joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4365f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x3c3d3e3f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43666e
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0xd7
sub edx, eax
add eax, 0x6cb96f28
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
add al, 0xe8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x436630
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [0x441028]
test edx, edx
je 0x4366c8
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x44102c]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xd75bc899
je 0x4366a0
inc edi
cmp edx, edi
jne 0x436690
jmp 0x4366c8
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x4366c8
lea eax, [esp + 8]
lea edi, [esp + 0x24]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x441030]
push edx
call fcn.00433e50
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x4366d5
mov edx, dword [esp + 0x10]
mov dword [esi], edx
test ecx, ecx
je 0x4366e1
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4366f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0x3c3d3e3f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x436769
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0xd7
sub edx, eax
add eax, 0x6cb96f28
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
add al, 0xe8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x436730
mov eax, dword [esp + 8]
mov edi, dword [0x441028]
test edi, edi
je 0x4367cd
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x44102c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0x47a01aa3
je 0x4367a0
inc ebx
cmp edi, ebx
jne 0x436790
jmp 0x4367cd
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x4367cd
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x441030]
push edi
call fcn.00433e50
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x4368b2
mov dword [esp + 8], 0x3c3d3e3f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43684c
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0xd7
sub edx, eax
add eax, 0x6cb96f28
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp], edx
mov eax, dword [esp]
add al, 0xe8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x436810
mov eax, dword [esp + 8]
mov ecx, dword [0x441028]
test ecx, ecx
je 0x4368aa
xor edx, edx
mov ebx, dword [0x44102c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x39c83604
je 0x43688a
mov esi, edx
xor esi, 1
and edx, 1
lea edx, [esi + edx*2]
cmp edx, ecx
jb 0x436870
jmp 0x4368aa
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x4368aa
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x441030]
push ecx
call fcn.00433e50
add esp, 0x18
test eax, eax
js 0x4368b2
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x4368c5
xor ecx, ecx
cmp eax, 0xc0000011
je 0x4368c3
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4368d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0x3c3d3e3f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x436949
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0xd7
sub edx, eax
add eax, 0x6cb96f28
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
add al, 0xe8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x436910
mov eax, dword [esp + 8]
mov edi, dword [0x441028]
test edi, edi
je 0x4369ad
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x44102c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0xa1e50e2a
je 0x436980
inc ebx
cmp edi, ebx
jne 0x436970
jmp 0x4369ad
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x4369ad
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x441030]
push edi
call fcn.00433e50
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x436a92
mov dword [esp + 8], 0x3c3d3e3f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x436a2c
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0xd7
sub edx, eax
add eax, 0x6cb96f28
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp], edx
mov eax, dword [esp]
add al, 0xe8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x4369f0
mov eax, dword [esp + 8]
mov ecx, dword [0x441028]
test ecx, ecx
je 0x436a8a
xor edx, edx
mov ebx, dword [0x44102c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x39c83604
je 0x436a6a
mov esi, edx
xor esi, 1
and edx, 1
lea edx, [esi + edx*2]
cmp edx, ecx
jb 0x436a50
jmp 0x436a8a
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x436a8a
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x441030]
push ecx
call fcn.00433e50
add esp, 0x18
test eax, eax
js 0x436a92
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x436a9c
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x436ad0
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 4], bx
add ebx, 2
mov word [esp + 6], bx
mov dword [esp + 8], edi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0x3c3d3e3f
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x436b89
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edi, 0xd7
sub edi, eax
add eax, 0x6cb96f28
xor edi, eax
and edi, ecx
xor edi, eax
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0xc]
add al, 0xe8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x436b50
mov eax, dword [esp + 0x10]
mov edi, dword [0x441028]
test edi, edi
je 0x436bd3
xor ebx, ebx
mov ecx, dword [0x44102c]
nop
cmp dword [ecx + ebx*8], 0x55708665
je 0x436bb0
inc ebx
cmp edi, ebx
jne 0x436ba0
jmp 0x436bd3
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, eax
je 0x436bd3
lea eax, [esp + 0x24]
push esi
push eax
push edx
push dword [ebp + 0xc]
push 4
push dword [0x441030]
push ecx
call fcn.00433e50
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xcb8bd5
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe4338b
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
mov edx, 0xebb7ffb3
mov dword [ebp], eax
mov ebx, 0x90b73f95

Function at 0xcc01cf
Capabilities:
Get number of processors

Disassembly:
lea esp, [esp + 8]
je 0x19ff407
mov eax, 0xa3b72d85
mov eax, dword [ebp + ebx*4]
call fcn.019ff3e5
call fcn.00ed0a0a
mov eax, 0xaa063430
mov eax, dword [ebp]
jmp 0xf659a6

Function at 0xcc2ab9
Capabilities:
Encode data using xor

Disassembly:
sub edi, 2
mov word [edi], ax
push edx
movsx eax, dl
sub esi, 4
call fcn.0190e956
mov bh, 0xa
mov esi, 0x4ee81c2
add byte [eax], al
add al, ch
test dword [esi - 0x48d1ff3c], edi
or al, byte [edi + 0x4f]
mov bh, 0xa
inc edi
dec edi
sub esi, dword [esp + edx]
xor edx, dword [edx]
xor byte [ebp - 0x1e], 0xcc
jge 0xcc2ad2
mov esi, 0x2ac733b7
shl byte [ebp + 0x2ce3cc33], 1
xor edx, dword [ebp + 0x61]
salc
aad 0x21
xor ebx, edi
dec esp
jge 0xcc2ac4
pop ebp
mov eax, dword [0x8acc75c2]
in al, dx
xchg ecx, eax
xor ebx, dword [edi - 0x61]
salc
lea ebp, [ebp - 0x34]
bound ebp, qword [edx + eax*8 + 0x4695afcc]
imul ebp, ebx, 0xb3d52d85
pop ds
dec edx
mov dh, cl
out 0xc1, al
dec ebp
enter 0x50fd, 0x5e
pop ebp
cmp esi, dword [ecx + 0x32]
inc ecx
jecxz 0xcc2b1b
jb 0xcc2b98
cdq
pushfd
imul eax, edx, 0xfffffffd
and edx, ecx
call 0xec23f34b
invalid
and dh, byte [edi + ebp - 0x73]
cmpsd dword [esi], dword es:[edi]
dec esi
aam 0xf6
sub edx, dword [esi + 8]
inc eax
test eax, 0x177d166d
imul edx, dword [ebp + 0x38], 0xb60c8cb3
push edx
pop edi
mov dh, byte [eax - 0x669987f8]
add eax, 0x7671ba31
aas
lodsb al, byte [esi]
dec esi
push eax
jbe 0xcc2ba3
xchg byte [edi - 0x1f], al
xor byte [eax - 0x26], al
mov ebx, 0x9205612d
push esi
pop ds
aas
jle 0xcc2bac
xchg dword [ebp + ecx - 0x40], ebx
push ss
jns 0xcc2b5d
adc bh, cl
nop
mov gs, word [eax]
mov esp, 0xba6ca3db
jg 0xcc2bc8
mov edx, 0xf3b82d7f
lodsd eax, dword [esi]
test al, 0xf6
mov eax, 0xf6a8adf3
aam 0xab
scasd eax, dword es:[edi]
mov esi, 0x186bf698
loopne 0xcc2b4b
mov ecx, ebp
int 0x17
mov bl, 0x8b
pushal
pop ss
and eax, 0xc58ac308
scasb al, byte es:[edi]
adc ah, dh
jle 0xcc2bac
jmp 0x8c7f437e
xchg ebx, eax
xor eax, 0xa294b88d
sbb byte [edx - 0x1c4e17b6], dl
inc ebx
jecxz 0xcc2c0d
in al, dx
iretd
invalid
Function at 0xcd05c0
Capabilities:
Encode data using xor

Disassembly:
not ecx
add edi, 2
mov dword [esp], ecx
add al, dl
sal word [esp], 0x26
shl byte [esp + 2], 0x43
lea edx, [ecx*2 + 0x412eed8c]
mov word [edi], ax
and dword [esp], 0x29a9a294
lea eax, [ecx + edx*8 + 0x45a6a72f]
mov ecx, dword [eax + ebp - 0x1310b905]
lea ebp, [eax + ebp - 0x1310b901]
setbe dl
lea eax, [eax*8 - 0x47f2a549]
xchg dword [esp + eax - 0x509322df], edx
xor ecx, ebx
pop edx
call fcn.00d2fb1f
inc cx
mov dword [esp], esi
inc esp
mov eax, dword [edi]
dec eax
or dword [esp], 0x90276113
nop
dec eax
adc edi, 4
inc ebp
xor eax, ebp
inc ecx
sub eax, 0xcb4f724
inc ecx
bswap eax
inc ecx
neg eax
mov ecx, 0x97be439a
add dword [esp + 3], ecx
inc ebp
lea eax, [eax + ecx*2 - 0x4a68f583]
jnp 0x1a294a9
stosd dword es:[edi], eax
cmp dword [eax], esi
fdivr st(0), st(0)
jl 0xcd0625
mov eax, dword [0xd372fe8d]
inc esi
xor ebp, dword [ebp + 0x5ab20ed8]
push ecx
lea esi, [edx + 5]
xor al, bh
inc ecx
mov eax, 0x14a1b215
jp 0xcd0667
inc ebp
pop esp
enter 0xffffffffffffcc87, 0xffffffffffffffae
xchg esp, eax
invalid
xor eax, ebx
xor dword [esp + edx - 0x19bfdb91], edx
neg word [esp + edx - 0x19bfdb8f]
xor eax, 0x23821b04
sub edx, edx
not eax
neg cx
xor byte [esp + edx*4], 0x13
xor cl, cl
lea eax, [edx + eax - 0x1f0eabbb]
ror eax, 1
inc eax
add cl, byte [esp + edx*8 + 1]
sub word [esp + edx*8 + 2], cx
xor ebx, eax
bswap ecx
add ebp, eax
jmp 0xdcb780
mov ebx, dword [esp + 0x1c]
jmp 0xdbe8ba
push esi
pushfd
mov esi, 0x21ec520
mov esi, dword [esp + esi - 0x21ec51c]
mov dword [esp + 4], 0x1aa1328d
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00d49bb7
lea esi, [eax - 0x75f6a3e8]
mov eax, dword [esp + ebx - 0xa7]
mov esi, dword [esp + ebx*4 - 0x2d4]
lea ebx, [ebx + ebx*8 - 0x75c5d5e5]
jmp 0x178414e
or word [esp + 1], cx
shl dword [esp + 4], 0xd9
dec esp
mov dword [esp], ebp
inc esp
movsx edx, cx
inc ebp
movsx esi, dx
push ecx
inc esi
xor dword [esp + edx - 0x4392], eax
call fcn.00de3c12
jno 0x1a294d5
mov dl, 0xd7
and byte es:[ebp + edi*8 - 0x82cccf3], 0xd2
or eax, 0xd2f7d333
push 0x1a8393b9
ror edx, 1
not edx
add dword [esp + 3], 0xaa19d3be
sub edx, 0xbabf00a7
ror edx, 1
mov eax, dword [esp + 2]
bswap edx
mov byte [esp + eax - 0x6985d881], ah
neg edx
call fcn.00f54dcc
mov eax, 0xa29cd10d
shl ax, 0x21
jae 0xe0af16
movzx ax, byte [esi]
mov ecx, 0xce110029
push ecx
mov edx, 0x493a1e00
mov cl, byte [edx + esi - 0x493a1dfe]
neg dl
sar dword [esp + edx - 0x493a1e00], 0xca
lea esi, [esi + edx - 0x493a1dfe]
xchg word [esp + edx - 0x493a1dff], dx
sar word [esp + edx - 0x493af382], 0x8f
shr edx, 0x21
shr al, cl
mov ecx, 0x314161f
add dl, byte [esp + ecx*2 - 0x6282c3d]
mov word [esi + edx*2 - 0x493af384], ax
or dword [esp + edx*2 - 0x493af384], 0x47b9d3a7
mov eax, dword [edi + edx*2 - 0x493af384]
or byte [esp + edx*2 - 0x493af384], ch
rol edx, cl
lea edx, [edx + ecx*4 - 0x4df39cc]
lea edi, [edi + ecx - 0x314161b]
jne 0xd34968
lea esp, [esp + 4]
jmp 0x19d1282
Function at 0xcd4afe
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
movzx eax, byte [edi]
add edi, 1
mov dword [esp], edx
push edx
and byte [esp + 4], 0x96
xor al, bl
sub byte [esp + 5], dl
rol al, 1
rol edx, 0x47
neg al
and edx, 0xdb0ea99d
ror edx, 0x7c
rol al, 1
add dword [esp], 0xe188fb09
jb 0x1a0a6c9

Function at 0xcfd922
Capabilities:
Encode data using xor

Disassembly:
bswap edx
dec edx
bswap edx
or ax, ax
mov ecx, eax
call fcn.01933762

Function at 0xd159da
Capabilities:
Encode data using base64

Disassembly:
mov al, byte [esi + eax - 0x8a39122]
lea esi, [esi + ecx - 0x20c9f5ca]
call fcn.01740c23
mov edx, 0x31be1387
shl edx, 0xfb
movsx eax, dl
mov edx, dword [edi + eax*2]
lea ecx, [eax*4 + 0x182b7315]
lea edi, [edi + eax + 4]
jae 0x180fe58

Function at 0xd1a613
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov dword [esp + 4], 0x1aa1328d
lea esp, [esp + 4]
call fcn.00d49bb7
mov eax, 0x1093ad84
neg ax
lea edi, [edi + eax*4 - 0x424d49f4]
sbb al, ah
mov ecx, dword [edi + eax*4 - 0x424d48a4]
movsx edx, al
push eax
bswap edx
xor ecx, ebx
xadd al, dh
sal edx, 0x38
lea eax, [edx*2 + 0x6f2aed2d]
dec ecx
xadd dword [esp + edx], edx
jae 0x1781d72
push 0xc4b1c69c
sub byte [esp], 0x80
mov eax, dword [ebp]
adc ebp, 4
push 0xab946f94
mov ecx, dword [esp]
sar word [esp + 4], 0x4a
xor eax, ebx
dec eax
movzx edx, cx
sal ecx, 0x3f
bswap edx
neg eax
neg byte [esp + ecx + 5]
dec eax
rol eax, 1
dec word [esp + ecx + 6]
cmovno edx, dword [esp + ecx + 1]
shl word [esp + ecx*8 + 6], 0x6a
not eax
xor dl, ch
neg eax
pop ecx
not eax
not ecx
shl dword [esp], cl
xor ebx, eax
inc dword [esp]
push ecx
add edi, eax
sub byte [esp + 1], dh
pop eax
mov ax, word [esi]
or dword [esp], 0x4b80d41c
mov dx, word [esi + 2]
inc byte [esp + 2]
shl dword [esp], cl
shr cx, cl
mov cl, byte [esi + 4]
call fcn.01926bc2
mov ecx, 0xf6b5051a
ror cx, 0xc1
mov dx, word [edi]
jno 0x1a23a9a
mov ax, word [edi + 2]
mov cl, byte [edi + 4]
adc edi, 4
push 0x97ba879c
shrd dx, ax, cl
mov word [edi], dx
mov eax, dword [esp]
xchg dword [esp], eax
mov eax, dword [ebp]
add ebp, 4
mov ecx, dword [esp]
lea edx, [ecx*8 + 0x6c83412d]
xor eax, ebx
add dword [esp + edx - 0x2a577e0d], 0x2688fe3d
pop edx
rol eax, 3
call fcn.0195b31b
call fcn.019a6680

Function at 0xd262ba
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0x67ab1fb3
shl ecx, cl
jnp 0xea9610
sub esi, 4
neg dword [esp]
jns 0xe74a8e
sub eax, 0xc625f4aa
push ecx
xor ebx, eax
add ebp, eax
pop ecx
pop ecx
pop ecx
jmp ebp
Function at 0xd7c7a7
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe93df9
mov dword ss:[eax], ecx
movzx ecx, byte [esp]
not dl
add dword [esp + ecx*4], edi
ret
mov dh, 0x94
add eax, 0xffff794f
sal eax, 0xe8
ror eax, 0xe8
dec eax
lea ebp, [ebp + eax*2 - 0x10d5f]
sbb eax, eax
sar eax, 0x2c
not al
xor dl, bl
shl al, 0x81
loopne 0xd7c720
bswap eax
jb 0x17a6413
rol cl, 0xa2
xor edx, 0xfc2cd0b5
sal eax, 0x3a
call fcn.00d0424a
mov eax, dword [edi]
inc ecx
mov edx, 0x753334a3
inc ebp
mov esi, edx
dec edx
lea edi, [edi + edx - 0x7533349f]
inc ecx
push edx
call fcn.00dfff0a
aas
mov bh, 0x96
cmpsd dword [esi], dword es:[edi]
loopne 0xd7c79d
jns 0xd7c77e
xchg edx, eax
in al, dx
pop ebx
push ebx
mov bl, 0xff
push ebx
pop es
scasb al, byte es:[edi]
pop ebp
push dword [esi + 0x22]
xchg dword [ebx + 0x42], edx
or edx, dword [eax + 0x662a3bae]
mov ebx, 0xd63f4b02
cwde
pushal
jae 0xd7c806
mov ebp, 0xcebbabcd
loope 0xd7c7fc
stosd dword es:[edi], eax
mov ebx, 0x51fbe1ce
push ecx
into
xor edi, dword [edi + 0x29a45ad7]
dec eax
cmp al, 0x37
pop edx
movsb byte es:[edi], byte [esi]
sub dword [eax + 0x3c], ecx
aaa
cmpsd dword [esi], dword es:[edi]
fild qword [edi]
sub dh, byte [eax]
pop edi
sar dword es:[edx + 0x6f], 0xa
lcall 0x6cd2, 0x7c1dbe7a
popal
inc edi
test eax, 0xd90b8ca0
push ds
xor ah, byte [esi]
mov al, byte [eax - 0x7ecc3b29]
imul esp, dword [esi + 0x5b], 0x26
add al, 0x58
ret 0x1a9a
dec ax
push ebp
lea ebp, [eax + eax*8 + 0x15127519]
push edi
and al, 0xab
shl ebp, 0x46
push ebx
mov ebx, ebp
shl eax, 0xa5
call fcn.019611e0
dec dl
ror dl, 1
sal eax, 0x35
xor dl, 4
dec dl
xor dl, 0x2f
or ax, 0xbe09
bswap eax
not dl
adc eax, 0xe5369908
shr eax, 0x21
sal eax, 0xcc
xor dl, 0x33
sub eax, eax
adc eax, eax
ror dl, 1
xor bl, dl
jmp 0xd7c60d

Function at 0xd7f2ed
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
inc ecx
not edx
push eax
shl cx, 0xab
neg cl
dec edx
xchg al, cl
sal ecx, 0xaf
jb 0x1823afa
jo 0xd7f329
jo 0xd7f329
and dword [ebx + eax + 0x22], eax
mov dl, 0xb0
sub edi, edx
invalid
insd dword es:[edi], dx
mov dl, 0x3d
push cs
xor dh, byte [ebx]
mov dh, 0xf7
push ds
cmp eax, 0xb633320e
neg dword [esi]
mov dl, 0x56
pop ebx
jno 0xd7f327
mov edx, 0xcc8c87a3
mov edx, 0xdc8bf83
pop ebx
imul byte [ebx - 0x2ead4dec]
add byte [eax + 0x78], bl
jb 0xd7f382
push ecx
or dword [ebp + 0x35], 0xffffffb9
sub eax, 0xef638d9c
xor al, 0x7b
xor esi, dword [eax]
aas
xor esi, dword [edx - 0x6a07dbfc]
cmp byte [edx], dh
jb 0xd7f306
imul dword [edx]
mov dl, 0x11
invalid
inc dword [eax]
add byte [eax], al
loope 0xd7f3fc
cmpsb byte [esi], byte es:[edi]
dec esi
sub byte [edi + 0x6a], bh
das
mov bh, pe_nt_image_headers32
add ah, bh
push esi
push esi
popfd
mov ecx, 0x56bb3400
jle 0xd7f3fd
out 0x34, al
sbb dword [eax], eax
add byte [eax - 0x2022291f], al
into
adc eax, ecx
sahf
retf
invalid
dec ebx
dec eax
iretd

Function at 0xd845e3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg eax
xor ebx, eax
push ecx
add edi, eax
ror dword [esp + ecx - 0xf], 0xeb
add dl, 0x9e
mov dword [esp + ecx*4 - 0x68], edx
pop eax
pop ecx
pop edx
pop ecx
jns 0x17cd1cd
Function at 0xda35dd
Capabilities:
Encode data using xor

Disassembly:
shrd edx, eax, cl
mov dword [ebp], edx
call fcn.00f7ee1a
inc ecx
mov edi, 0x3927a32a
inc ebp
movsx esi, di
inc ecx
movsx edx, dh
inc di
mov ebx, dword [edi - 0x3927a32a]
inc bp
mov esi, dword [esp + edx - 0x28]
inc ecx
mov cl, byte [esp + edx - 0x26]
add edx, 0xa4bfefb3
dec edi
lea esp, [esp + edi*2 - 0x724f4650]
inc bp
shrd ebx, esi, cl
inc di
mov dword [edi - 0x3927a32a], ebx
inc ecx
mov ebp, edi
mov byte [ecx - 0x75], 0xef
dec eax
lea eax, [ebp*4 + 0x2928a3a0]
push edx
inc esp
mov edi, dword [edi + ebp - 0x3927a32a]
dec eax
lea edi, [ebp + edi - 0x3927a326]
dec eax
lea esi, [edx*4 - 0x26d3555a]
inc ebp
xor edi, ebp
call fcn.01899098
push ebx
aaa
add bh, byte [esi]
sub al, 0xfe
mov dl, 0x42
jb 0xda3626
mov ebx, 0x9b504cb9
pop ss
invalid

Function at 0xdada54
Capabilities:
Encode data using base64

Disassembly:
not cl
xor cl, 0x33
mov dword [esp + edx - 0x74000001], edx
and word [esp + edx - 0x74000000], dx
ror cl, 1
not byte [esp + edx - 0x73fffffd]
xor bl, cl
call fcn.01918d06
mov eax, 0xad0f01b5
sub ebp, 4
mov edx, 0x5380e401
movsx ecx, al
lea ecx, [eax + 0x52b54fa3]
mov ecx, dword [edx + ebp - 0x5380e401]
xor ecx, ebx
jmp 0x19d608b
xor ebx, edx
mov eax, ecx
add ebp, edx
mov ecx, edi
sub edi, 4
movsx edx, ax
dec dword [esp + 8]
jge 0xdc18ce
mov dword [edi], ecx
pop eax
pop edx
pop eax
jle fcn.00de19a9
mov eax, 0x28a8a987
shr eax, 0x1b
mov eax, dword [ebp + eax*8 - 0x28]
push 0x9bcfa80
adc ebp, 4
xor eax, ebx
bswap eax
xor eax, 0x5c91afa9
shl word [esp + 1], 0x2d
ror eax, 1
not word [esp + 2]
not eax
push 0x8b09fdb4
neg eax
xor ebx, eax
call fcn.01917a0c
dec eax
not ecx
jns 0x1937dea
call fcn.00da45fe
mov eax, 0x9517f5af
mov edx, eax
sub esi, 4
lea ecx, [edx*8 - 0x77c39051]
mov edx, dword [esi + ecx*2 - 0x61f83a4e]
xor edx, ebx
rol edx, 1
call fcn.01a0be15

Function at 0xdbc397
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc esp
mov edi, eax
lea ecx, [ecx + eax*2 + 0x67bdfd00]
dec esp
xor dword [esp + eax*2 + 8], ebp
xor dword [esp + eax + 8], ecx
dec esp
mov ebp, dword [esp + eax*2 + 8]
inc ecx
push edi
dec esp
mov dword [esp + eax*4 + 8], eax
inc ecx
mov ecx, 0xac95f3b9
dec eax
arpl cx, cx
call fcn.00f41054
sysenter
call fcn.0196904c
mov dword [ebp + 0xc], eax
pop eax
mov eax, 0x6aa5a1b
call fcn.017e9aa7
cmp edi, 0x7310b11b
Function at 0xddf156
Capabilities:
Encode data using xor

Disassembly:
pop eax
jne 0x17d2a82
push edx
pushfd
mov edx, 0xaf0aeb25
mov edx, dword [esp + edx + 0x50f514df]
mov dword [esp + 4], 0x124fdc8d
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00d49bb7
adc edi, 4
push 0xd107438d
call fcn.01a01020
add ecx, 0xff4f1b14
jmp ecx
rcr bl, 1
ret 8
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
ja 0xe5be20
or byte [edi], cl
xchg dword [edx - 0x4200976d], edx
mov esi, 0x22aa948e
stc
mov ebp, 0xaa948ebe
and bh, cl
xor al, 0xbb
imul esp, ebp, 0x1a4b0805
xor eax, 0xefe5a150
dec edx
test byte [eax - 0x7f], ch
mov esp, 0x81cd1a6b
jo 0x17d2a87
imul ebx, dword [edx], 0xffffffcd
xor dword [eax - 0x26], 0x92ac9473
jae 0x17d2a43
lodsb al, byte [esi]
xchg edx, eax
mov dh, 0x77
test dword [ebx + 0x1a], ecx
add ah, byte [eax - 0x7f]
add eax, 0xa1489118
jecxz 0x17d2a73
xchg ecx, eax
je 0x17d2b11
mov ah, 0x99
and ch, byte [ebx - 0xa4398a2]
daa
jne 0x17d2ac8
mov esp, 0xfa7527f5
adc dh, byte [eax + 0x88a7fbf]
inc edx
imul esi, dword [eax + ebx - 0x24], 0xffffffbc
push esi
retf
push esi
mov ch, dl
sbb eax, 0x5ed1bb0f
inc ebp
aam 0xe
pushfd
push eax
push ss
push ecx
test dword [eax], edi
mov esp, dword [ebx]
and bl, byte [ecx]
invalid
salc
imul esp, esp, 0x44
into
xor eax, 0x8291928b
jae 0x17d2aa7
sbb dword [edx], edx
pushfd
pop edi
inc esi
jb 0x17d2af8
retf

Function at 0xde93cc
Capabilities:
Encode data using xor

Disassembly:
call fcn.01971d11
cwde
test al, 7
dec esi
jmp 0xde5bbc
and al, 0x5f
jb 0xde5be3
sub eax, 0x1094ca4
lea edx, [ecx - 0x45]
invalid
push ebx
popfd
int3
mov ecx, eax
rol edx, 1
or byte [esp + eax*2 - 0x7d578e31], 0x88
xor edx, 0x9c8d312b
ror al, 0xa3
shl word [esp + eax - 0x3eabc7bf], 0x8c
inc edx
mov dword [esp + ecx - 0x3eabc71e], eax
jmp 0x194a17e
mov dword [esi + 8], ebx
mov dword [esi + 4], ecx
call fcn.017d300d
mov edx, edi
jmp 0x1834519
mov edx, 0xc822a9ba
cpuid
push 0xc69c903d
sub esi, 0xc
mov dword [esi + 0xc], eax
push 0x2abf9e00
jmp 0xf79c0c
sub edi, 2
mov ecx, 0xc89fc62a
lea eax, [ecx + ecx*8 + 0x549b2ea0]
mov word [edi + eax - 0x6239261a], dx
mov ecx, dword [eax + ebp - 0x6239261a]
lea edx, [eax + 0x1b39712f]
sal eax, 0x66
lea ebp, [ebp + edx - 0x7d729745]
xor ecx, ebx
or al, ah
inc ecx
sar eax, 0x10
rol ecx, 1
push edx
xor dword [esp + edx - 0x7d729749], 0xcbb932b4
sbb ecx, 0xd612321b
sar ax, 0xc1
neg ecx
rol eax, 0xd1
setb al
not ecx
sub ecx, 0x540a779c
ror al, 0x47
jb fcn.00d26420
neg ecx
jmp 0xde5b8e
xchg dword [esp + ecx - 0x3eabc717], ecx
bswap edx
xor ebx, edx
push ecx
call fcn.00eb9c98
mov eax, dword [esi]
push ebx
jmp 0x1a212e6
jmp 0x1816756

Function at 0xdf02c8
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0xa01f48a6
mov eax, dword [edi]
and dl, dh
lea ecx, [edx + edx*4 - 0x25eff141]
neg ecx
lea edi, [ecx + edi - 0x553893d]
call fcn.018984c3