joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc8e8d5
Capabilities:
Encode data using xor

Disassembly:
xor al, 0xbd
rol byte [esp + 4], 0xe7
adc word [esp + 0xa], 0xb28b
rol al, 1
xor dx, word [esp + 9]
xor edx, dword [esp + 9]
shl dword [esp + 8], 0x56
mov dword [esp], edx
add al, dl
xor bl, al
inc dword [esp + 8]
neg dx
lea eax, [esp + eax + 0xc]
not dx
mov word [eax], cx
jb 0xd7a17a
sub dword [eax + 0x59bd9b72], ebp
mov esi, dword [ebp + 0x74]
loopne 0xc8e968
pushfd
mov ds, esi
cdq
rol edi, cl
mov dword [eax - 0x62], edi
sahf
pop esi
mov byte [0x6d865871], al
sbb dl, byte [esi - 0x58ae078a]
dec ebp
lea eax, [esp + eax*8]
jge 0xc8e9a9
pushfd
sahf
jne 0xc8e8e6
and dh, byte [ebp - 0x71]
mov bh, 0x5c
mov word [ebx + 0x662e0f37], es
jae 0xc8e98c
test al, 0x6f
mov ebp, cs
invalid
and dword [ebx], ecx
inc edx
iretd
stc
inc eax
mov dh, dh
fisub dword [edi]
inc eax
mov ch, 0x1e
int1
shr byte [ebx - 0x59], 0xc7
push es
aas
jp 0xc8e9ec
pop ss
xlatb
inc eax
xchg esp, eax
xchg dh, bl
mov ah, 0xc0
sti
xchg ebx, eax
aam 0x40
jp 0xc8e970
out dx, al
jno 0xc8e9cf
aas
adc ebx, esi
cmp al, 0x3f
jnp 0xc8e923
outsd dx, dword [esi]
jmp 0xffee0d62
dec edx
push esp
lcall 0xc0db, 0xa30b4004
mov bl, 0x4d
or esp, dword [ebx + 0x4db3c0db]
cmp ah, dl
fiadd word [esi]
pop edi
cmp ebp, dword [ebp + 0x47]
loop 0xc8e9e5
mov esp, 0x5e9a0992
rcl dword [edx], cl
jmp 0x6e1ea680
xchg edx, eax
imul ebx, dword [edi + 0x6692aac1], 0x6d67a370
scasb al, byte es:[edi]
out 0xb8, al
xor al, 0x18
insd dword es:[edi], dx
push edi
mov ebp, 0x2f981297
das
loopne 0xc8e9da
adc bl, byte [edx + 0x3e588dc0]
pop ss
pop eax
pop ss
popfd
push 0xffffffffffffffb4
pop eax
cmp esi, dword [esi - 0x535fed4d]
xchg dword [ebx + 0x7cdc86d0], edx
sbb al, 0xd6
sahf
and dword [esi], ebp
inc edi
dec ecx
push eax
loop 0xc8ea14
mov ecx, 0xe8450760
pop ss
out 0x21, eax
jge 0xc8ea52
jmp 0x1070838d
jne 0xc8e9af
cmpsd dword [esi], dword es:[edi]
invalid
xchg edx, eax
sub dword [ecx + 0xf], ebp
or al, 0x98
xchg edx, eax
loopne 0xc8e9e0
pop ss
in eax, dx
and eax, eax
fdiv dword [edx - 0x13]
or eax, dword [esi - 0x52]
or eax, 0x62f76860
push eax
xlatb
adc dh, bh
xor dword [ebp + 0x6d], ebp
imul eax, esp, 0x1f522f13
sbb ah, dl
fsubr st(5), st(0)
dec ebp
push ss
mov esp, ebx
xor ebx, dword [edx]
test al, 0xcf
cdq
aad 0x74
mov ecx, 0xe83a30a9
jle 0xc8ea6c
cld
dec edx
inc eax
jmp 0x71592b3e
pop ecx
pop eax
pop ecx
jmp ebp
Function at 0xcaba37
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xor al, 0xa9
inc esp
add al, dh
dec esp
lea ebx, [eax + 0x6d112913]
inc esp
xor al, dl
btc si, dx
movzx ebp, byte [esp + edx - 0xfb]
call fcn.00d3a6fd
jmp 0xd645f0
lea edi, [edi + edi*8 + 0x19243684]
mov edi, dword [esp + edi - 0x13b0e1f9]
push 0x5aaec9e
call fcn.0079e52e
mov ebx, 0x4da82821
mov dword [edi + eax - 0x66a713b3], edx
bts ecx, 0x3f
cwde
pop ebx
mov edx, dword [ebp + eax*8 - 0x9d98]
ror eax, cl
jae 0xcd8342
sal eax, cl
lea ebp, [ebp + eax*4 - 0x3ffc]
and eax, 0x402c4fb9
not eax
xor edx, ebx
lea edx, [eax + edx - 0x6aeb2ee6]
bswap edx
inc ecx
and al, 0xa3
not edx
shl ax, cl
btr ecx, eax
or cl, ah
inc edx
or cl, al
push ecx
bswap edx
dec edx
rol edx, 1
push eax
sar eax, 0xae
sar ax, 0x6e
bswap edx
xchg dword [esp + 3], ecx
xor ebx, edx
add esi, edx
sub eax, eax
adc dword [esp + eax + 3], 0x65130c2b
adc byte [esp + eax + 2], ah
pop edx
pop eax
jno fcn.00b016e0
xchg ebx, eax
inc esi
xor dword [esp], ebp
cbw
dec esp
lea esp, [esi*8 + 0x6c28ebb7]
dec eax
add esi, ebx
inc ecx
pop edi
inc eax
dec dh
dec ebp
arpl bp, bp
cbw
inc esp
mov ebx, ebx
shr ecx, cl
dec ebp
adc esi, ebp
inc esp
movsx ebp, bx
dec ebp
lea ecx, [ecx + edx - 0x100]
inc ebp
movzx eax, byte [ecx + edx - 0xff]
inc ebp
xor al, bh
push edx
jmp 0xb59846
mov ecx, 0x19119d26
lea edi, [edi + ecx*2 - 0x32233a50]
movzx edx, cl
movsx eax, cx
sar eax, 0xf3
mov ecx, dword [ecx + edi - 0x19119d26]
xor ecx, ebx
xadd al, dl
neg ecx
dec ecx
ror dl, 0x21
not edx
sbb edx, edx
rol ecx, 1
bswap ecx
add ecx, edx
xadd dl, ah
xadd dl, al
xor ebx, ecx
cbw
push edx
xor byte [esp + 3], dl
adc ebp, ecx
add ax, word [esp + 2]
rdtsc
inc byte [esp + 1]
or byte [esp + 1], 0x1c
dec dword [esp]
sbb esi, 8
mov ecx, 0x8e1c6506
or ecx, dword [esp]
mov dword [esi + 4], eax
seta byte [esp + 3]
mov dword [esi], edx
call fcn.00b2f37c
rol edx, 2
sar ecx, cl
not edx
sbb cx, cx
or dword [esp], ecx
xor edx, 0xaf1432ac
xor ebx, edx
shr byte [esp], 0x83
shr dword [esp], 0x5d
xor ax, word [esp + 2]
adc edi, edx
sal word [esp + 2], 0x8c
xchg word [esp], ax
movzx dx, byte [esi]
neg byte [esp + 2]
call fcn.00ba1901
Function at 0xcb985a
Capabilities:
Execute syscall

Disassembly:
add esi, 4
not word [esp + 2]
jmp 0xb84ccd
shld dx, ax, cl
mov word [esi], dx
mov eax, 0x5b8347b0
lea ebp, [ebp + eax - 0x5b8347b4]
mov ecx, 0x341d7f0f
mov eax, dword [ecx + ebp - 0x341d7f0f]
xchg word [esp + ecx - 0x341d7f0f], cx
dec cl
xor eax, ebx
or cl, byte [esi + ecx*2 - 0x23fc]
jmp 0xab76cd
push 0x4ebba72c
xor ebx, eax
dec dword [esp]
jl 0xcb928d
invalid
shr byte [esp], 0x42
and ebx, 0xff
call fcn.007518cd
push 0xffffffffffffffd8
xor ebx, dword [ebx + 0x76]
jb 0xcb981c
fdiv dword [ebx]
pop ebx
jbe 0xcb98f3
lcall 0x3ca, 0xcea88c87
mov ebp, 0xb4858073
mov eax, fs
mov dl, 0x40
test dword [ebx - 0x75], esp
stc
inc ebx
mov dh, byte [ecx + 0x1f]
xchg dword [eax + ebp*4 - 0x42fc3532], ecx
jae 0xcb980b
test dword [esp + ecx*4 - 0x7abf4d20], esi
arpl word [ebx + 0x718a43f9], cx
pop ds
pushal
fst st(1)
jbe 0xcb98a9
fist word [eax - 0x4c]
mov fs, word [edi + 0x31]
in al, dx
adc al, 0x80
mov ebp, eax
inc eax
test eax, 0xca15725b
imul ecx, dword [ebx + ecx*4 + 0x34a2e429], 0xffffff8a
push ds
mov ecx, 0x486734a
and byte ss:[eax - 0x74], dh
jl 0xcb9869
jns 0xcb9938
dec eax
sub bl, ah
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
je 0xcb987c
mov esp, 0x4709812a
jg 0xcb9945
rol bl, 1
out dx, al
add byte [ebx - 0x56834f79], bh
in eax, 0xb0
jp 0xcb991f
inc eax
invalid
xor cl, ah
ror byte [edi + 0x73], 1
dec edi
jae 0xcb98f7
cli
inc eax
inc esp
xor dl, byte [edi + edx*2]
sub eax, 0xf26e7b40
ror byte [ebp + 0x516117f], 0x3f
loop 0xcb98f0
aam 0x40
inc eax
inc eax
scasb al, byte es:[edi]
mov bh, 0xc0
cmp eax, 0x5240d7e3
sub byte cs:[ecx], al
cmp dword [edi], edi
aad 0xae
aas
aas
fstp xword [ecx]
pop ds
ljmp 0xc0e6
invalid
sar byte [0xdee14acb], 0x66
and edx, 0x9c0f4fad
sal dword [ebx], 0xd8
pop ecx
add ecx, 0x5a62ec
jmp ecx
Function at 0xcba11d
Capabilities:
Encode data using base64

Disassembly:
pop ecx
pop ecx
jae fcn.00b99983
xor ah, cl
shl dword [edx], 0xc6
js 0x757f09
pop ebx
leave
xchg ebp, eax
int1
and edx, ebx
mov ch, 0xda
frstor dword [edx + ecx*8]
into
test byte [ebx - 0x2837b6e0], bh
jae 0x757f0f
pop ebx
stc
or dword [ebx - 0x5b], ebp
mov dh, 0x9e
popfd
hlt
push ebp
and eax, 0x68bcb977
lcall 0x564e, 0x4266ee52
nop
lds esi, [esi]
jbe 0x757f78
pop edi
mov byte [0x5f41ffff], al
dec edx
mov edx, dword [esp + eax*2 - 0xbafa]
inc ecx
pop edx
inc ebp
mov ebp, eax
inc ebp
movzx edx, bp
dec esi
mov esi, dword [esp + eax*2 - 0xbafa]
call fcn.00b7c63c
ror dx, 1
mov dword [esp + eax - 0x7c0affab], ecx
shl eax, cl
rol eax, 0xac
adc dx, 0xa93a
or ecx, dword [esp + eax*8 - 0x3ffc]
not ecx
sbb dword [esp + ecx + 1], ecx
xor bx, dx
neg ax
sbb dword [esp + ecx + 4], eax
lea ebp, [ebp + ecx*2 - 2]
mov word [ebp + ecx*4], dx
jns 0x757ebb
sub edi, 4
mov ecx, 0x4c2e1d1e
rol cx, 0x24
mov edx, dword [edi + ecx - 0x4c2ed1e1]
xor edx, ebx
dec cl
xor edx, 0xc5a950bb
not edx
mov eax, 0x45b034a1
rol edx, 3
call fcn.00765443
mov eax, 0xec3c8ab1
mov edx, 0x22b2f81d
mov edx, dword [esi + edx - 0x22b2f81d]
not eax
mov ecx, eax
mov ax, word [esi + eax*2 - 0x2786ea98]
sar ecx, cl
bt cx, 0xa1
or cl, ch
lea esi, [ecx + esi - 0x4f49]
adc cl, 0x2f
lea ecx, [ecx + ecx*8 + 0xe89d0ba]
mov word ss:[edx + ecx*4 - 0x3a3270a0], ax
and ecx, ecx
movsx edx, cx
mov ecx, dword [ebp + ecx*8 - 0x7464e140]
adc ebp, 4
call fcn.00b0122f
mov edx, 0x33a8149d
jmp 0x7466e4

Function at 0xcd4592
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xa4
mov word [edx - 0x43], fs
pop ds
lds esp, [esi - 0x75]
mov esp, 0x47ef570f
int1
pop eax
inc ecx
pop edx
jp fcn.00c46ca0
call fcn.00bfa3da
mov eax, 0xd82f883b
mov edx, 0x292e9088
mov ecx, dword [edx + esi - 0x292e9088]
bts ax, dx
setb al
lea esi, [edx + esi - 0x292e9084]
xchg edx, eax
ror byte [ebp + 0x6f7c32b4], 0xd1
salc
shr edx, 0x41
xor ecx, ebx
dec ecx
bswap edx
btc edx, edx
ror ecx, 1
sub edx, edx
or al, 0x2f
not ecx
setae al
bts ax, dx
rol ecx, 3
add dl, ah
bswap ecx
retf
shl byte [esi + 0xf], 0xab
rol cl, 1
rol dword [ebx], 2
aam 0xf
leave
call fcn.00b86488
or ebx, dword [esi + edx*8 + 0x76]
jo 0xcd457a
jmp 0xcd45db
dec dword [ebx]
pop esp
salc
jbe 0xcd4651
cwde
mov edx, 0xf08cb6b2
xor al, 0xbf
jae 0xcd45cb
stosb byte es:[edi], al
push eax
xor al, 0x68
je 0xcd45da
or dword [esi - 0x2593d7bb], 0xe1f73b89
mov edi, 0x6c994971
movsd dword es:[edi], dword [esi]
mov esi, dword [esi + 0x3b]
test al, 0x18
push eax
invalid
pop esp
adc edi, dword [edi]
jne 0xcd45ba
or byte [ecx - 0x74], al
into
push ss
xchg ecx, eax
jnp 0xcd4690
pop esp
pop ss
jb 0xcd45ad
cmp dl, al
sbb al, 0x17
movsd dword es:[edi], dword [esi]
mov esp, dword [ebp - 0xa8eb32f]
mov ah, 0x4f
pop ss
jbe 0xcd4644
sti
ret 0x8e72
shl ebx, cl
add edi, edi
mov esp, 0x7045f847
les ecx, [edi + 0x32]
wait
mov bh, 0x73
out dx, al
mov edi, 0xc0f33de8
jp 0xcd460f
mov word [esi], fs
aas
mov edx, 0x3f2a1c9e
invalid
invalid
Function at 0xcd5e83
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0xd5362d9e
sub al, al
dec eax
mov eax, dword [ebp + ebx*4]
jle 0xbbf0db
mov ecx, 0x4f3b412a
push ecx
movsx edx, cx
mov edx, esi
neg ecx
movsx eax, byte [esp]
sbb dword [esp + eax - 0x2a], eax
lea esi, [esi + eax - 0x2c]
sub cl, byte [esp + eax*2 - 0x52]
mov word [eax + esi - 0x2a], dx
sbb eax, dword [esp + eax*8 - 0x150]
lea edx, [eax - 0x7ac0d0d2]
neg dword [esp + edx - 0x3603ee59]
lea ebp, [ebp + edx*2 - 0x6c07dcb6]
mov ecx, dword [edx + ebp - 0x3603ee59]
xor ecx, ebx
pop eax
jmp 0xd5e9ad
mov dword [esi + ebp - 0x5200006e], eax
mov edi, ebp
movzx ebp, si
pop ebx
call fcn.00d33563
lea esp, [esp + 8]
jne 0x72790e
mov eax, 0xb43ead21
lea eax, [eax*8 + 0x6210e18b]
mov eax, dword [eax + ebp - 0x4064a93]
call eax
mov edi, 0x72053729
mov ebp, dword [ebp + edi - 0x7205372d]
movzx esi, di
ror esi, 0xa7
jae 0xa74c41
btr ax, ax
sbb ecx, 0x5187ed2b
xchg edx, eax
not ecx
lea edx, [eax + eax*8 + 0x530d4b3d]
dec ecx
lea eax, [eax*8 + 0x23aafd19]
lea eax, [edx*4 + 0x2e0c158e]
xor ecx, 0xc992b6a7
xor ebx, ecx
not ax
ror edx, 0x57
adc edi, ecx
movsx ecx, dl
cdq
jmp fcn.00c26ffe

Function at 0xce740e
Capabilities:
Encode data using base64

Disassembly:
not ecx
xor eax, 0x3c183783
xor ecx, ecx
dec eax
dec dx
neg ecx
call fcn.00d72372
bswap ecx
xadd dword [esp + ecx - 0x5b6aacd8], ecx
xor edx, 0xbf1d2c1e
lea eax, [eax*8 + 0x1121e291]
not eax
sub ecx, ecx
ror edx, 3
lea edx, [edx + eax - 0x720e1fa1]
rol edx, 1
sar dword [esp + ecx*4], 0x8d
pop ecx
xor edx, 0x90169da4
not edx
btr ecx, 0xbc
call fcn.00b5f9c8
lea esp, [esp + 4]
mov eax, 0x5087760c
lea ecx, [eax + eax*4 - 0x48736d6c]
mov eax, dword [ecx + esi - 0x4a31e0d0]
lea esi, [esi + ecx - 0x4a31e0cc]
xor eax, ebx
lea edx, [ecx + ecx - 0x5544c2c7]
xor dl, 0x80
neg dx
rol eax, 1
inc cl
lea eax, [eax + ecx*2 + 0x46abf162]
jne 0x764af5
xor ecx, 0x84159e10
lea ecx, [ecx + edx*2 + 0x76b8fc99]
movsx eax, word [esp + edx*4 - 4]
xchg dx, ax
cwd
xor ebx, ecx
add ebp, ecx
movzx ecx, dx
add dx, word [edx + edi]
mov ax, word [eax + edi + 1]
not ecx
xchg dword [esp], ecx
call fcn.00aaba5f
rol eax, 1
neg edx
not eax
mov dword [esp], 0xd927bda7
jns 0xb942c3
xchg dword [esp + 4], ecx
add ecx, 0xe02bf
jmp ecx

Function at 0xced13d
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x78b7328b
mov dword [esp + ecx*2 - 0x17957000], ecx
jmp 0xce7495
Function at 0xcf7e30
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x2a937f81
lea edi, [edi + edx - 0x3a341ac]
and eax, dword [esp + eax - 0x2a944917]
dec al
mov word [eax + edi - 0x4914], cx
not ax
movsx ecx, ax
or dl, byte [esp + eax - 0xb6e9]
mov eax, dword [eax + ebp - 0xb6eb]
mov dword [esp + edx - 0x3a341a6], edx
adc cl, dl
neg ecx
lea ebp, [ebp + edx - 0x3a341a6]
sete cl
shl dl, 0x42
xor eax, ebx
jmp fcn.00a78b30
mov ebx, dword [esp + edi - 0x35d915cc]
sal eax, 6
movsx ecx, al
mov dword [esp + edi*2 - 0x6bb22b9c], eax
mov edi, dword [esp + edi - 0x35d915c8]
lea ebp, [eax - 0x5163eac8]
mov ebp, dword [esp + eax*4 - 0x35c6f4]
or ecx, dword [esp + eax*2 - 0x1ae37c]
movsx edx, byte [esp + eax - 0xd71bc]
lea ebp, [ebp + eax - 0xd71c4]
not ax
cdq
jg 0xc1dd84
mov ecx, dword [ebp + eax*2 - 0x1b1c7e]
xor ecx, ebx
shl edx, 0x62
dec al
mov dword [esp + eax - 0xd8e32], 0x2988016
inc ecx
mov dword [esp + eax*2 - 0x1b1c74], eax
sar edx, 0x72
bswap ecx
cwd
sub byte [esp + eax - 0xd8e2f], ah
je 0xb3db6e
dec ecx
xchg dh, al
sal dword [esp + eax - 0xd8ef3], 0x22
cwde
bswap ecx
mov dword [esp + edx*2 - 0x7dfe], eax
lea ecx, [ecx + eax - 0x1348e6ea]
not eax
xor ebx, ecx
shr ax, 0xe8
ror dx, 0x4b
not word [esp + eax - 0x6a]
add edi, ecx
movsx ecx, dl
mov dword [esp + eax*2 - 0xe2], edi
ret 0xc

Function at 0xd096ad
Capabilities:
Encode data using base64

Disassembly:
call fcn.00ccb571
mov edx, 0xa1ad1985
movsx eax, dl
mov cl, byte [edi]
bt eax, 0x88
movzx ax, byte [edi + 2]
add dl, 0x2d
seto dl
jae 0xbae540

Function at 0xd1f11e
Capabilities:
Encode data using xor

Disassembly:
sub dx, dx
xor ecx, 0xd22c89b8
or edx, edx
dec edx
Function at 0xd25fad
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
bswap ecx
sub eax, eax
bswap eax
dec ecx
not ecx
or edx, edx
bswap eax
add eax, 0x8d02d0a5
xor ebx, ecx
not dl
xor eax, eax
adc ebp, ecx
not dx
ror edx, 0xa8
ror ax, 0x21
or al, byte [esi + edx*2 - 0x1fe]
xadd dl, dh
shr edx, 0xed
lea esi, [edx + esi - 6]
xor al, bl
call fcn.00c324f7
loopne 0xc189ab
push esi
add bh, dh
invalid
add eax, 0x3a7d44b0
ror byte [ebx], cl
xor esp, eax
mov eax, dword [0xec955121]
mov ss, esp
lcall 0x8089, 0xfff57943
imul dword [ebx]
xor bh, 0x2b
mov byte ds:[0xff57375a], al
jbe 0xc1897d
jg 0xc1894f
cmc
cmp byte [ebx - 0x5884f87e], 0x31
and eax, 0xa7c0a098
jge 0xc189e6
call dword [ebp + 0x3032bb19]
xchg edx, eax
jp 0xc18988
push edi
dec edi
xor dword [ecx - 0x2b], ebx
mov al, 0x54
arpl word [ecx - 0x2b908631], di
invalid
iretd
xor eax, 0x65799423
inc byte [esi]
mov al, byte cs:[0x8efe4249]
and eax, 0x9ee7ff76
xor eax, 0xeb00a50d
movsd dword es:[edi], dword [esi]
add bl, ch
xor eax, 0xc6ff5f69
mov eax, dword [0xb300b6e3]
xor dword [esi - 0x213e0074], ecx
adc esi, edi
or ebx, dword [ecx]
loope 0xc189d2
add dword [ebx - 0xc70f468], esp
add eax, ebp
invalid
out 0x1f, al
invalid
xor eax, ebx
bswap eax
lea edx, [ecx + ecx*2 + 0xda70e0f]
mov dword [esp + ecx*2 - 0xed40], edx
call fcn.00742655
mov ecx, 0xf9231496
movsx edx, cl
mov ecx, dword [esi]
lea eax, [edx*4 + 0x2bac08a2]
cdq
dec ax
lea esi, [edx + esi + 4]
cwde
bts edx, edx
inc eax
xor ecx, ebx
shr edx, 0x8c
cdq
dec ecx
dec eax
inc edx
rol ecx, 3
neg ax
lea ecx, [ecx + edx + 0x7684a8aa]
sar edx, 0x1d
sub eax, eax
jns 0xc18929

Function at 0xd2c59b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx], edx
dec al
mov ecx, 0xadb4772b
rol word [esp + edx + 1], cl
xor al, 0x35
rol ecx, cl
sbb al, 0xb9
sar edx, 0x52
neg dl
shl dx, 0xa8
not al
xor edx, 0x9b02b63a
xchg dword [esp], edx
sub word [esp + edx], cx
ror al, 1
or edx, dword [esp + edx]
xor bl, al
call fcn.00b84da7
and dh, byte [ebx]
stosd dword es:[edi], eax
mov word [esi + 0x33], fs
or al, ah
mov dword [esp + edi*8], esi
test dword [ebp - 0x509bed8f], eax
sal dword [ecx + 0x7c933a76], 0x6a
invalid

Function at 0xd345c7
Capabilities:
Execute syscall

Disassembly:
mov dword [esp], 0x4fa9cbad
push 0x3192cd20
dec ebx
jmp 0x7484df
Function at 0xd39c3e
Capabilities:
Encode data using xor

Disassembly:
sub edi, 4
or eax, edx
mov ecx, dword [edi]
setp al
xor ecx, ebx
sub ecx, 0x1a34d616
lea eax, [edx*4 - 0x7dfbc6ee]
lea edx, [edx*2 + 0x5b9c2486]
mov dword [esp + eax - 0x7efc55a6], edx
ror ecx, 2
shl dword [esp + edx - 0x5a1832d0], 0xe7
sub edx, 0xee03faba
jnp 0xd66c3e
adc dh, byte [eax + edi*4]
xor al, 0xb8
mov dword [ebx - 0x5b], ebx
mov al, 0x90
jno 0xd39ca7
movsd dword es:[edi], dword [esi]
jle 0xd39c81
movsb byte es:[edi], byte [esi]
jbe 0xd39ce7
ror byte [ecx + 0x7f], cl
lea eax, [edi - 0x6e8cb0d6]
xor esi, esi
inc edx
adc byte [ebp + 0xc], dh
pop ecx
outsb dx, byte [esi]
mov word [esi], fs
or byte [eax + eax*8], dl
push esp
jae 0xd39d07
inc esi
pop ebp
mov esp, es
and dh, dh
inc esi
mov cl, byte [ebx + 0x7163804f]
lds esp, [esi - 0x5e89c7e2]
imul edx, dword [ebx - 0xad871a3], 0x8969d70a
jmp 0x73860729
je 0xd39cf7
push ds
rol dword [eax], cl
mov esp, 0x6245f847
sbb dword [ebx], edi
dec ebp
cmp edi, dword [eax + 0x36]
aas
dec eax
inc esp
add eax, 0x311bfbf
movsb byte es:[edi], byte [esi]
sar byte [edi + 0x3f0d9d6c], cl
aam 0x2e
inc esi
in eax, 0xfa
sal byte [edi], 0x19
xchg esp, eax
sub edi, dword [edi + 0x485d4779]
aas
cmp dl, byte [eax]
sub byte [edi - 0xdf0de0b], bh
mov al, 0xf2
pop ebp
rol al, 0xc
fsubp st(4)
adc eax, 0x7ca4943f
sbb dword [edi], edi
invalid
inc ecx
btc eax, edx
cwde
xadd dl, ah
xor ecx, 0x4a959db4
shr eax, 0x87
adc byte [esp + eax - 0x2a], al
xor ebx, ecx
add esi, ecx
movsx ecx, al
call fcn.00ccb961
lea edx, [edx + eax - 0x1293096b]
and ecx, dword [esp + ecx - 0x7af56ffc]
xchg ecx, eax
shr eax, 0x43
ror edx, 3
xor ebx, edx
add edi, edx
bt eax, 0x33
cbw
shr ecx, 0x36
mov dword [esp + eax*2 - 0x140c0000], edi
ret 4

Function at 0xd3d28a
Capabilities:
Encode data using base64

Disassembly:
xor al, bl
pop ecx
neg edx
ror al, 1
movsx ecx, dx
inc dl
bts edx, ecx
neg al
sub dx, 0x5a02
xor al, dl
not dx
dec al
btc ecx, ecx
sar dx, 0x64
xchg ecx, edx
xor bl, al
sub dx, dx
btr ecx, ecx
adc eax, esp
push ecx
pop ecx
call fcn.00b84730

Function at 0xd409f7
Capabilities:
Encode data using xor

Disassembly:
call fcn.00ac8225
mov eax, 0xa5afcb08
inc ax
mov ecx, eax
mov ecx, dword [esi]
or ax, ax
jp 0xb2afbf
mov eax, 0xb5a5ee95
mov edx, dword [edi]
movzx ecx, al
lea edi, [edi + ecx*2 - 0x126]
lea ebp, [eax*4 + 0x71904cba]
mov esi, edx
shr ebp, 0xa1
xadd ecx, ebp
sal ecx, 0xdd
mov ebp, edi
sal eax, 0x9d
ja 0xaae590
adc eax, 0x509c5c31
ror dword [esp + 9], 0xfa
jae 0xa8184f
mov ecx, 0x723be11e
mov edx, dword [ecx + ebp - 0x723be11e]
mov cx, word ss:[edx + ecx - 0x723be11e]
add ebp, 2
mov eax, 0x31bc209b
movsx edx, ax
mov word [ebp + eax - 0x31bc209b], cx
mov edx, dword [esi + edx - 0x209b]
lea esi, [esi + eax*2 - 0x63784132]
xor edx, ebx
sub al, 0x3c
cbw
ror edx, 2
not edx
jmp 0x783cee
shld edx, eax, cl
mov eax, 0xa229c880
pop eax
add eax, 0xfff622bc
jmp eax
push 0x6b0ca026
xor eax, 0x333308d
sal dword [esp + 8], 0x59
dec word [esp + 1]
bswap eax
ja 0x789fc5
jmp 0xa9a45e
Function at 0xd4241e
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edi + edx - 0x678d6932]
call fcn.00afc5b3
psrlq mm2, qword [esi - 0x4f]
sbb al, 0xf0
dec ecx
push esi
adc dword [eax - 0x7ff7fe6e], esi
and eax, ecx
invalid

Function at 0xd44d72
Capabilities:
Execute syscall

Disassembly:
push eax
xor ebx, edx
call fcn.0074d3ae
syscall
call fcn.00ba970d
sbb byte [edi], dl
outsd dx, dword [esi]
test dl, dl
ret 0x78f6
Function at 0xd5985a
Capabilities:
Execute syscall

Disassembly:
adc dx, 0x7e8f
not cx
sbb dx, word [esp + edx*4 - 0x1fa3a]
and ax, cx
lea ecx, [edx + edx*2 - 0x78cd47c6]
mov dword [esp + edx*8 - 0x7c6a0], edx
mov word [edx + edi - 0xf8d4], ax
mov dword [esp + edx - 0xf8d4], esi
ret
adc edx, 0x742f2ca4
lea ebp, [ebp + edx*2 - 0x639dd2ae]
mov dword [esp + edx - 0x31cee959], 0x85b394b4
xor ecx, ebx
rol edx, 0xb9
bts dx, dx
sbb ecx, 0x1b3ce81
rol ecx, 3
mov eax, dword [esp]
cbw
lea ecx, [eax + ecx - 0x6a969288]
neg ecx
ror edx, 0xf1
mov word [esp + 1], dx
xor ebx, ecx
add esi, ecx
sal edx, 0x81
add byte [esp + 2], dl
mov ax, word [edi]
mov ecx, edx
sbb cl, 0x9a
mov cx, word [edi + 2]
sub edx, edx
lea edi, [edi + edx + 2]
not ax
je 0xd80037
ret
jp 0x74951f

Function at 0xd88428
Capabilities:
Encode data using base64

Disassembly:
dec ax
mov word [edi + ecx*2], dx
not ecx
bt ecx, 0x31
rol dword [esp + 6], 1
pop eax
pop ecx
pop eax
jae fcn.00d0eefc
mov eax, 0x2616158c
mov ecx, eax
mov ecx, dword [ebp + eax*2 - 0x4c2c2b18]
lea ebp, [ebp + eax - 0x26161588]
xor ecx, ebx
not ecx
lea ecx, [eax + ecx + 0x16f16f05]
sal al, 0xc5
movzx edx, ax
bts edx, 0x3e
xor ecx, 0xb92bc0d
bswap ecx
cwd
ror dl, 0x66
lea ecx, [ecx + edx - 0x70365793]
xadd al, dl
xor ebx, ecx
xchg edx, eax
rol eax, 0xf5
adc edi, ecx
mov eax, dword [esi + eax - 0x10080000]
call fcn.00b8bda5
dec eax
mov dword [esp], 0xfce0dfcc
call fcn.00cd6a42
mov ebx, 0x36819b15
dec esi
lea ecx, [ebx + ecx - 0x36819b19]
inc ecx
mov eax, 0x15afdf3a
dec esi
lea edx, [eax*8 - 0x20f4604d]
dec edx
lea ecx, [ebx + edx*2 + 0x1c039da8]
inc ebp
mov ebx, dword [ecx + ebx*2 - 0x6d03362a]
inc ecx
push eax
inc ebp
xor ebx, edi
pop eax
inc esp
movzx ebp, bx
sar cx, 0xa3
inc ecx
ror ebx, 2
inc ebx
inc ecx
xor eax, 0x8d0fe99c
dec esp
btr eax, edx
inc ecx
sbb ebx, 0xc53e06ac
inc ecx
not ebx
inc ecx
rol ebx, 1
dec ecx
ror edx, 0xcd
inc esp
movsx esp, bx
push ecx
inc ecx
not ebx
inc ecx
xor ebx, 0xb04a01f
sub dword [esp + eax - 0x15afdf2e], eax
sar cx, 0xcc
inc ecx
inc ebx
dec byte [esp + ebx*2 - 0x6d033627]
dec eax
cwde
inc sp
and ebp, eax
inc ecx
ror ebx, 1
inc ecx
sub ebx, 0xbc8e6026
inc cx
ror eax, 0xa6
setb cl
inc ecx
sar esp, 0x96
dec esp
mov dword [esp + ebx - 0x36819b16], edi
movsx esi, bl
inc ecx
movzx edx, ch
cwde
inc esp
xor dword [esp + ebx - 0x36819b16], ebx
dec eax
shr ebx, cl
dec ecx
neg ebp
inc ecx
pop edi
dec ebp
arpl bx, bx
inc cx
sal eax, cl
inc ecx
btr ebp, 0x26
dec ebp
add esi, ebx
inc ecx
sar eax, 0xa9
inc cx
xadd eax, edx
dec esp
mov edx, edi
inc cx
xchg ebp, esi
dec eax
lea edi, [edi + ebx*2 - 0x36819b1a]
inc eax
sub al, dh
dec eax
sal ecx, cl
inc esp
mov dword [ebx + edi - 0x1b40cd8b], edx
jns fcn.00c46ca0
rol al, 1
not al
add byte [esp + 7], dh
rol al, 1
movzx ecx, dx
xor bl, al
lea eax, [esp + eax + 0xc]
bts dx, 0xbc
mov dx, word [eax + ecx]
mov eax, 0xfe327224
rol dword [esp + ecx*8 + 8], 0x83
lea edi, [ecx + edi - 2]
shr ecx, 0x9f
jbe 0xafcaf3
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x3b677c48
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x182636f8
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219