joyce8/EMBER2024-capa huggingface dataset:
Function at 0x118e747
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
inc ecx
movzx esi, di
dec eax
mov ecx, edi
inc eax
shl dh, 0x27
dec eax
lea edi, [esi + edi - 0x3584]
inc ebp
movsx ebx, bh
inc ebp
movsx esp, bh
mov dword [edi + esi*8 - 0x1ac00], ecx
dec ecx
inc edi
dec eax
add esi, 0x699aa514
inc ebp
mov edi, dword [eax + esi - 0x699ada94]
jae 0x14bb6e9
inc ecx
movsx edi, sp
dec esi
mov edx, dword [esp - 0x54]
jmp 0x133754e
imul dl
shl byte [esp + ecx - 0x422cf53c], 0x24
jae 0x1273992
mov ebp, 0x9136308e
inc esp
movzx esp, ch
inc esp
movsx edi, bp
dec eax
mov esp, edi
inc ecx
rol ah, 0x23
movzx esi, bp
popfd
push esi
inc esp
movzx esi, dh
dec esi
mov edi, dword [esp - 0x6c]
dec edx
mov ecx, dword [esp - 0xd8]
inc ecx
pop ecx
dec edx
mov eax, dword [esp - 0x64]
dec esi
mov eax, dword [esp - 0xd0]
jmp 0x118b174
movsx edx, cx
mov word [ecx + ebp - 0x422cf54a], ax
adc dx, 0xa417
not edx
mov eax, 0x99b840bb
mov dword [esp + ecx - 0x422cf54a], edi
ret 0xc
dec eax
mov edx, dword [esp + edi - 0x34]
pop edi
dec ebx
lea edi, [ecx + ecx*2 + 0xf96da99]
dec eax
mov edi, dword [esp + 0x40]
dec esp
mov ecx, dword [esp + 0x48]
push ebp
push ebp
dec eax
mov ebp, dword [esp + 0x60]
push 0xab88f731
dec esp
mov ebx, dword [esp + 0x70]
push 0xb93e4587
call fcn.012b273d
mov esi, 0xfc9262a0
mov ecx, esi
inc ecx
mov ebp, dword [eax]
inc esp
movsx esi, si
dec edi
lea eax, [eax + esi - 0x629c]
inc esp
movzx esp, si
inc ecx
xor ebp, ecx
inc ecx
mov edx, 0x9d22c49e
inc ecx
add dh, dl
inc ebp
mov ebx, edx
sbb ebp, 0xe7a6322d
inc ecx
movzx edx, dx
xor ebp, 0x74b58aa9
inc edx
lea ebp, [ebp + esi + 0x218444ed]
inc ecx
xchg ah, dh
dec edx
lea eax, [edx + ebx + 0x26061611]
not ebp
bt si, si
xor ebp, 0x522437bb
inc sp
imul esi, edx
dec ecx
lea eax, [ebx + edx + 0x6ab9e0b7]
dec ecx
xor esp, 0x4239472e
inc ecx
push ecx
jbe 0xd195d6
inc edx
xor dword [esp + esi - 0x5ec0], ebp
inc ecx
pop ecx
mul dl
inc cx
shl ebx, 0x81
inc bp
adc esi, ebx
dec eax
arpl bp, bp
dec esi
lea edi, [edx + 0x3a9d5196]
js 0x12f6886
sbb dx, cx
dec eax
adc ebx, ebp
cdq
push esi
dec edx
dec dword [esp + esi*4 - 0x39ff4]
inc ecx
mov ebp, dword [esi + edi - 0xe7fd]
inc edx
div byte [esp + esi - 0xe7fd]
inc esi
mov ebp, dword [edi + esi*2 - 0x1cff6]
inc ecx
mov cl, byte [esi + edi - 0xe7f5]
dec ecx
shl ebx, 0xe
dec esi
inc esp
xchg dl, bl
dec edx
lea edi, [edi + esi*2 - 0x1cff4]
dec edx
neg dword [esp + esi - 0xe7fd]
inc edx
rol dword [esp + esi*4 - 0x39ff1], 0xba
jne 0x15adead
dec ebp
lea esp, [esp + esi*4 - 0x58c94d6a]
dec edi
lea ecx, [esi + 0x2c862413]
dec esi
mov esp, dword [esp + 0x58c88ae6]
dec eax
mov esi, dword [esp + esi*2 - 0x60ec]
dec esi
mov esi, dword [esp + esi - 0x56]
jmp 0x1298fa1
inc esp
shrd ebp, ebp, cl
dec edx
sal dword [esp + esi - 0xe7fd], 0x78
inc cx
dec edi
inc edx
mov dword [edi + esi - 0xe7fd], ebp
inc edx
xor dword [esp + esi*4 - 0x39ff1], eax
dec eax
lea ecx, [edx*4 + 0x6c96f9b6]
dec edx
mov dword [esp + esi*2 - 0x1cffa], ebx
ret
Function at 0x119112c
Capabilities:
Encode data using xor

Disassembly:
sal eax, 0xed
lea edx, [esp + edx + 4]
mov dword [esp + eax - 0x45540000], 0xd8001120
xor al, byte [edx + ecx*2 - 0x63991ffa]
shr cx, 0x23
call fcn.0113fff5
add byte [eax + 0x6b9dbefa], bl
and al, 0x13
inc dword [eax]
cwde
cli
mov esi, 0x13246b9d
sbb ebp, dword [ecx]
scasd eax, dword es:[edi]
xchg edi, eax
xor eax, 0x6e5045e8
adc eax, 0xdf974232
sbb edi, dword [ebx - 0x6761316b]
sbb byte [eax - 0x28], bh
jb 0x119114d
and ebp, ebp
sub ebx, dword [ebp + 0x2ee67b89]
inc ecx
out dx, al
sbb ebx, dword [ebp - 0x2981d4dd]
sbb edx, dword [edx + 0x1f]
sub eax, 0xb6e457c2
mov al, byte [0xe431dffd]
aam 0x2c
ljmp 0x7730

Function at 0x1196b31
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
not edx
and dword [esp + ecx*8 - 0x767], ecx
inc edx
jmp 0x126e3cd
xor ebx, ecx
cwde
jmp 0x11f5cb7
mov dword [esp], esi
push 0x932a30d
pushfd
pop edi
mov dword [esp], edi
mov esi, 0xb219838a
lea edi, [esi - 0x64ea62cf]
mov esi, eax
mov edi, edx
call fcn.012da6ce
xor edx, ebx
movzx ecx, al
push ecx
sar cl, 0x62
dec edx
cwde
push eax
neg edx
btc eax, eax
inc cl
not ax
rol edx, 2
shr dword [esp + eax - 0x8bf49], cl
not edx
neg eax
bt ecx, 0x98
sbb edx, 0xf694252f
ror edx, 3
lea edx, [edx + eax - 0x26d4a86]
jmp 0x1157689
neg eax
add ebp, ecx
shr eax, 0x9b
add ax, dx
mov edx, dword [esi + eax - 0x40]
movzx ecx, ax
cbw
mov ecx, dword [esi + eax*8 - 0x1fc]
shl al, 0xa2
sbb eax, 0x2480f222
cwde
lea esi, [esi + eax*4 - 0x376c]
sal eax, 0xeb
mov dword ss:[edx + eax*2 - 0xddd000], ecx
shr ax, 6
lea ecx, [eax*8 + 0x77b5d62a]
jmp ebp
mov word [esp + ecx*2 - 0x1da], ax
not edx
neg edx
inc eax
mov byte [esp + ecx - 0xec], 0x33
xor ebx, edx
dec dword [esp + ecx*2 - 0x1da]
inc dword [esp + ecx*2 - 0x1da]
shr byte [esp + ecx - 0xed], 0x83
add edi, edx
add byte [esp + ecx - 0xec], 0x9c
movzx eax, byte [ecx + ebp - 0xed]
movsx edx, cx
not cx
lea ebp, [ebp + ecx*2 - 0x1fe23]
xor al, bl
xadd dword [esp + ecx - 0xff0e], edx
dec dl
bt cx, 4
xor al, 0x13
add cx, 0x4d0c
xor al, dl
shl cl, 0x61
shl dword [esp + ecx - 0x4c3b], 0x4b
bt dx, 2
sbb al, 0xf
shr edx, 0x22
rol al, 1
xor bl, al
lea eax, [esp + eax + 8]
shr ecx, 0x1f
xor edx, edx
add edx, dword [eax + ecx]
movsx eax, cx
lea esi, [esi + ecx*2 - 4]
shl al, 0x63
mov dword [esi + eax*2], edx
xadd dword [esp + ecx + 3], ecx
mov edx, 0xd012e6a7
pop eax
pop eax
jp fcn.00cab190
push 0xc3044906
and esi, 0xff
shl dword [esp], 0xec
adc byte [esp], 0xb9
js 0x15a4823
mov eax, 0xdda72eb4
not eax
lea edi, [eax + edi - 0x2258d14f]
lea edx, [eax + eax - 0x1ac68780]
mov ecx, dword [edx + edi - 0x29eb1b16]
bts ax, 0x22
xor ecx, ebx
bts dx, ax
xor dl, dh
xor al, ah
dec ecx
or dl, ah
sub edx, edx
bswap ecx
shl edx, 0x61
btc dx, 0x96
rol ecx, 1
xor ecx, 0x6e8127ac
and al, ah
neg ecx
jmp 0x1176b2f
mov esi, dword [esi*4 + 0xd5d02c]
call fcn.00d7ab4d
Function at 0x119f6f1
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push edx
dec eax
mov dword [esp + edx*2 - 0x1d8], ecx
inc ecx
push edi
call fcn.01208e12
dec esp
mov dword [esp + 8], ebx
inc ecx
movzx edx, bl
dec esp
mov dword [esp + edx - 0xe4], edx
dec esp
mov dword [esp + edx*8 - 0x760], ebx
dec esp
mov dword [esp + edx - 0xec], eax
push eax
jmp 0xd6a68b

Function at 0x11aa815
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x18]
jne 0x11867a5
mov esi, 0xb00bc005
movsx eax, si
pop esi
mov edx, 0x922a9f8b
lea eax, [edx*2 - 0x24f1fde5]
not ecx
bts edx, 0x97
jb 0xd200f3
mov dword [ebp], ecx
lea ecx, [edx + edx*8 + 0x5390ec39]
jmp esi
movzx esi, byte [eax]
call fcn.01179324
inc ecx
mov edx, 0x17301b3e
inc ebp
movsx esi, dx
inc ebp
movzx ebp, dl
inc ebx
mov ebp, dword [eax + edx*2 - 0x2e60367c]
inc ebp
add ch, dl
inc ecx
movsx eax, bp
dec edi
lea eax, [eax + edx*2 - 0x2e603678]
inc ecx
imul dl
dec edx
lea edx, [esi*8 + 0x63b11eac]
xor ax, 0x6904
inc ecx
xor ebp, ecx
dec esi
lea ebx, [eax + ebp*2 - 0x3d59855d]
inc cx
shl ebp, 0xcb
inc ebp
call fcn.0112a783
jmp 0xd3399d

Function at 0x11b2af5
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp + edx - 0x7c8b4f24]
jb 0x1325f5b

Function at 0x11b6c7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol edx, 2
neg cx
setbe al
sub edx, eax
xchg cx, ax
neg edx
lea eax, [ecx + eax + 0x732ec081]
xor ebx, edx
imul ecx, eax
shr eax, 0xad
inc ax
adc edi, edx
cdq
inc edx
bt edx, edx
jae fcn.015b062f
mov dword [esp + 4], 0xfe244fc9
lea esp, [esp + 4]
call fcn.00ce825d
mov eax, 0xca22ac92
sar al, 0xe3
rdtsc
sbb ebp, 8
mov ecx, 0x7c2dd882
jmp 0x13347f0
xor cx, cx
mov dword [ebp + ecx - 0x7c2cfffc], eax
mov dword [ecx + ebp - 0x7c2d0000], edx
movsx edx, cx
movsx eax, cx
xor edx, dword [esi + edx*2]
inc eax
lea esi, [esi + ecx - 0x7c2cfffc]
sar cl, 0x24
xor edx, ebx
sub edx, eax
or eax, eax
neg edx
rol ecx, 0xd0
rol al, 0xa2
jae 0xd46338

Function at 0x11bc4df
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + ecx*4 - 2]
mov dword [esp + ecx - 1], ecx
or cl, al
btr cx, 0xaa
lea edi, [edi + ecx*2 - 0x43]
ror al, 1
jae 0xc7a3c1
dec ecx
lea edi, [ebp + edi + 6]
sbb dx, 0xb2b6
inc sp
mov dword [edi + ebp - 0x5a], esi
dec eax
or edx, ebp
dec eax
mov dword [esp + ebp - 0x5a], ebx
ret 0x20
Function at 0x11c4c99
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sbb eax, 0xcf93568e
btr edx, 0xbe
bswap eax
or ecx, edx
btc edx, edx
xchg edx, ecx
ror eax, 3
push ecx
not dl
bswap eax
xor ebx, eax
sal word [esp + 1], cl
adc esi, eax
and dword [esp], 0xe8bfd13b
mov edx, dword [edi]
or byte [esp + 2], ch
neg dword [esp]
adc edi, 3
xadd dword [esp], ecx
inc word [esp + ecx - 0x7793ffd5]
mov dword [esp + ecx - 0x7793ffd5], edx
popfd
mov edx, ecx
ror cx, 0x41
shr ecx, 0xe1
jmp esi
xor eax, 0x8d0f832a
ror cl, cl
dec eax
imul cx, word [esp + edx - 0x627b70f3]
xchg dword [esp + ecx*2 - 0x25faf20a], edx
btr edx, 0xa2
xor ebx, eax
sar ecx, 5
bt ecx, edx
rol byte [esp + edx - 0x2136ff3], 1
adc edi, eax
neg dx
pop ecx
pop eax
pop eax
pop eax
jno fcn.00cab190
jmp 0x11d7dc5
mov edx, 0x7b25ceaf
movzx ecx, dx
lea edi, [edi + ecx*8 - 0x6757c]
mov edx, dword [edi + ecx - 0xceaf]
mov eax, 0x3a132e1c
btc ecx, 0x2c
xor edx, ebx
xor ecx, ecx
dec ax
inc edx
call fcn.00d96f2a
mov edx, 0x631cea1a
movzx ecx, dl
dec cx
lea ebp, [ebp + ecx - 0x1d]
ror cx, 0xac
mov eax, dword [ecx + ebp - 0x190]
xor eax, ebx
ror edx, 0x43
ror edx, cl
jb 0xd9d23f

Function at 0x11c794e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
shl eax, 0x57
lea ebp, [eax + ebp - 0x5dfffffa]
cwde
and al, ah
sbb ax, ax
mov word ss:[ecx + eax*2], dx
movsx ecx, al
movsx edx, cl
rol dl, 0xe7
or ecx, dword [eax + esi]
neg edx
rol dl, 0x46
lea esi, [esi + eax*2 + 4]
sal eax, 0x8b
not eax
rol dl, 4
xor ecx, ebx
add al, 0x94
bswap eax
bt edx, eax
inc ecx
bt dx, 0x2c
bt ax, ax
adc edx, edx
not ecx
xor eax, eax
rol eax, 0x68
ror ecx, 1
push edx
mov dword [esp + eax], edx
call fcn.01185ef3
mov dword [esp], 0x621c3206
call fcn.00d474e5
mov edx, 0x809b64af
lea eax, [edx - 0x2f55c7f3]
mov ecx, dword [ebp + eax - 0x51459cbc]
add edx, 0xe7b6308f
mov dx, word [ebp + edx - 0x6851953a]
jnp 0xd24535

Function at 0x11cd172
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x68a40530
call fcn.00cb9fe6

Function at 0x11d7589
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
not esi
mov dword [esp + esi - 0x7e42aaeb], eax
lea ebp, [ebp + ebp*2 - 0x52edcedf]
push eax
xchg bp, si
pushfd
bswap ebp
xor bp, bp
mov eax, 0
mov dword [esp + esi - 0x7e4223ca], eax
mov edx, esi
and edx, edx
mov esi, dword [esp + esi - 0x7e4223b2]
and edx, edx
imul dx, dx
inc ebp
sbb esi, 0x3aa31b22
movzx ecx, dx
xadd ebp, edx
lea ecx, [edx + ecx*2 + 0x4b8fcca6]
not esi
add dx, dx
rol esi, 3
sub dl, 0xbc
sub dx, bp
not dx
not esi
jae 0xc8b12e
or ecx, edx
shl ecx, 0xac
neg esi
sar dx, 0x2f
btr edx, ebp
not esi
inc esi
btc ebp, ebp
jae 0x15b8d83
Function at 0x11d7b83
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.00d391eb
mov eax, 0x6d321fad
movsx edx, al
movzx ecx, word [ebp + eax - 0x6d321fad]
sal dl, 0x82
lea ebp, [ebp + eax - 0x6d321fab]
xchg edx, eax
or dl, 0xae
cdq
xor cx, bx
imul edx
xor cx, 0x9028
shl dx, 0xef
rol cx, 1
ror eax, 0xce
push eax
adc cx, 0x2994
not cx
imul dword [esp + eax*2 - 0x2600000]
ror cx, 1
pop edx
xor bx, cx
dec eax
bts ax, dx
xadd edx, eax
lea esi, [esi + eax - 0x1300002]
btc dx, ax
adc dx, ax
ror ax, 0x83
mov word [esi + eax*8 - 0x9800000], cx
adc edx, 0xb7a7ea03
mov ecx, dword [ebp + eax - 0x1300000]
shl dl, 0x25
lea ebp, [ebp + eax*4 - 0x4bffffc]
add al, dl
xor ecx, ebx
push eax
shl dx, 0x6c
bswap ecx
idiv al
sal byte [esp + eax - 0x1300000], 0xa5
shr dword [esp + eax - 0x1300001], 0x11
lea ecx, [ecx + edx - 0x2c47e2e8]
shr edx, 0xf1
add edx, 0x22ab02aa
add edx, dword [esp + eax*2 - 0x2600002]
not ecx
dec ecx
add eax, eax
xor edx, 0x23291037
sub eax, eax
xor ebx, ecx
pop eax
cwde
add edi, ecx
lea ecx, [edx*8 - 0x265171f1]
bt ax, cx
jae fcn.00cab190

Function at 0x11d89ff
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xor eax, 0x9c06942b
dec edx
call fcn.0119f906
Function at 0x11dec85
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ebx
dec ecx
xor edx, 0xa2ad6b18
not al
neg ecx
xor ecx, 0xb21b1908
dec ax
not ecx
call fcn.014d0c0d
mov eax, dword [edi + ecx - 0x7f61bf98]
shr edx, 0xea
sal cl, 6
xor eax, ebx
xor eax, 0xdf34bd9e
ror dx, 0x61
dec cx
neg ecx
dec eax
ror cl, cl
call fcn.00d481eb
mov ebp, dword [ebp + edi - 0x503d273b]
lea esi, [edi - 0x2f4f13fe]
dec edi
lea esi, [edi + edi - 0x53d8f3d4]
mov dword [ebp + esi - 0x4ca15a98], eax
lea eax, [edi + 0x42882fbc]
inc eax
mov esi, ebp
or al, 0x3f
mov ebx, dword [esp + edi - 0x503d2732]
mov edi, dword [esp + edi - 0x503d272e]
sbb eax, eax
mov ebp, dword [esp + eax + 0xc]
mov ecx, eax
mov dword [esp + eax*2 + 8], ecx
mov dword [esp + eax + 4], ecx
lea ebp, [eax + ebp - 4]
adc ecx, dword [ebp + eax]
lea edx, [eax + eax + 0xf0ded1a]
xor ecx, ebx
inc eax
mov dword [esp + edx*4 - 0x3c37b468], eax
xor ecx, 0xe1ae9d99
sub edx, 0xde2bf607
sbb ecx, 0xf499d992
push eax
call fcn.00d00e07
mov ecx, 0x81b40692
movsx eax, cl
cbw
mov ecx, dword [ebp]
add eax, eax
mov eax, dword [ebp + 4]
mul ecx
push 0xc99ab5b6
sal byte [esp + 2], 0xa7
mov ecx, 0x21208404
mov dword [ebp + ecx - 0x21208404], edx
lea edx, [ecx + ecx*8 - 0x3f5b497f]
ror ecx, cl
imul cx, word [esp + ecx - 0x4212083e]
mov dword [ebp + ecx - 0x42123ffc], eax
or eax, 0xbdedc004
rol dx, 0x44
movzx eax, cl
pop eax
mov ecx, dword [esi + eax*2 + 0x6dfe9494]
sub edx, 0x1c09ab18
div al
lea esi, [eax + esi + 0x36ff9305]
neg dx
jbe 0x119bc26
add byte [edi + 0x49], dl
dec esi
dec ecx
dec esi
inc ebp
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx], bh
inc ebx
pop es
xor ch, 0xe7
clc
and byte [edi], ah
mov dh, byte [edx]
adc ah, byte [eax + 0x7a]
mov dh, 0xec
xor dl, byte [edx]
pushal
jp 0x11ded3b
in al, dx
sbb eax, ebx
xor al, 0x8c
aas
stosb byte es:[edi], al
sbb byte [edx], al
sar byte [eax + 0x7f], cl
adc ebp, ebp
sub dword [ebx - 0x6215bc03], ecx
sti
jg 0x11ded80
and eax, 0xe38dda1d
pop ss
sub ch, byte [ebx*2 - 0x3ca0173d]
fstp qword [ebx]
xor byte [ebx], bl
and al, 0x43
xchg edi, eax
and ebx, dword [ecx]
invalid

Function at 0x11e4493
Capabilities:
Encode data using xor

Disassembly:
lea eax, [eax*8 - 0x68d34b7b]
ror edx, 2
bts eax, 0x18
xor ebx, edx
or ax, ax
lea ecx, [ecx - 0x2d4d72f9]
and ecx, ecx
adc esi, edx
sub ecx, 0xad37ed12
mov edx, eax
mov ecx, dword [edi + ecx*2 - 0x4de98546]
call fcn.01156cbd
shr dl, cl
or dword [edx - 0x43095655], eax
stosb byte es:[edi], al
xchg byte [esi + 0x545f4d0f], ch
movsd dword es:[edi], dword [esi]
or eax, 0xb3544c5c
mov al, byte [edx - 0x55]
adc al, 0x38
loope 0x11e449a
stosb byte es:[edi], al
fist dword [edx]
pop ecx
test eax, 0x7ccd7baa
test al, 0x54
dec ecx
cld
cmp byte [eax + 0x77ba8bab], ch
stosb byte es:[edi], al
mov dh, 0xcd
aam 0xab
add byte [ebp + 0x7dfe9704], al
leave
int1
invalid
Function at 0x11e9c99
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
jmp 0x112e1e0
imul bp, dx
inc esp
and edi, esi
inc ecx
not esp
inc ecx
rol esp, 1
ror cx, 0xa2
inc ecx
dec esp
inc ecx
bswap esp
inc esp
movzx edx, dl
inc ecx
inc esp
dec ecx
neg esi
inc ecx
inc dl
inc ecx
ror esp, 1
movsx eax, dx
inc ecx
push ecx
inc esp
movsx ecx, dl
inc ebp
movzx ebp, dh
inc esi
xor dword [esp + edi - 0x10], esp
inc ecx
push edi
dec esi
mov ecx, dword [esp + edi - 8]
cwd
dec eax
mov dword [esp + ebp*2 - 0x6833fff8], eax
dec ebp
arpl sp, sp
dec ecx
add ebx, esp
inc ecx
pop esi
dec edx
ror dword [esp + edi*2 - 0x20], cl
dec edx
xor dword [esp + edi*2 - 0x20], ebx
ret
add dx, cx
mov ecx, eax
mov word [eax + esi - 0x733a8000], dx
cwde
mov dword [esp + ecx - 0x733a8000], ebp
ret
call fcn.0131cb71
not eax
inc edx
shr edx, 0x72
or edx, 0x601c5c9a
not ecx
adc dx, 0xfa07
adc edx, edx
sete dl
or eax, ecx
mov dword [esi], eax
movzx ecx, dl
mov eax, ecx
lea edi, [ecx + edi - 4]
sal eax, 0xb9
cwde
jns 0x11e2f4d
mov word [edi + edx*2], ax
lea ebp, [edx + ebp - 4]
not dx
xchg byte [esp + edx - 0xffff], dl
inc dl
mov edx, dword [edx + ebp - 0xff01]
mov ecx, 0x2c9e30aa
movzx eax, cl
jge 0x11e036e
lea esi, [esi + eax - 0x85]
sub eax, 0x733a8087
neg eax
jne 0xd0dbc6
xor edx, ebx
xor ax, 0xc281
xor ecx, 0x5683b93e
neg edx
sar ax, 0xca
rol edx, 2
sal eax, cl
sar ecx, cl
inc al
lea edx, [eax + edx - 0x5b4e9d01]
idiv cl
dec ecx
ror ax, 0xeb
ror edx, 2
inc edx
xor ebx, edx
call fcn.011ddf9d
inc ecx
mov esp, 0x341ae3b0
inc ecx
mov ebp, esp
inc esp
movzx edi, ch
dec ecx
mov edx, dword [esp + edi - 0x341ae3b0]
jmp 0x122947c
or ecx, dword [edi + ecx*2]
ror dx, 0x2d
dec edx
xor ecx, ebx
neg eax
rol ecx, 2
mul eax
and al, ah
inc ecx
neg al
btr eax, edx
neg ecx
inc ecx
sal edx, 3
mul al
xor ebx, ecx
inc ax
shl ax, 7
ror eax, 0x91
adc ebp, ecx
add edx, ebp
jmp edx
xor edi, eax
and edi, 0xff
jmp 0xcdcf86
inc ebp
movzx edx, ah
dec ebp
mov edx, dword [esp + edx - 0x341ae3b0]
movzx esi, bp
inc ecx
movzx edx, di
dec ebp
mov dword [esp + edi - 0x341ae3b0], edx
bswap edx
inc edi
mov esp, dword [eax - 0x341ae3b0]
mov ecx, 0x9982132d
inc eax
rol dh, 0x87
dec esp
lea esi, [edx*4 + 0x53922f31]
dec edi
lea eax, [eax + edi - 0xac]
inc ebp
xor esp, ecx
jmp 0xcf9129
Function at 0x11f4e66
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec al
ror al, 1
lea ecx, [ecx + ecx*4 + 0x5216db9]
shl cl, 0xe6
jne 0x12d41b0
inc ecx
ror edi, 3
dec eax
xchg edx, eax
dec esp
lea edx, [eax + 0x7121b925]
call fcn.012e6ff6
and al, 0
sar eax, 0x11
shl edx, cl
movzx ecx, al
inc ecx
mov dword [esi + eax*2 - 0x400], edx
movsx edx, cx
lea edi, [edi + eax*2 - 0x404]
mov edx, dword [edi + eax - 0x200]
jnp 0x127188d
mov word [esi], dx
pop edx
jbe fcn.0117f4d6
mov eax, 0x81334e1b
bts eax, eax
mov eax, dword [esi + 4]
mul ecx
mov dword [esi], edx
mov edx, 0xbfb3bcb5
rol edx, 0xe9
mov dword [esi + edx - 0x67796b7b], eax
lea edi, [edi + edx - 0x67796b83]
bswap edx
movsx ecx, dx
btc dx, 0xb4
mov edx, dword [edi + ecx*2 - 0xf2ce]
movzx eax, cl
btc eax, ecx
call fcn.00d1f4e8
mov edx, dword [edi + ecx - 0xd1]
sbb word [esp + ecx*2 - 0x19e], cx
xor edx, ebx
imul cx, word [esp + ecx*8 - 0x687]
dec edx
movsx eax, cl
neg eax
neg edx
shl byte [esp + ecx*2 - 0x5725], 3
js 0x130b23a
lea esp, [esp + 4]
jmp 0x15b70d1
movsx edx, byte [esp + ecx - 0x72a00000]
movzx eax, word [edi + ecx - 0x72a00000]
neg word [esp + ecx - 0x729fffff]
sub ecx, 0x959fb1ac
xor ax, bx
sub edx, edx
neg ax
inc ecx
sal dword [esp + edx*2], cl
sbb ax, 0xcb20
pop edx
inc edx
xor ax, 0x70e
inc ecx
sar edx, 0x44
xor ecx, ecx
dec ax
jmp 0x13232eb
ror edx, 2
lea ecx, [ecx + eax*8 - 0x6658d757]
ror ecx, cl
mov dword [esp + eax*4 - 0x59c36edc], 0xf82f07b6
sbb edx, 0xb52db1a2
xor ebx, edx
lea ecx, [ecx + ecx*2 - 0x565fdc7b]
shl ecx, 0x14
cwde
adc ebp, edx
inc byte [esp + ecx - 0x729ffffe]
lea edi, [edi + ecx - 0x72a00002]
jne 0x116777c
mov edx, 0xd5b3a099
xor eax, ebx
rol eax, 3
call fcn.00d72e84
sbb edx, 0xfc230db2
or ecx, 0x2687bf13
sar eax, cl
not edx
setp byte [esp + ecx*2 - 0x4d6f7f22]
xor edx, 0x2c196e0b
rol ax, 0xc3
xor ebx, edx
cbw
add ebp, edx
mov dx, word [esi + ecx - 0x26b7bf93]
cwde
shr ecx, cl
lea esi, [esi + ecx*2 - 0x9aa]
btc ax, cx
lea edi, [edi + ecx*2 - 0x9ad]
mov al, byte [edi + ecx*4 - 0x1358]
bt ecx, ecx
xor al, bl
neg al
jmp 0xccd912
xor dl, dh
not edx
ror ax, 1
push ecx
or cl, 0x8d
sal cx, 0x43
neg ax
xor bx, ax
lea esi, [esi + ecx*2 - 0x8d2]
and word [esp + ecx - 0x467], 0x120a
mov word [esi + ecx*4 - 0x11a0], ax
pop eax
jno fcn.01124eea
mov edx, 0x60ad709a
lea ecx, [edx + edx*4 - 0xa595200]
movsx eax, dx
mov edx, dword [esi + eax - 0x709a]
xor ecx, 0xed1aba89
btc eax, eax
inc ax
mov cl, byte [ecx + esi - 0x34135b87]
lea esi, [eax + esi - 0x4007099]
jnp 0xd6b34b
pushal
fisttp word [ecx]
cmc
push esp
dec ebx
or eax, 0x4a665597
insd dword es:[edi], dx
andnps xmm0, xmmword [ebx - 0xf]
mov edx, 0x4bab601a
std
mov word [edx + 0x46ad2a7e], gs
outsd dx, dword [esi]
push esp
aaa
invalid
call 0x127914d
mov ecx, 0xc90c8bf
mov eax, dword [esi + ecx - 0xc90c8bf]
and cx, 0x2804
lea esi, [esi + ecx*8 - 0x6480401c]
jns 0x1303128
Function at 0x11f9084
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
shr al, 2
or al, byte [esp + eax*4 - 0x65ffffe]
mov eax, dword [esi + eax*8 - 0xcc00308]
sar ecx, cl
btc cx, 9
lea edx, [ecx + ecx*8 + 0x5a331022]
mov dx, word ss:[edx + eax - 0x5a330ef9]
adc esi, 2
movzx eax, cl
mov word [esi + eax*2 - 0x1be], dx
mov dword [esp + eax - 0xdf], ebp
ret
push 0x601471b
pop ebp
inc esi
mov esi, dword [ebp + eax - 0x601471b]
push ebp
call fcn.00c7ca00
sub ebp, 4
mov ecx, 0xaa9c6104
mov edx, ecx
mov edx, dword [ebp]
push ecx
push ecx
xor edx, ebx
push ecx
xor edx, 0xfc31bc0f
sal cl, cl
shl dword [esp + 7], 0xac
call fcn.00c8dba0
btc eax, eax
lea ecx, [ecx + edx*2 - 0x5a787c6b]
sub eax, edx
inc ax
bt ax, 0x17
bswap ecx
bt dx, dx
add al, dh
lea ecx, [ecx + edx*2 - 0x4fcd2d6d]
or eax, 0x62355aa
neg edx
bswap ecx
xor ebx, ecx
add ebp, ecx
bt dx, dx
bts eax, edx
lea ecx, [edx*2 - 0x4b46e5d4]
lea edi, [eax + edi - 0x7ee35ffc]
cmovb ecx, eax
setb al
movzx ecx, byte [ecx + edi - 0x7ee35ffb]
xor cl, bl
cwde
imul eax
adc cl, al
shl dl, 5
xor al, dl
xchg edx, eax
neg cl
sub cl, 6
push edx
dec al
or edx, edx
rol cl, 1
not dword [esp + edx*2 - 0x46837c02]
pop eax
cwde
sub cl, 0x39
lea eax, [eax + eax*2 + 0x38b6059f]
bswap edx
div eax
not cl
xor bl, cl
btc eax, edx
xchg edx, eax
btr edx, 0x14
add ecx, esp
add dl, 0x1b
sbb dx, 0x95a1
mov eax, dword [ecx + eax - 0x12a36599]
lea esi, [esi + edx*2 - 0xb9d80f8]
not edx
mov dword [esi], eax
js fcn.015b454f
push eax
xor edx, ebx
shl dword [esp], cl
adc dword [esp], ecx
xor edx, 0x7526eb07
add byte [esp + 2], ch
xadd dword [esp], ecx
jnp 0x128dacf
bswap edx
lea edx, [eax + edx - 0x44b7471f]
neg edx
bt cx, 0xb3
ror edx, 1
mov byte [esp + ecx - 0x161ca30], ah
shl eax, cl
xor edx, 0x108850a8
bt eax, ecx
lea ecx, [eax + ecx*2 - 0x44c38375]
sbb ecx, 0x3a0ab3b
xor ebx, edx
add ebp, edx
jmp 0xda766f
mov dword [esp + ecx*8 - 0x51000], edi
ret 0xc