joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d8af6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x40]
neg dword [esp + 0x2c]
jae 0x8542df
test word [esp + 0x30], 0x6d90
ja 0x9bc991
add edi, eax
jmp 0xa207f1
lea ecx, [ecx + ecx*4 + 0x14647a0d]
push ecx
xor byte [esp + 8], 0x21
jle 0xa945b9
cmp dword [esp], edi
push ecx
mov edi, dword [esp + 0x18]
mov dword [esp + 0x18], 0xd3a1d3d5
push ecx
not dword [esp + 0x10]
jo 0x8805bf
inc dl
not dl
movzx ax, bl
mov ax, di
rol dl, 1
btc ax, 0xf1
adc eax, 0x7d8072ae
xor bl, dl
shl ax, 0xdd
sal eax, cl
rcl eax, 0xd8
mov word [esp + edx], cx
cmp dh, 0x1c
mov eax, dword [ebp]
lea ebp, [ebp + 4]
stc
cmp al, 0xb2
cmp di, si
xor eax, ebx
cmc
neg eax
jmp 0xa52e9d
push ecx
sub word [esp + 0x14], 0x86f
and word [esp + 8], 0x3cd8
test dword [esp + 0xc], 0xe216dc9
call fcn.00b4c0cd
test cx, bp
neg ecx
ror ecx, 1
test ecx, 0x43ee5b2e
stc
cmp di, bx
xor ebx, ecx
cmp sp, bx
add esi, ecx
jmp 0xa3f79e
jmp edi
ror eax, 2
clc
stc
sub eax, 0x6da00fc6
ror eax, 1
cmc
test edx, edx
add eax, 0x43b71038
cmc
ror eax, 1
bswap eax
jmp 0x9c65e3
mov dword [esp + 0x30], 0x41ed0370
xor dword [esp + 0x3c], 0x66c17648
xor word [esp + 0x2c], 0x23e
or word [esp + 0x10], 0x1336
sete byte [esp + 0x10]
xor byte [esp + 0x3c], 0xcf
je 0xa94590
add dword [esp + 0x34], 0x68140598
and dword [esp + 0x10], 0x4eb57546
sete byte [esp + 0x2c]
and dword [esp + 0x3c], 0x4b647b6f
not dword [esp + 0x10]
mov dword [esp + 0x28], 0x2f2256e6
neg dword [esp + 0x3c]
and dword [esp + 0x14], 0x796f77ea
sub word [esp + 0x3c], 0x6e77
and word [esp + 0x34], 0x44a0
sub dword [esp + 0x14], 0x633a11b8
add dword [esp + 0x2c], 0x1682669c
cmp dword [esp + 0x34], 0x7e8327fd
push dword [esp + 0x44]
and al, 0x14
mov eax, 0x81633a11
inc esp
and al, 0x2c
pushfd
adc byte [esi], 0x81
jl 0x9bca39
xor al, 0xfd
daa
cmp dword [esi - 1], 0x74
and al, 0x44
popfd
lea esp, [esp + 0x48]
call fcn.00a50d5b
inc ebx
or dword [eax], eax
add byte [esi], dh
jp 0x9bca53
jp 0x9bca53
or ebx, dword [esi + 0x5bec8c31]
jl 0x9bca25
cmp al, 0x30
and al, 0x4a
dec esi
sbb al, 0xcb
sbb al, 0xcb
out 0xe6, eax
push cs
leave
mov ebx, 0x33a463fe
push 0xffffffffffffffdd
cmp ah, byte [esi]
stosd dword es:[edi], eax
rcr byte [edx - 0x5c], 0xfa
cmp esp, ebp
je 0x9bca04
salc
je 0x9bca27
rcl byte [esp + eax]
out dx, al
mov ebx, 0xe6b6f7ff
hlt
xor ebx, eax
cmc
stc
test esp, ebx
add edi, eax
jmp 0x886107
push edi
ret
jmp esi
add eax, 0x41a35904
clc
jmp 0x8a3c46
xor word [esp + 0x20], cx
mov word [esp + 0x28], 0x79b8
add dword [esp + 0x14], 0xff88883a
neg dword [esp + 0x20]
add dword [esp + 0x2c], ecx
mov edx, ecx
add dword [esp + 0x18], 0xff86d72e
movsx ecx, dl
pop edx
and dword [esp], ecx
sub word [esp + 0x24], cx
neg dword [esp + 0x28]
call fcn.00b5b2ad
add ebp, eax
jmp 0xafee6b
jmp fcn.00acd0fc
Function at 0x7de3f0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x7de552
cmp edi, esi
je 0x7de552
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x7de542
add edi, 4
jmp 0x7de4a3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x7de4b8
mov dword [ebp - 4], 2
jmp 0x7de4d9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x7de4cf
mov dword [ebp - 4], 1
jmp 0x7de4d9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x7de552
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x7de510
mov byte [ecx + 2], 0x3d
jmp 0x7de51d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x7de52c
mov byte [ecx], 0x3d
jmp 0x7de532
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x7de4a0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x9a2141
Capabilities:
Encode data using xor

Disassembly:
dec ecx
jmp 0x9241e9
add byte [eax], al
add cl, ch
or dh, bl
sub al, byte [eax]
neg ebx
call fcn.009bb9f5
call fcn.0082db34
jmp 0xadd9c5
or dword [esp], 0x70ad6c9f
mov esi, dword [esp]
push edx
push 0x18d614e6
test byte [esp + 8], 0x64
push 0x5a4c6321
call fcn.0098920a
cmp edi, edx
adc byte [ecx + 0x20], bh
fdivr dword [eax]
lock xor byte [ebx - 0x78020c59], 0x2c
and bh, dl
fnstsw word [edi - 0x35]
jg 0x82fbb8
inc eax
xchg esp, esi
out 0x42, eax
push ebx
jbe 0x82fc1d
int 0xbb
js 0x82fc6c
mov al, byte [0xbb8621a2]
push ss
or eax, 0x12227367
and ecx, dword [edx - 0x1d729def]
push ss
loop 0x82fc35
dec edx
jp 0x82fc20
wait
adc dword [ecx - 0x61], esi
jnp 0x82fc77
pop eax
add byte [eax + 0x659cbc8c], cl
push 0xffffffffffffffee
js 0x82fbb5
inc esi
jns 0x82fc96
jns 0x82fc96
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
adc dword [edx + 0x6b], ecx
mov esi, 0xdc553079
ljmp 0xf6f6
push ecx
inc ebp
add byte [edi + 0x5b], al
mov ch, 0x69
pushfd
test eax, 0x4d806fe0
add eax, 0xaec1d8a0
or byte [ebp + 5], 0xa0
fadd st(1)
scasb al, byte es:[edi]
pushal
in eax, dx
mov ds, edx
cwde
or al, 0x84
in al, dx
fdivr st(3), st(0)
je 0x82fc0d
cmp ch, dh
xchg edx, eax
fadd st(7)
fst qword [0xb72f87e6]
sub ebp, ecx
ficom dword [ebx]
test byte [edi - 0x3c], dl
jb 0x82fca6
jmp 0x58071075
iretd
add ecx, edi
loop 0x82fd29
sti
cld
out dx, al
int1
xor byte [edx + ebx*4], ah
add esi, dword [edx - 0x3e7f126]
not dword [esi - 0x42dfb24b]
sbb eax, dword [esi + ebp*4]
sahf
insd dword es:[edi], dx
pushal
cmp dword [ebx], 0xfffffff8
pop ecx
scasb al, byte es:[edi]
enter 0x31c3, 0xffffffffffffffe6
int1
loopne 0x82fc80
sti
mov dword [0x4d11f13b], eax
xor al, al
test al, 0xc9
mov ch, dh
invalid
add esp, esi
mov dword [0xf5540a69], eax
mov esi, 0x17f5e1a6
loope 0x82fd20
pop ss
cmc
pop esp
xor dword [edi - 5], edx
iretd
inc ecx
push esp
inc ebp
bsr esp, edx
inc ebp
cmp esi, esp
xor dword [esp], ecx
inc ebp
or ah, bh
inc ecx
pop esp
inc ecx
test edx, ebx
dec eax
arpl cx, cx
cmc
inc esp
test ch, ch
jmp 0x9f9176
inc ecx
push eax
ret
movzx si, word [esp + 0x12]
js 0xa7fce3
push ebp
xor byte [esp + 0x14], 0xe5
xor dx, word [esp + 0x16]
push 0x2f2a1ce8
jae 0x82fbc9
not ecx
jmp 0x81a40d
dec esp
add eax, ecx
jmp 0x93cc11
xor edx, ebx
ror edx, 3
dec edx
cmc
stc
bswap edx
stc
ror edx, 3
xor ebx, edx
cmp ecx, esi
test ch, 0x1a
add ebp, edx
jmp 0xb3e334
jmp fcn.008db7e3
Function at 0x9a8e88
Capabilities:
Encode data using xor

Disassembly:
push esi
and esi, 0x536d3aa7
mov byte [esp], 3
not dword [esp + 0x10]
movsx ecx, si
cmp byte [esp + 0x2c], 1
mov byte [esp + 0x10], dl
js 0xb0abb5
dec ecx
sub ecx, 2
rcr cx, 0xd4
ror cl, cl
inc ecx
movzx ecx, word [ecx]
inc cx
xor ecx, esp
dec eax
arpl bp, bp
inc eax
sub ch, 0x85
inc eax
dec ch
neg cx
movzx bp, dl
inc ecx
mov ch, ch
dec cx
dec eax
arpl bp, bp
not cx
inc eax
seta ch
inc cx
movzx ebp, dh
inc cx
inc sp
xor esp, ecx
bswap ebp
dec ecx
sub edx, 2
cmc
inc cx
mov dword [edx], ecx
dec ecx
sub ecx, 4
bt bp, di
rol bp, cl
bt bp, 0x8f
inc ecx
mov ebp, dword [ecx]
jmp 0x976ad6
jmp fcn.008768c6
bswap ebp
jmp 0xb4b81d
inc ecx
xor ebp, esp
rol ebp, 1
stc
cmp dx, 0x5d89
test ah, bl
sub ebp, 0x6ce4662b
jmp 0x94de52
push ebp
movsx edx, cx
bswap esi
mov si, word [esp + 8]
mov ebp, ecx
jbe 0xb31051
cmovs ebp, esi
xor esi, esi
sub ebp, esi
push edi
jno 0x86fd8b
jmp fcn.00a7d0ae
mov ebp, dword [esp + 8]
mov edi, dword [esp + 4]
lea esp, [esp + 0xc]
ret 4
push ebx
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
add dword [esp + 0x18], 0xffe8aa0f
add dword [esp + 0x10], 0x24fdfc
xor cl, byte [esp + 0x17]
lea ebx, [ebx + 0x4a8c4738]
mov edi, edx
xor di, 0x60bb
cmp word [esp + 0x14], dx
pop ebx
je 0xa059ec
push edx
mov edx, 0xdf91022
pushfd
or dx, dx
xor edx, edx
push ebp
mov ebp, 0x696a6962
mov ebp, 0x598e4c9a
push edx
push ecx
sub dword [esp + 4], 0x11124ac7
or word [esp + 4], 0x2cfd
neg word [esp + 4]
push ebp
push edi
mov ecx, 0x13021a28
xor edx, 0x2d881004
add byte [esp + 0xc], 0x13
push 0x616d1fb6
cmp byte [esp], ch
push edx
push ebx
jbe 0xb0abf1
movsx edx, word [esp + 0x10]
push 0x619b38ce
mov edx, dword [esp + 0x28]
mov dword [esp + 0x28], 0xcac23abc
mov cl, ch
not word [esp + 0x14]
mov word [esp + 0x1c], cx
mov edi, ebp
lea ebp, [edi + ecx*2 + 0x70665c06]
push ecx
push ebp
sub dword [esp + 4], 0x3f2112d8
push ecx
sub dword [esp + 0x18], 0x3a190c3f
mov ebx, ebp
or word [esp], 0x686d
jb 0xb0ac40
push edi
not byte [esp + 4]
neg edi
call fcn.00af10af
das
jl 0xb0ad13
invalid
invalid
inc ebp
inc cx
test ebp, esp
test bp, 0x6c78
clc
inc ecx
push esp
test ch, 0xbc
inc ecx
shr ah, 0xc5
inc bp
xor esp, edi
xor dword [esp], ebp
inc ecx
pop esp
inc esp
test bl, bl
dec eax
arpl bp, bp
inc ecx
test dl, 0x85
dec esp
add eax, ebp
jmp 0x8ccadd

Function at 0x9b460a
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp*8 + 0x3b355631]
not ebx
call fcn.009374e3
scasb al, byte es:[edi]
dec ecx
and byte [edx + 0x63fabf11], 0xb2
pop es
cmp edi, eax
dec edi
pop ebp
adc ah, byte [ebx - 0x38]
lcall 0xf260, 0x62befb2d
mov bh, 0x10
cld
jne 0x9b4672
cmp eax, 0xa962a70d
lodsd eax, dword [esi]
or eax, 0xada962a7
cwde
jmp 0x507dcbb4
arpl word [eax], dx
dec ebx
sbb eax, 0x99b6efc5
or eax, 0x13a80299
xor eax, 0x1cbb44b2
cmc
jb 0x9b4634
fnstsw word [edi]
invalid

Function at 0x9b8ae3
Capabilities:
Encode data using xor

Disassembly:
jle 0x923890
sub edx, edx
call fcn.008a45b4
sbb eax, 0xb55ad024
or dl, dl
adc al, 0xa
invalid
Function at 0x9de178
Capabilities:
Encode data using xor

Disassembly:
call fcn.007e8f60
sub eax, 0x58bb8b5
jp 0x9de1c7
jl 0x9de161
aaa
xor ebx, 0xddb9a4a0
int1
mov word [ebx - 0xc], cs
adc eax, 0xd3b59c1
or byte [ebx - 0x5d], ch
in al, 1
xchg esi, eax
cmc
mov dh, 0x2b
or eax, ecx
imul ebp, dword [edx - 0x45], 0x7e
dec edi
movsb byte es:[edi], byte [esi]
mov ecx, 0x4b8cf1dd
hlt
pop ecx
cmp ecx, dword [0xe4a36b08]
add dword [esi + 0xb2bb6f5], edx
shr dword [ebx + 0x6a], 0xbb
jle 0x9de1f5
jge 0x9de1ee
hlt
cmp ebx, ebx
xchg esp, eax
in al, 0xcd
cmp eax, 0x2c3b63e9
mov esp, 0x17747679
nop
daa
mov dl, 0x24
pop ebp
xor edx, dword [edi + 0x3f8b5b6e]
xchg ebp, eax
inc edx
mov ah, 0x16
push ss
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
xchg edi, eax
invalid
insd dword es:[edi], dx
sbb ecx, dword [ebx]
push esp
xchg ecx, eax
js 0x9de1aa
leave
mov ebx, 0x444a40f
cmp eax, 0x1b0b8819
dec edi
adc dword [esp + ebx], ebp
cwde
dec edx
mov dl, 0xd8
jecxz 0x9de23f
mov edx, 0x7d10fa38
aam 0xe3
sbb al, 0x72
jno 0x9de193
adc byte [ebp - 0x2c], bh
jecxz 0x9de20f
jb 0x9de266
popfd
adc byte [esi + ebx*2 - 0x78f4ba67], cl
jo 0x9de1cf
jl 0x9de18a
das
int3
and al, byte [edi - 0x6d84c856]
inc esi
out dx, al
and edi, ebx
mov dword [ecx - 0x4f7b2a74], ecx
invalid
aas
mov ebx, 0xcb2c7ad4
inc esp
invalid
pop esi
rol dword [edx + esi + 0x2dd95cb7], cl
pop edx
fdiv qword [esi + ebp*4]
mov dh, 0x56
dec edx
neg dword [esi - 0x1d2508b9]
rcr esp, 1
add dword [esi + 0x34b04e81], 0xfffffffa
dec byte [eax]
sub al, 0x36
salc
adc dword [0x61030674], eax
in al, dx
mov ecx, 0x30bef9ac
inc edi
xor ch, ah
jno 0x9de275
sub byte [eax + esi - 0x4561c01f], 0x1c
scasb al, byte es:[edi]
cmp byte [edx], bh
sbb al, 0xce
mov esi, 0x392e34cc
popal
and eax, 0x2e2cbe85
mov eax, dword cs:[0x6c7ee8e0]
or dl, byte [eax + 0x34]
add dword [edx], esi
jbe 0x9de312
sbb dh, ch
pop edi
scasb al, byte es:[edi]
invalid
rol byte [ecx + eax*4 - 0x4c8184a], cl
xchg edi, eax
sub bl, al
adc eax, 0xdc3298fb
mov byte [ebp + edi*8 - 0x3c], 0xb9
into
test ch, dh
sti
daa
salc
add al, 0x26
stosb byte es:[edi], al
sal byte [ebx + edi], cl
loope 0x9de36f
dec edx
cmp byte [ebx - 0x33ed34cf], bh
inc esp
mov ch, 0x74
dec ebp
sub bh, byte [ebx + 0xd]
jnp 0x9de34f
std
or dword [esi], edi
sti
mov dl, 0x6b
enter 0x384, 0x44
sub eax, 0x1a42b1fb
psubq mm1, qword [edx + 0x44dc0508]
fistp qword [edx]
sti
mov cl, 0x42
sbb cl, byte [edi]
sti
mov cl, byte [eax]
add eax, 0x3adf44dc
add ebx, ebx
sub eax, 0xacd05ef0
mov ebx, 0x4cc811e2
les esp, [esi]
loop 0x9de377
enter 0xffffffffffffc44c, 0x26
mov bh, 0x1a
pop esp
ror byte [eax], 1
test ebp, ebp
sbb dword [ecx], 0x19
adc eax, 0x5b2ccf8
mov dl, 5
dec ebx
cmp al, 0x9c
enter 0xfffffffffffffb86, 0xffffffffffffffe0
jecxz 0x9de340
xchg bl, bh
loopne 0x9de364
mov esi, 0xcccf9e2
dec ebx
pop edx
leave
sbb dword [edx + eax*2 + 0x67], edi
arpl bx, sp
mov dword [0xf6fd81ee], eax
insb byte es:[edi], dx
pushfd
arpl word ds:[edx], bp
cld
add dword [eax + 0x75], eax
push es
mov bl, 0x66
lodsb al, byte [esi]
rcl esp, cl
mov dword [0x23e11a5a], eax
jl 0x9de3b5
loop 0x9de37d
int3
sub esi, dword [ecx + 0x36]
xor eax, dword [eax]
out dx, eax
das
arpl word [edx], sp
dec esp
lahf
sbb al, 0xf4
invalid
Function at 0xa04c6e
Capabilities:
Execute syscall

Disassembly:
not dword [esp + 0x14]
call fcn.009bf191
syscall
push ebx
pushfd
dec eax
mov ebx, 0x46d912e0
in eax, 0x65
ret
lea ecx, [ecx*8 + 0x29b87e05]
jg 0x7dcf06
lea esi, [esi + 0x50ed4742]
call int.0088bc79

Function at 0xa1eee0
Capabilities:
Encode data using xor

Disassembly:
not byte [esp + 0xc]
neg edi
sub word [esp + 0xc], 0x4559
add byte [esp + 0xc], 0x45
test byte [esp + 4], 0x84
jb 0xa1eef2
add ecx, 0xd12320d
test edi, edi
mov ecx, dword [esp + 0x10]
setae byte [esp + 0xc]
add dword [esp], 0xd6242
call fcn.00a750c6
inc ecx
xchg esp, eax
pop ecx
or byte [esi - 0x70], bl
mov byte [0x59407dcd], al
push ecx
std
xchg esp, eax
invalid

Function at 0xa96ea8
Capabilities:
Encode data using xor

Disassembly:
xor ebx, ecx
cmp eax, edi
clc
add edi, ecx
push edi
ret
test bl, 0x58
seta bl
test cl, bl
cmovle ecx, dword [esp + 0x30]
add ecx, ecx
not bl
lea ecx, [ecx + ebx*4 + 0x34a8453c]
lea ebx, [ebx + ecx*8 + 0x3ce16f84]
call fcn.00a13b7a
sets bl
je 0x9e94fd
mov ecx, dword [esi]
xadd ax, ax
mov ax, word ss:[ecx]
xadd ch, cl
test cl, 0xe9
bts cx, dx
add esi, 2
mov word [esi], ax
bt cx, si
bsr ecx, ecx
lea ebp, [ebp - 4]
mov ecx, dword [ebp]
jmp 0xb05de0
xor ecx, ebx
stc
xor ecx, 0x631c1a30
test edi, ebp
stc
cmc
not ecx
cmp di, dx
clc
neg ecx
clc
ror ecx, 1
jmp 0x8a0144

Function at 0xaff27f
Capabilities:
Encode data using xor

Disassembly:
sub word [esp + 0x24], 0x79f1
setne byte [esp + 0x28]
mov dword [esp + 0x20], 0x7f72023f
xor dword [esp + 0x18], ebx
lea ebx, [edx*2 + 0x6b157c4d]
jbe 0xa77e22
call fcn.00b13eac
mov esp, esi
sbb bx, bp
pop esi
pop ebx
xor cx, si
popfd
movzx eax, di
pop edx
cmovne bp, di
xchg ah, ah
bswap ecx
pop ecx
lahf
movsx eax, sp
pop edi
movzx eax, di
movsx ebp, dx
xchg ebp, ebp
pop eax
movsx ebp, cx
pop ebp
ret
add dword [esp + 0x28], 0x78e37eba
push 0x6c8033fc
add dword [esp + 0x28], 0x229d30
neg dword [esp + 0xc]
movsx bp, word [esp + 0x10]
jle 0x913ad9
neg cx
mov word [esp + 8], di
neg dword [esp]
cmp dword [esp], 0x49567e87
mov edi, dword [esp + 0x14]
call fcn.00b35e5a
Function at 0xbeeeed
Capabilities:
Parse pe header

Disassembly:
jae 0xd4a25e
mov esi, dword [edx + ecx + 0x1c]
lea eax, [esi + eax*4]
cmp ch, 0xe8
jmp 0xb827c4
mov ecx, esi
clc
sub ecx, eax
cmp edi, 0x33284ab6
cmp ecx, 0x104
jae 0xd4a25e
sub edi, edi
test si, dx
test ecx, ecx
je 0x115ab8e
lea ebx, [ebp - 0x114]
setae dl
sub ebx, eax
sar dl, 0xcc
mov dl, byte [eax]
test si, 0x1214
cmp cl, 0xa3
test dl, dl
jmp 0xc9c0c3
mov eax, dword [eax + ecx]
cmp ax, 0x5ec8
test eax, eax
jmp 0xbb89d1
je 0xd4a25e
cmp cl, 0x2e
je 0xb801a2
mov cl, byte [esi + 1]
jmp 0x1192066
inc edi
jmp 0xcdb482
je 0xd4a25e
cmp eax, edx
jmp 0xc461ea
push ebp
mov ebp, esp
add ch, cl
mov ecx, dword [ebp + 8]
cmc
sub esp, 0x114
push esi
jmp 0xcdf5ef
test esi, esi
jmp 0xd0797b
jb 0x117fd30
mov esi, dword [ebp - 0x10]
add esi, edx
cmp ebp, 0x2bfb5fa9
stc
cmp eax, esi
jmp 0xd7fcb3
je 0xd07994
mov esi, dword [ebp + 0xc]
clc
jmp 0xbf2987
mov eax, dword [ebp - 8]
cmp eax, dword [edx + ecx + 0x14]
jmp 0xb7706f
je 0x115ab8e
mov byte [ebx + eax], dl
jmp 0xbab881
ja 0xd4df74
mov eax, esi
sub eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jmp 0xd5ef28
je 0xd07994
mov eax, dword [eax + ecx + 0x7c]
clc
push ebx
push edi
stc
cmc
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
cmc
cmp esi, 0xffff
jmp 0xca63a9
inc eax
stc
cmp edi, ecx
jmp 0x115ab88
test ecx, ecx
jmp 0xc62126
mov esp, ebp
pop ebp
ret
ret
je 0xd07994
mov eax, 0x5a4d
stc
cmp bx, bp
cmc
cmp word [ecx], ax
je 0xd0b561
sub eax, eax
mov si, di
pop esi
jmp 0xd6bf3d
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0xd07994
mov edx, dword [eax + ecx + 0x78]
mov dword [ebp - 4], edx
test bx, 0x595a
test edx, edx
jmp 0xcaaf68
pop edi
shr bx, cl
mov bh, 0xeb
bts bx, ax
pop ebx
cmc
xor si, bx
xor eax, eax
pop esi
jmp 0xce790e
mov edi, dword [edx + ecx + 0x18]
test bp, bx
cmp esp, ecx
test ax, 0x60ae
test edi, edi
jmp 0x11838e8
jmp 0xc665b2
mov esp, ebp
pop ebp
jmp 0xcfb4c3
jae 0x117fd30
add eax, ecx
and esi, 0x3d742f70
btr esi, ecx
mov cl, byte [eax]
bts si, di
mov esi, eax
test ecx, 0x5f995a25
test cl, cl
jmp 0xbaad9d
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406054], 1
mov dword [0x406050], 1
mov dword [0x40604c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40600c], eax
mov eax, dword [0x406060]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40605c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x403030], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4014f0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401549
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x4017c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401820
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406068]
test esi, esi
jle 0x401940
mov eax, dword [0x40606c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401854
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4018d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401840
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401967
mov eax, dword [0x40606c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40606c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401947
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4018d0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4018e0
add dword [0x406068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40606c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4018d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40185e
mov eax, dword [0x40606c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401e80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40607c]
sub esp, 4
test ebx, ebx
je 0x401ed5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401ece
test esi, esi
je 0x401ece
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401eb0
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401000
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, dword [ebp + 8]
push 0x32
lea eax, [ebp - 0x38]
push eax
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x401053
lea eax, [ebp - 4]
lea ecx, [ebp - 0x38]
push eax
push 0xf003f
push 0
push ecx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401045
lea eax, [ebp - 4]
push eax
call section..text
add esp, 4
lea eax, [ebp - 0x38]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40100a
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret