joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa5c89f
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + eax*4 - 0x128], 0xe3beac98
push eax
inc esp
add al, dl
inc esp
mov ebp, dword [esp + eax*8 - 0x24a]
inc bp
mov dword [ecx + eax - 0x4a], eax
xadd word [esp + eax*2 - 0x8a], ax
dec ebp
lea edx, [edx + eax*2 - 0x1c780]
dec eax
cdq
dec esp
lea esp, [eax - 0x16437ff4]
inc cx
inc esp
inc ecx
mov ebp, dword [edx + eax*4 - 0x38ef8]
inc sp
mov dword [esp + eax - 0xe3b2], esp
inc esp
xchg byte [esp + eax - 0xe3b0], ch
xor ebp, ebx
bswap ebp
inc edx
lea ebp, [ebp - 0x60a765a1]
dec eax
mul dword [esp + eax*2 - 0x1c774]
inc sp
xchg dword [esp + edx - 0xe2cf], ebx
neg ebp
not dword [esp + edx*2 - 0x1c5ad]
inc ebp
btr ebx, ebp
dec edi
lea eax, [esp + ebp - 0x554b52c7]
not ebp
inc cx
idiv esp
inc sp
or ebx, edx
call fcn.00a5d2c0

Function at 0xa5c941
Capabilities:
Encode data using base64

Disassembly:
or al, cl
pop ecx
lea ecx, [edx + edx*2 + 0x419da29d]
add cx, dx
not al
mov byte [esp + ecx - 0x44588322], cl
sbb cx, 0x582b
mov word [ecx + esi - 0x44582af8], ax
adc edx, 0xdab0c7a0
movzx eax, cl
mov edx, dword [ecx + esi - 0x44582af8]
shr eax, cl
mov cl, byte [esi + ecx - 0x44582af4]
call fcn.009c4d03

Function at 0xa5cba2
Capabilities:
Encode data using base64

Disassembly:
inc ebx
mov ebp, dword [edx + edi*2 - 9]
inc ebp
and ch, bl
inc ecx
push esp
inc ecx
sar ch, 0xc7
dec edi
lea edx, [edi + edx - 9]
mov eax, 0xd637dbaa
xor ebp, ebx
dec eax
dec esi
lea esi, [ebx*8 - 0x2258ac45]
dec ebx
lea esi, [edi + esi*8 + 0x34170e01]
bswap ebp
rol ebp, 1
dec ecx
bts edi, ecx
not ebp
inc ecx
shr edi, 0x81
neg ebp
ror ebp, 2
xor ebp, 0xaaf518b
neg ebp
not ebp
inc si
xor edi, dword [esp + edi*2 - 0x4000000]
dec edx
mov dword [esp + edi - 0x2000005], ebx
inc ecx
mov ebx, edi
inc edx
xor dword [esp + edi - 0x2000005], ebp
inc dx
sar dword [esp + edi*4 - 0x8000051], 0x28
dec edx
mov ebx, dword [esp + edi - 0x2000005]
inc ecx
not ebx
dec ecx
neg ebx
dec eax
cdq
inc ecx
mov dword [ecx + edx - 4], ebp
inc ecx
not ebx
dec esi
lea ecx, [edx + ecx - 4]
push ecx
inc ecx
pop esp
pop esi
pop ecx
inc ecx
pop edi
jne fcn.00987526
call fcn.0095667f
movzx eax, byte [ebp - 1]
mov ecx, 0xb124f088
xor al, bl
btr ecx, 0x9d
dec ecx
dec al
neg al
neg ecx
bt cx, 0x3a
jb 0xa6d01f
dec al
bswap ecx
not al
xor cx, 0x7a11
movzx edx, cl
lea ecx, [ecx + ecx*8 - 0x57c9e141]
xor bl, al
add eax, esp
call fcn.009e35ab
Function at 0xa5d86c
Capabilities:
Encode data using base64

Disassembly:
sal al, 0xa4
dec al
xor bl, cl
lea ecx, [esp + ecx + 0xc]
neg edx
xadd byte [esp + eax - 0xf6], dh
dec dx
mov dx, word [ecx + eax*2 - 0x1fe]
mov ecx, 0x9f9d150d
xchg ah, cl
lea esi, [esi + eax - 0xe01]
xor cl, cl
mov dword [esp + eax*4 - 0x37fc], ecx
mov word [esi + eax - 0xdff], dx
cdq
imul dword [esp + eax*2 - 0x1bfb]
pop ecx
pop ecx
pop eax
jb fcn.00a106d2
dec esp
jb 0xa5d919
paddusb mm2, qword [edi]
mov byte [0x4d596aeb], al
pop edi
push cs
mov eax, 0xf7e82bf9
invalid
invalid
invalid

Function at 0xa5dbd3
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop ebx
inc ecx
pop esp
pop ebp
pop esi
ja fcn.00987526
mov eax, 0x76895523
mov cx, word [ebp + eax - 0x76895523]
mov ax, word [ebp + eax - 0x76895521]
add cx, ax
mov word [ebp + 2], cx
mov ecx, dword [esi]
mov eax, 0xee25409d
movsx edx, al
xor ecx, ebx
sal edx, 0x6a
ror ecx, 2
neg ecx
xor ecx, 0xe1a134ae
xor ax, 0x6f9a
bswap edx
shr eax, 0x85
lea ecx, [ecx + eax - 0x567c1815]
and dl, 0x2d
cmovne edx, eax
xor ebx, ecx
cdq
shl eax, 0xc1
adc edi, ecx
or edx, dword [esi + eax - 0xee252ec]
imul eax, eax
lea ecx, [eax + eax + 0x689b23a5]
not ecx
lea esi, [esi + ecx*2 - 0x44f34ac]
xor edx, ebx
xor edx, 0x8c094b86
shr ax, 0x85
neg cx
lea edx, [edx + eax - 0x1e846d56]
shr ax, 0xc8
shl eax, cl
call fcn.0093d11a
adc byte [ecx], al
pop eax
call [eax + 0x13ae9cba]
invalid
Function at 0xa6a3fd
Capabilities:
Encode data using base64

Disassembly:
shr eax, cl
mov dword [esp + eax - 0x7fffffff], ecx
rdtsc
add ecx, ecx
sbb esi, 8
mov dword [esp + 8], ecx
not cx
mov dword [esi + 4], eax
mov dword [esi], edx
movsx edx, byte [esp + 8]
inc edx
push ecx
pop eax
pop eax
pop eax
pop edx
jge fcn.00a106d2
dec ebp
mov esi, ecx
inc ecx
mov ebx, 0x55b8cfb7
dec edi
lea ecx, [ecx + ebx - 0x55b8cfbf]
dec edi
mov dword [ecx + ebx - 0x55b8cfb7], esi
dec edi
lea edx, [edx + ebx - 0x55b8cfbb]
inc ecx
movsx ebp, bx
inc edi
mov edi, dword [ebx + edx - 0x55b8cfb7]
inc esp
xor edi, ebx
inc ecx
dec edi
inc ecx
mov ecx, ebx
inc ecx
mov edx, ebx
inc ecx
rol edi, 1
push ebp
rol dx, 0xef
dec edi
lea ebp, [ebx + ebx*4 + 0x2e127cb0]
inc ecx
inc edi
inc esp
and bl, cl
dec eax
lea eax, [edx + 0x793c711]
inc ecx
bswap edi
push ebp
inc ecx
rol edi, 3
inc ecx
inc edi
inc esp
movsx eax, cl
inc ecx
pop ebx
inc esp
sub dword [esp + edx - 0x55b8e7d7], ebp
dec eax
mov dword [esp + ecx - 0x55b8cfb7], ebx
jbe 0xa6d139
mov eax, 0x72b16892
mov ecx, eax
neg al
mov edx, dword [ebp + ecx - 0x72b16896]
setle cl
sbb eax, eax
xor edx, ebx
sar cl, 0x62
rol eax, 0x2f
sar ecx, 0x52
neg edx
add eax, 0x1d091135
xor edx, 0x26a7ed83
rol edx, 1
xadd cx, ax
xor eax, eax
neg edx
and cx, cx
inc al
xor ebx, edx
add edi, edx
ror ax, 0x2b
mov edx, dword [esi + eax*4 - 0x80]
mov al, byte [ebp + eax - 0x25]
xor al, bl
push ecx
add byte [esp + ecx*2 - 0x5bbf], cl
not cl
rol al, 1
xor dword [esp + ecx - 0x2d1f], 0xee340d0d
xadd byte [esp + ecx*2 - 0x5a3b], ch
rol ecx, cl
xor al, 0xb
add al, 0x23
ror al, 1
xchg word [esp], cx
sub cx, word [esp + 2]
neg al
jmp 0xa9573a
shr ecx, 0xce
sbb al, 0xa1
not ecx
ror al, 1
or byte [esp], 0x3c
xor bl, al
or cl, cl
btc ecx, 0x80
lea eax, [esp + eax + 4]
mov dword [eax], edx
push ecx
sub dword [esp + 4], ecx
movzx eax, byte [ebp - 6]
ror word [esp + 1], 0x24
movzx edx, cl
lea ecx, [ecx*2 + 0x50804d36]
lea ebp, [ebp + ecx - 0x507c4d36]
pop ecx
xor al, bl
ror al, 1
sub ecx, edx
mov dword [esp + edx - 0xfd], 0x5e86e3ac
adc al, 0x3b
lea edx, [edx + edx + 0x92ee817]
neg al
ror word [esp + edx*4 - 0x24bba842], 0xcb
shl dword [esp + edx - 0x92eea11], 0xa
ror ecx, 0x66
xor al, 0xa1
xor bl, al
xadd byte [esp + ecx*4 - 0xffffded], cl
not cl
lea eax, [esp + eax + 4]
shl dword [esp + ecx*4 - 0xfffff40], 0xed
call fcn.00a085c0
mov bh, 0x8a
push esp
invalid

Function at 0xa6aa97
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov dword [esp + ecx*2], ebx
inc esi
and byte [esp + edi*2 + 3], ch
dec esi
lea ecx, [ecx + ecx - 4]
dec byte [esp + ecx*2 + 5]
dec ecx
bts ebx, ebp
inc ecx
pop esi
jae fcn.00987526
dec esp
jb 0xa6ab12
pand mm2, qword [0x7160e390]
dec ebp
dec ebx
outsd dx, dword [esi]
inc esp
mov eax, ecx
inc esp
xor dword [esp + edx*2 - 0x75293e16], esi
inc ecx
and bl, 1
inc ebp
mov edi, esp
pop ebx
inc ecx
mov eax, ebx
call fcn.009669f8
Function at 0xa6b646
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
dec ebp
xchg ebp, edi
dec ecx
adc edi, esp
sar esi, 6
sal dl, 0xc4
jne fcn.00987526
inc ecx
mov ebp, dword [edx]
inc ecx
mov esp, 0xdd1a4a35
xor ebp, ebx
dec esi
lea ebx, [0x833cae22]
inc ebp
inc ecx
movzx ecx, ah
rol ebp, 3
xor ebp, 0x46210c2f
inc esp
movzx edi, cx
dec ecx
sal ebx, 0xf7
inc ecx
mov esi, edi
sbb ebp, 0xfd9cb5b9
add ecx, 0x37327324
dec eax
mov dword [esp + ecx*2 - 0x6e64e6b2], ebx
jge 0xe9b448
inc ecx
ror esp, 1
inc edx
sub byte [esp + eax*2 - 0x115], 0xb6
inc ecx
xor esp, 0x73bea80
inc ebp
movzx esi, ax
dec edx
mov dword [esp + ebx*2 - 0x1f78fee4], ebx
inc esi
xor dword [esp + ebx - 0xfbc7f72], esp
inc ecx
mul edi
pop ebx
inc cx
shl ebp, 0x49
movzx esi, al
dec ebp
arpl sp, sp
jp 0x942db5
shl ecx, 0xe5
xor edx, 0xf218c25
call fcn.0094bb1b
push 0x220cd283
mov dx, word [esi]
mov ecx, 0xc93d4c23
mov ax, word [esi + 2]
neg ecx
or ecx, ecx
bswap ecx
not dx
xor word [esp], cx
call fcn.009a2efc
xor dword [esp + ecx - 0x37327359], ebp
inc ebp
movzx eax, bx
movzx ebx, cl
rol cl, 0x63
pop ebx
inc ecx
movsx edx, ah
dec eax
arpl bp, bp
call fcn.009814e0

Function at 0xa6d03d
Capabilities:
Encode data using base64

Disassembly:
bswap edx
pop eax
pop edx
jae fcn.00989a2c

Function at 0xa704d1
Capabilities:
Encode data using base64

Disassembly:
jmp 0xa6ab02
inc ecx
mov edi, 0x211b10b4
dec esi
lea eax, [edi*4 - 0x1bdeaa44]
dec ebp
mov esi, dword [edi + ebp - 0x211b10b4]
inc ecx
movzx eax, al
pop eax
dec edi
mov dword [ecx + edi*2 - 0x42362168], esi
dec esi
lea esp, [eax*8 + 0x56935e8d]
dec esi
lea esp, [0xe4bf2634]
inc ecx
mov eax, esp
dec edi
lea edx, [edx + edi - 0x211b10b8]
inc ebx
mov ecx, dword [edx + edi*2 - 0x42362168]
mov ebp, eax
dec eax
btr ebp, eax
inc ecx
movzx esi, di
xor ecx, ebx
inc ecx
btr esp, esi
dec eax
bswap esi
cbw
xor ecx, 0x3b8650a1
dec esp
and esp, esi
inc ebp
and edi, edi
inc edx
lea ecx, [ecx - 0x6d2188b2]
inc ecx
push eax
rol ecx, 1
dec ebp
add edi, esp
inc eax
dec dh
ja 0xb7f661
mov dword [esp], 0x71ed896
mov esi, dword [esi*4 + 0x97aa94]
not dword [esp]
shr ecx, 8
jmp 0x9ed1ba

Function at 0xa70551
Capabilities:
Encode data using base64

Disassembly:
jmp 0xa6ab02
inc ecx
mov edi, 0x211b10b4
dec esi
lea eax, [edi*4 - 0x1bdeaa44]
dec ebp
mov esi, dword [edi + ebp - 0x211b10b4]
inc ecx
movzx eax, al
pop eax
dec edi
mov dword [ecx + edi*2 - 0x42362168], esi
dec esi
lea esp, [eax*8 + 0x56935e8d]
dec esi
lea esp, [0xe4bf2634]
inc ecx
mov eax, esp
dec edi
lea edx, [edx + edi - 0x211b10b8]
inc ebx
mov ecx, dword [edx + edi*2 - 0x42362168]
mov ebp, eax
dec eax
btr ebp, eax
inc ecx
movzx esi, di
xor ecx, ebx
inc ecx
btr esp, esi
dec eax
bswap esi
cbw
xor ecx, 0x3b8650a1
dec esp
and esp, esi
inc ebp
and edi, edi
inc edx
lea ecx, [ecx - 0x6d2188b2]
inc ecx
push eax
rol ecx, 1
dec ebp
add edi, esp
inc eax
dec dh
ja 0xb7f661
mov dword [esp], 0x71ed896
mov esi, dword [esi*4 + 0x97aa94]
not dword [esp]
shr ecx, 8
jmp 0x9ed1ba
Function at 0xa7141b
Capabilities:
Encode data using base64

Disassembly:
dec esi
lea edi, [esp + edi + 0x10]
dec eax
ror ecx, cl
dec eax
and dword [esp + esi*8 - 0x5fff8], 0x8b3c9434
inc ebp
mov dword [edi + esi*2 - 0x18000], esp
jns 0xa6acb2
jp 0x984b81
jmp 0xea9ef3
neg al
dec ebx
lea ecx, [ecx + esi - 0x5d47f699]
inc ecx
setle al
dec ecx
mov dword [ecx + esi*2 - 0x18004], ecx
call fcn.0095f2b4
inc ecx
push esi
inc ecx
sub bh, 0xb3
add ecx, 0x151e6895
inc ecx
ror bh, 1
dec esp
mov dword [esp + esi - 0xbff8], eax
inc ecx
xor bl, bh
shl byte [esp + esi - 0xbffb], 0xe7
jp 0x9960dd
dec esp
jb 0xa714a0
pop ss
aad 0x16
mov bl, 0xcb
insd dword es:[edi], dx
popal
dec ebx
dec edx
or al, byte [ebx + esi*8 - 0xb0dc2a5]
xor eax, 0x9aac0e8e
mov edx, 0x603660ab
and ecx, ecx
bswap eax
xor eax, 0xdf37fb95
and edx, ecx
btr dx, dx
inc edx
bswap eax
jge 0xa85257
inc cx
btc esi, eax
jmp edi
enter 0x660f, 0xffffffffffffffc1
lodsb al, byte [esi]
dec esp
and al, 0xf5
invalid
xor eax, 0xf72603a8
add edx, ecx
xor ecx, edx
lea eax, [eax + ecx*2 - 0x2e36a034]
xor ebx, eax
btc ecx, ecx
add dx, dx
adc edi, eax
dec dl
mov bp, word [ebp + ecx*2 - 6]
jne fcn.00989a2c
mov edx, 0x84180ea4
movzx eax, dl
dec edx
mov edx, dword [ebp + eax*4 - 0x290]
mov eax, dword [ebp + eax*2 - 0x144]
mov ecx, 0x690d7d10
lea ebp, [ecx + ebp - 0x690d7d0c]
add ecx, ecx
not edx
not eax
and edx, eax
movsx eax, cx
dec cx
neg al
mov dword [ebp], edx
mov ecx, dword [esi]
setl al
dec ax
adc esi, 3
cwde
lea edx, [eax + eax*8 + 0x7a00da2a]
xor ecx, ebx
rol ecx, 1
bts ax, dx
inc ecx
shl dx, 0x46
shr edx, 0x9f
not ecx
adc eax, 0x88bb0d8f
jae 0x9d9ed9
or edx, 0x599bfbb7
neg ecx
bts dx, dx
xor ebx, ecx
add edi, ecx
bt dx, 0x1c
jmp edi
mov edx, 0x39277809
mov eax, dword [edx + ebp - 0x3927780d]
bswap edx
mov ecx, edx
lea ebp, [ebp + edx*4 - 0x25e09ce8]
jmp 0x9d811f
Function at 0xa7482e
Capabilities:
Encode data using base64

Disassembly:
inc ebp
sub ebp, edi
inc ecx
ror ebp, 1
inc edi
lea ebp, [ebp + eax*2 + 0x6dd9d352]
movzx edx, cl
inc esp
movzx esi, dl
push edx
inc ecx
xor ebp, 0xb812f10f
inc dx
or dword [esp + eax - 0x131672ac], edx
inc esp
movsx ebx, word [esp + ecx - 0x8cb3069]
dec eax
mov dword [esp + ecx - 0x8cb3069], ebx
inc ecx
not bl
inc ecx
sbb bl, 0x99
inc esi
xor dword [esp + eax - 0x131672ad], ebp
pop ebx
dec ebx
lea ebp, [eax + eax*8 - 0x6e7b3c44]
add bp, 0x959e
dec ebp
arpl bp, bp
inc ebp
movzx esp, bl
sal bp, cl
dec ecx
adc edi, ebp
inc ecx
xchg eax, ebp
xor ecx, 0x32cb2a
inc di
mov esi, dword [ecx + eax*2 - 0x7a9dbc00]
inc bx
mov edx, dword [ecx + eax*2 - 0x7a9dbbfe]
inc ecx
movsx eax, al
inc ebx
mov cl, byte [eax + ecx - 0x3d4eddfc]
inc ecx
bts ebx, ebp
dec ecx
neg edi
dec edi
lea edi, [edi + ebx*2 - 0x314ef0ec]
dec edi
lea ecx, [ecx + eax*2 - 0x7a9dbbfc]
setbe al
ja 0xb6dd6a
dec eax
cwde
inc cx
shrd esi, edx, cl
inc sp
btc eax, eax
shr eax, 0x71
jbe 0x9fe2ef
xor ebx, eax
shl word [esp + ecx*4 - 0x78199037], cl
shl cl, 0x65
add edi, eax
mov cx, word [esi + ecx*2 - 0x3c0cc980]
mov ax, word [esi + 2]
xchg word [esp], dx
sub dword [esp], 0xee019c8a
adc esi, 1
or cx, ax
mov eax, dword [esp]
pop edx
not cx
xor dl, 0xbb
mov word [esi], cx
mov ecx, 0xce216092
or edx, ecx
dec eax
jmp edi
dec ecx
and eax, 0xa5297933
dec eax
or eax, edi
jmp eax
inc di
mov dword [ecx + ebx*2 - 0xd3fa], esi
inc ecx
movzx esi, di
jae 0x9cfb3a
dec eax
ror eax, 1
inc ecx
lea eax, [eax + ecx*2 + 0x6c7a0920]
rol ecx, 0x71
mov dword [esp + edx - 0x1e06640e], edx
ror eax, 3
xor edx, ecx
pop ecx
inc eax
inc dl
push edx
jg 0x990bd9
inc ecx
mov eax, 0x131672ad
jmp 0xea1402
inc ebp
movsx edi, al
dec edi
lea edx, [edx + eax*2 - 0x262ce55e]
inc edi
mov ebp, dword [edx + eax*2 - 0x262ce55a]
dec edx
lea ecx, [eax*8 + 0x5e813a2e]
not ecx
inc esp
xor ebp, ebx
inc ecx
sar edi, 0x4e
jb 0x956f0f
Function at 0xa8056c
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp + eax*2 - 0xbde], dx
mov dword [esp + eax - 0x5f0], eax
push eax
mov cx, word [ebp + eax*2 - 0xbde]
dec al
mov dx, word [eax + ebp - 0x5eb]
sbb dword [esp + eax*8 - 0x2f74], eax
and cx, dx
sar dword [esp + eax*4 - 0x17b9], 0xfe
call fcn.00a6f9b8
inc ebp
mov ebx, dword [ecx]
mov ecx, 0x809e72a7
inc esp
mov esp, ecx
inc ecx
mov ebp, dword [ecx + 4]
inc esp
movsx eax, cx
dec esp
lea edi, [ecx*8 + 0x49a38719]
inc ecx
sub cl, al
inc ecx
not ebx
jne 0x9c275d
inc ecx
ror edi, 0xba
not ebp
inc bp
bts edi, edi
jb 0x9d1ef6
sbb byte [ecx], bl
cmc
inc dword [ebx - 0x23]
inc esp
and ebx, ebp
inc ebp
mov esi, esp
dec ebp
lea ebp, [esp + 0xa713a0]
dec ecx
shl esi, 0x1c
inc ebp
mov esp, ebx
inc ebp
movsx ebx, dh
inc ebx
mov esi, dword [eax + ecx - 0x729f]
inc ecx
movsx edx, di
inc esp
and esp, esi
inc ecx
mov esi, eax
inc ecx
not esp
dec eax
not esi
inc ecx
btc ebp, edx
inc edi
mov dword [ecx + eax*4 - 0x1ca94], esp
inc ecx
setae bh
rol ecx, 0xad
inc ecx
mov esp, 0xbd0a060d
inc edi
mov eax, dword [edx + eax*2 - 0xe552]
dec eax
lea eax, [edx + esi + 0xbaada7]
call fcn.009356de
xchg edi, eax
push ds
xor dl, dl
sub byte [eax - 0x55], al
jl 0xa805da
mov edx, 0x50df4760
mov al, byte [0x334760ba]
and eax, 0x4760bac0
ja 0xa806cb
cmp byte [edx - 0x64a8b8a0], 0x3c
sahf
fld xword [0x5a9e4625]
xor eax, 0x74b41a7f
fsub qword [esi - 0x2b316556]
fld dword [edi + 0x7b]
adc byte [ebx], bl
cmpsb byte [esi], byte es:[edi]
and edi, dword [ecx + 0x46]
test eax, 0x95f3d9f4
jb 0xa80629
hlt
fxch st(7)
dec ebp
inc esi
test eax, 0x573d9f4
sbb ch, byte [ecx + 0x1eafd9f4]
inc ebx
adc byte [edi], al
cmp eax, 0x754359c4
retf 0x2f10
Function at 0xa83b34
Capabilities:
Encode data using base64

Disassembly:
sbb byte [esp + ecx - 0x58201cb0], 0x20
xor edx, ebx
not edx
bswap edx
inc eax
neg edx
push ecx
inc edx
btc eax, eax
neg edx
dec cx
xor ebx, edx
add edi, edx
call fcn.00938878
dec eax
rol ebp, 0x1a
dec edx
mov ebx, dword [esp + ebp - 0x43c72b53]
mov eax, 0x723b6bb9
sbb ax, word [esp + eax - 0x723b6bb5]
inc ecx
setle al
dec ebp
arpl sp, sp
ror al, 0xe7
dec ecx
adc edi, esp
inc esp
sub ebp, dword [esp + eax - 0x723b6b62]
jne 0x9e1169
dec edi
mov ecx, dword [ecx + ebp*2 - 0x770e4fe2]
inc ecx
pop ebx
inc ecx
pop edi
jne fcn.00987526
inc ecx
bswap esp
dec eax
mov dword [esp], ecx
mov esi, ebp
inc ecx
rol esp, 3
inc ebp
mov ebp, eax
dec ecx
bt ebp, ecx
rol ecx, cl
inc ecx
sbb esp, 0xc2051819
not bp
inc eax
not ch
dec eax
xchg esi, ebp
inc ecx
ror esp, 2
inc ecx
neg esp
dec edx
mov dword [esp + ebp - 0x43c72b53], ebx
inc esi
xor dword [esp + ebp - 0x43c72b53], esp
sar si, 0xa7
jns 0x9ada8d
mov dword [esi], eax
mov eax, 0xdc0aa304
and eax, 0x5fb8a800
xor eax, eax
mov dword [esi + eax - 4], ebx
mov dword [esi + eax - 8], ecx
bts ax, 0x35
mov dword [esi + eax*8 - 0x10c], edx
jae 0xb68a45
pop ebx
bswap eax
lea ecx, [eax*4 + 0x6eb3f107]
lea edx, [ecx*2 - 0x1dd24a43]
mov ecx, dword [esi + eax*2 - 0x4000000c]
lea edx, [edx + eax*2 + 0x2b8be22a]
imul ax, ax
add eax, edx
lea esi, [esi + eax - 0x4b2179fd]
push eax
lea edx, [esp + eax - 0x4b2179e1]
mov dword [edx + eax - 0x4b2179f5], ecx
movsx edx, byte [esp + eax - 0x4b2179f5]
mov edx, dword [ebp + eax - 0x4b2179fa]
lea ebp, [ebp + eax - 0x4b2179fa]
inc byte [esp + eax - 0x4b2179f3]
movsx ecx, al
xor edx, ebx
sar cl, 0x43
ror word [esp + eax - 0x4b2179f3], 0xe
cwde
neg edx
btc eax, 0x9a
ror byte [esp + eax*2 - 0x800f3e8], 0x83
jae 0xa41bfb
mov dl, byte [esi]
mov eax, 0x592c8f87
mov ecx, 0xe58a6080
add cx, cx
movzx ax, byte [esi + eax - 0x592c8f85]
setp cl
shl cl, 0x64
shr cl, 5
adc esi, 1
ror ecx, 0x53
imul dl
movsx edx, cx
push edx
mov word [edx + esi - 0x1cb1], ax
lea ebp, [ebp + ecx - 0x58201cb5]
mov eax, ecx
div cl
shr eax, 0x8c
mov edx, dword [ebp + ecx - 0x58201cb1]
ror byte [esp + eax - 0x58203], 0x22
jp 0x93aac3
Function at 0xa8b867
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
dec edx
lea ebp, [edi + ecx - 0x258]
inc ecx
inc ebp
inc eax
and ch, 0xf0
movzx ecx, bl
jmp 0xea5581
dec esp
mov dword [esp], esi
inc eax
seta dh
dec eax
inc esi
inc eax
movsx eax, dh
push ebx
inc ecx
push ebp
movzx edi, si
inc esp
mov ebp, edi
push edx
jb 0xa91e7a
dec eax
or edi, edi
dec eax
btr eax, esi
inc ecx
push esp
inc ecx
push ecx
inc sp
btc eax, ebp
imul si, di
dec esp
lea ecx, [esp + eax - 0x23]
shr ax, 0x6f
dec eax
bts esi, 0x8b
dec eax
cdq
push ebp
sbb esi, edx
inc ecx
push edi
inc esp
movsx esi, dx
js 0xb6c2ae
dec esp
jb 0xa91f0a
paddusw mm0, qword [esi]
lodsb al, byte [esi]
leave
popal
pushal
dec esp
dec eax
outsd dx, dword [esi]
sal ax, 0xa4
dec ecx
sbb ecx, 4
cwde
movsx ecx, al
movzx edx, ax
inc edx
mov dword [ecx + ecx - 0x10], esi
inc esp
movzx eax, al
dec edi
lea esp, [esp + edi*2 + 0x38ab9c05]
inc ecx
movzx ebp, ah
dec ebp
lea edx, [edx + ecx - 0x14]
add cl, dh
imul dl
inc esp
mov esi, edx
inc ebp
mov ebx, dword [edx + ecx - 0xab]
inc ecx
shr esi, 0xd3
push edx
inc esp
xor ebx, ebx
inc ecx
ror ebx, 2
ror dl, 0xc3
inc ecx
sbb ebx, 0x9a07883d
inc ecx
xor ebx, 0xd6070faf
lcall 0x70f, 0xaff38141
salc
inc ebp
lea ebx, [ebx + ecx*4 - 0x219b9f53]
inc esp
mov ebp, edx
dec ecx
shr ebp, 0x68
dec eax
mov dword [esp + ecx*2 - 0x156], ebx
dec eax
dec ecx
inc esp
xor dword [esp + ecx*2 - 0x154], ebx
pop ebx
cwde
inc ecx
btc esi, 0xb9
inc cx
btc eax, 0x8a
dec ebp
arpl bx, bx
dec ecx
adc edi, ebx
inc ebp
movsx ebx, bh
jmp 0xa0d431
sbb edi, edi
inc ecx
push ebx
inc ecx
push edx
inc ebp
mov edx, ebp
inc ecx
mul edx
btc di, 0x87
inc esp
mov edx, dword [esp + eax + 0x80]
movzx ebp, ax
inc ecx
bswap edx
inc ecx
rol edx, 2
inc ecx
sub eax, ebp
inc ebp
lea edx, [edx + eax - 0x43c7fc61]
inc ecx
neg edx
dec eax
lea ebx, [edx*2 + 0x59aeef1c]
inc sp
xor ebp, eax
inc al
inc ebp
lea edx, [edx + eax - 0x16dec461]
dec ebp
adc edx, edi
dec esp
mov dword [esp + edi - 8], eax
inc ebp
mov eax, ebp
dec eax
mov dword [esp + edi*2 - 0x80], ecx
jmp 0xa49337
dec eax
dec eax
dec eax
mov esp, ebp
Function at 0xa938aa
Capabilities:
Encode data using base64
Execute syscall

Disassembly:
sub dx, 0x1b96
bswap ecx
cdq
bt eax, edx
bts dx, 0x11
xor ebx, ecx
and edx, dword [esp + edx]
xor byte [esp + edx*4 + 5], 0x21
mov dword [edx + ebp - 2], ecx
ror byte [esp + edx*8 + 3], 0xa6
lea ebp, [edx + ebp - 2]
jne 0xa63b3c
sysenter
push edx
mov dword [esp], 0xfe8baf19
call fcn.00b6bc0f
inc byte [esp + edx + 2]
add word [esp + edx + 5], ax
mov eax, dword [esi + edx*2 + 6]
setbe dl
lea ecx, [edx + edx + 0x2cb5f283]
neg ecx
lea esi, [esi + edx*4 + 0xa]
dec dx
ror word [esp + edx*8 - 0x7fff6], 0x6e
xor eax, ebx
sub dl, cl
cmovo ecx, dword [esp + edx*2 - 0x1ff00]
ror eax, 2
dec dl
shr cx, 0xa9
call fcn.00941458
rol ax, 1
dec cl
xor bx, ax
mov word [ebp + 2], ax
mov eax, edx
shr byte [esp + 5], 0xe6
mov ecx, dword [esi + 2]
setb dl
xor ecx, ebx
dec dword [esp + 4]
ror ecx, 1
not dx
xor ecx, 0x19f6f9c
xadd eax, edx
pop edx
sbb eax, dword [esp]
neg ecx
push eax
jmp 0x9a7c6e
mov dword [esp], 0xd8aa1f35
xchg ch, cl
not eax
dec cl
mov edx, dword [esp]
btr cx, 0x25
mov dword [ebp + 4], eax
lea eax, [ecx + edx + 0x4bf82ac]
cwde
and dword [esp + eax*2 - 0x4dd6], 0x9aaf9aa2
mov ax, word [esi + eax*8 - 0x13758]
or ecx, 0x9d3a99af
add dl, dh
xor ax, bx
ror ax, 1
sub ax, 0x5523
push edx
bts ecx, ecx
rol ax, 1
or edx, 0x8005143c
not ax
js 0xa8f24f
mov edx, 0xf14268e
lea eax, [edx + edx*2 + 0x7aad6833]
mov eax, dword [esi + edx*4 - 0x3c509a38]
mov ecx, 0xd19b101d
xor eax, ebx
ror eax, 3
btc cx, cx
jae 0xa3f3b5

Function at 0xa9768f
Capabilities:
Encode data using base64

Disassembly:
pop eax
lea ecx, [ecx*2 + 0x398c391a]
lea edx, [esp + edx + 8]
sal cl, 0x61
and dword [esp + 2], ecx
mov ax, word [edx]
mov edx, ecx
mov dx, word [esi + 2]
not ax
sar ecx, cl
jb 0x9b7c90
mov ecx, 0xbdaa9c8d
rol ecx, cl
sbb ecx, ecx
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov ecx, 0x3e9d4609
mov edx, 0xe9a37928
mov dword [ecx + ebp - 0x3e9d4609], eax
mov edx, dword [esi + ecx*2 - 0x7d3a8c12]
movzx eax, cl
lea esi, [esi + eax - 5]
xor eax, ecx
bts eax, ecx
xor edx, ebx
neg edx
cbw
and al, al
bt cx, ax
inc edx
ror edx, 2
ror ax, 0xe9
inc edx
bswap ecx
bts cx, 0x34
xor ebx, edx
dec ecx
sub cl, 0x1a
call fcn.00ab1788
stc
test bl, 1

Function at 0xa9bef5
Capabilities:
Encode data using base64

Disassembly:
inc ecx
rol bh, 1
inc ecx
xchg ah, ch
inc eax
movsx eax, ch
dec edx
mov dword [esp + ebx*4 - 0xe8], 0xb9a8111b
inc ecx
add bh, 0x31
call fcn.00e99066
mov eax, dword [ebp]
mov ecx, 0x308dd83e
movsx edx, cx
sar cx, 0x21
mov ecx, dword [ecx + ebp - 0x308dec1b]
bts dx, dx
shr dl, 0xe1
xchg dh, dl
adc ebp, 8
call fcn.00a71b0f