joyce8/EMBER2024-capa huggingface dataset:
Function at 0x891899
Capabilities:
Encode data using xor

Disassembly:
add ebx, esi
not eax
pop ecx
rol eax, 1
sar si, 0x41
dec eax
xadd dword [esp + edx - 0x7daa8f1e], edx
inc eax
dec esp
mov dword [esp + edx - 0x7daa8f1e], ebx
dec eax
inc edx
xor dword [esp + edx - 0x7daa8f1f], eax
dec esp
mov ebx, dword [esp + edx - 0x7daa8f1f]
dec eax
arpl ax, ax
dec eax
add edi, eax
dec eax
lea ebp, [ebp + edx - 0x7daa8f28]
inc esp
movzx esi, byte [ebp + edx - 0x7daa8f27]
inc ebp
xor dh, bl
add byte [ebp + 0x32], 0xf3
dec eax
lea edx, [esi + ebx*4 + 0x1b943605]
inc ecx
dec dh
dec eax
lea eax, [edx + ebx*2 + 0x21beacaa]
movzx ecx, si
inc ecx
rol dh, 1
dec esp
lea edx, [eax + edx*4 + 0x550c21a6]
dec ebp
lea ecx, [edx + eax*8 + 0x7812899d]
call fcn.00835126
xor al, 0x71
jg 0x8918df
insd dword es:[edi], dx
inc edx
std
mov byte [0xa250d2a], al
std
mov byte [0x5275392a], al
std
mov byte [0x220d652a], al
std
mov byte [0x4e19fd2a], al
idiv dword [ecx + 0x6fa8dc2a]
mov eax, 0x6433d4bc
ja 0x8919b2
out 0xc9, al
mov al, byte [0x1105010e]
ja 0x891983
movsd dword es:[edi], dword [esi]
inc esi
push ecx
bound ecx, qword [eax + 0x5b]
mov al, byte [0xfee31cd]
adc ah, byte [edi + 0x62fff004]
or al, dl
invalid
pop eax
xlatb
and ebx, dword [eax + ebx*2 - 0x21d7788c]
stosd dword es:[edi], eax
out dx, al
dec eax
invalid
mov edi, 0x7ab886ae
mov esp, 0x9b158980
cmp edi, dword [esp + ebx*8 - 0x7a7594]
das
retf 0x67d0

Function at 0x89b8af
Capabilities:
Encode data using base64

Disassembly:
push esi
pushfd
mov esi, 0xa0b4250e
call fcn.00907e60

Function at 0x89ba39
Capabilities:
Authenticate hmac

Disassembly:
xor eax, ebx
mov ecx, 0xb71ec33b
shl cl, 0xa1
not eax
dec eax
xor eax, 0x788a57ad
add ecx, 0x158faab0
mov dword [esp + edx - 0xac38605], 0x692517bc
lea eax, [eax + edx*2 - 0x7f8bc2c4]
sal dword [esp + edx - 0xac38605], 0x32
xor ebx, eax
neg ecx
sub dword [esp + edx - 0xac38605], ecx
adc ebp, eax
mov dword [esp + edx*2 - 0x15870c0a], ecx
mov ax, word [esi + edx*2 - 0x15870c0a]
jmp 0x95731f
ror dx, 0xca
or edx, 0x7c27caae
mov cx, word [esi + ecx*2 - 0x66a323b2]
xchg dword [esp + edx - 0x7ee7cbef], edx
shl dword [esp + edx - 0x335191da], 0xdd
pop edx
add esi, 2
neg edx
jns 0xcd8888
call fcn.00db34ef
add ax, cx
mov ecx, edx
inc cl
lea ecx, [edx*4 - 0x245feb55]
mov word [esi + ecx - 0x5ba014ab], ax
ror ecx, 0x5c
xor cl, dh
jle 0xce0b4a
movzx eax, byte [esi - 1]
mov edx, 0x92bedc3d
xor al, bl
rol al, 1
xadd dl, dh
movzx ecx, dx
rol dx, 0x45
not al
and ecx, ecx
lea edx, [ecx + ecx*8 + 0x46035e00]
inc al
inc edx
ror ecx, cl
not al
adc edx, 0xfa1e09a3
xchg dh, cl
shr cl, 0x43
neg al
add cx, cx
xor ecx, ecx
xor bl, al
mov word [ebp + edx - 0x40238087], ax
call fcn.00d57c14
jmp ebp
Function at 0x8ab706
Capabilities:
Encode data using base64

Disassembly:
pop eax
adc ebp, 4
add edx, ecx
call fcn.00dbd435
inc ecx
mov esi, 0x1684aca3
inc ebx
mov esi, dword [edi + esi*2 - 0x2d095946]
inc ecx
movsx ebx, dh
inc ebp
mov eax, esi
inc ebp
movzx ebp, ax
inc edi
mov esi, dword [edi + esi*2 - 0x2d095942]
inc ebp
movzx edx, bp
call fcn.008bb54c
inc ecx
mov edx, 0x4400e193
inc ebp
movsx esi, dl
inc ecx
movzx ecx, dx
inc ebx
mov edx, dword [edi + edx - 0x4400e193]
inc ebp
mov eax, esi
inc ecx
mov esp, 0x6588713f
inc ebp
mov edx, dword [edi + ecx*8 - 0x70c94]
dec ebp
lea edi, [edi + ecx - 0xe18f]
mov esi, 0xae904032
inc ecx
or edx, edx
not edx
inc ecx
movsx ebx, sp
dec eax
shl ecx, 0x4a
inc ecx
sub bl, dh
inc ecx
mov dword [edi + ecx*2 - 0x70c9800], edx
dec esp
lea ebp, [ecx*2 + 0x6b8f27ac]
inc ecx
sar eax, 0xb7
neg ecx
dec edx
lea ebp, [ebp - 0x65887143]
inc esp
mov ebp, dword [ebp + ebx - 0x71ac]
dec ecx
neg esi
inc ebp
xor ebp, ebx
inc ebp
lea ebp, [ebp + ebx*8 + 0x5592d92b]
dec esp
xadd ebx, esi
inc ecx
mov edx, 0xaa847e87
inc ecx
xor ebp, 0xe424de96
movsx eax, cx
dec eax
sar esi, 0x79
inc ecx
ror ebp, 3
inc ebp
lea ebp, [ebp + ebx + 0xb7cbdb5]
neg cl
inc ecx
bswap ebp
inc eax
neg dh
inc esp
movsx ecx, al
rol si, 0x83
inc ecx
push ebx
shr ebx, 0x71
dec esp
lea ebx, [ecx + ebx*2 - 0x254981ec]
dec eax
or ebx, ebx
inc esi
xor dword [esp + esi - 0x71ac], ebp
inc ecx
pop ebx
inc bl
jg 0xcf626e

Function at 0x8ac076
Capabilities:
Encode data using base64

Disassembly:
rol al, 1
pop ecx
ror ecx, 0x8b
sub al, 0x37
jmp 0xd15f7a
mov dword [esp + ecx*2 - 0xb024], 0x559e7a17
lea ecx, [eax + ecx*4 - 0x7a5a25c9]
xor ebx, edx
add edi, edx
xor ecx, dword [esp + ecx*4 - 0x7fd64a44]
lea edx, [eax*2 - 0x6a6456e9]
mov edx, dword [ebp + ecx - 0x4a6be886]
not eax
lea ebp, [ebp + eax - 0x65b1a7e9]
sal eax, cl
shl ax, 0xc1
sal eax, 0xb5
movzx eax, byte [ecx + esi - 0x4a6be882]
lea esi, [ecx + esi - 0x4a6be881]
xor cx, word [esp + ecx - 0x4a6be884]
xor al, bl
lea ecx, [ecx + ecx - 0x3366fc52]
sub al, 7
dec dword [esp + ecx - 0x61707dde]
shr word [esp + ecx - 0x61707dde], 9
not al
xor word [esp + ecx - 0x61707ddd], cx
inc ecx
sal cl, 0x82
ror al, 1
add al, 0x8d
dec word [esp + ecx - 0x61707d7c]
neg al
or word [esp + ecx - 0x61707d7a], cx
ja 0x8bbad5
jp 0x876ec3
or eax, 0x620ce6aa
lea eax, [edx*8 - 0x6d7864da]
pop ecx
pop ecx
pop ecx
pop ecx
pop ecx
pop eax
jmp ebp
neg al
call fcn.007ebb19
Function at 0x8ac10f
Capabilities:
Encode data using base64

Disassembly:
bswap eax
rol edx, 0x79
ror eax, 1
shl dl, 0x66
xadd dword [esp + edx*4 - 0xcfdbcfc], edx
dec dl
neg eax
neg ecx
sal dword [esp + edx - 0x2332f2d], 0x93
sub dword [esp + edx*2 - 0x4665e56], 0xc211b319
xor ebx, eax
not dword [esp + edx - 0x2332f2b]
jmp 0x818e63
inc bp
mov dword [edi + edx - 0x32], esp
jle 0xd30b64
xor eax, ebx
sub ecx, ecx
rol eax, 2
jmp 0x7e17a1
jmp 0xda206a
movzx eax, word [eax + edi - 0x6fabda6]
movzx ecx, dl
xor ax, bx
xchg dh, cl
shr edx, 0x35
sal ecx, 0x3e
neg ax
dec ax
shr edx, 0x75
and ecx, 0xa032770b
ror ax, 1
not ax
jmp 0xd57a37
sub edi, 4
mov ecx, dword [edi]
mov eax, 0x4b9ce83a
mov dword [esp + eax - 0x4b9ce83a], eax
xor ecx, ebx
sar word [esp + eax - 0x4b9ce838], 0x8d
inc word [esp + eax - 0x4b9ce839]
lea ecx, [ecx + eax + 0x1bfb75ce]
lea edx, [eax + eax - 0x27ca0b51]
or al, 0x3e
jg 0x99bbe9
mov ecx, edx
add edi, 0xfffffffb
jmp 0x805b82
mov word [ecx + esi + 6], ax
lea esi, [esi + ecx*4 + 6]
mov eax, 0xb01681ac
mov dword [esp + ecx], ebp
ret 8
bswap ecx
dec byte [esp + eax - 0x4b9ce83d]
rol ecx, 1
lea eax, [eax + edx*8 + 0x398b011]
lea eax, [edx + eax*2 + 0x22375b5]
pop edx
dec ecx
xor ebx, ecx
neg dx
add ebp, ecx
lea edi, [edi + eax*8 - 0x37d5ed32]
add edx, edx
lea edx, [edx*8 - 0x776712fe]
jg 0x86b3cd
mov eax, 0x35176f8b
call fcn.008c6b39
dec ecx
not esi
inc eax
add dl, dh
jmp edi
shr ecx, 0x12
sbb ax, 0xbb89
jmp 0xd6f4ef
jmp 0xdc1f3a
add ebp, eax
movzx eax, word [esp + ecx*2 + 8]
mov edx, dword [esi + edx - 0x2332f2b]
sub al, byte [esp + ecx*4 + 3]
setle cl
mov ax, word [edx + ecx*2]
jnp 0x8d196e
inc esp
xor dword [esp + edx - 0x64], ebp
inc ecx
pop ebx
inc ecx
not dl
dec ecx
sar edx, 0x60
neg ax
dec ebp
arpl bp, bp
dec ecx
add edi, ebp
dec eax
lea esi, [eax*4 + 0x4b882b02]
inc ecx
sal cl, 0x41
inc di
movzx esp, byte [edx + edi]
inc esi
or dl, byte [edx + edi - 0x62]
dec edi
lea edi, [edi + eax - 0x1ba8]
inc ebp
and ah, dl
dec eax
sub ebx, esi
inc ecx
not ah
ror dl, 1
jle 0x7f69c8
xor bx, ax
and dl, 0x83
lea esi, [esi + edx*8 - 2]
mov word [esi + edx], ax
jae fcn.0083caf3
mov ecx, 0x4c1d43b0
movsx eax, cl
mov eax, dword [edi + ecx - 0x4c1d43b0]
mov edx, dword [edi + ecx - 0x4c1d43ac]
shl cl, 0xa4
dec cx
dec ecx
lea edi, [edi + ecx - 0x4c1d42fa]
call fcn.00d86749
inc ecx
mov eax, 0x9920b4bb
inc ecx
movzx ecx, ax
inc ecx
mov edx, dword [edi + ecx - 0xb4bb]
call fcn.0090d848
Function at 0x8ae647
Capabilities:
Encode data using xor

Disassembly:
sal eax, 0x25
call fcn.00d1b173
xor ebx, edx
call fcn.0093c06a
mov ecx, dword [edi]
jmp 0x99ad2e
push edx
cdq
push bx
pop ebp
sbb byte [edx - 0x67], dl
push edx
cdq
push bp
or eax, esp
push ds
retf 0x7548
mov eax, 0x8c09392b
movzx edx, al
xor ecx, ebx
push edx
inc dl
js 0x8aa91b
sti
invalid
ror ecx, 1
bswap edx
dec edx
xor ecx, 0xf6bfe822
bswap ecx
or eax, edx
call fcn.00dbaabc
loope 0x99ad3e
sbb byte [esi + 0x76c15c3c], dl
mov ah, 0x47
jae 0x99adb1
sal dword [esi - 0x4c], 0x78
push esp
and al, 0xc1
jbe 0x99ad1e
sti
xchg dword [ecx + eax*8], edx
jbe 0x99ad24
daa
lahf
sub al, 0x55
add eax, dword [eax + 0x403cf9e6]
mov eax, 0x78cb8f01
aaa
out 0xe, eax
invalid
jmp 0x99add3
scasb al, byte es:[edi]
cmp dword [esi + 0x70bba594], esp
outsd dx, dword [esi]
ficom dword [ebx - 0x17]
xchg esp, eax
jmp 0x99ae0e
sub edi, dword [ecx + 0x2117f068]
push cs
cdq
mov al, byte [0xdb68bf8d]
jmp 0x99ae35
jp 0x99ae54
outsb dx, byte [esi]
dec esp
mov ah, byte [esi + 0x64]
or dword [esi - 0x5b945387], ecx
inc edi
leave
push 0x39
nop
jle 0x99ae63
mov dl, 0x32
out 0x86, eax
sti
push 1
add dword [0xf8909307], ecx
nop
clc
retf 0xdd83
les edi, [edi + 0x46]
sub ebp, dword [ebp - 0x7261538]
dec ebp
pop es
out dx, al
dec ebx
adc dl, byte [edx]
shr edx, 0x33
retf 0x28f3

Function at 0x8af120
Capabilities:
Encode data using base64

Disassembly:
add ebp, ecx
mov dword [esp + eax - 0x277f379d], eax
mov edx, dword [edi + eax*2 - 0x4efe6f3a]
mov al, byte [eax + edi - 0x277f3799]
add edi, 6
jmp 0x8bed7d
call fcn.008c5cff

Function at 0x8af45b
Capabilities:
Encode data using xor

Disassembly:
call fcn.008277f7
lea edi, [edx + edi - 0x39]
xadd eax, edx
movzx edx, byte [esi]
and ax, 0xa0ba
lea eax, [eax*2 - 0x55f743dd]
lea esi, [eax + esi - 0x590bfc96]
setge al
xor dl, bl
rol dl, 1
dec eax
inc al
neg dl
sar al, 0x23
add al, 0x82
dec dl
cmp dh, 0xca
ror dl, 1
inc dl
ror eax, 0xce
and eax, 0x7538f326
xor bl, dl
shl ax, 0xed
adc edx, esp
shl eax, 0x69
adc eax, 0xfc3e5f11
shl ax, 0x4d
mov dword [eax + edx - 0xdbe2000], ecx
setnp al
call fcn.00ced82f
wait
pushfd
jl 0x8af48c
xchg edx, eax
mov ebp, 0xce2aa110
cmpsb byte [esi], byte es:[edi]
cdq
adc byte [ecx - 0x220509d6], ah
adc byte [ecx - 0x2e0925d6], ah
adc byte [ecx - 0x6214dd6], ah
adc byte [ecx + 0x25d6ee2a], ah
and dword [ebx + 0x2b], ebx
push 0xff19f3b
mov eax, dword [0xec42f7b0]
jnp 0x8af549
jnp 0x8af55c
retf
or eax, 0x815147d1
pop ecx
or ebx, ebp
ret
dec ebx
bnd retf

Function at 0x8b2c54
Capabilities:
Encode data using base64

Disassembly:
xor dl, 0xa0
not eax
xor ax, 0x7913
push eax
sbb dl, 0x90
xor bl, dl
lea edx, [esp + edx + 0x10]
mov dword [edx + eax - 0x7ffffd74], ecx
lea edx, [eax + eax + 0x6c2f1e15]
mov eax, dword [esi + edx - 0x6c2f18f9]
mov ecx, 0x4ca65bbb
mov edx, dword [esi + ecx - 0x4ca65bb3]
mov dword [esp + ecx - 0x4ca65bb7], 0xcc3b539e
not cl
not eax
call fcn.0080ac8c
Function at 0x8b2d16
Capabilities:
Encode data using xor

Disassembly:
lea esi, [ecx + esi - 0x42944834]
mov edx, dword [esi + ecx - 0x42944830]
movsx eax, cl
ror word [esp + ecx - 0x4294482f], 0xe4
shl ax, 0x4c
xor edx, ebx
sar cl, 0xc4
jbe 0x8c1ee6
dec edx
ror edx, cl
add ecx, 0xf22be826
inc edx
inc word [esp + ecx - 0x34c03028]
dec byte [esp + ecx*2 - 0x69806052]
neg edx
sub al, al
xor ebx, edx
shr al, 0x65
adc edi, edx
inc al
and word [esp + ecx - 0x34c03028], cx
jae 0xd1565f
inc ecx
mov ebp, 0x26b7bb30
dec ecx
lea eax, [ebp - 0x606f5d7e]
call fcn.0090f29f
mov dword [esp + 8], 0x6df66bca
lea esp, [esp + 8]
call fcn.00daa46a
mov eax, 0x9b0f9c9d
mov ax, word [ebp]
mov dx, word [ebp + 2]
mov ecx, 0x1109a931
mov cl, byte [ecx + ebp - 0x1109a92d]
push 0x42944830
inc edx
add ebp, 4
shrd ax, dx, cl
mov ecx, dword [esp]
movsx edx, word [esp + ecx - 0x42944830]
mov word [ecx + ebp - 0x42944830], ax
xor byte [esp + edx*4 - 0x120be], cl
not dword [esp + edx*2 - 0x9060]
jno 0x8416dd
mov al, byte [0xfffff6f]
and dword [esi - 0x17], 0x4552fff8
push edx
inc ebp
jge 0x8b2d45
outsd dx, dword [esi]
dec eax
leave
mov al, byte [0x2cf30b2a]
leave
mov al, byte [0x28175f2a]
leave
mov al, byte [0x785f432a]
leave
mov al, byte [0xe83f0f2a]
and dword [edx + ebp + 0x7fa7460], edi
sbb edi, dword [ecx]
mov al, byte [0xe77f4ffc]
mov ah, 0x7c
mov dl, 0xfe
mov ebp, 0x777109e8
inc edi
ja 0x8b2df5
xchg byte [edx - 0x31167a93], cl
aam 0x38
sub edi, 0x70
inc ebx
add al, 0xa7
test al, 0x4a
adc byte [edi + edi*4], bl
xchg byte [ecx - 0x54f24632], dh
les ebx, [edi - 0x3c]
popfd
cdq
mov al, 0x37
xor dword [edx], ebp
jne 0x8b2d6d
mov esp, 0x1e0ac493
loop 0x8b2dac
aas
sbb eax, 0x8cdbb46a
sub eax, 0x367b76ee
or eax, 0x4c3bdafa
sub ah, byte [edi]
invalid
mov dword [ebp + 0x4d1dc877], 0xe2ca8576
pop ecx
stosb byte es:[edi], al
wait
dec edx
call 0xaac118bb
stosb byte es:[edi], al
mov byte [ecx - 0x44], 0x67
sub edx, ecx
dec esi
adc edi, dword [ecx]
stc
jmp 0x6d0e80be
xor eax, edx
call fcn.0085b975
mov dword [esp + ecx - 0x34c03029], edi
ret
Function at 0x8b8114
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [edx + ecx - 0x1125f9fb]
bswap eax
mov dword [esp + eax - 0x3c6d27a1], eax
neg ecx
dec ecx
xor dword [esp + eax*2 - 0x78da4f42], edx
rol ecx, 1
sar dx, 4
sub ecx, 0xd42a9886
call fcn.0097ab6b
mov ecx, dword [ebp]
mov edx, 0x9f8bba34
lea edx, [edx + edx*4 - 0x50cf90f6]
shl edx, 0x38
movzx ax, byte ss:[edx + ecx - 0xe000000]
movsx ecx, dx
dec edx
lea ebp, [ebp + edx*2 - 0x1bfffffc]
mov word [ebp + edx*4 - 0x37fffffc], ax
call fcn.0087d81e
xor eax, ebx
movsx ecx, dl
ror eax, 1
call fcn.0089a38d
neg dl
pop eax
pop edx
jbe fcn.0091626b
add edi, 4
shl dword [esp + 8], 0xbf
js 0xd525f5
mov dword [esp], ebx
xor ecx, ecx
test edx, edx
lea esp, [esp + 0xc]
je 0x7d57f2
push 0xf0b91419
jmp 0x96d944

Function at 0x8b9e18
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov edx, ecx
not esi
ror esi, 3
bswap esi
mov eax, 0x339d108f
dec esp
lea ebp, [eax + eax*4 + 0x6287889f]
inc edx
lea esi, [esi + ecx - 0xf9717c2]
dec edx
mov dword [esp + ecx - 0x2633], eax
inc esp
movsx eax, dx
inc ebp
xor eax, ebp
dec esi
mov dword [esp + ecx*8 - 0x13198], ebx
dec ecx
and ebp, 0x86a0ceb6
inc edx
xor dword [esp + edx*2 - 0x66], esi
inc ebp
xadd esi, eax
not dl
je 0x976b5e
inc ecx
pop ebx
call fcn.0084c4d8
dec edx
mov dword [esp + eax*4], edi
ret 0x18

Function at 0x8ba40d
Capabilities:
Encode data using base64

Disassembly:
shl edx, 0xf5
xor dl, byte [esi + edx - 0x4d600000]
mov al, byte [esi + 2]
mov ecx, 0x79364314
jmp 0xd44742
inc ecx
not eax
inc ecx
rol ah, 4
dec ecx
not esi
jae 0x8c0e00
lea edx, [eax + eax + 0x658a8b1a]
neg ecx
sal dx, 0x61
dec dx
sal ax, 0x26
xor ebx, ecx
neg eax
add ebp, ecx
jmp 0x8525a7
inc ecx
ror eax, 1
inc ecx
inc eax
call fcn.00d3a318
call fcn.009855b9

Function at 0x8bea47
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ecx
add edx, esi
xor edx, esi
dec eax
neg ebx
dec esp
mov dword [esp + ebx + 0x256d2fe], ebx
xor dword [esp + ebx*2 + 0x4ada5fc], edx
dec esi
lea ebx, [ebx + edx*4 - 0x276dabef]
inc ecx
inc ecx
pop ebx
inc cx
xadd edx, esi
inc ebp
movsx eax, dx
dec ecx
dec eax
dec eax
arpl dx, dx
dec esi
lea esi, [eax*4 - 0x1141804f]
jg 0x95db40
dec eax
add edi, edx
inc ebp
movzx ecx, dh
shl cl, cl
dec esi
mov edi, dword [ebx + edi + 0x256d2fe]
inc cx
cmovp ebx, edx
jb fcn.00d3b80a

Function at 0x8bed65
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx - 0x1e08ea22]
dec eax
mov dword [esp], 0x4a8c2f9b
dec ebp
lea eax, [edi - 0x80]
call fcn.009248ea

Function at 0x8c0193
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0x28ae4a0e
xor cx, dx
mov dword [esp], 0x8b22c817
not eax
adc byte [esp], 0x82
neg eax
xor ebx, eax
add edx, edx
or cx, cx
adc edi, eax
call fcn.00cea9af
Function at 0x8c01b8
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [eax + ecx - 0x1ab3622d]
shl edx, 0xe3
rol ecx, 1
mov dword [esp + edx - 0x48a20010], eax
xor ebx, ecx
rol dword [esp + edx - 0x48a20010], 0xd5
adc dl, 0x9d
adc ebp, ecx
mov ecx, edx
shr ecx, cl
mov eax, dword [edi + edx - 0x48a200ad]
dec byte [esp + ecx*2 - 0x48a20]
lea edi, [ecx + edi - 0x2450c]
ror cl, 0x61
movzx edx, byte [esi + ecx*4 - 0x91420]
lea esi, [esi + ecx*8 - 0x12283f]
xor dl, bl
neg ecx
shl ecx, cl
rol dl, 1
push ecx
neg dl
mov dword [esp + 8], 0xf6b1cb37
or dword [esp + 6], ecx
dec dl
ror dl, 1
not dword [esp + 8]
dec cx
inc dl
xor bl, dl
shr word [esp], 0xe9
cmovae ecx, dword [esp + 4]
lea edx, [esp + edx + 0xc]
add ecx, 0xd5a62d00
call fcn.00879b86
dec esi
mov dword [esp - 0x58008b91], esp
inc ebp
xadd ah, al
rol ebx, 3
sub ebx, 0xb4a7759d
dec ecx
lea esi, [eax - 0x4aeaf2d2]
neg ebx
bswap ebx
dec ebx
lea ecx, [esp + 0x1a9fd723]
jmp 0x8b7c3d

Function at 0x8c5de3
Capabilities:
Encode data using base64

Disassembly:
sar ax, 0x63
mov cx, word [ecx + ebp - 0x2facfd9b]
dec ax
push eax
lea ebp, [ebp + eax*4 - 0xe]
push eax
lea esi, [esi + eax - 5]
shr byte [esp + eax + 3], 0xe2
mov edx, 0xa00591a4
mov al, byte [esi + eax*2 - 8]
sub dword [esp + 1], edx
sub edx, edx
xor al, bl
pop edx
xchg word [esp + 1], dx
call fcn.00d0d109

Function at 0x8ce82a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edx
call fcn.0097c378
mov cx, word [ebp]
add ebp, 2
movzx eax, byte [esi]
add esi, 1
mov edx, 0xb53027bb
or dl, dh
xor al, bl
rol al, 1
neg edx
inc al
call fcn.00cf0df3
test bp, ax
cmc
test edx, edx
jmp 0x819de4

Function at 0x8d5041
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp + ecx*4 - 0x1047c], dx
mov dword [esp + ecx*4 - 0x1047c], 0xe6bba825
xadd dword [esp + ecx - 0x411f], ecx
mov edx, dword [esi]
sbb eax, ecx
lea ecx, [ecx - 0x757a5fc9]
xor al, 0x25
lea esi, [esi + ecx - 0x71414858]
sub ecx, dword [esp + ecx - 0x7141485c]
xor edx, ebx
bswap ecx
not al
inc edx
dec word [esp + ecx*2 - 0x30bf0b14]
sal byte [esp + ecx*4 - 0x617e1626], 0x24
neg edx
jmp 0xcdaf3b
sal ecx, 0xae
bswap edx
not edx
jnp 0xd76bf5
sar ax, 0xc1
xor edx, 0x7586dc99
call fcn.008f4135
Function at 0x8da72d
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
inc dx
dec dword [esp + eax - 0x3f0c6aa7]
jbe 0x85fb8d
mov ecx, dword [edi + edx*2 - 0xe72e]
movsx eax, byte [esp + edx*2 - 0xe72b]
neg dx
jne 0x88b4d3
inc edx
xor edx, 0x3380020b
ror edx, 2
not cl
neg dword [esp + ecx*2 - 0x1f4c3e00]
neg eax
dec edx
not dword [esp + eax - 0x7810000]
ror edx, 1
dec edx
ror cx, 0x25
jae 0x950a55
mov dword [edi], esp
xchg ah, al
shl byte [eax + 0x78], cl
xchg ebp, eax
cdq
les ecx, [0x5d048d0f]
loopne 0x7ddae0
jge 0xfec1aa3b
invalid
dec ebx
invalid
mov dword [ebp + ecx - 0x7cb7ea01], eax
movsx eax, cx
xchg ah, cl
mov dword [ecx + ebp - 0x7cb7eaea], edx
neg eax
movzx edx, cl
jge fcn.0087d700
push edx
add edi, eax
movzx eax, dx
and dx, 0x9097
adc edx, dword [esp + ecx - 0x83]
mov edx, dword [esi + eax - 0xfe74]
lea ecx, [eax + eax + 0x1193938e]
jae 0xd37e7d
lea esi, [esi + ecx*2 - 0x232b20e8]
xor edx, ebx
dec edx
inc eax
not byte [esp + ecx - 0x11959074]
rol edx, 1
bswap ecx
lea edx, [ecx + edx + 0x1985d273]
or cl, al
not edx
neg byte [esp + ecx - 0x76909574]
shr eax, 0xfd
xor ebx, edx
lea ebp, [ebp + eax - 4]
sub ecx, ecx
mov dword [ebp + ecx*4], edx
neg eax
pop eax
jp fcn.0087d700
inc ecx
mov eax, 0xd9b9cb5
inc ecx
mov edx, eax
inc si
mov ecx, dword [edx + edi - 0xd9b9cb5]
inc ebx
mov cl, byte [edi + eax - 0xd9b9cb3]
inc ecx
push eax
mov eax, 0xd4a3d11c
dec esp
lea edx, [edx*2 + 0x7e26ebba]
dec edi
lea edi, [edi + eax*4 - 0x366e72d2]
inc ecx
push edx
inc cx
shl ecx, cl
inc cx
ror eax, 0xe3
inc di
mov dword [eax + edi - 0xd9bb396], ecx
dec esi
lea esp, [edx + edx - 0x3779f265]
dec ebp
lea eax, [esp - 0x307364c2]
dec eax
lea ebp, [ebp + edx - 0xd9b9cb9]
jb 0x7dda71
jns 0x802ee6
xor ecx, ebx
push edx
dec ecx
or edx, dword [esp + edx*8 - 0x46347]
shr dl, 0xe4
neg ecx
and dl, byte [esp + eax*4 + 6]
bswap ecx
mov esi, dword [esp + 4]
lea esp, [esp + 8]
mov eax, 0x800fc00b
not edx
movsx ecx, ax
mov dword [edi], edx
neg ecx
call fcn.00843acc
xor ecx, ebx
ror ecx, 1
xadd dx, ax
sbb edx, 0xa427c295
dec ax
lea ecx, [ecx + edx*2 - 0x6e32d183]
inc ax
not ecx
dec ecx
xor ebx, ecx
sub edx, eax
adc edi, ecx
or eax, edx
jp 0xd69193
lea edx, [eax - 0x10fbb152]
bswap eax
add ebp, ecx
jmp 0x8ff0fa
xor ebx, edx
ror eax, 0xa1
adc ebp, edx
mov edx, ecx
pop ecx
jmp fcn.0083caf3
jno 0x829f49
inc ecx
push eax
dec ebp
mov eax, dword [edx + eax*2 - 0x7400]
dec esi
mov dword [eax + edi - 0x3a00], eax
jge 0xd5819d
and ecx, edx
lea edx, [eax*8 + 0x15b8ca87]
lea eax, [eax*2 - 0x77f635d4]
mov dword [ebp + edx - 0x15b8ca87], ecx
not ax
and dword [esp + edx - 0x15b8ca83], eax
lea esi, [esi + edx*4 - 0x56e32a20]
sbb byte [esp + edx - 0x15b8ca86], dl
setb dl
or eax, eax
rdtsc
mov ecx, 0x7cb7ea05
lea ebp, [ebp + ecx - 0x7cb7ea0d]
jg 0x96cabd

Function at 0x8e1dc6
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esp + edx + 0x7a0a6008]
mov dword [esp + 8], 0x37831b6f
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00d60c80
Function at 0x8e87e8
Capabilities:
Encode data using base64

Disassembly:
jp 0xce7835
mov word [esp + 6], cx
xor dl, 0x26
add al, 0x80
jp 0x856aee
sar cx, cl
rol ax, 1
xor bx, ax
lea ecx, [edx + edx*2 - 0x516837d7]
mov word [ebp + ecx*2 - 0x5657e2aa], ax
dec dx
lea ebp, [ebp + ecx - 0x2b2bf157]
shl edx, cl
pop eax
jb fcn.0093525e
xor ebx, eax
movsx edx, byte [esp]
rol dword [esp], 0xa
adc ebp, eax
movzx edx, byte [esi]
add esi, 1
mov dword [esp], 0x1c8bbd14
xor dl, bl
ror dl, 1
lea eax, [ecx*2 - 0x3775e07f]
lea ecx, [eax + 0x46a43001]
push eax
neg dl
jmp 0x88d824
neg dl
xor bl, dl
lea edx, [esp + edx + 8]
push eax
call fcn.0088d5f3

Function at 0x8ea4c5
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0
lea edi, [edx*4 - 0x29db3763]
mov dword [esp], ecx
mov eax, ebx
dec ebx
add esi, ecx
dec al
lea ebx, [ebp - 0xf4]
movsx ecx, ax
inc eax
mov esp, ebx

Function at 0x8ea502
Capabilities:
Encode data using base64

Disassembly:
mov eax, ecx
xor edx, 0x5a959ebe
sar ecx, 0xe1
sub ecx, ecx
shr ecx, 0x48
lea edx, [edx + ecx + 0x770da807]
and ecx, 0xbb3d5e1b
shr ecx, 0x67
setae al
bswap edx
shl ax, 0x2d
not edx
sal ecx, 0xbb
xor cx, cx
sar al, 0xa1
inc edx
neg edx
or ax, 0x3524
not cl
xor ebx, edx
dec cl
jno 0x925e47
not edx
bswap eax
rol edx, 1
inc edx
sub cx, word [esp + eax*2 - 0x1c49540]
jl 0x917c52
neg edx
call fcn.00d6e55b
ror word [esp], 0x8d
not eax
jae 0x8d9e6c
or ecx, eax
mov edx, dword [esp]
mov dword [edx + ebp - 0x9136], ecx
lea ebp, [ebp + edx*4 - 0x244f0]
push edx
mov dword [esp + edx*8 - 0x489f0], edi
ret 4
add ecx, eax
inc edx
mov dword [esi + edx - 0x7cd9ed62], ecx
lea esi, [esi + edx - 0x7cd9ed62]
call fcn.008d42c7
not cx
and al, 0x27
setbe al
and dx, cx
mov word [esi + 2], dx
xor al, al
adc ax, 0xe90f
mov eax, dword [edi - 4]
mov edx, 0x982b949a
inc edx
inc edx
sub edi, 4
call fcn.00d1b0f4
lea edx, [ecx + edx + 0x306e72c1]
jmp 0x7e175a
not edx
call fcn.00dad279
push eax
add edi, edx
neg dword [esp + ecx*2 - 0x1fc]
xor al, cl
mov edx, 0x209fa7b8
lea esi, [esi + ecx - 0x102]
xor eax, edx
and eax, eax
mov eax, dword [esi + ecx*2 - 0x1fc]
xor eax, ebx
sar cx, 0x24
neg eax
inc eax
bswap edx
inc edx
not eax
sub dx, cx
xor eax, 0xac865803
shl cl, 0xc1
dec cx
not eax
jb 0x89c301
ror eax, 1
shr word [esp + ecx*4 - 0x73], 0xa5
xor ebx, eax
lea ecx, [ecx + ecx*8 - 0x23486744]
xor dx, word [esp + 1]
push edx
sbb ebp, 4
mov dword [ebp], eax
pop eax
pop ecx
jmp fcn.0093525e