joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20497fa
Capabilities:
Encode data using base64

Disassembly:
dec esp
or eax, ebx
jmp 0x20e732e
mov dword [esp + edx], ebp
ret 0xc
inc ecx
bts ecx, edx
dec esp
add edi, eax
dec esp
mov dword [esp + ebx - 0x81], eax
dec ecx
sar edx, 0xe5
dec edx
mov edi, dword [ebx + ebp - 0x81]
dec ebp
bt esi, ecx
dec ebp
or edx, dword [ebp + ebx*4 - 0x1fc]
dec ecx
add edi, edx
dec ecx
mov dword [ebp + ebx*2 - 0xfa], edi
inc ecx
push esi
shr word [esp + ebx*2 - 0xfe], 2
dec ebp
mov eax, dword [ebp + ebx - 0x79]
dec esp
sbb esi, dword [esp + ebx - 0x80]
dec ecx
mov ebx, dword [ebp + ebx - 0x71]
inc ecx
mov edi, ecx
jb 0x198e1dc
sal edx, 0xbd
adc ebp, ecx
sal word [esp + edx*8], 0x61
jne 0x203f9d7
inc ecx
xor edx, 0x22e9280
inc ecx
neg edx
inc ecx
shl dh, 0x67
dec esp
mov dword [esp + edi - 0x7c34], ebx
inc esp
xor dword [esp + edi - 0x7c34], edx
dec ecx
not eax
shr cl, 0x67
dec ebp
lea ecx, [esi + 0x269ab89c]
inc ecx
pop ebx
dec ebp
arpl dx, dx
dec ebp
adc edi, edx
inc cx
bt ecx, ecx
xadd edi, ecx
dec eax
mov edi, dword [ebp + edi - 0xf840]
inc ecx
mov ebx, esi
dec ecx
lea ebp, [esi + ebp - 0xc]
dec edx
lea edx, [ecx*8 + 0x6d921a22]
dec ecx
xor edi, ebx
dec ecx
dec eax
inc esp
movsx edx, cl
dec eax
dec edi
mov eax, 0xb036017
xchg ecx, eax
dec eax
not edi
dec edx
lea edi, [edi + esi + 0x5da9a227]
dec eax
bswap edi
dec eax
bswap edx
dec eax
lea esi, [ecx - 0x75ad078]
inc ebp
movzx esp, al
dec eax
dec edi
dec ebp
bt eax, esi
dec eax
xor edi, 0x115bd04
sar bl, 0x64
xadd ax, dx
dec ebp
sbb esp, eax
dec esp
xor ebx, edi
dec ebp
sub esp, esi
cwd
dec ebx
mov dword [ebp + esi - 6], edi
call fcn.02068817
mov ecx, 0x8a32ad2d
movzx ax, byte [edi]
mov cl, byte [edi + 2]
mov edx, 0xb1bb961a
add edi, 2
dec edx
rol dl, 0x42
dec edx
sal al, cl
push edx
jmp 0x20f433f
dec ecx
not eax
dec edi
mov dword [ebp + ecx*2 - 0x29543626], eax
btr edx, 0x88
dec edi
lea ebp, [ebp + ecx - 0x14aa1b0b]
dec esi
adc dword [esp + ecx - 0x14aa1b14], esi
xor esi, 0xba1b063a
dec esi
mov dword [esp + ecx*2 - 0x29543636], edi
ret 8
inc ebp
xadd cl, ah
jne 0x2080d24
movzx ecx, byte [esp]
mov word [edi + ecx*2 - 0xc6], ax
sub ecx, edx
mov eax, dword [esi + ecx - 0x4e446a00]
bt edx, 0x28
lea esi, [esi + ecx - 0x4e4469fc]
adc word [esp + ecx - 0x4e4469ff], 0x1b1c
sal dword [esp + ecx - 0x4e446a00], 6
xor eax, ebx
dec edx
call fcn.020c90bc

Function at 0x20548ec
Capabilities:
Encode data using base64

Disassembly:
mov edi, 0x533aa8aa
or edi, 0xe9853b00
inc ecx
movzx edi, byte [ecx]
call fcn.019886cd
rol word [esp + 0x10], 0x88
inc ecx
xor esp, 0x43859c8e
dec eax
mov dword [esp], 0x73a7e029
not dword [esp + 0x17]
not word [esp + 0x18]
dec eax
dec ebx
dec eax
lea esp, [esp + 0x20]
jne 0x13f7880
mov eax, 0x8a01760e
movzx esi, ax
dec esp
lea edx, [esi + esi*4 + 0x40abd49e]
inc ecx
not esp
inc esi
mov dword [esi + ebp - 0x760e], esp
inc ecx
movzx edi, dl
call fcn.020df0cb
Function at 0x2063612
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
ror eax, 2
btc ecx, ecx
jb 0x199a4f9
neg eax
ror dx, 0x24
sub eax, ecx
btr cx, 0x1f
and dl, cl
xor ebx, eax
shr ecx, 0x3b
bt edx, 0x85
adc ebp, eax
imul edx, ecx
xor cx, word [edx + edi + 2]
neg edx
mov eax, edx
adc ax, word [edi + edx*2 + 4]
call fcn.0198649b
mov esi, 0x931d753c
dec esp
lea esi, [esi*4 + 0x38b4469f]
call fcn.0208cc1a
mov edx, dword [edi]
mov eax, 0x878aba1f
mov ax, word ss:[edx]
mov ecx, 0xd24e380
mov word [ecx + edi - 0xd24e37e], ax
pop ecx
mov eax, dword [esi]
sub esi, 0xfffffffc
mov edx, 0xcfab891f
movsx ecx, dl
xor eax, ebx
rol eax, 2
lea eax, [eax + ecx*4 - 0x6b998627]
shr cl, 7
adc dl, ch
ja 0x2033814
mov ebx, 0x7abb9a88
jmp 0x20ee8e3
push ebx
inc esp
movzx esp, byte [ebp + ebx - 0x7abb9a89]
inc ebp
xor ah, bl
dec eax
and dword [esp + ebx - 0x7abb9a88], 0x718d1e32
call fcn.019c8792

Function at 0x206839e
Capabilities:
Encode data using xor

Disassembly:
ror edx, 3
inc edx
lea eax, [ecx + ecx*8 - 0x2fdbc068]
ror cx, 0x84
rol edx, 1
shr ecx, 8
xor eax, dword [esp + ecx*8 - 0x4402]
call fcn.020b4c08
enter 0x5c79, 0x33
jmp 0x13db041
add byte [eax], al
add cl, ch
mov al, ch
retf
jb 0x20f39fd
movsx edx, dl
mov edx, dword [esp + 8]
mov dword [esp + 8], 0x2b617fb
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.0209c304
call fcn.0199dbf1
and cx, cx
xor al, bl
or cx, 0x2b07
inc word [esp + ecx - 0x6d7b7bb1]
mov dword [esp + ecx - 0x6d7b7bb7], 0xc256323
ror al, 1
not al
shr ecx, 0xa9
sar ecx, cl
neg al
sal dword [esp + ecx*8 + 4], 0x5a
sbb al, 7
and dword [esp + ecx*4 + 4], ecx
lea ecx, [ecx*2 + 0x658cf708]
bt ecx, ecx
neg al
dec ecx
not ecx
dec cl
xor bl, al
lea eax, [esp + eax + 8]
add cl, cl
mov dword [eax], edx
movsx edx, cl
mov edx, dword [esi + 1]
sbb byte [esp], ch
adc esi, 5
not ecx
add cl, ch
and byte [esp + ecx - 0x658cf702], 0x33
xor edx, ebx
push ecx
inc ecx
dec dword [esp + ecx - 0x658cf701]
lea edx, [edx + ecx*2 + 0x28a2dd9d]
and ecx, 0x1818128c
jne 0x13daffc
dec edx
popfd
frstor dword [edx - 0x731e7ed8]
adc bl, byte [eax]
sbb byte [edi], cl
test dword [edi + 0x2c], edi
aaa
dec dword [ebp - 0x73]
pushfd
inc esp
bt dword [0x74314449], ebp
adc al, 0xbb
dec ebp
lea ebx, [esp + eax*2 + 0x492da30f]
inc esp
xor dword [esp + edx - 0x45], esi
inc ecx
pop ebx
dec ecx
mul esp
dec eax
or esi, eax
inc eax
setp bh
dec ebp
arpl si, si
call fcn.019742d2
jge 0x199c445
lcall 0x34e8, 0xf6634dc7
mov edi, 0x8d0fff90
mov eax, dword [0x94ff9340]
xchg esp, eax
sub cl, al
jge 0x2068402
sar byte [ecx - 0x699e0e36], 0xe0
loope 0x206837d
int1
jge 0x206836c
in al, 0xe1
retf 0x1f1
jo 0x2068394
mov ebp, 0xc1728639
mov ebx, 0xb6b37a54
outsd dx, dword [esi]
mov al, byte [0x1801ddda]
popal
pop es
daa
mov ebx, 0xdae72d6
mov ecx, 0x69e2c246
adc byte [esi - 0x65f72f7d], ah
cmpsb byte [esi], byte es:[edi]
inc ecx
stosb byte es:[edi], al
dec edx
dec ecx
popal
das
pop esp
cmp eax, 0xecdac110
invalid
mov edx, 0xc4bbe020
test dl, 0x3a
call 0x206839e
Function at 0x2074240
Capabilities:
Encode data using base64

Disassembly:
rol al, 0x24
btc edx, 0x3b
xor ebx, ecx
xadd dword [esp + edx - 0x8000000], edx
shr ax, 0x4a
add ebp, ecx
rol byte [esp + eax*2 - 0xb], 0x43
sar edx, 0xc4
pop edx
pop ecx
ja fcn.020c2694
shl edx, 0x25
and edx, dword [esp + edx*2 - 0x3810cc80]
mov byte [eax + edx*4 - 0x70210800], cl
sub dx, word [esp + edx*2 - 0x381083ff]
movsx ecx, dx
sub dword [esp + edx*2 - 0x3810e45a], edx
mov dword [esp + edx - 0x1c08722d], ebp
ret
neg al
neg edx
adc edx, 0xc0867223
xadd byte [esp + 2], dl
xor al, 0x21
neg dword [esp]
shr dl, 2
ror byte [esp + 3], 0x64
add al, dl
xor byte [esp], dl
jbe 0x13e8d93
xor bl, al
sub byte [esp + 3], dl
ror edx, 0xe9
lea eax, [esp + eax + 4]
jne 0x19d812c
mov dword [esp + ecx - 0x203b48e8], edx
add ebp, eax
movzx ecx, byte [ecx + esi - 0x203b48e4]
xor cl, bl
movzx eax, dx
cwd
xchg word [esp + eax - 0xd000], ax
neg cl
shr edx, 0xe8
or byte [esp + edx - 0xf719fc], dh
rol cl, 1
bswap eax
rol dx, 2
sal edx, 0xbd
sbb cl, 0xaa
rol eax, 0xfb
neg cl
inc eax
not cl
or edx, dword [esp + edx - 0x80000000]
bt dx, 0x8c
rol cl, 1
neg cl
cbw
neg dword [esp + eax - 0x60001]
add eax, edx
xor bl, cl
div eax
movzx eax, byte [edx + esi - 0x40e8b542]
sar word [esp + edx - 0x40e8b547], 0xcf
xor edx, 0x2b0c18e
add dword [esp + edx - 0x425874c9], edx
lea esi, [esi + edx - 0x425874c3]
xor dx, 0x9124
or edx, edx
sar edx, 0x6a
xor al, bl
sar edx, 0x5d
neg dword [esp + edx*4]
bt dx, 0x84
rol al, 1
inc al
sal dword [esp + edx], 0xc2
sub dx, word [esp + edx*2 + 2]
jbe 0x19db5c4
mov edx, 0x9310a328
inc ebp
mov eax, dword [ebp]
dec esp
lea ecx, [edx*4 + 0x63acd7bc]
inc ecx
mov cl, byte [ebp + 4]
inc esp
movsx esp, dx
dec ecx
add ebp, 2
inc ecx
shl eax, cl
inc ecx
push esp
inc esp
mov esi, dword [esp + 3]
inc edi
mov dword [ebp + esi*2 - 0x1fe], eax
inc esp
movsx edx, dx
dec edx
lea ebp, [ebp + esi*4 - 0x400]
inc edx
movzx eax, byte [esp + esi - 0xfe]
inc edx
rol dword [esp + esi - 0xfc], 0x5a
inc esi
mov ecx, dword [ebp + esi - 0xff]
dec eax
lea edi, [edx*4 - 0x174aa2e3]
inc ebp
xor ecx, ebx
inc edx
not dword [esp + esi*2 - 0x1fe]
inc ecx
sub ecx, 0xab91d12a
inc ecx
bswap ecx
dec ebx
lea ecx, [edx + esi*2 - 0x6dd2a64]
dec eax
lea ebx, [edi*2 - 0x59d50a5d]
inc ecx
mul edx
inc ecx
sbb ecx, 0xf105a5ab
inc cx
xadd esp, ebx
inc edx
setns byte [esp + esi - 0xff]
cbw
inc ecx
neg ecx
inc ebp
lea ecx, [ecx + edx*4 - 0x2e0aad16]
inc esp
xadd byte [esp + edx - 0x9e], ah
inc ecx
xor ecx, 0x13a9520a
rol ecx, 0xbe
call fcn.020b52d5
ror ecx, 3
jmp 0x13d3ebe

Function at 0x2086df8
Capabilities:
Encode data using base64

Disassembly:
xor bl, cl
rol ax, 0xea
dec al
mov word [edi - 4], cx
lea ecx, [edx*2 - 0x2e7d0641]
btc ecx, eax
cmovae edx, dword [esp + 4]
lea edi, [edx + edi - 0x32fcd300]
not dl
xor cl, dh
pop ecx
pop ecx
jle fcn.020c2694
Function at 0x20a4f69
Capabilities:
Encode data using base64

Disassembly:
call fcn.02039068
inc ecx
pop ebx
dec eax
arpl di, di
inc cx
imul edx, eax
inc bp
xchg ecx, edx
dec eax
adc ecx, 0x9980ff28
dec esp
add edi, edi
inc sp
xchg ebx, edx
dec esi
mov ecx, dword [edx + ebp - 0x21dbd244]
inc ebp
mov ah, byte [ebp + edx - 0x21dbd23c]
inc cx
dec esi
inc cx
imul eax
inc esi
dec ebp
lea ebp, [ebp + edx - 0x21dbe4b6]
inc esi
mov byte [edx + ecx - 0x21dbe4c0], ah
inc ebp
mov esp, edx
dec ebp
lea edx, [esp + ecx*8 - 0x386571ea]
inc ecx
jmp edi
call fcn.019b927c
inc ebp
mov ecx, dword [ebp]
mov edx, 0x4d38663f
not dl
mov eax, edx
inc ecx
mov ecx, dword [ebp + eax - 0x4d3866bc]
cwd
movzx ebx, al
movsx edi, dx
inc esp
add ecx, ecx
dec esp
lea esi, [eax*2 - 0x6ae4e350]
dec eax
or edi, 0xcd171a34
je 0x13df4cf
inc esi
mov dword [ebx + ebp - 0xbc], ecx
jno 0x20e15c5
push ebx
mov dword [esp + eax - 0x4d3866bc], 0x643e1db1
inc ecx
mov edx, dword [ebp + edx - 0x4d37fffc]
inc esp
movzx edx, word [esp + eax - 0x4d3866bf]
inc esp
movsx eax, bh
bt ax, di
inc ecx
mov eax, dword [ebp + ebx - 0xb8]
dec esi
lea esp, [edx*4 - 0x72418df0]
setb byte [esp + ebx - 0xc0]
inc ecx
mov ecx, dword [ebp + ebx*2 - 0x174]
inc ecx
ror dh, 0xc5
div ecx
inc ecx
mov dword [ebp + edi + 0x32e8e5d4], edx
inc ecx
ror dh, 0x47
invalid
call 0xd0ce574d
inc edi
dec eax
shr dword [esp + ebx - 0xc0], 0x27
sub dword [esp + ebx - 0xbe], ebx
inc edx
mov dword [ebx + ebp - 0xb4], eax
inc ecx
sar esi, 0x72
not byte [esp + edi*2 + 0x65d1cb99]
call fcn.020b16b9
mov edx, 0xfa024e0c
call fcn.02063612
jle 0x20e160d
leave
jge 0x20e1616
adc byte [edx + 0x74], bl
ret 0xbff1

Function at 0x20b6c24
Capabilities:
Encode data using base64

Disassembly:
shr bl, 4
inc cx
xor eax, ebx
movsx esi, byte [esp + edi*2 - 0x46]
inc ax
movzx ecx, si
neg ax
inc eax
xadd bh, bl
rol ax, 1
shr cx, cl
dec esp
lea edx, [ebx + edi*4 - 0x2785548]
not ax
mov dword [esp + edi - 0x21], 0x52b46004
inc ecx
mov esi, 0xd68c3b96
inc ecx
pop esp
dec ax
inc esp
movzx ecx, word [esp + edi - 0x2a]
sal byte [esp + edi*8 - 0x151], 0x81
inc sp
xor ebx, eax
not dl
dec eax
lea eax, [esp + eax + 8]
inc ecx
push esi
inc ecx
xor esi, esi
mov esi, dword [eax + edi - 0x2b]
ror word [esp + edi - 0x21], 0xb
inc cx
shl ecx, 0x61
dec cl
dec ebp
lea ebp, [ebp + edi - 0x2f]
call fcn.013f7658

Function at 0x20b6e34
Capabilities:
Encode data using xor

Disassembly:
dec ebp
arpl si, si
inc esi
sub dword [esp - 2], ecx
dec ebp
add edi, esi
neg edx
add edx, 0x610e212a
dec esp
mov dword [esp + ebx*2 - 0x10a0a], edi
ret 0x10
inc ebp
xor esi, ebx
neg esi
inc ecx
ror esi, 2
inc edi
lea esi, [ecx + esi - 0x764fd2b1]
inc ecx
neg esi
inc esi
imul ecx, dword [esp + 4]
inc ecx
sbb esi, 0xefab42b1
inc ecx
movzx eax, cl
dec esp
imul ecx, eax
dec esi
mov dword [esp + 0xb], ebx
inc esi
xor dword [esp + 0xb], esi
dec esi
mov dword [esp - 5], esp
inc edx
not byte [esp + 5]
ror al, 0xa1
dec esi
mov ebx, dword [esp + 6]
dec eax
mul esi
jae 0x19bb6d3
Function at 0x20bc345
Capabilities:
Encode data using base64

Disassembly:
call fcn.01974357
push 0x8390208d
mov edx, dword [edi]
mov ecx, 0x43281680
sar byte [esp + ecx - 0x4328167e], 0x82
inc dword [esp + ecx - 0x43281680]
mov ax, word ss:[edx + ecx - 0x43281680]
lea edi, [edi + ecx - 0x4328167e]
call fcn.01998e27
shr esi, 0x95
dec eax
lea esi, [esi*4 - 0x1bead5e4]
lea edx, [edx + esi*2 - 0x22631c5c]
inc ebp
bt eax, eax
xor edx, 0xa8a4cb29
dec ecx
bts ecx, esi
btc esi, 0x11
not edx
inc eax
movzx ecx, bh
inc ecx
sal al, 0x41
neg edx
dec eax
ror esi, cl
movsx ebx, di
mov eax, ecx
dec edx
inc ebp
mov esp, eax
push edi
dec esp
mov dword [esp + ecx - 0x74], ebx
dec esi
lea esi, [edi + eax + 0x897aeae]
xor dword [esp + ecx*4 - 0x1d0], edx
inc eax
and bh, cl
dec eax
cwde
setnp bl
inc ecx
pop ebx
inc bp
imul esi, edx
dec ecx
adc esp, 0xddbb09b3
bts bx, si
dec eax
arpl dx, dx
bswap ecx
push 0x751a4595
mov eax, dword [ebp]
jmp 0x13ef517

Function at 0x20c3df9
Capabilities:
Encode data using base64

Disassembly:
inc ecx
movsx esi, ah
inc ecx
dec edx
ror edi, cl
inc ecx
bswap edx
dec ecx
sbb ecx, esp
inc ecx
mov eax, 0x8e8f1d1f
inc ecx
ror edx, 1
inc sp
btr edx, esi
inc ecx
neg edx
dec eax
xadd ecx, edi
dec eax
lea ebx, [edx*2 + 0x18ae7e8f]
inc ecx
not edx
dec ebp
lea ecx, [esi + edx + 0x44b91532]
inc ecx
push ebx
inc esp
xor dword [esp], edx
dec eax
lea edx, [ebx + 0x4d04e535]
inc eax
dec dh
inc esp
movzx ebx, di
inc ecx
pop ebx
dec ecx
lea eax, [esi + edx*4 - 0x24c33356]
dec eax
cwde
dec ebp
arpl dx, dx
dec edx
lea ecx, [eax*2 - 0x235ab858]
inc ecx
idiv ecx
push ecx
dec ebp
add edi, edx
shr al, cl
dec eax
add ecx, dword [esp + edx - 0x43fedf35]
dec ebp
lea edx, [esi + eax*8 + 0x53109826]
dec esp
mov dword [esp + edx - 0x43fedf35], edi
ret
inc edi
mov dword [ebp + esi - 0x428537b8], ecx
inc esp
mov esp, edi
dec ecx
lea edi, [esp + edx + 0x511f643f]
inc cx
rol esi, 0xc9
dec ecx
lea ebp, [esi + ebp - 0x42857073]
inc ebp
adc esi, esi
inc esp
mov edx, dword [ebp]
dec ecx
lea ecx, [esi + edi + 0x53851f1d]
inc ebp
xor edx, ebx
dec eax
xadd ecx, edx
jae 0x13e3e1c
mov edx, 0x5322118d
dec eax
inc edx
movzx edx, byte [edi + edx - 0x5322118e]
inc ecx
xor edx, ecx
push 0xdc152c9d
call fcn.019b2d12
push 0xb134f5af
dec eax
lea esp, [esp + 0x28]
jne 0x204688c
mov edx, 0x52a04e32
inc ecx
pop ebx
inc ecx
mov esi, 0x428537b8
inc ecx
not ecx
dec ebx
lea edi, [esi + esi*8 - 0x7bc195dd]
dec edx
lea edx, [esi*4 - 0x3b48cfdc]
jmp 0x2042227

Function at 0x20c5347
Capabilities:
Encode data using base64

Disassembly:
jnp 0x20e5874
push 0xda9503a7
xor edx, 0x641e2835
push 0x68245c21
push 0xb93c0fb4
ror word [esp + 0x14], 0x2f
not edx
and word [esp + 0x10], 0x7237
xor ebx, edx
Function at 0x20d6f22
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + eax*8 - 0x403a]
mov ecx, eax
movsx edx, al
dec edx
mov dword [esp + eax - 0x808], ebp
ret 8
insb byte es:[edi], dx
add byte [esi - 0x77], ah
xchg esp, eax
cmp dh, bh
idiv edi
inc ecx
mov esp, 0xfff7fa04
jmp ebp
mov word [eax + edi - 0x802], dx
sar dword [esp + eax - 0x806], 0xe5
jae 0x19c38da
lahf
in eax, 0x5a
jle 0x19d4f0e
iretd
jg 0x19d4e97
leave
mov esi, dword [edi]
sub byte [esi], al
jmp 0x19d4ee0
adc al, 0xe1
and eax, 0x3666820a
pop ds
sub esp, dword [esi]
jmp 0x19d4ee3
or al, byte [edx + 0x2b1f3666]
jmp 0x19d4ee3
dec eax
ja 0x19d4f49
sbb ch, cl
push esp
stosd dword es:[edi], eax
invalid
and dword [edi], ecx
dec eax
jp 0x19d4f1e
stosd dword es:[edi], eax
inc ebx
jb 0x19d4ecc
rol dword [ebx + 0x710a895e], 0x36
pcmpgtb mm3, qword [0x52829f]
sbb ecx, ecx
push edx
add byte [ebx], bl
leave
mov esp, 0xd49ee306
rcl dword [edi - 0x5c24dfc8], cl
mov esi, 0x26a30fa1
sbb dword [ecx - 0x84ef277], 0xf3d59129
sahf
aam 0xd3
xchg edi, eax
cmp byte [eax], ah
invalid
mov eax, dword [0x8126a30f]
cdq
mov dword [0x9129f7b1], ecx
aad 0xf3
imul ebp, dword [ebx + 0x1b], 0xffffffa6
push es
stc
jle 0x19d4eec
push ss
loop 0x19d4ecd
jl 0x19d4f60
pop ebx
popal
xlatb
aam 0xd0
xor ebp, dword [edi]
jle 0x19d4ef9
invalid
jnp 0x19d4f77
sub al, 0xdb
xor dword [ecx - 0x5b], 0xffffffbe
insb byte es:[edi], dx
fild dword [ebx + 0x6cbea571]
dec esp
jne 0x19d4f4a
mov eax, 0x4ffd75a6
outsd dx, dword [esi]
into
in eax, dx
adc dword [ecx], eax
sbb al, 0x8f
and esp, dword [eax + ebx*2 + 0x3410149a]
adc dword [eax + 0x7a], ebp
invalid
adc al, 0x71
rcr byte [edi - 0x967382c], cl
js 0x19d4f15
pop esp
push cs
cmp al, 0x4b
invalid
jne 0x19d4e99
xor dl, 0x3b
lea ecx, [ecx + ecx*4 + 0x541db388]
not dl
call fcn.020be46c
cwde
neg edx
mov dword [esp + eax*2 - 0x3ffc], eax
cwde
lea edx, [edx + ecx + 0x701fd24e]
not edx
inc eax
xchg dword [esp + ecx - 0x1f0065], ecx
mov dword [esp + ecx - 0x2000], 0x9213bca4
xor ebx, edx
neg dword [esp + ecx - 0x2000]
add ebp, edx
mov ecx, dword [ecx + edi - 0x1ffc]
push eax
add al, ah
mov edx, 0x71934898
movzx dx, byte [ecx + eax - 0x2021]
sar ax, 0x82
jnp 0x19db80f
mov eax, 0xcbb8d4a5
mov ecx, dword [esi]
not eax
lea esi, [esi + eax*2 - 0x688e56b0]
add eax, eax
add eax, 0x1a0e88bd
xor ecx, ebx
rol eax, 0x21
shl eax, 0x34
mov edx, eax
neg ecx
or dl, dl
inc edx
xor ecx, 0x7a08fcb4
call fcn.019a8877
and cx, ax
mov eax, 0x581dc332
lea eax, [eax + eax*4 - 0x5e6fc0e8]
cwde
not cx
mov word [edi + eax*4 - 0x3c46], cx
mov ecx, dword [esi + eax - 0xf12]
lea eax, [eax*2 - 0x6ff33d43]
mov edx, eax
xor ecx, ebx
btc dx, dx
bt ax, 0xa1
ror edx, 0xcd
inc ecx
sal al, 0x66
adc edx, edx
dec eax
xor ecx, 0x9311af
rol dx, 1
not ecx
sal eax, 0x23
imul al
sbb ecx, 0x7206f32d
xor ebx, ecx
cdq
add ebp, ecx
btr edx, eax
inc eax
mov ecx, eax
movzx edx, byte [esi + 4]
adc esi, 4
bt ax, cx
setae cl
xor dl, bl
sal cl, 0x46
bt eax, 1
and ecx, eax
not dl
neg dl
neg ax
bts ecx, eax
xor dl, 0xe
sub dl, 0x24
xchg ecx, eax
jmp 0x20cdaa5
Function at 0x20e6b18
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + eax*2 - 0x115d2902], esi
not edx
inc ecx
movzx edi, cx
inc edx
dec ecx
ror ecx, 0x91
neg edx
dec esi
mov dword [esp + eax - 0x8ae9481], ebx
inc ebp
movsx ebx, cx
and ax, 0xff00
jbe 0x19947d0
inc edx
xor dword [esp + eax - 0x8ae9481], edx
inc ecx
not ebx
xor si, 0x893c
inc ecx
pop ebx
dec eax
add ebx, 0x27a22087
cwde
dec eax
arpl dx, dx
ror ax, 0x86
dec ecx
xadd ecx, edi
inc eax
sets dh
dec esp
adc edi, edx
dec edi
mov ebp, dword [eax + ebp - 0x8ae9481]
push ebx
inc ecx
pop esi
jmp fcn.013d7167
Function at 0x50fdb5
Capabilities:
Encode data using xor

Disassembly:
pop edi
pushal
movsb byte es:[edi], byte [esi]
pop esp
sbb dh, ch
salc
xor esi, dword [ebp + 0xa]
pop eax
dec eax
invalid
inc esp
dec eax
dec esp
das
wait
sbb ebx, dword [ebx + 0x50]
push esp
push esp
add dword [edx + 0x70], edx
pop eax
call [esi + edi*8 - 0x5b]
add esi, edx
jl 0x50fd76
pushal
jge 0x50fe37
test dword [eax + 0x48], ecx
ret 0x5fbc
fucompi st(5)
push cs
rol byte [ebp - 0x7256fb48], 1
pushfd
mov eax, dword [ebx]
retf 0xc258

Function at 0x58403d
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret
Function at 0x58b369
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x3014a4e0]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
call esi
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call esi
mov edi, dword [ebp + 8]
push dword [edi + 0x38]
mov ebx, eax
mov dword [ebp - 8], ebx
call esi
mov ecx, dword [edi + 0x18]
mov dword [ebp + 8], eax
add eax, ebx
add eax, dword [ebp - 4]
lea ebx, [ecx + eax*2 + 9]
and ebx, 0xfffffffc
lea eax, [ebx + 0xa8]
push eax
call dword [0x3014a62c]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x58b541
push 0x30
push edi
push esi
call 0x63928a
add ebx, 0xa8
movzx eax, bx
mov ebx, dword [ebp + 8]
mov dword [esi], eax
lea eax, [esi + 0xa8]
mov ecx, eax
sub ecx, esi
mov word [esi + 0x38], cx
add ebx, ebx
lea ecx, [ebx + 2]
push ecx
push dword [edi + 0x38]
push eax
call 0x63928a
lea ebx, [esi + ebx + 0xaa]
mov eax, ebx
sub eax, esi
mov word [esi + 0x3a], ax
mov eax, dword [ebp - 4]
add eax, eax
push eax
push dword [ebp + 0xc]
push ebx
call 0x63928a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add eax, eax
and ecx, 0x3f
mov cx, word [ecx*2 + 0x301b83b8]
xor edx, edx
add eax, ebx
add esp, 0x24
cmp dword [ebp - 4], edx
mov word [eax], cx
mov dword [ebp + 0xc], edx
jbe 0x58b455
lea ecx, [ebx + edx*2]
and edx, 0x3f
mov dx, word [edx*2 + 0x301b83b8]
xor word [ecx], dx
mov edx, dword [ebp + 0xc]
inc edx
cmp edx, dword [ebp - 4]
mov dword [ebp + 0xc], edx
jb 0x58b438
lea ebx, [eax + 2]
mov eax, ebx
sub eax, esi
mov word [esi + 0x3c], ax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push dword [ebp + 0x10]
push ebx
call 0x63928a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add eax, eax
and ecx, 0x3f
mov cx, word [ecx*2 + 0x301b83b8]
xor edx, edx
add eax, ebx
add esp, 0xc
cmp dword [ebp - 8], edx
mov word [eax], cx
mov dword [ebp + 0xc], edx
jbe 0x58b4b1
lea ecx, [ebx + edx*2]
and edx, 0x3f
mov dx, word [edx*2 + 0x301b83b8]
xor word [ecx], dx
mov edx, dword [ebp + 0xc]
inc edx
cmp edx, dword [ebp - 8]
mov dword [ebp + 0xc], edx
jb 0x58b494
add eax, 2
mov ecx, eax
sub ecx, esi
mov word [esi + 0x3e], cx
push dword [edi + 0x18]
push dword [edi + 0x30]
push eax
call 0x63928a
and word [esi + 0x40], 0
mov ebx, dword [0x3014a650]
push 0x5c
push dword [edi + 0x34]
call ebx
push 0x2f
push dword [edi + 0x34]
mov dword [ebp + 0xc], eax
call ebx
add esp, 0x1c
cmp dword [ebp + 0xc], eax
ja 0x58b4ef
mov dword [ebp + 0xc], eax
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x58b4fe
mov eax, dword [edi + 0x34]
mov dword [ebp + 0xc], eax
jmp 0x58b502
add dword [ebp + 0xc], 2
push 0x20
push dword [ebp + 0xc]
lea eax, [esi + 0x68]
push eax
call dword [0x3014a6cc]
add esp, 0xc
push ebx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
mov word [esi + 0xa6], bx
mov dword [esi + 0x30], 0x3e8
mov dword [ebp - 0xc], ebx
push dword [esi]
push esi
push dword [eax + 8]
call dword [0x3014a2bc]
push esi
call dword [0x3014a49c]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41be04
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041bc75

Function at 0x41c1fe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040a490
mov eax, dword [0x477e00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00419df2
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41c240
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41c39c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004259c0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x47a438]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041cf9d
mov ecx, dword [esi*4 + 0x47a438]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41c395
cmp eax, dword [edi + ecx + 0x24]
jne 0x41c395
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c395
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041cf9d
add esp, 0x14
test edx, edx
jl 0x41c395
jg 0x41c30b
test eax, eax
jb 0x41c395
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41c395
jl 0x41c325
cmp dword [ebp - 0x1008], eax
ja 0x41c395
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41c343
test ebx, ebx
je 0x41c37c
cmp ecx, edi
jae 0x41c37c
mov al, byte [ecx]
cmp al, 0xd
jne 0x41c35d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41c369
cmp byte [ecx + 1], 0xa
jne 0x41c369
inc ecx
jmp 0x41c369
movzx eax, al
movsx eax, byte [eax + 0x4780c8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41c343
cmp edx, ebx
jne 0x41c343
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41c39a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00409aec
leave
ret