joyce8/EMBER2024-capa huggingface dataset:
Function at 0x22cccae
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0x2f98f582
and cx, cx
add cx, dx
shl dl, 0xc7
bswap eax
xor ebx, eax
sub ecx, ecx
sub cx, 0xd8b6
rol dl, 0xc3
adc edi, eax
jmp 0x240e727
xor edx, ebx
pop ecx
mov ecx, eax
neg edx
ror edx, 3
shl al, 0xe1
ror al, 0xa4
jae 0x243c372
not edx
and al, 0xb5
lea ecx, [eax*4 - 0x1369bbd6]
adc edx, 0x5234b683
ror ecx, 0x45
xor ebx, edx
ror al, 0x81
add esi, edx
movzx edx, cx
not dl
movzx cx, byte [edx + edi - 0x62ea]
push eax
push edx
rol dword [esp + edx*2 - 0xc5d0], 0xd7
mov dl, byte [edi + edx - 0x62e8]
adc edi, 1
xadd word [esp + 5], ax
sar eax, 0xae
sar al, 0xa6
or cl, dl
not cl
and byte [esp + 7], 0xab
mov word [edi], cx
movsx ecx, byte [esp + 3]
xadd dword [esp + ecx], ecx
mov dword [esp + ecx - 0x62ea], esi
ret 4
mov eax, 0x55a0e90f
mov ecx, dword [edx + esi - 0x3bd4b500]
bts eax, edx
call fcn.0159ae32
lea ebp, [ebp + ecx - 0x4c2059ed]
or ecx, 0xf12e3ca3
lea eax, [ecx + ecx*4 - 0x36c1784e]
sar ax, 0x66
xor edx, ebx
xor ecx, 0xc2f5e94
or eax, ecx
ror edx, 1
and eax, eax
rol eax, 0xb6
sal eax, 0xa5
not edx
dec edx
btc ax, 0xb9
sub ecx, eax
xor edx, 0x4688b79d
sub eax, eax
lea edx, [edx + ecx*2 + 0xa33a01d]
rol edx, 1
sub eax, eax
btr ecx, 0xb8
sar cl, 0x25
xor ebx, edx
add edi, edx
movzx edx, al
cdq
or edx, 0xaf91d918
jno fcn.0140c38e
mov ecx, 0x52ad55ae
movzx edx, cl
movsx eax, cx
mov ecx, dword [ebp + edx*2 - 0x15c]
jmp 0x13883d0
lea edx, [ecx - 0x56474d4d]
adc dx, 0x2718
inc dl
inc eax
jmp 0x15f660e

Function at 0x22d53a6
Capabilities:
Encode data using base64

Disassembly:
neg dx
lea ecx, [ecx + edx + 0x13d9efbf]
xchg dword [esp + eax - 0xa], edx
shr word [esp + eax - 9], 5
not ecx
ja 0x23b548e
mov dword [esp], 0xc6077ab2
ror ecx, 2
cwde
jmp 0x127c35d
sub eax, 0x5d821735
lea ecx, [ecx + edx - 0x25d6e20d]
bt eax, edx
add dword [esp], 0x8e23cd06
ror ecx, 2
pop eax
xor ebx, ecx
dec edx
lea ebp, [ebp + eax - 0x5e25bf00]
call fcn.022e508b
not ecx
inc eax
sar al, 0xc6
rol ecx, 1
dec ecx
push eax
bt ax, 0x87
neg ecx
sub ecx, 0xc59a4022
cwde
mov byte [esp + edx - 0x519798fe], al
dec edx
xor ebx, ecx
add esi, ecx
xadd dl, dh
mov ecx, dword [edi + edx - 0x5197039c]
sbb eax, eax
ror dword [esp + eax*2 + 3], 0xd6
sar word [esp + eax + 2], 0xcb
lea edi, [eax + edi + 4]
shr dword [esp + eax + 1], 0x81
cmovns dx, word [esp + edx - 0x5197039a]
mov dword [esp + edx - 0x5196fffc], ecx
bt ax, ax
not dword [esp + edx - 0x51970000]
pop ecx
popfd
bt eax, 0x11
add eax, esi
jmp eax
Function at 0x22e0cbf
Capabilities:
Authenticate hmac

Disassembly:
push 0xf503a5b4
lea esp, [esp + 0xc]
jne 0x242da4d
push 0x811e0fb9
mov ebx, dword [esp + 4]
lea esp, [esp + 8]
mov eax, 0xaba4ca86
not edx
btc eax, eax
jae 0x1629133
cld
cmp cl, dl
push cs
test dword [esp - 0xbc8bf2f], ebp
test dword [ebx - 0x134ecb39], ecx
dec edi
pop esi
or al, 0x88
push ds
stosd dword es:[edi], eax
ljmp 0xc0f6
inc ecx
mov dword [esp], 0x47987080
xor edx, 0x18ad92a1
jmp 0x1715050
jmp 0x1297dc1
bts ax, ax
mov dword [edi], edx
movzx edx, ax
xchg edx, eax
mov ecx, 0xe716dc86
jmp esi
dec eax
jmp 0x144eb58
jp 0x1323b93
dec esi
lea ecx, [eax + ecx + 8]
dec ebp
or edi, eax
dec ecx
not edi
xor ebp, ebp
dec ebp
mov dword [ecx + eax], edi
inc ebp
adc dh, bl
dec eax
or eax, esi
jmp eax
inc word [esp + 6]
xor edx, ebx
shr byte [esp + 4], 0x65
jp 0x1727333
mov ecx, 0x2b99ca17
mov eax, 0xbb96121
mov eax, dword [ebp + ecx - 0x2b99ca17]
and ecx, ecx
lea ebp, [ebp + ecx*2 - 0x5733942a]
lea edx, [ecx + ecx*4 - 0x674f9156]
jp 0x23fa711
xor eax, ebx
inc eax
bt dx, 0x1d
sal cx, 0x6e
rol eax, 3
add dx, cx
xchg dh, cl
sbb eax, 0x811a34a7
xor cl, ch
not eax
or dl, 0xb4
sbb ecx, edx
inc eax
sar dx, cl
dec ecx
ror eax, 1
or dx, dx
xor ebx, eax
xchg dx, cx
neg ecx
neg ecx
add esi, eax
call fcn.02352eb3
mov ebx, 0x1616fabd
movzx ebx, byte [ebx + ecx - 0x1616fabd]
call fcn.0229eed8

Function at 0x22f6914
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0x7faae2f3
lea esp, [esp + 4]
call fcn.02373216
cmovne bx, cx

Function at 0x2329955
Capabilities:
Encode data using base64

Disassembly:
adc eax, edx
mov dword [ebp - 4], eax
push 0x61bb5e12
mov dword [esp + 0xc], 0xe1b9f2ac
sal dword [esp], 0x33
test ebx, ebx
push 0xd7880880
lea esp, [esp + 0x14]
je 0x1541954

Function at 0x233997d
Capabilities:
Encode data using base64

Disassembly:
test ecx, ecx
call fcn.01431654
mov ebx, 0xe0a31880
inc ecx
mov ecx, dword [ecx]
dec esp
lea eax, [ebx + 0x66ac4e1c]
dec ecx
add ecx, 4
dec ecx
sub esp, 1
inc ebp
movzx eax, byte [esp]
inc esp
xor al, bh
dec esp
lea edx, [ebx + 0x6ab1babd]
inc esp
movzx esi, bl
inc ecx
not al
inc esp
btr ebx, esi
inc ecx
inc al
inc ecx
movzx ebp, dh
inc ecx
neg al
inc ecx
not al
not bx
inc ecx
sar edx, 0x50
dec esi
lea ebx, [ebx + esi - 0x70cdd7e9]
inc ecx
neg al
inc ecx
add al, 0x8f
inc ecx
ror al, 1
inc ecx
xor bh, al
dec ebx
inc sp
xadd ebp, edx
dec esp
adc eax, esp
inc ebp
movsx ebp, dh
inc ebx
mov dword [eax + edx*8 - 0x400], ecx
inc cx
sal ebx, 0x23
inc ecx
sar esi, 9
inc esp
movsx edi, ch
dec edi
lea esp, [esp + edx*2 - 0x104]
inc edi
mov eax, dword [edx - 0x80]
dec eax
lea ecx, [ebx + ebp*2 + 0x602e6581]
inc esp
xor eax, edi
inc cx
add ebx, edi
inc edi
lea eax, [eax + edx - 0x7a9afa21]
dec edx
lea eax, [esi*2 + 0x5c891932]
dec eax
neg ebp
inc eax
Function at 0x23545b3
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
test eax, eax
jmp 0x248206b
shl dword [esp], 0x79
jp 0x143ad04
neg eax
rol eax, 3
lea eax, [eax + ecx + 0x66173780]
lea edx, [ecx*4 + 0x12acd034]
lea ecx, [edx*2 - 0x326d3d50]
xor eax, 0xd402fa13
or cl, 0xa0
xor ebx, eax
xor ecx, 0x3ab74280
adc esi, eax
btc ecx, ecx
sbb edx, 0x329f9c2d
mov eax, dword [edi + ecx*2 - 0x7341bce0]
xor dx, 0x443b
sal cx, 0x65
mov edx, dword [edi + ecx*2 - 0x73419bfc]
lock xadd dword [eax + ecx - 0x39a0ce00], edx
pushfd
pop eax
and cx, cx
call fcn.0140f2eb
mov dword [esp], 0xbca337a8
adc edi, 4
xor edx, edx
jmp 0x15b3043
Function at 0x235558a
Capabilities:
Encode data using base64

Disassembly:
bts dx, ax
mov dx, word [ebp + edx*8 - 8]
movzx ecx, al
lea ebp, [ebp + ecx*4 + 2]
neg al
and eax, ecx
lea esi, [esi + eax*2 - 1]
sub al, al
sbb cl, ah
shr cx, 0x4a
or cl, byte [eax + esi]
neg al
neg ax
sub eax, 0x771641ac
xor cl, bl
rol cl, 1
sal al, 0x86
xor eax, 0x3b1dd731
not cl
inc cl
ror cl, 1
sar al, 0xc2
shl eax, 0x95
xor bl, cl
jmp 0x241d57a
mov eax, 0x91cfeb0
lea ecx, [eax + ecx + 0x4291ebd8]
neg al
cwde
neg ecx
imul eax
adc dl, ah
not ecx
cmovnp eax, edx
shl ax, 0x4e
bswap ecx
xor ebx, ecx
add ebp, ecx
mov eax, dword [esi + eax*2 - 0x8000]
mov ecx, edx
call fcn.016130a9
out 0x3a, eax
fisttp word [ebx]
movsb byte es:[edi], byte [esi]
popfd
test al, 0xe7
pop esp
or eax, 0xcc8b91ee
sbb eax, 0x524feeb5
pop es
shr dword [eax - 0x78], 0xf2
push 0xe59af288
rol edx, 3
neg word [esp + 0xd]
xchg cx, ax
xor edx, ebx
bswap edx
lea edx, [ecx + edx + 0x4021de7e]
shl al, 0x22
sbb ax, ax
sbb ecx, 0x9a294289
rol edx, 2
inc ecx
bswap edx
xadd eax, ecx
sar ax, 0xa5
btc ecx, ecx
ror edx, 1
xchg al, cl
not ecx
cwde
inc edx
ror cx, 0x4f
jae 0x23bbf17
sub edi, 4
mov ecx, dword [edi]
xor ecx, ebx
jmp 0x15dad7f
xor eax, ebx
sar edx, 0x34
not eax
xor ecx, 0x8c8cf432
rol edx, 0xae
neg eax
ror eax, 1
xor eax, 0x29974222
shl dl, 0x47
bt ecx, 0xb0
ror ecx, cl
xor ebx, eax
or edx, 0x510bdf88
adc ebp, eax
lea eax, [ecx + ecx + 0x33ba0fbb]
shl al, cl
mov edx, dword [ecx + edi - 0x3d0c9aa6]
shl cx, 0x21
adc eax, ecx
or cl, 0xba
lea edi, [edi + ecx*2 - 0x7a186bf8]
jl 0x165fa80
xor al, bl
not edx
bswap ecx
inc dx
sub al, 0x9c
mov dword [esp + ecx - 0x7cc4ffff], 0xaf892218
or cl, 0xb3
inc edx
xor al, cl
bt cx, cx
call fcn.01542b9f
mov eax, 0x57ae2d29
dec al
mov ecx, dword [esi + eax - 0x57ae2d28]
cdq
mov ebp, 0x2fa5e111
lea esi, [eax + esi - 0x57ae2d24]
mov ebp, ecx
lea ecx, [edx + eax*4 + 0x89f7b0]
mov edi, esi
inc ecx
jns 0x236bbd8
mov eax, dword [edi]
mov ecx, 0xe6143307
movzx edx, cx
xor cx, dx
lea edi, [edi + edx - 0x3303]
imul cx, dx
jae 0x16bf543
not edx
and eax, eax
rol edx, 3
xor ebx, edx
xadd cl, al
lea esi, [esi + eax - 0x17a]
sar cx, 0xeb
mov dword [esi + eax*2 - 0x2ec], edx
je fcn.01645f5c
mov ecx, 0x2221b632
lea esi, [ecx + esi - 0x2221b636]
mov ecx, dword [esi + ecx*2 - 0x44436c64]
xor ecx, ebx
mov eax, 0xb8322a4
lea edx, [eax - 0x3e7c80cf]
xor ecx, 0x7caca136
inc ecx
add edx, 0xfd2a9535
lea eax, [edx*4 - 0x5bc8db42]
sal al, 0x81
xor ecx, 0x896bfaf
sub edx, edx
neg ecx
dec ecx
sal dx, 0x49
xor ebx, ecx
sub al, 3
sar ax, 0x4e
adc edi, ecx
jmp 0x1411e5f
add ecx, esp
imul eax, eax
mov byte [ecx + eax], dl
movsx edx, al
xor eax, edi
jmp eax
Function at 0x235f17a
Capabilities:
Encode data using xor

Disassembly:
dec edx
lea ecx, [eax + eax*8 + 0x7e812e86]
btr cx, 0x95
neg edx
add ax, cx
add al, ch
rol edx, 2
cwde
cwde
not edx
xadd al, ah
and ecx, ecx
ror edx, 3
lea edx, [edx + eax + 0x6a1a3ede]
sal cx, 0x87
xor ecx, eax
ror edx, cl
or ax, ax
sar eax, cl
btc ecx, eax
neg edx
btc eax, eax
rol edx, cl
xor ebx, edx
push eax
add ebp, edx
mov eax, dword [esi + ecx - 0x6b7a17c2]
mov edx, ecx
mov edx, dword [esi + ecx - 0x6b7a17be]
bts ecx, ecx
mov cl, byte [esi + ecx - 0x6b7a17be]
call fcn.0235adce
shr ebp, 1
jp 0x22ff571
inc eax
pcmpgtw mm5, qword [ebx + 0x57]
mov ecx, 0xc4c7f981
scasb al, byte es:[edi]
and byte [edx], cl
push ecx
pop esi
inc ecx
mov ecx, 0x575add6c
fcmovu st(0), st(7)
push es
mov dword [eax - 0x5616ac98], ebp
sbb esi, edx
test eax, 0x72562905
rcl esp, 0xa0
dec ebx
dec ecx
in al, dx
retf
rol edx, 1
push ecx
rol ecx, 0x72
not edx
cbw
mov dword [esp + eax*8 - 0x20fff9c], eax
bswap edx
mov dword [esp + eax*2 - 0x83ffe4], 0x5f92d30c
shr cl, 0xa2
rol edx, 2
or dword [esp + eax*4 - 0x107ffcf], eax
shl eax, 0xb9
sar byte [esp + ecx*2 - 0x2806f9fb], 0xa4
xor ebx, edx
call fcn.01452a30
mov edx, dword [edi]
mov eax, 0xd39511b4
add edi, 4
shl eax, 0x2b
xor edx, ebx
not edx
jmp 0x22ff55f

Function at 0x237e24e
Capabilities:
Encode data using base64

Disassembly:
xchg dword [esp + ecx*8 - 0x5fd7c], ecx
mov dword [esp], ecx
xor al, bl
not al
xor cx, 0x6982
bts ecx, ecx
sbb al, 0xae
pop ecx
dec cl
setge cl
xor al, 0xa5
jmp 0x2482302
shl cl, 0x43
inc word [esp + 4]
dec al
btr ecx, ecx
sbb cx, cx
xchg dword [esp], ecx
neg al
and word [esp + ecx - 0xbfa8], 0xb838
rol al, 1
neg ecx
xor ecx, ecx
call fcn.024243c6
Function at 0x239b724
Capabilities:
Encode data using xor

Disassembly:
shl byte [esp + 4], 0x41
test ebx, ebx
call fcn.02367486
push ebp
push edi
mov ebp, 0xba86cb3a
pushfd
call fcn.0230b2b1
add byte [eax], al
add byte [edx + 0x65], dl
inc esp
insb byte es:[edi], dx
je 0x239b7ae
dec ebx
jns 0x239b78e
add byte [edx - 0x35cf45c9], bh
movsx eax, dl
movsx ecx, al
mov edx, dword [edi + eax - 0x37]
push ecx
sal eax, 0xc9
mov cx, word [edi + eax*8 - 0x36ffc]
sbb eax, dword [esp + eax - 0x6e00]
pop eax
lea edi, [edi + eax*2 - 0x6c]
setae al
bt ax, ax
shr cx, 1
rcr edx, cl
push eax
call fcn.01741463
and ecx, 0x640d97a9
neg edx
dec edx
rol eax, 0x55
xor edx, 0x560dedbc
dec ecx
fimul dword [edx - 0x3f]
rcl byte [ebp - 0x7f], 0xf2
mov esp, 0x49560ded
xor ecx, 0x5512e4b5
push eax
not edx
sbb cl, 0x3d
sbb edx, 0x7c36388d
ror cx, cl
leave
adc al, ch
call fcn.016e3a8e
pop es
lcall 0xdd5d, 0x6c84fd05
add ah, byte [eax + 0x46]
wait
sub dword [ebx], eax
in eax, dx
cmp al, 7
sbb al, byte [edx]
lcall 0xc333, 0xfd79a049
stc
cli
vpaddusw ymm4, ymm0, ymmword [ecx]
mov byte [0x5f7cfbfc], al
jl 0x239b83a
jecxz 0x239b7d9
or byte [eax + 0x20fc1aa], ah
js 0x239b819
push ss
dec edx
int1
fcomp qword [ebx + 0x2c]
xor al, 0xda
mov byte [ebp - 0x3ea6bf1], ah
aas
xor ecx, dword [0x67a56531]
jg 0x239b77f
xchg ecx, eax
mov bh, 0xbd
cmp ebx, edx
inc ebx
jl 0x239b807
mov bh, cl
add esi, edx
sub ah, cl
imul edi, dword [edi + edx*4], 0x2e
sbb ebx, edi
scasb al, byte es:[edi]
outsd dx, dword [esi]
rol byte [ebp - 0xd7e7917], 1
les eax, [esi + 0x1d]
iretd
les eax, [esi + 0x1d]
pop edx
jge 0x239b885
loopne 0x239b7c5
and al, 0xdb
out 0xfe, al
idiv esi
mov ebx, 0x4e74e566
test byte [esi + edx + 0x35], bh
dec edi
shr dword [edx + 0x16904143], 0x2c
sub byte es:[ebx], bl
rol dword [edi + 0x230e4b54], 1
lodsd eax, dword [esi]
cld
pop esp
lcall 0xa32a, 0xa04dcfc8
popfd
or byte [ecx + 0x29], cl
arpl word [esi + 0x2a], cx
adc dl, dl
mov byte [0x96c538d4], al
push ebp
bound esi, qword [ebx + 0x25]
or eax, 0xf169616
cmp al, 0xae
xchg edx, eax
sbb ebp, dword [eax + 0x526d6992]
and byte [ebp - 0x33], bl
invalid
xchg edi, eax
or dword [ebx + 0x31], esp
and byte [ecx], bh
cmp dword [ebx + 0x41deddfd], edx
or ah, al
and ebp, ebx
sbb al, 0x65
sbb byte [eax], ah
scasb al, byte es:[edi]
xchg edi, eax
sbb dword [edx], esi
fistp qword [ecx + 0x6a]
add dword [edi - 0x22], esp
mov bl, 0xdb
cmpsd dword [esi], dword es:[edi]
add eax, dword [edi + 0x45]
bound ecx, qword [ecx - 0x5d]
invalid
Function at 0x23b470b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi + edx*8 - 0xdc50], ecx
lea ecx, [eax + edx - 0xe7aa3f8]
sal al, 0xa1
mov eax, dword [edx + edi - 0x1b8a]
ror dl, 0x27
bts edx, edx
or cl, dl
lea edi, [edi + edx*2 - 0x403626]
xor eax, ebx
sar edx, 0xd2
jnp 0x153ed5a
cli
ror byte [edi], cl
mov ebx, dword [eax]
mov dword [0x6bf30027], eax
ret
imul eax, ebx, 0xffffffe3
push eax
xor dh, byte [eax + 0x7aeebc2]
xchg edi, eax
mov ebp, dword [edi - 0x3e912937]
dec ebx
push eax
mov ch, 5
mov dh, 0xa6
jnp 0x12c4a3a
sub byte [ecx - 0x7db110a9], ch
loopne 0x12c4ab8
sbb cl, al
push edi
invalid
mov dl, 0xaf
popfd
pop ebx
iretd
not eax
lea eax, [edx + eax - 0x30987840]
bt edx, 0xe
dec ecx
inc edx
not eax
sbb dx, 0xb42f
lea eax, [eax + edx - 0x7e3b7a7a]
lea edx, [ecx + 0x16b13811]
xor ebx, eax
bswap edx
rol ecx, cl
shr dx, 0x8f
add ebp, eax
lea eax, [edx + ecx*8 + 0x7531388c]
dec ax
jmp ebp
mov esi, dword [esp + esi - 0x523e0a16]
lea esp, [esp + 8]
mov eax, 0x3f391b8a
movzx edx, ax
div dl
not ecx
not eax
jmp 0x12c4a10

Function at 0x23bc016
Capabilities:
Execute syscall

Disassembly:
inc ebx
mov dl, byte [ecx + edx*2 + 6]
call fcn.01706a44
sysenter
call fcn.0242a122
adc esi, eax
mov eax, dword [ecx + ebp - 0x405c3a1c]
sal dword [esp + edx - 0x405c0771], 0xef
call fcn.0155e5fd
mov eax, dword [edi]
mov ecx, 0x1c3b4422
sar cx, cl
lea edx, [ecx + ecx*8 - 0x27648e52]
lea edi, [ecx + edi - 0x1c3b1104]
lea ecx, [edx + edx - 0x17e53aed]
xor eax, ebx
dec eax
push ecx
or ecx, 0x4a9b831a
inc dword [esp]
ror eax, 1
lea edx, [edx*4 - 0x6661915c]
push ecx
and ecx, edx
adc eax, 0x5a3751a
ror eax, 2
dec edx
xor eax, 0x643f1a8e
lea edx, [ecx*2 - 0x22ef814c]
xor ebx, eax
add ebp, eax
xchg dword [esp + 3], edx
add dx, dx
ror cl, 2
mov ecx, dword [esi + edx - 0x78db01be]
and dx, dx
mov dl, byte [edx + esi - 0x78db01ba]
not dword [esp + 4]
adc esi, 6
mov eax, dword [esp + 4]
div byte [esp + eax - 0x6a7a3a48]
mov byte [ecx + eax - 0x6a7a1cc4], dl
mov dword [esp + eax - 0x6a7a1cc4], ebp
ret 4

Function at 0x23c8446
Capabilities:
Encode data using base64

Disassembly:
neg ecx
sar eax, 0x7e
or edx, edx
or dl, dl
xor ebx, ecx
add esi, ecx
or dl, al
xadd eax, edx
mov dword [esp], 0x972f941e
mov edi, dword [edi]
pop edx
pop ecx
jbe fcn.0141de63

Function at 0x23c846b
Capabilities:
Encode data using base64

Disassembly:
rol edx, 2
xor dword [esp + ecx*2 - 0x27637470], ecx
inc edx
bswap edx
add ecx, 0x363332b6
mov dword [esp + eax - 0x6b759601], eax
mov word [esp + ecx - 0x49e4ecf2], 0x5606
rol edx, 1
lea ecx, [ecx*4 + 0xd0ec7b6]
rol eax, 0xde
xor ebx, edx
shl ecx, 0x7e
imul cx, cx
adc ebp, edx
call fcn.023644b0

Function at 0x2414769
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, eax
add esi, eax
mov eax, 0x818cf9aa

Function at 0x2414a18
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax + edx - 0x6233d7e8]
rol eax, 1
dec ecx
add dx, cx
not eax
xor ebx, eax
xadd cl, dl
mov dword [esp], 0x5786f226
inc dx
adc edi, eax
bswap ecx
btr ecx, 0x18
sbb dword [esp], ecx
mov ax, word [ebp]
adc dx, 0x4517
jno 0x246fb48
jl 0x142b0e7
Function at 0x242e41b
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [edi + edx - 0x129dea2c]
movzx ecx, word [esp + edx - 0x129dea28]
call fcn.012b4433

Function at 0x242fdc5
Capabilities:
Encode data using base64

Disassembly:
xor cx, 0xee28
xor ebx, eax
shl ecx, 0x76
sal ecx, 0xa6
ror cl, 0x87
adc edi, eax
mov eax, ecx
mov eax, dword [ebp]
xchg ch, cl
mov dx, word [ebp + 4]
neg cl
adc ebp, 6
call fcn.013d84e7
not dx
ror eax, 0xed
shl cl, 0xe5
xadd cx, ax
xor dx, 0x81b9
add al, ah
rol cx, 0x83
rol dx, 1
neg dx
rol dx, 1
shl eax, cl
xor bx, dx
xor eax, ecx
imul eax, eax
call fcn.0236635e
out dx, al
mov ch, byte [ecx + 0x4f]
aam 0x82
bound esp, qword [ebp + ecx*2 + 0x66]
ja 0x1672ad7
cld
mov byte [ebx + 0x4e9109be], dh
hlt
insb byte es:[edi], dx
stosd dword es:[edi], eax
cli
in eax, 0xf2
mov edi, 0x815a383d
imul edi, dword [esi + 0x1e8d503f], 0xc41848a1
inc eax
mov ebp, 0x10f0fa9f
pop edx
imul eax, ebx, 0x12
jo 0x1672b4b
dec edi
lcall 0x5cec, 0x2c94deb5
sub al, 0xe6
mov cl, 0xe8
push esi
xor al, 0x53
pop esi
push eax
js 0x1672b81
or dword [ecx - 0x7c8fb422], edx
mov al, 0x71
xchg edx, eax
out dx, eax
pushal
mov bh, 0x54
pop ebp
xchg dword [esi + 0x33], ecx
xor ebx, eax
invalid
mov word [esi - 2], cs
invalid
invalid
xchg ebp, eax
wait
xchg edx, eax
mov ecx, 0x4489669b
daa
add byte [esi + 0xf], ah
mov edx, 0xb70f85ea
ret 0xb489
and edx, dword [esp + ecx - 0xf0f033]
not dword [esp + ecx - 0xf0f036]
xor ebx, eax
ror dl, 0xc4
shl cl, 0x41
adc esi, eax
rol edx, 0xcd
lea eax, [edx*2 - 0x5941ce4e]
mov eax, dword [edi + ecx*2 - 0x1e1e0dc]
dec ecx
neg dword [esp + ecx*8 - 0x7878364]
jns 0x2467ea2
sub edi, 4
mov eax, 0xf23b814
mov edx, dword [edi + eax - 0xf23b814]
shr eax, 0x13
btc eax, eax
movsx ecx, al
xor edx, ebx
sub edx, 0x96b0510b
or eax, 0xfb1f789b
ror edx, 1
bts eax, eax
not edx
bts ecx, eax
shr al, 0xa4
rol edx, 3
sal ecx, cl
setns cl
xor ebx, edx
add esi, edx
imul al
xor ecx, 0xcd8fc70a
movzx edx, ax
mov dx, word [ecx + ebp - 0x32cfc70a]
xadd eax, ecx
mov ax, word [ebp + eax*2 - 0x5bdd8fd4]
or cl, ch
imul ecx, ecx
mov cl, byte [ecx + ebp - 0x6c7ec5bd]
call fcn.012e2408
mov edx, 0x3a047e22
movsx ecx, dl
sub ecx, edx
lea esi, [esi + edx - 0x3a047e26]
mov eax, dword [edx + esi - 0x3a047e22]
sar edx, 0xc5
bt edx, ecx
sar ecx, 0xff
xor eax, ebx
and dl, 0xae
cmovb ecx, edx
and ecx, 0x6892361a
not eax
btr edx, 0x99
sbb eax, 0xf307ff0b
inc dx
not edx
setp dl
bswap eax
setnp cl
lea eax, [edx + eax - 0x6a85cb44]
inc edx
jne 0x1672a03
mov edx, 0xf0350708
mov eax, dword [ebp]
mov dword [esp], edx
mov ecx, edx
add ebp, 4
shr ecx, cl
mov dword [esp + ecx*2 - 0x1e06a0a], edx
xor eax, ebx
lea eax, [eax + ecx*4 - 0x46754a3b]
dec dx
neg eax
or cx, word [esp + ecx*4 - 0x3c0d416]
xadd byte [esp + ecx*8 - 0x787a9b1], ch
rol eax, 2
btc edx, ecx
sbb edx, ecx
jns 0x242a184
xor eax, 0xc708c6be
jmp 0x22ccbb2
Function at 0x245cc61
Capabilities:
Encode data using xor

Disassembly:
movzx edx, al
push eax
lea edi, [edi + ecx - 0x638584c1]
shr byte [esp + edx*2 - 0x175], 1
dec word [esp + ecx - 0x638584bb]
mov ecx, dword [eax + edi - 0x638584be]
shr edx, 0x9f
xor ecx, ebx
mov dword [esp + edx + 3], eax
shr dx, 0x4b
xor ecx, 0x1d099abc
sal word [esp + eax - 0x638584b8], 0x25
neg ecx
inc word [esp + eax - 0x638584b8]
pushfd
cwde
bswap ecx
sub dword [esp + edx + 4], 0x4319030a
sbb dl, al
push edx
lea ecx, [ecx + edx*2 - 0x34346f11]
neg eax
xadd dword [esp + eax - 0x7b3a], eax
cdq
xor ecx, 0xf2895535
sub dword [esp + 2], eax
rol ecx, 3
rol byte [esp + 9], 0x63
adc ecx, 0x4ebd6d25
call fcn.01603171
cld
cmp cl, dl
cmp dword [esi + 0x4af9a2ab], ebx
cmp byte ss:[edi + 0x571d2113], 0x74
mov ecx, 0xddf2b257
movsb byte es:[edi], byte [esi]
jns 0x156a2fe
push es
pushal
test byte [esi + 0x7f], bl
std
dec ebp
wait
scasd eax, dword es:[edi]
jmp 0x156a36e
cli
mov ebp, 0xaf15e575
lodsb al, byte [esi]
sub byte [eax - 0x47b2cda1], al
adc eax, 0x8028acaf
pop edi
xor cl, byte [ebp - 0x48]
dec dword [ebx + 0x248b8956]
pop eax
test eax, 0xa838713c
dec ebp
push ebp
int 0x27
clc
push edi
push ss
jecxz 0x156a395
mov eax, dword [0x1acee597]
push eax
pop esp
sub eax, 0x9c535364
xor byte [ecx + 0x25b3af4d], 0x39
jns 0x156a372
mov esp, 0x7d0eb754
retf
not edx
mov dword [esp + eax - 0x638584be], ecx
dec cx
mov dword [ecx + esi - 0x638584bd], edx
jno 0x156a2b8

Function at 0x245ef32
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4db1d70a
movzx ebx, byte [ecx + ebx - 0x4db1d70a]
call fcn.0161c385
mov edx, dword [edi]
mov ecx, 0xe48cb409
btr ecx, ecx
adc edi, 4
xor edx, ebx
ror edx, 1
lea eax, [ecx + 0x12ae88a]
bts ax, 0x2b
xor edx, 0x5993a935
not eax
xchg ch, al
btc ecx, 0xa6
lea edx, [eax + edx + 0x1ade9555]
neg edx
xor ebx, edx
push eax
add ebp, edx
xadd dword [esp + eax*4 - 0x69218ed0], ecx
add dword [esp + ecx - 0x1a4863b4], eax
movsx edx, al
mov cx, word [esi + ecx - 0x1a4863b4]
inc edx
xchg word [esp + eax*2 - 0x3490c767], ax
lea esi, [esi + eax*2 - 0x34903a64]
idiv dword [esp + eax*4 - 0x692074cc]
lea eax, [edx + edx*2 + 0x5ca6a28c]
movzx edx, byte [edi + eax - 0x4ea8ac2e]
pop eax
lea edi, [edi + eax*4 - 0x658ed2c3]
cwde
xor dl, bl
rol eax, 0xcb
bts eax, eax
neg dl
bt ax, ax
rol eax, 0xea
dec dl
not dl
call fcn.01755bbc
lea esp, [esp + 0x1c]
jne 0x140cb8d
call fcn.013f0f41
in al, dx
sub eax, 0x8d811adb
mov bl, ah
inc eax
sub dh, ah
mov al, byte [0x763a96e4]
mov ebp, 0x218a075d
pop es
xor al, 0x14
dec ebx
insd dword es:[edi], dx
enter 0xffffffffffffb594, 0xffffffffffffffbf
invalid
Function at 0x2469471
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [ebp + 2]
mov ecx, dword [esp + 4]
xchg ch, cl
or cx, cx
mov cl, byte [ebp + ecx - 0x720296c8]
jg 0x24540c2
push 0x218803a
adc ebp, 4
shld dx, ax, cl
mov eax, 0x68b7d48d
sar dword [esp + eax - 0x68b7d485], 0xf7
mov word [eax + ebp - 0x68b7d48d], dx
movsx ecx, word [esp + eax - 0x68b7d485]
xchg dword [esp + eax - 0x68b7d485], eax
lea edi, [eax + edi - 0xe8]
mov edx, dword [eax + edi - 0xe4]
xor edx, ebx
cwde
sub edx, 0x96b0510b
sub cx, ax
ror edx, 1
rol al, 0x63
call fcn.0236814f
mov ecx, 0xb99cc20
movsx edx, cx
movzx cx, byte [ecx + edi - 0xb99cc20]
mov eax, edx
neg edx
mov al, byte [edi + edx*4 - 0xcf7e]
sar dx, 0x21

Function at 0x2471355
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x3b3b1d25
movsx eax, dl
mov ecx, dword [edx + edi - 0x3b3b1d25]
xor eax, eax
imul dx, dx
mov dx, word [eax + edi + 4]
sbb eax, eax
ja 0x22a0dad
adc edi, 5
jl 0x22a0262
mov dword [esp], 0x4b2bb697
shr ecx, 8
xor ecx, edi
inc edx
push 0xb8b6e385
shr dword [esp + 5], 0xef
xor ecx, 0x12a31d32
push 0xa700109c
dec eax
not word [esp]
lea esp, [esp + 0x10]
jne 0x16d3aaf
mov edi, 0x8f113200
pop edi

Function at 0x2480dab
Capabilities:
Execute syscall

Disassembly:
push ecx
cwde
xor edx, 0x1c1a6815
dec dword [esp + ecx*4]
shl ecx, 0xc3
lea eax, [ecx*4 - 0x37c4af4b]
rol edx, 1
xchg ecx, eax
lea edx, [edx + eax*2 - 0x1a84e110]
and dword [esp + eax*2], 0x79147dbf
sal dword [esp + eax*4], cl
xor ebx, edx
add edi, edx
add eax, dword [ebp + eax*4]
movzx edx, byte [esp]
jmp 0x2418f8d
or cx, word [ecx + esi + 4]
shr dl, 0x81
and dword [esp + edx*2], 0x4e04beaf
lea esi, [esi + edx*8 + 2]
setno dl
shr cx, 1
xchg word [esp + edx*8 - 6], dx
pop edx
rcr eax, cl
shl dl, 0x45
mov dword [edx + esi - 0x1a040], eax
setp dl
mov ecx, edx
jmp ebp
shl edx, 0x98
mov ecx, dword [ebp + edx*4 + 4]
setae dl
lea ebp, [edx + ebp + 3]
ror dword [esp + edx*4 - 4], 0xb2
or edx, edx
btc dx, 0x35
not eax
and byte [esp + edx*2 - 0x41], dh
sub dword [esp + edx - 0x21], edx
not ecx
and eax, ecx
shr dword [esp + edx*2 - 0x42], 0x11
lea ecx, [edx + edx*2 + 0x46ad45a3]
btr cx, dx
mov dword [ebp + edx - 0x21], eax
xor dword [esp + edx*2 - 0x42], edi
ret
add ebp, edx
mov dword [esp + eax - 0x6ce00211], 0xcd2ee09a
rol cl, 0x26
mov eax, dword [ecx + esi]
mov edx, ecx
jae 0x16bc1e3
mov eax, 0x342355b4
cdq
movzx ecx, dl
mov eax, dword [ebp + eax*2 - 0x6846ab68]
add cx, cx
dec cx
lea ebp, [ebp + ecx*2 - 0x1fffa]
sal edx, cl
ror edx, 0xc2
and dl, 0xab
xor eax, ebx
sal cx, 0x6d
shr ecx, 0xd
inc eax
bswap ecx
sal cx, 0x2d
imul edx, edx
neg eax
rol eax, 3
sub eax, 0x9823ff89
ror eax, 1
bt cx, cx
imul cx, dx
not eax
sbb eax, 0xb62f7337
or ecx, ecx
sar ecx, 0xb2
neg eax
or cl, dl
xor ebx, eax
xadd edx, ecx
inc cx
sub edx, 0xc9292a86
add esi, eax
mov ecx, dword [edi + edx*2 - 0x6dadae74]
push edx
call fcn.0153ceb3
mov ecx, 0x7d92653e
movzx edx, cx
lea esi, [esi + ecx - 0x7d926542]
mov edx, dword [edx + esi - 0x653e]
mov eax, 0xa733f8b0
xor edx, ebx
or ecx, 0x553de3b5
xor edx, 0xdc88919a
xor ecx, ecx
not al
and ecx, 0x41bc5eb4
bswap edx
lea edx, [edx + ecx*2 + 0x38bfda27]
jno 0x15739a8