joyce8/EMBER2024-capa huggingface dataset:
Function at 0xad4ab8
Capabilities:
Encode data using base64

Disassembly:
dec dx
mov dword [esp], ecx
and al, ch
xor eax, dword [esp + 4]
not dx
xor bx, dx
neg ecx
rol eax, cl
adc ax, cx
lea ebp, [ecx + ebp - 0x470ff1ac]
mov word [ebp + ecx - 0x470ff1aa], dx
mov ecx, dword [esi + ecx - 0x470ff1aa]
mov edx, dword [esp + 4]
lea esi, [esi + edx - 0x72b5c7a2]
jo 0x11946d6
pop eax
xor ecx, ebx
neg ecx
pop eax
sub ecx, 0xef1e8b87
xor ecx, 0xec99af04
shr dl, 0x41
rol ecx, 1
bswap ecx
inc dx
jne 0xb6eb4a
or edx, eax
call fcn.011a70f0
jnp 0x11ad209
mov ecx, 0xa90ac5bb
shr cx, 0x23
push ecx
mov dx, word [ebp]
xchg word [esp + 2], cx
mov cx, word [ebp + 2]
adc ebp, 2
or dx, cx
mov ecx, dword [esp]
not dx
lea eax, [ecx*8 + 0x71a062d]
mov word [ebp + ecx*4 - 0x62dc62dc], dx
mov edx, dword [esi + ecx*2 - 0x316e316e]
lea esi, [esi + ecx*4 - 0x62dc62d8]
shl word [esp + ecx*4 - 0x62dc62dc], 0xa4
shl ax, 0x4e
xor edx, ebx
call fcn.00f96da0

Function at 0xad7c2a
Capabilities:
Encode data using base64

Disassembly:
xchg cl, dl
pop esi
inc esp
xadd cl, al
dec ecx
add ecx, edx
inc ebp
mov dword [ebx + edx - 0x6c025897], edi
ja 0xaed58d
dec eax
mov dword [esp + edx - 0x6c02586d], 0x2a8dafbe
inc ecx
neg edi
inc eax
neg ch
sal byte [esp + edx - 0x6c025863], 0xa7
dec eax
xor dword [esp + edx - 0x6c025865], eax
inc ecx
rol edi, 3
inc ecx
pop ebp
inc word [esp + ebp - 0x6c0250fe]
sub bl, 9
dec eax
mov dword [esp + edx - 0x6c02586d], esi
inc esp
xor dword [esp + edx - 0x6c02586d], edi
inc cx
xadd eax, ebx
jbe 0xac9016
test ecx, 0x392f8e08
clc
inc bp
xchg ebp, esp
inc ebp
movsx edi, dx
inc esi
movzx eax, byte [edx + esi - 0x6c02589c]
inc ecx
push edx
cmova ebx, edx
dec esi
lea esi, [edx + esi - 0x6c02589c]
inc ecx
sal dl, 0x44
cmovb ax, bp
inc esp
xor al, dh
inc ecx
rol al, 1
inc eax
not ch
dec eax
and edx, dword [esp + edx - 0x6c025893]
call fcn.00b764b2

Function at 0xae4972
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [0xb07f16]
sub esi, 4
mov dword [esp], 0x5ead850f
mov ecx, dword [esi]
rol dword [esp], 0x86
jb 0xb2ec72
xor ecx, ebx
bswap ecx
mov eax, 0x8e254b88
xor dword [esp], eax
movzx edx, ax
dec ecx
and eax, eax
rol ecx, 3
lea eax, [edx + edx*4 + 0x6926ca1]
add al, al
sar byte [esp + eax*4 - 0x1a4f9a47], 0x45
lea ecx, [ecx + eax*2 - 0x1ec8e65e]
xor ebx, ecx
sal dl, 0xc1
mov word [esp + eax - 0x693e690], ax
sbb eax, 0x1180f73c
add ebp, ecx
pop eax
movzx ecx, dl
jmp ebp

Function at 0xaeca51
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + eax + 0x76ca5c1f], 0xb506eeb1
inc edx
xor dword [esp + eax + 0x76ca5c27], edx
inc dx
add dword [esp + edx - 0x573a2cb0], ebp
dec esi
or dword [esp + edx - 0x573a2cb4], edx
dec ecx
add ecx, eax
dec edx
mov esi, dword [esp + edx - 0x573a2cac]
push eax
inc sp
xchg ebp, edx
dec eax
arpl dx, dx
jns 0xb80c93

Function at 0xaeeb5a
Capabilities:
Encode data using base64

Disassembly:
push 0x2397ff9f
sub ebp, 8
mov dword [ebp + 4], eax
jmp 0xfce039
xor byte [esp + ebp + 0xa], 0xbc
dec eax
lea ebx, [esp + ebx + 0x28]
jno 0x100f06b
jmp 0xb92e05
mov eax, 0x58bb6393
mov edx, eax
rdtsc
jmp 0xac9eb5
call fcn.01028427
Function at 0xaf252e
Capabilities:
Encode data using base64

Disassembly:
xor bl, dl
bswap ecx
add edx, esp
jmp 0xb2257c
mov dword [edi + 4], eax
mov eax, 0x58061116
lea edx, [edx*8 + 0x6c09ec12]
pop eax
mov eax, dword [edi]
mov ecx, edx
xor ecx, ecx
sar cx, 0x69
lea edi, [edi + ecx*2 + 4]
movzx edx, byte [ecx + esi]
sbb ecx, 0x62b7532
lea ecx, [ecx + 0x53bb8caa]
xor dl, bl
mov dword [esp + ecx - 0x4d901774], 0xa398083a
pop ecx
pop ecx
dec dl
neg dl
rol cl, 0xc2
dec dl
ror cl, 0x67
and cx, cx
rol dl, 1
add dl, 0x30
ror dl, 1
rol cx, 0x8b
lea ecx, [ecx + ecx + 0x27065d19]
sbb ecx, ecx
neg dl
not ecx
dec cx
js 0xaeebbd
lea edi, [edi + eax*4 - 0x646ce65e]
add ax, 0x6d8f
adc cl, dl
movsx edx, ax
mov word [edi + eax - 0x191ba727], cx
shl dx, 0x6b
movzx ecx, al
mov edx, dword [esi + eax*2 - 0x32374e4e]
not al
add cl, ch
lea esi, [eax + esi - 0x191ba7d4]
setnp al
jne 0xfc9611
lea esi, [esi + edx - 0x5f968d94]
call fcn.010a1ef4
mov dword [edx], eax
mov eax, dword [esi + 1]
lea edx, [ecx + ecx*2 + 0x501549b3]
lea esi, [esi + edx - 0x4d1549ab]
dec cl
xor eax, ebx
call fcn.0111c14d
shr cx, 0xab
xor edx, ebx
shr ecx, 0x25
dec edx
ror cl, 0x67
shl eax, 0xb
sar ecx, 0xb7
rol edx, 2
not ecx
shl cx, 0xeb
bswap edx
call fcn.00b81d49

Function at 0xaf5a74
Capabilities:
Encode data using xor

Disassembly:
add al, 0x81
rcr dword [ebp - 0x30], 0x4d
add bh, bh
loope 0xaf5ab5
invalid
not ecx
xor bx, dx
mov dword [esp + ecx - 0xff7f], 0xa332430e
shl cl, 0x87
mov word [edi + ecx - 0xff80], dx
mov dword [esp + ecx - 0xff80], ebp
ret 8
mov eax, dword [esi]
push 0xaf826001
add esi, 4
call fcn.011aeb8d
mov ecx, dword [edi]
mov eax, 0xd3043f3a
call fcn.0119070e
jle 0xaf5a99
pop es
xchg ecx, eax
imul eax, dword [eax], 0xffffff8b
invalid
jg 0xaf5a45
xor dh, byte [edi + 0x396305d7]
add eax, 0xb9333963
loopne 0xaf5aed
arpl word [ecx], di
xor edi, dword [ecx + 0x39634de0]
arpl word [ecx], di
xor edx, dword [eax]
mov bh, 0x85
arpl word [ecx], di
xor edi, dword [edi - 0x67]
xor eax, 0xe7333963
arpl word [ecx], di
xor esp, edi
nop
std
arpl word [ecx], di
xor esi, edi
pop ecx
push ebp
neg dword [ecx + 0x55]
arpl word [ecx], di
xor edx, dword [esi + 0x3963a569]
xor edx, eax
cmp ebp, edx
arpl word [ecx], di
xor esp, ecx
and ebp, ebp
arpl word [ecx], di
xor esp, eax
in eax, 0x92
adc byte [eax], bh
shl dword [ebx + edi*2 - 0x6a6a2272], 7
xchg byte [esi + 0x7a], ah
or byte [ebp - 0x30], ch
fimul dword [esi + 0x4a]
push esp
bound edi, qword [ecx]
outsb dx, byte [esi]
outsd dx, dword [esi]
xchg ebx, eax
daa
mov dh, 4
je 0xaf5a9a
lodsb al, byte [esi]
jl 0xaf5a82
ja 0xaf5aac
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
mov ecx, 0xc7e7b55e
xchg esp, eax
mov ecx, 0x1717b55e
cmp al, 0xb9
pop esi
mov ch, 0xcf
div esp
mov ecx, 0xbf67b55e
inc esp
mov ecx, 0x5fd7b55e
invalid
Function at 0xafd11e
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0xa0081c9f
sal eax, 0x68
push edx
bswap ecx
add eax, edx
sar ax, 4
sal eax, 0xb5
neg ecx
dec al
bswap ecx
sub ax, dx
inc ecx
sub eax, eax
bswap ecx
rol eax, 0x2a
lea ecx, [ecx + edx*4 - 0x3450193d]
sbb dx, 0xc934
mov byte [esp + eax + 2], ah
jae 0xb63fa8
not ecx
mov dword [esp + eax*8 + 4], edx
pop edx
jo 0xfb3833
xor ecx, 0x641a2d34
sal edx, 0xc4
xor ebx, ecx
add ebp, ecx
xor dword [esp + eax], eax
movzx ecx, ax
rol ax, 0xab
rdtsc
pop ecx
sal ecx, 0xb2
push ecx
sbb edi, 8
neg cl
and cx, cx
call fcn.00b63af7
sub esi, 4
mov edx, dword [esi]
mov ecx, 0x8d1a51ae
xor edx, ebx
lea eax, [ecx + ecx + 0x63bb1119]
not ecx
sub edx, 0x810f90ae
not eax
xadd eax, ecx
rol edx, 1
neg edx
and eax, 0xb10e363d
inc ecx
dec edx
inc ecx
setns cl
add ecx, eax
neg edx
call fcn.010204fb
inc ecx
mov ebp, 0x921ae6b8
dec ebp
mov ebp, dword [ebx]
inc ecx
mov esp, 0x7d16839f
dec edi
mov edx, dword [ebx - 0x7d168397]
inc ecx
movzx eax, sp
inc sp
sub esp, eax
dec edi
lea ebx, [esp + ebx - 0x7d15fff8]
dec ebp
adc ebp, edx
inc ecx
mov ebp, esp
dec esi
mov dword [eax + ebx - 0x839f], ebp
dec edi
lea esi, [esi - 0x7d160004]
inc ebp
mov edx, dword [esi + eax*4 - 0x20e7c]
jmp 0x1169d1d
mov eax, dword [esi]
inc cx
rol cx, 0xe3
add esi, 4
ror edx, 0xcd
xor eax, ebx
call fcn.00fb7ba3
jmp 0xb9257a

Function at 0xb00dec
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov eax, dword [ecx + ebp - 0x7fac85ac]
mov dword [esp + ecx - 0x7fac85ac], edx
rol dl, 0x23
mov edx, dword ss:[eax + ecx - 0x7fac85ac]
movzx eax, word [esp + ecx - 0x7fac85ac]
shl dword [esp + eax - 0x85ac], 0xe1
mov dword [ebp + ecx - 0x7fac85ac], edx
movzx edx, byte [esp + eax*2 - 0x10b58]
js 0xb7e2cb
add ax, 0x13bb
mov eax, dword [ecx + esi - 0x7fac85ac]
js 0xfc1e72
lea esi, [esi + ecx - 0x7fac85a8]
xor eax, ebx
neg cx
xchg word [esp + edx - 0x57], cx
sub eax, 0x851a29a9
shl cl, 0xc2
and cx, 0x808e
neg eax
xor eax, 0xb4b4f2af
rol eax, 1
xor ebx, eax
add edi, eax
call fcn.01193f85

Function at 0xb01bfa
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x37aab636
sar eax, 0xf6
inc al
mov eax, dword [ebp + ebx*4]
push 0x6592093b
mov dword [esp], eax
call fcn.00b01bfa
dec ebx
lea esp, [esp + 4]
jne 0xafa5dd
mov eax, 0x8190704
push eax
mov eax, dword [eax + ebp - 0x8190704]
jmp 0x117b497
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
mov ebx, 0x59f7f90
movzx edx, bx
mov dword [ebp + ebx - 0x59f7f90], eax
mov ecx, 0x72a0e88e
lea edi, [ecx + edx + 0x3d230189]
mov edi, ebp
movzx esi, bl
shl esi, 0xc2
or ebx, 0x8282fc96
pop ebx
pop ebp
xor dx, 0x789
pop esi
movsx eax, cl
lea esi, [edx + esi - 0x781d]
mov ecx, dword [esi + edx*4 - 0x1e064]
xor ecx, ebx
add dl, al
ror dx, 0xcd
sub eax, 0x3d17b939
xor ecx, 0x96b93e99
not eax
neg eax
call fcn.00b339a1
nop
invalid

Function at 0xb0d996
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esp + edx + 0x717db808]
mov dword [esp + 8], 0x90dca278
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00ba2bab
Function at 0xb13e4d
Capabilities:
Encode data using base64

Disassembly:
sub ecx, 0x29ab5994
lea edx, [eax - 0x134da347]
neg ecx
ror edx, 0x99
mov dword [esp + edx*2 - 0x425cb97e], eax
jae 0xb339b9

Function at 0xb15a3d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x483d76c
call fcn.010a0292

Function at 0xb15a4a
Capabilities:
Encode data using base64

Disassembly:
ja 0x100f67e
or cl, dl
shl al, 0x64
sbb byte [esp + eax + 1], al
mov edx, eax
not cl
pop edx
mov word [eax + edi], cx
call fcn.011238e9
mov dword [ebp + ecx*2 - 0x132017e], eax
movzx eax, dl
jl 0xb08a6e
jmp 0x117d189
jmp edi
movsx edx, cl
mov dword [esp + edx*2 - 0x62], edx
lea eax, [eax + ecx*2 - 0x6d3370a8]
shl dl, 0xe3
xor eax, 0xaebd1d13
lea eax, [ecx + eax - 0x2ef50b18]
neg edx
xor eax, 0x881e7bae
xor ebx, eax
xchg dword [esp], ecx
add edi, eax
jmp 0xb533eb
rol word [esp + ecx - 0x30], 0x46
xadd ecx, edx
mov eax, dword [ebp + edx*8 - 0x188]
xchg word [esp + edx - 0x30], cx
sub dword [esp + edx*2 - 0x62], ecx
shr word [esp + edx*2 - 0x60], 0x28
mov edx, dword [ebp + edx*8 - 0x184]
pop ecx
lea ebp, [ebp + ecx*2 - 0x133afc8]
push ecx
xor cx, cx
and eax, edx
shr dword [esp + ecx - 0x990000], 0x45
not eax
pop edx
adc cl, dl
jae 0xaf2c2d
not edx
lea edx, [edx + eax - 0x5555fb45]
shr dx, 0x43
add ebp, ecx
call fcn.0119b3d4
sal eax, 0xb
shr eax, 0x69
xor ebx, edx
neg ecx
push eax
add ebp, edx
sub ecx, 0xe529f80c
movzx cx, byte [edi + eax]
mov dl, byte [edi + eax + 2]
rol ax, 0x89
sal al, 0x65
lea edi, [edi + eax*2 + 2]
jns 0xad4840

Function at 0xb18ac4
Capabilities:
Encode data using base64

Disassembly:
shr edx, 0x6e
mov dword [edx + ebp - 0x3fffb], ecx
mov dword [esp + edx*2 - 0x7fffe], edx
jbe 0xba1d37
lea ebp, [ebp + edx*2 - 0x7fffa]
mov eax, dword [esi + edx*2 - 0x7fffa]
neg edx
sub dword [esp + 4], edx
neg edx
lea esi, [esi + edx*2 - 0x7fff6]
mov dword [esp + edx*8 - 0x1ffff4], edx
xadd dword [esp + edx*4 - 0xffffb], edx
call fcn.00b806e8
mov eax, 0x5bbf20b0
ror ax, 0x2a
jae 0x103a495

Function at 0xb19453
Capabilities:
Encode data using base64

Disassembly:
dec ecx
mov dword [ebx + ebp - 0x6289230a], ebx
inc ecx
shl bh, 0x81
inc ecx
movsx ebx, al
dec esi
lea ebx, [edx + ebx - 0x71]
jge 0xb80603
jge 0x1011777
inc esi
mov ecx, dword [edx + esi - 0x85]
dec eax
mov dword [esp + ebp - 0x6289231a], ebp
dec ebp
lea esi, [esi + edx*2 - 0x106]
inc esp
xor ecx, esi
ror bx, 2
inc ecx
neg ecx
dec ecx
rol edi, 0xb4
dec esp
xadd dword [esp + edx - 0x81], edi
inc ecx
ror ecx, 2
inc esi
lea ecx, [edx + ecx - 0x22244d84]
inc esp
xadd byte [esp + ebp - 0x62892316], al
inc ecx
bswap ecx
inc esi
lea ecx, [edx + ecx + 0x23293306]
dec eax
mov dword [esp + edx*8 - 0x400], esi
inc dword [esp + edx - 0x7f]
inc ecx
rol al, 0xc3
add bl, dl
inc esp
xor dword [esp + edx - 0x79], ecx
sal byte [esp + ebp - 0x62892319], 0xa6
jnp 0x1007cec
pop ecx
pop esi
call fcn.0113bdc2
xor eax, esi
call fcn.00b97133

Function at 0xb197b6
Capabilities:
Encode data using base64

Disassembly:
add dx, word [esp + edx - 0x41e15729]
adc eax, 0xcb9062a5
add ebp, ecx
neg eax
mov dword [esp + edx - 0x41e108dc], eax
pop edx
pop ecx
pop edx
jne fcn.00b72a73
Function at 0xb1bdf9
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + ebp - 0xc891], esi
inc edx
xor dword [esp + ebp - 0xc891], ebx
dec edx
mov esi, dword [esp + ebp*2 - 0x19132]
dec eax
arpl bx, bx
call fcn.00af182e
xor ebx, ecx
lea eax, [edx - 0x4d7345da]
add ebp, ecx
shr dx, 9
mov ax, word [edi + edx*2]
lea ecx, [edx + edx*4 + 0x5d3e4e1b]
not dl
adc dword [esp + edx - 0xf6], ecx
lea edi, [edi + edx*4 - 0x3fa]
and byte [esp + edx*4 - 0x3fc], dl
mov dword [esp + edx - 0xfb], edx
shl edx, 0xdc
lea esi, [esi + ecx - 0x5d3e4e1c]
movzx edx, byte [esi + ecx - 0x5d3e4e1b]
pop ecx
lea ecx, [ecx + 0x2c2242a5]
xor dword [esp + ecx - 0x2c224497], ecx
xor dl, bl
ror cx, 0xf
jb 0xfae21c
ror dword [esp + ecx*2 - 0x5845126f], 0x6c
rol dl, 1
call fcn.00fd1fae
cmp cl, 0x8a

Function at 0xb1e25a
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [edi + 4]
sal ax, 0xa9
shr edx, cl
shr eax, 0x81
neg ax
sar al, 4
mov dword [edi + eax - 0x7e465efe], edx
mov edx, dword [esi + eax - 0x7e465f00]
movzx ecx, ax
lea esi, [esi + eax - 0x7e465efc]
rol ecx, 1
xor edx, ebx
or ax, cx
xchg ecx, eax
bswap edx
not eax
or eax, ecx
sbb ecx, eax
xor edx, eax
lea eax, [ecx + eax + 0xfaf48a8]
bswap edx
xor cl, 0x11
not al
not edx
inc edx
inc ecx
xor ebx, edx
lea ecx, [ecx + eax*4 + 0x5a8b7026]
and ax, ax
jl 0x1120297
adc ebp, edx
inc eax
setne cl
mov eax, dword [edi + ecx*4 - 0x42ae3002]
not ecx
jl 0x116c40b
mov ebp, 0x9bd67a0
push es
mov ch, 0xd9
invalid
mov dword [esp + edx - 0x79ab69a4], edx
movzx ecx, word [esp + edx - 0x79ab69a4]
mov word [edx + edi - 0x79ab69a4], ax
dec edx
mov ecx, dword [esi + ecx*2 - 0xd348]
movsx eax, dx
call fcn.0112849d
movzx ecx, dl
call fcn.011a9ecd
mov eax, 0xfc8d0821
or ax, ax
mov edx, dword [edi]
jns 0xb0a441
mov edx, dword [edi + 6]
add cl, cl
inc ecx
neg cl
or eax, edx
sub cx, cx
xor cx, cx
not eax
lea edx, [ecx + ecx*4 + 0x17ae6537]
sar dl, 0x63
shl dl, 1
mov dword [edi + 6], eax
adc ecx, edx
call fcn.00b4acec
fcomp qword [edi + 0x46b24816]
lds edx, [ebx]
push ss
add ch, byte [edx + 0x4e]
mov edx, 0xe24093c0
xor bh, byte [edi + esi*8 + 0x1f]
aam 0xd4
pop ebx
in al, dx
jmp 0x44dbc14e

Function at 0xb1fe82
Capabilities:
Encode data using base64

Disassembly:
or edx, dword [esp + edx - 0x195fa7f0]
not word [esp + 0xf]
sbb al, 0x1f
xor edx, 0x1b3c2bb7
push edx
inc byte [esp + 3]
ror al, 1
xor bl, al
lea eax, [esp + eax + 0x18]
push edx
xor dl, 0x98
mov byte [eax], cl
mov dword [esp + 8], edx
jle 0xb48fae

Function at 0xb21e47
Capabilities:
Encode data using base64

Disassembly:
sub ecx, 0xb133faae
dec ax
xor ebx, ecx
mov dword [esp + eax*2 - 0xe0aa6e6], 0x220ed70c
add ebp, ecx
call fcn.0101f29a

Function at 0xb21e64
Capabilities:
Encode data using base64

Disassembly:
inc edx
sar al, 0xc6
inc cl
neg edx
xor ebx, edx
xor ecx, eax
shl al, 0xc1
setae al
add ebp, edx
rol dword [esp + ecx*2 - 0x5212f4ce], 0x8f
lea ecx, [edi + ecx*2 - 0x5212f4d0]
mov dword [edi - 2], ecx
lea edx, [eax + eax*4 + 0xe3cbd09]
mov dword [esp + edx - 0x3f59209], 0x492ee1d
lea edi, [edx + edi - 0x3f5920b]
or dword [esp + edx - 0x3f59205], 0x38a954a6
pop ecx
pop eax
jno fcn.00fa3df3
Function at 0xb21eb6
Capabilities:
Encode data using base64

Disassembly:
add esi, 4
xor ecx, ebx
sub eax, 0xe5a5ae1b
mov dword [esp], edx
ror ecx, 3
xadd edx, eax
jg 0xb2399a
dec ecx
bswap ecx
rol eax, 0xe1
add dword [esp], eax
sub ecx, 0x7d325c97
xor ebx, ecx
sar word [esp + 1], 1
add ebp, ecx
add eax, edx
call fcn.00fad145
jmp eax

Function at 0xb21ef1
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
inc dword [esp + ecx*8 + 8]
call fcn.00ff871e

Function at 0xb24887
Capabilities:
Encode data using xor

Disassembly:
xor dword [esp + ebp*2 - 0x1ea], ebx
dec esp
mov dword [esp + ebp*2 - 0x1f2], edx
jmp 0xb6bcd4
inc ebp
add dl, bh
dec eax
mov esi, dword [esp + eax*4 - 0x1f3d8]
ror byte [esp + ebp*2 - 0x1f2], 0x45
dec eax
arpl bx, bx
sub dword [esp + ebp*2 - 0x1f1], ebp
dec eax
adc edi, ebx
dec ebp
mov edx, dword [ebx + ebp - 0xf9]
push ebp
pop eax
call fcn.00ff93b2
sal edx, 0x9b
mov dword [esp + eax*2 - 0x47611352], eax
not ecx
sub word [esp + edx - 0x4fffffff], ax
dec ecx
jmp 0xade24d

Function at 0xb274d5
Capabilities:
Get number of processors

Disassembly:
call fcn.00b75dfa
push 0xe307efa8
jmp 0x11338ed
dec ecx
sub esi, 4
inc ebp
mov esp, dword [esi]
inc esp
xor esp, esi
shl byte [esp + 6], 0xe6
inc ecx
mov ebp, 0x8f2efc95
inc ecx
inc esp
dec ebx
lea ebx, [ebp + ebp*2 - 0x37f868c6]
mov ecx, 0xff30b993
inc ecx
ror esp, 1
inc edi
lea esp, [esp + ebp - 0x1bfbca06]
sal word [esp + 2], 0xc6
dec esi
lea ecx, [ebx + ebp*2 - 0x4ae891d3]
add word [esp + 5], cx
inc ecx
not esp
dec eax
inc dword [esp]
inc ecx
movzx edx, bp
inc ecx
rol esp, 2
dec esp
xadd ebx, ecx
jno 0x1160855
inc ecx
xor esp, 0x740029af
dec eax
mov dword [esp + edx*2 - 0x1f92a], esi
inc sp
sbb ecx, dword [esp + edx*4 - 0x3f254]
inc ecx
dec esp
jmp 0x113c145

Function at 0xb28dc3
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
rol byte [esp + ecx*2 - 0x1f6], 6
lea eax, [esp + eax + 0xc]
mov cl, byte [eax + ecx - 0xff]
setb dl
mov eax, edx
sar dx, 0x4b
sbb ebp, 2
call fcn.00b7728b
lea ecx, [ecx + edx*2 - 0x30eb568c]
shl dword [esp + edx - 0x22019fb], 1
not ecx
xor dword [esp + edx - 0x22019fc], edx
setl dl
jbe 0xb6b5d2
rol ecx, 3
dec ecx
xor ebx, ecx
add edx, 0x2f22d712
adc ebp, ecx
pop eax
or edx, dword [esp + edx*2 - 0x6285e221]
pop eax
pop ecx
jge fcn.00b72a73
mov eax, 0xae191633
push eax
mov ecx, dword [ebp]
mov dl, byte [ebp + 4]
add ebp, 6
and al, ah
mov byte es:[ecx], dl
mov eax, dword [esi]
dec dword [esp]
adc esi, 4
xor eax, ebx
mov edx, 0x5fb9b205
call int.01172e98
or dword [ebp + 0x379f826e], 0xffffffe7
dec eax
invalid
mov eax, 0x753722b3
movsx ecx, al
lea esi, [esi + eax - 0x753722af]
sub ecx, ecx
xor edx, ebx
lea eax, [ecx + eax*2 + 0x41246cb2]
lea ecx, [ecx*4 + 0x161c243d]
add ax, cx
dec edx
call fcn.00b99682
ror ecx, 1
movzx eax, dx
call fcn.00b835a1
mov edx, 0x1f0f8793
mov edx, dword [esi + edx - 0x1f0f8793]
add esi, 4
mov eax, 0x27326338
mov ecx, eax
xor edx, ebx
sub eax, ecx
bswap edx
add ecx, 0xebb893aa
neg edx
inc eax
je 0xaccd62
xor edx, 0xe6966294
jmp fcn.010b7f71
Function at 0xb2dbba
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor edx, 0xa314bbbf
dec eax
lea esp, [esp + 8]
jne 0x1171ef7
mov ecx, 0xba8a5007
mov eax, ecx
neg al
pop edi
xor edi, edx
and edi, 0xff
mov edi, dword [edi*4 + 0x102be40]
jmp 0xb57876
shr edx, 8
push 0x8920ada9
xor edx, edi
sub dword [esp], 0xcb293911
jb 0xacca15
push eax
pushal
ja 0xb578fe
pop esp
bound eax, qword [edx + eax*2 + 0x2e]
in eax, 0x7f
jbe 0xb578c1
mov cl, byte [edi]
mov eax, 0x9eb10b24
neg eax
movzx ax, byte [edi + eax - 0x614ef4da]
call fcn.0101a8fe
retf 0xd187

Function at 0xb2ebf0
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp + 0xc], eax
setae byte [esp + 2]
jb 0xfc1e45
or ax, 0x7d9c
not edx
xor ecx, ecx
sub ecx, eax
xor ebx, edx
call fcn.00b47ccb
inc bp
movzx eax, al
seta bl
call fcn.00f9e541
xor dword [esp + eax - 0x4f8fa1d3], 0x25b68e9e
xor ecx, 0x972fdda6
jmp 0xf987e7
cpuid
dec dword [esp + 7]
inc dword [esp + 2]
sbb ebp, 0xc
ror dword [esp + 8], 0x96
jb 0xacd49b
inc cx
inc esp
dec eax
mov dword [esp + ebx*4 - 0x194d4], esi
inc ecx
not eax
inc ecx
mov eax, ebp
dec eax
lea esi, [eax + ebx*2 - 0x7654ba4a]
inc esp
xor dword [esp + ebx - 0x6535], ecx
sar ax, 0x4b
jns 0xfec26b
mov dword [ebp + 4], ecx
mov ebx, 0x153022b5
mov dword [ebp + ebx*2 - 0x2a60456a], edx
mov ebx, dword [esp + ebx*4 - 0x54c08ac8]
pop edx
pop ecx
pop ecx
pop edx
jb fcn.010a18ab
add dword [esp + edx*4], eax
shl al, 0x41
not ecx
xor ebx, ecx
ror dl, 0x26
shr ax, 0xa1
neg dword [esp + edx]
mov dword [ebp + edx*2 - 8], ecx
or dword [esp + edx + 4], eax
lea ebp, [ebp + edx*2 - 8]
jle 0xb2beda
mov ecx, eax
pop eax
pop eax
jg fcn.010a18ab
mov dword [ebp + 8], ebx
jb 0xb99df3
inc eax
dec dh
pop esi
inc ebp
and esp, esp
jge 0x11729d3
mov edx, dword [edi]
mov cl, byte [edi + 4]
add edi, 6
mov eax, 0x1b1871be
bswap eax
lea eax, [eax + eax*8 - 0x584489c8]
mov byte ss:[edx + eax - 0x59b54f2b], cl
not ax
lea esi, [esi + eax - 0x59b5b0d8]
mov eax, dword [esi + eax - 0x59b5b0d4]
xor eax, ebx
mov edx, 0x3c9aa3b4
inc eax
call fcn.01190c9f
jne 0xb8368f
mov ecx, 0x843bf4ab
movzx edx, cx
mov edx, dword [esi + edx - 0xf4af]
mov eax, ecx
shl ecx, 8
xor edx, ebx
and cx, ax
shl al, 1
shr cl, 0x63
rol edx, 2
bswap eax
inc edx
xadd al, ch
not edx
neg cl
lea ecx, [eax*4 + 0x52ba0e3e]
inc edx
sub cl, 0xb2
add ax, cx
push eax
bswap edx
not edx
call fcn.00b7de30
lea edx, [edx + ecx + 0x953b124]
neg al
bswap ecx
sal cl, 0xe4
ror edx, 1
or eax, 0xbd131981
bswap edx
inc ecx
jge 0xb18cb4

Function at 0xb3447b
Capabilities:
Encode data using base64

Disassembly:
mov byte [eax], cl
mov dword [esp], 0x2185250e
mov eax, dword [esi + 1]
neg dx
push edx
jns 0xba0223
xor eax, ebx
dec byte [esp + 4]
ror eax, 1
mov ecx, edx
add eax, 0x7e37773a
call fcn.01017c49
xor edx, 0x900b742f
not edx
shl byte [esp + 0xb], 1
neg cl
xor ebx, edx
add edi, edx
mov ecx, dword [ebp]
mov eax, dword ss:[ecx]
mov ecx, 0xce83e600
dec cx
mov dword [ebp], eax
lea eax, [ecx + ecx*8 - 0x6a642df9]
dec word [esp + 0xa]
inc ecx
pop eax
pop ecx
pop eax
jmp edi
Function at 0xb3580f
Capabilities:
Execute syscall

Disassembly:
neg eax
dec ecx
add edi, edi
dec eax
sub edx, eax
mov ecx, eax
inc ecx
push eax
inc ebp
movzx ecx, byte [esi + edx - 0x72e9196d]
dec ebp
lea esi, [esi + ebp - 0xa77e]
dec eax
and ebx, ebx
inc esp
xor cl, dh
dec esi
lea esp, [edx*8 + 0x742702bf]
inc ecx
rol cl, 1
call fcn.00b9692c
syscall
inc ecx
push ebx
pushfd
dec ecx
mov ebx, 0xd53d4880
mov eax, 0x4ca0bbeb
mov ebx, dword [esp + 8]
dec eax
mov dword [esp + 8], 0xbb4401fd
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.010153d2

Function at 0xb3c29e
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [edi + eax - 0x16c7fffc]
call fcn.00b6b3f3
ror dword [esp + 8], 0x12
mov edx, dword [esi]
jb 0x118ba3a
mov eax, 0xb89c77b9
adc esi, 4
xor edx, ebx
movzx ecx, al
bswap edx
lea ecx, [ecx*2 - 0x38d3c567]
mov dword [esp + 4], ecx
dec edx
mov dword [esp], eax
neg edx
sub edx, 0xa4987d02
sar dword [esp + 5], 0x88
sets al
adc ecx, ecx
bswap edx
sal ecx, cl
sub ax, word [esp + ecx - 0x57ffffa]
ror edx, 2
xor ebx, edx
call fcn.01005d15
xor eax, eax
lea esi, [esi + eax*8 + 4]
xor edx, ebx
shl al, cl
setno al
rol edx, 2
inc cl
jns 0x101ebac
sub edx, eax
xor edx, 0xca2d9f90
shl eax, cl
add ecx, ecx
call fcn.00b6eac1
mov eax, 0x7c0ec5b2
mov edx, dword [edi + eax - 0x7c0ec5b2]
mov ecx, eax
sal eax, cl
jp 0xaf43c0
mov eax, dword [esp + ecx - 0x2925c7c]
mov dword [esp + ecx*2 - 0x524b900], edi
ret 0xc
movzx eax, byte [ecx + esi - 0x7f35a000]
call fcn.00b30d90

Function at 0xb3fa2d
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
call fcn.00ad19b5
inc ecx
movzx ebp, ax
inc ecx
ror ecx, 2
inc ecx
not ecx
jmp 0xfa7e44
not ecx
mov dword [esp], 0x91207c86
not dword [esp]
lea eax, [edx + edx*4 - 0x20c3d15b]
mov dword [edi + eax - 0x7345cac3], ecx
or edx, 0x57251b01
sal dl, 0xe2
mov ecx, dword [esi + eax - 0x7345cac3]
lea esi, [esi + eax - 0x7345cabf]
neg ax
jge 0xb33682

Function at 0xb3fc1a
Capabilities:
Encode data using base64

Disassembly:
push 0xba156317
add edx, 0xa6aee38a
neg byte [esp + 2]
mov eax, 0xe3a337bf
rol edx, 3
rol word [esp + 2], 0xee
push eax
xor edx, 0x42ba4114
mov dword [esp + 8], eax
sub edx, 0x32862e89
bswap eax
inc dword [esp + 3]
lea ecx, [eax*4 + 0x4a8978b9]
rol edx, 1
push ecx
call fcn.0112394c

Function at 0xb44a15
Capabilities:
Encode data using base64

Disassembly:
inc edx
sub al, 0xbe
mov ecx, 0x3906d415
mov dword [esp + edx - 0xea5ca1], 0x4822a00b
xor dword [esp + edx - 0xea5ca1], ecx
ror al, 1
lea ecx, [edx + edx*4 - 0x365bd9f5]
call fcn.00b772fe

Function at 0xb5036b
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov esi, dword [esp + eax*2 - 0x14c]
push edx
inc cx
shr eax, 0xac
dec eax
arpl bp, bp
inc ebp
movzx edx, di
dec eax
adc edi, ebp
dec esi
mov ebx, dword [edx + ebx - 0x6223ffab]
pop edx
pop eax
inc ecx
pop eax
jmp fcn.00b112ff