joyce8/EMBER2024-capa huggingface dataset:
Function at 0x582b20
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f7a4a
push eax
mov dword fs:[0], esp
mov eax, 0x1d2fbc8
sub esp, 0x40
test eax, eax
je 0x582b4a
mov eax, dword [0x1d2fbcc]
test eax, eax
jne 0x582bb5
lea ecx, [esp + 4]
push esi
push ecx
push 0x3c
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov ecx, 0x1d2fbc8
call fcn.005c5b01
push 8
call fcn.005bd525
mov esi, eax
add esp, 4
mov dword [esp + 4], esi
test esi, esi
mov dword [esp + 0x4c], 0
je 0x582ba5
push 0x18
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
mov ecx, esi
call fcn.005c5bbe
jmp 0x582ba7
xor eax, eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [0x1d2fbe0], eax
pop esi
call fcn.00582a80
mov eax, dword [0x1d2fbe4]
test eax, eax
jne 0x582bde
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x582bf0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1d2fbe4], eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x58bf90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
lea eax, [esp]
push esi
push eax
push 1
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
mov esi, 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x58c003
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.WheelScrollLines
push ecx
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x58bff8
push 0xa
lea edx, [esp + 0x14]
push eax
push edx
call fcn.004ab456
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x8c
ret
Function at 0x5969c0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f8f3c
push eax
mov dword fs:[0], esp
sub esp, 0x414
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push esi
mov ebp, ecx
push edi
push 0
push 0
mov eax, dword [ebp + 0xb4]
push 0x184
push eax
call ebx
mov ecx, dword [ebp + 0x78]
push 0
push 0
push 0x188
push ecx
call ebx
test eax, eax
jl 0x596b5e
mov edx, dword [0x1cd3de8]
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x42c], 0
push ecx
push eax
lea ecx, [ebp + 0x5c]
call fcn.005cdb05
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x596b4a
push str.MenuData.ini
lea eax, [esp + 0x18]
push 0x1d2e550
push eax
call fcn.005bda79
mov eax, dword [eax]
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push 0x400
push ecx
push 0x1c6f9c0
push edx
push str.MenuData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x14]
call fcn.005bd7e4
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push eax
call fcn.005bd852
mov ecx, dword [0x1cd3de8]
mov dword [esp + 0x1c], ecx
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x434], 2
call fcn.005bd559
call fcn.0053c650
mov edi, eax
mov esi, 1
add esp, 4
cmp edi, esi
jle 0x596b28
push esi
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.005bd559
lea ecx, [esp + 0x1c]
push ecx
call fcn.0053bd20
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x430], 3
call fcn.005bd91d
lea ecx, [esp + 0x14]
mov byte [esp + 0x42c], 2
call fcn.005bd7e4
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x596b28
mov edx, dword [ebp + 0xb4]
push eax
push 0
push 0x180
push edx
call ebx
inc esi
cmp esi, edi
jl 0x596ac5
lea ecx, [esp + 0x1c]
mov byte [esp + 0x42c], 1
call fcn.005bd7e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x42c], 0
call fcn.005bd7e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x42c], 0xffffffff
call fcn.005bd7e4
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x420
ret
Function at 0x59dad0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5f9868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0xc]
mov dword [esp + 0x24], 0
mov ecx, edi
call fcn.004da990
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esi + 4], eax
lea edx, [esp + 0x34]
lea eax, [esp + 0xc]
mov dword [esi + 8], ecx
push edx
push eax
mov ecx, edi
mov dword [esi], 0x1c82a70
call fcn.004da9b0
mov ecx, dword [esp + 0x40]
mov eax, esi
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x18
Function at 0x5a3920
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5fa150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], ebx
call fcn.005bdf11
mov eax, dword [esp + 0x30]
push ebx
push ebx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 1
call fcn.005be0c3
test eax, eax
jne 0x5a398e
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.005be006
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.005bd7e4
mov eax, 0x65
jmp 0x5a3a3e
lea ecx, [esp + 0x10]
call fcn.005be3bd
mov edi, eax
cmp edi, ebx
jne 0x5a39c2
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.005be006
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.005bd7e4
mov eax, 0x66
jmp 0x5a3a3e
push edi
call fcn.005bd525
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x5a39f6
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.005be006
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.005bd7e4
mov eax, 0x64
jmp 0x5a3a3e
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.005be1e0
lea ecx, [esp + 0x10]
call fcn.005be2de
push edi
push esi
mov ecx, ebp
call fcn.005a3710
push esi
mov edi, eax
call fcn.005bd54e
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.005be006
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.005bd7e4
mov eax, edi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x5bec2e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x5bec50
cmp dword [edi + 0x3c], 0
jne 0x5bec50
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.005d40e6
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.005bec7d
pop edi
pop esi
pop ebx
ret 8

Function at 0x5beccb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.005d40e6
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5becfc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.005bed0f
pop edi
pop esi
pop ebx
ret 8

Function at 0x5c0325
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5c035d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005bdc8b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005bdc63
jmp 0x5c0369
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5c1ec1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5c1f03
call fcn.005d40e6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5c1f03
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5c1efa
xor eax, eax
jmp 0x5c1f0b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005c1f11
pop edi
pop esi
pop ebx
ret 4

Function at 0x5d28a2
Capabilities:
Create http request

Disassembly:
mov eax, 0x5fb224
call fcn.004a9ed8
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x5d28da
call fcn.005d40e6
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x5d28ff
push eax
push dword [esi + 4]
call fcn.005d3731
jmp 0x5d290b
push esi
push eax
mov ecx, 0x1d2fd60
call fcn.005d291c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x5d2c18
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x5fb297
call fcn.004a9ed8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.005c4866
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x1cd3de8]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.005bd96d
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.005bd96d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x5d4615
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5d4643
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5d4661
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005d457b
jmp 0x5d4661
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5d4661
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005d457b
test edi, edi
mov eax, edi
jne 0x5d464b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40271b
Capabilities:
Get common file path

Disassembly:
sub esp, 0x400
push esi
push edi
xor edi, edi
xor esi, esi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, 0x9f60fc3
jg 0x402741
inc esi
cmp esi, 0x1e70dee2
jl 0x402727
cmp dword [0x43883c], 0x400
jne 0x402769
push edi
call fcn.004028bb
push edi
push edi
call fcn.00402d23
push edi
call fcn.00402b82
push edi
call fcn.00402e01
add esp, 0x14
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x58bba6
jg 0x402788
inc esi
cmp esi, 0xe147
jl 0x40276b
mov eax, dword [0x43080c]
mov dword [0x43883c], eax
call fcn.0040249a
mov esi, 0x3078f
cmp dword [0x43883c], 0x51f
jne 0x4027b4
push edi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec esi
jne 0x40279c
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x405974
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c5b0]
jne 0x40597e
repz ret
jmp fcn.00407295
Function at 0x4064e4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40c5b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040527f
and dword [ebp - 0x14], 0
cmp dword [0x432434], 0
mov dword [ebp - 0x18], eax
jne 0x406597
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40663f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40663f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x432434], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x432438], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43243c], eax
call edi
push eax
call esi
mov dword [0x432444], eax
test eax, eax
je 0x406597
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x432440], eax
mov eax, dword [0x432440]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4065f0
cmp dword [0x432444], ecx
je 0x4065f0
push eax
call esi
push dword [0x432444]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4065f0
test ebx, ebx
je 0x4065f0
call edi
test eax, eax
je 0x4065e7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4065e7
test byte [ebp - 8], 1
jne 0x4065f0
or dword [ebp + 0x10], 0x200000
jmp 0x406623
mov eax, dword [0x432438]
cmp eax, dword [ebp - 0x18]
je 0x406623
push eax
call esi
test eax, eax
je 0x406623
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406623
mov eax, dword [0x43243c]
cmp eax, dword [ebp - 0x18]
je 0x406623
push eax
call esi
test eax, eax
je 0x406623
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x432434]
call esi
test eax, eax
je 0x40663f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406641
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405974
leave
ret
Function at 0x10001fc0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10001fd5
xor eax, eax
jmp 0x1000204a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x10002002
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x10002045
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x10002043
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x1000203f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x10002043
xor eax, eax
jmp 0x1000204a
jmp 0x10001ff9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100038d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [0x10009018]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 0x10007330
mov dword [ebp - 0x2e4], edi
mov dword [ebp - 0x2e0], esi
mov dword [ebp - 0x2c8], eax
jmp fcn.1008e2c5
Function at 0x10063508
Capabilities:
Parse pe header

Disassembly:
jne 0x1001c6d0
mov eax, 0x5a4d
jmp 0x1009f088
mov ecx, dword [ebp - 8]
jmp 0x100a1dc3
push edi
call ebx
test eax, eax
je 0x1001c6d0
cmp dword [ebp - 0x2d0], 0x40
jmp 0x1000ee83
call fcn.1008f601
and bh, bl
dec ecx
push eax
pop ds
mov dl, 0xcb
sub eax, edx
outsd dx, dword [esi]
cldemote byte [ecx + 0x5641e2b5]
aaa
xchg ebx, eax
mov ecx, 0x1fb2e00f
movzx ax, byte [ebp + ecx*2 - 0x3f65c01e]
xor cl, cl
xor ecx, 0x218720a6
mov cl, byte [ebp + ecx - 0x3e35c0a4]
jae 0x100829d2
push edx
push eax
jmp 0x100514d3
adc ebp, 2
call fcn.100a504c
insd dword es:[edi], dx
xor eax, edx
jl 0x10082a2a
cmp edi, dword [esi + 0x40d838cf]
adc byte [eax], bl
mov word [esi + 0x175f4ffe], fs
jmp 0x10082a06
dec ecx
inc esp
xor cl, dl
or ecx, ecx
dec eax
adc edx, esp
add cx, cx
rol cx, 0x2c
dec eax
mov ecx, dword [edx]
dec ecx
sub esi, 8
jmp fcn.1004b23a
mov eax, dword [ecx + 0x39]
push esp
sbb dword [edx - 0x42], ebx
clc
hlt
pop ebp
jmp loc.1000405c
cmp word [ebp - 0x2c4], ax
jmp loc.1000393b
pop edi
ror bh, cl
pop esi
xor ecx, ebp
xor eax, eax
setbe bh
pop ebx
call fcn.10004bb8
mov esp, ebp
jmp 0x100987c1

Function at 0x1006517a
Capabilities:
Encode data using xor

Disassembly:
push 0x3299a63a
movzx ax, byte [esi]
pop ecx
sal ecx, 0xc1
mov dword [esp + ecx - 0x65334c74], ecx
mov cl, byte [ecx + esi - 0x65334c72]
adc esi, 2
call fcn.100a3c2d
push esi
pushfd
mov esi, 0xab2983b2
xor esi, 0x50bf6faa
jo 0x100651a1
call fcn.1004b5f6
inc bp
mov edi, dword [esi]
mov ecx, 0xe0290180
inc esp
movsx ebx, cx
call fcn.10091177
or bh, ah
pushal
fdiv qword [eax + edx*2]
imul esi, dword [ebx + 0x63], 0x17
cdq
sti
pop ss
invalid

Function at 0x100b2ccb
Capabilities:
Encode data using base64

Disassembly:
add eax, edx
push 0xfb0a28d
call fcn.10120ff6
push ebp
push edx
mov dword [esp + 4], 0xe1d7975d
lea esp, [esp + 4]
call fcn.100ce9d4

Function at 0x100b3f0b
Capabilities:
Encode data using base64

Disassembly:
dec ecx
add esi, 0xa
dec eax
shrd ebx, ebp, cl
push 0xb69d6b24
dec ecx
mov dword [esi], ebx
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x100b4023
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esi], ebx
jmp 0x100d84bb
dec eax
lea esp, [esp + 0x38]
jmp fcn.100da766

Function at 0x100b496e
Capabilities:
Encode data using base64

Disassembly:
dec ecx
mov dword [esi], edi
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766
Function at 0x100b63a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ret
xor bl, cl
lea ecx, [esp + ecx + 0x14]
call fcn.10133869
cmp cl, 0xe1
jmp 0x101181a1
sub eax, eax
jmp fcn.100bc801
mov dword [edi + 8], 0
clc
cmp cl, 0x2d
jb 0x1010a665
push esi
btr eax, esp
add si, bp
and esi, edx
movzx esi, cl
mov eax, 0x6c16c16d
bsf edx, ebp
mul esi
mov ax, bx
mov eax, esi
sub eax, edx
shl si, 2
shr eax, 1
or si, 0x8f08
lea eax, [eax + edx]
shr eax, 5
sbb edx, edx
btc si, 1
movzx eax, al
cmove dx, bx
mov edx, eax
pop esi
test bh, ch
stc
cmp esp, esi
add cl, 0xd3
sub eax, 1
jmp 0x1010a65c
jne 0x101052cb
mov dword [edi + 8], edx
mov dword [edi + 4], 0
test esp, 0xf91a4f0b
cmc
cmp si, 0xf82a
cmp cl, 9
jb 0x1010af67
movzx edx, cl
bt eax, esi
mov eax, 0x38e38e39
jmp 0x1010af38
mul edx
bsr ax, si
shr edx, 1
movzx eax, dl
bt dx, 0xa2
sbb edx, 0xe99e3788
mov edx, eax
lea ecx, [ecx]
cmp esi, edx
add cl, 0xf7
stc
sub eax, 1
jne 0x1010af55
mov dword [edi + 4], edx
cbw
movzx eax, cl
test ah, 0x22
mov dword [edi], eax
jmp 0x100eea71
jb 0x10105276
mov eax, 1
jmp 0x100b162f

Function at 0x100b63da
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0x2bb87086
dec ebp
mov ebx, dword [esi + edx*2 - 0x5770e10c]
inc cx
mov edx, dword [ebx + edx - 0x2bb87086]
push 0xbe179291
neg byte [esp + 1]
dec ecx
add esi, 6
call fcn.10139aff

Function at 0x100b792b
Capabilities:
Encode data using base64

Disassembly:
inc ecx
rol ah, 1
inc ecx
not ah
inc ecx
dec ah
inc ebp
xor cl, ah
dec esi
lea esp, [esp + 0x18]
inc ecx
mov dword [esp], ebp
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x100b81f9
Capabilities:
Encode data using base64

Disassembly:
call fcn.100c0960
push edi
mov edi, 0xb0af85b5
mov edi, dword [esp + edi + 0x4f507a4b]
mov dword [esp], 0xe1d7975d
call fcn.100ce9d4
call fcn.1010476e
mov ebp, esp
ror edx, cl
sub dx, cx
sal dh, cl
sub esp, 0x48
adc cl, 0xb4
movzx edx, si
btr dx, sp
mov ecx, dword [eax + 8]
and dx, dx
mov edx, dword [eax + 0xc]
clc
push ebx
push esi
test ch, 0x1f
xor esi, 0x9d1ddb91
push edi
mov edi, 1
sub si, cx
mov esi, edi
cmp esi, 0xa1ae781
clc
shl esi, cl
mov ecx, dword [eax + 4]
cmp si, 0x802d
xor ebx, ebx
mov dword [ebp - 0x20], edx
test di, 0x128
test di, bp
sub esi, edi
clc
jmp 0x100f0699
mov dword [ebp - 0x44], esi
mov esi, edi
clc
shl esi, cl
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ebx
test al, 0x2b
clc
mov byte [ebp - 1], bl
clc
test di, cx
sub esi, edi
clc
mov dword [ebp - 0x48], esi
mov esi, dword [eax]
test si, di
stc
cmp ax, di
mov dword [ecx], ebx
sbb cx, bx
xchg ecx, ecx
btr cx, 0x89
mov ecx, dword [ebp + 0x14]
test bh, 0xa8
mov dword [ecx], ebx
mov ecx, dword [eax + 4]
rcl ax, 0x88
shr ax, cl
lahf
add ecx, esi
mov eax, 0x300
test al, 0xae
shl eax, cl
test edx, 0x2012070a
jmp 0x100f8d0c

Function at 0x100ba153
Capabilities:
Encode data using xor

Disassembly:
xor dl, bl
pop eax
inc dl
call fcn.100ba284
popfd
ja fcn.100ba153
out dx, eax
invalid

Function at 0x100ba6f1
Capabilities:
Encode data using base64

Disassembly:
push 0xef82cf11
inc cx
mov dword [esi], ecx
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766
Function at 0x100bba5d
Capabilities:
Encode data using base64

Disassembly:
jmp 0x100dcef0
inc cx
mov dword [esi], edx
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x100bc67c
Capabilities:
Encode data using base64

Disassembly:
mov cx, word [eax]
push 0xa905ef05
adc ebp, 2
call fcn.100d5a82
mov ecx, 0x3221f116
inc ecx
mov ebp, dword [esi + ecx - 0x3221f116]
ror ecx, cl
xor cx, cx
dec eax
dec ecx
inc ecx
mov cl, byte [esi + 4]
push 0x7c05dd34
dec ecx
adc esi, 2
sal ebp, cl
inc ecx
mov dword [esi], ebp
jmp 0x1012ec5a
dec eax
lea esp, [esp + 8]
jmp fcn.100da766

Function at 0x100bca98
Capabilities:
Encode data using base64

Disassembly:
inc ebp
xor cl, ah
dec esi
lea esp, [esp + 0x18]
dec eax
and ecx, 0x9336238f
sub ecx, dword [esp + ecx - 0x279]
call fcn.100ebdff

Function at 0x100bcab3
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [esi*4 + 0x100d5c68]
shr edi, 8
xor edi, esi
mov dword [esp], 0xa809e717
inc eax
jmp 0x100f6c80

Function at 0x100bf366
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov cl, byte [esi + 8]
dec ecx
add esi, 6
inc esp
shrd esi, edi, cl
inc ecx
mov dword [esi], esi
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x100bf4bf
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + 8], 0x60a70c02
inc ebp
mov dword [esi], ebx
push 0x6586e19e
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x100c7f78
Capabilities:
Encode data using base64

Disassembly:
dec ecx
adc esi, 6
inc cx
mov dword [esi], esi
push 0xac080888
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x100c8498
Capabilities:
Encode data using base64

Disassembly:
call fcn.100fdec2
push edi
sub dword [ebx], 0x1f
add al, 0xc0
cmp al, bh
invalid

Function at 0x100c9cce
Capabilities:
Encode data using base64

Disassembly:
add di, di
cmp edi, 0x614609d
lea edi, [edx + edx*2 - 0x14fd7974]
jo 0x100c9ceb
mov edi, dword [esp + edx + 0x7bccaaf3]
call fcn.100f37c3

Function at 0x100cbab0
Capabilities:
Encode data using base64

Disassembly:
pushfd
neg byte [esp + 8]
js 0x100fbd53
neg dword [esp + 8]
add dword [esp + 4], 0xefef2b11
cmp dword [esp + 8], 0x9fabcd29
mov dword [esp + 0xc], 0xc5c995d
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.100ce9d4
push edi
insb byte es:[edi], dx
arpl word [0xdc37c4b9], ax
jo 0x100fbddd
jae 0x100fbd93
cmp bh, 0x44
xor eax, 0x26f2b91a
lea esp, [esp + 8]
and al, 8
jmp fcn.100eab55
ret
loopne 0x100fbe0d
movzx ax, byte [esi]
mov edx, 0x9bbc389
shr edx, 0x42
mov dl, byte [edx + esi - 0x26ef0e0]
call fcn.100eb648
imul ebp, dword [0x1e6e9e16], 0x2e9e2a88
into
cmpsb byte [esi], byte es:[edi]
xchg ebp, eax
sbb dword [ecx + 0xd89139d], 0xd86d61a9
sbb byte [edi - 0x6b4b12f1], bl
ljmp 0x1255
fcomp dword [eax]
lahf
paddsw mm6, qword [esp + edx*4 - 0x5793e516]
adc dl, byte [ebp + 0x12]
dec ebx
jmp 0x100fbdcb