joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18f155b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jnp 0x102c5a3
ror eax, 1
bts dx, 0x2c
btr ecx, edx
rol ecx, cl
inc ecx
pop esi
and si, si
dec eax
bts edx, 0x83
dec eax
arpl di, di
inc ecx
mul dl
dec eax
adc ebx, edi
inc cx
sal ebp, cl
inc cx
ror edi, cl
jne fcn.00fff3bb
mov eax, dword [esi]
mov edx, dword [esi + 4]
push 0x908f96a0
mov ecx, dword [esp]
add esi, 8
neg ecx
jg 0x18f2330
ror eax, 3
sar cx, 0x21
xor ebx, eax
add ebp, eax
lea eax, [edx + ecx*4 - 0xdc6445e]
mov dword [esp + ecx*2 - 0x18000034], ebp
ret 4
sub ecx, ecx
or byte [esp + ecx*2 + 1], 4
mov eax, dword [edi + ecx]
sbb byte [esp + ecx + 1], cl
mov edx, ecx
lea edi, [edi + ecx*2 + 4]
jnp 0xfd3451
adc cx, word [esp + ecx + 1]
xor eax, ebx
lea eax, [eax + ecx*4 - 0x2007f1d8]
call fcn.0100f4e2
mov eax, 0xc99f7801
shr eax, 0x5c
movsx ecx, al
mov ecx, dword [ebp + eax*2 - 0x18]
sbb ax, 0x6a4
sar eax, 0xbf
sub eax, eax
or eax, dword [eax + ebp + 4]
push 0xaeb758b4
shr word [esp + 2], 0x41
ja 0x10376e4
mul ecx
mov ecx, dword [esp]
ror ecx, 0xce
mov dword [ecx + ebp - 0x62d15d6d], edx
mov dword [ebp + ecx - 0x62d15d69], eax
mov edx, ecx
pop edx
mov eax, dword [edi + ecx - 0x62d15d6d]
add edx, edx
lea edi, [edi + ecx - 0x62d15d69]
call fcn.01a7f523
mov edx, 0x188f2f01
movzx dx, byte [edx + ebp - 0x188f2f01]
mov ecx, 0xd29da388
movzx eax, cl
mov cl, byte [ebp + eax*8 - 0x43e]
rol eax, 0xc8
cwde
call fcn.00f53f92
btc eax, eax
or cx, dx
cdq
dec eax
ror dx, 0x26
mov word [edi], cx
sbb esi, 3
movzx ecx, dx
idiv eax
sub eax, 0xccbb560c
mov eax, dword [esi + eax*2 - 0x668953ea]
not cl
xor eax, ebx
xor edx, 0xc296da23
bswap eax
imul ecx, edx
neg cx
or edx, ecx
xor eax, 0x5385f03e
lea eax, [eax + ecx*4 - 0x2df528c5]
shr cx, 0x48
push edx
bswap eax
rol word [esp + ecx - 0x43480023], 0xcb
jp 0xfe36c0
xor ebx, eax
inc cl
dec word [esp + ecx - 0x43480024]
add ebp, eax
sal ecx, 0xcc
sub ecx, ecx
push ecx
or dword [esp + ecx], ebp
ret 4
mov edx, dword [ebp]
js 0xfe26aa
mov edx, dword [edi]
mov eax, 0x6c2f140b
lea edi, [eax + edi - 0x6c2f1407]
sar al, 0x66
xor edx, ebx
dec eax
movsx ecx, al
bts eax, ecx
xor edx, 0xc83845b2
btc ax, ax
dec ax
rol edx, 3
inc ecx
sal eax, 0xbb
sbb edx, ecx
bt eax, 0xb3
ror edx, 1
not edx
sar ax, 0x88
xor ebx, edx
add ebp, edx
neg eax
sbb eax, 0x390f9986
or cl, al
mov ecx, dword [esi + ecx*4 - 0x1e4]
or eax, eax
jnp 0xe5f33a
dec ebp
btc edi, esi
jae 0x17f6027
shr cx, 0x42
mov dword es:[eax + ecx - 0x6f701a58], edx
jne 0x182dcf2
not word [esp + 3]
dec dword [esp]
dec ecx
add ebx, 2
dec ecx
shr ebp, cl
shl dword [esp], 0xc8
neg word [esp + 3]
rol byte [esp + 1], 0x63
dec ebp
mov dword [ebx], ebp
mov ebp, 0x6db4f4b7
push ebp
push ebp
dec ebp
lea eax, [eax + ebp - 0x6db4f4bb]
sal byte [esp + ebp - 0x6db4f4a8], 0x61
not dword [esp + ebp - 0x6db4f4b5]
inc ecx
mov ebp, dword [eax + ebp - 0x6db4f4b7]
mov ecx, 0xe8a15f80
inc esp
movsx edi, byte [esp + 0x10]
inc ecx
xor ebp, esi
not ebp
sub ebp, 0xf28008a2
not ebp
jmp 0xe5000d

Function at 0x191e5d6
Capabilities:
Encode data using base64

Disassembly:
or cl, byte [esi + ecx + 8]
mov dword [esp], 0xa72a6298
add esi, 6
shrd edx, eax, cl
mov dword [esi], edx
jmp 0x1848cfc
Function at 0x1920f97
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + 8], 0xdfdee5e9
dec eax
lea esp, [esp + 8]
call fcn.01a83518
jmp 0x1997de9
push edx
mov dword [esp], 0x465aae2c
call fcn.00d9c751
movzx eax, byte [edi]
add edi, 1
xor al, bl
sub al, 0xa9
neg al
not al
inc al
mov edx, 0xe519bb32
xor bl, al
push edi
and dx, dx
push ebp
movzx ebp, dx
lea edx, [ebp - 0x67699f1]
push ebp
mov dword [esp + ebp*8 - 0x5d990], ebx
mov ebx, edx
ror dl, 1
cmovno bx, bp
mov ebp, esi
push ebx
pop ebx
mov ebx, eax
mov edx, ebx
mov eax, 0x64a6a98b
sal edx, 2
push eax
xadd dword [esp + eax - 0x64a6a98b], eax
sal dword [esp + eax - 0x64a6a98b], 0x96
mov eax, ebp
adc eax, edx
jmp 0x1affb29
add esi, ecx
lea esp, [esp + 8]
jmp 0x193ac58
neg dword [esp]
call fcn.01b037a7
push 0x36b7a290
jmp 0x1ab9c01

Function at 0x19733a4
Capabilities:
Encode data using base64

Disassembly:
adc esi, edx
movzx edx, al
xadd edx, ecx
inc dl
jmp esi
or ch, byte [esi]
or bh, al
push cs
jb 0x1a76d6a
jae 0xf3ae45
inc esi
movzx edx, byte [ecx + eax - 0x90]
push esi
inc ebp
xor dl, dh
dec eax
neg dword [esp + edi - 0x90]
dec ebx
lea ebp, [ecx + 0x1900b61f]
inc ecx
adc dl, 0x22
inc dx
neg dword [esp - 0x7b3cb98d]
inc ecx
not dl
inc ecx
ror dl, 1
btr ebp, 0xd
dec eax
sub esi, dword [esp + edi*4 - 0x240]
inc ecx
inc dl
sar edi, cl
inc ecx
inc esp
inc ecx
not dl
ja 0x18286b3
mov ecx, 0x9628c6b7
call fcn.00ec1dca
and eax, 0x8d67fad8
lds ebp, [edx + 0x49e429e5]
jp 0xfde9db
cwde
xchg ecx, eax
push 0xfffffffffffffff3
sub bl, byte [edx]
add byte [eax + 0x1bb06adf], bh
inc eax
aas
xor dl, byte [edi + 0x7b]
xor al, 0xbc
mov dword [0xafbb40e4], eax
mov edx, 0xf255ee98
sbb byte [ebx], 0xe3
hlt
inc ebp
xor dh, dl
dec esi
lea edx, [esp + edx + 8]
or word [esp + edi + 2], 0x7614
call fcn.01a46b0f
mov ecx, dword [edi + ecx*4 - 0x5400]
push edx
movzx eax, byte [esp + edx - 0x14f8]
mul word [esp + edx - 0x14f7]
lea edi, [edi + edx + 4]
xor ecx, ebx
call fcn.0186889c
and ebx, 0xff
mov dword [esp], 0xa1a5fc98
ror dword [esp + 4], 0x9e
push 0xb438a281
mov ebx, dword [ebx*4 + 0x18902ec]
call fcn.0104ba2f
xor edx, 0xd5284e01
sar eax, 0x22
xor ebx, edx
and ecx, eax
ja 0xfde9e6
mov dx, word [edi]
mov ecx, 0xaf3d481e
not ecx
mov cl, byte [edi + ecx - 0x50c2b7df]
push 0xc511b4bc
mov eax, 0x6c968808
lea edi, [edi + eax - 0x6c968806]
xchg dword [esp + eax - 0x6c968808], eax
call fcn.0189f429
xor cx, 0xb7ab
bswap edx
xor ebx, edx
lea ecx, [eax*2 - 0x6543b86b]
add al, al
add ebp, edx
neg eax
cmovg eax, ecx
movsx edx, cl
mov edx, dword [esi]
bts ecx, eax
adc esi, 3
push edx
ror ecx, cl
neg cl
mov edx, ecx
popfd
jmp ebp

Function at 0x19758aa
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x10], 0x21acd01a
xor edx, esi
inc eax
neg dword [esp + 0xf]
xor edx, 0x821a5a3
dec ecx
jmp 0x1ab9681

Function at 0x19759f8
Capabilities:
Authenticate hmac

Disassembly:
jae 0x18f283d
adc eax, 0x500e2f1f
ror eax, 2
mov dword [esp], 0xa8979b01
ror byte [esp + 0xa], 0xe5
dec eax
push 0xe9a8af27
neg dword [esp + 1]
call fcn.00fae460
sub ebp, 4
mov ecx, dword [ebp]
mov edx, 0x50b8b090
bt edx, 0xa5
bt dx, dx
xor ecx, ebx
bts edx, edx
movzx eax, dl
jae 0x18ad055
Function at 0x1979664
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov dword [esp + 4], 0x4086393f
lea esp, [esp + 4]
call fcn.00f8fec6
lea ebp, [ebp + ecx - 0x60019293]
movzx edx, byte [ecx + ebp - 0x60019292]
xchg dword [esp + ecx - 0x60019292], ecx
pop ecx
xor dl, bl
inc dl
bswap ecx
bts ecx, ecx
xor dl, 0x89
shl ecx, 0xe
not dl
inc cl
add ecx, ecx
sal ecx, cl
inc dl
neg dl
shl cl, 0x21
xor bl, dl
add edx, esp
ror ecx, 0x92
mov word [edx], ax
movzx eax, cx
or eax, eax
mov edx, 0x5c21241c
lea ebp, [ebp + eax*4 - 0x2c4]
imul ecx, ecx
xchg ecx, eax
mov ecx, dword [ebp + ecx*2 - 0x160]
or dx, 0x298d
xor ecx, ebx
btc ax, ax
lea ecx, [ecx + eax*2 + 0x7181f98b]
call fcn.018eb62d
lea esp, [esp + 8]
jmp 0xde4764

Function at 0x197a8b3
Capabilities:
Encode data using xor

Disassembly:
mov ebx, esi
call fcn.01a9d4a6
mov eax, 0x6d26ca18
mov eax, dword [eax + edi - 0x6d26ca18]
mov ecx, 0x6719ef99
shl cx, 0xe4
bswap ecx
adc edi, 4
bt ecx, 0x1b
xor eax, ebx
movsx edx, cx
not eax
xor edx, ecx
sbb cx, dx
push edx
xor eax, 0xbe269532
inc eax
call fcn.00ea8a1e

Function at 0x1999f40
Capabilities:
Encode data using base64

Disassembly:
ja 0x1999f7f
jmp dword [edx]
and cl, cl
rol eax, 1
sal word [esp + ecx*2 - 0x584681b5], 0xe1
bswap ecx
call fcn.00f7614a
xor esp, dword [ebx - 0x312264ef]
out dx, eax
inc ecx
and ah, byte [esp + ebx - 0x12]
sbb al, 0xee
jns 0x1999f90
and ecx, dword [eax - 0x3322eb66]
inc ax
push ebp
and bl, byte [eax - 0x50]
test dword [eax], ecx
and bl, byte [ebx]
push ecx
ficom word [ebp + ebx*8 - 0x465be883]
fsub st(2), st(0)
dec ebx
push ebp
movsd dword es:[edi], dword [esi]
invalid
pushfd
stosb byte es:[edi], al
or dword [eax + 7], edi
js 0x1999f9c
dec edi
jo 0x1999fde
cmp al, 0x8e
and byte [edx - 0x2f], 0xc7
rol edi, 1
dec esi
jl 0x1999f3d
xor byte [edx + 0x52], dl
push cs
or ch, dh
lcall 0xb9e4, 0x549eb736
test esp, 0x7e31c84e
wait
pop eax
stosb byte es:[edi], al
xchg ebp, eax
neg byte [esi + 0x34bb76fd]
push eax
scasb al, byte es:[edi]
lodsd eax, dword [esi]
insb byte es:[edi], dx
xlatb
or eax, dword [edi]
jb 0x1999f5d
push ecx
rcr dword [ebp - 0x14fce4d4], cl
imul esi, dword [edx + 0x635fa04c], 0xe09e5f35
jae 0x1999f93
lahf
test al, 0xcf
or al, 0xac
fmulp st(7)
int 0x65
cmp eax, 0x68494d0f
sub eax, 0x832cfe2e
fsub dword [edi]
mov bl, 5
jmp dword [ebx + 0x78]
Function at 0x1a031c6
Capabilities:
Encode data using xor

Disassembly:
pop ecx
pop eax
pop eax
pop ecx
jnp fcn.0102d8b1
mov eax, 0x9d2155b6
popfd
call fcn.0190ded8
and al, byte [eax + edi*2]
and al, ah
mov dword [0xb8ff7460], eax
xor eax, 0x3bc5290e
mov eax, 0x474e178f
jbe 0x17edb81
stc
inc ebp
invalid
push ecx
add ebp, edx
lea esi, [ecx + esi - 0x2ef03be5]
movzx edx, byte [esi + ecx - 0x2ef03be4]
mov dword [esp + ecx*2 - 0x5de077c4], ecx
pop ecx
xor dl, bl
and dword [esp + ecx - 0x2ef03bde], eax
adc ecx, 0x6d02ddac
add cx, 0x6801
ror dl, 1
neg eax
not byte [esp + eax*8 - 0x442d6]
sbb dl, 0x9c
ror dl, 1
inc dl
xor bl, dl
lea edi, [edi + eax*4 - 0x2216e]
sar ecx, cl
push eax
xadd dword [esp + eax - 0x884f], ecx
mov word [edi + eax - 0x885b], dx
cwde
seta al
jne 0x17edb73
outsd dx, dword [esi]
aam 0x87
pop eax
and cl, byte [esi - 0x2730e3f1]
jg 0x1a03202
cld
call 0xa455e1d9
popfd
pop ebx
cmp ebx, ebx
sar dword [ebx + 0x14d3e1c3], cl
and edx, edx
cmp dword [0x94c76e16], 0x2a
fiadd word [ecx + 0x7d]
pop edi
int1
into
push 0x1568f516
jns 0x1a031e0
mov esp, 0x96c83fe0
sub ah, bl
push esp
into
ror eax, 0x33
mov ebp, 0xb156eb0
dec esp
clc
xchg esi, eax
test byte [eax - 0x54], dh
sub al, 0x35
push cs
bound esi, qword [ebx + ecx*8 - 0x32bfa6c2]
pop edx
dec edx
cdq
sbb al, byte [ebx]
pushal
jnp 0x1a032d5
invalid
imul esp, dword [eax - 0x7cecd055], 0x89dded60
lcall 0xce1f, 0x13aac12a
and dword [eax - 0x13], 0xffffffdd
mov dword [edx + 0x13aac12a], ebx
pop ds
sub al, cl
stosb byte es:[edi], al
adc ebx, dword [edi]
into
stosb byte es:[edi], al
mov esp, 0x24fc2db5
cmpsb byte [esi], byte es:[edi]
add byte [ecx], ah
mov al, byte [0x22a2926c]
xchg ebx, eax
sbb byte [ecx + 0x28], ah
add dh, byte [edx + 0x1660a68]
hlt
add esi, dword [ebx + 0x2a542b5c]
dec esi
dec dword [edx + 0x488ad0cc]
ja 0x1a032b3
test eax, 0xea010371
aas
dec ebx
sub dword [esi - 0xc], ebx
xor dword [ebp - 0x67dd1469], eax
jne 0x1a032ad
mov esi, esp
or byte [edi - 7], cl
push cs
pop esp
xchg edx, eax
leave
mov esp, 0x5ba2a01
jmp 0x1a032a8

Function at 0x1a1cee3
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [edx]
lea edx, [ecx*8 - 0x7bd5a3e7]
lea esi, [esi + edx - 0x62286c7f]
xadd dl, dh
mov dword [esp + edx - 0x622881ed], edx
mov word [esi + edx - 0x622881ed], ax
xchg ch, dl
lea ebp, [ebp + edx - 0x622881c6]
popfd
mov edx, dword [ebp + edx - 0x622881c2]
xor edx, ebx
not ecx
push ecx
call fcn.00f20a2c
cmp ebx, dword [eax]
mov ebx, 0xea7e0492
dec esp
loopne 0x1a1cf0f
pop edx
rcl byte [edx - 0x34], cl
jl 0x1a1cf6c
sbb esi, ebx
jno 0x1a1cf9e
pushfd
adc bl, 0xd3
inc ebp
inc eax
enter 0xffffffffffffec3e, 0x21
mov bh, byte [esi]
or al, 0x61
mov byte [0xed33d538], al
movsd dword es:[edi], dword [esi]
pop ecx
wait
invalid
sub dh, byte [edi - 0x831a559]
int 0x23
wait
insd dword es:[edi], dx
sub dword [ecx], edx
in al, 0xcf
mov esi, 0xcc6b2f46
dec ebp
std
cmp edx, dword [ecx - 0x4f]
pushal
xchg ebp, eax
xor dword [eax], ebx
int3
invalid
Function at 0x1a2478e
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
btc ecx, eax
mov dword [esp + eax*4], 0xdc292c30
adc edx, eax
neg word [esp + eax + 1]
rol word [esp + eax + 1], cl
btc eax, ecx
ror edx, 3
pop eax
rol cl, 0x85
adc edx, 0x62cdd9b
btr eax, 0x1e
or eax, 0x89f46a7
ror edx, 3
sal al, 0x82
sub eax, ecx
dec eax
inc edx
inc ecx
push ecx
bt eax, ecx
xor ebx, edx
cbw
call fcn.018ba3ab

Function at 0x1a2e1fd
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x4518d318
inc eax
push 0xe094d88c
call fcn.018ed9b4
mov eax, dword [edi]
mov edx, 0xf68c928c
add edi, 4
mov ecx, edx
sub ecx, edx
btr ecx, 0x3e
xor eax, ebx
or edx, 0xc03bd52d
imul cx, cx
not eax
xor eax, 0xbe269532
bt ecx, ecx
imul ecx, edx
setno dl
inc eax
push ecx
add edx, edx
bswap eax
rol ecx, 0xa6
inc eax
sar ecx, 0x19
ror eax, 1
lea eax, [eax + ecx + 0x36a435b9]
xchg byte [esp + ecx*2 + 3], dh
xor dword [esp + ecx], ecx
mov dword [esp + ecx], edx
xor ebx, eax
ror ecx, 0xeb
adc esi, eax
movzx eax, cx
call fcn.00f93366

Function at 0x1a307e9
Capabilities:
Encode data using xor

Disassembly:
inc ecx
movsx edi, cx
pop ebp
dec eax
adc ebx, eax
dec edx
mov dword [esp + edi - 0x7c2db8c8], ebx
ret
cmp esi, ecx
call fcn.01a9fc05
dec esi
mov dword [esp + edx + 8], esi
neg dl
inc edx
xor dword [esp + edx + 8], eax
dec ecx
rol edi, 0x3f
dec esi
mov esi, dword [esp + ecx - 0x4d9fc102]
dec eax
arpl ax, ax
jae 0xffba36
Function at 0x1a3b97d
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax + edx - 0x348975ce]
mov dword [esp], 0x9610bd8f
neg eax
not cl
xadd byte [esp + 1], dh
mov dword [esp + 8], 0xe3911a00
adc eax, 0xab025b3
xor ebx, eax
call fcn.00f945d3
not eax
rol edx, 2
not cl
not al
neg edx
and cl, 0x3e
add eax, eax
dec ecx
ror edx, 1
call fcn.00d95d34

Function at 0x1a3c7ce
Capabilities:
Encode data using base64

Disassembly:
push edx
xor ebx, ecx
lea edx, [edx + edx - 0x4fc15642]
add ebp, ecx
mov ecx, 0x8d18f297
dec ecx
sub eax, 1
movsx esi, cl
inc ebp
movzx ecx, byte [eax]
dec eax
rol ecx, cl
dec esp
lea ebp, [ecx*2 - 0x535ab851]
inc ebp
xor cl, dh
jmp 0x1ac8d58

Function at 0x1a3f71a
Capabilities:
Encode data using base64

Disassembly:
bts ax, cx
xor ebx, edx
neg eax
bswap eax
add edi, edx
mov eax, dword [esi + eax - 0x5392ffff]
or ecx, 0x6285725
mov edx, dword [esi + 4]
not cx
adc esi, 8
bts cx, cx
lea ecx, [ecx + ecx*2 + 0x25b9e896]
neg cl
mov dword ss:[ecx + eax - 0x25b6ea27], edx
jmp edi
mov dword [edi + ecx*2 - 0xf369d12], edx
movsx edx, cl
pop ecx
jbe fcn.00effa0e
sysenter
push ebp
call fcn.01a5b0d8
jb 0x1808ffc
mov edx, 0xfbb6ed95
movzx eax, dl
rol eax, 0xa4
lea ebp, [eax + ebp - 0x954]
cwde
movsx ecx, ax
xor ax, ax
mov edx, dword [ebp + eax*2]
xor edx, ebx
add ax, 0xe494
sbb cx, cx
ror ax, 0x4e
rol edx, 3
sar ecx, 0x78
not eax
cwde
not edx
neg edx
ror edx, 2
inc edx
not ecx
sub al, cl
shr cl, 0x62
not edx
dec ecx
jne 0x17e5048
ror dword [edi], 0xc8
inc eax
push ecx
xor ebx, eax
dec byte [esp + ecx - 0x3aa02e00]
neg dword [esp + ecx - 0x3aa02e01]
add esi, eax
sar dword [esp + ecx - 0x3aa02e01], cl
xchg dword [esp + ecx - 0x3aa02e01], edx
movzx eax, dl
mov dword [esp + ecx - 0x3aa02e01], esi
ret
mov dword [esp + eax - 0x3b3b], edx
rdtsc
sub edi, 8
shl dword [esp], 0xc5
mov dword [edi + 4], eax
mov ecx, 0x79b4e89
jbe 0x18e280b
adc al, 0xb
jp 0x1a3f6d9
aad 0xff
invalid

Function at 0x1a7c2b3
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1a851df
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
mov esi, 0x8d8e6a1b
mov dword [ebp], eax
movzx ecx, si
lea edi, [esi + ecx*2 + 0x383aa11]
jmp fcn.0102332f

Function at 0x1a7f561
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp - 0x4904c258], esi
inc esi
xor dword [esp - 0x4904c250], ecx
inc ecx
push esp
dec esi
mov esi, dword [esp - 0x4904c248]
dec edx
mov dword [esp - 0x4904c248], 0x8bda8b8
cdq
dec ebp
arpl cx, cx
dec edx
lea eax, [0x6184e92]
dec edx
ror dword [esp - 0x4904c24d], 0xc5
dec ecx
add ebx, ecx
inc edx
mul byte [esp - 0x4904c254]
inc bx
xor eax, dword [ebx - 0x4904c258]
inc esp
movzx ecx, ch
jmp 0x1a48aa8
Function at 0x1a88fb0
Capabilities:
Check for software breakpoints

Disassembly:
mov dh, 0x4c
and al, 0
and eax, eax
not edx
add eax, eax
jp 0x193762c
inc word [esp + eax - 0x5debb875]
inc dword [esp + eax - 0x5debb875]
neg edx
lea ecx, [eax*2 - 0x38dd7546]
not edx
lea eax, [ecx + ecx + 0x523616b2]
sal word [esp + eax - 0x582a0dfc], cl
inc edx
push ecx
btr eax, ecx
pop eax
xor ebx, edx
inc byte [esp + 1]
add ebp, edx
pop eax
jmp ebp
push edx
rcr eax, cl
sar edx, 0x9c
jp 0x1947465
fld xword [0x8d8888a0]
mov dword [0xbb2d4fd3], eax
lea esp, [ebx - 0x44d2b02d]
jno 0x1a4e0d0
jo 0x1a4e0e1
inc edx
sar dword [0x8df2f04e], 1
aaa
xor dword [edx], edi
clc
aam 0xbd
loope 0x1a4e143
mov al, byte [0xda749d2e]
jnp 0x1a4e19f
fidivr dword [ebx + 0x59]
ror dword [edi], 1
jbe 0x1a4e124
mov dh, 0xeb
pushal
pop eax
cmpsb byte [esi], byte es:[edi]
xor eax, 0x6720c0f
inc ebx
push ebx
ret
sub ebp, dword [ebx - 0x5d1682ac]
inc edx
into
insb byte es:[edi], dx
mov byte [ebp + ebx*2 + 0x4abb3253], 0xfd
xor ebp, dword [ecx]
ja 0x16b8b532
push ss
adc ch, ch
push cs
and eax, 0xf237fbba
xchg esi, eax
xor esi, dword [0xb7a374ae]
pop ecx
out 0x44, eax
arpl bp, bx
mov esi, 0x31841ca1
sbb bh, byte [ecx - 0x43]
wait
pop esp
cmpsd dword [esi], dword es:[edi]
inc ebp
cmpsb byte [esi], byte es:[edi]
or eax, 0xbc983bb0
ret
add eax, dword [edi + eax*2]
mov cx, word [edi + 4]
add edi, 2
mov edx, 0x372ca99b
mov dword [esp + edx - 0x372ca99b], 0xcf1544b8
shr cx, 1
jmp 0x1a4e113

Function at 0x1a8bb36
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [esp + edi + 8]
mov dword [esp + edi + 8], edi
mov edi, dword [esp + edi + 0xc]
lea esp, [esp + 0x10]
mov dword [esp], 0x20a8fd26
push 0x1a1c6e92
cld
rep movsb byte es:[edi], byte [esi]
pop edi
ror byte [esp + edi - 0x1a1c6e90], 0x23
sub edi, edi
push dword [esp + 4]
popfd
movzx esi, word [esp + edi]
jmp 0xecc780
Function at 0x1a9fad6
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
pushfd
mov esi, 0x4537d80f
test esi, 0x1f984289
mov esi, dword [esp + esi - 0x4537d80b]
mov dword [esp + 4], 0x1b36986c
push dword [esp]
popfd
lea esp, [esp + 4]
and al, 4
insb byte es:[edi], dx
cwde
sbb edi, edi
je 0xf57143
add byte [ebp + 0x424648d], bl
call fcn.01817eb3
inc ebp
xor edx, esi
dec esp
lea esp, [edx + esi*2 - 0x146f1ac2]
inc ecx
not edx
inc esp
mov ebp, ebp
inc ecx
neg edx
sar ecx, cl
inc cx
xor ebp, 0x8d45f42f
xchg esp, eax
sub ah, byte [eax + 0x59]
ja 0xf57116
cmc
das
hlt
inc ebp
movzx ecx, ah
inc ecx
rol edx, 1
dec edx
lea eax, [ecx*4 - 0x6ce72177]
dec eax
mul esi
inc esp
xor edx, ecx
inc ecx
push esi
inc cx
imul esp
dec esp
lea edi, [eax*8 + 0x6926530d]
inc esp
xor dword [esp + ebp], edx
inc cx
neg edi
push ecx
dec esp
mov esi, dword [esp + ebp*8 + 8]
dec ebp
arpl dx, dx
dec eax
dec edx
dec eax
cdq
inc ecx
div cl
dec ecx
add ebx, edx
dec eax
lea esi, [ecx*4 - 0x4cfe0167]
dec esp
and dword [esp + ebp], esp
dec ebp
mov ecx, dword [ebx + ebp*8]
inc ecx
mov edi, dword [ecx + ebp*2]
dec edi
lea edx, [edi + edi + 0x44145f3b]
setno dl
dec esi
lea ebx, [ebp + ebx + 4]
inc ecx
mov dword [ebx + ebp], edi
dec edx
lea edi, [0xcdbf6f25]
dec esp
mov dword [esp + ebp*8 + 8], edx
dec eax
mov dword [esp + ebp], ebx
ret 8
lea esp, [esp + 0x1c]
jmp 0xf57100

Function at 0x1aae551
Capabilities:
Encode data using base64

Disassembly:
bt ecx, ecx
xor bl, dl
bts ax, 0xb2
lea edi, [eax + edi - 0x40000e09]
mov dword [edi + eax - 0x40000e05], edx
movsx edx, cl
call fcn.01a0adc0

Function at 0x1ab534c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esp, [esp + 8]
call eax
mov edi, 0x711ac413
mov edx, 0xc88d7e1d
mov esi, edi
mov ebp, dword [esi + ebp - 0x711ac417]
lea edx, [edx + edi*8 + 0x53194014]
push edi
bswap edx
mov dword [ebp + esi - 0x711ac413], eax
imul edx, edx
push edx
lea eax, [edi*4 + 0x5facae94]
mov edi, ebp
bts si, 0x9f
sar edx, 0x45
mov ecx, 0xbb304218
mov ebx, dword [esp + esi - 0x711ac40b]
call fcn.017de6f9
jmp 0xf4fdeb

Function at 0x1ab9b5f
Capabilities:
Encode data using base64

Disassembly:
push 0x9db11a87
dec ebx
lea esp, [esp + 8]
jne 0xf01438
shr byte [esp + 4], 0xc2
mov dword [esp + 4], eax
jbe 0x191faed
Function at 0x1ac8d11
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [eax + edi - 0x242c8000]
lea ecx, [eax + 0x2a8c9592]
lea edi, [edi + eax - 0x242c7ffc]
xor edx, ebx
xor edx, 0xcf822992
lea ecx, [eax + ecx*4 + 0x3c816721]
xchg ecx, eax
btc ecx, 0xa1
not edx
sbb edx, 0x7f92809d
dec cx
cbw
btc eax, ecx
neg edx
sal ax, cl
inc al
dec edx
xor ebx, edx
sal al, cl
add ebp, edx
jmp ebp
inc ecx
movzx ecx, byte [ecx]
dec eax
mov dword [esp], 0x1c35fa3c
xor ecx, ebp
and ecx, 0xff
dec eax
dec dword [esp]
call fcn.01905a79
mov ecx, dword [esi]
mov eax, 0x8d2090b2
mov edx, dword [esi + 4]
shl eax, 0xae
and al, ah
lea esi, [esi + eax - 0x242c7ff8]
ror al, 0xe3
mov dword fs:[ecx + eax*2 - 0x48590000], edx
jbe 0x1a81abf
inc ebp
movzx edx, bp
inc ecx
mov esp, 0x34adfda3
inc ecx
sub cl, 0xbc
inc ecx
push esp
inc ecx
movzx ebp, dx
inc esi
sub byte [esp + edx*2 - 0x8f5c], ch
inc ecx
xor cl, 0x91
inc ecx
add cl, 0x14
inc ecx
ror cl, 1
dec eax
neg esi
inc cx
ror ebp, 0x47
inc ecx
not cl
jns 0xed80d4
inc ecx
xor cl, 0x26
inc cx
btr esp, 8
inc ebp
xor dh, cl
movzx eax, cl
dec edx
ror dword [esp + edx*2 - 0x8f5e], 0x1f
inc edx
adc dword [esp + edx*2 - 0x8f5a], 0xf214fea3
dec esi
lea ecx, [esp + ecx + 8]
dec esp
lea edi, [ecx*4 + 0x5ea983bc]
ror ebp, 0xf7
inc di
movzx edx, byte [ecx + edx*2 - 0x8f5e]
dec edx
inc dword [esp - 0x695bf946]
dec dword [esp + ebp - 0x8f5dfd]
dec esi
lea ebx, [ebp + ebx - 0x8f5e02]
dec eax
xor eax, dword [esp + ebp - 0x8f5e00]
dec edx
neg dword [esp - 0x695bf946]
inc si
mov dword [ebp + ebx - 0x8f5e00], edx
inc esp
mov ecx, ecx
inc ecx
sal cl, 0x62
dec esi
lea eax, [ebp + eax - 0x8f5e04]
inc dx
adc dword [esp - 0x34adfc9d], ebp
inc ecx
mov edx, 0x720de897
inc edi
mov edi, dword [eax - 0x695bf946]
push eax
inc ebp
xor edi, esi
inc cx
inc ecx
inc esi
xchg dword [esp - 0x34adfc98], edx
inc ecx
btr ecx, 5
inc ecx
rol edi, 1
inc cx
ror edx, 0xed
inc ecx
neg edi
inc edx
mul byte [esp - 0x34adfc95]
inc dx
xchg dword [esp + ecx - 0x4b7ffff6], ecx
inc cx
or ecx, 0x8d479f9f
mov esp, 0x17583167
invalid

Function at 0x1b0861c
Capabilities:
Check for software breakpoints

Disassembly:
sal dl, cl
mov word [esi + eax*2 - 0x7200], dx
call fcn.00f91d01
sar ax, 0xe2
neg ecx
ror ecx, 1
xor ebx, ecx
not al
btc edx, 0x10
adc edi, ecx
add dl, byte [esi + edx*2 - 0x20000]
shl byte [esp + eax - 0xe2], 0x41
movsx ecx, ax
mov cl, byte [esi + eax - 0xe2]
shl eax, 0xc5
rol ax, 0x41
lea esi, [esi + eax*2 - 0x71fe]
jne 0x1a10c7a
call fcn.01af9ade
rol al, 0xc4
jae 0x18fb062
movzx edx, cl
sal cl, 0xa5
mov ecx, dword [ecx + ebp - 0x1c880160]
lea edx, [edx + edx*2 + 0xba60e9b]
xor ecx, ebx
mov dword [esp + edx*8 - 0x5d308360], edx
movzx eax, word [esp + edx*2 - 0x174c20d8]
cbw
inc ecx
cdq
cbw
rol ecx, 1
jmp 0x19425b5