joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd8c00a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pop edx
xor ecx, ebx
not ecx
movsx edx, al
btr edx, edx
xor ecx, 0xc8135db6
cbw
sub ecx, 0x76b9ac0e
ror ecx, 1
xor ebx, ecx
add ebp, ecx
add dx, dx
cwde
and eax, edx
lea edi, [edi + edx - 0x7fffffff]
movzx eax, byte [edi + edx - 0x7ffffffe]
xor al, bl
neg al
sar edx, 0xb0
movzx ecx, dl
xchg ch, cl
ror al, 1
lea edx, [edx - 0x1552666c]
bt cx, cx
inc ecx
sbb al, 0x22
shl dx, cl
setge dl
bswap edx
xor al, cl
sar edx, cl
xadd dx, cx
bswap edx
not al
shr ecx, cl
neg al
btr ecx, edx
sar ecx, 0x4e
adc al, 0x35
xor bl, al
shr cl, 0xe4
lea edx, [edx + ecx*8 - 0x2cc8cf6d]
adc eax, esp
inc cx
jns 0x12f643a

Function at 0xd910c3
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.00d23a6a
shr edx, 0xa
xor ebx, ecx
shr eax, 0xad
ror eax, 0xa6
adc ebp, ecx
jmp fcn.015b454f

Function at 0xd9eede
Capabilities:
Encode data using xor

Disassembly:
and cl, ch
ror edx, 2
sar ecx, 0xf7
lea edx, [edx + eax - 0x5e14cb9c]
sal cx, 0xa7
bt ecx, eax
push ecx
xor edx, 0x82ab6d3e
xor cl, byte [esp + eax - 0x20000000]
sub ecx, 0x941ded2d
dec edx
not edx
dec word [esp + eax*4 - 0x7fffffff]
xor ebx, edx
ror dword [esp + eax*2 - 0x40000000], 0x62
adc esi, edx
call fcn.00c8ce84
mov dword [ebp - 4], eax
xor dword [esp + 0xc], 0x4e961ba8
sal dword [esp + 0xb], 0xe7
call fcn.011394f0
sub eax, 0x7cff0762
sbb esp, dword [esi + 0x454fe7c5]
sbb eax, 0x52651488
dec ebp
sbb bh, dh
push eax
sbb eax, 0x1aeeeeeb
push 0xe9c85def
loopne 0xd9ee98
jmp 0xd9eef9
push ss
push ds
push edx
cmp eax, 0x5fcf1a26
scasb al, byte es:[edi]
push esp
insd dword es:[edi], dx
sbb dword [eax + 9], edi
mov byte [0x7aecd614], al
fst dword [esi - 0x6f30147c]
mov eax, 0xe0268ee5
out 0x24, al
push ss
add byte [edx + 0x4a], bh
scasd eax, dword es:[edi]
jmp 0xd9ef09

Function at 0xda2675
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xf10b789c
dec ebx
call fcn.00d1d761
mov eax, dword [esi]
mov edx, 0xd512bdb9
ror edx, 3
mov edx, dword [esi + edx*2 - 0x7544af6a]
mov ecx, 0xb388b212
shr ecx, 0x77
lea esi, [esi + ecx*2 - 0x2c6]
sal ecx, cl
sal ecx, 4
sbb cl, ch
mov dword [ecx + eax - 0xb38c8], edx
mov eax, 0x3c99d92b
and ecx, ecx
mov edx, dword [ebp + ecx - 0xb38c8]
not cl
xor ecx, ecx
cwde
lea ebp, [ebp + ecx*4 + 4]
xor edx, ebx
push ecx
cwde
rol ax, 0x2c
lea edx, [ecx + edx - 0x150a71b3]
xor edx, 0x8e35eb8a
neg cx
jp 0x11923f6
mov edx, 0x9c060105
shl edx, 0x1f
mov edx, dword [esi + edx - 0x80000000]
mov eax, 0x162aeb36
mov cx, word [eax + esi - 0x162aeb32]
rol eax, 0x5c
lea esi, [esi + eax - 0x6162aead]
neg eax
ror al, 0xe1
mov word ss:[edx], cx
lea eax, [eax + eax - 0x65f15ee4]
push eax
sbb ebp, 3
sar byte [esp], 0x41
mov ecx, dword [ebp]
xor ecx, ebx
jmp 0x12ec5a3
bswap edx
jge 0x124e148
rol eax, 9
ror edx, 1
sar al, 0xe4
sar dword [esp + ecx], 0x95
sal ecx, 0xce
xor ebx, edx
pop eax
push eax
add edi, edx
neg ax
mov edx, dword [esp + ecx*2]
or dword [esp + ecx], edi
ret
Function at 0xda3fcd
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
inc edx
mov dword [esp + eax - 0x3780bb], eax
shr ax, 0xad
add eax, dword [esp + eax*2 - 0x6e0008]
neg edx
sub cx, cx
neg byte [esp + eax - 0x6e80bc]
xor ebx, edx
shl eax, 0xd9
add esi, edx
neg ax
call fcn.012dea5c
mov ecx, 0x4bbd261e
dec esp
mov ebx, dword [edi + ecx - 0x4bbd261e]
dec esp
lea ebp, [ecx*4 - 0x1bc13a59]
dec eax
bswap ecx
inc esp
mov ebp, dword [edi + 8]
dec eax
lea esi, [ecx + ecx*2 + 0x71ebb2b]
dec eax
add edi, 0xc
inc ebp
mov dword [ebx], ebp
call fcn.00d30d19
mov eax, dword [ebp]
push 0x66b49c32
mov ecx, dword [esp]
pop edx
movzx cx, byte [eax + ecx - 0x66b49c32]
lea ebp, [ebp + edx - 0x66b49c30]
movsx eax, dx
mov word [edx + ebp - 0x66b49c32], cx
imul edx, edx
call fcn.015a4a7d

Function at 0xdaa128
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp + 0xc], eax
mov eax, 0x58bb2b84
mov dword [ebp + eax - 0x58bb2b7c], ebx
mov dword [ebp + eax - 0x58bb2b80], ecx
mov ebx, dword [esp + eax - 0x58bb2b7c]
mov dword [eax + ebp - 0x58bb2b84], edx
lea edx, [ebx*2 - 0x27f0fac6]
mov ebx, dword [esp + eax - 0x58bb2b78]
cdq
xor eax, dword [esp + edx + 6]
pop eax
pop eax
pop ecx
pop edx
js fcn.015a46db
Function at 0xdb4cd6
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec edx
mov dword [esp + esi - 0x1f], esi
inc edx
inc ecx
mov ebp, esp
dec esp
lea ebx, [ecx - 0xd56a462]
call fcn.00d23919

Function at 0x11273cb
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
neg eax
pop ecx
push edx
neg dl
xor ebx, eax
sar byte [esp + edx - 0x7ca6ed55], 6
movzx ecx, dl
add edi, eax
shr cl, 0xc2
pop eax
ja fcn.00cab190
dec edi
jb 0x11273fd
in eax, 0xb2
adc dword [eax], 0xffffffaf
test al, 0x1d
add al, 0xf4
mov byte [0xc2db94f0], al
push ebp
sbb dh, byte [ecx + 0x4f2ea505]
mov cl, 5
movsd dword es:[edi], dword [esi]
dec edi
xor ebx, dword [eax + edx*2 - 0x462d5c65]
mov ah, bh
int3

Function at 0x112c0cf
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x522b25c9], 0xb6aeb89c
mov dword [ebp + ecx - 0x522b25c9], eax
mov edx, dword [esi + ecx - 0x522b25c9]
call fcn.00d4aa24
Function at 0x112ce48
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x3d933c2
stc
mov edx, 0x566bce8
wait
sbb dword [ebx], esi
ret 0xe7ff
push 0xd9269813
xor eax, eax
sar dword [esp], 0x4b
jae 0x12bee60
test byte [edi], ah
aad 0xa4
xchg byte [ecx - 0x7d], bh
pop ebp
jbe 0x112ce3d
lodsd eax, dword [esi]
out dx, al
jbe 0x112cedf
jns 0x112ced4
push cs
pop esp
mov edi, ebp
or byte [ecx], ah
lahf
jbe 0x112ce9d
idiv edx
jno 0x112cef0
xchg esi, eax
mov dh, 0x13
outsd dx, dword [esi]
sub al, 0x89
test eax, 0x8986c5d4
cmp al, 0xe6
scasd eax, dword es:[edi]
jbe 0x112ceae
add dword [edi + esi + 0x53218924], ebx
mov ebx, 0xc9b7adfd
add dword [eax], edi
stc
bound ebx, qword [eax]
jmp 0x112cef1
add eax, dword [edi]
test byte [esi + 0x48], cl
stc
inc ecx
inc ebx
pushal
xor dword [edx - 0xe], esi
loop 0x112ce36
loop 0x112ce36
fldcw word [edi - 0x20]
stc
loopne 0x112cea9
dec edi
cmp ebx, edx
jle 0x112cea7
std
mov cs, edx
add byte es:[eax - 0x3cc36ae9], ah
fdiv dword [esi]
inc ecx
popal
sub dword [ecx], eax
sbb eax, 0xa471ac70
pop edx
ret
dec edi
cmc
and esi, dword [edi - 0x2b]
mov dword [0x780900ec], eax
push 0xeb882278
js 0x112cf03
mov bl, ch
push cs
push edi
loope 0x112cf5e
push ss
fisttp qword [edi + ecx + 0x5b8b678]
sbb dword [edx - 0x78], edx
mov edi, 0xbb87bba2
push edx
mov byte [edi - 0x4478445e], bh
adc dl, byte [eax - 0x5388882f]
sbb dword [esi - 0x74], ebp
clc
xor dword [ecx + 0x31], 0x2585f639
das
nop
xor dword [ecx], edi
test byte [ebp + 0x53902f25], 0x2d
add eax, 0x2ada351c
sbb byte [ecx + 0x45], ah
push ebx
sub eax, 0xda351c05
sub bl, byte [eax]
popal
inc ebp
mov ah, byte [ebx]
enter 0x6b06, 0x2c
ret
or byte es:[edi], ch
xchg byte [ebp - 0x764a9ae6], dh
pop ecx
loopne 0x112cf0a
jbe 0x112cf13
out 0x9a, eax
adc eax, 0x6d1e7994
mov edi, 0x4250a189
jl 0x112cfd2
jle 0x112cf05
cdq
xchg edx, eax
jns 0x112cf40
push ds
mov esp, ebx
or byte [edx - 0x56], 0x10
and dword [edi + 0x4f], ecx
push cs
inc ebx
mov esp, 0x560eee35
push 0x3c
pop ds
inc ecx
sub bh, dh
invalid
lcall 0x26d6, 0x6764f742
test dword [eax - 0x6d7b3341], ebx
jno 0x112d053
mov edi, 0x719284cc
jnp 0x112cfc9
invalid
pop ebx
fdivr qword [bx + 0xd04]
cld
hlt
xchg dword [ebx - 0x5e9dcf5b], esi
xchg ebp, eax
mov esi, dword [eax]
adc bl, byte [edx]
xchg ebx, eax
pushal
scasb al, byte es:[edi]
mov ebp, 0x4db1a9fd
or al, bh
sbb byte [edi - 1], ah
dec ebx
dec esi
adc bl, byte [edi + 0x1a4bead1]
call 0x12555cad
xlatb
or byte [esi], dl
mov ch, 0x4f
dec edi
or al, 0x99
dec eax
aam 0x8b
lcall 0x41d5, 0xfd869d6c
aad 0x8a
mov byte [0xf51b78cd], al
mov ah, byte [edx - 0xae48733]
cwde
add dword [ecx + 0x64], esi
sahf
sub dl, 0xda
cld
loope 0x112d045
cli
fiadd dword [ecx - 0x67e046a1]
pop es
pushfd
push ebp
fild dword [ebp + 0x61172512]
movsd dword es:[edi], dword [esi]
salc
je 0x112d01b
invalid

Function at 0x112e14f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
and ebx, 0xff
mov dword [esp], 0xcc8ab198
call fcn.015c1549

Function at 0x11394f0
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
test ebx, ebx
lea esp, [esp + 0x14]
je 0x12668da
Function at 0x113effc
Capabilities:
Encode data using xor

Disassembly:
movzx cx, byte [eax + esi - 0x42accf9b]
cdq
or dx, 0xa3ab
mov al, byte [esi + edx - 0xa3a9]
ror dx, 0xcf
push edx
lea esi, [esi + edx*2 - 0x8eac]
btc edx, edx
jae 0xd6bf9a

Function at 0x1148642
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.014c2c4e
mov edx, 0x6d3c18b0
rol dl, 0x21
mov edx, dword [esi + edx - 0x6d3c1861]
mov eax, 0x702c661b
lea esi, [esi + eax - 0x702c6617]
push eax
movzx ecx, word [esp + eax - 0x702c661b]
xor dword [esp + eax - 0x702c661b], ecx
xor edx, ebx
dec edx
and word [esp + eax - 0x702c661a], 0x4808
btc ax, ax
shr byte [esp + eax - 0x702c6e1a], 0x21
rol edx, 3
lea edx, [edx + eax - 0x118ee286]
sar dword [esp + eax - 0x702c6e1b], cl
sal cl, 1
dec ax
rol edx, 2
call fcn.00cce460
mov ecx, 0x19a89f
lea eax, [ecx + 0x648e2e97]
push ecx
mov eax, dword [esi + ecx*4 - 0x66a27c]
movzx edx, byte [esp + ecx - 0x19a89f]
call fcn.01182a23
call fcn.00c7c9a0
mov edx, 0x2b39638
bts dx, 0x98
lea edi, [edi + edx*2 - 0x5672e74]
movsx eax, dx
shr eax, 0x3d
mov edx, dword [eax + edi - 7]
mov ecx, eax
push eax
xor edx, ebx
inc cx
dec dword [esp + eax - 7]
and dword [esp + eax - 7], ecx
not edx
setle al
shr al, 5
and word [esp + eax + 1], 0xf29d
rol edx, 1
inc edx
sar al, 0xe6
jae 0xd6ef37

Function at 0x11490ac
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sal ax, 0x62
push edi
adc ax, ax
not eax
push ebp
mov ebp, 0xf82f803d
xadd ebp, eax
js 0xd37df5
xor al, bl
pop edx
movsx edx, cl
neg al
dec cl
rol ecx, 6
neg cx
ror al, 1
sub al, 0x22
bt ecx, edx
sar ecx, 0xa4
dec edx
xor al, 1
inc dx
setne dl
not al
neg al
add al, 0x35
bswap ecx
bts dx, dx
xor bl, al
add eax, esp
add ecx, edx
mov cx, word [eax + ecx - 0x30b00fb]
sar dl, 0x44
jp 0x12165ac
not dl
neg eax
shr al, 0x41
lea eax, [eax - 0x1f5846e3]
rol dl, 1
inc dl
not ax
xor al, 0x2e
and eax, eax
xor dl, 0xa0
xor bl, dl
not eax
jmp 0xdafd25
Function at 0x115aa50
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea ecx, [edx*4 + 0x62b36ba8]
sbb dword [esp], edx
adc esi, 3
shl word [esp + 1], 0x23
xor ecx, 0x93f439d
xor eax, ebx
or dl, byte [esp + 3]
pop edx
bswap eax
lea eax, [eax + edx - 0x7ee57f44]
sub dx, 0xe28a
jns 0x12a6231
btr edx, ecx
ror eax, 3
dec edx
lea eax, [eax + edx*2 - 0x7230e8ef]
btc edx, ecx
xor ebx, eax
ror edx, cl
adc edi, eax
jmp edi
add edi, ecx
movzx ecx, dx
idiv dl
jmp edi
cld
jmp 0x12b069b
mov ecx, dword [ebp + ecx*2 - 0x1fe]
movsx eax, dx
xor ecx, ebx
cwde
imul al
not ecx
lea ecx, [ecx + eax*8 - 0x30161a4c]
not ecx
cmovae eax, edx
dec ecx
mul eax
sbb al, dl
xor ebx, ecx
jmp 0x113924e
neg word [esp + 5]
sbb cx, word [esp + 6]
lea eax, [ecx - 0x4dfd7bdc]
bswap edx
xor ebx, edx
call fcn.01263111
mov edx, 0xc526cb85
lea ecx, [edx*2 - 0x614cf741]
push edx
mov eax, dword [ebp + ecx*2 - 0x52013f92]
jmp 0x15a1fcf
push 0xd8a4e420
push 0xac23e11c
rep movsb byte es:[edi], byte [esi]
mov esi, 0xb0ba749c
movzx edi, si
mov dword [esp + edi*4 - 0x1d264], esi
push dword [esp + 0x10]
popfd
mov esi, dword [esp + edi*2 - 0xe924]
call fcn.00d7ba53
sub ebp, 4
mov ecx, 0xfb3164bf
mov edx, dword [ebp]
btr ecx, 0x1a
xor edx, ebx
shl cl, 0x21
lea edx, [edx + ecx - 0x461ea6f3]
xor cl, 0xa3
not ecx
je 0x12a845d
rol edx, 3
mov eax, ecx
lea edx, [edx + ecx*4 - 0x605738a3]
cwde
ror edx, 3
add cl, 0x1b
dec edx
xor ebx, edx
inc al
neg cx
add edi, edx
lea ebp, [ebp + ecx*2 - 0x99cc988]
movzx eax, word [ebp + ecx*2 - 0x99cc986]
push ecx
lea edx, [ecx + ecx*4 - 0x2cd9d55c]
xor ax, bx
shl dx, 0xa1
sbb dword [esp + ecx - 0x4ce64c3], edx
ror ax, 1
add dword [esp + ecx*2 - 0x99cc986], edx
call fcn.011b56aa
ror ecx, 1
shr dl, 0x45
shl eax, 0x98
not ecx
sbb edx, edx
cbw
xor ebx, ecx
add edi, ecx
or edx, edi
jmp edx
mov cl, byte [ebp + ecx - 0x29009fc5]
inc edx
shr byte [esp + 3], 0x24
sar edx, 0xa1
adc ebp, 6
bts edx, edx
mov byte [eax], cl
adc word [esp + 1], dx
mov eax, dword [esi]
jo 0xd2faae

Function at 0x115aaa1
Capabilities:
Encode data using xor

Disassembly:
jmp 0x11e535d
dec ecx
popal
aaa
cld
xlatb
imul dword [edx - 0x3d216b00]
add al, byte [esi - 4]
mov dl, 0xe4
add eax, 0xbd3a6869
adc bh, byte [edi]
push 0x3f12bd3a
xor eax, 0xe1a6412e
add dword [esp + 4], 0xc3b21401
dec ecx
push 0x53118624
lea esp, [esp + 0x14]
jne 0xca1c0f
mov edx, 0x119984a1
movzx esi, dl
pop esi
mov edx, 0xe11806af
inc dl
lea ecx, [edx + edx*2 + 0x5bb3d23]
not eax
rol ecx, cl
mov dword [ebp], eax
push edx
mov eax, edx
mov eax, dword [esi]
call fcn.01254e97
sysenter
push ecx
mov dword [esp], 0x54b894a6
call fcn.0159abc8
js 0xd77f54
add edi, dword [edi]
fcomp qword [edx + 0xd]
retf
mov dword [esp], 0x6885e827
shr eax, 8
xor eax, esi
inc edx
jmp 0xd77f67
movzx esi, byte [edx]
xor esi, eax
call 0xcfae70
Function at 0x115f718
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea edi, [eax + edi - 0xc9b359e]
mul dl
dec ecx
shr edx, cl
dec esp
mov dword [edi + eax*2 - 0x19360000], edx
inc ecx
mul ah
pop edx
inc ecx
mov ebp, 0xf52f66ac
inc ebp
mov ebp, dword [eax + eax - 0xc9b0000]
inc esp
movzx edi, dh
inc ecx
movsx ecx, di
btr cx, cx
dec ebp
lea eax, [eax + eax*2 - 0x1935fffc]
dec esp
lea esi, [esi + eax + 0x3386c791]
inc ebp
xor ebp, ecx
inc ecx
xadd dh, dh
inc ecx
ror ebp, 3
movsx ebp, ax
inc esp
movsx ebx, cx
inc ecx
dec ebp
inc esp
movsx edx, cl
inc ecx
rol ebx, cl
inc ecx
ror ebp, 1
inc ecx
not ebp
call fcn.01160828

Function at 0x11671b5
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec eax
mov dword [esp], 0x322393ff
call fcn.0126663b
mov eax, dword [ebp]
mov edx, 0xd581723a
xor edx, edx
shl dx, 0x47
mov ecx, dword [ebp + edx*2 + 4]
call fcn.012d0581
mov ecx, 0x51291627
mov ax, word [ecx + edi - 0x51291627]
movsx edx, cx
mov cl, byte [edi + ecx - 0x51291625]
lea edi, [edi + edx - 0x1625]
push edx
shr ax, cl
movsx ecx, dl
dec cx
jne 0x1263ac6
mov edx, 0x7c8b4f24
lea ecx, [edx + edx*8 + 0x7015bd27]
sal ecx, cl
lea ebp, [edx + ebp - 0x7c8b4f28]
bt dx, 0x98
call fcn.011b2af5
inc ecx
mov esi, 0xae049594
inc ebp
movsx ebx, si
inc ebp
movzx edi, si
inc edi
mov edi, dword [eax + edi - 0x9594]
inc ecx
mov esi, esi
inc cx
shl esi, 0x81
dec ecx
adc eax, 3
inc esp
movsx ebp, si
inc ecx
movzx ebp, bl
inc ebp
xor edi, ecx
inc ecx
dec edi
dec ebp
btc ebp, ebx
inc ecx
not ebx
inc ebp
and ch, dh
inc ecx
ror edi, 1
inc eax
movzx eax, ch
inc ecx
add dh, ch
inc ecx
bswap edi
inc ecx
inc ch
inc ecx
ror edi, 3
inc ecx
idiv bl
dec ecx
dec ebp
inc ecx
push ecx
inc ecx
push ebp
inc esi
xor dword [esp + ebx - 0x6a63], edi
inc eax
movsx edx, ch
dec esi
mov ecx, dword [esp + ebx*4 - 0x1a9a4]
inc ecx
movsx ecx, bl
dec ebp
arpl di, di
inc esp
movsx esp, cl
dec ecx
add ebx, edi
dec edx
not dword [esp + ebx*2 - 0xd4d6]
inc ebp
xadd ebp, ebx
dec edi
lea edi, [esi + esi - 0x3ccb16c2]
mov ecx, dword [edi + ebp - 0x94]
dec ecx
neg ebp
mov esi, dword [ebp + edi - 0x90]
dec eax
lea edi, [ebp + edi - 0x90]
dec eax
cdq
not ecx
cmovge eax, dword [esp + ebp - 0x93]
not esi
dec eax
cwde
and ecx, esi
xor dx, dx
inc eax
dec ch
mov dword [edi + ebp*2 - 0x126], ecx
dec eax
mov dword [esp + ebp - 0x93], ebx
ret 8
mov word [edi + edx*2 - 0x2c4e], ax
movzx eax, word [esp + edx - 0x1627]
not cl
sar ecx, 0x1e
lea ebp, [edx + ebp - 0x162b]
mov edx, dword [ebp + edx - 0x1627]
xor edx, ebx
or ax, ax
inc ecx
not edx
sbb edx, ecx
call fcn.00d67f54

Function at 0x1168b9c
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x8a3f700b
mov edx, dword [esp]
xor eax, ebx
call fcn.0119b549
mov eax, 0xfc068d99
sub ebp, 4
mov ecx, dword [ebp]
movzx edx, al
xor ecx, ebx
or dl, al
shr edx, 0xfe
sbb ecx, 0xcf93568f
shr ax, 0xa5
inc edx
call fcn.00d4db9e
Function at 0x1168d8d
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
rol edx, 1
lea ecx, [eax + 0xbb29f03]
not eax
neg edx
call fcn.0115d95b
lea eax, [ecx + eax - 0x33a7ff39]
lea edx, [ecx*4 + 0x41a7af25]
sub ecx, ecx
shl cl, 0x87
ror eax, 2
sub ecx, 0x441845ba
rol edx, cl
sal dword [esp + edx - 0x6afdc94d], 0xb3
sbb eax, 0xb52db1a2
xor ebx, eax
add ebp, eax
inc byte [esp + edx - 0x6afdc94a]
pop eax
pop eax
jge fcn.01124eea
lea ebp, [ebp + ecx - 0x5406010a]
mov dword [esp + ecx - 0x5406010e], ecx
btc eax, eax
xor edx, ebx
inc byte [esp + ecx - 0x5406010b]
dec edx
xadd cl, al
bswap edx
dec edx
push ecx
and cx, 0x1c82
sal eax, 0x17
ror edx, 2
sub eax, dword [esp + ecx - 0x5405ffff]
dec edx
inc cl
sub ecx, 0xd0a5f53a
xor ebx, edx
add edi, edx
sar eax, 0x98
not dword [esp + eax - 0x74]
cbw
mov dword [esp + eax - 0x78], edi
ret 4
inc word [esp + 1]
dec ecx
call fcn.011a369e
not edx
lea edx, [edx + ecx - 0x2c525710]
ror edx, 3
shl eax, 0x10
shr al, 0xe1
or ecx, 0x9611d61c
not edx
sete cl
neg al
dec cx
xor ebx, edx
dec cx
jge 0xcbe405
add edi, edx
push ecx
mov dx, word [esi]
xadd byte [esp + 1], al
shr cl, 0xe7
mov cx, word [esi + 2]
adc esi, 1
lea eax, [eax + eax*4 + 0xf911ebd]
shl ax, 0xe7
not dx
setae byte [esp + eax*2 - 0x19fb8afd]
xor eax, eax
and dword [esp + eax], 0xf50e553a
not cx
btr eax, 0x31
or dx, cx
movzx ecx, byte [esp + eax]
mov word [esi + eax*2], dx
sub byte [esp + eax*2 + 3], ah
pop edx
sbb edx, edx
adc eax, edi
jmp eax
sbb ecx, 0xb08e5822
shl eax, 0x9c
add al, dh
neg ecx
xor eax, 0xee307999
and ax, ax
shr edx, 0x59
xor ecx, 0x268400af
push eax
not ecx
xor ebx, ecx
xor dx, ax
push edx
adc edi, ecx
pop ecx
btc edx, 6
mov dword [esp + ecx*4 - 0x1e5d4], edi
ret
rol dword [esp], 0xf9
adc ecx, 0x3a8b303d
mov word [esp + 2], 0x10b2
xor ebx, ecx
neg ax
add edi, ecx
shl byte [esp + 2], 0x87
adc eax, dword [esp]
mov dword [esp + eax*2 - 0x2001fc00], edi
ret
bswap eax
mov dword [esp + ecx - 0x6fcbe175], edx
inc eax
ror eax, 3
inc eax
xor edx, edx
sub byte [esp + edx + 3], cl
xor ebx, eax
add edi, eax
movsx eax, cl
or edx, dword [ecx + ebp - 0x6fcbe175]
dec dword [esp + ecx - 0x6fcbe175]
xadd cl, ah
mov ecx, dword [ebp + ecx - 0x6fcbe171]
lea ebp, [eax + ebp - 0x7571]
inc dword [esp + eax - 0x7575]
and edx, ecx
not edx
movzx ecx, word [esp + eax*2 - 0xeaea]
mov dword [eax + ebp - 0x7575], edx
cdq
call fcn.0124341a
mov edx, 0x5039fc19
dec dx
movzx ecx, dx
mov edx, dword [ebp + ecx*8 - 0x7e0c0]
mov cx, word ss:[edx + ecx*2 - 0x1f830]
mov edx, 0x879faf28
add ebp, 2
bts dx, dx
mov eax, 0x35a8f033
ror eax, 0x24
mov word [eax + ebp - 0x335a8f03], cx
sbb ax, ax
mov ecx, edx
mov ecx, dword [esi + eax*2 - 0x66b40000]
cmovo eax, edx
adc eax, edx
adc esi, 4
shr al, 0x22
xor ecx, ebx
add eax, eax
jnp 0xd9c274
jns 0xd6e2eb
jns 0x131930a
ror ecx, 3
jmp 0xcc9dc9
Function at 0x1168e51
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
rol eax, 0x50
adc esi, ecx
lea eax, [eax*2 - 0x13f62a4b]
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [esp], 0xcb2c54bd
mul ecx
mov ecx, 0x8bd782f
xor ecx, dword [esp + ecx*8 - 0x45ebc170]
adc ecx, ecx
mov dword [edi + ecx - 0x117af05e], edx
jno 0x129a825
mov ecx, dword [esp + 0xc]
adc ecx, 0x66d5da
jmp ecx

Function at 0x116f068
Capabilities:
Encode data using base64

Disassembly:
imul dl
pop edx
mov dword [esp], ecx
mov word [edi], ax
movzx edx, byte [esp]
mov eax, 0x61173d13
dec byte [esp + edx*4 - 0x2cf]
lea ebp, [ebp + edx*2 - 0x16c]
xchg cx, ax
rol ax, 0x8d
mov eax, dword [ebp + edx*2 - 0x168]
xor eax, ebx
ror eax, 3
xor dx, 0xce31
lea eax, [eax + ecx - 0x2b18a7ef]
dec edx
bswap eax
btc cx, 0xb7
mov dword [esp + edx - 0xce80], 0x56b4540b
rol cx, 0x69
rol eax, 1
call fcn.00c8a4da

Function at 0x116f12e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
inc eax
xor ch, 0xb8
dec eax
mul dword [esp + eax*2 + 0x18]
inc esp
xor cl, ch
inc ecx
ror bl, 0x86
dec eax
cdq
or ecx, eax
dec eax
lea ebp, [esp + ebp + 0x20]
dec eax
mov dword [esp + eax], esi
inc esp
mov ebx, dword [ebp + eax]
dec eax
lea edi, [eax + edi - 4]
inc esp
mov dword [edi + eax], ebx
pop esi
inc ecx
pop esi
inc ecx
pop ebp
pop ebp
jno fcn.0126f980
cli
or al, 0x9d
nop
stosd dword es:[edi], eax
mov cl, 0xc2
cmp dl, dl
push ebx
outsb dx, byte [esi]
mov ecx, 0x328e9735
movsx edx, cl
call fcn.011ef755

Function at 0x1182a23
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ecx + esi - 0x19a89b]
mov dword [esp + ecx*2 - 0x33513e], ecx
btc cx, cx
shr cl, 0x25
lea esi, [esi + ecx*8 - 0xc94018]
mov dword [eax + ecx*2 - 0x325008], edx
lea edi, [edi + ecx*4 - 0x64a014]
push ecx
neg dword [esp + ecx - 0x1927fc]
sbb word [esp + ecx*2 - 0x325001], 0x4d18
mov eax, dword [edi + ecx*4 - 0x64a010]
mov edx, ecx
ror dx, 0xce
xor eax, ebx
dec eax
xor dx, 0xe127
dec ecx
shl ecx, cl
not eax
ror ecx, cl
push edx
shl ecx, 0xac
dec eax
btr dx, cx
xadd byte [esp + ecx - 0x17ffff1], dh
ror eax, 3
and cx, word [esp + ecx - 0x17fffff]
pop ecx
call fcn.00d33c1d

Function at 0x1183ec3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
setne byte [esp]
push eax
mov dword [esi], edx
movzx ecx, ax
btr ecx, eax
lea edi, [edi + ecx - 0xaf3c]
movsx edx, al
sbb edx, 0xa9892881
sub cl, 0x36
mov eax, dword [ecx + edi - 0xaf02]
or dl, byte [esp + edx - 0x5676d7b4]
adc cx, 0x7015
xor eax, ebx
not byte [esp + ecx*4 - 0x7c5b]
shr byte [esp + ecx*2 - 0x3e2a], 1
call fcn.00d4238e
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x891a]
jmp ebx
mov dword [esp], 0x6d284cab
test ebx, ebx
jmp 0x11b8385
lea esp, [esp + 4]
je 0x14c7fbd
mov eax, 0x661b32bf
mov eax, dword [ebp + ebx*4]
push eax
dec ebx
jmp 0x14c7fae
push 0x85ad122c
lea esp, [esp + 4]
jne 0x11b838f
mov eax, 0x549eacad
cbw
cwde
mov eax, dword [ebp]
call fcn.0124efb6
mov eax, 0xf698af87
movzx ecx, ax
movsx edx, al
mov ecx, dword [ecx + esi - 0xaf87]
push eax
shl al, 0x23
mov edx, dword ss:[ecx]
jns 0xd769c0
Function at 0x11865a7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pop edx
pop eax
jb fcn.0126f980
mov esi, 0x9d899dbe
dec ecx
add eax, 4
inc ecx
xor ecx, ecx
dec eax
mov dword [esp], esi
dec eax
mov dword [esp + 8], esi
inc esp
movzx ebx, word [esp + 8]
inc ecx
lea ecx, [ebx + ecx - 0xf85bf7c]
inc esp
mov edx, esi
inc edx
shl byte [esp + ebx - 0x9db1], 0xe1
ror ecx, 1
inc ecx
movsx eax, bl
inc edx
mov byte [esp + ebx - 0x9dbb], al
inc ecx
mov ebp, 0x729cfa99
xor ecx, 0xd985b16
jmp 0x118cc52
inc ecx
sub dl, 0x2c
neg ecx
cbw
inc edx
sar byte [esp + ebx*2 - 0x13b6d], 0x61
dec esi
mov dword [esp + ebx - 0x9db6], ecx
inc edx
xor dword [esp + ebx*2 - 0x13b74], ecx
dec esi
mov ecx, dword [esp + ebx*2 - 0x13b74]
inc ecx
movsx ebp, dl
dec eax
arpl cx, cx
dec ebp
lea edi, [edx + ebp + 0x4caa02b1]
dec eax
add ebx, ecx
inc esp
bt ebp, ebx
inc ecx
imul ebp, edx
inc ecx
mov edi, dword [ebx + edi - 0x9dbe]
jo 0xcb867c

Function at 0x118d821
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esi]
movzx edx, cl
not cx
not cx
lea esi, [esi + edx - 0x2f]
xor eax, ebx
xor ecx, ecx
sbb edx, 0x4f34a739
sbb eax, ecx
sal word [esp + ecx + 5], 0xaa
neg eax
or dword [esp + ecx + 4], edx
mov dword [esp + ecx*2], 0xaa39f48b
xor eax, 0xd50da08a
rol ecx, 0xee
xadd word [esp + ecx + 5], cx
call int.015a0bf7