joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a6e6e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100a6eb8
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100a6e5f
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100a6e6e
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x104acb11
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100a6ebf
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1008dd35
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100a6f5e
add edi, 4
add eax, 2
dec ecx
jne 0x100a6ea4
call 0x100a6f0b
loope 0x100a6f01
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100a6f5b
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100a6f6c
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100a6f1f
cmp eax, ecx
ja 0x100a6f1f
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100a6fa9
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100a6f9f
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1008e214
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..3ean
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x58530389
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..7LWLf
mov ebx, 0x42f3f8
nop
mov ecx, 0x5f2517e1
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1028c243
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1028c282
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1028c282
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1028c282
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1028c282
cmp dword [ecx + 0x74], 0xe
jbe 0x1028c282
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1028f361
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1028f3fe
push ebx
push esi
call fcn.1028f32a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1028f2be
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1028f3ab
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1028f3fd
push edi
push eax
call fcn.1028cd57
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1028f3cb
call fcn.1028cd1d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1028f3fc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1028f2be
add esp, 0x20
test eax, eax
jne 0x1028f3ea
push edi
call fcn.1028cd1d
jmp 0x1028f3f2
push ebx
call fcn.1028cd1d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1028f66b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x102975a0
push 0x10297598
push str.FlsAlloc
push 0x1f
call fcn.1028f587
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1028f69f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1029513c]
call esi
jmp 0x1028f6a5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1028f6e9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x102975b0
push 0x102975a8
push str.FlsGetValue
push 0x21
call fcn.1028f587
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1028f720
push dword [ebp + 8]
mov ecx, esi
call dword [0x1029513c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1028f728
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x102975b8
push 0x102975b0
push str.FlsSetValue
push 0x22
call fcn.1028f587
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1028f762
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1029513c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x102947d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x102947fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x102947fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x933e07
Capabilities:
Encode data using base64

Disassembly:
lea edx, [eax*4 + 0x8112bac]
dec ecx
imul eax
xchg dword [esp + edx*2 - 0x768c40], eax
sal dword [esp + edx*2 - 0x768c40], 0x19
ror ecx, 2
mov dword [esp + edx - 0x3b4622], edx
ror byte [esp + edx*2 - 0x768c40], 0xe3
xor ebx, ecx
ror ax, 0x23
add al, al
mov dword [ebp + edx*2 - 0x768c4a], ecx
movsx ecx, word [esp + edx - 0x3b461e]
mov edx, dword [esi + edx*4 - 0xed1883]
cwde
adc eax, 0x69b6cb0f
cwde
xor edx, ebx
bswap ecx
rol cx, 0x23
ror word [esp + eax - 0x2b11], 0xe9
ror edx, 2
bt ax, 0x1b
inc ax
call fcn.00963925
rol al, 1
add al, 0x22
neg byte [esp + edx*2 - 0x1fe]
bt dx, 0xac
xor bl, al
mov word [edx + esi - 0x105], ax
mov edx, dword [ebp + edx*2 - 0x204]
shl dword [esp], cl
sbb ebp, 5
xor edx, ebx
bswap edx
call fcn.0094e56b

Function at 0x9386de
Capabilities:
Encode data using base64

Disassembly:
add eax, edx
shr dword [esp + 4], 0x4b
sal word [esp + 6], 0xc1
sete byte [esp + 4]
mov dword [ebp - 4], eax
test ebx, ebx

Function at 0x938704
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov esp, dword [esp + edi - 0x83]
dec eax
mov edx, dword [esp + ecx - 0x5634617b]
inc ecx
pop edi
jo 0x962ae2
dec esp
mov ebp, dword [esp + ecx - 0x5634617b]
jns 0xa2602c
dec edx
mov ebx, dword [esp + esi - 0x7510]
push edx
inc edx
mov ecx, dword [esp + esi - 0x751f]
inc eax
shr dh, 3
dec ebp
arpl ax, ax
inc ecx
pop edi
dec ecx
adc edi, eax
inc esp
movzx eax, si
inc cx
dec ebx
cwde
dec edx
mov dword [esp + esi - 0x7520], edi
ret 0x10
dec eax
mov ebx, dword [esp + ecx - 0x56346173]
mov esi, ecx
dec esp
mov esi, dword [esp + ecx - 0x5634616b]
push eax
inc ecx
mov edi, 0x972b1727
dec esp
mov dword [esp + esi - 0x56346183], edi
dec esp
mov edi, dword [esp + ecx - 0x5634615b]
btr di, cx
push edi
dec eax
mov edi, dword [esp + esi - 0x5634614b]
dec eax
mov esi, dword [esp + esi - 0x56346143]
dec esp
lea eax, [ecx*8 + 0x7e305f2b]
dec eax
mov eax, dword [esp + ecx - 0x5634613b]
push dword [esp + 0x60]
popfd
inc ecx
push eax
push ecx
dec esp
mov eax, dword [esp + ecx - 0x5634611b]
pop ecx
xchg dword [esp + ecx - 0x5634618f], ecx
dec eax
mov ecx, dword [esp + ecx + 0x75]
call fcn.00a24366
imul edx, dword [esp + eax*2 + 4]
pop ecx
pop eax
jb fcn.00a106d2
Function at 0x93a63e
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx - 0x1f968eb6], 0xac326999
xor al, bl
neg dx
not dl
sbb al, 0x93
ror edx, 0xca
neg al
or byte [esp + edx - 0x6d47e59b], 0x22
bt dx, 0x81
inc dword [esp + edx - 0x6d47e59c]
dec al
or dword [esp + edx - 0x6d47e59c], edx
neg edx
imul dx, word [esp + 2]
neg al
imul edx, edx
or dword [esp + edx - 0x59517c10], edx
xor bl, al
lea eax, [esp + eax + 4]
mov word [esp + edx - 0x59517c0f], dx
or edx, dword [esp + edx - 0x59517c10]
mov dword [eax], ecx
movzx ecx, byte [esp]
mov dword [esp + ecx - 0x9e], ecx
mov edx, dword [ecx + esi - 0x9d]
lea esi, [esi + ecx - 0x99]
xor edx, ebx
mov eax, 0x6f07589f
not edx
or dword [esp + ecx - 0x9e], eax
xor edx, 0x84230926
ror eax, 0x5b
setb al
sbb edx, 0xc19601b2
bswap eax
shl cl, 0x47
rol edx, 1
pop eax
sar eax, 0x1c
xor ebx, edx
add al, ch
dec cl
adc edi, edx
shr cx, 0x44
sbb eax, 0x6c81e0ad
call fcn.00a0586b
lea esp, [esp + 0x14]
je 0xa995e7
push 0xf40e7420
mov dword [esp], edi

Function at 0x941389
Capabilities:
Encode data using base64

Disassembly:
movzx ecx, dl
mov dword [esp + ecx - 0xd4], ecx
mov ecx, dword [esi + ecx*4 - 0x360]
or dl, 8
mov dword [esp], 0xe73b7006
adc esi, 4
add edx, 0x572e0126
shl dword [esp + edx - 0x572d20fa], 0xe9
xor ecx, ebx
add edx, dword [esp + edx - 0x572d20fa]
not ecx
not dword [esp + edx - 0x572ed0fa]
jae 0xb7281b
xor eax, ebx
neg eax
inc ecx
imul cx, cx
inc ecx
xor eax, 0x26a7ed83
neg dl
rol eax, 1
btc ecx, ecx
sub cl, 0xa9
bswap edx
neg eax
or dl, 0x1d
shl cl, 1
xor ebx, eax
and ecx, ecx
not dx
and dl, 0x3c
adc edi, eax
jmp edi
not ecx
inc dl
inc ecx
rol ecx, 2
push eax
add dword [esp + eax*2 - 0x1ad20], edx
pop eax
xor ebx, ecx
inc word [esp + eax - 0xd68d]
call fcn.00979be6
rol edx, 0x66
ror ecx, 1
movzx eax, word [esp + 4]
shr dl, 7
inc dword [esp + eax*8 - 0x27ff4]
bswap ecx
mul word [esp + eax*2 - 0x9ffd]
or ax, dx
ja 0x9d1f39
neg dl
sub dl, 0x1f
dec word [esp + ecx*2 - 0x586805cc]
ror word [esp + ecx*2 - 0x586805cc], cl
xor dl, 0x2a
xchg byte [esp + ecx*2 - 0x586805ca], cl
not dl
ror cx, 0xa2
or ecx, ecx
inc ecx
xor dl, 8
call fcn.00aa1635
add byte [eax], al
mov dh, 0x9b
mov edx, 0xbdab2037
inc eax
lcall 0xb3ca, 0xcd9b4fa
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
pop edi
xlatb
xor byte [ecx], bh
outsd dx, dword [esi]
rol byte [edi - 0x7d], 1
fstpnce st(6), st(0)
adc eax, 0x84a9de0e
adc esp, dword [ecx + 0x39]
adc ah, byte [ebx]
dec si
test al, 0x72
outsd dx, dword [esi]
xlatb
inc edx
push 0xcd79da0
or esp, edi
or ecx, dword [ecx - 0x4f]
mov dh, 2
shl byte [edi], 1
xchg byte [0xd8bd2a7], al
sub al, byte [ebx + edi*4 + 0xa]
pop ebp
invalid

Function at 0x944573
Capabilities:
Encode data using base64

Disassembly:
jmp 0xb883bb
mov dword [esp + 4], edi
lea esp, [esp + 4]

Function at 0x944ce2
Capabilities:
Encode data using base64

Disassembly:
adc ebp, 3
mov dword [esp], 0x4eba2c9b
sal byte [esp], 0xa7
div ecx
mov dword [ebp], edx
mov ecx, 0xe42eaa83
movsx edx, cx
mov dword [ebp + 4], eax
call fcn.00a7401c
Function at 0x944f2b
Capabilities:
Encode data using base64

Disassembly:
add edi, eax
movzx ecx, word [esi + ecx - 0x4b622a71]
mov edx, 0x1c2ffd98
bts dx, 0x92
mov dword [esp + edx - 0x1c2ffd9c], edx
lea esi, [esi + edx*4 - 0x70bff66e]
bts edx, edx
xor cx, bx
dec cx
sub byte [esp + edx*2 - 0x385ffb36], dl
rol cx, 1
not dword [esp + edx - 0x1c2ffd9c]
not cx
lea eax, [edx*8 + 0x3892911f]
add dword [esp + edx - 0x1c2ffd9c], edx
bts edx, edx
dec cx
xor dx, ax
cbw
mul dword [esp + edx - 0x1c2f8063]
xor bx, cx
rol dx, 0x81
lea ebp, [ebp + edx*2 - 0x3411424e]
mov dword [edx + ebp - 0x1a08a125], ecx
jae 0x9db40e
mov dword [esp + edx*2 - 0x3411424a], eax
pop ecx
jno fcn.00989a2c
mov edx, 0x12bcaa25
add edx, edx
mov eax, dword [esi + edx - 0x2579544a]
movsx ecx, dl
not dx
sal cx, 0xf
lea esi, [esi + ecx + 4]
xor eax, ebx
sal edx, 0xe8
xadd cl, dl
neg eax
and ecx, ecx
not eax
seta dl
rol ecx, 0xa9
xchg edx, ecx
sbb eax, 0x8f0574a9
neg ecx
rol eax, 2
xadd edx, ecx
xor ebx, eax
add edi, eax
btc edx, edx
rol edx, 0xfe
movzx eax, byte [esi + edx - 0x619512c0]
sub dx, 0xae90
lea esi, [ecx + esi + 1]
or edx, ecx
xor al, bl
btc ecx, edx
jae 0xa0e94b
or dl, dl
adc al, 0x87
lea ecx, [edx + edx*8 + 0x7108cc06]
sub ecx, edx
xor al, 0x81
neg al
or cl, 0x39
inc ecx
sbb al, 0x3b
imul edx, ecx
neg al
shr ecx, 0xa7
sbb al, 0x37
xor bl, al

Function at 0x9477eb
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov dword [esp + ecx*2 - 0x8e], ebp
pop esi
jge fcn.00987526

Function at 0x954527
Capabilities:
Encode data using base64

Disassembly:
xor bl, dl
xchg ecx, eax
neg eax
shl cl, 0x24
lea edx, [esp + edx + 8]
mov dword [esp + eax - 0x221b0400], eax
and byte [esp + eax - 0x221b03fb], cl
mov eax, dword [ecx + edx - 0x76a0]
mov edx, 0x1438c18c
mov dword [esi + ecx - 0x76a4], eax
inc byte [esp + ecx*2 - 0xed3c]
lea eax, [ecx + ecx*4 - 0x40d677c3]
mov edx, dword [ebp + ecx*2 - 0xed45]
lea ebp, [ebp + ecx*8 - 0x3b505]
xor edx, ebx
inc edx
bswap edx
push ecx
rol al, 0x81
ror edx, 3
xchg ecx, eax
and cx, cx
sal ax, 0xa8
bswap edx
inc edx
inc cl
pop eax
push eax
xor ebx, edx
sub dword [esp + eax*2 - 0xed3b], eax
not ecx
adc edi, edx
movsx edx, al
sal word [esp + ecx - 0x40d42640], cl
ror dword [esp + ecx - 0x40d4263c], cl
mov ecx, dword [ecx + esi - 0x40d42648]
sub edx, 0x2c9f6621
setnp al
mov edx, dword [esi + eax*2 - 0xec02]
ror word [esp + eax*8 - 0x3b003], 0xa1
call fcn.009b5a62
Function at 0x959bc5
Capabilities:
Encode data using base64

Disassembly:
shr dx, 6
mov eax, dword [eax + ebp - 0x20cd8559]
shr edx, 0x7b
not ecx
lea edx, [edx*2 - 0x7d650f70]
xor dl, 0x95
not eax
jae 0x95c2d2
inc ecx
mov edi, 0x5583033b
inc ebp
movzx ebp, bh
inc edi
mov ebp, dword [edx + ebp*8 - 0x1dc]
inc esp
xor ebp, ebx
inc ebp
movsx ebx, di
inc ecx
movsx ecx, bh
inc edi
lea ebp, [edi + ebp - 0x4ed6d797]
inc ecx
mov esi, 0x7aba2e87
dec edx
lea esi, [edi*4 - 0x53e2d3ec]
not ecx
inc ecx
not ebp
inc ecx
inc ebp
inc ecx
movzx edx, bx
inc ebp
xchg bl, dh
mov eax, ecx
inc ecx
neg ebp
inc ecx
bswap ebp
dec ebx
lea ebp, [esi + edi*8 + 0x559d6a1b]
inc esp
movzx esp, dl
push ebx
dec ecx
bt esp, eax
inc ecx
bts esp, edx
inc esi
xor dword [esp + edi - 0x5583033b], ebp
shr dl, cl
dec esp
xadd edx, esp
dec eax
add ebp, ecx
pop ebx
inc ecx
push edi
dec ecx
rol esi, 0xb2
inc ecx
push ebx
inc edi
mov dword [edi + ecx - 0x5583033f], ebp
inc esp
mov eax, ecx
pop eax
inc ebx
mov ebp, dword [edi + edx - 0x55830343]
inc ecx
adc edi, 0xcbb3400
xor ebp, ebx
cdq
inc ecx
push esi
inc ecx
shr ah, cl
xor ebp, 0x8707b63d
inc dx
inc dword [esp + edi - 0x623e3735]
sar edx, 8
dec edx
mov dword [esp + edi - 0x623e3736], 0xe02c6f39
bswap ebp
inc ecx
sub dh, bh
bt ecx, 0x1d
dec edx
dec dword [esp + ebx*4 - 0xe18]
neg ebp
inc edx
mul byte [esp + edi - 0x623e3737]
inc ebp
xchg esp, edi
inc edx
div byte [esp + ebx - 0x37b]
sub ebp, 0xbdb6ce84
dec ecx
div edi
dec edx
mov dword [esp + edi - 0x2f8], ebx
dec esi
xadd dword [esp + edi - 0x300], eax
inc ecx
bswap eax
inc edx
xor dword [esp + edi - 0x2f8], ebp
dec edx
neg dword [esp + edi - 0x300]
jo 0x9a36f1
dec esp
cmovne esi, eax
dec edx
mov ebx, dword [esp + edi - 0x2f8]
inc ecx
shr esi, cl
inc edx
dec byte [esp + edi*2 - 0x5ff]
inc ebp
movzx ebp, al
dec eax
arpl bp, bp
inc sp
xchg esi, ebp
shr cl, cl
dec edx
mov dword [esp + edi*4 - 0xbf8], esi
dec eax
adc edi, ebp
inc bp
btr eax, ebp
inc edi
movzx edi, byte [edi + edx - 0x309]
shr ecx, cl
inc edx
mov dword [esp + ebx*4 - 0xe1b], edx
dec edi
lea edx, [edx + ebx - 0x390]
inc ecx
xor eax, 0xd0370bbd
inc esp
xor bh, bl
inc ecx
xor bh, 0x84
inc dx
sub edx, dword [esp + ebx*2 - 0x702]
inc ebp
adc bh, bl
dec edx
add dword [esp + ebx - 0x37f], 0x25bc4f10
inc cx
shl eax, 9
dec edx
rol dword [esp + ebx - 0x37f], cl
inc ecx
rol bh, 1
or eax, 0xb73f640a
inc ecx
sbb bh, 0x14
dec ecx
lea ecx, [ebx + 0x4d8b2710]
inc ecx
movzx ebp, ch
dec edx
not dword [esp + ebx - 0x37f]
inc ecx
xor bl, bh
inc edx
div dword [esp + ebx - 0x37d]
inc ebp
xchg ebx, ebp
dec esi
lea edi, [esp + edi + 0x10]
dec ebx
mov eax, dword [edi + ebx - 0x39c5]
inc edx
xor dword [esp + ebx - 0x39bb], 0x7b28088a
call fcn.00a4b434
inc bp
or eax, eax
dec eax
arpl bp, bp
call fcn.00a8fc86
mov ecx, dword [esi]
mov eax, 0xf8b3f10b
add esi, 4
movzx edx, ax
xor ecx, ebx
cwde
rol al, 0x41
rol ecx, 1
rol eax, 0xe6
inc ecx
bts ax, dx
btc edx, eax
jb 0x9621f1
not ecx
adc eax, edx
lea eax, [edx + 0x7f1a6735]
neg ecx
shl eax, 0x91
sub eax, 0x8fb27aa3
adc dx, 0xfbaf
xor ebx, ecx
lea edx, [eax*8 - 0x1ff48d45]
add edi, ecx
movzx ecx, dx
mov ecx, dword [eax + ebp - 0x20cd855d]
jmp 0x94e369
Function at 0x95aab2
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xa993afa1
lea ecx, [edx + ecx - 0x4b649f14]
neg eax
and al, 0xa6
xor ecx, 0x7099f8a5
lea eax, [edx*2 + 0x1c0ee0be]
lea ecx, [ecx + eax*2 - 0x61430c7b]
rol dl, 0x23
btc edx, edx
dec dl
xor ebx, ecx
shl dword [esp], 9
add edi, ecx
lea ecx, [edx - 0x474547eb]
movzx edx, byte [ebp + ecx - 0x71c70c80]
lea ebp, [ebp + ecx - 0x71c70c80]
xor dl, bl
neg dl
cbw
ror dl, 1
dec ax
xor ax, 0xc9b8
inc dl
not dl
jmp 0xa6a28c
jnp 0xa8f05f
shr dword [esp], 0x6a
mov word [esi - 4], cx
adc esi, 0xfffffffb
pop eax
jmp fcn.00a106d2
and dword [esp + ecx - 0x71c70c7a], 0x3a23869a
xor bl, dl
or cx, word [esp + ecx - 0x71c70c79]
jno 0xb81702
movsx ecx, dl
mov si, word [eax + esi - 0x289d14e8]
xor ecx, 0xc63b0185
jle fcn.00a106d2
pop edx
adc edx, 0x4909
jmp edx
lea edx, [esp + edx + 4]
sal ecx, 0x6e
movzx cx, byte [edx]
jne 0x9d98e2

Function at 0x95f4eb
Capabilities:
Encode data using base64

Disassembly:
dec eax
arpl ax, ax
inc si
sub dword [esp + ebp*8 - 0x60078], eax
dec edx
mov dword [esp + eax - 0x4f19561a], ebp
dec esi
lea esp, [ebp + edi*8 - 0x604ed955]
dec eax
adc edi, eax
dec edx
mov dword [esp + ebp - 0xc011], 0x922fd082
dec ebx
mov edx, dword [ebp + ecx - 0xc011]
inc edi
movzx esi, byte [eax + edx - 0x4f195637]
inc bp
bts ebp, ebp
inc esp
xor dh, bl
inc ecx
rol ah, 0xc3
pop esi
inc ecx
rol dh, 1
jmp 0xaad650

Function at 0x96145d
Capabilities:
Encode data using base64

Disassembly:
pop ecx
mov dword [ebp], edx
mov eax, 0xacb30c12
movsx edx, ax
mov eax, dword [esi + edx - 0xc12]
lea esi, [esi + edx*8 - 0x608c]
movzx ecx, dl
bt edx, edx
call fcn.00958206

Function at 0x9619cd
Capabilities:
Encode data using base64

Disassembly:
neg edx
xor edx, 0x26a7ed83
rol edx, 1
ror cl, 0xa1
call fcn.00a86139
shl ebp, 0x89
dec eax
add esi, esp
inc ecx
shr ebx, 0x6f
inc esp
mov dword [ecx + esi], esp
inc ecx
xor cl, byte [edx + ebp - 0x3feaf202]
inc ebp
movsx ebp, di
rol ebp, 0x7d
xor cl, bl
inc ecx
not bh
inc cx
ror ebx, 0xa4
inc ecx
xor cl, bh
ror cl, 1
inc ecx
mov edx, ebp
jmp 0xac1cea
Function at 0x961f4c
Capabilities:
Encode data using base64

Disassembly:
xor bl, al
ror ecx, cl
lea eax, [esp + eax + 8]
setb cl
pop ecx
movsx ecx, dl
adc edx, dword [eax + edx]
lea ecx, [ecx*2 + 0x390714a5]
push ecx
dec cx
mov dword [ebp + ecx*2 - 0x720e294c], edx
lea eax, [ecx*2 + 0x7b29f3a6]
rol cx, 0x88
add ax, ax
mov eax, dword [ebp + ecx*2 - 0x720f482c]
mov dx, word [eax + ecx*2 - 0x720f4828]
jo 0xa679d7
pop eax
cwde
mov word [ecx + ebp - 0x3907a416], dx
add dword [esp + eax*2 - 0x294a], ecx
lea ebp, [ebp + ecx*2 - 0x720f482a]
cwde
sbb cl, 0x2f
movsx edx, byte [esp + eax*2 - 0x294a]
pop eax
jb fcn.00989a2c
mov ebp, 0xdcb3948c
dec ecx
sub edx, 1
push ebp
inc esp
movzx edi, ch
inc edx
sal byte [esp + edi*4 - 0x22c], 0xe1
inc edi
movzx esp, byte [edx + edi - 0x8c]
inc eax
add ch, 0x99
inc esp
xor ah, bl
inc dx
ror dword [esp + edi*2 - 0x116], 0xa3
inc ecx
sbb ah, 0x91
inc ecx
push edi
inc cx
rol edi, 0xe3
inc ecx
not ah
dec edi
lea ebp, [edi + edi*8 - 0x7e76eedd]
mov esi, 0x3b3184b8
dec ecx
neg edi
inc ecx
ror ah, 1
inc ecx
neg ah
jmp 0x9c446b
dec ecx
bswap edi
inc ecx
xor bl, ah
call fcn.0096a7db

Function at 0x963ae0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [esi + ecx*4 - 0x6573800]
mov eax, edx
mov dword [esp], 0xe52c2aa9
rol dword [esp], 0x1b
lea eax, [esp + 0x6d]
rol dword [esp], 0x81
mov byte [eax], cl
jo 0xa10e89
pop eax
jbe 0x963b54
cmc
pop ss
mov ch, 0xeb
ja 0x963b58
push esi
dec esi
and byte [edx - 0x18d3ba2b], dh
mov eax, ds
fadd st(6)
mov word [ecx + 0xf], es
mov bh, 0xcd
movzx ecx, bp
xor esi, ebx
rol ax, 0x26
xor esi, 0xc6a877a4
inc ebp
mov esi, eax
rol ax, 0xc5
cdq
ror esi, 1
call fcn.00b7930a
mov esi, 0x55b73832
inc si
mov esi, dword [esi + ecx - 0x55b73832]
inc esp
movzx ebx, dh
push esi
dec eax
add esi, esi
inc ebx
mov cl, byte [ecx + ebx*8 - 0x18e]
dec edi
lea ecx, [ecx + ebx*4 - 0xc6]
inc cx
shr esi, cl
inc esi
movzx eax, byte [esp + ebx - 0x31]
mov ebp, 0x20058514
inc di
mov dword [ecx + ebx - 0x32], esi
dec ecx
not ebx
dec edi
lea edx, [edx + ebx + 0x2f]
inc edi
mov ebp, dword [edx + ebx*2 + 0x66]
inc ecx
pop edi
inc esp
xor ebp, ebx
dec ebx
lea ecx, [ebx + eax*8 + 0x331fe707]
call fcn.009fb1f8
xchg byte [esp + 2], dl
and dx, dx
mov eax, dword [esi + 2]
call fcn.00a02d49
Function at 0x96a155
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0xb7afb586
xor dl, bl
shl cx, 0x44
bts eax, ecx
shr eax, 0xbd
inc dl
xor dl, 0x39
rol dl, 1
xor dl, 0x11
xchg dword [esp + eax], ecx
dec cl
mov dword [esp + eax*4 - 0x1c], 0xea90a18d
xor bl, dl
mov cx, dx
pop edx
cdq
btr ax, dx
or dl, byte [ebp + eax*4 - 0x22]
rol word [esp + eax], 0x4d
rol byte [esp + eax - 6], 0x22
lea ebp, [ebp + eax*8 - 0x3a]
jae 0x9abdcb
xor dl, bl
dec eax
sub dl, 0x82
and dword [esp + eax - 1], eax
ror word [esp + eax*4 - 0x14], 0xc9
neg dl
bts eax, 0x11
shr al, 0xc2
xor dl, 0x23
and dword [esp + eax - 0x1ffff], eax
neg dword [esp + eax - 0x1fffd]
sar eax, 0x6f
neg dl
xchg byte [esp + eax*2 - 5], al
neg al
adc dword [esp + eax + 4], eax
ror dl, 1
xor bl, dl
sal al, 0x22
inc eax
ror ax, 4
lea edx, [esp + edx + 8]
mov byte [edx + eax*2 - 0x2000], cl
xadd byte [esp + eax*2 - 0x1ffb], al
sub dword [esp + eax - 0xfff], 0x3fa53b9e
pop edx
pop ecx
jno fcn.00a106d2

Function at 0x96a7db
Capabilities:
Encode data using base64

Disassembly:
dec esi
lea esp, [esp + 0x18]
dec eax
rol ebp, 0xec
inc esi
movsx ecx, si
inc bx
mov esi, dword [ebp + 0x7e76c77d]
push ebp
dec edx
mov dword [esp + ebp + 0x7e76c785], 0x9ab95e32
inc edx
ror dword [esp + ebp + 0x7e76c786], 0x3f
dec edi
lea ecx, [ecx + ebp + 0x7e76c77b]
inc bx
mov dword [ebp + ecx + 0x7e76c77d], esi
dec edi
lea edx, [edx + ebp + 0x7e76c779]
push ebp
inc ebx
mov edx, dword [edx + ebp + 0x7e76c77d]
inc edx
add byte [esp + ebp + 0x7e76c780], 0x8c
dec esi
sub edi, dword [esp + ebp + 0x7e76c79d]
inc edx
movsx esi, word [esp + ebp + 0x7e76c785]
xor edx, ebx
inc ecx
or bh, 0x3e
inc esp
movsx esi, ch
neg edx
inc edx
lea edx, [edx + esi - 0x2cd3abc0]
inc ecx
or ebp, esi
xor edx, 0x2f191528
inc ecx
lea edx, [ebp + edx - 0x522d720c]
dec edx
mov dword [esp + ebp + 0x7e76c79d], ebx
xor dword [esp + esi - 0xdab], edx
inc ecx
pop edi
xchg word [esp + esi - 0xdc1], si
inc eax
xor dh, cl
dec eax
mov ebx, dword [esp + esi - 0x35b3]
dec eax
neg dword [esp + esi - 0x35c5]
dec eax
arpl dx, dx
dec eax
add edi, edx
inc edx
inc byte [esp + ebp + 0x7e76c780]
inc ecx
pop edi
dec eax
mov dword [esp + esi - 0x35bb], 0x26265107
pop eax
pop ebp
pop esi
jge fcn.00987526