joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbce5d8
Capabilities:
Encode data using xor

Disassembly:
mul ecx
mov dword [esp], 0x142e6489
mov dword [esi], edx
mov dword [esi + 4], eax
sal byte [esp], 0xe1
mov eax, dword [ebp]
mov word [esp], 0x8d94
adc ebp, 3
add byte [ebp + ecx*4 + 0x3d581], dl
add byte [eax], al
mov edx, 0x6c2e992e
lea ecx, [edx + 0x120e9c84]
xor eax, ebx
call fcn.00d42b39
mov ebp, 0xa4892190
dec edx
adc al, 9
jno 0x76226f
shl byte [ecx], cl
push eax
cmp eax, 0xedc55e76
out 0x8d, al
nop
mov ss, esi
jae 0x76222c
dec eax
mov esi, esp
mov dword [ebp + 0x73], esi
std
test dword [edi + eax - 0x329b0c3d], 0xc4e2b973
mov word [edi], ds
mov ecx, 0x1f8cc4e2
mov bl, 0x71
loop 0x76228b
mov ecx, eax
and al, 0xfa
jno 0x762284
jno 0x76223a
mov eax, dword [0x379e5e76]
aaa
les ecx, [esi + 0x73ed283e]
invalid
jmp 0x762210

Function at 0xbd7c9e
Capabilities:
Encode data using xor

Disassembly:
xor bx, cx
cwd
xchg dword [esp + edx - 0x582bfffb], eax
sub word [esp + edx - 0x582bfffa], dx
lea esi, [edx + esi - 0x582c0003]
std
call ebx
cmpsd dword [esi], dword es:[edi]
bt dx, ax
sbb dl, dh
mov dword [esi + eax - 0x582b1dbc], ecx
loop 0xbd7c99
cmpsd dword [esi], dword es:[edi]
lea ebp, [ebp + edx - 0x582c0003]
mov edx, dword [edx + ebp - 0x582bffff]
lea ecx, [eax*4 + 0x68a0d71a]
mov dword [esp + eax - 0x582b1dbc], 0xe2e632f
test byte [esp + eax*2], al
loop 0xbd7cb5
cmpsd dword [esi], dword es:[edi]
das
arpl word [esi], bp
push cs
not eax
xor edx, ebx
or word [esp + 5], ax
sal al, 0xc4
call fcn.00d21821
test eax, 0x567483cc
jb 0xbd7cc3
jbe 0xbd7cdc
pop edi
iretd

Function at 0xbdb3fe
Capabilities:
Encode data using base64

Disassembly:
call 0xb9e9b9
mov dword [esp], 0xdd036c39
xor ebx, ecx
rol dword [esp], 5
shr dword [esp], 0xa7
and ebx, 0xff
add byte [esp + 3], 5
mov ebx, dword [ebx*4 + 0xb69d60]
push 0x2e86ac0f
shr ecx, 8
dec dword [esp + 4]
xor ecx, ebx
neg dword [esp + 2]
jle 0x72dfd4
jg 0xd7fb8b
movzx edx, byte [esp + eax - 0xefc800a]
lea ebp, [eax + ebp - 0xefc8006]
setae dl
adc ax, 0xd594
sub ax, dx
xor ecx, ebx
lea eax, [eax*8 - 0x1e5a4973]
call int.00c35857
mov edx, 0x209d5283
xor dx, 0xa38e
lea ebp, [edx + ebp - 0x209df111]
mov ecx, 0x1c370783
jne 0xc415f5
mov eax, 0x6789c62b
neg eax
sbb ebp, 3
btc eax, eax
and ax, ax
btr eax, eax
mov eax, dword [ebp]
push 0x6b87118
ror dword [esp], 0x75
jae 0x7853db
xor eax, ebx
jmp 0xd8dd7f
mov edx, dword [ebp + edx*2 - 0x413be21a]
xor edx, ebx
neg ecx
xor cl, 0xc
seta cl
lea edx, [ecx + edx - 0x2b90a5d4]
neg edx
lea eax, [ecx + ecx*8 - 0x677e3480]
btr ax, ax
xor edx, 0x9a324925
ror eax, 4
rol edx, 2
dec edx
btc ecx, 0x28
or cx, 0x7f9c
inc eax
xor edx, 0xb124ce09
xor ebx, edx
add edi, edx
cdq
inc ecx
cmovno cx, dx
mov edx, dword [esi]
btc ecx, 0x8b
btc ecx, 0x9e
adc esi, 3
push edx
movsx edx, ax
rol cl, 0xa2
cdq
popfd
cwde
and ecx, eax
or edx, eax
jmp edi
inc eax
xor ecx, 0xde046b99
dec edx
jmp 0x73798b
Function at 0xbdec2e
Capabilities:
Encode data using xor

Disassembly:
not edx
jmp 0xd0bdd0
mov edx, dword [esi + edx - 0x2f29fda1]
xor edx, ebx
add edx, 0x92222a8f
pop ecx
neg edx
mov ecx, 0x80323c0e
shl ecx, 0x37
lea edx, [edx + ecx + 0x20218327]
bswap edx
jbe 0xd3c9f2
xor ebx, edx
lea eax, [ecx + ecx - 0x2f57e77e]
add ebp, edx
btc ecx, eax
lea edx, [ecx + eax*8 - 0x2c9fff3]
shr edx, cl
lea esi, [esi + ecx - 0x7000005]
sub dl, al
shl cl, cl
movzx edx, byte [esi + ecx*8 - 0x38000200]
bt cx, cx
adc ax, 0x6d04
not cx
xor dl, bl
push ecx
ror eax, cl
xor dl, 0x1e
ror dl, 1
add eax, 0xb01f6db7
adc dl, 0x30
rol dl, 1
add al, 1
shl dword [esp + ecx - 0x700ffbf], 0x3d
xor bl, dl
lea edi, [ecx + edi - 0x700ffc1]
or dword [esp + ecx*8 - 0x3807fdf8], ecx
or cx, ax
mov dword [esp + ecx*4 - 0x1c03fffc], ecx
mov word [edi + ecx - 0x700ffff], dx
add eax, 0xa927079c
pop ecx
jnp fcn.00bfc994
push 0x9c0c54ac
mov edx, dword [edi]
add edi, 4
xor edx, ebx
add edx, 0xaab4e33a
and dword [esp], 0x8e1a35b4
mov ecx, 0x8839e926
ror edx, 3
movzx eax, cx
rol eax, cl
lea edx, [edx + eax*2 + 0xc09692]
rol edx, 2
jmp 0xaf039c
xor ebx, edx
cwde
dec eax
not byte [esp + eax - 0x497c]
add ebp, edx
or ax, cx
jne 0x7606d8

Function at 0xbe8db4
Capabilities:
Execute syscall

Disassembly:
ror ecx, 3
not ecx
lea ecx, [edx + ecx + 0x36f40b50]
ror dx, 0xaf
mov dword [esp + edx - 0xaaf6778], eax
rol ecx, 1
xor ebx, ecx
push edx
cwd
mov dword [esp + edx*2 - 0x155dfff8], eax
add edi, ecx
xor ax, dx
mov dword [esp + edx*8 - 0x5577fffc], edx
pop eax
pop eax
pop ecx
pop ecx
pop edx
pop edx
jno fcn.00b99983
sbb esp, dword [edx]
dec edx
inc esi
je 0xbe8dcd
sbb cl, bl
invalid

Function at 0xc0c1f9
Capabilities:
Encode data using xor

Disassembly:
dec ecx
not ecx
mov dword [esp], 0xc3a8b9bb
xor word [esp], dx
xor ebx, ecx
inc dword [esp]
add ebp, ecx
movsx ecx, word [esp]
mov eax, dword [edi]
mov cl, byte [edi + 4]
sub dx, 0xeb5
lea edx, [edx*2 + 0x101d0134]
adc edi, 2
sal dx, 0xcb
shl dx, 0x86
call fcn.00cc2401
xor dl, bh
sbb al, 0x8b
adc edx, ecx
and byte [ebx + 0x44], ch
mov dword [ecx], ecx
mov esi, ss
lahf
jb 0xc0c225
xor al, 1
sbb eax, 0x2d78110
add byte [eax], al
add byte [esi - 0x3f], ah
bnd retf
mov ch, 0xaf
mov word [ecx + 0x7f], es
cwde
invalid
Function at 0xc0f8c3
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx - 2], eax
dec ecx
shr edx, 0x17
lea eax, [edx + eax - 0x3be7e969]
push edx
not ecx
inc ecx
rol edx, 0x3d
jae 0xd7d17e
mov eax, 0x88041ba0
lea ecx, [eax*4 + 0x4711fc9e]
and cx, cx
mov ecx, dword [ebp + ecx - 0x67226b1e]
neg ax
mov eax, dword [ebp + 4]
push 0x18177b8e
neg dword [esp]
adc ebp, 3
push 0x201c4990
call fcn.00755b5e
xadd word [esp + ecx*2 - 0x6635a64c], bx
dec esi
lea edx, [ebx*8 - 0x10e02d4e]
inc ecx
neg eax
inc ecx
btc esp, edx
dec dword [esp + ecx - 0x331ad323]
inc ecx
xor eax, 0x3892718a
inc ecx
movzx ebp, bx
inc ecx
neg eax
dec eax
mov dword [esp + ecx - 0x331ad329], ebx
dec esp
mov dword [esp + ecx*2 - 0x6635a650], edi
add ebp, dword [esp + ecx - 0x331ad32c]
inc ebp
movsx ebp, bx
inc esp
xor dword [esp + edx + 0xf0e0208], eax
inc ecx
xchg ch, ch
rol dx, cl
jb 0xb6c1bd
dec esp
mov edi, dword [esp + ecx - 0x331ad324]
dec esp
mov dword [esp + edx + 0xf0ef028], ebp
dec ebp
arpl ax, ax
inc ecx
adc ebx, 0x299ab4ab
dec edx
lea esi, [edx*2 + 0x1b3c7b9c]
dec ebp
adc esi, eax
pop esi
dec edx
shr dword [esp + ebx - 0x299ab4ab], 0x30
dec esp
add dword [esp + ecx - 0x331ad32c], esi
ret
lea edx, [eax + edx - 0x78b7f7dd]
mov dword [esp + eax*2 - 0x5257d452], 0x262112b8
neg edx
dec eax
sub edx, 0xe01a343f
not edx
push eax
and eax, eax
mov byte [esp + eax*2 - 0x5257d44d], al
xor ebx, edx
call fcn.00c2da12
rol ecx, 2
not eax
jmp 0xb6e4ff
inc edx
xor ebx, ecx
xor dword [esp + edx*8 - 4], edx
adc ebp, ecx
movsx ecx, byte [esp + edx*2]
add dword [esp + edx*2 - 2], ebp
ret 4
Function at 0xc111a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + ebp - 5]
shl cl, cl
xor eax, ebx
bswap eax
push ecx
neg ecx
dec eax
xor dword [esp + edx*2 - 0xa], edx
add ecx, dword [esp + edx*8 - 0x28]
xor eax, 0x7b330486
lea eax, [eax + ecx*2 + 0x61bf1df7]
xchg dx, cx
xor ebx, eax
shl dx, 0x88
shl ecx, 0x98
pop edx
adc edi, eax
or edx, edx
and cl, 0x3a
jmp edi
fcmovb st(0), st(1)
jmp 0xc829ea7
stosd dword es:[edi], eax
rol byte [ecx + 0x2f680df2], 0x3f
lea ecx, [eax + ecx*8 - 0x71fef2f1]
xor ebx, edx
sar cx, 0xae
add edi, edx
cli
bt eax, 0x19
bswap eax
call fcn.00c328d7
add ebp, edx
call fcn.00d11c7b
push 0x60b9a595
mov dword [esp], ebx
mov ebx, 0xe822a888
btr ebx, 0x23
not bx
movzx ebx, byte [ecx]
jb 0xc5cf9a
sub eax, 0xea8907a5
xor ah, byte [ecx]
das
jno 0x761537
cmp cl, bh
sbb esi, dword gs:[esi - 0x7a]
sbb eax, 0x488dc0d8
mov ebx, 0xb22073f0
jns 0x7614f0
scasd eax, dword es:[edi]
jne 0x7614a3
enter 0xffffffffffff8cd1, 0x35
imul esp, dword [ebx + 0x51], 0xd72973eb
loop 0x7614b9
push ebp
mov cl, 0xd7
xlatb
xor eax, 0xdc11088b
jno 0x761530
clc
cdq
pop dword [edi + 0x2de4876]
loop 0x7614cf
xor byte [edx - 0x43], ah
inc esi
salc
mov dword [esi - 0x17], ebx
sti
or eax, 0x3d98bc72
invalid
sub dx, ax
neg ecx
xadd eax, edx
xor ecx, 0x55ae20ad
sal al, 7
xor ebx, ecx
add esi, ecx
movzx ecx, dl
ror edx, 0x6b
adc ax, 0xa534
jmp esi
inc ecx
rol eax, 3
neg eax
bswap eax
shl ecx, cl
sbb eax, 0xa229928b
xor ecx, ecx
and ecx, ecx
mov dword [esp + ecx*2], ecx
xor eax, 0xd8140db5
sal cl, 0x25
shr cx, 0xc5
xor ebx, eax
add edi, eax
add ecx, dword [ebp + ecx*2]
mov eax, dword [ebp + 4]
add ebp, 4
sal dword [esp], 0xce
xor edx, edx
test eax, eax
push 0xf09bca91
lea esp, [esp + 8]
je 0xcd64d2
jmp 0x7614e2
xor ebx, edx
push 0x20253f1d
call fcn.007911ac
mov ecx, 0x482d0ab9
movsx edx, cl
mov ecx, dword [ecx + edi - 0x482d0ab9]
bswap edx
movsx eax, dl
mov ax, word [edi + 4]
add edi, 6
sub edx, edx
btr edx, 0x33
mov word ss:[ecx + edx*4], ax
neg edx
mov ecx, dword [edx + ebp]
shr dl, 0x23
shr edx, 0x83
mov eax, 0x6e93a8ba
lea ebp, [ebp + edx*8 + 4]
xchg edx, eax
ja 0x74991b
adc ax, ax
xor ecx, ebx
cbw
dec eax
add ecx, eax
sal al, 0xc1
jae 0xd3d2c1
not ecx
jne 0xbca680
xchg dword [bx + di], edx
popfd
ficom word [ebp + 0x5e]
xchg edi, eax
push ecx
mov dword [eax], edx
pop esp
shr dword [eax - 0x32], 1
lds ebp, fs:[eax + 0x6beeb26b]
push edi
jno 0xc5d045
adc eax, 0x70df573e
bound ebx, qword [ebx - 0x29]
test al, 0xba
scasd eax, dword es:[edi]
scasb al, byte es:[edi]
sub edx, dword [edi - 0x28bf2488]
mov dh, 0xbf
pop edi
movsb byte es:[edi], byte [esi]
sub dh, ch
iretd
pop esp
sbb ecx, edi
and dword [ecx - 0x560b490e], 0xffffffe1
invalid
not edx
mov eax, 0x5387ea8a
lea ecx, [eax + eax - 0x2bcc7649]
lea eax, [eax + ecx*4 + 0x46bad138]
mov dword [ebp + ecx - 0x7b435ecb], edx
sub eax, 0x2dbc8706
sar ecx, cl
neg cl
jmp edi
inc byte [esp + eax - 0x100]
bswap ecx
dec ecx
bswap ecx
inc dx
shl word [esp + eax - 0x101], 0x44
xor ebx, ecx
add ebp, ecx
or edx, dword [esp + eax - 0x101]
call fcn.00c6a350
Function at 0xc182c1
Capabilities:
Encode data using xor

Disassembly:
inc edi
mov ebp, dword [ecx - 0x1fe]
mov ecx, esi
shl cx, 4
inc cx
xor ecx, esp
inc ebp
xor ebp, edi
inc edx
sal dword [esp - 0x7ec], 0x3f
sar si, 0x4f
inc esi
lea ebp, [ebp + ebp - 0x62ed2ddd]
dec edx
dec dword [esp - 0xf7]
pop edx
dec edx
dec dword [esp - 0x1fe]
inc esp
xor ebp, ebp
inc ecx
mov ebx, 0xed077a84
not word [esp + ecx - 0xf9]
inc ecx
bswap ebp
call fcn.00bec559

Function at 0xc3ed94
Capabilities:
Encode data using base64

Disassembly:
mov ax, word [esi]
ror dword [esp], 0x21
mov cx, word [esi + 2]
call fcn.00c7d5ab
add ebp, 4
shl edx, 0x32
xor eax, ebx
mov dword [esp], edx
bswap edx
lea ecx, [edx*2 + 0x76393410]
neg eax
call fcn.00c7128b
dec dx
mov eax, dword [edx + edi - 0x480665ab]
rol dx, cl
lea ecx, [edx + ecx*2 + 0x83e5a0e]
xor eax, ebx
dec edx
sal dx, 0x83
bswap eax
sal cl, 0x24
ror eax, 1
xor eax, 0x7316c687
neg dx
xor dx, dx
bswap eax
dec edx
shl cl, 0xa3
neg ecx
xor ebx, eax
ror edx, 0x2f
push edx
add ebp, eax
jmp 0xba584d

Function at 0xc4b8f0
Capabilities:
Encode data using xor

Disassembly:
ror edx, 2
shl eax, 0xc1
sbb edx, 0x7a0dd13e
xor eax, eax
add eax, 0x83ff1b2
neg edx
cbw
rol ax, 0x84
dec edx
btr eax, 1
xor ax, ax
inc ax
xor ebx, edx
ror ax, 0x89
adc al, 0x9f
add esi, edx
shl eax, 0x72
mov eax, dword [eax + edi - 0x7c0000]
mov edx, 0xc51eebb0
call fcn.00c0c2e5
mov edx, 0xd6229739
mov eax, dword [esi]
add esi, 4
xor eax, ebx
mov ecx, 0x4629fa88
inc eax
not eax
sar dx, 0xcf
ror ecx, 0x97
bswap eax
dec dl
adc cl, ch
and ecx, 0xf928eb14
inc eax
rol cl, 6
or dx, 0xf5a0
ja 0xd4ad3d
jmp fcn.00c2e966
neg eax
sub cl, dl
rol cx, 0x86
inc edx
rol eax, 2
lea eax, [eax + ecx*2 - 0x7ea47867]
or edx, 0x682b4a13
jno 0xd794be
mov eax, dword [ebp + eax - 0x55963f3b]
pop edx
mov edx, 0x1007d513
lea ebp, [edx + ebp - 0x1007d50f]
push edx
xor eax, ebx
sal dl, 1
adc word [esp + edx*4 - 0x401f5497], dx
neg eax
call fcn.00ae53ef
mov esi, 0x1be51b
inc eax
movsx ecx, dh
dec esp
lea edx, [esi + esi*4 - 0x2bdf8c7c]
dec esi
lea ecx, [esi + ecx - 0x1be51f]
inc ecx
movsx ebp, dx
inc edx
mov ebx, dword [ecx + ecx - 0x1b]
inc esp
movsx ebp, cx
inc ecx
xor ebx, edi
inc esp
mov esp, ecx
xor ebx, 0x2d14c595
inc sp
and edx, ebp
rol ebx, 1
inc esp
xchg ch, ch
dec ecx
inc esp
bswap ebx
dec cx
dec eax
rol ebp, 0xb1
inc eax
sal ch, 0xc6
dec ebx
inc ebp
movzx eax, sp
inc sp
btr ebp, ebp
xor ebx, 0x87aa97ba
or ecx, 0x1a91742f
inc ecx
push edi
inc ecx
dec al
xor dword [esp + esi - 0x1be51b], ebx
call fcn.00b28ad4
mov edx, 0x97346904
mov edx, dword [ebp]
add ebp, 4
mov eax, 0xcf2095bf
xor edx, ebx
bt eax, 0x34
btc eax, eax
jb 0xa76fa9
bswap eax
neg dx
not cl
dec eax
inc edx
jl 0xac1ed1
sar cx, 0x64
xor ebx, eax
sal cl, 0xa4
adc dx, cx
sar cl, 0x87
add ebp, eax
lea eax, [ecx*8 - 0x22553900]
mov ecx, dword [edi + eax - 0x66aae6f8]
inc eax
cdq
lea edx, [eax*8 + 0x6f231e39]
lea edi, [edi + eax - 0x66aae6f5]
inc ax
movzx edx, byte [eax + esi - 0x66aae6fa]
btr eax, 0x3e
jb 0xcfc62e
neg dword [esp]
adc esi, 5
ror word [esp + 1], 0xe1
shld edx, eax, cl
call fcn.00c9a0f4
Function at 0xc646f2
Capabilities:
Hash data using murmur3

Disassembly:
pushfd
mov edx, 0x5eb81d13
mov edx, dword [esp + edx - 0x5eb81d0b]
mov dword [esp + 8], 0x54ed1a54
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.00aa0a54
mov edx, 0xe324338b
movzx eax, dl
shl al, 0xa4
mov ax, word [esi + eax - 0xb0]
mov ecx, edx
call fcn.00b9c61b
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, 0xad33793a
add cl, 0xd
adc ebp, 4
sal ecx, 0x3c
not edx
call fcn.00c52b8c

Function at 0xc67429
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xor eax, ebx
btc ecx, ecx
sbb ecx, ecx
mov edx, 0xd6a6a895
inc eax
bt ecx, edx
shl edx, 0x2e
sar edx, 0xe
ror eax, 1
shl edx, 0xfd
inc dx
lea eax, [eax + ecx*2 - 0x3b2972b0]
xadd edx, ecx
neg eax
xor ebx, eax
jmp 0xc6e839
movzx eax, byte [esi]
mov ecx, 0x1c80668a
movzx edx, cl
lea esi, [esi + edx - 0x89]
xor al, bl
bts cx, dx
not cx
xor al, 0x9a
neg al
rol al, 1
inc al
sar dx, 0xc7
rol al, 1
xor ecx, ecx
sal cx, 0x46
not al
bswap ecx
cmova ecx, edx
sbb al, dl
ror edx, 0xb9
xor cx, cx
shr cl, 0x61
not al
and ecx, edx
dec al
xor bl, al
or dx, cx
xadd dl, dh
push ecx
lea eax, [esp + eax + 4]
jno 0xc587ed
jmp 0xd067dc
rdtsc
mov dword [esp], ecx
not dword [esp]
sub edi, 8
inc cx
js 0xcba05c
or edx, ecx
sbb edx, 0x2000edb5
adc edi, eax
sub cx, 0x4123
lea ebp, [ebp + edx - 0x7fff124d]
bts ecx, ecx
movzx eax, byte [ebp + edx - 0x7fff124c]
xor al, bl
add al, 0xf
xor al, 0x89
ror al, 1
neg ecx
inc al
bts dx, 0x91
btc cx, dx
bt cx, 0x2d
neg al
add al, 0x97
or ecx, 0xa01ff6b4
shl cl, 0xe4
xor bl, al
lea esi, [esi + edx - 0x7fff1250]
or edx, edx
jl 0xd93874
mov word [edx + esi - 0x7fff124e], ax
jge fcn.00c26ffe
mov dword [edi + 4], eax
mov dword [edi], edx
movzx edx, cx
or ecx, ecx
mov ecx, dword [edx + esi - 0xfabf]
xadd dword [esp + edx*2 - 0x1f57e], edx
lea eax, [edx + edx*4 + 0x7b298aab]
rol ax, 0xe5
lea esi, [esi + edx*8 - 0x2a04]
je 0xb0524f
cwde
xor ecx, ebx
call fcn.00c09e36
mov edx, 0x4ba4b1b8
and dl, 0x93
lea esi, [esi + edx - 0x4ba4b194]
lea eax, [edx*8 - 0x3f5d2fed]
btr dx, ax
mov edx, dword [esi + eax*4 - 0x7721724c]
lea ecx, [eax + 0x48365c2d]
sal ecx, 0xff
xor edx, ebx
inc cl
ror edx, cl
not ecx
lea edx, [eax + edx + 0x2a622383]
bts eax, eax
shr ax, 0xa7
bswap ecx
rol edx, 1
shl eax, cl
lea edx, [eax + edx - 0x3c726fe5]
lea eax, [ecx - 0x30713563]
sbb cl, cl
xor al, ch
xor ebx, edx
inc eax
btc ax, cx
adc ebp, edx
push eax
mov eax, dword [edi]
movzx edx, cl
and cl, dl
push ecx
lea edi, [edx + edi + 4]
add dl, ch
adc dl, byte [esp + edx - 0xff]
dec ecx
lea esi, [edx + esi - 0x100]
xor edx, edx
call fcn.0077f8af
mov eax, 0xe8353903
mov ecx, 0x2128f88f
lea ebp, [ebp + ecx - 0x2128f893]
xchg ecx, eax
neg ecx
mov eax, dword [ebp + ecx*4 - 0x5f2b1bf4]
not ecx
sal ecx, 0xf0
jbe 0x7519a9
ror dx, 0x41
rol eax, 1
sal edx, cl
rol cl, 0x66
add ecx, edx
inc eax
not eax
shl cl, 0xc1
lea edx, [edx + ecx*2 - 0x3c5f3374]
sal ecx, 0xcc
neg eax
neg dl
sal edx, 0x57
not ecx
xor ebx, eax
push ecx
add esi, eax
pop edx
jmp esi
Function at 0xc6c3df
Capabilities:
Encode data using xor

Disassembly:
sbb ebp, 8
mov dword [ebp + 0xc], eax
rol word [esp + 4], 0xc9
mov dword [esp], 0x6d2a242c
mov eax, dword [esp + 4]
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ecx
setae byte [esp + 6]
mov dword [ebp], edx
sub dword [esp + 1], 0xe6942ca0
cdq
and al, 0x85
mov ebx, dword [esp + 8]
pop edx
pop ecx
pop eax
jne fcn.00b99983
push ds
jo 0xc6c493
mov word [eax + 0x37], gs
dec ebx
mov dword es:[esi], ebx
rol dh, 1
inc ebx
jno 0xc6c478
and al, 0xf3
xor byte [edi + 0x76], 0x38
xchg dword [edi], edi
lodsb al, byte [esi]
invalid
jbe 0xc6c49b
push 0xfc0a76eb
in eax, 0x8e
mov fs, word [eax]
mov al, byte [0x89baa147]
enter 0x1c63, 0x61
jb 0xc6c4aa
jg 0xc6c4c7
invalid
sub bh, cl
pop ss
push cs
mov al, byte [ebx + 0x64bfe594]
loopne 0xc6c4fb
movsd dword es:[edi], dword [esi]
or eax, 0xf59c0b33
aas
xchg dh, cl
pop ebx
mov ebx, dword [0xab9d3729]
sub dword [edi], esi
popfd
stosd dword es:[edi], eax
jae 0xc6c4b7
add ebp, ebx
add byte [ebx - 0x3cb01480], bh
and dword [ecx], 0x52
test byte [eax + 2], dl
aas
jmp 0xc6c4ec
add bh, byte [edi]
xor eax, 0xc0cdffe3
jecxz 0xc6c4a7
dec ebp
rol byte [ecx - 0x3f3e9047], 0xa3
mov edi, 0xd240f75c
out 0xd0, al
int 0xc0
cmp dword [ecx - 0x5c3f3e91], 0x40f75cbf
shl dh, cl
ror byte [edx], 1
and byte [eax - 0x41], al
xor edi, edi
shr byte [ebx - 0x15], 0x9d
dec ebx
or byte [edi], bh
mov dh, 0x8a
cmp bl, cl
inc eax
sub al, 0x2c
mov edx, 0xdabe51c0
or ah, byte [eax]
inc eax
mov edi, 0x6bc0ff33
jmp 0xc6c45e
fld dword [eax + 0x2c]
sub al, 0xf3
mov edx, 0xdabe51c0
rcl byte [ecx - 0x42], 0xda
inc eax
dec esp
test al, 0x84
pop esp
xor al, 0x3f
jns 0xc6c4cd
xor bh, byte [edi]
add eax, 0xc0e742fd
in eax, dx
iretd
sub dl, byte [esi + edi*2 - 0x49]
push esp
jle 0xc6c4a6
or al, byte [eax + 0x11]
mov ss, ebp
shl bh, 0xf
pop ss
in al, dx
fdivp st(6)
dec edi
pop ss
jbe 0xc6c48a
pop ecx
ja 0xc6c4a3
ja 0xc6c490
cmp eax, 0x21737e27
lea esi, [ebp + 0x27]
test eax, 0x40e1cc74
mov ds, word [ebp + ebx*8 - 0x1976e481]
and dh, dl
jle 0xc6c58d
sbb ecx, dword [ecx + 0x7ef222e6]
jno 0xc6c543
pushal
pushal
mov cl, 0xb6
dec edx
jbe 0xc6c4eb
pop ebp
or edx, dword [ecx - 0x5e97f773]
jae 0xc6c58c
ficomp dword [ecx]
add dh, bh
jne 0xc6c515
sbb eax, dword [eax + 0x6b53e18c]
cmp byte [edx - 0x4cfbde8d], 0x8c
xlatb
adc ecx, ecx
add al, 0x64
mov esi, dword [eax - 0x3e]
mov esi, dword fs:[eax - 0x3e]
lea esi, [ecx - 0x80]
lds edx, [edx + 0x4c]
mov edi, 0x1930e067
mov esp, ds
push es
xlatb
dec esp
jno 0xc6c565
adc dl, ch
xchg ebx, eax
js 0xc6c5d4
test eax, 0x973fe1b0
mov al, 0xe1
aas
xchg edi, eax
int 0xc6
sar byte [esi + 0xd], 0xfc
cmc
cmpsb byte [esi], byte es:[edi]
je 0xc6c55f
clc
mov dh, 0
mov ebx, 0xc6469799
or al, 0xd5
sbb eax, 0x40d9edff
bnd call 0xa885d62c
lea edi, [edi - 0x2f403804]
lds ebx, [eax]
aas
mov edx, 0xefbdc29e
rcl byte [ecx - 0x40c1334b], 0xf7
ret
sahf
ret 0xefbd
add dl, al
lea eax, [ecx + ecx + 0x741f46bd]
mov eax, dword [ebp]
jmp 0xd8ffbb
add ebp, 4
sal ecx, 0x76
call fcn.00b423ac
rol eax, 1
dec eax
xchg byte [esp], ch
btr ecx, 0xae
neg eax
movzx edx, cl
pop ecx
xor ebx, eax
add edi, eax
shr dx, 0xce
and cx, 0x5e10
call fcn.00b1cbf6
Function at 0xc78b34
Capabilities:
Encode data using base64

Disassembly:
inc dword [esp]
add esi, eax
pop ecx
jmp esi
lea eax, [edx + eax + 0x2e340416]
mov eax, dword [eax + edi - 0x59465872]
sbb ecx, edx
xor eax, ebx
sar ecx, 0x95
btc dx, 0x99
setb cl
not eax
rol ecx, 0x61
push edx
dec eax
bswap eax
and dx, word [esp + edx*2 - 0x58d]
rol edx, 0x42
cmovbe ecx, edx
ror eax, cl
not edx
or cl, 0x21
xor ebx, eax
dec edx
jl 0xafc9c7
dec eax
mov esp, edi
inc ebp
mov ecx, esi
dec esi
lea ebp, [esi*8 - 0x7244115d]
popfd
jmp 0xd0c671
dec edi
lea ebp, [esi + ecx + 0x1b03b23a]
dec edx
lea edi, [esi*4 - 0x45c566e8]
inc ecx
pop ebx
inc ecx
pop esp
push edi
dec esp
mov ecx, dword [esp + 8]
movsx ebx, byte [esp + 1]
inc ecx
pop eax
dec eax
mov esi, dword [esp + ebx*2 - 0x80]
dec eax
mov eax, dword [esp + ebx*4 - 0x100]
call fcn.00b3da8c
mov ecx, 0xd9044a3
movzx edx, cl
not dl
mov dx, word [ecx + ebp - 0xd9044a3]
lea ecx, [ecx + ecx*8 - 0x33eda07c]
sar cl, 0x84
mov cl, byte [ebp + ecx - 0x4624c901]
mov eax, 0xe93e7516
lea eax, [eax + eax*2 + 0x19324d28]
adc ebp, 1
or eax, eax
not eax
shr dx, cl
lea ecx, [eax + eax*2 + 0x53bd908]
mov word [ebp + eax - 0x2b125395], dx
btr cx, ax
movzx edx, cl
lea edi, [edi + eax - 0x2b125399]
jae 0xc098e6

Function at 0xc7939c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push esi
mov esi, 0xa004fd97
mov esi, dword [esp + esi + 0x5ffb0269]
mov dword [esp], 0xd1a7e064
call fcn.00d4fd61
cwde
xadd ecx, eax
xor ebx, edx
mov dword [esp], eax
call fcn.00c4ba2d
lea esp, [esp + 0x14]
jmp 0xb5e193

Function at 0xc81d4d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], eax
push 0x52a8708f
dec ebx
push 0xf7860f88
call fcn.0075f567
add byte [eax], al
add byte [eax + 0x61], dl
je 0xc81dd0
inc esi
imul ebp, dword [ebp + 0x45], 0x74736978
jae 0xc81db4
add byte [ecx + 0x49216d28], bh
mov eax, dword [ecx + ebp - 0x49216d28]
mov cx, word [ebp + ecx - 0x49216d24]
mov edx, 0x45300926
call fcn.00b2ad5c
mov edx, 0x494a38e1
sal byte [esp + ebp], cl
Function at 0xc8af85
Capabilities:
Encode data using base64

Disassembly:
hlt
mov word [edi], dx
pop edx
jle fcn.00d0eefc
loop 0xb183d3
sbb dword [esi + ebx*2 + 0xda8a28d], ebx
out 0x76, al
imul dword [eax + 0x389a1be0]
push ds
push edi
bound ecx, qword [edi - 0x33]
loop 0xb1842c
cwde
mov eax, 0x7762889
dec edi
push ecx
push edi
enter 0xffffffffffffd026, 0x61
xchg edi, eax
invalid
xlatb
mov cl, 0xdf
jp 0xb1836f
inc ebx
sub eax, 0x9511a8e5
or al, byte [0x30a516c8]
push es
xor al, 7
invalid
push 0xf2b872c6
enter 0x3d56, 0xffffffffffffff9e
add eax, dword [ebp - 0x492b6b5a]
mov eax, 0xff173cba
cmc
push 0xffffffffffffffea
stc
add dword [ecx - 0x43], eax
xchg ecx, eax
sbb dword [bp + di - 0x929], eax
pushal
pop edi
jle 0xb18457
inc ebp
out 0x4a, al
jno 0xb18423
push ss
aaa
pop esi
hlt
fiadd dword [ebx - 0x1e963ebb]
ret 0x2fd4
neg dword [esp]
xor eax, ebx
xchg ch, cl
inc cx
neg eax
movzx edx, word [esp]
bswap eax
neg dx
ror cl, 1
rol eax, 1
or edx, 0xf2140daa
xor eax, 0xc4099a90
sar edx, 0xf0
lea ecx, [edx + edx*4 - 0x76c30c64]
sal cx, 0xc2
xor ebx, eax
xadd dword [esp], ecx
and edx, edx
call fcn.00b0da2e
xor eax, ebx
ror cx, 0xcd
mov dword [esp], ecx
movsx edx, cl
rol eax, 2
btr edx, 0x15
dec eax
not dword [esp + edx*2 - 0xf8]
rol eax, 1
bt ecx, edx
add cx, 0xbeba
not eax
push ecx
rol eax, 1
push ecx
pop edx
not cx
xor ebx, eax
sal cl, 0x46
xchg dword [esp + 4], ecx
push edx
adc edi, eax
movsx eax, dl
mov ecx, dword [ebp + ecx*2 - 0x43f6ef06]
shl eax, 0x37
dec edx
mov eax, dword [ebp + eax*4 - 0x6bfffffc]
neg dx
call fcn.00d30e95
sysenter
push ebp
pushfd
mov ebp, 0xb228c2b2
xor bp, bp
mov ebp, dword [esp + ebp + 0x4dd80004]
mov dword [esp + 4], 0x696739c3
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00c7d61e
dec ecx
and eax, eax
sub al, 0x2c
xor ebx, ecx
btr ax, 0xbb
sal dx, 0xeb
adc ebp, ecx
lea eax, [eax*8 + 0x4068a00]
lea ecx, [eax + edx - 0x2554ceff]
movzx ecx, byte [eax + esi - 0x22f48f0]
lea esi, [esi + eax*4 - 0x8bd23bf]
bt eax, edx
dec edx
or edx, edx
xor cl, bl
dec ax
shr dl, 3
btc ax, 0x17
neg cl
sal ax, 0xcb
ror eax, 0x3d
dec edx
dec cl
lea edx, [eax + eax*2 + 0x5f9a6dad]
shl eax, 0xd
ror cl, 1
bswap edx
not cl
or al, dl
xor bl, cl
bt dx, dx
push edx
dec edx
lea ecx, [esp + ecx + 4]
sbb eax, dword [esp + eax - 0x78000094]
shl dx, 0xce
movzx dx, byte [ecx]
cwde
xor byte [esp + 2], al
movsx ecx, ax
sbb edi, 2
not ax
xor cx, cx
je 0xb183a1
mov eax, 0xdab0f211
mov ecx, 0xf38a7f8e
ror ecx, cl
mov eax, dword [edi]
push ecx
sar dword [esp], 0xd9
sar cl, 0x64
adc edi, 3
jmp 0xc76a49

Function at 0xc8b249
Capabilities:
Execute syscall

Disassembly:
mul ecx
call fcn.00ba77b1
syscall
inc ecx
push eax
dec eax
mov dword [esp], 0xfd5c2ab0
call fcn.00cd6a42