joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102f6e05
Capabilities:
Encode data using base64

Disassembly:
ror dword [esp + eax - 0x5b1df775], 8
xor dx, 0x440d
push eax
neg dx
add ax, word [esp + eax - 0x5b1df770]
sub eax, 0x8105c41d
jno 0x102c9c0e
xor bx, dx
mov word [esi], dx
shr eax, 0x35
lea edx, [eax*8 - 0x2667ff68]
neg dl
mov eax, dword [edi + eax*2 - 0xd9e]
xor edx, edx
lea edi, [edi + edx + 6]
xor eax, ebx
imul dx, dx
xor byte [esp + edx + 1], dl
call fcn.1031f9c1
mov edx, 0x2f25eb10
mov eax, edx
push edx
movzx eax, byte [edx + esi - 0x2f25eb10]
lea esi, [esi + edx - 0x2f25eb0f]
imul edx, edx
jo 0x1048ed34
mov edx, 0xd2159685
movzx eax, dx
add eax, eax
mov ecx, dword [edi + eax*8 - 0x96850]
push eax
add word [esp + eax*8 - 0x96850], ax
not edx
lea edi, [edi + edx - 0x2dea6976]
not dword [esp + edx - 0x2dea697a]
pop eax
sal edx, 0x3f
xor ecx, ebx
ror ecx, 1
sal edx, 0x6e
inc eax
inc ecx
dec edx
rol ecx, 1
add ecx, edx
xor ecx, 0xa93127a5
add ecx, edx
xor ebx, ecx
add ebp, ecx
lea ecx, [eax*2 - 0x5872ca78]
idiv ecx
mov cx, word [esi + eax*4]
and edx, edx
rol dl, 0xc7
mul ax
add ax, word [esi + eax*8 + 2]
add esi, 2
imul dx, dx
not cx
not ax
and cx, ax
mov eax, edx
not edx
mov word [edx + esi - 0x1ffff], cx
jmp ebp
mov eax, ebp
jmp 0x1038c7ff
jmp 0x1038944a
or edx, 0x92b38404
xor al, bl
add al, 0x3f
xor edx, 0x69fe30c
not al
xor al, 0x31
neg al
rol edx, 0xa7
dec dword [esp + edx*2 - 0x680608bc]
xor al, 0x89
lea edx, [edx + edx*4 + 0x7da4b48d]
inc al
xor bl, al
mov byte [esp + 2], dh
mov dword [esp], esi
push edi
dec dx
push ebx
mov ebx, eax
lea edx, [edx*4 - 0x7bd633f7]
not edx
sal dx, 0xe4
mov edx, ebx
mov eax, 0x77b0851e
shl edx, 2
jmp 0x10316947
Function at 0x102fbfde
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
neg eax
or ecx, ecx
mov dword [esp + ecx - 0x385bdf], 0x3283b09b
xor ebx, eax
rol dl, 0x67
adc ebp, eax
pop edx
movzx eax, dx
xor ecx, ecx
lea ecx, [ecx + esi + 4]
jbe 0x103c0006
mov dx, word [esi]
mov ecx, 0xad29449c
or cl, ch
movzx eax, cx
mov cl, byte [esi + eax - 0x44da]
setge al
lea esi, [esi + eax - 0x43fe]
sbb ax, ax
shr dx, cl
not eax
inc eax
mov word [esi + eax*2], dx
lea edx, [eax + eax*8 - 0x4ee4aa00]
xor eax, edx
adc edx, edx
lea edi, [edi + edx - 0x6236ac04]
lea ecx, [edx + eax*2 - 0x35f56a4c]
jne 0x103553d5
jle 0x103c7e2f
pop ecx
add ebp, edx
shl eax, 0xb3
cwde
adc eax, ebp
jmp eax
neg edx
xor dword [esp + eax*2 - 0x6007352a], eax
lea edx, [edx + ecx - 0x8c231d8]
pop eax
ror edx, 1
bswap edx
add eax, ecx
lea eax, [ecx*8 + 0x2f1b548e]
adc ecx, ecx
lea edx, [eax + edx + 0xbf38ef9]
xor ebx, edx
lea ecx, [eax*4 + 0x79900da2]
mov dword [ebp + eax*2 - 0x5e26a924], edx
mov edx, 0xf7366686
cwde
shr edx, 0xa6
lea ebp, [ebp + eax*8 - 0x2a478]
inc edx
xadd ecx, eax
shl dx, cl
jb fcn.1044af2a
mov dword [esi + edx - 0x3283b09b], ecx
call fcn.102ee9ac
inc cx
bswap eax
jge 0x104ad6e3
jmp 0x103cd4d2
lea eax, [eax*2 + 0x30070a9d]
xor edx, ebx
or dword [esp + eax - 0x30039a95], 0xe11ac58e
neg cl
jns 0x1039f21f
push 0xa21fb28f
mov ecx, 0xe18c03a4
mov edx, dword [esi]
movzx eax, cl
mov cl, byte [esi + eax*4 - 0x28c]
call fcn.10460fe2
sar dl, 0xe7
xor ebx, eax
shr cx, 0xa6
add esi, eax
imul ecx, edx
mov eax, 0x6903fb28
shl eax, 0xc2
mov edx, dword [ebp + ecx*4]
sete al
add cx, 0xf407
bts cx, 0x11
mov ecx, dword fs:[ecx + edx - 0xf407]
shl al, 0x27
mov dword [ebp], ecx
jmp esi

Function at 0x102fea41
Capabilities:
Encode data using base64

Disassembly:
js 0x10445ad2
mov ebx, dword [ebx*4 + 0x103bbc48]
jp 0x103d9d74
imul dx, dx
inc al
xor cl, 0x24
not al
push edx
or dword [esp + edx], 0x72831c28
or cl, dl
rol al, 1
mov word [esp + edx*4 + 2], 0xad9a
lea edx, [edx + edx*2 - 0x7f6fb9f1]
xchg cx, dx
sub al, 0x2f
btc dx, 0x24
call fcn.1043ba1e
Function at 0x10307919
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx*4 - 0x5270251c], 0x56b9ea29
not ax
and ecx, dword [esp + edx - 0x149c0947]
ror cl, 0x66
sub byte [esp + edx - 0x149c0947], cl
ror ax, 1
xor edx, ecx
sub ecx, ecx
neg dword [esp + edx - 0x4214c3e7]
sbb ax, cx
shr byte [esp + ecx*2 + 2], 0x66
xor bx, ax
sal edx, 0x76
sub ecx, ecx
lea ecx, [ecx*8 + 0x44a22b89]
mov word [ebp + ecx - 0x44a22b8b], ax
adc cl, dh
movsx eax, dx
ror byte [esp + eax*2 + 2], 0x24
mov ecx, dword [ecx + edi - 0x44a22b87]
lea edi, [edi + eax*8 + 6]
xor ecx, ebx
btc edx, edx
adc al, 0x1a
sub al, dl
xor ecx, 0xdb5712d
mul dword [esp + eax - 0x19]
jo 0x104b3bf3
mov ecx, 0xeeaa0c0b
mov edx, ecx
mov edx, dword [esi]
movsx eax, cx
btr ecx, eax
mov eax, dword [eax + esi - 0xc07]
sub ecx, ecx
neg ecx
shl ecx, 0x1f
xor ecx, dword [ecx + esi + 8]
add esi, 4
div ecx
mov ecx, 0x7b1d2707
mov dword [esi + ecx - 0x7b1d2707], edx
push ecx
mov dword [ecx + esi - 0x7b1d2703], eax
movsx edx, word [esp + ecx - 0x7b1d2707]
mov word [esp + edx*4 - 0x9c1c], 0x9aa7
lea edi, [edi + edx - 0x270b]
push edx
pop eax
xchg cx, dx
mov ecx, dword [ecx + edi - 0x7b1d2707]
xor ecx, ebx
not dword [esp + edx - 0x2707]
inc al
shl byte [esp + edx - 0x2704], 0xc5
not ecx
ja 0x10324ff6
mul dx
add ecx, edx
not ecx
neg al
div byte [esp + edx*2 + 1]
ror ecx, 2
xor ebx, ecx
bts eax, eax
adc esi, ecx
xadd edx, eax
mov dx, word [ebp + eax - 3]
movsx ecx, ax
mov ax, word [ebp + eax - 1]
adc dx, ax
lea ecx, [ecx + ecx*8 - 0x21ecc5cc]
lea eax, [ecx + ecx*2 - 0x79c1c77d]
mov word [ebp + eax*2 - 0x40efce74], dx
movzx edx, cl
mov dword [esp + eax - 0x2077e73a], esi
ret

Function at 0x103117d4
Capabilities:
Encode data using base64

Disassembly:
xor cl, 0x2f
sar edx, 0x9c
sbb cl, 1
cbw
rol cl, 1
mov dword [esp + edx + 4], 0xa5360110
xor ax, ax
xor bl, cl
mov dword [esp + edx*2 + 8], edx
pop eax
add dword [esp + edx + 4], edi
not dword [esp + edx]
and dword [esp + edx], edx
xor dword [esp + edx*4], ebp
sar dl, 0xe4
shr dl, 0x22
push ebx
jae 0x103777e8

Function at 0x1031261f
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec al
neg edx
and eax, 0xbcaa748f
mov dword [esp + ecx - 0x11], ecx
ror eax, 0xd9
inc edx
xor ebx, edx
xchg ecx, eax
inc ecx
neg dword [esp + ecx*2 - 0x20540e86]
add ebp, edx
jmp 0x103359ac

Function at 0x10314af0
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0xc], ecx
add ecx, ecx
xor edx, 0x48082d00
mov dword [esp + ecx - 0x7259a55c], 0x3c08cf19
mov dword [esp + ecx - 0x7259a558], 0xa2bdad88
push ecx
xor ebx, edx
and dword [esp + ecx - 0x7259a560], ecx
mov dword [esp + ecx - 0x7259a55c], ecx
adc esi, edx
call fcn.103da259

Function at 0x10315ff8
Capabilities:
Encode data using base64

Disassembly:
mov word [ecx + ebp - 0x1191], ax
inc ecx
push ecx
mov dword [esp + edx - 0x2a271189], edx
mov eax, dword [edi + edx*2 - 0x544e2322]
or cx, word [esp + edx - 0x2a271190]
mov dword [esp + edx - 0x2a27118d], edx
jne 0x1036d00b
Function at 0x1031fad0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + ebx*4]
mov dword [esp], 0x2cb7dab8
inc byte [esp + 2]
jp 0x103f190b
mov ecx, dword [edi + eax*2 - 0x6c]
lea edi, [eax + edi - 0x32]
bts eax, 0x19
cdq
xor ecx, ebx
ror ecx, 2
idiv eax
call fcn.103b4d7a
mov eax, 0x9f34bc36
mov edx, dword [edi]
movzx ecx, al
dec eax
lea edi, [edi + ecx - 0x32]
xor cl, ch
xor edx, ebx
shl cl, 0x42
lea edx, [edx + ecx*8 + 0x2515f15a]
shr eax, 0xb9
dec eax
xor edx, 0x2cbacd90
not edx
inc ecx
btc eax, 0xbe
xchg ch, cl
rol edx, 2
lea eax, [eax + eax + 0x4d3acc0e]
btc eax, ecx
xchg ecx, eax
xor ebx, edx
not al
add esi, edx
ror cl, 0x85
neg al
mov eax, dword [ebp + eax - 0xd901]
btc ecx, ecx
setb cl
rol cl, 1
mov edx, dword [ebp + 4]
add cl, byte [ebp + 8]
call fcn.1030cec4
mov dword [esp], eax
dec ebx
jmp 0x104058ee

Function at 0x1031fb65
Capabilities:
Encode data using base64

Disassembly:
push 0xf98b2105
mov dword [esp + 4], edi
lea esp, [esp + 4]
mov edi, 0x2db59e21
btc di, di
movzx edi, byte [edx + edi*2 - 0x5b6b3c46]
xor edi, ecx
push 0x90bc5b03
and edi, 0xff
mov edi, dword [edi*4 + 0x102c4ac8]
jmp 0x10432661
call fcn.103c9edc

Function at 0x10322b60
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ecx
not word [esp + 6]
lea esp, [esp + 8]
jne 0x10456e82
mov ecx, 0xc927af10
movzx edx, cl
pop ebx
mov edx, 0xd728012f
not eax
inc dx
mov dword [ebp], eax
movsx ecx, dx
lea ecx, [ecx + ecx*4 - 0x65666a6c]
mov eax, dword [esi]
bt ecx, ecx
adc esi, 4
xor edx, 0x2a841838
sar dl, cl
xor eax, ebx
shr cl, cl
call fcn.102c5c3b
mov edx, 0x6403c4ba
mov eax, edx
movsx ecx, ax
lea edi, [edi + eax - 0x6403c4be]
mov eax, dword [edi + edx - 0x6403c4ba]
dec edx
btr edx, 0x13
xor eax, ebx
or cx, 0x309e
add dl, dl
sbb eax, 0x8fb8ec05
sal dx, 0xa8
inc dx
adc cl, ch
bswap eax
btc edx, edx
shl ecx, 0x18
lea ecx, [edx*2 - 0x725365e6]
neg eax
lea edx, [ecx*8 + 0x76212d3c]
shl cl, 0xe6
bswap eax
sub ecx, edx
neg eax
inc eax
inc edx
and cx, 0xf72a
sbb ecx, edx
xor ebx, eax
btc ecx, 0x9d
lea ecx, [ecx + ecx*8 - 0x4d9dd7c]
xchg dl, cl
adc ebp, eax
shl cx, 0xaf
rdtsc
sal ecx, 0xb2
not cx
bt ecx, 0xaf
lea esi, [ecx + esi - 0x10007]
not ecx
push ecx
mov dword [esi + 4], eax
movzx eax, cx
and cl, byte [esp + eax*8]
mov dword [esi + eax*2], edx
sets al
push eax
pop eax
pop ecx
jbe fcn.102d9ffd

Function at 0x10324fa9
Capabilities:
Encode data using base64

Disassembly:
push 0xc890c90f
mov dword [esp + 4], eax
shl dword [esp], 0x9e
shr dword [esp], 0x7e
sal word [esp + 2], 0x69
dec ebx
call fcn.102ed698
Function at 0x10324fc8
Capabilities:
Encode data using base64

Disassembly:
jp 0x104aa2fc
call fcn.10339e11
push eax
ror cl, 1
btr eax, 0x2d
rol edx, 0xee
adc ax, word [esp]
add cl, dl
neg eax
xor cl, dl
and dword [esp + eax - 0x2269d9f5], eax
idiv word [esp + eax*2 - 0x44d3b3e9]
call fcn.10354f9f
inc ecx
ror ecx, 3
dec byte [esp + edx - 0x2704]
call fcn.103efc00
mov eax, 0xb31b7923
mov edx, eax
movzx ecx, al
mov edx, dword [ebp + ecx*2 - 0x46]
shl cl, 0x45
xor edx, ebx
shr ax, 0x46
neg edx
sal cl, 0xe2
div cl
dec edx
sar ecx, 0x9a
bswap edx
rol edx, 1
shl cx, 0x69
or eax, 0x5598abbb
sar ax, 0xaa
xor ebx, edx
btc ecx, 9
xor ecx, eax
shl ecx, 0x73
add esi, edx
cbw
or cx, word [edi]
movzx edx, ax
rol al, 0x66
cbw
mov ax, word [edi + edx - 0xfff9]
sal dl, 0xe2
lea edi, [edi + edx*4 - 0x3ffac]
sal dl, 0xc4
ja 0x102c9d47
mov ecx, 0x13266b8b
mov eax, 0x79b2ddb4
sub al, al
mov ecx, dword [ecx + edi - 0x13266b8b]
lea edi, [edi + eax - 0x79b2dcfc]
neg eax
push eax
xor ecx, ebx
pop eax
or eax, 0x5abdbe85
sbb ax, 0x8112
inc ecx
inc eax
imul ax, ax
bswap ecx
neg ecx
ror ecx, 1
xor ebx, ecx
and al, 0xa7
neg eax
rol ax, 0xa1
add esi, ecx
lea ecx, [eax*8 + 0x1a92a42d]
sar eax, 0x96
xchg ecx, eax
mov eax, dword [ebp + ecx*8 - 0x420]
mov ecx, dword [ebp + ecx*2 - 0x104]
push 0x3106c6bf
adc ebp, 4
not dword [esp]
call fcn.104b1437
jmp esi
or cx, ax
movzx eax, dx
ror edx, 0x4a
call fcn.1033d349
mov eax, dword [edi]
mov ecx, 0x4d29120c
xor cl, cl
lea edx, [ecx + 0x609dc406]
mov ecx, dword [edi + ecx - 0x4d2911fc]
btc edx, edx
adc edi, 8
xchg dh, dl
rol dl, 0x47
mov dword [eax], ecx
bts edx, 0x85
mov ecx, dword [ebp]
bts edx, edx
movsx eax, dl
inc ax
lea ebp, [ebp + eax*4 - 0x1ac]
btc dx, 0x1c
rol edx, 0xaf
bt dx, 9
xor ecx, ebx
not ecx
btr eax, eax
not dx
mul ax
sbb ecx, 0xa3b2b78c
xor eax, 0x280d22a5
bt ax, ax
imul eax
neg ecx
imul eax
cwde
rol ecx, 2
xor ebx, ecx
add esi, ecx
bts eax, eax
mov ecx, edx
jae 0x104301f6

Function at 0x103250dd
Capabilities:
Encode data using base64

Disassembly:
adc edi, edx
mov ebp, dword [ebp + ecx]
inc cl
not byte [esp + ecx*8 - 7]
pop eax
jns fcn.104769e1
not ax
xor edx, 0xa1aad30d
or ax, cx
not edx
sub ecx, ecx
mov dword [esp + ecx*4], 0x35a00e99
xor ebx, edx
or ax, cx
xchg word [esp + ecx*4 + 2], ax
jnp 0x103117c1
bswap ecx
xor ebx, ecx
btr edx, 0x30
neg edx
add esi, ecx
cwde
add dl, dl
mov edx, dword [ebp + edx - 0x9410002]
sal eax, 0x1e
sar eax, 0xb5
movzx ecx, al
xor ecx, dword [ebp + eax*2 - 0x3fc]
shr al, 0x41
or eax, eax
push eax
lea ebp, [eax + ebp - 0x1fc]
xor eax, eax
and edx, ecx
mov dword [esp + eax*8], 0x2200f1a1
movsx ecx, al
shl ecx, 0x66
not edx
ror ax, 0x82
not dword [esp + eax]
mov dword [eax + ebp], edx
adc byte [esp + eax + 1], cl
shl byte [esp + eax + 3], 0x21
mov dword [esp + eax*4], esi
ret
Function at 0x1032554f
Capabilities:
Encode data using base64

Disassembly:
mov ebx, 0xfc88b61e
inc ebx
neg ebx
movzx ebx, byte [edx + ebx*8 - 0x1bba4f08]
jno 0x103dbbf8
dec ax
xor ecx, ebx
mul eax
dec eax
sar eax, 4
xor ecx, 0xdaa22f27
or edx, 0x13abe43c
sal dl, 0x66
add ax, ax
rol ecx, 2
cwd
sar ax, 0xcd
xor ecx, 0x7f21e2a8
and dx, ax
or dl, dh
push eax
dec ecx
mov dword [esp + edx - 0x1bfbffff], 0x452fcaae
dec dword [esp + edx - 0x1bfbffff]
imul ax, word [esp + edx - 0x1bfbffff]
xor ebx, ecx
add ebp, ecx
jmp 0x103e9be6
push 0x93b4b7a7
inc edx
xor eax, 0x662a332f
dec ecx
jmp 0x10328281
jmp 0x103fc38a
bts dx, 0xb1
adc ebp, 6
shl edx, 0xf9
or byte [esp + edx - 0x3fffffa], dh
xor dx, word [esp + edx*4 - 0xffffffa]
mov word ss:[ecx + edx*4 - 0x10030548], ax
mov dword [esp + edx*2 - 0x80182a4], edi
ret 0xc
lea esp, [esp + 0x14]
je 0x10406e69
push esi
movzx esi, byte [eax]
push 0x9c0dc9be
xor esi, edx
call fcn.104b7b59
mov edx, 0xecb7bd8d
dec eax
sub ebp, 4
inc esp
movsx esi, dl
inc ecx
movsx ecx, si
inc esp
mov eax, dword [ebp]
inc ebp
xor eax, ecx
call fcn.1037cde6
jmp 0x102dd0e2
push 0x4cb4d7a0
and ebx, 0xff
sal byte [esp + 6], 0xe4
mov ebx, dword [ebx*4 + 0x103a883c]
jbe 0x104105d7
mov ecx, 0xc39b78a4
movzx eax, cl
neg cx
mov eax, dword [edi + eax - 0xa4]
ror cl, 0x62
neg cx
adc edi, 3
xor eax, ebx
call fcn.1048b64f
sbb cx, cx
jmp ebp
jmp 0x10352948
mov byte ss:[eax + edx*8], cl
mov eax, 0xe1ecf84
adc edx, esi
jmp edx
push 0x6fb6f2a2
jae 0x1036bfd8
xor ebx, eax
jmp 0x103b883d
mov ecx, dword [edx + esi - 0x1bfbffff]
movzx dx, byte ss:[edx + ecx - 0x1bfbffff]
jmp 0x10445215
js 0x1039c923
lea esp, [esp + 0xc]
jne 0x102c419b
mov ecx, 0x4d1fffb7
pop ebx
not eax
jmp 0x1041d29a
mov ecx, 0x152004ad
and cl, cl
not edx
mov dword [esi + ecx*2 - 0x2a40095a], edx
jae 0x103ee848
mov ecx, dword [ebp + eax - 0xfc]
ror dword [esp + eax - 0xf7], 0xa1
xor word [esp + eax - 0xee], ax
mov ax, word [ebp + eax*2 - 0x1f4]
jbe 0x10408cd0
jno 0x102e243d
sbb edi, 1
xchg ecx, eax
or cx, cx
call fcn.1030f900
lea eax, [ecx + eax + 0xcb9279b]
pop edx
ror byte [esp + ecx - 1], cl
pop ecx
ror eax, 1
sar ecx, 0xac
shr dl, 0x22
ror edx, 0x18
xor ebx, eax
add esi, eax
btc dx, dx
mov eax, dword [edi + edx*8 - 8]
mov cl, byte [edi + edx*2 + 2]
shr edx, 0x47
lea edi, [edi + edx*2 + 6]
jp 0x103c1322
rol dl, 7
xor ebx, eax
add edi, eax
pop ecx
pop ecx
jmp fcn.104769e1
xor eax, ebx
inc dword [esp + 4]
jne 0x102d005f
adc edi, 4
push 0xca70e32
sal dword [esp], 0xd4
shld ax, dx, cl
mov ecx, 0x2fa13aa5
mov word [ecx + edi - 0x2fa13aa5], ax
mov eax, ecx
mov edx, dword [ebp + ecx - 0x2fa13aa5]
xor cl, ch
xadd al, ah
lea ebp, [ebp + ecx - 0x2fa13a9b]
xor edx, ebx
btr cx, cx
lea ecx, [ecx + ecx*4 - 0x46d3e459]
ror edx, 1
lea edx, [edx + eax*2 - 0x57bf2202]
sub word [esp + eax*2 - 0x5f434bbd], ax
neg cx
cbw
neg edx
btc ax, cx
cbw
pop ecx
dec edx
call fcn.103fe830
shr eax, 8
jmp 0x10408cca
mov ecx, 0x4c96ce22
mov dword [edi + ecx - 0x4c96ce22], eax
movsx edx, cx
dec ecx
call fcn.10495d38
add esi, 2
bt eax, eax
movsx ecx, al
mov word [esi + ecx - 0x53], dx
mov dword [esp + ecx*2 - 0xa6], ebp
ret
Function at 0x10325d28
Capabilities:
Encode data using base64

Disassembly:
rol edx, 1
or dword [esp + ecx + 0xb], ecx
btc ecx, eax
bswap ecx
dec edx
push ecx
ror edx, 1
inc eax
js 0x103af264
neg edx
shl cl, 0xe1
shl eax, 0xb2
xor ebx, edx
mov word [esp + ecx - 0xfff2], ax
sub ax, 0xee10
cwde
add esi, edx
call fcn.1030f8dd

Function at 0x10325d5c
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov ecx, dword [esp + ecx + 0x44]
pop eax
dec eax
mov eax, dword [esp + 0x78]
jmp 0x1035d372
call 0x102f3fa5

Function at 0x103264a7
Capabilities:
Encode data using base64

Disassembly:
jae 0x1037d8e2
not ecx
and edx, ecx
mov dword [ebp + eax - 0x738ce088], edx
movzx ecx, ax
mov dword [esp + eax - 0x738ce08c], ecx
neg eax
mov ecx, dword [edi + ecx*4 - 0x38230]
cbw
xor word [esp], ax
call fcn.103365d5
jmp 0x1045636b
mov eax, 0x5437a01c
mov ecx, 0xd89e503e
mov eax, dword [edi + eax - 0x5437a01c]
jmp 0x102c3eb9

Function at 0x1032dc45
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax*4 - 0x441748a8], eax
or byte [esp + eax*2 - 0x220ba453], 0x39
not ecx
pop edx
jge 0x1048d42f
xor ebx, ecx
lea ebp, [ebp + eax*2 - 0x220ba458]
btr dx, 0xac
btc eax, 0x18
mov dword [eax + ebp - 0x1005d22a], ecx
jb fcn.1044af2a
push edx
jmp 0x102fe64a

Function at 0x10332cec
Capabilities:
Encode data using base64

Disassembly:
dec cl
xor eax, ebx
call fcn.103f6997
add byte [eax], al
add byte [edx + 0x65], dl
inc esp
insb byte es:[edi], dx
je 0x10332d66
dec ebx
jns 0x10332d46
add byte [eax], al
add byte [esp + ebp*2 + 0x73], dl
push ebx
je 0x10332d65
popal
insb byte es:[edi], dx
jne 0x10332d78
add bh, al
inc esp
and al, 8
xchg edx, eax
mov edx, 0x74ff881f
and al, 4
popfd
lea esp, [esp + 8]
call fcn.10479837
and al, 2
scasb al, byte es:[edi]
neg ecx
aam 0xe8
push ebx
sub cl, bh
dec dword [ebp + 0x247c0884]
cwde
test dword [ebx], eax
sal bh, cl
fadd dword [esi + 0x2c8c1ca]

Function at 0x10332d14
Capabilities:
Encode data using base64

Disassembly:
dec cl
xor eax, ebx
call fcn.103f6997
add byte [eax], al
add byte [edx + 0x65], dl
inc esp
insb byte es:[edi], dx
je 0x10332d66
dec ebx
jns 0x10332d46
add byte [eax], al
add byte [esp + ebp*2 + 0x73], dl
push ebx
je 0x10332d65
popal
insb byte es:[edi], dx
jne 0x10332d78
add bh, al
inc esp
and al, 8
xchg edx, eax
mov edx, 0x74ff881f
and al, 4
popfd
lea esp, [esp + 8]
call fcn.10479837
and al, 2
scasb al, byte es:[edi]
neg ecx
aam 0xe8
push ebx
sub cl, bh
dec dword [ebp + 0x247c0884]
cwde
test dword [ebx], eax
sal bh, cl
fadd dword [esi + 0x2c8c1ca]
Function at 0x1033ab02
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
sbb dl, al
not dl
shl eax, 0x2e
rol dl, 1
add word [esp + 9], ax
xor dl, 0x12
btr ax, 0x8c
inc eax
rol dl, 1
pop eax
mov eax, 0x33858d86
neg dl
add al, 1
cwde
rol dl, 1
sub dword [esp + 4], eax
jp 0x10380bbb
ror al, 0x24
not dl
shl eax, 0xe3
ror al, 0xa4
xor bl, dl
pop eax
and al, al
mov dword [esp], edi
not ax
bts eax, 0x8d
adc eax, eax
push esi
rol al, 1
add eax, eax
push ebx
mov ebx, edx
lea edx, [eax + eax*4 + 0x6034e236]
rol ax, 0xaa
mov edx, ebx
setbe al
sal edx, 2
rol al, 0x81
lea eax, [eax + eax*4 - 0x47c9c67e]
jae 0x103d67ee
mov ecx, 0xce335006
inc cl
btr ecx, ecx
sbb edi, 4
movsx edx, cx
bt cx, dx
mov edx, dword [edx + edi - 0x5007]
or ecx, 0x238cb7ae
js 0x10470aea
mov eax, 0xdb980916
mov edx, eax
rdtsc
mov ecx, 0x2b41f3f
shr cl, 0xc6
jne 0x103e475c
lea edi, [ecx + edi - 0x2b41f08]
lea ecx, [ecx*4 + 0x5c955b2e]
mov dword [edi + ecx - 0x6765d72a], eax
bts ecx, ecx
call fcn.102d50c5
call fcn.10438795
mov edx, dword [edi]
add edi, 4
mov eax, 0xdd08e5ad
sar al, 0x43
movsx ecx, ax
xor edx, ebx
inc cl
inc eax
xchg ecx, eax
not edx
or cl, 0x3a
shl cl, 4
bswap ecx
xor edx, 0x33207a03
sub edx, 0xa2ab6328
rol edx, 2
shr al, 0x81
bts eax, 0x27
xor ebx, edx
add esi, edx
lea edx, [eax + ecx*8 + 0x7328a9bd]
mov eax, dword [edx + ebp - 0x7a50d6a0]
sal cl, 0xa1
mov cl, byte [edx + ebp - 0x7a50d69c]
shr edx, 0x38
ja 0x1038a053
lea ebp, [ebp + edx*8 - 0x3ce]
and dl, dh
setns dl
btr edx, edx
sal eax, cl
add edx, edx
bt edx, edx
mov dword [ebp + edx - 2], eax
ror dx, 0x43
movzx ecx, dx
not ecx
jmp esi
div al
add ebp, ecx
mov edx, esi
not ax
lea esi, [eax + esi - 0x8f63]
mov word [eax + esi - 0x8f61], dx
jmp fcn.10440eae
lea esp, [esp + 4]
je 0x10380f23
mov eax, dword [ebp + ebx*4]
call fcn.104a48d9
mov eax, ebp
push 0x70949b09
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x103b5593
inc ecx
add dl, ah
xadd al, dh
ror ecx, 2
inc edx
not ecx
ror ecx, 2
xor ecx, 0xe31a8f18
mul ax
ror al, 0xc3
ror edx, 0xaa
rol ecx, 1
cbw
mul ax
inc ecx
shr dx, 3
xor ebx, ecx
mul dl
jo 0x103a71fc
xor edx, ebx
movsx eax, cx
ror edx, 1
and cx, ax
neg eax
bswap eax
dec edx
rol ecx, 3
ror eax, 4
ror edx, 3
or cl, 0x8a
or ecx, ecx
not edx
xor ebx, edx
call fcn.1043f6fd

Function at 0x1033dcd8
Capabilities:
Encode data using base64

Disassembly:
shl ax, 0xce
ror edx, 2
not cl
neg eax
lea ecx, [eax + eax*8 + 0x6837e68c]
xor edx, 0xa838e996
xor ebx, edx
shl eax, cl
mov dword [esp + eax*8], 0xc437bc11
adc esi, edx
mov edx, dword [esp + eax*4]
neg edx
add eax, dword [eax + edi + 5]
jmp 0x1040727d
call fcn.102e98f5
Function at 0x1033f62f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor cl, 0x2c
inc esp
xor cl, cl
dec eax
dec esi
inc cx
neg ebp
sal si, 0x85
dec eax
lea ecx, [esp + ecx + 0x18]
movsx edx, byte [esp + eax*2 - 0xf9]
inc eax
shr bh, 0xc3
push eax
inc esp
mov byte [ecx + eax - 0x82], dh
dec eax
lea ebp, [ebp + eax*4 - 0x20c]
xor dx, word [esp + eax - 0x7e]
inc esp
mov eax, dword [eax + ebp - 0x82]
call fcn.10443ec5
push 0xfd1ec1b7
mov eax, dword [esi]
dec dword [esp]
add esi, 4
mov ecx, 0x83bcf7a7
xor eax, ebx
inc cl
dec cx
sar byte [esp + 3], 0xc5
lea eax, [eax + ecx*2 - 0x7be8e811]
btc ecx, ecx
lea ecx, [ecx + ecx*4 + 0x5f307bb3]
adc cx, 0x638c
rol eax, 1
btc cx, cx
inc eax
xor eax, 0xa99fd60f
jmp 0x10419785

Function at 0x1034404b
Capabilities:
Execute syscall

Disassembly:
sar ecx, 0x39
adc edx, 0xc795dd98
neg edx
call fcn.10431581
mov edx, 0xe5281c91
movsx eax, dx
movsx ecx, dl
mov edx, dword [edi + eax*8 - 0xe488]
bswap ecx
lea edi, [edi + eax - 0x1c8d]
and ax, cx
xor edx, ebx
and eax, eax
shl cl, 0xe5
shr ecx, 0x54
neg edx
push ecx
cwde
or ecx, 0x838002a8
inc edx
or word [esp + eax*4 - 0x7242], 0x8794
cwde
xor edx, 0x482b0583
not ecx
rol ax, 0xaf
neg edx
xor ebx, edx
or ecx, 0x5480312a
cmovnp ecx, eax
adc ebp, edx
shl byte [esp + eax - 0x8e48], 0xa2
shr word [esp + eax*2 - 0x11c8f], 0xe1
lea edx, [eax - 0x6d7283ce]
movzx edx, byte [edi + eax - 0x8e48]
lea edi, [edi + eax - 0x8e47]
not al
xchg ecx, eax
xor dl, bl
neg dword [esp + eax - 0x7cfff56a]
setnp al
cwde
neg dl
sub dl, al
pop ecx
add eax, 0xef33a903
xor cl, 0x8a
not dl
add eax, ecx
cwde
ror dl, 1
xor eax, ecx
sbb dl, 0x8f
xor cx, ax
xor bl, dl
bt cx, ax
call fcn.102e3d1f
mov eax, dword [edi]
mov edx, 0xb483f21d
movzx ecx, dx
bts dx, 0xa3
lea edi, [edi + ecx*8 - 0x790e4]
jb 0x103a1c7d
xor eax, ebx
bt edx, edx
imul ecx, edx
sbb eax, 0x940039b2
sal cx, cl
cmovbe dx, cx
and edx, ecx
not eax
imul edx, ecx
shl ecx, 0x24
jne 0x103706c9
syscall
push 0xf4bd620a
pushfd
dec eax
shr dword [esp + 8], 0x43
dec eax
mov dword [esp + 8], 0x2192c0be
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call int.1037d214

Function at 0x10344ac9
Capabilities:
Encode data using xor

Disassembly:
inc esp
movsx eax, dx
dec edx
mov dword [esp + edx*2 - 0xf408], edx
dec edx
lea ebp, [ebp - 0x69fce7f0]
dec eax
bswap esi
mov eax, 0xb496a82f
inc ecx
sal ah, 1
inc esi
mov esp, dword [ebp + edx*8 - 0x3d020]
push esi
inc ebp
call dword [esi + 0x45]
xor esp, ecx
inc ecx
not esp
inc ecx
push edx
inc ecx
ror esp, 3
inc edx
dec byte [esp + edx - 0x79fd]
inc dx
shr dword [esp + edx - 0x79fd], 0x6a
call fcn.1040fe44
mov esp, 0x17af7bf8
pop ds
adc dword [eax - 0x34], 0x42
sbb bh, ah
push edi
jl 0x10344aef
inc edx
sbb byte [ebx], bl
jnp 0x10344b88
int3
inc ebx
int3

Function at 0x10345030
Capabilities:
Encode data using base64

Disassembly:
xor edx, edx
call fcn.1040b586
mov edx, 0x98896808
jmp 0x10406e15

Function at 0x10352420
Capabilities:
Encode data using base64

Disassembly:
not edx
dec edx
inc cx
jp 0x103fa276
inc dword [esp + eax*2 - 0x4825a3e6]
rol edx, 1
shl eax, 0x1c
sbb cx, 0x199a
xor ebx, edx
mov dword [esp + eax - 0x70000000], ecx
add esi, edx
mov dword [esp + eax - 0x70000000], esi
ret 8