joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14dbea6
Capabilities:
Encode data using xor

Disassembly:
mov word [ebp + ecx - 0x6800], dx
inc ecx
mov edi, dword [ebp + esi - 0x7c196800]
dec edi
lea ebp, [esp + ebp - 0x7c1967fc]
inc ecx
xor edi, eax
dec edx
mov dword [esp - 0x7c196800], 0x763b4a01
inc eax
movzx eax, dh
bswap edi
jmp 0x14e79e6

Function at 0x14dfd90
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xb092ca9b
rol ax, 0xc9
neg cl
lea eax, [eax*4 - 0x1ec41de7]
dec byte [esp + 0xc]
rol cl, 1
add eax, eax
add eax, eax
mov dword [esp + eax - 0x44cfa4d0], eax
xor bl, cl
add ax, ax
lea ecx, [esp + ecx + 0x10]
mov dword [eax + ecx - 0x44cf49a8], edx
lea edi, [edi + eax - 0x44cf49ac]
add dword [esp + eax - 0x44cf49a7], 0xcb30c915
movsx ecx, byte [esp + eax - 0x44cf49a1]
mov ecx, dword [ecx + edi - 0x44]
sub dword [esp + eax - 0x44cf49a1], eax
push eax
xor ecx, ebx
and word [esp + eax - 0x44cf49a6], ax
mov edx, dword [esp + eax - 0x44cf4999]
not ecx
inc eax
rol ecx, 1
add word [esp + eax - 0x44cf49a0], dx
bswap ecx
rol ecx, 3
ror edx, 0x86
xchg byte [esp + eax - 0x44cf49a5], al
sar dword [esp + eax - 0x44cf4996], 0x62
xor ebx, ecx
or edx, dword [esp + eax - 0x44cf4992]
jne 0x152326c
mov bh, 0xf6
sbb eax, 0x763b7219
salc
out 0x6b, al
dec edi
cwde
scasd eax, dword es:[edi]
imul esp, edi, 0xdf0b264f
sbb byte [ebx + 0x3e], dl
mov dh, 0xf0
out 0x44, al
xchg ebx, eax
jnp 0x14dfe4f
sbb dword [esi + 0x52], eax
mov ch, 0x18
pop esi
jo 0x14dfdeb
sbb dword [esi], ebx
out 0xad, eax
pop esi
mov ah, 0x19
out 0x61, eax
lahf
and ah, bh
sbb byte [ebx + eax*2], ah
jnp 0x14dfe89
sbb dword [edx + eax], esi
mul dh
test al, 0x33
mov cl, byte [edx - 0x79]
push ss
fadd qword [eax + 0x5b]
pushal
mov ch, 0x50
div dword [ecx + esi + 0x1ee87782]
sub dword [ecx + 0x5e], 0x18
jb 0x14dfec3
lahf
pop ss
fiadd word [ebx - 0x39]
cmpsd dword [esi], dword es:[edi]
pop ss
dec ecx
add ch, al
dec esi
inc esi
out dx, eax
sub al, 0x9c
pop ss
mov esp, 0x1786a131
test al, 0xd1
test al, 0x4e
invalid
dec esi
call 0x19264654
xchg byte [ebx], ch
adc edi, dword [edi + edx - 0x44bcf5b2]
pop ebp
call 0xa52f116c
jmp 0x14dfe36
or al, 0xc3
loop 0x14dfead
js 0x14dfe9e
push cs
adc dword [ecx], ebx
add byte [edi], ah
cmpsd dword [esi], dword es:[edi]
sbb byte [eax], dh
shr dword es:[esp + ecx - 0x19], 0xd9
and al, 0xc1
or esp, edi
sbb ebp, edx
xor bh, ah
pop esi
pushal
add eax, 0x7219360e
ja 0x14dfecc
out 0xc0, al
adc dword [eax + 0x58e71911], 0x16e8f0f9
out dx, eax
or eax, 0x1b88ee09
inc eax
cmpsd dword [esi], dword es:[edi]
xchg byte [ebx - 0x45e82ddd], bh
and edx, edi
cwde
pop ss
retf 0x365b
add ax, 0xb1f
adc ebp, ecx
neg edx
mov dword [esp + edx - 0x41601011], ebp
ret 0x10

Function at 0x14e5957
Capabilities:
Encode data using xor

Disassembly:
sub edx, 0xbf18112a
ror edx, 1
bswap edx
not edx
xor ebx, edx
add ebp, edx
mov cl, byte [esi]
call fcn.0176e45a
mov eax, 0x320578bf
movzx ecx, ax
mov edx, dword [esi + eax - 0x320578bf]
lea esi, [esi + eax*2 - 0x640af17a]
xor edx, ebx
rol ecx, 0x7b
sar eax, cl
lea edx, [edx + ecx - 0x3965c930]
not edx
call fcn.01529ac0
Function at 0x1504674
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [esp + ecx + 8]
shl word [esp + eax + 5], 2
mov word [ecx + eax*8], dx
and byte [esp + eax*8 + 4], al
setg byte [esp + eax*2 + 6]
mov dword [esp + eax*4], esi
ret 4
xor ebx, eax
add esi, eax
sal dl, cl
mov dx, word [ebp + edx*4 - 0x10b20]
movsx eax, cx
lea ebp, [ebp + ecx*4 - 0x3202]
mov dword [esp + ecx*2 - 0x1902], ecx
inc ax
sal al, 0xa4
lea edi, [edi + ecx - 0xc82]
not ecx
adc ecx, eax
adc dword [esp + eax*8 - 0x60fc], eax
movzx ecx, byte [eax + edi - 0xc20]
inc dword [esp + eax - 0xc1f]
sub byte [esp + eax - 0xc1a], al
xor cl, bl
sal ax, 0x6d
adc cl, 0x3c
xor cl, 0x24
neg al
jp 0x169a5e0
inc eax
mov esi, 0x2d49d44d
invalid
neg ax
xor cl, 0x24
xor bl, cl
shl word [esp + eax], 0xa7
jne 0x14a306d
rol cl, 1
jmp 0x1662b6f

Function at 0x1548320
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [esi + eax*2 - 0x617a6780]
sar ecx, cl
test byte [esi - 0x80], al
cwde
test dword [esi - 0x3e17062d], ebx
jno 0x1548329
call fcn.0150f4ef
mov edx, dword [ebp]
mov eax, 0x98ac6715
push eax
dec dword [ebx - 0x47ffdaac]
adc eax, 0x5098ac67
mov eax, dword ss:[edx]
mov dword [ebp], eax
sar dword [esp], 0x5e
mov edx, dword [esp]
lea eax, [edx*4 - 0x2bf5dae4]
sbb edi, 4
mov edx, dword [edi]
xor edx, ebx
call fcn.00de3cff
inc ecx
xor edi, 0x61362f9a
dec ecx
lea edx, [esi - 0x95e50d7]
dec eax
xor edx, edx
inc ecx
inc edi
call fcn.0161a6f4
jbe 0x1548321
adc eax, dword [ecx + 0x15]
inc edx
adc byte [edi], ah
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
jmp 0xfe0d5cb1
Function at 0x15690b5
Capabilities:
Manually build aes constants

Disassembly:
mov word [esp + 6], 0x5b9b
sar cx, 0xa4
add ebp, edx
lea edx, [eax + eax*4 - 0x2f5d9174]
inc edx
mov dword [esp + edx - 0x6d8784e6], ebp
ret 4
dec ebx
mov edx, dword [edx + edi - 0x475fff8]
dec edi
lea edx, [edx + edi - 0x475fff8]
inc ecx
pop esi
dec eax
or edi, edx
inc edx
sal byte [esp + edi*2 - 0x8ebfffd], cl
call fcn.00cae542
call fcn.016dcf0f
mov cl, byte [ebp + 4]
add ebp, 4
jmp 0x16f1269
lea esi, [esi + ecx - 0x151f7a92]
xor eax, ebx
sal cx, 7
rol eax, 3
jmp 0x1774557
inc ecx
push esi
dec esp
adc ebx, eax
dec ebx
mov edi, dword [edi + edx - 0x4760000]
dec edx
mov dword [esp + edi*2 - 0x8ebfff8], ecx
inc edx
sal dword [esp + edi - 0x475fffa], 0xde
jns 0xe0bbb8
call fcn.00db58d3
push ecx
add edi, 4
movsx eax, cl
sub esi, 1
call fcn.016c5100
inc edx
xor dword [esp - 0x3cbbb705], ebp
inc ecx
push esp
inc esi
movzx ecx, word [esp - 0x3cbbb705]
dec ebp
lea esp, [ecx + 0x430e123b]
dec esi
mov eax, dword [esp - 0x430e1d26]
dec eax
arpl bp, bp
dec edx
lea edx, [ecx*2 - 0x16aa04c]
dec eax
add edx, 0x8a24bc86
pop esi
dec esp
add ebx, ebp
dec edx
mov dword [esp - 0x430e1d2e], esi
call fcn.00e3fdd8
lea edx, [ecx*4 - 0x75c2bcc3]
mov edx, dword [edx + edi - 0x472867a5]
xor edx, ebx
rol dword [esp], 0xc
sar dword [esp], cl
ror cx, 0x6f
dec edx
jmp 0x16bfd3f
and word [esp], ax
rol edx, 2
shl eax, cl
inc cx
dec edx
ror ecx, 0xfc
ror edx, 1
xor dword [esp + eax*2 - 0x46800000], 0x37122eb1
sub eax, dword [esp + eax - 0x23400000]
push ecx
xor ebx, edx
jmp 0xc9ea2b
shrd dx, ax, cl
call fcn.015ca509
lea ecx, [edx + edx - 0xae08576]
jae 0x1523b46
mov edx, 0x673c322a
and dl, dh
js 0x16f9a86
movzx ecx, byte [esi + edx - 0x673c3222]
lea eax, [edx + 0x14b8bf8e]
lea esi, [eax + esi - 0x7bf4f1af]
call fcn.00dc8e3a
inc edx
xor ebx, edx
mov ecx, 0xfe2b0da2
call fcn.016b751f
mov cl, byte [esi + ecx*8 - 0xbbf54]
setp byte [esp + eax*8 + 2]
ror dword [esp + eax], 0xaf
add al, al
lea esi, [esi + eax + 2]
neg al
sar al, 0x63
sal eax, 0xd8
sal edx, cl
mov dword [esi + eax*2], edx
mov dword [esp + eax*2], ebp
ret

Function at 0x15c159d
Capabilities:
Encode data using base64

Disassembly:
xor cl, byte [esp + ecx - 0x8da0382]
adc dl, 0x31
not byte [esp + ecx*2 - 0x11b40644]
not dl
push ecx
dec dl
xor bl, dl
lea edx, [esp + edx + 0xc]
neg ecx
neg cx
call fcn.00da0b50
mov dword [esp + ecx - 0x8da0386], 0x2437ef97
sal word [esp + ecx - 0x8da0380], 0xc5
rol dl, 1
neg byte [esp + ecx*4 - 0x23680e13]
jbe 0xe1fcf7

Function at 0x15f26b8
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xed0b0146
call fcn.01709a7f
xor edx, ebx
movzx eax, cx
lea edx, [edx + ecx + 0x517a6c2b]
neg edx
shr ecx, 0x4a
xor edx, 0xa59a042e
inc eax
dec edx
shl cl, 0x25
sar cl, 0x42
not edx
neg cl
rol ecx, cl
xor ebx, edx
call fcn.00caebe3
or eax, 0xe2aac6bc
push edx
das
movsd dword es:[di], dword [si]
add ecx, ebp
pop eax
jg 0x15f26dc
xchg ecx, eax
call 0x809e9966
push esi
out dx, eax
arpl word [edi], si
ret
Function at 0x15f9dab
Capabilities:
Encode data using xor

Disassembly:
imul edi, dword [ebp + 0x548b0000], 0x44c7f447
add al, 0xfa
cmp byte [ebx], bl
xchg esp, eax
push ebx
mov edx, dword [edi + eax*2 - 0xc]
mov dword [esp + eax - 6], 0x53941b38
lea edi, [eax + edi - 2]
movsx ecx, al
xor edx, ebx
dec edx
call fcn.016d915c
jecxz 0x15f9da7
sbb edx, dword [esi + 0x3a]
clc
pop ds
mov esp, 0xbf617457
cld
xor eax, 0x20eaebb5
inc ecx
shr dword [edi], 0xde
outsb dx, byte [esi]
fbld tbyte [ecx + 0x48]
ret 0xbc2d

Function at 0x160718e
Capabilities:
Encode data using xor

Disassembly:
inc bx
mov dword [edx - 0x600], ebp
inc ecx
mov eax, esp
dec esp
lea esi, [esi*8 + 0x2c97a4a2]
dec edx
mov dword [esp - 0xc00], 0xf521c5a6
inc esi
mov esi, dword [esi + ebp - 0x600]
neg ax
dec edi
lea ebp, [ebp - 0x17fc]
inc ecx
push ecx
push edx
inc ebp
xor esi, eax
dec eax
shr eax, 0xcd
inc dx
ror dword [esp - 0xbf2], 0xe3
inc ecx
ror esi, 2
Function at 0x1622b03
Capabilities:
Encode data using xor

Disassembly:
movzx edi, al
jno 0x172315b
and edx, ecx
sub cx, cx
or ecx, dword [esi + ecx]
xor ecx, ebx
call fcn.01722251
call fcn.0153d67b
push ebp
mov byte [0x8cec570e], al
push ebx
sar byte [ebp - 0x2eeb61f3], 1
mov ebp, 0xf0cf39e8
popal
js 0xdfc825
cwde
inc edx
mov dl, 0xe6
out dx, eax
cmp byte [edx], al
push eax
pop ds
insd dword es:[edi], dx
ficomp word [esp + edx*4 + 0x21e950fd]
jae 0xdfc77d
dec esp
stosb byte es:[edi], al
inc edx
push ds
cmp esp, esp
mov word [edx + 0x1e1e33d8], es
xor al, 0x4b
retf
salc
xchg esp, eax
mov al, byte [0x43319042]
mov ah, 0x2c
mov dl, 0xa0
or al, ah
sbb ah, byte [esi - 0x38e47fc]
add eax, eax
inc esi
xor eax, dword [eax]
ficomp dword [esi - 0x26]
mov ch, 0xff
lahf
salc
invalid
jns 0xdfc87b
lahf
movsd dword es:[edi], dword [esi]
test al, 0x55
daa
xor al, 0x70
xchg esp, eax
pop ss
dec esi
aas
push ss
wait
sub byte [edi - 0x45], dl
mov eax, dword [0x7c85cf3e]
test ah, 0xc7
cmp byte [edx + ecx*2 + 0xb], al
jl 0xdfc7f8
xchg ebp, eax
pop ecx
sbb byte [edi], dl
hlt
push ebx
dec edx
jo 0xdfc8af
mov dl, 0x8a
inc edi
or byte [edi - 0x53], 0x40
cwde
aas
jne 0xdfc877
imul ebx, eax, 0x49aa82cc
fmul dword ss:[edi]
xchg bh, bh
add al, 0xf1
lds edx, [ebx]
fsub dword [eax - 0x33]
ret
add edi, edi
invalid
mov ebx, dword [esp + ebx + 4]
push ecx
xor dl, dl
mov esi, dword [esp + ecx + 0xc]
pop edx
shl cl, 0x22
neg ecx
mov edi, dword [esp + edx + 0xc]
mov dword [esp + edx*2 + 0xc], 0x39115d24
lea edi, [edi + edx - 4]
mov eax, dword [edi + edx*2]
pop edx
xor eax, ebx
rol eax, 1
movsx edx, cl
bswap eax
mov dword [esp + ecx*2], edx
dec eax
xor ecx, dword [esp + ecx + 8]
neg eax
xor ebx, eax
add esi, eax
call fcn.014a4c42
mov edx, 0xb33b5416
lea ecx, [edx + edx*4 + 0x5d8001bd]
lea eax, [edx*4 - 0x2367f67b]
sub edi, 4
shl ax, 0xe
inc eax
mov ecx, dword [edi]
xor ecx, ebx
jmp 0xdfc795
inc ecx
push eax
inc ecx
push esp
inc ecx
movzx edx, ah
inc esp
xor dword [esp + ecx + 5], esi
dec eax
dec dword [esp + eax - 0x5687d509]
inc ecx
add cl, 0x1f
dec esp
mov eax, dword [esp + ecx + 5]
dec esp
mov dword [esp + ecx*2 + 2], esp
dec ebp
arpl si, si
call fcn.01545564
mov eax, 0x71a8603b
mov edx, 0x9aa20000
or edx, edx
rdtsc
mov ecx, 0x7c9e4d2e
neg cx
lea esi, [esi + ecx - 0x7c9eb2da]
shl ecx, cl
jne 0x1516d73
imul edx, dword [ebx], 0xffffff8c
adc eax, 0x5cd267f0
ljmp 0xbe5c

Function at 0x1652ab6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ecx, ax
dec eax
lea eax, [ebp - 0x594112c2]
inc ecx
rol esp, 1
inc ecx
xor esp, 0xd129e322
inc ecx
inc esp
dec edx
mov dword [esp + ecx*2 + 0x59f4d0a0], ecx
push ebp
inc ecx
not esp
dec esp
lea edi, [ecx + ecx*8 + 0x4e8f14a3]
inc ecx
ror esp, 3
inc esi
xadd dword [esp + ecx + 0x2cfa685b], edi
call fcn.0149022a
Function at 0x16745df
Capabilities:
Encode data using xor

Disassembly:
not edx
lea edx, [edx + ecx*2 - 0x6f46660c]
ror eax, cl
neg edx
call fcn.016c8086
or ebx, ecx
lodsd eax, dword [esi]
enter 0xffffffffffffdaf7, 0xffffffffffffffe8
xchg ebp, eax
cmp al, byte [0xadcb0900]
sbb edx, ebx
repne cmpsd dword [esi], dword es:[edi]
imul ebx, dword [edx], 0xc810d0e6
sbb dword [eax + 0x2f], esp
idiv dword [0x9c235fe6]
and bh, 0x4f
sub cl, byte [edx + 0xe751834]
aaa
sbb esp, esi
jl 0x16745e9
cli
call 0x603a4c35
sbb byte [edx], al
sub al, 0xc7
cwde
cmc
out 0xf5, eax
push ds
xor eax, 0x1e21e7f2
leave
out 0x58, eax
test dword [esi + 0x50], 0x9b17e9a1
imul cl
pop ebp
out 0x7e, eax
pop ebx
xlatb
inc esi
cmpsb byte [esi], byte es:[edi]
xchg esp, eax
pop ss
call 0x1919b4a9
xchg esp, eax
adc dword [edi + 0x1a0178a], ecx
das
call 0x66205e55
mov cl, 0x17
xchg edx, eax
arpl cx, bp
stosd dword es:[edi], eax
pop ss
mov edi, 0xdee863e0
pmaddwd mm2, qword [edi]
call 0x18f8a1bb
xor byte [ecx + edi*2], ch
jo 0x1674654
lds ecx, [eax - 0x4179541]
jo fcn.016746ba
mov eax, dword [0xb60ff1d3]
pop ss
call fcn.016b0ce2
dec ebp
lea edx, [edx + ebx*2 - 0x6c]
inc ebp
movzx ecx, di
pop edx
not al
pop ebp
dec eax
lea edx, [edx*2 + 0x7ea331be]
not cl
inc eax
inc ch
inc ecx
ror ah, 0xc2
or al, cl
dec eax
shl edx, 0x1f
dec esp
mov dword [esp + ebx*2 - 0x6e], esi
or edi, 0xae160f18
inc cx
mov dword [edx + ebx*2 - 0x6e], eax
dec esp
mov dword [esp + ebx - 0x37], ebx
ret

Function at 0x1675672
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x16a9efb
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x16a9ef5
push ebp
shr dl, cl
sbb dh, al
mov ebp, esp
rcr edx, cl
xor dh, 0x1a
mov edx, dword [ebp + 8]
sub esp, 0x114
push esi
test edx, edx
je 0x16a9efb
mov esi, dword [ebp + 0xc]
cmp esp, edi
cmp bp, 0xef20
test eax, ebp
test esi, esi
jmp 0x1515fe4

Function at 0x167d744
Capabilities:
Encode data using xor

Disassembly:
call fcn.0176df18
xchg cx, ax
xor edx, 0x15a557ae
xor ebx, edx
push eax
shr ecx, 0xe6
adc ebp, edx
mov dword [esp + eax - 0x111c46fc], eax
xor cx, cx
mov ax, word [edi + eax - 0x111c4700]
shl dword [esp + ecx - 0xf3fffc], 0xbc
movzx edx, cx
or dx, word [edi + ecx*2 - 0x1e7fffe]
pop ecx
xor cl, byte [edi + ecx*4 - 0x44711bfc]
call fcn.016bf9ec
xor eax, 0xb22dea26
dec ecx
lea esp, [esp + 8]
jne 0xdcf4e2
mov ecx, 0x64b11b9a
neg ecx
pop ebx
Function at 0x169e0fc
Capabilities:
Encode data using xor

Disassembly:
add esi, 6
not eax
mov byte [edx + eax*4 - 0xff1640c], cl
mov edx, 0xdea1459e
jmp 0x14d492e
lea edi, [edi + eax*4 - 0xff16410]
xchg dword [esp + eax*2 - 0x7f8b206], edx
mov dword [esp + eax - 0x3fc5903], eax
mov edx, dword [edi + eax - 0x3fc5903]
movzx ecx, al
xor edx, ebx
rol ecx, 0xb
push ecx
sbb dword [esp + eax*2 - 0x7f8b202], 0x270f0300
inc edx
shr ecx, 0xd8
jns 0x16e807e
xor eax, dword [edi + eax]
movzx ecx, word [esp + 4]
neg ecx
call fcn.0171ea39
mov eax, dword [esi + eax - 0x7322860a]
lea esi, [esi + ecx - 0x73228606]
sar ecx, 0x6b
movzx edx, cx
xor eax, ebx
or ecx, ecx
bswap eax
jg 0x173fe91
mov ecx, dword [edi + edx*4 - 8]
and edx, 0x5b17ba8b
mov eax, 0x1b249a83
xor ecx, ebx
push edx
dec ecx
ror word [esp + edx*4 - 4], 0xa9
neg ecx
bswap ecx
not ecx
or word [esp + edx - 1], 0xe085
ja 0x14382fb
mov edx, 0x7d006b1a
movzx ecx, dl
push ecx
mov edx, dword [esi + ecx*2 - 0x34]
lea eax, [ecx + ecx*8 - 0x3fc59ee]
mov cl, byte [esi + ecx*2 - 0x30]
jmp 0x14917cd
ror edx, 1
shr eax, 0x38
add edx, 0xffa6081f
neg edx
xor ebx, edx
and eax, eax
adc ebp, edx
shl cx, 0x25
mov dword [esp + eax - 3], ebp
ret 4
call fcn.00dae362
jbe 0x173fee4
push esp
push edx
xchg ecx, eax
invalid
dec ebx
cld
daa
pop es
cmp eax, 0x8413201e
or eax, 0xe3df9a08
cmp dl, byte [ecx + ebx*8]
mov esp, 0xffbc0979
jl 0x173fece
imul ebp, dword [ebp - 0x20], 0xffffff84
lodsb al, byte [esi]
jae 0x173ff31
leave
add esi, dword [ecx - 0x42]
cmpsd dword [esi], dword es:[edi]
inc ebx
inc ebx
iretd
cwde
test dword [edx + 0x14cd41e], ecx
sbb byte [edi + 2], bl
add eax, 0xb528dca3
add al, byte [0xb528dca3]
stosb byte es:[edi], al
mov cl, 0x18
mov ch, 0x16
xor bh, bl
add eax, ebx
push ss
pop esi
add eax, 0xc6cd9d11
add byte [edi + 0x58], cl
push edi
jg 0x173ff39
jg 0x173ff3b
jl 0x173ff65
sbb edx, dword [ebp + 0x27]
popfd
in eax, 0x17
push ecx
mov dl, 0x7a
cmp al, 0x12
jge 0x173ffb4
adc bh, byte [ebp + 0x4c]
out 0xe0, eax
and ch, byte [ecx - 0x65]
mov ecx, 0xc6a79ef4
adc al, 0x9e
pop edi
iretd
add byte [edx], al
and byte [ebx + 0x6b], al
dec edx
cmp al, 0x39
lds eax, [ecx]
je 0x173ffb9
cmp dword [ecx - 0x18], edi
sbb bl, byte [eax - 0x25]
in eax, dx
inc ebp
mov dl, 0xfe
jnp 0x173ffd3
dec edx
jle 0x173ffd0
fmul dword [ebx - 0x6ff1390b]
mov esi, ebp
invalid
push cs
nop
push es
push ecx
xchg byte [esp + edi*4], bl
pop ebx
out dx, eax
pop ds
mov esp, 0x9d5b4efc
mov eax, 0x3e6a53fc
outsb dx, byte [esi]
pop esp
jmp dword [ebx]
Function at 0x16b1d15
Capabilities:
Encode data using base64

Disassembly:
xor bl, cl
mov dword [esp + eax - 0xfe9fa9], eax
xadd dl, ah
lea ecx, [esp + ecx + 8]
and dl, byte [esp + eax*8 - 0x7f75543]
mov edx, dword [ecx + eax*4 - 0x3fbaaa4]
jae 0x14d5c1d
xor cl, 0x30
neg cl
ror dl, 0xc7
sar edx, 0x16
jb 0xdc6b8f
mov edx, 0x27b9a394
mov ecx, edx
fstp qword [ebp + edx*2 - 0x4f734728]
mov ecx, dword [edx + edi - 0x27b9a394]
movzx eax, dl
lea edi, [edi + edx - 0x27b9a390]
lea edx, [eax*4 + 0x29a6010f]
shr al, 0x44
ja 0x1714ce4
mov ecx, 0xebacc433
movzx edx, cx
sal cl, 0x81
movzx ax, byte [ebp + edx*2 - 0x18866]
sar cx, 0x85
cmovb cx, dx
jae 0x1541505
xor ecx, ebx
rol al, 0xe1
and ax, 0x47b6
ror eax, 0x12
rol ecx, 1
bswap ecx
not dx
rol ecx, 3
neg edx
rol edx, 0x91
neg ecx
xor ebx, ecx
rol dl, 0x82
lea eax, [eax + eax + 0xa2b53b2]
adc esi, ecx
lea ecx, [eax - 0x4dc3a74e]
xor cl, dl
shr edx, 0x3d
add edx, esi
jmp edx

Function at 0x16b2c64
Capabilities:
Encode data using xor

Disassembly:
jl 0xd85687
mov dword [ebp], edx
mov ebx, dword [esp + 0xc]
mov edx, dword [edi]
push 0x3e1ba50f
shr dword [esp + 0xc], 0xdc
add edi, 4
pop eax
call fcn.014b2278

Function at 0x16b6c25
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + edx - 0x282255a0]
fst st(7)
xor ecx, ebx
call fcn.00dda0c5
pop ebx
mov dl, 0xe4
push ebx
adc ebx, dword [esi]
cmp al, 0xfd
mov byte [0x2169946a], al
pop esi
or eax, ecx
mov eax, dword [0x6f01deed]
mov ebp, 0x8c8bbdae
adc eax, 0xc26d7d88
sbb ah, cl
sal ecx, 1
out 0xed, al
mov esi, 0xec3b302
xor al, 0x42
xor eax, 0x42354929
das
not byte [edx + 0x2bb79e14]
jl 0xdb04d8
cli
jmp 0xd9d8e1d3
xor ecx, ebx
mov eax, 0xf9b804b5
and ax, ax
mov dword [esp], 0x4893a8a7
inc ecx
bswap ecx
sub eax, dword [esp]
inc ecx
call fcn.00dbb1d7
mov eax, edx
mov ecx, dword [edx + esi - 0x282255a4]
jmp 0xdb04d3

Function at 0x16b99da
Capabilities:
Encode data using base64

Disassembly:
jle 0x161c26c
xor edx, 0xaf04b3a5
sal al, 0xa7
xor ebx, edx
push eax
add ebp, edx
push ecx
movzx edx, byte [edi + ecx*8 - 0x42790]
lea edi, [edi + ecx - 0x84f1]
mov dword [esp + ecx - 0x84ea], eax
call fcn.014a2489
lea edx, [edx + eax*2 - 0x677de868]
js 0x143a036

Function at 0x16cea27
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 8]
je 0x145c5df

Function at 0x16dc8c2
Capabilities:
Encode data using xor

Disassembly:
add ebp, ecx
add dl, byte [esi + eax + 0xec519bc]
call fcn.01749e99
Function at 0x16e9bea
Capabilities:
Encode data using base64

Disassembly:
not eax
ror eax, 3
neg byte [esp + edx - 0x600b51af]
sub eax, 0xb39a0193
not eax
shr edx, 0x4e
xchg dword [esp + edx - 0x1802d], ecx
sal dx, 0xeb
neg eax
neg edx
xor ebx, eax
call fcn.016de5be
ja 0x16e9b8a
mov dword [esp + edx - 0x51f03e5f], 0x442a8422
rol ecx, 1
and word [esp + edx - 0x51f03e5e], dx
xchg dword [esp + eax - 0x5289c504], eax
sbb al, byte [esp + edx - 0x51f03e5f]
xor ebx, ecx
call fcn.014e85fa
mov ecx, 0xa60e4f8d
lea eax, [ecx - 0x76d7f042]
mov edx, dword [edi + eax*2 - 0x5e6cbe96]
mov eax, dword [eax + edi - 0x2f365f47]
and cx, 0x5227
sar ecx, 0xd3
add edi, 4
push ecx
add edx, eax
lea eax, [ecx*8 + 0x321cb792]
call fcn.0172a682
lea ebp, [ebp + edx*4 - 0x62]
shr ax, cl
mov dword [esp + edx*2 - 0x2e], edx
mov word [ebp + edx*2 - 0x32], ax
mov dword [esp + edx - 0x19], edx
lea ecx, [edx*8 + 0x6f0ed38e]
inc cx
mov ecx, dword [edi + edx*2 - 0x32]
mov eax, edx
lea edi, [edi + edx - 0x15]
and dword [esp + edx - 0x15], 0xc9b10da7
jnp 0x174efc5
mov edx, 0xd539ab2d
lea ecx, [edx + edx - 0x49cadb5c]
mov edx, dword [ebp + ecx - 0x60a87afe]
mov cx, word [ebp + ecx - 0x60a87afa]
push 0xa189f439
add ebp, 6
mov word [edx], cx
mov eax, dword [edi]
mov ecx, dword [esp]
mov edx, 0x600b51af
shr byte [esp + edx - 0x600b51ad], 0x66
lea edi, [edi + edx - 0x600b51ab]
lea ecx, [ecx*2 + 0x52368330]
xor eax, ebx
sal dword [esp + edx - 0x600b51af], cl
and cl, 0x3f
ja 0xdc90c6
mov dword [esp + ecx - 0xba0000], esi
ret 4

Function at 0x16f1ae1
Capabilities:
Encode data using xor

Disassembly:
pop edx
ja 0x15d9d00
add edx, ecx
call fcn.016d2bc1
add esi, 4
call fcn.014c1804
mov edx, 0xe59513b4
lea eax, [edx*2 + 0x6789149b]
xchg al, dl
lea edi, [edi + eax - 0x32b33cb8]
jmp 0x1750b5b
lea ebp, [ebp + edx - 0x41360195]
movsx eax, dx
mov dword [esp + eax*2 - 0x332], eax
mov edi, ecx
add word [esp + eax - 0x199], 0x7b30
movzx ecx, ax
ja 0x16d53f8
mov eax, 0xc782e5a9
sal eax, 0xb2
mov ecx, dword [edi]
add edi, 4
lea edx, [eax*8 - 0x4c7958e8]
push eax
lea edx, [edx*8 + 0x7f5a3]
xor ecx, ebx
inc edx
ror ecx, 1
jmp 0x143f748

Function at 0x16f2b65
Capabilities:
Encode data using xor

Disassembly:
sub edi, 4
mov ecx, dword [edi]
xor ecx, ebx
mov eax, 0x75313622
neg ecx
mov edx, eax
neg dl
ror ecx, 3
neg ecx
or eax, 0x6e38af3a
shr eax, 0xa4
xor ecx, 0x81b9458e
add ax, 0xbb05
lea edx, [edx*8 + 0x58ae2f34]
rol ecx, 1
mov dword [esp + eax - 0x7f356f8], eax
bswap ecx
xchg dword [esp + eax - 0x7f356f8], edx
sar dword [esp + edx - 0x7f356f8], 0xf2
ror ecx, 1
rol dword [esp + eax*2 - 0xfe6adf0], 0xe1
or byte [esp + eax - 0x7f356f6], dh
lea ecx, [ecx + eax*4 + 0x17452fac]
not ecx
call fcn.0165558c
Function at 0x170a26e
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + ecx*4 - 0x24], ecx
mov ecx, dword [esi + ecx*4 - 0x24]
sar dl, 0x26
bswap edx
xor ecx, ebx
inc dx
rol ecx, 1
lea ecx, [ecx + edx*4 + 0x7d3e5b60]
xor dword [esp + edx*2 - 0x1e427dc], eax
xchg byte [esp + edx - 0xf213eb], al
ror ecx, 1
lea ecx, [ecx + edx*4 + 0x7e6a924d]
push eax
bswap ecx
ror ecx, 1
xor ecx, 0x92deeb0
xchg dword [esp + edx*8 - 0x7909f6c], eax
shr dl, 0xa7
setns dl
xor ebx, ecx
shr dl, 0x87
neg al
sub dword [esp + eax*2 - 0x11fffffe], eax
add ebp, ecx
call fcn.016058bc
sysenter
push ebp
mov dword [esp], 0x6d93dc7f
call fcn.01443318
mov eax, 0x50b8571b
mov ax, word [ebp + eax - 0x50b8571b]
mov dx, word [ebp + 2]
mov ecx, 0xa19567a1
push ecx
add ebp, 2
not ecx
call fcn.0143dc30

Function at 0x17197b5
Capabilities:
Encode data using xor

Disassembly:
movsx ecx, dl
ja fcn.00cb69f6
mov eax, dword [edi + edx - 0x72ec0000]
lea edi, [edi + ecx*2 + 4]
xor eax, ebx
ror eax, 2
and cx, dx
dec eax
ror dl, 0x85
lea edx, [ecx + edx*2 + 0x543bb18e]
bswap eax
sbb dl, 0x3e
call fcn.00e74aac
bswap eax
neg edx
call fcn.016e5801
mov eax, 0x521df116
sal eax, 0xa3
mov ecx, dword [esi]
lea edx, [eax*2 + 0x671faab3]
xor dl, al
mov al, byte [esi + 4]
sal dx, 0x81
rol edx, 0x27
lea esi, [esi + edx - 0x7f3ca33e]
not edx
shl edx, 0xf2
mov byte [edx + ecx - 0x72ec0000], al
jns 0x14ce9de
mov edx, dword [esi]
mov eax, 0xe1147ebb
lea ecx, [eax + eax*2 + 0x6eafe29f]
lea esi, [esi + ecx*2 - 0x23dabd9c]
sar eax, cl
sbb ecx, ecx
xor edx, ebx
call fcn.00e1bca4
dec eax
mov dword [esp + edx*2 - 0x10dca826], edx
shl ecx, 0xa8
xor dx, dx
bswap eax
xor ecx, dword [esp + ecx - 0x2b82a000]
not eax
jge 0x153361d
mov ecx, 0x70aebf8d
mov edx, dword [edi + ecx - 0x70aebf8d]
xchg ch, cl
bswap ecx
add edi, 4
lea eax, [ecx + 0x5b85e8b7]
xor edx, ebx
dec cx
pop dword [esi - 0x7e36f033]
mov dword [eax + eax], 0x818d0000
mov bh, 0xe8
test dword [ebx + 0x33], ebx
shl dword [esi - 1], cl
leave
lea edx, [edx + eax*4 + 0x695b7a73]
ror edx, 2
xor ecx, 0x6f16950a
call fcn.00d86c40
sti
in al, dx
dec edi
push edx
jno 0x17197df
dec ebp
mov eax, dword [0xc9f48e60]
inc ebx
push esp
sbb byte [ebp + 0x69], ch
add ecx, ecx
adc edi, esp
cmp al, 0xdf
rcr byte [ebp + 0x43], cl
sar byte [eax - 0x316b15e0], cl
sti
inc ebx
adc byte [edi], al
fld qword [ebx + 0x1f4fb1e6]
sub eax, 0xeb9e3545
cld
and al, dh
jge 0x17198a0
pushal
invalid
mov esp, 0x603aaae1
pushal
mov esp, 0x41e1658c
pushal
and al, 0x58
sub dword [ebx + 0x69], eax
jp 0x1719812
mov dword [ebx], eax
pushfd
jmp 0x17198a1
pop ebx
xor esi, edi
imul ebp, edx, 0xffffff84
jmp 0x17198af
and dword [ebx], 0x9386cb1
push esi
scasb al, byte es:[edi]
sbb dword [esi - 0x16], edx
sbb byte [ebx - 0x25], dl
or ah, al
jmp 0x1719843