joyce8/EMBER2024-capa huggingface dataset:
Function at 0x83ffa1
Capabilities:
Encode data using xor

Disassembly:
iretd
ror eax, 1
sar edx, cl
push ecx
xor ebx, eax
pop edx
add ebp, eax
lea eax, [ecx + ecx*2 - 0x18ed8772]
btc eax, edx
mov ax, word [eax + edi - 0x79f301c9]
sub dx, dx
jbe 0x92c3d2
lodsb al, byte [esi]
adc dh, 0xfa
xchg dword [edi + 0x5a], ebx
lodsb al, byte [esi]
cmp eax, 0xa9c52965
and byte [ebp + 0x21], al
jecxz 0x7cb8e0
fstp xword [edx]
jp 0x7cb962
xor ah, byte [ebp + 0x356b8b6e]
mov dword gs:[ebp + 0x54], esi
push ss
les edi, [edx - 0x2531b577]
imul ebx, dword [edi - 0x6534c901], 0xffffffd2
int1
fcomp dword [edx - 7]
popfd
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ss
test dword [ecx + 0x23], edx
mov ebx, dword [edi + 0x407c8dc3]
test dl, bh
dec ebx
pop ss
or ax, 0x656d
sbb ecx, esp
or byte [eax + 0x45], dh
popal
invalid
mov dword [edx - 0x32], ecx
fisubr dword [ebx - 0x61]
push dword [esi]
retf
xor ax, bx
neg ax
xor ax, 0x20a9
not ax
pop ecx
ror ax, 1
movsx ecx, dl
xor bx, ax
push ecx
and dword [esp + ecx - 0x1c], 0xba80ce14
lea edi, [ecx + edi - 0x1e]
add word [esp + ecx*2 - 0x37], cx
rol cl, 0xe2
sbb cl, 0xa9
mov word [edi + ecx*2 - 0x18e], ax
sub dword [esp + ecx*4 - 0x31c], edx
add word [esp + ecx - 0xc5], 0x95ac
inc cx
lea ebp, [ebp + ecx*8 - 0x644]
dec byte [esp + ecx - 0xc5]
lea eax, [ecx*8 - 0x56f79b71]
mov ecx, dword [ebp + ecx - 0xc8]
and al, 0x93
ror ax, 0xcd
sar dl, 0x21
xor ecx, ebx
pop edx
xor al, ah
add eax, 0x9a28bb
rol ecx, 3
not ecx
btc eax, edx
dec ecx
xor ecx, 0xb6a8f839
inc dl
xor ebx, ecx
add dx, 0xd01a
add esi, ecx
push eax
dec dword [esp]
or dl, al
pop eax
jno fcn.007355cd
xor eax, eax
adc ebp, edx
mov edx, dword [esi + eax]
call fcn.007cb8e3
mov eax, 0x7914eb3b
lea ebp, [ebp + eax - 0x7914eb3f]
mov ecx, dword [eax + ebp - 0x7914eb3b]
xor ecx, ebx
cwde
add al, ah
rol ecx, 2
lea ecx, [eax + ecx - 0x73f52585]
btr eax, eax
bswap ecx
lea edx, [eax*4 - 0x5cd2b871]
inc ecx
dec edx
not ecx
or al, 0x3d
setae al
push edx
inc ecx
push eax
call fcn.00871c99
xor edx, edx
xor eax, 0xd9a062b4
xadd edx, ecx
sbb cl, dl
dec eax
sar dx, 0xe5
btc dx, cx
rol cl, 0x43
ror eax, 1
lea eax, [edx + eax - 0x646730bd]
and cl, dh
neg eax
btc cx, dx
inc ecx
lea ecx, [ecx + edx*8 - 0x245fd3f2]
inc eax
xor edx, edx
bswap eax
jne 0xd279e1
cmovns dx, cx
je 0x7cb91a
inc esp
movsx esi, bx
inc esp
adc eax, edx
xor dword [esp + eax - 0x88d], ecx
inc ecx
pop esi
inc ecx
add esp, 0xd09ad615
dec eax
arpl cx, cx
dec esp
adc edi, ecx
cwde
inc bp
bts ecx, ecx
dec eax
mov ebp, dword [ebx + edi - 0x71a30000]
inc sp
mov eax, dword [edi + ebx - 0x71a2fff8]
dec ebp
xadd ebx, ecx
dec edx
lea edi, [edi + ecx*2 + 0xa]
jno 0xd72858
inc sp
mov dword [ebx + ebp - 0x71a30000], eax
cdq
inc bp
bt ecx, ecx
movzx ebp, ax
dec ebp
adc ecx, edi
inc ecx
jmp ecx
Function at 0x842af9
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
or ax, 0x7125
mov ax, word [ecx]
lea ecx, [edx*4 - 0x3e71e0e2]
rol dx, 0xe9
inc ecx
sbb esi, 1
rol dword [esp], cl
or cx, word [esp + 1]
neg dword [esp]
mov word [esi], ax
sar edx, 0xca
pop eax
jp fcn.009f2e39
push 0xce8be304
jae 0xd8f845
rdtsc
mov ecx, 0x2910c415
sal ecx, 0xcf
lea ebp, [ebp + ecx - 0x620a8008]
btr ecx, ecx
mov dword [ebp + ecx - 0x620a7ffc], eax
xor cx, cx
neg ecx
mov dword [ebp], edx
not ecx
movsx eax, cl
sub cl, ch
mov edx, dword [esi + ecx - 0x6209ff00]
sal al, 0xc1
lea esi, [esi + ecx - 0x6209fefc]
setne cl
add cl, 0x2d
xor edx, ebx
xor eax, eax
bswap edx
lea edx, [edx + ecx + 0x108633f0]
rol eax, 0xb5
sbb al, al
lea ecx, [eax*2 - 0x21e2dddc]
not edx
call fcn.00812708
not cl
add ebp, eax
movzx ecx, byte [edi + ecx*2 - 0x116e8]
mov dword [esp], edx
add edi, 1
lea eax, [edx*2 - 0x1473ad7d]
and edx, 0x8fa9c487
xor cl, bl
add cl, 0x20
shr edx, 0xf2
bts eax, edx
sal edx, 0x77
xor cl, 0x9b
neg dx
rol cl, 1
ror edx, 0x36
dec cl
xor bl, cl
mov byte [esp + edx*8 - 0x1e99], ah
btr eax, edx
rol word [esp + edx*4 - 0xf4a], 0x2b
lea ecx, [esp + ecx + 8]
pop edx
jae 0x7c067e
adc ebp, 4
shl dword [esp], 0x4b
setp byte [esp + 2]
ror byte [esp], 0x83
shld ax, dx, cl
mov word [ebp], ax
call fcn.00d18ca8
mov eax, 0x4b0d9da6
xchg ah, al
mov ecx, dword [esi + eax - 0x4b0da69d]
dec eax
movzx dx, byte [eax + ecx - 0x4b0da69c]
mov ecx, eax
bswap eax
lea esi, [esi + ecx - 0x4b0da69a]
call fcn.00d014c2

Function at 0x8464b7
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x491f011
sar dword [esp], 0xec
xor eax, ebx
sal dword [esp], 0xf
sal byte [esp + 2], 0xe4
jp 0x870da3
dec eax
shl byte [esp], 0xa5
ja 0x8b110f
bswap eax
inc eax
call fcn.008ddaa7

Function at 0x84bad4
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax*2 - 0x186], edx
pop eax
pop ecx
pop eax
pop eax
jae fcn.009f2e39

Function at 0x84c083
Capabilities:
Encode data using xor

Disassembly:
btc ecx, ecx
mov dword [esp + edx], 0x5f98fcad
neg eax
call fcn.0087377d
mov eax, 0xc70d2b2f
shr al, 0xa2
mov edx, dword [edi]
movzx ecx, al
xor cx, 0xee36
and ecx, ecx
lea edi, [edi + ecx - 0xee39]
bt eax, eax
shr ecx, 0x29
xor edx, ebx
lea ecx, [eax + ecx*8 - 0x77e1715f]
xor edx, 0x4033c526
ror al, 0xa6
adc cl, cl
ror ecx, 0xdb
rol edx, 1
dec edx
lea eax, [eax*4 + 0x61aa6790]
cbw
neg edx
bswap eax
xor cl, 0x2d
xor ebx, edx
call fcn.008ed900
mov eax, 0x18ba5d17
dec eax
bt eax, eax
inc esp
movzx ecx, al
dec eax
lea esi, [esi + eax*2 - 0x3174ba32]
inc esp
movsx eax, ax
inc ecx
mov ecx, eax
dec ebp
lea edx, [eax + eax*8 + 0x2a37b6a1]
mov eax, dword [esi + eax*2 - 0x3174ba2e]
inc ecx
mov ebp, edx
inc ecx
xor eax, esi
movzx edx, cl
not eax
inc eax
inc ecx
mov ebx, 0x1e87e329
ror eax, 3
dec eax
inc ecx
push esi
inc edx
xor dword [esp + ecx - 0x17], eax
inc ecx
pop esi
inc ecx
mov esp, 0xbbff725
dec eax
arpl ax, ax
inc ebp
xor bl, ah
inc ecx
seto al
dec esp
adc edi, eax
dec esi
mov ebx, dword [edi + ecx - 0x17]
inc ebp
bts eax, edx
call fcn.007617de
jb 0x84c132
in eax, 0xff
add ebp, esi
mov esp, ds
int3
Function at 0x85075f
Capabilities:
Encode data using base64

Disassembly:
dec ebx
jmp 0xd11019
mov eax, 0x8095e8b7
and al, al
mov eax, dword [ebp + ebx*4]
push 0x62a1f8a5
rol dword [esp], 0x61
mov dword [esp], eax
push 0xe5bd6812
dec dword [esp]
call fcn.0085075f
lea esp, [esp + 8]
jne 0x8dac82
mov eax, 0xf3bccc15
call fcn.00d64c2d

Function at 0x85b7eb
Capabilities:
Encode data using base64

Disassembly:
jmp 0xda2a08
or dword [esp + 0xe], 0xd2a0562c
xor ecx, 0x4615bd8d
mov dword [esp + 8], 0x990c4895
dec edx
jmp 0x8158cc
lea esp, [esp + 0x1c]
jne 0x79ea2c
mov ebx, 0xd283138d
xor bl, 0x1a
movzx eax, bl
pop ebx
jmp 0xd1bb0a

Function at 0x86592e
Capabilities:
Encode data using base64

Disassembly:
push esi
pushfd
mov esi, 0x7d9876ba
lea esi, [esi*2 - 0x1848baca]
or esi, esi
and esi, 0x7c33ee93
mov esi, dword [esp + esi - 0x6020227e]
mov dword [esp + 4], 0xfa7a7b67
push dword [esp]
popfd
lea esp, [esp + 4]
call int.008ac23d

Function at 0x86fbb6
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + ecx - 0x2ca2d0a7]
call fcn.0075e871
mov ecx, 0x458f970f
movzx eax, cl
bt cx, ax
mov eax, dword [esi + eax - 0xf]
mov edx, ecx
setae cl
or edx, 0xa29fe918
mov ecx, dword [esi + ecx - 0x458f96fc]
btc edx, edx
push ebx
jb 0x920b16
movzx ecx, byte [esi + edx - 0x798cf3b0]
mov eax, edx
not dl
xor cl, bl
shr eax, 0x85
bt dx, ax
sub dx, 0xea20
dec cl
add edx, 0xd9a448ac
cdq
xor dx, dx
rol cl, 1
shr eax, 0x2f
neg cl
shr eax, 0x56
cbw
ror cl, 1
or eax, edx
not cl
xor eax, eax
inc edx
sbb cl, 0x39
not edx
shr dx, 4
sal edx, 0x7d
rol cl, 1
inc cl
xor bl, cl
xadd eax, edx
bts ax, dx
neg dl
adc ecx, esp
xor edx, dword [edx + ecx]
sub edi, 4
movzx ecx, al
neg eax
sar eax, cl
mov dword [edi + eax*2 - 0x1ffffffe], edx
and ax, 0xc3b7
lea esi, [esi + eax*2 - 0x1fff8772]
mov edx, eax
ror cl, 0x64
inc ecx
mov edx, dword [esi + eax - 0xfffc3b7]
not ecx
setle al
xor edx, ebx
add ax, 0xccb2
sub cx, 0x100c
inc ecx
lea edx, [eax + edx - 0x258cef69]
btc ecx, ecx
bts ecx, 0xf
shr ecx, 0x3b
bswap edx
or ecx, ecx
xor edx, 0x79836c9d
shr cl, 0xe4
bt cx, ax
setae al
sbb edx, ecx
not ecx
xor ebx, edx
and cl, al
rol ecx, 0x5f
adc ebp, edx
movsx edx, ax
jmp fcn.00828bba
cpuid
sbb esi, 7
call fcn.007ec679

Function at 0x8871e0
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push 0x53b5fda7
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x7304fb

Function at 0x88c085
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xec7601ac
call fcn.0099676a
Function at 0x89fdca
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec ecx
xadd dl, ah
sub dl, al
xor ecx, 0x5533cf85
sal dl, 0xa5
call fcn.009ffec9
wait
inc ebx
aas
invalid
lea esi, [ecx + esi - 0xa2a3]
mov eax, dword [ecx + esi - 0xa29f]
sbb word [esp + ecx*4 - 0x28a7c], cx
xor eax, ebx
not dword [esp + ecx - 0xa29f]
rol eax, 3
neg cl
pop edx
ror ecx, 0x15
inc eax
shr cl, 0xc7
rol eax, 1
sub dl, 0x92
jbe 0x8789bc
call fcn.007b24c1
sub ebp, 4
mov ecx, 0x3a8be24
mov ecx, dword [ebp + ecx - 0x3a8be24]
mov eax, 0xad972515
movzx edx, al
and al, ah
xor ecx, ebx
cwd
jmp 0x7e7cb1
mov dword [esp + ecx - 0x6800], 0xa103d0b7
mov ax, word [edi + ecx*4 - 0x19ffc]
adc cx, 0x3a9f
lea edi, [ecx + edi - 0xa299]
add word [esp + ecx*2 - 0x1453e], 0x4ead
mov word [edx + ecx*2 - 0x1453e], ax
movzx eax, word [esp + ecx - 0xa29f]
jg 0x83ce55

Function at 0x8a0802
Capabilities:
Encode data using base64

Disassembly:
pop edx
adc edi, 6
mov edx, 0x1aa71697
mov byte [ecx + edx - 0x1aa71697], al
lea esi, [esi + edx - 0x1aa7169b]
or edx, 0xf30f0392
mov eax, dword [esi]
xor eax, ebx
push edx
mov byte [esp + 3], dh
call fcn.00d00e93
mov eax, 0xec20e783
mov dx, word [esi]
movsx ecx, al
mov cl, byte [esi + 2]
inc ax
bts ax, 9
adc esi, 1
shr dx, cl
mov word [esi], dx
sar eax, 0x5b
jnp 0xd68315
rol ecx, 2
add ecx, edx
not dl
xor ebx, ecx
add edi, ecx
lea edx, [edx*8 - 0x57c58874]
jmp edi
sub ecx, edx
jmp 0x9167ee
sbb ebp, 3
add eax, eax
mov ecx, dword [ebp]
xor ecx, ebx
cdq
neg eax
neg ecx
push edx
pop edx
rol ecx, 1
jmp 0x91ccd3

Function at 0x8a089b
Capabilities:
Encode data using base64

Disassembly:
rol ebp, 2
push ebx
not ebp
dec edx
mov dword [esp + ebx - 0x68fab99], ebx
jmp 0xcf316e
dec esp
mov dword [esp + edx - 0xab98], esi
dec ebp
lea ebp, [ebx + ecx + 0x58f7abd]
inc edx
xor dword [esp + ebx*2 - 0xd1f573a], ebp
pop ebx
dec edx
lea eax, [ebx*4 - 0x53ebbfe4]
inc ecx
pop esi
dec esp
lea esp, [edx*8 - 0x52cd884c]
inc ecx
sal ebx, 0x76
dec eax
neg eax
dec eax
arpl bp, bp
shr edx, cl
dec esp
lea eax, [eax + ecx + 0x398e9b8f]
inc esp
movzx edx, cx
dec esp
adc edi, ebp
cwde
not ax
dec eax
lea esi, [esi + edx*2 - 0xaba2]
shl dl, 0xc2
movzx ebp, word [esi + edx*2 - 0xaa80]
dec ecx
rol eax, cl
neg al
neg al
inc cx
xor ebp, esi
inc esp
movsx ecx, dl
dec esi
lea ebp, [ebx + ebx*4 + 0x7019eda5]
sar bx, 0x63
rol bp, cl
add bp, 0x11b3
inc ecx
sal edx, 0xa2
inc dl
dec dl
ror bp, cl
dec ebp
bts ebp, esp
add ebx, 0x249fcf8a
rol dl, 0x27
xor bp, 0x52b2
inc cx
shl edx, cl
inc cx
bts ebx, 0x27
inc ecx
adc ecx, 0x900df724
inc sp
xor esi, ebp
dec eax
add ebp, esp
inc esp
mov ecx, dword [ebp + edx - 0x5520]
dec ecx
not eax
dec eax
lea edi, [edi + edx*2 - 0xaa44]
inc esp
mov dword [edi + edx*8 - 0x2a900], ecx
cwd
inc esp
xor ch, bl
inc cx
sbb ebp, 0x850fbe84
cmp dword [edi], ebx
add al, byte [eax]
Function at 0x8a0d28
Capabilities:
Encode data using base64

Disassembly:
call fcn.00d2aa0e
mov eax, 0xfb1ef404
movsx edx, ax
sub esi, 4
lea ecx, [eax + edx*8 + 0xcb0f61b]
not ecx
mov eax, dword [esi]
xor eax, ebx
sar ecx, 0x3b
sub cl, dl
inc eax
push ecx
jmp 0xa02be5
lea ecx, [esp + ecx + 8]
mov dword [esp], 0xd681c7b0
mov dword [ecx], eax
add word [esp], dx
jl 0x779ac1
mov edx, 0xbe3ba320
movsx ecx, dl
mov eax, dword [ecx + esi - 0x20]
bt edx, 0xe
jae 0xd688d5
sal cx, 0x4a
neg eax
pop edx
inc eax
bswap eax
xor ebx, eax
add ebp, eax
not ecx
lea eax, [ecx + edx*2 + 0x1bbe3e18]
movzx dx, byte [edi + ecx*4 - 0x4ffc]
sal eax, cl
dec al
mov cl, byte [ecx + edi - 0x13fd]
ror eax, 0x6c
sub ax, ax
lea edi, [edi + eax - 0xff7fffe]
adc eax, eax
dec al
adc dl, cl
mov ecx, 0x2cb661a8
and cx, cx
mov word [eax + edi - 0x1ff000ff], dx
neg ecx
mov edx, eax
jmp ebp
btr ecx, edx
lea esi, [esi + ecx*2 - 0x3c]
neg edx
push edx
xor eax, ebx
sar ecx, 0x59
not eax
or edx, 0x1323af17
lea eax, [eax + edx*2 - 0x76b37a62]
ror eax, 1
rol edx, 0xa1
sal cl, 0x81
xor eax, 0xb50d9639
not eax
xor ebx, eax
sar dx, 0xae
add edi, eax
rol ecx, 0x8a
movzx ax, byte [ecx + ebp]
rol dx, 0xe1
add cl, byte [ecx + ebp + 2]
dec edx
add ebp, 2
lea edx, [edx - 0xdf693c7]
shl al, cl
lea edx, [edx + edx - 0x467d9d6]
neg dword [esp + edx - 0x2f4afe98]
call fcn.00db6d73

Function at 0x8afe16
Capabilities:
Encode data using base64

Disassembly:
neg edx
xor edx, 0x10a02b05
inc edx
rol dword [esp + ecx + 8], 0x57
xor ecx, 0x80f1088
sbb eax, 0xe30613c
bswap edx
jbe 0xd3dc09
jmp 0x8b515a
mov edx, 0xeb0ea2a2
push edx
sub esi, 4
movsx ecx, word [esp]
inc ecx
mov edx, dword [esi]
shl word [esp + 1], 0x2d
not word [esp + 2]
xor edx, ebx
inc dword [esp]
sub cl, 0x1e
push ecx
neg edx
sub edx, 0x6fb90e29
or ecx, ecx
not edx
sar cx, 0xf
sbb edx, ecx
xor dword [esp], 0x4b0ce0a4
shl dword [esp + 2], cl
pop ecx
ror edx, cl
or cl, 0xa2
inc edx
not edx
or word [esp], 0x5bb9
xor ebx, edx
add cl, 0xb2
add edi, edx
mov edx, dword [ebp]
sar dword [esp], cl
dec ecx
sbb cx, cx
mov ecx, dword [ebp + 4]
mov dword [esp], 0x54127821
inc dword [esp]
jb 0x9e00f2
pop eax
add eax, 0xffdf25cf
jmp eax

Function at 0x8b51db
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi + eax - 0x709258b0], ecx
movzx ecx, ax
mov dword [edi + ecx*4 - 0x162d0], edx
mov dword [esp + eax - 0x709258b0], eax
mov dword [esp + ecx - 0x58b4], eax
mov ebx, dword [esp + eax - 0x709258ac]
btc eax, 0x9d
lea esi, [ecx + esi - 0x58b8]
mov eax, dword [eax + esi - 0x509258b4]
xor eax, ebx
movsx edx, word [esp + ecx*2 - 0xb164]
not cx
mov dword [esp + ecx*2 - 0x14e8e], ecx
not eax
shl edx, 0xdd
add ecx, ecx
rol eax, 2
btc edx, edx
pop edx
neg eax
add dword [esp + ecx*4 - 0x53a55], 0xd0371f28
dec eax
ror cl, 0xa1
rol eax, 1
push ecx
xor ebx, eax
add ebp, eax
rol ecx, cl
pop edx
pop eax
pop edx
jae fcn.00828bba
Function at 0x8b6f98
Capabilities:
Encode data using xor

Disassembly:
sal dword [esp + 4], 0xac
xor ecx, ecx
xor dword [esp + 4], 0x3b28e5a4
test eax, eax
call fcn.007e6fdd
sysenter
push edx
mov dword [esp], 0x3db3976c
call int.009d20d7
mov dword [0x4347949d], eax
mov ah, 0xdc
dec esi
mov esp, 0x7c501677
stc
xchg edi, eax
dec esp
xor ebp, ebx
jno 0x8b6f9f
and eax, 0x48d83223
jle 0x8b7011
rol byte [ecx], cl
pop edi
mov ebp, 0x25fa804e
sti
int1
in al, dx
aam 0xe8
adc eax, edx
dec esi
jne 0x8b6ffa
xlatb
sbb ebx, dword [ecx]
cwde
mov eax, dword [0x3c3c5c6e]
outsb dx, byte [esi]
pop esp
cmp al, 0x3c
cmp al, 0xa3
dec esi
das
pop ds
xchg ecx, eax
and dword [eax], edx
pop edi
and bh, bl
push ebp
push ds
fild dword [ecx]
clc
xchg edi, eax
cmc
or dl, 0xf0
out dx, al
enter 0x3ef4, 0xffffffffffffffff
insb byte es:[edi], dx
mov byte [0xfdcc400b], al
or eax, dword [eax - 0x34]
std
mov edx, 0x616ea7e5
pop ecx
jnp 0x8b6ff0
jecxz 0x8b706f
sbb dl, al
arpl bx, dx
fld qword [edi]
push eax
cwde
sub byte [ebx - 0x53d081d2], bl
pushal
mov esp, 0x6a1f7b63
mov cl, 0x1d
into
and ebp, dword [edi - 0x5d]
aas
daa
lea ebp, es:[0x871b565c]
sbb byte gs:[eax + 0x49], ah
in eax, dx
wait
mov dl, byte [ebp - 0x50]
mov byte [esi - 0x2b], dh
insd dword es:[edi], dx
insd dword es:[edi], dx
lodsb al, byte [esi]
inc ebx
int3
invalid

Function at 0x8b7acf
Capabilities:
Encode data using base64

Disassembly:
mov word [esi], ax
sbb ebp, 4
btc cx, 0x93
lea eax, [edx*2 + 0x2e010f36]
mov eax, dword [ebp]
xor eax, ebx
btc edx, edx
jae 0x9c35df
call fcn.0096e972
mov ecx, 0x43132c36
movzx edx, cx
xadd dl, dh
mov cl, byte [ecx + esi - 0x43132c36]
movzx eax, dx
lea edx, [eax - 0x21750876]
movzx ax, byte [esi + eax - 0x3660]
adc esi, 2
imul cl
btr edx, edx
mov ecx, 0xfd81d52a
jae 0x7815d6
mov dl, 0xf8
lahf
sbb dword [edi + 0xf19919], esp
cmp al, 4
clc
cmp al, 0x5f
mov ebx, 0xeacf8ce7
arpl bp, sp
and cl, byte [ebx]
invalid
cmovae edx, ecx
rol eax, 3
inc cx
inc eax
xor eax, 0x9590b729
bswap edx
shl dl, 0xe3
js 0x9eaca4
inc ecx
mov ecx, 0xc1132287
dec eax
sub esi, 4
mov eax, dword [esi]
dec ebp
bts ecx, ecx
inc ecx
xor eax, esi
inc ebp
movsx esp, cx
dec esi
lea ebp, [ecx*2 - 0x5b5074ca]
inc ecx
mov ebx, 0x9012c303
bswap eax
dec ebp
bts ebx, esp
dec esi
lea edx, [ecx*4 + 0x5cb836a2]
inc ecx
movzx ebx, cl
neg eax
not eax
rol eax, 2
inc ecx
push esi
dec esi
lea esi, [ebx*2 - 0x14c1c1d0]
inc bp
xchg ecx, ebx
inc edx
xor dword [esp - 0x450e], eax
inc cx
dec ecx
inc ecx
pop esi
inc ecx
movsx ecx, dx
inc ecx
movzx ebp, bp
js 0xcf856d
rol eax, 2
not eax
lea ecx, [edx - 0x134569e4]
call fcn.007a26ef
dec eax
arpl ax, ax
btc ebp, 0xa9
inc ecx
ror edx, cl
btc bx, 7
dec esp
add edi, eax
inc ecx
mov edi, dword [esp + edi - 0x2287]
mov edx, 0x94007910
inc ebp
movsx eax, ch
inc ebp
or cl, ch
js fcn.00d15188
dec ecx
inc eax
call fcn.008daf9a
shr cx, 0x2c
mov cl, byte [ebp + edx - 0xfffffe]
or dx, dx
add edx, edx
add edx, edx
lea ebp, [edx + ebp - 0x3fffffe]
rol edx, 2
shr edx, 0x9b
not dl
shr al, cl
add dx, dx
movsx ecx, dx
mov word [ebp + edx*4 - 0x7e8], ax
lea edx, [ecx - 0x73df694c]
jmp edi
Function at 0x8c36fe
Capabilities:
Encode data using base64

Disassembly:
mov word [edx + esi - 0xc501], cx
mov dword [esp + eax - 0x4014c50a], 0x62820daa
xchg byte [esp + edx - 0xc500], dl
seta byte [esp + eax - 0x4014c509]
pop edx
jnp fcn.00969791
sub eax, ecx
movzx edx, byte [eax + ebp - 0x9ecd]
bt ecx, eax
xor dl, bl
mov dword [esp + eax - 0x9ecd], 0x5eab8f9d
ror byte [esp + eax*2 - 0x13d97], 0xc3
adc dl, 0x87
neg byte [esp + eax*8 - 0x4f668]
btc ecx, 0xb8
neg byte [esp + eax - 0x9ecc]
not dl
sal cl, 0xc7
not byte [esp + eax - 0x9ecb]
adc dl, 0x30
not dword [esp + eax*2 - 0x13d9a]
not dl
cwde
btc ax, cx
xor bl, dl
bswap eax
bt ecx, ecx
and eax, 0x6115c50a
lea edx, [esp + edx + 4]
sar dword [esp + eax - 0x4014c50a], 0x61
mov cx, word [edx + eax - 0x4014c50a]
movzx edx, ax
lea esi, [esi + eax - 0x4014c50c]
sar dl, 0x43
jae 0x85fd0f

Function at 0x8cd06f
Capabilities:
Parse pe header

Disassembly:
adc esi, 6
jmp 0x8bc0d2
xor ebx, edx
call fcn.00833f00
mov edx, dword [esp]
not al
ror edx, 0xc4
pop edx
xor al, 0x82
inc al
rol al, 1
bts dx, dx
bswap edx
neg edx
xor bl, al
add eax, esp
btr edx, 0xa4
push edx
push edx
mov byte [eax], cl
pop ecx
pop eax
jmp ebp
mov dword [esp], 0x941474bc
jae 0x7c7188
shr dword [esp], 0x3d
inc dword [esp]
shld edx, eax, cl
pop ecx
mov eax, ecx
neg al
mov dword [esi + ecx*8 - 0x28], edx
cwde
movsx edx, al
cwde
lea ebp, [ebp + ecx - 9]
shr al, cl
je 0x8cd041
mov edx, dword [ebp + ecx*8 - 0x28]
lea ecx, [ecx*4 + 0x64a28eb7]
xor edx, ebx
inc cx
ror ecx, 0x4c
jne 0x9fdbee
mov edx, 0x4d91c137
shr dx, 0xe
lea ebp, [edx + ebp - 0x4d910007]
shr edx, 0x33
inc dl
mov edx, dword [edx + ebp - 0x9b3]
mov eax, 0xd23ae10b
not eax
lea ecx, [eax + eax*2 + 0x7f22330c]
xor edx, ebx
rol ecx, cl
lea eax, [eax*8 - 0x776e75cc]
not edx
inc edx
neg cx
setp al
shr ecx, cl
neg edx
rol edx, 1
xor ebx, edx
and ecx, 0xa3821725
push eax
btr ecx, ecx
adc esi, edx
jmp 0xdb67ea
sub ecx, ecx
neg ecx
adc ax, dx
movzx edx, cx
mov word [edi + ecx*2], ax
lea esi, [esi + ecx*2 - 4]
mov eax, 0x418cd4ab
shl eax, 0x2a
lea eax, [eax + edx*4 + 0x4d8a2299]
xor edx, dword [esi + ecx*8]
sal ax, 0xa3
jae 0xd798f2
dec ebx
lea esp, [esp + 8]
jne 0xd149ce
bswap edx
sub cx, ax
dec edx
inc ecx
neg edx
not edx
btc eax, eax
or ecx, eax
rol al, 0xc7
lea edx, [edx + eax - 0x7d34ac77]
cmovns cx, ax
js 0x7d3f15
sub ebp, 4
mov eax, 0xd6391323
mov eax, dword [ebp]
xor eax, ebx
mov ecx, 0x302b4bb5
rol eax, 3
shr cl, 0x63
add ecx, 0x2b2073a9
sal cl, 0x86
neg eax
xor eax, 0x8e11f893
ror eax, 3
not ecx
mov edx, 0x6b0a041f
sal cl, 0xe2
inc eax
sar cx, 0xed
bts edx, ecx
xor ebx, eax
call int.00d817d4
push eax
call fcn.009e332b
rol eax, 0xd9
mov edx, dword ss:[ecx + eax - 0x1e31f79]
xor eax, eax
call fcn.00953ddc
mov ebp, 0x9a96c397
jmp 0xb9760349
Function at 0x8dc807
Capabilities:
Encode data using base64

Disassembly:
lea eax, [ecx*2 + 0x4d92b195]
mov eax, dword ss:[edx]
mov dword [esi], eax
mov eax, 0x104d603
movzx edx, ax
btr dx, dx
jmp ebp
call fcn.009e4104
btr dx, 0x93
sub edx, edx
lea edi, [edi + edx*2 + 4]
ror edx, 0x38
movzx ecx, dx
xor eax, ebx
rol eax, 3
neg ecx
sar cx, 0xeb
rol dl, 0xc5
dec eax
rol eax, 2
sar edx, 0xea
dec dx
lea edx, [edx*8 - 0x28745b7a]
lea eax, [eax + ecx*2 + 0x2486489d]
xchg edx, ecx
btc edx, 0x89
bt dx, cx
xor ebx, eax
neg dl
xor ecx, edx
sal edx, 0x5b
adc ebp, eax
add edx, dword [edx + esi]
dec cl
jge 0x77a462

Function at 0x8ea5d1
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp + 0xc], 0x7a7eee3d
mov ecx, dword [esp + 8]
ja 0xd97da3
call fcn.00851304
xchg ebp, eax
lahf
int 0x93
add cl, byte [eax + 0x69]
fidivr word [ecx + 0x6e]
and dl, ch
rcl dword [ebx - 0x5166e0ef]
cmp byte [edi + 0x76], ch
sbb byte [edx + 0x4c033b6c], al
or edx, dword [ebx + 0x72f03c2a]
xor al, 0x6c
sub ch, byte [edi + 0x2cdb6d8f]
adc ebx, dword [ebx - 0x38]
adc al, 0xc2
adc byte [esi + 0x73], dh
sub al, 0x13
pop ebx
enter 0xffffffffffffc214, 0x10
jbe 0xd97e4c
loop 0xd97e0b
mov ch, 0x32
add byte [eax + ebp + 0x3b38a43a], 0xbf
xchg ebx, eax
fbld tbyte [esi + ebp*4 + 0xd78b063]
int3
lodsb al, byte [esi]
aam 0xbd
lea eax, [ebp - 0x23]
sub dword [esi + 0x4db1e106], 0x8089273
mov al, byte [0x63d40d40]
jp 0xd97dd0
invalid
xor eax, 0x85cbf18
cld
mov bl, 0xe7
inc eax
pop esp
insb byte es:[edi], dx
pop ebp
mov edi, 0x17ff409c
mov edi, 0xe865e036
inc eax
sbb dword [0xbf02fc9f], ebx
push edx
sub byte [edi], ch
mov edi, 0xaa2b1079
and eax, 0x6bbb92b0
jmp eax
Function at 0x8edb5b
Capabilities:
Encode data using base64

Disassembly:
xchg dword [esp + edx - 0x2b3cc500], ecx
add edi, eax
pop ecx
sal cl, 7
movsx eax, cx
mov eax, dword [esi + edx - 0x2b3cc500]
and edx, 0x8baddd1e
xadd dl, cl
mov edx, dword [esi + edx - 0xb2cc57c]
inc cl
lea ecx, [ecx + ecx*4 + 0x3b14eb0d]
mov cl, byte [esi + ecx*4 - 0x49547840]
jno 0x97a8ef
mov edx, 0x5f3c523b
lea ecx, [edx - 0x39d359c9]
movzx dx, byte [edx + esi - 0x5f3c523b]
lea eax, [ecx*2 + 0x3b9b6805]
shl ecx, 0x66
jns 0x7f91e0
mov cl, byte [esi + ecx - 0x5a3e1c7e]
rol al, 0x41
bswap eax
adc esi, 1
ror ax, 0x6e
shr dl, cl
mov ecx, 0x40aa7036
or cl, ah
mov word [ecx + esi - 0x40aa70b6], dx
not cl
lea ebp, [ecx + ebp - 0x40aa704d]
and cl, cl
mov ecx, dword [ecx + ebp - 0x40aa7049]
xor ecx, ebx
movzx edx, ax
bswap eax
lea edx, [eax*8 + 0x9067f2a]
neg ecx
lea ecx, [ecx + eax - 0x70d485f5]
inc al
dec al
ror ecx, 2
neg eax
rol eax, 0x96
not ecx
dec eax
xor ebx, ecx
not eax
bts dx, dx
adc edi, ecx
btr ax, dx
movzx ecx, al
lea eax, [eax + ecx*2 + 0x1ebc308a]
jmp edi
and dl, cl
ror edx, 0x1e
lea eax, [esp + eax + 8]
pop ecx
and dl, dh
mov cx, word [eax]
lea eax, [edx*8 - 0x8fb4a7c]
xor dword [esp + eax*2 - 0x41a15c48], edx
sub dx, 0x9588
lea edi, [edi + eax*2 - 0x41a15c4a]
sbb edx, dword [esp + eax - 0x20d0ae24]
sub dl, 0x21
mov dword [esp + edx - 0x679a98a1], edx
mov word [eax + edi - 0x20d0ae24], cx
mov ecx, eax
cdq
pop edx
jno fcn.007355cd
sub ebp, 4
mov edx, 0x2ea6c589
mov eax, edx
mov eax, dword [ebp + edx*2 - 0x5d4d8b12]
lea ecx, [edx + edx*2 + 0x73313b28]
btc dx, 0xb6
dec ecx
xor eax, ebx
sal ecx, cl
bswap eax
inc cx
sub cx, cx
xadd edx, ecx
dec eax
sub dl, cl
cmovo ecx, edx
neg eax
shr ecx, 0x70
not eax
or cl, ch
lea ecx, [ecx + edx*8 - 0x2ed97f6f]
sbb eax, 0x7d34abb4
push ecx
sar byte [esp + ecx - 0x2b0cd73f], 0xa5
xor cl, 8
xor ebx, eax
jmp 0x7d7f5c
call fcn.00980b18
neg ax
shl dx, cl
mov ecx, 0x908b2d3c
mov word [esi], dx
movzx edx, al
jmp edi

Function at 0x8ef64a
Capabilities:
Encode data using base64

Disassembly:
call fcn.0082e461
mov ecx, 0x2728d109
movzx eax, cl
lea ebp, [ebp + ecx*2 - 0x4e51a216]
cdq
cdq
mov eax, dword [ebp + ecx*2 - 0x4e51a212]
btc cx, 0x84
sbb dl, 0x1a
xor eax, ebx
bts edx, edx
not eax
btc dx, 6
and edx, ecx
neg dx
sbb eax, 0x9891c6a4
call fcn.0080bad6
sub esi, 4
mov edx, 0xdf8194b1
ror edx, 2
movzx eax, dl
mov ecx, dword [eax + esi - 0x2c]
xadd dl, al
sar al, 0x61
and edx, eax

Function at 0x8f5502
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov dword [esp + 4], 0xbf174ce7
lea esp, [esp + 4]
call fcn.008f466e