joyce8/EMBER2024-capa huggingface dataset:
Function at 0x152902f
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x5120031d], 0xe09f0a0f
xor ebx, ecx
cwde
add esi, ecx
xor byte [esp + eax*2 - 0x639], 0x10
jno 0x16d2ff7

Function at 0x153324f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec eax
lea edx, [ecx*4 - 0x1cc25c59]
mov dword [esp + ecx - 0x24c7218e], ecx
rol eax, 3
xor eax, 0x2522cf15
push edx
call fcn.0233496f
shl edx, 0x8c
xor ecx, ebx
rol ecx, 2
xchg dx, ax
shr dl, 0xe6
sub al, al
bswap ecx
not ecx
jle 0x16791b7
xor ecx, 0x19bc76ac
lea edx, [eax + eax*2 - 0xa74d2d9]
sub eax, 0x2a9313e
je 0x15418f7
neg ecx
shr dx, 0x23
rol edx, 0x5d
mul dx
bswap ecx
bts eax, 0x28
bt dx, ax
or eax, edx
xor ebx, ecx
inc eax
imul edx
add edi, ecx
jmp fcn.0140c38e
idiv cl
xor ebx, edx
add ebp, edx
and byte [esp + 7], 0x8f
sbb cx, 0xf784
pop ecx
pop edx
pop edx
jno fcn.01734d14
lea eax, [edx*2 + 0x1521d1ab]
cwde
xor ecx, 0x55835017
mul eax
jb 0x16b4397
ljmp 0xa1ab:0x8c0fce32
lea ecx, [ecx + eax*8 + 0x2623957e]
bswap ecx
xor ebx, ecx
push edx
add edi, ecx
imul edx
push edx
sar dword [esp + 1], 0xc5
pop edx
pop edx
jmp edi

Function at 0x1540e2e
Capabilities:
Encode data using base64

Disassembly:
ror eax, 3
and edx, 0xf7186622
movsx ecx, dl
setns byte [esp + ecx*2]
lea eax, [eax + ecx*4 - 0x5a0aaf1d]
push edx
xadd word [esp + ecx + 4], dx
bts cx, dx
neg eax
sar cx, 0xcf
lea edx, [edx + ecx*2 + 0x73a44292]
call fcn.0154ed26
call 0xb16efa7b
movsd dword es:[edi], dword [esi]
mov es, ebp
and eax, 0x244489
mov dword [esp], eax
movzx eax, byte [edi]
xor al, bl
rol dword [esp], 0x68
inc al
mov ecx, 0x1bac0aa7
add ecx, 0x4a26e13c
movzx edx, byte [esp + ecx - 0x65d2ebe3]
rol al, 1
push edx
btc edx, 7
not cl
inc al
rol word [esp + ecx - 0x65d2eb18], 0xcd
rol al, 1
bt edx, edx
sbb al, 0x2a
not dl
add ecx, ecx
dec dx
xor bl, al
lea ebp, [ebp + edx*2 - 0x138]
imul ecx, ecx
sub word [esp + edx*4 - 0x26b], cx
mov word [edx + ebp - 0x9b], ax
jb 0x15f3f8d
sar edx, 0x6f
xor eax, ebx
mov dword [esp + edx*2 - 0x4456], edx
xadd dword [esp + edx - 0x222b], edx
dec eax
not edx
jmp 0x13a3008

Function at 0x1541910
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc ebp
mov edx, ebx
ror dl, 1
movsx eax, bl
dec ebp
and edi, ebx
dec esp
mov dword [esp + ebx*2 - 0xe650], edi
sbb dl, 0xb5
dec eax
sal dword [esp + ebx - 0x7328], 0xa6
shr dword [esp + ebx*2 - 0xe64e], 0x58
sal word [esp + ebx - 0x7327], 0xe5
neg dl
inc eax
jno 0x2455e2f
Function at 0x1548073
Capabilities:
Encode data using base64

Disassembly:
pop edi
mov ebx, 0xd03c96a7
mov ebp, dword [ebp - 4]
movzx edi, bl
or bx, bx
or ebx, edi
mov dword [edi + ebp - 0xa7], eax
movsx esi, bx
rol edi, 0x2f
lea edx, [edi*8 + 0x4e85c3b6]
pop ebx
not si
pop edi
lea ecx, [esi + esi*4 + 0x6f9e2f11]
rol esi, cl
lea eax, [edx + ecx + 0x5222e982]
pop esi
sub dl, dh
call fcn.02347385
Function at 0x154c17c
Capabilities:
Encode data using base64

Disassembly:
inc esp
xor dword [esp], edi
inc esp
mov ebp, ecx
inc ecx
inc ebp
push ebp
dec eax
mov edi, dword [esp + 8]
xor cl, 0x3b
sete byte [esp + 1]
dec ebp
arpl di, di
inc bp
dec ecx
adc esi, edi
dec ebp
mov ecx, dword [ecx]
inc esp
movsx ebx, word [esp + 2]
inc ecx
pop eax
inc ecx
pop eax
jmp fcn.0134864b
dec eax
or edx, edx
inc esi
mov dh, byte [ecx + eax*4 - 0x10]
inc esp
xor ebx, edx
inc ebp
mov ebp, eax
inc sp
add edx, ebx
dec edi
lea ecx, [eax + ecx - 6]
je 0x16c5fa3
dec eax
mov dword [esp + ebx - 0x448887f4], 0xfe0c1916
inc edx
xor bl, byte [esp + edx - 0x648b]
inc di
mov dword [ecx + eax - 4], esi
inc esi
movzx esi, word [esp + eax]
inc ecx
push ebp
dec ebp
sbb esp, eax
dec ecx
ror edi, 0x9e
inc ebx
mov eax, dword [esp + eax*8 - 0x20]
not word [esp + ebx - 0x44888702]
inc cx
btc esi, 0x80
inc ecx
not edx
xor eax, edi
rol eax, 3
ror bx, 0xc4
not edx
not eax
dec esi
sbb dword [esp + eax], eax
inc edx
sal byte [esp + eax*2 - 5], 0x87
dec edx
shr dword [esp + eax + 4], 0x8b
rol eax, 3
inc cx
rol eax, 0xe7
dec edx
lea ecx, [ebx*4 - 0x13ca3345]
inc ecx
inc bh
xor eax, 0xcfb0e1b1
dec edx
mov dword [esp + eax*2 - 0x3f0], edi
inc edx
xor dword [esp + eax*4 - 0x7f0], eax
inc ecx
shl eax, 0xdb
dec eax
mov edi, dword [esp + ebx - 0x4488b860]
inc bp
bt esi, edi
dec eax
arpl ax, ax
inc esp
bts edx, ebp
push ecx
dec eax
adc esi, eax
dec edx
mov dword [esp + eax + 0x18], 0x66bdb4ae
inc cx
inc ecx
pop ebx
inc ecx
pop esi
inc ecx
pop esi
pop ebx
jge fcn.0134864b
mov dx, word [edi]
mov ax, word [edi + 2]
call fcn.01381718
dec ecx
lea ecx, [esi + ebx*8 - 0x765d9e6a]
inc esp
movsx edx, bl
dec esp
lea edx, [ebx*2 - 0x574203c7]
inc ecx
dec edi
dec ecx
imul ebx, esi
inc ecx
rol edi, 3
dec ebx
lea ebp, [edx + edx*2 + 0x53b68da8]
dec ecx
bts esi, ecx
jb 0x137e199
dec eax
mov dword [esp], edi
inc ecx
sal edx, cl
dec esp
lea eax, [ebx + ebp*8 + 0x202ac406]
jne 0x13b4263
or bh, byte [edx]
sbb eax, 0x664424f9
mov ebx, 0x4d5ff8f5
pushal
pop es
cli
xor eax, 0x9bf30646
and dword [ebx - 0x7a], 0xfffffff9
pop eax
cmpsd dword [esi], dword es:[edi]
jnp 0x16c6016
popal
arpl word [edx + 0x1bcafe64], cx
and byte [0xf5540dfd], ch
xor eax, dword [ecx]
stosb byte es:[edi], al
in eax, 0x80
inc ebp
pop es
push ebx
movsb byte es:[edi], byte [esi]
mov esp, dword [edx]
ljmp 0x430e

Function at 0x1563e36
Capabilities:
Authenticate hmac

Disassembly:
lea eax, [edi - 0x80]
and eax, 0xfffffffc
mov dword [esp], 0x21298fbf
sub eax, ecx
not byte [esp + 2]
mov esp, eax
call fcn.012f5c34
mov eax, 0x2336d998
mov ecx, eax
movsx edx, cx
mov eax, dword [edi + eax - 0x2336d998]
movzx dx, byte [ecx + eax - 0x2336d998]
add ecx, ecx
lea edi, [edi + ecx - 0x466db32e]
mov word [edi + ecx - 0x466db330], dx
mov eax, dword [ebp + ecx - 0x466db330]
sbb cx, 0x759b
lea ebp, [ebp + ecx - 0x466d3d91]
mov edx, ecx
jns 0x1459205

Function at 0x1565533
Capabilities:
Execute syscall

Disassembly:
call fcn.0228d443
mov dword [esp], 0xb9990885
shr byte [esp], 0x82
mov dword [esp], eax
jns 0x12740aa

Function at 0x1574d84
Capabilities:
Encode data using base64

Disassembly:
call fcn.02366aea
call fcn.023e36a6
Function at 0x1574d93
Capabilities:
Encode data using base64

Disassembly:
push 0xac0d2308
mov dword [edi], edx
mov ebx, 0xd41d46b9
lea ebx, [ebx + ebx*4 - 0x4f5233eb]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
call fcn.016b4707
sub edi, 4
mov edx, 0x8c897c17
bt dx, 0x83
jae 0x15cfc97
mov eax, dword [edi]
xor eax, ebx
not edx
jmp 0x23fe91f

Function at 0x15bbab3
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x8882e984
jmp 0x2327b7a
mov edx, dword [esi]
dec byte [esp + 3]
mov eax, 0xfe2d0b8b
jnp 0x16c0fb5
xor edx, ebx
dec eax
neg edx
ror ax, 0x8a
jb 0x23fe8dd
inc edx
cwde
rol edx, 1
or al, ah
adc edx, 0x4faa05a4
mov ecx, eax
btr ax, 7
or byte [esp + 1], al
xor ebx, edx
btr ax, ax
shl ecx, cl
add ebp, edx

Function at 0x15bf9c7
Capabilities:
Encode data using base64

Disassembly:
rol eax, 1
not cx
btr edx, edx
xor dx, 0xbc97
not eax
xor ebx, eax
add edi, eax
xchg dword [esp + edx - 0xbd93], edx
movsx eax, dl
mov dx, word [ebp + eax*2 - 0x1c]
mov dword [esp + eax*2 - 0x1c], eax
neg ecx
mov cl, byte [ebp + ecx - 0x4006180d]
lea ebp, [ebp + eax*8 - 0x6e]
pop eax
btr eax, eax
shr dx, cl
call fcn.012ace78

Function at 0x15d47c3
Capabilities:
Encode data using base64

Disassembly:
inc eax
pop eax
pop ecx
pop eax
pop edx
pop ecx
pop ecx
jp fcn.0141de63

Function at 0x15d47d0
Capabilities:
Encode data using base64

Disassembly:
call fcn.023cfb55
mov ax, word [ebp]
mov edx, 0x4b129af
mov ecx, edx
xchg ecx, edx
lea ebp, [ebp + edx*2 - 0x962535c]
shr dx, 0xaa
imul dx, dx
shr edx, cl
lea edi, [edi + edx - 0x963]
add cl, ch
neg dx
lea edx, [edx + ecx*2 - 0x36702d69]
movzx ecx, byte [ecx + edi - 0x4b129d8]
xor cl, bl
ror cl, 1
rol dl, 0x84
dec cl
rol cl, 1
ror edx, 0xd0
bts edx, edx
or edx, edx
xor cl, 0x9f
push edx
sub cl, 0x86
xor cl, 0xb8
dec cl
xor bl, cl
jmp 0x2315d2a
mov byte [ecx + edx*4 - 0x71798000], al
lea edi, [edi + edx*2 - 0x38bcc004]
jns 0x16b0edb
add edi, 4
push 0xd59c5798
inc dword [esp]
call fcn.023fcd7c
lea ecx, [edx + 0x70108fa0]
mov ecx, dword [edi + edx*4 - 0x71798000]
xor ecx, ebx
bts dx, dx
lea eax, [edx*4 - 0x5c5bb7ec]
dec ecx
push eax
call fcn.023526e1
cld
pop ss
stc
push ds
cmp dword [eax + 0x24de1ac], 0xf78998f2
xor al, 0x98
push ebp
dec ecx
sub cl, al
or byte [esp + edx - 0x1c5ed2f0], 0x9a
lea ecx, [esp + ecx + 4]
dec dword [esp + edx - 0x1c5ed2f3]
shl dx, 0xed
ja 0x15fb810
pop ebx
cwd
call fcn.01764988
mov ecx, 0xf488663b
dec ecx
sub esp, 8
inc esp
movsx edx, cl
dec edi
mov esi, dword [esp + edx - 0x3b]
inc ecx
movzx ebx, dx
dec esp
xor esi, edi
dec ecx
neg esi
inc esp
movsx edi, cx
dec ecx
xor esi, 0xe1b1fa0e
dec ecx
sal edx, 0xfd
not cx
call fcn.013b6649

Function at 0x15e3eb6
Capabilities:
Encode data using base64

Disassembly:
mov dword [esi + 4], eax
movzx edx, cx
inc cx
mov dword [esp + edx - 0xfd31], 0xed2f3f34
mov dword [esp + edx - 0xfd31], ebp
ret 4
mov dword [esi], edx
inc byte [esp + 4]
jp 0x133f4a5
Function at 0x15e6e97
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0xd8a97d06
mov dword [esp + eax - 0x26ba8b0f], 0x7dbf01bd
sal al, 0x67
sar edx, 0xbf
ror ecx, 1
neg byte [esp + eax - 0x26ba8b7f]
js 0x17436be
adc edi, 5
shld edx, eax, cl
mov eax, 0x3d82b2bd
mov dword [edi + eax*2 - 0x7b05657a], edx
movsx edx, al
mov dword [esp + eax - 0x3d82b2bd], ebp
ret
ror dword [esp + eax - 0x26ba8b80], 0x57
adc ecx, edx
xor ebx, ecx
or dword [esp + eax*2 - 0x4d751700], eax
adc ebp, ecx
not dx
mov edx, dword [edi + eax*2 - 0x4d751700]
rol dword [esp + eax*2 - 0x4d751700], 0x2c
mov eax, dword [edi + eax - 0x26ba8b7c]
mov ecx, dword [esp]
rol dword [esp], 0xb2
sar cl, 1
mov cl, byte [edi + 8]
shl word [esp], 0xe6
jb 0x173ee74

Function at 0x160862c
Capabilities:
Encode data using base64

Disassembly:
neg al
xor bl, al
sar edx, 3
lea ecx, [edx + edx*4 - 0x516c8deb]
xor edx, ecx
lea eax, [esp + eax + 4]
movzx dx, byte [eax]
sbb edi, 2
mov word [edi], dx
shl byte [esp + 3], 0x61
neg dword [esp]
pop edx
jl fcn.01734d14
pop ecx
add edx, esp
lea ecx, [eax + eax*2 - 0x4e756066]
push ecx
mov ax, word [edx + ecx - 0x7c9c8d07]
bts cx, cx
movzx edx, cl
lea edi, [edi + edx - 0x89]
mov word [edi + edx*2 - 0x10e], ax
not edx
neg cx
sbb dl, ch
mov ecx, dword [ebp + ecx - 0x7c9c7279]
jl 0x1322341
movzx eax, dl
ror byte [esp + eax*2 - 7], 0xa7
lea ebp, [ebp + eax*8 - 0x24]
rol edx, 0xe9
xor ax, 0x7e31
cwde
xor ecx, ebx
sub ecx, 0xf73b42ac
ror ecx, 2
rol eax, 0x4b
dec ax
bswap ecx
mul dword [esp + eax - 0x3f19fff]
rol ecx, 2
xchg edx, eax
cwde
call fcn.0152eeaa
mov ecx, 0xbc1394b7
add edi, 4
xor eax, ebx
mov edx, ecx
sal cx, 0xc8
sar cx, 0xc7
sbb eax, 0xe80c73ab
sar ecx, 0xd4
neg eax
not eax
add cx, 0x701e
xor edx, 0x5a10d190
lea edx, [edx + edx*2 - 0x5d363fc]
sbb eax, 0xabe8f30
bswap ecx
bswap eax
inc eax
and edx, 0xecb00211
rol eax, 1
xor ebx, eax
add ebp, eax
xor edx, 0xe596c512
mov edx, dword [esi + edx - 0x49a6c703]
mov ecx, dword [esi + 4]
jb 0x15304c7
adc esi, 4
not edx
mov eax, 0x9f2e3a3c
not ecx
rol eax, 0xf2
jae 0x23c86a7
bts ax, ax
or edx, ecx
dec eax
movsx ecx, ax
inc ecx
mov dword [esi + ecx*8 - 0x3edc0], edx
movzx edx, al
push edx
mov dword [esp + ecx*2 - 0xfb70], ebp
ret

Function at 0x162d0cc
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0xde09d305
mov ecx, 0x323bbb17
fidivr word [ecx + 0x323bbb17]
mov dword [edi + ecx*2 - 0x6477762e], edx
mov dword [ecx + edi - 0x323bbb13], eax
not ecx
mov ecx, dword [ebp]
mov eax, dword [esp + 4]
add ebp, 4
mov dword [esp], eax
and al, 0
xor ecx, ebx
sal word [esp + 3], 0x63
setnp al
lea ecx, [eax + ecx + 0xb08ee04]
push eax
cdq
sbb edx, dword [esp + 3]
ror ecx, 1
or al, ah
xor ecx, 0xcb8cb013
mul dword [esp + 1]
mov dword [esp + eax*2 - 0x550c03c6], edx
lea ecx, [eax + ecx + 0x567f76a0]
call fcn.01381d3d
jae 0x162d0d3
jge 0x162d0f9
retf
Function at 0x1647473
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0xbf1b629f
sal dword [esp + 4], 0x38
xor edx, ebx
mov dword [esp], ecx
inc edx
xor edx, 0xe8362e95
bswap ecx
inc edx
ror edx, 1
ror cx, 0xc
not edx
lea eax, [ecx + ecx*2 + 0x28b97d96]
ror edx, 2
add ax, 0x911d
neg edx
xor ebx, edx
shr al, 0xe1
xadd dword [esp + eax*8 - 0x370a1216], ecx
adc edi, edx
inc ecx
je 0x16f09d0
mov edx, dword [ebp + ecx*2 - 0x17e38]
add cl, 0x95
lea ebp, [ebp + ecx*2 - 0x17f5e]
sar eax, cl
sar al, 0x85
lea esi, [ecx + esi - 0xbfb2]
push ecx
movzx eax, byte [ecx + esi - 0xbfb1]
call fcn.0237e24e
mov edx, 0xafa0fd82
rdtsc
sub ebp, 8
mov ecx, 0x6c208a18
mov dword [ebp + ecx - 0x6c208a14], eax
lea eax, [ecx*2 + 0x5a1dbd98]
cwde
mov dword [ebp + ecx - 0x6c208a18], edx
mov edx, 0x898c28bb
not cl
xadd edx, eax
lea edi, [ecx + edi - 0x6c208aeb]
shl dl, cl
mov eax, dword [edi + ecx - 0x6c208ae7]
sar dl, cl
xor eax, ebx
xchg ch, dl
btr edx, 0xab
neg eax
lea eax, [eax + edx + 0xdf7eb83]
ror eax, 2
call fcn.0176b638
imul edx, eax
lea edi, [edx + edi - 0x53f980fc]
shr edx, 0x87
sar eax, 0x57
xor ecx, ebx
rol ecx, 2
rol ax, 0x8c
mul edx
sub edx, 0xb10b692
adc ecx, 0xfbe099f
bswap ecx
xor eax, 0xb299bbbb
not ax
inc ecx
xor ebx, ecx
xchg dh, al
sar edx, 0xba
lea edx, [eax + eax - 0x69e54076]
adc ebp, ecx
mov eax, dword [esi + edx - 0x319d5002]
shr edx, 0x9e
movzx ecx, dl
xor edx, dword ss:[edx + eax]
mov dword [esi + ecx*2], edx
sal cx, 0x41
push ecx
movsx eax, byte [esp + ecx]
or dword [esp + ecx*4], ebp
Function at 0x1651dc2
Capabilities:
Encode data using base64

Disassembly:
add dx, word [ebp + eax*2 - 0x38ba0000]
not eax
mov ax, word [ebp + 2]
push 0x4b91df11
mov ecx, 0x6f36b6bf
call fcn.013d6d46
mov ecx, 0x9107ee8e
call fcn.013cb571

Function at 0x166c512
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x74809812
mov edx, ecx
mov eax, edx
mov ecx, dword [ecx + ebp - 0x74809812]
shr dl, 0xe1
sbb eax, edx
lea ebp, [ebp + edx - 0x74809805]
add edx, 0xbfa746ba
or edx, edx
xor ecx, ebx
cwde
neg ecx
inc ecx
xadd al, dl
ror ecx, 1
not edx
bts ax, 0x13
push edx
lea ecx, [edx + ecx - 0x36b85737]
and eax, 0xfd3da19d
idiv dl
shr dword [esp + eax*4 - 0x3c8], 0x2a
xor ecx, 0x10878b18
shl dword [esp + eax - 0xf2], 0xf6
xor ebx, ecx
mul dx
xor eax, 0x54a5b4b9
add word [esp + eax - 0x54a5ae33], 0xa302
add esi, ecx
mov ax, word [edi + eax - 0x54a5ae35]
lea ecx, [edx - 0x1fec85d3]
sar dword [esp], cl
xor byte [esp], cl
adc edi, 2
not ecx
movzx ecx, byte [ebp + ecx - 0x541485b2]
add ebp, 1
push edx
xor cl, bl
shl edx, 0xd7
xor cl, 0xbd
ror edx, 0x1c
adc cl, dl
sub edx, edx
ror cl, 1
bts edx, 0xb0
not byte [esp + edx*4 - 0x3fffd]
xor cl, 0x2b
xor bl, cl
mov dword [esp + edx - 0xffff], edx
not dl
rol dx, 0xef
lea ecx, [esp + ecx + 8]
jb 0x1523460
mov dword [esp], 0xc13b6228
add ebp, 6
shr dword [esp], 0x1f
neg byte [esp]
jae 0x13d8f47
shld edx, eax, cl
mov ecx, dword [esp]
lea eax, [ecx + ecx*2 - 0x28c7f8f8]
mov dword [ebp + ecx - 0xff], edx
lea esi, [esi + ecx*4 - 0x400]
movzx edx, word [esp + ecx*8 - 0x7f8]
idiv eax
mov eax, dword [esi + ecx*2 - 0x1fe]
ror dword [esp + ecx*8 - 0x7f8], cl
adc dword [esp + ecx - 0xff], ecx
xor byte [esp + edx*2 - 0x18dcac6], 0x3f
xor eax, ebx
dec dword [esp + ecx*2 - 0x1fe]
or byte [esp + ecx - 0xfe], dl
dec eax
sub edx, 0x752a5e17
sar dword [esp + ecx - 0xff], cl
inc dx
not eax
shr dword [esp + ecx - 0xff], cl
dec eax
dec cl
xchg edx, ecx
rol eax, 3
or ecx, ecx
xor ebx, eax
inc cl
call fcn.01393d81

Function at 0x166c68c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], ecx
mov eax, ecx
pop eax
pop ecx
jge fcn.0141de63

Function at 0x16770a2
Capabilities:
Encode data using xor

Disassembly:
push 0xb6122b1b
dec ebx
lea esp, [esp + 4]
jne 0x1545c10
mov dword [esp], 0x4aa600a4
mov dword [esp], eax
ja 0x13bfc5a
mov eax, 0xe0201126
movzx ecx, al
bswap eax
mov ecx, dword [eax + esi - 0x261120e0]
mov eax, dword [eax + esi - 0x261120dc]
mul ecx
mov ecx, 0x32a5ee98
ror cx, 0x49
dec ecx
mov dword [ecx + esi - 0x32a54c76], edx
adc ecx, ecx
mov dword [ecx + esi - 0x654a98e8], eax
movsx eax, cx
xadd cl, ch
rol cx, cl
lea edi, [edi + ecx - 0x654ac852]
movzx edx, al
sar ecx, cl
xor cl, 0x34
mov eax, dword [edi + ecx*8 - 0xca8f8]
or ecx, edx
xor eax, ebx
lea eax, [eax + ecx + 0x52ffe4b5]
or dl, 0x99
dec ecx
btr edx, ecx
neg eax
add eax, 0xae034223
or cx, cx
rol eax, 1
sal cx, 0xca
shl dx, 0xe1
neg eax
rol edx, 0x19
sal cx, 0xe5
bts dx, dx
not eax
bts ecx, edx
rol edx, 0xb1
xor ebx, eax
and dx, 0x81ac
sete dl
adc ebp, eax
jmp ebp
Function at 0x168c168
Capabilities:
Encode data using base64

Disassembly:
shrd edx, eax, cl
mov eax, dword [esp + 0xc]
sar dword [esp + 0xc], 0xc9
movsx ecx, word [esp + 0xc]
mov dword [ecx + edi - 0x4bb2], edx
mov dword [esp + ecx*8 - 0x25d90], esi
ret 0xc
adc edi, 6
or dword [esp + 9], 0xa3257802
jno 0x1643e38

Function at 0x16a478b
Capabilities:
Encode data using xor

Disassembly:
and byte [eax - 0x75bcff2d], dh
mov word [ecx], gs
out dx, al
clc
jmp 0xc2abae37
ror edx, 3
call fcn.013e132f
mov bl, byte [esi + 0x7f81cf6c]
dec ecx
fnsave dword [eax - 0x17]
push ecx
inc ebx
sahf
salc
jns 0x16a4768
mov al, byte [0x17860545]
adc byte [ebp - 0x79], ah
xchg ecx, eax
invalid

Function at 0x16ce93f
Capabilities:
Encode data using base64

Disassembly:
push 0x1a0de1b7
lea esp, [esp + 8]
jmp 0x2387f4e
push ebp
mov ebp, 0xf41a382e
mov ebp, dword [esp + ebp*2 + 0x17cb8fa4]
mov dword [esp], 0x8b241c0f
call fcn.012afc07

Function at 0x16d0d4d
Capabilities:
Check for software breakpoints

Disassembly:
or edx, ecx
xor eax, 0xf604f104
sub eax, 0x7695bc93
mov dword [esp], ecx
call fcn.01704699
xor edx, ebx
mov dword [esp], 0xc398e136
not byte [esp + 1]
not dword [esp]
not edx
shl byte [esp + 2], 0x87
neg dword [esp]
shl byte [esp + 3], 0xa6
bswap edx
shr byte [esp + 2], 0xa2
sbb edx, 0xc718438b
not byte [esp + 3]
jmp 0x245fdbb
not dword [esp + 8]
not edx
ror dword [esp + 5], 0x75
call fcn.0165631a
mov ecx, 0xd9bf9aaa
mov eax, dword [ebp]
add ecx, ecx
adc ebp, 3
bts ecx, ecx
call fcn.01315f46
xor edx, 0x38a438b1
push 0x3b9cc7b9
not dword [esp]
push 0x2bb6ee8d
dec edx
jmp 0x242fcc7
jmp 0x2448134

Function at 0x16ee94c
Capabilities:
Encode data using base64

Disassembly:
xor byte [esp + 0x12], 0x91
adc esi, eax
lea esp, [esp + 0x28]
jmp 0x1706b51

Function at 0x16fc206
Capabilities:
Encode data using base64

Disassembly:
movzx eax, byte [ebp]
mov dword [esp], 0x4d027122
sub ecx, ecx
lea ebp, [ecx + ebp + 1]
jb 0x242e300
movsx edx, byte [esp + ecx]
xor al, bl
call fcn.02426c69
in al, dx
sub eax, 0x8d811adb
mov edi, esp
dec ecx
and ecx, eax
mul dword [esi + 0xf]
movzx ax, byte [ebp + eax*2 - 0x24077fc]
invalid
test byte [edi + edi*8], cl
or al, 0x8e
xor edx, ebx
ror ax, 0xd
cwde
ror edx, 1
cwde
call fcn.015c4ecd
Function at 0x170b930
Capabilities:
Encode data using base64

Disassembly:
je 0x241be2c
movzx edx, byte [ecx]
test ah, cl
test esi, 0xc40dc6b3
cmp di, bx
shl esi, 8
inc edi
cmc
or esi, edx
jmp 0x172b7fe
mov ecx, dword [esp]
mov cl, byte [edi + ecx*2 - 0x562b3e44]
call fcn.015c965f
cmp edi, 5
jmp 0x22bd286
mov eax, 0x2b159f26
mov dword [esp + eax - 0x2b159f26], eax
mov edx, dword [edi + eax - 0x2b159f26]
mov eax, dword [edi + eax - 0x2b159f22]
jmp 0x161a4b7
inc ecx
jmp 0x161a4c7
cmp ecx, dword [ebp - 0x40]
jmp 0x1293135
jl 0x17347ca
mov dword [ebp - 8], ecx
rcl dh, 8
lea esp, [esp]
rcr ecx, cl
stc
Function at 0x176fdd5
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jne 0x16a245f

Function at 0x22afc62
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jne 0x15e1472
Function at 0x22b06fc
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x33ab6e04
jmp 0x12e3583
adc edi, 3
jmp 0x133a3c6
jb 0x1418424

Function at 0x22b40f9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xfca9bb8e
inc edi
mov esp, dword [edi]
inc ecx
shr ebx, 8
inc ebp
xor ebx, esp
dec eax
neg dword [esp + 0xa]
push 0x451409be
dec ecx
inc edx
push 0x8ea08a3d
inc ecx
xor ebx, 0xc003df27
push 0xd432b623
jmp 0x15fe52b
jmp 0x22ee67a
inc ecx
mov esp, 0x773c1730
inc ecx
neg ah
inc edi
movzx esp, byte [edx - 0x773c17d0]
push 0xc03a9621
push 0x30b480a4
inc ebp
xor esp, ebx
sar dword [esp + 6], 0x3a
sets byte [esp]
inc ecx
and esp, 0xff
push 0x3d5fa6
jmp 0x15f0700
mov edx, 0x7605082a
mov ecx, dword [edi + edx - 0x7605082a]
movzx eax, dl
mul dl
lea edx, [edx*4 + 0xe0cd139]
mov eax, dword [edi + eax*2 - 0xdc4]
and dx, dx
mov dword [esp], edx
adc edx, edx
adc edi, 7
inc edx
pop edx
mov dword ss:[ecx], eax
bswap edx
movsx ecx, dl
neg edx
mov edx, dword [ebp + edx*2 - 0x3c1dbe34]
mov eax, 0xcd2d318a
sar cl, 6
adc ebp, 3
call fcn.016fbe18
dec eax
lea esp, [esp + 0x40]
jne 0x17147b1
inc ecx
mov esi, 0x7abfc8ad
inc ebp
mov ebp, esi
inc ecx
pop esp
inc ecx
not ebx
inc ecx
mov esi, 0x2237a48e
inc ecx
movsx ebp, si
inc edi
mov dword [ecx + esi*2 - 0x446f491c], ebx
dec ecx
neg esi
inc ecx
movzx ecx, si
inc ebp
movzx ebx, dh
jmp esi
dec eax
dec eax
call 0x22b40f9
cdq
cwd
mov ebp, esi
adc ax, dx
sbb eax, eax
pop ecx
jp 0x12958d9
push ebp
and ebp, dword [ecx - 0x1e90ab43]
or eax, 0x9fe630aa
dec esp
stosb byte es:[edi], al
fimul dword [esi + 0x4c]
dec esp
add dword [eax - 0x460b61ac], esp
test eax, 0x6599d749
stosb byte es:[edi], al
jns 0x22ee71a
in eax, 0x4f
push ebp
mov dh, 0x16
pop edi
rsm
jp 0x22ee6d8
cdq
sti
stosd dword es:[edi], eax
push ebx
jp 0x22ee6c7
add eax, 0x8f00aac8
enter 0xaa, 0xffffffffffffff8f
in eax, 0xfb
sti
fstp xword [ebx - 0x6c637e1c]
mov al, 0x5c
pop esp
jl 0x22ee67d
dec ebp
cmp bh, ah
adc edx, dword [di]
jbe 0x22ee705
push edi
lds edx, [edx]
or byte [ecx + eax + 0x552189a0], 0xd9
sbb dword [ebp - 0x2c], edi
sub ah, bh
shl byte [edi - 0x34], 0xd9
je 0x22ee6bf
cdq
and al, 0x1b
insd dword es:[edi], dx
push esp
jo 0x22ee6cf
sar ah, 0xb8
invalid
cmp dh, ah
and bh, dh
mov ah, 0xb2
xchg ecx, eax
invalid
push es
jecxz 0x22ee6a3
jp 0x22ee6c1
scasd eax, dword es:[edi]
sbb eax, 0xfa4ade5c
retf
Function at 0x22cbad4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi + ecx - 0x4696fffc]
not ecx
mov dword [esp], 0xba86e1a
push ecx
adc edi, 7
call fcn.023a937e
in eax, 0x6d
enter 0xffffffffffff9c88, 0xffffffffffffffc6
mov ebx, 0x1ad9e507
mov byte [edx], bl
jae 0x22cbb74
mov ebp, 0x92d9099c
add al, 0xe1
or dword [0xb2b355c], eax
sub ecx, dword [ebx]
js 0x22cbb0b
mov eax, 0x4344e4fc
cmc
cmc
adc dl, byte [esi - 0x48]
mov eax, 0x78511acd
push edi
in eax, 0x5d
push edi
dec edi
lds eax, [ebx]
inc eax
pop ecx
adc bl, al
in al, 0xf6
salc
mov esi, 0x5febe268
rol byte [esi], 0x13
or dword [edx + eax*2], ebx
cmpsb byte [esi], byte es:[edi]
cmp esi, ebp
call 0xac2fa14f
stosb byte es:[edi], al
hlt
add dh, byte [edx + edx*4]
pop es
add al, byte [ebp + 0x20f1c8c]
lodsd eax, dword [esi]
imul ebp, dword [eax + ecx*8 - 0x78], 0x2a
jo 0x22cbb40
pop es
in eax, 0x6f
sbb ecx, dword [eax - 0x433d3ae6]
pushfd
or dword [ebx], ecx
add eax, 0x96cf09e1
xor al, 0x2b
or esp, dword [esi - 0x1b0346de]
loop 0x22cbb87
cmc
cmc
les eax, [eax + 0x1acdb96e]
pushfd
adc ecx, dword es:[edx]
and dword [edx], ebx
cmp bl, byte [esi + 0x78]
and al, 0xb8
push esp
cmp byte [eax], 0x67
push es
cmp eax, 0xb8cae36d
cld
adc byte [0x2f1e670f], ah
or al, 0x5a
in eax, dx
loop 0x22cbbe8
pop ebp
xchg esi, eax
sbb eax, 0xc26fc4e
adc ebx, dword [edx + 0x5b]
and ebx, dword [edi]
xor ebx, esp
jecxz 0x22cbbda
jecxz 0x22cbc38
inc byte [edx - 0x18]
aaa
add esi, esi
push ecx
jle 0x22cbbea
add dword [eax - 0x62], ecx
dec eax
sahf
sbb dword [ecx + 0x1ecccb50], esp
rcl dword [eax]
inc esi
push ebp
fadd st(0), st(0)
push 0x284bc735
test byte [ebx - 0x7b74691e], dl
and edx, dword [edx]
jmp 0x5c0fb087
push eax
xchg ecx, esi
xchg edi, eax
mov bh, 0x41
xchg ecx, eax
jge 0x22cbc87
adc al, 9
push ecx
movsd dword es:[di], dword [si]
xchg edx, eax
mov bl, 0x66
pop ebx
iretd
nop
pop ecx
mov ah, 0x3e
rcl byte [eax - 0x62]
jmp 0x22cbc3e