joyce8/EMBER2024-capa huggingface dataset:
Function at 0xff36eb
Capabilities:
Encode data using base64

Disassembly:
call fcn.018e5fab
mov edx, 0x3b26bfb7
mov ecx, edx
mov ecx, ebp
movzx eax, dx
lea ebp, [edx + ebp - 0x3b26bfb9]
inc eax
inc eax
sub edx, edx
mov word [ebp + edx], cx
lea esi, [edx + esi - 4]
or al, 0x22
idiv ax
mov eax, dword [esi + edx*8 - 0x1f988]
xor eax, ebx
lea ecx, [edx + edx*4 - 0x7bf53760]
neg dl
bswap eax
push ecx
setle dl
xchg dword [esp + edx - 0x3f01], ecx
neg eax
inc eax
xor eax, 0xd52eeb1b
bswap eax
shr cl, 0xc6
xor ebx, eax
sar edx, 0xc5
adc edi, eax
sar dl, 0xe7
sub dword [esp + edx*8 - 0xff8], ecx
lea eax, [ecx + edx*2 + 0x1ca2e324]
pop edx
jne fcn.019143e0
neg eax
imul edx, ecx
call fcn.00facc71
mov ecx, 0xf083a0a7
sub esi, 4
movsx edx, cx
xor dx, cx
je 0x193ae3b
mov edx, dword [esi]
push ecx
xor edx, ebx
movsx eax, cl
not edx
bswap edx
xchg ecx, eax
jmp 0x19401c7
rol word [esp + 2], 0x2c
inc edx
not edx
sub edx, 0x6aafe5b4
pop eax
neg ecx
neg edx
xor ebx, edx
dec ecx
xadd ax, cx
adc edi, edx
inc cl
lea esi, [esi + ecx*4 - 0x282a1]
lea edx, [eax*4 + 0x2b9e362f]
movzx eax, byte [ecx + esi - 0xa0a8]
push edx
xor al, bl
dec al
neg al
add edx, ecx
xor al, 0xa5
sub byte [esp + ecx - 0xa0a8], 0x3e
rol al, 1
dec cx
setle dl
neg al
add dword [esp + ecx*2 - 0x1414e], edx
xor cl, dl
xor bl, al
sar edx, 0x6f
adc cx, 0x7987
lea ebp, [ecx + ebp - 0x1a30]
imul edx, ecx
not edx
setno byte [esp + ecx - 0x1a2e]
mov word [ebp + ecx*8 - 0xd170], ax
pop ecx
jae fcn.019143e0

Function at 0xffbf71
Capabilities:
Encode data using base64

Disassembly:
dec eax
ror edx, cl
mov dword [esp], 0x762d6bb2
sar dword [esp], cl
rol eax, 2
lea edx, [ecx*4 - 0x33ede47d]
sal cl, 3
sbb dword [esp], ecx
neg eax
sal edx, 0xb9
call fcn.01979171

Function at 0x1000f75
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
adc ebp, 1
bt eax, eax
sal dx, cl
mov ecx, eax
mov word [ebp], dx
or ecx, 0x848f423d
jmp edi
mov eax, dword [ebp + ebx*4]
call fcn.0194e168
jne 0x1000350
ror dword [esp], 0xc3
jae 0x1978017
jne 0x1975044
mov dword [edi + 8], edx
cmc
clc
test cx, cx
mov dword [edi + 4], 0
clc
cmp cx, ax
cmp cl, 9
jmp 0x1209d47
jb 0x1001afa
push esi
sub eax, edx
movzx esi, cl
or edx, ebp
btr eax, 0xaa
mov eax, 0x6c16c16d
mul esi
cmovb ax, si
lahf
mov eax, esi
sub eax, edx
shr eax, 1
lea eax, [eax + edx]
shr eax, 5
rcr edx, 0xe
movzx eax, al
clc
mov edx, eax
pop esi
test bp, dx
jmp 0x1975044
add cl, 0xd3
stc
test ah, dl
sub eax, 1
jmp 0x1001aec
xor edx, 0x9d8167b7
ror dword [esp], 0x91
call fcn.0106bbb5
mov dword [edi + 8], 0
test edi, esi
cmp cl, 0x2d
jmp 0x1212c15
Function at 0x10064f0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rol al, 1
lea ecx, [ecx*2 + 0x13148f02]
push ecx
neg al
inc ecx
rol al, 1
neg cx
neg al
ror word [esp + 1], 0x6b
neg word [esp + 1]
push ecx
xor bl, al
lea eax, [esp + eax + 8]
mov byte [eax], dl
mov edx, 0x848b69a7
mov eax, dword [esi - 5]
push ecx
xor edx, 0xcf08da01
lea esi, [esi + edx - 0x4b83b3ab]
push ecx
inc edx
xor eax, ebx
neg ecx
btc edx, ecx
inc eax
bts dx, dx
bts dx, cx
inc dword [esp + edx - 0x4b83b3ab]
ror eax, 1
shl ecx, 0xa1
neg eax
add edx, 0x4487cb36
btr ecx, 0xb0
inc eax
shl edx, 0x9c
xor ebx, eax
ror cl, 0x25
adc edi, eax
dec cx
mov ecx, dword [edx + ebp - 0x4ffffffe]
push edx
lea eax, [edx + edx*8 - 0x78c6fdda]
or dx, word [ecx + eax - 0x57390226]
cbw
mov word [ebp + eax - 0x57390022], dx
shr eax, 0x31
movsx ecx, byte [esp + eax*8 - 0x15cd0]
lea ebp, [ebp + ecx*2]
lea ecx, [eax*2 - 0x2ed15df4]
and word [esp + eax*2 - 0x5729], 0x1b2
mov dword [esp + eax*2 - 0x5738], edi
ret 0x10
dec edx
lea edx, [0xbd9dec3f]
inc eax
movzx eax, bh
ror ebp, 1
cdq
xor ebp, 0x7a33df01
rol ebp, 1
inc ebp
dec eax
mov dword [esp + edi - 0x753a3796], 0xc5a8bbba
dec esp
mov dword [esp + edi - 0x753a3796], esi
inc ecx
rol ah, 0x26
inc ecx
mov eax, 0x683bb01f
xor dword [esp + edi - 0x753a3796], ebp
dec ecx
xor edi, esp
inc ecx
pop esi
jnp 0x11fa70c
dec eax
arpl bp, bp
jge 0x11fd4c3
sub esi, 4
mov edx, 0xce8da831
call fcn.018dc6e1
sal cx, 9
not al
jb 0xf8f034
dec eax
adc esi, ebp
dec ecx
btr edi, 0xd
dec ecx
bts esp, 0x3d
dec ebp
lea ebp, [ebp + eax*4 - 0x25c]
inc ebp
movzx ecx, sp
inc sp
sbb ecx, edi
ja 0x19262d6
inc esi
mov esp, dword [edx + ebp]
dec ecx
shr ecx, 0x4f
inc ebp
xor esp, esi
push edi
inc ecx
dec esp
inc ecx
bswap esp
inc esp
movzx edx, di
inc eax
rol bh, 7
inc ecx
push edi
inc ecx
sbb esp, 0xf22f30be
inc ecx
pop edi
jmp 0x1226a21

Function at 0x100ac63
Capabilities:
Encode data using base64

Disassembly:
dec dword [esp + edx - 0x54f7b10]
not eax
mov dword [esp + edx - 0x54f7b19], 0xee3abc9f
lea eax, [eax + ecx - 0x2e95434c]
pop edx
cmovle ecx, dword [esp + 3]
xor ebx, eax
inc dx
sar dword [esp], 0x1a
sar byte [esp + 7], 0x47
add edi, eax
call fcn.00ff0c22
lea eax, [edx + eax - 0x7eda470c]
btr edx, ecx
xor ebx, eax
add edi, eax
sub word [esp + 2], 0x7f95
not dx
mov dl, byte [ebp]
call fcn.018dd466

Function at 0x1010313
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], 0xa7b606ac
mov eax, 0x93afc4b0
sub esi, 4
mov eax, dword [esi]
xor eax, ebx
mov ecx, dword [esp]
ror eax, 2
bswap eax
call fcn.0103abd6
add eax, 0x432c153d
not edx
rol eax, cl
rol edx, 3
bswap edx
and al, 0x12
or cx, 0x3f00
not edx
btc eax, 0x8c
lea edx, [ecx + edx - 0x39869a64]
sbb eax, eax
call fcn.01018ef0
Function at 0x1011b4b
Capabilities:
Encode data using base64

Disassembly:
inc ecx
setae bh
dec eax
xor eax, 0xd0b0c1aa
rol ebx, 0x11
dec eax
not eax
bswap edi
dec eax
rol eax, 1
dec eax
xor eax, 0x6d88e284
call fcn.0193625e
inc ecx
movzx ecx, di
inc ebx
mov ecx, dword [ebx + edi - 0x4e3f758f]
inc ebx
mov ebx, dword [ebx + edi - 0x4e3f758b]
and ecx, ebx
inc ecx
mov ebp, edi
not ecx
inc esp
movsx eax, bp
inc ebx
mov dword [ebx + eax - 0x758b], ecx
inc edi
mov edi, dword [edi + ebp - 0x4e3f7593]
movsx edx, bp
dec ebp
lea ebp, [ebp + ebp - 0x4e3f7593]
inc esp
movzx edx, ch
inc ebp
xor edi, esi
inc ecx
movzx eax, dx
inc esp
bt eax, edx
dec edx
lea ebp, [eax*4 + 0x120222a6]
inc edi
lea edi, [edi + eax*2 - 0x4d8e12bf]
inc ecx
ror edi, 2
inc esi
lea edi, [ebp + edi + 0x1e374e20]
dec ecx
sar edx, 0x35
dec eax
lea edi, [eax - 0x2e98ec3]
inc ecx
xor edi, 0x64a7f1bf
mov ecx, edi
inc ecx
dec edi
dec ebp
lea ecx, [edx + 0x79a3f4bf]
dec edx
lea ecx, [eax*4 + 0x4e1fc2ae]
inc ebp
btr ecx, eax
inc ecx
neg edi
jmp 0x1904340
inc ecx
ror edi, 2
dec eax
xor ecx, 0x5312b28b
inc ecx
sbb edi, 0xe22b8fb7
inc ecx
imul edx
dec eax
not ecx
cwd
inc ecx
xor edi, 0xe89d7a8d
inc ecx
push esi
inc ecx
mov ebx, ecx
cdq
inc esp
xor dword [esp + ebp*4 - 0x480fe388], edi
dec eax
bswap eax
inc ebp
mov esp, eax
inc ecx
pop esi
inc bp
bts ecx, esp
dec eax
lea eax, [ecx + ecx*4 + 0x4a94dc3b]
dec ecx
sbb edx, 0x4c1431bf
dec ebp
arpl di, di
dec ecx
add esi, edi
dec eax
not ecx
inc edx
mov ecx, dword [ebp + ebx - 0x1203f8de]
inc esp
movsx edi, ch
inc ecx
neg bh
dec ecx
bt eax, edi
inc esi
mov ecx, dword [ebp + ebx - 0x1203f8da]
inc cx
idiv eax
call fcn.0191af18
add ecx, 0xe49985a6
mul ax
mul edx
xor eax, 0x44b0fda7
xor ebx, ecx
call fcn.011fd4e6
shl bl, 0x47
shr ebx, cl
pop ebx
sub eax, ecx
call fcn.00fa1a33
mov word [esp + ecx - 0xaa8b3], ax
push ecx
bswap edx
lea ecx, [ecx*2 + 0x3a0c3d15]
xor ebx, edx
lea eax, [ecx*4 + 0x1203f536]
dec byte [esp + ecx - 0x3a218e7a]
and dword [esp + ecx*2 - 0x74431cf6], eax
adc edi, edx
rol cx, 0x25
pop edx
pop eax
jb fcn.0121e846
Function at 0x1014055
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov cl, byte [ebp + eax*2]
jg 0x11fd2c5
mov byte [edx + ecx*2], al
xor ecx, dword [esi + ecx*2 - 5]
call fcn.0102b9f8
mov edx, 0x959ea09f
shr dx, 0xe5
movsx eax, dl
mov edx, dword [ebp + eax - 4]
ror al, 0x21
jae 0xf95052
dec ecx
inc edi
xor eax, 0x31857a9f
movzx ebp, dx
dec ecx
bt eax, ebx
dec eax
dec eax
xor dword [esp + edx*2 - 0x6804f5], 0xca853918
rol eax, 1
push ebx
dec esp
mov dword [esp + edi - 0x29282d9b], esi
xchg ecx, edx
inc esp
add byte [esp + edi - 0x29282da7], bh
not dword [esp + edi - 0x29282da0]
inc edx
xor dword [esp + edx - 0x2d9b], eax
inc ecx
pop ecx
dec esp
mov esi, dword [esp + edi - 0x29282da3]
inc cx
inc ecx
dec eax
arpl ax, ax
shl dword [esp + edi - 0x29282da7], cl
dec eax
add esi, eax
jmp 0x18f2708
not eax
dec ax
shr edx, cl
ror eax, 0x21
mov dword [ebp + eax - 0x7ffffffc], edx
lea eax, [eax + eax - 0x39f4476b]
mov ecx, dword [esi - 4]
mov edx, eax
shl edx, 0x4b
xor ecx, ebx
inc edx
div eax
add eax, edx
not ecx
add dx, 0x6882
xadd dl, al
bswap ecx
sar edx, 0x6c
inc ecx
sub al, al
not ecx
rol ax, 0x62
mul edx
btc edx, 0xa
lea ecx, [ecx + edx - 0x6ab03552]
imul al
sar eax, 0x8a
neg ecx
not eax
sar dx, 0x2f
setne al
xor ebx, ecx
cwde
add edi, ecx
neg eax
add eax, 0xb4b14f85
lea ecx, [eax + eax - 0x6ff0244b]
add dl, byte [edx + esi - 5]
jmp 0xf96d5d
rol cx, 4
jb 0x18d0c8d
pop eax
pop ebx
jae fcn.019363ab

Function at 0x1015b95
Capabilities:
Encode data using xor

Disassembly:
inc eax
shl dl, 0x84
bswap ecx
ror edx, 0x7c
add ecx, eax
push edx
not dx
add edx, 0x3e0be9a6
ror ecx, 1
and byte [esp + eax*4 - 3], ah
xor ebx, ecx
mul al
adc edi, ecx
jmp 0x10012a3
movzx ecx, al
rdtsc
bts ecx, 0x81
shl ecx, cl
lea ebp, [ebp + ecx*2 - 0x38]
and byte [esp + ecx*2 - 0x2f], cl
mov dword [ebp + ecx - 0x14], eax
push ecx
movzx eax, cx
mov dword [ebp + ecx*8 - 0xc0], edx
jns 0x101f72c
syscall
call fcn.00fef6fe
shl al, 0xa1
rol dl, 1
ror cx, 0xa1
shr ecx, 0x9c
inc ecx
xor dl, 0xf
xor bl, dl
shl al, cl
call fcn.011f77b8
mov dword [esp], eax
xchg edx, eax
mov ecx, dword [esi]
ror eax, 0x88
pop edx
xor ecx, ebx
dec eax
sar eax, 0xff
bswap edx
sbb ecx, 0xfd2df104
jmp 0xfeab26
jge 0xf95524
mov dx, word [ebp]
mov cl, byte [ebp + 2]
call fcn.00fade01
sbb ebp, 1
ror edx, 2
xor cx, cx
lea eax, [edx*2 + 0x3ea03236]
jbe fcn.0121e846
add al, 0x55
xor ah, byte ss:[eax - 0xe79f0c2]
invalid
cmpsb byte [esi], byte es:[edi]
push 0xecbf3d8d
mov edx, 0x512de934
out 0x96, al
adc ch, bh
sub eax, 0x54b2e651
bound eax, qword [eax - 0x7b]
pop ds
inc ebp
sbb byte [edx], bl
or edi, dword [ecx + 0x628258dd]
jp 0x101f749
mov bh, 0x2a
int1
adc eax, 0x64a5b5d0
lea esi, [esi + edx*2 - 9]
add eax, 0xd3db8e43
sbb ah, byte [edi]
mov dl, 0x9e
test dword [edi - 0x5417de35], esi
stc
jle 0x101f79d
sub dword [esi], eax
movsb byte es:[edi], byte [esi]
mov al, byte [esi + 6]
dec ecx
movsd dword es:[edi], dword [esi]
salc
or bl, cl
xor dl, byte [esi + 0x61]
xchg esi, eax
invalid
Function at 0x101714f
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov dword [esp], esi
jmp 0x19317c7

Function at 0x1019442
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
add byte [edi + ebx - 0x7935f01e], ah
add al, 0x84
cbw
inc cl
not edx
not cl
xor ebx, edx
shr cx, cl
call fcn.011f57d4
xor ebx, eax
shr cl, 2
sbb dx, word [esp + edx - 0x7387f74f]
sbb dl, dh
add edi, eax
neg cx
movsx eax, cl
mov dword [esp + edx - 0x7387f758], edi
ret
add cx, word [ebp + ecx - 2]
call fcn.018cdc15
adc al, 0x76
mov esi, 0x4aa73516
adc ebp, ebx
push ss
aaa
test dword [esi + 0x13], ebp
jmp 0x1019473
stosb byte es:[edi], al
jp 0x1019407
xchg ebp, eax
pop ebp
cmp eax, 0x92d9360e
inc ebx
fdivr st(1), st(0)
invalid
fst dword [edx - 0x730e23bd]
jo 0x10194b9
xor dh, bl
int1
xchg dword [esi], edi
add eax, 0xda057965
and edx, dword [esp + edi*8 + 0x78]
or dword [esi + 0x78fc544f], ebx
adc eax, 0xfc5413d6
js 0x10194c8
loopne 0x101946b
and ebp, dword [eax - 0x30f0bef0]
ret 0xdcbc

Function at 0x101ddc5
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
jp 0x1936517
xor ebx, ecx
call fcn.01042f14
mov eax, 0x7c0abc07
bswap eax
movzx eax, byte [esi + eax - 0x7bc0a7d]
mov ecx, 0x2812759e
btr cx, cx
xor al, bl
movzx edx, cl
not al
sub al, 0x98
not al
inc edx
bswap edx
add al, 0x2d
shl dx, 0x6b
xor bl, al
add eax, esp
shr dl, 7
xchg dh, dl
jae 0x190b255
lea esi, [esi + ecx - 0x8003]
bts cx, 0xba
mul ecx
jo 0x19282df
adc edi, eax
movsx eax, dx
add eax, dword [ecx + ebp - 0x3ebf2806]
and dl, dl
adc cx, 0x68a8
movzx cx, byte [eax + ecx*2 - 0x7d7f2154]
sar dword [esp], 0xeb
mov word [ebp - 2], cx
xor byte [esp + 1], 0xe
adc ebp, 0xfffffffe
call fcn.018e605b
movzx dx, byte [ebp]
mov eax, 0x522c628
shl ax, 0x81
mov cl, byte [ebp + eax*4 - 0x148a313e]
sal eax, 0xeb
lea ebp, [eax + ebp - 0x14627ffe]
and ax, ax
not eax
shr dl, cl
mov word [ebp], dx
movzx ecx, ax
jmp 0x103aaba
mov ecx, dword [ecx + eax - 0x2812359e]
je 0xfae548
mov eax, dword [esi + ecx*2 - 0xfffe]
xadd edx, ecx
bts cx, cx
xor eax, ebx
btr edx, edx
neg eax
or dl, dh
btc dx, 0xac
sar dx, 0xc
xor eax, 0x3bb0f314
dec eax
xor ecx, 0x2eb1d9bf
neg eax
xadd dl, ch
add ecx, 0x6e208d90
xor ebx, eax
add edi, eax
jmp edi
mov dword [ebp - 4], ecx
push edx
mov eax, dword [esi - 5]
movsx ecx, word [esp]
sar dl, 0x62
lea esi, [esi + ecx*2 - 5]
adc dl, byte [esp + ecx*2 + 2]
sar dl, 0x43
bts edx, 0xd
xor eax, ebx
ror eax, 1
inc eax
bswap eax
pop edx
xor eax, 0xfe04dc86
not ecx
sar ecx, 0xb1
lea ecx, [edx + ecx*4 - 0x6040d7fa]
xor ebx, eax
or cl, cl
push edx
jne 0x1203ca5
Function at 0x102807a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc ebx
mov dword [ebx + ecx*4 + 4], eax
inc ebx
mov dword [ecx + ebx], edx
dec edx
mov dword [esp + ecx + 8], 0x2226af95
inc ecx
pop eax
dec edx
mov dword [esp + ecx*4 + 0xe], 0x2902e437
inc ecx
pop edi
inc ecx
pop ecx
pop eax
jp fcn.019363ab
push 0x651574a3
mov edx, dword [ebp]
mov ecx, dword [ebp + 4]
shr byte [esp + 3], 0x42
adc edx, ecx
not byte [esp + 2]
mov eax, 0x6b24b621
mov dword [eax + ebp - 0x6b24b61d], edx
lea ecx, [eax*4 + 0x29b1230a]
sub eax, 0x40b09db9
mov ecx, dword [esi + eax*2 - 0x54e830d4]
lea esi, [esi + eax - 0x2a74186c]
xor al, ah
call fcn.00fae2fa

Function at 0x102d6ab
Capabilities:
Encode data using base64

Disassembly:
sub esi, 4
mov edx, eax
call fcn.00fadd62
call fcn.01954f81
mov dword [esp + ecx*2 - 0x10e], ecx
lea esi, [esi + ecx*8 - 0x43c]
neg al
xor edx, ebx
sal al, cl
call fcn.0190f7de
mov eax, 0xba03499b
jmp 0x101713d

Function at 0x10300e6
Capabilities:
Encode data using base64

Disassembly:
lea eax, [edx + eax + 0x43052393]
sar cl, 0x86
ror eax, 1
xor eax, 0x6e1fa834
not cl
sub eax, 0xc804e1af
xor ebx, eax
add edi, eax
movsx eax, dx
jmp fcn.0121e846
sal edx, cl
not al
pop ecx
dec al
shr edx, 0xd4
xor bl, al
mov ecx, 0xc78e4235
add eax, esp
rol edx, 0xb5
sub ecx, edx
rol ecx, cl
adc edx, dword [eax + edx*8]
shr cl, 0xc1
movzx eax, cx
mov dword [ecx + ebp - 0x46b8f166], edx
lea ebp, [ebp + eax - 0xf166]
sbb ecx, ecx
mov edx, 0x7da37d8c
mov eax, dword [esi + ecx - 5]
and dx, cx
bt ecx, 0x93
lea esi, [esi + ecx - 5]
inc dl
bts dx, cx
xor eax, ebx
add ecx, ecx
jp 0x100e926

Function at 0x10344d1
Capabilities:
Encode data using base64

Disassembly:
push 0xb3bd5d96
call fcn.0195caa0
mov dword [esp], 0x5d1a7887
xadd byte [esp + 7], cl
not dl
lea ecx, [ecx*4 - 0x3b40ff65]
or cl, 0x30
dec dword [esp + ecx*2 - 0x6a46f662]
and al, dl
pop edx
or byte [esp + edx - 0x5d1a7884], ch
mov word [ecx + ebp - 0x35237b31], ax
mov eax, 0x8eae1883
movzx edx, byte [esi + edx - 0x5d1a7888]
div cl
xor dl, bl
push eax
jmp 0x1901820
add dl, 0x23
neg dl
xor dl, 0x30
sar cl, 0x66
sbb dl, 0xa3
pop ecx
ror ecx, cl
xor bl, dl
cwde
lea edx, [esp + edx + 4]
shr dword [esp + eax - 0x2cc], cl
ja 0x18fb90b
btr ax, cx
mov ecx, dword [edx + eax*2 - 0x598]
mov dword [eax + ebp - 0x2ce], ecx
xchg word [esp + eax - 0x2cc], ax
mul dword [esp + eax - 0x7f9]
lea ebp, [ebp + eax - 0x164c6e]
shr ax, 0x89
movsx ecx, byte [esp + eax*8 - 0xb00130]
or ax, ax
adc edx, dword [esi + eax*2 - 0x2c0051]
not byte [esp + eax - 0x160023]
lea ecx, [ecx*4 + 0x302472a6]
lea esi, [esi + eax - 0x16002b]
xor edx, ebx
rol word [esp + ecx - 0x302471d5], 0xea
add word [esp + eax - 0x160025], ax
lea edx, [edx + ecx*2 + 0x605f3fe8]
sar byte [esp + eax*4 - 0x580098], 0xc6
setb al
adc ecx, 0x141d74b2
ror edx, 1
call fcn.0193bf61
sub al, 0xaf
not dl
dec dword [esp + ecx*2 - 0x6a46f664]
shr dword [esp + ecx - 0x35237b2f], 0x43
rol dl, 1
not dl
jmp 0x103d0d4
Function at 0x1038f6b
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea esp, [esp + 8]
call fcn.018dd199
mov eax, 0x371aec0c
sal eax, 0xfd
movsx edx, al
mov eax, dword [ebp + eax - 0x80000000]
mov cx, word [ebp + edx*2 + 4]
btc edx, edx
jae 0x120581d
lea ebp, [ebp + edx*4 + 2]
btc dx, dx
inc dx
shr dl, 0x61
mov word [eax + edx*8 - 0x10], cx
not edx
dec edx
sbb esi, 4
movzx ecx, dx
sal cl, 0x82
mov ecx, dword [esi + ecx*2 - 0x1ffe0]
xor ecx, ebx
ror edx, 0x7d
or dl, 0x3a
adc edx, edx
sbb ecx, 0xf8b4cbb7
movsx eax, dl
or eax, eax
cwde
neg ecx
cwd
idiv edx
or ax, 0x1eb6
rol ecx, 2
neg dl
call fcn.01010abb

Function at 0x103dd83
Capabilities:
Encode data using base64

Disassembly:
bswap edx
sal eax, cl
xor ax, cx
not edx
not ecx
sub ecx, 0xd82c7a99
xor ebx, edx
shl eax, cl
sbb al, 0x11
jl 0x105f8c5
lea edx, [eax + eax*8 + 0x1d11cd01]
sar dword [esp + ecx*2 - 0x4fa559fc], 0x18
lea ebp, [ebp + eax*4 - 0x2b3fc]
pop eax
jne fcn.0121e846
xor cl, bl
add edx, 0xcc2f5912
not cl
mov dword [esp + edx - 0x4d06f06a], edx
neg cl
add dword [esp + edx - 0x4d06f06a], 0x52563ad
sbb byte [esp + edx - 0x4d06f069], dh
inc cl
sal word [esp + edx - 0x4d06f068], 0xe6
ror cl, 1
add cl, 5
xor bl, cl
lea ecx, [esp + ecx + 4]
xchg dh, dl
imul dx, word [esp + edx - 0x4d066af0]
mov edx, dword [ecx + edx - 0x4d065b90]
mov dword [ebp - 4], edx
mov edx, dword [esi - 5]
jb 0x1946ce5
xor al, bl
inc word [esp + 2]
lea edx, [ecx + ecx*2 - 0x3be93f78]
sal dword [esp], cl
xor al, 0x3a
not dword [esp]
btr edx, edx
dec al
xor al, 0xb7
lea ecx, [ecx + ecx - 0xbd373ca]
shr ecx, cl
inc al
neg edx
shl dword [esp + ecx - 0xf3e8], 0x8f
xchg dword [esp + ecx - 0xf3e8], ecx
ror al, 1
pop ecx
inc al
rol cx, cl
imul edx, ecx
xor bl, al
sub edx, edx
jns 0x1979ff4
add edi, edx
inc byte [esp + ecx*2 - 0x4fa558a2]
cwde
mov eax, dword [ebp + eax - 0xf2]
xor cl, ch
mov edx, dword fs:[eax + ecx*2 - 0x4fa559fc]
movzx eax, cx
mov dword [ebp + ecx - 0x27d2ad02], edx
jl 0x1004183
mov eax, dword [esp]
adc esi, 0xfffffffa
not eax
movsx ecx, word [esp + eax - 0x74ff9be8]
xor edx, ebx
not edx
xor word [esp + eax - 0x74ff9be7], 0x4295
sub cx, 0x3c0b
neg edx
inc byte [esp + ecx - 0x280c]
lea eax, [ecx*4 - 0x4a457f7e]
xor cx, word [esp + ecx*2 - 0x5018]
lea edx, [edx + eax + 0x1d534b0b]
jle 0xfeb21d
pop ebx
inc ebx
push es
cmpsd dword [esi], dword es:[edi]
push dword [esi + 0x71]
sub eax, 0x9682990a
sbb dl, byte [edi - 0x19d30158]
add byte [ecx], dh
xor dword [esp + edx - 0x57c0], edi
inc ecx
movsx ebp, di
dec ecx
or eax, 0x609b2306
dec eax
mov dword [esp + edx - 0x57c8], ebp
dec esp
mov esi, dword [esp + edx - 0x57c0]
neg cl
adc eax, esp
or dl, byte [eax + ecx - 0xe8f3]
shl ecx, cl
mov eax, ecx
lea ebp, [ebp + eax - 0x47980002]
btr eax, eax
and al, cl
mov word [ebp + ecx - 0x47980000], dx

Function at 0x10461be
Capabilities:
Encode data using base64

Disassembly:
inc ebp
mov bh, byte [ebx + ebx - 0x54b907ae]
inc ecx
not cl
inc ecx
pop eax
mov eax, ebx
inc ecx
not bh
movzx ecx, al
dec eax
not dword [esp + ebx - 0x54b907b0]
inc ebp
or cl, bh
imul ebx, eax
call fcn.0100c25c
Function at 0x1047ea6
Capabilities:
Encode data using base64

Disassembly:
inc edi
mov ebx, dword [eax + ebx*4]
call fcn.019675b6
inc ebp
xor ebx, edi
inc ecx
and ebx, 0xff
jmp 0x101366b
push 0x8b998e21
dec eax
lea esp, [esp + 0x38]
jne 0x18ff63f
inc ecx
mov edx, 0xe81b9586
inc ebp
mov eax, edx
inc ecx
mov edx, eax
inc ecx
pop ebx
inc ecx
mov ecx, 0xd22dda9
inc ebp
movsx eax, cx
inc ecx
not edi
inc ecx
movsx edx, cl
inc ecx
movzx edi, cx
inc edi
mov dword [ebx + ecx*8 - 0x6916ed3c], edi
movsx ecx, di
inc bp
bts ecx, ecx
inc ecx
movsx ebp, al
inc edi
mov ecx, dword [ecx + ebp - 0xd22dfad]
inc esp
mov esp, edx
dec esp
btr edx, eax
inc ebp
xor ecx, esi
not cl
inc ecx
rol ecx, 3
inc ecx
btr eax, 0xb0
inc ecx
neg ecx
inc ebp
movsx edx, ah
inc ecx
not ecx
inc ecx
add al, 0x8e
inc ecx
dec ecx
call fcn.0106a3a0
mov ebp, 0xdda4f5af
inc esp
movzx ecx, ch
dec edx
lea edi, [ebp + ecx*2 - 0x35d0e7c4]
dec ebp
mov ecx, ebx
inc esp
mov edx, ebp
inc esp
mov eax, ebp
inc eax
dec bh
dec ecx
sub ebx, 4
inc esp
mov edi, edi
inc ebp
btc edi, eax
inc ecx
neg al
inc ebp
mov dword [ebx], ecx
dec ecx
sbb ebp, 3
call fcn.0103880a
inc ecx
mov ebx, 0x8a197190
inc esp
movzx ebx, byte [edx]
jmp 0x197437f
jmp 0x101cdf5

Function at 0x104d345
Capabilities:
Authenticate hmac

Disassembly:
call fcn.0192fbbe
cwd
xor ebx, ecx
cwde
sar dx, 0xaa
add edi, ecx
mov ecx, dword [ebp]
sar dx, 0xe7
ja 0x193864c
movzx eax, byte [esi - 5]
sbb esi, 4
bts edx, 0x92
xor al, bl
neg dl
sar dl, 0x44
sbb al, 0xb7
neg al
add al, 9
sub word [esp + 8], 0x2c96
adc dx, 0xafb6
mov dword [esp], edx
xor al, 0x29
ror dx, 0x21
shr edx, 0x1c
dec al
jmp 0xf99a13

Function at 0x104d50b
Capabilities:
Encode data using base64

Disassembly:
shr edx, cl
shl word [esp + 4], 0x21
call fcn.0101e474

Function at 0x104ed72
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec ecx
add esi, edx
inc sp
sub esp, ecx
inc cx
xor edi, ecx
pop ebx
jae fcn.019363ab

Function at 0x104ed84
Capabilities:
Encode data using base64

Disassembly:
sar word [esp + 9], 0x48
pop ecx
pop edx
pop edx
jne fcn.0121e846
not al
neg ecx
mov dword [esp + edx*4 - 0x18fc1000], 0xa25f007
sbb ecx, dword [esp + edx - 0x63f03fe]
xor bl, al
dec word [esp + edx*2 - 0xc7e07fa]
lea ebp, [ebp + edx*4 - 0x18fc1002]
push ecx
ror word [esp + edx*2 - 0xc7e07f8], 0x81
imul edx, ecx
mov word [ebp], ax
shl cl, cl
jb 0x1014b74
Function at 0x104ee18
Capabilities:
Encode data using base64

Disassembly:
inc edx
xor dword [esp + edi*2 - 0x6b6bea24], edi
call fcn.00f92d90
push ecx
ror ecx, 0x7d
add edi, edx
bts ecx, eax
movzx ecx, byte [esi - 5]
sbb esi, 5
dec dword [esp]
xor cl, bl
dec cl
mul al
shr word [esp], 0x21
neg cl
rol cl, 1
xor cl, 9
xor bl, cl
shl word [esp], 0xd
jbe 0x12134d3
mov ecx, 0xd18a5d91
movsx edx, cx
lea esi, [esi + edx*2 - 0xbb26]
rol dl, 0xc1
mov eax, dword [edx + esi - 0x5d23]
neg edx
neg cx
xor eax, ebx
xor eax, 0xe302fa92
bswap eax
sal edx, 0x5c
lea eax, [eax + edx - 0x75f428d2]
lea ecx, [edx*4 + 0x7ba3e80c]
xor eax, 0x54864824
sub ecx, edx
lea ecx, [ecx*2 + 0x1eadca1b]
inc cl
xor ebx, eax
dec edx
sub edx, ecx
add edi, eax
call fcn.0197dea3
rol edi, 1
cwde
dec eax
mov dword [esp + ebx*8 - 0x53fb8], 0x24905415
dec eax
rol ebx, cl
sbb edi, 0xb63f678f
dec ecx
ror esp, cl
push eax
neg edi
inc ecx
pop eax
xor edi, 0x31857a9f
push ebx
dec edi
rol edi, 1
inc ebp
movsx ecx, ax
inc esi
xchg byte [esp + edi*2 - 0x6b6bea2f], ah
inc ecx
push edi
dec esi
mov dword [esp + edi - 0x35b5f50a], esi
jmp 0xfa20de
btc eax, eax
lea ecx, [esp + ecx + 4]
lea edx, [eax*8 + 0x1367522]
movzx ax, byte [ecx]
call fcn.00f96b61