joyce8/EMBER2024-capa huggingface dataset:
Function at 0x520cc0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0046ea8c
mov eax, dword [0x588040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x58a500]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x520eab
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x520df6
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x520df6
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x520dd2
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x520d49
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x520e64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x520ecb
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x520ea6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x520ecb
jmp 0x520d22
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f98c
mov esp, ebp
pop ebp
ret
Function at 0x121ba98
Capabilities:
Encode data using base64

Disassembly:
mov ebp, esi
mov ebx, ecx
pop eax
lea eax, [edx + edx*8 + 0x12240227]
pop edx
mov edx, ebx
inc eax
setno al
shl edx, 2
add ax, ax
mov eax, ebp
jge 0x1711405
call fcn.016bf396

Function at 0x12238da
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
dec eax
mov dword [esp + edx + 0x57c35530], 0x80205d80
inc ebp
mov eax, dword [ecx + esi*4 - 5]
jge 0x16dab32
mov byte [esi], al
jmp 0x16fbb80
dec esi
lea ecx, [edx + ecx + 0x57c3552b]
dec eax
ror ecx, 0xf
sar cx, cl
inc esp
xor eax, ebx
pop esi
xadd edx, edi
inc ecx
movzx ebp, di
inc ebp
lea eax, [eax + edx - 0x2e9fa7c5]
inc ecx
mov ebp, 0x3034e7a5
call fcn.0171ed21
call fcn.01774eee
call fcn.0176bc09
mov ecx, 0xbb216c99
inc ecx
mov ebp, 0x582e1ba8
dec edi
mov esp, dword [ebp + esi - 0x582e1ba8]
dec ebx
mov ebp, dword [esp + ebp - 0x582e1ba8]
dec ebx
mov dword [esi + ebp - 0x582e1ba8], ebp
mov edx, 0x8aa4b01a
dec edi
lea ecx, [ecx + ebp - 0x582e1bac]
inc ebp
mov eax, ebp
movzx eax, dx
inc esp
movzx edi, dl
inc ebp
mov eax, dword [ecx + eax*2 - 0x16034]
inc sp
add ebp, edx
inc esp
xor eax, ebx
sar ax, 0xc
inc edi
lea eax, [eax + ebp*2 + 0x2aa50fa8]
inc ecx
sar bh, 0x61
inc ecx
movsx edi, bp
inc ebp
mov esp, ebp
inc ecx
neg eax
dec ecx
bswap edi
inc ecx
xor eax, 0xa8a3d814
inc ecx
dec esp
sar cx, 0xa6
inc ecx
rol eax, 1
add cl, dl
inc ecx
movzx ebp, sp
inc ecx
neg eax
movsx esi, ax
add esi, edi
inc ecx
inc eax
inc ecx
rol edi, 0x87
and esi, ebp
push ebx
inc esp
xor dword [esp + eax*4 - 0x3ffec], eax
push ebp
sal dword [esp + eax - 0xfff9], 0x7a
shl ecx, cl
dec eax
mov ebx, dword [esp + ecx*2 - 0x20397ff8]
dec ebp
arpl ax, ax
dec ebp
adc edx, eax
dec edx
mov dword [esp + ebp - 0x582ecbba], 0x6527ff06
dec esi
mov dword [esp + ebp - 0x582ecbc2], edx
ret 8
je 0x175d72b
inc edx
test ebp, esi
stc
clc
cmp edx, 0x104
jmp 0x175d725
jb 0x1784701
mov eax, 0x8e8fc83b
mov cl, dl
rol eax, cl
bswap si
not esi
lea esi, [ebp + edx - 0x10c]
test eax, 0xb197ea0
add al, dl
xor al, byte [edi + esi]
jmp 0x12238f1

Function at 0x12249fb
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x591ce3f3], 0x9ebfd437
shl ecx, cl
rol dl, 1
inc dword [esp + ecx*4 - 0x7e600000]
sub al, ch
not dl
ror eax, 0x47
jp 0x12f9d1b
sbb dl, 0x3e
ror dl, 1
inc ax
sub dl, al
xor bl, dl
lea edx, [esp + edx + 4]
inc dword [esp + ecx - 0x1f980000]
add cl, byte [edx + ecx*2 - 0x3f300000]
movzx edx, word [esp + eax - 1]
mov word [esi + eax*4 - 4], cx
mov ecx, 0x74219100
call fcn.012d2e4d
bt cx, 0x9d
Function at 0x122a5f9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not dl
ror dword [esp + eax - 0x3409b17b], cl
inc dl
mov dword [esp + eax*2 - 0x681362fe], ecx
call fcn.0169f445
mov ebp, 0x3493a99b
dec ecx
mov ecx, dword [esi + ebp*2 - 0x69275336]
inc eax
movzx eax, ch
inc ecx
mov eax, 0xf11e6f97
movzx bp, byte [ebp + ecx - 0x3493a99b]
dec esi
lea esi, [eax + esi - 0x95]
inc cx
mov dword [esi + eax - 0x9b], ebp
inc ecx
movzx esi, al
mov ebp, 0xd13d7b16
dec esp
lea ebx, [eax + eax*8 - 0x45ee70d1]
dec ebp
lea ecx, [ecx + eax*4 - 0x270]
dec eax
not eax
call fcn.0122a535
lea esi, [esi + eax - 0x4414c8c5]
pop eax
pop edx
pop eax
pop ecx
pop eax
pop edx
pop edx
jmp fcn.016a12a3

Function at 0x122d58c
Capabilities:
Encode data using base64

Disassembly:
sub eax, 0x182c5121
dec eax
mov dword [esp], 0xd693b998
rol eax, 2
call fcn.01792a55
xor edx, ebx
inc ecx
movzx eax, bh
inc ecx
rol esp, 0x18
bswap edx
dec edx
lea ecx, [edi*8 - 0x1bd6015f]
dec edx
ror edx, 1
inc ecx
xchg bh, dh
shl esi, 0xcc
xor edx, 0x4ab2c182
dec eax
dec eax
bswap edx
inc ecx
push edi
not edx
jno 0x174349d
inc esi
xor dword [esp + edi - 1], eax
call fcn.01768d8e
inc cx
sar esp, 1
inc edx
seta byte [esp - 0x38fffffe]
dec eax
mov dword [esp + eax - 0x38], ebx
inc edx
xor dword [esp - 0x39000000], edx
inc ecx
shr esp, cl
inc ecx
push ebx
dec ecx
not ebx
dec edx
mov ebx, dword [esp - 0x71fff8]
call fcn.016f0845

Function at 0x12338d4
Capabilities:
Encode data using base64

Disassembly:
or word [esp + ecx + 0x12], 0xc00a
setne byte [esp + ecx + 0x12]
xor bl, al
or edx, 0x310afb90
shr edx, 0x6e
mov dx, ax
movzx dx, dl
neg ecx
adc cl, byte [esi + ecx*2]
mov dword [esp], 0xb8250bae
not dl
mov eax, dword [esp + 0xd]
shr eax, 0x35
lea eax, [eax + eax + 0x3e943217]
not cl
or dl, cl
mov word [esi + eax*2 - 0x7d28642e], dx
mov ecx, dword [esp + eax - 0x3e943208]
add ecx, ecx
call fcn.01717ee9

Function at 0x1238e81
Capabilities:
Encode data using base64

Disassembly:
mov eax, ebp
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x12e484b
lea esp, [esp + 0xc]
je 0x12e487b
mov eax, dword [ebp + ebx*4]
push 0xf31baa0c
dec word [esp + 1]
mov dword [esp], eax
dec ebx
push 0x9e9997a5
push 0x421f8c33
lea esp, [esp + 8]
jne 0x12e4855
mov eax, dword [ebp]
call fcn.0173e5b1
Function at 0x12d29f0
Capabilities:
Encode data using base64

Disassembly:
mov dword [ecx + esi - 0x34cd29d], edx
pop ecx
sbb esi, 8
shr byte [esp + 9], 0x62
pop eax
pop ecx
pop eax
pop ecx
pop edx
jp fcn.016a12a3
mov edx, 0x1388f7b1
movzx ecx, dl
dec esi
lea ecx, [edx + ecx - 0x1388f7b5]
rol dx, 0x24
inc ecx
mov edx, dword [ecx + edx - 0x13887b1f]
xor edx, ebx
inc esp
movsx eax, cx
dec esi
lea ebx, [eax*8 + 0x709d139]
lea edx, [ecx + edx + 0x4bbbbf66]
inc ebp
or ebx, ebx
rol edx, 1
dec edx
lea ebp, [ecx + eax - 0xe47135c]
inc edx
lea edx, [edx + ebx*8 + 0x6b5ffb00]
inc ebp
movsx esp, bx
inc esp
movzx edi, cl
dec esi
lea ebp, [edi*2 + 0xa1c30a9]
xor edx, 0xc6b6d100
inc ecx
bswap esp
inc ecx
neg esp
push ebx
xor dword [esp + ecx - 0xb1], edx
inc ecx
push eax
dec eax
mov ebx, dword [esp + ecx - 0xa9]
dec eax
arpl dx, dx
dec eax
neg ecx
jle 0x177e90a
inc ecx
ror bl, 0xa5
inc bp
mov dword [esi + ecx*2 + 0x162], eax
jae 0x17b0c5b
mov ecx, 0x95b0fa2c
dec esp
lea edi, [ecx*8 + 0x78383398]
dec ecx
sub ecx, 4
inc bp
or edi, edi
adc cx, 0x5b2d
jge 0x16e6dbd
movzx edi, byte [edi + ebp - 0x15a9c582]
call fcn.0171eaf2
dec esp
add edx, edx
dec eax
mov dword [esp + ecx*4 + 0x2cc], ecx
mov edi, ebp
dec ebp
mov edi, dword [esi + ecx*2 + 0x162]
inc eax
movzx esi, bh
inc ebp
mov al, byte [edi + ecx + 0xb1]
inc eax
movsx eax, bh
dec esp
add esi, esi
ror dword [esp + ecx*4 + 0x2c4], cl
jae 0x17699ad
dec esi
mov dword [esp + ebx*2 - 0xe13ac1c], edx
ret 8

Function at 0x12d9c63
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov dword [esp + edi - 0x1b80511c], esp
inc ecx
movzx edi, sp
dec ebp
arpl bp, bp
inc ecx
dec bh
dec ebp
add edx, ebp
call fcn.0177fe33

Function at 0x12ec6c4
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esi + ecx - 0x4f22ed25]
inc ecx
mov dword [esp + ecx - 0x4f22ed2a], ecx
add eax, edx
lea ecx, [ecx*8 + 0x62a3cd03]
mov dword [esi + 4], eax
rol word [esp + 1], 0x6a
mov eax, ecx
sar cl, 0x66
mov ecx, dword [edi - 4]
sbb ax, word [esp + 2]
mov edx, 0xb6b34e26
xadd eax, edx
add edi, 0xfffffffc
call fcn.0169f038

Function at 0x12f8445
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x2a125331
dec eax
lea esp, [esp + 0x18]
je 0x16c870f
inc ecx
push edx
mov edi, 0xf42f1712
dec esp
lea edx, [0x3cfc9a]
Function at 0x16a4f7b
Capabilities:
Encode data using base64

Disassembly:
or cl, al
call fcn.017a7bd7
mov ecx, 0x7d27f28f
js 0x17092d1
inc edi
mov ebx, dword [ecx + edi - 0x2d17504e]
inc esp
xor ebx, ebx
push eax
inc ecx
ror ebx, 3
rol ebp, cl
inc ecx
not ebx
dec ecx
add edi, 0x663dda06
inc ecx
neg ebx
push ecx
not ax
inc ecx
bswap ebx
dec edx
mov dword [esp + eax*2 + 0x10], ebp
inc ecx
xor ebx, 0xa093b88c
inc ecx
rol ebx, 3
dec ecx
sar edi, cl
push ebp
jne 0x16c0fa1
cmp esp, 0xe39e199f
inc esi
lea ebx, [ebp + ebx + 0x48285cac]
dec ecx
sar ebp, 0x8a
inc ecx
xor ebx, 0xb2022780
inc edx
movzx esi, word [esp + edi - 0x126a7]
dec edx
inc dword [esp + edi*2 - 0x24d4c]
inc ebp
movsx esp, ax
inc ecx
dec ebx
inc edx
not byte [esp + edi - 0x12696]
inc ecx
xor al, 0xad
inc edx
sub byte [esp + edi - 0x1268d], 0xd
dec edx
mov dword [esp + edi - 0x1268a], ebx
inc bp
jae 0x1734dbf
inc ecx
bswap edi
inc esi
xor dword [esp + eax*2 - 0x13a], ebx
dec ax
call fcn.016b5796
inc ecx
mov eax, dword [ecx + ecx - 0x66bc6d86]
inc ebp
mov ebp, ebx
xor eax, ebx
inc ecx
push ebx
neg byte [esp + ecx - 0x66bc6d83]
inc ebp
movzx eax, bx
inc eax
xor eax, 0x3d0aeb92
inc word [esp + ecx - 0x66bc6d83]
dec ecx
lea edi, [ebx + 0x6e270b12]
daa
outsb dx, byte [esi]
dec eax
lea ebp, [ecx + 0x37bf361c]
inc eax
inc word [esp + ecx - 0x66bc6d81]
neg eax
inc edx
mov dword [esp + eax - 0x25bf], ebp
inc eax
neg bh
dec edx
mov dword [esp + eax - 0x25c0], ebx
inc edx
xor dword [esp + eax - 0x25c0], eax
call fcn.01232551
outsd dx, dword [esi]
adc al, 0x83
cwde
fld dword [edx]
mov edi, 0x2153faaf
jg 0x1734ded
fmul dword es:[esp + 0x49fe8b44]
sub ecx, 4
inc ebp
movsx ebp, di
dec edx
lea edi, [ebp*2 - 0x6f5fddcb]
inc ecx
mov edx, dword [ecx]
inc ebp
movzx ebx, di
inc esp
movzx eax, bh
call fcn.01778460
ror ax, 0xc5
lea edx, [edx + eax - 0x66c65dbd]
movsx ecx, word [esp + eax - 0x58290000]
bswap edx
shr ax, cl
inc ax
push ecx
not edx
xor edx, 0x8f1033b3
jmp 0x16a1e7f

Function at 0x16a63e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, dl
add ebp, ecx
and ax, 0x3b27
or word [esp + edx - 0x289171a4], dx
pop ecx
pop ecx
pop ecx
jnp fcn.016a12a3
dec ecx
sub ecx, 4
push 0x3a90a13f
inc ebp
mov ebx, dword [ecx]
sub dword [esp], 0xcebb28a0
inc esp
xor ebx, ebx
inc ecx
mov eax, 0x602b62b2
inc ecx
pop esp
inc ecx
mov edx, esp
inc ecx
inc ebx
inc ecx
neg ebx
inc ecx
dec ebx
inc ecx
movzx eax, ah
call fcn.0177093a
not ax
mov eax, dword [esi + eax*8 - 0x7fff8]
movzx cx, byte ss:[eax + ecx - 0x98d671b]
add esi, 2
mov word [esi], cx
mov eax, 0xe5a41302
pop ecx
jmp ebp
Function at 0x16a6b35
Capabilities:
Encode data using xor

Disassembly:
xor dl, 0x26
sub si, 0xd281
dec eax
lea edi, [esp + edi + 8]
inc esp
mov dword [edi + ecx - 0x7895], eax
dec eax
mov dword [esp + ecx*4 - 0x1e254], edx
inc ecx
mov edx, dword [ecx + ecx - 0x789a]
dec esi
lea ecx, [ecx + ecx - 0x789a]
xor edx, ebx
neg dword [esp + ecx - 0x7895]
lea edx, [ecx + edx - 0x3f82f09e]
jbe 0x16e97c1
invalid
shr cl, 0x62
jne 0x1768758
dec edx
aam 0xb5
mov dh, 0x2a
and eax, 0x49e67be5
in eax, 0x7b
out 0x49, al
jnp 0x16bdebc
dec ecx
aad 0xb5
lds esp, [ebx - 0x1a]
dec ecx
aad 0xdd
xor eax, 0xd549e647
test eax, 0x49e6077d
aad 0x79
movsd dword es:[edi], dword [esi]
ja 0x16bded4
dec ecx
aad 0xd9
push ds
sbb al, 0xb2
jp 0x16bded3
xchg esp, eax
mov ebx, 0xdd62a824
ficomp dword [edx + 0xf1d58a]
inc edi
aad 0x79
pop ebx
and eax, 0x3723f6a7
aaa
jmp 0x16bdf0a
dec ebp
lea eax, [esp + ecx*8 - 0xbcd11cc]
dec eax
lea eax, [ebp*2 + 0x1ba95027]
xor edx, 0xb88db922
lea edx, [edx + ecx*8 + 0x6ff3eea]
inc ecx
and al, ch
jns fcn.016cde2c
inc ecx
pop eax
ror edx, 2
jmp 0x16bdec4
xor edx, 0x8b37582c
push ebx
jmp 0x1790dbf
inc eax
inc ch
xor dword [esp + ecx*2 - 0xf04a], edx
pop ebx
shl esi, cl
call fcn.016d420e

Function at 0x16aaa50
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov ebx, dword [esp + ebp*2 - 0x30]
dec eax
ror edx, 0xc7
call fcn.012f78ff

Function at 0x16b4b21
Capabilities:
Encode data using base64

Disassembly:
not ecx
and dword [esp + eax - 0x5001fffc], edx
mov dword [esp + eax - 0x50020000], eax
dec dword [esp + eax - 0x5001fffe]
xor ebx, ecx
pop edx
call fcn.01775c74
stc

Function at 0x16b6570
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + eax*2 - 0x294ea3e6]
not ax
call fcn.01759701
mov eax, 0x641a1d03
dec eax
lea edi, [edi + eax - 0x641a1d06]
movsx edx, al
mov ecx, dword [eax + edi - 0x641a1d02]
jge 0x16c12d7
test dx, bp
dec ecx
sub ecx, 4
dec eax
mov dword [esp], edx
inc ebp
mov edi, dword [ecx]
dec eax
shl dword [esp], 7
inc esp
xor edi, ebx
not dword [esp + 4]
inc edi
lea edi, [edi + ebx - 0x3dd9b348]
or dword [esp + 1], edx
xor dx, word [esp + 2]
inc ecx
xor edi, 0x963dd304
call fcn.01706399
mov eax, 0xa175316
add eax, 0x55b7c402
lea edi, [eax + edi - 0x5fcf171c]
mov ecx, dword [edi + eax - 0x5fcf1718]
xor ecx, ebx
jmp 0x16df3e1
xor ecx, 0xe222c984
lea edx, [eax + eax - 0x4b7acd54]
ror ecx, 1
ror dx, 0x47
xor ecx, 0x71883189
sar al, 0x83
sar edx, 0x43
add eax, 0xcd3ecb8b
inc ecx
xchg edx, eax
neg eax
bswap ecx
ror al, 0xa4
or eax, edx
rol edx, 0x85
xor ebx, ecx
add ebp, ecx
mov ecx, eax
mov eax, dword [esi]
movzx dx, byte ss:[eax]
lea eax, [ecx*2 + 0x19a7ce35]
xadd al, ah
jle 0x16ab41b
inc dx
xor dword [esp + edi - 0x1e5a428b], 0x8b4acf98
pushfd
cmp al, 0x7b
mov ebp, 0x894ae1a5
lodsb al, byte [esi]
sub al, 0x8b
popal
xor byte [esi - 0x249cb2aa], dl
push esi
inc edx
setnp byte [esp + edi*2 - 0x3cb484fb]
call fcn.017bac97
Function at 0x16b7438
Capabilities:
Encode data using base64

Disassembly:
bswap eax
lea edx, [edx*8 + 0x463aff83]
inc eax
ror dx, 0x63
sub cl, 2
add ecx, 0x562239ad
bswap eax
push ecx
sbb dx, word [esp + ecx - 0xf5a722e]
lea edx, [edx + ecx*2 + 0x6590038e]
xor ebx, eax
shr ecx, 0xe9
adc ebp, eax
mov dword [esp + ecx*4 - 0x1eb4e0], 0x3732ab8c
xchg byte [esp + ecx*2 - 0xf5a6d], cl
mov ecx, dword [esi + ecx*2 - 0xf5b56]
movzx eax, dx
sar dl, 0xa7
movzx edx, byte [eax + edi - 0x56e]
sub word [esp + eax - 0x569], 0x2ead
and eax, dword [esp + eax - 0x564]
lea edi, [eax + edi - 0x2e]
xor dl, bl
inc dl
bswap eax
ror dl, 1
or byte [esp + eax - 0x28fffff7], ah
add dword [esp + eax - 0x28fffff8], 0x272c6cb3
sbb dl, 0x24
jmp 0x17810d0

Function at 0x16b9243
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ecx - 0x7da6d32b], 0x9329ff33
ror ebp, 2
call fcn.016b86ab

Function at 0x16bab7c
Capabilities:
Encode data using base64

Disassembly:
call fcn.016c3da4
mov eax, 0x913294b0
movzx edx, ax
mov ax, word [esi + edx*4 - 0x252c0]
mov dx, word [esi + edx*2 - 0x1295e]
mov ecx, 0x9b27bf82
rol cl, 0x81
neg ecx
mov cl, byte [esi + ecx - 0x64d840f7]
jnp 0x176a1be
push 0x29afda2
add esi, 4
shld ax, dx, cl
dec dword [esp]
mov word [esi], ax
add dword [esp], 0x250a042b
sbb edi, 4
mov eax, dword [edi]
mov edx, dword [esp]
sar edx, 0xc1
xor eax, ebx
add dword [esp + edx*2 - 0x27a501cc], edx
call fcn.017b5334
dec eax
adc byte [ebp - 0x24ba2f4d], dl
loopne 0x172186d
dec edx
sub byte [edi - 0xa], bh
xchg esp, eax
int3
jbe 0x172183a
inc dx
not dword [esp + ebp - 0x1e3757c5]
inc ecx
rol ebx, 1
inc ecx
bswap ebx
pop edi
call fcn.017537a3

Function at 0x16bc0aa
Capabilities:
Encode data using xor

Disassembly:
dec ebp
adc edx, esp
dec eax
shr eax, 0xff
inc ecx
push ebx
rol ebp, 0x8f
dec ebp
lea ecx, [ecx + ecx - 0xd2a]
inc eax
shl ch, 1
inc ecx
pop ebx
inc ebx
movzx ebp, word [ecx + ebp - 0x28]
xor bp, bx
shl ecx, cl
jbe 0x1734a57
inc ebp
sbb ch, bh
inc ebx
mov cl, byte [eax + esi - 0x6c0a6ca5]
call fcn.0121c5b5
inc ebp
movzx esp, byte [ecx - 1]
mov ecx, 0xb228bb08
inc esp
movsx edi, cx
inc esp
xor ah, bl
shl cx, cl
inc esp
movzx eax, cl
inc ecx
add ah, 0xa2
inc ecx
not ah
dec ebx
lea esi, [edi + edi*2 - 0x3cdf2afc]
inc ecx
push eax
inc ecx
shl eax, 0x87
inc ecx
neg ah
push esi
inc ecx
ror ah, 1
call fcn.016acf55
dec edx
mov dword [esp + eax - 3], ebx
inc edx
shl byte [esp + eax - 0x11], 0x43
inc edx
xor dword [esp + eax - 3], edi
inc ecx
pop eax
call fcn.0173143b
inc cx
mov edx, dword [esi]
inc ecx
mov eax, 0x6c0a6ca7
jmp 0x1732446
Function at 0x16c3cb1
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov eax, dword [esi + ecx*2 - 0xed00]
jle 0x1748c0f
inc ecx
mov ecx, edi
inc ebx
mov eax, dword [ecx + edi - 0x2018]
dec bp
jo 0x1710eb6
xor eax, ebx
not eax
inc ecx
push edi
shr dl, 0x47
bswap eax
not eax
dec esp
lea esp, [ecx*8 - 0x4876ffee]
dec ecx
bswap eax
dec eax
dec edx
mov dword [esp + edi*2 - 0x4030], ebx
inc ecx
shr bh, 0xe6
dec esp
lea ebp, [edx + edx + 0x46aeb423]
inc ecx
dec eax
inc edx
xor dword [esp + edi*2 - 0x4000], eax
pop ebx
inc cx
sar esp, 0xa2
call fcn.01743ba0
inc esp
xchg byte [esp + esi*2 + 0x117], al
lea ebp, [ebp + esi - 0x6127d429]
call fcn.017bb9f3
dec esp
xadd dword [esp + ecx*4 - 0x1d9f8], edi
inc edx
mov ecx, dword [ecx + esi - 0x767c]
inc ecx
pop ebx
dec ecx
adc ebx, 0xfff219b9
inc ecx
jmp ebx

Function at 0x16c5c2a
Capabilities:
Encode data using base64

Disassembly:
call fcn.0174fe13
mov ebp, 0x3a32620e
dec ecx
mov ebp, dword [esi + ebp*2 - 0x7464c41c]
jmp 0x17bb544
movzx eax, byte [esp + esi - 0x22]
dec eax
mov dword [esp + esi*2 - 0x4c], ebx
inc ecx
push eax
inc byte [esp + edi + 0x5b883c2e]
inc eax
rol dh, 0x66
xor dword [esp + edi + 0x5b883c2f], edx
dec ebp
xchg ebx, ebp
dec eax
mov ebx, dword [esp + esi*2 - 0x10a]
dec esi
lea ebp, [edi + edi*2 - 0xc102f4]
dec eax
arpl dx, dx
xchg word [esp + esi - 0x86], di
dec esp
mov dword [esp + esi*8 - 0x440], ebx
dec esp
add edx, edx
inc ecx
ror ebp, 0x58
add dword [esp + edi + 0x5b89000c], edi
rol byte [esp + edi + 0x5b890006], 0xc4
mov word [esi + ebp - 0x26], dx
dec eax
not edi
movzx ecx, di
dec ebp
lea ecx, [ecx + esi - 0x2a]
inc ecx
mov edx, dword [ecx + esi*2 - 0x4c]
dec esp
sub ebp, esi
inc eax
movsx ebp, bh
xor edx, ebx
dec ecx
inc ecx
sar ebp, 0xbe
inc esp
mov edi, ecx
lea edx, [edx + ebp - 0x6de8eaa9]
inc esp
movzx ebx, cl
inc cx
inc ebx
inc ebp
movzx eax, bh
ror edx, 1
inc ecx
sub edx, ebp
bswap edx
xor edx, 0x3f1665a4
dec ecx
add ebp, 0x9329db3e
push ebp
not edx
dec ecx
shr ebp, cl
jae 0x16c85a8
inc cx
mov edx, dword [esi + 8]
mov edi, 0x5b883c26
inc eax
movzx esi, bh
inc esp
mov ebp, edi
dec ebp
lea esi, [esi + esi*8 - 0x126]
jmp 0x16d2f26

Function at 0x16c86ce
Capabilities:
Encode data using base64

Disassembly:
mov edi, 0x15a9c582
jmp 0x17699e3
xor edi, ecx
dec eax
mov dword [esp + 8], 0x80a6d007
and edi, 0xff
inc ecx
mov edi, dword [edx + edi*4]
shr ecx, 8
sar byte [esp + 0xe], 0x26
xor ecx, edi
dec eax
inc ebp
xor ecx, 0x4ba73f24
neg dword [esp + 9]
push 0x4bb4b81b
dec eax
dec eax
dec eax
lea esp, [esp + 0x18]
jne 0x12f8466
inc ecx
pop edx
mov esi, 0x52b024af
jmp 0x1709931
not ecx
jmp 0x1785470

Function at 0x16ce75d
Capabilities:
Encode data using base64

Disassembly:
movsx edi, bp
inc sp
xchg edi, edi
pop ebx
call fcn.016def74
lea ecx, [ecx + esi + 0x158d7502]
inc cx
add esi, ebp
dec ebx
lea eax, [esp + 0x4fb20a0c]
pop edx
xor ecx, 0x8ea801b5
inc eax
sal dh, 0x61
movsx ebp, word [esp + eax - 0x4fb2c0ec]
dec ebp
lea eax, [esp + 0x66afde89]
ror ecx, 1
dec ebx
lea edx, [eax + eax + 0x1f048287]
shl dword [esp + eax - 0x4fb2c0ed], 0x9b
bswap ecx
pop edx
push ebx
inc ecx
movzx ebx, di
inc edx
xor dword [esp - 0xb6e4], ecx
jmp 0x12d9cff
Function at 0x16d200d
Capabilities:
Encode data using base64

Disassembly:
inc bp
movzx edi, bh
dec eax
mov dword [esp + esi - 0x4f17748c], 0x1b310036
inc ecx
mov al, byte [esi + esi - 0x4f177494]
mov ebp, dword [esp + esi - 0x4f177485]
sar word [esp + esi - 0x4f17748b], 0x69
inc esp
movzx ebp, dh
inc ecx
not bh
dec edx
mov dword [esp + ebp*4 - 0x250], edx
not al
shl bp, 0xcc
inc esp
or bh, al
dec edx
inc dword [esp + ebp - 0x84]
dec eax
mov dword [esp + esi - 0x4f17747c], 0x70acf23c
jns 0x16fc35b
inc si
mov dword [esi + esi - 0x4f177494], edi
inc ecx
mov edi, 0xb9b25f33
inc ecx
mov ecx, dword [ecx + esi - 0x4f177499]
inc ecx
mov ebx, 0xe9a244b9
dec edx
dec dword [esp + ebp*2 - 0x110]
dec edi
lea ecx, [ecx + ebp - 0x99]
xor ecx, ebx
xor ecx, 0xdc34961c
dec eax
lea edi, [edx*2 + 0x14310c20]
jmp 0x17749ff

Function at 0x16d2f80
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x259b90bd
inc ecx
mov esp, 0x5686b311
inc edx
sar byte [esp + eax + 4], 0x86
inc ecx
movzx esi, di
dec edx
mov dword [esp + eax], ebx
inc edx
xor dword [esp + edi - 0x434e2df2], ecx
dec edx
lea ebp, [0xdae5098]
inc ecx
bswap esp
pop ebx
inc cx
xchg edi, esi
sub ebp, 0x2ea13a03
xadd al, ah
dec eax
mov ecx, edx
mov ecx, dword [edi + ecx - 0x5321ec10]
jg 0x17159a5
push 0x6ab7399d
rol edx, 3
jmp 0x173ff06
inc eax
mov dword [esp + eax*2 - 0x1a25cd5e], 0xb728f63d
xor edx, ebx
neg edx
call fcn.017b9dcb
mov edx, 0x5321ec10
lea edi, [edi + edx - 0x5321ec14]
and edx, edx
jae 0x12d3897
ror dx, 0xb
neg ecx
rol dl, 0x82
dec ecx
or eax, eax
xor ebx, ecx
ror dl, 0xa1
lea eax, [edx + edx*8 + 0x4e8a7b89]
adc ebp, ecx
movzx dx, byte [esi + eax*2 - 0x75701f26]
xor ax, ax
mov cl, byte [eax + esi - 0x3ab7fffe]
lea esi, [esi + eax - 0x3ab7fffe]
and eax, 0xa812ef37
shl dl, cl
call fcn.016ea781
mov dword [esp + eax - 0x4e9edf95], ebp
ret 4
xor ecx, ebx
mov eax, edx
inc ecx
sal eax, 0x41
bswap ecx
sbb ecx, 0xb9b37719
neg ecx
xor eax, 0x2f319132
dec ecx
jmp 0x16d5dec
add edx, 0x4e3ed3a8
push 0xdc22a6ba
bswap edx
not edx
xor ebx, edx
add ebp, edx
jmp 0x17712d2
lea esp, [esp + 0xc]
jmp 0x179c7fd
call fcn.017a7591
ror ecx, 1
xor dl, 0x22
sal al, 0x41
neg ecx
mov dword [esp + eax*2], 0x6405840e
shl dword [esp + eax + 7], 0x61
pop edx
ror ecx, 1
or edx, eax
sbb edx, edx
lea ecx, [ecx + eax - 0x2d06040d]
jns 0x17b15d3
rol ecx, 3
lea eax, [edx + eax + 0x4e9edf95]
bswap ecx
xor ebx, ecx
not edx
add ebp, ecx
neg word [esp + eax - 0x4e9edf92]
jno 0x16fa4b1
call fcn.017b5b12
inc ecx
movzx eax, bx
neg al
xor ecx, 0x1f294f03
dec ecx
lea edi, [ebx + 0x2d165b11]
dec edx
lea ebp, [edi*4 - 0x48d555d1]
sub ecx, 0xc724c81f
jmp 0x122a825