joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9d20d7
Capabilities:
Encode data using xor

Disassembly:
call fcn.00d58c7c
das
or dword [ebp - 0x60e8e0bb], eax
mov byte [ebp - 0x5d], 0x56
or eax, 0x5f4bef16
mov eax, dword [0x9165bd1d]
xchg byte [edx - 0x51], cl
sub eax, 0xd36a98b6
test ah, ch
mov eax, dword [0x2c7847e9]
outsb dx, byte [esi]
add byte [ebp + 0x21], ah
jge 0x9d216a
or eax, 0x19273210
lcall 0x2dd6, 0x498f1402
dec esp
cli
mov bl, 0xa5
adc byte [ebx - 0x2a], bl
xlatb
or eax, 0x92f08268
andnps xmm3, xmmword [0x43154ff]
or bh, ch
or dword [edi], edx
mov ds, word [esi + 0x6f]
aas
push ebx
inc edi
test byte [edx], 3
push edx
in eax, dx
push ecx
push 0x4e
adc dword [ecx + 0x5d320700], ebp
xor byte [ebx + ebx*2], ah
popal
push 0xf2498ce7
xchg edx, eax
sub dword [ebx + ebx*8], edi
fcom qword [esi - 0x40]
cmp al, 0xf4
popfd
sti
invalid
xor al, 0x2b
mov ah, 0xd2
add al, 2
or ecx, eax
leave
push ds
and al, al
mov eax, 0xff754db6
stosd dword es:[edi], eax
call edi
add dl, byte [esi]
out dx, eax
cwde
inc esi
add ah, byte [ebp - 0x58]
salc
iretd

Function at 0x9e032c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], esi
mov dword [esp], 0x1c98e90b
pop edi
call fcn.0099f65b

Function at 0x9e7e07
Capabilities:
Execute syscall

Disassembly:
mov eax, dword [esi + edx*8]
btc edx, edx
xor eax, ebx
lea eax, [edx + eax + 0x329e8fb2]
xchg word [esp + edx*4 + 1], dx
xor edx, ecx
bts ecx, edx
neg eax
and cl, 0x99
inc eax
xor cl, 0xae
bswap eax
dec ecx
dec eax
jmp 0xd7dfb7
neg cl
shr dx, 0x2a
not cl
mov dword [esp + edx - 0x78380001], edx
sal byte [esp + edx - 0x7837fffa], 0x65
adc dx, dx
dec cl
xor cl, 0x99
sal edx, 0xb7
inc edx
xor bl, cl
sub edx, edx
lea ecx, [esp + ecx + 8]
mov byte [ecx + edx*4], al
movsx eax, dl
xor dword [esp + edx], 0x2a2b6a05
btc ax, 0x3e
lea esi, [esi + edx - 4]
mov ecx, 0xd417f226
jae 0x89e05c
xor ecx, ebx
call fcn.0086110e
mov ecx, 0x7439c9b0
call fcn.0092a8af
sysenter
pushfd
mov dword [esp], 0xe5c3ff0
call fcn.00cfa122
add word [esp + 6], dx
sub byte [esp + 5], cl
bswap eax
xor ebx, eax
call fcn.009a595b
mov eax, dword [esi]
mov ecx, 0xc89c603d
mov edx, 0x59b0252a
push ecx
lea esi, [edx + esi - 0x59b02526]
rol cl, 6
xor eax, ebx
bts ecx, 0x35
sbb eax, 0xd129203d
pop edx
not eax
or dl, ch
sar cx, cl
rol eax, 1
btr edx, 0x18
push ecx
shr ecx, 0x54
not eax
rol edx, 0xd6
shl dx, cl
rol eax, 3
not edx
xor ebx, eax
add edi, eax
movsx eax, byte [esp + ecx*2 - 0x1916]
ror byte [esp + ecx - 0xc89], 0x66
mov edx, dword [ebp + ecx*2 - 0x1916]
mov ecx, dword [ebp + ecx*4 - 0x3228]
lea eax, [eax + eax*8 - 0x61c2e4ef]
call fcn.00760c5e
mov edx, ecx
mov edx, dword [esi + eax - 0x300f2d01]
and al, byte [esp + eax - 0x300f2cfa]
xor edx, ebx
jmp 0xdb77f7

Function at 0x9e9827
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x862d189a
sub esi, 4
Function at 0x9f54bc
Capabilities:
Encode data using base64

Disassembly:
inc ecx
not edx
inc ecx
dec edx
movzx edx, cl
inc ecx
not edx
inc ecx
ror edx, 2
inc esp
mov esp, ebp
dec eax
mov dword [esp + ebp - 0x3d09ff3e], 0xf817a8b1
inc ecx
and ebx, 0x942047aa
dec esp
mov dword [esp + ebp - 0x3d09ff3e], esi
inc esp
xor dword [esp + ebp - 0x3d09ff3e], edx
inc ecx
pop esi
movsx ebx, cl
inc cx
bt ebx, ecx
jb 0xd471b8
call fcn.007d3cac
dec ebp
arpl dx, dx
inc ecx
shr ebx, cl
inc esp
or ebp, ebx
dec eax
bswap ebp
dec ebp
adc edi, edx
inc ecx
jmp edi

Function at 0x9fb3af
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
xor dword [esp + eax - 0x703412fc], eax
adc word [esp + eax - 0x703412fc], 0xd797
ror ecx, 1
not ecx
push eax
ror edx, 0xf5
and edx, dword [esp + eax - 0x703412f8]
lea ecx, [ecx + eax - 0x6c8efd5c]
shr edx, 0xb7
setne al
bswap ecx
shl edx, 0x61
push edx
xor ebx, ecx
add ax, 0x299a
btr dx, ax
btr edx, edx
adc ebp, ecx
cwde
add dword [esp + eax - 0x3c8e], eax
mov eax, dword [eax + edi - 0x3c9a]
call fcn.00780865

Function at 0xa013ae
Capabilities:
Encode data using base64

Disassembly:
xor edx, dword [esp + edx - 0xae6f]
lea ebp, [ebp + edx*4 - 4]
add dl, 0xbd
neg dx
neg edx
mov edx, dword [ebp]
not eax
xor edx, ebx
movzx ecx, word [esp + eax - 0x57f65190]
sal cx, cl
xadd cx, ax
xor edx, 0x2f23d833
bswap edx
rol edx, 1
xadd eax, ecx
call fcn.0075d82c
dec eax
mov dword [esp], 0x2bbe72c3
call fcn.00d3443d
ror edx, cl
neg eax
add dx, dx
dec eax
xor dl, 0xba
xor edx, edx
rol eax, 1
ror ecx, cl
sar ecx, cl
dec ecx
xor ebx, eax
dec cl
add ebp, eax
add cl, 0x14
push ecx
mov eax, dword [edi + edx*4]
sbb edx, edx
xadd dword [esp + edx], edx
push ecx
mov ecx, dword [edi + 4]
call fcn.0093f4cd
mov eax, 0x56893217
bt eax, eax
sub ax, 0x3305
movzx cx, byte [eax + esi - 0x5689ff12]
bt eax, eax
mov dl, byte [esi + eax - 0x5689ff10]
setb al
neg eax
bswap eax
lea esi, [esi + eax*2 - 0x2ed50]
not cl
sar eax, 0x38
not dl
xor eax, 0xa809c1ae
push eax
and byte [esp + 2], 0x8a
or cl, dl
xadd al, ah
movzx edx, ax
mov dword [esp + edx*2 - 0x15cde], edx
mov word [edx + esi - 0xae6f], cx
jne 0x98f08e

Function at 0xcf324f
Capabilities:
Encode data using base64

Disassembly:
call fcn.0081eb53
mov dword [esp + eax - 0x6738000d], edx
xor ecx, 0xd8256a28
rol ecx, 1
rol dword [esp + edx], 0xfc
xor ebx, ecx
bswap edx
and eax, 0xf79066b8
adc ebp, ecx
cwde
mov si, word [eax + esi - 8]
lea eax, [edx*2 + 0x2a2e9e32]
shr dword [esp + edx*8], 0xbc
pop edx
jp fcn.009f2e39

Function at 0xcf328a
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x18]
jne 0x9c55a2
mov eax, 0x7e2161b4
lea edx, [eax + eax*8 - 0x42476dfa]
pop esi
Function at 0xcf772a
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0xff8b430d
mov dword [esp + 4], 0x95342ff5
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00cfa122
dec ebp
fdiv dword [esi - 0x3b1b775b]
sbb eax, 0xa9037a78
outsd dx, dword [esi]
lcall 0x659f, 0xaacfda2a
pushal
test al, 0xaf
add byte [ebp - 0x2c], 0x3e
mov dword [ecx + 0x3a], edi
cmpsd dword [esi], dword es:[edi]
or edx, dword [eax + 0x6ddef7a5]
xchg edi, eax
or al, 0xfc
stc
adc byte [esi - 0x46], ah
and al, 0x4c
insb byte es:[edi], dx
ficom dword [edx]
push esp
scasd eax, dword es:[edi]
cwde
sar byte [edx], 0x2b
xor al, 0x45
sbb al, 0x9a
movsd dword es:[edi], dword [esi]
inc edi
or dword [ecx + 0x6804aca5], ecx
pop ebp
inc edi
jp 0xcf7740
jmp 0xbf6a11e6

Function at 0xcfa1f0
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
dec ebp
arpl ax, ax
inc dx
sub dword [esp - 0x35b2], ecx
shr cl, cl
dec ebp
adc edi, eax
dec edx
lea esi, [esi - 0x35be]
inc esi
movzx ebp, byte [esi - 0x1ade8]
inc edx
inc byte [esp - 0x6b74]
inc ebp
xor ch, dh
inc ecx
rol ch, 1
dec ecx
btr esp, ecx
inc ecx
dec ch
inc ecx
rol ch, 1
dec edx
rol dword [esp - 0x6b67], cl
dec edx
mov dword [esp - 0x35a5], ebx
inc ecx
dec ch
push ebp
inc edx
movzx eax, byte [esp - 0x35a5]
cdq
inc ebp
xor dh, ch
dec eax
lea edi, [edi + ecx*4 - 0x3fc10]
inc esp
sub esp, ebx
dec dword [esp + ecx - 0xfee9]
inc esp
mov dword [ecx + edi - 0xff03], ebp
inc esp
movsx ebx, byte [esp + ecx*2 - 0x1fdfe]
inc ecx
pop ebp
pop ebx
inc ecx
pop ebx
pop ebx
jge fcn.00d15188
dec eax
mov dword [esp], 0xaa8abc22
sar byte [esp + 5], 0x22
inc esp
mov eax, dword [esi]
dec eax
and dword [esp], 0x631cdf1a
inc ebp
xor eax, esi
push 0xab231426
push 0xc68ae1b9
inc ecx
not eax
inc ecx
xor eax, 0xfe3fa4ab
not byte [esp + 0x12]
dec eax
sal dword [esp + 0x10], 0x6f
inc ecx
not eax
inc ecx
ror eax, 1
mov ebp, 0xe99735bd
inc esp
movsx esp, bp
inc esi
add dword [esp - 0x35ab], esp
dec esi
mov dword [esp - 0x35ad], esi
inc edx
rol dword [esp - 0x35b3], 0xf1
inc esi
xor dword [esp - 0x35ad], eax
inc edx
movzx ecx, word [esp - 0x35ba]
dec esi
mov esi, dword [esp - 0x35ad]
dec eax
lea ebx, [ebp*4 - 0x49c5d252]
ror bl, 0xa3
jae 0x87f1c1
Function at 0xcfff16
Capabilities:
Execute syscall

Disassembly:
cdq
jmp [esi + ebp*4 + 0x450cbc89]
jne 0x9e4518
mov eax, dword [0x4147d9b2]
inc edx
xchg ecx, eax
mov ebp, 0x329e3509
sub al, 0x8b
jno 0x8d6b88
xor dword [esi - 0x40], esp
ror dword [ebx + 0x23], 1
mov cl, 2
fucomp st(1)
scasd eax, dword es:[edi]
or dword [edi + 3], 0xfffffff2
int3
adc edi, 6
push 0x87bf421a
neg dword [esp]
shld eax, edx, cl
mov ecx, dword [esp]
push ecx
mov dword [edi + ecx - 0x7840bde6], eax
movzx edx, cx
lea eax, [edx + ecx*4 + 0x5c150da5]
shr edx, 0x67
mov dword [esp + edx*8 - 0xbd8], esi
ret 4
pop ecx
not eax
inc eax
mov ecx, edx
sub dl, dh
xor ebx, eax
add esi, eax
mov eax, edx
xor ecx, eax
mov eax, dword [edi + ecx*2 - 0x86]
xchg ch, dl
ja 0xd26a1f
sysenter
call fcn.0097a06f
adc dl, ah
xor ecx, 0x7eb13e0c
cwde
neg ecx
not eax
add eax, edx
dec ecx
push eax
cdq
neg dl
not ecx
rol dx, 0xcc
xor ecx, 0x6730d3ac
rol dword [esp + eax - 0x39b], 0x1d
not ecx
ror dx, 0xcf
dec dword [esp + eax*4 - 0xe6c]
sub dword [esp + eax - 0x39b], eax
xor ebx, ecx
add edi, ecx
push eax
or dx, 0xb03d
add ax, word [esp + eax - 0x396]
mov eax, dword [esi + eax - 0x397]
pop ecx
xor ecx, 0x8d8b9184
neg ecx
mov ecx, dword [esi + edx*4 - 0x2c0f0]
inc edx
lea esi, [esi + edx*2 - 0x16078]
not eax
push edx
not ecx
and eax, ecx
mov dword [esi + edx*4 - 0x2c0f8], eax
movzx ecx, byte [esp + edx - 0xb03c]
sub word [esp + edx - 0xb038], cx
mov dword [esp + edx - 0xb03e], edi
ret 4
mov edx, dword [ecx + edi - 0x2a3f]
mov cl, byte [ecx + edi - 0x2a3b]
jae 0x8d6bee

Function at 0xd002c5
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp + 8], ecx
call fcn.0078abac

Function at 0xd00746
Capabilities:
Encode data using base64

Disassembly:
bswap edx
dec word [esp + ecx*2 - 0x2065]
cmovns ax, word [esp + ecx - 0x1031]
jl 0x8dfe1b
inc ecx
mov ebp, 0xf82d06b2
dec edi
lea edx, [ebp + ebp*8 + 0x7ca0ad24]
dec esp
mov eax, edi
mov ebx, 0x1b332631
dec ecx
neg edx
dec eax
lea edi, [ebx + edi - 0x1b332639]
inc ecx
mov esp, 0x96b9348c
inc ecx
mov ebx, 0x17a57b12
dec ebx
lea ecx, [ebx + 0xa8d68b8]
dec esp
mov dword [ebx + edi - 0x1b332631], eax
call fcn.009e527f
mov dword [esp], 0xe7b78532
add edx, 0x938ccb2
sub cl, 0x31
dec ecx
and eax, dword [esp]
not edx
btr ecx, ecx
xchg dword [esp], eax
sbb edx, 0x511bf099
not ecx
jmp 0x896a2e

Function at 0xd07a62
Capabilities:
Encode data using xor

Disassembly:
push 0x8e075027
lea esp, [esp + 0x18]

Function at 0xd0c6d2
Capabilities:
Execute syscall

Disassembly:
mov ebx, 0x1f907816
movzx ebx, byte [ebx + edx - 0x1f907816]
xor ebx, ecx
push 0x19a3e9ab
and ebx, 0xff
call fcn.0084ddf6
lea esp, [esp + 0x18]
jne 0x7b7356
mov ebx, 0x522d35a1
inc ebx
pop ebx
not ecx
mov edx, 0x2413ba1d
xor dl, dl
mov dword [ebp + edx*2 - 0x48277400], ecx
call fcn.00795898
sysenter
pushfd
mov dword [esp], 0xba0b47f1
call fcn.00cfa122

Function at 0xd0cbd5
Capabilities:
Encode data using base64

Disassembly:
mov word [esp + edx + 4], ax
xor cl, 0x99
sar dword [esp + eax - 0x6b182e7d], 0x81
sbb cl, 0xb1
xor word [esp + edx*2 + 5], 0x2f0f
jno 0x8d737f
Function at 0xd14df0
Capabilities:
Encode data using base64

Disassembly:
neg dx
shr al, 0x27
push eax
sbb dx, 0x9c82

Function at 0xd14e0b
Capabilities:
Encode data using base64

Disassembly:
push 0xe7bb3c9c
not word [esp + 8]
shld eax, edx, cl
mov ecx, 0xec83c3bd
mov dword [esp + 4], ecx
mov dword [esi], eax
call fcn.008f83f6
call fcn.0090b9d2
add esi, 6
jmp 0x78f241

Function at 0xd16b6e
Capabilities:
Encode data using base64

Disassembly:
inc eax
bts edx, 0xa7
inc dx
sar word [esp + ecx*4 - 0x4b01406f], 3
bswap eax
lea ecx, [edx + 0x599b6626]
xor ebx, eax
add edi, eax
push ecx
ror edx, 0xf4
call fcn.0084ee4a
mov dword [esp + edx - 0xac56367], edx
dec eax
neg eax
sub edx, 0x4f328887
jbe 0x7ac977

Function at 0xd29a8a
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
lea esi, [ecx + esi - 0xc2]
pop ecx
mov dword [esp + edx*2 - 0x430e4ea0], edx
mov eax, dword [edx + esi - 0x21872750]
xor eax, ebx
push edx
movsx ecx, dl
xor ecx, ecx
inc eax
neg dword [esp + edx - 0x2187274c]
jp 0x86ca34
not eax
and ecx, dword [esp + edx - 0x2187274f]
neg eax
lea eax, [eax + edx*8 - 0x1eb4b977]
xor ebx, eax
pop edx
add edi, eax
mov eax, edx
mov dword [esp + edx*2 - 0x430e4ea0], edi
ret
or dword [esp + edx - 0x4b381fc], edx
inc ecx
neg ecx
shr dx, 0x41
neg dx
lea ecx, [ecx + edx - 0x234a4c19]
lea eax, [edx*2 - 0x5d755e5c]
lea eax, [eax*8 - 0x3fea64fd]
xor ecx, 0x5a125f30
xor eax, dword [esp + edx*2 - 0x9677dfc]
mov dword [esp + edx*8 - 0x259df800], eax
lea eax, [eax*8 + 0xbbb3584]
not ecx
neg ecx
add edx, eax
rol ax, 0x49
sbb ecx, 0x7a84c830
sub edx, edx
xor ebx, ecx
sar eax, 0x4b
jae 0xd29a2d
xor edx, ebx
rol edx, 1
sal cx, 0x4b
inc cx
sbb edx, 0xcfb254bd
ror cx, cl
neg edx
xor ecx, 0x3992a729
mov eax, dword [esp + ecx*2 - 0x7324764e]
setns cl
not edx
or dword [esp + ecx - 0x39923afd], eax
xor eax, dword [esp + ecx - 0x39923b00]
xor ebx, edx
shl byte [esp + ecx - 0x39923aff], cl
add edi, edx
shr cx, 0xc7
mov edx, 0x99b7c708
mov dword [esp + ecx*2 - 0x732400ec], edi
ret 0xc
call fcn.00d7a221
mov edx, 0x9a39db30
mov eax, dword [edi]
movsx ecx, dx
lea edx, [edx*2 + 0x7abd740b]
add edi, 4
xor eax, ebx
lea eax, [eax + edx - 0x39a19bb0]
or ecx, 0x5b1b9be
xor dl, dl
btc edx, edx
bswap eax
sub cl, dh
neg eax
bswap edx
sub dx, cx
bt edx, 7
sbb eax, 0xb48c8c18
xadd edx, ecx
bswap edx
xor eax, 0x750d4200
xor ebx, eax
xor dx, dx
cmovg cx, dx
call fcn.0090993e
shld eax, edx, cl
mov edx, 0x218727be
movzx ecx, dl
mov dword [ebp + edx*2 - 0x430e4f7c], eax
add dl, 0x92
jbe 0x7ee37f
Function at 0xd29adb
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add edi, edx
mov edx, eax
pop eax
pop eax
pop eax
jmp fcn.00d58d5d
not cx
or ax, ax
neg edx
neg cx
jmp 0xd62c72
not ecx
dec edx
cbw
not edx
sub ecx, 0xf591208c
cwde
xor dl, dl
ror ecx, 2
shr eax, 5
btr eax, 5
shl al, 0x87
xor ebx, ecx
shl dl, 0x64
jb 0x81b731
adc edi, ecx
cwde
jmp 0x94a85b
sar ecx, 0x61
not cx
movzx ecx, dx
lea esi, [esi + eax*4 - 0x201]
jmp 0x932dd3
xor edx, 0xaba29590
lea ecx, [ecx + eax*2 + 0x1c3b84a6]
shl byte [esp + ecx - 0x1c945f04], 0x21
not edx
xor ebx, edx
push ecx
shl word [esp + ecx - 0x1c945f02], 0x23
jb 0x731b98
rol ax, 0x89
shl cl, 0xa7
sbb edx, 0xb2a8b89b
jmp 0xd69ff5
sub esi, 4
mov dword [esp], 0xba320138
mov ecx, 0x7013adbc
mov edx, dword [ecx + esi - 0x7013adbc]
xor edx, ebx
movzx eax, cl
push ecx
dec edx
jmp 0xdb5c22
inc eax
mov ebx, 0x6b864338
mov dword [esi + ebx - 0x6b864338], edx
mov ebx, dword [esp + ebx - 0x6b864330]
movsx edx, ax
ror eax, 0x57
cbw
lea ebp, [ebp + edx - 0x6d35]
sete byte [esp + edx - 0x6d2d]
inc dx
mov edx, dword [ebp + edx - 0x6d32]
xor edx, ebx
rol edx, 2
neg edx
movzx ecx, ax
xadd cl, ah
inc edx
bswap edx
jmp 0xd1ff24
push esp
and dword [esi + 0x5a66668a], ecx
xchg edx, eax
cli
pop edx
add ebx, dword [edx + 0x49]
mov edi, 0x7cd45a3a
xchg bl, bh
and bl, byte [edx - 0x2f]
mov byte [edx - 0x68c0da2a], bh
pop ds
push cs
fidiv dword [ebp - 0x18bfc56]
cmp dword [esi - 0x3a], 0x75fca5b0
mov bh, 0xaf
fimul word [ecx + 0x64c00c46]
mov dword [esi + 0xc], eax
shl byte [esp + 3], 0x67
mov eax, dword [esp]
mov dword [esi + 8], ebx
push eax
mov dword [esi + 4], ecx
jnp 0xd62935
mov dword [edi + edx], ebp
dec esp
mov dword [esp + edx], edi
ret
call fcn.007bb25d
jecxz 0xd62c20
jbe 0xd62c60
js 0xd62cd1
aam 0x71
mov cl, 0x7a
adc eax, ebp
cmpsb byte [esi], byte es:[edi]
lcall 0x6556, 0xc6df2a1a
fsubr dword [eax]
ret
salc
cmp ch, byte [edi + 0x39]
and byte [edi], al
mov cl, 0xfe
invalid
not edx
sub edx, 0x8d2eab8b
pop eax
jmp 0x993431
bswap edx
push ecx
neg word [esp + eax*2 - 0x16e]
ror edx, 2
sub ax, 0x188a
xadd word [esp + eax*2 - 0x1d064], ax
or eax, 0xa9b4fcb4
inc edx
xchg ecx, eax
push ecx
inc ecx
neg edx
sar eax, 0x6b
xor ebx, edx
add edi, edx
neg cx
mov edx, ebp
lea ebp, [ebp + eax*4 - 0x3809d8]
sub ax, 0xd38e
mov dword [ebp + eax - 0xe2ee7], edx
pop ecx
js 0x847631
pop edx
pop eax
pop edx
jg fcn.00dad269

Function at 0xd2e73e
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [ebp + ecx - 0x208a8c08]
mov eax, ecx
movsx edx, cx
ror dl, 1
mov edx, dword [ebp + eax*2 - 0x41151808]
adc eax, eax
or eax, ecx
push ecx
xor edx, ebx
neg edx
add word [esp + ecx - 0x208a8c02], 0x3c9b
rol eax, 0xde
xor edx, 0x1388d690
ror dword [esp + ecx - 0x208a8c04], 0xd3
push ecx
bswap edx
call fcn.009dcb87
Function at 0xd3a8db
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
xor cx, 0x4926
dec cx
cwde
jmp 0x8411de
mov esi, dword [esi*4 + 0x8516e4]
push 0x75a46c11
call fcn.0090e56e
mov eax, dword [edi]
mov ecx, 0x1fadec1e
lea edx, [ecx + ecx - 0x124819c8]
lea edi, [edi + ecx - 0x1fadec1a]
dec edx
ror dx, 0xc3
push edx
xor eax, ebx
btr ecx, edx
inc eax
bswap eax
shr cx, 0xcf
ror eax, 2
neg eax
inc eax
bts edx, edx
xor ebx, eax
and dx, dx
or cx, dx
adc ebp, eax
neg dx
btr edx, 0xa5
and ecx, ecx
movzx ecx, word [edi + ecx*2 - 0x3f5aef9e]
rol dword [esp + edx*2 - 0x5a271024], 0x71
sbb dl, dh
movzx eax, dx
lea edi, [edx + edi - 0x2d138888]
sbb word [esp + edx*2 - 0x5a271112], dx
xor cx, bx
add cx, 0xf01b
shr al, 0xc2
not cx
and ax, ax
inc eax
adc cx, 0xcb97
push edx
jmp 0x873748

Function at 0xd3d8dd
Capabilities:
Encode data using base64

Disassembly:
xor ebx, ecx
not eax
mov dword [esp + eax*2 - 0x53edfbfe], 0x9a3689bf
add ebp, ecx
jmp 0xdb794b
bswap eax
shr byte [esp + edx*2 + 1], 0x85
mov si, word [esi + edx*4]
neg word [esp + edx + 2]
pop eax
jno fcn.009f2e39

Function at 0xd69f5f
Capabilities:
Encode data using base64

Disassembly:
push 0xd18bc8b0
jmp 0xd889d5

Function at 0xd7003d
Capabilities:
Encode data using base64

Disassembly:
jmp 0xda826a
jmp 0xd57861
lea esp, [esp + 8]
jne 0x7cfcb0
Function at 0xd788f2
Capabilities:
Encode data using xor

Disassembly:
sar cx, cl
dec ebp
lea edx, [ebx + 0x73a21401]
dec esp
mov dword [esp + eax - 0x8167722], esi
inc esp
movsx esi, dx
cwde
dec ecx
dec eax
xor dword [esp + eax*2 - 0xee44], ebp
dec eax
add edx, 0x4089363e
call fcn.00d15221
popfd
enter 0x3f69, 0xffffffffffffffa5
lahf
xor dword [edi], esi
and eax, 0x4dd1a909
xor ah, byte [ebp - 4]
mov ah, byte [ecx]
movsd dword es:[edi], dword [esi]
out 0x67, eax
add ebx, esi
out dx, eax
jp 0xd788fd
push 0xfffffffffffffff8
lcall 0x2be1, 0x4c229be9
inc eax
pop es
lds esi, [edx + 0x3fcfdae9]
std
mov edx, 0x8db390b
lds ecx, [ebp - 0x2fc02b13]
in eax, 0x15
sub eax, 0x8fea3fdd
xchg ebx, eax
cmpsb byte [esi], byte es:[edi]
push ss
and eax, 0x16cce518
sub esp, edi
ljmp 0xeded

Function at 0xd7bdbc
Capabilities:
Encode data using base64

Disassembly:
inc word [esp + eax + 1]
jne 0xd113e3
jmp 0x7ccf7c
sub ebp, 4
movsx ecx, dx
mov edx, dword [ebp + ecx*4 - 0x4ccc]
sar ecx, cl
or ecx, ecx
xor edx, ebx
and ecx, ecx
not edx
shr cl, 0x62
xor edx, 0xed394c93
bswap edx
ror edx, 1
sub edx, 0x81b74186
rol eax, 0x70
xor ebx, edx
btc ecx, ecx
adc edi, edx
ror cl, 0xc7
xor bl, cl
xadd dword [esp + eax + 4], eax
sub eax, eax
jge 0x91a94e
mov ebx, 0x62a997a9
mov ecx, ebx
dec eax
lea esi, [esi + ecx - 0x62a997ad]
dec esp
lea ebp, [ebx + ecx*2 - 0x5b5574c1]
call fcn.00d09ee3
btc edx, 0x31
bswap ecx
movzx eax, word [esp + edx*2 - 0x6c07541e]
lea ecx, [ecx + edx*4 + 0x10297bdb]
lea edx, [edx + edx*4 + 0x708de6be]
not edx
ror ecx, 3
xor ebx, ecx
sub word [esp + eax - 0xf7], ax
call fcn.009812c3
mov edx, 0xbbad780f
inc edx
mov eax, dword [esi]
btc dx, dx
lea ecx, [edx + 0x1eb09d2d]
not dx
xor eax, ebx
xor eax, 0xe511d696
add cx, 0xc4ab
ror cx, 0xec
xor ecx, ecx
lea eax, [eax + edx - 0x682045cb]
or cl, dh
inc edx
call fcn.008e5860
mov dword [esp + 4], 0xaa3b8987
not edx
push 0x33b0d512
bswap edx
jae 0x7800aa
jae 0x7e59c3
not edx
inc dword [esp + 0xb]
xor ebx, edx
ror byte [esp + 0xc], 0x41
rol byte [esp + 9], 2
mov dword [esp + 4], 0x8eb5ec3f
adc edi, edx
lea esp, [esp + 0x10]
jmp 0x7d3f45

Function at 0xd7d678
Capabilities:
Encode data using xor

Disassembly:
mov dx, word [esi + 4]
mov eax, 0x47135391
rol al, 0xa3
mov dword [esp + eax - 0x4713538c], 0xdca2aca4
lea esi, [eax + esi - 0x47135386]
dec ax
ror word [esp + eax - 0x4713538a], 0x68
lodsb al, byte [esi]
in al, dx
mov eax, 0x66c8ff66
ror dword [esp + eax - 0x4713538a], 0x68
inc word [esp + eax - 0x4713538a]
mov word ss:[ecx + eax - 0x4713538b], dx
mov ecx, 0x2d1813aa
lea ebp, [eax + ebp - 0x4713538f]
mov ecx, dword [ecx + ebp - 0x2d1813aa]
cdq
inc edx
xor ecx, ebx
call fcn.0081fbbb
mov ah, 0x7e
stc
loop 0xd7d693
stosb byte es:[edi], al
push dword [esi + edi*2 + 0x2bbfe2f9]
xor ebp, esp
add byte [esi], bh
jb 0xd7d6cd
sub esi, dword [ecx]
in eax, 0
jb 0xd7d6cd
xchg esp, eax
dec ebx
mov ebx, 0xfe6782eb
arpl bx, bp
mov bl, byte [edi]
fcmovnbe st(0), st(3)
pop esi
fcomp dword [0x29726d91]
dec eax
dec eax
insd dword es:[edi], dx
lds edx, [ecx + 0x33fe16eb]
mov edx, 0xb829167c
ret 0xa00a
Function at 0xda5770
Capabilities:
Encode data using xor

Disassembly:
bswap edx
xor ecx, ecx
xor eax, ecx
jbe 0x9291c2
xor edx, 0xf7108ab5
dec edx
call fcn.007cd791
mov esi, dword [esp + esi + 0x1c730771]
mov dword [esp + 0x10], 0x9d21457b
mov ecx, dword [esp + ecx - 0x4994ac9d]
not byte [esp + 4]
setbe byte [esp + 4]
xor word [esp + 4], 0xe10e
or byte [esp + 4], 0x98
add dword [esp], 0xff779c82
test dword [esp + 4], 0xda5fda8
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.00746277
mov edx, dword [esi]
mov ecx, 0x55a57cb5
bswap ecx
sar cl, 0x47
mov al, byte [esi + 4]
inc ecx
and cl, ch
adc esi, 6
shl cl, 0xa5
mov byte es:[edx], al
sbb ebp, 4
movsx eax, cx
mov edx, dword [ebp]
cwde
xor edx, ebx
neg al
jle 0x9d018b

Function at 0xdb5c76
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
shr eax, 8
push 0x67b76d82
mov dword [esp + 8], 0x122ffd9c
xor eax, ebx
inc edx
call fcn.00871454
inc ecx
mov ecx, 0x6c1fc803
dec edi
lea edx, [ecx + ecx*8 + 0x6e9b77b0]
dec edx
lea esi, [esi + ecx - 0x6c1fc807]
inc ecx
movzx ecx, dx
inc ebp
mov eax, dword [ecx + esi - 0x6c1fc803]
inc ebp
xor eax, esi
call fcn.00935021
Function at 0x41dc2b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x42c070]
test eax, eax
je 0x41dc6a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41dc6a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41dc6a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41dc6a
cmp dword [ecx + 0x74], 0xe
jbe 0x41dc6a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42ba40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42ba6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42ba6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret