joyce8/EMBER2024-capa huggingface dataset:
Function at 0x113c0
Capabilities:
Create device object
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0x10], 0
push 0x1108c
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00011500
movzx edx, al
test edx, edx
jne 0x113fe
mov eax, 0xaff41400
jmp 0x114ef
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 2
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
mov ax, word [edx]
mov word [ebp - 6], ax
add dword [ebp - 4], 2
cmp word [ebp - 6], 0
jne 0x11410
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x18]
sar ecx, 1
mov dword [ebp - 0x14], ecx
push 1
mov edx, dword [ebp - 0x14]
shl edx, 1
push edx
lea eax, [ebp - 0xa0]
push eax
push 0x11094
push 0x110a8
call fcn.00011610
push 0x11120
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x8d000
push 0
push 0
push 0x22
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x11486
mov eax, dword [ebp - 0xc]
jmp 0x114ef
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [0x8d004], eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x38], 0x11340
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x38], 0x11340
mov eax, 4
imul ecx, eax, 0x12
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x38], 0x11340
mov eax, 4
imul ecx, eax, 0xe
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x38], 0x11370
call fcn.000119c0
mov dword [ebp - 0xc], eax
mov eax, 0xc0000001
mov esp, ebp
pop ebp
ret 8

Function at 0x11610
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 8], 0xc0000001
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0x240
lea edx, [ebp - 0x14]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0xf003f
lea edx, [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x1168d
mov eax, dword [ebp - 8]
jmp 0x116d4
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x116d1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x8e6b06
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
ror eax, 3
mov dword [esp + edx*2], 0x750e692a
lea eax, [eax + edx*8 - 0xd177835]
not dl
and dx, cx
not dword [esp + edx - 0xf9]
bswap eax
ror dx, 0xa
setne byte [esp + edx - 0x3e40]
sal cl, 0xa5
xor ebx, eax
add ebp, eax
mov cx, word [edi + edx*2 - 0x7c7e]
sub dword [esp + edx - 0x3e40], edx
lea edi, [edi + edx - 0x3e3c]
xchg byte [esp + edx*2 - 0x7c7f], dh
movzx edx, byte [esi + edx*2 - 0xae85]
push 0x1f008689
sub dword [esp + 2], 0xc09d9a2b
call fcn.008e8e93
inc ecx
mov ebx, 0x4e953a87
dec ecx
lea edi, [ebx + edi - 0x4e953a8b]
inc esi
mov ebx, dword [edi + ebx - 0x4e953a87]
inc ebp
xor ebx, edx
inc ecx
mov ebp, 0xacac1da6
inc ebp
movzx esi, bp
dec ecx
lea esi, [esi + 0x612727a0]
inc ecx
neg ebx
inc cx
dec ebp
inc ecx
rol ebx, 1
inc ecx
xor ebx, 0x69a5d235
inc ecx
neg ebx
inc ecx
push edx
inc ecx
mov edx, 0x6001c4a7
dec ecx
btc edx, esi
inc esi
xor dword [esp + esi - 0x1da6], ebx
dec esp
bts esi, esi
inc eax
movzx edx, dh
inc ecx
pop edx
dec ecx
shl esi, 0xb
dec ebp
arpl bx, bx
inc ebp
movsx eax, si
call fcn.008f690b
mov edx, 0xc31ef19c
movzx dx, byte [edi]
mov al, byte [edi + 2]
add edi, 2
mov ecx, 0xbeb07b22
bts ecx, 0xb2
adc dl, al
call fcn.00960e68
Function at 0x900d1e
Capabilities:
Encode data using base64

Disassembly:
rol ecx, 3
ror edx, 3
movsx eax, dx
sar byte [esp + edx - 0x200005cc], 0xe4
lea ecx, [ecx + eax*2 - 0x15957c3a]
pop edx
imul edx
rol ecx, 1
cwde
dec dl
shr ax, 0x42
xor ebx, ecx
btr edx, 0x14
adc ebp, ecx
movzx ecx, word [esi + edx - 0x105]
neg dl
xor cx, bx
bts edx, eax
div eax
ror cx, 1
not cx
inc cx
btr eax, eax
xor cx, 0x3c2f
btc ax, dx
xor bx, cx
lea eax, [eax*2 - 0x6d658c7]
mov word [edi + edx - 0x79731ed5], cx
xadd eax, edx
movzx ecx, word [esi + eax - 0x72dcc638]
xadd edx, eax
setg al
sub al, dl
lea esi, [esi + edx - 0x6c466d95]
shl dx, 6
xadd dx, ax
xor cx, bx
shl edx, 0x69
sar eax, 0xba
inc cx
cwde
push eax
call fcn.0092d55d
inc ecx
mov ebp, 0x5593b794
inc ecx
movzx ecx, ch
dec ebp
mov esi, dword [edi + ecx - 0x94]
call fcn.009d4fd0
mov dword [esp + edx*2 - 0x5cf2], edx
dec ecx
jmp 0x8fbe63

Function at 0x904470
Capabilities:
Authenticate hmac

Disassembly:
adc dx, 0x5e2e
shl byte [esp + 3], 0x66
not ax
xor dx, 0x3232
sar byte [esp + 1], 0x81
sub cl, 3
call fcn.00a2728b
inc ecx
mov ebx, 0x8a37ba28
inc ebp
xor ebx, ebx
mov esi, 0x41beab9d
dec edx
lea edi, [edi + ebx - 4]
dec eax
lea eax, [esi*2 - 0x5c74f96e]
mov edx, eax
inc esi
mov ecx, dword [edi + ebx]
inc ebp
xor ecx, edx
bts esi, 0x1a
dec esp
lea esp, [edx*8 - 0x10f28456]
inc edi
lea ecx, [ecx + ebx*4 - 0x48bc3895]
dec eax
not eax
inc ecx
ror ecx, 1
inc esp
movzx ebp, dl
inc ebp
lea ecx, [ecx + esi + 0x785b53a2]
call fcn.00936859
xor al, 0x91
mov ebx, 0xe084b1da
push ebp
mov bh, 0xda
rol byte [edi - 0x26], cl
sbb eax, 0x47d2da87
loop 0x903880
aad 0xaf
inc byte [ecx + edx + 0x69e47ebb]
jl 0x903820
pop ss
call 0xe4efddd
ret 0x98bd
sub ecx, dword [ebp - 0x30e13c73]
retf 0xd807
ror edx, 0xba
shl byte [esp + edx*8 - 0x26fff9], 0xe1
lea ecx, [ecx + edx*8 - 0x15bc709c]
movsx eax, word [esp + edx*2 - 0x9bff8]
rol ecx, 1
inc dx
xor word [esp + edx - 0x4dffc], dx
mul al
xor ebx, ecx
pop eax
and word [esp + edx - 0x4dffb], dx
lea eax, [edx + edx - 0x27725841]
adc ebp, ecx
jmp 0xa0cd28
movsx ecx, word [esp + edx - 0x4e001]
movzx edx, word [esi + edx*2 - 0x9c009]
mov dword [esp + 1], ecx
xor ax, 0xc884
sbb esi, 7
bt eax, ecx
xor dx, bx
or al, cl
inc ecx
inc dx
bt ecx, eax
push ecx
neg dx
sar al, 0x61
jb 0x90379c

Function at 0x904f13
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + eax*4 - 0x1344c], eax
dec byte [esp + eax*2 - 0x9a21]
inc esp
movzx ebp, byte [edi + eax - 0x4d14]
push eax
inc ebp
xor ch, dl
movsx ecx, al
inc esp
movzx esi, ax
inc ecx
and dh, 0xa3
inc ecx
ror ch, 1
jmp 0x91c37a
inc dword [esp + eax*2 - 0x9a1d]
inc ecx
dec ch
inc ecx
rol ch, 1
movzx edx, word [esp + eax - 0x4d10]
call fcn.0092225b
sysenter
push ecx
xor al, 0x51
call fcn.008f7b29
lcall 0x5200, 0x8be20b31
cdq
add esp, edx
call 0x3c673a6e
loop 0x91c395
ret
Function at 0x91a5f6
Capabilities:
Encode data using xor

Disassembly:
mov ebx, edi
call fcn.009ce998
dec eax
sub edi, 4
inc ecx
mov ebx, 0xff09faac
inc ebp
movsx ecx, bx
inc esp
mov ebp, dword [edi]
inc ecx
mov eax, ecx
inc ebp
xor ebp, edx
neg ax
inc ecx
dec ebp
shl eax, 0x4a
inc ecx
bswap ebp
dec edx
lea edx, [eax + ecx - 0x3651ee43]
inc ecx
neg ebp
movsx esi, dx
movzx ecx, ax
inc ecx
rol ebp, 1
dec ecx
rol ebx, 0x39
sal dl, 0xe1
inc ecx
bswap ebp
neg ax
inc esp
movsx esi, dx
shr edx, 0xd7
inc ecx
push edx
inc esp
xor dword [esp + edx - 0x18b], ebp
inc ecx
xor ebx, 0xe25e69f
inc ecx
pop edx
or esi, 0x9c83033a
mov ebx, 0xd0b016b7
dec esp
lea eax, [esi*4 + 0x7ab42c3c]
dec ebp
arpl bp, bp
sets bl
dec cx
dec ecx
div esi
dec ecx
add ebp, ebp
inc ecx
mov ebp, 0x4ca6f40f
inc ecx
sal ebx, 0x49
dec ecx
inc ecx
dec eax
lea edi, [edx + edi - 0x3ccb]
inc esp
xadd al, cl
inc ecx
imul ebx, eax
movzx esi, byte [edi + edx*4 - 0xf328]
dec esp
and esi, ebx
inc ecx
xor dh, dl
dec esi
lea esp, [ebx + eax + 0x298d402e]
inc eax
rol dh, 1
dec eax
cwde
dec esp
xor ebx, ecx
inc eax
neg dh
bts ax, 0xa8
inc ecx
div esp
dec ebp
or ecx, ebp
inc eax
ror dh, 1
dec eax
lea eax, [edx + edx + 0xc36793f]
inc eax
xor dh, cl
inc esp
xadd ebx, ebp
dec ecx
xchg esi, ebx
inc ecx
xchg cl, al
inc eax
ror dh, 1
inc esp
xor dl, dh
inc cx
neg esi
jle 0x9b687f
xor dword [esp], eax
dec ecx
xor edx, 0x1780e086
jae 0x8eadea
inc ecx
not ah
dec eax
add esi, esp
mov bx, word [eax + esi - 0x3680386f]
inc cx
neg esi
inc ecx
mov esi, esp
dec ebp
lea edi, [edi + edx*2 - 0x2a49bf42]
dec eax
cdq
inc cx
mov dword [edi + eax*2 - 0x6d0070de], ebx
jns fcn.009c2b9d
mov edx, dword [edi]

Function at 0x9221e1
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x9b10b231
call 0x991a38
Function at 0x935858
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + esi - 0x56086fd5], ebp
ret
mov edx, esi
xor ecx, 0x75b7ee0b
dec edx
div dword [esp + esi - 0x56086fcd]
inc ebp
movsx ebx, al
neg ecx
dec eax
mov dword [esp + esi*2 - 0xdfaa], eax
ror ecx, 3
inc esp
add al, dl
inc ebp
movzx ebp, dh
inc esp
mov ecx, eax
inc edx
lea ecx, [ecx + esi*2 + 0x33aa4075]
sbb dword [esp + esi*4 - 0x1bf4b], 0x6e93a1a8
dec esp
mov dword [esp + esi - 0x6fcd], edx
bt ax, 0x95
inc sp
bt eax, esi
inc edx
xor dword [esp + esi - 0x56086fcd], ecx
dec eax
sar esi, 0xf9
dec esp
mov edx, dword [esp + esi + 8]
dec eax
cdq
dec ecx
not eax
dec eax
cdq
dec eax
arpl cx, cx
dec eax
adc ebp, ecx
inc esp
movzx esp, al
inc ecx
movzx ebx, al
inc ebx
add edx, dword [esi + edi - 0x56086fd5]
pop esi
dec esp
lea eax, [esi*4 - 0x735561d9]
inc ecx
add ch, 0x9d
inc ebx
mov eax, dword [edi + ebx*4 - 0x1a0]
inc ecx
and eax, 0x5283b190
dec edx
mov dword [esp + eax - 0x52002000], 0xef0c6da3
inc ecx
add ebp, 0x7fb37db5
inc edi
mov ecx, dword [esi + edi - 0x56086fcd]
dec ebp
btc ebp, esp
inc ecx
shl al, 0x23
dec eax
shr esi, 0x3f
dec ebp
lea edi, [edi + esi*4 + 4]
dec esp
and eax, dword [esp + esi]
inc esp
add dword [esp + esi*4 + 4], esi
movsx ecx, byte [esp + esi*2 + 3]
inc ecx
div ecx
inc eax
add byte [esp + esi*2 + 3], dh
xchg word [esp + esi + 6], bx
inc cx
imul esi, ebp
inc ebx
mov dword [esi + edi - 0x56086fd5], edx
inc edx
adc byte [esp + esi - 0x56086fd5], dh
inc ecx
mov dword [edi + esi*2 + 4], eax
inc edx
adc dword [esp + esi - 0x56086fd1], esi
jae 0x91fd74
mov edx, 0x5926c889
fld dword [edi + edx - 0x5926c889]
bt dx, 0xac
lea esi, [esi + edx - 0x5926c88d]
mov edx, dword [esi + edx - 0x5926c889]
mov eax, 0xf3934691
xor edx, ebx
rol eax, 0x3f
mov ecx, eax
inc ecx
not edx
xadd al, cl
or ax, 0xc537
rol edx, 1
not edx
not al
rol edx, 3
not edx
not cx
not al
shr eax, 0x94
lea edx, [ecx + edx - 0x3a8a97a9]
inc al
jb 0x9fdfa5
dec esp
adc eax, esi
dec eax
sar dword [esp + edx + 5], 0x6f
shl byte [esp + edx + 0x12], 0xe1
dec eax
sbb ebx, 0xfd1f6f24
dec ebp
mov dword [edi + edx*2 + 8], eax
push edx
mov esi, dword [esp + edx*2 + 0x1b]
xadd byte [esp + edx + 0xc], dl
dec eax
mov ebx, dword [edi + edx*2 - 0xc]
inc sp
and ebx, edx
inc ecx
sbb bl, 0x14
inc cx
sal ebx, 5
dec eax
lea edi, [edi + edx - 0xc]
call fcn.009385bf
inc esi
xor dword [esp + ebx*4 - 0x23260], eax
inc ebp
movzx edx, dh
dec ecx
inc esi
and al, dh
inc ecx
pop edx
dec esp
imul esp, esi
jno 0x951dca
cwd
dec ebp
arpl ax, ax
inc ecx
imul bl
dec ecx
add ebp, eax
idiv cx
jmp ebp
xor ebx, edx
inc ecx
call fcn.009c7274
Function at 0x937c51
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x55b2e11b
inc esp
movzx esi, ax
dec edi
lea esp, [esi + esi*8 + 0x6135be06]
inc esp
mov ebx, dword [edi + eax - 0x55b2e11b]
inc ebp
xor ebx, edx
inc ebp
lea ebx, [ebx + eax + 0x45831499]
dec eax
cdq
inc ebp
movzx eax, dh
inc ecx
neg ebx
jmp 0x9e109d
shr eax, 0xd6
jp 0x9ca05e
adc cl, 0xbe
mov dword [esp + eax*4 - 0x5fc], eax
not dx
neg al
xor cl, dl
ror cl, 1
sub dx, 0xdb28
setns al
xor cl, 0xb5
sub dl, 0xb4
setbe al
dec cl
imul eax
sbb edx, dword [esp + eax - 0x10000]
xor bl, cl
call fcn.009525fa
inc ecx
mov esp, 0xce066ca7
inc ebp
movzx ecx, ah
inc ebp
movsx esi, cx
dec edx
lea edi, [edi + ecx*4 - 0x2a0]
inc ecx
bswap ecx
dec edx
lea ecx, [0xe08eb0b6]
dec ebp
xchg esp, esi
inc ebp
mov ecx, dword [esp + edi - 0xa7]
inc ecx
mov ebp, 0xd9241e0d
inc ecx
sub ecx, esi
inc ebp
xor ecx, edx
inc ecx
bswap ecx
inc ecx
dec ecx
inc ebp
movsx ebx, ch
dec eax
btc ecx, ecx
inc ecx
not ecx
inc ecx
sal ah, 1
inc ecx
ror ecx, 2
inc bp
xadd ebx, ebp
and ecx, 0xf2a6aa94
inc ecx
movsx edx, bl
inc ecx
not ecx
inc ecx
movzx esi, ah
inc bp
btc ebp, esp
dec ebp
btr ebx, ebp
inc edi
lea ecx, [ecx + 0x23a494b3]
inc eax
movzx ebx, dh
inc ecx
not dh
inc ecx
push edx
dec esp
lea eax, [edx + edx*4 + 0x2a063d1c]
inc esi
xor dword [esp - 0x4e], ecx
dec ebp
sub esi, esi
dec ecx
rol ebp, 0x49
inc ecx
sal esp, 0x99
inc ecx
pop edx
inc ecx
sal dh, 0xe1
inc esp
btc ecx, esp
jb 0x8f486b
dec ebp
arpl cx, cx
dec ecx
adc ebp, ecx
shl edx, 0x3b
inc cx
sal esp, 0x41
dec ecx
sar ebp, 0x61
inc di
movzx eax, byte [edi + esi*2]
inc ebp
sbb ebp, ebp
inc bp
bt ebx, ebp
inc ebx
mov cl, byte [esi + edi + 2]
call fcn.009e4865
inc ecx
mov ebx, 0x41a2bb2
inc ecx
push edx
inc esp
movsx edx, dx
jmp 0x95302d
jmp 0x99b46d
inc ecx
xor ebx, 0x682e7028
dec edx
lea ecx, [edx + esi - 0x64c17873]
call fcn.009f7079
cld
aad 0x99
enter 0xffffffffffff9084, 0xffffffffffffffea
dec esp
sahf
mov dword [eax - 0x392765a1], esp
invalid

Function at 0x94556c
Capabilities:
Encode data using base64

Disassembly:
sar cx, 0x46
or edx, dword [edi + ecx*2]
ror cx, 0x4c
lea edi, [edi + ecx + 4]
ror ecx, 0xd6
shr ax, 0x4b
or cl, byte [ecx + esi - 5]
ror ax, 0xe1
adc esi, 0xfffffffb
xor cl, bl
rol cl, 1
add al, 0xaa
dec eax
inc cl
neg cl
push eax
and dword [esp], eax
setge al
sbb cl, 0x3f
btr eax, eax
not cl
not byte [esp + 2]
btr ax, ax
bswap eax
xor cl, 0xba
xor bl, cl
call fcn.00e95647
dec eax
mov dword [esp + esi*2 - 0x5457041c], edx
inc ecx
rol ah, 1
add byte [esp + esi - 0x2a2b820b], dh
inc ebp
adc ah, al
pop eax
call fcn.009dc7c2
mov edx, 0x72b5912d
lea ecx, [edx + edx*8 + 0x79b75c89]
mov edx, dword [esi + edx - 0x72b59131]
mov eax, ecx
xor edx, ebx
xor ax, ax
lea edx, [ecx + edx - 0x5b8bdd11]
bswap edx
xor edx, 0x2b9fabbc
xor ecx, ecx
ror edx, 2
xor ebx, edx
cbw
shl ecx, 0xbe
adc ebp, edx
mov edx, ecx
sar eax, 0x50
or ax, cx
fild qword [edi + ecx*2]
jae 0x8e0b5c
Function at 0x9478e4
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + ebx - 0x5ea5], edx
inc cx
shr esi, 0x8e
inc esp
mov ecx, ebx
inc edx
xor dword [esp + ebx - 0x5ea5], ecx
inc cx
btc ebx, ebx
dec ecx
sar ecx, 0x53
dec esi
mov dword [esp + eax - 0x69a85230], ebx
dec esi
mov edx, dword [esp + eax - 0x69a85220]
inc edx
sar byte [esp + eax - 0x69a85229], 0x62
inc edx
xor byte [esp + ebx - 0x5ab4], dh
dec eax
arpl cx, cx
dec eax
sal esi, 0x72
dec eax
div byte [edx + 0x48]
add ebp, ecx
dec ebp
mov ebp, edi
dec edx
ror dword [esp + ebx - 0x5ab4], 0x48
dec ecx
rol ecx, 0xad
inc ecx
push eax
dec edi
lea edi, [ebx + edi - 0x5ab7]
inc cx
sar ebx, 0xc8
dec edx
lea edx, [ebx*4 + 0x1e086009]
inc di
mov dword [eax + edi - 0x69a85230], ebp
inc ecx
push ecx
bswap ebx
inc ecx
pop ebx
inc ecx
pop eax
inc ecx
pop ebp
inc ecx
pop ebx
inc ecx
pop eax
jns fcn.009c2b9d
mov edx, 0x1f6d2117
clc
jle 0x94792b
push ebp
insd dword es:[edi], dx
jl 0x9479bb
mov cl, 0x4d
dec ebp
insd dword es:[edi], dx
jl 0x9479c1
sub byte [ebp + 0x3b7c6d49], ch
sub byte [ebp + 0x3b7c6d6d], al
sbb al, 0x84
bound eax, qword [ecx]
and byte [edi - 5], 0x80
jbe 0x947943
and al, 0xe3
xchg edi, eax
and edi, edi
add al, 0x13
cli
shl byte [esi + 0x38], 0xe8
stc
cmp dword [ecx], edi
push 0x2d76717b
xor eax, ebp
out dx, al
mov dh, 0x42
sub eax, 0xd65fe831
call 0x2dd730a4
xor eax, ebp
pop edi
salc
sub eax, 0xe27be831
sub eax, 0xe27be831
jne 0x947982
rcr byte [0x4f67f01d], 0x5e
sbb eax, 0x4f67f01d
pop esi
sbb byte [edi + 0x5e7f871c], cl
jnp 0x947a1c
sbb byte [ebp + 0x4c7b5e73], dl
push ss
and dword [ebx + 0x5e], 0xaf024c7b
inc edi
pop esi
jnp 0x947a2e
scasb al, byte es:[edi]
push ecx
push es
cmc
jno 0x9479b1
xchg dword [ecx], eax
adc dword [edi], 0xfbe6e0e4
xor al, 0x85
dec edx
jo 0x947a5b
cmp al, ch
dec ecx
cmp bh, byte [ecx]
push 0x2ed25acb
xor eax, ebp
dec edx
fstpnce st(2), st(0)
xor eax, ebp
mov edi, 0x312ee21e
call 0xc439c911
sbb eax, 0x85bf221d
and cl, bl
xchg ebp, eax
int3
mov eax, dword [0xc656a822]
push edi
mov ch, 0x22
test al, 0x56
sub al, 0x6c
out dx, al
retf 0xb404
popal
sub al, 0x6c
outsb dx, byte [esi]
enter 0x4958, 0xffffffffffffffc0
and ecx, edx
push esi
sbb edx, dword [ebx]
cmc
fstp qword [edx + 0x3a]
cmp eax, 0xb9612dd7
fiadd word [ecx]
les esp, [edi]
mov al, byte [0x9ea689a4]
invalid
retf 0x59d7
sub byte ss:[ecx + 1], ch
xchg byte [edi - 0x2faf0d40], al
sahf
or al, 0xd
fbstp tbyte ss:[edx - 0x2c]
sbb edi, dword [edx - 0x3a]
cmp ebx, dword [0x1fb4360e]
das
and dword [edx], eax
mov bh, 0x83
lahf
xor dword [edx], 0x17
add eax, 0x2c06f698
loopne 0x947a0d
out dx, al
fadd dword [esi + 0xb]
mul edx
imul ecx, dword [edi + 0x230b3579], 0x6fc9dc59
pop ds
cmp dh, byte [esi]
mov ebx, 0x1a37dd3c
mov ch, 0x3a
push ecx
stc
jae 0x947ae8
push 0x24
sti
jecxz 0x947a57
mov dh, 0xa4
push ebp
add dword [edx], 0xf0416466
and al, 0x39
dec ebx
push ecx
ljmp 0xc96a
sbb cl, byte [ebp + 0x773f3ab5]
int 0x72
shl byte [esi + 0x4c], cl
sub byte [ebx - 0x4bf44726], bh
pop ebp
dec eax
invalid
Function at 0x95600f
Capabilities:
Encode data using base64

Disassembly:
dec esi
lea eax, [esi + esi + 0x2d9f6dbf]
dec esi
mov dword [esp + esi - 0x56086fd5], eax
inc ecx
mov ecx, dword [esi + edi - 0x56086fd5]
dec ecx
lea eax, [esi + esi*2 - 0x7ddaeec3]
sar word [esp + esi - 0x6fd5], 0x4b
inc ecx
xor ecx, edx
inc esp
or al, byte [esp + esi - 0x6fd0]
call fcn.00935858
call fcn.0092f551
Function at 0x9603c2
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
dec eax
mov eax, dword [esp + eax + 0x20]
pop ebx
dec esp
mov esi, dword [esp + 0x20]
dec eax
mov edi, dword [esp + 0x28]
mov ebx, 0x6cb004ba
dec esp
mov ebx, dword [esp + ebx - 0x6cb0048a]
dec esp
lea ecx, [ebx*8 - 0x4d7c83cc]
dec esp
mov esp, dword [esp + ebx - 0x6cb00482]
inc ecx
pop edx
jmp 0x8e69d6

Function at 0x96ee40
Capabilities:
Encode data using base64

Disassembly:
mov eax, ecx
mov dword [edi], edx
shr cl, 1
movzx edx, byte [esi - 1]
ror ecx, 6
adc al, ah
sub cx, 0x213b
xor dl, bl
push eax
ror dl, 1
ror al, 0x42
mov dword [esp + ecx - 0x6f16c972], 0x18248c84
adc dl, 0xa1
dec word [esp + ecx - 0x6f16c970]
shr ecx, 0xf2
not dl
or al, al
neg dl
sub word [esp + ecx - 0x1bbe], ax
xor bl, dl
pop eax
lea eax, [eax + ecx*4 - 0x2a6781d4]
mov word [edi + ecx*2 - 0x378c], dx
or cl, al
jp 0x9edd56
jmp 0x9d5b8a
lea edi, [edi + ecx*8 - 0xdf3a]
pop ecx
dec byte [esp + 2]
xor eax, dword [esp]
mov edx, dword [esi + eax - 0x5eea35b0]
lea esi, [esi + eax - 0x5eea35b0]
shl word [esp + eax - 0x5eea35ab], 0x81
sbb byte [esp + eax - 0x5eea35a8], 8
xor edx, ebx
pop eax
not eax
push ecx
inc edx
cbw
inc eax
not edx
setne byte [esp]
neg edx
add edx, 0x6a34d701
ror eax, 0x61
not edx
jno 0x9fbcc6
sar byte [esp + 2], 0x41
ror edx, 2
xadd byte [esp + 2], cl
xor ebx, edx
rol eax, 0x93
rol cl, 0xa1
adc ebp, edx
sal dword [esp + eax + 0x46f2e5], 0xd5
lea edx, [ecx + eax*4 + 0xf056d39]
mul eax
pop eax
jo fcn.009d640f

Function at 0x98853a
Capabilities:
Encode data using xor

Disassembly:
neg edx
not edx
neg edx
inc cl
or al, 0xa
cmovl eax, ecx
ror edx, 2
xor edx, 0xce2d64a9
dec edx
xor ebx, edx
add ebp, edx
movsx edx, word [esp + eax - 0x24340e0b]
movzx eax, byte [esi + ecx - 0x4e12b0eb]
lea esi, [esi + ecx - 0x4e12b0eb]
btr ecx, edx
mov dword [esp + ecx - 0x4e12b0c6], ecx
xor al, bl
add al, 0x2f
and edx, ecx
bswap ecx
rol al, 1
push ecx
sub al, 0xb9
xor al, 0x22
sar cl, 0xe4
xor bl, al
lea eax, [esp + eax + 0x10]
btr dx, cx
mov dx, word [edx + eax - 0x4e12b0c4]
mov ax, word [edi]
push ecx
call fcn.008dea72

Function at 0x999fcc
Capabilities:
Encode data using base64

Disassembly:
inc ebp
movzx ebx, ah
dec edx
lea ebx, [ebx + 0x6bef3fbd]
dec eax
not ebx
dec ecx
lea ebx, [esp + ebx - 0x65577e9a]
inc ecx
movzx ecx, bx
dec eax
ror ebx, 4
call fcn.0096cc1a
Function at 0x99f1dc
Capabilities:
Encode data using base64

Disassembly:
push ecx
cwde
mov cx, word [edx + ecx*4 - 0x39c]
pop eax
cdq
mov word [edi + eax*8 - 0x73c], cx
lea edi, [edi + eax - 0xeb]
shl ax, 0xe6
movsx ecx, word [esp + eax - 0x39b4]
pop ecx
pop ecx
pop edx
pop eax
ja fcn.009d640f
xor ecx, ebx
add al, dl
bswap ecx
inc ecx
bt eax, 0x3b
ror ecx, 1
not edx
sub edx, edx
lea ecx, [ecx + edx + 0xb98019d]
btr dx, ax
idiv eax
xor ebx, ecx
inc eax
sal eax, 0x2f
adc ebp, ecx
lea ecx, [edx + 0x498979b9]
shl eax, cl
jp fcn.009d640f
lodsd eax, dword [esi]
jb 0x944476
inc esp
invalid
fadd st(5), st(0)
xor dword [eax + 0x40], 0xffffffc0
ret
test byte [eax - 0x13], al
jo 0x944474
lodsb al, byte [esi]
int1
cmpsd dword [esi], dword es:[edi]
jmp 0xf42bd99a
mov bh, 0x81
mov ebx, 0x75a299d5
hlt
cmp dword [ebx + 0x75a299d5], 0x3ce7e1f4
fmul qword [esi + 0x6f]
push ebp
into
aam 0x3d
mov edx, 0x5acfbf4a
jecxz 0x94440f
pop ss
lcall 0xc7ec, 0xd1e892e0
cld
xchg edx, eax
push ss
mov dl, byte [ecx]
or eax, 0xc8f9c6b9
jne 0x94444d
fxch st(7)
or eax, 0x287b7ef6
int 0x36
in al, 0xce
loopne 0x9444e9
invalid
push ecx
std
dec ebp
mov dword [0xa1c5ff4], eax
sti
add cl, byte [edx]
push edx
mov dword [0x9affd2e1], eax
jmp 0x944507
sbb edx, dword [eax]
xor byte [ebx + ebx + 0x1a349d08], 0x53
shl esp, 1
xor dword [edi + ecx - 0x29d05c4b], edx
sbb cx, ax
sub ch, bl
pop esp
pop edx
sub al, 0x2a
hlt
xchg byte [esp + edx - 0xcbc6559], dl
xor bl, cl
mul al
cbw
lea ecx, [esp + ecx + 8]
mov al, byte [edx + ecx - 0xcbc6543]
seto byte [esp + edx - 0xcbc653e]
movzx ecx, byte [esp + edx - 0xcbc653f]
mov word [edx + edi - 0xcbc6545], ax
mov dword [esp + edx - 0xcbc6543], 0x43027604
rol dx, cl
lea eax, [edx + edx*4 + 0x203eedad]
mov edx, dword [esi + edx*2 - 0x19792a1f]
xor edx, ebx
not al
xor edx, 0xea50f19
btr ax, ax
and eax, 0x339b7a33
neg edx
sub eax, ecx
not edx
rol edx, cl
and byte [esp + ecx*2 - 0xc3], ah
not edx
shl eax, cl
sbb byte [esp + ecx*8 - 0x30c], al
inc edx
shl al, cl
push ecx
xadd dword [esp + ecx - 0x5d], eax
rol edx, cl
shr ecx, cl
xor ebx, edx
inc dword [esp + ecx - 0x14]
shl eax, cl
adc ebp, edx
or eax, ecx
shl al, 5
not cl
movzx edx, byte [esi + ecx*4 - 0x3a2]
lea esi, [esi + ecx - 0xed]
xor dl, bl
xchg byte [esp + ecx - 0xdc], ah
ror dl, 1
or al, byte [esp + ecx*2 - 0x1c4]
dec dword [esp + ecx - 0xe4]
add eax, 0xebf1aa0
adc dl, 0xb8
dec al
neg dl
push ecx
dec dl
and dword [esp + ecx - 0xde], ecx
adc word [esp + ecx*4 - 0x39b], cx
dec byte [esp + ecx - 0xd8]
not dl
sbb dl, 0x30
bts ecx, ecx
lea eax, [eax*2 + 0x58202b83]
setae al
ror dl, 1
ror ax, cl
xor bl, dl
and dword [esp + ecx - 0xdb], 0x3a18d5aa
ror word [esp + ecx - 0xd9], 9
je 0x9443c3
lea edx, [esp + edx + 0x10]
jae 0x90b4e7
movzx ecx, dl
inc ecx
neg esp
dec ecx
imul ebp
inc ecx
ror esp, 1
inc ecx
inc esp
inc ecx
bswap esp
inc ecx
push edx
inc cx
sal esi, 0x67
inc esp
xor dword [esp + edx], esp
inc ecx
pop edx
dec edx
lea ebx, [ecx*4 - 0x6a7922e4]
inc esp
xor ch, dl
add esi, ecx
dec ebp
arpl sp, sp
inc ecx
setne cl
dec ecx
mul ebx
seto cl
dec ecx
add ebp, esp
inc ecx
push ebx
inc dx
sal dword [esp + ebp - 0x42], 0x67
dec edx
mov dword [esp + ebp - 0x44], ebp
ret