joyce8/EMBER2024-capa huggingface dataset:
Function at 0x95b24b
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov edx, eax
mov dword [esi + edx*8 - 0x12], ecx
btr ax, dx
lea esi, [esi + eax + 3]
sar eax, 0xb7
mov edx, dword [eax + edi]
mov ecx, 0x13b8c4a2
shl ecx, cl
mov dword [esp + eax*4], eax
lea edi, [eax + edi + 4]
shr eax, 0x71
rol ecx, cl
xor edx, ebx
or ecx, eax
bswap edx
bt eax, 0xb9
xor eax, ecx
xor edx, 0xa59366b4
ror edx, 2
inc edx
pop eax
xor ebx, edx
imul cx, cx
add cl, cl
jp 0xd713eb
movzx ax, byte [ebp]
mov edx, 0x4596850c
movzx ecx, dl
btc ecx, edx
mov dl, byte [edx + ebp - 0x4596850a]
and cl, 0xa
jno 0xc9f026
neg cl
not cl
jmp 0xde02a8
inc ecx
adc al, dl
mov word [ebp + ecx*2 - 0x2010], ax
movsx edx, cx
and ecx, ecx
mov edx, dword [ecx + edi - 0x1009]
lea eax, [ecx*2 + 0x3815a95]
rol eax, 0xbe
lea edi, [edi + ecx*2 - 0x200e]
ror cl, 0x87
xor edx, ebx
ror cl, 5
lea edx, [edx + ecx*2 - 0x269bd9c4]
jb 0xd382bc
movzx ecx, byte [edi + ecx*2 - 0x73bca79c]
bt ax, 0x9d
mov edx, eax
adc edi, 4
bts eax, 0x2e
xor cl, bl
not al
push edx
inc dx
inc cl
not cl
btc eax, edx
rol edx, 0x73
jb 0xc77954
btc eax, 0x25
rol ecx, 6
bswap edx
xor edx, 0xef8ba4a6
rol eax, 0xaf
xchg cx, ax
rol cx, 0xb
ror edx, 2
dec eax
sar cl, cl
sub cl, ah
xor ebx, edx
lea eax, [ecx*8 - 0x1145e7dc]
xchg ecx, eax
or ecx, 0x890ac529
adc esi, edx
lea ecx, [ebp + eax*2 - 0x90fb8]
dec al
mov edx, eax
mov dword [ebp + eax*2 - 0x90fba], ecx
xchg dl, al
lea ebp, [eax + ebp - 0x487de]
and eax, edx
movsx ecx, dl
xchg ecx, eax
jge fcn.00caa7a7
xor bl, cl
xor dword [esp], 0xdaa52e2c
mul dword [esp]
sal dl, 0xc6
lea ecx, [esp + ecx + 4]
jbe 0xda13ae

Function at 0x95fe69
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.0095fe90
ror cx, 0x61
call fcn.00c7f4c4

Function at 0x9630fb
Capabilities:
Authenticate hmac

Disassembly:
neg edi
dec edi
lea ebx, [edi + ebx - 0xaed3]
inc eax
xor dl, dh
inc eax
movsx eax, bh
dec edi
lea ebp, [esp + eax*8 + 0x44021c91]
ror dl, 1
dec ecx
sar ebp, cl
inc ecx
adc dl, al
jno 0xd11ff3
mov eax, 0xfcae4a92
movzx edx, al
lea ecx, [eax + eax - 0x73da09cd]
mov eax, dword [esi + edx*2 - 0x124]
inc dx
mov dx, word [esi + edx*8 - 0x494]
xor cl, ch
add ecx, 0x6aa385b0
btc ecx, ecx
adc esi, 5
call fcn.00c8d450
xor ecx, ebx
dec dword [esp + 0xc]
call fcn.00cf3e0c
dec eax
inc cx
shl edi, 0x82
xor eax, 0xc01dd599
ror eax, 2
dec ecx
bt esi, edx
push esi
inc edx
xor dword [esp + eax - 0x34], eax
dec esp
lea esp, [ebp + edx*4 + 0x8b3da84]
inc cx
bt esi, 9
not dx
pop esi
dec eax
arpl ax, ax
dec esp
add ecx, eax
movzx edi, dl
dec ecx
neg eax
xor edx, 0xe2344daa
inc ebx
movzx edx, byte [ebx + eax*2 + 0x68]
dec ecx
bswap eax
ja 0x958d21
Function at 0x974f14
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [esi + edx - 0xa5]
sal edx, 0x43
call fcn.00986602
mov ecx, 0xa6a7f8a7
movsx eax, cx
jmp 0xcc1ea4
pop esi
pop edi
movsx eax, cx
pop ecx
bswap ebp
lea ebp, [eax*8 + 0x1a3eee3f]
call fcn.00d19a17
movzx edx, byte [edi]
or ecx, eax
shr ax, 0x23
shr eax, 0x23
mov esi, ecx
xor dl, bl
mov edi, 0xd22ce2af
bswap eax
sal di, 0x2c
ror dl, 1
xor dl, 0xb5
ror esi, 0xd3
ror dl, 1
neg dl
or si, ax
rol esi, cl
xor bl, dl
shr ecx, cl
dec al
add si, ax
add edx, esp
mov eax, dword [edx + ecx*4 - 0x7ffffc4]
mov dword [ebp + ecx - 0x1fffff5], eax
bts edi, ecx
jae 0xd24f82
dec ecx
push 0x4bb65282
call fcn.00d09021
cmc
and eax, 0xa090a8b5
mov byte [edx], 0x8e
add ah, byte [eax - 0x7cfd3960]
cmp dl, byte [eax + 0x2c802c6]
movsb byte es:[edi], byte [esi]
mov al, byte [0x1a8f02c6]
ja 0xcc1f75
dec esi
test ecx, ebx
sub dword [0x9761c0b3], esi
jno 0xcc1eab
shl byte [ecx - 0x69], 0x71
xchg dword [edx + 0x471ae09b], ebx
daa
pop edx
lcall 0x5a27, 0x471ae09b
sbb bh, dh
pop esp
aam 0x64
ret 0x9504
mov al, 0x79
test bh, al
xchg edi, eax
push 0xaf5fdcb
and eax, 0xeba79b5d
out dx, eax
dec esi
aad 0x5a
sbb ebp, dword [ecx + 2]
push 0xa8d106de
sahf
js 0xcc1f9e
jmp 0xcc1f66
pop ds
aad 0xce
imul edx, dword [edx - 0x309651d4], 0x5a
xchg edx, eax
sti
jae 0xcc1f1f
out 0xa0, eax
adc byte [edx + 0x2d], ah
ret
xchg byte [edx - 0x668824c], dh
aas
in eax, 0xed
inc edx
cmc
sahf
rcr eax, 4
push ecx
add dword [edi - 0x26], ebp
outsb dx, byte [esi]
mov dword [ebx + 0x70], eax
hlt
jae 0xdafdaf
lea esp, [ebp + ecx*8 - 0xfffff8c]
pop edx
jae 0xdd9027
pop ebx
sar ecx, 0xf6
popfd
mov ebp, 0xd2a8568e
jmp 0x9a6a77

Function at 0x975e6d
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov dword [esp - 0x5a0], eax
inc eax
add ch, 0x94
inc dx
or dword [esp - 0xae], ecx
shr dl, 0x82
inc eax
not ch
call fcn.00d6b077

Function at 0x97cdfb
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea eax, [eax*2 - 0x1ff45a55]
dec eax
mov esi, dword [esp + ebp + 0x28]
dec eax
sub ecx, ecx
dec eax
btr ebx, 0xb0
dec ebp
arpl bp, bp
dec eax
mov dword [esp + ebp + 8], ebx
dec esp
mov dword [esp + ebp*4 + 0x28], esp
dec ebp
lea esp, [esp + ebx*4 + 0x729b9ea5]
dec ebp
add ecx, ebp
inc eax
shr ch, 0x87
cbw
pop edx
pop eax
pop ebp
inc ecx
pop ebp
pop ecx
inc ecx
pop esi
je fcn.0098d067
shl esi, cl
clc
test edi, esi
mov ecx, dword [ebp + 0xc]
jmp 0xdcfe51
shl eax, cl
mov dword [ebp - 0x3c], esi
stc
mov dword [ebp - 0x14], ebx
stc
mov dword [ebp - 0x10], edi
stc
cmp bp, si
add eax, 0x736
jmp 0xce5dd0
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], bl
cmp edi, esi
test esp, 0xf829fc04
sub esi, edi
cmc
mov dword [ebp - 0x48], esi
btr si, 0xad
mov esi, dword [eax]
cmp ecx, esp
test esi, edi
cmc
mov dword [ecx], ebx
btc ecx, esi
cmovbe ecx, ecx
xor ecx, esp
mov ecx, dword [ebp + 0x14]
clc
mov dword [ecx], ebx
mov ecx, dword [eax + 4]
sub al, 0x14
lea ecx, [ecx + esi]
inc ah
movsx ax, bl
stc
mov eax, 0x300
stc
jmp 0xc78ec8
Function at 0x983713
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ebp*2 - 4], 0x631b25ad
dec eax
mov dword [esp + ebp + 6], esi
movsx edx, bx
dec edx
lea esi, [eax*8 + 0x51beec17]
xor dword [esp + ebp + 6], edi
dec eax
mov esi, dword [esp + ebp + 6]
inc ecx
inc al
dec eax
arpl di, di
dec esp
add ecx, edi
inc ebp
movzx ebp, byte [ebx + ebp*2 - 4]
dec ebp
lea ebx, [ebx + ebp*4 - 7]
inc ecx
not esp
dec eax
lea ecx, [ebp*2 + 0x7007e405]
inc esp
xor ch, dh
mov edi, 0xbe0dec82
inc bp
or edi, edi
inc ecx
dec ch
dec eax
mov dword [esp + ebp*8 - 8], 0x1482528c
inc ecx
dec esi
seto cl
inc ecx
not ch
inc ecx
sar esi, 0xdf
dec edx
lea eax, [edi*2 - 0x684b41f8]
inc ecx
xor ch, 0x1c
inc ecx
not ch
inc eax
dec bh
inc ecx
xor dh, ch
pop ebx
dec esi
lea ebp, [esp + ebp + 8]
not word [esp + ebp + 2]
cdq
dec esi
mov eax, dword [ebp + ebp - 2]
dec ebp
lea edx, [edx + ebp*2 - 0xc]
push edi
inc esi
or byte [esp + esi*2 + 4], ah
dec ebp
mov dword [edx + ebp*2 - 4], eax
inc esp
mov eax, ebp
inc esp
and edi, ebx
inc ecx
pop ebp
pop ebx
jno fcn.0098d067

Function at 0x98d086
Capabilities:
Execute syscall

Disassembly:
adc ecx, edx
neg eax
mov dword [esp], 0x301f473a
add esi, 4
shl byte [esp + 3], 5
shrd ax, dx, cl
sal dword [esp], 0x94
mov ecx, 0x5d9e1c15
bt ecx, ecx
mov word [esi + ecx - 0x5d9e1c15], ax
lea eax, [ecx - 0x5fd27255]
ror ecx, cl
rol dword [esp], cl
mov eax, dword [ebp]
adc ebp, 4
movzx edx, byte [esp]
sal cl, 5
ror edx, 0x4c
xor eax, ebx
sar dx, 0xe
jae 0x96bd7b
loope 0x98d13c
aam 0x7b
loopne 0x98d0d3
push edx
sbb esi, dword [eax - 0xf]
ljmp 0xd8e9
mov ah, byte [ebx]
int3

Function at 0x98e5c3
Capabilities:
Encode data using base64

Disassembly:
shl ecx, 0x6f
xor ebx, edx
lea eax, [ecx*4 - 0x61d1624a]
btr cx, cx
jae 0xd25061
ret
mov dword [esp + eax - 0x53cb4e6c], 0xc12a5590
neg ecx
xchg dword [esp + eax - 0x53cb4e6c], eax
xor ecx, 0x5e13ba94
xadd dl, al
bswap ecx
jne 0x992c4b
xor edx, ebx
xor edx, 0x6283732b
dec ax
ror edx, 1
or eax, ecx
xor edx, 0x68898237
neg edx
add al, cl
btr ax, ax
rol edx, 3
jmp 0x968d58
xor ebx, ecx
dec byte [esp + 3]
add ebp, ecx
cwde
movsx ecx, byte [esp + eax*8 - 0x2aa78]
mov dword [esp + eax*8 - 0x2aa78], ebp
ret

Function at 0x98f132
Capabilities:
Encode data using base64

Disassembly:
neg ecx
xor ebx, eax
add ebp, eax
not ecx
mov dword [esp + ecx - 0x758b902f], ecx
xor dl, byte [ecx + esi - 0x758b902f]
lea eax, [ecx*4 + 0x5122fa1]
bt eax, 0xf
mov cl, byte [esi + ecx - 0x758b902d]
dec al
bswap eax
lea esi, [esi + eax - 0x5c7040d9]
sal dl, cl
pop ecx
mov word [esi + ecx - 0x758b902f], dx
bswap eax
sar ax, 0xa8
jae 0xd1aa49
Function at 0x990728
Capabilities:
Authenticate hmac

Disassembly:
jp 0xd2edff
inc ecx
mov edi, 0xdb84c68b
inc ecx
push edi
inc ecx
mov ebp, dword [ebx]
inc ebp
movzx ebp, di
inc ecx
push ebp
inc esi
mov byte [esp + ebp*2 - 0x18d0d], bh
dec edi
lea ebx, [ebx + ebp*2 - 0x18d12]
dec ebx
lea edx, [edi + ebp*8 - 0x29486660]
ror edx, 0xf4
xor ebp, esi
inc ecx
shr ch, 0x41
dec esi
lea esp, [edi*2 + 0x7da6501e]
movzx ecx, dx
not ebp
dec eax
lea edi, [ecx*8 - 0x1cfa5049]
inc esp
movsx esi, dl
dec ebp
shl word [esp + edx - 0x29483b1f], 0xe1
inc ecx
setg ch
bswap ebp
inc eax
movzx ebx, bh
dec esp
imul edi, ebx
inc ebp
jmp 0xda5dde
dec ebp
adc ecx, ebp
push eax
push edi
jmp 0xbf04ab
dec esi
mov dword [esp + ebp*4 - 0x3180], ecx
ret 8
xor ecx, ecx
test eax, eax
lea esp, [esp + 8]
je 0xd62024
push edi
adc esi, 4
jmp 0xce16d9
inc edx
xor dword [esp + ebp*2 - 0x18b8], ebp
shl ebx, 0xa5
dec edx
mov esi, dword [esp + ebp*4 - 0x3178]
inc dx
dec dword [esp + ebp*4 - 0x3180]
dec eax
arpl bp, bp
dec esp
adc ecx, ebp
dec ecx
dec esi
inc edx
mov ebp, dword [esp + ebp*4 - 0x317d]
dec eax
cdq
dec ebx
mov ecx, dword [edx + ebp*4 - 0x3180]
dec edx
lea ebp, [esi*4 - 0x276df0c9]
cdq
inc ecx
sar bh, 0x21
dec ebx
or eax, dword [edx + ebp - 0xc58]
inc ecx
sal esp, 0x41
inc ecx
dec ah
dec edx
xadd dword [esp + ebp - 0xc60], edi
dec esi
lea edx, [edx + edx + 8]
dec eax
or ecx, eax
dec ecx
sub eax, 0xcba18784
dec eax
not ecx
dec ebx
mov dword [edx + ebp*2 - 0x18c0], ecx
inc edx
adc dword [esp + ebp - 0xc5c], ebp
inc ecx
mov ecx, edi
js 0xcd92d6
inc dx
and ebx, dword [esp + ebp*2 - 0x18bf2]
neg ebp
inc esi
or byte [esp + ebp - 0xc600], ah
inc edx
mov eax, dword [esp + ebp*2 - 0x18bf4]
inc edx
xor edx, dword [esp + ebp*4 - 0x317f9]
inc edx
lea ebp, [ebp + ebp + 0x14019d]
inc ecx
setb bh
dec eax
bt ecx, edx
dec edx
mov dword [esp + ebp - 0xc5f8], esi
inc cx
shr ebp, cl
inc ecx
mov eax, 0x6fafe617
jp 0xd7a01d
mov ax, word [esi]
mov ecx, 0xc1a9661e
lea edx, [esp + 8]
call fcn.00991f2e
mov edx, 0x14172185
movzx edi, dl
inc ebp
mov ebp, dword [ebx + edi - 0x85]
movzx ebp, dx
dec ebp
lea ebx, [ebx + edx*4 - 0x505c8610]
inc esp
xor ebp, esi
inc esp
mov eax, ebp
inc ebp
lea ebp, [ebp + edx*8 + 0x4ee27008]
inc ecx
xor ebp, 0x571fafaf
inc ecx
ror al, 0x47
inc eax
add dl, ch
inc ecx
rol ebp, 3
inc ecx
bswap ebp
push esi
mov ecx, 0x73bdcb32
inc esp
xor dword [esp + edx - 0x1417210a], ebp
inc ecx
movsx ebx, al
dec eax
lea edi, [ebx*4 + 0x14ba2088]
movzx eax, dl
pop esi
ror bx, 0xa2
dec ebp
arpl bp, bp
xor di, di
dec eax
cdq
jae 0xcc49a1
mov eax, dword [ebp]
mov edx, 0xe83b3d3f
mov ecx, edx
push ecx
mov dl, byte [ebp + 4]
jmp 0xda1a8a
Function at 0x992b26
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xd13d7084
and eax, 0xfffffffc
jmp 0xdd9919
sub eax, ecx
mov esp, eax
call fcn.00d3407a
push esi
cmp dword [ebx - 0x2641dcd6], 0xffffffb5
jle 0xdd9947
mov edi, 0x7eb5a9b0
sbb ebp, dword [edi + 0x7eb53918]
sbb eax, dword [ebx]
les esp, [ecx - 0x4b]
jle 0xdd9959
aaa
pushal
xchg ecx, eax
mov ch, 0x7e
sbb esp, edi
clc
inc ecx
mov ch, 0x7e
sbb eax, dword [ebx]
dec eax
sbb dword [ebp - 0x41e4e482], esi
cmp dword [ecx - 0x11e8e4b5], 0xffffff8f
mov esi, 0x1b4bb983
pop ss
out dx, al
invalid
je 0xdd9977
mov ch, 0x6f
inc ebp
adc bh, byte [edi]
cmp eax, dword [eax]
add byte [eax], al
pop ss
mov cs, word [ebx]
scasd eax, dword es:[edi]
cmpsd dword [esi], dword es:[edi]
aad 0xdd
add byte [esi + 0x9f8795e], dh
or eax, 0xa9d56da
jp 0xdd9951
fnstenv [ebx]
fadd dword [eax]
in eax, 0xa3
xor dword [eax - 0xc], edi
adc byte [esp + ebx], 0xde
mov dh, 0xb
dec edi
xor dword [ecx], esp
xor ebx, eax
add ch, ah
mov dword [0x80f47831], eax
adc al, 0x1c
fidiv word [esi + 0x21314f0b]
pop edx
pushal
ja 0xdd99ee
add esp, ecx
pop edi
cmc
lahf
dec eax
cmpsb byte [esi], byte es:[edi]
xor eax, 0x39df7795
leave
jnp 0xdd99a3
mov edx, 0x3c65349f
inc ebp
cmp al, 0x45
adc dh, byte [esi*4 - 0x4ea5adc2]
cld
xor al, 0xb5
push edx
pop edx
mov cl, 0xfc
mov ch, bh
or ah, ch
jno 0xdd99a3
sbb dl, dh
mov gs, word [ecx + 0x21fdf877]
scasb al, byte es:[edi]
fdivr dword [ebp - 0x5ff711ea]
mov edi, 0x656b69b3
enter 0x2ac0, 0xffffffffffffffe4
enter 0x2ac0, 0xffffffffffffffe4
test dword [ebx + 0x19935b1b], eax
push 0x9555953f
mov edi, 0xcaa28923
mov dh, 0x24
mov edx, 0xfba74823
add byte [eax], al
add byte [eax + 0x6a6d7eef], al
jge 0xdd99c5
cdq
jb 0xdd999f
in al, 0x2d
pushal
inc edx
cdq
jecxz 0xdd9a64
int3
out 0x6e, eax
stosd dword es:[edi], eax
popfd
invalid
Function at 0x9962c1
Capabilities:
Encode data using base64

Disassembly:
dec dword [esp + 4]
push 0xed26ad25
shr edx, 8
push 0xb6373028
xor edx, esi
jmp 0xe67b0a
rol dword [esp + 4], 0x9b
inc ecx
xor edx, 0xd4b9449b
sal dword [esp + 4], 0xfe
dec eax
push 0x143f310e
lea esp, [esp + 0x14]
jne 0xc808be
mov eax, 0x9c8e799b
imul eax, eax
pop esi
Function at 0x99e70d
Capabilities:
Authenticate hmac
Manually build aes constants

Disassembly:
bswap edx
mov eax, edx
add cl, 0x8b
mov dword [esp + edx - 0x6a2c9f71], edx
inc dx
sal eax, 0xaf
rol cl, 1
dec dword [esp + edx - 0x6a2c9f72]
mul eax
adc cl, al
sub dl, byte [esp + eax*2 - 0x7ffffffe]
setge al
mul dword [esp + edx*2 - 0x31a6c798]
not cl
xadd dword [esp + edx - 0x1a8b27dc], edx
lea edx, [eax + eax*8 + 0x2d1c25a6]
jg 0xd71268
and bh, ch
jmp [edx]
dec cl
and byte [esp + eax*4 + 3], dl
ror ax, 0xee
rol cl, 1
or eax, 0xb2b8523
neg cl
sar dx, 0xe1
adc dl, al
xor dword [esp + eax*2 - 0x16570a46], eax
not cl
adc al, ah
xor dx, ax
xor bl, cl
sal eax, 0xf3
lea ecx, [esp + ecx + 4]
add byte [esp + edx - 0x2d1c975d], ah
adc edx, eax
mov eax, dword [edx + ecx - 0x5a5c975e]
mov dword [esi + edx - 0x5a5c9762], eax
mov ecx, dword [esp + edx - 0x5a5c975e]
inc dword [esp + edx - 0x5a5c975e]
mov eax, dword [edi + edx - 0x5a5c975d]
pop ecx
rol dx, 5
xor eax, ebx
call fcn.00dcc315

Function at 0x99fbea
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
push edi
dec eax
mov esp, edx
push edi
call fcn.0095a3d2

Function at 0x9a200f
Capabilities:
Encode data using base64

Disassembly:
mov dx, word [esi + 2]
mov cl, byte [esi + 4]
adc esi, 4
call fcn.00dd62da

Function at 0x9a4b11
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x5421ddbf
call fcn.00d613cd
mov eax, 0xf59034b2
rol eax, 0xfa
lea eax, [eax*8 + 0x62028013]
mov edx, dword [esi]
push eax
mov ecx, dword [esi + 4]
adc esi, 4
inc ax
xadd word [esp], ax
ror al, 0xa1
not edx
or ax, ax
call fcn.00cb3d80
and cl, cl
movzx eax, byte [esp + 8]
lea ebp, [ebp + eax - 0x20]
or ax, 0xe022
movzx eax, byte [edi + eax*8 - 0x7012c]
sbb edi, 0xfffffffb
jmp 0xd01108
call fcn.009777f3
add byte [eax], al
add byte [ebx + 0x65], dl
je 0xd01169
outsb dx, byte [esi]
push 0x6c646e61
inc ebp
js 0xd01182
jo 0xd01196
imul ebp, dword [edi + 0x6e], 0x746c6946
jb 0xd0112c
jmp 0xbe81170
cmp dword [edx], ebp
pop es
cmp eax, 0xae091b73
out 0x3d, eax
jae 0xd011a9
mov ebp, 0x733d67d8
sbb esi, dword [0x733d0774]
sbb ebx, dword [ecx + 0x22]
pop es
cmp eax, 0x22591b73
inc edi
int1
jns 0xd011bc
cmp esi, dword [edx + 0x30]
mov byte [0x2f1eee4], al
mov dword [0xffffffff], eax
shr byte [edi - 0xd49c52], cl
xchg esp, eax
int 0x73
push eax
mov esi, 0xe871169f
add eax, 0x7c5a79f1
mov edx, 0xa7126423
dec ecx
retf 0xfafd
Function at 0x9a8f18
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x5096a82c], ecx
xor eax, 0xae135435
xadd ecx, edx
jg 0xd6f40a
lea ecx, [edx*8 + 0x293dcb17]
lea eax, [eax + edx - 0x509a5540]
add word [esp + edx - 0x5096a82b], 0x5b86
shr dword [esp + edx - 0x5096a82b], 0x77
xor ebx, eax
not edx
add ebp, eax
or dword [esp + 4], ecx
sal dl, 0x87
mov eax, dword [esi]
movzx edx, byte [edi + 4]
btr cx, 0xac
pop ecx
lea ecx, [ecx + ecx + 0x5f339e16]
lea edi, [edi + ecx - 0x5f350a69]
or word [esp + ecx - 0x5f350a6c], cx
bts ecx, 0x3a
xor dl, bl
xor dl, 0xb
pop ecx
or ecx, ecx
rol dl, 1
not dl
call fcn.00dea8f1
mov ebp, 0x6a27a225
inc ebp
mov edi, dword [ebx + ebp - 0x6a27a225]
inc esp
mov eax, ebp
jmp 0xda12c2
dec edi
lea ebx, [ebx + eax - 0x6a27a221]
inc eax
movsx ebx, ch
inc ecx
dec eax
inc esp
xor edi, esi
inc ecx
movzx edx, ax
inc esp
movsx ebp, bl
inc edi
lea edi, [edi + eax*2 + 0x1b4c37e8]
dec eax
ror ebx, 0x12
inc ecx
xor edi, 0x571fafaf
bt ebp, edx
inc ecx
rol edi, 3
inc esp
movzx esi, bp
dec eax
ror ebp, 0x23
inc cx
ror esi, 0x66
inc ecx
bswap edi
inc ecx
movzx eax, si
call fcn.00cfe2d5

Function at 0x9aa0b6
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
je 0xdc0ae4
lea edx, [esp + edx + 4]
mov dword [esp + ecx - 0x660087df], eax
neg cx
mov cx, word [ecx + edx - 0x66007821]
mov word [esi + eax*8 - 0x2b81880], cx
lea ecx, [eax*8 + 0x589cc621]
mov dword [esp + eax*2 - 0xae0620], edi
ret

Function at 0xbf2e87
Capabilities:
Encode data using base64

Disassembly:
dec esi
lea esi, [esp + esi + 0x18]
inc si
mov ebp, dword [ebx + esi]
push ebx
dec eax
lea eax, [edi - 0x1363e1f9]
dec esi
lea edx, [ebx + edx - 2]
inc si
mov dword [ebx + edx], ebp
dec eax
xadd eax, edi
inc sp
xadd dword [esp + ebx + 0x1c], eax
inc esp
movsx ebp, byte [esp + ebx*4 + 0x18]
inc ebp
adc ebp, dword [ebx + ebx*2]
inc eax
xor dl, ch
dec ebp
lea ebx, [ebx + ebx*2 + 4]
dec eax
not ebx
inc esp
xor ebp, esi
mul di
sbb ecx, ecx
dec ecx
sar edi, 0xa7
inc esp
sbb ebp, ecx
inc ecx
pop esp
push edx
inc ecx
rol ebp, 2
cbw
inc edi
lea ebp, [ebp + edi + 0x2bb9cb0a]
inc dx
rol dword [esp + edi*2 + 0x18], 0xa5
inc esp
movsx esi, bh
inc esp
xor ebp, ecx
inc edx
xchg byte [esp + edi*4 + 4], dl
inc ecx
neg ebp
dec bx
bswap ebp
inc eax
sar bh, 0x41
inc ecx
ror ebp, 3
dec eax
bt ebp, 0x22
inc ecx
neg ebp
pop edx
inc sp
sub edi, ecx
dec edx
mov dword [esp + edi*4 - 4], eax
dec edx
mov dword [esp + edi + 0xf], esi
inc sp
bts eax, eax
inc ecx
pop eax
setae bl
inc esi
xor dword [esp + edi*2 + 6], ebp
inc ecx
pop esp
jmp 0x9733fd

Function at 0xc6fee0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, ebx
dec eax
mov dword [esp + edi*2 - 0x3200], 0x8032eaae
xor dword [esp + ebx*4 - 0xbc], eax
mov esi, ebx
inc ebp
movsx esp, di
dec eax
mov esi, dword [esp + ebx - 0x29]
inc esp
movsx eax, dl
dec eax
arpl ax, ax
inc ecx
neg eax
dec eax
mov dword [esp + ebx - 0x29], 0x93a63db5
dec eax
inc ebp
dec esp
add ecx, eax
inc cx
movzx edi, byte [edx + ebx - 0x31]
call fcn.00d70d91
test sp, 0x5ba7
Function at 0xc702ff
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [edx + ebp + 4]
btc eax, 6
push eax
xor ecx, ebx
neg ecx
neg edx
or dword [esp + edx], eax
bswap eax
lea ecx, [edx + ecx + 0x379336bf]
mov dword [esp + edx*2 + 4], eax
rol ecx, 1
call fcn.00d76b6f
mov eax, 0x783073a8
sal ax, 0xe1
adc al, 0xa8
lea edi, [edi + eax - 0x7830e7fc]
inc eax
mov eax, dword [edi + eax - 0x7830e7f9]
push 0xa89c4590
sal word [esp + 1], 0xc5
xor eax, ebx
add eax, 0x53007c37
push 0x17947a96
push 0x48a0341c
bswap eax
add eax, 0x7d365d80
ror eax, 2
sal dword [esp + 8], 0x8d
push 0xeb9f5c39
not word [esp]
xor ebx, eax
jmp 0xdcff05
call fcn.00d83425
xor dword [esp + 6], 0x7d27f609
adc ebp, eax
lea esp, [esp + 0x10]
push 0x60267783
lea esp, [esp + 4]
jmp 0xd25a6a

Function at 0xc70f12
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec esp
lea ebp, [edi*4 + 0x578bbd20]
inc ecx
mov cl, byte [edx + edi - 0x1e0d5d29]
dec eax
mov dword [esp + edi - 0x1e0d5d2d], ebx
dec esi
lea edx, [ebx + edx + 0x4b446afc]
inc eax
movzx eax, bh
inc sp
shld edx, edi, cl
dec eax
lea ebp, [eax*2 + 0x31089b24]
inc esp
movsx esi, byte [esp + ebx + 0x4b446afa]
neg dword [esp + edi - 0x1e0d5d2d]
inc cx
mov dword [edx + edi*2 - 0x3c1aba5a], edx
inc eax
inc ch
not bx
inc ecx
mov ecx, dword [ebx + edi - 0x1e0d5d2d]
neg bl
call fcn.00dc47e4
mov eax, 0x408dd2f
movzx edx, ax
mov ecx, 0x4a80c1ae
lea edi, [edi + eax - 0x408dd33]
xor eax, edx
cwde
mul eax
mov ecx, dword [edx + edi]
shr edx, 0x24
xor ecx, ebx
and dx, dx
sub edx, 0x13872f88
rol ecx, 1
lea eax, [eax*4 + 0x5f136b19]
neg ax
xor ecx, 0xbba9e883
shl edx, 0x63
or al, 0x8d
jl 0xd77f35
dec edx
mov dword [esp + esi - 0x64c8], esi
inc esi
xor dword [esp + esi - 0x64c8], esp
dec eax
or ecx, 0x4f3b74b2
inc ecx
movzx edi, si
inc cx
or ebx, ebp
pop esi
dec ebp
arpl sp, sp
jb 0xd66321
dec eax
btc ebp, edx
call fcn.00d2fcc1
mov ecx, dword [ebp]
mov eax, 0x3b19d69f
bt eax, eax
xor ecx, ebx
not ecx
bswap eax
imul eax, eax
neg ecx
rol eax, 0x47
sbb ecx, 0xf32b4d1c
cwde
sal ax, 0xc
btc eax, eax
not ecx
shl al, 0x26
call fcn.00d777cc
lea ecx, [ecx + edx - 0x2f35bd1f]
and dl, 0x23
rol eax, 0xdf
bts dx, ax
not ecx
ror ecx, 1
inc ecx
xor ebx, ecx
call fcn.00d57b57

Function at 0xc7c22c
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x718ace29
mov dword [esp + eax - 0x42fc5d5d], 0xb882f315
dec ecx
shl dword [esp + eax - 0x42fc5d5d], 0x2d
neg word [esp + eax - 0x42fc5d5b]
rol ecx, 3
xadd dword [esp + eax - 0x42fc5d5d], eax
add dl, 0x2d
jge 0xd31651
dec ecx
lea eax, [eax*2 + 0x6a815b03]
inc dl
rol ecx, 3
xchg word [esp], ax
bswap edx
xor ebx, ecx
add edi, ecx
rol edx, 0xf5
adc byte [esp + 3], 0xb0
mul ax
mov eax, dword [esi]
pop edx
movzx ecx, dl
mov cl, byte [esi + ecx + 1]
adc esi, 1
shr eax, cl
lea ecx, [edx*4 + 0x58176aa6]
or dl, ch
mov dword [esi], eax
jmp edi
Function at 0xc807b2
Capabilities:
Authenticate hmac

Disassembly:
xor dl, bl
shr ecx, 0xb0
btr ecx, 0x23
neg dl
rol ecx, 0x67
mov dword [esp + ecx*8 - 0x3304c00], ecx
mov eax, ecx
sbb dl, 0x84
push ecx
not eax
pop eax
ror dl, 1
push ecx
sal al, 0xc5
neg dl
not dl
btc ecx, 0xa2
xor bl, dl
shr cl, 0x27
jne 0xd173f2
mov edx, 0x659f1fac
mov ax, word [esi + edx - 0x659f1fac]
mov dx, word [esi + edx - 0x659f1faa]
mov cl, byte [esi + 4]
call fcn.0098d086
dec ecx
mov ebx, dword [edx]
inc ecx
mov esi, 0x2f04ca99
inc ecx
sal esi, 0x8f
inc ebx
movzx eax, byte [ebx + esi - 0x654c8000]
inc ecx
movsx edi, si
inc eax
xor al, dh
jmp 0xdb4a9b
inc cl
lea edx, [esp + edx + 8]
mov cx, word [edx + ecx*2 - 0xcc1204]
lea edx, [eax + eax + 0x30b62c18]
cdq
mov word [esi + eax - 0x660902], cx
pop edx
bt ax, dx
not dx
movzx eax, byte [ebp + eax*8 - 0x33047ff]
call fcn.00ce725d
mov edx, dword [ebp]
mov ecx, 0x2915ada0
sal cx, 0xe1
mov eax, dword [ebp + ecx - 0x29155b3c]
inc ecx
mov ecx, dword [ebp + ecx*2 - 0x522ab67a]
adc ebp, 3
jmp fcn.00d29002
test byte [eax + eax], dl
cmp byte [eax], 0x91
sar cl, 0xa2
dec eax
push ecx
fmul dword [edi]
shr byte [esp + edx - 0x5144453], 0x42
rol al, 1
inc ecx
push esi
inc esp
movzx eax, di
dec edx
lea ebp, [edi + eax*4 - 0x414b90c1]
add al, 0x16
dec ebp
bt eax, esi
jae 0x982abc
mov ecx, eax
xchg edi, eax
jnp 0xdb4a5a
stosb byte es:[edi], al
enter 0x7058, 0xffffffffffffffa9
lodsb al, byte [esi]
mov dh, 0xc8
pop eax
jo 0xdb4a80
mov al, 0xbe
enter 0x7058, 0xffffffffffffffa5
mov esp, 0x8e34f14d
cmpsb byte [esi], byte es:[edi]
popfd
or dword [edi + 0x3ad108f], esp
rcl dword [esi + 0x58c39afc]
loope 0xdb4b03
sbb al, 0xfd
cmc
and al, 0xd
invalid
xlatb
or al, 0xa3
adc byte [ebp + 0x62d4240e], cl
stosb byte es:[edi], al
pop esp
dec esi
int3

Function at 0xc808b6
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], esi
lea esp, [esp + 4]
mov esi, 0x6713a128
neg si
movzx esi, byte [ecx + esi - 0x67135ed8]
push 0xe496c835
xor esi, edx
shl byte [esp + 3], 0xa4
and esi, 0xff
mov esi, dword [esi*4 + 0xd790a8]
call fcn.009962c1