joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10c4828
Capabilities:
Encode data using base64

Disassembly:
inc dword [esp]
lea edx, [edx + ecx - 0x58f45969]
inc dword [esp]
sub dword [esp], eax
rol edx, 3
not byte [esp + 2]
dec edx
bts eax, eax
neg edx
bts eax, ecx
xor ebx, edx
bswap ecx
add esi, edx
ror ax, 0xab
add cl, cl
mov cx, word [ecx + edi - 0x8c2166]
mov edx, eax
mov dx, word [edi + 2]
shl byte [esp + 1], 0x85
rol ax, 0xcc
adc edi, 1
xchg dword [esp], eax
and ax, 0xdf2c
sar al, 0x47
or cx, dx
xor byte [esp], 0xa7
not cx
mov word [edi], cx
movzx ecx, al
push ecx
xor dword [esp + ecx*2], esi
ret 4
adc cx, dx
or edx, 0x4a8d4a0e
jge 0x125fe16
in eax, 0x28
xchg ebx, eax
nop
xchg esp, eax
pushfd
dec ebp
lodsd eax, dword [esi]
sbb dword [edx + 0x34], 0xf6dfb114
std
mov cl, 0x56
pop esi
cmpsb byte [esi], byte es:[edi]
invalid
mul ecx
call fcn.010d13f2
push 0x87a0f32c
xor edx, 0x5c09632b
dec eax
not dword [esp + 0xd]
lea esp, [esp + 0x14]
jne 0x11471a6
pop ebx
mov ecx, 0x251ff597
not edx
sal cx, 0xad
je 0x10001ee
lea ecx, [ecx + ecx - 0x16e35579]
mov dword [esi + ecx*2 - 0x66b8d50e], edx
lea eax, [ecx + ecx*8 - 0x25e95965]
movsx edx, cx
jmp edi
mov ebx, 0xd633ce2e
movzx ebx, byte [ecx]
jmp 0x128ed9b
mov word [esi + ecx - 0xcddb], ax
movsx eax, cx
lea ebp, [ebp + ecx - 0xcddf]
div eax
inc ecx
not al
mov edx, dword [ecx + ebp - 0xcddc]
jl 0x1039a30
xor edx, ebx
inc edx
btc eax, eax
cwde
call fcn.0102e21d
sub ebp, 2
mov word [ebp], cx
lea ecx, [edx + edx*2 + 0x6d04bc34]
neg edx
rol cx, 0x8b
mov ecx, dword [edx + edi - 0x74b9a74]
shl dl, 0x41
lea edi, [edi + edx - 0x74b9ae4]
xor ecx, ebx
rol dx, 0x42
lea ecx, [ecx + edx - 0x1f866555]
xor ecx, 0xdc35d12e
mov eax, edx
inc ecx
btc edx, 0xb7
bts ax, dx
not eax
ror ecx, 2
sar edx, 0x21
jnp 0xf69617
xor ebx, ecx
call fcn.010bed55
dec ecx
mov ecx, dword [ebx]
dec ebp
mov edi, dword [ebx + 8]
push 0x900cd407
dec word [esp]
dec ecx
add ebx, 8
inc esp
mov esi, dword [esp + 3]
dec ecx
or ecx, edi
neg dword [esp + 4]
mov ebp, dword [esp + 1]
dec eax
not ecx
dec ebp
lea esp, [esi + ebp*4 + 0x780ad23]
inc ecx
movzx eax, sp
dec ecx
mov dword [ebx + ebp - 0x1900cd4], ecx
inc ax
call fcn.01282b92
pop edx
div eax
rol ecx, 3
imul eax
call fcn.011c3775
lea edi, [edi + edx*2 - 0xf348a5c]
sar byte [esp + edx - 0x79a452b], 0xc5
sal word [esp + edx - 0x79a452a], 0x87
mov dword [edi + edx*4 - 0x1e6914b0], eax
pop eax
jbe fcn.00f3fe0c
mov eax, 0x5c0b4235
mov ecx, dword [eax + edi - 0x5c0b4235]
bt eax, 0x87
mov eax, dword [eax + edi - 0x5c0b4231]
jae 0x103eb50
xor ebx, edx
call fcn.0103281d
Function at 0x10de03b
Capabilities:
Execute syscall

Disassembly:
mov dword [esi + ecx*2 - 0x590a9a32], edx
movsx eax, cx
mov ecx, dword [ebp + ecx - 0x2c854d19]
ror byte [esp + eax - 0x4d16], 0x46
neg al
lea ebp, [eax + ebp - 0x4de3]
movzx edx, al
xor ecx, ebx
not ecx
cwde
idiv word [esp + eax - 0x4de4]
shr ax, 0xe3
dec ecx
sar dx, 0x4b
shr edx, 0x14
ror ecx, 2
xor ecx, 0x7412c83d
xor ebx, ecx
mul eax
or dx, dx
or al, 0x8d
adc edi, ecx
lea ecx, [edx + eax*2 - 0x67f0a8fe]
add ecx, 0xe3026197
pop ecx
pop edx
jbe fcn.00ffc251
mov ecx, 0xd712db86
shl cl, 0x62
sbb ebp, 4
jmp 0x119efa0
call fcn.012736b7
push 0xa0917c08
dec dword [esp]
rdtsc
sub esi, 8
push 0x730f93aa
or byte [esp + 4], 0xac
mov dword [esi + 4], eax
mov ecx, 0x2c854d19
js 0xfb298c
inc cx
rol esi, 1
or bl, 0xbe
inc cx
xchg esp, eax
inc bp
xor eax, esi
dec eax
shr ecx, cl
dec esp
adc esi, esp
call fcn.00edf8b0
mov eax, 0x7196a739
rol al, 6
mov ecx, dword [ebp + eax - 0x7196a74e]
mov edx, eax
cdq
push eax
xor ecx, ebx
neg edx
xor dword [esp + edx], eax
bswap ecx
dec eax
ja 0x11b6461
inc ecx
shr eax, 0x7f
inc edx
shr byte [esp + eax + 3], 0xc6
xor ecx, 0xf2b8dd2c
call fcn.00ff0fc6
sysenter
pushfd
mov dword [esp], 0x4c305d16
call fcn.00fa0e39
push eax
cmpsb byte [esi], byte es:[edi]
lodsb al, byte [esi]
ret

Function at 0x10f114c
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
call eax
mov ecx, 0x5b185c9c
movsx ebx, cl
mov ebp, dword [ebp + ecx - 0x5b185ca0]
mov dword [ebp + ecx - 0x5b185c9c], eax
mov edi, ebp
xadd cx, bx
movsx eax, bx
pop ebx
movzx esi, cl
push ecx
lea edx, [eax*8 - 0x257594db]
mov esi, dword [esp + ecx - 0x5b185c34]
push edx
mov ebp, dword [esp + eax*2 - 0xb92c]
mov dword [esp + eax*4 - 0x17268], 0xeaba3a7
mov dword [esp + eax - 0x5c90], edx
mov dword [esp + eax*4 - 0x17270], esi
ret 0xc
lea esp, [esp + 4]
jne 0x11720d7
push 0xe69d8fba
not dword [esp]
mov eax, dword [esp]
mov eax, dword [ebp + eax*2 - 0x32c4e08a]
jmp 0xfbd286
dec eax
adc edi, eax
dec ecx
dec ebp
inc ecx
movzx edx, word [ecx + ebx*2 + 0x6a241a22]
call fcn.012218fa
mov dword [esp], 0x8e393292
mov dword [esp], eax
dec ebx
push 0x6e9eba8b
not byte [esp + 1]
jmp 0xff6f97
mov eax, 0xe2a20f25
add al, al
mov eax, dword [ebp + ebx*4]
call 0x10f1160
mov edx, dword [esi]
mov ecx, 0x1d8ce132
add ecx, ecx
mov cx, word [esi + ecx*2 - 0x763384c4]
mov eax, 0x729da5be
lea esi, [esi + eax - 0x729da5b8]
ror eax, 0x38
inc eax
xor al, 0xb7
mov word [edx], cx
sbb edi, 4
mov edx, eax
shl dl, 3
sar dx, 0xc
mov edx, dword [edi]
movzx ecx, ax
inc eax
xor edx, ebx
inc ax
jno 0xfde4f6

Function at 0x10f8ca1
Capabilities:
Encode data using base64

Disassembly:
jmp 0x114719b
lea esp, [esp + 0x10]
je 0x10c4843
push ebx
Function at 0x110faf2
Capabilities:
Authenticate hmac

Disassembly:
xor ax, 0x2318
and ecx, 0xc84b537
mov dword [esp + edx*2 - 0x1c006], ecx
not ax
jae 0x1046a19
mov edx, 0x8b2c6032
call fcn.010cf0c7

Function at 0x1110b05
Capabilities:
Encode data using base64

Disassembly:
not ecx
sub eax, eax
mov dword [esp + eax], edx
bswap ecx
jl 0x117e95e
btr edx, 0x26
neg ecx
cdq
or dword [esp + edx], 0xeb3e2905
rol ecx, 1
xor ebx, ecx
add esi, ecx
idiv byte [esp + eax*4 + 3]
mov dword [esp + edx], esi
ret

Function at 0x1114436
Capabilities:
Encode data using base64

Disassembly:
mul dword [esp + edx - 0x7ec59ffd]
dec dword [esp + 3]
bswap ecx
xor ebx, ecx
sar byte [esp + 6], 0xa2
add edi, ecx
movzx ecx, dx
pop ecx
pop eax
pop ecx
jmp fcn.0104b44b
btc ax, dx
xor ecx, 0x4521cb25
mov dword [esp + edx - 0x7ec5a001], edx
dec ax
not ecx
shr dl, 0x47
lea ecx, [ecx + eax - 0x5459adf6]
je 0x106c487
sbb edx, 0x26396b09
dec eax
neg eax
bts cx, cx
sbb cl, 0x9a
rol eax, 2
inc cl
dec eax
xchg cx, dx
xadd cx, dx
or edx, ecx
xor eax, 0xfbb4f389
ror ecx, cl
shr cx, 0x89
and dx, cx
ror eax, 1
bswap ecx
lea eax, [eax + ecx*4 - 0x21564fcf]
sar ecx, 0x81
xchg dh, cl
bswap eax
lea ecx, [ecx*2 + 0xdbea8b3]
xor ebx, eax
rol cx, 0x4d
adc edi, eax
xchg ch, cl
lea eax, [edx*8 - 0x78c0497b]
lea ebp, [ebp + ecx - 0x4fbf966b]
rol al, cl
mov edx, dword [ecx + ebp - 0x4fbf9667]
xor edx, ebx
dec edx
sub eax, 0x26021900
setbe cl
btr eax, ecx
neg edx
sal eax, 0xcd
sal al, 0xa1
sbb cx, 0x2230
not edx
sbb al, 0xb8
xor edx, 0xbe35f996
xor ebx, edx
btc ecx, eax
inc cl
lea esi, [esi + ecx - 0x4fbf72d5]
call fcn.00fc3098

Function at 0x11382ee
Capabilities:
Manually build aes constants

Disassembly:
mov dword [esp + eax*2], ecx
shl dword [esp + eax*2 + 2], cl
mov dword [ebp + eax], edx
bswap eax
pop eax
pop edx
jp fcn.00f4c6ca
imul ax, word [esp + eax + 5]
lea ebp, [ebp + eax - 4]
jno 0x107b28d
jp 0xfe134b
add dword [esp + edx*2], ecx
mov word [esi + edx*4], ax
mov dword [esp + edx*2], edi
ret

Function at 0x1143df5
Capabilities:
Execute syscall

Disassembly:
mov dx, word [edi + eax*8 - 0x425c50]
lea edi, [edi + eax*8 - 0x425c4e]
movzx ecx, byte [eax + ebp - 0x84b8a]
cwde
lea ebp, [ebp + eax - 0x4b89]
adc dword [esp + eax*8 - 0x25c50], eax
sbb word [esp + eax - 0x4b8a], 0x86ac
add ax, ax
xor cl, bl
shl byte [esp + eax - 0x9714], 0xc5
mov byte [esp + eax*2 - 0x12e26], ah
ror cl, 1
add ebp, eax
mov dword [esp + 4], ecx
mov ecx, esi
lea eax, [edx*4 - 0x635fd962]
lea esi, [esi + eax - 0x56c0b020]
sal edx, 0xa9
div eax
shl word [esp + edx - 0x2e82561e], 0x86
mov word [edx + esi - 0x2e825622], cx
imul dx, dx
imul al
pop ecx
pop ecx
jb fcn.00fb1362
mov ecx, 0xcf270a99
ror cl, 0xe7
sbb ebp, 4
neg ecx
mov eax, dword [ebp + ecx*2 - 0x61b1eb9a]
ja 0x113638c
xor eax, ebx
call fcn.010de86b
sysenter
push ebp
mov dword [esp], 0x9afc895b
call fcn.010638c4
rol edi, cl
cmpsb byte [esi], byte es:[edi]
ret

Function at 0x115a212
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov dword [esp], 0x9a82ca39
call fcn.01264816
Function at 0x1169345
Capabilities:
Encode data using xor

Disassembly:
bt edx, eax
xor cx, bx
push edx
dec eax
sub dl, dl
dec cx
sub edx, dword [esp]
sbb ax, dx
rol cx, 1
dec dl
imul word [esp]
jb 0x11ddc1d
adc dword [ecx - 0x5c85c25d], ebx
loope 0xfce1d2
jmp [ebp + esi*2 - 0x44]
jmp dword [edx + 0xe2cceb]
test eax, 0xf6e76c02
add ch, byte [edi - 0xa]
jge 0xfce234
push ss
jmp [ecx + ecx*4 - 0x28]
push esi
dec ecx
sbb dword [eax - 0x79], 0x20097500
fisttp dword [eax]
dec ecx
xor al, 0xa3
jle 0xfce1ba
int3
shl byte [esi + ebx*2 + 0x1ab9daaa], 1
fidiv dword [eax + eax*4]
or ebx, dword [esi - 0x3d]
pop esp
jne 0xfce1d1
cmp edi, edi
salc
jecxz 0xfce2b1
jp 0xfce210
sub edx, ebp
fidivr dword [eax + 0x5d]
sbb byte [0x406fe62d], al
cdq
pop ebx
in al, dx
add byte [ebx + ebx*2 - 2], bh
aad 0x5c
and ebp, dword [0xa2bff2d]
fsub dword [edx]
ret 0xa811
xor ah, ah
push ebp
mov ecx, 0x3aa000e3
xor al, 0x3b
dec edx
xlatb
sbb esp, dword [edx - 0xf]
sti
mov esi, 0x4e1b7365
ret 0x65bd
dec ecx
xor edx, ebx
sar ax, 0xc4
and cx, cx
setno cl
sbb edx, 0x9a9e4c09
ror edx, cl
sub al, ah
jne 0xf35c98
syscall
push edi
dec eax
mov dword [esp], 0xc739d614
call fcn.00f2640a
call fcn.011e9af3
xchg edx, esi
mov edi, dword [esp + ebx - 0xa23]
mov ecx, 0x86af9ab7
mov dword [esp + ebx - 0xa27], edx
mov ecx, dword [esp + ebx*2 - 0x1446]
dec bl
push dword [esp + 0xc]
popfd
jmp 0x11ffa18
not cx
call fcn.00ffeee0
mov eax, 0x28aa96ad
movsx ecx, al
mov ecx, dword [eax + esi - 0x28aa96ad]
mov eax, dword [esi + eax*2 - 0x51552d56]
mul ecx
mov ecx, 0xc636aaa3
sal cl, cl
mov dword [esi], edx
mov dword [esi + 4], eax
setae cl
sbb edi, 3
mov edx, dword [edi]
movzx eax, cx
sar ecx, 0x62
xor edx, ebx
dec edx
bt cx, ax
push ecx
rol edx, 2
sal dword [esp + eax*2 - 0x15400], 0x13
ror ax, 0xa1
rol cx, 0x4a
not edx
sub ax, word [esp + eax*2 - 0xa9ff]
pop eax
inc edx
or cx, ax
and cl, cl
shl ecx, cl
bswap edx
add al, al
dec edx
add eax, eax
xor ebx, edx
btc eax, ecx
shl eax, 0xcb
adc ebp, edx
jmp ebp
mov dword [esp + ebx*2 - 0x1448], ebx
mov esi, dword [esp + ebx - 0xa16]
pop ebx
lea edx, [edx + edx*8 + 0x43144b39]
mov ebx, dword [esp + 0x10]
call fcn.00f5b1fe
mov ecx, 0xb7bda000
mov ecx, dword [esi]
mov edx, 0xc43ef039
mov edx, dword [esi + 4]
add esi, 4
mov eax, 0x64030909
not ax
not ecx
bt ax, ax
not edx
sub al, ah
ror eax, 0x2e
and ecx, edx
mov dword [esi], ecx
movzx edx, al
lea ecx, [edx + eax*8 + 0x441a6e9a]
bts edx, ecx
mov edx, dword [edx + ebp - 0xf]
bts ecx, eax
lea ebp, [ebp + ecx - 0x426ef1d]
jb 0x111c8fe
movzx ecx, word [edi]
mov edx, 0xcda7fb38
movsx eax, dx
add edi, 2
add dx, ax
jb 0xfce17e

Function at 0x117ed15
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec eax
mov dword [esp], 0xc7b346a4
call fcn.00f2640a
mov eax, 0x509fb204
push eax
lea edi, [eax + edi - 0x509fb208]
mov ecx, dword [edi + eax - 0x509fb204]
xor ecx, ebx
neg word [esp + eax - 0x509fb204]
sbb ecx, 0x428b9208
Function at 0x11b5513
Capabilities:
Encode data using base64

Disassembly:
neg dx
rol al, 1
push ecx
rol word [esp + 2], 0xe
sar edx, cl
neg al
lea ecx, [ecx + ecx*2 + 0x200e8b3f]
rol al, 1
rol edx, cl
rol ecx, 0xe8
setb byte [esp + ecx*4 - 0x3a2ccc80]
neg al
or edx, edx
bswap ecx
setno cl
adc al, cl
dec cx
xor cl, ch
xor bl, al
sub edx, 0x8b22758f
pop edx
jo 0xef0091
adc eax, esp
xor edx, 0xac0f3694
inc ecx
ja 0x1029e13
imul byte [ebx]
mov al, 0x3d
mov ch, 0xfc
leave
xor bh, bh
cmp eax, 0x9b0a00ac
shr byte [edx], 1
jmp dword [esi - 0x19]
xchg ch, dl
bswap eax
sub eax, 0x5893263a
bswap edx
xor eax, 0xeb275093
bt cx, cx
not ecx
xor ebx, eax
sar cx, 0x6f
not cx
adc ebp, eax
bt edx, edx
mov edx, dword [esi]
jb 0xf54dee
call fcn.00f07643
cmp cl, dh
mov dl, 0x3d
sbb edx, dword [edx + 0x13]
xor bh, bh
pop esp
out 0xae, eax
add byte [ebp + esi - 0x2700d7f6], ah
mov eax, 0xe18661
xlatb
pop esp
or dh, 0
add dh, bh
push 0
push ecx
invalid
lea eax, [ecx*8 - 0x176b0842]
ror eax, 0x97
or cl, byte [esi + 4]
btr ax, ax
add eax, eax
shl eax, 0xe6
adc esi, 2
add al, ah
shr edx, cl
movsx ecx, al
rol ecx, cl
mov dword [esi + ecx*4 - 0xa000], edx
jmp ebp
call fcn.0113862e
push 0x18378882
call fcn.00f668d5
mov dword [esp], 0x99291012
xor ebx, edx
not word [esp]
and ebx, 0xff
neg word [esp + 2]
mov ebx, dword [ebx*4 + 0x1040c00]
jo 0xedd9b9
shr edx, 8
jmp 0xf7bd77

Function at 0x11d583c
Capabilities:
Manually build aes constants

Disassembly:
movsx eax, word [esp + ecx - 1]
shr al, cl
pop edx
je fcn.00fb1362
mov ecx, 0x1a1cd80
sal ecx, 0xcf
lea edx, [ecx + 0x281d9e03]
lea edi, [edi + edx - 0xedd9e04]
adc dx, 0x4d28
movzx eax, cl
dec dl
adc al, byte [edx + edi - 0xeddeb2a]
btr cx, 0xc
jb 0xfab408
setb dl
xor al, bl
and cl, 0x36
sub edx, 0xf137393
neg al
and cx, cx
dec al
rol al, 1
or dx, dx
xor al, 0x11
jmp 0xf63207
sub al, 0xbf
xor bl, al
sub esi, 2
and dl, 0xab
sbb edx, ecx
mov word [esi + edx - 0x190a7729], ax
dec dl
movzx eax, dx
lea edi, [edi + edx - 0x190a772c]
sbb dl, cl
xchg dx, ax
mov edx, dword [edi + edx*2 - 0x3214ee50]
xadd cl, ah
xor edx, ebx
add ecx, eax
shr ecx, cl
seta al
adc edx, 0xfa09fd16
ror edx, cl
add edx, 0xbe172ea5
push ecx
shr dword [esp + ecx - 1], 0x5d
ror cx, cl
bswap edx
not dword [esp + ecx - 0x8000]
rol edx, 1
xor dword [esp + ecx - 0x8000], ecx
bswap edx
adc edx, 0xca1f642c
rol edx, 2
rol dword [esp + ecx*4 - 0x20000], 9
shr dword [esp + ecx - 0x8000], 0xb8
rol ecx, 0x8e
xor ebx, edx
or ecx, eax
rol al, 0x44
push eax
adc ebp, edx
xadd word [esp + ecx*4 - 0x7ffffffd], cx
or word [esp + eax*2 + 4], cx
pop eax
pop eax
jl fcn.00fb1362
call fcn.00f49534
lea esi, [esi + edx*4 - 0x36183ffa]
mov word [esp + edx*2 - 0x1b0c1fff], dx
inc edx
lea edx, [edx*2 - 0x32c75968]
mov word ss:[ecx], ax
pop ecx
pop ecx
pop edx
jmp edi
dec dl
sbb eax, 0xdd28ab08
neg eax
inc eax
ror eax, 1
movsx ecx, dx
dec edx
mov dword [esp + ecx - 1], ecx
xor ebx, eax
xor word [esp + ecx + 1], dx
seta dl
adc ebp, eax
shl dx, 0x66
ja 0x1263507
mov si, word [esi + ecx*2 - 2]
je 0xf3fc34
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
push 0x7bb08b88
push 0xe523a3a9
jmp fcn.01024d4f
btr dx, ax
xor ecx, ebx
imul eax, eax
bts edx, eax
sbb ecx, 0x8dbc5284
jmp 0x10d1bf7
Function at 0x11dee3f
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x18]
jmp 0x120046e
push eax
and dword [esp + edx - 0x95], edx
xor ecx, 0xc79117b8
neg ax
call fcn.011df63f
jmp 0x1128be0
mov eax, dword [ebp]
mov edx, 0x4a2ac62f
mov ecx, edx
neg dx
lea ebp, [ebp + ecx - 0x4a2ac62b]
or dx, dx
call fcn.00f7d914
mov word [esp + 0xa], 0x6804
add edi, edx
push 0x2011a79d
jmp 0xfa0e61
call fcn.01114390
mov ecx, dword [edi]
mov eax, 0x9c382895
movzx edx, al
inc ax
lea edi, [edi + edx*4 - 0x250]
bt eax, 0x95
xor ecx, ebx
jmp 0x109a938
push ecx
mov ecx, 0xcb0ece2c
pushfd
cmp ecx, 0x8ca1b6a3
mov ecx, dword [esp + ecx*2 + 0x69e263ac]
mov dword [esp + 4], 0x6344854c
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00f1a34b
jnp 0x1200503
jbe 0x12004d8
bound edi, qword [ecx]
cmp al, byte [ecx]
pop eax
xor cl, ch
loop 0x12004a0
invalid
inc ebx
wait
cmp dl, byte [ecx + eax]
jl 0x12004dd
inc edx
jp 0x12004e3
and al, 0x2d
pop ss
int 0xfe
dec esi
sub eax, 0x4efecd17
pop es
push ss
add eax, dword [ecx]
jns 0x12004e3
in eax, dx
invalid
into
lodsd eax, dword [esi]
enter 0x2c2e, 0xfffffffffffffffe
mov bh, 0x51
jecxz 0x1200511
inc eax
xor al, 0x90
inc ecx
int3

Function at 0x11f1ad3
Capabilities:
Encode data using base64

Disassembly:
movzx edx, al
mov ax, word [esi + eax - 5]
lea edx, [edx + edx + 0x6a1f36b9]
lea esi, [esi + edx - 0x6a1f36c5]
or edx, edx
adc cx, ax
mov eax, 0xa11d9a0e
and dx, ax
mov word [edx + esi - 0x6a1f1206], cx
imul ax
mov ecx, dword [ebp + edx - 0x6a1f2898]
lea ebp, [ebp + edx - 0x6a1f2894]
not dx
inc edx
ror al, 0xe4
xor ecx, ebx
or eax, edx
bts eax, eax
xor ecx, 0xe3161096
cdq
sub ecx, 0x85920d9c
cdq
rol ax, 0x82
cbw
rol ecx, 3
mul dl
bt eax, eax
adc eax, 0x6ca94108
add ecx, edx
push edx
xor ebx, ecx
call fcn.010ba88d
call fcn.00fe12a6
mov eax, 0xd9adf6b4
lea edx, [eax + eax + 0x6d161a9c]
mov eax, dword [edi + edx*2 - 0x40e41008]
not dl
imul edx, edx
push edx
adc edi, 3
push edx
xor eax, ebx
shr dx, 0x66
sub dx, dx
bswap eax
inc eax
jmp 0x1223c83
movsx ecx, dx
rol edx, 0x53
neg eax
lea ecx, [ecx + ecx*4 - 0x1dcfdc74]
lea eax, [eax + ecx - 0x121e2a05]
bt edx, 0x9a
shr dx, cl
rol eax, 3
inc byte [esp + edx - 0x5000c]
call fcn.00f1e565
movsx eax, cl
mov cx, word [esi + eax - 7]
jmp 0x1124a66

Function at 0x11f9ab0
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jne 0x11adc3e
Function at 0x11ffcc2
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
sal word [esp + 3], 2
xor eax, 0x949b2385
bswap eax
xor ebx, eax
mov dword [esp + 0xc], edx
mov ecx, edx
add ebp, eax
push edx
mov dword [esp + ecx - 0x753c0017], ebp
ret 0x10
mov edx, dword [ecx + edi - 0x7d16]
lea edi, [edi + ecx*4 - 0x1f454]
bts ax, ax
xadd eax, ecx
btc ecx, 0x87
xor edx, ebx
not cx
neg cl
rol edx, 1
xchg cx, ax
btr ax, cx
bswap edx
neg ecx
neg al
lea edx, [edx + eax + 0x733e536c]
xor edx, 0x3f3fef21
sal ecx, cl
ja 0x106eb5d
sub ah, byte [esi]
inc edi
ret 0x305
jmp 0x1167cca
mov edx, eax
and eax, eax
mov edx, ebx
btr ax, 0xae
neg al
sal edx, 2
mov eax, ebp
jmp 0x11499d2
inc ecx
xor ebx, edx
inc ax
and ecx, eax
sal eax, 0xd9
adc esi, edx
add ecx, esi
jmp ecx
add eax, edx
push 0x56849c01
mov dword [ebp - 4], eax
test ebx, ebx
mov dword [esp], 0x751e262a
jmp 0x11bfd67
push 0xa8a33a2d
pushfd
xor byte [esp + 4], 0x11
mov dword [esp + 4], 0x6c08c5db
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00ee6e04
inc ecx
sub edx, 0x8281a20f
neg ecx
sub edx, edx
sbb al, ah
cbw
sbb ecx, 0x8316b601
dec edx
btr edx, 0x20
not ecx
btc edx, eax
or eax, eax
neg ax
ror ecx, 2
bswap ecx
push eax
call fcn.00f60eb1
sub edi, 8
push 0x46142287
add word [esp + 1], 0xc20f
push 0x371b9eb4
mov dword [edi + 0xc], eax
mov eax, 0xa18b8d1e
sub ax, ax
mov dword [edi + 8], ebx
call fcn.010ae202
dec eax
lea esp, [esp + 0x90]
ret
lea esp, [esp + 4]
je 0x1201991
mov eax, dword [ebp + ebx*4]
call fcn.0120197e
leave
test dword [esp + edi + 0x53], eax
mov edi, ebp
iretd
mov dword [esp + eax - 0x459c0d98], esi
push ebx
lea ebx, [eax - 0x12c283f8]
mov ebx, edx
jae 0xffac26
mov eax, dword [ebp]
call eax
mov edx, 0x69b87f16
mov ebp, dword [edx + ebp - 0x69b87f1a]
mov dword [edx + ebp - 0x69b87f16], eax
movsx edi, dx
movzx ecx, di
btr dx, 0xa
pop ebx
movsx eax, di
btc edi, ecx
pop esi
jae 0x128791a
pop edi
btc cx, 0x19
jb 0xf0e4b9
push 0x858e822d
mov ax, word [esi]
inc byte [esp + 1]
push 0xa0aea0b1
pop edx
mov cx, word [esi + edx + 0x5f515f51]
lea edx, [edx*4 - 0xd7dbfda]
or edx, edx
adc esi, 2
ror dx, 0xcd
jb 0xfb9a02
setae dl
adc ax, cx
push edx
mov word [esi], ax
or dl, dh
mov eax, dword [edi]
shl byte [esp + 5], 1
adc edi, 3
push edx
xor eax, ebx
push edx
ror eax, 2
and dx, dx
sar dx, 0xc8
lea eax, [eax + edx + 0x7588fc63]
jp 0xf08de7
Function at 0x120f46e
Capabilities:
Encode data using xor
Execute syscall

Disassembly:
adc byte [esp + edx - 0x40002051], 0x88
or dl, ch
xor eax, ebx
xor ecx, edx
bt dx, dx
lea eax, [eax + edx - 0x7203cd77]
bt ecx, 0x3f
xor eax, 0x89bf931e
call fcn.00fa5d9d
call fcn.0100a721
syscall
call fcn.0112f32a
mov ecx, 0xbf344e1d
push ecx
mov eax, dword [edi]
inc byte [esp + 2]
pop ecx
movsx edx, cx
lea edi, [edi + edx*4 - 0x13870]
xor eax, ebx
sub dx, 0xa3ab
rol dx, 0x89
ror eax, 1
sub eax, 0x9aad4f18
btc cx, 0x9c
adc dx, dx
push ecx
bswap eax
dec eax
xor word [esp + edx - 0xcaa7], cx
not cx
ror eax, 1
xor ebx, eax
btc ecx, edx
add esi, eax
bswap edx
mov eax, edx
add dword [esp], 0xc41c03a4
mov eax, dword [ebp]
ror dl, 0xa1
setb cl
mov ecx, dword [ebp + 4]
push edx
sal word [esp], 0x8f
adc ebp, 4
ror edx, 0xd6
and eax, ecx
not eax
and edx, edx
shl byte [esp + edx - 0x2800029e], 0xa6
mov dword [ebp + edx - 0x280002a3], eax
mov ecx, edx
not byte [esp + edx - 0x280002a3]
mov eax, 0x5f35b625
mov dword [esp + edx - 0x280002a3], esi
ret 4
lea ecx, [edx + ecx + 0x1a8db320]
mov dword [edi + edx - 0x40002052], eax
lea ebp, [ebp + edx - 0x40002056]
movzx eax, dx
mov dword [esp + eax - 0x2052], eax
rol al, 0xa5
mov eax, dword [ebp + edx - 0x40002052]
jae 0xfe7a13

Function at 0x12262ae
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [edi + 4]
neg byte [esp + 7]
adc edi, 3
call fcn.00fab7a1
inc ecx
mov esi, 0xd50ea72c
inc ecx
push esi
inc ecx
mov ebp, dword [ecx]
dec ebx
lea edx, [esi + esi*8 - 0x6d48d8f2]
dec eax
shl dword [esp], 0x12
dec ecx
adc ecx, 4
inc ecx
xor ebp, eax
inc ecx
pop ebp
inc ecx
dec ebp
dec eax
lea esi, [edx + edx*8 + 0x42b99403]
xor ebp, 0x8a34ec8b
inc cx
xadd ebp, edx
inc edx
lea ebp, [ebp + ebp - 0x76f8477a]
inc esp
movzx edi, dx
dec ebx
lea eax, [esi + ebp*8 + 0x1d18cc8c]
dec eax
dec eax
bswap ebp
dec ebp
neg eax
mul eax

Function at 0x122d0e1
Capabilities:
Encode data using base64

Disassembly:
push 0x5930dd01
call fcn.0101e11b
inc eax
inc word [esp + 4]
push 0x9a344c17
xor ecx, 0x5068819
jmp 0xf74823

Function at 0x1238677
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor

Disassembly:
lea ebp, [ebp + eax*8 - 0xc]
mov eax, dword [ebp + eax*2 - 2]
xor eax, ebx
push edx
not eax
neg cl
ror edx, 0xe1
bswap eax
dec cx
xor eax, 0xe4baceaf
sar dword [esp + ecx], 0x45
lea ecx, [ecx + ecx*2 + 0x4ca384a1]
neg eax
push edx
shl dx, 0xac
inc cx
dec eax
push edx
sar byte [esp + ecx - 0x4ca384a2], 0xc2
xor ebx, eax
xchg word [esp + edx - 0x7fffeb], dx
sar ecx, 0xd
sbb cx, 0x5cac
adc esi, eax
dec dword [esp + edx - 0x7ffff3]
pop edx
pop edx
pop eax
pop edx
pop edx
pop edx
jne fcn.01101cc6
lea edi, [edi + eax*8 - 0xa]
mov dword [esp + eax + 3], eax
dec cl
mov dword [esp + eax*2 - 2], eax
mov word [edi + eax - 1], dx
mov edx, dword [esp + ecx*2 - 0x1fd]
jne 0x11c95ed

Function at 0x123d749
Capabilities:
Execute syscall

Disassembly:
not edx
neg eax
pop ecx
call fcn.0116761c
syscall
call fcn.0117ed15
Function at 0x124d81b
Capabilities:
Authenticate hmac

Disassembly:
shl eax, 0x53
xor dl, bl
cbw
call fcn.00ff86b0
movzx edx, byte [ebp]
jns 0xee9b88
sal eax, 0x19
cwd
xor bl, cl
sub dx, 0xcea8
lea ecx, [esp + ecx + 0xc]
movzx dx, byte [edx + ecx - 0x2a933158]
lea ecx, [eax*8 - 0x7a6bb0cb]
cwde
cbw
lea esi, [esi + eax*2 - 2]
or eax, eax
mov word [esi + eax], dx
push eax
xor ax, word [esp + eax + 0xb]
pop edx
pop edx
pop edx
pop ecx
jle fcn.00fb1362
bswap eax
inc cl
neg eax
lea eax, [eax + edx - 0x70d8bbfe]
neg eax
pop edx
xor ecx, ecx
sub ecx, 0x3480da95
lea eax, [eax + edx*2 - 0x6aa5138a]
lea ecx, [ecx + ecx*8 + 0x719db720]
neg eax
not edx
not dx
dec eax
dec cl
bt ecx, 0x84
sal dl, 0xe4
xor ebx, eax
xor edx, 0x2ca83785
adc edi, eax
mov eax, 0xcd2aa410
rol ax, 0xa1
sbb ebp, 0
neg cl
jbe 0xfb7b8a