joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1224bb4
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
mov dword [esp + eax - 0x35146318], 0xdb3f768b
push ecx
pop ecx
lea edx, [edx + ecx - 0x4ab75d31]
call fcn.01ad29ae
cmpsd dword [esi], dword es:[edi]
pushal
adc eax, 0x607ddc88
jg 0x1224bc8
dec eax
mov ch, 0xe8
invalid
mov byte [ebx], bh
push 0x1e
imul esi, dword [ebp - 0x35], 0xffffff8f
xchg edi, eax
mov dword [edi + 9], esp
mov word [esp + esi + 0x77], ds
scasd eax, dword es:[edi]
jle 0x1224bde
retf
sub byte [edi + 0x29], dh
cdq
invalid

Function at 0x12365aa
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xfd838aa4
mov dword [esp + 8], 0xb52fe903
xor eax, eax
call fcn.01333933
mov edx, 0x2fad0132
lea edi, [edi + edx - 0x2fad0136]
movsx eax, dl
mov edx, dword [edx + edi - 0x2fad0132]
xor edx, ebx
or eax, eax
jle 0xe82e55
lea ecx, [eax*4 - 0x4dc3bacc]
bswap edx
call fcn.00e107ba
not edx
and eax, ecx
ror ecx, cl
dec ax
xor edx, 0xb6b67a83
mov dh, 0xb6
xor al, al
neg cl
lea edx, [eax + edx - 0x40582ac]
setne cl
lea ecx, [ecx + ecx*2 + 0x290aeb01]
bswap edx
ror edx, 1
call fcn.00db377b
xlatb
fld qword [0x3ea7bb19]
xor esp, dword [esi - 0x79]
jae 0x12365fc
fild word [edi - 0x42520800]
adc ebx, dword [ebx + ecx]
cvttps2pi mm0, qword [ebx]
xor eax, 0xd042e07f
test dword [eax], edx
mov ch, 0x42
sbb byte [ebx - 0x5e], 0xcf
ror dword [edi + eax*2], cl
xor al, 0xef
mov esp, 0x2c2966c9
mov esi, 0x9c0a88b8
into
pop es
dec edi
add bh, byte [ecx]
int1
push edx
cmp byte [ebx], bh
jno 0x123665e
or dword [edx - 0x3aa38605], 0xffffffce
sti
jns 0x12366bd
invalid
wait
mov al, byte [0x99774328]
push 0x58
aaa
cld
sti
adc esp, dword [ebx + 0x2070abbc]
pop eax
loope 0x1236663
out 0xa7, eax
mov dh, 0x5c
wait
adc ebp, dword fs:[ecx + 0x759a5b9a]
fist word [edx - 0x7d74b8f7]
pop esp
cmp eax, 0x98615d2
dec edx
shl byte [ebp - 0x683ccb02], cl
ret
in al, dx
xchg esi, eax
push ebp
or ebx, dword [esi]
ljmp 0x7db2
Function at 0x123d0d3
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edi + ecx - 0xf204]
mov dword [esp + ecx*8 - 0x79020], 0x5a817b06
or ecx, ecx
sub byte [esp + ecx - 0xf201], cl
lea edi, [ecx + edi - 0xf200]
xor edx, ebx
not word [esp + ecx*4 - 0x3c80e]
lea edx, [ecx + edx + 0x62b68099]
not edx
neg dword [esp + ecx - 0xf204]
lea edx, [edx + ecx + 0x60c4d8c]
jge 0x1ae9488
not eax
ror eax, 2
ror dl, 0x65
sbb eax, 0x980d9da5
rol eax, 1
inc dx
xor eax, 0xd7004800
btc edx, ecx
ror eax, 3
xchg ecx, edx
xor ebx, eax
add esi, eax
mov eax, dword [edi + edx - 0xbd4a]
or dl, 0x32
mov ecx, dword [edi + edx*2 - 0x17af0]
inc edx
sal dl, 0xc7
inc edx
push ebx
cpuid
call fcn.01accf07
dec eax
mov ebx, edi
dec eax
sub edi, 4
inc ecx
mov esi, 0xef03feaf
inc ebp
movsx ecx, si
mov dword [edi], ebx
dec edi
lea ebp, [ecx + ecx*8 + 0x5f1e23be]
inc ecx
movzx ebx, si
inc ecx
movzx eax, bp
dec ebp
lea ebx, [ebx + ebx - 0xfeb3]
inc ebp
mov esi, dword [ebx + ebx*8 - 0x7f578]
dec ecx
imul ebp
inc esp
xor esi, esi
dec eax
lea ecx, [eax*2 - 0x58749ee6]
inc ecx
sal ebp, cl
inc ecx
bswap esi
inc ecx
neg esi
bts edx, ecx
inc esp
movsx edx, cl
inc ecx
not esi
dec ebp
lea eax, [edx + 0x48fe9a3]
inc cx
neg ecx
inc ecx
dec esi
inc ecx
bswap esi
call fcn.01aecbfd
xor bh, dl
mov al, byte [eax]
movsx eax, cl
neg edx
dec edx
call fcn.013dbf00
jecxz 0x123d1c7
cmc
inc eax
int3
Function at 0x1242f9b
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + esi + 0x60db52ea]
not ecx
mov eax, dword ss:[edx]
mov dword [esp], 0x2325cbbb
mov dword [esi], eax
jmp 0x1290299
add al, 0x4f
shl byte [esp + ecx], 0x23
lea edi, [edi + ecx*4 + 4]
xor eax, ebx
xadd word [esp + ecx*4 + 2], cx
adc ecx, ecx
ror eax, 1
call fcn.0122b199
movzx eax, cl
mov edx, dword [eax + edi - 0xe9]
btc eax, eax
lea edi, [eax + edi - 0x2e5]
xor word [esp + eax*2 - 0x5d0], 0x53d
sal word [esp + eax - 0x2e7], cl
or dword [esp + eax - 0x2e9], 0x12aeb212
xor edx, ebx
pop eax
and ecx, ecx
inc al
bswap edx
shr ecx, 0x1d
push eax
bts ecx, ecx
inc edx
pop ecx
bswap edx
inc edx
call fcn.00e9c63c
add eax, 0x6e29838e
push edx
inc esi
cdq
loope 0x129027e
ror byte [ebp - 0x2e4c744], 0xff
jmp dword [esi - 0x7f]
mov esi, 0x10db840b
jne 0x12902a5
sbb edi, ecx
outsd dx, dword [esi]
cmp bh, cl
imul edx, dword [eax + 0x614054d], 0x28
outsd dx, dword [esi]
or dword [ecx + 0x486e8b6b], esi
push ecx
adc byte [ebx + edx*4 + 0x7a], dl
lahf
push ecx
pushal
and edx, ebx
scasb al, byte es:[edi]
insb byte es:[edi], dx
jle 0x12902f8
push esp
sbb dl, bh
cli
sahf
push ecx
cmp byte [ebx], ch
cmpsb byte [esi], byte es:[edi]
shl esp, 1
aaa
push esp
popfd
inc ebp
cmp al, 0x94
xchg dword [ecx], ebx
wait
outsd dx, dword [esi]
mov bh, 0x34
pop eax
jmp 0x1290370
cmp dword fs:[edx - 0x6e], 0x65
sahf
mov esp, 0x88aa65ae
mov eax, dword [0xf7bddc64]
mov eax, dword [0x9b4428ba]
wait
or dword [esi], eax
popal
salc
jp 0x1290319
movsb byte es:[edi], byte [esi]
popal
lea ebp, [ebp - 0x2f]
inc esp
popal
dec edx
in al, dx
inc ebx
pop ebx
jno 0x12903c2
mov esp, 0xd0bd99ee
jge 0x12903db
cmp eax, 0x1b803c0a
cld
push es
cmpsb byte [esi], byte es:[edi]
pushal
sub dword [esi + 0x7ce454ff], eax
xchg bh, bh
push esp
in al, 0x7c
fnstsw word [edi + 0x6a]
fist word [edx - 0x20]
mov al, byte [0x4059113c]
or esi, edx
ret
scasd eax, dword es:[edi]
pop ebx
xor bl, bh
pop ebp
inc eax
sub dword [ebx - 0x612314b2], ebx
cmp dword [ecx + 0x2ebc9e6f], ecx
lds esp, [ebp + ebp + 0x63]
clc
sub byte [eax + 0x31], al
push ebx
lcall 0xcb2b, 0x9a99b7d7
mov ecx, 0x8d9cb49b
pop ebx
add bl, byte [ecx]
salc
xor dword [ebx - 0x66], edx
xlatb
mov bh, 0x99
cdq
lcall 0x9cb4, 0x9bb9cb2b
lea ebx, [ebx + 2]
sbb esi, edx
ja 0x12903ac
clc
push 0xffffffffffffffe4
inc esi
popal
sbb bl, byte [esi - 0x646bce00]
ror dh, 1
outsd dx, dword [esi]
insd dword es:[edi], dx
aaa
in al, dx
mov cs, word [ecx + 0x38]
out dx, al
sub ah, byte [ebp*2 - 0x7a11dc43]
daa
dec esi
xor dword [edi], 0x46
mov al, 0x43
mov bl, 0x7d
xchg edi, eax
jns 0x1290459
out 0x3c, al
cmp al, 0x6f
jecxz 0x12903e0
xchg al, al
sal dword [ecx - 0x4742f377], cl
cld
movsd dword es:[edi], dword [esi]
pop ebx
inc esp
or eax, dword [esi - 0x3f]
sub byte [ebx + 0x6138be13], bl
dec edi
jl 0x129040d
jl 0x12904ce
in al, dx
sbb byte [esi + 0x78], ch
mov dword [0xe2e4ad35], eax
test eax, 0xb2c57326
inc ebp
sub al, 0x9a
pop ds
sbb eax, 0xe4dc4236
invalid
Function at 0x1251902
Capabilities:
Encode data using xor

Disassembly:
lcall 0xc0d1, 0xb60fffc1
retf 0x33a5
movzx edx, cl
ror dl, 0xa5
xor eax, ebx
or ecx, edx
sbb eax, 0xaf86f9ae
add ecx, edx
push ecx
or dx, 0xa292
rol eax, 1
sub eax, 0xbc036e29
mov dword [esp + edx*4 - 0x28af8], ecx
push ecx
xor eax, 0x113bafb7
neg eax
push edx
xchg word [esp + ecx - 0x72146d5e], cx
xor ebx, eax
neg cx
push ecx
sbb dword [esp + edx*2 - 0x1456e], ecx
add esi, eax
sal cl, 0x41
shl dword [esp + edx - 0xa2b0], cl
lea eax, [edx + edx - 0x24527e70]
mov ecx, edi
neg eax
lea edi, [edi + edx*4 - 0x28afe]
inc dx
call fcn.00e00e87
adc al, 0x42
cmc
mov dword [esi - 0x5b407179], esp
cmp byte [ecx + 0x29], 0xd4
jle 0x12518ff
mov byte [0x338deb92], al
fsub dword [esi - 9]
fst dword [ecx + 0x19]
mov word [edx + edx*4 - 0x46], ss
invalid
loop 0x1251911
out dx, al
dec esp
js 0x12519d7
dec esp
mov es, word [eax + ecx - 0x7bb4a959]
sbb eax, ebx
inc esp
add dh, byte [esp + eax*4 - 0x59]
arpl di, bp
jns 0x1251934
sub al, 0x9c
push es
popal
xchg ebp, eax
pushal
enter 0xffffffffffff84d4, 2
sbb dh, 0x22
test byte [0x841ea225], dl
sahf
lodsw ax, word [esi]
mov edi, 0x14fced76
bound esp, qword [esi + 0x933627d]
cld
adc al, 0x62
cmpsb byte [esi], byte es:[edi]
jge 0x1251a15
xor ecx, dword [ecx]
jl 0x1251a31
xchg ecx, eax
sub ah, byte [0x85a2e773]
mov ch, 0x93
mov ds, word [edi + esi*4 - 0x1922c8c0]
leave
out dx, eax
sub al, 0x22
wait
and bl, byte [edx + 0x79]
imul ebp, dword [ebx - 0x4dff7578], 0x1feea86b
cld
xor eax, 0x998ef6da
xor eax, 0xee562a40
imul ebp, dword [eax + 0x35fc1fee], 0xffffffda
test byte [esi + 0x2a403599], 0x56
out dx, al
pop ds
cld
xor eax, 0xe20b4cd9
sti
jae 0x12519ad
and edi, ebp
lahf
sbb ebx, dword [ebx - 0x183293d7]
add edi, esp
and dword [eax], edi
push ebp
in eax, 0x60
in al, dx
cmp eax, 0x572d7303
push ebp
popfd
sub ch, ch
inc edi
xchg esi, eax
sbb al, 0xb9
inc eax
push ebx
push edi
push ebp
popfd
sub byte [edi], dl
bound ecx, qword [esi + 0x534ae22c]
fidiv dword [0x471d01d5]
push ds
inc ecx
ret 0xf27e
or eax, 0xe4bd3bf5
ror byte [edi + 0x77], cl
mul dword [eax]
and al, bh
invalid

Function at 0x125b36f
Capabilities:
Execute syscall

Disassembly:
inc ecx
sub ebx, eax
inc ebp
movsx edi, ax
dec eax
arpl cx, cx
cdq
inc ecx
pop edi
dec esp
adc esp, ecx
call fcn.00ea9772
adc dl, byte [esp + edx - 0x3cd41990]
mov word [esi + edx - 0x3cd419ac], ax
push edx
adc ecx, edx
lea eax, [edx*4 - 0x6fecbf4d]
lea edi, [edx + edi - 0x3cd419b0]
ror ecx, 0xba
mov ecx, dword [edi + edx*2 - 0x79a83358]
xor ecx, ebx
sal eax, 0x1c
lea ecx, [ecx + edx - 0x45efe9b1]
shr dword [esp + edx - 0x3cd419a4], 0x8c
sal word [esp + edx - 0x3cd419a7], 0x81
setge al
neg ecx
rol ecx, 1
xor ecx, 0x7b36a32e
neg eax
sar word [esp + edx - 0x3cd419ab], 0x2e
xor ebx, ecx
or word [esp + edx - 0x3cd419a7], ax
xadd dx, ax
and ax, word [esp + edx*2 - 0x79a83352]
adc ebp, ecx
rol dword [esp + edx - 0x3cd419a4], 0x79
jb 0x1acd7dd
pop eax
pop eax
pop eax
jb fcn.013b5580
imul ecx, edx
bswap eax
not eax
xor ebx, eax
shr cl, 0x41
add ebp, eax
btr edx, ecx
lea eax, [edx + ecx*2 - 0x34462864]
adc ecx, eax
jmp ebp
Function at 0x1288d4b
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jne 0xe3a169

Function at 0x128af19
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + esi - 0x67ab8034], 0x4504c08b
mov eax, dword [ebp + esi - 0x67ab8034]
lea ebp, [ebp + esi - 0x67ab8030]
mov edi, eax
mov esi, ebp
call fcn.01a972eb
mov dword [esp], esi
mov esi, 0xaa0e995
xor si, si
movzx esi, byte [eax + esi*2 - 0x15400000]
xor esi, edx
push 0xdc0bd915
and esi, 0xff
shl byte [esp + 1], 0x23
sal byte [esp + 1], 0xe4
mov esi, dword [esi*4 + 0x1ade930]
ror byte [esp + 3], 4
mov byte [esp], 0x99
shr edx, 8
push 0xaa8d6995
xor edx, esi
inc dword [esp + 3]
inc eax
rol byte [esp + 3], 0xe7
sub word [esp + 4], 0xc97
xor edx, 0x6a8d7ea9
dec ecx
lea esp, [esp + 8]
jne 0x128af1d
pop esi
mov eax, 0xb8a06a00
not edx
sar ax, 0x62
mov ecx, eax
mov dword [edi], edx
neg eax
jmp esi

Function at 0x128ce1f
Capabilities:
Encode data using xor

Disassembly:
cwd
sbb ecx, 0x971d2a13
btc ax, dx
ror ecx, 3
mov dword [esp + edx*2 - 0x51d3fffe], 0x2004c58e
shl dx, 0xc8
lea ecx, [ecx + eax*4 - 0x4cce6912]
call fcn.01b2b2d1
mov ecx, 0x3b9c4090
lea ebp, [ebp + ecx*2 - 0x77388124]
movzx edx, cx
mov ecx, dword [ecx + ebp - 0x3b9c4090]
movsx eax, dx
shr dl, 0xc6
rol edx, 0xe6
xor ecx, ebx
push eax
not eax
not eax
add ecx, 0x95313f8c
shl eax, 0xa5
xor ecx, 0x60be4a80
xchg dx, ax
inc dx
inc ecx
or eax, edx
ror ecx, 3
not ecx
call fcn.013d8b17

Function at 0x12b95b5
Capabilities:
Encode data using base64

Disassembly:
not dword [esp + 5]
inc eax
push 0xdfbf09b4
not byte [esp + 0xa]
xor edx, 0x2c8d57be
inc word [esp + 2]
dec ecx
push 0xe3bc2e18
push 0x302af110
lea esp, [esp + 0x18]
jne 0x124a734
mov ecx, 0xb32b46a9
lea edi, [ecx*4 + 0x4aa62213]
pop edi

Function at 0x12d6cc3
Capabilities:
Encode data using base64

Disassembly:
imul edx, dword [esp + edx - 0x63a2ef9c]
or dl, dl
ror eax, 1
and dx, dx
sal dl, 0x44
neg eax
sub eax, 0xdd0aa13e
not eax
xchg dword [esp + edx*2 - 0x44b215fc], edx
neg eax
not dl
push edx
mov dword [esp + 4], edx
xor ebx, eax
jmp 0x1274b63

Function at 0x12e2e24
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
bts ax, cx
lea edx, [ecx + edx - 0x5a985ccc]
add ecx, eax
add ecx, eax
add al, al
rol edx, 1
xadd cx, ax
sbb eax, ecx
sbb edx, 0xbf81e397
xadd eax, ecx
rol edx, 1
sub edx, 0x990a3918
shr cl, 0x82
not edx
xor cl, ch
sbb ax, 0xd438
neg edx
neg cl
xor ebx, edx
add ebp, edx
movsx edx, al
jmp 0xf0ba56
neg ax
jb fcn.00df6c76
not edx
or cx, dx
xor bl, al
rol dx, 0x29
mov dword [esp + ecx*4 - 0x38531df0], edx
lea eax, [esp + eax + 4]
xor dx, dx
mov edx, dword [eax + ecx*2 - 0x1c298ef8]
inc ecx
lea esi, [esi + ecx - 0xe14c781]
lea eax, [ecx - 0x3161ce75]
rol cl, 0xe3
mov dword [esi + ecx*8 - 0x70a63f58], edx
pop eax
rol ecx, cl
xor al, cl
mov edx, dword [edi]
adc edi, 4
neg eax
dec ax
xor edx, ebx
lea eax, [ecx + eax - 0x3f19247]
jmp 0xd89cae
Function at 0x12e4875
Capabilities:
Encode data using xor

Disassembly:
add dl, cl
inc ecx
js 0x1b0fe08
cwde
xor al, ah
mov dword [eax + ebp - 0x1f1], ecx
lea esi, [esi + eax - 0x1f5]
mov edx, dword [esi + eax*8 - 0xf88]
lea ecx, [eax + eax*4 + 0x17a61daa]
adc eax, 0x3a2d9488
xor edx, ebx
imul ax, cx
ror edx, 1
neg edx
dec eax
shr eax, cl
idiv cl
inc edx
call fcn.0128ac92
imul ebx, ebx, 0xd76ed837
popal
pop ss
outsd dx, dword [esi]
das
and dword [edi - 0xf], esi
loop 0x1257290
sal dword [eax], 0xf8
sbb al, 0x26
mov ebx, 0xd4bdf763
add byte [eax - 0x17], al
cmp byte [edi + ebx*8 + 0x7e53a627], ah
fadd dword [edx + eax*8]
imul ecx, dword [ebp], 0xf6d98ecb
push 0x7fd94bd1
fbld tbyte [ebx]
test dword [ecx + ebx*8 + 0x78], esi
sub esp, esp
out dx, eax
and al, 0xad
jno 0x12572ed
and dword [ebx + 0x1b], ebp
mov ecx, 0xfc4c26a3
lds ebx, [edi - 0x355890da]
aam 0x9d
jne 0x12572bb
add eax, 0xea3adf27
outsb dx, byte [esi]
std
fadd dword [eax + edi*8 - 0x63d22bd9]
pushfd
out 0x13, eax
in al, dx
xchg dword [ecx], edx
inc edi
invalid
mov byte [0x38684b1], al
sbb al, byte [esi]
mov byte [0x2fda83f5], al
mov dh, 0x30
pushfd
adc eax, 0xcdbf7943
add eax, esp
test byte [0xbbce2e1b], bh
arpl si, cx
xor byte [ebx + edx*8 - 0x35], cl
push ss
push 0xbbdab390
mov dh, 0xac
jbe 0x125730b
xchg ebx, eax
cmp ecx, dword [eax + ebp - 8]
imul ebp, dword [ebp + 0xe1e6f63], 0xe9a24e7e
invalid
sub cl, ch
adc edx, esp
dec eax
call fcn.013160e8
mov edx, 0xabbc4838
inc edx
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
setns dl
not dx
add ebp, 4
or ecx, eax
mov eax, 0xbc3d01be
sal al, 0xe3
bts eax, eax
not ecx
jb 0x1257222
call 0x47d49443
popfd
mov dword [ebx + 0x53], ebp
ret 0x6b1b
mov dword [esp], 0x7b888094
xor edx, ebx
call fcn.00f015b5
mov eax, 0x1427f989
lea ecx, [eax*8 - 0x10edcecd]
lea edi, [eax + edi - 0x1427f98a]
lea edx, [eax + ecx*8 + 0x28be801b]
lea ecx, [edx + ecx*2 - 0x15702de]
movzx edx, byte [edi + eax*4 - 0x509fe624]
xor dl, bl
xor cx, cx
neg ax
dec cl
ror dl, 1
jmp 0xe6e4b0
xadd cl, ah
not dl
rol dl, 1
lea ecx, [ecx + eax*8 + 0x7da151b2]
xor cx, cx
ror al, 0x44
xor bl, dl
jmp 0x1289994

Function at 0x12eaf78
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ecx*2 - 0x9160], ebx
inc ecx
neg ebp
inc ecx
not ebp
ror bx, 0x83
inc ecx
pop edi
inc ecx
xor ebp, 0xff1dbf1e
inc ecx
movsx ebp, dl
inc ecx
ror edx, cl
call fcn.00e92ba4

Function at 0x12ed483
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [ebp]
jae 0x13f7441
not word [esp + 5]
xor edx, ebx
rol edx, 2
mov ecx, 0x521ad38a
sub edx, 0xfc2abeaa
mov dword [esp + ecx - 0x521ad38a], ecx
and word [esp + ecx - 0x521ad388], cx
not edx
shr ecx, cl
lea edx, [edx + ecx*2 + 0x105794ca]
not cx
xor ebx, edx
not dword [esp + ecx*2 - 0x28f296]
sub byte [esp + ecx - 0x147945], 0x3e
adc esi, edx
movsx edx, word [esp + ecx - 0x147947]
mov dword [esp + ecx - 0x14794b], esi
ret 4
Function at 0x12f7970
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
and dword [esp + 8], 0xdfa05a04
neg word [esp + 7]
inc edx
push 0xe884e713
xor ecx, 0xdc9b0621
inc dword [esp + 0xc]
call fcn.01b05ae2
shr ecx, 0x63
xor eax, ebx
rol cl, 5
movsx edx, cx
jae 0xef711c
sbb eax, 0x8d359013
bts cx, 0x96
neg ecx
not eax
rol eax, 2
btr cx, 0xbf
push edx
bswap eax
push edx
dec eax
neg eax
xor ecx, 0x9abd090b
push ecx
xor ebx, eax
add ebp, eax
rol word [esp + ecx - 0x69030b03], 0xa3
btr dx, 0x8d
movzx dx, byte [esi + ecx - 0x69030b05]
sub cl, cl
xadd byte [esp + ecx - 0x69030afc], ch
add cl, byte [ecx + esi - 0x6903b1fe]
mov eax, 0x90baa533
or word [esp + 1], ax
adc esi, 2
neg al
dec byte [esp + 3]
sbb byte [esp + 2], ah
shr dl, cl
mov ecx, eax
sal eax, 0xb
not byte [esp + 3]
mov word [esi], dx
pop edx
pop eax
pop ecx
jmp ebp
xor bl, al
mov dword [esp], edi
inc edx
push esi
push ebx
mov ebx, eax
movzx eax, dx
mov edx, ebx
bt eax, eax
call fcn.00e219ee
mov eax, 0xd344da4
mov ecx, dword [esi + eax*4 - 0x34d13690]
call fcn.0102affb
jmp 0xde118d

Function at 0x131e72d
Capabilities:
Authenticate hmac

Disassembly:
mov esp, ebp
mov bp, 0xb83c
pop ebp
jmp 0xe4fec3
mov byte [esi], al
je 0x12ad3fc
inc edx
cmp edx, 0x104
jmp 0x12ad3f6
dec esp
adc esp, ebp
inc ecx
shl eax, 0xfc
inc ebp
btr ebp, ebp
jb fcn.01b06334
xadd dl, ah
bswap eax
inc ecx
xchg dl, al
bt dx, 0x25
not ecx
jae 0xf35c0b
dec ebp
lea esi, [ebp + eax*2 - 0x72d02b6a]
pop esi
dec eax
sub eax, 0xc82752a
inc ecx
sar dh, 0x46
inc ecx
dec al
dec eax
arpl bp, bp
js 0xe8caea
push ebp
test cx, 0xc11e
rcr ebp, 0xb2
or ebp, ebp
mov ebp, esp
rol cl, cl
inc cl
sub cl, 0xb9
lea esp, [esp - 0x104]
xor cl, bl
push esi
and esi, edx
push edi
add esi, edi
mov edi, eax
lea eax, [ebp - 0x104]
cmovnp si, ax
sub edx, edx
sub edi, eax
mov eax, 0xb31d23aa
mov cl, dl
movzx esi, si
rol eax, cl
lea esi, [ebp + edx - 0x104]
cmc
add al, dl
xor al, byte [edi + esi]
jmp 0xe41ea8
push ecx
mov eax, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
jmp 0x12807e2
inc ecx
push 0xf6b4e5ac
call fcn.01402505
bswap ecx
jae 0x100241f
call eax
pop edi
pop esi
jmp 0xda3b98
jb 0x1002487
lea ecx, [ebp - 0x104]
jmp 0x1011ff1
jmp 0x11dac80
Function at 0x1341de2
Capabilities:
Encode data using base64

Disassembly:
movzx ecx, byte [edi + eax*2 - 0x40000a6]
neg eax
adc al, ah
bswap eax
adc edi, 0
xor al, al
call fcn.00ef868a
syscall
inc ecx
push ecx
dec ecx
mov ecx, 0xe9351a0d
and dword [eax], 0x8b4c7127
dec esp
and al, 0
dec eax
mov dword [esp], 0x69a3bba3
call fcn.01b195b0
mov edx, dword [eax + ebp - 0x2000053]
lea ebp, [ebp + eax - 0x200004f]
jae 0xf1b6d6
mov dword [esp], 0x93832e21
xor cl, cl
dec edx
neg edx
movzx eax, cx
shr eax, 0x29
shr word [esp + eax - 0x51], 0x4c
sbb edx, 0xd5179c20
sal dword [esp + eax - 0x53], 0x7c
xor edx, 0x95b67029
sub cx, word [esp + eax - 0x53]
rol dword [esp + eax*8 - 0x298], 0xdd
adc ecx, 0xc8a303f
dec edx
xor ebx, edx
xor dword [esp + eax - 0x53], eax
cbw
adc esi, edx
sal eax, 1
pop eax
jne 0xf93836
mov edx, dword [edi]
mov ecx, 0xad222f0c
push ecx
add edi, 4
and byte [esp + 1], cl
xadd byte [esp + 1], cl
xor edx, ebx
ror byte [esp + 2], 0x86
ror cl, 0x41
bswap edx
shr cx, 0xc5
inc cx
not edx
btc ecx, 0x2b
mov eax, 0xd113df2e
sar ax, 5
bswap edx
neg edx
xor ebx, edx
neg eax
add esi, edx
push ecx
fstp qword [ebp + eax*2 - 0x5dd8020e]
cdq
not dx
sub dl, byte [esp + eax*2 - 0x5dd80208]
mov dword [esp + eax - 0x2eec0107], esi
ret 4

Function at 0x1351ec8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], edi
lea ebp, [ebp + ebp + 0x783439f]
jmp 0x1b07985
push esi
mov esi, ebp
xchg esi, ebp
push ebp
mov dword [esp], ecx
push esi
mov dword [esp], 0xc89b87ae
bswap ebp
mov dword [esp], edx
lea edx, [ebp + esi + 0x1abcd12c]
lea ebp, [edx + 0x7bb4a20a]
push ecx
pushfd
call fcn.00f72198
test si, sp
stc

Function at 0x135a782
Capabilities:
Encode data using base64

Disassembly:
not edx
mov eax, 0x920bc727
mov dword [esi], edx
movsx ecx, al
mul eax
setb dl
jmp ebp
mov byte [esp + 4], 0xba
lea esp, [esp + 0xc]
je 0xd677a1
push edi
mov edi, 0xf6838401
movzx edi, byte [ecx]
push 0x49820689
neg dword [esp]
xor edi, edx
not byte [esp + 1]
jmp 0x1a94fad
jmp 0x133053b
and edi, 0xff
jmp 0x1aeaaee
push 0xd180e039
dec word [esp]
mov edi, dword [edi*4 + 0x13eaf80]
not byte [esp + 6]
shr word [esp + 5], 1
shr edx, 8
xor edx, edi
shr dword [esp + 4], 0xf3
shr dword [esp + 1], 0x37
sar word [esp + 6], 0xa3
inc ecx
dec word [esp + 5]
xor edx, 0x5fb55bab
call fcn.0101c3d2

Function at 0x1398460
Capabilities:
Execute syscall

Disassembly:
lea ecx, [ecx + eax*2 - 0x4506e990]
rol ecx, 2
xadd edx, eax
xor ebx, ecx
rol dx, 0xc7
push eax
adc ebp, ecx
xchg ah, dl
lea ecx, [eax + eax*4 + 0x102fb9b6]
call fcn.0125e0de
syscall
call fcn.00d654b4
lea edi, [edi + edx*2 - 0x118]
movzx eax, dl
xor ecx, ebx
imul edx, edx
xor ecx, 0x39803d02
add dx, 0xbeb4
rol ecx, 2
mov dword [esp + edx*8 - 0x6bc0], edx
xor ecx, 0x9594fda4
xor eax, 0x9b9bb083
rol ecx, 1
bswap ecx
xor word [esp + edx*2 - 0x1af0], dx
and word [esp + edx*2 - 0x1aee], ax
je 0x11bfd5a
Function at 0x139add1
Capabilities:
Encode data using base64

Disassembly:
call fcn.01379c22
xor cl, byte [esp]
xor eax, ebx
sar ecx, 0xab
or edx, dword [esp]
add cl, ch
rol eax, 1
not dword [esp]
dec eax
jmp 0xe43205
mov edx, dword [esi + 4]
jp 0xf38cf3
mov ecx, 0xe20dd909
inc cl
sub edi, 4
movsx eax, cx
movzx edx, cx
mov ecx, dword [edi + edx - 0xd90a]
bt edx, eax
rol ax, 0x87
xor ecx, ebx
call fcn.01a97648
lea esp, [esp + 4]
jne 0xe6f7b7
mov eax, dword [ebp]
call fcn.01b14442
shl cx, 0xeb
sbb dword [esp], edx
bswap eax
shr edx, 0xf7
shr edx, 0xb6
inc dword [esp + edx*8]
inc eax
dec dx
imul edx, edx
xor ebx, eax
call fcn.010259b6
sub ebp, 4
mov ecx, 0x44a2152c
mov eax, dword [ebp + ecx - 0x44a2152c]
bts cx, 0x20
xor eax, ebx
bswap ecx
inc eax
and cx, 0x890e
call fcn.01228306
push edx
add dword [ebx + eax*2 - 1], edx
salc
xchg dword [esi + ecx*8], ebx
add al, byte [ebx]
mov dword [ebx + 7], esi
push ebp
xchg ebp, eax
jo 0xe43291
mov ebx, 0xe9ba0f66
and byte [ebx], dh
ret
xchg ecx, eax
in al, 0x44
xor eax, 0x8afe8713
fidivr dword [edx + 0x40]
invalid
or bl, dl
inc dword [0x3af793d0]
jno 0xe43237
arpl word [edi - 0x4b], dx
or eax, 0x7f3ff6b
mov ch, 0xd5
aaa
add al, byte [eax]
or ch, byte [esi + 0x64e7d1f0]
movsb byte es:[edi], byte [esi]
jbe 0xe432b2
mov ecx, 0x7026e162
xchg edx, eax
sbb ebp, dword [eax + 0x2c]
mov edi, 0x8e0262a9
mov ecx, 0x89941d9d
shr byte [0x262a9bf], 1
push cs
and al, 0xf7
xchg byte [edi + edx*4 + 0x99de4d2], ah
pop edx
std
sbb dword [esi], ebp
sbb dword [esi + 0x5f], ecx
adc al, 0x2c
iretd
invalid
mov eax, 0x7a169e31
cwde
mov eax, dword [ebp + ebx*4]
push eax
jmp 0xd7b0ce
push 0xd2a8912a
push 0xc0257290
adc esi, 4
dec dword [esp + 4]
setg byte [esp + 2]
push 0x2f181914
xor ecx, ecx
sar dword [esp + 5], 0xcb
test edx, edx
push 0x74adcab0
call fcn.00d75428
neg dword [esp + edx*8 - 0x3ac]
bswap eax
neg eax
lea ecx, [ecx + edx*4 - 0x3b40a144]
not edx
not eax
xor ebx, eax
xchg dword [esp + 4], edx
add ebp, eax
rol cl, 0xa6
neg cx
btc cx, cx
pop eax
pop edx
pop edx
jb fcn.00fa3814
mov eax, 0xd1250805
mov eax, dword [esi]
mov edx, 0xc311bc00
and dx, 0x9f95
jne 0xdf23f3
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
sal al, 1
mov dword [esp + eax - 0x60808776], 0x5bbbd32e
mov dword [eax + esi - 0x6080876e], ebx
movzx ebx, byte [esp + eax - 0x60808772]
sar word [esp + ebx*8 - 0x1d7], 0xa1
adc bx, 0xf705
mov dword [esi + eax - 0x60808772], ecx
lea ebx, [ebx + ebx*8 + 0x2e94cb3e]
mov dword [esi + eax - 0x60808776], edx
mov ebx, dword [esp + eax - 0x6080876e]
movzx edx, al
not eax
lea ecx, [eax + edx*4 + 0x4b3f0c07]
mov eax, dword [edi + edx*2 - 0xec]
lea edi, [edi + edx*4 - 0x1d4]
sar cx, cl
xor eax, ebx
dec eax
jmp 0x1378401

Function at 0x139db2c
Capabilities:
Encode data using base64

Disassembly:
push 0xf8ac898e
mov dword [esp + 4], eax
push 0xd6018410
sal dword [esp + 2], 0x50
adc word [esp + 3], 0x692a
dec ebx
push 0xad821782
jmp 0xe0ed45