joyce8/EMBER2024-capa huggingface dataset:
Function at 0x170e27d
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov byte [esi], al
jmp 0x16eb89f
je 0x16eb8b5
inc edx
cmp bx, bx
cmp edx, 0x104
jb 0x170e28a
mov eax, dword fs:[0x30]
not cx
rcl cl, cl
mov eax, dword [eax + 0xc]
shrd ecx, ebx, 0x14
bsr bx, si
test edi, 0xa302ff17
mov ecx, dword [eax + 0xc]
movzx bx, al
mov eax, dword [eax + 0x10]
setne bl
sbb bh, 0x3b
cmova ebx, ecx
mov dword [ebp - 4], eax
mov ebx, ecx
cmp ecx, eax
je 0x1715439
lea ebx, [ebx]
and di, di
mov dword [esp], 0x6e87fa80
call fcn.01753e63
mov eax, 0x963d6488
mov si, dx
mov cl, dl
rol eax, cl
lea esi, [ebp + edx - 0x10c]
stc
add al, dl
test esi, ecx
stc
xor al, byte [edi + esi]
jmp 0x1260b8e

Function at 0x17174dd
Capabilities:
Encode data using xor

Disassembly:
add dword [edx], esp
pop es
adc ecx, ebx
leave
into
lcall 0x86f4, 0xc9cb1337
aas
adc al, al
adc dh, byte [ebp + 0x1e]
sbb bh, byte [edi]
pop ebx
les esi, [ebx - 0x55]
in al, 0xb0
dec edi
xchg ebp, eax
mov eax, 0x6728215b
dec ebp
cdq
enter 0x2b2d, 0x10
xchg esp, eax
mov bl, 0xa6
cli
adc al, 0x6d
jecxz 0x17174f2
cmp dword [edx + esi*8 - 0xdafef4d], esi
add eax, 0x70dab9d9
aam 0x57
push ecx
sub al, 0x10
push 0x2c5157cc
xor byte [eax], ah
cwde
sub eax, 0x9135c5cd
pop ebp
insb byte es:[edi], dx
xchg byte [ebx - 0x5605b12d], ah
scasb al, byte es:[edi]
shr dword [esi], cl
invalid
sar dword [esi], cl
xchg esi, eax
mov dl, 0xa9
scasb al, byte es:[edi]
rcl esi, cl
dec edi
rol byte [edx + esi], cl
jb 0x1717469
invalid
mov eax, dword [esi + eax - 0x6d25b300]
test byte [esi], al
add byte [ebp - 0x26], cl
xchg edx, eax
mov dword ss:[edx], eax
pop ecx
mov edx, dword [esi + 8]
mov eax, 0xad04f696
dec ax
sub esi, 0xfffffff4
enter 0xffffffffffffee83, 0xfffffffffffffff4
movsx ecx, al
movzx eax, byte [edi + 4]
ror cl, 4
sbb edi, 0xfffffffb
sar cx, 0xe2
mov dword [esp], 0xda3fa30b
sal ecx, cl
stc
loop 0x17174cf
add al, 0x24
or esp, dword [ebx - 0xe2c25c1]
xor al, bl
shl ecx, 0xac
pop ecx
ror al, 1
call fcn.017774cb
mov dl, 0x86
shr byte [eax - 0x33], 0xd2
adc bl, ch
mov cl, 0xe9
mov ch, 0xd2
adc bl, ch
and byte [ebp - 0x22ed2d0f], dh
xchg ebp, eax
jo 0x1717505
rcl byte [edx], cl
fucom st(5)
mov cl, 0xf9
jno 0x1717503
ret

Function at 0x171d582
Capabilities:
Encode data using xor

Disassembly:
inc esp
movzx ebp, dl
dec eax
arpl di, di
inc ecx
sar eax, 0x1a
dec esp
adc edi, edi
call fcn.01736882
cmp ah, byte [esi]
shr byte [eax + 0x45], 0x72
adc bl, ch
sub eax, edx
imul esi, dword [edx + 0x12], 0xd610ddd
jb 0x171d5ba
jb 0x171d5b4
fisttp qword [0x12720d61]
or eax, 0x31dd1272
fnsave dword [ecx]
dec ecx
adc eax, 0xa8dd1272
cwde
sub eax, 0x8cc3c7d1
push ebp
mov al, 0x93
adc edx, dword [edx]
inc esp
ja 0x171d5ec
ret
adc al, byte [edi + esi*2 + 0x2e]
push edi
das
loopne 0x171d638
ja 0x171d5f2
loope 0x171d5a5
les esp, [ecx + 0x17]
pop ds
jg 0xf9f6ada1
daa
std
inc esp
jne 0x171d5a0
pop ebx
out dx, al
xchg ecx, eax
add eax, 0xe6635c28
retf
xchg ebp, eax
ret
leave
cmc
aad 0x22
sbb esi, dword [edx + 0x24b51b28]
xor esi, esi
xor eax, 0x7857a7ad
dec eax
pop edi
into
pop ebp
mov ah, dl
sbb al, 0x37
mov esp, 0xa3795dbd
invalid
invalid
Function at 0x171dacb
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
sub eax, eax
lea edx, [edx*4 + 0x18065bb8]
sbb ecx, 0xc98645be
sal eax, 0xe3
shl edx, 6
xchg dx, ax
ror ecx, 1
call fcn.017723fb
sub eax, 0x539ced8e
inc ebp
xor dl, ch
rol bp, 0x46
dec esp
add ebp, esp
call fcn.0132c162
jb 0x125bb87
pop ebx
pop ebp
jp fcn.012669aa
xor ecx, ebx
mov dword [esp + edx - 0x7aeb3dab], eax
call fcn.0124702a
mov edx, eax
mov ecx, dword [eax + edi - 0x2b8e90a0]
jmp 0x1739f35
neg eax
lea edi, [edx + edi - 0x2b8e909c]
jne 0x16fb0d8
inc ebp
xor ch, dl
inc esp
mov ebx, ecx
ror di, 0x22
inc ecx
xor ch, 0x3f
jmp 0x1766448
inc ecx
ror al, 0x21
inc ecx
inc ch
inc ecx
xor ch, 0xa3
inc ecx
add ch, 0x3d
jmp 0x17184ce
Function at 0x1720c23
Capabilities:
Encode data using base64

Disassembly:
mov dword [esi], ecx
xchg dword [esp], eax
sal word [esp + eax - 0x7ffffffd], 0xa1
pop ecx
jne fcn.0171e965
xor dword [esp + edi - 0xb3], edx
dec edx
lea eax, [eax*8 + 0x472ccd84]
call fcn.01251d26
pop ecx
neg edx
push 0xa9a6f37
rol byte [esp + 9], 0x66
mov dword [esp + 4], 0x927aa0c
xor ebx, edx
mov eax, dword [esp + 0xc]
add eax, 0x54e9e0
jmp eax
xor dl, bl
mov dword [esp + eax*4], ecx
xor eax, 0x979d8eba
push ecx
sbb dl, 4
or al, 0x37
xor dl, 0xba
mov dword [esp], 0x981aeb6
dec dl
not dl
add dl, 0x29
sar ecx, 0xdb
sbb dword [esp + 3], eax
and cl, byte [esp + 4]
xor bl, dl
shr word [esp + 4], 0x2a
pop ecx
lea edx, [esp + edx + 4]
rol eax, cl
not dword [esp]
mov ecx, dword [edx]
sal dword [esp], 0x7f
not ax
adc ax, word [esp + 1]
sbb esi, 4
not dword [esp]
jmp 0x16fb898

Function at 0x1727971
Capabilities:
Authenticate hmac

Disassembly:
inc bp
mov esi, dword [esi + ecx*2 - 0x464]
dec eax
xadd ebx, edx
inc ecx
pop ebp
jne fcn.012669aa
mov edx, 0xe5806235
movsx eax, dl
xor ecx, 0x2d152bb9
sar dl, 0xe2
ror ecx, 1
sal dx, 0x61
ror dx, 0x2d
dec ecx
ror ecx, 1
xchg edx, eax
lea ecx, [edx + ecx - 0x43b16737]
or eax, 0x1bb25abd
call fcn.0177fc04
mov eax, 0x24864d26
movzx edx, byte [eax + edi - 0x24864d26]
lea edi, [edi + eax*2 - 0x490c9a4b]
call fcn.01787f1d
inc ecx
ror eax, 2
dec esi
mov dword [esp - 0x6a0eec31], edx
movsx ebp, al
inc esp
movzx edx, dh
dec eax
rol esi, 0x4c
inc esp
xor dword [esp + edi*4 - 0xc], eax
dec esi
lea edx, [edx + ebx + 0x54979c35]
inc ecx
movsx ebx, dx
inc ecx
pop edx
dec ebp
arpl ax, ax
neg si
xadd ebp, edx
dec ebp
adc edi, eax
inc si
movzx eax, byte [edi + esi - 3]
dec eax
dec ebx
inc ebp
add ebp, esp
inc ebx
mov bl, byte [ebp + esi - 0x6a0f722a]
inc ecx
sal ebx, 0x36
jbe 0x1791f4d

Function at 0x172cc68
Capabilities:
Encode data using base64

Disassembly:
rcl byte [edx], 0x41
mov ebp, 0x6ca6ea90
inc ebx
mov ecx, dword [esi + eax - 0x5ffff8]
dec ebx
lea edx, [eax + eax*4 - 0x2e52b5ed]
call fcn.016eae55
pop ebx
inc eax
not bh
inc bx
mov dword [esi + ebp*2 - 0x3eacc8fe], edi
inc dx
or dword [esp + ebp - 0x1f56647c], 0x894ed591
mov esp, 0xa99b812c
loopne 0x172cc4b
and byte [eax], al
Function at 0x173037a
Capabilities:
Encode data using base64

Disassembly:
dec ebp
lea esi, [esi + ebx*8 - 0x53a8]
dec edi
mov dword [esi - 0x29d0], ebx
dec cx
pop edi
dec eax
lea edx, [ebx + edi*2 + 0x339a387]
jl fcn.012669aa
inc ecx
mov ebp, 0x2703f431
inc ebp
movzx eax, bp
inc ecx
mov ebx, eax
inc edi
mov ebx, dword [ecx + ebp*2 - 0x4e07e862]
inc ecx
push eax
dec edi
lea ecx, [ecx + eax - 0xf42d]
dec edx
lea edi, [ebx + eax*4 + 0x1aaa57bf]
inc ebp
xor ebx, edx
inc ecx
dec ebx
inc ecx
ror ebx, 1
inc ecx
not ebx
call fcn.01272920
lds edi, [ebp + 0x52]
and cl, bl
jle 0x16fab1b
aaa
fbstp tbyte [0x147c995]
inc edi
fmul qword [esi + ebx*8 - 0x5a]
push ebx
sub al, 0xed
jbe 0x16faaab
inc edi
jno 0x16faaac
retf
test dword [ecx - 0x32078240], esi
pop es
sbb bh, dh
push edx
loopne 0x16fab65
cld
push dx
invalid
push cs
out dx, al
sub al, 0x61
xor eax, 0xb77713cd
push ebx
mov dword [edi + ebx*8 + 0x25], eax
or byte [esi - 0x11f16a66], 0x2c
popal
outsd dx, dword [esi]
sbb eax, 0xf6321ba
pop esi
invalid
inc esi
mov ch, byte [ebp + ecx - 0x47]
dec eax
mov dword [esp + ebp - 0x47], edx
sar ebx, 0xf3
mov ecx, 0x840a3a20
dec ebp
lea ecx, [ecx + ebx*2 - 0x1515]
dec ax
or dword [esp + ebx - 0xa87], 0xc730dc3e
inc ebp
xor ch, dl
dec edx
lea ecx, [edi + eax*2 - 0x63fbc678]
not bl
inc ecx
xor ch, 0x3f
inc ecx
inc ch
dec ecx
add eax, 0xfa20d537
jge 0x1791a98
inc ecx
xor ch, 0xa3
inc ecx
add ch, 0x3d
dec eax
not eax
inc ebp
xor dl, ch
ror byte [esp + ebx*2 - 0x14e7], 0x46
neg word [esp + ebx - 0xa71]
dec esi
lea ebp, [esp + ebp + 8]
dec ebp
mov ebx, dword [ebp + ebx - 0xa74]
inc esp
or esp, ebx
inc edx
movsx esi, word [esp - 0x29d0]
jp 0x16faa73

Function at 0x1730b17
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov edx, 0xfa35b72c
mov esi, ebp
lea eax, [edx*2 + 0x6c96601a]
lea ecx, [eax + 0x2060725]
pop ebx
sal ecx, cl
neg eax
jb 0x17bc10c
mov ecx, 0x9292feb7
movzx edx, cl
mov dx, word [esi + edx*4 - 0x2dc]
dec ecx
mov cx, word [esi + 2]
add dx, cx
mov ecx, 0xdc363526
movzx eax, cl
xor eax, eax
mov word [eax + esi + 2], dx
mov ecx, dword [edi + eax*2]
mov edx, eax
sar edx, 0xe1
lea edi, [edi + eax*4 + 4]
xor ecx, ebx
lea ecx, [eax + ecx + 0x5f1310a4]
add al, dh
sub eax, edx
not ecx
sbb al, 0xb8
ror ecx, 3
add ecx, 0xf983ea8b
ror edx, 0x52
rol dl, 4
xor ebx, ecx
add ebp, ecx
mov ecx, edx
add cx, word [esi + eax - 0x46]
or al, dh
adc dx, word [esi + eax*8 - 0x23c]
not eax
not cx
shr ax, 0x41
sal eax, 0x38
not dx
sar al, 0x67
or cx, dx
dec eax
and eax, eax
movzx edx, al
mov word [esi + edx - 0xfb], cx
xor ax, ax
push eax
lea esi, [esi + edx*8 - 0x7f4]
call fcn.0125ea22
mov eax, dword [esi + eax*4 - 0x6d9896f8]
and dl, byte [esp + 3]
mov cx, word [esi + 4]
sar dx, 0xe8
adc edx, edx
call fcn.01709f20
Function at 0x17332cb
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esi + ecx*4 + 4]
push ecx
lea edx, [ecx*2 - 0x71de82e1]
setne dl
mov edx, dword [esi + ecx*4 + 8]
setb byte [esp + ecx + 0xa]
call fcn.01733e52
dec eax
mov dword [esp + edx + 0x63349851], 0xec86dbac
push edx
dec ebp
lea esi, [esi + ebx - 0x86]
inc ecx
movzx ecx, word [ecx + ebx - 0x8e]
dec esp
lea eax, [ebx + ebx*4 + 0x749ab000]
dec ebp
lea ecx, [ecx + ebx - 0x8c]
inc cx
xor ecx, edx
jmp 0x175da4f
jmp 0x16eaaed
mov ecx, dword [esp + 4]
lea edx, [esp + edx + 8]
ror dword [esp + ecx*4 - 0x5e], 0x3f
and dword [esp + ecx*2 - 0x30], 0x138e2a19
shl cx, 0xaf
mov dword [ecx + edx], eax
jns 0x121d2bd
inc ecx
xor edx, edx
movzx edi, word [esp + 0x10]
dec eax
xadd dword [esp + edi - 0xfef1], eax
dec eax
ror edi, 0x3a
inc edx
sal word [esp + edi - 0x3fbff7], 0x24
pop ecx
and dword [esp + edi - 0x3fbffc], edi
rol edx, 1
inc esp
movsx eax, al
pop ebp
lea edx, [ebp + edx - 0x17370f72]
dec eax
lea ebx, [eax*2 + 0x6716613e]
inc esp
xadd dword [esp + edi*2 - 0x7f7ffe], esp
bswap edx
inc edx
sar byte [esp - 0x100ad], 1
dec ecx
sub esp, 0x10bb2820
inc edx
sar dword [esp + 0x10ba2773], 0x3c
rol edx, 2
inc edx
sal dword [esp + 0x10ba2774], 0xce
inc edx
shl word [esp + edi - 0x3fbfff], 0xa2
pop ebp
dec ecx
sal esp, 0xd2
inc ecx
push edx
dec ecx
lea esi, [eax + edi - 0x7fc832d4]
call fcn.01248ba1
inc byte [esp]
xor bl, dl
jmp 0x122246c
dec esi
lea ebx, [edx + eax*2 + 0x63b8013d]
ror bl, 0x24
inc cx
inc esp
movzx esp, byte [esp + edx + 0x63349859]

Function at 0x173491c
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor bl, 0x3f
dec esi
lea esp, [eax*4 - 0x656457f1]
dec edx
lea ebx, [esi + eax - 0x45e04c67]
dec esp
xchg ebx, esp
inc ecx
inc bl
dec eax
lea eax, [ebp*4 + 0x45002981]
inc ecx
xor bl, 0xa3
inc ecx
movzx edi, al
dec ecx
sar eax, 0xf8
call fcn.0131c448
jbe 0x126c601
dec esi
mov dword [esp - 0x27040206], ebx
dec edi
lea ecx, [ecx - 0x138200ff]
pop eax
inc ecx
xor esi, edx
rol eax, 0x88
bswap esi
inc edx
lea esi, [esi - 0x6d3df0d]
jb 0x1239a0b
dec esi
lea ebp, [eax + ebx*4 + 0x35901807]
bswap esi
dec esi
mov dword [esp - 0x27040206], ebx
ror esi, 3
call fcn.0171eced

Function at 0x17366fa
Capabilities:
Encode data using base64

Disassembly:
lea edx, [eax + edx + 0x4c0b00c0]
rol ax, 0x22
mov dword [esp + eax*2 - 0x1b366f9a], 0x58260b1b
xor ebx, edx
or ax, 0xd822
ja 0x172dbf9
mov ebp, 0x9a3d24a9
inc ecx
mov ebp, dword [ecx]
inc ecx
mov ebp, 0x80b92928
dec ecx
add ecx, 4
inc ecx
xor ebp, edx
inc ecx
movzx eax, bp
movsx ecx, al
dec edx
lea esi, [ecx + ebp*2 - 0x31710d66]
neg ebp
bswap ebp
jmp 0x17447c3
Function at 0x173e75e
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
movsx eax, cx
neg cl
not edx
rol edx, 1
jmp 0x1748da4
xor eax, 0x58944705
lea eax, [eax + ecx*2 - 0x37b09623]
sal dx, cl
rol eax, 3
and cl, 0x9b
sbb edx, 0xfd100510
xor ebx, eax
shr dl, 0x81
call fcn.017c3747
mov ecx, 0x61258305
movsx edx, cx
sal ecx, 0x8d
mov edx, dword [edi]
jns 0x1276cba
adc edi, 4
jmp 0x1336cff
inc eax
shr ecx, 0x62
lea edx, [edx + ecx*2 - 0x67630ca7]
adc cl, cl
bswap edx
neg edx
inc eax
xor al, 0x12
sal ecx, 0xd5
bswap edx
neg ax
sal al, 0xc2
rol cx, 0x41
xor ebx, edx
xadd al, ah
shr cx, 0xe
adc ebp, edx
rol ecx, 0x89
movsx edx, al
sub ecx, 0x6e93dd10
movzx eax, byte [edi + edx*4 - 0x7c]
jno 0x1235042

Function at 0x1742045
Capabilities:
Encode data using base64

Disassembly:
mov edi, dword [esp + 0x14]
mov dword [esp + 0x10], 0x54012183
push 0xc8ba983
mov ecx, 0xb31b849b
mov edx, dword [esp + 0x1c]
call fcn.0131ff93

Function at 0x1742064
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0xa408c731
xor ebx, ecx
add ebp, ecx
pop eax
pop eax
jmp fcn.0171e965
xor ecx, ebx
mov dword [esp], 0xe6a29b38
mov edx, 0xff0a0a27
sar dword [esp + 4], 0x2b
rol ecx, 1
bswap eax
neg ecx
sub eax, dword [esp]
lea ecx, [ecx + edx - 0x2a7ac122]
jl 0x171daba
Function at 0x1749885
Capabilities:
Encode data using base64

Disassembly:
not edx
sal al, 0x63
ror ecx, 0xf3
rol edx, 2
push ecx
xor ebx, edx
add ebp, edx
not ax
movzx ecx, word [eax + edi - 0x18500007]
lea edi, [edi + eax*4 - 0x6140001a]
lea eax, [eax*4 + 0x3172a0]
xor cx, bx
xadd byte [esp + eax - 0x617172bb], al
xor ax, word [esp + eax - 0x6171724e]
adc cx, 0x1a30
mov edx, eax
inc dx
xor cx, 0xfebd
not cx
add cx, 0x8419
and eax, dword [esp + eax - 0x617178d0]
xor bx, cx
xadd word [esp + eax - 0x2030088f], ax
ror edx, 0x88
dec word [esp + eax - 0x2030be08]
lea esi, [esi + eax*2 - 0x40617c16]
sub byte [esp + eax - 0x2030be0a], dh
mov word [esi + eax*2 - 0x40617c14], cx
shr dword [esp + eax - 0x2030be0a], 0x5d
dec dword [esp + eax*2 - 0x40617c14]
pop edx
jle fcn.0171e965
jae 0x122e891
inc ecx
xor eax, edx
inc ecx
movsx ebp, bl
dec eax
lea edx, [ebp*2 + 0x463dda38]
neg eax
jmp 0x1261aea
xor eax, 0xcd1f7bb5
neg eax
inc esi
or dword [esp - 0x2a5de20b], ebx
inc edx
shl byte [esp - 0xa97787f], 0x84
inc eax
inc cx
dec ebx
xor eax, 0xa0af202d
dec esi
mov dword [esp - 0xa977875], edx
jmp 0x1727b0e
xor ecx, 0x1cb1543f
call fcn.0172f411
inc edi
mov eax, dword [ecx + ebp*2 - 0x5313e422]
dec edi
lea ecx, [ebp + ecx - 0x2989f20d]
dec edx
lea edx, [ebx + ebp*4 + 0x68b7613b]
inc ecx
movsx esi, ch
inc ebp
xor eax, edx
movzx ecx, dl
inc esp
mov ebx, ebx
dec ecx
rol ebp, 0x3d
inc ecx
rol eax, 3
inc esp
xor ebx, esi
inc ecx
xor eax, 0x5ea21516
inc ecx
not eax
inc ecx
xadd ebp, ebx
inc ecx
neg eax
inc ecx
or dh, bl
inc ecx
dec eax
inc ecx
not eax
call fcn.017336bb
sub ax, 0xc298
shr dx, cl
sal eax, 0x4c
movzx ecx, ax
neg ax
mov word [esi + eax*4 - 0xf5a0000], dx
lea edx, [eax*4 + 0x570cab03]
mov eax, dword [edi + eax*4 - 0xf5a0000]
sal edx, 0x81
sub edx, 0x58984a95
shl cx, 0x6d
lea edi, [edi + ecx*4 + 4]
adc dx, dx
xor eax, ebx
dec edx
lea ecx, [ecx + ecx + 0x6b0dc2b7]
shr ecx, 0x34
dec eax
call fcn.0170f785
mov edx, dword [edi]
lea ecx, [eax + eax*2 + 0x240c6d02]
or al, al
lea edi, [edi + ecx - 0x74f1f5ee]
shl eax, cl
sar eax, 0xc2
not ax
xor edx, ebx
lea edx, [edx + eax - 0x7bf76487]
ror edx, 1
jmp 0x17a8786
jmp 0x1226f9c

Function at 0x174de9d
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
shr ecx, 0x94
sbb dword [esp + ecx*4 - 0xa04], ecx
neg dword [esp + ecx - 0x27e]
dec eax
lea edx, [ecx*8 + 0x710e2b29]
shl dx, 0xca
mov dword [esp + ecx*4 - 0xa08], ecx
bswap eax
pop edx
jp 0x1222ae3
Function at 0x17543ae
Capabilities:
Encode data using base64

Disassembly:
dec ecx
neg ecx
or eax, eax
sub eax, edx
xor ecx, 0x87378bab
sub ecx, 0xec086faa
bswap ecx
not ax
xor ebx, ecx
and dl, ah
jg 0x1799e4b
call fcn.01749174
jbe 0x121dc47
xor eax, 0xa3ff2611
and dword [ecx], esp
mov byte [ecx], bl
jo 0x132a483
adc dword [edi + 0x2c662f40], ecx
aad 0x4b
pop dword [eax + 0x2f]
sub al, 0xd5
dec ebx
clc
mov edx, 0x8f4ce5
mov ah, 0x45
push ss
xchg esi, eax
test byte [edx + 0x61], al
pop es
cdq
std
int1
xchg ecx, eax
test eax, 0xf82b86fa
pop ds
mov ebp, 0x1e68f4c8
pop ebp
nop
test byte [eax + 0x3281976d], 0x3c
sahf
sbb byte [esp + ecx + 0x1516f99], ah
xchg ecx, eax
loop 0x132a45c
xor dword [esi - 0x609f826b], edx
or al, 0xeb
push eax
cwde
jnp 0x132a4e9
invalid
xchg esp, eax
sub ebp, dword [0x5a2ca45e]
iretd
setne dl
xor ecx, ebx
lea eax, [edx + edx*8 + 0x5997411e]
dec ecx
inc ax
bswap ecx
sal eax, 0xf
neg ecx
sal dl, 0xe5
sal ax, 0x45
lea ecx, [ecx + eax*4 + 0x2b647704]
bswap ecx
not ecx
je 0x132a44a
movzx cx, byte [esi]
mov dl, byte [esi + 2]
not cl
not dl
call fcn.0123d974
movsx ecx, al
movzx eax, byte [edi + eax - 0xd2929eb]
inc ecx
call fcn.0172a402
mov edx, 0xecb1aeb1
mov ecx, dword [edi]
jmp 0x179acd0
push eax
adc ebp, ecx
jmp 0x17a7848
dec edx
setno dl
add edi, 4
dec dx
jno 0x1745dae
mov ebp, 0x74886997
dec esi
lea esi, [ebp + esi - 0x74886995]
dec eax
lea eax, [ebp + ebp*8 - 0x64c3865e]
inc ecx
sal esp, cl
call fcn.01325636
mov edx, dword [esi + eax - 0x42e2ae1f]
rol dword [esp + eax - 0x42e2ae1f], 0xff
mov eax, dword [esi + eax - 0x42e2ae1b]

Function at 0x1762da0
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
call fcn.016ef937
pop eax
jmp fcn.0171e965

Function at 0x1764084
Capabilities:
Encode data using base64

Disassembly:
push 0x4722750a
dec ecx
mov edx, dword [esi]
dec eax
lea eax, [ecx*4 + 0x3a00c0b8]
neg edi
dec ebx
lea edx, [ebx - 0x46771f0]
lea edi, [edi + ebp*4 + 0x1d9a857c]
dec esi
mov dword [esp + ebx], edx
inc edx
xor dword [esp + ebx], edi
inc ebp
movsx eax, bl
inc cx
dec ebx
dec eax
lea esi, [eax + edx + 0x3c07d89f]
inc ecx
pop edx
setp cl
sets cl
dec eax
arpl di, di
jne 0x178dc57
jmp 0x16f701a
shl cx, cl
dec esp
xor ebx, edx
dec esp
adc edi, edi
inc cx
sub eax, 0xbf0f6282
cli
dec ebp
mov eax, dword [esi + ebp + 7]
sar bx, 0x4e
sub ax, 0x64bd
dec edx
mov edi, dword [ebp + esi + 0xf]
push ecx
dec esp
lea ebp, [eax + esi*4 + 0x67327893]
inc esp
add bl, dh
dec esp
adc eax, edi
dec eax
shr dword [esp + ebp*2 - 2], cl
sal esi, 0x27
dec esi
mov dword [ebp + esi + 0xf], eax
dec ebp
lea esi, [esi + ebp + 0xf]
dec esp
mov dword [esp + ebp - 1], edi
ret

Function at 0x17665d3
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov ebp, dword [esp + edx*2 - 0x110e625a]
mov edi, dword [esp + edi - 0x35bc563d]
jno 0x176ac1d
movzx ebx, cl
call fcn.01323946
mov dword [ebp + edi - 0x35bc5649], eax
mov edx, 0x8873131
mov ebx, edx
mov esi, ebp
mov dword [esp + edi - 0x35bc5649], ebx
mov ebx, dword [esp + edi - 0x35bc5645]
jns 0x1335aa4
iretd
movsx eax, dx
xor word [esp + edx - 0x8873131], dx
mov ecx, dword [edi + edx - 0x8873131]
jno 0x12470e4
Function at 0x176846d
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x5e941d35
rol edx, 0xcf
jb 0x123a020
jg 0x172cb21
shl ax, 0x23
adc edi, 4
or eax, 0x5a9ba531
sub eax, 0xd631b4b4
push eax
xor ecx, ebx
mov edx, 0x542ba582
xor ecx, 0x7a9c552c
dec ecx
jmp 0x16ebee7
inc ecx
xor eax, edx
xchg dword [esp + edi*2 - 0x4438405e], ebp
rol ebx, 0xbf
sub byte [esp + ebp - 0x3d9b], 0xb
lea eax, [eax + edi + 0x68fc7dfe]
neg eax
ror dword [esp + ebp - 0x3da6], 0x9d
inc bp
lea eax, [eax + ebp*2 - 0x4ab6cae9]
bswap eax
inc esp
movsx eax, bp
setl dl
neg eax
inc cx
shl esp, 0xa5
sbb eax, 0xdc8e27a4
dec eax
not dword [esp + ebp - 0x3da2]
inc ecx
sal eax, 0xa1
dec esp
mov dword [esp + edi - 0x221c2028], edx
inc eax
setb bh
xor dword [esp + ebp*2 - 0x7b4c], eax
dec esp
mov edx, dword [esp + edi*2 - 0x44383ff8]
inc ecx
add ebp, 0x2a9378b
xchg bx, dx
dec eax
arpl ax, ax
dec esp
mov dword [esp + edi*2 - 0x44383ff8], eax
call fcn.01278623
inc ecx
rol bl, 1
dec esp
mov dword [esp + edi - 0x6a1e2436], ebp
inc ecx
sub bl, 0x11
dec eax
xadd edx, eax
dec eax
shl dword [esp + ebp - 0x3da92aba], 0xd4
inc ecx
setnp ch
inc ecx
rol bl, 1
inc edx
neg byte [esp - 0x170]
inc ebp
xor dl, bl
push ebp
dec ebp
lea esi, [esi + ebp - 0x3da92abc]
inc bp
mov dword [esi + edi - 0x6a1e2436], ebx
jmp 0x1778625
neg bx
inc ecx
mov eax, dword [ecx + ebx - 0x6a1edbca]
mov ecx, dword [esp + ebp - 0x3da92ab2]
dec eax
and edi, 0xb21d3831
dec ebp
lea ecx, [ecx + edi - 0x221c202c]
jne 0x17291b2
call fcn.0179375d

Function at 0x1770444
Capabilities:
Encrypt data using chaskey

Disassembly:
dec eax
lea edx, [ebp + ebx + 0x411c0bb2]
inc esp
movsx ebp, bx
dec esi
lea ecx, [ebp + ecx - 0x15adb2cc]
inc ebp
xor ah, dl
dec ebp
inc ecx
sub ah, 0x9f
inc ecx
not ch
inc ecx
neg ah
dec eax
lea esi, [edx*4 + 0x71b05424]
jmp 0x17552a2
mov dword [esi + eax - 0x7bb3ba06], ecx
movzx ecx, ax
or cx, cx
lea esi, [esi + eax - 0x7bb3ba06]
and ecx, 0xa3aebab4
ror ecx, 0x6b
jmp ebp
inc ecx
inc ah
inc ecx
rol ah, 1
call fcn.01713b29
inc cl
adc eax, esp
inc ecx
shr cl, 4
not dl
mov edx, dword [eax + edx*4 - 0x3fc]
movsx eax, cl
ror al, 0xa3
setnp cl
mov dword [ecx + esi - 0x195ea3fe], edx
sal eax, 0xca
adc eax, eax
lea esi, [ecx + esi - 0x195ea3fe]
adc eax, ebp
jmp eax
inc eax
ror byte [esp + 9], 0x61
xor ecx, 0x719d1939
not dword [esp + 7]
and dword [esp + 8], 0x9bdd22f
dec edx
push 0x8a8297a9
lea esp, [esp + 0x10]
jne 0x17c1bed
mov ebx, 0xe1292021
pop ebx
mov eax, 0x7bb3ba82
not ecx
inc eax
ror al, 0xa6
jne 0x1708c3c
sub al, 0xf7
invalid
mov ebx, 0xed83cc96
ror bl, 0x61
movzx ebx, byte [eax]
push 0xd4a18230
xor ebx, ecx
call fcn.0133c0a1
dec ecx
push esi
rol edx, 5
call fcn.017366a4
inc bp
mov eax, dword [esi]
mov ebp, 0x15ad4d33
neg bp
dec esi
lea esi, [ebp + esi - 0x15adb2cb]
inc eax
movzx ebx, ch
dec eax
lea edi, [ebp + ebp*2 + 0x1993ec2d]
inc ebp
movzx esp, byte [ecx + ebp*2 - 0x2b5b659a]
jne 0x12349bc

Function at 0x17723fb
Capabilities:
Encode data using base64

Disassembly:
shl dl, 0xa4
mov dword [esp + eax*2 - 0x11c00], edx
not ecx
inc ecx
add dword [esp + eax*2 - 0x11c00], 0x3d913701
xor ecx, 0xe97a684
neg ecx
inc ax
Function at 0x17785a4
Capabilities:
Encode data using base64

Disassembly:
popfd
lea esp, [esp + 4]
call fcn.01753e63
push edi
mov edi, 0x592cdd2b
pushfd
and edi, 0x30bee738
bswap edi
neg edi
mov dword [esp + 8], 0xb68500
mov edi, dword [esp + 4]
jb 0x1312f12
fld xword [ebx + 0x57]
xor ebp, eax
jp 0x177864d
cmp esi, ebx
push eax
shr dword ss:[ecx], cl
mov ebp, 0xe21948f1
push 0xffffffffffffff9b
ljmp 0x66ff
or al, 0xb1
add dword [eax], eax
invalid

Function at 0x177cd3b
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x70a5391f
dec edx
neg dword [esp + eax*4 - 0x4a22d26c]
dec esi
mov dword [esp + eax*2 - 0x2511691e], edx
inc eax
dec bh
inc edx
xor dword [esp + eax*4 - 0x4a22d25c], ecx
dec esi
mov edx, dword [esp + eax - 0x1288b47f]
dec eax
arpl cx, cx
inc esp
sub ebp, edx
inc ecx
bswap ebp
dec esi
mov dword [esp + ebp*2 - 0x7fde570a], eax
dec esp
add edi, ecx
dec eax
lea ecx, [edx + 0x6c177cb2]
inc dx
not dword [esp + eax*2 - 0x2511693b]
inc edx
xor dword [esp + eax*2 - 0x25116922], ecx
pop ebp
pop ebx
inc ecx
pop ebx
pop eax
inc ecx
pop eax
jge fcn.012669aa

Function at 0x177ddbc
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x821c1c39
call fcn.0123193a
call fcn.01328633
movzx ecx, byte [edi + ecx*2 - 0x43fc]
sub eax, 0x7a0c048a
ja 0x177ed14
adc edi, 5
mov dword [esp], 0x4c2e9e87
add eax, 0xa622de89
jnp 0x17ba364
xor cl, bl
sub cl, 4
or al, byte [esp + eax - 0x2c14fbfc]
jp 0x16ef0b8
inc ecx
xor esi, edx
dec esp
lea eax, [edx*4 + 0x268a4e8e]
sub esi, 0xb59d9aa1
jmp 0x1317252

Function at 0x178b1c9
Capabilities:
Encode data using base64

Disassembly:
pop edx
pop eax
pop edx
jp fcn.0171e965
inc ecx
mov eax, 0x4d0943b1
dec edx
lea ebx, [eax*2 - 0x48f29541]
inc esp
mov ebx, ebx
inc ecx
mov ebx, dword [ecx + ebx - 0x511ff221]
dec ebp
add eax, ebx
dec ebx
lea edx, [eax + eax*8 - 0x38525261]
inc ebp
movsx ebp, bx
dec edi
lea ecx, [ecx + ebx - 0x511ff21d]
inc ecx

Function at 0x178fd82
Capabilities:
Encode data using base64

Disassembly:
neg eax
mov dword [esp + ecx - 0x3019dff5], ecx
pop edx
bswap eax
sub dword [esp + ecx - 0x3019dfed], 0x842acfba
adc cx, cx
mov edx, 0x2888f9b6
xor ebx, eax
rol ecx, cl
sal ecx, cl
add ebp, eax
movzx eax, byte [edi + ecx - 0x7ffffffb]
lea edi, [edi + edx*2 - 0x5111f366]
ror dx, 8
xor al, bl
sar edx, 0x64
not dword [esp + edx - 0x2888b5f]
sub al, 4
xor al, 0xba
ror word [esp + edx*2 - 0x51116d6], 0x28
xor edx, 0xb0802ea6
dec al
or dx, dx
ror dword [esp + ecx - 0x7ffffff2], 0x69
neg word [esp + ecx - 0x7ffffff0]
not al
and edx, 0x7d20f2aa
adc al, 0x29
shl ecx, 0xd6
xor bl, al
lea eax, [esp + eax + 0x14]
add ecx, dword [eax + ecx*2]
mov eax, 0xd19d5595
mov dword [esi + edx*2 - 0x60014118], ecx
neg ax
neg byte [esp + edx - 0x3000a081]
lea esi, [esi + edx*2 - 0x60014118]
pop eax
pop edx
pop edx
pop edx
pop edx
jbe fcn.0171e965
or dword [0x59fe68c9], 0xbeaadd1b
ljmp 0xdaa6