joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19c79fe
Capabilities:
Encode data using xor

Disassembly:
rcr edx, cl
mov dword [edi], edx
mov eax, dword [esi]
mov dword [esp], 0x43a67e9e
call fcn.01aae637
rol ecx, 0xe3
xor ebx, edx
btc eax, 0
adc esi, edx
and al, 0x6c
push cs
add cl, al
shl ebx, 0x33
fimul dword [edi]
mov edx, 0xf21300f8
rol dword [esp + eax - 0x1780371d], cl
xchg ah, cl
movzx edx, byte [edi + eax*4 - 0x5e036074]
lea edi, [edi + eax*4 - 0x5e036073]
adc eax, 0x6225eb05
btr ecx, ecx
xor dl, bl
neg dl
sal al, 0x81
btr ax, ax
ror dl, 1
inc dl
ror dl, 1
call fcn.013233d5
xlatb
jge 0x19c7a0f
aas
insd dword es:[edi], dx
fisttp dword [edx - 0x74]
lodsd eax, dword [esi]
loopne 0x19c7a8f
int1
out 0x61, al
jb 0x19c7a95
arpl word [edi + 0x68], cx
mov dl, 2
sbb dword [ebp*4 + 0x50d85111], ebx
push es
lodsd eax, dword [esi]
mov ecx, 0x6152f878
stc
fild dword [ebx]
insd dword es:[edi], dx
lds edx, [ebp - 0x127cd372]
mov eax, 0x2a5215ad
bound edx, qword [ebx + 0x3ae71265]
xchg esp, eax
mov dword [0x3ae71265], eax
or ah, byte [eax]
lodsd eax, dword [esi]
jne 0x19c7a87
xchg byte [ebp + 0x59d71e4e], ch
push ds
xlatb
pop ecx
imul esi, dword [edx - 0x29], 0x65
invalid

Function at 0x19cdd0e
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 8]
jmp 0x115d211

Function at 0x19dd07f
Capabilities:
Encode data using base64

Disassembly:
not edi
inc ecx
dec ecx
dec eax
mov dword [esp + ebp - 0x26a62d00], 0x7a2a5be
or bx, 0x4d3a
ror edi, 1
inc esp
mov esp, edx
dec ecx
not ecx
inc sp
bt eax, ecx
not edi
dec eax
mov dword [esp + ebp*2 - 0x4d4c5a10], 0x148cb994
neg edi
inc esp
movzx ebx, byte [esp + ebp - 0x26a62cfc]
ror edi, 3
call fcn.0114211a

Function at 0x19de6f0
Capabilities:
Encode data using base64

Disassembly:
not ecx
inc ecx
sar dword [esp + eax - 0x661bfff6], 0x77
xor ecx, 0x7f8a483d
xor ebx, ecx
sar dl, 0x84
xchg word [esp + eax - 0x661bfffa], ax
lea edx, [eax + edx*2 + 0x793f2032]
adc ebp, ecx
pop ecx
pop eax
pop eax
pop eax
jmp fcn.01002e95

Function at 0x19e11a3
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0x7f8a483d
push edx
xor ebx, eax
mov dword [esp + edx*4 + 4], 0xd23a0ca2
ror ecx, cl
xadd dword [esp + edx*2 + 4], ecx
adc ebp, eax
pop eax
pop eax
pop edx
jmp fcn.01002e95

Function at 0x19e3110
Capabilities:
Check for software breakpoints

Disassembly:
inc edx
xor ecx, 0x412eef9c
mov dword [esp], 0xee2deca9
sar word [esp], 0x8a
neg word [esp]
dec eax
lea esp, [esp + 0xc]
jne 0x115d201
pop esi

Function at 0x19f8673
Capabilities:
Encode data using base64

Disassembly:
movzx eax, byte [edi + ecx*8 - 0x6e800000]
setb cl
dec cx
or ecx, ecx
xor al, bl
neg ecx
mov dword [esp], 0xe5079007
not al
sbb al, 0x36
xor al, 0x8d
xadd cl, ch
rol cx, 0xe
or word [esp + 1], 0x2182
inc al
neg dword [esp]
push ecx
pop ecx
neg al
sub ecx, 0x453f6a2a
or cl, cl
xor al, 0x2b
neg dword [esp]
sbb cl, 0x8e
xor bl, al
xadd byte [esp + 1], cl
neg cx
jg 0x1badb41
lea eax, [esp + eax + 4]
sar cl, 0x81
pop ecx
mov byte [eax], dl
movsx edx, cx
inc ecx
movzx eax, dx
jmp ebp
Function at 0x19fcb81
Capabilities:
Encode data using base64

Disassembly:
shr word [esp + 1], 0x4b
mov dword [edi + 0xc], eax
not dword [esp]
mov dword [edi + 8], ebx
mov eax, dword [esp]
mov dword [eax + edi - 0xffe0ca], ecx
movsx ebx, ax
pop ecx
mov dword [eax + edi - 0xffe0ce], edx
pop ebx
jnp fcn.01002e95
mov edx, 0x830d250c
lea eax, [edx + edx*2 - 0x5fd47bdf]
movsx ecx, ax
lea edi, [edi + eax*2 - 0x52a5e68e]
mov eax, dword [eax + edi - 0x2952f345]
xadd dx, cx
xor eax, ebx
btc ecx, 0xb3
rol dx, cl
dec eax
shr ecx, cl
xchg dh, cl
sar dl, 0xc2
not eax
shl cx, 0x21
ror eax, cl
sub edx, 0xa528b786
xchg dl, cl
lea eax, [eax + ecx + 0x4a13e72b]
sal ecx, 0xa2
add ecx, 0xa68e4cb9
not eax
call fcn.01060c70
call fcn.01ae8f8a
sub cx, cx
neg edx
bts ax, cx
sbb edx, ecx
neg cl
call fcn.019e06f5
aas
jge 0xff3bc6
bswap ebp
lodsd eax, dword [esi]
retf 0xac4d
dec dl
shr edx, 0xf5
xor eax, ebx
lea ecx, [edx - 0x4156714e]
not eax
xor edx, ecx
lea edx, [edx*4 + 0x2baa7092]
rol ecx, cl
lea eax, [eax + edx*2 - 0x53a1703e]
and cx, cx
call fcn.01309c5b
jbe 0x19ecd45
mov ebp, 0x5534fd2
mov byte [edi + ebp*8 + 0x53636543], ah
dec esi
ror byte [edi + 0x53], cl
add eax, 0x43efa488
arpl word gs:[ebx + 0x4e], dx
push ds
test dword [0x80f181ea], ebp
wait
test esp, ebp
add dx, dx
lea ecx, [ecx + edx*2 + 0x28af202d]
xadd word [esp + edx*8 + 3], dx
jl 0x1b972b7
rol ecx, 1
shr byte [esp + edx*4 - 0xffa], 0xe1
rol dword [esp + edx*8 - 0x1ffc], 0x3c
call fcn.00ff0fc0
inc ecx
mov ebx, 0xeebe3f27
inc sp
mov ebp, dword [esi]
dec ebx
lea ebp, [ebx + ebx*8 - 0x546fed7]
mov edi, 0x3fae3395
mov cl, byte [esi + edi - 0x3fae3393]
dec eax
lea esi, [esi + edi - 0x3fae3393]
inc cx
sal ebp, cl
inc esp
movsx esp, bp
call fcn.019d7a07
mov ecx, 0x8b18ffaa
mov eax, dword [esi]
neg ecx
lea esi, [esi + ecx - 0x74e70052]
movsx edx, cx
jns 0x1a971d0
js 0x1a5146c
xor ebx, eax
neg cl
add ebp, eax
mov dword [esp + ecx*4 - 0x4eb44b8c], 0x8a380c23
rol word [esp + ecx*4 - 0x4eb44b8a], cl
movzx eax, cx
mov ecx, dword [edi + ecx*4 - 0x4eb44b8c]
mov eax, dword [edi + eax - 0x12df]
jb 0x19ecd19
call fcn.012f2b90
sub ebx, dword [ecx - 0x57]
fcom dword [edx + 0x526b5bff]
invalid
call fcn.01a8a6da
inc dword [esp]
jae 0x1abf36b
jbe 0x1a06daf
mov ebp, 0x24e41dd
mov byte [0x6263f8ba], al
fld qword [ecx + 0x4e]
add ah, byte [edx + 0x6263f8ba]
pop ss
push es
cmp al, 0xd1
xor cl, byte [esp + edx*2 + 0xf]
hlt
bswap edx
neg ecx
ror ax, 0xee
shl eax, 0x5e
rol edx, 1
not ecx
rol ecx, 1
call fcn.00fe269a
jmp fcn.00feaf67
xor eax, ebx
sar dx, 0xae
ror eax, 1
or edx, ecx
bswap eax
xadd ecx, edx
rol eax, 1
sal dl, 0x43
xor eax, 0xeba00119
imul ecx, ecx
dec eax
jmp 0x1a06d9d
sbb edi, 8
jmp 0xff3b61

Function at 0x19fdada
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jne 0x1002ed1

Function at 0x1a01455
Capabilities:
Encode data using base64

Disassembly:
and esi, 0xff
mov esi, dword [esi*4 + 0x1a0a51c]
mov dword [esp], 0x37994e8d
push 0x49a74ba2
neg dword [esp + 4]
shr ecx, 8
push 0x2852faf
jmp 0x1120323
push 0x290b929c
xor ecx, esi
inc eax
xor ecx, 0xd3b5e63f
call fcn.01a4f4df
xor esi, ecx
jmp 0x111e126
Function at 0x1a04719
Capabilities:
Execute syscall

Disassembly:
mov word [ecx + ebp - 0x7faf00af], ax
push ecx
xor edx, edx
pop ecx
pop ecx
pop edx
jp fcn.010b8be2
mov edx, 0x181175a9
lea ebp, [ebp + edx*4 - 0x6045d6a8]
lea ecx, [edx - 0x16f13879]
call fcn.010b25fc
sysenter
call fcn.01142037
mov edx, 0x762dff1a
movzx ax, byte [edi + edx - 0x762dff1a]
mov cl, byte [edi + edx - 0x762dff18]
sar edx, 0x76
call fcn.0117c9f0

Function at 0x1a19e48
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
not edx
mov dword [esp + ecx - 0x210887fe], 0x2cb05b99
ror edx, 1
xor edx, 0xf33ccf9c
bswap ecx
add edx, 0xc31c2129
neg edx
call fcn.0109de89

Function at 0x1a19ef4
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [esp + 0x2c]
call fcn.01306712

Function at 0x1a1da6a
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
je 0x1025025
push 0xea291023
jmp 0x1a1159c

Function at 0x1a24123
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp + esi - 0x73b6dc19], ecx
call fcn.01a30a15
sub edi, 4
mov eax, 0x6a3f5cb6
mov edx, dword [eax + edi - 0x6a3f5cb6]
mov ecx, 0xa38c8837
inc cl
xor edx, ebx
ror edx, 1
not edx
shl al, 0x83
lea eax, [ecx + 0x13223405]
neg ecx
neg edx
dec edx
sar cl, 0x41
inc cx
xor ebx, edx
sal ecx, cl
add esi, edx
movsx edx, cx
push ecx
rol cx, 5
mov bp, word [ebp]
dec al
jns 0x1115709

Function at 0x1a2cf1d
Capabilities:
Encode data using base64

Disassembly:
xor edx, edx
lea esi, [esi + ecx - 0x76985a04]
or edx, ecx
xor eax, ebx
sub eax, 0x23a7491a
not ecx
bswap eax
inc edx
inc eax
bswap edx
btr ecx, edx
bswap eax
neg cx
inc eax
rol eax, 2
btr ecx, ecx
dec eax
neg eax
sal edx, cl
ja 0x1a03af8
mov edx, 0x48ae3ca0
dec dx
movsx ecx, dl
mov edx, dword [edi + edx - 0x48ae3c9f]
btr ecx, ecx
lea edi, [edi + ecx - 0x7fffff9b]
ror cx, 0xaf
xor edx, ebx
sal cx, 0xab
lea edx, [edx + ecx*2 - 0x20778343]
neg edx
btc ecx, ecx
ror edx, cl
lea eax, [ecx + ecx + 0x2f8f4d1d]
xchg ecx, eax
neg ecx
xor edx, 0x8cb8f49c
xor ebx, edx
add esi, edx
mov edx, dword [ebp + eax - 0x7ffff801]
add eax, 0x1624022a
adc ebp, 4
shr eax, cl
btr ax, cx
push edx
popfd
lea edx, [eax*8 + 0x19bbd2f]
jmp 0x19c85f9
jmp esi
rol eax, 1
bt edx, edx
bswap eax
not edx
rol eax, 3
rol cx, 0xc7
not eax
push edx
call fcn.012f3b6c
sub ebp, 4
mov eax, dword [ebp]
mov ecx, 0x8a3a4da8
movsx edx, cl
xor eax, ebx
dec esp
mov esi, dword [esp + ecx - 0x49bcaa8c]
dec eax
mov ecx, dword [esp + ecx - 0x49bcaa84]
not dl
call fcn.0106e8f6
rol eax, 0xa7
cbw
mov edx, dword [edi]
lea ecx, [eax*2 - 0x237e7b7e]
and cl, ch
inc byte [esp + ecx*8 - 0x611c2420]
lea edi, [edi + ecx - 0xc238480]
js 0xfdfdbd
xor edx, ebx
rol cx, cl
sal dword [esp + ecx - 0xc234848], 0xe1
sub eax, 0x49303b3c
neg edx
ror edx, 2
lea ecx, [ecx + eax*8 - 0x347d8a73]
shl dword [esp + ecx - 0x4cabe4a5], cl
not edx
rol edx, 1
inc dword [esp + ecx - 0x4cabe4a5]
call fcn.01ae32be
mov eax, 0x9a9f288b
mov eax, dword [esi]
mov ecx, 0x76985a08
movsx edx, cl
jmp 0x12da3db

Function at 0x1a45bac
Capabilities:
Encode data using base64

Disassembly:
add eax, edx
mov dword [esp], 0xc20c4306
call fcn.0118537f
Function at 0x1a46f55
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rol ecx, cl
neg eax
shl cx, 0xe8
ror eax, 3
sub dword [esp + ecx - 0xaa20000], 0xa881b423
btc edx, edx
xchg dword [esp + ecx*2 - 0x15440000], ecx
neg eax
neg edx
rol eax, 1
shr dword [esp + edx*4 - 0x677f05b8], 0x5c
pop ecx
rol dx, 0xa3
xor ebx, eax
neg edx
bts ecx, ecx
and edx, edx
adc edi, eax
inc ecx
jp 0x112eeb4
mov eax, 0x71bc4638
jmp edi
shl ax, 0x43
adc ebp, ecx
lea ecx, [eax*2 + 0x52a7ff89]
movzx edx, byte [esi + edx - 0x1002f7]
lea esi, [esi + eax - 0x20fc5487]
xchg ah, cl
sal ecx, cl
adc dword [esp + eax*2 - 0x41f93310], 0xb2b8c625
xor dl, bl
add dl, 0xb0
ror dl, 1
bswap ecx
xchg cx, ax
neg dl
sub dword [esp + ecx - 0x9988], ecx
xor ecx, ecx
sar ecx, 0xb9
rol dl, 1
xor dl, 0x2b
rol cl, 0xa3
pop ecx
or eax, eax
adc dl, 0xaa
push ecx
xor bl, dl
inc ax
xadd dword [esp + eax*2 - 0x41f8810c], ecx
lea edx, [esp + edx + 4]
pop ecx
sbb al, ah
ror ecx, 0x2b
mov ecx, dword [eax + edx - 0x20fc4045]
movsx edx, ax
bswap eax
btr dx, ax
lea edi, [edx + edi - 0x4048]
mov dword [edi + eax - 0x4540fc20], ecx
or ax, ax
sal ax, 5
jp fcn.01002e95
pop edx
lea edx, [ecx + ecx*4 - 0x49df144a]
xor eax, 0x9c97d501
btr ecx, 0x19
jae 0x103ae89
lea esp, [esp + 8]
je 0x103e362
push 0xe7ba7436
push 0xd794bea8
push 0x361b8e9a
mov dword [esp + 8], esi
lea esp, [esp + 8]

Function at 0x1a47978
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*4 - 0x46112c94], 0x7f03ee24
movsx edx, byte [esp + ecx - 0x11844b22]
ror eax, 1
mov dword [esp + ecx - 0x11844b26], ecx
not eax
xadd edx, ecx
or dword [esp + ecx - 0x20], 0x34108c0e
not edx
bswap eax
xor eax, 0x55ad13a8
lea eax, [eax + ecx*2 - 0x6ea75e67]
push ecx
call fcn.019d62f7
Function at 0x1a56d36
Capabilities:
Encode data using xor

Disassembly:
add esi, eax
pop edx
jmp fcn.019f5515
jmp 0x1a67a1b
mov dword [esp + ecx - 0x2c2051ff], 0x11a77423
and dword [esp + ecx*2 - 0x5840a3fe], 0xd5384224
bswap eax
btr edx, 0x30
bt edx, 0xba
lea eax, [ecx + eax + 0x18fa17a0]
imul ecx, edx
bswap eax
setb dl
seto cl
setb cl
lea eax, [edx + eax - 0x63eed663]
imul ecx, ecx
or word [esp + ecx - 0x4f55c801], cx
inc ecx
xor ebx, eax
inc dword [esp + ecx - 0x4f55c802]
sar byte [esp + ecx - 0x4f55c802], cl
jb 0x103c213
mov eax, 0x2c9ca3a1
movsx edx, ax
cdq
lea ebp, [eax + ebp - 0x2c9ca3a5]
mov ecx, 0x393b8a88
inc edx
not cx
mov eax, dword [eax + ebp - 0x2c9ca3a1]
xor eax, ebx
sal dl, 0x26
imul ecx, edx
rol eax, 2
inc cl
sal cx, cl
inc edx
dec eax
inc cl
neg eax
rol dx, 0x2f
neg dx
rol eax, cl
jmp 0x12fbcec
xor ebx, eax
sub edx, edx
adc ecx, 0xb02f94b5
setb dl
lea edi, [edi + edx*2 - 4]
mov dword [edi + edx], eax
movzx eax, cl
lea ebp, [ebp + edx*2 - 4]
insb byte es:[edi], dx
push ebp
cld
mov ecx, dword [ebp + edx]
dec eax
xor ecx, ebx
sar dl, 0x61
rol ecx, 3
btr edx, edx
lea ecx, [ecx + edx*4 - 0x29b5b626]
idiv ax
inc ax
sub al, ah
ror ecx, 1
neg ecx
add edx, eax
setno dl
cmovno dx, ax
xor ebx, ecx
mul eax
adc esi, ecx
shr edx, 0xe7
jns fcn.019f5515
rol ecx, 1
call fcn.011a88a0
or ebp, dword [0x2c6cedd8]
lcall 0x2bbc, 0xe9125d82
sbb byte [ebp - 0x52412b0d], ch
enter 0xffffffffffffe140, 0x78
push ebx
jb 0x1a67a33
mov dword [0xc2b25ad1], eax
xchg dword [esi], ebp
lodsd eax, dword [esi]
ror dword [ecx - 0x52cb3168], 1
stc
out 0xca, al
push edx
and dword [ecx], edi
inc ebp
xor dword [ebp + 5], ebp
push ebp
pop esi
mov dl, 0xb1
in eax, dx
push 0xfa522733
jp 0x1a67afa
cmp eax, 0x7a371257
xchg esp, eax
adc ch, byte [ebp - 0x524b94cb]
push cs
xchg esi, eax
xlatb
invalid
sub eax, 0x1119f7ca
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
invalid

Function at 0x1a56e19
Capabilities:
Encode data using base64

Disassembly:
not byte [esp + edx - 0x3ffffb]
xor al, 0x2b
xor word [esp + edx*4 - 0xfffff7], 0x1820
adc al, 0xaa
xor bl, al
dec ecx
push ecx
lea eax, [esp + eax + 0x10]
mov ecx, dword [edx + eax - 0x3fffff]
movsx eax, byte [esp + edx - 0x3fffff]
btc edx, 0xb0
mov word [esp + edx*4 - 0xfbfffa], ax
lea edi, [edi + eax*4 - 0xc8]
mov dword [edi + edx*2 - 0x7dfffe], ecx
pop eax
pop edx
pop eax
pop ecx
jb fcn.01002e95
mov eax, 0x5db89ead
sar ax, 0x64
lea ecx, [eax + eax*2 + 0x4434fa9b]
fsub qword [ecx + ebp - 0x5d5fe859]
mov edx, eax
call fcn.011b4dfe
Function at 0x1a707f1
Capabilities:
Encode data using base64

Disassembly:
add edx, dword [esp + edx - 0x3e078a0f]
inc cx
lea edx, [eax*4 + 0x639b483a]
not cx
neg al
inc cx
xor bx, cx
push eax
lea edx, [edx + edx*2 + 0x3c812629]
mov dword [esp + eax - 0x49a1f53f], 0xe1054024
lea edi, [edi + eax - 0x49a1f545]
mov word [edi + eax - 0x49a1f543], cx
sal byte [esp + eax - 0x49a1f538], 0x45
pop edx
pop ecx
pop ecx
js fcn.01002e95
mov edx, 0x2d071c99
movsx eax, dx
mov eax, dword [esi + edx - 0x2d071c99]
dec edx
lea esi, [esi + edx - 0x2d071c94]
bt edx, edx
xor eax, ebx
bswap eax
shr dl, 0xc3
neg edx
lea eax, [eax + edx + 0x492fec7]
lea edx, [edx + edx*4 + 0x1d17d280]
btc edx, 0x80
shr edx, 0x3e
ror eax, 1
not eax
dec edx
xor dl, dh
xor ebx, eax
shr dx, 0xcd
sal dx, 0xe
add ebp, eax
movsx eax, dx
movzx eax, byte [esi]
add esi, 1
xor al, bl
or dl, dl
push edx
add dl, 0x9b
neg al
rol byte [esp + 3], 0x21
sbb al, 0xb1
or edx, edx
dec word [esp + 2]
not dx
xor al, 0x88
ror dl, 0xe1
inc al
sub edx, dword [esp]
neg al
btc edx, edx
adc edx, 0x281e091d
mov dword [esp + edx*2 - 0x5045109e], 0x3a0edfb7
xor bl, al
inc dx
lea edx, [edx + edx*4 + 0x2abafd30]
mov dword [esp], esi
sar dx, 0xa9
inc dl
push ebp
dec dx
adc dx, 0xbe38
push ebx
btr edx, edx
mov ebp, edi
call fcn.010ab284
jae 0x1a70930
invalid
add eax, dword [ebp + edx*4 - 0x42]
xor al, byte [edi]
shl dl, cl
pop edi
sahf
jo 0x1a708e0
xor edi, dword [esi + 0x23]
je 0x1a7099a
js 0x1a708c3
pop es
imul ebp, edi, 0xffffffed
int 0x62
daa
xlatb
ret 0xbec3
hlt
test ch, bh
jns 0x1a70988
invalid

Function at 0x1a72c26
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xc998238
add esi, eax
call fcn.019dbf9a
Function at 0x1a772b6
Capabilities:
Encode data using base64

Disassembly:
ror byte [esp], 0x23
mov dword [esp], ebx
push edx
cpuid
jae 0x1a06da2
mov eax, dword [esi]
mov dword [esp], edx
inc word [esp + 2]
js 0x1ad437f
arpl word [ecx], ax
scasb al, byte es:[edi]
clc
push ebx
dec ecx
adc edx, dword [ebp + 0x776df88c]
push ebx
push ecx
push esp
sbb al, dh
mov edx, 0x86128e8b
dec ecx
sub esi, 4
movsx ecx, dl
movzx ebx, dx
inc esp
movsx esp, cx
inc ecx
mov ebx, dword [esi + ebx*2 - 0x11d16]
dec esp
lea ebp, [ecx + ecx*2 - 0x84f3b41]
call fcn.01035bd7
shr dword [edi], 1
call 0xb26a2622
jbe 0x1a772b9
adc dword [ecx], esp
test al, 0xf9
insb byte es:[edi], dx
lodsb al, byte [esi]
leave
rcl dword [edx + 0x7229d153]
imul ebp, dword [ebp + edx*8 + 0x7d], 0xece9854e
js 0x1a77328
jg 0x1a77379
ljmp 0x4f13:0xf0a3cb2
cmp al, 0xa
movlps qword [edi + 0x5a], xmm1
mov dword [0x5c15ac4a], eax
in al, dx
lodsb al, byte [esi]
scasb al, byte es:[edi]
pop es
lock add dword [ebx + 7], esi
movsd dword es:[edi], dword [esi]
pop ecx
or byte [ebx - 0x5383f03c], dh
xlatb
iretd
iretd
add esi, 4
xor eax, ebx
inc eax
shl dword [esp], 0xd1
movsx ecx, dx
sbb cl, dh
not eax
and ecx, dword [esp]
inc eax
add dl, dl
shl word [esp + 2], 0x64
xor eax, 0x7f8a483d
sub cx, 0x4e8d
xchg cl, dl
xor ebx, eax
add ebp, eax
mov eax, dword [edi]
rol ecx, 0xc8
inc edx
sar edx, 0x94
mov ecx, dword [edi + ecx*4 - 0x32c43204]
btr dx, 0xc
jb 0x10450ae
rol edx, 2
neg edx
neg eax
setp cl
rol edx, 1
dec cx
sete al
setnp al
bswap edx
xor ebx, edx
ror eax, cl
or cx, ax
adc esi, edx
movzx edx, al
add cl, dh
xor edx, esi
jmp edx

Function at 0x1a8062f
Capabilities:
Encode data using base64

Disassembly:
jp fcn.01002e95
add esi, 1
bswap ecx
ror ecx, 0x62
setb byte [esp + 0xd]
xor al, bl
bt cx, 0xb4
push ecx
neg al
sub dword [esp], 0x842ca726
neg ecx
dec ecx
not al
shr cx, 0x46
js 0x12f218e
ror al, 1
shr ecx, cl
sbb ecx, 0x76af4101
sub dword [esp + 0x12], ecx
not al
rol ecx, cl
adc al, 0xb0
xchg word [esp + 2], cx
xor bl, al
lea eax, [esp + eax + 0x18]
sub cl, cl
sal ecx, 0x4b
mov dword [eax + ecx - 0x57e80000], edx
mov dword [esp + ecx - 0x57e80000], ebp
ret 0x14

Function at 0x1a915ae
Capabilities:
Encode data using base64

Disassembly:
adc ax, 0x2086
cwde
inc ecx
xor ebx, ecx
add ebp, ecx
mov dword [esp + eax*8 - 0x36740], 0x2f0ef811
pop eax
pop ecx
pop ecx
jmp fcn.01002e95

Function at 0x1a91d8b
Capabilities:
Encode data using base64

Disassembly:
add esi, 4
push 0xc1a5aa0e
mov eax, 0x8136313f
mov dword [esp + 8], eax
xor edx, ebx
sub al, byte [esp + 0xb]
movzx ecx, ax
sbb ecx, ecx
rol edx, 2
shr cx, 0x24
not edx
sar ecx, cl
not cx
bswap ecx
inc edx
or ecx, dword [esp + ecx*2 - 0x1fffe]
and eax, dword [esp]
xor edx, 0x2d8b80bb
neg cl
sub eax, dword [esp]
adc ax, word [esp]
ror edx, cl
bts ecx, 0x10
inc edx
xor ebx, edx
inc cl
bswap eax
lea ecx, [eax + 0x153b9317]
add ebp, edx
movzx edx, byte [esp + eax - 0xf207eb7]
mov eax, edi
not dx
not dl
sub edx, dword [esp + ecx - 0x245c11ce]
lea edi, [edi + edx - 0x7ecace02]
add dl, 2
mov word [edx + edi - 0x7ecace02], ax
pop eax
pop eax
pop edx
ja fcn.01002e95
Function at 0x1a94b14
Capabilities:
Encode data using xor

Disassembly:
ret 0xdaf6
inc ecx
push ebp
dec esp
mov ebp, dword [esp + ecx*2 - 0x122]
dec esp
mov esi, dword [esp + ecx - 0x55]
pop edx
dec eax
mov dword [esp + ecx - 0xa5], 0xcc3b089d
dec eax
mov ecx, dword [esp + ecx*4 - 0x2a4]
dec eax
mov dword [esp + edx - 0xebd7], 0xf730882f
call fcn.01aeced3
pop edx
jo 0x1a94ad2
sub eax, 0x13333fb
sar dl, cl
and esp, dword [eax + 0x3d]
fcmovb st(0), st(3)
push es
invalid

Function at 0x1aa4845
Capabilities:
Encode data using base64

Disassembly:
push 0xd91ae423
shr dword [esp], 0xf6
test ebx, ebx
call fcn.011df31c

Function at 0x1aa7768
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xb28dc790
mov ecx, eax
sub edi, 4
movzx edx, al
shl cl, 0xa3
mov ecx, dword [edx + edi - 0x90]
shr eax, 0x2c
xor ecx, ebx
lea edx, [edx*2 - 0x704a57f5]
and dl, 0x97
bswap eax
bswap ecx
shl dl, 0xe5
push eax
sbb ecx, 0x9592ec24
inc ax
and dx, 0x431c
not ecx
shr edx, 0x9a
lea ecx, [eax + ecx - 0x1afa9373]
cwd
bswap edx
adc byte [esp + edx + 1], 0x86
rol ecx, 1
xor ecx, 0xfc34acac
not al
xor ebx, ecx
idiv eax
add ebp, ecx
cwde
and dx, word [esp + edx*2 - 0xa30a7e2]
mov ecx, dword [esi + edx - 0x5185020]
neg ax
not al
call fcn.01adcea8
push 0x21be0b94
call fcn.0107b534
jmp 0x116af9c

Function at 0x1aabd3a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], eax
sub esi, 4
not al
mov ecx, dword [esi]
xor ecx, ebx
movzx edx, word [esp]
lea ecx, [ecx + eax*2 - 0x5cb8d0c3]
jmp 0x19a40e6

Function at 0x1aade55
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jne 0x111bb04
dec ebx
jmp 0xfffad7

Function at 0x1aae80b
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [eax + ebp - 0x63de00ba]
or ecx, 0x59aa8a94
mov word [ebp + ecx - 0x7fef9f95], dx
jmp esi
xor ecx, 0xa4394b82
not ecx
mov dword [esp + eax - 0x63de8d55], edx
dec dx
bswap ecx
xor ecx, edx
not ax
pop edx
bswap ecx
sar edx, 0x66
xor ebx, ecx
add esi, ecx
imul dx
add dx, ax
mov ecx, edx
mov ecx, dword [ebp + eax - 0x63de5800]
and ax, 0xdf2e
mul dl
cdq
or dl, byte [eax + ecx - 0x63de0000]
add al, 0xbc
lea ecx, [eax*2 - 0x614cec77]
jnp 0x10dda1b

Function at 0x1ab64f1
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0xa1301511
shr eax, 0xed
mov eax, dword [ebp + ebx*4]
call fcn.0108b261
call fcn.0117b61e
lea esp, [esp + 0x10]
jne 0x11bf575
mov eax, 0x90a2b79d
lea eax, [eax*2 - 0x706b337b]
cwde
mov eax, dword [ebp + eax*8 - 0x1ddf8]
call fcn.01a870d8
Function at 0x1ac3646
Capabilities:
Encode data using base64

Disassembly:
push 0x6ab160b2
call fcn.019dfba5
xor ebx, ecx
bts dx, 0xb2
add edi, ecx
movzx ecx, dx
mov word [esp + ecx - 0x99cc], 0x49bb
mov eax, dword [ebp + ecx - 0x99ce]
or edx, edx
sub byte [esp + ecx - 0x99cc], cl
mov cl, byte [ebp + ecx*8 - 0x4ce6c]
not dx
adc ebp, 1
and dx, dx
or dl, 0xa9
sal eax, cl
sar word [esp + 1], 0xa2
mov ecx, edx
mov dword [ebp], eax
mov eax, 0x873e0d9c
call fcn.0114ed32
mov eax, dword [edi]
add edi, 4
call fcn.010bd157
mov ecx, dword [ebp + ecx - 0x49095dd0]
xor ecx, ebx
neg edx
not ecx
call fcn.01af00fb
or edx, esi
jmp edx
mov esi, 0x330d6906
movzx esi, byte [esi + ecx - 0x330d6906]
jmp 0x11b24da
mov ecx, dword [edi + edx - 0x5e3452a0]
cwd
cwd
xor ecx, ebx
push eax
shr byte [esp + edx - 0x5e34fffd], 0x81
neg ecx
shr edx, 0xd1
sar ax, 0x23
not ecx
div eax
neg edx
inc ecx
ror byte [esp + eax*2 - 0x869d], 0x61
sar dx, 0x23
not ecx
and dl, byte [esp + eax*2 - 0x869e]
xor ebx, ecx
bts eax, 0x93
xor eax, dword [esp + eax - 0x8434f]
xor edx, eax
adc ebp, ecx
movsx ecx, dx
cbw
mov dword [esp + edx - 0x30a1734d], ebp
ret
dec edx
lea esp, [esp + 0x24]
jne 0x19ea8a7
mov ecx, 0xd3290a2d
xor cl, 0xb3
sbb ecx, ecx
pop esi
not eax
mov edx, 0x5e3494a8
mov dword [edx + esi - 0x5e3494a8], eax
mov eax, 0xb3258b02
shl dx, 0xa2
lea edi, [edi + edx - 0x5e3452a4]
jae 0x1a9d517
mov eax, dword [edi]
mov edx, 0xec1e5e97
mov ecx, dword fs:[eax]
and dl, dh
adc dx, dx
mov dword [edi], ecx
lea ecx, [edx*4 - 0x677192df]
push ecx
lea ebp, [ebp + ecx - 0x49095dd5]
movsx eax, byte [esp + ecx - 0x49095dd1]
dec cl
jle 0x1312dad

Function at 0x1acef5e
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp]
jmp 0x1141727
push 0x9f1d0cb3
lea esp, [esp + 0x14]
je 0xfffae1
mov eax, 0x500d942f
bswap eax
inc al
mov eax, dword [ebp + ebx*4]
call fcn.010b4661
push 0xd439113b
not dword [esp]
lea esp, [esp + 4]
call eax
mov ecx, 0x8d340e9e
movsx ebx, cx
movsx edx, cl
mov ebp, dword [ebp + ebx*2 - 0x1d40]
push ebx
mov dword [ebp + ebx - 0xe9e], eax
jmp 0x19aad7c
mov dword [esp], 0x3594719f
adc eax, edx
push 0x1efa3b
push 0x348c9c81
mov dword [ebp - 4], eax
test ebx, ebx
not word [esp + 6]
jmp 0x111baf5