joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1a4424c
Capabilities:
Encode data using base64

Disassembly:
and eax, 0x518f0390
rol edx, 1
not edx
xchg ecx, eax
neg eax
jp 0x1934328
mov eax, dword [ebp]
jmp 0x28ba9c2
inc edx
xor edx, 0x9324ef8c
sal ecx, 0xc3
or ax, 0x7226
bswap ecx
xor ebx, edx
add edi, edx
mov eax, dword [ebp + ecx*8 - 0x6401000]
movsx edx, cx
rol cx, 0x8e
mov edx, dword [ecx + ebp - 0xc8007c]
inc ecx
and ecx, 0x9502c50d
lock xadd dword [eax + ecx*8 - 8], edx
jmp 0x1a9cc7f
mov dword [eax + edi - 0x619c2127], edx
jmp esi
rol edx, 1
bswap eax
xor edx, 0x31ab07b1
sub ax, cx
lea edx, [ecx + edx - 0x7596433a]
bswap edx
shr ax, 0xc6
imul eax, ecx
neg edx
ror ax, 2
xor eax, ecx
xor ebx, edx
lea ecx, [eax - 0x84d51d9]
rol ax, 0x6a
sal eax, 0x70
adc edi, edx
xor eax, edi
jmp eax
mov esi, 0x2e226537
call fcn.015347cc
ror cx, 0xe7
mov eax, dword [ecx + edi - 0x1dfc]
inc cl
lea ecx, [ecx + 0x4c109639]
lea edi, [edi + ecx - 0x4c10b436]
sar cl, 0xe7
and edx, eax
or cl, cl
lea eax, [ecx + ecx*8 - 0x3afa32d9]
not edx
btc eax, 0xbc
lea ecx, [eax + ecx*8 - 0x5acd1e55]
jb 0x188d6ed
pop ecx
mov dword [eax], edx
pop ecx
mov ecx, dword [ebp]
mov eax, 0x129ed63e
movsx edx, ax
mul dx
lea ebp, [ebp + eax*2 - 0x253d6e04]
jo 0x288215c
or cl, dl
mov word [edi + eax*8], cx
movsx ecx, al
sar eax, 0xa9
or ax, 0xf212
xor ecx, esi
jmp ecx
pushfd
shl cx, cl
not cx
lea eax, [ecx - 0x42c465d9]
pop eax
neg cl
mov dword [ebp + ecx*4 - 0x3fc08], edx
movzx edx, cx
rol ecx, 0xdd
imul edx, edx
mov dword [ecx + ebp - 0x60001fe0], eax
lea eax, [edx + edx - 0x3762e053]
jo 0x1ae34f3
jmp edi
sub ecx, 0xce000333
ror ax, 0x67
neg ecx
call fcn.01bfa352
lea esp, [esp + 0x18]
jne 0x19b7f49
mov esi, 0x6e2f8928
add esi, 0xbd950f10
pop esi
mov eax, 0xdd8cfb19
mov ecx, 0x3c0bf58c
not edx
mov dword [ebp + ecx - 0x3c0bf58c], edx
mov edx, eax
rol dl, 6
sar ecx, cl
lea esi, [esi + ecx - 0x3c0c3]
lea edx, [edx*2 + 0x6e99f722]
xor eax, edx
setge al
mov edx, dword [esi + ecx - 0x3c0bf]
xor edx, ebx
cwde
lea edx, [edx + eax + 0x5286a10e]
shr eax, cl
jae 0x152bda8
xor ecx, ebx
dec dx
bswap ecx
bts edx, 0x34
sal edx, 0x2e
xor ecx, 0xba268783
jmp 0x1c168e1
mov edx, dword [ebp]
mov ecx, 0xb4a49487
movsx eax, cl
xor edx, ebx
not eax
bswap eax
dec al
lea edx, [edx + eax - 0x5bc095ea]
cbw
sete al
bswap edx
sar ecx, cl
neg edx
not cx
lea edx, [eax + edx + 0x49e9b22]
xor ebx, edx
shl eax, 6
adc esi, edx
mov eax, dword [edi + eax*2 - 0x7f8000]
movsx edx, cl
mov ecx, dword [edi + 4]
shl dl, 0x83
adc edi, 8
shr edx, 0xf7
mov dword [eax + edx - 0x1ff], ecx
add edx, 0x7083bb1c
call fcn.01c0d8a1
mov edx, 0x133e5937
lea eax, [edx*4 + 0x548cb3b1]
xchg dx, ax
lea esi, [esi + edx - 0x133e1891]
movzx ecx, ax
bts eax, edx
and eax, ecx
mov edx, dword [esi + edx - 0x133e188d]
xor edx, ebx
lea eax, [eax + ecx + 0x780aaa2f]
not eax
bswap edx
rol edx, 2
bt eax, 0x3e
sal eax, cl
not edx
and cl, al
xor ax, cx
ja 0x16d2444
add esi, edx
mov edx, dword [edi + ecx*8 - 0x78]
bt cx, ax
jb 0x19f311c
mov ecx, dword [ebp]
push 0x25084702
call fcn.019c72e2
push esi
sbb ebp, dword [ebp*2 + 0x74ea55d7]
adc edi, dword [esi]
retf
call int.01b12aef
sub ebp, 4
jmp 0x28b0532
Function at 0x1a59df8
Capabilities:
Encode data using base64

Disassembly:
call fcn.01bd411f
inc eax
inc ecx
inc cl
neg eax
lea edx, [ecx + ecx*2 - 0x24dffbc8]
imul ecx, edx
inc dx
inc eax
xor eax, 0xfc02f5a0
imul dx, dx
rol eax, 1
lea eax, [eax + edx*8 - 0x591e5c34]
not edx
xor ebx, eax
dec ecx
sal edx, 0xaa
adc edi, eax
lea ebp, [ebp + edx - 0x6c29d801]
dec cx
sar edx, cl
xor cl, ch
movzx ecx, byte [ebp + edx - 0x1b0a7]
jle 0x1a5c9c7
xor edx, 0x3da095b3
push 0x19a86caa
dec eax
jmp 0x194962a
xor cl, bl
sub cl, 0x1a
xor cl, 0x84
or dx, dx
movzx eax, dx
dec cl
cwd
jmp 0x1c31b58
xor cl, dl
rol edx, 7
sar edx, 0xf4
dec cl
push edx
btc edx, 0xb4
xor bl, cl
cdq
mul dx
lea ecx, [esp + ecx + 4]
xor dx, word [ecx + edx]
lea ecx, [eax*2 - 0x7c7db759]
sub word [esp + eax*2 + 2], cx
lea esi, [esi + eax*2 - 2]
or eax, eax
mov word [esi + eax*2], dx
pop eax
jae fcn.01a6ab2d
not ecx
ror eax, 3
sub edx, edx
sbb edx, edx
dec eax
xor eax, 0x2d22049e
inc eax
xor ebx, eax
bswap edx
add edi, eax
sub dl, 0x3d
setns dl
imul cx, dx
mov ecx, dword [esi + edx]
neg dl
movzx eax, dx
push edx
lea esi, [esi + edx*4 + 4]
and byte [esp + edx*8], al
shr al, 4
or al, byte [ebp + eax]
mov byte [esp + edx*2], dl
bts edx, edx
not edx
adc ebp, 1
sar edx, 0x6b
xor al, bl
xor al, 0x25
and dword [esp], 0x24b36c27
adc al, dl
xor al, 0x3d
neg al
imul edx, edx
inc dl
neg dword [esp + edx - 2]
xor bl, al
shl dx, 0x21
sal byte [esp + edx*2 - 7], 5
ror dl, 0xc2
lea eax, [esp + eax + 4]
mov dword [eax + edx*4 - 4], ecx
lea ecx, [edx*8 - 0x714f31e2]
neg dx
imul edx, dword [esp + edx - 0xffff]
add dword [esp + edx*2], edi
ret

Function at 0x1a5ca60
Capabilities:
Execute syscall

Disassembly:
jp 0x1aa01e8
jmp esi
mov dword [esp], 0x621bba2
sbb ebp, 8
not word [esp + 1]
jmp 0x186f2a3

Function at 0x1a5f0b4
Capabilities:
Encode data using base64

Disassembly:
dec ebx
push 0xffb915bb
lea esp, [esp + 8]
jne 0x19d8f1f
Function at 0x1a63a40
Capabilities:
Encode data using base64

Disassembly:
ror edx, 1
inc edx
cwde
sal cl, 0x22
cbw
not edx
cbw
and eax, ecx
or ax, cx
neg edx
xor ebx, edx
add esi, edx
movzx edx, cl
xadd eax, ecx
bts eax, 0xa8
mov eax, dword [edi + eax - 0x1f8]
mov edx, dword [edi + ecx - 0xf8]
neg ecx
mov cl, byte [edi + 8]
push 0xae36af83
push 0xda2f4994
mov byte [esp + 3], 0x12
adc edi, 5
push 0xf09a569f
shld eax, edx, cl
pop edx
lea ecx, [edx*4 - 0x4d624048]
mov dword [edi + edx*2 + 0x1ecb52c2], eax
inc dx
mov dword [esp + edx*2 + 0x1ecb52c0], esi
ret 4
lea esp, [esp + 4]
ja 0x18ac292
mov eax, 0x172ba08e
mov edx, esp
movzx ecx, ax
sal eax, cl
call fcn.01a41c17
mov eax, 0x99b08787
sub ebp, 4
movsx edx, al
idiv ax
mov edx, dword [ebp]
and eax, eax
movzx ecx, al
sbb al, 0xa9
xor edx, ebx
rol eax, cl
jb 0x16d720c
mov eax, 0xcc23daa8
btc eax, eax
mov dx, word [ebp]
lea ecx, [eax + eax*4 + 0x1e8c6b2c]
shl ecx, cl
or cl, byte [ecx + ebp - 0x573ffffe]
not eax
lea ebp, [ebp + eax*2 - 0x67b848ac]
neg ax
shl dx, cl
ror al, 0x21
sbb eax, 0xf3b86827
mov word [ebp + eax - 0x402473ac], dx
cdq
lea eax, [eax*2 + 0x760d82bf]
lea esi, [esi + edx - 4]
lea ecx, [eax + 0x15ac9d1e]
lea edx, [edx*4 - 0x74cab65f]
mov edx, dword [esi + ecx*4 - 0x300c1cd4]
cwde
call fcn.0197c021
mov edx, 0x27a1a520
movsx ecx, dl
movzx eax, cl
mov edx, dword [ebp + edx*2 - 0x4f434a40]
lea ebp, [ebp + ecx - 0x1c]
shl eax, 0x66
xor ax, ax
sal ecx, 0x93
xor edx, ebx
sal eax, 0x65
btc ecx, 2
lea edx, [edx + ecx*2 + 0x2b220e78]
rol al, cl
shr ax, 0x65
xor edx, 0xf62e1220
neg cl
cwde
shr cx, 0x4f
inc edx
sar eax, 0xf6
not edx
je 0x1be0dc3
mov ecx, 0xc50c0091
push ecx
sub ebp, 4
mov ecx, dword [ebp]
push 0x21346e1e
mov eax, dword [esp + 4]
and word [esp + 1], ax
xor ecx, ebx
pop eax
jmp 0x1bafc7b
jmp 0x18da419
bswap ecx
cwde
mov byte [esp + eax*2 - 0x3c], ah
dec ecx
mov edx, dword [esp + eax - 0x1e]
neg ecx
xor edx, edx
xor al, dl
inc ecx
push edx
dec edx
neg word [esp + eax - 0x1c]
xor ebx, ecx
add byte [esp + eax*8 - 0xed], dl
adc esi, ecx
movzx ecx, ax
neg dx
sal byte [esp + eax*4 - 0x76], 0x87
mov eax, dword [edi + eax*2 - 0x3c]
mov cl, byte [edi + ecx - 0x1a]
dec dl
pop edx
btr edx, 0x3d
adc edi, 1
jmp 0x1762d0e

Function at 0x1a6601c
Capabilities:
Encode data using base64

Disassembly:
sal dword [esp + 0x10], 0xef
inc eax
jmp 0x1ae8128
jmp 0x1beca1c
xor edx, 0xd7323608
sal word [esp + 0x12], 0x6d
mov dword [esp], 0x1b0c4f31
dec ecx
not byte [esp + 4]
mov dword [esp + 0xc], 0x26a9d109
jmp 0x1c168f2

Function at 0x1a66909
Capabilities:
Encode data using base64

Disassembly:
pushfd
mov esi, 0x46afe73e
mov esi, dword [esp + esi - 0x46afe736]
mov dword [esp + 8], 0x7b52711c
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.01c0a32b

Function at 0x1ab0301
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0xc407], ecx
dec eax
inc edx
shl dl, cl
inc cl
neg eax
xor dword [esp + ecx*2 - 0x18810], edx
xor ebx, eax
add esi, eax
not dl
shr edx, cl
sal dword [esp + edx*2 - 0x170c408], 0x51
pop edx
jne fcn.01952f1c
Function at 0x1ab5759
Capabilities:
Encode data using xor

Disassembly:
shrd eax, edx, cl
mov edx, dword [esp + 4]
movsx ecx, dl
mov dword [esi], eax
sub ebp, 4
shl edx, 4
xchg word [esp + 1], cx
sbb ecx, ecx
mov eax, dword [ebp + ecx*2]
xor eax, ebx
shl byte [esp + ecx*8 + 1], 0xc5
mov word [esp + ecx*4 + 6], 0xeb88
shl ecx, 0xec
inc eax
bt edx, 0xbc
and byte [esp + ecx*4 + 2], ch
bswap eax
push ecx
adc dword [esp + ecx*2 + 8], edx
lea eax, [edx + eax - 0x6c21d44e]
not eax
pop edx
neg cl
sbb eax, 0xfc901a03
xor ebx, eax
mov dword [esp + edx + 4], edx
add edi, eax
shl word [esp + edx*2 + 1], 0x83
lea eax, [ecx + 0x6000ca1]
neg ax
mov dword [esp + edx], edi
ret 4
mov dword [esp], 0xe83dfe0d
push 0xdb1ad939
add esi, 6
sar word [esp + 4], 0xcf
jbe 0x15316b1
Function at 0x1ac0bc3
Capabilities:
Encode data using xor

Disassembly:
sal edx, cl
mov dword [esp + ecx*2 - 0x104], ecx
not eax
xor edx, 0xa38647bf
shr dl, 0xc4
call fcn.028c33dc
loopne 0x1ac0bdc
mov eax, dword [0xee3e92a0]
sub al, 0xc8
inc edi
jne 0x1ac0c18
sub eax, 0x96699c9
jno 0x1ac0c5e
insd dword es:[edi], dx
mov byte [0xe4403591], al
pop esp
jae 0x1ac0c67
adc eax, 0x7b46fe1e
mov edx, 0xf1bdced4
inc ecx
push cs
lea edx, [edx - 0x5ade34da]
cmp cl, al
popal
shl al, cl
cmpsd dword [esi], dword es:[edi]
push 0x672f2f1a
jae 0x1ac0c95
jae 0x1ac0c1b
jnp 0x1ac0bda
sub dword [eax - 0xe9b0890], 0xf2585b45
sub eax, 0xf09dc6a9
test al, 0x70
mul dword [ecx + esi*8 + 0x45]
pop ebx
pop eax
sub eax, 0xf09dc6a9
xor eax, 0x41a9eea6
invalid
pop es
mov ah, byte [esi - 0x2e]
out 0xff, al
cld
invalid
adc byte [ecx - 0x42e764c1], ch
sub edx, dword [eax]
pop edx
xchg dword [edi - 0x3a], edi
outsb dx, byte [esi]
dec edx
push ecx
or cl, byte [eax]
test dword [edx - 0x6c6ccd2], ecx
aaa
cmp eax, 0xbee5fbce
lodsb al, byte [esi]
outsd dx, dword [esi]
push ebx
int3
or al, 0xad
push edx
jae 0x1ac0cce
inc esp
mov cl, 0x22
fmul dword [eax]
mov dh, 0x2a
cmp ch, byte [ebx - 0x35f06524]
mov word [edx - 0xa], ss
int1
xchg edx, eax
add esp, dword [ebx + 0x1e]
sbb esp, ebx
ret 0x7a6d
bound ebx, qword [eax + 0x7a7ce33b]
cmp esp, ebx
jl 0x1ac0d4e
cmc
mov edi, ds
lodsd eax, dword [esi]
pushal
inc esi
aas
push edi
xor byte [edi - 0x3d1f01f6], ah
add dh, byte [esi + eax*4]
fadd dword [ecx + 0x1d]
loopne 0x1ac0cd0
add eax, 0x342d74d1
jo 0x1ac0cf9
sbb ebx, dword [ebx]
jns 0x1ac0d43
rcr byte [eax + esi], 0x79
clc
cmp al, 0x9e
in eax, 0x2a
in eax, 0xb6
pop eax
cld
pop edi
xchg ecx, eax
dec ebx
xchg ebx, eax
mov ebx, 0x9b43dccc
mov al, byte [0xb52ca9e8]
jae 0x1ac0d25
scasb al, byte es:[edi]
wait
pop es
xchg ecx, eax
salc
inc edi
clc
and byte [edx + 0x1ec3081a], dh
push esp
inc esp
mov esi, 0xb55c9b5c
daa
pop esp
wait
pop esp
mov ch, 0x27
push ss
push ebx
bswap edx
mov esp, 0x29edc2ac
cmp cl, ch
test esi, esp
in eax, dx
sbb al, 0x65
dec ecx
in al, 0xb3
insb byte es:[edi], dx
idiv dword [eax + 0xa]
sal dword [esi + edi*8 - 0x4f], 0x84
dec ecx
bound ecx, qword [eax - 0x1a]
jle 0x1ac0d5d
invalid
mov bh, 0x2b
retf
not esp
sbb byte [edi - 0x2eae6c48], dh
lds ecx, [ebx]
loopne 0x1ac0d95
fmul qword [0x5b870a0]
or eax, dword [edx + 0x5a3c0e13]
sahf
in al, 0xa5
invalid
and byte [eax + 0x35678a69], ah
jp 0x1ac0dd2
xchg edi, eax
out dx, al
add eax, 0x10bb3690
cmpsd dword [esi], dword es:[edi]
sbb byte [esp + eax*8 + 0x19ecbd12], al
invalid
mov al, 0xae
je 0x1ac0de7
dec ebx
popfd
xor dword [esi + 0x567e5914], 0x68099bc5
das
ror byte [edi + ebp*2 + 0x337629e5], 1
sub dword [esi + 0x33], esi
pop eax
jmp 0xb9a4369
Function at 0x1ac1333
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx ecx, dx
btr ecx, 0xaf
xor al, byte [esi + edx*2 - 0x3d9c626c]
shr cl, 0x27
lea esi, [esi + edx*4 - 0x7b38c4d7]
xor al, bl
inc dword [esp + ecx - 0x3100]
neg al
imul dx, dx
neg dword [esp + edx*4 - 0x7b38c4d8]
xor ebx, ecx
add edi, ecx
jmp 0x171ca55
jnp 0x1a38e58
sbb eax, 0xb6989e1b
sal dl, 0xe1
push edx
xor ebx, eax
add edi, eax
lea ecx, [edx*8 + 0x3ea74198]
pop edx
not edx
mov ecx, dword [ebp + ecx*2 - 0x7e54d3d0]
mov edx, dword [ebp + 4]
mov dword [esp], 0xb425dca6
mov eax, 0x7ab072a4
lea ebp, [ebp + eax - 0x7ab072a0]
dec eax
sub al, 0x23
adc ecx, edx
pop eax
movzx edx, ax
mov dword [ebp + edx - 0xdca6], ecx
rol eax, 0xdd
inc edx
btc eax, 0x8b
jmp edi
Function at 0x1ad00bb
Capabilities:
Encode data using base64

Disassembly:
sbb edx, 0xf18049ab
cbw
dec ecx
btr eax, 0x8a
xor edx, 0xea16c407
inc ecx
imul ebx, edi
dec ebp
btc edi, edi
rol ax, 0x6e
sbb edx, 0xb138568f
inc ecx
push edx
not edx
dec esi
or edi, dword [esp + esi*2 - 0x61b0]
inc edx
movsx ecx, word [esp + esi*2 - 0x61ae]
inc edx
adc byte [esp + esi - 0x30d6], cl
ror edx, 1
inc cx
bts esi, eax
dec esi
mov dword [esp + esi - 0x30d8], ecx
movsx ebp, cl
push ecx
inc ecx
setb ah
inc edx
xor dword [esp + esi*2 - 0x61a8], edx
inc edx
sal byte [esp + esi - 0x30d4], 0x46
call fcn.01adf84e
lea ebp, [ebp + edx - 0x5ca9cd1f]
mov ecx, dword [esp + edx - 0x5ca9cd17]
xor eax, ebx
xor cx, dx
bts dx, dx
btc cx, 0xbe
lea eax, [eax + edx*2 + 0x17bfd84a]
neg eax
rol dx, 0x69
inc edx
lea eax, [eax + ecx - 0x5cf64b78]
shr ecx, 0x21
xor eax, 0x841431a0
pop edx
btc dx, cx
inc eax
sub word [esp + ecx - 0x69012ac9], cx
js 0x1ac8bb0
not edx
inc edx
xor ebx, edx
xor eax, dword [esp]
adc edi, edx
pop ecx
not cl
jmp edi
btc ecx, 5
xor ebx, eax
call fcn.01bb6d9e
sbb eax, 0xae93703f
call fcn.0183b463
xor ecx, esi
dec dword [esp + 6]
jge 0x18991d8
inc edx
not word [esp + 0xc]
xor ecx, 0xcd36b70b
dec eax
call fcn.017585c3
xor edx, ebx
lea ecx, [ecx + eax + 0x7d0a8d01]
neg word [esp + eax*2 - 0x6430021c]
xchg byte [esp + eax - 0x3218010e], al
neg edx
sal cl, 0x47
inc byte [esp + eax - 0x321800fb]
rol edx, 1
xchg ecx, eax
dec edx
neg byte [esp + ecx - 0x321800fa]
add cx, cx
dec dword [esp + ecx*2 - 0x64300400]
not edx
jne 0x1bd867f
inc ecx
xor edx, ecx
inc ecx
inc edx
dec ebp
bt edx, edx
inc ecx
not dh
not edx
inc ebp
movzx edi, dx
inc esp
btc ebx, esi
dec ebp
adc edi, esi
xor edx, 0xfe39730b
neg ax
shl bl, 0x42
jbe 0x181277c
mov ecx, 0x1a145a8b
push ecx
movzx ecx, byte [ebp + ecx*2 - 0x3428b516]
jmp 0x1c391c3
inc ax
lea edx, [edx + ecx*2 + 0x4f7fe8ac]
pop eax
sbb ecx, 0x598fd5be
jno 0x18e74d6
dec edi
lea edx, [esp + ebp*4 - 0x72e2ecd0]
inc di
mov ebp, dword [esi + eax - 0x3027]
dec edx
lea esi, [esi + esi - 0x3021]
dec ebx
lea eax, [esi + edx*2 + 0x6f17e4b3]
inc bp
mov dword [esi + esi - 0x3027], ebp
dec edi
lea ebx, [esi + ebx - 0x302b]
inc ecx
mov eax, 0x3f91eeaa
inc ecx
movsx ebx, ah
bt ebx, ebx
inc ebx
mov edx, dword [ebx + esi*2 - 0x604e]
jb 0x1b9b445
fisubr dword [edx + 0x13]
mov eax, dword [0x738538c8]
fild qword [eax]
mov cl, 0x9c
mov al, byte [0x989aa3ad]
sar dword [edi - 0x66b5cf90], 1
mov dword [ecx], 0xdd9ceff1
inc ecx
inc dl
mov dl, 0xef
out dx, eax
jno 0x1bd876d
invalid
pmaddwd mm7, qword [ebp + edx*2 - 0x4384bf18]
mov byte [esi + 8], bl
aaa
dec ebx
retf 0x1d4b
ror dword [esp], 0x8b
mov eax, dword [esp]
lea ebp, [eax + ebp - 0x5163428a]
xor cl, bl
mov edx, dword [esp + eax - 0x5163428b]
sar dl, 0xe7
adc cl, 0x87
ror cl, 1
mul eax
not cl
ror word [esp + edx - 0x19dff697], 0x4c
sal ax, 0x29
neg cl
neg dl
xor eax, eax
or word [esp + eax], 0x2990
xor bl, cl
bt eax, edx
shr edx, 0x13
sar dl, 0xc1
mov dword [esp + eax], ebp
bts ax, ax
push edx
neg eax
mov dword [esp + edx - 0x31d], esi
mov ebp, 0xdda21d09
neg edx
call fcn.0174b5ba
Function at 0x1ad1f3a
Capabilities:
Encode data using base64

Disassembly:
jae 0x1a5f5c1
mov edx, dword [ebp]
mov ecx, 0xea19eba2
shr cl, cl
movsx eax, cl
lea ebp, [eax + ebp - 0x24]
xor edx, ebx
ror edx, 1
xor ecx, 0xce80c02b
dec ecx
sbb eax, ecx
neg edx
dec cl
sub edx, 0xb5079e89
dec ecx
shr eax, 0xf0
ror edx, 1
inc ecx
neg edx
sar cx, cl
cwde
or al, al
ror edx, 1
xor ebx, edx
add edi, edx
call fcn.017b6b47
mov ecx, 0x3432969b
mov eax, 0x971b5a9b
mov edx, dword [esi + ecx*2 - 0x68652d36]
mov ecx, dword fs:[edx + ecx*2 - 0x68652d36]
ror al, 0x46
bt eax, eax
movzx edx, ax
mov dword [esi + edx - 0x5a6e], ecx
setae al
dec edx
lea edi, [edi + edx*2 - 0xb4de]
jo 0x186bef2
movsx ecx, dx
xchg cl, dl
mov ecx, dword [edi + edx - 0x5a6d]
xor ecx, ebx
bt dx, ax
shr eax, 0x93
neg ecx
inc ecx
xor dx, ax
or edx, eax
rol ecx, 2
inc ecx
btc edx, 0xa6
sal edx, 0x90
neg ecx
push edx
xor ebx, ecx
push eax
mul eax
adc ebp, ecx
mov dword [esp + edx*2], ebp
ret 4
xor ebx, edx
add edi, edx
btr ax, cx
jae 0x1a14030
sar edx, 0x27
lea ebp, [ebp + edx - 0xae0]
imul dx, dx
mov dword [esp + edx - 0xf240], edx
bts dx, dx
mov dword ss:[ecx + edx - 0xf241], eax
ror dword [esp + edx - 0xf241], 0xbf
jb 0x18d48ec
lea ecx, [edx - 0xc4f58d8]
mov edx, dword [esi + edx - 0xf241]
add cx, cx
mov dword [esp], 0x5f22d4b4
adc esi, 3
xchg word [esp + 2], cx
push ecx
imul ecx, ecx
xor edx, ebx
bswap edx
lea edx, [edx + ecx*4 - 0x48679488]
xor dword [esp + ecx*2 - 0x78bc8104], ecx
movzx eax, word [esp + ecx - 0x3c5e4080]
not edx
shr dword [esp + ecx - 0x3c5e4082], 0x70
sal byte [esp + ecx - 0x3c5e407d], 0x81
pop ecx
lea edx, [ecx + edx + 0x18da9dfd]
jno 0x1899903
mov eax, 0x8e8a102c
mov edx, dword [ebp]
lea ecx, [eax + eax*4 - 0x685dae73]
lea ebp, [ebp + ecx - 0x6054a265]
jmp 0x16cc730

Function at 0x1af8411
Capabilities:
Encode data using xor

Disassembly:
ror ebx, 3
inc esp
movzx ebp, dx
dec ebp
bt edi, edi
dec eax
mov dword [esp + edx*4], edx
inc ecx
lea ebx, [edi + ebx - 0x4d7c89e9]
dec eax
dec dword [esp + edx]
dec esi
or ebp, dword [esp + edi - 0x5db9300b]
inc ecx
xor ebx, ebp
sub ebx, 0x89385901
not byte [esp + edx + 2]
inc ebp
xadd ch, ah
sar dx, 0x29
dec esp
mov dword [esp + edx], ecx
xor dword [esp + edx], ebx
inc ecx
pop ecx
dec ecx
inc esp
inc ebp
movzx esi, sp
dec ecx
shr esi, 6
dec eax
arpl bx, bx
div ax
dec eax
add edi, ebx
inc ecx
push edi
idiv eax
rdtsc
jmp 0x1a3ed17
Function at 0x1af9b02
Capabilities:
Encode data using xor

Disassembly:
btc ax, dx
xor ecx, ebx
bts ax, ax
inc al
bswap ecx
jne 0x1973b47
xchg dword [edx - 0x43dfec3e], ebx
dec ch
xor dl, ch
mov edi, 0x236f2c04
inc ebx
mov ch, byte [ecx + 0x2b]
inc ecx
xor eax, dword [ebp - 0x75]
mov esi, 0xc50097b9
jbe 0x1af9b65
mov byte [0xdf91af40], al
mov dword [0x591c020d], eax
add byte [ebp + 0x6409994c], 0x84
scasd eax, dword es:[edi]
out 0x16, al
jbe 0x1af9b5a
std
jmp 0x1af9ba6
xchg ecx, eax
sbb al, 0x8c
mov dword [eax + edi*2 - 0x40113130], esi
xor byte [ecx], 0x91
xchg ecx, eax
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
jp 0x1af9b4e
mov edi, 0xa30d6d77
inc edi
fidivr dword [edx]
mov cl, 0x59
dec edx
inc esi
xchg dword [ebp - 0x22e147e1], ebx
movsd dword es:[edi], dword [esi]
push esi
cmp ch, ah
out 0x9b, al
pop ebx
and dword [esi + 0xa], esp
sbb ebx, edi
sub dword [eax - 0x4600f59], 0x66
cmp dword [eax], eax
sti
in al, 0x6c
rcr edi, 0xf3
xchg ebp, eax
in al, dx
cmp eax, dword [ebx]
shl dh, 1
jmp 0x1af9b16
add ebx, edi
inc ebx
dec ebp
cmc
ret

Function at 0x1b04c02
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
je 0x17c8e83
push 0x3137b104
mov dword [esp], ebx
mov ebx, 0xa1b77819
movzx ebx, byte [edx]
xor ebx, eax
call int.027e248d
mov eax, 0xbfb2cea6
movzx edx, ax
mov edx, dword [esi + edx*2 - 0x19d4c]
mov ecx, 0x20289905
mov cx, word [esi + ecx*2 - 0x40513206]
sar al, 0xe4
bt eax, eax
adc esi, 1
bts ax, ax
bswap eax
call fcn.02875bd0
call fcn.017626b0
lea esp, [esp + 4]
jne 0x1b719e6
Function at 0x1b4a418
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp + edx - 0x4ba1c7a7]
call fcn.0196ce40

Function at 0x1b4f534
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x64], 0xfc0fcda6
rol ecx, 1
xadd ax, dx
shl al, 1
or edx, eax
bswap ecx
mov dword [esp + eax*2 - 0x1a4], 0xab1aa49f
div word [esp + edx - 0xf6]
shr dx, 0x8e
not ecx
cwde
and ax, 0xb204
shl eax, 0x1a
xor ebx, ecx
sub dl, dh
adc esi, ecx
imul edx, dword [esp + eax*8 - 0x7ffffffc]
btr edx, eax
adc dword [esp + eax - 0xffffffd], eax
add dl, byte [eax + ebp - 0x10000000]
cwde
lea ebp, [ebp + eax*8 + 1]
rol ax, 6
cbw
add word [esp + eax + 3], 0xec3a
xor dl, bl
or word [esp + eax + 6], ax
ror word [esp + eax*2 + 5], 0x65
je 0x17afbc0
ror dl, 1
ror ax, 0xcf
movsx ecx, byte [esp + eax + 3]
xor dl, 0x10
neg dl
btc ecx, 0xbd
sbb dl, 0x2d
not dword [esp + eax*2 + 3]
sar byte [esp + eax*2 + 1], cl
neg dl
not ecx
ror dword [esp + eax*8], cl
sbb dl, 0x3c
xor bl, dl
sal cx, 0xe4
sbb dword [esp + eax + 1], ecx
lea edx, [esp + edx + 8]
pop eax
adc eax, dword [esp + ecx*2 - 0x40000340]
and ax, ax
mov cx, word [ecx + edx - 0x200001a0]
sbb edi, 2
shl word [esp + 2], 0x46
jbe 0x1b53e27
lea esi, [esi + eax*2 - 0x906e]
add eax, eax
cbw
dec eax
shr dx, cl
mov word [esi + eax - 0x6f], dx
jmp ebp
mov word [edi], cx
shr ax, 0xcd
neg ax
pop ecx
jb fcn.01bb934d
dec esi
jbe 0x1b53e8e
add dh, bh
dec ecx
lds edi, es:[eax + edi*2 + 0x5b]
pushal
out dx, eax
cmp dword [esi + 0x5f], ebp
ja 0x1b53f09
mov al, byte [0x901183a3]
xor eax, 0xa76350ba
pop esi
mov esi, 0x64d47121
idiv byte [edi + 0x4f6dcf37]
mov edx, 0x6a5e8f2d
xchg esp, eax
pop ds
and edx, edi
cmp byte ds:[eax], bl
inc edx
adc byte [ecx - 0x4667fdee], ah
pop es
jb 0x1b53f2e
das
mov dword [edi + 0x4bb301fd], 0x8ffb1cdd
invalid
mov ah, 0x2d
dec edi
mov byte [ecx + 0x62c63feb], dh
in eax, 0x1a
lea esi, [ecx]
hlt
push ss
invalid

Function at 0x1b5f3c4
Capabilities:
Encode data using base64

Disassembly:
shr eax, 0x7f
bswap edx
not byte [esp + eax*4 + 6]
call fcn.028b9c49
push 0x9ca11d41
call fcn.0193102c

Function at 0x1b62880
Capabilities:
Encode data using base64

Disassembly:
neg ecx
mov edx, dword [ebp + edx - 0x506d0600]
call fcn.019b16e7

Function at 0x1b6c8f7
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xe36a3f1c
call fcn.01c0a32b
Function at 0x1b6f402
Capabilities:
Encode data using xor

Disassembly:
xor esi, ecx
call fcn.0287d8a5
pushfd
in al, 0xd0
add byte [edi + 0x7a], cl
dec eax
dec edi
jp 0x1b6f454
das
fiadd dword [ebx + 0x30]
clc
push esp
ja 0x1b6f46c
add eax, 0x181863f6
jbe 0x1b6f43e
lahf
cmc
shl dword [ebp + 0x4d], 0x1f
in al, 1
adc dword [eax + 0x12], ebx
daa
sti
invalid
inc ebx
xchg ebp, eax
std
sal byte [ecx], 0x3c
and eax, 0xc46145b3
jnp 0x1b6f4bf
mov ds, word [esi - 0x5a]
pop esi
cmpsb byte [esi], byte es:[edi]
add byte [edx], 0x37
xor dword [ecx + 0x51], esp
push ecx
jecxz 0x1b6f4a7
loope 0x1b6f4cd
xchg dword [esi], ecx
push ds
pop edi
jge 0x1b6f44d
stc
xchg ebx, eax
jnp 0x1b6f43e
adc dl, ch
xlatb
xchg esi, eax
mov ch, 0x8a
push ecx
invalid
mov cl, 0x24
out dx, eax
pop ds
inc esi
insd dword es:[edi], dx
mov bh, 0xf2
jns 0x1b6f405
push ecx
mov ah, 0x3e
push ebp
xor esp, ecx
pop edx
sbb eax, 0xdf991e87
push ecx
sub byte [esi], cl
jno 0x1b6f409
push eax
xchg ebp, eax
dec ebp
sub al, byte [ecx]
mov ch, 0x48
mov esp, cs
mov ecx, 0x19268be8
out dx, al
jno 0x1b6f427
mov cl, 4
push 0x5c00c77d
xor bl, al
dec esp
mov esi, 0xea3e9920
jecxz 0x1b6f457
imul eax, dword [esp + edx*8], 0xd85cc9b0
shl byte [ecx + 0x55083d0], cl
and byte [eax], bh
sub cl, byte [esi - 0x4b]
salc
sbb byte [ebx + ebp*2 - 0x392ed455], 0x46
invalid
stosd dword es:[edi], eax
sub edx, ecx
mov byte [esi - 0x72], 0xfc
mov al, cl
clc
or ecx, esp
out 0x95, eax
sahf
mov eax, 0xc277d747
insd dword es:[edi], dx
nop
insb byte es:[edi], dx
test dword [esi - 0x35], 0xc0ea5e73
aad 0xfe
sub word [esi + edx + 0x35], sp
jnp 0x1b6f543
push eax
or byte [eax + ecx*8], 0x51
add eax, 0xbb9fc39c
cmpsb byte [esi], byte es:[edi]
mov ecx, 0x7d661969
xor eax, 0x9f0b9de
and ecx, esi
push ss
lodsb al, byte ss:[esi]
xchg ebx, eax
hlt
arpl word [ebp + 0x2419a226], sp
xchg edi, eax
pop ebp
pop esi
mov ch, 0x66
fidiv dword [esi - 0x67]
invalid
shr edx, cl
sbb al, 0xa1
in eax, dx
je 0x1b6f521
pop ecx
push es
int3