joyce8/EMBER2024-capa huggingface dataset:
Function at 0x150f4f3
Capabilities:
Encode data using base64

Disassembly:
inc cx
dec esi
dec ecx
sal edi, 0xdf
inc ecx
push ebx
xor dword [esp + edx - 0x64b917ba], ebx
inc bp
xor edx, eax
inc ecx
pop ebx
inc cx
cmovle ebp, eax
dec eax
arpl bx, bx
dec esp
adc ebp, ebx
dec eax
mov ecx, dword [edx + esi - 0x64b917ba]
inc esp
mov dl, byte [ecx + edx - 0x64b917ba]
dec esp
lea ecx, [edx + 0x6414203a]
inc ecx
and al, cl
inc esp
movsx esp, ax
dec eax
lea esi, [edx + esi - 0x64b917b4]
inc ebp
xchg ah, al
dec ecx
lea ebx, [esp + ebp + 0x399e0927]
inc ecx
ror edi, 0x5d
inc bp
mov dword [edi + esi], edx
dec ebp
xor edi, ebp
inc ecx
jmp edi
dec esp
lea esi, [ebx*8 - 0x50e29061]
dec esp
add ebp, ebp
inc ecx
neg bh
sub bx, bx
btr eax, 0xae
inc ecx
jmp ebp
inc cx
sar eax, 0xc
ror eax, 1
dec ecx
shr edx, 0xab
jnp 0x14fc241
dec esi
mov dword [esp + edx*4], ebx
inc ecx
movsx ebp, dl
sub dl, 0x11
dec ecx
btr ecx, 0x9e
inc edx
xor dword [esp + edx*4], eax
inc ebp
xadd ecx, esi
dec ecx
shl ecx, 0x1a
inc ecx
pop ebx
jnp 0xcc4c96
bts cx, 0x20
inc cx
adc edx, edi
dec eax
ror ecx, cl
dec edx
neg dword [esp + esi*2 - 0x2e8]
rol dx, 1
inc ecx
pop ecx
inc cx
neg esp
inc cx
sbb edx, eax
dec edx
rol dword [esp + esi - 0x170], 0x98
dec edi
lea esp, [edx + eax - 0x76cdb247]
neg dx
inc esp
movzx ecx, byte [esp + ebp - 0x5d392170]
inc sp
xor ebx, edx
btr eax, 0x36
inc cx
rol edx, 0x4a
dec eax
lea edx, [esp + edx + 0x18]
mov eax, dword [edx + ebp - 0x5d392184]
inc ecx
movzx ebx, al
dec edx
lea ebp, [ebp + edx*2 - 0x7d5d20e5]
inc ecx
shr al, 0xe4
inc edx
mov dword [esi + esi*2 - 0x308], eax
inc ecx
rol dh, 0x66
inc ecx
ror bh, 0x87
dec edx
lea esi, [esi + esi*4 - 0x488]
inc eax
or ch, 0x1d
pop eax
inc ecx
pop esp
inc ecx
pop esp
js fcn.00cc0ab0
inc ebp
add al, cl
inc ecx
mov eax, dword [edx + edi - 0x50b41abb]
inc edx
mov ebx, dword [esp + edx - 0x50b41abb]
jl 0xd3eff3
inc ebp
bts ecx, edi
dec edx
lea edi, [edi + edx - 0x50b41ab7]
inc ecx
btr eax, 0xb6
inc ecx
xor eax, ebx
inc cx
btr edi, ebx
inc eax
inc esi
movsx esi, byte [esp + edx - 0x50b41ab9]
not eax
dec eax
bswap eax
inc ecx
ror cl, 0xc4
inc ecx
sbb eax, ecx
jmp 0xd7e73d
Function at 0x150fdda
Capabilities:
Encode data using xor

Disassembly:
inc cx
xor esi, 0xbc41e1ad
pop ds
xor eax, dword ds:[ebx]
inc cx
dec esi
inc bp
xor ebx, esi
inc ecx
mov eax, eax
inc ecx
ror edi, cl
dec eax
xadd ecx, edx
dec esp
adc esi, esp
dec ebx
mov dword [esi + edx - 0x8944314], ebp
inc ecx
movzx ebp, bh
sal dx, 0x2f
inc edx
mov ebp, dword [edi + edx - 0x8944312]
inc ecx
dec eax
inc ecx
xor ebp, ebx
inc ebp
movzx ecx, al
inc ecx
xor esp, 0x4497bc96
dec ebp
inc cx
sal ecx, cl
ror ebp, 3
dec eax
ror eax, 0xbd
inc bp
sub edx, edx
inc ebp
movzx esi, bh
bswap ebp
ror ebp, 1
dec ecx
sar ecx, cl
inc ecx
dec dl
inc ecx
imul esp
inc ecx
lea ebp, [edx + ebp - 0x21b27eb9]
dec eax
and ecx, ecx
not ecx
not ebp
rol ebp, 3
dec ecx
ror edi, 0x8a
bswap ebp
dec ecx
imul esi
dec ecx
sar esi, cl
xor ebp, 0x8824688e
inc ecx
push ebx
inc edx
xor dword [esp + edx*2 - 0x112801fe], ebp
inc ecx
mov ebx, esp
inc ecx
dec ecx
inc ecx
pop ebx
dec eax
arpl bp, bp
dec esp
add ebp, ebp
dec ecx
neg esi
inc si
adc esi, dword [edi + edx - 0x89400f9]
inc ecx
shl esp, cl
dec edx
lea edi, [edi + edx*2 - 0x112801f6]
dec ecx
imul ecx
jb 0xd3e03d
invalid
mov dword [esp + edx*8], 0x833e2218
add eax, 0xcaa86c25
adc cl, 0x3b
lea edx, [edx*8 + 0x23b51f00]
xor cl, 0x8f
add dl, al
inc cl
xor dx, dx
push eax
call fcn.015aaa16
dec eax
mov ebp, dword [esi]
inc ecx
mov edx, 0x8944314
inc ebp
movzx esi, word [edx + edi - 0x8944314]
inc ecx
movsx edx, dl
inc ecx
movsx ecx, dl
inc bp
xor esi, ebx
inc esp
movsx eax, dl
inc cx
dec esi
inc cx
neg esi
inc ebp
mov edi, edx
jmp 0x15451ce
inc cx
dec esi
inc esp
or bh, cl
dec esp
lea eax, [ecx*8 + 0x752aff3f]
jae 0xd5413e
mov ebp, 0xdc8952b8
dec eax
btr ebp, 0xb2
dec esp
mov edi, dword [esi]
inc cx
mov ebx, dword [edi]
inc esp
movzx esi, bp
inc ebp
movsx edx, si
dec edx
lea esi, [esi + esi*2 - 0xa56a]
dec eax
not ebp
inc ecx
sub ebp, esi
dec edi
lea edi, [edx + esi*4 + 0xbaf898d]
mov word [esi + ebp - 0x23765a8f], bx
inc esp
mov edx, dword [ebp + edi - 0x23765a8f]
inc ecx
movsx eax, bh
dec eax
lea edi, [edi + ebp - 0x23765a8b]
inc ebp
xor edx, ebx
inc ebp
lea edx, [edx + ebp*4 + 0x1ee17251]
inc ecx
ror edx, 1
dec esp
add esi, ebp
push ebp
pop eax
inc ecx
neg edx
inc ecx
movsx ecx, di
inc ebp
lea edx, [edx + ecx - 0x74b41236]
call fcn.00ccc5e9
xor dh, cl
sbb edi, dword [edi + edi*2 + 0x5d951b1e]
add eax, 0x7b010b7
scasb al, byte es:[edi]
jb 0x1545258
pop eax
inc ebx
adc esi, dword [edx - 0x11]
pop esp
stosd dword es:[edi], eax
ret
Function at 0x15401aa
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
adc eax, esp
mov dword [eax + ecx - 0x201], edx
lea eax, [ecx*4 - 0x6569e54d]
movzx edx, cx
shr edx, 0x3e
or edx, edi
jmp edx
mov dword [esp + ecx*2 - 2], ecx
or dword [esp + ecx*8 - 8], ecx
xor al, 4
pop ecx
rol cx, 0x89
jb fcn.01554b95
not al
rol ecx, 0x64
xor bl, al
ror cx, 4
setae cl
jae 0xd7d1ad
push ecx
inc esp
mov edi, dword [ebx + esi - 0xf02e]
shl bx, 0x6d
dec ecx
mul esi
cdq
inc esi
mov edx, dword [esi + eax - 0x4976]
dec ecx
adc eax, 0xe9b3c786
call fcn.0157c7ce
xlatb
dec esi
sub ch, bl
jno 0x1540270
imul ecx, dword [ebx], 0xffffff97
retf 0xef28
sar cx, cl
dec eax
rol eax, 1
lea eax, [eax + ecx - 0x621469eb]
shl ecx, 0x3a
bts ecx, ecx
lea ecx, [ecx - 0xbfe8a48]
ror eax, 1
push ecx
xor ebx, eax
sar ecx, 0x79
shl dword [esp], 0x8a
adc edi, eax
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
shl dword [esp], 9
imul ecx
push 0xf5a3b682
mov ecx, 0x50957113
mov dword [ebp + ecx - 0x50957113], edx
shr dword [esp + ecx - 0x50957112], cl
rol cx, 0x26
mov dword [ebp + ecx - 0x509544d8], eax
mov dword [esp + ecx - 0x509544dc], edi
ret 4

Function at 0x1540454
Capabilities:
Encode data using base64

Disassembly:
not eax
sbb eax, 0x843a242d
ror ecx, 0xd3
call fcn.01539d55
dec esp
mov dword [ebx + esi - 0x37], ecx
dec eax
lea eax, [ecx*8 - 0x437f5357]
call fcn.0158f4f4

Function at 0x1544859
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [esi*4 + 0x157bae0]
push 0x5a16039c
push 0xea217b22
xor dword [esp], 0xde9fd79f
shr edx, 8
dec dword [esp + 4]
jg 0xd68076
mov al, 0x4b
out 0xac, eax
out dx, al
test eax, 0x55cc222f
adc ebx, dword [ecx + 0x55cc76ef]
adc ebp, edx
xchg edi, eax
dec esi
int3

Function at 0x15493ae
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax + ebp*8 + 0x4025ab56]
inc bp
or esi, edi
call fcn.015b8266
xor eax, 0xa13a1013
inc edx
lea eax, [eax + esi*2 - 0x375ffb27]
dec edx
mov dword [esp - 0x260cb98a], 0x6f13c180
neg eax
dec ecx
dec ecx
rol esi, 0xfa
seta byte [esp + edx - 0x23]
dec eax
inc ebx
dec ebp
lea ecx, [esp + 0x113b2f01]
xor eax, 0x3b039381
inc esi
xor al, byte [esp - 0x260cb97b]
rol cl, 0x83
jae 0xd9c0a0
Function at 0x15540c7
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0x2cc5e8e6
ficomp word [ebp + 0x62]
or eax, 0x8b1f1a0d
adc cl, byte [ebp + 0x1d]
cmp dword [0x1e98ec5e], 0x55
xor ebx, dword [edx]
cmp ebx, dword [edx]
sbb dword [edx + 4], esi
pop ss
stosb byte es:[edi], al
salc
mov ch, 0x3a
or edx, dword [edi]
xchg ecx, eax
dec edx
call 0x445603cd
sbb dl, byte [edi]
loop 0x15540d9
cmpsd dword [esi], dword es:[edi]
insd dword es:[edi], dx
stosb byte es:[edi], al
test dword [edx - 0xa091701], 0xee640e27
div ch
daa
push cs
out dx, al
loope 0x155407f
xor dl, byte [ecx + 0x746e9923]
mov eax, dword [0xd4ba5e41]
inc ecx
pop esi
mov edx, 0x632db6d4
mov esi, 0x509f7ae5
inc ecx
pop esi
mov edx, 0x632db6d4
mov esi, 0x509f7ae5
sbb eax, ebx
mov esi, 0x3a1a4a08
xor edx, dword [ecx + 0x1f]
cmp dh, byte [ebx]
push ecx
pop ds
test eax, 0xed339667
aam 0xf
dec ebx
push edi
cld
push ss
ficom word [ecx + 0x2965a42d]
push edi
mov esp, 0x76e056dc
push edi
sub ebp, eax
mov dh, 0xb0
or byte [esi + 0x7a376735], dl
movsb byte es:[edi], byte [esi]
mov al, byte [0x84e7c3ea]
add al, byte [ebp + 0x12c88018]
std
cmp eax, 0x84d2511c
xor byte [ebx], 0x21
or al, 0xf1
inc edx
adc al, 0x7f
clc
test al, 0x7c
out 0x40, al
jo 0x15540b8
or dword [ecx], 0x545c2a09
std
xchg byte [ecx], al
or eax, 0x646a52f
adc bl, byte [eax + 0x4cf19a2]
sbb byte [eax + 0x3c2582ea], bh
sbb cl, cl
add al, dl
out 0x41, al
mov al, 0xd7
cmp eax, 0xc1f4969b
pushal
sti
out 6, eax
pop edi
int1
sub dword [ecx - 0x15], esi
jae 0x15541c8
pushal
or eax, 0xffffff9c
add dl, byte [edx]
das
adc ch, byte [edi]
mov al, byte [0x6c60e975]
int1
sbb eax, 0xdae2029b
pop edi
int1
sub dword [ecx + 0x14], esi
xchg ebx, esp
jns 0x1554196
sub eax, 0xb5b0a5a1
xor bh, byte [edx]
fcmove st(0), st(1)
lodsd eax, dword [esi]
or dword [0xd247a52f], 0xffffffbe
scasd eax, dword es:[edi]
jno 0x1554105
jp 0x1554157
mov dl, 0xa3
mov edi, 0x313a0760
sub al, 0x1f
enter 0x7d78, 0x4c
hlt
ljmp 0x52fb:0x40e3319d
lahf
rol dword [ecx + 0x2a], cl
and esp, edx
invalid

Function at 0x1554343
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov cl, byte [esi + esi - 0xaf]
dec ecx
rol esp, 0x65
inc dx
xor dword [esp + esi - 0x9d], edx
dec edx
lea esi, [esi + esi*2 - 0x162]
inc cx
bts ecx, ebx
dec esi
mov dword [esp + esi*2 - 0x146], ecx
inc cx
shld edi, ebp, cl
inc ecx
mov edx, 0x6bae9286
call fcn.0153ff31
Function at 0x1554b95
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
pop ecx
mov ecx, dword [ebp + 8]
shr dword [esp + 4], 0x5c
adc ebp, 3
push 0x93925b36
push 0xfd926694
push 0x59019798
div ecx
neg byte [esp + 8]
setbe byte [esp + 9]
js 0x159a5d2
inc ecx
mov eax, 0xe40312bd
inc ebp
movsx esi, al
dec esi
lea esp, [eax*2 - 0x3e616cce]
movzx ax, byte [esi]
inc ecx
mov ebp, esi
call fcn.00ce3046
inc ecx
mov eax, 0xf52ccb3d
inc esp
mov edx, dword [edi]
dec eax
add edi, 4
inc ebp
movsx esp, al
inc ebp
xor edx, ebx
inc ecx
movsx ebx, sp
inc ecx
ror edx, 1
inc ecx
movsx ecx, al
inc edi
lea edx, [edx + 0x4c94c913]
inc ecx
rol edx, 1
inc ecx
neg edx
inc ebp
movzx edi, al
mov ebp, ecx
inc sp
bt ebx, edi
inc ecx
push ebx
inc ecx
movsx eax, al
inc esi
xor dword [esp - 0x3d], edx
inc ecx
pop ebx
push ebx
inc ecx
mov esi, 0x7185f82b
dec ebp
arpl dx, dx
dec ebp
add ebp, edx
cdq
add dx, word [ebx + esi - 0x3d]
dec edx
lea esi, [esi - 0x3b]
inc si
mov edi, dword [edi - 0x3d]
jmp 0x15175ec

Function at 0x155a837
Capabilities:
Encode data using base64

Disassembly:
inc esp
movsx eax, bp
inc ecx
ror edi, 3
inc ecx
movsx ebx, ah
call fcn.00d92e5e
Function at 0x156261b
Capabilities:
Encode data using base64

Disassembly:
dec byte [esp + edx*2 + 3]
not dx
lea eax, [edx + eax + 0x13b35b9f]
btr ecx, ecx
jb 0x15992bc
jae 0xd878f3
movzx eax, byte [esp + edx*2]
xor eax, dword [edx + esi]
shl word [esp + edx*2 + 2], 0x86
or word [esp + edx*2 + 2], dx
not byte [esp + edx*2 + 3]
xor eax, ebx
jmp 0xd3e70e
bswap eax
inc dl
or dword [esp + edx*2 - 0x1fe00], ecx
js 0xd8b8b2
dec eax
ror eax, 1
imul dx, cx
shl dl, 0xc4
xor ebx, eax
add edi, eax
sar edx, cl
push edx
imul cx, word [esp + edx*2 + 3]
or dword [esp + edx*8], edi
ret 4
lea eax, [eax + edx - 0x609ba1d5]
btr edx, edx
lea ecx, [edx + edx*8 + 0x1395cb01]
bswap eax
ror eax, 3
imul ecx, edx
ror ecx, cl
imul edx, ecx
not eax
lea edx, [ecx*2 - 0x54e3d354]
xor eax, 0x49034db8
ror edx, 0x36
rol eax, 2
xor ebx, eax
add edi, eax
add ecx, edx
or cl, 0x30
lea eax, [edx + edx + 0x710bd533]
mov eax, dword [ebp + ecx - 0x33cfed30]
bt ecx, edx
mov ecx, dword [eax + ecx - 0x33cfed30]
movzx eax, dx
mov dword [eax + ebp - 0x2292], ecx
movzx ecx, dx
shl ecx, cl
jmp edi
dec eax
rol ebp, cl
dec ebp
adc ebp, ecx
dec eax
mov edx, dword [esi + eax*4 + 0x66d22fc8]
inc esp
mov ah, byte [esi + eax*2 + 0x336917ec]
dec esp
lea edi, [eax*4 - 0x2f4fd75f]
inc cx
add edx, 0x416678a2
sbb edi, 0x8d4ad13b
mov ah, 6
cli
ret 0xffff
sal al, 0x42
or dx, cx
and al, ah
not dx
mov word [ebp + eax - 0xe0c0600], dx
pop edx
mov edx, dword [eax + esi - 0xe0c0605]
lea esi, [eax + esi - 0xe0c0605]
mov ecx, eax
xor edx, ebx
rol eax, 0xc5
rol ax, 0x2b
inc cl
not edx
lea edx, [edx + ecx*2 - 0x6ea2800c]
not edx
bswap edx
xor ebx, edx
inc eax
add edi, edx
shl ax, cl
call fcn.01576181
lea eax, [esp + eax + 4]
sar edx, 0x14
mov dword [esp + edx*2], edx
sbb edx, edx
mov byte [edx + eax], cl
and byte [esp + edx*2 + 3], 0x20
lea ecx, [edx + edx*2 + 0x74850411]
add byte [esp + edx*2 + 1], 9
lea esi, [edx + esi - 4]
jge 0xd770a3
mov ecx, 0x400056a5
dec esp
lea esp, [ecx*4 + 0x680b5b0d]
inc bp
imul esp, esp
inc esp
mov ecx, dword [edi + ecx - 0x400056a5]
mov eax, ecx
movzx ebp, cl
inc ecx
sbb ecx, esp
dec eax
lea edi, [edi + ebp - 0xa1]
inc esp
movzx esi, cl
bt bp, ax
inc ebp
xor ecx, ebx
cdq
inc esi
lea ecx, [eax + ecx - 0x2ec57a22]
inc ebp
movsx eax, sp
sub eax, 0x59b4e293
dec eax
btr ecx, edx
inc ecx
xor ecx, 0x7da66bb9
inc ecx
rol esi, cl
dec esi
lea edx, [eax*4 + 0x1174786]
bt cx, 0xb0
inc ecx
rol ecx, 1
inc ecx
rol eax, cl
dec ecx
ror esi, cl
inc ecx
sbb al, al
inc ebp
lea ecx, [ecx + ecx - 0x6a665a53]
inc ebp
bt esi, esp
inc ecx
push ebx
dec eax
cwde
btc dx, ax
sal bp, 0x47
inc esp
xor dword [esp + eax*2 + 0x336917e4], ecx
inc ecx
movsx ebx, sp
inc ecx
pop ebx
dec ebp
arpl cx, cx
inc ecx
rol al, cl
jae 0x15475b3
mov edx, 0x97b2c18b
jmp 0x151dbef
Function at 0x157128c
Capabilities:
Encode data using base64

Disassembly:
and eax, ecx
pop ecx
movzx ecx, dx
mov dword [ebp + edx*2 + 4], eax
lea eax, [edx + edx*2 + 0x2589901f]
cdq
lea ecx, [eax*8 - 0x2afe4eeb]
mov eax, dword [esi + edx*8 - 4]
lea esi, [edx + esi - 4]
shr cl, 0xc6
or edx, 0x20b8131c
bts ecx, 0x20
xor eax, ebx
add ecx, ecx
btc ecx, ecx
lea eax, [edx + eax + 0xf6b6ae5]
dec edx
xor eax, 0x559c0e8c
neg eax
not cl
dec eax
btr dx, cx
add cx, cx
xor ebx, eax
rol ecx, cl
shl ecx, cl
adc edi, eax
bts edx, 0xbc
btr ecx, 0x95
mov eax, 0x3d0a5a3f
mov ecx, dword [ebp + edx - 0x30b81117]
adc eax, edx
neg edx
mov edx, dword [eax + ebp - 0x6dc26b52]
not ecx
not edx
ror eax, 0x5e
xor al, ah
or ecx, edx
movsx edx, ax
xor dx, ax
mov dword [ebp + 8], ecx
jns 0x1574125
mov edx, 0xc0332a9
dec eax
lea ecx, [edx*2 - 0x42d238dc]
call fcn.014f782d

Function at 0x157c5b4
Capabilities:
Encode data using base64

Disassembly:
inc esp
mov byte [ebp + edx*2], ah
inc ecx
pop eax
inc ecx
pop esp
inc cx
shr esp, 0x42
mov ecx, dword [edi + edx*2]
ja 0x1579fed
dec ecx
lea eax, [esp + edx*4 + 0x668d6f83]
dec eax
lea edi, [edi + edx*2 + 4]
inc ebp
movzx eax, sp
inc ecx
xor ecx, ebx
ror ecx, 1
lea ecx, [ecx + edx + 0x4c94c98d]
rol ecx, 1
dec eax
bts edx, 0x31
inc ecx
mov ebx, esp
inc ecx
btc esi, 0x28
neg ecx
inc ebp
add bh, bh
inc ecx
push ebx
ror bx, 0xcc
sar eax, 0xf5
inc edx
xor dword [esp + esi - 0x100], ecx
inc cx
xor esp, 0xc1418d8e
hlt
Function at 0x157ca51
Capabilities:
Encode data using base64

Disassembly:
lea eax, [edx*4 - 0x20ca60e1]
jmp edi
dec esp
adc ebp, eax
dec eax
btr ebx, 0x1d
dec esp
mov edi, esi
inc ecx
pop esp
inc ecx
inc dh
dec eax
lea esi, [esi + ebx - 0x4858e6f7]
dec esp
mov dword [esi + ebp + 0x6858e6f0], edi
dec eax
bt ecx, ecx
inc bp
add ecx, edx
ja 0xcd18af
jp fcn.00cc0ab0
inc ecx
pop ebx
dec eax
arpl dx, dx
idiv bl
dec esp
lea esi, [eax*2 - 0x4e60544e]
sal ebx, 0xb4
dec esp
add ebp, edx
inc cx
xor esi, 0xf443929
mov edi, 0x5799bac8
adc dl, bl
movzx eax, byte [ebx + edi - 0x73600000]
dec eax
bts edx, 0x12
inc cx
rol ecx, 0xc6
inc cx
ror ecx, 0xc1
dec eax
lea edi, [ebx + edi - 0x735fffff]
inc ecx
seto dl
jb 0x158a14a
inc ecx
mov esp, 0x603997be
inc ecx
dec esp
inc edx
mov eax, dword [edi - 0x603997bd]
dec ecx
lea edi, [esp + edi - 0x603997b9]
dec edi
lea edx, [esp - 0x35cf3151]
inc ebp
and esp, esp
inc ecx
xor eax, ebx
inc ecx
movzx ebp, dl
inc esp
movsx ecx, bp
inc eax
sar ch, 0x87
neg eax
inc ecx
movzx ebx, dx
inc eax
dec ebp
lea esi, [edx - 0x654ba1f7]
bswap eax
inc ecx
push esi
dec edx
sal dword [esp - 0x603997bd], 0x8b
dec eax
mov dword [esp + ebp], 0x5f977f83
not eax
inc ecx
setb ah
inc eax
inc ecx
movsx ecx, dx
xor eax, 0x1b341c20
inc esp
mov edi, ecx
dec edx
lea ebx, [esi*8 + 0x29949cb1]
inc ecx
rol esi, 0x6d
ror eax, 1
dec edx
sal dword [esp + ecx*2 - 0x52], 0xb8
dec eax
sal ecx, cl
ror byte [esp + ebp + 3], 0x67
dec esi
mov dword [esp - 0x60399700], ebx
dec ecx
bts esi, ebp
call fcn.00d5adbd
mov eax, 0x3c9b3b00
push eax
mov ecx, eax
lea esi, [eax + esi - 0x3c9b3b04]
mov eax, dword [esi + eax*2 - 0x79367600]
movzx edx, cl
or dl, byte [esp + edx]
xor eax, ebx
bswap edx
add word [esp + edx + 2], cx
not eax
shr edx, 0xb4
add edx, 0x89141a37
rol cl, 7
ror eax, 1
lea eax, [eax + ecx + 0x20177c25]
inc cx
neg eax
lea edx, [edx + ecx*2 + 0x1586539d]
push ecx
ror edx, cl
xor ebx, eax
xor dword [esp + ecx - 0x3c9b3afd], ecx
adc edi, eax
mov eax, dword [ebp + ecx*2 - 0x79367602]
mov ecx, dword [edx + ebp - 0xbe871e7]
mov dword [esp + edx*2 - 0x17d0e3d2], ebx
cpuid
not dword [esp]
sub ebp, 8
ror dword [esp], 0x10
jae 0xd958f1
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
sbb eax, dword [esp]
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ecx
cwde
mov dword [ebp], edx
mov ebx, dword [esp + 4]
pop ecx
pop edx
js fcn.015b9a99
dec eax
sar ecx, 0x91
inc ecx
xor al, bl
inc cx
shr edi, 3
sbb al, bl
inc bp
btc ecx, eax
mov ebp, ebx
rol al, 1
neg al
inc cx
sal edi, cl
xor al, 0xbd
dec ecx
dec eax
inc esp
xor bl, al
dec eax
lea esi, [esi + ecx*2 - 0x3de]
inc bp
btc esi, edx
mov word [esi + ecx*2 - 0x3dc], ax
jb fcn.00cc0ab0
Function at 0x1585c17
Capabilities:
Encode data using base64

Disassembly:
dec eax
sar ecx, cl
lea edx, [edx + ecx*4 + 0x259dbf13]
neg edx
call fcn.00d98fb7
add ecx, 0xe52b5f2b
call fcn.00ccc499
inc ecx
mov esp, 0xb8247a17
inc ebp
movsx esi, sp
inc esi
mov eax, dword [edi + esi - 0x7a17]
dec ebx
lea edx, [esi + esi + 0x38345e8b]
dec edx
lea edi, [edi + esi*4 - 0x1e858]
inc ebp
xor eax, ebx
inc ebp
movsx edi, sp
inc ecx
bswap eax
inc cx
bt esp, 0x95
inc ecx
ror eax, 3
inc ecx
movsx ecx, sp
call fcn.00d827b1
mov eax, 0x51163e98
rol eax, 0x6d
mov edx, eax
mov eax, dword [ebp]
btr dx, dx
and edx, edx
jae 0x15b9bed

Function at 0x1587012
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xor ecx, ebx
rol ecx, 3
inc edx
lea ecx, [ecx + eax - 0x76a8a980]
dec esi
mov dword [esp + edx*8 - 0x19d18], eax
inc esi
xchg byte [esp + edx - 0x33a3], dl
inc edx
xor dword [esp + edx - 0x339f], ebp
rol ecx, 3
dec esi
lea esi, [edx + eax*8 - 0xed4a5f]
inc edx
lea ecx, [ecx + eax - 0x6dbbb17b]
dec dx
inc edx
setl byte [esp + edx*2 - 0x6746]
dec esi
mov dword [esp + edx - 0x33a3], ebx
dec esp
mov edx, dword [esi]
inc ecx
mov edx, eax
dec ebp
mov esp, dword [edx]
inc esp
movzx edx, dx
inc ecx
movzx ebp, dl
dec esi
mov dword [esi + edx*2 - 0x6746], esp
inc edx
mov ecx, dword [edi + edx - 0x33a3]
dec eax
bt ebp, 0x85
dec edx
lea edi, [edi + edx*4 - 0xce88]
jb 0xd46d53
mov edx, 0xb23085ab
xor dl, dl
inc esp
mov eax, edx
dec eax
mov esp, esi
inc ecx
pop ebp
inc ecx
pop eax
dec esp
lea edi, [edx + edx*8 + 0x36aa7db7]
inc ecx
pop edx
dec edi
lea ebx, [edi + edi - 0x64f3c54e]
inc bp
xchg edi, ebx
inc ecx
movzx ecx, bx
inc ecx
pop ecx
inc ecx
sets bl
inc ecx
mov edi, edi
call fcn.00d759cb

Function at 0x159665b
Capabilities:
Encode data using base64

Disassembly:
rol ebx, 1
dec ebp
lea edi, [edi - 0x1ac0026b]
bswap ebx
dec eax
mov dword [esp], 0x98367c9b
lea ebx, [ebx + eax - 0xd4f5ee8]
dec esp
mov dword [esp], ebx
inc esp
sub al, al
dec ebp
lea esi, [edi + ebp*4 - 0x65cdd2dd]
xor dword [esp], ebx
inc ecx
pop ebx
sub ebp, 0x30ab7004
dec eax
arpl bx, bx
jno 0x15b8ac6
Function at 0x15ac08b
Capabilities:
Encode data using base64

Disassembly:
inc dword [esp + edx - 0x10b9f00]
xor ax, bx
xor ax, 0xb1a4
rol word [esp + edx - 0x10b9eff], cl
shl ecx, 0xea
inc ax
not ax
xor dword [esp + edx*2 - 0x2173e00], ecx
neg dl
rol ecx, 0xa9
adc ax, 0xa22b
jmp fcn.0155a0a4
dec ecx
and ebx, esp
dec eax
lea edi, [edi + ebp*4 - 0x200c7]
shl bl, 0x63
jne 0x151866a
inc ebp
xor bh, bl
inc ecx
xchg cl, bl
inc ecx
ror esp, cl
jae 0x1559d00
aad 0x4c
xor esp, ebp
bound ebx, qword [ebp + 0x4b]
pop es
mov byte [0x9be127cf], al
mov al, 0xde
or dh, byte [eax + 0x54dd8d10]
mov ebp, 0xe08589a8
call fcn.0151a10a
dec esi
mov dword [esp + edi - 0x74b3e533], ebx
inc esp
xor dword [esp + ebp*2 - 0x10066], eax
inc ecx
movzx eax, cx
inc ebp
movsx ebx, si
inc esp
movzx esp, ch
inc ecx
pop ebx
inc esp
movzx edx, al
inc cx
rol edx, 0xeb
inc ecx
movzx ecx, dl
dec ebp
arpl ax, ax
inc cx
inc ecx
inc ecx
movsx ebx, sp
dec ebp
add ebp, eax
cbw
xadd ecx, ebx
dec ecx
and esi, 0x2a3c2809
inc esp
movzx edi, byte [edi + ebp*4 - 0x200c8]
jge 0x150427a
xlatb
inc edi
xor edi, ecx
jns 0x157e7eb
pop esp
das
mov byte [0x95e936d2], al
xchg esi, eax
iretd
inc ebp
movzx ecx, bh
dec edx
mov dword [esp + edi - 0x74b3e533], 0x9c19461d
inc ecx
bswap eax
dec ebp
bts ecx, ecx
inc ecx
push ecx
inc ecx
not eax
inc ecx
push edi
inc ecx
dec eax
pop ebp
pop ebp
dec esp
lea esi, [ebp + 0x718a0b0]
inc ecx
bswap eax
inc edx
inc byte [esp + edi - 0x74b3e532]
bts ebp, 0x8f
jae 0x157e71f
push 0x10be49f
bswap eax
mov edx, dword [esp + 3]
sub edx, 0xfb9fc00b
adc eax, 0xe52b5f2a
or dl, dh
not eax
xchg byte [esp + edx*2 - 0x8e07ffd], dl
movzx ecx, dl
mov dword [esp + edx*2 - 0x8e07fc0], ecx
ror eax, 2
bswap eax
neg dx
sbb eax, 0x853224bd
bswap eax
xor ebx, eax
pop edx
shl dx, 0x48
add edi, eax
xadd dword [esp + edx - 0x10b9f00], ecx
pop ecx
jbe 0xd62f31
movzx eax, word [edx + esi - 0x10b9f06]
lea esi, [esi + edx - 0x10b9f06]
jne 0xcccef5
pop ecx
push ebx
xchg ebp, eax
xchg edi, eax
lcall 0x37da, 0x81108f7f
push ecx
xchg edx, eax
adc byte [edi - 0x44], dh
mov dl, 0xcc
invalid
Function at 0x15bd0a8
Capabilities:
Encode data using base64

Disassembly:
dec edx
lea edi, [edi + edx - 0xabfd]
inc edx
mov eax, dword [esp + edx - 0xac00]
inc ecx
bswap ecx
inc ecx
xor ebx, ebx
dec eax
div ebp
dec edx
shl dword [esp + edx - 0xac02], 0x39
bswap ebx
cdq
xor ebx, edx
lea ebx, [edx + ebx - 0x18ea1dd5]
dec ebp
lea edi, [edi + ebp*8 - 0x879dd7f]
not ecx
xor ebx, 0xc3029a00
dec esi
mov dword [esp + edx - 0xac02], ebx
inc edx
xor dword [esp + edx - 0xac02], ebx
dec ecx
add ecx, edi
inc ecx
inc edx
inc ecx
pop ebx
inc ecx
idiv edx
inc ecx
not dh
dec eax
arpl bx, bx
ror al, 0xa7
dec eax
shr edx, cl
inc sp
bts edx, esp
dec esp
add ebp, ebx
rol dl, 0x66
dec ebp
or ecx, ebp
inc ecx
jmp ecx
dec edx
mov eax, dword [esi + edx*4 - 0x2b000]
inc edx
mov ebx, dword [eax + edx*4 - 0x2b004]
dec esi
lea eax, [edx*4 + 0x29aef62a]
dec ecx
inc edx
pop ebp
inc edx
mov dword [esi + edx*2 - 0x157fc], ebx
dec edx
lea esi, [esi + edx*2 - 0x157fc]
inc esi
and cl, byte [esp + edx*2 - 0x15801]
inc cx
shr ecx, 0xf
inc edx
mov ebx, dword [edi + edx - 0xac01]
dec esi
cmovns edi, dword [esp + edx - 0xac02]
jae 0xd3f941
inc esi
and dh, byte [esp + edx - 0xabf4]
inc ecx
shr ecx, cl
dec esi
lea eax, [esp + eax + 0x10]
mov ebp, ecx
dec edx
xchg dword [esp + edx*2 - 0x157fa], ecx
inc ebx
mov dword [eax + edx*2 - 0x15802], ebx
dec edx
mov dword [esp + edx - 0xac01], 0x3fbc09a0
inc esp
movzx edi, cx
jb 0x151103b
push 0x15a27d15
mov cx, word [ebp]
mov eax, 0xe3b1b594
movzx eax, byte [esi - 1]
shl word [esp + 2], 0xc9
call fcn.0152117d