joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12384de
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
pop edx
and byte [esp + eax - 0x1abc14fd], al
lea edx, [eax*8 + 0x2cb603a2]
inc ecx
neg word [esp + eax - 0x1abc14fe]
xor ebx, ecx
sal dx, 0xec
adc esi, ecx
rol dword [esp + eax*4 - 0x6af05400], 0xbe
call fcn.013e5dbd
mov eax, 0x1f3bc70a
sub al, ah
jnp 0x12e9981
mov ecx, 0xb28b7b06
movzx eax, cx
mov dx, word [ebp + eax*4 - 0x1ec18]
ror eax, cl
inc al
xchg ah, cl
mov cl, byte [ebp + eax - 0x180006eb]
lea ebp, [ebp + eax - 0x180006eb]
sbb ax, 0xf69d
shl dx, cl
ror eax, 0x1a
dec eax
mov word [ebp + eax*4 - 0x105014], dx
movzx ecx, al
jp 0x13d3af2
shl eax, 0x21
mov word [ebp], dx
movzx edx, ax
mov edx, dword [edi + edx*2 - 0x65d8]
bswap eax
lea ecx, [eax + eax*4 + 0x5b149a08]
or cl, ch
adc edi, 4
add eax, eax
sub ax, 0x6a87
xor edx, ebx
call fcn.012b20bc
mov dx, word [ebp + eax*2 - 0x3e778e86]
and eax, 0xb04cf0d
mov cx, word [eax + ebp - 0xb00c6ff]
not ax
lea ebp, [eax + ebp - 0xb0038fc]
or al, ah
bswap eax
adc dx, cx
sub eax, 0x21056695
jae 0x1257e68
movsx edx, cx
mov edx, dword [edi + eax*2 - 0x8280a]
sbb al, 0x16
lea edi, [edi + eax - 0x414eb]
xor edx, ebx
call fcn.013aff28
inc eax
or ch, bl
inc edx
xor byte [esp + ebp - 0x64bb2034], dl
dec edx
sal dword [esp + ebp - 0x64bb203f], 0xfd
inc ecx
sar ebp, 1
inc eax
not ch
dec ebx
lea eax, [ebp + ebp*2 + 0x1c06b5b5]
movzx ebx, ax
dec ebx
lea esi, [ebp + ebp*4 + 0x5f367304]
inc bx
mov dword [edi - 0xffd4], ebp
bswap edx
dec esp
lea ecx, [ebx*8 + 0x5b996b33]
dec esi
mov dword [esp + ebp*2 - 0x64bb2056], ebx
ret 0x28

Function at 0x124e6e0
Capabilities:
Encode data using base64

Disassembly:
imul cl
mov dword [esp + edx*2], edx
movzx ecx, dx
xor edx, 0x7db207bc
mov word [ebp + ecx], ax
and edx, 0x772891b2
lea eax, [ecx*2 + 0x7d898793]
neg ax
mov eax, dword [edi + ecx*2]
sub byte [esp + ecx*8], ch
neg ecx
lea edi, [ecx + edi + 4]
call fcn.012a3c8c
clc

Function at 0x1253e63
Capabilities:
Encode data using base64

Disassembly:
xor ebx, ecx
shl edx, 0x99
adc esi, ecx
mov ecx, ebp
xchg byte [esp + eax*2 - 0x4d4d0216], dh
xor eax, 0xa60cac23
pop eax
lea ebp, [ebp + edx*2 - 0x38003c04]
jle 0x13ce9d0
mov dword [ebp + edx*2 - 0x38003c00], ecx
pop ecx
pop eax
jno fcn.012c9356
dec ebp
dec edi
sbb esi, dword [ebx + 0x4b]
salc
jmp 0x5a9ac403

Function at 0x1262223
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor

Disassembly:
lea edx, [edx + eax - 0x25f858e7]
and al, ah
neg ecx
push eax
xor edx, 0x97ba030c
neg edx
bswap edx
xor ebx, edx
lea ecx, [ecx + eax*2 + 0x370a01b1]
add esi, edx
rol cx, 0x4b
call fcn.0128c3f1

Function at 0x127039a
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x18]
je 0x12cdca4
push 0xef2129a7
shl dword [esp], 0xca
call fcn.0124807b
Function at 0x12775ff
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea ecx, [edx + edx*4 + 0x4f9e1411]
shl byte [esp + edx - 0x4d222c4f], cl
movzx cx, byte [eax + edx - 0x4d222c51]
sal byte [esp + edx - 0x4d222c4f], 0xe1
lea ebp, [ebp + edx - 0x4d222c53]
mov word [ebp + edx - 0x4d222c51], cx
and edx, 0xeb16c824
mov eax, edx
pop eax
pop eax
jne fcn.012c9356
aad 0x77
arpl word [edi + 0x41], sp
push ss
sti
arpl word fs:[ebp + 0x34], ax
sbb eax, 0x8316b0b6
aad 6
mov al, byte [0x3dc69729]
xor al, 0x15
mov dword [esp + edx - 0x4d222896], ecx
xor bl, al
rol dx, 9
sub word [esp + edx - 0x4d222c4f], cx
lea eax, [esp + eax + 8]
jbe 0x1244f33

Function at 0x127fd6f
Capabilities:
Encode data using base64

Disassembly:
ror ecx, 1
inc edx
xor ecx, 0x5f096e04
mov dword [esp + edx - 0x5fc9c63], edx
xchg byte [esp + edx - 0x5fc9c63], dh
neg ecx
inc dword [esp + edx - 0x5fc6363]
jle 0x12fe28b
xor ebx, ecx
jmp 0x13f5162
mov edx, 0x24bbbc3b
mov edx, dword [ebp + edx*2 - 0x49777876]
mov eax, 0xba347f22
movzx ecx, al
mov eax, dword [ebp + ecx*4 - 0x84]
lea ebp, [ecx + ebp - 0x1e]
add cx, cx
push ecx
shr dword [esp + ecx - 0x44], 0x5b
adc edx, eax
sar dword [esp + ecx*2 - 0x88], cl
call fcn.012e2368

Function at 0x1288d72
Capabilities:
Encode data using base64

Disassembly:
dec ebp
lea esp, [eax + edi*2 + 0x732f7727]
dec esp
mov edx, dword [esp + ecx + 0x17]
dec eax
shl eax, 0xb2
and si, 0x7dbb
dec esp
mov dword [esp + ecx*4 - 4], esp
dec eax
arpl bp, bp
dec eax
mov dword [esp + ecx + 0x17], edx
call fcn.012d33d4

Function at 0x1288d9a
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jne 0x129a0ba

Function at 0x128a1ae
Capabilities:
Encode data using base64

Disassembly:
jle 0x13bed2c
movzx eax, byte [edi + eax*2 - 0x1805a]
neg edx
add edi, 1
call fcn.012c5202

Function at 0x1290a12
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
dec eax
ror eax, 1
xor ecx, ecx
push edx
not eax
xor eax, 0x3b72185
mov dword [esp + edx - 0x3189326], edx
not eax
bswap ecx
xor ebx, eax
neg cx
call fcn.013d23db

Function at 0x1290a36
Capabilities:
Encode data using base64

Disassembly:
jmp 0x13aed19
ror ax, 0x2b
xor edx, 0x8b208a1e
call fcn.01248b48
ror ecx, 1
push edx
jmp 0x1225ecc
not ecx
call fcn.013beac3

Function at 0x1296716
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc ecx
or ah, 0xe
xor bp, 0xb5bb
inc ecx
xor esi, edx
rol esi, cl
sub esi, 0xcf8b040f
pop eax
not esi
jmp 0x13d080e
call fcn.013ed69a
Function at 0x1296c4c
Capabilities:
Encode data using base64

Disassembly:
inc si
mov ebp, dword [ebp + edi - 0x5d2ca206]
inc ebp
movzx esp, byte [esi + ebp - 0x5d2ca207]
inc ebp
xor ah, dl
dec eax
mov dword [esp + ebp - 0x5d2ca206], ebp
pop edx
push edx
inc ecx
inc ah
inc ecx
not ah
dec esp
lea eax, [ebp + edx*8 + 0x629a0096]
dec eax
lea esi, [ebp*2 - 0x6be9c3d0]
inc ecx
xor ah, 0x94
neg dword [esp + edx - 0x5d2ca205]
inc word [esp + edx - 0x5d2ca205]
inc ebp
movzx ecx, al
inc ecx
add ah, 0xb3
inc ecx
xor ah, 0xbe
inc ecx
movsx ecx, al
inc ecx
sub ah, 0x9d
inc eax
xchg byte [esp + ebp - 0x5d2ca1ff], ch
inc ecx
xadd ecx, ebp
inc ebp
xor dl, ah
dec esi
lea esp, [esp + 8]
inc eax
xchg byte [esp + ebp - 0xcb], ch
not ecx
inc ebp
mov byte [esp + ebp - 0x5f], ch
or bp, 0xf63a
inc edx
mov ebx, dword [edx + esi - 0x5d2ca20b]
dec ebp
lea esi, [esi + ebp - 0xf684]
and esi, 0x9b0adfb0
inc ebp
movzx esp, ax
inc ecx
xor ebx, edx
or edx, dword [esp + ebp*2 - 0x1ecfd]
dec esp
or esp, dword [esp + ebp*8 - 0x7b3f8]
ror ebx, 3
xadd cx, dx
xor ebx, 0x313f371e
lea ebx, [ebx + ebp*4 - 0x698e0617]
neg dl
neg ebx
inc ecx
not ah
jmp 0x13ccb5f
dec esp
mov dword [esp + ebp - 0xf67f], edx
dec edx
lea ebp, [0x85afb031]
call 0x12d4e77
Function at 0x1299a8b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push esi
cmp bp, 0xfcba
test edx, edx
je 0x129ff88
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x12ad7b5
push ebp
mov ebp, esp
btr edx, 0x33
mov edx, dword [ebp + 8]
sub esp, 0x114
jmp 0x1279f72
je 0x129ff88
mov eax, 0x5a4d
stc
cmp word [edx], ax
jmp 0x129ff82

Function at 0x129a90b
Capabilities:
Encode data using xor

Disassembly:
inc ebp
mov esp, eax
dec ebp
dec ecx
dec eax
mov dword [esp + edi*2], ebp
movzx eax, byte [esp + edi + 4]
shr byte [esp + edi*2], 0x83
bswap ecx
inc ecx
shl al, 0xc3
xor ecx, 0x421d8aa8
jmp 0x13f0522
push edi
call fcn.013da2fa
movzx ax, byte [ebp]
mov ecx, 0x4c940037
lea ecx, [ecx + ecx + 0x6120959d]
mov cl, byte [ebp + 2]
push 0x689f7629
mov edx, 0xbda90f27
add ebp, 2
shr edx, 0xdb
not al
shr edx, 0x6c
not cl
or al, cl
lea ecx, [edx + edx + 0x603c16a7]
mov word [ebp + ecx - 0x603c16a7], ax
xchg cx, dx
pop eax
not dx
mov edx, dword [edx + edi - 0xe958]
sub eax, eax
lea edi, [ecx + edi - 0x603bfffc]
dec cl
call fcn.012e1b6c
push edx
dec edx
call dword [ebx]
sar byte [esi - 0x1a], cl
imul ebp, dword cs:[ecx - 0x80], 0x75
outsb dx, byte [esi]
outsd dx, dword [esi]
mov ebx, 0x7e758069
scasb al, byte es:[edi]
fld xword [ecx - 0x80]
jne 0x13dc171
not bl
imul eax, dword [eax - 0x24c1798b], 0x97758069
xchg edi, eax
out dx, eax
stosd dword es:[edi], eax
imul eax, dword [eax + 0x43c64f75], 0xff758069
xlatb
xor ebp, dword [ecx - 0x80]
jne 0x13dc1df
dec byte [ebx]
imul eax, dword [eax + 0x47b11875], 0x22bc714a
call 0x6ab52e75
push ebx
cld
sub byte [ebx], ah
stosb byte es:[edi], al
inc esi
ror ebx, 0x5a
mov dword [0xe5f7a88c], eax
sub eax, 0x58450d76
leave
fisttp dword [ecx - 0x50b5a4c5]
enter 0xffffffffffff9789, 0xffffffffffffffd7
mov ch, byte [edi + 0x235b89c8]
push 0xffffffffffffffaf
enter 0xffffffffffffe389, 0x17
loop 0x13dc1ce
enter 0x4f89, 0x2f
and ch, byte [edi - 0x506c7638]
mov edx, 0x389c8af
xchg edi, eax
mov dl, 0xaf
enter 0xffffffffffffc389, 0x2f
retf 0xc8af
dec eax
bswap ebx
not ecx
jmp 0x13dc146

Function at 0x12a85f6
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0xd0350781
sub edi, 0xfffffffb
sal cx, cl
neg cl
dec cl
xor al, bl
sal cl, 0x65
add ecx, 0x435e486
call fcn.01290089
dec ecx
xor al, dh
adc eax, eax
pop edx
neg ecx
sub dword [esp], eax
pop edx
sbb eax, edx
lea ecx, [ecx + eax - 0x6c234e05]
ror ecx, 2
add al, al
ja 0x12b7371
mov byte [esp + ecx*2 - 0x6c], dl
inc ebp
lea esp, [esp + ecx*8 - 0x996cd7]
inc ecx
bswap esp
inc esp
movzx ebp, bh
inc byte [esp + edi - 0x494bc26a]
inc ecx
dec esp
jmp 0x12a050d
xor ebx, ecx
add esi, ecx
sub ax, dx
mov edx, dword [ebp + 8]
or al, 0x2b
adc ebp, 0xc
add eax, eax
movzx eax, byte [edi + eax - 0x793db72]
jle 0x12874ab
shr byte [esi + edi*2 + 0x51], 0x48
xor cl, byte [ecx - 0x723aa77]
Function at 0x12aa623
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec esp
mov dword [esp + edi - 0xde], ebx
ret
inc ecx
movzx eax, byte [esi + eax - 0x8fb6]
dec eax
or ecx, ebp
inc ecx
xor al, dl
mov esi, 0x4a2cb00c
inc al
neg byte [esp + edi + 7]
movsx ebx, dl
not al
inc esp
movzx esp, cl
xor al, 0x94
xchg byte [esp + edi], cl
add al, 0xb3
inc byte [esp + edi*8 + 1]
dec word [esp + edi*2]
dec ecx
or edi, esp
xor al, 0xbe
sub al, 0x9d
mov dword [esp + edi*4 - 0x375], 0xe995230f
ror byte [esp + edi*2 - 0x1ba], 0xc1
inc esp
xor dl, al
sal byte [esp + edi - 0xde], 0x21
sbb cx, word [esp + edi - 0xd9]
and dword [esp + edi*8 - 0x6ec], edi
dec eax
lea eax, [esp + eax + 8]
rol dx, cl
inc ecx
mov ecx, 0xa808b7ad
inc esp
mov byte [eax + edi*2 - 0x1bc], al
jb 0x1232797
bswap ecx
xadd dword [esp + eax*2 - 0x250], eax
shl al, 0xa4
dec ecx
push eax
mov word [esp + eax*2 - 0x2fa], ax
xor ebx, ecx
add esi, ecx
jmp 0x13b0e68
dec eax
mov dword [esp + eax - 0x8fb6], ecx
dec esp
adc ebx, esi
inc bp
mov eax, dword [edi + eax*2 - 0x11f6c]
dec ebp
lea edi, [edi + eax*8 - 0x47dae]
neg dword [esp + eax - 0x8fb4]
inc eax
sar bh, 0x47
dec edx
lea edx, [ebp*2 + 0x4cb2e22c]
dec ebp
lea esi, [esi + eax*4 - 0x23ed9]
jns 0x13d9d7e
mov ecx, dword [ebp + eax - 0x180]
mov eax, dword [eax + ebp - 0x17c]
mul ecx
mov ecx, 0x528c3930
mov dword [ebp + ecx - 0x528c3930], edx
mov dword [ebp + ecx - 0x528c392c], eax
inc byte [esp + ecx - 0x528c392e]
mov dword [esp + ecx - 0x528c3930], esi
ret 4
jp 0x12a1d2d

Function at 0x12ac8b4
Capabilities:
Encode data using base64

Disassembly:
dec esi
lea edi, [esi + edi - 0x2331]
dec ecx
lea edx, [ecx + ebp*4 - 0x1ac18551]
dec esi
lea esi, [edi + esi - 0x59b6]
inc ecx
movzx eax, byte [esi + esi - 0x2339]
inc ecx
xor al, dl
dec eax
mov dword [esp + esi*8 - 0x119c8], esi
dec eax
add dword [esp + esi - 0x2329], edx
xor al, bl
sal bl, 0x85
xor al, 9
shr word [esp + esi*4 - 0x8cd5], 3
ror word [esp + esi*4 - 0x8ccf], 0x4b
jae 0x13d9c80

Function at 0x12ad534
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + ecx - 0x3c388910]
mov dword [esp + 8], 0x2df8995b
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.012f2828

Function at 0x12c9414
Capabilities:
Encode data using base64

Disassembly:
inc esp
mov eax, ecx
pop ecx
dec eax
inc ebx
shr dword [esp + ebp - 0x1c57], 0xaa
dec eax
ror ebx, 2
dec esp
xor edx, ebx
dec ecx
mov dword [edi + ebp*2 - 0x38c4], ebx
inc ecx
neg eax
dec esi
lea edi, [ebp + edi - 0x1c64]
jle 0x12ca435
inc ecx
pop ebp
pop edx
pop ebp
pop esi
jno fcn.013ed213
Function at 0x12cdc87
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea ecx, [ebx + ebp*2 + 0x428055b0]
mov dword [esp + edx*2 - 0x278d2acc], 0x2ba457a0
xor di, 0xeda2
dec eax
not ebx
dec eax
lea edx, [ebp + eax*4 + 0x77283c17]
sub di, 0x4720
not di
inc cx
add eax, ebp
ror di, 1
sar eax, 0xf4
dec eax
dec eax
inc esp
mov dword [esp + ebx + 0x6aa3], ebp
inc sp
xor edx, edi
and cx, 0xb80e
jae 0x12c30cc
mov eax, 0xb22ccf31
and al, ah
mov ecx, dword [edi]
inc eax
sar al, 0x84
add eax, 0x5991507
adc edi, 4
or eax, 0x8b0252ac
xor ecx, ebx
lea edx, [eax*8 + 0x463c0e82]
inc ax
neg ecx
sar ax, 0x66
adc ax, ax
adc ax, dx
inc ecx
jmp 0x12a6d07
or ax, ax
and eax, 0x95ab5d8e
not ecx
and dx, 0x9d39
xor ecx, 0x3a201623
neg ecx
lea edx, [edx - 0x51fafbf3]
dec dl
seto al
xor ebx, ecx
add esi, ecx
neg dx
movsx ecx, dx
mov eax, dword [ecx + edi - 0x7abc]
sbb ecx, edx
dec cl
lea edi, [edi + ecx*2 - 0x1afffff8]
call fcn.0129de1b
setge dl
inc cx
mov dword [edi + ebx + 0x6a92], edi
sar cx, 3
dec esp
mov dword [esp + ebx*4 + 0x1aa48], ebx
ret 0x10
shr edx, 8
xor edx, ebx
inc ecx
xor edx, 0x7b124e3f
dec eax
lea esp, [esp + 0xc]
jne 0x1248083
mov ebx, 0x22034c2a
pop ebx
not edx
call fcn.013ba3c8
salc
pushal
jb 0x12cdd16
imul esi, dword [ebx], 0xfffffffd
dec esp
adc eax, 0x56b48d4d
dec ebp
lea esi, [esi + edx*2 - 0x278d2ae2]
sbb dword [esp + edx*4 - 0x4f1a559e], eax
inc esp
xadd byte [esp + edx - 0x13c69553], al
dec eax
adc dword [esp + edx*2 - 0x278d2ac4], esi
inc cx
xor edi, edx
dec eax
mov dword [esp + edx - 0x13c6955e], ebx
pop esi
inc esp
movzx ebp, al
dec di
jmp 0x1296d29
aam 0x23
salc

Function at 0x12ce82e
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esi + edi - 0x34], ebp
inc ecx
mov ebx, dword [esi + esi*2 - 0x5d]
inc ecx
movsx ebp, ah
inc ecx
xor ebx, edx
movsx ecx, byte [esp + esi - 0x23]
dec eax
mov dword [esp + esi*2 - 0x58], 0xab0db03e
sub ebx, ecx
and edi, dword [esp + esi*8 - 0x14d]
rol ebx, 3
dec eax
lea edx, [ecx*2 - 0x60d3354b]
inc ecx
mov ebp, 0xce9b9c9b
xor ebx, 0xc98b2382
add ebx, ecx
pop eax
dec esp
and dword [esp + edi - 9], ebp
dec dx
dec esp
xor dword [esp + edi*2 - 0x12], edx
xor dword [esp + edi - 5], ebx
dec esp
mov edx, dword [esp + edi*2 - 0x12]
dec ecx
add ecx, esp
dec eax
mov dword [esp + edi - 5], edx
inc esp
movsx eax, dh
dec eax
arpl bx, bx
sal dword [esp + edi - 7], 0x1b
push edi
dec ecx
sub ecx, 0xc005ab1a
dec esp
add ebx, ebx
inc ecx
pop ecx
inc esi
movzx ebp, word [edi + esi - 0x14]
jmp 0x13b79c5
dec ecx
sar esp, cl
cmovnp ax, cx
dec ebp
lea esi, [esi + edi - 0x14]
jns 0x121eda5
add esi, edx
mov eax, dword [ebp + ecx + 0x416d6a21]
sar ecx, 0x5f
dec byte [esp + ecx*4 + 4]
rol ecx, 0xfb
mov ecx, dword [ecx + ebp + 5]
add eax, ecx
jmp 0x13bb200
mov ecx, 0xf152b38
mov dword [ebp + ecx - 0xf152b34], eax
inc cx
shr ecx, cl
mov ecx, dword [ebp + ecx - 3]
mov eax, dword [ebp + 8]
call fcn.0126b5d8
Function at 0x12d52aa
Capabilities:
Encode data using base64

Disassembly:
not eax
push ebp
inc eax
xor eax, 0x21b4a431
inc ecx
pop ebp
dec edx
lea ebx, [esi + ebp + 0x21abb2b1]
inc eax
inc dh
inc eax
neg bl
inc ecx
push edx
xor dword [esp + esi - 0x15bbd9a0], eax
inc ecx
pop edx
dec eax
xor edi, ecx
dec eax
arpl ax, ax
jno 0x12ba340
dec ecx
cmovp ecx, ebp
dec esp
adc ebx, eax
dec ebp
lea esi, [esi + esi*4 - 0x56ef6681]
inc ebp
movzx ecx, byte [esi + esi - 0x15bbd9a0]
inc esp
or ch, dh
inc ebp
xor cl, dl
sal si, 0x82
dec eax
lea ecx, [ebp*4 - 0x474e0de1]
inc esp
movsx esp, bx
inc ecx
inc cl
xor ebx, ecx
inc ecx
rol cl, 1
inc ecx
movsx eax, ch
dec edi
lea ebp, [esp - 0x2e72c663]
dec eax
sal ecx, 0xb0
inc ecx
dec cl
and ebx, 0xa979daa
inc ecx
mov eax, 0x249896ad
inc ecx
neg cl
inc ebp
xor dl, cl
inc ebp
xor ah, ch
dec esp
adc ecx, esp
dec eax
dec esi
and si, bp
jnp 0x12f9a20
mov cl, byte [ebp + 2]
rol dl, 0x87
shl ax, cl
ror dl, 0x23
rol edx, 0xb
mov dword [esp], 0xd7bfb314
mov word [ebp + 2], ax
mov ax, word [ebp + 2]
and dword [esp], edx
inc edx
ja 0x13008d5
dec ecx
sub esi, 4
mov esi, 0x15bbd99f
dec eax
lea edi, [esi*2 - 0x6e611d6c]
inc ecx
mov eax, dword [esi + esi - 0x15bbd99f]
inc eax
movsx ebp, bh
dec eax
lea ecx, [edi + ebp*2 + 0x696ac3d]
dec eax
lea ebp, [ebp + ecx*4 + 0x3430c416]
inc ecx
xor eax, edx
bswap eax
inc eax
dec bh
jne 0x12483fe
cmp eax, 0xed1b5ef7
not dword [ebx + edx*2]
or edx, ebx
xchg ecx, eax
dec ebx
js 0x12d5372
or edx, ebx
mov eax, dword [0x953201d]
fcmove st(0), st(1)
int1
push eax
push ebx
or edx, ebx
mov esp, ecx
daa
outsd dx, dword [esi]
adc dh, byte [ecx + 0x2990f814]
push ecx
sub byte [eax], cl
fisub word [edi + 0x50165a81]
out dx, eax
mov eax, dword [0x1a0ba6e0]
int1
sal byte [edx + 0x3b], 1
int1
sub eax, edx
cmp edx, dword cs:[ecx - 0x43]
sub eax, edx
adc ebx, dword cs:[edi - 0x43]
push ecx
and byte [esi], ch
mov ah, 0xae
pop edi
sal dword [ebp - 0x3c910b71], 1
add eax, ecx
scasb al, byte es:[edi]
mov esp, 0x1858304b
jle 0x12d5387
adc cl, 0xe9
mov dh, 0x63
dec ebp
add byte [edx - 0x6bd54df], dl
sbb al, 0xaa
leave
or ebx, ebp
pop esp
jmp 0x12d539f
mov byte [ecx - 0x4d], al
push edi
enter 0x7dd4, 0x77
mov edi, 0x7fd4c857
movzx esi, word [ebx]
xor esp, edx
add dword [ecx - 0x7ed3d30e], 0xc1c0d3d5
xor edx, 0xd5812c2c
rol eax, cl
rol edx, 2
push eax
aad 0xd3
rol cl, 0xc2
add dl, byte [eax - 0x77]
mov word [ecx + ebx*8], cs
push cs
invalid
inc cx
mov ebp, dword [ecx + esi*4 - 0x56ed08d0]
inc ecx
sal ch, 1
dec esp
xor ebp, edi
inc esp
movsx ecx, di
dec ebp
lea edi, [edi + esi - 0x15bb4236]
inc cx
xor ecx, ecx
inc cx
mov dword [edi + esi*2 - 0x2b768468], ebp
dec eax
dec edi
ja fcn.013ed213
mov dx, word [ebp + 4]
mov ecx, dword [esp]
jae 0x1223214
cmp ax, 0x1120

Function at 0x12d73b7
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], edx
shl cl, 0x61
xor ebx, eax
pop edx
shr ecx, cl
add esi, eax
ror cx, 0xcd
movzx eax, byte [edi + ecx*4 - 0xf16cb]
call fcn.012a9b4f
Function at 0x12e00f7
Capabilities:
Encode data using base64

Disassembly:
inc edx
xor edx, 0x5085fa04
not eax
mov dword [esp + eax - 0x2d61f345], ecx
ror ecx, 0x92
inc edx
not edx
sar eax, cl
lea edx, [edx + ecx - 0x7c273a9e]
push ecx
mov dword [esp + eax*2 - 0xb587c4], 0xbb8a511
add al, 0x3b
xor ebx, edx
jmp 0x13d8166
add esi, edx
lea ecx, [eax*4 + 0x109bd03b]
call fcn.01304c4c

Function at 0x12e355a
Capabilities:
Encode data using xor

Disassembly:
shr dx, 0x6c
sbb dx, dx
lea edi, [edx + edi - 0xcd2fffc]
call fcn.012f9f09
inc ecx
mov eax, 0x3dbacab6
inc ebp
movzx ebp, ax
mov esi, 0xb00654b1
dec ebx
mov edi, dword [ebp + edi - 0xcab6]
xor esi, 0x511c2884
dec edi
mov eax, dword [edi + eax - 0x3dbacaae]
dec edi
lea edi, [edi + ebp*2 - 0x19564]
call fcn.012b193d

Function at 0x12f2828
Capabilities:
Encode data using base64

Disassembly:
lea ebx, [ebx*4 + 0x6b32eda6]
jmp 0x13a9fda
push ebx
mov ebx, 0x7590380e
push edx
jmp 0x124e318
push edi
jmp 0x13d9c17
mov edx, 0xba95be29
push ecx
lea edx, [edx*4 + 0x6629fdb3]
not bx
pushfd
movsx ecx, bx
push edx
neg dword [esp + edx - 0x5080f657]
mov dword [esp + ecx*8 - 0x19108], esi
lea ecx, [edx + 0x708ec1aa]
call fcn.0129dd09

Function at 0x12f4749
Capabilities:
Encode data using base64

Disassembly:
call fcn.013a65b4
neg ax
jmp 0x13d8685
mov dword [esp + edx - 0x427a0100], ecx
neg eax
pop edx
xor ebx, eax
lea ecx, [edx + ecx*8 - 0x37d7bc5]
add esi, eax
mov ecx, dword [ecx + ebp - 0x52cc843b]
mov eax, dword [ebp + edx - 0x4279fffc]
sar edx, 0x4e
mov dword ss:[edx + ecx - 0x109e8], eax
lea ecx, [edx*8 - 0x5969fc5b]
mov eax, 0xbd913c37
sar dl, 0xe2
movzx eax, word [edx + edi - 0x109f6]
not edx
sbb edi, 0xfffffffa
sar ecx, 0x7b
xor ax, bx
and ecx, ecx
ror ecx, 0x7d
not ax
sub ax, 0x748b
sal cx, 0x46
add dl, 0xa
jno 0x12578d7
dec esp
mov dword [esp + esi*4 - 0x7c3c], edx
movzx eax, si
inc byte [esp + esi - 0x1f08]
call fcn.012b984b
inc ecx
jmp ebx
and ecx, ecx
not ax
sal cl, 0xe5
not dl
setbe dl
sbb ax, 0x288a
and edx, edx
xor bx, ax
mov word [ebp + 6], ax
jmp 0x12253bc

Function at 0x12f7253
Capabilities:
Encode data using base64

Disassembly:
xor al, 0x14
mov edx, dword [esp + 4]
neg al
pop edx
xor bl, al
inc dword [esp]
mov edx, 0xcc2ac287
lea eax, [esp + eax + 4]
call fcn.01254060

Function at 0x12f7f7c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx - 0xf598], edx
sub byte [esp + edx*8 - 0x7acbd], 0xa0
mov word [ebp + edx - 0xf598], ax
shl dword [esp + edx*8 - 0x7acc0], 0xb7
mov ecx, dword [edi + edx*8 - 0x7acc0]
call fcn.0121b83a
lds esp, [eax + 0x7e]
inc eax
push eax
xor al, 0xe0
arpl word [edx + 0x70], si
cmp dword [eax], ecx
adc dword [ebp + 0x2444c779], 4
mov dword [esp + 4], 0x2d542eaf
lea esp, [esp + 4]
call fcn.012f2828

Function at 0x12f9f09
Capabilities:
Encode data using base64

Disassembly:
jne 0x1232b41
xor ecx, ebx
rol edx, 0x7a
mov dword [esp + edx*2 - 0x6697fc], 0x8b8ecf89
sbb ecx, 0x8000a92f
xor ecx, 0xb7859592
rol eax, 0xc6
lea ecx, [ecx + edx*2 + 0x45b2521b]
sub eax, edx
sbb dword [esp + edx*2 - 0x6697fc], edx
call fcn.01212443

Function at 0x13acc92
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 2], 0x448fca95
call fcn.01285cf7
Function at 0x13ad9a3
Capabilities:
Encode data using base64

Disassembly:
add cl, byte [esp + eax + 3]
xor edx, 0xb32ad013
add dword [esp + eax], ecx
xor ebx, edx
rol cx, cl
lea ecx, [eax*2 - 0x3052e7f4]
jae 0x124b065
lea eax, [ecx*4 - 0x7872d856]
add cl, byte [ebp + ecx*2 + 2]
or eax, eax
jb 0x12f0ee1
adc ebp, 2
sal dl, cl
lea ecx, [eax*2 - 0x38d9fed0]
ror cl, 0x47
setb cl
mov word [ebp], dx
mov ecx, dword [edi]
adc edi, 4
movsx edx, ax
shl ax, 0xc9
or edx, edx
xor ecx, ebx
add dl, dl
xchg ah, al
lea ecx, [edx + ecx - 0x6280a085]
sub eax, eax
ror ecx, 1
sub eax, eax
inc ecx
dec al
call fcn.012dd0fd
mov dword [eax + ebp + 2], edx
rol eax, cl
lea edx, [eax + ecx*2 + 0x3b8bc292]
lea ebp, [ebp + eax*2 + 2]
add cl, 0x9e
mov dword [esp + eax], esi
ret 4
mov dword [esp + eax*4], 0x311aff8f
rol edx, 1
ror dword [esp + eax*4 + 2], 0xa1
dec edx
shr cl, 0xe2
seta byte [esp + eax + 3]
ror edx, 1
xor ecx, 0x931aba0a
jp 0x1220da3

Function at 0x13afe07
Capabilities:
Encode data using xor

Disassembly:
dec eax
or edx, 0x1b0a18b2
inc ecx
jmp ebx
push 0xa3bd8b8
dec eax
lea esp, [esp + 0x18]
je 0x12bf3e0
mov eax, 0xec8d042a
inc ecx
push ebx
inc esp
movsx ebx, al
sal eax, 0x23
dec esp
lea ebx, [0x42d5]
inc ecx
movzx eax, byte [ebp]
inc ecx
xor eax, ecx
and eax, 0xff
inc ecx
mov eax, dword [ebx + eax*4]
inc ecx
shr ecx, 8
push 0xcc9b5f2a
push 0xacba552b
inc esp
xor ecx, eax
dec ecx
inc ebp
inc ecx
xor ecx, 0x51acf81
dec ecx
dec eax
dec eax
lea esp, [esp + 0x10]
jne 0x12bf3a3
inc ecx
pop ebx
mov edi, 0x278dd21b
dec eax
lea edx, [edi*8 - 0x26d1bc68]
dec esp
lea eax, [edx*8 + 0x626303e]
inc ecx
not ecx
inc eax
movzx esi, bh
inc esi
mov dword [esi + edi - 0x1b], ecx
bswap edi
jmp 0x12a3ec5
dec ecx
add edi, 0xc
dec eax
mov dword [esp], 0xaea12a96
inc ebp
xor ecx, ecx
dec ebp
test eax, eax
jmp 0x12bf37e

Function at 0x13b78a9
Capabilities:
Encode data using base64

Disassembly:
rol al, 0xe6
dec ebp
lea esi, [esi + esi*8 - 0x48568]
call fcn.01273ef5

Function at 0x13b90fd
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp]
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
mov ebx, 0x71080e36
mov dword [ebp + ebx - 0x71080e36], eax
push cs
or byte [ecx - 0x77], dh
test byte [0x8ef7f1ca], bl
movsx esi, bl
pop ebx
pop esi
pop edi
call fcn.01280cbd
bswap eax
sar cl, 0x84
xor edx, 0x47a0ff06
call fcn.0128da6f
push ds
xor eax, 0x7cc21b48
dec edi
xchg ecx, eax
pop ds
fidivr dword [esi + ebx*4 + 0x4b]
xchg ecx, eax
pop ds
fisubr dword [esi + 0x3fac5c80]
add dword [eax], edi
js 0x13b910c
dec eax
sub eax, 0xdddfc157
mov al, byte [0xd7c3fd37]
mov word [ebx + 0x75], fs
scasb al, byte es:[edi]
lds edx, [esi + 0x29]
dec ecx
rol ch, cl
push esi
sub dword [ecx + 0x67], ecx
rol ch, cl
push esi
sub dword [ecx], ecx
dec edi
std
clc
jbe 0x13b915c
xchg dword [esi - 0x75], eax
invalid