joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40596d
pop dword [ebp - 0x4c]
mov eax, 0x40596d
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x13c8a0c8
sub dword [ebp - 0x5c], 0xc5765b7d
mov dword [ebp - 0x58], 0x812c8cdc
sub dword [ebp - 0x58], 0x4ef94097
mov dword [ebp - 0x54], 0xb007d52f
sub dword [ebp - 0x54], 0x63bb9101
mov dword [ebp - 0x50], 0xe44c5f60
add dword [ebp - 0x50], 0x1bb3a0a0
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xa80aa712
add eax, 0x5835c94e
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9e3ee607
add dword [ebp - 0x5c], 0xd633834f
mov dword [ebp - 0x58], 0x112597c
sub dword [ebp - 0x58], 0xbfa5f807
mov dword [ebp - 0x54], 0xa2b0472c
sub dword [ebp - 0x54], 0x3f40dac0
mov dword [ebp - 0x50], 0xf73d20c5
add dword [ebp - 0x50], 0x8c2df3b
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x9c4b47da
add eax, 0x63f52926
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x37d07
push 0
call eax
mov ecx, 0x4c64
mov ebx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x4c]
mov edx, 0xcd0f41c1
add dword [ebp - 0x3c], 0xbef8aab0
mov esi, dword [edi]
xor dword [ebp - 0x30], 0x505c2ab5
sub esi, edx
sub dword [ebp - 0x1c], 0xc0a7511f
mov dword [ebx], esi
add dword [ebp - 0x24], 0x200c218f
add ebx, 4
add edi, 0x7e04c6f
add edi, 0xf81fb395
loop 0x405a78
add eax, 0x12463
mov ebx, eax
add eax, 5
mov ecx, 0xea5c3f4d
sub ecx, 0xea1c3f4d
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x434570
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2f000]
push edi
jmp 0x43458a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x434591
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x434580
mov eax, 1
add ebx, ebx
jne 0x4345a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x434598
jne 0x4345b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434598
xor ecx, ecx
sub eax, 3
jb 0x4345c8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43463a
mov ebp, eax
add ebx, ebx
jne 0x4345d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4345e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x434604
inc ecx
add ebx, ebx
jne 0x4345f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4345e5
jne 0x434601
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4345e5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x434624
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x434615
jmp 0x434586
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x434624
add edi, ecx
jmp 0x434586
pop esi
mov edi, esi
mov ecx, 0x24a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x434642
cmp byte [edi], 1
jne 0x434642
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x434647
lea edi, [esi + 0x32000]
mov eax, dword [edi]
or eax, eax
je 0x4346bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x36e64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x36f30]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x434674
mov ecx, edi
jns 0x4346a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x36f38]
or eax, eax
je 0x4346b9
mov dword [ebx], eax
add ebx, 4
jmp 0x434691
call dword [esi + 0x36f34]
mov ebp, dword [esi + 0x36f3c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4346f3
sub esp, 0xffffff80
jmp 0x40323c
Function at 0x414b40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b58
mov eax, 1
add ebx, ebx
jne 0x414b7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b70
jne 0x414b8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b70
xor ecx, ecx
sub eax, 3
jb 0x414ba0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c12
mov ebp, eax
add ebx, ebx
jne 0x414bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414bdc
inc ecx
add ebx, ebx
jne 0x414bc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bbd
jne 0x414bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bbd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bed
jmp 0x414b5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bfc
add edi, ecx
jmp 0x414b5e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c1a
cmp byte [edi], 0
jne 0x414c1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c1f
lea edi, [esi + 0x12000]

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1e27272a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x22e645c3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1270bc3
Capabilities:
Encode data using xor

Disassembly:
xor dl, 0x9b
pop ecx
xor eax, ebx
mov dword [esp + edx - 0x7980c6a7], edx
xor eax, 0xd729818d
push edx
sub eax, 0x4f8bf33f
call fcn.0130ebf3

Function at 0x12774b0
Capabilities:
Encode data using base64

Disassembly:
push 0x68b3c390
add ebp, 4
mov ecx, dword [esp]
neg ecx
xor eax, ebx
pop edx
call fcn.02422026

Function at 0x127b4e6
Capabilities:
Encode data using base64

Disassembly:
bts ecx, ecx
xor bl, al
mov dword [esp + edx - 0x50ac3a3f], ecx
imul ecx, edx
lea edi, [edi + edx - 0x50ac3a41]
rol ecx, 0xe1
and edx, dword [esp + ecx*4 - 0x55ef4dec]
dec dl
mov word [edi + ecx*4 - 0x55ef4dec], ax
lea eax, [edx + ecx*4 - 0x5d59ddcb]
ror cl, 0xc6
lea esi, [esi + ecx - 0x157bd3f1]
mov ecx, dword [esi + ecx*2 - 0x2af7a7da]
jns 0x130876a
add esi, 6
call fcn.023ae7cb
lea edx, [ecx + ecx - 0x4a5d64dd]
xor dl, 0xbd
mov dword [edi + edx - 0x57b8338a], eax
xadd dx, cx
shl edx, cl
lea eax, [ecx*2 + 0x9a25abb]
lea esi, [edx + esi - 0x3fe58004]
sets cl
jae 0x171cd64
xor edx, ebx
dec ecx
add edx, 0x1b93e285
btc ecx, eax
xor eax, ecx
ror edx, 1
inc edx
sal ax, 0xa4
setns al
sar cx, 0x8f
bswap edx
rol eax, 0x74
not edx
and al, cl
xor ebx, edx
ror eax, 0x47
adc ebp, edx
movzx edx, cx
and ecx, eax
add ecx, ebp
jmp ecx
cmovs dx, ax
mov edx, dword [esi + edx*2 - 0x7fcb0000]
ja 0x16ce9e0
mov edx, 0xcc2616a4
inc dl
movzx eax, dl
lea esi, [esi + eax*4 - 0x298]
mov eax, dword [esi + eax*8 - 0x528]
movsx ecx, dx
xor dl, dl
push ecx
xor eax, ebx
xor dword [esp + ecx*2 - 0x2d4a], ecx
or cx, dx
not eax
inc eax
rol eax, 3
sub ecx, dword [esp + ecx - 0x16a5]
adc dl, 0x81
lea eax, [eax + ecx + 0x56126666]
shr cl, cl
xor ebx, eax
add edi, eax
movsx ecx, al
lea edi, [edi + eax + 4]
xor edx, ebx
dec cl
push eax
lea eax, [eax + ecx*2 - 0x45d19d4d]
rol edx, 1
and dword [esp + ecx*8 - 0x7f8], eax
sbb ecx, eax
sbb edx, 0x50b6231e
pop eax
jmp 0x1734859
not edx
not ax
sub al, 0x3a
inc cl
ror edx, 3
xor ebx, edx
add ebp, edx
jmp ebp

Function at 0x129767d
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [esp + 0x10]
call fcn.0237b56c
sysenter
push edx
call fcn.0243821a

Function at 0x129d269
Capabilities:
Encode data using base64

Disassembly:
push 0x461c0bbb
mov dword [esp + 4], 0xf84f005
lea esp, [esp + 4]
call fcn.022a283b
Function at 0x12a60d0
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea edx, [edx - 0x677b0442]
mov dword [esp + ecx*2], 0x993ad910
not eax
mov dword [esp + ecx*4 + 4], ecx
inc dl
add cl, ch
lea eax, [eax + ecx + 0x2b328e31]
jp 0x1585792
rol edx, 1
push eax
neg edx
add eax, 0x5c15c89e
inc dword [esp + ecx - 0x7ffffe00]
xor ebx, edx
rol ecx, 0xab
shl dword [esp], 0xd8
add ebp, edx
xor dword [esp], ecx
jae 0x132a38d
mov ecx, 0x1e06142a
mov edx, 0x18040af
lea esi, [esi + ecx*2 - 0x3c0c2858]
movzx eax, cx
xchg edx, eax
mov edx, dword [ecx + esi - 0x1e06142a]
xor edx, ebx
and ecx, 0x5096a390
rol edx, 3
and eax, 0x1f37be95
dec eax
dec edx
rol edx, 3
xchg cl, al
bswap edx
bswap ecx
xor ebx, edx
sal ecx, cl
adc edi, edx
cdq
or edx, dword [ebp + ecx*2 - 0xc200000]
or cx, word [ebp + ecx - 0x60ffffc]
ror eax, 0x96
lea ebp, [eax + ebp - 2]
bts eax, eax
shr cx, 1
cwde
call fcn.0161debd
pop eax
jmp ebp
push edx
bswap eax
not eax
push edx
ror byte [esp + ecx + 0xb], 0x26
je 0x172b7db
inc ecx
mov esi, 0x4322ee06
inc ebp
movzx edx, si
inc ebp
movsx ebx, dl
dec edi
mov edi, dword [esi + ecx - 0x4322ee06]
inc di
mov ebp, dword [edx + edi - 0xee06]
call fcn.0238ca19
xor ebx, eax
lea ecx, [ecx + ecx*4 - 0x18da4cff]
add edi, eax
shl ecx, cl
dec dl
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
mov dword [esp + 0x10], ebx
cpuid
jno 0x13e92b2

Function at 0x12e280d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x472d6c9
call fcn.022e4b17
sub edi, 4
mov ecx, 0xfbaa8c10
push ecx
and ecx, ecx
mov ecx, dword [edi]
xor ecx, ebx
xor ecx, 0xae17159f
call fcn.023e8802

Function at 0x12e2838
Capabilities:
Encode data using base64

Disassembly:
push 0x70bcc1a0
mov dword [esp + 4], 0xe375c21
add esi, 6
dec dword [esp + 4]
shrd edx, eax, cl
mov ecx, 0x21274b86
mov dword [esp + ecx - 0x21274b86], ecx
mov eax, 0x3f39e618
mov dword [esi + ecx - 0x21274b86], edx
lea edx, [ecx*8 - 0x256e2ace]
inc cx
mov edx, dword [ecx + edi - 0x21274b87]
ror dword [esp + ecx - 0x21274b85], 0x3a
lea edi, [ecx + edi - 0x21274b83]
xor edx, ebx
neg al
ror edx, 1
btc eax, ecx
bswap edx
jb 0x241ffa0
inc esp
xor dword [esp + ebp - 0x1ae318], ebp
inc ebp
and al, al
inc eax
shl bh, 0xa3
inc ecx
push esi
dec eax
mov edi, dword [esp + ebp*4 - 0x6b8c58]
inc ecx
setp dh
jns 0x127698f
movzx eax, cx
lea edx, [eax + ecx*2 - 0x5a7ad3fc]
mov edx, dword [esi + eax*8 - 0x1e830]
sal ecx, cl
lea ecx, [eax + ecx*2 - 0x4fea176]
imul ecx, ecx
xor edx, ebx
not edx
shr eax, 0x3d
xadd ecx, eax
adc edx, 0x5e914e24
shl ecx, 0xb
setbe cl
xor edx, 0x60106690
rol cl, cl
ror edx, 3
xor ebx, edx
btr cx, 0xa0
or ecx, 0xe2253dbe
and eax, ecx
adc ebp, edx
mov eax, dword [edi]
call fcn.022ab830
adc ax, cx
not edx
ror cx, 0xe4
lea edx, [edx + ecx*4 + 0x2ed402a]
mov word [esp + ecx - 0x212774b6], 0xfe97
xor ebx, edx
cbw
push ecx
xor ax, 0x688c
adc ebp, edx
cwde
shr ecx, cl
mov dword [esp + ecx - 0x21], ebp
ret 8
Function at 0x12e491f
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push 0x70212ebb
mov dword [esp], esi
push edx
pushfd
push ecx
mov edx, 0x4a18a69c
lea ebp, [edx*8 - 0x315b6372]
movsx edi, dl
push ecx
lea ecx, [edi + 0x4d8ec014]
imul edx, ecx
push edx
mov esi, 0
xchg dx, cx
mov dword [esp + ebp - 0x1f69d16a], esi
xchg byte [esp + ebp - 0x1f69d16c], dl
sbb ebp, ebp
adc byte [esp + ecx - 0x4d8eef3f], 0x9f
mov ebp, dword [esp + ecx - 0x4d8eef1c]
lea ebp, [ebp + ecx*2 - 0x4bdea747]
bts edi, edx
add edi, 0x48938087
neg ebp
shl cl, 0xe4
bswap ebp
js 0x1591756
sar edx, 0xea
dec ebp
push edi
sal edi, 0xcb
sbb cl, dl
add ebp, esi
jmp 0x1767033
mov edx, dword [edi + ecx*8 - 0x595dd058]
movzx eax, cx
add ax, cx
lea edi, [ecx + edi - 0xb2bba07]
push eax
or cx, ax
ror dword [esp + ecx*4 - 0x2caff87c], 0xff
xor edx, ebx
rol dword [esp + eax*2 - 0xe82c], 0x79
cwde
bswap edx
lea edx, [edx + ecx - 0x7ad16539]
jae 0x22d6d28
mov ecx, 0xf98e4f0c
mov ecx, dword [edi + 8]
call fcn.01296d85
sub dword [esp + ecx - 0x4d8eefd0], edx
movzx esi, dx
mov dword [esp + esi - 0xf20b], ebx
not cl
pop esi
pop edi
mov dword [esp + ecx - 0x4d8eef0e], eax
bswap esi
lea eax, [esi + edi*2 + 0x340cb135]
mov ebx, 0xd097f816
mov edi, esp
ror bx, 0xf
lea ecx, [edi + ecx - 0x4d8ef01a]
inc esi
push ebx
imul dword [esp]
mov esp, ecx
add cl, cl
rol edx, 1
xor cx, 0x3bf
dec edx
mov dword [esp + eax - 0x7416], ecx
xor ebx, edx
shr al, 0x87
jae 0x23299b4
mov edx, dword [edi]
mov eax, dword [edi + 4]
jmp 0x15e147b
adc ebp, edx
rol dword [esp + ecx*2 - 0x1657fb02], cl
mov dword [esp + ecx - 0xb2bfd81], ebp
ret
Function at 0x12e92d0
Capabilities:
Encode data using xor

Disassembly:
push 0xa9b91a3
lea esp, [esp + 0x10]
call eax
mov edx, 0x81025619
bts edx, edx
movsx ecx, dx
mov ebp, dword [ebp + ecx*8 - 0x2b0cc]
movsx edi, cx
mov dword [ecx + ebp - 0x5619], eax
pop ebx
jae 0x12f223f
mov edx, 0x25a49932
mov ecx, edx
lea edi, [edi + edx - 0x25a49933]
push edx
push ecx
lea edx, [edx + edx - 0x1d66407c]
movzx eax, byte [edi + ecx*2 - 0x4b493264]
xor ecx, dword [esp + edx - 0x2de2f1e7]
jg 0x165af76
mov eax, dword [ebp]
add ebp, 4
mov edx, 0x98bcc23c
shr edx, 0x33
movsx ecx, dx
xor eax, ebx
shl ecx, cl
lea eax, [eax + edx + 0x2b8eed08]
sbb edx, 0xc430e688
neg eax
xor eax, 0x91095197
bswap eax
call fcn.012f969d
sysenter
call fcn.01724d4a
out 0x31, al
xlatb
setl byte [ecx + 0x215ffca1]
sar dword [ebx - 0x63fb3273], cl
inc dword [edi + 0x59]
imul eax, dword [ecx - 0x46], 0x328de9a2
dec edi
lea esp, [edx - 0x328de9a6]
inc ebx
mov edx, dword [esp + edx - 0x328de9a2]
inc ebp
mov edi, edx
xor edx, edi
inc ecx
mov ebx, edi
inc ebp
mov ebx, edi
sub edx, 0xf587b2ac
call fcn.0166a083
mov ecx, dword [ecx + edi - 0x6b80]
add edi, 8
mov dword ss:[edx], ecx
mov edx, 0xff8c19bc
mov eax, dword [ebp]
btc edx, edx
mov ecx, edx
adc edx, edx
adc ebp, 3
xor eax, ebx
ror eax, 2
neg eax
call fcn.016eea65
pop edi
dec dl
mov eax, ecx
pop esi
inc eax
jmp edi
shl dl, 0x87
xor al, bl
push edx
ror dx, 6
inc al
push ecx
sar dl, 0xc2
rol al, 1
shl cx, 0xa8
adc al, cl
rol al, 1
sub al, 0x2a
bts ecx, ecx
xor bl, al
lea ebp, [ebp + edx - 0x2de203f3]
sub cx, 0x1f18
sbb eax, 0xe98166d2
sbb byte [edi], bl
and cl, 0xa1
dec dword [esp + edx - 0x2de203eb]
mov word [ebp + edx*2 - 0x5bc407e2], ax
setle byte [esp + ecx*2 - 0x2f03173b]
lea edi, [ecx + edi - 0x17818ba5]
mov ecx, dword [edi + edx*2 - 0x5bc407e2]
adc word [esp + edx - 0x2de203f1], dx
movzx eax, word [esp + edx*2 - 0x5bc407da]
xor ecx, ebx
inc edx
neg ecx
imul edx, edx
inc edx
rol dword [esp + edx*2 - 0x16af2184], 0x17
ror ecx, 3
call fcn.01707518
push 0xf44e5527
call fcn.0175daac
cld
fnsave dword [eax]
mov ebx, 0xed0976cc
mov edx, ds
les esi, [ebp - 0x281e9413]
dec ebp
scasd eax, dword es:[edi]
sub eax, 0xd7bcf35e
js 0x165af9c
int1
into
jecxz 0x165b01b
invalid

Function at 0x13299c9
Capabilities:
Encode data using base64

Disassembly:
not word [esp + 9]
lea esp, [esp + 0xc]
call eax
mov edi, 0x99ab3014
mov ecx, edi
movzx edx, di
mov ebp, dword [ebp + edx*2 - 0x602c]
dec ecx
neg dx
jbe 0x15ff283
mov dword [ebp + edx*2 - 0x19fd8], eax
btc di, 0x8a
mov esi, ebp
dec di
shr edi, cl
lea ebx, [edi - 0x3f5c4578]
pop ebx
shl ecx, cl
ror ecx, 0x83
pop edi
xor edx, 0x5928c5a6
pop ebp
sub edx, 0xf1c81bc
movsx eax, dx
jmp edi

Function at 0x13434fd
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor edi, edx
and edi, 0xff
mov edi, dword [edi*4 + 0x247aff0]
shr edx, 8
xor edx, edi
mov dword [esp], 0x4f964dae
inc ecx
sal byte [esp], 0xe4
dec byte [esp + 1]
xor edx, 0xaea1fd39
jmp 0x238b58c
inc byte [esp]
dec eax
call fcn.012d1d7b
in al, dx
sub eax, 0x8d811adb
lahf
cli
push eax
sub ah, ah
movsd dword es:[edi], dword [esi]
sbb ebp, 0x48fd8604
invalid
Function at 0x138a0be
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0xede2b44f
call fcn.0175daac
mov edx, 0x821ba907
lea eax, [edx + edx*4 - 0x3666dd59]
mov ecx, dword [eax + edi - 0x54236fca]
imul ax
xor ecx, ebx
neg ecx
neg dl
cbw
dec ecx
not ecx
neg ax
cwd
sub dx, 0x2b3
rol ecx, 1
xor eax, edx
xor ebx, ecx
inc al
add esi, ecx
mov eax, dword [ebp]
movsx ecx, dx
rol dx, 0x23
mov cx, word ss:[eax]
adc ebp, 1
call fcn.0157e374
mov edx, 0xa1b65b16
sar dx, 0xd
sbb esi, 3
btr edx, edx
mov edx, dword [esi]
jae 0x162b3ad
mov edx, 0x2b279596
movsx ecx, dx
mov ecx, dword [edi + edx*2 - 0x564f2b2c]
mov eax, edx
lea edi, [edx + edi - 0x2b279592]
shr eax, 0x8c
xchg ecx, edi
btc eax, eax
movsx ebp, ax
adc dx, 0xcc80
mov ebp, ecx
lea ecx, [eax*8 - 0x45dff77c]
rol edx, 0xf4
ja 0x12958d9
test byte [edx], al
loopne 0x162b357
jmp dword [eax + eax]
xor edx, ebx
call fcn.0131ace0
mov dh, 0x42
inc ebx
ror dword [eax + 0x67], 0x42
pop ss
jl 0x162b355
nop
das
cdq
wait
invalid
Function at 0x13a3045
Capabilities:
Encode data using base64

Disassembly:
ror eax, 3
and edx, 0xf7186622
movsx ecx, dl
setns byte [esp + ecx*2]
lea eax, [eax + ecx*4 - 0x5a0aaf1d]
push edx
xadd word [esp + ecx + 4], dx
bts cx, dx
neg eax
sar cx, 0xcf
lea edx, [edx + ecx*2 + 0x73a44292]
call fcn.0154ed26
call 0xb16efa7b
movsd dword es:[edi], dword [esi]
mov es, ebp
and eax, 0x244489
mov dword [esp], eax
movzx eax, byte [edi]
xor al, bl
rol dword [esp], 0x68
inc al
mov ecx, 0x1bac0aa7
add ecx, 0x4a26e13c
movzx edx, byte [esp + ecx - 0x65d2ebe3]
rol al, 1
push edx
btc edx, 7
not cl
inc al
rol word [esp + ecx - 0x65d2eb18], 0xcd
rol al, 1
bt edx, edx
sbb al, 0x2a
not dl
add ecx, ecx
dec dx
xor bl, al
lea ebp, [ebp + edx*2 - 0x138]
imul ecx, ecx
sub word [esp + edx*4 - 0x26b], cx
mov word [edx + ebp - 0x9b], ax
jb 0x15f3f8d
sar edx, 0x6f
xor eax, ebx
mov dword [esp + edx*2 - 0x4456], edx
xadd dword [esp + edx - 0x222b], edx
dec eax
not edx
jmp 0x13a3008

Function at 0x13b1f57
Capabilities:
Encode data using xor

Disassembly:
cdq
mov ecx, dword [ecx + esi - 0xaf]
mov dword [esp], edx
shr ax, 0x65
cdq
xor ecx, ebx
not dword [esp + 8]
push eax
xor al, 0x8a
xor ecx, 0x2db7ec12
xor dx, 0xfc29
jnp 0x16093f6
sub esi, 4
mov ecx, dword [esi]
call fcn.0134160b
ror ecx, 2
pop eax
push edx
xor ecx, 0x7da550a3
idiv eax
mov dword [esp + eax - 0x21ea2], edx
sub ecx, 0x8227b196
xor ebx, ecx
div dword [esp + eax*2 - 0x43d44]
mov dword [esp + 0x14], 0xdf853f3d
add ebp, ecx
cwd
pop edx
pop ecx
pop ecx
pop eax
pop edx
pop edx
jmp fcn.01734d14

Function at 0x13bc56d
Capabilities:
Encode data using base64

Disassembly:
xadd edx, ecx
adc ebp, eax
mov dword [esp + ecx - 0x5d7dfb9d], ecx
mov ax, word [ecx + esi - 0x5d7dfb9d]
sar cx, 0xea
shr dx, 0xc6
mov cl, byte [esi + ecx - 0x5d7dfffc]
imul dx, word [esp + 1]
adc esi, 1
or edx, 0x832e32ad
js 0x229eeb7
mov dword [esp], 0xee025794
shl ax, cl
not edx
mov word [edx + esi - 0x78c0c942], ax
xchg byte [esp + edx - 0x78c0c93f], dh
call fcn.014535ef

Function at 0x13d8472
Capabilities:
Encode data using xor

Disassembly:
bswap edx
neg edx
not edx
rol ecx, 0x92
adc ecx, ecx
xor edx, 0xc097dc83
xor ecx, 0x2316a40b
neg ecx
setge cl
xor ebx, edx
add edi, edx
jmp 0x153053e
lea edi, [edi + eax - 0xaa]
not eax
xor edx, ebx
shl ecx, 0x82
push eax
xor cl, byte [esp + ecx - 0x66b77eb7]
lea edx, [edx + ecx*2 - 0xc5594e4]
sal eax, 0x90
or eax, ecx
mov dword [esp + ecx - 0x66b77e43], eax
neg edx
or al, byte [esp + ecx - 0x66b77e40]
dec edx
sar ax, cl
rol edx, 2
bswap edx
lea edx, [edx + ecx + 0x3fdbc166]
or ax, ax
xor al, 0x25
call fcn.0239a721
mov edx, dword [ebp]
mov ecx, 0x8289c01a
shr ecx, cl
dec cl
lea ebp, [ebp + ecx*2 - 0x3a]
shr cx, 0x4b
and cx, cx
xor ecx, ecx
xor edx, ebx
rol edx, 2
ror cx, 0x66
jae 0x1386274
Function at 0x13debb9
Capabilities:
Execute syscall

Disassembly:
pop eax
push edx
mov ax, word [ebp]
mov dword [esp + 4], edx
or dword [esp], edx
btc ecx, edx
adc ebp, 2
sub edi, 1
movzx ecx, byte [edi]
btc dx, 0x10
pop edx
xor cl, bl
and dl, dh
ror cl, 1
jmp 0x173ee3c
shr byte [esp + 2], 0x62
dec cl
call fcn.01716f36
syscall
inc ecx
push eax
dec eax
mov dword [esp], 0xee16c437
call fcn.0175daac

Function at 0x1409a42
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edi + edx*2 - 0x58]
mov dword [esp], 0x7d011b1c
btc eax, 0xb7
call fcn.023845a1
Function at 0x141de3b
Capabilities:
Encode data using base64

Disassembly:
call fcn.02392c63
jb 0x13898e5
call fcn.012d91e8
push esi
movzx esi, byte [ecx]
xor esi, eax
call fcn.013bf1c7
mov edi, dword [edi*4 + 0x247cf24]
jb 0x13d901d

Function at 0x1427acc
Capabilities:
Encode data using base64

Disassembly:
cbw
btr cx, 0xae
sbb edx, 0x9c32628a
and word [esp + ecx*8 - 0x202f3c], ax
sub ecx, ecx
not cl
rol edx, 1
bts cx, 0x33
sub dword [esp + ecx - 0xfb], 0x62a52c9a
sal al, 0x61
xor ebx, edx
cwde
btr ecx, ecx
call fcn.0126a2ca
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, 0xfe279739
xor dx, 0x410a
push ebx
cpuid
call fcn.015f7e0f
mov edx, 0x6e296981
movzx ecx, dx
mov eax, 0x3caa2888
mov ecx, dword [ebp + ecx - 0x6981]
lea ebp, [edx + ebp - 0x6e29697d]
mul edx
call fcn.023278ac

Function at 0x143097b
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [edi + edx - 0x3f718f60]
lea edi, [edi + edx*2 - 0x7ee31ebc]
neg eax
call fcn.01425637
bswap ecx
not ecx
push edx
bswap ecx
not eax
xor ebx, ecx
add ebp, ecx
cdq
mov ecx, dword [esp]
mov esi, dword [esi + ecx - 0x7e362c34]
push ecx
neg word [esp + ecx - 0x7e362c2e]
pop eax
pop edx
jb fcn.0154e259