joyce8/EMBER2024-capa huggingface dataset:
Function at 0xce441c
Capabilities:
Encode data using base64

Disassembly:
not ecx
ja 0xd16a9c
movsx eax, dl
mov ecx, dword [esi + edx - 0x142d9eb4]
mov edx, dword [ecx + edx*2 - 0x285b3d68]
sal al, 0xc2
mov dword [esi], edx
sbb edi, 4
mov ecx, eax
mov ecx, dword [edi]
xor ecx, ebx
lea edx, [eax + eax*8 + 0x742a7b26]
sub al, dl
lea ecx, [eax + ecx - 0x4a5339c1]
add ax, dx
neg ecx
sub dx, 0x2b36
and edx, edx
lea ecx, [ecx + edx - 0x6518852d]
lea edx, [eax + edx*4 + 0x491ea9aa]
adc al, 9
jle 0x815c20
mov dx, word ss:[ecx + eax - 0x10140ad5]
pop ecx
mov ecx, 0xb82a9338
add esi, 2
movsx eax, cl
mov word [eax + esi - 0x38], dx
jmp 0xd37e5b
rol ax, 2
ror edx, 2
neg edx
rol ecx, cl
sub edx, 0xe2058b1c
not edx
sub ax, ax
inc ax
cmova eax, ecx
lea edx, [ecx + edx + 0xdadbd03]
rol cl, 0x67
bswap edx
add cx, 0xe93d
inc ax
xor ebx, edx
add ebp, edx
add al, ch
jb 0x8d5d1e
mov edx, dword [esi]
neg ecx
lea ecx, [eax*8 - 0x4669fe77]
not eax
mov al, byte [esi + eax - 0x7fff7f92]
sal ecx, cl
lea esi, [ecx + esi - 0x9a1fffa]
mov byte [edx + ecx - 0x9a20000], al
jmp ebp
sal cx, 0xc
lea edi, [edi + eax*8 - 0x1c4]
mov edx, ecx
ja 0xceeddd
mov ecx, dword [edi + eax*2 - 0x70]
xor ecx, ebx
xor ecx, 0x6204a92b
ror ecx, 3
or dl, dl
shr ax, 0x41
inc ecx
xadd ax, dx
lea eax, [eax*2 - 0x1d74468]
not ecx
or ax, ax
lea ecx, [ecx + edx - 0x381e9f7]
add ax, ax
neg edx
neg ecx
lea eax, [edx - 0x367fb7e2]
xor ebx, ecx
sal edx, 0xb4
rol eax, 0x52
call fcn.00d35797

Function at 0xce6570
Capabilities:
Authenticate hmac

Disassembly:
rol eax, 1
or dl, 0xb5
mov dword [esp], 0xd3a1af12
neg eax
rol dx, 0xa6
xor cx, 0x8b86
not eax
jnp 0x8b55d2
cli
jle 0xce6597
pop es
push es
mov ah, 0xfa
or dword [eax - 0x58320aa], edi
or dword [eax - 0x5b30071], edi
or dword [eax - 0x5bb39a2], edi
or dword [eax - 0x53bf8d2], edi
or dword [eax - 0x55b89ea], edi
or dword [eax - 0x57b4859], edi
or dword [eax - 0x58381b9], edi
or dword [eax - 0x5e3b011], edi
or dword [eax - 0xda01071], edi
jbe 0xce6593
push edx
jecxz 0xce65de
xor al, 0xd2
popfd
push ds
mov dh, 0x75
out 0xec, eax
clc
or eax, 0x9dedfbfb
in eax, dx
popfd
test bh, ch
xlatb
mov edi, 0xbdf64007
invalid

Function at 0xcecc2e
Capabilities:
Encode data using base64

Disassembly:
neg dword [esp + edx*4 - 0x21f11e52]
mov dword [ecx + edx*2 - 0x10f88f30], eax
movsx eax, dl
mov dword [esp + edx - 0x87c4798], edi
ret 0x10
xor byte [esp + edx - 0x87c4786], dl
mov dword [esp + edx - 0x87c4798], edx
xor bl, cl
sar dword [esp + edx*2 - 0x10f88f2e], 0xa4
lea ecx, [esp + ecx + 0x14]
jbe 0x8330e2
cmc
mov dword [ebp - 0x48], esi
shrd si, di, 0x1b
sbb esi, 0x6d0c02a6
mov esi, dword [eax]
test ebp, 0x3a3c1838
cmp ebp, 0xdb981ba6
mov dword [ecx], ebx
test edi, 0xc1348c27
mov ecx, dword [ebp + 0x14]
cmp esi, 0x6eb37fa9
mov dword [ecx], ebx
mov ecx, dword [eax + 4]
sar al, 9
bt eax, 0x8e
test dx, ax
add ecx, esi
shl al, cl
add eax, 0xeb07d00d
mov eax, 0x300
stc
shl eax, cl
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], ebx
stc
mov dword [ebp - 0x10], edi
test edi, 0xaf30a90e
add eax, 0x736
jmp 0xd44798
Function at 0xd03464
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
dec esp
mov dword [esp + ecx - 0x7637859d], esp
inc esp
xor dword [esp + edx - 0x6803bea2], esi
rol eax, 2
dec eax
xadd dword [esp + ecx - 0x7637859b], edx
inc esp
xchg byte [esp + ecx - 0x76378598], ah
not eax
dec eax
not dword [esp + ecx - 0x76378599]
bswap eax
xadd ebx, edx
sbb eax, 0xe53868b5
add dx, bx
rol eax, 1
inc word [esp + ecx - 0x7637859a]
or ebx, dword [esp + ecx - 0x7637859b]
dec esp
mov dword [esp + ecx - 0x76378595], ebx
inc ecx
neg esi
xor dword [esp + edx - 0x793988c3], eax
dec esp
mov ebx, dword [esp + edx - 0x793988c3]
inc ebp
movsx ecx, si
dec eax
arpl ax, ax
not dl
dec eax
add edi, eax
call fcn.0095d9a3

Function at 0xd03854
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc dword [esp + 1]
inc ebp
xor esp, ebx
inc ecx
neg esp
inc ecx
ror esp, 1
mov edx, 0x492885bb
movzx ecx, dx
inc ecx
sub esp, 0x938b39bb
inc ecx
xor esp, 0x48889f24
dec esp
mov dword [esp + edx - 0x492885bb], ebx
inc esp
xor dword [esp + edx - 0x492885bb], esp
inc esp
movsx ecx, cl
inc ecx
pop ebx
jmp 0x9050ea
dec esp
lea eax, [edx*2 + 0x2c8b4289]
inc ecx
inc ecx
pop esi
inc esp
mov esp, dword [ebp]
push 0xe58d9631
jmp 0x8ab6c8

Function at 0xd0c04d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
jne fcn.0093525e
mov dword [esp + ecx*2 - 0x239e8000], eax
sub cl, ah
ror edx, 1
lea ecx, [eax*4 - 0x58f93348]
xadd dword [esp], eax
shr dword [esp], cl
xor ebx, edx
inc byte [esp + 2]
not al
add edi, edx
sub dword [esp], ecx
rdtsc
sub ebp, 8
push ecx
bswap ecx
mov dword [ebp + 4], eax
sal byte [esp + 3], cl
mov dword [ebp], edx
pop eax
jnp 0x87d7b6
pop eax
mov bl, 0x80
lds esi, [ebp + 0x1b]
xor ecx, dword [eax + 0x738a3aef]
aas
mov edi, gs
cmp cl, byte [edx - 0x106fec89]
cmp cl, byte [edx - 0x1057ace5]
cmp cl, byte [edx - 0x1017b0ad]
cmp cl, byte [edx + 0xaa18363]
pop ecx
std
push edx
mov edi, 0x3cb485bf
sbb dword [ebp + 0x4875c714], edx
pushfd
out dx, eax
scasd eax, dword es:[edi]
mov edi, 0xbfd15c62
adc ebx, ebx
pushfd
invalid
Function at 0xd0f53d
Capabilities:
Encode data using base64

Disassembly:
ror cl, 0xe7
dec edi
lea edi, [edi + edx*2 - 0x12c]
dec edx
lea ebp, [ebp + edx - 0x99]
inc ecx
movzx esi, dx
inc edx
mov cl, byte [ebp + edx - 0x98]
jae 0x8387d5
inc edx
xadd byte [esp + ecx*2 + 8], bl
inc ecx
xor cl, bl
neg cl
ror cl, 1
inc esp
movzx esi, bx
call fcn.008ae13b
inc ebp
xor ebp, ebx
dec ecx
lea esi, [esp + 0x2686301c]
inc ecx
movsx ebx, dl
dec esi
lea ecx, [eax*4 + 0x692e2438]
inc ecx
rol ebp, 2
mov edx, 0x788b1620
dec eax
sar esi, 0x8f
inc esp
movsx esi, bl
inc ecx
xor ebp, 0x5882b1a5
inc ecx
shl ah, 0x81
dec ecx
xadd edx, edx
dec eax
ror eax, 0x2e
inc ecx
not ebp
sal dx, 0x61
inc bp
xchg esp, edx
inc ebp
lea ebp, [ebp + eax*8 - 0x4a44ed3a]
inc ecx
movsx ecx, al
call fcn.00922dad
dec edx
lea eax, [ecx + 0x6160a07]
rol edx, 2
bswap eax
ror word [esp + ecx*4 - 0x1b9a6], 0xd
call fcn.007ecac5
mov edx, 0xa88e0019
mov eax, dword [ebp]
mov cl, byte [ebp + 4]
push edx
sub edx, edx
sub byte [esp + edx + 1], 0x11
lea ebp, [ebp + edx*8 + 2]
dec edx
pop edx
ror edx, 0x3e
shl eax, cl
mov dword [ebp], eax
sub esi, 4
sar edx, 0xbd
jne 0x8a5e9c
setns dl
sub eax, 0xcc9555bf
lea edi, [edi + edx - 4]
neg cl
push ecx
shl al, 1
mov ecx, dword [edi + edx]
adc edx, eax
shr edx, 0x2b
xor ecx, ebx
not al
shl eax, 0x71
inc ecx
pop eax
rol ecx, 1
not ecx
dec dl
dec eax
inc eax
add ecx, 0xc4a541b2
add eax, 0x230c9f0f
neg ecx
xor dx, 0xb38d
xor ebx, ecx
xadd dl, dh
push edx
adc ebp, ecx
mov dword [esp + edx - 0x18357b], ebp
ret
inc ecx
not ebp
inc esp
movzx ecx, dh
bswap esi
inc ecx
xor ebp, 0xbe1e1b28
inc ecx
not dl
inc ecx
push ebx
inc ecx
add edx, edx
inc eax
sub bl, dh
inc esp
xor dword [esp + ebx - 0x4f52560a], ebp
inc ecx
pop ebx
inc ecx
ror esi, cl
dec ebp
arpl bp, bp
dec eax
bswap ecx
inc ecx
ror dh, 0x25
inc esp
adc dl, cl
dec ecx
adc edi, ebp
jmp fcn.00d3b80a
lea esp, [esp + 4]
call eax
mov edx, 0x6bbcdfb2
sub dl, dh
mov ebp, dword [edx + ebp - 0x6bbcdfd7]
mov dword [ebp + edx - 0x6bbcdfd3], eax
not edx
jnp 0xd06fd0
pop ebp
sub cx, ax
not cx
xadd eax, edx
pop edi
jle 0x879800
dec ebp
lea edi, [edi + edx*8 - 0x198]
movsx eax, cl
xchg cx, ax
dec ebx
dec esi
mov dword [ebx + edi - 0x4f52d46c], ebp
inc cx
ror esp, 0xa5
shl eax, 0x49
inc cx
xchg edx, ebx
dec eax
lea ebp, [ebx + ebp - 0x4f52624e]
not bl
inc esp
mov ebp, dword [ebx + ebp - 0x4f5262b5]
inc ebp
xor ebp, ebx
inc ebp
xchg edx, esp
inc ecx
neg ebp
dec eax
dec eax
rol bx, 5
inc ebp
add esp, esp
inc ebp
lea ebp, [ebp + edx - 0x5eac25c8]
inc ebp
add esp, esi
jno 0x8d3be5
inc ecx
neg ebp
call fcn.008ba819
add ah, byte [ebp - 0x35]
adc eax, 0x8dba30e4
adc ebp, dword [edx - 0x1e643d07]
pop edi
stosb byte es:[edi], al
stc
ret 0x2c66
mov esi, ebp
movzx eax, dl
movsx ecx, dl
pop ebx
movsx ebp, cx
jle 0xcee8db
mov ecx, 0x65b38ea3
call fcn.007e1ea2
dec esi
mov ebx, dword [esp + edx - 0x80]
dec eax
arpl dx, dx
dec eax
add edi, edx
dec ecx
rol ecx, cl
inc edi
mov ebp, dword [edi + edx - 0x98]
jae 0x7d9c13
mov eax, dword [ebp + eax*8 - 0x3a10b318]
jmp 0x967f5b
Function at 0xd18bd4
Capabilities:
Authenticate hmac

Disassembly:
inc ebp
xor bl, ah
dec esi
lea esp, [esp + 0x10]
dec esp
and edx, dword [esp + ecx*8 - 0x7fc90]
jae 0x849729

Function at 0xd1d429
Capabilities:
Encode data using base64

Disassembly:
ror edx, 2
xchg dword [esp + eax - 0x34b9e18e], eax
ror eax, cl
xor ebx, edx
neg ax
sal al, 0xc6
add edi, edx
movzx ax, byte [ebp + ecx*2 - 0x697279b0]
mov edx, ecx
neg dx
inc cl
mov cl, byte [ecx + ebp - 0x34b93cd7]
lea ebp, [ebp + edx*2 - 0x6973864e]
dec dl
pop edx
sal al, cl
call fcn.00d43131

Function at 0xd1f447
Capabilities:
Encode data using add xor sub operations

Disassembly:
lea eax, [edx + edx*4 - 0x2be01fea]
not ecx
call fcn.007f1dc4

Function at 0xd24adf
Capabilities:
Encode data using base64

Disassembly:
mov dword [esi + eax - 0x21b804a0], edx
mov edx, 0x1884512
not edx
lea edi, [edi + eax*2 - 0x43700944]
dec eax
mov dword [esp + eax - 0x21b8049f], eax
mov edx, dword [edi + eax - 0x21b8049f]
xchg word [esp + eax*2 - 0x43700936], ax
xor edx, ebx
inc edx
lea ecx, [eax + eax + 0x3f298030]
xor edx, 0x35907083
neg edx
call fcn.007efd84

Function at 0xd2e67d
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [edi + 4]
add edi, 4
shld dx, ax, cl
mov ecx, dword [esp]
mov word [edi], dx
lea eax, [ecx + 0x67ac8e90]
call fcn.00965e3a
mov eax, dword [ebp]
mov edx, 0xe9a083aa
mov ecx, dword [ebp + 4]
add eax, ecx
mov dword [ebp + 4], eax
movzx eax, dl
mov eax, dword [esi + eax - 0xae]
sal edx, 0xc8
shl dx, 0x88
adc esi, 0xfffffffc
xor eax, ebx
add eax, 0x200fc595
call fcn.00d8d92f
lea eax, [ecx*4 - 0x347af67a]
mov dx, word [edi + eax*8 - 0x59417e50]
mov dword [esp + eax - 0xb282fca], 0x16be2512
mov ax, word [edi + eax - 0xb282fc8]
mov word [esp + 2], cx
shr cx, 0x88
jb 0x93ed67
mov cx, word [esi]
mov eax, 0x6b0dea86
mov edx, eax
call fcn.0089cb71

Function at 0xd2f882
Capabilities:
Encode data using base64

Disassembly:
pushfd
mov dword [esp + 4], 0x6dff0922
lea esp, [esp + 4]
call fcn.00daa46a
call fcn.00d7c5c4
jp 0xd2f8a1
invalid
test byte [eax - 0x407cf05f], al
neg dword [eax + 0x10]
mov ecx, dword [esi]
mov eax, 0xbcac729c
and ax, ax
shl ax, 0xcf
adc esi, 4
xor ecx, ebx
movzx edx, al
lea ecx, [ecx + edx*2 - 0x5689fbba]
rol eax, 0x3f
neg ecx
sal edx, 0xe3
bswap ecx
sal eax, 0x90
inc eax
ror ecx, 3
lea ecx, [eax + ecx + 0x5e8446bc]
xor ebx, ecx
bswap eax
sal ax, 0x43
add edx, edx
adc edi, ecx
xchg edx, eax
call fcn.0081180f
push 0x4bc0780
neg byte [esp + 3]
mov eax, dword [ebp]
shr dword [esp], 0xfd
add ebp, 4
dec dword [esp]
mov ecx, 0xa6af0ab6
movzx edx, byte [esi]
shr cl, 0xa2
add esi, 1
add cx, 0x5386
xor dl, bl
sub dl, 7
shr dword [esp], cl
not dl
ror dl, 1
add dl, 0x8d
neg byte [esp + 1]
neg dl
rol dl, 1
inc ecx
sub dl, 0x37
not dword [esp]
neg dl
or ecx, ecx
shr cl, 0x41
xor bl, dl
neg cx
setg cl
lea edx, [esp + edx + 4]
shr cx, 2
mov dword [edx], eax
push ecx
call fcn.00cf36fd

Function at 0xd3163a
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + ebx*4]
mov dword [esp], eax
jmp 0x8e95c2
Function at 0xd3584d
Capabilities:
Encode data using base64

Disassembly:
inc ecx
neg esp
dec ecx
inc eax
inc eax
setns dh
call fcn.0095f1c9
mov ecx, 0x79273505
call fcn.008cc8dd
inc edi
lea esp, [esp + edx - 0xfe03d87]
and al, 0x83
jae 0x8258f9
cmp edx, ecx
or byte [esi + 0x66ecd0b3], dl
mov ah, 0xe7
shr ah, 1
mov ah, 0xe7
mov bh, 0xd4
in al, dx
mov ah, 0xf0
xchg dword [esp + ebp*8 - 0xc904b9a], esp
loopne 0x898092
mov ah, 0x3f
xchg ebx, eax
mov al, byte [0x7e801378]
or eax, 0x1a86df8
movsb byte es:[edi], byte [esi]
je 0x89811e
adc eax, eax
mov eax, dword [eax]
jmp dword [edx + 0x6e4804f6]
mov ah, 0x98
sub byte [ebx], cl
in eax, dx
mov ah, 0xd4
mov ah, 0x17
in eax, dx
mov ah, 0x33
sub al, 0x5f
in eax, dx
mov ah, 0x50
xor byte [ebx + 0x79], dl
adc eax, dword [eax + 0x6c4baed6]
test al, 1
mov ecx, 0x30d2c760
push ebx
ret
inc esp
movzx ebp, cx
dec edi
mov dword [edx + edi - 0x671211a0], ecx
inc esp
movsx ecx, si
dec edi
lea edi, [edx + edi - 0x671211a0]
dec ebp
lea eax, [edx + esi*8 + 0x3fb7f000]
inc esp
mov esp, dword [ebp + edx*2 + 0x15ca9582]
dec eax
lea ebp, [ebp + esi*2 + 0x11821bba]
dec ebp
lea esi, [ebp + eax*8 + 0x47a6cc25]
dec esp
lea edx, [ebx - 0x3be71157]
inc cx
add ebx, ecx
inc ebp
xor esp, ebx
inc ecx
shr esi, 0x54
inc ecx
pop esi
inc ecx
ror esp, 1
inc ecx
dec esp
add cx, 0x7e2c
inc ecx
rol esp, 1
inc ecx
inc cl
setne al
jge 0x89807d
mov esp, edi
mov ebx, 0x2b205632
lea edx, [ebx + ebx - 0x4af7a8d6]
call fcn.00d7fb83
jbe 0xd358cc
invalid
out dx, al
popfd
xchg ebx, eax
xchg esi, eax
mov cl, 0x2f
and dword [esi - 0x76ef9e15], 0xffffff84
mov dword [esp + eax - 0x59ba7126], eax

Function at 0xd358d7
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x59ba7126], eax
mov eax, dword [eax + esi - 0x59ba7124]
mov cl, byte [esi + 6]
shr eax, cl
mov dword [esi + 4], eax
add esi, 4
call fcn.00cee3b8
mov eax, 0xebb1d609
lea ecx, [eax + eax*4 + 0x673dbd8f]
mov ecx, dword [esi + ecx*2 - 0x36dd778]
movsx edx, al
lea esi, [edx + esi - 5]
xor ecx, ebx
push edx
inc ecx
rol ecx, 1
shr dl, 0x67
jns 0xd5de94

Function at 0xd3e29c
Capabilities:
Encode data using base64
Encode data using xor
Execute anti-debugging instructions

Disassembly:
rol dl, 1
sub cl, 0x16
adc dl, 0xb2
call fcn.0090e475
Function at 0xd3e66d
Capabilities:
Authenticate hmac

Disassembly:
dec ecx
lea eax, [ecx + ebx + 0x1b1501bd]
inc esi
xor dword [esp + ebp*2 - 0x7a3abe38], esp
inc ebp
sub bl, cl
ja 0x92911c
inc edx
add byte [esp + edx - 0x8353], dl
dec esi
mov dword [esp + edx - 0x8358], ebx
dec ebx
lea eax, [ecx + ebp*2 - 0x30eb47d6]
inc edx
xor dword [esp + edx*2 - 0x106b0], esi
inc ecx
sal ebp, cl
inc ecx
pop ebx
dec eax
arpl si, si
inc ecx
adc esp, 0x79b4d60f
dec eax
neg ebx
add edx, eax
dec eax
adc edi, esi
dec esp
add ebp, edi
inc ecx
jmp ebp
jne 0xcd6bd9
rol ecx, 2
sal dword [esp], 0x41
neg edx
bswap ecx
sbb dl, dl
ror eax, 0xac
sets dl
lea ecx, [ecx + eax + 0x7c533287]
sub dword [esp + edx - 1], edx
jae 0x88b571
mov ecx, 0x273b1f97
dec eax
bswap ecx
inc esp
movzx esp, cl
dec edi
mov eax, dword [edi]
mov edx, 0xcc89868c
mov eax, ecx
inc esp
movzx ecx, al
dec ebx
mov ebx, dword [eax]
dec ebx
mov dword [esp + edi], ebx
dec ecx
xor ecx, ecx
inc esi
mov edx, dword [ebp - 4]
shl cx, 0xe9
inc esp
movsx eax, dx
dec edx
lea ebp, [ebp - 4]
inc ebp
xor edx, ebx
dec ebx
lea ebx, [eax - 0x65431d4c]
inc ecx
inc edx
dec esi
lea ebp, [eax*2 - 0x7d60e151]
inc sp
and ebp, ebx
inc ecx
xor edx, 0x15b7ec20
inc ecx
neg edx
neg ecx
shr al, 0xa5
inc ecx
xor edx, 0x11955b18
inc ecx
xchg al, cl
or bl, 0x3f
dec ecx
not eax
inc ecx
dec edx
add cl, 0x9b
inc cx
shl ebp, 0x43
inc ecx
ror edx, 1
jmp 0x980773
shr bx, cl
not cl
inc ecx
push ebx
inc esp
xor dword [esp + ecx - 0xd8], edx
sar dx, 6
inc ecx
pop ebx
shl al, 6
dec ebp
arpl dx, dx
bswap edx
dec ecx
neg ebp
dec ecx
add edi, edx
inc cx
not esp
dec esi
lea esi, [eax + ebp - 0x6cdd2958]
dec ecx
mov edx, dword [edi + ecx*2 - 0x1b0]
inc ecx
movsx esi, ch
inc ebp
or esp, eax
inc sp
mov esi, dword [edx + ecx*2 - 0x1b0]
ja 0xcecde6
mov eax, 0xc400862b
sub edi, 4
or al, 0x8f
mov ecx, 0xd28109e
mov eax, dword [ecx + edi - 0xd28109e]
xor eax, ebx
sub cx, cx
neg eax
inc cl
not eax
push ecx
call fcn.00d7ec9b
inc ecx
not esp
inc ecx
bswap esp
inc esp
movzx ecx, bx
dec edx
mov dword [esp + ebp - 0x3d1d5f1c], 0x340249a7
dec esp
mov dword [esp + ebx - 0x1c], ebx
inc ebp
movsx ebx, si
jae 0x8128af
rol ecx, 1
add dword [esp + eax*2 - 0x10301510], edx
sbb eax, 0x39b4883b
bswap ecx
sbb edx, edx
jl 0x96f242
push ebx
pushfd
mov ebx, 0xc42a41ad
call fcn.00d48080

Function at 0xd4418a
Capabilities:
Encode data using base64

Disassembly:
xchg word [esp + edx - 0x89c], cx
shr byte [esp + edx - 0x89b], cl
add eax, 0xc6912097
call fcn.008582ad

Function at 0xd47a80
Capabilities:
Encode data using xor

Disassembly:
dec eax
lea ecx, [esp + ecx + 0x20]
dec esi
mov dword [esp + edx*2 - 0x6c], eax
dec esi
mov dword [ecx + edx*4 - 0xd8], esp
dec esp
lea esi, [edx + esi*8 + 0x58a5b022]
call fcn.0083ea88
sub esi, dword [eax]
push ebp
xchg esi, eax
aad 0xf6
push ss
cmp esi, dword [edx + ecx*8 + 0x3b16ea89]
mov ah, 0x31
cmpsb byte [esi], byte es:[edi]
invalid
Function at 0xd47f52
Capabilities:
Encode data using xor

Disassembly:
dec dword [esp + 4]
mov dword [edi + 8], ebx
mov dword [esp], 0xd2b7648b
mov ebx, 0x330d6405
mov dword [edi + ebx - 0x330d6401], ecx
pop eax
mov dword [edi + ebx*2 - 0x661ac80a], edx
inc ebx
sar dword [esp + ebx*2 - 0x661ac80c], 0x7a
call fcn.008c3780
mov eax, 0x22339225
dec eax
lea ebp, [ebp + eax*2 - 0x4467244e]
push eax
push eax
mov esi, dword [ebp + eax*2 - 0x4467244a]
call fcn.008321b4
mov ecx, 0x52834ba4
dec cl
movzx eax, cx
mov cx, word [eax + edi - 0x4ba3]
jne 0x99993d
dec ecx
not ecx
shl edx, 0x58
call fcn.00894944

Function at 0xd4b1e5
Capabilities:
Encode data using base64

Disassembly:
xor ebx, ecx
jmp 0x986eca
sub eax, edx
xor byte [esp + 2], dl
adc ebp, ecx
inc word [esp + 6]
shr al, 0xa4
mov edx, dword [edi]
and byte [esp + 4], al
jge 0xd3d411
xor edx, 0x2b0f7d8d
pop ecx
inc dword [esp + eax + 4]
xor ebx, edx
add ebp, edx
add al, byte [esi + eax*2 - 2]
mov dl, byte [esi]
mov ecx, 0x4eb33da1
and al, dl
call fcn.00d7754a
xor ecx, 0x1af34ad
neg edx
rol byte [esp + eax - 0x1878ccfc], 0xa1
dec ecx
inc eax
jge 0x841cf6
inc eax
neg eax
add ebp, ecx
mov edx, dword [edi + edx*2 - 0x14c]
lea ecx, [eax + eax*8 - 0x4ef79cca]
sar cl, 0x26
mov eax, dword [edi + 4]
jb 0x967f76
shr ecx, 0xed
push ecx
mov cl, byte [edi + ecx*4 - 0x153770]
neg byte [esp + 2]
inc byte [esp]
add edi, 6
call fcn.00917b1d
Function at 0xd4c2b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, edx
rdtsc
rol ecx, cl
push ecx
lea ebp, [ebp + ecx*2 - 0x5e718]
sbb dword [esp + ecx*2 - 0x5e710], ecx
neg cl
jb 0x9477cd
sal al, 0xe1
not ax
mov dword [ebp + eax*2 - 0x1febe], edx
neg dword [esp + eax*2 - 0x1feba]
mov dword [esp + eax*2 - 0x1febe], edi
ret 4
mov dword [ebp + ecx - 0x2f374], eax
mov dword [ebp + ecx*2 - 0x5e6f0], edx
movsx eax, byte [esp + ecx - 0x2f378]
dec dword [esp + ecx - 0x2f378]
sub cl, 0x2c
pop ecx
jae fcn.0093525e
inc edx
sub dword [esp + eax + 4], 0x45a77ca1
inc ebp
xor esp, ebx
dec ecx
ror eax, cl
not cx
inc dx
sal dword [esp + ecx*2 - 0x1c7e0], 0x6c
inc ecx
ror esp, 1
inc edx
ror dword [esp + ecx*4 - 0x38fc1], 0x81
inc ecx
dec esp
dec edi
lea ecx, [ebp + edx*8 - 0x7b7f2174]
dec esp
lea ecx, [eax*8 - 0x20f791e9]
inc ecx
shr ecx, 0x91
inc ecx
rol esp, 1
inc edi
lea esp, [esp + edx*4 - 0x7fc50670]
inc ecx
not eax
dec eax
add ecx, 0x529fc3d
jno 0xd29069
add esi, 4
xor edx, edx
jmp 0xd3c31b
inc ecx
neg esp
movsx edx, si
call fcn.0086674e
xor eax, 0x4483bd02
jmp 0xd9a262
test eax, eax
call fcn.008f5867
sysenter
call fcn.007edbef
neg ecx
add ebp, eax
mov dword [esp + ecx + 0x411db07a], 0x278fabaf
rol dword [esp + ecx + 0x411db07a], cl
mov ecx, dword [esi + ecx + 0x411db07a]
mov eax, dword [esi + 4]
jb 0xd216fa
mov eax, 0x4d2b8738
lea ecx, [eax*2 + 0x18008790]
jmp 0xdbd7e1
bswap eax
not eax
ror eax, 1
dec eax
xor ebx, eax
add ebp, eax
call fcn.008fdf78
inc ecx
pop ebp
inc edi
mov eax, dword [edi + ebp - 0x4cb5bcb2]
dec edi
lea ecx, [esp + 0x7c1b56ad]
inc ecx
neg ebp
dec edi
lea edi, [edi - 0x4cb5bc41]
inc ecx
mov ecx, ecx
inc ecx
div eax
inc ecx
shr ah, 0x42
inc ebx
mov dword [edi - 0x4cb5bc11], edx
dec ebp
lea edx, [ebp - 0x3b4b7c67]
inc ebx
mov dword [edi + edx - 0x77fec6db], eax
dec eax
and ecx, ecx
inc ecx
mov esi, ebp
dec ecx
lea ebp, [esp + ebp - 0x4cb5bc15]
inc esi
mov esp, dword [ebp + edx - 0x77fec6df]
inc ecx
movsx ebx, ch
movzx edx, cx
dec eax
bswap esi
inc ebp
xor esp, ebx
call fcn.0088dc98
or eax, eax
inc edx
not al
movzx ecx, ax
ror edx, 1
xor ebx, edx
jmp 0x84dd71
mov eax, dword [esi + eax - 0x4d2b8738]
sal ecx, 0x9a
lea edx, [ecx + ecx*8 - 0x185b34d4]
dec dx
adc ecx, dword [esi + ecx*2 + 4]
or dx, dx
dec edx
shl dx, 0xe8
add esi, 4
dec dx
and dx, 0xc5b0
shl dl, 0x87
adc eax, ecx
call fcn.0083f517
sub esi, 4
mov edx, 0xcb96bc1c
lea eax, [edx + edx*8 + 0x5d8a132a]
xchg edx, eax
mov edx, dword [esi]
xor edx, ebx
inc eax
neg edx
xor edx, 0xdd0045b3
jmp 0xdadc29
Function at 0xd523a0
Capabilities:
Encode data using base64

Disassembly:
inc esp
xor dword [esp + esi*8 - 0x7fd08], ecx
dec esp
mov ebx, dword [esp + esi - 0xff9a]
dec eax
mov dword [esp + esi*8 - 0x7fd08], esi
dec ebp
arpl cx, cx
call fcn.0094e50c
jne 0x8066b9
mul ecx
mov ecx, 0x5e9f7b94
sub cx, 0xcf00
sar ecx, cl
mov dword [esi + ecx*2 - 0xbd2], edx
lea edx, [ecx - 0x56d9c3e8]
mov dword [esi + ecx*8 - 0x2f44], eax
rol cl, 0xc1
lea edx, [ecx*8 + 0x6d3d0496]
shl cl, 0xe4
lea edi, [edi + ecx - 0x534]
mov edx, dword [edi + ecx*2 - 0xa60]
movzx eax, cx
sar ax, 2
not cl
xor edx, ebx
rol ax, 0xaf
adc ecx, eax
jno 0x7fd97d
dec eax
mov dword [esp + esi*4 - 0x3fe88], esi
dec esp
mov dword [esp + esi - 0xff9a], ebx
jmp 0x7ef619

Function at 0xd58ef2
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov dword [esp + edx*2 - 0x8328], ebx
jmp 0xd7ab11

Function at 0xd5e915
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xc033293a
mov edx, dword [ebp]
pop ecx
lea ecx, [ecx + ecx - 0x3bd47e5b]
mov eax, dword [ebp + ecx - 0x4491d415]
jmp 0xd52393

Function at 0xd61457
Capabilities:
Authenticate hmac

Disassembly:
setge byte [esp + ecx]
sar word [esp + ecx + 1], cl
mov ecx, dword [edi + ecx - 1]
xor ecx, ebx
sal dword [esp + edx*4], 0xde
dec ecx
xor ecx, 0x62143b2e
sub word [esp + edx + 2], 0xce36
ror ecx, 1
call fcn.0080dee4
sub cl, cl
mov eax, dword [ecx + edi - 0x12aa7ffc]
ror cx, 0xec
call fcn.0082d7a4
add dl, 0x97
ror dl, 1
neg dl
ror dl, 1
xor bl, dl
mov word [esi + eax - 0x638f142e], dx
ror word [esp + eax - 0x638f142a], 0xa5
setb byte [esp + eax - 0x638f142c]
movsx edx, al
mov edx, dword [edx + edi - 0x31]
rol eax, 0x91
jb 0x8b5572
add eax, dword [esp + eax*2 - 0x50b18e3c]
xor edx, ebx
jmp 0x852b8d
neg eax
rol eax, 3
dec byte [esp + 5]
and cx, cx
bswap eax
xor byte [esp + 6], 0xab
xor ebx, eax
call fcn.008ece12
mov eax, 0x638f142c
push eax
movzx edx, byte [eax + edi - 0x638f142d]
xor dl, bl
shr word [esp + eax - 0x638f142c], 0xa4
rol dl, 1
xor dl, 0x8a
jmp 0x90790d
mov dword [edi], eax
mov eax, dword [esi]
pop edx
pop edx
add esi, 4
xor eax, ebx
mov ecx, 0xeaa9b99e
shl cl, 0xe2
mov dword [esp], ecx
rol eax, 1
push ecx
jmp 0x91bde5

Function at 0xd66c32
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edi + eax - 0x1b3c123d]
movsx ecx, al
xor edx, ebx
dec edx
xor edx, 0x5f14e51a
add eax, ecx
call fcn.00921c47
ror ecx, 3
lea edx, [eax + eax + 0xe09c4b6]
ror edx, 0xef
jb 0x9415ae
neg ecx
lea ecx, [eax + ecx - 0x1ab416ba]
rol dx, 0x61
call fcn.0082e0db
movzx eax, dx
mov edx, dword fs:[ecx + eax*2 - 0x16870]
mov dword [eax + edi - 0xb438], edx
mov dword [esp + eax*4 - 0x2d0e0], eax
mov dword [esp + eax*2 - 0x1686c], 0x205b21c
mov ecx, dword [esi + eax - 0xb438]
xor al, 0xad
sar byte [esp + eax - 0xb494], 0x61
push eax
xor ecx, ebx
dec dword [esp + eax - 0xb491]
jp 0x90ae3f
jne 0x98c041
mov ax, word [ebp]
mov ecx, 0xc397ff3e
push ecx
call fcn.00cf8bc3