joyce8/EMBER2024-capa huggingface dataset:
Function at 0x910423
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub eax, 0xb61e8887
ror eax, 3
sub eax, 0x803ff41d
xor ebx, eax
dec ecx
mov dword [esp + edx - 0xc1], ecx
and dl, 1
adc ebp, eax
rdtsc
sub edi, 8
and byte [esp + 2], cl
pop ecx
mov dword [edi + 4], eax
sbb ecx, ecx
xor ecx, 0x1536ad95
mov dword [edi + ecx*4 - 0x54dab654], edx
jno fcn.0091626b
xor bl, al
mov dword [esp], esi
inc dl
push edi
push ebx
movsx ebx, dl
mov ebx, eax
call fcn.00cd911b
neg dword [esp]
add esi, 4
mov edx, dword [esp]
or edx, edx
xor eax, ebx
call fcn.00d4e83b
add esi, 4
xor eax, ebx
movsx ecx, dl
not eax
xchg dl, cl
push edx
sal ecx, cl
bswap eax
neg edx
sar edx, 0x36
jb 0x89a324
xor eax, ebx
lea eax, [ecx + eax - 0x558c1926]
bswap eax
not eax
pop ecx
rol eax, 3
mov edx, 0x5d224e3b
bswap eax
call fcn.00d1dea9
mov eax, 0x12f981c
sar al, 0x44
mov eax, dword [esi + eax*2 - 0x25f3002]
mov edx, 0xcf9e653c
jnp 0x8acb56
mov cl, byte [ebp + ecx*4 - 0x1f6dc]
shr eax, cl
lea ecx, [edx - 0x64e71ded]
call fcn.00dbad4b
sbb dl, 0x13
shl eax, 0xfa
xor ecx, ebx
jmp 0x85d9d6

Function at 0x92132b
Capabilities:
Encode data using base64

Disassembly:
inc di
mov dword [edi + ebp*2 + 0x483da606], esp
dec edi
lea edi, [edi + ebp*2 + 0x483da606]
pop esi
inc ecx
pop eax
inc ecx
pop esi
pop eax
pop ecx
pop ecx
inc ecx
pop ecx
jae fcn.00d3b80a
ror dl, 1
pop eax
add dl, 0x8d
call fcn.007fd060
mov ecx, 0xa3bf7420
mov ecx, dword [ebp]
mov edx, dword [ebp + 4]
mov eax, 0x572b8d25
sar ax, 0x69
lea ebp, [ebp + eax - 0x572bffbe]
mov dword fs:[ecx + eax - 0x572bffc6], edx
mov edx, dword [esi + eax - 0x572bffc6]
lea esi, [eax + esi - 0x572bffc2]
xor edx, ebx
movsx ecx, al
call fcn.00818ad5

Function at 0x922d40
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
not dword [esp + edx - 0x58d60faa]
shr byte [esp + edx - 0x58d60fa7], 0x67
mov dword [esp + edx - 0x58d60fb2], edx
adc edi, eax
shr dword [esp + edx - 0x58d60fb2], 0x71
lea ecx, [edx*4 + 0x2e188c2d]
mov dword [esp + edx - 0x58d60fae], ecx
movzx dx, byte [edx + ebp - 0x58d60fb2]
inc ecx
movzx eax, byte [esp + 8]
mov cl, byte [ebp + eax - 0xdf]
lea ebp, [ebp + eax*8 - 0x706]
sbb dword [esp + eax - 0xd9], eax
not eax
and dl, cl
sar dword [esp + 3], 0xd7
movzx ecx, ax
add al, cl
not dl
sbb cl, 3
jge 0xd03001
Function at 0x922dad
Capabilities:
Encode data using base64

Disassembly:
inc esp
xadd dl, cl
dec esp
mov dword [esp + eax - 0x1e40000], ebx
jb 0xd66043
bswap ecx
xadd ax, dx
lea edx, [edx*2 - 0x48f84fd5]
ror ecx, 3
call fcn.008796d3
adc al, 0xa6
insb byte es:[edi], dx
pop ecx
fmul dword [ecx - 0x1ae459c6]
test eax, 0x1ba67271
in eax, 0x41
cdq
sbb ah, byte [esi + 0x1901e51b]
cmp ah, byte [esi + 0x7039e51b]
shl byte [esi + 0x2030e51b], cl
xchg edx, eax
cmpsb byte [esi], byte es:[edi]
sbb esp, ebp
clc
loope 0x922e01
cmpsb byte [esi], byte es:[edi]
sbb esp, ebp
or al, dl
xor ah, byte [esi - 0x261f1ae5]
in eax, 8
sal byte [edx], 1
cmpsb byte [esi], byte es:[edi]
sbb esp, ebp
loopne 0x922de3
lcall 0x2160, 0x21e51ba6
je 0x922e3d
salc
lfs edi, [edx]
push 0xea28c0c0
mov edx, 0xe9517e0b
cmpsb byte [esi], byte es:[edi]
mov dword [0xa9b28161], eax
test eax, 0x906f8f71
jne 0x922e20
push ecx
jmp 0x81f3d1cc
hlt
ret
dec cx
inc esp
xor dword [esp + eax*2 - 0x3c80000], ebp
call fcn.00d4d39f

Function at 0x923a46
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x436b1adc], 0x683f158e
mov esp, 0x683f158e
add ebp, ecx
mov edi, dword [edi + eax - 0x436b1ae0]
call fcn.0089b9d9
mov word [edi + edx*2 - 0x762c8000], ax
mov ecx, dword [esi + edx*2 - 0x762c8000]
ror dx, 0x48
xadd dl, dh
lea esi, [esi + edx - 0x3b16403c]
xor ecx, ebx
xor ecx, 0x1103b226
call fcn.00cf6a9b
cmp eax, 0xa7961370
les edx, [esi + 0x7d]
mov ah, 0x1f
mov bh, 0x84
push esi
jge 0x923a4c
wait
outsd dx, dword [esi]
int3

Function at 0x925008
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and dword [esp + 4], 0x7093110f
push 0xbab881b0
dec eax
lea esp, [esp + 0x10]
jne 0x7fefe1
mov edx, 0xba96cc16
pop edi
Function at 0x932e03
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, 0xd8e0b2f
call fcn.0099353a
neg ecx
rol edx, 0x46
pop edx
jae 0x8f408c
inc bp
mov ecx, dword [edi + 8]
inc sp
or esp, ebx
call fcn.00d5ea36
nop
invalid
lea eax, [eax*2 - 0x76401d73]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 4], edx
mov ecx, 0x6f85010d
pop ecx
add ebp, 0xfffffffc
movzx edx, cl
call fcn.00982f38
sub dword [esp + 1], 0x8c230323
inc esp
sbb dword [esp + 4], edx
dec ecx
mov eax, dword [edi]
jne 0x800063
mov edx, dword [esi]
mov eax, 0x40a6f100
lea esi, [eax + esi - 0x40a6f0fc]
xor edx, ebx
lea ecx, [eax + eax*2 + 0x33aaf823]
call fcn.007e0c4b
lea edx, [edx + eax*2 + 0x32c9682b]
xor edx, 0x68399394
rol al, 7
dec eax
not edx
lea edx, [edx + ecx + 0x549c89a6]
xor ebx, edx
jmp 0xcdd6e8
not ecx
xadd dword [esp + eax - 0x2f800c7b], eax
rol ax, 0xa7
adc eax, eax
dec ecx
xor word [esp + 1], ax
xor ebx, ecx
ror ax, 0xa2
add edi, ecx
jmp 0x82e836
dec esp
mov dword [esp], esp
dec ecx
add edi, ecx
jmp 0x84465b
xadd eax, ecx
adc ebp, edx
ror eax, 0x8e
not ax
lea edx, [eax + 0x5a9f4f2f]
mov edx, dword [esi + ecx - 0x27b5265d]
mov cx, word [edx + ecx*2 - 0x4f6a4cc2]
mov edx, 0x680b3698
jb 0xd2add1
mov ecx, dword [edi - 4]
sub edi, 4
mov eax, 0x169e4c08
call fcn.0095ace3
shl edx, 0xf
mov word [esi + 6], cx
jne 0x7ec084
mov edx, 0x78a234b8
lea ecx, [edx - 0xfec5941]
push ecx
mov eax, dword [edx + ebp - 0x78a234b8]
mov dword [esp + ecx - 0x68b5db77], ecx
mov ecx, dword [ebp + ecx - 0x68b5db73]
pop edx
shr dl, 0x22
or eax, ecx
sal edx, 0xac
sbb edx, 0xaa28533f
not eax
mov ecx, edx
dec cx
call fcn.00d116f3

Function at 0x93b52f
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov dword [esp + eax], ebx
xor dword [esp + eax], edx
inc ebp
mov edx, ecx
inc esp
movsx ebx, al
inc ecx
pop ebx
xchg ebx, eax
dec eax
arpl dx, dx
neg al
dec eax
add edi, edx
shr bx, 0xab
dec edi
xor edx, dword [ecx + edi]
dec ecx
ror ebp, 0xe5
jae 0x9419f1
inc ecx
or bl, byte [edi + ebx + 8]
inc ebp
mov eax, esp
inc ecx
sal ebp, 0x7f
dec edi
lea edi, [edi + ecx*8 + 0xa]
dec edx
lea edx, [ecx + eax*4 + 0x4e9352a5]
inc esp
movsx esi, ax
inc ecx
shr ah, 0xa3
inc ebx
mov byte [ecx + edx], bl
dec ecx
lea ebx, [eax + edx + 0x1a858511]
shr edx, 0x53
call fcn.0088638c
mov eax, 0x2cb15793
mov eax, dword [edi + eax*2 - 0x5962af2a]
push 0x92813d9d
xor eax, ebx
sar dword [esp], 0x4c
inc eax
call fcn.008d16f2
Function at 0x93b55a
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + eax*2 - 0x656cf0a3]
dec cx
setae byte [esp + eax - 0x32b67854]
inc dword [esp + eax - 0x32b67854]
xor edx, ebx
not edx
xadd dword [esp + ecx - 0x663cde14], ecx
neg word [esp + eax*2 - 0x656cf0a6]
sub edx, 0x69bcd121
sar word [esp + eax - 0x32b67852], cl
bswap edx
sbb edx, 0x80a9bcb7
sar dword [esp + eax*2 - 0x656cf0a8], 7
xor ebx, edx
shl eax, cl
adc edi, edx
or ecx, eax
movzx ax, byte [ebp + eax - 0x656cf0aa]
and ecx, ecx
mov cl, byte [ebp]
shr al, cl
mov ecx, 0xb734762f
mov word [ebp], ax
shl ecx, 0xcd
ror ecx, 0x47
mov dword [esp + ecx - 0x11d8bc0], edi
ret
mov word [ebp + eax - 0x663cde17], dx
mov dword [esp + eax - 0x663cde15], eax
xadd dword [esp + eax - 0x663cde15], ecx
mov edx, dword [esi + ecx - 0x663cde14]
add dword [esp + eax - 0x663cde15], eax
adc eax, dword [esp + eax - 0x663cde15]
jns 0x865487
test eax, 0x88ca65dd
mov bh, 0x51
mov eax, 0x9f40b02a
push ecx
mov eax, 0xf3d4d82a
push ecx
mov eax, 0xe3c4e82a
push ecx
mov eax, 0x77d0d02a
mov ecx, 0xabcf2aa4
and eax, 0xab39039f
dec ebp
fcom qword [edx]
cld
out 0xf5, al
nop
cmpsb byte [esi], byte es:[edi]
wait
cld
test byte [edx], bl
mov ds, word [edi]
pop es
mov edx, 0x79a3df7b
idiv dh
inc ebx
mulps xmm5, xmmword [ecx + 0x4e4b0042]
pop ecx
test eax, 0x4e4b0042
mov bh, pe_nt_image_headers32
imul esp, dword [ecx - 0x16], 0xffffffa5
ljmp 0x3334:0x567562a5
bound esi, qword [ebp + 0x56]
xor al, 0x33
movsd dword es:[edi], dword [esi]
dec ebx
popfd
movsb byte es:[edi], byte [esi]
fimul word [ebx - 0x26bea037]
cmpsd dword [esi], dword es:[edi]
cmp eax, 0xe7a631dd
dec edi
xchg ebp, eax
fistp qword [ecx + 0x54b9c32]
movsb byte es:[di], byte [si]
pop ebx
jne 0x93b631
xor dword [eax], esp
inc ebp
inc esi
pop ecx
push esp
int3
adc dl, byte [edi + 0x6058d53d]
mov byte [edi], dh
loop 0x93b5cc
push esi
jb 0x93b5d6
aaa
loop 0x93b5d2
dec eax
adc ah, al
aaa
loop 0x93b5d8
xor edi, dword [0x91e237d8]
cmp al, 0
call 0x3625988b
sub ebp, dword [edi - 0x34]
xor ah, cl
pop es

Function at 0x94313e
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + ebp*8 - 0x455b0], 0x43319eb3
call fcn.008df122
inc si
xchg dword [esp + eax*2 - 0xf], eax
dec eax
arpl bx, bx
dec esi
mov dword [esp + eax*2 - 0x1f6], esp
inc esi
xchg dword [esp + eax*2 - 0x1f8], esp
dec eax
add edi, ebx
dec edx
and dword [esp + eax - 0xf7], 0xf3edd1e
pop edx
jno 0x95c0e5
pop eax
jg fcn.00d3b80a
inc bp
mov dword [edi + ecx*2 - 0xa], ecx
and dl, byte [esp + ecx]
dec edi
lea edi, [edi - 0x7f4cfc4d]
inc ecx
inc esp
dec eax
neg ebx
inc ecx
pop edx
pop ebx
pop edx
pop ecx
jno fcn.00d3b80a
stc
test esp, 0x9293b1b4

Function at 0x943199
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and edx, 0x4ba7d595
inc edx
shl edx, cl
mov edx, dword [ebp + 8]
cmp di, cx
cmp edi, 0xd72f26bb
lea esp, [esp - 0x114]
cmc
clc
push esi
jmp 0x8ce85c
Function at 0x94b357
Capabilities:
Encode data using base64

Disassembly:
and esi, 0xff
push 0x60b98833
inc ecx
mov esi, dword [ecx + esi*4]
call fcn.00cf0cf8
call fcn.007f8611

Function at 0x95c898
Capabilities:
Check for software breakpoints

Disassembly:
sub bl, 0x91
push eax
inc esp
xor bl, bl
dec eax
lea ebx, [esp + ebx + 0x20]
pop esp
sbb al, 0x20
inc bp
mov eax, dword [ecx + ebx - 0x1a]
inc esp
sbb esi, esp
dec ecx
sub ecx, 0x679d1dbd
dec edx
mov ebp, 0x4a679d1d
popfd
dec edx
mov dword [esp + ebp + 0x5689378], eax
dec edi
lea edi, [edi + ebp*2 + 0xad126de]
inc edx
shr dword [esp + ebp*4 + 0x15a24dda], 0x37
inc di
mov dword [edi + ebp*2 + 0xad126e0], eax
pop ebx
pop ecx
pop ebx
inc ecx
pop eax
jne fcn.00d3b80a
push 0xffffffffffffff82
adc al, 0x96
cwde
mov esp, dword [edx + edi*2 - 0xc9f774c]
movsb byte es:[edi], byte [esi]
jp 0x95c8a1
cmp al, 0xcc
scasd eax, dword es:[edi]
movsb byte es:[edi], byte [esi]
jp 0x95c8a7
aam 0x90
rep movsb byte es:[edi], byte [esi]
jp 0x95c8ad
loopne 0x95c8af
xlatb
mov eax, dword [0x47f4b626]
add dword [esi + 0x19], 0x23c22b6b
and dword [esp + ebx + 0x6f56730e], edi
mov bh, 0xf4
mov cl, 0xff
mov bl, 0xb9
lcall 0x6b68, 0xa96f19b9
aaa
sub eax, 0xb7e71dbd
cmp eax, 0x7aff39b9
jo 0x95c8fb
xor dword [ecx], ebx
cmpsb byte [esi], byte es:[edi]
cwde
dec ebp
jmp 0xffafe9b2

Function at 0x962f59
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
sub ecx, eax
xor ebx, edx
neg eax
rol eax, 0x92
add ebp, edx
call fcn.008d1adc
mov edx, 0x1b9598b2
jmp 0xd8f434
inc cx
mov edx, dword [esi + eax - 0xb801b32]
or eax, 0xf387569d
jbe 0x8f3ec8
mov dword [esp], eax
adc esi, 4
sub eax, dword [esp]
xor edx, ebx
xadd byte [esp + eax + 1], cl
call fcn.008975dc
movzx ecx, dl
mov edx, dword [edx + edi - 0x1b9598b2]
mov cx, word [edx + ecx - 0xb2]
mov word [edi + 2], cx
mov edx, 0xce27bc3d
neg dx
mov edx, dword [esi]
mov eax, 0xc405de87
movzx ecx, al
xor edx, ebx
ror edx, 1
neg cl
call fcn.00d5edc7
mov eax, 0xa815df19
movzx ecx, ax
movzx dx, byte [ebp + ecx*8 - 0x6f8c8]
mov cl, byte [ebp + ecx*2 - 0x1be30]
add ebp, 2
shl al, 7
not ax
or dl, cl
add ax, ax
movzx ecx, ax
setge cl
not dl
inc ecx
sbb eax, 0x32342b86
mov word [ebp + ecx*2 - 0x8004], dx
lea esi, [esi + ecx - 0x4006]
mov eax, dword [esi + eax - 0x75e11578]
xor eax, ebx
jmp 0xdb70f6
lea edx, [ecx + ecx*4 - 0x10e860fb]
sal edx, 0x7e
neg eax
call fcn.0087d526

Function at 0x967f1e
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax*2 - 0x4670bd7c], eax
mov eax, dword [ecx + eax*2 - 0x4670bd7c]
mov dword [ebp], eax
sub esi, 4
mov ecx, 0x51affe28
mov edx, dword [esi + ecx - 0x51affe28]
xor edx, ebx
dec dword [esp + ecx - 0x51affe28]
lea eax, [ecx + ecx*2 - 0x215dedf9]
dec edx
ror ax, cl
call fcn.00d73383
Function at 0x96d96f
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax + edx*2 + 0x20199b2]
inc cl
call fcn.008a085e

Function at 0x9732e5
Capabilities:
Encode data using xor

Disassembly:
not edx
inc ecx
mov esp, 0x293a432f
inc ecx
movzx esi, sp
push esi
inc ebx
mov dword [edi - 0x5274865e], edx
inc esi
or byte [esp - 0x52748659], ah
jne 0xd82285
jbe 0x8ae7a4
mov word [ebx - 0x680ad434], ds
xchg edi, eax
mov dword [ebx - 0x7e3276ff], ebp
adc edi, 2
xor word [esp + 5], dx
mov dword [esp], edx
adc al, 0x24
sar edx, 0xa1
shr ax, cl
lea ecx, [edx + edx*8 + 0x25a52c2b]
ror word [esp + ecx - 0x4b991f23], 0x4e
mov word [ecx + edi - 0x4b991f29], ax
movsx eax, cl
mov dword [esp + eax - 0x29], ebp
ret 4
dec eax
lea esp, [esp + 0x20]
je 0x97334b
push edi
dec eax
lea edi, [0xfff131f0]
push 0xb79bb8b2
inc ebp
movzx ecx, byte [ebp]
inc esp
xor ecx, edx
inc ecx
and ecx, 0xff
inc esi
mov ecx, dword [edi + ecx*4]
not word [esp + 1]
shr edx, 8
inc ecx
xor edx, ecx
dec ecx
inc ebp
xor edx, 0x12a263b8
sar word [esp + 5], 4
dec eax
dec esi
push 0x9baefb06
dec eax
lea esp, [esp + 0x10]
jne 0x9732f8
mov eax, 0x6f9555a8
inc esp
movsx esp, ax
inc esp
mov ecx, eax
pop edi
jmp 0x8ae767
dec esp
lea ebp, [esi + esi + 0x5a202021]
dec eax
lea ebp, [ebp + esi - 0x4333]
dec eax
lea ebx, [esi + esi*8 + 0x3aa9db37]
inc esi
mov edx, dword [ebp - 0x5274865e]
inc ecx
mov eax, 0xe1bc2998
movzx eax, word [esp + esi - 0x432e]
inc ebp
xor edx, ebx
dec eax
or ebx, ebx
inc ecx
inc edx
inc dx
mov dword [esp - 0x5274865e], eax
inc ecx
bswap edx
sub si, ax
call fcn.00d035ba

Function at 0x9762d1
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [ebp + ecx - 0x5555fc9d]
jbe 0x96d992
xor ebx, eax
ror dx, cl
adc ebp, eax
push edx
rdtsc
jmp 0x9302dd
dec cx
xor dword [esp + 4], 0xf535bb39
sbb esi, 8
lea ecx, [ecx + ecx*8 + 0x1db940af]
jmp 0xd77edb
xor ebx, edx
dec eax
add edi, edx
neg ecx
jnp 0x8fea8e

Function at 0x9794c2
Capabilities:
Check for software breakpoints

Disassembly:
neg cl
xor bl, cl
lea eax, [edx - 0xd52ece6]
rol byte [esp + edx - 0xd86058c], 0x41
mov dword [esp + edx*2 - 0x1b0c0b24], eax
lea ecx, [esp + ecx + 8]
xor byte [esp + edx - 0xd860591], al
call fcn.008f1f1e

Function at 0x97ce96
Capabilities:
Encode data using base64

Disassembly:
dec esi
lea edx, [esp + edx + 0x10]
dec eax
mov dword [esp + ebx*2 - 0x1f18eb4a], ecx
inc ecx
dec ebp
dec esp
mov dword [esp + ebx*4 - 0x3e31d6a4], ebp
inc esi
mov dword [ebx + edx - 0xf8c75a9], esp
inc ecx
xchg dword [esp + ebx - 0xf8c75a6], esi
inc esp
mov esp, dword [ebp + ebx*2 - 0x1f18eb57]
call fcn.008317e9
Function at 0x97d530
Capabilities:
Encode data using xor

Disassembly:
sete dl
or dword [esp], edx
mov dword [ebp - 4], ecx
jne 0xd5dd6d
mov edx, dword [esp + 7]
xor dword [esp + 0xd], 0x4b89f23a
mov dword [ebp], eax
jne 0x918286
call 0x8369a4
lea ebp, [ebp + edx - 0x41328c41]
jne 0x8fff5c
sal edx, 0x82
mov eax, dword [edx + esi - 0x2bd]
or dx, cx
jns 0xd69ffd
sub ax, 0xf793
xor ecx, ebx
jmp 0xd0fd34
ror byte [esp + 3], 0xc1
xor ebx, ecx
not al
add edi, ecx
pop ecx
jmp edi
xor bl, al
neg edx
push edx
lea eax, [esp + eax + 4]
mov ecx, dword [eax + ecx - 0x147af405]
jp 0x7e1e7c
push eax
neg dword [esp + eax*8 - 0x1807fff8]
mov dword [esp + eax*8 - 0x1807fff0], esi
adc eax, eax
mov dword [esp + eax*2 - 0xc03fffa], edi
dec eax
mov dword [esp + eax*2 - 0xc03fffc], ebx
shl al, 0xc1
mov ebx, edx
mov edx, ebx
sar al, 0xc2
or al, al
shl edx, 2
mov eax, ebp
jmp 0x80a7c0
call fcn.0081615f
jne 0x8b352b
xor ebx, ecx
movzx edx, byte [esp]
and edx, eax
adc ebp, ecx
sub word [esp + edx*8 + 1], dx
mov dword [esp + edx], ebp
ret 4
mov dword [esp + 4], 0x27822a58
lea esp, [esp + 4]
call fcn.00d75b6e
lea ecx, [edx + edx + 0x6b1322ae]
xor ebx, eax
sar edx, cl
add edi, eax
movzx eax, word [esp + edx - 0x7d8]
neg cx
and ecx, 0x6a204881
movzx dx, byte [ebp + edx - 0x7d6]
adc cl, byte [ecx + ebp - 0x622047fc]
or al, ah
adc ax, ax
add dl, cl
shr ax, 0xe7
mov word [ebp + eax - 0x2f], dx
mov edx, dword [esp + eax*2 - 0x66]
ja 0x884dae
jmp 0x9963d6
mov ecx, 0xd1391000
movzx eax, byte [esi - 1]
lea edx, [ecx + ecx + 0x711832ac]
sar dl, 0x67
xor al, bl
add ecx, ecx
shr dx, 0x81
ror al, 1
not al
ror al, 1
lea ecx, [ecx + edx*8 - 0x2a4876fe]
neg al
ror al, 1
not cl
jmp 0x8ea44b
or eax, 0xf81fc835
rol ecx, 1
neg ecx
add edx, eax
and eax, eax
adc ecx, 0x533b6b2f
neg dx
bswap eax
bswap ecx
push edx
ror ecx, 3
xor byte [esp + 1], dl
xchg edx, eax
not ecx
rol dx, 0x8c
rol ecx, 2
sub eax, 0x5e94e098
jno 0x8ba80b
inc esp
mov ecx, dword [ebp + eax*4 - 0x19220]
dec ecx
add esp, 0xbd98be07
inc ebp
xor ecx, ebx
inc ecx
ror ecx, 1
movzx esi, ax
call fcn.00ce6e3f
dec eax
lea ecx, [ebx*4 + 0x4abc50a6]
or bl, 0x33
dec edx
lea edx, [edx - 0x2f7e2ef5]
dec eax
bswap edx
inc esp
sbb ch, bl
dec eax
inc edx
dec eax
not edx
inc edx
dec byte [esp - 0x2e]
inc dx
xor dword [esp - 0x12], 0xf48b819
retf 0x334c
lea esi, [esi + edx - 0x2bd]
call fcn.00d8a6f2
movsx eax, dl
mov ecx, dword [esi + eax*8 - 5]
lea edx, [edx + edx + 0x372ef119]
call fcn.008ffd7b
jae 0xd528a8

Function at 0x98c066
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x48f41fba
call fcn.009746fa
stc

Function at 0x98cab1
Capabilities:
Encode data using base64

Disassembly:
inc edi
mov ah, byte [edi + ebp + 0x1e030352]
dec edi
lea edi, [edi + ebp + 0x1e030352]
inc ecx
sar dh, 0x21
inc ebp
movzx edx, dh
jp 0xd0988f
inc ecx
adc dh, ah
inc bx
mov dword [edi + ebp + 0x1e030350], esi
call fcn.008b351e
push 0x18b250a9
dec eax
sub ebp, 4
inc esp
mov edx, dword [ebp]
call fcn.00d4c3d6
jmp 0x84154c
Function at 0x98e27a
Capabilities:
Encode data using base64

Disassembly:
inc ecx
bswap esp
inc ecx
inc esp
inc ecx
movzx ecx, si
inc cx
sub edx, ebp
inc ecx
rol esp, 2
dec esi
mov dword [esp + ebp - 0x250b202b], ebx
neg edx
inc esi
xor dword [esp + esi + 0xa3fe295], esp
sub dl, 0xa3
inc ecx
pop ebx
shr cx, 1
dec ebp
arpl sp, sp
inc cx
shl esi, 0xc5
inc ecx
movzx eax, bp
ror cl, 0x62
dec ecx
adc edi, esp
or edx, edx
shl eax, 0x10
inc di
mov edi, dword [edi + esi + 0xa3f52a0]
dec ecx
shr ebp, cl
je fcn.00d3b80a

Function at 0x98f591
Capabilities:
Encode data using xor

Disassembly:
call fcn.0085d55f
add esi, 4
xor edx, ebx
ror edx, 3
neg edx
mov eax, 0xa82d1c15
dec eax
and al, al
sbb edx, 0x1ab36225
call fcn.00d625a4
xor al, 0xf1
pop eax
pop ds
inc eax
sal dword [edx - 0xf], 0x2f
mov dword [0xf1dad841], eax
das
mov dword [0xf1eae9c1], eax
das
mov dword [0xf10a29b0], eax
das
mov dword [0xf1125109], eax
das
mov dword [0xf1823081], eax
das
mov dword [0xf1ba68b8], eax
das
xor dword [eax], 0xa32ff182
mov eax, 0x2ff1ba68
mov dword [0xf1aa2901], eax
das
mov dword [0xf15290c9], eax
das
mov dword [0xa489a9b0], eax
jge 0x98f5d8
dec ecx
ljmp 0x53bd
Function at 0x993571
Capabilities:
Encode data using base64

Disassembly:
xor edx, 0x71fe115
not eax
pop edx
jge 0x8b0625
add dword [ebp - 0x76603253], eax
lodsb al, byte [esi]
add al, 0x85
lodsd eax, dword [esi]
int 0x9f
sar byte [edx - 0x2d], 0xe2
movsx ecx, ax
or eax, ecx
mov dword [ecx + ebp - 0x1781], edx
ror al, 0x64
lea esi, [ecx + esi - 0x1785]
and al, ah
movzx edx, cx
mov ecx, dword [esi + ecx*2 - 0x2f02]
or eax, edx
push edx
xor ecx, ebx
call fcn.008610f9
jp 0x885bb0
loop 0x885bee
mov edi, 0x89c10bc8
xchg esp, eax
sub dword [edi - 0x18], edi
invalid
mov ah, 0x31
jnp 0x885bda
invalid
mov word [edi + edx*2 - 0x5f9c0002], cx
sbb byte [esp + edx - 0x2fce0000], dh
shl dl, 5
add byte [edx], dh
rol al, 1
loop 0x885c21
mov eax, dword [esi + edx*2 - 0x5f9bfffe]
lea ecx, [edx + edx*2 + 0x25bb11b7]
xor eax, ebx
neg eax
add dx, cx
jp 0x876554
mov al, byte fs:[0xb7528c8d]
mov al, byte [0xb7528c8d]
adc dword [ebx - 0x83cccdb], edi
mov ebx, 0xf7c33325
fsub dword [esi + 3]
ror dword [edi], 1
mov bl, byte [0xa9ffff09]
jno 0x885bdb
or edi, edi
jmp [ecx - 0x22425e8f]
test eax, 0xddbda171
in al, 0x87
jno 0x885c16
mov ebp, 0x7187e4dd
salc
add esp, ecx
in eax, dx
pop edi
jno 0x885c1c
add esp, edx
aaa
jno 0x885c22
add dword [esp + ecx*2 + 0xf], edx
jno 0x885c28
add dword [0xd671a754], esi
add ebp, esp
insb byte es:[edi], dx
dec edi
jno 0x885c34
add dword [ebp - 0x3c], eax
mov bh, 0x71
salc
add dword [ebp + ecx*2 + 0x5f], ebx
jno 0x885c40
add dword [ebp - 0x298ef063], edi
add dword [esp + eax*2 + 0x1bfd0924], ebx
jmp 0x885c8a
pop ds
or edi, dword [ecx]
and eax, 0x47c284f8
push ecx
out 0x37, al
mov al, byte [0x8f7cf611]
inc ebx
xchg esp, eax
fadd qword [eax]
invalid
inc dword [esp]
inc eax
sar ecx, 0x51
inc edx
shr dword [esp], cl
xor eax, 0x332bf8b4
or cx, cx
xor ebx, eax
jmp 0x92c57d
call fcn.008b2313
lea eax, [edx - 0x646aa4f7]
inc cx
mov dword [esp + edx - 0xa965f9c], 0xab2c93b7
shl edx, 0xcf
shr word [esp + edx*2 - 0x5f9c0000], 0xb
xor bx, cx
or word [esp + edx*2 - 0x5f9bfffe], ax
sal byte [esp + edx*2 - 0x5f9bffff], 6
jae 0x885c0a
add ecx, edx
xor eax, ebx
shr edx, 0xce
shr cx, 0xc1
jg 0x7ec24e

Function at 0x997c30
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov edi, dword [esp + 0x70]
dec esp
mov ecx, dword [esp + 0x78]
dec eax
mov ebp, dword [esp + 0x80]
call fcn.008f4169

Function at 0xcd92c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
shr ecx, 8
inc esp
xor ecx, ecx
dec ecx
inc eax
inc ecx
xor ecx, 0xe92cf80b
dec eax
dec edx
dec eax
lea esp, [esp + 0x10]
jne 0x957386
mov ecx, 0xbbbea88f
inc ecx
pop edi
jmp 0x85fd76
inc ecx
mov edx, 0x7b3d2eb2
inc ecx
not ecx
inc edi
mov dword [edi + edx - 0x7b3d2eb2], ecx
call fcn.00d199d8
jmp 0x8397af