joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf7a8f5
Capabilities:
Encode data using xor

Disassembly:
xor bl, dl
shl byte [esp + eax - 0x42f50f6], 0xa1
lea edx, [esp + edx + 0xc]
sbb word [esp + eax - 0x42f50fe], ax
mov dword [edx + eax*2 - 0x85ea200], ecx
add dword [esp + eax - 0x42f50f8], eax
mov dword [esp + eax*8 - 0x217a8800], ebp
ret 8
mov dword [esp + eax - 0x3fffff4], 0x468f498f
call fcn.00d62fcf
inc ebp
mov ecx, dword [eax]
mov eax, 0x56ad9f8e
inc esp
movsx esi, ax
inc ebp
movzx edx, si
inc ebx
mov ecx, dword [edx + eax - 0x9f8a]
dec eax
cwde
dec ebp
imul esi, edx
dec edi
lea eax, [eax + edx - 0x9f8a]
inc ecx
shr esi, 0x91
inc ecx
not ecx
not ecx
inc esp
or ecx, ecx
call fcn.0149756f
add ebp, eax
mov ecx, dword [edi + edx*2 - 0x7fe]
push edx
lea edi, [edi + edx - 0x3fb]
sub edx, 0xd73b111c
mov dword [esp + edx*2 - 0x5189e5c2], edx
movzx edx, byte [esi + edx*2 - 0x5189e5cb]
jp 0xefa344
sbb esi, 4
mov eax, 0x202de87
ror word [esp + eax*4 - 0x80b7a18], 0xc4
shl ax, 0x44
xor dl, bl
xor dl, 0x91
ror dword [esp + eax*2 - 0x405d0df], 0x17
imul eax, dword [esp + eax*4 - 0x80ba1bc]
sub eax, dword [esp + eax - 0x2cf38ffc]
not dl
push eax
dec dl
or word [esp + eax*2 - 0x85ea1fd], 0x528f
add word [esp + eax - 0x42f50f8], 0x863b
neg dl
jmp 0x14d215f
jmp 0xe9eef9
Function at 0xf7c3ac
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + ebp - 0x29], edi
inc esp
xor dword [esp + ecx - 0x5916e550], edx
inc ebp
sub esi, edi
pop edi
mov esi, ecx
dec ecx
bt esi, ecx
dec ebp
arpl dx, dx
dec eax
inc ebp
inc eax
setns dh
dec ecx
add ebx, edx
inc ecx
movsx eax, dh
dec ebp
lea ebp, [esi + ebp*4 - 0x5ede475c]
inc ebp
xor dh, bh
dec ebp
mov edi, dword [eax + esi - 0x5916e501]
dec ecx
or esi, ebp
inc dx
mov ecx, dword [ecx + eax - 0x5916e548]
inc esp
mov edx, edx
jg 0xec6a91
dec esp
lea edi, [ebp + 0xa123b07]
inc esp
movzx esi, byte [esp + ebp*2 - 0x52]
dec ebp
lea ebx, [ebx + ebp*2 - 0x4e]
inc esp
xor edx, edi
neg cl
inc ecx
imul ecx, edi
inc ecx
dec edx
inc edx
sar dword [esp + edi - 0xa123b2e], cl
inc esp
movzx ebp, bp
dec edx
lea edx, [edi*4 + 0x2b236d28]
inc ecx
neg edx
inc ecx
inc edx
inc ecx
ror edx, 2
sal word [esp + ecx - 0x5916e54a], 0x25
dec ecx
lea edx, [edi + edx*2 - 0x2f79abfb]
inc ecx
bswap edx
jbe 0xe8f10a
dec esi
lea eax, [esi + eax - 0x2c08012a]
movsx ecx, word [esp + esi*2 - 0x58100242]
cdq
inc ecx
mov dword [eax + esi - 0x2c080126], ebp
jne 0x14d19ff
inc eax
neg ch
dec esi
lea eax, [ebp + eax - 0xcc]
dec eax
neg ebp
inc cx
mov dword [edi + ebp*2 + 0x1ac], ecx
call fcn.0149d885
bswap edx
ror word [esp + eax - 0x50000000], 3
sal byte [esp + eax - 0x50000001], 0x81
call fcn.00f6f1ae
mov ch, 0xbd
invalid
inc ecx
shr ecx, 0xa8
push edi
inc esi
xor dword [esp + esi], edi
dec ebx
lea edi, [ecx + esi*4 + 0x621b2eac]
dec ecx
lea ebp, [esi + 0x62981ea4]
inc ebp
movzx esp, cl
pop edi
jmp 0xfc39b5
dec edx
mov dword [esp + ecx*2 - 0xd4], edi
dec eax
btc esi, eax
dec esi
mov dword [esp + ecx - 0x6e], ecx
inc cx
btr esp, 0xb
inc esi
xor dword [esp + ecx - 0x66], ebp
dec edx
sal dword [esp + ecx - 0x6e], 0x51
dec edx
mov edi, dword [esp + ecx*2 - 0xd4]
dec ebp
arpl bp, bp
inc ebp
movzx edi, cx
inc esi
movsx edx, word [esp + ecx - 0x6c]
dec eax
not edx
dec ecx
adc ebx, ebp
inc cx
neg ecx
jo 0xef3867
movsx ebp, ax
inc ebx
mov eax, dword [ecx + eax - 0xff92]
inc eax
setnp dh
inc edx
not dword [esp + ecx*4 - 0x3fe48]
dec edi
lea esi, [edx + edi*2 + 0x7202cb32]
dec edi
lea eax, [eax + ecx*4 - 0x3fe44]
inc ecx
shl cl, 0xe2
inc eax
movsx ecx, dh
inc edi
movzx esi, byte [ecx + ebx - 0xff48]
inc esi
movzx ebp, byte [esp + ecx - 0xff45]
pop esi
inc cx
sbb edx, 0x34c79b1
fldenv [esi - 0x3f]
stc
stosb byte es:[edi], al
jae 0x14b61fc
and esi, 0x5c9a588d
dec ebp
arpl di, di
not edx
dec ecx
shl esi, 0xa3
inc ecx
push esp
dec ecx
adc ebx, edi
inc edx
sar dword [esp + esi*2 + 3], 0x72
inc eax
ror ch, 0x61
shr dx, 0xcd
dec ebp
mov ebp, eax
dec edi
lea eax, [eax + esi*4 - 8]
inc eax
shl ch, 0x47
ja 0xea2500
dec edi
mov dword [eax + esi*2], ebp
pop ebp
je fcn.00fa7e93
out 0xa5, eax
leave
cmpsd dword [esi], dword es:[edi]
rol dword [ecx], 0x3f
xor eax, 0x6fc1daca
sbb eax, 0x79c1daca
inc edi
and edx, ecx
fcmovb st(0), st(1)
sbb eax, 0x3fe22b29
pop eax
leave
sti
or ah, byte [eax]
std
stosb byte es:[edi], al
ljmp 0xd75b
inc esp
xor dh, bh
inc ecx
add dh, 0xb2
jmp 0x148d68a
or si, 0x1ba9
inc ecx
mov eax, dword [ebx + ecx - 0x3f77]
dec ebp
lea ebx, [ebx + esi - 0x2c081bab]
Function at 0xf89183
Capabilities:
Manually build aes constants

Disassembly:
dec eax
imul ebp
pop ecx
inc ecx
pop ebp
pop edx
jae fcn.00fa7e93

Function at 0xf8ea8c
Capabilities:
Manually build aes constants

Disassembly:
call fcn.00e9c89c
mov ecx, 0x4eb6a9af
shl ecx, cl
btr cx, 0x1f
mov eax, dword [ebp + ecx - 0x54d70000]
or cl, cl
lea ebp, [ebp + ecx - 0x54d6fffc]
jne 0xf74b77
mov edx, ecx
ror cx, 0xc
xor eax, ebx
not dl
neg cx
sbb eax, 0x503f470d
xadd ecx, edx
not eax
ror eax, 2
inc ecx
shl dl, 0xc3
lea eax, [eax + edx*2 + 0x2ffa5a9f]
jae 0x148f801
btc edx, edx
lea ecx, [ecx + eax*4 + 0x7e89340a]
call fcn.014aeca4
dec eax
mov dword [esp + eax*4 - 0x6286c8], esi
dec esi
lea ecx, [edi*8 + 0x7490018a]
dec ecx
adc ebx, esp
cdq
inc ecx
sal bh, 0xc3
inc ecx
pop esi
inc ecx
pop esp
jb fcn.00fa7e93
bswap ecx
rol ecx, 3
xor ecx, 0x61398a8b
shl dl, 0x86
bswap edx
ror ecx, 1
call fcn.00e85a3d
xor dl, bl
xor dl, 0x9f
shl cl, 0xa2
jnp 0xf6e895
jp 0x14cbef7
mov dword [esp + edx - 0x6d850834], ebp
ret 8

Function at 0xf91996
Capabilities:
Manually build aes constants

Disassembly:
inc ecx
movsx edx, cl
dec edx
mov dword [esp + esi - 0x3e653bd], edx
dec ebx
mov ecx, dword [esi + ebp - 0x3e653bd]
dec ebx
mov dword [eax + esi - 0x3e653c5], ecx
inc edx
sal dword [esp + esi*2 - 0x7cca76c], 0xf1
inc sp
btc esi, ecx
inc edi
mov edx, dword [esi + ebx - 0x3e653bc]
dec edx
sbb dword [esp + esi - 0x3e653b1], 0xa0038b38
jp 0x1489f93
inc ecx
movsx esi, sp
neg eax
inc edx
rol byte [esp + esi - 0x1b3df03], 0x25
inc edx
lea eax, [eax + esi*4 + 0x7e412c6c]
inc ecx
push edi
imul ecx, ecx
inc esi
movzx ebp, word [esp + esi - 0x1b3df02]
rol eax, 1
inc edx
lea eax, [eax + esi + 0x505e90a7]
jmp 0xfb5fc4
inc sp
cmovae ecx, eax
inc esp
xor edx, edi
inc ecx
xor edx, 0xa89b4e29
inc esi
jle 0x14d2706
inc ecx
mov esi, dword [ebx]
dec ecx
add ebx, 4
xor esi, edi
push 0x7e1793ba
dec eax
shr dword [esp], 0x3a
mov edx, 0x27b962b6
neg esi
mov ecx, edx
jmp 0xfae0c1
Function at 0xf91fb7
Capabilities:
Encode data using xor

Disassembly:
jb 0xed3471
inc eax
dec dh
inc di
mov dword [eax + ecx*2 - 0x1c], edx
dec edi
lea eax, [eax + ebp*2 - 0x90]
inc ebp
btc esp, ebp
call fcn.01488083
dec ecx
inc eax
neg ecx
call fcn.00e7274c
inc ecx
rol dh, 1
inc esp
movzx ebp, dl
inc ecx
xor bh, dh
dec ecx
lea ecx, [edx + 0x40bc84a5]
dec esp
dec byte [ecx - 0x73]
mov ah, byte [ebp + 0x4c40bc84]
mov esp, 0xf4034c40
add esi, esp
btc ax, cx
inc esp
movzx esp, ax
inc di
mov edx, dword [esi + ecx*2 - 0x1e]
jae 0xeb905e
sysenter
pushfd
mov dword [esp], 0xae8dd39
call fcn.00eb1263
rcl dword [edi + 0x73c0609d], 0x31
cmp dword [0x115fc07f], ebx
sbb eax, 0x51c07f1d
jg 0xf91fc9
push ecx
pop ds
popal
sbb eax, 0x2305c07f
and eax, 0xc041215d
sbb al, byte [edi + 0x68]
cli
dec ebx
fst qword [ebp + 0x212cd448]
push edi
dec ecx
jg 0xf91fcf
add eax, 0x215d2523
inc ecx
rcr byte [edx], 0x47
push 0xdd4bfa64
xchg ebp, eax
dec eax
aam 0x2c
and dword [edi + 0x49], edx
inc ebx
dec esi
pop esi
in eax, dx
push esp
sal ebp, cl
cmc
add ch, byte [edx]
std
push esp
sal ebp, cl
sbb bh, byte [esi - 0x5f]
push esp
sal ebp, cl
inc esi
sti
inc edx
xor al, byte [ebp + 0x645fdea6]
shl byte [edx + esi + 0x40], 0xdf
jnp 0xf92007
or al, 0x28
js 0xf9202a
jnp 0xf9200d
push edx
adc byte [edi + ebx*8 + 0x7b], ah
rol byte [eax], 0x2c
adc dl, byte [eax - 0x1d]
inc ebp
shr byte [edi], 0xc7
or dword [esi + 0x7a], esp
mov bl, 0xdd
xchg ebp, eax
dec eax
aam 0xc0
rcl dword [edi + 0x49]
inc ebx
mov esi, 0xd35401a6
cmc
out 0xaa, al
inc ebp
push esp
sal ebp, cl
stosb byte es:[edi], al
mov ah, byte [ecx]
push esp
sal ebp, cl
inc edi
inc edx
xor al, byte [ebp + 0x19817c40]
aas
mov edx, 0x6482cc98
aas
invalid

Function at 0xfa37a9
Capabilities:
Manually build aes constants

Disassembly:
lea edx, [ecx*4 - 0x49477680]
mov word [ecx + edi - 0x1f9], ax
mov dword [esp + ecx*2 - 0x3f6], 0xe3ebeb6
sub ecx, edx
dec dx
movzx edx, byte [esi + ecx - 0x49477090]
adc cl, cl
jns 0xf8eaa3

Function at 0xfa9705
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
neg ecx
ror ax, 0x6f
or al, al
call fcn.00eafd50

Function at 0xfb0566
Capabilities:
Encode data using xor

Disassembly:
mov word [esi + eax*2 - 0xd46fe], dx
jg 0xe9ebde
movzx edx, word [esp + eax - 0x6a37b]
mul ecx
lea esi, [edx + esi - 0x50a05]
setno cl
pop edx
pop edx
pop ecx
jb fcn.014ccc6f
inc al
ror al, 1
rcl al, 0xc8
and cx, dx
cmovs dx, cx
neg al
sub al, cl
xor bl, al
neg dl
and dl, 0x9e
lea eax, [esp + eax + 0xc]
sar ecx, cl
mov dword [esp + edx - 0x7b5c8212], edx
or dx, dx
movzx dx, byte [eax + edx - 0x7b5c8212]
movzx eax, cl
xchg dword [esp + eax + 5], eax
jne 0xea1a4e
cld
sahf
movsd dword es:[edi], dword [esi]
jb 0xfb0567
push ds
adc bh, byte [ebp + 0x6d]
rcr byte [eax], 0x56
and byte [0x4c78c06d], ah
sub byte [0x4002c06d], ah
push edx
cmp byte [ecx], bl
push ebx
sar byte [edi + 6], 0x43
outsb dx, byte [esi]
jp 0xfb05c3
clc
xchg edi, eax
dec eax
lcall 0x9043, 0x4b72f78e
int3
Function at 0xfb5573
Capabilities:
Encode data using xor

Disassembly:
mov dx, word [edi + eax*4 - 0x1a39c]
setae al
lea edi, [edi + eax*4 - 0x19ffe]
call fcn.00f8da05
adc ebp, edx
movsx edx, cx
mov dword [esp + eax*2 - 0xd1d0], edx
sal edx, 0x13
mov ecx, dword [edi + eax - 0x68e8]
or eax, eax
pop edx
jne 0xe690a9
inc ecx
movsx eax, cl
inc ecx
mov eax, dword [ebx]
xor eax, edi
dec ecx
lea esi, [ecx - 0x3df3afc8]
inc ebp
movzx esp, cl
inc ebp
mov edi, ecx
rol eax, 1
jmp 0xeba60b

Function at 0xfc25f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0xfb90df
mov dword [edi + 4], edx
rcl ax, 0xa0
adc al, 0xa0
movzx eax, cl
test sp, cx
mov dword [edi], eax
sub eax, eax
jmp 0xeb91a7
jb 0xe997f9
movzx edx, cl
lahf
mov eax, 0x38e38e39
jmp 0xfb90bc
add cl, 0xd3
clc
test eax, edi
stc
sub eax, 1
jmp 0x14b853d
mul edx
sar eax, 0xa7
shr edx, 1
shrd eax, eax, 0xa6
movzx eax, dl
setnp dl
rcl dx, cl
movzx dx, cl
mov edx, eax
cmp si, si
lea ecx, [ecx]
test di, cx
add cl, 0xf7
cmp dx, 0x459b
cmc
sub eax, 1
jmp 0xe997ea
add ax, cx
ror ax, cl
inc ebp
and bh, ch
dec eax
shr edx, cl
dec eax
not ecx
adc ax, 0x9023
dec edx
mov dword [esp + ecx*8 - 0x18], 0xdc1d6d08
inc edx
neg dword [esp + ecx - 3]
call fcn.014aa9c2
mov dword [edi + 8], 0
test cx, 0x4200
cmp cl, 0x2d
jmp 0x148f158
jb 0x14b854c
push esi
movzx esi, cl
and eax, ebp
movsx eax, dx
mov eax, 0x6c16c16d
shr dh, 0x96
shl edx, 0xbe
bts edx, eax
mul esi
mov eax, esi
xor si, 0xda30
sub eax, edx
clc
shr eax, 1
cmp bx, 0x5b9c
neg si
test edx, esp
add eax, edx
shr eax, 5
stc
movzx eax, al
rcr si, 0xa0
inc edx
mov edx, eax
btc esi, esi
neg esi
bt esi, 0x8d
pop esi
jmp 0xfad08f
jne 0xfad08f
mov dword [edi + 8], edx
cmp edi, 0x8801e48b
mov dword [edi + 4], 0
cmp cx, sp
cmp cl, 9
jmp 0xec3fcd

Function at 0x14867d2
Capabilities:
Manually build aes constants

Disassembly:
jmp 0xf9a17a
shr ecx, 0xf0
lea ecx, [ecx + ecx + 0x5d9aad8d]
rol edx, 2
push ecx
not cx
jmp 0x14bb8c0
div cl
lea edx, [edx + ecx - 0x4e010548]
mov dword [esp + ecx - 0x40007314], 0xf9386e07
dec cl
xchg byte [esp + ecx - 0x40007312], al
bswap edx
ror eax, 0xeb
or dword [esp + ecx - 0x40007313], 0xe00ad307
neg dword [esp + ecx - 0x40007313]
dec edx
xor ebx, edx
cwde
or ax, word [esp + ecx - 0x40007313]
call fcn.00ea5187
shl ecx, cl
setns dl
movzx dx, byte [ecx + eax - 0x2b800000]
jnp 0x14e3776
not dword [esp + ecx*2 - 0x57000000]
xor cl, ch
mov ax, dx
movzx edx, byte [ecx + ebp - 0x2b7fffff]
xor dl, bl
sal ecx, 0xfd
call fcn.014a279e
mov word [esi + edx*2 - 0x4929c63a], ax
bt edx, edx
jae 0xfa96ef
mov eax, dword [ebp + edx - 0x2494e31d]
lea ebp, [ebp + edx - 0x2494e319]
xor eax, ebx
rol dl, 0xc3
dec eax
sub dx, 0x4986
push edx
xor eax, 0xcd9fb33e
jmp 0xed893b
bswap edx
inc edx
ror edx, 2
add dword [esp + ecx - 0x5d9c6bfa], ecx
sbb dword [esp + ecx - 0x5d9c6bfa], ecx
xor ebx, edx
sar cx, 0xca
mov eax, ecx
add ebp, edx
call fcn.00e916d9
Function at 0x14871e6
Capabilities:
Manually build aes constants

Disassembly:
pop esi
inc ecx
mov esi, 0x9aab07a1
dec ecx
add ebx, 4
inc ecx
push esi
inc esp
xor edx, edi
inc ecx
mov edi, 0x33159030
dec esi
lea ebp, [edi*8 + 0x739f0d14]
inc ecx
not edx
inc edx
movzx eax, word [esp + edi*2 - 0x662b2060]
inc ecx
imul esi
inc ecx
inc edx
dec ecx
not ebp
inc ecx
ror edx, 1
inc ecx
dec edx
jmp 0xeb169c

Function at 0x14878f1
Capabilities:
Encode data using base64
Encode data using xor
Manually build aes constants

Disassembly:
mov eax, ecx
and al, al
jmp ebp
dec edx
mov dword [esp + edi - 0x53bc8500], edi
dec esp
or edi, esi
dec ecx
lea eax, [esp + edx*8 - 0x26e2bdec]
shl ecx, cl
inc esi
xor dword [esp - 0x580], ebp
inc eax
neg ch
js 0x148869e
mov dword [esi + 8], ebx
sar dword [esp + 0xd], 0xcb
mov eax, dword [esp + 0xb]
mov dword [esi + eax - 0xeb42ca7], ecx
movsx ecx, ax
js 0xf9bdb5
mov dword [esi + eax - 0xeb42cab], edx
xchg word [esp + eax - 0xeb42c98], cx
mov dword [esp + eax - 0xeb42cab], ecx
mov ebx, dword [esp + eax - 0xeb42c8b]
cwde
adc cx, ax
pop ecx
pop ecx
pop ecx
pop eax
pop edx
pop ecx
pop eax
pop ecx
pop eax
jge fcn.014ccc6f
sbb al, byte [esi]
inc esp
int 0x44
mov ebp, 0x559d3710
dec ebp
movsd dword es:[edi], dword [esi]
adc byte [edi], dh
popfd
or al, 0x82
or eax, 0x659d3710
std
cmp eax, 0xf29d3710
movsd dword es:[edi], dword [esi]
lds edx, [eax]
aaa
popfd
stosb byte es:[edi], al
push ebp
sbb eax, 0xf49d3710
sub al, 0x25
adc byte [edi], dh
popfd
insd dword es:[edi], dx
mov ebp, 0x9d036d50
invalid
Function at 0x1496014
Capabilities:
Encode data using base64

Disassembly:
inc esi
xor dword [esp + esi - 0x1e95d476], edi
dec eax
not ebp
dec ecx
bswap ebp
dec edx
mov edi, dword [esp + esi*2 - 0x3d2ba8fc]
sal ecx, cl
dec edx
mov dword [esp + esi - 0x1e95d486], ecx
dec ebp
arpl di, di
dec ecx
add ebx, edi
cdq
jmp 0xe8b521
inc esi
mov byte [edx + ebp], dl
inc ecx
mov ebp, ecx
dec eax
cwde
jno 0x14d28c5
xor eax, 0xe48d79b9
inc cl
pop eax
pop eax
pop eax
pop ecx
pop ecx
jnp fcn.00e671b6
dec edx
mov dword [esp + ecx - 0x9f1a], ebx
ret 8
inc al
xor ecx, 0x6d8f2c86
bswap ecx
call fcn.00ee32ae
dec ecx
mov edx, dword [eax]
inc sp
movzx esp, byte [edx]
mov edx, 0x92b98334
inc esp
movsx ecx, dx
dec ecx
add eax, 6
dec eax
shl edx, 0xa7
movsx esi, dx
movsx ecx, si
inc bp
mov dword [eax + ecx], esp
dec eax
sar edx, 0xd
ja 0xf80ed8
lea esi, [esi + edx - 0x5c12069f]
movzx ecx, dl
mov ecx, dword [edx + esi - 0x5c12069b]
xor ecx, ebx
call fcn.00ed3dd7
pop ss
in eax, 0xd0
shl ebp, 0xd9
lea esp, [ebp - 0x31]
sal dword [ebx - 0x309a2e7f], 0xc1
cdq
sal dword [ebp - 0x103e309b], cl
stosd dword es:[edi], eax
lahf
rcr dword [ecx - 0xf], 1
ror dword [esi + 0x7aa01fdf], 0x10
push eax
or byte [eax + 0x77], 0x63
push cs
ficomp dword [esi + 0x43]
imul ebx, dword [ebp - 0x62], 0x1f5c4d9
and esi, ecx
fld st(4)
cmc
sub dword [ebp - 0x76], ebp
fld st(4)
cmc
jne 0xeeacf4
iretd
inc ecx
mov eax, dword [ebx + esi*2]
dec esp
lea esp, [ecx*4 + 0x37aed53e]
dec ebp
lea ebx, [ebx + esi*2 + 4]
movsx ebp, cx
bswap esi
xor eax, edi
call fcn.00e70848
inc esi
add dword [esp + ecx*4 - 0x27c63], esp
dec edx
mov dword [esp + ecx - 0x9f11], edi
inc esp
imul edx, esi
inc esi
xor dword [esp + ecx - 0x9f11], esi
xadd dl, al
inc cx
inc ecx
dec edx
mov edi, dword [esp + ecx*8 - 0x4f8c8]
dec eax
shl eax, 0xb1
cwd
dec ebp
arpl si, si
cwde
dec ecx
add ebx, esi
jmp 0xea7313
inc edx
lea ecx, [ecx + edx*2 - 0x3861d9b4]
neg ecx
imul byte [esp + eax*4 - 0x2610ffd]
sbb ecx, 0xbf064c22
sal edx, 0xe8
inc edx
not byte [esp + eax*2 - 0x12ffffe]
bswap ecx
bts edx, 0xbc
jb 0xeeac7f
neg ecx
add al, 0xb1
inc ecx
rol edi, 0x3d
dec eax
shl ebp, 0x1f
not ecx
dec ecx
rol esi, 0xcb
inc bp
sbb edi, edi
rol ecx, 1
inc sp
and edx, ebp
jg 0xe94b6d
inc ecx
push esi
dec edx
mov dword [esp + edi], edi
inc ebp
mov ebp, edx
inc cx
dec esi
jle 0xf83277
xor eax, ebx
or dl, dl
xor eax, 0xd63206ae
lea eax, [eax + ecx + 0x4a25c68c]
shl ecx, 0x3d
bswap eax
neg eax
call fcn.014943aa
dec eax
add esi, 0x24014d23
dec esi
lea ebp, [esp + ebp + 0x10]
dec eax
and ecx, eax
mul word [esp + edx*2 + 7]
jae 0xea0124
xor word [esp + eax - 0x9843fe], ax
jp 0xfc330e
dec eax
mov dword [esp + edx], ebx
ret 8
Function at 0x14998c4
Capabilities:
Manually build aes constants

Disassembly:
dec eax
cwde
dec eax
mov dword [esp + eax + 0xfc1d], edi
xor dword [esp + eax*4 + 0x3f058], 0x35aa64b3
dec esp
xor ecx, eax
setge dl
inc esp
xor dword [esp + eax*4 + 0x3f05c], edx
and dword [esp + eax*8 + 0x7e0a9], 0x95af2488
movzx ebp, byte [esp + eax + 0xfc16]
movsx edi, si
dec eax
mov edi, dword [esp + eax*2 + 0x1f832]
sar bp, cl
dec ecx
sal ecx, cl
dec ebp
arpl dx, dx
cbw
dec ecx
add ebx, edx
call fcn.00fc26bc
adc ebp, edx
cbw
lea edx, [eax + edi - 0x1a00fffc]
btc cx, ax
mov dword [edi + eax*2 - 0x3401fff8], edx
and ecx, ecx
call fcn.00fc0790
cwde
neg ecx
mov dword [esp + edx*8], 0x983ed925
neg eax
adc ecx, edx
push edx
neg ecx
mul word [esp + edx + 1]
neg edx
bswap ecx
sar al, 0x21
ror ecx, 1
bswap edx
inc dx
sar dx, 0xcb
xor ebx, ecx
call fcn.014a583c
dec ecx
mov edx, dword [eax]
inc ecx
mov esp, 0x97018da2
inc ecx
mov ecx, esp
movsx eax, cl
mov ebp, dword ss:[edx]
inc ebp
movzx edi, ah
inc ecx
push edi
inc ebx
mov dword [eax + edi*2 - 0x140], ebp
dec ecx
lea edx, [edi + ecx*2 - 0x12d96ef0]
inc edi
mov edx, dword [ebx + edi*4 - 0x288]
inc dx
xchg dword [esp + edi*2 - 0x144], edx
dec edi
lea ebx, [edi + ebx - 0x9e]
inc edx
not byte [esp + edi*2 - 0x141]
inc esp
xor edx, edi
rol eax, cl
inc ecx
mov ebp, 0x5525e43f
inc si
add dword [esp + edi*2 - 0x144], ebp
inc ecx
dec edx
inc ecx
not bh
neg edx
inc edx
ror dword [esp + edi - 0x5d], cl
inc ecx
xor edx, 0x1a949034
dec eax
lea esi, [eax + 0x6298a586]
inc ecx
neg edx
mul si
inc edi
lea edx, [edx - 0x34ea3b8d]
inc eax
mul dh
inc ecx
rol edx, 1
inc dx
sub dword [esp + edi*4 - 0x172], ecx
push ecx
inc ecx
mov ecx, 0x81a67fab
inc ecx
not edx
jbe 0x14954d6

Function at 0x149a56b
Capabilities:
Encode data using base64

Disassembly:
not al
neg byte [esp + edx - 0x9dba]
sbb al, 0xba
lea edx, [edx*4 + 0x1cac0c9c]
xor bl, al
pop edx
shr word [esp + ecx - 0x9dbf], 0x61
lea edx, [ecx*8 - 0x11f386f2]
lea eax, [esp + eax + 0xc]
or dword [esp + ecx*4 - 0x276fc], ecx
sub cl, 0xb
mov ecx, dword [eax + ecx - 0x9db5]
add edx, edx
add dword [esp + 1], edx
movzx eax, byte [esp + 7]
mov dword [esi + eax*2 - 0x66], ecx
mov ecx, dword [esp + eax - 0x31]
mov ecx, dword [ebp + eax*8 - 0x18f]
imul edx, edx
lea ebp, [ebp + eax - 0x2d]
xor ecx, ebx
xor ecx, 0xeda2d61b
sub byte [esp + eax - 0x27], 0x30
neg ecx
bswap ecx
xor ecx, 0xed04e40b
cwde
rol word [esp + eax - 0x29], 0xe3
not dword [esp + eax*8 - 0x188]
bswap ecx
xadd dword [esp + eax*8 - 0x18f], edx
bts edx, 0xa6
neg ecx
neg eax
add eax, dword [esp + 8]
call fcn.00d66c12
Function at 0x14a15ea
Capabilities:
Manually build aes constants

Disassembly:
add eax, eax
ror cl, 1
add cl, dl
not cl
sub cl, 0xbb
not edx
mov dword [esp + eax - 0xc010000], eax
xadd byte [esp + eax - 0xc00fffd], dh
xor bl, cl
lea ecx, [esp + ecx + 4]
push eax
lea eax, [eax + eax*2 - 0x20e17cd5]
cwd
mov eax, dword [ecx + eax - 0x321832b]
lea ecx, [edx*2 - 0x397cda52]
lea esi, [esi + edx*8 - 0x7fffc]
call fcn.0149c444
mov al, byte [edi + 4]
sar dx, 8
adc edi, 6
xor dl, dl
bswap edx
sal edx, 0xf6
mov byte [edx + ecx - 0x20c00000], al
mov eax, edx
lea esi, [esi + edx*2 - 0x41800004]
call fcn.0149cc15

Function at 0x14a2be9
Capabilities:
Encode data using base64

Disassembly:
lea edx, [edx + eax + 0x3f955e06]
add ecx, eax
lea eax, [ecx + ecx*2 + 0x4af1896]
rol ax, 0x4c
not edx
cwde
add ecx, 0x2d82c01a
xor ebx, edx
shr al, 0x27
add ebp, edx
xor ax, ax
movzx edx, cl
mov dl, byte [eax + esi - 6]
ror byte [esp + eax], 5
lea esi, [esi + eax*2 - 6]
call fcn.00f81249
mov eax, 0x55a75e26
movzx edx, byte [eax + esi - 0x55a75e27]
call fcn.014b4ec1
mov edx, 0x4e35c2a3
mov ecx, dword [esi + edx - 0x4e35c2a3]
mov eax, edx
not al
mul dl
mov edx, dword ss:[ecx + edx - 0x4e35c2a3]
mov dword [esi + eax - 0x4e353a94], edx
xadd al, ah
mov edx, 0xd5a9df9a
mov ecx, dword [ebp + eax - 0x4e3594ce]
ror ax, 0xcb
lea ebp, [ebp + eax - 0x4e3599ce]
mul ax
xor ecx, ebx
btc edx, eax
cwde
xor ecx, 0x9ebd10b8
shl dl, 0x21
inc edx
not ecx
and ax, ax
push edx
xadd dword [esp], edx
inc ecx
inc ax
jl 0xf74b29
jmp 0xf92622
mov dx, word [edi + edx - 0x6ccfd26b]
mov ecx, dword [esp]
lea edi, [edi + ecx - 0xdcfa20b]
adc cl, ch
call fcn.00eeef76
mov ecx, 0x27926ca8
dec ecx
rdtsc
not cx
sal cl, 0xe6
call fcn.00f9c419
jmp 0xeb5411
xor word [esp + 2], dx
neg ecx
sub ecx, 0x3fb1a7af
or edx, eax
xor ecx, 0x21303835
xor ebx, ecx
and dl, dh
adc edi, ecx
pop ecx
jmp edi
mov ecx, 0xa80fea5
not eax
btc ecx, 0x3d
mov dword [esp + ecx*2 - 0x5501fd4a], 0x19bfb708
sal dword [esp + ecx*2 - 0x5501fd46], 0x36
not edx
jne 0x14e889b
syscall
push ecx
call fcn.00ed6b39
imul cx, cx
shr word [esp + 1], 0xee
lea edx, [esp + edx + 4]
setae cl
sar ecx, 0xcf
shr cl, 0xe7
mov dword [edx], eax
jnp 0xeba388
or dword [esp], ecx
mov edx, dword [esi - 5]
adc word [esp + 1], cx
xor edx, ebx
dec edx
movsx eax, cl
neg edx
jmp 0xe7bf4f
add dword [esp + ecx - 0x2a80fea1], ecx
and eax, edx
movzx edx, byte [esi + ecx - 0x2a80fea6]
sub dword [esp + ecx - 0x2a80fea1], ecx
xor dl, bl
or cx, cx
adc dword [esp + ecx - 0x2a80fea2], ecx
xor dl, 0x91
and cl, ch
not dl
dec dl
neg dl
pop ecx
xor bl, dl
jmp 0x14a605d