joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5db093
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [edi + 0x6f]
arpl word [edx + 0x3d3bdcd9], dx
sar byte [0xb0a7d1c5], cl
arpl word [eax + esi*2 - 0x5db7a5e2], di
jo 0x5db0b3
pop edx
dec eax
mov byte [0xb260fc99], al
in eax, dx
jo 0x5db0b3
pop edx
dec eax
mov byte [0xb260fc99], al
in eax, dx
cdq
inc esp
mov edx, dword [edi]
adc al, 0x5c
push edi
invalid
cmp eax, 0xd25d9fd5
insb byte es:[edi], dx
inc ebp
arpl word [ebx + 0x64a22425], dx
and dword [esi + 0x1b], 0xab40bc64
jae 0x5db082
push ds
jle 0x5db0ef
jecxz 0x5db126
mov edi, dword [ecx + eax*4]
xchg byte [eax + 8], ah
pop esp
lahf
jb 0x5db140
leave
jg 0x5db0b3
xlatb
sub eax, 0xef31db6d
jp 0x5db0cf
inc edi
xor al, 0xd2
xchg ebx, eax
pop esi
or dword [esi - 3], esi
aaa
sar byte [0xd396886e], cl
adc eax, 0x770d0899
or al, 0xdf
add edi, dword [edi + ebp*2]
mov byte [esi + 0x89915d3], dl
or eax, 0x3df0c77
cmp al, 0x6f
xor bl, 0xe5
jbe 0x5db0db
jb 0x5db0e1
and al, 0xb6
pushfd
outsb dx, byte [esi]
push esi
add esi, dword [eax + 0x79]
ror dh, 1
sbb al, 0x8d
sub al, 0x29
and eax, 0x35feba57
adc ebx, eax
stosb byte es:[edi], al
and dword [eax], 0x5a
invalid
out 0x5e, eax
invalid
invalid

Function at 0x5efed3
Capabilities:
Encode data using xor

Disassembly:
sub al, byte [edx - 0x1d80596c]
dec esi
lcall 0x22ce, 0x37c2810b
xchg bh, ah
fiadd word [edx]
in al, 0x72
cli
into
and al, byte [esi - 0x1bfd2119]
out 0xde, eax
add ah, ah
jb 0x5efe85
invalid
cli
push edx
je fcn.005efed3
cmp bh, dh
jle 0x5efe76
invalid
mov byte [0x13708807], al
pop es
mov byte [eax + 0x13], dh
adc edi, dword [edx - 0xe]
jp 0x5efecc
jnp 0x5efe82
pop edx
std
sub cl, dl
lcall 0xdfc7, 0xa25c7a7f
push esi
scasb al, byte es:[edi]
xor edx, ebp
xor dword [edi + 0x231d8c02], 0x37
jle 0x5efed7
sahf
adc dword [ebx + 1], ecx
xchg ebx, eax
mov dh, 0x1f
xchg byte [esi], bl
pop esi
invalid
Function at 0x605f43
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639433
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606066
push ecx
lea ecx, [esi + 0x18]
call int.00625763
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x60607d
push ecx
lea ecx, [esi + 0x24]
call fcn.00625673
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64d15d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654338
cmp edx, dword [eax]
je 0x64d17f
add eax, 8
inc ecx
cmp eax, 0x6543c8
jl 0x64d170
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x654338]
jne 0x64d2ad
mov eax, dword [0xa57c90]
cmp eax, 1
je 0x64d287
test eax, eax
jne 0x64d1b0
cmp dword [0x654264], 1
je 0x64d287
cmp edx, 0xfc
je 0x64d2ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d1e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064db40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064dfd0
inc eax
lea eax, [ebp + 8]
lea esi, [esi + 0x65433c]
push 0
push eax
push dword [esi]
call fcn.0064dfd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x562019
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
or dx, 0x329f
add edx, eax
shr dl, cl
mov ebp, esp
rcl dx, cl
mov edx, dword [ebp + 8]
cmc
cmp sp, 0xc18b
sub esp, 0x114
jmp 0x7cc55f
push edi
stc
cmp edx, 0x4174805
mov dword [ebp - 0x10], eax
jmp 0x5d22ca
je 0x7ca404
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x7ca3ec
mov eax, dword [edx + 0x3c]
test ebx, edx
add eax, edx
cmp dword [eax], 0x4550
jne 0x7ca404
mov ecx, dword [eax + 0x78]
clc
jmp 0x7a33f9
je 0x7ca404
mov eax, dword [eax + 0x7c]
stc
clc
cmp edx, ebx
push ebx
cmc
jmp 0x5e6d5e
mov dword [ebp - 4], ecx
clc
test ecx, ecx
jmp 0x61f768
je 0x7ca404
mov eax, 0x5a4d
stc
test bx, di
cmp word [edx], ax
je 0x605629
xor eax, eax
cmovbe si, bp
pop esi
jmp 0x60f2c3
push esi
cmp eax, eax
test edx, edx
jmp 0x5eb2c3

Function at 0x5646d8
Capabilities:
Encode data using base64

Disassembly:
dec dx
xor dx, 0x7022
rol dx, 1
jmp 0x76249c
xor bx, dx
mov dword [esp], 0x6c8f9e96
call fcn.00796d37

Function at 0x569500
Capabilities:
Encode data using base64

Disassembly:
jb 0x56d5f2
xor ebx, edi
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x7c43dc]
shr edi, 8
xor edi, ebx
mov dword [esp], 0x1e88e98f
inc eax
xor dword [esp], 0x5f8d2a07
xor edi, 0xf085ad01
push 0xd9992cbe
shl dword [esp + 4], 0x3d
dec ecx
lea esp, [esp + 8]
jne 0x56ccfe
mov ebx, 0x6bb7c7aa
not bx
bswap ebx
pop ebx
jmp 0x7b6182
call fcn.00569500
mov ebx, 0xe7906d07
or ebx, 0x2f0f5293
add bx, bx
movzx ebx, byte [eax]
jo 0x56956e
invalid
adc byte [0x92b75301], dl
add al, 0x49
mov esi, 0xe654184
sbb edi, dword [edi]
pop edi
in eax, dx
les eax, [esi + 5]
loopne 0x56cd13
xchg ecx, eax
scasb al, byte es:[edi]
salc
xor dword [esi], esi
fadd dword [eax + ebx*2 + 0x7f]
cmc
sub ah, byte [ebp - 0x6c427dcb]
mov eax, 0xc3b19ea5
movzx eax, word [esi]
call fcn.00605599
pop esi
push 0x4e046eab
lea esp, [esp + 4]
ret
mov ax, word [ebp + edx*4 - 0x186c2ab8]
shr edx, 0x39
ja 0x5f3bdd
dec ecx
add esp, 0xa
jmp 0x77fca7
lea edx, [edx + edx*4 - 0x1e5d0b77]
adc ebp, 2
or edx, edx
movzx edx, byte [esi]
adc esi, 1
call fcn.0059dcd0
push 0x6e04f500
dec eax
shld ebx, esi, cl
dec ecx
mov dword [esp], ebx
dec eax
lea esp, [esp + 8]
jmp fcn.007c15b5
push edx
fdiv qword [ebx]
test byte [edi + edi - 0x3382bb09], al
retf 0x498a
fmul st(0), st(0)
jno 0x7b61bf
wait
sal byte [ebp - 0xa], 1
dec edi
pop ebx
xchg byte [ecx + 0x7fe26330], ah
movzx ax, byte [edx]
sal word [esp + 1], 0x8b
sbb edi, 2
call fcn.00777a74
call fcn.0076ce4f
lcall 0x64a0, 0x19c1e7f5
jg 0x7b615d
jmp 0x7b6145
nop
sub byte [eax - 0x7f39d6f], dl
lodsb al, byte [esi]
push edx
mov eax, dword [0x1f8b77a5]
sal dword [edx], 1
jle 0x7b61fd
nop
aam 0x32
adc dword [ebp + 0x2f], ebp
mov ebp, dword [edi - 0x3b2925c7]
cwde
mov word [edx + 0x5b978511], es
dec edi
rol dword [esi + 0x29], 0x1b
cmp eax, 0x4b404ce5
popal
inc edi
jmp dword [esi + 0x32]
invalid
Function at 0x58e70b
Capabilities:
Encode data using base64

Disassembly:
call eax
push 0x82acbe3c
pop esi
push esi
mov ebp, dword [ebp + esi + 0x7d5341c0]
call fcn.0075d224
jmp 0x615e61
mov eax, dword [ebp]
jmp 0x5656c6
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x5eb2dd
mov eax, 0x2bb06fbb
add eax, eax
not al
mov eax, dword [ebp + ebx*4]
push 0xa0a86fbd
mov dword [esp], eax
call fcn.0075d598

Function at 0x5a580c
Capabilities:
Encode data using base64

Disassembly:
add esi, 2
sal dl, cl
mov word [esi], dx
call fcn.0077ddf6

Function at 0x5bc5b4
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [eax + esi - 0x4cad7826]
movzx edx, cx
xor edx, edx
adc edx, dword [esi + edx*4 + 4]
mov cl, byte [ecx + esi - 0x4cad781e]
add esi, 6
shld eax, edx, cl
push 0xee391fb3
jmp 0x7c0f0a

Function at 0x5ca61c
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
and ax, ax
shl ax, 0x2d
sal edx, 2
mov dword [esp + eax - 0x6ad44000], eax
mov eax, ebp
jmp 0x60cd87
jmp 0x5ca5fa
mov eax, dword [ebp]
jmp 0x5a9771
lea esp, [esp + 4]
je 0x5a3872
mov eax, 0x4c199680
or eax, 0x912b1a13
mov eax, dword [ebp + ebx*4]
call fcn.005a385a
call fcn.0056d418
mov eax, 0xed17cc03
mov esi, eax
mov esi, dword [ebp]
jmp 0x7cac73
dec word [esp]
not dword [esp]
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x59c1d0
cld
push edi
jge 0x78b186
fild dword [eax + ebp]
jbe 0x78b19f
cmp dword [esi], esp
jl 0x78b144
add byte [eax], al
shl byte [eax + ebx*8 - 0x3672764c], 0x6f
int3
call fcn.00724b9e
push 0xfcfc1b13
and ebp, ebx
push eax
imul dword [eax]
mov eax, dword [0xaba38012]
sbb al, 0x1c
sti
xor ebx, dword [ebx + edi - 0x28cb6a54]
je 0x78b137
or byte [ecx + ebx*8], dl
sahf
lcall 0x5b83, 0xa533e435
lcall 0x6e8f, 0xec9957e4
add dh, byte [esi + 0x5f65a47f]
sar byte [edi - 0x469bee32], cl
arpl word [esi], dx
jne 0x78b204
pushfd
popfd
sbb byte [ecx - 0x4a], ch
ret
imul edx, dword [0x8965a47e], 0x68fb664c
mov dword [esi + 0x26], ebx
sbb byte [ebx - 0x66], 0xd9
sbb byte [ebp - 0x60], dh
int3
ror eax, 0xbf
mov eax, dword [ebp + 4]
jb 0x78b192
add esi, 6
mov word [edx], bp
lea esp, [esp + 4]
jmp fcn.005c6e37

Function at 0x5d17e2
Capabilities:
Encode data using xor

Disassembly:
ret
cmpsb byte [esi], byte es:[edi]
enter 0x3b5, 0x46
adc ebx, ebp
inc esp
xlatb
inc edx
int 0x95
or esp, dword [eax - 0x502fc0ae]
pop es
mov ah, 0xf9
int3
rep movsb byte es:[edi], byte [esi]
push dword [esp + 0xc]
popfd
mov esi, dword [esp + 0x10]
call fcn.007abfd4
call fcn.007d3773
insb byte es:[edi], dx
lodsd eax, dword es:[esi]
xchg dword [ecx - 0x1d], ebx
jnp 0x5d1798
fdiv dword [ecx + 0x49]
and ebx, dword [ebp + 0x70a9bb3f]
adc ch, 0x44
cmpsd dword gs:[esi], dword es:[edi]
push ebx
pop ecx
daa
scasb al, byte es:[edi]
std
std
salc
jbe 0x5d1886
inc eax
jae 0x5d185e
push ecx
scasd eax, dword es:[edi]
cmp al, 0x36
dec sp
inc edi
pop ecx
xlatb
xor eax, 0x9f656832
jne 0x5d17b4
invalid
push es
push eax
jge 0x5d18c2
sub ecx, 0x71
nop dword [edx + 0xc888c8e]
dec edx
fldcw word [ebp + 0x6f]
jmp 0x5d1870
jmp ecx
fst qword [edi]
push 0x465d49d0
movsb byte es:[edi], byte [esi]
xchg edx, eax
invalid
ret 0x9856
Function at 0x5ec996
Capabilities:
Encode data using base64

Disassembly:
mov dword [esi], edx
call fcn.00777aff
mov dword [esp], ecx
mov ecx, dword [esi + 4]
adc esi, 4
neg word [esp + 2]
not edx
not ecx
dec byte [esp + 2]
jge 0x610d28
clc
or edx, ecx
jmp 0x5c95ba

Function at 0x5f2264
Capabilities:
Authenticate hmac

Disassembly:
mov cl, byte [ecx + ebp - 0x21aa0ba7]
add ebp, 2
shl edx, cl
jmp 0x7a1edb
call fcn.00795678
mov eax, dword [edi]
mov ecx, 0x2b06ef33
movzx ebp, cx
call fcn.00725f95
mov edx, 0xc412b285
mov eax, dword [edi]
sar edx, 0x7a
movzx ebp, dx
shr edx, 0x30
lea edi, [edi + edx*4 - 0x3fff8]
jp 0x759fe9
imul esp, dword [esi - 0x7f55c022], 0xffffffdb
mov ebp, 0x3ec3d322
ret
xchg edi, eax
mov esi, eax
jbe 0x591a5a
stosb byte es:[edi], al
sub ch, byte [bx + si]
cli
dec edx
mov edx, 0xf87d4e1a
mov dh, 0x4f
dec edi
sub dword [ebx + ebp*8], edx
fsub st(0), st(0)
add byte [eax - 0x3313a0], al
jp 0x75a06d
mov bh, 0xf4
xchg dword [esi - 0x51], edx
scasb al, byte es:[edi]
invalid
fidiv dword [edi]
je 0x75a08b
xor al, 0x36
push es
push edi
arpl word [ebx - 0x279bf59d], cx
aaa
jne 0x759ffe
int1
out dx, al
shr dword [ecx], 1
stosd dword es:[edi], eax
mov dword [ebx + ebx + 0x48f6a37f], esi
pop edi
adc dword [edi], eax
insb byte es:[edi], dx
enter 0xffffffffffffff8a, 0xffffffffffffffef
jno 0x75a0ba
mov ecx, 0xbf7db4bb
enter 0x7f8a, 0xfffffffffffffff2
xor al, 0xe4
loope 0x75a11e
mov dl, 0x55
xor al, 8
invalid
invalid
fstp dword [edi - 1]
and ebx, eax
sbb sp, si
call 0xc4e7b935
push esi
jb 0x75a0ac
xor esi, dword [ecx + 0x15]
movsb byte es:[edi], byte [esi]
fnstenv [edx + 0x5e]
sub al, 0x77
cwde
ffreep st(5)
aas
lahf
pop ds
lea ebx, [edi - 0x29faa22a]
mov al, byte [0x6b7d16ed]
xchg ebp, eax
invalid
jb 0x75a161
cli
hlt
jns 0x75a16b
push esi
lfs ecx, [eax*2 + 0x5c1af84]
pop eax
out dx, eax
push edi
mov dword [0xf117f41], eax
invalid
inc ecx
jg 0x75a14c
invalid
sub eax, 0xf975d73
jae 0x75a1a6
daa
sbb dword [edi + 0x27], esp
pop ds
jne 0x75a138
aam 0x91
push ds
invalid
jne 0x75a1a0
scasd eax, dword es:[edi]
mov ebx, dword [ebp - 0x7f]
movsd dword es:[edi], dword [esi]
xchg ebx, eax
mov dh, 0x5c
mov esp, 0x32b75da5
outsd dx, dword [esi]
pop esi
loopne 0x75a1d3
mov bh, bh
cmp byte [esi - 0x6c], dh
sub bh, bl
pop esi
pop edi
mov bh, cl
insb byte es:[edi], dx
pop edx
mov byte [eax], dl
fmul st(3)
test dword [ebx + 0x75a1c18b], edi
and eax, 0xf3988e5c
mov eax, dword [0xd5bc0075]
push edx
push ds
mov cl, 0x1c
je 0x75a129
sbb al, 0x74
invalid
jge 0x75a13e
jne 0x75a1af
test byte [ebx + 0x2c2019ec], cl
lodsb al, byte [esi]
mov ebp, esp
sbb dword [eax], esp
sub al, 0xac
enter 0x5ecb, 0xffffffffffffff8a
invalid
pop esi
push 0xf5d78a5f
daa
xor dword [esi], edx
out dx, eax
push ebx
mov al, byte [0xe05d0075]
int 0x53
mov eax, dword [0xa5aa2875]
pop eax
adc ebp, dword es:[esi + ebx - 0x64]
pop esi
mov ch, bh
sbb byte cs:[ebx + 0x7f], dh
push dword [esi - 0x794d2568]
in al, 0x26
loopne 0x75a1c7
loop 0x75a198
inc esi
test al, 0x7a
mov ds, word [edx + eax + 0x59e242ac]
mov edx, dword [ebp]
mov ecx, 0x21aa0bab
jmp 0x5b0a40
jge 0x5f2250
inc ecx
xor dh, bh
inc eax
add dh, 0xa8
call fcn.007500a8
mov dword [ebp], edx
jmp fcn.007b9c49
Function at 0x71d854
Capabilities:
Encode data using base64

Disassembly:
push ecx
pop ecx
mov cl, byte [esi + ecx - 0x78892822]
push 0x3d2bd63d
jo 0x7a795c
add esi, 6
shld ebp, eax, cl
push 0xa2328887
call fcn.007c9e33
pop ecx
sub ebp, dword [ecx + ecx*2 + 0x1f09e431]
jl 0x7a79a7
test eax, 0x50253c44
dec esi
sub eax, 0x31d1c84f
xor byte [ebp + 0x1b], ah
imul ebx, dword [ebx + 0x22], 0xaa122682
mov ah, 0xcc
and eax, 0xa1089961
mov ch, 0x9e
ror byte [eax - 0x72abaee7], 1
std
xchg ebp, eax
invalid

Function at 0x7283bd
Capabilities:
Encode data using base64

Disassembly:
push 0x22ac833f
xor edi, esi
and edi, 0xff
mov edi, dword [edi*4 + 0x77e0ec]
shr esi, 8
call fcn.006013ee
cmp edx, esi
cmp bl, 0x3c
xor esi, edi
or dword [esp + 8], 0x4f845d07
inc ecx
push 0x7122081
xor esi, 0x1919f69e
dec eax
lea esp, [esp + 0x10]
jne 0x7d2961
pop edi
call fcn.005d76c9
int3
mov edi, 0xcf1d53bf
and edi, edi
movzx edi, byte [ecx]
jae 0x5f0d75

Function at 0x75d598
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jne 0x615e73
jl 0x5648ff
dec ebx
jmp 0x5eb2d3

Function at 0x761568
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7cc4bf
test edi, edi
lea esp, [esp + 4]
je 0x722f67
jmp 0x5baa0c
push 0xde809405
not edx
push 0xfb3604bf
not dword [esp + 4]
mov dword [ebp], edx
lea esp, [esp + 8]
jmp fcn.005a0c80
xor edx, edx
jmp 0x5c3e62
push esi
mov esi, 0xc30be35
xor esi, esi
shl si, 0x6d
movzx esi, byte [ecx + esi*2]
push 0xa509f585
xor esi, edx
and esi, 0xff
mov esi, dword [esi*4 + 0x702020]
shr edx, 8
push 0x26b67e80
xor edx, esi
inc ecx
xor edx, 0xa23907a7
dec edi
lea esp, [esp + 8]
jne 0x7cc4c0
call fcn.00722f5f

Function at 0x76cb76
Capabilities:
Encode data using base64

Disassembly:
call 0x71d7a4
in al, dx
xchg ebx, eax
cdq
mov edi, 0x717a5ee7
cmp edi, dword [ebx + 0x57]
xor eax, 0x6b401cb5
int1
mov dword [edi - 0x12], 0xdd1bb9a2
aad 0x6c
test al, 0xa3
or dword [edi + 7], ecx
mov esi, 0x5d6b311a
in eax, dx
inc esp
pop eax
inc ebx
and dword [ebx + 0x18], esi
insd dword es:[edi], dx
int 0x8d
adc bh, byte [ebx - 0xf]
fstp qword [ebx]
pushal
cmp dword [eax + eax], edi
add byte [eax + 0x2dcff356], al
stc
lodsd eax, dword [esi]
and dword [eax + 0x3eaa0e4c], 0x70
arpl word [edi + 0x53f5b155], dx
mov al, 0x7c
push ds
or bl, byte [esi]
nop
add esi, dword [edi]
in eax, 0x19
or eax, 0xc6246093
xchg edx, eax
xabort 0x1b
invalid
mov ax, word [esi]
add esi, 2
mov dword [esp], ecx
sub ebp, 1
xor cx, 0xb702
xor cx, word [esp + 2]
pop ecx
movzx ecx, byte [ebp]
jns 0x767aaa

Function at 0x79eed3
Capabilities:
Encode data using base64

Disassembly:
adc dl, 0x85
xor bl, dl
lea edx, [esp + edx + 8]
mov dword [edx], eax
push 0xca15b0b3
lea esp, [esp + 0xc]
jmp fcn.007b9c49
adc edi, 1
xor dl, bl
mov dword [esp], 0xb9266a08
inc dl
and dword [esp], 0x2481a1a2
xor dl, 0x18
push 0x15365304
sub dl, 0xa4
ror dl, 1
sar dword [esp], 0xf8
jns 0x7d371a
jne 0x757c11
Function at 0x7a76f2
Capabilities:
Encode data using base64

Disassembly:
ror cl, 1
shr dword [esp + 8], 0x19
not cl
xor bl, cl
rol byte [esp], 0xc7
rol dword [esp], 8
lea ecx, [esp + ecx + 0xc]
jae 0x71d757
movzx ebp, ax
mov edx, dword [esi + ebp - 0xc98f]
sal ebp, 0x33
lea esi, [esi + ebp - 0x4c77fffc]
ja 0x56eb50
mov edx, dword [edi]
mov cl, byte [edi + 4]
call fcn.007c4e13
int3
mov dword [ecx], edx
jae 0x78fe91
call fcn.007ac7bc
xor ecx, eax
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
sub eax, 0x434b1486
rol al, 7
iretd
rol cl, 1
neg cl
push 0xc8c3d13
jmp 0x5994fd

Function at 0x7b5299
Capabilities:
Encode data using xor

Disassembly:
call fcn.005ca246
jmp 0x5f94ef
mov dword [esp], edi
push 0x24a64aa3
mov edi, dword [esp]
movzx edi, byte [edx + edi*2 - 0x494c9546]
ror dword [esp], 0xa3
xor edi, ecx
and edi, 0xff
mov edi, dword [edi*4 + 0x5c1fc8]
shr ecx, 8
xor ecx, edi
inc edx
xor ecx, 0x4e86c496
dec eax
lea esp, [esp + 4]
jne 0x7b529c
mov edi, 0x69b33bbc
not edi
pop edi
jmp 0x751da9

Function at 0x7ca435
Capabilities:
Encode data using base64

Disassembly:
mov bp, word [esi + 2]
adc esi, 2
ror word [esp], 0xf
and ax, bp
push 0x39a6742d
not ax
push 0x5cb031a8
not dword [esp + 6]
mov word [esi], ax
lea esp, [esp + 0xc]
jmp fcn.00591a82
push ebx
mov dword [esp + 0x10], 0x563897f2
mov ebp, dword [esp + ebp + 0x5850960c]
call fcn.005c47ad
mov eax, 0xa02cf325
ror ax, 0xc
push eax
mov ax, word [esi]
sal dword [esp], 0x78
jne 0x71ea99

Function at 0x7cded9
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], ecx
movzx ecx, ax
lea eax, [eax*4 - 0x1ad4cdf4]
bswap ecx
push ebp
not ax
pushfd
xadd cl, ah
movsx ebp, al
push edi
movzx edi, cx
call fcn.005d7025
Function at 0x7d1999
Capabilities:
Encode data using base64
Link function at runtime on windows

Disassembly:
cld
rep movsb byte es:[edi], byte [esi]
push dword [esp + 8]
popfd
call fcn.005d9ab2

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x39191eba
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data_1
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x158f2c2d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x80cb48
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x401129
cmp dword fs:[0xc0], eax
je 0x40102b
mov dword [0x80cb44], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x80ca2c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x80ca30], eax
movzx edx, word [esi + 0xac]
mov dword [0x80ca34], edx
mov eax, dword [esi + 0xb0]
mov dword [0x80ca38], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x40108b
push 0x7f
push eax
push 0x80ca3c
call fcn.00402810
mov edx, dword [0x80ca34]
add esp, 0xc
jmp 0x401093
xor eax, eax
mov word [0x80ca3c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x80cb3c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x80cb3e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x80cb40], ax
mov ecx, eax
mov byte [0x80cb42], 0
cmp byte [0x7ffe0268], 0
je 0x4010da
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x80cb42], bl
cmp ebx, 1
pop ebx
jne 0x4010f4
and ecx, 0xffef
mov word [0x80cb40], cx
test edx, edx
jne 0x401129
call section..text
cmp dword [0x80ca2c], 6
ja 0x401129
jb 0x401111
cmp dword [0x80ca30], 4
jae 0x401129
call section..text
cmp dword [0x80ca2c], 0xa
jae 0x401129
mov dword [0x80ca34], 1
ret
Function at 0x4016a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x4016eb
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x4016db
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x4016c1
jmp 0x4016e0
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x40173b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x401700
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401700
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x40171c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402810
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40175d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x4017d0
mov esi, dword [ebx]
cmp esi, ebx
je 0x4017d0
test esi, esi
je 0x4017d0
cmp word [esi + 0x24], 2
jbe 0x4017ca
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x4017ca
cmp dword [esi + 0x18], 0
je 0x4017ca
test ebp, ebp
je 0x401785
cmp ebp, eax
jne 0x4017ca
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402810
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4017aa
cmp eax, dword [esi + 0x18]
jne 0x4017ca
cmp dword [esp + 0x10], 0
je 0x4017dd
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.004033d0
add esp, 8
test eax, eax
je 0x4017dd
mov esi, dword [esi]
cmp esi, ebx
jne 0x401763
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret