joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcb4ddb
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
shl dword [esp], 0xcc
xor dl, bl
sub dl, 0x9e
xor dl, 0xbd
neg dl
pop eax
sal eax, 0x3f
sbb dl, 0xbf
imul eax, eax
xor ax, 0x7525
not al
not dl
adc ax, 0x186
sbb dl, 0x28
bt eax, 0xac
bts ax, ax
rol dl, 1
not eax
and al, 0x32
sar eax, 0x41
xor bl, dl
imul eax, eax
adc edx, esp
add eax, 0xaea60014
sar ax, 0xcb
imul ax, ax
mov dword [edx], ecx
mov eax, dword [ebp + 1]
mov ecx, 0x70898821
lea ebp, [ebp + ecx - 0x7089881c]
xor eax, ebx
movsx edx, cx
xadd dl, cl
rol eax, 3
ror dx, cl
xchg dh, cl
xor eax, 0x2b22d585
or ecx, edx
rol edx, 0x2f
dec eax
ror cx, cl
dec cl
ror eax, 3
or dx, dx
and ecx, edx
bswap eax
dec cx
and cx, dx
xor ebx, eax
add esi, eax
and dx, cx
mov edx, dword [edi + 4]
mov ax, word [edi + 8]
jae 0xd45486
inc esp
daa
or byte [edi], cl
sbb dword [ecx + 0x79000a79], 0xfffffff5
jns 0xc9dae4
mov cl, 0xf9
ficom dword [esi + 0x550e47a0]
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
test al, 0x47
push cs
push ebp
or cl, dh
enter 0xe47, 0x55
xor dl, byte [esi - 0x4c128e65]
popal
jl 0xc9daf7
inc edx
xlatb
stosb byte es:[edi], al
inc ecx
pop edx
or bh, bl
sar dword [edx], 0x55
mov bl, byte [edx + 0x1eda6fdf]
outsd dx, dword [esi]
ficomp dword [esi]
cli
adc dword [eax + edi + 0x30], 0x4d49b643
test byte [eax + 0x24], ch
xchg esp, eax
jns 0xc9db1a
push 0x21
int3
inc sp
xor eax, edx
dec eax
mov dword [esp + ebx*2], esi
dec ebp
lea ecx, [ecx + ebx*2 - 2]
inc ebp
or ebx, esp
inc cx
mov dword [ecx + ebx*4], edx
sar ebx, 0xe
movsx edi, cx
inc ecx
pop edx
pop eax
pop edx
pop eax
je fcn.00cf78e6
mov edx, 0xbab9208
push edx
movzx ecx, dx
mov ecx, dword [edi + edx*8 - 0x5d5c9040]
rol dword [esp + edx - 0xbab9208], 0x11
movzx edx, byte [ebp + edx*2 - 0x17572410]
jb 0xc9da47
cmc
Function at 0xcb7512
Capabilities:
Execute syscall

Disassembly:
mov edi, dword [ebp + esi - 0x73bf]
inc esp
movsx ebp, byte [esp + ecx - 0x6817719c]
call fcn.0151d8c2
fchs
mov edx, 0x4490d700
bswap edx
mov eax, dword [ebp + edx*4 - 0x35e4110]
bts dx, dx
mov ecx, 0x5e39b923
lea ebp, [edx + ebp - 0xd79050]
setb cl
xor eax, ebx
xor eax, 0xb6839b1d
push edx
jmp 0xcd3e70
xor eax, 0x898e338
mov dword [esp + ecx*2 - 0x27381098], edx
xor ebx, eax
or edx, ecx
xor edx, ecx
mov dword [edi + ecx*2 - 0x2738109c], eax
sar edx, 0x41
mov edx, dword [ebp + ecx - 0x139c0848]
xor edx, ebx
bswap edx
sub dword [esp + ecx*2 - 0x27381098], ecx
movsx eax, cl
xor edx, 0xcd1c6907
sub byte [esp + ecx*2 - 0x27381096], al
neg edx
sub eax, ecx
lea edx, [ecx + edx - 0xe9744c6]
push ecx
ror edx, 3
shr eax, 0x98
adc ecx, dword [esp + eax - 0xeb]
pop eax
lea edx, [eax + edx - 0x22aeb3f7]
jnp 0x151dba5
mov edx, 0x3803deac
mov ecx, dword [ebp + edx*2 - 0x7007bd58]
call fcn.00ceea3a
inc ecx
ror dh, 1
inc ecx
inc dh
dec eax
or eax, 0x90b603a4
dec esp
lea esp, [esi + esi*4 - 0xbdce650]
btc si, di
inc ebp
xor al, dh
inc esp
add dl, cl
inc ecx
seta dl
dec esp
add esi, esp
push edi
or si, 0x7320
not edi
inc bp
mov edx, dword [esi + ecx - 0x681771a6]
inc ecx
sal ah, 4
inc ecx
movsx ebx, bl
dec ebp
lea ecx, [ecx + esi - 0x73c1]
inc di
mov dword [ecx + ebx*8 - 0x5f0], edx
dec eax
rol dword [esp + esi*2 - 0xe77e], cl
inc ebp
movsx edx, bl
dec eax
lea ebp, [ebp + esi*2 - 0xe782]
inc ebp
sbb bl, ah
push ebx
jg 0xc9fc77
shr edx, 1
inc eax
dec word [esp + edx - 0x6bc828]
xadd cx, dx
not eax
lea edx, [ecx + edx*8 + 0x10ac592b]
setp cl
ror dl, 0x83
or byte [esp + eax - 0x139c084a], al
jge 0xcea0eb
xor ebx, edx
push ecx
sub eax, dword [esp + eax*4 - 0x4e70212c]
sal cl, 0x23
adc esi, edx
movzx eax, byte [ebp + eax - 0x25acb48a]
movzx edx, cx
sub word [esp + edx - 0xa49d], cx
adc word [esp + edx*4 - 0x2927c], 0xb204
lea ebp, [ebp + edx*8 - 0x524f7]
xor cx, 0xae85
sbb cx, dx
xor al, bl
lea ecx, [ecx*8 + 0x70335397]
dec al
xor al, 0x1a
inc al
xor ecx, 0xb0aac008
neg al
or edx, edx
xor bl, al
lea ecx, [ecx + edx*8 + 0x399db80d]
or ecx, dword [esp + edx*2 - 0x1493c]
add ecx, 0xa8852a84
mov word [edi + edx*2 - 0x14946], ax
lea edi, [edx + edi - 0xa4a6]
movzx eax, cx
pop edx
pop eax
js fcn.00cbc794

Function at 0xcba4b0
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], ecx
movsx edx, cx
add ebp, 4
xadd byte [esp + 3], dh
jle 0xcc4865
inc ecx
mov esi, 0xaad8516
dec edx
lea ebp, [ebp + esi - 0xaad851a]
inc ecx
mov ecx, esi
inc esp
movsx ebx, cx
dec edx
lea edx, [ebx*8 + 0x6283280b]
inc ecx
mov ebx, dword [esi + ebp - 0xaad8516]
inc ecx
xor ebx, eax
not dx
inc ecx
movsx esi, bx
inc ecx
ror bl, 0x21
bswap ebx
inc ebp
mov ebp, esi
call fcn.01542014
xor eax, ebx
dec eax
ror eax, 3
sub word [esp + 1], 0x57af

Function at 0xcbd4ec
Capabilities:
Encode data using base64

Disassembly:
inc ecx
ror esp, 1
inc esp
or edx, edi
inc ecx
bswap esp
adc dword [esp + ebx - 0xe63c], eax
dec esp
mov dword [esp + ebx - 0xe64c], edx
inc word [esp + ebx - 0xe637]
inc ecx
inc esp
sal si, 0x6e
inc ecx
neg esp
neg di
call fcn.00cdb008
Function at 0xcbf058
Capabilities:
Encode data using base64

Disassembly:
add ebp, 4
xor eax, ebx
bswap eax
ror word [esp + 6], 0xa1
mov dword [esp], 0x182f4f3f
sar word [esp + 9], 0x81
ror eax, 1
shl dword [esp + 2], 0xa1
sbb eax, 0x53a14813
not byte [esp + 7]
ror dword [esp + 2], 0x92
sar word [esp + 7], 0x8b
not eax
sal byte [esp + 4], 0x22
not word [esp + 9]
ror dword [esp + 1], 0x71
inc eax
call fcn.00d51935

Function at 0xcbf0a8
Capabilities:
Encode data using base64

Disassembly:
call fcn.00cdee6e
mov ecx, dword [ebp]
mov edx, 0xc088230e
ror edx, 0xce
jb 0xcb8070
rol al, cl
inc edx
sub ecx, ecx
sal ecx, 0x86
sets al
not edx
sbb ecx, ecx
bt ax, cx
sbb edx, 0xd21851b2
or eax, eax
bswap eax
bswap edx
sbb cx, 0xf418
lea edx, [edx + eax + 0x6eba7a04]
xor ebx, edx
rol al, 0xa6
cwde
sub ecx, ecx
adc esi, edx
xadd ax, cx
jmp esi
adc ebp, 3
sub edx, edx
movsx eax, dx
call fcn.00d7af7a
jnp fcn.00cbc794
ror eax, 1
sub eax, 0x53a14813
mov dword [esp], 0x83a95719
not eax
push 0x752d0788
inc eax
bswap eax
or word [esp + 0x16], 0x83a7
mov dword [esp + 0x18], 0xfea46336
not byte [esp + 0x12]
xor ebx, eax
not byte [esp + 2]
and byte [esp + 7], 0x1f
adc esi, eax
lea esp, [esp + 0x1c]
jmp 0xc99006
Function at 0xcc9b37
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx], edx
movzx ecx, dx
lea ebp, [ebp + edx*2 + 1]
xchg dword [esp + edx*8 + 1], edx
pop edx
add cx, 0xb622
xor al, bl
push edx
bswap edx
bswap edx
dec al
and dx, cx
push ecx
lea ecx, [ecx*8 + 0x279a2593]
xor al, 0x1a
not dword [esp + edx + 8]
inc al
ror dword [esp + edx*4 + 1], 0x6d
neg al
xor bl, al
xchg byte [esp + edx*2 + 9], cl
lea edi, [edi + edx - 2]
jmp 0xcf7fb5
bts ecx, edx
adc dl, 0xb8
mov word [edi + edx*2 - 0x172], ax
ror dx, cl
jne 0xd7ea33
mov ecx, 0xb702ce1c
push ecx
movzx ecx, byte [ebp]
rol dword [esp], 0xbe
setb byte [esp]
adc ebp, 0
ror dword [esp], 0xb9
mov edx, 0xa999dc00
xor cl, bl
jmp 0x14ee68e
pop ecx
pop edx
pop edx
jnp fcn.00cbc794
inc si
or dword [esp + esi*8 - 0x532], edx
neg edi
inc edx
shl dword [esp + ebx - 0x4e0b03a5], 0x4a
inc ecx
shl dl, 0x66
inc edi
inc ecx
pop edx
inc ecx
push ebx
ror edi, 3
push ebx
bswap edi
dec edx
lea eax, [ebx + ebx - 0x55d015fe]
dec esi
mov dword [esp + ebx - 0x4e0b039f], eax
xor dword [esp + ebx - 0x4e0b039f], edi
call fcn.00cf9778
dec esp
xor esp, dword [esp + ecx - 0x681771a1]
ror edi, 1
xor word [esp + esi*4 - 0x1cef1], bx
dec eax
sal dword [esp + esi - 0x73bd], 0x27
lea edi, [ecx + edi - 0x83688a]
inc esp
movsx esi, cx
xadd dword [esp + ecx - 0x6817719a], ebx
call fcn.00ccc8c7
Function at 0xce4c02
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0xb5b60ca1
sub edx, 0x81a8090c
add dl, 0x8a
not eax
or dx, dx
bt dx, dx
push edx
mov dword [edi + edx*2 - 0x681c063e], eax
xor byte [esp + edx - 0x340e031f], dl
mov ecx, dword [ebp + edx*2 - 0x681c063e]
lea ebp, [ebp + edx - 0x340e031b]
mov eax, 0x8328c98c
xor ecx, ebx
sal eax, 0x17
inc byte [esp + edx*2 - 0x681c063e]
sbb edx, dword [esp + edx - 0x340e031f]
inc ecx
xchg dword [esp + edx - 0x1e], edx
rol ecx, 1
call fcn.01548ce8
lea esp, [esp + 0x10]
je 0xcd05f3
jmp 0x152249e

Function at 0xce68a0
Capabilities:
Encode data using base64

Disassembly:
adc esi, eax
fld qword [ecx + edi - 0x430100f9]
rol ecx, 0x49
jmp esi
neg dl
sub cl, ch
not ecx
sar cx, cl
sbb dl, 0x22
mov dword [esp], ecx
xor dl, 0xb1
dec cl
not dl
je 0xccb4a3
add cx, cx
neg dl
inc dl
and dword [esp], 0xd0bbc68d
sar word [esp + 1], 0x2e
sal ecx, cl
xor dl, 0x98
xor bl, dl
and ecx, dword [esp + ecx*2 - 0x4200000]
or cx, cx
push ecx
lea edx, [esp + edx + 8]
mov dword [edx + ecx*8 - 0x800000], eax
mov eax, 0xd7949d03
push eax
movzx edx, cx
adc edx, dword [ebp + ecx*2 - 0x1fffff]
or ax, word [esp + ecx*8 - 0x7ffff6]
dec eax
or eax, dword [esp + ecx - 0xffffe]
lea ebp, [ebp + ecx*2 - 0x1ffffb]
shr ax, 0xe8
xchg ah, al
xor edx, ebx
sal word [esp + ecx - 0xffff7], 0xa1
ror dword [esp + ecx*8 - 0x7ffff8], 0x92
inc cl
neg edx
ror edx, cl
sar byte [esp + ecx - 0xffffe], 0x85
pop eax
setb byte [esp + ecx*8 - 0x800004]
xor edx, 0x188ceeac
sar cl, 0x42
pop ecx
not edx
call fcn.00cbfb72
xor edx, ebx
rol edx, 2
sal al, 0x61
lea eax, [ecx + eax - 0x1ad7ef71]
xor edx, 0x6cafafa1
not ecx
bswap eax
or cx, cx
neg edx
not ecx
call fcn.00d7cf2d
lea eax, [ecx + eax + 0x50b8bfaa]
add edx, ecx
inc cx
bts ecx, edx
xor ebx, eax
rol edx, 0x48
jae 0x1550bee
mov ecx, 0xaa82fc87
mov edx, dword [edi]
and ecx, ecx
shl cx, cl
mov cl, byte [edi + 4]
adc edi, 2
mov eax, 0x7d200baa
rol eax, 0x66
shr edx, cl
neg eax
lea ecx, [eax + eax - 0x4f7ab2ce]
mov dword [edi + ecx*2 - 0x40feefe8], edx
or al, 0xf
lea edx, [eax + ecx*4 - 0x3453e5f6]
mov edx, dword [ecx + ebp - 0x207f77f4]
lea ebp, [ebp + ecx - 0x207f77f0]
rol al, 0xe6
sub ecx, ecx
dec ecx
xor edx, ebx
dec eax
shr ecx, cl
sbb edx, 0xf3b95b93
not edx
add cx, ax
bswap edx
rol ax, 0xe
sal eax, 0x31
not edx
shr eax, cl
neg al
xor ebx, edx
ror cx, 0xcf
shl cl, 0x83
lea ecx, [eax*4 + 0x603dbb80]
add esi, edx
jmp esi
leave
bt ecx, 0x2c
sub al, al
mov dword [edi], edx
mov dword [esp], eax
sar dword [esp], 0x2f
sar ax, 0x42
pop ecx
pop edx
jmp esi
jae 0xce5edd
pushal
and al, 0x2d
clc
mov ebx, 0x9296fdeb
push esp
test dword [edi + 0x54929681], 0x96b1b7c3
xchg edx, eax
push esp
jnp 0x1550bd3
retf 0x71a0

Function at 0xceb229
Capabilities:
Encode data using base64

Disassembly:
dec ecx
mov dword [esp], 0x31bc13a1
or eax, eax
mul word [esp + 1]
not ecx
rol dword [esp], 0x25
idiv ax
cwd
dec ecx
not ecx
xor ebx, ecx
shr al, 0xa5
bts eax, 0xab
bts edx, 0x38
adc esi, ecx
call fcn.0152b253
inc esp
mov esp, dword [ebp - 4]
mov esi, 0xb99e3816
inc esp
movsx ebp, dh
inc cx
or esi, ebp
inc ebp
xor esp, eax
mov edi, esi
inc ebp
lea esp, [esp + edi - 0x356a526c]
jmp 0x1531d47
Function at 0xcef145
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [esp + 0xc]
mov dword [esp + 0xc], ecx
call fcn.00cad91a
mov eax, 0x188dd916
movsx ecx, al
mov ecx, dword [ebp + eax - 0x188dd916]
xor ecx, ebx
mov edx, eax
add edx, eax
bts edx, eax
ror ecx, 3
or edx, 0x36ae1f1a
rol eax, 0x17
sal eax, 0xa7
bswap ecx
adc eax, 0x2f9383a4
sub dx, dx
sar eax, 0xdc
neg ecx
lea ecx, [edx + ecx - 0x3a165306]
xor ebx, ecx
jmp 0x15190f2
xchg edx, eax
add esi, ecx
lea ecx, [edx + eax*2 + 0x7d2d7b0f]
xor ax, word [edi + eax - 0x37ff0000]
call fcn.00ce30f6

Function at 0xcfa3d7
Capabilities:
Encode data using base64

Disassembly:
sub dword [esp + ecx*2 - 0x7b040e2c], 0x10aaabaf
inc dx
rol cl, 0x44
xor dx, 0xfa83
and dword [esp + eax*4 + 8], eax
jg fcn.0154ca81
mov dword [esp + eax], eax
not dx
xor bx, dx
rol dword [esp + eax*2 + 8], 0xe5
mov word [edi + ecx*2 - 0x7b040f42], dx
rol cl, 0x86
adc dword [esp + eax], esi
ret 8

Function at 0xd09589
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp + edx*4 - 0x4674904c]
dec esp
mov dword [esp], ebx
idiv al
inc ecx
pop edx
inc ecx
xor edx, eax
dec ecx
lea edi, [ebx - 0x607c1062]
inc ecx
mov esp, 0xa2963687
inc edx
rol edx, 2
neg eax
inc ecx
neg ah
neg edx

Function at 0xd0ec5b
Capabilities:
Encode data using base64

Disassembly:
push 0x2689dbbc
dec edx
push 0xb50cbe1b
lea esp, [esp + 0x1c]
jne 0xccb4b8
mov edx, 0xa707a1bc
lea ecx, [edx*4 + 0x52adf12a]
pop ebx

Function at 0xd1de7d
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
sub dword [esp + 7], eax
mov ecx, 0xa62483ab
not edx
call fcn.00d05988

Function at 0xd1de8f
Capabilities:
Encode data using base64

Disassembly:
pop eax
imul cx, si
lea esi, [esi*4 + 0x77a49db8]
pop edi
not cl
movsx ebx, si
popfd
pop edx
lea ebx, [esi + ecx*8 - 0x36d4b858]
push ecx
mov esi, dword [esp + ecx - 0x49d0bb36]
xchg word [esp + ecx - 0x49d0bb38], cx
xchg dword [esp + ecx - 0x49d049d0], ebx
jmp 0x1535b44
neg eax
lea edx, [edx + ecx*4 + 0x692dc59f]
lea eax, [eax + edx - 0x4437fa09]
mov dword [esp + edx - 0x493cbd8f], edx
not dword [esp + edx - 0x493cbd8b]
ror eax, 3
pop edx
lea eax, [edx + eax - 0x584f693a]
neg edx
imul cx, cx
rol dx, 0xe2
xor ebx, eax
neg dx
sbb word [esp], cx
adc cx, word [esp]
adc esi, eax
and dword [esp], edx
jg 0x155ac76
bswap edx
mov ecx, dword [esp + ecx - 0x49d049c8]
mov dword [esp + 8], ebx
pop ebx
movsx eax, word [esp]
pop eax
jns fcn.00cbc794
mov esi, 0x1602d881
mov esp, edi
pop ebp
lea eax, [esi + esi*8 - 0x7c48bb44]
mov ecx, eax
jmp 0xd168fb
Function at 0xd26cf3
Capabilities:
Encode data using base64

Disassembly:
mov edi, dword [edi*4 + 0xd22ab4]
mov dword [esp], 0xa2142db0
neg byte [esp + 2]
jnp 0xcd05d3
inc ecx
mov edx, 0x1b2c2ba
inc ecx
movsx ebx, dl
inc ecx
movsx ecx, dl
dec edx
lea ebp, [ebp + edx - 0x1b2c2be]
inc ecx
movsx eax, dx
inc esi
mov edx, dword [ebp + edx*2 - 0x3658574]
dec eax
cdq
inc ebp
xor edx, eax
dec esp
lea ebx, [ebx + ebx*8 - 0x4fbfe4a]
inc ecx
dec edx
inc ecx
xor edx, 0x1f165295
push ecx
inc ecx
neg edx
shr word [esp + edx + 4], 0xee
pop esi
inc ecx
dec edx
inc ecx
mov ebp, 0xdb281795
inc esp
movzx esi, ax
inc ecx
bswap edx
inc ecx
not ebx
push ebx
inc cx
shr ebp, 0xe4
inc ecx
sbb edx, 0xd5888721
dec eax
shl edx, 0x6b
inc ecx
sbb dl, ch
inc ecx
xor edx, 0xe0b8e39e
inc esp
movsx esp, byte [esp + edx*2 - 0x10a]
dec edx
imul dword [esp + ebx*2 - 0x9f8017e]
dec esp
mov dword [esp + edx], eax
dec ebp
xadd esi, ebp
inc cx
not esp
inc esp
movsx eax, ax
inc esp
xor dword [esp + edx*2], edx
inc ecx
pop eax
dec ecx
btc ebp, 0xb
dec ebp
arpl dx, dx
inc ecx
idiv esp
dec ebp
add edi, edx
inc cx
sub ebx, 0xf749318f
fisttp dword [ecx + 0xf]
mov edx, 0x8b4d97f3
dec esp
inc ecx
loopne 0xceccbe
xor dword [edx], 0xffffffac
add byte [eax], al
inc esp
and eax, 0xcac16604
add esi, dword [edx]
ret
neg dword [esp + 4]
and edi, 0xff
jmp 0xcecbdb

Function at 0xd5308f
Capabilities:
Check http status code
Encode data using base64

Disassembly:
and ax, dx
xor ebx, ecx
mul eax
jo 0xcac01b
mov dword [esp], 0xdc229e98
add ebp, 4
pop eax
xor ecx, ebx
lea edx, [eax + 0x23bd470f]
lea edx, [eax + 0xa893237]
xchg dl, al
sub ecx, 0x2e9fb984
not edx
bswap edx
not ecx
inc dx
rol ecx, 1
not eax
sub dl, al
lea ecx, [ecx + eax - 0x7969d9d9]
jno 0xca4689
push edx
rol ecx, 3
sal dx, 0x8e
xor ecx, 0x2b22d585
pop edx
btc dx, 0x9a
pop eax
dec ecx
sal dl, 5
sar dx, 0x42
ror ecx, 3
ror eax, 0x81
shl edx, 0xe4
sal eax, 0xc1
bswap ecx
cwde
btr eax, edx
cdq
xor ebx, ecx
cwd
add esi, ecx
lea ecx, [eax + edx*4 - 0x29e70953]
xor edx, dword [edi + eax - 0x2020]
mov ax, word [edi + eax*2 - 0x403c]
push ecx
mov word ss:[edx], ax
mov edx, dword [ebp + 4]
sub ebp, 0xfffffff8
xor edx, ebx
inc cl
jnp 0xd76764

Function at 0xd5318c
Capabilities:
Encode data using base64

Disassembly:
dec eax
arpl cx, cx
dec esp
add edi, ecx
dec edi
lea edx, [esi + 0x501b6c83]
inc esp
sub dl, dh
inc di
mov ecx, dword [ebp + ecx]
pop ecx
pop edx
ja fcn.00cf78e6

Function at 0xd531ab
Capabilities:
Encode data using base64

Disassembly:
shl ax, cl
sar dx, 3
mov dword [esp], edx
mov word [edi], ax
movzx eax, dl
lea ecx, [edx + 0xa3e9037]
mov ecx, dword [ebp + eax*8 - 0x588]
neg al
bts eax, 0x14
lea ebp, [eax + ebp - 0x10004b]
xor ecx, ebx
ror ecx, 3
shl ax, 0xc6
call fcn.01533268
cmp esi, ebx

Function at 0xd61914
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0x14295a8
lea esp, [esp + 4]
call fcn.014f59f3
Function at 0x14a03bf
Capabilities:
Encode data using base64

Disassembly:
push 0xb83d0c23
jo 0x1548f07
movzx edi, cl
dec esp
lea ebp, [ecx + 0x1b992b02]
inc edx
lea esi, [esi + ebx - 0x25104f55]
xor esi, 0xda144108
inc ebp
movsx esp, bp
push eax
rol word [esp + ecx - 0x2db43baf], 0xcb
not esi
call fcn.00cb0dc5
rol edx, 2
inc al
lea edx, [edx + ecx*2 - 0xe4eae09]
bswap edx
not cl
cwde
sar ecx, 0x2d
ror edx, 2
xor ebx, edx
cwde
dec cx
inc cx
add esi, edx
or ecx, ecx
dec ecx
jns 0xd5015b
mov edx, dword [edi + 4]
not cx
imul ecx, eax
mov eax, dword [edi + ecx*2 - 0x26b1fff8]
mov ecx, dword [edi + ecx - 0x1358fff4]
jo 0xca680e
dec ebx
push 0xb0980682
call fcn.01500f9c
pop esi
sub al, 0x32
clc
sub eax, 0x8d9ec7c1
push esp
dec ebp
cmc
jecxz 0x14a0376
lea edx, [ecx + esi*8 + 0x74]
sbb dword [esi - 0xe0eab73], 0xffffffee
xchg esp, eax
out dx, eax
mov eax, dword [0x44081e1f]
mov ch, 0x78
or esp, dword [edx + 0x60]
sub ecx, ebx
pushal
or dword [ecx - 0x65], ebp
jle 0x14a043c
jb 0x14a0429
pop ss
fbstp tbyte [edi - 0x4913711]
scasb al, byte es:[edi]
dec ecx
loopne 0x14a0479
xchg ebp, eax
or byte [edi + 0x17], cl
mov ch, 0x20
sbb al, 0xd7
mov dh, 0xb1
push ss
out dx, al
and al, 4
cmp dword [ebx], ebp
jbe 0x14a0494
inc ebp
lcall 0x294d, 0xd48a4f65
xor al, 0x3f
push ebx
xchg ebp, eax
lea esp, [ebx - 0x1eda49b]
scasb al, byte es:[edi]
pop esi
movsd dword es:[edi], dword [esi]
test ah, dl
cli
stosb byte es:[edi], al
pop esi
movsd dword es:[edi], dword [esi]
test byte [eax - 0x5aa13d6e], ah
test al, ch
mov byte [0x84a55ef2], al
hlt
movsd dword es:[edi], dword [esi]
test ah, dh
xchg esi, eax
cmpsb byte [esi], byte es:[edi]
into
or byte [edi - 0x33ad161f], cl
push es
add byte [ebx + ecx*4 - 0x30], al
inc ecx
sar bl, 0x85
dec eax
arpl si, si
dec esp
add edi, esi
dec esi
mov dword [esp + esi - 0xac99], edi
ret 0x10
clc
mov esp, 0x66c00aa3
xadd eax, ecx
lea ebp, [ebp + ecx*2 - 0x7f1cb8f6]
cwde
shl ecx, 0xe1
imul ax, cx
xor edx, ebx
and eax, eax
xadd eax, ecx
adc ecx, eax
rol edx, 1
neg edx
lea eax, [ecx + ecx*2 - 0x23cc505e]
shr eax, 0xf4
ror edx, 1
neg edx
ror al, 1
xor ebx, edx
sub eax, eax
lea ecx, [ecx + 0x1789d509]
adc esi, edx
movzx edx, al
add eax, esi
jmp eax
ror byte [edi], 0xc1
enter 0xffffffffffffc813, 0xffffffffffffffd1
ret 0xdaf7
div ecx
push 0xf1073902
mov ecx, dword [esp + 1]
mov dword [edi + ecx*2 - 0x47e20e6a], edx
movzx edx, cl
xor byte [esp + edx - 0x35], ch
setg dl
mov dword [ecx + edi - 0x23f1072d], eax
not dword [esp + edx + 3]
sub word [esp + edx*2 + 4], 0x8faa
lea edi, [edi + ecx - 0x23f10731]
mov dword [esp + ecx*2 - 0x47e20e72], esi
ret 4
Function at 0x14ee477
Capabilities:
Encode data using base64

Disassembly:
rol eax, 2
add eax, 0xf1b16c87
bswap eax
mov dword [esp + ecx - 0x35], edx
ror eax, 2
rol ecx, 0xfe
setae cl
xor ebx, eax
add esi, eax
mov edx, dword [edi + ecx - 0x3ffffffe]
movsx eax, word [esp + ecx*2 - 0x7ffffffe]
ror ax, 7
push ecx
xor eax, dword [edi + eax*4 + 6]
neg ecx
add edx, eax
lea eax, [ecx + ecx*2 - 0x14d3d77a]
shl dword [esp + eax*2 - 0x56585108], 0x83
jns 0xcdc64c
push edx
mov edx, 0x33858f04
pushfd
cmp dx, 0x20a
lea edx, [edx + edx + 0x9353f1a]
mov edx, dword [esp + edx - 0x70405d1e]
mov dword [esp + 4], 0x814e233a
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.014f59f3
ror dword [ebx + 0x29], 1
stc
push es
xchg esi, eax
mov bh, 0xe3
imul edi, dword [esp + ebx*2 + 0x6f], 0xb0919b76
wait

Function at 0x14f04e2
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [edi + edx*4 - 0x60722d8]
sal edx, 0xc9
lea eax, [edx + edx*4 + 0x6e93fa09]
mov edx, dword [edi + edx*8 - 0x1c8b5ffc]
adc edi, 3
dec eax
push eax
add ecx, edx
mov dword [edi], ecx
mov ecx, 0xab1ea710
movsx edx, cl
mov dword [esp + edx - 0x10], 0x7dac2c04
mov eax, dword [edx + ebp - 0x10]
shl ecx, 0xe9
xchg dword [esp + ecx - 0x3d4e2000], edx
lea ebp, [ecx + ebp - 0x3d4e1ffc]
and byte [esp + edx - 0x7dac2c03], ch
call fcn.00d52d1c
inc ecx
mov esp, 0x44872419
dec edx
lea ebp, [ebp - 0x4487241d]
inc ebp
movzx ebx, sp
inc esi
mov esi, dword [ebp + ebx - 0x2419]
inc ecx
movzx edx, bl
inc ebp
xor esi, eax
dec dx
inc ecx
movsx ecx, bl
push ecx
inc ecx
rol esi, 2
inc ecx
sub esi, 0x81abda85
inc edx
neg byte [esp + ebx*4 - 0x9064]
inc edx
add byte [esp + ebx - 0x2417], cl
dec edx
ror dword [esp - 0x44872419], cl
inc ecx
ror esi, 3
inc edx
not dword [esp + ebx - 0x2419]
dec edx
add dword [esp + ebx - 0x2419], 0x6b8429f
inc ecx
inc esi
inc ecx
rol esi, 1
push ecx
inc edx
sub byte [esp - 0x44872416], 0x2f
dec esi
mov dword [esp - 0x44872411], eax
inc ebp
movsx eax, ah
inc bp
xor ebx, ebx
inc esi
xor dword [esp + ebx + 8], esi
inc ecx
push esp
movsx eax, cl
dec esi
mov eax, dword [esp + ebx*4 + 0x10]
dec ebp
xchg esp, ebx
dec eax
dec eax
dec ebp
arpl si, si
inc edx
mov ebx, dword [esp + 8]
dec ebp
add edi, esi
inc ebp
mov esi, esp
dec ebp
lea esp, [esi + ebx + 0xf237839]
call fcn.01557d27
sar edi, 0xc2
inc edx
xor dword [esp + ebp - 0xe7], eax
inc dx
or ecx, dword [esp + ebp - 0xed]
inc esi
sub esi, dword [esp + ebp*2 - 0x1dd]
dec esi
mov eax, dword [esp + ebp - 0xe7]
inc ebx
mov dword [ecx + ebp - 0xf3], eax
inc cx
inc esi
call fcn.00cb5282
shl cx, cl
test di, ax
dec esi
mov eax, dword [esp + ebp + 2]
not cl
dec ebp
arpl sp, sp
inc ecx
setae dl
dec ebp
adc edi, esp
inc edx
mov eax, dword [ebp + ebp*2 - 0x14]
dec edx
mov dword [esp + ebp*2 - 4], ebx
inc ecx
xor eax, eax
rol eax, 1
dec edx
lea edx, [esi + ebp*2 - 0x18db78e5]
dec eax
xadd dword [esp + ecx - 0xe1], edx
dec edx
mov dword [esp + ebp - 6], esi
dec eax
bt cx, 0xa1
inc eax
or dl, dh
xor eax, 0xd10957af
inc esp
movsx esi, byte [esp + ecx*2 - 0x1c6]
inc edx
neg byte [esp + ebp + 6]
ror eax, 1
inc ecx
xadd ebp, ecx
dec esi
mov dword [esp + ebp*2 - 0x1d6], eax
jns 0xd11066
mov edx, 0x181c8b6
movzx ecx, dl
jmp 0xcaa310
Function at 0x14f7b83
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x88]
ret
inc edi
inc ebp
mov esp, ebp
inc ecx
pop edx
call fcn.015199ab
inc ecx
ror ebx, 1
inc ecx
neg ebx
inc eax
and al, dh
jp 0xd64c11
mov byte [ecx + 0x2e], 0xce
xor dword ds:[esi + 0x6d6f66f5], 0xa6280446
mov bh, 0xf9
mov esp, dword [esi]
rcl dword [eax + ecx]
push ebp
arpl bx, sp
in eax, dx
adc al, 8
push ebp
aaa
mov dword [0x550814ad], eax
out 0x9f, eax
mov ah, byte [edx]
jmp 0xcf898b
inc ecx
inc ebx
inc ecx
push eax
inc esp
movzx esi, cl
inc ecx
mov eax, 0xd41617a7
inc esp
xor dword [esp + eax - 0x4f22c822], ebx
dec eax
lea ebx, [eax*4 - 0x20c1c26b]
rol ecx, cl
dec eax
btr ecx, edx
inc ecx
pop eax
dec eax
imul ecx
inc ebp
movzx edx, si
dec eax
cwde
dec ebp
arpl bx, bx
dec eax
inc ebx
mov edi, 0x2f29ff9f
dec ebp
adc edi, ebx
dec eax
xchg ecx, eax
inc si
mov ecx, dword [eax + ecx - 0x459ffffe]
inc esp
mov ebx, ebx
ror ebx, cl
push esi
inc ecx
pop ebp
jb fcn.00cf78e6
dec ecx
mov ecx, dword [ecx]
mov esi, 0xf3b8232a
dec ecx
mov esi, dword [ecx + 8]
mov edx, 0x882eb2ac
inc esp
mov esp, edx
dec eax
add ecx, esi
mov ebx, edx
dec ecx
mov dword [ecx + 8], ecx
mov esi, edx
dec eax
lea eax, [ebx*2 - 0x5be60dee]
mov edi, dword [ebp - 4]
dec eax
add ebp, 0xfffffffc
inc ecx
xor edi, eax
dec eax
add ebx, 0xfd29ec9e
rol edi, 3
inc eax
xchg al, dh
inc esp
mov ebp, edx
inc edi
inc ecx
or dl, ah
rol edi, 1
inc esp
mov edx, edx
cwd
sub edi, 0xd2156ad
not al
inc ecx
push eax
dec eax
bt edx, 0x88
mov ecx, 0x4e2d2202
dec eax
shr esi, 0x43
xor dword [esp + esi - 0x1105d64d], edi
jmp 0x15008e0
inc ecx
xor edi, eax
inc ecx
ror edx, 0x9a
movzx ecx, bx
inc edi
inc ecx
sar ebp, 0x6c
not edi
inc ecx
sal edx, 0x82
dec eax
mov dword [esp + esi*2 - 0x13268], 0x74ae4b85
inc esp
xadd cl, dl
neg edi
xor word [esp + esi - 0x992e], 0xbd96
shl dword [esp + esi - 0x9934], 0xec
jp 0xcf8994
inc esp
sub dl, dl
dec esp
lea ebx, [eax + eax + 0x1b8b95bc]
inc ecx
pop eax
dec eax
arpl di, di
inc cx
xor esp, 0xd2f780b0
inc cx
sub esp, 0x34ce495
invalid

Function at 0x15066d6
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor eax, 0x15aa9d81
call fcn.00ccc1da
mov dword [esp], 0x16accfb6
shl byte [esp + 3], 2
shr eax, 8
xor eax, esi
jmp 0xcd0241

Function at 0x15126aa
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0xf90b979b
inc esp
xor esp, esi
ror dword [esp + 3], 0x3d
inc ecx
and esp, 0xff
push 0xa5075a01
call fcn.01500139

Function at 0x1521ada
Capabilities:
Encode data using base64

Disassembly:
dec esp
adc edi, edi
dec eax
shl eax, 0x43
pop eax
ja fcn.00cf78e6