joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa4c938
Capabilities:
Execute syscall

Disassembly:
mov dword [esp], ecx
mov ecx, dword [edi]
xor ecx, ebx
neg word [esp + 2]
call fcn.00b60eaf
syscall
inc ecx
push esp
dec ecx
mov esp, 0x140b13b6
xchg ebp, eax
pop esi
cmp byte [esp + ecx*2 + 0x24648b], bl
dec eax
mov dword [esp], 0x3b6146a6
call fcn.0069bd91

Function at 0xa5d1ec
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
shr cx, 0xb0
or ecx, ecx
je 0xa5d206
xor ecx, ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0xc], 0x824fd938
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.009b3519

Function at 0xa5d25a
Capabilities:
Encode data using base64

Disassembly:
and esi, 0xff
jmp 0xb2bff0

Function at 0xa80066
Capabilities:
Encode data using xor

Disassembly:
dec eax
ror eax, 2
mov dword [esp + ecx*2 - 0x577f0fdc], ecx
xor ebx, eax
not dl
add edi, eax
shl word [esp + ecx - 0x2bbf87ec], cl
lea eax, [ecx + ecx + 0x78154811]
mov ebp, dword [ebp + ecx*2 - 0x577f0fdc]
dec word [esp + edx - 0x77bd3451]
pop edx
pop eax
jns fcn.005aabfd
inc ecx
pop edx
and dl, dl
rol ecx, 3
movsx eax, dl
xor ecx, 0xdb2ee238
cwde
cdq
or ax, 0x394
adc ecx, 0x1c07b81f
jmp 0x9b432f

Function at 0xa88c92
Capabilities:
Execute syscall

Disassembly:
add dword [esp + ecx*2 - 0x4850f342], 0xff86cc28
and cx, 0x588f
mov dword [esp + 0x10], 0x79467674
mov ecx, dword [esp + ecx - 0x24285875]
setne byte [esp + 8]
call fcn.005da610

Function at 0xa88cc8
Capabilities:
Execute syscall

Disassembly:
xor edx, ebx
ror edx, 3
not edx
mov dword [esp], eax
sub edx, 0xfc25b5be
call fcn.009e7913
syscall
call fcn.006d2470
lea esp, [esp + 0xc]
ret

Function at 0xa9c312
Capabilities:
Encode data using xor

Disassembly:
push 0x78aa1312
test ebx, ebx
lea esp, [esp + 4]
je 0x913bed
push eax
lea ebp, [eax + ebp - 0x3ffff]
movzx ecx, ax
push eax
or eax, dword [esp + eax - 0x3fff4]
xor dl, bl
neg word [esp + eax*2 - 0x11f15fc]
cbw
sub byte [esp + eax*2 - 0x11e0000], ch
adc dl, 0x84
rol dl, 1
sub dl, 0xe
inc cx
cbw
or ecx, ecx
neg dl
ror dl, cl
or ax, word [esp + eax*2 - 0x11dfff7]
xor bl, dl
push ecx
inc ecx
lea edx, [esp + edx + 0x14]
or ecx, 0x90b24c25
call fcn.009bdc92
push edx
pushfd
mov edx, 0xe8981c34
xor edx, edx
call fcn.0074c88e
mov dword [ebp - 4], eax
jmp 0x5a4844
adc dl, byte [ebp + eax*2 - 0x80000]
pop ecx
jmp 0x8e3e34
Function at 0xa9f75f
Capabilities:
Encode data using xor

Disassembly:
movzx edi, byte [edx]
xor edi, eax
jmp 0xa0898b
and edi, 0xff
push 0x93871a85
mov edi, dword [edi*4 + 0x6d25ec]
shr eax, 8
xor eax, edi
push 0x6d886b80
shl byte [esp + 2], 0x25
inc edx
call 0xa9f83a
inc eax
mov dword [esp + ecx*2 - 0x5d186b62], ecx
shr dword [esp + ecx*2 - 0x5d186b62], 0x5f
xor eax, 0xf00d973c
pop edx
btr edx, edx
not eax
or cl, dl
sub dl, cl
push ecx
ror eax, 3
xor byte [esp + ecx - 0x2e8c35b0], cl
dec eax
sar byte [esp + ecx - 0x2e8c35af], 0x84
bswap eax
push edx
inc eax
or ecx, 0xbc0b1b1f
call fcn.0076d4f3
push 0xaaaf0021
mov ecx, dword [esp]
movzx dx, byte [esi]
btc ecx, 0x19
sal dword [esp], cl
mov cl, byte [esi + 2]
mov eax, 0x3f1bc92d
lea esi, [eax + esi - 0x3f1bc92b]
shl dl, cl
mov ecx, eax
and eax, eax
mov word [esi + eax - 0x3f1bc92d], dx
jae 0x5f1202
adc esi, 6
shrd edx, eax, cl
mov eax, 0xcb117c19
sar eax, 0x83
mov dword [esi], edx
movzx ecx, ax
mov edx, dword [ecx + edi - 0x2f83]
push eax
lea edi, [ecx + edi - 0x2f7f]
shr al, cl
xor edx, ebx
cbw
xor cl, 0x29
not edx
or ecx, eax
pop ecx
dec cx
bswap edx
adc al, ah
dec edx
shl ax, 0x2e
add ecx, ecx
rol ecx, cl
rol edx, 3
sub al, ah
je 0xb2bcbd
sub edi, 1
mov ecx, 0x57b15abc
call fcn.00a3fc3e
xor eax, 0xbf032904
jmp 0xab009c
neg word [esp + 8]
dec ecx
lea esp, [esp + 0xc]
jne 0x5380a8
pop edi
not eax
jmp 0x7655eb
shl eax, 0xd3
xor ebx, edx
add ebp, edx
mov edx, 0x60198390
btc edx, 0x94
add eax, ebp
jmp eax

Function at 0xaa0842
Capabilities:
Check for software breakpoints

Disassembly:
sbb ebp, 2
pop edx
bswap edx
push eax
mov word [ebp + edx*8 - 0x5016f8], cx
mov ecx, eax
and al, 3
pop eax
pop eax
pop edx
jge fcn.005aabfd
xor cx, bx
neg cx
mov dword [esp], eax
push edx
cdq
xor cx, dx
sub dl, byte [esp + 5]
or eax, dword [esp]
mov dword [esp + 8], 0xa6808ea1
dec cx
neg cx
add byte [esp + 9], 0xb4
dec cx
not dword [esp + 7]
rol edx, 0xd9
xor bx, cx
or ax, word [esp + 9]
jnp 0x6b7a50
shr ecx, 0x3b
xor eax, ebx
not eax
shl dword [esp + ecx - 0x1b], cl
bswap eax
xor eax, 0x7d379d0d
bswap eax
sub eax, 0xac9db097
rol eax, 3
xor ebx, eax
add edi, eax
movsx edx, cl
ror dword [esp + ecx - 0x1c], cl
pop eax
pop ecx
jae fcn.009cfbdf

Function at 0xad96eb
Capabilities:
Encode data using xor

Disassembly:
shl edx, 0x5d
adc ebp, 0
xor al, bl
lea ecx, [edx + edx*8 + 0x1ebe589d]
pop ecx
call int.008cce9a
mov dx, word [ebp]
mov eax, 0xec8a57b2
mov ch, ah
mov ecx, eax
call fcn.00a64464
mov edi, 0xdfff4007
mov ah, 0x1d
jo 0xad9763
push ss
outsd dx, dword [esi]
cmp byte cs:[eax - 0x50], dh
sbb dword [ebx], esi
xor dword [eax + 0x52], 0xa6e3223
wait
std
xchg ecx, eax
cmpsb byte [esi], byte es:[edi]
sub dh, byte [ebx + 0x39717791]
mov al, 0x61
test byte [edi + 0x5d], ch
inc ecx
rcl dword [edx - 0x1057c297], cl
mov bl, 0x72
invalid
aaa
and byte [ebp + 0x6e], ah
inc dl
jbe 0x861c2830
scasd eax, dword es:[edi]
leave
mov byte [eax - 0x33f71b12], ah
xor eax, dword [edi]
and eax, 0x29d57016
cwde
fidiv dword es:[edi - 0x32c09ad7]
push esi
jl 0xad970b
and ah, dl
dec edx
sub ebx, edi
mov bh, byte [edi + 0x6b]
adc al, 0x9d
sbb dword [edi], ebp
retf
Function at 0xada0a3
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop ebx
inc ecx
dec bh
pop eax
inc ecx
pop edi
inc ecx
pop edi
jno fcn.00a15120
imul edi, dword [edx], 0x3e
lcall 0x80d5, 0xdced3b8c
invalid

Function at 0xb1c01d
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x10f50a7
neg dword [esp]
dec ebx
lea esp, [esp + 4]
jne 0x68a58b

Function at 0xb3dbd3
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp], ecx
movzx eax, dx
movzx ecx, al
call fcn.005e5684

Function at 0xb4ad0b
Capabilities:
Execute syscall

Disassembly:
dec ecx
call fcn.007da872
cwde
mov ecx, dword [edi]
xor ecx, ebx
shr ax, 0xc
mov dword [esp], 0xa2bbc793
neg edx
dec ecx
xor ecx, 0x8d970b95
add ax, ax
jae 0xacc441
Function at 0xb4adf1
Capabilities:
Encode data using xor

Disassembly:
imul dl
movzx edx, cx
mov word [ebp + ecx*2 - 0xb5fb3ee], ax
shr cl, 0xc3
lea edi, [edi + ecx*2 - 0xb5fb240]
lea eax, [ecx*4 + 0x502ab682]
mov ecx, dword [ecx + edi - 0x5afd91e]
cwde
xor ecx, ebx
jmp 0xaffdb7
btr ecx, 0x2c
adc edx, eax
mov dword [ebp], edx
call fcn.0075ccd9
lea ebp, [ebp + ecx*2 - 0xb5fb3ec]
jnp 0x728091
inc ecx
and edx, eax
btc edx, eax
xor ecx, 0xf00d973c
not ecx
ror al, 0x46
lea eax, [edx*4 - 0x605d0eed]
sar ax, 0x29
ror ecx, 3
dec ecx
btr ax, dx
bswap ecx
sbb al, dl
inc ecx
bswap ecx
lea ecx, [ecx + edx - 0x130e7e12]
call fcn.0063cdc3
or edx, edx
ror eax, 1
xadd ecx, edx
not eax
sal ecx, 0x7e
add ecx, ecx
ror eax, 3
xor ebx, eax
btr ecx, edx
adc esi, eax
add ecx, esi
jmp ecx
jmp 0x84f432
adc dword [esp + eax - 0x40b8], ecx
inc edx
xchg cx, ax
inc ecx
rol edx, 1
dec edx
xchg byte [esp + ecx - 0x140b6], cl
not edx
mov dword [esp + ecx - 0x14050], eax
call fcn.009791e6
mov ecx, 0xed20c72f
sar ecx, cl
mov ecx, dword [ebp]
mov edx, 0x43a3a416
mov eax, dword [ebp + edx - 0x43a3a412]
ror edx, 0x75
not edx
neg edx
lea ebp, [ebp + edx*4 - 0x7482c870]
rol dx, 0xcc
ror dl, 0x62
adc edx, edx
mov dword ss:[ecx + edx - 0x3a41d690], eax
movsx eax, dx
lea edi, [edi + edx - 0x3a41d694]
mov eax, dword [edi + edx*2 - 0x7483ad20]
movzx ecx, dl
xor eax, ebx
bts edx, 0x25
inc eax
or edx, ecx
jno 0x860840
mov edx, dword [edi]
xor edx, ebx
dec al
xor edx, 0x85beb927
sub word [esp + 1], 0x8f15
and ecx, dword [esp]
not edx
rol cl, 0x26
xchg dword [esp + ecx - 0x108a0105], eax
je 0x8293a5
lea edx, [edx + ecx*8 - 0x7c35749b]
sub word [esp + eax - 0x5fab297c], 0xfa26
sar ecx, cl
not edx
neg ecx
sub byte [esp + eax - 0x5fab297a], 0x8d
pop eax
xor ebx, edx
sar eax, cl
sbb al, ah
adc esi, edx
lea edx, [ecx + ecx*2 - 0xce7cadf]
dec cx
bt edx, ecx
jb fcn.006143c7
add ecx, edx
mov cs, word [ecx - 0x28]
pop esp
push es
pop ebp
pop eax
lcall 0xc979, 0x27ac4f6e
push ecx
push 0x492cd874
pop esp
fdivr dword [0xc09940f5]
daa
les esi, [0x6af505d8]
aad 2
fdiv dword [ecx]
mov esi, 0x1b46585f
sbb bl, 0x27
sub ebp, ecx
scasd eax, dword es:[edi]
cmp byte [0x5adad540], 0xea
mov bl, 0x70
mov esp, ds
xor cl, ch
ror byte [ecx], 0xd
js 0xb4af05
fbstp tbyte [edx + 0xc6c2f7d]
out 0x1e, al
dec ebp
adc eax, 0x66a53b4c
test byte [ebp - 0x728c9cd5], cl
cmp dword [esi], eax
push es
cmp edi, dword [ebx]
sbb al, 0xc0
jno 0xb4af2f
adc dh, byte [edi - 0x76]
not byte [eax + 0x55dceaa0]
invalid
Function at 0xb4fe28
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
bswap edx
not eax
adc cl, ah
lea eax, [ecx*4 - 0x2b556b6e]
xor edx, 0xc9a7fcaf
dec edx
xchg ah, cl
ror edx, 1
jmp 0xa3529c
adc edi, edx
movsx edx, cx
btc edx, ecx
ror ax, cl
jmp edi
adc edi, edx
sal word [esp + eax*2 - 0x20000], 0xc5
btc eax, 0xaf
mov cx, word [esi + eax*4 - 0x60000]
adc byte [esp + eax - 0x17ff9], al
lea edx, [eax*2 + 0x1daae939]
lea esi, [esi + eax*2 - 0x2fffe]
movzx edx, byte [ebp + eax - 0x18000]
shl eax, 0x2b
bswap eax
lea ebp, [ebp + eax*2 - 0x17]
ja 0x94eb9e
insb byte es:[edi], dx
jne 0x82975e
push ecx
sbb dword [edx + 0x41e6ac8b], ebx
outsd dx, dword [esi]
sbb eax, 0x6682ab85
mov edx, dword [ebp]
mov cl, byte [ebp + 2]
mov eax, 0x62b09493
lea ebp, [ebp + eax - 0x62b09491]
or ax, ax
sbb ax, 0x15a8
lea eax, [eax + eax - 0x7e5da4cc]
sal dx, cl
sal eax, 0xcf
bt eax, 0x3f
btc eax, eax
mov word [ebp], dx
mov edx, dword [esi]
btc eax, 0xc
mov ecx, 0xba3dea0
cwde
lea esi, [esi + ecx - 0xba3de9c]
sal ax, 0x8b
xor edx, ebx
and cx, ax
jge 0x5ff89c
pop esp
hlt
call fcn.00aa0f38
xor dx, bx
shl ax, 0x85
sal ax, cl
or eax, ecx
xor dx, 0xbe00
sar ax, 0x65
sbb al, ch
inc ecx
rol dx, 1
sub al, 0xa7
neg dx
dec dx
xor bx, dx
bswap ecx
cwde
lea ebp, [ebp + ecx - 0x4a1e0004]
call fcn.00a9ce11
mov dword [ebp - 4], eax
neg dword [esp]
call fcn.005354cd
xor edx, 0x7d3728b9
xchg ecx, eax
bswap edx
xor ebx, edx
bt eax, ecx
jae 0x61ddd7
call fcn.007f43c1
mov dword [esp + eax - 0xd29909], eax
lea ebp, [ebp + eax - 0xd29905]
xadd ecx, eax
dec cx
xor edx, ebx
push eax
sar ax, 0x22
sbb edx, 0x82279f08
ror eax, cl
bt eax, 0xa
rol edx, 3
bswap edx
lea edx, [edx + eax*8 - 0x65107aab]
shl word [esp + eax*2 - 0x1ffff], 0xae
sets byte [esp + eax*8 - 0x80000]
xor ebx, edx
or cl, byte [esp + eax - 0xfffd]
jno 0x8296c6
sbb edx, 0x2e9e9202
sub eax, eax
mov word [ebp + eax], cx
jns fcn.006143c7

Function at 0xb70391
Capabilities:
Execute syscall

Disassembly:
mov dword [esp], 0xe402eeb9
mov esp, edi
mov ebx, 0x379fc0bd
movsx ebp, bl
pop edi
lea ecx, [ebp + ebx*8 - 0x76cfb574]
push ecx
lea ebx, [ebp + ebx*2 - 0x66fe8080]
mov edx, dword [esp + ebx*8 - 0x420805b4]
inc bl
call fcn.00b40d6f
Function at 0xb9f750
Capabilities:
Hash data using murmur3

Disassembly:
or cx, cx
lea eax, [ecx + eax - 0x5d121e13]
mov dword [esp + ecx], edx
bts cx, 0x18
xor ecx, edx
xor ebx, eax
rol dword [esp + ecx - 0x100], 0x17
neg ecx
add ebp, eax
add dl, byte [edi + edx]
ror ecx, 0xe7
mov cl, byte [ecx + edi - 0x1fffffc]
call fcn.00cfdc73
mov edx, 0x64935e39
mov eax, edx
mov ecx, dword [edx + esi - 0x64935e39]
sal eax, 0x7a
sub dl, ah
shl eax, 0x2c
lea esi, [eax + esi + 4]
xor ecx, ebx
cwd
btc edx, edx
ror ecx, 1
call fcn.01005094
mov ecx, dword [esi]
mov edx, 0xf687f2af
movsx eax, dx
call fcn.00f92ba7

Function at 0xba2e8a
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x3801], 0xb597f236
bswap ecx
rol dword [esp + eax*4 - 0xe000], 0x39
neg dl
rol ecx, 3
bts eax, 0xba
not dl
sbb dword [esp + eax - 0x40037fd], eax
lea ecx, [eax + ecx - 0x1f0a66a]
adc edx, dword [esp + eax - 0x40037ff]
sbb al, dl
ror al, 0xc6
bswap ecx
xor ebx, ecx
add edi, ecx
cwde
not dword [esp + eax*2 - 0x7146]
call fcn.01059b73
movsx edx, ax
mov edx, dword [esi + eax*2 - 0x2400]
xor edx, ebx
sub ecx, dword [esp + ecx - 0x690919ba]
bts cx, ax
ror ecx, 0x72
inc edx
not cx
pop ecx
xchg byte [esp + eax - 0x1200], ah
neg edx
push eax
sar dword [esp + eax*8 - 0x47ff7], 0x6e
movzx ecx, al
ror edx, 1
xor ecx, ecx
push ecx
xor edx, 0xe2d2280
bswap eax
rol word [esp + ecx + 0xe], 0xc6
jae 0xbfafe4
sbb edx, 0x921f8036
rol word [esp + eax*4 - 0x23ffffd], 0xe2
ror cx, 0xe8
ror edx, 1
add edx, 0xf907f019
not dword [esp + eax - 0x8ffff0]
xor edx, 0xcc30bc94
and cx, word [esp + eax*8 - 0x47ffff0]
xor ebx, edx
jmp 0xc1dca9
add edi, edx
cdq
dec dx
pop edx
pop eax
pop eax
pop ecx
pop edx
pop edx
jne fcn.00da3483

Function at 0xba7e10
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
pop edx
movzx edx, cl
ror eax, 3
sub byte [esp + edx - 0xef], 0xb9
dec cx
sal dword [esp + edx - 0xf0], cl
not eax
not edx
adc dx, 0xa133
sbb eax, 0xfc25b5bd
neg eax
sal word [esp], cl
call fcn.00fcef2a
mov eax, 0xc539ff02
jmp 0xbd55de
sub edi, 4
movzx ecx, ax
mov eax, dword [edi + ecx - 0xff02]
btc ecx, 0xa2
movzx edx, cx
sub cx, 0x502c
xor eax, ebx
or ecx, 0xd2b590a8
dec eax
xor ecx, edx
btc cx, cx
ror eax, 3
lea eax, [eax + edx*2 - 0x65b739a0]
not eax
xor eax, 0xd804c8b
shl cx, 0xc6
sal edx, 0xd1
inc edx
xor ebx, eax
btr cx, 0x1d
add esi, eax
jmp 0xf9d04c

Function at 0xbb9002
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], eax
dec ebx
jmp 0xe012cb
call 0x109808c

Function at 0xbde1e0
Capabilities:
Encode data using base64

Disassembly:
xor ebx, edx
mov dword [esp], ecx
add esi, edx
dec dword [esp]
lea edx, [ecx + 0x4380760c]
pop edx
jle fcn.00b943b0
Function at 0xbde1f9
Capabilities:
Encode data using base64

Disassembly:
sub dl, dl
adc ebp, eax
mov dword [esp], ecx
pop ecx
sub esi, 1
movzx eax, word [esp]
neg word [esp + eax - 0xfbff]
movzx eax, byte [eax + esi - 0xfbff]
mov dword [esp], edx
rol dl, 0xc6
inc byte [esp + 1]
xor al, bl
shl cx, 0xc7
ror al, 1
xor al, 0xa8
sub al, 0x8d
add dl, dl
jae 0xe46b04
or edx, 0xa83b67ac
rol al, 1
shr cl, 0xe3
or dl, dh
adc al, 0x8d
and dl, 0xa2
sbb ecx, edx
bt cx, dx
xor bl, al
and edx, dword [esp + ecx - 0x15ff2a6e]
lea edi, [ecx + edi - 0x15ff2a70]
mov word [ecx + edi - 0x15ff2a6e], ax
sal ecx, cl
pop ecx
jb fcn.00ff1508
mov ecx, 0x84b76935
lea edx, [ecx + ecx - 0x24c33e62]
lea eax, [edx + ecx*2 - 0x76f1cbc7]
lea edi, [edi + eax - 0x77289aaf]
sub cl, al
xor eax, edx
lea ecx, [edx + edx - 0x1ecf3180]
mov ecx, dword [edi]
call fcn.00fcdfff
xor cl, bl
call fcn.00c3a9fc
push 0xe99535b3
push 0x61b92bad
rol word [esp + 4], 0xc6
mov eax, dword [ebp]
call fcn.00eb7611

Function at 0xbfb0a1
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
je 0xeab363
jmp 0xda4316
push 0x1c34c3a5
mov dword [esp], edi

Function at 0xc064fc
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov ecx, dword [ebp]
call fcn.00ff925d
mov edx, 0x3a9e5411
lea edi, [edx + edi - 0x3a9e5415]
lea ecx, [edx*8 - 0x3a690a48]
mov edx, dword [edx + edi - 0x3a9e5411]
bswap ecx
sal cl, 0x43
bt cx, cx
xor edx, ebx
lea edx, [edx + ecx*2 + 0x426588f7]
not edx
bt cx, cx
sbb edx, 0x74224f25
rol cx, 5
shr cx, 0xb
neg cl
bswap edx
bswap ecx
or ecx, ecx
adc cx, 0x833e
xor ebx, edx
ror ecx, 0x48
adc ebp, edx
neg ecx
mov edx, dword [esi]
btr ecx, ecx
dec cx
mov ecx, dword [esi + 4]
adc esi, 3
jmp 0xe96e2f
not eax
call fcn.0100a2d3
jmp 0xbaa504
xor eax, eax
sar dword [esp], 0xe5
ror dword [esp], 0xbd
test ecx, ecx
call fcn.00ce569b
sub edi, 4
cdq
inc eax
movzx ecx, ax
mov ecx, dword [edi + ecx*8 - 0x5d9e8]
cdq
xor ecx, ebx
neg ecx
sub ecx, 0x3b33f8bd
inc dl
btr edx, eax
add al, al
xor ecx, 0x16acc389
push edx
shl edx, 0xe8
bswap eax
ror ecx, 3
push edx
cdq
xor ebx, ecx
or edx, 0xab30eebf
sub dword [esp + eax - 0x7abb2bc8], 0x6e00e73e
adc ebp, ecx
rdtsc
mov ecx, dword [esp + 4]
lea esi, [esi + ecx - 0x71ff17ca]
bswap ecx
call fcn.01031c5f
push 0x9724fdbf
jmp 0xce9d21

Function at 0xc1ce3e
Capabilities:
Encode data using xor

Disassembly:
adc esi, eax
lea edi, [edi + edx*2 - 0x4d862801]
dec edx
mov eax, edx
ror edx, 0xc1
movzx eax, byte [edi + eax*2 - 0x4d8627fe]
push edx
not dl
xor al, bl
inc dword [esp + 9]
inc al
pop edx
neg al
pop edx
mov edx, 0xf4a5e1ac
sub al, 0xa0
rol al, 1
ror byte [esp + 2], 0x67
xor bl, al
rol edx, 0xe7
xor dword [esp + edx - 0x52f0d676], edi
mov word [esp + edx - 0x52f0d679], dx
or edx, dword [esp + edx - 0x52f0d67a]
sbb dx, dx
mov dword [esp + edx - 0x76f60000], esi
shr dx, 0x49
push ebx
bt dx, dx
sub dl, dl
sar edx, 0x9e
mov ebx, eax
shr dl, 0x27
xor dx, 0xf402
jno 0xbd56e4
Function at 0xc24606
Capabilities:
Encode data using base64

Disassembly:
shrd ax, dx, cl
mov edx, dword [esp + 4]
mov word [ebp], ax
rol edx, 0xe
mov eax, dword [esp + edx*2 - 0x94f6fc]
mov ecx, eax
lea edi, [edi + edx*8 - 0x253dc04]
mov dword [esp + edx*4 - 0x129ee00], edx
neg ax
call fcn.00d9d00f
test dl, ah

Function at 0xc31922
Capabilities:
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
or dword [esi - 0x170009d6], 0x5a
pushal
inc ebp
add byte [edx + 0x1c080caf], bh
call fcn.01087981
mov edx, 0x1c080caf
lea ecx, [edx*8 - 0x33c4d870]
bswap edx
movzx edx, byte [esi]
movzx eax, cl
xchg cl, al
lea esi, [eax + esi - 7]
and ecx, ecx
neg eax
xor dl, bl
cwde
shr cl, 0xe7
neg dl
dec ax
btc eax, ecx
rol dl, 1
or al, 2
not eax
adc dl, 0x8d
sar cx, 0xca
js 0xe43ed2
lodsd eax, dword [esi]
jo 0xc3191d
call 0xc6b31763
hlt
ror dl, 1
btc ecx, 0x8b
xadd ecx, eax
and ecx, ecx
not dl
ror eax, 0x85
sbb ecx, ecx
xor bl, dl
add edx, esp
bswap ecx
ror ecx, 0x1a
adc cl, byte [edx + ecx*4]
lea ebp, [eax + ebp - 0x1d63dfc1]
mov edx, eax
sub edx, edx
jne 0xedcaf2
mov word [ebp + eax*2 - 0x3ac7bf7e], cx
lea ecx, [eax + edx*4 - 0x3ac912c2]
mov ecx, dword [eax + esi - 0x1d63dfbf]
rol ax, 0xce
lea esi, [esi + eax*2 - 0x3ac7efda]
xor eax, 0x651fda03
push eax
sbb dx, word [esp + eax - 0x787c2dea]
xor ecx, ebx
not ecx
cwde
bt edx, edx
setb dl
ror ecx, 1
xor ecx, 0x1d273e9f
not ecx
cdq
xor ebx, ecx
xchg dx, ax
sar al, 0xc1
adc edi, ecx
movzx ecx, dl
call fcn.00cb33c7

Function at 0xc3438d
Capabilities:
Encode data using base64

Disassembly:
shl ecx, 0x3d
mov dword [esp + eax + 0x12020041], ecx
rol dl, 1
not dl
sal eax, 0x51
xadd eax, ecx
dec dl
call fcn.00e13379
mov edx, dword [edx + edi - 0x3f2a8ba4]
mov ecx, 0x7aa3b798
lea edi, [ecx + edi - 0x7aa3b794]
mov eax, 0x2387af06
cbw
xor edx, ebx
xor ecx, 0xe7a7bdb3
bt ax, cx
dec edx
rol edx, 1
push eax
sar ecx, cl
call fcn.00c2da89

Function at 0xc3627d
Capabilities:
Encode data using base64

Disassembly:
dec ebx
call fcn.00e34c0d
mov ecx, 0x7532f81d
mov eax, 0x37868d9f
call fcn.00e5f563
mov ecx, 0xa39b7216
mov eax, dword [edi]
add edi, 4
xor eax, ebx
call fcn.00c49226
pushfd
mov dword [esp], 0xf90318ab
call fcn.00e3a93d
Function at 0xc45cb1
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor edx, ebx
neg edx
ror edx, 1
mov dword [esp + ecx - 0x51b5ca05], ecx
lea eax, [ecx*2 + 0x7d0a88b2]
inc edx
sub byte [esp + ecx - 0x51b5ca05], ah
dec eax
and cx, cx
not edx
pop eax
jne 0x105382c
lea ecx, [eax + ecx*4 - 0x2cd63bec]
mov edx, dword [edi + ecx - 0x7fc7be1a]
sal cx, 0xe
rol ecx, 0x71
mov eax, dword [edi + ecx*2 - 0x1ff1a]
adc ecx, 0x4031e8bc
lea edi, [edi + ecx - 0x4032e848]
neg cx
not edx
jbe 0xfe65d1
xor ecx, 0xe223e2f
das
and cl, byte ds:[esi]
dec eax
call fcn.00ebe7b4
pop esp
dec ecx
push ebx
out dx, eax
out dx, al
inc eax
jge 0xe58368
jno 0xe5839e
cwde
add al, 2
retf
xor ebx, edx
add ebp, edx
movzx edx, cl
xor ax, 0x1f2d
lea esi, [esi + edx - 7]
movzx ecx, word [ecx + esi - 0x51b5ca05]
cdq
xor cx, bx
btc eax, edx
not cx
btr dx, 1
xor cx, 0xf18f
xchg dh, al
not dx
inc ax
neg cx
xchg dx, ax
bt eax, 0x85
bts ax, dx
xor cx, 0x921b
xor dx, 0xb390
not dx
sal dl, 0xc1
adc cx, 0x260d
not cx
and eax, 0xc01f340c
sbb cx, 0xa200
rol ax, 0x61
adc edx, 0x60b55c8e
inc edx
ror cx, 1
lea eax, [edx + eax + 0x23aec507]
neg al
seto dl
xor bx, cx
sub edx, edx
or eax, edx
lea edi, [edi + edx*8 - 4]
xadd eax, edx
xor eax, edx
cbw
mov dword [edi + eax*8], ecx
jp fcn.00ff1508
push 0x1830600d
xor ecx, edi
inc edx
sar word [esp + 1], 0x45
jae 0xe5839c
Function at 0xc49e4d
Capabilities:
Encode data using xor

Disassembly:
sar dword [esp + eax - 0x4cac76eb], 0x6c
adc eax, eax
adc ebp, ecx
bt dx, 1
loop 0xc49e5f
pop eax
pop edx
jae fcn.010cab6a
pop ebx
neg byte [edi + edi*8]
pop ds
jle 0xc49ea0
sub ch, byte [ebp + 0x11]
adc al, 0x99
cmpsb byte [esi], byte es:[edi]
mov ds, word [ecx + 0x75]
sub byte [eax + 0x69da06ae], dl
nop
mov ah, 0x7e
cdq
jae 0xc49e5c
outsd dx, dword [esi]
call 0xfdda6828
invalid
in eax, dx
jb 0xc49f0e
dec edi
cmpsb byte [esi], byte es:[edi]
add edx, dword [ebx - 0x68fedc91]
nop
dec edi
cmp eax, dword [esi - 0x26d75fb]
les ebp, [edi - 0x2a68efa]
mov dh, byte [eax - 4]
sbb eax, 0xc8708232
cmp al, 0x39
popfd
in eax, 0x90
arpl word [edx], bp
les edi, [ecx - 0x4b63ef77]
or byte fs:[si + 0x20], al
cmp ah, byte [edi - 0x7f60893f]
test al, 0xe6
cmp al, 0x40
mov ecx, 0x78df1535
cmc
cmp ch, byte [0x16e01eaa]
and byte [edx - 0x2caf4a65], bh
call 0x86a48500
arpl word [ecx], dx
sbb bl, byte [edi]
jnp 0xc49eda
test eax, 0xdee4f0b6
in al, 0xde
mov ah, 0x6c
in eax, 0x8b
imul byte [edi]
pop ebp
sbb edx, dword [esi + 0x7a392957]
fdivr dword [edx + 0x63]
jp 0xc49f73
adc dword [edx], ebx
movsd dword es:[di], dword [si]
xor edx, dword [ebx + 0x7b30406a]
push cs
jl 0xc49efe
sub eax, 0xdcf7864d
mov bl, 0x75
push ecx
ret 0x6186
xchg dword [ecx + eax + 0x4c], esp
push esp
lds edi, [edi]
add dword [esp + edx*2 - 0x3b], ecx
aas
fisub dword [edi]
push 0xdf6eb365
inc edi
cmp al, 0xcc
jbe 0xc49f71
int1
pushal
xchg edx, eax
mov al, ah
or byte [edi + 0x3e01d08c], al
mov eax, 0x3917dbe1
mov edi, 0x643d1a1f
arpl word [ecx], dx
arpl word fs:[ecx], dx
sbb ch, byte [ebp + 0x76]
stosb byte es:[edi], al
pop ebx
cmp bl, cl
or al, 0xd0
dec esp
pushal
jbe 0xc49f99
sub dword [esi], 0x2f2be8b7
sal dword [esi - 0x5c], 1
cmp dword [ecx + 0x7f], edx
out dx, al
ror byte [edx + 0x54], 1
fbstp tbyte [eax + 0x768d2ca6]
lodsd eax, dword [esi]
loopne 0xc49fd7
cmpsb byte [esi], byte es:[edi]
sar dword [edx + 0x76], 0xbb
sahf
arpl word [ecx], dx
sbb ch, byte [ecx - 0x69]
enter 0xffffffffffffd9b6, 0xffffffffffffffd9
pop ebx
inc esp
mov dh, 0x72
pop ecx
jge 0xc49f7f
cmpsd dword [esi], dword es:[edi]
into
or al, 0xe5
add eax, 0x9ee228c0
rcr esi, cl
insd dword es:[edi], dx
sub dl, byte [ebx]
hlt

Function at 0xc5c92e
Capabilities:
Encode data using base64

Disassembly:
dec edx
and dword [esp + ebx - 0x63bb], 0x95091000
dec ebp
sbb edi, eax
dec esi
mov dword [esp + ebx*2 - 0xc786], edx
inc cx
sbb edi, 0x31466fa1
lodsb al, byte [esi]
pop esp
jp 0xc5c989
invalid