joyce8/EMBER2024-capa huggingface dataset:
Function at 0x632aba
Capabilities:
Inspect section memory permissions

Disassembly:
call eax
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov esi, ebp
mov edi, 0xeaac7286
pop ebx
shr edi, 0x82
movzx eax, di
pop ebp
not edi
pop edi
jmp ebp
mov eax, 0x9c948191
lea eax, [eax + eax + 0x30249af]
mov eax, dword [eax + ebp - 0x3c2b4cd1]
jmp 0x55812b
test ebx, ebx
push 0x8618cb97
lea esp, [esp + 0x10]
je 0x62c392
mov eax, 0xe7ae4c19
mov eax, dword [ebp + ebx*4]
jmp 0xed2bc9
and al, 4
mov esi, 0xff6b4375
je 0xe2122f
add byte [ebp + 0x424648d], bl
call fcn.00e8f72d
clc
call fcn.00e94991
mov edx, 0x72127339
movsx ecx, dx
lea edi, [edi + ecx*2 - 0xe673]
bts edx, edx
movzx eax, byte [ecx + edi - 0x7339]
xor dx, dx
shr dl, 6
jae 0xe5ac0c
sbb edi, edi
dec dword [edi]
stosd dword es:[edi], eax
ror byte [edi], cl
mov dh, 0x84
cmp edi, eax
invalid
dec eax
or dword [esi - 0x36d540c3], esp
add eax, esp
xchg ecx, eax
sbb bh, 0x71
add dh, dh
push ecx
imul ecx, dword [esi], 0x9b267602
jp 0xe2127a
std
xor dword [ebx - 0x3601beba], ebp
jnp 0xe21202
call [ecx + 0x257b465]
daa
int1
jg 0xe2122b
add dl, dh
cli
pop es
ja 0xe212ba
jmp [ebx + edi*8 + 0x5a]
adc al, 0x1a
xchg ecx, eax
mov dh, 0x20
lcall 0x6d25, 0xf8ff91b5
rcr byte [ebx], cl
fdiv dword [edx - 0x7cee3f38]
add byte [esi - 0x51], 0xd8
xor al, 0x91
sub eax, dword [eax + 0x4a305a09]
in al, 0x7f
xchg edi, eax
dec eax
stosd dword es:[edi], eax
sub byte [esi + 8], ch
sub ecx, dword [esi + 0x580f7062]
xchg ebx, eax
add edx, dword [edx + 0x5b7f2460]
xchg esp, eax
movsb byte es:[edi], byte [esi]
fistp word [edi + edi*4]
outsb dx, byte [esi]
outsb dx, byte [esi]
push edi
jp 0xe2136f
dec ecx
cmp dword [edx], ecx
invalid
std
push 0x63
or edi, edi
ja 0xe2137d
fistp dword [esi - 0x40]
or dword [ebp + 0x6ded552f], 0xe5070cbd
inc eax
in eax, dx
insd dword es:[edi], dx
mov ebp, 0x40e5070c
bound ebp, qword [edx - 6]
jmp [edx]
xor al, bl
neg al
push ecx
pop ecx
and cl, 0x25
dec al
xor cl, ch
seto dl
rol al, 1
or ecx, 0xf585c401
adc cx, dx
xor al, 0x11
sub al, 0xbf
xor bl, al
add cl, 0xb6
lea esi, [esi + edx - 0x72120002]
mov word [edx + esi - 0x72120000], ax
movzx eax, dl
bswap ecx
or ecx, ecx
lea edi, [edx + edi - 0x72120004]
lea edx, [eax*2 - 0x2767e4f6]
shr ax, 0x2f
or eax, dword [ecx + edi - 0x9f785f5]
call fcn.005ab9a3
push eax
jmp 0xe2121e
Function at 0x632ed7
Capabilities:
Encode data using xor

Disassembly:
push esp
mov edx, 0x23131cbb
mov ebp, 0xe6a9f12a
mov ecx, dword [esi + edx - 0x23131cbb]
call fcn.004d2f9c
jecxz 0x4acdd5
fsub st(0), st(0)
lodsd eax, dword [esi]
popal
add al, byte [eax]
xchg esi, eax
test eax, 0x3eabade4
je 0x4ace71
imul ebp, dword [eax + 0x6a4548c1], 0x9c2df715
push edx
mov eax, dword [0xbabd46b5]
dec esp
inc edx
movsd dword es:[edi], dword [esi]
sbb byte [ebp - 0x30d3d88a], ch
inc esp
lodsb al, byte [esi]
xor eax, 0x895267da
mov byte [0xcb51528c], al
cmp dword [edx + edi*4 + 0x1b2530f1], ebx
nop
js 0x4acde7
and bh, byte [edx + ebx]
fild dword [ecx + 0x2f]
lds edi, [edi + eax*4 + 0x6513791c]
push ecx
mov byte [ebx + ebx*8 - 0xa], ch
mov eax, 0x43f39b34
sbb ebx, esi
mov esi, 0x9a8e60ae
mov esp, 0xcab9d3d3
mov ah, byte [ecx + 0x24]
adc byte [eax + edx*8 - 0x5f5f977d], dh
mov ecx, 0xe56970b7
sub byte [ecx], dh
cmp dl, byte [esi + 0x7a]
push esi
add eax, 0xd7177ffe
adc al, 0x9a
out dx, al
or al, byte [ecx - 0x2f]
mov edx, 0x796d993a
mov ebp, dword [ecx + edi - 0x58ba553e]
lodsb al, byte [esi]
cmp edx, eax
stosb byte es:[edi], al
inc ebp
cmpsd dword [esi], dword es:[edi]
sbb edx, esi
jle 0x4acece
mov byte [0xba5f45f8], al
pop ebx
jnp 0x4ace2a
cli
lodsd eax, dword [esi]
push cs
pop esi
das
sub eax, 0xd9149244
test dword [edx - 0x58], edx
mov eax, dword [0xa219526e]
cmp bh, byte [esi - 0x46]
mov al, 0x67
aas
mov edi, 0x7c9393b2
mov al, byte [0x904e5dad]
lodsd eax, dword [esi]
pop ebp
dec esi
nop
sar byte [edx - 0x7743b18d], 1
psubsw mm6, qword [edi + 0x13]
out dx, eax
mov ebx, 0x83f31ee5
dec edi
cmp edx, esp
mov bl, 0x24
jne 0x4aceff
in al, 0x7d
sbb dword [eax], ebp
popal
jno 0x4aced1
cmp edx, dword [ebp - 0x2e]
inc esi
dec ebp
or eax, 0xdef25e7
dec ebx
cmp dh, ch
mov eax, dword [0xf62c325f]
push 0x3bb7b31a
test eax, 0x814a268d
xchg edx, eax
mov dh, 1
cmp ah, byte [edx + 0x6627cd86]
sub al, 0x8f
shl dword [ebx], 1
jmp 0x3864ae25
scasb al, byte es:[edi]
mov ah, 0xa2
xor ch, bl
jmp 0x4acea2
lea edx, [ecx + ecx*2 - 0x5253eacb]
mov word [edi], ax
movsx eax, cl
mov ecx, dword [ebp]
adc ebp, 3
xor ecx, ebx
call fcn.00ddba6a
jmp 0x4acdd9
Function at 0xce3c08
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
mov esi, 0xcab43219
mov edi, 0x1294e6b5
mov edx, esi
mov dword [ebp + edi*4 - 0x4a539ad4], eax
push edx
mov ebx, 0xc1a95bb2
mov esi, ebp
movsx ebp, byte [esp + edi*2 - 0x2529cd6a]
mov dword [esp + edi*4 - 0x4a539ad4], edx
mov ebx, dword [esp + edi*2 - 0x2529cd66]
lea ecx, [ebp*4 + 0x552031a0]
lea eax, [ecx + ebp - 0x49e75653]
mov edi, dword [esp + edi - 0x1294e6ad]
xadd ecx, ebp
xor ecx, dword [esp + ebp - 0x55203204]
mov ebp, dword [esp + eax - 0xb38dbbe]
dec edx
push ecx
mov ecx, dword [ebp + eax - 0xb38dbca]
mov dword [esp + eax - 0xb38dbba], eax
setns byte [esp + eax*2 - 0x1671b793]
lea ebp, [ebp + eax*2 - 0x1671b790]
xor ecx, ebx
xadd dword [esp + eax*2 - 0x1671b791], edx
or word [esp + eax - 0xb38dbba], ax
not ecx
dec edx
imul eax, eax
shl ax, 0x87
bswap ecx
mov dword [esp + eax - 0x4113b1f4], eax
not ecx
jae 0x523b31
sbb al, ah
call fcn.00d6e21a
adc ebp, 0xec4bc2e3
sub bh, dh
std
imul esi, esi, 0xffffffb9
pop dword [edx]
fst qword [esi - 0x59fd890b]
inc edi
fiadd dword [ecx]
xchg dword [eax], esi
cmc
jle 0xce3d29
add byte [eax], dl
mov dh, 0xc8
add bh, cl
pushal
invalid
salc
and al, 0x43
add dh, ch
adc ch, bl
invalid
mov byte [eax], ch
wait
add byte [edx], dh
xchg esp, eax
loop 0xce3cef
add al, byte [ebx - 0x22]
jae 0xce3c9c
std
xor al, 0x26
das
and al, 0xfd
sub ah, byte [edi - 0x2c]
std
fsubr st(1)
add eax, dword gs:[edx - 0x43]
mov dword ds:[0xc4a3c563], eax
mov al, 0x3d
add byte [edx], ch
sbb al, 0x97
retf
push ebx
fiadd word [ecx + 0x55]
mov esi, 0xcc008b45
movsd dword es:[edi], dword [esi]
test dword [edi], esp
mov dword [0xdf56dd], eax
sub dword [edi + edx*4], ebx
mov ebx, dword [edx*4 - 0x10a81a79]
mov dl, 0x22
cmpsb byte [esi], byte es:[edi]
inc ecx
jne 0xce3dc8
pop edx
loope 0xce3cff
mov word [edx], es
rcl ecx, 0x5a
add dword [edi], ecx
and byte [edi + 0x1d], bh
inc ebp
retf
inc edi
sahf
pushfd
and bh, byte [edx]
retf

Function at 0xcffddf
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, byte [esp + eax*8]
lea ebp, [ebp + eax*2 - 4]
movsx edx, word [esp + ecx*4 - 0x250]
idiv byte [esp + eax]
shr byte [esp + eax + 3], 4
mov ecx, dword [eax + ebp]
jns 0xe8360f
not cl
mov dword [esp], 0xea18d94
mov eax, 0xa391788d
sub cl, 0xa8
add ax, word [esp]
not cl
bts eax, eax
xor eax, eax
adc cl, 0x2e
sub ax, ax
xor bl, cl
sar word [esp + eax + 1], 0xe5
lea ecx, [esp + ecx + 4]
mov byte [eax + ecx], dl
js 0x5a6590
mov edx, dword [ebp]
add ebp, 4
xchg edx, ebp
jmp 0xd84386
mov ecx, 0xfa820e0e
mov esi, edx
ror ecx, 0x2e
sar ecx, cl
ja 0xea8680
xor dx, 0x9a32
rol al, 0x41
xor ecx, ebx
not ecx
inc ecx
xor edx, edx
cwde
shr dword [esp + eax], 0xb1
bswap ecx

Function at 0xd16b30
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push ebp
btc eax, 0x8e
mov dword [esp + edi - 0xe3a43a4], ebx
mov dword [esp + edi*2 - 0x1c748764], 0x13273408
bt ebp, edi
and bp, 0x4021
mov edi, dword [esp + edi - 0xe3a438c]
sar eax, 0x5c
rol edi, 1
pop ecx
call fcn.004b688c
Function at 0xd16bb9
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [esp], 0xde06b60c
sub esi, 8
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
call fcn.00518912

Function at 0xd1f9b9
Capabilities:
Authenticate hmac
Inspect section memory permissions

Disassembly:
dec ebx
push 0xde27efb0
lea esp, [esp + 8]
jne 0xcef102

Function at 0xd24e19
Capabilities:
Inspect section memory permissions

Disassembly:
lea edi, [edi + eax - 0xb8]
mov edx, dword [edi + eax*2 - 0x168]
and ecx, ecx
lea eax, [ecx + 0x4f909038]
or cl, ch
xor edx, ebx
div cl
rol edx, 2
xor edx, 0x529e253c
inc edx
sar cl, 0x46
sbb al, cl
bswap edx
inc eax
cwde
neg edx
sar cl, 2
cbw
inc ecx
xor ebx, edx
add ebp, edx
xadd ax, cx
jmp ebp
mov cl, byte [esi + ecx - 0x69aef0b3]
push 0xb68b4bb4
adc esi, 4
or dword [esp], 0x13bda934
xor dword [esp], 0xff25ff8a
shld ax, dx, cl
shr word [esp + 2], 0xc5
mov word [esi], ax
mov ecx, dword [ebp]
dec byte [esp + 3]
mov edx, 0xeb919118
shl edx, 0xf
adc ebp, 4
xadd byte [esp + 1], dl
movzx eax, dl
mul ax
xor ecx, ebx
rol ecx, 3
sub ecx, 0x80059593
xor ecx, 0x219d400
dec edx
lea ecx, [ecx + edx - 0x4d5c0af9]
neg dx
bswap ecx
pop eax
adc ax, ax
bts edx, 0x13
lea ecx, [ecx + edx - 0x44594f7d]
ror al, 0x47
or ax, ax
div al
xor ecx, 0x16abb10c
dec dx
mul dx
sar eax, 0x91
xor ebx, ecx
add edi, ecx
jmp edi
adc al, 0x3f
pop edx
mov edx, 0xa599b12d
neg al
sar dl, 0xe1
ror al, 1
ror edx, 0x9e
xor bl, al
push ebp
neg edx
add dl, 0x1b
push esi
movzx ebp, dl
push ebx
or ebp, 0x4b23a2ba
cmovge ebp, edx
movzx ebx, dx
mov ebp, edi
mov ebx, eax
shr dx, 0x84
mov edx, ebx
mov eax, 0x571a769b
sub ax, 0x7aaa
rol eax, 0xca
shl edx, 2
shr al, 6
mov eax, ebp
call fcn.00cf8257
mov ecx, 0x69aef0b8
mov ax, word [esi + ecx - 0x69aef0b8]
mov edx, ecx
mov dx, word [edx + esi - 0x69aef0b6]
btr cx, cx
dec cx
invalid
invalid
daa

Function at 0xd24eb3
Capabilities:
Inspect section memory permissions

Disassembly:
xor ecx, ebx
inc edx
call fcn.0057fa73
sysenter
push edi
mov dword [esp], 0x9eaa77f
call int.0057341d
mov eax, 0x3abb4798
movzx ax, byte [edi + eax - 0x3abb4798]
mov ecx, 0x72a35b89
mov edx, 0xa2bd803c
imul dx, dx
mov cl, byte [edi + ecx - 0x72a35b87]
adc edx, edx
lea edi, [edi + edx - 0x457a1c1f]
add al, cl
mov word [edx + edi - 0x457a1c21], ax
push edx
lea ebp, [ebp + edx - 0x457a1c25]
add dx, dx
movsx eax, dl
mov eax, dword [ebp + edx - 0x457a3842]
lea ecx, [edx - 0x336dd34d]
xor eax, ebx
sal edx, 0x7d
dec eax
not ecx
lea ecx, [edx*8 + 0x7c06029a]
xor eax, 0x581c05bc
rol eax, 2
neg eax
inc cl
call fcn.004ede37
mov ax, word [esi]
mov ecx, 0x3800109f
dec cl
mov edx, ecx
mov dx, word [esi + edx - 0x3800109c]
bts cx, cx
mov cl, byte [esi + ecx*2 - 0x7000a138]
adc esi, 4
call fcn.0061ea6d

Function at 0xd257f7
Capabilities:
Inspect section memory permissions

Disassembly:
js 0xd4a24f
mov ecx, 0xe2a4e88f
lea edx, [ecx + ecx*4 - 0x6dcdbbc4]
lea eax, [edx*2 + 0x230be413]
mov eax, dword [eax + edi - 0x21e18221]
btr dx, 0x2d
add dl, dh
lea edx, [ecx + 0x1f19de0f]
mov ecx, dword [edi + edx*2 - 0x37d8d38]
push ebx
shr dx, 1
mov ebx, 0x4c3597a2
cpuid
call fcn.00e4f673
call fcn.005197ae
Function at 0xd2cc9c
Capabilities:
Inspect section memory permissions

Disassembly:
lea ebp, [ebp + ecx*2 - 0x1fff8]
inc edx
xor eax, ebx
call fcn.00d0dd76

Function at 0xd35436
Capabilities:
Encode data using xor

Disassembly:
jbe 0xce3ba4
xor dword [esi + 0x7443256], ecx
cdq
in al, dx
push edx
mov edi, 0x6e98d972
push ebx
lea esp, [ebx]
dec edi
mov edx, 0xcf2e93e4
wait
lodsd eax, dword [esi]
invalid
ror word [esp + 2], 0xc3
sbb eax, eax
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
xor eax, dword [esp]
lea ebx, [eax + eax*4 - 0x6c4c00e2]
mov ebp, esi
xadd word [esp + eax*2 - 0x8570], bx
sar bl, 0xe1
mov ebx, edx
and byte [esp + eax*4 - 0x10ae3], al
btr eax, eax
pop edx
mov edx, ebx
dec eax
sal edx, 2
lea eax, [eax + eax*8 - 0x66c96e6f]
cwde
sub al, 0x20
mov eax, ebp
jno 0x47fec3
call fcn.004febd5
mov dword [esp], eax
inc dl
neg dl
cwde
btc ax, ax
mov dword [esp], eax
adc dl, 0x82
push eax
rol dl, 1
shr dword [esp + 0xa], 0xa7
xor bl, dl
jmp 0xde7202
adc edi, 3
shld dx, ax, cl
mov ecx, 0x413b7732
call fcn.00e51262
xor al, ah
add ax, 0xae12
mov dword [esp + 0xc], edi
jb 0x51f5f9
mov esi, dword [esi + edx - 0x8f360]
dec dl
not ecx
lea eax, [edx - 0x6771d400]
jno fcn.00ec7009
mov eax, 0xbab56b2d
mov edx, eax
or edx, 0x3a2173b5
mov dx, word [edi]
shl eax, 0xc
mov ecx, 0x310f8415
sal cx, 0xc1
mov ax, word [ecx + edi - 0x310f0828]
not ecx
btc ecx, ecx
mov cl, byte [edi + 4]
jb 0xd7dbd9

Function at 0xd37c44
Capabilities:
Execute syscall

Disassembly:
push ebx
mov dword [esp + 8], 0x64e2cb90
lea esp, [esp + 8]
call fcn.005e7aaf
shr cx, 0xaf
not eax
xor eax, 0x61aaa53c
mov edx, dword [esp + ecx - 0x369d0000]
neg byte [esp + ecx - 0x369cfffd]
rol eax, 1
shl dword [esp + ecx - 0x369d0000], 0xdd
xchg dword [esp + ecx*2 - 0x6d3a0000], ecx
call fcn.00d0d074
sysenter
push esi
mov esi, 0xb82091b4
mov esi, dword [esp + esi + 0x47df6e4c]
mov dword [esp], 0xd81f2c06
call fcn.005e707d

Function at 0xd3fb56
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [esp], 0xf0c9904
push 0x61194b6
xor edx, edx
dec dword [esp + 6]
test ecx, ecx
lea esp, [esp + 0xc]
je 0x5903bb
jmp 0x55ed0c
not edx
mov dword [ebp], edx
mov eax, 0xd586f78d
mov edx, dword [edi]
add edi, 4
lea ecx, [eax + eax - 0x52cb6800]
xor edx, ebx
dec ecx
xor edx, 0xe18bcc01
xor ax, ax
shr al, 0x27
dec edx
add cl, cl
not ax
bswap ecx
xor edx, 0xa081543b
lea edx, [edx + ecx + 0x3ffb5c51]
not ecx
and ecx, ecx
sar cl, 0xe6
not edx
ror eax, 0x11
sal eax, cl
dec cx
xor edx, 0x96116701
xor ebx, edx
add esi, edx
call fcn.00430605
mov eax, edx
cmp edx, ecx
bswap edx
xor edx, esp
cdq
stc
jmp 0x5db287
mov eax, dword [ebp]
mov ecx, 0xee8667ad
bt ecx, 0x91
mov ecx, dword [ebp + 4]
ror word [esp + 4], 0x48
adc ebp, 3
jmp 0x485927

Function at 0xd4121f
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], ebx
jmp 0xcec46d

Function at 0xd45d79
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [esp + 8], 0xa8aff2af
lea esp, [esp + 8]
call fcn.005cff84
Function at 0xd5e1e8
Capabilities:
Inspect section memory permissions

Disassembly:
not ax
cdq
mov dword [esp + eax], edx
xchg word [esp + eax + 1], dx
rol cl, 1
add cl, dl
btr eax, eax
cwde
xor cl, dl
jmp 0x50e6bf
Function at 0xd7d048
Capabilities:
Inspect section memory permissions

Disassembly:
call fcn.00e9f4b0
mov edx, dword [edi]
mov eax, 0x4c2b9621
lea edi, [edi + eax - 0x4c2b961d]
xor edx, ebx
movzx ecx, al
cbw
not edx
xor eax, ecx
sbb edx, 0x922a86b8
shr cl, 0xc1
add cx, ax
bswap ecx
ror edx, 1
bswap edx
xadd al, cl
xadd ecx, eax
neg edx
dec cx
lea eax, [eax*2 - 0x6a5c10c7]
neg ax
xor ebx, edx
add esi, edx
cdq
cdq
mov eax, dword [ebp + ecx - 0x5c2bffff]
mov edx, dword [ebp + ecx - 0x5c2bfffb]
neg cx
bt ecx, ecx
mov cl, byte [ecx + ebp - 0x5c2afff9]
adc ebp, 6
call fcn.00da2f07

Function at 0xd7d0b9
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [esp], 0x90502f3
call int.0057341d

Function at 0xd90bc4
Capabilities:
Authenticate hmac

Disassembly:
jne 0xd3275d
xchg dword [esp], ecx
shr ecx, 0x91
mov dword [edx + ecx*2], eax
inc dword [esp + ecx]
movsx edx, cl
lea edi, [edi + ecx*2 - 4]
call fcn.00cfd4ff
neg eax
bswap eax
inc eax
neg edx
neg eax
xor cx, cx
call fcn.00432f60
xor dl, byte [esp + ecx*8 - 0x35946bf8]
inc eax
or dword [esp + ecx - 0x6b28d78], ecx
jnp 0xd22e53
movsx edx, cl
inc edx
mov ebx, dword [ecx + ecx - 0x7d835cab]
dec esi
lea ecx, [ecx + ecx - 0x7d835ca7]
inc sp
btr ecx, esp
shr ecx, cl
inc ecx
xor ebx, eax
bswap ebx
not ebx
dec ebp
lea esi, [esp + 0x321935b6]
inc ebp
movzx edx, ch
inc cx
imul ecx, edx
neg ebx
inc ebp
add ebp, edx
inc ecx
push esp
sar word [esp + ecx - 0xfd779], 0x23
dec ebx
mov ebp, dword [esp + ecx*4 - 0x3f5de3]
bswap ebx
inc esi
sub dword [esp + ebp - 0x7d835d55], esp
movsx esi, dl
inc cx
sal ebp, 0xe2
dec esp
mov dword [esp + ecx*2 - 0x1faef2], eax
dec eax
and ebp, 0xfd1f8001
inc esp
cmove esp, edx
xor dword [esp + ecx*2 - 0x1faef2], ebx
inc eax
dec dh
inc ecx
xor dh, bh
inc ecx
pop eax
inc cx
sar edi, 0xa3
inc ebp
xchg ch, dl
inc ecx
setns dh
dec eax
arpl bx, bx
call fcn.00d23a6e
xor ebx, edx
call fcn.00cebe76

Function at 0xd9af9d
Capabilities:
Inspect section memory permissions

Disassembly:
shr dword [esp + 7], 0x4e
xchg word [esp + 1], dx
pop ecx
pop eax
pop ecx
jmp esi
and cl, ch
push ecx
xor bl, dl
shl cx, 0x49
sal ecx, 0x5b
lea edx, [esp + edx + 8]
pop ecx
adc word [esp + ecx*8 - 0x1190000], 0x7623
mov word [edx + ecx*4 - 0x8c8000], ax
movzx eax, cl
seto al
lea edi, [edi + ecx*4 - 0x8c8004]
movzx edx, byte [esp + ecx*4 - 0x8c8000]
call fcn.00d90a8f
push edi
mov edi, 0x5b0fd82b
pushfd
shr di, 0x3d
call fcn.00e5a3cb
mov dword [esp + ecx*2 - 0x460544], ecx
inc dword [esp + ecx - 0x2302a2]
xor dl, 0x11
ror dl, 1
sal cx, 0xec
not dl
jns 0xd2aea1
not ecx
setnp byte [esp + 6]
or dword [esp + 6], edx
not eax
inc dl
btr edx, 0x91
and ecx, eax
rol word [esp + 4], 0x22
mov dword [edi], ecx
jb 0xcd7496
Function at 0xd9b00c
Capabilities:
Inspect section memory permissions

Disassembly:
ror ecx, 0x84
xor eax, 0xb4033980
inc eax
mov dword [esp + edx - 0x76670000], ecx
sub ecx, dword [esp + edx - 0x7666fffe]
js 0xe3e139
ror eax, 3
dec edx
not dword [esp + ecx - 0x71f7fbb]
xor eax, 0x8196c43d
xor ebx, eax
sub edx, 0x4cb27dbe
bts ecx, edx
add esi, eax
sal dword [esp + ecx - 0x71f7fbb], 0x7c
not ecx
movzx ax, byte [edi + edx*2 - 0x53690482]
adc dl, ch
or dword [esp + edx*2 - 0x53690582], 0x52bd2095
mov cl, byte [edi + edx*2 - 0x53690582]
xchg dh, dl
and edx, 0xd8b78bb8
lea edi, [edx + edi - 0x8b4827e]
shr al, cl
mov word [edi + edx*2 - 0x11690500], ax
mov dword [esp + edx - 0x8b48280], esi
ret 4
lea ecx, [ecx + ecx*8 + 0xa091013]
adc esi, 1
and cl, cl
neg ecx
add dl, al
movzx eax, cl
add al, cl
rol eax, cl
mov word [esi + eax*8 - 0xda0000], dx
sal eax, 0xba
xor ax, cx
bts ecx, 0x2b
mov edx, dword [ebp + eax - 0x2fed]
call fcn.005fac8a

Function at 0xda0435
Capabilities:
Inspect section memory permissions

Disassembly:
jo 0x5c7551
test ecx, ecx
call fcn.00569efd
mov eax, dword [edi]
add edi, 4
xor eax, ebx
mov ecx, 0x71b7cb1
movzx edx, cl
and edx, edx
rol eax, 2
lea ecx, [ecx*4 - 0x18c51700]
shr ecx, 0x75
sbb eax, 0xa18ac91c
bswap eax
xadd dl, cl
dec dl
neg eax
sub dl, cl
imul edx, ecx
dec eax
shl cl, 7
sete cl
sub ecx, 0xcc9a730a
xor eax, 0x1f84e03b
dec cl
setnp dl
xor ebx, eax
xor edx, ecx
shr cl, 1
add ebp, eax
xor cx, cx
mov eax, dword [esi + ecx*2 - 0x66ca0000]
bt ecx, edx
setae dl
xor cl, byte [eax + ecx - 0x33650000]
movsx eax, dl
bts ax, dx
neg edx
lea esi, [esi + eax + 1]
btr edx, edx
imul edx
mul ax
mov word [esi], cx
bts eax, 0x9d
jmp ebp
xor eax, eax
neg dword [esp + 8]
jbe 0x5aeed7
Function at 0xdb551e
Capabilities:
Encode data using base64

Disassembly:
mov ecx, esi
inc ecx
mov ebx, dword [ecx]
inc esp
mov edi, ebp
jmp 0xd386cb
xor eax, 0x768c253e
ror dl, 0x27
rol eax, 1
neg edx
not dl
inc edx
lea eax, [eax + ecx*8 - 0x4103ba70]
xor cx, 0xc1b
bswap eax
xor ebx, eax
xadd dword [esp + ecx - 0x5af7c8], edx
xchg cl, dl
inc dx
add edi, eax
not dl
mov dword [esp + edx*8 - 0x7ffd990], edi
ret 4
dec ecx
add ecx, 4
dec esi
lea edx, [esi + edi*4 + 0x3da9e78e]
dec esi
lea esi, [edx*4 + 0x2aac0e0a]
inc ecx
xor ebx, eax
inc ebp
xadd edx, edi
dec ecx
xor esi, esi
not ebx
inc edx
lea ebx, [ebx + edi*2 - 0x5f1b2181]
inc ebp
bt esi, edi
dec ecx
not edx
inc cx
sal esi, cl
ror ebx, 2
inc edx
lea ebx, [ebx + edx + 0x5f6067f8]
neg ebx
inc edx
lea ebx, [ebx + edx*2 - 0x6491fd90]
inc bp
and esi, esi
dec edx
lea eax, [edi*2 - 0x106ed758]
neg ebx
dec edx
lea edx, [ebp + edi - 0x46fb8ec2]
sar ecx, 0x23
dec esi
lea esp, [eax + edx*2 + 0x1c3af700]
inc ecx
push eax
inc esp
or esp, ebp
jno 0xdc6c1e
jne 0x539d2c
xor eax, 0x622a6c9b
mov dword [esp + edx - 0x6b3bee61], 0x4c1e833b
btr ecx, 0x95
mov dword [esp + ecx - 0x7fd7fff3], ecx
dec eax
btr ecx, ecx
xor ebx, eax
rol byte [esp + ecx - 0x7fd7fff0], 0x86
shr byte [esp + ecx - 0x7fd7fff2], 0x24
and cx, cx
adc edi, eax
inc ecx
jns 0xdb5853
mov ebx, 0xa32f8d83
inc esp
movsx edi, bl
dec esp
imul edi, ebx
inc ebp
mov ebp, dword [ecx]
jae 0x432ea8
dec ecx
adc ecx, 3
movsx esi, bx
push esi
inc esp
movzx esi, si
inc ebp
xor ebp, eax
inc ecx
bswap ebp
inc edx
movsx eax, word [esp + esi*2 - 0x11b05]
inc eax
not dh
inc esp
movzx edx, ax
inc ecx
neg ebp
inc ecx
xor ebp, 0xac279502
inc ecx
rol ebp, 1
push ebx
dec ecx
lea ecx, [esi - 0x6dccef7f]
shr ax, cl
inc ecx
dec ebp
inc esi
sub dword [esp + esi - 0x8d79], edi
inc ecx
bts edx, 9
inc edx
shr byte [esp + esi - 0x8d7f], cl
inc ecx
neg ebp
dec edx
or dword [esp + esi*4 - 0x23604], 0x32043586
inc ecx
sbb dh, 0xa4
dec edx
ror dword [esp + esi - 0x8dd7], 2
inc ecx
dec ebp
inc esi
movzx esp, word [esp + esi - 0x8dd7]
inc ecx
rol esp, cl
dec esi
mov dword [esp + esi - 0x8dd7], eax
inc edx
shr dword [esp + esi*2 - 0x11bbe], 0x9c
inc esi
xor dword [esp + esi*2 - 0x11bb6], ebp
inc ecx
push edi
inc ecx
mov ebp, edx
inc cx
inc edi
dec esi
mov eax, dword [esp + esi - 0x8dcf]
mov edx, 0xf9127e8d
dec ebp
arpl bp, bp
inc eax
sub al, ch
inc edx
xor dword [esp + edi - 0x651e7c4a], ebx
dec ecx
dec esi
inc esp
movzx eax, dx
dec eax
bswap esi
inc ecx
pop eax
dec ebp
lea esp, [edx + ebp*2 - 0x31ddcddf]
dec eax
mul edx
dec esi
lea ebp, [esi + 0x3e85189d]
dec eax
arpl bx, bx
dec eax
adc edi, ebx
inc cx
sub esi, esi
inc ecx
mov ebx, esp
inc bx
mov esi, dword [ebx + edi - 0x651e7c4a]
call fcn.00583370
Function at 0xdc2bc0
Capabilities:
Parse pe header

Disassembly:
je 0x4850b0
mov ecx, 0x5a4d
cmp word [ebp - 0x44], cx
jne 0x4850b0
mov eax, dword [ebp - 8]
jmp 0xe9ca80
jb 0x4850b0
lea edx, [ebp - 0x13c]
push edx
cdq
jmp 0x568fab
push ebp
mov ebp, esp
movzx dx, bh
sub esp, 0x13c
push esi
movzx edx, cx
push edi
cdq
mov esi, eax
lahf
lea eax, [ebp - 0x44]
mov edx, 0x2fb57b89
push eax
push 0
cwd
setne ah
mov edi, ecx
push 0
setne ah
cdq
push edi
setno dh
movsx ax, cl
mov edx, 0x40
cwde
mov ax, 0xccba
not al
mov eax, esi
jmp 0xdf3415
call fcn.00d0a8e6
test al, al
jmp 0x43189b
cmp eax, edx
jmp 0x57bc27

Function at 0xdc6978
Capabilities:
Inspect section memory permissions

Disassembly:
add edi, eax
shl edx, cl
call fcn.00ec702d
mov ecx, 0x7c1ac5b4
lea edi, [edi + ecx - 0x7c1ac5b8]
mov edx, dword [edi + ecx - 0x7c1ac5b4]
movzx eax, cl
xor edx, ebx
sub edx, 0xdd28ab08
neg edx
jmp 0xde1a21
inc edx
ror edx, 1
xor ebx, edx
rol ax, 0x81
adc ebp, edx
add cl, 0xa1
mov edx, ecx
mov si, word [esi + eax*2 - 0x2d0]
bts edx, 0x29
jae fcn.00ec7009
movzx eax, byte [eax + edi - 0x23b3c202]
add edi, 1
imul edx, edx
mov ecx, edx
shl ecx, 0xdc
xor al, bl
xor cx, dx
neg al
bt edx, 0xaf
call fcn.00e133e4

Function at 0xdda106
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov ecx, 0xdf2920b5
lea edx, [ecx*8 - 0x66677af2]
mov dx, word [esi + 2]
mov dword [esp], ecx
sar ecx, 0x1d
mov cl, byte [esi + 4]
adc esi, 3
jmp 0xe27ce1

Function at 0xde1973
Capabilities:
Inspect section memory permissions

Disassembly:
xor ebx, ecx
add esi, ecx
call fcn.00d65ee5
sal edx, 2
mov eax, ebp
add eax, edx
push 0xa4123684
shl word [esp + 2], 0x45
mov dword [ebp - 4], eax
test ebx, ebx
push 0x4cadc521
lea esp, [esp + 8]
je 0x483631