joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428fc0
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword fs:[0x18]
sub esp, 0x24
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.winetest
call dword [sym.imp.winhttp.dll_WinHttpOpen]
sub esp, 0x14
mov esi, eax
mov dword [ebp - 0x10], eax
call fcn.00431c30
mov dword [eax], 0x438e8a
mov dword [eax + 4], 0x15c
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.failed_to_open_session__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.00410490
mov dword [esp], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x50
mov dword [esp + 4], str.test.winehq.org
call dword [sym.imp.winhttp.dll_WinHttpConnect]
sub esp, 0x10
mov esi, eax
call fcn.00431c30
mov dword [eax], 0x438e8a
mov dword [eax + 4], 0x15f
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.failed_to_open_a_connection__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.00410490
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.winhttp.dll_WinHttpOpenRequest]
sub esp, 0x1c
mov edi, eax
call fcn.00431c30
mov dword [eax], 0x438e8a
mov dword [eax + 4], 0x162
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.failed_to_open_a_request__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.00410490
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x43b1f0
mov dword [esp], edi
call dword [sym.imp.winhttp.dll_WinHttpSendRequest]
mov ecx, eax
sub esp, 0x1c
mov eax, dword [ebx + 0x34]
test ecx, ecx
jne 0x42914c
cmp eax, 0x2efd
je 0x4291b0
cmp eax, 0x2ee2
je 0x4291b0
mov dword [ebp - 0x14], ecx
call fcn.00431c30
mov dword [eax], 0x438e8a
mov dword [eax + 4], 0x16b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.failed_to_send_request__lu_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x14]
mov dword [esp], ecx
call fcn.00410490
mov dword [esp], edi
mov edi, dword [sym.imp.winhttp.dll_WinHttpCloseHandle]
call edi
sub esp, 4
mov dword [esp], esi
call edi
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00431c30
mov dword [eax], 0x438e8a
mov dword [eax + 4], 0x168
mov dword [esp], str.connection_failed__skipping_n
call fcn.0040fef0
jmp 0x429181
Function at 0x431b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [esp], 1
call dword [0x43427c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_fflush]
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x433030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00433120
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x10026e0
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [0x1005018], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.01001bef
test al, al
jne 0x100270c
or eax, 0xffffffff
jmp 0x10027bf
call fcn.01001ae9
test eax, eax
jne 0x100271d
cmp byte [0x100501d], bl
je 0x1002704
push esi
push edi
lea eax, [ebp - 4]
push eax
call fcn.010023f0
mov esi, dword [ebp - 4]
cmp eax, 2
je 0x1002734
cmp esi, ebx
jne 0x1002738
cmp esi, ebx
je 0x100277a
mov edi, dword [esi + 8]
cmp edi, ebx
je 0x100277a
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x100279c
push 1
push 8
call fcn.01001505
test eax, eax
jl 0x100279c
push 2
call sub.DUI70.dll_InitThread
test eax, eax
jl 0x100276e
push esi
push edi
call fcn.010020e0
call sub.DUI70.dll_UnInitThread
push 0x1000000
call sub.DUI70.dll_UnInitProcessPriv
jmp 0x100279c
cmp byte [0x100501c], bl
jne 0x100279c
cmp esi, ebx
jne 0x10027a0
push 0xfffd
push 0x3ed
push ebx
push 0x3e9
push ebx
call fcn.010021c7
cmp esi, ebx
je 0x10027b5
cmp dword [esi + 8], ebx
jne 0x10027ac
push dword [esi]
call fcn.01001910
push 1
mov ecx, esi
call fcn.01001ac3
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret 0x10

Function at 0x438ca7
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
mov edx, 0xde43c7eb
call fcn.00438cdc
add edx, edx
sub edx, 0x9a11d5eb
xor dword [edi], esi
sub edx, 0xd7bb295d
inc edi
sub eax, 1
cmp edi, ecx
jne fcn.00438ca7
or eax, eax
ret
Function at 0x409c70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [esp], 1
call dword [0x40c094]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_fflush]
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x40b110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0040b200
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x4d8d20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x92000]
lea eax, [edi + 0xc87cc]
push dword [eax]
mov dword [eax], 0x2767d8f7
push eax
push edi
jmp 0x4d8d4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4d8d51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d8d40
mov eax, 1
add ebx, ebx
jne 0x4d8d63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4d8d74
jne 0x4d8d93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d8d93
dec eax
add ebx, ebx
jne 0x4d8d80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4d8d58
add ebx, ebx
jne 0x4d8d8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4d8de5
xor ecx, ecx
sub eax, 3
jb 0x4d8dab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4d8e1a
sar eax, 1
mov ebp, eax
jmp 0x4d8db6
add ebx, ebx
jne 0x4d8db6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d8d84
inc ecx
add ebx, ebx
jne 0x4d8dc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d8d84
add ebx, ebx
jne 0x4d8dd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4d8dc6
jne 0x4d8de2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4d8dc6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4d8e04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4d8df6
jmp 0x4d8d46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4d8e04
add edi, ecx
jmp 0x4d8d46
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x38cf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4d8e26
cmp byte [edi], 0x11
jne 0x4d8e26
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4d8e2b
lea edi, [esi + 0xd2000]
mov eax, dword [edi]
or eax, eax
je 0x4d8ea3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe01dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe0250]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4d8e58
mov ecx, edi
jns 0x4d8e87
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe0258]
or eax, eax
je 0x4d8e9d
mov dword [ebx], eax
add ebx, 4
jmp 0x4d8e75
call dword [esi + 0xe0254]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4d8ed4
cmp al, 0xef
ja 0x4d8ec7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4d8ea9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4d8eb6
mov ebp, dword [esi + 0xe025c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4d8f08
sub esp, 0xffffff80
jmp 0x45d17f
Function at 0x401550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x46f190]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4015b7
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.00401741
lea ecx, [esp + 0x1c]
call fcn.0040131c
cmp eax, dword [esp + 0x14]
je 0x4015cf
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.0040171e
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x401587
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401a79
add esp, 0x2c
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.0040171e
jmp 0x4015b9

Function at 0x401652
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
movsd xmm0, qword [0x4198a8]
push esi
push edi
push ecx
push ecx
movsd qword [esp], xmm0
push 0x419890
call fcn.00401006
add esp, 0xc
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x46f190], eax
push 0x27
mov esi, 0x46e130
mov edx, 0x547
push 0x41b900
mov ecx, esi
call fcn.00401112
pop ecx
pop ecx
mov edx, 0x8aafdc01
call fcn.00401550
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0x4e4
push esi
call eax
test eax, eax
je 0x4016c8
call fcn.004015ed
push 0x1000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4016e0
or eax, 0xffffffff
jmp 0x4016f6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
call dword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
xor eax, eax
pop edi
pop esi
leave
ret 0x10

Function at 0x402327
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402366
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402366
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402366
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402366
cmp dword [ecx + 0x74], 0xe
jbe 0x402366
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408324
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155b8
push 0x4155b0
push str.FlsAlloc
push 0x1e
call fcn.00408242
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408358
push dword [ebp + 8]
mov ecx, esi
call dword [0x414118]
call esi
jmp 0x40835e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0xe493e9
Capabilities:
Get number of processors

Disassembly:
shl dl, 0x66
or al, dl
xor bl, cl
mov dword [esp + edx - 0xc440], eax
sal dl, 0x45
push eax
lea esi, [edx + esi - 0xc402]
adc dword [esp + edx - 0xc3fc], eax
mov word [esi + edx*4 - 0x31000], cx
lea ecx, [edx + 0x13a7e2b1]
ja 0x12a13a2
add cx, dx
mov word [esi], cx
mov eax, 0xe493c51f
movzx edx, ax
lea edi, [edi + edx - 0xc523]
mov edx, dword [edx + edi - 0xc51f]
push eax
pop ecx
xor edx, ebx
rol cl, 0x66
sar cl, 0xc3
sub ecx, ecx
ror edx, 1
not edx
jmp 0x128f061
xor ebx, edx
sub cx, 0x1109
jnp 0x1149102
adc ebp, edx
mov edx, eax
jmp ebp
lea ecx, [eax*2 + 0x5c1767a5]
ror edx, 2
bswap ecx
sub edx, 0x9e27ac1b
jmp 0xebef46

Function at 0xe4ec84
Capabilities:
Encode data using xor

Disassembly:
dec esi
lea edx, [ecx + edx - 0x25]
inc esp
sub eax, dword [esp + ecx - 0xe]
inc ebp
movsx esi, cl
inc ecx
movzx esi, word [edi + ecx*2 - 0x52]
rol dword [esp + ecx - 0x20], 0xf3
dec esi
lea edi, [ecx + edi - 0x27]
inc sp
sub esi, dword [esp + ecx*2 - 0x35]
xor si, di
inc esp
xchg dword [esp + ecx*2 - 0x35], eax
inc ebp
movzx esp, cx
inc cx
sar ecx, cl
rol si, 1
call fcn.019743c4
cmp edi, dword [ebx]
jo 0xe4eced
xor edx, esp
invalid
sbb cl, ch
fcompi st(6)
jle 0xe4ed11
sbb bl, byte [ecx + 0x6d9d1ece]
neg byte [ecx + 0x2cbdea19]
xor eax, 0x27dd369d
sub al, 0x35
popfd
frstor dword ss:[edi]
out dx, al
invalid
fstp qword [edx - 0x156ea0f7]
add byte [eax + eax*2 + 0x6c], dh
insb byte es:[edi], dx
mov bl, 0xe
std
inc esi
dec ebx
mov ebx, 0x4d722e0e
inc edx
push 0
arpl word [0x3d096b8c], di
pushal
xor ebp, dword [eax + 0x46]
sal byte [esi], cl
jg 0xe4ed08
dec edx
mov bh, 0
add byte [eax], al
shr dh, 0xc0
fdivr dword [0xf6d0bc3e]
sal dh, 1
jle 0xe4ed43
fcomp qword [edx - 0x2f]
mov ah, 0xd0
arpl word [eax], si
sub ch, dh
xor byte [eax], ch
cmc
test al, 0x33
sbb dword [ebp - 0x670a409d], esp
les esi, [ecx + 0x57]
arpl word [edi + 0x71c498f5], di
push edi
push edi
mov dh, 0x46
xor dh, ah
dec ebp
add al, 0x72
in al, 0x8b
adc al, 0x5a
adc ch, ah
or ebp, dword [esp + edi*8 + 0x5bd1dbe4]
jae 0xe4ed4a
loope 0xe4ecfe
loopne 0xe4ed39
pop edx
salc
aas
push esi
sub dl, ch
dec edi
retf

Function at 0xe79032
Capabilities:
Encode data using xor

Disassembly:
inc edx
pop ecx
bswap edx
add edx, 0xf72c79b6
movzx ecx, al
xchg cx, ax
xchg ecx, eax
or ax, 0xefa2
xor ebx, edx
add ebp, edx
sub cx, cx
sbb ax, cx
mov edx, dword [eax + esi - 0xefa7]
jle 0x19095df
cmp edx, dword [esi + ebp*8 + 0x8752de7]
cmpsd dword [esi], dword es:[edi]
or byte [0x2767e60], bl
jbe 0xe79040
cmp eax, 0x788e8212
aas
jbe 0xe79093
arpl bp, bx
cmp ch, dl
mov ch, 0xc0
mov ecx, 0x1616eaa3
mov eax, 0xc729ff49
xchg edx, eax
or byte [edi - 0x29c434cc], 0x1b
insd dword es:[edi], dx
mov ch, 0xc3
add al, al
dec ebx
xor dword [edx - 0x63], 0x42
adc dword [edx], edx
salc
sub eax, 0xae614b6c
or dword [ebx], ebx
mov al, byte [0x3c28df1b]
add ecx, 9
jbe 0xe79085
test eax, 0xf89322d
not dword [esi]
sub bl, byte [eax]
hlt
neg al
xor cl, byte [eax + esi - 0xef55]
lea esi, [esi + eax*8 - 0x77ac6]
inc eax
lea eax, [eax*2 + 0x419e3e96]
shr edx, cl
mov dword [esi + eax - 0x41a01d4a], edx
jmp ebp
Function at 0xe84cd6
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax*2 + 8], ebp
movsx ebp, al
mov dword [esp + eax + 4], edi
mov dword [esp + eax], ebx
jmp 0xf7a9ef
jmp 0x10399e4
movzx ebx, bp
add ebp, esi
shr ebx, 0x81
or ebx, edx
movzx edx, ax
xchg dh, al
add edx, ebx
shl edx, 2
inc ax
inc eax
ror ax, 0xc8
mov eax, ebp
jne 0x192056e
push 0x7f109cb8
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x1910654
mov eax, 0x9781dd8c
call fcn.0191063f
call fcn.00f3a0ef
adc eax, edx
jmp 0xf54891

Function at 0xec6b4f
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x666931a1
call fcn.00e55748
Function at 0xef91ef
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
dec esp
lea eax, [esi + eax*2 + 0x32360206]
dec esi
lea esp, [esp + 0x18]
dec eax
shr dword [esp + ecx - 0x5ba4c650], cl
inc eax
xchg dh, al
inc dx
movzx esi, byte [ecx - 0x5ba4c660]
dec eax
mov dword [esp + edx + 0x1b30f816], 0xee0c7da0
dec ebp
lea edx, [edx + ecx - 0x5ba4c662]
push ebp
inc cx
mov dword [edx + ecx - 0x5ba4c660], esi
dec eax
adc edx, 0xe328a798
jne 0xf07597
inc edi
mov ecx, 0x865e3bf6
and dword [ecx - 0x5b1cf002], 0
sbb cl, byte [bp + di + 4]
add byte [esi + 0x1dbd48a], ah
add ch, al
invalid

Function at 0xf2a47c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esi]
mov dword [esp], ecx
shr cx, cl
jne 0x123191e
mov dh, 0x3a
push es
imul eax, eax, 0x56848356
add al, cl
mov bh, byte [0xdf915a0a]
inc esi
scasb al, byte es:[edi]
inc edi
mov ebx, 0xfce0aedf
sub cl, byte [ebx - 0x7d]
insd dword es:[edi], dx
mov cl, 0xdf
mov ah, 0xca
and eax, 0xb3a555f3
inc eax
fbstp tbyte [edx + ecx*8 + 0x55f32567]
movsd dword es:[edi], dword [esi]
mov bl, 0x40
js 0xf2a500
scasd eax, dword es:[edi]
into
xlatb
xor ch, byte [edi - 0x35c1e8ff]
pop ss
retf 0x639a
lcall 0x67b8, 0xaa5f6063
scasd eax, dword es:[edi]
xchg esp, eax
jnp 0xf2a4a9
dec eax
imul eax, dword [ecx - 0x75], 0xffffffb2
ficom dword [eax - 0x5f]
xchg ecx, eax
or dword [ebp - 0x40], 0xffffffb3
test dword [ebx], esi
loope 0xf2a4be
mov eax, dword [0xc04d8391]
mov bl, 0x85
xor esp, ecx
in al, 0x21
pushal
or eax, 0x85db7758
ud1
sub dword [edi + 0x54], 0xffffffa1
and dword [eax + 0xd], esp
pop eax
ja 0xf2a4bb
test dword [edi], ecx
mov ecx, 0xa1546f83
pop edi
jns 0xf2a549
dec esp
retf
or bh, byte [eax + ebx*2 + 0x5f5bc629]
or eax, 0xd1426b92
test byte [esi + 0x35eef119], ch
push edi
and al, 0xa3
mov ecx, dword [edi + 0x76ee961c]
cli
jae 0xf2a53c
adc al, 0x70
inc ebp
scasd eax, dword es:[edi]
or al, 0x72
sub dword [ecx], ebx
in eax, dx
adc byte ds:[ebp - 0x58d52515], bh
push ds
mov bl, 0x42
xor al, 0x4a
jl 0xf2a530
xchg esi, eax
out dx, al
jle 0xf2a576
jns 0xf2a550
jl 0xf2a4d0
mov bl, 0x77
sbb ah, byte [edx]
cmp byte [edx - 0x1b], 0x4b
mul esp
imul esp, dword [ebp - 0xde3e249], 0x54
in al, 0x6b
movsd dword es:[edi], dword [esi]
mov bh, 0x1d
sbb al, 0xf2
push esp
sbb dh, bh
iretd
mov dh, 0x3f
pop es
push eax
loope 0xf2a570
stc
out 0x47, al
lodsb al, byte [esi]
rol byte [edx - 7], 0xe4
add al, 0x58
rcr dword [ecx - 0x31], 0x98
loopne 0xf2a574
and dword [edi + 0x28dda996], edi
add esp, esp
mov ch, 0x4a
scasb al, byte es:[edi]
inc esi
mov edx, 0x92a2b4a6
push es
fsubr dword [ecx + esi*8 + 0x44dfea0]
inc ecx
invalid
xor ebx, eax
shr dx, 3
ror cl, 0xc1
sbb word [esp + ecx - 0x14ac49a7], 0xf288
add ebp, eax
and byte [esp + edx*2 - 0x7d0e1ec4], cl
mov dword [esp + ecx*2 - 0x29589350], ebp
ret
mov eax, dword [esi + 4]
lea ecx, [ecx + ecx*4 - 0x187e2679]
je 0x107f4f4
mov cl, byte [esi + 8]
call fcn.011458a4
Function at 0xf30bfc
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
xor edx, ebx
push 0x6ab9e694
call fcn.01956c14
mov edx, dword [esi + eax*2 - 0x6726005e]
lea esi, [esi + eax - 0x3393002b]
sal eax, 0xfc
js 0x19d8f37
xor edx, ebx
xor edx, 0xf0b205ad
mov ecx, 0x3d09c335
ror al, 0xe2
xchg cx, ax
neg edx
rol eax, 6
or ecx, eax
dec edx
inc al
neg edx
or eax, eax
xor ebx, edx
add eax, eax
adc ebp, edx
shl ecx, 0xec
jmp ebp

Function at 0xf3bb8c
Capabilities:
Encode data using xor

Disassembly:
inc ecx
push ecx
dec eax
xor esi, ebx
inc ecx
mul eax
shr word [esp + ebx - 0x54c3e0e2], 0x2b
inc ecx
pop esp
dec ecx
bswap esi
inc edx
mov dword [ebx + edx - 0x54c3e0e2], edx
inc edx
mov dword [ebp + edx - 0xa49f], eax
call fcn.010af5ea
mov ax, word [esi]
mov ecx, 0xdc258837
lea edx, [ecx*8 + 0x6998bca8]
xadd ecx, edx
lea esi, [esi + ecx*2 - 0x4dd50d2c]
inc edx
or ecx, 0xe01baf96
rol edx, 0x1e
movzx ecx, byte [edi + edx*2 - 0x6e12c41c]
lea edi, [edi + edx - 0x3709620d]
xor cl, bl
push edx
ror dl, 0x44
sub cl, 0x18
rol cl, 1
shr dl, 0xe5
add edx, edx
inc cl
not cl
sub cl, 0x82
push edx
ror cl, 1
jmp 0xf3d664

Function at 0xf4661d
Capabilities:
Encode data using xor

Disassembly:
call fcn.0193cf42
inc esp
xor ah, bh
jmp fcn.019d9e9d
add eax, 0x333b5f03
lea ecx, [edx + ecx - 0x3d51efb9]
sbb dl, ah
shr dl, 0x41
xor ebx, ecx
add ebp, ecx
call fcn.00fc0aee
and dword [esp + ecx*4 + 1], ecx
sbb eax, 0xcc872a36
ror eax, 3
movsx edx, byte [esp + ecx]
bswap eax
xor ebx, eax
pop ecx
add esi, eax
shl word [esp + ecx*4 - 0xe0], 0xc1
bswap edx
mov edx, dword [ecx + ebp - 0x38]
lea eax, [ecx + ecx*4 + 0xb2eae98]
jl 0xee7e7d
xchg ecx, eax
xchg al, al
push cs
inc esi
invalid
Function at 0xf570c9
Capabilities:
Authenticate hmac

Disassembly:
div ecx
mov ecx, 0xf201259d
mov dword [esi], edx
mov dword [esi + 4], eax
movsx edx, cx
neg dl
add ecx, 0x680b513f
lea edi, [edi + edx*2 - 0x4aca]
mov eax, dword [edi + edx - 0x2563]
xchg ecx, edx
xor eax, ebx
or edx, ecx
cmova cx, dx
sbb eax, 0xb2aed136
ror eax, 1
neg edx
sub ecx, 0x521f9da1
xor eax, 0xe3007611
neg eax
xor ebx, eax
xadd edx, ecx
adc dx, 0x6704
add ecx, ecx
add ebp, eax
movzx eax, cl
sal ecx, 0x53
jmp ebp
bswap edx
bswap eax
neg edx
neg ax
xor al, ch
xor ebx, edx
add ebp, edx
mov edx, dword [edi + eax*2 - 0x24000000]
jmp 0xeb5e77
mov dword [esp + edx*2 - 0x2a], edx
xor ecx, ebx
not ecx
lea ecx, [ecx + edx - 0x5c8804c7]
lea edx, [edx - 0x4df318e9]
neg ecx
mov word [esp + 1], 0xf634
ror ecx, 3
sub ecx, 0xa9d6191
jmp 0x12660a4
mov eax, dword [esi + 4]
mov ecx, 0x35267721
mov edx, dword [edi + ecx - 0x35267721]
shr word [esp + ecx*2 - 0x6a4cee40], cl
sub ecx, dword [esp + ecx*2 - 0x6a4cee42]
adc ecx, 0xe86b292
lea edi, [ecx + edi - 0x48e767c]
xor edx, ebx
mov eax, 0x8e3872a2
lea eax, [ecx*4 + 0x15ba0cb1]
bswap edx
inc eax
xchg dword [esp + ecx - 0x48e7680], ecx
xor cx, 0xc213
sbb edx, 0xb933a0ba
not edx
ror edx, 3
xor cx, 0xe3b5
inc ecx
rol byte [esp + ecx - 0x3f1e9292], 0x83
not edx
dec dword [esp + ecx - 0x3f1e9293]
xadd ecx, eax
ror edx, 2
shr byte [esp + ecx - 0x67127944], cl
sub ecx, dword [esp + eax*2 - 0x7e3d2526]
not dword [esp + eax*2 - 0x7e3d2526]
not edx
bswap eax
rol dword [esp + ecx - 0x628473c6], 0xa
lea edx, [ecx + edx - 0x277ab4b1]
inc al
neg edx
and eax, eax
xor ebx, edx
add ebp, edx
ror word [esp + ecx - 0x628473c5], 0xe1
mov ecx, dword [esi + ecx - 0x628473c6]
pop edx
jno 0xfa6723
mov eax, 0x4e2f683a
movsx edx, ax
or eax, edx
mov edx, dword [esi + eax - 0x4e2f683a]
jne 0x121d92f
not dx
and ax, dx
inc cx
mov word [ebp + ecx - 0x4068d889], ax
mov dword [esp + ecx - 0x4068d889], esi
ret 4
inc eax
lea esi, [esi + eax - 0x4e2f6837]
movzx ecx, al
shr eax, cl
xor edx, ebx
add eax, eax
sbb edx, 0xca9adaa8
neg edx
xor ecx, eax
sal cl, 6
jne 0xe869f8
mov ecx, 0xacbb7ba3
mov edx, ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
add esi, 4
jmp 0xe4bd69
rol dword [esp], 0xf5
ror ecx, 1
rol word [esp + 1], 0xe3
jae 0x1135c44
xor ebx, ecx
pop eax
rol edx, 0xc7
add edi, ecx
push edx
mov ebp, dword [ebp + edx - 0x6739659]
or dword [esp + edx - 0x6739659], 0x72225c82
neg dx
pop edx
jns fcn.010179ae

Function at 0xf6f1b5
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + edx - 0xff], 0x12937685
xchg byte [esp + edx*2 - 0x1fb], dl
rol eax, 2
call fcn.0128e1aa
rol ecx, 3
lea edx, [eax - 0x46ce8ae9]
not eax
xor ebx, ecx
call fcn.00eda7f3
syscall
call fcn.0129c0f5

Function at 0xf8b6a6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov dword [esp], ecx
ror eax, 2
call fcn.011da862
dec ecx
add edi, 4
call fcn.01246d1e
cmp ah, byte [ecx + 0x6c]
sub dword [eax], esi
mov eax, 0xfc10d37e
xchg edi, eax
invalid

Function at 0xfad734
Capabilities:
Encode data using base64

Disassembly:
xor bl, cl
bswap eax
call fcn.012959f4