joyce8/EMBER2024-capa huggingface dataset:
Function at 0xda12e6
Capabilities:
Encode data using xor

Disassembly:
xadd word [esp + 5], ax
inc al
mov word [edx], cx
add eax, eax
pop ecx
pop eax
pop eax
jmp esi
mov dword [esp + eax - 0x1fffe00], eax
adc dl, 0x11
dec eax
setne al
rol dl, 1
add al, ah
neg dword [esp + eax - 0x1fffdfe]
jo 0x97a7e5
adc dl, 0x94
sub word [esp + eax*8 - 0xfffeff0], ax
not ax
xor dl, 0xb7
push eax
push eax
and eax, dword [esp + eax*8 - 0xff81000]
xor bl, dl
dec eax
cbw
lea edx, [esp + edx + 0xc]
jp 0x8d4c62
push ecx
dec esp
lea edx, [ebp*8 - 0x4d6e095b]
dec eax
xor edi, esi
movsx edx, byte [esp + 7]
dec eax
xor edi, 0x8d29a4b0
dec eax
inc edi
inc esp
xchg ch, ah
inc ebp
mov esi, edx
sub dword [esp + edx + 9], 0x29b6128b
dec eax
bswap edi
dec eax
inc edi
shl word [esp + edx + 0xd], cl
dec eax
bswap edi
dec eax
xor esi, edi
dec eax
shr dword [esp + edx*8 + 2], cl
inc sp
xadd edx, ebp
dec eax
not dword [esp + edx - 0xeeb3]
dec eax
mov dword [ebx + edx*2 - 0x1dd82], edi
dec eax
lea edi, [edx + 0x27688e]
dec eax
adc dword [esp + edx*2 - 0x1dd71], 0x78b97e1d
inc ebp
mov ecx, dword [edi + edx*2 - 0x1dd6e]
inc ecx
adc dh, 0xab
jnp 0xe08e31
inc ecx
movzx ecx, byte [edi]
mov edx, 0xf8966113
movsx edi, dl
movsx ebp, dl
dec esi
lea edi, [ebp + edi - 0x12]
inc eax
shr bh, 0x66
inc esp
movsx ebp, bh
movzx eax, di
inc eax
xor cl, dh
inc esp
movsx esp, ch
inc esp
movsx esi, bh
neg cl
push edx
inc ecx
sar dh, 0xc3
adc cl, 0xb9
inc cx
sal esp, 0xe2
dec eax
adc dword [esp + ebp - 0x13], edi
setae byte [esp + edi*2]
rol cl, 1
push edi
add cl, 0x23
not dword [esp + ebp - 0xa]
inc eax
xor dh, cl
inc ecx
rol ah, 0x26
dec eax
lea ecx, [esp + ecx + 0x10]
inc esp
mov eax, dword [ecx + edi*4]
dec eax
lea ebx, [ebx + edi - 4]
call fcn.009ce75d
jmp 0x999aa2
inc esp
xor ecx, esi
inc esp
add dl, byte [esp + edx - 0xeeb2]
inc ecx
dec ecx
inc cx
sal esp, 0xaf
add cx, word [esp + edx*2 - 0x1dd74]
xor dx, word [esp + edx - 0xeeba]
inc ecx
bswap ecx
inc di
dec eax
sub dword [esp + edx*2 - 0x1bcf8], edx
inc ecx
push esi
inc ecx
ror ecx, 2
inc ecx
mov eax, esp
shr word [esp + edx*2 - 0x1bcea], 0x2c
inc ecx
dec ah
inc ecx
not ecx
dec esp
mov dword [esp + edi*2 - 0x50ae88], ebp
rol cx, 0xa1
inc ebp
mov eax, esp
dec eax
mov dword [esp + edx*4 - 0x379f0], esi
inc esp
xor dword [esp + edx - 0xde70], ecx
push eax
not edx
dec eax
mov esi, dword [esp + edi*2 - 0x50ae7c]
push ecx
dec ecx
neg esi
dec eax
bt ebp, 0xb2
dec ebp
arpl cx, cx
inc esp
add byte [esp + edi - 0x285731], al
dec ebp
add ebx, ecx
dec edx
mov edx, dword [edi + edi - 0x28573e]
dec ebp
lea edi, [edi + edi*4 - 0xa15d14]
mov word [esp + edi*4 - 0xa15d0e], ax
dec eax
xor edx, esi
dec eax
not edx
dec eax
inc edx
dec esp
btc eax, esi
inc ecx
pop esi
dec eax
ror edx, 1
push edi
dec eax
lea edx, [edi + edx - 0x7fbc415b]
dec eax
neg edx
dec eax
inc edx
inc ebp
movsx ecx, al
dec eax
xor esi, edx
dec eax
mov dword [esp + edi - 0x28572a], 0xbb8a2236
dec eax
inc eax
dec eax
mov dword [ebx + edi*8 - 0x142ba64], edx
dec eax
lea ebx, [ebx + edi - 0x28575e]
dec eax
ror dword [esp + eax - 0x2e3e0000], cl
inc ecx
pop esi
inc ecx
pop esp
inc ecx
pop esi
inc ecx
pop eax
pop edx
jne fcn.00a14fd9
Function at 0xdad1d5
Capabilities:
Encode data using xor

Disassembly:
rcr edx, cl
mov dword [esp + eax - 0x25ac000d], 0x9da9efbe
call fcn.00a5c924
syscall
call fcn.00dd1d84

Function at 0xdaeb9b
Capabilities:
Encode data using base64

Disassembly:
call fcn.009b8751
mov ecx, 0xd2a1fd87
sub edi, 4
movsx eax, cl
mov edx, dword [edi]
btc ecx, ecx
sar al, 0x61
sal ax, 0xa
xor edx, ebx
bswap ecx
push ecx
push eax
lea edx, [edx + ecx*2 - 0x4eaeac50]
pop ecx
xor edx, 0xe69b54ae
bswap edx
push ecx
shl eax, 0x44
btr ecx, ecx
dec edx
cwde
xor ebx, edx
inc cl
add esi, edx
shl eax, cl
mov ebp, dword [ebp]
cmovg ecx, dword [esp]
sbb ax, cx
push eax
pop edx
pop edx
pop ecx
jne fcn.0094787b
mov eax, 0x723e5d22
mov edx, dword [eax + ebp - 0x723e5d22]
lea ebp, [eax + ebp - 0x723e5d1e]
btc ax, ax
push edx
movsx edx, ax
lea ecx, [edx + edx - 0x75c7e260]
sal edx, 0x97
popfd
shl cx, cl
neg cx
btr cx, cx
mov eax, dword [edi + eax - 0x723e5d26]
adc edi, 4
sub dx, dx
sal dx, 0xea
or dx, dx
xor eax, ebx
and ecx, 0xe581b3a1
bswap eax
xor ecx, ecx
sete cl
sub edx, ecx
sbb eax, 0x9ca1308a
bts edx, ecx
sbb edx, edx
bswap eax
add eax, edx
shl dl, 0xc2
xor ebx, eax
rol dx, cl
add dl, dh
xadd cx, dx
adc esi, eax
rol ecx, 0x9f
btc edx, edx
movzx eax, dx
jmp esi
jae 0x947021
test ebx, ebx
lea esp, [esp + 8]
je 0x9b8761
mov eax, 0x5fbc892a
not ax
mov eax, dword [ebp + ebx*4]
push eax
jmp 0x8978d2
inc ecx
mov esi, 0x83b144bf
inc esp
mov edx, dword [ebx + edi*8 - 0x1087f1ec]
dec eax
lea ebx, [ebx + edi - 0x210fe3a]
inc ebp
xchg cl, dh
inc eax
movzx edx, bh
dec ecx
bswap esi
inc ebp
or eax, edx
mov eax, edi
inc ecx
not eax
inc sp
xor esi, edi
inc ecx
ror dh, 0x62
dec esp
btc edx, ecx
inc esp
mov dword [ebx + edi - 0x210fe3e], eax
inc ebp
mov edx, dword [edi + edi*4 - 0x843f8f8]
dec ebp
lea edi, [edi + edi - 0x210fe3a]
dec edx
lea ecx, [edx + ecx*2 - 0x627f3161]
inc esp
xor edx, esi
inc edi
lea edx, [edx - 0x1b4076df]
jmp 0x9ad816
jmp 0x9c02dd
inc ecx
ror dh, 0x81
inc ecx
ror edx, 3
inc ecx
xadd ah, dl
inc cx
sar esi, 0x87
inc esp
movsx eax, di
inc ecx
not edx
dec eax
dec eax
lea ebp, [edi*8 - 0x4f5128c1]
dec esp
lea esp, [ebp + edx*2 - 0x3c5385f7]
inc ecx
dec edx
inc ecx
ror edx, 1
push esi
inc esp
xor dword [esp + edi*2 - 0x421fc7c], edx
dec eax
inc ecx
dec eax
bswap ecx
inc cx
btr eax, edi
pop esi
inc al
dec ebp
arpl dx, dx
jnp 0xdb298c
jmp 0x9f2fc4
call fcn.00a0f6dd
mov eax, dword [ebp]
jmp 0x8d5d4f
ror word [esp], 0x83
jae 0xde9bd3
mov edx, 0xfcaddea4
lea eax, [edx + edx*2 - 0x32657d73]
movzx ecx, byte [edi - 1]
xor al, dl
xor cl, bl
not cl
call fcn.00de09e6
dec edx
mov edx, ebx
shl edx, 2
mov dword [esp], eax
mov eax, ebp
jmp 0xd7a20d
inc ecx
rol al, 0xa2
dec ebp
adc ebx, edx
inc ecx
jmp ebx
adc eax, edx
push 0x851d76af
shl byte [esp], 0x83
mov dword [ebp - 4], eax
jne 0x8998fb
mov edi, 0x843f8f8a
inc esp
movsx esp, bh
inc ebp
movzx ecx, ah
inc esi
mov eax, dword [ebx + ecx*4 - 0x228]
shr edi, 0x86
jns 0x8becbc
int 0x7d
dec edi
sub al, 0xf9
arpl word [ecx + 0x33], di
Function at 0xdaf988
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov ecx, dword [esp + 0x10]
pop ecx
dec eax
mov ebx, dword [esp + 0x10]
call fcn.0093f248
jmp 0x8d2bfa
inc ecx
pop esp
dec esp
mov eax, dword [esp + 8]
jmp 0xa31679

Function at 0xdb2e1f
Capabilities:
Encode data using base64

Disassembly:
mov word [esp + 8], 0x163d
dec eax
mov dword [esp], 0x6a185534
inc esi
mov ebx, dword [ebx + ebx*4]
inc ecx
shr edx, 8
inc ebp
xor edx, ebx
dec eax
inc edi
shl dword [esp + 9], 0x88
push 0xb5a60322
adc dword [esp + 0xe], 0x95249caa
inc ecx
xor edx, 0x649bf28c
dec eax
shr dword [esp + 0xe], 0xb8
dec eax
dec edx
call fcn.00980d95
movzx ax, byte [ebp]
mov edx, 0xdf8652ac
bt dx, dx
movzx ecx, dl
mov cl, byte [ebp + ecx - 0xaa]
sbb edx, edx
dec dl
dec edx
adc ebp, 1
neg edx
xor dx, dx
call fcn.00de947e
jmp 0xdf60cb

Function at 0xdbaec0
Capabilities:
Encode data using base64

Disassembly:
adc ax, 0x30a1
not eax
mov eax, dword [ebp + 4]
rol ecx, cl
add ecx, dword [esp + ecx - 0x56bffff0]
not edx
dec cx
xor ecx, ecx
not eax
sub ecx, 0x56ba82bc
and edx, eax
shl cx, 0xe
neg dword [esp]
shr dword [esp], 0xf6
mov dword [ebp + 4], edx
lea ecx, [ecx + 0x4618822b]
xor dword [esp], 0xf9000e33
mov eax, dword [ebp + 4]
movzx edx, byte [edi - 5]
sal cl, 0xa6
sbb word [esp + 1], cx
shl byte [esp + 1], 0x45
xor dl, bl
ror dl, 1
pop ecx
btr ecx, 0x9e
dec dl
rol dl, 1
inc dl
neg dl
jmp 0xdc2f70
neg ecx
mov dword [esp + edx - 0x6868], eax
dec ecx
pop edx
sar ax, 0xa2
add word [esp + 2], ax
rol ecx, 1
add eax, dword [esp]
movsx edx, ax
xor ecx, 0x2432c91b
xor ebx, ecx
add ax, 0x4f82
sub dl, ah
sal eax, 0xe7
add esi, ecx
movsx ecx, dx
or dword [esp + eax - 0x4be90480], ecx
mov edx, dword [ebp + eax - 0x4be90480]
jl 0x993777
xor ecx, ecx
not cx
xor bl, dl
ror cx, 0x41
adc ecx, ecx
adc edx, esp
mov dword [edx + ecx*2 - 0x3fffe], eax
movsx edx, cl
sub cl, cl
movzx eax, word [ecx + edi - 0x1ff07]
bts ecx, ecx
btc cx, dx
btr cx, dx
lea edi, [ecx + edi - 0x17f08]
push ecx
xor ax, bx
neg ax
pop edx
rol edx, cl
bswap ecx
inc ax
and cl, dh
and cl, 0x15
sub dx, cx
ror ax, 1
shl dx, 0x6a
sal edx, 0xee
adc ax, 0xd418
sar ecx, 7
push ecx
xor ax, 0x3294
sar dl, cl
xadd dword [esp + ecx*2 - 0x5fc04], edx
call fcn.00dfec2d

Function at 0xdbbc19
Capabilities:
Encode data using base64

Disassembly:
inc ecx
ror edx, 1
inc ebp
lea edx, [edx + edi + 0x12950b7e]
sar di, 0xa1
pop ecx
cbw
inc ecx
not edx
dec ecx
sar esi, 0x3b
sar edx, 0x14
dec edx
mov dword [esp + esi*2], esi
dec ecx
sar ecx, 0x10
inc sp
sub eax, edi
inc ecx
dec eax
inc esi
xor dword [esp + ecx - 0xaf8d], edx
movsx ebp, al
dec eax
sal eax, 0x63
inc ecx
movzx esi, al
pop esi
call fcn.00a47419
mov edx, 0xb58d6d3a
movsx ecx, dx
mov cx, word [ebp + ecx - 0x6d3a]
movzx eax, dx
not edx
lea ebp, [edx + ebp - 0x4a7292c3]
sar dl, 0x81
jle 0xa5f785
mov dx, word [ebp]
mov eax, 0x32231205
mov ax, word [ebp + eax - 0x32231203]
mov ecx, 0xec852436
mov cl, byte [ebp + 4]
call fcn.00dea271
Function at 0xdbdbcb
Capabilities:
Encode data using base64

Disassembly:
dec eax
cwde
inc edi
add ecx, dword [ecx + edi]
pop ecx
inc edx
ror dword [esp + eax*4 + 3], 0xdd
dec edi
lea edi, [edi + eax*2 + 4]
dec ecx
sal esp, 0x15
inc edx
movzx ebp, byte [esp + eax]
inc esp
xor ecx, esi
inc ebp
movzx edx, sp
inc cx
sar edx, 0xea
inc esi
mov dword [esp + eax + 1], ebp
inc ecx
sbb ecx, 0xfb061986
inc ecx
xor ecx, 0xca8778b3
inc eax
inc edx
ror dword [esp + eax*2 + 3], 0x21
inc ebp
adc ecx, eax
inc ecx
ror ecx, 2
inc esi
sub al, byte [esp + eax + 6]
inc edi
lea ecx, [ecx + eax*2 - 0x1dbbb3aa]
inc dx
sal dword [esp + eax - 1], 0xe1
inc ecx
ror ecx, 1
movsx edx, al
dec edx
mov dword [esp + eax*4 - 4], esi
inc ecx
push esp
rol dword [esp + eax - 0x1801087b], 0xcf
inc sp
xchg edx, ebp
inc esi
xor dword [esp + eax*4 + 4], ecx
inc ecx
pop edx
inc ecx
movsx edi, dl
inc ecx
sal ebp, 0xc9
pop esi
Function at 0xdbf21c
Capabilities:
Encode data using base64

Disassembly:
and al, al
rol dl, 1
shr cx, 0x62
jb 0xa40abc
cbw
adc dl, 0x25
bts eax, eax
shl eax, 0xe6
shl byte [esp + eax - 0x3a], cl
ror dl, 1
xor bl, dl
xchg ecx, eax
lea edx, [esp + edx + 8]
mov ecx, dword [edx + eax*2 - 0x44]
lea edx, [eax - 0x33c4b2ff]
mov dword [eax + ebp - 0x26], ecx
neg byte [esp + eax - 0x20]
lea ecx, [eax + eax*2 + 0x41822e09]
js 0x9c853b
lea ebp, [eax + ebp - 0x26]
pop ecx
pop ecx
jbe fcn.00a28822
call fcn.008a7320
adc edi, 3
sal eax, cl
adc al, al
xor edx, ebx
neg ecx
rol eax, cl
shr ecx, cl
neg edx
neg ecx
shr al, 0x83
neg edx
dec dx
bswap ecx
xchg ah, al
inc dx
ror eax, 5
xor ebx, ecx
add esi, ecx
sub eax, eax
movzx edx, byte [edi + eax - 5]
adc eax, eax
neg word [esp + eax*8 + 6]
lea edi, [edi + eax*2 - 5]
xor dl, bl
movsx ecx, byte [esp + eax + 4]
neg ecx
btc eax, ecx
adc dl, 0x20
mov byte [esp + eax*2 - 0x1ffd], cl
dec cl
rol dl, 1
xchg byte [esp + eax*4 - 0x4000], cl
add dl, 0xac
and ecx, dword [esp + eax*8 - 0x7ffe]
jne 0x8c89a2
rol ecx, 0x17
lea edi, [edi + ecx*2 - 0x800006]
sal cx, 0xaa
sbb eax, eax
xor dl, bl
xor ax, ax
dec dl
shr eax, 0xa7
neg cx
sub cx, cx
ror dl, 1
bt cx, 0x18
inc ecx
sbb dl, 0x11
not dl
xor bl, dl
lea eax, [eax + eax*4 - 0x73de31ec]
cwde
sub ax, 0x8e38
adc edx, esp
and eax, eax
movzx ax, byte [edx + ecx - 0x400001]
movsx edx, cl
dec edx
add ecx, edx
mov word [ebp + ecx*2 - 0x800000], ax
lea ebp, [ebp + ecx*4 - 0x1000002]
push edx
movsx eax, cx
and al, ah
adc dword [esp + ecx - 0x400001], esi
ret
xor ecx, ebx
pop edx
pop eax
bswap ecx
mov eax, 0x29ae9c18
rol ecx, 3
movzx edx, byte [esp + eax - 0x29ae9c14]
mov dword [esp + eax*2 - 0x535d3830], 0x819a4ca8
not ecx
shl edx, 0xc6
lea ecx, [ecx + eax*2 - 0x6b1a743b]
xadd dx, ax
jle 0xdaaefe
lea edi, [edi + ecx*4 - 4]
push eax
lea edx, [eax + ecx*2 - 0x106498d5]
or ecx, dword [edi + ecx]
xor ecx, ebx
ror ecx, 1
shr edx, 0x71
sal ax, 0xed
mov dword [esp + edx*8 - 0x3be68], eax
inc ecx
xor ecx, 0xba3ca189
inc ax
not dl
sub ecx, eax
not dl
xchg dword [esp + eax + 1], eax
neg ecx
add dx, word [esp + eax*4 + 3]
dec ecx
ror dx, 0x4d
rol ecx, 1
xor ecx, 0x2432c91b
xor ebx, ecx
add esi, ecx
rol edx, 0x6a
mov dword [esp + eax*8], esi
ret 4

Function at 0xdbf9f6
Capabilities:
Encode data using base64

Disassembly:
rol cl, 1
xor bl, cl
push eax
pop edx
lea ecx, [esp + ecx + 0x18]
shr edx, 1
inc dl
mov al, byte [ecx + edx*4 - 0xc]
lea ecx, [edx + edx - 0x7ae58ce1]
xor ecx, 0x5398dfa8
mov word [edx + ebp - 1], ax
lea ebp, [edx + ebp - 1]
call fcn.00a027d6

Function at 0xdc2f56
Capabilities:
Encode data using base64

Disassembly:
push edx
xor ebx, eax
add esi, eax
shr dword [esp + edx - 0x3effffed], cl
pop eax
pop eax
pop eax
pop edx
pop eax
pop ecx
pop ecx
pop edx
jns fcn.00a28822
Function at 0xdcbb77
Capabilities:
Encode data using base64

Disassembly:
and edx, edx
mov dword [eax], ecx
or edx, edx
mov eax, dword [esp + 2]
mov edx, dword [eax + edi - 0x72b594dd]
sbb al, 0x92
sar eax, 0x2b
xor word [esp + eax - 0xe56b1], ax
lea edi, [eax + edi - 0xe56ad]
xor edx, ebx
xor byte [esp + eax*2 - 0x1cad5e], al
bswap edx
bts eax, eax
ror ax, 0x27
xor edx, 0x549af09a
pop eax
movzx ecx, al
cwde
rol edx, 3
sal eax, cl
lea edx, [ecx + edx - 0x2721c20c]
bts ecx, eax
xor ebx, edx
add esi, edx
not eax
movsx edx, byte [esp + ecx - 0x67]
mov dword [esp + ecx - 0x67], esi
ret
mov ecx, dword [edx + ebp - 0x361]
mov dword [esp + edx - 0x365], 0x4e2f07bc
and dword [esp + edx*2 - 0x6c9], edx
lea ebp, [ebp + edx*8 - 0x1b20]
lea eax, [edx*2 - 0x1d47f652]
add dword [esp + edx*8 - 0x1b27], 0x74a0ca24
adc byte [esp + edx - 0x35f], 0x8a
movzx eax, byte [edx + edi - 0x365]
sbb dl, dl
sub byte [esp + edx*2 - 0x5fa], 0x17
rol dword [esp + edx*2 - 0x600], 0xcf
xor al, bl
ror al, 1
add al, 0x1e
lea edx, [edx + 0x52bfa49f]
rol al, 1
dec al
bswap edx
shr dx, 0xa8
sub dword [esp + 4], edx
not al
xadd dl, dh
btr dx, dx
sbb byte [esp + 6], dl
xor bl, al
lea eax, [esp + eax + 8]
dec dx
jge 0x9bfb92

Function at 0xdccb6a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
not ecx
ror ax, 0x42
add dl, ah
dec ecx
xor ebx, ecx
lea ebp, [ebp + eax*4 - 0xc]
mov dword [esp + edx - 0x55a00001], eax
xchg dh, al
mov dword [ebp + eax*2], ecx
add dx, ax
pop ecx
pop eax
pop eax
jae fcn.0094787b
bt dx, dx
inc eax
not eax
or dx, 0x7d8f
rol edx, 0x8b
xadd dword [esp + edx*4 - 0x4fb1e040], edx
neg eax
movzx ecx, dl
shl ecx, cl
sub dword [esp + ecx - 0x2a800], ecx
lea eax, [eax + ecx*2 - 0x5ab941ad]
sub dl, dl
ror eax, 3
ror word [esp + ecx - 0x2a7ff], 0x42
xor ebx, eax
dec byte [esp + ecx*8 - 0x153ffe]
add esi, eax
rdtsc
and dword [esp + ecx*2 - 0x55000], 0x5c930c8d
sar ecx, 0xbe
xchg word [esp + ecx + 1], cx
lea ebp, [ebp + ecx - 0x214]
adc word [esp + ecx*4 - 0x82f], cx
not cx
and cl, byte [esp + ecx - 0xfdf2]
mov dword [ebp + ecx*4 - 0x3f3fc], eax
mov dword [ecx + ebp - 0xfd00], edx
lea eax, [ecx + ecx*2 - 0x4f2d4cf]
movzx edx, al
dec cx
pop ecx
jno fcn.0094787b
Function at 0xdcd77c
Capabilities:
Execute syscall

Disassembly:
neg edx
ror dword [esp + 4], 0xc3
jae 0x994a26
rol edx, 2
mov dword [esp], 0xb59d6c03
sub dword [esp + 4], 0x99a73622
sar dword [esp + 3], 0x3d
inc edx
ror edx, 2
call fcn.008c6fac
or dword [esi - 0x2a], ebx
cwde
test dword [ebx - 0x10], esp
jle 0xdcd7dc
add eax, 0x297eb08b
arpl word [si], bx
call 0x1444013f
aas
mov al, 0x7e
sub dword [edi + 0x63], esp
sbb al, 0xe8
jle 0xdcd7e8
adc edi, dword [bx]
les edi, [esi + 0x29]
or eax, 0xdcbf02c7
jg 0xdcd7a2
retf
jno 0xdcd7e4
imul esp, dword [edx], 0xed591040
push 0x7ef07ee9
inc ecx
jle 0xdcd82b
in eax, dx
push 0xebd296e9
and eax, dword [ebx]
cmp ebp, ebx
dec esp
pop ds
xor dword [ebx], edx
add byte [esi + 0x347e0b7], dh
jo 0xdcd7b6
mov bh, 0xe0
mov eax, dword [0xb7b620ab]
loopne 0xdcd7f2
jecxz 0xdcd883
mov dh, 0xb7
loopne 0xdcd818
aaa
fidiv dword [edi + 0x42]
clc
add dword [ebx], ebx
jno 0xdcd823
mov al, byte [0xf01d5f9c]
add al, 0xe5
lodsb al, byte [esi]
cmp eax, 0x70b6e2a4
mov dh, 0x70
loop 0xdcd7bd
adc eax, 0xec96c567
in al, dx
mov word [esi], ss
mov cl, 0xe
dec edi
invalid
lahf
invalid

Function at 0xdd90a6
Capabilities:
Encode data using base64

Disassembly:
call fcn.00e141e0
mov esi, 0xa3796349
adc eax, 0x432adcff
adc eax, 0xf3920cff
adc eax, 0xaba9ecff
sub al, 0xd
xchg esp, eax
sti
les esi, [eax - 0x490b213e]
push ebp
jo 0xa3560b
xchg edi, eax
jmp [eax + 0x26]
ljmp 0x4098:0xe4438b43
movzx ecx, byte [edx + edi - 0x7ff]
mov dword [esp + edx*2 - 0xffe], 0x71028609
xor cl, bl
neg cl
bts dx, 0x3f
dec ax
sbb cl, dl
neg cl
xor ax, 0xfd84
not eax
jb 0xa355c8
sbb cl, dl
xor bl, cl
btr dx, dx
pop edx
lea ebp, [ebp + eax - 0x7d89]
cwde
inc edx
mov dword [ebp + eax*2 - 0xfb0a], ecx
mov ecx, eax
dec edx
jno fcn.0094787b

Function at 0xdd910b
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x14]
jne 0xa043b4
mov ecx, 0xd0371cbb
movsx edi, cx
sal ecx, cl
pop edi
jmp 0xa0eb41

Function at 0xdd91c8
Capabilities:
Encode data using base64

Disassembly:
xadd byte [esp + ecx - 0x658787f9], dh
movzx dx, byte [ecx + ebp - 0x65878801]
ror ecx, 0x88
movzx eax, word [esp + 2]
ror dword [esp + eax - 0xfffb], 0xee
mov cl, byte [ebp + eax*8 - 0x7fff8]
xor dl, al
pop eax
cbw
not cl
btr eax, eax
or dl, cl
lea ecx, [eax*2 - 0x7240c776]
shr ecx, cl
add ecx, ecx
mov word [ecx + ebp - 0x11b7a6], dx
pop eax
lea edx, [esp + ecx - 0x11b77e]
neg eax
sub cx, 0x18ad
bts ecx, eax
movzx ax, byte [eax + edx - 0x33f41]
sal cx, 0xc1
mov word [ebp + ecx*4 - 0x44f7da], ax
lea ebp, [ebp + ecx*4 - 0x44f7da]
jb fcn.00a28822
lea eax, [eax + edx*2 + 0x6519e638]
bt ecx, 0xab
not edx
xchg cl, dl
rol eax, 1
ror edx, cl
inc eax
mov dword [esp + ecx*2 - 0x101fe], edx
sar dword [esp + ecx - 0x80fd], cl
rol eax, 1
inc eax
xor ebx, eax
lea edx, [ecx*8 - 0x3a6f9d6c]
btr ecx, edx
or ecx, 0x65870780
adc esi, eax
jmp 0x994619
Function at 0xde84b6
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax*2], edx
xor dx, word [ebp + eax*2 + 2]
and cx, dx
mov word [esp + eax*2 + 1], 0x223b
lea edx, [eax + eax + 0x18ac13f]
cwde
not cx
push eax
mov word [ebp + eax + 2], cx
mov dx, word [ebp + eax*2 + 2]
jmp 0xe10127
je 0xdc5373
cwde
movsx ecx, ax
add ax, word [ebp + eax + 4]
dec ecx
xor dx, cx
btr ecx, 0x39
push ecx
not cl
not ax
call fcn.00ddb767

Function at 0xdea69e
Capabilities:
Encode data using base64

Disassembly:
sub al, cl
bswap ecx
lea edx, [edx + eax - 0x42e86c6b]
dec ax
ror dword [esp + ecx - 0xfffb], 0xa1
shr dword [esp + ecx*2 - 0x1fffa], cl
xor edx, 0xd514263f
xchg ecx, eax
sal word [esp + eax*8 - 0x7ffef], 0xcb
cwde
add edx, eax
and cx, ax
xor ebx, edx
bts ecx, 0x85
and eax, 0x43aebb2a
adc eax, eax
mov dword [ebp - 0xc], edx
sub ax, 0x76ad
movzx edx, cl
cwde
lea ebp, [edx + ebp - 0x45]
cwde
pop edx
pop edx
pop edx
pop eax
js fcn.008e0841
xor ebx, ecx
mov dword [ebp - 4], ecx
movsx ecx, word [esp]
shl ecx, cl
movzx edx, byte [edi + ecx - 0x30809]
pop ecx
sbb edi, 9
xor dl, bl
ror dl, 1
xor dl, 0x3f
movsx eax, cl
dec dl
ror ax, cl
not ecx
xchg al, cl
ror dl, 1
inc dl
xadd cl, ah
setne al
rol eax, 0x95
xor bl, dl
mov word [ebp + ecx*4 - 0x31dff026], dx
call fcn.00e11510

Function at 0xdf90be
Capabilities:
Encode data using xor

Disassembly:
xor dl, bl
mov dword [esp], ecx
call fcn.00a0db36
mov ecx, dword [ebp]
mov edx, 0x50c8b3b
movzx eax, dl
shl eax, 0xbf
movzx eax, byte [edx + edi - 0x50c8b3c]
sar dl, 0x44
xchg dh, dl
dec dx
xor al, bl
rol al, 1
bt edx, edx
neg al
ror al, 1
push edx
jmp 0x9f89a2
Function at 0xe0658c
Capabilities:
Encode data using base64

Disassembly:
lea edx, [eax + edx - 0x6c795f42]
mov ecx, 0xf88b6036
adc eax, 0x550b2729
xor edx, 0x8013e00a
ror edx, 1
mov dword [esp + eax*2 - 0x2447c9ee], eax
inc word [esp + eax - 0x1223e4f2]
bt ecx, 0x28
xor ebx, edx
call fcn.008ae14c
Function at 0xe10143
Capabilities:
Encode data using base64

Disassembly:
and word [esp + edx - 0x538917b1], 0xea83
sbb ecx, 0xb224400c
mov edx, dword [eax + edx - 0x538917b3]
mov eax, ecx
shl al, 0x41
bswap ecx
mov dword [ebp + ecx - 0x79dcf7d0], edx
mov edx, dword [esp + ecx - 0x79dcf7c5]
mov dword [esp + ecx - 0x79dcf7d0], esi
ret 0xc
mov dword [esp + edx - 0x538917b3], edx
rol cx, 0xe6
lea eax, [esp + eax + 0x10]
jb 0xdd5539
call fcn.00a09f38
inc ecx
ror dh, cl
dec ecx
xor esp, 0x50a789bf
cwd
inc ecx
xor dh, 0xbb
dec eax
sub eax, edx
and eax, edx
dec ecx
bswap ecx
inc ecx
neg dh
rol ecx, 0x7c
inc ecx
rol dh, 1
inc ecx
xor dh, dh
dec ecx
rol edx, cl
dec eax
cwde
inc sp
mov dword [ebx + edx*2 - 0xa], esi
inc ecx
sbb edx, 0x839a7fa7
inc ebp
mov esp, dword [edi + edx*8 + 1]
call fcn.00e15f96

Function at 0xe1131b
Capabilities:
Execute syscall

Disassembly:
xor ebx, eax
xor ecx, 0x308ebba5
adc esi, eax
and cl, 0x90
sar cl, 0xa6
inc dx
pop ecx
pop ecx
jmp esi
push 0xd99fea25
neg dword [esp]
shrd edx, eax, cl
mov ecx, 0xfa99c0bb
movsx eax, word [esp]
mov dword [ebp + eax - 0x15db], edx
inc byte [esp + eax - 0x15d9]
lea edi, [edi + eax*8 - 0xaedc]
ror ecx, 0x98
mov eax, dword [edi + eax*8 - 0xaed8]
xor eax, ebx
not word [esp + 2]
mov edx, ecx
xor eax, 0xed27a38e
dec eax
add dx, dx
dec edx
ror eax, 2
push ecx
dec edx
not eax
jnp 0x8b5e90
movzx ax, byte [eax + ebp - 0x1fb91ffe]
call fcn.0099372d
mov ecx, 0x9d02779e
movsx eax, cx
mov edx, dword [eax + ebp - 0x779e]
mov eax, dword [ebp + eax*4 - 0x1de74]
xor ecx, 0x70bda8b1
neg cx
sal cx, 0x8f
add cl, byte [ebp + 8]
add ebp, 6
jmp 0x9c0c32

Function at 0xe12b34
Capabilities:
Encode data using base64

Disassembly:
dec edx
xor ebx, edx
rol ecx, 0x9b
adc esi, edx
movzx edx, word [esp + eax - 0x15]
or dword [esp + edx*2 - 0x5b1], edx
call fcn.00dc485b
mov edx, 0x46b57f03
dec eax
lea ebp, [edx + edx*8 - 0x65ee875a]
bts ebp, 0x96
dec esp
mov eax, dword [ebx + ebp*2 - 0x2ce5df82]
dec eax
lea ecx, [edx + edx*8 + 0x4cb9758c]
dec ebp
mov ecx, dword [eax + edx - 0x46b57f03]
call fcn.00d726a7

Function at 0xe15bf4
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
dec ecx
lea edx, [edx + 0x516133a]
bswap eax
call 0xdfbccd
inc ecx
push ebp
inc bp
adc esp, edx
inc esi
xchg byte [esp + ecx - 0x1d84bad4], dh
neg al
not bp
inc si
mov dword [ebx + ecx*4 - 0x7612eb5c], esp
jb 0x9d1d06