joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaf041d
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
sar ecx, cl
xor al, bl
imul ecx, edx
ror edx, 0x4b
xor al, 0x26
not al
shr cx, 0x45
sub edx, 0xd105a4b4
mov dword [esp + edx - 0x23b7f3bd], edx
adc al, 0xbf
not al
sar dx, 0x8a
sbb al, cl
sal dl, 0xe3
xor al, 0x97
xchg byte [esp + ecx + 2], cl
rol byte [esp + edx - 0x23b7ffde], 0x41
xor bl, al
lea eax, [esp + eax + 8]
xchg byte [esp + edx - 0x23b7ffd9], dl
dec cl
neg dl
mov edx, dword [eax + edx - 0x23b7fff9]
movzx eax, cl
lea esi, [ecx + esi - 0xba]
not cl
dec byte [esp + ecx - 0x46]
dec byte [esp + ecx - 0x49]
mov dword [esi + ecx*2 - 0x92], edx
shl dword [esp + ecx*2 - 0x8e], cl
pop ecx
pop eax
js fcn.013c0ed1
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, 0xd904aa95
xadd cl, ch
xor cl, 0xa9
mov cl, byte [ebp + 8]
adc ebp, 6
push 0x3b4112a
push 0xb3686a8
shld edx, eax, cl
mov eax, 0xe191c108
mov dword [ebp], edx
inc eax
js 0x1324cb1
push edx
xor eax, ebx
and edx, dword [esp + ecx - 0x1f25f615]
neg dx
call fcn.00c72d5f
sub edi, 1
mov ecx, 0x87325c87
shl ecx, cl
movzx edx, byte [edi]
jb 0xc3c920
mov eax, dword [edi]
mov ecx, dword fs:[eax]
mov eax, 0x66a59d11
inc eax
movzx edx, al
mov dword [edi + edx*4 - 0x48], ecx
sal al, 0x61
cdq
lea edx, [eax + eax - 0x546764e2]
mov edx, dword [esi + edx - 0x78e3d566]
dec ax
lea esi, [esi + eax - 0x66a59d1f]
jne 0x132c7b3
pop ecx
xchg ebx, eax
ljmp 0x2b00
mov eax, ecx
seta cl
xor dl, bl
xor al, ah
xor dl, 0x3d
dec al
dec ax
jg 0xc960c2
inc dl
neg dl
sub al, al
sub ecx, 0xd21b0199
adc dl, 0xbc
rol eax, cl
and eax, eax
neg dl
xor bl, dl
add edx, esp
xor eax, 0x69b4f2a8
imul eax, eax
mov cx, word [edx + eax - 0x60f7db10]
mov edx, eax
jb 0x127060d
movsx edx, word [esp + 2]
mov eax, dword [edi + edx - 0xb36]
rol dword [esp + edx*4 - 0x2cd4], 0x9d
lea edi, [edi + edx - 0xb32]
setnp dl
mov ecx, dword [esp + edx - 0xafd]
call fcn.00ca9f7d
mov cl, byte [edi + 2]
mov edx, 0x3a9b8f1d
push edx
lea edi, [edi + edx - 0x3a9b8f1b]
neg dword [esp + edx - 0x3a9b8f1d]
shr al, cl
call fcn.012f5bf6
dec ecx
sub eax, 4
mov edi, 0x4caa1980
mov ebp, 0x839686b9
inc eax
xchg ch, bh
inc edx
mov ebx, dword [edi + eax - 0x4caa19b9]
mov edx, edi
call fcn.00bf2093
mov ecx, 0xc3ab4f0a
xor edx, ebx
not ecx
bswap edx
not cl
sar al, 0x82
btc cx, ax
xor edx, 0xfc3b6b02
neg cl
inc edx
btr ax, cx
imul ax, ax
shl al, 0xe5
bswap edx
not edx
xor ebx, edx
add ebp, edx
cdq
dec ecx
add edx, ebp
jmp edx
Function at 0xaf0b69
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp], 0x3fd3ac5c
call fcn.011c6914
mov ecx, 0xc68a56b6
mov ecx, dword [edi]
push 0x2a3367bf
sal dword [esp], 0x72
neg word [esp + 1]
adc edi, 3
xor ecx, ebx
not byte [esp + 1]
rol ecx, 2
shl byte [esp], 0x81
dec dword [esp]
sar dword [esp], 0x37
dec ecx
jmp 0x13c5299
mov eax, 0xce114dbf
not cl
shr dl, 0xe6
sbb cl, 0xa9
neg cl
or dl, 0x1c
pop eax
ror cl, 1
xor bl, cl
lea edx, [edx + 0x7f357922]
add ecx, esp
call fcn.013c1804
jg 0xb16b4a
int3
lodsb al, byte [esi]
mov al, byte [eax]
add byte [eax], dl
add byte [eax], al
xor al, 0
add byte [eax], al
add dword [ebx + eax*8], 6
jecxz 0xb16b7f
sbb dword [edi + 0x63], 0x73
xchg ebx, eax
je 0xb16b45
and byte [ebx], 0x84
or dword [ebx - 0x6bcc727d], 0x23
mov dl, 0x83
mov ch, 0x13
mov ecx, 0xc4a3c303
push ebx
invalid
cmp esi, 0
and byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
add dword [ebx], 0xc
xor ecx, dword [0x28531e83]
jecxz 0xb16bbd
jae 0xb16bc0
ret
mov dword [0xe30a7300], eax
or ah, bl
or al, 0xa3
sbb al, byte [ebx + 0x73244323]
mov bl, 0x2f
inc ebx
xor bl, al
push esi
ret
push 0xeb9182a0
xor ebx, ecx
add ebp, ecx
lea esp, [esp + 8]
jmp 0xbf1d1f
push edi
pushfd
mov edi, 0xc032e59d
push edx
mov edi, dword [esp + edi*2 + 0x7f9a34ce]
mov dword [esp + 8], 0xdcd521db
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.011cf8f8
not edx
or ecx, eax
and eax, ecx
ror edx, 1
call fcn.013d3c3d
mov ecx, 0xee2d953b
sub cl, cl
movzx ecx, byte [esi]
mov edx, 0xca8ba032
xor edx, edx
lea esi, [esi + edx + 1]
add edx, edx
adc edx, 0x5b0aa792
xor cl, bl
push edx
ror cl, 1
jmp 0xb16b29
neg ecx
rol word [esp + 1], 0x4c
dec byte [esp + 2]
xor ecx, 0x16093d11
dec word [esp + 1]
jne 0xb441c9
Function at 0xb4873e
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
lea edi, [eax + edi - 0x1fd]
inc ax
shl dl, cl
mov word [edi + eax*4 - 0x800], dx
mov edx, 0x2e9db18b
lea esi, [esi + eax*2 - 0x404]
mov dword [esp + eax*8 - 0x1000], 0x1e8bcd2d
ror eax, 0x8e
mov eax, dword [esi + eax*2 - 0x10000000]
lea ecx, [edx*8 - 0x645e0bfa]
jae 0x13f30a2
nop
mov cx, ss
mov ss, cx
jmp 0xb85ccc
call fcn.00c59b90
add cl, al
nop
inc eax
or dword [esp + edx - 0x2d30], 0x6e9dfb87
bswap ecx
sal ecx, cl
xor ebx, eax
call fcn.00bc105e
mov eax, 0xe52b2a9e
movsx ecx, ax
lea ebp, [ebp + ecx*2 - 0x5540]
mov edx, ecx
sal ecx, cl
not cx
mov eax, dword [ebp + edx - 0x2a9e]
call fcn.013b2474
mov eax, dword [eax + esi - 0xbcfd]
call fcn.00bcf236
or al, 0xa1
jbe 0x12a5fb0
arpl cx, dx
cli
into
retf 0xa2fe
pop edx
xor eax, ebx
xor eax, 0x3cb4ce98
inc dl
sub ecx, 0x101bcea3
not eax
ror ecx, cl
dec eax
ror eax, 3
rol cl, 0xc6
dec eax
call fcn.00c0fc12
mov eax, 0xda352b3d
lea edx, [eax*2 + 0x11a151b6]
mul eax
mov edx, dword [edi]
or eax, 0xf8afb82c
adc edi, 4
movzx ecx, al
xor edx, ebx
or ax, ax
lea edx, [edx + eax - 0x318d8b8a]
xadd ecx, eax
adc al, 0x39
not edx
lea edx, [edx + eax*2 + 0x1035be0]
push ecx
not edx
rol dword [esp + eax*2 - 0x1cc], cl
inc dword [esp + eax - 0xe6]
setg cl
xor ebx, edx
add ebp, edx
xadd cx, ax
imul cx, word [esp + eax*2 - 0x17a00]
mov ecx, dword [esi + eax*2 - 0x17a02]
jb 0x12a5fec
mov word [eax + eax - 0x7a], es
invalid
jle 0x13f3142
pop ds
xor eax, 0xde7b4e32
jnp 0x13f311b
in al, 0x53
scasd eax, dword es:[edi]
retf 0x4d01
mov dh, 0xf8
sbb al, 0x35
inc ecx
cmp eax, 0xe3d8d01b
insd dword es:[edi], dx
invalid

Function at 0xb4911a
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + esi - 0xb00f], 0x7a1235b7
mov ebx, dword [esp + esi*4 - 0x2c038]
ror byte [esp + esi*2 - 0x1601e], 0x82
jb 0xc5528a
rol ebx, 2
xor ebx, 0xbc995a1d
inc esi
movzx ebx, word [esp + ebp - 0x41b89986]
dec eax
rol dword [esp + ecx - 0x81], 0xbd
inc eax
movsx eax, ch
lea ebx, [edx + ebx - 0x7411c59f]
inc ecx
add ebx, 0xb518132a
inc edx
not byte [esp + ebp - 0x41b89980]
neg ebx
call fcn.0133f09b
syscall
call fcn.00af0b69
mov ecx, 0x4fa1e335
mov eax, 0x8097b389
mov edx, ecx
lea ebp, [ebp + edx - 0x4fa1e339]
lea edx, [ecx + 0x393d5e95]
mov eax, dword [ecx + ebp - 0x4fa1e335]
not ecx
xor eax, ebx
call fcn.012e50bd
Function at 0xb50cdc
Capabilities:
Authenticate hmac

Disassembly:
not dl
xor dl, 0x3c
btc ecx, ecx
sbb cx, cx
jp 0x11c5bed
xor edi, eax
push 0x9536ab0e
sar word [esp + 1], 0x24
not dword [esp]
and edi, 0xff
push 0x11b69d36
mov edi, dword [edi*4 + 0xa9e6d4]
sar word [esp + 4], 0x28
jnp 0x13e852b
shr eax, 8
call fcn.013d1a43
sub eax, esi
cmp si, si
cli
push 0xffffffffffffff87
salc
invalid
lea edi, [edi + ecx*4 - 0x24eb046f]
xor dl, bl
btr cx, cx
ror dl, 1
rol cx, 0x61
sub cx, cx
inc dl
jmp 0xab1649
and edi, 0xff
not dword [esp + 4]
mov dword [esp], 0xd314bd8f
or byte [esp + 6], 0x31
mov edi, dword [edi*4 + 0xc9d188]
shl word [esp + 1], 0xc1
add word [esp], 0x16bb
setnp byte [esp + 2]
shr ecx, 8
push 0x52aefc23
inc byte [esp + 6]
xor ecx, edi
call fcn.00c266e2
push 0xef3fdc00
lea esp, [esp + 8]
je 0x13b74bc
push 0xed8503bd
shl dword [esp], 0xd2
push 0xff20c62c
mov dword [esp + 4], edi
lea esp, [esp + 4]
movzx edi, byte [ecx]
jmp 0xb2873b
sbb edx, ecx
neg al
xor edx, 0x86bea695
xor ebx, edx
or ax, cx
adc esi, edx
shl al, 0x24
jae 0x13c6ff5
mov dword [esp + eax - 0xfff0], esi
ret 4
lea ecx, [edx + ecx - 0x4dfa315e]
btr ecx, 0x2f
xor ebx, eax
add ebp, eax
neg dx
rol ecx, 0x63
jae 0x133fa02
lea eax, [edx*2 + 0x263ac39a]
adc al, ah
mov eax, dword [esi]
lea ecx, [edx*4 - 0x367572f1]
adc ecx, edx
lea esi, [esi + ecx - 0x67fec868]
rol edx, 0xc7
xor cl, dh
xchg ecx, edx
xor eax, ebx
sub edx, 0x1e26e199
inc dx
bswap eax
btr cx, cx
dec ecx
shl cl, 0xe1
neg eax
sal cl, 0x61
shl cl, 0x21
lea ecx, [ecx*4 + 0x21a88a86]
dec eax
dec ecx
xor edx, 0x47a0c0b5
rol eax, 3
jmp 0xc462ca
xor bl, dl
sar ecx, 0xbe
adc edx, esp
bts cx, 0x86
and ecx, ecx
mov word [ecx + edx - 0x40], ax
movsx eax, cx
mov edx, dword [edi + ecx - 0x40]
btr cx, cx
div al
xor eax, ecx
lea edi, [edi + ecx*2 - 0x7c]
xor eax, ecx
xor edx, ebx
not ecx
neg edx
dec cl
sub edx, 0xd01cf827
push ecx
ror edx, 1
sub dword [esp + eax - 1], ecx
bswap edx
imul eax, eax
and ecx, ecx
xchg byte [esp + eax], ch
neg edx
push ecx
or cx, word [esp + eax*2]
jle 0xb68eda
jmp ebp
mov ecx, 0x7b3278b
imul ecx, ecx
not eax
mov edx, ecx
mov dword [edi], eax
jb 0x11be4c8
mov ecx, 0x93a8238
mov ax, word [ecx + ebp - 0x93a8238]
sar cx, 0xc1
movzx edx, cl
lea ebp, [ebp + ecx*2 - 0x12758236]
jl 0x13f9cc6
mov dword [esp + edx*2 - 0x102], esi
ret 0x10
mov dl, byte [ecx + edi - 0x93ac11c]
js 0xb3ebb4
Function at 0xb911d1
Capabilities:
Encode data using base64

Disassembly:
je 0x12d5761
pop eax
xor ebx, ecx
add esi, ecx
pop ecx
rol cl, 1
xor ecx, ecx
mov ax, word [edx + ebp - 0x579bd933]
lea edx, [edx + ecx*8 + 0x68033912]
and dx, cx
jge 0xc3d3dd
mov ecx, 0x112b35a9
mov eax, dword [ecx + esi - 0x112b35a9]
push ecx
ror ecx, cl
or dword [esp], ecx
adc esi, 4
shl cl, 0x81
xor eax, ebx
add cl, ch
shl ecx, cl
bswap eax
sar ecx, 0xbe
sbb eax, 0xd4949590
xor eax, 0xba2b36bc
neg eax
xchg word [esp + ecx + 2], cx
xor ebx, eax
xor dword [esp + ecx - 0xd5ab], ecx
pop ecx
xor cx, cx
adc ebp, eax
btr cx, cx
jb fcn.00c99374
lea eax, [ecx*4 - 0x394fafc1]
or ecx, dword [edi + ecx]
mov eax, dword [edi + 4]
mul ecx
mov dword [edi], edx
mov edx, 0xbcbb820e
lea ecx, [edx + edx*2 - 0x1eee9f7a]
mov dword [edi + ecx - 0x1743e6ac], eax
shr edx, 0x5e
jmp ebp
adc cl, byte [ecx + ebp + 2]
or edx, edx
adc ebp, 2
sar edx, 0xd6
shr ax, cl
mov word [ebp], ax
push edx
pop eax
jmp esi

Function at 0xb94f03
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], 0xa70ab493
mov esi, dword [esi*4 + 0x13054a8]
shr edx, 8
jmp 0xc0049c
neg word [esp + 1]
call fcn.00ca3d41
push 0x8a80b5bd
mov ax, word [edi]
add edi, 2
mov ecx, 0xd851e86
sub dword [esp + ecx*8 - 0x6c28f430], ecx
movzx edx, byte [esi + ecx - 0xd851e86]
sal cx, 0xab
ror cx, 0xf
lea esi, [ecx + esi - 0xd855fff]
xor ecx, ecx
imul ecx, ecx
xor dl, bl
add cl, ch
btr ecx, ecx
and dword [esp + ecx], 0x28250a10

Function at 0xb9faf3
Capabilities:
Execute syscall

Disassembly:
mov edx, dword [edi + edx - 0x402e5205]
xor edx, ebx
movsx eax, cl
bts eax, ecx
bswap edx
sar ecx, cl
not edx
dec cx
dec edx
push eax
neg edx
rol dword [esp + eax - 0x87], cl
dec al
xor ebx, edx
and cl, cl
call fcn.00c3f223
mov dword [esp], 0x5358e254
call fcn.013feca3
mov eax, dword [esi + eax - 0x3580887c]
call fcn.00bacad9
and ebx, 0xff
call fcn.013fa918
inc esp
movzx esi, bp
dec edx
mov ebx, dword [esi + ebx*2 + 8]
inc eax
movzx eax, bh
dec edx
lea esi, [esi + ebx*2 + 0x10]
dec edx
mov dword [ecx + esi - 0xfbb], ebx
not bp
dec edi
lea eax, [eax + ebx*8 - 4]
push eax
inc edx
mul dword [esp + ebx + 3]
inc edx
rol byte [esp + ebx + 5], 0x81
inc ebx
mov ebx, dword [ebx + eax]
inc ecx
xor ebx, ecx
xor ebx, 0x8389a71e
not al
bswap ebx
inc si
or dword [esp + ebx + 6], ebx
xor ebx, 0x4f318d3a
inc esi
xadd dword [esp + ebx + 2], esi
jp 0xc502d9
mov edx, 0xa435c107
movsx ecx, dx
sub edi, 4
add dl, 0x9d
xor edx, 0xe41b93a1
jns 0xb3a20a
dec ebx
inc ebp
movzx ebp, bx
inc edx
mov dword [esp + ebx*2], ebp
inc dx
neg dword [esp + ebx*2 + 4]
dec esi
mov dword [esp + ebx], ecx
dec ebp
lea edi, [ebp + eax + 0xc004d85]
inc ecx
neg ebx
inc edx
xor dword [esp + esi*4], ebx
dec esp
lea ebp, [ebp*2 - 0x7febbd7f]
dec ebx
lea ecx, [esi + edi*8 + 0x6e125ba1]
push eax
dec esi
mov ecx, dword [esp + ebx*8 + 8]
sar edx, 0x1e
dec esi
xadd dword [esp + ebx], ebp
sal dx, cl
dec eax
arpl bx, bx
dec esp
adc edx, ebx
pop edx
dec esi
mov dword [esp + ebx*8], edx
ret
Function at 0xbb0ecc
Capabilities:
Execute syscall

Disassembly:
xor cl, 0x86
mov dword [esp], 0xba047a31
add cl, 0x97
cwd
push edx
neg cl
not al
sar dword [esp + 4], 0xbf
inc ax
sbb cl, 0xab
xor bl, cl
lea ecx, [esp + ecx + 8]
mov ax, word [ecx]
xadd byte [esp], dh
rol dword [esp + 3], 0xd9
sal word [esp], 0x69
sbb ebp, 1
mov word [ebp], ax
call fcn.00b35a1e
inc ecx
mov esp, 0x61becd0a
inc ecx
movsx ecx, sp
inc ecx
movzx ebp, sp
dec edi
lea eax, [esp + eax - 0x61becd0b]
inc ecx
mov edi, esp
inc ecx
rol ah, 0x61
inc ebx
movzx ecx, byte [eax - 0x61becd14]
call int.00ba9b78
mov eax, dword [edi]
mov edx, 0xb3923618
add edi, 4
mov ecx, edx
xor eax, ebx
imul edx, ecx
inc eax
neg dl
js 0x1323f0b
sysenter
push esi
push edi
pushfd
mov edi, 0xb3a20e04
mov dword [esp + 8], 0x7137506b
mov edi, dword [esp + edi + 0x4c5df200]
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.01297733
shr cx, 0xad
neg eax
bt dx, 0x2b
shr dx, 0xe2
inc eax
rol eax, 2
call fcn.00bd2b2b

Function at 0xbcc258
Capabilities:
Encode data using xor

Disassembly:
pop ecx
mov edx, dword [esp + 4]
mov dword [ebp + edx*2 + 4], eax
call fcn.012b0702
mov bh, 0x4e
out 0x3b, al
lodsb al, byte [esi]
inc eax
movsb byte es:[edi], byte [esi]
invalid

Function at 0xbdbeef
Capabilities:
Encode data using xor

Disassembly:
adc dl, 6
xor dl, 5
add dl, cl
call fcn.00aa92e7
jmp 0xbe0553
mul ecx
mov dword [esi], edx
pop edx
jmp 0xc11b85
mov edx, 0xc28cffa7
mov dword [esi + 4], eax
lea ecx, [edx*8 + 0xc3e3806]
movzx eax, cl
mov eax, dword [ecx + edi - 0x20a6353e]
shl dl, 0x61
inc cl
rol dl, 0xc6
lea edi, [edi + ecx*2 - 0x414c6a7a]
shr edx, 0x7d
xor eax, ebx
lea eax, [eax + ecx*4 + 0x46895c27]
bts cx, cx
btc cx, 0x2d
jae 0xb80396
not eax
shr edx, 0x59
neg ecx
lea eax, [eax + edx + 0x1035dac]
ror edx, 0xe2
not eax
dec edx
btr dx, dx
xor ebx, eax
sar ecx, cl
or cx, cx
push edx
adc ebp, eax
sub dx, cx
shr edx, 0xfd
mov dword [esp + edx - 7], ebp
ret
Function at 0xbe055d
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
pop ecx
add edi, eax
imul edx, edx
mov eax, dword [edx + esi - 0x10000]
mov ecx, edx
ror dword [esp + edx - 0xfffc], 0xf1
mov ecx, dword [esi + edx*2 - 0x1fffc]
or edx, 0x2ab4641e
sbb edx, edx
mov dword [esp + edx*2 + 4], ebx
call fcn.00ca9722
mov ecx, 0x50b5318a
movsx eax, cl
lea ebp, [ebp + ecx - 0x50b5318e]
mov edx, eax
mov edx, dword [ecx + ebp - 0x50b5318a]
btc eax, 0x13
xor edx, ebx
xor ax, cx
add eax, ecx
jnp 0x11b4b9f
dec eax
loop 0xbe0622
iretd
insb byte es:[edi], dx
inc esp
rcl byte [esi]
sbb byte [edx], bh
cmpsb byte [esi], byte es:[edi]
push esi
in eax, dx
sal dword [eax], 1
lodsd eax, dword [esi]
outsd dx, dword [esi]
lcall 0x81e4, 0xa8c0c38d
clc
mov word [eax + 0x43622060], ds
pop esp
sbb dword [edx], esp
sbb bh, byte [0x1603d1fb]
and esi, dword [edi - 0x2886dfdb]
invalid
neg eax
dec ecx
mov dword [esp + ecx*8 - 0x6bf34], eax
bswap edx
sub al, byte [esp + ecx - 0xd7e1]
mov dword [esp + ecx - 0xd7e7], 0x7f0ccf98
rol edx, 1
pop eax
lea ecx, [eax*8 + 0x5e899431]
xor ebx, edx
add ebp, edx
call fcn.00b3c744
dec edx
call fcn.00aede46
imul ebx, dword [ebx - 0x52b3349b], 0x42
test ah, bh
dec esi
outsb dx, byte [esi]
sahf
jnp 0x11b4b6e
stc
adc bh, dh
fidivr dword [ebx]
scasb al, byte es:[edi]
pop esi
xor eax, 0xd74d49bc
add al, 0x47
inc esp
dec esi
push es
xchg edx, eax
sti
cli
clc
movsb byte es:[edi], byte [esi]
test bh, 0x7b
jnp 0x11b4bec
iretd
imul esi, ebx, 0x50
add al, 0x7f
mov edx, 0x7f8e2332
invalid

Function at 0xbee536
Capabilities:
Execute syscall

Disassembly:
add edi, 4
jmp 0xbcda1e
push 0x99bbe62c
and byte [esp + 0xe], 0xbc
shld dx, ax, cl
mov ecx, 0xaf31242c
mov eax, ecx
mov dword [esp + 8], ecx
mov word [edi], dx
sub esi, 4
pop edx
mov dword [esp + edx + 0x664419d4], ecx
mov ecx, dword [esi + edx + 0x664419d4]
shr byte [esp + edx + 0x664419d7], 0x21
neg edx
cwde
xor ecx, ebx
mul ax
not edx
shr dword [esp + eax*2 - 0xcf1d], 3
xor ecx, 0x7f215e34
rol dword [esp + eax*4 - 0x19e3f], 0x10
ror eax, 0x48
bswap ecx
adc edx, 0x9235b33a
inc ecx
not edx
bswap ecx
dec dx
btr eax, 0xbf
or edx, 0xb40d0ebc
dec ecx
dec ax
mul edx
jb 0x13ead91
mov dx, word [edi]
mov eax, 0x6036bc15
shr al, 0xa1
sar eax, 0x72
mov ax, word [edi + eax*2 - 0x3018]
mov ecx, 0x73a59028
mov dword [esp + ecx - 0x73a59020], ecx
sal ecx, cl
add cl, byte [edi + 4]
inc dword [esp + 8]
jns 0xbc8afd
mov eax, 0x4d9a5128
lea esi, [eax + esi - 0x4d9a5129]
rol ax, 0xa7
sbb al, 0x95
movzx eax, byte [esi + eax - 0x4d9a9493]
mov ecx, 0xa2b00da2
jp 0x11d7b48
sysenter
call fcn.012aca97
mov edx, 0x9a19e883
xor al, bl
sub dl, cl
not al
shr dx, 0x65
call fcn.011b2306
mov ecx, 0x73228886
movzx ax, byte [ecx + edi - 0x73228886]
btc cx, 0x99
lea edx, [ecx*4 + 0x50224d08]
mov cl, byte [edi + ecx - 0x73228a84]
adc edx, edx
btr dx, 0xb2
dec dl
lea edi, [edi + edx*2 - 0x72b1dc7c]
lea edx, [edx + edx + 0x299b1582]
btr edx, edx
adc al, cl
mov word [edi], ax
bswap edx
lea esi, [esi + edx*2 - 0x1e4993c]
call fcn.00aaba56
sar dword [esp + edx - 0x57f0e200], cl
lea esi, [esi + edx - 0x57f0e1fc]
xor eax, ebx
rol eax, 3
dec eax
jmp fcn.00c1aa51
rol ecx, 3
cwde
xor ebx, ecx
pop edx
call fcn.012aa92a
Function at 0xc10fcb
Capabilities:
Encode data using xor

Disassembly:
lea eax, [ecx - 0x186da0d2]
inc eax
ror edx, 1
rol ax, 0x85
dec cx
jno 0xaebcce
sahf
pushfd
std
stosb byte es:[edi], al
scasb al, byte es:[edi]
into
mov dword [ecx + ebx*4 + 0x7c], 0xe515a1d4
aad 0xaa
invalid
lea edx, [edx + ecx*2 - 0x6f44e15d]
bts cx, ax
imul ax, ax
jb 0xc5bc0c
movsx ecx, ax
xor edx, ebx
div al
mov dword [esp + ecx*2 - 0x8b7c], ecx
sub edx, 0xad2272ae
xor edx, 0x4d940280
sar cx, 9
shl cl, cl
adc byte [esp + ecx*4 - 0x21d], 0x21
bswap edx
lea edx, [edx + ecx + 0x691f4327]
xor ebx, edx
xchg dword [esp + ecx - 0x88], eax
add ebp, edx
cwde
push ecx
lea eax, [eax + eax*2 + 0x2688d23b]
mov ecx, dword [eax + esi - 0x2689a375]
sar eax, 0x3d
mov eax, dword [esi + eax + 3]
push 0x7592a2b6
ror dword [esp + 7], 0x9b
mul ecx
mov dword [esi], edx
mov ecx, 0x92bb6fba
sar word [esp + 7], 0x4c
push ecx
mov dword [esi + 4], eax
movzx eax, byte [esp + 0xc]
call fcn.011ac6c3
mov edx, 0xc831b437
mov ecx, edx
movsx eax, cx
mov edx, esi
add ecx, eax
add al, 0x82
shr eax, cl
lea esi, [esi + eax*8 - 0x1ffff4]
mov dword [eax + esi - 0x3fffe], edx
mov edx, dword [edi + eax - 0x3fffe]
lea edi, [edi + eax*2 - 0x7fff8]
setp cl
xor edx, ebx
shr cx, 0x62
btc ecx, eax
bt eax, eax
sbb edx, 0xf3239e30
jmp 0xade183
ror edx, 2
bt ecx, ecx
xadd al, ah
inc edx
cwde
imul cx, cx
xor ebx, edx
add ebp, edx
jmp fcn.011af2b4

Function at 0xc1498e
Capabilities:
Encode data using xor

Disassembly:
dec ecx
push 0x831da08c
mov dword [esp + 0xc], 0xd5022b2f
push 0x11bc9125
lea esp, [esp + 0x14]
jne 0xbee9f9
pop edi

Function at 0xc266e2
Capabilities:
Encode data using base64

Disassembly:
inc edx
push 0x91934325
ror byte [esp + 8], 0x23
setb byte [esp + 8]
xor ecx, 0x2319e8b3
dec eax
lea esp, [esp + 0x14]
jne 0x12d9d32
mov edi, 0xc3a939b4
lea edx, [edi - 0x55e63e6]
pop edi
mov edi, 0xe0385bb8
dec edi
movzx edi, byte [edx]
call fcn.013bea10

Function at 0xc4183c
Capabilities:
Encode data using xor

Disassembly:
dec eax
setg al
rol ecx, 1
call fcn.00c46e37

Function at 0xc43a6d
Capabilities:
Encode data using xor

Disassembly:
lea eax, [ecx + ecx*4 - 0x16741cfc]
test byte [ecx - 0x16741cfc], cl
lea esi, [esi + ecx - 0x1f962e1d]
push ecx
xor edx, ebx
shl ax, 0xc5
sar ax, 8
sbb dword [esp + ecx*4 - 0x7e58b884], ecx
inc edx
cbw
ror edx, 2
sub cl, ah
neg edx
or dword [esp + ecx*4 - 0x7e58b884], ecx
xchg byte [esp + ecx - 0x1f962e1f], ch
btc eax, ecx
inc edx
not word [esp + ecx - 0x1f969621]
neg edx
add dword [esp + ecx*4 - 0x7e5a5884], ecx
sub cl, ch
xor ebx, edx
add ebp, edx
shr dword [esp + ecx*2 - 0x3f2d2d16], cl
call fcn.013ed542
mov ebx, 0x23342532
pop edi
push cs
inc byte [ecx - 0x1e]
xchg ecx, eax
jae 0xbffc55
retf
and ax, word [esp + eax*8 - 0x1343e]
xor ebx, ecx
add ebp, ecx
or eax, eax
mov ecx, dword [edi + eax]
sal al, 0xa3
bswap eax
adc eax, dword [eax + edi + 4]
xor dword [esp + 0xb], 0x283da9ab
push 0xada47113
mul ecx
mov ecx, 0xf294cf3a
mov dword [esp + 4], 0xc1d953a
ror cl, 0xe1
mov dword [edi], edx
jo 0xbffc54
shl cx, 0x41
sbb cx, 0xe438
mov dword [edi + 4], eax
movsx edx, cx
xor byte [esp + 0xc], dl
pop ecx
pop edx
pop edx
pop edx
pop ecx
jmp ebp
Function at 0xc43f4e
Capabilities:
Authenticate hmac

Disassembly:
xor byte [esp + edx - 0x7ffffff8], dl
adc esi, ecx
mov dword [esp + edx - 0x7fffffff], edx
movzx ecx, byte [edi + edx - 0x7fffffff]
mul edx
lea edi, [edi + eax*8 - 0xf]
lea eax, [eax*2 - 0x1074e5c4]
div dl
xor cl, bl
dec cl
mov dword [esp + edx - 0x7ffffffa], 0x3c27a4b6
imul edx
not cl
ror edx, 0x93
rol cl, 1
xchg dx, ax
pop eax
idiv word [esp + eax - 0x7ffffffd]
sub cl, 0xba
xor bl, cl
or dl, al
xor edx, edx
dec al
lea ecx, [esp + ecx + 4]
adc dx, word [ecx + edx]
pop ecx
shl ax, 0xee
lea ebp, [ebp + eax - 0x7fff4002]
add eax, ecx
mov word [ecx + ebp - 0x3c27a4b6], dx
mov edx, ecx
setno cl
lea eax, [edx*2 + 0x3b086bb6]
jne fcn.00b0430e
Function at 0xc960f3
Capabilities:
Parse pe header

Disassembly:
inc ecx
mov edi, 0x7c977b1b
dec esi
lea esp, [edi*2 + 0x5b4b818]
dec edi
lea eax, [edi + eax - 0x7c977b1f]
jmp 0xbf1a24
inc esp
mov dword [ebx + esi - 0x39], edi
inc ecx
ror bl, 0x41
dec dword [esp + ebx - 0x35]
dec eax
mov dword [esp + ebx - 0x31], 0x181bd434
dec esi
lea eax, [ebx + eax - 0x3d]
dec eax
bts ebx, edi
dec eax
lea eax, [ebx*2 + 0xb212425]
dec esi
lea edi, [ecx + ebx - 0x234e5cd4]
inc ebx
mov edx, dword [eax + esi*2 - 0x1f38]
adc eax, ebx
dec ecx
sal edi, cl
inc ecx
xor edx, ecx
neg edx
inc ecx
sar bl, 0xc6
inc cx
not ebx
inc edx
setnp byte [esp + esi - 0xf97]
lea edx, [edx + ecx*2 + 0x58c755a3]
inc si
xchg dword [esp + esi - 0xf97], ebx
xor al, bl
ror edx, 1
dec ecx
xor esi, 0xc0add52b
bswap edx
inc cx
imul ecx, edi
inc esp
movsx ebp, bl
inc esi
add dword [esp + esi*2 + 0x7ea44a9e], esi
dec esi
mov dword [esp + esi + 0x3f522551], ecx
ja 0xcae941
sysenter
call fcn.00b53821
mov ebx, eax
mov ebx, edx
mov edx, ebx
ror eax, 0xd5
shl edx, 2
neg ax
mov eax, ebp
call fcn.00ab69a2
mov ecx, 0x6e8fa480
mov edx, dword [edi + ecx - 0x6e8fa480]
push ecx
lea edi, [edi + ecx - 0x6e8fa47c]
movzx eax, cx
call fcn.011a8fba
call fcn.00c10c98
jmp 0x13b0974
inc edi
mov esi, dword [eax + edi - 0x7c977b1b]
inc ecx
mov edx, edi
jmp 0xc3e103
inc ecx
movzx ebp, ah
inc ebp
xor esi, ecx
mov eax, edx
sar dl, 0xe6
inc cx
dec esp
inc ecx
rol esi, 1
movsx edi, ax
dec ecx
lea ebx, [esp + edx*4 - 0x78daa6ea]
inc ecx
xor esi, 0x24b2b285
inc ecx
movzx ecx, bh
inc sp
bts ecx, edi
dec ebp
lea ebp, [esp + 0x413f2e06]
inc ecx
inc esi
inc ecx
xor esi, 0x6893daa2
inc ecx
push ecx
dec eax
xadd ebp, ebx
inc cx
sal esp, 4
inc esi
xor dword [esp + edi - 0x7c977b1b], esi
inc cx
shr esp, 0xf
jb 0xc656b1
inc esp
movsx ecx, bl
dec cl
dec esp
mov ecx, dword [esp + ebx*8 - 0x1c0]
btr edi, 7
dec eax
mov dword [esp + ebx - 0x39], ebx
dec eax
bts edi, ebx
dec eax
lea esi, [esi + ebx - 0x3d]
movzx edx, di
jae 0xb93f26
jmp 0xb28f35
inc edx
xor dword [esp + esi + 0x3f522551], edx
inc ecx
movzx ebp, di
dec eax
lea ebp, [edi + ebx*8 + 0x100f1d96]
inc esi
add esi, dword [esp + esi*2 + 0x7ea44a94]
dec esp
mov ecx, dword [esp + eax*4 - 0x2c84939c]
dec eax
arpl dx, dx
dec esp
add edx, edx
inc ecx
sub esi, 0xe784a088
inc ecx
pop esp
inc sp
bt ebx, edi
inc ecx
pop esi
jb fcn.00ca1b11
call fcn.00be3ceb
xor ebx, edx
sub cx, 0x3f86
not byte [esp + eax*4 - 0x23a5]
cmovns ax, cx
add esi, edx
call fcn.00afdc44
neg dl
dec eax
ror eax, 2
jmp fcn.00ae4258
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
mov ecx, 0x5c8aad2d
push 0x69abf73c
lea esp, [esp + 8]
jne 0xcb2deb
mov eax, dword [ebp]
push 0xf18ec71d
push 0xa03e103b
jmp 0x12ea796

Function at 0xc99374
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1272dba
push 0xc423e584
lea esp, [esp + 0x10]
ja 0x12b042d
mov eax, esp

Function at 0xc9ad47
Capabilities:
Execute syscall

Disassembly:
ror eax, 1
shr byte [esp + 5], 0xe7
sbb eax, 0x318cfa9d
call fcn.00ca5e2f
syscall
call fcn.014076c5

Function at 0xca97df
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
call eax
mov ebx, 0xf7afbf18
mov ebp, dword [ebp - 4]
jmp 0xa98b71