joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103b8d3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [esi + ecx*4 - 0x1e4490fc]
neg edx
mov edx, dword [esi + edx*2 - 0x26582094]
jge 0x1048c183
adc esi, 3
push 0x3728902b
xor eax, eax
test edx, edx
lea esp, [esp + 4]
je 0x102fee06
push ebx
inc ecx
bswap ebp
dec esp
lea esi, [eax*8 - 0x625d6d52]
shl dx, 8
inc ecx
dec ebp
dec ecx
dec esi
ror eax, 0x8e
dec eax
mov dword [esp + eax*2 - 0x800000], edx
inc ecx
ror ebp, 3
movsx ecx, dl
cdq
xor word [esp + esi*2 - 0x6233de16], ax
inc ecx
not ebp
dec esp
mov dword [esp + eax - 0x3ffff8], ecx
inc ecx
imul esi
call fcn.10307b59
mov ecx, 0x59f3988
lea edx, [ecx*2 + 0x8b74738]
sar edx, cl
lea edi, [ecx + edi - 0x59f398c]
mov eax, dword [edi + ecx*2 - 0xb3e7310]
shr ecx, cl
or dl, dl
dec cx
xor eax, ebx
sal dx, 0xca
not eax
lea eax, [ecx + eax + 0x6405297e]
xadd ecx, edx
neg eax
shr cl, 0x67
and cx, dx
or ecx, 0x8fa2e221
lea eax, [eax + ecx*2 - 0x3acdf30c]
or cl, 0x3d
and ecx, 0x37953cbd
sbb edx, 0x1331af84
xor ebx, eax
inc ecx
jge 0x103e8ddd
inc ecx
add ebp, eax
jmp 0x1032ddde
jns 0x103730b3
call fcn.1038939a
mov eax, 0xb32cdb2f
mov ecx, eax
sal al, 0x65
mov eax, dword [esi]
and cl, 0x30
jnp 0x102fa803

Function at 0x103bf4fa
Capabilities:
Encode data using base64

Disassembly:
pop eax
pop eax
pop edx
pop eax
pop eax
jno fcn.1044af2a
mov ecx, 0x55bd0a1f
lea eax, [ecx + 0x4af53a7]
mov ecx, dword [esi + ecx - 0x55bd0a1f]
push eax
cwde
sal byte [esp + eax*8 - 0x2ee2f], 3
mov ax, word ss:[ecx + eax*2 - 0xbb8c]
and word [esp], 0xc401
mov edx, 0xfb3b2d2a
adc esi, 2
push edx
mov ecx, edx
mov word [esi], ax
not byte [esp + 3]
movzx eax, dx
mov ecx, dword [edi + eax - 0x2d2a]
push edx
bswap edx
lea edi, [edx + edi - 0x2a2d3bf7]
neg al
xor ecx, ebx
cbw
dec ecx
lea eax, [edx + 0x50256131]
rol eax, 0xa2
ror ecx, 2
xor ecx, 0xd035b103
neg ax
call fcn.1038fd6a
lea eax, [edx + edx + 0x443670ae]
mov ax, word ss:[ecx + edx - 0xba80]
mov word [edi + edx*8 - 0x5d3fa], ax
call fcn.10416616

Function at 0x103bfbde
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, ebp
adc eax, edx
push 0xb89287b7
dec byte [esp]
mov dword [ebp - 4], eax
sal dword [esp], 0xf0
test ebx, ebx
push 0xc281691b
lea esp, [esp + 8]
je 0x10433c45
mov dword [esp + edx - 0xa79ae36], ebp
push ebx
sbb eax, edx
adc dl, dh
mov ebp, esi
ror dx, 0x21
mov ebx, eax
mov ebx, ecx
sete al
lea eax, [eax + edx*4 + 0xe96c31c]
btc edx, edx
mov edx, ebx
btr ax, ax
shl al, 4
btc ax, ax
shl edx, 2
rol al, 0x81
jae 0x1036f9a9
inc cx
mov dword [ebp + esi - 0x77b3b688], ecx
dec edx
mov dword [esp + ebp - 0x77b3b688], ebx
ret 0x10

Function at 0x103c984f
Capabilities:
Encode data using base64

Disassembly:
bt cx, 0xa9
lea ebp, [ebp + ecx - 0x3a]
cwde
rol ecx, 0x42
jae 0x10469216

Function at 0x103c9862
Capabilities:
Encode data using base64

Disassembly:
not edx
xor edx, 0x4125b2bb
or eax, dword [esp + ecx - 0x6f3064f1]
xor al, byte [esp + ecx - 0x6f3064ee]
pop ecx
inc edx
call fcn.102fc41d
Function at 0x103cfe56
Capabilities:
Encode data using base64

Disassembly:
inc ax
inc ecx
imul dx
ror ecx, 3
inc ecx
neg ecx
shr eax, 0x1d
xor al, dl
xor ecx, 0xf12bac97
imul ax
cwde
lea ecx, [ecx + edx - 0x10a453ed]
xor edx, ebx
sar eax, 0xb9
push eax
xchg ecx, eax
sbb edx, 0x940039b2
xor cx, cx
jnp 0x1032c734
not edx
dec edx
mov dword [esp + 4], 0x9d27c814
shl byte [esp + 7], 0x23
bts ecx, ecx
rol edx, 2
not edx
bswap edx
cwde
inc word [esp]
dec edx
pop ecx
shr byte [esp + 2], 0xc5
xor eax, ecx
xor ebx, edx
neg eax
not dword [esp]
or byte [esp + 1], ch
adc esi, edx
add eax, ecx
lea edx, [ecx + eax*8 + 0x5ab4ec35]
mov edx, dword [edx + edi - 0x5aa62c11]
adc edi, 7
jmp 0x103c001d

Function at 0x103d177b
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0x15290707
mov ax, word [edx + ebp - 0x15290707]
mov dword [esp + edx*2 - 0x2a520e0e], 0x2882f4a3
movzx ecx, byte [esp + edx*2 - 0x2a520e0e]
btc dx, dx
mov cl, byte [ebp + edx*2 - 0x2a520f0c]
shr ax, cl
lea ecx, [edx + edx + 0xd2fde06]
xchg dword [esp + edx*2 - 0x2a520f0e], ecx
mov word [ebp + edx - 0x15290785], ax
shr ecx, cl
xchg dword [esp + edx - 0x15290787], ecx
mov edx, dword [esi + edx - 0x15290787]
pop ecx
push ecx
sar cx, 0xe1
lea esi, [ecx + esi - 0x5102f46]
movzx eax, word [esp + ecx*2 - 0xa205e94]
btc ecx, ecx
xor edx, ebx
bt eax, ecx
bswap edx
dec edx
dec cx
pop ecx
bswap eax
bswap edx
cbw
ror eax, 0x61
neg edx
xor ebx, edx
add edi, edx
lea edx, [ebp + ecx - 0x5105e92]
btc ecx, eax
bswap ecx
mov dword [ebp + eax - 0x4a2f0002], edx
shl cl, cl
movzx edx, cx
shr dx, 0x63
lea ebp, [ebp + edx*8 - 0x10a2]
mul cx
jae fcn.104769e1
clc

Function at 0x103d78a3
Capabilities:
Encode data using base64

Disassembly:
pop ecx
mov dword [edi + eax*4 - 0x344dc], edx
dec dword [esp + eax - 0xd137]
pop edx
jp fcn.10315919

Function at 0x103d8032
Capabilities:
Execute syscall

Disassembly:
pop esi
call fcn.103d54cb
syscall
call fcn.103e697e
xor eax, eax
xor ecx, 0x33207a03
call fcn.1036d58e
dec eax
mov dword [esp + esi*2 - 0x17c], 0x181f4335
dec ebp
lea esi, [eax + edi*2 + 0x7803603f]
dec esp
mov dword [esp + esi - 0xae], ecx
jmp 0x103a21a1
Function at 0x103d8f3a
Capabilities:
Encode data using base64

Disassembly:
imul ax, ax
call fcn.10489daa
push 0x6d2be1b9
mov dword [ebp - 4], eax
test ebx, ebx
push 0x919b02a4
lea esp, [esp + 0x1c]
je 0x103eec3e
mov eax, 0x1c995f15
call fcn.1049b847
mov eax, 0x4153e07
mov eax, dword [eax + edi - 0x4153e07]
mov ecx, 0xba90109b
add edi, 4
lea edx, [ecx + ecx + 0x5a006b00]
dec ecx
bswap edx
xor eax, ebx
bswap eax
bt cx, dx
and cx, dx
xadd cx, dx
lea eax, [eax + edx*4 - 0x1215b496]
ror eax, 1
bt ecx, edx
push edx
xor eax, 0xf688029d
ror dl, 0x24
sbb ecx, edx
xor ebx, eax
sub dx, 0xa727
rol ecx, 0xae
and dword [esp + edx*2 - 0x6d18b302], ecx
adc esi, eax
shl dl, cl
ror dword [esp + ecx - 0x82c2101], 0x84
movzx eax, byte [esp + edx - 0x368c5902]
mov ecx, dword [ebp + ecx*8 - 0x41610808]
mov edx, dword [ebp + eax*2 + 4]
lea ebp, [ebp + eax*2 + 8]
sar dword [esp + eax*8], 0xf5
call fcn.1046e580
mov eax, dword [ebp]
call eax
mov edx, 0xaeac3e8e
movsx ebx, dx
lea edi, [edx + ebx*8 + 0x6b1e6837]
mov ebp, dword [ebp + ebx - 0x3e92]
shl ebx, 0xa3
adc edx, 0xc7966f34
js 0x102ee57f
mov dword [edx + ebp - 0x7642adc2], eax
movzx ecx, dx
lea esi, [edi + 0x52b0e505]
xchg esi, ebx
pop ebx
bts edi, edx
sal dl, 0xc4
call fcn.103ef7b9
inc ecx
mov ebp, 0x833fe786
inc ebp
movsx esp, bp
dec edx
lea edi, [0x44b3fbb2]
dec eax
sub ebp, 4
dec esp
lea esi, [edi - 0x246d845c]
inc esp
mov eax, dword [ebp]
movzx ecx, di
movzx eax, cx
inc ebp
xor eax, ecx
movsx esi, cx
inc ebp
movzx ebx, ch
inc ecx
or esp, 0xe03e66b5
inc ecx
ror eax, 2
add si, 0xc69e
sal si, cl
inc esp
and esi, eax
inc ecx
inc eax
inc ecx
xor eax, 0xc5273d33
inc ecx
dec eax
dec eax
bts edi, eax
inc cx
bts ebp, 0x1d
inc ecx
rol eax, 3
inc ecx
push ecx
inc ecx
movsx edx, ah
sub cx, 0x27ba
dec ebp
add ebp, ebp
inc esp
xor dword [esp + ecx*4 - 0x1c840], eax
inc ecx
pop ecx
inc esp
movsx edx, ax
dec ebp
arpl ax, ax
dec ecx
btc edx, 0xba
bt cx, 0x96
dec ebp
bt edx, esp
dec ecx
adc ebx, eax
inc esp
and ebp, ecx
dec ebx
mov edi, dword [edi + ebp*2 - 0x8400]
dec ebp
mov esi, dword [ebp + edi - 0x4200]
dec ecx
lea edi, [ebx + edx*8 - 0x4a7953fd]
inc esp
add ah, al
dec edi
mov dword [edi + ebp*2 - 0x8400], esi
cwd
jmp ebx
Function at 0x103dc052
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [edi + edx*8 - 0x4b0]
sub edx, edx
adc edx, edx
xor ecx, ebx
add ecx, 0xa5106d30
neg ecx
movzx eax, dl
shr al, 0x67
xchg dx, ax
inc ecx
ror ecx, 1
or ax, ax
lea eax, [edx + edx*4 - 0x48534ec2]
xor ebx, ecx
sal edx, 0xed
adc ebp, ecx
dec dl
btc ax, dx
mov eax, dword [edx + esi - 0xff]
shl edx, 0xa9
lea edx, [edx + edx*4 - 0x1ac83271]
mov cl, byte [esi + 4]
dec edx
bt edx, 0x32
adc esi, 2
shl eax, cl
call fcn.104b32c9
shr byte [esp + ecx + 2], 0xa1
lea edi, [edi + ecx - 4]
push ecx
mov eax, dword [edi + ecx*2]
bts edx, edx
xor eax, ebx
ror dword [esp + ecx*4 + 3], 0x4b
sar ecx, 0x1c
rol edx, 0xfc
not eax
lea eax, [eax + edx*2 - 0xe84374a]
not dword [esp + edx - 0x39477ffc]
bt dx, dx
shr byte [esp + edx - 0x39478000], 4
neg eax
shl dword [esp + edx - 0x39477ffc], 0x23
neg dl
setbe dl
lea eax, [eax + edx*2 + 0x721adb34]
push ecx
inc dword [esp + edx - 0x39477ffb]
xadd edx, ecx
xor ebx, eax
sal dword [esp + ecx*2 - 0x728f0000], cl
lea ecx, [ecx*8 + 0x6f2b6732]
jae 0x1046f0dd
jmp 0x103e88d3
lea esp, [esp + 0x1c]
jne 0x104b81ec
pop esi
mov edx, 0x919fd28f
shl edx, 0x13
movzx ecx, dl
not eax
setne dl
rol ecx, 0xd5
push edx
mov dword [esi + ecx], eax
ja 0x103d791a
xor dx, cx
adc ebp, eax
movzx ax, byte [esi + edx - 0x3417]
mov cl, byte [esi + edx*4 - 0xd05a]
lea esi, [esi + edx*2 - 0x682c]
sub edx, edx
not al
call fcn.10411d14
adc ebp, eax
add dword [esp + edx - 0x39478001], ebp
ret 8
mov esi, 0x713d881
not si
movzx esi, byte [edx + esi - 0x713277e]
call fcn.103c12ec
sub edi, 4
movzx edx, cl
and edx, ecx
jae 0x10389d59
ror ecx, 1
dec edx
pop eax
bts ax, 0x2c
neg ecx
xchg edx, eax
rol ecx, 2
call fcn.102f2ba2

Function at 0x103df5a2
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x52d12129], ecx
dec dword [esp + ecx - 0x52d12125]
not eax
or ecx, edx
jne 0x1048f49a

Function at 0x103df5ba
Capabilities:
Encode data using base64

Disassembly:
add ebp, edx
movsx edx, ax
movzx eax, byte [edi + edx - 0x383f]
btr ecx, ecx
ror dl, 0xe5
mov dword [esp + ecx - 0x7fffffff], 0x6d96fb17
lea edi, [edi + edx*8 - 0x1c7c7]
xor al, bl
sal ecx, cl
sub edx, 0xcdb7c0a8
and dl, 0x8d
not al
dec byte [esp + ecx - 0x7fffffff]
rol dword [esp + ecx - 0x80000000], 0x79
pop edx
rol al, 1
sub al, 0x2a
dec edx
btr dx, dx
setae dl
not al
btc dx, cx
ror al, 1
bt ecx, edx
sar cl, 0x23
neg al
and cl, dl
lea edx, [ecx + edx*2 + 0xdb976b4]
xor bl, al
and dl, 0x84
adc eax, esp
or cl, dh
sub edx, 0x2b8eb607
mov cx, word [eax]
bt edx, 0x2e
mov eax, edx
xor edx, eax
lea esi, [edx + esi - 2]
mov word [esi + edx*8], cx
mov ecx, eax
jbe fcn.10440eae
Function at 0x103e1755
Capabilities:
Encode data using base64

Disassembly:
shl cx, 0xc6
xor edx, ebx
lea eax, [ecx - 0x417f27ff]
btc cx, 0xe
mov dword [esp + eax - 0x3087d7c1], eax
ror edx, 3
neg eax
not edx
xor edx, 0x9248713
shl ecx, 0x8e
shl cl, 0x81
shl cl, 0x47
ror edx, 3
or cx, 0xa131
inc cl
add ecx, eax
not edx
not dword [esp + ecx - 0x7f68c96d]
imul ecx, ecx
btc ecx, ecx
lea edx, [edx + ecx*2 - 0x41861891]
sar cl, 0xc4
call fcn.103ce4d2
mov eax, 0xaab5c719
mov cx, word [ebp]
movzx edx, byte [esi]
ror eax, 0x77
ror eax, 0xf2
xor dl, bl
xor dl, 0x21
xor eax, eax
shr eax, 0x4e
adc ax, 0x1816
adc dl, 0x98
lea eax, [eax + eax*2 + 0x788c9f80]
not ax
not dl
inc ax
rol dl, 1
inc eax
sub dl, 0x80
xor bl, dl
rol eax, 0xd3
adc edx, esp
or eax, eax
xor eax, eax
push eax
mov byte [edx + eax*2], cl
shr eax, 0x2b
movsx edx, ax
or edx, dword [esi + eax*2 + 1]
rol eax, 0x23
lea esi, [esi + eax*4 + 5]
push eax
xor edx, ebx
and dword [esp + eax*8 + 3], eax
add dword [esp + eax + 4], eax
bswap edx
jno 0x103f81a8
add ax, ax
mov ax, word [edi + eax - 0x26]
sub word [esp], 0x570e
pop ecx
mov cl, byte [edi + ecx - 0x82f994]
call fcn.1046e3e9
mov esi, 0x55bf5b3e
inc eax
movsx ecx, dh
dec eax
lea ebp, [ebp + ecx*2 - 0x80]
inc esp
movzx esp, dh
mov ecx, dword [ebp + ecx - 0x3e]
dec ebp
and esp, esp
call int.1037a3f2
xor eax, ebx
mov edx, ecx
sub eax, 0x5138df19
neg dl
shr dl, 0x83
bswap eax
add cx, dx
rol eax, 2
dec eax
jmp 0x103da202
dec edx
or byte [esp + eax + 2], al
bswap eax
sub dword [esp + eax*8 + 4], eax
bswap edx
lea ecx, [eax*2 - 0x54d971f5]
mov word [esp + eax*8 + 5], ax
neg edx
xor ebx, edx
pop eax
add edi, edx
cbw
mul byte [esp + eax*2]
lea ecx, [eax + ebp + 2]
or al, ah
call fcn.103af57c

Function at 0x103e2655
Capabilities:
Encode data using base64

Disassembly:
mov word [edx], ax
mov ecx, dword [edi - 9]
adc edi, 0xfffffff7
pop edx
xor ecx, ebx
neg edx
imul dx, word [esp + 1]
shl dx, 1
dec ecx
add byte [esp + 2], 0xae
mov eax, 0xbbb022e
ror ecx, 1
mul edx
jo 0x102c9eb5
dec cx
mov dword [esp + ecx - 0x7d9e5138], ecx
xor dl, bl
xor word [esp + ecx - 0x7d9e5136], 0xe589
dec dl
mov dword [esp + ecx - 0x7d9e513c], ecx
ror dl, 1
ror ecx, 0x46
sal cx, 0x43
not word [esp]
not dl
sbb ecx, ecx
dec word [esp + 2]
sub dl, cl
rol word [esp], 0x43
inc dword [esp]
sar dword [esp], 0x64
xor bl, dl
shl cl, 0x46
dec cx
lea edx, [esp + edx + 8]
and word [esp + 5], 0xf328
ja 0x10332d2a
mov dword [edi + 0xc], eax
mov eax, 0x1226e09a
push eax
mov dword [edi + eax*4 - 0x489b8260], ebx
mov dword [edi + eax - 0x1226e096], ecx
add eax, eax
sar dword [esp + eax*2 - 0x489b8268], 0x9d
mov dword [eax + edi - 0x244dc134], edx
movsx ebx, ax
movsx edx, bx
mov ebx, dword [esp + eax*2 - 0x489b8264]
pop eax
pop edx
jp fcn.10315919
Function at 0x103e2933
Capabilities:
Encode data using base64

Disassembly:
mov eax, ecx
lea edi, [ecx + edi - 0x43890b24]
mov dword [esp + eax - 0x43890b28], 0x6417be38
sar ax, cl
cwde
xor edx, ebx
bt ecx, 0xbe
mov dword [esp + eax*2 - 0x16], eax
rol dword [esp + ecx - 0x43890b28], cl
lea edx, [ecx + edx + 0x70791a89]
add eax, eax
ror edx, 3
dec word [esp + ecx - 0x43890b28]
not edx
jge 0x103f5924
and dword [esp + eax - 0x16], 0xc48ca21d
dec edx
call fcn.102d32ff
movzx dx, byte [edi]
mov eax, 0xd6143c93
mov al, byte [edi + 2]
mov ecx, 0xb2ae690b
add edi, 2
sar ecx, cl
adc cx, cx
adc dl, al
lea eax, [ecx - 0x2bfa7154]
bt ax, 0x95
and eax, eax
mov word [edi], dx
jae 0x1035b588

Function at 0x103eed55
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, 0x5e91058e
jmp 0x10368461
push 0x5db04b97
dec edx
lea esp, [esp + 0x10]
jne 0x1037d759
mov ebx, 0xd7393401
lea ebx, [ebx + 0x3f0a18a9]
lea edx, [ebx + ebx*2 + 0x7f83001a]
pop ebx
ror word [esp + 8], 0xab
jae 0x102d2eb3
add edi, 5
pop edx
lea eax, [edx*4 - 0x73590cca]
sar dx, 0xb
xor cl, bl
ror eax, 0x99
not cl
cbw
rol cl, 1
sub cl, 0x2a
neg word [esp + edx - 0x359ffff3]
not cl
sbb dword [esp + edx*2 - 0x6b3fffe5], edx
ror word [esp + edx - 0x359ffff1], 0xcb
ror cl, 1
neg cl
shr dx, 0xcd
pop eax
xor bl, cl
or dword [esp + edx - 0x359f0003], edx
lea ecx, [esp + ecx + 8]
mul edx
add word [esp + edx*4 - 0x480e7e82], dx
xchg word [esp + edx*4 - 0x480e7e7e], dx
or ax, word [ecx + edx - 0x1203ffff]
rol byte [esp + edx - 0x1203fff8], 0xa1
mov word [edx + esi - 0x1203fffd], ax
lea esi, [esi + edx*4 - 0x480ffffa]
ror dword [esp + edx - 0x1203ffff], 0x34
dec dl
mov dword [esp + edx - 0x1203fffe], ebp
ret 4

Function at 0x103eef03
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov eax, dword [edi]
adc edi, 4
xor eax, ebx
btc dx, 0x14
movsx ecx, word [esp + 4]
jb 0x103fac66
inc ebp
cmp eax, 0xfcb94d3e
sub al, 0x85
push es
adc bl, byte [ecx + 0x44]
invalid
lea eax, [eax + ecx*8 - 0x69ba6065]
pop edx
add edx, 0xfffd3202
jmp edx

Function at 0x103f059d
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop ebx
inc ecx
pop esp
pop eax
jne fcn.1040c813
mov eax, 0x1c80cf8d
call fcn.103ec4b5
dec eax
lea ebp, [eax + ebp - 0xd0]
inc ecx
shr dl, 0x81
dec ecx
xor esi, ecx
dec esp
mov dword [esp + eax*4 - 0x30c], ebx
inc ecx
shl eax, 1
dec ecx
btr eax, eax
dec eax
xor esi, 0x4095d780
add dword [esp + eax - 0xbf], 0xac363e28
sal byte [esp + eax - 0xc0], 0xa1
dec eax
neg esi
push edx
cbw
dec eax
not esi
jmp 0x1041151e
dec eax
sub ecx, ecx
dec eax
dec esi
push edi
jmp 0x104af777
inc ebp
movzx ebp, dl
dec esp
xor ecx, esi
shl cl, 0xc1
dec ecx
mov dword [edi + eax - 0xffc9], esi
cwd
dec ebp
lea edi, [edi + eax*4 - 0x3ff12]
inc esp
and ebp, eax
jge 0x1031f53b
mov dx, word [ebp]
mov eax, 0x16b40591
movzx ecx, byte [edi + eax - 0x16b40591]
or al, 0x30
xor cl, bl
neg ax
neg cl
not eax
push eax
bswap eax
dec cl
call fcn.10350937
Function at 0x103f232d
Capabilities:
Encode data using base64

Disassembly:
or al, dl
btc ecx, ecx
mov edx, 0xb9979096
or word [esp + 2], cx
mov word [esi + 2], ax
lea edx, [esi + 2]
mov eax, ecx
shr ecx, cl
mov dword [esi + ecx*2 - 0x1f9fe], edx
lea esi, [esi + ecx*2 - 0x1f9fe]
mov edx, 0xdf006018
sar al, 0xa1
div dword [esp + ecx*2 - 0x1f9fc]
mov eax, dword [edi + ecx*2 - 0x1fa00]
lea edi, [edi + ecx - 0xfd02]
shr byte [esp + ecx - 0xfcfe], 0x64
bts dx, dx
shr edx, cl
xor eax, ebx
push edx
shl cx, 0xc6
inc edx
rol eax, 1
shr ecx, 0xd0
xadd byte [esp + ecx + 1], cl
not eax
shr dword [esp + ecx*4], 0x11
bswap eax
sar cl, 0x82
dec eax
pop edx
ror ecx, 0xc5
shr edx, 0x7c
neg eax
shr cx, 0xa6
xor ebx, eax
add ebp, eax
pop edx
jmp fcn.102d9ffd
setae dl
xadd word [esp + eax - 0x52a03b0b], ax
mov dword [esp + eax - 0x52a04652], esi
ret 0x10
neg eax
inc dl
push eax
mov dword [esp + 8], 0xbaa6192c
mov dword [esp + 4], eax
xor bl, dl
dec al
jo 0x1047b8d2
lea edx, [esp + edx + 0x10]
dec eax
mov byte [edx], cl
shr ax, 0x69
jp 0x1040f8ed
or word [esp + 0xd], 0x1000
movzx edx, byte [ebp + 5]
cwde
lea ecx, [eax + eax*4 - 0x32ec8ae4]
lea ebp, [ebp + eax*2 - 0x60]
neg eax
sar ecx, 0x21
xor dl, bl
bts ax, cx
neg ecx
xor dl, 0x20
add dl, 0x3b
ror ax, 0xe4
shr cl, 0x87
ror dl, cl
not ecx
inc eax
sub dl, 0xa8
xor bl, dl
btc eax, eax
setb byte [esp + 0xb]
lea edx, [esp + edx + 0x10]
btr cx, cx
mov cx, word [edx]
mul dword [esp + 0xa]
jae 0x103fa0fd
push eax
mov word [edi + eax - 0x52a03b0e], cx
jo 0x1039ce40
mov ecx, 0x14257d97
lea edx, [ecx + ecx*8 - 0x15f4266f]
btr edx, edx
movzx ax, byte [esi + ecx - 0x14257d97]
neg cx
ror edx, 0xf0
mov dl, byte [esi + ecx - 0x14258267]
imul ecx, ecx
sbb ecx, ecx
sbb cl, 0x32
not al
sub cl, cl
shr ecx, 0x86
bswap ecx
not dl
rol cx, 0x2c
push ecx
jp 0x102e20f6
mov eax, 0xf3b1109
test eax, 0x3e10970
push eax
dec ecx
add cl, 0x79
add edx, dword [eax + 0x49]
cwde
cdq
popal
add edx, dword [eax + 0x49]
mov al, byte [0x500369a0]
dec ecx
or byte [ecx], dh
pop ecx
add edx, dword [eax + 0x49]
js 0x1040fa2f
fld dword [ebx]
push eax
dec ecx
pop eax
cdq
adc dword [ebx], eax
push eax
dec ecx
mov al, 1
invalid
retf 0xa69c
or dx, 0xf513
or edx, edx
ror eax, 1
sal edx, 0xe8
rol ecx, 0x6c
lea eax, [eax + edx - 0x56a0e83c]
xor eax, 0xa8b4af9b
xor ebx, eax
add esi, eax
mov ecx, dword [edi + edx*2 - 0x5ee6e00]
lea eax, [edx + 0x3b0ce00e]
add edx, edx
add edx, 0x278fd0bc
mov ax, word [edx + ecx - 0x2d7e3ebc]
sal edx, 0x2b
jns 0x103f1661
adc edi, 1
sal dx, 1
mov ecx, edx
mov word [edi], ax
jmp esi
Function at 0x103f2b1e
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor ebp, 0x3e8b62a8
inc ecx
xchg al, al
inc esp
mov esi, esi
inc ecx
push ecx
dec esi
lea edx, [edi + eax*8 - 0x5846f849]
inc esp
xor dword [esp + edx*2 - 0x24690718], ebp
dec esp
lea ecx, [eax*4 + 0x43280623]
inc ecx
shl ebx, 0xc7
inc ecx
and al, 0xb1
inc ecx
pop ecx
inc ecx
shl esi, 0xfa
jp 0x10463a01
dec eax
sub ebp, 4
mov edx, 0x1234838c
mov ecx, 0x382d5280
inc esp
mov ebp, dword [ebp + edx*4 - 0x48d20e30]
inc ebp
xor ebp, ecx
inc ecx
rol ebp, 1
pop ecx
inc ecx
bswap ebp
dec eax
lea eax, [edx*2 + 0x4b917904]
inc esp
movsx ebx, ax
inc ebp
mov eax, ebx
inc ecx
neg ebp
dec ebp
lea edx, [ebx + eax*8 - 0x387698df]
inc ecx
push ebx
inc ebp
lea ebp, [ebp + edx - 0xb060ef2]
pop esi
inc ecx
xor ebp, 0xa306d63e
dec esp
xadd esi, ebx
inc ecx
mov esp, 0x5302c0a8
inc ecx
movzx edi, al
inc ecx
ror ebp, 1
jmp 0x103ce518
inc sp
btc eax, esp
dec ebp
arpl bp, bp
dec ecx
adc ebx, ebp
dec esi
mov esp, dword [eax + edi - 0x6ffa811c]
ror ax, 0xac
not di
inc bp
mov ebp, dword [edi + edx*2 - 0x24690710]
inc ebp
bts esi, eax
dec esi
lea edi, [edi + edi - 0xffd9]
inc bp
mov dword [esp + edi - 0xffe3], ebp
jmp ebx

Function at 0x103f6c4d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
call fcn.1040e2ef
jmp 0x10372d02
Function at 0x103f6e7b
Capabilities:
Encode data using base64

Disassembly:
call fcn.104909e1
add word [esp + eax - 0x3101fffe], ax
xor ebx, ecx
push edx
xchg edx, eax
add edi, ecx
or byte [esp + edx*2 - 0x6203fff9], ah
push eax
lea ecx, [edx + edx*8 + 0x3aaec22]
mov dword [esp + edx - 0x31020000], edi
ret 8
mov dword [ebp], eax
mov edi, 0xe2b12006
lea ebx, [edi*4 - 0x6cf74757]
pop ebx
lea edx, [edi - 0x4bfdf245]
pop edi
mov esi, edx
mov eax, edx
pop esi
lea ecx, [edx*4 + 0x548feeb9]
inc al
jmp edi
mov dword [ebp + 4], ecx
sbb dword [esp], 0x4335ae33
mov ecx, edx
sbb ebp, 0xfffffffc
btc ecx, edx
jae 0x103da52e
inc ecx
mov ebp, 0x6ba25d87
inc ebp
movsx edx, bp
mov edi, 0x269c508e
dec ebx
mov edi, dword [edi + ebp - 0x6ba25d87]
inc ecx
movzx ecx, ch
mov edx, 0x15b4e2a6
dec edi
lea edi, [edi + ebp - 0x6ba25d7f]
movzx esi, dx
jmp 0x103e0369
jae 0x103ded39
mov cl, byte [esi + 2]
mov edx, 0x2627661a
and dx, 0xbf84
lea esi, [edx + esi - 0x262725fe]
neg dl
sal ax, cl
mov ecx, edx
mov word [esi + ecx*2 - 0x4c4e4c00], ax
lea edi, [edi + edx - 0x26272604]
bts ecx, edx
add edx, 0x6b35453c
mov ecx, dword [edi + ecx*2 - 0x4c4e4c02]
push edx
movzx eax, dl
xor ecx, ebx
dec ecx
or eax, eax
neg ecx
cwd
imul dword [esp + eax*2 - 0x78]
call fcn.1039e6df
mov dword [ebp - 4], eax
sal word [esp], 0x86
sbb byte [esp + 2], 0x36
test ebx, ebx
push 0xe5015da5
lea esp, [esp + 8]
je 0x104909f5
mov eax, 0x80b25d88
rol ax, 0x68
neg eax
mov eax, dword [ebp + ebx*4]
push 0xf9a5d899
jno 0x102dfd79
mov ecx, 0x4e00e9b3
mov eax, ecx
movsx edx, cx
movzx edx, word [ebp + eax - 0x4e00e9b3]
add ecx, 0xb3055fa9
lea ebp, [ebp + ecx*2 - 0x20c92b6]
shr eax, cl
xchg cx, ax
inc ecx
xor dx, bx
shl eax, cl
rol eax, cl
xor ax, cx
rol dx, 1
xor cx, cx
inc dx
xor eax, eax
add ax, ax
not dx
rol dx, 1
xor ax, 0x1732
xor bx, dx
dec ecx
btr eax, eax
lea edi, [edi + ecx*4 - 0x417fffe]
shl eax, 8
neg al
mov word [ecx + edi - 0x105ffff], dx
ror ecx, 8
ror cx, 0xc9
mov ecx, dword [eax + ebp - 0x173200]
lea ebp, [ebp + eax*4 - 0x5cc7fc]
movsx edx, ax
jp 0x103f8171
pop eax
jmp esi
lea ecx, [edx*2 + 0x283de11a]
mov ecx, dword ss:[eax]
mov dword [esp], 0x4e90b586
neg dx
jns 0x1037104c
xor ebx, edx
cwde
cwde
sar ecx, 0xb0
adc esi, edx
shr eax, cl
sbb ecx, ecx
mul al
adc ecx, esi
jmp ecx
cbw
xor ecx, ebx
xor ecx, 0xa50a0825
sub ecx, 0xff035782
add dl, 0x3a
bswap edx
not ecx
sbb al, dh
sbb eax, eax
mul ax
neg ecx
btr ax, ax
xor ebx, ecx
rol eax, 0xbd
inc ax
cwde
adc esi, ecx
dec edx
and edx, edx
call fcn.10472731
mov eax, 0x5820df8a
lea eax, [eax + eax*8 + 0x2fbeb69f]
jmp 0x1049e453
mov eax, dword [ebp + eax - 0x48e69279]
push 0xdf3f1aa5
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
jmp 0x10343cb6