joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6280e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x628134
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x628124
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x1fd778]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x628104
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x628136
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.00628030
add esp, 8
test eax, eax
je 0x628150
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x642dd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov eax, edx
mov dword [esp + 4], eax
push esi
push edi
mov edi, ecx
test eax, eax
je 0x642f65
test edi, edi
je 0x642e3e
cmp byte [edi + 0x1e], 0
jne 0x642f65
cmp byte [edi + 0xe2], 0
je 0x642e3e
mov eax, 0x44
cmp ax, word [edi + 0xe0]
ja 0x642e3e
mov ebx, dword [edi + 0xec]
test ebx, ebx
je 0x642e3e
mov eax, dword [ebx]
mov dword [edi + 0xec], eax
mov eax, dword [edi + 0xe4]
inc eax
mov dword [edi + 0xe4], eax
cmp eax, dword [edi + 0xe8]
jle 0x642e5e
mov dword [edi + 0xe8], eax
jmp 0x642e5e
push 0x44
call fcn.00624a60
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x642e5e
test edi, edi
je 0x642e56
mov byte [edi + 0x1e], 1
test ebx, ebx
je 0x642f65
mov edx, dword [esp + 0xc]
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
mov edx, dword [edx]
call fcn.00642820
mov dword [ebx], eax
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, edi
push esi
mov edx, dword [eax + 8]
call fcn.00642a50
mov dword [ebx + 8], eax
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, edi
push esi
mov edx, dword [eax + 0xc]
call fcn.00642800
mov dword [ebx + 0xc], eax
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, edi
push esi
mov edx, dword [eax + 0x10]
call fcn.00642820
mov dword [ebx + 0x10], eax
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, edi
push esi
mov edx, dword [eax + 0x14]
call fcn.00642800
mov dword [ebx + 0x14], eax
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, edi
push esi
mov edx, dword [eax + 0x18]
call fcn.00642820
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [ebx + 0x18], eax
mov al, byte [ecx + 4]
mov byte [ebx + 4], al
mov edx, dword [ecx + 0x1c]
mov ecx, edi
push esi
call fcn.00642dd0
mov dword [ebx + 0x1c], eax
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, edi
push esi
mov edx, dword [eax + 0x28]
call fcn.00642800
add esp, 4
mov dword [ebx + 0x28], eax
mov ecx, edi
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 0x2c]
call fcn.00642800
mov dword [ebx + 0x2c], eax
add esp, 4
mov dword [ebx + 0x30], 0
mov eax, 0xfff7
mov dword [ebx + 0x34], 0
mov cx, word [esi + 6]
and cx, ax
mov dword [ebx + 0x24], 0
mov word [ebx + 6], cx
mov eax, ebx
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x3c], 0xffffffff
mov dword [ebx + 0x40], 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x647a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x128
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0
mov esi, dword [edi + 0xc]
mov dword [esp + 0x18], esi
test esi, esi
je 0x647e54
test edx, edx
je 0x647e54
movzx eax, byte [edx]
lea ecx, [eax + 1]
add eax, 0xffffffed
xor ecx, 1
dec ecx
mov dword [esp + 0x20], ecx
cmp eax, 0x7f
ja 0x647d6f
movzx eax, byte [eax + 0x18da7c]
jmp dword [eax*4 + 0x18da5c]
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.006471c0
mov dword [esp + 0x24], eax
add esp, 4
mov eax, dword [esi + 0xc]
mov dword [esp + 0x18], eax
cmp dword [esi + 0x10], eax
jg 0x647d9d
mov ecx, esi
call fcn.00635960
test eax, eax
jne 0x647dd6
mov eax, dword [esp + 0x18]
inc dword [esi + 0xc]
lea ecx, [eax + eax*4]
mov eax, dword [esi + 0x14]
mov word [eax + ecx*4], 0x1b
lea ecx, [eax + ecx*4]
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
xor eax, eax
cmp dword [ebp + 0xc], eax
setne al
mov dword [ecx + 0xc], eax
mov byte [ecx + 3], 0
mov dword [ecx + 0x10], 0
mov byte [esi + 0x6e], 0
cmp dword [esp + 0x1c], 0
je 0x647e14
mov al, byte [edi + 0x15]
mov byte [esp + 0x17], al
cmp al, 8
jae 0x647e14
xor ecx, ecx
lea eax, [edi + 0x60]
nop dword [eax]
mov edx, dword [esp + 0x1c]
cmp dword [eax + 0x10], edx
je 0x647e10
inc ecx
add eax, 0x18
cmp ecx, 0xa
jl 0x647df0
movzx eax, byte [esp + 0x17]
mov dword [edi + eax*4 + 0x18], edx
inc byte [edi + 0x15]
jmp 0x647e14
mov byte [eax + 9], 1
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x647e54
mov al, byte [edi + 0x15]
mov byte [esp + 0x17], al
cmp al, 8
jae 0x647e54
xor ecx, ecx
lea eax, [edi + 0x60]
nop dword [eax]
cmp dword [eax + 0x10], edx
je 0x647e50
inc ecx
add eax, 0x18
cmp ecx, 0xa
jl 0x647e30
movzx eax, byte [esp + 0x17]
mov dword [edi + eax*4 + 0x18], edx
inc byte [edi + 0x15]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [eax + 9], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x647f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x648085
test edi, edi
je 0x648085
movzx ecx, word [esi + 2]
push ebx
test ecx, 0x1000
jne 0x64807c
movzx eax, word [edi + 2]
test eax, 0x1000
jne 0x64807c
xor al, cl
test al, 0x10
jne 0x64807c
mov al, byte [esi]
cmp al, byte [edi]
jne 0x64807c
mov edx, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.00647f00
test eax, eax
je 0x64807c
mov edx, dword [edi + 0xc]
mov ecx, dword [esi + 0xc]
call fcn.00647f00
test eax, eax
je 0x64807c
mov eax, dword [esi + 0x10]
mov ecx, dword [edi + 0x10]
test eax, eax
je 0x647fcf
test ecx, ecx
je 0x64807c
mov edx, dword [eax]
cmp edx, dword [ecx]
jne 0x64807c
xor ebx, ebx
test edx, edx
jle 0x647fd7
xor edx, edx
mov dword [ebp - 4], edx
nop dword [eax + eax]
mov eax, dword [eax + 0xc]
mov ecx, dword [edx + eax]
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0xc]
mov edx, dword [edx + eax]
call fcn.00647f00
test eax, eax
je 0x64807c
mov eax, dword [esi + 0x10]
inc ebx
mov edx, dword [ebp - 4]
add edx, 0x14
mov dword [ebp - 4], edx
cmp ebx, dword [eax]
jl 0x647fa0
jmp 0x647fd7
test ecx, ecx
jne 0x64807c
mov eax, dword [esi + 0x18]
cmp eax, dword [edi + 0x18]
jne 0x64807c
mov eax, dword [esi + 0x20]
cmp eax, dword [edi + 0x20]
jne 0x64807c
mov eax, dword [esi + 0x24]
cmp eax, dword [edi + 0x24]
jne 0x64807c
mov eax, 0x800
test word [esi + 2], ax
je 0x648014
test word [edi + 2], ax
je 0x64807c
mov eax, dword [esi + 4]
cmp eax, dword [edi + 4]
jmp 0x64806e
cmp byte [esi], 0x98
je 0x648070
mov esi, dword [esi + 4]
test esi, esi
je 0x648070
test word [edi + 2], ax
jne 0x64807c
mov edx, dword [edi + 4]
test edx, edx
je 0x64807c
mov bl, byte [esi]
test bl, bl
je 0x648058
mov al, bl
sub esi, edx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x1fd778]
cmp al, byte [ecx + 0x1fd778]
jne 0x648058
mov al, byte [esi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x648037
movzx eax, bl
movzx ecx, byte [eax + 0x1fd778]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x1fd778]
sub ecx, eax
jne 0x64807c
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp edi, esi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x64a460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, edx
mov edx, ecx
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
push edi
mov edi, eax
test eax, eax
je 0x64a48d
cmp byte [eax], cl
je 0x64a485
inc edi
cmp byte [edi], cl
jne 0x64a480
sub edi, eax
and edi, 0x3fffffff
mov eax, 1
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
cmp dword [edx + 4], eax
jle 0x64a555
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
xor esi, 1
cmp eax, 2
cmovge esi, eax
test ebx, ebx
je 0x64a513
mov eax, dword [edx + 8]
mov ecx, esi
add ecx, ecx
mov edx, dword [eax + ecx*8]
mov ecx, dword [ebp + 8]
mov bl, byte [ecx]
test bl, bl
je 0x64a4f5
sub ecx, edx
mov al, bl
mov dword [ebp - 0x14], ecx
mov edi, ecx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x1fd778]
cmp al, byte [ecx + 0x1fd778]
jne 0x64a4f2
mov al, byte [edi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x64a4d1
mov edi, dword [ebp - 4]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x1fd778]
movzx eax, bl
mov ebx, dword [ebp + 8]
movzx eax, byte [eax + 0x1fd778]
sub eax, ecx
jne 0x64a536
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
add esi, esi
mov edx, dword [ebp - 0x18]
push edi
mov ecx, dword [eax + esi*8 + 0xc]
add ecx, 4
call fcn.006280e0
mov ecx, eax
add esp, 4
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x64a54c
jmp 0x64a539
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 4]
jl 0x64a4a6
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x64a560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, edx
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
push esi
mov esi, eax
push edi
test eax, eax
je 0x64a58d
cmp byte [eax], dl
je 0x64a585
nop dword [eax]
inc esi
cmp byte [esi], dl
jne 0x64a580
sub esi, eax
and esi, 0x3fffffff
mov eax, dword [ecx + 4]
mov edi, 1
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
cmp eax, edi
jle 0x64a655
push ebx
mov ebx, dword [ecx + 8]
mov dword [ebp - 0x18], ebx
nop word [eax + eax]
mov eax, edi
xor eax, 1
cmp edi, 2
cmovge eax, edi
add eax, eax
mov ecx, dword [ebx + eax*8 + 0xc]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x64a61c
mov edx, dword [ebx + eax*8]
mov bl, byte [ecx]
test bl, bl
je 0x64a604
mov edi, ecx
mov al, bl
sub edi, edx
nop word [eax + eax]
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x1fd778]
cmp al, byte [ecx + 0x1fd778]
jne 0x64a601
mov al, byte [edi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x64a5e0
mov edi, dword [ebp - 8]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x1fd778]
movzx eax, bl
movzx eax, byte [eax + 0x1fd778]
sub eax, ecx
jne 0x64a639
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add ecx, 0x14
push esi
call fcn.006280e0
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x64a64c
jmp 0x64a63c
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
inc edi
mov dword [ebp - 8], edi
cmp edi, dword [ebp - 0x14]
jl 0x64a5b0
pop ebx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x69b8c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x69b8ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x69b8ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x6d7b10
Capabilities:
Packed with generic packer

Disassembly:
push 0xbda1cd00
pushfd
or word [esp + 4], 0x5516
sete byte [esp + 4]
jl 0x9f448c
test word [esp + 4], 0xe895
push ebx
push 0x650ae602
mov dword [esp + 0xc], 0x49f68dcf
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.008f6dfd

Function at 0x6d7b28
Capabilities:
Encode data using xor

Disassembly:
test byte [esp + 0x28], ch
jo 0x7a5e33
mov word [esp + edx + 0x34783e05], dx
jle 0x7f8dbd
not esi
cmp si, 0xb026
ja 0x8151cb
mov ecx, dword [esp + 0x2c]
cmp esi, dword [esp + 4]
movsx esi, byte [esp + 0x28]
call fcn.00a1ccdf
xchg dword [esp + edx + 0x34783e25], edi
adc al, 0x25
js 0x7f8df8
mov edx, dword [esp + edx*2 + 0x68f07c0a]
jne 0x8ebcc7
jno 0x7ee166
push 0xe1062ed6
stosb byte es:[edi], al
call 0x308898d6
or dword [edi + 0x509ab6fc], eax
mov dl, 0x36
pop ds
cdq
mov bl, 0xbc
nop
dec edx
out dx, eax
push es
sub ch, bl
push ds
xchg ebp, eax
pop ecx
sbb dl, byte [edx + edx - 0x2b647925]
mov byte [0xa8c4b768], al
pop edx
and bh, ah
mov edi, 0xf8576666
xchg esp, eax
adc bl, bl
xchg byte [ebx - 0x48975d2c], bl
les ebp, [eax - 0x4018dfa6]
push di
clc
scasd eax, dword es:[edi]
wait
or dl, byte [edx]
xor esp, dword [ebx]
sar dword [edx], cl
push es
pop ds
jo 0x7f8dbf
add esi, dword [edx - 0x45]
aad 0xaa
xchg esi, eax
inc esp
cmpsd dword [esi], dword es:[edi]
bound edi, qword [ebx - 0x3b]
sahf
fdiv st(4)
push cs
in al, dx
push 0xbaa1fb61
xchg dword [eax], ebp
mov ebx, 0xd8d5220a
xor dword [eax + 0x69], esi
outsb dx, byte [esi]
fucomi st(1)
cmp dword [esi + 0x70592da6], edx
adc eax, 0xb99aa54c
jnp 0x7f8ddd
and al, 0x4d
loope 0x7f8e65
scasd eax, dword es:[edi]
call 0x2170effb
jg 0x7f8ddd
loopne 0x7f8e70
add dword [eax], esp
dec edi
cwde
mov ah, 0x35
pop es
salc
out dx, eax
popal
sub ch, byte [eax - 0x5c]
mov dl, 0x50
aam 0xed
jg 0x7f8e7f
jp 0x7f8e4d
test eax, 0xa27096c6
jo 0x7f8e14
push ebp
sbb ebx, dword [edx]
pushfd
test dword [edx], ebp
sbb dh, ah
fstp st(5)
xchg edi, eax
mov ah, 0x34
shl cl, 1
sub dword [eax - 0x3a578390], ecx
mov bh, 0xac
cli
pushfd
call 0xfc252d18
mov al, 0xf5
out dx, al
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
jg 0x7f8ee6
dec ecx
cmp byte [edx], dl
or eax, 0x7822e478
xor bh, byte [ecx + 0x3f]
sal dword [ebp + 0x5f], cl
and bh, byte [esi - 0x28c2f9fc]
sub dword [ecx + 0x2aec7022], 0x70
adc byte [ecx], 0x43
xchg ebx, eax
pushal
jns 0x7f8eee
mov esi, 0x20067925
into
xchg ebp, eax
mov bh, 0xa6
hlt
inc edi
loope 0x7f8f0e
sub ecx, ebx
lodsd eax, dword [esi]
lodsd eax, dword [esi]
leave
test dl, 0xd7
push ecx
in eax, dx
mov edi, 0x1c569c6f
mov esi, 0x80d620a5
invalid
mov cs, word [ebp - 0x41]
scasb al, byte es:[edi]
cld
sti
dec ebx
jecxz 0x7f8ef8
movsd dword es:[edi], dword [esi]
sahf
and esi, ebx
ret
js fcn.0080e6bb
and dword [esp + 8], 0x13bf650c
add dword [esp], 0xffe97322
shl byte [esp + 8], 0x7f
ret 8
mov dword [esp + 0x20], edx
not byte [esp + 0x20]
lea ebp, [ebp + 0x800caa]
call fcn.00a29518
mov eax, 0xbf972d3f
mov ax, word [edi]
mov edx, 0xe9929c81
mov dx, word [edi + 2]
jmp 0x96a381
jmp 0x99d7e6
add edi, 2
jmp 0x917a70
Function at 0x6dbadd
Capabilities:
Packed with generic packer

Disassembly:
int3
xor al, 0x22
add byte [esi - 0x7f], ah
invalid
invalid
jecxz 0x6dba85
pop ds
push ebx
push edx
pushfd
mov edx, 0x158d00be
mov dl, dh
not edx
lea edx, [0xd2f7d68a]
mov ebx, dword [esp + 0xc]
shl edx, 0x42
cmp edx, 0xd1a9cd2a
jle 0x81b16a
movzx ecx, byte [edi]
movzx edx, al
lea edi, [edi + edx*8 - 0x1d7]
or al, 0x8d
xor cl, bl
call fcn.00924e04
je 0x6dbada
jns 0x6dbb21
int3
call fcn.007d14be
loopne 0x81b1e4
push cs
clc
stosd dword es:[edi], eax
mov ds, word [ebp - 0x2a]
push eax
mov dl, 0xe6
push ecx
and esi, dword [esi]
in eax, dx
pop es
xor byte [ebx + 0x74ee80e6], dl
add dword [esi + 0x1274c53], esi
jl 0x81b1c4
adc dword [ebx], esi
pop es
add byte [edx - 0x2e807bf2], bh
xchg ebx, eax
xlatb
and byte [esi + 0x7b], al
or edi, dword [ebx + esi]
retf
in al, dx
mov edx, 0x287c32c1
sub esi, dword [edi + 0x21bf9464]
leave
lea edi, [eax - 0x607adff0]
mov al, byte [0x90b23b6c]
js 0x81b24a
imul ecx, dword [edi - 0x69], 0x5ecb4e79
pop esi
mov dh, 0xe9
jecxz 0x81b24b
dec edi
test dword [edi + 0x4ec06ca0], ebx
sbb byte [ecx], dh
inc edi
pop ebx
pushal
cmc
inc esp
mov eax, 0x8808c89a
pop ss
push edi
test dword [edi + 0x3bb26ca0], ebx
sbb dword [0x2b9fe2e1], esp
test ebp, 0x471dc0c6
scasb al, byte es:[edi]
inc edx
je 0x81b247
xchg ebp, eax
push edi
invalid
stosd dword es:[edi], eax
pop esi
pop esi
into
adc al, 0x66
cmp cl, byte [edx]
cmp dword [eax - 0x3364976e], esi
int3

Function at 0x6dbb1b
Capabilities:
Packed with generic packer

Disassembly:
int3
xor al, 0x22
add byte [esi - 0x7f], ah
invalid
invalid
jecxz 0x6dba85
pop ds
push ebx
push edx
pushfd
mov edx, 0x158d00be
mov dl, dh
not edx
lea edx, [0xd2f7d68a]
mov ebx, dword [esp + 0xc]
shl edx, 0x42
cmp edx, 0xd1a9cd2a
jle 0x81b16a
movzx ecx, byte [edi]
movzx edx, al
lea edi, [edi + edx*8 - 0x1d7]
or al, 0x8d
xor cl, bl
call fcn.00924e04
je 0x6dbada
jns 0x6dbb21
int3
call fcn.007d14be
loopne 0x81b1e4
push cs
clc
stosd dword es:[edi], eax
mov ds, word [ebp - 0x2a]
push eax
mov dl, 0xe6
push ecx
and esi, dword [esi]
in eax, dx
pop es
xor byte [ebx + 0x74ee80e6], dl
add dword [esi + 0x1274c53], esi
jl 0x81b1c4
adc dword [ebx], esi
pop es
add byte [edx - 0x2e807bf2], bh
xchg ebx, eax
xlatb
and byte [esi + 0x7b], al
or edi, dword [ebx + esi]
retf
in al, dx
mov edx, 0x287c32c1
sub esi, dword [edi + 0x21bf9464]
leave
lea edi, [eax - 0x607adff0]
mov al, byte [0x90b23b6c]
js 0x81b24a
imul ecx, dword [edi - 0x69], 0x5ecb4e79
pop esi
mov dh, 0xe9
jecxz 0x81b24b
dec edi
test dword [edi + 0x4ec06ca0], ebx
sbb byte [ecx], dh
inc edi
pop ebx
pushal
cmc
inc esp
mov eax, 0x8808c89a
pop ss
push edi
test dword [edi + 0x3bb26ca0], ebx
sbb dword [0x2b9fe2e1], esp
test ebp, 0x471dc0c6
scasb al, byte es:[edi]
inc edx
je 0x81b247
xchg ebp, eax
push edi
invalid
stosd dword es:[edi], eax
pop esi
pop esi
into
adc al, 0x66
cmp cl, byte [edx]
cmp dword [eax - 0x3364976e], esi
int3
Function at 0x7563e6
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov esi, dword [esp + edi - 0x380ae269]
mov ebx, edi

Function at 0x77d65c
Capabilities:
Encode data using xor

Disassembly:
pushfd
cmp word [esp + 8], 0xdfbd
jo 0x90f1ab
sete byte [esp + 8]
mov eax, dword [esp + 0x10]
js 0x9e1bad
stc
xchg byte [0x10cd81bb], cl
dec esp
push 0x852e
xor ebx, ebx
cdq
and ecx, 0x287a0658
add byte [esi - 0x63], cl
das
invalid
and word [esp + 8], 0x3c1c
call fcn.00926a67

Function at 0x78e70b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jo 0x98a743
jb 0x78f7e4
and eax, 0xb6115b11
cmc
dec edx
and byte [esi - 0x29], cl
adc dword [esi + 0x4e204af5], esi
xlatb
pop esp
dec esi
fstp xword [ecx + 0x4f]
mov ah, 0x53
cdq
mov ebp, 0x61b204ef
jl 0x78e71a
or dword [ebp + 0x17], edi
int3

Function at 0x794cb7
Capabilities:
Encode data using base64

Disassembly:
lea ebx, [eax*8 - 0x4d6fb3f0]
bswap esi
sub eax, eax
jne 0x7982df
not ebx
xor esi, 0xff258b1b
neg esi
inc ax
sub esi, eax
xor esi, 0xf59e6f21
lea esi, [esi + eax*8 - 0x65a291bd]
neg esi
push eax
sub esi, 0x8cb4783a
lea edx, [ecx + eax*8 - 0x584ef8df]
mov dword [esp + ecx - 0x16482b4a], edx
shl byte [esp + ecx - 0x16482b4b], 0x87
neg esi
or dl, cl
mov byte [esp + eax + 4], dl
mov dword [esp + ecx - 0x16482b4a], edi
sar edx, cl
lea edi, [esp + ecx - 0x16482b4e]
not word [esp + ecx - 0x16482b4e]
sub byte [esp + ecx*2 - 0x2c90569a], ah
xor ebx, ebx
mov edx, 0xffce0000
cmovb ecx, eax
call fcn.00a3fbfe

Function at 0x79931e
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
lea ebx, [ebx + esi*2 + 0x28e7a7ae]
mov ebp, dword [esp + esi + 0x12da7c9e]
ja 0x983ea9
mov edi, 0x1023fe3f
cmp byte [esp + 0xc], ch

Function at 0x7ad546
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
not bp
movsx ebp, bp
nop
ja 0x851e42
jmp 0x96c952
jbe 0x970a5a
jne 0x91c579
sub ebp, 4
jmp 0x96f761
mov eax, 0x50b97f08
ror eax, 0x46
mov eax, dword [ebp + eax*2 - 0x4285cbf8]
push 0xcf2bf8a5
xor eax, ebx
ror eax, 3
bswap eax
not eax
or dword [esp], 0xe33feda5
rol eax, 3
neg eax
call fcn.0090f056

Function at 0x7b78d9
Capabilities:
Authenticate hmac

Disassembly:
push edx
push ecx
pushfd
mov ecx, 0xd69f099f
push edx
push ebp
shl ecx, 0xf9
mov edx, dword [esp + 0x14]
jns 0x926674
ja 0x9f44e7
jae fcn.007c85ed
mov ebp, 0xe2a4609
lea edx, [edx + 1]
call fcn.007c530f

Function at 0x7f0460
Capabilities:
Encode data using base64

Disassembly:
jl fcn.00824553
sub dword [esp + 0x18], 0x67ab288f
push dword [esp + 0x4c]
popfd
lea esp, [esp + 0x58]
ret

Function at 0x7fb017
Capabilities:
Packed with generic packer

Disassembly:
shr byte [esp + edi + 0x67d47004], 0x9d
jne 0x800f01

Function at 0x809617
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
lea edx, [edx + esi*2 - 0x35c6b29f]
or si, 0x1ab8
push esi
sub esi, esi
mov dword [esp + esi + 0x1c], edx
jg fcn.00a2dcfa
call fcn.008cac44
push ecx
lea ebp, [ebp + ecx - 0x7ca37638]
movzx ecx, byte [ebp + ecx - 0x7ca37637]
xor cl, bl
not cl
ror cl, 1
sub cl, 0xa1
ror cl, 1
xor bl, cl
sub edi, 2
jmp fcn.0083983d
Function at 0x824553
Capabilities:
Encode data using base64

Disassembly:
or edi, edi
ja 0x963c90
jae 0x962ab9
add byte [esp + 0x10], 0xa0
mov byte [esp + 0x10], 0xa1
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x20]
ret
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x18]
ret
sub edi, edi
push ebx
mov dword [esp + edi*2 + 0x18], ebx
lea edi, [edi + edi*8 - 0x4f57b3ed]
mov ebx, 0x82ed622
call fcn.009aed1a

Function at 0x83ff6a
Capabilities:
Encode data using base64
Encode data using xor
Parse pe header

Disassembly:
mov edx, dword [esp + edx - 0x711cffe3]
js 0x9898cb
shr byte [esp + 0x44], 0x66
mov dword [esp + 0x48], 0xd8bb8d29
neg dword [esp + 0x48]
or dword [esp + 0x48], 0x5b177914
not word [esp + 0x48]
test dword [esp + 0x48], 0x88b54134
push dword [esp + 0x40]
popfd
lea esp, [esp + 0x50]
ret

Function at 0x869cf2
Capabilities:
Packed with generic packer

Disassembly:
call fcn.009e67fd
jge 0x985cb1
add dx, dx
neg dl
xor dl, dh
test word [esp + edx - 0x7277fff2], dx
jns 0x74eb0e
jmp 0xa40f30
jns 0x96dc19
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x28]
ret
call fcn.007accc8
sbb al, 0x3b
mov word [0x743c8ffe], cs
rep lodsb al, byte [esi]
xor edi, ebp
pop esi
push dword [ebp - 0x12]
invalid

Function at 0x875138
Capabilities:
Encode data using xor

Disassembly:
or al, dl
mov word [edi], ax
call fcn.0096b3ba
xchg esp, eax
sub al, 6
jp 0x8751b9
or cl, dl
push edx
xor dl, byte [edx]
or byte [eax + edi*2], dh
loopne 0x87514a
pop esp
jl 0x87519b
sub cl, byte [edx + 0x32]
out 0xe, al
inc esi
int1
invalid
or dword [ebp + 0x19], esi
mov esi, 0xab6a7c8
pop ecx
push ecx
jmp 0xee9379e2
sub bl, byte [edi - 0x4e]
mov edx, 0xc3af5f13
or dl, byte [ebx]
sahf
pop es
das
wait
stosd dword es:[edi], eax
stosb byte es:[edi], al
call 0x26b59808
out dx, al
push es
pop esi
jmp 0x41a2eab5