joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd99b41
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov eax, ebp
mov dword [esp], 0x3ca1bb89
add eax, edx
jmp 0xe82bc4

Function at 0xd9f50d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xd910ee89
dec byte [esp + 2]
mov dword [esp], eax
jge 0x133d291
mov eax, 0x7c2e6996
shr eax, 0x8b
lea ebp, [eax + ebp - 0xf85d1]
lea ecx, [eax + eax + 0x3c8057b6]
mov eax, dword [eax + ebp - 0xf85cd]
xor eax, ebx
movzx edx, cl
sub eax, 0xe7bd09a2
neg eax
or ecx, edx
setno cl
cmovb ecx, edx
not eax
and edx, 0x75390423
and dl, dl
je 0xe9b680
cli
call dword [edx]
push eax
push edx
fisub dword [ebx + 0x6f]
not ebx
pop eax
xchg ebx, eax
mov edi, 0x604034c0
mov bl, 0xe0
stosb byte es:[edi], al
cmp al, 0xba
test dword [ebp + 0x77e566cc], 0x833767af
mov ebx, 0x34c3c170
adc byte [ebx - 0x6d], dh
adc al, 0x22
movsb byte es:[edi], byte [esi]
lahf
push ds
std
popfd
bsr edx, dword [edx + 0x12]
adc dh, bl
jmp 0x1c1ca058
dec eax
jmp 0x11daf38
or ecx, ecx
rol eax, 3
neg dx
shr ecx, 0x98
xor ebx, eax
ror edx, 0x74
and dx, dx
xchg cx, dx
adc esi, eax
mov eax, 0xd3b1bb9d
mul cx
and cx, 0x9d88
adc al, byte [edi + ecx]
bts cx, 0x11
not ecx
setae cl
mov cl, byte [edi + edx*4 + 2]
lea edi, [edi + edx*8 + 2]
jb fcn.01241d6c
jae 0x1ab50b8
adc al, 0x29
invalid
shl al, cl
mov word [edi + edx*8], ax
ror edx, 0x83
lea ecx, [edx*4 + 0x26a279aa]
adc edx, esi
jmp edx

Function at 0xde877b
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0x7d25f925
inc eax
shr ecx, 0x88
xor edx, edx
dec cx
not eax
neg cx
adc dx, 0x8daa
lea eax, [edx + eax + 0x3e094ff6]
xor ebx, eax
xor cl, dl
xor dx, cx
adc ebp, eax
mov edx, dword [edx + esi - 0x72ef]
shl cx, 0xe5
mov ecx, dword [ecx + esi - 0xe87c]
mov eax, 0xb2aeb49e
sub eax, 0x7badc011
neg ax
lea esi, [eax + esi - 0x37000b6b]
sal ax, 0x44
mov dword fs:[edx + eax*2 - 0x6e016e60], ecx
lea eax, [eax + eax + 0x51340720]
jmp ebp
movsx edx, cl
mov dword [edi + ecx - 0x100100fe], eax
add dx, 0xdcb9
sar dx, cl
mov eax, dword [ecx + ebp - 0x10010102]
sar ecx, 0x3c
lea ebp, [ecx + ebp + 3]
ror dl, cl
xor eax, ebx
jmp 0x132acb3
sal cx, cl
imul ecx, ecx
lea eax, [eax + edx*2 - 0x6d32027d]
xor ebx, eax
lea ecx, [ecx*4 - 0x7043d248]
add edi, eax
shl cl, 0x66
jbe 0x132a0f4
mov edx, 0xd916123d
movzx eax, dx
mov eax, dword [edi + eax*2 - 0x247a]
add edi, 4
xor eax, ebx
movzx ecx, dx
dec edx
jp 0xd7e699
in eax, dx
xor al, ch
sub bl, bh
sub ebx, edx
push cs
enter 0xffffffffffffb909, 0xffffffffffffffd1
push eax
and dh, byte [eax - 0x17dbbb06]
cld
mov ecx, 0x2cb723ad
movzx eax, cl
add ax, ax
mov ecx, dword [edi + ecx - 0x2cb723ad]
sub ax, ax
sub ax, 0x1790
shl ax, 0x8a
mov eax, dword [edi + eax*2 - 0x17ffc]
mul ecx
mov ecx, 0x9b03c113
mov dword [edi], edx
and ecx, 0x308131aa
jge 0xda37c4
mov dword [esp + edx - 0x46220080], 0xbaa0799
mov dword [esp + edx - 0x46220080], edi
ret 8
ror eax, 3
neg cl
lea eax, [eax + edx + 0x3eb91a13]
or dx, 0x2c01
bswap eax
inc edx
xor eax, 0xdbb668bd
inc ecx
inc eax
xchg ecx, edx
xchg ecx, edx
xor ebx, eax
add esi, eax
jmp esi
Function at 0xde9e81
Capabilities:
Encode data using base64

Disassembly:
push 0xd33ee2b1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
pop esi
lea esi, [esi*8 + 0x35ac4d2f]
push esi
pushfd
pop esi
mov dword [esp], esi
call fcn.0124a52b

Function at 0xde9ea2
Capabilities:
Encode data using base64

Disassembly:
jg 0x128aca6
mov al, 0xdc
adc edi, ebx
and eax, 0x994b470
xchg ebp, eax
pop esi
enter 0xffffffffffff8200, 0x79
cmp al, 0x92
or dword [ebp - 0x7dff37a2], edx
jns 0xde9ef4
xchg edx, eax
pop edi
add ch, byte [edi + 0x4f]
out 0x77, eax
add dword [0x658e3711], eax
jae 0xde9f3a
adc dword [edi], esi
mov fs, word [ebp + 0x73]
jae 0xde9eb0
call 0xe3c8bda2
or dword [edi], esp
jp 0xde9f19
salc
push ds
ljmp 0xab49
stosd dword es:[edi], eax
xlatb
dec edi
xchg ebx, eax
loopne 0xde9ec1
xchg esp, eax
imul eax, dword [esi + edi - 0x230ae654], 0x54
xchg esp, eax
xor bh, byte [esi - 0x255496b6]
add dword [edx + esi + 0x1f6d3440], ebx
or ebx, esi
xor byte [edi + 0x67], 0xb8
cmp cl, 9
fstpnce st(6), st(0)
dec edx
fidiv dword [esi - 0x4afe6896]
cmp ecx, esp
rcr dword fs:[ecx - 0x14], 0xf0
or eax, 0x64bfe026
shl dword [ecx], 1
and edi, dword [esi]
pop ss
xor al, 0x16
invalid
stc
or ecx, ebx
fimul word [edx - 0x26]
mov dh, 0x6a
xchg edi, eax
add dword [ebp - 0x3e9b33c5], esi
pop ecx
in al, dx
invalid
mov al, byte [0x276ce037]
and ah, byte [edi - 0x210168d8]
or byte [esi], bh
aad 0xc7
cmp dword [eax - 0x3f], esp
sbb ah, dh
push ss
aaa
mov cl, 0xe7
xor al, 2
xchg edx, eax
loope 0xde9f87
xchg esi, eax
out 0x9a, al
paddb mm6, qword [ecx - 0x7a]
scasd eax, dword es:[edi]
push ds
invalid
dec edi
clc
or eax, 0xd7116a0e
push edi
daa
imul esi, ecx, 0xffffffd3
or al, 0xfb
sbb dword [ecx - 0x27], edi
scasb al, byte es:[edi]
cmp dword [ebx - 0x15], edx
sbb dword [ecx], 0xf50c6f27
mov ch, byte [ecx - 0x60b70bb3]
sahf
or esi, esi
invalid
call fcn.0133d386
adc ebp, 6
mov dword [esp], 0xef196100
call fcn.00eba047
mov eax, 0x430c3cba
mov eax, dword [ebp + eax - 0x430c3cba]
jmp 0xebb1e1

Function at 0xe0d995
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov dword [esp + ebx*8], edi
dec ebp
adc esp, eax
dec eax
shr dword [esp + ebx*2], 0x71
movzx ebp, bx
dec esi
lea ebx, [ebx + ebx - 1]
push ecx
je 0x12b2021
in eax, dx
xor al, ch
sub ah, ch
sub edi, edx
add edi, ecx
or dl, byte [edx + ecx*8 - 0x124be2b7]
imul edi, dword [ecx], 0xffffffe9
xchg ecx, eax
mov ch, 0xda
aas
invalid

Function at 0xe14404
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x913441be
mov esi, 0x5680d7ac
sub ebx, ecx
lea esp, [esp + 4]
mov ecx, 0xdb82c803
lea eax, [ecx - 0x7549675]
shl ecx, cl
lea esi, [0xe14414]
ja 0xf3cbc5
mov edx, dword [edi]
adc edi, 4
and eax, eax
btc ax, 0xac
xor edx, ebx
cwde
sal ecx, 0x77
bt cx, ax
bswap edx
or cx, 0xb800
lea ecx, [eax*4 - 0x3e70c866]
ror edx, 2
push eax
rol dword [esp + eax - 0x218e], cl
lea ecx, [ecx*4 - 0x33c26ed8]
inc edx
neg edx
cwde
neg eax
sal eax, 0xb0
not edx
adc edx, 0x717ec17
not dword [esp]
shr ecx, 0xd1
xor ebx, edx
Function at 0xe251a6
Capabilities:
Packed with generic packer

Disassembly:
call 0xe8f856
add edi, 4
jmp 0x13eddb5
mov eax, edx
mov dword [eax + edi - 0x580b7010], ecx
jmp esi
xor ecx, ecx
test edx, edx
lea esp, [esp + 8]
je 0xfe346f
push 0xeeb9ac8c
mov dword [esp], edi
mov edi, 0xee3ec221
movzx edi, byte [eax]
jmp 0x1015fbb
mov edx, 0x580b7010
not ecx
jmp 0xea9d2c
push 0x941e202a
jmp 0xf20287

Function at 0xe36df2
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0xc], 0x690f7c9a
not ecx
inc ecx
pop edx
not ecx
call fcn.012fc2e5

Function at 0xe389f2
Capabilities:
Encode data using base64

Disassembly:
bswap edx
or cx, 0xd309
xchg dword [esp + eax*2 + 4], eax
xor ebx, edx
add ebp, edx
and ecx, 0xcf1a7d8e

Function at 0xe3a153
Capabilities:
Encode data using base64

Disassembly:
test ebx, ebx
push 0x203c7889
push 0xb91ee018
lea esp, [esp + 0x18]
je 0x1288d55
mov eax, dword [ebp + ebx*4]
push eax
push 0xc1b2ea15
mov eax, dword [ebp]
push 0x26936d09
lea esp, [esp + 8]
call eax
mov ebx, 0xeab43437
mov ebp, dword [ebp - 4]
lea edi, [ebx + ebx + 0x52b68c0f]
lea esi, [edi*2 - 0x6358d7da]
movsx edx, di
mov dword [edi + ebp - 0x281ef47d], eax
mov eax, edi
mov esi, ebp
pop ebx
movzx ebp, ax
lea ecx, [eax + edx*4 + 0x779b5204]
pop edi
btr ecx, eax
or ebp, eax
pop ebp
bswap eax
jmp edi

Function at 0xe50938
Capabilities:
Encode data using base64

Disassembly:
inc dx
bswap ecx
not ecx
call fcn.00fedd38

Function at 0xe5bcf4
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
mov dword [esp], 0x1f38b7a6
inc esp
and al, 0
cmpsb byte [esi], byte es:[edi]
mov bh, 0x38
pop ds
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x13a389c]
sal dword [esp], 0x4f
not word [esp + 1]
push esp
and al, 1
shr eax, 8
push 0xc2a4e01b
push 0xcc25f195
dec word [esp + 7]
xor eax, ebx
push 0xe69e7e87
inc ecx
rol byte [esp + 3], 7
push 0x5b3465b4
xor eax, 0x3e927228
call fcn.00e19151
out dx, al
xor eax, eax
cmp eax, 0x2fd3edb
ror dword [edx], 1
mov ch, 0xd7
cmp eax, 0x79437e92
or eax, 0xf77f66be
test esp, edx
jp 0xe5bcf7
add dl, cl
or dh, byte [ebp + 0x7e923dd7]
inc ebx
jns 0xe5bd62
mov esi, 0x85f77f66
aam 0x7a
lcall 0xcec9, 0xd475853d
cmp eax, 0xc9d47585
into
add al, byte [ebp - 0x6650a4c5]
js 0xe5bd4a
cmp ah, byte [edi*2 - 0x2a0d66f8]
jp 0xe5bd12
dec edi
sbb eax, 0x41205fd
sub ch, byte [ecx]
invalid
Function at 0xe6074f
Capabilities:
Encode data using base64

Disassembly:
xor ebx, ecx
sar eax, 0xd0
lea eax, [eax*8 + 0x3600e614]
adc ebp, ecx
sar dl, 0x21
dec word [esp + eax - 0x3600e610]
btr eax, 0x29
pop eax
pop eax
pop ecx
jb fcn.00fa3814
sub edi, 4
movsx eax, dl
rol dx, 1
adc edx, eax
mov ecx, dword [edi]
mov dword [esp], eax
or ax, word [esp + 2]
jne 0xf0746b
mov eax, 0xb486d410
and al, al
push eax
mov edx, dword [edi]
adc eax, 0x1f2a79b8
sets al
adc edi, 4
sub eax, eax
movzx ecx, ax
xor edx, ebx
jmp 0x1016c29
xor ecx, ebx
bswap ecx
sub ecx, eax
xor ecx, eax
sar dl, 0x81
rol dl, 0x27
sal eax, 1
sbb ecx, 0x12b07713
add ax, dx
add ax, dx
xor ebx, ecx
ror dl, 0xe4
btr ax, 0x39
adc ebp, ecx
bt eax, 0x11
shr al, 5
setb al
pop ecx
jmp ebp
cwde
xor edx, 0x316d09
not eax
neg ecx
or ecx, 0xddba3711
rol edx, 2
lea eax, [ecx*4 - 0x7955026f]
not edx
imul ecx, dword [esp]
inc al
sbb edx, 0x6a0b92a7
or ecx, eax
or al, byte [esp + 1]
jge 0xe58cb7
bswap edx
sal al, 0xc1
sbb edx, 0x98357810
and ecx, 0xbfae3935
cbw
push ecx
xor ebx, edx
add ebp, edx
call fcn.00e775cb
adc dx, sp

Function at 0xe70c26
Capabilities:
Encode data using xor

Disassembly:
sub ebp, 4
call fcn.00ff5930
or byte [ebx - 0x63d7dfc8], 4
je 0xe70c5a
xchg esi, eax
xchg edx, eax
xor al, 0x2d
aas
and dh, byte [edx]
stosd dword es:[edi], eax
mov ch, 0xbf
scasd eax, dword es:[edi]
or eax, 0x3ddf8570
nop
lodsb al, byte [esi]
leave
mov al, byte [0x2c154760]
inc eax
dec ebx
push ecx
and dword [ebp + 0xe], 0xd456a60
pushal
and edx, dword [0x5fb3ff78]
sub ebp, dword [edx - 0x23c3c192]
inc ebp
or eax, 0x78152360
push dword [ebx + 0x6eaa2b5f]
cmp al, 0xdc
nop
add al, byte [edi]
das
xchg edx, eax
dec ecx
add eax, dword [edi - 0x22ae2931]
lodsd eax, dword [esi]
adc al, 0xfc
inc ecx
sub ebp, ecx
lahf
sbb edx, dword [edx]
jns 0xe70c3a
xchg byte [esi - 0x5c0838c2], cl
pop edx
and ecx, dword [ebp + 0x769106d8]
jmp 0x39f21eaa

Function at 0xe7b80f
Capabilities:
Authenticate hmac

Disassembly:
mov word [edi + ecx*2 - 0x1fffe], ax
sal ecx, cl
sbb ebp, 3
lea eax, [ecx*2 - 0x525deb57]
mov ecx, dword [ebp + ecx - 0x80000000]
xor ecx, ebx
mov dword [esp], eax
cwde
xor ecx, 0x6926ba1d
xor dword [esp + eax - 0x14a9], eax
push eax
neg byte [esp + eax - 0x14a2]
not ecx
ror ecx, 3
jmp 0x12d662d
Function at 0xe97bb6
Capabilities:
Encode data using base64

Disassembly:
inc ebp
sub dh, dh
dec eax
arpl bx, bx
inc sp
xchg ecx, ebp
inc ecx
push esi
inc cx
rol ebp, 0x23
dec esp
adc esp, ebx
inc esp
sub esi, dword [esp + edx]
dec esi
mov dword [esp + eax - 0x7a218601], esp
ret
xor ecx, ebx
lea ecx, [ecx + edx + 0x3b989059]
imul eax, edx
mov dword [esp + edx - 0xad], 0x4c095037
ror ecx, 3
jmp 0xfbff19
mov cl, byte [ebp + edx - 0x5df5e00d]
lea ebp, [ebp + edx - 0x5df5e00f]
shr eax, cl
mov dword [ebp + edx - 0x5df5e011], eax
push edx
shl edx, 0x3d
mov dword [esp + edx - 0x20000000], esi
ret
scasd eax, dword es:[edi]
retf 0xf003
not ecx
btc edx, edx
mov eax, dword [ebp + ecx - 0x77dcffff]
lea edx, [ecx*4 + 0x7e81e015]
jae 0xec73ce
not ecx
neg ecx
dec ax
not ecx
call fcn.00eb0be7
in al, dx
mov esi, dword [esi + 0x2aa7a1d3]
xchg esp, eax
sbb eax, 0x12cc3961
inc ecx
loop 0xecb356
int3
mov ecx, 0x7b53ca2c
xchg ecx, eax
popfd
mov cl, 0x81
inc ebx
jbe 0xecb315
lodsb al, byte [esi]
pop ecx
mov ch, 0xe2
dec esp
test al, 0xa4
sub byte [ebx], dl
sbb eax, 0x62ed42df
stosd dword es:[edi], eax
jp 0xecb311
ror edi, cl
jecxz 0xecb3f2
dec edi
daa
rcl byte [ecx]
xor bl, ah
scasb al, byte es:[edi]
cwde
lahf
and byte [eax - 0x18], dl
dec ebp
xor byte [edx], ah
insb byte es:[edi], dx
fidivr word [edi]
xor dword [esi - 0x35], ebx
push ds
add dl, byte [0xd210a9f5]
jl 0xecb3ee
loop 0xecb414
aam 0xb2
bound esi, qword [eax - 0x617c5fb4]
sbb edx, ebx
adc esi, dword [eax - 0x36f7fab]
xchg ebp, eax
pop esi
xchg ecx, eax
in eax, 0xf3
jb 0xecb417
invalid
jge 0xecb395
test byte [eax], 0x33
movsb byte es:[edi], byte [esi]
out 0x80, al
dec ebx
and eax, 0xdd7f23ce
xor esp, dword [esi - 0x31dab480]
and edi, dword [edi - 0x23]
jl 0xecb457
pop ss
and dword [esi + 0x30cd24dd], 0x66
ret 0xb2f3
cli
jns 0xecb470
xor ch, byte [eax + ebx*2]
mov byte [0x4d0311c6], al
mov cl, 0xd2
dec ebp
pop ebp
rcr dword [ebp - 0x40], 0x74
mov dl, 0x61
inc ecx
jnp 0xecb463
or byte [ebp - 0x7bff0efe], 0xe8
mov eax, 0xa0a4be7f
sahf
or bl, dh
insb byte es:[edi], dx
int1
push ecx
pop ecx
dec esi
outsb dx, byte [esi]
push esp
push ecx
push ds
invalid
jg 0xecb4b8
sar dword [eax], 1
add bh, bh
lodsd eax, dword [esi]
invalid
sbb ah, byte [ebp + 0x36730098]
mov ebp, 0xbb80df15
or bl, byte [ecx + edx + 0x71774cff]
adc edi, edi
dec esp
ja 0xecb4e6
jg 0xecb4a9
shl dword [esi - 0x7f], cl
leave
or ecx, ebp
ror cl, 0xc1
sbb dl, 0x90
sal cl, 0xa4
not dl
ror dl, 1
xor ecx, dword [esp + 4]
xor dl, 0x33
add cx, 0xad28
shr ecx, cl
btc ecx, ecx
dec dl
mov dword [esp + ecx - 0x10000dbc], 0x73ac301b
xor bl, dl
call fcn.01a97e81
sub ebp, 4
mov edx, dword [esp]
rol dx, 0xcc
call fcn.00f888ea
invalid
add byte [esi - 0x3f], ah
ret 0xe8cc
test dword [edi + 0x4e], edx
sar eax, 0x76
neg ecx
inc ax
and eax, edx
jnp 0xecb33d
sysenter
push ebx
mov ebx, 0x590df421
mov ebx, dword [esp + ebx - 0x590df421]
mov dword [esp], 0x4a4242a9
call fcn.00fe2920
inc ecx
ror edx, 0xd9
pop esi
ja 0xe20350
mov eax, 0x44226586
mov edx, dword [esi + eax - 0x44226586]
push eax
movsx ecx, al
mov ecx, dword [esi + eax - 0x44226582]
call fcn.011cca84
Function at 0xeaeac0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec edx
shl ax, 0x6e
or dword [esp], ebp
push ebx
mov ebp, esi
btc edx, eax
or al, ah
movzx ebx, ax
adc ebx, ecx
ror eax, 0xa4
mov edx, ebx
jb 0xfffd33
shr eax, 0xd3
shl edx, 2
neg ax
shl eax, 0x9a
btc ax, 0x33
mov eax, ebp
call fcn.00da82b3
mov edx, 0xcfbd969d
movzx eax, dx
mov edx, dword [edi + eax*4 - 0x25a74]
bts eax, eax
lea edi, [eax + edi - 0x20009699]
movzx ecx, al
adc eax, eax
sal cl, 0x87
xor edx, ebx
xor cl, cl
not ecx
je 0xf2cb2c
sar dword [esp + 0xc], 0xe1
adc esi, ecx
lea esp, [esp + 0x14]
jmp 0x126f5b0
call fcn.00f517b3
mov eax, 0x251471af
movzx ecx, byte [eax + edi - 0x251471af]
mov edx, 0xde3cdc28
ror edx, 0xef
push edx
lea edi, [eax + edi - 0x251471ae]
cdq
sub ax, word [esp + edx + 2]
xor cl, bl
btr ax, 0xa6
sal edx, 0xb3
ror cl, 1
inc cl
cbw
push edx
not cl
not eax
ror cl, 1
sal word [esp + edx*2 + 2], 0xca
adc cl, 0x16
btc eax, edx
adc dword [esp + edx*4 + 4], 0x3025da3d
xor bl, cl
mov dword [esp + edx + 4], edi
jmp 0xe443bb

Function at 0xeb039e
Capabilities:
Encode data using xor

Disassembly:
rep movsb byte es:[edi], byte [esi]
mov esi, 0xe8b616a3
bts si, 0xe
mov dword [esp], esi
push dword [esp + 8]
popfd
lea esi, [esi + esi*4 + 0x34b93882]
mov esi, dword [esp + 0xc]
call fcn.0133e373
cmp al, 0x7e
add bh, bh
je 0xeb03d5
or byte [ebp - 0x7d494b73], bl
cmp byte [ecx + 0x24748b34], bh
or al, 0xe8
mov al, 0xdf
dec eax
add byte [esi + edi*2], bh
mov word [ecx], ds
cwde
xchg dword ss:[ebx + 0x3c16a903], ebp
fiadd dword [ebx - 0x31c5619]
add al, 0xcc
sbb al, 2
xor dword [edx + 0x7c01c635], 0x4e
xor al, 0xbf
jl 0xeb03ad
adc eax, 0xdc83dbb6
fsub st(1), st(0)
xchg edi, eax
enter 0xffffffffffffa483, 0xffffffffffffffac
rcr dword [ecx], 3
int1
pop edx
lcall 0x5c1d, 0xcd7b0fd1
pushal
mov byte [ebp - 0x4f], al
test al, 3
loope 0xeb043b
and al, 0xb3
fcom qword [edx - 0x3c]
cmc
xlatb
invalid
fisub dword [edx + 0x5bff36e3]
sbb eax, 0x4522476a
add al, 0xc
cwde
mov bl, 0x64
pop ebx
xor esp, esi
std
add byte [ecx - 0x50be1009], dh
dec edx
int3
xchg esp, eax
in eax, dx
xor al, 0x94
fiadd dword [edi + ebx + 0x53395979]
mov esp, dword [edx + 0x36]
adc edx, 0xffffffa9
adc dword [ebx - 0x19], ebx
jl 0xeb0411
inc edi
jl 0xeb04a2
out dx, al
mov byte [ebx + 0x26], dh
shr byte [ebx], 0xcb
mov dl, dh
and byte [edx + 6], 0x67
sub eax, 0x65f01dc8
loop 0xeb0479
adc dword [ecx - 0x279ce055], ebx
out dx, eax
lahf
in eax, 0x80
out dx, al
mov al, byte [0x782ff0ba]
out 0x38, al
push edx
or dword [edi + ebx], esi
cmp byte [edx + 9], dl
xor al, 0x1f
sub al, 8
sbb byte [esi - 0x43dd20b3], ah
push ebx
invalid
outsd dx, dword [esi]
pushfd
wait
ret
Function at 0xeb5733
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + edx*2 - 0x646985e]
lea eax, [edx + edx*4 + 0x660ad708]
mov edx, dword [edi + edx - 0x3234c2d]
xor edx, ebx
mov ecx, 0xc2113734
push ecx
xor edx, 0xe7a7d9ac
add byte [esp + eax - 0x75bb53e9], ch
inc edx
not edx
mov dword [esp + eax - 0x75bb53e9], eax
shr ax, 8
neg edx
jmp 0xfd6318
lea ecx, [ecx + eax - 0x699f6bc2]
mov dword [esp + edx + 0x78fb70cd], 0xb73f6609
neg dx
xor ebx, ecx
ror word [esp + edx + 0x78fb8f33], 0x6d
adc ebp, ecx
mov edx, dword [esi + edx + 0x78fb8f33]
push eax
call fcn.013f2565
mov edx, 0x3234c2d
jmp 0xe2476b
neg byte [esp + ecx - 0x75bb53e6]
cbw
xor ebx, edx
sub ax, 0x1f9f
xor cl, 0x83
adc ebp, edx
sar eax, cl
mov eax, dword [esi + eax*2 - 0x3addf0]
sar cx, cl
add cl, 5
mov cl, byte [eax + ecx - 0x75bb0019]
adc esi, 2
mov edx, dword [esp]
rol byte [esp], 0x43
mov word [esi], cx
lea eax, [edx*8 + 0x4d1f7a37]
sub eax, 0xf00a30a2
not al
pop eax
jmp ebp
inc edx
shr cx, 0x43
xadd dword [esp + eax - 0x75bb0053], ecx
jl 0x13cd8e6
bswap edx
jns 0xec7408

Function at 0xeb8ebd
Capabilities:
Execute syscall

Disassembly:
idiv dl
not ecx
bswap ecx
or ax, 0xe99c
xor ebx, ecx
pop edx
call fcn.01380403
sysenter
call fcn.01276dbe
or ecx, dword [ebp + ecx*2 + 8]
add ebp, 4
div ecx
and dword [esp + 3], 0xcebe4995
mov ecx, 0x6491f923
mov dword [ebp + ecx - 0x6491f923], edx
seta byte [esp + ecx - 0x6491f923]
mov dword [ebp + ecx - 0x6491f91f], eax
movzx eax, word [esp + ecx - 0x6491f91f]
and ecx, 0xcb1f4683
inc dword [esp + eax*2 + 3]
mov dword [esp + ecx - 0x40114003], esi
ret 4
Function at 0xec7702
Capabilities:
Encode data using base64

Disassembly:
shl edx, 0x81
pop edx
mov edx, dword [edi + 4]
mov ecx, dword [esp]
inc cl
setl cl
mov cl, byte [ecx + edi - 0x22554bf9]
inc dword [esp]
rol word [esp + 1], 0x46
push 0x5ab14591
adc edi, 5
jmp 0xf61fc5

Function at 0xecc859
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp + ecx*4 - 0x1c]
shl edx, cl
xor eax, ebx
push edx
ror word [esp + edx - 0x3a007ff], 0x2a
bswap eax
dec eax
dec edx
shl dword [esp + edx*4 - 0xe801ffc], cl
neg eax
mov dword [esp + edx*2 - 0x7400ffa], edx
lea eax, [eax + edx*2 - 0x79da1dfe]
rol eax, 3
neg eax
xadd dword [esp + edx*4 - 0xe801ffa], edx
lea edx, [edx + ecx - 0x72e7adf5]
inc edx
or cl, byte [ebx]
push edx
sbb byte [ebp - 0x2c27ccbe], cl
insb byte es:[edi], dx
dec esp
int1
xor ebx, eax
shr dword [esp + ecx*2 - 0xf], cl
call fcn.0100e71c
bt cx, cx
imul dl
rol cx, 0xaf
call fcn.00e0a872
mov eax, 0x5f041d5
add al, 0x90
scasd eax, dword es:[edi]
not byte [esi - 0xd926027]
jo 0xecc940
cdq
loope 0xecc895
mov cl, 0xe5
fst dword [edi - 0x1d13a9e7]
sub cl, bh
imul ebp, dword [edi + 0x37], 0x22
je 0xecc89b
movsb byte es:[edi], byte [esi]
das
imul ebx, edx, 0xffffffe6
mov cl, 0x18
sbb al, 0x60
pop esp
mov ebp, 0xa6e9d0be
dec esp
mov esi, 0x4ca6e9d0
add eax, 0x85e02af4
mov edi, 0x6c786616
popfd
inc eax
xor byte [esp + edx - 0x6a], bl
pop edi
mov ch, 0xe9
mov byte [esi*4 + 0xe587199], dl
imul ecx, ecx, 0xcda95329
sub byte [esi], ah
mov ebp, 0x1efd3089
dec esp
jecxz 0xecc8e3
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
pushfd
cli
ret
pcmpeqb mm1, qword [eax - 0x6600b96d]
outsb dx, byte [esi]
mov byte [ebx + 0x6e99ff46], dl
out 0xdf, al
in eax, dx
out 0xa1, al
jg 0xecc93e
aaa
leave
out 0x97, eax
iretd
Function at 0xed8dfc
Capabilities:
Encode data using base64

Disassembly:
sub word [esp + 0xa], 0x4f89
ror edx, 2
inc word [esp + 5]
seto byte [esp + 2]
call fcn.00e75b9a
mov eax, dword [edi + edx - 0x4f37358e]
mov dword [esp + edx - 0x4f37358e], edx
lea edi, [edi + edx - 0x4f37358a]
push edx
movsx ecx, dl
xor eax, ebx
lea eax, [eax + edx*2 - 0x68b5a36c]
call fcn.013602dd
push 0x16399024
push 0x90bd109e
xor edx, ebx
push 0x61acd699
neg dword [esp + 8]
jne 0x1274b52
and ax, dx
dec ecx
or ax, 0xc99f
xor edx, 0x5b1aa37
setae dl
neg ecx
xor ebx, ecx
lea esi, [esi + eax - 0x45d1c9c3]
mov dword [esi + eax - 0x45d1c9bf], ecx
call fcn.01ab90a6
mov bl, 0xd3
in eax, dx
int1
mov dh, 0xf0
sbb byte [edx + 0x23a17719], ch
mov edx, 0x41068c89
mov edx, 0xbe0240e8
add byte [ebx - 0x490e122d], dh
lock sbb byte [edx + 0x23a17719], ch
adc eax, 0xaae26f9
and dh, byte [edi]
lcall 0x709b, 0xb56b1265
and eax, 0x6b23471c
popal
adc ch, byte gs:[ebx - 0x4b]
wait
jo 0xed8ea6
sbb al, 0x47
and ebp, dword [ebx + 0x61]
jo 0xed8e7a
adc ebx, edi
dec edx
mov bh, 0xe5
xor al, 0xce
daa
fstp xword [edx + 0x4e]
outsd dx, dword [esi]
mov bl, 0x61
push esi
fstp xword [edx - 0x15ba02dc]
or al, 0x7a
loop 0xed8e58
iretd
dec ebp
and dword [ecx - 0x31], esp
or byte [ebx - 0x1f44b16e], 0xe4
mov eax, dword [edi]
or al, 0x26
mov ecx, edi
mov eax, 0xbaff3e50
cmp dword [0x85465ff8], 0x63bc76ad
cmc
sbb eax, edx
aaa
adc eax, 0x3de08a1b
lahf
xor eax, ebx
inc ebx
mov ah, 0x13
add eax, 0xb2df25e4
das
fimul dword [ecx + 0x30]
xor bl, byte [esi - 0x1be855ca]
lds esi, [ebx + ebp*2 + 0x460f98e6]
sbb ebx, edi
pop ebx
lahf
wait
pop ebx
cmp byte [edi + 0x36baf5a4], bl
jns 0xed8e9f
insb byte es:[edi], dx
mov byte [0x3ea550fc], al
jno 0xed8f69
loopne 0xed8f7c
invalid
cld
push cs
invalid
out 0xee, eax
xor dh, byte [edi - 0x1a]
sbb dword [ebx], edi
mov al, byte [0x14498701]
pop esi
xchg edi, eax
int 0xd5
mov dword [esi + 0x49], esi
dec ecx
jns 0xed8f33
retf 0xd6c2
sbb edx, 0xed82708e
shl byte [esp + 8], 0x42
jb 0xe33320
sub dword [esp + 4], edx
adc esi, eax
mov eax, dword [edi]
imul dx, dx
mov edx, dword [edi + 4]
push 0xe5a0c787
adc edi, 3
shr dword [esp + 1], 0x90
push 0xbf0a9807
sar dword [esp + 4], 0x83
xor ecx, ecx
mov dword [esp + 0xa], 0x33934817
test edx, edx
push 0xdf86e686
jmp 0xfec46b

Function at 0xeda4bc
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov dword [esp], 0xd180d3a9
neg ecx
rol edx, 0x12
lea ecx, [edx + ecx - 0x6ebfb56a]
shr edx, 0x4f
pop edx
bswap ecx
bts edx, edx
jb 0x13bac1f
inc dl
xor ebx, ecx
add esi, ecx
mov ecx, 0xe4baebac
shl dx, 0xcc
xadd ecx, edx
mov ecx, dword [edi]
call fcn.00d8e3d3
pop edi
jmp 0x140597d
Function at 0xef3b41
Capabilities:
Check http status code
Encode data using base64

Disassembly:
mov dword [edi + 0xc], eax
mov dword [edi + 8], ebx
mov eax, 0xf8be2e16
mov dword [edi + 4], ecx
mov ecx, dword [esp]
sar eax, 0xe3
mov dword [edi + ecx*4 - 0x3bf81fe0], edx
mov ebx, dword [esp + ecx*8 - 0x77f03fbc]
pop ecx
pop edx
jb fcn.01a9a90d
sar ebx, 3
xor dword [esp + ebx*2 - 0x18cd7ae8], eax
pop esi
and bp, bp
dec eax
arpl ax, ax
dec esp
adc esp, eax
dec eax
btc ebp, ebp
dec eax
mov ebx, dword [edi + ebx*2 - 0x18cd7ae8]
adc bp, bp
dec eax
mov ebp, dword [edi + ebp + 0x6b35d751]
dec eax
adc edi, 0xc
call fcn.010004f0
lea ebp, [ecx + ebp - 0x30]
dec cl
btc edx, ecx
sal cx, 0xe2
xor eax, ebx
ror eax, 1
push edx
add ecx, edx
dec ecx
neg eax
mov dword [esp + ecx*2 - 0x100196], 0x61048507
shr ecx, 0x58
bswap eax
dec edx
and cl, 0xab
shl cl, 0x44
rol eax, 1
push edx
neg eax
ror edx, 0x6a
sub dl, cl
xor ebx, eax
imul ecx, dword [esp + ecx*8 + 1]
shl dl, 1
add esi, eax
shl dword [esp + ecx + 1], 0x26
adc byte [esp + ecx*2 + 5], 0x26
sbb word [esp + ecx*2 + 6], cx
mov eax, dword [edi + ecx*8]
push edx
adc ecx, dword [edi + ecx*4 + 4]
jmp 0xe0c98e
mov dword [esp + 8], ebx
mov ebx, 0x1ea17aa6
pop ebx
cpuid
shl dword [esp], 3
dec byte [esp + 3]
ja 0x12a3af3
mov edx, 0xc0296789
dec dl
sub ebp, 4
movsx ecx, dl
neg dl
mov eax, ecx
mov eax, dword [ebp]
shr cl, 0x85
inc dl
call fcn.00e673a0
mov edx, esi
call fcn.00f42f26
mov ecx, dword [esp + 4]
jmp 0x1ab1962
sar word [esp + edx - 0x8afc], 0x84
xor ebx, ecx
add edi, ecx
pop edx
mov edx, dword [ebp + eax*2 - 0x4c405026]
lea ecx, [eax + eax*4 - 0x784f11dd]
add dword [esp + ecx - 0x4651b682], ecx
adc al, byte [esp + ecx - 0x4651b680]
mov eax, dword [ebp + eax*2 - 0x4c4050c4]
add ecx, 0xa404b324
mov cl, byte [ebp + 8]
call fcn.00e6b48a
call fcn.00e6690f
mov eax, 0xc9305b34
movzx ecx, al
dec ax
mov eax, dword [ebp + ecx*2 - 0x68]
mov edx, ecx
seto dl
jns 0xdaaff6
sbb edi, 8
jmp 0xd880bb
push 0x8d265d28
mov ebx, dword [esp + 0xc]
not dword [esp + 3]
push 0x99a9078d
lea esp, [esp + 0x14]
ret
jmp 0x12bce4f