joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7a8c4e45
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x257e25a4
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40b106
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [0x44b0ec]
mov esi, eax
test esi, esi
jne 0x40b15a
call dword [0x44b0e8]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
push edi
push 0x140
push 0x44edd4
call fcn.004037d3
push 0x44f1cc
push edi
call fcn.0044012f
pop ecx
pop ecx
jmp 0x40b2a7
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x40b183
mov esi, 0x8007000d
push esi
push 0x14a
push 0x44edd4
mov edi, esi
call fcn.004037d3
push 0x44ee50
push esi
jmp 0x40b14e
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
je 0x40b1ad
mov esi, 0x8007000d
push esi
push 0x155
push 0x44edd4
mov edi, esi
call fcn.004037d3
push 0x44eec0
jmp 0x40b180
movzx eax, word [ecx + esi + 0x14]
push ebx
add eax, ecx
lea ebx, [esi + 0x18]
push 8
add ebx, eax
push 0x44efe4
push ebx
call fcn.0042f919
add esp, 0xc
test eax, eax
je 0x40b1f2
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 6]
xor eax, eax
inc eax
cmp eax, ecx
jae 0x40b219
add ebx, 0x28
inc eax
cmp dword [ebx], 0x7869772e
jne 0x40b1d9
cmp dword [ebx + 4], 0x6e727562
jne 0x40b1d9
cmp dword [ebx + 0x10], 0x34
jae 0x40b237
mov esi, 0x8007000d
push esi
push 0x17a
push 0x44edd4
mov edi, esi
call fcn.004037d3
push dword [ebx + 0x10]
push 0x44f010
jmp 0x40b261
mov esi, 0x8007000d
push esi
push 0x16e
push 0x44edd4
mov edi, esi
call fcn.004037d3
push 0x44eff0
jmp 0x40b29e
mov ebx, dword [ebx + 0xc]
add ebx, esi
cmp dword [ebx + 4], 2
je 0x40b26c
mov esi, 0x8007000d
push esi
push 0x184
push 0x44edd4
mov edi, esi
call fcn.004037d3
push dword [ebx + 4]
push 0x44f0b4
push esi
call fcn.0044012f
add esp, 0xc
jmp 0x40b2a6
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4 + 8]
jne 0x40b282
inc ecx
cmp ecx, 4
jne 0x40b271
jmp 0x40b2a6
mov esi, 0x8007000d
push esi
push 0x18a
push 0x44edd4
mov edi, esi
call fcn.004037d3
push 0x44f1f4
push esi
call fcn.0044012f
pop ecx
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x416310
Capabilities:
Encode data using xor

Disassembly:
sar byte [ebp + 0x17], 1
jge 0x41632a
mov ebx, dword [eax + 3]
jbe 0x416311
nop
jnp 0x416397
sub eax, dword [ecx + 0x63]
movsb byte es:[edi], byte [esi]
inc ecx
dec eax
xchg edx, eax
jp 0x41638f
dec edx
and al, 0xb
rcl byte [ebp + 0xc], 3
or al, 3
mov ah, 0xf6
add al, 0x19
xor ah, byte [esi - 0x1a85987c]
sbb eax, 0xcb956722
ret 0x2f51
out dx, eax
dec ebx
ror ebx, 1
ret 0x8227
mov dword [0x6508d180], eax
pop ds
add al, 0x24
push ebp
inc edx
idiv byte [eax + 0x6603854f]
cmp eax, 0x183f4bfd
in eax, dx
shr al, 1
pushal
xor byte [eax - 0x34], ah
cmp byte [ebx + ebp], ah
fcom dword [ecx]
xchg ecx, eax
pop eax
jne 0x4163ad
push ds
rcr byte [edi - 0x6444338b], 0xca
xchg esp, eax
popal
mov bh, 0x17
sub al, 0x2d
or ah, byte [edi]
invalid
Function at 0x708687
Capabilities:
Encode data using base64

Disassembly:
mov dx, word [ebp + edx*2 - 0xbec587c]
btr ecx, 0x8d
movsx eax, cl
mov dword [esp + ecx], 0x14b55c82
or cl, byte [ebp + ecx + 2]
lea ebp, [eax + ebp + 2]
shl dx, cl
inc eax
mov dword [esp + eax*8], 0xcc08a23e
mov dword [esp + eax*2 + 2], eax
mov word [ebp + eax - 1], dx
jno 0xb1366c
movsx edx, ax
setg al
mov dword [esp + eax - 1], edi
ret 8

Function at 0x7091be
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0xc034fd37
dec ecx
add edx, 8
dec eax
mov dword [esp + 8], 0xf725d2b0
sub word [esp + 7], 0xbf2a
dec eax
mov dword [esp + 8], ecx
push dword [esp + 8]
popfd
mov ecx, dword [ebp]
dec eax
mov dword [esp + 8], 0x2935cc35
dec eax
add ebp, 4
inc ecx
mov ebp, 0x131f0e32
call fcn.00b77141
mov ecx, 0x63848b9f
movsx edx, cx
mov edx, dword [ecx + ebp - 0x63848b9f]
mov cl, byte [ebp + ecx - 0x63848b9b]
mov eax, 0xca861908
or al, al
push eax
adc ebp, 6
mov byte [edx], cl
lea edx, [eax*2 + 0x6da0960b]
sub word [esp + edx - 0x2acc819], dx
lea esi, [esi + edx*2 - 0x559903a]
mov ecx, dword [esi + edx*2 - 0x5599036]
pop edx
jns 0xb51067
cmovns edx, eax
xor ecx, ebx
bswap ecx
not ecx
ror edx, 0xe3
shr dl, 0x66
cdq
sub ecx, edx
add ax, 0x3fb7
sal eax, 0xfe
ror ecx, 1
xadd al, ah
or eax, eax
xor ecx, edx
btr eax, 0xc
dec eax
dec edx
xor ebx, ecx
not ax
add edi, ecx
mov ecx, 0x79bf8d81
jmp edi
Function at 0x70e852
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp + edx - 0x6dab239d]
mov ecx, 0x40bd3c93
pop ecx
mov cl, byte [ebp + 8]
jmp 0x9800e5
jmp 0x9dc5ca
call fcn.00c1bf54
add edx, ecx
mov esp, 0x4134c353
xor al, 0x41
sbb al, 0xac
push ebx
mov bh, 0xd4
push ecx
sbb al, 0xac
push ebx
xor edi, dword [eax + 0x53ac1c5d]
mov eax, 0x53ac1c5d
mov ecx, ds
pop ecx
and ebp, edi
out dx, al
xchg edx, eax
push edx
or al, 0xa8
inc edi
lodsb al, byte [esi]
outsb dx, byte [esi]
in al, dx
mov ecx, 0x28c11004
fbstp tbyte [eax + 0x7b5d664b]
and byte [ebx + 0x3b40f78a], bh
js 0x9dc5d5
xchg edx, eax
and dword [ebx + edi + 0x78], 0xffffffce
mov dh, 0x8f
jo 0x9dc64c
js 0x9dc5e1
mov byte [0x77478bff], al
push ss
ret 0xbd9c
lahf
push 0x73
lodsd eax, dword [esi]
push ebx
fst dword [edi]
add dh, byte [ebx - 0x53]
push ebx
xchg ebp, eax
dec edi
push 0x73
lodsd eax, dword [esi]
push ebx
adc dword [ebx - 0x7e0dd72e], ecx
xchg ebx, eax
push edx
add eax, edi
inc esi
lodsb al, byte [esi]
pop ebp
rcl esi, cl
add eax, 0xe8a92810
wait
sub ah, bh
dec esp
jnp 0x9dc669
mov ebx, 0x3b2dfa9b
js 0x9dc61e
sub eax, 0xffce783b
out dx, al
inc ecx
cmp edi, dword [eax - 0x32]
xchg ebx, eax
scasb al, byte es:[edi]
adc dword [ebx], edi
js 0x9dc62a
invalid
ret
mov bh, 0xb
push ebx
mov bh, 0xb
push ebx
js 0x9dc67f
into
mov bh, 0xb
push ebx
xlatb
xchg dword [esi], ecx
mov bh, byte [edx + 0x45]
xor eax, 0xcd3bbc52
std
mov al, 0x89
mov bl, 0x10
jb 0x9dc69d
push edx
mov esp, 0xb0fdcd3b
mov dword [ebx + 0x12726710], esi
ljmp 0x646:0xff55fb8f
xor al, dl
imul eax, dword [eax - 0x37], 0x12
js 0x9dc636
push edi
salc
fmul qword [ecx + 0x27]
xor byte [ebx + 0x277e2fb], bl
test eax, 0x7c78cfe8
test ah, cl
jle 0x9dc6dd
invalid
mov ecx, 0x3e9a4030
sub al, 0x81
add esi, dword [eax]
lds edi, [0x20de034f]
cmpsd dword [esi], dword es:[edi]
mov byte [0x2e7c709c], al
loope 0x9dc68b
stc
dec esi
or byte [eax], al
rcl word [edx - 0x20962bdc], 2
fst dword [edi]
pop esp
sbb byte [eax + 0x36], 0x2f
jne 0x9dc6d7
mov ecx, 0xadbf67ce
or eax, ecx
call 0x269496ac
xor dword [esi], 0x34
sub eax, 0x8e30f7f4
inc ebp
mov ecx, edi
stosd dword es:[edi], eax
salc
jecxz 0x9dc73b
xchg byte [esi - 0x4e], dl
pushfd
add cl, byte [ecx + 0x79b51e98]
test eax, 0xa2e8324d
invalid
nop
sal al, cl
cld
ror al, 0x97
cmp dword [ecx + 0x238186f], ebx
leave
aas
aaa
add byte [ecx + 0x2a805348], dh
int1
mov edi, 0xed77e97b
rcl byte [edx - 0x55ce9d55], 0x31
jmp 0x9dc7bb
sbb al, al
scasd eax, dword es:[edi]
ljmp 0xacbf

Function at 0x71186a
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov dword [esp + 0xc], 0x86df2a24
lea esp, [esp + 0xc]
call fcn.00b7c3dc
Function at 0x9515b5
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xb23aeb5
add ebp, 6
or word [esp], 0xfe83
shl dword [esp], 0x12
push 0xe2a54d2f
shld edx, eax, cl
mov eax, dword [esp + 4]
rol byte [esp + 7], 0xc5
adc ax, 0x6683
mov dword [ebp], edx
shr eax, 0x4d
mov edx, dword [esi + eax*4 - 0x1f5b8c]
lea ecx, [eax*4 + 0x3c3aecb2]
adc byte [esp + eax - 0x7d6dc], 0x8c
lea esi, [esi + eax - 0x7d6df]
and cx, 0x1f39
xor edx, ebx
shr cl, 0x45
jp 0xc5bbd3
jnp 0xbe2b77
jmp 0xa542c4
jmp 0xabe637
mov edx, 0x3295f11c
movzx dx, byte [ebp + edx*2 - 0x652be238]
mov eax, 0xf6044e96
mov al, byte [ebp + 2]
mov ecx, 0xaaa4931
not dl
shl cl, 0xc1
not al
and dl, al
btr ecx, 0xbf
adc cx, 0x7487
mov word [ebp + ecx*4 - 0x2aaaf7a2], dx
mov eax, dword [ebp + ecx*2 - 0x15557bd0]
imul cx, cx
shl cx, 0x65
mov edx, ecx
mov cl, byte [edx + ebp - 0xaaac21a]
sal eax, cl
push edx
and edx, dword [esp + edx*2 - 0x15558440]
mov dword [edx + ebp - 0xaaac21c], eax
lea ebp, [edx + ebp - 0xaaac21c]
mov eax, 0x2333b836
shl eax, 0x2d
sub byte [esp + eax - 0x7706bfff], dl
mov edx, dword [edi + edx*2 - 0x15558444]
shr dword [esp + eax - 0x7706c000], 0x7b
movsx ecx, al
lea edi, [eax + edi - 0x7706c004]
and dword [esp + eax - 0x7706c000], eax
xor edx, ebx
shl ax, 0xa9
rol ecx, 0x2f
sbb cx, ax
rol edx, 1
pop eax
and cl, 0x14
jns 0x9c567c
ror edx, cl
and cx, cx
lea edx, [edx + eax*2 + 0xbffe042]
ror edx, cl
dec edx
not eax
sal al, cl
not edx
adc byte [esp + ecx - 0x3c5a07fc], 0x19
xadd byte [esp + ecx - 0x3c5a0800], al
dec edx
inc cx
bswap edx
not al
rol ax, cl
bts ax, 0xad
xor ebx, edx
add edi, edx
sal ecx, 0xe1
mov dword [esp + ecx - 0x78b41004], edi
ret 4
Function at 0x95d112
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esp + 3]
add cl, al
movsx eax, dx
mov word [ebp + edx - 0x5f1bf200], cx
neg word [esp + edx - 0x5f1bf1fa]
movsx ecx, byte [esp + edx - 0x5f1bf1fc]
mov dword [esp + edx - 0x5f1bf200], edi
ret 4
pop eax
bt ecx, 0x9f
adc edi, edx
rol dword [esp + ecx*2 - 0x8550d0], cl
movzx cx, byte [ebp + eax - 0x42a868]
push eax
mov al, byte [ebp + eax*8 - 0x215433e]
adc ebp, 2
jmp 0x9568e3
lea esp, [esp + 0xc]
jmp 0xbe36f7
btc dx, dx
jb 0x95a195
xor ebx, eax
call fcn.00c5935b
mov dword [eax + ecx*8 - 0x24008048], edx
lea eax, [ecx*8 - 0x1c746260]
jmp edi
ror cl, 0x63
adc ecx, 0xe53cf318
neg edx
cwde
lea edx, [edx + ecx - 0x1511c6f7]
lea ecx, [eax*4 + 0x1090b9c]
dec ecx
xor edx, 0xa70eb0b0
xor ebx, edx
dec al
cwde
add edi, edx
movzx edx, al
add al, cl
sets al
mov edx, dword [ebp + ecx*8 - 0x83cccd8]
lea ebp, [ebp + ecx*4 - 0x41e6668]
setno cl
add cl, al
movzx eax, byte [esi + ecx - 0x1079901]
add cl, cl
lea esi, [esi + ecx - 0x1079901]
xor al, bl
btc ecx, 8
shl cx, cl
not al
neg al
not al
bt cx, 0xba
btc ecx, 0x26
bt ecx, 0x8e
xor al, 0x32
rol ecx, 0x94
xor bl, al
btc cx, cx
jae 0x98c99d
setb cl
add eax, esp
bts ecx, 0x23
jae 0xa9d30c
div byte [esp + eax*2 - 0x6632e209]
neg dl
not dword [esp + eax - 0x331986a0]
and word [esp + eax*2 - 0x66330d40], ax
xor dl, 0xba
inc dword [esp + eax - 0x331986a0]
rol dl, 1
shl ecx, 9
rol al, 1
adc eax, eax
xor bl, dl
bts eax, 0x88
lea ebp, [ebp + ecx - 0x15003a02]
mov word [ebp + ecx - 0x15003a00], dx
mov dword [esp + ecx*2 - 0x2a007400], eax
lea edi, [edi + ecx*2 - 0x2a007404]
pop ecx
inc ecx
movsx edx, cx
mov eax, dword [eax + edi - 0x66330d83]
sbb ecx, edx
push edx
xor eax, ebx
sar edx, 0x92
pop ecx
call fcn.00b9bc12
mov edi, 0xe6b1b22
jmp 0xa6815706
push ecx
push edi
mov dword [esp + 4], 0x39d7b3ff
lea esp, [esp + 4]
call fcn.00a4f708
mov eax, 0x4927cbbf
movzx edx, al
mov edx, dword [esi + edx*2 - 0x17e]
mov ecx, eax
xor cl, ch
imul eax, eax
lea esi, [esi + ecx - 0x4927cb70]
xor edx, ebx
rol edx, 1
add cl, 0x2f
xadd cl, ah
lea ecx, [ecx + ecx + 0x71da59b]
inc edx
not edx
cwde
dec ecx
dec eax
bswap edx
jl 0xbbe437
mov eax, 0xc790fe8a
sub edi, 4
mov edx, dword [edi]
lea ecx, [eax*8 - 0x7871865d]
shl al, 0xa1
xor edx, ebx
dec ecx
not edx
dec edx
or eax, eax
rol edx, 2
xor edx, 0xaca8288e
bswap ecx
or al, 0x91
xor ebx, edx
sal al, 0x46
add esi, edx
idiv al
clc
or eax, eax
mov bp, word [ebp]
mov edx, 0x1f33e2b4
ror cl, 0xa6
and dl, ch
jge fcn.00c3a5ba
jg 0xbe371d
ja 0xbe37c1
lea esi, [ebp + edi + 0x75]
inc byte [edx + 0x55]
lodsb al, byte [esi]
cmp eax, 0x4df2fe75
mov ah, 0x3d
jne 0xbe37a6
xchg esi, eax
movsd dword es:[edi], dword [esi]
pop esp
cmp eax, 0x5576fe75
lodsb al, byte [esi]
cmp eax, 0x1dcafe75
in al, 0x3d
jne 0xbe37b8
mov dh, 0x65
pushfd
cmp eax, 0x75b2fe75
mov eax, 0xb0ffbdba
cmpsd dword [esi], dword es:[edi]
jne 0xbe377b
mov edx, 0xa7b0ffbd
ret 0x6761
Function at 0x968a78
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov dword [esp + ecx*2 - 0x29056872], esp
inc ecx
mov esi, 0x23aeb1
inc bp
and edi, ebp
or dword [esp + esi - 0x38], 0x7ea91033
movzx edi, cx
add ecx, edi
inc cx
not edi
and word [esp + ecx - 0x14836872], cx
inc si
mov dword [ecx + edx - 0x14836872], edi
mov edi, dword [ebp + ecx - 0x14836872]
dec eax
lea ebp, [ebp + ecx*4 - 0x520da1c4]
dec ecx
sar ebx, cl
xor edi, ebx
jmp 0xb65d4b

Function at 0x9715eb
Capabilities:
Encode data using base64

Disassembly:
and eax, eax
ror edx, 2
call fcn.00bed45c
mov eax, 0xb1f2aa1
mov ecx, dword [edi + eax*4 - 0x2c7caa84]
lea edx, [eax*2 - 0x2e4a44eb]
lea eax, [eax + 0x7107b587]
mov dl, byte [edi + eax - 0x7c26e024]
ror al, 0x64
sar eax, 0x71
lea edi, [edi + eax*2 - 0x7c20]
bt eax, eax
mov byte ss:[ecx + eax - 0x3e13], dl
movsx ecx, al
movsx edx, al
mov ecx, dword [ebp + eax*2 - 0x7c26]
shl dl, 0x47
lea ebp, [ebp + eax*2 - 0x7c22]
shl eax, 0x3d
not al
xor ecx, ebx
neg ecx
and ax, 0x850a
jg 0xbc6ffc
mov ebx, 0x133ac01a
call fcn.00c2fa13
rdtsc
mov ecx, 0x641cf197
btc cx, 0x29
btr ecx, ecx
lea ebp, [ebp + ecx - 0x641cf39f]
bt ecx, ecx
mov dword [ebp + ecx - 0x641cf393], eax
lea eax, [ecx*2 - 0x55e4e968]
sar eax, 0xb5
mov dword [ecx + ebp - 0x641cf397], edx
mov edx, dword [edi + eax - 0x392]
dec eax
sar eax, cl
bts eax, ecx
lea edi, [eax + edi - 0x7ffffc]
sar al, 0x21
neg al
jp 0x9e164f
xor edx, ebx
push eax
xor ecx, 0xf2a6800c
lea edx, [edx + eax*8 + 0x3032a917]
add cx, 0x6eba
push ecx
xor al, 0
xor edx, 0xcc8d331d
bswap edx
rol edx, 3
or al, 0xd
xor ebx, edx
btr ax, ax
bts ax, ax
adc esi, edx
lea edx, [ecx - 0x1cc2354a]
shr edx, 0x6b
sets cl
pop ecx
pop eax
jbe fcn.00a7c83e
neg ecx
or dl, 0x1d
xchg dx, ax
mul edx
lea ecx, [eax + ecx - 0x56d8dd8b]
neg eax
neg dl
xor eax, 0x61325f95
rol ecx, 1
neg edx
bswap ecx
dec al
sbb ecx, 0xcca5dda3
ror ecx, 1
not dl
or al, dh
not edx
not ecx
adc ax, ax
ror ecx, 2
add dx, dx
and dx, ax
not dx
xor ecx, 0xc292d235
xor ebx, ecx
mul al
dec dl
add edi, ecx
lea ecx, [edx*2 - 0x466a05cd]
btc edx, edx
movzx ecx, byte [eax + ebp - 0x36d56180]
bts ax, dx
neg al
dec edx
lea ebp, [ebp + edx*2 - 0x52fb8cd9]
inc eax
and edx, eax
xor cl, bl
inc cl
dec eax
sar eax, 0x54
inc edx
ror cl, 1
call fcn.00982e46
Function at 0x984dee
Capabilities:
Encode data using base64

Disassembly:
pop eax
dec dword [esp + 4]
xor bl, cl
lea ecx, [esp + ecx + 8]
shl dword [esp + 4], 0xe8
mov dword [ecx], edx
mov edx, 0x162071b6
mov edx, dword [esi + edx*2 - 0x2c40e36b]
xor edx, ebx
mov ecx, 0xc016e13b
mov dword [esp + 4], ecx
sub edx, 0x140ee438
lea eax, [ecx + ecx*8 - 0x56c04252]
xor edx, 0xc186621d
sal byte [esp + eax - 0x6a0da8bc], 7
not ecx
dec edx
cwde
not edx
bt ax, 0xab
xor ebx, edx
rol dword [esp + ecx - 0x3fe91ec2], 0x82
shr eax, 8
jns 0xbe53ab
sbb byte [eax], dh
sub eax, 0xb3f87a07
or bl, byte [ebx + 0x57]
xor bh, al
mov bl, 0xa
arpl word [edi + 0x2a], cx
clc
mov bl, 0xa
pop es
daa
cmp bh, al
adc dword [ebp - 0x4c9eaaf8], 0xd2d8700a
imul ebp, esi, 0xffffffad
fiadd word [ebp + ebp*4 - 0xe]
fisttp qword [ebx]
loope 0x984e8e
les edx, [ebp + 0x79]
adc byte [esi + ecx*2 - 0x15], bl
imul eax, edx, 0xfffffff8
sbb byte [ecx - 0x64], cl
cdq
dec ebp
inc esi
outsb dx, byte [esi]
or dword [edi + 0x7818dda4], edx
adc al, 0xbd
xchg ebp, eax
shl dword [ebp + 0x6a21ce2], 1
push ebp
mov dl, 0xb9
mov dword [0x71f9e1e], eax
push edx
test byte [ebp + ebp - 0x34782b2], ch
sbb al, 0xf2
mov esi, 0xbfe73476
adc al, 0x3d
rol byte [ecx], cl
and edi, dword [eax + ebx*2]
sbb eax, 0xfec24c16
invalid
add edi, edx
ror ecx, 0xc4
movzx edx, byte [esi + eax*8 - 0x7fffd3b]
xchg cx, ax
shl ecx, 0xd7
adc ax, ax
lea esi, [esi + eax - 0xff23d3]
btc cx, cx
add cx, cx
ror dword [esp + eax - 0xff23d5], cl
xor dl, bl
lea ecx, [eax + ecx*8 - 0x57c30dcc]
add al, ch
bt eax, ecx
adc dl, 5
not dl
xor al, ah
xor dl, 0x35
sal byte [esp + ecx - 0x493c161a], 0xa7
pop ecx
push eax
neg dl
inc dl
xor bl, dl
call fcn.00b892ea

Function at 0x987a7c
Capabilities:
Encode data using base64

Disassembly:
mov edi, 0x83b15999
pushfd
pop edi
mov dword [esp], edi
mov esi, 0xb22fc333
mov edi, esi
mov esi, eax
lea edi, [edi + 0x112f0d99]
btc edi, edi
call fcn.00a2db36
mov eax, 0x5ca6f012
push eax
mov ecx, dword [ebp + eax - 0x5ca6f012]
bts eax, eax
mov dx, word [ebp + eax - 0x5ca6f00e]
add ax, ax
xchg word [esp + eax - 0x5ca6e023], ax
lea ebp, [ebp + eax - 0x5ca6a6ea]
xchg dword [esp + eax - 0x5ca6a6f0], eax
pop eax
mov word [ecx + eax - 0x5ca6a6f0], dx
lea esi, [eax + esi - 0x5ca6a6f4]
mov ecx, eax
jb 0xa5ede0
Function at 0x9905b3
Capabilities:
Encode data using base64

Disassembly:
inc eax
and cx, word [esp + eax - 0x14]
xor edx, 0x991e6127
call fcn.00af0b27
mov eax, 0x77b6aa9d
jmp 0x9818b2
movzx edx, ax
lea ebp, [ebp + edx - 0xaaa1]
mov eax, dword [eax + ebp - 0x77b6aa9d]
xor eax, ebx
movzx ecx, dx
rol eax, 2
xchg ecx, edx
xor dx, dx
or dx, dx
bswap eax
je 0xb8c0c9
xadd ecx, eax
mov edx, dword [ebp + eax*2 - 0x26]
xor edx, ebx
mov dword [esp + eax*2 - 0x26], eax
or byte [esp + eax*2 - 0x26], al
not edx
jg 0x97a212
lea ecx, [ecx*2 + 0x162cfb07]
lea esi, [esi + ecx - 0x52494465]
dec ecx
or ecx, ecx
adc cl, cl
imul dl
mov edx, ecx
xor cx, dx
mov word [ecx + esi - 0x52490000], ax
jmp edi
sar byte [esp + 4], 4
mov dword [esi], edx
jb 0x9e4eeb
dec dword [esp + 4]
mov edx, 0x3638b182
mov dword [esp + edx - 0x3638b182], edi
ret 4
lea eax, [ecx*8 + 0x390eb014]
sub cx, 0x1833
neg edx
sal ecx, cl
sbb eax, 0xae2bb8a4
bswap edx
btr cx, ax
dec cl
add ecx, 0x7c0763b1
xor ebx, edx
add edi, edx
movzx edx, cl
mov dl, byte [ecx + esi - 0x1e0e24b0]
movzx ax, byte [esi + ecx*4 - 0x783892be]
jmp 0xa009e2
lea ecx, [ecx + ecx*4 - 0x797e7476]
adc ecx, edx
lea eax, [eax + edx*4 - 0x7d23a8a4]
sal cl, 0xc4
xor eax, 0x30bf5c9f
shl cl, 0xa2
dec eax
btr edx, ecx
xor ebx, eax
add edi, eax
movsx eax, cx
shl ecx, 0xca
sbb eax, ecx
or edx, dword [esi + edx]
neg ax
ror ecx, 0x6b
mov eax, dword [esi + ecx*2 - 0x4e0bc]
push ecx
and cl, 0x8f
add cl, byte [esi + ecx*2 - 0x4dff8]
add esi, 6
shr dword [esp], 0x3d
push 0xe0f0a2d
shrd edx, eax, cl
sar word [esp + 2], 0x47
jns 0xa795d0
mov edx, dword [ebp]
mov ecx, 0xa93d1c35
movsx eax, cx
lea ebp, [ebp + eax - 0x1c31]
add ecx, ecx
bt eax, ecx
xor edx, ebx
add cl, al
ror al, 0xc1
sbb eax, 0xc0b442af
rol edx, 1
inc edx
jmp 0xb7ced6

Function at 0x991387
Capabilities:
Execute syscall

Disassembly:
dec dx
mov dword [esp + ecx - 0x200006], ecx
lea eax, [esp + eax + 0x10]
sub cl, ch
mov dx, word [eax + ecx - 0x200006]
mov dword [esp + ecx*4 - 0x800010], 0x50093a12
mov eax, ecx
xchg word [esp + ecx - 0x200001], ax
lea ebp, [ebp + ecx - 0x200008]
mov word [esp + ecx - 0x1ffffa], ax
mov word [ebp + ecx - 0x200006], dx
cdq
sbb dword [esp + ecx - 0x1ffffa], edx
pop ecx
pop ecx
pop ecx
pop edx
ja fcn.00c3a5ba
sysenter
push 0xb61f0f91
pushfd
and dword [esp + 4], 0x42ae5f97
mov dword [esp + 4], 0xd4ef3c24
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00b7c3dc
shl dx, cl
inc dx
mov dword [eax + edx], edx
inc edx
idiv byte [esp + ebx*2 - 0x63544a77]
inc esi
add dword [esp + ebx*2 - 0x63544a77], eax
dec esi
mov dword [esp + ebx*2 - 0x63544a78], ecx
ret

Function at 0x9a02b3
Capabilities:
Parse pe header

Disassembly:
btr ax, 0x95
pop eax
mov eax, ebp
jae 0xa1c5de
call 0xbfc9bd
Function at 0x9a4b83
Capabilities:
Encode data using base64

Disassembly:
lea edx, [edx + edx*4 + 0x5d98db9c]
cwd
add edi, ecx
mov ecx, eax
mov dword [esp + eax - 0x5a00], eax
mov cx, word [eax + ebp - 0x5a06]
and ax, dx
ja 0x9e1085
xor cx, bx
or edx, eax
shl ax, 7
ror cx, 1
neg cx
shr eax, 0x3d
adc cx, 0x72bc
sar dl, 1
sbb al, byte [esp + eax*4 + 3]
sub edx, 0x4fb207a1
rol cx, 1
add dword [esp + eax*2], eax
call fcn.00a55fd2
mov dword [ebp - 4], eax
test ebx, ebx
push 0x2b3e9f31
lea esp, [esp + 8]
je 0xa9be86

Function at 0x9b278d
Capabilities:
Encode data using base64

Disassembly:
lea esi, [ecx + esi - 0x138dd3c3]
movsx eax, cl
mov ecx, dword [ecx + esi - 0x138dd3bf]
xor ecx, ebx
shl ax, 0xe7
bt eax, eax
xor ecx, 0x1398a23
not ecx
mov dword [esp], eax
mov word [esp + 1], 0x62a9
rol ecx, 1
not ecx
ror ax, 0x6f
ror eax, 0x64
xor ebx, ecx
add edi, ecx
mov eax, dword [ebp + eax*2 - 0x3ffff7e0]
mov edx, 0xdc166a01
mov ecx, edx
add ebp, 4
or cl, cl
jae 0xc3a748
sbb esi, 1
sar cx, cl
movzx edx, byte [esi]
sub ecx, 0xc81de003
xor dl, bl
dec ecx
add cl, cl
call fcn.00be8a67

Function at 0x9bc3ea
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc cx
mul ebp
dec ebp
add ecx, esi
dec eax
mov dword [esp + ecx*2 - 0x20a5b036], 0x541e7a01
dec edi
mov esp, dword [edx + ebp*4 - 0x41489f80]
dec eax
shr ecx, cl
inc edx
xor byte [esp + ebp - 0x105227dd], cl
inc ecx
push ebx
dec ebx
mov edx, dword [ebp + edx - 0x105227d8]
inc bp
or ebp, ebx
inc cx
rol ebp, 0xe8
dec edi
lea edx, [edx + ebp - 0x1052ffa7]
dec ebx
mov dword [ebp - 0x1052ffb7], edx
dec esi
mov dword [esp + ebp*2 - 0x20a5ff6e], ecx
ret 0x10
dec eax
mov dword [esp + edx - 0x4082913f], eax
dec edx
mov ebx, dword [esp + ebp - 0x105227d8]
inc ecx
btr ebp, ecx
inc cx
btr ebp, eax
dec ebp
arpl si, si
jae 0x994685

Function at 0x9bca2c
Capabilities:
Encode data using base64

Disassembly:
xor bl, al
lea ebp, [ebp + edx*2 - 0x94]
jmp 0xbc782c
mov word [esp + 6], 0x9413
xor al, bl
mov dword [esp], ecx
sal dx, 0x86
add al, cl
neg ecx
xor al, 0x2e
pop ecx
xadd dword [esp], edx
inc al
shr edx, cl
neg al
xor al, 0x83
sub byte [esp + edx*4 - 0x127], dh
dec dx
ja 0x9a7aab