joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa9c3ed
Capabilities:
Encode data using base64

Disassembly:
lea edx, [edx + eax - 0x3d54366d]
shr ecx, 0x7e
neg al
jne 0xa650b6
pop eax
jb 0x93ca1d
push ds
fiadd dword [ecx]
mov ah, ch
dec eax
jl 0x93ca19
pop ecx
outsd dx, dword [esi]
xchg esp, eax
adc eax, 0xee557e74
push ebp
out dx, al
push 0x8a3a5eb4
xor edx, ebx
sal byte [esp + 1], 0xc4
ja 0x95842d
inc edx
shl byte [esp + 1], 0xc5
dec byte [esp + 1]
rol edx, 3
call fcn.00ea70e7
mov edx, 0x340a3511
mov ecx, dword [esi + edx*2 - 0x68146a22]
mov edx, dword ss:[edx + ecx - 0x340a3511]
mov dword [esi], edx
mov edx, 0xf381af15
movzx eax, dl
div al
lea ebp, [eax + ebp - 5]
mov edx, dword [ebp + eax - 1]
add al, al
movsx ecx, al
sal eax, 0x8d
xor edx, ebx
and eax, eax
not edx
rol edx, 1
call fcn.009cea4b
inc bp
adc ebp, ebp
inc esi
xor dword [esp + eax*4 - 0x18e4c], ebx
dec edx
lea edx, [eax*8 - 0x2345af7b]
inc eax
xor dl, ch
pop ebx
dec edi
lea ebp, [ebp + ebp*8 - 0x58c82e4d]
dec ecx
bswap eax
dec ebp
arpl bx, bx
ror edx, 0x10
dec ecx
adc edi, ebx
jmp 0x9857d4
btc cx, cx
mov ecx, dword [esi + 8]
push 0xc023190b
jae 0xa5156b
dec ebx
mov esi, dword [ebp + ecx + 0x58c823ee]
inc edi
mov bh, byte [ecx + ebp + 0x58c823f6]
mov ecx, 0x61246e94
dec edi
lea ecx, [ecx + ebp + 0x58c823f8]
inc esp
mov byte [esi + eax - 0x1e205cbb], bh
idiv ax
jmp edi
adc esi, 4
call fcn.00a3e0fc
xor ebx, eax
add cx, 0xdc83
dec cx
add edi, eax
bswap ecx
not cx
jmp edi
ror edx, 2
btc ax, cx
sal ecx, cl
xor ax, cx
xor ebx, edx
bt ecx, eax
shl eax, cl
ror cl, 0x86
adc edi, edx
lea ebp, [ebp + ecx*2 - 0xc1]
mov cl, byte [ebp + ecx*2 - 0xc0]
inc eax
and eax, eax
movzx edx, al
xor cl, bl
bt ax, ax
ror cl, 1
add cl, 0x3b
bt dx, 0x2b
div al
imul eax, eax
neg cl
xor cl, 0xa1
inc eax
xor bl, cl
div ax
mov dword [esp], 0xb3947c93
mov ecx, dword [esi]
mov edx, dword [esp]
mov eax, dword [esi + 4]
add ecx, eax
movzx eax, word [esp]
rol eax, 0x37
jb 0x93c9ae
mov dword [esi + eax - 0x4980003a], ecx
pop ecx
neg eax
lea ecx, [esi + 4]
or al, dh
mul eax
mov dword [esi + eax*2 - 0x4c000008], ecx
movsx ecx, al
mov ecx, dword [ebp + eax - 0x26000008]
imul edx, edx
adc edx, 0x51a9a03
shl ax, 4
lea ebp, [ebp + edx*4 - 0x21f46838]
xor ecx, ebx
not eax
lea ecx, [ecx + edx*8 + 0x6cbb3ac2]
rol ecx, 1
or dx, ax
rol edx, 0x36
sar ax, 0x2a
not ecx
js 0xab89d2
sub eax, eax
inc ecx
inc eax
xor edx, edx
xor ebx, ecx
add edi, ecx
mul edx
dec eax
adc edx, edi
jmp edx

Function at 0xa9effe
Capabilities:
Encode data using base64

Disassembly:
pushfd
add dword [esp + 4], 0xff55da23
mov dword [esp + 8], 0xfe536205
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.00b6bc0f
Function at 0xaa68ab
Capabilities:
Encode data using base64

Disassembly:
jmp 0x9d1f07
dec ebp
cmp ecx, esp
jmp 0x94d3c7

Function at 0xaae3c4
Capabilities:
Encode data using base64

Disassembly:
inc cx
dec esi
inc eax
xadd ch, dl
dec edi
lea ecx, [ecx + ebp*2 - 0x4a]
dec ecx
sal edi, cl
dec eax
bt edx, 0x89
dec edi
lea edx, [edx + ebp*8 - 0x131]
push ebp
dec ebp
sbb esp, edi
inc ebx
movzx eax, byte [edx + ebp*4 - 0x98]
dec esi
mov dword [esp + ebp*2 - 0x4c], ebx
xor al, bl
dec edx
inc dword [esp + ebp*2 - 0x4c]
inc ecx
setns bh
inc edx
sar byte [esp + ebp - 0x21], 0x85
ror al, 1
inc dx
and dword [esp + ebp*8 - 0x12a], ecx
je 0xa46bb0
call fcn.00a09b27
inc ecx
mov eax, 0x8cabfd90
inc ecx
mov edi, 0xd80ffc98
dec ecx
sub edx, 4
inc ebp
mov ebx, eax
inc ebp
movzx ebp, bh
inc ecx
movzx ecx, bh
inc edi
mov eax, dword [edx + ebp - 0x98]
inc ebp
mov esp, ebp
inc ecx
movsx eax, ah
inc esp
xor eax, ebx
dec esi
lea esi, [ebx*4 - 0x70c75ffa]
inc cx
sal esp, 0xaa
inc ecx
not eax
mov esi, 0xae38d4aa
inc ecx
dec eax
dec ecx
ror edi, cl
dec ebx
lea ebp, [esi + edi*4 + 0x1ba1111d]
inc eax
xor dh, ch
inc ecx
not eax
inc eax
sal ch, 3
inc ecx
inc eax
dec esp
add esi, eax
jle 0xe994fd
push ebx
dec eax
lea ebp, [ebp*8 - 0x44c0cd78]
bts ecx, 0xd
inc esi
xor dword [esp + ebp*4 - 0x260], eax
cwde
inc ecx
rol ebp, 0x3e
inc ecx
movzx edx, di
pop ebx
dec ebp
arpl ax, ax
dec ecx
imul edi
dec ecx
add edi, eax
inc bx
mov esi, dword [ecx + ebp*2 - 0x4c]
jmp 0x9d1d73
inc bp
mov esi, dword [ecx + 2]
dec ecx
add ecx, 2
inc eax
add byte [esp + 5], dh
inc esp
movsx ebx, dh
inc bp
adc eax, esi
sar word [esp + 5], 0xea
mov edx, esi
inc bp
mov dword [ecx], eax
dec ecx
sbb edx, 4
inc ecx
mov edx, dword [edx]
push esi
xor word [esp + 0xe], 0x8437
xor edx, ebx
dec esp
xadd dword [esp + 7], ebx
adc edx, 0x3173f14
xor edx, 0x1855d2d
inc ecx
movzx ecx, bl
neg word [esp + ecx]
inc esp
sbb ebx, dword [esp + ecx*4 + 2]
lea edx, [edx + ecx - 0x7d91d63f]
call fcn.0093d390
sbb esi, 0xfffffffa
btc eax, 0x92
cwde
sal eax, 0x8e
xor dl, bl
or eax, eax
neg al
inc dl
shr eax, 0xaa
je 0x97b137
ror ax, 0xec
xor dl, 0x9e
inc eax
not dl
sar eax, 0x61
or eax, eax
shr al, 0x42
rol dl, 1
bts ax, ax
bt eax, eax
btc eax, 0x20
xor bl, dl
cbw
shl eax, 0xa9
lea eax, [eax + 0x2c1f049d]
adc edx, esp
inc eax
call fcn.00ea2dd6
mov ecx, 0xc5a7e72e
inc cx
sub ebp, 2
lea edx, [ecx + ecx*8 - 0x2dde6eca]
mov eax, 0x88bda931
neg eax
movzx eax, word [ebp + eax - 0x774256cf]
push edx
pop edx
xor ax, bx
neg ax
sub cx, 0xe12e
and dl, cl
rol edx, cl
not ax
dec ax
and edx, ecx
rol ecx, 0x76
ror ax, cl
and dx, dx
add cl, cl
xor bx, ax
sub esi, 2
rol edx, 0x77
mov word [edx + esi - 0xc00081], ax
lea ebp, [ebp + edx - 0xc00085]
mov eax, dword [edx + ebp - 0xc00081]

Function at 0xab17ed
Capabilities:
Encode data using base64

Disassembly:
sal cx, 0x22
xor al, 7
lea ecx, [edx + ecx*4 + 0x63b5ef2f]
sub al, 0x3b
mov dword [esp + edx*4 - 0x1c8d59c], 0xa6b9e01b
xor edx, 0x17ac76b3
sar ecx, 0x41
xor bl, al
call fcn.00b626c8
Function at 0xaba3a4
Capabilities:
Encode data using base64

Disassembly:
call 0xa891cc
pop edx
ror al, 1
or cl, cl
not al
inc al
sar cl, 0xa3
jns 0xb79a7c
rol al, 1
xchg dword [esp + ecx - 0x5590a9ed], ecx
movsx edx, cx
not al
not ecx
not word [esp + edx - 0x3bba]
add al, 0xb3
mov dword [esp + edx*2 - 0x7774], 0x2b011299
shl word [esp + edx - 0x3bba], cl
adc dword [esp + edx - 0x3bb8], ecx
xor bl, al
rol cx, cl
lea eax, [esp + eax + 8]
rol ecx, 0x36
bswap ecx
mov ecx, dword [eax + edx*2 - 0x7778]
mov dword [edx + ebp - 0x3bc4], ecx
push edx
neg dword [esp + edx*2 - 0x7773]
lea ebp, [ebp + edx*4 - 0xeef8]
lea eax, [edx*2 - 0x7d4fc3d1]
xor dword [esp + edx*4 - 0xeeed], edx
pop edx
pop edx
pop eax
jae fcn.00989a2c
sysenter
push ecx
pushfd
mov ecx, 0x7388a790
or ecx, 0xf43d6dac
mov ecx, dword [esp + 4]
mov dword [esp + 4], 0xfe96c249
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00b6bc0f
mov edx, 0xaa0fbe27
movzx eax, dx
mov ecx, dword [eax + ebp - 0xbe2b]
rol eax, 0x34
call fcn.00b6b9bb
dec esi
jns 0xaba4be
cmp eax, ebx
add byte [eax + 0x4d7160e3], dl
dec ebx
outsd dx, dword [esi]
out 0x41, eax
neg ecx
lea ecx, [ecx + edx - 0x35cab8af]
and word [esp], dx
dec dword [esp]
lea eax, [edx + edx*4 - 0x7459ed58]
bswap ecx
pop edx
xor ecx, 0x8198f532
xor eax, 0xe014a215
jg 0x961172
sysenter
push ebp
mov ebp, 0x3211330a
mov ebp, dword [esp + ebp - 0x3211330a]
mov dword [esp], 0xfe49257d
call fcn.00b6bc0f
mov eax, ebp
jmp 0xa7adef

Function at 0xabbd54
Capabilities:
Encode data using base64

Disassembly:
add edi, edx
pop eax
xor byte [esp + 2], 0x97
dec ecx
mov edx, dword [ebp]
mov eax, ecx
sbb dword [esp], 0xf48a519f
mov cx, word [ebp + 4]
dec ax
push eax
jp 0xa5b5f7
inc ecx
mov eax, 0xe70a1487
inc ebp
mov esp, dword [ecx]
jmp 0xa5cb3e

Function at 0xabda80
Capabilities:
Encode data using base64

Disassembly:
sub eax, dword [esp + eax - 0xd3e5]
xadd ax, cx
adc edi, edx
mov dword [esp + ecx - 0x1a2e], ecx
mov edx, dword [eax + esi - 0x1aa2b]
add ecx, eax
adc cl, 0x9d
mov ecx, dword [esi + eax*2 - 0x35456]
call fcn.00a9f05e
inc ecx
mov esi, 0x3c2f5418
dec ecx
mov ecx, ecx
inc ebp
mov ebx, esi
dec edi
lea ecx, [ebx + ecx - 0x3c2f541c]
inc ecx
push ebx
inc edx
not byte [esp + esi - 0x3c2f5417]
inc ebp
mov esp, esi
inc ebx
mov dword [ecx + esi*2 - 0x785ea830], ecx
dec edi
lea edx, [edx + esi - 0x3c2f541c]
inc ebx
mov ecx, dword [edx + esi*2 - 0x785ea830]
inc ecx
dec ebx
jg 0x96a1f9
inc ecx
movzx ebp, byte [edx - 1]
inc eax
xor ch, bl
inc eax
ror ch, 1
inc ecx
mov esp, 0x56a52f1a
inc eax
sub ch, 0xbd
inc ebp
mov edi, esp
inc ecx
mov eax, 0xb7bf7a8e
inc eax
ror ch, 1
dec ecx
lea ecx, [eax - 0x734c0ed2]
inc eax
dec ch
inc ebp
movsx esi, bh
inc eax
neg ch
inc cx
sar esp, 0x4f
inc eax
xor bl, ch
dec eax
add ebp, esp
inc ecx
ror esi, cl
inc cx
movzx ecx, byte [esi + ebp - 0x1a0]
inc ecx
ror esi, 0x3f
call fcn.009d41bb
Function at 0xabe6b9
Capabilities:
Check http status code
Encode data using base64

Disassembly:
inc bp
or esp, esp
mov eax, 0x3b28df1a
inc ecx
neg esi
inc ecx
not esi
call fcn.00938817
inc ecx
rol ebx, 3
inc ecx
inc ebx
inc ecx
sar ebp, 0xc8
dec eax
mov dword [esp + esi - 0x40ccc5ab], ebx
inc esp
xor dword [esp + ebp - 0x649e4a10], ebx
inc esp
movzx eax, al
dec ecx
not edi
inc esp
movzx esi, dx
pop ebx
dec ebp
arpl bx, bx
dec ecx
mul edi
dec ecx
add edi, ebx
inc ecx
bswap esp
dec eax
inc ebp
jge fcn.00987526

Function at 0xac1c4b
Capabilities:
Encode data using base64

Disassembly:
neg word [esp + ecx - 0x17966910]
xchg ch, cl
rol al, 1
xor al, 0x19
ror cx, 0xa5
xchg cx, dx
mov word [esp + ecx*2 - 0x2f2cd2e8], 0xbd1b
not al
call fcn.00a6b56f
rol edx, 3
dec esp
lea esi, [ecx + ecx*2 + 0x6b12b286]
inc eax
movsx esi, ch
dec edx
xor dword [esp + ebp - 0x1abb], ebx
inc esp
movzx eax, dh
inc ecx
idiv dh

Function at 0xb5fafa
Capabilities:
Encode data using base64

Disassembly:
xor al, bl
ror al, 1
movzx edx, word [esp + 8]
rol cl, 0x47
imul cx, cx
adc al, 0x3a
neg al
push edx
sal ecx, 0xd7
push ecx
xor al, 0xa1
xor bl, al
lea eax, [esp + eax + 0x14]
mov dword [esp + ecx*2 - 0xfffff8], edx
xor dword [esp + ecx - 0x7ffff1], ecx
add edx, dword [esp + ecx*2 - 0xfffff2]
xor cx, word [eax + ecx*4 - 0x2000000]
mov word [esi - 8], cx
dec dl
lea ecx, [edx*8 - 0x15c2460]
not dx
lea esi, [esi + ecx*8 - 0x32e26ac8]
pop eax
pop edx
pop ecx
pop eax
pop ecx
jge fcn.00a106d2
inc ebx
mov dword [ecx + ebp*2 - 0x1be], ebp
inc edi
mov eax, dword [ebp + edx - 0xe7]
dec ecx
xor edi, 0xaa196a9b
dec edi
lea edx, [edx + ebp*8 - 0x71c]
inc esp
xor eax, ebx
neg edx
inc ecx
inc eax
dec ebp
lea ebp, [ebx + 0x341b4719]
inc ecx
bswap eax
dec ecx
sub esi, 0x1e26e1b9
inc ecx
xor eax, 0x1dbf111a
xor al, 0x95
inc edi
lea eax, [eax + ebx*2 - 0x3d05a7ca]
inc ecx
rol eax, 1
inc bp
xchg esp, edi
push ebx
mul dl
inc eax
add dh, dh
inc ax
inc esi
xor dword [esp + ebp - 0x5cd78], eax
dec esp
bt esi, ebx
inc ecx
inc bl
call fcn.009b8fa7

Function at 0xb6afab
Capabilities:
Encode data using base64

Disassembly:
dec ecx
inc esi
inc ecx
dec ebp
dec ebp
bt esi, ebx
dec esi
mov dword [esp - 0x406c], edi
inc ecx
not ebp
jb 0xa478f7
mov eax, 0xc1bad83f
movzx edx, al
lea ecx, [edx + edx*4 - 0x4b47c14b]
mov eax, dword [ebp + edx*8 - 0x1f8]
dec edx
btr edx, ecx
mov ecx, dword [ebp + edx - 0x3a]
btr edx, 0x8c
neg dx
push ebx
sete dl
shr edx, 0xc8
cpuid
call fcn.00b898ab
Function at 0xb6e745
Capabilities:
Encode data using base64

Disassembly:
push ebp
inc ecx
inc esi
sal dword [esp + esi - 0x3aae0a74], cl
dec eax
mov eax, dword [esp + 8]
dec eax
adc eax, 0xfff20ac7
jmp eax
dec edx
mov ebx, dword [esp + ebx - 0xe55a]
dec esp
lea ebx, [ecx*4 + 0x929240b]
dec edx
mov dword [esp - 0x5dffffd8], 0x8c0e5e18
dec ebp
arpl ax, ax
inc ecx
inc esp
dec ecx
add edi, eax
inc ecx
and ecx, esi
dec esp
btc ebp, esp
inc dx
sal dword [esp + edi*8 + 0x1f], 0x43
dec edx
mov dword [esp - 0x5e000001], edi
ret 0x28
inc ecx
sub bh, 0x14
dec ecx
lea eax, [esp - 0x952b2e8]
inc ecx
xor bl, bh
cbw
inc ecx
sal esp, 0x37
dec esi
lea edi, [esp + edi + 0x18]
inc ebp
movzx ebx, si
dec ecx
mov ecx, dword [edi + ebp - 0xffffb6]
dec ebp
lea ebp, [esp + ebp*4 - 0x265f950]
je 0x9a919d
dec eax
cdq
dec eax
xor edx, ecx
inc ecx
idiv al
mov ecx, 0x588f42a6
dec ebp
btr ebp, esp
inc ebp
mov eax, dword [ecx + ebp*2 - 0x1ffff70]
dec bp
je 0x94ac61
inc esp
mov dword [edx + ebp*4 - 0x3fffed4], eax
cwde
inc ebp
mov eax, dword [edx + ebp*2 - 0x1ffff70]
push ecx
movsx esi, al
dec ebp
lea edx, [edx + ebp - 0xffffbb]
cwde
neg al
inc esp
xor eax, ebx
inc cx
xchg esi, eax
add ecx, ecx
dec eax
shl ebp, 0x76
inc ecx
neg eax
inc dx
dec dword [esp + ebx - 0xe581]
inc esi
movzx edi, word [esp - 0x5dfffffc]
inc dx
add dword [esp + ebx - 0xe571], 0x8d474182
test byte [eax + esi], al
dec ebx
sbb eax, ecx
push eax
inc ecx
ror eax, 2
inc ecx
not eax
dec edx
mov dword [esp - 0x5dffffe0], ebx
dec edx
mov dword [esp - 0x5dfffff0], esi
inc ecx
sub al, bl
inc ecx
push esi
inc esi
xor dword [esp + ebx*4 - 0x395e0], eax
dec edi
lea esi, [esi + esi*8 - 0x635923fa]
jmp 0xa96d38

Function at 0xb713b2
Capabilities:
Encode data using base64

Disassembly:
call 0x979fb5
rol eax, cl
rol edx, 2
xchg byte [esp + ecx - 0x31b45ff9], al
sal cl, 0xc2
sal ecx, cl
neg edx
bts eax, ecx
rol al, 0xc1
sub ecx, eax
sbb edx, 0x79047ba7
push ecx
rol edx, 3
add eax, eax
rol ax, 0x41
cmovo eax, ecx
xor ebx, edx
add edi, edx
shl ecx, 0x13
pop eax
pop ecx
pop eax
pop ecx
pop ecx
js fcn.00a106d2
test ax, di
cmc

Function at 0xb7256f
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax*4 - 0xc], ecx
inc edx
idiv cl
not word [esp + eax - 0x2fe]
sar ecx, 0x4e
ror edx, 1
rol al, 0x41
sub dword [esp + eax*8 - 0x1800], ecx
neg ecx
dec edx
sar cx, 0xc6
div cl
add word [esp + eax*2 - 0x3c04], ax
neg edx
xor ebx, edx
neg cx
add edi, edx
bswap ecx
lea edx, [eax*4 + 0x794ad05]
btr ecx, 0xe
mov ecx, dword [ebp + eax*2 - 0x3c02]
jae 0x9d26a0
mov eax, 0xc716879a
dec ecx
sub edx, 4
jmp 0xeb05c2
call fcn.00b79063

Function at 0xb72788
Capabilities:
Encode data using base64

Disassembly:
ror dword [esp + 0x13], 0x36
inc ecx
and edx, 0xff
call fcn.0099cd36
rol edx, 2
mov eax, dword [esp]
ror dword [esp + eax - 0x61aa7fad], 0xdc
sar eax, 0x55
xor ebx, edx
add edi, edx
mul al
call fcn.00972e3b

Function at 0xb77400
Capabilities:
Encode data using base64

Disassembly:
pushfd
xor edx, 0xf2280217
mov dword [esp + 0x14], 0xfe13d015
mov edx, dword [esp + 8]
call fcn.00a75ed1
inc esi
js 0xb77473
loopne 0xb77428
xor dl, 0xe
mov eax, 0x9e8a3ba5
call fcn.00b85d90
jmp 0x8cdf742d
Function at 0xb7742b
Capabilities:
Encode data using base64

Disassembly:
ror edx, 0x41
sbb al, 0x1e
or dx, dx
xor al, 0x2a
push edx
lea edx, [edx + edx*4 - 0x31fe3554]
not al
call fcn.00a4cf4f
mov eax, dword [esi]
add esi, 4
mov edx, 0x1a12f719
movsx ecx, dl
xor eax, ebx
sal edx, 0xdc
not cl
not ecx
bswap eax
and edx, ecx
cmovp ecx, edx
rol eax, 1
sub eax, 0xcfa81c99
jmp 0xa09f27
sub byte [esp + ecx*2 - 0x2d1a92bc], cl
xor eax, 0xb90ba6bd
xor ebx, eax
add edi, eax
mov dword [esp + ecx*4 - 0x5a352584], edx
push ecx
mov cx, word [esi + ecx - 0x168d4961]
pop eax
add eax, dword [esp + edx - 0x168d9603]
btc eax, eax
mov dx, word [edx + esi - 0x168d9602]
pop eax
rol ax, 0x6e
shr ax, 0x45
lea esi, [eax + esi - 0x168d0128]
call fcn.00eb2061
mov edx, 0xf73c1c8a
mov eax, edx
mov cx, word [ebp]
inc edx
movzx eax, byte [esi]
neg dx
xor al, bl
inc edx
not al
inc dl
dec al
neg al
neg edx
jno 0x9ef884
Function at 0xb79822
Capabilities:
Encode data using base64

Disassembly:
xor cl, 0x2a
and eax, dword [esp]
sar word [esp + 1], 0xc
xor cl, al
xor cl, 8
cbw
xor bl, cl
lea ecx, [esp + ecx + 4]
jmp 0xab4bfb
rol edx, cl
sub ecx, 0x5484cd00
xor eax, 0xd33bb8b5
neg eax
xor ebx, eax
inc ecx
setne dl
add edi, eax
ror dl, 0xe1
movzx eax, byte [esp + edx*8 - 0x3fe]
shl cx, cl
mov dword [esp + edx - 0x80], edi
ret 4
adc edx, 0xd982cbb7
not cx
sub byte [esp], dh
or dword [esp], edx
and ax, cx
shr edx, 0x3d
movsx ecx, dl
xor ecx, ecx
mov word [ebp + edx*2 - 8], ax
ror dword [esp + edx*2 - 0xa], 0xfa
mov edx, dword [edx + esi - 5]
sal word [esp + ecx*2 + 1], 3
lea esi, [esi + ecx + 4]
lea eax, [ecx + ecx - 0xc51fc52]
sbb ecx, eax
xor edx, ebx
ror ecx, cl
adc al, ch
inc edx
or cx, 0x7c9c
shl dword [esp], cl
not byte [esp + 2]
xor edx, 0xba325e3e
not dword [esp]
dec edx
btc ecx, 0x2c
xor byte [esp], 0x8c
not edx
sbb cl, ch
cwde
push eax
xor ebx, edx
rol ecx, cl
pop ecx
shl dword [esp + ecx - 0x335], 0xe5
add edi, edx
mov ax, word [ecx + ebp - 0x333]
sub ecx, ecx
lea ecx, [esp + ecx*4 + 8]
not word [esp + 2]
mov word [ecx], ax
pop edx
lea ecx, [esp + edx*2 - 0x3fc1dc60]
mov eax, edx
movzx ax, byte [ecx + edx - 0x1fe0ee60]
sal dx, 0xe3
lea ecx, [edx + edx*8 + 0x3ca69486]
not dx
mov word [ebp + edx - 0x1fe08cfd], ax
shl ecx, 0xfb
shl dx, 0x2a
lea ebp, [ebp + edx - 0x1fe0fbfe]
push ecx
sar cl, 0x64
movsx eax, cx
mov dword [esp + edx*4 - 0x7f83f000], edi
ret
neg al
shl ax, 0xa
mov word [ecx], dx
pop edx
xor edx, 0x6d9db4b7
movzx ecx, al
mov edx, dword [esi + ecx*4 + 1]
lea ecx, [eax + eax*4 + 0x6b05b220]
div cl
bts eax, ecx
lea esi, [esi + ecx - 0x6afbc61b]
xor ecx, 0x2529a386
xor edx, ebx
ror edx, 3
neg ecx
cwde
call fcn.00954ff2
mov dword [esp], 0x272cca0b
mov al, byte [ebp + 4]
mov ecx, dword [esp]
not ecx
add ebp, 6
shr ecx, cl
push ecx
mov byte ss:[edx + ecx*4 - 0x3634], al
mov eax, dword [esi + ecx*2 - 0x1b1a]
lea esi, [esi + ecx*2 - 0x1b16]
movsx edx, byte [esp + ecx - 0xd8b]
xor eax, ebx
bt ecx, 0xb
or ecx, edx
bswap eax
not eax
jno 0x979eab
mov cx, word [ebp + 2]
inc dl
xadd dl, dh
push edx
not ax
jg 0xaa16ad
mov ecx, 0xeb30ec0c
movzx eax, cx
mov dx, word [ebp + eax*2 - 0x1d818]
not cx
movzx ecx, byte [esi + eax*2 - 0x1d818]
not eax
shl ax, 0x4e
xor cl, bl
not cl
sal ax, 0x67
setae al
push eax
sbb cl, al
bt eax, eax
and al, ah
dec dword [esp]
neg cl
dec eax
sub cl, 0x1f
or dword [esp], eax
jl 0xb7fe29
jle 0x955ee9
lea esi, [esi + edx*2 - 0x3da19b4a]
jae 0xeae62a
shr dl, 0x45
shl ecx, 0x24
mov word [esi + edx - 0x1ed0cd05], ax
call fcn.00a234ae

Function at 0xb7a3f5
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], ecx
mov dword [ebp + 4], eax
lea eax, [ecx*8 + 0x6628e79f]
mov dword [ebp], edx
pop ecx
jae fcn.00989a2c
dec esp
jb 0xb7a46c
pop ds
fst qword [esi]
lodsb al, byte [esi]
int3
sar dh, 0xc1
Function at 0xb7a496
Capabilities:
Encode data using base64

Disassembly:
ror dl, 0x61
call 0x99a939
sub al, ah
mov eax, dword [ebp + eax*2 - 0x7a9dd804]
sub word [esp + 4], dx
jb 0xa56006
dec cl
not eax
add dx, 0x5f99
sal dx, 8
xor bl, cl
mov word [esi - 2], cx
imul eax, eax
imul eax, edx
mov eax, dword [ebp + eax - 0x47247905]
jo 0xa025c4

Function at 0xb7fdce
Capabilities:
Encode data using base64

Disassembly:
mov edi, 0x2b289f95
rol edi, 0xc5
movzx edi, byte [edx + edi - 0x6513f2a5]
xor edi, ecx
jmp fcn.00b74217
push 0x7ba916a6
not dword [esp]
xor ecx, edi
inc edx
push 0x942d720b
xor ecx, 0x280ede81
dec eax
lea esp, [esp + 0x10]
jne 0x93a710
mov eax, 0xb21db08a
pop edi
not ecx
mov dword [ebp], ecx
jmp edi
shr ecx, 8
jmp 0xa995bf

Function at 0xb7fdd6
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ecx + esi - 0x6360d01d]
mov eax, 0x867801
setge al
lea eax, [eax*4 - 0x7b726c6e]
mov eax, dword [esi + 4]
call fcn.009a5d50
xor dx, 0x3413
or ax, cx
shr al, 0xc2
xor dx, cx
xor bx, dx
sub ebp, 2
dec dword [esp]
mov word [ebp], dx
pop edx
jnp fcn.00989a2c
inc ebx
mov eax, dword [esp + edx - 0xa433]
call fcn.00a662b6
Function at 0xb7fea7
Capabilities:
Encode data using base64

Disassembly:
ror eax, 1
call fcn.0097cf25
pop ds
inc edi
outsb dx, byte [esi]
call dword [edi + 0x3eaeaafc]
add bh, 0xfc
stosb byte es:[edi], al
scasb al, byte es:[edi]
inc edx
sbb bl, byte [edi + 0x30aeaafc]
mov esi, 0x60b3e5cf
ret 0x19e4
or byte [esp + 0xb], ah
inc eax
inc ecx
shr eax, 0xea
or dword [esp + eax - 0x256982], 0x2aa21eb3
pop eax
xor ecx, 0xba325e3e
movzx eax, byte [esp + 1]
dec ecx
sal byte [esp + eax - 0xdc], 0xa4
not ecx
xor ebx, ecx
lea edx, [edx + edx*2 - 0x63e589d7]
inc dx
add edi, ecx
idiv byte [esp + eax*2 - 0x1b7]
or ax, 0xe407
mov eax, dword [eax + esi - 0xeefb]
bswap edx
mov word [esp + 5], 0xb9b2
xor eax, ebx
movzx ecx, dl
mov dh, 0xca
mov word [esp + ecx - 0x97], 0x91
inc eax
neg edx
or ecx, 0x6a1f8abd
rol eax, 1
btr ecx, 0xad
jb 0xa4f576
inc ecx
xor eax, 0x9f156bae
sar cl, 0xa2
rol eax, 3
not edx
dec eax
xchg dword [esp + ecx - 0x6a1f8aed], ecx
xor eax, 0x2bb07120
bt edx, 0
jb 0x939a59
cmp esp, dword [edx]
dec edx
push dword [ebx + 0x36ae8e99]
cmpsb byte [esi], byte es:[edi]
xchg dword [edx + 0x39ab7221], ebx
cmp eax, 0x62adf58b
jb 0xb7fefe
stosd dword es:[edi], eax
cmp dword [0x62adf58b], edi
jns 0xb7ff96
dec ecx
inc eax
std
aaa
add esi, dword [ebp - 0x1d8d601f]
jp 0xb7ff52
js 0xb7ff51
push esp
sbb byte [ecx + 0x74], bh
sbb al, byte [esi - 0x5a957fff]
inc esp
xor eax, 0x6944b865
jae 0xb7ffab
fsub qword [edx]
loopne 0xb7fffa
sbb dword [edi + 0x2fe9772d], ebp
sbb al, 0xab
and eax, 0xeb51e6b1
dec eax
mov ecx, 0x495fd800
jp 0xb80002
movsb byte es:[edi], byte [esi]
out 0x34, eax
fdiv st(7), st(0)
xor al, al
cdq
enter 0x3ee2, 4
int3
rcr byte [ecx + 0x43ee2c8], 0xcc
adc al, 0xa7
adc ch, byte [ebx]
mov ch, 0x1c
stosd dword es:[edi], eax
cdq
invalid
pushfd
pop es
push edi
stosd dword es:[edi], eax
sbb al, 0x3a
sbb ch, dh
adc al, 0x4d
cmpsd dword [esi], dword es:[edi]
sub eax, 0xb2f18274
xor cl, 0xb2
div edx
inc ebp
test dword [edi - 0x5c286a71], 0x1ffafc58
pop eax
cld
cli
pop ds
inc ebp
and dword [edi - 0x2f793826], edi
aad 0x3b
dec ebp
xchg ecx, eax
mov ss, word [ebx]
jb 0xb8003e
push ebp
xchg ebp, eax
iretd
jge 0xb7ffbf
or dword [ebx*2 - 0x6614d396], esi
rol byte [ebx], 1
add al, byte [edi - 0x80]
sub dl, 0xe8
jns 0xb7ffcd
jmp 0xb7ff9d
in eax, 0x47
inc ebx
add al, 0xaa
xchg edi, eax
and al, 0x40
mov dh, 0xaf
insd dword es:[edi], dx
fisubr word [esi - 0x14049247]
dec edi
jecxz 0xb7ffd9
fld xword [edx + 0x586be3f9]
enter 0x5802, 3
clc
add eax, 0x12e46fef
pushfd
fucom st(2)
pop ss
mov dh, 0x21
sbb al, 0x94
test byte [esi + 0x7d56f624], 0x71
sti
not byte [esi + 0x7d]
jno 0xb8003e
cmp byte [ebp - 0x42], dl
mov eax, 0x38ac7e22
fild dword [esi + 0x26]
mov eax, 0x7c483b66
add ecx, ebx
bound ebp, qword [ebx + 0x14]
jmp 0xed9c1bc4

Function at 0xb80515
Capabilities:
Encode data using base64

Disassembly:
call fcn.00985121
add eax, edx
mov dword [ebp - 4], eax
ror dword [esp + 4], 0xc6
setb byte [esp + 6]
test ebx, ebx
jmp 0x96a78f
Function at 0xb81714
Capabilities:
Encode data using base64

Disassembly:
inc ecx
ror esi, 3
dec edi
lea ebp, [ebx + ebx*2 - 0x4be17bf9]
dec esi
mov dword [esp + ebx - 0x7e96], esp
inc esp
movsx edi, si
inc ecx
not esi
dec ecx
shr esp, 0xce
inc ecx
xor esi, 0x7527c68b
dec edx
mov dword [esp - 0x3ffde], ebx
call fcn.00a838b3

Function at 0xb838f9
Capabilities:
Encode data using base64

Disassembly:
lea esi, [edx + esi - 0x36043648]
inc cx
and dx, dx
mov dword [edx + esi - 0x36043644], eax
sbb edx, 0x2b2e7989
setnp byte [esp + edx*4 - 0x2b56f2e5]
pop eax
pop ecx
pop eax
pop edx
jno fcn.00a106d2