joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13cd85e
Capabilities:
Encode data using base64

Disassembly:
xadd esi, ecx
adc ebp, ebx
mov dword [esp + ecx*8], 0xfa862b23
and si, word [esp + esi*2 - 0x26e4b21b]
ror cl, 0xc2
mov dword [esp + esi - 0x1371ffd8], eax
add cl, byte [esp + esi*4 - 0x4dc7fffc]
lea esi, [esp + esi*2 - 0x26e3fff8]
and dword [esp + ecx + 1], edi
movzx edx, di
mov eax, dword [esp + ecx*4 + 4]
lea edx, [esi + edx*2 - 0xb31c]
shr eax, 0xdf
mov esp, edx

Function at 0x13cdc17
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [edi + ecx - 0x6a7ab370]
adc dl, dl
sar edx, 0x3c
adc edi, 4
jmp 0xe5d510
or eax, ecx
movsx ecx, dl
inc edx
not eax
jge 0x11c5b36
setp dl
mov dword [edi], eax
not edx
inc edx
rol dl, 0x61
jmp esi
call fcn.01acbd1a
xor ecx, 0x6c17fb29
btr ax, ax
not ecx
not al
ror ecx, 1
xor ecx, 0x9f3e12b0
sub dx, 0xf398
lea edx, [eax + edx*8 + 0x7583029c]
xor ebx, ecx
add esi, ecx
mov eax, dword [edi]
bts edx, edx
lea ecx, [edx + edx*2 + 0x56a64020]
jb 0xd5eb28
jmp 0xf430a9

Function at 0x13d0872
Capabilities:
Encode data using base64

Disassembly:
add cl, 3
btr ax, ax
mov dword [esp], 0x39a7738
neg cl
ror al, 0x42
add eax, eax
sal al, 0x67
adc cl, 0xb5
ror cl, 1
cwde
xor dword [esp + eax*8 + 0x40000], eax
not dword [esp + eax + 0x8000]
neg cl
sar word [esp + eax + 0x8000], 0x49
call fcn.0100034c

Function at 0x13d8b17
Capabilities:
Encode data using xor

Disassembly:
sar eax, cl
xor ebx, edx
bt eax, eax
xchg ecx, eax
shl ecx, 0x2d
adc ebp, edx
inc ax
movsx edx, ax
movzx eax, byte [edi + eax - 0x6a51c002]
add edi, 1
lea ecx, [edx + ecx + 0x403e7487]
xor al, bl
xor edx, edx
btr ecx, edx
shr edx, cl
neg al
shr ecx, 0x2a
shl dx, 0x87
neg dl
adc al, 0x33
ror al, 1
inc al
not al
sub al, 0x9b
sub edx, ecx
and cl, dh
xor bl, al
inc edx
call fcn.0101a801
arpl word [esi + edx*4 - 0x249bfa7a], sp
pop esi
xchg dword [esi + 0x75ffd4e7], ebx
mov ah, 0x35
mov esp, 0x563d5a54
invalid
dec dl
xchg word [esp + edx*4 - 0x4047fc], dx
xor ebx, ecx
add esi, ecx
mov ecx, 0x32364da9
mov edx, dword [edx + edi - 0x104090]
pop ecx
movsx ecx, byte [esp + eax*4 - 0x604a04]
sub eax, dword [esp + eax*2 - 0x302502]
lea edi, [eax + edi - 0x18007d]
shl ecx, 0xc3
ja 0xe3bc31
and byte [esp + eax - 0x18007e], ch
mov dword [esp + eax - 0x180081], edx
movsx edx, al
seto cl
popfd
lea edx, [edx + edx + 0x4d3adf0a]
or ecx, esi
jmp ecx

Function at 0x13dce2d
Capabilities:
Encode data using base64

Disassembly:
shr byte [esp + 0xa], 0xc3
push 0xb63fd686
and eax, 0xff
push 0xa29b10f
mov eax, dword [edi + eax*4]
jmp 0x13f408b
ror dword [esp + 4], 0x41
shr ebx, 8
dec eax
not dword [esp + 5]
shr word [esp + 7], 0x69
inc dword [esp + 0x18]
xor ebx, eax
push 0x59867d16
neg dword [esp + 0x20]
dec ecx
inc esi
jmp 0x1b09581
push 0xdf19bba0
xor ebx, 0xda1427a4
rol word [esp + 0x12], 0xa7
dec eax
dec ecx
mov dword [esp + 0x10], 0x79114f20
dec eax
lea esp, [esp + 0x30]
jne 0x12da75b
mov eax, 0x34a0d4a6
dec eax
lea edi, [eax + 0x32a06ac]
push edi
dec eax
mov edi, dword [esp + eax - 0x34a0d49e]
dec eax
lea esp, [esp + 0x10]
Function at 0x13dd3d6
Capabilities:
Encode data using xor

Disassembly:
add ebp, edx
lea edx, [ecx*4 + 0x1a9e6102]
rdtsc
mov dword [esp + ecx - 0x40], ecx
lea esi, [esi + ecx*2 - 0x88]
mov dword [ecx + esi - 0x3c], eax
lea eax, [ecx + ecx*4 - 0x6a5b58d4]
mov dword [ecx + esi - 0x40], edx
sar ecx, 0x73
sub ecx, 0x23b93626
pop ecx
jnp fcn.00df6c76

Function at 0x13dfbea
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
neg dx
lea edx, [ecx + ecx*2 - 0x79c90252]
add edi, eax
pop eax
add edx, eax
mov ecx, dword [esi]
btr dx, 0x22
btr edx, 0xb6
mov eax, dword [ecx]
mov dword [esi], eax
add word [esp], dx
jg 0x121c651
mov eax, 0xa60fe391
dec esp
lea esi, [eax*4 + 0x49a5fd0e]
dec ecx
sub ebx, 4
inc esp
mov eax, eax
mov ebx, 0x46b41ab1
inc esi
inc esi
mov ecx, dword [ebx + ebx - 0x46b41ab1]
inc esp
xor ecx, esi
call fcn.00e6fbd8
add al, 0xce
fdivr dword [eax - 0x31]
imul esi
dec ecx
sahf
xor dword [esi], esp
mov bh, 0x77
sub dword [ebx + 0x26bcf3db], ebx
ficom word [ebp + 0x65]
je 0xfd2904
invalid
pop eax
jmp edi
mov dword [esp], ecx
not eax
dec cl
sub eax, 0xa98cea04
inc dword [esp]
shl byte [esp + 2], 0x61
not eax
xor ebx, eax
jmp 0xfd28bd

Function at 0x13e1f51
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + ebx*4]
call fcn.00d9f50d
mov edx, 0x461ffcb4
neg cl
sub cl, 0x9e
xor bl, cl
push edx
shl dl, 0xe3
jp 0xf6e193
lea ecx, [esp + ecx + 0x10]
inc edx
jae 0x13f59bb
push edx
mov word [ecx + edx - 0x461ffca1], ax
xor word [esp + edx - 0x461ffc9f], dx
movsx ecx, dx
inc edx
mov dword [esp + edx - 0x461ffca2], ebp
ret 0x10
lea esp, [esp + 4]
jne 0xf2f223
mov eax, dword [ebp]
call eax
push 0xe004aa3f
mov edx, 0x2f026026
mov esi, 0x76380837
mov ebp, dword [ebp + edx - 0x2f02602a]
or word [esp + edx - 0x2f026025], 0x6090
mov dword [ebp + edx*2 - 0x5e04c04c], eax
mov edi, ebp
sbb word [esp + edx - 0x2f026025], 0x3806
mov dword [esp + edx - 0x2f026026], esi
mov ebx, dword [esp + edx*2 - 0x5e04c048]
rol edx, 0xf0
neg dl
lea ebp, [esi + esi - 0x3a4b1251]
mov esi, dword [esp + esi - 0x7638082f]
mov dword [esp + edx - 0x60262ffa], edx
mov dword [esp + edx - 0x60262ff6], 0x849dc21d
shr byte [esp + edx - 0x60262ff8], 0xc1
mov ebp, dword [esp + edx - 0x60262ff2]
pop eax
shl edx, 0x49
cbw
mov dword [esp + edx - 0x4c5ffc00], esi
ret 8
lea esp, [esp + 8]
je 0xe8e339
push 0x681325b5
mov dword [esp], edi

Function at 0x13f1baa
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
je 0xfd03c7
push ebx
xor eax, eax
jmp 0x1323332
test edx, edx
push 0x809548ad
jmp 0x1a9a954
jmp 0x11ca955
jmp 0xe1f1ba

Function at 0x140877c
Capabilities:
Encode data using base64

Disassembly:
sbb edx, 0x84912dbc
neg eax
not edx
Function at 0x1409a1a
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x69adde05
call fcn.01b195b0
xlatb
pop ds
sahf
cwde
pop ss
nop
arpl word [edx + 0x7124895], ax
jge 0x1409a13
mov dword [ebx + esi - 0x360282ec], edi
adc al, 0x7d
std
leave
shr edx, 0xfd
fidiv dword es:[ebx + 0x19e15a82]
xor al, byte [edx]
dec ebp
pop ebp
mov byte [0x932cfd62], al
sbb dword [ebx], edx
jge 0x1409a83
mov cl, 0xeb
add al, cl
jb 0x1409a39
inc edi
mov bl, 0x7c
sub al, 0x42
adc edi, dword [esi]
scasd eax, dword es:[edi]
push ebx
mov bh, byte [edi + 0x52a5ee11]
jp 0x1409a2a
in al, 0x7d
add eax, 0x16a188cc
pop es
jecxz 0x1409a7a
push cs
jle fcn.01409ac0
inc ebp
add dword [edx], ecx
pop ebx
out 0x41, al
aam 0x3c
int3
fnstsw word [esi + 0x38]
jle 0x1409abe
inc esp
push ss
mov ch, 0xfe
jnp 0x1409af4
mov es, word [ecx - 0x29]
jns 0x1409a84
push ecx
jle 0x1409ac3
add eax, 0xdabe19e3
cwde
and al, 0xbe
mov esi, dword [ecx]
daa
shl dword [eax + esi*4 - 0x3ec7a4e7], 0xf7
ror byte [ebx - 0xf09a73f], cl
bswap edx
mov dword [esp + ecx*8 - 0x8c0], eax
pop eax
xor ebx, edx
call fcn.00fc06ac
mov ebx, 0xb48948ff
pushfd
push 0x48fffe40
ror dword [ebx + 0x51002554], 0x66
mov ecx, dword [ebp + 4]
Function at 0x1a9a959
Capabilities:
Authenticate hmac

Disassembly:
call 0x1b116b7
mov ecx, dword [esi]
mov eax, 0xec2bf1a4
mov edx, eax
lea edx, [edx + eax + 0x2531d93d]
mov edx, dword fs:[ecx]
mov dword [esi], edx
movzx edx, al
rol al, 0x84
push eax
mov eax, dword [ebp + edx*4 - 0x290]
push edx
xor dword [esp + edx*2 - 0x144], 0xf328a295
lea ebp, [ebp + edx*2 - 0x144]
btc edx, edx
adc dword [esp + edx - 0xb0], 0xf32dc4af
mov ecx, dword [esp + edx*2 - 0x165]
xor eax, ebx
pop edx
xchg dword [esp + edx - 0xa4], edx
sal ecx, 0x95
not eax
dec word [esp + edx*2 - 0x2462311c]
imul cx, cx
dec eax
sal byte [esp + edx*2 - 0x24623119], 0x21
sub ecx, ecx
ror cx, 0xa7
bswap eax
sal cx, 0x29
sal ecx, 0x8e
imul edx, dword [esp + edx - 0x1231188e]
sbb eax, ecx
imul cx, word [esp + ecx*2 + 2]
xor eax, 0x2390d235
dec eax
and edx, 0x9f228c0d
xor eax, 0x961d913b
bswap ecx
xor ecx, dword [esp + ecx*2]
xor ebx, eax
not byte [esp + ecx*4 - 0x28b]
and edx, 0x42264a29
and dword [esp + edx - 0x20008], ecx
adc edi, eax
lea eax, [ecx + edx + 0x1c303610]
call fcn.0131e6b4
not ecx
movzx eax, byte [ebp + eax - 0x72c2c23b]
sbb cx, cx
sar cx, 0x2c
btr ecx, 0xb
xor al, bl
push ecx
not al
sub cx, word [esp]
or cl, 5
neg cl
neg al
rol al, 1
rol dword [esp], 0x21
neg al
bswap ecx
xchg dword [esp], ecx
ror al, cl
add al, cl
xor bl, al
and ecx, dword [esp]
mov byte [esp + 1], 0xa4
dec cl
lea eax, [esp + eax + 4]
add cx, cx
or cx, cx
mov word [eax], dx
sbb ebp, 4
neg dword [esp]
inc byte [esp + 2]
mov ecx, dword [ebp]
pop edx
je 0xe21976
dec ecx
sub ebx, 4
inc ecx
mov ebp, 0xbb91949c
dec ebp
lea edi, [ebp + 0x632fddb4]
inc ecx
mov ebp, ebp
inc ecx
mov ecx, dword [ebx]
xor ecx, esi
jmp 0xf4314f
dec ecx
inc ebp
not ecx
xor ecx, 0x8d23a82b
dec ecx
call fcn.00e52e9b
mov ecx, dword [edx + esi - 0x1a]
movzx eax, dl
and eax, eax
rol edx, 0xf5
xor ecx, ebx
and al, ah
sar ax, 0x8e
lea ecx, [ecx + edx*8 + 0x7e0f9aae]
sub dl, 0xb8
cwde
bswap ecx
sub al, 0x3c
jnp 0xe914f8
jns 0xfa77df
xor edx, 0xb4373591
xor ebx, edx
sal dword [esp + 6], 0x35
sal dword [esp + 0xc], 0x1d
add esi, edx
jmp 0xeb1754

Function at 0x1aa8557
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [edx + ebp - 0x34]
mov dword [esp + edx - 0x34], 0x941fe31b
lea ebp, [ebp + edx - 0x30]
xor ecx, ebx
not word [esp + edx - 0x33]
bswap ecx
neg dx
sub edx, 0xbca2b2ac
dec ecx
xor edx, dword [esp + edx - 0x435e4d20]
add dword [esp], edx
neg ecx
movzx eax, dl
lea ecx, [eax + ecx - 0x729a0e3b]
btr ax, ax

Function at 0x1aa9015
Capabilities:
Encode data using base64

Disassembly:
xor edi, edx
jmp 0x1402755
push 0x73be02b2
lea esp, [esp + 0x10]
je 0x12b95f0
push edi
mov edi, 0xfe1fa028
lea edi, [edi*4 + 0x17a35b0e]
sub edi, 0x749d910a
movzx edi, byte [eax]
js 0xf04a5c
mov eax, 0xd336a499
lea eax, [eax*4 + 0x7d8bad22]
not edx
lea eax, [eax + eax*2 - 0x67c5e4d1]
add al, 0x11
movzx ecx, ax
mov dword [esi + ecx*8 - 0x6ce90], edx
not ecx
call fcn.0140293d
push 0x8231e2ae
and edi, 0xff
shr dword [esp], 0xe1
jl 0x1acbc7e
jmp 0x124a724
ja 0x1ae0ce0
Function at 0x1ab6390
Capabilities:
Execute syscall

Disassembly:
mov ecx, dword [esp + ecx - 0xa8548a]
mov dword [esp + 8], 0x19f4520
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00f430e7

Function at 0x1ac77b7
Capabilities:
Encode data using base64

Disassembly:
xadd dl, dh
mov dword [esp + edx - 0x145b0000], esi
ret
xor ebx, eax
and edx, edx
adc esi, eax
mov ecx, dword [edx + edi - 0x145b0000]
movzx eax, dx
mov dword [esp + edx*4 - 0x516c0000], 0xe3ac5290
add eax, dword [edx + edi - 0x145afffc]
shl dx, 0x41
inc dword [esp + edx*4 - 0x516c0000]
lea edi, [edx + edi - 0x145afff8]
mov dword fs:[ecx + edx*2 - 0x28b60000], eax
jae 0xe56bf8
in eax, dx
xor al, ch
sub al, ch
invalid
jb 0xf5b58f

Function at 0x1ac9bef
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + ecx*2 - 0x62278500]
mov dword [edi + ecx - 0x3113c278], eax
mov dword [edi + ecx*2 - 0x622784f8], edx
movzx eax, cl
cwde
pop eax
jae fcn.0133d218
mov eax, 0x6c1a6db5
sub al, 0x84
mov eax, dword [ebp + eax - 0x6c1a6d31]
mov edx, 0x4694a7be
mov dl, byte [ebp + edx - 0x4694a7ba]
mov ecx, 0xf7b46c06
bts cx, cx
adc ecx, ecx
adc ebp, 5
lea ecx, [ecx*8 - 0x49674763]
jmp 0x1aa3740

Function at 0x1ace94e
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jne 0xfffaec

Function at 0x1adab75
Capabilities:
Encode data using xor

Disassembly:
dec ebp
arpl bp, bp
dec ebp
adc esp, ebp
dec ecx
sar edi, cl
mov bp, word [edi + eax - 0xb014]
dec ecx
xadd eax, edx
inc esp
movsx ebp, dx
dec eax
lea edi, [edi + eax*2 - 0x16026]
imul al
add word [esp + eax - 0x17e], 0xdd83
dec eax
mov dword [esp + eax - 0x190], edx
dec esi
lea ebx, [eax + ebx - 0x192]
inc esi
movzx ecx, word [eax + ebx - 0x190]
inc ecx
ror eax, cl
inc sp
xadd dword [esp + eax - 0x18b], edx
inc sp
xor ecx, esi
dec eax
cdq
dec eax
cdq
mul dl
inc cx
sbb ecx, 0x9866368e
shr dword [esp + eax + 0xb], 0x7e
inc cx
ror ecx, cl
dec edx
lea edx, [eax + ebp*8 + 0x308c00be]
dec eax
cdq
inc dword [esp + eax*2]
inc cx
xor ecx, 0x41661692
idiv esi
inc cx
neg ecx
call fcn.01b20992
Function at 0x1ae7e15
Capabilities:
Encode data using xor

Disassembly:
cwde
xchg word [esp + eax - 0x1b], ax
rcr edx, cl
rol byte [esp + eax*2 - 0x7264], 0x81
setb byte [esp + eax - 0x3930]
mov dword [edi + eax*4 - 0xe4c8], edx
mov dword [esp + eax*4 - 0xe4c8], esi
ret
shr cl, 0xc3
add ecx, 0xd1040889
xor eax, ebx
not eax
bswap eax
btr cx, 0x99
xchg ecx, edx
rol eax, 3
lea eax, [eax + ecx + 0x3f08b974]
neg eax
sal edx, 0xfc
xor ebx, eax
or ecx, ecx
adc edi, eax
movzx eax, dx
fld dword [esi + ecx*2 - 0x1b615722]
xor ax, ax
xchg ecx, eax
adc ecx, eax
jmp edi
mov dh, 0xca
bt dx, 1
lea ebp, [ebp + edx - 0xdb0ab8d]
jae 0x13bda6b
jl 0xeb9772
jb 0x1aebaad
sbb esi, 8
mov dword [esp], 0x6080873b
call fcn.0139add1
test byte [ebp - 0x57a7b8c2], 0xcc
scasb al, byte es:[edi]
out 0xaa, al
jno 0x1ae7dee
sub al, 0xa2
mov ebx, 0x94ddb029
mov ebp, 0xf59746b8
inc ebp
adc esp, dword [eax - 0x65]
inc eax
test dword [ebp + 0x2476aa8], edx
wait
mov esp, 0xf361e1a2
and ch, byte [edx + 0x64]
mov eax, 0xa33c970
dec edx
or bl, byte [edx]
push ebx
cld
adc eax, dword [ecx - 0x24]
fcom qword [edi - 0x3711b937]
lodsd eax, dword [esi]
sti
mov ebx, 0x47390f0a
sbb eax, 0x47fc15c2
and eax, 0xc341212c
inc edi
invalid

Function at 0x1ae8f61
Capabilities:
Authenticate hmac

Disassembly:
not byte [esp]
lea esp, [esp + 4]
call eax
mov ecx, 0xf69c7930
movzx edi, cx
mov ebx, edi
mov ebp, dword [ebx + ebp - 0x7934]
not ebx
sub ebx, 0xa1005520
mov dword [ebp + edi*8 - 0x3c980], eax
add edi, ecx
movzx eax, bx
mov edi, ebp
movsx ebp, ax
lea esi, [eax + 0x7f34111f]
bts ebp, 0x2c
pop ebx
pop esi
bt ebp, 0x36
or cx, 0xe90a
mov edx, ecx
pop ebp
setnp al
xadd eax, ecx
or dl, 0x22
lea ebp, [ebp + ecx - 0x3104]
adc cx, 0xea9f
bts cx, dx
mov eax, dword [ebp + ecx*4 - 0x7e7c]
ror dx, 0xe3
dec edx
neg dl
xor eax, ebx
rol cx, 0xc5
xchg edx, ecx
ror eax, 1
xadd edx, ecx
push ecx
add edx, ecx
lea eax, [eax + edx - 0x356f7999]
rol eax, 1
shl edx, 0x5c
xor eax, 0xe4ba8d16
btc ecx, edx
pop edx
xor ebx, eax
not cx
add esi, eax
jmp esi
push 0x3faa3789
dec ebx
push 0xa1330200
push 0xfe189637
lea esp, [esp + 0xc]
jne 0x1ae8f6b
push 0x523e369e
mov eax, dword [ebp]
jmp 0xde5d84
lea esp, [esp + 0x10]
je 0x1011e53
mov eax, 0xacbb5c0c
shr eax, 0x99
sbb al, ah
mov eax, dword [ebp + ebx*4]
push eax
jne 0x1011e39

Function at 0x1aeab6a
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
shl edx, 0x8c
and edx, 0x228c8506
mov dword [esp + ecx*2 - 0x6b2f0d7e], 0x2bad43b4
adc ebp, eax
mov si, word [ecx + esi - 0x359786bf]
sub dx, dx
pop eax
jae fcn.00df6c76

Function at 0x1aecea4
Capabilities:
Encode data using base64

Disassembly:
mov edi, dword [edi*4 + 0x125462c]
call fcn.01acae23
and edi, 0xff
shl dword [esp + 4], 0xce
ror dword [esp + 0xc], 0xa8
jb 0xf2ab87
Function at 0x1b03605
Capabilities:
Encode data using base64

Disassembly:
sal ecx, cl
mov edx, dword [ecx + esi - 0xe100000]
add cl, byte [edx + ecx*2 - 0x1c200000]
mov edx, dword [esp + 4]
lea esi, [edx + esi - 0x6ad84cd8]
inc dl
mov word [esi + edx - 0x6ad84cdb], cx
call fcn.00da7946
mov edx, 0x9294c8b9
movsx eax, dl
mov edx, dword [edi]
sub ax, ax
adc edi, 4
bswap eax
shl eax, 0x85
xor edx, ebx
movzx ecx, ax
bts eax, eax
btc cx, cx
dec edx
add ax, ax
rol edx, cl
btr cx, ax
or al, 0xa9
neg edx
dec edx
call fcn.00e94fbc

Function at 0x1b07965
Capabilities:
Encode data using base64

Disassembly:
inc si
movzx ecx, byte [edx + esi - 0x31]
dec ecx
lea edi, [esi + edi - 0x2b]
inc ebp
movsx edi, dx
mov ebp, 0xad0fc582
mov eax, 0x44172201
inc si
mov dword [edi + esi - 0x31], ecx
inc edx
ror byte [esp + esi*2 - 0x5c], 0x43
inc ecx
push esi
dec edx
neg dword [esp + esi - 0x2a]
dec edi
lea ebx, [ebx + esi*8 - 0x18c]
inc ebp
movsx ecx, di
inc edi
mov edi, dword [ebx + esi*4 - 0xc4]
inc ecx
push ecx
inc ecx
inc dh
inc ebp
xor edx, ecx
inc esp
xor edi, esi
inc ecx
inc edi
inc ecx
neg edi
inc ecx
neg ecx
rol dword [esp + eax - 0x441721fd], 0xc9
inc ecx
not edi
dec edx
lea ecx, [ebp + ecx*4 + 0x6912912a]
inc esp
movzx eax, cx
inc ecx
neg edi
movsx edx, ax
call fcn.00e6a9f5
dec ebx
mov dword [esp], 0xb3a9ab24
call fcn.00e8c24a
jmp 0xf28779

Function at 0x1b0f3b4
Capabilities:
Encode data using base64

Disassembly:
mov edx, ebx
jnp 0xdb4a77
sal edx, 2
mov eax, 0x5b34432d
neg al
mov eax, ebp
jns 0xf5f624
push 0xbc33ea1d
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
push 0x6193933f
lea esp, [esp + 0xc]
je 0x13bb93b
ror al, 1
sub al, 0xba
xadd dword [esp + edx - 0x12000fb], edx
pop edx
dec dword [esp]
neg al
pop edx
add al, 0xa5
not dx
xor bl, al
push edi
lea edx, [edx + edx*8 + 0x238327ac]
neg edx
sub dl, dl
push esi
ror edx, 0xe1
ror dl, 7
push ebx
movzx ebx, dx
push ebx
mov ebx, eax
jp 0xffd137

Function at 0x1b1a7f8
Capabilities:
Encode data using xor

Disassembly:
xor eax, ebx
xor eax, 0xa0394790
push ecx
sal word [esp + 9], cl
push ecx
neg eax
mov dword [esp + 8], ecx
mov edx, 0x82959481
rol eax, 2
add ecx, ecx
lea eax, [eax + ecx - 0x25466de]
stosd dword es:[edi], eax
std
or cl, dh
xor ebx, eax
add ebp, eax
movzx eax, word [esp + ecx - 0x6b6c8b90]
shr dx, 0xb
cbw
mov edx, dword [eax + esi]
inc ecx
or al, byte [esi + eax + 4]
bswap ecx
inc ecx
add esi, 6
call fcn.01385333
jp 0x1b1a81b
fdiv st(1)
pop esp
insb byte es:[edi], dx
ja 0x1b1a86e
mov ecx, 0x79ceb5b7
out 0x3c, eax
invalid
or dword ss:[ecx - 0x47941db7], ebx
cld
inc ebp
aaa
xor byte [eax], dh
inc edi
sbb eax, dword [ebp + 0x21]
cdq
nop
adc dword [edx + 0x26], edi
lahf
imul esp, dword [edx], 0x5de6e1b
mov ebp, dword [ebp - 0x26]
pop es
invalid
Function at 0x1b2893c
Capabilities:
Encode data using xor

Disassembly:
inc eax
lea ebp, [ebp + eax*2 - 0xc3e4]
sub word [esp + eax*4 - 0x187c0], 0x352e
mov dword [esp + eax*8 - 0x30f88], ecx
mov word [ebp + eax*2 - 0xc3e2], dx
and ecx, ecx
mov ecx, dword [edi + eax - 0x61f1]
lea edx, [eax + eax*2 + 0x26812d80]
push edx
adc edx, 0x3a317a3
lea edi, [eax + edi - 0x61ed]
ror dword [esp + eax - 0x61ee], 0x64
rol eax, 0xaa
xor ecx, ebx
btr eax, 0x36
add eax, 0xb1180202
cdq
xor ecx, 0xfe3e2db5
shl edx, 0xa4
sal dx, 0xa1
bswap ecx
mul eax
shr eax, 0xff
adc ecx, eax
or dword [esp + eax*8 + 8], 0x910fee88
dec dword [esp + eax*4 + 7]
xor ecx, 0x5209271b
shr eax, 0xb7
and byte [esp + eax*8 + 6], ah
not ecx
sbb ax, word [esp + eax*2 + 9]
xadd byte [esp + eax - 0x600f], dl
xor ebx, ecx
ror dword [esp + eax*8 - 0x3008c], 0x2f
adc esi, ecx
sub dword [esp + eax - 0x600a], 0x12870a1e
shl eax, 0x9c
pop edx
pop ecx
pop edx
jp fcn.00f69144

Function at 0x1b2bcd6
Capabilities:
Encode data using base64

Disassembly:
mov esp, esi
popfd
mov edi, 0x97a37992
push edi
mov edx, dword [esp + 4]
pop ebp
mov ecx, dword [esp + 4]
pop eax
lea edi, [ebp*8 + 0x7a8a3404]
mov esi, dword [esp + edi*2 - 0x6f4c0124]
call fcn.01380636
call fcn.013011ec

Function at 0x1b2bd01
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
movzx edx, cl
push ecx
mov dword [esp + ecx - 0x56cb6400], edi
ret
xor ebx, edx
add esi, edx
sar eax, 0xf5
mov edx, 0x9418b501
neg eax
mov ax, word [ebp + eax*2 - 2]
add edx, 0xdf0ac31e
mov cx, word [ebp + edx - 0x7323781d]
inc edx
sal edx, 0x37
lea ebp, [ebp + edx*8 - 0x7ffffffe]
neg edx
and ax, cx
movsx ecx, dl
bts dx, 0x27
not ax
mov word [ecx + ebp], ax
bt edx, edx
call fcn.00f9673d
and ax, 0x5831
adc edx, ecx
bts ecx, 0x25
bswap edx
xor edx, ecx
lea eax, [ecx*4 - 0x10d964cb]
xor eax, ecx
or eax, eax
adc edx, ecx
and al, 0x10
rol eax, cl
and ecx, 0xa934bca0
neg edx
xor ebx, edx
neg ecx
imul cx, cx
cwde
add edi, edx
jmp 0x12aac8b
inc edx
mov dword [esp + edx - 0xffff], edi
neg ax
push esi
lea edx, [eax*4 - 0x6dd5b655]
inc edx
bt eax, edx
push ebx
imul edx, eax
shr al, 0x85
or eax, edx
mov ebx, ecx
mov edx, ebx
sal edx, 2
not al
shr al, 0x23
mov eax, ebp
add eax, edx
push 0x6b350824
mov dword [ebp - 4], eax
shr word [esp], 0x61
setg byte [esp]
jl 0x1408794
test ebx, ebx
call fcn.00d962d6
inc edx
not cx
xor edx, 0xd63772b0
bts cx, ax
sbb edx, 0xb63dba9f
neg eax
dec cx
ror eax, 0x2f
xor edx, 0x4fba5aa6
btr cx, ax
bt eax, ecx
rol edx, 2
cbw
cwde
jmp 0x135fd68
Function at 0x402734
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
push dword [esi]
push 1
push dword [esi + 8]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 8]
mov ebx, eax
add esp, 0x10
dec ebx
mov eax, ecx
neg ebx
cdq
sbb bl, bl
idiv dword [esi + 0x18]
inc bl
test bl, bl
mov byte [ebp - 1], bl
mov dword [esi + 0x1c], eax
je 0x4028ab
add dword [esi + 0x14], ecx
push 0xffffffffffffffff
push eax
push 0x18
push ecx
lea eax, [esi + 0x24]
lea edi, [esi + 0x20]
mov ecx, esp
push eax
mov dword [ebp - 0xc], edi
call fcn.004023cc
push ecx
mov ecx, esp
push str.read
call fcn.0040121a
push edi
call fcn.004010ad
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
mov edi, dword [ebp + 8]
add esp, 0x18
xor eax, eax
cmp ecx, 1
sete byte [ebp - 2]
mov ebx, edx
dec edx
test ebx, ebx
mov dword [ebp - 0x10], eax
je 0x402857
inc edx
mov ebx, eax
mov dword [ebp - 8], edx
cmp byte [ebp - 2], 0
je 0x4027d4
xor edx, edx
cmp byte [edi], dl
jmp 0x4027d9
xor edx, edx
cmp word [edi], dx
sete dl
test edx, edx
je 0x402804
test eax, eax
je 0x4027fd
cmp edi, eax
je 0x4027fd
imul ecx, ebx
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
mov ecx, dword [esi + 0x18]
inc ebx
lea eax, [ecx + edi]
add edi, ecx
dec dword [ebp - 8]
jne 0x4027c8
test eax, eax
je 0x402829
cmp edi, eax
je 0x402829
mov ecx, dword [esi + 0x18]
sub edi, eax
imul ecx, ebx
push edi
push eax
sub eax, ecx
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
test ebx, ebx
je 0x402857
push 0xffffffffffffffff
push ebx
push 1
push ecx
mov ecx, esp
push 0
call fcn.0040121a
push ecx
mov ecx, esp
push str.nulls_removed
call fcn.0040121a
push dword [ebp - 0xc]
call fcn.004010ad
add esp, 0x18
sub dword [esi + 0x1c], ebx
cmp dword [esi + 0x18], 1
jle 0x40289f
push dword [esi + 4]
call fcn.004019f5
test al, al
pop ecx
je 0x40289f
push dword [esi + 0x1c]
push dword [ebp + 8]
call fcn.004019fe
pop ecx
pop ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.0040121a
push ecx
mov ecx, esp
push str.endian_swap
call fcn.0040121a
push dword [ebp - 0xc]
call fcn.004010ad
add esp, 0x18
mov bl, byte [ebp - 1]
pop edi
mov al, bl
pop esi
pop ebx
leave
ret 4
mov ecx, esi
call fcn.004022e1
jmp 0x4028a2
Function at 0x402fb9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 0xc]
push edi
mov eax, dword [esi + 0x18]
imul eax, dword [esi + 0x1c]
test ebx, ebx
mov dword [esi + 8], eax
jne 0x402fd5
mov ebx, dword [ebp + 8]
push dword [esi + 4]
xor edi, edi
call fcn.004019f5
test al, al
pop ecx
je 0x403041
cmp dword [ebp + 8], edi
jne 0x40300b
mov eax, dword [esi + 0x1c]
shl eax, 1
push eax
call sub.MFC42.DLL_operatornew
mov edi, eax
mov eax, dword [esi + 0x1c]
shl eax, 1
push eax
push ebx
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0x10
mov dword [ebp + 8], edi
mov ebx, edi
push dword [esi + 0x1c]
push dword [ebp + 8]
call fcn.004019fe
pop ecx
pop ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.0040121a
push ecx
mov ecx, esp
push str.endian_swap
call fcn.0040121a
lea eax, [esi + 0x20]
push eax
call fcn.004010ad
add esp, 0x18
push dword [esi]
push 1
push dword [esi + 8]
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ebx, eax
add esp, 0x10
dec ebx
neg ebx
sbb bl, bl
inc bl
test edi, edi
je 0x403066
push edi
call sub.MFC42.DLL_operatordelete
pop ecx
test bl, bl
je 0x40309e
mov eax, dword [esi + 8]
push 0xffffffffffffffff
push dword [esi + 0x1c]
add dword [esi + 0x14], eax
lea eax, [esi + 0x24]
push 0x18
push ecx
mov ecx, esp
push eax
call fcn.004023cc
push ecx
mov ecx, esp
push str.write
call fcn.0040121a
add esi, 0x20
push esi
call fcn.004010ad
add esp, 0x18
jmp 0x4030a5
mov ecx, esi
call fcn.004022e1
pop edi
mov al, bl
pop esi
pop ebx
pop ebp
ret 8