joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc9d5bb
Capabilities:
Encode data using xor

Disassembly:
sar dx, 0x43
inc dl
adc esi, 4
sal dx, 0x66
shl edx, 0xf
movzx eax, dl
push ecx
ror dx, 0xc1
popfd
mov edx, dword [ebp + eax]
mov ecx, eax
xor cx, ax
xor cl, ch
lea ebp, [eax + ebp + 4]
xor edx, ebx
xadd al, cl
ror eax, 0x77
sbb edx, 0xbba86313
push eax
rol edx, 3
bswap eax
jmp 0xb76ef7
bswap edx
xadd cl, ah
rol edx, 3
xor ebx, edx
jmp 0xc599ec
xor eax, 0x613fcf2e
neg edx
rol eax, 1
ror cx, 0x2e
jb 0xac9959
jae 0x7e8430
mov ecx, 0xb9fac22
mov eax, 0xcc99e887
dec esp
lea ecx, [ecx + ecx*2 - 0x77e58df6]
dec ebp
mov esi, dword [edi + ecx*4 - 0x2e7eb088]
inc ecx
mov eax, dword [esi + ecx*2 - 0x173f5844]
inc ebp
movsx esi, cx
inc ecx
mov dword [edi + ecx*4 - 0x2e7eb084], eax
movsx ebx, cl
movzx edi, bl
dec eax
lea edx, [ecx*8 + 0x50155f26]
mov bx, word [ecx + ebp - 0xb9fac24]
dec ecx
ror ecx, cl
inc bp
btc esi, esi
inc cx
xor ebx, eax
dec edi
lea ebx, [esi + esi*4 - 0x51ccd67a]
inc esp
movsx edx, di
dec eax
sal ecx, cl
sbb bx, 0xb023
inc cx
xor ebx, ecx
ror edi, 0x74
inc esp
mov ebp, edi
adc bx, 0x3c32
inc ecx
not esi
ror bx, 1
inc ecx
movzx eax, dl
inc sp
xor eax, ebx
dec dx
xadd edx, edi
inc ecx
movsx esi, ch
dec eax
adc ebx, esp
dec eax
add esi, dword [ebx + ecx - 1]
inc ecx
not bl
sub ax, 0x3c11
call fcn.007ee7e9
mov edx, dword [esi]
mov ecx, 0xcd3bfb89
lea ecx, [ecx*8 + 0x6e85c013]
mov ecx, dword [esi + 4]
add esi, 4
call fcn.00bbaf77
mov ecx, 0xd88715b2
mov edx, ecx
ror dl, 0x44
mov ecx, dword [esi]
jae 0x7d34da
push eax
add edi, edx
add cx, word [esp + eax + 2]
xor dword [esp + eax], edi
ret 4
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
call fcn.00b90429
bts ecx, ecx
mov eax, dword [esi + ecx*2 - 0x613c7264]
movzx edx, cl
sbb cx, cx
lea esi, [esi + ecx - 0x309dfffc]
xor cl, 0x2f
xor eax, ebx
bt edx, ecx
lea eax, [ecx + eax + 0x39fe03f0]
sub cl, 0x39
cmovnp cx, dx
bswap eax
jno 0xb98829
test byte [esi - 0x64], cl
invalid
and edi, esi
jns 0xc9d60c
dec eax
dec ebx
test byte [edx + 2], bl
lea edx, [0xc07cb8b3]
jl 0xc9d5cc
rcr dword [eax], 0x92
pop esi
mov bh, 0xe4
js 0xc9d62f
push ss
cld
clc
inc esp
sbb al, 0xa6
mov ch, 0x87
cli
pushfd
jl 0xc9d667
sahf
fmul st(4), st(0)
in al, 0x6d
mov eax, dword [0x1fc8148]
xchg edi, eax
jg 0xc9d60a
pop esp
jle 0xc9d651
and dword [ebx - 0x41], edx
mov eax, 0x48fee7a6
push ebx
mov edi, 0xfee7a6b8
dec eax
push ds
add byte [eax], al
add byte [eax], al
mov ecx, 0x1581efbb
invalid
xchg ecx, eax
adc byte [esi + 0x1a], bh
ret
jmp 0x138d56aa
Function at 0xcc2b32
Capabilities:
Encode data using xor

Disassembly:
les eax, [edx + esi - 0x3e]
call fcn.00cc07a5
inc eax
push cs
add al, 0x3f
mov ch, 0x22
mov esi, dword [esi]
inc dword [edx + 0x1d]
xchg ecx, eax
dec edx
mov esi, dword [esi]
call [edx]
pop ebp
std
dec ebp
jne 0xcc2b20
sbb esi, ebp
bound ecx, qword [edx - 0x218a335b]
sub esp, dword [ecx + 0x5a41ecf6]
invalid

Function at 0xcc3a4e
Capabilities:
Encode data using xor

Disassembly:
not dword [esp + 8]
lea esp, [esp + 0xc]
jmp fcn.00d1b572

Function at 0xcc4a2c
Capabilities:
Encode data using xor

Disassembly:
inc cx
ror ebp, 0x83
movzx di, byte [edx + ecx*4 - 0x5206b534]
inc dx
mov dword [ecx + edi - 0x1481ad4d], edi
dec edx
lea edx, [esi*8 - 0x48446d7c]
dec eax
lea edi, [eax + ecx + 0x7a162381]
dec eax
sar ecx, cl
movzx ecx, byte [ebp + ecx*4 - 0x2903b]
inc ecx
sar ebx, 0xa8
dec ecx
lea ebp, [ecx + ebp - 0x7d851977]
inc bp
sbb ebp, esi
inc ecx
xor cl, al
and bl, ah
dec ecx
sub esi, 0x588f7d32
inc ecx
or bl, 0x2d
xor cl, 0xbd
inc ecx
push ebx
cbw
sub cl, 0x14
inc ecx
add dl, dl
inc ecx
push esi
neg cl
inc ecx
idiv ch
dec esp
lea ebx, [ebx*8 + 0x4f217409]
inc cx
bt ecx, 0xa2
ror cl, 1
inc cx
btc ecx, edi
inc dx
adc dword [esp + ecx - 0x7d8519e6], 0x842b9bc
xchg esp, eax
or al, 0x18
out 0x7a, al
add byte [eax + 0x42669df1], 9
xchg esp, eax
sub al, 0xf
salc
out 0xa0, eax
inc ecx
pop edx
inc ebp
xadd cl, bl
inc esp
xor al, cl
sar bx, 0x26
dec eax
lea ecx, [esp + ecx + 8]
inc cx
inc ecx
movzx si, byte [ecx + eax*2 - 0x92c1200]
inc ecx
dec edx
inc ecx
mov ecx, esi
inc edx
or byte [esp + ecx - 0x7d8519f5], bl
inc bx
mov dword [ebp + edi - 0x5f1829f7], esi
sub bx, 0x17b9
dec edi
lea edi, [edi + ebp - 0x5f1829f7]
inc ecx
pop edx
jb fcn.00cb64ad
jmp 0xccaae6
dec dx
inc ecx
btr edx, 0x9f
inc cx
shr ebp, 0xc
xor dx, 0x9e18
dec eax
imul ebx, dword [esp + ecx*4 - 0x5206b534]
cwde
dec ecx
lea esi, [edx - 0x29e9afce]
sbb dx, 0x37aa
inc eax
sar dh, 0x22
dec ecx
add edx, 0xeb2c3ba8
inc ecx
pop esi
ror dx, 1
inc ecx
dec ch
inc ecx
ror ecx, 0xe8
inc ecx
ror dl, 0xc4
inc sp
xor eax, edx
dec ecx
xadd ebx, eax
inc ecx
xor ebx, 0x47a1600a
not si
dec eax
adc edx, esp
jmp 0xafaec1
inc ecx
mov ebx, 0x4960909
inc cx
xor edx, eax
bt edi, 0xae
dec esp
mov dword [esp + ecx*2 - 0x29035a9a], ebp
jb 0xb27373
mov ecx, 0x40857c89
movsx eax, cl
mov ecx, dword [esi + ecx - 0x40857c89]
shr ax, 0x44
or ax, ax
push eax
mov eax, dword [esi + 4]
call fcn.00b90e40
Function at 0xcc9467
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, 0x79b9c2bc
mov edx, dword [ecx + edi - 0x79b9c2bc]
mov ecx, dword fs:[edx + ecx - 0x79b9c2bc]
mov eax, 0xa0066929
mov dword [edi], ecx
mov edx, eax
btc dx, dx
mov edx, dword [ebp]
adc ebp, 4
push eax
xor edx, ebx
or dword [esp], eax
inc edx
bt eax, 0xad
jae 0x78ba79
ror edx, 1
cwde
dec edx
movzx ecx, ax
call fcn.00b0c23a
xor ecx, ebx
ror edx, 0x72
setae al
shl eax, 0xa8
not ecx
jnp 0xb5ac9c
jne 0xc96093
xor edx, 0x324a2a4
rol edx, 2
and byte [esp + eax - 0x580059fd], cl
xchg ecx, eax
dec edx
shl dword [esp + eax*2 - 0x70000000], 0xbc
sbb dword [esp + ecx - 0x58005a00], 0xd71aeba1
xor ebx, edx
add ebp, edx
mov eax, dword [ecx + edi - 0x58005a00]
movsx edx, cl
or cx, word [esp + edx]
mov cl, byte [edi + ecx - 0x58005e5b]
jle 0x7a56ee
lea edi, [edi + edx*4 + 6]
shr dx, 0x2f
mov byte ss:[eax + edx*2], cl
lea ecx, [edx*8 - 0x1de13365]
pop ecx
shr ecx, cl
add edx, ebp
jmp edx
push 0x639a8c9e
call fcn.00cec221
mov edx, 0xc8a40f8c
sar edx, 0x64
mov ecx, dword [ebp]
xor dx, dx
mov eax, edx
adc ebp, 4
imul dx, ax
shl dx, 0x42
jae 0x7d9129
jmp 0x7933ca

Function at 0xcd186e
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 4]
call eax
mov ecx, 0xb62d2f
movsx ebx, cl
call fcn.00c53c41
Function at 0xcd18af
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
bswap ecx
mov dword [esp + edx*8], eax
div dword [esp + edx + 2]
mul byte [esp + eax*2 + 1]
xor ecx, 0xcbacf2a2
not ecx
inc al
shr dl, 2
cwde
sbb ecx, eax
push eax
mul dx
xor ebx, ecx
neg eax
adc ebp, ecx
cwd
btr eax, 0x36
mov ecx, esi
add eax, 0x6b0c99bd
lea esi, [esi + eax - 0x6b0c99c1]
inc dx
mov dword [esi + eax - 0x6b0c99bd], ecx
xadd byte [esp + edx - 0x5d01fffc], ah
jno 0xd268c5
sbb ebx, dword [esi - 0x7515ec4c]
xchg esp, eax
rdpmc
enter 0xffffffffffffe786, 0x66
movzx eax, byte [ecx + edi - 0x187937cb]
lea edi, [edi + ecx*4 - 0x61e4df32]
or dword [esp + ecx - 0x187937cd], ecx
call fcn.00d36e5b
add dword [eax], eax
pop eax
pop eax
pop edx
jno fcn.00bf54ab
jmp 0xd268b9
in eax, dx
sal ecx, 1
dec eax
inc edx
loopne 0xd268f7
ret
add dword [edx + 0x49], edx
jl 0xd26968
in al, 0x42
inc edi
sub ebx, esi
mov eax, 0xc4ab528d
jb 0xd2689d
cmp al, byte [edx + edx]
int1
mov ebx, 0x778a4ecc
sahf
and al, 0x7e
xor byte [esp + ebx*4 + 0x2e34b0c3], ah
jle 0xd268cb
sbb dword [edx - 0x2f52e2ba], 0x734ec681
cmpsb byte [esi], byte es:[edi]
xor al, 0x2e
jle 0xd26992
bnd jnp 0xd26972
mov esi, 0x3681d1cb
xchg edx, eax
loop 0xd2695b
jle 0xd268c3
add byte [ebx + 0x3e], 0xe5
wait
stosd dword es:[edi], eax
out 0x48, eax
insd dword es:[edi], dx
out dx, al
out 0xb9, eax
and al, dh
invalid
inc esi
test dh, 0x24
fidivr dword [eax + 0x5503107a]
int1
wait
and esi, dword [edi + 0x6d2404c2]
mov bh, 0xc2
add al, 0x24
insd dword es:[edi], dx
pushal
ror dword [eax - 0x67], 1
mov edi, 0xd0c79314
lahf
xchg ebx, eax
rcl byte [edi]
sbb ebp, dword [ecx - 0x7e24f239]
xor byte [edx - 0x64cf097e], dl
adc al, 0x93
invalid
wait
xor dword [ebx], 0xe89b72d9
pop bx
jle 0xd2698b
wait
call 0xfb50c4f7
jbe 0xd269ca
aaa
push esp
mov byte [0x8c654f81], al
invalid
sbb al, 0xaa
adc bl, ch
jp 0xd26986
xor al, 0x50
sub edx, dword [esp + ecx*8 - 0xf]
outsd dx, dword [esi]
out dx, al
das
scasd eax, dword es:[edi]
sbb al, 0xd7
and byte [eax + 0x3f6a5c63], al
add byte [0xa798123d], ch
or esi, dword [eax - 0x22]
jo 0xd269aa
add byte [eax], 0
add byte [eax], al
cmp eax, 0x6edf216b
and edx, dword [eax + 0x2eff2daa]
loop 0xd26a4e
pop ebx
dec esi
sal dword [ebx - 0x2eafa029], 1
xor byte [edx], 0xa4
mov al, byte [0x3e1f4530]
mov edi, 0xd1cac03c
jbe 0xd26a07
add al, 0x24
lodsb al, byte [esi]
hlt
sbb dword [ebx - 0x58], eax
xor byte [0x94598703], bl
fnstcw word [esi]
jmp dword [edx]
mov bl, 0xd9
dec edi
cli
jmp 0xc232feb6

Function at 0xcd2d26
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + ecx - 0x54ff780e], 0x8b339c8d
btc eax, ecx
xor ebx, edx
add esi, edx
xchg cx, ax
mul al
mov edx, edi
mov dword [edi + ecx - 0x54ff4004], edx
neg ecx
mov edx, 0xe03596b8
adc edi, 0xfffffffb
ror eax, 0x5b
sub dword [esp + 3], 0x81a9ea91
pop edx
pop eax
jae fcn.00aa83ef

Function at 0xcd6ae1
Capabilities:
Authenticate hmac

Disassembly:
inc eax
dec edx
rol ecx, 0x9d
neg eax
inc edx
shl dword [esp + 4], cl
dec eax
inc dl
bt cx, 0x3c
mov dword [esp], 0xfa17dca3
bswap eax
call fcn.0074bc4c
Function at 0xcd6f06
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi + 4], ecx
xadd word [esp], ax
jg 0xb1a120
inc ecx
mov ecx, 0x169f3d2e
inc ebx
mov edi, dword [ecx + edi - 0x169f3d2e]
dec ebx
lea edx, [ecx + ecx*8 - 0x7ac3e2df]
inc ebp
movsx ebx, cl
inc ebp
mov edx, dword [edi + edx - 0x50d543bb]
inc ecx
movsx ecx, cx
not edi
mov ebx, 0x8c07008e
dec ebp
lea ebp, [ebx - 0x70d6bf78]
jmp 0xbe7c86
inc ecx
movzx esi, cx
mov bh, 0xf1
inc ebx
mov dword [ecx + edi - 0x169f3d2a], edi
inc ecx
or bl, bl
inc ecx
mov edi, ebp
inc esi
mov edx, dword [ebp + ebx*4 - 0xbc]
push ecx
inc ebp
xor edx, eax
inc edx
not dword [esp + ecx*2 - 0x2d3e7a58]
inc ecx
not edx
inc esp
xchg ebx, ecx
dec ebp
lea esi, [ebp + edx*2 - 0x3b4b535c]
inc ecx
bswap esi
inc ecx
inc edx
inc bp
bt esi, ebx
push ebx
call fcn.00afd59d
xor bh, bh
push esp
add eax, 0xe0d24f22
cmpsd dword [esi], dword es:[edi]
inc edx
daa
shl al, cl
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
cmp dl, byte [edi - 0x2e]
loopne 0xad7d9a
xchg esi, eax
push es
ret
inc ecx
not edx
bts cx, cx
inc ecx
and edi, edx
jmp 0xad7d98
not edx
mov dword [esp], eax
and ecx, edx
mul byte [esp + 1]
sal dword [esp], 0x2e
jp 0x7d70b7

Function at 0xce7c62
Capabilities:
Encode data using xor

Disassembly:
push 0x3f07c783
pop eax
mov eax, dword [eax + ebp - 0x3f07c783]
push 0xa482dba1
lea esp, [esp + 4]
call eax
push 0x46030caf
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
push 0x902189e
mov esi, 0x42245b32
shl esi, 0x9e
mov edi, ebp
pop eax
push eax
lea edx, [esi*4 - 0x78607347]
mov ebx, dword [esp + esi - 0x7ffffff8]
mov esi, dword [esp + esi - 0x7ffffff4]
mov ebp, dword [esp + eax*2 - 0x1204312c]
movzx ecx, dx
mov dword [esp + eax*8 - 0x4810c4f0], esi
ret 0x10
mov dword [esp], 0xd7296da6
sar dword [esp + 4], 0xcf
test ebx, ebx
lea esp, [esp + 8]
je 0x7d1b25
mov eax, 0x2f982922
not eax
mov eax, dword [ebp + ebx*4]
push 0x7eacd395
mov dword [esp], eax
jmp fcn.00b0f8f3

Function at 0xceb260
Capabilities:
Encode data using base64

Disassembly:
mov dx, word [edi + eax*2 - 0x4401d534]
or dword [esp + eax*2 - 0x4401d52c], 0x1b36b5af
and word [esp + eax - 0x2200ea94], 0x48ba
sar word [esp + eax - 0x2200ea94], 0x82
movzx ecx, byte [esi + eax*2 - 0x4401d52b]
jbe 0xab43fb
mov ecx, dword [esi + edx - 0x752c7383]
movzx eax, dl
xor ecx, ebx
add edx, eax
dec ecx
sal edx, 0xc5
neg ecx
inc ecx
and eax, eax
neg ecx
shr eax, 7
inc dx
jae 0xcb7eb2
mov ecx, 0x948c86aa
inc ecx
mov ecx, 0xbcaad380
dec eax
sub ebp, 4
jmp 0xd2846c
call fcn.00c03600
not dl
sal eax, 0x15
not cl
adc word [esp + eax - 0x181fffff], 0xda8c
setns al
and dl, cl
mov word [edi + eax*2 - 0x303ffffc], dx
movsx ecx, word [esp + eax*2 - 0x303ffffd]
jmp 0x76c3ee
Function at 0xcef733
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
btc ecx, ecx
and cx, cx
not edx
or ecx, 0x3b96d98b
and eax, edx
lea edx, [ecx - 0x41e40ac7]
mov dword [esi + ecx - 0x3b96d9cf], eax
mov ecx, dword [ecx + ebp - 0x3b96d9cf]
add ebp, 4
dec dl
sete dl
xor ecx, ebx
bts edx, edx
sar dl, 6
jp 0xccc39c
sbb dx, 0x719d
xor bx, dx
xor ax, ax
sar eax, cl
mov word [esi], dx
jmp ebp
rol byte [esp + 2], 0x65
jb 0x7cfee2
mov eax, dword [esi]
mov edx, 0x1ca71a8d
inc edx
mov ecx, edx
mov edx, dword [esi + edx - 0x1ca71a8a]
bts ecx, 0x85
bt ecx, ecx
lea esi, [esi + ecx*2 - 0x394e3558]
shl cx, cl
shr ecx, 0xd5
not eax
jne 0xb9cdad
shr edx, cl
mov ecx, dword [esp + eax*2 - 0x7b78f454]
not cl
mov dword [esi + eax*2 - 0x7b78f452], edx
sub cx, word [esp + eax - 0x3dbc7a28]
inc al
mov edx, dword [edi + eax - 0x3dbc7a2b]
not cx
xor edx, ebx
sub edx, 0xb63b2fb0
pop ecx
inc ax
bswap edx
neg edx
not cl
xor cl, al
btc ecx, 0x34
not edx
xchg ecx, eax
dec eax
xor ebx, edx
push ecx
inc dword [esp + eax - 0x1000d2]
rol ecx, cl
add ebp, edx
mov edx, ecx
movzx edx, word [eax + edi - 0x1000ce]
xchg dword [esp + eax*2 - 0x2001a4], ecx
shr eax, cl
lea edi, [eax + edi - 0x7a]
bswap eax
and al, 0x25
shl ax, 5
xor dx, bx
neg al
not ecx
rol dx, 1
neg dx
pop eax
btc ecx, eax
inc dx
cwde
not dx
and ecx, eax
jne 0xbeb8fc
btc ax, ax
mov word [esi + 2], dx
sbb ax, 0x3ea6
adc esi, 2
pop eax
mov ecx, dword [edi - 5]
jmp 0xcbd5cd

Function at 0xcf2868
Capabilities:
Encode data using xor

Disassembly:
enter 0x18e8, 0xffffffffffffffa9
hlt
pop edx
neg al
rol al, 1
ror ecx, 0x4d
lea edx, [ecx + ecx*8 + 0x603d918]
call fcn.00b660a1
loopne 0xcf2882
dec ebx
mov byte [edi + esi*4 + 0x7c], bl
fimul word [edi]
and byte ss:[edi - 0x49], bl
aam 0xf6
invalid
jl 0xcf2862
invalid

Function at 0xcf640e
Capabilities:
Encode data using xor

Disassembly:
movzx eax, dl
sbb ax, word [esp + edx - 0x24800032]
lea edi, [edi + edx - 0x2480003a]
pop edx
mov word [edi + eax*2 - 0x1396a], cx
or ax, word [esp + eax - 0x9cb5]
lea edx, [eax + eax*8 + 0x4881a614]
push eax
pop ecx
pop eax
jne fcn.00bbc35d
mov ecx, edi
ja 0xaf675f

Function at 0xcf8382
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x1c]
jne 0xac9fd5
pop esi

Function at 0xd09573
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ecx - 0x24f0], eax
dec ebp
arpl dx, dx
dec ebp
add esp, edx
call fcn.00b79c9b

Function at 0xd0ba30
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xor eax, 0x222b9a7
jmp 0x7b2520
Function at 0xd28203
Capabilities:
Encode data using xor

Disassembly:
inc esp
mov edx, dword [ebp]
inc ebp
xor edx, eax
dec eax
mov dword [esp + 8], 0x83809f17
mov edi, dword [esp + 9]
ror dword [esp + 0xb], 0x49
inc ecx
adc edx, 0x5bb2cb5
btr di, di
dec eax
mov dword [esp], edi
pop eax
inc ecx
neg edx
ror al, 0x46
inc ecx
dec edx
push edi
inc ecx
mov esi, 0x41a9c2a9
inc ecx
movzx ecx, si
inc ecx
ror edx, 3
inc esi
xadd byte [esp + esi - 0x41a9c29c], dh
inc ebp
lea edx, [edx + ecx*4 - 0x6b282460]
push edi
xchg esp, eax
mov ah, byte [eax + 0x5794d7db]
inc ecx
xor edx, 0x551491b8
dec esi
mov dword [esp + esi - 0x41a9c2ef], eax
inc esp
movsx eax, al
dec esp
lea ebp, [edi + 0x11163415]
inc esp
xor dword [esp + ecx - 0xc299], edx
inc ebp
movzx ebx, si
inc esi
movzx ecx, byte [esp + esi - 0x41a9c2f3]
dec esp
mov eax, dword [esp + ecx*8 - 0x61538]
dec ecx
xchg ebp, edi
dec ebp
arpl dx, dx
cwde
mov edx, dword [esp + eax*2 - 0xf5]
imul dx, word [esp + eax*4 - 0x1ef]
dec ebp
add esp, edx
xor edi, 0x2187680e
dec eax
lea ebp, [ebp + edi - 0x311e5cbc]
dec eax
mov dword [esp + edi - 0x311e5caa], ecx
inc esp
movzx esi, word [ebp + edi*2 - 0x623cb974]
dec ecx
sar ebp, cl
inc ecx
sal cl, 0xa1
inc bp
xor esi, eax
cwde
inc cx
sub esi, 0x4ce8f4be
je 0xd282c1
mov bh, 0xb4
jge 0xd28251
inc esi
ret
invalid

Function at 0xd28b49
Capabilities:
Encode data using base64

Disassembly:
lea edx, [edx + eax - 0x530f02a8]
xor ebx, edx
shl eax, cl
lea eax, [eax*2 - 0x8f123d3]
not ecx
add ebp, edx
push ecx
shl eax, 0xf0
mov eax, dword [edi + ecx*2 - 0x47ccf082]
movsx edx, byte [esp + ecx - 0x23e67841]
mov edx, dword ss:[eax + ecx - 0x23e67841]
btr cx, 0x81
bts cx, 0x17
mov dword [edi + ecx*2 - 0x47ccf182], edx
mov eax, ecx
shl cl, 0xa4
mov dword [esp + ecx - 0x23e67810], ebp
ret 0xc
push 0xdc1987be
inc edx
mov ecx, dword [esp]
movzx eax, cl
rol edx, 1
ror ax, 0x63
neg dword [esp + eax*2 - 0x1802e]
jbe 0xcdc099
Function at 0xd3a6f1
Capabilities:
Encode data using xor

Disassembly:
not word [esp + eax - 0x2619071e]
shr byte [esp + eax - 0x2619071f], 0xc6
inc edx
add al, byte [esp + eax - 0x2619071e]
not word [esp + eax - 0x2619071f]
rol edx, 1
pop ecx
bswap edx
neg cl
xor ebx, edx
add cl, cl
add ebp, edx
btc ecx, eax
jb 0xbbfacb
dec cl
bts ecx, 0x24
xor ebx, eax
add ebp, eax
shr edx, 0x6d
mov eax, dword [esi + edx*4 - 0x1e0280]
bts cx, cx
and dx, 0x2025
mov ecx, dword [esi + edx*4 - 0x1c007c]
add dl, dl
sbb dl, dl
shr edx, 0xd5
push ebx
mov ebx, edx
xadd edx, ebx
cpuid
sbb esi, 8
push 0xd9a0ac9e
sub dword [esp], 0xa527c535
mov dword [esi + 0xc], eax
rol dword [esp], 0xf5
mov dword [esi + 8], ebx
pop ebx
shl bl, 0xa2
mov eax, 0x3a7389d
mov dword [esi + ebx*2 + 0x25b2e124], ecx
mov dword [esi + ebx + 0x12d97090], edx
movzx ecx, al
pop ebx
movsx edx, al
xadd cx, dx
jp fcn.00ccf271
dec ebp
mov esi, dword [edi]
mov ebx, 0xc09eeda6
movzx edi, bl
movsx eax, bl
dec esi
lea edi, [edi + edi - 0x9e]
inc ecx
push esi
xor bl, 0xae
popfd
mov edx, 0x731cd4bc
push eax
dec eax
lea ebp, [ebp + edi*2 - 0x150]
dec eax
btc edx, edx
inc esp
mov esi, dword [ebp + edi - 0xa6]
sub ebx, edi
shl word [esp + edi - 0xa4], 0x6d
inc ebp
xor esi, eax
inc ecx
ror esi, 1
dec eax
sal dword [esp + edi*8 - 0x530], 0xf4
movsx ecx, byte [esp + edi - 0xa5]
mov esi, eax
inc esp
adc esi, ecx
push eax
inc ecx
rol esi, 2
inc ecx
xor esi, 0x67224789
dec eax
btr esi, 0x26
inc eax
add dh, 0x11
inc ecx
mov edx, 0xe4b32f17
inc esi
lea esi, [edi + esi - 0x4906b333]
btr ecx, ecx
dec eax
shl edx, 0x1c
dec eax
xadd dword [esp + edi*2 - 0x144], esi
dec esp
mov dword [esp + edi*2 - 0x144], eax
jbe 0xc35394
dec dword [esp + edi*2 - 0x149]
sar dl, 0x61
inc esp
xor dword [esp + edi*2 - 0x144], esi
dec ecx
lea esi, [edx + ecx*2 - 0x4cd81a5a]
dec esp
mov eax, dword [esp + edi - 0x9e]
inc esp
movsx ebx, dl
cwd
dec ebp
arpl si, si
call fcn.007ecb7f
lea ebp, [ebp + eax*2 - 0x462932be]
jae 0xd4958a
sar eax, cl
xor ecx, 0x6307939f
xor edx, ebx
sal eax, 0xdf
rol cl, 0x47
neg eax
rol edx, 3
and eax, eax
lea edx, [edx + eax*4 + 0x2b32b298]
sub eax, 0xca24a580
imul ecx, eax
ror edx, 1
jmp 0x790ecd
dec edx
lea ebp, [ebp + ebx - 0xab36]
dec edx
lea esi, [ecx*8 - 0x276743cd]
inc ebp
xor al, dl
inc cx
xchg ebp, edx
dec cx
dec eax
cwde
dec esi
lea edx, [esp + edx + 8]
dec eax
mov dword [esp + ecx - 0x41f10fff], edx
dec edx
mov ebx, dword [ecx + edx - 0x41f10fff]
dec esp
xadd ecx, ebx
dec ebx
mov dword [edi + ebx - 0x41f11017], ebx
dec edi
lea edi, [edi + ebx - 0x41f11017]
inc dx
sal dword [esp + esi + 0x4f18ddb9], 0x6f
inc edx
sbb byte [esp + esi + 0x4f18ddb5], cl
dec ebp
lea edx, [ebx + 0x552401a9]
pop ecx
jl fcn.00cb64ad
sub esi, 4
mov edx, 0x8334dab8
mov edx, dword [esi]
mov eax, 0x26190712
rol al, 0x63
movzx ecx, al
xor edx, ebx
sal al, 0xa1
push ecx
not edx
add ecx, 0x5108af35
rol edx, 1
jmp 0xb35e3a
Function at 0xd580db
Capabilities:
Encode data using xor

Disassembly:
movzx eax, dl
push edx
add eax, dword [edx + esi - 0xdf000]
mov dword [esp + edx - 0xdeffc], edx
push edx
lea esi, [esi + edx*2 - 0x1bdffc]
lea edx, [edx + edx - 0x2a77b9e0]
pop edx
add ecx, eax
lea edx, [edx*2 + 0x603292c]
inc byte [esp + edx - 0x61f0926]
push edx
mov eax, ecx
movzx ecx, byte [ebp + edx*4 - 0x187c24af]
xor cl, bl
and edx, 0xe9177a39
ror dl, 0x83
ror dword [esp + edx*4 - 0x5c2008], 0x58
neg cl
call fcn.0076e7ff
mov eax, dword [ebp]
add ebp, 4
call fcn.00cca38b
push eax
invalid

Function at 0xd609d1
Capabilities:
Encode data using xor

Disassembly:
inc dx
add esi, dword [esp + esi - 0x137e]
dec eax
imul ebx
dec edi
mov ebx, dword [edi + esi*4 - 0x4e00]
dec ecx
and ecx, ebx
dec eax
not ecx
dec esp
lea ebp, [edx*8 + 0x4b842d0b]
inc edx
add dword [esp + esi*8 - 0x9bff], edx
inc ecx
rol edx, 0x29
dec ebx
mov dword [edi + esi*2 - 0x2700], ecx
cdq
call fcn.00baa043
syscall
call fcn.00bf7729
dec esp
mov ebp, dword [ecx + esi]
dec eax
mov dword [esp + ecx*4], ebx
movzx esi, word [esp + ecx*2 + 1]
setno byte [esp + ecx]
dec ecx
xor ecx, ebp
jmp 0xac1f00
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401bd7
pop dword [ebp - 0x10]
mov eax, 0x6ee071c1
add eax, 0x915faa16
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x230abd31
sub dword [ebp - 0x20], 0xd4b877e6
mov dword [ebp - 0x1c], 0x1ad64c79
add dword [ebp - 0x1c], 0x175cffcc
mov dword [ebp - 0x18], 0xd3952619
sub dword [ebp - 0x18], 0x8748e1eb
mov dword [ebp - 0x14], 0x25cded95
sub dword [ebp - 0x14], 0x25cded95
lea eax, [ebp - 0x20]
push eax
mov eax, 0x186dadee
sub eax, 0x182d3d8e
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x1489d05d
sub dword [ebp - 0x20], 0xa0176707
mov dword [ebp - 0x1c], 0xa7d415a5
add dword [ebp - 0x1c], 0x99984bd0
mov dword [ebp - 0x18], 0xfabfc4b
add dword [ebp - 0x18], 0x53c37021
mov dword [ebp - 0x14], 0x1591e2c8
add dword [ebp - 0x14], 0xea6e1d38
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3476b
push 0
call eax
mov ecx, 0xf257098
add ecx, 0xf0dacef6
xor edi, edi
add edi, eax
mov ebx, 0xc5ea4b50
sub ebx, 0xc5a94b50
add ebx, dword [ebp - 0x10]
mov esi, 0xbee64cf0
xor dword [ebp - 4], esi
mov edx, dword [ebx]
xor dword [ebp - 4], 0x4fda121c
add edx, esi
mov dword [edi], edx
xor dword [ebp - 0xc], 0x363dfc7c
add edi, 0x7f471e92
add edi, 0x80b8e172
add ebx, 0xdeeb4bd9
add ebx, 0x2114b42b
loop 0x401cf0
add eax, 0xf10b
mov ebx, eax
add eax, 5
mov ecx, 0xf236b9e7
sub ecx, 0xf1f6b9e7
add ecx, dword [ebp - 0x10]
call ebx
leave
ret