joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10149466
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edi + eax*4 - 0x3fffffc]
xor ax, ax
bts eax, eax
mov dword [ecx + eax - 0x1000001], edx
mov dword [esp + eax*2 - 0x2000002], 0x2eabee3c
movzx ecx, byte [ebp + eax*8 - 0x8000004]
pop edx
dec ax
jns 0x1025904c
lea ebp, [ebp + eax*8 - 0x7fffffb]
xor cl, bl
add cl, 0xa5
push edx
neg cl
cbw
xor cl, 0x3f
shr dl, 0x87
cdq
pop eax
inc cl
bts ax, dx
xor bl, cl
add ecx, esp
or edx, dword [ecx + eax - 0x2eabee3d]
lea eax, [eax - 0x1c5f3af7]
shl eax, 0xe
mov dword [edi + eax - 0x2cd17ffc], edx
shr ax, 0xcf
movzx edx, al
add eax, edx
lea edi, [edi + eax - 0x2cd0fffe]
jmp esi

Function at 0x10167cde
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + eax - 0x15ce1452]
shr al, 0x61
dec byte [esp + eax - 0x15ce1429]
shr dword [esp + eax - 0x15ce1425], 0xa1
xor cl, bl
push eax
not cl
btr eax, eax
dec eax
xchg dword [esp + eax*4 - 0x57385098], eax
dec cl
neg cl
sal dword [esp + eax*4 - 0x72fd600e], 0x37
shr al, 0xc3
ror cl, 1
rol byte [esp + eax*2 - 0x397eaffc], 0xc3
xor cl, 0x34
inc byte [esp + eax*2 - 0x397eaff9]
neg cl
add eax, dword [esp + eax*2 - 0x397eaff8]
jns 0x100b8dec
call fcn.10169a84
dec eax
sub ebp, 4
inc ecx
mov edx, 0x5d9ec414
inc ebp
mov ebp, dword [edx + ebp - 0x5d9ec414]
inc ebp
xor ebp, ecx
inc ecx
bswap ebp
inc ecx
not ebp
mov eax, 0xa638a8ad
cwde
inc edi
lea ebp, [ebp + edx*2 - 0x6db3b6f0]
inc ecx
ror ebp, 1
dec ebp
lea esp, [edx + eax*4 - 0x7ad85a68]
inc edi
lea ebp, [ebp + edx*2 + 0x3043b573]
inc ecx
push ecx
inc esp
movzx ebx, al
inc esi
xor dword [esp + ebx - 0xad], ebp
inc ecx
pop ecx
inc ecx
movsx edi, sp
dec ecx
sar edx, 0xf5
inc ecx
movsx esi, bl
dec ebp
arpl bp, bp
inc esp
mov esi, edi
inc cx
sbb esp, 0x814151b1
in al, dx
xor eax, 0x499e3608
adc ebx, ebp
dec esp
xadd edi, ebx
dec ebp
sub edx, ebx
dec edi
mov esi, dword [edi + edx*8 + 0x6300]
inc ecx
movzx ecx, ah
jle 0x101f82a4
mov edi, ss
in al, dx
test al, 0x40
aam 0x2d
jne 0x100b8eb0
xchg edi, eax
fsub qword [esi - 0x685bc2b3]
fsub qword [esi - 0x686ba37b]
fsub qword [esi - 0x68b30b0b]
fsub qword [esi - 0x68db2313]
fsub qword [esi - 0x6833ab3b]
fsub qword [esi - 0x6853aab3]
fsub qword [esi + 0x5a998dad]
or ecx, ecx
leave
xchg edx, eax
insd dword es:[edi], dx
invalid
mov dword [esp + ecx*2 - 0x72fc1070], ecx
mov dword [esp + ecx*2 - 0x72fc106c], 0x7a2a2bd
lea edx, [edx + eax - 0x5b12bc78]
xor ebx, edx
add esi, edx
sar word [esp + ecx - 0x397e0834], 0x25
mov dword [esp + ecx - 0x397e0833], 0x7039a90
pop edx
mov edx, dword [ecx + ebp - 0x397e0838]
ror ecx, 0xb8
sar cl, 0x44
inc dword [esp + ecx - 0x7e0837ff]
lea ebp, [ebp + ecx - 0x7e0837ff]
neg eax
movzx ecx, byte [edi + ecx - 0x7e083803]
xor byte [esp + eax - 0x15ce144e], al
jne 0x100987a3
inc ecx
dec esi
pop es
sbb byte [esi + 6], ah
sbb eax, 0x7a183143
ljmp 0xe29e
Function at 0x1016be4d
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
and dx, 0x1ba9
movzx ecx, dx
jle 0x101d7d98
ror eax, 3
not eax
mov dword [esp + edx - 0x1688007c], edx
sal dword [esp + edx*2 - 0x2d100106], 0x9a
lea eax, [edx + eax + 0x2a1c4216]
ror eax, 3
ror dword [esp + edx*2 - 0x2d100107], 0x98
dec edx
lea eax, [eax + edx*8 + 0x245851fb]
rol eax, 3
shl word [esp + edx - 0x16880079], cl
call fcn.10158a66
mov bh, 0xe8
out dx, eax
daa
invalid

Function at 0x10188a2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec al
neg edx
and eax, 0xbcaa748f
mov dword [esp + ecx - 0x11], ecx
ror eax, 0xd9
inc edx
xor ebx, edx
xchg ecx, eax
inc ecx
neg dword [esp + ecx*2 - 0x20540e86]
add ebp, edx
jmp 0x101a2f64
rdtsc
lea esi, [ecx + esi - 0x102a074b]
sal cl, 0x85
dec ecx
mov dword [esi + ecx - 0x102a075b], eax
mov eax, 0xcb9b4abd
not ecx
mov dword [esi], edx
inc dword [esp]
cdq
pop edx
jae fcn.101b9510
mov ecx, 0x4ea4c72f
movsx edx, cl
mov eax, 0xd3198707
mov ecx, dword [esi + edx*8 - 0x178]
neg ax
call fcn.1010a698
mov eax, 0xd2288a8c
movsx ecx, al
inc cx
mov edx, dword [ebp]
ror eax, cl
lea ecx, [eax - 0x42ca7d44]
xadd cl, al
lea ebp, [ebp + eax - 0x546690fc]
rol eax, cl
xor edx, ebx
btc ecx, eax
xor edx, 0xfb2591bb
sub cx, ax
shr cx, 0x8e
ror edx, 1
ror eax, 0x56
lea edx, [ecx + edx - 0x15c74eaa]
sbb al, al
neg eax
cwde
not edx
xor ebx, edx
imul eax, ecx
lea eax, [ecx*8 + 0x64023025]
rol cl, 0x47
adc esi, edx
mul ecx
dec eax
btc edx, 0x89
movzx ax, byte [edi + ecx*4 - 0x46700000]
or cl, byte [edx + edi - 0x1091cd05]
push edx
sub edx, dword [esp + edx*2 - 0x21239a0e]
ja 0x101b0d7f
lea edi, [edi + edx + 2]
inc edx
add dword [esp + edx - 1], edx
jns 0x1025ab15
inc ecx
mov edx, dword [edi]
inc ebp
mov eax, dword [edi + 4]
inc ecx
mov cl, byte [edi + 8]
inc ecx
mov ebx, 0x3db87ea6
dec esi
lea ebp, [ebx*8 - 0x2140e344]
inc ecx
push ebx
dec edi
lea edi, [edi + ebx*2 - 0x7b70fd46]
inc edx
not byte [esp + ebx - 0x3db87ea0]
dec edx
lea esi, [ebp*2 + 0x62240aa4]
inc ebp
movsx esp, bl
inc esp
shld edx, eax, cl
inc esi
movzx eax, word [esp + ebx - 0x3db87ea5]
inc edx
not byte [esp + ebx - 0x3db87e9f]
inc ebx
mov dword [edi + ebx - 0x3db87ea6], edx
neg ecx
dec word [esp + ecx - 0x32614bce]
lea eax, [ecx + eax + 0x2f4f76d3]
sbb dx, 0x1688
shr al, cl
dec edx
mov word [edx + edi], ax
movzx ecx, dl
movsx eax, word [esp + edx*2]
shr edx, 0x3c
mov dword [esp + edx], esi
ret
Function at 0x10195f59
Capabilities:
Encode data using base64

Disassembly:
push 0xd48242ba
push ecx
mov ecx, dword [esp + 4]
pushfd
test ch, cl
push edx
mov dword [esp + 0xc], 0x88145440
mov ecx, dword [esp + ecx*2 + 0x56fb7a94]
mov edx, 0xb4179695
call fcn.1023c974
retf
mov edx, dword [esp + edx + 0x4be86973]
jno 0x1024d630
jbe 0x10195f70
add dl, bh
cli
inc ebx
popal
ja 0x10195f63
pop dx
or cl, cl
test dword [esi + 0x11083db1], esp
imul esi, dword [edx + 0x5083db1], 0x7e82325d
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
jae 0x10195f53
pushal
hlt
jb 0x10118e60
jbe 0x10118e4a
call fcn.10212efd
mov edx, 0x9ab52c0f
mov ecx, dword [ebp]
bts edx, edx
lea eax, [edx + edx*4 + 0x672958a3]
rol eax, 0xfd
adc ebp, 3
lea edx, [eax*2 + 0x163ff5ab]
xor ecx, ebx
rol dl, 0x63
bswap ecx
cwde
setae dl
inc ecx
call fcn.101d0d7a

Function at 0x1019c817
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ebp
lea ebp, [edx + edx - 0x36eff363]
dec edi
lea edi, [edi + eax - 0x39c500fd]
mov edi, 0x3fb869a1
jbe 0x1021c2f5
add ebp, eax
movzx eax, cl
jmp ebp
inc esi
and dword [esp + eax*2 - 0x738a01f2], eax
sal esi, cl
inc bp
imul eax, eax
inc ebx
mov dword [edi + eax - 0x39c5fe01], esi
call fcn.102b2ecb
mov ebx, dword [esp + edx - 0xc]
mov eax, edx
lea edi, [edx + edi - 0x14]
lea ecx, [edx + eax*4 + 0xc1a12bf]
mov edx, dword [edx + edi - 0x10]
and dword [esp + eax*2 - 0x20], 0x5f84a5bf
xor edx, ebx
xor eax, 0xdfbe0d37
mov dword [esp + ecx - 0xc1a130b], 0x363bb3b2
bts ecx, eax
lea edx, [edx + eax + 0x1ee6ec8d]
dec eax
not edx
neg edx
btr ecx, ecx
sbb edx, 0xa0abf9a2
inc eax
bts eax, eax
not edx
adc ecx, ecx
xor ebx, edx
shr word [esp + ecx - 0x1834271e], 0xc1
adc ebp, edx
pop edx
or dword [esp + ecx*4 - 0x60d09c78], eax
pop ecx
jp fcn.101b9510

Function at 0x101a158e
Capabilities:
Execute anti-debugging instructions

Disassembly:
and eax, 0xfffffffc
mov dword [esp], 0x7037971b
sub eax, ecx
jmp 0x10299ac1

Function at 0x101b32ce
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + eax - 0x4c03143c]
movzx ecx, al
call fcn.10001dc3
setae al
not ecx
btc ax, 0x28
and eax, dword [esp + eax*2 - 0x1fc]
and edx, ecx
sar ax, 0x28
mov dword [esp + eax - 1], 0xb88ed09
mov dword [ebp + eax + 3], edx
xchg dword [esp + eax + 3], eax
and byte [esp + 1], ah
movsx edx, ax
mov edx, dword [edi + 4]
adc edi, 8
sal al, 0x83
movsx ecx, ax
cwde
xor edx, ebx
ror dword [esp + 1], cl
inc edx
call fcn.100b3203
call fcn.101ca0a4
mov eax, 0x1300c511
shr eax, 0xe1
mov edx, dword [edi + eax*2 - 0x1300c510]
rol eax, 0x43
jne 0x10161fcb
Function at 0x101c40ed
Capabilities:
Encode data using base64

Disassembly:
jmp ebp
jns 0x1018c221
lea eax, [edx + eax - 0x427313fb]
bt dx, 0x8d
not cl
xor ebx, eax
add edi, eax
xor dx, cx
mov ecx, dword [ebp + edx - 0x39485b86]
mov dx, word [edx + ebp - 0x39485b82]
adc ebp, 6
mov eax, 0x80871a99
not ax
mov word ss:[ecx], dx
movsx edx, ax
jmp edi
neg ecx
xor dl, bl
cwde
sar eax, cl
xchg ah, cl
sbb dl, 0x9c
not dl
xchg cx, ax
inc cx
add dl, cl
ror dl, cl
xor bl, dl
shl ecx, cl
add edx, esp
mov eax, dword [eax + edx - 0xe000]
lea edx, [ecx*4 + 0x5bb28e2f]
jmp 0x1027b5f0
bswap eax
dec eax
push ecx
call fcn.101ab7a5
xor eax, 0x2ebad2a9
neg eax
inc ecx
shl dl, 0xa1
bts ecx, 0xbd
xor ebx, eax
neg dx
sbb ecx, edx
xadd cx, dx
add ebp, eax
xchg ch, dl
add cx, dx
mov ecx, dword [esi + ecx - 0x1fff997a]
mov al, byte [esi + edx*2 - 0x1d7d2]
or dx, 0xa73d
lea edx, [edx + edx*4 + 0x270b142e]
lea esi, [esi + edx*2 - 0x4e1f884c]
ror dx, 0x2a
mov byte ss:[ecx + edx - 0x270f0a71], al
jp 0x10045574
bt ecx, edx
inc eax
bswap eax
sub ecx, ecx
sbb cx, 0x210d
xadd dword [esp + ecx - 0xdef3], ecx
xor ebx, eax
ror edx, cl
add ebp, eax
rol cl, 0xa5
push ecx
dec dword [esp + 3]
pop ecx
pop ecx
jg fcn.101b9510
call 0x101f95f7
neg eax
or dx, cx
lea ecx, [eax + eax*8 - 0x21400d73]
mov word [ebp + eax - 0x6ec45f01], dx
mov dword [esp + eax - 0x6ec45f01], 0xaeba0b93
mov edx, 0x1a3a6fa8
or dword [esp + eax - 0x6ec45f01], ecx
mov dword [esp + edx - 0x1a3a6fa8], esi
ret 4
mov edi, dword [esp + ebp - 0xff8e]
neg edi
call fcn.100f5916
lea eax, [eax + ecx*2 - 0x227f85a5]
not ecx
je 0x1010e4e4
ror eax, 2
and edx, edx
bswap eax
inc eax
ror ecx, cl
not cx
inc cx
rol eax, 3
sar ecx, cl
adc cl, dl
jno 0x100e97bc
mov eax, dword [esi]
add esi, 4
mov edx, 0x46aca91f
xor eax, ebx
push edx
dec eax
rol eax, 2
or word [esp + edx - 0x46aca91e], dx
lea ecx, [edx*2 - 0x75664f41]
or cl, dh
dec eax
lea ecx, [edx + ecx*4 + 0x4eb3321c]
shl dl, 0xa7
xor dh, byte [ebx - 0x581d3fb2]
jbe 0x10182c78
mov eax, dword [0xf4dc8a4c]
mov ah, 0xdc
les eax, [edx + ebx*2 - 0x38]
mov ah, 0xdc
les esi, [edx + ebp*2 - 8]
mov ah, 0xdc
les eax, [edx + 0x7e]
je 0x101c4151
mov bl, 0xc4
dec eax
jbe 0x101c41c1
retf
push esp
and al, 4
jle 0x10087394
xor edx, ebx
btc ecx, ecx
or ecx, ecx
lea edx, [ecx + edx + 0x87c588d]
btc ax, cx
btr cx, 0x3e
neg edx
not eax
xadd cl, ch
bswap edx
rol edx, 2
ror eax, cl
not al
cbw
inc edx
rol edx, 1
dec eax
not ecx
xor cl, al
xor ebx, edx
add edi, edx
mov edx, eax
mul dx
jo fcn.101684c6
lea ebp, [edx + ebp - 0x6ad96e3b]
add dx, dx
xor cl, 0x15
mov dword [ebp + edx - 0x6ad9dc6e], eax
dec cx
shl edx, 0x57
shl edx, cl
add edx, dword [edx + esi]
shr cl, 5
lea ecx, [ecx + ecx*4 + 0x6f396a06]
adc esi, 3
xor ecx, 0x57b2a921
movzx eax, cl
js 0x101c83e1
sysexit
out dx, eax
nop
insb byte es:[edi], dx
aam 0x2e
pop esi
aaa
scasd eax, dword es:[edi]
invalid
Function at 0x101e6e56
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, 0x5881cd27
bt edx, eax
mov dword [esp + eax - 0x2ab2509], 0xe6331885
sar dl, 1
dec ecx
rol edx, 0x99
not ecx
bts ax, ax
ror dword [esp + eax - 0x2ab2534], 0x47
xor ebx, ecx
div al
inc dword [esp + eax - 0x2ab26a8]
sar byte [esp + edx*4 - 0x5000011b], 0xc2
adc ebp, ecx
sar dword [esp + eax*2 - 0x5564d5f], 0xf6
add dword [esp + eax - 0x2ab26ae], edx
and ax, word [esp + eax - 0x2ab26a5]
pop ecx
pop ecx
pop edx
pop ecx
jne fcn.10232a4d
mov eax, 0x88ad7e36
xor ax, ax
rdtsc
sbb ebp, 8
call fcn.102af144
sub eax, 0x390ced0
jl 0x101037b6
add edi, dword [ebp + edi*8 - 0x62]
sahf
push 0xffffffffffffffa6
push ebx
jl 0x101037bc
sahf
bound ebx, qword [eax - 0x610283c5]
xchg edx, eax
xchg esp, eax
pop ds
pop ds
mov esp, 0x83a02a9e
fst dword [esp + ebx*4]
or eax, 0xe4f6a46a
sub eax, 0xfff7527c
int1
xchg ebx, eax
invalid
shl dword [esp + eax - 0x2ab2509], 0x9b
mov ebx, dword [esp + eax - 0x2ab2505]
mov ecx, dword [edi + eax*4 - 0xaac9454]
movsx edx, al
lea edi, [eax + edi - 0x2ab2511]
mov dword [esp + eax*2 - 0x5564a26], 0xd8346c36
neg dl
xor ecx, ebx
imul dx, word [esp + eax - 0x2ab250e]
and dl, byte [esp + eax - 0x2ab2507]
pop edx
adc ecx, 0xf3a41d24
bts eax, eax
movsx edx, ax
jb 0x1010373e

Function at 0x101ea4ef
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [ebp + edx - 0x44ba5094]
and edx, edx
rol dx, 0x67
and edx, 0x4c80e49c
lea ebp, [ebp + edx - 0x44804402]
setne dl
not edx
sar dx, 0x8f
mov byte ss:[eax], cl
mov dword [esp], 0x45ac8790
jne 0x1025e07b
mov ecx, dword [esi]
dec edx
lea eax, [edx + edx*4 - 0x3cccdf50]
lea esi, [esi + eax - 0x6cb320a2]
xor ecx, ebx
ror ecx, 2
add edx, eax
dec ecx
ror ecx, 1
imul edx, dword [esp + edx - 0x283320a4]
dec word [esp + eax - 0x6cb320a4]
call fcn.1019a501

Function at 0x101fdd6c
Capabilities:
Encode data using base64

Disassembly:
xor dl, 0x9c
call fcn.100c3b82
mov ecx, 0xad349297
jmp 0x101eb52c

Function at 0x1020e589
Capabilities:
Encode data using xor

Disassembly:
loope 0x1020e5c0
mul ebp
inc ecx
neg esp
call fcn.1027a4a6
sbb dl, 0x2a
ror cl, 0xa6
not dl
ror eax, cl
inc ax
ror dl, 1
neg dl
mov dword [esp + eax*2 - 0x40000040], ecx
xor bl, dl
ror byte [esp + eax*2 - 0x4000003d], cl
sar ecx, cl
lea edx, [esp + edx + 8]
shr ecx, 0x29
sbb cx, ax
mov cx, word [edx + eax*2 - 0x40000040]
rol eax, 0x59
pop ecx
call fcn.1011435d
and byte [ebp - 0x2d07fb38], al
mov esi, 0xf7e9f195
bnd jb 0x1020e57d
int1
jmp 0xb1c3c4d1
Function at 0x1020f3cb
Capabilities:
Encode data using base64

Disassembly:
xadd dl, ch
xor cl, byte [edi + ecx - 0x1437fffa]
imul edx, edx
shr eax, cl
sub edx, 0xf1150b0a
mov dword [edi + edx*4 - 0x3babd3d4], eax
mov eax, 0x8d35eab1
lea eax, [eax + edx*8 - 0x55ecfdd9]
rol dx, 0x69
lea edi, [edi + edx*4 - 0x3babb7a0]
movsx ecx, dx
mov eax, dword [edx + ebp - 0xeeaede9]
shr edx, 0xac
or cl, ch
jo 0x100f1517
lea ebp, [ebp + edx - 0xeeaa]
btc dx, dx
setb dl
inc ecx
xor eax, ebx
btr dx, cx
xor eax, 0x3594ebbb
or edx, edx
xadd edx, ecx
bts ecx, ecx
rol eax, 2
xor cl, dl
xadd dx, cx
not eax
sbb ecx, edx
sal edx, cl
btr ecx, 0x83
neg eax
sar edx, 0xfa
lea eax, [eax + edx*4 + 0x3e171368]
not eax
imul ecx, ecx
xor ebx, eax
btr edx, edx
push ecx
rol ecx, cl
add esi, eax
movsx eax, dx
mov dword [esp + edx*2 - 0x2a], esi
ret
sbb ebp, 8
mov dword [ebp + 0xc], eax
mov eax, 0x82fa6a2
xor ax, ax
not ax
mov dword [ebp + eax - 0x82ffff7], ebx
mov dword [ebp + eax - 0x82ffffb], ecx
mov ebx, 0x95b3c105
shl bx, 0x8d
lea ecx, [ebx - 0x5aefd663]
mov dword [eax + ebp - 0x82fffff], edx
mov edx, eax
and ecx, ebx
pop ebx
cwd
jae fcn.1009dcc4
mov eax, 0x9085193
mov edx, 0x809c7681
xadd eax, edx
mov ax, word [edi + edx - 0x9085193]
mov ecx, 0x143875a8
ror edx, 0x41
shl cx, 0xcf
mov dx, word [edi + ecx*2 - 0x286ffffe]
and ax, dx
not ax
movzx edx, cl
mov word [edi + ecx - 0x1437fffe], ax
ror edx, 0x8c
movsx eax, cl
adc eax, dword [edi + ecx - 0x1437fffe]
rol cl, 0xe1
jno 0x100a987f
mov eax, 0xce1bfb0c
movzx cx, byte [esi]
push eax
ror byte [esp + 2], 0xe1
inc al
mov dl, byte [esi + 2]
add dword [esp], eax
shr eax, 0xbb
lea esi, [esi + eax*2 - 0x30]
and cl, dl
rol eax, 0x9c
mul al
shl eax, 0xb3
not cl
xchg dword [esp + eax*8 - 0x400000], eax
movzx edx, al
mov word [esi + edx*4 - 0x64], cx
movsx ecx, byte [esp + edx*8 - 0xc8]
bt ecx, 0x3d
or ecx, dword [edi + edx*2 - 0x32]
shl edx, 0x26
push eax
lea edi, [edi + edx*4 - 0x18fc]
xor ecx, ebx
ror ecx, 1
neg ecx
rol ecx, 2
xchg dx, ax
not edx
dec ecx
dec eax
xchg ah, dl
bswap ecx
cwde
mul edx
pop eax
xor ebx, ecx
shr dl, 0xa5
push edx
bts ax, ax
add ebp, ecx
imul edx
mov dword [esp + edx - 0x69ed], ebp
ret 4
and ecx, 0xf4b2761b
mov edx, 0xf0aac3af
mov ecx, dword [ecx + ebp - 0x240201fe]
sub edx, 0x2a11499d
push ebx
sbb dx, dx
cpuid
jge 0x101cdc86
push 0xbb1cb925
jmp fcn.100e55d6
pushfd
add dword [esp + 0xc], 0xefe51cf5
push ebx
mov dword [esp + 0x10], 0x560c3659
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.1016187c
mov edx, dword [edi]
mov ecx, 0x982b8bb0
push ecx
inc cx
add edi, 4
pop eax
xor edx, ebx
sub cl, ah
add ax, cx
and ecx, eax
bswap edx
not edx
inc edx
cwde
xchg ch, cl
rol edx, 3
xor ebx, edx
lea ecx, [eax + eax*4 + 0x2e884a0a]
add esi, edx
rol ecx, 0x6e
mov eax, dword [ebp + ecx*2 - 0x5e1c1744]
jae 0x1020e1fa
Function at 0x10227c85
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x47a64b3], ecx
jg 0x10204189
mov ecx, 0xf73346ac
jge 0x102a1688
push dword [esp + 8]
popfd
mov dword [esp + edx - 0x2000ffff], ebp
ret 8
btc edx, 9
adc ebp, ecx
mov dword [esp + edx*2 - 0x400], eax
mov ecx, dword [edx + esi - 0x200]
shl edx, 0x94
sbb dword [esp + edx*2 - 0x3ffffffc], eax
dec dx
lea esi, [esi + edx*2 - 0x4001fffa]
or al, 0x9a
js 0x101b034d

Function at 0x1023369a
Capabilities:
Encode data using xor

Disassembly:
push 0x39adf53f
jmp 0x10288134
push 0xb93af28e
dec dword [esp]
dec ebx
push 0x3bb6a81
jmp 0x1012167a
sar cx, 0xef
neg al
lea ecx, [ecx - 0x1f6faccf]
ror al, 1
and cx, word [esp + 2]
sub word [esp + 2], cx
add cx, word [esp + 1]
xor bl, al
xadd word [esp], cx
bt cx, cx
lea eax, [esp + eax + 4]
shr cl, 0x82
mov byte [eax], dl
movzx ecx, byte [edi + 5]
call fcn.101785e3
lodsb al, byte [esi]
mov edi, es
in eax, 0x16
pop ebx
dec esp
mov dl, 0x1d
push ecx
pop esp
rcl dword [ecx - 0xd], 0x21
push ecx
pop ecx
xor dword [0x3e4c9e2a], 0x16
mov eax, 0x1c729a2c
outsb dx, byte [esi]
sbb edi, dword [ebp + 0x12]
ja 0x1010e918
invalid
add esi, ecx
mov dword [esp + eax], esi
ret
lea esp, [esp + 8]
jne 0x1028813e
mov eax, 0x69b202ac
mov eax, dword [ebp + eax - 0x69b202ac]
call eax
mov ebp, dword [ebp - 4]
call fcn.101a4eeb
sbb eax, dword [si + 0x32dc]
jecxz 0x10121674
les ebx, [edx - 0x2d1cf568]
les ebp, [esp + edx*4 - 0x3b2d1cfa]
mov dl, 0x90
bound edi, qword [edx]
rol esp, 0xa8
in al, 0xc0
aad 0x38
cmp al, 0x81
mov edx, 0xd2414abd
add dword fs:[edi + 0x3a], esi
push ss
pop edx
scasd eax, dword es:[edi]
rcr ah, 1
outsd dx, dword [esi]
pop ecx
add eax, dword [edx]
add dword [ecx + 0x1ae30097], edi
sbb al, 0x10
insb byte es:[edi], dx
push ecx
sub bl, byte [edx - 0x15]
invalid
shl byte [esp + 6], 0xe4
mov dword [ebp - 4], eax
push 0x45bf03a9
push 0xdb1d9a08
test ebx, ebx
jmp 0x10042b67
lea esp, [esp + 0x14]
je 0x10121684
mov eax, 0xc30af183
bt eax, eax
mov eax, dword [ebp + ebx*4]
push 0x2e3c95b1
mov word [esp], 0xbbab
mov dword [esp], eax
jae 0x1007a4f0
adc al, 0xb
or ecx, ecx
ror al, 1
dec cl
js 0x1010e8d0
pop esi
pop esi
call 0xdabced43
lds ebx, [esi - 0x3563f6d3]
lds ebx, [esi - 0x3507a85b]
lds ebx, [esi - 0x350fb8a7]
lds ebx, [esi - 0x3533a097]
lds ebx, [esi - 0x350bae6b]
lds ebx, [esi + 0x7de823cd]
mov al, byte [0xa75c629f]
mov cl, 0x24
adc ah, dh
sahf
ret

Function at 0x10246074
Capabilities:
Encode data using base64

Disassembly:
dec eax
add ebx, edx
inc ecx
bts edx, 0x3a
dec eax
mov dword [esp + eax - 0xa58713], ebx
ret 8
dec eax
mov dword [esp + eax + 0x3f00], edi
inc esp
xchg byte [esp + eax + 0x3f03], ah
xor dword [esp + eax*4 + 0xfc08], edx
add eax, 0xa5c613
dec esp
mov ecx, dword [esp + eax*2 - 0x14b0e1e]
dec eax
arpl dx, dx
inc esp
adc dh, byte [esp + eax*4 - 0x2961c45]
jb 0x100e5010
Function at 0x10247e23
Capabilities:
Encode data using base64

Disassembly:
xor ebx, edx
add esi, edx
mov dword [esp + ecx - 0x37be0000], 0x8929d85
mov edx, dword [esp + ecx - 0x37bdfffd]
and byte [esp + ecx - 0x37bdfffa], dl
add cx, word [ebp + ecx*2 - 0x6f7c0000]
mov ax, word [ebp + 2]
bswap edx
add dl, dl
lea ebp, [edx + ebp - 0x80094a2]
ja 0x100fa0a9
sar dx, 0xe4
not byte [esp + edx - 0x800f947]
not cx
dec edx
rol dl, 0x41
cmovnp dx, word [esp + edx*4 - 0x2003e643]
not ax
pop edx
or dx, dx
or cx, ax
and dword [esp], 0xf528df02
mov word [ebp], cx
jno 0x1028f487
xor edx, edx
and dx, 0x524
mov dword [esp + edx*8], esi
ret

Function at 0x1025b397
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
rol ecx, cl
sbb eax, 0x56800d36
jmp 0x102806f6
sar ecx, cl
adc eax, 0x171bcc08
pop ecx
not ecx
push edx
rol eax, 3
imul dx, cx
jb 0x100033c0
adc ebp, edx
lea eax, [ecx + ecx*8 - 0x4ae939e9]
shl cx, 0xe
lea edx, [ecx*8 + 0x5fbea88f]
lea edi, [edi + ecx - 0x399f0001]
xchg ecx, eax
movzx ecx, byte [eax + edi - 0x399f0000]
imul dword [esp + eax - 0x399efffc]
seto dl
xor cl, bl
add cl, dl
xor cl, 0x80
mov dword [esp + eax*2 - 0x6b820000], 0x6d1aec36
sal dl, 0x87
xor edx, dword [esp + eax - 0x35c0ffff]
rol cl, 1
and dword [esp + eax - 0x35c0ffff], eax
inc edx
sal dword [esp + eax - 0x35c0fffc], 0x72
inc cl
neg cl
rol al, 0xa6
cmovae ax, dx
not cl
inc al
lea edx, [eax + edx*8 + 0x2800afb3]
xor bl, cl
lea ecx, [esp + ecx + 8]
shl dx, 0x6b
add ax, word [esp + eax*2 - 0x6b8250da]
jle 0x10045983
movzx ax, byte [ecx + edx - 0x58db4800]
movsx ecx, dl
lea esi, [esi + ecx*2 - 2]
xor cx, dx
mov word [esi + edx - 0x58db4800], ax
pop ecx
pop edx
jp fcn.101b9510

Function at 0x102609e5
Capabilities:
Encode data using base64

Disassembly:
xor ebx, edx
dec eax
xchg ch, cl
add ebp, edx
pop ecx
movzx edx, al
call 0x1004bbe7
Function at 0x1026f254
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + ecx - 0x175ea3]
mov dword [esp + 8], 0x56dc3717
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.1016187c
movsx eax, dx
mov eax, dword [edi + edx - 0x731d05a4]
inc cl
dec edx
sal cl, 1
xor eax, ebx
dec cx
ror dl, 1
sbb eax, 0xfe9cb900
inc dl
xor dl, dl
cmovs ecx, edx
xor eax, 0x51ba8cbd
sub dx, 0x19
dec ecx
sbb edx, ecx
bswap eax
lea edx, [ecx - 0x51cd8e5f]
rol eax, 1
bt dx, dx
xor ebx, eax
and cl, ch
call fcn.100b537f
cmp dword [esi - 0x235dd9d3], 0x2411b2a
ror byte [eax + 0x7c411b2a], 1
jg 0x1026f298
invalid

Function at 0x10277c3e
Capabilities:
Encode data using base64

Disassembly:
and esi, 0xff
ror dword [esp], 0xdf
mov esi, dword [esi*4 + 0x10297ff4]
shr eax, 8
sal dword [esp], 0x7e
xor eax, esi
inc edx
ror byte [esp + 1], 0x83
xor eax, 0x72314b2d
not word [esp + 2]
dec ecx
jmp 0x102a5398
movzx esi, byte [edx]
xor esi, eax
mov dword [esp], 0xa8131437
inc byte [esp]
jno 0x101158a7
lea edx, [edx + 0x34220ea5]
seta byte [esp + edx*2 - 0x68441f43]
lea esi, [esi + edx*2 - 0x68441f42]
call fcn.1016fd52
lea esp, [esp + 4]
jne 0x1018d9e0
mov edx, 0x1e9d50aa
movzx esi, dx
lea ecx, [edx*4 - 0x5db08ca]
pop esi

Function at 0x1027ed68
Capabilities:
Encode data using base64

Disassembly:
add dl, al
bt ax, 0
xchg dword [esp + 7], eax
ror dl, 1
inc al
sub dl, 0xa4
xchg cx, ax
push eax
xor ecx, ecx
rol dl, 1
neg eax
xor bl, dl
lea edx, [esp + edx + 0x10]
push eax
shr byte [esp + ecx + 0xd], 0x27
adc word [esp + ecx + 7], ax
or cl, byte [edx + ecx*4]
movsx edx, word [esp + 0x10]
neg eax
mul word [esp + eax - 0xfff1]
lea ebp, [ebp + eax*2 - 0x1fe02]
jae 0x102ae341
bts eax, 5
rol dl, 0xa5
mov word [ebp + eax*2 - 0x1fe40], cx
shl dl, 0x62
je 0x1015f7d8
pop eax
pop edx
pop ecx
pop edx
pop edx
js fcn.101684c6
not cl
sal word [esp + 0xb], 0x24
sbb cl, dl
not dword [esp + 8]
pop edx
neg word [esp + 1]
xor bl, cl
push edx
or edx, 0xbd236f07
sar dl, 0xa4
lea ecx, [esp + ecx + 0x14]
sbb dword [esp + 2], 0xb32f538d
xadd dl, dh
sbb dl, byte [esp + 0x12]
mov dword [ecx], eax
lea eax, [edx*4 - 0x21e79c58]
dec eax
pop ecx
pop ecx
pop edx
pop eax
pop ecx
jmp ebp
mov dword [esp + 4], edx
pop edx
add cl, 0xb
shl dx, 0xca
jns 0x10151307
mov ebp, dword [ebp - 4]
mov dword [esp], 0xcf81291e
sar word [esp + 2], 0xd
mov dword [ebp], eax
sar byte [esp + 1], 0xe2
mov edi, ebp
mov edx, 0x8e30361c
mov ebx, dword [esp + 4]
movzx ebp, byte [esp]
imul ebp, ebp
mov esi, dword [esp + ebp - 0x37c]
mov ebp, dword [esp + ebp - 0x378]
mov dword [esp + 8], 0x9ebd27a2
pop eax
setno dl
mov eax, dword [ebp]
sal dword [esp + 4], 0x78
or edx, dword [esp + 4]
adc ebp, 4
lea ecx, [edx*8 - 0x4e66bde8]
inc edx
jns 0x100c3b14
xor eax, ebx
btr cx, 0x28
sbb cl, cl
ror eax, 1
push edx
shr edx, 0x52
bswap eax
xor cl, dh
inc eax
call fcn.100c4283