joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e58351
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + edx - 0x589bef2d]
push edx
mov eax, dword ss:[edx + ecx - 0x589bef31]
bswap edx
movsx ecx, dl
mov cl, byte [edi + edx*2 - 0x63df36b0]
xor byte [esp + edx - 0x31ef9b58], dh
xor dx, word [esp + edx - 0x31ef9b57]
inc byte [esp + edx - 0x31ef00b4]
xor cl, bl
sub edx, 0x2b5688b
je 0x21df579
dec cl
lea edx, [edx + edx*8 + 0x3e210190]
not cl
rol cl, 1
bswap edx
neg dword [esp + edx*4 - 0x716c9f9c]
add cl, 0xf
rol word [esp + edx - 0x1c5b27e5], 0x29
neg dx
xor bl, cl
jmp 0x2ed7bd6
movzx edx, al
lea edi, [eax + edi - 0x1131a823]
call fcn.01b85aae
mov ecx, dword [esi]
mov edx, 0x589bef31
jmp 0x1b83d88
xor esi, eax
call fcn.02e2d45f
mov edx, 0xfdb6ca1e
shr dx, 0xc4
mov eax, 0xf726021b
mov edx, dword [esi - 4]
movsx ecx, ax
call fcn.021dbc9a
js 0x2e865d7
neg eax
rol eax, 3
lea eax, [edx + eax - 0x4f31087d]
shl cx, 0xe5
mov dword [esp + edx*2 - 0x402b6e80], 0xc3bd5691
xor ebx, eax
pop ecx
rol ecx, 0x7a
adc ebp, eax
lea eax, [ecx + edx*2 - 0x404d757e]
xadd cx, ax
setge cl
jmp ebp
xchg dword [esp + edx*2 - 0x38b7b032], edx
ror dword [esp], 0xe4
lea ecx, [esp + ecx + 4]
sbb edx, dword [esp]
mov dword [ecx + edx - 0x378652d4], eax
jl 0x2ef8cb9
lea edx, [edx + edx - 0x4ef6ee68]
mov eax, dword [edi + edx - 0x2015b73f]
movsx ecx, byte [esp + edx*2 - 0x402b6e80]
lea edi, [edi + edx - 0x2015b73b]
not dword [esp + edx - 0x2015b740]
xor eax, ebx
sar ecx, cl
xor cx, 0x4cb8
bswap eax
rol eax, 1
inc ecx
jno 0x2ed59c7
neg ecx
or al, 0xb6
js 0x2e49797
mov eax, dword [esi + edx - 0x5f9392b2]
mov cl, byte [edx + esi - 0x5f9392ae]
mov ebp, edx
inc esp
movsx esp, dl
dec eax
lea esi, [esi + ebp - 0x5f9392b0]
shl eax, cl
mov dword [edx + esi - 0x5f9392b2], eax
dec edi
lea ebp, [esp - 0x3871b04f]
call fcn.021b0c9f
movsx ecx, word [esp + eax*2 + 8]
neg ecx
ror edx, 3
bswap edx
inc ax
inc al
ror edx, 1
neg ecx
call fcn.021b40a6
inc ecx
mov ecx, 0xdc93ea37
call fcn.02e33170
or al, 9
ror edx, 2
inc edx
shr ecx, 0x79
neg edx
xor edx, 0x11c929b
inc eax
xor ebx, edx
call fcn.01b9360a
xor ecx, 0xfa2e1d3f
call fcn.021b679c
sub eax, 0x9fb5a08e
call fcn.02e19dc8
js 0x2e8e664

Function at 0x2e5853b
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x85ca3074
call fcn.022040b8
Function at 0x2e5f2f1
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test edx, edx
je 0x2e6b0ad
mov esi, dword [ebp + 0xc]
test sp, bp
test esi, esi
je 0x2e6b0ad
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x2e6b0a7
sub esp, 0x114
clc
cmp esp, edi
push esi
jmp 0x1b9fb36
test ecx, ecx
jmp 0x1bef68b
push ebp
neg bp
test esi, 0xcb0e423f
rol dh, cl
mov ebp, esp
bsr dx, cx
mov edx, dword [ebp + 8]
jmp 0x21ef284
je 0x2eb9b13
mov eax, dword [edx + 0x3c]
stc
add eax, edx
cmp dword [eax], 0x4550
jne 0x2e6b0ad
mov ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
jmp 0x221c924

Function at 0x2e64ef2
Capabilities:
Authenticate hmac

Disassembly:
push eax
dec dword [esp + ecx*2 - 0x1fe]
ror edx, 1

Function at 0x2e65c3e
Capabilities:
Encode data using xor

Disassembly:
dec dl
mov ecx, 0x7a23bdaf
mov dword [esp + ecx - 0x7a23bdaf], ecx
neg dl
shr dword [esp + ecx - 0x7a23bdaf], cl
pop ecx
inc dl
xor dl, 0x30
jmp 0x21b6862

Function at 0x2e670c5
Capabilities:
Encode data using base64

Disassembly:
inc esp
movsx esp, cl
inc ecx
shl cl, 0x21
inc ebp
xor bl, al
inc cx
sub ebp, 0x416645bd
xadd esi, edx
dec esi
lea eax, [esp + eax + 0x18]
call fcn.021cac1e
and al, al
xor bl, cl
call fcn.02ec2c66

Function at 0x2e670ee
Capabilities:
Encode data using base64

Disassembly:
inc ecx
inc edx
inc ecx
ror edx, 2
pop ecx
inc si
xchg dword [esp + ecx - 0x99a3], ecx
inc ecx
bswap edx
inc ecx
dec edx
dec esp
mov dword [esp + ebp*4 - 0x266a0], ebx
call fcn.02e9ca76

Function at 0x2e691ee
Capabilities:
Encode data using base64

Disassembly:
inc ecx
bswap ebp
inc ecx
pop esp
inc ecx
dec ebp
inc ecx
shr dh, 3
call fcn.0222c256

Function at 0x2e691ff
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov dword [esp], 0x85c2f2ca
call fcn.022040b8
xor ecx, ebx
bswap ecx
jmp 0x2e90fb3
ror ecx, 1
mov dword [esp], 0xfc9e5f3d
push 0x9a026bb7
dec ecx
xor ecx, 0x599621a8
neg ecx
dec ecx
xor ebx, ecx
add ebp, ecx
lea esp, [esp + 8]
jmp 0x2e58548

Function at 0x2e6a9cf
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + eax - 0x67767f31]
xor dl, bl
mov dword [esp + eax - 0x67767f2c], 0x3196098f
add eax, 0x82a0ef8a
dec dl
bswap eax
neg dl
inc dl
sar eax, 0xc2
jae 0x1b7cfe4
xor dl, 0x30
xor bl, dl
push eax
mov dword [esp + 2], eax
lea edx, [esp + edx + 0x10]
mov dword [edx], ecx
movsx edx, word [esp + 4]
and byte [esp + 5], dh
call fcn.0219633c
mov ax, word [esi]
mov ecx, 0x76915732
movzx edx, cx
movzx edx, byte [edi + ecx - 0x76915732]
neg ecx
inc ecx
xor dl, bl
add cx, cx
rol dl, 1
inc dl
ror cl, 0xc5
neg dl
add dl, 0x16
xor bl, dl
call fcn.02e15dbe
xor ecx, ebx
shr dword [esp], 0xf3
inc ecx
jmp 0x21b6823

Function at 0x2e6bcc0
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + 4], 0x85d7ca7a
lea esp, [esp + 4]
call fcn.022040b8

Function at 0x2e6bcd1
Capabilities:
Authenticate hmac

Disassembly:
dec eax
lea esi, [esi + eax*2 - 0xc606]
dec esp
mov dword [esp + eax*2 - 0xc60c], esp
not word [esp + eax - 0x6300]
inc sp
mov dword [eax + esi - 0x6306], ecx
push eax
jmp 0x21a8029
Function at 0x2e72622
Capabilities:
Encode data using base64

Disassembly:
lea edx, [ecx*4 + 0x12917093]
lea edi, [edi + ecx - 0x6989b00a]
mov ecx, dword [edi + ecx - 0x6989b006]
call fcn.02e3a6bd
call fcn.02ee7bda
inc ecx
not eax
dec esi
mov dword [esp + edx*4 - 0x20], ebx
jb 0x220078f
inc esi
xor dword [esp + edx*2 - 0xc], eax
dec esi
mov ebx, dword [esp + edx*2 - 0xc]
dec ecx
xor edx, 0x1e3c4cae
inc esp
xchg ecx, ebp
dec edx
inc dword [esp + edx - 0x1e3c4ca4]
dec ebp
arpl ax, ax
inc edx
sub dword [esp + edx*2 - 0x3c789947], 0x4c8d1f9b
inc ecx
xchg edi, ecx
dec ecx
add edi, eax
dec edx
dec dword [esp + edx - 0x1e3c4ca4]
dec esi
mov dword [esp + edx - 0x1e3c4c9c], edx
pop eax
pop eax
jnp fcn.02e1aa1a
neg dword [esp + edx + 0x310c1503]
dec ecx
adc edi, ebp
inc ecx
shl ah, 0xc2
inc si
movzx edx, byte [esi + esi - 0x33a9da3f]
inc sp
add esi, ecx
inc esp
mov cl, byte [esi + edx + 0x310c1501]
inc edx
dec byte [esp + esi - 0x33a9dac0]
dec eax
lea esi, [esi + edx + 0x310c1501]
inc ecx
push esp
inc ebp
and dl, cl
inc ecx
not dl
movsx ebp, word [esp + edx + 0x310c1500]
call fcn.02e2c624
not eax
call fcn.02e8f093
sar ax, 0x44
inc edx
shr eax, cl
xor edx, 0x2d9ba380
xor ebx, edx
shr eax, cl
call fcn.02ef9151
pushfd
mov dword [esp + 4], 0x805d8767
lea esp, [esp + 4]
call fcn.02f05847
jecxz 0x2e726a4
outsb dx, byte [esi]
popal
imul ebp, dword fs:[edx], 0x52c77b1f
sbb bh, bl
xchg esp, eax
cmp edx, edx
xchg ebx, eax
in al, 0xff
xor edx, ebx
lea eax, [ecx + 0x67262ebd]
not al
sub al, ch
lea edx, [edx + eax + 0x404d01f5]
xor eax, ecx
bswap edx
dec eax
not edx
jg 0x2e38d4e
mov ecx, 0x6989b006
jmp 0x21e96ba

Function at 0x2e7544e
Capabilities:
Encode data using base64

Disassembly:
inc ebp
movzx eax, bh
dec ecx
xor esp, 0x4b39d936
dec edi
lea esp, [esp + ecx*4 + 0x544ce874]
call fcn.02213f9d

Function at 0x2e7b68e
Capabilities:
Encode data using base64

Disassembly:
sub dword [esp + eax - 0x7217399c], eax
and cx, dx
jmp 0x2efd052
call fcn.02e36540
or dx, word [edx + ebp + 2]
shl byte [esp + eax*2], 0x81
lea ebp, [ebp + eax + 2]
adc eax, 0x7217399c
jg 0x21c2980
dec eax
mov dword [esp], 0x99ad39bc
push ebp
dec eax
sub ebx, 4
inc esp
mov esi, dword [ebx]
inc ebp
inc ebp
xor esi, ebx
jmp 0x2e43cf1

Function at 0x2e7c488
Capabilities:
Encode data using base64

Disassembly:
xor dx, dx
xor eax, 0x15359a11
movzx ecx, dx
lea eax, [ecx + eax + 0x5b16a01e]
xor ebx, eax
mov dword [esp + ecx*2], 0x52a36e13
add ebp, eax
lea eax, [ecx + ecx*4 - 0x1ee9e368]
add dl, byte [edi + ecx*8]
ror ecx, 0x3b
rol cx, 0xae
xor cl, byte [edi + ecx*2 + 2]
and ax, ax
and dl, cl
pop eax
shr dword [esp + eax - 0x52a36e11], 3
not dl
mov ecx, 0x439c2421
sar ax, 0x61
not dword [esp + ecx - 0x439c241d]
movzx dx, dl
xadd dword [esp + ecx - 0x439c2421], eax
shr eax, cl
shl cx, cl
mov cl, byte [eax + edi - 0xc7b764d]
jg 0x2e53e20
Function at 0x2e847e7
Capabilities:
Execute syscall
Get number of processors

Disassembly:
not eax
inc ecx
rol ecx, 1
mov dword [esp], eax
call fcn.02e706fc

Function at 0x2e85442
Capabilities:
Encode data using base64

Disassembly:
inc ecx
movsx eax, dx
call fcn.02e359aa
sub edi, 4
mov edx, 0xdc06a602
mov eax, 0x4e86cc08
movsx ecx, ax
mov edx, dword [edi + eax - 0x4e86cc08]
jmp 0x2e8af23
ret
add esi, 6
call fcn.021dfa44
mov ecx, 0x1e041ba3
mov eax, 0x6926919e
shl eax, cl
movzx ecx, byte [ecx + esi - 0x1e041ba4]
xor cl, bl
call fcn.02ed724e
inc ecx
mov esp, 0x3888601e
inc ebp
movzx eax, sp
inc edx
mov ebp, dword [ebx - 0x38886022]
inc ecx
mov edx, esp
movzx eax, dx
inc esp
mov ebp, eax
dec edx
lea ebx, [ebx + eax - 0x6022]
call fcn.02ee55a7
inc ecx
mov ecx, 0x72f96b8
rdtsc
inc ebp
mov edi, ecx
inc ebp
movsx esp, bh
dec edx
lea esi, [esi + ecx - 0x72f96c0]
dec edx
lea ecx, [ecx*4 + 0x2621673d]
push ecx
inc ecx
and esp, 0xb9a13b1
inc ecx
mov dword [ecx + esi - 0x72f96b4], eax
dec esi
adc esp, dword [esp + ecx*4 - 0x1cbe5ae0]
inc edx
mov dword [esi + ecx*2 - 0xe5f2d70], edx
dec esi
add dword [esp + ecx - 0x72f96b8], edi
jle 0x1bd9aaa
dec edx
lea ebx, [ebx + ecx*4 - 0x1cbe5ae4]
jge 0x2e5d179
mov eax, dword [esi]
mov ecx, 0xf5a67097
movzx edx, cl
inc dl
mov edx, dword [esi + edx*2 - 0x12c]
mov cl, byte [esi + 8]
jl 0x21a5e78
neg dl
neg ecx
xor bl, dl
lea edx, [esp + edx + 0x14]
neg al
add al, ah
mov eax, dword [edx + eax - 0x5836]
sub edi, 4
dec dword [esp + 5]
mov dword [edi], eax
pop edx
pop edx
pop eax
pop ecx
pop ecx
jl fcn.02ecf313
jmp 0x21f45e4
inc esi
mov edx, dword [ebx + ecx*8 - 0x397cb5c0]
dec esi
lea esi, [0xf61c2cbb]
dec ebx
lea eax, [esi + ecx*2 + 0x4727010f]
inc ebp
xor edx, ebx
inc dx
inc dword [esp + ecx*2 - 0xe5f2d6c]
jl 0x1bcd80a
inc ecx
rol edx, 3
inc ecx
movsx edx, sp
inc edi
lea edx, [edx + ecx*2 + 0x3535d542]
call fcn.02e93a1a
movzx ecx, dx
mov eax, dword [edx + edi - 0x2da65aa0]
shr ecx, 0x1f
seta dl
mov edx, dword [edx + edi - 0x2da659fc]
sar cx, 0x46
sal cx, 0x69
call fcn.02eed573
add cx, 0x1438
neg dl
push ecx
xchg word [esp + ecx - 0x322c14d7], cx
movsx eax, word [esp + ecx - 0x322ccafd]
rol dl, cl
push ecx
sub dl, 0x12
add cx, ax
xor dl, 1
and dword [esp + ecx - 0x322c2318], eax
push ecx
jg 0x223ee54
lea ecx, [edx*4 - 0x447032ec]
ror eax, 3
sar cl, 0xa5
adc dl, 0x98
bswap eax
mov dword [esp], edx
ror eax, 1
not edx
dec eax
sal word [esp + edx - 0x38a4be7], 0x8a
sbb byte [esp + edx*4 - 0xe292f95], ch
xor ebx, eax
add ebp, eax
shl dx, 0xad
inc edx
pop ecx
pop edx
jge fcn.02211a4f
jmp 0x2e3e278
call fcn.01b9004a

Function at 0x2e8aed9
Capabilities:
Get number of processors

Disassembly:
pushfd
mov dword [esp], 0x85c2f2ca
call fcn.022040b8
lea esp, [esp + 4]
jmp 0x1bba4be

Function at 0x2e8e626
Capabilities:
Encode data using base64

Disassembly:
dec ebp
mov eax, esi
call fcn.021a8d24
inc ecx
mov ecx, 0x3e889a0b
inc ebp
mov edi, ecx
inc edx
movzx ebp, byte [ebx + ecx - 0x3e889a0c]
inc ebp
mov edx, ecx
dec esi
lea eax, [edi*4 - 0x60e7acc5]
inc ecx
xor ch, bl
inc ecx
neg bh
call fcn.02e4a641
Function at 0x2e8e696
Capabilities:
Encode data using xor

Disassembly:
ror edx, 1
lea ecx, [eax + eax + 0x49b6c89c]
shr ax, 0xe2
dec edx
xor ebx, edx
lea ecx, [eax + eax*8 + 0x1f99310e]
add ebp, edx
call fcn.021f51d5
arpl word [edx + 0x60], bp
insb byte es:[edi], dx
bound esi, qword [ebp + 3]
xor edi, ecx
push edx
je 0x2e2615b
push edx
xor dword [edx + 0x3b], ebx
cmp al, 0x37
dec ecx
cmp edi, ecx
dec ecx
mov edx, dword [eax + edi - 0x6e460082]
mov dword [esp + eax - 0x6e460083], eax
xor edx, ebx
ror edx, 3
sub eax, dword [esp + eax - 0x6e460083]
adc al, byte [esp + eax*4 + 1]
bswap edx
jp 0x2e26159

Function at 0x2e950dd
Capabilities:
Get number of processors

Disassembly:
not edx
lea esi, [ecx + esi - 0x1b815d8d]
push edx
inc cl
xadd word [esp + ecx*2 - 0x3702bb06], dx
pop edx
pop ecx
pop edx
pop eax
jb fcn.02e8367f

Function at 0x2e9a7e8
Capabilities:
Encode data using base64

Disassembly:
xor cl, bl
dec cl
not ax
pop eax
xor cl, 0x82
call fcn.02ea6780

Function at 0x2ead663
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ecx*2 - 0x1fd17298], 0xcb9c3498
dec eax
mov dword [esp + ecx*2 - 0x1fd17298], edi
ret
dec esi
mov ebx, dword [esp + esi - 0x21b39ea1]
dec ebp
arpl sp, sp
dec ecx
add edi, esp
inc ecx
pop eax
dec esi
mov ecx, dword [esi + esi - 0x21b39ea9]
inc ecx
shr bh, 0x47
inc edi
mov esi, dword [ecx + esi - 0x21b39ea9]
dec eax
lea esi, [ecx + esi - 0xfe8b948]
inc esp
mov dword [ecx + esi - 0xfe8b94c], esi
inc esp
movzx esp, cx
jns 0x21b1aca
Function at 0x2ead6a2
Capabilities:
Encode data using base64

Disassembly:
inc ecx
ror eax, 2
inc ecx
movzx ebp, dh
jmp 0x2eb2fba
inc ebp
mov ebx, edi
inc esi
xor dword [esp + esi - 0x68ec73cc], eax
sub edx, 0xe2aa251c
inc ecx
bswap esp
inc ecx
pop ebx
inc bp
or edx, edi
inc ebp
mov ebp, edi
dec eax
lea esi, [esi + ecx*2 - 0x4000150c]
inc esp
mov dword [esi + ecx*2 - 0x40001508], eax
inc cx
xadd edi, edx
jl fcn.02e1aa1a
dec ecx
lea esi, [edx + esi - 0x68c8bfa4]
dec ebp
lea esi, [esi + eax + 0x252605b4]
inc ecx
shl ah, 0xc1
dec ecx
lea ebx, [edx + ebx - 0x68c8bfa9]
inc ecx
mov ebp, 0x9596e134
inc ecx
movzx ecx, ch
inc esp
movzx esi, byte [ebx + edx - 0x40a8]
push ecx
inc ebp
mov eax, esp
bswap eax
inc ebp
xor dh, bl
inc ecx
dec dh
inc ecx
neg dh
inc esi
xchg byte [esp + edx - 0x68c8bfa8], al
dec eax
mov dword [esp + edx - 0x4098], edx
not dword [esp + edx - 0x40a1]
inc ecx
dec dh
jmp fcn.02e18e34
neg eax
call fcn.01bc5056
ret
mov eax, 0x6fbe8b9f
ror edx, 3
or al, al
neg ecx
neg edx
not edx
rol edx, 3
jmp 0x2206059
dec ecx
add edi, ebp
dec ecx
not esi
dec eax
lea ebx, [ebx + ecx - 4]
dec esp
mov dword [esp + ecx], esi
dec eax
lea ecx, [edx - 0x33d7b7c8]
dec esi
or dword [esp + esi - 0x68ec73cc], esi
inc esi
mov eax, dword [ebx + esi - 0x68ec73cc]
inc ebp
xor eax, ebx
inc cx
rol esp, 0x8f
dec edx
sub dword [esp + esi - 0x68ec73cc], ecx
inc ecx
ror eax, 1
inc ecx
sub eax, 0xd69b29bb
inc ecx
and edx, edx
dec edx
and dword [esp - 0x801e], 0x65338ea6
jg 0x1b81be3
mov edx, 0x700b9fa8
mov cx, word [esi + edx - 0x700b9fa8]
movzx eax, dx
xadd eax, edx
mov ax, word [esi + eax - 0x700c3f4e]
sal dx, 0xe6
add cx, ax
mov word [esi + edx*2 - 0x1d3fe], cx
mov eax, edx
mov ecx, dword [edx + edi - 0xea00]
lea edi, [edi + edx - 0xe9fc]
push edx
pop edx
call fcn.01b9a8c2
mov eax, 0xfe24a22a
movsx edx, ax
call fcn.021f0e13
jmp 0x2efa652
pop ecx
inc ecx
xor eax, 0xb186ccb7
inc ecx
push ebx
inc cx
sar ecx, 0x45
jae 0x1bde587
not dl
ror dl, 1
pop eax
shl ax, 0x49
add dl, 0x94
xor ax, ax
rol dl, 1
call fcn.02ebdeb0
xor ebx, edx
add ebp, edx
inc al
mov edx, 0x6f2a7b10
sar al, 0xc7
jb fcn.02211a4f
mov ecx, 0x7a906613
mov edx, dword [edi + ecx - 0x7a906613]
xor edx, ebx
jmp 0x2e4830e
Function at 0x2eb0f2c
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xffa3fff3
jmp eax
cwde
cmp byte [ebp + 0x35134984], cl
aas
adc eax, 0x5627b95f
add dh, byte [eax - 0x3e3e48f1]
call 0x12be0673
enter 0xfffffffffffff766, 0xffffffffffffffd8
mov dword [edi + eax - 0x58010000], edx
jo 0x21b4b10
cmp esi, dword [eax]
dec dword [ebx + 0x684]
jmp dword [edi + 0x16e8c90f]
mov eax, dword [esi + eax - 0x58010000]
bswap ecx
call fcn.02ee5042
mov dword [esp + ecx - 0x46178578], ecx
lea edx, [edx + ecx*2 - 0x4f19ae32]
or al, 0x88
jp 0x2eb0f1a
mov ecx, 0xce4a948d
push ecx
out 0xb0, al
ror eax, cl
xor ebx, edx
not byte [esp + eax - 0x242d80f6]
mov dword [esp + eax - 0x242d80f4], eax
add edi, edx
add al, 0xc
jg 0x2eb0f1d
fild dword [ebx]
cli
call fcn.02213255
inc esp
movsx ebx, dl
inc ecx
pop ebx
dec eax
bswap ecx
inc esp
and esp, eax
inc ebp
adc edx, ecx
dec eax
arpl bp, bp
call fcn.02e2efc5
jbe 0x2eb0f2e
loopne 0x2eb0ef5
popfd
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
fdiv qword [ebx]
pop ebx
call 0x102d9d5a
pop ebx
call 0x10dd3108
pop ebx
call 0x10a574b6
pop ebx
call 0x10ad3c9c
pop ebx
call 0x10b56532
pop ebx
call 0x107d64f0
pop ebx
call 0xfee0522
pop ebx
call 0x100df550
pop ebx
call 0x4e02e536
pop ebp
imul ecx, dword [edx - 0x1d888a], 0x61ffffff
or al, 0xf
jnp 0x2eb0f47
xchg ebx, eax
sahf
dec ebp
adc ecx, dword [esi*4 - 0x5cbe4d53]
jae 0x2eb1011
insd dword es:[edi], dx
inc edx
inc ecx
mov dword [0xaadd4173], eax
inc ecx
mov dword [0x42453973], eax
inc ecx
mov dword [0x5a6d0973], eax
pop edx
inc ecx
mov dword [0xfab96973], eax
inc ecx
mov dword [0x82a5d173], eax
inc ecx
mov dword [0xd2f19973], eax
inc ecx
mov dword [0x724d6573], eax
out 0xd6, al
rol byte [ecx - 0x5d], cl
jae 0x2eb1053
dec ebp
jb 0x2eb0fd7
salc
in eax, dx
loopne 0x2eb0fe9
push ss
add byte [esp], dh
call 0xe08eb79f
cmc
sbb dl, byte [edx]
pop ebx
call 0x157539d8
pop ebx
call 0x1536054a
pop ebx
call 0x15e589e4
pop ebx
call 0x15559df6
pop ebx
call 0x158d1a14
pop ebx
call 0x153ded92
cli
adc bl, byte [ebx - 0x18]
fisttp qword [ebp - 0x17a4ed96]
cmc
or dword [edx + 0x6de85b12], esp
fst qword [edx + 0x12]
pop ebx
call 0x15ad3184
pop ebx
call 0x4df37d32
pop ebp
in eax, dx
sbb ch, byte [ecx + 0x77]
loop 0x2eb1037
invalid
mov bl, byte [esi - 0x5d]
jae 0x2eb109d
xchg ecx, eax
loop 0x2eb10b9
mov dword [0x1a4d9973], eax
pop esi
mov dword [0xd2814573], eax
pop esi
mov dword [0xeaedf973], eax
pop esi
mov dword [0x82918573], eax
pop esi
mov dword [0x6dc58173], eax
out 0xd6, al
mov edx, 0xfdaa767e
bound ecx, qword [ecx + 0x69]
xchg edx, eax
mov ebx, 0x268417cd
fbstp tbyte [edi + ecx*8 - 0x79]
push edx
jae 0x2eb10e5
or ebx, ecx
je 0x2eb1095
mov cl, 0x92
sub ebx, dword [0x2af7ffff]
mov esi, 0x5df8dcfa
fdiv st(0), st(0)
pop ebp
dec ebx
push esi
cmpsb byte [esi], byte es:[edi]
sahf
xor eax, dword [edi]
imul eax, dword [0xb757caa6], 0xda8f75f2
in al, 0xd5
adc dword [edx - 0x44f17309], ecx
movsb byte es:[edi], byte [esi]
push edi
das
inc esp
or byte [esi], dh
cli
hlt
pop ebp
lcall 0x25a, 0x4d7d36be
iretd
Function at 0x2eb2f12
Capabilities:
Encode data using xor

Disassembly:
call fcn.02eea7a6
inc ecx
bswap ecx
inc ecx
movsx ebp, ax
inc ebp
mov esp, eax
jno 0x2e709f6
dec esi
mov dword [esp + edi - 0x1b72399], ebx
inc esi
xor dword [esp + edi - 0x1b72399], ecx
dec ebp
and edi, ebp
sal al, 4
jnp 0x2218630
inc ecx
pop ebx
dec ebp
arpl cx, cx
inc ecx
mov edx, 0x2ebdb13e
inc ebp
dec ecx
add edi, ecx
push ebp
dec eax
lea ecx, [eax*8 - 0x1e7c10ee]
call fcn.021c7439
call fcn.02e48a45
mov eax, 0xf0045e0b
inc ax
mov ecx, dword [esi - 4]
push eax
setge al
xor ecx, ebx
mov edx, 0x9e11150a
not ecx
neg edx
rol ecx, 3
xadd byte [esp + edx - 0x61eeeaf6], dh
shr dword [esp + edx - 0x61ee0cf6], 0xee
mov word [esp + edx - 0x61ee0cf5], 0x5a02
inc ecx
bswap ecx
jmp 0x2eca0cf
xor ebx, ecx
add edi, ecx
mov cx, word [ebp + edx - 0x61ee0cf6]
inc dx
setne dl
movzx edx, byte [esi + edx - 0x61ee0c06]
setge al
jne 0x21a4383
jmp 0x21fe1be

Function at 0x2eb2fa0
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [esp + 4]
lea esp, [esp + 8]
not eax
call fcn.01b87f8e

Function at 0x2eb2fcf
Capabilities:
Encode data using base64

Disassembly:
inc ecx
movzx edx, bh
call fcn.02209300

Function at 0x2eb68c2
Capabilities:
Get number of processors

Disassembly:
inc ebp
mov edi, eax
inc ebp
movsx esi, ax
dec eax
arpl dx, dx
inc si
xadd dword [esp + edi - 0x2b2b5bf9], edi
dec eax
adc edi, edx
inc ecx
push eax
inc edx
mov edx, dword [esi + edi - 0x2b2b0004]
inc edx
inc dword [esp + edi - 0x2b2afff2]
inc cx
neg edi
inc ecx
push esi
inc esi
mov edx, dword [esi + edi*2 - 0x5657fff4]
not edx
jp 0x21d325f
inc esp
mov ebp, dword [esi]
inc ecx
mov eax, 0x136062e
inc ebp
mov ecx, dword [eax + esi - 0x136062a]
inc ecx
mov ecx, eax
dec esp
lea esp, [ecx + ecx*8 - 0x72c44dda]
inc edx
mov cl, byte [esi + eax*2 - 0x26c0c54]
inc ecx
movzx edx, sp
ror dx, 0x4a
dec edx
lea esi, [esi + eax*2 - 0x26c0c56]
jae 0x2eea19b
inc esi
mov dword [esp + edi - 0x2b2bfff5], edi
inc cx
ror esi, 0x66
inc ecx
not edx
inc ecx
mov ecx, eax
dec edx
mov dword [esp + esi*8 - 0x7ab58], eax
inc ecx
pop ecx
inc ecx
or edx, edx
inc edx
mov dword [esi + edi - 0x2b2bfff8], edx
inc ecx
xor edx, ebx
ror edx, 3
dec dword [esp + 0x11]
dec edx
neg edx
bswap edx
mov eax, dword [esp + 0x12]
dec eax
mov dword [esp + 8], eax
inc esp
mov edx, eax
dec edx
inc esp
xadd byte [esp + 0xd], dl
bswap edx
dec esp
mov dword [esp + 0x10], ebx
dec esp
lea eax, [eax*4 + 0x2b2ceb3d]
dec esp
mov dword [esp], eax
dec ecx
lea ebp, [eax + 0x25bb3c34]
xor dword [esp + 0x10], edx
dec esp
mov ebx, dword [esp + 0x10]
jmp 0x21c0b92

Function at 0x2ee0274
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi]
mov edx, 0xc208831c
add edi, 4
neg dx
xor eax, ebx
not eax
jmp 0x2ebef47
add dword [esp + 8], 0xd7a60f2f
mov dword [ebp + 8], ebx
xchg word [esp + 9], ax
mov dword [ebp + 4], ecx
adc eax, eax
mov dword [ebp + eax - 0x666ec037], edx
js fcn.02ed8cf7
not eax
mov ebx, dword [esp + 0xc]
mov ecx, eax
add ecx, eax
add al, cl
pop eax
pop ecx
pop ecx
pop ecx
jl fcn.021b7ec4
mov eax, 0xa717e997
jmp 0x21d4d60
Function at 0x2eebe5b
Capabilities:
Encode data using base64

Disassembly:
call fcn.021d8b08
sal byte [ebp + 0x6f], cl
push eax
jns 0x21fcfd9
inc ebx
xor dword [ebx - 0x723541f1], esp
movsx ecx, dl
invalid
mov ah, 0x16
invalid
neg edx
lea edx, [edx + ecx*2 - 0x408ced7c]
call fcn.021a1199
mov edx, 0xc1a5fc3d
movsx eax, dl
mov ecx, dword [esi + eax*8 - 0x1e8]
dec edx
ror dx, 0x6a
mov al, byte [edi + eax - 0x3d]
inc edx
inc dx
xor al, bl
add dl, dh
setbe dl
dec al
push edx
not al
bswap edx
shr dl, 0xc4
inc byte [esp + edx - 0xfa509]
rol al, 1
shr edx, 0x42
adc al, 0xf
lea edx, [edx + 0x2e0ed31d]
xor bl, al
add dl, dh
lea eax, [esp + eax + 4]
mov dword [edx + eax - 0x2e12bc1c], ecx
movsx ecx, dx
jg 0x21fcf5d
inc ecx
bswap ebp
dec ecx
shr edx, 0x81
call fcn.02eb4f90

Function at 0x2eee698
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov eax, dword [esi + ebp - 0x5cd0f7db]
inc ecx
movzx eax, ah
inc esp
movzx ebp, byte [ebx + ebp - 0x5cd0f7e0]
inc ebp
xor ch, bl
and dl, 0x2c
inc ecx
xor ch, 4
dec eax
bswap eax
dec eax
mov dword [esp + edx*2 - 0x104bf610], 0x72393c06
call fcn.01b9fa8b
dec esp
lea esp, [ebp + ebp*4 + 0x14aec4a9]
inc ebp
xor ebp, ebx
movsx edx, bp
inc ecx
dec ebp
shl edx, 0x11
inc ecx
ror ebp, 1
neg ebp
movsx ecx, dl
inc ecx
sub ebp, 0xdf8d2102
inc ecx
and ah, 0xaf
inc esp
mov esi, edx
push ebp
inc ecx
xor ebp, 0x9831d3bf
inc ecx
not ebp
dec esp
mov dword [esp + ebp - 0x5cd0f7d3], ebx
sub cx, word [esp + edx - 0x104a0000]
inc esp
xor dword [esp + ebp - 0x5cd0f7d3], ebp
xchg dword [esp + edx*2 - 0x2093fffe], ecx
sar byte [esp + ebp - 0x5cd0f7d7], 0x83
dec esp
mov ebx, dword [esp + edx*2 - 0x2093fff8]
dec eax
inc ecx
inc esp
movzx edx, bp
rol byte [esp + ebp - 0x5cd0f7da], 0x67
dec ebp
arpl bp, bp
dec ecx
add edi, ebp
pop edx
jmp 0x2e9d190

Function at 0x2ef5fcd
Capabilities:
Get number of processors

Disassembly:
mov edx, dword [edi + eax - 0x9b39134]
not ax
xor edx, ebx
call fcn.01be7a6a
add cx, dx
mov word [esi + eax*8 - 0x4d9c899e], cx
mov dword [esp + eax*4 - 0x26ce44c8], eax
mov dword [esp + eax - 0x9b39134], eax
jmp 0x21ae557

Function at 0x2ef8c93
Capabilities:
Encode data using base64

Disassembly:
add esi, 4
xor eax, eax
test edx, edx
lea esp, [esp + 4]
je 0x2ea1ae6
push esi

Function at 0x2efbd77
Capabilities:
Get number of processors

Disassembly:
not cx
movzx edx, byte [edi + edx*2 - 0xcedede0]
rol cl, cl
lea edi, [edi + ecx*2 - 0x7334e63e]
mov dword [esp + ecx - 0x399a731c], 0x7807ecb3
xor dl, bl
ror byte [esp + ecx*2 - 0x7334e626], 3
mov dword [esp + ecx - 0x399a7318], ecx
inc dl
xor ecx, ecx
sal ecx, 0x86
not dl
sbb dl, 0xaf
neg ecx
neg dl
sar cl, 0x47
jns 0x1be2ee2

Function at 0x2efc49f
Capabilities:
Encode data using base64

Disassembly:
ror dx, 0xe1
mov dword [eax + esi - 6], ecx
movzx ecx, dl
adc eax, ecx
lea esi, [esi + eax - 0x2c]
xor eax, dword [esp + ecx - 0xd]
mov dword [esp + ecx - 0x21], 0x27b8eebc
sar ecx, cl
pop ecx
pop eax
pop ecx
pop eax
pop edx
pop edx
pop ecx
jnp fcn.02211a4f