joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f04c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0xe2353a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f09b
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
jmp 0x41f0ba
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f12c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f115
test esi, esi
jbe 0x41f12c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f107
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f12c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0e4
jmp 0x41f12c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f12c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe23541
ret
Function at 0x420284
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0xe2489f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202bf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202d8
lea eax, [ebp - 0x10]
mov edx, dword [0xe41348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202eb
lea eax, [ebp - 0x10]
mov edx, dword [0xe41348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4202f7
adc edx, 0
mov edx, dword [edx*4 + 0xe40178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420471
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420464
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420464
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420402
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420402
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420402
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420402
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420464
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420464
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420489
inc ebx
cmp ebx, 0x19
jne 0x4202b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe248a6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x55ea7e
Capabilities:
Encode data using base64

Disassembly:
imul cx, dx
movzx dx, byte [eax + edx*2 - 0x4feea300]
pop eax
mov word [esi + ecx*4 - 0x1e402], dx
ror cl, 0xe5
mov edx, 0x68ba0c29
lea esi, [esi + ecx*2 - 0xf202]
pop ecx
pop eax
jae fcn.0059f19a

Function at 0x57702c
Capabilities:
Encode data using base64

Disassembly:
dec ecx
sub ebx, 4
inc ebp
mov eax, dword [ebx]
inc ebp
xor eax, edi
call fcn.00647e12

Function at 0x5794e5
Capabilities:
Encode data using base64

Disassembly:
dec eax
cdq
inc ebp
movzx esi, al
inc ecx
xor dl, 0x95
inc ebp
xor bh, dl
xor word [esp + ebp + 8], bx
inc ecx
shl eax, 0xa4
inc cx
bts eax, 0xa1
dec esi
lea edx, [esp + edx + 0x20]
inc ecx
neg al
dec ebp
mov eax, dword [edx + ebp]
btr bp, si
dec ebp
mov dword [ebp + edi + 0x65dd13ec], eax
inc ecx
pop edx
inc eax
xchg byte [esp + edi + 0x65dd1409], dh
cbw
dec ebp
lea ebp, [ebp + ebp*2 - 0x14]
pop esi
inc ecx
pop esi
pop edi
jae fcn.00656530
Function at 0x580c53
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp]
lea esp, [esp + 4]
call eax
mov edi, 0x1321190c
mov ebp, dword [ebp + edi*4 - 0x4c846434]
mov esi, edi
shr si, 0xc5
mov dword [ebp + edi*4 - 0x4c846430], eax
mov edx, esi
jns 0x597b1a
mov esi, ebp
movzx eax, di
shl dl, 0xe6
pop ebx
adc edi, 0xfcaad21c
pop ebp
ror eax, 0x94
pop edi
lea edi, [edi + edx - 0x13210004]
movzx ecx, al
neg edx
mov eax, dword [eax + edi - 0x190c000]
bswap ecx
neg edx
xor eax, ebx
ror eax, 1
push ecx
pop edx
neg eax
ror eax, 1
call fcn.0057f5b8
push 0xd3236b3c
shr dword [esp], 0x67
mov edx, dword [esi]
shr word [esp + 2], 0x23
mov ecx, 0x713ac009
lea ecx, [esp + ecx - 0x713abfad]
mov dword [ecx], edx
mov eax, dword [edi - 4]
sal word [esp + 1], 0xe
xor eax, ebx
neg dword [esp]
not eax
sbb eax, 0x999f528d
mov ecx, 0x802c2889
movsx edx, cl
not edx
rol eax, 1
add cl, cl
sal edx, 0x83
dec eax
not eax
call fcn.005b697b
inc ecx
mov eax, 0xf802b426
inc ebp
mov ecx, eax
dec esp
lea eax, [esp + 0x98]
jmp 0x5bd02c
inc ecx
movsx edi, cx
inc ecx
movzx edx, cl
inc ecx
mov ebx, dword [eax + edx*4 - 0x98]
inc cx
rol ecx, 0xe3
inc ecx
mov dword [ebp + edx*4 - 0x9c], ebx
inc ebp
sub ecx, ecx
inc ebx
mov edx, dword [ebx + ecx*2 - 4]
dec edi
lea ebx, [ecx + ebx - 4]
dec eax
btr edi, 0xf
inc ecx
xor edx, edi
inc eax
movsx ecx, bh
rol edx, 2
inc ebp
mov eax, ecx
xor edx, 0x94b1e68e
inc edx
lea edx, [edx + ecx*2 - 0x5a30005]
inc esp
mov esi, ecx
bswap edx
inc ecx
movsx eax, al
inc ecx
push edi
inc edx
xor dword [esp + ecx*2], edx
inc ecx
pop edi
inc ecx
movsx ebp, cl
mov esi, 0x4fa3529c
dec eax
arpl dx, dx
call fcn.005c2635
xchg edx, eax
sal dword [eax - 0x6448c076], 1
mov cl, 0xbb
cli
cwde
daa
int 0xf9
mov ebx, 0xae4398fa
int1
mov ebx, 0xefbb98fa
inc eax
sub dword [eax + 0xb], ebp
out dx, ax
stc
insd dword es:[edi], dx
movsb byte es:[edi], byte [esi]
sub dword [esi + 0x57], eax
scasb al, byte es:[edi]
jno 0x5bd0d8
out dx, eax
psrlq mm7, mm2
cdq
jecxz 0x5bd0c7
adc al, 0x2a
les ebx, [ecx + 0x2a1ce899]
les ebx, [ecx - 0x57b97a11]
push edx
les ebx, [ecx + 0x5faca2]
outsd dx, dword [esi]
mov byte [0x6f005fac], al
and byte [ebp + 0x7ae3f8a], bh
and al, 0xb6
cli
cwde
pop esi
ja 0x5bd146
mov dh, 0xfa
cwde
cli
pop es
xor byte [esi + 0x4eda98fa], dh
inc ebp
cwde
fimul dword [esi + 0x45]
lodsb al, byte [esi]
or esp, dword gs:[esi + 0x52]
sar dword [edi - 0x704df4d7], 1
jns 0x5bd151
dec ebp
les esi, [ecx + esi*2]
sbb al, bl
jl 0x5bd103
imul edi, ecx, 0x2125d099
and al, 0xc4
cdq
cmpsb byte [esi], byte es:[edi]
mov ecx, 0x99c4241d
cld
mov eax, dword [0x99c42445]
salc
rcr dword [edi + 0x4731015b], cl
cmp al, 0x42
push eax
dec esi
pop edx
pop ecx
call 0x1541d2ce
xor bh, byte [eax]
mov ebx, 0x6af88550
push ds
sub dword [edx + 0x6accd4c7], eax
sbb bh, bl
mov byte [0x3d32e23], al
rol dword [ebx], cl
fidiv word [ebx + 0x47388a11]
fstp dword [eax + eax + 0x50]
push eax
pop eax
jnp 0x5bd114
xor al, byte [ebp + 0x5b]
pop esi
mov dword [esi], esp
ja 0x5bd0f2
das
outsb dx, byte [esi]
mov ch, 0x4e
xchg edx, eax
out dx, eax
and eax, 0xf9a6bf7f
cmpsd dword [esi], dword es:[edi]
mov ah, 0xc2
or al, 0xa4
stosd dword es:[edi], eax
cmpsd dword [esi], dword es:[edi]
int3
Function at 0x58145c
Capabilities:
Encode data using base64

Disassembly:
jae 0x6566b7
mov eax, 0x729c980c
call fcn.0059d3c6
jmp 0x6111dd
mov dword [esp], 0xe8273cb9
rol dword [esp], 0x6c
mov dword [esp], eax
jae 0x57f251
mov eax, 0xc29b4fb7
dec ecx
sub ebx, 2
movzx ecx, al
movsx ebp, al
inc ebp
movzx eax, word [ebx + ecx*2 - 0x16e]
movzx ebx, cx
inc bp
xor eax, edi
inc esp
movsx esi, bx
inc ecx
inc esi
mov edx, 0x1b069489
inc cx
not eax
inc cx
xor eax, 0xc2ff0f05
push ecx
inc eax
shr ch, 0x86
inc cx
sbb eax, 0x8481a780
or al, 0x49
invalid
Function at 0x5860d4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Manually build aes constants

Disassembly:
not cl
push edx
mov dword [esp + edx - 0x525eedfc], edx
add cl, 6
not cl
and dl, dh
inc dword [esp + edx - 0x525eedfc]
jae 0x5ea76d
xor bl, cl
imul edx, edx
lea ecx, [esp + ecx + 8]
rol dword [esp + 2], 0x3d
mov dword [ecx], eax
lea eax, [edx + edx*8 + 0x728cf3e]
adc byte [esp + 2], dl
or ax, word [esp]
sbb edi, 4
mul eax
mov eax, dword [edi + eax*2 - 0x66c9a608]
xor eax, ebx
movsx ecx, dx
not eax
or byte [esp + 2], 0x3f
xor edx, edx
adc ecx, edx
sbb eax, 0x999f528e
ror dword [esp + edx + 1], 0x99
setae cl
rol eax, cl
dec dword [esp + edx + 4]
dec eax
sar byte [esp + edx], cl
not eax
call fcn.00603b11

Function at 0x587f58
Capabilities:
Encode data using xor

Disassembly:
call fcn.005ddef1
mov eax, 0xf11eaa3b
movsx ecx, al
lea eax, [esp + ecx*2 - 0x1e]
lea edx, [ecx + ecx*4 - 0xbf14a69]
bt ecx, ecx
mov ecx, dword [eax + ecx*2 - 0x76]
movzx eax, dl
mov dword [esi + eax*2 - 0x180], ecx
mov ecx, dword [eax + edi - 0xc2]
mul dl
lea edi, [eax + edi - 0x8d08]
sal ax, 0xea
bswap eax
cmovbe edx, eax
xor ecx, ebx
sub ecx, 0xf8302d12
xor ecx, 0xc8bc428e
bts ax, dx
inc ecx
xor ecx, 0x2901e988
xor al, ah
imul edx, eax
imul dx, dx
rol ecx, 1
and dx, dx
cdq
dec ecx
sub edx, 0xd808ae9a
call fcn.006604d5
Function at 0x58c1df
Capabilities:
Encode data using base64

Disassembly:
lea edx, [ecx*2 - 0x1eeaf273]
imul cx, dx
xor eax, ebx
not cx
mov dword [esp + edx - 0x67228d9b], 0x58be560d
inc eax
push ecx
inc ecx
bswap eax
not cx
dec dx
dec eax
inc edx
not eax
bts dx, 0x8b
pop ecx
xor ebx, eax
lea ecx, [ecx - 0x377c42d0]
add ebp, eax
movzx eax, dl
shr word [esp + edx - 0x67228d99], 0x4f
sar dl, 0x25
mov dx, word [esi + eax - 0x9b]
mov ax, word [eax + esi - 0x99]
call fcn.0066563e
add ecx, eax
xor ecx, ecx
adc ecx, dword [edi + eax*2 - 0x14a42]
movzx edx, al
xor ecx, ebx
not eax
not ax
bswap eax
xor ecx, 0xd60d6d9b
add edx, edx
shl edx, 0xd8
not ax
dec ecx
xor ecx, 0xf03fd486
sub eax, 0xfb8e8ab0
lea edx, [edx + eax*4 - 0x4d7748c7]
neg ecx
not dx
add dx, dx
shr edx, 0xf3
xor ebx, ecx
btc edx, 0
inc dx
adc ebp, ecx
dec ax
push eax
setno dl
pop eax
jnp fcn.0059f19a
mov edx, dword [esi]
mov cl, byte [esi + 4]
mov eax, 0x98174e3a
ror eax, 0x58
div al
lea esi, [esi + eax - 0x174e685c]
add eax, eax
ja 0x63d3c7
mov ecx, 0x45a60f80
movsx edx, cl
mov ax, word [esi + ecx - 0x45a60f80]
lea ecx, [ecx + edx*2 + 0x66baf48e]
mov cx, word [esi + 2]
btc edx, edx
adc esi, 2
or edx, edx
call fcn.005a6368
dec ecx
not ecx
inc dword [esp + edx - 0x821d]
movzx eax, byte [esp + edi - 0x10]
jne 0x659c9d
sbb ax, 0x17af
mov byte es:[edx + eax - 0x2e9cb915], cl
mov edx, eax
lea edi, [edi + eax - 0x2e9cb919]
movsx ecx, al
bt dx, 0x98
neg dl
mov edx, dword [edi + eax - 0x2e9cb915]
xor edx, ebx
dec cl
and al, cl
ror cx, 0x24
bswap edx
shr cl, 0x41
neg edx
bswap edx
shl ecx, 0xf7
jp 0x55f017
inc ecx
movsx esi, cl
dec ebp
lea ebx, [ebx + esi*4 - 0xe0]
dec ecx
mov edi, dword [ebx + esi*2 - 0x6c]
dec eax
lea ebx, [esi + esi*4 + 0x2cbf8c82]
inc ecx
movsx ecx, cl
dec edx
lea ebp, [ebx + ecx*4 - 0x55effe65]
dec ecx
xor edi, edi
xchg si, cx
inc eax
add bl, ch
movzx edx, cl
dec eax
not edi
dec eax
dec edi
dec eax
neg edi
inc ecx
shl ecx, 0x3e
dec eax
lea edi, [edi + esi*2 - 0x61448fe5]
dec eax
neg edi
inc cx
shr ecx, 0x64
inc ecx
mov eax, 0x6618c301
call fcn.005ca89a
and al, dl
movzx edx, cl
not al
mov word [edx + esi - 0xa0], ax
lea edi, [edi + edx - 0xa4]
ror edx, 0x26
jb 0x5e4db3
call fcn.00642191

Function at 0x58c6d8
Capabilities:
Encode data using base64

Disassembly:
pushfd
pop dword [esp + 4]
push 0x17863f0a
mov dword [esp + 4], 0xd386f69a
or word [esp + 2], 0x939e
mov dword [esp + 0xc], ecx
mov dword [esp + 4], esi
mov esi, dword [esp]
pop esi
push esi
mov dword [esp], ecx
jno 0x58a301
not dl
Function at 0x58ca0b
Capabilities:
Encode data using base64

Disassembly:
dec esp
add esp, ecx
dec edx
mov dword [esp + eax - 0x2a240a0b], 0xbb8bf628
inc ebp
mov ebp, dword [ebp + ebp + 0x1295e1a6]
dec esi
lea esi, [eax*2 - 0x744d37fb]
xor edi, 0xd09c871d
inc esi
mov edx, dword [esp + eax - 0x2a240a07]
inc ecx
pop edx
ja fcn.00656530
mov ecx, dword [esi + 4]
mov edx, 0xf4bf8c9c
push edx
and eax, ecx
and dword [esp], edx
and dx, 0x348e
jg 0x58cc77
pop esi
xor al, al
sbb byte [ebx + 0xecd4fd6], dh
xchg esp, eax
invalid
not eax
mov dword [esi + 4], eax
mov edx, dword [edi - 4]
xor edx, ebx
dec edx
mov eax, 0x8123c79a
rol edx, 2
add eax, eax
inc edx
bswap edx
add edx, 0xe12e80ac
rol dword [esp + eax*8 - 0x123c79a0], 0xb2
movzx ecx, ax
ror edx, 1
xor cx, ax
add cl, 0x96
xor ebx, edx
ror eax, cl
sal eax, 0xb2
add ebp, edx
cwde
mov edx, 0x218668ab
mov edx, dword [edi + eax - 8]
lea edi, [edi + eax - 8]
sar al, 0x46
xor edx, ebx
not edx
push ecx
and dword [esp + eax*4 + 2], ecx
neg edx
add dword [esp + eax + 4], eax
sal dword [esp + eax + 2], 0xf
sar eax, 0xc
ror edx, 3
lea edx, [edx + eax*4 + 0x6c39c909]
shl ecx, cl
sar byte [esp + eax + 7], 0x25
xadd dword [esp + eax + 2], ecx
not edx
not eax
neg edx
push eax
xor ebx, edx
pop eax
shr ecx, 0x56
mov dword [esi + ecx*8], edx
push eax
not word [esp + ecx + 9]
inc eax
mov dword [esp + eax], ebp
ret 8

Function at 0x58fc5a
Capabilities:
Encode data using base64

Disassembly:
mov dword [edx + ecx], eax
movsx eax, dx
sar edx, 0x18
lea edi, [edx + edi - 4]
mov ecx, dword [edi + edx*2]
mov dword [esp + eax + 4], eax
adc al, byte [esp + edx + 7]
mov dword [esp + edx], edx
xor ecx, ebx
btc ax, 0x1e
jae 0x5fb2f0
mov ecx, dword [esp + esi*8 - 0x1d0]
dec eax
idiv ebp
dec esi
mov ecx, dword [esi + ebp - 0x3a]
call fcn.005d7fa0
not ecx
bt dx, dx
sar eax, 0xc1
sbb ecx, 0x999f528e
add dx, word [esp + edx*2 + 4]
or al, dh
rol ecx, 1
xchg dword [esp + edx], edx
dec ecx
push edx
not ecx
cbw
call fcn.006038ae
mov ebp, 0x3399a83a
dec ebp
lea ebx, [ebx + ebp*2 - 0x67335078]
inc eax
movzx esi, ch
inc esi
mov eax, dword [esi + ebx - 0x3a]
inc ebp
xor eax, edi
mov eax, 0xdba1bdac
inc esp
movzx esi, dh
inc ecx
rol eax, 2
xchg ebp, eax
movzx edx, ax
inc ebp
xor dh, dh
inc ecx
dec eax
inc ecx
movzx ebx, dh
inc ecx
rol eax, 3
inc ebp
lea eax, [eax + eax*4 + 0x92abcbf]
inc ecx
push edi
inc esp
xor dword [esp + esi*4 - 0xe8], eax
inc esp
movsx edx, al
rol al, 0x46
inc ecx
ror dl, 0x21
inc ecx
pop edi
push ebp
dec ebp
arpl ax, ax
mov edi, edx
dec ebp
sub esi, esi
dec ebp
adc esp, eax
jmp 0x5e90b1

Function at 0x595f5a
Capabilities:
Encode data using base64

Disassembly:
inc di
movzx ecx, byte [ebp + edx - 0x1700e97e]
inc ebp
mov dl, byte [ebp + ecx*4 - 0x5c034bfc]
dec edx
shr dword [esp + esi - 0xd2f1], 0xfa
inc ecx
not cl
inc ecx
not dl
dec eax
shl dword [esp + ecx - 0x1700d2f0], 0xfd
dec ebx
lea edx, [esi + eax*8 + 0x2484df17]
inc ebp
or cl, dl
dec esp
xor dword [esp + ecx*4 - 0x5c034bf6], eax
call fcn.00636f5e
Function at 0x59bec1
Capabilities:
Encode data using base64

Disassembly:
inc esp
xor dword [esp + ebx], ecx
sub si, 0x8b25
dec esp
xchg esi, eax
movsx ecx, si
inc ecx
pop edi
inc eax
movzx ebx, dh
dec eax
sub ecx, 0x1d12ed20
sete cl
inc ecx
bswap ecx
dec eax
cdq
inc eax
dec bh
inc ecx
or ch, dh
inc ecx
push edi
inc ecx
and eax, 0x3ebf5103
dec eax
btc edx, ebp
inc esi
xor dword [esp + eax - 0x1100], ecx
cbw
dec eax
cdq
inc ecx
pop edi
inc ebp
xchg eax, edx
imul bx, ax
bswap edx
dec ebp
arpl cx, cx
dec esi
lea eax, [ebx + edx - 0x666778d7]
rol cl, 0x64
cwde
dec ebp
adc esp, ecx
xchg di, ax
dec edx
mov esi, dword [ecx + ebp - 0x2b014800]
inc ecx
ror dh, 0x44
inc ebp
movzx ecx, al
inc esp
xor edx, edi
dec esi
mov dword [esp + eax*4 - 0x119cc], edi
inc esi
xor dword [esp + eax - 0x4673], edx
dec eax
lea ecx, [eax + ebx*8 + 0x1d204206]
inc ecx
mov edi, 0x202c2e16
inc ecx
pop edi
dec ebp
arpl dx, dx
inc ecx
or ebx, esi
inc cx
mul eax
dec ebp
add esp, edx
inc ecx
push ecx
inc edx
mul byte [esp + eax*2 - 0x8ce1]
inc edx
movsx ebp, word [esp + eax - 0x4671]
dec edi
lea ebx, [ebx + eax - 0x467b]
jo 0x61ea75
dec edx
neg dword [esp + eax*4 - 0x119cc]
dec esi
cmovs esi, dword [esp + eax*2 - 0x8ce6]
dec ebx
mov ebx, dword [eax + ebx - 0x4673]
dec ecx
xor ebx, edi
not ecx
inc ecx
bt esi, 9
dec eax
not ebx
call fcn.00623d7e
inc cx
movzx ebp, byte [ebp]
inc esp
movzx ecx, bx
call fcn.006340e7
dec ecx
sub ebx, 4
mov ebx, 0x6da4722a
inc esp
movzx esi, bl
neg bx
inc edi
mov ecx, dword [esi + ebx - 0x2a]
inc esp
movsx edx, bl
dec edx
lea eax, [edx*4 - 0x766861cc]
inc ebp
xor ecx, edi
dec eax
cdq
inc sp
sub edx, ebx
movsx esi, al
inc ecx
neg ecx
inc esp
sub dl, dl
inc ecx
dec ecx
dec edx
lea eax, [eax + edx*4 - 0x235a5e7c]
mov edi, 0xbfbd6a04
dec esi
lea esi, [edi + edx + 0x302e452d]
inc ecx
ror ecx, 1
dec eax
lea ebp, [edx + ebx*8 + 0x5a8fd021]
dec eax
idiv edi
mul bl
inc ecx
xor ecx, 0xacb15011
dec esp
lea esi, [eax + eax + 0x1c8708bb]
shl dl, 0x65
jbe 0x638a34
inc ecx
mov ebx, 0xe0016229
dec ecx
mov esp, ebp
pop esi
dec edx
lea ebx, [ebx*8 - 0x44ec9de9]
pop edi
pop ebx
dec ebx
lea edx, [ebx + ebx*4 - 0x48d11ff3]
inc ebp
mov edi, ebx
dec ecx
dec edi
pop ecx
inc ecx
pop esp
inc ecx
mov edx, 0xd62ab194
inc ebp
mov ecx, ebx
inc ecx
pop ebx
inc ebp
movzx esi, cx
jo 0x58b42e
call fcn.005f6067
inc ecx
neg ecx
inc cx
rol esi, 0xae
cdq
inc ecx
push edi
xadd edx, ebx
inc ecx
mov eax, 0x19aa9223
jnp 0x581a95
Function at 0x59ccef
Capabilities:
Encode data using base64

Disassembly:
inc ecx
and ecx, 0xab2edd88
dec esi
mov edi, dword [esp + ecx - 0x9170]
inc ecx
push ecx
jp 0x5aee0a
dec edx
mov dword [esp + ecx*4 - 0x245f8], 0xddb8c022
dec ebp
arpl dx, dx
dec ebx
lea edx, [esi + ecx*8 + 0x4e907e09]
dec eax
shr eax, 2
dec ebp
adc esp, edx
dec edx
lea esi, [edx + esi*8 + 0x2301430a]
inc esi
and dword [esp + ecx - 0x917e], ecx
dec edi
mov esi, dword [ebp + ecx - 0x9188]
inc esp
mov edx, ebx
inc ebx
mov eax, dword [esi + ecx*4 - 0x24600]
dec esi
lea esi, [edx*2 - 0x3a7e6b58]
xor di, 0xf6ae
inc ebx
mov dword [ebp + ecx - 0x9184], eax
inc cx
dec esi
dec edi
lea ebp, [ebp + ecx*4 - 0x24604]
dec edx
lea ecx, [esi*8 + 0x6f0ce281]
inc ecx
pop eax
pop edx
pop ecx
pop esi
jnp fcn.00656530

Function at 0x5a43c8
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov edi, dword [esp + eax - 0x2007cb7]
dec ebp
arpl dx, dx
inc eax
movsx edx, bh
dec eax
mov dword [esp + eax - 0x2007cc7], edi
dec ebp
add esp, edx
dec esp
add esi, dword [esp + eax*2 - 0x400f98c]
inc ecx
dec al
dec eax
bswap edi
dec ecx
mov eax, dword [ebp + eax*2 - 0x400f98e]
inc ecx
mov cl, byte [ebp + ebx*8 - 0x1c0]
not byte [esp + ebx*2 - 0x72]
dec esi
lea ebp, [ebx + ebp - 0x37]
dec eax
mov dword [esp + ebx*2 - 0x62], 0xd6a89e8b
inc ebp
movsx ecx, al
dec ecx
sar eax, 0xf6
dec eax
shl eax, cl
dec ebx
mov dword [ebp + eax*8], eax
call fcn.00588a20
Function at 0x5a7ffc
Capabilities:
Encode data using xor

Disassembly:
push eax
and cx, cx
rol dl, 1
sal eax, 0xef
dec dl
not dl
xor dl, 0xb3
xor eax, ecx
neg al
neg dl
inc eax
not dl
cbw
xor bl, dl
mov dword [esp + 4], ecx
lea eax, [ecx - 0x5a70f44c]
sub dword [esp + 4], eax
lea edx, [esp + edx + 8]
cwde
mov eax, dword [edx]
xor dword [esp + 4], ecx
mov dword [esi - 8], eax
movzx edx, byte [esp + 4]
movsx eax, dl
mov eax, dword [edi + edx*2 - 0xa1]
lea edi, [edi + edx - 0x55]
or cl, dl
sal ecx, 0x1d
xor eax, ebx
xor eax, 0x43257214
call fcn.0058f681
sbb esp, dword [eax]
inc ebx
dec edi
jge 0x5a802b
jne 0x5a80a3
dec esp
arpl word [edi - 0x2a], sp
inc edi
insb byte es:[edi], dx
dec esp
arpl word [edi + 0xe], sp
adc al, 0x38
dec esp
arpl word [edi + 0x6e], sp
rcr byte [esp + eax*8 + 0x29], 1
mov bl, 0x31
ret
enter 0xffffffffffff814a, 0xffffffffffffffa4
hlt

Function at 0x5aafba
Capabilities:
Encode data using base64

Disassembly:
dec ebx
push 0x710ed52d
lea esp, [esp + 8]
jne 0x5bef8e

Function at 0x5ab21c
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ebp - 0x54500b61], eax
dec ebp
arpl ax, ax
dec ebp
adc esp, eax
call fcn.005e783b
cmp ebx, edi
clc

Function at 0x5b898e
Capabilities:
Encode data using base64

Disassembly:
dec ebp
mov eax, dword [ebp + edi - 0x1ffc]
movsx ecx, dx
dec esi
lea ebp, [edx + ebp - 0x6d318284]
dec eax
lea eax, [esp + edi - 0x1ffc]
dec eax
and edi, esi
inc eax
movzx ebp, dh
inc esp
movzx edx, di
dec esp
mov dword [eax + edx - 0x6d318294], eax
call fcn.005b06dc

Function at 0x5b8a78
Capabilities:
Encode data using base64

Disassembly:
inc ecx
push esi
push ecx
push ebx
push edi
inc ecx
setae cl
cwde
push esi
inc eax
sar ch, 0xa5
xor edx, 0xe00012b5
dec eax
rol eax, 0xdf
inc esi
mov ebx, dword [esp + edx - 0x3e8c9c0e]
neg ebp
inc ecx
push edx
inc esp
adc ebx, eax
movsx edi, al
dec eax
cdq
bt ax, di
inc ecx
rol ebx, 2
inc ecx
xor ebx, 0xf6a73933
inc ecx
movzx ebx, cx
inc ecx
inc ebx
inc edx
dec byte [esp + edx - 0x3e8c9c87]
dec ebp
add ebx, esi
inc ecx
or dl, dl
dec esp
mov dword [esp + eax*2 - 0x7d19ff1c], esp
jb 0x585c4d
mov eax, 0x5c06a69e
shl ax, 0x26
mov eax, dword [esi + eax - 0x5c06a780]
mov edx, 0xcd395c8e
adc esi, 3
call fcn.00586e9d
inc esi
mov eax, dword [esi + ebp - 0xc4efb0e]
mov ebx, 0xe3b19c0a
btr ax, ax
dec ecx
cmovae edi, edx
inc ecx
mov eax, dword [ebp + esi*2 - 0x189df610]
inc ecx
not eax
inc cx
adc edx, 0x816691b6
fnstenv [0x66d0f748]
adc ecx, ebp
mov dh, 0x91
sbb cx, 0x4835
not eax
adc cx, bp
ja 0x629da9
inc esp
jge 0x5b8aca
mov bh, byte [edi]
iretd
inc ecx
adc dh, dl
inc esp
and eax, eax
dec edx
lea edx, [ebp + edx*8 - 0x5ded397c]
inc esi
mov dword [esi + ebp - 0xc4efbc0], eax
dec eax
sal ebx, cl
dec ebp
lea ebp, [ebp + esi*8 - 0x6277dde4]
btc bp, 0x3c
inc ebp
sbb edx, ecx
inc eax
inc ch
jns fcn.00656530

Function at 0x5ba0cb
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x4ac5a4a
call fcn.005b091a
inc eax
sar ch, 0xc5
dec esi
mov dword [esp + edx - 0x3720346a], edi
btr cx, bp
dec ebp
lea eax, [eax + ebx*8 - 0x786aad47]
call fcn.005d76bd
Function at 0x5bd851
Capabilities:
Encode data using base64

Disassembly:
not dword [esp]
shr dword [esp], 0x7c
adc esi, 4
jmp 0x58a291
xor ecx, eax
mov dword [esp + eax*4 - 0x74e72ed0], eax
lea edx, [edx + ecx*2 - 0x46d242cd]
not edx
and cx, ax
neg edx
ror edx, 1
sar eax, cl
lea ecx, [eax*2 - 0x7d7bb0db]
add cx, 0xcfb2
bswap edx
cwde
neg edx
rol eax, cl
xor ebx, edx
xor ecx, 0x2e2ae1b5
adc ebp, edx
movzx edx, ax
cwde
mov ax, word [eax + esi - 0x7fff]
rol cx, 0xc9
xchg dword [esp + edx*2 - 0xfffe], ecx
mov dx, word [ecx + esi - 0x1d39cbb2]
inc cl
adc cl, 0x17
mov cl, byte [esi + ecx*2 - 0x3a739796]
ja 0x58ed52
lea eax, [eax - 0xef848cf]
add ebp, edx
rol al, 0xa5
jae 0x61e197
xor dword [esp + 7], 0xa99dc72d
pop eax
pop ecx
pop eax
pop ecx
jno fcn.0059f19a
dec ecx
sub ebx, 4
inc ecx
mov edx, 0x1318020
inc ebp
movzx esi, dx
inc ebx
mov ebp, dword [ebx + edx*8 - 0x98c0100]
inc ecx
mov esi, edx
inc ecx
xor ebp, edi
rol ebp, 1
inc esp
movzx eax, si
inc ecx
movsx edx, dh
sal esi, 0x72
neg ebp
inc ebp
movsx ecx, dh
inc ecx
movsx edi, cx
not di
dec ebp
call fcn.005e6a29
jmp 0x5fce76