joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ebd21
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1019bb94], 0
mov dword [0x1019bb98], 0
mov dword [0x1019bba4], 0
mov dword [0x1019bb8c], 0x819
cmp eax, 0
sete bl
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x1d], bl
xor eax, eax
mov cl, byte [ebp - 0x1d]
test cl, 1
mov edx, eax
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
jne 0x100ebeb1
jmp 0x100ebd92
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1019bb94], edx
mov dword [0x1019bb8c], 0x110a
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1019bb98], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1019bb9c], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x1019bb9c]
mov edx, dword [0x1019bb98]
mov byte [edi + edx], cl
mov edx, dword [0x1019bb94]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1019bb98]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov edx, dword [0x1019bb8c]
mov ecx, edx
add ecx, 0x154a
mov dword [0x1019bb8c], ecx
and ebx, 0xff
mov dword [0x1019bba4], ebx
mov ecx, dword [0x1019bb90]
add ecx, 0x880
mov dword [0x1019bb90], ecx
mov cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
mov ch, byte [ebx + esi]
mov byte [0x1019bba9], ch
mov byte [0x1019bbaa], cl
xor ch, cl
mov byte [0x1019bba8], ch
add edx, 0xffffd056
mov dword [0x1019bb8c], edx
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x3c], esi
je 0x100ebeb1
mov eax, dword [0x1019bb94]
mov ecx, dword [0x1019bb98]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], edx
jmp 0x100ebd92
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ec331
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [0x1019bb90], 0xfffffec1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [0x1019bb8c], 0x83
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x1016dbd8]
mov dl, byte [eax + str._tZtyx]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
jne 0x100ec35d
lea eax, [ebp - 0x24]
mov dword [0x1019bb90], 0xe43
mov dword [0x1019bb8c], 0x1b8b
mov dword [ebp - 0x34], eax
call fcn.100ec75f
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.100ec1cb
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x100ec45d
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.100ec992
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov dword [0x1019bb90], 0xfc2
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x2c], ecx
mov dword [0x1019bb8c], 0x671
add ecx, 0x16b8
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x100ec454
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x100ec523
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov dword [0x1019bb8c], 0x1f0
mov dword [ebp - 0x10], eax
call fcn.100ebf37
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x100ec569
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x1019bb90], 0x1eae
mov esi, dword [edx + eax + 0x24]
mov dword [0x1019bb8c], 0xb82
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x100ec5da
jmp 0x100ec5f2
mov eax, dword [ebp - 0x38]
add eax, 2
mov dword [ebp - 0x3c], eax
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov edx, dword [ebp - 0x30]
cmp ecx, edx
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], ecx
jb 0x100ec602
mov eax, dword [ebp - 0x34]
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [ebp - 0x49]
test al, 1
jne 0x100ec682
jmp 0x100ec5b1
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x1019bb8c], 0x2173
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov ecx, eax
mov edx, dword [ebp - 0x50]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x59], bh
mov byte [ebp - 0x49], cl
je 0x100ec5e5
mov eax, dword [ebp - 0x58]
add eax, 1
mov dword [ebp - 0x60], eax
mov al, byte [ebp - 0x59]
cmp al, 0
setne cl
mov dl, byte [ebp - 0x49]
and dl, cl
mov esi, dword [ebp - 0x60]
cmp esi, 0x20
setb cl
and dl, cl
test dl, 1
mov dword [ebp - 0x54], esi
jne 0x100ec626
jmp 0x100ec5e5
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x24]
add edx, 0x1c
mov esi, dword [ebp - 0x1c]
add esi, edx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x68]
add eax, dword [ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x64]
add edx, dword [eax + esi*4]
mov dword [0x1019bb8c], 0x12d8
mov dword [ebp - 0x34], edx
jmp 0x100ec5da
Function at 0x100ecaab
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x1019bb98], 0
mov byte [0x1019bb9c], 0
mov dword [0x1019bb8c], 0x719
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x1019bb94], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1019bb90]
add eax, 0xfffff13a
mov dword [0x1019bb8c], eax
mov esi, dword [0x1019bb94]
add esi, 1
mov dword [0x1019bb94], esi
cmp esi, 0x100
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
jl 0x100ecaf0
xor eax, eax
mov dword [0x1019bb94], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x1019bba0], 0
mov esi, dword [0x1019bb98]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x1019bba0], ebx
mov dword [0x1019bb90], 0xde7
mov eax, ebx
cdq
mov ebx, dword [ebp - 0x30]
idiv ebx
mov dword [0x1019bb98], edx
mov esi, dword [ebp - 0x2c]
mov bl, byte [edi + esi]
mov byte [0x1019bb9c], bl
add ecx, 0x17b0
mov dword [0x1019bb8c], ecx
mov bl, byte [edi + edx]
mov byte [edi + esi], bl
mov dword [0x1019bb8c], 0x20e9
mov bl, byte [0x1019bb9c]
mov ecx, dword [0x1019bb98]
mov byte [edi + ecx], bl
mov ecx, dword [0x1019bb94]
add ecx, 1
mov dword [0x1019bb94], ecx
cmp ecx, 0x100
mov dword [ebp - 0x34], ecx
jge 0x100ecc02
mov eax, dword [0x1019bb8c]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x100ecb41
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ecc9d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [0x1019bb8c], 0x1c02
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x100eccee
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100ecdcf
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x100ecd39
jmp 0x100eccd3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x100ecd1b
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x100eccee
mov eax, dword [ebp - 0x20]
mov dword [0x1019bb8c], 0x848
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x100eccdd
jmp 0x100eccd3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff5
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x61
jne 0x100eccd3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov dx, word [eax + ecx*2 - 0x14]
mov word [ebp - 0x26], dx
mov ax, word [ebp - 0x26]
cmp ax, 0x64
jne 0x100eccd3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff7
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2], 0x64
jne 0x100eccd3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x100eccd3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0xe], 0x6c
sete dl
mov byte [ebp - 0x2d], dl
mov eax, 1
mov cl, byte [ebp - 0x2d]
test cl, 1
mov dword [ebp - 0x14], eax
jne 0x100ecdcf
jmp 0x100eccd3
mov eax, dword [ebp - 0x14]
add esp, 0x30
pop ebp
ret
Function at 0x100ecdd7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, esp
mov eax, 0x10
call fcn.100eb7a0
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x24], eax
call fcn.10001064
xor ecx, ecx
cmp eax, 0
mov dword [esi + 0x20], ecx
jne 0x100ecf51
mov eax, dword [0x1019bb90]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x28]
mov ecx, dword [esi + 0x1c]
add ecx, 0xffffe60f
mov dword [0x1019bb8c], ecx
mov dword [esi + 0x18], eax
call fcn.100ecc9d
xor ecx, ecx
cmp eax, 0
mov dword [esi + 0x14], ecx
je 0x100ece69
jmp 0x100ecf4b
mov eax, dword [esi + 0x10]
add eax, 0x3c
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
mov edx, dword [esi + 0x10]
cmp dword [edx + ecx], 0x4550
mov dword [esi + 8], ecx
je 0x100ecef6
jmp 0x100ecee5
sub esp, 4
mov eax, dword [esi + 0x24]
mov dword [esp], eax
call fcn.100eb9fc
add esp, 4
lea ecx, [0x100ec159]
mov edx, dword [esi + 0x24]
mov edi, dword [edx]
mov dword [esi + 0x68], edi
mov dword [esi + 0x3c], 0x135400
mov edi, dword [0x1019bb78]
mov dword [esi + 0x2c], edi
mov edi, dword [0x1019bb7c]
mov dword [esi + 0x34], edi
mov edi, dword [0x1019bb80]
mov dword [esi + 0x50], edi
mov edi, dword [0x1019bb84]
mov dword [esi + 0x38], edi
mov edi, dword [0x1019bb88]
mov dword [esi + 0x30], edi
mov dword [0x1019bb90], 0x5db
mov dword [0x1019bb8c], 0x183f
mov dword [esi + 4], eax
mov dword [esi], ecx
mov eax, dword [esi]
cmp word [eax], 0x5a4d
mov dword [esi + 0x10], eax
je 0x100ece44
mov eax, dword [esi + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esi], eax
jmp 0x100eced5
lea eax, [esi + 0x28]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x70], ecx
mov dword [0x1019bb90], 0xffffffce
mov edx, dword [esi + 8]
mov edi, dword [ecx + edx + 0x50]
mov dword [esi + 0x28], edi
mov dword [0x1019bb8c], 0x108a
mov edi, dword [esi + 0x24]
mov ebx, dword [edi + 8]
push ebx
push eax
call fcn.100ec331
add esp, 8
mov dword [0x1019bb90], 0x159a
sub esp, 4
mov ecx, esp
lea edx, [esi + 0x28]
mov dword [ecx], edx
call eax
mov eax, 1
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x20]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x73f8be
Capabilities:
Encode data using base64

Disassembly:
dec ecx
xor eax, 0x84ad3606
inc ecx
dec esp
mov ecx, dword [esp + esi - 0x2399]
inc ecx
xor esp, 0x87aa97ba
dec esi
mov dword [esp + eax + 0x7b52370a], edi
inc esp
xor dword [esp + esi - 0x2391], esp
dec eax
mov dword [esp + esi - 0x23a1], 0xe7253415
movsx ebx, cl
dec esp
mov edi, dword [esp + esi*2 - 0x4732]
ror bl, cl
dec ebp
arpl sp, sp
jb 0xc1269f
dec ecx
shr ebx, cl
dec ebp
adc esi, esp
inc edx
mov eax, dword [esp + ebx - 0x1ae5794]
and dx, 0xe50d
inc ecx
seta al
dec edx
mov edi, dword [edi + ebx - 0x1ae579d]
dec edx
mov dword [esp + ebx - 0x1ae578d], ebx
inc edx
rol dword [esp + ebx - 0x1ae5789], 0xd9
inc edx
inc byte [esp + ebx - 0x1ae5788]
inc ecx
pop eax
inc ecx
pop esp
inc ecx
pop eax
jne fcn.00c46ca0
neg dl
cwde
bt eax, 0x1a
dec dl
cwde
shr eax, 0xf1
not cl
xor dl, 0x9a
btr ax, ax
bts ax, 0x3e
rol eax, cl
neg dl
rol ecx, cl
adc cx, cx
or ecx, eax
xor dl, 0x86
xor bl, dl
jmp 0xcc835e
add edx, esp
sub ecx, eax
call fcn.00c92f39
and al, 0xfc
add al, 0xea
clc
inc ebx
das
xchg dword [ecx + edx*4], ebx
xor ebp, dword [edi]
invalid

Function at 0x74c24d
Capabilities:
Encode data using xor

Disassembly:
add edx, dword [esp + edx*2 - 0x7d95ae4a]
lea esi, [esi + eax - 0x4ec68189]
rol al, 0xa2
shl dx, 0x6c
inc dx
xor ecx, ebx
bswap ecx
xor ecx, 0xb1061137
inc byte [esp + eax - 0x4ec6812f]
mov dword [esp + edx - 0x4c3d6001], eax
add edx, 0xa89c9aac
ror ecx, 2
xor ecx, 0x79bfb735
call fcn.00c91fae
mov ebp, 0x892236a9
sub cl, byte [ebp - 0x278ddda9]
xor al, 0x12
invalid

Function at 0x75065d
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x3c1d8b2a
dec esp
lea eax, [edx*4 - 0x4e1d5e2]
inc sp
mov eax, dword [edx + edi - 0x3c1d8b2a]
dec eax
mov dword [esp + edx - 0x3c1d8b2a], edx
push edx
inc esp
movzx ebx, dl
dec edx
lea edi, [edi + ebx*2 - 0x52]
dec ebp
lea ecx, [ecx + edx*2 - 0x783b1656]
dec ecx
neg ebx
inc ebp
movzx ebx, word [ecx + edx - 0x3c1d8b2a]
movzx eax, dl
inc bp
xor ebx, edi
inc cx
sub ebx, 0x81661cba
lodsb al, byte [esi]
adc al, 0xe3
je 0x75068f
ret
fild dword [ebp + 0xf]
mov bh, 0x9c
adc esi, edx
je 0x75067a
ret
ret
Function at 0x7614db
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ecx + ebp - 5]
shl cl, cl
xor eax, ebx
bswap eax
push ecx
neg ecx
dec eax
xor dword [esp + edx*2 - 0xa], edx
add ecx, dword [esp + edx*8 - 0x28]
xor eax, 0x7b330486
lea eax, [eax + ecx*2 + 0x61bf1df7]
xchg dx, cx
xor ebx, eax
shl dx, 0x88
shl ecx, 0x98
pop edx
adc edi, eax
or edx, edx
and cl, 0x3a
jmp edi
fcmovb st(0), st(1)
jmp 0xc829ea7
stosd dword es:[edi], eax
rol byte [ecx + 0x2f680df2], 0x3f
lea ecx, [eax + ecx*8 - 0x71fef2f1]
xor ebx, edx
sar cx, 0xae
add edi, edx
cli
bt eax, 0x19
bswap eax
call fcn.00c328d7
add ebp, edx
call fcn.00d11c7b
push 0x60b9a595
mov dword [esp], ebx
mov ebx, 0xe822a888
btr ebx, 0x23
not bx
movzx ebx, byte [ecx]
jb 0xc5cf9a
sub eax, 0xea8907a5
xor ah, byte [ecx]
das
jno 0x761537
cmp cl, bh
sbb esi, dword gs:[esi - 0x7a]
sbb eax, 0x488dc0d8
mov ebx, 0xb22073f0
jns 0x7614f0
scasd eax, dword es:[edi]
jne 0x7614a3
enter 0xffffffffffff8cd1, 0x35
imul esp, dword [ebx + 0x51], 0xd72973eb
loop 0x7614b9
push ebp
mov cl, 0xd7
xlatb
xor eax, 0xdc11088b
jno 0x761530
clc
cdq
pop dword [edi + 0x2de4876]
loop 0x7614cf
xor byte [edx - 0x43], ah
inc esi
salc
mov dword [esi - 0x17], ebx
sti
or eax, 0x3d98bc72
invalid
sub dx, ax
neg ecx
xadd eax, edx
xor ecx, 0x55ae20ad
sal al, 7
xor ebx, ecx
add esi, ecx
movzx ecx, dl
ror edx, 0x6b
adc ax, 0xa534
jmp esi
inc ecx
rol eax, 3
neg eax
bswap eax
shl ecx, cl
sbb eax, 0xa229928b
xor ecx, ecx
and ecx, ecx
mov dword [esp + ecx*2], ecx
xor eax, 0xd8140db5
sal cl, 0x25
shr cx, 0xc5
xor ebx, eax
add edi, eax
add ecx, dword [ebp + ecx*2]
mov eax, dword [ebp + 4]
add ebp, 4
sal dword [esp], 0xce
xor edx, edx
test eax, eax
push 0xf09bca91
lea esp, [esp + 8]
je 0xcd64d2
jmp 0x7614e2
xor ebx, edx
push 0x20253f1d
call fcn.007911ac
mov ecx, 0x482d0ab9
movsx edx, cl
mov ecx, dword [ecx + edi - 0x482d0ab9]
bswap edx
movsx eax, dl
mov ax, word [edi + 4]
add edi, 6
sub edx, edx
btr edx, 0x33
mov word ss:[ecx + edx*4], ax
neg edx
mov ecx, dword [edx + ebp]
shr dl, 0x23
shr edx, 0x83
mov eax, 0x6e93a8ba
lea ebp, [ebp + edx*8 + 4]
xchg edx, eax
ja 0x74991b
adc ax, ax
xor ecx, ebx
cbw
dec eax
add ecx, eax
sal al, 0xc1
jae 0xd3d2c1
not ecx
jne 0xbca680
xchg dword [bx + di], edx
popfd
ficom word [ebp + 0x5e]
xchg edi, eax
push ecx
mov dword [eax], edx
pop esp
shr dword [eax - 0x32], 1
lds ebp, fs:[eax + 0x6beeb26b]
push edi
jno 0xc5d045
adc eax, 0x70df573e
bound ebx, qword [ebx - 0x29]
test al, 0xba
scasd eax, dword es:[edi]
scasb al, byte es:[edi]
sub edx, dword [edi - 0x28bf2488]
mov dh, 0xbf
pop edi
movsb byte es:[edi], byte [esi]
sub dh, ch
iretd
pop esp
sbb ecx, edi
and dword [ecx - 0x560b490e], 0xffffffe1
invalid
not edx
mov eax, 0x5387ea8a
lea ecx, [eax + eax - 0x2bcc7649]
lea eax, [eax + ecx*4 + 0x46bad138]
mov dword [ebp + ecx - 0x7b435ecb], edx
sub eax, 0x2dbc8706
sar ecx, cl
neg cl
jmp edi
inc byte [esp + eax - 0x100]
bswap ecx
dec ecx
bswap ecx
inc dx
shl word [esp + eax - 0x101], 0x44
xor ebx, ecx
add ebp, ecx
or edx, dword [esp + eax - 0x101]
call fcn.00c6a350
Function at 0x76f142
Capabilities:
Encode data using xor

Disassembly:
push esi
dec eax
bswap ebx
dec edx
lea ebx, [ebx + edx - 0x43b807c2]
inc dx
shl dword [esp + edx + 0x1d], 0x86
dec esp
xor edi, ebx
dec ecx
inc edx
xor cl, ch
dec ecx
lea edx, [ebp + esi*8 + 0x75ae3fa2]
dec edx
lea edi, [edi - 0x7ead4213]
inc esp
and esp, ebp
dec ecx
mov dword [edx + edi - 9], ebx
inc ecx
pop ebx
inc ecx
pop edx
inc ecx
pop esp
pop edx
inc ecx
pop eax
jae fcn.00c46ca0
mov edx, dword [esi]
add esi, 4
mov ecx, 0x2a8f459c
dec ecx
movsx eax, cl
xor edx, ebx
add ecx, ecx
adc eax, ecx
not edx
bswap ecx
rol al, 0xc3
shl cl, 0xc1
neg edx
ror al, 0x24
neg cl
lea edx, [ecx + edx + 0x49b279c4]
xor edx, 0xe42127ab
neg eax
xor ebx, edx
ror eax, 0xd9
adc ebp, edx
lea eax, [ecx*4 + 0x4e8a36ac]
shl eax, 0x46
shr ax, 0x86
movzx ecx, byte [esi + ecx - 0x368b1e56]
inc ax
cbw
shr ax, 0x6b
lea esi, [esi + eax*2 - 0x5b57ffff]
test al, 0xa4
bts ax, 0x2c
lea edx, [eax*4 + 0x4d9f450b]
shl al, 5
xor cl, bl
sub ax, dx
ror eax, 0x9f
inc al
not cl
rol cl, 1
call fcn.00b0301b
adc al, 0xb0
ror dword [ebx + 0xe1ee71b], 1
xchg ecx, eax
mov dword [edi - 0x6e], ebp
mov bl, 0x4a
jb 0x76f1e1
sar byte [edx - 0x74], 1
inc ebx
rcl dword [esi]
mov eax, 0xa3ec8a25
pop ebx
jae 0x76f1e6
sbb al, 0x24
cmp ah, byte [ecx - 0x74]
outsb dx, byte [esi]
mov esp, 0x84987368
mov sp, 0x74bf
fistp qword [edx + 0x56]
mov cs, word [ebp - 0x76f21b2a]
in eax, dx
sub dword [ecx + 0x68], ebp
jno 0x76f2ad
adc eax, 0x765c2dca
pop edi
not byte [eax - 0xc5c7279]
mov bh, 0x73
scasd eax, dword es:[edi]
xchg dword [edx - 0x65], ebp
call 0x96f782d2
invalid
popfd
ja 0x76f2f0
lea edx, [ebx - 0x113febac]
sbb dword [eax + eax*2 + 0x3f], esi
test eax, 0x3f9afb93
outsb dx, byte [esi]
push esp
pushfd
aas
pop esp
mov dl, 0xe5
dec ecx
shl byte [eax], 0x28
jne 0x76f311
sar byte [edx + 0x4073468e], 0xe3
test byte [edi - 0x4221b7], al
mov eax, dword [0x8ae67596]
pop ss
mov fs, word [edx + 7]
adc al, 0x4c
mov esi, edx
inc eax
cdq
sub dword [ecx + 0x32], esi
mov al, byte [0x761ddd43]
invalid
xor ecx, dword [ebx + 0x71daa962]
push ss
inc ebx
aaa
xor dword [esi - 0x52], 0x8ee4ba54
pop esi
cmp byte [edi - 2], 0xd0
mov dword [esi], eax
xchg ebx, eax
inc ebx
or esi, dword [edx - 0x3a]
and byte [ebx], bh
mov word [esi - 0x35], fs
sti
jno 0x76f2c1
aas
jmp 0x76f2c1

Function at 0x774246
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
not edx
btc ecx, 0x98
dec eax
rol edx, cl
inc edx
not dword [esp + edx - 0x7fd]
xor eax, 0x7b330486
lea eax, [eax + edx*2 + 0x61bf0dff]
call fcn.00be890c
xor eax, 0x3631fe1d
ror cx, 0x8a
xor ebx, eax
lea ecx, [ecx - 0x6c75ab6d]
not cx
lea ecx, [edx*2 + 0x10af5217]
add esi, eax
inc edx
rol ecx, cl
rdtsc
not ecx
sbb ebp, 7
or ecx, 0x88b0023
jb 0xd7d75f
bts cx, cx
mov dword [ebp + 4], eax
mov dword [ebp], edx
lea eax, [ecx + ecx - 0x65f3ee48]
xor ax, ax
jbe fcn.00b6d6da
Function at 0x77f8b8
Capabilities:
Encode data using base64

Disassembly:
jb 0xbb06e1
mov ecx, 0xc080f996
lea edx, [ecx + ecx*4 - 0x11ed8562]
bts cx, cx
sbb esi, 4
mov edx, dword [esi]
bt ecx, ecx
xor edx, ebx
push ecx
sub edx, 0x2b90f604
btc ecx, ecx
inc word [esp + 1]
movzx eax, cx
neg edx
shl word [esp + eax*2 - 0x1f3aa], 0x4a
neg byte [esp + eax - 0xf9d4]
xor word [esp + eax*2 - 0x1f3aa], cx
bswap edx
and dword [esp + eax*8 - 0x7ceb0], 0xecbd979e
or eax, ecx
inc edx
not word [esp]
rol edx, 3
pop ecx
inc edx
xor ebx, edx
sal ecx, cl
shr ax, 0xc4
adc ebp, edx
neg ecx
or eax, ecx
bswap eax
movzx ax, byte [edi]
mov edx, 0xdc3d2510
or cl, byte [edi + 2]
rol dl, 0xa1
jae 0xbeb961
mov edx, dword [ebp]
push 0xd2a1f31e
call fcn.00c1b986
mov eax, dword [edi]
mov edx, 0x8fb3d894
shl edx, 0x5e
movzx ecx, dx
or dl, byte [edi + edx*4 + 4]
bts ecx, ecx
lea edi, [edi + ecx*8 - 2]
not cx
shr cx, 0x2d
mov byte [eax + ecx*2 - 0xe], dl
mov eax, 0xd8aef0a7
mov edx, ecx
btc ecx, eax
lea esi, [esi + ecx - 0x8b]
rol ecx, cl
cdq
mov edx, dword [ecx + esi - 0x4380]
shl ecx, 0x23
sal cx, 0xc2
cwde
xor edx, ebx
shl ecx, 0x98
bswap edx
xor ecx, eax
jo 0xc78b11
push eax
rol edx, 3
sal word [esp + 2], cl
inc edx
cbw
xchg word [esp + 1], cx
neg edx
sal ecx, cl
sbb edx, 0x1b8f1929
add al, 0xa
xor ebx, edx
add ebp, edx
bswap ecx
movsx edx, cl
mov dword [esp + ecx - 0xf080], ebp
ret
adc edi, 2
bts edx, edx
or edx, 0x999add37
sar dl, 0x64
sal al, cl
movzx ecx, dx
neg edx
or ecx, ecx
mov word [edi + edx - 0x224002fd], ax
sal cl, 0x23
mov eax, edx
jmp ebp

Function at 0xa78955
Capabilities:
Encode data using xor

Disassembly:
shr cl, 0x86
neg eax
bswap edx
btr edx, edx
call fcn.00aa3933
ror ecx, 1
mov dword [esp + edx - 0x2d8d96a0], edx
movzx eax, byte [esp + edx - 0x2d8d969d]
sar dl, 0xc5
sbb ecx, 0xba890fae
xor ebx, ecx
xor edx, dword [esp + edx - 0x2d8d96f9]
call fcn.0076422e
sub ebp, 4
mov ecx, 0x7c04eb2e
btr ecx, 0x1b
mov eax, ecx
mov ecx, dword [ebp + eax - 0x7404eb2e]
shl eax, 0x57
movsx edx, al
neg al
xor ecx, ebx
rol edx, 0xb0
cdq
ror ecx, 3
btc ax, dx
neg ecx
not dx
jmp 0xc996e7
mov word ss:[eax + edx*4 - 0x20579bb0], cx
mov dword [esp + edx*8 - 0x40af3760], edi
ret
inc ecx
sub edx, 0x9eb02f2a
dec dx
btr ax, 0xa
bswap ecx
rol al, 0x47
bts ax, ax
ror ecx, 2
or eax, edx
adc dx, 0x4433
bswap edx
xor ebx, ecx
ror dx, 0x2d
sbb eax, 0x3cbe2eaa
adc edi, ecx
not ax
add dx, dx
lea ecx, [eax - 0x25c05444]
mov eax, dword [edx + esi - 0x815e614]
shr ecx, cl
bswap ecx
sub cx, dx
mov cx, word [esi + edx - 0x815e610]
push edx
bts edx, edx
lea esi, [esi + edx*8 - 0x40af309a]
neg dl
js 0xb39f98
xor byte [esi + edx*2 + 0x73], bl
pop esp
add dword [edi + 0x1d], esp
jbe 0xc9974d
push cs
ljmp 0xae6d

Function at 0xa7db2c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xd093c306
shl dword [esp], 0x8d
mov ecx, esi
rol dword [esp], 0x18
mov eax, 0x22ac7f0d
movsx edx, al