joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdffcbe
Capabilities:
Execute anti-debugging instructions

Disassembly:
jae 0x17cca6b
push eax
dec ebx
push 0x93a02c93
lea esp, [esp + 4]
jne 0x18f25df
mov eax, 0x1d3b298e
mov eax, dword [ebp + eax - 0x1d3b298e]
jmp 0xf342a4
rol al, 1
mov dword [esp + ecx - 0x3d139f00], edx
mov dword [esp + ecx - 0x3d139efc], 0xc3923ba3
not al
add dl, dl
jge 0x194f2ac
xor eax, ebx
call fcn.017e5077
jmp 0xd5c82c
jmp 0xdffce3
push 0xda38ed8f
lea esp, [esp + 4]
call eax
mov ecx, 0xae9787
mov ebp, dword [ecx + ebp - 0xae978b]
movzx edi, cx
call fcn.01920295
mov ecx, 0x8822723f
movzx edx, cl
mov ecx, dword [esi + edx*8 - 0x1f8]
neg dx
lea eax, [edx - 0xdc865f0]
rol edx, 2
lea esi, [esi + edx - 0x3ff00]
sets dl
xor ecx, ebx
ror dx, 0xe8
bswap ecx
jae 0xce5d52
jae 0xcfe969
or dword [esp + edx - 0x69976b03], 0x2909c014
mov cl, byte [ebp + edx - 0x69976b01]
lea ebp, [ebp + edx - 0x69976b01]
call fcn.0184904c
xor bl, al
neg cx
call fcn.017f1b17
mov eax, 0x8829fa92
dec ecx
pop edx
call fcn.017a454e
mov eax, 0xcd9c4d36
add ax, 0x3125
mov cx, word [edi]
mov edx, eax
jb 0x19ddff9
neg dx
mov dx, word [edi + 2]
neg al
not ax
sub eax, eax
lea edi, [eax + edi + 2]
not eax
neg eax
adc eax, eax
adc cx, dx
mov edx, eax
sar eax, 0x6a
mov word [edi + eax], cx
neg ax
mov ecx, dword [eax + ebp]
shl edx, 0x1c
neg dl
lea ebp, [ebp + eax*8 + 4]
setae dl
xor ecx, ebx
bswap ecx
inc ecx
push eax
sal eax, 0x61
pop eax
rol ecx, 1
shr al, 0xe1
setnp dl
lea ecx, [ecx + eax*2 + 0x75af6d83]
xchg dx, ax
xor ebx, ecx
shr eax, 0x6c
adc esi, ecx
neg dl
mov ecx, eax
add eax, esi
jmp eax
mov eax, 0xf3975a3b
mov eax, dword [ebp + ebx*4]
jmp 0xe659b5
sbb al, 0x92
dec word [esp + ecx*2 - 0x7a273e00]
jge 0x181e5af

Function at 0xe06a74
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x52137a65], edi
push ebx
and edx, edx
movzx ebx, al
mov ebp, esi
ja 0x18e1ab1
jmp 0x176b2e7
mov ecx, 0xd40a7b26
add ebp, 4
and ecx, 0x6cb65833
add byte [eax], al
add byte [ecx - 0x49a7cc1f], al
insb byte es:[edi], dx
xor eax, ebx
neg cx
neg eax
movzx edx, cx
inc ecx
ror eax, 1
and dx, 0x45b8
xor eax, 0xf256e08
push edx
or cx, dx
dec dword [esp + ecx - 0x4402a7df]
not eax
xor ebx, eax
shr edx, 0x5d
shr dword [esp + ecx - 0x4402a7df], 0x93
and dl, 0x92
adc esi, eax
mov eax, 0xb6073a23
xchg dword [esp + edx*8], ecx
neg byte [esp + ecx]
or ecx, dword [edi + ecx*2]
or edx, 0xb712a7a0
call fcn.017effee
xchg dword [ecx + 0x11], esi
aas
sub al, 0xf0
push esi
mov dword [ebx], esi
bnd je 0x176b2ef
cdq
mov bl, 0x94
xor dh, dh
js 0x176b3bc
in al, dx
or ecx, ebp
pop eax
popal
aam 0x4f
or al, 0xa1
or al, 0xc0
xchg ebx, eax
mov bl, 0xb0
rol byte [edx], 1
xor edi, edi
jae 0x176b3a4
cmp al, byte [ecx*2 + 0x46cb44ef]
sbb ecx, dword [ecx + ebx*2 + 0x32fc5fd5]
or dl, byte [esp + esi*4 - 0x4d]
std
invalid
jmp 0x176b3d7
jae 0x176b391
push 0xf3554d38
cdq
mov al, 0x50
lcall 0x2340, 0xf2c936ea
mov edi, dword [esi - 0x3bb71b9d]
popal
add cl, bl
daa
out dx, eax
call 0x2b0ba593
push edi
xchg ecx, eax
daa
add dword [eax], eax
add byte [eax], al
mov eax, 0xb9e2dcbe
add dword [ebp + 0x24], ebp
mov dword [0xfc09859c], eax
or esp, edi
jp 0x176b3dc
or ebp, esi
cmc
dec eax
pop ds
push esi
iretd
Function at 0xe57f05
Capabilities:
Encode data using xor

Disassembly:
bswap edx
movzx ax, byte [ebp + edx - 0x38fabf5a]
call fcn.0195d4a3

Function at 0xe6f502
Capabilities:
Encode data using base64

Disassembly:
call fcn.00eaf0af
dec eax
jmp 0xcf2427

Function at 0xe74b92
Capabilities:
Encode data using xor

Disassembly:
neg ecx
sub ecx, 0x87278398
pop edx
mov dword [esp], eax
bswap ecx
xor ebx, ecx
and dword [esp], 0x8e89cd3a
and dword [esp], eax
jp 0x190128f
mov edx, 0x50ba6b94
movzx ecx, dx
xchg edx, ecx
lea esi, [edx + esi - 0x6b98]
or edx, ecx
mov ecx, dword [edx + esi - 0x50ba6b94]
lea eax, [edx + edx*2 - 0x23e80ef2]
sal ax, 0xa4
jbe 0x189ca22
shl dl, 0x47
mov cx, word [esi + edx - 0x7e827efc]
lea edx, [edx - 0x4e4ac5b]
lea esi, [esi + edx - 0x799dd29f]
mov word ss:[eax + edx - 0x799dd2a5], cx
push ss
popal
sub eax, 0x66368662
mov dword [eax + edx - 0x799dd2a5], ecx
call fcn.01915886
xor ecx, ebx
shr edx, 0x9a
not edx
ror ecx, 1
sar eax, 0xc8
sar dl, 0xa2
inc ecx
xor ecx, 0x9bbb41b8
sar eax, 0x6d
call fcn.00d74b95
or byte [ebx - 0x30b6e1d3], 0xe4
jbe 0x189c9fc
das
dec eax
sbb ebx, esi
jnp 0x189cab1
xchg esp, eax
in al, 0xcd
nop
stosb byte es:[edi], al
lodsb al, byte [esi]
mov al, byte [0xb8c76a0c]
jl 0x189ca0f
mov dword [0x104b31e3], eax
jae 0x189ca69
inc edx
jmp 0x189cab3
hlt
stosb byte es:[edi], al
ljmp 0xb130
cmc
inc esi
rol edx, 1
xor byte [ecx + 0x795eae6e], dh
scasd eax, dword es:[edi]
xchg edi, eax
clc
xchg esp, eax
sbb al, 7
sbb al, 0x32
or byte [eax], dh
mov esi, 0xbf1a3438
outsb dx, byte [esi]
fiadd word [ebx + 9]
int 0x84
mov dh, 0xf7
xor eax, 0xf6f12feb
pop edx
lahf
dec esp
out dx, eax
cmp eax, 0xd165beb3
iretd
adc esi, ecx
sar ax, 0x6f
ror byte [esp + 1], 4
sal eax, 0x25
mov dword [esp + eax - 0x5ebfffe0], esi
ret

Function at 0xea16af
Capabilities:
Encode data using base64

Disassembly:
or al, dh
mov dword [esp + 4], 0xb29bc284
rol cx, 1
inc ax
pop eax
inc cx
shr edx, 0xa2
xor bx, cx
lea edx, [edx + edx - 0x626d89c9]
lea edi, [edi + edx*4 - 0x621c247e]
mov word [edi + edx*4 - 0x621c247c], cx
not edx
sar word [esp + 4], 0x44
pop ecx
pop edx
jae fcn.017b4ebb
push 0x7ebbb93f
rol word [esp + 2], 0x62
mov byte [esp + 1], 0x23
movzx eax, byte [ebp]
mov ecx, 0x80341ba6
add ebp, 1
xor al, bl
lea edx, [ecx + ecx - 0x44e2d07c]
inc al
not al
sub dl, ch
sbb al, 0x11
rol al, 1
sal edx, cl
sal byte [esp], cl
pop ecx
not al
xor bl, al
add eax, esp
and edx, edx
call fcn.017f3f18
mov edx, 0x201aed36
not edx
mov ecx, dword [ebp]
movsx eax, dx
mov edx, dword [ebp + eax*2 - 0x258e]
push eax
and eax, eax
lea ebp, [eax + ebp - 0x12c1]
adc eax, eax
and al, byte [esp + eax - 0x2590]
pop eax
mov dword fs:[ecx + eax - 0x12c9], edx
lea edx, [eax*4 + 0x20388f86]
jns 0x18a1d17
or dword [esp + ecx - 0x7300], 0xb0243699
rol byte [esp + ecx*2 - 0xe5fe], 3
mov dword [esp + ecx*2 - 0xe600], ebp
ret
inc ecx
add eax, eax
xchg edx, eax
xor ecx, 0x9a318d3b
push edx
push eax
xor al, byte [esp + edx*2 - 0x4b21]
rol ecx, 1
add byte [esp + eax*2 - 0x4071b512], ah
adc edx, 0x6010b99f
lea ecx, [ecx + eax*2 + 0x75481687]
xor ebx, ecx
call fcn.019270ce
lea edi, [edi + eax*2 - 0x2596]
mov ecx, dword [edi + eax*2 - 0x2592]
dec edx
xor ecx, ebx
jmp 0xed0a1f
Function at 0xea2863
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + edx - 0x6b00de38], ecx
lea eax, [eax + edx + 0x7a009ddd]
ror ecx, 0xa9
xor dx, dx
not eax
not edx
pop edx
sbb eax, 0xd0b6a784
bswap eax
add dword [esp + edx - 0x6873237e], 0x660c633d
neg eax
sub eax, 0x2122478d
xor ebx, eax
neg cx
add edi, eax
movzx eax, dl
mov al, byte [esi + eax*8 - 0x400]
mov dword [esp + edx - 0x68732380], 0x5db014ae
sal ecx, 6
call fcn.0192a8e9
mov byte [0xda3e80a8], al
add eax, 0x7732188f
int1
inc ebp
or byte [edx - 0xd9816ef], dh
sbb eax, 0xcc9a3504
pop esp
or eax, 0x29840dde
sbb dword [edx], eax
mov dl, 0x16
inc ebp
xchg edi, eax
ljmp 0x4c95
not eax
add dl, byte [esp + ecx - 0x6873237a]
jg 0xe76a0c

Function at 0xeb13fb
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sar dl, 0x43
imul cl
lea edx, [edx*2 - 0x5d4c953]
mov word [ebp], ax
pop ecx
pop eax
jmp edi
sal edx, 0x1d
adc ebp, ecx
mov dword [esp + edx - 0x40000000], 0x87acc48b
shl dword [esp + edx*2 - 0x7ffffffc], 0x41
push edx
mov edx, dword [edi + edx*2 - 0x80000000]
jne 0xfaaf90
adc ecx, 0xacad448f
mov cl, byte [ebp + edx*2 - 8]
sub edx, 0x6e29c211
xchg word [esp + 6], dx
movzx ax, byte [ebp + 2]
add ebp, 2
sar edx, 0x32
jne 0xd569d7
lea ecx, [eax - 0x4edc4980]
lea esi, [esi + ecx*2 - 0x62541002]
neg eax
mov ecx, dword [eax + esi - 0x7ff9ae81]
lea edx, [eax*8 + 0x9a88f81]
mov ecx, dword [edi + 4]
ja 0x19166e8
call fcn.018fcb55
mov edx, 0xd21abc81
xor edx, 0xc017ea1f
mov edx, dword [edi + edx - 0x120d569e]
mov eax, 0x1c0b5fab
call fcn.00d17c96
mov ecx, 0xa6352c08
fld qword [edi]
movsx eax, cx
sar ecx, 0x9e
shr eax, 0xf6
lea esi, [esi + eax*8 - 4]
mov ecx, dword [esi + eax*2]
jb 0x194ccff
lea edx, [eax + eax + 0x5885ebbb]
xor ecx, ebx
ror ax, 0xaf
dec edx
xor dx, dx
not ecx
dec ecx
bswap ecx
sal dx, 8
shl al, 0x22
inc ecx
sal dx, 0x67
call fcn.017c58dd
ror eax, 3
jmp 0x192d141
adc edi, 4
xor eax, eax
test ecx, ecx
lea esp, [esp + 0xc]
je 0x172d47f
jmp 0x17a04a2
mov ecx, 0xe00c9e12
inc eax
lea edx, [ecx*8 - 0x76f028e9]
rol eax, 1
or dl, cl
bswap edx
neg eax
and ecx, edx
shl edx, 0x5c
xor ebx, eax
jmp 0x1a044cb

Function at 0xebeb27
Capabilities:
Encode data using add xor sub operations

Disassembly:
sal dword [esp + edx*2 - 0x5a0c6bd2], 0x9c
mov dword [esp + edx - 0x2d0635eb], edx
rol cl, 1
neg edx
add cl, 0xad
push edx
xor dword [esp + 8], 0x83a9d684
sbb word [esp + 6], dx
rol cl, 1
or edx, edx
dec cl
xor cl, 0x96
ror dl, 2
xor bl, cl
lea ecx, [esp + ecx + 0x18]
and byte [esp + 9], 1
mov word [ecx], ax
mov dword [esp + 0x10], edx
adc dl, 0x30
mov edx, dword [ebp]
adc ebp, 4
Function at 0xebeb8c
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
xor edx, ebx
bswap edx
or byte [esp + 0x17], 0x1d
or byte [esp + 5], 4
neg edx
inc edx
call fcn.00e3221c
mov ebp, dword [esp + edi - 0x175f9264]
mov edi, dword [esp + edi*2 - 0x2ebf24d0]
bswap ebx
mov ebx, dword [esp + 0x14]
call fcn.00d15a64
mov eax, 0xe9b84424
movzx edx, al
lea ecx, [edx - 0x3ad4df5a]
lea ebp, [edx + ebp - 0x28]
not edx
sub ax, ax
adc edx, edx
mov edx, dword [ebp]
xor edx, ebx
ror edx, 1
xor al, 0x84
neg edx
ror eax, cl
shr eax, 0xff
call fcn.0182fa9a
push edi
scasd eax, dword es:[edi]
cwde
movnti dword [ecx + 0x27312851], ebx
jecxz 0xebeb74
das
arpl di, bx
push ss
ljmp 0x2fd9

Function at 0xf32689
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xa8
add edx, edx
lea edx, [edx + edx*8 - 0x57556866]
xor bl, al
mov dword [esp], 0x34836601
neg byte [esp + 3]
lea eax, [esp + eax + 8]
call fcn.01813571

Function at 0xf3cbac
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], 0x39aa6123
shr ecx, 8
jmp 0x1914eda
xor ecx, edi
inc edx
call fcn.019ae874

Function at 0xf41db2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov dx, si
btr dx, sp
shl bp, 0x94
mov ebp, esp
btc edx, 0x2c
ror edx, cl
rcl dl, cl
mov edx, dword [ebp + 8]
test cl, 0x13
jmp 0xe811d9

Function at 0xf4864c
Capabilities:
Encode data using base64

Disassembly:
shr dx, 0x6d
ror esi, 2
inc esp
mov esi, dword [esp + edx + 0x11]
lea esi, [esi + eax + 0x5a7e0b12]
dec esp
mov dword [esp + edx + 0x10], ebp
xor dword [esp + edx*2 + 0x10], esi
dec esp
mov dword [esp + edx*2], edx
shr byte [esp + edx*8 + 0xc], 0x66
dec eax
adc ebp, dword [esp + edx*2 + 8]
dec esi
mov ebp, dword [esp + edx*2 - 0x18d16]
inc ebp
movsx ecx, bx
dec eax
arpl si, si
inc ecx
mov ecx, ecx
dec eax
ror eax, 0x92
dec eax
adc ebx, esi
inc ecx
shr dl, 0xe3
jae 0x182e245
dec eax
shr dword [esp + edx*2 + 8], 0x41
dec eax
mov dword [esp + edx*2], ebx
ret 0x10

Function at 0xf48783
Capabilities:
Encode data using base64

Disassembly:
push 0x979788bc
lea esp, [esp + 8]
jmp fcn.00d33e54

Function at 0xf78663
Capabilities:
Encode data using xor

Disassembly:
pop edx
pop edx
pop eax
jns fcn.00e2bf93
or al, 0x52
sal dword [edx], 1
mov dl, 0x3d
jl 0xf786a8
insd dword es:[edi], dx
xor al, 0xb2
stosb byte es:[edi], al
sub dh, ch
pushfd
aas
xor dl, bh
push ecx
push esi
das
mov dl, 0xb1
cli
inc eax
lea edx, [esi - 0x231a3343]
push ds
stc
or eax, 0x250a01ac
mov dl, 0xfd
lea ebx, [edi - 7]
dec ecx
jb 0xf78706
invalid
call 0x382ad142
xor esi, dword [edi]
sahf
add dh, byte [edx + 0x3477ab7b]
or dword [edx], esi
jne 0xf786ab
invalid
invalid
Function at 0xf8379d
Capabilities:
Encode data using base64

Disassembly:
inc cx
shr ebx, 0xc
dec dx
inc ecx
neg esi
inc cx
dec ecx
dec edx
mov dword [esp + edx - 0x13], eax
neg cl
inc edx
inc dword [esp + edx*2 - 0x24]
dec esp
and ecx, eax
not cl
ja 0x190014e
inc ebp
mov ebx, edi
inc ecx
pop esi
inc esp
xor ch, cl
inc ecx
inc bh
dec eax
add ecx, esp
inc dx
mov ebp, dword [ecx + edx*2 - 0x26]
inc ecx
inc bl
dec edi
lea esp, [edx - 0x15]
inc bx
mov dword [esp + edx*8 - 0x98], ebp
inc ebp
sub edx, ecx
or dx, dx
inc esi
mov esi, dword [edi + ebx - 0x74bd2b23]
dec edx
lea edi, [edi + edi - 0x74bd2b1f]
inc ebp
xor esi, ebp
inc cx
xor edx, ebx
dec ecx
not ecx
inc ecx
neg esi
inc ecx
dec esi
inc ecx
push edx
inc ecx
not esi
jmp 0xebbd8a

Function at 0xf837b4
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
mov dword [esp], edx
not ecx
inc word [esp + 1]
sub dword [esp], 0x1b9e2e36
dec ecx
lea eax, [edx*8 - 0x69f1775e]
neg ecx
lea eax, [edx + eax*8 + 0x413b8426]
bswap ecx
shl edx, 0x62
sub ecx, 0xa982f106
xor dx, word [esp + 2]
jge 0x180fe44
rol ecx, 2
inc edx
xor ecx, 0x24b66498
bswap edx
push eax
push eax
inc ecx
call fcn.00db7d8c
movzx ecx, byte [ebp + eax]
jne 0x19ee493
mov ecx, 0x79997223
lea eax, [ecx + ecx*8 + 0x4aabf215]
mov edx, dword [ecx + ebp - 0x79997223]
jmp 0x19f33cd
lea ebp, [ebp + ecx - 0x7999721f]
or ecx, eax
xor edx, ebx
rol edx, 1
call fcn.00f883f1
and ax, ax
xor ecx, ebx
ror word [esp], 0x22
dec ecx
neg ax
mov edx, 0x74ae0a3b
jl 0x19f69e1
bswap ecx
shl dx, 0xa5
call fcn.00eb0bfe

Function at 0xf8e608
Capabilities:
Encode data using xor

Disassembly:
sub dword [esp + eax*2 - 0x9fff0], eax
xchg byte [esp + edx - 0x64110714], al
mov ecx, dword [esi + eax*8 - 0x280000]
add al, byte [esi + eax*8 - 0x27fffc]
call fcn.019d1258
salc
fld dword [0x2a911ddc]
xchg esp, eax
invalid
Function at 0xfad296
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 0x24], edx
sar dh, 8
xor edx, edi
mov dx, 0x6e30
mov edx, dword [ebp - 0x10]
cmc
jmp 0x1726dd5
rol al, 1
inc al
rol al, 1
xor ecx, 0x8ba71abf
xor bl, al
sub dword [esp + ecx - 0x6e081b3f], ecx
ja 0x17e1cb3
mov word [edi + ebx*2 + 0x1c8], cx
mov cl, 0x9c
xchg cx, cx
mov ecx, dword [ebp - 0x24]
jmp 0xfa8682
jmp 0x185e912
mov dword [esp + edx - 0xffc8], ecx
setle byte [esp + edx - 0xffc8]
movzx eax, byte [esi + edx*2 - 0x1ff90]
sets cl
xor al, bl
shr cx, cl
sub al, 6
jmp 0xf3446b
mov dword [ebp - 0x28], edx
cmp esi, esi
mov dword [ebp - 0x10], ecx
test edx, esp
cmp ah, dl
lea eax, [esp + eax + 4]
mov cx, word [eax + ecx - 0x6e081b3f]
lea edi, [edx + edi - 0xffca]
sar edx, 0xdc
movsx eax, dl
mov word [edi + edx*4], cx
inc eax
jge 0x1a2ca87
lea ebp, [ebp + eax*2 - 0x4869c672]
bswap eax
movsx ecx, byte [esp + eax - 0x37e3341c]
mov edx, dword [ebp + eax - 0x37e33424]
xor edx, ebx
mov dword [esp + eax - 0x37e33424], 0x542509bc
not edx
xadd cl, ah
ror edx, 1
ror cx, 0x21
not edx
shr ecx, 0xfa
shl dword [esp + eax - 0x37e30f1c], 0xbb
inc al
sbb edx, 0xbabf00a7
inc word [esp + ecx*4 + 3]
sub dword [esp + eax - 0x37e30f1d], ecx
ror edx, 1
sub ecx, 0xacb2eb2c
bswap edx
lea ecx, [eax + eax*4 + 0x4e381431]
call fcn.01915a83
mov edx, dword [ebp - 0x28]
jmp 0xcbb9db
lea esi, [esi + edx*2 - 4]
sbb word [esp + edx], dx
pop eax
mov eax, dword [edx + esi]
call fcn.00f442a3
mov ebx, 0x98f0f235
into
xchg edx, eax
sub al, byte [ebp + 0x7d]
push ecx
mov edi, 0xbd1af511
in eax, 0x9e
mov edx, 0x9fea6b60
mov dword [ebx + ebx], ebp
add eax, 0x7f101309
push 0x2c
leave
inc ebx
xor dh, byte [edi - 0x55a0026]
or byte [eax], bh
xor ecx, ebp
imul esp, dword [esi - 0x1d], 0xcb9284c9
xlatb
int 0x29
xchg ebx, eax
ror dword [esi], 1
jg 0x1a2cabc
xor bh, dl
push 0xcf2fb48c
ficom word [ebx]
pop edi
push edx
jmp 0xfea95e8e
Function at 0x1755f1a
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + ebx*4]
push 0x7191203b
mov dword [esp + 4], 0xf2214fa8
mov dword [esp + 4], eax
setno byte [esp]
xor dword [esp], 0x449afbad
dec ebx
lea esp, [esp + 4]
jne 0x1831c18

Function at 0x1757653
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [ecx + edi - 0x7092a689]
cmovb ax, cx
xor edx, ebx
dec ecx
jns 0x1911182
mov eax, dword [ebp + 4]
imul ecx
mov dword [esp], 0xbc3d6115
mov ecx, 0x7092a68a
mov dword [ebp + ecx - 0x7092a68a], edx
dec ecx
mov dword [ebp + ecx - 0x7092a685], eax
lea edx, [ecx + ecx*2 + 0x180324a5]
or dx, cx
lea edi, [edi + edx - 0x69bbbecd]
movsx eax, cx
or dword [esp + edx - 0x69bbbec9], eax
jae 0xec9b3d
dec eax
ror edx, 1
lea ecx, [eax + ecx*4 + 0x4637e5a9]
xor byte [esp + ecx - 0x8822650], 0x96
dec edx
call fcn.019380db

Function at 0x1772290
Capabilities:
Encode data using base64

Disassembly:
test ebx, ebx
jmp 0x18573ba
lea esp, [esp + 8]
je 0xfb8d6c

Function at 0x17cd214
Capabilities:
Encode data using xor

Disassembly:
sar bx, 0x6c
xor ebp, 0xd70dd63c
dec ebp
mov dword [esp + edx - 0xe9ad320], edi
lea edi, [esp + edx*2 - 0x1d35a648]
mov edx, 0
shl word [esp], 0x82
jp 0x175c34a
adc ebp, eax
movzx eax, cx
neg dx
call fcn.017c6d05

Function at 0x17d77f2
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + eax - 0x64247e80]
not ecx
sal dl, 3
sar eax, 0x28
lea ecx, [eax + ecx + 0x7b25769b]
rol ecx, 3

Function at 0x180c3e7
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor bl, dl
call fcn.01969b7f
mov edx, 0x5b20ab97
mov ecx, dword [ebp + edx - 0x5b20ab97]
lea ebp, [ebp + edx - 0x5b20ab93]
xor ecx, ebx
neg ecx
sar dx, 0xe7
setb dl
dec ecx
movsx eax, dx
push eax
neg eax
rol ecx, 1
xor ecx, 0xe8143727
not edx
not edx
xor ebx, ecx
mov byte [esp + edx - 0x5b20ff00], 0x2f
shr edx, 0x21
sal dl, 0x61
add edi, ecx
movzx ax, byte [esi + eax*4 - 0x400]
or dl, byte [esi + edx*2 - 0x5b20fdfe]
mov ecx, 0x32a95a6
lea esi, [esi + ecx*4 - 0xcaa5696]
dec byte [esp + ecx - 0x32a95a4]
pop ecx
shl cl, 0xe5
not al
bswap ecx
jbe 0x187e4e9
mov edx, 0x9c96c62e
jmp 0xe7f2ee

Function at 0x182349c
Capabilities:
Encode data using xor

Disassembly:
not dword [esp + 4]
mov esi, dword [esp + 0xc]
mov edi, 0x480ba62e
mov edi, dword [esp + edi - 0x480ba61e]
lea esp, [esp + 0x14]
call fcn.0175fb33
mov ecx, 0x68044516
movzx eax, cx
mov edx, dword [ebp + ecx - 0x68044516]
rol ax, 6
dec cx
dec eax
lea ebp, [eax + ebp - 0x458c]
sar ecx, 0x17
xadd al, cl
xor edx, ebx
xor edx, 0x1988a02
or ecx, eax
sub eax, ecx
bswap edx
call fcn.019e0d99
xor dh, dh
in eax, 0x3f
das
sar dword [ebp + 0x33], 1
sub eax, 0xb36d1bab
dec ebx
mov bh, 2
pop edi
inc esi
imul edi, edi, 0xffffffcd
invalid
Function at 0x18255e4
Capabilities:
Execute syscall

Disassembly:
movsx edx, cx
movsx eax, cx
mov ecx, dword [ebp + edx - 0x1574]
inc eax
sar edx, 0xb3
xor ecx, ebx
mov dword [esp + edx*2], eax
xor edx, eax
dec ecx
xor ecx, 0xcb9eff86
call fcn.0184566e
sysenter
push edx
pushfd
mov edx, 0xaebde6ba
mov edx, dword [esp + edx + 0x5142194a]
mov dword [esp + 4], 0xb6c0288d
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00d49bb7
xor edx, ebx
add edx, 0xe70c3fad
not eax
ror edx, 1
sar dword [esp], 0xff
mov ecx, eax
lea edx, [eax + edx - 0x26569cce]
adc eax, 0xff15dd81
ror edx, 1
add ax, ax
not cl
cmovle eax, dword [esp]
xor ebx, edx
lea ecx, [ecx + ecx*4 + 0x62994a23]
xchg byte [esp + eax*2 + 2], cl
add esi, edx
call fcn.01845718
Function at 0x1834624
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
call fcn.00ebdc06
mov eax, 0xc59d0e0a
bswap eax
mov eax, dword [ebp + eax*4 - 0x283a7714]
call fcn.017b5cc3
cmovb ecx, dword [esp + edx - 0x11d4f495]
adc edi, eax
rol word [esp + edx - 0x11d4f493], cl
setae byte [esp + edx - 0x11d4f497]
adc dword [esp + edx*2 - 0x23a9e92e], 0xd52150b3
mov dword [esp + edx*2 - 0x23a9e932], edi
ret 4
lea esp, [esp + 4]
je 0xde4baf
call fcn.00ed8476
movsx eax, cl
mov word [esi + eax*8 - 0x68], dx
movzx edx, ax
neg eax
rol ax, cl
lea ebp, [edx + ebp - 0x11]
and cl, 0xa7
mov eax, dword [ebp + edx*4 - 0x34]
xor eax, ebx
not eax
sar ecx, 0x96
xchg ch, dl
inc eax
neg ecx
lea ecx, [edx + ecx*2 - 0x5c6b3e52]
rol dl, 0xe1
not eax
neg eax
bswap edx
neg dx
xor eax, 0x95943ab3
xchg ecx, edx
sal cx, 0x8f
ror dl, 0x43
lea eax, [eax + edx - 0x127fdb7f]
xchg dx, cx
xor ebx, eax
add edi, eax
call fcn.018c56bf
sub dx, cx
shl ecx, cl
add esi, eax
xor cx, cx
mov ax, word [edi + edx*2 - 0x6c2beea2]
mov dx, word [edx + edi - 0x3615f74f]
adc edi, 2
rol cl, 0xc7
not ax
rol ecx, 0xb6
and cx, 0xfa16
neg ecx
not dx
sbb ecx, ecx
setne cl
or ax, dx
mov edx, ecx
call fcn.019d9405
xor ecx, ebx
sub dx, 0x9809
xor ecx, 0x87bd348e
not eax
sub ecx, 0xb434afab
shl edx, 0xd1
or ax, 0x613d
or eax, edx
bswap ecx
lea ecx, [ecx + edx - 0x69cfca73]
xor ebx, ecx
sar ax, 0xa6
xor byte [esi - 0x3e9926cd], dl
clc
cmpsb byte [esi], byte es:[edi]
js 0x1a0595b
scasd eax, dword es:[edi]
rcr dword [edi - 0x19f728c2], 7
xor ah, byte [edx - 0x1c]
sub al, 0x17
mov dl, 4
cmp byte [eax - 0xe], 0x28
xor dword [ebp + eax*4 - 0x34], ebx
jecxz 0xf80361
ror dword fs:[0x1d70bc11], 0xb2
sbb byte [eax - 0x6e], al
xchg edx, eax
xor dword [ecx + 0x72], 0xffffffa5
mov cl, byte [edx - 0x5cd000b4]
not byte [ebp - 0x10820d73]
das
mov dword [0xf28d95f6], eax
jge 0xf80392
jb 0xf803d8
mov byte [0xceb23ae4], al
invalid
test byte [ebx], bh
add eax, 0x16e9aa2f
push esi
jae 0xf803f3
pop es
mov ecx, 0x1711390e
mov esp, 0x5ec0a362
insb byte es:[edi], dx
dec ecx
pop ebx
jg 0xf8039b
in al, dx
push cs
imul ebp, dword [esi - 1], 0x52
pushal
dec ecx
invalid
not dword [esp + eax - 0x5c19070b]
lea edi, [edi + eax - 0x5c190710]
movsx edx, al
jle 0xf80290
pop edx
adc edx, 0xb3fb5d
jmp edx
add esi, ecx
sal ax, 3
xor edx, 0x50b875bf
mov ecx, eax
mov cx, word [ebp]
mov ax, word [ebp + 2]
xor dl, 0x83
lea edx, [edx*4 + 0x6e0f442f]
adc ebp, 2
bswap edx
call fcn.0176fa0a
push eax
and al, ah
not cx
or dx, cx
mov word [ebp + eax - 0x3e688b80], dx
mov eax, dword [esi + eax*2 - 0x7cd11700]
add esi, 4
xor eax, ebx
mov edx, 0x7008ea3d
ror byte [esp + edx - 0x7008ea3a], 0x25
ror eax, 2
push edx
rol dl, 0x21
lea eax, [eax + edx - 0x44ec28cf]
sal edx, 0xe9
movzx ecx, word [esp + edx*4 - 0x4753d000]
push edx
ror eax, 1
xor dword [esp + edx - 0x11d4f3f8], ecx
add ecx, ecx
xor eax, 0xc3bc7913
pop edx
xor dl, byte [esp + edx*4 - 0x4753cffc]
neg ecx
xor ebx, eax
xor dl, byte [esp + edx - 0x11d4f4e6]
js 0xf3aeea
movzx eax, byte [ebp]
mov edx, 0x40a0140b
movsx ecx, dl
lea ebp, [ebp + ecx*2 - 0x15]
call fcn.018baf84
jmp 0xd61ef5
Function at 0x185a623
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
add dword [esp + 4], 0xfe84be65
mov dword [esp + 4], 0xd0a114d3
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.01911859

Function at 0x186645d
Capabilities:
Encode data using xor

Disassembly:
adc esi, ecx
mov eax, dword [edx + edi - 0x74100901]
movsx ecx, dl
pop edx
add edx, 0xffe34b70
jmp edx
lea ecx, [ecx + eax*4 + 0xd8b800b]
not ecx
inc dx
or eax, edx
xor ecx, 0xa425e2ab
mov dword [esp + 4], 0x3a93cc10
and edx, 0x76948b11
not al
xor ebx, ecx
loop 0x186648d
mov edx, dword [esi + esi*2 - 0x26cc2f0a]
xor al, 0xa7
jne 0x1726d39
mov esp, dword [ebx + ebx*4 + 0x29]
outsd dx, dword [esi]
call 0x93c657e6
wait
sub dword [edi - 0x18], ebp
push ecx
aas
xchg edx, eax
cld
lea ecx, [esi + esi*8 - 0x42]
insb byte es:[edi], dx
psraw mm1, qword [ebx + ebx*2 + 0x79b21a06]
imul esp, ebp, 0x3f73057a
mov bl, 0x63
loop 0x186647a
insb byte es:[edi], dx
push 0x38b4caa
fadd st(2), st(0)
mov eax, dword [0x8e86dcc]
mov cl, 0x4c
or byte [esi + ebx*8 + 0x78fde40c], ah
and esi, dword [edx]
lodsb al, byte [esi]
xchg ebp, eax
inc eax
push ds
mov al, 0x54
mov ebx, 0x3eef544c
cmpsd dword [esi], dword es:[edi]
xlatb
mov word [ecx], cs
scasb al, byte es:[edi]
sub al, 0xb2
and edi, dword [ebx]
mov bh, 0xd2
xor esi, dword [ebx + 0x1d]
xchg ecx, eax
retf

Function at 0x1868f67
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov ebp, dword [esp + edi + 0x12]
dec esi
lea ecx, [ebx*8 - 0x1d7e54f]
dec ebp
arpl si, si
inc dx
shr dword [esp + edi*4 - 0x38], 0xe2
dec ecx
add ebx, esi
call fcn.018e38e6

Function at 0x187196e
Capabilities:
Encode data using xor

Disassembly:
call fcn.0194a0da
mov eax, 0x93b608e
movzx ecx, ax
lea esi, [esi + eax - 0x93b6092]
sub ecx, eax
sal cx, 0xeb
mov eax, dword [esi + eax*2 - 0x1276c11c]
sar ecx, 0x68
adc cx, cx
xor eax, ebx
movzx edx, cx
sar ecx, 0xba
sub eax, 0xd4b215a7
xor eax, 0x14a4b71d

Function at 0x187c24a
Capabilities:
Encode data using xor

Disassembly:
neg eax
inc ecx
xor edx, ebx
rol edx, 1
call fcn.019c97c3