joyce8/EMBER2024-capa huggingface dataset:
Function at 0x189346b
Capabilities:
Encode data using base64

Disassembly:
xor word [esp + 1], dx
mov si, word [esi]
neg eax
movsx ecx, al
cmovbe cx, word [esp + eax - 0x3ffffffe]
pop eax
jbe fcn.017680db
call fcn.00e544a7
mov ebx, dword [ebp - 0x531b4e7e]
push ebp
or dh, byte [edx - 0x2a]
fild word [eax]
sar dword [edx + 0x50912cac], 0xdd
add eax, 0xf25bbd72
jbe 0x1866e7e
xor al, 0x83
cmpsd dword [esi], dword es:[edi]
mov al, byte [0x925ad451]
and dword [edi + 0x5ad451a0], 0xffffff92
js 0x1866e41
lodsd eax, dword [esi]
adc ebp, dword [ebx]
aaa
xchg ebx, eax
add esp, dword [ebx + 0x2ab62abb]
lodsd eax, dword [esi]
push ds
lahf
cmp eax, 0x36a76750
das
scasd eax, dword es:[edi]
mov ch, 0xaf
xchg esi, eax
outsd dx, dword [esi]
dec eax
mov ebp, 0x49e96c9c
lcall 0xc2ee, 0x94dbefea
fxsave [edx - 0xcecc0e2]
retf 0xd3ca
mov ah, 0x6c
xor edx, dword [esi - 0x48]
dec esp
or byte [edx], bl
adc byte [edi + 0x51], bl
in eax, dx
clc
jne 0x1866e5f
scasd eax, dword es:[edi]
and ah, al
sal byte [eax], cl
xor eax, 0x9a94d2e3
xchg esi, eax
clc
invalid
mov edx, edi
movzx eax, cl
neg cl
or ecx, ecx
lea edi, [ecx + edi - 0x78780002]
dec cl
setp al
mov dword [esp + ecx - 0x787800ff], eax
mov word [edi + eax - 1], dx
pop eax
jno fcn.019124b2
inc ax
sar cx, 0x2b
bswap edx
xor ebx, edx
add edi, edx
lea edx, [eax*8 - 0x6af5ace9]
sub dl, ah
push edx
pop eax
jg fcn.00d1cd32
push 0xf89d2507
mov ecx, dword [ebp]
add ebp, 4
jmp 0x18ac402
mov eax, 0x4ca4d6b3
xor ecx, ebx
movsx edx, ax
dec ecx
mov dword [esp + eax - 0x4ca4d6b3], eax
and dword [esp + eax - 0x4ca4d6b3], 0x2fada92c
jnp 0x19a6d82
jg 0x18ac431
mov edi, 0x868026cb
in eax, 0x61
jl 0x18ac4ad
xor ebx, dword [eax + 0x33]
shl dword [0x9faeca8a], cl
pop eax
xor edx, ebx
and eax, 0x9faeca8a
adc ax, 0x6faf
call fcn.019bb042
mov eax, dword [ebp]
mov edx, 0x8d168339
or edx, edx
adc ebp, 4
movsx ecx, dl
xor eax, ebx
sar ecx, cl
or cx, 0xc906
adc ecx, edx
not eax
rol cl, 6
push edx
jp 0xd7fea7
sub edi, ecx
xor ecx, 0xf21e5706
xor dx, 0xec3b
dec ecx
xor byte [esp + eax - 0x4ca4d6b1], dh
sal word [esp + eax - 0x4ca4d6b3], 0x81
shr word [esp + eax - 0x4ca4d6b1], 0x2f
rol ecx, 1
not edx
not ecx
xor ebx, ecx
sal eax, 0xde
neg edx
add edi, ecx
jmp 0x1866e04
Function at 0x18947da
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + edx]
inc ecx
push eax
dec esp
lea esi, [ecx + edx*2 + 0x563e849f]
inc esp
add edi, dword [eax + edx*2]
push eax
dec ebp
lea esp, [esp + edx*2 + 4]
inc ebp
mov dword [esp + edx], edi
inc ecx
push esi
dec esi
lea ebx, [esi + eax*8 - 0x27685972]
sar cx, cl
dec eax
mov dword [esp + edx*4], ebx
ret 0x28
call fcn.00e0306f
mov edx, dword [edi + ecx*2 - 0x11aa6612]
lea eax, [ecx + ecx + 0x2379916]
add ax, cx
shl eax, cl
mov ax, word [edi + ecx*2 - 0x11aa660e]
shr ecx, 0xb7
lea edi, [ecx + edi - 0xb]
or ecx, ecx
add ecx, 0xf00f829e
mov word [edx], ax
movsx edx, cx
lea eax, [ecx + edx*8 + 0x3412da26]
mov ecx, dword [ebp + eax - 0x241e724d]
call fcn.00ec0454
sub esp, dword [eax - 0x13376835]
jns 0x18947ab
sti
cmp byte [edi + 0x51], 0xa1
push ebx
dec ebp
pop ss
lcall 0xdebe, 0x85e2b457
add eax, 0xcb3e15e0
aas
jnp 0x18947d4
loop 0x18947bc
mov esi, 0x15e005de
retf
xor cl, bh
mov ah, 0x6c
add dl, byte [edi + 0x10dda15e]
mov bl, 0xaf
jle 0x1894835
xor dword [0xed2a7e0a], ebp
mov ah, 0x6b
invalid

Function at 0x18b7f28
Capabilities:
Execute syscall

Disassembly:
sal ecx, 0x6c
mov dword [esp], 0x51901e23
xor edx, ebx
pop ecx
dec ecx
rol edx, 1
dec edx
sal cx, 0x67
neg edx
bswap edx
push ecx

Function at 0x18cef7d
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp + ecx*2 - 2]
adc ecx, ecx
xchg edx, ecx
lea ebp, [ebp + ecx*2 - 0xc]
sub edx, edx
dec dx
sal cl, 0x46
xor eax, ebx
call fcn.00d03752
ror cl, 0xe3
mov word [esi + eax - 8], dx
movsx edx, al
neg eax
jle 0xcd43ab
mov al, 0xcd
adc eax, 0x78c141af
js 0xde6324
call 0xcd487963
loopne 0xde6384
jecxz 0xde632d
push ecx
mov eax, dword [0xccee13e2]
adc esi, dword [ebp + esi - 0x4e]
xor ecx, ebp
int 4
mov edx, 0x5e2ae633
int3
xor edi, dword [edi + ecx + 3]
dec esp
test byte [ebp - 0x73], ch
cld
dec edx
insb byte es:[edi], dx
sub byte [edx - 0xa], 0xa8
push cs
idiv edx
push 0x7a
xor dword [edx], eax
push 0x39
cdq
adc al, bl
retf
sbb ecx, 0x8021d303
sar dword [esp + 4], 4
adc edx, 0x97afeb2d
rol ecx, 1
bswap ecx
call fcn.00f615f9
jnp 0x184fa56
movzx eax, cl
xor edx, ebx
xor edx, 0xd7a1a032
xor ax, 0x66ad
inc edx
neg edx
sal al, 0x87
bswap eax
jp 0xcf3acf
xor edx, 0xe30af43d
xor cl, ch
inc ax
sbb edx, 0xcd2cfb09
call fcn.01961bf5
mov ecx, dword [esi + ecx - 0x6c1c5b85]
mov eax, 0x1f131e9d
xor eax, eax
bswap eax
movzx dx, byte [ecx + eax*4]
inc eax
shl al, 0xa3
mov ecx, eax
lea esi, [ecx + esi - 6]
jne 0xde633c
inc ecx
pop ebx
dec ecx
add ebx, 0xff6e9e56
inc ecx
jmp ebx
Function at 0x18f25d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0xd5c83d

Function at 0x190cb33
Capabilities:
Encode data using base64

Disassembly:
neg edx
lea eax, [eax + edx - 0x783e1fca]
lea ecx, [edx*2 - 0x285855c8]
not dx
neg eax
ror dl, 1
lea eax, [edx + eax - 0x6ad1485a]
mov dword [esp], 0xfc2a1891
bswap ecx
jo 0x1926066
mov ecx, dword [ebp]
add ebp, 4
xor ecx, ebx
mov eax, 0xb1fdd8d
lea ecx, [eax + ecx - 0x54d4efa1]
call fcn.018bb0a7
jmp 0x197eb69
mov eax, 0x2495ea23
mov dx, word [eax + ebp - 0x2495ea23]
mov cx, word [ebp + eax*2 - 0x492bd444]
lea ebp, [ebp + eax*2 - 0x492bd444]
inc al
sub al, ah
and dx, cx
movzx ecx, ax
call fcn.018b5e70
mov eax, 0x169bd3bc
mov ecx, eax
sal ecx, 0x74
mov ecx, dword [esi + eax*4 - 0x5a6f4ef0]
lea esi, [esi + eax - 0x169bd3b8]
xor ecx, ebx
movsx edx, ax
neg edx
xor ax, dx
neg ecx
rol al, 0xc2
setb dl
dec eax
bswap ecx
xor ecx, 0x99b39891
sar ax, 0x4a
adc eax, 0xbfa9868a
not ecx
dec dl
rol ecx, 1
shl dx, 4
lea edx, [eax + edx*2 + 0x3b840e37]
ror edx, 0x2a
xor ebx, ecx
or eax, 0xadbac387
sbb ax, dx
xchg dx, ax
adc edi, ecx
lea ecx, [edx + eax*4 - 0x75d2feec]
lea ecx, [eax*4 + 0x26b66295]
mov eax, dword [edx + ebp - 0x304454ca]
mov edx, dword [ebp + edx - 0x304454c6]
sal cx, 6
mov cl, byte [ecx + ebp - 0x26b46a38]
call fcn.0185874a

Function at 0x1914ee2
Capabilities:
Encode data using base64

Disassembly:
sar dl, 0x44
call fcn.01883157
mov edx, 0xaa3b1d0e
mov eax, dword [edi]
shl edx, 0xce
movzx ecx, dx
lea edi, [edi + ecx*2 - 0xfffc]
rol ecx, 0x41
shr ecx, 0xd7
ror cx, 0x6d
xor eax, ebx
push edx
sal cl, 0x67
call fcn.019e63a5
bswap eax
jle 0x197ea29
mov edx, 0x32155b15
neg eax
lea ecx, [edx + edx*4 + 0xe29e1a3]
neg ecx
xor ebx, eax
sal dl, 0x61
xor cl, cl
adc edi, eax
jmp 0xd33dea
xor ebx, ecx
add esi, ecx
sal eax, 0xf0
xor eax, 0xe0820190
mov ecx, dword [ebp + edx*8 - 0x1b0]
jno 0xe3fbb9
sub dl, 0x34
push eax
push eax
add al, 0xa4
xor dl, 0x3d
xor bl, dl
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
call fcn.01882d86
xor eax, eax
neg ecx
mov dword [esp + eax], edx
dec ecx
rol ecx, 1
pop eax
xchg edx, eax
ror eax, 0x81
bswap ecx
cmovno ax, dx
jno 0x18bc290
lea ebp, [edx + ebp - 0x32]
lea edx, [edx + 0x63058788]
xor ecx, ebx
lea ecx, [ecx + edx*2 - 0x6f5bc146]
bswap ecx
xor dl, 0x20
sbb ecx, 0xb121e1b1
ror eax, 0x73
rol ecx, 1
or dx, ax
xor ecx, 0xf199c520
neg dl
and dx, ax
xor ebx, ecx
call fcn.018b52fa

Function at 0x19242a3
Capabilities:
Encode data using xor

Disassembly:
not cl
xor eax, 0xd3994a0e
rol eax, 3
inc cl
je 0x18573f5
shr dx, cl
xor ebx, eax
add edi, eax
shl cl, cl
shr edx, 0xc5
mov dword [esp + edx - 0x632b380], ecx
movzx dx, byte [esi + edx - 0x632b380]
pop ecx
neg cl
mov cl, byte [esi + ecx*4 - 0x64f6]
mov eax, 0x5abbf1a3
jge 0x192629a
push 0xae1a3892
call fcn.017630ff
lea esi, [eax + esi - 0x5abbf1a1]
shr dl, cl
sar eax, 0xbb
or eax, eax
mov word [esi + eax - 0xb], dx
lea edx, [eax*2 + 0x648515a9]
xor edx, eax
jmp edi
Function at 0x1933bf9
Capabilities:
Encode data using base64

Disassembly:
inc cl
rol cl, 1
sal dx, 0x4b
mov dword [esp], edx
rol eax, 0x44
xor bl, cl
lea ecx, [esp + ecx + 4]
add dword [esp + eax*8 - 0x36b9e0], 0x68195e11
shl eax, 0x69
mov dx, word [ecx + eax*8 - 0x6d73c000]
not dword [esp + eax - 0xdae7800]
lea edi, [edi + eax*4 - 0x36b9e002]
movzx ecx, word [esp + eax - 0xdae7800]
mov word [edi + eax - 0xdae7800], dx
not byte [esp + eax*2 - 0x1b5cefff]
adc byte [esp + eax - 0xdae77fe], 0x33
pop eax
jg fcn.00de19a9
mov ecx, 0x7f9d5f1c
movzx eax, cx
jmp 0x1825e31

Function at 0x1939d05
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + edx*4 - 0x545dc8d3], edx
bswap edx
sub ax, 0x8b3
xor ecx, ecx
rol ax, 1
call fcn.00f310dd
syscall
push edi
dec eax
mov dword [esp], 0xe1974f33
call fcn.00d66479
mov word [esp + eax - 0x3a1dcc0c], 0x2b20
lea ecx, [ecx + eax*2 - 0xc85fe19]
neg ecx
mov dword [esp + eax - 0x3a1dcc16], eax
inc al
xor ebx, ecx
shr word [esp + eax - 0x3a1dcc0d], 0x45
adc edi, ecx
movzx eax, word [eax + esi - 0x3a1dcc17]
lea esi, [esi + edx - 0x15177235]
neg dword [esp + edx*4 - 0x545dc8d7]
lea ecx, [edx*8 + 0x6925cf10]
xor ax, bx
ror ecx, cl
ror ax, 1
jmp 0xecaab8

Function at 0x1953923
Capabilities:
Encode data using xor

Disassembly:
lea esi, [ecx + esi - 0x311ace7d]
push eax
xchg byte [esp + ecx*2 - 0x62359cfd], cl
movzx ecx, byte [ecx + ebp - 0x311ace00]
not al
add ebp, 1
shr al, 0x42
shl ax, 0xa9
sbb dword [esp], eax
xor cl, bl
shr byte [esp + 3], 5
or al, 7
not cl
push eax
ror cl, 1
inc cl
call fcn.018cbb7b
shl cl, cl
sbb eax, ecx
adc edi, edx
sal eax, 0xba
mov dx, word [ecx + esi - 0x311ace80]
dec ecx
sbb al, ch
jns 0xdc4562
jmp fcn.00d1cd32
add ebp, 4
mov eax, 0x311acea7
mov dword [esp + eax - 0x311acea7], eax
sal al, 0xa7
xor edx, ebx
pop ecx
rol edx, 1
shl eax, cl
neg edx
shl al, cl
je 0x1a0bf6c
bswap edx
lea edx, [edx + ecx - 0x54b2124c]
xor ebx, edx
jmp 0xf92344
Function at 0x195827e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jno 0x191678f
not ecx
lea edx, [edx - 0x555949d6]
rol ecx, 1
inc ecx
push eax
bswap ecx
call fcn.017337fa
call fcn.00d5f2bc
mov eax, 0x930884a3
sub ebp, 1
movzx edx, byte [ebp]
xor dl, bl
sub dl, 0xa5
jmp 0x18a2de5
push 0xc23c03a
dec ebx
lea esp, [esp + 4]
jne 0x18573c4
mov eax, dword [ebp]
push 0x2abb603c
lea esp, [esp + 4]
call eax
mov ecx, 0x900792a0
call fcn.01928f71
mov eax, 0x75b9dc94
rol eax, 0x7b
inc al
mov eax, dword [ebp + ebx*4]
js 0xf6e009
not eax
not dl
bswap eax
add eax, eax
sal eax, 0x9d
dec dl
rol eax, 0x51
mov ecx, eax
sal ecx, 0xd4
neg dl
sar cl, 0x61
rol cx, 0xcd
rol dl, 1
dec ax
sub dl, 0x34
jmp 0x18c9eae
js 0xfb8d5c
mov dword [esp + edx - 0x13829099], edx
mov dl, byte [esi + edx*4 - 0x4e0a4262]
lea esi, [esi + eax - 0x97]
push eax
add cl, dl
neg word [esp + eax - 0x95]
movsx edx, word [esp + eax*4 - 0x260]
mov word [esi + eax*2 - 0x132], cx
sbb dword [esp + eax*2 - 0x12e], edx
lea ebp, [ebp + eax*2 - 0x136]
neg al
mov ecx, dword [ebp + eax*2 - 0xce]
xor ecx, ebx
shl eax, 0x37
jns 0xdca9e2
call fcn.01915e75
lea edi, [edi + ecx - 0x55db86fe]
sub ecx, ecx
xor edx, ebx
xadd dword [esp + ecx*4], ecx
jbe 0xd5f2bf
adc dword [esp + ecx - 0xab], ecx
rol edx, 2
movzx eax, word [esp + ecx*8 - 0x558]
dec edx
xor edx, 0xd8a63b0a
ror edx, 3
call fcn.00dd7fcf
call fcn.019292cb
mov ecx, 0x57b1a389
push ecx
mov edx, dword [edi + ecx - 0x57b1a389]
dec cx
shl dword [esp + ecx - 0x57b1a388], 0x5c
lea edi, [edi + ecx - 0x57b1a384]
shl ecx, cl
sar cl, 0x44
xor edx, ebx
rol word [esp + 1], 0x47
call fcn.019272d3

Function at 0x1961bf5
Capabilities:
Encode data using base64

Disassembly:
push 0xf0974020
sub esi, 0xc
mov dword [esi + 0xc], eax
call fcn.00e2d16a
mov dword [esp + ecx - 0x378e81b5], eax
sub byte [esp + ecx - 0x378e81b4], 3
xor ebx, edx
sal word [esp + ecx - 0x378e81b5], 0xa5
add edi, edx
mov eax, dword [esi + ecx*2 - 0x6f1d036a]
mov dword [esp + ecx*2 - 0x6f1d036a], ebx
mov edx, ecx
movzx ebx, dx
inc ebx
cpuid
jno 0x1a15e86
jg 0xeaf0c5

Function at 0x196d871
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdeab32
inc cl
mov dword [esp + 4], edx
ror cl, 1
dec dl
call fcn.019343f3
lea ecx, [ecx + eax - 0x6fe03d73]
sar al, 0x24
inc dx
ror ecx, 1
call fcn.0191dda1
lea eax, [edx + eax - 0x5a637a67]
ror eax, 1
inc ecx
shl cx, 0xaf
sbb eax, 0xe1957e3f
xor cl, 0xab
xor ebx, eax
jmp 0xd5e1f5

Function at 0x19973a5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor al, bl
xor edx, edx
lea ecx, [edx*4 + 0x3d139f85]
seta cl
ror al, 1
inc al
sub edx, ecx
call fcn.00dc222e
mov ecx, 0x2e97001f
lea edi, [edi + ecx - 0x2e97001b]
not eax
not edx
ror ecx, 0x23
or eax, edx
and ecx, ecx
ja 0xdb507f
adc bh, 0x5c
invalid
call fcn.018df7aa
mov eax, 0xc0b4d723
movzx eax, byte [edi]
mov edx, 0x4317148b
lea edi, [edx + edi - 0x4317148a]
and edx, 0xb312a295
jp 0xd22b59
not eax
xadd word [esp + 1], cx
jg 0x197c5fb
mov edx, dword [esp + 4]
adc edx, 0xfffed289
jmp edx
Function at 0x19ca0df
Capabilities:
Hash data using murmur3

Disassembly:
rol ecx, 1
not ecx
lea ecx, [ecx + eax + 0x6f2efdbe]
xor ebx, ecx
add esi, ecx
lea ecx, [eax*2 - 0x24e9d0d6]
xor al, al
rol dword [esp + eax - 0xffffffc], 0xd
mov dword [esp + eax - 0x10000000], esi
ret 8
mov word [ecx + ebp - 0x2100ffff], dx
inc dword [esp + ecx*2 - 0x4201fffa]
mov dword [esp + ecx*2 - 0x4201fffe], ecx
push ecx
mov ecx, dword [edi + ecx - 0x2100ffff]
shr dword [esp + eax*2 - 0x3a], 0x98
shl eax, 0xbc
lea edi, [eax + edi - 0xffffffc]
or dword [esp + eax*8 - 0x7ffffffd], eax
lea edx, [eax - 0x19de27fd]
xor ecx, ebx
neg edx
sal ax, 0x4d
not ecx
je 0x1921016

Function at 0x19ddc33
Capabilities:
Encode data using xor

Disassembly:
add edi, ecx
or dword [esp], 0xf022c3ac
mov eax, dword [esi]
xadd byte [esp + 1], dl
sub word [esp + 1], dx
jnp 0xf84953
mov cl, byte [esi + 4]
add esi, 2
inc edx
dec dword [esp]
xor word [esp], 0x749c
sal eax, cl
push edx
movzx ecx, word [esp]
mov dword [esi + ecx*2 - 0x11fa0], eax
movzx eax, dl
call fcn.01932263
dec ecx
not ecx
push edx
lea ecx, [ecx + eax - 0x283aacaa]
xor ebx, ecx
jmp 0xd71b2f
mov eax, 0x16887ca8
lea esi, [esi + eax*4 - 0x5a21f2a4]
call fcn.00da1559
xor edx, ebx
jmp 0x1758f48
sub edx, 0x8a3ad39f
lea eax, [ecx + ecx*8 + 0x51daa13]
ror ecx, 0x3b
not edx
dec edx
sub ax, cx
jp 0x1923877
lea eax, [ecx*8 + 0x1973180]
mov dword [esp + edx - 0x22df], ebp
ret 4
sar eax, cl
rol edx, 2
call fcn.00f77246
mov eax, 0xf43b85a5
call fcn.019cddfc
and al, dh
jp 0x1910d1e
mov ecx, dword [ebp + edx*2 - 0x235bde5e]
sub eax, edx
xor ecx, ebx
sub eax, 0x29172e36
dec ecx
neg ecx
add dx, ax
jno 0x19e0e17
inc ecx
not bl
dec ecx
lea ecx, [esi + ebp*2 - 0x4cdcf669]
sal dl, 7
inc esp
movsx ecx, ch
inc ecx
inc bl
ror dl, 0x46
inc ebp
xor ch, bl
shl dx, 0x87
dec eax
lea edx, [ecx*2 + 0x5b352802]
mov esi, 0x98392634
dec esp
adc ebx, esp
inc ecx
xchg esi, ebp
dec ecx
and edx, 0x8ba0198c
inc cx
sub esi, 0x47666223
mov dword [ebx + edx*4 - 0xe006030], eax
call fcn.019db5dd
bswap edx
not ecx
add edx, eax
jp 0xe338a9
xor ecx, 0x60b1f6a5
movzx eax, dl
lea ecx, [ecx + eax*2 - 0x8910e19]
xor ecx, 0x50b5e7b5
xor ebx, ecx
dec al
je 0x1873132
mov dword [esp + eax - 0x1a], edx
add esi, ecx
mov dword [esp + eax*8 - 0x170], esi
ret 0x14

Function at 0x19e250d
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp]
push 0xee8d7921
push 0x2e5e8f
lea esp, [esp + 8]
call eax
mov esi, 0x3b22fe21
mov edx, 0xf51c2d09
mov ebp, dword [esi + ebp - 0x3b22fe25]
mov dword [ebp + esi*2 - 0x7645fc42], eax
movzx eax, dl
xor edx, edx
mov esi, ebp
mov ecx, eax
jae 0x1952a1f
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
push 0x63b5ec9b
lea esp, [esp + 0xc]
je 0xcd7417
mov eax, 0x5bba488
ror al, 0x83
sub eax, eax
adc eax, dword [ebp + ebx*4]
call fcn.00e67146
Function at 0x19e3508
Capabilities:
Encode data using xor

Disassembly:
dec ebx
jmp 0x19f5034
movsb byte es:[edi], byte [esi]
test byte [ebx], bl
scasb al, byte es:[edi]
mov dword [esp], 0x64bfd7a0
mov dword [esp], eax
jno 0xdc20b6
out 0xa, eax
arpl bp, bx
scasd eax, dword es:[edi]
and cl, bh
mov word [edx + 0x3215e00e], es
shr ebx, 1
pop ebp
mov bl, 0x85
movsd dword es:[edi], dword [esi]
jns 0x19e356f
push esi
xor edi, eax
jge 0x19e34be
inc esi
mov bl, 0x9d
daa
sub ebx, esi
sbb dword [eax + 0x7acdd4fb], 0xc90c340
mov byte [0xf9b34cd7], ah
mov dword [ebx + 0x24], ebx
and byte [ebx + 0x6c], dh
sub eax, 0x2dae4ddb
mov byte [0xc38cc451], al
dec esp
dec eax
and esi, dword [edx]
xchg ebx, eax
inc ebx
imul esi, dword [ebx - 0x165c80bc], 0x60
xor ebp, ecx
outsd dx, dword [esi]
and esi, dword [eax - 0x4d]
invalid
ljmp 0x16ba:0x8bcde253
call fcn.0183309a

Function at 0x19e6333
Capabilities:
Encode data using base64

Disassembly:
add ebp, 2
xor cx, bx
mov eax, 0xa2b46903
jmp 0x1a0953b
mov word [esi + edx*8 - 0x23218], cx
not edx
lea edx, [eax + edx*4 - 0x2df92b77]
xor edx, edx
mov eax, dword [edx + ebp]
lea ebp, [edx + ebp + 4]
neg byte [esp + edx*4]
xchg dh, dl
xor eax, ebx
rol eax, 2
dec eax
xchg dword [esp + edx*8], edx
not eax
push edx
lea edx, [edx + edx*8 - 0x6bcb6e70]
rol eax, 1
and byte [esp + edx - 0x7c79284f], dh
ror dword [esp + edx - 0x7c79284d], 0x6b
xor ebx, eax
mov ecx, edx
and byte [esp + ecx - 0x7c792849], dl
adc edi, eax
neg cl
pop ecx
pop eax
jne fcn.017680db
adc ebp, 4
push ecx
inc ecx
xor eax, ebx
ror eax, 3
neg eax
bswap eax
call fcn.017d53d4
mov ecx, 0x41a42b0
fld qword [esi + ecx*8 - 0x20d21580]
lea ebp, [ebp + ecx - 0x41a42b4]
lea eax, [ecx + 0x93263b]
bswap ecx
mov ecx, dword [ebp + eax*2 - 0x95ad1d6]
movsx edx, ax
call fcn.00e0a306
or dh, byte gs:[edx - 0x5d69ea22]
les edi, [eax + 0x67]
jnp 0x175769d
pop esp
call fcn.00e26ef0
push 0x6f241088
movzx ecx, word [ebp]
jmp 0xe6aba8
neg eax
xor ebx, eax
mov dword [esp + ecx - 0x5abad171], edx
and ecx, ecx
adc edi, eax
mov dl, byte [ecx + esi - 0x5abad171]
movzx ax, byte [ecx + esi - 0x5abad16f]
jmp 0x190f957
xor cx, 0x7383
dec word [esp]
movsx edx, word [esp]
ror cx, 1
inc dword [esp + edx - 0x1087]
shr dl, 1
add eax, edx
sbb cx, 0x53f
xchg dh, al
not cx
or edx, edx
xor bx, cx
sar eax, 0x7b
lea esi, [edx + esi - 0x4645]
sal byte [esp + edx*2 - 0x8c86], 0xa3
jns 0x17575ac
mov ecx, 0x8231e089
movsx edx, cx
mov eax, dword [esi]
sal cx, cl
add esi, 4
movzx edx, byte [ebp]
not ecx
lea ebp, [ebp + ecx - 0x7dceedfe]
not ecx
xor dl, bl
call fcn.00e5d1d5
mov eax, 0x5db9e52a
rol al, 0x85
mov ecx, 0xd63d0b32
mov cl, byte [esi + eax - 0x5db9e545]
lea edx, [eax + eax*2 + 0x1e8945bc]
movzx ax, byte [eax + esi - 0x5db9e543]
add edx, edx
lea esi, [esi + edx - 0x6f6deb14]
imul cl
movsx ecx, dx
sal edx, 0xc5
neg edx
mov word [esi + edx*4 - 0x490a7500], ax
ror cl, 0x67
mov edx, dword [edx + ebp - 0x12429d40]
adc ebp, 4
xor edx, ebx
mov eax, ecx
xor ecx, eax
not edx
dec edx
not edx
xadd ax, cx
xor edx, 0x14afbd29
xor ebx, edx
add edi, edx
shr cl, 0x84
jmp edi
Function at 0x19ff3e5
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov dword [esp], 0x38bebd05
mov dword [esp], eax
dec ebx
push 0x2ebe3b0a
not dword [esp]
not word [esp + 1]
lea esp, [esp + 4]
jne 0xcc01d9

Function at 0x1a058a9
Capabilities:
Encode data using base64

Disassembly:
call fcn.01985a68
jo 0x1a058b3
mov cl, 0xd9
adc eax, 0x4cec9589
jg 0x1a0592b
mov dword [ebp + 0x727f4cec], edx
pop esp
aas
lodsd eax, dword [esi]
mov edx, 0xba3d39b6
xor eax, ebx
inc eax
neg eax
lea ecx, [edx + edx + 0xcb7591f]
bswap eax
lea eax, [eax + ecx - 0x197c3278]
inc edx
neg eax
call fcn.017270c7
mov ecx, dword [esi + ecx*4 - 0x2e06c]
sar ax, 0xe6
call fcn.019be66c

Function at 0x1a0a6bd
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
inc edx
not dword [esp + edx + 0x429223]
dec eax
lea edx, [esp + edx + 0x18]
dec eax
dec esi
inc edx
shr byte [esp + edx + 0x42921f], 0x87
dec esi
mov ebx, dword [edx + edx + 0x42920f]
dec ecx
xor eax, ecx
dec edi
lea esp, [esp + edx*2 + 0x852416]
inc dx
neg dword [esp + edx + 0x429213]
jb 0x17a6876
rol ecx, cl
adc ebp, eax
or dx, cx
fstp qword [esi + ecx*4 + 0x5d0d9450]
jmp ebp
dec edi
mov dword [esp + edx + 0x42920f], ebx
call fcn.017780c9
push 0xacafac2b
mov ecx, 0x6a30fba7
shr cl, cl
mov eax, dword [ecx + edi - 0x6a30fb01]
mov edx, ecx
rol cl, 0x27
lea edi, [edi + edx - 0x6a30fafd]
add byte [esp + ecx - 0x6a30fb7d], cl
xor eax, ebx
lea edx, [edx + edx*8 + 0x3b2ba900]
inc eax
rol eax, 1
and dword [esp + ecx - 0x6a30fb80], ecx
sbb ecx, dword [esp + ecx - 0x6a30fb80]
lea eax, [eax + ecx*4 - 0x2dbce544]
pop ecx
cmovp ecx, edx
sal cl, 0x41
xor eax, 0x24349d39
not dl
or ecx, 0x2706933a
xor ebx, eax
jmp 0xeb2a17
xadd dword [esp + eax - 7], eax
xor ebx, edx
add esi, edx
neg ecx
movsx edx, al
mov dword [esp + ecx*2 - 0x60c8e880], esi
ret 8
bswap eax
or cx, 0x769d
call fcn.00f6a123
inc al
xor bl, al
add dword [esp + 4], 0x498cc516
lea eax, [esp + eax + 8]
movzx cx, byte [eax]
movzx eax, word [esp + 4]
jge 0xf9c39c
mov ecx, 0xde38cc88
shr cl, 0x24
lea edx, [ecx + ecx - 0x18cb776b]
mov dl, byte [ebp]
sbb ecx, ecx
movzx ax, byte [ebp + 2]
rol cx, 0x61
sub cl, ch
rol ecx, 0x82
add ebp, 2
not cx
not cx
rol cx, cl
imul dl
mov word [ebp], ax
sal cx, 6
push ecx
push ecx
sbb edi, 4
mov edx, dword [edi]
movsx eax, cl
push eax
xor edx, ebx
pop ecx
and al, ch
or byte [esp + 7], 0xb7
xor edx, 0xa594a704
sar ax, 0xe2
sbb edx, 0x439d2713
ror dword [esp + 4], 0x52
shr eax, 0x1c
and ax, ax
ror edx, 1
add ecx, 0xcf9b8c00
push eax
not edx
jp 0x189b131
xor dl, 0x1b
inc ecx
ror edi, 0xf5
dec esi
mov dword [esp + edx + 0x42920f], ecx
inc esp
xor ch, dl
jmp 0xea54f4
Function at 0x1a124c6
Capabilities:
Encode data using base64

Disassembly:
rol edx, 2
sal ax, 0x6f
call fcn.019bba4e
shl al, 0x41
adc esi, edx
sar dword [esp + ecx - 0x40d7bff], 0xe6
movsx edx, cx
movzx dx, byte [edi + ecx*4 - 0x1035f004]
mov cl, byte [edi + ecx*8 - 0x206be006]
or dword [esp + 4], eax
shl eax, 0xf2
lea edi, [edi + eax - 0x5057fffe]
add dl, cl
mov word [edi + eax - 0x50580000], dx
mov dword [esp + eax - 0x50580000], esi
ret 4
lea ebp, [ebp + ecx - 0x428c1a33]
mov edx, dword [ebp + ecx - 0x428c1a2f]
rol cl, 0xc4
mov dword [esp + ecx - 0x428c1af2], ecx
jb 0xf6ecf9
xor edx, ebx
ror cx, 0xa7
dec edx
movzx eax, word [esp + ecx - 0x428ce435]
neg edx
ror word [esp + eax - 0x1af1], 0xca
sar word [esp + ecx - 0x428ce435], 5
inc edx
bswap edx
shr ax, 0xcb
rol ecx, cl
dec cx
xor edx, 0x38bbf612
push ecx
jmp 0xd467a6

Function at 0x1a1886b
Capabilities:
Encode data using xor

Disassembly:
rol edx, 2
neg ecx
xor edx, 0x24b66498
ror eax, cl
inc edx
not edx
rol edx, 1
sub cl, ch
rol eax, 0x2c
neg edx
xor ebx, edx
add esi, edx
mov edx, 0xcd10c89a
not ecx
jmp esi
neg edx
pop eax
sal cl, 0xc3
bswap edx
lea eax, [ecx + ecx - 0x40cfc7dc]
shr ecx, 8
sub edx, 0xa982f106
xadd ax, cx
or al, ah
js 0x19c4b54

Function at 0x1a1db7e
Capabilities:
Encode data using xor

Disassembly:
inc ecx
movzx eax, dl
inc ecx
shl edi, 0x53
not edx
call fcn.00d19ddb
neg edx
jmp 0x1796290
or cx, dx
call fcn.017cd103
mov eax, ecx
dec edx
or ecx, eax
xor ebx, edx
shr ecx, 0x90
lea eax, [ecx + eax*8 - 0x745205f9]
xor eax, ecx
adc esi, edx
call fcn.00e152a8
fcmovb st(0), st(1)
jmp 0xc3266923
dec esp
lea edi, [esi*2 + 0x4cbc7c94]
inc edx
mov edx, dword [edi + esi*2 - 0x8668]
dec ecx
or ecx, 0x2d06b810
inc ebp
movzx eax, dx
inc ecx
push edx
dec ecx
lea edi, [esi + edi - 0x4330]
inc edx
ror dword [esp + esi*2 - 0x8664], 0x3f
inc ecx
xor edx, ebp
inc ecx
pop ecx
xor edx, 0xb69142b8
add bp, bp
sar esi, 0xab
ja 0x19f09e2
sbb ebp, dword [eax]
stc
mov word [edx - 0x7c325a0b], ds
pop ds
ja 0x1a1dc27
mov edi, 0x77c45ecd
dec ecx
xor bh, cl
xchg ebp, eax
mov esp, 0x1e04cd1c
ror byte [esi], cl
int 0xf8
loope 0x1a1db8c
int 0x11
dec ebp
ret 0x8ad7
push ecx
invalid