joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc7dc68
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
bts edx, eax
sal dword [esp + eax*2 - 0x6d7382a4], 0xdc
add edi, ecx
add dword [esp + eax - 0x36b9c14e], edx
push eax
lea ecx, [eax + eax*2 + 0x6985150a]
pop ecx
pop edx
pop ecx
pop ecx
jno fcn.0117f4d6
inc ecx
push ecx
call fcn.0130bb5e
lea ecx, [ecx + edx*4 + 0x77b533f4]
rol dx, 0xea
not ecx
sar al, 0x24
rol dword [esp + edx*8 - 0x189b0], 0x69
ror byte [esp + edx - 0x3136], 0x45
ror ecx, 1
dec edx
xor ax, 0xb609
xor ebx, ecx
div dword [esp + edx*2 - 0x626a]
add esi, ecx
not word [esp + eax - 0x10bb2]
lea ecx, [eax*4 - 0x3dcead71]
mov di, word [edi + edx - 0x277e6f6e]
sar dword [esp + eax - 0x10bb2], 0xf7
pop eax
jne fcn.011b0a0e

Function at 0xc80070
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
and dword [esp + 0xb], 0x8413dd80
rol eax, 1
jmp 0xcb53cc
push ecx
btr cx, 0xa5
lea esi, [ecx + esi - 0x4d43341d]
push edx
mov dword [esi + edx - 0x43000a8f], eax
jae 0xd6f407
sal dword [esp + 0xa], 0x49
bswap eax
jnp 0xcb3c67
xor ebx, eax
jmp 0xcbc395
jmp 0xccc18d
add ebp, eax
call fcn.00ceda83
pop ecx
pop eax
jae fcn.00cab190

Function at 0xc8763b
Capabilities:
Encode data using xor

Disassembly:
mov dword [0xe9597925], eax
invalid
hlt
xor edx, ebx
call fcn.0121957f
mov ecx, 0xe4b8672a
push ecx
mov eax, dword [ebp]
shl dword [esp], 0xff
movzx edx, cx
or word [esp + edx*8 - 0x3394f], dx
lea ebp, [ebp + edx*8 - 0x3394c]
xor eax, ebx
neg ecx
bswap eax
call fcn.00c92dd2
aad 0x86
sbb al, 0x3f
fcomp dword [edi + 4]
aam 0xe9
inc ebp
jns 0xc87656
xchg esp, eax
aam 0xb1
invalid
adc esp, dword [eax + 0x36]
dec esi
sbb dword [ecx - 0x78], ebx
and dh, byte [ebx + 0x298aecf5]
xor dword [edi - 0x7a8c9015], esp
out 0x59, eax
jl 0xc87632
test dword [ecx], ebx
jmp 0xc87638

Function at 0xc8dba0
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sbb edx, 0x2ea659af
inc dword [esp + 0xc]
ror cx, 0xc6
not edx
bt ecx, 0xae
mov dword [esp], ecx
dec edx
add dword [esp + 4], 0x3183a2ac
jle 0x130b1fe
Function at 0xc90cd6
Capabilities:
Execute syscall

Disassembly:
lea esp, [esp + 0x10]
jne 0x11a9fbe
mov eax, 0xba349d8c
movzx ebx, ax
sub ebx, eax
pop ebx
not ecx
mov eax, 0xf7adab91
call fcn.011d237c
dec ecx
imul ebp, edi
dec eax
cdq
dec eax
adc edx, ebx
jmp edx
inc esp
movsx edx, dx
xor dword [esp + eax*2 - 0x128], ebp
dec edi
lea ecx, [edx + edx + 0x19bafa14]
add dx, 0xb526
inc ecx
pop ecx
shr si, 0xa1
inc ebp
mov edi, ebx
dec eax
arpl bp, bp
dec eax
add ebx, ebp
dec ecx
mov ebp, dword [ebx + edi - 0x6c1fc9d2]
inc ebp
movzx ebp, ah
dec ebp
xadd esi, esp
inc cx
inc ebx
inc dx
mov ecx, dword [edi - 0x4da80407]
dec ecx
lea edi, [esp + edi - 0x4da80405]
call fcn.00d2cee5
mov ecx, 0x5fb31f19
lea ecx, [ecx + ecx - 0x46d73ecb]
mov edx, dword [esi + ecx - 0x788eff67]
or ecx, ecx
rol ecx, cl
movsx eax, cx
mov ecx, dword [ecx + edx - 0x477fb3bc]
movzx edx, ax
shl edx, 0xb6
jnp 0x125768a
mov dword [esi], ecx
mul dx
mov ecx, dword [ebp]
imul dl
rol dx, 0xe5
adc ebp, 4
xor ecx, ebx
div eax
jmp 0xd92c3d
dec ecx
neg edx
sal eax, 0x5f
jne 0x126929a
sysenter
call fcn.0132e93d
pushal
ret 0x5f0d
mov ebx, 0xb59a9c3f
sar bx, 0x49
call fcn.014c8fd8
inc ecx
mov ebp, dword [eax]
inc ecx
mov esp, 0xd9319694
dec ecx
btr esp, 0xb4
dec ecx
adc eax, 4
inc ecx
xor ebp, ecx
inc ecx
movsx esi, sp
inc ecx
movzx eax, ah
rol ebp, 3
dec eax
cdq
inc ecx
mov esi, 0x4da8040e
bswap ebp
inc ecx
shr ah, 0x21
dec esp
lea ebx, [eax + edx + 0x6c1fc93e]
dec ebp
inc ecx
bts esi, edx
dec si
dec eax
cwde
neg ebp
inc ecx
push ecx
bts esi, edx
jb 0xceff19
add dword [edx - 0x42], ebp
loop 0x11aa04a
sub al, 0x14
inc edx
outsd dx, dword [esi]
sti
movsd dword es:[edi], dword [esi]
stc
sbb byte [edi - 0xe], ah
pushal
jg 0x11aa065
stosd dword es:[edi], eax
test al, 0x88
les ecx, [ecx - 0x516c80c4]
rcr byte [esi + 0x1394f974], 1
pop ecx
ret
push ds
pop esi
mov ebp, 0xbca64040
bound ebx, qword [eax + 0x54]
dec ebx
jg 0x11aa0b1
add edx, dword [ebp + 0x67]
les ebx, [ebx]
leave
test al, 0x76
stosd dword es:[edi], eax
out 0x20, al
jge 0x11aa017
push ebx
adc eax, 0xed87596e
push esp
xchg ebx, eax
jmp dword [ebx - 0x9c7c255]
fsub st(3), st(0)
imul edi, dword [0x2d1caf71], 0xb6ad0d1
dec ecx
call [ebx]
inc esi
and eax, 0x96da1954
mov dword [eax], 0x6fe425f
cmp al, 0xf4
invalid
ror ecx, 1
inc al
cwd
xor ecx, 0xc884800c
neg edx
bt dx, 0x33
inc ecx
btr ax, 0x8c
bswap ecx
xor ebx, ecx
mul edx
neg edx
add edi, ecx
shl ax, 0xc4
mov ecx, 0xc3a97880
cwde
adc eax, edi
jmp eax

Function at 0xca55d9
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
add esi, ecx
bt edx, edx
pop eax
pop ecx
jae fcn.00cb9d91
Function at 0xcae3f5
Capabilities:
Encode data using xor

Disassembly:
pop edx
not edi
mov esi, ebp
movzx ebp, bx
pop ebx
pop edi
bswap ebp
movzx ecx, bp
pop ebp
movsx edx, cx
mov eax, dword [ebp + ecx]
lea ebp, [ebp + ecx + 4]
shl cl, 0xe6
xor eax, ebx
inc ecx
bt edx, 0xb1
lea ecx, [edx + edx*4 + 0x3d91c31b]
ror eax, 1
lea edx, [edx*8 - 0x595a3c45]
bswap eax
ror cx, 0x63
or ecx, 0x45199fac
jno 0x130b8e2
inc ecx
mov edx, dword [eax]
dec ecx
add eax, 4
inc ecx
xor edx, ecx
not edx
rol edx, 1
inc ecx
mov ebx, 0x5a24941a
call fcn.011f3f02
out 0x36, al
mov esi, edx
xchg dword [edi + 0x471ce579], eax
lahf
or esp, esp
mov ebx, fs
leave
in al, dx
xchg edx, eax
out dx, eax
cmp byte [ebx], 0x19
push ss
movsb byte es:[edi], byte [esi]
mov eax, 0x6d97bc10
sbb al, 0xcb
pop ds
xchg edx, eax
inc ecx
and al, 0x47
dec ebx
dec edx
and edx, dword [edx + 0x7b]
sub ebx, dword [edi + 0x6df8b4ee]
jle 0xcae43f
invalid
xor cx, cx
ror eax, 2
bts dx, dx
or edx, edx
jno 0x13036ab
xchg edx, ecx
lea edi, [edi + edx - 0x6449af7c]
mov eax, dword [edi + edx - 0x6449af78]
ror edx, cl
xor eax, ebx
lea edx, [edx + ecx - 0x266ea4c2]
xor dx, cx
sets cl
dec eax
shl edx, 0x72
bswap eax
push ecx
rol eax, 1
lea edx, [ecx + edx*8 + 0x118ba589]
bswap edx
xor eax, 0x6e8127ac
imul edx, dword [esp]
neg eax
sal ecx, 0x1f
shl dx, 0xe8
xor ebx, eax
ror word [esp + ecx + 1], 0xc7
call fcn.011e9db4
dec eax
xor ecx, ecx
xor ebx, eax
xadd edx, ecx
adc edx, 0x4f2e0bb9
jnp 0x12bf5a1
adc edi, eax
sal edx, 0x5d
jmp edi
dec eax
jmp 0x122d877

Function at 0xcaf5ed
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
adc word [esp + 6], 0xa512
shrd edx, eax, cl
mov ecx, dword [esp + 4]
rol cl, 0x63
adc cx, cx
mov dword [ebp + ecx - 0x3593a583], edx
mov eax, ecx
imul cx, ax
mov eax, dword [esi + ecx*2 - 0x6b264212]
movsx edx, cl
lea esi, [esi + edx*2 - 0xe]
mov dword [esp + ecx - 0x35932109], ecx
xor eax, ebx
shl cl, 0x47
sar edx, 0xa5
rol eax, 1
xor eax, 0xa724523a
not dword [esp + ecx*2 - 0x6b264300]
ror eax, 2
sub dword [esp + ecx - 0x3593217c], ecx
xor dl, dh
inc edx
bswap eax
xor ebx, eax
rol cx, 0x45
adc edi, eax
btr dx, cx
jae 0xcf4693
mov dword [esp + edx - 1], edi
ret 4

Function at 0xcc600e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + ecx], 0xf716c93b
sal dx, 0x4b
mov ax, word [ecx + esi]
mov dx, word [ecx + esi + 2]
push ecx
call fcn.012f6177
sub edi, 1
mov ecx, 0xb6a86cb6
call fcn.00d6a6c2
btr edx, edx
adc dx, dx
sbb eax, 0xc71badaf
mov ecx, edx
and edx, 0xc40a2220
bswap eax
ror cx, 0xa4
neg cx
neg eax
btr edx, ecx
inc edx
adc ecx, 0xf79cf8b6
lea eax, [eax + edx*8 + 0x7a206286]
bswap eax
shr ecx, 0x4d
call fcn.014c69d0
Function at 0xcc61c9
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi], eax
mov dword [esp], edx
mov edx, dword [ebp]
add ebp, 4
xor edx, ebx
dec edx
call fcn.012e985b
sub edi, 4
mov edx, dword [edi]
xor edx, ebx
mov eax, 0x5bb7c839
sub edx, 0xd8815b8c
mov ecx, 0x5729788d
rol edx, 1
not edx
neg eax
and ecx, ecx
xadd al, ah
ror edx, 1
sub ax, 0x8c29
dec edx
rol al, 4
adc ecx, ecx
adc eax, 0xd60a6da0
xor ebx, edx
push ecx
sar ecx, cl
neg dword [esp + eax - 0x7a52a8fd]
add ebp, edx
sal word [esp + eax - 0x7a52a8fc], 0x66
mov eax, dword [eax + esi - 0x7a52a8fd]
rol dword [esp], cl
rol cl, 0xc1
mov edx, dword [esi + 4]
not ecx
lea esi, [esi + ecx*4 - 0x4c]
or cx, cx
ror dword [ebp + 0x66b48e74], 1
or ecx, ecx
rol byte [esp + ecx*4 - 0x4f], 0xe3
call fcn.00db732a
xor byte [edi], bh
sahf
mov fs, word [eax - 0xd566630]
lahf
clc
sbb esp, ebx
fbld tbyte [ebp + 0x42de18b5]
pushal
push ecx
les esi, [ecx - 0x560127e1]
dec edi
jecxz 0xcc6242
inc edx
add cl, cl
add ah, byte [ebx + 0x40]
pushal
int3
Function at 0xcce460
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx*4 - 0x198d8], eax
xor ebx, edx
shr ecx, 0x99
adc edi, edx
sub dword [esp + eax - 0x702c6e17], 0xcb042e32
cbw
movzx edx, word [esp + ecx*4 + 2]
movzx dx, byte [ebp + eax - 0x702c001a]
and cl, 0xa6
add al, ch
btc eax, eax
or cl, byte [eax + ebp - 0x742c0018]
lea ebp, [ebp + eax - 0x742c0018]
rol dword [esp + eax - 0x742c0017], 0x32
and dword [esp + eax - 0x742c0019], eax
shr dl, cl
movzx ecx, al
neg al
shl ax, 0xa1
mov word [ebp + eax - 0x742c01cc], dx
push eax
jg 0x11fdb2a
clc
or bl, byte [eax]
pop edi
sbb eax, 0xe91caeda
mov eax, 0x5136619
arpl word [ecx + 0x33], cx
sbb byte [edi], dh
inc ebp
sub al, cl
in eax, dx
cmp bh, byte [ebp - 0x7e1719b8]
mov ebp, ss
sbb dword [edx], ebx
mov ds, ebx
pop ebp
mov eax, 0x6ecfe9dd
push ecx
adc eax, dword [edx]
xor al, 0xfa
jp 0xcce4ee
fucomp st(1)
iretd
and bl, byte [edx]
lodsb al, byte [esi]
jge 0xcce576
sbb dword [ebx - 0x3cc207ae], esi
in al, dx
jmp 0xec5ea455
dec edx
adc bl, byte [eax + 0x4d87b26e]
dec eax
xor ebp, dword [eax]
clc
jmp 0xcce5ca
add edx, dword [ecx + 0x1c]
mov dword [0xee64c1b1], eax
xor al, 0x4e
invalid
mov dword [esp + ecx - 0x1a], edi
ret 8
Function at 0xccf627
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
btr edx, ecx
mov dword [esp + ecx - 0x80000000], ecx
adc edi, eax
mov ax, word [esi + ecx - 0x80000000]
or dword [esp + ecx - 0x7ffffffa], ecx
lea esi, [esi + ecx - 0x7ffffffe]
jae 0x12c2e8b
mov eax, 0x1e0afd9d
mov esp, esi
movsx ebp, al
mov edx, 0x3495348e
pop ebp
mov esi, edx
cwde
pop ecx
sar edx, 0x77
pop edx
cbw
popfd
lea esi, [eax + eax*2 + 0x7311519f]
cbw
pop esi

Function at 0xcd853d
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + edx - 0x43a78fa1], 0xb712fea2
mov dword [edx + esi - 0x43a78fa1], ecx
pop ecx
rol ecx, 0xfc
sar ecx, 0x13
lea ebp, [ebp + ecx*4 - 0x15bc]
call fcn.012c55b7
mov eax, 0xb7b1cab8
jmp 0x11be2e8
mov ebx, esi
mov eax, 0xc1a9cc8a
mov ecx, eax
mov ecx, 0
add eax, eax
not ax
mov edx, 0x8c1e2782
sub ebx, ecx
mov edx, 0x2891a3bb
lea edx, [edx + edx*2 - 0x7ce8d941]
lea edi, [0xd3afc5]
mov ecx, dword [esi]
inc edx
lea edx, [edx + edx*4 - 0x1d72dfee]
lea eax, [edx*2 - 0x48c90b6f]
lea esi, [esi + eax - 0x5c49e81b]
mul dx
xor ecx, ebx
dec ecx
add edx, 0x14ec36
imul ax
mov eax, dword [esi]
mov ecx, 0xfa2f5db8
mov ebp, 0xa1b11014
add esi, 4
xchg esi, eax
mov ebp, eax
rol ecx, 0xa5
jb 0xd3afab
Function at 0xcf485b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
imul dx, dx
xor bl, al
mov dword [esp + ecx + 4], ecx
pop edx
movzx edx, cl
lea eax, [esp + eax + 8]
mov dword [esp + ecx*2 + 4], 0x51190922
add edx, dword [eax + ecx]
lea esi, [esi + ecx*8 - 4]
mov dword [esi + ecx*2], edx
lea edi, [ecx + edi - 4]
mov edx, dword [edi + ecx]
xor edx, ebx
sub ecx, ecx
movzx eax, word [esp + ecx*2 + 4]
inc edx
call fcn.012d7bc7

Function at 0xcf4895
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
mov dword [esp + ecx*2], edx
neg eax
btc edx, 0x8a
sar edx, 0x1b
lea eax, [ecx + eax + 0x30bea520]
ror ecx, 0x5f
btr dx, dx
sal edx, 0xce
xor ebx, eax
mov byte [esp + ecx*8], cl
add edi, eax
imul edx, edx
pop edx
jno fcn.00cab190
mov eax, 0x49b8b091
mov ecx, eax
movsx edx, cx
mov edx, dword [eax + esi - 0x49b8b091]
lea esi, [esi + ecx - 0x49b8b08d]
sub al, cl
not ecx
jbe 0x131f562
movzx ecx, byte [ebp + eax - 0x49b8b000]
sub ax, ax
lea ebp, [ebp + eax - 0x49b7ffff]
or al, 0x87
xor cl, bl
shl eax, 1
xor eax, eax
sar eax, 0x7c
sbb cl, 0x21
bts eax, eax
xor cl, 0xbe
not eax
or eax, eax
sar eax, 0x8d
sub cl, al
rol eax, 0x37
push eax
xor cl, 0xaf
or dword [esp], eax
xor bl, cl
add dword [esp], eax
lea ecx, [esp + ecx + 4]
mov dword [ecx], edx
cwde
shr eax, 0x3b
mov eax, dword [ebp + eax*2 - 0x3e]
adc ebp, 3
xor eax, ebx
not eax
xor eax, 0xa5be5b27
mov ecx, 0x4483fe3b
call fcn.0113f0b8
sar word [esp + 0xa], 1
shrd edx, eax, cl
sar dword [esp + 8], 0x46
mov ecx, 0xc80a992e
mov eax, ecx
mov dword [ebp], edx
mov dword [esp + 4], ecx
pop edx
pop edx
pop eax
jmp esi

Function at 0xcfc257
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esi
mov esi, 0x230b0395
pushfd
neg si
push ebp
dec esi
movsx ebp, si
lea edi, [esp + esi - 0x230bfc76]
sal si, 0xe5
lea esi, [edi + esi - 0x230b8e2c]
sub ebp, ebp
neg bp
push ebp
adc dword [esp + ebp*2], eax
movzx eax, bp
sal ax, 0x8a
push ecx
cbw
add ebp, dword [esp + ebp*2 + 0x1c]
or eax, eax
movsx ecx, ax
ror ebp, 1
btc cx, 0xa1
sal cl, 2
adc ebp, 0xa1382c19
bswap ebp
lea ebp, [ebp + eax*2 + 0x468d86b6]
ror ebp, 1
jmp 0x114460d
mov dword [esp + ecx*2 - 0x10], eax
rol ecx, cl
jne 0xc7ddab
mov edx, 0x7c82b7b7
call fcn.00da32ae
imul eax, ecx
xor eax, 0x2c2f0b04
lea ebp, [eax + ebp - 0x4d4c912b]
push ebx
mov eax, 0
and cl, 0xe
jnp 0xda030e
Function at 0xcfcec2
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0x57c0779a], ecx
not ecx
movzx ax, byte [esi + eax - 0x2a90861]
mov cl, byte [esi + 2]
mov edx, 0xcfabcfa0
jmp 0x128c9a9
mov dword [esp + eax - 0x5ba621a4], ebp
add esi, 2
not dl
and dl, byte [esp + 5]
sal al, cl
xor dword [esp + 4], 0x2d39da3b
mov word [esi], ax
inc esp
add byte es:[ebx + 0xf042444], cl
mov dword [esi], edi
pop esp
mov cl, 0xff
mov eax, dword [esp + 4]
jns 0xda260c
bound edi, qword [edi - 4]
push ds
xor byte [edx - 0x4d], bh
jle 0x128c9c4
mov bl, 0x7e
in eax, dx
xchg edi, eax
mov cl, 0x30
inc esp
call 0x1968875b
loopne 0x128c9c1
jge 0x128ca03
and esp, dword [edx]
in eax, dx
invalid
adc ebp, dword [ebp - 0x17ecdce8]
add ebp, dword [eax + ebp*8 + 0x4af25a66]
add dword [edx + 0x76], ebx
aam 0x56
shl byte [eax], cl
jl 0x128ca59
add dword [eax], 0xdb0783a9
inc ecx
stc
mov byte [esi + 0x606ac121], al
mov gs, word [0x3b158ce8]
out dx, al
mov al, 0x1b
jp 0x128c9d4
cwde
sub al, 0xe8
int3
push 0x32
dec esp
push ecx
mov edi, dword [ebx - 0x3f]
in eax, dx
mov esp, 0x2907af1b
int 5
sbb esi, edi
or al, 0xc
add al, 0x23
movsb byte es:[edi], byte [esi]
push ecx
arpl sp, di
or dh, byte [ebp - 0x65]
jb 0x128ca8f
inc eax
cld
or esi, ebx
inc esp
cmpsd dword [esi], dword es:[edi]
add eax, 0xa4d30c49
dec edx
sbb byte [ebx - 0x5ff2ed41], dh
stosb byte es:[edi], al
inc dword [edx - 0x73]
ret
invalid

Function at 0xd0d325
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + ecx*2], 0x3e33d43c
bswap eax
dec dl
xor byte [esp + ecx + 3], dh
jge 0x127f448
cli
or al, 0x9d
and byte [ebx + edi*4 + 0x43e43dc3], 0x6e
add esi, eax
call fcn.0118a499
xor ebx, eax
jmp 0x1255f3b

Function at 0xd1c02e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
adc ebp, 4
call fcn.012d6ab2
mov ecx, 0x2fa14609
movsx eax, cx
mov edx, dword [ebp + ecx - 0x2fa14609]
cwde
lea ebp, [ebp + eax - 0x4605]
shr cl, 0x44
xor edx, ebx
dec edx
bts cx, cx
adc eax, eax
ror edx, 2
btr cx, 0xb4
neg edx
rol ecx, cl
jae 0x12d6b7e

Function at 0xd48366
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
adc eax, edx
not word [esp + 6]
mov dword [ebp - 4], eax
call fcn.013324ff
Function at 0xd4a8f1
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Manually build aes constants

Disassembly:
mov eax, ecx
mov eax, dword [edi]
mov dword [esp], 0xe8b9802e
btr ecx, 0xb
xor eax, ebx
sub dl, byte [esp + 3]
rol dword [esp + 3], 0x5f
neg eax
call fcn.015ab4e7
mov ebp, 0x1014ae38
inc esp
movsx ebp, ch
inc esp
movzx ebx, bp
inc ecx
mov esi, dword [eax + ebp*2 - 0x20295c70]
dec ecx
lea eax, [ebx + 0x3423c620]
inc ebp
inc esp
bts eax, ebp
dec esi
lea eax, [ebp + eax - 0x1014ae35]
movsx edx, al
inc ebp
movsx edx, ch
inc ecx
xor esi, ecx
bswap esi
bt ax, 0x3a
jb 0x115c9e9
mov eax, 0xa8953309
movsx ecx, ax
mov ecx, dword [ecx + ebp - 0x3309]
sar eax, 0x85
movzx edx, ax
sal eax, 0x97
lea ebp, [edx + ebp - 0xa994]
not eax
sbb edx, eax
xor ecx, ebx
sar eax, 0x6d
or eax, edx
sbb ecx, 0xbd3fe39a
add ax, 0x490
sub dx, dx
not ecx
bswap ecx
sal dx, 0xc2
sbb ecx, 0x61a5915
push eax
btc eax, eax
xor ecx, 0x271c788c
cwd
not dword [esp]
inc dx
not ecx
xchg dword [esp], eax
ror ecx, 2
shr edx, 0x48
jbe 0x14d31b8
and dword [esp + edx*4 - 0x3300000], edx
dec ecx
shl eax, 0xe1
add byte [esp + eax - 0x67fc76df], al
sar al, 0x27
rol ecx, 1
mul edx
lea ecx, [eax + ecx + 0x1f72eeae]
shl ax, 0xed
and edx, 0x2402133e
xor ecx, 0x5000d7b8
lea ecx, [ecx + edx*8 + 0x601ca3a2]
xor ebx, ecx
rol eax, 0x34
cwde
sar al, 0x81
adc edi, ecx
mov si, word [esi + eax - 0x3320]
sal eax, 0xf9
mov byte [esp + eax*2 - 0x7ffffffd], 0x80
shl word [esp + edx - 0x2112d], 0xe1
pop edx
ja fcn.00cab190

Function at 0xd54b63
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov edx, 0xa62c64bc
sub edi, 1
xor dx, 0x388f
movsx ecx, dx
movsx eax, dx
movzx edx, byte [edi + ecx*2 - 0xb866]
mov dword [esp + eax - 0x5c33], ecx
sar byte [esp + ecx*2 - 0xb866], 0x44
ror eax, cl
xor dl, bl
and eax, ecx
neg dl
not ecx
cbw
shl al, 0xc1
rol dl, 1
dec dl
sub word [esp + eax + 2], cx
jbe 0xd94206
and ecx, 0x42b77fbe
not dl
xor bl, dl
imul ecx, eax
cwde
lea edx, [esp + edx + 4]
sal ecx, 0xe3
adc eax, dword [edx + eax*4]
lea edx, [ecx + ecx*4 - 0x63d069d1]
lea ebp, [ebp + ecx*2 - 4]
ror dl, 0xe6
inc word [esp + ecx + 1]
neg cl
mov dword [ebp + ecx*2], eax
call fcn.0114e785

Function at 0xd555a2
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pushfd
pop esi
mov dword [esp], esi
mov esi, 0x4a1bbf09
and esi, 0x7f24ac01
mov edi, esi
mov esi, edx
jae 0x15bcbb3
btc di, di
mov edi, eax
cld
push 0xa60c65b6
rol dword [esp], 0xab
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp]
neg dword [esp + edi - 0x632db530]
movzx esi, byte [esp + edi - 0x632db530]
Function at 0xd574f9
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
inc ecx
ror ebp, 2
dec eax
mov dword [esp + eax - 0x11ef2], ebp
dec eax
xor ecx, ebp
jns 0x12cb588
mov edx, ebx
mov eax, 0x67bd2e2c
jg fcn.00d25f7d
shl edx, 2
or eax, eax
sbb ax, ax
bts ax, ax
mov eax, ebp
jae 0x1278087
jmp 0x15b0a23
je 0xd9d337
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x11d15e1
ror ecx, 2
sub ecx, 0x8e8a323d
call fcn.00d0303d
dec esi
mov dword [esp + edi - 0x3b0c], ecx
dec edx
not dword [esp + edi*4 - 0xec68]
pop ecx
inc edx
rol byte [esp + edi - 0x3b19], 0x23
xor dword [esp + esi*8 - 0x230], edx
push esi
dec esi
mov ecx, dword [esp + edi*2 - 0x7628]
dec eax
arpl dx, dx
dec eax
add ebx, edx
inc esi
xor esp, dword [esp + edi*2 - 0x7632]
dec edx
mov dword [esp + edi - 0x3b1c], ebx
ret 0x10

Function at 0xd62646
Capabilities:
Encode data using xor

Disassembly:
inc ecx
btr edi, ecx
mov eax, 0x15bc8a02
inc eax
not ch
inc cx
not esp
inc esp
xor cl, ch
dec eax
lea ebp, [esp + ebp + 8]
dec eax
mov dword [esp + ecx - 0xaf], esi
inc ecx
mov esi, 0xbd1f0109
not word [esp + ecx - 0xab]
mov cx, word [ecx + ebp - 0xaf]
inc cx
btr edi, esi
dec ecx
sar esp, 0xb8
inc ecx
xor esi, 0x772f4902
dec edx
lea edi, [edi - 2]
inc cx
mov dword [esp + edi], ecx
inc edi
mov edx, dword [eax]
inc ecx
pop esp
inc ecx
mul ah
dec ecx
xchg esp, esi
dec edi
lea eax, [edi + eax - 0x320c009c]
inc esp
xadd al, bl
inc ebp
xor edx, ecx
inc ecx
rol edx, 3
dec esp
lea ebx, [esi*2 + 0x698d52a7]
inc ecx
xor edx, 0xb5999d00
inc bp
add byte [ebp + 0x4566b599], bl
xchg esi, ebx
inc ecx
sar bl, 0x83
inc ecx
movsx edx, bl
inc esp
adc edx, edx
inc esp
sub ch, dh
inc ecx
xor edx, 0x888eb79b
dec edx
lea ecx, [edi*2 + 0x5b0c9a1a]
inc ecx
movzx ebp, dh
inc ecx
not edx
shl si, 0xcd
inc ecx
push ecx
shl dx, 0xa7
dec eax
shl edx, 0x44
not dx
inc esi
xor dword [esp + edi - 0x320c00a0], edx
dec eax
cdq
inc ebp
mov ecx, esi
inc ecx
idiv ch
inc ecx
pop ecx
dec esp
bt eax, esp
dec ebp
arpl dx, dx
dec ecx
imul edx, esp
inc cx
adc ebx, 0x890fc503
adc al, byte [ecx + 0x51]
add byte [ebp + 0x64e8d7dc], dl
les ecx, [edi + 0x544a0534]
inc eax
loope 0xd626c0
jl 0xd62734
add dword [eax - 0x36], edx
mov edx, 0x7acb8a92
mov ch, 0x90
xchg ebp, eax
jmp 0x1c478823
Function at 0xd6f423
Capabilities:
Execute syscall

Disassembly:
sal dword [esp], cl
mov eax, dword [ebp]
lea edx, [ecx + ecx*2 - 0x20d9b67d]
bts cx, 0x8f
xor eax, ebx
neg eax
dec edx
add ecx, 0xfa39426
adc word [esp + edx - 0x6e107c0d], cx
dec eax
dec ecx
xor eax, 0xd4a283bf
not eax
rol edx, cl
pop edx
xor eax, 0xc00bfd3e
lea edx, [edx*4 - 0x52f6c341]
xor ebx, eax
add edi, eax
or edx, edx
bswap ecx
sar dl, 2
mov edx, dword [esi]
mov eax, 0xffbeb51c
inc eax
jb 0x1138d40
pop ecx
pop eax
pop edx
pop edx
jmp ebp
sub ecx, 0x6807fb33
push 0x270c5818
bswap ecx
add ecx, 0x4a8db4bf
mov dword [esp + 0xc], 0x7d041526
inc dword [esp + 0xc]
not byte [esp + 0xe]
xor ebx, ecx
mov dword [esp + 4], 0xf69b361f
sal byte [esp + 2], 0xa3
jp 0x11d9ea0
mov eax, dword [esi + 4]
neg cl
add ecx, ecx
adc esi, 7
mov dword [edx], eax
jmp edi
adc edi, ecx
lea esp, [esp + 0x10]
jmp 0x128dd32
push edi
mov dword [esp], 0xe7dff56e
call fcn.00c93538
push 0xe92669ac
ror dword [esp], 0x8d
mov ecx, 0x25b1ef26
lea ebp, [ebp + ecx*2 - 0x4b63de50]
not ecx
jae 0xcc94d6
syscall
inc ecx
push ebx
dec eax
mov dword [esp], 0x2314957f
call fcn.0126663b
dec ecx
push es
aaa
test eax, 0xed6c650d
aad 0xa9
les ebp, [esi + ebp*2 - 0x395c3257]
lahf
push esi
or al, byte [ebp - 0x71]
wait
test eax, 0x13cbf24a
push esi
or dh, byte [ecx + 0x47]
mov ecx, 0xea3e756
imul edx, dword [esi + 0xe], 0x4c55dde2
sub dword [edi - 0x4220b749], ecx
mov esp, 0x1d9f2229
stosb byte es:[edi], al
cmp al, 0xfd
xor eax, 0x6d5fdfd9
cmp al, 0xa6
aas
inc esp
fsubr qword [ebx]
pop esp
mov dword [0xc0f134de], eax
mov ch, 0xb4
cmc
das
insb byte es:[edi], dx
in eax, dx
rcl byte [esi], cl
adc edx, dword [edi]
arpl word [ebx], cx
push 0xd6ea09d7
scasb al, byte es:[edi]
invalid

Function at 0xd72cc8
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
test ebx, ebx
call fcn.011fc2d9
mov edx, 0x8119a29c
mov ecx, 0xa193a287
and dl, 0x9a
sbb edi, 4
mov ecx, dword [edi]
mov eax, edx
xor ecx, ebx
push eax
sub ecx, 0x9581ec35
cdq
neg dword [esp]
idiv eax
neg ecx
xchg byte [esp + edx*2 + 3], ah
sar dword [esp + edx*4], 0xfb
lea ecx, [ecx + edx*4 - 0x6406b6bc]
sar dl, 0x24
ror ecx, 3
call fcn.00d06518

Function at 0xd72d13
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
cbw
dec edx
bt ecx, 0x17
jb 0x1257e58
and cl, 0x35
bswap edx
mov dword [esp + eax], 0xd79e8821
push ecx
setg byte [esp + eax + 4]
xor ebx, edx
add edi, edx
call fcn.015aa657
xor edx, eax
shr eax, 0xcb
mov dword [esp + edx - 0xbbced72], 0xbb316f16
lea ebp, [ebp + edx*2 - 0x1779dae8]
mov dword [edx + ebp - 0xbbced72], ecx
mov ecx, dword [esi + edx*4 - 0x2ef3b5c8]
cwde
seta al
lea esi, [esi + edx*2 - 0x1779dae0]
call fcn.012e96a4
sysenter
call fcn.012e4371
rcr eax, 1
idiv dh
punpckhdq mm7, mm6
in eax, dx
bound esi, qword [eax]
insb byte es:[edi], dx
out 0xc2, eax
push 0xffffffffffffffa8
pop eax
mov edx, 0x35bc8d12
sbb byte [edx], dh
push ds
pop es
add dh, byte [ebx - 0x1c]
xchg esp, eax
pushal
nop
xor esp, dword [ebx]
adc dl, ch
and eax, 0x95e42c25
lds eax, [edx]
push ebx
mov al, 0x17
pop ebx
adc ah, ah
retf 0x24ed