joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10d16b62
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
lea eax, [edx*4 + 0x532b4bb3]
ror ecx, 1
pop eax
movzx eax, dx
neg ecx
mul ax
xor ebx, ecx
or al, al
rol ax, 3
jp 0x10d4b2c9
dec eax
popfd
mov dword [ebx - 0x61], ecx
shl dword [ebx - 0x2c4276d7], cl
int1
sahf
cmp al, 0xd6
jle 0x10d16bcb
wait
mov ah, 0x9e
adc al, 0xd6
neg byte ss:[ebx - 0x713b614c]
jle 0x10d16be9
wait
mov ah, 0x9e
je 0x10d16bb6
sahf
wait
mov ah, 0x9e
salc
pop edx
scasd eax, dword es:[edi]
pushal
dec eax
adc dh, byte [edi + 0x6c]
nop
inc esp
mov dl, 0x8f
dec ebx
sbb eax, 0x6f4fb512
mov ebx, 0x84734ce4
outsb dx, byte [esi]
retf
in al, 0xa7
jno 0x10d16bff
test dword [esp + ebx*4 - 0x25], esp
mov byte [0x6f19d726], al
push edx
pop dword [edx + 0x110381bc]
lea ebx, [edi - 0x54d462c]
sbb eax, 0x7d017c26
out 0x45, al
pushfd
invalid
jge 0x10d16bd1
inc ebp
and bl, byte [ebx + 0x4f]
pop ds
jne 0x10d16b76
in eax, dx
in eax, 0x32
mov dl, 0xa0
adc byte [ebx + 0x2d], 0x82
sbb dword [edx - 0x7da2bf7a], edi
sbb dword [edx + 0x2de556ca], edi
cmp ecx, eax
hlt
pop ebp
sbb byte [ecx], 0xba
retf 0xe556
mov dword [ebp + eax*2], ecx
bswap edx
cbw
call fcn.111ada10

Function at 0x10d18369
Capabilities:
Encode data using base64

Disassembly:
inc dword [esp + 5]
shr edx, 8
push 0x2a0d2f21
xor edx, edi
inc ecx
dec byte [esp + 0xd]
xor edx, 0x8f3febb2
dec eax
call fcn.10d3fc95
mov ecx, 0xcdbc52a6
movsx edx, cx
mov cl, byte [ebp + edx*2 - 0xa54c]
or dx, 0xf91b
movsx eax, dl
sbb ax, 0xb4ad
movzx ax, byte [edx + ebp - 0xfbbd]
jl 0x118b8933
ror dx, 0x4a
jbe 0x111b652e
mov ecx, dword [ebp]
mov eax, 0x6639c6bf
lea edx, [eax + eax*8 - 0x32ebb3d4]
rol edx, 0xf2
mov al, byte [ebp + eax - 0x6639c6bb]
neg edx
lea edx, [edx*2 - 0x1a572bd3]
or edx, 0xf2965b9c
adc ebp, 6
rol dl, 3
shl edx, 0x13
mov byte es:[ecx], al
sbb edi, 3
mov ecx, dword [edi]
lea eax, [edx + edx*4 - 0x1bf5bd7e]
cdq
xor ecx, ebx
lea ecx, [ecx + eax + 0x726d6e0c]
xor ecx, 0xc09a0606
btc ax, ax
xor dx, ax
ror ecx, 1
sar edx, 0x90
dec dl
xor ax, dx
not ecx
setle al
bswap ecx
neg dl
imul edx, eax
sub ax, ax
xor ecx, 0xe2933aa8
dec al
xor ebx, ecx
bts eax, 0x3c
push eax
adc esi, ecx
mov dword [esp + eax - 0x53ba00ff], esi
ret
imul cl
movzx ecx, dl
inc dl
mov word [edx + ebp - 0xeffd], ax
neg dl
mov ax, word [ebp + edx*2 - 0x1de00]
movzx edx, byte [edi + edx*2 - 0x1de03]
sete cl
jnp 0x10d3d33d
ror eax, 8
ror al, 0x44
adc eax, ebp
jmp fcn.118cede6

Function at 0x10d1859d
Capabilities:
Encode data using base64

Disassembly:
inc eax
setle bh
inc ecx
ror ecx, 2
cdq
inc esp
sub ecx, edi
dec ecx
imul eax
dec esp
mov dword [esp + edx + 8], edi
inc ecx
idiv eax
call fcn.118e0d0b
Function at 0x10d208d1
Capabilities:
Encode data using xor

Disassembly:
sal dl, 0x64
btc edx, eax
sbb ecx, 0xf6bbc3bc
rol ax, 0xe2
rol ecx, 3
mov dword [esp + eax - 0x47952c44], eax
imul al
xor ecx, 0x3e1fbb39
shl dword [esp + eax - 0x47951210], 0x2b
sbb word [esp + eax - 0x4795120f], 0xc48c
inc ax
xor ebx, ecx
sar dl, 0x46
or dword [esp + eax - 0x47951211], 0x441f6906
bswap edx
adc esi, ecx
mov ecx, dword [eax + ebp - 0x47951211]
neg ax
shr eax, 0xa
mov edx, dword [ebp + eax*2 - 0x23caf2]
not ecx
adc eax, eax
not edx
sar ax, 0x84
setns al
or ecx, edx
or eax, eax
sbb ax, ax
mov dword [ebp + eax - 0x22fffc], ecx
sub dword [esp + eax - 0x230000], eax
push eax
mov ebp, dword [ebp + eax - 0x22fffc]
movzx ecx, word [esp + eax*4 - 0x8bfffc]
pop eax
pop ecx
jno fcn.10ce0aa7

Function at 0x10d24896
Capabilities:
Encode data using xor

Disassembly:
lea eax, [ecx*8 + 0x5a079aa]
mov eax, dword [edi + ecx*2 - 8]
mov dword [esp + ecx*4], 0x6d3fa989
adc cl, byte [esp + ecx + 4]
ja 0x118eae2e

Function at 0x10d282d5
Capabilities:
Encode data using base64

Disassembly:
neg ax
xor edx, edx
pop ecx
xor ax, 0xeea3
movzx ecx, dl
push edx
xor bx, ax
shr ecx, 0xd6
sal cl, 0x84
sal dl, 0xc7
mov word [ebp + edx*2 - 4], ax
lea ebp, [ebp + edx*2 - 4]
adc dword [esp + ecx], edx
not cl
pop edx
jno fcn.10ce0aa7
mov edi, 0x168c5ca8
inc esp
mov eax, edi
dec eax
lea edx, [edi*8 - 0x78469872]
dec eax
lea ebx, [ebx + edx*2 - 0x783899a0]
mov ecx, dword [edi + ebx - 0x168c5ca8]
inc ecx
xor ecx, edi
inc ecx
shl al, 0x42
push edx
inc ecx
bswap ecx
inc ecx
pop ebp
xor ecx, 0x848db199
inc cx
ror ebp, 0xa3
inc ecx
movsx esi, bp
inc ecx
mov edx, 0x6596a2a0
bswap ecx
ror ecx, 2
inc ecx
push edi
inc esi
dec eax
imul edi, esi
inc edx
xor dword [esp + ebp - 0x3c1cc999], ecx
dec eax
neg edi
dec ecx
and eax, 0x81830b14
inc ecx
pop edi
inc ecx
not ebp
jle 0x1115b053
dec esi
lea esp, [esi + eax*4 + 0x7b516b0]
dec eax
arpl cx, cx
inc eax
or dl, dh
inc ecx
adc edx, esp
inc ebp
bt eax, edx
dec esp
adc ebx, ecx
inc cx
sal eax, 0xaa
je 0x11170152
mov eax, 0x1aaeeabc
call fcn.118d391b
dec esp
mov dword [esp + eax - 0x17e63], ebx
ret

Function at 0x10d2a2f2
Capabilities:
Encode data using base64

Disassembly:
bswap eax
mov dword [esp], 0xf6a556ae
call fcn.11163e4a
Function at 0x10d2a749
Capabilities:
Encode data using base64

Disassembly:
call fcn.10d4970a
adc esi, ecx
mov ecx, dword [ebp + eax - 0x28004002]
dec edx
btc edx, 0x28
cdq
lea ebp, [ebp + eax*2 - 0x50007ffe]
lea edx, [esp + eax - 0x28003fec]
bt eax, eax
call fcn.10d38c14
mov eax, 0xd2d4f8a
mov ecx, 0x8d1a4287
lea edi, [edi + eax*2 - 0x1a5a9f18]
neg al
adc cx, 0x26a8
jle 0x10d571bc
mov eax, dword [eax + edi - 0xd2d4f76]
movsx edx, cl
sub ecx, 0x189dfa93
xor eax, ebx
sal ecx, cl
dec cl
lea eax, [eax + ecx + 0x180a758f]
not dl
imul dx, dx
bts ecx, edx
neg eax
ror dx, 0xc
rol cx, 0xc2
sub edx, 0x7419cb9b
xor eax, 0xc314121c
sub eax, 0x1306882
shl ecx, cl
js 0x11902805
push edx
add esi, eax
lea eax, [ecx + 0x759e3b28]
cdq
xor word [esp + edx*4], ax
add dx, word [edi + edx*8 - 7]
and eax, ecx
sbb byte [esp + eax - 0x759d103e], ah
xor dx, bx
dec al
call fcn.1115a99b
mov edx, 0xf8b2f82
dec eax
lea ebx, [ebx + edx - 0xf8b2f86]
inc esp
mov esi, dword [ebx + edx - 0xf8b2f82]
shl dx, 0xa8
inc ebp
xor esi, edi
mov esi, 0xb0aaefa4
inc ecx
not esi
dec eax
inc edx
dec eax
lea edi, [esi*8 + 0x7f87c190]
inc ecx
rol esi, 1
inc ecx
bswap esi
inc esp
movsx ecx, si
inc ecx
rol cl, 0x64
inc ecx
neg esi
inc esp
movzx edx, dh
inc ecx
push edx
inc ecx
sub esi, 0xc036c812
inc ecx
xor esi, 0x6ab31d35
shl byte [esp + edx - 0xf8b81fc], 0xc7
dec esp
mov dword [esp + edx - 0xf8b8201], edi
inc esp
movzx ebp, dh
inc ecx
setns dl
dec esi
lea esp, [edi + edx*8 + 0x3a0a52b1]
inc esp
xor dword [esp + edx*4 - 0x3e2e0804], esi
dec dl
inc ecx
pop edi
inc cx
imul esi, esp
dec ebx
lea eax, [ecx + ecx*4 + 0x58aefaa5]
btr ax, 0x1a
ror edx, 1
not eax
neg edx
xchg ecx, eax
rol edx, 3
sar eax, cl
bswap ecx
xor ebx, edx
cwde
add esi, edx
sub edi, 1
sar eax, 0x3f
movsx edx, al
cmovbe cx, ax
movzx eax, byte [edi]
push ecx
sub ecx, 0x6c9ba28d
btc ecx, ecx
xor al, bl
add al, 0xb0
xor dword [esp], edx
cmovo ecx, edx
xor ecx, edx
rol al, 1
xchg ecx, edx
neg dword [esp + edx - 0x6c9fa28d]
setb dl
adc al, cl
rol al, 1
xor bl, al
lea eax, [esp + eax + 4]
shr cx, 0xf
jne 0x111870a4
not cl
xor bl, cl
lea ecx, [esp + ecx + 8]
add al, ah
pop eax
mov byte [ecx], dl
lea ecx, [eax + eax*4 - 0x1770b56a]
sar ecx, 0x64
pop eax
adc eax, esi
jmp eax
not eax
ror eax, 1
not cl
bts edx, 0x36
dec eax
sar ecx, cl
lea ecx, [ecx + ecx*8 - 0x29c66a55]
push ecx
not eax
or word [esp], dx
xadd byte [esp + 3], ch
sbb word [esp + 1], cx
xor ebx, eax
add esi, eax
and word [esp + 2], cx
mov dx, word [ebp]
add ecx, dword [esp]
lea ebp, [ecx + ebp - 0x185bf39f]
or word [esp + ecx - 0x185bf3a1], 0xba8
inc cl
bt ecx, 0x3b
lea edi, [edi + ecx*4 - 0x616fce89]
sbb cx, cx
movzx ecx, byte [edi + ecx - 0x185bffff]
mov eax, dword [esp]
sbb al, al
sub dword [esp + eax - 0x42221fff], eax
xor cl, bl
ror cl, 1
xor cl, 0xad
bswap eax
neg cl
push eax
shl dword [esp + 4], 0x4a
sbb cl, 0x17
jmp 0x11835636
Function at 0x10d2e701
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov edx, 0xf7969615
movsx ecx, dl
mov eax, dword [ecx + edi - 0x19]
mov dword [esp + ecx*2 - 0x2a], 0xdf3a353d
dec cx
lea edi, [ecx + edi - 0x18]
xor eax, ebx
jmp 0x1119de8a
ror word [esp + ecx - 0x13], 0x4b
inc eax
ror ecx, 3
xor word [esp], cx
sal byte [esp], cl
ror eax, 1
not word [esp + ecx - 0x80000000]
ror edx, cl
sal ecx, cl
neg eax
xadd dword [esp + ecx*4 - 0x20], ecx
pop ecx
sub dx, cx
rol eax, 3
push edx
imul edx, edx
sar cl, 0x63
xor ebx, eax
btc edx, 0xa6
bswap ecx
jae 0x118f1d00
adc esi, eax
lea eax, [edx + edx*2 - 0x54e363d3]
xor dword [esp + edx - 0x7dd23b41], ecx
mov ecx, dword [edx + ebp - 0x7dd23b45]
mov ax, word [ebp + edx - 0x7dd23b41]
sar byte [esp + edx - 0x7dd23b41], 0x84
imul edx, dword [esp + edx - 0x7dd23b41]
lea ebp, [ebp + edx - 0x46982178]
shl dl, 0xa7
call fcn.11159d55

Function at 0x10d36ca0
Capabilities:
Encode data using base64

Disassembly:
adc eax, 0xd35553a
or ecx, 0x220584bc
xor ebx, eax
mov dword [ebp - 4], eax
sub ebp, 4
and dx, 0xabb8
adc word [esp + 0xe], dx
xor ecx, dword [esp + 0x14]
pop edx
pop eax
pop edx
pop eax
pop ecx
pop eax
jge fcn.10ce0aa7
not ecx
btc edx, 0xb1
and eax, ecx
shr edx, 0xa1
inc edx
neg edx
mov dword [ebp + 4], eax
call fcn.118f64ff
mov edx, 0x78b72a1f
movzx ecx, dl
mov ecx, dword [ebp + ecx*2 - 0x3e]
sar dx, 0xa1
movsx eax, dx
push eax
mov ax, word [ecx + eax*8 - 0xa878]
shl dword [esp + edx - 0x78b7150f], 0x47
sal word [esp + edx - 0x78b7150f], 6
mov word [ebp + edx - 0x78b7150d], ax
push edx
or dword [esp + edx - 0x78b7150b], edx
not dl
mov ecx, dword [edi + edx - 0x78b715f4]
inc edx
inc dword [esp + edx - 0x78b715ed]
dec dword [esp + edx - 0x78b715ed]
xor ecx, ebx
ror ecx, 3
xor ecx, 0xbaab421e
lea eax, [edx + edx*4 + 0x2d1801]
pop eax
shr dword [esp + edx - 0x78b715f1], 0x10
rol ecx, 2
add eax, 0xe0848136
btr dx, 0x3f
dec ecx
add dword [esp + edx - 0x78b715f1], 0xc60be920
rol dword [esp + edx - 0x78b715f1], 0xa6
xor ebx, ecx
btr edx, eax
add esi, ecx
movzx eax, byte [eax + edi - 0x593b964a]
btc edx, 0xb4
mov ecx, edx
lea edi, [edx + edi - 0x78a715d6]
xor al, bl
dec al
xor cx, word [esp + ecx - 0x78a715d1]
rol edx, 0xf2
sbb dword [esp + ecx - 0x78a76220], 0x5f1bd238
not al
xor dword [esp + edx - 0x5745e29c], 0x7137892c
dec al
sub cl, 0x3d
xor cl, ch
ror al, cl
btr cx, 0x93
xor bl, al
inc cl
neg cx
mov word [ebp + edx - 0x5745e29c], ax
mov eax, edx
xor cx, dx
sal dword [esp + eax - 0x5745e29c], 0xc4
mov dword [esp + eax - 0x5745e29c], esi
ret
and word [esp + edx*4 - 0x8a35148], dx
bswap eax
mov dword [esp + edx*4 - 0x8a3514c], edx
and ecx, ecx
xor eax, 0x2497881c
neg edx
jno 0x1117a77d
jno 0x10d0ecff
Function at 0x10d3810a
Capabilities:
Encode data using base64

Disassembly:
dec esp
adc ebx, edi
inc cx
bt ebp, esi
dec ebp
adc edx, ebx
inc ecx
jmp edx
movzx ecx, byte [edi + edx - 0x6f4de1aa]
mov dword [esp + edx - 0x6f4de1a5], 0x803a113c
dec edx
inc edx
xor cl, bl
sar word [esp + edx - 0x6f4de1a5], 2
not cl
ror cl, 1
shr word [esp + edx - 0x6f4de1a5], 0x2b
adc cl, 0x39
dec dx
call fcn.10d073ee
mov dword [esp + eax - 0x66121c95], edx
not ecx
sal dword [esp + eax - 0x66121c95], 0x3f
xor ebx, ecx
add esi, ecx
ror dword [esp + eax - 0x66121c95], 0x5a
shl al, 0xa6
lea edx, [edx - 0x3d421e5b]
mov ax, word [ebp + eax - 0x66121c40]
jns 0x10cfe948
and ax, si
not edi
inc ebp
movzx eax, dl
dec esp
lea ecx, [edx + eax*2 + 0xfa924a3]
inc ecx
not ebp
dec eax
cwde
inc ebp
xor edx, edx
inc ecx
or edi, ebp
inc ecx
mov dword [edx + ebp], edi
dec edx
lea ebx, [ebx + edx*2 - 4]
dec eax
shr esi, 0xe
inc ecx
mov edi, eax
cdq
inc ecx
mov edi, dword [edx + ebx]
inc ecx
push edx
dec ecx
rol eax, 0x84
inc ecx
xor edi, edi
rol edi, 3
add edi, edx
inc esp
movzx esp, dl
neg edi
xor edi, edx
xor edi, 0xdf9a4e07
dec esi
add dword [esp + edx*2], edi
inc si
inc cx
shl esp, 0x4f
inc eax
sets dh
inc edx
xor dword [esp + edx], edi
inc ecx
pop edi
inc esp
movsx ebp, si
inc ecx
rol cl, 0x44
inc ecx
bt ebp, 0x3d
dec eax
arpl di, di
jae 0x10cee0de
inc ebp
jg 0x10d38238
push edi
pop ds
mov dh, 0xe6
aaa
sbb dword [edi - 0x40b31552], ebx
mov al, byte [0x405f841b]
movzx eax, bh
call fcn.11828943
or al, 8

Function at 0x10d3b0a1
Capabilities:
Encode data using base64

Disassembly:
sar edx, 0x5b
imul edx
lea ecx, [esp + ecx + 0x18]
rol eax, 0xa1
sbb al, al
dec edx
mov edx, dword [ecx]
lea eax, [eax + eax*8 + 0x5828500b]
shr eax, 0x94
ror ax, 0x87
mov dword [ebp + eax*8 - 0x205e], edx
movsx ecx, ax
lea ebp, [ebp + eax*2 - 0x81c]
pop eax
pop ecx
pop edx
pop ecx
pop eax
pop edx
jns fcn.10ce0aa7
Function at 0x10d4970a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shrd edx, eax, cl
pop eax
mov dword [ebp + 6], edx
mov ecx, dword [ebp + 6]
not word [esp + 4]
add ebp, 0xa
lea eax, [esp + 0x64]
mov edx, 0xab23ed15
mov dword [esp], edx
jmp 0x11159c51
add edi, 0xfffffffc
rol dword [esp + 1], 0x29
mov ecx, dword [esp]
xor edx, ebx
movsx eax, cx
push ecx
call fcn.10d48943
jbe 0x10d659d9
push ebx
lea ebx, [ecx + eax]
ror al, 0xa0
movsx ax, cl
push edi
rcl eax, cl
ror ax, cl
mov dword [eax], ecx
mov edx, dword [edi - 4]
not byte [esp + 6]
jmp 0x10d5af8b

Function at 0x10d4ac77
Capabilities:
Encode data using base64

Disassembly:
pop eax
pop edx
pop eax
pop ecx
jae fcn.10ce0aa7
mov word [esp], ax
rcr edx, cl
or dword [esp], eax
movzx ecx, al
js 0x118fc077
inc ecx
popal
je 0x10d4aced
or bh, byte [edi - 0x6befdb19]
scasb al, byte es:[edi]
into
or eax, 0x1d787efa
add al, 0x9d
mov dword [ecx + ebp - 0xff], edx
shr cl, 3
sal cl, 1
mov dword [esp + ecx*2 - 0x7c], esi
ret
Function at 0x10d4b2d6
Capabilities:
Encode data using base64

Disassembly:
inc cx
xor ebp, 0xff41c18d
les esp, [esi - 0x2d]
dec byte [eax - 0x2d]
out dx, eax
inc cx
rol ebp, 1
inc bp
xor edi, ebp
inc ecx
dec esp
inc eax
not bh
inc sp
mov dword [ebp + esi - 0x16a], ebp
inc esi
inc esp
movsx ebp, al
dec esp
mov edx, dword [ebx + esi*2 - 0x2f1]
inc edx
dec ecx
lea ebx, [esp + ebx - 0xf]
jnp 0x118cd3ad
sub edi, 4
mov eax, 0x6cb76c0d
mov edx, dword [eax + edi - 0x6cb76c0d]
mov ecx, eax
btc eax, ecx
xor edx, ebx
rol edx, 2
call fcn.10d2028f
mov edx, 0x2e3a0baa
mov edx, dword [ebp + edx*2 - 0x5c741754]
mov eax, 0xbe328f3e
lea ecx, [eax*4 - 0x39fc57ca]
mov eax, dword [ebp + 4]
ror cl, 0xc7
push ecx
adc ecx, dword [esp]
mov cl, byte [ebp + ecx - 0x7d9bcab0]
shl word [esp + 2], 0x83
dec word [esp + 2]
adc ebp, 5
inc dword [esp]
dec byte [esp + 3]
shrd edx, eax, cl
mov ecx, 0x8da17839
movzx eax, word [esp]
jmp 0x118b5a10
inc ebp
adc eax, esp
inc ecx
mov ecx, 0x83a8cf3a
cbw
btc edx, 0x3f
inc ecx
rol eax, 2
dec esi
lea esi, [edi + esi - 0x4e609ad7]
dec esi
mov dword [esp + esi - 0x72ad200d], esp
inc ecx
bswap eax
jmp 0x11902e3f
mov dword [ebp + eax - 0xe55d], edx
dec al
shl dword [esp + eax*8 - 0x72ae0], 0x9d
lea edi, [edi + eax - 0xe560]
sar eax, 0xd7
mov ecx, dword [edi + eax*8]
cdq
sete dl
js fcn.118383db
xor ecx, ebx
sub ecx, edx
not byte [esp + eax + 3]
sal eax, 0x8c
bswap ecx
shl edx, 0x66
ror ecx, 3
and edx, edx
cwd
dec ecx
add word [esp + eax*4 + 2], ax
xor ebx, ecx
rol dl, 0x83
xor al, dl
adc esi, ecx
or byte [esp + eax], ah
neg dword [esp + eax*2]
add edx, edx
mov dword [esp + eax*2], esi
ret
inc ecx
xor ebp, 0xd6357094
inc ecx
sbb ecx, 0xb2b5b5ab
dec ebp
xor edx, edi
inc ebp
and al, cl
dec ecx
neg edx
dec ecx
ror edx, 1
dec ecx
xor eax, esp
dec ecx
not edx
inc cx
neg esi
dec ecx
rol edx, 1
dec ecx
not edx
dec eax
not eax
inc bp
xor esi, ecx
dec ebp
xor edi, edx
dec eax
not ecx
inc cx
xchg eax, edi
dec esp
lea esp, [edi*2 - 0x84dcdf3]
dec esp
mov dword [esi + ebp - 0x173], edx
dec eax
shr ecx, 0xd3
imul al
inc ecx
idiv ch
dec eax
lea ebp, [ebp + esi - 0x173]
inc eax
div dh
add esi, 0x129bd13c
inc ebp
movzx edx, sp
jns fcn.10cf108c
inc ecx
sub eax, 0xd23f26ab
dec esp
or esi, edi
neg eax
and word [esp + esi - 0x5c0], 0xd330
dec esp
adc dword [esp + esi - 0x5c0], edi
dec eax
inc eax
dec ebp
cmovge ecx, esp
inc esp
xor dword [esp + esi - 0x5c0], eax
inc cx
sar ecx, cl
inc esp
movzx edi, di
inc cx
add ecx, 0x5f410a15
dec ebp
arpl ax, ax
imul eax
inc bp
xchg ebp, edx
dec ebp
add ebx, eax
inc bp
sub ebp, ecx
shl cx, cl
inc eax
ror bh, 0xe4
inc sp
mov ebp, dword [esi + ebx - 0x5c7]
inc esp
mov eax, esi
dec eax
mul ecx
inc eax
setb bh
inc bp
xor ebp, edi
dec eax
sal edi, cl
add edx, 0xb1ad5531
inc cx
xor ebp, 0xf41c681
mov dword [0x948d48cc], eax
mov ecx, 0xff37b8bc
inc cx
neg ebp
jmp 0x10ce9e9d
Function at 0x10d55227
Capabilities:
Encode data using base64

Disassembly:
inc ecx
not dl
add ecx, ecx
imul ecx, ecx
push ecx
not al
btc ecx, ecx
adc cx, cx
shr ecx, 0x1b
or dl, al
mov word [ebp + ecx*2 - 0x3c], dx
lea eax, [ecx + ecx + 0x221c07b5]
not ax
lea edx, [ecx + ecx*2 - 0x3afc38d4]
mov ecx, dword [edi + ecx - 0x23]
xor ecx, ebx
rol ecx, 1
neg edx
xor ecx, 0xc9388d22
imul eax, eax
mov dword [esp + edx*2 - 0x75f870ea], edx
shr ax, 0xef
rol ecx, 2
mul edx
sbb ax, 0xcf01
lea ecx, [eax + ecx + 0x2cc80220]
xor ebx, ecx
or eax, edx
dec al
adc esi, ecx
movzx ecx, word [esp + eax*4 - 0x7b75dbf3]
dec byte [esp + eax - 0x1edd76fc]
movzx dx, byte [ebp + eax*2 - 0x3dbaedf8]
sar al, 0xc1
cwde
sbb cl, cl
mov cl, byte [eax + ebp - 0x76fa]
sbb eax, 0x2725e1b6
pop eax
not dl
inc eax
ror ax, 0x4d
not cl
or dl, cl
add eax, dword [esp]
mov word [ebp + eax*2 - 0x7401a208], dx
movsx edx, byte [esp + eax - 0x3a00d106]
shl eax, 0x98
dec eax
movzx ecx, word [edi + eax*8 - 0x2ffffffe]
jb 0x118f2432
inc ecx
mov ecx, 0x2608ae86
inc ebp
movsx edx, cx
inc dx
mov eax, dword [ebp + ecx*2 - 0x4c115d0c]
inc ebp
movzx esp, cx
dec ebp
bts ecx, edx
dec ecx
lea ebp, [esp + ebp - 0xae84]
dec edi
lea ebp, [esp + edx*8 - 0x6dc387c]
inc ecx
mov ecx, ebp
dec edx
lea ebx, [ebx - 0x2ba19]
dec edi
lea eax, [edx + 0x471b919b]
dec eax
add ecx, 0x9e2a330c
dec ebp
btr edx, esp
inc ebp
movzx esi, byte [esp + ebx - 0xae86]
inc ecx
mov esi, ebp
neg esi
dec ebp
btr ecx, edx
inc ebp
xor dh, bh
inc ecx
imul esi, ebp
inc ecx
inc dh
inc bp
btc ebp, eax
inc ecx
not dh
inc ecx
push ebp
inc edx
and byte [esp - 0xae83], 1
je 0x11172d36
inc ecx
xor dh, 0x17
inc edx
add dword [esp - 0xae86], 0x4c306d91
inc ecx
not dh
inc bp
imul ecx, ecx
inc ecx
movzx edi, al
inc ebp
cmovae ebp, esp
inc ecx
inc dh
inc ebp
xor ah, ah
inc ecx
sub cl, 0xa9
inc ecx
push ebp
inc ecx
xor dh, 0x83
inc ecx
inc dh
dec edx
lea edx, [ecx + edx + 0x38037904]
dec eax
and ecx, esi
inc ecx
xor dh, 0x1e
inc cx
sal edx, cl
inc ecx
setne cl
dec ecx
sub ecx, 0xe1182eb1
inc ecx
ror dh, 1
inc ecx
neg dh
dec ecx
inc esp
inc ecx
pop eax
dec eax
ror edx, 0x3c
inc ebp
xor bh, dh
dec ecx
shr esp, cl
push ecx
dec esi
lea esi, [esp + esi + 0x10]
inc bx
mov dword [esi - 0x15c0], eax
inc edx
not byte [esp + ecx - 0x44f03f45]
dec edx
lea ebx, [ebx - 0x15c4]
call fcn.118e0d85
add dword [esp + edx*8 - 0x18c], edx
mov dword [ebp + edx - 0x36], eax
call fcn.10cf92a3
call fcn.10cfbae1
sub edi, 4
mov edx, 0x892d7fb6
mov eax, dword [edi]
lea ecx, [edx*8 + 0x48b0e88e]
sal dl, 0xe3
sar ecx, cl
xor eax, ebx
imul dx, dx
dec ecx
bt ecx, edx
xor eax, 0x3337daaf
lea eax, [edx + eax - 0x4e838adf]
add dl, ch
xor ecx, ecx
ja 0x118d380e
rol eax, 1
ror edx, 0xf7
bswap eax
xchg edx, ecx
and dx, dx
dec eax
add dx, cx
sub ecx, edx
bswap eax
xchg edx, ecx
inc eax
ror eax, 1

Function at 0x10d5afc8
Capabilities:
Encode data using base64

Disassembly:
adc esi, eax
mov dword [esp + ecx*4 - 0xbac0], edx
sar dword [esp + ecx*4 - 0xbac0], 0xb7
or byte [esp + ecx*2 - 0x5d5e], ch
lea edi, [ecx + edi - 0x2eb1]
lea eax, [edx*4 + 0x410e75bf]
jp 0x1117b25e
Function at 0x10d5d5f1
Capabilities:
Encode data using base64

Disassembly:
sbb edx, eax
xor eax, ecx
cwde
bswap edx
cbw
lea eax, [ecx*4 - 0x7ac5e760]
neg edx
push eax
xor ebx, edx
shr dword [esp + ecx - 0x40ad6104], 0xc7
mov dword [esp + ecx - 0x40ad6100], 0x65ac87b1
pop ecx
mov dword [ebp + ecx*2 - 0x21fbe74], edx
and ecx, 0xe42e6e8f
inc eax
imul cl
lea ebp, [ebp + ecx*4 - 0x393826]
shr ecx, cl
sub byte [esp + ecx - 0x726], ch
cdq
pop ecx
jnp fcn.10ce0aa7
Function at 0x10d5ee8e
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x77
mov bh, 0xfd
lodsd eax, dword [esi]
dec esi
call 0x825779b9
rcr dword [ecx + 0x719d602d], cl
mov al, byte [0xab74a691]
pop esi
xchg ecx, eax
mov eax, 0xd6469b84
ret 0xa783
push 0x4e005080
dec eax
sar dword [esp + 0x10], 0xed
inc ecx
and edx, 0xff
ror dword [esp + 0x13], 0x6d
inc esi
mov edx, dword [esi + edx*4]
jb 0x111ac641
mov al, byte [0xcf59277e]
xlatb
inc esi
lodsb al, byte [esi]
push edi
pop esp
xor al, ch
push 0x2e44e6ec
xor al, ch
push edi
jae 0x10d5ee53
sub byte ss:[esi + 0x4995c72a], al
insb byte es:[edi], dx
test al, 0xcb
xchg edi, eax
mov dword [esi], eax
pop ebx
insd dword es:[edi], dx
pop edi
and al, dh
lodsd eax, dword [esi]
stc
lodsd eax, dword [esi]
xor ch, byte [esi]
or al, 0x44
or eax, 0x76cef308
pop ss
inc ebx
push edx
outsb dx, byte [esi]
arpl word [edi], ax
and byte [ecx], ch
cdq
sbb cl, byte [edx - 0x26]
jo 0x10d5eed9
pushfd
invalid

Function at 0x10d672b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jl 0x10cfea22
ror eax, 1
lea eax, [edx + eax + 0x1d964d8f]
not ecx
sal edx, 0x1e
sbb edx, 0x2d0b74a2
xor eax, 0xea07428f
dec edx
not eax
neg eax
rol edx, 0x62
and dl, 0x92
rol edx, cl
not eax
bts ecx, ecx
ror ecx, cl
rol eax, 1
dec ecx
sub dx, dx
xor ebx, eax
xchg dword [esp + ecx - 0x6d1d703c], ecx
sar byte [esp + ecx - 0x557cc752], 7
ror byte [esp + ecx - 0x557cc755], 0xa1
adc esi, eax
pop ecx
pop edx
pop edx
jmp fcn.10ce0aa7
call 0x1118760b
mov ecx, 0x81328730
mov eax, dword [ebp]
push ecx
mov edx, 0x969bc4a3
mov edx, dword [ebp + 4]
mov dword [eax], edx
movzx eax, byte [esp]
mov ecx, dword [edi + eax - 0x34]
cwde
mov dword [esp + eax - 0x30], eax
cdq
lea edi, [edi + eax - 0x34]
xor ecx, ebx
push eax
mul dword [esp + eax - 0x2c]
inc ecx
div eax
lea edx, [edx*8 + 0x1e1e84a2]
xor eax, edx
neg ecx
or word [esp + eax - 0x1e1e84a0], dx
rol word [esp + eax*2 - 0x3c3d0945], 0xec
cbw
dec ecx
inc edx
xor ecx, 0x508d919c
xchg byte [esp + eax - 0x1e1effa3], dl
jmp 0x11175687
xor ebx, ecx
push edx
bts eax, 7
add esi, ecx
shl word [esp + eax - 0x1e1eff9c], 0x28
jae 0x118fb66c
lea ecx, [ecx + eax - 0x1f03b8f4]
bswap ecx
inc ebp
bt eax, eax
inc ecx
push edi
push eax
mov ecx, dword [eax + ebp - 0x1e1eff9b]
shr dx, 0x49
setb al
lea edx, [esp + eax - 0x1e1efea8]
jbe 0x10ce0ee5
xadd byte [esp + eax - 0x1e1efef8], ah
mov dword [edx + eax*2 - 0x3c3d4600], ecx
jbe 0x10cdb93d
call fcn.118c53b4
mov eax, 0xe039962f
dec eax
cdq
dec esp
lea eax, [eax*4 + 0xb3c8c98]
dec eax
lea ebx, [ebx + edx*2 - 4]
cdq
dec esp
lea esp, [edx + eax*4 - 0x497628f9]
mov ecx, dword [ebx]
dec ecx
rol esp, 0xbb
inc ecx
movzx esi, al
inc esp
mov ebp, esi
inc ecx
xor ecx, edi
bswap ecx
cwd
cwd
xor ecx, 0x18bac298
inc ebp
movsx edx, sp
rol ecx, 1
dec ecx
ror edx, 0xf7
jae 0x118f08a1
pop edi
cwde
add dh, cl
adc dh, dl
salc
cld
jl 0x118fb6ce
pop eax
dec ebx
adc dword [ecx - 0x4d], ebx
and dword [ebx - 0x6eeef1f0], 0xffffffeb
push ebx
fist dword [eax]
push cs
adc ecx, edi
retf
Function at 0x10d68863
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], eax
mov eax, dword [ebp]
dec byte [esp + 2]
inc dword [esp]
mov ecx, dword [ebp + 4]
call fcn.10d3ed60
call fcn.118d59e6

Function at 0x10d6ab7e
Capabilities:
Encode data using xor

Disassembly:
dec byte [esp + 7]
xor ebx, eax
rol cl, 0xa6
mov dword [esp], edx
adc esi, eax
not dx
movzx eax, byte [esp + 0xc]
mov eax, dword [edi + eax - 0x2c]
mov dword [esp + 8], ecx
xor word [esp + 4], dx
dec ecx
xor eax, ebx
dec eax
ror cx, 0xa1
ror eax, 2
shl ecx, 0x72
neg dl
bswap eax
pop edx
xchg byte [esp + 4], cl
rol edx, 0xee
dec eax
push edx
shl cx, 0xa1
xor ebx, eax
call fcn.111a8bba
mov esi, 0x39643c44
inc esi
dec ebx
fldcw word [ecx]
inc ecx
xchg edi, eax
mov edx, 0x99a97327
mov dword [edi - 0x2654d846], edx
adc dword [ecx - 0x69], ecx
mov edx, 0xf9b17b27
adc dword [edi + 0x70bf27ba], 0x44216144
mov edi, 0xd39018cf
leave
loop 0x10d6ab82
push ss
std
mov ebp, dword [ebx]
mov ebx, 0xc75e28fd
call 0x471d88fd
mov byte [edx + 0x47], bl
cmc
stosb byte es:[edi], al
inc esi
sub dword [edi], esi
das
cmp dh, al
shr edi, cl
and dword [edx - 0x43], ecx
sti
retf