joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c7f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, edx
shr edi, 3
mov eax, edi
neg eax
lea edx, [edx + eax*8]
lea esp, [esp]
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [ebx*4 + 0x491070]
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x491070]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [ebx*4 + 0x491070]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x491070]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x491070]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x491070]
movzx ebx, byte [ecx + 1]
add ecx, 1
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x491070]
movzx ebx, byte [ecx + 1]
add ecx, 1
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x491070]
add ecx, 1
sub edi, 1
mov esi, eax
jne 0x401c90
pop edi
pop ebx
test edx, edx
je 0x401d8c
lea esp, [esp]
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x491070]
add ecx, 1
sub edx, 1
jne 0x401d70
mov eax, esi
not eax
pop esi
ret

Function at 0x401df0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x14]
xor edx, edx
bswap eax
bswap ecx
sub esi, edi
jmp 0x401e10
lea edi, [esi + edx*4]
mov edi, dword [ebp + edi - 0x14]
bswap edi
mov dword [ebp + edx*4 - 0x14], edi
add edx, 1
cmp edx, 4
jl 0x401e10
xor edx, edx
mov dword [ebp - 4], 0x10
mov edi, edi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x10]
mov edi, ecx
shl edi, 4
add edi, dword [ebp - 0x14]
sub edx, 0x61c88647
xor esi, edi
lea edi, [edx + ecx]
xor esi, edi
add eax, esi
mov esi, eax
shr esi, 5
add esi, dword [ebp - 8]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0xc]
xor esi, edi
lea edi, [edx + eax]
xor esi, edi
add ecx, esi
sub dword [ebp - 4], 1
jne 0x401e30
mov edx, dword [ebp + 0xc]
bswap eax
bswap ecx
pop edi
mov dword [edx], eax
mov dword [edx + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407ea7
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [ecx + 0x60343722]
mov edx, dword [0x60313588]
and eax, esi
and edx, ebp
mov ebx, ecx
shl edx, 5
xor eax, edx
and ebx, esi
movzx edx, word [eax*2 + 0x60333700]
mov dword [0x60313588], eax
lea eax, [eax*2 + 0x60333700]
mov word [ebx*2 + 0x60323700], dx
mov ebx, dword [0x60363874]
mov word [eax], cx
mov eax, edi
push 2
mov dword [0x60363860], eax
test edx, edx
pop edi
je 0x407d6d
cmp eax, dword [0x60313584]
jae 0x407d6d
mov eax, ecx
sub eax, edx
cmp eax, 0x7efa
ja 0x407d6d
push edx
call fcn.00407a84
mov edi, eax
mov eax, dword [0x60313594]
cmp edi, eax
pop ecx
jbe 0x407d50
mov edi, eax
mov ecx, dword [0x60363864]
cmp edi, 3
jne 0x407d6d
mov eax, ecx
sub eax, dword [0x60363874]
cmp eax, 0x1000
jbe 0x407d6d
push 2
pop edi
mov eax, dword [0x60363860]
cmp eax, 3
jb 0x407e37
cmp edi, eax
ja 0x407e37
sub ecx, ebx
add eax, 0xfffffffd
dec ecx
push eax
push ecx
call fcn.0040a25c
pop ecx
pop ecx
push 1
pop ecx
sub ecx, dword [0x60363860]
add dword [0x60313594], ecx
sub dword [0x60363860], 2
mov ecx, dword [0x60363864]
movzx edx, byte [ecx + 0x60343723]
mov edi, dword [0x60313588]
inc ecx
and edi, ebp
and edx, esi
shl edi, 5
xor edx, edi
mov edi, ecx
mov dword [0x60313588], edx
and edi, esi
mov bx, word [edx*2 + 0x60333700]
dec dword [0x60363860]
lea edx, [edx*2 + 0x60333700]
mov word [edi*2 + 0x60323700], bx
mov word [edx], cx
jne 0x407dae
and dword [esp + 0x10], 0
push 2
inc ecx
pop edi
test eax, eax
mov dword [0x60363864], ecx
je 0x407ea5
mov eax, dword [0x60363878]
test eax, eax
jl 0x407e19
lea edx, [eax + 0x60343720]
jmp 0x407e1b
xor edx, edx
sub ecx, eax
push 0
push ecx
push edx
call fcn.00409a5f
mov ecx, dword [0x60363864]
add esp, 0xc
mov dword [0x60363878], ecx
jmp 0x407ea5
cmp dword [esp + 0x10], 0
je 0x407e90
movzx eax, byte [ecx + 0x6034371f]
push eax
push 0
call fcn.0040a25c
pop ecx
test eax, eax
pop ecx
je 0x407e88
mov eax, dword [0x60363878]
test eax, eax
jl 0x407e64
lea ecx, [eax + 0x60343720]
jmp 0x407e66
xor ecx, ecx
mov edx, dword [0x60363864]
push 0
sub edx, eax
push edx
push ecx
call fcn.00409a5f
mov ecx, dword [0x60363864]
add esp, 0xc
mov dword [0x60363878], ecx
jmp 0x407e98
mov ecx, dword [0x60363864]
jmp 0x407e98
mov dword [esp + 0x10], 1
inc ecx
dec dword [0x60313594]
mov dword [0x60363864], ecx
mov ebx, 0x106
cmp dword [0x60313594], ebx
jae 0x407ece
cmp dword [0x6031358c], 0
jne 0x407ece
call fcn.00407bc1
cmp dword [0x60313594], ebx
mov ecx, dword [0x60363864]
jb 0x407eb2
cmp dword [0x60313594], 0
jne 0x407cdc
cmp dword [esp + 0x10], 0
pop esi
pop ebp
pop ebx
je 0x407efc
movzx eax, byte [ecx + 0x6034371f]
push eax
push 0
call fcn.0040a25c
pop ecx
pop ecx
mov ecx, dword [0x60363864]
mov edx, dword [0x60363878]
test edx, edx
jl 0x407f0e
lea eax, [edx + 0x60343720]
jmp 0x407f10
xor eax, eax
sub ecx, edx
push 1
push ecx
push eax
call fcn.00409a5f
add esp, 0xc
pop edi
pop ecx
ret
Function at 0x409caa
Capabilities:
Encode data using xor

Disassembly:
add esi, dword [ebp - 8]
xor edx, esi
mov dword [ebp - 0x10], edx
and edx, ebx
xor edx, dword [ebp - 8]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x30]
lea edi, [edx + edi - 0x72d5b376]
mov edx, dword [ebp - 0x10]
ror edi, 0xc
add edi, esi
xor edx, edi
add edx, dword [eax + 0x14]
xor esi, edi
lea edx, [edx + ebx - 0x5c6be]
mov ebx, dword [ebp - 8]
rol edx, 4
add edx, edi
xor esi, edx
add esi, dword [eax + 0x20]
lea esi, [esi + ebx - 0x788e097f]
mov ebx, dword [ebp - 0xc]
rol esi, 0xb
add esi, edx
mov dword [ebp - 8], esi
xor esi, edi
xor esi, edx
add esi, dword [eax + 0x2c]
lea esi, [esi + ebx + 0x6d9d6122]
mov ebx, dword [ebp - 8]
rol esi, 0x10
add esi, dword [ebp - 8]
xor ebx, esi
mov dword [ebp - 0x10], ebx
xor ebx, edx
add ebx, dword [eax + 0x38]
mov dword [ebp - 0xc], esi
lea edi, [ebx + edi - 0x21ac7f4]
ror edi, 9
add edi, esi
mov esi, dword [ebp - 0x10]
xor esi, edi
add esi, dword [eax + 4]
lea edx, [esi + edx - 0x5b4115bc]
mov esi, dword [ebp - 0xc]
rol edx, 4
add edx, edi
xor esi, edi
xor esi, edx
add esi, dword [eax + 0x10]
mov ebx, dword [ebp - 8]
lea esi, [esi + ebx + 0x4bdecfa9]
rol esi, 0xb
add esi, edx
mov dword [ebp - 8], esi
xor esi, edi
xor esi, edx
add esi, dword [eax + 0x1c]

Function at 0x41c348
Capabilities:
Hash data with md5

Disassembly:
out 0x3e, al
lahf
dec eax
loope 0x41c38c
sahf
dec eax
retf
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push eax
inc ebp
add byte [eax], al
dec esp
add dword [eax + eax], eax
lea edx, [edx + 0x4f5c]
add byte [eax], al
add byte [eax], al
add byte [eax], al
loopne 0x41c3b2
add eax, dword [ecx]
or eax, dword [ecx]
or byte [eax], al
add byte [eax + 0xb], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
add byte [eax], al
add byte [ecx - 0x60], bl
or al, byte [eax]
add byte [eax], dl
or dword [eax], eax
add byte [eax], al
add byte [eax], al
pop ecx
mov al, byte [0x1000000a]
add byte [eax], al
add byte [eax + 0xb], dl
add byte [eax], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x14], dh
add byte [eax], al
adc byte [eax], al
add byte [ecx + esi + 0x20015], dh
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
loopne 0x41c3be
or eax, 0x6200
add byte [ebx + ebp + 0xd], bl
add byte [eax + 1], dl
invalid
Function at 0x41df24
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp]
nop
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, 0xff
add ecx, 1
rol dword [ecx], 0x8b
mov cl, 0xe8
or byte [ebx], dh
add al, 0x9d
mov byte [ebp + 0x4c], ah
add byte [edi], cl
mov dh, 0x19
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
add ecx, 1
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
add ecx, 1
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
add ecx, 1
sub edi, 1
mov esi, eax
jne 0x41df2c
pop edi
pop ebx
test edx, edx
je 0x41e028
lea esp, [esp]
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x4c6588]
add ecx, 1
sub edx, 1
jne 0x41e00c
mov eax, esi
not eax
pop esi
pop ebp
ret

Function at 0x41df38
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
lea esp, [esp]
nop
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, 0xff
add ecx, 1
rol dword [ecx], 0x8b
mov cl, 0xe8
or byte [ebx], dh
add al, 0x9d
mov byte [ebp + 0x4c], ah
add byte [edi], cl
mov dh, 0x19
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
add ecx, 1
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
movzx ebx, byte [ecx + 1]
add ecx, 1
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4c6588]
add ecx, 1
sub edi, 1
mov esi, eax
jne 0x41df2c
pop edi
pop ebx
test edx, edx
je 0x41e028
lea esp, [esp]
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x4c6588]
add ecx, 1
sub edx, 1
jne 0x41e00c
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x41e08c
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x14]
xor edx, edx
bswap eax
bswap ecx
sub esi, edi
jmp 0x41e0ac
lea edi, [esi + edx*4]
mov edi, dword [ebp + edi - 0x14]
bswap edi
mov dword [ebp + edx*4 - 0x14], edi
add edx, 1
cmp edx, 4
jl 0x41e0ac
xor edx, edx
mov dword [ebp - 4], 0x10
mov edi, edi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x10]
mov edi, ecx
shl edi, 4
add edi, dword [ebp - 0x14]
sub edx, 0x61c88647
xor esi, edi
lea edi, [edx + ecx]
xor esi, edi
add eax, esi
mov esi, eax
shr esi, 5
add esi, dword [ebp - 8]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0xc]
xor esi, edi
lea edi, [edx + eax]
xor esi, edi
add ecx, esi
sub dword [ebp - 4], 1
jne 0x41e0cc
mov edx, dword [ebp + 0xc]
bswap eax
bswap ecx
pop edi
mov dword [edx], eax
mov dword [edx + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4290e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror dword [ebp - 0xa37b], cl
jmp [eax - 0x6c]
Function at 0x435962
Capabilities:
Get number of processors

Disassembly:
sar byte [ecx], 1
fdivr dword [ecx]
loopne 0x4359a1
call 0xf87d49a6
cmp dword [eax], eax
cmp cl, byte [eax]
cmp dl, byte [edx + edi]
xor al, 0x3a
cmp al, 0x3a
inc esp
cmp dl, byte [eax + 0x3a]
js 0x4359b8
pushfd
cmp ch, byte [eax - 0x37c54fc6]
cmp dl, ah
cmp dh, ah
cmp bh, ah
cmp al, byte [ebx + edi]
adc byte [ebx], bh
xor al, 0x3b
push esp
cmp ebx, dword [ebx + edi + 0x64]
cmp ebp, dword [ebx + edi + 0x74]
cmp edi, dword [ebx + edi - 0x7c]
cmp edx, dword [eax - 0x2bc44bc5]
cmp ebx, esp
cmp esp, esp
cmp ebp, esp
cmp esi, dword [ebx + edi + 0x3bdc3bd4]
in al, 0x3b
in al, dx
cmp esi, esp
cmp edx, dword [esp + edi]
sbb al, 0x3c
and al, 0x3c
xor byte [eax + edx*2], bh
cmp al, 0x58
pop eax
cmp al, 0x60
cmp al, 0x6c
cmp al, 0x8c
cmp al, 0x94
cmp al, 0x9c
cmp al, 0xa4
cmp al, 0xb0
cmp al, 0xd0
cmp al, 0xd8
cmp al, 0xe0
cmp al, 0xec
cmp al, 0xc
cmp eax, 0x3d383d18
inc eax
cmp eax, 0x3d543d48
je 0x435a1b
jl 0x435a1d
test byte [0x3db03d90], bh
mov esp, 0x3de03d
or byte ds:[esi], bh
adc byte [esi], bh
sbb byte [esi], bh
and byte [esi], bh
sub byte [esi], bh
xor byte [esi], bh
cmp byte [esi], bh
inc esp
insb byte es:[edi], dx
js 0x435a40
cwde
mov al, byte ds:[0xb43ea83e]
aam 0x3e
fdivr qword [esi]
in al, 0x3e
in al, dx
clc
sbb byte ds:[edi], bh
and byte [edi], bh
sub al, 0x3f
dec esp
aas
push esp
aas
pop esp
aas
push 0x903f883f
aas
cwde
aas
movsb byte es:[edi], byte [esi]
aas
enter 0xffffffffffffe83f, 0x3f
invalid
adc byte [eax], dh
sbb byte [eax], dh
and byte [eax], dh
sub byte [eax], dh
xor byte [eax], dh
cmp byte [eax], dh
inc eax
xor byte [eax + 0x30], cl
push eax
xor byte [eax + esi + 0x7c], bl
xor byte [eax + esi + 0x3094308c], al
pushfd
xor byte [eax + esi + 0x30b430ac], ah
mov esp, 0xcc30c430
xor ah, dl
xor ah, bl
xor ah, ah
xor ah, ch
xor al, bh
xor byte [eax], bl
xor dword [ecx + esi], esp
inc esp
xor dword [ecx + esi + 0x58], ecx
xor dword [eax + 0x31], edi
test byte [ecx], dh
movsb byte es:[edi], byte [esi]
xor dword [eax - 0x27ce2fcf], esi
xor esp, esp
xor dword [edx + esi], eax
or al, 0x32
adc al, 0x32
sbb al, 0x32
sub byte [edx], dh

Function at 0x43cdc4
Capabilities:
Encode data using xor

Disassembly:
push ds
mov ch, 0x65
adc byte [ebx], 0xb5
push eax
pop ds
mov ch, 0x65
push eax
cmp al, 0xb5
ror byte gs:[0xebe065b5], 1
loopne 0x43cdb1
loopne 0x43cdb1
mov al, 0x65
add ah, ch
mov al, 0x65
push eax
in al, dx
mov al, 0x65
sub ah, 0xb0
lock and byte gs:[ebp - 0x4b871f9b], dh
mov al, 0x1f
mov ch, 0x65
add al, 0x20
mov edx, 0x65
add byte [ecx], al
add byte [eax], al
add al, cl
pop ss
mov edx, 0x65
add byte [ecx], al
add byte [eax], al
add ah, cl
xchg ebx, eax
mov ebx, 0x465
add byte [ecx], al
add byte [eax], al
add byte [eax + 0x865ba20], ch
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi], bl
sti
mov al, byte [0xba91c7b1]
inc edx
invalid

Function at 0x448f39
Capabilities:
Encode data using xor

Disassembly:
je 0x449023
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0x18], 0
jmp 0x449023
Function at 0x44c740
Capabilities:
Access peb ldr_data

Disassembly:
add byte [eax - 0x7d], dl
in al, dx
sbb al, 0x53
push ebp
push esi
push edi
mov eax, dword [0x101a7148]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x40]
mov dword [esi], eax
push edx
lea eax, [esp + 0x48]
mov dword [esi + 4], ecx
xor ebx, ebx
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x48], 3
mov dword [esp + 0x4c], ebx
call fcn.0044c674
mov dword [esp + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
lea edi, [esi + 0x4c]
mov ecx, edi
mov byte [esp + 0x38], 1
call fcn.00439374
mov dword [edi + 4], eax
mov byte [eax + 0x29], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov ebp, dword [0x1017b064]
lea eax, [esi + 0x68]
mov word [esi + 0x58], bx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], edx
mov edi, 0x1017b4d4
push eax
mov dword [esi + 0x64], edi
call ebp
lea ecx, [esi + 0x80]
mov byte [esp + 0x38], 3
call fcn.00443934
lea ecx, [esi + 0xb8]
push ecx
mov dword [esi + 0xb4], edi
call ebp
mov dword [esi + 0xd4], ebx
add byte [eax], al
add byte [ecx + 0xd89e], cl
add byte [ecx + 0xdc9e], cl
add byte [edx - 0x72afdbac], cl
xchg ah, dh
add byte [eax], al
add byte [esi - 0x77], ah
sahf
loopne 0x44c82e
add byte [eax], al

Function at 0x467164
Capabilities:
Encode data using xor

Disassembly:
lea edi, [ebx + edi + 0x4881d05]
mov ebx, dword [ebp - 0xc]
Function at 0x403b07
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x403b3f
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x403b32
xor al, al
jmp 0x403b63
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
lea eax, [ebp - 4]
push eax
push 0x10000
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
push 0
call fcn.0042a6ac
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
leave
ret 0xc

Function at 0x403c5f
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
lea ebp, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x403c6c
sub esi, ebp
sar esi, 1
lea esi, [esi*2 + 2]
test ecx, ecx
je 0x403cdf
test edx, edx
je 0x403cdf
cmp dword [esp + 0x14], ebx
je 0x403cdf
cmp dword [esp + 0x1c], ebx
je 0x403cdf
test esi, esi
je 0x403cdf
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
push 0x20106
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403cdf
push esi
push dword [esp + 0x20]
xor esi, esi
inc esi
push esi
push ebx
push dword [esp + 0x24]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
test eax, eax
movzx ebx, bl
cmove ebx, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret

Function at 0x403d72
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x403de4
cmp dword [ebp + 0x10], 4
jb 0x403de4
xor ebx, ebx
mov dword [esi], ebx
test ecx, ecx
je 0x403de4
test edx, edx
je 0x403de4
cmp dword [ebp + 8], ebx
je 0x403de4
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
mov eax, dword [ebp + 0x14]
or eax, 0x20019
mov dword [ebp - 4], ebx
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403de0
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
cmove ebx, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x403de6
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x4045a8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push esi
push edi
mov dword [ebp - 0x10], eax
cmp dword [eax + 4], 0xffffffff
je 0x40464a
cmp dword [ebp + 8], 0
je 0x40464a
cmp dword [ebp + 0x10], 0
ja 0x4045d5
cmp dword [ebp + 0xc], 1
jb 0x40464a
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
and dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub ecx, esi
sbb eax, edi
test eax, eax
jb 0x404608
ja 0x4045ff
cmp ecx, 0xfffffff
jbe 0x404608
mov eax, 0xfffffff
mov ecx, esi
jmp 0x40460f
mov eax, dword [ebp + 0xc]
mov ecx, esi
sub eax, ecx
push 0
lea edx, [ebp - 8]
push edx
push eax
mov eax, dword [ebp + 8]
add eax, ecx
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404644
cmp dword [ebp - 8], 0
je 0x404644
add esi, dword [ebp - 8]
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x4045e3
ja 0x404644
cmp esi, dword [ebp + 0xc]
jb 0x4045e3
mov eax, esi
mov edx, edi
jmp 0x40464e
xor eax, eax
xor edx, edx
pop edi
pop esi
leave
ret 0xc

Function at 0x40477f
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
mov ebp, ecx
and dword [esp + 0x10], esi
mov ebx, edx
push edi
xor edi, edi
test ebp, ebp
je 0x4048a6
mov edx, dword [esp + 0x20]
test edx, edx
je 0x4048a6
mov byte [edx], 0
test ebx, ebx
je 0x40489d
mov eax, dword [esp + 0x24]
add eax, 0xfffffff8
mov dword [esp + 0x18], eax
cmp esi, eax
jae 0x40489d
mov ch, byte [edi + ebp]
inc edi
cmp edi, ebx
jb 0x4047de
xor al, al
mov dword [esp + 0x14], 2
xor cl, cl
mov byte [esp + 0x11], cl
jmp 0x4047fc
mov al, byte [edi + ebp]
inc edi
mov byte [esp + 0x11], al
mov cl, al
cmp edi, ebx
jae 0x4047f2
mov al, byte [edi + ebp]
inc edi
jmp 0x4047fc
xor al, al
mov dword [esp + 0x14], 1
mov byte [esp + 0x12], al
and cl, 0xf
shr al, 6
shl cl, 2
or cl, al
movzx eax, ch
shr eax, 2
and ch, 3
shl ch, 4
mov byte [esp + 0x13], cl
movzx ecx, ch
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
movzx eax, byte [esp + 0x11]
shr eax, 4
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx + 1], al
add esi, 2
mov eax, dword [esp + 0x14]
sub eax, 0
je 0x40486e
sub eax, 1
je 0x404859
sub eax, 1
jne 0x404891
mov word [esi + edx], 0x3d3d
jmp 0x40488e
movzx eax, byte [esp + 0x13]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
mov byte [esi + edx + 1], 0x3d
jmp 0x40488e
movzx eax, byte [esp + 0x13]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
movzx eax, byte [esp + 0x12]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx + 1], al
add esi, 2
mov eax, dword [esp + 0x18]
cmp edi, ebx
jb 0x4047bc
mov byte [esi + edx], 0
lea eax, [esi + 1]
jmp 0x4048a8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret