joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19131bf
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
btr ecx, ecx
neg al
xor edx, ebx
push ecx
xor eax, 0x98bb0124
btr ecx, 0x14
sbb edx, 0xaa30049a
ror ecx, cl
jae 0x1035a09
call fcn.00f9d1bd
mov ebp, 0xcaac433
dec esp
lea edi, [ebp + ebp - 0x5ff7eaf5]
dec eax
lea edx, [ebp + ebp*2 + 0x621a630]
dec ebp
lea ebp, [ebp + ebp*2 - 0x1955886a]
mov edi, ebp
inc ecx
mov ecx, dword [ebp + ebp - 0xcaac433]
dec esp
lea ecx, [ebp*4 + 0x6f2a1b35]
inc ecx
mov eax, edi
inc ecx
xor ecx, esi
dec eax
cdq
not ecx
neg ecx
xor ecx, 0x6328e43e
inc ebp
mov edx, ecx
rol ecx, 1
dec ecx
sal edx, 0x98
inc ecx
movsx ebx, cl
jp 0x196ff7d
mov eax, 0xb2cb4bd
movzx ecx, ax
movsx edx, cl
mov eax, dword [eax + ebp - 0xb2cb4bd]
movzx cx, byte ss:[ecx + eax - 0xb4bd]
mov eax, edx
add ebp, 2
mov word [ebp], cx
lea ecx, [edx*2 - 0x4ebda77]
bt cx, cx
btc eax, ecx
sbb esi, 3
mov edx, dword [esi]
jmp 0x121243e
inc ecx
push esi
rol ebx, 0xe7
push ebx
inc esp
movsx esi, dl
xor dword [esp + ebp - 0xcaac42b], ecx
dec esp
mov esi, dword [esp + ebp*2 - 0x1955885e]
inc esp
movsx esp, byte [esp + ebp*2 - 0x19558863]
dec eax
arpl cx, cx
shr edi, 0x61
inc ecx
push edx
dec eax
add esi, ecx
not dx
inc cx
neg edx
dec edx
mov edi, dword [ebp + ebx - 0xcaac433]
neg dl
inc sp
mov ecx, dword [edi + ebp*4 - 0x32ab10cc]
dec ebp
lea ebx, [ebx + ebp*2 - 0x19558860]
inc ecx
dec edi
inc ecx
xchg ah, ch
inc bp
mov dword [ebx + ebp*2 - 0x19558800], ecx
push ebx
dec eax
mov dword [esp + ebp - 0xcaac400], esi
ret 0x18

Function at 0x19184f0
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jne 0x196b2cf
mov eax, 0xd23cb710
mov eax, dword [ebp]
call fcn.0194cd80
mov edx, 0xd51d0da8
movsx eax, dl
mov cx, word [ebp]
neg edx
dec eax
sbb dx, 0xcd3a
lea edx, [esp + edx*2 - 0x55c44a22]
setg al
shl eax, 0xc2
neg al
mov word [edx], cx
movsx edx, al
mov ecx, dword [esi - 4]
add esi, edx
xor ecx, ebx
add ecx, 0x6d8e263e
xor ax, dx
neg ecx
jmp 0x1918547
dec ebx
jmp 0x18d7eab
call fcn.01038cd7

Function at 0x191b377
Capabilities:
Encode data using base64

Disassembly:
inc ecx
movzx ebp, sp
inc eax
movzx eax, ch
neg bl
not edi
add bl, 0x2f
xor bl, 0x87
dec eax
lea eax, [eax + edi*4 + 0x2720159d]
call fcn.010616c4
dec edx
mov dword [esp + edx*2 - 0x1290c], 0xfea7f89b
inc ecx
mov eax, dword [ebp + edi - 0x6e35459f]
or di, 0xe7b0
or di, 0x4d92
call fcn.00fef1c9
mov edi, 0x951c10aa
movzx ecx, di
dec esp
lea esp, [ecx + edi*8 + 0x3abc0b93]
inc cx
mov ecx, dword [ebx + ecx*4 - 0x42a8]
inc ecx
movzx ebx, byte [ebp - 1]
inc ecx
shl esp, 0xda
dec ecx
adc edi, esp
inc ecx
xor bl, dh
shr edi, 0xe8
inc ecx
rol ah, 6
mov edx, 0x6d21581d
dec bl
jmp 0x18e3977

Function at 0x191d623
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x2283dd60
call fcn.00fd86b2

Function at 0x1924ac9
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x75869e19
not ecx
pop eax
sub eax, edx
neg ecx
jmp 0x1229d7c
Function at 0x1925e53
Capabilities:
Encode data using base64

Disassembly:
add ecx, 0xb5399233
mov dword [esp + ecx - 0x687d1e6e], 0x9d9f1693
neg dl
call fcn.00ffa34c

Function at 0x192e10c
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 8]
jne 0x1208a0d
jmp 0x18eb935

Function at 0x192fbbe
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [ebp + eax*2 - 0x1fdfe]
jge 0x18de40d
inc esp
or byte [esp + ebx - 0x34a12bab], cl
rol cl, 1
jmp 0x1935ec0
mov dword [esp + eax - 0xff00], edi
ret 0x10
neg al
xor bl, al
not dx
lea eax, [esp + eax + 0x10]
push edx
mov dword [eax + edx*4 - 0x3ffd0], ecx
mov eax, dword [esp + edx*2 - 0x1ffe8]
or al, dh
mov dword [esp + edx - 0xfff0], 0x30b6d2a6
mov dx, 1
inc al
mov word [ebp + eax - 0xfefe], dx
jp 0x1004167
inc ebp
bt ecx, esp
inc cl
inc sp
xadd dword [esp + ebx*2 - 0x69425751], ecx
dec edx
lea ebp, [ebx + ecx*4 - 0x3febbc4c]
neg cl
div bl
sub ebx, dword [esp + ebx*2 - 0x69425754]
rol cl, 1
inc esp
xor dh, cl
inc edx
sal byte [esp - 0x15d56], 0xc2
inc eax
sub byte [esp + ebx - 0x41a0f709], ch
dec eax
lea ecx, [esp + ecx + 8]
dec eax
lea edi, [ebp + ebp*4 + 0x4dad8210]
inc ebp
mov dword [esp + ecx - 0x2bab], edx
dec esi
lea edx, [eax + ecx*4 + 0x6b240ca0]
bts ax, 0x3d
inc edx
mov ecx, dword [ebx + ebp - 0x41a0f70f]
cwde
inc ecx
xor ecx, esi
inc ecx
imul esp
inc esp
xor ah, dl
dec ecx
dec esp
lea eax, [eax*4 + 0x128a6fa0]
dec eax
xchg dword [esp + ebx - 0x41a0f70a], edi
neg ecx
cbw
dec eax
cwde
xor ecx, 0x81e7821
jmp 0x103a934

Function at 0x192fbf9
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp + edx - 0x430a9eb1], eax
mov dword [esp + edx - 0x430a9ead], edx
mov eax, 0xab1f1986
mul word [esp + edx - 0x430a9ead]
mov eax, dword [esi + edx - 0x430a0fd5]
pop ecx
bswap edx
rol ecx, cl
lea esi, [esi + ecx - 0x53d5a865]
bswap ecx
sar edx, 0x2e
xor eax, ebx
call fcn.0197fba2
push esp
pop esi
add byte [edi + 0x2e4a55e7], ah
sbb ah, byte [ebx - 0x5fe55671]
mov bl, 0xea
and ah, ah
mov ebx, 0xda92e8a5
mov ecx, 0x37ae0a31
lea edx, [ecx + ecx - 0x66e351da]
btc edx, edx
lea esi, [esi + ecx - 0x37ae0a35]
mov ecx, dword [esi + ecx*2 - 0x6f5c1462]
adc edx, 0xe20dd70b
add dx, 0x7384
adc dx, dx
xor ecx, ebx
sar dl, 0x26
rol ecx, 3
call fcn.01924ac9
mov eax, 0xd1affe33
mov ecx, eax
movsx edx, al
mov eax, dword [edx + esi - 0x37]
btr cx, 0x3a
xor eax, ebx
call fcn.0103e1c3
pop ebx
inc ebx
push es
cmpsd dword [esi], dword es:[edi]
push dword [esi + 0x65]
sub edx, dword [ebx]
xchg edx, eax
mov cl, 0xc4
Function at 0x193bdbd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push edi
mov dword [esp], 0x24458480
call fcn.00fd86b2
not ecx
ror ax, 0x69
btc edx, eax
shr dx, 0x63
neg ecx
cbw
inc ecx
bswap eax
shl eax, 0x9f
lea eax, [edx + eax*2 + 0x15b50b98]
xor ebx, ecx
bt edx, edx
or dl, ah
adc edi, ecx
jmp edi
add edx, 0xeb25b6bc
xor ecx, ebx
bts eax, eax
lea ecx, [ecx + eax - 0x5a1e0567]
jb 0xfaf79c
lea eax, [edx - 0x68cad566]
xor ecx, dword [edx + esi]
btr edx, edx
jae 0x10041a0
not dword [esp + 6]
jmp 0x18dedbb
rol edx, 1
not edx
rol ecx, 0x54
dec edx
shr eax, cl
add ecx, eax
neg edx
ror ecx, 0x41
and al, ah
xor ebx, edx
btc cx, ax
ror ax, 0x69
adc edi, edx
movsx edx, cl
mov ecx, dword [ebp + ecx - 0x45e7fff9]
call int.0193a101
lea esp, [esp + 0xc]
jmp 0xfadfbb
sbb edx, edx
mov word [ebp + edx*4], ax
mov ecx, edx
lea esi, [esi + edx*8 - 4]
jns 0x101729e
mov ecx, 0x170a2ba1
lea esi, [esi + eax*4 - 0x2c65e469]
not ecx
movzx ecx, byte [eax + esi - 0xb19791a]
mov edx, eax
mov dword [esp + eax*4 - 0x2c65e468], 0xb2b5f1b8
call fcn.0120de0a
mov eax, 0x7101fa10
lea ecx, [eax*2 + 0x5a20ed80]
mov ax, word [ebp + ecx*2 - 0x7849c340]
lea edx, [ecx + ecx*4 + 0x522fc491]
mov cl, byte [ebp + ecx*2 - 0x7849c33e]
inc edx
sub edx, 0x9f12b70c
adc ebp, 1
sal ax, cl
bt dx, dx
jae 0x18f4e94
add byte [edi + 0x64], ah
imul esi, dword [eax + 0x6c], 0x642e7375
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax - 0x3d9ab75], bl
cwde
mov edx, dword [esi - 4]
xor edx, ebx
mov dword [esp], eax
push eax
pop eax
not edx
sub al, al
pop ecx
jns 0x105d23f
test dx, 0x8d93
Function at 0x193c08c
Capabilities:
Encode data using xor

Disassembly:
adc edi, eax
movzx ax, byte [edx + ebp - 0x33f1ede8]
rol dl, 0x87
ror edx, cl
push ecx
mov cl, byte [ebp + 2]
rol dword [esp], 0xe6
ror dl, 0x21
push edx
adc ebp, 2
xchg byte [esp + 3], dl
shl al, cl
xor dl, 0x87
mov word [ebp], ax
mov ecx, dword [esp + 4]
shr ecx, cl
mov dword [esp + ecx - 0x2b996f], edi
ret 4
pop edi
sbb eax, eax
dec esi
pop esi
rol ebx, 0xa3
cmp ebp, 0xb3305d92
rol bh, cl
neg eax
movzx ebx, cx
movzx bx, cl
pop ebx
jmp 0x19474c8
inc edi
jmp 0x197f6d7
mov byte [ebp - 1], al
jmp 0x193225c
jbe 0x101d188
pop edi
pop esi
not eax
mov ebx, 0xa4297d19
cbw
mov eax, 0xffffffff
xchg bx, bx
movsx ebx, bx
cmovbe ebx, eax
pop ebx
mov esp, ebp
jmp 0x194737f
inc eax
test sp, 0xada2
mov dword [ebp - 8], eax
sbb al, 0x10
mov al, byte [ebp - 1]
test bl, bl
jmp 0x193797b
je 0x18f549f
mov eax, 0x773b8718
cmc
mov edx, eax
mov eax, dword [ebp - 8]
mov cl, al
jmp 0x19636a0
je 0x1937989
cmp bl, al
je 0x19553e5
cmp al, bl
jmp 0x18f0767
neg ax
inc ecx
neg edi
inc ecx
mov esp, 0xbab1918c
dec edx
mov dword [esp + edx*2], 0x2eb82a84
inc esp
movzx eax, al
dec esi
mov dword [esp + edx*2 + 0x10], esi
inc esi
xor dword [esp + edx + 0x10], edi
dec esi
mov esi, dword [esp + edx + 0x10]
inc cx
ror eax, 0x64
inc edx
rol byte [esp + edx + 9], cl
dec edx
mov dword [esp + edx*4 + 0x10], ecx
dec ebp
arpl di, di
dec ecx
shr eax, cl
dec ecx
adc esi, edi
inc esi
add byte [esp + edx + 0x13], al
inc ebp
mov edi, esp
inc bx
mov ebx, dword [edx + ebp - 7]
inc cx
imul edi
inc eax
or ch, dl
dec ebx
lea edi, [eax + edx - 0xf6f054a]
dec edi
lea ebp, [ebp + edx*2 - 7]
jae 0xfa340f
mov edx, 0x7796b018
xor dl, dl
xor eax, ebx
or edx, 0xcd8429aa
rol eax, 1
lea ecx, [edx + edx - 0x3dd64480]
bswap edx
lea ecx, [edx + 0x6f3f58b2]
inc eax
rol cx, 6
ror eax, 2
sar cx, 0xc1
dec edx
bswap eax
inc eax
ror eax, 1
ror cl, 6
inc eax
xor ebx, eax
xchg edx, ecx
add edx, edx
ja 0xfa27b7
inc esi
jmp 0x104fbeb
pop ebp
ret
mov esp, ebp
not ebp
xchg ebp, ebp
pop ebp
ret
mov al, byte [edi]
setp bl
mov bl, byte [esi]
jmp 0x193c135
rol edx, cl
add dl, al
stc
clc
xor bl, dl
jmp 0x18f5491
cmp byte [ebp + 8], 0
jmp 0x18e4555
Function at 0x1941a2a
Capabilities:
Encode data using base64

Disassembly:
inc cl
inc ebp
mov esp, edx
inc ecx
dec edi
pop edi
call fcn.0196e43f

Function at 0x1944b99
Capabilities:
Encode data using base64

Disassembly:
dec ebp
arpl sp, sp
movzx edx, bp
dec ecx
sar eax, 0xee
not dx
dec ecx
adc esi, esp
dec ebx
mov ebx, dword [eax + ebp - 0xc]
dec ecx
xor ebx, esi
dec ebp
lea esp, [edx + ebp - 0xe55405a]
inc ecx
movzx eax, dl
dec eax
rol ebx, 1
call fcn.011ff5b8
inc ecx
xor esp, 0x81e7821
dec eax
mov dword [esp + ebx*2 - 0x118], 0xf6989128
dec ebp
bt edx, eax
inc ecx
dec esp
inc ecx
rol esp, 1
or byte [esp + ebx*2 - 0x115], 0x1d
dec ecx
lea ebp, [eax - 0x54652572]
inc ecx
inc esp
inc ecx
rol esp, 1
dec esp
mov dword [esp + ebx*8 - 0x460], esi
dec eax
lea ebx, [ebx - 0x70f707ea]
inc esi
xor dword [esp + eax - 0x7431], esp
inc ebp
movzx esi, dl
sar bl, 4
inc ecx
pop esi
inc cx
imul ebx, eax
mov edi, ebp
jb 0x18e1f14
or byte gs:[eax + ecx - 0x5a169ca9], ah
xor ch, bh
invalid

Function at 0x194a501
Capabilities:
Encode data using xor

Disassembly:
bswap edx
sal al, cl
sub eax, dword [esp + eax*4 - 0xf9401fc]
not word [esp + eax - 0x3d56c71]
sbb edx, 0xd716889b
sar eax, 0x14
mov dword [esp + eax - 0x3d], ecx
adc word [esp + eax*2 - 0x7a], cx
rol edx, 3
jmp 0x19305aa

Function at 0x194c9e4
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [esp + ebx - 0x1a1fdaac]
mov dword [esp + eax*4 + 4], eax
lea esi, [esi + eax*4 - 4]
div dl
and ecx, edx
jns 0xff5016
mov edx, dword [esi + eax]
sub dword [esp + eax + 2], eax
xor edx, ebx
shr dword [esp + eax*2 + 1], cl
btr ecx, eax
xor edx, 0x32249824
and dword [esp + eax + 4], ecx
lea ecx, [ecx + eax*8 + 0x5821baa2]
and eax, 0x44b12d8b
ror edx, 3
lea edx, [edx + eax*4 - 0x39a89ab1]
dec word [esp + eax*4 + 5]
cwde
xor word [esp + eax*2 + 6], 0xc629
neg edx
neg cl
sbb edx, eax
lea ecx, [ecx*2 + 0x651e3fab]
btr eax, ecx
not al
xor ebx, edx
add edi, edx
pop eax
pop eax
jmp fcn.0121e846
mov dword [ebp + ebx*2 - 0x343fb55c], ecx
movzx eax, word [esp + ebx*4 - 0x687f6ac0]
lea ecx, [ebx + ebx + 0x39033a87]
mov dword [ebx + ebp - 0x1a1fdab0], edx
lea edx, [eax*4 - 0x717a0851]
jp 0xfdfe93
mov dword [ebp + 8], ebx
mov ebx, 0x1a1fdab0
sar byte [esp + ebx*2 - 0x343fb55e], 0xe5
je 0x1938561
btr eax, eax
mov dword [ebp + eax - 0x48000eee], ecx
cwde
lea ebp, [ebp + eax*8 - 0x7746]
pop ecx
pop edx
pop edx
pop eax
pop edx
jae fcn.019143e0
inc esi
lea eax, [eax + eax - 0x148f8800]
rol edi, 0x88
dec eax
and dword [esp + ebx - 0x3a80e8], 0xe58d301e
inc ecx
bswap eax
mul dword [esp + ebx - 0x3a80ee]
sar byte [esp + ebx - 0x3a80ea], 0x26
pop ebp
inc edi
lea eax, [eax + ecx*2 + 0x6efd737c]
inc ecx
neg eax
inc word [esp + ebx - 0x3a80ef]
dec esp
mov dword [esp + ebx*2 - 0x7501de], esi
inc ebp
bts esp, esp
inc esp
xor dword [esp + ebx - 0x3a80ef], eax
inc ecx
pop esi
dec ebp
arpl ax, ax
call fcn.018d5da0
mov ecx, 0xb3ba7914
movzx eax, cl
mov eax, dword [eax + ebp - 0x14]
mov ecx, dword [ebp + 4]
mov edx, 0xab9e48af
push edx
shr byte [esp + 2], 0x43
mov dword [esp], ebx
dec edx
rol edx, 0xea
lea edx, [edx*4 - 0x7a5c9cfa]
cpuid
sbb ebp, 8
push 0xfc07db14
sal dword [esp], 0x19
mov dword [ebp + 0xc], eax
ja 0x193fc1d
Function at 0x19510ff
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], 0x24458480
lea esp, [esp + 8]
call fcn.00fd86b2
pop ebx
pop ebp
or al, 0xb5
out dx, al
inc ebx
push ecx
sub edx, dword [ecx]
add dword [ebx - 0x34cd804a], 0xf
xor cl, bl
btc eax, 8
adc cl, 0x82
xor cl, 0x8e
dec cl
dec edx
and dl, ah
ror cl, 1
xor cl, 0x8e
inc eax
cbw
xor bl, cl
rol edx, 0xbb

Function at 0x195111d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], 0x24458480
lea esp, [esp + 8]
call fcn.00fd86b2
pop ebx
pop ebp
or al, 0xb5
out dx, al
inc ebx
push ecx
sub edx, dword [ecx]
add dword [ebx - 0x34cd804a], 0xf
xor cl, bl
btc eax, 8
adc cl, 0x82
xor cl, 0x8e
dec cl
dec edx
and dl, ah
ror cl, 1
xor cl, 0x8e
inc eax
cbw
xor bl, cl
rol edx, 0xbb

Function at 0x1953143
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0x14], 0x31e0727
xor edx, 0x2297f31e
dec word [esp + 5]
dec ecx
not dword [esp + 6]
lea esp, [esp + 0x20]
jne 0x191f762
pop edi
push 0x86bdd3b5
mov ecx, 0xb34a99c
xadd dword [esp + ecx - 0xb34a99c], ecx
not edx
mov dword [ebp + 0xc], edx
or word [esp + 2], cx
lea eax, [ecx + ecx*8 - 0x2ae98df4]
inc eax
sbb ebp, 0xfffffff4
call fcn.01006137
xadd ecx, eax
dec edx
btc ax, cx
rol edx, 2
inc cl
sub edx, 0xe2886915
sal cl, cl
ror edx, 3
xor ebx, edx
add edi, edx
dec al
call fcn.00fa9ff8
pop ecx
add ecx, 0xfffe1d66
jmp ecx
mov edi, 0x1e25f8a4
call fcn.0192324a
mov ecx, 0x8222e912
sal cl, 7
lea eax, [ecx - 0x2a4cdf72]
movzx edx, word [esi + eax - 0x57d60990]
xor dx, bx
sub dx, 0xd28d
xor cl, 0x30
div al
dec eax
rol dx, 1
xor cl, 0x3c
call fcn.010209d0
mov edx, 0xcc30d422
movsx eax, dx
movzx eax, byte [esi - 1]
xor al, bl
not al
and dx, dx
btr edx, edx
lea ecx, [edx + 0x7c9106ac]
neg al
ror ecx, 0x87
dec al
or dl, ch
xor al, 0xae
sub al, 0x29
not dx
xor bl, al
add eax, esp
mov cx, word [eax]
xor dl, 7
mov word [ebp - 2], cx
lea eax, [edx + edx*8 + 0x56133db5]
mov ecx, dword [esi - 5]
rol edx, 0x14
and ax, ax
sbb esi, 5
xor ecx, ebx
xadd eax, edx
jbe 0x19083c9
lea edx, [edx + eax*2 + 0x76baf111]
and eax, eax
bswap ecx
rol edx, 1
bswap ecx
jmp 0x18ce75e
inc eax
jmp 0x1047d65

Function at 0x1954f81
Capabilities:
Encode data using base64

Disassembly:
mov ax, word [ebp]
mov ecx, dword [esp]
movsx edx, byte [esp]
mov cx, word [ebp + 2]
and ax, cx
not ax
mov word [ebp + 2], ax
movzx edx, byte [esi - 1]
xor dl, bl
mov ecx, dword [esp]
ror byte [esp + 2], 0x67
adc dl, 0x1e
jmp 0x100ad01
mov dword [esp], 0xf89d609f
jmp 0xfea233
Function at 0x195b123
Capabilities:
Encode data using base64

Disassembly:
rep stosw word es:[edi], ax
mov ecx, dword [ebp + 8]
mov al, 0x2e
lea eax, [ecx - 1]
test di, 0xfe9c
mov dword [ebp - 0x40], eax
test ah, 0xa1
xor esi, esi
clc
or eax, 0xffffffff
sub edi, edi
jmp 0x193e305
adc ecx, ecx
jmp 0xf9e840
xor ebx, eax
add edi, eax
imul ecx, ecx
mov ecx, dword [ebp + ecx - 0x2c0e4629]
mov eax, dword [esp + 4]
adc eax, 0xffff9247
jmp eax
je 0x1959ed0
movzx edx, byte [ecx]
stc
shl esi, 8
inc edi
stc
or esi, edx
jmp 0x1945dff
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], bl
sub esi, edi
jmp 0x106fce0
mov dword [ebp - 0x44], esi
shld si, bx, 0x9f
cmovg esi, edx
mov esi, edi
stc
shl esi, cl
rcl ch, cl
mov ecx, dword [ebp + 0xc]
jmp 0x1063ea2
mov dword [ebp - 0x48], esi
mov esi, dword [eax]
stc
cmp eax, esi
mov dword [ecx], ebx
movzx ecx, bp
mov ecx, dword [ebp + 0x14]
jmp 0x18e39c2
jl 0x193e305
mov dword [ebp - 8], ecx
xchg dx, dx
lea esp, [esp]
shl cx, cl
test dx, 0xc194
btr dx, 0xbe
mov dword [ebp - 0x2c], edi
jmp 0x123421b
mov dword [ebp - 0x24], edi
jmp 0x1211568
je 0xf9e843
mov ecx, eax
test edi, 0xbf17aa84
not eax
cmp sp, 0x8c1f
mov eax, 0x400
dec di
mov edi, edx
rcl dl, cl
rcl edx, 0xb5
movzx edx, ax
mov eax, edx
cmp edi, ebx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
jmp 0xfae73c
mov dword [ecx], ebx
mov ecx, dword [eax + 4]
and eax, edx
sub eax, edi
lea ecx, [ecx + esi]
rcr al, cl
mov eax, 0x300
cmp esi, ecx
shl eax, cl
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
stc
test si, cx
cmc
add eax, 0x736
jmp 0x18fe4c6
mov dword [ebp - 0x28], edi
jmp 0x12290c0
cmp ecx, dword [ebp - 0x40]
jmp 0x1058566
inc ecx
clc
stc
cmp edi, 5
jmp 0x11fec93
xor eax, 0xdb99e60e
dec eax
movzx ecx, dx
xor eax, 0x21bb0c12
push edx
rol byte [esp + ecx*2 - 0xd466], 0xc7
jb 0x1031f70
cmp esp, 0x208a1798
xchg dx, dx
mov edx, dword [eax + 0xc]
clc
push ebx
push esi
btc esi, 0x95
push edi
bsf si, cx
mov edi, 1
add esi, edx
bts si, si
mov esi, edi
test si, si
shl esi, cl
mov ecx, dword [eax + 4]
stc
xor ebx, ebx
cmc
cmp esi, 0x987cd86
mov dword [ebp - 0x20], edx
clc
sub esi, edi
jmp 0x106d317

Function at 0x195ed25
Capabilities:
Encode data using base64

Disassembly:
xchg dword [esp + ecx - 0x26164730], ecx
not al
dec ecx
neg al
not ecx
mov dword [esp + ecx - 0x1910], ecx
dec ecx
not al
xor bl, al
lea eax, [esp + eax + 8]
xor ecx, dword [esp + ecx - 0x190b]
neg cx
shr cx, cl
mov word [eax + ecx - 0x2616050e], dx
movsx eax, cl
lea edx, [ebp + ecx - 0x2616050c]
mov dword [ebp + ecx*2 - 0x4c2c0a1e], edx
shr word [esp + ecx - 0x2616050c], 0x88
lea ebp, [ebp + ecx - 0x26160510]
shr word [esp + ecx*2 - 0x4c2c0a18], 0xe1
not dword [esp + eax*2 - 0x19]
call fcn.01056dca
Function at 0x195ed8b
Capabilities:
Encode data using base64

Disassembly:
sar dx, 0x2b
div eax
mov word [ebp + edx - 0x6bd79b6a], cx
rol byte [esp + eax*2 - 0x7dd29356], 0xa1
movsx ecx, word [esp + edx - 0x6bd79b68]
ror byte [esp + ecx*2 - 0x8003], 0xe4
movzx ecx, byte [esi + edx - 0x6bd79b6f]
jae 0x193904b
lea esi, [esi + eax - 0x3ee949b2]
inc word [esp + eax - 0x3ee949a9]
jne 0x195b0fe
mul dl
xor cl, bl
bt eax, 0x1c
ror cl, 1
not byte [esp + eax - 0x3ee94575]
call fcn.0191129e
push 0xf98e9089
mov eax, 0x2f1a0d99
call fcn.0102c732
add cx, 0xe980
dec edx
dec eax
ror cx, 1
not edx
mov dword [esp + edx - 0x1ede0001], eax
pop eax
sub cx, 0xd3bc
xor bx, cx
jmp 0x1022a7c

Function at 0x19665b9
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
bts ecx, ecx
or ecx, edx
adc eax, 0x3d172533
not eax
shl ecx, 0xb8
imul ecx, ecx
neg eax
not ecx
inc edx
sal ecx, 0x21
sbb eax, ecx
rol ecx, cl
btr edx, edx
xor ebx, eax
add edi, eax
mov ax, word [ebp]
bts ecx, 0xbf
sal cl, 0x83
mov cl, byte [ebp + 2]
neg edx
sal ax, cl
push edx
lea ecx, [edx*2 - 0x4fdaacc]
mov word [edx + ebp - 0x2f4fb86c], ax
and dl, byte [esp + ecx - 0x59a1c60d]
movsx eax, dx
lea eax, [edx*2 + 0x4f314232]
mov ax, word [ebp + edx - 0x2f4fb82c]
cmovb edx, ecx
setl cl
mov word [esp + edx - 0x2f4fb82d], cx
lea ebp, [ebp + edx*2 - 0x5e9f7058]
sets dl
sar byte [esp + edx - 0x2f4fb7fd], 0xe1
setns cl
movzx edx, byte [edx + esi - 0x2f4fb805]
call fcn.0197641f
mov ax, word [ebp + edx*2 - 0x4460e40]
shr ecx, 0x47
lea edx, [ecx + edx*2 - 0x2a7ee0df]
call fcn.01042666
mov ecx, 0xd0b40ca9
imul cx, cx
mov eax, dword [esi - 4]
mov edx, ecx
sub ecx, edx
jns 0x191d4e4

Function at 0x19681b4
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea esi, [esi + ecx - 0x64554741]
idiv ecx
rol al, 0x43
add dword [esp + ecx - 0x6455473f], eax
movzx eax, word [esi + ecx - 0x6455473f]
shl dword [esp + ecx - 0x6455473b], 0xa4
xadd cl, dl
cmovbe edx, ecx
xor ax, bx
pop edx
rol byte [esp + ecx - 0x6455470d], 0x82
neg ax
inc edx
push ecx
shl word [esp + ecx - 0x64554709], 0x4f
sbb ax, 0xa805
xor dword [esp + ecx - 0x6455470a], 0x90290daa
sbb dword [esp + ecx - 0x6455470c], 0xc51deab7
ror ax, 1
and cl, dh
pop ecx
adc ax, 0x918d
push ecx
push ecx
push ecx
neg ax
add ecx, ecx
inc ax
ror dl, 0x81
sbb ecx, dword [esp + 0xa]
xor ax, 0xcebb
xor dx, cx
sbb ax, 0x272c
pop edx
xor bx, ax
dec cl
and cl, 0xbf
or dword [esp + 1], ecx
sbb ebp, 2
neg ecx
xchg word [esp + 8], dx
sub dx, cx
mov word [ebp], ax
adc cx, dx
inc dword [esp + 4]
pop edx
pop edx
pop ecx
jns fcn.019143e0
rol edx, 2
sub ecx, 0xd7174b3f
sbb edx, 0xe2886914
mov dword [esp], eax
dec eax
ror edx, 3
cbw
bt eax, ecx
btr eax, eax
xor ebx, edx
ror ax, cl
add byte [esp + 7], 0xb
bt ecx, ecx
adc edi, edx
movsx edx, cl
neg ecx
jno 0x104bb68

Function at 0x196b2c5
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
je 0x18d7eb5
Function at 0x196b2d4
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sal ecx, 9
not ecx
and dl, al
mov word [ebp + ecx - 0x7dff0ffb], dx
lea ebp, [ebp + ecx - 0x7dff0ffb]
movzx eax, cl
movsx edx, ax
jmp edi
adc edx, 0x1a9ea023
mov eax, ecx
sub cx, 0x1e0f
xor word [esp], ax
not edx
adc ecx, dword [esp]
rol cx, 0x85
inc edx
cwde
pop eax
xchg ecx, eax
xor ebx, edx
shl al, 0x61
add edi, edx
mov eax, dword [ebp + ecx*2 - 0x9f704]
bt cx, 0xb
mov edx, dword [ebp + ecx*2 - 0x9f700]
add eax, edx
mov edx, ecx
lea edx, [ecx - 0x64f8d3dd]
neg edx
mov dword [ebp + ecx - 0x4fb7e], eax
bswap ecx
mov eax, dword [edx + ebp - 0x64f3d857]
shl edx, 4
mov ecx, dword fs:[eax + edx - 0x4f3d85b0]
movsx eax, dl
mov dword [ebp + edx - 0x4f3d85ac], ecx
sar edx, 0xb7
lea ebp, [ebp + edx*2 - 0x138]
jmp edi
neg cx
neg eax
ror eax, 3
imul ecx, ecx
inc eax
ror eax, 2
sal ecx, 0x3e
xor ebx, eax
and edx, 0x953d8c8a
adc edi, eax
lea eax, [ecx*4 + 0x2b9397a6]
cdq
push edx
xor edx, dword [ebp + edx]
sub word [esp + ecx*4 + 2], 0xe030
inc word [esp + eax - 0x2b9397a5]
mov eax, dword [ecx + ebp + 4]
push ecx
shr word [esp + ecx*8 + 1], 0xca
add cl, byte [ebp + ecx + 8]
push 0xa41a2c32
ror dword [esp], 0x42
adc ebp, 5
shl word [esp + 1], 0x2d
push 0xb803a005
jbe 0x10103c1
xchg ecx, edx
xadd dx, cx
not eax
inc dl
ja 0xfeb7a6
ror ax, 0x6c
cdq
mov ecx, dword [esi + eax*4 - 0x40]
push edx
xor ecx, ebx
xor ecx, 0xdba88080
pop eax
add al, dl
sal al, 0x87
lea ecx, [ecx + eax - 0x6a3d6088]
xor ecx, 0xec149c35
push eax
xchg edx, eax
rol ecx, 3
cwde
cdq
xchg dword [esp + eax], edx
lea ecx, [eax + ecx - 0x6bdb221]
jmp 0x123a07e
xor ebx, ecx
inc byte [esp + eax + 1]
add edi, ecx
fild dword [eax + ebp]
call fcn.0102d6a5
not byte [esp + 3]
shr dword [esp], cl
xor edx, ebx
bswap edx
btc ecx, ecx
jae 0xfdfe1c
pop edi
push esp
pop ss
xchg ecx, eax
loop 0x123a126
inc edi
sub eax, 0xbc83a308
or edi, dword [eax - 0x3d33d47]
push 0x8a0fccb8
mov eax, 0xc7fffc29
invalid
inc esp
and al, 4
inc esp
int3
call fcn.00fd86b2
btc cx, cx
not dl
ror cx, 7
sal cx, 0xb
xchg ch, cl
not al
jne section..upx2
dec edx
push esp
add byte [edx + 0x2e447dea], dh
sbb dh, bh
imul esi, dword [edi], 0x70c6aaa7
sbb byte [ebx - 0x66], 0xff
invalid
inc edi
jns 0x123a0ca
pushal
xchg ebx, eax
popal
fidivr word [eax - 0x57]
push 0xffffffffffffffbf
popal
fidivr word [eax - 0x6b]
dec esp
invalid
call fcn.0193e41d
mov ecx, 0xbb01d1b
movzx edx, cx
dec ecx
lea esi, [ecx + esi - 0xbb01d1e]
shr dl, 0xa3
ror edx, cl
push edx
mov eax, dword [ecx + esi - 0xbb01d1a]
xor eax, ebx
sub cx, 0xd7b5
seto dl
not eax
and dword [esp + ecx - 0xbb04565], edx
jo 0x100bbc7
xchg byte [esp + edx*4 - 0x1cffff], cl
ror eax, 3
inc cl
lea eax, [eax + ecx*2 + 0x7543d411]
ror ecx, cl
pop ecx
call fcn.00fb2242