joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc5f080
Capabilities:
Encode data using base64

Disassembly:
dec eax
btr eax, eax
dec esi
mov dword [esp + ebx*8 + 8], eax
dec esp
adc ecx, ebp
pop edx
rol edi, 0x24
inc ebp
xor bl, bh
inc ebx
mov ebx, dword [ebx + 0x85]
dec ebp
adc edi, esi
inc ecx
xor ebx, edx
dec ebx
neg ebx
inc ebp
sub bl, ch
dec ecx
div ebx
rol ebx, 1
inc edx
lea ebx, [ebx + ebx*8 - 0x7d837dc9]
dec eax
neg edi
dec ecx
dec esi
jbe 0xf22e5d
mov cx, word [esi]
sal edx, 0xcc
mov dx, word [esi + 2]
adc esi, 1
dec eax
btr eax, eax
not cx
not dx
or al, ah
sar al, 0x81
xor ax, ax
or cx, dx
mov edx, eax
sub edx, edx
ja 0xc9d4b8
mov word [esi + edx*2], cx
add edx, edi
jmp edx
inc ecx
push edx
inc cx
imul edi
inc ecx
dec eax
inc edx
xor dword [esp + ebx + 0xbc], ebx
dec eax
rol edx, 0xa8
inc ecx
pop edx
dec esi
lea ebx, [eax*2 - 0x5d54aaf9]
neg dl
mov eax, ebx
call fcn.00c698d5
xadd cx, dx
bswap eax
adc dl, 0x2f
rol ecx, cl
sets cl
ror eax, 1
inc edx
sar ecx, 0x50
xor ebx, eax
add edi, eax
lea eax, [edx - 0x314915f6]
inc dx
jno 0xec612d
Function at 0xc5f0c1
Capabilities:
Encode data using base64

Disassembly:
pop eax
mov edx, 0x982c3380
mov al, byte [ebp + 2]
add ebp, 2
sub dl, dh
and cl, al
movzx eax, dx
neg eax
cbw
not cl
imul eax
mov word [ebp + edx], cx
sbb ax, ax
mov ecx, 0x60b6550e
adc eax, dword [esi + edx*8]
shr edx, cl
lea esi, [esi + edx + 4]
dec cl
ror dx, cl
xor eax, ebx
shr cl, 0x62
rol eax, cl
xadd cl, ch
push edx
not eax
jne 0xca0c7f
imul dword [esp + 5]
mov eax, dword [esi + eax*2 - 0x8000000]
lea ecx, [edx + edx*4 - 0x39dad37a]
mov ecx, dword [esi + 4]
dec byte [esp + 7]
mov dword [esp + 8], ebx
ror word [esp + 3], 0xa
cpuid
sbb esi, 7
push 0x7d155691
not word [esp + 1]
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
shl byte [esp + 6], 0x67
setns byte [esp + 2]
mov eax, 0xb1110626
mov dword [esi + 4], ecx
movzx ebx, ax
mov dword [ebx + esi - 0x626], edx
mov ebx, dword [esp + ebx - 0x61a]
cwde
movzx edx, al
call fcn.00d02aef
sbb esi, 3
shl edx, 0x64
bts dx, 0x2c
mul al
mov dword [esi], ecx
mov ecx, 0x7b1b3917
call fcn.00cf52fe
not dl
xor eax, ebx
bt edx, 0x85
lea eax, [eax + ecx*4 - 0x1699b3dc]
shl dl, cl
add edx, 0x521ff025
adc dl, 0xb1
neg eax
push ecx
inc dword [esp + ecx - 0x4508c321]
inc eax
lea edx, [ecx*4 + 0x1b84aa09]
ror eax, cl
dec eax
call fcn.00dc0deb
mul ax
lea ecx, [eax + ecx - 0x23005cd1]
adc al, 0x3e
dec dword [esp + eax - 0x66232618]
and al, byte [esp + eax - 0x66232617]
neg ecx
inc ecx
add eax, dword [esp + eax - 0x66232618]
jno 0xdd6f68
adc edi, eax
mov dword [esp + edx - 0x4000001], edi
ret
xor eax, 0x252ff2bd
btc cx, dx
lea eax, [eax + ecx*2 - 0xdc21da3]
inc cx
xadd dword [esp + edx], ecx
xadd dword [esp + edx*8], ecx
neg eax
bts edx, ecx
or ecx, 0x535830e
ror eax, 1
inc dx
rol dword [esp + edx*2 - 0x8000002], cl
shr ecx, 0xc1
xor ebx, eax
sub dword [esp + edx - 0x4000001], ecx
jp 0xc7e854
mov ecx, 0xf5234408
movzx eax, cx
movzx ecx, word [edi + eax*8 - 0x22040]
dec ax
btr ax, 0x13
rol al, 0xc5
lea edi, [edi + eax*8 - 0x226fe]
push eax
or eax, dword [esp + eax*8 - 0x22700]
xor cx, bx
xor byte [esp + eax*4 - 0x1137e], 0x3d
xor ebx, ecx
add esi, ecx
mov dword [esp + eax*2 - 0x335b8868], 0x3e079a15
shr al, 0x23
mov ax, word [edi + eax - 0x19adc406]
dec edx
adc edi, 1
movzx ecx, dx
xadd byte [esp + ecx - 0x70bc], cl
sub dl, dh
lea ebp, [ebp + ecx*8 - 0x381f1]
bt ecx, edx
setae dl
jb fcn.00961826
movzx edx, byte [ebp + ecx*2 - 0xe07c]
dec ecx
call fcn.00d29581
Function at 0xc8025f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sal dx, 3
and edx, eax
neg cx
cdq
shr al, 0xc5
shl eax, 0x16
not cx
js 0xf2a00c
ror byte [esp + edx], 0xe3
xor bx, cx
or dx, ax
lea ebp, [ebp + edx*2 - 2]
cdq
adc edx, eax
mov word [eax + ebp], cx
ror word [esp + eax*4 + 1], 0x85
shr dl, 0xc2
imul dword [esp + eax]
mov ecx, dword [esi + eax*2]
xor edx, 0x721899a
lea esi, [esi + eax + 4]
lea edx, [edx + 0x6da9bea2]
sbb byte [esp + eax*4], dh
xor ecx, ebx
add dl, ah
bswap ecx
shl ax, 0xc3
lea ecx, [edx + ecx + 0x1874277a]
sal edx, 0x66
and edx, 0x1cbb2012
bts eax, 0x8e
neg ecx
sar al, 0x82
inc dword [esp + eax - 0x4000]
dec ecx
xchg ah, dl
pop edx
xor ebx, ecx
push eax
add edi, ecx
jmp 0xd81587
xor cx, bx
bts eax, eax
xor cx, 0xcf32
movzx edx, ax
add dx, 0x6426
mov dword [esp + eax - 0x4a4f00a3], edx
neg cx
xor eax, eax
adc al, ah
btr edx, 9
dec cx
jmp 0x9ad7ee
shl eax, 0xb3
pop eax
je fcn.00ec195b

Function at 0xc83464
Capabilities:
Encode data using xor

Disassembly:
xor dx, 0x1e3f
mov word [ebp + edx - 0x3084a6bb], ax
push edx
mov ecx, 0x2c91f838
sal edx, 0x8f
lea ebp, [ecx + ebp - 0x2c91f83c]
mov edx, dword [edx + esi - 0x535b7fff]
movzx eax, cl
lea esi, [esi + ecx - 0x2c91f833]
not eax
shr cx, 0xe9
mov dword [esp + ecx*2 - 0x592200f4], eax
xor edx, ebx
lea edx, [edx + ecx - 0x573c123b]
inc byte [esp + ecx*2 - 0x592200f8]
bts cx, ax
xor edx, 0xc510100c
cwde
shl eax, 0x22
xchg dword [esp + ecx - 0x2c9100fc], eax
inc edx
xor eax, dword [esp + ecx - 0x2c9100f4]
or ax, 0x13a2
xchg dword [esp + ecx*2 - 0x592201f3], ecx
xor edx, 0x5825ff2b
jmp 0xf09a58
inc edx
or eax, ecx
sar cl, 0x21
rol edx, 2
shl eax, 0xed
btc eax, ecx
not edx
not cx
shl byte [esi - 9], cl
shl dword [esi + 0x21], 1
mov word [edx + ecx], es
and byte [eax], al
xor byte [ebx], 0xda
not ecx
and word [esp + eax - 0x7fffdff6], cx
xor ebx, edx
add edi, edx
pop eax
sar dword [esp + 4], 0x57
call fcn.0095253b
sub dl, byte [esi + 0x73]
adc byte [edx - 0x382175d0], dh
pushal
add al, 0x86
mov bl, byte [esi - 0x79fbbf29]
mov bh, byte [ebx + edi + 0x38408a99]
cdq
or dword [eax], edx
js 0xf09a68
mul dword [ebp - 0x221eee14]
test eax, 0x7364fb1d
mov cl, 0xb5
mov dword [0x136f153b], eax
int 0xd5
stc
outsd dx, dword [esi]
adc eax, 0xb1d136f
jmp 0xf09a6a
Function at 0xc91e45
Capabilities:
Encode data using base64

Disassembly:
sbb ecx, 0x7328229d
xor eax, ebx
lea ecx, [ecx + ecx*8 + 0x5d113d09]
mov dword [esp + ecx - 0x50ab6c8c], ecx
lea eax, [eax + ecx*2 + 0x5c327f90]
mov edx, ecx
neg eax
inc eax
ror eax, 1
ror edx, cl
dec edx
shr dword [esp + ecx - 0x50ab6c8b], 0x83
dec eax
ror eax, 1
sub eax, 0x9b303d89
shl ecx, 0x3e
shl dl, 0xc7
bt edx, 0x13
xor ebx, eax
inc dword [esp + ecx + 4]
jge 0xefa4ba
mov ecx, dword [ebp]
mov edx, dword ss:[ecx]
mov dword [ebp], edx
mov ecx, 0x441fb92d
lea edx, [ecx*4 + 0x7b21f715]
mov edx, dword [esi + ecx - 0x441fb92d]
movzx eax, cx
lea esi, [ecx + esi - 0x441fb929]
bts eax, ecx
inc cl
xor edx, ebx
neg edx
sar eax, cl
jbe 0xe8e090
mov edx, dword [ebp]
mov ecx, 0x49385a27
mov ecx, dword [ebp + ecx - 0x49385a23]
add edx, ecx
mov eax, 0x7128a79e
lea ecx, [eax*4 - 0x96890f5]
mov dword [ebp + eax - 0x7128a79a], edx
movzx eax, word [esi + eax - 0x7128a79e]
jmp 0xd8c4bf
xor ax, bx
rol ax, 1
movsx edx, cl
rol dl, 0xa4
sub cl, ch
dec ax
xadd ecx, edx
xor ax, 0xcb97
sub ax, 0x8a1e
rol ax, 1
bswap edx
neg ax
rol cx, 4
bt dx, cx
xor bx, ax
and edx, 0x24ad270c
bswap edx
dec edx
mov word [ebp + edx*8 - 0x41106916], ax
push edx
inc dx
mov edx, dword [esi + edx*2 - 0x10441a46]
mov eax, dword [esp]
sar word [esp + eax*8 - 0x41106916], 0xab
xor edx, ebx
call fcn.00cac16c
mov eax, 0xf9a8bc31
and al, ah
mov eax, esi
mov dword [esi - 4], eax
mov eax, 0xd9b66188
mov eax, dword [edi]
mov edx, 0x9e94dfbc
lea edx, [edx - 0xc62dff5]
xor eax, ebx
bswap eax
xor eax, 0xca9cd006
call fcn.00e6a716
mov edx, dword [edi]
mov eax, 0x9a353bb9
add edi, 4
bts eax, eax
xor edx, ebx
sal eax, 4
not ax
neg edx
movsx ecx, al
inc cl
dec edx
call fcn.00d92c42
lea ecx, [eax + eax + 0x57abc300]
lea edx, [ecx + edx + 0x18fb80a9]
or cl, al
add ax, 0x6f27
xor edx, 0xb291dc10
inc edx
inc ecx
shl al, cl
call fcn.00e10454
sar dl, 0x8c
in al, dx
fcom qword [ecx - 0x2dbebd4e]
loopne 0xe8e097
mov eax, dword [0xc0fff823]
cli
mov esp, gs
in al, dx
xchg edx, eax
popal
ja 0xe8e0a7
aam 0x13
int1
ja 0xe8e0ad
inc sp
retf
add ebp, eax
lea eax, [ecx + ecx*4 + 0x5a27b33c]
sar cl, 0xe2
lea ecx, [esi + ecx*4 - 4]
setae al
mov dword [eax + esi - 0x5a27b309], ecx
jae 0xdb9b29
mov eax, dword [edi + ecx*2 - 0xec9ffff]
jae 0xd83292
Function at 0xca0b02
Capabilities:
Authenticate hmac

Disassembly:
xor dword [esp + eax - 0x5636], eax
adc word [esp + eax - 0x5635], ax
movzx eax, byte [edi + eax*4 - 0x777bff24]
call fcn.00e9919b
movzx eax, dl
add ecx, dword [ebp + ecx]
dec eax
neg edx
xor ecx, ebx
ror ecx, 1
shl edx, 0x5c
inc eax
xor ecx, 0xc08a0da6
call fcn.00e1ca98
not eax
sal edx, cl
jns 0xc7a66d
bts cx, cx
sbb eax, 0xd7a10c3c
bswap eax
add ecx, edx
btc dx, 0xab
inc eax
xchg edx, ecx
inc ecx
imul ecx, ecx
xor ebx, eax
ror ecx, cl
shr ecx, 0xe8
sub edx, edx
adc ebp, eax
btr ecx, 0x9a
rdtsc
adc ecx, ecx
ja 0xdb3974
call fcn.00e99871
jl fcn.00dc8f21
lea esi, [esi + ecx - 0x196a016]
neg cx
lea ecx, [ecx*4 + 0x220f1510]
sar ecx, cl
mov dword [esi + ecx*2 - 0x4c], eax
mov dword [ecx + esi - 0x28], edx
lea eax, [ecx + ecx - 0x3ec75dc9]
ja fcn.00c575b7
mov eax, 0x189fe580
mov dx, word [esi + eax - 0x189fe580]
mov ax, word [esi + eax*4 - 0x627f95fe]
mov ecx, 0x2536a92b
btc ecx, 0x84
imul ecx, ecx
mov cl, byte [esi + 4]
jb 0xd28a35
inc ecx
mov eax, 0x9080de93
inc ebp
movzx eax, byte [esp - 1]
inc ebp
xor al, dl
inc ecx
sub al, 0xbc
inc ecx
mov ebp, 0x17bbcb83
mov edx, 0x9b166789
inc ecx
neg al
inc esp
mov edi, edx
mov edi, edx
inc ecx
ror al, 1
inc ecx
xor al, 0x27
inc ecx
movsx eax, di
inc ecx
mov ecx, ebp
cdq
inc ecx
ror al, 1
dec ebx
lea ebx, [ebp + ebp + 0x6d200483]
xor cx, 0xc2bc
inc ebp
xor dl, al
inc edi
movzx edi, byte [esp + ebp*2 - 0x2f779708]
inc ebp
movzx esi, ch
dec eax
cwde
inc ebp
xor bh, dl
inc ecx
div al
idiv edi
inc ecx
rol bh, 1
inc ecx
sar ch, 0x41
inc ecx
not bh
jno 0xe728ed
inc ecx
xor dh, 0x16
inc cx
sar ebp, 0x24
inc ecx
inc bh
dec eax
cwde
inc ecx
xor dl, ch
dec eax
add ecx, 0xf5280b10
inc ecx
rol bh, 1
inc cx
add ebx, esi
dec ebp
lea ebx, [esi + ecx*4 - 0x5f643cea]
inc ebp
xor dl, bh
jmp 0x9cf1f1

Function at 0xca1089
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
dec ebp
arpl ax, ax
dec eax
bt ebp, 0x2b
inc ecx
push edi
inc ecx
pop esi
dec ecx
sub esp, 4
mov edx, 0x3f8d618a
inc ebp
mov eax, dword [esp + edx*2 - 0x7f1ac314]
or dx, dx
inc ebp
xor eax, edx
dec esp
lea ebp, [edx + edx*4 + 0x77b6793f]
movsx eax, dl
inc ecx
neg eax
shl al, 0xc7
inc ecx
bswap eax
inc ecx
inc eax
btr edx, edx
inc ecx
xor eax, 0xf1a95d1e
dec ecx
lea ebp, [ebp + edx*2 + 0xe14ccb2]
dec eax
lea edi, [edx + 0x3b967c04]
inc ecx
push edx
dec ecx
idiv ebp
inc eax
mul bh
jo 0xdb0335
inc esp
xor dword [esp + edx - 0x2b243af7], eax
inc esp
movzx edi, ax
bts edx, edi
inc esp
movzx edx, ch
inc ecx
pop edx
dec ecx
dec edi
jge 0x94b30e
mov eax, 0x6122e3a3
movzx dx, byte [edi + eax - 0x6122e3a3]
mov al, byte [eax + edi - 0x6122e3a1]
mov ecx, 0xcd806ea9
add dl, al
not ecx
mov eax, ecx
and ax, 0xeb9f
mov word [ecx + edi - 0x327f9154], dx
ja 0xed57c9
mov eax, dword [esi]
jmp fcn.00ddea44
Function at 0xcad31b
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
mov dword [esp + edx - 0xd706], edx
not ecx
sub ecx, 0xd7a10c3c
bswap ecx
inc ecx
xor ebx, ecx
pop edx
movsx eax, dx
add ebp, ecx
add eax, eax
mov ecx, edx
call fcn.00ebaace
mov eax, 0x653b5612
mov edx, dword [eax + ebp - 0x653b5612]
mov ecx, eax
mov eax, dword [eax + ebp - 0x653b560e]
push ecx
lea ebp, [ebp + ecx - 0x653b560e]
imul ecx, dword [esp + ecx - 0x653b5612]
add edx, eax
xor cx, cx
mov dword [ebp], edx
jge 0xefa3ed
jae 0xf34822
mov eax, 0x4081462f
movzx edx, al
shr eax, 0x52
mov edx, dword [ebp + eax*2 - 0x2040]
sbb al, al
setge al
jge 0xda0850
mov edx, 0x136613b
call fcn.00cc38f9
xchg ebp, eax
fnstenv [edi + edx*8 + 0x18a09ec]
adc al, 0xb7
pop edx
popal
add eax, ebp
fist word [esp + ebx*8 - 0x4b266a01]
xlatb
in al, dx
or dword [edx + 0x5ab71401], ecx
mov edi, 0x8ffc718a
pop edx
mov edi, 0xa065738a
mov dh, byte [edi + 0x43f746db]
js 0xefa490
leave
mov edx, 0x1e12bdec
je 0xefa412
lds edi, [ebx + 0x73]
xchg byte [ecx + 0x702bb42c], bl
adc ebx, dword [edx]
push cs
adc al, byte [ebx + ebp + 0x35f61370]
hlt
dec ebp
mov ch, 0xa0
mov bh, 0xba
scasb al, byte es:[edi]
mov al, 0x8f
mov edx, 0xdaf7d213
xor cl, bl
not edx
or dl, 0x83
setno dl
sbb cl, 0xe
lea edx, [edx + edx - 0x415b67d7]
and dx, dx
call fcn.00d8fead

Function at 0xcb2128
Capabilities:
Encode data using base64

Disassembly:
mov ecx, edi
mov edx, 0
sar cx, 0xcb
movsx eax, cl
adc eax, 0x7f200491
sbb ebx, edx
mov edx, 0x959e7992
movzx eax, dx
xadd eax, edx
lea edi, [0x9835d8]
ror dx, 0xe5
mov edx, dword [edx + esi - 0x93cc]
lea ecx, [eax + eax*4 + 0x42344826]
lea ecx, [eax + ecx*8 - 0x79412af0]
adc esi, 3
bswap ecx
or eax, eax
xor edx, ebx
inc ax
sal eax, 0x3e
inc edx
sar ax, 0xed
rol edx, 1
rol cx, cl
cwde
jae 0xe0c355
not edx
bts ecx, 0x2b
sar eax, 0x96
rol edx, cl
rol eax, 0x47
cwde
lea edx, [eax + edx - 0x41b68ea7]
cwde
sal eax, 0x35
push ecx
rol edx, 1
sub word [esp + eax*2 + 2], ax
xor ebx, edx
add edi, edx
xchg dword [esp + eax], ecx
mov edx, 0x151ce0aa
mov dword [esp + eax*2], edi
ret
xor dl, bl
lea eax, [ebp + ebp*2 + 0xf0c8f27]
ror dl, 1
movzx esi, byte [esp + eax - 0x49b2a1f4]
not dl
xor si, si
or eax, ebp
rol cl, 0xe5
neg dl
mov dword [esp + ecx - 0x61a1073d], eax
inc dl
pop ebp
xor bl, dl
pop ebp
shl ecx, cl
sub bp, 0x55b4
adc edx, esp
jmp 0xea3724
add esi, edx
push ebp
movsx eax, cx
not ebp
mov ebp, edi
inc word [esp + eax*4 - 3]
pop eax
jno 0xec3c91
mov dword [esp], 0x802a310e
and dword [esp], 0x1c340eb6
adc edi, 4
shl word [esp + 8], 0xd
rol dword [esp + 0xc], 0x6e
xor edx, edx
dec word [esp + 0xb]
test ecx, ecx
call fcn.009a8197
jmp 0xe74bbe
lea esp, [esp + 4]
je 0xdb6b34
xor ax, ax
lea eax, [eax + ecx*2 - 0x7debcc5a]
mov eax, dword [esi + edx]
mov edx, eax
bswap ebp
btc ecx, esi
jae 0xde0bdd
mov ebx, esi
mov edi, 0x8e077b34
jmp 0x9835c3
Function at 0xcbf214
Capabilities:
Encode data using xor

Disassembly:
xor ecx, 0x10eb017
rol al, 0xe4
mov dword [esp], edx
inc ecx
call fcn.00f288c3
mov eax, dword [ebp - 4]
cld
mov edx, 0xbd2c80a1
push edx
movsx ecx, dx
add ebp, 0xfffffffc
shr dword [esp], 0xff
pop ecx
xor eax, ebx
and cx, dx
ror eax, cl
and ecx, 0xb63b6d0c
ror ecx, 0xaf
sar cl, 0x83
inc eax
btr dx, cx
rol cx, 8
shl edx, 0xe1
rol eax, 1
not eax
xor edx, ecx
xor eax, 0xae1c9d18
not ecx
xor ebx, eax
add edi, eax
and dx, cx
xchg ecx, edx
movzx ax, byte [ecx + esi - 0x7a590140]
mov cl, byte [esi + ecx - 0x7a59013e]
or al, cl
push edx
xor al, dl
xor dword [esp], edx
mov word [esi + 2], ax
mov dx, pe_nt_image_headers32
call fcn.00daf17b
mov cl, 0x68
or eax, ebp
jecxz 0xcbf22a
invalid

Function at 0xccf7d9
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
lea eax, [eax + eax*8 - 0x306542dc]
pop edx
cwde
inc ecx
movzx edx, al
lea eax, [edx + edx*4 + 0x7895e182]
not ecx
ror ecx, 1
jmp 0xe3f824
bt eax, 0xba
xor edx, edx
neg ecx
xor ebx, ecx
dec ax
btr eax, edx
add edi, ecx
not eax
bswap edx
lea ebp, [edx + ebp - 1]
imul al
movzx eax, byte [ebp + edx]
ror dl, 0xe1
movsx ecx, dx
xor al, bl
push ecx
lea ecx, [edx + edx + 0x7a117102]
ror al, 1
xor cl, 0xa7
xor dx, cx
neg al
ror dx, cl
and byte [esp + edx - 0x2b8a], cl
ror al, 1
xchg ecx, edx
not al
and edx, ecx
xor bl, al
not cx
push edx
or dx, dx
lea eax, [esp + eax + 8]
mov edx, dword [edx + eax - 0x2185]
shl dword [esp + ecx - 0xd471], 0xeb
lea esi, [ecx + esi - 0xd476]
shl word [esp + ecx - 0xd46d], 0x26
mov dword [esi + ecx - 0xd472], edx
movsx eax, cx
movzx edx, cl
pop eax
pop ecx
je fcn.00e0d043

Function at 0xcd59d8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov ecx, dword [esp + 4]
xor cx, cx
and dl, al
shl ecx, 0x7e
lea eax, [ecx + ecx*4 + 0x7f9ee483]
not dl
mov word [esi + ecx], dx
mov eax, dword [edi + ecx + 1]
mov dword [esp + ecx*8], ecx
lea edi, [edi + ecx*2 + 5]
ror ecx, 0x45
or word [esp + ecx*2 + 6], 0xd2a
xor eax, ebx
movzx edx, byte [esp + ecx*4 + 4]
xor eax, 0xf41b4088
bts ecx, ecx
adc cx, 0x8c04
dec eax
rol eax, 3
sub byte [esp + ecx - 0x8c00], ch
not eax
xor dx, 0xad05
xor ebx, eax
sar cl, 0x21
add ebp, eax
shl dword [esp + ecx - 0x8c02], 0x5b
mov eax, edx
cdq
mov eax, esi
mov dword [ecx + esi - 0x8c06], eax
lea esi, [esi + ecx*2 - 0x11808]
xchg dword [esp + ecx*2 - 0x11800], ecx
dec dx
lea eax, [ecx + edx*4 - 0x5ffe9e7b]
pop ecx
pop eax
jne fcn.00ec5123
add byte [ebx], dl
dec byte [edi - 0x77317a88]
invalid

Function at 0xcdea57
Capabilities:
Encode data using xor

Disassembly:
cbw
mul al
bswap ecx
neg dl
push edx
rol ecx, 3
inc ax
not ecx
neg ax
dec ecx
sar al, 0x83
xor ebx, ecx
sar edx, 0x91
mov dword [esp + eax - 0x1215f10a], eax
js 0xdb464b
not byte [esp + 1]
adc esi, 5
sar dl, 0xa4
mov word [eax], cx
mov eax, edx
pop ecx
pop edx
jmp ebp
adc ebp, ecx
shl ax, 0x8d
mov eax, dword [esi + eax - 0x1215c000]
mov cx, word [esi + 4]
jb 0xd002a0
Function at 0xd0141b
Capabilities:
Encode data using base64

Disassembly:
ror ecx, cl
mov dword [esp], 0xf00c8a35
xor bl, al
sub edi, 2
mov word [edi], ax
lea eax, [edx + edx*2 + 0x7c055e04]
mov dword [esp + eax - 0x38e1efc0], ecx
mov edx, dword [esi + eax*2 - 0x71c3df88]
sal cl, 0xa1
lea esi, [esi + eax*2 - 0x71c3df84]
btr ecx, 0x8b
xor edx, ebx
not dword [esp + eax - 0x38e1efc0]
dec edx
xchg byte [esp + eax - 0x38e1efc2], al
ror edx, 1
neg ecx
dec eax

Function at 0xd08d2b
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
dec edx
mov dword [esp + ebx*2 - 0x61247a38], ebp
inc ebx
mov ebp, dword [esp + ebx*2 - 0x61247a44]
call fcn.00dfaccc

Function at 0xd0c4b7
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
jmp 0xcd3ffe
lea esp, [esp + 8]
jne 0xc4663b
jmp 0x9252ec

Function at 0xd2d278
Capabilities:
Encode data using xor

Disassembly:
inc esi
movzx ebx, word [eax - 0x3f8fb016]
push edi
dec eax
cwde
inc bp
xor ebx, edx
mov ebx, dword [esp + eax - 0x3f8fb00f]
sub cl, bh
dec eax
xchg ecx, ebx
inc cx
neg ebx
bt di, 0x92
dec ecx
sal eax, 0x76
inc cx
ror ebx, 1
dec edx
mov dword [esp + edi + 8], ebp
inc cx
neg ebx
inc cx
sub ebx, 0xf4436b2
mov dh, 0xe9
dec eax
cwde
inc cx
neg ebx
inc cx
not ebx
inc ecx
add bh, 0x39
sub dword [esp + eax - 0x3f8fb011], ebx
inc bp
xor edx, ebx
inc dx
add dword [esp + edi*8 - 0x1c1], ebp
dec eax
neg dword [esp + eax - 0x3f8fb00b]
dec ecx
dec edi
inc sp
mov dword [eax + esi - 0x3f8fb013], ebx
adc cl, byte [esp + eax*2 - 0x7f1f601b]
dec eax
mul dword [esp + eax - 0x3f8fb00f]
inc dx
sbb dword [esp + edi - 0x2c], edi
inc ebx
or edi, dword [esp + edi*8 - 0x1c7]
inc ecx
neg eax
dec edi
lea esp, [esp + eax - 7]
inc ecx
push ebp
inc ecx
setns ch
inc ecx
xor edi, edx
inc edx
not byte [esp + eax*4 + 0x12]
xor edi, 0x7327b4ae
call fcn.00e6ac41
call fcn.00c5119d
adc byte [0x8af1fcbc], dl
or dword [eax], ebx
mov ebx, 0x258a9844
pop esp
test dword [eax + ebx*4 - 0x76], 0x44f37839
cwde
mov bl, ch
movsd dword es:[edi], dword [esi]
add dword [ecx + 0xc], 0xffffffe8
test eax, 0x8b162992
mov byte [edx], dl
or byte [eax + 0x6a], bh
ja 0xd2d321
adc ebx, dword [esi - 0x75bdc590]
push esi
jecxz 0xd2d3be
rcr dl, 1
cdq
push 0x75
iretd
dec ebp
adc ebp, dword [edx - 0x2a]
into
pop esp
dec ebp
adc edx, dword [esi]
inc edx
leave
lodsb al, byte [esi]
inc edi
mov byte [eax - 0x5cf04b14], al
shl byte [esi - 0x75], 0x8c
cmp byte [eax + 0x40], cl
jbe 0xd2d3a8
Function at 0xd7dbf8
Capabilities:
Encode data using xor

Disassembly:
movsx edx, ax
mov dword [esp + eax*2 - 0x40], eax
xor ecx, ebx
mov dword [esp + edx*8 - 0x100], 0xfa2b8aa4
bswap ecx
ror eax, 0x1b
sub ax, 0xcab0
jb 0xe48f99
mov eax, dword [esi]
mov ecx, 0xa5114038
movzx edx, cx
xchg dl, cl
lea esi, [esi + edx*4 - 0x100dc]
xor eax, ebx
inc dl
setge dl
push ecx
lea eax, [edx + eax - 0x60a6652e]
neg eax
sal dword [esp + edx*4 - 0x10004], 0xdc
xadd byte [esp + edx - 0x3ffe], dh
ror eax, 1
add dword [esp + edx*4 - 0x20004], ecx
sbb ecx, edx
neg eax
shl byte [esp + edx - 0x7fff], 0x24
btr cx, 0xb4
shl dl, cl
dec eax
btc edx, ecx
xor ebx, eax
add edi, eax
movsx eax, word [esp + edx - 0x8000]
cdq
add edx, ebp
push ecx
lea ebp, [eax + ebp - 0x403c]
call fcn.009b1ac2
mov edx, 0xefa8e593
lea eax, [edx + edx*8 - 0x7fcdba62]
lea ecx, [edx*8 + 0x7434ca1a]
sbb cl, dl
xor al, 0x74
mov ecx, dword [esi]
btr edx, eax
push eax
adc esi, 4
xor ecx, ebx
btr edx, edx
shr word [esp + 1], 0x4e
xadd byte [esp + 2], dl
dec ecx
lea eax, [eax + edx - 0x5140aee3]
or eax, dword [esp]
shr word [esp], 0xe7
ror ecx, 3
sub dword [esp], 0x825f1ba
xor dx, 0x702a
inc ecx
neg ecx
xchg edx, eax
neg eax
btr eax, 0x1d
xor ebx, ecx
call fcn.00dfd7ed
ror edx, 2
mov ecx, 0xf222bdb1
add edx, 0x4322ca08
movsx eax, cx
pop ecx
neg edx
call fcn.00e99c76
stc
shld esi, ebx, cl
push esi
mov ebx, 0xadb11e72
jb 0xd7dc9a
jb 0xd7dd33
mov cl, 0xfd
cmp al, 0xdb
jb 0xd7dd39
mov cl, 0xa9
push 0x15
xchg edi, eax
and al, 0xb1
pop ebx
std
outsb dx, byte [esi]
lds edi, [esi]
mov cl, 0x60
mov ecx, 0x3da0d3fa
xchg ebx, eax
pop ecx
xor ecx, esi
pop ebx
push 0xafb1491b
invalid
mov esi, 0xb5eb8395
jmp 0xdf38fe2
Function at 0xd93dee
Capabilities:
Encode data using base64

Disassembly:
xor al, bl
ror edx, 0xd6
lea ecx, [edx + edx + 0x503e081f]
rol al, 1
ror edx, cl
adc al, 7
btr dx, 0x8a
neg al
sar dx, 0x2f
xor al, 0x27
jmp 0x9bb548
xor bl, al
movzx ax, al
btc dx, dx
not ecx
bts ecx, 0x87
mov cl, byte [edi]
jae 0xed8b91
inc eax
push 0xb5a3520c
rol eax, 2
xor ebx, eax
shl word [esp + 0xb], 0xef
inc dword [esp + 0xc]
add edi, eax
push 0xadb704a9
lea esp, [esp + 0x18]
jmp 0xcc6a51
push edx
pushfd
mov edx, 0xfd2108a7
mov edx, dword [esp + edx*2 + 0x5bdeeb6]
mov dword [esp + 4], 0x80fb3d83
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00e103e8
mov eax, 0xee88e9b5
lea edx, [eax + eax*4 - 0x197c9575]
movzx eax, byte [ebp - 1]
btc edx, edx
jae 0x942d5c
mov eax, 0x40800aa2
mov edx, eax
push eax
movzx ecx, byte [ebp + eax - 0x40800aa2]
xor cl, bl
sub word [esp + edx - 0x40800aa2], 0x428c
xor cl, 0x3c
or dword [esp + edx - 0x40800aa2], eax
neg ax
jb 0xe01c04
lea eax, [edx - 0x5eccfc76]
jae 0xf27ff0
movzx ax, byte [ecx + eax - 0x639453e8]
mov word [esi - 4], ax
dec dword [esp]
sete byte [esp]
movzx ecx, dl
mov edx, dword [edi + ecx*2 - 0x59]
lea edi, [edi + ecx*4 - 0xaf]
mov eax, dword [esp + ecx - 0x2d]
shl byte [esp + ecx*2 - 0x59], 0x27
bts eax, ecx
xor edx, ebx
shr eax, 0xe5
sal cx, 0x4c
lea edx, [edx + ecx + 0x7c9eac28]
seta al
mov word [esp + ecx - 0xcfff], 0xc430
adc byte [esp + ecx*4 - 0x34000], 0x38
neg edx
dec word [esp + ecx - 0xd000]
xor edx, 0x9ab1dfbd
call fcn.00e34b2c
aas
dec esp
clc
pop ebx
push ecx
add byte [edi + 0x965935e], bh
imul esi, dword [eax], 0xffffffbf
pop esi
xchg ebx, eax
push ebx
test al, 0x3d
stc
rcr byte [ebx + 0x53], cl
inc ebp
sbb dword [edx + 0x52dbe1e3], esp
push edx
mov bh, 0x86
inc ebx
fidivr dword [eax - 0x73796269]
sal byte [edx - 0x46], 1
and ebx, edi
invalid
jb 0xcbe25b
mov eax, 0x44815c0d
mov dx, word [edi + eax - 0x44815c0d]
lea eax, [eax + 0x66893204]
mov ecx, eax
add al, 0x1c
adc edi, 2
lea ecx, [eax - 0x35df04e0]
lea esi, [esi + ecx - 0x752b894e]
bts ecx, ecx
xchg ecx, eax
movzx ecx, byte [esi + eax - 0x752ba94d]
sal ax, 0xe7
neg ax
inc eax
xor cl, bl
add ax, ax
xor al, ah
neg al
neg cl
bswap eax
call fcn.00c924df
neg cl
sub byte [esp + eax - 0x4080f55c], al
and dword [esp + eax - 0x4080f55e], 0x8c225f10
cdq
ror cl, 1
not cl
shr al, 7
sbb byte [esp + edx*8 + 2], 0x2d
xor bl, cl
cwde
pop edx
and edx, edx
adc ecx, esp
sub eax, eax
sar edx, 0x8a
or edx, 0x658ca036
xor al, byte [eax + ecx]
call fcn.00eea749
not al
add edx, 0xbab58392
adc dx, dx
not cl
sal dl, 2
sub edx, edx
and al, cl
rol dx, 0x6c
mov ecx, edx
mov word [edi + edx], ax
jae 0xd85b4b
mov edx, 0x592be3bc
call fcn.00ee3c9c

Function at 0xd9e0e9
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions

Disassembly:
inc cx
adc ebx, 0x8d4aa096
mov ah, 0x6e
and byte [eax - 3], al
add dword [edx - 0x2d], 0xffffffb4
insb byte es:[edi], dx
xor al, 0x40
std
sbb dword [ebx + 0x5a], 0xf
sub dword [esi - 0x41], 0xfffffff7
call [ecx + 0x35]
mov bh, 0xb8
xor ah, byte [esi + 0xd34f281]
mov byte [0xd19140aa], al
ret 0xc833