joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007da24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x10087dc0
call fcn.10083e33
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.PK_page3.0
lea ecx, [esi + 0x1428]
mov dword [ebp - 4], 0x24
call fcn.100019be
lea ecx, [esi + 0x1398]
mov byte [ebp - 4], 0x23
call fcn.10001272
lea ecx, [esi + 0x130c]
mov byte [ebp - 4], 0x22
call fcn.10001272
lea ecx, [esi + 0x1280]
mov byte [ebp - 4], 0x21
call fcn.10001272
lea ecx, [esi + 0x120c]
mov byte [ebp - 4], 0x20
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1198]
mov byte [ebp - 4], 0x1f
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1124]
mov byte [ebp - 4], 0x1e
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x10b0]
mov byte [ebp - 4], 0x1d
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x103c]
mov byte [ebp - 4], 0x1c
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xfc8]
mov byte [ebp - 4], 0x1b
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xf54]
mov byte [ebp - 4], 0x1a
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xee0]
mov byte [ebp - 4], 0x19
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xe6c]
mov byte [ebp - 4], 0x18
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xdf8]
mov byte [ebp - 4], 0x17
call sub.mfc100.dll_Ordinal_915
mov byte [ebp - 4], 0x16
lea ecx, [esi + 0xd84]
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xd10]
mov byte [ebp - 4], 0x15
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xc9c]
mov byte [ebp - 4], 0x14
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xc28]
mov byte [ebp - 4], 0x13
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xbb4]
mov byte [ebp - 4], 0x12
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xaf8]
mov byte [ebp - 4], 0x11
call fcn.100019be
lea ecx, [esi + 0xa4c]
mov byte [ebp - 4], 0x10
call fcn.100019be
lea ecx, [esi + 0x9a0]
mov byte [ebp - 4], 0xf
call fcn.100019be
lea ecx, [esi + 0x8f4]
mov byte [ebp - 4], 0xe
call fcn.100019be
lea ecx, [esi + 0x868]
mov byte [ebp - 4], 0xd
call fcn.10001272
lea ecx, [esi + 0x7dc]
mov byte [ebp - 4], 0xc
call fcn.10001272
lea ecx, [esi + 0x750]
mov byte [ebp - 4], 0xb
call fcn.10001272
lea ecx, [esi + 0x6c4]
mov byte [ebp - 4], 0xa
call fcn.10001272
lea ecx, [esi + 0x638]
mov byte [ebp - 4], 9
call fcn.10001272
lea ecx, [esi + 0x5ac]
mov byte [ebp - 4], 8
call fcn.10001272
lea ecx, [esi + 0x520]
mov byte [ebp - 4], 7
call fcn.10001272
lea ecx, [esi + 0x494]
mov byte [ebp - 4], 6
call fcn.10001272
lea ecx, [esi + 0x408]
mov byte [ebp - 4], 5
call fcn.10001272
lea ecx, [esi + 0x37c]
mov byte [ebp - 4], 4
call fcn.10001272
lea ecx, [esi + 0x2ac]
mov byte [ebp - 4], 3
call fcn.100019be
lea ecx, [esi + 0x1d0]
mov byte [ebp - 4], 2
call fcn.100019be
lea ecx, [esi + 0x140]
mov byte [ebp - 4], 1
call sub.mfc100.dll_Ordinal_1011
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 0
call fcn.100019be
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call sub.mfc100.dll_Ordinal_946
call fcn.10083f0b
ret
Function at 0x1007f5a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x10087fdb
call fcn.10083e33
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.PK_page4.0
lea ecx, [esi + 0x1374]
mov dword [ebp - 4], 0x24
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x12fc]
mov byte [ebp - 4], 0x23
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1288]
mov byte [ebp - 4], 0x22
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1214]
mov byte [ebp - 4], 0x21
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x11a0]
mov byte [ebp - 4], 0x20
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x112c]
mov byte [ebp - 4], 0x1f
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x10b8]
mov byte [ebp - 4], 0x1e
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1044]
mov byte [ebp - 4], 0x1d
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xfd0]
mov byte [ebp - 4], 0x1c
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xf5c]
mov byte [ebp - 4], 0x1b
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xee8]
mov byte [ebp - 4], 0x1a
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xe74]
mov byte [ebp - 4], 0x19
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xe00]
mov byte [ebp - 4], 0x18
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xd8c]
mov byte [ebp - 4], 0x17
call sub.mfc100.dll_Ordinal_915
mov byte [ebp - 4], 0x16
lea ecx, [esi + 0xd18]
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xca4]
mov byte [ebp - 4], 0x15
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xc30]
mov byte [ebp - 4], 0x14
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xbbc]
mov byte [ebp - 4], 0x13
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xb48]
mov byte [ebp - 4], 0x12
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xad4]
mov byte [ebp - 4], 0x11
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xa60]
mov byte [ebp - 4], 0x10
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x9ec]
mov byte [ebp - 4], 0xf
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x978]
mov byte [ebp - 4], 0xe
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x8a8]
mov byte [ebp - 4], 0xd
call fcn.100019be
lea ecx, [esi + 0x7fc]
mov byte [ebp - 4], 0xc
call fcn.100019be
lea ecx, [esi + 0x750]
mov byte [ebp - 4], 0xb
call fcn.100019be
lea ecx, [esi + 0x6c4]
mov byte [ebp - 4], 0xa
call fcn.10001272
lea ecx, [esi + 0x638]
mov byte [ebp - 4], 9
call fcn.10001272
lea ecx, [esi + 0x5ac]
mov byte [ebp - 4], 8
call fcn.10001272
lea ecx, [esi + 0x520]
mov byte [ebp - 4], 7
call fcn.10001272
lea ecx, [esi + 0x494]
mov byte [ebp - 4], 6
call fcn.10001272
lea ecx, [esi + 0x408]
mov byte [ebp - 4], 5
call fcn.10001272
lea ecx, [esi + 0x37c]
mov byte [ebp - 4], 4
call fcn.10001272
lea ecx, [esi + 0x2f0]
mov byte [ebp - 4], 3
call fcn.10001272
lea ecx, [esi + 0x228]
mov byte [ebp - 4], 2
call fcn.100019be
lea ecx, [esi + 0x17c]
mov byte [ebp - 4], 1
call fcn.100019be
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 0
call fcn.100019be
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call sub.mfc100.dll_Ordinal_946
call fcn.10083f0b
ret
Function at 0x10080f63
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x100881e8
call fcn.10083e33
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push 0x1b8c
call sub.mfc100.dll_Ordinal_381
xor eax, eax
lea ecx, [esi + 0xdc]
mov dword [ebp - 4], eax
mov dword [esi], vtable.PK_page5.0
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], eax
mov dword [esi + 0xd8], eax
call fcn.10001587
lea ecx, [esi + 0x168]
mov byte [ebp - 4], 1
call fcn.10001587
lea ecx, [esi + 0x1f4]
mov byte [ebp - 4], 2
call fcn.10001587
lea ecx, [esi + 0x280]
mov byte [ebp - 4], 3
call fcn.10001587
lea ecx, [esi + 0x30c]
mov byte [ebp - 4], 4
call fcn.10001587
lea ecx, [esi + 0x398]
mov byte [ebp - 4], 5
call fcn.10001587
lea ecx, [esi + 0x424]
mov byte [ebp - 4], 6
call fcn.10001587
lea ecx, [esi + 0x4b0]
mov byte [ebp - 4], 7
call fcn.10001587
lea ecx, [esi + 0x53c]
mov byte [ebp - 4], 8
call fcn.10001587
lea ecx, [esi + 0x5c8]
mov byte [ebp - 4], 9
call fcn.10001587
lea ecx, [esi + 0x654]
mov byte [ebp - 4], 0xa
call fcn.10001587
lea ecx, [esi + 0x6e0]
mov byte [ebp - 4], 0xb
call fcn.10001587
lea ecx, [esi + 0x76c]
mov byte [ebp - 4], 0xc
call fcn.10001587
lea ecx, [esi + 0x7f8]
mov byte [ebp - 4], 0xd
call fcn.10001587
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x884]
call fcn.10001587
lea ecx, [esi + 0x910]
mov byte [ebp - 4], 0xf
call fcn.10001587
lea ecx, [esi + 0x99c]
mov byte [ebp - 4], 0x10
call fcn.10001587
lea ecx, [esi + 0xa28]
mov byte [ebp - 4], 0x11
call fcn.10001587
lea ecx, [esi + 0xab4]
mov byte [ebp - 4], 0x12
call fcn.10001ad6
lea ecx, [esi + 0xb60]
mov byte [ebp - 4], 0x13
call fcn.10001ad6
lea ecx, [esi + 0xc0c]
mov byte [ebp - 4], 0x14
call fcn.10001ad6
lea ecx, [esi + 0xcb8]
mov byte [ebp - 4], 0x15
call fcn.10001ad6
lea ecx, [esi + 0xd64]
mov byte [ebp - 4], 0x16
call fcn.10001ad6
lea ecx, [esi + 0xe10]
mov byte [ebp - 4], 0x17
call fcn.10001ad6
lea ecx, [esi + 0xebc]
mov byte [ebp - 4], 0x18
call fcn.10001ad6
lea ecx, [esi + 0xf68]
mov byte [ebp - 4], 0x19
call fcn.10001ad6
lea ecx, [esi + 0x1014]
mov byte [ebp - 4], 0x1a
call fcn.10001ad6
lea ecx, [esi + 0x10c0]
mov byte [ebp - 4], 0x1b
call fcn.10001ad6
lea ecx, [esi + 0x116c]
mov byte [ebp - 4], 0x1c
call fcn.10001ad6
lea ecx, [esi + 0x1218]
mov byte [ebp - 4], 0x1d
call fcn.10001ad6
lea ecx, [esi + 0x12c4]
mov byte [ebp - 4], 0x1e
call fcn.10001ad6
lea ecx, [esi + 0x1370]
mov byte [ebp - 4], 0x1f
call fcn.10001ad6
lea ecx, [esi + 0x141c]
mov byte [ebp - 4], 0x20
call fcn.10001ad6
lea ecx, [esi + 0x14c8]
mov byte [ebp - 4], 0x21
call fcn.10001ad6
mov byte [ebp - 4], 0x22
lea ecx, [esi + 0x1574]
call fcn.10001ad6
lea ecx, [esi + 0x1620]
mov byte [ebp - 4], 0x23
call fcn.10001ad6
mov eax, esi
call fcn.10083f0b
ret 4
Function at 0x10083e24
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a69a0]
jne 0x10083e2e
repz ret
jmp fcn.10084702

Function at 0x103f2e7c
Capabilities:
Encode data using base64

Disassembly:
sal cl, 0xc5
bswap edx
bswap ecx
push ecx
mov dword [esp + ecx - 0xfc439a], ecx
adc edx, 0x8a89e597
ror edx, 1
jmp 0x103fabea
neg dword [esp + ecx - 0xfc4396]
xor ebx, edx
jmp 0x104611e2

Function at 0x103f4252
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xb0009f
mov eax, dword [esi]
add esi, 4
xor eax, ebx
dec eax
jmp 0x1050de07
add edx, 0x3f2960b7
xor ebx, eax
and edx, edx
shl edx, cl
ror eax, 2
mov edx, 0x2f3f179e
neg eax
movzx ecx, word [esp + edx - 0x2f3f179e]
shr ecx, cl
sub ecx, 0x8711c9a4
inc eax
or word [esp + edx - 0x2f3f179d], cx
jne 0x1040331a
add ebp, 2
mov word [ebp], dx
mov eax, dword [edi]
add edi, 4
or ecx, dword [esp]
xor eax, ebx
bswap eax
dec eax
not eax
lea eax, [eax + ecx - 0xb3e8e83]
xor ebx, eax
mov edx, ecx
inc ecx
ror edx, 0xfa
adc esi, eax
movzx eax, dl
push ecx
call fcn.10514298
jmp 0x10443c53

Function at 0x103f8609
Capabilities:
Encode data using base64

Disassembly:
add esi, 1
mov eax, 0x901e1af
xor dl, bl
mov dword [esp + eax - 0x901e1af], 0x94ba4109
add dl, 0x3d
neg byte [esp + eax*2 - 0x1203c35e]
jne 0x1049b23b

Function at 0x103f8a1f
Capabilities:
Encode data using base64

Disassembly:
ror ecx, 0xe9
mov cl, byte [eax + edi - 0x4c1e1322]
lea edi, [edi + eax - 0x4c1e1322]
xor al, 0x36
shr dx, cl
call fcn.104bc088
jmp 0x104be2f4
lea eax, [edx + eax + 0x6a745c58]
call fcn.10402efc
add dl, dh
bswap edx
rol eax, 3
dec ecx
jno 0x10416ba9
mov cx, word [edi]
mov ax, word [edi + 2]
add edi, 2
add cx, ax
mov edx, 0x3e1d528e
mov word [edi + edx - 0x3e1d528e], cx
push edx
mov eax, dword [esi + edx*2 - 0x7c3aa51c]
and dword [esp + edx - 0x3e1d528e], 0x2390ae1f
lea esi, [edx + esi - 0x3e1d528a]
xor eax, ebx
ror dl, 0x82
lea eax, [eax + edx*2 + 0x1855b142]
sub dword [esp + edx*2 - 0x7c3aa546], edx
xor eax, 0xbf13c787
movzx ecx, byte [esp + edx*2 - 0x7c3aa546]
push edx
sar dx, cl
inc eax
xor eax, 0x7d9d0805
xchg byte [esp + edx - 0x3e1d0007], dh
sar ecx, 0x8f
ror cl, 0xa3
neg eax
jmp 0x104b939f
Function at 0x10400e8f
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esi]
mov dword [esp], 0xb0355d2e
xor eax, ebx
mov edx, dword [esp]
movzx ecx, dx
xor eax, 0x8eacb4a7
call fcn.10465389
mov edx, 0xa4984fb0
movzx ecx, byte [edi]
mov eax, edx
rol dl, 0x27
call fcn.103ef8f7
mov eax, 0x672b7a0c
movsx ecx, al
sal cx, 0x6c
mov dx, word [ebp + eax - 0x672b7a0c]
adc cl, cl
setns al
shl ecx, 0xcd
add cx, word [ebp + eax - 0x672b79ff]
ror eax, 0x64
lea ebp, [ebp + eax - 0x1672b79e]
inc ax
not eax
adc al, 0x88
not dx
or eax, eax
not cx
jge 0x10511b8d
jl 0x104d7125
mov edx, dword [esi]
add esi, 4
mov ecx, 0xa900b484
mov eax, 0xe211878a
xor edx, ebx
shl cl, cl
sbb eax, ecx
dec ax
bswap edx
inc edx
and eax, 0x50947c8b
setnp al
ror cx, 0x82
xor edx, 0xa43ca223
lea ecx, [ecx*2 - 0x31fb69d8]
not eax
jmp 0x1048e03f
shl eax, 0xc3
jne 0x1050628a
call fcn.10507f84
call fcn.1052f6b7
ror edx, 2
bswap edx
sal cx, 0xa4
lea edx, [edx + ecx*8 - 0x1415547f]
and al, 0x8f
not eax
bswap edx
lea ecx, [eax*4 - 0x74715d7c]
xor ebx, edx
add eax, 0xcb982ba7
jo 0x1045bf67
sal cl, cl
adc ebp, edx
or al, 0xb6
mov ecx, dword [esi]
jno 0x1043e1c4
and dx, cx
mov word [ebp], dx
movsx ecx, al
mov eax, dword [edi]
movzx edx, cl
and ecx, edx
sal edx, 0xf1
lea edi, [edi + ecx*8 - 0x72c]
jns 0x1052bed0
call fcn.10405832
adc esi, 4
mov edx, eax
xor ecx, ebx
not eax
neg edx
dec ecx
and dl, al
adc eax, 0x1533e0a0
adc eax, edx
not ecx
sal eax, 0x91
lea ecx, [edx + ecx - 0x1cbb7830]
sub dx, dx
not edx
rol ecx, 1
push eax
xor ebx, ecx
call fcn.104f0f05
sal cl, 0x83
xor ebx, eax
call fcn.104cd81e
jmp 0x10456a29
not ecx
neg ecx
xor eax, ebx
push edx
pop ecx
neg eax
and edx, 0xf8a9b8b0
add cx, 0x62a1
sar ecx, 0x28
not eax
bswap eax
xor eax, 0x92195a8d
not ecx
jmp 0x10527296

Function at 0x10401015
Capabilities:
Encode data using xor

Disassembly:
mov esp, ebp
popfd
pop edx
pop edi
mov ebx, 0x6a9c25aa
pop eax
pop esi
call fcn.1049a67d

Function at 0x104172e2
Capabilities:
Encode data using base64

Disassembly:
sub esi, 1
rol dx, 0xc3
xadd edx, eax
movzx eax, byte [esi]
xor al, bl
rol al, 1
mov dword [esp], edx
movsx ecx, word [esp + 0x17]
neg al
add edx, 0xbac883b
sbb al, 0x86
mov dword [esp + 8], edx
shr dl, 0x87
ror al, 1
and dword [esp + 5], 0x28004583
not dword [esp + 7]
neg dl
sub al, 1
xchg word [esp + 5], dx
ror dl, 0x23
xor bl, al
jmp 0x104dd1a0
push edx
rol byte [esp + 0x19], 0x87
lea eax, [esp + eax + 0x20]
dec cx
xor edx, 0x838f3813
rol dx, cl
mov cx, word [eax + edx*2 - 0x714b19ea]
sar dl, 6
add dword [esp + edx - 0x38a58cff], 0xcf2c388c
dec dword [esp + edx - 0x38a58cf2]
lea edi, [edi + edx - 0x38a58d01]
mov word [edi + edx - 0x38a58cff], cx
movsx eax, dx
pop ecx
pop eax
pop edx
pop ecx
pop edx
pop eax
pop ecx
pop ecx
jne fcn.1045b2b6
shl word [esp + 5], 0xe
dec ecx
mov dword [esp], edx
xadd dword [esp + 5], edx
sete byte [esp + 5]
bswap ecx
sete byte [esp + 8]
xor ebx, ecx
inc word [esp + 0xa]
inc word [esp]
jl fcn.100036b1
add esi, ecx
pop ecx
pop ecx
pop ecx
jmp fcn.1052f2c2
Function at 0x1041b6cb
Capabilities:
Encode data using base64

Disassembly:
xor al, 0x22
mov dword [esp + ecx], ecx
jmp 0x1049546f
xor bl, al
lea edi, [edi + ecx*4 - 2]
mov word [edi + ecx*8], ax
neg byte [esp + ecx*8 + 7]
mov eax, dword [esi + ecx*2]
lea esi, [ecx + esi + 4]
sets dl
call fcn.1040b1e7

Function at 0x10428ee6
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov dword [esp + ecx - 0x177beff1], 0x101ede37
neg dl
and dword [esp + ecx*4 - 0x5defbfc3], 0x643f798a
rol dl, 1
dec ecx
add al, al
sub ecx, 0x660a6f92
sub dl, 0x33
sal dword [esp + eax*2 - 0x2000003], 0x5a
neg dl
ror dl, 1
call int.104f2f2c
pop eax
mov dword [esp + 4], 0x483c2f2d
xor edx, ebx
inc edx
bswap edx
mov eax, dword [esp + 3]
lea edx, [edx + eax - 0x4a3ae160]
shr word [esp + eax - 0x3c2f2d2b], 0x61
call fcn.10472e2b

Function at 0x10437ff8
Capabilities:
Encode data using xor

Disassembly:
adc al, 7
or dh, byte [esi - 0x68]
movzx cx, byte ss:[ecx + edx - 0x325bda2]
add esi, 2
mov word [esi], cx
push 0xa3b15c0b
sub ebp, 4
mov ecx, 0x7c8ccf27
movzx eax, cl
mov eax, dword [ebp + eax*2 - 0x4e]
sub cl, ch
mov edx, 0x2ebbe200
or dword [esp + edx*2 - 0x5d77c400], ecx
xor eax, ebx
xor edx, 0x62218698
lea eax, [ecx + eax - 0x13f81cad]
call fcn.1047f3ab
idiv dh
inc eax
sub al, 0x64
add al, 0xf1
inc edi
lodsb al, byte [esi]
pop edi
movsd dword es:[edi], dword [esi]
mov ch, 0xb4
push ebx
xchg ebp, eax
mov cl, 0xdb
mov edi, 0x7f6cce53
dec edi
lodsb al, byte [esi]
je 0x10437fee
or cl, byte [eax - 0x54]
invalid

Function at 0x1043cb64
Capabilities:
Encode data using base64

Disassembly:
mov dword ss:[eax + edx - 0x1ffff], ecx
call fcn.1050a9c5
rol ecx, 0x54
xor edx, 0x8402c50d
movzx eax, cx
mov byte [esp + eax - 0x9bda], cl
inc edx
add word [esp + eax - 0x9bd9], 0xd73c
xor ebx, edx
add edi, edx
pop ecx
pop ecx
pop eax
jmp fcn.10511f38

Function at 0x1043f5f2
Capabilities:
Encode data using base64

Disassembly:
shl edx, 0xb9
add esi, 4
pop eax
xor ecx, ebx
movsx eax, dx
ror eax, 0x2f
call fcn.1052f9be

Function at 0x1045628f
Capabilities:
Encode data using base64

Disassembly:
movsx edx, al
mov eax, dword [edx + esi - 0x1b]
mov dword [esp + edx - 0x1b], 0x3698d7a3
sub cl, dl
lea esi, [esi + edx*8 - 0xd4]
call fcn.1046e0b3

Function at 0x10457a17
Capabilities:
Encode data using base64

Disassembly:
pop ecx
shr edx, 0x81
lea eax, [eax + edx*4 - 0x5f95d954]
push edx
jbe 0x104a6d6c
mov ecx, 0xc381799a
movsx eax, cl
movzx ecx, byte [edi]
add edi, 1
movsx edx, al
sal eax, 0x2b
xor cl, bl
ror edx, 0x3c
call fcn.10445d0b
sbb dword [esp + edx - 0x530944f5], 0x14a64808
xor eax, 0xb097fe21
sar dword [esp + edx - 0x530944f5], 0xa8
movsx ecx, dl
not eax
inc eax
shr byte [esp + edx - 0x530944f2], 0x61
ror dx, 1
dec edx
xor ebx, eax
mov byte [esp + edx - 0x5309a277], 0x3a
not byte [esp + edx - 0x5309a276]
Function at 0x104594f9
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx*4], edx
neg eax
neg dword [esp + edx*2]
neg dx
inc dl
lea eax, [edx + eax - 0xc1ef685]
and dx, word [esp + edx]
sbb ecx, 0x270cdf1b
sal dword [esp + edx], 0xbe
neg eax
shl ecx, 0xb5
shl ecx, 0x9d
sal ecx, 0x72
ror eax, 1
sub dl, cl
xor ebx, eax
ror ecx, 0x16
jae 0x10502531
xor ecx, ebx
neg edx
call fcn.10429221
mov eax, 0xb61b0231
mov ecx, dword [edi]
movsx edx, ax
bswap edx
and dx, 0x482f
lea edi, [edi + edx - 0x3101fffc]
ror al, 0x85
xor ecx, ebx
sar al, 0x65
inc al
neg edx
dec ecx
neg eax
sub edx, edx
sar edx, 0x1f
xor ecx, 0x18ed22
add edx, 0xcc3b8b93
sar edx, 0xd0
dec dl
not ecx
call fcn.10403389
dec dword [esp]
inc ax
inc ecx
call fcn.1041f135
mov eax, 0xa937e832
mov edx, dword [ebp]
mov ecx, eax
shl eax, 0x55
mov esi, 0xe4165a13
lea ebp, [ebp + eax - 0x63ffffc]
mov esi, edx
mov edx, eax
push eax
sbb ax, 0xed05
pop eax
jge 0x1043092b
xor eax, 0x72a30db0
movzx ecx, dl
ror eax, cl
xchg dx, cx
add ecx, 0x2cbb902b
xadd dl, ch
xor ebx, eax
dec ecx
jo 0x1045dfe7
call fcn.104f8129
mov dword [esp + eax*2 - 2], ebp
ret 4
call fcn.10420f8b
adc dx, dx
lea esi, [esi + edx*2 - 0x21241e14]
xor eax, ebx
rol dx, 0xaa
ror eax, 3
pop edx
dec eax
jmp 0x1046c061

Function at 0x1045e175
Capabilities:
Encode data using xor

Disassembly:
bswap eax
inc eax
mov dword [esp + ecx - 0xb0b00fe], 0x8712a10d
ror eax, 2
xor ebx, eax
lea edx, [edx + ecx*8 + 0x3617ff31]
sar dx, 0x43

Function at 0x1046ab68
Capabilities:
Encode data using base64

Disassembly:
push edi
mov edi, 0xb11de8b5
lea edi, [edi*4 + 0x3c0d3792]
push ebp
movzx ebp, di
push esi
lea ebp, [ebp + edi*8 - 0xd5a4bd6]
bswap ebp
pushfd
inc edi
ror ebp, 0xb7
mov esi, dword [esp + edi*2 - 0x109b4ba]
or bp, bp
xchg ebp, edi
neg esi
not ebp
lea esi, [esi + edi + 0x38101d8f]
shr di, 0x46
lea edi, [ebp*2 - 0x7c4defd4]
xor esi, 0xbc9c4e13
or di, di
adc ebp, 0xdaa6d410
not esi
jle 0x104fb257
xor edx, ebx
mov eax, ecx
not ax
xor edx, 0xca4e1ab
sar cx, cl
xchg ch, al
bswap edx
lea ecx, [ecx + eax*2 + 0x7905f305]
lea eax, [ecx + eax*2 - 0x3e69887b]
dec ax
lea edx, [edx + ecx*2 - 0x597a4d5f]
sub cl, ah
jge 0x1049e5fc
mov eax, 0xe3966c11
movzx ecx, al
mov cl, byte [ecx + esi - 0x11]
mov dl, byte [esi + 2]
lea eax, [eax - 0xdcd9c43]
add esi, 2
add eax, eax
jp 0x104ca971
shr ebp, 0x4f
shr bp, 0xa7
push eax
mov eax, 0
push ecx
xadd bp, di
adc esi, eax
movsx ecx, di
push ebx
lea ebp, [ecx*4 - 0x376722db]
push eax
push edx
mov edi, esp
xchg ebp, ecx
mov edx, 0xf838472a
lea ebx, [ebp + edi - 0x238]
push ecx
shr dword [esp + ebp*4 - 0x5a0], 0x46
and byte [esp + ebp - 0x165], 0xae
mov esp, ebx

Function at 0x1046ae71
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax], 0x33804dad
xor cl, byte [ebp + eax + 2]
lea ebp, [eax + ebp + 2]
call fcn.1049f0cb
xor dl, bl
neg dl
bswap ecx
rol byte [esp + 2], 0x21
sal byte [esp], 0xa5
rol dl, 1
inc byte [esp]
xor dword [esp], 0x32840e9a
dec dl
lea eax, [ecx*8 - 0x23d5f2de]
ror dl, 1
ror eax, 0x8c
xor dl, 0xb6
add eax, dword [esp]
xor bl, dl
sal al, 0x87
lea edx, [esp + edx + 4]
xor cx, word [edx]
xor word [esp + 2], ax
sbb esi, 2
and byte [esp], 0xaa
call fcn.10470e68
Function at 0x1046aed5
Capabilities:
Encode data using base64

Disassembly:
jb 0x104ee239
lea ebp, [ecx + ebp - 0x30318aad]
mov dword [esp + ecx - 0x30318aac], ecx
movzx eax, cx
xor cx, cx
movzx eax, byte [ebp + eax - 0x8aac]
xor al, bl
shr ecx, 0x82
bswap ecx
xor al, 0xb1
lea ecx, [ecx*2 + 0x302ab69f]
sub al, 0x21
call fcn.104f8ae6

Function at 0x10480b9c
Capabilities:
Encode data using base64

Disassembly:
call fcn.1051ff97
call fcn.10418156

Function at 0x10487e46
Capabilities:
Encode data using base64

Disassembly:
sub eax, ecx
pop ecx
pop edx
pop ecx
pop edx
pop edx
jns fcn.10482ecc

Function at 0x1049729a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push dword [esp + 0x20]
popfd
not ebx
pop ebx
mov ebx, dword [esp + ebx - 0x407fffe0]
pop ebp
lea ebp, [ebp - 0x104c63]
jmp ebp
je 0x10416ab2
lea ebp, [edx + esi + 0xb32a08d]
mov edx, dword [esp + ebx - 0x407fffec]
rol ebp, 0xe9
mov esi, dword [esp + ebx - 0x407fffe8]
mov dword [esp + ebx - 0x407ffff0], 0x291d9e97
jbe 0x10473665
rol edi, 0x1f
salc
stosd dword es:[edi], eax
inc esi
push ebx
sub dh, al
or bh, byte [0x443c5a0f]
fisttp word [ecx - 0x1cf245b]
pop es
wait
movsd dword es:[edi], dword [esi]
xor dword cs:[edx], 0x4d
push ds
dec esi
jne 0x104972d1
invalid
xchg ecx, eax
nop
pop ds
sbb cl, byte [ebp + 0x54]
fisub word [edx]
xor byte ds:[esi + 0x14], ah
ljmp 0x4942

Function at 0x104991fa
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x4f8b8235
not ecx
add edx, edx
shr dx, 0xe3
pop eax
ror ecx, 1
xor ecx, 0x9a82dc8e
rol edx, 0x21
or dl, 0x3f
xor ebx, ecx
movsx eax, dx
and ax, dx
adc edi, ecx
sub ax, ax
jle fcn.10511f38

Function at 0x1049fc24
Capabilities:
Encode data using base64

Disassembly:
shl dword [esp + 2], 0xa9
rol edx, 3
movsx ecx, al
not edx
ror byte [esp + 6], 0x63
shr ax, 0xc2
inc edx
or ecx, eax
or dword [esp], ecx
sub eax, 0xf1a6bc3d
xor ebx, edx
ror cl, 0xa1
lea eax, [ecx + ecx - 0x2b78f8db]
adc ebp, edx
ror byte [esp + 7], 0x62
mov edx, eax
pop edx
pop ecx
jmp ebp
mov dword [esp], eax
xor edx, ebx
bswap edx
or ax, 0x2e18
jg 0x10479d9b