joyce8/EMBER2024-capa huggingface dataset:
Function at 0x963e2d
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
inc eax
xor dl, dh
dec esi
mov dword [esp + eax - 0x791229a1], esp
ror dl, 1
inc ecx
mov esi, 0x1db8cfb0
and al, 0xb9
sbb dl, 0x3a
inc cx
sal eax, 0x24
jb 0xa59ebb
inc ecx
movsx ebp, dl
rol dl, 1
inc ecx
xor dl, cl
inc eax
or byte [esp + ecx*2 - 0x72fd], bh
inc cx
or esi, 0x3240589f
dec eax
shl eax, 0xb0
dec eax
lea edx, [esp + edx + 0x20]
inc ecx
not ah
inc esi
and dword [esp + eax - 0x79129b7b], esp
inc esp
mov esp, dword [ecx + edx - 0x3988]
inc word [esp + ecx*8 - 0x1cc36]
inc esp
mov dword [ecx + ebx - 0x398c], esp
dec eax
dec dword [esp + ecx*8 - 0x1cc28]
ror cx, 0x25
dec ecx
cmovae edi, eax
inc edx
movzx ecx, byte [ecx + edi - 0x41c7]
dec esi
mov dword [esp + eax - 0x79129b90], eax
inc ecx
ror ecx, 0x35
inc ecx
bts eax, 0x36
dec edi
lea edi, [eax + edi - 0x79529b8a]
neg edi
inc eax
xor cl, dh
inc dx
and dword [esp + eax - 0x79529b8b], eax
dec edx
neg dword [esp + esi - 0x1db8dfa7]
neg cl
add cl, 0xb9
pop eax
rol cl, 1
add cl, 0x23
call fcn.00ddb733
inc sp
xor esi, esi
inc ecx
mov ecx, 0x2500f939
inc cx
ror esi, 1
inc cx
not esi
inc ecx
movzx edi, cx
inc esp
movsx esp, bh
btr edi, 0x1e
inc cx
ror esi, 1
inc esi
and byte [esp + ecx - 0x2500f935], cl
inc dx
adc dword [esp + ecx - 0x2500f935], edi
inc dx
shr dword [esp + ecx*2 - 0x4a01f270], 0x2c
inc cx
dec esi
inc ecx
sar esp, 0xf8
inc cx
xor esi, esi
dec ecx
lea ebx, [ecx + ebx - 0x2500f941]
inc ecx
pop eax
inc ecx
neg esp
dec esi
mov dword [ebx + ecx - 0x2500f939], esi
inc esp
xchg bh, al
inc ecx
movzx ebp, al
inc ecx
mov ebp, dword [edi + edi*4 - 0x3e488]
mov edi, 0xfffc1b78
inc ecx
mov ebp, 0x511fbb26
dec edi
lea edi, [edi + ecx - 0x2500f935]
inc bp
btc esp, ebp
xor ebp, esi
bt di, 0x8b
sbb ebp, 0xfb061985
inc cx
shr ecx, 0x48
inc ecx
movsx eax, ax
movzx edx, di
xor ebp, 0xca8778b3
dec eax
inc edi
dec ecx
add edx, esp
inc ecx
dec eax
inc ebp
shl di, 0x26
ror ebp, 2
dec edx
lea ecx, [edi + 0x5035b08a]
push eax
dec eax
lea ecx, [edx*8 + 0x3233559b]
inc edx
lea ebp, [ebp + ecx*2 - 0x67bbb59a]
inc esp
mov esi, edi
inc edx
shr dword [esp + ecx - 0x250000f8], cl
ror ebp, 1
inc cx
or eax, 0xb4c0292a
jl 0xa59f23
outsb dx, byte [esi]
invalid
Function at 0x9640e8
Capabilities:
Encode data using xor

Disassembly:
lea eax, [ecx*8 + 0x1a9d1385]
dec ecx
not dl
mov dword [esp + eax - 0x5aa84bbd], ecx
lea ecx, [eax + ecx - 0x2564f7fe]
inc dl
neg word [esp + eax - 0x5aa84bbd]
sar eax, 0x94
rol ecx, cl
neg dl
push ecx
lea ecx, [ecx + eax*8 - 0x5e47f4fb]
xor dl, 0x9f
neg cx
xor bl, dl
xchg word [esp + eax - 0x5a7], cx
push eax
lea edx, [esp + edx + 0xc]
ror byte [esp + ecx - 0x4a4ffa9e], 0x81
shr byte [esp + ecx - 0x4a4ffaa0], 0x41
xor al, ah
mov eax, dword [edx + ecx - 0x4a4ffaa8]
movzx edx, cl
mov dword [ecx + ebp - 0x4a4ffaac], eax
mov edx, dword [ebp + edx*4 - 0x2a4]
sar dword [esp + ecx - 0x4a4ffaa5], cl
not dword [esp + ecx - 0x4a4ffaa7]
mov cl, byte [ebp + ecx - 0x4a4ffaa8]
shl edx, cl
mov dword [ebp - 2], edx
mov eax, 0x3535c209
sar word [esp + eax*2 - 0x6a6b8409], 0x2c
mov edx, dword [edi + eax - 0x3535c208]
pop ecx
mov dword [esp + eax*2 - 0x6a6b840e], ecx
or edx, eax
xor eax, 0xbcc16635
inc esp
idiv dword [ebx - 0x6c]
xchg ebp, eax
sub al, 0x8b
xchg esp, eax
pop es
clc
cmp eax, 0x8959caca
mov word [edx + esi*8 + 0x7b], es
xchg esp, eax
xchg ebp, eax
cbw
xor edx, ebx
bswap edx
cwde
inc dword [esp + eax*4 - 0x20]
xor edx, 0x549af09a
not dword [esp + eax*2 - 0xe]
sar ecx, 0x36
rol edx, cl
ror cl, 0xe1
add ecx, eax
inc dword [esp + eax - 7]
lea edx, [edx + eax*2 - 0x2721c1b8]
add cx, cx
pop ecx
xor ebx, edx
call fcn.00da1018
mov bh, 0x5d
push esi
jns 0x964173
cmp ah, byte [eax]
call dword [edx]
and bh, byte [edx]
outsd dx, dword [esi]
lodsb al, byte [esi]
pop ds
sbb byte [esi + 0x70], dl
inc edx
cdq
push ds
push esp
xchg dword [esi - 0x3c], ebx
fild word [eax]
xor dword [esi - 0x7f], ebx
cmp ebp, dword [eax + 0x35]
dec edx
invalid
Function at 0x96a676
Capabilities:
Encode data using base64

Disassembly:
bt dx, dx
inc cl
or edx, 0x861c90ae
ror cl, 1
dec cl
sar dl, 2
jp 0xa4d8b9
rol cl, 1
call fcn.00d894ac
mov edx, 0xae9aa093
mov eax, dword [edi]
add edi, 4
movzx ecx, dl
xor eax, ebx
push ecx
and ecx, 0x5cb2e98b

Function at 0x96ebbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol edx, 0x79
xor ebx, ecx
btr edx, 0x35
dec dword [esp + eax*8 - 0xf77c]
add esi, ecx
or byte [esp + eax - 0x1ed9], dl
lea ecx, [edx*8 - 0x224fb5c3]
mov edx, dword [ebp + eax - 0x1ef4]
xchg dword [esp + eax - 0x1edd], ecx
not ecx
cbw
mov eax, dword ss:[edx + eax - 0xfff0]
rol ecx, 0x69
shl ecx, 0x68
lea edx, [ecx*4 - 0x2b75abea]
mov dword [edx + ebp - 0x1d9bc81a], eax
dec dx
sets dl
lea ebp, [ebp + edx*2 - 0x3b379006]
lea eax, [edx + edx + 0x31bf319c]
sub ecx, 0x412fa0a2
shl edx, cl
pop ecx
pop ecx
pop edx
pop eax
pop edx
pop edx
jae fcn.0094787b
mov eax, 0xb3262683
mov ecx, 0x34359734
mov eax, dword [ebp + ecx*2 - 0x686b2e68]
jmp 0x9e0ed1
jb 0x9d521a
inc edx
xor ebx, ecx
not al
ror eax, 0xb5
call fcn.0088dcb7
inc ecx
mov ecx, 0x102d4038
inc edi
movzx esp, byte [edi + ecx - 0x102d4038]
inc ecx
mov eax, ecx
inc esp
xor ah, dh
inc ebp
movzx esi, cl
movsx ebp, ax
call fcn.00981120
mov dword [esi], ebx
mov dh, bh
pop ds
invalid
xor ecx, ecx
movsx edx, cx
xor ecx, dword [ebp + ecx*2 + 4]
push ebx
push edx
cpuid
dec dword [esp]
dec word [esp]
sub ebp, 8
push 0xc73d632e
mov dword [ebp + 0xc], eax
not dword [esp]
dec word [esp + 5]
mov eax, dword [esp + 4]
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ecx
mov dword [ebp], edx
mov ebx, 0xf48df135
movzx ecx, ax
mov ebx, dword [esp + ecx*2 - 0x1fdf4]
shr eax, cl
mov dword [esp + eax*2 + 2], 0x621f39c
jne 0xa071f1
xor eax, ebx
shr cx, 0x23
pop edx
ror eax, 2
lea eax, [eax + edx + 0x2713038c]
or edx, dword [esp + ecx*8 - 0xfef4]
rol edx, cl
sub edx, 0xf2bd54af
ror eax, 2
xchg ecx, edx
xor eax, 0x87b6510f
xor ebx, eax
bts edx, 0x39
xchg word [esp + 3], cx
adc esi, eax
movsx eax, dl
pop edx
pop eax
jmp fcn.00a28822
lea edi, [edi + eax*2 - 0xa]
mov edx, dword [esp + eax]
rol eax, 1
mov eax, dword [edi + eax*4 - 0x18]
bt edx, 0x15
jb 0x9f710c
mov edx, 0x86925c2a
rdtsc
mov ecx, 0x6036b0be
inc ecx
lea ebp, [ebp + ecx - 0x6036b0c7]
ror ecx, cl
xor cx, 0x2f90
mov dword [ebp + 4], eax
movsx eax, cl
mov dword [ebp], edx
add cl, ch
sbb edi, 3
mov ecx, dword [edi]
movsx edx, ax
xor ecx, ebx
shr al, 0xe4
inc edx
not ecx
je 0xa306e3
bt eax, eax
btc edx, edx
dec ecx
add eax, edx
and edx, eax
bswap ecx
push edx
dec ecx
shr dword [esp], 0x9f
rol dword [esp], 0x50
xor ebx, ecx
sal word [esp + 1], 0xa4
dec eax
setb byte [esp + 1]
adc esi, ecx
mov ecx, 0xf686f583
pop edx
jmp fcn.00a28822
bswap ecx
jb 0x988a44
Function at 0x9705ff
Capabilities:
Encode data using xor

Disassembly:
rol edx, 2
inc ecx
bts eax, 7
pop ecx
dec edx
rol edx, 2
mov ecx, eax
xor edx, 0xe78ba03d
neg edx
pop eax
lea ecx, [eax + eax*4 + 0x67bc0329]
rol ax, 0xcd
xor ebx, edx
push ecx
not eax
call fcn.009bcceb
lea edx, [eax*2 + 0x1083bd10]
lea edi, [eax + edi - 0x1cd32f7]
shr ax, 0xa1
shl dl, 0x63
sub dl, al
xor cl, bl
sub eax, 0x308eee0c
setbe dl
ror cl, 1
cbw
xadd edx, eax
cdq
neg cl
add cl, 0xa2
sar eax, 0x46
sbb dx, 0x2b88
rol cl, 1
btc eax, 0x1f
xor bl, cl
bt ax, ax
xor edx, 0xac27c59d
adc ecx, esp
mov eax, dword [ecx]
push edx
xor byte [esp], dh
movzx ecx, byte [esp]
mov dword [ebp + ecx*2 - 0x1ec], eax
inc ecx
inc dword [esp + ecx - 0xf5]
mov ecx, dword [ecx + ebp - 0xf9]
sar dword [esp], 0x9c
pop eax
mov edx, dword [ecx]
lea eax, [eax + eax - 0x30570546]
movzx ecx, ax
mov dword [ecx + ebp - 0xfab2], edx
cbw
btc eax, 0x8a
lea ebp, [ebp + ecx*4 - 0x3eabc]
jae 0x982118
cdq
sub eax, 0xf423ac32
jle fcn.0094787b
bt ecx, 0x18
neg byte [esp + ecx*4 - 0x5af57a07]
mov ecx, dword [ecx + ebp - 0x16bd5e7e]
adc ebp, 3
mov edx, dword [esp]
not eax
mov word [esp + edx*2 - 0x2d7b4504], dx
or edx, edx
jg 0xdc56d9
not ecx
add edx, 0x5e3e6e86
and eax, ecx
jmp 0xd9e3e5

Function at 0x972fae
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + 4]
neg cl
sbb cl, cl
jne 0x8a8607
mov cl, byte [ebp + 8]
call fcn.008e229c
mov eax, 0xa4956922
inc ebp
mov ecx, dword [edi]
movsx edi, al
dec ebp
lea edi, [edi + edi*4 - 0x84]
inc esp
movzx ebp, al
inc ecx
mov edx, ebp
dec eax
ror edx, 6
inc esp
xor ecx, esi
inc ecx
inc ecx
dec ecx
lea ecx, [ebp + edi + 0x4e9de8b9]
dec esp
lea esi, [edi*8 + 0x6e965780]
inc esp
movsx edx, al
inc ecx
rol ecx, 1
inc esp
movsx eax, al
inc ecx
sub ecx, 0xd78cf131
inc esp
movsx esp, cl
ror ax, 0xe6
inc ecx
not ecx
adc cx, ax
inc ebp
xadd ah, dh
inc ecx
xor ecx, 0x4780ed98
inc ecx
not dh
inc ecx
sub edi, edx
push esi
inc ebp
add eax, esp
jne 0xa3babe
shl dword [edx + 0x61], 0x24
in eax, dx
inc edi
outsb dx, byte [esi]
pop edx
adc eax, 0xefa73ede
das
cwde
pop eax
movzx eax, word [ecx + edi - 0x3497cf8f]
xor ax, bx
and dword [esp + ecx - 0x3497cf87], ecx
btc ecx, 1
sbb ax, 0x8e25
dec byte [esp + ecx*2 - 0x692f9f09]
xor dword [esp + ecx*2 - 0x692f9f0a], ecx
rol dword [esp + ecx - 0x3497cf85], cl
ror ax, 1
call fcn.00a12593
mov edx, 0x270eb88e
mov edx, dword [edx + ebp - 0x270eb88e]
mov ecx, 0xa69a62b1
xor cx, 0xcf29
jnp 0x8a1764
not cl
setnp cl
dec ecx
add edx, ebx
jmp edx
Function at 0x977e57
Capabilities:
Encode data using base64

Disassembly:
bt dx, cx
rol dword [esp + edx - 0x78961d2e], cl
inc eax
inc edx
call fcn.00e00657
inc ecx
mov eax, 0x93ca208
inc ebp
movsx esi, al
inc ebp
mov esp, esi
dec esp
mov esp, ebx
inc ecx
movzx edi, al
dec ecx
sub ebx, esi
dec ebp
lea ebp, [eax + 0x41269831]
dec esi
mov dword [ebx + eax - 0x93ca208], esp
inc ecx
ror al, 0xe4
inc eax
movzx eax, bh
inc ebx
mov edi, dword [edi + eax - 0x93ca280]
dec eax
cdq
dec edi
lea edi, [eax + edi - 0x93ca27c]
ror dx, 0x2b
inc ebp
movsx edx, ax
xor edi, esi
inc cx
or edx, ebp
ror edi, 2
sar ax, 0x2b
inc ecx
ror eax, 0xef
inc edi
xor edi, 0x3987a595
inc ebp
mov esp, esi
dec edi
dec ecx
bswap esi
inc ecx
rol al, 0xc6
jb 0xdfc13b
push esi
inc edx
xor dword [esp + eax - 0x4500125e], edi
pop esi
dec ebp
xadd esp, ebp
inc ecx
movzx ebp, ch
inc cx
sar eax, 0x4d
dec eax
arpl di, di
jne 0xe051a9
dec esp
add ebx, edi
inc ecx
xchg esp, eax
inc cx
rol esp, 0x8b
jae fcn.00a14fd9
fidiv dword [edi + ecx*2 + 0x20]
call 0x4f7f878
salc
bt ebp, esi
inc eax
and dl, dh
and byte [ecx - 0x43], al
aaa
jmp 0x977f57
sub ch, byte [ebx]
inc ebx
sal eax, 0xc4
not edx
jp 0x9f5fb6
movzx ecx, ax
adc al, ch
mov dword [eax + ebp - 0x3a32c262], edx
jmp esi
call fcn.0096621d
inc ecx
push ecx
dec esi
mov ebp, dword [ebx + eax*4 - 0x190]
inc edx
setns byte [esp + eax*2 - 0xc8]
inc ecx
movzx ebp, cx
inc edx
mov cl, byte [ebx + eax - 0x56]
inc ecx
pop eax
inc ecx
mov edx, 0x141a6203
dec eax
lea ebx, [ebx + ebp - 0x885c]
dec ebp
shld esp, ebp, cl
call fcn.00983d25
cwde
call fcn.009820ec
Function at 0x97bce3
Capabilities:
Encode data using base64

Disassembly:
ror edx, 1
sub edx, 0x71011dbf
xor edx, 0x6f3bcc04
xchg ecx, eax
ror edx, 1
and al, 0xbd
sete cl
sar eax, 0x83
sbb edx, 0xb98672a1
pop ecx
rol word [esp + 2], 0xa4
bswap edx
xor ebx, edx
xchg dword [esp + 8], eax
add esi, edx
pop eax
neg word [esp + 6]
pop ecx
pop ecx
jge fcn.008e0841
jnp 0x9950e8
sub ebp, 8
push 0x6cb42206
jmp 0xd90866
mov edx, 0x129eb339
lea edi, [edi + edx*4 - 0x4a7acce8]
push edx
shl edx, 0xc8
and dl, byte [esp + 2]
mov edx, dword [edi]
xor edx, ebx
sal word [esp], 0xa1
push 0x27b5b529
rol edx, 1
jmp 0xa2e031
dec edx
mov ecx, dword [esp + 4]
rol edx, 1
lea edx, [ecx + edx + 0x4afb1716]
rol cl, 5
movzx eax, cl
ror edx, 1
neg edx
inc ecx
dec cx
not edx
xor ebx, edx
add esi, edx
sar cx, cl
neg dword [esp + eax - 0x4d]
inc byte [esp + ecx - 0x129dfffc]
mov al, byte [ebp + ecx - 0x129e0001]
inc dword [esp + ecx*2 - 0x253bfffe]
mov edx, ecx
push ecx
mov dl, byte [ebp + ecx - 0x129dffff]
bts ecx, 0x15
sub cx, cx
lea ebp, [ebp + ecx*4 - 0x4af7fffe]
seto byte [esp + ecx*4 - 0x4af7fff8]
ror ecx, 0xe9
sal ecx, 0xd3
not al
call fcn.00d98312
lea eax, [ecx*8 + 0x458e2d86]
not edx
ror eax, 0xf
xor ebx, edx
or ecx, eax
rol dword [esp + eax - 0x5b0c8b1c], 0x94
adc esi, edx
cbw
neg word [esp + eax - 0x5b0c001c]
bt ax, 0x1a
mov dword [esp + eax - 0x5b0c001c], esi
ret
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
mov dword [eax + ebp - 0x6cb421fe], ebx
mov dword [ebp + eax - 0x6cb42202], ecx
mov dword [ebp + eax - 0x6cb42206], edx
lea ecx, [eax + eax*2 - 0x636f335a]
mov ebx, dword [esp + eax - 0x6cb421fa]
mov dword [esp + eax - 0x6cb421fa], ecx
sar cl, 0x22
mov edx, dword [edi + eax - 0x6cb42206]
mov dword [esp + eax - 0x6cb42202], eax
lea edi, [edi + eax - 0x6cb42202]
ror eax, cl
xor edx, ebx
xadd dword [esp], eax
lea edx, [ecx + edx - 0x8efa45a]
add cx, word [esp + eax - 0x6cb421f9]
jl 0x953856
mov edx, 0x493aeea0
lea edi, [edi + edx - 0x493aeea4]
movsx eax, dl
mov edx, dword [edx + edi - 0x493aeea0]
ror ax, 0x4d
xor edx, ebx
inc edx
inc eax
sar eax, 0x8a
call fcn.00df8446
call fcn.00a4b4e3
Function at 0x97ff1c
Capabilities:
Encode data using base64

Disassembly:
push ecx
dec eax
rol edx, 1
btc ax, 8
inc dword [esp + ecx - 0x40b0a07]
btc ecx, ecx
xor edx, 0xc2ade405
not dword [esp + eax*2 - 0x160b]
not edx
dec edx
call fcn.0097bc32
inc ecx
jmp 0xf95c9f5b
inc edx
inc byte [esp + eax*2 - 0x1b8f4]
inc ecx
xor dh, ch
dec esi
lea ebp, [esp + ebp + 0x18]
inc cx
sub ecx, esp
dec eax
mov dword [esp + edx], 0xf432db1b
not byte [esp + edx + 7]
inc edx
mov dword [edx + ebp], eax
jno 0xa44d28
mov dword [esp + 4], eax
sub dl, 0x8a
movzx ecx, al
ror cl, 0xa7
xor dl, 0x34
push eax
rol dl, 1
xor bl, dl
pop ecx
neg cl
sbb cl, al
lea edx, [esp + edx + 8]
push eax
inc eax
movzx cx, byte [edx]
add dword [esp + 4], eax
sbb ebp, 1
movsx edx, byte [esp + 2]
inc dl
mov word [ebp], cx
btr eax, eax
pop edx
pop edx
pop eax
jb fcn.0094787b
mov ecx, 0x410f459c
mov ecx, dword [ebp + ecx - 0x410f459c]
mov edx, 0xaf828728
movzx eax, byte [edi]
sar edx, 0x57
xor al, bl
ror al, 1
add al, 0x1e
or edx, edx
rol al, 1
dec al
not al
push edx
add word [esp], dx
neg dx
xor bl, al
shl dx, 0xe3
not dx
ja 0xdbf15d
mov ecx, 0x40b0a07
mov edx, ecx
push ecx
mov edx, dword [edi + ecx - 0x40b0a0b]
movsx eax, cx
xor edx, ebx
jmp 0x8d24aa
jmp ecx
dec eax
ror ebp, cl
dec ecx
mov ecx, dword [edi + edx*8 + 6]
adc word [esp + edx*8 + 0xa], 0x8938
inc ebp
sbb dh, al
dec ebp
lea edi, [edi + edx + 0xe]
jae 0xdf9556
mov edx, 0xb420fe12
btc edx, edx
pop eax
pop ecx
jmp esi
inc ebp
movzx esp, ch
inc esi
xchg byte [esp + ebp*4 - 0x24f90443], ch
inc cx
inc eax
inc edx
not byte [esp + ebp*2 - 0x127c827e]
inc si
add ebp, dword [esp + ebp*8 - 0x49f20a06]
inc cx
ror eax, 1
call fcn.00e13980
lea eax, [esp + eax + 4]
jp 0xa423cb
call fcn.00da3852
mov eax, 0x672d382c
dec eax
lea ecx, [eax + eax*2 + 0xd3ac]
lea edi, [eax + edi - 0x672d382f]
push eax
mov ecx, dword [edi + ecx*2 - 0x6b10f85a]
xor ecx, ebx
cwde
lea edx, [eax + eax*8 - 0x5bf9fa58]
lea ecx, [eax + ecx + 0x7b07ef91]
ror ecx, 2
or al, byte [esp + eax*8 - 0x1c158]
bts dx, ax
xor ecx, 0x73263194
sal byte [esp + eax*4 - 0xe0ac], 4
inc ecx
xor eax, 0xc6002628
sal dl, 0xc6
ror ecx, 1
cwde
cwde
xor dword [esp + eax - 0x1e03], 0xdc1b9f1f
bswap ecx
xor ebx, ecx
sar edx, 0x22
sar dword [esp + eax - 0x1e03], 0x29
add esi, ecx
lea ecx, [eax + edx*2 + 0x17077f3d]
lea edi, [edi + eax - 0x1e04]
sal edx, 0xc3
dec edx
or ecx, 0x8d001336
movzx edx, byte [edi + eax - 0x1e03]
shr ecx, cl
xor dl, bl
ror ax, 0x28
sbb byte [esp + eax*2 - 0x63b], ah
adc dl, 8
sub al, 0xb4
neg dl
ror eax, 0x4b
call fcn.00da678a
inc ecx
movzx eax, dh
dec eax
or dword [esp + edx*2 + 9], edx
dec eax
xor ecx, esi
inc ecx
shr ecx, 0x59
inc ecx
btr esi, 0x85
dec eax
bswap ecx
dec eax
not ecx
jb 0xdbdf5a
dec eax
xor ecx, 0x1f01c8bf
call fcn.008d2c8b
Function at 0x990164
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebp + eax - 0x5c12e5b6]
lea edx, [eax*2 - 0x6159fc4b]
sar eax, 0xae
not dx
mov eax, dword [eax + ecx - 0x1704b]
mov dword [ebp + edx - 0x56cb30d2], eax
seta dl
inc dword [esp + edx - 0x56cb3000]
lea edx, [edx - 0x526d244d]
lea ebp, [ebp + edx - 0x45e0baf]
shl dword [esp + edx - 0x45e0bb3], 0x10
shr dword [esp + edx*2 - 0x8bc1766], 0xb5
mov dword [esp + edx - 0x45e0bb3], esi
ret
xor cl, 0x10
mov dword [esp], edx
lea eax, [edx + edx*8 - 0x5444a4ee]
or eax, 0xa1aa3021
not cl
sbb ax, word [esp + 2]
adc eax, dword [esp]
and al, 0
xor bl, cl
inc eax
lea ecx, [esp + ecx + 4]
mov edx, dword [ecx]
mov ecx, dword [esp]
rol ax, 0x27
lea eax, [eax*4 - 0x27ddc342]
mov dword [eax + ebp - 0x5acdd40e], edx
sub eax, dword [esp + eax - 0x5acdd412]
adc dword [esp + eax - 0x5c12e5ba], eax
jbe 0x96281e
lds esi, [ecx + 0x3c]
cmp dword [ebp - 0x22], 0x4ac6fb78
out 0xa8, eax
jnp 0x990201
push dword [esi - 0x4e]
sbb byte [ebx + 0x3d], bh
mov dl, 0x18
jnp 0x990207
push dword [edi + 0x727b40f8]
lodsb al, byte [esi]
fsubr qword [eax + 0x675f3144]
mov dword [edi - 0x11], ebx
jge 0x990180
test dword [ebp + 0x4d85a853], ecx
push ebp
mov al, byte [0x73048498]
mov eax, ss
insd dword es:[edi], dx
fadd qword [ebx]
invalid
mov ebx, 0x868796ba
mov esp, dword [ebp - 0x2ae0c07a]
psrlq mm3, qword [ecx - 0x2f]
movsd dword es:[edi], dword [esi]
xchg byte [edi], bh
pop ds
aad 0xf
rcr dword [ecx - 0x2f], cl
mov eax, 0xf0a7a57e
pop ebp
je 0x9901c6
aaa
invalid

Function at 0x9946ab
Capabilities:
Encode data using base64

Disassembly:
dec edx
or edx, dword [edx + ecx]
inc bp
sub esp, eax
dec eax
mov dword [ebp + ebx - 6], edx
dec esp
mov dword [esp + ebp], ebp
dec eax
lea ebx, [ebx + ebp - 6]
inc ecx
inc eax
dec eax
sbb dword [esp + ebp*8], 0x7823d32a
inc bp
bts eax, ebp
inc ecx
pop eax
jae fcn.00a14fd9
Function at 0x9946d9
Capabilities:
Encode data using base64

Disassembly:
not eax
xor eax, 0xf5076f10
bswap eax
shl word [esp + ecx - 0x3bca], cl
xor eax, 0xc33e4d20
xadd cl, dh
xor ebx, eax
shl dx, cl
ror ecx, cl
adc esi, eax
lea eax, [ecx*8 + 0x2182a1a8]
shl dword [esp + eax - 0x6182b068], cl
shr ecx, cl
movzx eax, word [edi + ecx - 0x24]
shr cx, cl
lea edi, [edi + ecx + 6]
and dx, cx
pop edx
xor ax, bx
sal ecx, 0xc1
or dx, 0xf11
neg ecx
neg ax
bswap edx
btr edx, ecx
rol ax, 1
push ecx
not ax
sal dword [esp + edx - 0x110f0000], 0x8c
shl dword [esp + edx - 0x110f0000], 0x41
btc ecx, 1
sbb ax, 0x9a3f
xor dword [esp + edx - 0x110f0000], edx
xadd dword [esp + edx - 0x110f0000], edx
shl edx, cl
xor bx, ax
sal dword [esp + ecx - 2], cl
dec cx
xadd dword [esp + ecx - 1], edx
mov word [ebp + ecx*2 - 4], ax
lea ebp, [ebp + ecx - 3]
movsx eax, cx
lea edx, [ecx*2 + 0x62ac2608]
pop ecx
ja fcn.008e0841
dec esp
or esi, ecx
dec ebp
adc ebx, eax
dec esp
lea eax, [eax - 0x4cdd70e3]
cwd
dec eax
btr ecx, edi
inc esp
mov ebp, dword [ebx + edx*8]
dec eax
lea ecx, [eax*4 + 0x2f2550a9]
jae 0x8b9616
mov eax, dword [ebx + edx*2 + 4]
inc ecx
rol esp, cl
inc eax
sub dl, ch
inc esp
or ebp, eax
inc ebp
or al, al
inc ecx
not ebp
inc esp
bts ecx, eax
push edi
inc esp
mov dword [ebx + edx*8 - 0x6ac], ebp
dec eax
xor dword [esp + edx - 0xd6], 0x127d9b4
dec eax
or dword [esp + edx*4 - 0x358], edi
dec esp
lea eax, [esp + edx + 0x62]
dec ebp
cmovle edx, esi
jbe 0x9acb95
inc ecx
mov ecx, 0xb6abe797
inc ecx
mov ebp, dword [eax + edx*2 - 0x1ac]
mov dword [ebx + edx - 0xd6], ebp
and dword [esp + edx*4 - 0x358], edi
dec esp
mov dword [esp + edx - 0xd6], ebx
ret
mov dword [esp], edx
mov dword [ebp], eax
mov eax, 0x3804aba9
mov eax, dword [edi + eax*2 - 0x70095752]
xor eax, ebx
movsx ecx, dx
not eax
dec eax
jmp 0x893c21
inc esp
movsx esi, di
inc cx
adc edx, eax
adc ax, 0x8538
inc esp
mov edx, ecx
inc ecx
xchg esi, edi
jmp 0xdd977f
neg ax
dec eax
bswap ebp
inc ecx
shr ebp, cl
xor si, ax
inc ecx
and esi, 0xa6189ca0
dec ecx
sal ebp, 0x70
dec eax
lea ebx, [edi + ebx + 0x60e24dbc]
setns byte [esp + edi + 0x60e24dc1]
jae 0xa50165
xor ax, 0xc610
inc bp
btc esi, esi
dec ebp
lea esi, [ecx + ecx*8 - 0x20612e46]
inc esp
add edx, ecx
inc ax
dec ecx
and esi, 0xaa116e0f
inc ecx
push eax
dec eax
lea edi, [edi*8 - 0x60e2ab60]
xor ax, 0x83bb
jmp 0xd83391

Function at 0x99801f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x5dec6cd7
call fcn.00da2058
Function at 0x9ad866
Capabilities:
Encode data using base64

Disassembly:
xor dword [esp + ebp*2 - 0xfbf2], edx
dec eax
mov esi, dword [esp + ebp*4 - 0x1f7ec]
dec esp
mov dword [esp + ebp - 0x7dfd], esi
dec eax
arpl dx, dx
dec eax
mov dword [esp + ebp*4 - 0x1f7ec], 0xa231ad92
dec ebp
lea eax, [esp + eax - 0x3d4e864]
dec esp
add ebx, edx
mov byte [esp + ebp - 0x7df6], 0x3f
inc ebp
movzx eax, byte [edi + ebp - 0x7dfd]
dec ebp
lea edi, [edi + ebp*2 - 0xfbf9]
dec eax
and ebp, dword [esp + ebp*4 - 0x1f7ec]
inc ecx
sar dl, 0xc5
inc esp
xor al, dh
or al, byte [esp + ebp - 0x2d86]
inc ecx
push ecx
dec eax
not dword [esp + ebp*2 - 0x5b1d]
inc ecx
inc al
dec edx
lea edi, [ebp - 0x1dd74cf1]
inc ecx
rol ebp, 0x95
inc ecx
neg al
or dword [esp + ebp - 0x2d7c], 0x77aff8bd
shr byte [esp + ebp*2 - 0x5b1f], 0xa2
inc ebp
adc al, dl
inc ecx
ror al, 1
dec eax
lea edx, [ebp*4 - 0x73fbda76]
inc ecx
xor dh, al
dec eax
lea ebp, [ebp + edi*4 - 0x2d4c19ee]
dec eax
lea ebx, [ebx + edx + 0x73fb2432]
dec ebx
lea ecx, [esi + ebp*2 + 0x1f832525]
inc esp
mov dword [ebx + edx + 0x73fb2436], eax
dec ecx
ror edx, cl
push edi
pop edx
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop ebp
jae fcn.00a14fd9

Function at 0x9aed4e
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop esi
pop edi
jle fcn.00a14fd9

Function at 0x9b4e5c
Capabilities:
Encode data using xor

Disassembly:
stc
cmp dword [ecx], ecx
add bh, dh
not eax
invalid
test byte [edx + ebx*2], dl
not eax
mov dword [esp + edx - 0xa6], 0x65855781
xor ecx, 0x9234972f
shl edx, cl
xor ebx, eax
shr dword [esp + edx - 0x52d], 0x3b
adc cl, 0xc
ror ecx, cl
adc esi, eax
movzx cx, byte [ebp + edx*8 - 0x2980]
mov eax, 0x3f18fc04
not dword [esp + edx - 0x52c]
cdq
invalid
mov al, byte [edx + ebp + 2]
lea ebp, [ebp + edx*8 + 2]
add edx, 0xba853413
not cl
call fcn.00a4055a
shl edx, 0xfb
inc edi
mov esi, dword [edi + ecx - 0x42080000]
dec eax
rol eax, 3
mov ah, 0xf
add byte [eax], al
clc
mov ebp, 0x3c0c148
call fcn.0089625d
xor eax, 0x91c1a3e0
lahf
in eax, 0xc4
push 0x5e
jno 0x9b4eb2
sets byte [edx + 0x5e]
jno 0x9b4e58
lds edi, [eax + 0x57715e6a]
lahf
pop esi
jl 0x9b4e98
adc dword [ecx - 0x6f], edx
je 0x9b4e62
xchg edx, eax
fsincos
sub eax, 0xdd1a0a55
lodsb al, byte [esi]
rol ch, 1
pop eax
lcall 0x3013, 0x5470b53d
movsb byte es:[edi], byte [esi]
mov cl, 0xb9
add dword [edi + esi + 0xf], ebp
mov esp, 0x6c01dd85
aaa
popal
loopne 0x9b4f2e
xchg edx, eax
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
dec eax
lahf
mov ebp, dword [ebx]
insd dword es:[edi], dx
dec byte [esp + edi*8 - 0x3d]
invalid
das
xchg ebp, eax
loope 0x9b4f82
invalid
rol byte [ebx], 1
sbb dword [ebx], edi
and dword [esp + esi*2 - 0x30], 0x301119d7
test dword [esi - 0x5291bd00], eax
cwde
retf