joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf369d2
Capabilities:
Encode data using base64

Disassembly:
dec eax
inc dword [esp + eax + 5]
dec esi
xchg dword [esp + ebp + 0x5e706d5b], ebp
inc ecx
dec bl
jmp 0xe04f93
inc ecx
not bl
movsx ebx, byte [esp + eax + 0xa]
inc ebp
xor dl, bl
dec esi
lea ebx, [esp + ebx + 0x18]
inc esp
or eax, dword [esp + eax + 7]
dec esi
mov ecx, dword [eax + ebx - 2]
xchg word [esp + eax + 4], cx
dec eax
lea edi, [edi + eax - 0xa]
dec esp
mov dword [eax + edi - 2], ecx
inc esp
mov ecx, eax
dec ecx
not ebp
pop eax
inc ecx
pop ebp
inc ecx
pop ebx
jp fcn.00d45932
inc ecx
mov ebx, 0x2789a335
dec ebp
lea ebx, [ebx + 0x10abd204]
inc edx
mov ebx, dword [ebp + ebx - 0x38357539]
inc ebp
movsx ebp, bx
inc bp
btc ebp, ebx
inc ecx
movzx eax, ch
dec edx
lea ebp, [ebp + ebx*2 - 0x706aea6e]
inc esp
xadd eax, ebp
mov ecx, 0x123d0fbe
inc ecx
xor ebx, edx
inc ebx
inc esp
movsx eax, cx
rol ebx, 1
inc ax
inc ecx
shl ebx, 0x53
xor ebx, 0x55b37280
inc ecx
movsx edx, ax
dec ecx
rol ebx, cl
inc ebp
movsx ecx, ax
ror ebx, 1
cdq
neg ebx
dec esp
lea ebx, [eax + edx + 0x6e05edbf]
inc ecx
push edx
dec edx
lea eax, [ebx*2 + 0x7806962d]
dec esi
lea edi, [ebp*8 - 0x726ac25b]
inc sp
add edi, edx
inc edx
xor dword [esp + ebx - 0x6e066532], ebx
inc esp
movsx esi, al
inc ecx
pop edx
dec eax
arpl bx, bx
inc ecx
bswap ebx
inc ecx
sar ecx, cl
not al
dec esp
adc esp, ebx
dec edx
mov edi, dword [edi + ebp*2 - 0x72]
inc ecx
movzx ebx, ch
jmp fcn.00d45932
xor eax, ebx
neg dl
ror eax, 3
mov dword [esp + edx*2 - 0x5fc00000], ecx
shr edx, 0x7c
jae 0xd88065
xor eax, 0x18b8dfb3
dec dword [esp + edx*4 - 8]
and cl, 2
ror edx, 0x79
bswap eax
setb byte [esp + edx*2 - 0x200]
sal dword [esp + edx - 0x100], 0x3f
shr word [esp + edx*4 - 0x400], 0xe9
rol eax, 1
or cx, 0x10bc
sub dl, dl
xor ebx, eax
add ebp, eax
movzx eax, dx
mov dx, word [edx + esi - 0x100]
mov cl, byte [esi + eax - 0xfe]
lea eax, [eax + eax - 0x7c46a568]
add esi, 2
call fcn.00ca3c24
inc ecx
mov ebx, 0x95a74daf
inc ecx
dec bl
dec ebp
lea eax, [ebx + 0x4e19c801]
mov edx, dword [ebp]
inc ebp
movzx ebp, bx
dec edx
lea ebp, [ebp + ebp*2 - 0x9b58]
dec edx
lea esi, [ebx*2 + 0x1301272f]
dec ebp
or ebp, eax
inc ecx
movzx eax, ch
inc ecx
xor edx, edx
not edx
inc cx
shr ebx, 0x84
inc edx
lea edx, [edx + ebp - 0x788e9ff4]
bswap edx
inc bp
adc eax, ebx
rol edx, 1
inc ecx
neg ch
dec edx
shr eax, 0xe6
inc ecx
push edx
push esi
inc bp
or ebp, eax
xor dword [esp + eax + 6], edx
dec ebx
lea ecx, [ebx + eax*2 + 0x372ef112]
dec esp
mov edx, dword [esp + eax*2 + 4]
inc esp
movsx ecx, word [esp + eax - 1]
inc ecx
push eax
dec eax
arpl dx, dx
dec esp
add ebp, dword [esp + eax*2 + 4]
dec esp
adc esp, edx
dec edx
lea edx, [ecx*2 - 0x547775d8]
ror byte [esp + eax], 0xc4
inc esp
movzx ebx, byte [eax + ebp - 2]
dec eax
neg dword [esp + eax*4 - 5]
dec eax
lea ebp, [eax + ebp - 1]
inc ebp
xor bl, dl
inc esp
movzx edi, word [esp + eax*8 - 8]
inc ecx
add bl, 0x82
dec esi
lea ebp, [ecx*8 - 0x5e72eb63]
inc ecx
rol bl, 1
jmp 0xd079e9
Function at 0xf4c8c7
Capabilities:
Encode data using base64

Disassembly:
inc cl
sal edx, 0xc4
btr dx, dx
jb 0xfacc39
xor bl, cl
and dl, dl
lea ecx, [esp + ecx + 4]
mov dword [esp], edx
not dl
mov word [ecx], ax
pop ecx
jmp edi
mov eax, 0xac1c7b3e
sub esi, 4
movzx ecx, al
mov ecx, dword [esi + ecx - 0x3e]
cwde
jmp 0xb9cdbb

Function at 0xf5aa91
Capabilities:
Encode data using base64

Disassembly:
pop eax
not al
xor bl, cl
add ecx, esp
cwde
mov eax, dword [ecx]
sub esi, 4
lea ecx, [edx + edx - 0x27ddf277]
dec ecx
xor dx, dx
mov dword [esi], eax
bt cx, dx
jae fcn.010cab6a
sub edi, 4
call fcn.00e233fc
sub edi, 4
mov edx, 0x39008c80
mov eax, edx
lea edx, [eax*8 + 0x328596b1]
mov edx, dword [edi + eax*2 - 0x72011900]
ror al, 0xa4
xor edx, ebx
not edx
call fcn.00dadf33
stc
cmp edi, 0x83916701
pop eax
not cl
dec dword [esp]
ror cl, 1
jmp 0xd9064a

Function at 0xf5d2a6
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov dword [esp], 0xeea67d95
mov dword [esp + 4], eax
mov eax, 0x8fb03592
mov dword [esp + 0x10], ebx
movsx ebx, ax
bswap eax
sar dword [esp + ebx - 0x3592], 0xf9
mov dword [esp + ebx - 0x3592], esi
push edx
add ax, ax
movsx esi, bl
movsx edx, al
push edi
lea edi, [eax + 0x1d8f8fa5]
btc edi, eax
not eax
lea edi, [esp + ebx - 0x3596]
cwde
inc bx
push edx
lea eax, [edi + ebx*2 - 0x6c12]
mov dword [esp + ebx*8 - 0x1ac98], ebp
inc edx

Function at 0xf5d5a5
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xdeb64002
ror dword [esp + 3], 0xe2
xor esi, ecx
and esi, 0xff
call fcn.00f70f94

Function at 0xf6608e
Capabilities:
Execute syscall

Disassembly:
dec eax
call fcn.00d078b8
adc eax, ecx
xor bx, dx
cwde
xor ax, cx
neg ecx
lea ebp, [ecx + ebp - 0x8f0c03]
inc cl
push ecx
call fcn.00c5cd98
inc dword [esp + 0xc]
jne 0xbd7f9f
syscall
call fcn.00bf7ffa
Function at 0xf74100
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edi + 2]
mov dword [esp], edx
push esp
and al, 0
or dl, dh
adc edi, 2
inc byte [esp]
shr al, cl
add byte [esp + 1], dl
shr word [esp + 2], 0xe5
mov word [edi], ax
pop eax
lea esi, [esi + eax*8 - 0x38af2c24]
mov ecx, dword [esi + eax*2 - 0xe2bcb08]
neg dl
xor ecx, ebx
xor edx, 0xe3887291
btc edx, edx
ror ecx, 2
lea ecx, [ecx + edx*4 + 0x4550d417]
call fcn.00be84f9
movsb byte es:[edi], byte [esi]
mov eax, dword [ecx - 0x11]
push ss
sub byte [edi - 0x48], 0x99
add al, 0x5a
push ss
add cl, byte [ebx + 0x50]
js 0xf74105
aaa
invalid

Function at 0xf806ab
Capabilities:
Authenticate hmac

Disassembly:
xor eax, edx
not ecx
xadd eax, edx
neg ecx
ror ecx, 2
inc dx
inc ecx
neg dl
ror ecx, 2
sub al, 0x22
sbb ecx, 0xc49a4eae
rol dword [esp + 4], 0x88
not al
xor ebx, ecx
and dl, al
bt eax, eax
adc esi, ecx
bswap edx
pop edx
pop eax
jmp fcn.00f780b9
sar eax, 0x44
adc cx, 0x9f09
mov dword [esp], eax
push eax
movzx edx, word [esp + 1]
rol cx, 1
add cx, 0x5418
ror cx, 1
xor bx, cx
lea ebp, [edx + ebp - 0xe18f]
mov word [edx + ebp - 0xe18d], cx
mov ecx, 0x90820f24
lea edi, [edi + edx*4 - 0x38638]
mov ecx, dword [edi + edx*2 - 0x1c31a]
sub al, byte [esp + edx*4 - 0x3862f]
neg dx
xor ecx, ebx
ror eax, 0x17
jb 0xe0cd7f

Function at 0xf81026
Capabilities:
Encode data using base64

Disassembly:
not eax
mov dword [esi], eax
mov ecx, 0xc7b1fc2f
mov edx, dword [edi]
neg ecx
movsx eax, cx
lea edi, [edi + ecx*2 - 0x709c079e]
not eax
xor edx, ebx
jmp 0xf23a05
and cx, ax
bswap edx
sal cx, 0x4e
lea edx, [edx + ecx*4 - 0x61940ef9]
sbb al, al
neg edx
neg cl
add eax, ecx
lea edx, [edx + ecx*2 - 0x4f9143d5]
xor ebx, edx
call fcn.00f7d8d2
jmp 0xc1a3b3
mov ebx, dword [ebx*4 + 0x1086a84]
neg byte [esp + 3]
call fcn.0105a307
inc dx
inc dword [esp + ebx - 0x6897]
neg eax
dec esi
mov dword [esp + ebx*8 - 0x34558], edx
inc edx
xor dword [esp + ebx - 0x6896], eax
inc ecx
mov ecx, 0x870590ba
inc ecx
sal ebx, 0x3b
inc ecx
push esi
dec esi
mov edx, dword [esp + ebx - 0x6fffffe0]
dec edx
or ebx, dword [esp + eax*4 - 0x1a2bc]
and bx, bx
call fcn.010bd281
mov dword [esp], 0x4e3f269e
xor eax, eax
push 0x7335028
rol word [esp + 0xa], 0xca
test ecx, ecx
push 0xfdab9fa1
push 0x73903491
lea esp, [esp + 0x14]
je 0xbd3a40
push ebx
mov ebx, 0xcaae0c1b
dec bl
sub ebx, ebx
adc bl, byte [edx + ebx*2]
push 0xa290f110
xor ebx, eax
rol dword [esp], 0x12
shl byte [esp + 2], 0xc2
and ebx, 0xff
jmp 0xf64722
Function at 0xf822c5
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esi + edx*2 - 0x1842bb02]
xor eax, ebx
mov dword [esp + edx - 0xc215d7d], 0xc7295c92
bswap eax
lea eax, [eax + edx*2 - 0xd159cfe]
neg edx
xor eax, 0x4aa6b532
add edx, ecx
inc eax
ror word [esp + ecx - 0xfb], cl
jae 0xc0cb1b
xor ebx, eax
add ebp, eax
sub edx, ecx
setb cl
lea eax, [edx + ecx*4 - 0x4add7b68]
pop eax
pop ecx
jle fcn.00ff1508
ror ecx, cl
inc eax
lea edx, [ecx*8 - 0x5d0fdef]
not dl
xor cl, cl
bswap eax
neg ecx
ror eax, 1
sub dl, 0x13
bt cx, 0x8d
lea eax, [eax + ecx*2 - 0x5d8c8ec4]
ror eax, 1
xor ecx, ecx
xor ecx, edx
adc dl, dl
xor ebx, eax
and ecx, edx
neg ecx
lea ebp, [ebp + edx - 0x6d874c6a]
mov dword [ebp + edx - 0x6d874c66], eax
lea edi, [edx + edi - 0x6d874c6a]
rol edx, 0x14
mov eax, ecx
dec ax
mov ecx, dword [edi]
cdq
xor ecx, ebx
rol ecx, 1
sar dl, 0xe6
xor ecx, 0x8c3a99a2
btc edx, edx
bts eax, 0x99
rol ecx, 3
not al
dec al
inc ecx
lea edx, [edx + edx*2 + 0x76b55f1a]
neg edx
xor ebx, ecx
add esi, ecx
mov ecx, edx
neg al
js fcn.00cf9758
add ah, ah
inc ebp
inc edx
mov al, 0xda
outsd dx, dword [esi]
inc edi
inc edi
push edx
salc
std
invalid

Function at 0xf8e9f7
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
and byte [esp + ecx - 0xe807ef9], 0xa8
movzx eax, cx
xor ebx, edx
sub al, byte [esp + ecx*2 - 0x1d00fdf9]
add esi, edx
pop ecx
pop edx
jmp fcn.00cf9758
Function at 0xfa19cf
Capabilities:
Encode data using base64

Disassembly:
sub edx, 0xf9988511
and al, 0x91
rol edx, 3
btr eax, 0x99
xor edx, 0xcba59e81
ror edx, 1
and al, ah
bt eax, ecx
neg edx
inc ecx
xor ebx, edx
add eax, 0x65397910
sub eax, 0x2920aaa5
add esi, edx
or cx, ax
jmp esi
lea eax, [eax + eax + 0x48ae8f9c]
ror edx, 1
cwde
dec edx
add ecx, eax
ror edx, 2
btr ecx, eax
xor ebx, edx
not ecx
inc cl
add ebp, edx
cwde
dec cl
mov dl, byte [edi + ecx*4 - 0x4b2c]
not ecx
push ecx
pop eax
movzx ax, byte [edi + 2]
call fcn.00c55938
mov eax, 0xfd1f308d
mov eax, dword [edi]
add edi, 4
call fcn.00c0e7a2
neg ecx
ror ecx, 2
mov dword [esp + 8], edx
mov dword [esp + 4], edx
dec ecx
rol dword [esp + 2], 0xee
xadd word [esp + 0xb], ax
bswap ecx
ror ecx, 1
not edx
inc ax
inc ax
lea ecx, [ecx + eax + 0x696cbb8]
xchg dword [esp + edx - 0x71], eax
xchg word [esp + edx*2 - 0xe0], ax
ror ecx, 3
bts edx, eax
bswap ecx
shl al, 0xa3
cbw
call fcn.00c6e77d
lea eax, [ecx*2 - 0x7465a7c7]
ror dword [esp + eax*2 - 0x2f556596], cl
inc edx
pop ecx
ror edx, 1
sar ecx, cl
neg al
lea edx, [eax + edx - 0x46b778c1]
jge 0xfe5c2c
mov eax, 0x822cab26
mov edx, eax
xor edx, 0x641fbb07
mov eax, dword [esi]
setle dl
sal edx, 0x27
lea esi, [esi + edx - 0x1988007c]
lea ecx, [edx*2 - 0x627b73f0]
neg cl
xor eax, ebx
or cl, dl
rol dx, 0xcd
and dx, dx
neg eax
xor eax, 0x543d6faa
not dx
rol cl, 0x87
setae cl
lea eax, [eax + edx*4 + 0x54fa52e5]
sub edx, edx
not eax
xor ebx, eax
add ebp, eax
sub edx, 0x603ebd83
mov eax, 0x2b0cab38
mov cx, word [eax + edi - 0x2b0cab38]
shr edx, 0x6f
or edx, edx
setae al
mov dx, word [edi + edx - 0x13f80]
lea edi, [eax + edi - 0x2b0caaff]
not cx
jnp 0xd70114
not dx
xadd al, ah
cbw
bswap eax
or cx, dx
sar eax, 0xa1
mov word [edi], cx
movzx edx, ax
jmp ebp
mov dword [esp], ecx
ror cx, cl
not edx
jae 0xf7db75
mov ecx, dword [esi]
mov eax, 0xe289b81f
bswap eax
mov edx, eax
lea esi, [eax + esi - 0x1fb889de]
bts ax, dx
xor ecx, ebx
shr dl, 0x67
and edx, eax
sbb ecx, 0xa83ce2bc
lea eax, [edx*2 + 0x7a9d8c18]
xadd dl, ah
setbe al
neg ecx
sar eax, 0x76
ror eax, 0xe5
shr al, 0x81
inc ecx
lea eax, [edx*2 - 0x41c10348]
shr edx, 0xe1
xor ecx, 0x3ca9a39f
inc ecx
or dx, 0xf10d
shr eax, 4
shr al, 0xe5
xor ebx, ecx
cbw
xor eax, 0x32221c32
adc ebp, ecx
push eax
mov dx, word [edi + edx - 0xfdcf5cf]
pop eax
mov ax, word [edi + eax*2 - 0x7bf23868]
mov ecx, 0x1288124
jmp 0xe69a29
jge 0xc5d850
mov eax, 0x12a83b94
call fcn.0108edb7
neg ecx
adc ecx, eax
xor edx, ebx
shr al, 0xc5
dec edx
ror cl, 6
sbb ecx, ecx
ror edx, 1
jmp 0xb8468c

Function at 0xfa437a
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
mov dword [esp], 0xf81cc7be
pop eax
mov eax, dword [ebp]
call eax
mov edi, 0x3228ab28
movsx esi, di
mov ebx, esi
mov ebp, dword [ebp + edi - 0x3228ab2c]
mov edx, edi
mov dword [ebp + edx*2 - 0x64515650], eax
lea eax, [edx + ebx*8 - 0x86e0948]
sub esi, edx
cmovo dx, bx
mov edi, ebp
sbb bl, 0x17
pop ebx
sar dl, 0x46
cdq
pop ebp
neg esi
dec edx
jbe 0xc27fbe
Function at 0xfc6449
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00d2b2a4
mov eax, 0x5290323a
add al, al
rdtsc
mov ecx, 0x78f65b7
shr cx, 0xe3
add cl, 0xad
lea esi, [esi + ecx - 0x78f0c6b]
mov dword [esi + ecx - 0x78f0c5f], eax
lea eax, [ecx + ecx - 0x346779f7]
sub eax, ecx
mov dword [esi + ecx - 0x78f0c63], edx
neg ecx
sbb ecx, 0xc48d8233
btc ecx, eax
lea edi, [edi + ecx - 0x33e3616d]
mov edx, dword [edi + ecx - 0x33e36169]
or cl, ah
btc eax, 0xac
xor edx, ebx
bswap eax
neg edx
sar cl, 0x45
lea edx, [ecx + edx - 0x6f175abc]
sub ecx, 0x5303d00e
sar eax, cl
xor edx, 0x16acc389
call fcn.00cd92e7
cmp bl, byte [edi - 0xf]
imul esi, dword [edi - 0x5b], 0x5c2df22d
salc
sti
xchg dword [ecx - 0x6c], ebx
shl edi, 1
salc
les ebx, [esi + esi*8 + 0x26103d1]
pop edx
stosb byte es:[edi], al
sbb ebx, edx
mov ecx, 0x8e75f7c0
jno 0xc19c46
dec edx
push esi
invalid
call fcn.00fa437a
mov edx, 0x23eeba3
inc esp
movsx esi, dl
mov edx, dword [ebp + edx*4 - 0x8fbae8c]
mov ebx, 0x433d719f
dec eax
lea ebp, [ebp + ebx - 0x433d719b]
inc esp
mov ebx, ebx
inc esp
btr ebx, esi
inc ebp
mov eax, ebx
inc ecx
xor edx, edx
push ebx
rol edx, 2
inc esp
movzx edi, word [esp + ebx - 0x433d7194]
inc ecx
pop eax
inc edx
rol edx, 3
neg edx
inc cx
btr eax, 0x14
inc bp
btc edi, edi
inc ecx
sal esi, 0x13
inc ecx
push edx
dec edx
lea eax, [edi*2 - 0x1df326c5]
xor dword [esp + eax + 0x1df3262f], edx
dec ecx
xchg esi, ebx
inc ecx
pop edx
dec eax
arpl dx, dx
dec esp
add esp, edx
inc ebp
mov bh, byte [ebx + ebp - 0x433d719f]
inc ecx
movzx esi, dh
dec ecx
lea ebp, [ebx + ebp - 0x433d719e]
inc ebp
xor bh, dl
sal eax, 0x28
inc ecx
mov ebp, 0x6c26f1ba
inc ecx
movzx ecx, si
inc ecx
sbb bh, 0xbb
inc eax
xadd dh, cl
inc ecx
rol bh, 1
inc cx
dec ebx
dec eax
neg esi
inc ecx
sbb bh, 0x87
inc ecx
dec ebx
inc ecx
not bh
dec edx
lea edx, [ebp*4 - 0x2e6f5470]
cwd
inc ebp
xor dl, bh
dec ecx
xchg ebx, eax
dec edx
lea edi, [edi + ebx - 0xcd9d108]
dec edi
lea ecx, [ebx + ebx*4 - 0x4c4e7d76]
inc ecx
rol ebx, 0x7c
dec esi
mov dword [edi + esi - 0x433d7197], edi
jae 0xf18687
dec esp
lea eax, [ecx - 0x27f04d54]
inc ecx
sar al, 0xc1
dec eax
lea ebp, [ecx + ebp - 0x198c1a08]
inc esp
mov esi, ecx
inc esp
movzx ebp, cl
inc ecx
xor edx, edx
inc ebp
movzx ebx, dh
not edx
inc edx
lea edx, [edx + eax*4 - 0x77107e18]
call fcn.0100cb53
jae fcn.00d45932
test ebx, ebx
lea esp, [esp + 0xc]
je 0xcdcb12
mov eax, 0x51872db1
sar eax, 0x3b
mov eax, dword [ebp + ebx*4]
push eax
ja 0xc19c0c
movzx edx, byte [esi]
add esi, 1
mov eax, 0x7424ed22
add eax, 0xac1b9616
rol eax, 0xec
xor dl, bl
mov ecx, eax
sub dl, al
xor ecx, 0x4817fe9d
bswap ecx
rol dl, 1
sub dl, 0xa5
sub eax, 0x18070f30
and ax, 0x801e
xor dl, 0x86
sar eax, 0xf5
rol cx, 0xed
xor bl, dl
sar eax, 0xae
add edx, esp
mov ecx, dword [edx]
sub ebp, 4
xor eax, eax
shr eax, 0xba
movsx edx, ax
mov dword [eax + ebp], ecx
push edx
xor edx, dword [esi + eax*2]
shl eax, 0x64
lea esi, [esi + eax*2 + 4]
xor edx, ebx
neg ax
mov word [esp + eax + 2], 0x7791
rol edx, 1
inc edx
bswap edx
bswap eax
xadd byte [esp + eax + 3], al
cwde
rol edx, 3
dec edx
xchg byte [esp + eax*8 - 0x3b5], al
call fcn.00ddef9e
Function at 0xfdb68b
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov edi, dword [edi + ebx*2 - 0x36]
setno dl
dec esp
xchg esi, ebx
inc word [esp + ebx*4 - 0x69]
dec eax
mov esi, dword [edi + ebx - 0x13]
dec ecx
btr esi, 0x9a
jae 0xb8ee16
dec eax
lea edi, [edi + ebx - 0xb]
inc cx
dec ecx
shl dword [esp + ebx*2 - 0x32], 0x7c
inc byte [esp + ebx*8 - 0xd4]
dec ecx
mov dword [edi + ebx*2 - 0x36], esi
dec esp
mov dword [esp + ebx*8 - 0xd8], esp
ret
sub eax, 0x501a1f00
mov dword [esp], ecx
pop edx
inc dl
rol eax, 1
call fcn.00db7ad6
inc ecx
mov ebp, 0x40223bbf
inc ebp
mov edi, dword [ebp + ebp - 0x40223bbf]
dec edx
lea ebp, [ebp + ebp - 0x40223bbb]
dec ebx
lea ebx, [ebp + ebp*4 - 0x5ee6e9f9]
inc ecx
movsx esi, bp
dec esi
inc ebp
xor edi, edx
inc ecx
neg edi
inc ecx
xor edi, 0x63950a16
inc esp
movzx ebx, dh
btr esi, esi
inc eax
movsx eax, dh
inc ecx
inc edi
inc ecx
inc bl
jns 0xc8b15a
inc eax
ror dh, 0x21
inc ecx
ror edi, 2
btr bx, si
inc ebp
add bl, ch
inc ecx
neg edi
inc ecx
rol edi, 2
inc ecx
push edx
inc esi
xor dword [esp + ebx - 0x7e], edi
movsx edx, bl
inc ecx
pop edx
dec ebp
arpl di, di
inc esp
movzx esi, ax
shl al, 0x82
dec ebp
adc esp, edi
inc ebp
mov ebp, dword [ebp + edi - 0x40223bbf]
inc ecx
sub dh, dh
mov cl, byte [edi + esi - 0x3b9d]
jg 0xcb5df9

Function at 0xfdb76c
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esp + ebx - 0x82]
mov edi, ebp
lea ecx, [edx + edx*2 - 0x32e61170]
mov dword [esp + ebx - 0x82], 0x4d322431
mov dword [ebp + ebx*2 - 0x104], eax
movsx edi, word [esp + ebx*2 - 0x104]
jnp 0xe7b492

Function at 0xfe21d5
Capabilities:
Encode data using xor

Disassembly:
movzx dx, byte [ebp + ecx*2 - 0x2c699e32]
mov dword [esp + ecx - 0x1634cf19], 0x5aacca22
call fcn.00e13bab
mov edx, 0xe30d8a3d
call fcn.00d5f2ad

Function at 0xfe4060
Capabilities:
Manually build aes constants

Disassembly:
xor bl, dl
and ecx, dword [esp + eax*2]
ja 0xd664e1
mov ecx, ebp
mov edx, 0x6f1ab62a
lea ebp, [edx + ebp - 0x6f1ab62e]
push edx
jmp 0xf1da99
lea esi, [esi + eax*2 - 2]
dec cl
ja 0x10d0bf8
mov dword [ebp + edx - 0x6f1ab62a], ecx
mov eax, 0xa983e38f
jmp 0x1079c50
mov dword [esp + edx - 0x712b1ddd], eax
or eax, 0xfdbc3511
mov edx, dword [edx + esi - 0x712b1ddd]
xor edx, ebx
neg dword [esp + 4]
dec edx
mov ecx, eax
rol dword [esp], 0x41
jno 0x1021ff2
mov edx, 0x67a4b92a
movzx edx, byte [edi + edx - 0x67a4b92a]
mov eax, 0x3128222d
lea ecx, [eax + eax*4 - 0x73664048]
lea edi, [edi + eax*2 - 0x62504459]
not ax
sub eax, eax
or ecx, 0x6c0077b2
xor dl, bl
ror dl, 1
cwde
push ecx
xadd byte [esp + eax + 1], ah
not dl
adc dl, 0x26
shl eax, cl
not dl
jbe 0xc680a5
bswap edx
add cl, ah
ror edx, 1
shl ecx, 0x8a
sbb edx, 0x653d3824
inc byte [esp + 3]
ror dword [esp + 4], 0x57
pop ecx
xor ebx, edx
add dword [esp + ecx - 0xff0e33], 0xe50fef1d
add ebp, edx
mov dword [esp + ecx - 0xff0e33], ebp
ret
sub al, al
mov word [esi + eax*4], dx
mov edx, dword [edi + eax*8]
inc eax
sal ecx, cl
or ecx, ecx
lea edi, [edi + eax + 3]
setp cl
ja 0xf79d1a
Function at 0xfe64f1
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc ecx
pop edi
dec eax
add edi, 8
mov ecx, 0xf9146737
mov ebx, ecx
movsx esi, cl
inc esp
movzx eax, word [ebp + esi*4 - 0xdc]
dec eax
lea ebp, [ebp + esi - 0x35]
inc esp
movzx ecx, si
dec eax
lea eax, [ecx + ecx*8 - 0x1fdfb664]
inc bp
xor eax, edx
dec ebp
lea esi, [ecx - 0x507b2f41]
inc ecx
xchg dh, dh
ror al, 0x22
inc cx
xor eax, 0x8b44a90a
fld dword [ebp + 0xf]
mov dh, 0xfe
inc cx
ror eax, 1
ror si, 0xe9
inc ecx
shl ecx, cl
inc cx
sbb eax, 0xf741d483
shl dword [esi + 0x41], 1
neg eax
sal ax, 0xc8
inc bp
xor eax, ecx
inc cx
xor eax, 0x45664f29
xor edx, eax
dec esp
add eax, esp
inc sp
and esi, esi
dec esi
mov dword [esi + eax - 0x7b00], ebp
dec esi
inc esp
mov ebx, dword [ebp + esi - 0x7aff]
inc ebp
movzx ebp, cx
dec eax
sar eax, 0x33
dec esp
lea eax, [ebx + ebx*8 - 0x35e9d75d]
dec eax
lea ebp, [ebp + esi*8 - 0x3d7f4]
inc ebp
xor ebx, edx
inc ecx
inc edi
inc ecx
mov edx, ebp
inc ebp
lea ebx, [ebx + ecx - 0x7707df84]
inc ecx
ror ebx, 1
inc ecx
neg ebx
inc ecx
not cl
inc ecx
push ebp
inc ecx
ror ebx, 1
inc ecx
not ebx
call fcn.00f04c66

Function at 0xff197c
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp + edx*2 - 0x6b74], eax
jae 0xcd1d95
lea ecx, [edx + 0x6015c229]
movzx eax, cl
mov esi, ebp
lea edi, [ecx + ecx*4 + 0x1d287c29]
pop ebx
xadd edx, eax
pop ebp
adc ecx, eax
lea edi, [eax*4 - 0x25513473]
setl al
pop edi
sar al, 0x62
ror cx, 0xe1
and cx, 0xf124
mov edx, dword [edi + edx*2 - 0x6d3a]
add ecx, ecx
lea edi, [edi + eax*2 - 0x69fc]
rol eax, cl
xor edx, ebx
sal eax, cl
setae cl
sal eax, 0x76
neg edx
lea edx, [eax + edx + 0x1f99ac91]
shl ecx, cl
and cl, 0x98
rol eax, 0xb7
xor edx, 0x3e95e79f
and cl, ah
ror edx, 3
lea edx, [edx + eax*2 + 0xd2fb9ad]
btc ax, ax
bswap edx
shl ax, 0x86
inc ecx
xor ebx, edx
shr ecx, cl
and cl, 0xa3
call fcn.01084482
sal dx, 0xee
adc ebp, 3
shr dl, 0x84
xor ecx, ebx
movzx eax, dl
lea edx, [eax + eax + 0x39b1369d]
inc ecx
dec eax
neg ecx
xor ecx, eax
sub ecx, 0x6ba45f06
neg ecx
btc eax, eax
btc dx, dx
xor ebx, ecx
cwde
ror dx, 0xc1
xchg al, dl
add edi, ecx
lea esp, [esp + 8]
call eax
mov esi, 0x5c9235ba
mov ebp, dword [ebp + esi - 0x5c9235be]
movzx edx, si
neg esi
jbe 0xc1dc16
push ebx
mov ebp, dword [esp + eax - 0xf0]
mov dword [esp + eax*2 - 0x1e4], ebx
not dword [esp + eax*8 - 0x79c]
mov ebx, dword [esp + eax - 0xec]
push dword [esp + 0xc]
popfd
call fcn.00d9d8db
Function at 0xff3877
Capabilities:
Encode data using xor

Disassembly:
and cx, 0x76ad
dec esi
mov ebp, dword [edi + edi - 0x40261201]
inc ebp
mov ebx, dword [ebp + ebx - 0xa8]
dec esi
lea ecx, [edi*2 - 0x3a496cf7]
jg 0xf96e3f
lds ecx, [edi]
invalid
sub edi, 4
mov ecx, 0x5a9c1995
mov eax, dword [ecx + edi - 0x5a9c1995]
dec ecx
xor eax, ebx
mov edx, ecx
sal edx, cl
bswap eax
ror edx, 0x84
xor eax, 0xf5b94318
call fcn.0108dc24
adc bh, bh
cli
add byte [edi], bh
loop 0xf9841b
mov dl, byte [ecx + 0x72e1258c]
test dword [edi + 0x6f9f5f3a], 0x909b5dbf
mov dword [0x86590abf], eax
xchg edx, eax
xchg ebp, eax
add bl, dh
or dh, byte [ecx - 0x63]
mov eax, dword [0x119c7086]
pop ds
xchg byte [edi + 0x44], ch
push esp
popal
jns 0xf98409
invalid
dec edx
mov dword [esp + ebp*2 - 0x350], esi
inc ecx
inc ebx
dec esi
or ecx, dword [esp + ebp*2 - 0x350]
dec eax
bt ecx, 0x23
inc ecx
not ch
inc ecx
ror ebx, 1
dec eax
neg ecx
inc dx
or dword [esp + edi - 0x402612a2], edx
inc edx
add byte [esp + ebp*4 - 0x555], 0x1e
inc ecx
bswap ebx
dec ebp
lea eax, [edi + 0x1730a733]
inc ecx
setno bh
xadd edx, ecx
dec esi
mov dword [esp + edi - 0x40261201], edx
inc cx
or esi, ebp
inc esi
xor dword [esp + ebp - 0x157], ebx
inc ecx
xor esi, edi
neg si
dec esi
lea edx, [eax*4 - 0x1ccfa7dd]
inc ecx
pop edx
dec ebp
arpl bx, bx
dec eax
shl esi, 0xfc
movzx eax, bl
or edx, edx
dec ebp
adc esp, ebx
jmp 0xf983ec

Function at 0xffc056
Capabilities:
Encode data using xor

Disassembly:
btc ecx, ecx
not eax
bt cx, cx
inc eax
xadd ecx, edx
shr edx, 0x1c
xor ebx, eax
shr edx, cl
neg edx
btr cx, dx
add ebp, eax
add edx, dword [edi + edx]
lea eax, [ecx + ecx*8 - 0x63facb]
inc cx
sar cx, 0x28
mov eax, dword [ecx + edi - 0x3e8ffae]
btr ecx, ecx
lea edi, [edi + ecx - 0x3e8ffaa]
bt ecx, ecx
btc ecx, 0x37
dec ecx
mov dword [edx + ecx - 0x368ffb1], eax
lea edx, [ecx*8 + 0x7024fd0f]
call fcn.00fefe7b
shr ax, cl
bswap edx
rol cx, cl
lea edx, [edx + eax*8 + 0x732bd919]
shl ecx, cl
xchg ah, cl
or cx, 0x9735
xor ebx, edx
inc cl
setl cl
sar ecx, 0x66
adc edi, edx
neg cl
btc ecx, 0xb9
cbw
jmp edi
dec esp
xadd ecx, esi
dec ebp
adc esp, ebp
inc esp
mov ebp, eax
call fcn.00e3b67d
mov edx, 0xf728dcba
movsx ecx, dl
movsx eax, cx
mov ecx, dword [ebp]
bt eax, 0xad
mov eax, dword [ebp + 4]
and edx, edx
adc ebp, 4
sar edx, 0x8b
shr edx, 0x85
add ecx, eax
mov dword [ebp + edx - 0x7fff728], ecx
movsx ecx, dl
lea esi, [edx + esi - 0x7fff72c]
mov eax, edx
shl ecx, 0xd8
mov edx, dword [esi + edx*8 - 0x3fffb940]
xor edx, ebx
shr ecx, 0x3d
setae al
rol edx, cl
xchg cl, al
neg edx
bts ax, 0xb8
jb 0xf1dc62
mov eax, dword [esi]
mov edx, 0xb3b415ba
rol dl, 7
adc esi, 3
lea ecx, [edx*8 - 0x6c624b54]
lea edx, [edx + edx*4 - 0x3553a1ca]
btr cx, dx
xor eax, ebx
bt ecx, 9
dec dl
dec eax
bts ecx, ecx
lea edx, [edx*8 + 0x6934a623]
bswap eax
xadd dl, dh
jno 0xc166f9
sub edi, 4
mov eax, 0x15111b9a
not eax
cbw
mov ecx, dword [edi]
jmp 0xd29c51