joyce8/EMBER2024-capa huggingface dataset:
Function at 0x98a794
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, 0xf184f9f
jmp 0x8d85c9
inc ecx
setge dl
add eax, ecx
call fcn.0091c97a
mov eax, 0xc3903889
lea ecx, [eax + eax*8 + 0x498de5b0]
lea esi, [esi + ecx*2 - 0x533fc506]
xor eax, 0x9320a7bc
sal eax, 0x90
mov eax, dword [ecx + esi - 0x299fe281]
push ecx
btr ecx, ecx
xor eax, ebx
call fcn.0088eda7
shr edx, 0x3f
neg eax
sub ecx, edx
xor ebx, eax
btr ecx, ecx
call fcn.0088a6a9
call fcn.00976f49
pushfd
mov dword [esp], 0x2464920c
call fcn.009a586c
imul edx, ecx
mov dword [esp + ecx - 0x766652bf], ebp
ret
not ecx
xor ebx, ecx
sar al, 0xc5
add esi, ecx
sar edx, 0xd0
or edx, esi
jmp edx
dec ecx
shr dx, 0xe
ror eax, 0x7b
neg ecx
not ecx
lea edx, [edx*8 - 0x1ee61c5]
btr ax, dx
lea ecx, [eax + ecx + 0x5468fd59]
inc eax
ror ecx, 1
not dx
and dx, 0x8481
xor ebx, ecx
cwde
add ebp, ecx
jmp ebp
adc eax, eax
lea eax, [eax*2 + 0x59189805]
adc edi, 8
sal eax, 0x46
ror eax, 0x87
mov dword ss:[ecx], edx
sbb ebp, 3
mov ecx, dword [ebp]
lea edx, [eax + eax - 0x60f322d0]
xor edx, edx
xor ecx, ebx
btr ax, 0x3b
neg ecx
xor ecx, 0x8fb708a0
add eax, eax
rol ecx, 2
xor eax, 0x3592263a
jae 0x8e316a
not dl
xor ebx, ecx
sub dx, 0xa286
not ax
rol dx, 0x49
adc ebp, ecx
shr dl, 6
jmp ebp
lea edx, [esp + edx + 4]
sal al, 0x21
mov dword [esp + ecx - 0x7fe99b6], 0x1792a493
or ax, cx
mov ax, word [edx + ecx - 0x7fe99b6]
jae 0x9c009c
mov ecx, dword [edi]
mov eax, 0x23ade422
and al, al
mov edx, dword [eax + edi - 0x23ade41e]
jg 0x96f03a
mov eax, 0xa93f2e22
mov edx, dword [esi]
imul ax, ax
mov ecx, eax
adc esi, 3
push ecx
xor edx, ebx
rol eax, cl
pop eax
sal cx, cl
rol edx, 2
not edx
div cl
xor cl, ah
dec edx
xor eax, 0x76bc20bc
ror edx, 1
xor edx, 0x7e17d8bd
cwde
neg edx
or eax, eax
xor ebx, edx
jmp 0x9b620f
add ebp, edx
mov ax, word [edi + eax - 0x244e]
movzx edx, cl
mov dx, word [edx + edi - 0x42]
or ecx, ecx
xor ecx, ecx
rol ecx, 0x92
adc cl, byte [edi + ecx + 4]
call fcn.008b003c
neg eax
or edx, ecx
ror eax, 2
ror cx, 0x6b
jae 0x8deda1
mov eax, 0xe0b8a391
mov ecx, dword [ebp]
mov edx, 0x763b6627
lea ebp, [ebp + edx - 0x763b6623]
mov edi, 0x439c55a0
xchg ecx, ebp
mul al
mov edi, ecx
lea ecx, [eax + eax*4 + 0x181938a8]
jo 0x89ecec
mov edx, 0x3ebe9508
lea esi, [esi + ecx*2 - 0xffd336e]
pop ecx
not edx
mov word [ecx + esi - 0x1792a493], ax
sbb ecx, ecx
neg edx
jge fcn.00942899
mov edx, 0xad16b48b
and edx, edx
movzx ecx, dl
mov eax, dword [ecx + edi - 0x8b]
mov edx, dword [eax + ecx*2 - 0x116]
mov dword [ecx + edi - 0x8b], edx
mov eax, dword [ebp + ecx*8 - 0x458]
movzx edx, cx
and ecx, 0x81b13fb3
or dx, dx
lea ebp, [ebp + ecx*8 - 0x414]
add ecx, 0xaebeac04
inc ecx
sar cx, 1
xor eax, ebx
xchg ecx, edx
xor eax, 0xebb0aa35
inc ecx
lea eax, [eax + ecx - 0x29045b31]
shl dx, 0x24
setp cl
jb 0x8ce38d
mov eax, 0xcab59d07
mov dx, word [edi]
mov cl, byte [edi + 2]
add edi, 2
rol al, 0xe1
setae al
shr dx, cl
mov word [edi], dx
mov ecx, eax
movsx edx, ax
mov ecx, dword [esi]
rol edx, 0xc1
adc eax, edx
sbb dl, 0x19
adc esi, 3
rol eax, 0x75
rol dl, 7
not al
xor ecx, ebx
jmp 0x8edd34
Function at 0x98e8e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
adc ecx, 0xfffa3cb4
jmp ecx
shld dx, ax, cl
mov word [edi], dx
add word [esp], 0xb41d
sbb ebp, 3
mov eax, dword [ebp]
pop ecx
movzx edx, cl
add ecx, ecx
xor eax, ebx
xor ecx, ecx
xor dl, cl
xor eax, 0x5b02f6ba
rol eax, 3
xadd edx, ecx
dec dx
add cl, ch
neg eax
sub ecx, edx
btc ecx, 0x2f
jae 0x8e94db
mov edx, 0xc8176616
mov ecx, edx
mov edx, dword [esi]
add esi, 4
shl ecx, 0x73
and cl, 0x83
movsx eax, cx
xor edx, ebx
jmp 0x968195
mov word [edi], dx
mov eax, dword [esi]
mov ecx, 0xc483f91c
add dword [esp + 4], 0xce331d0b
adc esi, 3
xor eax, ebx
movzx edx, cl
xadd ecx, edx
bswap eax
ja 0x8470e3
mov eax, 0x53986da0
movsx edx, al
mov dx, word [eax + edi - 0x53986da0]
mov ecx, eax
inc ecx
shl ecx, 0xef
mov ax, word [ecx + edi - 0x36d07ffe]
sets cl
adc cl, byte [edi + ecx*2 - 0x6da0fffc]
push 0xdb39a726
add edi, 4
inc dword [esp]
not word [esp + 2]
js 0x924f5a

Function at 0x98fd21
Capabilities:
Execute anti-debugging instructions
Manually build aes constants

Disassembly:
bt eax, eax
mov eax, dword [ebp + 4]
jae 0x99951d
xor dl, byte [ecx]
movzx ecx, ax
neg eax
call fcn.0098c074
xor ebx, eax
shl cx, 0xa1
mov dword [esp], ecx
pop ecx
adc edi, eax
lea eax, [ecx*2 - 0x1ed228cb]
not cl
mov ecx, dword [ebp]
rol ax, 0x2d
jae 0x93e80c
btc ecx, ecx
neg edx
neg cl
xor ebx, edx
ror eax, cl
adc ebp, edx
lea edx, [eax*2 - 0x22d197f8]
ror dword [esp + eax - 0x2ae51975], cl
mov ecx, dword [edi + eax*2 - 0x55ca32f2]
or edx, edx
xor edx, 0xc6bcef8a
movzx ax, byte [ecx + eax*2 - 0x55ca32f2]
lea edx, [edx + edx*4 + 0x2791703e]
adc edi, 2
mov ecx, 0xf4af0683
shl dx, cl
ror cl, 0x42
mov word [edi], ax
jne 0x8a031d
call fcn.00980b8d

Function at 0x996081
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol cx, 0x4d
not edx
or al, al
not al
not eax
neg edx
btr eax, ecx
dec ax
sar ax, 0x23
inc edx
not edx
dec ax
or ecx, eax
sbb al, 2
sbb edx, 0xf197328f
and eax, ecx
xor edx, 0x8d1d5b32
neg edx
sub edx, 0x588262ad
neg edx
xadd cx, ax
sar eax, 0x84
sar ecx, cl
xor ebx, edx
and cx, cx
btc ecx, ecx
cwde
add ebp, edx
sub ecx, eax
xor cl, al
movzx edx, ax
movzx ecx, word [esi + eax*2 - 0x9eea]
neg dl
bts ax, 0x94
xchg edx, eax
lea esi, [esi + eax*2 - 0x9f14]
xor cx, bx
imul al
xor edx, eax
btr dx, ax
rol cx, 1
neg cx
shr dx, 0xc7
cwd
mul dx
xor cx, 0x3ebe
mul ax
btc eax, edx
sbb cx, ax
jmp 0x90abc1
xor bx, cx
dec edx
lea edi, [edi + eax*2 - 6]
neg eax
cwd
mov dword [edi], ecx
js fcn.0088b1ed
mov dword [esp + edx*2 - 0x690bfffe], edx
lea ebp, [ebp + edx - 0x34860001]
mov word [edx + ebp - 0x3485ffff], cx
and edx, dword [esp + edx*2 - 0x690bfffe]
mov dword [esp + edx*2 - 0x690bfffa], edx
pop eax
pop eax
jne fcn.008f8c19
mov eax, 0xa89825bb
mov edx, dword [esi]
movzx ecx, al
rol eax, cl
lea esi, [esi + ecx*2 - 0x172]
xor edx, ebx
or cx, 0x9a15
cwde
lea edx, [edx + eax - 0x234e47a3]
adc ax, 0x28b4
bts eax, ecx
inc ecx
xor edx, 0xb305ed2a
ror edx, 2
lea eax, [eax*8 + 0x492bfe9c]
jmp 0x8f1053
Function at 0x996f74
Capabilities:
Encode data using base64

Disassembly:
sbb ebx, 0x541456b7
pop eax
popfd
bswap ebx
bswap ebp
call fcn.0097ef99
movsx ecx, dx
sal ecx, 0x6a
bswap eax
lea edx, [edx + edx*8 + 0x15190905]
inc eax
or dx, 0xbd07
call fcn.00858ed9
mov edx, 0xb2175caa
lea eax, [edx + edx*2 - 0x1345ff61]
lea esi, [esi + eax*4 - 0xc005a78]
xadd eax, edx
lea ecx, [edx*8 - 0x54024d2]
mov ecx, dword [esi + edx*2 - 0x6002d3a]
sar dx, 0x25
sal dx, 0xe5
setne al
xor ecx, ebx
mul edx
rol ecx, 1
bt eax, eax
adc ax, dx
sal dx, 0x4e
lea ecx, [ecx + eax*2 - 0x6bfa1eef]
bswap eax
not edx
ror ecx, 1
neg eax
not ecx
jge 0x93e7ca
repne insd dword es:[edi], dx
adc ebp, 2
lea edx, [edx*8 - 0x5be3daf3]
bt edx, 0x3f
inc edx
not cl
rol dl, 0x27
jnp 0x938697
mov ebx, 0x9aa3a391
mov ebp, ebx
neg ebp
mov esp, edi
inc bl
jne 0x8774c5
call dword [eax - 0x23]
pop esp
push edi
inc cl
jl 0x8ed403
inc dword [ebp - 0x77]
insb byte es:[edi], dx
xchg esp, eax
cld
sbb byte [eax], al
add al, ah
inc cl
cwde
dec edx
bswap ecx
bswap eax
ror cl, 0xc7
rol edx, cl
sal cl, 5
jne 0x91ce0e
and bh, byte [edi]
mov dword [0xebfc1e2a], eax
jne 0x8ed3b5
stosb byte es:[edi], al
cmp ah, byte [eax + edi + 0x1c3a1b22]
mov cl, byte [edi]
pop ecx
or al, 0xd8
frstor dword [eax]
loope 0x8ed480
push ds
jne 0x8ed3ed
xor eax, 0xb38a1e7d
jge 0x8ed3e6
enter 0x28dd, 0x38
jb 0x8ed3f5
fnsave dword [ecx - 0x602230be]
popal
mov dh, 0x81
pop ecx
fcomp qword [edi - 0x67dd71f2]
invalid
shr ah, cl
ljmp 0xbd3c
not al
sal dx, 0xa
and cl, al
mov word [ebp + edx - 0x57a41c00], cx
lea eax, [edx + 0x59900693]
lea esi, [edx + esi - 0x57a41c04]
mul eax
mov eax, dword [esi + eax - 0x56636069]
xor eax, ebx
lea eax, [eax + edx - 0x717a3e4e]
jmp 0x8aa14c
div dl
xor ebx, ecx
mul edx
add ebp, ecx
lea ecx, [edx*4 - 0x2cca28d5]
mul cx
mov edx, dword [edi + edx*2 - 0x7728403e]
sub cl, cl
mov ax, word ss:[edx]
adc edi, 2
bswap ecx
mov word [ecx + edi - 0xb486c1], ax
mov eax, ecx
sar ecx, cl
jmp ebp
mov byte ss:[ecx], al
sub esi, 4
mov edx, 0xf2b057a6
mov edx, dword [esi]
mov ecx, 0xcf0bae88
push ecx
or dword [esp], 0xf53d943b
xor edx, ebx
movsx eax, cx
sal eax, cl
mov dword [esp + 4], 0x209358b6
inc edx
sar dword [esp + 1], cl
xchg word [esp + 4], cx
shl ecx, cl
rol edx, 1
jmp 0x8ed40c

Function at 0x997b9d
Capabilities:
Execute anti-debugging instructions
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
cmp di, sp
stc
cmp esp, 0x88131432
push 0x484d70
stc
push eax
cmovne eax, ebp
mov dword fs:[0], esp
sub eax, ebx
cbw
shrd ax, bx, 0xac
sub esp, 0x10
movzx eax, ax
sal eax, cl
xor ax, 0x7e23
push ebx
stc
push esi
push edi
test ax, 0xac25
mov edi, ecx
mov eax, dword [edi + 0x1c8]
test eax, eax
jmp 0x9a990d
mov eax, dword fs:[0]
jmp 0x934472
Function at 0x9998c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor bl, dl
lea edx, [esp + edx + 0xc]
neg al
mov ax, word [eax + edx - 0x3398d3de]
pop ecx
mov ecx, 0xa1a420f
lea ebp, [ecx + ebp - 0xa1a4211]
mov word [ebp + ecx*2 - 0x1434841e], ax
dec dword [esp + ecx*4 - 0x28690838]
mov dword [esp + ecx - 0xa1a420f], ecx
movsx eax, word [esp + ecx - 0xa1a420b]
pop ecx
pop ecx
jns fcn.009338ec
mov eax, 0x44b174a1
call fcn.0093887a
sub cx, 0x489b
lea ebp, [ecx + ebp - 0x52332884]
btc ecx, edx
movzx eax, dl
mov edx, dword [ecx + ebp - 0x5a332880]
sbb ax, 0x5a26
xor edx, ebx
neg edx
inc edx
dec eax
bswap edx
sar eax, 0xaf
rol cl, 7
sbb al, 0xb5
not edx
not eax
add eax, ecx
xor ebx, edx
ror ecx, 0xe
add esi, edx
xor al, 0xb1
jmp esi

Function at 0x99afbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, esi
mov ebp, ecx
movzx edx, ax
mul eax
jb 0x8e0441
mov ecx, 0x43b32caf
add ecx, ecx
mov eax, ecx
mov ecx, edi
sbb edi, 4
mov dword [edi], ecx
sub esi, 4
neg eax
not eax
mov eax, dword [esi]
mov ecx, 0x19bb771d
btc ecx, 0xa3
not cx
xor eax, ebx
inc cx
neg eax
ror ecx, 0x28
sbb cl, cl
ror eax, 1
bswap eax
sal ecx, cl
ror eax, 3
mov edx, ecx
jmp 0x98af56
xor ebx, edx
and ecx, eax
call fcn.009c68dd
xor ebx, eax
add ebp, eax
or ecx, 0xb08a51be
jl fcn.00943216
test al, 0xb
push ecx
cmp dword [ebp - 0x67], eax
jle 0x98afda
cmp eax, dword [ecx + ecx*8]
cld
aam 0x67
in al, dx
mov esp, 0xa5ad6ae4
sbb dword [0x78576a2b], edx
push ebp
outsd dx, dword [esi]
pop es
dec eax
push 0xc3b79dad
movsd dword es:[edi], dword [esi]
call 0x59456fd4
out dx, eax
cmp edi, ebp
jbe 0x98af46
dec dword [ebx]
aam 0x27
jnp 0x98afdf
dec dword [ecx - 0xe]
popal
sbb dh, byte [ebx - 0x11924073]
test dword [eax + 0x75], eax
sbb dword [eax - 0x6c], esi
and al, 0xfa
mov bl, 0xa6
add eax, 0x1eaba4a1
pop esp
xchg byte [esi], dl
sar dword [ecx + 0x1c09abd3], 0x55
jge 0x98afe0
rcl byte [edx - 0x4c], 0x91
dec edi
cmc
int 0x2d
xor eax, 0x79a94a87
mov eax, dword [0xef569d2b]
insb byte es:[edi], dx
in eax, dx
insd dword es:[edi], dx
pushfd
fucompi st(6)
ret
jle 0x98aff7
pop ds
mov dword [ebx + 8], edx
push cs
push ebx
or byte [esi], cl
outsb dx, byte [esi]
cmp esi, dword [ecx + 4]
mov esi, ss
movsd dword es:[di], dword [si]
rcl dword [ecx], 0x1a
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
hlt
add eax, 0xed50fd48
mov ch, 0xc3
pop eax
cwde
inc edi
shl byte [ecx - 0x7b], 0x12
dec ebx
push dword [esi - 4]
int 0xfb
int3
xor ecx, ebx
shr dl, 7
dec ecx
mov dword [esp + eax*4], eax
not ecx
xchg dword [esp + eax*2], edx
rol ecx, 2
xor ecx, 0x5c24293c
inc ecx
imul dword [esp + eax]
xor ebx, ecx
sar ax, 0x84
rol dword [esp + eax*2], 0x77
cbw
adc edi, ecx
cwde
lea ecx, [edx + edx*8 + 0x5293693d]
neg eax
mov ebp, dword [eax + ebp]
push eax
pop edx
pop eax
jae fcn.009338ec
mov eax, 0xb03da29f
mov ecx, dword [esi]
movzx ebp, al
shr bp, 0xc3
lea esi, [esi + ebp - 0xf]
jns 0x8cc802

Function at 0x99b46b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
not dx
lea edi, [edx + edi - 0xfffd]
adc cx, ax
pop edx
Function at 0x99bf5d
Capabilities:
Execute anti-debugging instructions

Disassembly:
sal word [esp + edx - 0x2f87ffa7], 0xa1
shl eax, cl
xadd dword [esp + edx - 0x2f87ffa7], edx
or dword [esp + edx - 0x500fe26a], edx
mov dword [edi + edx - 0x500fe26a], eax
mov dword [esp + edx - 0x500fe26a], ebp
ret
lea edx, [edx + eax*4 - 0x7237f05e]
or ecx, 0x8b19753f
pop ecx
lea ecx, [eax + eax*8 + 0x620b84b3]
ror edx, 2
mov dword [esp + eax*2 - 0x1f624], eax
lea edx, [edx + eax*4 + 0x551b3acb]
rol edx, 2
xor ebx, edx
xchg word [esp + eax - 0xfb12], ax
xchg byte [esp + eax - 0xfb0f], cl
inc dword [esp + eax*2 - 0x1f624]
add ebp, edx
sar byte [esp + eax - 0xfb11], 0x25
mov eax, dword [edi + eax - 0xfb12]
lea edx, [ecx + ecx*4 + 0x452247a7]
rol dword [esp + edx - 0x2f87ffa7], 0xa4
xor cl, byte [ecx + edi - 0x621457fc]
bts edx, edx
lea edi, [edi + edx*2 - 0x5f0fff4c]
cmovae edx, dword [esp + edx - 0x2f87ffa7]
jb 0x970543

Function at 0x99bfdd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, eax
sub cx, cx
adc edi, eax
mov eax, dword [ebp + ecx*2 - 0x41800000]
mov edx, dword [ebp + ecx*2 - 0x417ffffc]
shr cl, 0x84
mov dword [esp + ecx*2 - 0x41800000], ecx
lea ebp, [ebp + ecx - 0x20bffff8]
bt ecx, ecx
shl ecx, 0x4e
mov dword [eax + ecx*2], edx
jp 0x8f6000

Function at 0x9a55c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor bl, dl
sal eax, cl
lea ecx, [eax + eax*2 + 0x6622d3bf]
lea edx, [esp + edx + 4]
sal eax, 0x81
movzx cx, byte [ecx + edx - 0x5c2d3bf]
lea eax, [eax + eax*2 - 0x394541cc]
lea ebp, [ebp + eax*4 - 0x17eaf8d2]
sub eax, eax
mov edx, eax
mov word [ebp + eax*2], cx
cdq
pop eax
jns fcn.009338ec
Function at 0x9a5789
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dx
idiv eax
xor ecx, ebx
sal edx, 0x25
not ecx
lea ecx, [ecx + edx*4 - 0x6910edb]
lea edx, [eax*8 - 0x4c520f71]
add edx, eax
xor ecx, 0x611146a8
dec ecx
btc ax, 0x3c
shl edx, 4
sub al, 0x96
xor ebx, ecx
neg edx
add edi, ecx
shl ax, 0xea
setnp dl
mov eax, dword [ebp]
movzx ecx, dl
btr edx, 0xb9
movzx dx, byte ss:[eax + ecx*2]
xor ecx, ecx
call fcn.0090d72a
neg edx
cwde
lea edx, [edx + ecx*8 + 0x33c53051]
ror edx, 2
inc edx
push eax
not al
jmp 0x891706
add edi, eax
btr ecx, ecx
dec byte [esp + ecx*8 - 0x24005]
adc byte [esp + ecx*8 - 0x24005], 0xbd
mov eax, dword [ebp + ecx*2 - 0x9002]
mov edx, dword [ebp + ecx*2 - 0x8ffe]
dec cl
pop ecx
adc ebp, 7
mov dword es:[eax], edx
movzx edx, cl
movsx eax, dl
mul ecx
adc edx, edi
jmp edx
xor ebx, edx
mov dword [esp + ecx - 0x12a972e5], eax
xor al, 0x8b
inc dword [esp + ecx - 0x12a972e4]
adc ebp, edx
cbw
mov edx, ecx
imul eax
mov dword [esp + ecx*2 - 0x2552e5d0], ebp
ret 4
mov ecx, dword [ebp + ecx*2 - 0xe32de04]
mov edx, 0x90b30107
mov eax, dword [ebp + 4]
shl edx, 0xdd
adc ebp, 8
add edx, edx
mov dword fs:[ecx], eax
mov ecx, edx
btc edx, ecx
sub cx, dx
sbb esi, 3
ror cl, 0x61
mov eax, ecx
jb 0x93fb5e
mov ecx, 0xb786963a
bt ecx, ecx
mov eax, ecx
mov ecx, dword [esi]
movsx edx, al
lea esi, [esi + edx*4 - 0xe4]
jb 0x846938
mov ecx, 0x1ab9c2ae
movsx edx, cl
mov ecx, dword [esi + ecx*4 - 0x6ae70ab8]
add esi, 4
movzx eax, dl
imul edx
setae al
xor ecx, ebx
and eax, eax
dec edx
rol ecx, 2
rol dx, 0x2d
neg al
mul edx
not ecx
rol ecx, 1
lea eax, [edx + eax*8 - 0x6bc3a8d1]
shl edx, 0x58
dec ecx
idiv eax
bts ax, dx
xor ebx, ecx
sar eax, 0x1c
not dx
add ebp, ecx
call fcn.0092ec8c
adc dx, dx
bswap eax
sbb eax, 0xac337fb7
xor ebx, eax
add ebp, eax
push ecx
mov dword [esp + edx - 0xc2a8], ebp
ret
mov ecx, dword [esi]
or eax, eax
neg dx
xor ecx, ebx
lea eax, [edx - 0x23645946]
rol ecx, 3
or dl, 0xbe
neg ecx
shl eax, 0x69
inc ecx
ror ecx, 1
not dx
sub ecx, 0x561a1e3e
xor ebx, ecx
add edi, ecx
movzx ecx, dl
shl edx, 0x18
or edx, edi
jmp edx
movzx ecx, al
mov eax, dword [esi + ecx*2 - 0x10a]
lea esi, [esi + ecx*2 - 0x106]
call fcn.008a41ad
ror eax, 3
ror cx, 0xd
xor ebx, eax
dec dl
jle 0x847b9a
mov ecx, 0x7196f02
jmp 0x91e61c
fadd qword [edi]
jmp 0x957d1d
lea eax, [esp + eax + 4]
neg ecx
mov dword [esp + edx*2 + 0x800], ecx
add dl, dh
mov dx, word [eax + edx + 0x304]
xor byte [esp + 3], 0xa1
sbb ebp, 2
mov word [ebp], dx
lea ecx, [ecx + ecx + 0x7a1fa384]
xor byte [esp + ecx*4 - 0x64c10d35], cl
pop edx
jg fcn.009338ec
ror eax, 3
shr word [esp + ecx - 0x2900], 7
or ecx, ecx
not eax
lea edx, [edx*8 - 0x47190f1]
sub edx, ecx
jp 0x96ce13
mov eax, 0xd53dc985
jmp 0x99eefd
Function at 0x9a9901
Capabilities:
Execute anti-debugging instructions
Link many functions at runtime

Disassembly:
test eax, eax
jmp 0x9a44d3
mov eax, dword [eax + ebx*4]
jmp 0x8fb458
mov ebx, dword [esp + 0x2c]
bts ax, bp
xor al, 0x9e
mov edx, dword [edi + 0x18c]
btc ax, 0x82
shl al, cl
mov eax, dword [edx + ebx*4]
cmp edi, esi
jmp 0x850e4f
cmp byte [eax], 0x23
jmp 0x401a0e
call fcn.004697d8
lea esp, [esp + 4]
and eax, 0xffff
jmp 0x93fc4c
mov dword [esp + 0x10], eax
stc
cmp bp, 0x9b0d
jmp 0x8974d4
jne 0x916b12
mov eax, dword [edi + 0x164]
bts ecx, edi
mov ecx, dword [esp + 0x2c]
btc si, si
mov esi, dword [eax + ecx*4]
test esp, 0x382c4cab
cmp byte [esi], 0x23
jne 0x92b9c9
lea edx, [esi + 1]
push edx
jmp 0x8e72eb
mov eax, esi
jne 0x926593
mov eax, dword [edi + 0x164]
cmc
jmp 0x85ffb6
lea edx, [edx + edx*2 + 0x18057f16]
call fcn.0090e49d
je 0x86493a
mov esi, dword [edi + 0x1cc]
rcr ah, cl
mov eax, dword [esi - 8]
test eax, eax
jmp 0x916af2
Function at 0x9b2e74
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
mov ecx, dword [esi + eax - 0x71ce8fd3]
mov ax, word ss:[ecx + eax - 0x71ce8fd3]
movsx ecx, dl
xchg dword [esp], ecx
lea edx, [ecx + edx*8 + 0x759da8ab]
add esi, 2
call fcn.009242ae

Function at 0x9b3716
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
jmp ebp
call fcn.008b4562
lea eax, [ecx + eax - 0x4b9d7b01]
lea ecx, [edx*2 - 0x69e4a0f1]
xor eax, 0xc00c7101
xchg dword [esp + edx*2 - 0x1d2], edx
and cx, 0xeab
and edx, ecx
ror eax, cl
mov word [esp + 5], cx
shr edx, 0x6c
xor ebx, eax
rol dx, 0xe8
add ebp, eax
pop edx
ror dword [esp], 0xf2
jae 0x9a1ddf
mov edx, 0x2c2df62f
movzx ecx, dx
movzx ax, byte [esi + edx - 0x2c2df62f]
sub ecx, 0xe4b76027
mov cl, byte [edx + esi - 0x2c2df62d]
sar dl, 0xc6
bswap edx
lea esi, [esi + edx*2 - 0x1ec5a56]
not dl
bt dx, 0x2a
sar dx, 0xcd
shl al, cl
movzx ecx, dx
xadd ecx, edx
lea edx, [ecx + ecx*2 + 0x6886e48f]
mov word [edx + esi - 0x6b68e495], ax
sar ecx, cl
xor ecx, edx
lea edi, [edi + edx - 0x6b68e499]
mov eax, edx
mov ecx, dword [edi + edx - 0x6b68e495]
or eax, 0x393c4c23
cdq
idiv eax
xor ecx, ebx
push eax
sar dl, 0xc2
call fcn.0087e86d
neg ecx
add ax, dx
and dx, dx
xor ebx, ecx
add esi, ecx
mov dword [esp + edx*2 - 0x18a709fc], 0xdda14b08
lea ecx, [eax + edx*8 - 0x7a646f70]
shl edx, cl
mov eax, dword [edi]
mov edx, dword [edi + 4]
ror dword [esp + 4], 0x18
mov cl, byte [edi + 8]
jb 0x9abf70
or ecx, 0xdd0405ae
xor eax, ebx
dec eax
ror eax, 1
mov edx, ecx
bswap ecx
dec eax
sub ecx, 0xaaafb2a5
call fcn.0098aab3

Function at 0x9b4d4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, ebx
inc ecx
ror eax, 3
add dx, word [esp + edx - 0xffa7]
xor eax, 0x2d8d1c10
imul edx, ecx
or cx, word [esp + 5]
rol eax, 1
sar dx, 0xa1
bt edx, 0x33
sal edx, 0xf5
xor eax, ecx
sal edx, cl
xor ebx, eax
add edi, eax
mov dword [esp + edx*2], edx
shl ecx, 0x6a
push ecx
xor dx, word [ebp + edx*2]
shl cx, 0xe8
sbb byte [esp + 4], cl
add cl, byte [ebp + 2]
mov eax, dword [esp + 8]
xadd dword [esp + 4], eax
lea ebp, [eax + ebp + 2]
shl dx, cl
call fcn.00938740

Function at 0x9b4daa
Capabilities:
Encode data using xor

Disassembly:
inc dword [esp + edx - 0x735d08fc]
mov si, word [esi + edx - 0x735d0903]
pop ecx
pop eax
pop edx
pop edx
jp fcn.00942899

Function at 0x9bb5a4
Capabilities:
Encode data using base64

Disassembly:
ja 0x9b9c79
not dl
sar cl, 0xe2
rol dl, cl
and eax, ecx
sar ecx, 0xfc
neg ecx
not dl
xor bl, dl
xor ecx, ecx
lea edi, [edi + ecx - 2]
add ecx, eax
xor ecx, ecx
mov word [edi + ecx], dx
lea edx, [ecx + ecx*4 + 0x133d5f06]
sbb eax, edx
sal al, 2
jb fcn.009b97d0
lodsb al, byte [esi]
invalid
movzx edx, byte [ebp + edx*2 - 0x54d410d8]
pop eax
lea eax, [ecx*8 - 0x2ae8f5e1]
add ebp, 1
sal ecx, 5
setbe al
xor dl, bl
add ecx, 0x3e0b4427
ror dl, 1
add cl, al
ja 0x94b559
Function at 0x9bc5ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor cx, dx
neg cl
add edi, eax
mov dword [esp], ecx
shr byte [esp], 0xc2
sbb dword [esp], ecx
pop ecx
jbe fcn.009338ec
mov edx, 0x8ca4f333
mov dx, word [ebp + ecx*2 - 0x477c7456]
lea ebp, [ebp + ecx - 0x23be3a2a]
not ax
rol ecx, cl
dec ecx
not dx
sbb cl, cl
push ecx
rol ecx, 0x55
or ax, dx
pop edx
shl dx, 0x2a
mov word [ebp + ecx - 0x5ffc7458], ax
lea esi, [esi + ecx - 0x5ffc745c]
mov eax, ecx
shl edx, 0x41
mov ecx, dword [ecx + esi - 0x5ffc7458]
mul eax
xor ecx, ebx
btr eax, eax
sbb al, dh
bt edx, eax
not ecx
or eax, edx
adc al, dl
sbb ecx, 0xa83bc69c
cbw
xchg edx, eax
cbw
ror ecx, 3
neg al
shr dx, 0x46
bswap ecx
push edx
dec ax
xor ebx, ecx
add edi, ecx
lea ecx, [eax*8 - 0x4af177d3]
and eax, 0x458ebf3f
mul cl
mov dword [esp + eax - 0x18c22a5], edi
ret

Function at 0x9be787
Capabilities:
Execute anti-debugging instructions

Disassembly:
xadd ecx, eax
not edx
btc ecx, 2
adc ax, 0xf3bb
neg edx
dec eax
ror edx, 1
inc edx
shr word [esp + eax - 0x58f5a0b6], cl
shl eax, cl
bswap ecx
xor ebx, edx
mov dword [esp + ecx - 0x4ad2b93], ecx
bts ecx, 3
adc edi, edx
add ax, cx
push ecx
movzx edx, word [esp + ecx - 0x4ad2b93]
pop edx
pop edx
pop edx
jne fcn.009338ec
lea edx, [eax + edx - 0x4a4d1f0e]
rol eax, 0x7b
jne 0x8ca7e1

Function at 0x9be797
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, word [ebp]
mov dword [esp], eax
pop edx
jmp fcn.009338ec