joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8c4e9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x8c4fee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x8c4fee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.008c4ff8
test eax, eax
je 0x8c4fee
add ebx, 0x28
dec ecx
jne 0x8c4fc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x8c509e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x8c50c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x8c512e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x8c50e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x8c512e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x8c5105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x8c512e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x8c5123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x8c512e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x8c516b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x8c5172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x8c51a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x8c51a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x8c5dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.008c5f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.008c5f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.008c5eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.008c5f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.008c5ecb
push ecx
push dword [ebp + 8]
call fcn.008c5f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.008c5f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.008c5ecb
push ecx
push dword [ebp + 8]
call fcn.008c5f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.008c5f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.008c5ecb
push ecx
push dword [ebp + 8]
call fcn.008c5f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.008c5f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.008c5ecb
cmp ecx, 0x2b
jne 0x8c5e0f
leave
ret 0xc

Function at 0x8c74b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x8c7544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x2f4810
push 0
call dword [eax + 0x20]
test eax, eax
je 0x8c75d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x2f4810
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x2f4810
call fcn.008c73fa
push 0x2f4810
push dword [ebp + 0xc]
call fcn.008c51a8
test eax, eax
jne 0x8c75b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x2f4810
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.008c75dd
test eax, eax
je 0x8c75d6
jmp 0x8c7574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x8c75d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x8c760b
Capabilities:
Terminate process

Disassembly:
call fcn.008c7618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x13e3208
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp], 0x23aceea2
call fcn.0199201d
mov ecx, 0x59d83ad
call fcn.019824af
Function at 0x13e4a0e
Capabilities:
Encode data using base64

Disassembly:
not ecx
inc eax
shr dh, 0xc4
inc ecx
pop esp
dec eax
add dword [esp + esi - 0x5d7cfe04], eax
rol ecx, 3
dec esp
mov dword [esp + esi - 0x5d7cfe04], ebx
xor dword [esp + esi - 0x5d7cfe04], ecx
shr byte [esp + esi - 0x5d7cfe07], 0xa2
dec eax
sub eax, 0xcfbca4af
sar word [esp + esi - 0x5d7cfe09], 0x82
dec esp
mov ebx, dword [esp + esi - 0x5d7cfe04]
dec eax
mov dword [esp + esi - 0x5d7cfe04], esi
dec eax
bts ebx, 6
dec eax
arpl cx, cx
cbw
movsx edx, bl
dec esp
adc edi, ecx
mov dl, byte [edx + ebp - 0x45]
not esi
dec eax
add ebp, 0xfffffffb
rol bl, 0x65
dec esp
xor eax, esi
inc ecx
xor dl, bl
inc dl
inc ecx
push eax
not dl
call fcn.0205450a
clc
cmc

Function at 0x13e4b65
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x20]
jne 0x20e52ea
mov edx, 0xc3029908
bt edx, edx
pop esi

Function at 0x13e529b
Capabilities:
Encode data using base64

Disassembly:
dec ecx
bswap edx
cbw
rol ax, cl
dec ebp
lea edx, [edx + edx*2 + 0x22545170]
dec ecx
xor edx, 0x413d9995
dec eax
xor dword [esp + edx*2 + 0xa], ecx
jae 0x19bc43a
neg si
inc esp
movzx edx, bl
add si, dx
inc ebp
movzx esi, dl
inc ecx
btr esi, edx
xadd dword [esp + ebx - 0xa89f], eax
ror si, 1
inc sp
xor ebx, esi
dec eax
lea ebx, [edx*4 - 0x7c43d65d]
dec edx
idiv dword [esp + edx - 0x9f]
dec eax
lea esi, [esp + esi + 0x18]
dec esi
mov dword [esp + edx*4 - 0x2b0], esi
sal dx, 0xe3
bswap ebx
inc ebp
mov dword [edx + esi - 0xac], eax
inc edx
ror dword [esp + edx - 0xa0], 0x36
dec eax
cdq
inc esi
mov esp, dword [ebp + edx*2 - 0x15e]
inc ecx
inc dh
pop ebx
shr dword [esp + edx + 0xc], 0xc2
inc ebp
xor esp, ebx
inc ecx
sub esp, 0xa4132d1b
inc ecx
neg esp
inc ecx
shr dh, 0xc6
inc esp
xor esp, edx
inc esp
sub esp, edx
inc esp
movzx ecx, dl
inc ecx
ror esp, 2
dec esp
mov dword [esp + edx + 9], ebx
mov ecx, dword [esp + edx + 3]
inc esp
btr ecx, ecx
inc esp
xor dword [esp + edx*2 + 0xa], esp
dec esp
mov ebx, dword [esp + edx + 9]
sal word [esp + edx + 3], 0xce
dec ebp
arpl sp, sp
dec ebp
adc edi, esp
cwde
inc ecx
mov esi, edx
dec eax
mov dword [esp + edx + 9], 0xdfa0e387
dec esp
mov edx, dword [ebp + edx*2 - 0xc]
dec eax
lea ebp, [ebp + edx - 0xd]
dec ebp
xor edx, ebx
dec esi
lea edx, [edx + edx + 0x767850d6]
rol dword [esp + edx + 3], cl
dec esi
lea esp, [esi*4 + 0x5d34088e]
dec ecx
ror edx, 6
and cl, 0xf
jno 0x13d713e
dec ecx
bswap edx
xchg ch, cl
push ebx
mul byte [esp + edx*8 + 0xc]
dec ebp
xor ebx, edx
inc byte [esp + edx + 3]
dec esp
lea ecx, [ecx - 0x5f5979fb]
dec esi
mov dword [edx + ebp - 3], edx
idiv byte [esp + edx*4 + 6]
dec eax
idiv dword [esp + edx + 0xb]
pop esi
dec esi
lea ebp, [eax + ebp - 2]
pop ecx
pop edx
jmp fcn.013d7167
Function at 0x13f0eed
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + 8], ecx
neg dl
not dl
add al, byte [esp + 0xa]
and al, byte [esp + 0xe]
ror ecx, 0x29
xor bl, dl
lea edx, [esp + edx + 0x10]
inc al
setp cl
add eax, 0x6933a327
mov cx, word [edx + eax - 0x6932a3f4]
mov word [edi + eax - 0x6932a3f8], cx
movzx ecx, ax
push eax
not ecx
lea edi, [edi + eax - 0x6932a3f8]
pop edx
pop edx
pop ecx
pop ecx
pop edx
jno fcn.020c2694
sysenter
call fcn.013f58fb
mov eax, 0xb634ef9b
mov ax, word [edi]
mov edx, 0x250568aa
movzx edx, byte [edx + esi - 0x250568aa]
mov ecx, 0x3615601b
xor dl, bl
sar ecx, cl
call int.01976ca6

Function at 0x1974357
Capabilities:
Encode data using base64

Disassembly:
push 0xd7986008
lea esp, [esp + 0x10]
call eax
mov ecx, 0x3e13b50c
mov ebp, dword [ebp + ecx - 0x3e13b510]
or cl, 0xbc
mov dword [ebp + ecx - 0x3e13b5bc], eax
push ecx
mov edi, ebp
sal dword [esp + ecx*2 - 0x7c276b78], cl
mov ebx, dword [esp + ecx - 0x3e13b5b8]
movzx esi, cx
mov dword [esp + ecx*2 - 0x7c276b74], esi
mov ebp, dword [esp + ecx - 0x3e13b5b4]
mov esi, dword [esp + esi*8 - 0x5add4]
mov dword [esp + ecx*2 - 0x7c276b70], ecx
rol ecx, 0xd4
rol word [esp + ecx - 0x5bc3e135], 0x25
mov eax, dword [ecx + esi - 0x5bc3e13b]
lea edx, [ecx + ecx*4 - 0xcf816ca]
lea esi, [esi + ecx - 0x5bc3e137]
jae 0x20f106d
js 0x19bd267
adc dl, 0x2a
xor eax, ebx
ror dl, 0x64
btr ecx, 0xa2
lea ecx, [edx + edx*2 + 0x1121779e]
bswap eax
mov dword [esp + ecx - 0x4ab36601], 0xfbb05314
jb 0x20a1861
not eax
dec eax
jmp 0x20d0183

Function at 0x197d091
Capabilities:
Authenticate hmac

Disassembly:
pop edx
mov al, byte [edi + eax*2 - 0x3c5c110e]
mov edx, 0x828f593e
add edi, 2
Function at 0x198b2f6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
movsx esi, dx
inc esp
xadd bh, cl
dec ebp
lea ebp, [ebp + eax*2 - 0x1ff24]
push eax
inc ebp
mov dword [ebp + eax*2 - 0x1ff20], esp
inc ebp
btc esi, eax
dec eax
neg eax
mov word [esp + ebx - 0x74b34c87], di
inc ecx
pop eax
inc ecx
pop esp
pop edi
pop ebx
pop eax
jno fcn.013d7167
mov ecx, 0x8f90d8a8
lea eax, [ecx + ecx*8 - 0x217ce5e8]
mov edx, dword [esi]
jmp 0x20a58dc

Function at 0x1996113
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call 0x206365b
fdivr dword [ebp + 0x44]
or ebx, ecx
push cs
pushfd
mov dh, bh
jo 0x1996182
and eax, 0xf5f842a4

Function at 0x199e10b
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov dword [ebp + edi - 0x692b0fa0], eax
inc ecx
push esi
dec eax
lea ebp, [ebp + edx - 0xfa4]
pop ecx
inc ecx
mov esp, 0x5029488a
inc cx
dec esp
inc esp
mov esi, dword [edx + ebp - 0xfa0]
pop esi
inc ebp
xor esi, ebx
inc ecx
xor esi, 0xdbb76888
inc ecx
rol esi, 1
inc ecx
not ecx
sar dx, 0x8d
inc ecx
inc esi
inc sp
xor eax, edi
inc ecx
xor esi, 0xd2a95381
inc ecx
push ebx
call fcn.020ae802
push 0x4a
pop esi
jle 0x199e116
push eax
push ss
adc dword [ebp - 0xe], 0x33
cmp al, 0x5e
adc dword [ebp - 0xe], 0xfffffff3
xor al, 0x5a
adc dword [ebp - 0xe], 0xffffffe7
add word ss:[ebp - 0x6e6c71be], 0xff99
mov ch, 0xc0
daa
add al, byte [ebp - 0x753b5d64]
sbb dword [ebp + 0x38c9b1f0], esp
push esi
sbb bl, ah
hlt

Function at 0x19b2d12
Capabilities:
Encode data using base64

Disassembly:
and edx, 0xff
dec eax
mov dword [esp], 0xa8aae10f
sal word [esp + 8], 0xea
dec eax
rol dword [esp + 3], 0x5b
inc ecx
mov edx, dword [ebx + edx*4]
jnp 0x198b592
inc ecx
shr ecx, 8
inc esp
xor ecx, edx
call fcn.019c4f00
mov eax, 0xb6009d9d
lea eax, [eax*8 - 0x3759cadd]
mov eax, edi
sub edi, 2
mov ecx, 0x392a7e3d
push ecx
mov word [edi + ecx*2 - 0x7254fc7a], ax
mov edx, dword [esi + ecx*2 - 0x7254fc7a]
movsx eax, cx
xadd eax, ecx
lea esi, [ecx + esi - 0x7e39]
sar dword [esp + ecx*2 - 0xfc7a], 0x3a
setb byte [esp + eax*2 - 0x7255f8f4]
pop ecx
xor edx, ebx
sub edx, 0x9c105414
inc ax
sal cx, 0xe2
btr ax, cx
neg edx
dec cl
sub edx, 0xfb2f722c
neg edx
not al
rol cx, 0x2c
xor ecx, eax
lea edx, [ecx + edx + 0x36fbec1d]
xor ecx, ecx
bswap edx
sar al, 0x43
or eax, eax
rol ecx, 0xd5
xor edx, 0x963a2716
Function at 0x19b44f7
Capabilities:
Encode data using base64

Disassembly:
inc dx
dec ecx
or esp, 0xf93689ad
inc di
mov eax, dword [esp + esi + 0x6c80401]
dec edi
lea ebp, [ebp + 0xd900800]
inc edx
sal dword [esp + 0x6c80413], cl
inc di
mov dword [esp + ebp + 0x6c80401], eax
dec edx
mov dword [esp + 0x6c80401], 0xc19c4eb2
inc ecx
pop eax
inc ecx
pop eax
inc ecx
pop edx
jne fcn.013d7167
fdiv qword [ecx + 0x54]
cmp bh, bh
push ds
mov dword [ecx + 0x227d73c5], edi
enter 0x194a, 0xffffffffffffff91
loope 0x19b45a2
push esi
push ebp
dec eax
sub ebp, 4
inc ecx
mov esp, 0xf01315b3
dec ebp
lea esi, [esp - 0x1ce120db]
mov eax, dword [ebp]
inc ecx
dec esi
inc ecx
movzx ecx, si
inc ebp
movzx edx, dh
inc ecx
xor eax, ebx
neg eax
dec ebx
lea edi, [edx + esi - 0x4f7a1057]
shr cl, 0xe1
lea eax, [ecx + eax + 0x5855732]
ror eax, 3
neg eax
jmp 0x2060140
fsub dword [ebx + 0x400b8]
add byte [ebx - 0x2f48f006], cl
dec eax
lea edx, [edi*2 - 0x77dc68dc]
inc eax
call 0x20b66c3
add eax, 0x44c74800
dec eax
mov dword [esp], 0x2979b1c1
call fcn.020b6f53
push 0x6e
loope 0x20601a6
and al, 0
sal dword [ecx - 0x917d687], 0x6d
add eax, 0xe16e6a00
inc ebp
cmp byte [edx - 0x62], ch
pop edx
loop 0x206014c
sbb dl, bl
into
pop edx
loop 0x2060152
push 0xe25a0e57
in eax, 0x64
ljmp 0x250f
ja 0x2060160
add ah, ch
popfd
mov ch, 0x2b
or esp, ebx
push ecx
int 0x75
in al, dx
ja 0x2060141
xchg edx, eax
xchg byte [edx - 0x4a], cl
daa
and ecx, ecx
jg 0x206014f
div dword [edx - 0x809539f]
push eax
scasb al, byte es:[edi]
test dword [edi + 0x6e], esp
salc
adc bh, bh
invalid
Function at 0x19c9947
Capabilities:
Encode data using base64

Disassembly:
inc cx
inc edx
inc cx
xor edx, 0x41665831
add edx, 0xb8bb5839
push edx
lodsd eax, dword [esi]
sbb eax, dword [eax + 0xf]
mov esi, 0x348d4cce
dec ebp
cmp ebx, esp
aaa
pcmpgtd mm0, qword [ecx - 0x7f]
mov esp, 0x33456600
fimul dword [ecx - 0x73]
mov word [esi + 0x3d3de10a], cs
push ecx
inc eax
inc dh
dec esi
lea edx, [esp + edx + 8]
dec eax
lea edi, [ecx + ecx*2 - 0x794ee856]
shr cl, 0x21
inc cx
movzx edx, byte [edx + esi - 0x10255fb5]
or dword [esp + esi - 0x10255fb2], 0xb03b172c
dec ebp
lea ebp, [ebp + esi*2 - 0x204abf6c]
dec eax
inc dword [esp + esi - 0x10255fb5]
xadd ebx, ecx
inc dx
mov dword [esi + ebp - 0x10255fb5], edx
dec eax
lea ebp, [ebp + esi*4 - 0x40957ed8]
shr bl, 0xe1
dec ecx
lea edx, [esi + edi*8 + 0x619ce7bc]
mov edx, dword [ebp + esi - 0x10255fb5]
call fcn.0198d12c
inc ecx
mov esp, 0xe30ae198
dec edx
lea esi, [0xd1215da0]
inc esp
movzx edx, si
dec ebx
mov esi, dword [edx + ebp - 0x6a60]
dec ebx
mov eax, dword [ebp + edx - 0x6a58]
inc ebp
movsx ecx, ah
call fcn.02079ea8
neg dl
sub dl, 7
mov ecx, 0xa9f3285
imul cx, cx
add cl, cl
neg dl
xor bl, dl
call fcn.020efbe8
mov eax, dword [esi + ecx*2 - 0x622eee42]
mov dword [esp + ecx*2 - 0x622eee3e], ecx
sal word [esp + ecx - 0x3117771b], 0x86
rol cl, cl
lea esi, [ecx + esi - 0x3117773e]
xor eax, ebx
lea edx, [ecx + ecx*2 - 0x27510c7c]
shl ecx, cl
inc eax
inc cx
not ecx
ror eax, 1
not dl
neg eax
btr cx, cx
sal dword [esp + ecx*2 - 0x77444568], 0x61
lea eax, [eax + ecx*4 - 0x7e49b821]
sub edx, 0x52887ca7
not eax
mov dword [esp + ecx*2 - 0x7744456c], 0x303bdab6
xor ebx, eax
push edx
add dx, dx
not edx
add ebp, eax
movsx eax, byte [esp + ecx*2 - 0x77444566]
inc word [esp + ecx*2 - 0x77444568]
mov edx, dword [edi + ecx*2 - 0x7744456c]
or cx, 0x3423
mov eax, dword [edi + ecx*2 - 0x77446d6a]
sbb word [esp + ecx - 0x3ba236b7], 0x209d
movzx edi, cx
adc edx, eax
sal byte [esp + edi - 0x36b4], 0xc3
lea eax, [ecx + ecx - 0x7adb2e54]
jae 0x20e22e8
mov edi, edx
inc ax
add eax, eax
pop eax
pop edx
pop ecx
jle fcn.020c2694
dec eax
sub ebp, 2
mov esi, 0x10255fa4
inc esp
movzx edx, word [ebp + esi - 0x10255fa4]
inc bp
xor edx, ebx
bts esi, esi
inc cx
not edx
inc cx
neg edx
jmp 0x13f6fda

Function at 0x19cacda
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x8aa317fe
call fcn.0209c304
sar ecx, cl
neg cx
mov word [edi + ecx*4 - 4], dx
push ecx
rol dword [esp + ecx], 2
bswap ecx
lea edi, [edi + ecx - 4]
dec ecx
mov edx, 0x5a218d00
pop ecx
jp fcn.020c2694
Function at 0x19cc0d3
Capabilities:
Encode data using base64

Disassembly:
not ecx
mov eax, dword [esi + edx*8 + 4]
mov dword [esp + edx], 0xd09a21a2
sar ecx, 0x4d
lea esi, [esi + edx*2 + 8]
inc cx
seto dl
push edx
xor eax, ebx
imul edx, ecx
inc dx
dec cx
sbb eax, 0xd3106186
dec word [esp + edx + 4]
bswap ecx
rol eax, 3
or ecx, edx
push ecx
seta byte [esp + edx*4 - 1]
xor eax, 0x69ae6a96
and word [esp + ecx - 0x10000f8], dx
pop ecx
sbb eax, edx
shr word [esp + edx + 4], cl
sal dword [esp + edx], cl
sub cl, 0xa1
bswap eax
ror word [esp + edx*2 + 2], 0x8a
adc eax, 0xf002fd02
btc edx, edx
not eax
inc word [esp + edx - 3]
ror dword [esp + edx - 3], 0xc6
xor eax, 0xc28de834
imul ecx, ecx
bt edx, edx
pop edx
not eax
shl edx, 0x57
xor ebx, eax
neg byte [esp]
shl word [esp + 2], 0xa9
btc cx, dx
mov dword [edi - 4], eax
pop edx
bts edx, edx
lea edi, [edi + edx - 0x1105]
bts dx, dx
lea eax, [ecx*8 + 0x8a889a3]
dec dl
jnp fcn.020c2694
dec ebx
mov dword [ecx + ebp - 4], ecx
inc edx
sal dword [esp + ecx*2 + 2], 0x74
dec edx
xadd dword [esp + ecx], esi
dec edi
lea ebp, [ebp + ecx - 4]
inc si
xadd dword [esp + ecx + 4], ecx
neg esi
inc ecx
pop esi
jle fcn.013d7167

Function at 0x19d2920
Capabilities:
Encode data using base64

Disassembly:
push 0xa50dbf32
dec ebx
push 0x4206ceb5
lea esp, [esp + 0xc]
jne 0x13e53fa

Function at 0x19d7a76
Capabilities:
Encode data using base64

Disassembly:
jmp ebp
lea edx, [edx + eax + 0x521d738]
bswap eax
bt ecx, 0x2c
jae 0x2045532
mov ebp, 0x6f2618ad
dec esp
lea edx, [ebp + ebp*4 - 0x72fa91c7]
inc ecx
movsx ebx, dx
dec ecx
mov esp, ebp
movsx ecx, bl
dec ecx
lea ecx, [edx + 0x4ca7beb0]
pop ebx
inc ecx
pop ecx
inc sp
bt ecx, edx
inc esp
mov esi, ecx
inc ecx
imul ebp, esi
popfd
pop ecx
inc ecx
xchg dh, ch
dec esp
lea esp, [ebp + ebp - 0x38dd3ddf]
inc ecx
pop eax
inc ecx
movzx eax, si
inc ecx
pop ebp
call fcn.02047ad5
call fcn.02048ddc
mov edx, 0x5c0a5e99
shr edx, 0x51
mov edx, dword [esi + edx - 0x2e05]
sbb esi, 0xfffffffc
mov ecx, 0x6b1ca303
xor edx, ebx
mov eax, ecx
xor ax, cx
dec ax
inc edx
dec eax
ror edx, 1
sub al, 0x8f
rol ax, cl
neg edx
jmp 0x19d03ef
not edx
sar ecx, 0x70
xor ebx, edx
add ebp, edx
mov edx, dword [edi + eax - 0x7ffb1c6b]
shr cx, 0x4c
ror ax, cl
shr al, 0xc1
mov eax, dword [edi + ecx*2 - 8]
add edx, eax
lea eax, [ecx + ecx*4 - 0x2dc65e4a]
or ax, 0xd093
xor ecx, eax
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
push 0xb02d362f
div ecx
neg word [esp + 2]
mov ecx, 0xc35a305
mov dword [edi + ecx*8 - 0x61ad1820], edx
pop ecx
not ecx
mov dword [edi + ecx + 0x4fd3363c], eax
movsx eax, cx
cdq
idiv ax
lea edi, [edi + ecx + 0x4fd33638]
jmp 0x198d4b6
Function at 0x203ba30
Capabilities:
Encode data using base64

Disassembly:
dec ebp
lea ecx, [eax - 0x20e991c9]
inc edx
lea edi, [edi + ecx*4 - 0x52fed0ee]
dec esp
lea edx, [esi + edx - 0x57cc7c62]
rol edi, 1
inc ecx
sub edx, 0x6e805a1f
inc ebp
movsx esp, dl
inc cx
sar ecx, 0x48
inc edi
mov ebx, ecx
dec ebx
bts cx, 7
bswap edi
inc ecx
push ebx
xor dword [esp + edx - 0x7a125803], edi
dec esp
and eax, esi
jg 0x19ca4f4
mov edi, dword [ebp + ecx*2 - 0x63a38986]
inc ecx
xor edi, ebx
inc ecx
movzx esi, al
dec esp
lea esi, [edx + edx - 0x3c46695e]
btr esi, edx
bswap edi
inc ecx
add cl, dh
inc ecx
sub al, al
not edi
ja 0x19947d0
inc ecx
pop ebx
dec ecx
sbb eax, ecx
dec eax
arpl di, di
inc cx
inc esi
inc ecx
dec edx
dec esp
add edi, edi
dec eax
lea edi, [ecx + ebx*4 - 0x2f7dae6f]
inc edi
mov ebp, dword [eax + ebp - 3]
inc cx
shl esp, 0x8f
inc ebp
add eax, ecx
jno fcn.013d7167
adc dword [esi], ecx
pop ebx
jle 0x19ca56b
push edi
pop ecx
invalid
push cs
inc ebp
ret
stosd dword es:[edi], eax
cmc
out dx, al
lahf
mov ecx, 0xea08ee1a
mov dword [esi + 0x5f], ecx
inc esi
clc
loop 0x19ca5e5
xor eax, 0xe8699cbc
enter 0x3452, 0xffffffffffffffb4
imul ebp, eax, 0xbc4452c8
imul ebp, eax, 0x9c367cc8
aas
jb 0x19ca5c4
je 0x19ca5ca
jl 0x19ca53f
push cs
pop ebx
jle 0x19ca5d6
invalid
mov ebx, 0xe64ebe1f
add cl, al
and dl, bl
stc
enter 0xffffffffffffda20, 0xfffffffffffffff9
les edi, [0xb26b1c55]
pop esi
cmp al, 0xed
in eax, dx
xchg esi, eax
out 0x8e, eax
xor ch, byte [ecx + 0x14d63deb]
inc ecx
out 0x25, al
xlatb
sbb dword [esi - 0xe9dabc9], eax
cmpsd dword [esi], dword es:[edi]
fsub st(4)
and byte [esi], al
pop esp
hlt
mul dword [esp + eax - 0x4bf4]
jae 0x19a1bfb
inc cx
neg eax
dec esp
xchg dword [esp + ecx*2 - 0x2207ffe0], edx
inc cx
ror eax, 1
inc cx
xor eax, 0x9662f9e
xchg esp, eax
or al, 0xb
add ah, bh
out dx, al
dec ecx
neg edx
inc cx
not eax
dec eax
mov dword [esp + ecx - 0x1103ffd8], edx
inc ecx
movsx esi, sp
pop edi
dec eax
add edi, 0xff95e1b4
jmp edi

Function at 0x203f86c
Capabilities:
Encode data using base64

Disassembly:
inc ecx
not esp
pop esi
mov ecx, 0x6ba631ad
inc ebp
mov dword [ebp + ecx - 0x6ba631ad], esp
dec esp
lea edx, [ecx + ecx*4 + 0xb703a0]
dec eax
lea ebp, [ecx + ebp - 0x6ba631b1]
inc cx
and edx, 0xbf0f8686
ror dword [ebx - 0x6359ba64], 0xff
inc dword [ebx + ecx*4 - 0x10]
inc ecx
xor ebx, ebx
inc ecx
bt esi, ecx
dec ebx
dec ebx
lea edi, [edx + esi*2 + 0x2c03171b]
and edi, 0xd1918f0a
bswap ebx
ror ebx, 1
dec eax
add eax, ecx
inc ecx
xchg edx, edi
neg ebx
jmp 0x20b3b8d
inc ecx
movsx esi, dl
inc ecx
btc edx, 0x21
not ebx
dec esi
lea eax, [esi*2 + 0x72b64215]
push eax
dec esp
mov dword [esp + ecx - 0x6ba631ad], ebx
xor al, ah
inc ecx
sbb bh, dl
call fcn.0197ee77

Function at 0x20443ec
Capabilities:
Encode data using base64

Disassembly:
call fcn.020f66d1
mov cx, word [edi]
movzx eax, byte [esi]
mov edx, 0x4f18868e
xor al, bl
not dl
shl edx, 0xc1
rol edx, 0x83
ror al, 1
lea edx, [edx + edx - 0x1f64146]
and dl, 0x9d
neg edx
neg al
not edx
inc al
sub dx, 0xd79f
xor edx, 0x482f0626
sbb dx, 0x9aa9
neg al
and dl, dh
bts dx, dx
call fcn.019d0bc8