joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcdca9a
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, dx
neg cx
mov ecx, dword [edi + eax - 0x62982698]
xor ecx, ebx
neg dx
add dl, ah
bswap ecx
lea eax, [edx*2 + 0x202ab412]
lea ecx, [ecx + edx - 0x6e6506e9]
and ax, 0x6933
cwd
sar eax, 0x25
ror ecx, 3
btc eax, edx
dec ecx
rol al, 0x82
not al
sub eax, 0x5d20cbb2
bswap ecx
lea ecx, [eax + ecx + 0x3c2ce9e6]
or dl, byte [esp + edx*2 - 0x75be0000]
mul dx
bswap ecx
or dx, 0x4194
sar al, 0x44
div dword [esp + edx - 0x3adf41dc]
rol ecx, 1
btc dx, 0x9a
add byte [esp + edx*2 - 0x33272fd9], 8
xor ebx, ecx
add ebp, ecx
or edx, 0x853b680c
sal byte [esp + 1], 0xa6
xor dx, dx
movzx ax, byte [esi]
mov cl, byte [esi + 2]
sub dword [esp], edx
push edx
or dword [esp + 4], 0x462b122e
adc esi, 2
imul edx, edx
or al, cl
movsx ecx, dl
rol edx, 0xdc
not al
lea ecx, [edx*4 + 0x26ac4498]
pop edx
mov word [ecx + esi - 0x26ac4498], ax
ror dword [esp + ecx - 0x26ac4498], 0x63
mov dword [esp + ecx*2 - 0x4d588930], ebp
ret
xchg dword [esp + eax - 0x673ffffc], eax
xor ebx, ecx
mov dword [esp], edx
shr al, 0xc2
add esi, ecx
cwde
inc byte [esp + 3]
add dl, dl
movzx edx, byte [edi + 4]
jg 0x97a4f3
sbb dword [esp + 4], eax
mov ecx, 0xae3712b0
adc edi, 4
or al, cl
sbb eax, dword [esp + 4]
sal al, 0x22
xor dl, bl
btc ecx, eax
xchg cx, ax
xor dl, 0xac
dec byte [esp + 4]
sal eax, 0x36
lea eax, [eax - 0x545b696b]
rol dl, 1
xchg dword [esp + eax - 0x57a49691], eax
xor dl, 0x36
dec dl
jmp 0xe6ce8b

Function at 0xce6c4c
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
dec ebp
adc ecx, eax
jmp 0xcb5714
dec ebp
lea esp, [edi - 0x215724e3]
inc dx
movzx edx, byte [eax + edx - 0x5714ac12]
inc ebp
movsx esi, ah
dec ecx
ror esi, 0x36
dec ebx
lea ecx, [edi + esi*2 - 0x72570562]
inc ecx
add ch, byte [edx + eax - 0x5714ac10]
dec eax
lea ecx, [edi*2 + 0x54aa56a9]
inc esp
movsx eax, ax
dec eax
cwde
inc eax
or dl, ch
not dl
inc ecx
mov ebp, eax
dec eax
neg ebx
inc bx
mov dword [edx + edi*4 - 0x46], edx
inc cx
rol esp, cl
cbw
inc cx
shr eax, 0xa1
dec ecx
lea ebx, [edx + eax - 0x57140010]
inc eax
mul bh
jo 0xdd46f9
add byte [edi], cl
mov dword [0xe9489c9], eax
adc dword [ecx - 1], ebp
dec dword [edi]
or dword [ebx + 0x1d], 0xe
add byte [esi - 0x1c574d94], al
jmp 0x52935a53
bt ecx, ecx
mov dword [esi + ecx - 0x96ef], edx
jae 0xd974d3
xchg byte [edx + esi*4 - 0x58], ch
jecxz 0xcb5777
rol dword [edx], 0xc8
push ecx
invalid
inc ecx
dec eax
dec edx
inc ecx
ror eax, 1
dec edx
mov dword [esp + edi - 0x12], esi
cwd
inc esp
xor dword [esp + eax - 0x5714ac12], eax
movzx edi, bl
sar edi, 0x7d
pop esi
dec eax
xadd edx, edi
dec ebp
arpl ax, ax
dec eax
xor edi, 0x6ba2f381
ja 0x97a46f
jae 0xd0aae4
dec ebx
mov dword [edx + edi*2 - 0x2a], ebx
dec edi
lea edx, [edx + edi - 0x18]
inc ecx
sub dh, 8
dec eax
lea ebx, [ebp*8 - 0x62619eec]
inc eax
shr bh, cl
jne fcn.0098d067
mov eax, 0x228d9f20
mul eax
mov ecx, dword [edi + eax*2 - 0x58518800]
rol eax, 0x2d
bts eax, 0xa1
lea edi, [edi + eax - 0x18800583]
btc ax, dx
xor ecx, ebx
shr dl, 0x41
dec ecx
not ecx
call fcn.00df3145
call fcn.009781d2
mov ecx, 0x8136d91c
or cx, cx
call fcn.00981dc1
Function at 0xcebcf0
Capabilities:
Encode data using base64

Disassembly:
pop ecx
xor ebx, eax
lea ecx, [edx + edx*2 + 0x69033482]
and edx, ecx
call fcn.00db9814
movsx eax, cx
xor ax, cx
sbb edx, 0xfdb08d20
sar ecx, 0xda
xor ebx, edx
add ebp, edx
mov eax, dword [edi + ecx*8 - 0x5c]
mov edx, ecx
lea edi, [edi + ecx*2 - 0x10]
push edx
xor byte [esp + ecx*4 - 0x2d], cl
xor eax, ebx
xchg byte [esp + ecx - 9], dl
neg eax
shr ecx, cl
add byte [esp + ecx*8 + 1], dl
inc eax
neg word [esp + ecx + 2]
neg eax
lea edx, [edx + ecx*2 - 0x5bfa785e]
shl edx, 7
bswap eax
sbb eax, 0x953f051f
btr ecx, edx
sar dword [esp + ecx*2], 0xc9
xor eax, 0x200edf35
xor ebx, eax
mov dword [esi + ecx - 4], eax
sub dword [esp + ecx], 0xed2f93ab
lea esi, [esi + ecx - 4]
movsx eax, word [esp + ecx*4]
jge 0xcbdba8
rol ecx, 1
sub word [esp + 1], 0xefb4
dec dx
sbb ecx, 0x2b5809
sub eax, eax
xor ebx, ecx
add edi, ecx
mov ecx, 0x51baad91
inc edx
mov dword [esp + eax], edi
ret

Function at 0xcfbe8b
Capabilities:
Encode data using base64

Disassembly:
adc ecx, ecx
jmp 0x99404a
mov dword [esp + 4], 0x1fe0dc17
lea esp, [esp + 4]
call fcn.00d4ad25
rep stosd dword es:[edi], eax
jmp 0x996fb4

Function at 0xd010a8
Capabilities:
Encode data using base64

Disassembly:
push edx
inc ecx
not ax
shl word [esp + eax - 0x908d], 0x23
not ecx
xor ebx, ecx
cwde
add edi, ecx
mov dword [esp + edx*2 - 0xc2], edi
ret 4
push 0x56240906
lea esp, [esp + 0xc]
call eax
mov ebx, 0xf0ac82b3
mov ebp, dword [ebp - 4]
lea edx, [ebx + ebx*2 - 0x28de1e7b]
mov dword [ebp], eax
pop ebx
movsx esi, dx
mov ecx, edx
btr edx, edx
pop esi
pop edi
dec dl
sbb cx, dx
mov ecx, dword [edi]
lea eax, [edx + edx*2 - 0x19ed377d]
dec al
jb 0xcc2cb3
adc edi, 4
push edx
xor ecx, ebx
neg dword [esp]
neg ecx
or dx, word [esp]
add eax, 0xc6a7030b
jle 0xd8943d
inc ecx
ror dword [esp], 0x47
neg ecx
rol word [esp], 0x41
shr dword [esp], 0x43
setp al
sbb ecx, 0x9c28d538
xor ebx, ecx
rol eax, 0x58
adc esi, ecx
mov dword [esp + eax - 0x1a83008], esi
ret
Function at 0xd048e0
Capabilities:
Encode data using base64

Disassembly:
not eax
xor edx, eax
bt ax, cx
push eax
sub edx, eax
xadd byte [esp + ecx + 1], ch
je 0xcc1931
bswap edx
xor edx, eax
neg edx
sub dword [esp + ecx*4 - 0x3fc00], 0xd41f100d
and dword [esp + ecx*4 - 0x3fc00], ecx
xor edx, eax
ror edx, 1
shr dword [esp + ecx*8 - 0x7f800], 0xfd
neg eax
neg dword [esp + eax*2 - 2]
not edx
adc ax, ax
adc dword [esp + eax - 2], ecx
ror word [esp + ecx*8 - 0x7f7ff], 0x6b
xor edx, 0x808cc494
neg edx
rol al, 0xc7
shr eax, 0x78
sar word [esp + eax], 0x4c
not edx
call fcn.00cf5d34
neg ax
sets dl
not ecx
add dl, 0x94
xor dl, 0x2c
shr eax, 1
ror dl, 1
not byte [esp + eax - 0x42183253]
inc cl
push eax
add dl, 9
sub cx, word [esp + eax - 0x42183253]
add dword [esp + eax - 0x42183252], 0xf4b1f313
jbe 0xde91ef
neg eax
mov edx, ecx
xor dword [esp + ecx*8 - 0x8c], 0x83a489a5
not dx
xor ebx, eax
add ebp, eax
movsx eax, dx
or cx, cx
call fcn.009733bc
xor ebx, eax
sar cx, 0xa3
push edx
add edi, eax
shl dx, 0xae
xor dl, byte [edx + ebp + 4]
movzx eax, cl
add dword [esp + ecx - 0x10], 0xa32d3b8f
btc eax, eax
lea ebp, [ecx + ebp - 0xd]
neg eax
pop ecx
adc eax, 0x843464ba
xor dl, bl
jmp 0xccda1e
inc eax
xor edx, ecx
pop edx
not eax
jno 0xce831d
mov eax, 0x2d296e30
push eax
shl eax, 0xfa
mov eax, dword [ebp]
mov edx, dword [esp]
xor eax, ebx
sar dword [esp + edx*2 - 0x5a52dc60], 0x91
movsx ecx, byte [esp + edx*2 - 0x5a52dc60]
inc eax
sar cl, 0xc7
adc edx, edx
neg eax
inc ecx
rol eax, 2
lea eax, [eax + edx*2 - 0x52791018]
xchg dword [esp + edx - 0x5a52dc60], edx
and edx, edx
ror eax, 1
sal cl, 0x62
xor cl, 0x94
not word [esp + edx - 0x1693]
bswap eax
js 0xcee3a3
mov ax, word [ebp]
mov ecx, 0x359abea1
movzx edx, cl
mov dx, word [ecx + ebp - 0x359abe9f]
btr cx, cx
bswap ecx
sar ecx, cl
mov cl, byte [ebp + 4]
push 0x37191301
jne 0xdd2a11
mov edx, 0x9418d41a
lea eax, [edx + edx*8 + 0x202eb726]
mov edx, dword [edi + eax - 0x550e2c10]
neg eax
adc edi, 3
sub eax, eax
sub ax, ax
movzx ecx, ax
xor edx, ebx
btr ax, cx
neg edx
cwde
jmp 0x9778f3
mov edx, 0xc11f689f
xor eax, ebx
and dl, byte [esp + 0xa]
movsx ecx, byte [esp + 8]
bswap eax
lea eax, [eax + ecx - 0x188acae]
xor eax, 0x6f80319f
mov dword [esp + ecx*2 - 0x20], ecx
shl dx, 8
jns 0xd01c7d
adc ebp, 3
ror byte [esp + 3], 0x61
shr word [esp], 0xc3
shrd ax, dx, cl
call fcn.00dbdea9
not dl
xor cl, byte [esp + eax - 0x42183250]
jge 0xe6baa1
xor bl, dl
and dword [esp + eax - 0x42183250], 0x5c9f6519
xchg byte [esp + eax - 0x42183253], cl
movzx dx, dl
mov al, byte [eax + esi - 0x42183254]
neg ecx
rol ecx, cl
bswap ecx
and dl, al
movsx eax, cx
dec eax
not dl
mov word [esi], dx
sar dword [esp + 2], cl
pop eax
pop ecx
jmp edi

Function at 0xd04e6b
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov esi, dword [esp + ebx - 0xa399]
inc ebp
movsx esp, bh
call fcn.0096d9da
Function at 0xd04f35
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
xchg esp, eax
or byte [eax], al
add byte [eax], al
mov cs, word [ebx - 0x1e3e993f]
imul ecx, dword [edi], 0xffffff82
xchg ebp, eax
sub dword [edi], eax
add byte [ebx + 0x6068c], cl
add byte [esi + 0x48489], cl
add byte [eax], al
mov cs, word [ebx + 0xa0684]
add byte [esi + 0x15bac813], cl
mov ah, 0x84
xor al, 0x89
mov word [esi], ss
cmc
dec ebx
jnp 0xd04efb
call fcn.00d6a519
mov esp, 0x9accee65
popal
add byte [ebp + 0x619accee], bh
mov edi, 0xd492c6e4
pop ds
xchg edi, eax
jecxz 0xd04f00
test byte [ebp - 0x70e4975c], bl
adc al, 0xe5
movsb byte es:[edi], byte [esi]
push 0x5d42e31b
movsb byte es:[edi], byte [esi]
push 0xcd242b1b
movsb byte es:[edi], byte [esi]
push 0x3d4ed71b
movsb byte es:[edi], byte [esi]
push 0x15962b1b
movsb byte es:[edi], byte [esi]
push 0xbc12571b
das
inc edi
sbb esi, dword [edx + 0x4ee64347]
dec edi
bound ecx, qword [ebx]
in al, 9
xor ch, cl
enter 0x2419, 0xb
jo 0xd04f39
cmpsb byte cs:[esi], byte es:[edi]
pop ecx
mov al, byte [0xa5e5abb7]
shr edi, cl
xor dword [ebx + edi*8 + 0x6d21931c], esi
rol byte [ebp - 0x43], 1
pop edi
push esi
loopne 0xd04fbc
mov ecx, 0x2197e4b9
ja 0xd04fcf
and byte [esp + edx + 0x14], dl
invalid
push cs
imul edx, dword [eax], 0xb41b4f75
xor byte [edx + 0x8b1e], cl
add byte [eax], al
xor eax, 0xff01f7b1
add edi, edi
invalid

Function at 0xd0ce3b
Capabilities:
Encode data using base64

Disassembly:
jge 0xc865f2
dec ebp
add ecx, esi
inc ecx
movzx eax, byte [ebx + edi - 0x60a2f3cc]
inc esp
bts ebx, ebp
inc esp
movsx esi, byte [esp + edi - 0x60a2f3be]
inc ecx
inc edi
dec edi
lea ebx, [ebx + edi - 0x60a1fff4]
btc cx, bx
inc eax
xor al, dh
inc esp
or eax, ecx
neg al
not al
pop ecx
inc ecx
mov edx, esp
dec edx
mov dword [esp + edi - 0x60a20001], ebx
add al, 0x8f
dec ecx
bts edi, 0xad
not al
inc ecx
pop eax
inc eax
xor dh, al
dec esp
xadd edx, esp
dec ecx
dec esp
dec eax
lea eax, [esp + eax + 0x10]
inc ebp
add ah, ah
inc cx
adc esi, 0x8b4468ab
mov ah, 0x38
sub byte [ebx*2 + 0x23c5819f], cl
jecxz 0xd0cebc
jo 0xd0cef8
mov dword [edx - 4], esi
inc ecx
neg ah
dec esi
lea esi, [edi + eax*2 + 0x2d097389]
dec ebp
lea edx, [edx + edi - 0x60a2f3e4]
mov dword [ebx + 9], esi
sub eax, 0x3a948d4d
sbb al, 0xc
pop ebp
lahf
pop edi
pop ebx
jg fcn.0098d067
mov eax, dword [edi]
mov ecx, 0xe7284f8d
mov edx, ecx
push ecx
add edi, 4
xor eax, ebx
rol edx, 0x90
sar ecx, cl
not byte [esp + edx - 0x4f8de727]
inc eax
or ecx, ecx
sbb cl, 0xa7
rol eax, 1
bswap eax
xor eax, 0xa7b19987
xor ecx, 0x7d8cada4
and dx, 0xae31
lea eax, [eax + edx - 0x7b12d35b]
sub dword [esp + edx - 0x4f8da620], 0x77254239
xor ebx, eax
shl ecx, cl
jne 0xc90fec
Function at 0xd0cfda
Capabilities:
Authenticate hmac

Disassembly:
xor bl, dl
call fcn.00d01b71
mov ecx, dword [esi]
mov edx, dword [ecx]
mov dword [esi], edx
mov eax, dword [ebp]
mov ecx, 0xa089e089
add ebp, 4
push ecx
movzx edx, byte [esp]
xor eax, ebx
neg byte [esp + edx*8 - 0x446]
xadd cx, dx
jg 0x99c855
neg eax
xchg word [esp + edx*8 - 0x70447], cx
not byte [esp + edx - 0xe086]
dec eax
and cl, byte [esp + edx*4 - 0x38224]
imul edx, ecx
xor eax, 0xe62c0a13
btr ecx, edx
jb 0xdebbdb
bswap eax
ror dword [esp + edx - 0x3220f380], 0xaa
dec edx
xchg word [esp + edx - 0x3220f37f], cx
xor ebx, eax
bts edx, ecx
add edi, eax
xor word [esp + edx*2 - 0x6441e6fc], 0xc41b
dec dword [esp + edx - 0x3220f37f]
mov dword [esp + edx - 0x3220f37f], edi
ret
not cx
not dx
sub ax, ax
and cx, dx
mov word [esi + 4], cx
lea ecx, [eax - 0x49779f6e]
cdq
lea esi, [ecx + esi - 0x70ad608e]
mov edx, dword [edi + ecx - 0x70ad6092]
call fcn.00cae99b
btr ax, 0x39
movzx edx, byte [edi + eax*2 - 0x7ecb0060]
not eax
mov dword [esp], eax
inc dword [esp]
xor dl, bl
shl ax, 0x68
adc dl, al
xadd al, ah
ror dl, 1
neg dl
xor dl, 9
xor ax, ax
not dl
jae 0x97d068
mov ax, word [esi]
mov ecx, 0xec980817
and ecx, ecx
adc esi, 2
and ecx, ecx
movsx edx, cl
lea edi, [edi + edx*4 - 0x5d]
sets dl
xor cl, dh
sal cx, 0xe2
movzx ecx, byte [edi + edx*2 - 2]
rol edx, 0x5c
bts edx, edx
lea edx, [edx + edx*2 - 0x8cb814f]
xor cl, bl
call fcn.00dc7c97
mov edx, 0x21adedb5
mov cx, word [edx + esi - 0x21adedb5]
mov eax, 0xba25199d
dec dx
sal ax, 0x2d
mov dx, word [esi + edx*2 - 0x435bdb66]
and cx, dx
not cx
lea edx, [eax + eax + 0x1fb2900e]
shr edx, 0xc6
mov dx, word [esi + edx*4 - 0x93fdcfc]
shl ax, 0x22
jae 0xbf1495
sar edx, 0xf0
call fcn.009703dc

Function at 0xd0d82a
Capabilities:
Encode data using xor

Disassembly:
shr dword [esp + 1], 0xe4
xor eax, edi
push 0xeb355d81
sal dword [esp + 4], 0x17
call fcn.00d80717
lea edx, [edx + eax*4 - 0x33a6d86b]
and al, ch
ror edx, 1
xor al, al
dec edx
btr eax, 0x87
and ecx, ecx
rol edx, 1
lea edx, [edx + ecx - 0x3ecf38ce]
sar ax, 0x81
call fcn.00db8f4e
mov dh, 0xf6
salc
jnp 0x9a7d4c
test eax, 0xa27019ff
cmpsd dword [esi], dword es:[edi]
mov ebp, 0x867019ff
test dword [ebp - 0x458fe601], edx
stosd dword es:[edi], eax
inc edx
invalid
add ebp, 4
mov dword [esp], ecx
xor edx, ebx
shl cx, 0x8c
shr dword [esp], 1
ror edx, 3
lea eax, [ecx*8 + 0x7099b434]
dec edx
rol edx, 3
not word [esp + eax - 0x55643434]
dec edx
rol edx, 3
ror cx, 0xcd
rol ecx, cl
bswap edx
adc ecx, eax
xor ebx, edx
add edi, edx
mov edx, esi
lea esi, [esi + eax - 0x55643438]
mov dword [esi + eax - 0x55643434], edx
ror word [esp + eax - 0x55643434], 0xe2
pop ecx
jae fcn.0096f6cc
xor edx, ebx
neg cx
shr eax, 0x6e
ja 0x9a7d62
movsx eax, cx
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
mul ecx
mov ecx, 0xd71e5e80
shr ecx, 0x4c
lea ecx, [ecx + ecx*8 + 0x240922a1]
mov dword [ebp + ecx*2 - 0x4904475c], edx
movzx edx, cl
jne 0xde5aa2

Function at 0xd0ecf8
Capabilities:
Authenticate hmac

Disassembly:
dec ebx
push 0x5884bd30
push 0x78228eb5
lea esp, [esp + 0xc]
jne 0xdc1ecd
Function at 0xd148aa
Capabilities:
Encode data using base64

Disassembly:
seto cl
xor edx, 0x1d0d3a8c
lea edx, [eax + edx + 0x268588f9]
shr cl, 0x83
bts ecx, ecx
not ecx
not edx
pop eax
inc dword [esp + ecx - 0x51b2c1fa]
xor ebx, edx
shl word [esp + ecx - 0x51b2c1fb], 0x6e
call fcn.00cd1b90
add byte [eax], al
inc ebx
jb 0xd14946
popal
je 0xd14949
dec ecx
arpl word [edi + 0x6e], bp
inc esi
jb 0xd1495a
insd dword es:[edi], dx
push edx
jae 0xd1495f
jne 0xd14964
arpl word [ebp], sp
mov eax, 0x31a449a6
mov eax, dword [ebp + eax*2 - 0x6348934c]
push 0x170c6921
sub ebp, 0xfffffffc
mov edx, dword [esp]
xor eax, ebx
sar dword [esp + edx - 0x170c6921], 0xfc
dec eax
bswap eax
adc al, 0xdf
xchg esi, eax
call 0xc8e09216
movzx ecx, dl
sar dl, 3
xchg dword [esp + edx*4 - 0x5c31a410], edx
ror eax, cl
add ecx, edx
sbb eax, 0xeda67db9
btr edx, ecx
not edx
bt cx, dx
rol eax, cl
bt edx, ecx
xor dword [esp + ecx*8 - 0x110], ecx
neg eax
pop edx
shl cl, 0xc6
fcomp dword [edx - 0x40]
loope 0xd14911
ror cx, 0xe6
xor ebx, eax
add edi, eax
neg cl
mov dx, word [esi + edx - 0x170c6926]
add cx, cx
xchg esi, eax
call 0x8c9a4cc7
ror dword [ebp - 0x1d3f374], 0xff
dec dword [eax - 0x1fbf76c]
invalid
leave
mov eax, ecx
lea ecx, [esp + ecx - 0x1d4]
mov byte [eax + ecx - 0x1fc], dl
lea ecx, [esp + eax*2 - 0x3d0]
mov edx, 0x99aa829c
rol eax, 0xc5
movzx ax, byte [eax + ecx - 0x3f80]
call fcn.00985d3e
or al, 0x2c
invalid

Function at 0xd16fa2
Capabilities:
Encode data using base64

Disassembly:
dec eax
sbb ebp, 0xbaa82b8d
inc esp
adc ebp, ecx
inc ecx
dec edi
mul cx
inc ebp
mov esp, esi
dec eax
mov dword [esp + eax - 0x22b0fff0], esi
and cl, bl
dec eax
mov dword [esp + eax*2 - 0x4561fff8], 0xaf93cfbf
inc esp
xor dword [esp + edx + 0x10], ebp
dec eax
mov esi, dword [esp + eax - 0x22b0fff0]
cwd
dec bl
div word [esp + eax - 0x22b0fff7]
dec ebp
lea edx, [edx + eax - 0x22b10004]
dec eax
mov dword [esp + eax - 0x22b0fff0], edi
inc esp
xchg byte [esp + eax*2 - 0x4561fff4], al
inc di
inc ebp
mov dword [edx + eax - 0x22b10000], ebp
inc ecx
mov eax, dword [ebx + ebp - 0x45581973]
rol word [esp + edx + 0xf], 0x28
sar ebp, 0xc5
dec esi
lea ebx, [ebp + ebx - 0x22ac0c7]
mov word [esp + ebp*4 - 0x8ab0322], bp
sbb bx, word [esp + ebp*2 - 0x4558183]
xor eax, esi
bswap eax
imul ebx, edi
setno dl
dec eax
mov dword [esp + ebp - 0x22ac0cb], 0x693218a2
sbb eax, 0xd13be3bc
dec eax
lea edi, [edx + 0x6e857b02]
bswap eax
inc ecx
xchg dh, ch
dec dword [esp + ebp*2 - 0x4558073]
not eax
dec edx
lea ebx, [eax*2 - 0x3e40de43]
setno byte [esp + ebp*2 - 0x4558064]
dec eax
mov dword [esp + ebp - 0x22ac02a], esi
inc ecx
dec eax
inc bp
ror dword [esp + ebp*4 - 0x8ab00e9], 0x38
xor dword [esp + ebp - 0x22ac02b], eax
dec ebp
lea eax, [edi + 0x77ac9f86]
dec eax
xor ebp, 0xfa3aa594
neg dl
dec eax
mov esi, dword [esp + ebp*4 + 0x1fbe6954]
dec eax
arpl ax, ax
inc ecx
seta ah
dec ebp
xchg eax, edi
dec esp
adc ecx, eax
ror word [esp + edx], 1
inc cx
inc edi
pop eax
pop edx
inc ecx
pop esi
jle fcn.0098d067
Function at 0xd19e60
Capabilities:
Encode data using base64

Disassembly:
shld dx, ax, cl
mov ecx, dword [esp + 8]
mov word [esi], dx
movsx edx, cl
xchg word [esp + 0xa], dx
mov ecx, dword [edi]
mov dword [esp + 4], edx
movsx eax, word [esp + 8]
not byte [esp + eax*2 - 0x4909]
lea edi, [edi + eax*8 - 0x1243c]
xor ecx, ebx
cdq
rol dl, 0xa7
lea ecx, [ecx + edx*2 - 0x661f4c22]
call fcn.00d16173

Function at 0xd19ea0
Capabilities:
Encode data using base64

Disassembly:
call fcn.00dca955
inc ecx
mov esp, 0xcf158b27
dec edx
lea ecx, [0x5cb89503]
inc ecx
mov ebp, dword [ebx]
dec ecx
add ebx, 4
inc esp
movzx esi, cl
xor ebp, esi
inc ebp
mov edi, esi
dec ebp
lea ebp, [esi + 0x3f00f413]
mov ebx, 0x49aba727
xor ebp, 0xc3bb5427
inc ecx
shl ch, 0xe3
dec ebx
lea eax, [esi + esi*2 - 0x6d3f3f3]
dec ebp
and edi, ebp
bswap ebp
inc ecx
sbb esp, 0xa49b0909
call fcn.00c7a885

Function at 0xd229a7
Capabilities:
Execute syscall

Disassembly:
xor ebx, edx
mov dword [esp + ecx*4 - 0x66fe8694], ecx
pop ecx
add ebp, edx
or al, 0xa6
rol al, 0x86
not eax
mov ecx, dword [esi + ecx*4 - 0x66fe8694]
mov ax, word [esi + 4]
jne 0xd2ba56
int 0x2e
push 0xffffffffffffffb5
inc eax
ror byte [edx], cl
sub dword [esi - 0x3a], eax
sub al, 0x8a
or ch, byte [ecx]
inc esi
mov esp, dword [eax]
scasb al, byte es:[edi]
or ch, byte [ecx]
inc esi
stosb byte es:[edi], al
adc eax, 0x9d7f6045
ret 0xc36c
mov word [ecx], ax
mov edx, 0x40a9e294
lea eax, [edx + edx*8 - 0x31f84cf4]
mov eax, dword [edi + edx - 0x40a9e29c]
sub edx, edx
lea edi, [edi + edx*4 - 8]
xor eax, ebx
add eax, 0x8eb8199a
lea ecx, [edx*4 + 0x4109bfb6]
bswap eax
sub eax, 0xa6369b20
imul cx, cx
bswap eax
not dx
sal ecx, cl
call fcn.009a4fb8
movzx edx, byte [edi]
mov ecx, 0x38b182
xor dl, bl
mov eax, ecx
dec dl
imul eax, ecx
lea ecx, [ecx*2 + 0x298b992]
sbb eax, ecx
rol dl, 1
jmp fcn.00c91ae2
Function at 0xd25623
Capabilities:
Encode data using base64

Disassembly:
and ax, cx
mov word [edx + esi - 0xe854600], ax
call fcn.00dd45c6
add byte [eax], al
add byte [edx + 0x65], dl
inc ebx
jb 0xd256a1
popal
je 0xd256a4
dec ebx
jns 0xd25688
js 0xd25686
add byte [ecx - 0x75], al
add ebp, eax
das
push esi
add al, 0
mov bl, 0x6d
cmp byte [esi], 0x84
and al, 0xa4
mov eax, dword [eax + esi - 0x59c494d6]
movzx ecx, dl
push edx
or cx, dx
mov ecx, dword [ecx + esi - 0x1094]
mov dword [esp], ebx
lea edx, [edx*4 - 0x5b525fd0]
mov ebx, edx
sbb dl, bl
cpuid
call fcn.00d2a733

Function at 0xd26874
Capabilities:
Encode data using base64

Disassembly:
dec eax
cwde
inc eax
add ch, 0x81
shr al, 0x61
inc eax
neg ch
inc si
mov dword [esp + eax - 0x5187a6a4], ebp
inc dx
xor dword [esp + eax - 0x5187a6a9], eax
inc ecx
mov ebx, esi
inc eax
rol ch, 1
inc ecx
xadd esp, eax
inc ecx
inc ch
dec edx
not dword [esp - 0x5d]
inc eax
xor dh, ch
call fcn.00d6c681
inc sp
or esp, edi
dec eax
arpl bx, bx
dec ecx
ror esp, 0x5e
dec edx
mov dword [esp + eax - 0x5187a6ad], edx
pop ebp
dec esp
adc ecx, ebx
push ebp
dec edx
sar dword [esp + eax - 0x5187a6ad], 1
inc ebx
mov edx, dword [edx + eax - 0x5187a6b1]
inc ebx
movzx ebp, byte [ebx + eax - 0x5187a6a8]
jle fcn.00dae2b0
adc dword [esp + eax*2], ecx
inc ecx
add al, dh
dec ebp
lea ebx, [ebx + eax*2 - 0x184]
jle 0xdca668
inc eax
xor ch, dh
inc edx
inc dword [esp + esi - 0x4289a2c5]
inc ecx
rol esi, 0xb8
inc ecx
push esp
inc eax
ror ch, 1
shr byte [esp + eax - 0xbf], 0xe4
inc edx
rol dword [esp + eax - 0x5187a6a9], 0x78
inc eax
xor ch, 0x8a
dec word [esp + eax - 0xbd]
jl 0x96cce2
rol eax, 1
xor eax, 0xda1ce5bc
bswap eax
rol dx, 0x8f
xor eax, 0x8fb07c3b
sar edx, 0xc
not edx
lea edx, [edx - 0x286b55dd]
xor ebx, eax
add ebp, eax
movzx dx, byte [esi + ecx*2 - 2]
or cl, byte [esi + ecx]
not dl
not cl
or dl, cl
mov ecx, 0x45b9f5af
mov eax, ecx
mov word [ecx + esi - 0x45b9f5af], dx
sal eax, 0x99
mov edx, ecx
push eax
mov dword [esp + ecx - 0x45b9f5af], ebp
ret
Function at 0xd2f032
Capabilities:
Encode data using base64

Disassembly:
pop edi
shr cx, 0x85
rol ecx, 0x15
mov ecx, dword [ecx + edi - 0x54100]
lea edi, [edi + edx*2 - 0x1428c]
xor ecx, ebx
mov eax, 0x4eb03a30
not edx
btr eax, 0
sbb ecx, 0xbdbef9b2
sub al, dh
call fcn.0095ca85
inc esp
and esi, edi
inc ecx
setp ch
inc ebp
adc bh, ch
cwde
inc ebp
or dh, dh
inc ecx
sal eax, 0x97
inc ecx
xor dh, bh
ror eax, cl
dec eax
lea ebx, [ecx*2 - 0x6d59eff1]
dec eax
cdq
dec esp
adc edi, esp
inc esi
add al, byte [ebp + edi - 0x14f30d1a]
inc esp
xadd edi, esi
dec esi
lea edi, [ebx + 0x7d0ac116]
inc bp
mov dword [edx + ebp*2 - 0x29e61a34], eax
inc ecx
mul ebp
cwde
btr ax, bp
inc ebp
mov edi, dword [ebx + ebp*2 - 0x29e61a33]
inc esp
movzx eax, cl
dec esi
lea ebx, [ebp + ebx - 0x14f30d15]
inc ecx
xchg ah, dl
dec eax
cdq
inc esp
xor edi, esi
inc sp
xchg edx, ebp
neg edx
inc esp
and esp, edi
inc edi
lea edi, [esp + edi - 0x5b9b5029]
inc cx
neg eax
inc eax
setl bh
inc ecx
rol edi, 2
bt ecx, 0x30
inc ecx
bswap edi
inc esp
adc edi, edx
dec eax
sub ebp, 0xb718c088
inc ecx
xor edi, 0xc01dd599
inc ecx
ror edi, 2
inc eax
inc bh
inc ecx
setnp dh
inc ecx
btr eax, 0x3b
push esi
jae 0xd1a113
dec eax
bts eax, eax
inc edx
bswap edx
or dword [esp + eax - 0x1cb5bbba], 0x4233bdbb
ror edx, 3
xor ebx, edx
imul eax, ecx
dec dword [esp + ecx - 0x67642589]
add edi, edx
bts ecx, 0x8b
mul byte [esp + ecx - 0x67642d84]
movzx ecx, byte [ebp + ecx - 0x67642d8a]
shr byte [esp + 8], 0x81
adc ebp, 6
pop edx
or ax, 0xfa93
xor cl, bl
rol al, 0xe4
shl dword [esp + 4], 0x27
btr edx, eax
inc cl
not cl
shr edx, 0x66
inc edx
neg cl
btc ax, 0xf
call fcn.00c9d06f
inc esp
xor dword [esp + ebp - 0x5dda4c92], edi
pop esi
dec ecx
mul ebp
dec ebp
arpl di, di
dec eax
bt eax, ebx
rol ebp, 0xb0
dec eax
cwde
dec ebp
adc ecx, edi
dec ebp
or esp, ecx
inc ecx
jmp esp
adc edi, eax
call fcn.00d8477f
mov ecx, 0x18a048e
movzx edx, cl
and cl, cl
lea edi, [edi + ecx*2 - 0x3140920]
mov eax, dword [ecx + edi - 0x18a048e]
add dx, dx
sub dl, cl
xor eax, ebx
xor eax, 0xe8b32592
bts ecx, 0x16
or cx, 0xa4b7
neg eax
bts edx, edx
and ecx, ecx
imul edx, ecx
rol eax, 1
not cx
inc eax
or dx, cx
neg eax
inc ecx
lea ecx, [edx*8 - 0x6c107c4]
xor ebx, eax
xchg edx, ecx
add edx, ecx
imul edx, ecx
add ebp, eax
push edx
rol byte [esp + ecx - 0x723bfbf0], 0xc1
mov ecx, dword [esi + ecx - 0x723bfbf2]
mov edx, dword [ecx]
mov ecx, dword [esp]
call fcn.00cebcd8
jmp 0xdd883a
call eax
mov ecx, 0x2e3c3824
mov ebp, dword [ebp + ecx - 0x2e3c3828]
and ecx, 0x2b8ac3ab
mov dword [ebp + ecx*2 - 0x54100040], eax
lea edi, [ecx + ecx - 0x30db5ef8]
movzx edx, di
mov esi, ebp
and cx, dx
lea ebx, [ecx*8 - 0x1dc9d5f0]
not ebx
pop ebx
cmovl di, dx
pop ebp
inc ecx
jns 0x9880c4

Function at 0xd3407a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], edi
call fcn.00d5580f