joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10a042c
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], dx
push eax
push eax
sar dword [esp + 1], 0xcf
mov eax, dword [esi]
call fcn.01037649
mov dl, byte [edx + edi - 0x11ed777b]
rol cl, 0xc2
adc edi, 6
mov byte [eax], dl
call fcn.0112a778
xor edx, 0xb9108dbd
pop eax
rol cx, 0x2f
call fcn.0102b84b
mov eax, 0x970be300
mov edx, dword [ebp]
jmp 0x116bbdf
shr cx, 0x8c
mov cx, word [ebp + edx*4 - 0x44711294]
dec dx
lea ebp, [ebp + edx - 0x111c449f]
mov dword [esp + edx*4 - 0x44711294], edx
lea edx, [edx + edx*8 + 0x233b311f]
neg dx
mov word [eax], cx
adc byte [esp], 0xac
movsx ecx, dl
mov eax, dword [esi + ecx*8 - 0xa0]
call fcn.00fd8537
mov eax, 0x5aa4d39
lea ecx, [eax + eax*2 - 0x4ac10ee3]
inc ecx
mov eax, dword [eax + esi - 0x5aa4d39]
rol ecx, cl
lea esi, [ecx + esi - 0x7bb19388]
shl cx, cl
xor eax, ebx
mov edx, ecx
dec eax
not eax
shl ecx, 0xde
sal ecx, 0x82
bswap eax
or edx, edx
inc cx
or ecx, edx
rol eax, cl
shr edx, cl
bswap eax
inc dx
and ecx, edx
lea eax, [ecx + eax + 0x55f272ad]
or dx, 0xe533
neg edx
push edx
not eax
neg eax
push edx
sal byte [esp + ecx*2 - 0x73217ffb], 0x63
sbb eax, 0xfc9777a6
sal dl, cl
bswap edx
or edx, dword [esp + ecx*2 - 0x73218001]
xor ebx, eax
or ecx, edx
adc edi, eax
or word [esp + 2], 0xddad
mov eax, ebp
inc edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sar edx, 0xb2
shr word [esp + 6], 0xa7
mov eax, dword ss:[ecx]
jns 0x1130fc3
sub edi, 2
not al
jmp 0xae4fbd
pop ecx
jae 0x11abbc0
dec ecx
sub esi, 4
mov ecx, 0x461b368d
inc edx
mov eax, dword [ecx + esi - 0x461b368d]
inc esp
movzx ecx, cl
movzx edx, cx
xor eax, esi
inc esp
movzx edi, dl
lea eax, [eax + ecx*2 + 0x20742cf0]
xor eax, 0x22250a7
bswap eax
dec eax
rol edx, 0xa7
inc ecx
push edi
inc eax
inc ecx
push edi
inc cx
not ecx
neg eax
call fcn.00b583fb
inc ecx
mov ebp, 0x6308039c
inc ebp
movzx esp, ch
dec ebx
mov edx, dword [ebp + ebx - 0x6308039c]
inc ecx
mov ebx, ebp
push ebx
dec ebp
mov ebp, dword [ebp + edx - 0x6308039c]
dec edi
mov dword [esp + ebx - 0x9c], ebp
dec edx
rol dword [esp - 0x138], 0x92
inc ecx
push esp
call fcn.00fde333
mov edx, 0xa2bbdbbb
mov eax, edx
inc ax
mov edx, edi
push eax
jne 0x10a2918
mov edx, 0xf6bb4537
lea eax, [edx*4 + 0x26bbaaac]
xchg dx, ax
mov eax, dword [edi + eax - 0x1a84537]
mov ecx, 0xa5932599
rol edx, cl
jb 0xb9824c
mov dword [ebp - 4], eax
adc ebp, 0xfffffffc
push ecx
jmp 0x119de0f

Function at 0x10a19db
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp + eax - 0x6f2eb2fb]
sal dword [esp + 6], 0xe2
je 0x118fb03
add ebp, 4
xchg dword [esp + 8], edx
or ecx, eax
lea eax, [edx + edx - 0x56c19d7e]
pop eax
movzx eax, dl
not ecx
add word [esp + edx - 0x6f2e380a], ax
sbb dword [esp + edx - 0x6f2e3809], edx
shl al, 0xe2
mov dword [ebp + eax*2 - 0x60], ecx
shr edx, 0xb7
call fcn.00af386d
lea esi, [esi + 0x62]
jp 0x10a1a30
mov al, byte [0x3f9e956f]
and edi, dword [eax + 0x2f9e956f]
outsd dx, dword [esi]
xchg ebp, eax
sahf
das
cmp eax, 0x9e956f9c
pop ss
sub edx, dword [edi + ebp*2 + 0x1d019e95]
push edi
invalid
mov dword [esp], edx
call fcn.0117acf4
Function at 0x10a538d
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x8ba1751a
mov ecx, dword [esi]
add esi, 4
mov dword [esp], edx
xor ecx, ebx
lea ecx, [ecx + edx + 0x297c0473]
movsx eax, dl
rol ecx, 1
xchg dx, ax
push edx
not ecx
shr byte [esp + eax*4 - 0x1d461], 0xa1
not dword [esp + eax - 0x7516]
dec ecx
or word [esp + eax - 0x751a], 0xb139
pop eax
sal dword [esp], 0xae
xor ecx, 0xdd1ec43c
dec al

Function at 0x10a963a
Capabilities:
Encode data using base64

Disassembly:
inc ecx
push ebp
dec eax
mov dword [esp + eax - 0x69ff23fb], 0xcf97ca1e
dec edi
mov esp, dword [ebx + ecx - 0xda7c7cd]
inc ecx
mov edx, 0x898fb594
dec ecx
dec ecx
dec eax
xadd ecx, ebx
inc ecx
mov eax, dword [ebx + eax - 0x69ff23fb]
dec eax
bswap ecx
dec edi
lea ebx, [ebx + ecx*2 - 0x1b4f8f8c]
inc esi
movsx eax, byte [esp + ecx - 0xda7c7ca]
inc edx
sbb dword [esp + ecx*8 - 0x6d3e3e5b], ebp
inc esi
xadd byte [esp + ecx - 0xda7c7c3], dl
inc ebx
mov dword [esp + ecx - 0xda7c7cc], eax
jbe 0x116d4e1
iretd
pop eax
bnd jbe 0x116d4e1
add byte [edi + 0x44], al
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebp + 0x76424294], cl
lea edx, [edx + eax*2 + 0x7e377642]
invalid
retf 0x84c1
inc edx
loop 0x10a9627
jecxz 0x10a95dd
adc ecx, 0x2a822e0f
call fcn.0100914f
call fcn.01165cf7
inc edx
shl byte [esp + ecx*4 - 0x369f1f26], 0x61
inc ecx
movsx eax, bp
dec edx
mov dword [esp + ecx - 0xda7c7cc], edi
ret 8
Function at 0x10abe3e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [eax + esi*2 - 0x6018ef8]
mov dword [edi + ebp - 0x7fc7f09c], ecx
lea esp, [esp + 8]
lea esp, [ebp + esi - 0x300c780]
shr edi, 0xd8
pop ecx
lea ebx, [edi*2 - 0x87ce873]
not bx
pop ebp
lea eax, [esi*8 + 0x1b094d08]
pop eax
push edi
mov edi, dword [esp + esi - 0x300c778]
inc bx
push ebx
push dword [esp + 0xc]
popfd
mov dword [esp + esi - 0x300c770], 0x31ab092a
push ebx
lea esi, [esi + ebx*2 - 0x57c5bbc4]
mov esi, dword [esp + 0x14]
pop ebx
mov edx, 0x6ea3fc8d
mov edx, dword [esp + edx - 0x6ea3fc79]
lea ebx, [ebx + ebx*2 - 0x37e0677b]
xchg word [esp], bx
xchg byte [esp + 2], bl
mov ebx, dword [esp + 0x18]
jmp 0xfa7b50

Function at 0x10b1407
Capabilities:
Encode data using base64

Disassembly:
push ecx
inc eax
not ecx
ror eax, 3
lea edx, [ecx*4 - 0x4ad6815e]
bswap eax
mov dword [esp + 4], 0x6bbf0408
jmp 0xfff05c

Function at 0x10b2a46
Capabilities:
Encode data using base64

Disassembly:
sub cl, al
ror cl, 1
push eax
call fcn.00fa2ddc

Function at 0x10b505a
Capabilities:
Encode data using base64

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.00fd522b
mov ecx, 0x30bedfb7
movzx eax, byte [esi + ecx - 0x30bedfb7]
lea esi, [ecx + esi - 0x30bedfb6]
lea edx, [ecx + ecx - 0x327d0b66]
xadd dx, cx
jae 0xb03cc0
xor al, bl
jmp 0xad07d7

Function at 0x10b6c2f
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + ecx - 0xe833], edx
dec edx
lea ebp, [ecx + ebp*4 + 0x17229512]
dec ebp
arpl di, di
dec ecx
sar ebp, 0x9c
inc si
sbb dword [esp + ebp - 8], esp
dec ecx
add edi, edi
dec edi
mov edi, dword [ebx + ebp*4 - 0x38]
dec edx
rol dword [esp + ebp - 0xe], cl
inc edx
shl byte [esp + ebp*2 - 0x1a], 0x61
inc di
movzx ecx, byte [edi + ebp - 0xe]
dec esi
lea edx, [ebp + eax*8 + 0x3b3ceb16]
inc edx
add dword [esp + ebp - 0xc], ebp
dec edi
lea ebx, [ebx + ebp*4 - 0x32]
dec ebp
and edx, esp
call fcn.00b53a8a
xor ebx, edx
call fcn.0117353e
Function at 0x10b7906
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
rol edx, 0xad
adc ebp, eax
jmp ebp
mov ecx, eax
dec edi
mov dword [ebp + ebx - 0x6bbb], esp
inc ecx
shr edi, 0x4b
jmp edi
bswap ecx
rol eax, 1
dec eax
xor dl, cl
neg edx
ror eax, 1
and dx, 0xa08c
sal edx, 0x77
jae 0xffdb7b
movzx ecx, byte [ecx + esi - 0x11989f50]
pop edx
sub esi, 0xfffffffb
mov edx, dword [esp + 0xa]
xor cl, bl
ror dx, 0xee
dec cl
push edx
lea edx, [edx - 0x7978415e]
or dword [esp + edx - 0x7e992120], 0xfc3cec2c
xor cl, 0x98
xor word [esp + edx - 0x7e992111], dx
pop edx
ror cl, 1
call fcn.00fb959f
mov edx, 0x42fe80b
lea esi, [edx + esi - 0x42fe80f]
add edx, 0xe0ad9526
movzx ecx, dx
mov eax, dword [esi + ecx - 0x7d31]
lea edx, [ecx + 0xe2c69ad]
rol ecx, cl
xor eax, ebx
add edx, edx
xchg ch, cl
ror eax, 2
bswap eax
jmp 0x118e69e
lea edx, [edx*4 - 0x547d3e7b]
push edx
not eax
pop edx
ror eax, 1
neg eax
xchg cx, dx
xor ebx, eax
sar cx, 0xc8
add edx, 0xc4bba584
adc ebp, eax
call fcn.00b71337
mov edx, 0xa692749f
lea eax, [edx*8 - 0x7acbddf8]
and dl, al
fld qword [edi]
jg 0x102cb73
adc dx, ax
sub esi, 4
xadd edx, eax
mov eax, dword [esi + edx - 0x605a0200]
jae 0xb1459c
xor eax, ebx
mov ecx, edx
ror ecx, 0xf4
lea eax, [eax + edx*2 - 0x1a052076]
inc ecx
rol eax, 3
sar edx, cl
xor eax, 0x42ba4114
shr cx, cl
ror dx, 0xa2
lea eax, [eax + edx - 0x3407488b]
jns 0x10b0a5b
inc ebp
or al, bh
add ax, 0xec06
dec ebp
mov esp, dword [eax + edx - 0x6bef]
jbe 0x1012b3b

Function at 0x10b7f56
Capabilities:
Encode data using base64

Disassembly:
add edi, edx
mov dword [esp + 8], 0x989f5439
add ax, word [ebp + 2]
add ebp, 4
mov ecx, dword [esp + 9]
call fcn.010b7906

Function at 0x1120fe7
Capabilities:
Encode data using base64

Disassembly:
add edx, 0x23b4339
lea ecx, [ecx + edx*2 - 0x62a5208c]
or al, byte [esp + edx*2 - 0x47685f7]
dec ax
rol ecx, 2
jmp 0xb836a7
call fcn.00fa5b21
pop ecx
mov dword [edi + ecx - 0x16578757], eax
lea ecx, [ecx + ecx*8 - 0x1c25d6f]
movsx edx, cl
sub esi, 4
shl ecx, cl
add ecx, 0xd13c8b1
push ecx
mov ecx, dword [esi]
xor ecx, ebx
mov eax, edx
jmp 0xb6493e

Function at 0x112731c
Capabilities:
Encode data using base64

Disassembly:
movzx edx, byte [edx + esi - 0x6d200000]
shl cl, 0xa7
mov dword [esp + eax - 8], 0x233365a4
lea esi, [esi + eax - 7]
call fcn.00b5ac28

Function at 0x113b309
Capabilities:
Encode data using xor

Disassembly:
daa
out dx, eax
inc dword [ebx]
add ebp, ecx
dec eax
invalid
invalid
invalid
add ebp, ecx
dec eax
sub byte [esp + eax - 0x4928522a], al
mov eax, dword [esi + eax - 0x49285239]
adc esi, 0xfffffff8
xor eax, ebx
mov dword [esp], edx
sar edx, 0x9b
dec eax
xor eax, edx
movsx ecx, dx
neg eax
neg cl
sub eax, 0xc711f40f
call fcn.00b4fab7
cmc
mov cl, 0xa2
xor eax, 0x99545483
mov esi, 0x1ceb82a3
jno 0x113b306
mov dword [0x31bd8c82], eax
mov esi, 0x4d3b82a3
mov eax, dword [0x4a82a3be]
ljmp 0xadcc
Function at 0x1141342
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
bswap edx
inc edx
add eax, 0xadacd2a5
bswap edx
add word [esp + 2], ax
movzx ecx, ax
call fcn.01155688
inc ecx
not edx
dec eax
mov dword [esp + ebx + 0x19a20fc0], esi
inc esp
movsx eax, ax
call fcn.0111dffa
inc ebp
movsx edi, al
inc edx
xor dword [esp + eax], ecx
call fcn.00f9992b
adc cl, ch
neg ecx
not eax
jg 0x1125f9c
dec esp
mov edx, dword [esp + 0x30]
inc ebp
movzx esp, ch
dec edx
mov ebx, dword [esp - 0x66]
dec esi
mov dword [esp - 0x240], esp
inc ebp
or ah, ah
dec edx
mov dword [esp - 0x4e0], 0x4a1288bb
dec esi
mov edi, dword [esp - 0x238]
call fcn.010b663a
rol ecx, 1
xor ecx, edx
rol ecx, 1
shr edx, 0x43
pop eax
push eax
xor ebx, ecx
shr eax, 0xf
and dx, word [esp + edx - 0x1ffffffc]
adc edi, ecx
mov dword [esp + edx*4 - 0x7ffec1ec], edi
ret 4
not edx
and eax, edx
mov dword [esp + ecx - 0x6c67734d], 0xbb9e5226
mov dword [edi + ecx - 0x6c677349], eax
or dword [esp + ecx - 0x6c67734d], ecx
movzx edx, byte [esi + ecx - 0x6c67734e]
not cl
jns 0x11a9e7e
sar dword [esp + ecx - 0x6c6773b2], cl
xor dl, bl
jmp 0x1141372
mov dh, 0x3c
and al, 0xe9
ljmp 0x4c7
dec eax
invalid
invalid
sub dl, 0x96
movsx eax, cl
sal ecx, 0x6a
sbb ax, cx
not dl
not dword [esp]
call fcn.01134eda
and dword [edi + 0x7c], edi
jp 0x114133a
add byte [esi - 0x75], ah
sahf
xchg ecx, eax
wait
or al, 0x66
mov ebx, dword [esi + 0x6618b983]
mov ebx, dword [esi + 0x6628a79f]
mov ebx, dword [esi - 0x31344445]
in eax, 0x9e
mov esi, 0xb39345fc
popal
aaa
xchg esp, eax
dec edx
mov al, byte [0x2043cb80]
jbe 0x11413fa
adc dl, bl
push ebx
jo 0x11413b9
pop dword [0x56188e14]
push es
push ebp
int1
pop ebx
sbb byte [ebx - 0x23], dl
invalid
stc
sahf
push edx
add byte [edx + 0x750e749d], 0x7c
cmp al, 0xb9
and al, 0x39
jnp 0x1141411
and dl, byte [ecx]
pushfd
mov bh, 0x8a
invalid
cld
int3
sar word [esp + eax - 0x766e92e4], 0xc1
jno 0xff2220
xor edx, ebx
xor edx, 0xa0081c9f
bswap edx
push eax
bswap eax
neg edx
sar word [esp + 2], 0x61
push eax
jp 0xb0c9c3
Function at 0x1143211
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + edx - 0x10b078b2]
xor edx, 0x65345caf
ja 0xb80539
mov byte [esp], pe_nt_image_headers32
mov dword [edi], eax
mov dword [edi - 4], edx
sbb edi, 4
inc cx
inc cl
pop ecx
jg fcn.00fa3df3
dec edx
xor eax, ebx
xadd edx, ecx
rol eax, 2
or edx, ecx
jb 0xb150bc
not eax
not ecx
or dx, cx
ror eax, 1
call fcn.01174fb3
xor ecx, 0x9b8cd108
xor ebx, ecx
dec byte [esp + edx - 0x40211bb6]
add ebp, ecx
movzx dx, byte [edx + edi - 0x40211bb7]
rol eax, 0x63
shr word [esp + eax - 0x2dc00003], 0x2f
mov cl, byte [eax + edi - 0x2dc00003]
push eax
lea edi, [edi + eax*2 - 0x5b800008]
call fcn.0117c44c
mov edx, 0x10b078b6
fmul qword [ebp + edx*4 - 0x42c1e2d8]
movzx eax, dx
lea ecx, [eax*2 + 0x5bacd22e]
inc ecx
mov eax, dword [esi + edx*4 - 0x42c1e2d8]
jns 0xb1353d
bswap ecx
shl eax, 0xd2
neg ax
mov dword [esp + edx - 0x40211bb7], 0xee13fdb4
inc ecx
add eax, eax
jg 0xfb5362
lea eax, [ecx + ecx*4 - 0x61f0a9dd]
lea edx, [edx + ecx - 0x3605f874]
ror dword [esp], 0xde
xor ebx, edx
add ebp, edx
dec dword [esp]
sub eax, 0x432d6a3f
xchg ecx, eax
rdtsc
jno 0xb28568
dec esp
outsb dx, byte [esi]
bound esp, qword [ecx + 0x5a]
push 0xfe3c4865
jae 0x11432dd
daa
mov edx, dword [edi + ecx - 0x9eab]

Function at 0x114ef1b
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + 0x7a0ea838]
lea edi, [edi + ecx - 0x744dc840]
pop ecx
pop eax
pop eax
pop edx
pop edx
pop ecx
pop edx
jbe fcn.00fa3df3

Function at 0x114f23c
Capabilities:
Encode data using base64

Disassembly:
mov edi, dword [esp + 4]
lea esp, [esp + 8]
call fcn.010b48fb
Function at 0x114f249
Capabilities:
Encode data using base64

Disassembly:
inc edx
mov cl, byte [edx + ebx - 0xbb]
jae 0xb807f4
add ecx, eax
dec edx
push ecx
neg dword [esp + eax - 0x4411]
setns byte [esp + eax - 0x4411]
ror edx, 1
or eax, dword [esp + eax*8 - 0x22088]
add cx, 0x8200
bswap edx
jp 0x116faba
mov ecx, 0x2cb2cab2
mov edx, dword [esi + ecx*2 - 0x59659564]
mov eax, ecx
lea esi, [esi + ecx*2 - 0x59659560]
xor edx, ebx
or ax, cx
ror edx, 3
rol eax, cl
not ecx
lea edx, [edx + eax*2 - 0x673bd9b1]
not edx
call fcn.00b4a314
call 0xfc963c
xor edx, ebx
lea edx, [edx + eax - 0x751738cd]
xor cl, cl
neg edx
xor ecx, eax
bswap edx
rol edx, 1
jmp 0xb4d258
inc esp
movzx esp, dx
inc ecx
bswap edx
inc ecx
push esp
inc ecx
mov ecx, 0x95a7e123
inc ecx
inc edx
dec esp
mov dword [esp + edx*2 - 0x172], ebp
movzx eax, dl
inc ecx
neg edx
inc ecx
xor edx, 0x201c939c
dec eax
lea eax, [ebx*4 + 0x468ddd80]
dec eax
mov dword [esp + edx - 0xad], esi
inc ecx
movsx esi, cl
movzx ebp, byte [esp + edx - 0xb5]
inc esp
xor dword [esp + edx - 0xad], edx
sal byte [esp + edx*4 - 0x2f4], 0x46
inc si
dec eax
mov esi, dword [esp + edx - 0xad]
dec ebp
arpl dx, dx
or bx, 0x5782
dec eax
bswap eax
dec ecx
adc edi, edx
inc cx
shr esp, 0x6d
dec edi
lea ecx, [edi + ebp*8 - 0x6a448259]
inc bp
mov ebp, dword [ebx + edx - 0xbd]
jae 0xb28ae5
mov edx, 0x1e9f4432
jmp 0x117dacf
xor ebx, edx
call fcn.0100e441
mov eax, edx
fmul qword [edi + edx*2 - 0x3d3e8864]
add ax, dx
and ax, 0x56aa
sbb eax, edx
mov edx, dword [edx + esi - 0x1e9f4432]
not eax
movsx ecx, ax
lea esi, [eax + esi - 0x440d]
sal cx, 0xa7
jne 0xfb6bb9

Function at 0x1151b60
Capabilities:
Encode data using base64

Disassembly:
movzx edx, ax
sub ax, ax
mov ecx, dword [edx + esi - 0x3140]
and edx, dword [esp + edx - 0x313e]
lea esi, [esi + edx*2 - 0x61fc]
or eax, dword [esp + edx - 0x30f2]
call fcn.010346c6
mov dword [esp + 0xc], eax
neg cl
sar al, 0x61
lea eax, [eax*8 - 0x405a87d8]
mov dword [esp], eax
rol cl, 1
xor bl, cl
and al, byte [esp + 9]
push eax
lea ecx, [esp + ecx + 0x14]
mov word [ecx], dx
jns 0xad5f76

Function at 0x1151b89
Capabilities:
Encode data using base64

Disassembly:
call fcn.011660a5
push ebx
ja 0x1151bd2
imul bx, word [ecx + 0x41], 0xe50f
jl 0x1151c17
daa
sub al, 0x9d
and dword [edx], edx
mov dh, 0x11
Function at 0x1154f58
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.010aa4f1
mov ecx, 0x638f8600
pop ebp
add byte [ecx + 0x638f8600], bh
mov edx, ecx
mov eax, dword [esi + ecx - 0x638f8600]
movsx edi, cl
xor eax, ebx
rol di, 0xab
ror eax, 2
xor cl, ch
not eax
sets dl
neg eax
sub eax, 0xdba0f998
bswap eax
or edx, edx
jae 0xf9bf66
inc ebx
imul esp, dword [edx + 0x77], 0x42667d5d
cmp ecx, ebp
adc byte [ebx - 0x6cfb45fa], cl
pop es
jg 0xad8ab6
push cs
cmp byte [esi - 0x3f3cccca], cl
stc
inc ebp
rol cl, 6
shl ecx, 0x24
lea eax, [eax + edx - 0x3b865954]
add dx, cx
not eax
push ecx
xor eax, 0x972fdda6
not eax
inc dl
sete byte [esp + edx - 0x7f071304]
xor ebx, eax
mov dword [ebp + ecx - 0x68e38004], eax
xchg dword [esp + edx - 0x7f071305], ecx
sal dword [esp + ecx - 0x68e30000], 0xa4
sbb word [esp + edx - 0x7f071305], 0xd3ad
mov eax, dword [esi + ecx - 0x68e2fffc]
xor cl, cl
ror dword [esp + ecx - 0x68e30000], 0x41
xor eax, ebx
dec eax
jmp 0xafbc1f
jmp 0x118e37b
xor ebx, eax
sal dl, cl
adc ebp, eax
lea eax, [ecx*2 + 0x18881308]
inc al
jg 0x11970b1
sal al, 0x45
ror ecx, 2
dec dl
rol al, 0x84
xor ebx, ecx
sub dl, ah
adc edi, ecx
mov dword [esp + edx], 0xdf351abc
or dx, ax
pop eax
mov dx, word [ebp + edx - 0xff00]
bswap eax
mov ecx, eax
mov ax, word [ebp + 2]
adc ebp, 2
and dx, ax
not dx
jmp 0xad8ab3
xor cl, bl
inc eax
xchg edx, eax
rol cl, 1
sub cl, 0x96
ror cl, 1
call fcn.00b112f0
xor esi, eax
push 0x853a0b9d
and esi, 0xff
jmp 0x101b74d
not eax
call fcn.00fd639e
mov eax, 0x3314dea1
mov ecx, dword [esi + eax*2 - 0x6629bd42]
add al, ah
or ax, ax
inc eax
lea esi, [esi + eax*2 - 0x6629bcfc]
rol al, 0x42
mov edx, 0x9e194ca7
ror ax, 0x25
xor ecx, ebx
dec al
sub ecx, 0xf29e952d
bswap ecx
and dl, dl
or edx, edx
rol ecx, 3
sar eax, 0x1a
jp 0xb1adc5
movzx ecx, byte [esi + ecx - 0x638f8682]
lea esi, [edx + esi - 0x638f863b]
jnp 0x1154f48

Function at 0x1161b30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
lea esi, [esi + ecx - 0x78932601]
xor al, bl
sub ecx, dword [esp + ecx - 0x789325f2]
shr cl, 0x64
rol al, 1
xor al, 8
shl cl, 0x41
sbb al, 0x1f
ror al, 1
xor bl, al
call fcn.011733d8
mov ecx, dword [esi]
mov eax, 0xe901beb4
xor ecx, ebx
movzx edx, ax
call fcn.00afeac6
push ebp
cmp di, cx
mov ebp, esp
lea esp, [esp - 0x10c]
cmp esp, edi
test esi, ecx
push ebx
push esi
test bx, sp
push edi
btc edi, 0x35
mov edi, eax
lea eax, [ebp - 0x10c]
cmp si, 0x1825
test edx, esi
xor edx, edx
cmp bl, 0xb6
test eax, 0x4ca70584
jmp 0x1163c20
sub edi, eax

Function at 0x1163b2f
Capabilities:
Encode data using base64

Disassembly:
neg dword [esp + eax - 0x3532]
ror edx, 1
mov dword [esp + eax - 0x3536], 0xcb8cb2a5
shl eax, cl
dec edx
pop ecx
call fcn.011279a7

Function at 0x11677ac
Capabilities:
Encode data using xor

Disassembly:
dec edx
mov dword [esp + eax*2 - 0x1faca], esi
dec esi
lea ebp, [edi*2 + 0x4481ce0d]
call 0xb396a4
Function at 0x116a6d2
Capabilities:
Encode data using base64

Disassembly:
dec dword [esp + ecx - 0x21076f9c]
add edi, eax
pop edx
neg cl
movzx ax, byte [ebp + ecx*2 - 0x420edeb2]
mov dword [esp + ecx - 0x21076f4c], 0xea298f17
mov dword [esp + ecx*2 - 0x420ede98], 0x711cd184
mov cl, byte [ebp + ecx - 0x21076f58]
call fcn.011491dc

Function at 0x117208b
Capabilities:
Encode data using base64

Disassembly:
adc dx, 0x86bf
xor ebx, ecx
call fcn.00ad41da
mov word [edi + edx*4 - 0x20], cx
add edx, 0x773fe7b1
mov ecx, edx
mov ecx, dword [esi + ecx - 0x773fe7b9]
lea esi, [esi + edx - 0x773fe7b5]
xadd dx, ax
xor ecx, ebx
not eax
bswap ecx
inc ecx
dec edx
not ecx
sal edx, 0xfd
sal dx, 0x65
xor ecx, 0x52922b09
rol dl, 0xa7
jae 0xb9243f
xchg dx, cx
not eax
and byte [esp + ecx - 0x781b0a02], 0xa8
pop ecx
push edx
lea eax, [eax + ecx*4 - 0x20dac4ff]
bswap edx
rol edx, 0x17
xor ebx, eax
call fcn.0102db95
mov cx, word [edi + edx*2 - 0x5746eb12]
mov eax, 0xc83e5e95
mov dword [esp + edx*2 - 0x5746eb12], 0x4a971708
sub edx, dword [esp + edx*2 - 0x5746eb12]
mov dx, word [edi + 2]
lea eax, [eax + eax*4 - 0x3fa10e8]
sbb eax, eax
add edi, 2
xor cx, ax
lea eax, [eax*4 - 0x5b6fede2]
not dx
or word [esp + 2], 0x2b4
pop eax
and cx, dx
movsx edx, al
jmp 0xba2a25
xor eax, ebx
mov edx, 0xbbbe0a02
sub eax, 0xf29e952d
lea ecx, [edx*2 + 0x9f3b23]
mov dword [esp + ecx - 0x781b4f27], 0x3a3a4bb5
bswap eax
rol eax, 3
ror cx, 1
jo 0x10121cf
call fcn.01164025

Function at 0x11724eb
Capabilities:
Encode data using base64

Disassembly:
inc ecx
dec edi
dec esi
lea edx, [eax + ebp + 0x4f1c59ad]
inc ecx
not edi
call fcn.010a599e

Function at 0x117250d
Capabilities:
Encode data using base64

Disassembly:
neg eax
mov dword [esp], 0xd8298b2d
xor ebx, eax
neg ecx
sal dx, cl
add cl, dh
adc ebp, eax
mov dword [esp + ecx - 0x5f3d0c99], 0x2ea5830d
add dword [esp + ecx - 0x5f3d0c96], ecx
rol cl, 0xa3
pop edx
pop edx
pop edx
ja fcn.00fa3df3

Function at 0x1177dc1
Capabilities:
Encode data using base64

Disassembly:
neg eax
call fcn.00ff3f55
rol dl, 1
inc dl
shr eax, 0x66
not ecx
rol cx, 0x4f
neg dl
dec al
xor bl, dl
inc ecx
lea eax, [ecx + ecx + 0x4aa7acbf]
add edx, esp
xor cl, byte [edx + ecx*4]
lea edx, [eax*4 - 0x7d74a069]
shr eax, 0xb3
sal dx, 0xa4
mov word [ebp + eax - 0x956], cx
jns 0xfdf294
mov eax, dword [edi + edx*2 - 0x156]
pop edx
mov ecx, dword fs:[eax]
mov edx, 0xd8297991
ror dword [esp + 4], 0x45
movsx eax, dl
mov dword [edi], ecx
call fcn.00b4e84f
mov dword [edi - 4], edx
sub edi, 4
pop ecx
lea edx, [ecx*4 + 0x69ea0b0]
push ecx
mov eax, dword [esi + edx*2 - 0x17c74965]
lea esi, [esi + edx*4 - 0x2f8e92c5]
shr ecx, 0x6f
rol dl, 0xa6
xor eax, ebx
and ecx, 0x5e264b0c
ror eax, 1
sar dword [esp + ecx*2 - 0x400], 0x30
inc ecx
ja 0xfa7daa
mov edx, 0x19e182b
movzx edx, byte [esi + edx - 0x19e182b]
mov ecx, 0x6525578c
xor dl, bl
sub ecx, ecx
lea ecx, [ecx + ecx*8 + 0x1f2fcc3e]
sbb ecx, ecx
neg dl
lea eax, [ecx + ecx*4 - 0x547c7e6b]
add al, 0
jl 0xffbd6b
Function at 0x117c511
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8226228
mov ecx, 0xaa37400
add cl, byte [edi + ecx*4 - 0x2a8dcffc]
add edi, 4
call fcn.011417db
inc esi
xadd dword [esp + ebp*2 + 0x553bc4b], ebp
neg dl
jmp 0xafa86b
rol ecx, 1
lea ecx, [ecx + eax*2 + 0x4aa6d890]
xor ebx, ecx
sub ax, word [esp + eax*8]
add ebp, ecx
mov dword [esp + eax*8 - 0x1d290], ebp
ret 4
lea edx, [eax*8 - 0x5bec6455]
xor ecx, 0x960bd5ae
sub word [esp + eax + 5], 0x581e
mov dword [esp + eax], 0x523ac5ae
jne 0x1165e4a
not cx
or dx, cx
xor ax, 0x9419
jnp 0xffe09d
mov word [edi + eax - 0x70817a98], dx
mov eax, dword [eax + esi - 0x70817a9a]
je 0xb64912
sbb esi, 0xfffffffc
mov edx, 0x919a238d
xor eax, ebx
neg word [esp + 2]
xor eax, 0xcf8d400c
call fcn.00b16a77
mov ax, word [edi]
mov edx, 0xbd9f252b
mov dx, word [edi + 2]
jmp 0xfffb52