joyce8/EMBER2024-capa huggingface dataset:
Function at 0x144534c
Capabilities:
Encode data using base64

Disassembly:
ror edx, 1
inc ebp
movsx ebx, ah
inc ecx
movsx ebp, bh
sub edx, 0x771e03b1
inc ebp
mov edx, esp
xor bx, bx
xor edx, 0x3e0fe210
dec ecx
and esi, edi
inc ecx
push esi
inc ebp
movsx ecx, bh
dec eax
neg ebp
inc ecx
sal ebx, 0x8d
xor dword [esp + ebx*2 - 0x6c1a0000], edx
inc ecx
pop esi
inc ebp
xadd cl, bl
dec eax
dec ebp
call fcn.00bd4a36
syscall
inc ecx
push ebx
pushfd
dec ecx
mov ebx, 0xa23acbf
invalid
dec ebp
xor ecx, esi
dec eax
shr dword [esp + eax*4 - 0x3bbfc], 0xbe
ror word [esp + eax*2 - 0x1de02], 0x44
dec ebp
lea ecx, [ecx + eax + 0x43df73eb]
dec ecx
ror ecx, 6
add cx, 0x13b1
dec ecx
neg ecx
add dword [esp + eax*2 - 0x1ddfd], ecx
dec eax
lea edx, [ecx*8 - 0x2c481349]
dec esi
lea ecx, [eax + ecx + 0x56344b90]
dec eax
ror edx, cl
inc ebp
movsx esp, bl
inc esp
movsx edi, si
dec ebp
xor esi, ecx
inc ecx
pop edi
dec eax
lea edi, [edi + eax*2 - 0x1de0a]
dec esp
mov dword [edi + eax*4 - 0x3bc04], ecx
shr ecx, cl
inc ecx
pop ecx
pop ecx
jbe fcn.01400bb8
inc esp
mov ebx, ebx
inc ecx
neg edx
mov dword [esp + ebx - 0x15], 0x44aea93e
sar ecx, 0xda
inc ebp
lea edx, [edx + ebx - 0x62d3cca]
dec esp
mov dword [esp + ebx - 0x21], ebx
dec esp
mov dword [esp + ebx*2 - 0x52], ebx
inc ecx
ror edx, 2
add word [esp + ebx - 0x1b], cx
jne 0x14fdf39
inc ecx
xor edx, esi
dec esp
lea edi, [ebx + ebx*4 - 0x3dfedacb]
dec ecx
lea esi, [edi + ebx*4 + 0x21ba18ad]
inc ebp
mov esp, edi
neg edx
jmp 0xbe7147
inc ecx
not edx
inc esp
movsx ecx, bl
inc esi
lea edx, [ebx + edx - 0x7a849f35]
dec esp
mov dword [esp + ebx*2 - 0x42], esi
dec esp
xor ecx, dword [esp + ebx*2 - 0x4d]
neg ebx
inc esp
xor dword [esp + eax*2 - 0x1ddf2], edx
movsx esi, cl
dec esp
mov esi, dword [esp + eax - 0xeef1]
dec ebp
arpl dx, dx
dec ebp
add ebp, edx
dec eax
lea ebp, [esi*4 + 0x3d114e19]
dec ebp
lea eax, [eax + eax*2 - 0x1de0a]
dec esi
mov ecx, dword [eax + eax - 0xef01]
xor word [esp + eax - 0xeefe], si
jle 0x13d5db1
mov ecx, 0x9eb84eb3
lea edx, [ecx + ecx*8 + 0x6c10a806]
mov ecx, dword [esi + edx*4 - 0x22db144]
jmp fcn.00c046fa

Function at 0x1445c4e
Capabilities:
Encode data using base64

Disassembly:
movsx ecx, bl
dec esp
adc ebp, edx
push ecx
inc cx
or ecx, 0x8b447c1c
pushfd
pop edi
add byte [eax], al
out 0x93, al
inc eax
shr dh, 0x24
call fcn.01540369
Function at 0x1445d65
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec esp
adc ebp, ebx
rol ebp, 0xb1
jae 0x14b8d59
dec esp
mov ebx, edi
dec edx
lea edi, [edi + edi - 0x6f5e]
call fcn.01480ac1
inc ebp
movsx edi, dl
rol dx, cl
push eax
inc edx
neg byte [esp + ebx*8 - 0x29d03]
neg dx
inc sp
xor esi, edx
dec edx
lea edi, [edi + edx*2 - 0x4842a744]
inc bp
and edi, ecx
inc si
xchg dword [esp + edx - 0x2421539e], ecx
inc dx
mov dword [edi + ebx - 0x53a1], edx
sete bl
dec edi
lea eax, [eax + edx - 0x242153a5]
inc ebx
or ebx, dword [edx + eax - 0x242153a1]
inc ecx
xor ebx, esi
inc ecx
rol ebx, cl
inc esp
movzx esp, al
inc eax
movsx edx, dh
inc edx
shr dword [esp + edx - 0x242153a1], cl
bswap ebx
lea ebx, [ebx + eax*2 + 0x526be620]
neg ebx
sar ebp, cl
dec esi
mov dword [esp + edx - 0x242153a1], esi
inc edx
xor dword [esp + edx - 0x242153a1], ebx
inc ecx
pop esi
inc ecx
ror bh, cl
shr eax, 0xb8
dec eax
arpl bx, bx
dec esp
add ebp, ebx
neg dl
call fcn.0145c42e
inc ecx
mov ebx, dword [eax + edx - 0x18]
inc ecx
xor ebx, esi
inc esp
mov esp, ecx
movzx eax, bp
inc edx
lea ebx, [ebx + ebx*2 + 0x6737f68a]
dec esp
lea ecx, [ebp*8 - 0x6dcd2a74]
sal eax, cl
ror ebx, 2
dec eax
sub ebp, ecx
inc ecx
xchg edi, edx
inc ebx
ror ebx, 1
dec eax
dec eax
inc cx
ror ebx, 0xaf
inc ecx
push esi
inc edx
xor dword [esp + edi*4 - 0x60], ebx
inc ecx
rol bl, 0xe6
jb 0x1467b2c
inc ecx
mov dword [edi + edi - 0x8ade], eax
pop ecx
jmp 0x14c6600
inc ebx
mov esi, dword [ebx + eax - 0x82]
dec esi
lea edx, [ecx*8 + 0x13964c13]
inc ecx
xor ebx, 0xc2891c0c
inc ecx
xor esi, esi
dec ecx
shl ecx, 0xb2
inc ecx
and cl, 0xe
neg esi
inc ecx
ror bl, 0x67
not esi
dec edi
lea edi, [edx + edx + 0x1186e931]
inc cx
shr ebx, 0x8f
jae 0x14d3397
cmc
retf
dec ebp
lea eax, [eax + ebx*2 - 0x56]
dec eax
mov dword [esp + ebx - 0x29], 0xef01a11b
movzx eax, word [esp + ebx - 0x27]
call fcn.00be1a22
inc ecx
mov ecx, 0xdf201c82
inc ebp
movzx ebx, cl
dec edi
lea eax, [eax + ebx*2 - 0x108]
dec ebx
lea eax, [ebx + ecx*8 + 0x3b1418a1]
jmp 0x14424c4
dec eax
sal ebp, cl
inc ecx
pop esi
setbe cl
dec eax
arpl bx, bx
jne 0x140829f
dec esi
lea ebx, [edi*8 - 0x28cec770]
dec eax
arpl bx, bx
dec esp
add ebp, ebx
inc ecx
sub edx, 0xa2a270b
rol word [esp + esi - 0x7b6c], 0x23
ror bp, 0x42
inc ecx
pop edi
inc ecx
pop edi
js fcn.01400bb8
push ebp
dec esi
mov dword [esp + edi - 0x18], ebp
ret
jmp 0x14efaa4
ror esi, 3
inc cx
neg ebx
inc ecx
movsx ebx, cl
not esi
inc ecx
push esi
jne 0x140b92a
dec esi
lea esi, [edi*2 + 0x5da38fad]
xor dword [esp + ebx], esi
movzx ecx, bl
inc ecx
pop esi
inc esp
or bl, al
dec eax
arpl si, si
dec eax
inc ecx
dec esp
adc ebp, esi
call fcn.014cc2c3
dec esi
mov dword [esp + edi*4 - 0x22b88], ebp
ret 0x10
Function at 0x144774e
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov esi, dword [esp + edx + 0x3384f7ac]
inc esp
movsx ecx, bx
dec esi
mov dword [esp + edx*2 + 0x6709ef38], ebx
dec eax
arpl bp, bp
dec edx
mov dword [esp + edx + 0x3384f7ac], ecx
inc edx
shr byte [esp + edx + 0x3384f79e], 0x67
dec esp
adc ebp, ebp
dec ecx
not edx
inc edx
movsx edx, word [esp + edx*2 - 0x6709ef2a]
inc esp
mov edi, edx
dec edi
lea eax, [eax + edx - 0x3384f79d]
inc ebx
movzx esi, word [eax + edx - 0x3384f79b]
movsx ebp, byte [esp + ecx*2 - 0x122]
inc esp
sub dword [esp + ecx - 0x95], ecx
inc cx
xor esi, esi
rol si, 1
mov eax, 0x4d150daf
dec si
neg si
inc ecx
xchg edx, ecx
inc edx
xchg dword [esp + edx - 0x88], ecx
sub si, 0x2eb6
inc esp
mov esp, ecx
inc edx
sal dword [esp + edx*8 - 0x4a9], 0x3c
pop ebp
ror si, 1
dec edx
lea ecx, [0x98228313]
inc cx
ror ebx, 0xa8
adc si, 0xcc94
jmp 0x145d882

Function at 0x1449c03
Capabilities:
Encode data using base64

Disassembly:
dec esi
lea edx, [esp + edx + 0x10]
inc edx
sal byte [esp + 0x9a73], 0x42
inc ecx
not cl
inc ecx
mov ecx, esp
inc bx
mov dword [edx + 0x134cc], esi
inc ecx
movsx ebx, sp
dec edi
lea eax, [esp + eax + 0x4d2f]
dec ecx
xchg esp, edx
inc ebx
mov ecx, dword [esp + eax - 0x10616d]
dec ecx
shl edi, 0x47
call fcn.00c3c781

Function at 0x1449c75
Capabilities:
Encode data using base64

Disassembly:
xor edi, ecx
and edi, 0xff
mov edi, dword [edi*4 + 0x14a2bc8]
shr ecx, 8
jmp 0x14996ec
xor ecx, edi
push 0x628cabb7
inc edx
mov dword [esp + 4], 0xd6917a02
xor ecx, 0x47331cb7
dec eax
jmp 0x1508745

Function at 0x14503eb
Capabilities:
Encode data using xor

Disassembly:
nop
mov edx, 0x9ba3ad48
invalid
call fcn.013ed1e4
adc byte [ebx + 0x1e20d0e], bh
sub eax, 0xbae52354
add byte [eax + 7], dl
lodsd eax, dword [esi]
xchg esi, eax
push ds
scasd eax, dword es:[edi]
in eax, dx
jg 0xc3689a
cmpsb byte [esi], byte es:[edi]
invalid
mov ecx, dword [esi]
mov edx, 0x67274b1d
mov dword [esp + edx - 0x67274b1d], 0x969db4b7
lea esi, [edx + esi - 0x67274b19]
pop edx
mov eax, edx
shr eax, 0xa9
xor ecx, ebx
mov dword [esp + eax*2 - 0x969db4], eax
xor ecx, 0xf7a05a01
lea ecx, [ecx + edx + 0x30dc5e4]
rol ecx, 1
sub ecx, 0xb8232c11
not ecx
dec ecx
bswap ecx
neg edx
xor ebx, ecx
add ebp, ecx
add dword [esp + eax*2 - 0x969db4], eax
lea edx, [eax + eax*2 + 0x7992a26]
mov edx, dword [edi + edx*4 - 0x21ec5ad0]
mov eax, dword [eax + edi - 0x4b4ed6]
mov ecx, 0xa99ba08a
mov ecx, dword [edi + 8]
adc edi, 4
div ecx
mov dword [edi], edx
mov dword [edi + 4], eax
call fcn.00c28a33
dec eax
shrd ebx, esi, cl
dec esp
lea edi, [eax + eax*4 + 0x563ec58b]
dec ecx
lea esi, [edi - 0x715d7365]
dec eax
mov dword [edi + edx - 0x55090108], ebx
shr eax, 0x24
dec ebp
lea eax, [eax + eax*8 - 0x5eda7ccc]
movzx ebx, ax
inc ebp
movzx esp, di
inc edx
mov ebp, dword [eax + eax - 0xbdb4f99]
inc ecx
xor ebp, esi
inc ebp
mov edx, esp
sub ebp, 0xc93c242d
jmp 0xc368df
Function at 0x1450664
Capabilities:
Encode data using base64

Disassembly:
sub ebx, 0x83983fb2
inc ecx
mov edi, 0x578d9709
ror ebx, 2
dec ecx
lea eax, [edi + 0x7e33a784]
dec eax
shl eax, 0x4e
dec edx
mov dword [esp + edi - 0x578d9709], 0x5221d51d
inc ebx
ror ebx, 1
dec esi
mov dword [esp + edi - 0x578d9701], esi
inc edx
not dword [esp + edi - 0x578d9707]
inc ecx
movzx edx, di
call fcn.01534229

Function at 0x1453e43
Capabilities:
Encode data using base64

Disassembly:
rol ax, 0x23
call fcn.01434f03

Function at 0x1453e4c
Capabilities:
Encode data using base64

Disassembly:
inc esi
inc esp
movsx edi, bx
inc esp
mov byte [esp + ebx*2 - 0x430ee5], bh
ror esi, 2
lea esi, [esi + ebx - 0x23c7170c]
call fcn.00c47b1c
dec eax
mov dword [esp], 0x2187762e
dec ecx
sub eax, 4
mov ebx, dword [esp + 1]
movsx ebp, byte [esp + ebx - 0x218773]
inc edx
mov esi, dword [ebx + eax - 0x218776]
dec esp
lea ecx, [ebp + ebp*4 + 0x753c9f90]
inc ecx
xor esi, esi
movsx ecx, bl
neg esi
inc sp
xchg dword [esp + ebx - 0x218773], ecx
sar word [esp + ebx*2 - 0x430ee6], 0x21
bswap esi
je 0xbfc370
dec eax
ja 0x1453efa
jno 0x1453f11
push ebp
adc byte [eax - 0x776ae752], ah
invalid
or al, 0xd1
nop
ret 0x41f4
sbb al, 0x8d
xor dword [edi - 0x76b1f07b], edi
mov esp, 0xfed1ec0c
call [ebp + 0x41]

Function at 0x1453ece
Capabilities:
Encode data using base64

Disassembly:
dec ebp
arpl cx, cx
inc cx
neg esp
call fcn.014a4c66

Function at 0x1453eda
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov esi, dword [esp + eax - 0xb3d6f1f]
dec edx
lea ebx, [edi*2 + 0x350e400b]
movsx ecx, al
inc esp
movsx esp, bx
dec ebp
arpl bx, bx
dec ebp
add ebp, ebx
dec edx
mov dword [esp + ecx - 0xb3d6f2f], ebx
inc ecx
and ecx, 0xf003ae1c
inc dx
mov edi, dword [edi + ecx - 0x12e14]
dec esi
lea ebx, [ecx*4 + 0xf85bf31]
dec esi
mov dword [esp + ecx - 0x12e14], edi
pop ebp
inc ecx
pop edi
inc ecx
pop ebx
inc ecx
pop ebx
jae fcn.01400bb8

Function at 0x1453f7d
Capabilities:
Encode data using base64

Disassembly:
inc ebp
mov ecx, dword [eax + eax*4 - 0x22fc]
inc ebp
xor ecx, esi
inc ecx
bswap ecx
mov edx, ecx
inc ebp
lea ecx, [ecx + edx - 0x160650d]
call fcn.00c50d7a

Function at 0x1455e28
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov ebx, 0xa9c2b9a
inc edx
mov dword [edi + ebx*2 - 0x15385734], ecx
dec ebx
lea ecx, [ebx + ebx - 0x1c7d26f7]
inc ecx
jmp ebp
dec eax
mov ebx, dword [edi + 8]
dec eax
add edi, 0xc
xor ecx, ecx
dec eax
test ebx, ebx
dec eax
lea esp, [esp + 8]
je 0x150b017
inc ecx
mov ebx, 0xd2843ba1
dec esp
lea ebx, [0xfffa3048]
mov esi, 0xe685ef0b
ror esi, 0xe
inc ecx
movzx esi, byte [ecx]
push 0x13b21e30
xor esi, ecx
and esi, 0xff
inc ecx
mov esi, dword [ebx + esi*4]
dec eax
xor dword [esp], 0xcd90631a
shr ecx, 8
xor ecx, esi
call fcn.00c1999f
jmp 0xc00dcc
not ecx
jmp 0x148b481
Function at 0x1456e58
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov ecx, 0x5b00ab3a
dec esi
mov ebx, dword [edi + ecx - 0x5b00ab3a]
inc esi
mov esp, dword [edi + ecx - 0x5b00ab32]
dec edx
lea edi, [edi + ecx - 0x5b00ab2e]
jmp 0x14f5dd9
inc ecx
push ebx
inc edx
shr dword [esp + edx + 0x6f73c0f6], cl
dec esi
mov esp, dword [edi + ebx - 0x5782e720]
dec edx
mov dword [esp + ebx - 0x5782e718], 0xe3016080
inc eax
xor ch, 0x97
dec eax
mov ebx, dword [edi + ebp + 0x6f73c06c]
inc edx
and dh, byte [esp + ebx - 0x5782e714]
call fcn.01442322
jmp 0xc2cf18
inc ebp
movzx edx, cl
inc ecx
movsx eax, dl

Function at 0x145c42e
Capabilities:
Encode data using base64

Disassembly:
not ecx
ror ecx, 2
neg dx
jno 0x1496a2a
xor ecx, 0xa40275b9
sub al, dl
rol ecx, 1
xor eax, edx
xadd edx, eax
xor ebx, ecx
shl dl, 0x41
ror al, 0xe5
adc ebp, ecx
call fcn.00c3f9dc
dec eax
mov ecx, dword [edi]
mov ebp, 0x6619e8b8
dec esp
mov ecx, dword [edi + ebp - 0x6619e8b0]
jmp 0xc01f2b
dec ecx
not ecx
pop ecx
jp fcn.01400bb8
lea ecx, [ecx + edx*2 - 0x34c276bd]
pop edx
jmp 0x144f3ab
sub eax, edx
xor ecx, 0xea936d34
inc ecx
add dx, dx
sal dx, 0xec
jp 0x1459e6f
mov ah, 0xbc
jecxz 0x1496ab8
invalid
sub al, byte [0x32bfea95]
xchg dword [edi + edx*2], eax
add bl, byte [esi + 0x4b35b242]
push es
les ebp, [esp + ebp*2 - 0x73802d0f]
mov byte [edx + 0x55], al
leave
mov edx, 0xaf890c7b
fmul qword [ebp + 0x46]
aaa
bound edx, qword [edx + eax*4 - 0x6d]
cmpsb byte [esi], byte es:[edi]
and al, 0x52
popfd
adc bl, byte [eax]
adc dword [ecx], edi
xchg edx, eax
aam 0x75
lodsb al, byte [esi]
jge 0x1496b0c
sbb bl, 0xfc
add ch, 0x70
pushfd
les eax, [0x4530f950]
jne 0x1496a7c
mov bl, bh
mov al, byte [edx + 0x36]
push 0x68dccbcc
mov al, 0x97
mov dword [0x70ba0b7c], eax
pop ecx
push esp
pop ds
pop ss
jge 0x1496aad
fiadd dword [bp + si - 0x60]
into
les ebp, [ebx - 0x42]
outsb dx, byte [esi]
nop
or byte [eax - 0x41], ch
pop ebp
cdq
sub dl, byte [ebx - 0x5691a6f7]
mov ebx, 0xaed6b02b
hlt
cmp eax, 0xb17b5204
add eax, 0xba31c9b4
jp 0x1496af5
pop ss
in eax, 0x91
xchg esp, eax
mov ah, 0xf5
ret 0x60f4
mov eax, 0xccc79164
push esi
clc
dec esi
cmp eax, 0x4febae61
jo 0x1496afa
wait
mov dword [ecx - 0x53b690b2], 0xa80986cd
cld
cmpsb byte [esi], byte es:[edi]
sub byte [eax + 0x2b4f8c6d], ah
pushal
hlt

Function at 0x14637ea
Capabilities:
Encode data using base64

Disassembly:
dec ebp
xadd edx, edi
pop edx
pop ecx
inc ecx
pop esp
pop ebx
jae fcn.01400bb8

Function at 0x14650fc
Capabilities:
Encode data using base64

Disassembly:
adc esi, 4
push 0x5033469f
call fcn.01437ece
dec esi
mov esi, dword [esp + ecx - 0x1aaa28ff]
inc eax
sal ch, 0xa4
sal dword [esp + ebp - 0x29e7], cl
dec ebp
arpl di, di
dec eax
rol esi, 0x5a
call int.014700e6
mov edx, 0x1a908881
rol edx, 0x90
mov edx, dword [esi]
jae 0x1401c69

Function at 0x146eef8
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
rol dword [esp + eax - 0x1015ac40], 0xce
dec ecx
sar dx, 0x43
sbb edx, eax
adc ax, dx
ror ecx, 1
sal ax, 0x42
xor ecx, 0x46800804
add byte [esp + eax - 0x101504fe], 0x83
pop eax
bswap ecx
call fcn.014dc61f
mov dword [esp + edx - 0x62830a0c], 0xac239e98
xor ecx, ebx
jmp 0xbfa092
Function at 0x146f4d0
Capabilities:
Encode data using base64

Disassembly:
push edi
mov edi, 0x6b931102
pushfd
add dword [esp + edi - 0x6b9310fa], 0xfec076cb
mov dword [esp + 8], 0xdad58103
mov edi, dword [esp + edi - 0x6b9310fe]
call fcn.01522381

Function at 0x146f4f6
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x79251fde], eax
neg edx
lea edx, [ecx + edx - 0x302a8f13]
xor al, 0x8a
xor ebx, edx
add ebp, edx
push ecx
lea edx, [eax + eax + 0x6d29e328]
movzx ecx, byte [esi + edx - 0x5f7421d0]
shl dword [esp + eax - 0x79251f53], 0x45
lea esi, [eax + esi - 0x79251f53]
sete al
ror eax, 0x51
xor cl, bl
shl eax, 0x67
rol cl, 1
neg cl
sar ax, 0xa
not dword [esp + edx - 0x5f7421cc]
and al, byte [esp + edx - 0x5f7421c9]
adc cl, 0x98
xor edx, edx
neg cl
neg dl
not cl
sub word [esp + edx], ax
shl edx, 0x8b
rol cl, 1
add cl, 0xa9
jmp 0x1486db5
add edx, eax
jne 0x1493fc8
or word [esp + edx + 6], dx
ror cl, 1
inc cl
jmp 0x14726b1
xor cl, 0xb3
bswap edx
sub cl, 0xa2
not dx
neg eax
adc dword [esp + edx*8 - 0x100709f4], 0x998c239d
rol cl, 1
or dx, dx
neg cl
pop eax
lea eax, [eax*2 + 0x53ade8b5]
xor bl, cl
neg edx
xchg edx, eax
push eax
lea ecx, [esp + ecx + 8]
sub dword [esp + edx*4 - 0x7d1a898], eax
movzx ax, byte [ecx + edx*4 - 0x7d1a89c]
inc dx
push edx
mov ecx, edx
lea edi, [edx + edi - 0x1f46a2a]
adc ecx, dword [esp + edx - 0x1f46a20]
jno 0x1530306

Function at 0x1471998
Capabilities:
Encode data using base64

Disassembly:
inc cx
shl ecx, 0x23
dec ecx
not ecx
inc ecx
neg edi
movsx ecx, bl
call fcn.014eecb3
inc ecx
mov edx, dword [eax + ebp*8 - 0xe8]
dec eax
shl esi, 0x4a
inc ecx
xor edx, esi
dec eax
mov dword [esp + ebp*4 - 0x74], 0x86993e03
ror ax, 0x81
ror si, 0x85
inc edx
dec eax
sub dword [esp + ecx - 0x488d351d], ebp
jnp 0x14bc566
inc ecx
movzx ebx, bl
inc esp
movsx ecx, bx
inc ecx
inc edi
jmp 0xc3c97e

Function at 0x147e69a
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea eax, [eax - 0x4d7a]
inc ecx
push esp
dec esi
mov dword [esp + edi + 0x70f88200], esp
inc ebx
mov ecx, dword [eax + edi + 0x70f881f8]
inc ebp
movzx edx, di
inc ecx
xor ecx, esi
inc esi
or byte [esp + edi + 0x70f88209], cl
inc ecx
sal bh, 0xe6
inc edx
lea ecx, [ecx + 0x14bf004b]
inc edx
setp byte [esp - 0x26ab]
not ecx
mov ebx, 0xba2a5b93
dec ecx
inc cx
and eax, edx
movsx ebp, word [esp + esi + 7]
ror ecx, 2
inc ecx
shl ah, 4
inc edx
setb byte [esp - 0x26ab]
inc ecx
sal esp, 0x7f
dec esi
mov dword [esp + 0x10], esi
inc edx
xor dword [esp + edi + 0x70f88210], ecx
dec esi
mov esi, dword [esp + 0x10]
dec eax
arpl cx, cx
dec esp
add ebp, ecx
inc edx
shr dword [esp + edi + 0x70f88201], 0x7d
inc ecx
sets bh
pop esi
pop esi
inc ecx
pop ecx
jns fcn.01400bb8
fisttp qword [0xc1389cae]
stosd dword es:[edi], eax
aas
push esi
popal
into
stosd dword es:[edi], eax
push ebp
cmp bh, byte [ecx - 0x2755ab8a]
mov dl, 0xcd
jns 0x147e6f2
pop edi
invalid
Function at 0x147edf4
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
neg eax
xor eax, 0xa5b0fdac
sar edx, 0x7d
xor ebx, eax
add ecx, 0xd8039ea4
add ebp, eax
mov dword [esp], ecx
mov eax, 0x38ae8216
mov edx, dword [edi + eax*2 - 0x715d042c]
add eax, dword [esp + eax*2 - 0x715d042c]
xadd ecx, eax
sub eax, dword [esp]
mov cx, word [edi + eax + 4]
lea edi, [edi + eax + 2]
or eax, dword [esp + eax]
jp 0x14f2db8
ret 0x5b00
shr cx, 1
call fcn.014a2b91

Function at 0x148d879
Capabilities:
Encode data using base64

Disassembly:
add esi, 4
movsx eax, byte [esp]
jmp 0x14bc63d
inc ecx
shl bh, 0x63
not ecx
inc ebp
xor edx, esi
dec esp
lea esp, [ecx*8 - 0x71d02849]
dec edx
lea ebx, [edi*2 - 0x2a43ced2]
inc ecx
neg edx
dec eax
lea eax, [ecx*4 - 0x2373386c]
inc esp
or esp, ecx
inc edi
lea edx, [edx + edi*2 + 0x3b1f4e34]
jg 0x14ef7b5
adc edi, 6
mov dword [esp], 0x24bea2a5
shrd eax, edx, cl
mov ecx, dword [esp]
shl byte [esp + ecx - 0x24bea2a2], 0x83
lea edx, [ecx*8 - 0x54edfbd2]
mov dword [edi + ecx*2 - 0x497d454a], eax
mov ecx, dword [esi + ecx*2 - 0x497d454a]
jnp 0xbff843
inc sp
xadd eax, esp
inc dl
call fcn.00c1d7b3
xor ecx, ebx
sub byte [esp], 0x20
inc word [esp + 1]
ja 0x14e778e
dec ecx
sub eax, 4
mov ecx, 0xa5062f9d
inc esp
movzx edi, cx
inc cx
ror edi, 0x21
inc edi
mov edx, dword [eax + edi*2 - 0x12f9c]
jb 0x14706a4

Function at 0x1494048
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec ecx
dec ebp
xchg edi, esp
ror ecx, 2
inc ecx
pop edi
xor dx, bp
dec eax
rol ebp, 0x1f
inc ecx
push esi
dec esp
lea esi, [ebp + 0x7c1d4309]
xor dword [esp + eax - 0x403c5cd0], ecx
inc ecx
movzx ebx, ah
call fcn.00c210c7
Function at 0x1498d38
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov edx, 0xc0b9592b
inc ecx
mov ecx, 0x1a338e05
dec ebp
lea ebx, [edx - 0x11f61261]
rdtsc
inc cx
xor edx, 0x8d4b2639
mov ah, 9
push ss
mov cl, 0xb4
or byte [edx - 0x73], 0xbc
invalid
dec esp
mov dword [esp + ebx*4 - 0x310a0d7c], esi
xor dword [esp + ebx - 0xc428359], ebp
dec esp
mov esi, dword [esp + ebx - 0xc428359]
inc ebp
movzx ebx, di
shr eax, 0xb8
dec eax
mov dword [esp + ebx - 0xc428359], 0x66a08a9b
dec eax
arpl bp, bp
jb 0xc06fce
neg byte [esp + ebx - 0xc428358]
pop esi
dec eax
add esi, 0x439a0
jmp esi
Function at 0x149ad8f
Capabilities:
Encode data using base64

Disassembly:
adc eax, 0xfbc14138
sbb al, 0x66
inc ecx
xchg edi, eax
dec esp
adc ebp, ebx
dec esp
mov dword [esp + eax - 0xff61], ecx
inc edx
inc dword [esp + ecx - 0xcffffe6]
inc ecx
pop ecx
pop eax
pop edx
pop ebp
inc ecx
pop ebx
jnp fcn.01400bb8
push eax
jno 0x149ae26
bound esp, qword [esi + 0x6c]
adc dword [ecx - 0x4a7dec59], edx
invalid
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
adc eax, dword [edx + 0x1f2ac6b5]
mov dword [ecx - 0x33747116], ecx
cmp ebx, ebx
notrack call fcn.01447b28
call fcn.01447b28
call fcn.01447b28
inc edx
jbe 0x149ae43
jno 0x149ae43
pop ecx
xor byte [edx - 0x536ce64d], cl
enter 0x536, 0xffffffffffffffad
retf 0x8948
js 0x149ad8d
push ecx
xchg edi, eax
mov eax, dword [0x44ae9454]
lahf
mov cl, 0x64
je 0x149adbd
outsb dx, byte [esi]
push cs
out dx, eax
stosb byte es:[edi], al
js 0x149ada9
inc esp
pop edx
or al, 0x55
int1
in eax, dx
in al, dx
stosb byte es:[edi], al
mov edi, 0x56de482f
mov edi, 0x549b5d2d
push esp
push ecx
xchg edx, eax
jnp 0x149ae60
invalid
aad 0x90
loopne 0x149ae59
xchg ebx, eax
add ah, byte [eax]
outsb dx, byte [esi]
adc dword [ebx], edi
adc byte [ecx + esi*2 - 0x35], bh
ljmp 0x8699
sub eax, 0x869975aa
lea esp, [eax + 0x6433ba21]
add eax, 0xeed27426
cmp dword [ecx], esi
adc eax, 0xb913c329
sal dword [edx], 1
or edx, ebx
adc edi, dword [ecx - 0x25f6cd2f]
cld
jge 0x149aeda
inc ebp
jb 0x149ae01
popal
cmp dword [edx + 0x51], ecx
jnp 0x149aee5
cmp dword [eax - 0x61785e13], esi
jle 0x149ae33
xchg dword [esi - 0x66613f82], ebx
sahf
cdq
and eax, 0x467384ae
test dword [ebp + 0x757ab15e], edx
pop esp
sal cl, 0x33
sub ebx, eax
sahf
jns 0x149ae81
pop esi
dec edx
xor al, 3
mov ebp, dword [edi - 0xffd95bc]
xor edx, dword [ebx + 0xa]
je 0x149aefd
dec eax
dec edx
cmp bl, byte fs:[ebx - 0x4b]
out dx, eax
cmp eax, 0xe788dd8d
fidiv dword [edx - 0x358c5013]
fld st(3)
jnp 0x149ae6f
dec ecx
ljmp 0x1b8a
or byte [0x8b0e5184], dh
jno 0x149af12
int3
jnp 0x149aeb9
inc eax
mov esp, 0x1dbd869b
jp 0x149af25
xchg cl, al
scasd eax, dword es:[edi]
mov al, byte [0x40b4f927]
shr dword [edi - 0x4b06d860], 0x40
mov esp, 0x3676e6e8
jnp 0x149af42
shl dword [edx], 1
jnp 0x149af05
pop esi
invalid
out 0x84, eax
add dword [esi], ebx
imul esp, dword [edi - 0x20cc3933], 0xffffffbc
xchg edi, eax
pop ds
jmp 0x649c2afa
xor ebx, edi
mov esp, 0xebe91f97
jnp 0x149af60
jmp 0x149af88
arpl word [edi - 0x1432a437], dx
int 0xeb
enter 0x2c5a, 0x3d
shl dh, 1
insb byte es:[edi], dx
fst qword [esi + 0x30]
mov esi, 0x3d4bbc9a
scasd eax, dword es:[edi]
ficom dword [eax]
salc
adc dh, dl
shl byte ds:[edi + 0x3d], 1
out 0xe4, al
retf 0xbf44
jmp 0x149af0b
fimul word [ebp - 0x7cb209e4]
inc edi
inc eax
cmp dword [edx], edi
fcom dword [ecx]
xchg esi, eax
aas
push ss
sub esi, 0xad6d3436
sub dword [0xb061afb0], edx
enter 0xffffffffffffe84f, 0x38
into
wait
push es
scasd eax, dword es:[edi]
mov esp, 0x665f3fff
inc eax
iretd