joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9bf5de
Capabilities:
Encode data using base64

Disassembly:
lea edx, [eax*2 - 0x7c52035e]
bt dx, 0xb3
not ecx
rol ecx, 2
jmp 0xaf2e7e
xor al, 0xb7
ror cl, cl
sbb al, 0xe
xor bl, al
mov dword [esp + ecx*2 - 0x4e88005c], 0x54254599
btr dx, 0x9c
shl dword [esp + ecx - 0x2744002e], 0xdd
mov word [ecx + ebp - 0x27440030], ax
movzx ecx, byte [esi + ecx*2 - 0x4e88005b]
dec byte [esp + 3]
xor cl, bl
sar byte [esp], 0x67
xor cl, 4
and dword [esp], edx
mov eax, edx
sal byte [esp], 0xe1
dec cl
imul eax, eax
sal ax, 9
rol cl, 1
not al
xor cl, 0x16
xor bl, cl
inc al
sal dword [esp + eax*4 - 0x18038800], 0xb0
lea ecx, [esp + ecx + 4]
movzx ax, byte [ecx + eax - 0x600e200]
movzx ecx, dx
push edx
not dword [esp + ecx*2 - 0x4e]
mov word [ebp + ecx - 0x2b], ax
neg ecx
adc ebp, 0xfffffffb
sub byte [esp], cl
shr word [esp + 4], 0x82
shl ecx, 0x7b
mov eax, dword [esi + 2]
adc ecx, dword [esp + 3]
adc esi, 6
xchg cx, dx
xor eax, ebx
and dx, dx
sub byte [esp + 6], dl
sub edx, 0x5ca6621b
lea eax, [eax + edx - 0x7c688257]
sbb word [esp + edx - 0x68599e1c], 0xaa04
adc dword [esp + edx - 0x68599e1b], edx
neg ecx
xor eax, 0xc186621d
dec eax
xor dx, 0x8d9f
xor byte [esp + edx - 0x6859137b], dl
lea edx, [edx + edx*4 - 0x654c46ee]
not eax
xor ebx, eax
xor byte [esp + ecx - 0x37ffffd3], cl
sbb byte [esp + ecx - 0x37ffffd5], dh
inc dx
adc edi, eax
rol dword [esp + ecx - 0x37ffffd5], 0x21
pop eax
pop eax
jo fcn.009ca7a3
lea eax, [eax + ecx + 0x354ac83]
btc cx, cx
pop edx
bswap eax
adc ecx, ecx
xor ebx, eax
neg dl
seto byte [esp + ecx - 0x408dcc5e]
add edi, eax
xchg dword [esp + ecx - 0x408dcc62], edx
movzx eax, cx
mov edx, dword [ebp + edx - 0x1a30ffff]
mov al, byte [ebp + ecx - 0x408dcc5e]
bt ecx, ecx
jae 0xaf54e5
sbb dword [esp + eax*8 - 0x792541fd], eax
lea edi, [edi + eax*2 - 0x1e49507c]
mul ax
xor ecx, ebx
and dl, 0x96
shl byte [esp + eax - 0xf240ffe], 2
mul eax
bswap ecx
not ecx
mov dword [esp + edx - 0xe53ef0], edx
mul ax
dec ecx
div eax
xor ecx, 0xa92d83
mul eax
sbb edx, edx
xor ebx, ecx
add edx, edx
add esi, ecx
mul word [esp + eax - 0x73f85ea0]
adc eax, 0x110e09ae
pop ecx
pop edx
jmp esi
bts ecx, 0x2f
lea ebp, [ecx + ebp - 0x408dcc5c]
mov byte es:[edx + ecx - 0x408dcc62], al
jb 0xc03ed5
movzx edx, byte [edi]
mov ecx, 0xd0e7d92
lea edi, [ecx + edi - 0xd0e7d91]
lea eax, [ecx + ecx*2 + 0x3a231b3b]
xor dl, bl
rol eax, cl
and eax, ecx
call fcn.00aba24e
mov edx, dword [ebp]
mov eax, 0xe015b89a
mov cl, byte [ebp + 4]
add eax, 0x990f8a39
lea ebp, [ebp + eax - 0x792542cd]
setno al
push eax
shr eax, 0x43
mov byte [edx + eax*8 - 0x79254200], cl
push eax
lea edx, [eax + eax*2 + 0x45be9f8a]
mov ecx, dword [edi + edx - 0x732c984a]
or dword [esp + eax - 0xf24a83c], 0x55000d18
jno 0xa997a8
jb 0x94f537
rol dword [esp], 0xc4
adc edi, 7
mov eax, 0x2ca3b886
jmp 0xbe1671
adc byte [esp + ecx - 0x408dcc5e], cl
mov dword [esp + ecx - 0x408dcc62], edi
ret 4

Function at 0x9c14fc
Capabilities:
Encode data using base64

Disassembly:
inc edx
mov dword [esp], 0x249bb19b
not dword [esp + 4]
rol word [esp + 5], 0xe5
xor eax, 0x7da37b1c
push 0xb4dd33
shl dword [esp + 8], 0x74
mov dword [esp + 0xc], 0x9103a2ad
dec ecx
call fcn.0097ae67
Function at 0x9cdd08
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp]
push 0x740cf4a8
call fcn.00c374a6
mov ecx, 0x961d8192
sar cx, 0x45
movzx eax, cx
mov edx, dword [eax + esi - 0xfc0c]
neg ecx
inc al
ror eax, 0xc8
mov cl, byte [esi + eax - 0xd0000f8]
shr edx, cl
movzx ecx, ax
btr ecx, ecx
mov dword [esi + eax*2 - 0x1a0001f6], edx
neg al
lea eax, [eax + ecx - 0x51c646e0]
cmova ax, cx
mov eax, dword [ebp + ecx*8 - 0x7e4]
neg ecx
movzx edx, cx
sbb ecx, ecx
lea ebp, [ebp + edx - 0xff08]
btr edx, 0x30
ror edx, 0x86
xor eax, ebx
sal ecx, 0x5b
ror dx, 0x2d
dec eax
xor dx, 0x8507
inc ecx
sal ecx, 0xce
rol eax, 1
rol dl, 0x22
rol dl, 0x21
rol edx, 0xa1
neg eax
imul ecx, edx
sub edx, edx
ror eax, 3
xor ebx, eax
imul dx, dx
call fcn.00b86a7e
xor ebx, eax
or cx, cx
neg cx
add edi, eax
not edx
mov ax, word [ebp + ecx - 0x45bf9000]
lea ebp, [ebp + ecx - 0x45bf8ffe]
shl ecx, 0x50
sal ecx, 0xbe
neg dl
lea esi, [esi + ecx*2 - 1]
xor cl, byte [esi + ecx*4]
not edx
bt edx, edx
not dl
xor cl, bl
jmp 0xb851d1
dec edi
mov esp, dword [ebx + edx - 0x2e]
dec edx
shr dword [esp + ebx - 0x2e], cl
inc cx
xor eax, 0xf749369a
salc
dec ecx
not esp
dec ebp
or esi, esp
dec edi
mov dword [edx + ebx*2 - 0x64], esi
dec edi
lea edx, [edx + ebx - 0x2e]
dec esi
mov dword [esp + ebx - 0x36], ecx
ret 8
bswap edx
neg cl
ror cl, 1
xor dl, dh
shr dx, 0xe8
and edx, edx
sbb cl, 0x80
inc dx
rol cl, 1
btc dx, 0x39
call fcn.00a7ca7e
xor edi, 0x8512f21e
inc ecx
lea edi, [edi + edi + 0x7748ea85]
dec eax
or ecx, esi
ror edi, 1
cwde
inc ecx
sal bh, 0xe4
inc edx
dec dword [esp + ebx - 0x2c]
dec edx
mov dword [esp + ebx*2 - 0x64], ebx
inc edx
xor dword [esp + ebx - 0x2e], edi
inc edx
shr dword [esp + edi - 0x4bdc81de], 0xa5
inc esp
mov esp, dword [esp + edx - 0x6cc13e61]
cdq
dec edx
mov ebx, dword [esp + edi - 0x4bdc81d8]
dec ecx
xchg esp, eax
dec edx
mov dword [esp + edi - 0x4bdc81d8], 0xa79318b0
dec eax
arpl di, di
dec eax
cdq
dec esp
add ecx, edi
dec ecx
bswap edi
pop ecx
inc cx
not esi
dec edi
mov esi, dword [edx + ebx - 0x36]
mul dx
inc ecx
push edi
jae 0xa04d5f
sub byte [esi + edx], ch
sub eax, 0x93e45a07
or dh, byte [edi + 0x73]
push ss
in al, 0x93
or dl, byte [ebx + 0x67]
add ah, ah
xchg ebx, eax
or dl, byte [ebx + 0x5b]
in al, 0xa1
xchg ebp, eax
or al, 0x66
pop ecx
std
popal
mov eax, dword [0xee59dfc6]
add al, 0xf8
xor al, 0xaa
jns 0xb85268
cmpsd dword [esi], dword es:[edi]
adc dword [eax], esp
lodsb al, byte [esi]
pop eax
push edi
das
pop ebp
inc ebp
inc esp
push 0x4ec464e0
mov dl, al
adc byte [eax + 0x43106006], bl
insb byte es:[edi], dx
stosb byte es:[edi], al
xchg esp, eax
lodsb al, byte [esi]
xchg edx, eax
movsd dword es:[edi], dword [esi]
out dx, eax
mov eax, 0x8bb69c4e
cld
fcom dword [ebx - 0x34]
ljmp 0x3e11
Function at 0x9e3679
Capabilities:
Encode data using base64

Disassembly:
div dl
mov ecx, dword [edx + esi - 0x80c4dac]
xor ecx, ebx
add eax, edx
not ecx
jbe 0xad45c3
jle 0xc3f41b
mov eax, 0x5015aa90
mov eax, dword [ebp + eax - 0x5015aa90]
mov edx, 0x9c1989a7
movzx ecx, dx
mov cl, byte [ebp + ecx - 0x89a3]
sal dx, 0xb
js 0xb5fb7e
sbb dx, 0x9503
adc ebp, 1
dec dx
sal dl, 1
shr eax, cl
bt dx, dx
movzx ecx, dx
sar ecx, 0x53
mov dword [ebp + ecx*2], eax
lea esi, [esi + ecx*4 - 4]
jne 0x990093
mov edx, dword [esi + ecx*2]
xor edx, ebx
movzx eax, cx
or cl, 1
sbb ax, ax
xor edx, 0xd5b09297
sub edx, ecx
xor edx, 0xe32ddfa0
sal cx, 0xc7
sal eax, 0x25
setb cl
sbb edx, 0x9db4a131
xor ebx, edx
add edi, edx
shl ecx, 0xd7
or ecx, edi
jmp ecx
xor ecx, ebx
mov dword [esp + edx - 0x3b96ec2c], edx
dec dword [esp + eax*2 - 0x34]
je 0x9c4e7b
bswap ecx
dec ecx
bswap ecx
sub ecx, 0xb01bb025
neg ecx
xor ecx, 0x8489d2a4
dec dl
and dword [esp + edx*2 - 0x772dd856], eax
cwde
xor ebx, ecx
shl dword [esp + edx - 0x3b96ec2b], 0x7f
add edi, ecx
or dword [esp + edx*2 - 0x772dd856], edi
ret
mov ecx, dword [esi]
mov eax, 0xa38b9635
lea eax, [eax + eax*2 - 0x2c4915c7]
add esi, 4
xor ecx, ebx
rol ecx, 1
sar ax, 0x29
shr eax, 0xef
xor ecx, 0x6d16631d
dec eax
ror ax, 0xae
ror ecx, 1
neg ecx
xor ecx, 0x89e02a1
dec al
xchg edx, eax
dec ecx
add ax, dx
rol ecx, 3
lea ecx, [eax + ecx + 0x65222ef2]
dec al
ror ecx, 2
inc ecx
xor ebx, ecx
add edi, ecx
cwd
Function at 0x9e8752
Capabilities:
Encode data using base64

Disassembly:
not eax
mov dword [esp + ecx*2 - 0x6d2ecc3a], edx
shl ecx, 0x49
btr edx, ecx
xor ebx, eax
add edi, eax
shl word [esp + ecx - 0x2ecc39f8], 0xc5
or word [esp + ecx - 0x2ecc39f2], cx
pop edx
pop ecx
pop ecx
pop edx
pop edx
jl fcn.009ca7a3

Function at 0x9eead8
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx - 0x5921301], edx
xor eax, 0xb2899aad
sar byte [esp + edx - 0x59212fd], 0xa2
cmovne ecx, dword [esp + edx*8 - 0x2c909808]
xor ebx, eax
or byte [esp + edx*4 - 0x16484bfd], dh
rol dword [esp + edx*2 - 0xb242600], 0x6e
adc edi, eax
mov ecx, ebp

Function at 0xa053ec
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jne 0xa8b205
call fcn.00c579b2
dec esi
mov ebx, dword [esp + esi*2 - 0x34ba]
dec esi
lea ecx, [esi*8 + 0x2b05a118]
dec esi
mov dword [esp + ecx*2 - 0x560cea38], esi
dec esi
mov ebp, dword [esp + esi - 0x1a2d]
jmp 0xa8a9c4
jmp 0x707757
dec esi
mov eax, dword [esp + ecx - 0x2b0674e0]
pop ecx
call fcn.00a9c82a
mov edi, 0x820c60f
imul edi, edi
movzx edi, byte [eax + edi*8 - 0x67d9a708]
call fcn.00aff5ba

Function at 0xa06006
Capabilities:
Encode data using base64

Disassembly:
btr ecx, ecx
mov ecx, dword [ecx + esi - 0x66a6e52f]
mov eax, dword [esp]
shr ax, 0xa
mov dword [esp + eax - 0x66ae0035], 0x70918d09
lea esi, [eax + esi - 0x66ae0035]
add al, 0x8a
and edx, ecx
shl dword [esp + eax - 0x66ae00c3], 0x72
not edx
shr ax, 0x68
mov dword [eax + esi - 0x66ae0000], edx
push eax
mov eax, dword [ebp + eax - 0x66ae0000]
adc ebp, 3
mov ecx, 0xbd9bde38
sal ecx, cl
lea edx, [ecx + ecx + 0x4d107ab7]
xor eax, ebx
or ecx, dword [esp + ecx*2 - 0x6ffffff8]
dec edx
lea eax, [eax + ecx + 0x1d9ead8c]
inc dl
ror eax, 1
jmp 0xabdf54
mov edx, dword [ebp + ecx - 0x226dfffc]
jb 0x9569a1
sal ecx, 0x56
and cl, cl
not eax
sar cl, 0xe5
call fcn.009f5cfc
inc eax
neg cl
shr ecx, cl
mov word [esp + ecx*8 - 0x77f], dx
neg eax
not eax
lea eax, [eax + edx + 0xd2af5e6]
dec cl
bt ecx, ecx
call fcn.00ac7ce0
Function at 0xa0ce59
Capabilities:
Encode data using base64

Disassembly:
btc dx, ax
lea ebp, [ebp + edx - 0x493bcda0]
lea edx, [edx*8 + 0x78bdaf3b]
xor ecx, ebx
xor ecx, 0x6ea57182
or dl, 0xbe
dec ecx
push eax
neg ecx
dec dword [esp]
cwde
rol ecx, 1
xor word [esp + eax - 0x2c90], 0x1a
jg 0xc55bbc
mov edx, dword [ebp]
inc ecx
mov ebx, 0xac90f723
inc ecx
push ebx
dec esp
sub dword [esp], ebx
dec eax
adc ebp, 4
dec edx
lea ecx, [ebx*2 + 0xa1998b6]
inc esp
xchg dword [esp + 3], ebx
xor edx, ebx
inc edx
mov edi, dword [esp + ebx + 1]
not edx
inc dx
sub dword [esp + ebx + 3], ecx
dec ebp
lea eax, [ebx + edi*2 + 0x68af8325]
inc ebp
movsx ebp, bl
dec edx
xor edx, 0x3b0959a
dec edx
and dword [esp + ebx], 0x4c011f3e
inc dx
neg dword [esp + ebx + 6]
inc esi
xadd dword [esp + ebx + 3], ebx
rol edx, 3
inc edx
xor dword [esp + ebx - 4], 0xc4b2cd85
neg cl
dec edx
mov dword [esp + ebx - 4], ebx
btc edi, ecx
inc edx
xor dword [esp + ebp], edx
inc esp
movsx esi, cx
inc ecx
mov eax, esi
inc ebp
movzx edi, al
pop ebx
dec eax
arpl dx, dx
dec esp
btr edi, ebp
movsx esi, cx
dec esp
adc ecx, edx
inc bp
bt eax, esi
inc ecx
neg esi
cwde
inc ebx
mov ecx, dword [ebx + edx - 4]
dec ecx
bts eax, edi
mov edx, 0x921963f
inc ebx
mov edx, dword [ebx + edx]
dec edx
lea esi, [eax + eax*2 + 0x52015b8e]
jae 0xad14f6
dec ebp
add edx, ebx
push edi
inc ecx
and dh, 0x98
adc ecx, edx
inc ebx
mov dword [edx + ebx*4 - 0x10], ecx
jmp 0xa68730
sar dword [esp + 8], 0x82
mov esi, dword [esi*4 + 0xa67ff4]
shr ecx, 8
mov dword [esp], 0x4999ba2b
not word [esp + 8]
xor ecx, esi
push 0x90264ebb
inc eax
dec byte [esp + 0xb]
js 0x97d6a5
sar word [esp + 9], 3
xor ecx, 0x97b4bc08
shl byte [esp + 0xa], 0xc1
push 0xa8314131
rol byte [esp + 0xf], 0xc4
dec edx
jmp 0x9f90e0
inc ecx
mul bl
inc edx
setae byte [esp + ebp + 7]
dec esi
mov dword [esp + ebx - 4], ecx
ret
xor ebx, ecx
add ax, word [esp + eax - 0x2c8e]
sal eax, 0x73
adc edi, ecx
mov eax, dword [esi]
call fcn.00b7e24c

Function at 0xa133e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, ecx
imul ax
mov ecx, dword [ebp]
call fcn.0096ecef

Function at 0xa16340
Capabilities:
Encode data using base64

Disassembly:
push 0x5604f092
push 0x60b69790
shrd dx, ax, cl
mov eax, 0x302cc908
mov ecx, eax
mov dword [esp + eax*2 - 0x60599208], ecx
mov word [ecx + ebp - 0x302cc908], dx
shl word [esp + eax - 0x302cc906], cl
lea esi, [eax + esi - 0x302cc90c]
mov edx, dword [esi + eax*2 - 0x60599210]
xor cl, 0x9a
xor edx, ebx
neg edx
xor word [esp + eax*2 - 0x6059920a], cx
inc edx
neg cx
xor edx, 0x637a6a8
add dword [esp + eax*2 - 0x6059920a], 0x23899d25
jl 0xad1c2c
add word [esp + eax - 0x302cc904], ax
bswap edx
inc ecx
xor ebx, edx
xchg ecx, eax
add edi, edx
call fcn.00bb3a28
Function at 0xa2c174
Capabilities:
Encode data using xor

Disassembly:
xor bl, dl
ror al, 1
mov word [esi + eax - 4], dx
movzx edx, cl
bts ax, cx
not al
mov eax, dword [ebp + eax - 0x80fc]
call fcn.00c5e0a8
test eax, 0xe739f353
push ebx
cmp edi, esp
test byte [ebp - 0x140a1ad1], cl
test byte [ebp - 0x7c9222d1], cl
test byte [ebp + 0x37559d2f], cl
push cs
out dx, al
xor cl, ah
leave
sar ebx, cl
jno 0xa2c194
mov bl, 0xf2
fistp dword [ecx - 0x19776fe2]
fistp dword [ecx - 0x596f6be2]
push ebx
stc
push ds
fadd qword [esp + ecx*2 - 0x2f3ef09a]

Function at 0xa569c7
Capabilities:
Encode data using base64

Disassembly:
adc esi, 2
mov dword [esp], edx
not cl
not al
jmp 0xbdb3bb
or cl, al
lea eax, [edx*2 + 0x5032f71a]
bts edx, 0xb6
mov word [esi + eax - 0x4b9af71a], cx
idiv al
jmp 0xa6d400

Function at 0xa5fa2e
Capabilities:
Encode data using base64

Disassembly:
adc eax, edx
xor ebx, eax
xadd word [esp + edx + 3], dx
mov dword [esp + edx - 0x7ff], 0x8d3189a5
setle dl
adc edi, eax
call fcn.00ad5b60
push ecx
movsx eax, cl
mov eax, dword [esp + ecx - 0x6a559d4b]
mov ebx, dword [esp + ecx - 0x6a559d47]
mov dword [esp + ecx - 0x6a559d4f], ecx
call fcn.00aedb2e
sub ebp, 2
sub dl, 0x31
ror cl, 0x82
shr dword [esp + 3], 0xca
mov word [ebp], ax
not ecx
pop edx
pop eax
jbe fcn.00a7c83e

Function at 0xa644de
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov dword [esp], ebp
movsx edi, byte [esp + 3]
inc ecx
inc esp
inc ecx
movzx ecx, bp
inc ecx
bswap esp
inc ebp
lea esp, [esp + ecx*4 - 0x69af8f1e]
shl word [esp + ecx - 0xa0a0], cl
sal byte [esp + ecx - 0xa0a3], 0xe3
dec esp
lea esi, [ecx*8 - 0x4d6b99c6]
dec eax
mov dword [esp + ecx*4 - 0x2828c], ebx
movsx esi, cl
dec edx
lea edx, [esi*8 - 0x75e2cf64]
inc ecx
mov eax, 0xfc21ec0e
inc esi
xor dword [esp + esi + 0x4d6694ae], esp
pop ebx
inc esp
movsx edi, dl
dec edx
lea eax, [esi*8 - 0x444b8ef7]
dec ebp
arpl sp, sp
push edx
dec ebp
add ecx, esp
inc ebp
movsx ebx, bp
call fcn.0094f155

Function at 0xa66940
Capabilities:
Encode data using xor

Disassembly:
push 0x5b094c93
shr byte [esp + 3], 0x47
dec eax
call fcn.00bdf93e
or dh, dh
or ch, bl
sahf
invalid

Function at 0xa6d3d9
Capabilities:
Encode data using base64

Disassembly:
test ebx, ebx
not word [esp + 0x11]
lea esp, [esp + 0x18]
je 0xbca451

Function at 0xa6ee89
Capabilities:
Encode data using base64

Disassembly:
pop ebp
mov ebp, dword [esp + eax - 0x54ebbb85]
bswap edi
pop ecx
mov edi, dword [esp + edi - 0x3e1e2358]
call fcn.0099d6b2
call fcn.00974207
Function at 0xa6eea5
Capabilities:
Encode data using base64

Disassembly:
dec ecx
neg ecx
sub dword [esp], 0xb8373b97
push 0x373a97a9
xor ecx, 0xa283826
rol dword [esp], 0x6b
call fcn.00a76337
mov dword [esp], 0xa130b41e
dec byte [esp]
xor ecx, ebx
xor ecx, 0xbd16692d
sar dword [esp], 0xde
jnp 0x9b39e7
movsx eax, word [esp + 1]
xor ecx, 0x6a3ec418
xchg byte [esp + 2], al
push eax
cdq
add ecx, 0x73a31a29
ror ecx, 2
shr dword [esp + 8], 0xcd
lea eax, [edx + edx*8 - 0x33ea1262]
or eax, 0x79a281a2
xor ecx, 0xa015a9ab
cbw
cwde
xadd al, dl
xor ebx, ecx
cdq
add edi, ecx
mov dword [esp + 8], edx
rol word [esp + 5], 0xac
mov dx, word [ebp]
or al, al
mov ax, word [ebp + 2]
shr dword [esp + 2], 0x3d
adc dword [esp], 0x2f95111a
adc ebp, 2
not dx
mov ecx, 0xfa809f26
call fcn.00bd9f0f
shld ax, dx, cl
mov word [ebp], ax
sub esi, 4
call fcn.00707af2

Function at 0xa78082
Capabilities:
Encode data using base64

Disassembly:
not eax
add edi, edx
mov dword [esp], eax
bt cx, ax
pop eax
pop ecx
pop ecx
pop eax
pop edx
jb fcn.009570bc

Function at 0xa794f9
Capabilities:
Encode data using base64

Disassembly:
bt ax, ax
adc edi, edx
and ax, cx
call fcn.00a212fb
sub esi, 4
mov ecx, dword [esi]
call fcn.009b9417
mov edx, 0xb22df915
sub ebp, 4
mov edx, dword [ebp]
call fcn.00b38b4e
rol cx, 0xcd
mov dword [esp + ecx - 0x76b85c5], eax
rol edx, 2
pop ecx
or eax, ecx
inc edx
neg ax
not al
neg edx
dec al
xadd cl, ah
inc edx
shl ax, 0x61
shl ecx, 0x34
btr ecx, eax
xor ebx, edx
add cx, ax
ja 0xa28a35

Function at 0xa7952d
Capabilities:
Encode data using base64

Disassembly:
mov bp, word [ebp]
call fcn.00af88da
Function at 0xa92475
Capabilities:
Encode data using xor

Disassembly:
lea ebx, [esi + esi*4 - 0x4d6e9b70]
mov eax, dword [esp + eax - 0x1b32bb93]
pop esi
movsx esi, word [esp]
push ebx
mov ebp, dword [esp + 0x10]
jmp 0xa5c9d8

Function at 0xa9297c
Capabilities:
Encode data using base64

Disassembly:
rol edx, 2
xor ecx, 0xb0064029
not ax
xor cl, ah
dec edx
bts ecx, eax
bt eax, 0x25
rol edx, 1
shl cx, 0x2a
sbb eax, eax
neg eax
dec edx
not cl
xor ebx, edx
dec ecx
cbw
rol eax, 0xad
adc edi, edx
sal cx, 0xc7
xor eax, edi
jmp eax
lea esp, [esp + 0x14]
je 0xa929ae
mov eax, 0xada865b8
mov eax, dword [ebp + ebx*4]
push 0xee89dc05
push 0xcbb83522
shr word [esp + 3], 0x4f
mov dword [esp + 4], eax
dec ebx
lea esp, [esp + 4]
jne 0xa92986
mov eax, 0x90307aa1
not eax
not al
mov eax, dword [ebp + eax - 0x6fcf85a1]
push 0x68a1e488
lea esp, [esp + 4]
call eax
mov ecx, 0xf8b4f300
lea ebx, [ecx*2 - 0x44e1684a]
mov ebp, dword [ebp - 4]
lea edi, [ecx*8 - 0x67d2166b]
mov dword [ebp + edi - 0x5dd58195], eax
sar ebx, 0x53
pop ebx
pop edi
lea esi, [ecx + ecx*8 - 0x5b488d56]
mov edx, ecx
pop esi
btc ecx, 0x95
shl cx, 0x42
sub ecx, ecx
mov eax, dword [ecx + esi]
adc dl, cl
sub ecx, ecx
lea edx, [edx + edx*8 - 0x1ced25d9]
lea esi, [esi + ecx*4 + 4]
xor eax, ebx
lea eax, [eax + edx - 0x38bdc06c]
add edx, edx
bts edx, edx
rol eax, 2
not dx
xchg edx, ecx
call fcn.009afcbe
sub esi, 4
dec eax
movsx ecx, al
mov edx, dword [esi]
imul ecx, ecx
bt cx, cx
xor edx, ebx
and cx, ax
dec edx
ror cl, 0x45
jb 0x9f01e7
push 0x5502420d
sbb ebp, 7
dec dword [esp + 1]
push 0x1d16e406
mov dword [ebp + 0xc], eax
call fcn.00705e92

Function at 0xa9b94c
Capabilities:
Execute syscall

Disassembly:
inc dword [esp + 0xc]
call fcn.00c07c14
xor bl, dl
sub eax, 0xe6883a1f
xchg ecx, eax
adc edx, esp
lea eax, [eax + eax + 0x50a678aa]
inc eax
call fcn.00af8e1c
sysenter
pushfd
mov dword [esp], 0xb40eee35
call fcn.009c52c1

Function at 0xa9ef40
Capabilities:
Parse pe header

Disassembly:
shld ax, dx, cl
mov word [esi], ax
sub ebp, 4
mov eax, 0x1fb63da0
movsx ecx, al
xor dword [esp + eax*4 - 0x7ed8f674], eax
mov ecx, dword [eax + ebp - 0x1fb63da0]
xor ecx, ebx
inc ecx
call fcn.00bc4bfb

Function at 0xaa6fa2
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov cl, byte [eax + ebp - 0x7be0]
and dl, cl
not dl
pop ecx
mov word [ebp + eax*4 - 0x1ef8c], dx
movsx edx, al
push edx
lea ebp, [ebp + eax*8 - 0x3df1c]
mul dword [esp + eax - 0x7be3]
mov ecx, dword [edi + edx - 0x4dea]
lea edi, [eax + edi - 0x63ff8418]
push edx
sub word [esp + eax - 0x63ff8412], ax
xor ecx, ebx
cwd
shr edx, 0xad
idiv eax
inc ecx
sar edx, 0xe6
inc byte [esp + eax - 0xb]
inc edx
xor ecx, 0x641acdb1
dec word [esp + eax*2 - 0x24]
neg ecx
ror al, 0x87
inc al
inc ecx
call fcn.009db739
mov ecx, 0x3818a4b4
movzx ax, byte [esi + ecx*2 - 0x70314968]
movsx edx, cl
jmp 0x70926f
Function at 0xaba27c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx*2 - 0xa0], 0x3d2d290f
mov edx, dword [ebp + edx*2 - 0x9c]
call 0x9c6cd7
mov ecx, 0x2c984cb8
mov eax, dword [edi + ecx*2 - 0x59309970]
lea edx, [ecx + ecx - 0x21eb34f4]
movzx ebp, dl
bt edx, ecx
lea edi, [edi + ecx - 0x2c984cb4]
call fcn.00b7603b
les esp, [eax + 0xfbf71ad]
sbb al, 0xda
mov bh, 0x73
dec eax
les esp, [0x45b7d91e]
fstp xword [ebp + 0x45b7edac]
fild dword [ebp + 0x45b7b59c]
fist dword [ebp - 0x6ee6b97e]
fld xword [eax]
dec esp
sbb bh, byte [esi + ebp*2]
or dword [ebx - 0x72], edx
jns 0xaba281
invalid
in eax, 0x97
out dx, al
mov word [ecx - 0x4672c9e7], gs
xchg ebp, eax
or byte [esp], cl
sub byte [edi + 7], al
in eax, 0x73
and al, 0x9b
or al, 0x61
push edx
inc edx
push 0xecfada0c
lcall 0x8c62, 0x91738c64
rcl byte [ebx + 0x74]
cdq
wait
mov dword [0x8c623598], eax
xor ebx, eax
bts dx, 0xb5
sub cx, 0xa2ae
add edi, eax
call fcn.00a7d8c3

Function at 0xabb7ef
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], eax
dec ebx
call fcn.00bca0e0

Function at 0xabe781
Capabilities:
Encode data using base64

Disassembly:
lea edx, [edx*4 - 0x74e398d8]
xor al, 0x8b
ror al, 1
imul ecx, ecx
xchg word [esp], dx
neg al
sub dl, byte [esp + 4]
adc cl, cl
and edx, 0xffab44b4
adc al, 0x35
rol word [esp], cl
sal ecx, cl
not al
xor dword [esp + 1], 0x1ba5735
and cl, 0x90
xor bl, al
jmp 0xa5fa6b
mov dword [esp + ecx*2 - 0x1e5a], edx
neg eax
rol eax, 2
xor eax, 0xcd0e102f
not eax
dec eax
sub dword [esp + edx - 0x56905b4b], edx
xor ebx, eax
sal dword [esp + ecx*2 - 0x1e57], cl
jbe 0xada06b
and byte [esp + edx - 0x56905b4a], dl
adc esi, eax
movsx eax, byte [esp + ecx*8 - 0x7966]
imul eax
movzx eax, byte [edi + edx*2]
inc cl
lea edi, [edx + edi + 1]
lea ecx, [edx + edx + 0x6d92e3a6]
sbb edx, 0x78178b1e
xor al, bl
ror word [esp + ecx - 0x6d92e3a2], cl
sbb al, 0x3a
jmp 0x986e35

Function at 0xac56cb
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx - 0x20000], edx
add dx, 0x1d21
lea ebp, [edx + ebp - 0x21d1f]
sbb dword [esp + edx - 0x21d21], edx
shl dword [esp + edx*4 - 0x87481], 0x30
sub ecx, 0xd49d429f
lea edi, [edi + ecx*2 - 0x56c578c3]
setge dl
xchg word [esp + ecx - 0x2b62bc5f], dx
neg word [esp + edx - 0x200fe]
movzx edx, byte [edi + ecx - 0x2b62bc61]
xor dl, bl
ror dl, cl
push ecx
bt cx, cx
jae 0xb2c59e
dec dl
sal ecx, 0xce
lea ecx, [ecx + ecx*4 + 0x4926be9f]
js 0xb0734c
stc
Function at 0xac8e27
Capabilities:
Encode data using xor

Disassembly:
call fcn.00acc41e
lea ecx, [edx + edx - 0x2ff361e1]
movzx edx, byte [esi + edx*2 - 0x464ff279]
movzx eax, cl
neg al
xor eax, 0x26bafb87
xor dl, bl
dec dl
btr eax, 0x17
rol cl, 0x21
ror dl, 1
btc eax, ecx
sub ax, ax
btc eax, eax
sbb dl, al
sub cx, ax
cbw
rol dl, 1
add eax, eax
sbb cl, cl
not dl
sbb eax, eax
sbb dl, 0x3b
sub ax, ax
xor al, ah
xor bl, dl
mov word [ebp + ecx*4 - 0x59724002], dx
inc ecx
jnp 0xb6c89c
mov edx, 0x501cdd13
lea edx, [edx - 0x2d47e063]
lea eax, [edx + edx*2 - 0x227b8cfa]
mov eax, dword [ebp + edx - 0x22d4fcb0]
lea ecx, [edx + edx*2 + 0x660624a0]
lea ebp, [ebp + edx*2 - 0x45a9f95c]
mov edi, 0xe091c023
sar edi, cl
mov edi, eax
jb fcn.00a28ab3
push es
invalid
mov es, word [ecx]
push esp
pop ss
xor al, 0x76
mov es, word [ecx]
sbb byte [ebx + 0x60], 0xf6
mov al, 3
test byte [ecx], dh
cli
outsd dx, dword [esi]
mov dword [0xa434bae9], eax
mov bh, 0x65
add eax, dword [ecx + esi - 0x165c9006]
mov edx, 0x65b7a434
sub ecx, ecx
lea esi, [esi + ecx - 5]
dec edx
xor eax, ebx
shl ecx, 0xe9
bswap ecx
inc ecx
sbb eax, ecx
neg eax
dec edx
lea ecx, [ecx*2 - 0x5873295c]
not eax
call fcn.00a16756
sub eax, edi
loop 0xb6c88f
arpl word [eax + 0xd], cx
out dx, al
sub bl, byte [edi + ebx*8 + 0x565e79c9]
push esi
mov edi, 0xfdde5715
pushfd
imul eax, ebx, 0
push edx
jne 0xb6c8aa
xor dword [esi + ebp + 0x5c], ecx
nop
scasb al, byte es:[edi]
sub dword [ebp - 0x3b4cff26], edx
fstp qword [0x3df6e372]
cmpsb byte [esi], byte es:[edi]
mov al, byte [0x28659347]
mov ebp, 0xffa794ec
cmp eax, 0x14f72e9e
std
push 0x1f809d53
nop
mov ebp, 0xe21f7d
sbb esi, dword [edx]
push es
pushfd
in eax, 0xe9
dec byte [edx]
inc dword [eax + 0x7a]
js 0xb6c8d8
mov ebp, 0x14cb4d16
in al, dx
inc esp
pop edi
ljmp 0xee

Function at 0xaea160
Capabilities:
Encode data using base64

Disassembly:
sub dx, 0x8a22
xor cl, 0xa5
or eax, edx
sbb cl, 0x21
btc ax, ax
mov dword [esp + 4], eax
not edx
neg cl
rol cl, 1
sal byte [esp + edx - 0x8d28926], 0x64
sbb dl, byte [esp + edx*2 - 0x11a5125c]
xor bl, cl
cwde
lea edi, [edi + edx*2 - 0x11a51308]
shl word [esp + edx - 0x8d2897f], 0xe1
pop edx
mov word [edi + eax - 0x3ece], cx
mov ecx, eax
xor cx, cx
movsx edx, ax
pop ecx
pop edx
jge fcn.00703b43

Function at 0xaeb6e5
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edx + esi - 0x73bd9c05]
movzx ecx, al
xor edx, ebx
mov dword [esp + ecx*4 - 0x14], ecx
xchg ecx, eax
xor ax, 0x111
bswap edx
imul ecx, ecx
not ecx
dec ax
ror edx, 1
dec eax
not edx
jge 0xb4a306
sbb eax, 0xea305a8e
invalid
and word [esp + eax - 0x112], ax
neg cx
neg edx
btr ax, 0xac
ror ecx, cl
not eax
xor ebx, edx
bswap eax
rol cl, 0xe2
adc edi, edx
push eax
mov ecx, dword [ebp]
bswap eax
not al
movzx edx, al
mov edx, dword [ebp + edx - 0xe]
add ebp, 8
sar eax, 0xd3
push eax
mov dword ss:[ecx], edx
or ax, ax
movsx ecx, al
pop eax
pop eax
pop eax
adc eax, edi
jmp eax