joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe53463
Capabilities:
Encode data using xor

Disassembly:
cwde
lea ecx, [eax + ecx + 0x2692462d]
jmp ebp
mov dword [ebp - 4], eax
push 0xdf9200a9
test ebx, ebx
jmp 0xf37d96
mov eax, 0x1a232914
mov eax, dword [ebp + eax - 0x1a232914]
call eax
mov ecx, 0x5b1d7ab2
mov ebp, dword [ecx + ebp - 0x5b1d7ab6]
mov ebx, ecx
mov dword [ebp + ebx - 0x5b1d7ab2], eax
test byte [0xa4e2854e], bl
movsx edi, cx
mov esi, ebp
not edi
movsx eax, cx
pop ebx
pop ebp
inc ecx
pop edi
jnp 0xbe1d95
add byte [eax], al
add byte [edi], bh
insd dword es:[edi], dx
outsd dx, dword [esi]
jne 0xe61d38
push edx
insb byte es:[edi], dx
popal
jae 0xe61d32
inc ebp
jbe 0xe61d35
outsb dx, byte [esi]
je 0xe61d13
push ecx
dec esp
imul ebp, dword [esi + 0x65], 0x74696445
inc eax
inc eax
dec ebp
inc ecx
inc ebp
pop eax
push eax
inc ecx
push esi
push ecx
dec ebp
outsd dx, dword [esi]
jne 0xe61d5d
inc ebp
jbe 0xe61d53
outsb dx, byte [esi]
je 0xe61d31
inc eax
inc eax
pop edx
add byte [edi - 0x37], dh
leave
push ebx
clc
mov byte [ecx + ebp*4 - 0x3b], dl
cmp eax, 0xcaaecb55
cmp eax, 0xc3d9da85
pop edx
xchg dword [ebx - 1], ebp
invalid
jae 0xe61ca3
dec ecx
cmp al, 0x10
pop esp
nop
loop 0xe61d59
sub eax, 0xc28d5d15
push ss
cli
cmpsd dword [esi], dword es:[edi]
and dword [0x75bf7520], edi
movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
iretd
invalid
iretd
mov edx, 0xbc729d69
jb 0xe61cf6
pop eax
pop esp
add cl, dh
pop esp
cmpsb byte [esi], byte es:[edi]
invalid
inc esi
push cs
pop es
movsd dword es:[edi], dword [esi]
sub al, 0xec
dec esi
adc edi, dword [ebp + eax*2 + 0x40]
inc ebp
mov dword [edi - 0x128e3117], esi
mov bh, 0xe9
into
jno 0xe61d45
sbb dword [edx], esp
leave
and cl, cl
invalid
pop ds
test byte [eax + 0x54], 0x78
xchg ebp, eax
add al, 0xdd
cdq
adc ah, bh
mov eax, dword [0xba0d626b]
adc eax, 0xcc821f2e
pop ss
mov al, byte [0x60400555]
add esi, dword [ebx + 0x1383c90c]
mov dl, 0xa8
add dword [ecx - 0x72ef66a0], ebx
dec ecx
xor byte [eax - 0x45], dh
pop edi
inc edx
jl 0xe61dc1
inc ecx
invalid
dec edx
cmp byte [edx + 0x79cdef7b], 0x6e
mov dl, 0x86
rol ah, 1
push es
xor bh, bl
out 0x14, al
xor edx, dword [edi + 0x7e]
adc edi, edx
jp 0xe61e32
mov al, byte [0x8eae8d9e]
dec edx
int3
xor eax, 0xb0e4d49b
loop 0xe61db5
pop ebp
xor bh, byte [edi]
bound edi, qword [edi - 0x4963952c]
cmpsb byte [esi], byte es:[edi]
stc
pop ds
pop eax
test eax, 0x1c06f577
clc
inc edx
jge 0xe61e17
dec edi
sub dl, ch
stosd dword es:[edi], eax
cmp bl, bl
neg dword [bx + 8]
cmp al, 0x84
aaa
cmp bl, byte [eax + 0x16794aca]
jno 0xe61dd6
pushfd
popfd
invalid
lcall 0x41ca, 0x2421a8cc
xor dword [edx], esp
or eax, 0x43cf4ae9
jmp 0xc965b44e
neg dword [eax]
and al, 0xa3
jne 0xe61ea6
dec edi
mov ch, 0xf5
inc edx
cli
xchg edx, eax
mov esi, 0xa2c97b95
jno 0xe61dde
invalid
adc edi, dword [eax]
test al, 0xab
in al, dx
mov gs, word [esi]
jbe 0xe61e43
retf 0x80b0
push 0x20320f84
push 0x461a948e
lea esp, [esp + 0x14]
je 0xe61c86
mov eax, 0x3d01faac
mov eax, dword [ebp + ebx*4]
push 0xd5b63e2e
mov dword [esp], eax
call fcn.00e61c6f
Function at 0xe606a3
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor edi, ecx
jmp fcn.00f6032f
mov dword [esp], edi
mov edi, 0x3d8e041f
movzx edi, byte [eax + edi*2 - 0x7b1c083e]
jmp 0xd9f9aa
Function at 0xe7546a
Capabilities:
Encode data using base64

Disassembly:
not cl
jmp ebp
sub byte [esp + eax - 0x4c80], 0xc
bswap ecx
sbb edx, 0x158eb52a
xor ebx, ecx
xchg word [esp + eax - 0x4c79], dx
xor dword [esp + eax - 0x4c7c], eax
adc ebp, ecx
mov dword [esp + eax*2 - 0x9902], ebp
ret 8
inc dx
dec eax
dec ecx
shl dword [esp + eax*2 - 0x98fd], 0xd0
jne 0xbffcce
lea ecx, [eax + ecx + 0x3af4f90]
sub dword [esp + eax*2 - 0x98fc], 0x87af90bc
jl 0xec72f8
xor ecx, 0x9f218c0d
jmp 0xc25f70
lea ebp, [edx + ebp - 0x7eb30009]
mov word [edx + ebp - 0x7eb3000b], ax
movzx eax, dl
lea ecx, [edx + eax*4 + 0x63af5800]
lea edi, [edi + eax - 0xf]
not cx
btc cx, 0xa
cdq
mov eax, dword [edx + edi]
inc cl
xor eax, ebx
neg eax
bswap eax
dec ecx
inc eax
xor eax, 0x23b94513
not edx
xor eax, edx
sub dl, 0x83
sar edx, 0x87
xor ebx, eax
add esi, eax
bt edx, ecx
setb cl
inc ecx
jmp esi
sal al, 0x87
xor bl, dl
lea edx, [esp + edx + 0xc]
and al, 0xba
xor eax, eax
not al
mov byte [edx + eax*8 - 0x7f8], cl
lea edi, [edi + eax*8 - 0x7fc]
mov ecx, dword [edi + eax*4 - 0x3fc]
mov dword [esp + eax*2 - 0x1fe], eax
xchg word [esp + eax*2 - 0x1f8], ax
lea edx, [eax + eax*2 + 0x29186e9a]
xor ecx, ebx
inc eax
jg 0xc362b5
xor ecx, ebx
lea eax, [edx*2 + 0x43a51e29]
shr dl, 0x87
ror eax, 0x24
ror ecx, 1
xor ecx, 0xf9b45028
rol dx, 0x88
lea ecx, [ecx + eax + 0x247530ab]
shr edx, 0x8d
not ecx
jp 0x10d0de3
sysenter
call fcn.00e71855
mov eax, 0x680b213b
shr eax, 0x21
lea ecx, [eax - 0x3fe7d5df]
mov eax, dword [edi + eax - 0x3405909d]
push ecx
or byte [esp + 1], 0x9e
adc edi, 4
movzx edx, cl
neg word [esp + edx - 0xbd]
adc dl, 0x23
xor eax, ebx
lea eax, [eax + edx*4 - 0x4bef824]
not eax
neg cl
dec edx
jae 0xef13d7
inc eax
rol eax, 3
sub dl, 0x2d
xor ebx, eax
mov dword [esp + edx - 0xb4], ecx
and edx, edx
adc ebp, eax
pop edx
rol cl, cl
movzx eax, cl
mov ax, word [esi + eax*4 - 0x24]
mov cx, word [esi + 2]
btr edx, edx
rol dx, 8
adc esi, 2
bt edx, 0xab
jae 0x10e5cde
mov ecx, dword [ebp]
mov edx, 0x7eb3000b
mov ax, word [ecx + edx - 0x7eb3000b]
mov ecx, 0x6caa5791
jmp 0xd561cd
mov ecx, 0x68840c03
lea edi, [ecx + edi - 0x68840c07]
movsx eax, cl
call fcn.00bb1d68
inc ebp
movzx edx, dh
dec esi
mov edx, dword [esp + edi*4 - 0x104]
dec esi
mov dword [esp + eax*8 - 0x500], ecx
dec eax
arpl cx, cx
dec edx
lea esi, [esi + ebp*2 - 0x6dd5b65b]
dec esp
add esp, ecx
inc edx
movzx ecx, byte [esp + eax - 0x8f]
push ecx
inc ecx
sar edi, 0x21
inc si
mov ecx, dword [edi + eax*8 - 0x510]
inc ecx
not esi
inc si
mov eax, dword [edi + eax*2 - 0x142]
dec edx
lea edi, [edi + edi*2 - 0x42]
inc bp
add ecx, eax
inc edx
dec dword [esp + edi - 0x1a]
inc bl
inc si
mov dword [edi + edi - 0x22], ecx
dec edx
lea eax, [ecx + ebx + 0x60904da9]
pop ebx
dec esp
mov dword [esp + ebx*2 - 0x182], esp
ret 0x10
sal dword [esp + edx + 3], 0x59
ror ecx, 3
neg edx
xchg ah, dl
sbb word [esp + edx - 0x51], 0x6c3e
neg ecx
ror dword [esp + edx*2 - 0xa2], 0x81
xor ebx, ecx
and eax, edx
adc ebp, ecx
shl dword [esp + edx - 0x4d], 0x14
mov dword [esp + edx - 0x51], ebp
ret 4
adc ax, cx
mov ecx, 0x32939abd
shr edx, cl
mov word [esi + edx*8 - 0x38], ax
sub dx, 0xe131
jg 0xbfc52a
Function at 0xe75748
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax*4 - 0x278], eax
xor edx, ebx
add edx, 0xd3a28532
ror edx, 3
neg edx
btc ecx, ecx
sub dword [esp + eax - 0xa0], ecx
mov dword [esp + eax*2 - 0x13c], eax
inc edx
or ax, ax
lea ecx, [eax*8 - 0x254b343]
ror edx, 1
rol eax, 0xab
adc ecx, ecx
inc edx
not byte [esp + eax*2 - 0x9fffe]
xor ebx, edx
neg dword [esp + eax*2 - 0x9fff8]
xchg ecx, eax
dec ax
add edi, edx
mov dword [esp + ecx - 0x50000], edi
ret 0xc
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
mov edi, 0x5c359b18
push edi
lea ebx, [edi + edi*2 - 0x4be5b8fb]
mov dword [ebp + edi - 0x5c359b18], eax
mov ebx, dword [esp + edi - 0x5c359b14]
movsx eax, byte [esp + edi - 0x5c359b18]
mov edi, dword [esp + edi - 0x5c359b10]
or al, 0x87
mov esi, dword [esp + eax - 0x93]
movzx ecx, ax
inc eax
lea esi, [esi + eax - 0xa4]
mov edx, dword [esi + eax*2 - 0x140]
ja 0xe29ec2
or dl, byte [eax - 0x3b3700a6]
lds ebp, [edi + 0x49]
pop ebp
pushal
mov byte [0xcc498fe2], al
adc ecx, dword [edx - 0x6f]
cld
sub ch, byte ss:[edi - 2]
mov dl, 0xff
xor dword [ecx - 0xd376e6f], ebx
jb 0xe757b5
pop edx
out 0x71, eax
sub ch, byte [edi]
int 0xc6
stc
fadd dword [edx + 0x6f71410e]
pop edx
ljmp 0xe188

Function at 0xe81490
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
xor ecx, 0x343fb91d
shr dx, 0xe9
shr edx, 5
add edx, edx
not ecx
lea ecx, [ecx + edx*8 + 0x619f0377]
movsx eax, dl
add eax, eax
neg ecx
dec edx
xor ebx, ecx
sub ax, 0xc93f
add dx, dx
push eax
adc esi, ecx
mov ax, word [ebp + edx*2 - 0x1e428004]
mov dx, word [ebp + edx - 0xf214000]
mov ecx, dword [esp]
sar cl, cl
mov cl, byte [ebp + ecx*8 - 0x1b7ec]
rol byte [esp + 1], 0xc6
jb 0xfb872a
jmp 0x10cc33e
lea ebp, [ebp + ecx*2 - 0xb5fb3ec]
jnp 0xdec9f2
imul dl
movzx edx, cx
mov word [ebp + ecx*2 - 0xb5fb3ee], ax
shr cl, 0xc3
lea edi, [edi + ecx*2 - 0xb5fb240]
lea eax, [ecx*4 + 0x502ab682]
mov ecx, dword [ecx + edi - 0x5afd91e]
cwde
xor ecx, ebx
jmp fcn.00bea910
or edx, dword [esp + ecx*2 - 0x5ffffffc]
movsx eax, dl
movzx eax, byte [ecx + edi - 0x30000000]
xor al, bl
btr ecx, edx
sal ecx, 0x13
sbb edx, ecx
xor al, 0x12
sar dl, 0xa1
neg ecx
inc al
xor al, 0x94
xchg cx, dx
and dword [esp + ecx - 0xdeda], ecx
neg al
mov dword [esp + ecx*2 - 0x1bdbc], 0x418fbca0
sal dword [esp + ecx*4 - 0x37b75], cl
je 0xcbaf8e
xor bl, al
shr edx, 0xd5
lea eax, [esp + eax + 8]
call fcn.00cad520
sal byte [esp], 0xa3
adc ebp, 4
inc byte [esp + 3]
shr dword [esp], 0x41
shrd ax, dx, cl
mov ecx, 0x78062602
movzx edx, cx
mov dl, byte [ebp + edx*2 - 0x4c04]
not cl
mov eax, 0x9f0feb8f
movzx ax, byte [ebp + ecx - 0x780626fb]
sal cx, 0x81
xor ecx, 0x7da9940d
jae 0xd898cb
Function at 0xe94e66
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
rol ecx, 1
dec ecx
xor ebx, ecx
xor dl, 0xc
lea edx, [eax*2 - 0x3fe6ecd8]
adc edi, ecx
shr eax, 0x47
pop ecx
lea esi, [esi + eax*4 - 0x481ca2a]
jnp 0xf9e6cb
sub esi, 4
mov ecx, 0xd70fa52e
mov ecx, dword [esi]
push 0xb2257aaa
call fcn.00bb0c0a
inc eax
movsx ecx, dl
movzx eax, word [esi + ecx*4 - 0xc0]
inc cl
dec ecx
bts cx, cx
xor ax, bx
xchg cl, dl
btr ecx, ecx
and ecx, ecx
adc ax, 0xa33f
bts ecx, ecx
sal cx, 2
and edx, ecx
neg ax
dec edx
jl 0xbf9dc1
ror ax, 1
lea edx, [ecx + 0x5d9dc09f]
not ax
bts cx, cx
sar dx, cl
shr cl, cl
xor bx, ax
and ecx, ecx
lea edx, [ecx + edx + 0x50acb1a]
lea ebp, [edx + ebp - 0x62aaac2d]
mov dword [ebp + edx - 0x62aaac29], eax
movzx eax, cx
bswap ecx
jae fcn.00da3483

Function at 0xe9860a
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov ebx, dword [ebx*4 + 0xfea234]
push 0xbd17c693
shl dword [esp], 0xb8
rol dword [esp], 0x63
shr edx, 8
inc word [esp + 1]
neg byte [esp + 1]
dec word [esp + 9]
xor edx, ebx
shr byte [esp + 2], 5
neg dword [esp]
inc ecx
call fcn.010b2a82
mov edx, 0xdf8a1004
lea eax, [edx + edx*4 - 0x4662ab59]
and al, dh
mov eax, dword [ebp + eax - 0x174fa410]
movsx ecx, dx
btc edx, edx
dec ecx
mov dl, byte [ebp + ecx*2 - 0x2002]
push ecx
setno cl

Function at 0xe9909a
Capabilities:
Encode data using base64

Disassembly:
or ecx, dword [esi + ecx]
lea edx, [eax + eax*8 + 0x2617e41f]
cwde
not dx
mov al, byte [eax + esi - 0x2bb2]
bt edx, edx
bswap edx
lea edx, [edx + edx*4 - 0x3f7208e3]
lea esi, [esi + edx - 0x256abe7a]
sar dx, 0xca
mov byte es:[ecx + edx*2 - 0x4ad5ffde], al
movsx eax, dl
mov ecx, eax
jmp ebp
xor ebx, eax
shr edx, 0x41
pop edx
or dx, dx
adc ebp, eax
mov di, word [edx + edi - 0x41010c3f]
sar dx, 0xe8
sete dl
cmovns cx, dx
jns fcn.00d62eca
neg edx
dec word [esp + ecx - 0x38c0489c]
pop ecx
lea eax, [ecx + ecx*4 + 0x48b7e2d]
lea edx, [ecx + edx - 0x2e09a165]
xadd eax, ecx
sal al, 0x21
btr ecx, 0x3d
xor edx, 0x1fa98fb6
lea edx, [edx + ecx*8 - 0x2c94b101]
xor ebx, edx
bt ecx, 0x22
add ebp, edx
sar ecx, cl
jbe 0xc1c87f
xor eax, 0x3a1128aa
rol ecx, cl
push edx
lea eax, [eax + edx - 0x52baa25a]
pop ecx
jb 0xf981ed
mov eax, 0xcf218028
xor edx, ebx
ror cx, 0x2e
mov dword [esp + ecx - 0x38c0489d], ecx
cwde
inc edx
jmp 0xe52ecb
jb 0xd0724a
ret

Function at 0xec4373
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
adc ebp, 4
rol dword [esp], 0x55
sar word [esp + 1], 0x2d
call fcn.00c24606
push ecx
xor eax, ebx
xor cl, 0x36
inc eax
dec ecx
add edx, 0x13a0422a
neg dl
not eax
call fcn.00bf0826
mov ax, word [ebp]
mov ecx, 0xf71c101f
lea edx, [ecx*8 + 0xa2e210a]
and cx, 0xd1b4
mov dx, word [ebp + 2]
ror ecx, cl
push ecx
or cl, ch
mov cl, byte [ebp + 4]
jg 0xc88678
Function at 0xecbb37
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey

Disassembly:
sub ecx, 0xe6a9c5ad
ror dword [esp + edx - 0x399df6b], 0xc6
jae 0xc92629
mov ecx, dword [ebp]
call fcn.00e04d10
mov eax, 0x6b94833d
lea edi, [eax + edi - 0x6b948341]
mov ecx, dword [edi + eax - 0x6b94833d]
xor ecx, ebx
push eax
xadd byte [esp + eax - 0x6b94833a], ah
movzx edx, ax
inc ecx
neg ax
rol ecx, 2
shr byte [esp + edx*2 - 0xd67a], 0x87
and byte [esp + edx - 0x6b3d], ah
inc al
dec ecx
neg edx
cbw
ror ecx, 2
neg word [esp + eax - 0x6b94ffc4]
inc byte [esp + eax - 0x6b94ffc3]
sbb edx, 0xa824f336
inc ecx
not dword [esp + eax - 0x6b94ffc4]
inc dword [esp + edx - 0x57daa18c]
xor ebx, ecx
ror eax, 0xfa
call fcn.00d582a0
rol ecx, 2
or edx, 0x22316509
cdq
ja 0xe7ba08
mov ecx, 0x108ef326
shl ecx, cl
movsx edx, cx
mov eax, dword [ebp + ecx*2 - 0x47799300]
shl edx, 0x2c
jb 0x109f02b
neg ecx
add ecx, edx
xor eax, 0xe2170513
xadd eax, edx
jno 0xfc0b38
mov dword [esp + eax*2 - 0x6b3a2c56], ebx
mov dword [ebp + eax*2 - 0x6b3a2c56], edx
lea edx, [ebx + ebx*8 + 0x1b04b121]
mov ebx, dword [esp + eax - 0x359d1623]
mov dword [esp + eax*2 - 0x6b3a2c4e], 0x1f3cfe9e
movsx ecx, dl
mov ecx, dword [edi + eax*2 - 0x6b3a2c56]
neg eax
lea edx, [eax - 0x1fc8a7cc]
adc edi, 3
shr dword [esp + 7], 0xb2
sbb edx, 0xa7006299
xor ecx, ebx
jmp 0xc2e578
rol ecx, 1
not dx
ror dx, 0x2d
xor ebx, ecx
add esi, ecx
movsx ecx, byte [esp + edx - 0x287599c7]
sal edx, cl
sbb al, al
pop eax
pop eax
pop edx
jns fcn.00b943b0
setne dl
lea ebp, [ebp + ecx - 0x23bcc97c]
sbb dx, dx
xchg edx, ecx
xor eax, ebx
sub eax, 0xec87be2e
lea edx, [edx + ecx*4 + 0x61869fbd]
ror eax, 3
ror cl, 0x61
cmovno ecx, edx
sar cl, 1
lea eax, [ecx + eax - 0x77be011d]
rol eax, 2
lea edx, [edx*2 + 0x34865419]
xor ebx, eax
xchg cx, dx
add edi, eax
add ecx, ecx
movzx eax, dx
ror edx, 0xc1
mov si, word [edx + esi - 0x11eab48e]
jl fcn.00dc3d0b
neg eax
xor ebx, eax
add edi, eax
call fcn.00bc74ee
Function at 0xed6d0b
Capabilities:
Encode data using xor

Disassembly:
xor eax, ebx
xadd dl, cl
mov dword [esp + edx - 0x7a2324a8], 0x608a0236
dec eax
bt dx, 0x98
ror eax, 3
add dword [esp + edx - 0x7a2324a8], ecx
call fcn.0102fee3
dec edx
lea edx, [ecx*4 + 0x31907ea1]
dec esp
shld ebx, ebx, cl
inc edx
shl byte [esp + eax - 0xea3], 0x62
dec edx
mov dword [edi + eax*4 - 0x3a9c], ebx
inc ebp
mov edi, dword [eax + ebp - 0xea7]
dec edx
lea ebp, [ebp + eax - 0xea3]
inc edx
inc dword [esp + eax - 0xea5]
inc ebp
xor edi, edx
inc ecx
rol edi, 1
inc ecx
sub edi, 0xa406d839
inc edx
movzx ebx, word [esp + eax - 0xea6]
inc ecx
not edi
inc dx
add dword [esp + eax - 0xea1], 0x80424caa
movsb byte es:[edi], byte [esi]
test byte [ebp + eax*8 - 1], ah
inc dword [ecx]
inc ecx
bswap edi
inc ecx
xor edi, 0x2b90feb5
dec edi
lea esi, [ecx + ecx*8 + 0xc3305be]
inc edi
lea edi, [ecx + edi + 0x4689b32c]
inc ecx
neg edi
or edx, 0x66a38818
inc ecx
push esi
dec esi
mov dword [esp + eax - 0xe9f], edx
inc esi
xchg dword [esp + eax - 0xea7], eax
sub ebx, esi
inc dword [esp + 2]
inc esp
xor dword [esp + 8], edi
inc esp
movzx ebx, byte [esp + 3]
dec esi
mov edx, dword [esp + ebx + 8]
inc edx
xor dword [esp + ebx + 4], esi
dec edx
mov dword [esp + ebx*4 + 8], ebx
dec ebp
arpl di, di
call fcn.00d63ae6
or edx, 0x4a5e00ef
rcl byte [eax + 0x4d3584fc], cl
popal
outsb dx, byte [esi]
pop ebx
mov ah, 0xa
lea esi, [esp]
push ebp
push 0x95909092
clc
add byte [ebp + 0x66], 0x1c
xor bh, byte [ecx + 0x6f]
jl 0xed6e37
push ecx
insd dword es:[edi], dx
out dx, al
wait
pushfd
call 0x65bb74ad
invalid
mov dword [0x90647042], eax
outsd dx, dword [esi]
adc ecx, dword [edx]
push ss
inc ebx
jo 0xed6e57
mov dh, 0xa7
jmp 0xed6e9e
test dword [eax], edi
outsb dx, byte [esi]
stosd dword es:[edi], eax
cmp byte [esi - 0x55], ch
jl 0xed6e90
invalid
fild dword [esi - 0x35]
mov esi, ss
push 0xe8ad63b6
mov ch, byte [esi + 0x709c0544]
jns 0xed6e8a
cmp al, 0x47
dec ebx
pop es
push esp
nop
fbld tbyte [eax]
and edx, esi
in al, 0x4b
jge 0xed6e38
ret
mov eax, 0xff029409
mov dh, 4
push ds
push edi
inc edi
rcr byte [ecx - 0x59a0728d], 0x63
push edi
invalid
cdq
jae 0xed6e20
pop edi
cmpsb byte [esi], byte es:[edi]
arpl word [edi - 2], dx
xchg edi, eax
aas
jne 0xed6e85
and cl, byte [esi + 0x6db927e4]
add al, 0xdf
rol ah, 0x4d
mov byte [ecx + 0x69], dl
mov esp, 0x44bf8bb
sbb al, byte [edi + 0x22e91790]
invalid
in al, 0x27
mov ecx, 0xc0df046d
les ecx, [ebp - 0x78]
push ecx
imul edi, dword [ebx + edi*4 + 0x1a044bf8], 0xe9179087
and cl, byte [edi + esi + 0x64f1ab11]
and al, 0xf0
jne 0xed6efe
sahf
invalid
invalid
jecxz 0xed6f2f
push edx
adc dword [eax], edi
or dl, al
rol ch, cl
sti
test eax, 0xe7316739
xor edi, esp
jge 0xed6ed4
das
cmp cl, dl
and bh, al
das
sbb bl, dh
loope 0xed6f0a
retf
aaa
wait
ret
Function at 0xed7d99
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
sub edi, 4
bt edx, 0x29
mov eax, dword [edi]
xor cx, dx
xor eax, ebx
not eax
rol cx, 0x44
ror edx, 0xbf
ror eax, 1
sar dx, 0xa1
xor eax, 0x4685b1a5
shl ecx, cl
adc dx, cx
push eax
not cl
xor eax, eax
inc al
ror cl, 1
and al, ah
sbb eax, eax
xchg dword [esp + eax*8], eax
adc cl, 0x91
dec dword [esp + eax - 0xaa]
xor bl, cl
sar word [esp + eax - 0xa9], 0x81
setge al
lea ecx, [esp + ecx + 4]
btc eax, eax
mov word [ecx + eax*2 - 2], dx
movzx ecx, al
mov dword [esp + eax*8 - 8], ebp
ret
sal dl, 0x41
sar dl, 0xe2
lea edi, [edi + edx - 0x46bfb21d]
bt dx, dx
dec eax
or ecx, ecx
xor edx, 0xaf01179c
sub ax, cx
bswap edx
mov dword [esp + ecx - 0x16], eax
btr cx, 0x89
neg al
not edx
sar ax, 0xcc
call fcn.00e0ccbb
xor cl, bl
push 0x7eab8f3e
neg cl
pop eax
xor eax, eax
ror cl, 1
xor al, 0xaa
jb 0xdeabae
jg 0xb8518d
inc cl
jmp 0xb87df7

Function at 0xee3d33
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp], 0x38e25784
call fcn.00dd142f
add edx, esp
mov byte [edx], cl
inc eax
mov ecx, dword [edi]
lea eax, [eax + eax*4 - 0x55e9cb46]
lea edi, [eax + edi - 0x41162ab6]
xor ecx, ebx
sar al, 0x44
rol al, 0x27
shl ax, 0xc3
not ecx
neg al
movzx edx, ax
cwde
dec ecx
cbw
call fcn.00fad236
mov ecx, dword [esi]
mov edx, 0xd731a48f
lea edi, [edx + edx*8 - 0x5ddec249]
lea esi, [esi + edi*2 - 0x65c00d78]
lea ebp, [edx - 0x61d25779]
sub edi, 0x3c247cbb
mov edi, ecx
jne 0xd6a51a
add byte [eax], al
add byte [ebp + 0x6c], al
je 0xee3e0b
inc ebx
jb 0xee3e12
je 0xee3e14
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [eax - 0x5d], ch
insb byte es:[edi], dx
adc dword [ecx - 0x7f], edi
lds eax, [eax + eax]
add byte [eax], al
mov edi, 0x4c8c89d1
or bl, 0x9f
lahf
mov esi, 0xc40f8489
in eax, 0x4f
fist word [ecx - 0x7a]
mov word [eax + eax*4 - 0x35], cs
lahf
mov esi, 0x7c4eb48d
retf

Function at 0xee7e1f
Capabilities:
Encode data using base64

Disassembly:
inc ebp
xor edi, edx
ror dx, 0x68
inc ecx
bswap edi
inc ebp
sbb edi, ebx
inc esp
xor edi, edx
dec esi
mov dword [esp + ebx*2], ebp
ror bl, 0x67
inc edx
setb byte [esp + ebx]
inc ecx
xor edi, 0x2d9907b8
call fcn.00ced63c
jp 0xee7e5f
invalid
mov ecx, 0x7027f384
or eax, esp
inc edx
invalid

Function at 0xef54fe
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call fcn.00e11c22
mov ecx, 0x9fadf008
mov eax, ecx
mov ecx, dword [edi]
sal eax, 0xa4
shr eax, 0x72
mov eax, dword [eax + edi - 0x3eb3]
push 0x369039b9
push 0x23acae06
jb 0xcdf6e4
sub esi, 4
mov edx, 0xb3a2bb9e
btc edx, 7
mov eax, edx
mov ecx, dword [esi]
xor ecx, ebx
cwde
dec edx
xor ecx, 0x11bc0600
btc eax, eax
adc al, 0xb1
dec al
bswap ecx
xor ecx, 0x792cc290
lea ecx, [ecx + eax - 0x2fd306bf]
xor ebx, ecx
add ebp, ecx
mov ecx, 0xfb278f9e
and al, cl
push 0x8fa23512
cmp ebp, eax
lea esp, [esp + 0xc]
ja 0xbecd82
mov edx, esp
mov ecx, 0x6c
mov eax, 0xa2ad64a5
lea eax, [ebp - 0x80]
jmp 0xe582fd
Function at 0xf05cb7
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor eax, ebx
dec eax
ror eax, 2
bt edx, ecx
mov dword [esp + ecx - 0x2305], 0x230f309d
shl dl, 0xa6
neg eax
bts edx, ecx
and dword [esp + edx*4 - 0x80], edx
sar byte [esp + edx - 0x1d], 0xe3
adc eax, 0xba02e035
neg byte [esp + edx*2 - 0x3e]
xor ebx, eax
xchg word [esp + edx*2 - 0x40], dx
neg dword [esp + edx*8]
sar cx, cl
adc ebp, eax
call fcn.00df52f4

Function at 0xf163cd
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
add esi, eax
xor edx, ecx
sbb edx, 0xe918b5a3
mov ecx, dword [ebp + edx - 0x16e8485d]
mov dword [esp + edx*2 - 0x2dd090ba], edx
movsx eax, dl
sar ax, 0xef
mov dx, word [ecx + edx*2 - 0x2dd090ba]
lea ecx, [eax + eax*2 - 0x3e7f48f3]
lea ebp, [ebp + eax + 2]
cwde
mov word [eax + ebp], dx
jp 0xf92af1
not eax
sub ecx, ecx
xor ebx, eax
add ebp, eax
neg ecx
jbe 0xbbc4f5

Function at 0xf1f42f
Capabilities:
Encode data using base64

Disassembly:
sub edi, 4
add dl, 0x2e
movzx eax, cl
mov eax, dword [edi + eax - 0xb2]
xchg dword [esp + 4], ecx
xor eax, ebx
call fcn.010437e8
add byte [eax], al
add byte [ebx + 0x65], ah
pop di
jae 0xf1f4ca
jb 0xf1f4c1
outsb dx, byte [esi]
pop edi
jne 0xf1f4d1
cmp byte [edi + 0x63], bl
insb byte es:[edi], dx
popal
jb fcn.00f1f466
push ss
out dx, eax
or ebx, ebx
int3
or edx, 0xc3333fbf
cmp dword es:[esi + 0x44c04053], ebx
and al, 3
bound ebp, qword [ebx]
rol byte [ecx + 0x364a33d2], cl
mov ecx, 0x89781d35
dec edx
Function at 0xf2ac7a
Capabilities:
Encode data using base64
Encrypt data using chaskey
Manually build aes constants

Disassembly:
shl edx, 2
mov dword [esp + eax], 0xf0b9f6ad
pop eax
mov eax, ebp
jmp 0x108a272
xor cl, 0xa2
xor eax, edx
shl eax, 0xbb
lea eax, [edx*8 + 0x211dde00]
dec cl
xor cl, 0xb4
dec edx
cdq
inc dl
sub cl, 0x9b
bt eax, 0
ror ax, 0x43
rol cl, 1
bts dx, dx
adc edx, eax
xor bl, cl
add ecx, esp
sub eax, 0xf2a8472c
btc eax, 0x9b
movzx ax, byte [ecx]
sbb esi, 2
movsx ecx, dx
mov word [esi + ecx - 0x1ac1], ax
ror cx, cl
jb fcn.00e4ff8e
dec dword [edi]
sbb esp, 0xffffff9b
invalid
call fcn.00e53f8f
or dword [eax + 1], edi
dec esi
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
and al, 0x70
notrack call ds:[esi]
mov word [esi - 0x31], gs
cmp ebp, esp
nop
shr dword [ecx + 0x6e5f3cd4], 1
test eax, 0x6e5f3cd4
mov edx, 0xfd8d34c5
mov dword [edi + edi*4 + 0x4a], esp
nop
dec ecx
lahf
push eax
outsd dx, dword [esi]
pushal
sub al, dh
lcall 0xdc61, 0x7d4c
mov eax, 0x460b92ab
adc ah, byte [edi]
jno 0xef6291
inc eax
stosd dword es:[edi], eax
jo 0xef6284
ja 0xef62ba
stosd dword es:[edi], eax
outsd dx, dword [esi]
cli
and dh, byte [edi - 0x68]
mov word [edi + 0x2429e342], cs
xchg ecx, eax
ror dword [esp + eax*2], cl
outsd dx, dword [esi]
imul ebx, dword [ebp - 0x6e08f4c0], 0x72f88156
mov esi, 0xad8ed4ee
xchg ebp, eax
salc
push edi
jnp 0xef6267
sar byte [0xa61389d6], cl
jp 0xef62e2
and al, 0x68
aad 0x68
shr dword [edi + 0x106a6697], 0x6d
mov al, 0x47
xor bh, byte [esi + 0x22]
pushal
shl dword [esi - 0x14], cl
push ebp
pushal
cmovne ebx, dword [ecx + ecx*8]
inc ebp
sbb byte [edx + 0x4b55560e], bh
ret 0x17a7
mov dword [esp + edx - 1], edx
mov ebx, ecx
sbb dword [esp + eax*8], eax
jns 0x10a7652
cdq
movzx ecx, byte [edx + edi]
sub edx, 0x4f988726
lea edi, [eax + edi - 0x3de00000]
xor cl, bl
xor cl, 0xa7
shl dx, 0xae
ror cl, 1
btr dx, 0x1b
adc cl, al
and eax, eax
jo 0xef6279
neg cl
sub cl, al
cwde
and dl, 0x14
inc eax
neg cl
bt dx, dx
sbb ax, 0xfdb7
jbe 0xe94e0f
shr al, 0x46
xor ecx, ebx
lea edx, [edx + eax - 0x7b746974]
sal eax, 0x8c
inc ecx
jmp 0x10c11b2
call fcn.00cdec84
mov edx, ebx
ja 0xc114b5
mov eax, 0xd733de85
mov ecx, dword [edi]
mov edx, eax
add dx, dx
adc edi, 3
cdq
jmp 0xfb9dc8
rol ecx, 1
not ecx
inc al
btc eax, edx
sbb ecx, 0x892e7617
bt ax, 0x1d
xor ebx, ecx
btr ax, ax
adc ebp, ecx
jmp 0xf6f187

Function at 0xf2baaf
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 8]
je 0xdb0cf8

Function at 0xf2bacf
Capabilities:
Parse pe header

Disassembly:
dec eax
mov dword [esp + esi*2 - 0x670f8426], esi
inc ecx
dec eax
dec eax
inc eax
cwde
inc esp
movsx esi, dl
inc ecx
xor eax, 0xe536c3a3
dec eax
ror edx, cl
xor byte [esp + esi*2 - 0x670f841f], bh
sal dword [esp + esi - 0x3387c210], cl
dec esp
mov dword [esp + esi - 0x3387c213], edx
inc sp
and edi, edx
inc esp
xor dword [esp + esi - 0x3387c213], eax
inc esp
movzx ecx, bx
dec bx
dec ecx
ror ebx, cl
inc ecx
pop edx
dec ebp
arpl ax, ax
dec eax
inc ebx
dec ebp
add esp, eax
dec eax
rol ebx, cl
ror edx, 0xa7
inc ecx
xor cl, 0x87
jl fcn.00d45932
Function at 0xf33325
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov dword [esp + 4], eax
adc edx, 0x45b30c1c
not edx
or dword [esp + 4], eax
bts cx, 0x10
sbb edx, 0x698e11bc
sal cx, cl
sbb cl, 0x1a
xor edx, 0xc60bef00
sub cx, ax
xor ebx, edx
add edi, edx
call fcn.00fca85e