joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9b519b
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
xor ecx, 0xa01e8dbc
bswap ecx
movzx eax, dl
inc eax
xchg dword [esp + edx - 0x560dc79b], eax
neg ecx
xor edx, eax
inc ebp
mov esp, esi
dec esi
lea edx, [ebp*2 + 0x390da098]
inc ecx
mov edi, dword [edi]
dec edx
lea ecx, [0x72ade78e]
xor edi, esi
neg edi
dec eax
mov dword [esp], ecx
dec edi
lea eax, [esi + edx + 0x44969c87]
bswap edi
inc ecx
movsx edx, ch
inc ecx
movzx ebp, si
inc ecx
push eax
inc edi
inc ecx
inc al
xor edi, 0xc12bc620
dec esp
or dword [esp + edx - 6], eax
dec eax
mov dword [esp + ebp - 0x6dc5], esi
ja 0xd8c308
dec ecx
inc esp
xor dword [esp + edx*4 - 0x30], edi
or byte [esp + edx*2 - 0x16], 0xad
sar edx, cl
dec ecx
neg esi
dec eax
mov esi, dword [esp + edx + 8]
pop eax
dec esp
lea ecx, [ebp*8 + 0x6a032e8a]
inc cx
xor esi, 0x6348dba1
dec dword [eax - 0x77]
or al, 0xd4
inc cx
or esp, 0xf4d508c
shr esi, 0x4c
adc ebx, edi
inc ecx
shl ecx, cl
jp 0xd94d9e
mov dword [ebp + 4], eax
mov ecx, 0x78bcd905
mov eax, dword [ebp + ecx - 0x78bcd901]
mov word [esp + ecx - 0x78bcd904], cx
mov cl, byte [ebp + ecx - 0x78bcd8fd]
sal word [esp + 1], 0xef
push 0xbd3e65b2
shr eax, cl
jmp 0xa040a4
ja 0xa10ec5
mov edx, 0x560dc79b
mov ecx, dword [edi + edx - 0x560dc79b]
push edx
lea edi, [edi + edx - 0x560dc797]
xadd byte [esp + edx - 0x560dc79b], dl
jne 0x998107
inc esp
mov eax, dword [ebx + edx*2]
inc esp
sbb dword [esp + edx + 1], edx
and byte [esp + edx*2 + 4], 0x2c
inc ecx
push esi
dec eax
lea ebx, [edx + ebx + 4]
inc ebp
movzx ebp, word [edi + edx*2 + 4]
jl 0xa51b7c
pop ebp
inc cx
xadd esi, ebp
dec esi
lea edi, [edx + edi + 6]
call fcn.00d9a282
add esi, ecx
mov eax, dword [ebp + eax - 0x55db8e17]
mov edx, dword [ebp + edx - 0x531f0ffc]
rol word [esp + 1], 0x46
or eax, edx
shr byte [esp + 1], 0x67
mov edx, 0xaf174f3f
or dword [esp], 0x6bf7925
not eax
movsx ecx, dx
pop ecx
btc ecx, ecx
mov dword [ebp + 4], eax
adc ebp, 3
jmp esi
Function at 0x9b773d
Capabilities:
Encode data using base64

Disassembly:
movsx ecx, dl
pop eax
add eax, 0xe105
jmp eax
push edx
mov dword [ebp + edx - 0x4465f3ae], eax
pop eax
btr dx, ax
lea ebp, [ebp + eax - 0x4465f3ae]
jb 0x936091

Function at 0x9b7757
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xf40403ae
sbb ecx, 0xf6157903
xor ebx, ecx
xchg dx, ax
sar byte [esp], 0x87
adc esi, ecx
shl edx, 0xa8
xchg dh, dl
mov ecx, dword [ebp]
shl dword [esp], 0x1a
bt ax, 0xbd
mov edx, dword ss:[ecx]
mov ecx, eax
xor eax, dword [esp]
or ecx, ecx
mov dword [ebp + eax*8 - 0x14f68940], edx
and dword [esp + eax*2 - 0x53da250], 0x38955aaa
mov ecx, dword [ebp + eax*2 - 0x53da250]
shr eax, 0x63
sal dword [esp + eax - 0x53da25], 0x9c
lea edx, [eax*2 - 0x2af5444a]
mov edx, dword [ebp + eax*2 - 0xa7b446]
xchg dword [esp + eax*2 - 0xa7b44a], eax
not eax
ja fcn.00943d24
adc ecx, edx
ror dword [esp], 0x8b
call fcn.00d8ac8a
mov eax, 0xfda04095
lea edx, [eax + 0x753c8934]
movzx ecx, al
mov eax, dword [ebp + ecx - 0x95]
mov cl, byte [ecx + edi - 0x96]
neg dx
xor cl, bl
and edx, edx
rol cl, 1
sub dx, dx
jl 0x9e1119
xor dl, 0x8d
neg cl
shr dl, 3
jb 0x8bec36
syscall
push ebp
push edx
inc ecx
push edx
dec eax
mov dword [esp + 0x10], 0x917b3a6e
dec eax
lea esp, [esp + 0x10]
call fcn.00de0fcd
mov eax, dword [edi]
mov ecx, 0xfe2fe23a
btc cx, cx
adc edi, 4
bt cx, 0x30
lea edx, [ecx + ecx*8 - 0x3066b841]

Function at 0x9be50d
Capabilities:
Encode data using base64

Disassembly:
jmp 0xa5dd0e
xor ecx, edi
mov dword [esp + 0xc], 0x973fff39
inc edx
jmp 0x94ceb2
jmp 0xa1ebbd
Function at 0x9c300c
Capabilities:
Encode data using base64

Disassembly:
jmp ecx
xor dl, byte [esp + ebp + 0xf]
dec eax
xor edi, 0xd1bee35
dec esp
lea ebp, [ecx + 0x18a83993]
dec eax
xor esi, edi
and dword [esp + ebp*4 + 4], 0x9595c724
dec eax
mov dword [ebx + ebp*8 - 0x14], edi
dec eax
lea ebx, [ebx + ebp - 0xd]
je 0xdb7458
inc ecx
pop edx
pop ecx
inc ecx
pop ecx
jns fcn.00a14fd9
sub ecx, 0xa247d05
rol ecx, 1
movsx eax, dx
sub al, ah
not ecx
bts edx, eax
shr dx, 0xa6
btr edx, edx
xor ebx, ecx
or dx, dx
bswap eax
adc esi, ecx
movsx ecx, al
mov dx, word [ebp + edx - 0x7fff03ff]
sub ecx, ecx
mov ax, word [ebp + ecx*2 + 2]
not dx
not ax
jb 0x93c867
ror ecx, 0xbf
neg ecx
or dx, ax
mov word [ebp + ecx + 2], dx
add cx, word [ecx + ebp + 2]
lea edx, [esp + 0x2c]
mov eax, 0x5a03a09b
ror eax, 0x2c
mov word [eax + edx - 0x9b5a03a], cx
dec al
movzx edx, ax
mov ecx, dword [ebp + eax*2 - 0x136b406e]
xor dl, 0x3f
dec dx
mov ax, word [ecx + eax - 0x9b5a039]
mov word [edx + ebp - 0x9fff], ax
xor dx, 0xba3e
lea ebp, [ebp + edx - 0x1a35]
mov ecx, edx
jmp esi
inc esp
movsx esi, bp
inc cx
shl esp, 3
push esi
dec esp
btr ebp, ecx
inc cx
ror esp, 0x2d
inc ecx
movzx eax, dh
inc esp
xor dword [esp + ecx - 0x3870], eax
pop esi
inc esp
or dh, al
dec ebp
arpl ax, ax
dec ebp
xadd esp, edx
jp 0x9dd62c
mov edi, 0x20cee0f
inc eax
movsx ecx, bh
dec esp
mov edx, dword [edi + ebx - 0x20cee0f]
inc eax
xchg bh, cl
inc esp
movzx eax, cl
sub ecx, edi
dec eax
mov edi, dword [ebx + edi - 0x20cee07]
inc esp
movsx esi, cl
dec esp
add edx, edi
inc ecx
mov edx, esi
inc ebp
or esi, eax
dec ecx
mov eax, edx
inc ebp
mov esp, esi
dec ebp
lea ebp, [esi + edx*8 + 0x579eb008]
mov edi, edx
dec edx
adc edx, dword [eax + eax*2 - 0x1e]
mov ebp, ecx
dec ecx
mov dword [eax + ebx - 7], edx
bswap ebp
dec edx
lea ebx, [ebx + eax - 7]
mov eax, 0x540f5726
inc ebx
mov eax, dword [eax + edi - 0xf]
inc sp
bt ebp, esi
dec edi
lea edi, [edi + eax*2 - 0x1a]
shr ecx, 0x58
inc ecx
movsx edx, ax
inc eax
xor bh, 0x9f
xor eax, esi
dec eax
rol eax, 1
dec esp
bts ecx, esi
dec ebp
lea ecx, [ebp + ecx + 0x5c98dca4]
lea eax, [ecx + eax + 0x50aeb921]
inc bp
btc ebp, esi
inc cx
shl esi, 0x4d
inc ebp
mov edx, ebp
rol eax, 1
inc ecx
shr ch, 0x22
neg eax
ror eax, 3
push esi
dec eax
xchg ebp, edi
xor dword [esp + ecx - 0x80fd], eax
inc ecx
rol ah, 0x26
inc ecx
xadd ch, ch
dec esi
lea ebp, [edi + ecx*4 - 0x2b554561]
pop esi
dec eax
arpl ax, ax
dec esp
adc ebx, eax
inc ecx
push ecx
inc bp
xchg ebp, esi
dec ecx
sar eax, 0xf3
dec esp
mov dword [esp + ecx - 0x80fd], ebx
ret

Function at 0x9ca9fd
Capabilities:
Encode data using xor

Disassembly:
inc dword [esp + 4]
add esi, eax
push ecx
rol byte [esp + 9], 0x21
xor cl, 0x99
mov eax, dword [ebp - 4]
bt edx, edx
and ecx, 0x638c5a9c
mov edx, dword [ebp + ecx - 0x610c1090]
adc eax, edx
mov dword [ecx + ebp - 0x610c1090], eax
call fcn.00a51a3b
Function at 0x9ce1bc
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x329ae22f
shr dx, 0x86
btr dx, dx
mov dword [esp + edx - 0x302800cd], edx
rol ecx, 1
sal dx, 0xe5
not byte [esp + edx*2 - 0x6050333f]
push edx
bswap ecx
dec edx
ror ecx, 2
xor dl, byte [esp + edx*2 - 0x60503339]
or dx, dx
not ecx
xor ebx, ecx
bt dx, dx
not dword [esp + edx*2 - 0x605032c0]
adc esi, ecx
shr word [esp + edx - 0x3028195d], 0xb
mov edx, dword [ebp + edx*2 - 0x605032c0]
pop ecx
ror cl, 0x83
pop ecx
mov ecx, dword [ebp + ecx*2 - 0x6051fdfc]
adc ebp, 3
push 0xac0ffca4
xor eax, eax
push 0xa1a11aa3
test ecx, ecx
jmp 0xdcbc06
Function at 0x9d0361
Capabilities:
Encode data using base64

Disassembly:
inc cx
xor esi, edx
or ebp, edx
dec eax
lea edi, [ebp + edx*8 - 0x37cabcda]
sar dword [esp + ecx*2 - 0x363a], 0xfe
dec eax
lea ebx, [ebx + ecx*8 - 0xd900]
inc ebp
movzx esp, si
dec eax
inc dword [esp + ecx - 0x1b1f]
inc esi
sub byte [esp + esi*2 - 0x6c7f7dd], dh
dec esp
mov dword [ebx + ecx - 0x1b1f], edx
call fcn.008b96f5
dec esp
mov edx, dword [ebx + eax*8 - 0x60]
dec ecx
inc ecx
inc eax
mov ch, byte [ebx + eax*8 - 0x58]
dec eax
and edi, ecx
xadd dx, di
inc bp
sub eax, ecx
dec eax
lea ebx, [ebx + eax*2 - 0xe]
inc ebp
movsx esp, ch
dec ecx
xchg ecx, eax
dec ecx
xor ecx, 0x7da929a9
inc ebx
mov byte [edx + ecx - 0x7da929a5], ch
inc ecx
jmp ebx
inc ecx
sub ecx, esi
inc ebp
movsx eax, dx
inc ecx
dec esp
inc ebp
movsx ebp, dl
inc ecx
xor esp, 0x98b982be
dec ebx
lea edx, [ecx + ecx*2 - 0x11fc3564]
inc cx
btc eax, 0x9b
push esi
inc esi
xor dword [esp + edx + 0x15f52a42], esp
movsx eax, cl
sub bp, cx
pop esi
dec ebp
arpl sp, sp
jg 0xd98aec
dec edx
out 0x22, al
inc ecx
or al, 0xb1
cmp ah, byte [edi - 0x75]
invalid
mov ecx, 0x8187388d
movzx edx, cx
mov cl, byte [ebp + edx - 0x388b]
and dl, dh
bt edx, edx
add edx, edx
lea ebp, [ebp + edx - 0x700e]
jg 0xe142bf
dec esp
lea edx, [edx*2 - 0x15f72ae4]
inc esp
xor esp, esi
inc ecx
mov ebp, ecx
inc ecx
xor esp, 0xc89d8f07
inc esp
mov esi, ecx
inc ecx
bswap esp
inc edi
lea esp, [esp + edx*8 - 0x4e65919e]
inc ecx
or dl, 0xb2
adc cx, 0x790c
js 0x8ba88b
inc ecx
rol esp, cl
jmp 0x9821fc
jmp 0xd6b961
mov dword [esp], 0xe3ab685
not dword [esp + 4]
mov ebx, dword [ebx*4 + 0xe15390]
call fcn.009db81e
inc ecx
movzx ebp, byte [edi + ecx - 0x16047aa8]
inc ecx
pop ebp
dec ebx
lea edx, [ebp + ebp*2 - 0x4ae962e4]
shr cx, cl
inc eax
xor ch, dh
inc eax
neg ch
jmp 0xdb2177
inc eax
dec ch
dec eax
xor ecx, ecx
inc eax
ror ch, 1
inc bp
xor ebp, esi
call fcn.00dbcd13
jmp 0x9c0168
movzx ax, byte [ebp]
jmp 0x9a2849
dec ebp
adc ebx, esp
jmp 0x93c943
inc ebp
mov eax, ebp
inc ebp
movsx esp, bp
inc eax
not ch
inc esp
mov esi, edx
inc ebp
movsx ecx, ax
dec edx
lea edi, [edx + esi - 0xc5052d7]
inc eax
dec ch
inc eax
ror ch, 1
inc ebp
movzx edx, ch
jmp 0xa2bd9b
call fcn.008dae10
sar eax, 0x4c
push ebx
mov ebx, ecx
bts edx, edx
mov edx, ebx
adc ax, ax
shl edx, 2
xor eax, eax
setle al
call fcn.008a5d94
mov eax, 0x153593ac
mov eax, dword [ebp + eax*2 - 0x2a6b2758]
mov edx, 0xc9b6ec84
mov dword [esp], edx
movzx edx, byte [edi - 1]
inc byte [esp]
xor dl, bl
mov ecx, dword [esp]
and dword [esp], 0xff90ee36
neg cx
neg dl
call fcn.00937c54
sal al, cl
mov word [ebp + edx*2 - 0xe020], ax
lea eax, [edx + edx - 0x364b72de]
lea edi, [edx + edi - 0x7014]
rol dl, 3
movsx ecx, ax
shl ecx, 0xde
mov edx, dword [edi + edx*4 - 0x1c200]
or cx, 0x1e24
xor edx, ebx
rol ecx, 0x1b
sar eax, cl
inc eax
dec edx
xor ecx, eax
shr cx, cl
xor edx, 0x933e9817
xchg ecx, eax
dec edx
bts eax, ecx
not ax
adc eax, 0x32864bb6
not edx
jl 0xdb79eb
bswap ecx
neg edx
push eax
ror byte [esp + eax*2 - 0x1d0c96fa], 0xc4
sub dword [esp + eax*2 - 0x1d0c96fa], eax
xor ebx, edx
not ecx
shr ecx, 0x18
adc esi, edx
sub word [esp + eax*8 - 0x74325be7], ax
sal cl, 0x43
mov dword [esp + eax - 0xe864b7d], esi
ret
Function at 0x9d17f8
Capabilities:
Encode data using base64

Disassembly:
call fcn.00969250
dec eax
mov edi, dword [ebx]
inc ecx
mov eax, 0xe4a26e01
mov cl, byte [ebx + 8]
inc ecx
mov edx, eax
dec eax
shr edi, cl
inc ecx
push eax
inc esp
movsx esi, dl
dec ecx
mov dword [esi + ebx + 1], edi
mov ecx, 0xd039e9a3
inc dx
shr dword [esp + esi + 3], 0x48
inc esi
mov ebp, dword [esp + esi*4 - 3]
inc ebx
mov edx, dword [edi + esi - 1]
jbe 0x9d024f
dec ecx
sar ebp, cl
inc esi
mov esp, dword [esp + esi*8 - 4]
xor edx, esi
ror edx, cl
inc edx
sal byte [esp + esi + 5], 0x41
sbb edx, 0xa23bd614
inc ecx
ror ah, 1
call fcn.009cbf95
lea esp, [esp + 0x14]
je 0x9d9a7e
push 0xf80ddca8
mov eax, 0xff22752a
mov eax, dword [ebp + ebx*4]
xor dword [esp], 0xa3bfce11
mov dword [esp], eax
call fcn.008b5ca4
ror eax, 1
neg cx
bt cx, 0xb6
xor ebx, eax
add esi, eax
movsx eax, dl
add eax, dword [ebp + ecx - 0x4237738c]
shl dx, 0xcd
sal dx, cl
add edx, dword [ebp + edx + 4]
jmp 0xde95e9
mov eax, dword [ebp]
push 0xd226d88e
jmp 0x9c0057
and ecx, ecx
lea ebp, [ebp + ecx - 0x42377388]
lea ecx, [ecx + ecx + 0x312c3ca1]
rol ecx, 0xe6
add eax, edx
and cx, cx
movzx edx, cl
not ecx
mov dword [ebp + edx*4 - 0x1b4], eax
jmp esi

Function at 0x9d4ee3
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
pushfd
pop edx
mov dword [esp], edx
push ebx
mov ebx, 0x6ab42b8e
mov edx, 0xbdb6c716
mov edx, 0
not bx
sub bl, bl
neg ebx
push edx
setp bl
shr bl, 0x66
shl bl, 3
push esi
inc ebx
mov dword [esp + 0x14], eax
movsx esi, bl
push ebp
movsx eax, si
lea ebp, [esp + esi - 5]
and esi, 0x8686be0e
push edi
cwde
adc bl, 0x11
sbb bl, 0xc
mov edi, dword [esp + esi + 0x20]
xor al, bl
shl bx, 5
rol edi, 2
neg edi
btc ebx, 5
shl esi, 0x8d
sal si, 0xc9
ror edi, 2
jmp 0x897250

Function at 0x9d9e37
Capabilities:
Encode data using base64

Disassembly:
rol ecx, cl
jne fcn.008e0841
mov word [ebp + ecx - 0x24c2f7c], ax
movsx eax, cl
lea edx, [eax*8 - 0x227f33d0]
mov dword [esp + ecx*2 - 0x4985ef4], 0x2c37313c
movzx edx, byte [edi + ecx - 0x24c2f75]
lea edi, [ecx + edi - 0x24c2f74]
btr ecx, 0x9f
dec dword [esp + ecx*8 - 0x12617bd0]
xor dl, bl
pop eax
not dl
push eax
neg dl
dec eax
sub dl, 0x98
cwde
not dl
xadd eax, ecx
ror ax, 0xd
ror dl, 1
xor eax, 0xd2a24a95
xor bl, dl
lea edx, [esp + edx + 4]
btr cx, 0x2f
movzx ax, byte [edx + ecx*8 - 0x189d0]
ror byte [esp + ecx - 0x3139], 1
mov edx, ecx
mov word [ebp + ecx*2 - 0x6278], ax
pop eax
and cx, dx
xchg edx, eax
lea ebp, [ebp + ecx*4 - 0xc4ec]
lea eax, [edx*8 + 0xb21a413]
jns 0x93e923
Function at 0x9f3bb3
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xchg cl, dl
inc cx
xor esi, esp
dec esp
add esp, esp
inc esp
xchg ecx, eax
inc edi
mov byte [eax - 0x13bf2081], dl
dec eax
cwde
dec ecx
sal ecx, cl
inc ecx
sal eax, cl
inc ecx
jmp ebx
jno 0xdaa885
jmp 0xde15b7
dec edi
lea edi, [edi + eax*4 - 0x288]
inc ecx
mov edi, edx
mov ecx, 0x13bf2081
inc ecx
movzx eax, ax
inc esp
xor esi, esi
dec esi
lea ebp, [edx*8 + 0xba91382]
inc ecx
dec esi
inc ecx
and dl, 0x2d
inc esp
movsx esp, bh
inc ecx
neg al
inc ecx
not esi
inc ebp
sbb eax, esp
inc ecx
sar ch, cl
inc ecx
neg esi
dec ecx
ror ebp, 0x63
inc ecx
movzx edx, bp
inc ecx
sal ch, 0xc5
inc ecx
rol esi, cl
inc ebp
lea esi, [esi + ecx + 0x7261618a]
dec edx
mov dword [esp + eax*8 - 0x5c8], edi
inc ecx
xchg ah, bh
dec edx
mov dword [esp + eax - 0xb9], esi
movsx ebp, al
dec eax
and ebp, edx
inc esi
xor dword [esp + eax*2 - 0x172], esi
inc esp
movsx ecx, bh
shl dx, 0x62
inc ebp
or al, dl
pop esi
inc ecx
bt ebp, edi
dec ebp
xadd edx, ebp
dec ebp
arpl si, si
inc eax
and ch, 4
dec ebp
adc ebx, esi
inc si
mov edx, dword [ebx + eax*2 - 0x172]
dec ecx
lea ebx, [eax + ebx - 0xb7]
inc bp
jns 0xd8ac9c
rol cl, 1
add eax, edx
dec ax
push eax
sbb cl, dl
shl edx, 0x95
sub word [esp + eax*2 - 0x1aa22223], dx
neg al
xor cl, 0x34
push eax
xchg dword [esp + eax*2 - 0x1aa223d2], edx
sar edx, 0x7f
rol cl, 1
push eax
xor bl, cl
jmp 0xe01538
dec eax
bts edx, edx
inc edi
movzx esp, word [edi + eax*2 - 0x172]
inc ecx
not ch
inc esp
xadd ebp, eax
dec edi
lea edi, [edi + eax*4 - 2]
inc ecx
sar ch, cl
inc sp
xor esp, esi
inc esp
movzx esi, di
dec edi
lea ecx, [eax + esi + 0x6133542d]
inc cx
rol eax, cl
inc cx
adc esp, 0x8149a7b3
in eax, 0x2d
sub dl, byte [ecx - 0x52c990c]
rol ax, cl
inc cx
xor esp, 0x4166be06
neg esp
btc dx, dx
inc cx
not esp
jae 0x8bc691
fdivr qword [ebp + 0x50]
add ch, ah
dec edx
push edx
or eax, 0x48d30bce
mov dword [edi + ebx], ecx
dec ecx
lea eax, [ebp - 0x5c69f680]
dec ecx
sal ebp, 0xc8
inc ecx
mov eax, dword [edi + edi*2]
dec ebp
lea edi, [edi + edi*8 + 4]
xor eax, esi
dec eax
rol eax, 1
lea eax, [eax + edi + 0x50af3a1e]
inc esp
movzx ecx, di
dec ebp
lea esi, [ecx + edi - 0x575bac5e]
mov edx, 0x7620baaa
rol eax, 1
inc ecx
xor edi, ecx
inc ebp
adc ecx, esi
neg eax
inc ebp
mov eax, ecx
inc esp
bts edx, ecx
ror eax, 3
inc esp
movzx esp, dl
push esi
dec ebp
bts ebp, ebp
inc ecx
shr dh, 0x67
inc ecx
movsx ecx, si
xor dword [esp + edi*2], eax
pop esi
push edi
dec dword [esp + edi*2 + 2]
or byte [esp + edx*2 + 0xb], 0xf
lea edi, [edx + edi - 5]
pop edx
xor ecx, ebx
cbw
shl ax, 0x21
sar dword [esp + edx - 0xd5111e5], 0x99
rol ecx, 1
dec ecx
push edx
rol ecx, 1
pop edx
push eax
xor eax, dword [esp + edx*8 - 0x6a888f62]
lea ecx, [ecx + edx + 0x50486b9b]
ror ecx, 1
not edx
neg ecx
xchg byte [esp + 0xc], ah
push edx
not ecx
call fcn.00a63636
mov ecx, 0x50af2d2d
mov edx, ecx
neg dx
mov ax, word [ebp + ecx - 0x50af2d2d]
mov cl, byte [ecx + ebp - 0x50af2d2b]
call fcn.00a16b3f
mov ecx, 0x5384540d
call fcn.0096fc27
inc edx
lea ecx, [esp + ecx + 0x10]
movzx ax, byte [ecx + eax*2 - 0x1aa223da]
dec dx
mov word [ebp + edx*2], ax
lea eax, [edx - 0x7de00cc3]
mov ecx, dword [edi + edx*2 - 5]
je 0x8c528f
Function at 0x9f9544
Capabilities:
Encode data using base64

Disassembly:
lea edx, [esp + edx + 8]
mov dword [edx + eax*2 - 0x3ff8000], ecx
mov ecx, dword [edi + eax*8 - 0xffe0006]
xor dword [esp + eax - 0x1ffbffc], eax
adc ax, ax
xor ecx, ebx
movzx edx, al
neg word [esp + eax - 0x1ff7fff]
sub edx, eax
bswap ecx
neg ecx
add edx, 0xe8b05780
lea ecx, [edx + ecx - 0xc2d7d00]
push eax
sbb ax, ax
ror edx, 0x6a
bswap ecx
push eax
sbb word [esp + eax - 0x1fffffc], ax
adc dword [esp + eax*8 - 0xfffffef], 0x701a4203
xor ecx, 0x97a1b296
ror eax, 0x4e
shl edx, 0x6c
btr ax, 0x9b
rol ecx, 1
jmp 0xa2206c
neg dl
rol eax, 0x8b
setb al
dec ax
sbb dl, al
xor dl, al
xor bl, dl
shl eax, 0xee
jne 0x895d5b
push ecx
neg al
and dword [esp + ecx*2], 0xcbb87ae
xor cl, byte [esp + ecx + 3]
adc al, 0xa2
not ecx
dec edx
rol al, 1
sar cx, 1
sbb edx, dword [esp + edx*2 - 0x74b354a8]
xor bl, al
mov dword [esp + edx*2 - 0x74b354a2], ecx
pop edx
lea eax, [esp + eax + 4]
xor ecx, ecx
sub word [esp + ecx + 1], 0xa02b
sbb dl, dl
or ecx, dword [eax + ecx]
mov dword [ebp + edx*8 - 4], ecx
mov eax, 0xf7a2fa00
ror word [esp + edx*8 + 1], 0x8a
mov ecx, dword [ebp + edx*2 - 4]
xor dl, byte [edi + edx - 2]
xor dl, bl
bswap eax
shl eax, 2
cwde
ror dl, 1
add dl, 0xa3
btc ax, ax
or eax, dword [esp]
neg dl
rol ax, 0xec
cwde
add dl, al
push eax
neg eax
jbe 0x8b9c0d
mov eax, 0xdc161d0b
movzx ecx, ax
mov eax, dword [edi + ecx - 0x1d0f]
movzx edx, cl
btc edx, edx
xor eax, ebx
xor edx, 0x66ae9bb0
adc cl, dh
push edx
rol eax, 2
xor cx, 0xdab6
bt edx, edx
bswap eax
or ecx, edx
lea ecx, [edx*8 + 0x31a19bc]
xor eax, 0xb622700b
rol dl, 0x83
xchg ch, cl
ror eax, 2
push edx
neg eax
bswap eax
dec edx
xor cl, byte [esp + ecx*2 - 0x711d296d]
pop edx
lea eax, [eax + ecx*2 + 0x6320965d]
not dx
sbb edx, ecx
xor ebx, eax
call fcn.00a305db
sal word [esp + 0xb], 0xed
xor ebx, ecx
add esi, ecx
call fcn.00d6d964

Function at 0x9fa139
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov dword [ebx + edx*2 + 0xc], esp
dec eax
cwde
bt edi, 0xb3
dec ebx
or ebp, dword [edx + edi + 6]
cbw
dec eax
dec edi
dec edi
lea edi, [edi + edx*2 + 0xe]
pop eax
dec eax
xor ebp, esi
inc ecx
shr ch, 0x87
dec eax
dec ebp
jmp 0x9f3b8f

Function at 0xa0174f
Capabilities:
Encode data using base64

Disassembly:
pop edx
mov ecx, 0xb9c00f
mov eax, dword [edi + ecx - 0xb9c00f]
mov dword [esp + ecx*2 - 0x173801e], ecx
shr ecx, cl
sal cx, 0x84
xor eax, ebx
dec eax
lea edx, [ecx*8 - 0x7db22d2]
xor dl, 0x2c
call fcn.008a944f
sub eax, 0xc4177c31
or edx, ecx
bt ecx, ecx
lea edx, [edx + edx*2 - 0x45ca77f8]
bswap eax
not eax
add cx, 0xd4b8
xor eax, 0xbe213030
inc eax
xor ebx, eax
call fcn.0098f0e4
mov edx, 0x1d3d0519
mov ecx, dword [edi + edx*4 - 0x74f41464]
jmp 0xa12579
shr edx, 0x2e
lea edi, [edi + edx - 0x74f0]
lea eax, [edx*4 - 0x52f7e8ed]
xor ecx, ebx
not al
call fcn.00d7963d

Function at 0xa047c5
Capabilities:
Parse pe header

Disassembly:
sal edx, 0xa
bswap ecx
neg edx
mov dword [esp + eax - 0x34a3], 0xb0299b8b
or ax, ax
dec ecx
Function at 0xa09f38
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
xor edx, ebx
sar ecx, 0x50
not edx
jae 0xda38c2
jmp 0x986629
mov edx, dword [edi]
mov ecx, 0xc53d2307
sub ecx, ecx
pop eax
lea edi, [edi + ecx*8 + 4]
movzx eax, cx
or ax, cx
jge 0x89b391

Function at 0xa0b60d
Capabilities:
Encode data using xor

Disassembly:
dec esi
lea edi, [edx + edi - 0x2c93f980]
xor edi, esi
rol edi, 2
push eax
dec edi
and dl, 0x34
sal dword [esp + edx*2 - 0x5927f207], 0x6e
dec ebp
lea eax, [ecx + edx*4 - 0x2fe8cb41]
neg edi
dec esp
sub eax, eax
inc ecx
xor eax, ecx
xor edi, 0xa381bb37
dec dword [esp + eax - 0xd9f00f9]
movsx ebp, word [esp + eax - 0xd9f00fa]
rol edi, 1
inc esp
movsx esi, dx
dec eax
mov dword [esp + edx - 0x2c93f8fc], esi
xor dword [esp + edx*2 - 0x5927f200], edi
ror word [esp + edx - 0x2c93f903], 0xc9
add al, 0x39
dec eax
not dword [esp + edx - 0x2c93f904]
dec eax
mov esi, dword [esp + edx - 0x2c93f8fc]
jge 0xdf46cc
pop ds
mov ebx, 0x1fdce32c
push ecx
popfd
push ecx
mov bh, 0xba
pop ss
push ecx
popfd
push ecx
mov bl, 0xb2
add edx, dword [ecx - 0x63]
push ecx
retf

Function at 0xa0fd0e
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor ch, dl
inc eax
ror ch, 1
dec ax
dec esi
mov dword [esp + ebp*2 - 0x102], eax
inc eax
xor ch, 0x98
inc ecx
pop ecx
inc ecx
xor ch, dl
inc ecx
add ch, dl
inc eax
xor dh, ch
pop edi
dec eax
add ebp, esp
dec edx
lea eax, [edi + ebp*8 + 0x5893c41f]
shr dx, 0xc7
dec edx
mov edi, dword [ebp + ebp*2 - 0x102]
inc cx
bt eax, 0x3f
dec edx
mov dword [ebx + ebp*2 - 0x112], edi
dec edx
lea ebx, [ebx + ebp*2 - 0x112]
jae fcn.00a14fd9
push edx
mov edx, dword [edi + ecx - 0x5212f403]
rol cx, 0xd
movsx eax, byte [esp + ecx - 0x52127e80]
lea edi, [eax + edi + 1]
sbb ax, cx
rol byte [esp + eax - 0x8183], 0xa3
xor edx, ebx
lea eax, [ecx*8 + 0x5084750c]
shr eax, 0xed
sal cl, 0xc1
dec edx
dec byte [esp + eax - 0x708c0]
xadd eax, ecx
rol edx, cl
inc byte [esp + ecx - 0x708c1]
inc edx
xor edx, 0xcb3d8c8d
shl ecx, 0xb2
neg edx
lea edx, [ecx + edx + 0x4d07422c]
xor ebx, edx
push eax
xor word [esp + eax - 0x521986c2], cx
adc esi, edx
or ax, word [esp + ecx*2 - 0x4617fffd]
mov dword [esp + ecx*2 - 0x4617fffc], ecx
mov dword [esp + ecx - 0x230c0000], esi
ret 4

Function at 0xa11c43
Capabilities:
Encode data using base64

Disassembly:
shr byte [esp + 4], 0xe4
sbb edi, 4
xor edx, ebx
lea ecx, [eax + eax*2 - 0x4d5ed0e9]
rol edx, 3
lea eax, [ecx*4 - 0x214809cd]
dec edx
and cl, cl
not al
bswap edx
not ecx
xor cl, ah
call fcn.009b16d5

Function at 0xa11cb6
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
neg byte [esp + edx*2 - 0x63d]
adc esi, eax
movzx eax, dl
xadd word [esp + edx - 0x31d], dx
sbb eax, edx
mov dword [esp + edx], esi
ret
lea ecx, [edx*2 + 0x6b342b2d]
mov dword [esp + edx*4], edx
neg eax
not dl
xor eax, 0xf9a3694
rol dx, 0x22
lea eax, [eax + ecx*2 - 0x4555684c]
ror word [esp + edx*4 - 0xfef], cl
sal byte [esp + edx*2 - 0x7f7], 1
not eax
shl cl, 0xc6
shr dl, 0xc3
btr edx, 7
rol eax, 1
and edx, edx
jnp 0x88b11b