joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc6f1ed
Capabilities:
Encode data using base64

Disassembly:
movsx ebp, cx
inc sp
xor edx, edi
inc cx
not edx
dec esi
lea esp, [ecx*2 + 0x6ab51513]
dec eax
sal eax, 0xeb
movzx ebx, bp
inc cx
neg edx
inc cx
add edx, 0xf411900
mov edi, 0xfd323d4
mov dh, 0xf1
inc cx
neg edx
inc cx
xor edi, edx
dec ebp
dec esp
add edx, esp
inc esp
mov edi, eax
inc esi
mov dword [ebp + edx - 0x34a1], eax
dec ebp
lea ebx, [ebx + ecx - 0x45b534a6]
inc ecx
mov ebp, dword [ebx + ebp - 0x34a1]
dec eax
or ecx, 0xd30ec403
setp dl
inc eax
setbe dh
xor ebp, edi
bswap ebp
inc ecx
lea ebp, [ecx + ebp - 0x501cf856]
rol ebp, 2
inc ebp
inc ecx
xor bl, bh
inc ecx
or dl, ah
dec ebp
lea ecx, [ecx + ebx*2 - 0x9da3945]
push edi
xor dword [esp + ebx*8 - 0x1a510], ebp
dec eax
lea edi, [ebx + edx*4 - 0x64560a56]
pop edi
dec eax
shl ebx, cl
dec eax
rol esi, 0x5c
dec eax
arpl bp, bp
ja 0xcee018
dec esp
mov dword [esp + ebp*2 - 0x4a], esi
ret 8
dec edx
mov dword [esp + ecx*2 - 0x70a1fed2], ecx
xor ebx, edx
sub al, 4
inc ecx
adc esi, edx
call fcn.00c3e19a
inc ecx
mov ecx, 0xa8b68e95
mov ecx, 0x122da9a5
inc ebp
mov eax, dword [ebp + ecx - 0x122da9a5]
rol ecx, cl
jae 0xc70d29
dec ebp
lea ebp, [ebp + ecx - 0x45b5349e]
inc ecx
movsx eax, cx
dec ebp
lea ebx, [ebx + ecx - 0x45b534a4]
inc ebp
movzx edx, word [ebx + ecx - 0x45b534a2]
jae 0xb9cf99
inc ecx
dec edi
inc ecx
movzx ecx, cl
inc ecx
xor edi, 0x9e3da9b1
dec edx
mov dword [esp + ecx - 0x618fadb4], edi
pop edx
dec eax
add edx, 0x16ad38
jmp edx

Function at 0xc7132d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x8fb2ab34
mov dword [esp], eax
push 0x8880b01f
dec ebx
call fcn.00c6a4e5

Function at 0xc72a3d
Capabilities:
Encode data using base64

Disassembly:
movsx esi, cx
dec eax
mov dword [esp + ecx*2 - 0x2407182a], edi
dec eax
lea eax, [esi + eax*4 + 0x2fbf9737]
inc ecx
movsx edi, dx
dec eax
lea ebp, [eax + ecx*8 - 0x61e141f9]
inc esp
xor dword [esp + ecx - 0x12038c15], ecx
and edi, 0x18abd19d
pop edi
dec esp
adc eax, eax
dec ebp
arpl cx, cx
inc ecx
setg al
dec ebp
adc esi, ecx
inc cx
mov ebx, dword [ebp + ecx - 0x12038c15]
dec esi
lea edi, [esi + edx*8 - 0x1ff9f84e]
inc bp
mov ecx, dword [ebp + ecx*4 - 0x480e3052]
call fcn.01434332

Function at 0xc77840
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + esi - 0x51919e89], 0x1a94b10b
dec esp
lea esp, [edx + 0x4490d63e]
inc esp
xor eax, edi
not dword [esp + edx - 0x51919e87]
inc ecx
dec eax
jmp 0xc360bb

Function at 0xc8c3d2
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], edx
mov edx, dword [edi]
push 0x5f82dda7
push 0xb42c8c24
add edi, 4
and byte [esp + 6], 0x80
xor edx, ebx
rol edx, 3
mov eax, 0xaf3e0392
call fcn.014254f1

Function at 0xc8c424
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea ebp, [ebp + eax - 0x51bb29fa]
pop ecx
inc bx
mov dword [ebp + eax - 0x51bb29f8], edx
inc ecx
shr eax, 1
call fcn.00bc7b74

Function at 0xc8da04
Capabilities:
Encode data using base64

Disassembly:
test dword [esp + 8], 0xf43d5f16
not dword [esp + 8]
push dword [esp + 4]
popfd
lea esp, [esp + 0x18]
call fcn.014474f1
Function at 0xc9373d
Capabilities:
Encode data using base64

Disassembly:
inc ecx
movzx ebp, ah
mov esi, 0x1c062e15
inc ecx
not eax
shr ecx, 0x55
dec edx
lea ebx, [ecx - 0x6841afec]
jae 0xb817af
sar dx, 0xc4
lea edi, [edi + eax - 0x503d0334]
lea eax, [eax + 0xcaa9989]
ror eax, 0xca
xor cl, bl
add al, al
call fcn.00b8ce4c
bswap esi
mov esi, dword [esp + 8]
mov dword [esp + 8], 0xfc229312
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.014474f1
xor ebx, ecx
shr al, 0xc3
shr eax, 0x63
dec edx
adc esi, ecx
jmp esi
mov ebx, dword [esp + eax - 0x56808c16]
lea eax, [eax + 0x63d41ad]
xadd al, ah
neg eax
pop ecx
pop ecx
pop eax
jnp fcn.00ccde4a
mov esi, 0xa1840a02
inc eax
movzx eax, dh
mov ebx, eax
inc ecx
mov edx, dword [ebp + eax*4 - 8]
dec esp
lea ecx, [ebx + 0x4f17b92d]
inc esp
mov edx, eax
inc ecx
dec edx
inc ecx
mov eax, dword [ebp + eax*2]
inc ecx
mov esp, 0x239d82a8
mov ebp, ebx
inc esi
mov edi, dword [ebx + ebp + 6]
dec eax
rol ebx, 0xad
jp 0xb9b268
inc eax
sar dh, 0xa1
dec edi
lea ebp, [ecx + ebp - 0x4f17b92b]
inc ecx
inc dl
inc ecx
div edi
inc cx
xor ecx, 0x894349a4
push esp
push ebp
cld
inc ebx
mov dword [ebp + edx + 2], eax
jno 0x140cc48
inc ebp
movzx edi, sp
inc ebp
xadd dl, ah
dec edi
lea ebx, [ecx + ebx - 0x4f17f08f]
mov edx, ebp
movsx ecx, bx
call fcn.00bdadaa
ror edx, 0x9c
and cl, al
not cl
lea eax, [edx + edx*2 + 0x1035033e]
sar eax, 0xf2
mov word [edx + ebp], cx
movzx ecx, ax
adc ax, dx
mov ecx, dword [edi + edx*2]
lea edi, [edi + edx + 4]
setge al
xor ecx, ebx
ror ecx, 1
rol dl, 0xc1
dec eax
bswap ecx
not ecx
xor ecx, 0x9700b7b6
dec dx
jne 0xc45227
jmp 0xb80aea

Function at 0xc98fdf
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + eax - 0x34], edi
xor dword [esp + eax - 0x34], ebx
dec eax
sub ebp, edx
js 0xb6be63
dec eax
dec ebp
dec eax
mov edi, dword [esp + eax*4 - 0xe8]
dec eax
mov dword [esp + eax*4 - 0xe8], edx
and edx, 0xa63c2087
dec eax
arpl bx, bx
call fcn.00c02c23

Function at 0xc9dbbd
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea ebx, [eax + ebx - 0x743c7811]
inc edi
mov edi, dword [eax + ebx - 0x743c780d]
call fcn.00b8485e
inc ebp
dec esi
mov dword [esp + ecx - 0x2507], ecx
not ebp
inc ebp
neg ebp
dec esi
mov dword [esp + ecx - 0x24ff], ecx
inc edx
movsx edx, byte [esp + ecx*8 - 0x1282d]
inc dx
and dword [esp + ecx*4 - 0x9413], edx
sbb ebp, 0xa62ecfa1
mov ebx, 0xeafa081
inc ecx
xor cl, 0xbe
jb 0xbdd1f0
dec edx
mov dword [esp + ecx - 0x25a9], edi
dec edx
lea esi, [ecx*2 - 0x3c70606f]
dec eax
adc edx, 0x2e925ba0
inc edx
xor dword [esp + ecx - 0x25a9], ebp
call fcn.00be41b1
das
mov bh, 0xd5
adc al, 0xb5
cli
push ecx
pushfd
and eax, 0x95e3ab71
invalid
Function at 0xc9e449
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + edx - 0x293055fc]
movzx eax, dx
xor ecx, ebx
ror ax, 0x25
rol ecx, 3
inc ax
dec ecx
inc ax
xor ecx, 0x41b0248d
dec ecx
call fcn.00ced0bd
dec edx
dec edx
sar dword [esp + eax + 0x5ed5c366], 0x6b
shl ecx, 0xe
inc esi
mov edi, dword [esp + eax + 0x5ed5c36a]
bswap edx
inc edx
lea edx, [edx + ecx - 0x6e8df1b3]
dec edi
lea ecx, [edi + ecx*4 + 0x7a24c427]
neg edx
inc dx
or dword [esp + eax + 0x5ed5c368], 0x89485c0e
mov esp, 0xfa00008c
shr eax, 0xc7
sbb dword ds:[eax], eax
mov edx, dword [ecx + ebp - 0xfaeeaba]
or ecx, ecx
lea ebp, [ecx + ebp - 0xfaeeaba]
shl cx, 0x4f
ror ecx, 0x21
js 0xb51401
not eax
call fcn.00c029bf
dec eax
mov dword [esp + ecx + 0x7ddfc1fa], esi
adc ebp, 0x1723a71c
xor edx, edi
dec eax
mov dword [esp + esi + 0x7ddfc0b9], 0xdd031f9e
jmp 0xb73e23

Function at 0xca0679
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec edx
inc dword [esp + eax*2 - 0x16]
xor esi, 0x73ac2927
jmp 0x1444ac9
dec edi
lea ebx, [ebx + eax - 0xc]
inc edi
movzx ecx, byte [ebx + eax*2 - 0x16]
inc esp
xor cl, bh
inc ecx
inc cl
pop edx
inc ecx
rol cl, 1
mov eax, 0xe0afc589
dec ebx
lea ecx, [eax + edx*8 - 0x476192f9]
inc ecx
not cl
inc ecx
mov esp, 0xc80b4908
inc ecx
dec cl
shl eax, 0xa1
js 0xcd64a1
dec ebp
lea ebx, [ebx + esi*2 - 0x3764a18]
dec edx
lea ebx, [eax*2 - 0x51f544df]
dec eax
xadd ebx, ecx
inc ebx
mov esi, dword [eax + ebx - 0xb]
xor esi, edi
bswap esi
dec ecx
lea ebp, [edx + 0x1a17eb0a]
inc edx
rol dword [esp + eax - 9], 0xd8
inc dx
sub ebx, dword [esp + eax - 9]
neg esi
inc dx
xchg dword [esp + eax - 9], ebx
inc dx
and eax, dword [esp + eax - 6]
inc esi
jmp 0xc23683
inc ecx
xor bh, cl
dec ebp
or esp, edx
mov esi, 0x1bb250a
dec esp
adc ecx, esp
dec ebx
mov ebx, dword [ecx + eax*8 - 0x58]
dec edi
lea ebp, [ebp + eax - 0x13]
dec ecx
lea edx, [eax + esi + 0x5293f32d]
dec eax
not edx
dec ebx
mov dword [ebp + eax - 0xb], ebx
inc ecx
push esp
inc dx
inc dword [esp + eax*2 - 0x16]
js 0xccd1a2
not ebp
pop edi
dec eax
arpl si, si
call fcn.00b87da3
call fcn.00c1ff3f
mov edx, dword [edi]
add edi, 4
xor edx, ebx
call fcn.0142b50c
inc bp
mov dword [ebp + ecx*8 - 0x15950], edi
inc ebp
mov esp, eax
inc ecx
sal dl, 0x62
inc cx
rol eax, 0xf
jne fcn.00bfd2e5
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x1c], 0xb5bdb786
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x24]
ret
inc si
mov dword [esp + eax - 5], edx
shl dx, 0xaf
dec edx
mov dword [esp + eax - 0xb], edi
inc ecx
dec esp
inc ecx
setg ah
inc ecx
sar ah, 0xe1
inc edx
xor dword [esp + eax*4 - 0x2c], esi
jmp 0x142deeb
Function at 0xca74cc
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [eax*8 + 0x4826b308]
ror ecx, 0xee
ror edx, 3
push eax
xor ebx, edx
jmp 0x14115a5
inc cx
mov ebx, dword [ebp + ecx - 0x523bc08b]
dec eax
lea ecx, [ecx*2 - 0x7ef912c8]
call fcn.00c9e35f
jmp 0x140cabe
inc ecx
xadd dl, dl
mov eax, dword [esp + edx*8 - 0x43c]
ror ebp, 1
inc ecx
mov ebx, ecx
dec ebp
inc cx
sal eax, 0x42
inc esp
xadd byte [esp + edx*2 - 0xfa], al
dec eax
mov dword [esp + edx - 0x79], esi
dec eax
mov dword [esp + edx - 0x71], edi
dec eax
dec dword [esp + edx - 0x7f]
neg word [esp + edx*2 - 0x107]
dec eax
xadd dword [esp + edx*8 - 0x439], ebx
xor dword [esp + edx - 0x71], ebp
dec eax
mov edi, dword [esp + edx - 0x71]
movzx ecx, si
call fcn.01411550
add byte [eax], al
add byte [edi + 0x5f], bl
inc ebx
js 0xca759d
inc esi
jb 0xca7589
insd dword es:[edi], dx
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
jb 0xca7532
mov ecx, 0x523bc08b
jmp 0xc76b3b
mul edx
fld qword [ebx + 0xe6fddda]
mov ebx, 0x8a88d352
loopne 0xca75e2
aas
push ds
rcr dword [ecx - 0x21], cl
sahf
bound esi, qword [ebx - 0x7d]
in al, 0xfe
test dword [esi + 0x47c8b4c7], esp
and byte cs:[edi + edx*4], 0x53
sal dword [ebp + 0x40152378], 1
retf 0xe3dd
in al, dx
and al, 0x4c
mov eax, dword [0x26359ea1]
inc ecx
mov eax, 0xbe44d800
invalid
bswap edx
jmp 0xc2e662
or ecx, ecx
adc esi, edx
shr dword [esp + eax - 0x40400000], 0xc7
mov eax, dword [ebp + eax - 0x40400000]
inc cx
lea edx, [ecx + ecx + 0x15aead96]
mov dl, byte [ebp + 4]
add word [esp], cx
adc ebp, 6
xor ecx, 0x41aa3903
adc cl, byte [esp + 1]
shr ecx, 0xf5
mov byte ss:[eax + ecx*2 - 0x8d8], dl
mov eax, 0xcaa8c9b3
sbb dword [esp + ecx*4 - 0x11b0], ecx
mov dword [esp + ecx - 0x46c], esi
ret

Function at 0xcb4083
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xfbdf9c86
call fcn.014474f1
Function at 0xcc5605
Capabilities:
Encode data using base64

Disassembly:
inc ebp
and edx, edx
inc ebp
movsx edi, ah
pop edi
dec eax
and edx, 0x2f97e107
inc ecx
push edx
dec ebp
arpl cx, cx
dec ebp
adc esi, ecx
movzx esi, word [esp + eax - 0x78]
call fcn.00c6f3b3
movzx edx, cx
mov ecx, dword [edi + edx*2 - 0x1f570]
mov eax, 0x1d26bc11
lea eax, [edx + edx*8 - 0x71d41354]
lea edi, [edi + edx*4 - 0x3eadc]
dec edx
cmovno edx, eax
xor ecx, ebx
inc ecx
call fcn.00bfe6b8
jae 0xc72eb5
add ecx, esp
call fcn.00bcdbc2
mov ecx, 0xc010fab8
jmp 0xb79297
inc esp
xor dword [esp + eax*2 - 0xf8], ecx
jmp 0xb657c9
mov dword [ebp + ecx*2 - 0x532545fe], eax
mov dword [ebp + ecx*2 - 0x53254602], edx
mov edx, dword [edi + ecx - 0x2992a301]
push ecx
lea eax, [ecx*4 + 0x4d24a51e]
lea edi, [edi + ecx - 0x2992a2fd]
sub eax, 0x1290c30b
xor edx, ebx
ror byte [esp + ecx*2 - 0x53254602], 0x24
setb cl
ror edx, 1
lea edx, [edx + ecx - 0x3513ee1d]
call fcn.01446260
mov edx, 0xc0935a83
dec ecx
sub ebx, 4
dec eax
and edx, edx
dec eax
not edx
inc ebp
mov ecx, dword [ebx]
inc esp
xor ecx, edi
movsx eax, dl
inc ecx
xor ecx, 0x1c3a3a9c
dec eax
lea ebp, [edx - 0x2d4ae47e]
inc esp
movsx esp, dl
inc ecx
ror ecx, 1
inc esp
movzx edx, bp
dec ecx
ror edx, 0x3f
push ebp
inc ecx
bswap ecx
movzx ecx, byte [esp + eax*2 - 0xf7]
inc ecx
not ecx
dec edx
mov dword [esp - 0x3e0], edi
jae 0xbe6c30
pop ebp
pop esp
adc byte [edx + eax*8 - 0x42f7ba88], ah
sti
imul ebp, dword [ecx + 0x40], 0x4c437473
daa
shl dword [esi - 0x77], 1
mov word [ebp], ax
mov eax, dword [edi]
push edx
add edi, 4
call fcn.00b847f3
mov ecx, 0x95a94caf
fsub qword [ebp]
xor cl, ch
movsx eax, cx
mov edx, ecx
mov ecx, dword [edi + eax - 0x4ce3]
lea edi, [eax + edi - 0x4cdf]
shr dx, 0xec
dec edx
add edx, edx
xor ecx, ebx
neg dl
rol ecx, 3
neg al
ror al, 0x27
and dl, dh
lea ecx, [ecx + eax*8 + 0x6e7e87b4]
ja 0xc260a1
push edx
bswap ecx
pop edx
call fcn.00b51450

Function at 0xcfd297
Capabilities:
Encode data using base64

Disassembly:
dec ebx
lea esi, [esp + 0x663fc3a1]
dec eax
mov edi, dword [esp + edx - 0x60275c46]
dec eax
arpl cx, cx
dec esp
add esi, ecx
dec edx
mov dword [esp + ecx - 0x46], 0x748da302
call fcn.00bc7a37
mov edx, 0xa5b4f3b0
mov ecx, dword [edi]
add edi, 4
xor ecx, ebx
rol edx, 0xbe
call fcn.00c9e4e9
dec eax
lea ecx, [edx + edx*8 + 0x1c08b182]
dec esi
lea ecx, [esp + ecx + 8]
inc edx
or cl, byte [esp + eax*4 - 0x7c655c5a]
inc ecx
push esp
dec ebx
mov dword [ecx + eax*2 - 0x3e32ae2e], eax
dec esi
lea esp, [eax*2 + 0x2cba09ad]
inc edx
or byte [esp + eax*4 - 0x7c655c4d], cl
dec edx
lea eax, [0xa9ab6a38]
dec edi
lea ebx, [ebx + eax*2 - 0x3e32ae32]
dec ecx
bswap esp
inc ecx
mov ebp, dword [ebx + edx]
xor ebp, edi
call fcn.00c35fef
Function at 0xcfe650
Capabilities:
Encode data using base64

Disassembly:
mov al, byte [0xf34df9e0]
mov edx, 0x3a1ef835
pop ebx
fadd dword [edi]
or eax, 0x3f1d9311
stc
rcl byte [edi + 0x48], cl
sti
imul ecx
and dword [ebp - 0x20], 0x3caa4306
push es
outsb dx, byte [esi]
stosb byte es:[edi], al
mov dh, 0xdf
hlt
out 0xbe, eax
mov eax, 0x370275c8
enter 0x685b, 0x13
loopne 0xcfe5f8
push 0x86fce013
push ebp
jo 0xcfe583
adc esp, eax
cld
xchg byte [ebp + 0x70], dl
adc dword [edx + 0x6b5d777b], 0x56
insd dword es:[edi], dx
imul esp, dword [edi], 0xd1bd6c6c
and dword [eax], edx
outsb dx, byte [esi]
xchg edx, eax
jnp 0xcfe67a
pop ebp
imul edx, dword [esi + 0x6d], 0x69
daa
insb byte es:[edi], dx
insb byte es:[edi], dx
mov ebp, 0x6e1021d1
salc
dec esp
pop ss
mov ah, 0x93
je 0xcfe5ef
or eax, 0x252f9261
in al, dx
mov word [ebp + 0x22], gs
jb 0xcfe5f6
stosb byte es:[edi], al
imul edx, dword [ebx - 0x6ee31f6b], 0xffffff80
sar byte [edx - 0x6f934b2e], 0x7a
jb 0xcfe6a0
sti
invalid
shr cx, 0xe3
mov eax, dword [edi + eax - 0x1338c400]
and cl, ch
lea edi, [edi + ecx - 0x17fc]
xor eax, ebx
call fcn.014142d5
wait
xchg dword [edx], eax
sbb ah, byte [edi]
add dh, byte [ebp + 0xb]
jge 0xcfe5f9
mov byte cs:[0x1bc8e158], al
jl 0xcfe69b
enter 0x7c1b, 0x1d
add edx, esp
je 0xcfe6a2
push edi
jnp 0xcfe623
and al, 0x3b
xor dword [ecx - 0x21], ebx
push cs
inc ebp
push cs
mov al, 0x6a
lodsb al, byte [esi]
hlt
and al, dl
scasd eax, dword es:[edi]
adc ecx, dword [ecx + 0x50]
push eax
sbb byte [0xb36a375f], dl
sbb byte [0xb36a375f], dl
fild dword [edi - 0x56]
fadd qword [eax - 0x7cdb9e9d]
sub dl, byte [edx - 0x26c87f92]
jae 0xcfe6e7
fadd st(4)
ja 0xcfe6d1
inc ecx
xor eax, 0x78a362db
test dword [ebp + 0x5b], edx
lodsd eax, dword [esi]
pop ebx
fcom qword [ebx + 0x6e74be53]
pushal
or al, 0x15
int 0xfe
inc edx
push edx
cmp ecx, eax
xchg esi, eax
mov dword [ebx + 0x40ab9c78], ecx
mov ch, dh
mov al, byte [0x6a09bc2a]
or byte [ecx], al
add ebx, edx
sahf
mov dh, 0x44
jno 0xcfe680
add dword [ebx], edx
mov edi, 0x2b28d929
pop edi
pop edi
stc
fcomp dword [ecx]
ja 0xcfe682
mov bh, 0xaa
dec edi
pop esp
and dh, byte [ecx - 0x40dab22a]
xchg dword [edx - 0x50], esi
mov cl, 0x47
popfd
cmpsd dword [esi], dword es:[edi]
mov cl, 0xae
xchg byte [edx + ecx*2 + 0x4e], bh
mov ch, 0xb1
invalid

Function at 0x1411459
Capabilities:
Encode data using base64

Disassembly:
pushfd
add dword [esp + 4], 0xff372e8b
mov dword [esp + 4], 0xfa01d29e
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.014474f1
mov di, ax

Function at 0x141bbc2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.00c51c85
dec eax
sub eax, esi
inc edx
movzx ebp, byte [esi + ebx - 0x3c]
sal byte [esp + edx - 0x9593], 0x42
inc eax
xor ch, bh
sar dword [esp + edx*2 - 0x12b38], 0xab
inc eax
inc ch
inc eax
rol ch, 1
and word [esp + edx - 0x9592], dx
jns 0xce65a0

Function at 0x1429248
Capabilities:
Execute syscall

Disassembly:
dec edx
mov edi, dword [esp - 0x16e88]
call fcn.0144242f
sysenter
call fcn.00cb4083
dec esi
mov dword [esp + ecx - 0x1c81a19a], esi
ret 0x18

Function at 0x14358a8
Capabilities:
Encode data using base64

Disassembly:
dec ebx
mov dword [esp], 0x8c13a5
lea esp, [esp + 4]
jne 0xc5d252
Function at 0x143f702
Capabilities:
Encode data using base64

Disassembly:
xor edx, edi
inc esp
movzx esp, si
inc esi
movzx edi, byte [esp - 0x4b0ed]
bswap edx
pop ebx
inc edx
not byte [esp - 0x961d]
dec eax
lea eax, [esi + ebx*4 - 0x9421d5f]
neg edx
inc edx
dec dword [esp - 0x961f]
not edx
mov ebp, 0x4d0417a6
inc edx
rol edx, 1
inc edx
ror byte [esp - 0x12c39], 0x41
dec esp
lea edx, [eax + esi*4 - 0x53f454f6]
inc ebp
movzx ecx, di
xor edx, 0x41b7108f
dec edx
mov dword [esp - 0x961f], edi
inc sp
sub edx, ebx
push ebx
jb 0xc11f74
dec ecx
mov esp, ebp
inc ecx
dec bl
dec esi
lea ecx, [ebx*8 - 0x4872b1eb]
inc ecx
pop eax
call fcn.00c9e4b4
mov ecx, dword [edi]
add edi, 4
xor ecx, ebx
mov eax, 0xf0a70980
dec ecx
shr eax, 0xb0
bswap ecx
rol ecx, 3
add ecx, 0xfda3fe90
xor ebx, ecx
push eax
mov edx, 0x76adee34
add esi, ecx
sub eax, eax
mov edx, dword [ebp + edx - 0x76adee34]
call fcn.00d005f0
shl dword [esp + 4], 0x3c
mov dword [esp + 4], 0xfc066a32
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.014474f1
dec edx
mov edi, dword [esp - 0x9617]
call fcn.00ce65a5
xor edx, edi
call fcn.00ca07e1
inc edx
xor dword [esp - 0x12c36], edx
inc edx
sar dword [esp - 0x12c3c], 0x58
dec edx
sal dword [esp - 0x961f], 0xaf
js 0xb8d656
dec ecx
xor ebx, ecx
push edx
call fcn.00cc570f
inc ecx
sub dl, 0x2a
dec esi
mov dword [esp + eax - 0x35], edx
inc ecx
sbb edi, 0xbc3b460b
dec ecx
lea ebp, [esp + edx*4 + 0xb23a132]
inc ecx
neg edi
inc esi
xchg byte [esp + eax - 0x30], ah
inc cx
inc ecx
rol edi, 1
dec esp
xadd ebp, eax
inc ecx
bswap edi
inc ecx
push esp
mov eax, ecx
inc ecx
dec edi
inc esp
mov ecx, dword [esp + eax - 0x32392ac3]
inc ecx
bswap edi
dec esp
mov dword [esp + eax - 0x32392ab8], ecx
mov word [esp + eax*2 - 0x64725581], 0xe2ab
dec edx
mov dword [esp + ecx - 0x7afffff0], edi
call fcn.00c5a620
dec ecx
mov edx, dword [ebp]
push 0x88bd7739
mov byte [esp + 1], 0x3a
shr byte [esp + 2], 0x83
inc ebp
mov esp, dword [ebp + 8]
dec ecx
add ebp, 0xc
inc esp
mov dword [edx], esp
push 0x961f210e
mov esi, dword [esp + 2]
dec ecx
sub ebx, 4
inc ecx
mov edx, dword [ebx]
jmp 0xb57d5e

Function at 0x143f7e0
Capabilities:
Encode data using xor

Disassembly:
inc ecx
not edi
inc ecx
dec edi
inc ecx
bswap edi
dec eax
mov dword [esp + ebp*4 + 0x348], 0xa73187be
inc edi
lea edi, [edi - 0x457490f0]
mov edx, dword [esp + ebp + 0xd4]
dec eax
mov dword [esp + ebp + 0xd2], edi
inc ecx
mov edx, 0xa02d0992
inc bp
xadd esp, eax
inc esp
xor dword [esp + ebp + 0xd2], edi
call fcn.00b81e9c
call fcn.00bd140e
daa
cmpsd dword [esi], dword es:[edi]
jns 0x143f7e5
iretd
xor al, dl
or eax, 0x53bfbe3
fsubp st(5)
sbb dword [eax], ebx
std
dec edx
iretd
Function at 0x14474f1
Capabilities:
Encode data using base64

Disassembly:
pushfd
call fcn.00c2af2c
mov ecx, 0xf5a61602
movzx dx, byte [ebp]
rol cl, 0xe1
mov al, byte [ebp + 2]
adc ebp, 2
not dl
not al
and cx, 0x9387
jg 0xbfb9d6
call [edi + edx*2 + 9]
lodsb al, byte [esi]
in al, 0x78
jns fcn.0144752a
pop esp
push edi
or dword [esp - 0x5dfa8688], ebp
in al, dx
imul edi, dword [eax + 0xe], 0x8254b489
invalid
mov ah, 0x54
invalid
jl 0x144751c
mov byte [0xe7869ec], al
lcall 0xaa16, 0x3a0008c2
mov bl, 5
sub al, 0x30
aad 0x51
jb 0x144756b
push esp
int3
aas
or eax, dword [edi + 0x26]
jno 0x144756f
xor dh, byte [ebx + 0x3b]
pop ss
push ss
out 0x7d, al
loope 0x144759f
sub dl, byte [edx + 0x70e285e3]
pop es
xchg esi, eax
inc ebx
int3
test al, 0xb1
cmp byte [ebp - 8], dl
pop esp
inc esi
cmp esi, dword [eax]
sub eax, 0x2c0a7772
lodsb al, byte [esi]
cmp bl, byte [ebx + 0x45]
retf
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x6b2060], 1
mov dword [0x6b205c], 1
mov dword [0x6b2058], 1
mov dword [0x6b2050], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x6b2014], eax
mov eax, dword [0x6b206c]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x6b2080]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x6b2068]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x41903c], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x401830
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401890
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6b2074]
test esi, esi
jle 0x4019b0
mov eax, dword [0x6b2078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4018c4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401947
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4018b0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4019d7
mov eax, dword [0x6b2078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x6b2078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4019b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401940
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401950
add dword [0x6b2074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6b2078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401940
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4018ce
mov eax, dword [0x6b2078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401e90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6b2090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6b2088]
sub esp, 4
test ebx, ebx
je 0x401ee5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401ede
test esi, esi
je 0x401ede
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ec0
mov dword [esp], 0x6b2090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret