joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406864
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406888
xor eax, eax
test eax, eax
je 0x40689b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40689b
xor ecx, ecx
jmp 0x40689e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069c1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dac], 0
push esi
jne 0x4069f8
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4069d2
mov dword [ecx*4 + 0x427da8], eax
inc ecx
cmp ecx, 0x100
jl 0x4069cd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a29
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427da8]
xor eax, esi
inc ecx
dec edx
jne 0x406a0b
pop edi
not eax
pop esi
ret 0xc

Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x407890
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4078ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x4078ae
shr eax, 1
dec edx
jne 0x40789f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407898
pop esi
ret

Function at 0x4078db
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078e7
call fcn.00407890
push 1
push 0x40c558
call fcn.004043fc
mov eax, edi
test esi, esi
je 0x407912
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078ed
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x517040
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x431000
lea edi, [esi - 0xc0000]
push edi
jmp 0x51705a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x517061
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x517050
mov eax, 1
add ebx, ebx
jne 0x517073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x517084
jne 0x5170a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5170a3
dec eax
add ebx, ebx
jne 0x517090
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x517068
add ebx, ebx
jne 0x51709f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5170f5
xor ecx, ecx
sub eax, 3
jb 0x5170bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51712a
sar eax, 1
mov ebp, eax
jmp 0x5170c6
add ebx, ebx
jne 0x5170c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x517094
inc ecx
add ebx, ebx
jne 0x5170d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x517094
add ebx, ebx
jne 0x5170e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5170d6
jne 0x5170f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5170d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x517114
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x517106
jmp 0x517056
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x517114
add edi, ecx
jmp 0x517056
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x517132
cmp byte [edi], 0x11
jne 0x517132
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x517137
lea edi, [esi + 0x110000]
mov eax, dword [edi]
or eax, eax
je 0x5171af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15521c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x155398]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x517164
mov ecx, edi
jns 0x517193
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15539c]
or eax, eax
je 0x5171a9
mov dword [ebx], eax
add ebx, 4
jmp 0x517181
call dword [esi + 0x1553ac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5171e0
cmp al, 0xef
ja 0x5171d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5171b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5171c2
mov ebp, dword [esi + 0x1553a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x517214
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x1220b7a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], ebx
mov ebx, 0xbe3d730c
shl ebx, 0x9f
inc bx
mov bl, byte [ebx + ecx - 1]
push 0xbf81b083
xor ebx, edx
jmp 0x1358125
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x179d8bc]
shr edx, 8
jmp 0x137d994
or eax, dword [edx + 0x2444c71c]
or byte [ebx + eax*8 - 0x27cd58cf], bh
call fcn.0130a6b3
xor edx, ebx
inc ecx
call fcn.0123c5a0
inc edx
jle 0x137d941
movsd dword es:[edi], dword [esi]
xchg esi, eax
sbb bl, byte [edi + 0x2a104949]
invalid

Function at 0x122651b
Capabilities:
Encode data using base64

Disassembly:
lea edx, [ecx + edx*8 + 0x53027835]
inc eax
inc ecx
jp 0x124e602
rol dword [esp + 8], 0x9d
neg eax
dec eax
neg eax
rol cx, 0x2e
call fcn.013246c2
mov eax, dword [ecx + ebp - 0x10d32]
mov dword ss:[ecx + edx - 0x10d36], eax
call fcn.017ca39b
jmp edi

Function at 0x122a996
Capabilities:
Encode data using base64

Disassembly:
inc edx
mov eax, dword [eax + ecx + 0x63def40f]
dec esp
mov dword [esp + ebp*8 - 0x29a08], ebp
dec ebp
lea ecx, [ecx + ebp - 0x5340]
inc esp
add edx, eax
push ebp
inc edi
mov dword [ecx + ebp - 0x73ad29a2], edx
movsx eax, bp
call fcn.01383b33

Function at 0x1232a2e
Capabilities:
Encode data using base64

Disassembly:
push ebx
inc ecx
mov ebp, dword [edi]
dec esp
lea edx, [ebx*4 + 0x5d80ff3c]
dec eax
mov dword [esp + 8], 0xa62a5fa9
shr word [esp + 1], 0xc8
inc ecx
xor ebp, ebx
lea ebp, [ebp + edi - 0xa03a904]
bswap ebp
inc eax
not bh
inc ecx
push edx
dec esp
lea eax, [edi + edi*4 + 0x28ba41bc]
xor ebp, 0xa52f6702
dec eax
dec dword [esp + 0x10]
inc eax
and byte [esp + 0xd], bh
dec ebp
xchg dword [esp + 3], ebx
ror edi, 0xba
not byte [esp + ebx*8 - 0xfee6]
dec esp
mov dword [esp + edi - 0x4a9d57e5], ebx
jae 0x17b80a4

Function at 0x124522a
Capabilities:
Encode data using base64

Disassembly:
shl ecx, 0xa9
bswap edx
inc edx
push eax
xor edx, 0xb990b435
mov dword [esp + ecx*2 + 4], 0xd22fcba0
push eax
xor cx, cx
ror edx, 2
sub byte [esp + ecx + 1], ch
not cl
inc dword [esp + ecx - 0xf4]
inc edx
rol edx, 2
dec dword [esp + ecx*8 - 0x7f8]
seto byte [esp + ecx*2 - 0x1fa]
sal ecx, 0xe7
dec edx
sal ecx, 0x79
xor byte [esp + ecx + 0xf], ah
dec dword [esp + ecx + 4]
xor ebx, edx
xadd dword [esp + ecx + 8], eax
add edi, edx
Function at 0x12452b4
Capabilities:
Encode data using base64

Disassembly:
sub esi, 4
mov ecx, dword [esi]
xor ecx, ebx
mov dword [esp], 0x760b8735
mov edx, 0x6a8c6b9e
jmp 0x17b97ab
sub ecx, 0x1d2136b4
movzx eax, word [esp + edx - 0x6a8c6b9e]
xchg byte [esp + eax - 0x8733], al
call fcn.01245348
mov ebp, 0xfa2d948f
movzx edx, bp
rdtsc
dec ecx
sub ecx, 8
inc esp
movzx esi, bp
inc cx
shl esi, 0x86
inc ebx
mov dword [ecx + esi*2 - 0x477c], eax
inc ebx
mov dword [ecx + esi*4 - 0x8f00], edx
sar bp, 0xe
dec edi
lea edi, [edi + esi*2 - 0x4784]
dec eax
lea edx, [ebp + 0x7c258794]
inc edi
mov ebp, dword [edi + esi*8 - 0x11e00]
inc ecx
push esi
inc ebp
xor ebp, ebx
inc edx
xor dword [esp + esi*8 - 0x11dfc], ebp
inc esi
movzx edx, byte [esp + esi*8 - 0x11dfe]
inc ecx
ror ebp, 1
dec ecx
sar esi, 0x7c
inc esi
movzx eax, word [esp + esi + 3]
dec esp
lea esp, [edx*8 - 0x1fdf3052]
inc ecx
inc ebp
inc bp
xadd eax, esi
inc ecx
rol ebp, 3
inc ecx
bswap ebp
inc edi
lea ebp, [ebp + esi - 0x202e3088]
dec esi
and dword [esp + esi*2 - 0x1fc00], esp
inc ecx
not ebp
dec esi
mov dword [esp + esi - 0xfe00], ebx
call fcn.013a482b

Function at 0x1247ff0
Capabilities:
Encode data using base64

Disassembly:
dec ebx
lea ebx, [esp + 0x658ab4a8]
inc ecx
inc ebp
movzx ebp, ah
dec esi
mov dword [esp + ebp - 0xa9], ebp
ror ecx, 3
inc esi
movsx eax, word [esp + ebp*4 - 0x2a3]
dec edx
shr dword [esp + ebp*2 - 0x152], 0xd6
inc edx
lea ecx, [ecx + eax + 0xc06058a]
bswap ecx
dec esi
xor dword [esp + ebp*2 - 0x152], ebx
jmp 0x179135a
inc ecx
pop ebx
dec ecx
ror esp, 0xc2
inc ebp
movzx edx, sp
inc cx
sal edx, 0x67
dec eax
arpl cx, cx
inc cx
sub ebx, esp
movzx eax, bx
setne bl
dec eax
add esi, ecx
dec eax
lea ebp, [ebx + 0x2995ac05]
push ebp
dec esi
lea edi, [ebx + edi - 0x5603]
neg dword [esp + ebx*2 - 0xabfe]
inc ebp
movzx ebp, word [edi + ebx*4 - 0x15804]
inc bp
xor ebp, ebx
inc ecx
sub ebx, esp
jne 0x17b1975
mov edx, 0xb9b6ae1b
movsx ecx, dx
movzx dx, byte [ebp]
lea eax, [ecx + ecx*4 + 0x323faf94]
mov cl, byte [ebp + eax*2 - 0x647c2c34]
neg eax
rol al, 0xa5
adc ebp, 2
call fcn.017800bb
inc ecx
xadd ebp, ebx
xor dword [esp + ebx - 0xa9], ecx
jmp 0x1356e0b
inc cx
dec ebp
call fcn.0137f279
Function at 0x124fc2d
Capabilities:
Encode data using base64

Disassembly:
call fcn.013376e6
mov edx, 0x118c1203
jmp 0x1339d64
lea ebp, [ebp + edx - 0x118c11ff]
or edx, dword [esp + edx - 0x118c1203]
shl edx, 0xb5
xadd word [esp + edx - 0x405ffffe], dx
mov dword [esp + edx - 0x4060118c], eax
setb dl
popfd
lea esi, [ecx + esi - 0xa4c7]
add dl, dl
and ecx, 0x1e3f0d96
mov ecx, dword [edx + esi - 0x40601100]
adc edx, 0xbe8b3b24
xor ecx, ebx
push edx
sal word [esp], 0xee
push edx
xor ecx, 0x712df333
movsx eax, dl
dec ecx
xor eax, 0x7c073a9f
xor ecx, 0x34910e1f
neg ecx
xor ebx, ecx
dec word [esp + eax - 0x7c073ab7]
and word [esp + eax - 0x7c073aba], dx
jnp 0x1310ec8
add edi, edx
inc cl
mov edx, ebp
mov dword [esp], ecx
mov dword [esp + 4], ecx
or word [esp + 6], cx
sbb ebp, 2
movzx eax, word [esp + 4]
jmp 0x13131a8
adc edi, ecx
mov dword [esp + eax - 0x7c073abb], eax
pop edx
sar dl, 0x45
mov dword [esp + eax - 0x7c073abb], edi
ret
or eax, ecx
mov word [ebp], dx
pop ecx
pop ecx
jle fcn.01798914
push edx
mov eax, dword [edx + ebp - 0x118c1203]
lea ecx, [edx + edx - 0x7e54b256]
shr ecx, cl
ja 0x1251af1

Function at 0x1250589
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ecx - 0x3e9b8807], eax
inc ebp
xor dh, bl
movzx edi, cl
inc ecx
xor dh, 0x1e
shr word [esp + ecx*2 - 0x7d37100a], cl
inc ecx
sbb dh, 0x25
inc ecx
rol dh, 1
not cl
inc ecx
add dh, 0x97
and ecx, 0x78bfffba
dec eax
mov dword [esp + ecx*2 - 0x71371170], 0x7d94e49e
dec eax
or dword [esp + ecx - 0x389b88b8], 0xc5369d1f
inc ecx
neg dh
inc cx
shr esp, 0x49
inc sp
or esp, dword [esp + ecx - 0x389b88b7]
inc ecx
inc dh
inc ebp
xor bl, dh
rol dword [esp + ecx*2 - 0x7137116f], cl
dec esi
lea esi, [esp + esi + 8]
jae 0x131bda1
push ecx
dec esi
mov esp, dword [ecx + esi - 0x389b88b8]
sar dword [esp + edi + 2], 0x1f
jae 0x17a0845
dec ebp
lea ecx, [ecx + ecx - 0x389b88c0]
neg word [esp + edi - 4]
dec eax
sub edi, eax
jle 0x139b977
dec eax
xchg edx, ebx
dec ebp
arpl bp, bp
dec ecx
add esi, ebp
dec dl
inc ebp
mov edx, dword [ecx + ebx + 0x4761d3fe]
inc ebp
movzx ebp, ax
dec ebp
lea ecx, [ecx + ebx + 0x4761d402]
neg cx
rol ax, 0xe1
inc edi
movzx ebp, byte [edi + esi - 0x7331bc59]
jp 0x17bfb4d
inc cx
add eax, 0x416691a6
xor eax, 0x894e1da8
xchg esp, eax
hlt
inc ecx
movsx ebp, ah
dec ebp
lea edi, [edi + ebx + 0x4761d3f5]
call fcn.0178007e

Function at 0x1264fa6
Capabilities:
Encode data using base64

Disassembly:
inc ecx
movzx edi, dx
dec eax
adc esi, ecx
dec edx
mov dword [esp], esi
ret 0x10
xor ecx, edi
jmp 0x135ce92
mov edi, 0xda19ae3f
movzx edi, byte [eax]
xor edi, ecx
call fcn.0126563e
lea esp, [esp + 8]
jne 0x132001e
pop edi
mov eax, 0x588a0e97
lea edx, [eax*4 - 0x42e132cc]
ror edx, 0xa1
not ecx
call fcn.017d0ec8
dec esi
mov ebx, dword [esp + 0x10]
dec esi
mov dword [esp + 0x10], edx
inc ecx
or ebp, 0x6229c4a3
je fcn.0122a92f
dec eax
arpl cx, cx
inc edx
inc dword [esp + 0xe]
jns 0x1237601
inc edi
movzx ebp, word [edi - 0x5c9e9496]
jmp 0x175d96f
inc eax
xor ecx, 0x96a83eb2
dec edx
jmp 0x1340173
Function at 0x126991d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ebx*2 - 0x65f0], ecx
dec eax
arpl di, di
inc ecx
rol dh, 0x87
setb byte [esp + ebx - 0x32f0]
dec eax
add esi, edi
dec eax
mov dword [esp + ebx*4 - 0xcc00], esi
ret 0x10
dec esp
mov ebx, dword [esp + ebx*2 - 0x65f0]
jp 0x1246eda
cli
add dword [ebp - 0x3e45d824], edi
cmp ecx, ebp
dec edx
mov edx, 0x9924b30d
lea ecx, [edx + edx*4 - 0x7e71f700]
lea eax, [edx + edx*4 + 0x60066d09]
lea esi, [eax + esi - 0x5dbdec4e]
mov ecx, dword [esi + eax - 0x5dbdec4a]
sub eax, eax
xor ecx, ebx
neg dx
sal edx, 0x5c
lea ecx, [ecx + edx*2 + 0x3d8e4220]
setbe al
dec edx
ror ecx, 2
call fcn.01761a04

Function at 0x131de99
Capabilities:
Encode data using xor

Disassembly:
dec eax
neg dword [esp + edi*4 - 0x98]
dec ebp
xchg edx, eax
not bx
inc eax
setg bh
inc cx
dec edx
ror bx, 1
inc ecx
push esi
not bx
sal ecx, 0xe5
shr word [esp + edi*2], 0x8f
sbb bx, 0xf308
or edi, 0x2a05a484
xor bx, 0x5c0b
call fcn.017a1623
popfd
dec ebp
aad 0x99
jbe 0x131deb2
fsub qword [eax + 0x5d897cc7]
jns 0x131def7
mov edi, 0x6c8bbfcd
and al, 0xa4
inc ecx
into
mov al, byte [0xebe3c776]
jle 0x131de9a
jbe 0x131debf
lahf
or ecx, dword [edx]
sub dword [edi + 0x70dd1876], esi
invalid

Function at 0x131ef8b
Capabilities:
Encode data using base64

Disassembly:
dec al
pop edx
neg al
shl word [esp], 0x24
inc al
neg al
xor bl, al
push 0xb4975b2d
mov dword [esp + 8], esi
mov dword [esp + 4], edi
pop edx
inc dx
sar edx, 0x90
push ebx
lea ebx, [edx + edx - 0x5964b864]
mov ebx, eax
movsx eax, dx
jnp 0x1767622
xor eax, eax
mov edx, ebx
sal edx, 2
push eax
xor eax, ebp
neg byte [esp + 3]
adc eax, edx
mov dword [ebp - 4], eax
not word [esp + 1]
mov dword [esp], 0xb7935b9f
test ebx, ebx
lea esp, [esp + 4]
je 0x135f23f

Function at 0x132056e
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ecx - 0x52f8f890], 0xfc835a17
inc bp
xor edx, ebx
dec edx
inc dword [esp + esi - 0x47a42131]
inc cx
rol edx, 1
inc sp
add edx, edi
and bx, dx
inc cx
not edx
inc edx
xor byte [esp + esi - 0x47a42130], 0x8c
dec ax
pop edi
inc cx
rol edx, 1
dec edx
lea ecx, [ebp*4 - 0x2d6eedd7]
dec eax
dec edi
dec dx
inc bp
xor ebx, edx
and edx, eax
dec esp
adc edx, esp
inc ebp
add dh, ch
dec eax
add ebp, edx
dec eax
inc bx
mov eax, dword [esi + edx - 0x47a42130]
inc ecx
push esi
dec esi
lea ecx, [edx + ecx - 0xae]
inc edx
inc byte [esp + esi - 0x47a4212e]
inc esi
movzx edx, byte [esp + esi - 0x47a4212c]
pop edx
inc cx
mov dword [ecx + edi + 0x37c29e9], eax
dec ebp
lea ebp, [ebp - 0x70d67afe]
dec esp
lea edx, [edi*4 - 0x33d94f4f]
inc ebp
xadd eax, edx
jns fcn.01343929

Function at 0x1324fbf
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec esi
mov dword [esp + eax + 6], ebx
dec esp
xchg edi, esp
inc cx
shl esi, 0xed
inc edx
xor dword [esp + eax*2 - 4], edx
dec edx
mov dword [esp + eax*4 - 0x28], 0x542df70b
dec esi
mov ebx, dword [esp + eax*2 - 4]
Function at 0x1328ca1
Capabilities:
Encode data using base64

Disassembly:
ror word [esp + ecx*8], 0xa7
call fcn.0122d7f6
mov edx, dword [esi + edx*2 - 0x3dc36c]
sbb ax, ax
xor edx, ebx
rol byte [esp + ecx*2 - 1], 0x26
jae 0x130863f
dec ecx
sub edi, 4
jmp 0x1324579
inc ecx
mov esp, 0x7a86522f
dec edi
lea ebp, [esp - 0x7fd8c7f9]
inc edi
mov esi, dword [edi - 0x7a86522f]
inc ebp
xor esi, ebx
dec edi
lea eax, [ebp + ebp*8 + 0x7aace4b9]
inc ecx
dec esi
inc ecx
bswap esi
inc ecx
ror esi, 2
dec ecx
rol eax, 0x61
inc ecx
sub esi, 0x2723209b
inc ecx
movsx eax, ch
inc ecx
push ebx
inc ebp
movzx ebx, ah
inc ecx
neg eax
inc esp
xor dword [esp + eax - 0x65], esi
inc ecx
movzx ebx, bp
inc ecx
movsx edi, sp
inc ecx
pop ebx
dec ebp
arpl si, si
jmp 0x13676c2
call fcn.01358044
xadd word [esp + ecx - 0x31], cx
lea esi, [esi + ecx*4 - 4]
neg word [esp + ecx + 1]
movzx eax, dx
sub eax, dword [esp + ecx]
xor ecx, dword [esi + ecx]
rol dl, 0x25
xor ecx, ebx
add edx, edx
sal edx, 0xe2
bswap ecx
js 0x1373ef7
xor ecx, 0xe90e970c
rol edx, 0xd4
jb 0x124527e
jae 0x139b751
inc esp
mov edx, edi
jmp 0x17ac097
lea edx, [edx*4 + 0x5dad4c26]
mov word [ebp + edx*4 - 0x7b86d8], ax
mov dword [esp + edx - 0x1ee1b6], 0x20025a00
lea esi, [esi + edx - 0x1ee1ba]
mov eax, dword [esp + edx - 0x1ee1b6]
rol word [esp + edx - 0x1ee1b4], cl
jno 0x131417e
bswap ebp
inc ecx
push ebx
push edi
inc esi
xor dword [esp + esi - 0xff97], ebp
dec edx
neg dword [esp + esi - 0xff9f]
inc eax
xor ch, 0xae
dec esi
mov ebx, dword [esp + esi*4 - 0x3fe74]
dec ebp
arpl bp, bp
dec ecx
adc esi, ebp
inc esp
movsx ebp, di
call fcn.0137d4c3
mov ecx, 0x74148e8e
dec edx
or cx, cx
movzx eax, cl
rol edx, 1
call fcn.013098cf
rol ecx, 1
rol byte [esp + edx*2 - 0x65fffffe], 0xe5
and ax, word [esp + edx - 0x33000000]
xchg edx, eax
neg ecx
xor ebx, ecx
ror dword [esp + eax - 0x33000000], 0xd3
and byte [esp + eax - 0x32ffffff], dl
adc edi, ecx
neg word [esp + eax - 0x32ffffff]
rol dx, 0xe1
mov ecx, eax
mov dword [esp + eax*2 - 0x66000000], edi
ret
dec ecx
add esi, esi
dec eax
add eax, 0x7ead4830
dec edi
mov esp, dword [esp + ecx - 0x7a86522f]
inc ecx
mov ebp, edx
shl ebp, 0xdf
dec ebx
mov ecx, dword [ecx + ebp - 0x7533dc5d]
dec eax
sar ebp, 0xac
dec edi
lea ecx, [ecx + ebp - 0x7533dc55]
dec edx
mov dword [eax - 0x7ead4895], ecx
inc esp
mov esi, edi
inc cx
sar ebp, 0x62
dec eax
shr ebp, 0xe3
dec eax
add ebp, esi
jmp ebp
Function at 0x132cc4c
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x2d144021
inc ecx
mov ecx, dword [edi + eax*2 - 0x5a288046]
dec eax
mov dword [esp + eax*2 - 0x5a288042], eax
inc ecx
pop ebp
inc esp
mov eax, dword [esp + eax - 0x2d14401f]
dec esi
lea edi, [eax + edi - 0x2d144025]
inc esp
mov edx, eax
inc ecx
xor ecx, ebx
bswap ecx
inc ecx
pop edx
call fcn.01335cb2
inc ecx
mov esp, 0xa0b9519
dec edx
lea edx, [0x152da8bf]
inc di
movzx eax, byte [esp + ecx - 0xa0b9519]
inc ecx
mov ch, byte [ecx + edx - 0x658a5185]
dec edi
lea ecx, [ecx - 0xa0b9517]
dec ecx
or esp, 0xb00a243b
movzx edi, dx
inc esp
or al, ch
inc esp
movzx ebp, dx
dec eax
sal edx, 0x68
inc cx
ror esp, 0xe2
inc ecx
not al
movzx ebx, di
inc ecx
movsx eax, ah
dec edx
lea edx, [ebx + ebp*8 - 0x56799c50]
inc di
mov dword [esp + ecx + 0x45f412b2], eax
xchg edi, eax
inc esp
movsx eax, bl
inc eax
sal bh, 0x46
dec ebp
lea edi, [edi + edi - 0x84]
dec ebx
jl 0x1320591
push edx
inc ecx
mov eax, dword [edi + edx + 0x5676be91]
inc ecx
mov ebp, eax
mov ecx, 0x5e96e7b2
inc ecx
xor eax, ebx
inc edx
shr dword [esp + 0x45f412b2], 0x36
inc esi
mov edx, dword [esp + 0x45f412b5]
add word [esp + edx + 0x5676be91], dx
dec eax
neg eax
jmp 0x17c203f
inc edx
sal byte [esp + 0x45f412b8], 0xa4
ror edi, cl
dec esp
mov dword [esp + edi - 0x20000], ebx
xor dword [esp + edx + 0x5676be91], eax
inc ecx
pop ebx
call fcn.0139dd32
xor eax, 0xef1d5b8a
inc edx
rol dword [esp + 0x45f412b2], cl
dec ecx
dec edx
dec eax
or ecx, ebx
inc eax
jmp 0x177fb66

Function at 0x1330817
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov dword [esp + edi - 1], esp
not word [esp + edi*2 + 7]
dec ebp
arpl dx, dx
call fcn.0136d6bd

Function at 0x133f5a8
Capabilities:
Encode data using base64

Disassembly:
lea edx, [ebp + ecx - 0x3fda]
lea eax, [ecx + ecx*8 - 0x24d58e66]
call fcn.013246b5
Function at 0x133f5bb
Capabilities:
Encode data using base64

Disassembly:
dec ebx
jmp 0x1395de6
movzx edi, al
sar al, 0x27
dec esi
lea edi, [ebx + edi - 0x34]
sub ax, 0x289e
dec eax
adc dword [esp + ebx*4 - 0xb0], 0xbd30e4a0
inc ecx
mov ebx, dword [edi + ebx - 0x30]
sub word [esp + ebp - 0x1c], di
call fcn.017a42d7
inc esp
xadd dl, dh
rol edi, 1
dec edx
lea ecx, [0x62b9ff26]
inc edx
dec eax
shr ebx, cl
inc edx
lea edi, [edi + edx*8 - 0x1f069794]
inc ebp
xchg dl, dh
mov eax, ebx
xor edi, 0x1422d81f
add ax, cx
inc ecx
push ebx
inc ecx
mov ebx, 0xabaa826
inc ebp
cmovns esi, ebx
inc edx
xor dword [esp + ebp - 0x381fd0d2], edi
dec esp
and ebx, ecx
inc ecx
pop ebx
shl bx, 0x82
setne dl
inc ecx
dec al
dec eax
arpl di, di
and bx, ax
inc ecx
xchg esi, ebx
inc cx
shl esp, cl
dec eax
add esi, edi
jmp 0x17cbdf7
mov edx, 0x2da6c09a
mov ebp, dword [ebp + edx*2 - 0x5b4d8138]
lea esi, [edx + edx*8 + 0x495ada0]
mov ecx, edx
movzx edi, dx
mov dword [ebp + edx - 0x2da6c09a], eax
jmp 0x139d737
lea esp, [esp + 8]
jne 0x176764e
mov eax, dword [ebp]
push 0x423d6086
lea esp, [esp + 4]
call eax
jmp 0x135272b
sub cx, dx
jmp edi
jmp 0x135f235
shl dl, 0x64
neg ecx
pop ebx
pop edi
xadd si, dx
shl cl, cl
seta dl
pop esi
lea eax, [ecx + ecx*4 - 0x2e799be4]
js 0x138393d
mov eax, 0xb81a303e
shl ax, 0x6e
call fcn.01391d2b
dec eax
mov dword [esp + ebx - 0x20], 0xa3162923
inc ebp
shrd esp, esi, cl
inc ebp
mov dword [ecx + ebx*4 - 0xc0], esp
jmp 0x1345119
jmp fcn.01343929

Function at 0x13457a1
Capabilities:
Encode data using base64

Disassembly:
adc edx, 0x58bd0a1
neg edx
ror edx, 3
inc esp
movzx esp, bx
mov ecx, 0x58aa66a8
inc edx
mov ebp, ecx
inc ecx
mov edi, edx
dec esi
add dword [esp - 0x3fecc], ebx
inc edx
xor dword [esp - 0x3fecc], edx
shr bp, cl
or ebx, 0x60bab899
inc ecx
pop ebx
dec eax
arpl dx, dx
adc ebx, ebx
dec ecx
dec eax
add esi, edx
dec esp
lea esp, [ecx*2 - 0x87acf70]
dec ebp
mov edx, dword [ecx + ecx - 0x58aa66a7]
shr cx, 0xe5
jb 0x13573d3
inc ecx
movzx eax, ah
inc cx
mov ecx, dword [edx + ecx - 0x58aa0335]
jp 0x130dc75
dec ebp
lea ecx, [ecx + eax*2 - 0x1b6]
inc esp
movsx eax, bx
inc ecx
mov esi, 0x2fa6b71c
dec esi
lea edx, [eax*4 - 0x7e7e2a61]
inc dx
mov dword [eax + ecx - 0xde], ecx
inc cx
sar esp, 0xc6
jmp esi
inc ecx
xor edx, ebx
inc ecx
movsx ebx, dl
dec eax
sar dword [esp], 0xf2
je 0x122a8c2
dec ecx
sub edi, 4
inc ecx
mov edx, dword [edi]
dec esp
mov dword [esp], edx
jmp 0x1324944

Function at 0x13480d7
Capabilities:
Encode data using base64

Disassembly:
inc cx
rol esi, 1
inc cx
not esi
inc cx
rol esi, 1
inc bp
xor ebx, esi
call fcn.01393078
dec eax
mov dword [esp + edi - 0x59bdc9ad], 0x1a1b313f
dec ecx
lea edx, [esi + edi + 0x379df334]
inc si
mov dword [edi + ecx - 0x59bdc9ad], edx
call fcn.01380b68
inc cx
dec esi
inc ecx
neg ebp
js 0x1320233
jg 0x1267b66
mov dl, byte [ebp + ecx - 0x591ecf36]
neg dword [esp + ecx - 0x591ecf31]
jne 0x17bfb48
call fcn.0125f663