inc ecx
rol edx, 1
shr bx, 0xa4
dec ebp
lea ebx, [eax + ecx*8 - 0x37d74e5b]
inc ebp
lea edx, [edx + edx - 0x38e9d09a]
inc ecx
rol edx, 1
call fcn.013975bf
push 0x15
pop ss
outsd dx, dword [esi]
stc
dec edx
inc edx
pushal
invalid

Function at 0x1262add
Capabilities:
Encode data using base64

Disassembly:
ror ecx, 0xc3
mov ecx, dword [esi + eax*2 - 0x7a31082e]
call fcn.01243210
Function at 0x1264151
Capabilities:
Encode data using base64

Disassembly:
inc ecx
shr al, 0xc7
inc edx
xor dword [esp + ebx - 0x215f], ebx
dec edx
mov edi, dword [esp + ebx - 0x215f]
dec eax
arpl bx, bx
inc ecx
dec ch
dec eax
sar eax, 0xca
dec esp
add edi, ebx
dec edx
mov dword [esp + ebx*2 - 0x4306], 0x1aa6e097
dec ecx
rol ecx, 0x81
inc ecx
movzx ecx, dl
inc ecx
pop ebx
pop esi
pop ebp
pop ebp
pop ebp
pop ebx
inc ecx
pop ebx
jae fcn.0136d40d
ror byte [esi + 0x23], cl
loope 0x12641c6
xlatb
adc dl, al
adc ch, byte [edi + 0x3fd806c6]
stosb byte es:[edi], al
loop 0x1264207
jne 0x12641fe
xor al, 0xc3
arpl word [edi + 0x6d], bp
arpl word [esp + ebp*2 + 0x33], si
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax - 0x7f], cl
imul byte [edx + eax]
stosb byte es:[edi], al
pop eax
and byte [esi - 1], 0x8c
add al, 0xe2
dec esi
inc eax
ljmp 0x3b78

Function at 0x12663c9
Capabilities:
Encode data using xor

Disassembly:
not edx
mov dword [esp + eax - 0x104cffff], ecx
sub ecx, 0x868b390d
shl word [esp + eax - 0x104cfffd], 0x26
inc edx
dec cl
neg cl
jge 0x1358795
mov edx, 0xf016630e
lea ecx, [edx + 0x33970faa]
mov word [ecx + ebp - 0x23ad72b6], ax
mov eax, dword [esi + ecx*2 - 0x475ae574]
or ecx, 0x5e9fab17
adc ecx, ecx
xor eax, ebx
and ecx, edx
ror dx, 0x6f
neg eax
sar ecx, 0xd5
call fcn.0136ac28
xor ebx, edx
and cl, cl
adc edi, edx
pop ecx
neg ecx
lea edx, [eax + ecx*8 + 0x4a9f6daf]
movzx edx, byte [esi + eax*2 - 0x209a0007]
lea esi, [esi + eax*4 - 0x41340005]
jle 0x13ace06
bswap ecx
inc esp
movzx ebp, bp
lea ecx, [edx + ecx - 0x1826035]
inc ebp
movzx ecx, bl
ror ecx, 2
inc esp
xadd ch, bl
push edi
dec edx
lea esi, [ebp*4 + 0x462bc5b4]
dec eax
adc esi, edx
jnp 0x1778e18
or ebp, dword [ebx - 0x58]
call 0xc8ed4c56
sub dword [edi - 0x28203b1a], 0xc4e6af9d
ret
shr ecx, 0x7d
add ax, 0x3d18
xor dl, bl
rol dl, 1
call fcn.0177a446
inc sp
xor ebp, edi
call fcn.0124ad3c
rcr byte [ebx + 0x33], 0xcf
xlatb
aaa
aad 0x1d
mov ebx, 0xfbc14d9
add eax, 0x44c7489c
and al, 0
pop ebx
or eax, 0xa5e8f88c
adc bl, ch
invalid
xor dword [esp + edx - 0x68b0], ecx
dec eax
lea edi, [ebp + 0x323692c]
sub al, 0x69
and eax, dword [ebx]
pop edi
dec eax
arpl cx, cx
mov ebx, 0xe532fb1b
inc cx
inc ebp
dec esp
add edi, ecx
inc si
mov ebp, dword [edx - 0x68b0]
dec ebp
lea esp, [esp + edx*8 - 0x3457e]
inc ebp
add ecx, ecx
jge 0x13b9d2a
add byte [edi], bl
cmp edx, esp
insb byte es:[edi], dx
push es
mov esi, 0xa07187b8
jle 0x1778e22
xchg ebx, eax
lea edx, [edi]
inc bh
pop esi
int 0xcb
add al, 0xe1
enter 0x33e3, 0x5b
scasd eax, dword es:[edi]
inc esi
inc ecx
mov esp, 0xff8f09ae
invalid

Function at 0x128785d
Capabilities:
Encode data using base64

Disassembly:
jbe 0x136f8d3
inc ecx
mov ebx, 0xf32aac0c
dec ecx
mov eax, dword [esi]
inc ebp
movsx eax, bx
inc ecx
push ebx
inc ecx
neg bl
dec ebp
mov ecx, dword [esi + 8]
dec ecx
add esi, 8
inc ecx
mov ebx, ebx
dec eax
not eax
dec esp
lea ebp, [ebx + ebx*8 - 0x61477662]
dec ecx
not ecx
jmp 0x175e6e8
mov dword [esp], 0xbf982b97
movzx edx, byte [esi - 6]
pop eax
dec al
bswap ecx
lea esi, [esi + ecx*2 - 0x2e2b335c]
xor dl, bl
call fcn.01263705