joyce8/EMBER2024-capa huggingface dataset:
Function at 0x120318f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov esi, 0xd0349b1e
movzx esi, byte [edx]
push 0xc412dfa5
ror dword [esp], 0xd4
push 0x10aa9203
xor esi, ecx
and esi, 0xff
shr dword [esp + 3], 0x9a
call fcn.012ecbfa
adc ebp, eax
shr ecx, 0xb8
btr edx, 0x29
and cx, cx
mov esi, dword [esi + ecx]
pop eax
jno fcn.0130cff3
mov dword [edi], edx
sbb ebp, 3
rol word [esp + 2], 0x8d
mov ecx, dword [esp]
movsx eax, byte [esp + ecx*2 - 0x20000000]
mov ecx, dword [ebp + ecx - 0x10000000]
jae 0x14be39f
sal dword [esp + 0xc], 0x84
inc edx
shr word [esp + 0xa], 0xc2
xor ecx, 0x4d1959be
dec eax
push 0x7c809f06
lea esp, [esp + 0x14]
jne 0x118ccb4
pop esi
mov edx, 0x43a78fa1
not ecx
call fcn.00cd853d
jmp 0xc35b6d3c
mov ecx, dword [esi + eax - 0x205da0]
lea edx, [eax + eax*4 - 0x30f20466]
lea esi, [eax + esi - 0x205d9c]
shl eax, 0x48
call fcn.00cb63e5
cli
or al, 0x9d
nop
lodsb al, byte [esi]
mov ebx, 0x4fd136cf
sub byte [ebp - 0x5ddbab0e], bh
inc ebp
mov ebp, dword [eax]
call fcn.00d4e383
jb 0x15b0a92
mov edx, 0x2535471a
xor ecx, ebx
or ax, word [esp + eax*2 + 1]
imul word [esp + eax*2]
dec al
dec ecx
not dword [esp + eax - 0xff]
call fcn.00ceab3e
jp 0x14be352
scasb al, byte es:[edi]
jle 0x14be3d0
and dh, dh
sbb ebp, dword [esi]
sahf
neg byte [ebx]
sahf
pop eax
push esi
push 0xffffffffffffffe8
add dword [edx - 0x1f], ecx
adc byte [edx], dl
add word [ecx - 0x483be6bb], si
sar byte [esi + 0x7b8f79ec], 1
jb 0x14be3ca
in eax, 0xaf
inc ebx
ret 0xd15
mov edi, dword [edi*4 + 0x1254084]
neg dword [esp + 1]
shr dword [esp + 1], 0xa9

Function at 0x12031cc
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov esi, 0xd0349b1e
movzx esi, byte [edx]
push 0xc412dfa5
ror dword [esp], 0xd4
push 0x10aa9203
xor esi, ecx
and esi, 0xff
shr dword [esp + 3], 0x9a
call fcn.012ecbfa
adc ebp, eax
shr ecx, 0xb8
btr edx, 0x29
and cx, cx
mov esi, dword [esi + ecx]
pop eax
jno fcn.0130cff3
mov dword [edi], edx
sbb ebp, 3
rol word [esp + 2], 0x8d
mov ecx, dword [esp]
movsx eax, byte [esp + ecx*2 - 0x20000000]
mov ecx, dword [ebp + ecx - 0x10000000]
jae 0x14be39f
sal dword [esp + 0xc], 0x84
inc edx
shr word [esp + 0xa], 0xc2
xor ecx, 0x4d1959be
dec eax
push 0x7c809f06
lea esp, [esp + 0x14]
jne 0x118ccb4
pop esi
mov edx, 0x43a78fa1
not ecx
call fcn.00cd853d
jmp 0xc35b6d3c
mov ecx, dword [esi + eax - 0x205da0]
lea edx, [eax + eax*4 - 0x30f20466]
lea esi, [eax + esi - 0x205d9c]
shl eax, 0x48
call fcn.00cb63e5
cli
or al, 0x9d
nop
lodsb al, byte [esi]
mov ebx, 0x4fd136cf
sub byte [ebp - 0x5ddbab0e], bh
inc ebp
mov ebp, dword [eax]
call fcn.00d4e383
jb 0x15b0a92
mov edx, 0x2535471a
xor ecx, ebx
or ax, word [esp + eax*2 + 1]
imul word [esp + eax*2]
dec al
dec ecx
not dword [esp + eax - 0xff]
call fcn.00ceab3e
jp 0x14be352
scasb al, byte es:[edi]
jle 0x14be3d0
and dh, dh
sbb ebp, dword [esi]
sahf
neg byte [ebx]
sahf
pop eax
push esi
push 0xffffffffffffffe8
add dword [edx - 0x1f], ecx
adc byte [edx], dl
add word [ecx - 0x483be6bb], si
sar byte [esi + 0x7b8f79ec], 1
jb 0x14be3ca
in eax, 0xaf
inc ebx
ret 0xd15
mov edi, dword [edi*4 + 0x1254084]
neg dword [esp + 1]
shr dword [esp + 1], 0xa9
Function at 0x120a03b
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
call eax
mov edx, 0x1b2ecae
mov ebx, 0xf70ac0a3
btc dx, bx
mov ebp, dword [ebp + edx*8 - 0xd976534]
dec edx
lea edi, [edx + edx*2 + 0x50afd537]
sbb dl, 0x86
mov dword [ebp + edx - 0x1b2ec1e], eax
xchg ebx, edi
mov edi, ebp
jns 0xcfe5b2
mov eax, 0x7f01f90a
lea ebp, [ebp + eax - 0x7f01f90e]
movzx ecx, ax
mov eax, dword [eax + ebp - 0x7f01f90a]
xor eax, ebx
call fcn.0130f499
rcl dword [edi], cl
cwde
sahf
mov byte [0xc401d8ad], al
dec eax
or esp, dword [eax + 0x44c79c9e]
and al, 0
outsb dx, byte [esi]
cmc
invalid

Function at 0x120fd2c
Capabilities:
Encode data using base64

Disassembly:
sar dword [esp], 0xac
mov dword [ebp - 4], eax
dec dword [esp]
call int.011e4e85
mov ecx, dword [edx + ebp - 0x2652c44]
lea eax, [edx + edx*8 - 0x3ccf1757]
bt eax, edx
jb 0x11de2e8
xor ecx, ebx
or ax, ax
xadd dword [esp + edx*4 - 0x994b10c], eax
not ecx
add edx, dword [esp + eax - 0x526fd1f]
dec ecx
bswap ecx
push eax
xchg dword [esp + eax - 0x526fd18], edx
sub dx, ax
rol ecx, 1
inc ecx
sar dword [esp + eax - 0x526fd19], 0x30
lea eax, [eax + edx*8 - 0x4cf31ccb]
mov byte [esp + 0xb], 0xa2
xor ebx, ecx
add esi, ecx
rol ax, 0x4e
bswap edx
mov dword [esp + edx - 0x582f74da], edx
pop ecx
pop ecx
pop edx
pop eax
jb fcn.00cb9d91
mov dword [esp], 0x929af788
sub dword [esp], 0xd19a1b86
add eax, edx
or byte [esp + 1], 0xa4
jae 0xc7a074
or eax, dword [ebp + eax]
rol dword [esp + edx*4 - 0x9383010], cl
bts ecx, edx
lea ecx, [ecx + edx*8 - 0x4df6be5]
xor eax, ebx
or byte [esp + edx*4 - 0x938300e], dh
sbb edx, dword [esp + edx*4 - 0x9383010]
rol eax, 2
neg eax
lea eax, [eax + edx + 0x44c896c7]
rol dx, 0x61
sub byte [esp + 1], 0xe
not eax
push ecx
xor ebx, eax
and dword [esp + 4], ecx
adc esi, eax
bswap edx
shr dword [esp + 1], 0x27
pop eax
pop eax
ja fcn.011b0a0e
sub edi, 4
mov eax, 0x61222901
add al, ah
lea ecx, [eax*4 + 0xaa22d97]
mov eax, dword [edi + eax - 0x6122292a]
movzx edx, cx
xor eax, ebx
imul dx, dx
bts cx, 0x3b
inc eax
neg eax
inc eax
dec dl
add edx, ecx
xor ecx, 0xf4b94fb8
xor eax, 0x5d8ccb8e
or edx, ecx
rol eax, 3
xor ebx, eax
add esi, eax
mov eax, dword [ebp + ecx - 0x7b939587]
neg cl
and dl, 0x39
mov dx, word [ebp + ecx - 0x7b939575]
btr cx, cx
ror ecx, 0x73
lea ebp, [ecx + ebp - 0x72af2f6c]
bswap ecx
sub cl, cl
mov word [ecx + eax - 0x722faf00], dx
jmp esi

Function at 0x1210616
Capabilities:
Encode data using xor

Disassembly:
adc ebp, 2
shr ax, cl
sar dl, 0x23
mov ecx, edx
mov word [ebp], ax
lea edx, [ecx + ecx*2 + 0xa0a16ab]
mov eax, dword [esi + edx*8 - 0x50509e30]
pop ecx
lea ecx, [edx + edx*4 + 0x71a03fb7]
lea ecx, [ecx*4 - 0x3ec54e69]
lea esi, [esi + edx - 0xa0a13c2]
inc ecx
bswap ecx
xor eax, ebx
and dx, cx
sbb cl, 0x82
not eax
jg 0x11d78e3
Function at 0x1221944
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [ebp], eax
movsx eax, cl
movsx edx, ax
pop ecx
pop eax
jne fcn.015b062f
mov edx, dword [esp + 4]
mov dword [edi + 4], eax
pop eax
pop eax
jmp esi
xor dl, bl
bt ecx, ecx
push ecx
inc dl
ror dl, 1
xor cx, word [esp + eax - 0x2e12]
neg dl
btc ax, cx
inc ecx
or eax, 0xa69981a3
adc dl, cl
bts ax, ax
rol ecx, 0xf1
xor bl, dl
mov dword [esp + ecx - 0x1fffc], eax
xor ecx, 0x4838f997
lea edx, [esp + edx + 8]
inc ax
xadd al, ah
mov eax, dword [ecx + edx - 0x483af997]
sbb cx, cx
lea ebp, [ebp + ecx - 0x483b0003]
lea ecx, [ecx*8 + 0x608bed3b]
jg 0x132ef9f
jb 0x11d185a

Function at 0x1223a51
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx + edx*8 + 0xe282932]
bswap eax
mov dword [esp + ecx - 0xde5f], edx
inc eax
rol eax, 1
xor ebx, eax
xor dword [esp + ecx - 0xde5b], edx
or ecx, dword [esp + ecx - 0xde5b]
je 0x12367d7
adc esi, eax
pop eax
pop ecx
jmp esi
pop edx
pop ecx
pop edx
jns fcn.0117f4d6
mov ecx, 0x1a28692d
mov eax, dword [ecx + ebp - 0x1a28692d]
mov edx, ecx
mov cl, byte [ebp + ecx*2 - 0x3450d256]
lea edx, [edx + edx + 0x288e4db0]
call fcn.00d313b4

Function at 0x1232953
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
add eax, dword [eax + esi]
lea esi, [ecx + esi - 0x76fe7dc3]
sub cl, byte [esp + ecx - 0x76fe7dc5]
sar dword [esp + ecx - 0x76fe7dc9], 0x1c
lea edx, [ecx + ecx*8 - 0x1e79457b]
xor eax, ebx
bswap eax
sub byte [esp + ecx - 0x76fe7dc9], 0x26
call fcn.01162b84
mov ecx, dword [esp + eax*2]
mov word [eax + ebp], dx
jno 0x1189545
pop edx
shl word [esp + eax - 0x46c0f804], 0xa1
not cl
shl word [esp + eax - 0x46c0f803], 0x24
xor cl, 0x10
shr dword [esp + eax - 0x46c0f804], 0xb8
mov edx, 0x8901823e
sbb dx, word [esp + eax - 0x46c0f803]
inc cl
sub dword [esp + eax - 0x46c0f804], edx
sub dl, 0x26
xor bl, cl
btc dx, 8
lea ecx, [esp + ecx + 4]
sub eax, eax
movzx dx, byte [ecx + eax*2]
lea ebp, [ebp + eax - 2]
jns 0x12239b1
Function at 0x1237746
Capabilities:
Encode data using base64

Disassembly:
or edx, 0xd9816c9f
xchg esi, eax
xchg ebx, eax
cwde
push eax
not al
lea edx, [edx + eax*8 + 0x3e9b8837]
neg ecx
xor eax, edx
xor ebx, ecx
sub dl, dl
not al
adc esi, ecx
jmp 0x15ba143
sar word [esp + 0xa], 0xe4
dec eax
push 0xff1400a8
lea esp, [esp + 0x18]
jne 0x130ee96
mov edx, 0xb7a8a522
pop edi
mov edx, 0x4937c1aa
sub edx, 0x2b8319ad
not ecx
mov dword [edi + edx*4 - 0x76d29ff4], ecx
lea eax, [edx + edx*2 - 0xfd364c8]
ja 0x12262a3
in al, dx
js 0xd54d29
pop ss
fsub qword [ebx - 0x43]
dec dword [ebx - 0x65]
pop ebx
retf
not dword [esp + edx*2 - 0x3b694ffa]
lea eax, [edx + eax + 0x28598c21]
bts ecx, 0x3d
dec dx
ror eax, 3
bswap eax
inc eax
call fcn.015ba17a
lea ecx, [eax*2 + 0x37b41195]
lea ebp, [edx + ebp - 0x1db4a801]
bswap ecx
sub ecx, 0xa49369bc
setbe al
mov eax, dword [edx + ebp - 0x1db4a7fd]
and ecx, ecx
push ecx
jae 0x14d26e0
inc edx
xor ecx, 0x51339d27
jmp 0xd54d52
movzx edi, byte [edx]
call fcn.00cf8eaf
xor eax, ebx
neg eax
shr dword [esp + ecx - 0x6437a137], 0x2c
adc ecx, ecx
adc cx, word [esp]
dec eax
sal word [esp + 2], cl
xor eax, ebx
jmp 0x11b917c
lea ecx, [edx*4 - 0x19402cd9]
call fcn.0124d2ac

Function at 0x1238d1b
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
dec word [esp + 0xe]
mov dword [ebp], edx
lea ebx, [ecx + ecx - 0x68db40fc]
mov ebx, dword [esp + 0x10]
push ecx
movzx edx, cl
pop eax
pop eax
pop eax
pop edx
pop ecx
pop eax
ja fcn.015a46db
sub edi, 4
mov edx, dword [edi]
ror cl, 0xa7
call fcn.01327561
shl cl, 0x46
lea esi, [edx + esi - 0xa81a]
neg ecx
and ecx, 0xfea37406
mov dword [esp + ecx*4 - 0x95000], edx
xor eax, ebx
lea ecx, [edx + ecx*4 + 0x5e292306]
xor eax, 0xba2bc822
inc eax
dec dx
not eax
mov dword [esp + edx*2 - 0x15032], 0xe19f1699
push edx
lea eax, [eax + ecx - 0x60dfe8e1]
sar word [esp + edx*4 - 0x2a068], cl
xor ebx, eax
xor dword [esp + edx - 0xa819], 0xb99673a7
dec dword [esp + edx*2 - 0x1503a]
lea edx, [ecx*2 - 0x5f446e9]
adc edi, eax
mov eax, dword [ebp + ecx - 0x5e331b24]
sal cx, cl
mov ecx, dword [ebp + ecx - 0x5e33b23c]
mov dword [esp + 0xc], ebx
push edx
adc word [esp + 8], dx
movsx ebx, word [esp + 8]
cpuid
mov dword [esp + 0xc], 0xcb9d9e93
add dword [esp + 1], 0xf2042209
sbb ebp, 7
inc word [esp + 9]
mov dword [ebp + 0xc], eax
rol dword [esp + 6], 0x74
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ecx
mov ecx, 0xa69ef083
jp 0xd2fb66
mov ecx, 0xd39acc35
jmp 0xd7a90e

Function at 0x1241abf
Capabilities:
Check for software breakpoints

Disassembly:
or eax, eax
rol bl, 0x13
jmp 0x2addfdaf
call fcn.00d67f5e
jb 0x1241ab0
leave
aam 0xbb
out 0x7c, eax
loope 0x1241a7b
push es
push ds
invalid
Function at 0x1242429
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
ror dl, 1
mov dword [esp], eax
pop eax
xor bl, dl
xchg dword [esp + 0xc], eax
push eax
mov dword [esp + eax - 0x7110310e], ebp
mov dword [esp + eax - 0x71103112], esi
pop ebp
ror ax, 0xe8
mov dword [esp + eax - 0x71101e2d], ebx
mov ebp, edi
mov ebx, edx
mov word [esp + eax - 0x71101e30], ax
lea edx, [eax + eax*8 - 0x53e1c6d7]
inc word [esp + eax - 0x71101e30]
mov edx, ebx
jne 0xc9d38c
jmp 0x12e0a17
mov ecx, 0x113f242c
btc ecx, ecx
mov eax, dword [esi + ecx*2 - 0x227e6858]
not cl
movzx edx, cl
lea ecx, [ecx*8 + 0x2cb0aaaa]
mov edx, dword fs:[eax + edx*4 - 0x34c]
movzx eax, cl
btr ecx, eax
add ecx, 0x713a41b6
mov dword [esi + eax*2 - 0x84], edx
neg eax
lea edi, [ecx + edi - 0x27e492fc]
mov eax, dword [ecx + edi - 0x27e492f8]
movzx edx, cx
xor eax, ebx
neg eax
inc eax
call fcn.011c4e1a
clc
test sp, 0xefa8

Function at 0x1247647
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec ecx
cmp edi, edi
call fcn.011f0c9d
js 0x1226f4a
dec esp
mov ebp, dword [edi]
inc ecx
mov edx, 0x58b2439b
inc bp
bt edx, edx
inc ecx
movzx ebp, dx
inc ecx
mov cl, byte [edx + edi - 0x58b24393]
dec eax
lea edi, [edi + ebp - 0x4399]
dec ecx
sal ebp, cl
dec esi
mov dword [edi + edx - 0x58b2439b], ebp
inc ebp
movzx esi, dx
dec esi
lea esp, [ebp + edx*2 - 0x7473ebda]
dec ebp
lea edi, [esi + 0x430b29b5]
inc ebp
mov ebp, dword [eax + ebp*2 - 0x8736]
inc ecx
rol esi, 0xf3
neg ebp
dec edi
lea eax, [eax + esi - 0x1cd7fffe]
inc ecx
sal esi, 0x70
inc cx
sal esp, 1
inc ebp
xor ebp, ecx
inc ecx
dec ebp
inc ecx
ror ebp, 2
inc ecx
movzx esi, si
inc ecx
movsx ecx, dl
dec eax
and ecx, ecx
inc ecx
bswap ebp
jle 0x12c7318
dec ebx
lea esi, [esi + edi - 0x287eec58]
inc ecx
and esi, 0x9232ee84
inc ecx
rol ebp, 1
dec edx
lea edx, [esi*2 - 0x3c642fe0]
inc cx
sar edi, 0x2d
inc ebp
lea ebp, [ebp + edx*4 - 0x2549b6]
mov eax, 0xa705b13c
inc ecx
not ebp
inc cx
sbb esi, 0x4166a6af
sub edx, 0x51414f36
idiv si
inc esp
movsx ecx, bp
neg cl
inc esi
xor dword [esp + esi - 0x25951], ebp
inc sp
and edi, eax
inc ebp
bts edi, esp
inc ecx
pop ecx
dec esi
lea ebx, [esi*2 - 0x42ccd15c]
dec eax
cdq
dec ebp
arpl bp, bp
dec ecx
adc ebx, ebp
cwd
dec eax
add edx, ebx
jmp edx
inc ecx
movsx edx, bx
inc cx
neg ebp
inc bp
xor ecx, ebp
dec esp
add ebp, esp
and dx, dx
dec esp
lea edi, [ecx*8 + 0x10fa73c]
inc ebx
mov byte [ebp + esi*4 - 0x1264], dh
inc ecx
mov ebp, 0xe39f7328
xadd cl, dh
inc ebx
mov esi, dword [esi + eax - 0x499]
jge 0xd55e75
mov ecx, 0x7f39aeb3
movzx eax, cl
mul cl
mov ecx, dword [ecx + ebp - 0x7f39aeb3]
mov eax, dword [ebp + eax*2 - 0xfa4e]
jo 0xd40f2c
sar cl, 0x85
add ecx, ecx
lea edx, [edx + ecx*2 - 0x66e23e76]
neg ecx
lea eax, [ecx + ecx*4 - 0x7df014e2]
not edx
seta al
btc eax, 0x2d
inc edx
lea ecx, [ecx*4 + 0x250d86b2]
ror eax, cl
push eax
not edx
ror dword [esp + ecx - 0x58ec16aa], cl
and cx, ax

Function at 0x12515a4
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sar word [esp + 0xc], 0x2f
xor ebx, eax
add esi, eax
call fcn.011d76cb
bswap eax
ror eax, 2
jmp 0xd8f1e8
Function at 0x1254511
Capabilities:
Execute syscall

Disassembly:
shld eax, edx, cl
mov ecx, dword [esp + 4]
mov edx, 0x4f9257b1
mov dword [esi + edx - 0x4f9257b1], eax
call fcn.01324e39
sysenter
push edi
pushfd
mov dword [esp + 4], 0xc553c36e
lea esp, [esp + 4]
call fcn.00c93538

Function at 0x12668bc
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xchg dh, dl
sub ecx, 0xf499d993
and dx, 0xcbbc
lea edx, [edx + edx*8 - 0x25ca22e5]
rol ecx, 3
add eax, edx
sbb ax, ax
not ecx
mul ax
btc edx, eax
neg dl
xor ebx, ecx
cwde
imul al
adc edi, ecx
mov ecx, eax
or eax, edi
jmp eax
mov eax, dword [ebp + ebx*4]
jmp 0x14be1fd
mov dword [esp], eax
push 0xfa2adf0b
dec ebx
not word [esp]
push 0x29050dbf
lea esp, [esp + 8]
jne 0x11394fc
mov eax, dword [ebp]
call eax
mov edx, 0x989bc22
movzx ebx, dx
mov ebp, dword [ebp + edx*8 - 0x4c4de114]
lea edi, [edx + ebx*4 - 0x1ecc15f9]
mov dword [ebp + edx*2 - 0x13137844], eax
xchg edx, ebx
mov ecx, ebx
inc ebx
mov esi, ebp
movzx eax, cl
sar bx, cl
pop ebx
pop edi
rol cx, 0xb
ror edx, cl
pop ebp
sbb dl, al
shr cx, cl
lea ebp, [ebp + edx*8 - 0x2f77c]
imul dl
sal ecx, 0x9d
sets al
or ecx, dword [ebp + edx - 0x5eef]
or edx, 0x5f0b8098
sete dl
xor ecx, ebx
dec dx
add eax, eax
inc eax
xor ecx, 0xe1ae9d99
dec dl
js 0xd3d11e

Function at 0x1267531
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov eax, 0x97998510
mov eax, dword [ebp]
call 0xcebdde
jo 0x11d3244
add eax, edx
mov dword [esp], 0xa384792c
rol word [esp + 2], 0x83
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x14ba078
not dword [esp]
lea esp, [esp + 4]
je 0xd6f3e6
push 0xd229281f
mov eax, 0x6b30fe2f
mov eax, dword [ebp + ebx*4]
call fcn.00cccbd0
clc
jmp 0x12cb66b
Function at 0x127b4e7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
adc esi, ecx
mov dword [esp + eax - 0x278], 0x39952cae
mov ecx, dword [esp + eax*2 - 0x4f0]
lea edi, [edi + ecx*2 - 0x732a595e]
or byte [esp + eax - 0x277], al
mov dword [esp + eax*8 - 0x13c0], ecx
mul dl
mov ax, word [edi + eax*2 - 0x8430]
or dword [esp + ecx*2 - 0x732a595c], 0xea2bea11
xor ax, bx
inc ax
jmp 0x14cee7a
inc ax
xor ecx, edx
neg dword [esp + 1]
neg word [esp + 4]
xor ax, 0x6981
call fcn.011f6397
mov dword [esp], 0x3ac6a834
call fcn.01325ea3
xor bh, bl
or byte [ebp - 0x77], ch
mov esi, 0xda86307e
push ebx
dec esp
pop edx
jbe 0x12d7021
dec esp
invalid
pushfd
in al, 0x30
mov ecx, 0x7e9b1787
jp 0x12d702a
push dword [esi]
add ebx, eax
add ebx, eax
push cs
add dword [edi + 0x39], ebx
div dword [esi - 0x7d]
xor eax, 0x58aac523
inc ebp
sub eax, 0xc11e780
call 0x56a014ae
ret
jecxz 0x14cee68
inc dword [ecx + 0x4ef]
add byte [eax + 0x3b945838], bh
sub edi, 4
mov eax, 0x3b945838
push eax
jmp fcn.0118fd07
push edx
rol ax, 1
bt cx, 0x2f
or dl, ch
xor byte [esp + ecx - 0x39952ca9], ch
neg ax
or cx, cx
setg dl
jne 0x12d6f92
mov ecx, 0x6e81cb61
xchg dword [ebp + ebx + 0x404fd9be], esi
sub dword [edx + 0x67], ebp
pop edi
cmc
mov fs, word [ebp + 0x99433cd]
outsb dx, byte [esi]
in al, 0xf2
jns 0x14cef0a
lodsw ax, word [esi]
sbb edi, edi
jge 0x14cee67
mov dword [0x7e7709ff], eax
mov eax, 0xdfab4199
sbb dword [ebx], esi
in eax, 0x53
push 0xbbc944b3
push esp
invalid
and al, 0

Function at 0x127c754
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Execute anti-debugging instructions
Execute syscall

Disassembly:
lea esp, [esp + 0x14]
jne 0x1343ac7
mov eax, 0xcc374336
pop ebx

Function at 0x127c7df
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
inc ecx
call fcn.01219b3b
inc ebp
mov edi, dword [eax]
inc ecx
mov esi, 0x47b2b913
inc ecx
movsx ecx, dh
inc ecx
mov esp, 0x70a3a58b
dec edi
lea eax, [eax + esi - 0x47b2b90f]
jmp 0x13275de
dec ecx
inc esp
inc ebp
xor edi, ecx
dec eax
lea edx, [ecx + ecx*8 + 0x669194b6]
inc ecx
neg esi
movzx eax, dx
inc ecx
xor edi, 0x4bacc822
inc ecx
sub dh, 0xaa
push eax
inc ecx
ror edi, 1
inc edi
lea edi, [edi + 0x278f9ffc]
inc ecx
ror edi, 1
dec eax
rol eax, 0xad
dec esp
lea ebp, [edx - 0x5c4fec56]
and word [esp + ecx*2 - 0x23], cx
dec esp
mov dword [esp + ecx*2 - 0x26], ecx
inc ecx
idiv dh
inc esp
mov ebx, eax
inc esp
xor dword [esp + ecx - 0x13], edi
inc ecx
pop ecx
rol cx, 0x4f
dec ebp
arpl di, di
dec ecx
add ebx, edi
dec esp
lea edx, [ecx + ecx*8 - 0x28d53043]
dec eax
mov edi, dword [ecx + edi - 0x8009]
dec ecx
imul ebp
jo fcn.0126f980
Function at 0x1280157
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Execute syscall

Disassembly:
mov dword [esp + 4], 0x6310226d
lea esp, [esp + 4]
call fcn.00c93538

Function at 0x1299941
Capabilities:
Encode data using xor

Disassembly:
inc ecx
movsx ebp, ch
inc ecx
dec esi
dec eax
inc ebp
dec eax
bswap ebp
inc ecx
xor esi, 0xe0a56535
inc ecx
sub esi, 0x96bee6b2
inc ecx
movsx eax, ch
inc esp
movzx edx, ax
dec edx
mov dword [esp + ebp - 0x3c], 0xa61d24b8
cmpsb byte [esi], byte es:[edi]
inc ecx
rol esi, 2
dec esi
mov dword [esp + ebp - 0x3c], ecx
push eax
inc esi
xor dword [esp + ebp - 0x34], esi
inc ecx
mov edi, 0xf70e4289
inc si
mov dword [edx + 0xe], eax
mul dword [esi + 0x46]
xchg dword [esp + edx - 0x38], edx
dec esi
mov ecx, dword [esp + ebp*8 - 0x1d8]
call fcn.0121af79
pop ebx
pushfd
mov bh, byte [edx + 0x76]
xor eax, 0x790460be
cmp dword [edx - 0x268961f3], ebx
jbe 0x129997e
mov byte [ebp + 0x5a351389], dl
jge 0x129996c
xchg dh, bl
add eax, 0x94e77694
sub dl, byte [edi - 0x77]
into
cmp esi, ecx
mov ecx, 0xc37a6c86
in al, 0x76
jns 0x12999a3
or eax, 0x15113979
ret 0x4d54

Function at 0x12a8bfa
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
not eax
sar cl, cl
xor edx, edx
sub edx, ecx
inc eax
sar cx, 0xe7
dec cx
sub edx, ecx
bswap eax
xadd ecx, edx
jbe fcn.011bf081
call fcn.012e33d6
mov dword [esp], 0xedc9cd3a
call fcn.0119a913
btr ecx, eax
mov dword [esp + eax*2], ecx
adc edx, eax
pop eax
call fcn.011c4df9
push 0xea0aeaad
shr edx, 8
push 0x69100607
call fcn.013390c5
mov edx, 0x85a63d23
lea eax, [edx + edx*8 + 0x633581b7]
mov edx, dword [ebp + eax*2 - 0x2c1b4fe4]
movsx ecx, al
lea ecx, [eax + eax + 0xca33a02]
mov cl, byte [ebp + eax*4 - 0x58369fc4]
sub al, ah
sar eax, 0x2b
bt eax, eax
lea ebp, [ebp + eax*2 - 0x58362]
xadd al, ah
lea eax, [eax*2 - 0x44625f69]
setp al
mov byte [edx], cl
mov ecx, eax
mov eax, dword [esi]
ror ecx, 6
lea esi, [ecx + esi - 0x2ee8c20]
movzx edx, cl
xor eax, ebx
bswap edx
lea eax, [eax + ecx*2 + 0x185599ec]
bts cx, 0x29
jae 0x12a8bd8
jmp 0x12d04a3
Function at 0x12aa0d3
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + edx - 0x2aca884c], 0x563ad916
cpuid
neg word [esp + 1]
sbb esi, 7
push 0x3e3b65ab
rol dword [esp + 4], 0x3a
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
mov ebx, 0x331f41b7
dec byte [esp + ebx*2 - 0x663e836d]
rol ebx, 0x30
mov dword [esi + ebx - 0x41b7331b], ecx
lea ecx, [ebx*2 + 0x30f4c87]
sal bx, 0xc7
mov dword [esi + ebx - 0x41b78f80], edx
shr byte [esp + ebx - 0x41b78f7c], 0x82
mov ebx, dword [esp + ebx - 0x41b78f78]
adc cx, cx
sbb edi, 3
dec cx
js 0x15955fe
movzx eax, byte [esp]
mov edx, dword [edi + eax*2 - 0x156]
je 0xcccd74
xor edx, ebx
sub ax, cx
mov dword [esp + eax*2 - 0x1363c], 0x119dbe0e
bswap edx
lea edx, [ecx + edx - 0x3f7c2361]
and dword [esp + eax*4 - 0x26c84], eax
bswap eax
not edx
ror byte [esp + eax - 0x229afff9], 0xa2
rol word [esp + eax - 0x229b0000], 0xe1
inc edx
dec word [esp + eax - 0x229afff8]
xor ebx, edx
add ebp, edx
call fcn.0129187d
lea ebx, ss:[edx + 0x7d]
out dx, eax
jle 0x12aa212
inc esi
push ecx
insd dword es:[edi], dx
push ss
xor bh, byte [ebp - 0x2d63b5f3]
mov ecx, 0x1b60ebeb
mov ecx, 0x4f6fde31
mov dword [0x461ce7d3], eax
mov ecx, 0x49391e71
fst qword [edx - 0x38f0d4f7]
fcmovnu st(0), st(3)
retf
adc edx, ecx
and eax, 0xb0994178
pop edx
paddb mm4, qword [eax]
lds ebp, [ebp - 0x2e]
add dword [eax - 0x4b], esi
push cs
ret
inc eax
sbb cl, 0x3d
shr ax, 0x8a
xor cl, 0x80
inc cl
sal al, 0xe6
xor ax, ax
ror cl, 1
ror ax, 0xe3
sub ax, ax
sbb cl, 0x34
add ax, ax
shl al, 0xa3
xor cl, 0xaa
call fcn.011b5008
mov edx, 0x55b2490c
lea edi, [edi + edx - 0x55b2490e]
movzx ecx, word [edx + edi - 0x55b2490c]
xor cx, bx
sal dx, 0xc1
ror cx, 1
mov eax, edx
sub cx, 0x563d
btc eax, eax
push eax
rol cx, 1
imul byte [esp + edx - 0x55b29217]
xor cx, 0xa024
btc dx, 0x87
mov dword [esp + edx - 0x55b29298], eax
bts edx, 0x93
xor bx, cx
pop edx
lea esi, [esi + eax - 0x54b2f5b2]
mov word [edx + esi - 0x54b2f5b0], cx
cdq
lea edi, [edi + edx*8 - 4]
mov ecx, edx
mov eax, dword [edi + edx*2]
and dl, ch
rol ecx, 0xdb
shl cx, 0xef
xor eax, ebx
xor edx, ecx
bt ecx, ecx
not eax
and dx, cx
btr edx, ecx
sbb ecx, ecx
bswap eax
inc eax
imul dx, dx
ror eax, 1
neg edx
inc eax
add cx, cx
rol ecx, 0xf9
and ecx, ecx
xor eax, 0xbaa390a5
sub eax, 0xac81f101
bts edx, 0xe
lea edx, [ecx*4 - 0xbdd1e7c]
xor ebx, eax
bswap edx
sar cl, 0x45
inc edx
adc ebp, eax
add edx, 0xdaa04bab
lea eax, [edx + edx - 0x76de964e]
inc ecx
jb fcn.0130cff3