joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e704
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x43e773
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x43e73b
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43eecc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x43ef6b
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.0040558c
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x4a848a
call fcn.0040580c
add esp, 0xc
test eax, eax
jne 0x43ef6b
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x43ef68
mov ecx, dword [ebp + 0x10]
mov esi, 0x4a84b6
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004054b0
add esp, 8
mov eax, 1
jmp 0x43ef76
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x43eeeb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7d57db
Capabilities:
Encode data using base64

Disassembly:
inc eax
mov dword [esp + edx - 0x110c0], edx
add dword [esp + edx - 0x110c0], ecx
not eax
lea eax, [edx + eax + 0x2085ef4f]
call fcn.00d2493c
xor ecx, 0xd52f8b9d
dec edx
lea esp, [esp + 8]
jne 0x96d947
mov eax, 0x6eb5da21
pop ebx
mov eax, 0x62a96f03
movzx edx, ax
not ecx
add ax, dx
shl al, 0xe7
mov dword [eax + edi - 0x62a9de00], ecx
cmovs edx, eax
jmp ebp
mov ebx, 0x68be6299
push ebx
movzx ebx, byte [eax + ebx - 0x68be6299]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x94dd74]
shr ecx, 8
xor ecx, ebx
inc eax
call 0x7d57db

Function at 0x7df17e
Capabilities:
Encode data using base64

Disassembly:
shl dx, 0xcd
setnp byte [esp + ecx - 0xee9f]
mov dword [ebp + ecx*8 - 0x77540], eax
sbb ecx, 0x68a1bca5
jge 0x805e66
pop ecx
pop eax
pop eax
jle fcn.0087d700
call fcn.007e2c5b

Function at 0x7ed17f
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*8 - 0x69ca3800], 0xbbba909a
mov dword [esp + ecx - 0xd3946fc], edx
inc eax
push ecx
xor eax, 0x44bf568c
xchg edx, ecx
sal edx, cl
dec eax
shl edx, 0xa5
neg eax
sar dword [esp + edx + 7], 0xd5
not byte [esp + edx + 9]
ja 0x928b71
xor ebx, eax
push edx
add edi, eax
sub dword [esp + edx + 0xc], 0x2f986939
xor dword [esp + edx*2], edi
ret 0xc
Function at 0x7f9f06
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], eax
dec byte [esp + 0xb]
add ebp, edx
mov edx, dword [esi]
call fcn.0080e52e
mov eax, 0xf4379498
mov eax, dword [esi]
add esi, 4
mov ecx, 0xf7204594
movsx edx, cl
sar cx, 0x21
xor eax, ebx
neg edx
lea eax, [edx + eax + 0x5e37374b]
and dl, cl
ror eax, 3
shr ecx, 0xf0
lea edx, [edx - 0x15413ec7]
inc eax
not eax
lea eax, [ecx + eax + 0x208608ef]
add cl, 0x18
rol eax, 3
or cx, cx
xor ecx, ecx
rol edx, 0xcb
xor eax, 0x3e04b40e
push ecx
xor ebx, eax
dec word [esp + ecx + 1]
jp 0x8201a4
and cx, cx
not edx
push eax
and dword [esp + eax*2 - 0x23910ea9], eax
xor ebx, edx
call fcn.0088e32a
lea ecx, [ebx + 0x7f108ea7]
mov ebx, dword [esp + eax*2 - 0x26ab9f68]
jge 0x911e3f
mov eax, 0x423aeb96
mov edx, dword [esi + eax - 0x423aeb96]
neg eax
add esi, 4
xor edx, ebx
sar eax, 0xae
not eax
bswap edx
inc edx
and al, ah
shl eax, 0xa7
xor edx, 0xa296be9c
bswap edx
call fcn.00d406f8
add edi, eax
jmp 0x8d36a3
jmp 0xd3e1ff
jge 0xda083e
mov eax, dword [ebp + ecx]
not dl
shl dword [esp + ecx], 0x48
mov dword [esp + ecx*2], ebx
adc ecx, edx
sal edx, 0x42
cpuid
push 0x389d07a8
sub ebp, 0xc
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
mov ebx, 0xec1d7b05
or ebx, ebx
mov dword [ebp + 4], ecx
lea eax, [ebx*2 + 0x3b1ad9ad]
dec eax
mov dword [ebp + eax*2 - 0x26ab9f6c], edx
jne 0x81afca
pop edx
pop edx
jg fcn.0087d700

Function at 0x803986
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov ebx, dword [esp + eax + 0x10]
dec esi
mov dword [esp + eax + 0x77dd6013], eax
inc esp
or eax, edx
dec eax
arpl cx, cx
call fcn.008d7ae1
mov ecx, 0x4f91b484
mov eax, dword [edi + ecx - 0x4f91b484]
movsx edx, cx
xchg cl, dl
mov dx, word ss:[eax + ecx - 0x4f91b484]
lea edi, [edi + ecx - 0x4f91b482]
mov word [edi + ecx - 0x4f91b484], dx
lea eax, [ecx + 0x32b62db0]
mov ecx, dword [ecx + esi - 0x4f91b484]
mov edx, 0x143945a3
sar dx, 0x48
lea esi, [esi + edx*4 - 0x50e40110]
call fcn.008d34b6

Function at 0x81007d
Capabilities:
Encode data using xor

Disassembly:
push edi
pushfd
add dword [esp + 8], 0xff23e271
mov dword [esp + 8], 0x6d415789
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.00daa46a
sub dword [edx], ecx
xchg esi, eax
in al, dx
pushfd
insb byte es:[edi], dx
outsb dx, byte [esi]
mov ah, 0x57
invalid
Function at 0x812147
Capabilities:
Encode data using base64

Disassembly:
rol ecx, 1
not dl
xor ebx, ecx
mov dword [edx + edi - 0x6c8063fb], ecx
lea edi, [edi + edx - 0x6c8063fb]
mov ecx, edx
mov dword [esp + ecx - 0x6c8063fb], eax
call fcn.00d2dc8a
neg al
movsx ecx, dl
sar dl, 0x25
setbe cl
xor bl, al
add eax, esp
shr edx, 0x35
shr dx, cl
mov dl, byte [eax + edx*8 - 0x2c0]
movzx eax, cl
mov word [ebp + ecx*2 - 6], dx
and eax, eax
lea ebp, [ebp + ecx*4 - 8]
lea edx, [eax + ecx*4 + 0x5daca7b0]
jno 0x92fb00
movzx edx, byte [ecx + esi - 0x398115f9]
lea eax, [ecx + ecx*4 + 0x34306e2e]
xor dl, bl
push ecx
sub cx, ax
not dl
rol dl, 1
ror cl, 0x67
inc eax
shr ax, 0x4a
inc dl
dec byte [esp + eax - 0x53b50035]
seto al
lea eax, [ecx*4 + 0x2f9c2bb5]
ror dl, 1
sub dl, 0xa4
ror dword [esp + eax*2 - 0x2b422552], cl
rol dl, 1
add al, 0x89
sar word [esp + ecx - 0x398139bb], 0xcc
inc dl
xadd dword [esp + ecx - 0x398139bd], eax

Function at 0x81a562
Capabilities:
Encode data using xor

Disassembly:
sub cx, 0x6f9a
xor ebx, edx
add ebp, edx
mov dword [esp + eax], eax
movsx edx, cx
rdtsc
bswap ecx
lea ecx, [ecx + 0x55216ca0]
call fcn.00d279bc
xor al, 0xef
add byte [esi + 0x6ec9ddbe], dl
mov ah, 0xfd
xchg byte [ebp - 0x7d4b9137], dh
xor dl, byte [ecx - 0xd4b9137]
invalid

Function at 0x81de69
Capabilities:
Get number of processors

Disassembly:
dec esi
mov dword [esp + ecx - 0x7235be31], edx
inc esp
mov edx, eax
call fcn.00d6ca3e
mov edx, dword [esi]
jmp 0x94e237
je 0xd604be
inc edx
test si, 0xf72f
stc
cmp edx, 0x104
jmp 0xd604b8
mov eax, 0x34a2e208
lea esi, [esi + eax - 0x34a2e204]
lea ecx, [eax + eax - 0x4c7bfe7d]
xor edx, ebx
bswap edx
dec ecx
rol edx, 3
add cl, al
dec eax
lea edx, [edx + ecx - 0x78010525]
ror edx, 3
and cx, 0x3b2a
xor ebx, edx
add ebp, edx
sar eax, 0xcd
mov edi, dword [edi + eax - 0x1a517]
mov edx, 0x9c888602
sub edx, 0x16a7451b
jp fcn.0091626b
mov eax, 0xee000d39
rol cl, 0x22
movzx esi, sp
mov cl, dl
movsx esi, di
rol eax, cl
adc si, si
lea esi, [ebp + edx - 0x10c]
add al, dl
jmp 0xce2a14
mov byte [esi], al
jmp 0x88b595
xor al, byte [edi + esi]
jmp 0x99c24f
jb 0x94e283
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
ror bx, 0xa0
mov ecx, dword [eax + 0xc]
test ah, 0xb8
mov eax, dword [eax + 0x10]
btc bx, 0xbb
mov dword [ebp - 4], eax
or bx, bx
seta bh
mov ebx, ecx
clc
cmp ecx, eax
jmp 0xd6fed1
je 0x87e79b
lea ebx, [ebx]
test ebx, 0x6e09d33c
sub edi, 0x5e83eba6

Function at 0x81dfd0
Capabilities:
Encode data using xor

Disassembly:
movzx edi, byte [edi + ecx - 0x78216014]
xor edi, edx
jmp 0xd4a448
shr word [esp + 2], 0xc6
jns 0xcf783c
mov dword [esp], 0x5986de22
and edi, 0xff
jmp 0x975cc3

Function at 0x82003d
Capabilities:
Encode data using xor

Disassembly:
lea eax, [eax + ecx*4 - 0x2042c9]
adc dword [esp + edx*2 - 0x30], 0x33171ae
bswap eax
bswap ecx
push edx
xor ebx, eax
call fcn.00ceead6
movzx edx, word [esi + eax - 0x9e]
shl ecx, 0x1c
lea esi, [esi + eax*4 - 0x276]
xor dx, bx
lea ecx, [eax + ecx*8 + 0x58131212]
sub dx, 0xae2f
xor dx, 0x1f21
sal cl, 0xe1
not dx
xor dx, 0x9c8b
inc dx
and ecx, ecx
jp 0x8a4a6a
Function at 0x828ca6
Capabilities:
Encode data using xor

Disassembly:
call fcn.00930401
pop ds
mov byte [ebx], 0x96
sub eax, 0xb46de0be
aad 0xf6
loopne 0x828d26
mov ah, 0xd2
jge 0x828cab
loopne 0x828d2c
mov ah, 0xce
mov ebp, 0xb46de09e
stc
mov ah, 0xf9
dec ecx
ljmp 0xea49
jno 0x828d42
mov edi, 0xfc974fe1
cld
in eax, dx
ja 0x828cc5
push ds
pop dword [eax]
mov word [ecx + 0x2ca59dd6], ds
sbb eax, 0x44b08ed5
adc eax, 0x331b6633
adc eax, dword [edx - 0x2c]
mov al, 0x59
xor edx, dword [ebx]
inc edx
aam 0xb0
pop ecx
jbe 0x828d9f
pop esi
je 0x828d9a
cmpsb byte [esi], byte es:[edi]
bound ecx, qword [edi - 7]
into
aad 0xf1
std
sahf
inc ecx
add al, al
invalid
invalid
push ebx
adc ebp, edx
xchg edi, eax
mov al, byte [0xc823e22d]
lcall 0x6d4f, 0x4744505c
in al, 0xf5
mov edi, 0xba30acff
out dx, al
pop es
fld qword [ebx]
add dword [eax + 0x2f], 0x1b72b34a
sahf
inc edi
push esi
lds esi, [ecx]
stosb byte es:[edi], al
jne 0x828dd9
cmp esp, dword [0x56e4e91d]
js 0x828dd4
pushfd
mov esp, esp
xor dword [edx - 0xa], ebp
in al, 0x31
push 0xfffffffffffffff6
cmpsd dword [esi], dword es:[edi]
cmp eax, 0xa86df452
pop ss
mov eax, 0x69fcf35d
call 0x7cc54221
cld
imul ebp, eax, 0x7c42b438
xor byte [eax], 0x52
stosb byte es:[edi], al
mov eax, 0x5c65c4a6
pop edx
sar dword [edx + 0x1369c116], 0xb2
push ebp
xlatb
imul esi, ebp, 0x9a5b9ea7
scasb al, byte es:[edi]
mov esi, 0x2c97f14a
jl 0x828de2
push eax
mov dword [0x4b6568cf], eax
cmp eax, 0x628d6f33
test byte [esi + ebx*4 - 0x2b], 0x50
movsd dword es:[edi], dword [esi]
pop ebp
add bl, byte [edx + 0x5e]
pop eax
xor eax, 0x60610b1a
add eax, 0xace2da9c
ljmp 0xc619

Function at 0x829e99
Capabilities:
Encode data using base64

Disassembly:
inc ecx
bswap esi
inc ecx
mov esp, 0x2033e502
inc ecx
lea esi, [esi + esi + 0x4299344f]
xor esi, 0xe424de96
ror esi, 3
inc ebp
add esp, ecx
jle 0x867310
inc ebp
movzx edx, cx
sub esi, 0xf482d032
inc ebp
movzx ebp, dh
call fcn.008d4c09
Function at 0x82d31c
Capabilities:
Encode data using base64

Disassembly:
add esi, 4
mov eax, 0x7f25c5b6
xor ecx, ebx
rol ecx, 1
lea edx, [eax + eax*4 + 0x67212997]
inc eax
add edx, edx
bswap ecx
lea ecx, [ecx + eax + 0x47db4608]
add ax, ax
rol ecx, 1
xor ebx, ecx
call fcn.007ff9ca
movzx ecx, ax
mov edx, ecx
mov edx, dword [esi + ecx - 0xb000]
call fcn.008d4a79
push 0xb0162316
lea esp, [esp + 0x10]
je 0xda4613
call fcn.00da4605
xor ecx, ebx
xor ecx, 0xbb261721
dec edx
not ecx
call fcn.00da2497
jmp 0x829f75
mov dword [ebx + ebp - 0x3d80f93e], eax
movsx edx, bx
call fcn.007fda75
mov edx, 0xa7877308
mov eax, dword [esi]
ror dl, 0x43
jae 0x823944
mov eax, dword [esi + edx*2 - 0xdf1da]
jmp 0x93f058
mov edx, dword [esi]
mov eax, 0xea011e0e
inc al
movsx ecx, al
lea esi, [esi + ecx*8 - 0x74]
shl cl, 0xe7
push edx
popfd
lea edi, [edi + ecx*8 - 0x404]
mov ecx, dword [edi + ecx*8 - 0x400]
movzx edx, al
sal al, 0x85
jnp 0x8d7c9d
add edi, edx
shr cl, 0x82
movsx edx, cx
mov dword [esp + ecx*4], edx
add dx, word [ebp + ecx - 2]
add cl, byte [esi + ecx*2 + 5]
xor byte [esp + 5], 0x3e
sbb esi, 0xfffffffa
mov eax, dword [esp + 2]
xor cl, bl
push eax
mov dword [esp + eax*2 - 0x54d3ffec], eax
rol cl, 1
lea eax, [eax + eax*8 + 0x7f3504a5]
call fcn.0093eefb
neg dl
movsx ecx, dx
lea esi, [esi + edx - 0x6f80f]
shr cl, 0x46
xor eax, ebx
ror edx, 0x83
inc eax
rol dx, 5
neg eax
call fcn.0081d148
jmp 0x93df9f
mov eax, 0xe99c3903
mov eax, dword [ebp]
call eax
mov ebx, 0x3d80f93e
movsx esi, bl
mov ebp, dword [ebp + esi - 0x42]
jmp 0x9315bf

Function at 0x8304c8
Capabilities:
Encode data using base64

Disassembly:
and al, cl
mov ecx, 0x7a2fa930
mov edx, ecx
mov word [edx + ebp - 0x7a2fa92c], ax
mov dword [esp + edx - 0x7a2fa930], edx
add dl, byte [esp + ecx - 0x7a2fa92a]
lea ebp, [ebp + edx - 0x7a2fa9b4]
movzx eax, cx
js 0x8fea80
mov ecx, 0x94047286
sub edi, 4
movzx edx, cx
mov edx, dword [edi + edx - 0x7286]
lea ecx, [ecx + ecx - 0xbf0ee79]
inc ecx
neg cl
xor edx, ebx
xor edx, 0x7d196232
movzx eax, cx
inc edx
not ecx
or al, 0x20
bswap edx
xor edx, 0x7b38d1b5
neg cx
xor ebx, edx
add ebp, edx
neg ecx
lea eax, [ecx + eax - 0x6e4e4e6e]
mov edx, dword [esi + ecx*2 - 0x382e1326]
ror eax, 0x76
movzx ax, byte [edx + ecx - 0x1c170993]
lea esi, [esi + ecx*4 - 0x705c264a]
movsx edx, cl
rol ecx, cl
mov word [esi + ecx - 0x4c98e0b8], ax
jmp ebp
not al
mov eax, dword [eax + esi - 0xa9d3]
call fcn.008cd5aa

Function at 0x830d6d
Capabilities:
Encode data using base64

Disassembly:
shr eax, 0x72
xor cl, 0x15
pop edx
add al, ah
ror ax, 0x43
sub cl, 0x80
call fcn.009669e8

Function at 0x838a60
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esi]
add esi, 4
xor eax, ebx
lea eax, [ecx + eax - 0x5bdf0807]
mov dword [esp], ecx
add cl, ch
not eax
movzx edx, word [esp]
add ecx, ecx
bswap eax
xor dl, 3
inc eax
ror eax, 1
sar dword [esp + edx - 0x98b9], cl
xchg cx, dx
jb 0x841543
Function at 0x838c08
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
add ebp, eax
xchg word [esp + ecx - 0x7ffffef8], dx
pop ecx
dec dword [esp + 4]
pop eax
pop eax
jge fcn.0091626b
mov edx, 0xb42c7c37
rol dl, 0xc3
mov dx, word [esi]
mov ecx, 0x1bb84a1e
movsx eax, cl
adc eax, 0xeebecbab
mov cx, word [esi + ecx*2 - 0x3770943a]
inc al
not dx
js 0x8ea518

Function at 0x8391e1
Capabilities:
Encode data using base64

Disassembly:
pop ecx
jno fcn.0087d700
pop eax
or edx, edx
neg ecx
rol ecx, 3
ror edx, 0x97
xor ecx, 0x2b0f7d8d
xor ebx, ecx
inc dx
dec edx
add ebp, ecx
call fcn.00cf287b

Function at 0x8498f7
Capabilities:
Encode data using base64

Disassembly:
dec esi
lea eax, [esi*2 - 0x476bd4e9]
dec esi
xor dword [esp - 0xc8b3c0], ebx
push ecx
inc edx
xor dword [esp - 0xc8b3b8], eax
inc dx
inc dword [esp - 0xc8b3ce]
dec esi
mov ebx, dword [esp - 0xc8b3b8]
dec eax
arpl ax, ax
dec eax
add edi, eax
dec edx
mov dword [esp - 0xc8b3c8], 0xc08423a1
inc edx
or dl, byte [ebp - 0x322cf46]
dec esi
sub dword [esp - 0x1916795], edx
dec edx
lea ebp, [ebp - 0xc8b3d6]
inc dx
shr dword [esp - 0x1916799], 0xa2
inc edx
rol byte [esp - 0xc8b3b9], 0x62
inc ecx
xor dl, bl
inc ecx
push edx
not dl
inc ecx
push edx
dec edx
mov dword [esp - 0x1916778], 0xe2046ea5
inc cx
shl edx, 0xce
inc dl
inc ebp
xor dh, ch
neg dl
mov esi, 0xd2199025
ror dl, 1
dec edx
inc dword [esp - 0xc8b3c9]
inc ecx
movsx eax, sp
jne 0x8cd7f3
ror ecx, cl

Function at 0x850f01
Capabilities:
Check for software breakpoints

Disassembly:
lea edx, [edx + ecx*2 - 0xc5f17ef]
or word [esp + ecx*2 - 0x63148903], ax
not edx
shl eax, 0xa1
pop eax
movsx eax, word [esp + ecx*2 - 0x63148908]
dec edx
jmp 0x877545
not dword [esp + ecx*2 - 0x63148908]
xor ebx, edx
jmp 0x95c838
add edi, edx
shl word [esp + ecx*2 - 0x6314890a], 0xe9
pop edx
pop edx
jne fcn.0087d700
movzx eax, word [esi + 5]
jbe 0x7f4729

Function at 0x857d0a
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax*2 - 0x1fff6], eax
xor ecx, 0xd6a5932e
mov dword [esp + eax*8 - 0x7fff8], eax
not ecx
sal edx, 0xdb
jns 0xce7132
xor dword [esp + eax*4 - 0x2bc6e0d8], edx
mov ax, word [ebp + eax - 0xaf1b836]
movsx ecx, dl
sar dword [esp + edx - 0x537dd69e], 4
mov cx, word [edx + ebp - 0x537dd69c]
push edx
pop edx
lea ebp, [ebp + edx - 0x537dd69c]
inc byte [esp + edx - 0x537dd69b]
shl edx, 0x8c
lea edx, [edx + edx - 0x5ae4cbe3]
not ax
sar word [esp + edx - 0x5feef41d], 0xca
adc word [esp + edx - 0x5feef41d], dx
not cx
sbb byte [esp + edx - 0x5feef41a], dh
and ax, cx
mov word [ebp + edx - 0x5feef41d], ax
call fcn.00d27075
xor eax, ecx
or cl, ah
sbb edx, ecx
neg cx
or cx, ax
sub eax, eax
not edx
sub ax, cx
and cx, 0x9b9f
cmovp cx, ax
neg edx
bswap eax
ror edx, 3
sub al, ah
or eax, 0xfd1ca8a5
lea eax, [ecx + eax + 0x79b5ed3a]
xor ebx, edx
not ecx
sal ecx, 0x84
add ebp, edx
sal ecx, 0xe6
shl ecx, 0x88
mov ecx, dword [eax + esi - 0x76d295dc]
mov eax, dword [esi + eax - 0x76d295d8]
jbe 0xce0fcb
not edx
add edi, ecx
dec dword [esp + eax*4 - 0x3ffed]
mov dword [esp + eax - 0xffff], edi
ret 0x10
or ax, ax
xor ebx, ecx
jmp 0x8e1cb1
Function at 0x85f201
Capabilities:
Encode data using base64

Disassembly:
lea edx, [ecx + ecx*8 - 0x76c584f]
or ecx, 0xc0152904
not eax
lea ecx, [edx*8 - 0xad914ef]
cmovs ecx, dword [esp + 0x10]
xor ebx, eax
sal dx, 0x62
add byte [esp + 4], dl
add ebp, eax
call fcn.0091d8c1
mov edx, 0xee00e324
dec ebp
mov esp, dword [edi]
dec ecx
mov edx, dword [edi + 8]
inc ecx
mov edx, 0x63e2c1d
dec edx
lea ebx, [edx*2 - 0xb6215fb]
inc ecx
movzx eax, dx
dec esp
add esp, edx
inc esp
movsx eax, bx
dec ebp
lea esi, [edx + 0x56941935]
dec edi
mov dword [edi + edx*4 - 0x18f8b06c], esp
inc esi
mov eax, dword [ebp + edx - 0x63e2c21]
inc ecx
movzx esi, dh
inc ecx
movsx edx, dx
dec ecx
lea ebp, [edx + ebp - 0x63e2c21]
inc esp
mov ebp, ebx
dec eax
lea eax, [esi*8 + 0x772c7f02]
inc ebp
xor eax, ebx
sal edx, 0xc9
inc ecx
xor eax, 0x49b06abd
dec esp
sub edx, edx
or si, dx
inc ebp
lea eax, [eax + eax*2 - 0x4fb54f02]
jnp 0xd60d8a
mov dword [esp], 0x63aa6bb8
mov ecx, 0x83a8d008
movzx ecx, byte [esi]
inc dword [esp]
call fcn.008d67c6
mov edx, 0x832bde36
dec ebp
mov ecx, dword [edi]
inc esp
movsx edx, dl
dec edi
mov ebp, dword [ecx + edx*4 - 0xd8]
inc esp
movzx eax, dl
dec edi
mov dword [edi + edx*2 - 0x6c], ebp
jmp 0x87a34c

Function at 0x85fd9d
Capabilities:
Encode data using base64

Disassembly:
sal edx, 2
mov dword [esp + eax - 0x40866d1a], eax
mov eax, ebp
sar word [esp + 2], 0x69
not dword [esp]
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
push 0x57113bb2
lea esp, [esp + 8]
je 0x8d51d6

Function at 0x866da4
Capabilities:
Encode data using base64

Disassembly:
bswap edx
pop ecx
mov ecx, 0x83addb1b
rol edx, 2
sub edx, 0x89affc0f
inc eax
dec cl
neg edx
xor eax, ecx
adc al, al
xor ebx, edx
inc eax
call fcn.00d09d52

Function at 0x8672d5
Capabilities:
Encode data using base64

Disassembly:
mov dword [esi + 4], eax
call fcn.00941601
ror dl, 1
neg eax
dec al
not dl
mov dword [esp + eax - 0x3633df13], 0x8b3a880
jp 0x8415c5
pop eax
inc dl
call fcn.007e1152

Function at 0x8672f6
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor eax, 0x8045833
inc ecx
ror eax, 3
inc ebp
lea eax, [eax + eax*8 - 0x573315da]
call fcn.00985b41

Function at 0x86730e
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop edx
not edx
bswap edx
call fcn.00d2b896
sysenter
call fcn.00990ea9
adc dx, dx
xor ebx, ecx
sub al, ah
add ebp, ecx
mov eax, dword [eax + edi - 0x75bfff01]
mov cx, word [edi + 4]
inc dl
lea edx, [edx + edx + 0x7c0d5835]
and edx, edx
adc edi, 2
jmp 0xd66053
mov eax, 0xdcbf0f16
not dl
shr cx, 1
push edx
pop edx
rcr eax, cl
call fcn.0091aa4c
jge 0xd65fe3
xchg byte [ecx + 0x149d71b9], ah
sub bh, byte [esi]
test eax, 0x42bc1e8e
test eax, 0xbee5f28e
and byte [esi + edx*8 - 0x4096cad7], ch
lodsb al, byte [esi]
iretd

Function at 0x86ffb7
Capabilities:
Encode data using base64

Disassembly:
movsx eax, dl
dec ecx
mov dword [esp + edx - 0x24c58cf], eax
ror ecx, 1
or ax, 0x1bbd
rol eax, 0x21
neg eax
not ecx
neg ecx
xor ebx, ecx
add edi, ecx
dec al
shr al, 1
xor eax, dword [ebp + eax*2 + 4]
mov cl, byte [ebp + edx*2 - 0x498b196]
dec dl
ror edx, 0xff
call fcn.00d4f8c5
Function at 0x873fa1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edi
mov ebx, dword [esp + 4]
call fcn.008d192f
inc ecx
mov eax, 0xd10978b7
inc ecx
mov esi, dword [edi]
dec edx
lea ecx, [eax*4 + 0x1e2948ab]
inc ecx
mov eax, dword [edi + 4]
dec ebx
lea edx, [eax + eax*2 - 0x44468bdf]
call fcn.008b2a66
dec esi
mov dword [esp + ecx*2 - 0x5b720048], ebx
jmp 0xd4c281
inc esp
movsx edx, bl
inc esi
xor dword [esp + ecx - 0x2db90020], esi
dec esi
mov ebx, dword [esp + ecx - 0x2db90020]
dec edx
mov dword [esp + ecx - 0x2db90020], eax
dec eax
not ebx
inc ebp
and cl, ah
dec ebp
arpl si, si
inc ecx
movzx edx, cl
dec ecx
adc edi, esi
call fcn.00cf634e

Function at 0x87a2d0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [edi]
mov dword [esp], ecx
xor eax, ebx
lea edx, [ecx - 0x1c28efd]
xchg dx, cx
inc eax
sar dword [esp], 0x30
js 0xcd5b0d

Function at 0x87a331
Capabilities:
Encode data using base64

Disassembly:
ror eax, 3
pop edx
mov ecx, 0x4f9ad0b2
neg eax
movsx edx, cl
lea ecx, [ecx + edx + 0x4a384d39]
sub eax, 0x1ab36225
lea ecx, [ecx*4 + 0x748e9127]
xor dl, 0xa2
rol eax, 1
xor cl, dh
sbb edx, 0x8121c613
rol dx, cl
xor ebx, eax
xadd dx, cx
neg dl
neg ecx
add ebp, eax
sar edx, 0x39
jae 0x912780
inc bp
or ebp, ecx
dec ebp
arpl si, si
dec eax
shl esi, cl
dec ecx
adc edi, esi
dec ecx
mov ebx, edi
inc cx
neg ecx
dec edx
call fcn.0081b815
shl dl, 0x21
inc esi
mov esi, dword [ebp + edx*2 - 0x70]
inc ebp
movzx esp, dl
dec eax
ror edx, 0x97
inc ebp
mov ecx, esp
inc ebp
xor esi, ebx
inc ecx
inc esi
inc ecx
movsx ebx, cx
jmp 0x8a3660
inc ecx
ror esi, 2
inc ecx
bswap esp
movsx eax, dl
dec edx
lea ecx, [ebx - 0x53f6f862]
inc ecx
inc esi
sub ecx, 0x77069a99
call fcn.008a2ebb
mov ecx, dword [edi + ecx*2 - 0x4848e05a]
lea edi, [edi + edx*2 - 0x7a]
mov dl, byte [esi + edx - 0x3f]
adc esi, 1
mov eax, 0xc6a24083
lea eax, [eax + eax*8 - 0x53c6aee7]
sar al, 0xa7
xor dl, bl
rol dl, 1
neg dl
inc al
dec dl
shr eax, 7
add al, al
ror dl, 1
rol al, 0xa2
setae al
inc dl
dec eax
xor bl, dl
add edx, esp
shr eax, 0xc3
mov dword [edx + eax*2 - 0x53f6be], ecx
jmp ebp