joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1094f207
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
add esi, 0xa
dec ecx
shld ecx, edx, cl
dec esp
mov dword [esi], ecx
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x1095018f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
mov edi, dword [esp + 8]
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x109519b8
Capabilities:
Encode data using base64

Disassembly:
mov ax, word [esi + 4]
add esi, 6
call fcn.10948865

Function at 0x10951c2a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shrd bx, dx, cl
mov word [esi], bx
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x10952ee6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x7a1b7781
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x10952f4a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add esi, 6
shrd edx, ebp, cl
jmp 0x10999bb0
mov dword [esi], edx
call fcn.1094ad67

Function at 0x109531e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
add esi, 0x10
call fcn.10963169
nop
mov cx, ss
mov ss, cx
jmp 0x1095612b
push ebx
push ecx
mov dword [esp + 4], 0x88d59e97
lea esp, [esp + 4]
call fcn.109381fb
not ecx
mov dword [esi], ecx
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x10953200
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x4eaf7010
call fcn.1095eab9
add byte [eax], al
push ebx
push 0x456c6c65
js 0x10953279
arpl word [ebp + 0x74], si
inc ecx
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
shld ecx, eax, 0xa6
Function at 0x1095321a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x1099a83b
je 0x1098434b
sub eax, eax
xchg si, si
movzx esi, di
pop esi
jmp 0x109772a5
dec edi
test esp, 0x43a6f7ac
cmp ecx, 0xb73963a3
cmp edi, edx
add eax, edx
sub ebx, ebx
clc
mov dword [ebp - 0xc], eax
clc
cmc
test bp, si
test edi, edi
jmp 0x10998667
jle 0x1099a805
lea ebx, [esi + 1]
cmp ebx, edi
movsx edx, di
mov dx, bx
mov edx, dword [ebp + 8]
jmp 0x109a2aeb
jmp 0x10948bd3
ja 0x1096fe3a
mov eax, esi
cmp sp, di
sub eax, dword [ecx + edx + 0x10]
jmp 0x109a568c
push ebp
mov ebp, esp
not edx
rcr dh, cl
shrd dx, si, 0x86
mov edx, dword [ebp + 8]
cmp bh, 0x98
lea esp, [esp - 0x114]
stc
cmc
jmp 0x10992c8e
jne 0x1094161c
mov ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
test ecx, ecx
jmp 0x109adf07
mov dword [ebp - 0x10], eax
cmp edi, 0x3915318e
mov dword [ebp - 8], 0xffffffff
test ebp, 0x6aa696bb
cmp esi, 0xffff
jmp 0x10950d6c
je 0x1094161c
mov esi, dword [ebp + 0xc]
stc
cmp ebx, esp
test esi, esi
jmp 0x109a2adb
mov edi, dword [ecx + edx + 0x18]
test edi, edi
jmp 0x10979964
cmp word [edx], ax
jmp 0x10941616
jae 0x1095669c
mov esi, dword [ecx + edx + 0x1c]
cmp ch, 0x2b
cmp si, cx
lea eax, [esi + eax*4]
mov eax, dword [eax + edx]
test eax, eax
je 0x1095669c
cmp eax, ecx
jmp 0x10971e76
mov esp, ebp
pop ebp
ret
je 0x1099a83b
mov eax, dword [ecx + edx + 0x20]
jmp 0x1094164d
mov eax, dword [edx + 0x3c]
cmc
cmp sp, ax
add eax, edx
stc
cmp dword [eax], 0x4550
jmp 0x109616a7
push esi
stc
test edx, edx
jmp 0x1096f770
jl 0x1099a83b
jmp 0x109a59a4
jge 0x10948bca
lea edi, [esi - 1]
jmp 0x1094cfa3
mov edx, dword [ebp - 4]
sal ax, cl
mov eax, dword [ebp + 8]
rol cx, 0x96
shr ch, 0x1e
mov ecx, dword [edx + eax + 0x24]
lea edx, [ecx + esi*2]
movzx eax, word [edx + eax]
bt cx, 0x28
cmc
mov ecx, dword [ebp - 4]
neg dh
shr dx, cl
mov edx, dword [ebp + 8]
mov dword [ebp - 8], eax
and ah, 1
cmp edi, edx
or al, 0x9f
mov eax, dword [ebp - 8]
cmp eax, dword [ecx + edx + 0x14]
jmp 0x10976794
je 0x1094161c
mov eax, 0x5a4d
jmp 0x10973fd4
jle 0x109a59a1
mov ecx, dword [ebp - 4]
jmp 0x109385f1
jmp 0x1099a831
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
ror si, 0xb3
rol esi, 0x9d
lea esi, [edi + ebx]
test bx, sp
sar esi, 1
cmp esp, 0x18ad293d
stc
mov eax, dword [eax + esi*4]
clc
cmc
stc
push ecx
clc
shrd ecx, eax, 0x29
mov ecx, dword [ebp + 0xc]
test bl, 2
clc
add eax, edx
call fcn.1096a4c3
lea esp, [esp + 4]
test eax, eax
jmp 0x1099a3dc
je 0x1094161c
mov eax, dword [eax + 0x7c]
test bl, 0x11
push ebx
cmp ebx, ebx
cmp esp, 0xdb97e623
push edi
stc
jmp 0x109696f7

Function at 0x1095473e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec ecx
add ecx, esi
jmp 0x1095ae01
jmp 0x1098caff
dec eax
mov dword [esi], ecx
dec eax
mov dword [esp], 0x92047aaa
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x10954c78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x38]
jmp fcn.1095380f

Function at 0x109554c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec esp
mov dword [esi], esi
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f
Function at 0x10955ae8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc esp
mov dword [esi], edi
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x1095613e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
add esi, 0x10
call fcn.10963169
nop
mov cx, ss
mov ss, cx
jmp 0x1095612b
push ebx
push ecx
mov dword [esp + 4], 0x88d59e97
lea esp, [esp + 4]
call fcn.109381fb
not ecx
mov dword [esi], ecx
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x10956643
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x9235a690
call fcn.109381fb

Function at 0x10956d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc sp
mov dword [esi], ebp
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x10956fa7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esi], edx
jmp 0x1096eddf
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x109593eb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
mov byte [esp], dl
push 0xfa1886b5
dec eax
mov dword [esp + 0x18], 0x28bfcd95
dec eax
lea esp, [esp + 0x28]
jmp fcn.1095380f

Function at 0x1095ce87
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x1ea92116
mov eax, dword [ebp + ebx*4]
push 0x500c0782
call fcn.1095ce87
call fcn.1099926c
mov dword [esp + 4], eax
dec ebx
lea esp, [esp + 4]
jne 0x10939634
mov eax, dword [ebp]
jmp 0x1099a7e2
jmp 0x10955e55

Function at 0x1095d56b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
mov dword [esp], 0xe784b79d
push 0x283d0e98
mov dword [ebp], ebx
jmp 0x10999f98
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x1095eab9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.1098059b
mov eax, dword [esi + ecx - 0x4eaf7010]
mov dword [esp + ecx - 0x4eaf700c], ecx
mov ecx, dword [ecx + esi - 0x4eaf700c]
add esi, 8
mov dword [eax], ecx
jmp 0x10954c73

Function at 0x109627fa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call 0x1097797f
mov eax, 0xe909140b
dec eax
mov eax, dword [esi]
push 0xe21ef823
dec eax
add esi, 8
push 0x91a299a8
dec eax
mov dword [esp + 8], eax
push dword [esp + 8]
popfd
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f
lea ecx, [esp + ecx + 0x10]
jmp 0x1094ee91

Function at 0x10962f2b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x6cb84cba
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f
mov cl, byte [esi + 2]
dec eax
add esi, 2
inc ecx
shl ch, cl
inc sp
mov dword [esi], ebp
jmp 0x10942bfd

Function at 0x10963169
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec ecx
mov dword [edx], ecx
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x10963ccc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec esi
mov esi, dword [esi + edx - 0x480ab909]
dec esi
mov edx, dword [esi + edx - 0x480ab901]
dec eax
add esi, 8
dec ebp
add esi, edx
dec esp
mov dword [esi], esi
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x1096598d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f
Function at 0x109667b5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esi], ebp
jmp 0x1097f838
push 0xb09ca02e
dec eax
lea esp, [esp + 0x28]
jmp fcn.1095380f

Function at 0x10966e5e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esi], ebx
push 0x3d031cb4
push 0xa2bfd23b
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x109670a6
Capabilities:
Encode data using base64

Disassembly:
call 0x1095613e
not edx
add edx, 0x4a2a6bbb
shl byte [esp], 0xe3
neg edx
rol edx, 3
xor ebx, edx
call fcn.1096ac62
or ecx, ebx
jmp 0x10949fd4

Function at 0x10968bc8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esi], dx
jmp 0x1098dd83
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x1096cd66
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
add esi, 0xc
push 0xa9b3be1e
inc esp
mov dword [eax], esp
call fcn.10940f53
les ecx, [esi]
add byte [eax], al

Function at 0x1096cd7f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec ecx
shrd edx, edx, cl
dec esp
mov dword [esi], edx
push 0x941b82a9
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x1096f0b1
Capabilities:
Encode data using base64

Disassembly:
xor dl, bl
rol dl, 1
call fcn.10990397
inc ecx
mov esi, 0xb2a47c13
inc ecx
push esi
inc esp
mov ebp, dword [esi]
dec eax
add esi, 4
inc ecx
rol dh, 3
dec ecx
sbb ebx, 1
shl dword [esp + 2], 0xd2
inc ecx
sar esi, 0x42
inc ebp
movzx esi, byte [ebx]
js 0x1096f5de
jno 0x1096f103
ljmp 0x65d4:0xb206d93e
inc ebp
xor dh, al
inc ecx
rol dh, 1
inc ecx
add dh, 0x2e
inc ecx
rol dh, 1
inc ecx
sub dh, 0xd
inc ebp
xor al, dh
dec eax
not dword [esp]
dec esi
lea esi, [esp + esi + 8]
inc ebp
mov dword [esi], ebp
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x1096f17a
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 0xc]
call fcn.1096fdae
mov ecx, 0xaaa8de98
movzx dx, byte [esi]
mov dword [esp], ecx
call fcn.1093c1c7

Function at 0x1096f5d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x28]
jmp fcn.1095380f

Function at 0x1096fdc0
Capabilities:
Encode data using base64

Disassembly:
lea edx, [ecx - 0x1ade2345]
mov edx, dword [esi + 4]
shr cl, cl
add cl, byte [esi + 8]
add esi, 6
shld ebp, edx, cl
call fcn.109649c8
inc ecx
mov esp, 0x4a2f0cb7
jmp 0x10981f79
inc si
movzx esp, byte [esi - 0x4a2f0cb7]
inc ecx
mov edx, 0x25a5ab08
inc esi
mov dl, byte [esi + edx - 0x25a5ab06]
push 0x5582192a
call fcn.10937ac4

Function at 0x1097160c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esi], edx
jmp 0x10980c58
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x10971d3b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
add esi, 4
jmp 0x10982496
inc esp
mov dword [esi], ebp
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x109727e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ebp
mov dword [esp], ebp
jmp 0x1098cf1e
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x10973b02
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not ebp
inc esp
or ecx, ebp
inc esp
mov dword [esi], ecx
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f
Function at 0x10974baa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esi]
mov edx, 0xa9857e8e
mov edx, dword [esi + 4]
add esi, 8
jmp 0x1099a784
call fcn.1094b505

Function at 0x109752dd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 8]
dec eax
add esi, 2
inc ecx
sal dl, cl
inc sp
mov dword [esi], edx
jmp 0x1095a6b2

Function at 0x10976a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x481c8380
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x10978f6c
Capabilities:
Encode data using base64

Disassembly:
inc sp
mov ebp, dword [esi]
dec eax
add esi, 2
mov ecx, 0xc489918d
dec ecx
sub ebx, 1
call fcn.1095c3f3
cmp eax, 0x11b76cc8
jbe 0x10978f95
add byte [eax], al
add al, ch
int 0x34
invalid
shld dword [esi + 0x4ab0c1f4], esi, 0x9c
mov ecx, 0xabdc65f1
test eax, 0xfb31efae
paddd mm4, qword [ecx]
adc esi, esi
mov edi, 0xe9d54cfd
inc eax
loope 0x10978f1e
pop ds
mov dword [0xe68f9a70], eax
push ebx
and dword [ebx + edx*4 + 0x49c5d80c], esi
xor ah, cl
mov eax, dword [0x48d3b411]
xchg esp, eax
std
cmp dword [eax + ebp*8 - 0xf], ebp
or eax, edi
clc
xchg edi, eax
js 0x10978fd4
mov edx, 0x77baf685
mov eax, dword [esi + edx - 0x77baf685]
sub edx, edx
neg edx
setne dl
adc dl, byte [edx + esi + 4]
add esi, 6
call fcn.1095b8d3
test esi, 0x3390fe83
nop
xor esp, dword [esi + 0x2b]
retf 0x66f5
sub ecx, edx
std
shr dword [ebx - 0xd], cl
jns 0x10978f68
xchg esi, esi
insd dword es:[edi], dx
jp 0x10978f92
shr ecx, cl
invalid

Function at 0x1097bfea
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x1097c1c7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f
dec esp
mov dword [esp], esi
dec esp
mov esi, dword [esi + 8]
dec eax
add esi, 0x10
dec ebp
mov dword [ecx], esi
jmp 0x1093d7cb

Function at 0x1097c6fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shr word [esp + 0xc], 0xa3
shr ebx, cl
jmp 0x109a0822
push 0xd9920a85
mov dword [esi], ebx
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x1097e327
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esi], ax
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x1097e389
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
adc esi, 0xc
inc ebp
mov dword [esp], ecx
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x1097e50d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x309ab4a9
inc esp
mov dword [esi], esi
dec eax
lea esp, [esp + 0x28]
jmp fcn.1095380f
inc ecx
not esi
jmp 0x10963a4f
Function at 0x10980e9a
Capabilities:
Encode data using xor

Disassembly:
jno 0x109a4d1a
mov eax, 0x723d8121
call 0x1095610c
movzx eax, byte [edi]
add edi, 1
jmp 0x10952cd9
mov edx, 0xe1b4c715
shr dx, 0x2b
xor al, bl
or edx, 0xa7980d86
adc al, 0xa9
neg al
call fcn.1094d852
call 0xfd4fce35
imul ebp, dword [ebp + 0x45b86535], 0xffffffb0
xor ebx, ecx
sbb eax, 0x55f07448
jb 0x10952d44
fdisi8087_nop
xchg esp, eax
xor al, 0xa5
sub eax, 0xd5835d5
invalid
cmpsb byte [esi], byte es:[edi]
and byte [edx], ch
add eax, 0x1523648e
invalid
outsd dx, dword [esi]
imul edx, dword [edi], 0xdc181a0c
les eax, [ebx]
mov eax, gs
sbb dword [ecx + 0x3ee0222], esi
inc esp
cwde
xor al, 0x22
add bh, dh
and eax, 0xf7919d1e
pop esi
pop ebx
pop esp
inc esi
js 0x10952d32
test eax, 0x222c01d
push cs
jge 0x10952dda
jae 0x10952d64
aad 0x25
test byte [eax - 0x23], ah
std
adc dword [ebx - 0x3fe3941d], ebp
dec ebx
ret
pop ds
mov ch, 0x3f
fmul st(1)
xor eax, ebx
xchg esp, eax
dec edi
xchg esp, eax
mov ah, 2
push cs
aam 0xb1
jl 0x10952e34
inc eax
xchg ebp, eax
mov edx, 0xf471fd4b
pop es
sbb byte [edi + 0x6a86696], al
mov ah, 2
outsb dx, byte [esi]
inc esp
cmp al, byte [ecx]
into
and dl, cl
insb byte es:[edi], dx
push ecx
movsd dword es:[edi], dword [esi]
test al, 0xec
jmp 0x10952e37
adc eax, 0xfe0d5ab9
or ecx, dword [eax + 0x40]
or eax, 0x40480bfe
and dl, byte [edi]
mov eax, dword [0xa9553cb8]
or byte [eax], dh
mov eax, dword [0x90cd298e]
sbb al, 0x79
popfd
cld
inc esp
movsd dword es:[edi], dword [esi]
retf 0xa94d
inc sp
mov dword [esi], ecx
dec eax
not dword [esp]
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f
movzx ebp, cl
mov bp, word [esi + ebp*8 - 0x196]
shl cl, 0x45
sal cx, 0xc1
jp 0x1099254a
inc ecx
mov ecx, 0x9418d680
dec edi
lea ecx, [ecx + ecx*2 + 0x32031327]
inc ecx
mov ecx, ecx
dec eax
mov ecx, dword [esi]
inc sp
movzx ecx, byte [ecx]
dec eax
add esi, 6
push 0x6f157821
jmp 0x10972a40
and al, 0xa5
lahf
mov dx, word [esi]
jmp 0x10979a4a
add esi, 6
call fcn.1095b012
jbe 0x10980e74
movsd dword es:[edi], dword [esi]
test byte [edi], bh
call 0xae2be750
in eax, 0x5d
xchg edi, eax
mov al, 0x59
stc
inc ebx
add eax, 0x89f7cc2d
xchg ecx, eax
sbb byte [ebx + 0x6d], 0xe5
aam 0xcf
xor byte [ecx], ch
fld dword [ebx + 0x5c]
test dword [0xf161c9cf], edx
sub esi, dword [esi - 0x2b]
sti
or edx, 0x29
int1
jmp edx
mov cl, byte [esi + 4]
jno 0x1094d834
invalid
sbb dword [edx + 0x7dc2e8cc], 0xd681fffe
add al, 0
add byte [eax], al
adc esi, 4
shld dx, bp, cl
call fcn.10946753
mov esp, 0xb48ab03e
push ecx
aam 0xc1
lea esi, [esi + 0x39d120c8]
jge 0x109a4d59
jge 0x109a4d12
push ebp
and byte [ecx], 0x9b
xor ch, byte [eax - 0x55df64e]
push ebp
aas
ret 0x39e8
mov dl, 0x93
adc bh, ch
and byte [edx - 0x6aa82e28], 0x8d
mov byte [edx], cl
and al, 0xa0
rcl ecx, 1
stosb byte es:[edi], al
inc byte cs:[esi + ebp - 0x2a1e122e]
jae 0x109a4d9b
pushfd
push ecx
daa
in al, dx
mov bh, 0xc6
add dword [0xda2e8715], 0x30a7086f
pop ss
ret
sub ch, al
cmp edx, 0x3e
imul ecx, dword [esp + ebx], 0xffffffa9
cli
imul ecx, dword ds:[esp + ebx], 0xffffffa9
fbstp tbyte [esi + 0x1bb09f0e]
xchg esi, esi
xor bl, byte [ebx - 0x59]
push cs
scasd eax, dword es:[edi]
add byte [edi], 0xe3
cli
jle 0x109a4d98
in al, 0x70
ret 0xd1bb
Function at 0x109849b8
Capabilities:
Encode data using base64

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.109381fb
call fcn.10963ccc
pop esi
pop esp
xor bh, byte [eax]
xor al, byte [edi + 0x345fb44e]
push ss
push cs
sub edi, dword [ebx + eax*8]
push cs
dec edx
mov ebx, 0x1092f7ce
adc dword [esi + edx + 0x440e3998], esi
test byte [eax], cl
jl 0x10984997
ret

Function at 0x10985b09
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x28]
jmp fcn.1095380f

Function at 0x10986188
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x10987d6d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, 0xc6b90189
mov edi, dword [esp + edi*2 + 0x728dfcf2]
call fcn.1095a3cc

Function at 0x109882a1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
add esi, 8
dec ecx
not esp
dec ecx
not edx
dec ebp
and esp, edx
dec eax
mov dword [esp], 0xb30a4b18
mov dword [esp + 2], 0xef096d81
dec esp
mov dword [esi], esp
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f
dec esp
mov edx, dword [esi + 8]
jmp 0x109583d5

Function at 0x109898ff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x20]
jmp fcn.1095380f

Function at 0x1098c908
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x1098cbde
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc sp
mov dword [esi], ecx
push 0xba84291f
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f
lea esp, [esp + 8]
call fcn.109381fb
inc cx
add ecx, 0x2a452404
leave
inc bp
movzx ecx, byte [edx]
push 0x1588ef35
dec eax
adc esi, 6
jmp 0x1095666f
Function at 0x1098e38f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esi, 4
call fcn.10979aa1

Function at 0x10990e75
Capabilities:
Encode data using base64

Disassembly:
push 0x4c37e298
lea esp, [esp + 4]
jmp fcn.1097b836
jmp 0x10937c30
je 0x10966dee
sbb esi, 2
call fcn.1094d6a3
test dword [edi + 0x33886399], edi
in eax, dx
sub bh, byte [esp + edx*2 - 0x61cb02f0]
sbb al, 0xc9
push 0x608a013d
mov eax, 0xf8658fd2
retf 0x7a1c

Function at 0x10991081
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
add esi, 0xa
jmp 0x109aab26
inc ecx
mov byte [edx], bl
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f
jmp 0x1099a744

Function at 0x10993425
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f
mov word [esi], dx
jmp 0x1097b673

Function at 0x10996ea1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esi + eax*4 - 0xb8]
dec eax
add esi, 4
dec eax
mov dword [esp], 0x7e01c093
and ebx, eax
not ebx
push 0xdb84a32a
push 0x481b358e
mov dword [esi], ebx
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x10997f5b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x75807e97
dec esp
mov dword [esi], ecx
dec eax
mov dword [esp + 8], 0x12bda0bd
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x10998017
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not ecx
inc esp
and edx, ecx
push 0x8d8dfb39
inc esp
mov dword [esi], edx
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x109982e1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x10999988
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
add esi, 6
jmp 0x10950239

Function at 0x10999bb7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
adc esi, 4
inc sp
shld ebp, esp, cl
dec eax
not dword [esp + 8]
mov word [esi], bp
push 0xd1b9060a
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x1099a789
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc cx
add ecx, edi
mov word [esi], cx
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f
jmp 0x10987d7e

Function at 0x1099c9d3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x90aa9429
dec eax
lea esp, [esp + 0x30]
jmp fcn.1095380f

Function at 0x1099d1b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec esp
mov dword [esi], ebp
push 0x37a02ea6
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f

Function at 0x1099d40c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
add esi, 6
dec eax
mov dword [esp], 0xfc1a8889
inc ebp
shrd esi, edx, cl
inc esp
mov dword [esi], esi
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x109a030f
Capabilities:
Encode data using base64

Disassembly:
sal al, cl
not dword [esp]
mov word [esi], ax
lea esp, [esp + 4]
jmp fcn.1098aaf4
jp 0x109a2964
push 0x6b881130
neg edx
sar word [esp + 8], 0x4b
jns 0x10970869
mov eax, 0xb6bcbfb4
and eax, eax
movzx ax, byte [esi]
mov ecx, 0xff9de316
mov cl, byte [esi + 2]
push 0x4a39e512
adc esi, 2
jmp 0x10963a6b
rol edx, 3
xor ebx, edx
sub esi, 4
mov dword [esi], edx
lea esp, [esp + 0xc]
jmp fcn.10996e95
Function at 0x109a05f2
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xe115a690
call fcn.109381fb

Function at 0x109a05ff
Capabilities:
Encode data using base64

Disassembly:
mov dx, word [esi + edx - 0x6b0a2f1f]
push 0xd20d6685
add esi, 6
call fcn.109581c8

Function at 0x109a1b34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x109a1d4b
Capabilities:
Encode data using base64

Disassembly:
neg cl
not cl
add cl, 0xa0
mov dword [esp], 0x3e9d4a82
shr dword [esp + 4], 0x50
xor cl, 0x20
call int.10970398

Function at 0x109a3926
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xe32a2093
not dx
inc sp
and esp, edx
inc sp
mov dword [esi], esp
dec eax
lea esp, [esp + 0x18]
jmp fcn.1095380f
mov dx, word [esi + 2]
dec eax
add esi, 2
inc cx
not esp
jmp 0x1094f53a

Function at 0x109a3ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x20]
jmp fcn.1095380f

Function at 0x109a598b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.109593eb
dec esp
mov edi, dword [esi]
mov ebp, 0xf0a93c0a
inc ecx
mov ebp, dword [edi]
jmp 0x10966e7f

Function at 0x109a59ef
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f

Function at 0x109a646f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
rol ch, 1
inc ecx
add ch, 0xa7
inc ecx
not ch
inc ecx
dec ch
jmp 0x109a646a
inc ecx
add ch, 0xa0
push 0xcfbde40a
jmp 0x109a7280
call fcn.10983376
mov ecx, 0xd5226b94
add cl, ch
dec eax
mov edx, dword [esi]
seto cl
mov ecx, dword [esi + 8]
push 0x9ba97121
dec eax
adc esi, 0xc
jmp 0x109a4468
inc ecx
xor ch, 0x97
jmp 0x10984339

Function at 0x109a6f58
Capabilities:
Execute syscall

Disassembly:
sbb esi, 2
call fcn.1099a3bb

Function at 0x109a7bfc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec esp
mov dword [esi], ecx
dec eax
lea esp, [esp + 8]
jmp fcn.1095380f
dec ecx
shl ecx, cl
jmp 0x1096b9db

Function at 0x109a7c04
Capabilities:
Encode data using base64

Disassembly:
call fcn.109518f1
dec ebp
shrd ecx, esi, cl
push 0x25874995
call fcn.109a6490
mov eax, 0xab91b902
lea eax, [eax*4 + 0x1b87a91e]
mov eax, dword [esi]
mov ebp, 0xdf2f6c36
mov ebp, dword [eax]
jmp 0x109a8dae
jmp 0x10937da2

Function at 0x109ab471
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f

Function at 0x109ae57a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lea esp, [esp + 0x10]
jmp fcn.1095380f