joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaed93e
Capabilities:
Encode data using base64

Disassembly:
inc ecx
neg esp
inc ecx
pop ebp
inc eax
mul bh
sbb ax, 0x3b8e
inc ecx
xor esp, 0x7a39da9
dec eax
mov dword [esp + ecx*4 - 0x664e7430], ebx
and edx, ecx
je 0x6febfe
inc esp
xor dword [esp + ecx - 0x19939d06], esp
dec eax
mov dword [esp + ecx - 0x19939d0e], eax
sal word [esp + ecx - 0x19939d09], cl
dec eax
mov ebx, dword [esp + ecx*2 - 0x33273a14]
dec eax
mov dword [esp + ecx - 0x19939d06], ecx
inc esp
movsx edi, al
pop eax
dec ebp
arpl sp, sp
inc esp
sub byte [esp + eax*8 - 0x68871], bh
call fcn.00adebe0
mov ecx, 0xdabbc492
mov edx, 0xa0867e1d
xor dx, cx
mov edx, dword [edi]
movzx eax, cx
lea edi, [edi + eax*2 - 0x18920]
shr eax, cl
call fcn.009d534e
mov eax, 0x120137b8
lea esi, [esi + eax*2 - 0x24026f71]
sal eax, 0xcf
movsx ecx, ax
mov edx, ecx
movzx eax, byte [esi + ecx]
shr cx, 0x2e
and dx, cx
bswap edx
xor al, bl
dec al
btc ecx, 4
sar cl, 0x85
ror al, 1
inc ecx
bts dx, dx
and ecx, 0xc4af9f96
not al
rol dl, 0x44
jns 0xc3d92b
shr byte [esp + eax - 0x3d92a1e], 0xe4
shl al, 0x81
xor ecx, ebx
xor ecx, edx
add dx, word [esp + eax - 0x3d92a3c]
xadd dword [esp + eax*2 - 0x7b2547c], edx
bswap ecx
setne dl
adc al, 0xa2
xor bl, al
sal ecx, 0x35
btc ecx, ecx
xor cl, 4
adc eax, esp
sal ecx, 0x9c
dec edx
mov ecx, dword [eax + ecx - 0x50000000]
bts edx, 0xae
sbb ebp, 3
lea eax, [edx + edx + 0x1f2ad905]
mov dword [eax + ebp - 0x1f2ad903], ecx
lea esi, [esi + eax*4 - 0x7cab6410]
mov ecx, edx
bswap eax
push eax
mov ecx, dword [eax + esi - 0x3d92a1f]
jmp 0xb92d97

Function at 0xaf835d
Capabilities:
Encode data using base64

Disassembly:
bswap edx
adc edi, ecx
mov eax, dword [edx + ebp - 0x3d1ac5a9]
not edx
and edx, edx
je 0xabe002
mov edx, dword [ebp + 4]
mov cl, byte [ebp + 8]
mov dword [esp], 0x1ca1809a
shl word [esp + 1], 0x67
adc ebp, 6
rol dword [esp], 0x79
call fcn.009fff20

Function at 0xaf8397
Capabilities:
Encode data using base64

Disassembly:
rol eax, cl
xor ebx, edx
shr ax, 0xcd
jbe 0xad2420
add esi, edx
neg dword [esp + eax*2 - 0x49580005]
pop ecx
pop edx
pop ecx
pop edx
pop eax
jne fcn.00c3a5ba
mov ecx, 0xa23cf788
mov dword [esp], 0x3710cabd
rdtsc
push ecx
sub ebp, 8
inc cl
sar dword [esp], 0xa3
sar ecx, 0xe2
mov dword [ebp + 4], eax
mov dword [ebp], edx
push ecx
xchg dword [esp + 2], ecx
sbb edi, 4
push ecx
push ecx
and dword [esp + 0xd], ecx
mov edx, dword [edi]
xor edx, ebx
not edx
inc dword [esp + 0x10]
sal word [esp + 4], 0xe8
sbb edx, 0x3ea97f8b
rol edx, 2
neg dword [esp + 0xa]
mov eax, dword [esp + 5]
lea eax, [eax*4 + 0x1ae693e]
dec edx
xadd eax, ecx
bswap edx
setbe byte [esp + eax*2 - 0x5638300d]
jbe 0xa161b4
or ecx, edx
btc eax, eax
lea eax, [eax + eax*2 + 0x4533ff02]
not ecx
movsx edx, ax
push edx
mov dword [eax + esi - 0x5d159197], ecx
sub edx, dword [esp + eax - 0x5d15919f]
lea ecx, [edx - 0x195d8249]
lea esi, [esi + edx + 8]
call fcn.00c555b4
Function at 0xaff5ba
Capabilities:
Encode data using base64

Disassembly:
call fcn.00b9f261
mov dword [esp], 0x54050696
jae 0xb5fbac
xor edi, edx
ror dword [esp], 0x8a
and edi, 0xff
sar word [esp], 0xa1
sar byte [esp + 1], 0x86
mov edi, dword [edi*4 + 0xa312f0]
shr dword [esp], 0xd3
shr edx, 8
inc word [esp + 1]
sal byte [esp + 1], 0x24
xor edx, edi
rol byte [esp + 1], 0xa2
inc eax
neg dword [esp]
setne byte [esp]
push 0x1892b112
xor edx, 0x4c8434ad
jmp 0xa6b601
sub ax, ax
bt eax, eax
inc ecx
rol al, 0xa6
add eax, eax
inc ax
ror ecx, 1
btc eax, 0x3d
sbb ax, ax
add al, al
xor ebx, ecx
shr eax, 0xd3
and ax, ax
adc edi, ecx
push 0xad93f494
mov ecx, dword [esp]
jmp 0xa0def1

Function at 0xb02a07
Capabilities:
Encode data using base64

Disassembly:
sbb cl, 0x95
mov eax, dword [ebp - 4]
xchg dl, cl
adc ebp, 0xfffffffb
jmp fcn.00b19c54
mov eax, 0xb4ae14bd
add ebp, 2
shl dx, cl
mov ecx, eax
not cx
push ecx
mov word [ebp], dx
btr cx, 0x1b
bswap eax
mov edx, dword [esi]
add cx, cx
sal eax, 0x56
dec eax
adc esi, 3
bt eax, 0xa7
rol eax, cl
xor edx, ebx
neg ax
not edx
neg ax
setb al
adc al, 0x8a
rol edx, 2
not edx
or byte [esp + 0xa], ch
jno 0xa92b0b
mov eax, dword ss:[edx]
movsx edx, cx
push ecx
mov dword [esi], eax
jnp 0x98292b
adc byte [ebp - 0x54add587], 0x20
jnp 0xb02a73
lea esi, [edx]
retf

Function at 0xb0d5cc
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x4bac69cb], esi
ret 8
lea eax, [ecx + ecx*8 - 0xb6d2743]
xor ax, cx
mov word [ecx + edi - 0x4bac69cb], dx
jno 0x97611f

Function at 0xb0d635
Capabilities:
Encode data using base64

Disassembly:
neg edx
xor ebx, edx
btr eax, eax
bts eax, eax
lea eax, [ecx + eax - 0x7841ffe1]
adc esi, edx
sar ecx, 0xee
neg eax
imul eax, eax
mov ecx, dword [edi + ecx - 0x1caca]
mov eax, dword [edi + 4]
push 0x13a3d003
rol byte [esp + 1], 1
call fcn.00aa4034
mov eax, 0x8e1c8a28
sar al, 0x47
mov eax, dword [ebp + ebx*4]
push 0xa539fdaf
ror dword [esp], 0x49
mov dword [esp], eax
je 0xba80fb
adc ebp, 5
push 0xd8042b9d
mov dword [esp + 4], 0x8791c6af
shrd edx, eax, cl
mov ecx, dword [esp + 1]
imul ecx, ecx
mov dword [ebp], edx
movzx edx, byte [esp + 4]
adc dword [esp + edx - 0xab], ecx
lea esi, [esi + edx - 0xb3]
dec dx
inc ecx
shl dword [esp + edx*2 - 0x15b], 0x9f
mov eax, dword [esi + edx - 0xae]
xor eax, ebx
rol eax, 2
sar edx, cl
or word [esp + edx*2 + 6], 0xecab
bswap eax
not ecx
call fcn.00c24cdd
sbb edx, 0xa68a40b6
mov dword [esp + ecx*2 - 0xe00202c], eax
dec ax
and dword [esp + ecx - 0x7001016], eax
not edx
dec ecx
pop eax
xadd ecx, eax
sbb edx, 0xb9bd1324
ror ecx, 0xf2
sal cx, 0x6e
jbe 0x9d3b08
push 0xb59f43b1
push 0xfe2e15a2
lea esp, [esp + 0x10]
jne 0xaf0807
call fcn.00ad331c
imul dx, dx
xor eax, 0x7aa7973c
and dword [esp], edx
dec dword [esp]
bswap eax
mov ecx, dword [esp]
xadd dword [esp], edx
ror eax, 1
mov byte [esp], 0xb4
imul ecx, ecx
neg eax
imul dx, cx
jb 0xba7ab5
insb byte es:[edi], dx
imul edi, dword [ecx + 0x2a], 0x7bdcef16
invalid
bswap eax
sub edx, edx
xor ebx, eax
dec byte [esp + edx*2 + 1]
dec ecx
add edi, eax
add edx, edx
mov dword [esp + edx], edi
ret
push 0x4a5632f
sbb dword [esp], 0x2c3859ad
dec ebx
call 0xb0d635
Function at 0xb0e8a6
Capabilities:
Encode data using base64

Disassembly:
call fcn.00a7dda8
add ax, ax
sbb dl, 0x7f
ror ax, 0xcb
mov dword [esp + eax - 0x41114601], eax
rol dl, 1
btc ax, ax
or eax, dword [esp + eax - 0x41114603]
xor bl, dl
rol ax, 0x8d
lea edx, [esp + edx + 4]
jb 0x9c5d7c
rol al, 0x62
xor eax, eax
mov byte [edx + eax], cl
lea edx, [eax*4 + 0x132fe599]
or word [esp + eax + 2], ax
mov dword [esp + eax], edi
ret

Function at 0xb12075
Capabilities:
Encode data using base64

Disassembly:
push ebp
pushfd
mov ebp, 0x5896f289
mov ebp, dword [esp + ebp - 0x5896f285]
mov dword [esp + 4], 0x137ee9
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00ac48e7
push 0xf10e7c24
lea esp, [esp + 8]
jmp 0xb0e87d

Function at 0xb17e13
Capabilities:
Encode data using base64

Disassembly:
bt dx, dx
inc edx
lea ecx, [edx + ecx + 0x730a4a98]
shl ax, 0xe2
bswap ecx
sbb ecx, 0x63182327
shr edx, 0x22
cmovne edx, eax
jb 0xbd7a90
xor ebx, ecx
shr edx, 0x23
imul eax
add edi, ecx
movsx ecx, dl
lea edx, [edx*8 - 0x62cce8d0]
rol eax, cl
movzx eax, byte [esi + edx - 0x12a6ba98]
lea esi, [esi + edx - 0x12a6ba97]
xor edx, 0x28b04b89
neg dx
xor al, bl
xor al, 0x1a
add dx, 0xef0a
jle 0xc25495
sar ecx, 0x41
mov eax, dword [ecx + ebp - 0x3fd95ddf]
mov dword [esp + edx - 0x80000000], edx
xchg byte [esp + edx - 0x7ffffffd], dl
xor eax, ebx
lea eax, [eax + ecx*4 - 0x294a6ce4]
neg eax
xor dword [esp + ecx - 0x3fd95ddf], edx
lea edx, [edx + ecx*2 - 0x2d4f3bf5]
not eax
neg eax
sar dx, 6
neg byte [esp + ecx*2 - 0x7fb2bbbe]
lea eax, [eax + ecx*2 + 0x33fd67ec]
call fcn.00aabba1
mov ecx, 0xac8f9a89
movsx edx, cx
mov ecx, dword [esi]
add esi, 4
bswap edx
lea eax, [edx + edx*4 - 0x1d58dc51]
xor ecx, ebx
xor ecx, 0x5c37150d
jmp 0xa78022
movzx dx, byte [esi + eax*2 - 0x40000002]
inc al
mov cl, byte [esi + eax - 0x20000000]
not ax
sar ax, 0x43
ror al, 1
imul edx, edx
adc al, 0x8a
sub edx, 0x3cb3cf8c
not edx
rol al, 1
inc edx
push edx
jno 0x970d8f
mov edx, dword [edi]
add edi, 4
push 0x7fb6ad25
xor edx, ebx
dec dword [esp]
not edx
ror edx, 1
sar dword [esp], 0xcc
jp 0x71224d

Function at 0xb1e1e4
Capabilities:
Encode data using base64

Disassembly:
dec ebx
push 0xe2bfbf0b
lea esp, [esp + 8]
jne 0xabb85f

Function at 0xb1e1ff
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + 8], 0x35ab2b7b
dec eax
lea esp, [esp + 8]
call fcn.00b6e24b
Function at 0xb21882
Capabilities:
Execute syscall

Disassembly:
sub ecx, ecx
ror dl, 1
mov dword [esp + ecx], ecx
neg dl
dec ecx
bswap ecx
jns 0xb4cce9
xor bl, dl
dec dword [esp]
lea edx, [esp + edx + 4]
shr byte [esp + 1], 0xe6
jns 0xb4a9b0
inc esp
mov eax, dword [ebp]
call fcn.00c373f6
mov esp, 0x99e4fdf2
pop ecx
mov dword [0xe3eb8209], eax
enter 0x10a, 0xffffffffffffffb1
das
dec eax
enter 0x10a, 0xffffffffffffffb7
xor eax, 0x10ac864
cdq
sbb ah, ch
cli
add ecx, eax
jle 0xb218df
jne 0xb21937
invalid
lahf
or ch, bl
int3
dec ebx
sar byte [eax + 0x3a], 4
sub byte [edi - 0x40], dl
js 0xb2197c
sbb esp, dword [edi + eax*2]
sar byte [eax + 0x3a], 0x2e
cmp dh, dh
cmp bh, bh
push eax
mov bl, 0xe
std
push cs
xchg esi, eax
adc dl, 0x46
and edi, ebp
invalid
sar byte [edi - 0xec68dd], cl
and esp, ecx
cmp edi, dword [ecx - 0x2a703101]
mov edi, 0xddb45982
and al, 0x2b
and al, byte [eax + 0x51]
invalid
neg dword [esp]
mov dword [edx], eax
pop ecx
jmp edi
or dword [esp + ecx*8 - 0x4400064], ecx
bswap ecx
pop eax
pop ecx
jno fcn.009570bc
syscall
push edi
dec eax
mov dword [esp], 0xb5b53134
call fcn.00b6e24b

Function at 0xb2549c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
pushfd
mov ebp, 0xbb1dda02
lea ebp, [ebp + ebp - 0x54fbf1dd]
push edi
mov ebp, 0x29a0083c
call fcn.00b2e5a2

Function at 0xb256e7
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + esi*2 - 0x1ff58], ebx
dec eax
inc cx
shr edi, 0x4a
bt edx, ecx
inc esp
xor dword [esp + esi*2 - 0x1ff58], esi
inc ecx
shl eax, 0x4c
pop ebx
dec ebp
arpl si, si
dec eax
cdq
push ecx
dec ebp
add ecx, esi
sal eax, 0x88
inc ebp
mov ebx, ebp
dec eax
sal dword [esp + esi*2 - 0x1ff58], 0xd8
inc esp
mov ebx, dword [ebp + esi*4 - 0x3feb0]
dec eax
lea ebp, [ebp + esi - 0xffa8]
dec eax
cdq
inc esp
xor ebx, ebx
inc ecx
rol ebx, 3
inc esp
movsx esi, word [esp + esi - 0xffaa]
xor byte [esp + esi - 0xffac], 0x18
inc ecx
sbb ebx, 0xcbb55291
inc ecx
rol ebx, 3
dec eax
ror esi, 0xb9
inc ecx
adc al, 0x80
js 0xa6d1a6
call fcn.00972cc0
xor cl, 0x98
push eax
btr eax, eax
xor bl, cl
lea ecx, [esp + ecx + 0xc]
mov dword [ecx + eax - 0x57e478fb], edx
lea edx, [eax*8 + 0x16a6bebd]
call fcn.00a716a5

Function at 0xb2b038
Capabilities:
Encode data using base64

Disassembly:
shl dword [esp + 4], 0xe4
neg cl
shr dl, 0x66
xor bl, cl
lea ecx, [esp + ecx + 8]
sub dl, dh
mov dword [ecx], eax
mov eax, dword [edi + 1]
mov ecx, dword [esp + 4]
rol word [esp + 6], 0x82
xor eax, ebx
push edx
and word [esp + 5], dx
inc eax
shl ecx, 0x5e
ror eax, 1
rol ecx, 0x2d
not byte [esp + ecx*2]
dec eax
add ecx, ecx
call fcn.00c48707
ror edx, 0xf6
not cl
mov dword [esp + edx - 0x5cbe3978], 0xc79bd6b3
shl edx, 0xca
imul edx, edx
adc cl, dl
neg byte [esp + 4]
neg cl
not cl
jmp 0xa81330

Function at 0xb2da2f
Capabilities:
Encode data using base64

Disassembly:
adc eax, edx
mov dword [esp], 0xb7365f83
jmp 0xb066b7
Function at 0xb31acc
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [eax + ebp + 4]
sar eax, 0x6e
shr edx, cl
mov dword [eax + ebp + 2], edx
movzx edx, ax
inc eax
xor edx, dword [ebp + eax*8 - 6]
bswap eax
movzx ecx, ax
bt ax, ax
lea ebp, [ebp + eax*2 - 0x1fffffa]
sar ecx, 0x2e
lea ecx, [eax*8 + 0x50cd385]
movzx eax, byte [eax + esi - 0x1000005]
dec ecx
dec cx
add cx, cx
lea esi, [ecx + esi - 0xd0ca70b]
push ecx
adc cl, ch
xor al, bl
add cl, byte [esp + ecx*2 - 0x1a194f5a]
xor al, 0x18
xor dword [esp + ecx - 0xd0ca7ba], ecx
add ecx, 0xfc09e825
or cx, cx
rol al, 1
add cl, byte [esp + ecx*8 - 0x48b47ef6]
btr ecx, 0x88
not al
dec cl
jns 0xbd798b
shr cx, 0xcd
rol al, 1
bt ecx, ecx
mov dword [esp + ecx - 0x9160004], 0xc79c6cbd
xor al, 0xa
neg cx
setbe byte [esp + ecx - 0x916fffc]
add ecx, ecx
inc al
bt cx, 0x1c
jae 0x9e03c3
xor bl, al
ror ecx, cl
lea eax, [esp + eax + 4]
mov dword [eax + ecx*2 - 0x5bfff024], edx
xor ecx, dword [esp + ecx*2 - 0x5bfff024]
jne 0xb98cac
mov eax, 0x31aeb582
call fcn.00a0d7b0
xor eax, ebx
not ecx
and ecx, edx
sar edx, cl
not eax
call fcn.009c3a56
mov ecx, 0x80aca0b
call fcn.00b7501a
mov eax, 0xa80f5a0
cdq
rol dl, 0xe7
mov ecx, dword [esi + eax - 0xa80f5a4]
setb dl
xor ecx, ebx
sal edx, 0x10
xor ecx, 0xb21e3bae
ror ecx, 2
push edx
shr edx, 0xce
pop edx
xor ecx, 0xb19b1a24
rol ecx, 1
xor ebx, ecx
div eax
sub eax, 0x13815400
add edi, ecx
rol dx, 0xe7
movsx ecx, dl
adc edx, dword [ebp + edx*2]
xchg ecx, eax
jmp 0x9bff7c
pushfd
add dword [esp + 4], 0xff4dae93
mov dword [esp + 4], 0x601561fc
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00ac48e7
mov edx, 0x16398c22
mov eax, dword [ebp + edx*4 - 0x58e63088]
lea ebp, [edx + ebp - 0x16398c1e]
lea ecx, [edx - 0x35f4937c]
sub edx, 0x3d002b0a
jle 0xaebdb5
push ecx
btc eax, ecx
xor ebx, edx
add esi, edx
cbw
mov dx, word [eax + ebp - 0x10]

Function at 0xb36c99
Capabilities:
Encode data using base64

Disassembly:
rol edx, 0x79
bswap eax
inc ecx
mov dword [esp], edx
sar edx, 0x8d
not eax
dec eax
call fcn.00ab2b08
inc bx
Function at 0xb3775a
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ebp + eax - 0x6fe4b8bf]
xor ecx, ebx
jmp 0x9c7e2c
neg ecx
jmp 0xbd7a56
mov eax, 0xc8be413b
not ecx
rol ax, 8
lea edx, [eax + eax*4 + 0x5130b520]
imul dx
mov dword [ebp + edx*2 - 0x79cfeffa], ecx
jno 0x70b2a7
jo 0xb8e069
mov edx, 0x211e9f3d
movsx ecx, dl
dec cx
mov ax, word [esi + edx - 0x211e9f3d]
push ecx
ror dword [esp + edx - 0x211e9f3d], 0x9e
mov cl, byte [edx + esi - 0x211e9f3b]
add dx, word [esp + edx*2 - 0x423d3e79]
js 0xbd55ab
mov dword [esp + edx - 0x3ce7f7fd], edx
mov dword [esp + edx*2 - 0x79cfeffa], esi
ret
lea esi, [esi + edx*2 - 0x423d3e78]
inc byte [esp + edx - 0x211e9f3b]
shr ax, cl
mov word [esi + edx*2 - 0x423d3e7a], ax
sar dword [esp + edx*2 - 0x423d3e7a], 0x83
mov ecx, dword [ebp + edx - 0x211e9f3d]
push edx
lea ebp, [edx + ebp - 0x211e9f39]
bts edx, 0xb8
sar edx, 4
xor ecx, ebx
ror ecx, 2
mov eax, 0x35bc9638
inc ax
dec dword [esp + edx - 0x211e9f2]
dec ecx
ror al, 0xe1
btr eax, edx
xor ecx, 0xf9104435
neg ecx
and edx, eax
shr edx, 0x8d
xadd dword [esp + edx*2 - 0x104], eax
xor ebx, ecx
add edi, ecx
mov dword [esp + edx*2 - 0x108], edi
ret 4
lea edx, [eax + eax*2 - 0x796593d9]
shl dx, 0x8f
bswap ecx
setp al
xor ecx, 0x3e2af3a3
bswap eax
mul dx
dec ecx
btc edx, 0x34
imul eax
adc ax, ax
xor ebx, ecx
ror eax, 0xa3
bswap edx

Function at 0xb3f593
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jne 0xa780a3

Function at 0xb42a56
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0x3cd0fe42], edx
neg eax
sub dword [esp + ecx*2 - 0x79a1fc84], edx
shl dword [esp + ecx - 0x3cd0fe42], cl
add ecx, ecx
rol eax, 1
ror cx, cl
sar cx, cl
neg edx
not eax
xadd byte [esp + ecx - 0x79a1004d], ch
not cl
xor ebx, eax
lea ecx, [ecx + ecx*2 - 0x44ced979]
imul dx, word [esp + ecx - 0x28142895]
adc edi, eax
movsx eax, word [esp + ecx*2 - 0x5028512e]
mul eax
btr eax, edx
mov cx, word [esi + ecx*2 - 0x5028512e]
pop eax
xchg dx, ax
add dx, word [esi + edx*2 + 2]
call fcn.00a4f6c7
Function at 0xb47bbd
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, byte [edi + edx - 0xf3]
sbb edx, 0x50a04abb
btr edx, edx
xor cl, bl
inc cl
mov dword [esp], edx
rol word [esp], 0xad
xor cl, 0xb4
rol cl, 1
and dword [esp], edx
not edx
not cl
xor cl, 0x98
shl word [esp + edx - 0x50a049c6], 0xc2
neg dx
xor bl, cl
inc edx
neg dl
add edx, dword [esp + edx - 0x50a0b6c7]
lea ecx, [esp + ecx + 4]
call fcn.00b884ff
loope 0xb47bd2
jge 0xb47c3b
arpl word [edx - 0x7b01808a], bx
pop ebx
mov byte [0xe4fe7f76], al
cmp dword [edx + 0x76], 0x7f
invalid
mov bl, 0xac
invalid

Function at 0xb47e06
Capabilities:
Encode data using base64

Disassembly:
bswap eax
mov dword [esp + edx - 0xba66899], edx
inc eax
sar dword [esp + ecx - 0x5efb6000], 0x2b
jae 0xaba317
Function at 0xb50631
Capabilities:
Encode data using base64

Disassembly:
rol dword [esp + edx - 1], 0x57
call 0x9ca851
and edi, 0xff
push 0x9ba118b0
dec word [esp + 1]
jno 0xc29fc5
mov ecx, 0x5cab6baf
lea esi, [esi + ecx - 0x5cab6bb3]
mov eax, dword [esi + ecx - 0x5cab6baf]
not cx
sal ecx, cl
xor eax, ebx
movzx edx, cx
shr ecx, 0x19
imul ecx, edx
not eax
sal cx, 0xe3
lea eax, [ecx + eax - 0x6385118d]
shl cl, 0xe4
rol eax, 3
lea eax, [eax + ecx*2 + 0x7e07a20d]
xor ebx, eax
not cl
neg dx
adc edi, eax
mov eax, dword [ebp + ecx*8 - 0x7f8]
inc edx
lea ebp, [ecx + ebp - 0xfb]
btr dx, dx
sal ecx, 0x2e
adc cl, 0x8b
sbb esi, edx
push ecx
movzx ecx, byte [esi + ecx - 0x3fc08b]
jmp 0xa1ff2a
mov edi, dword [edi*4 + 0xaea9f4]
push 0x96977510
or dword [esp], 0x6c10a0b8
jge 0xb7d134
shr edx, 8
ror dword [esp + 4], 0xcf
shl word [esp + 3], 0xd
mov dword [esp + 8], 0xc5906caf
xor edx, edi
or word [esp + 5], 0xb729
push 0x42ae9985
jle 0xc5fcc6
lea ebp, [ebp + edx*4 - 0x3ab00004]
mul eax
mov eax, dword [ebp + edx*4 - 0x35d4950]
xor eax, ebx
mov ecx, edx
btc dx, 0x3d
sbb eax, 0xcf15e10d
neg eax
ror dl, 0x41
inc eax
imul ecx, ecx
not eax
jo 0xb5800f

Function at 0xb7a190
Capabilities:
Execute syscall

Disassembly:
xor ecx, ebx
rol ecx, 2
sar word [esp + 2], 9
setbe byte [esp + 1]
not ecx
push 0x5b841335
sbb ecx, 0x5e2e66a0
pop eax
ror ecx, 3
inc ecx
cwde
neg byte [esp + eax*2 - 0x2667]
mul eax
xor ebx, ecx
ror eax, 0x4b
adc edi, ecx
mov dword [esp + eax - 0x1f202e1d], edi
ret
mov eax, ebp
call fcn.009acc1f
mov edx, 0xf8101211
mov dx, word [ebp]
mov eax, 0x4ba1e0b2
movzx ecx, al
mov ax, word [eax + ebp - 0x4ba1e0b0]
bts ecx, 0xaf
and ecx, 0xf0aeef13
add ecx, ecx
lea ebp, [ebp + ecx - 0x10022]
push ecx
bts ecx, 0x83
not dx
not ax
sar cl, 0xe5
or dx, ax
mov word [ebp + ecx*8 - 0x80008], dx
lea esi, [ecx + esi - 0x10005]
jmp 0xb018a1
shr dword [esp + ecx*2 - 0x20002], cl
mov ecx, dword [ecx + esi - 0x10001]
jp 0x9689ca
cbw
shl edx, 2
ror eax, 0x5c
jb 0xae7fe6
Function at 0xb7c7c2
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esi + ecx*4 - 0x34c77608]
movsx edx, cx
xor eax, ebx
lea ecx, [ecx + edx*4 + 0x71852417]
call fcn.0099c15b
mov eax, edx
sub word [esp + edx*4 - 0x16484c03], 0x8996
lea ebp, [ebp + edx*2 - 0xb242606]
bswap edx
mov dword [edx + ebp - 0x1139205], ecx
pop edx
pop ecx
jg fcn.009ca7a3
mov ecx, 0xd31dd82
lea esi, [esi + ecx*2 - 0x1a63bb08]
movsx eax, cx
inc eax
jl 0x9b6d90
bts cx, cx
xor eax, 0xd48d9b99
mov dword [esp + edx*2 - 0x3a080a5c], ecx
shr byte [esp + edx - 0x1d04052e], 1
sbb eax, 0xf08c7629
xor edx, 0x843d888c
not dx
shl edx, 0x61
xor eax, 0x55af3a83
pop edx
bswap eax
call fcn.00b1215e
inc esp
mov edi, ecx
inc esi
xor dword [esp + esi - 0x27212e94], ebx
sal dx, cl
inc ebp
btr edi, edi
pop ebx
inc ebp
movsx ebp, si
not eax
dec eax
mul edx
dec ebp
arpl bx, bx
or ecx, 0x5f0efe89
cwde
inc ebp
movsx esp, ch
dec ebp
adc ecx, ebx
shl al, 0x61
dec edi
lea ebx, [edi + edi + 0x1b857389]
rdtsc
inc ecx
and esp, 0x8c952910
push ecx
dec edx
lea esi, [edi*2 + 0xb35218]
dec edi
lea edx, [edx + esi - 0x27212e9c]
dec edx
sbb esi, dword [esp + esi - 0x27212e94]
inc ecx
inc bh
inc ebx
mov dword [edx + ebp - 0x2e90], eax
inc edx
movsx eax, word [esp + esi - 0x27212e90]
inc esp
xadd bh, ah
inc edx
sal dword [esp + ebp - 0x2e92], 0xef
inc ebx
mov dword [edx + esi*2 - 0x4e425d28], edx
dec ecx
bts esi, 0x1a
inc ecx
shr esp, cl
dec ebx
lea edi, [esi + esi*8 + 0x4c8447b6]
pop edx
jp fcn.00a7cd20
mov ecx, 0x9522c928
lea edx, [ecx*8 - 0x66d2f2e0]
mov eax, dword [edx + edi - 0x42435660]
shr ecx, cl
mov cl, byte [edi + ecx - 0x9522c5]
lea edx, [edx*4 + 0x720b2482]
lea edi, [edx + edi - 0x7b187e00]
je 0x9eeb09
shr edx, 0xf5
shr eax, cl
movsx ecx, dx
bswap edx
mov dword [edi + ecx*2 - 0x7b0], eax
xadd dl, dh
mov edx, dword [ebp + ecx*2 - 0x7b0]
xor cl, ch
movsx eax, cl
sal ecx, 0x55
lea ebp, [ebp + ecx - 0x7b5ffffc]
bts ax, ax
xor edx, ebx
ror cx, 0xaa
idiv al
lea edx, [edx + eax - 0x39bf9400]
shl al, 0x25
shr ecx, 0x31
xor edx, 0x93ad299b
ror eax, cl
xor ecx, eax
lea edx, [edx + ecx*4 - 0x73911e3c]
btc ax, ax
rol edx, 1
bt eax, 4
bt ax, ax
btr eax, eax
neg edx
bts ax, cx
sbb edx, 0xc1282c05
shr al, 0x41
xor ebx, edx
sar ecx, cl
add esi, edx
dec al
movsx edx, cl
mul cl
jmp esi

Function at 0xb8fffe
Capabilities:
Encode data using base64

Disassembly:
inc cx
sar eax, 2
inc esi
xor dword [esp + edi - 0x1b9ecb83], esi
jmp 0xbfb648
inc ecx
mov eax, 0x8888a294
inc ecx
dec esi
inc ecx
xadd ebp, ecx
inc ecx
xor esi, 0x3b0959a
dec edx
mov dword [esp + edi*2 - 0x373d9706], edi
inc dx
rol dword [esp + edi*2 - 0x373d9703], 0xe7
inc ecx
rol esi, 3
dec edx
mov dword [esp + edi - 0x1b9ecb83], ebx
inc ecx
imul esi, edi
jb 0xa6d035
add ebx, esi
in al, dx
pop ebp
frstor dword [esi + 0x693d2524]
frstor dword [esi + 0x61322924]
frstor dword [esi - 0xed4c2dc]
push esi
and al, 0xa9
mov ecx, 0xf25abeeb
mov edi, fs
mov ebx, 0xc8f7637
stosb byte es:[edi], al
jl 0xb9006d
jae 0xb90030
les esi, [ebp - 0x56]
in eax, dx
jmp 0xe3a4155
inc eax
or dword [0xeaff7256], 0x795e41c
das
ret
call fcn.009c6f99
Function at 0xb99887
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], 0x71af435
lea esp, [esp + 8]
call fcn.009c52c1
inc bp
mov ebp, edi
inc esp
movsx esi, byte [esp + eax - 0xffac]
movzx ecx, byte [eax + ebp - 0xffaa]
dec eax
lea ebp, [eax + ebp - 0xffa9]
inc ecx
add esi, 0x933c5532
xor cl, bl
inc ebp
xchg bl, dh
dec esp
lea edi, [esi + esi*8 - 0x2e54b2ce]
cbw
not cl
inc ecx
div esi
shr word [esp + edx - 0xffaa], 0x68
cdq
neg cl
inc ecx
idiv edi
inc eax
not bh
sub cl, 0x1b
inc sp
sub ebx, dword [esp + eax*2 + 3]
xor cl, 0x3a
inc eax
imul bh
inc cx
idiv esi
dec ecx
bswap esp
xor bl, cl
call fcn.00b96856
inc ecx
mov ebp, 0x460ef734
inc ecx
movzx edx, bp
dec ebp
mov eax, edx
dec edi
lea ebx, [ebp + ebp + 0x3c9bd601]
dec ebp
lea edx, [edx + edx - 0xf736]
dec ecx
btr ebp, edx
inc cx
and ebx, 0xbe0ffa1d
cli
inc di
mov dword [edx + ebp - 0x460ef734], eax
dec eax
lea eax, [edx*8 - 0x396dfa77]
inc ebp
movsx eax, bx
inc ecx
ror eax, 0xff
inc esi
mov ebp, dword [ebp + ebp - 0x460ef734]
inc esp
mov esi, eax
dec ecx
lea ecx, [esi + eax*2 - 0x7cfdb74d]
dec eax
inc edx
dec eax
lea ebp, [ebp + edx - 0xf731]
dec ebp
add eax, esi
jge 0xa72551
push 0x49962c21
mov dword [ebp - 4], eax
call fcn.00aa28b7

Function at 0xb9af87
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp]
lea edi, [edi + eax + 1]
call fcn.009bf355
syscall
push 0x5c951e16
dec eax
mov dword [esp], 0x35aa305b
call fcn.00b6e24b
mov edx, 0x2e346d3e
mov edx, dword [esi + edx*2 - 0x5c68da7c]
add esi, 4
mov ecx, 0x1e20f83f
push ecx
xadd cl, ch
xor edx, ebx
xchg byte [esp + ecx*4 - 0x7880fcdc], cl
neg edx
xchg byte [esp + ecx - 0x1e203f3c], cl
movsx eax, cx
shr eax, 0x12
inc edx
ror ecx, cl
xor edx, 0x852b579e
and word [esp + eax*4 + 2], cx
adc cx, 0x298c
sbb edx, eax
not edx
shr word [esp + ecx - 0x78802604], 7
ror cx, cl
dec edx
sub ecx, eax
rol ax, 0xcd
xor edx, 0xbfbb34
sub al, byte [esp + eax*4]
ror ecx, 0x1e
rol edx, 2
jmp 0xb14bd4
inc edx
bswap edx
inc edx
xor ebx, edx
shr byte [esp + eax - 0xd], 0x81
adc edi, edx
movzx edx, byte [esp + eax*4 - 0x40]
ror edx, 0x24
inc dword [esp + eax*4 - 0x40]
mov ebp, dword [ebp + eax*4 - 0x40]
or dx, ax
or al, al
pop edx
jge fcn.009ca7a3
call fcn.00b7c7c2
mov edx, 0x12a3a132
or dx, dx
je 0x952527
mov cx, word [edi + edx*2 - 0x25474264]
sbb edx, edx
push edx
adc dx, word [edx + edi + 2]
inc dword [esp]
jns 0xae5763
rol edx, cl
jae 0xb47549
not eax
adc eax, 0x3919d102
xadd dl, dh
neg dl
btr cx, cx
ror eax, 1
btc cx, dx
or dl, 0x10
xor eax, 0xb209c726
mov dword [esp], ecx
neg word [esp + 1]
xor ebx, eax
sal word [esp], 3
xchg byte [esp], cl
shr ecx, 0xc1
adc edi, eax
rol ecx, cl
pop ecx
jb fcn.009fa672
sub ecx, dword [ebx]
xor eax, 0x72dcd4fc
push 0x52
add dl, ch
call 0xc8c19a16
xchg esi, eax
out dx, al
dec ebp
mov word [ecx], ds
push ebx
cmp byte [ecx - 0x36218ea5], dl
or byte [eax - 0x52f7ff6f], cl
mov byte [0x5e84c000], al
invalid