joyce8/EMBER2024-capa huggingface dataset:
Function at 0x181d51e
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + edx - 0x2c3ae8f0]
rol dx, 0x86
not ecx
sub eax, edx
rol ecx, 3
dec edx
mov dword [esp + edx - 0x3acae32], eax
sub ecx, 0x80114022
shl eax, 0x88
xor dx, 0x9c2e
xor ecx, 0x9421003c
pop edx
rol ecx, 3
not ecx
btc ax, dx
neg ecx
or al, ah
add ax, dx
not ecx
bts dx, dx
sbb dx, 0x539
lea ecx, [ecx + eax*2 - 0x7c29c162]
sub eax, edx
or eax, edx
cbw
xor ebx, ecx
inc ax
add ebp, ecx
jmp 0x1c17c7d
lea ecx, [edx + edx*4 - 0x33d8e3f0]
lea edx, [edx + eax + 0x5dad4192]
mov si, word [esi + ecx - 0x7bf5ce2f]
call fcn.0197fa67

Function at 0x181d645
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax + edx*8 - 0x216500c9]
add edx, edx
xor edx, 0x6188af8a
sub ecx, dword [esp + ecx - 0x2165807]
xor ebx, eax
push ecx
neg dword [esp + edx - 0x21881f8a]
add edi, eax
inc ecx
pop ecx
pop eax
pop edx
jno fcn.01964729
sysenter
push esi
pushfd
mov esi, 0xeba03eb4
push ebx
mov esi, dword [esp + esi + 0x145fc154]
mov dword [esp + 8], 0xc8d7931
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.0185af1a
push 0x662afb95
mov eax, 0x8ca4e135
cbw
mov ecx, dword [ebp]
add ebp, 4
call fcn.01758991
xor ebx, ecx
add al, 4
fld dword [esp + eax]
sets byte [esp + edx - 0x3e009a36]
bt edx, 0x9d
add esi, ecx
shr edx, 8
mov eax, edi
lea edi, [edi + edx - 0x3e009c]
sal dl, 0x22
and edx, dword [esp + edx - 0x3e0068]
mov word [edi + edx*8 - 0x700000], ax
pop ecx
ja fcn.01952f1c
jle 0x1b8eb1a
lea ebp, [ebp + edx - 0x4702ffff]
shl al, cl
inc dx
dec edx
movzx ecx, dl
mov word [edx + ebp - 0x47030001], ax
jne 0x1b3da3e
mov eax, dword [ebp + ecx - 0x2605a124]
call fcn.0177a23a
mov byte [0xe7013272], bh
xchg ecx, eax
jno 0x181d6b4
leave
int3
push edx
setp dl
mov dword [esp + ecx*2 - 2], edi
ret
Function at 0x181f1f6
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx + eax*8 - 0x2ab81fdd]
mov dword [esp + eax - 0x570a], 0x77bce613
ror edx, 1
sal ecx, cl
not edx
sal ecx, 0x4b
xor byte [esp + eax*4 - 0x15c26], ch
xor ebx, edx
and al, ch
adc edi, edx
sub eax, 0xff865a3c
movsx edx, cx
mov ax, word [eax + esi - 0x79fcc4]
jne 0x192dcc3
call fcn.0180ac64
jge 0x19a9569
std
fistp word [esi + edi + 0x677ad930]
xor cl, bl
jp 0x192dd38
js 0x192dcf7
mov edx, 0x2428cb1d
aaa
loop 0x192dccd
inc edi
cmp esp, dword [eax - 0x373738b9]
outsb dx, byte [esi]
xlatb
clc
or dh, byte [ecx]
in al, 0xcb
inc edi
invalid
lahf
adc esi, ebx
adc eax, dword [ecx - 0x37e7483c]
jp 0x192dd64
aas
out 0xe8, eax
invalid
invalid
aas
sub eax, dword [0x9cd17132]
stc
sbb eax, 0x31c85cd
sbb al, 0xb4
dec edx
inc ebx
mov eax, dword [0x38fc7b1f]
xor al, 0x96
out 0xd9, eax
invalid
xor dx, word [esi + edx + 2]
shr dword [esp], 0x8f
bswap ecx
sbb byte [esp + ecx - 0x408c], cl
mov cl, byte [esi + ecx*8 - 0x20464]
jl 0x1c20aff
call fcn.0152d995
out dx, eax
xlatb
inc esp
mov bh, 0x65
daa
clc
int 0xc4
add eax, 0xcddcde3b
das
mov ecx, dword [eax + ecx]
xor dh, byte [0x39322aea]
adc dword [ecx - 0x48cdde67], eax
invalid
xchg ecx, edx
inc al
btc ecx, 0x9c
setb byte [esp + edx - 0x40b7605c]
setae byte [esp + ecx - 0x235d7400]
xor al, 0x1d
rol word [esp + ecx*2 - 0x46bae7fb], 0xcd
rol al, 1
rol dword [esp + ecx - 0x235d73fc], 0x53
adc al, 0x19
rol al, 1
mov dword [esp + ecx - 0x235d73fe], 0xfab000ac
sar edx, 0xc9
sbb al, 0x17
shl ecx, 0xc8
ror edx, 0x81
ror al, 1
sub dword [esp + edx*4 - 0x40b75c], ecx
push edx
xor bl, al
not cx
xchg word [esp + edx*2 - 0x205ba6], cx
lea eax, [esp + eax + 0xc]
rol ecx, cl
movzx cx, byte [eax + edx*4 - 0x40b760]
dec dl
lea esi, [esi + edx - 0x102dd9]
shl dword [esp + edx - 0x102dd6], 0xb6
call fcn.0186f306
xchg ebp, eax
jge 0x1b228c3
test al, 0x90
push edx
jge 0x1b22837
inc eax
enter 0x3d4f, 0xffffffffffffff81
cmpsd dword [esi], dword es:[edi]
ljmp 0x8d6f
movsb byte es:[edi], byte [esi]
mov al, byte [0x17017bbd]
inc edi
or ebp, ebp
push ds
and dword [edx + 0x7f], eax
hlt
not eax
sbb byte [esp + ecx - 0x40b763ac], ch
bts ecx, ecx
xor eax, 0x7b92b6b0
xor ebx, eax
movsx edx, cx
not byte [esp + edx*4 - 0x18ec1]
imul cx, dx
add ebp, eax
movzx eax, byte [ecx + edi - 0x40b76061]
lea edi, [edx + edi - 0x63b0]
lea edx, [edx + ecx - 0x57fd5d62]
shr edx, 0xe9
rol dword [esp + ecx - 0x40b7605d], 8
xor al, bl
bswap edx
jmp 0x1b227c1

Function at 0x182341d
Capabilities:
Encode data using xor

Disassembly:
and esi, 0xff
mov dword [esp], 0x798606bc
shr byte [esp + 3], 0x61
push es
xchg byte [ecx - 0x40], bh
insb byte es:[edi], dx
and al, 3
popal
not dword [esp]
mov esi, dword [esi*4 + 0x28888b4]
mov ah, 0x88
mov byte [edx], al
shr ecx, 8
not dword [esp]
sal word [esp + 1], 0xcb
inc word [esp]
xor ecx, esi
inc edx
push 0x94ab52ac
xor ecx, 0xcbbbd2ba
neg word [esp + 1]
shr byte [esp + 3], 0xc1
call fcn.0185fe54
popfd
sbb dword [ecx - 0xb], edi
dec esp
js 0x1823428
pushfd
test byte [ebx], bl
cmp ah, bl
jnp 0x1823437
invalid
Function at 0x1834774
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
xor byte [esp + ecx*4 + 6], ah
adc ecx, 0x24a02291
bswap edx
ror ecx, cl
mov dword [esp + ecx - 0x11489250], 0x17a3830f
dec cl
ror edx, 1
inc dword [esp + ecx - 0x1148924b]
xor edx, 0x488bc234
neg al
ror edx, 1
and cl, ch
shr al, cl
inc edx
shr dword [esp + ecx*2 - 0x22912400], cl
not ecx
not ecx
not edx
jne 0x1899988
call fcn.018e0e10
mov eax, 0xff30991f
movsx edx, al
mov ecx, 0x31aff720
mov eax, dword [esi + edx*2 - 0x3e]

Function at 0x183e3fc
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], ax
movzx ecx, dx
lea ebp, [ebp + ecx - 0xf799]
call fcn.01bf8f31
call fcn.01a2cce0

Function at 0x1848694
Capabilities:
Execute syscall

Disassembly:
dec eax
mov edi, dword [esp + 8]
dec eax
lea esp, [esp + 0x10]

Function at 0x188d831
Capabilities:
Encode data using base64

Disassembly:
jmp 0x182ef9b
dec ebx
call 0x1b04c02
jmp 0x1b719dc
mov eax, dword [ebp]
call eax
mov edx, 0xae8268a8
mov ebp, dword [ebp - 4]
call fcn.01868b54
lea esp, [esp + 0x10]
je 0x1b04c0c
mov eax, dword [ebp + ebx*4]
push eax
jmp 0x180adb9

Function at 0x1899909
Capabilities:
Encode data using base64

Disassembly:
rol al, 1
or edx, 0x15165e36
xor bl, al
mov dword [esp], edx
inc dword [esp]
lea eax, [esp + eax + 4]
lea edx, [edx + edx*2 - 0x63f45dc6]
mov byte [eax + edx - 0x5ceb3f1f], cl
not word [esp + edx - 0x5ceb3f1d]
mov ecx, dword [ebp + edx - 0x5ceb3f1f]
rol word [esp + edx - 0x5ceb3f1e], 0x6d
sbb byte [esp + edx - 0x5ceb3f1d], dl
btc dx, dx
lea ebp, [ebp + edx - 0x5cebbf1b]
mov eax, dword [esp + edx - 0x5cebbf1f]
sar dword [esp + edx - 0x5cebbf1f], 0x64
xor ecx, ebx
sar dword [esp + eax - 0x6aac1bf8], 0xb4
shr eax, 0x35
not ecx
lea ecx, [edx + ecx + 0x7b24136d]
neg byte [esp + edx - 0x5cebbf1c]
imul ax
bswap ecx
lea ecx, [ecx + edx + 0x20aa5803]
pop edx
bts edx, eax
jae 0x1a38e68
not ecx
neg eax
btc eax, eax
jb 0x1b14d01
xor ebx, ecx
add esi, ecx
jmp esi
Function at 0x18a167b
Capabilities:
Encode data using xor

Disassembly:
call fcn.0188e50b
mov ecx, 0xdb257b94
movsx eax, cx
jmp fcn.0287baf5
inc ecx
dec esi
dec ecx
imul edi
inc esp
btr edx, ebp
dec eax
ror eax, cl
inc ecx
ror esi, 2
inc ecx
push ecx
inc ebp
mov edx, edi
inc ebp
mov eax, edi
inc esp
xor dword [esp + ebx*2 - 0x5c], esi
inc ecx
rol al, 0xc1
inc ecx
sar eax, 0x7b
cbw
inc ecx
pop ecx
dec dword [esp + 8]
neg word [esp + 8]
mov dword [ebp - 4], eax
jp 0x16f59f8
movsd dword es:[edi], dword cs:[esi]
pop edx
rcr esp, cl
aad 0x2f
push es
rcl dh, 0x25
jle 0x18a1632
fst dword [ebx - 1]
mov dh, 0x4d
jb 0x18a162f
mov cl, 0x20
fld dword [esi + 0x60]
pop es
stosb byte es:[edi], al
insd dword es:[edi], dx
xchg edi, eax
aas
push ss
dec ecx
cmpsd dword [esi], dword es:[edi]
lodsb al, byte [esi]
pop es
or al, 0x9f
salc
mov bl, 5
or al, byte [ebp + 0x5c2943b4]
jp 0x18a1723
adc cl, byte [edx + 0x6d879e46]
lcall 0x9529, 0xa88aad0a
mov dl, 0x29
sub esp, ebx
sub byte [esi - 0x1b], ch
mov dl, 0xd2
fild qword [esi - 0x22]
enter 0xffffffffffffada2, 0x78
scasd eax, dword es:[edi]
mov ch, 0xed
ljmp 0x102e
outsb dx, byte [esi]
in eax, dx
inc ecx
cmpsd dword [esi], dword es:[edi]
not ch
mov dh, 0xac
dec ebp
cmpsd dword [esi], dword es:[edi]
add byte [esi + 0x7251756f], al
stosd dword es:[edi], eax
sahf
add byte [esi - 0x5a], 0xc4
js 0x18a175a
retf 0xca7d
invalid

Function at 0x18ada21
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov esi, dword [esp + 4]
lea esp, [esp + 8]
mov ecx, 0x293b8d1d
lea eax, [ecx + ecx*2 - 0x265cae7c]
not edx
call fcn.01c0f4da
lea esp, [esp + 8]
je 0x28c4e67

Function at 0x18cf7cc
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
call eax
mov edi, 0x2c1d8a1d
mov ebp, dword [ebp + edi*2 - 0x583b143e]
call fcn.01b095d7
dec edx
popal
inc ebx
sub ah, al
inc ebx
sbb bl, ah
bound ebp, qword [ebx + 0x44]
sub eax, 0x68cf0dd2
Function at 0x18d0745
Capabilities:
Encode data using xor

Disassembly:
not ecx
neg edx
shr dword [esp], 0x95
xor ebx, ecx
cbw
add edi, ecx
pop ecx
jmp edi
and ecx, ecx
mov dword ss:[eax], edx
bt ecx, 0x2f
mov edx, dword [edi]
not cx
jae 0x19b0191
movzx ecx, ax
bt ecx, 0
xor dl, bl
neg dl
add dl, 0xb1
shr al, 0xe5
sal cx, 0x6f
rol dl, 1
sub eax, 0x64880888
not ax
neg eax
adc dl, cl
not ecx
xor dl, cl
rol dl, 1
call fcn.0191a7e3
adc al, 0xb5
neg edx
not al
ror al, 1
not al
inc edx
not edx
mov dword [esp], edx
xor bl, al
not dword [esp + 3]
lea eax, [esp + eax + 0xc]
mov word [eax], cx
sub ebp, 4
pop edx
dec dword [esp + 4]
mov ecx, dword [ebp]
bt edx, 0x9a
adc word [esp + 5], dx
xor ecx, ebx
movzx eax, dl
pop eax
add ecx, 0x7ac1827
bswap ecx
xor ecx, 0xa3948a9c
dec al
jnp 0x1b33f46
mov edx, 0xf62d4e88
sar edx, 0xed
imul dx, dx
mov edx, dword [edi]
jo 0x1c3385b
mov ebp, 0x19b70510
mov al, byte [ecx + 0x44]
xchg edi, eax
jecxz 0x18d082e
add esi, edi
dec edi
sbb al, 0x45
dec ebp
jb 0x18d07e0
movsb byte es:[edi], byte [esi]
test dword [eax + esi*8 + 0x76], eax
xchg edx, eax
test al, 0xfc
add byte [edi - 0x17], cl
mov ecx, 0x9c9f671d
jns 0x18d080e
fsubr st(6)
cmpsd dword [esi], dword es:[edi]
sbb edx, 0xffffff87
and edi, dword [edi]
invalid
in eax, dx
or al, 0x48
push ecx
aas
xchg dword [ebx], esi
sahf
loope 0x18d0844
invalid
inc ebx
shl byte [esi + 0x4f], 1
dec edi
movsb byte es:[edi], byte [esi]
das
lock and dword [esi + 0x7332f3f6], ebp
sal byte [ebp - 0x18], 1
xchg ecx, eax
fmul st(1)
push esp
xor byte [eax + 0x6d], bh
and byte [eax + eax*4 + 0x67], 0xfb
jge 0x18d081c
cmc
loop 0x18d080b
xchg ebx, eax
sbb byte [ebx + 0x2c], ah
jmp 0x3ab4a32e
inc ebx
pop dword [edi - 0x21]
ret 0x7654
adc edi, 4
xor edx, ebx
mov eax, ecx
shr al, 0x47
dec edx
bswap edx
dec edx
shl cx, 0xe1
cbw
ror edx, 1
add cx, cx
xor edx, 0x4b052fa3
xor al, 0xb8
xor ebx, edx
add ebp, edx
cdq
jmp ebp
jne 0x188f24c
mov ecx, 0x2dac5aa6
mov eax, dword [esi + ecx*2 - 0x5b58b54c]
lea edx, [ecx*4 - 0x5ce823cf]
mov edx, dword [esi + ecx - 0x2dac5aa2]
not cl
ror ecx, 1
bt cx, cx
adc esi, 8
xor cl, cl
jle 0x18b3ce5
sub esi, 4
mov edx, 0xa0ade793
movsx eax, dl
mov ecx, dword [esi]
xor ecx, ebx
ror ecx, 3
push edx
neg ecx
btr edx, eax
xor dword [esp], edx
sbb ecx, 0x87379e80
bswap ecx
dec ax
shl word [esp], 0xec
xor ecx, 0xf93d041a
ror dx, 0xe2
jb 0x1ba7d87
mov edx, 0xff865194
call fcn.018b81df
rol ecx, 1
sub ecx, 0xe31193a5
xor ebx, ecx
cwde
dec dword [esp]
pop edx
add edi, ecx
mov ax, word [ebp + edx*2 - 0xffffe]
or edx, 0xe9beaba7
xor dx, dx
jne 0x1938997
mov cl, byte [ebp + 2]
ror edx, 0xe4
lea ebp, [ebp + edx*4 - 0x3a6fbffe]
shr ax, cl
shl dl, 0xc5
mov word [ebp + edx*2 - 0x1d37e000], ax
jmp edi
jb 0x1b8904c
sysenter
call fcn.0288bc34
Function at 0x18dac03
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp]
pop edx
mov edx, 0xba3d5ba1
sub edx, 0xc0b9ccbe
xor eax, ebx
movzx ecx, dl
xchg dh, cl
neg eax
not eax
btr dx, dx
sar edx, cl
shl cl, 0x41
inc eax
bt dx, cx
sar ecx, cl
cmovp cx, dx
xor eax, 0xb821802d
sub dl, 0x1f
lea ecx, [ecx + edx*4 - 0xc4fc8e2]
dec cx
xor ebx, eax
jmp 0x1af5833
add dl, cl
add edi, eax
ror dl, 0xc5
lea eax, [edx + ecx*4 + 0x3722b93a]
push edx
mov edx, dword [esi + eax - 0x5e583d0]
btc eax, 0xa5
bswap eax
adc ax, cx
mov eax, dword [esi + 4]
bts ecx, 0x2c
jb 0x1bf239f
lock xadd dword [edx], eax
pop edx
not ecx
push edx
pushfd
pop edx
mov dword [esp + ecx - 0xc4f4713], edx
btc ecx, 0x32
ror cl, 0x45
movsx edx, cl
pop edx
shl ecx, cl
mov dword [esi + 4], eax
sbb cl, 6
mov dword [esi], edx
jmp edi

Function at 0x1910217
Capabilities:
Encode data using xor

Disassembly:
cdq
call fcn.01a6cdf2
mov eax, 0x8a9cf0a
bt eax, eax
mov eax, dword [esi + eax - 0x8a9cf0a]
adc esi, 3
jmp 0x1aa3f7a
xor edx, 0x193f31af
call fcn.017a5037
jg 0x16dda25
mov byte [0x184d598a], al
pop ebp
dec eax
sar ecx, 0x95
stc
xchg ebp, eax
jle 0x16dda91
fstp xword [ebx + 0x4d]
in al, dx
cmp dl, byte [ecx + 0x5d0df4f0]
inc ecx
shr dword [ecx + 1], 1
push es
sub ebx, dword [edx]
xchg ebx, eax
loopne 0x16ddad0
jbe 0x16dda5f
dec edi
invalid
inc ecx
pushal
fist dword [ebp + 0x3f]
xor eax, 0xe76a113b
mov eax, dword [0xa60e6b0a]
scasb al, byte es:[edi]
xchg ebx, eax
shl edi, cl
mov esp, 0xe7f86cbb
add dword [eax], 0xf07074eb
lea eax, [edi - 0x4c]
popal
pop edi
daa
adc dl, byte [ecx - 0x5b]
sbb ah, byte [esi - 0xe45a01d]
xchg ebx, eax
add ecx, dword [esi - 0x135b20a3]
xor dl, byte [ebp + 7]
push esi
shr dh, cl
pushal
jne 0x16ddaaa
add bl, ch
je 0x16ddb1e
invalid
xchg esi, eax
inc ebx
push esp
sub edx, dword [ecx]
leave
invalid
sub eax, 0x4af33312
or dword [ebp + 0x6e3caadd], 0xffffffa9
call dword [0x56265be3]
or dword [ebx], ecx
mov ch, 0x4b
invalid
jmp 0x16dda4a
call fcn.01c0d48a

Function at 0x191d7d5
Capabilities:
Execute syscall

Disassembly:
jmp 0x1a75366
mov dword [esp], 0x139684b4
mov dword [esp + 4], 0x913cdabd
xor ecx, ecx
test edx, edx
jmp 0x1774865
call fcn.018f5c77
sysenter
push edx
mov dword [esp], 0x76d48cd0
call fcn.0181525f
Function at 0x19276ce
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [esp + 4], 0x74a5d28d
jmp 0x19388b0
pop edi
pop esi
and cx, 0x63a9
movsx eax, cl
lea edx, [eax + eax*4 - 0x1b4faa63]
mov eax, dword [esi + eax*2 - 0x10]
lea esi, [esi + ecx - 0x77880004]
inc cx
xor eax, ebx
lea eax, [edx + eax - 0x3c9805b4]
and ecx, edx
inc edx
bt ecx, 0xa6
rol eax, cl
sal dl, cl
jle 0x195bba3
inc ebp
xor edx, ecx
push 0x772ffb0a
mov eax, 0xec880a88
inc ecx
rol edx, 1
inc ecx
neg edx
inc esp
movzx esp, word [esp + 2]
inc ecx
bswap edx
inc ecx
xor edx, 0x41240d09
dec esi
mov dword [esp - 0x3b970], ecx
btr ax, 0x16
inc esi
xor dword [esp - 0x3b970], edx
dec esp
lea esi, [eax + eax*8 + 0x5cb06a36]
dec esi
mov ecx, dword [esp - 0x7727]
inc ecx
div ah
dec ebp
arpl dx, dx
pop ecx
dec edx
lea ebp, [eax - 0x28ed3f77]
dec eax
cdq
dec ecx
add edi, edx
dec edx
mov dword [esp - 0x772f], 0xc4381db2
inc edx
mov ebx, dword [esp - 0x3b976]
pop ebx
inc si
mov ebp, dword [esi - 0x772f]
inc ecx
mov eax, 0xcb28ff82
test ebx, ebx
lea esp, [esp + 8]
je 0x19388de
mov eax, 0x4eb3b523
neg ax
jnp 0x181462a
mov eax, dword [ebp + ebx*4]
push 0x89bbda33
mov dword [esp], eax
dec ebx
jne 0x19388bc
mov eax, 0x9a270d1d
cwde
mov eax, dword [ebp + eax - 0xd1d]
call eax
mov ebx, 0x44a56db7
mov ebp, dword [ebp + ebx - 0x44a56dbb]
movsx edi, bx
lea ecx, [ebx + ebx*2 - 0x566838c9]
mov dword [ebp + edi*2 - 0xdb6e], eax
shl di, 1
movsx esi, di
pop ebx
xadd edi, esi
adc esi, edi
jns 0x1927695
inc esi
jg 0x1938962
pop ds
out 0x47, al
invalid
add ecx, edx
neg eax
shr dl, 0x62
adc dx, cx
bswap eax
xor ebx, eax
imul dx, dx
not cl
shl ecx, 0x6f
adc edi, eax
and cl, 0x9e
dec dl
jmp edi

Function at 0x192c3b7
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x14]
je 0x1b5f375
call fcn.0286b388
sete dl
xor eax, ebx
lea eax, [eax + ecx*2 - 0x6a679a38]
ror eax, 2
or edx, 0x59b54486
imul ecx, edx
or dx, dx
xor eax, 0x60179192
xchg edx, ecx
not eax
imul edx, ecx
ror ecx, 0xe2
xor eax, 0x85a0f89c
and cl, 0x20
dec cx
btr dx, 0x3c
xor ebx, eax
sar edx, cl
not edx
neg edx
adc ebp, eax
movzx eax, dx
add edx, 0xe2ce785
cdq
or edx, ebp
jmp edx

Function at 0x1952dcb
Capabilities:
Check for vm using instruction vpcext

Disassembly:
rol al, 1
add dl, byte [esp + edx*8 - 0x4a50187c]
not al
call fcn.01c31e00

Function at 0x19a513a
Capabilities:
Encode data using base64

Disassembly:
push 0x3a37c03d
mov ebx, dword [ebx*4 + 0x1b8dd58]
inc dword [esp + 0xc]
mov dword [esp + 4], 0x29226606
not dword [esp + 0xc]
shr ecx, 8
not dword [esp + 2]
xor ecx, ebx
rol word [esp + 7], 0xc6
not dword [esp + 0xc]
inc eax
ror dword [esp + 4], 0x95
dec word [esp + 4]
xor ecx, 0x9eb3752e
dec word [esp + 5]
neg word [esp + 1]
jne 0x1b5f365
Function at 0x19bac76
Capabilities:
Encode data using xor

Disassembly:
push 0x78bccc3c
sar dword [esp], 0xa7
mul ecx
mov dword [esi], edx
mov dword [esp + 8], 0xe21151be
ror dword [esp + 8], 0x85
mov dword [esi + 4], eax
mov eax, 0x7c3436bd
lea edi, [edi + eax - 0x7c3436c1]
call fcn.01a91df2
dec ebp
jbe 0x19bacf2
loopne 0x19bacee
or edi, esi
jnp 0x19bad19
pop ebp
add edx, esi
psubsw mm1, qword [0xdf890ca0]
and dword [ebx + 0x339fdc9b], ecx
add al, 0xda
sbb byte [ecx - 0x3cfc38c], ah
mov edi, 0xe3e00cdd
and eax, ecx
dec edi
in al, dx
test eax, 0x8083cb74
rcr ch, cl
and dh, 0x63
xchg edi, eax
invalid
mov bl, 0
cmp al, byte [eax - 0x3fa97266]
outsd dx, dword [esi]
inc edi
inc esp
lcall 0x4447, 0x6fc0568d
adc al, 0x51
scasb al, byte es:[edi]
cmp ecx, edx
pushal
movsb byte es:[edi], byte [esi]
pop ebx
xor ebp, dword [ebx - 0x46f089bf]
out 0x79, eax
sub ch, byte [0x34672a05]
pushfd
jnp 0x19bad1a
dec esp
stosd dword es:[edi], eax
sahf
scasd eax, dword es:[edi]
mov ebp, 0x233c1bf7
sbb edi, dword [ebx]
cmp al, 0x23
push ebp
mov dword [ebx], ecx
fst qword [ecx + 0x4b]
dec eax
imul esp, dword [esi + 0x14c56162], 0x79
inc edi
xlatb
sal byte [ebx - 0x16], cl
pushfd
aam 0xf3
popal
sbb eax, 0x65e69681
adc eax, 0xb39986b2
dec edi
invalid

Function at 0x19cb87b
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x1609f02e
inc dword [esp]
mov dword [esp], eax
call fcn.019fb557
mov edx, 0xda8d2935
movsx ecx, dx
lea ebp, [ecx + ebp - 0x2939]
mov ecx, dword [ebp + ecx - 0x2935]
movsx eax, dx
xor ecx, ebx
sal ax, 0x43
xadd edx, eax
or dx, ax
adc ecx, 0x461e028e
neg dx
neg ecx
call fcn.018af878
mov ecx, 0x9a8d0e96
movsx edx, cx
lea edx, [edx + ecx*8 - 0x31571e70]
sub ebp, 4
sal cl, 0x61
movzx eax, dx
mov eax, dword [ebp + eax*8 - 0x326b0]
inc cl
add cx, dx
shl ecx, 0xea
xor eax, ebx
bswap eax
jmp 0x288b5b5
bswap edx
lea eax, [eax + ecx*4 - 0x3e298c62]
dec ecx
setno dl
xor dl, 6
neg eax
dec eax
sal edx, 0xaf
ror ecx, cl
and cl, ch
xor eax, 0x8d1c8812
xor ebx, eax
or dl, dl
call fcn.01a1b0b3
call fcn.01c0f848

Function at 0x19d17fc
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
call eax
mov edx, 0x662757b4
call fcn.01a5c9f3
xor ebx, edx
rol cx, cl
cwde
setno al
adc edi, edx
lea edx, [ecx + ecx*8 + 0x6d943ebd]
lea eax, [edx + ecx*2 + 0x3334d88d]
lea ebp, [edx + ebp - 0x6d943ed0]
movzx eax, byte [ebp + ecx - 2]
xor al, bl
xchg cx, dx
sal ecx, 0x62
adc edx, ecx
rol al, 1
not al
btc ecx, edx
shr ecx, 0x3f
adc al, 1
shl cl, 0xa1
ror al, 1
xor bl, al
add eax, esp
bt ecx, ecx
xadd edx, ecx
adc dl, 0xb9
movzx dx, byte [ecx + eax - 0x6d94fb3e]
movzx eax, cx
not cl
call fcn.0175dac8
push ds
salc
insb byte es:[edi], dx
shr dword [edx + 0x46], 1
adc ebp, 0xffffffac
rsm
lodsb al, byte [esi]
aaa
cmp edi, esi
jle 0x19d1839
inc edx
cmp byte [eax - 0x20d703c5], dl
sbb ch, byte [esi - 0x2c]
mov esi, 0xf4a5179b
invalid
Function at 0x19d4f57
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [edi + ecx - 0x75b0cf07]
mov dx, word [edi + ecx - 0x75b0cf03]
sal ecx, 0x9c
lea edi, [edi + ecx - 0x6ffffffa]
pop ecx
mov word [eax], dx
mov eax, 0xd3222daa
lea ecx, [eax*2 - 0x2edbf669]
jne 0x1bddeae
mov eax, dword [ebp]
mov edx, 0xc1b59b5
push edx
rol dword [esp + edx*2 - 0x1836b36a], 0xeb
lea ebp, [edx + ebp - 0xc1b59b1]
setb byte [esp + edx*2 - 0x1836b36a]
xor eax, ebx
push edx
shr byte [esp + edx - 0xc1b59af], 0x27
neg eax
sub dword [esp + edx - 0xc1b59b3], edx
movzx ecx, dl
bswap eax
neg dx
setae cl
bts dx, cx
xor eax, 0x13082736
not eax
or word [esp + edx*2 - 0x18374c91], cx
xor eax, 0xadac8996
rol ecx, 0xae
shr ecx, 0xa1
xor ebx, eax
shl dword [esp + ecx*2 + 4], 0xaf
add edx, edx
adc edi, eax
shl edx, 0x6d
adc cl, byte [esi + ecx]
movsx eax, dx
not eax
add dl, byte [eax + esi - 0x3ffd]
lea esi, [esi + eax - 0x3ffd]
ror dword [esp + eax - 0x3fff], 0xd6
add cl, dl
mov word [esi + eax - 0x3fff], cx
lea edx, [eax*2 + 0x332e2026]
mul eax
mov dword [esp + eax - 0xfff8001], edi
ret 4
mov edx, dword [ebp + ecx - 0x776864eb]
sbb eax, ecx
call fcn.01875a92

Function at 0x19d8edd
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edi + edx - 0x5ceb8810]
mov dword [esp], 0x89966da7
mov eax, 0x6ebd3584
bswap ecx
xor edx, ebx
neg ax
push ecx
dec byte [esp + eax - 0x6ebdca7a]
sbb edx, 0xf4a470a3
call fcn.0199fabd

Function at 0x19dcc4d
Capabilities:
Encode data using base64

Disassembly:
jb fcn.01778df0
mov eax, dword [esi + 4]
call fcn.019bac76

Function at 0x1a03c0f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1bc3d1e
dec ecx
mov esp, esp
jmp 0x16e7a68

Function at 0x1a0d6dd
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xe9911bc
add esi, 4
jmp 0x1a33f96
not word [esp + 1]
sal dword [esp], 0x5d
xor ecx, ebx
bswap ecx
push 0x752ba2ae
inc ecx
dec byte [esp + 3]
rol ecx, 2
push 0x8aca52f
push 0x84b9ce23
call fcn.0197c034
dec edi
lea ebx, [ebx + esi - 0x71c2e13]
inc ecx
mov ebp, ebp
inc ebx
movzx edx, byte [esi + ebx - 0x71c2e12]
mov dh, 0x94
push ds
out dx, al
shl ebx, 1
clc
inc ecx
pop ebp
inc ecx
xor dl, cl
dec edx
mov dword [esp + esi*2 - 0xe385c24], ebp
rol dl, 1
dec edx
add dword [esp + esi - 0x71c2e12], 0xf50a1699
inc dl
inc ecx
pop edi
inc cx
add ebp, 0x8b45221a
loop 0x1a33fcd
ret 0x1eb8

Function at 0x1a0e0b9
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x996ff39
sbb edi, 8
sar dword [esp], 0x41
mov dword [edi + 0xc], eax
mov dword [edi + 8], ebx
mov dword [edi + 4], ecx
not dword [esp]
shr dword [esp], 0x59
mov dword [edi], edx
pop ecx
jns 0x1b41629
lea eax, [ecx + ecx*4 - 0x25ee9558]
pop ebx
jns fcn.01bb934d

Function at 0x1a17fee
Capabilities:
Encode data using base64

Disassembly:
add edi, 4
xor ecx, ecx
test eax, eax
call fcn.01bd8cc9
xor eax, ebx
rol eax, 1
mov edx, dword [esp + ecx - 0x50da]
dec edx
call int.017a9e3e
mov dword [esp], 0x910f6e11
jmp 0x19dcc2d
Function at 0x1a27692
Capabilities:
Execute syscall

Disassembly:
xor eax, eax
mov dword [esp + eax*8], 0x5705138c
not ecx
add edx, 0x52ad2ea7
shl eax, 0x4c
bswap eax
sbb ecx, 0xba164aa6
bt ax, ax
shl eax, 0xa2
sar byte [esp + edx - 0x345a0832], 0xa1
neg ecx
sal eax, 0xfc
call fcn.01754685
syscall
call fcn.01adb33c
mov ecx, 0x372ea198
mov eax, dword [ecx + esi - 0x372ea198]
lea edx, [ecx + ecx - 0xe7338ce]
btr edx, 3
lea esi, [esi + ecx - 0x372ea194]
btc edx, edx
cmovae ecx, edx
push eax
popfd
mov eax, 0x68ad6525
push ecx
pop ecx
mov ecx, dword [ecx + edi - 0x5fea0a66]
call fcn.019a3cd4