joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb9eb99
Capabilities:
Encode data using base64

Disassembly:
pop ecx
jmp edi
sar eax, 0x28
mov dword [esp], eax
sbb esi, 1
or word [esp + 7], ax
dec dword [esp + 4]
movzx edx, ax
mov word [esi + edx*4 - 0x26c8], cx
imul dword [esp + edx*2 - 0x1363]
pop eax
pop eax
pop edx
jo fcn.00b0349b
mov ecx, 0x12053f9c
btr ecx, 0x32
mov ecx, dword [ebp + ecx*4 - 0x4804fe70]
mov eax, 0xbc8c5c02
btr eax, 0x32
mov edx, dword [ebp + 4]
neg eax
lea eax, [eax + eax*4 + 0x3282b71a]
dec eax
adc ebp, 7
shr al, 0xc1
push eax
mov dword ss:[ecx], edx
and dword [esp], 0x6607f290
lea ecx, [eax + eax + 0x3e8bbf8a]
mov edx, dword [ecx + esi - 0x463d9598]
bswap ecx
adc esi, 4
not cx
and byte [esp], al
lea ecx, [eax + ecx - 0x53e01e42]
xor edx, ebx
sub edx, 0xa7047ca8
neg eax
shr cx, 0x62
bswap edx
rol edx, 1
sar eax, 0x85
or eax, eax
sbb cx, cx
inc edx
sar cx, 1
xor dword [esp + eax - 0x3e138a7], 0x1e3435a5
xor ebx, edx
not eax
ror word [esp + 1], 0x4d
add edi, edx
neg dword [esp]
lea edx, [eax*8 - 0x316f36d0]
js 0xb11bbd
jno 0xc4c8cd
sal dx, 0xc1
lea ecx, [ecx + eax*4 - 0x7f4b3143]
bswap ecx
inc ecx
lea eax, [edx + edx + 0x48874f39]
xor ebx, ecx
cwd
push eax
rol dword [esp + eax - 0x48874f31], 0x91
adc edi, ecx
not edx
sub edx, eax
mov dx, word [eax + ebp - 0x48874f31]
mov ecx, 0x44b8f5bf
mov dword [esp + eax - 0x48874f31], ecx
lea ebp, [ebp + ecx - 0x44b8f5bd]
xor dword [esp + eax - 0x48874f31], eax
shl eax, cl
xor cl, 0x88
lea esi, [ecx + esi - 0x44b8f538]
movzx ecx, byte [eax + esi - 0x80000000]
rol dword [esp + eax - 0x80000000], 0x73
shr eax, 0x86
adc eax, dword [esp + eax - 0x2000000]
xor cl, bl
push eax
not cl
call fcn.00bc60c7
sub edi, 4
call fcn.009e0607
lea edx, [edx*4 - 0x736ab662]
mov edx, dword [ebp]
add ebp, 4
call fcn.00b9c7bb

Function at 0xba054b
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [ecx + ebp - 0x7ab0ba02]
movsx eax, cx
xor edx, ebx
sub al, 0xb6
call fcn.00b0802d
Function at 0xbb6d08
Capabilities:
Execute syscall

Disassembly:
sub eax, 0x89286814
or ecx, dword [esp + ecx - 0x63ffffc]
adc byte [esp + ecx*2 - 0xc7ffffa], dh
mov dword [esp + ecx - 0x6400000], edx
not eax
jbe 0xbe020b
inc cx
ror dword [esp + ecx*2 - 0xc7ffffe], cl
inc eax
lea ecx, [ecx*4 + 0x7898450c]
ror edx, cl
not eax
call fcn.00b8bcf9
mov ecx, 0x288240b1
inc ecx
lea ebp, [ecx + ebp - 0x288240b3]
movzx edx, cx
movzx eax, cx
jl 0xa8ac18
movzx eax, byte [ebp + ecx*2 - 0x51048164]
rol ecx, cl
xor al, bl
ror al, 1
imul ecx, edx
inc al
dec edx
push edx
xor al, 0x33
rol dword [esp + edx - 0x40b1], 0x87
shl dl, 0xe1
adc al, 0x3d
xor bl, al
lea esi, [ecx + esi - 0x1802ea44]
add ecx, edx
inc byte [esp + ecx*2 - 0x30065545]
mov word [esi + ecx*2 - 0x30065548], ax
dec ecx
sal dword [esp + ecx - 0x18032aa3], cl
lea ebp, [ebp + ecx*2 - 0x3006554a]
mov eax, dword [ebp + ecx*2 - 0x30065546]
dec cx
xor eax, ebx
inc eax
shl dword [esp + ecx*2 - 0x30065544], 0x49
neg eax
call fcn.009b1e42
mov ecx, 0xaca189b7
mov edx, 0x1aa7593b
xchg ch, cl
movzx cx, byte [esi + edx - 0x1aa7593b]
call fcn.00a1f80e
rol edx, 0xe8
sbb esi, 4
xor word [esp], cx
neg edx
mov ecx, dword [esi + edx*2 - 0x4747a7b8]
xchg word [esp + edx - 0x23a3d3db], dx
jge 0xb763d5
mov eax, 0xaf3ab432
movsx edx, ax
xadd edx, eax
sbb esi, 3
mov ecx, eax
imul dx, dx
cwde
mov ecx, dword [esi]
xor ecx, ebx
ror dl, 0x86
sbb edx, 0x57b8e631
setg dl
rol ecx, 1
btc eax, eax
jae 0xaaae94
sbb ecx, 0xd30430b4
not dl
lea edx, [eax*2 - 0x6feadb6e]
neg ecx
rol ecx, 1
not al
inc dl
cwd
not ecx
sub edx, 0xe72fe2bf
cmovle dx, ax
xor ebx, ecx
neg eax
add edi, ecx
and edx, edx
movsx ecx, al
shl edx, 0xea
mov eax, dword [eax + ebp - 0x44b33]
mov ecx, dword [eax + ecx*2 - 0x66]
movzx eax, dx
mov dword [edx + ebp - 0x76d33400], ecx
movzx ecx, dx
inc cl
dec eax
jmp edi

Function at 0xbb8dac
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jne 0xaa70bc

Function at 0xbbd0f9
Capabilities:
Encode data using base64

Disassembly:
bswap eax
pop edx
bts edx, 0xa1
xadd cl, ch
not eax
bswap eax
shr cx, 5
ror eax, 3
not ecx
neg eax
jmp 0xa794f2
xor ebx, eax
call fcn.00c11a39
mov ax, word [eax + esi - 0x752b4526]
mov dword [esp + ecx - 0x752b4528], 0x9530589b
lea esi, [esi + ecx - 0x752b4526]
xchg dword [esp + ecx - 0x752b4528], ecx
xor ecx, 0xd7293891
adc dx, ax
mov word [esi + ecx - 0x4219600a], dx
mov eax, dword [ecx + ebp - 0x4219600a]
shl byte [esp + ecx - 0x42196009], 0xc1
lea ebp, [ebp + ecx - 0x42196006]
xor eax, ebx
dec word [esp + ecx - 0x42196009]
jge 0xa64240
bt eax, eax
shr eax, 0x37
mov byte ss:[edx + eax*4 - 0x360], cl
not al
jmp esi
Function at 0xbc6a49
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax - 0x15ea8f0]
shr eax, 0x2a
ror dl, 1
not dl
neg dl
dec ax
sar eax, 0xf8
add eax, dword [esp + eax + 4]
xor bl, dl
call fcn.00c1521b
mov ecx, 0xab4f18c
lea eax, [ecx*8 - 0x5ce77b71]
mov edx, eax
lea esi, [ecx + esi - 0xab4f190]
shr dl, 0x81
sar al, 0x81
bswap edx
mov eax, dword [esi + ecx*4 - 0x2ad3c630]
sar cl, 0xc5
xor eax, ebx
rol edx, cl
xor dl, 0xb4
shl ecx, cl
bswap eax
bts dx, cx
and edx, 0x5411f422
not edx
not eax
adc eax, 0x1ea28e28
bswap eax
xor eax, 0xdcb8789f
xor edx, edx
xor ebx, eax
shr dx, 0x8f
jae 0xc46203
adc edi, eax
movzx eax, cl
bts edx, ecx
mov edx, ebp
sbb cx, cx
lea ebp, [ebp + eax*2 - 4]
mov dword [eax + ebp], edx
jge fcn.009fa672

Function at 0xbc77ec
Capabilities:
Encode data using base64

Disassembly:
movzx ebx, byte [eax]
xor ebx, ecx
call fcn.00a8d353
inc eax
xor ecx, 0xde8f10b9
push 0x2a8990ac
mov dword [esp + 8], 0xaa9c31b8
dec edx
not dword [esp]
lea esp, [esp + 0xc]
jne 0xaf8475
mov edx, 0x4bacde1c
movsx eax, dl
call fcn.00b833cf

Function at 0xbca439
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x2b996d25
jmp 0xb98c64
push 0x9f9bf182
mov eax, dword [esp]
mov eax, dword [ebp + ebx*4]
mov dword [esp], eax
call fcn.00bb65e2
lea ebp, [ebp + eax - 0x4b9af0ad]
or word [esp + eax - 0x4b9af0a9], dx
lea ecx, [eax + eax*8 - 0x48554476]
inc cl
mov ecx, dword [ebp + ecx - 0x601d317c]
bt eax, eax
xor ecx, ebx
neg ecx
bswap ecx
lea edx, [edx + eax*8 + 0x673fcd10]
not byte [esp + eax - 0x4b9af0a6]
cwde
xor ecx, 0x3e2af3a3
ror eax, 0xb7
sub edx, edx
and al, 0xb8
dec ecx
cdq
shl eax, 0x2e
xor ebx, ecx
lea edx, [eax - 0x7f676ef8]
call fcn.0098cf0c
mov eax, dword [ebp + eax*2 - 0x5732da4a]
push 0x14817cb3
lea esp, [esp + 4]
call eax
mov ebx, 0x573c222a
xor bl, 0
mov ebp, dword [ebp + ebx - 0x573c222e]
mov edi, ebx
mov dword [ebp + edi - 0x573c222a], eax
movzx ecx, bl
mov edx, 0xcea7a3a4
mov esi, ebp
sar cx, 0xa4
pop ebx
adc edi, edx
shl edi, 0xef
shr ecx, cl
pop edi
mov ebp, ecx
call fcn.00af9206
mov eax, 0xe6afe326
pop ecx
jmp edi
mov dword [esp], 0xaebb2010
dec ebx
push 0xe68469b5
lea esp, [esp + 0xc]
jne 0xa6d3ea
jmp 0xa10a7b

Function at 0xbd205d
Capabilities:
Encode data using base64

Disassembly:
jmp 0xac605f
pop edi
pop ebp
pop ebx
jmp 0xba0540
pop ecx
not edx
not edx
pop edx
call fcn.00b01840
jno 0xc0f66b
pop esi
jmp 0x9f01e2
dec ecx
lea esp, [esp + 0x18]
jne 0xb976b8
mov edi, 0xf187081d
mov eax, edi
shl al, 0x61
pop edi
mov ecx, 0x47a26ca5
dec cx
xor cx, cx
not edx
xor cx, cx
movzx eax, cx
btc ax, 0x11
mov dword [eax + esi - 2], edx
mov eax, dword [ecx + edi - 0x47a20000]
lea edi, [edi + ecx - 0x47a1fffc]
ror ecx, 0xb9
sar cl, cl
xor eax, ebx
movsx edx, cx
lea eax, [edx + eax + 0x2a136584]
and cx, cx
add cx, cx
xor eax, 0xa890b8e
shr edx, 0x2e
sar cx, 0x81
rol eax, 1
bswap ecx
dec eax
bswap ecx
shl dx, 0xa
not eax
lea eax, [eax + edx*2 + 0x4bcea39]
xor cl, ch
shr ecx, cl
xor eax, 0x49b4d587
dec cx
ror eax, 3
xor ebx, eax
sub edx, 0x6c27f10d
add ebp, eax
jmp ebp
Function at 0xbdd7e4
Capabilities:
Encode data using base64

Disassembly:
inc esp
mov esp, ecx
inc ecx
dec eax
dec eax
sar ecx, cl
inc ecx
movzx edi, ah
inc ebp
add ah, ah
inc ecx
ror eax, 1
inc ebp
movsx ebx, sp
dec eax
mov dword [esp + ecx], ecx
inc ebp
movzx ebp, sp
inc ecx
inc eax
inc ecx
movsx esi, ch
inc ecx
xor eax, 0x8d3d29bb
dec edx
or dword [esp - 0x524f20ec], ebx
inc esi
xor dword [esp - 0x524f20ec], eax
dec esp
xchg esi, ebx
inc ebp
movzx esi, bl
pop ebx
dec ebp
arpl ax, ax
dec ecx
shl ebp, 0xb6
dec ecx
imul esi, ebp
dec ebp
add ecx, eax
inc ecx
xor bl, 0x1e
jg 0xb55d9e
Function at 0xbe8c0b
Capabilities:
Encode data using xor

Disassembly:
inc ebp
mov eax, dword [edx + edx*2 - 0x2264]
xadd dl, cl
dec esp
lea ebx, [ecx + ecx*8 - 0x21f6f36a]
inc esp
movzx esp, dl
inc ecx
mov cl, byte [edx + ecx - 0x4c80002e]
dec ebp
lea edx, [edx + edx*2 - 0x2262]
dec esi
lea edi, [0x1083032e]
inc ecx
mov ebp, 0x15bf6d8e
inc ecx
movzx eax, bh
inc ecx
sal eax, cl
inc ecx
movsx ecx, ah
cbw
inc ecx
sub ah, 0xbf
inc ebp
mov dword [edx + edx - 0x1132], eax
mov esi, dword [ebp + edx - 0x1132]
dec eax
lea ebp, [ebp + edx - 0x112e]
mov edi, edx
inc ecx
mul ebp
xor esi, ebx
bswap esi
xor esi, 0xd1b9d8b6
jmp 0xb25623
inc edx
lea esi, [esi + edi*4 + 0x731f10cc]
inc bp
btr ebx, edi
dec eax
cwde
setae al
bswap esi
dec eax
ror edx, cl
inc esp
btr ecx, ebp
inc ebp
mov eax, ebp
neg esi
rol edi, cl
dec ecx
sar esp, cl
sete al
rol esi, 3
and di, dx
inc ecx
push eax
inc sp
imul eax, ecx
neg esi
inc esi
shr byte [esp + edx - 0x56d7ffc], 0x64
inc ax
not byte [esp + edx*2 - 0xadafffa]
dec eax
mov dword [esp + edx*2 - 0xadb0000], ebx
xor dword [esp + edx*2 - 0xadb0000], esi
pop ebx
inc ecx
inc ch
dec eax
arpl si, si
jns 0xa241ad
dec esp
add ecx, esi
cwde
inc ecx
movzx esi, sp
inc ecx
or cl, al
dec ebp
xor esp, ecx
inc ecx
jmp esp
dec ebp
adc ecx, esp
inc ebp
mov esp, ebx
inc ecx
inc ah
inc ecx
bts esp, eax
dec edi
mov edx, dword [edx + esi*4 + 0x19c6c]
dec esp
lea esi, [eax - 0x3e64725e]
jae 0xa8aee2
inc ecx
push ebx
inc ecx
pop esi
pop ecx
jb fcn.00a7cd20

Function at 0xbeafcc
Capabilities:
Execute syscall

Disassembly:
shr eax, 8
push 0xe19c3114
xor eax, ebx
call fcn.009c14fc
invalid

Function at 0xbec3e2
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xe491a811
mov dword [esp], ebx

Function at 0xbecf73
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + ebx*4]
call 0xc48edf

Function at 0xbed45c
Capabilities:
Encode data using base64

Disassembly:
adc dl, 0x1d
xor dl, 0xaf
jmp 0x9aceb9
mov dword [esp + eax - 0x46a153b3], eax
not edx
sub edx, 0xa108928d
btr ecx, eax
xor ebx, edx
bts ecx, ecx
mov dword [esp + eax - 0x46a153ab], 0xd99fef1e
adc esi, edx
mov dword [esp + eax - 0x46a153af], ecx
movzx edx, byte [eax + edi - 0x46a153b3]
cwde
ror eax, cl
or ax, 0xf1a2
lea edi, [edi + eax*4 - 0x29dbc687]
sar ax, 0xac
pop ecx
xor dl, bl
shr cl, 0x87
sal byte [esp + ecx - 0x46a15300], 0x41
add word [esp + eax - 0xa76fffd], ax
ror dl, cl
sub dl, 0x91
idiv al
not dl
shr cx, 0xe3
adc dl, al
bt ecx, ecx
pop ecx
dec dword [esp + eax - 0xa760001]
ror dl, 1
rol eax, cl
neg dl
add cx, cx
jb 0xb42a4b

Function at 0xbfbe98
Capabilities:
Encode data using base64

Disassembly:
neg al
xor bl, cl
lea ecx, [esp + ecx + 8]
mov dword [ecx], edx
sub ebp, 4
shl byte [esp + 7], 0xa6
call fcn.00afc06c
Function at 0xc07fad
Capabilities:
Encode data using base64

Disassembly:
movsx edx, cl
jns 0xbc65fe
mov edx, 0xed16ac9b
movsx ecx, dl
mov eax, dword [edi]
add edi, 4
imul edx, edx
xor eax, ebx
inc dx
xor cl, 7
inc eax
add cl, 0x2e
not eax
and ecx, 0x8a85263b
sal cl, 0xc5
shr dx, 0xa5
neg eax
movzx edx, byte [esi]
shr al, 0x47
xor dl, bl
inc ax
cwde
sar eax, 0xfb
xor dl, 0x37
or dword [esp + eax + 4], eax
movzx ecx, word [esp + eax*8 + 4]
sbb ax, cx
inc dl
xadd ax, cx
inc ecx
push ecx
neg dl
sar eax, cl
neg ax
dec eax
ror dl, 1
sar dword [esp + ecx*2 - 0x1dad0], cl
sbb dl, 0x1d
rol dword [esp + ecx - 0xed68], 4
adc eax, dword [esp + ecx - 0xed68]
mov dword [esp + eax*2 - 0x1d9a], 0x7830821c
xor bl, dl
lea edx, [esp + edx + 0xc]
rol dword [esp + eax*4 - 0x3b34], 0xbb
imul eax, eax
mov ecx, dword [edx + ecx*2 - 0x1dad0]
dec eax
mov dword [esp + eax - 0xdb4b60], eax
lea ebp, [ebp + eax*8 - 0x6da5b04]
mov dword [ebp + eax - 0xdb4b60], ecx
lea ecx, [eax*2 + 0x35bc192a]
sbb ax, ax
movzx edx, byte [esp + eax - 0xdafff8]
pop eax
pop edx
pop ecx
jno fcn.009570bc
mov eax, 0x291ba22a
cbw
cdq
lea edi, [eax + edi - 0x291b002e]
sal eax, 0x5a
jns 0xb0ccf9
mov eax, dword [edi + edx*4]
xor eax, ebx
shr edx, 0x1f
dec dx
rol dl, 0x45
xor eax, 0xa93a18bd
xor dx, 0x3a9e
adc eax, 0xb6020c90
or edx, 0x473abeb6
ror eax, 3
neg eax
movsx ecx, dl
xor ebx, eax
add esi, eax
movzx eax, dx
ror eax, 0x1f
bt ecx, edx
mov dx, word [edx + ebp - 0x473afff7]
mov cl, byte [ebp + eax - 0x1ffec]
inc eax
sbb eax, eax
not eax
lea ebp, [eax + ebp + 2]
shl dx, cl
movzx ecx, ax
xor ecx, eax
mov word [ebp + eax], dx
jno 0xb4750f
sub bh, byte [edi]
or dword [edx], ebp
nop
imul ecx, dword [edx + 0x204bfe0b], 0xfe0b8ad9
xchg ebx, eax
clc
add dword [edx - 0x1f9801f5], ecx
sbb dword [edx + 0x582ffe0b], ecx
mov eax, dword [0xfbfe0b8a]
push 0xfe0b8a91
xlatb
cmp cl, al
mov cl, byte [ebx]
invalid

Function at 0xc09c63
Capabilities:
Encode data using base64

Disassembly:
and cl, al
mov eax, dword [ebp + eax*4 - 0x3c5fec04]
dec ecx
not byte [esp + ecx - 0xf17fafd]
rol dword [esp + ecx*4 - 0x3c5fec00], 0x88
mov ecx, dword [ebp + ecx*2 - 0x1e2ff5fc]
mov edx, 0xde39173f
sbb dx, dx
sar dword [esp], 0x30
adc ebp, 3
add eax, ecx
bts edx, 0x14
bts edx, 0x8e
bts cx, ax
not edx
ror cl, 0x44
mov dword [esp + eax*2 - 0x1e2ff65e], eax
lea edx, [edx + ecx*2 - 0x6a836d94]
sar al, 0xe5
pop ecx
ror edx, 1
rol cl, 0xa6
push ecx
xor ebx, edx
add edi, edx
jmp 0x9c5d3f
Function at 0xc0a11d
Capabilities:
Encode data using base64

Disassembly:
sal eax, 0xe6
xor ecx, ecx
xor edx, 0x92947fbe
xor eax, 0x12d902
add eax, eax
neg ecx
xor ebx, edx
sub ecx, eax
shl ecx, cl
add edi, edx
push eax
mov ecx, dword [ebp + eax - 0x5f77f704]
lea eax, [eax + 0x1707e833]
mov edx, dword [ebp + eax - 0x767fdf33]
ror ax, 0xa
lea ebp, [eax + ebp - 0x767fcdf3]
btr eax, 0xbf
and eax, dword [esp + eax - 0x767fcdf7]
not ecx
jne 0xb4ef2e
mov eax, 0xbf851506
sub eax, eax
movzx edx, al
lea ebp, [ebp + eax*2 - 4]
movsx ecx, ax
or ecx, dword [ebp + eax]
xor ecx, ebx
inc al
xor edx, 0xff9e3d20
sbb ecx, eax
call fcn.00b98f7d
push 0xa504f1b1
add esi, 4
sal dword [esp], 0x72
xor eax, eax
test ecx, ecx
lea esp, [esp + 0xc]
je 0xc2f4fe
push esi
push 0x5a1e2caf
call fcn.00a5badd
ror ecx, 1
sub ecx, 0x12272004
rol al, 0x21
call fcn.00b91bba
inc cl
mov word [edx + ebp - 0x49], ax
lea eax, [ecx + ecx*8 + 0x4b1c07b9]
pop eax
sub al, dl
jle fcn.009fa672
mov dword [esp], 0x55335c1a
mov dword [esp], eax
call fcn.00b167c4
xor eax, edx
jle 0xbc781c
sub esi, 4
mov edx, dword [esi]
mov ecx, 0xa4a00f19
lea eax, [ecx + ecx*8 + 0x5693e61c]
xor edx, ebx
not ecx
div cl
or ax, cx
rol edx, 3
lea edx, [edx + eax*2 + 0x53a7738d]
or ax, ax
inc cx
lea eax, [eax + ecx + 0x3929c1a5]
xor edx, 0xa50bfeb3
inc edx
jmp 0x9ea354
mov ecx, 0xd81c951f
call fcn.00ac992b

Function at 0xc0aadb
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
inc ecx
ror dword [esp + 9], 0x87
jae 0xb9fa38

Function at 0xc0d52d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc edx
shr dword [esp + 0xa], 0x9c
xor ecx, 0xce25f08b
rol dword [esp + 0xc], 0x5c
dec eax
jmp 0xa50a86

Function at 0xc12679
Capabilities:
Parse pe header

Disassembly:
btr dx, 0x31
and edx, ecx
movsx eax, cl
lea esi, [esi + eax - 6]
shl edx, cl
imul dl
cwde
mov ecx, dword [edx + esi - 0x5eb90000]
xor ecx, ebx
lea ecx, [edx + ecx + 0x3d536438]
lea edx, [eax + eax*4 + 0x3876835]
push 0x7b8df7a9
lea esp, [esp + 0x10]
ja 0xc2d278
mov ecx, 0xb38b39b8
dec ecx
mov edx, esp
movzx eax, cx
lea ecx, [eax - 0x3963]
sub al, al
lea eax, [ebp + eax - 0x3980]
call fcn.00970bf9
mov eax, dword [esi]
mov edx, 0xd4b59489
mov ecx, dword [esi + 4]
or dl, 0x20
sbb edx, edx
lea esi, [esi + edx*2 + 4]
adc eax, ecx
mov dword [edx + esi], eax
mov ecx, 0x5f2bf310
xor edx, dword [edi + edx]
inc cl
lea edi, [edi + ecx - 0x5f2bf30d]
movzx eax, cx
cwde
sub ax, ax
xor edx, ebx
sub edx, 0xf2217089
neg edx
ror edx, 3
lea edx, [edx + ecx + 0xafb2b12]
not ecx
add ecx, 0x80a5f539
neg edx
dec ecx
btc ecx, eax
xor ebx, edx
neg ecx
jns 0xb3f83f
add ebp, edx
bt ecx, ecx
cdq
and cx, 0xdeb3
jmp ebp
Function at 0xc2302a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x98842a
bswap eax
dec word [esp + 0xd]
inc eax
jmp 0xbe7804

Function at 0xc29ae9
Capabilities:
Encode data using xor

Disassembly:
bswap ecx
lea ecx, [ecx + edx*2 + 0x135ed3c4]
sal ax, 3
xor ebx, ecx
shr edx, 0xb5
push edx
inc ax
adc esi, ecx
bts edx, eax
shr eax, 0x65
cmovnp dx, word [esp + edx*2 - 0x40314]
mov dx, word [ebp + edx - 0x2018b]
bt eax, eax
movzx ecx, al
sub eax, 0xc4acdd2f
mov cl, byte [eax + ebp - 0x42136109]
setne byte [esp + eax - 0x4213610b]
dec eax
shr dx, cl
mov word [ebp + eax - 0x42136108], dx
shr dword [esp + eax - 0x4213610a], 4
imul dword [esp + eax - 0x4213610a]
movzx ecx, word [edi + eax - 0x2136109c]
not dword [esp + eax - 0x213610a0]
sar dword [esp + eax*2 - 0x426c2140], 0x10
lea edi, [eax + edi - 0x2136109a]
push eax
push edx
sar dx, 0x41
xor cx, bx
bts edx, edx
ror cx, 1
cdq
add cx, 0x1a86
sal dword [esp + eax - 0x2136109a], 0x21
shl ax, 0x44
rol cx, 1
bts dx, dx
neg cx
mov dword [esp + eax - 0x21360a00], edx
imul eax, dword [esp + eax - 0x213609f8]
rol dx, 1
xor bx, cx
pop eax
shl dx, 0x65
mov word [eax + ebp - 1], cx
mov dword [esp + edx*4 - 0x100], esi
ret 4
push ebx
mov dword [esp], 0x5292d67f
call fcn.00a1d3d1
add ebp, 1
bts dx, dx
xor al, bl
rol dx, 0x6d
xor edx, edx
neg al
and dl, dl
ror al, 1
sub al, 0x86
and dx, dx
shl dx, 0x8d
rol dl, 0x44
rol al, 1
call fcn.00b47576
jns 0xb0aea1
in eax, 0x67
and eax, 0x6d24af73
jge 0xb0ae4e
jae 0xb0adfe
scasd eax, dword es:[edi]
and al, 0x55
inc ecx
sub dword [ebx - 0x51], esi
and al, 9
adc ebp, edi
clc
insb byte es:[edi], dx
and al, 0x89
out dx, al
jae 0xb0ae87
fadd dword [esi + 0x3c57060c]
adc dh, byte [ebx + 0x77]
push cs
and edi, dword [edx + edx]
jae 0xb0ae8e
push edx
push es
adc ebx, esi
rol byte [ebx + 0xce6886d], 0xc2
mov ecx, dword [edi]
mov edx, 0x2a066e31
bswap edx
xor ecx, ebx
dec ecx
movsx eax, dl
add eax, 0x3394bbbc
adc ax, dx
xor ecx, 0x91800019
or al, al
lea eax, [eax + edx*8 + 0x1902c58a]
xor esp, dword [esi + 0x13]
ret 0xf181
sbb ecx, 0x672ca592
jmp 0x95e98e
push 0x7a2bdf1a
neg dword [esp + 8]
rol eax, 1
ror dword [esp], 0x1f
bswap eax
jae 0xaf8f6e
mov dword [esp + 4], 0x1d87291d
sbb eax, 0xca178abc
rol dword [esp + 2], 0x9d
push 0x140a9990
xor eax, 0x8609f0b9
neg dword [esp]
not byte [esp + 1]
ror word [esp + 2], 0x4a
xor ebx, eax
add esi, eax
lea esp, [esp + 0x10]
jmp 0xb0ae09
Function at 0xc2e547
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [ebx*4 + 0xa80af4]
add dword [esp], 0x52aad16
jle 0xa9ee59
shr ecx, 8
xor ecx, ebx
call fcn.00ac3291
lea esp, [esp + 0x10]
jne 0xbec3ee
pop ebx
not ecx
mov eax, 0x7d109f02
mov dword [eax + ebp - 0x7d109f02], ecx
lea edx, [eax*2 - 0xef81af7]
lea eax, [eax + edx*2 + 0x33b00880]
jmp esi
neg dword [esp + 0xc]
ror edx, 1
neg edx
ror word [esp + 0xc], 8
neg byte [esp]
call fcn.00a8eed3
sbb esi, 3
xor cl, 0x19
push ecx
ror word [esp + 1], 0x47
mov edx, dword [esi]
btc ecx, 0x99
xor edx, ebx
inc byte [esp]
rol edx, 1
add edx, 0x192c54b7
movzx eax, word [esp]
not byte [esp + eax - 0x78be]
rol byte [esp + eax - 0x78c0], 0x23
xor edx, 0x5b800b10
btc eax, ecx
call fcn.00ba8210
mov dword [esp], 0xa7345130
rol edx, 1
push 0x7f8aefab
push 0xcda7583c
shl dword [esp + 0xc], 0xf7
xor edx, 0x6d16631d
shl byte [esp + 3], 0x41
jle 0x9de8c3
not word [esp + 0xe]
jmp 0x9b6da8
ja 0x9a1284
mov ebx, 0x6f901fbd
neg ebx
not bl
movzx ebx, byte [edx]
jbe 0xc0c604
in eax, dx
jnp 0xbec47b
sub dl, bh
into
jne 0xbec408
add al, 0x7f
xchg dh, cl
jne 0xbec40e
cwde
test dword [esi], 0x74fe75ce
dec dword [edx + 0x3dbe05cb]
cmp dl, byte [esi]
lcall 0xa2d8, 0xfe6a766c
clc
stc
add byte [ecx], dh
dec edx
invalid
xchg edx, eax
pushal
hlt
push 0xa28c8034
seta byte [esp + 2]
xor ebx, ecx
ror dword [esp], 0xdc
and ebx, 0xff
sal word [esp + 1], 1
push 0x9db24d36
jge 0x99e28a
invalid
inc edx
xadd cl, ah
sbb dword [esp + eax*2 - 0x4000d75c], ecx
bswap edx
adc eax, dword [esp + eax*2 - 0x4000d75a]
call fcn.00add45e
xor edx, ebx
jmp 0xa50a5c
mov dword [esp + ecx - 0x6927d013], 0x203f9daf
lea ebp, [ebp + ecx - 0x6927d011]
sal dl, 0x86
and word [esp + ecx - 0x6927d012], 0x4322
bt dx, dx
mov word [edx + ebp - 0x6927d0c0], ax
mov edx, dword [esi + edx - 0x6927d0c0]
lea esi, [esi + ecx - 0x6927d00f]
bts cx, cx
push ecx
and byte [esp + ecx - 0x6927d015], ch
xor edx, ebx
neg cl
mov eax, dword [esp + ecx - 0x6927d0e1]
xor edx, 0x7a31aa05
xor ecx, 0x8e1b838e
neg edx
jmp 0xc1157e

Function at 0xc2e843
Capabilities:
Encode data using base64

Disassembly:
movzx eax, byte [esi + eax - 0x72858006]
lea esi, [edx + esi - 0x7aaa9f90]
sub word [esp + edx - 0x7aaa9f8a], dx
call fcn.00955b57
retf 0xea94
movzx ax, byte [ecx + edx - 0x228e4ded]
sbb cl, cl
movsx edx, cx
mov word [ebp + ecx*2 - 0x451c9c00], ax
movzx eax, cx
mov ecx, dword [esi + ecx*2 - 0x451c9c03]
setle dl
xor eax, dword [esp + edx*8 - 0x26804]
xchg dx, ax
xor ecx, ebx
xor ecx, 0xd5aa6c87
shl eax, 0xe3
ror ecx, 3
neg ecx
lea edx, [eax + eax*8 - 0x77740a53]
xor ecx, 0x89bd6b3d
xor dl, 0x17
mov dword [esp + edx - 0xaf19de2], 0xb6a96929
neg ecx
add edx, dword [esp + edx*2 - 0x15e33bc1]
lea ecx, [ecx + edx*2 - 0x566b60f4]
ror ecx, 1
lea ecx, [edx + ecx - 0x109a0c67]
ror dl, 0x64
neg eax
sar dword [esp + 1], 0xf5
rol ecx, 2
lea ecx, [ecx + eax - 0x397613ef]
not al
not dl
xor ecx, 0x9d0a552c
neg edx
sbb eax, 0x29a81c0e
shl ax, 0x2c
xor ebx, ecx
bt edx, edx
and word [esp + eax - 0x72858000], 0xb9b7
or dx, dx
adc edi, ecx
neg byte [esp + eax - 0x72857ffa]
jno 0xbf67d5