joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015e0
Capabilities:
Extract resource via kernel32 functions
Get hostname

Disassembly:
push ecx
push 0x42a2f8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
ret
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x423458
push eax
mov dword fs:[0], esp
sub esp, 0xd84
cmp dword [0x848528], 0x5b1
push ebx
push esi
push edi
jne 0x4016a9
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push 0
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea esi, [ebp - 0x34]
call fcn.00401c30
push 0
mov dword [ebp - 4], 0
call fcn.00403aec
push 0
push 0
call fcn.00403940
add esp, 0xc
call fcn.004036fa
jmp 0x4015d0
mov eax, dword [0x429370]
mov dword [0x84852c], eax
mov eax, dword [0x848528]
add eax, 0x1134b
push eax
push 0
mov dword [0x848528], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x847478], eax
call fcn.00401510
mov edi, dword [sym.imp.GDI32.dll_GetDeviceGammaRamp]
xor esi, esi
lea ecx, [ecx]
cmp esi, 0x2710
jge 0x4016f3
lea ecx, [ebp - 0x590]
push ecx
push 0
call edi
inc esi
cmp esi, 0x18ea14c
jl 0x4016e0
xor esi, esi
cmp dword [0x848528], esi
jbe 0x401758
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [0x84852c]
mov al, byte [edx + esi + 0x1134b]
mov ecx, dword [0x847478]
mov byte [ecx + esi], al
cmp dword [0x848528], 0xa8
jne 0x40174f
push 0
lea edx, [ebp - 0x10]
push edx
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x190]
push eax
call ebx
inc esi
cmp esi, dword [0x848528]
jb 0x401712
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
jmp 0x401770
mov ecx, dword [0x848528]
add ecx, esi
cmp ecx, 0xe
jne 0x40179c
push 0
push 0
push str.juxaxisofun
call edi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
inc esi
cmp esi, 0x39621
jl 0x401770
call fcn.00401460
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
call edi
cmp esi, 0x26
jne 0x4017be
call fcn.004014f0
inc esi
cmp esi, 0x6753f
jl 0x4017b2
mov esi, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov ebx, dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [ebp - 0x10], 0x7b
cmp dword [0x848528], 0x86
jne 0x40181c
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xd90]
push eax
push str.zofirajohukaseviheza
call esi
push 0
push str.zajivazegecolojokateweyehenesa
push str.wedihofipepowexohogokozazotahejojeberaxipemobu
call edi
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
sub dword [ebp - 0x10], 1
jne 0x4017e0
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
or dword [ecx + 0x78], 0x56
mov edi, dword [0x458d569b]
mov byte [edx - 0x20], ch
push eax
push esi
call 0x7086e0
idiv dword [eax + ecx - 0x75]
adc eax, sym.imp.MSVCRT.dll__iob
push eax
push ecx
add edx, 0x40
push str._s:__s___d__n
push edx
call dword [0x4cc180]
mov eax, dword [0x4102ac]
add esp, 0x14
test eax, eax
je 0x401ea8
or byte [eax + 0x54], ch
rol byte [eax], cl
idiv dword [edi + 0x64]
shr dword [esi], 0x83
invalid

Function at 0x404ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub ecx, dword [edi]
test byte [esi], ch
add al, byte [eax]
add byte [eax - 0x6f2ffe70], dl
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x10002b10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016aa

Function at 0x100064e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x10006503
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x10006546
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call fcn.1002bc00
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.1002bfec
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x1003fc10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x1000652e

Function at 0x1000654a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005a90
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.1002bc00
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100065f2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10006607
pop ebp
ret
pop ebp
jmp fcn.100064e0

Function at 0x10008770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x1004f158]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x20]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.1002bc1b
add esp, 0x10
cmp eax, esi
jne 0x100087e0
cmp ebx, 1
je 0x10008789
cmp ebx, 2
mov esi, 0xffffffff
je 0x100087e3
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.1002b8a9
add esp, 4
neg eax
sbb esi, esi
jmp 0x100087e3
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d728
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x10008824
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.1002bc1b
add esp, 0x14
jmp 0x10008853
test esi, esi
jle 0x1000884c
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x1000884e
inc edi
cmp esi, edi
mov eax, ebx
jne 0x1000882d
mov edi, esi
jmp 0x1000884e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x10008860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x1004f158]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0xffffffff
je 0x100088a3
mov esi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x100088bb
xor edi, edi
inc edi
lea eax, [ebp - 0x19]
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.1002bc1b
add esp, 0x10
cmp eax, edi
je 0x100088a5
xor ebx, ebx
dec ebx
jmp 0x100088a5
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d728
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea ebx, [ebp - 0x19]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x1000889e
mov edi, eax
cmp eax, 3
je 0x1000891c
cmp edi, 1
ja 0x1000889e
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.1002bc1b
add esp, 0x10
cmp eax, ebx
jne 0x1000889e
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x100088c6
jmp 0x10008935
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.1002bc1b
add esp, 0x10
cmp eax, edi
jne 0x1000889e
mov ebx, dword [ebp + 8]
jmp 0x100088a5

Function at 0x10008970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x10008994
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.1002bc1b
add esp, 0x14
jmp 0x100089c4
test esi, esi
jle 0x100089bd
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x100089bf
inc edi
cmp esi, edi
mov eax, ebx
jne 0x1000899d
mov edi, esi
jmp 0x100089bf
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x100089d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x1004f158]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp si, 0xffff
je 0x10008a16
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x10008a2e
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.1002bc1b
add esp, 0x10
cmp eax, 1
je 0x10008a18
xor esi, esi
dec esi
jmp 0x10008a18
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d728
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x10008a11
mov ebx, eax
cmp eax, 3
je 0x10008a8f
cmp ebx, 1
ja 0x10008a11
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.1002bc1b
add esp, 0x10
cmp eax, esi
jne 0x10008a11
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x10008a39
jmp 0x10008aa8
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.1002bc1b
add esp, 0x10
cmp eax, ebx
jne 0x10008a11
movzx esi, word [ebp + 8]
jmp 0x10008a18

Function at 0x10008c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008c6f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008c51
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008db1
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008d91
pop esi
pop edi
pop ebp
ret 8
Function at 0x100124c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.1001b2e4
mov ebx, eax
test esi, esi
je 0x100124fd
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x100124ea
movzx eax, word [eax]
jmp 0x100124f1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x100124fd
test bl, bl
jne 0x10012503
jmp 0x10012560
xor esi, esi
test bl, bl
jne 0x10012551
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x10012512
movzx eax, word [eax]
jmp 0x10012517
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x10012542
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x1001253b
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x100124d0
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x100124d0
mov ecx, edi
call fcn.1001b2e4
mov ebx, eax
test esi, esi
jne 0x10012569
jmp 0x1001255a
mov ecx, edi
call fcn.1001b2e4
mov ebx, eax
test bl, bl
jne 0x10012588
jmp 0x1001258e
mov ecx, edi
call fcn.1001b2e4
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x10012576
movzx eax, word [eax]
jmp 0x1001257d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x1001258e
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x10034577
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10034582

Function at 0x10036c3f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10036c4a
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x525c0d1b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2089295b
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4012a4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0040a2b3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4012ea
xor eax, eax
jmp 0x4012ed
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call int.0040a8e8
lea eax, [edi + 0x7c]
test eax, eax
je 0x401308
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0040ac4d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x401346
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0040ac4d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.00409fcd
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0040a969
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4031a5
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x4f7e5e

Function at 0x42859d
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
in al, dx
and esi, edi
xor cl, dl
in al, 0xd0
mov al, byte [0x5a4746d]
rol dword [eax + 4], 0xd5
add byte [esi + 0x5b], 0xee
mov bl, 0xab
aam 0x79
inc ebp
xor eax, 0x4fae347f
mov ss, word [esi + ecx*2]
in al, dx
invalid

Function at 0x44c8a5
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x54155e
test dword [esi], esp
pop eax
outsb dx, byte [esi]
mov eax, eax
dec edx
inc esi
xchg esi, eax
adc edx, dword [ebx + esi*2]
push edx
aam 0x97
das
jnp 0x5414fa
in al, 0x71
dec edx
xor dword [0x6fb1b8c5], ebx
pop ds
pushal
insb byte es:[edi], dx
adc al, byte [ebx - 0x57]
jne 0x541535
push ecx
Function at 0x457234
Capabilities:
Encode data using xor

Disassembly:
sbb esp, esp
test byte [edx + 0x4852322b], 0x24
shr byte [esi - 0x50f3f042], cl
mov esi, 0x60af0c0f
mov esi, 0x60af0c0f
mov al, byte [0x1e1d90fc]
add dword [edi - 0x75c1b0eb], 0x22
sub ecx, dword [esp + ebx*4 + 0x50bb5e9b]
xor ecx, dword [esp + edi*4 + 0x31]
mov esi, 0xd4b4fd6c
mov dword [edi + 0x6e], ebp
pop ebp
loop 0x457229
invalid

Function at 0x458c3f
Capabilities:
Encode data using xor

Disassembly:
pop ds
insb byte es:[edi], dx
test eax, 0x43d43aba
jl 0x458c89
insd dword es:[edi], dx
insb byte es:[edi], dx
xor eax, 0x4fe34efc

Function at 0x494084
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0049d093
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4940ca
xor eax, eax
jmp 0x4940cd
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0049d6c8
lea eax, [edi + 0x7c]
test eax, eax
je 0x4940e8
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0049da2d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x494126
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0049da2d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0049cdad
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0049d749
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d6b4
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0xfa
xchg edi, eax
and eax, 0x7475089e
les si, [ebp + 0x62]
xor ecx, dword [ebx - 0xc17a8a2]
mov ebp, 0xca59adce
mov ah, 0x8b
imul ebp, esp, 0x1d
dec edi
aam 0x79
sbb ebp, dword [eax - 6]
les esp, [esi]
and al, byte [ebx + 5]
add eax, 0xa66ffdde
cmc
xor dword [eax + 0x2eb21257], esp
xchg edx, eax
invalid
rcr byte [esi], cl
or esp, dword [ebx + esi*8 - 0x6a420cb2]
jp 0x49d6a5
push cs
jo 0x49d68c
push es
test byte [ebp - 0x43], 0x10
push cs
popal
lcall 0xfb8, 0xf85dc30
cli
jb 0x859ffb8e
psubd mm1, qword [edi]
and byte [ebx + 0x2c855624], 0x2a
sub al, 0x2a
pushfd
out 0x92, eax
in eax, dx
jno 0x49d70a
outsd dx, dword [esi]
test al, 0x5a
push cs
sbb al, 0x1d
jl 0x49d736
and esi, dword [ebx + 0x88c69bf]
je 0x49d758
jg 0x49d6d7
xor dword ss:[eax], eax
dec esp
retf 0xb8d4
aam 0xb8
test dword [esi + 0x45], esi
lodsd eax, dword [esi]
push eax
stc
outsb dx, byte [esi]
push ss
outsd dx, dword [esi]
salc
popal
cwde
jne 0x49d746
rcl byte [edi + 0x16], 0x28
push 0xffffffffffffffb4
add byte [ecx - 0x7af96054], ch
invalid
cmpsb byte [esi], byte es:[edi]
jae 0x49d756
adc al, 0xbe
mov dword [0xe6767e6f], eax
hlt
sub al, 0x90
jg 0x49d6e3
stc
adc dword [edi], esp
sub dword [eax - 0x7128d60b], 0xa70769c4
test al, 0xf5
sub edi, edx
mov es, esp
invalid
pop es
cmpsd dword [esi], dword es:[edi]
daa
invalid
adc eax, 0x333da0cc
mov al, byte [0xe479333d]
jns 0x49d741
push cs
push esp
sub al, 0xa4
pop ecx
xor eax, 0xbb635758
fcmovne st(0), st(1)
je 0x49d76f
sar dword [esi], 1
pop edi
call [edx - 0x175d585]
retf
lcall 0x1dcb, 0xfe8a2a7b
call 0xd885deaa
pop ebp
jl 0x49d79d
pop ds
mov bl, 0xca
mov eax, 0x5e2ba2bb
salc
ja 0x49d745
lcall 0x241e, 0xda022580
invalid
mov eax, dword [0xe8d0c3b6]
shr al, 1
cmp al, 0xc6
mov ch, 0xad
lodsd eax, dword [esi]
jle 0x49d798
mov edx, 0x750e2ef0
jg 0x49d77d
sahf
int1
push cs
pop esi
stosd dword es:[edi], eax
fimul dword [eax + eax*8]
mov byte [edi], bh
aas
imul ebx, dword [esi + 0x73], 0xffffffe5
leave
or bh, dh
sbb ebx, dword [esi]
and al, 0x4d
sub eax, eax
mov ebp, 0xb2ffd4a4
adc bh, byte [eax - 0x42]
xchg esp, eax
mov bh, 0x15
cwde
push edx
jl 0x49d7b0
sub ah, dh
test dword [eax - 0x4a], esi
xchg ebp, eax
aas
out 0x7a, eax
mov ah, 8
sub al, 0xde
fiadd word es:[eax + 0x44]
pop ds
xor dword [ebx], 0x8717da9
fdivr dword [ebp - 0x2f]
jge 0x49d79d
fimul word [ecx - 0x72]
les esp, [ecx + 0x10]
sbb ecx, dword [0x734417b1]
mov edi, 0xde9936e9
dec edx
pop ss
push esp
inc edi
pop ss
scasd eax, dword es:[edi]
jl 0x49d795
sub eax, 0x560a56b6
ljmp 0xdd4f