joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16de3cf
Capabilities:
Encode data using base64

Disassembly:
not dl
xor dl, 0x2c
sub ecx, ecx
mov dword [esp + ecx], ecx
adc dl, 0xa6
not dword [esp + ecx*8]
xor bl, dl
xor ecx, ecx
adc cl, 0xa8
lea edx, [esp + edx + 8]
sbb ecx, ecx
mov word [ecx + edx], ax
and cl, byte [esp + ecx*2]
jg 0x172d2f9
movzx eax, byte [ecx + edi - 6]
movsx edx, cl
neg dx
lea edi, [edi + ecx*2 - 6]
jle 0x16f6684
push edx
sbb edx, dword [ebp - 0x38fd3b46]
mov ebp, 0xba4455ef
wait
sbb al, 0x53
movsx eax, dl
movsx ecx, dx
mov eax, dword [esi + edx - 0x531c369b]
lea esi, [esi + edx - 0x531c3697]
jmp 0x179b618
call fcn.0174d962
mov edx, 0x79aaf295
movzx ecx, byte [edx + edi - 0x79aaf296]
xor cl, bl
movzx eax, dx
neg eax
sar dx, 0x8f
xor cl, dl
call fcn.017788c1

Function at 0x16df45e
Capabilities:
Encode data using base64

Disassembly:
inc ecx
not eax
dec esp
adc edx, eax
dec esp
mov dword [esp + edi - 0x4c4511cb], ebx
pop edi
inc dx
sal dword [esp - 0x59dda], 0xa4
inc ecx
pop esp
pop eax
pop eax
jne fcn.0178e74d
cmc

Function at 0x16f15da
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*2], eax
xor edx, 0x6e2ce026
shr eax, 0xab
jns 0x17a160f

Function at 0x16f37a1
Capabilities:
Encode data using xor

Disassembly:
inc esi
xor dword [esp - 0x8858], edi
dec edx
mov ebx, dword [esp - 0x442f8]
inc ecx
shr bl, 0x21
inc esi
movsx eax, word [esp - 0x885c]
dec ebp
arpl di, di
pop edi
dec ebp
adc edx, edi
mov eax, esi
dec edx
mov dword [esp - 0x110c0], edx
jmp 0x16f402d
dec ecx
lea esi, [esp + ebp*2 - 0x454809e1]
inc ecx
neg edi
inc edx
movzx edx, byte [esp - 0x442f8]
inc esp
mov ebp, edx
inc ecx
bswap edi
inc ecx
not edi
dec esi
mov dword [esp - 0x22180], ebp
dec edx
mov dword [esp - 0x8858], ebx
ror dl, 0xa2
dec eax
add dword [esp + esi + 0x45477fcf], 0xf13ec58a
jnp 0x16a5abf
inc bx
mov ebp, dword [ecx - 0x22186]
inc ecx
push ebx
dec edi
lea ecx, [esp + ecx - 0x8866]
xor bp, bx
dec ebx
lea ecx, [ebp + ebx*2 + 0x782051a1]
inc sp
and eax, dword [esp + esi + 0x45477fd5]
dec ecx
shr esp, cl
ror bp, cl
dec esp
lea ebp, [edi*4 - 0x7b73ece1]
inc cx
add ebx, 0x8166548d
cmc
and ecx, dword [ecx]
dec eax
rol edx, cl
dec edx
dec dword [esp - 0x885a]
not bp
dec eax
sbb dword [esp + esi + 0x45477fd3], 0xce83cc02
inc eax
adc byte [esp + esi + 0x45477fdd], bh
rol bp, cl
jmp 0x16fc3d5
xor bx, bp
dec eax
or eax, eax
shl ecx, 0xc8
inc dx
mov dword [esi + esi + 0x45477fcf], ebp
shl edx, 0x51
inc ecx
pop edi
dec esi
mov dword [esp - 0x4430], edx
ret
Function at 0x16f6dfa
Capabilities:
Encode data using base64

Disassembly:
dec esp
xor esp, ebx
shl dl, 0x85
jbe 0x12e6c4e
dec edx
mov dword [esp + eax - 0x5abab989], edx
dec ecx
ror esp, 7
dec esi
lea ebp, [ecx + ebp*4 + 0x701f8d3b]
dec esp
mov dword [esp + ecx - 0x318161f2], edi
dec ecx
inc esp
inc cx
not ebp
dec ecx
xor esp, 0x65278096
inc edx
rol byte [esp + eax - 0x5abab985], 0x65
dec ecx
ror esp, 3
dec ecx
xor ebx, esp
dec edx
mov dword [esp + eax - 0x5abab979], 0x9d0704ab
inc edx
sar byte [esp + eax - 0x5abab97e], 7
dec ebp
mov dword [esi + ecx*2 - 0x6302c418], esp
jb 0x1790048
rol word [esp + ecx*2 - 0x6302c401], cl
inc ecx
movsx ebp, bp
dec esi
lea esi, [ecx + esi - 0x3181620e]
inc ecx
pop esp
inc ecx
pop eax
pop edi
pop edx
ja fcn.0178e74d
Function at 0x16f7b1d
Capabilities:
Encode data using base64

Disassembly:
adc esi, 2
jmp 0x1712bd2
call fcn.016d0edc
ror dword [esp], 0xb2
sal dword [esp], cl
sub edi, 4
jmp 0x172c22d
mov eax, dword [edi]
xor eax, ebx
movzx edx, cx
xor eax, 0xf83d0f82
sar edx, 0xdb
bswap eax
ror dword [esp + edx + 1], 0x2a
sar cx, 0xf
lea eax, [eax + edx*2 + 0x55ac681f]
shr ecx, 0x48
rol eax, 2
sub ecx, edx
jg 0x12388e1
dec byte [esp + ecx - 0x2a73]
not edx
not eax
jp 0x121d424
adc cl, ch
or edx, eax
push ecx
mov dword [esi + ecx - 0x2a9b], edx
mov ecx, dword [edi + ecx*8 - 0x154fc]
jmp 0x17435c3
add edi, 0xfffffffc
xor ecx, ebx
mov eax, 0x4d237913
inc al
bswap ecx
push eax
pop eax
mov edx, eax
xor ecx, 0x2c09c99e
push edx
not ecx
call fcn.012294a3
jl 0x1743602
test byte [ebx - 0x5664c601], bl
rcr dword [esi + 0x44], cl
cmp eax, 0x644d78a7
cmpsb byte [esi], byte es:[edi]
jle 0x1743626
sub esi, dword [edx + 0x2cfe9e9b]
sub esi, dword [edx + 0x34ae929b]
sub esi, dword [edx + 0x40fe7a9b]
sub esi, dword [edx + 0x78ee2e9b]
sub esi, dword [edx - 0x2eb23965]
dec ecx
xor al, 0xb2
ret
inc esp
and eax, 0x28caadb4
jmp 0x17435eb

Function at 0x1705a7c
Capabilities:
Encode data using xor

Disassembly:
add ebp, eax
movzx ecx, byte [edi + ecx*4 - 0x34a5e]
mov eax, edx
add edi, 0xfffffffa
xchg dword [esp + 4], eax
not dx
xor cl, bl
pop edx
xor cl, 0xbd
lea eax, [eax + eax - 0x43c5a344]
add al, ah
xor byte [esp], al
adc cl, 0x10
call fcn.017acc0d
add byte [edx - 0x6c6f2fe4], dl
scasd eax, dword es:[edi]
xor eax, 0xfb6f2f4f
sub ecx, dword [ebp + 0x4f]
das
outsd dx, dword [esi]
add edx, edi
push ebp
dec edi
das
outsd dx, dword [esi]
sub eax, dword [edi + 0x6f2f4f0d]
mov dword [0x2f4f61c3], eax
outsd dx, dword [esi]
scasd eax, dword es:[edi]
js 0x1705a87
ret 0xc783
aam 0xc0
scasd eax, dword es:[edi]
into
adc al, byte [edx + 0x12]
ljmp 0xae0a
Function at 0x1709ecf
Capabilities:
Encode data using base64

Disassembly:
dec edx
ror dword [esp + ebp - 0x862e43], cl
inc esp
movzx eax, bp
bswap esi
inc ebp
movsx ebx, ax
dec esi
inc edx
dec byte [esp + ebp - 0x862e40]
dec edx
mov dword [esp + edi - 0x4321], ebx
inc ecx
movsx ebx, bh
shr edi, cl
dec ecx
cmovnp ecx, edi
inc edx
xor dword [esp + ebp - 0x862e43], esi
movzx eax, di
call fcn.012d6939
inc ecx
not ebp
inc edx
mov esi, dword [esp - 0x40d0b759]
inc ecx
dec ebp
dec edx
dec dword [esp - 0x40d0b75a]
jp 0x172d39d
inc esp
mov edi, ecx
inc ecx
xor esp, 0xc734c70a
movzx eax, cx
inc ecx
bswap esp
dec bp
inc ecx
push edi
inc ecx
ror esp, 2
dec edx
mov dword [esp + ebp*4], ebx
dec edx
lea edx, [edi*2 - 0x69d26e79]
inc esi
xor dword [esp + ebp], esp
inc esp
xor ch, cl
inc eax
sbb dh, 0x31
pop ebx
inc esp
movzx ebx, bp
movzx edi, dl
dec ebp
arpl sp, sp
call fcn.016bc0aa
dec ecx
shr eax, cl
dec edx
mov dword [esp - 0x20685bad], 0xa5128c06
dec eax
lea edx, [edx + edx*4 + 0x699d590c]
dec edi
mov dword [esi - 0x20685bad], eax
inc esi
movsx edi, word [esp - 0x40d0b757]
inc edx
add byte [esp - 0x40d0b759], 0x8a
dec edi
lea ecx, [ecx - 0x20685bb1]
dec eax
sal edi, 0x76
dec edx
sbb dword [esp - 0x40d0b75a], edi
inc edx
setae byte [esp - 0x40d0b75a]
inc edi
mov ebp, dword [ecx - 0x40d0b75a]
inc eax
shl bh, 0x87
inc esp
xor ebp, ebx
shl eax, 0xf2
inc ecx
bswap ebp
dec ecx
not edi
inc edi
lea ebp, [ebp + 0x1f0ed364]
sub byte [esp + eax - 0x3a7bffff], 0x30
jbe 0x12d6596
dec edx
mov dword [esp - 0x20685bad], ebx
dec eax
xadd esi, edx
add ebp, esi
inc esp
xor dword [esp + eax - 0x3a7c0000], ebp
dec ecx
inc esp
or al, 0x8d
pop ebx
inc cx
xchg edi, edx
jb 0x1229691
inc eax
movsx ecx, dh
dec ebp
arpl bp, bp
dec ebp
lea ebx, [edi + eax*2 + 0x47884cbb]
ja 0x174287c
inc ecx
mov ebp, 0x5130d28
inc ecx
movzx ecx, bp
dec ebp
lea ecx, [ecx + ecx - 0xd2c]
dec ebp
xor ebp, ebp
inc edi
mov esp, dword [ecx + ebp*8]
inc ecx
mov ebp, ebp
inc esp
xor esp, ebx
dec eax
lea esi, [ecx - 0x5cdb214a]
inc ecx
not esp
jmp 0x16fccd3
dec esp
lea eax, [esi*8 - 0x47492657]
dec ebp
adc edx, ebp
dec eax
sar edi, 0x28
inc cx
not edi
inc ecx
or dh, bl
inc ecx
jmp edx
Function at 0x171cf2d
Capabilities:
Encode data using base64

Disassembly:
push 0xb7173f91
xor eax, ebx
sub eax, 0x1bb897af
rol eax, 3
inc eax
mov edx, 0xf6019bbc
neg eax
dec word [esp + 4]
movzx ecx, dx
neg dx
xor ebx, eax
xor cx, cx
adc ebp, eax
mov dword [esp + ecx], ebp
ret 4
mov eax, dword [esi + eax*8 - 0x1e6]
mov dword [esp], edx
xor byte [esp + 2], dl
call fcn.0174fc12
mov ebp, 0xb0b228bc
dec ebp
mov esp, dword [esi]
inc eax
movsx edi, ch
inc ebp
mov eax, dword [esp]
call fcn.012d31f6
dec ebp
lea esi, [esi + ebp - 0x83c0d9c]
dec eax
lea ebp, [ebp + ebp*2 - 0x49fe7ef1]
inc ecx
setp al
dec eax
bswap ebp
inc ecx
shld edi, eax, cl
ror si, 0xa8
inc ebp
mov dword [esi + edi - 0xa2], edi
dec eax
lea edx, [ebp*8 + 0x4a147b0]
jb 0x17a56e6
pop ebx
pop ebp
jmp 0x178c714
mov dword [edx + ebp - 0x78aa766d], eax
mov esi, ebp
movzx ecx, dl
movzx ebp, cl
pop ebx
movzx edi, dl
pop ebp
push edx
sar di, cl
mov edi, dword [esp + ecx - 0x69]
sub edx, ecx
lea edi, [edi + edx - 0x78aa7604]
mov dword [esp + ecx*4 - 0x1b0], edx
or ecx, edx
mov ecx, dword [ecx + edi - 0x78aa766d]
xchg byte [esp + edx - 0x78aa75f9], dl
or dword [esp + edx - 0x78aa7675], edx
mov eax, edx
xor ecx, ebx
inc edx
sub ecx, 0x1bb897af
inc dl
lea eax, [edx + eax*4 - 0x3defbddb]
mov word [esp + edx - 0x78aa7674], 0xf492
rol ecx, 3
shl dword [esp + edx - 0x78aa7679], 0x46
inc ecx
push eax
ror ax, 0xab
sal dl, 0xa6
neg ecx
ror byte [esp + edx - 0x78aa767a], 2
ror al, 0x21
xor ebx, ecx
pop edx
inc edx
call fcn.016ee7f4
and edi, 0x5fa64e14
pop edi
push 0xa39f3e3c
sbb edi, 4
mov eax, dword [edi]
jmp 0x1223680
dec esi
lea ecx, [edi + ecx - 0xa6]
and dx, 0xabe
call fcn.016a9766
mov ecx, 0xfda22bae
inc ecx
neg edi
inc ecx
dec edi
dec esp
lea eax, [edi*2 - 0x615d04ca]
inc cx
sal ebp, cl
call fcn.01760649
jmp 0x17810fe

Function at 0x1720674
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + ecx - 0x8d77]
shl dl, 0xa4
rol word [esp + ecx - 0x8d71], 0x66
xor eax, ebx
add dl, ch
sbb ecx, edx
bswap eax
or word [esp + ecx - 0x53ccf943], 0x111b
inc dx
xor eax, 0x2c09c99e
jmp 0x17389c5
mov edx, eax
and eax, edx
mov eax, dword [esi + 4]
and edx, dword [esp + 4]
inc edx
adc dword [esp + 4], 0xd7a340bf
and ecx, eax
dec edx
lea edx, [edx + edx*2 - 0x33d279c2]
not ecx
pop eax
mov dword [esi + 4], ecx
movzx ecx, word [esp]
mov eax, dword [edi + ecx - 0x8d77]
js 0x1715a2d

Function at 0x1726960
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp - 0x411b], edi
inc dx
rol dword [esp - 0x4117], cl
inc edx
xor dword [esp - 0x4113], eax
inc dx
xadd dword [esp - 0x10469], ecx
dec ecx
lea ebp, [edi + ecx + 0x3a282317]
dec edx
mov ebx, dword [esp - 0x10464]
dec esi
mov dword [esp - 0x4113], esp
dec eax
arpl ax, ax
inc esp
movzx ebp, ch
dec eax
xor ebp, 0xf98c0ba8
inc ecx
push ebp
dec esp
adc edx, eax
inc di
movzx edi, byte [esi - 0x8236]
dec edx
lea edx, [ebp - 0x16d061d8]
inc esp
movzx eax, bh
inc cx
or ecx, eax
inc ebx
mov cl, byte [esp + esi - 0x4119]
call fcn.0174fcd7
adc dword [edi + 0x6e], ebp
insd dword es:[edi], dx
xchg edx, eax
invalid
Function at 0x172d346
Capabilities:
Encode data using base64

Disassembly:
inc ebp
mov ebp, eax
pop esi
inc ecx
rol ebx, 1
inc ebp
xor bh, ch
inc ecx
movzx eax, di
dec edx
lea ecx, [edi*2 + 0x3c866c09]
inc ecx
bswap ebx
call fcn.017767c1

Function at 0x1743bb5
Capabilities:
Encode data using base64

Disassembly:
inc ebp
movsx ebp, sp
bswap eax
not eax
inc ecx
movsx ecx, ah
inc ecx
movsx edx, ah
inc ecx
lea eax, [ebp + eax - 0x3b2a796]
bswap eax
inc esp
movsx edi, cx
lea eax, [edi + eax - 0x6e241a18]
rol ecx, 0x7a
xor eax, 0xc39481aa
inc sp
xadd edi, esp
movzx ebp, cx
not eax
inc ecx
ror bh, 4
xor eax, 0xe7a7acb2
sal dx, 0xe7
push ecx
ror eax, 1
dec eax
shl edi, 0xb
inc ebp
movsx ebx, ah
jns 0x16fbb38
dec eax
dec eax
sal edi, 0x32
dec eax
mov dword [esp + edx*2 + 0x20], ebx
xor dword [esp + edx + 0x20], eax
call fcn.016c8625
not eax
and dword [esp + edi - 0x3192ffd], 0xab060197
xor eax, 0xc7363c32
inc ecx
xor cl, bh
sar bp, 0x89
bswap eax
inc byte [esp + edi*4 - 0xc64c000]
call fcn.0172263d
mov edx, 0x203778bb
bswap eax
mov dword [esp + edx*2 - 0x406ef176], edx
sub eax, 0xb207ffae
lea ecx, [edx + edx*2 + 0x720d92b2]
call fcn.017183d5
inc ecx
mov esp, 0xcf156313
rol eax, 3
inc ecx
movzx edi, ah
jmp 0x16d4a30

Function at 0x1748ba6
Capabilities:
Encode data using base64

Disassembly:
inc ecx
dec ebx
inc ecx
not ebx
inc ecx
xadd edi, ebp
jle 0x16e6874
inc ecx
ror ebx, 2
inc ecx
not ebx
inc bp
xchg esp, eax
inc ebp
and ebp, eax
dec eax
xor dword [esp + eax - 0x4bffffef], ebx
inc esp
xor dword [esp + eax - 0x4bffffef], ebx
pop eax
push ebp
dec eax
mov ebx, dword [esp + eax - 0x6810]
dec eax
mov dword [esp + eax - 0x6810], 0x3e304096
inc sp
sub dword [esp + eax - 0x6811], edi
dec eax
inc dword [esp + eax - 0x6815]
dec ebp
arpl bx, bx
sbb dword [esp + eax - 0x681c], 0x3fbeadbf
dec ebp
add edx, ebx
dec esi
lea ebp, [0xc09818a8]
dec esp
mov dword [esp + eax*4 - 0x1a080], edx
ret 0x10
inc sp
sub esp, edi
inc esi
mov ebx, dword [eax + ecx - 0x4bffffff]
inc esp
xor ebx, ebx
dec eax
mov dword [esp + eax - 0x4bffffff], edi
inc ecx
sub ebx, 0xfb0ecc9e
inc ecx
xor ebx, 0x2c898938
inc eax
add bh, 4
jp 0x17827dc
dec eax
mov ebx, dword [esp + edx - 0x6e0]
inc ebp
movsx ebp, sp
dec eax
arpl si, si
call fcn.012d3c83
ja 0x12dcb67
Function at 0x17497b7
Capabilities:
Encode data using base64

Disassembly:
xor edx, 0x6e2ce026
sar ax, 0xec
jae 0x17be475
mov ebp, 0xf480ef35
dec ecx
sub ecx, 4
movzx eax, bp
inc esp
movsx ebp, ax
inc ecx
mov ebp, dword [ecx + eax*8 - 0x779a8]
inc esp
mov edi, eax
xor ebp, ebx
dec esp
lea eax, [eax + eax*8 + 0x6fa1801e]
inc ebp
movzx esp, bh
dec eax
xor eax, eax
ror ebp, 1
inc ecx
shr bh, 0x22
lea ebp, [eax + ebp + 0x5616468f]
inc ecx
movsx edx, bh
bswap ebp
ror ebp, 1
inc cx
xadd eax, edx
push ebx
xor dword [esp + eax*2], ebp
dec eax
neg edx
pop ebx
push eax
call fcn.017750f4
dec ecx
sub ecx, 4
inc ebp
mov ebx, dword [ecx]
inc ecx
mov ebp, 0xc48a959b
inc ecx
mov eax, 0x3f9b6186
inc esp
xor ebx, ebx
inc ecx
mov edi, eax
inc ecx
not ebx
call fcn.016c518e
pushfd
mov edi, 0xc69fde84
push 0x2e10be9a
cmp dword [esp + edi + 0x3960217c], 0x4cb53a96
mov dword [esp + 0x10], 0x33fb7735
mov edi, dword [esp + edi + 0x39602188]
call fcn.0177cd17
inc edi
mov dword [ebp + ebx*4 - 0xac], esp
inc cx
rol ebx, cl
push ebp
dec edi
lea ecx, [ecx + ebx*4 - 0x16008]
inc edi
mov edi, dword [ecx + ebx - 0x5801]
xchg bp, dx
jb 0x12d9ce7
push 0xc11a162f
sub dword [esp], 0x311c5236
and word [esp], 0x6d84
sbb edi, 4
mov edx, dword [edi]
mov eax, 0xad97378f
xor edx, ebx
jmp 0x16f7272
jp 0x123217d
Function at 0x174c0cc
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
lea eax, [eax + 0x6283ce15]
dec ecx
bswap ecx
or eax, eax
neg dx
sbb eax, eax
dec ecx
xadd edx, eax
sbb eax, 0xeb2a020d
neg ecx
inc ecx
shl eax, 0x15
xor ebx, ecx
not dx
lea edx, [edx + eax*8 + 0x3493593b]
inc al
add ebp, ecx
jmp ebp
jmp ecx
mov word [esi], ax
bswap ecx
lea eax, [edx + ecx*4 - 0x4363a752]
and eax, ecx
mov ecx, dword [ecx + edi - 0x2394529d]
lea edi, [edi + eax*2 - 0x46002425]
add ax, ax
xor ecx, ebx
ror edx, 0xbd
jb 0x12d56b9
test edx, edi
xor ebx, edx
shl cl, 0xe1
add ebp, edx
ror ecx, 0xc8
jae 0x179253a
sal ax, 0x2e
xor edx, ebx
inc ax
ror edx, 3
jmp 0x175dfb1
xor eax, ebx
rol cl, cl
ror eax, cl
push edx
and dx, 0x6a14
rol ecx, 0xd3
inc eax
dec ebp
arpl ax, ax
shr edi, 0xb2
call fcn.01743253
inc ecx
dec eax
dec ecx
bswap edi
inc dx
xor dword [esp + ebp - 0x982305a], edx
push ebp
inc ecx
neg eax
inc dx
sar dword [esp + ebp*2 - 0x130460be], 0xee
inc sp
sub dword [esp + edi - 0xff8000], ebp
dec edx
mov dword [esp + ebp*2 - 0x130460c2], ebx
inc esi
xor dword [esp + ebp*4 - 0x2608c19c], eax
dec eax
mov ebx, dword [esp + edi - 0xff7fe8]
inc edx
sub byte [esp + ebp*4 - 0x2608c1ae], bh
inc cx
sub ebp, ebp
ja 0x173adb8
mov ecx, 0x542bfab2
movsx edx, cx
mov dx, word [esi + ecx - 0x542bfab2]
neg cl
mov ax, word [esi + ecx - 0x542bfa4c]
sub cx, 0x2426
jbe 0x16dae1b
and dx, ax
sub cx, 0xa082
lea ecx, [ecx + ecx*2 - 0x6755e3fa]
or ecx, ecx
not dx
mov word [esi + 2], dx
lea edx, [ecx*2 - 0x41c025c4]
movzx edx, byte [edi - 1]
lea eax, [ecx + 0xa29cb14]
ror cl, 0xc6
xor dl, bl
not cx
xor dl, 0xbd
dec ax
add dl, 0x10
shr al, 0x26
jne 0x177d820
ja 0x16e0812
neg dl
sub dl, 0x23
xor cx, ax
jns 0x16b1f56
dec ecx
xor dl, 0x1f
xadd cl, al
xor bl, dl
inc ecx
add edx, esp
add ecx, 0x326c907
mov ax, word [edx]
mov edx, ecx
jle 0x16bccbf
dec esp
add dword [esp + edi - 0x2516], ebx
inc ecx
dec bl
inc cx
not esp
inc ecx
inc ebx
inc esp
sub byte [esp + edi*8 - 0x1297b], bl
dec esp
lea ebp, [edx*4 - 0x3ccdf479]
inc cx
rol esp, 1
dec ecx
inc eax
inc cx
xor ebx, esp
inc cx
ror eax, 0x6f
inc si
mov dword [edi + esi - 0x252d], esp
dec esi
lea esi, [edi + esi - 0x252d]
dec eax
mov dword [esp + edi - 0x2533], 0xa94e94
inc edx
mov edx, dword [edi + ecx - 0x253a]
inc ecx
xadd ebp, eax
dec eax
adc ecx, 0xfa08a708
jge 0x1775a4f
sub edi, 4
mov ecx, dword [edi]
jmp 0x122bc29
rol eax, 0x63
not edx
movsx ecx, al
and ecx, eax
neg edx
inc edx
not byte [esp + eax*8 - 0x33]
jmp 0x17bb3a4
dec ebp
lea ecx, [ecx + edi*4 - 0x94d3]
inc ecx
rol ebx, 0xb8
call fcn.01733589
jge 0x16d38d8
mov dword [esp + ecx - 0x58828432], ebp
ret
Function at 0x174df67
Capabilities:
Check for software breakpoints

Disassembly:
bswap eax
not eax
sar cx, 0xc6
inc ecx
xor eax, 0x640a08bd
xor ebx, eax
xchg cl, dl
add ebp, eax
movzx edx, word [edi + ecx*8 - 0xe0]
lea edi, [edi + ecx - 0x23]
inc cl
add ecx, ecx
sal ecx, cl
xor dx, bx
sal ecx, 0x1c
jnp 0x172ca9d
ror dx, 1
xor dx, 0x48b0
lea ecx, [ecx + ecx*4 - 0x3978436b]
lea eax, [ecx + ecx*2 + 0x5530b59b]
neg dx
or cl, ah
not cl
or ecx, ecx
adc dx, 0x3080
bswap eax
add eax, ecx
xor ecx, 0xea35d9af
xor bx, dx
mov word [ecx + esi - 0x2cb265b3], dx
or al, al
rol eax, cl
lea esi, [esi + ecx*2 - 0x5964cb62]
lea edx, [eax + ecx*8 - 0x4cd7c04c]
jbe fcn.016a12a3
mov dword [esp + eax - 0x4f9534ff], ebp
ret
xor eax, ebx
mov dword [esp], edx
ror eax, 2
pop edx
movzx ecx, dl
jmp 0x1740fd4

Function at 0x175b6c5
Capabilities:
Execute syscall

Disassembly:
dec esi
lea ebp, [0xaf011822]
inc ecx
movsx edx, bp
dec ebp
lea esi, [esi + edx*2 - 0x5654]
call fcn.016e6d84
syscall
pushfd
dec eax
mov dword [esp], 0xe43ddddf
call fcn.016eb420

Function at 0x175d6eb
Capabilities:
Access peb ldr_data
Encode data using xor
Get number of processors

Disassembly:
rol edx, 6
rol edx, 0xaa
xor cl, 0xbd
not ax
add edx, edx
adc cl, 0x10
push edx
sar eax, 0xb1
neg cl
sar ax, 0xf
sub cl, 0x23
call fcn.016c9cf5
mov eax, dword [edi - 4]
call fcn.01708df0
mov edx, eax
xor ecx, 0xe222c984
call fcn.017a98e7
sbb ecx, dword [ebx]
adc eax, 0xf8f9eda0
invalid
xor cl, bl
jmp 0x12d5523
xor cx, ax
movzx ecx, byte [edi]
movsx edx, al
jae 0x16ef92d
pop eax
bswap edx
dec edx
movsx eax, cx
add ax, 0xdbb3
neg edx
inc edx
xor ebx, edx
and ecx, eax
sets cl
adc ebp, edx
sal ecx, cl
shr cl, 0xc5
sbb edi, 1
neg cx
jbe 0x16f5e0c
jl 0x175d72c
lahf
mov ebp, 0xaaa81add
xor byte [bx + si], dl
cdq
lahf
mov cl, 0xf
adc dh, 0x6f
add al, byte [eax]
mov eax, dword fs:[0x30]
mov eax, dword [0x30]
ror bx, cl
sar ch, cl
neg bl
mov eax, dword [eax + 0xc]
dec cx
mov ecx, dword [eax + 0xc]
bsr ebx, edx
add ebx, ebx
mov eax, dword [eax + 0x10]
rcl bl, 0xa5
movzx ebx, di
shl bl, cl
mov dword [ebp - 4], eax
not bx
mov ebx, ecx
cmp ecx, ebx
cmp ecx, eax
je 0x17b1469
lea ebx, [ebx]
Function at 0x175deda
Capabilities:
Encode data using xor

Disassembly:
inc ecx
sbb bh, ah
jae 0x178a744
inc esp
xor ebp, ebx
inc ebp
mov ebx, esp
call fcn.016a786b
inc eax
and byte [esp + ebp*2 - 0x5b], bh
xor bl, al
sal dl, 0xe1
and dl, 0x9e
inc esp
mov eax, edx
dec ebp
lea esi, [esi + ebp - 0x3f]
sar dword [esp + ebp*2 - 0x6d], 0xee
inc cx
mov dword [esi + ebp*4 - 0xf4], eax
dec eax
neg dword [esp + ebp - 0x25]
rol edi, 0x9b
pop edi
pop edi
pop edi
pop ebp
jne fcn.0178e74d
jg 0x178a785
xchg ecx, eax
test al, 0xf9
adc cl, byte [esi + 0x4f7496ab]
xor al, 0x44
inc esp
js 0x178a78e
dec ebp
cmpsd dword [esi], dword es:[edi]
inc edx
js 0x178a798
retf
mov eax, dword [0x1f787cdd]
inc ebx
in eax, dx
fnstsw word [eax + edi*2 + 0x13]
retf
adc ecx, ebx
mov ebp, 0x13787cdd
sub ebp, 0xffffffdd
jl 0x178a81c
adc edi, dword [edi + 0x1e]
inc ebx
mov ebp, 0x76a2761f
jecxz 0x178a772
add cl, bl
dec eax
mov byte [edi], cl
and al, 0x41
inc ecx
sub al, 0x1d
push 0xc6d4bc9c
jg 0x178a7ca
div dword [ecx]
fincstp
mov eax, 0x5e9aca9f
dec eax
add esi, dword [ebx - 0x10]
cmc
cmpsd dword [esi], dword es:[edi]
mov ecx, 0x87f1ee36
dec esp
and dl, byte [ebx]
pop esi
push edi
mov es, word [ebp + 0x404e8c85]
daa
out dx, al
in al, 0x60
adc ah, bl
xor eax, dword [ecx + 0x6c25480e]
xchg edx, eax
push esp
and al, 0xeb
lodsd eax, dword [esi]
jge 0x178a7b5
stosd dword es:[edi], eax
jnp 0x178a7f6
fst qword [ebp - 0x26]
stosd dword es:[edi], eax
jnp 0x178a7fc
and eax, 0x7babb64e
add cl, al
jbe 0x178a78b
stosd dword es:[edi], eax
jnp 0x178a808
test dword [ecx], ebp
ret 0x7fa
sar bl, 1
dec dword [edx - 0x39]
dec edx
mov dword [esp + ebx - 0x52ab5eb2], 0xe730971d

Function at 0x175e529
Capabilities:
Encode data using base64

Disassembly:
movsx ecx, al
lea esi, [eax + esi - 0xd40002]
xadd dword [esp + eax*4 - 0x34ffffc], ecx
mov dword [esp + ecx - 0x1002cff], 0x3031158b
mov edx, dword [edi + eax*2 - 0x1a80009]
lea edi, [edi + eax - 0xd40009]
sub byte [esp + eax - 0xd3fffe], 0x3f
call fcn.016acf3c
mov edx, 0x90992410
sub edi, 4
dec edx
mov eax, edx
mov eax, dword [edi]
jle 0x1781d21
inc ecx
mov esp, 0xbe91ab01
inc ecx
mov eax, esp
inc cx
shr esp, 0x8d
dec ecx
sbb ecx, 4
dec esi
lea edi, [eax - 0x5be9f849]
inc ecx
mov edx, dword [ecx]
xor edx, ebx
inc ebp
movzx ebp, ah
inc ecx
movzx ebp, ah
xor edx, 0x1005498c
neg edx
inc ebp
movzx eax, ah
inc cx
ror ebp, 0x43
inc edx
ror edx, 1
call fcn.016a77b7
xor eax, ebx
rol edx, 0xcb
not eax
ror eax, 1
sub eax, 0xab322fb4
ror eax, 1
or edx, edx
mov ecx, 0xdb1df797
sbb eax, 0x9bc86ba
lea ecx, [ecx*8 - 0x5c59207b]
xor ebx, eax
rol ecx, cl
push ecx
add ebp, eax
mov ecx, dword [esi]
lea eax, [edx*2 + 0x2caad580]
xchg byte [esp], al
not byte [esp]
mov eax, dword [ecx]
or dl, 0x86
mov dword [esi], eax
pop ecx
jmp ebp

Function at 0x175efb4
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov dword [esp - 0x10012020], esp
xor dl, bl
call fcn.0174fcea
Function at 0x175efd1
Capabilities:
Encode data using base64

Disassembly:
not ecx
xor ecx, 0xf910aa05
dec eax
sub ecx, 0x4fa39b2c
mov byte [esp + 7], 0x13
inc esp
mov edi, eax
movsx esi, byte [esp + 3]
bswap ecx
xor ecx, 0xc8339d94
dec eax
xor esi, 0x8db3fd0a
sbb dword [esp + 0xc], 0xa716e133
setl byte [esp]
lea ecx, [esi + ecx + 0x28fda9fd]
call fcn.016e0daf
dec eax
mov dword [esp], eax
dec ecx
sub ecx, 4
push eax
not byte [esp + 0xc]
inc ecx
mov ecx, dword [ecx]
xor ecx, ebx
sal byte [esp + 6], 0xe1
add dx, word [esp + 0xb]
mov ebp, 0xb4b65f84
inc ecx
lea ecx, [ebp + ecx + 0x66d5156c]
jbe 0x16d24cd
out dx, al
imul edi, dword fs:[0x87f92586], 0x3979c23a
inc ebp
invalid

Function at 0x176871f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc al
mov word [esi + edx*4], cx
adc dx, word [esp + edx + 4]
not eax
inc al
pop edx
pop ecx
js fcn.016a12a3
mov cx, word [edx + eax]
setnp dl
mov dword [esp + edx*8], 0x7daea986
movzx eax, dl
lea esi, [edx + esi - 2]
jns 0x16b577f

Function at 0x1769ef0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
ror ebp, 0x9b
test sp, 0xb0b0
cdq
mov ebp, esp
rcl edx, 0x36
movsx edx, dx
cwd
mov edx, dword [ebp + 8]
lea esp, [esp - 0x114]
push esi
cmp edx, ebx
jmp 0x17bb53d

Function at 0x176d953
Capabilities:
Encode data using xor

Disassembly:
movzx eax, dl
mov al, byte [esi + eax - 0xac]
lea edx, [edx + edx*2 + 0x6518552d]
lea esi, [edx + esi - 0xeeb5535]
sub edx, edx
sar dl, 0x45
add edx, edx
adc cl, al
mov word [esi + edx*2], cx
mov dword [esp + edx + 4], edx
lea edi, [edi + edx - 4]
mov ecx, dword [edi + edx*8]
add dword [esp + edx + 4], 0x3c217da1
xor ecx, ebx
lea eax, [edx - 0x49ee997e]
pop eax
movsx eax, byte [esp + edx]
rol ecx, 1
call fcn.016a90fe
imul ebp, dword [ebx], 0x3a4b4e6a
sbb bl, byte [ecx + edi + 0x1652b4b1]
cwde
cmp dword [ecx - 0x37b5d94c], esi
cmp dword [ecx - 0x2f61494c], esi
cmp dword [ecx - 0x6bbd914c], esi
cmp dword [ecx - 0x3c52a54c], esi
dec edx
sbb edx, dword [ebp + 0x4b]
fmul st(1), st(0)
invalid

Function at 0x17754b7
Capabilities:
Encode data using base64

Disassembly:
pushfd
test dword [esp + 8], 0x23b33ca4
jg 0x16b6ee8
mov byte [0xa5390f16], al
imul edx, dword [ebx], 0xffffffa6
fimul dword [edi - 0x3e]
or byte [eax - 0x62], bl
fimul dword [edi - 0x3e]
dec eax
mov ebx, 0xc24fdade
dec eax
rol byte [esi], 1
fimul dword [edi - 0x3e]
push 0x4fda86b3
ret 0xa0a0