joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104039ba
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pop ecx
pop eax
pop edx
pop ecx
jmp edi
mov ebp, dword [ebp - 4]
xchg ch, dl
mov dword [esp], edx
mov ebx, dword [esp]
mov dword [ebp], eax
movzx eax, word [esp]
neg byte [esp + eax - 0x35ec]
sar dword [esp + eax - 0x35ec], 0x1d
mov ebx, dword [esp + eax - 0x35e8]
movzx edi, ax
rol eax, 0xbf
push ecx
mov edi, dword [esp + eax - 0x1aea]
mov dword [esp + eax*4 - 0x6bd0], eax
mov dword [esp + eax - 0x1aea], ecx
mov esi, dword [esp + eax - 0x1ae6]
not word [esp + eax*2 - 0x35eb]
sal dx, 0xa2
shl eax, 0xc1
mov eax, dword [esi + eax*4 - 0xd7b0]
and ecx, 0x692abd0f
lea esi, [esi + ecx - 0x49221506]
imul edx, ecx
adc cl, cl
xor eax, ebx
not eax
shr cl, 0x61
xor eax, 0x4125b2bb
shl word [esp + edx - 0x265ddcd6], 0xed
sub edx, 0x81b6b6a2
not ecx
inc eax
dec dl
rol eax, 1
lea eax, [eax + ecx - 0x44af5f36]
or edx, dword [esp + 0xc]
xor ebx, eax
add edx, edx
pop edx
add edi, eax
xor dl, 0x15
jae 0x103e27ba
not dx
or cx, dx
imul eax
mov word [ebp + eax*2 - 0xc380000], cx
rol dl, 0x45
cwde
mov ecx, edx
mov edx, dword [ebp + eax + 1]
or ax, ax
bswap ecx
add cl, byte [eax + ebp + 5]
not eax
shr edx, cl
mov dword [ebp + 4], edx
sub ebp, 0xfffffffc
call fcn.104a8b4a
bswap edx
dec ecx
dec ecx
jle 0x10417591

Function at 0x10406e4e
Capabilities:
Encode data using base64

Disassembly:
push 0xed0c6d3d
dec ecx
push 0x2cbc7191
lea esp, [esp + 0x20]
jne 0x1032555a
mov eax, 0xab858392
pop esi

Function at 0x10408d80
Capabilities:
Encode data using base64

Disassembly:
push eax
mov dword [esi + edx*8 - 0x5af7776a], ecx
lea ecx, [edx*2 - 0x67d63b48]
ror eax, 0x13
lea esi, [edx + esi - 0xb5eeeef]
btc edx, 0x83
sal cl, 0x21
pop eax
pop eax
jle fcn.102d9ffd
inc ecx
mov ebx, 0x7c24749a
dec ecx
lea ebp, [ebx + ebp - 0x7c24749e]
inc ecx
mov esi, dword [ebx + ebp - 0x7c24749a]
inc ebp
movzx edx, bx
dec edi
lea esi, [ebx + edx*8 + 0x4d930ab4]
inc ecx
movsx ecx, bx
inc ecx
xor esi, ecx
jmp 0x103c987f
inc ebp
bts esi, ebx
rol esi, 2
dec esi
lea eax, [ecx + esi*4 + 0x190ad92d]
inc ecx
lea esi, [ebx + esi - 0x77e49108]
dec ecx
sub edx, 0x1b33b030
bswap esi
dec esi
xor esi, 0x80da58d
dec ecx
dec esi
inc ecx
push ecx
inc edx
xor dword [esp + ebx - 0x7c24749a], esi
inc ebp
sub esi, eax
inc ecx
pop ecx
inc ecx
movzx edi, ax
inc esp
add al, cl
inc ecx
not bl
dec eax
arpl si, si
dec eax
adc ebx, esi
inc esp
movzx ebp, cx
dec edx
lea esi, [esi*4 + 0x8033638]
inc ecx
sub esi, 0xe9890786
dec ebx
mov esi, dword [edx + edi + 0x1b333b96]
call fcn.104317bc
neg edx
mov dword [esp + ecx*2 - 0x483aa526], 0x6702210f
sal dword [esp + ecx - 0x241d5293], cl
lea edx, [eax + edx + 0x6d0a45da]
xor ebx, edx
push eax
sar dword [esp + ecx*2 - 0x483aa522], 0xc
cwde
adc esi, edx
call fcn.10316fee
rol ecx, 1
xadd dword [esp + edx*2 - 0x16bdddda], eax
xor ebx, ecx
jmp 0x1038d976
Function at 0x10408ff1
Capabilities:
Encode data using base64

Disassembly:
not cl
xor cl, 0x96
mov eax, dword [esp]
sub cl, 0
imul ax, ax
shl al, 3
xor bl, cl
cwde
rol eax, 0x13
lea ecx, [esp + ecx + 4]
mov word [ecx], dx
mov ecx, dword [ebp + 3]
div byte [esp + 2]
jmp 0x1040d3c7
rol ecx, 1
sub dword [esp + edx*2 - 0x3a45f0b], edx
sbb dword [esp + edx*8 - 0xe917c2f], edx
xor ebx, ecx
bswap edx
add esi, ecx
jmp 0x10345275
mov dword [esp + ecx - 0x179ec], 0x5f0e3996
shr dl, 0xc7
mov cx, word [ecx + eax - 0x179f0]
rol dword [esp + edx*4 - 0x25400], 0xc2
sal dl, 0xa3
xor dl, 0xa
lea esi, [esi + edx - 0x9504]
mov eax, dword [esp + edx - 0x94fe]
inc dword [esp + edx*2 - 0x12a01]
dec eax
mov word [edx + esi - 0x9502], cx
xor edx, 0x5a2d829
pop ecx
pop eax
jne fcn.10440eae
cwde
pop ecx
pop eax
jmp esi
inc ebx
mov dl, byte [eax + edi - 0x25f01ff]
call fcn.1035008e
mov eax, dword [esi]
mov ecx, 0xa12f4ab0
mov ecx, dword [esi + 4]
mov edx, 0xed9650be
sar dl, 5
mov dword ss:[eax], ecx
lea eax, [edx + edx*4 + 0x3e23d328]
neg eax
jle 0x102f5910
mov ecx, dword [edi + eax*4 - 0x77b25f9c]
cmovne eax, edx
xor ecx, ebx
btr eax, edx
dec ecx
sal ax, 0x21
sub edx, 0x5d1b4cb1
xor ecx, 0x2d0cc714
add edx, 0xdd0dd71e
dec ecx
xadd dl, dh
xor ecx, 0x8986878d
xor ebx, ecx
add ebp, ecx
lea ecx, [edx + edx*4 - 0x1fd4c9ca]
sub dl, cl
cmovge eax, edx
movzx eax, byte [edi + edx - 0x6d886ab2]
btr ecx, ecx
xor ecx, 0xa31a073a
add dx, dx
lea edi, [edx + edi - 0x6d88d567]
sub dx, cx
sar edx, 0x13
xor al, bl
shr cx, 0x64
dec dl
neg edx
inc al
ror cx, cl
ror al, 1
lea ecx, [edx + edx - 0x58e87774]
ror ecx, cl
inc al
shr edx, cl
call fcn.10322592
mov eax, dword [edi]
mov ecx, 0x70279790
movzx edx, cx
rol ecx, 0x73
lea edi, [edi + edx*8 - 0x4bc7c]
jb 0x10408cca
xadd cl, dl
xor eax, ebx
shl ecx, cl
sete cl
inc cx
lea eax, [eax + ecx - 0x56c19fbc]
bts edx, 0xb3
btr dx, dx
dec ecx
xor eax, 0x539c9b31
sal ecx, 0x56
adc cx, cx
xadd cx, dx
rol eax, 1
not eax
xor ebx, eax
rol edx, 0x91
adc ebp, eax
mov eax, edx
btc ecx, eax
mov al, byte [edi + ecx*8 - 0xc39e0]
lea edi, [edi + edx*2 - 0x1f]
ror dx, 0x68
or dx, 0x85ae
xor al, bl
not al
push ecx
inc ecx
rol al, 1
push ecx
sub al, 0x2a
sub byte [esp + ecx - 0x18738], dl
xor cl, 0xa2
not al
ror al, 1
or edx, edx
shl cx, 0xe4
neg al
xor bl, al
inc edx
lea eax, [esp + eax + 8]
jge 0x10336655
btc dx, dx
not ax
xor bx, ax
mov dword [esp + ecx - 0x371d0000], edx
btc cx, 0x1c
setae dl
mov dx, ax
movzx ecx, byte [ebp + ecx*2 - 0x6e3a1ffe]
xor cl, bl
inc cl
jmp 0x102c967f
sub ebp, 0xfffffff9
movzx edx, byte [esp]
and eax, eax
xor ecx, ebx
ror ecx, 1
or eax, 0x92a8522
sub al, dl
inc word [esp + edx - 0xd2]
lea ecx, [eax + ecx + 0x431670be]
push eax
bts ax, ax
bswap ecx
imul edx
xor edx, 0xfe2dd019
jg 0x102ffd3f

Function at 0x1040b586
Capabilities:
Manually build aes constants

Disassembly:
not edx
mov ecx, 0xb300281e
neg ecx
mov dword [ecx + ebp - 0x4cffd7e2], edx
mov eax, ecx
mov edx, ecx
cbw
jmp esi
test ecx, ecx
push 0xe204670b
lea esp, [esp + 0x18]
je 0x102f2068
call fcn.1039f273
Function at 0x1040b59c
Capabilities:
Manually build aes constants

Disassembly:
add edi, 4
xor ecx, ebx
mov dword [esp], edx
btc dx, dx
xor ecx, 0xc5a8d9b8
add dword [esp], 0xe5b4ed04
lea edx, [edx + edx*4 + 0x62fcb28]
sbb ecx, 0x11990289
rol ecx, 1
dec word [esp + edx - 0x7919a5ab]
not ecx
mov eax, dword [esp + edx - 0x7919a5ab]
push eax
cdq
xor ebx, ecx
call fcn.103eeba6

Function at 0x1040c63f
Capabilities:
Encode data using base64

Disassembly:
or cx, word [esp + ecx - 0x450c0e1c]
shl byte [esp + ecx - 0x450c8e34], 0xc4
adc ebp, eax
mov si, word [ecx + esi - 0x450c8e3a]
movzx eax, dx
imul dword [esp + ecx - 0x450c8e36]
cwde
pop eax
pop ecx
jb fcn.10440eae

Function at 0x1040e296
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, 4
div ecx
mov dword [edi], edx
mov dword [edi + 4], eax
mov eax, 0x1985ca13
mov eax, dword [ebp + eax - 0x1985ca13]
mov edx, 0x31be6f8b
lea ebp, [ebp + edx - 0x31be6f87]
xor eax, ebx
mov ecx, edx
neg ecx
js 0x103eb77a
dec ecx
sal ebp, cl
inc cx
idiv esp
dec edi
mov dword [edi - 0x1d], edx
dec eax
inc ecx
dec esp
lea esi, [eax + 0x7e18d4bd]
jl fcn.1040c813
xor edx, ebx
ror eax, 0xb7
xor byte [esp + eax - 0x499bd000], 0xb5
not word [esp + ecx - 0xd088]
not edx
rol edx, 3
dec cl
xor eax, dword [esp + eax - 0x499bd000]
sbb ax, 0x5f89
xor edx, 0x529c0726
ror byte [esp + ecx*2 - 0x1a10d], 0x66
ror edx, 2
shl eax, cl
dec edx
and ecx, eax
jno 0x10400165
dec ecx
bt edx, eax
xor ebx, ecx
lea eax, [eax + eax*2 + 0x2b2df80]
rol edx, 7
setb dl
adc ebp, ecx
shl edx, 0x9a
jns fcn.102d9ffd
jmp 0x1031d4e0
ror ecx, 2
cdq
xor eax, eax
bswap ecx
bt dx, 0x83
lea ecx, [ecx + edx*2 + 0x125b89c]
not ecx
jae 0x1036fac7
xor eax, 0x2134a21e
neg eax
inc eax
dec ecx
bswap eax
xor ebx, eax
btr edx, 0x97
add esi, eax
jmp esi
shr cx, 0x43
xor ebx, edx
shr cx, 0xec
add ebp, edx
not dword [esp + eax - 0x4082d400]
pop eax
imul ecx
jno fcn.10440eae
not byte [esp + eax - 0x582ebb9c]
xor ecx, ebx
pop eax
sub ecx, 0x8c9fd09f
neg ecx
pop edx
mov eax, edx
jmp 0x1038d0a7

Function at 0x1040e2ef
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [esi*4 + 0x104adad0]
push 0x741fc630
shr ecx, 8
jmp 0x102fe618

Function at 0x1041524c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + eax - 0x10000000], eax
bswap edx
xor ebx, ecx
mul eax
add esi, ecx
dec al
jl 0x104a0a46
Function at 0x1041da5f
Capabilities:
Manually build aes constants

Disassembly:
mov esi, 0x4c878daf
inc cx
add esp, 0xc14933a7
into
salc
inc ecx
rol eax, 3
dec esp
xadd ecx, esi
dec eax
dec edx
inc ecx
push ecx
inc esi
xor dword [esp + ebp - 0x23a9d1a2], eax
inc ecx
pop ecx
rol dl, 0xe5
inc ebp
movzx edx, ch
dec ebp
arpl ax, ax
dec eax
sbb esi, 0xcea4c908
inc ecx
or esp, 0x69149e82
dec ecx
adc ebx, eax
inc ecx
inc ah
sar ecx, 0xd0
jmp ebx
dec esp
mov dword [esp], eax
inc ebp
mov ebx, eax
inc bp
mov ebx, dword [edi + 2]
dec edx
lea ecx, [eax*4 - 0x2844bdf2]
inc esp
movsx edx, cx
inc esp
movsx ebp, byte [esp + 3]
dec ecx
add edi, 2
inc cx
and eax, ebx
not ax
inc ecx
pop esp
dec ecx
neg edx
inc ecx
rol ah, 0x21
inc cx
mov dword [edi], eax
dec esp
mov dword [esp], ebp
inc ecx
mov edx, esp
dec ecx
lea edi, [esp + ecx*8 + 0x4405b091]
dec eax
sbb ebp, 4
inc eax
rol bh, 0xc1
dec eax
xchg dword [esp], edx
push edi
inc esp
mov esi, dword [ebp]
inc esp
xor ebp, edx
dec edx
lea eax, [edx*4 + 0x653cb094]
inc ebp
xor esi, ecx
inc edx
neg byte [esp + ebp*4 + 5]
idiv ax
inc ecx
dec esi
imul edi, edx
dec ebp
xchg eax, edx
jno 0x1038de45
inc ecx
bswap esi
dec edx
imul edx, dword [esp + ebp*2 + 6]
dec edx
mov dword [esp + ebp + 8], 0x8d817eb5
inc ecx
neg esi
dec eax
imul dword [esp + edi - 0x31aa9056]
inc ecx
not esi
dec edx
sar dword [esp + ebp*2 + 8], 0x8c
inc esp
imul ebp, edi
inc dx
sbb dword [esp + ebp + 0xc], eax
inc ecx
dec esi
cwde
dec edx
dec dword [esp + ebp*2 + 8]
inc edx
sets byte [esp + ebp*2 + 7]
inc ecx
xor esi, 0x77b9d123
dec edx
sal dword [esp + ebp*2 + 1], cl
inc esi
movsx ebx, word [esp + ebp + 0xb]
dec esi
mov dword [esp + ebp + 8], ecx
inc si
xchg dword [esp + ebp + 3], ebp
inc edx
setne byte [esp + ebp*2 - 0x4d75]
inc esi
xor dword [esp + ebp - 0x26b3], esi
sal edi, 0x55
inc esp
movsx ecx, dx
dec esi
mov ecx, dword [esp + ebp - 0x26b3]
ror dx, cl
inc edx
or byte [esp + ebp*2 - 0x4d73], al
dec ebp
arpl si, si
call fcn.103c6e8e
mov ecx, 0x2b33199d
mov eax, dword [ecx + ebp - 0x2b33199d]
movzx edx, cx
mov cl, byte [ebp + ecx - 0x2b331999]
shl eax, cl
push edx
mov dword [ebp + edx*2 - 0x3338], eax
inc byte [esp + edx*2 - 0x333a]
lea ecx, [edx - 0x62e4f7ca]
lea eax, [ebp + edx*2 - 0x3338]
rol dl, 0x67
mov dword [ebp + edx*8 - 0xce72], eax
sar edx, cl
push ecx
call fcn.1036339a
Function at 0x1041e2d4
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov di, word [edx + edi - 0xff00]
xchg byte [esp + edx - 0xfefe], dl
shl ax, 0x47
pop eax
jp fcn.10315919
pop ecx
dec eax
mov dword [esp + edx], ebx
ret
push 0x290bc6a0
dec eax
lea esp, [esp + 8]
jmp ebx
dec eax
lea esp, [esp + 0x18]
ja 0x1045e73b
dec esp
mov esi, esp
mov esi, 0x293c3d
lea ecx, [esi - 0x293b4d]
movsx edi, si
dec eax
lea edi, [edi*2 + 0x61216f22]
inc eax
xor dh, bh
dec ebp
lea eax, [edi + esi*2 - 0x5279c2]
dec ecx
and eax, 0xfffffff0
dec esp
sub eax, ecx
push esi
dec ecx
mov esp, eax
not di
jmp 0x1044482a
jmp 0x103bfb58
xchg di, si
pushfd
dec eax
lea esi, [edi*2 - 0xb6f72e8]
dec ecx
mov esi, esi
push edi
dec ecx
mov edi, eax
mov word [esp + 6], 0xae14
cld
call fcn.1045e721
mov ecx, dword [esi]
mov edx, 0xe02066a0
mov eax, edx
and dl, 1
adc esi, 4
sar edx, 0xc3
bts edx, edx
rol eax, 0x6a
xor ecx, ebx
rol ecx, 1
sar eax, 0xa3
xor ecx, 0xa1bbdcb6
xadd dx, ax
not ecx
sete dl
xor ecx, 0x1f9aa6b5
sub ecx, 0x951d5490
inc eax
xor ecx, 0xc6293e8e
rol ecx, 1
sal edx, 0x49
dec ecx
neg ecx
push eax
dec ecx
xor ebx, ecx
ror byte [esp + edx*2 - 0x1173ffff], 0x25
sbb eax, edx
adc edi, ecx
bt edx, edx
bswap eax
sub dl, byte [esp + edx*8 - 0x45cfffff]
mov edx, dword [edx + ebp - 0x8ba00a0]
push eax
call fcn.1037f2d7
mov edx, 0xc0a2509f
movsx eax, dx
mov eax, dword [ebp + eax*4 - 0x1427c]
add ebp, 4
movsx ecx, dl
dec cl
push ecx
xor eax, ebx
inc eax
not byte [esp + 3]
inc byte [esp + 1]
xchg ecx, edx
neg eax
shl edx, cl
dec dx
lea eax, [eax + ecx - 0x261addf9]
sar ecx, cl
add dword [esp + edx*4 - 0x3fffc], ecx
sal ecx, 0x3d
rol eax, 2
rol ecx, 0xd7
xor ebx, eax
dec dx
shl ecx, 0x47
sete dl
adc esi, eax
sal cl, 0x87
movzx eax, cl
jp 0x103299ed
inc esp
sub al, 0xc5
cwde
aaa
mov ecx, 0xa0d5fca4
push 0x1d25f459
mov al, byte [0x7cbc5968]
in eax, 0xa0
push 0x1d74e459
mov al, byte [0x6d3c5968]
xchg ebp, eax
mov al, byte [0x94745968]
lodsd eax, dword [esi]
mov al, byte [0xb5ac5968]
int 0xa0
push 0x429cac59
pop edi
sbb eax, 0xfeaf6400
invalid
jmp 0x103ba3ea

Function at 0x1041e588
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor ebx, eax
sar cx, 0xb
push ecx
adc ebp, eax
shl ecx, 0x89
mov eax, dword [esi + ecx - 0x47fff800]
movsx edx, byte [esp + ecx - 0x47fff800]
jb 0x1032b929
xor eax, 0x1c1ae71b
pop edx
neg eax
lea ecx, [ecx*2 + 0x1c80542c]
jmp 0x10304fb4

Function at 0x1042085b
Capabilities:
Encode data using base64

Disassembly:
add eax, edx
mov dword [esp], 0xca8cf88b
jmp 0x1048ba2f
mov dword [ebp - 4], eax
jmp 0x1031f203

Function at 0x10421d2d
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + esi*2 - 0x3f140202], 0x12b6873f
inc ebp
xor cl, ch
push esi
dec ecx
and eax, 0x60aa7724
inc edx
mul dword [esp + esi - 0x1f8a0100]
dec esi
lea ebp, [esp + ebp + 0x10]
inc di
movzx edx, byte [ebp + esi*4 - 0x7e280404]
inc di
mov dword [esi + edi - 0x1f8a0107], edx
inc ecx
xchg esp, eax
dec eax
btr eax, 0x93
inc ecx
dec ebx
dec edi
lea edi, [edi + esi*4 - 0x7e28040a]
inc ecx
pop ebp
pop edx
jno fcn.1040c813
mov ecx, 0x5bb9d795
movzx edx, cl
lea edi, [ecx + edi - 0x5bb9d796]
imul edx, edx
and dx, dx
ja 0x1035bea1
Function at 0x1042eb75
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
push ebp
and edi, edi
add dword [esp + 0xc], 0xefcd5490
mov ebp, edi
mov dword [esp + 0xc], 0x7f362f47
mov edi, dword [esp + 8]
call fcn.10329aa9
xchg esi, eax
lahf
xor ebx, edx
add ebp, edx
mov dword [esp + eax - 0xfefb], ecx
jmp 0x104b10bc
push edi
mov edi, 0x1784a82a
pushfd
sub edi, 0x51b88491
jne 0x102bf0a8
pop ecx
pop ecx
jmp fcn.10440eae

Function at 0x10432666
Capabilities:
Encode data using base64

Disassembly:
rol ecx, 0x43
bswap eax
push ecx
dec eax
sub byte [esp + edx*2 + 1], dl
mov dword [esp + edx + 4], edx
xor ebx, eax

Function at 0x10434493
Capabilities:
Encode data using base64

Disassembly:
not ecx
lea eax, [eax + ecx - 0x46c20ed]
shr dword [esp], cl
rol eax, 2
push ecx
or cx, 0xd127
sbb eax, 0x120f389a
ror ecx, cl
btc ecx, ecx
setae byte [esp + ecx*2 - 0x44bffdfc]
xor ebx, eax
xadd dword [esp + ecx - 0x225ffefb], ecx
sar ecx, 0x65
adc esi, eax
xor ecx, dword [ebp + ecx*2]
mov eax, dword [esp + 1]
mov eax, dword [ebp + 4]
push 0xe36b515
push 0xa3bd5581
imul ecx
push 0x9ebdcaa0
pop ecx
mov dword [ebp + ecx + 0x61423560], edx
shr cl, 0x62
ja 0x103995b9
movzx ecx, al
mov edx, dword [eax + edi - 0x772da01a]
xor edx, ebx
rol edx, 1
xor ax, ax
sub ax, cx
sbb edx, 0xf986d227
not ecx
ror edx, 3
bts eax, eax
cwde
xchg ah, al
xor edx, 0xd89246bc
inc edx
bswap ecx
btc ax, ax
xor ebx, edx
sar ecx, 0x49
add eax, ecx
add esi, edx
and ax, 0x5f09
mov edx, eax
cwde
movzx edx, byte [edi + eax*4 - 0x1181c]
dec ecx
xor cx, cx
btr eax, ecx
lea edi, [edi + eax*4 - 0x1181b]
setae al
neg ecx
xor dl, bl
neg ax
cmovge cx, ax
ror dl, 1
cwde
sub ecx, 0x8a8e1c90
dec al
sbb dl, 0x28
shr ecx, cl
neg dl
dec cl
not dl
shr ax, 0x69
lea eax, [eax*2 + 0x15bbfc94]
ror ecx, cl
dec dl
cwde
neg dl
rol ax, 7
adc dl, 0xb3
lea ecx, [eax + ecx*8 - 0x7cc381f4]
xor bl, dl
sar ecx, 0x89
btr cx, cx
xor eax, ecx
mov word [ebp + eax*2 - 0x7c0e2a], dx
movzx ax, byte [ebp + eax - 0x3e0716]
lea edx, [ecx - 0x104c3b7a]
sub cl, dl
xor dl, cl
mov dl, byte [ebp]
sub cl, 0x9c
or ecx, ecx
sbb ecx, 0x89b0db82
not al
not cx
call fcn.1048e48a
mov dword [ebp + ecx + 0x614235dc], eax
shl dword [esp + ecx + 0x614235e4], 0x52
lea edx, [ecx + 0x2684debb]
mov dword [esp + ecx + 0x614235d8], esi
ret 0xc
jae 0x1043e640
mov eax, 0xb993bf1a
movzx ecx, ax
btc cx, ax
mov eax, dword [edi + ecx - 0xbb1a]
push ecx
not cl
sal cl, cl
lea edi, [ecx + edi - 0xbb9c]
sar dword [esp + ecx - 0xbba0], 0xab
shr cl, 0xc1
sar cx, 0xeb
xor eax, ebx
bts ecx, ecx
xor eax, 0x6b9ae03a
jmp 0x1036ff2c
adc ebp, 4
jmp 0x102ec5df

Function at 0x104354cc
Capabilities:
Encode data using base64

Disassembly:
div ecx
mov ecx, dword [esp + 4]
shr byte [esp + 4], 0xe6
mov dword [esi], edx
call fcn.103cb12b
mov dword [esp], 0x2e2eac8d
jmp 0x10380a2c
Function at 0x10437ed0
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
rol ecx, 1
shl dx, 1
xor ebx, ecx
add edi, ecx
movzx ecx, byte [esi + 4]
mov dword [esp], eax
btr eax, 0x2d
not dword [esp]
xor cl, bl
sub cl, 0x9c
mov byte [esp + 2], dh
inc dword [esp]
not cl
xor edx, 0x133c15af
sal dx, 0x6c
inc cl
shl eax, 0x43
setne al
ror cl, 1
xor bl, cl
shr al, 0x21
lea ecx, [esp + ecx + 4]
inc eax
mov eax, dword [ecx]
mov dword [ebp - 4], eax
sal dl, 0xa1
pop edx
movsx eax, dx
movzx eax, word [esi + edx - 0x61f89bfb]
movzx ecx, dl
xor dx, cx
lea esi, [esi + edx - 0x61f89bf9]
setne cl
bt cx, cx
shl ecx, 0x16
xor ax, bx
bts ecx, ecx
not ax
adc ax, cx
inc edx
xor ax, 0x3eac
add cx, 0x2725
rol ax, 1
shl cl, cl
sar dx, 0xe4
bts edx, 0xae
xor bx, ax
rol ecx, 9
mov word [ebp + edx - 0x61f8f9c6], ax
xadd cl, ch
lea ebp, [ebp + edx - 0x61f8f9c6]
jl 0x102be961
movsx eax, dx
bts cx, ax
jae fcn.104769e1

Function at 0x1043cf75
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ecx, byte [edi - 6]
imul dl
rol dword [esp], 0x61
sbb dx, 0x6691
adc edi, 0xfffffff9
ror edx, 0x99
xor cl, bl
add edx, 0x799786ab
mov word [esp], dx
xor cl, 0x97
xchg dx, ax
idiv word [esp + 1]
not cl
xchg byte [esp], al
neg edx
neg cl
neg eax
ror cl, 1
xor bl, cl
cbw
mov word [esi + edx - 0x271956cd], cx
or dword [esp + edx*2 - 0x4e32ad92], eax
dec dword [esp + edx*2 - 0x4e32ad92]
lea esi, [eax + esi - 0xf]
mov ecx, 0xf83fc20a
btr eax, eax
pop eax
jae fcn.102d9ffd
mov eax, 0x9698588d
mov ax, word [edi]
mov edx, 0xf7b4d78d
mov ecx, edx
mov dx, word [edi + 2]
neg ecx
adc cl, 0x93
lea edi, [edi + ecx - 0x84b2805]
not ax
sub ecx, ecx
not dx
shr ecx, 0x41
and ax, dx
sal cx, 1
mov word [ecx + edi], ax
xor ecx, dword [ebp + ecx*8]
mov eax, 0x463c3697
mov edx, 0xa7a45aae
lea ebp, [ebp + eax - 0x463c3693]
imul al
neg eax
imul eax
xor ecx, ebx
xadd eax, edx
neg edx
neg ecx
dec ecx
bswap ecx
neg edx
mul edx
rol ecx, 1
xor ebx, ecx
btr edx, eax
call fcn.1044c637
mov dword [esp + ecx - 0x14a], ecx
inc al
neg al
not al
mov dword [esp + ecx*2 - 0x290], 0x94be0eb0
or byte [esp + ecx - 0x146], 0x9d
sar byte [esp + ecx - 0x145], 0x21
xor bl, al
or edx, dword [esp + ecx*4 - 0x524]
xchg cx, dx
sal cl, 0xe7
lea eax, [esp + eax + 8]
cmovns ecx, edx
pop ecx
btc dx, cx
movzx cx, byte [eax + ecx - 0x14a]
movsx eax, byte [esp]
mov word [esi - 2], cx
jae 0x1032f30a
Function at 0x10443fe6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 4]
movsx ecx, al
mov ecx, dword [esi + ecx - 0x2c]
add esi, 4
or eax, dword [esp + 4]
mov dword [esp], 0x3f89c685
jns 0x10394111
xor ecx, ebx
inc eax
inc dword [esp + 2]
neg ecx
sub ecx, 0x56ab511f
neg ecx
sar word [esp + 4], 0x66
cdq
bswap ecx
cbw
adc edx, eax
sar word [esp + 3], 0x24
inc ecx
xor ebx, ecx
add edi, ecx
imul dword [esp + 4]
movsx ecx, al
mov dword [esp + edx*2 - 0x36d4a302], edi
ret 4

Function at 0x10445b06
Capabilities:
Encode data using base64

Disassembly:
bts eax, eax
btc ax, 0x39
adc esi, 3
mov dword [esp], eax
xor al, byte [esp + 2]
xor ecx, ebx
sub ax, word [esp]
neg ecx
movsx edx, al
push edx
shr edx, 0x6a
inc ecx
mov dword [esp + edx*8 + 8], edx
sal dword [esp + edx + 8], 0x12
cwd
xor ecx, 0x7f857f1d
bswap ecx
sub ecx, 0xda2bb52c
sub edx, 0x6c28b52d
call fcn.10380b8f

Function at 0x10448d75
Capabilities:
Encode data using base64

Disassembly:
sub eax, eax
movzx dx, byte [eax + ecx]
movsx ecx, ax
lea ebp, [ebp + eax + 2]
mov word [eax + ebp], dx
add eax, dword [eax + edi]
movzx edx, cx
not edx
lea edi, [edi + ecx + 4]
call fcn.103d497a
mov edx, 0x8b2c5434
call fcn.10476aab
cmp bx, 0x57af

Function at 0x1044bf55
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp]
jmp 0x103a9a1d
inc edx
xor dword [esp + esi - 1], edi
inc esp
mov edx, ecx
inc ecx
or eax, 0x30b6fd1b
dec esp
mov ecx, dword [esp + ecx*8 - 0x40]
inc esp
btr ecx, esi
dec eax
mov dword [esp + ecx - 1], 0xe238e734
inc cx
shr edx, cl
dec eax
arpl di, di
dec eax
adc ebx, edi
dec ebp
or edx, dword [edi + ecx*4 - 0x24]
rol byte [esp + edx - 0x783dc6ff], 0xe5
inc ebp
mov ebp, dword [edx + ecx - 9]
mov edi, ecx
dec ebp
lea edi, [edi + ecx*4 - 0x20]
inc ebp
mov dword [edi + edx - 0x783dc709], ebp
rol word [esp + edx - 0x783dc6fb], cl
dec eax
mov dword [esp + ecx - 9], ecx
call fcn.103a3b6a
shr dword [esp + 2], 0xb3
push 0x97847698
test ebx, ebx
lea esp, [esp + 0x10]
je 0x10323f5e
call fcn.103bf599
Function at 0x1045ab85
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
bt dx, 0x31
ror edx, cl
and word [esp + ecx - 0xfe], cx
adc ebp, eax
shr word [esp + ecx - 0xfd], 0x8a
movzx eax, word [edi + ecx - 0xfa]
lea edi, [edi + ecx*4 - 0x3f5]
xor ax, bx
and byte [esp + ecx*2 - 0x1fe], dl
rol dword [esp + ecx*4 - 0x3fc], 0xf7
sbb ax, 0xe301
sub cx, dx
jne 0x103bdb7f
clc
cmp eax, 0x3a1a3d90
add eax, dword [ebx - 0x42]
xor eax, 0x43033a3a
stosb byte es:[edi], al
leave
push es
cmp al, byte [ebx]
inc ebx
lcall 0xcd1c, 0xaf232205
stosd dword es:[edi], eax
xchg ecx, eax
push eax
mov cl, 0x99
cmp cl, byte [ebp + 0x32]
fisub dword [eax]
push eax
mov eax, 0x324d3acf
xchg esp, eax
out dx, al
push eax
mov ah, 0x56
popfd
dec edx
mov dl, 0x4f
bound esp, qword [ecx]
adc dh, ch
jl 0x10387936
shr dh, cl
retf
mov dl, 5
invalid
movzx dx, byte [eax + ecx]
movzx ecx, al
xchg cx, ax
rol eax, 0xf0
mov word [esi + eax*8 - 2], dx
xor eax, dword [edi + eax + 1]
movzx edx, cl
sal cl, 0xa4
xor eax, ebx
xor eax, 0xcb6a439
ror eax, 1
bts edx, edx
inc ecx
mov dword [esp + ecx*4 - 4], 0x550fff93
sbb eax, 0x92a22223
neg cl
bts ecx, edx
bswap eax
sar dx, 0x4c
sal edx, 0x98
jns 0x103878a7

Function at 0x1045ac5e
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov ebp, dword [esp + ebp + 0xc]
inc ecx
push ecx
call fcn.104b2911
Function at 0x10464f54
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xc488e104
inc dword [esp]
mov ebx, dword [ebx*4 + 0x1043813c]
jge 0x10415308
jle 0x103257e2
mov dx, word [esi]
mov eax, 0xf138023d
sub al, 0xb4
mov cx, word [esi + 2]
sub al, al
adc esi, 2
and al, al
and eax, eax
call fcn.104728dc
mov ecx, esi
lea eax, [edx + edx - 0x3edb427d]
bts eax, edx
push edx
lea esi, [esi + eax - 0x6b4fce9d]
not edx
mov word [esi + eax - 0x6b4fce9b], cx
lea edi, [eax + edi - 0x6b4fce9f]
pop ecx
mov edx, dword [edi + ecx - 0x55158884]
dec al
xor edx, ebx
dec ax
setg al
neg ax
rol edx, 1
shr al, 0xc7
neg edx
ror edx, 3
ror eax, 0x2d
add eax, eax
jo 0x1047ff50
xor edx, 0xfe89fc9a
xor ebx, edx
jmp 0x1048d4e9

Function at 0x1046aed6
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x8ca0a690
jmp 0x1045ac7e