joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f8800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x628585
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x6b93c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x40], 0x2d534544
mov dword [ebp - 0x3c], 0x32454445
mov word [ebp - 0x38], 0x2f
movups xmm0, xmmword [ebp - 0x40]
mov dword [ebp - 0x30], 9
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x30]
movq qword [ebp - 0x18], xmm0
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov byte [ebp - 4], 1
push 3
push 0x638fa8
cmp eax, 3
jb 0x5f88c2
cmp edx, 0xf
lea esi, [ebp - 0x28]
lea eax, [ecx + 3]
cmova esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.005c0730
add esp, 0xc
mov byte [esi + 3], 0
lea eax, [ebp - 0x28]
jmp 0x5f88cf
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
push 3
call fcn.0043e480
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x5f8934
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5f892a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5f8993
push ecx
push edx
call fcn.00584ebb
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x5f8976
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5f896c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5f8993
push ecx
push edx
call fcn.00584ebb
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00584ead
mov esp, ebp
pop ebp
ret
call fcn.005cadb0
int3
Function at 0x5f91c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x628585
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x6b93c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x40], 0x43414853
mov dword [ebp - 0x3c], 0x322d4c41
mov word [ebp - 0x38], 0x2f
movups xmm0, xmmword [ebp - 0x40]
mov dword [ebp - 0x30], 9
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x30]
movq qword [ebp - 0x18], xmm0
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov byte [ebp - 4], 1
push 3
push 0x638fa8
cmp eax, 3
jb 0x5f9282
cmp edx, 0xf
lea esi, [ebp - 0x28]
lea eax, [ecx + 3]
cmova esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.005c0730
add esp, 0xc
mov byte [esi + 3], 0
lea eax, [ebp - 0x28]
jmp 0x5f928f
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
push 3
call fcn.0043e480
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x5f92f4
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5f92ea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5f9353
push ecx
push edx
call fcn.00584ebb
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x5f9336
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5f932c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5f9353
push ecx
push edx
call fcn.00584ebb
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00584ead
mov esp, ebp
pop ebp
ret
call fcn.005cadb0
int3
Function at 0x5fbd20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x632502
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6b93c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004db110
mov dword [edi], vtable.CSkyObject.0
xorps xmm0, xmm0
movups xmmword [edi + 4], xmm0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea esi, [edi + 0x134]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00584ec9
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1bc], 0
xorps xmm0, xmm0
mov dword [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0
mov dword [edi + 0x1c8], 0x3f800000
mov dword [edi + 0x1cc], 0x3f800000
mov dword [edi + 0x1d0], 0x3f800000
movups xmmword [edi + 0x1d8], xmm0
mov dword [edi + 0x1e8], 0
mov dword [edi + 0x1ec], 0xf
mov byte [edi + 0x1d8], 0
lea ecx, [edi + 0x1f4]
mov byte [ebp - 4], 3
call fcn.004e8f00
mov dword [edi + 0x174], 0
mov dword [edi + 0x170], 0
mov dword [edi + 0x16c], 0
mov dword [edi + 0x168], 0
mov dword [edi + 0x160], 0
mov dword [edi + 0x15c], 0
mov dword [edi + 0x158], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x148], 0
mov dword [edi + 0x144], 0
mov dword [edi + 0x140], 0
mov dword [edi + 0x178], 0x3f800000
mov dword [edi + 0x164], 0x3f800000
mov dword [edi + 0x150], 0x3f800000
mov dword [edi + 0x13c], 0x3f800000
mov dword [edi + 0x1b4], 0
mov dword [edi + 0x1b0], 0
mov dword [edi + 0x1ac], 0
mov dword [edi + 0x1a8], 0
mov dword [edi + 0x1a0], 0
mov dword [edi + 0x19c], 0
mov dword [edi + 0x198], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x18c], 0
mov dword [edi + 0x188], 0
mov dword [edi + 0x184], 0
mov dword [edi + 0x180], 0
mov dword [edi + 0x1b8], 0x3f800000
mov dword [edi + 0x1a4], 0x3f800000
mov dword [edi + 0x190], 0x3f800000
mov dword [edi + 0x17c], 0x3f800000
mov byte [ebp - 4], 4
mov dword [edi + 0xf8], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf0], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xfc], 0x3f800000
mov dword [edi + 0xe8], 0x3f800000
mov dword [edi + 0xd4], 0x3f800000
mov dword [edi + 0xc0], 0x3f800000
mov ecx, dword [0x70b358]
call fcn.004c7100
mov dword [edi + 0x130], eax
mov eax, edi
mov dword [edi + 0x128], 0
mov dword [edi + 0x12c], 0
mov word [edi + 0x1f0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x601ec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x601eed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x601eed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x6035e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0x18]
test eax, eax
je 0x6035f0
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
xor ebx, ebx
add eax, 4
je 0x6035f9
mov ebx, dword [eax]
lea ecx, [eax + 4]
xor eax, eax
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x60360c
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
xor edx, edx
add ecx, 4
je 0x603615
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [ebp]
add edi, ebx
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 4]
add ebp, 8
add ebx, edx
test ecx, ecx
je 0x603682
nop
lea edx, [edi*2 + 1]
imul edx, edi
lea eax, [ebx*2 + 1]
imul eax, ebx
rol edx, 5
rol eax, 5
mov esi, edx
xor esi, dword [esp + 0x10]
movzx ecx, al
and ecx, 0x1f
mov dword [esp + 0x10], edi
rol esi, cl
mov edi, eax
xor edi, dword [esp + 0x1c]
mov eax, ebx
mov ebx, dword [ebp]
movzx ecx, dl
add ebx, esi
and ecx, 0x1f
mov dword [esp + 0x1c], eax
rol edi, cl
add edi, dword [ebp + 4]
add ebp, 8
sub dword [esp + 0x14], 1
jne 0x603630
add eax, dword [ebp + 4]
mov ecx, dword [ebp]
add ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6036a0
mov eax, dword [eax]
xor ecx, eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test edx, edx
je 0x6036aa
mov dword [edx], ecx
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x6036bb
xor edi, dword [edx]
test esi, esi
je 0x6036c1
mov dword [esi], edi
add esi, 4
lea ecx, [edx + 4]
test edx, edx
pop edi
cmove ecx, edx
mov edx, dword [esp + 0x18]
test ecx, ecx
je 0x6036d7
xor edx, dword [ecx]
test esi, esi
je 0x6036dd
mov dword [esi], edx
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x6036f0
mov eax, dword [eax]
xor ebx, eax
test esi, esi
je 0x6036f6
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x43b589
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x43b5c4
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x43b5a1
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x43b5e0
dec esi
je 0x43b5d9
dec esi
jne 0x43b5e5
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc

Function at 0x453d84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
movzx eax, word [esi]
add eax, esi
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor edi, edi
cmp eax, esi
mov ebp, esi
je 0x453dff
mov edx, dword [0x300200f0]
cmp eax, ebp
jne 0x453dbb
movzx ecx, byte [pe_dos_header]
test ecx, ecx
je 0x453dff
test dl, 1
je 0x453dd5
mov ecx, eax
and cl, 7
neg cl
mov ebx, edx
sbb ecx, ecx
add ecx, 1
and ebx, 2
xor ecx, ebx
je 0x453ddf
movzx ecx, word [eax + 2]
cmp ecx, dword [esp + 0x1c]
jge 0x453e31
mov dword [esp + 0x18], eax
movzx eax, word [eax]
xor ecx, ecx
add eax, esi
test edi, edi
sete cl
mov edi, ecx
test edi, edi
je 0x453dfb
movzx ebp, word [ebp]
add ebp, esi
cmp eax, esi
jne 0x453dac
mov ax, word [esi + 6]
cmp ax, 0xfffe
je 0x453e28
movzx eax, ax
cmp word [eax*2 + 0x300080e8], 5
jne 0x453e28
push eax
call fcn.004556cb
add esp, 4
test eax, eax
jne 0x453d9a
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x453f34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test byte [0x300200f0], 1
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jne 0x453f63
mov cx, word [eax]
test cx, cx
je 0x453f63
movzx ecx, cx
add ecx, eax
movzx ecx, word [ecx + 2]
push esi
lea esi, [edx + 4]
cmp ecx, esi
pop esi
jae 0x453f70
cmp ecx, edx
je 0x453f70
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp fcn.00453d84
ret

Function at 0x454ea3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x454ed7
cmp byte [eax], 0
je 0x454f1b
lea eax, [eax + 1]
test eax, 3
je 0x454ed7
cmp byte [eax], 0
je 0x454f1b
lea eax, [eax + 1]
test eax, 3
je 0x454ed7
cmp byte [eax], 0
je 0x454f1b
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x454ed7
test cl, cl
lea eax, [eax - 4]
je 0x454f1b
test ecx, 0xff00
lea eax, [eax + 1]
je 0x454f1b
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x454f1b
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x454f1b
lea eax, [eax + 1]
jmp 0x454ed7
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x454f2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x454f51
cmp word [eax], 0
je 0x454f4a
lea eax, [eax + 2]
test eax, 3
je 0x454f51
jmp 0x454f38
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x454f8c
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x454f51
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x454f8c
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x454f8c
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x454f51
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x458a50
Capabilities:
Encode data using xor

Disassembly:
push es
add edx, dword [ebp + 4]
or edx, dword [ebx]
and al, byte [ebx + 0x6f]
jo 0x458ad4
jb 0x458ac6
push 0x63282074
sub dword [eax], esp
xor dword [ecx], edi
cmp dword [edi], esi
and byte [ebp + 0x69], cl
arpl word [edx + 0x6f], si
jae 0x458ae0
je 0x458a94
inc ebx
outsd dx, dword [esi]
jb 0x458ae8
xor dword cs:[esi], ebx
xor byte [esi + eax], bl
add edx, dword [ebp + 4]
or edx, dword [ebx]
adc eax, 0x7263694d
outsd dx, dword [esi]
jae 0x458afa
je 0x458aae
inc ebx
outsd dx, dword [esi]
jb 0x458b02
outsd dx, dword [esi]
jb 0x458af6
popal
je 0x458b00
outsd dx, dword [esi]
outsb dx, byte [esi]
xor dword [ecx], esp
xor byte [edi], bl
push es
add edx, dword [ebp + 4]
add al, 3
invalid
sbb byte [ebp + 0x69], cl
arpl word [edx + 0x6f], si
jae 0x458b1a
je 0x458ace
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x458ad3
inc ecx
jne 0x458b2a
push 0x7469726f
jns 0x458aed
add byte [ecx], 0x22
xor byte [0x862a0906], cl
dec eax
xchg bh, dh
or eax, 0x5010101
add byte [ebx], al
add byte [ecx], 0xf
add byte [eax], dh
add byte [ecx], 0xa
xor byte [edx - 0x7dfdf5ff], al
add dword [ecx], eax
add byte [ecx + 0x70c1bd02], ch
out 0x3b, al
add al, byte [edx - 0x56fffeff]
add bh, byte [ebp + 0x3be670c1]
sal dword [eax - 0x1a], 0x3b
dec esi
sbb ebp, dword [eax]
lahf
xchg edi, eax
js 0x458b4a
xor dl, ch
mov byte [0x5f258da9], al
clc
invalid
ljmp 0xf85f:0x258da9a2
dec esp
mov dword [0xa29dfeb7], eax
and byte [esi], bh
jl 0x458b51
popfd
mov byte [0x517c3e20], al
mov byte [0x608fa29b], al
xor ch, byte [ebx - 0x2f]
inc edx
jns 0x458afa
mov byte [0x6b32608f], al
rol dword [edx + 0x64], 1
jns 0x458afa
lodsb al, byte [esi]
jbe 0x458ad8
push esp
invalid
mov bl, 0xc5
imul edi, dword [edx + 0x62], 0x23
salc
sbb eax, 0x10fde3c
xchg edx, eax
call 0x2e054fc2
lcall 0x9926, 0x689a
sar byte [edx], 1
mov edi, 0x9a9a662d
push 0x3ad09926
sub al, 0xbf
or al, 0xb5
pop eax
rol dword es:[esi - 0x19], 0xa
cmp byte ds:[esi + 0x3928a92c], dl
test al, 0xec
dec ecx
add dword [edx - 0x1d], 0xffffff84
jecxz 0x458ad0
btc dword [edx - 0x539eaa94], ebx
popal
lodsb al, byte [esi]
cmp byte [ecx + 0x60], 0x2d
ja 0x458ba6
jmp 0x3baa3ff8
cmp al, 0x56
call [ebx - 5]
movsb byte es:[edi], byte [esi]
or cl, byte [eax]
cmpsb byte [esi], byte es:[edi]
rol byte [ecx - 0x4910a8aa], cl
cmp ebx, dword [esi + 0x16]
xor dword [edi + 4], 0xaebef6da
adc byte [ebp + 0x7fcdb0fe], 0xd6
cmpsd dword [esi], dword es:[edi]
sbb dh, byte [edx + 0x5c]
cmp al, 0xca
mov esp, 0x22a308f0
xor byte [ebx - 0x4c367afa], dh
and byte [edi + 0x13], dh
test edi, ebx
add al, byte [ebx]
add dword [eax], eax
add dword [ebx - 0x7ecf577f], esp
movsd dword es:[edi], dword [esi]
xor byte [ecx + 0x550306a2], al
sbb eax, 0x9a810401
xor byte [ecx + 0x5b108097], al
sal byte [eax - 0x11], 1
imul esi, dword [edx - 0x62], 0x147e5123
mov dl, 0x4d
invalid
Function at 0x459480
Capabilities:
Encode data using base64

Disassembly:
dec dl
xchg dword [ecx], ecx
div byte [edi - 0x1e41e6ce]
loope 0x4594cc
loope 0x4594cc
push ecx
mov esp, 0x2cac7cbc
xchg ebp, eax
push 0xffffffffffffff97
jae 0x459477
jb 0x4594e6
mov eax, dword [0xd8868b9c]
wait
mov ebp, 0x3327fc4b
shr dword [ebp + 0x32], 0xac
loopne 0x459508
psllw mm1, mm0
jmp 0xff575f10
popfd
mov esp, 0x1030267
add eax, dword [ecx]
add byte [ecx], al
mov dword [0x8130f881], eax
cmc
xor byte [0x1d550306], bl
push cs
add al, 0x16
add al, 0x14
dec edi
sbb byte [ecx + 0xcad28a], cl
js 0x4594b4
in al, dx
pop ecx
or eax, 0xc47cfd0f
shl dword [edx], 0x80
fidiv word [eax]
pop ds
push es
add edx, dword [ebp + 0x1d]
and eax, dword [eax + ebx]
xor byte [esi], dl
adc byte [edi + ebp*2], 0xe8
dec esi
aas
xchg edi, eax
mov ecx, 0x864bab34

Function at 0x45db34
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4893c3
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x20]
call fcn.0045ca6d
and dword [esp + 0x30], 0
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0045e2d5
push esi
push dword [esi + 4]
lea ecx, [esp + 0x18]
call fcn.0045e9e6
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.0045e80f
test al, al
jne 0x45dbb5
push dword [esp + 0xc]
lea eax, [esp + 0x14]
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0045df10
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.0045e209
lea ecx, [esp + 0x1c]
call fcn.0045caa0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45dbe1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4893c3
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x20]
call fcn.0045ca6d
and dword [esp + 0x30], 0
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0045e2d5
push esi
push dword [esi + 4]
lea ecx, [esp + 0x1c]
call fcn.0045e9e6
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.0045e80f
test al, al
jne 0x45dc62
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push dword [esp + 0x10]
mov ecx, esi
push eax
call fcn.0045df10
lea ecx, [esp + 0x1c]
call fcn.0045caa0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45dc7e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4893a0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.0045ca6d
and dword [esp + 0x38], 0
lea edi, [ebp + 8]
lea ebx, [esp + 0x10]
call fcn.0045e18f
push esi
push dword [esi + 4]
lea ecx, [esp + 0x20]
call fcn.0045e9e6
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.0045e80f
test al, al
jne 0x45dcfb
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
mov ecx, esi
push eax
call fcn.0045df10
lea eax, [ebp + 8]
push eax
lea edi, [esp + 0x1c]
mov ebx, esi
call fcn.0045de58
lea ecx, [esp + 0x24]
call fcn.0045caa0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45dd28
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48937d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.0045ca6d
and dword [esp + 0x38], 0
push esi
lea ecx, [esp + 0x24]
call fcn.0045de18
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.0045e9e6
jmp 0x45dda9
lea ecx, [esp + 8]
call fcn.0045e7e9
mov edx, dword [ebp + 8]
mov ecx, dword [eax]
push dword [edx]
mov eax, dword [ecx]
call dword [eax]
lea ecx, [esp + 8]
call fcn.0045ea70
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x28]
lea ecx, [esp + 0x18]
call fcn.0045e9e6
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.0045e80f
test al, al
je 0x45dd8c
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.0045e519
lea ecx, [esp + 0x18]
call fcn.0045caa0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45ed97
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x482971
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea eax, [esp + 0xc]
push eax
call fcn.004995a7
add esp, 4
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.00490c67
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call dword [fcn.0048a314]
mov dword [esi], 0x48a880
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret