joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9ffacc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax]
mov dword [esi - 2], ecx
sub esi, 2
movsx ecx, dl
movsx eax, dx
jmp fcn.009494ed
pushfd
or dword [esp + 8], 0xb18d973a
push ecx
shl word [esp + 0xc], 0x10
push edi
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], 0x1be670be
mov ecx, dword [esp + ecx + 0x6730004]
jne 0xa1ab03
add dword [esp + 0xc], 0xffbe0d62
mov edi, 0x1a843a88
neg edi
test edi, 0x5cbfeba5
bswap edi
mov edi, dword [esp + edi - 0x78c57be5]
jo 0x9ffb05
call fcn.00a1aaff
mov ecx, 0x90b0b600
ror cl, 0x22
bt ecx, ecx
movzx ecx, byte [ebp]
mov edx, 0x94390d37
movzx eax, dl
xor ax, dx
xor cl, bl
add cl, 0x81
imul edx, edx
not cl
sbb cl, al
neg cl
sub cl, 0x9b
dec edx
or eax, eax
xor cl, 0xbd
not ax
xor cl, al
ror edx, 0x17
add edx, eax
sbb cl, 0x80
sub edx, edx
rol cl, 1
xor bl, cl
add ecx, esp
sal dx, 0x81
xor eax, eax
add dl, byte [edx + ecx]
mov word [eax + edi - 2], dx
shr al, 0x65
movzx ecx, byte [ebp + eax + 1]
dec al
btc eax, eax
xor cl, bl
sub eax, 0x7c132222
adc cl, 0x81
not cl
dec cl
neg cl
sub cl, 0x9b
wait
xor cl, 0xbd
not cl
call int.009f18b5
dec ecx
inc edi
test cl, al
jo 0x9ffb77
mov dh, byte [ebp - 0x34e8f7ce]
xchg edx, eax
mov ch, 0x32
or byte [ebx], al
fild word [esi + 0x110832b5]
mov dword [0x47a8fa17], eax
mov bl, 0xcf
cwde
daa
or cl, cl
leave
push 0x7f
xchg ebx, eax
xchg esp, eax
mov dh, 0x4b
aas
xor edx, dword [eax + edi*4]
stc
jae 0x9ffb93
packsswb mm1, qword [ebp + 0xfd56590]
arpl word [ebp + 0xfc16dea], cx
arpl word [ebp + 0xed568cc], cx
push ecx
invalid
invalid
Function at 0xa00d0d
Capabilities:
Manually build aes constants

Disassembly:
lea edi, [edi + eax - 0xd5270bd]
push edx
lea edx, [eax*4 - 0x2d425b79]
imul ax, cx
sar ecx, 0xde
popfd
sub cl, 0xbe
call fcn.00979a62
or edx, 0x798768e
neg eax
rol dl, 2
adc edx, ecx
ror eax, 1
ror dl, 0xc7
bswap eax
xadd dword [esp + ecx*2 - 0x70000000], edx
inc edx
xor ebx, eax
lea ecx, [edx + edx*8 + 0x2d3997a2]
sub ecx, dword [esp]
add dl, 0xb1
add esi, eax
call fcn.00a352ef
div cl
movzx dx, byte [ecx + edi - 0x7a7bf306]
add cl, cl
mov al, byte [edi + eax*8 - 0x1806]
push ecx
neg dword [esp + ecx - 0x7a7bf30c]
lea edi, [edi + ecx - 0x7a7bf30a]
sub ecx, 0x9280235
or dl, al
not dl
push ecx
or ecx, dword [esp + ecx - 0x7153f0d3]
setno byte [esp + 5]
mov word [edi], dx
jns 0xa80195
jae 0xa03961
mov edx, dword [edi]
add edi, 4
movzx eax, cl
dec eax
push edx
neg eax
js 0xacdba9
sub esi, 4
mov edx, dword [esi]
xor edx, ebx
mov eax, 0xc399860c
sar eax, 0x4a
rol edx, 1
push eax
dec edx
lea ecx, [eax*2 - 0x745affe4]
ror edx, 1
sar word [esp + 2], 0xa4
setns byte [esp + 2]
neg edx
add ecx, dword [esp]
inc edx
dec eax
lea eax, [ecx + ecx*2 - 0x42f26dd3]
bts eax, eax
neg edx
dec edx
dec ecx
add eax, dword [esp + eax - 0x5ca4afea]
neg dword [esp + eax - 0x5ba5964b]
neg edx
rol edx, 3
pop eax
xor ebx, edx
add ebp, edx
and cx, cx
mul eax
mov edx, dword [edi + eax*4 - 0x3549c304]
jb 0x94b8f2
mov ecx, 0x2315d53f
lea ebp, [ebp + ecx - 0x2315d543]
lea edx, [ecx*4 + 0x1ca0a090]
xchg edx, ecx
mov edx, dword [edx + ebp - 0x2315d53f]
movzx eax, cl
xor edx, ebx
cwde
imul eax, ecx
bswap edx
inc cl
sar ecx, cl
neg ecx
rol edx, cl
push eax
xadd al, ah
sbb edx, 0x93135f02
xor eax, 0xaf82bc83
bswap edx
sal dword [esp + ecx - 0x2b841], cl
xor ebx, edx
cwde
add edi, edx
push eax
btc ax, ax
mov si, word [esi + eax*8 - 0x122d8]
cdq
pop edx
pop ecx
jb fcn.00a27318
mov ecx, 0x8caa7a30
mov edx, 0xf017de31
btr edx, ecx
mov ecx, dword [edi]
shr dx, 0xaf
lea eax, [edx*4 - 0xde876df]
adc eax, edx
mov dl, byte [edi + 4]
add ax, ax
bts eax, eax
adc edi, 6
btr ax, ax
mov byte es:[ecx], dl
mov ecx, eax
mov edx, ecx
sbb ebp, 3
mov eax, dword [ebp]
sal cl, 2
sal ecx, cl
xor eax, ebx
push edx
rol eax, 1
bswap eax
lea eax, [ecx + eax + 0x26996a39]
and dl, ch
je 0x997e09
pop ecx
pop ecx
pop ecx
jmp esi

Function at 0xa07548
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx - 0x2144267], ecx
dec eax
xor cl, ch
xor dword [esp + edx - 0x2144266], edx
dec dword [esp + edx - 0x2144263]
xor ebx, eax
rol dx, cl
or cx, dx
btr cx, cx
add esi, eax
neg ecx
pop eax
mov edx, dword [ecx + ebp - 0x5e07199c]
not cl
sub word [esp + ecx - 0x5e071962], 0xfa85
mov al, byte [ecx + ebp - 0x5e07195f]
jae 0x96ce4d
xor bl, al
sar dl, 0xe4
lea eax, [esp + eax + 4]

Function at 0xa09595
Capabilities:
Encode data using base64

Disassembly:
mov esi, 0x6839b026
call fcn.009a1f41
Function at 0xa0b1a5
Capabilities:
Encode data using base64

Disassembly:
xor bl, dl
movzx ecx, byte [esp + eax*2 - 0x771e8]
lea edx, [esp + edx + 0x10]
movzx ax, byte [edx + eax - 0x3b8f8]
and byte [esp + ecx*4 + 0xd], ch
shl cx, 6
setbe cl
mov word [ecx + edi - 5], ax
push ecx
movsx eax, cx
lea edi, [edi + ecx*2 - 6]
movzx edx, byte [esp + ecx + 0xd]
pop edx
pop ecx
pop ecx
pop edx
pop ecx
jae fcn.009f6469
adc edi, ecx
mov edx, dword [ebp + edx - 0x6d361ad1]
rol ax, 0x8a
sbb ebp, 0xc
mov dword [esp], eax
neg word [esp + 1]
xor edx, ebx
rol edx, 1
movzx ecx, byte [esp]
xadd cx, ax
shl eax, 0x3c
inc edx
rol edx, 2
sub edx, 0xd1197818
and al, cl
inc cx
xor ebx, edx
add al, byte [esp + eax + 0xa]
mov dword [eax + esi - 0x65], edx
bswap ecx
jge 0xa34347
sub edx, 0x2d34e53c
jns 0x9f4503
ror eax, 1
or cl, dl
not eax
ror eax, 2
btc edx, edx
xor ebx, eax
sal word [esp + ecx*2], cl
xchg ecx, edx
and dl, 0x99
adc ebp, eax
add dword [esp + ecx*4 - 0xc], 0x669f049f
mov dword [esp + ecx - 3], ebp
ret
dec eax
lea edx, [esi + ecx*4 - 0x4100008]
not byte [esp + eax*4 - 0x16a]
not word [esp + eax*2 - 0xb8]
mov dword [esi + ecx*2 - 0x208000c], edx
or cl, al
sub dword [esp + eax - 0x55], ecx
lea esi, [esi + eax*4 - 0x17c]
ror dword [esp + eax - 0x58], 0x2a
movzx edx, word [esp + eax - 0x54]
jne 0xabf77d
shl ecx, 0x62
mov dword [esp + eax*2 - 0x6fff0], ecx
xor dl, 0x29
sal ax, 0xc1
ror dl, 1
xadd ax, cx
pop ecx
jle 0x9b172f
mov ecx, 0xce107296
movzx edx, cl
mov eax, dword [edx + ebp - 0x96]
sub cx, cx
lea ecx, [ecx + edx*2 - 0x7375f148]
and dl, dl
lea ebp, [ecx + ebp - 0x5a9a0fe0]
push eax
xadd dl, ch
jp 0xac0ed2
pop eax
pop eax
pop eax
jae fcn.009494ed
mov edx, 0x7d1e471b
inc edx
movsx ecx, dx
lea ebp, [ecx + ebp - 0x4720]
rol ecx, cl
mov eax, dword [ebp + edx - 0x7d1e471c]
sal dx, 0x86
call fcn.00a5416e
outsb dx, byte [esi]
std
leave
jg 0xabf756
cmpsb byte [esi], byte es:[edi]
in al, dx
jb 0xabf733
invalid
bt cx, cx
popfd
mov edx, dword [edi + ecx - 0x5a9a96e4]
dec ecx
movzx eax, cl
or ecx, eax
lea edi, [eax + edi - 0xdf]
xor edx, ebx
shr eax, 0x1c
rol edx, 1
bts ax, cx
adc al, 0xa9
sbb edx, 0x80b3d327
shl eax, 0xb5
bt eax, 0xa
bswap edx
neg ecx
xadd eax, ecx
dec edx
shl eax, 0x93
xor ebx, edx
cwde
not ax
call fcn.0096081b
mov edx, dword [edi]
mov ecx, 0x6ab03916
movzx eax, cl
mov ecx, dword [eax + edi - 0x12]
sub al, al
lea edi, [edi + eax*8 + 8]
btr ax, ax
btr ax, 0xf
adc edx, ecx
movsx ecx, al
sal eax, 0x7e
btr cx, ax
lea eax, [esp + eax*2 + 0x40]
sar cl, 0x21
bts ecx, ecx
mov dword [eax + ecx - 1], edx
btr ecx, ecx
mov edx, ecx
xor cl, 1
mov eax, dword [esi + ecx*4 - 4]
lea esi, [ecx + esi - 4]
xor eax, ebx
push edx
ror eax, 2
not eax
jmp 0xa0d957
Function at 0xa0f1a4
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
ror cl, 1
mov dword [esp], edx
neg cl
xadd dword [esp], edx
sub edx, 0xee3f623a
ror cl, 1
xor dl, 0x2b
jge 0x9a51f6
not cl
lea edx, [edx + edx*2 - 0x8405d62]
sbb cl, 0xbd
inc byte [esp + edx - 0x2b931992]
xor bl, cl
xor dl, dl
lea ecx, [esp + ecx + 4]
sar dword [esp + edx*2 - 0x57263200], 0xe1
mov dword [ecx + edx*2 - 0x57263200], eax
lea eax, [ebp + edx*2 - 0x572631fc]
xadd word [esp + edx - 0x2b9318ff], dx
pop edx
mov ecx, edx
mov dword [ebp + edx - 0x2a498a46], eax
movzx eax, cx
sar cx, cl
cmovs cx, dx
mov eax, dword [edi + edx*2 - 0x5493148b]
xor eax, ebx
call fcn.00964681
mov eax, 0x52146cae
movsx ecx, ax
mov eax, dword [ebp + ecx - 0x6cae]
sar ecx, 0x78
movsx edx, cx
sub dx, dx
lea ebp, [edx + ebp + 4]
not cx
xor eax, ebx
sar cl, 3
xchg ecx, edx
sbb eax, 0xcc2d2522
sub cx, cx
btc edx, ecx
push edx
xor eax, 0x26b38b9a
mov dword [esp + ecx*8], ecx
push edx
dec eax
neg eax
sar dword [esp + ecx + 4], 0x95
push edx
not eax
rol dword [esp + ecx*2 + 2], 0xec
xor ebx, eax
shl dword [esp + ecx + 7], 0xf6
adc esi, eax
shl ecx, 0x85
movzx eax, word [ebp + ecx]
pop ecx
pop ecx
sub cx, 0x4095
lea ebp, [ebp + ecx*2 - 0x13ed4]
xor ax, bx
shr word [esp + ecx*4 - 0x27dab], cl
sar edx, 0xab
dec ax
xor cl, dl
xor edx, dword [esp + ecx - 0x9f74]
neg ecx
ror ax, 1
push ecx
xor dword [esp + edx*2 - 0x3b], 0x202e59b4
not ax
rol dword [esp + edx*8 - 0xf8], 0x4d
dec ax
rol edx, 6
setae byte [esp + edx*8 - 0x3dfc]
and dx, 0xce38
xor ax, 0x352b
inc dl
xor bx, ax
lea edi, [edi + edx - 0x603]
mov word [edx + edi - 0x601], ax
dec byte [esp + edx - 0x5fd]
lea eax, [edx*4 - 0x8f55943]
pop edx
pop eax
jno fcn.00a3b739

Function at 0xa0f32f
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
xor ebx, eax
bts edx, 0x21
adc edi, eax
shl word [esp + ecx*2 - 0x625ef73c], 0xa3
sete dl
jbe 0x9c318b
sub eax, 0x61b2a58e
push ecx
xor cx, word [esp + ecx - 0x312f3af9]
jae 0x9a99a8
mov ecx, dword ss:[ecx]
add eax, 0xa9d6ba61
cmp cl, 0x51
mov edx, 0xc5aca9d6
jne 0xa0f310
salc
test eax, 0x853275e4
ror dword [ecx + 0x2d], 1
out dx, eax
aaa
add eax, 0x1a78a9f
rcl dword [ecx + 0x23], cl
xchg dword [0xeb196f79], ebp
pop ebx
jo 0xa0f3a1
sal dword [edi + 2], cl
xor eax, dword [ebp - 0x31ccdf23]
imul ecx, dword [eax], 0xa6acc2a5
jb 0xa0f400
movsd dword es:[edi], dword [esi]
ret 0x1dac
salc
test eax, 0xbaf8a801
salc
test eax, 0xbab8c424
salc
test eax, 0x6f17e821
salc
mov dword [edx], edi
mov edi, 0xacc98560
push edi
jg 0xa0f3e8
loop 0xa0f360
mov dword [0xa9be8a81], eax
sub ah, byte [eax + 0x20c005e0]
mov cl, 0x86
and dword [edi - 0x427f7baf], edx
push cs
retf
add eax, 0x15a3762
movsb byte es:[edi], byte [esi]
invalid
smsw word [edx - 0x70e22189]
pushfd
pop ebx
leave
push edi
lahf
leave
cmp al, 0x5a
adc ebx, dword [eax - 0x75]
mov edi, 0x7a40331
pop esi
inc esp
ret 0xd0ba
Function at 0xa1b5f9
Capabilities:
Parse pe header

Disassembly:
not ecx
mov dword [esp + edx - 0x19843436], edx
xor edx, 0x712eb102
bts edx, 0x29
xor ecx, 0x779dbd91
add dx, dx
ror ecx, 1
neg dword [esp + edx - 0x68aa0e68]
bswap ecx
movsx eax, dl
adc dword [esp + edx - 0x68aa0e68], eax
dec eax
xor ecx, 0x6a1c1b29
sub dword [esp + edx - 0x68aa0e68], eax
je 0xaccda6
cwd
xor ebx, ecx
cwd
or edx, 0xd2a3cda0
sbb dx, ax
adc esi, ecx
sal word [esp + eax - 0x66], 0x2b
movzx ecx, word [esp + eax*8 - 0x338]
xor eax, 0x892a7532
mov edx, dword [ebp + ecx - 0xcc]
shr ecx, cl
sar cl, 0xa5
shl dword [esp + ecx], 0x5d
or ecx, dword [ebp + ecx*4 + 4]
add ebp, 8
neg al
shr dword [esp], 0x38
mov dword [edx], ecx
mov dword [esp + 4], eax
mov edx, eax
pop edx
pop edx
jmp esi
add edi, 4
xor ecx, ebx
ror edx, 0x27
jae 0x98d4f4
movzx ecx, dl
adc cl, cl
mov eax, dword [edi + edx - 0x11020200]
lea edi, [edi + edx*4 - 0x440807fc]
xor eax, ebx
rol edx, 0xb6
rol eax, 1
add edx, ecx
dec eax
mov dword [esp + ecx*8], edx
xor eax, 0x16392591
shr ecx, 0x59
rol edx, 0xc8
rol eax, 1
shr dl, 1
imul ecx, ecx
not dword [esp + edx - 0x4408040]
xor ebx, eax
shr word [esp + edx - 0x440803e], 0xa
add esi, eax
mov dword [esp + ecx*4], esi
ret

Function at 0xa2003b
Capabilities:
Encode data using xor

Disassembly:
neg dx
lea eax, [esp + eax + 0x10]
or dword [esp + edx - 0xa87facb], edx
bts edx, edx
add edx, 0x111cb81b
mov dword [eax + edx*2 - 0x374965e4], ecx
sub dx, 0x2d3f
btr edx, edx
movzx edx, byte [edi + edx*4 - 0x6e9216c7]
push 0x2c80ec2e
sbb edi, 0xfffffffa
shr dword [esp + 0xa], 0x42
mov ecx, 0x1c353704
xor dl, bl
push ecx
neg dl
mov dword [esp + ecx - 0x1c3536fc], ecx
sub cx, 0xad84
ror dword [esp + ecx - 0x1c35897e], 0xd
inc dl
xor dword [esp + ecx*2 - 0x386b12fa], 0x65918a96
ror dl, 1
call fcn.009968a1
mov ecx, 0xd13c8f9c
xor cx, cx
mov edx, dword [edi]
adc edi, 4
add cl, ch
xor edx, ebx
sub cl, 0xa8
sar cl, 0xe5
sbb edx, 0xfca5daba
mov eax, ecx
ror eax, cl
xchg ecx, eax
ror edx, 2

Function at 0xa4e0ff
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp + eax - 0x30100000], 0x608eb2b2
lea esi, [esi + eax*2 - 0x60200002]
movzx ecx, al
call fcn.00aaa3ae

Function at 0xa5a512
Capabilities:
Encode data using base64

Disassembly:
push eax
movzx ecx, ax
rol edx, 3
bswap ecx
neg eax
dec dword [esp + eax - 0x586f966f]
inc edx
bswap edx
xor ebx, edx
shl eax, 0x6d
call fcn.00a0e42d
neg cl
rol cl, 1
add al, dl
adc cl, 0xff
xchg dword [esp + 0x14], edx
rol cl, 1
rol dl, 0xe2
mul dword [esp + edx*2 - 0x63480368]
dec cl
inc al
neg dx
xor bl, cl
sar dl, 0x21
lea ecx, [esp + ecx + 0x18]
dec eax
call fcn.009f6d5f
push 0xe10bf21c
shl byte [esp + 3], 0x81
mov edx, dword [edi]
xor edx, ebx
push 0xc588202f
not edx
mov eax, 0xa790698d
xor dword [esp + 4], eax
inc edx
jmp 0x9f44e4
Function at 0xa5c1d5
Capabilities:
Encode data using xor

Disassembly:
xor cx, word [esp + ecx - 9]
rol al, 1
inc al
xor edx, dword [esp + ecx - 0x2a6]
xor bl, al
sal ecx, cl
sub dword [esp + ecx*4 - 0x555ffc], 0x832d75b2
lea eax, [esp + eax + 0xc]
bts ecx, ecx
and edx, 0x9963a17
mov dword [esp + ecx - 0x155801], edx
movzx dx, byte [eax + ecx - 0x155801]
push ecx
lea edi, [edi + ecx - 0x155803]
rol byte [esp + ecx - 0x1557f3], 5
jnp 0xa48db0

Function at 0xa60492
Capabilities:
Encode data using base64

Disassembly:
adc edx, 0xd7b8f59a
ror al, 0xa1
xchg byte [esp + ecx - 0xce82b1], al
jno 0xa553e7
mov edx, 0x603f3896
mov eax, dword [edi + edx - 0x603f3896]
mov ecx, edx
lea edi, [edi + ecx - 0x603f3892]
or edx, ecx
dec cx
xor eax, ebx
xchg cl, dl
sub eax, 0xca87372d
rol edx, 1
dec edx
call fcn.00974380
jmp 0x99aac3
sub edx, edx
xor edx, dword [edx + esi + 5]
mov ecx, dword [esp + 4]
mov eax, 0x5391048e
sal eax, 0x82
lea esi, [esi + ecx*2 - 0x1fd9f5d]
xor edx, ebx
pop eax
add word [esp + ecx - 0xfecfb2], cx
bswap edx
xchg dword [esp + ecx*2 - 0x1fd9f66], ecx
mov eax, dword [esp + ecx*2 - 0x19d0566]
lea edx, [ecx + edx + 0x663c47d7]
btr eax, ecx
inc word [esp + ecx*2 - 0x19d0564]
not edx
shl al, 0xc1
jbe 0x9656ed
sub esi, 4
mov eax, dword [esi]
mov ecx, 0x5fb5ef20
inc cx
lea edx, [ecx*4 + 0x1112a19e]
xor eax, ebx
sub ecx, ecx
ror eax, 1
or cl, 0x8c
xor eax, 0xc4927b8a

Function at 0xa6a821
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xd51953a1
cmp edi, eax
push 0x250a6f9d
call fcn.00a954b2
jnp 0x9d4dd3

Function at 0xa8a3c8
Capabilities:
Packed with generic packer

Disassembly:
pop ecx
mov ecx, 0x4b850034
not al
lea edx, [ecx + ecx + 0xc1a6ab5]
bts dx, 0xb
rol dx, 0xc7
movzx ax, al
neg cx
xchg ch, dl
mov dl, byte [edi + ecx - 0x4b85b5ca]
rol ecx, 0xdf
xchg ch, cl
not al
not ecx
not dl
or al, dl
dec cx
btr ecx, ecx
movzx edx, cl
mov word [edi + edx*4 - 0x8e], ax
mov eax, 0xfd04ef13
jae 0xabd560
lea edi, [edi + edx*2 - 0x46]
mov edx, dword [edx + ebp - 0x28]
adc ebp, 0xfffffffc
bts ecx, eax
xor edx, ebx
sub edx, 0x3c85cc22
call fcn.00a3b839
Function at 0xa954b2
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
ja 0x9c5f7c
push 0x5bbb4896
lea edx, [esp + 4]
mov ecx, dword [esp]
sub dword [esp + ecx - 0x5bbb4896], ecx
mov eax, ecx
lea ecx, [eax - 0x5bbb4842]
neg al
btc ax, ax
lea eax, [edi + eax - 0x5bbb4cea]
and eax, 0xfffffffc
sub dword [esp], 0x8b07b601
jbe 0x9ccd9a
xadd ecx, eax
xor ebx, edx
add edi, edx
mov dword [esp + eax*4 - 0x21f4f670], edi
ret 4

Function at 0xa9986c
Capabilities:
Authenticate hmac

Disassembly:
add ebp, 6
call fcn.009f5daa

Function at 0xa9cd4e
Capabilities:
Encode data using xor

Disassembly:
xor bl, dl
add edx, esp
call fcn.00aa9f44
mov eax, dword [esi + ecx - 0x47302787]
mov edx, ecx
lea ecx, [edx + ecx*8 + 0xa8ef011]
add edx, ecx
xor eax, ebx
add edx, 0x2c120f18
xor eax, 0x5f24241f
sub ecx, ecx
xchg edx, ecx
lea eax, [edx + eax - 0x5a3afb25]
rol dl, 1
neg ecx
neg eax
add edx, edx
xor eax, 0x3bba6820
lea edx, [edx*2 - 0x15d08b4f]
shl ecx, 0xc4
sbb eax, 0x7d31b58a
sal ecx, 0xbe
sar dx, 0xab
bswap ecx
ror eax, 3
bt edx, ecx
xor ebx, eax
btc dx, 0x10
sbb cl, dl
add ebp, eax
shr cx, 0x8f
ja 0xaabccb
adc ecx, ebp
jmp ecx
retf 0xc00f
mov dword [0xd3daf6c1], eax
leave
sbb dl, 0x9b
bts eax, ecx
setae cl
xor dl, 0xbd
shl eax, 0x33
not dl
setns cl
shr ax, 0xcc
sbb dl, 0x80
jmp 0xa9e13e
not ecx
or eax, 0x989b4fa7
ror word [esp + edx + 4], 0xa5
lea ecx, [eax + ecx + 0x11f57109]
call fcn.00a07f7b
adc dh, byte [ebp + 0x15412600]
test bh, bl
test eax, 0x843989e0
fild qword [ecx - 0x7bcaba54]
fild qword [ecx - 0x44f1d608]
fmul dword [ecx + 0x79]
mov ebx, 0x8a86c368
mov bl, 0xbb
imul edx, dword [ecx - 0x61], 0xffffffbc
dec ebx
cmp dword [ecx], edx
sbb byte [esi], bh
js 0xa9cd22
push ebx
loopne 0xa9cdcb
push ss
js 0xa9cd28
push ebx
dec eax
adc al, 0x1a
js 0xa9cd2e
push ebx
sbb eax, esp
dec eax
dec esi
ret 0x77ee
neg dl
sal edi, 0xad
mov eax, 0xac83489a
ror dl, 1
lea ecx, [edi*8 - 0x9e7dd4f]
not dl
not cx
not al
dec edi
xor bl, dl
add edx, esp
btc eax, ecx
cwde
mov ecx, dword [edx + eax*8 - 0x4328]
sar al, 1
mov edx, ecx
lea ecx, [edi + edi + 0x4a071c37]
xchg edx, esi
mov edi, edx
sbb eax, eax
jp 0x9fc6e4
das
inc esp
jp 0xa9ce0d
not ebp
scasb al, byte es:[edi]
aad 0xae
push edx
das
xor eax, 0x7eafb008
dec ebp
xor eax, 0x5c8e1108
cmp byte [eax], cl
adc eax, 0x92ca46b4
add eax, 0x565ab0b0
sub al, byte [edi]
mov dword [0xb62e0f59], eax
adc al, 0x86
or esi, dword [eax - 5]
mov eax, dword [0x568c03fd]
movsb byte es:[edi], byte [esi]
les ecx, [edi - 0xd]
sub byte [ebx + 9], 0xa0
inc ebx
out dx, eax
mov byte [ebx + 9], ch
mov al, byte [0x6bccb333]
or dword [eax + 0x67ae7f0f], esp
xor ecx, dword [ebp + 0x3c7782d2]
js 0xa9ce11
dec ecx
invalid
inc eax
rol dl, 1
jmp 0x9553f3
add cl, 0x3d
or cl, 0xbc
Function at 0xace44d
Capabilities:
Encode data using base64

Disassembly:
sub cl, dl
rol eax, 3
lea eax, [eax + edx + 0x2d595e9e]
not eax
call fcn.00a71273
mov ecx, 0xe3e2535
mov edx, dword [ebp + ecx*2 - 0x1c7c4a6e]
mov eax, ecx
rol eax, cl
xor edx, ebx
inc cx
shl ecx, cl
ror edx, 3
xor eax, 0xdb361620
not edx
dec edx
rol cx, 0xca
ror edx, 1
bt ecx, eax
inc edx
sar cl, 6
neg al
cbw
rol edx, 3
xchg ecx, eax
xor ebx, edx
xadd ax, cx
adc edi, edx
lea edx, [eax + eax*2 - 0x2d7c7cd1]
movzx edx, byte [ebp + ecx - 0x7d970005]
sal eax, 0xa6
ror ecx, 0xd1
bswap eax
xor dl, bl
ror ecx, cl
dec dl
bt eax, 0x88
cwde
call fcn.00995114
xor eax, ebx
and byte [esp + ecx + 0x412a9b22], 0x13
ror eax, 1
neg dx
imul ecx, dword [esp + ecx + 0x412a9b28]
not dx
dec eax
and cl, 0x19
btr edx, edx
rol eax, 1
rol ecx, 0x49
not ecx
pop edx
lea eax, [eax + ecx*2 + 0x6fa178a1]
jb 0x9b0664
mov edx, ecx
lea ebp, [ebp + ecx + 0x412a9b1e]
movsx eax, word [esp + ecx + 0x412a9b2e]
bswap eax
sar dword [esp + ecx + 0x412a9b2e], cl
mov eax, dword [ebp + ecx + 0x412a9b22]
mov dword [esp + ecx + 0x412a9b22], ecx
jne 0xa23cbc
Function at 0xad5c10
Capabilities:
Encode data using base64

Disassembly:
dec eax
bswap eax
mov ecx, dword [esp + edx - 0x755ad001]
rol eax, 2
lea edx, [edx*8 + 0x6613f63b]
not edx
xchg ch, cl
xor ebx, eax
btr ecx, ecx
adc esi, eax
movsx eax, word [esp]
sub ebp, 2
shl byte [esp + 3], 0x65
movzx ecx, word [ebp]
xadd byte [esp + 1], dl
adc byte [esp], 0xad
shr edx, 0x4e
xor cx, bx
shr edx, 0x7e
not eax
cdq
ror cx, 1
sal eax, 0xda
sal word [esp + edx + 1], 0x8f
cdq
sbb cx, 0x8601
ror cx, 1
bt ax, ax
not cx
dec dword [esp + edx]
neg cx
not edx
ror eax, 0xfe
ror cx, 1
sal dword [esp + eax*2 - 0x60000000], 0x35
sbb cx, dx
bswap eax
add eax, dword [esp + eax*2 - 0x60]
neg cx
sar edx, 0xfe
call fcn.009a07d9
inc ecx
xor ax, 0x1b14
cdq
neg ecx
shl dx, 0xc9
sets dl
dec ecx
sar al, 0xe1
cwde
xor dx, dx
bswap ecx
inc edx
shl edx, 0x42
xor ebx, ecx
add dl, ah
adc esi, ecx
movsx ecx, al
ror eax, 0xdd
shl dl, 0xe1
mov ecx, ebp
push edx
shr eax, 0xd4
lea ebp, [ebp + eax - 0x1003]
xchg dword [esp + eax*2 - 0x1ffe], eax
dec al
add al, 0x14
mov dword [esp + edx], 0x8738f7b3
shr ecx, cl
rol al, 1
xchg edx, ecx
or ecx, dword [esp + edx*4]
adc al, 0x86
pop edx
and ecx, edx
rol al, 1
inc al
sal edx, 1
rol edx, cl
xor bl, al
bts dx, cx
add eax, esp
imul ecx, edx
cmovo dx, cx
and edx, ecx
mov edx, dword [eax + edx*4 - 0x488317f4]
lea eax, [ecx*2 + 0x37ac31a3]
push ecx
mov dword [eax + ebp - 0x5cfbbda5], edx
cwde
sbb ebp, 8
ror al, 1
cmovae cx, ax
lea edx, [ecx*8 - 0x3ddc2ef1]
mov edx, dword [edx + esi - 0x576200f2]
adc esi, 8
push eax
sal word [esp + 1], 0xc1
inc cl
xor edx, ebx
bswap edx
not edx
call fcn.0094e437
mov word [esp + edx - 0x5ae3f7ed], dx
xor ebx, eax
rol dx, cl
ror edx, 0x99
add dword [esp + edx - 0x71f87bac], edx
add edi, eax
mov dword [esp + edx - 0x71f87bad], edi
ret 0xc
call fcn.009d2eb0
sub ebp, 4
mov ecx, 0xbd12f413
mov ecx, dword [ebp]
mov edx, 0xa90d6c10
rol edx, 0x85
xor ecx, ebx
mov eax, edx
not ecx
add dl, dh
cdq
dec ecx
btr edx, eax
sub dx, 0xfcb2
call fcn.0099a7e5
mov eax, dword [esi]
mov ecx, 0xf898752e
not cl
mov edx, dword [esi + 4]
shr ecx, cl
inc cl
lea esi, [esi + ecx*2 - 0xf896]
not eax
btr cx, cx
not edx
call fcn.00a60d8a
push 0x1b1a4605
sub ebp, 4
dec dword [esp]
mov eax, 0xb2057d98
mov edx, 0x2c1755ad
mov eax, dword [ebp + edx - 0x2c1755ad]
xor eax, ebx
sal edx, 0xc
ror eax, 3
neg dword [esp + edx - 0x755ad000]
setp dl
jl 0x9f1ad3
mov edx, 0x6d068f9e
mov ecx, dword [edx + esi - 0x6d068f9e]
btc edx, 0x24
xor ecx, ebx
lea ecx, [ecx + edx - 0x237178e4]
bswap edx
push edx
movzx eax, byte [esp]
not ecx
sub al, 0xe
cbw
neg ecx
sub dword [esp + eax*8 - 0x2f8], eax
sbb ecx, 0xfcadc997
and byte [esp + eax*4 - 0x179], dh
cdq
not ecx
jbe 0xa912ed
xchg dword [esp + edx*8], eax
xor ebx, ecx
mov dword [ebp + edx - 4], ecx
add eax, edx
movzx eax, byte [edx + esi + 4]
or dword [esp + edx], 0xbc20278d
xor al, bl
movzx ecx, word [esp + edx]
inc al
ror al, 1
jmp 0xac9d2f