joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x103a8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.103a81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x103a807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103a806a
add dl, dl
jne 0x103a8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103a80dc
xor eax, eax
add dl, dl
jne 0x103a8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103a817d
add dl, dl
jne 0x103a80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103a80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103a80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103a80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x103a80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x103a8075
mov eax, 1
add dl, dl
jne 0x103a80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103a80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103a80e1
sub eax, ebx
mov ebx, 1
jne 0x103a8128
mov ecx, 1
add dl, dl
jne 0x103a810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103a8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103a8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103a8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x103a813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103a814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103a8136
cmp eax, 0x7d00
jae 0x103a816d
cmp eax, 0x500
jb 0x103a8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103a8075
cmp eax, 0x7f
ja 0x103a8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103a8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x103a819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x103a8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401470
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x94], eax
movups xmm0, xmmword [str.PongGameWindowClass]
push esi
push edi
movups xmmword [esp + 0x60], xmm0
push 0
movups xmm0, xmmword [0x4031f0]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x3c], 0
movups xmmword [esp + 0x74], xmm0
mov dword [esp + 0x20], 0x401000
movq xmm0, qword [0x403200]
movq qword [esp + 0x84], xmm0
xorps xmm0, xmm0
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x30], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x38], 6
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push dword [esp + 0x2c]
lea eax, [esp + 0x68]
push 0
push 0
push 0x438
push 0x780
push 0
push 0
push 0x80000000
push str.Pong_Game
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
jne 0x40154c
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Error:_Failed_to_create_window_n
jmp 0x40163f
push 0
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x224
push 0x438
push 0x780
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [esp + 0x10], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
mov edi, eax
push str.Start
push 1
push 0
push edi
call esi
push str.Pause
push 2
push 0
push edi
call esi
push str.Exit
push 3
push 0
push edi
call esi
push str.Game
push edi
mov edi, dword [esp + 0x18]
push 0x10
push edi
call esi
mov esi, dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.USER32.dll_SetMenu]
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x60], 0
push 0
lea eax, [esp + 0x4c]
movaps xmmword [esp + 0x4c], xmm0
push eax
movq qword [esp + 0x60], xmm0
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x401634
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x40]
push eax
call esi
lea eax, [esp + 0x40]
push eax
call edi
push 0
push 0
push 0
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x401611
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Debug:_Ending_Pong_Game_n
call fcn.00401660
mov ecx, dword [esp + 0x9c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0040193a
mov esp, ebp
pop ebp
ret
Function at 0xb51450
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax*2 - 0x9874], edx
rol ecx, 1
xchg byte [esp + eax*4 - 0x130e7], ah
mov dword [esp + eax - 0x3a], edx
inc dword [esp + eax*4 - 0xe8]
xor ecx, 0x5b136686
rol eax, 0x9d
xor ebx, ecx
neg edx
call fcn.00b6ab06
mov ecx, 0x58855083
call fcn.0142ddab
dec edx
mov dword [esp - 0x748a651f], edi
inc edx
xor dword [esp + edi*2 - 0x6c48f1e6], esi
dec ebx
lea ebp, [esp + eax*2 - 0x325e48cc]
dec edx
mov edi, dword [esp - 0x748a651f]
dec edx
mov dword [esp + edi*2 - 0x6c48f1fe], ebx
dec edx
mov dword [esp - 0x748a652f], ecx
dec eax
arpl si, si
inc edx
mov edx, dword [esp + edi - 0x362478f1]
push edx
call int.00cf1dac

Function at 0xb5d14a
Capabilities:
Encode data using base64

Disassembly:
bswap edx
mov dword [esp + ecx - 0x783cbca6], 0xf5845e90
not word [esp + ecx - 0x783cbca4]
call fcn.01446ca2

Function at 0xb626ec
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x10]
jne 0xc046d4
jmp 0xba0c92
inc ecx
mov edx, 0xaba0edba
inc ecx
not eax
inc ecx
push edx
inc ebp
mov dword [ebp], eax
dec ebx
lea edx, [edx + edx*2 - 0x147f11e3]
dec ecx
sub ebx, 4
inc ebp
movsx ecx, dl
inc dword [esp + 4]
inc ebp
mov ecx, dword [ebx]
inc ecx
movsx ecx, dx
push edx
jns 0xce70ab
mov eax, 0x40201d2c
jmp 0xc451b6
inc ecx
movzx eax, byte [edi + eax - 0x40201d2c]
inc ecx
xor eax, eax
call fcn.00bfc7a3

Function at 0xb7361e
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0xfbe936f2
lea esp, [esp + 4]
call fcn.014474f1

Function at 0xb811c4
Capabilities:
Encode data using base64

Disassembly:
inc esp
or edx, eax
call fcn.00c6a4cb
mov edx, dword [ebp]
call fcn.00cc85a3

Function at 0xb824d0
Capabilities:
Encode data using base64

Disassembly:
pop ebx
inc ecx
pop ebx
jmp 0xbfe778
inc edx
inc byte [esp + eax - 0x48ce86]
rdtsc
call fcn.00ce46ef
inc ecx
pop eax
mov ecx, 0x65a183a0
movsx ebx, cx
inc esp
movzx ecx, bl
pop eax
inc ecx
pop edi
inc ecx
sar cl, 0x62
popfd
pop edi
pop ebp
inc ecx
pop edx
dec ecx
xchg ecx, ecx
pop edx
inc ecx
bswap ecx
dec eax
xchg ecx, ebx
inc ebp
mov ebp, ecx
inc ecx
pop ebp
inc esp
mov esi, ebx
pop ecx
inc ecx
movsx esi, dh
dec ecx
bswap ecx
jmp 0xb6a4eb
Function at 0xb85222
Capabilities:
Encode data using xor

Disassembly:
dec eax
and eax, 0xb097e1a9
inc esp
xor esp, edi
inc ecx
rol esp, 3
inc ecx
sub esp, 0xb3aaf5a8
dec eax
mov dword [esp + edx*2 - 0x16000], eax
inc ecx
rol esp, 1
dec esp
xor ecx, eax
not word [esp + edx*2 - 0x16000]
inc ecx
xor esp, 0x802c690a
inc dx
neg dword [esp + ecx - 0x7fa43525]
and cx, bx
inc ecx
pop edx
inc ebp
lea esp, [esp + eax + 0x24376208]
dec esp
cmovnp ecx, ecx
inc ecx
not esp
mov esi, eax
dec eax
shl ecx, 0x9f
sar dx, 0xce
push edi
inc esp
xor dword [esp + edx*2 - 0x1fffc], esp
inc ecx
and eax, edx
push edx
dec eax
mov edi, dword [esp + edx*4 - 0x3fff0]
dec eax
mov dword [esp + edx*2 - 0x1fff4], esi
dec ebp
arpl sp, sp
inc esp
movsx eax, si
inc ecx
setb dl
pop ebp
dec ebp
adc esi, esp
call fcn.00b8e37d
mov dword [0x36d05813], eax
or byte [0x890ff1c3], al
cmpsd dword [esi], dword es:[edi]
jb 0xb8524e
stosd dword es:[edi], eax
idiv dword [ecx]
pushfd
sub esp, dword [edi]
popfd
out dx, al
std
invalid

Function at 0xb85b0d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
btr ebp, edx
mov ebp, esp
btc dx, 0x18
sbb edx, eax
shl edx, cl
mov edx, dword [ebp + 8]
test bx, 0x6623
clc
test di, bx
lea esp, [esp - 0x114]
push esi
cmp esi, ebp
test edx, edx
jmp 0xc6de11
je 0x141bbf8
mov esi, dword [ebp + 0xc]
cmp al, 0xbd
test ebp, 0x15b3be25
test ebx, edx
test esi, esi
jmp 0xc8da6e
je 0x141bbf8
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x141bbf2
mov eax, dword [edx + 0x3c]
cmp bx, 0xfa8
jmp 0xb5fb57
je 0xc9f526

Function at 0xb94619
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov dword [esp + ecx - 0x260296f5], eax
inc ecx
push eax
dec eax
mov edi, dword [esp + ecx - 0x260296e5]
inc cx
sar eax, 0xc2
dec eax
arpl dx, dx
rol al, 0xc4
dec esp
adc esi, edx
inc si
xadd dword [esp + ecx*2 + 0x6de58055], edi
call fcn.00c501a1

Function at 0xb9ec20
Capabilities:
Encode data using xor

Disassembly:
inc cx
add ebx, eax
inc ecx
neg esp
dec esp
lea edi, [eax + 0x6c032696]
inc ecx
and dl, al
inc ecx
not al
inc ecx
ror esp, 1
call fcn.00cb7be8
mov eax, 0x6e00e785
mov ecx, 0xda907333
shr ax, 0xc3
mov ecx, dword [ebp + eax - 0x6e001cf0]
movsx edx, al
mov eax, dword ss:[eax + ecx - 0x6e001cf0]
jne 0xc053aa
push esp
push edi
add al, 0xbf
cmc
pop esi
inc esp
push cs
mov esp, 0x626d69e0
inc ecx
jl 0xb9ecb7
dec ebx
sbb dword [esi + 0x3c8913fc], edi
mov dword [esp], edi
movzx edi, byte [eax]
lds ecx, [ebp - 0x53e1c07c]
and edx, edx
lea edx, [ecx + edx - 0x3effe64a]
xor cx, 0x552c
or cx, 0x34a5
ror edx, 3
sub ax, ax
push ecx
not edx
ror cx, cl
xor dword [esp], eax
bswap edx
lea ecx, [eax*8 + 0xa2a23b1]
jne 0xbfe62b
not edx
shr word [esp + ecx*8 - 0x51111d87], 0x87
xadd ecx, eax
sbb dword [esp + ecx*2 - 0x14424762], eax
xor ebx, edx
add esi, edx
rol eax, 0xb7
neg cx
call fcn.00c8b6fb
movzx ecx, dx
mov dword [ebp + ecx - 0xfff0], eax
js 0xc09a9c
shr edx, cl
mov edx, dword [edx + edi - 0xffff]
movsx eax, cx
and ecx, eax
sub ecx, 0x7219b2bc
add edi, 4
lea ecx, [eax + eax - 0x62c3e37a]
xor edx, ebx
jmp 0xbe6aeb
rol ecx, 2
call fcn.00cd356a
Function at 0xb9f19b
Capabilities:
Encode data using base64

Disassembly:
not al
mov dword [esp + ecx - 0x25a0fc93], 0xa69fb11b
xor ecx, 0xeaa34b11
adc ecx, 0x45301c3f
mov word [ecx + ebp - 0x1433d3c1], ax
call fcn.00b851af
Function at 0xbd2864
Capabilities:
Encode data using base64

Disassembly:
inc esp
xor esp, edi
sar ecx, cl
inc ecx
xor esp, 0xc532b529
pop ecx
call fcn.00c94622

Function at 0xbd6a35
Capabilities:
Encode data using xor

Disassembly:
sar ebx, 0x5b
dec edx
mov dword [esp - 0x17a18], edi
inc ecx

Function at 0xbd7c5b
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + ebp*4 + 0x7c85b357]
movzx ebx, bp
neg esi
pop ebp
inc esp
movzx esp, bl
dec esi
dec esi
lea ecx, [ebx + edx*4 + 0x6c3ce796]
dec eax
shr ebx, 0x93
xor esi, 0x9e3da9b1
call fcn.00b94455
inc ecx
movzx ebp, dl
dec esp
mov dword [esp + ebp*8 - 0x188], edi
xor esi, edi
jmp 0xb7fc51

Function at 0xbdd205
Capabilities:
Encode data using base64

Disassembly:
inc esi
call fcn.00b57c78
call fcn.00cb3f87

Function at 0xbdeec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ecx
dec ecx
dec ebp
arpl di, di
inc cx
dec ecx
call fcn.00c72f6b

Function at 0xbe093b
Capabilities:
Encode data using base64

Disassembly:
pop ebx
inc ecx
pop edx
pop ebp
je fcn.00bfd2e5

Function at 0xbe23cb
Capabilities:
Encode data using xor

Disassembly:
dec esp
fsubp st(0)
mov eax, 0x4600858e
inc esi
xor dword [esp - 0xc276], ecx
pop edi
dec eax
lea edx, [ebx + 0x360863a7]
dec esp
or edi, ebx
dec ebp
arpl cx, cx
dec ebp
adc esi, ecx
dec eax
lea esi, [ebx*2 - 0x7d7ccc]
rdtsc
call fcn.0142dd99
pop es
adc dword [edi + 0x740eaf78], ebx
cmc
loop 0xbb4dda
invalid
inc ebp
sub ah, cl
dec edx
mov dword [esp + edx - 0x3882], edi
inc edx
xor dword [esp + edx - 0x3882], edx
pop ebp
dec edx
mov edi, dword [esp + edx - 0x388a]
dec ecx
lea ebx, [edi - 0x5fe142d2]
dec eax
arpl dx, dx
dec esp
add esi, edx
call fcn.00c41374
dec edi
lea ebx, [ebx + ecx*2 - 0x751a8948]
inc edi
mov ecx, dword [ebx + ecx*2 - 0x751a8944]
inc ecx
mov edi, 0xcc223d89
inc esp
xor ecx, edi
inc ecx
inc ecx
inc ebp
movzx esp, di
inc ecx
rol ecx, 3
inc cx
not esp
inc ebp
movsx eax, di
inc ecx
movsx eax, ah
inc ecx
inc ecx
inc ecx
bswap ecx
dec eax
inc eax
push edi
mov ebx, 0x3f333bbd
jne 0xbb4de1
call fcn.00cf0a11

Function at 0xbe7113
Capabilities:
Encode data using base64

Disassembly:
inc ebp
mov ecx, eax
inc ecx
rol edx, 3
inc cx
or edx, esp
pop esi
dec ebp
lea edi, [eax + eax*8 + 0x4e9109bc]
push edi
dec esp
adc esp, edx
inc esp
xor dword [esp + ebp*2 - 0x20], edx
dec ecx
lea esi, [ecx + edx*2 - 0x726694c3]
pop edi
dec ebp
arpl dx, dx
push edx
inc ecx
shl bh, 2
dec ebp
add esi, edx
inc ecx
rol al, 0xe3
inc si
mov ecx, dword [ebp + ebp - 0x10]
inc esp
movzx edx, dh
shl byte [esp + ebp*4 - 0x3b], 0x47
not byte [esp + ebp - 0xf]
dec esi
lea ebp, [ebp + ebp - 0xe]
jae 0xbeeb2f
syscall
push edx
call fcn.01436a2a
inc ecx
mov edi, 0x783de60d
inc ecx
movsx eax, bh
inc esp
movzx edx, ax
dec ebp
mov eax, dword [ebp + eax*4 - 0x34]
dec edi
mov ecx, dword [ebp + edi - 0x783de605]
inc ecx
mov cl, byte [ebp + eax + 3]
dec ecx
lea esi, [edx + eax*2 - 0x395374c3]
dec edi
lea ebp, [ebp + edi - 0x783de603]
dec ebp
shrd eax, ecx, cl
jmp 0xcdc054
dec edi
lea ebx, [ebx + edx*2 - 0x118]
movsx ecx, ax
not byte [esp + ebp - 0xd]
call fcn.00b7634f
jmp fcn.00c011c4
Function at 0xbedb07
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop esp
inc esp
xor eax, edi
dec edx
inc esp
mov edi, ebp
dec ebp
lea ecx, [edi + ebp*2 + 0x459ea48d]
inc ecx
bswap eax
dec ecx
lea eax, [edi + ebp - 0x23597d7b]
jno 0xc477fd
inc ecx
mov ecx, 0xe0a3dfb9
inc ecx
rol ecx, 0x4a
dec ebp
mov edx, ebp
dec ecx
sbb ebp, 2
inc ecx
movzx ebx, cl
inc si
mov dword [ebx + ebp - 0x82], edx

Function at 0xbf2c38
Capabilities:
Encode data using base64

Disassembly:
neg ecx
dec edx
mov dword [esp + edi - 0x533c2154], edi
inc eax
add ch, al
jl 0xb51508
inc edx
xor dword [esp + edi - 0x533c2154], ecx
inc cx
rol edi, 0xcf
pop edi
xchg bp, ax
add esi, eax
dec eax
arpl cx, cx
dec esp
adc esi, ecx
dec edx
lea ecx, [ecx*2 + 0x529cc098]
jmp fcn.00bfd2e5

Function at 0xbf2c70
Capabilities:
Encode data using base64

Disassembly:
xor ebx, ecx
inc dl
add esi, ecx
mov edx, dword [ebp + edx*2 - 2]
lea ecx, [eax + eax + 0x4615ba3a]
mov eax, dword [ebp + 4]
mov cl, byte [ebp + 8]
add ebp, 6
call fcn.00cf3c06
and byte [ecx], al
add byte [eax], al

Function at 0xbfcb90
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [ebx], dh
retf
dec edi
lea ebp, [ecx + ebp - 2]
inc ecx
shr cl, 0x45
inc di
mov dword [ebp + ecx*2], eax
inc ecx
pop edi
pop edx
pop ebp
pop esi
pop eax
inc ecx
pop ecx
jp fcn.00bfd2e5
dec esp
mov esi, dword [esp + esi - 0x6f]
dec esp
mov dword [esp + esi - 0x7f], ecx
dec ecx
xchg ecx, esi
dec esp
mov ecx, dword [esp + esi - 0x510862dc]
dec esp
mov esp, dword [esp + esi - 0x510862d4]
dec eax
mov esi, dword [esp + esi - 0x510862cc]
call fcn.00bc3427
fcom dword [eax + 0x54ca5be9]
inc ebx
jl 0xbfcb74
invalid
jbe 0xbfcbf5
aaa
pushfd
out dx, al
jle 0xbfcbef
or dh, bl
ffree st(0)
sar esp, 0xc1
scasd eax, dword es:[edi]
lahf
loopne 0xbfcc32
xor ch, byte [esi]
pop edx
fbld tbyte [esi]
adc al, 0xb
sbb eax, 0x58c30a37
mov ch, 0xc
aas
sbb eax, 0x15c6c51d
and byte [ebx], ch
xchg ebx, eax
add byte ds:[edx + 0x31], bl
mov eax, dword [0x7b3d2050]
invalid
loop 0xbfcbbc
wait
xor byte [esi - 0x631b78fd], ah
insb byte es:[edi], dx
mov dword [esi + 0x61], esp
mov dh, bh
lodsb al, byte [esi]
adc dl, byte [edi + 0x61]
xchg edx, eax
cli
into
aaa
xchg edi, eax
push esp
inc edx
movsb byte es:[edi], byte [esi]
cwde
in al, 0xf6
fdiv dword [edx + 0x72c3d1cb]
invalid
Function at 0xc0a891
Capabilities:
Encode data using base64

Disassembly:
inc esp
movsx ecx, bx
inc ecx
movsx edi, dx
inc esp
xor dword [esp + ecx], edi
shl di, 0xc8
inc esp
movzx eax, cx
pop edi
push ecx
dec ebp
arpl di, di
dec eax
add dword [esp + ecx], ebx
shl ax, 0x83
dec ebp
adc esi, edi
dec ecx
mov esi, dword [ebp + ecx]
inc cx
sub edx, eax
movsx ebp, byte [esp + ecx + 2]
add al, byte ss:[esi + ecx]
neg dword [esp + ecx*8 + 1]
dec ebp
lea ebp, [ebp + ecx + 6]
dec eax
lea esi, [ecx*2 + 0x1290b707]
inc cx
mov dword [ebp + ecx*8], eax
xadd bp, bx
rol byte [esp + ecx*2 + 1], 0x24
dec esp
mov dword [esp + ecx*8], esi
ret
inc esp
movsx ecx, ax
dec esp
lea eax, [eax*4 - 0x354c4d70]
inc ecx
rol edx, 1
not cx
dec eax
mov dword [esp + esi*2 - 0x72], 0x9716ab0d
inc ecx
inc edx
inc ecx
rol edx, 1
dec eax
mov dword [esp + esi - 0x39], edi
inc esp
xor dword [esp + esi*4 - 0xe4], edx
inc sp
sub ecx, ecx
jo 0xb7797f
pop edi
inc ebp
movzx esp, al
not ecx
dec ebp
arpl dx, dx
jge 0xccb565
dec ebp
add esi, edx
dec eax
dec esi
call fcn.00bd142e

Function at 0xc0b6de
Capabilities:
Encode data using base64

Disassembly:
ror eax, 0x1b
pop ecx
pop ebx
inc ecx
pop ecx
jae fcn.00bfd2e5
mov eax, 0xa0b192b1
sub cl, cl
lea edi, [edi + ecx*2 - 0x344b65fc]
neg cl
push ecx
xor edx, ebx
shr word [esp + ecx - 0x1a25b2ff], 0xed
adc ecx, 0xec02f423
inc edx
ror edx, cl
jmp 0xc49328
pop ecx
dec edx
call fcn.00bb5d85

Function at 0xc24b32
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0xeb3a7f23
dec eax
dec edx
jmp 0xc61895

Function at 0xc27178
Capabilities:
Encode data using base64

Disassembly:
sub edx, 0x851c02af
jmp 0xb6585e
mov edx, dword [edi]
add edi, 4
mov dword [esp], ecx
movzx eax, cl
xor edx, ebx
bswap edx
rol eax, cl
shl word [esp + eax*2 - 0x16ffffff], 0xa1
jns 0xba4b38
dec edx
push edi
or dword [ecx + esi*8 - 0x74dcac92], ebp
mov dword [ecx + 0x50], eax
inc ecx
push eax

Function at 0xc3160d
Capabilities:
Encode data using base64

Disassembly:
dec ecx
sub ebx, 2
inc ecx
mov edx, 0xd10f112c
dec esi
lea edi, [edx*4 + 0x5e8213af]
inc ecx
movzx ebx, word [ebx]
xor bx, di
inc ecx
push edi
ror bx, 1
dec edi
lea edx, [edx + edx*8 + 0x5f295507]
pop ebp
add bx, 0x7917
inc ebp
movzx ecx, dx
ror bx, 1
call fcn.00c788d7

Function at 0xc3276f
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], ecx
inc esp
movzx edx, word [esp + 4]
xor eax, edi
call int.00bb00a8
sbb al, 0x10
dec eax
arpl cx, cx
dec esp
adc esi, ecx
inc ebx
mov ebp, dword [ebp + ecx - 0x95]
dec ecx
not edx
dec edx
lea ebx, [eax + 0x1d1e9037]
inc edi
mov edi, dword [ebp + ecx*2 - 0x126]
inc ebx
mov cl, byte [ecx + ebp - 0x8d]
rol bx, 0x6e
xor al, 0xa1
inc ecx
push ecx
dec edi
lea ebp, [ebp + ecx*8 - 0x4a2]
inc esi
and byte [esp + ecx*4 - 0x251], al
inc ecx
push edx
inc esp
shld ebp, edi, cl
inc cx
or ebx, esp
call fcn.00c517c7

Function at 0xc42b3d
Capabilities:
Encode data using base64

Disassembly:
call fcn.00bedac0
call fcn.00c5382e
test dl, al
Function at 0xc5d23b
Capabilities:
Encode data using base64

Disassembly:
call 0xbafee6
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
push 0xbb8a5d97
lea esp, [esp + 8]
je 0x14358ba
jmp 0xc8da86
mov eax, 0x55b1ae30
mov eax, dword [ebp + ebx*4]
push 0x6a35ab81
mov dword [esp], eax
call fcn.014358a8
mov eax, dword [ebp]
jmp 0xbb08a0

Function at 0xc61850
Capabilities:
Encode data using base64

Disassembly:
dec ecx
inc ecx
inc ecx
xor esp, 0x5b9e3928
call fcn.00c24b32
dec edx
mov edi, dword [esp + ecx - 0xd731]
inc ecx
rol cl, 0x81
dec eax
sar esi, 0xf2
dec eax
arpl dx, dx
je 0xca16ea
dec esp
adc esi, edx
inc ebp
xchg edx, eax
pop esi
pop esi
pop esi
pop ecx
inc ecx
pop esp
pop ecx
jmp fcn.00bfd2e5
mov dword [esp + ecx - 0x4229bb60], esi
ret
inc ecx
mov ebx, 0x77a74d8b
inc ecx
bswap ebx
inc ebp
movzx ebx, byte [ecx]
push 0x6ba1f18c
inc ebp
xor ebx, esp
inc ecx
and ebx, 0xff
inc edi
mov ebx, dword [eax + ebx*4]
shl word [esp + 6], 0xa4
dec eax
neg dword [esp]
dec eax
inc dword [esp]
inc ecx
shr esp, 8
inc ebp
xor esp, ebx
jmp 0xbcc831
shrd ax, dx, cl
mov edx, 0x3ab76429
pop edx
mov word [ebp], ax
mov ecx, 0x229bb604
mov edx, dword [edi + ecx - 0x229bb604]
lea edi, [edi + ecx*2 - 0x45376c04]
lea eax, [ecx + ecx*2 - 0x11d9b2f9]
shr dword [esp + ecx*2 - 0x45376c08], cl
xor edx, ebx
rol edx, 1
xor edx, 0x17b4b7b5
not edx
inc edx
ror ecx, cl
jae 0xce508f
dec eax
lea esp, [esp + 0x10]
jne 0xbed2e3
jmp 0xbdfe8f
neg ebx
dec edi
lea ebx, [eax + ebx - 0x970004]
jb 0xccf126
xor ebx, edx
add dword [esp + eax - 0x55f96f13], ecx
adc esi, edx
jmp 0xbd13fc

Function at 0xc6a4e5
Capabilities:
Encode data using base64

Disassembly:
call fcn.01424a05
neg bp
inc ecx
xchg edi, eax
jmp 0x1430148
jmp 0xbccbe4
lea esp, [esp + 8]
jne 0xbeb902
mov eax, 0x7d27c33e
mov eax, dword [ebp + eax - 0x7d27c33e]
jmp 0xbc78f9

Function at 0xc6f1c6
Capabilities:
Encode data using base64

Disassembly:
inc ecx
setb ah
inc sp
xor edx, edi
mov ebp, 0x781e8d97
inc bp
xor edx, eax
inc cx
neg edx
inc cx
add edx, 0xc1481900
sti
jo 0xc6f22e
shr ecx, cl
call fcn.00bf8e76