joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe310ee
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub ax, dx
adc ebp, ecx
movsx ecx, al
lea ecx, [esi + eax - 0x194d]
rol al, 0x62
shr dl, 0x45
mov dword [esi + eax*2 - 0x327c], ecx
lea esi, [esi + eax*8 - 0xc9ea]
shr eax, 0x10
jae fcn.00c575b7
xor ebx, ecx
sub al, 0x22
jge 0x99aa40
mov edx, 0x2729cbb9
movzx ecx, dl
movsx eax, cl
lea ebp, [ebp + edx*2 - 0x4e539776]
idiv cl
mov eax, dword [ebp + ecx*4 - 0x2e4]
xor eax, ebx
lea eax, [eax + edx*8 - 0x761e94b4]
imul dx, dx
rol eax, 3
btr cx, cx
neg dl
inc eax
or cx, dx
xor eax, 0x650db833
lea eax, [eax + ecx - 0x51b6d784]
not cx
neg dl
neg edx
xor ebx, eax
not edx
sal dl, 0x26
adc edi, eax
lea edx, [ecx + ecx*4 + 0x4912dc21]
mov eax, 0x8c2cd8b6
lea eax, [edx + edx*8 + 0x351e0824]
mov eax, dword [ecx + esi - 0x1400]
mov ecx, dword [esi + edx - 0x4913401d]
rol edx, 0x85
shr dl, 1
shr edx, 0xc6
push ebx
movsx ebx, dl
cpuid
jnp 0xebe577
mov dword [esp], edx
push edx
mov edx, dword [edi + 4]
mov eax, 0xd7b76d8f
add ax, ax
shr byte [esp + 7], 0xa6
not ecx
cwde
not edx
sub dword [esp + 4], 0x25b2963a
and al, ah
sub ax, word [esp + 3]
and ecx, edx
lea edx, [eax + eax*2 - 0x17fead4a]
bt eax, 0x85
mov dword [edi + 4], ecx
jae 0xdc5c04
mov ecx, 0x3628c495
mov edx, dword [esi + ecx - 0x3628c495]
lea eax, [ecx + ecx*4 - 0x71d3e279]
shl ecx, cl
xor cl, byte [esi + 4]
dec ax
shr edx, cl
mov dword [esi + 2], edx
mov ecx, dword [edi]
ror eax, 0x32
inc eax
adc edi, 3
movzx edx, al
sub dx, 0xc71c
xor ecx, ebx
shl eax, 0x4e
adc al, dh
lea ecx, [ecx + eax + 0x3b9d86f]
neg ecx
inc ecx
shl eax, 0xb9
cbw
ror ecx, 1
imul edx
dec ecx
ror ecx, 1
xchg edx, eax
sub ecx, 0x9b303d89
jmp 0xd82330
call fcn.00daf183
xor byte [edi], 0x99
fiadd word [0xb1224a90]
mov dl, 0x7d
mov byte [edx + 0x22], cl
mov cl, 0x92
imul eax, dword [eax - 0x614eddb6], 0x73528077
mov cl, 0xb2
pop es
add byte [edi], 0x61
movsd dword es:[edi], dword [esi]
popfd
xchg dword [edx + 0x74], esi
in eax, 0x6e
pop edx
xor byte [ebx + 0x539f4458], cl
pop edx
inc eax
push edi
mov ecx, 0xb1b60105
lea eax, [ecx*2 + 0x2e8bef15]
imul eax, ecx
sbb esi, 3
and ecx, ecx
mov edx, dword [esi]
shl eax, 0xc8
push eax
xor edx, ebx
bswap edx
inc dword [esp]
ror eax, 0x81
xor edx, 0x8fb9f42b
dec ecx
xor ax, 0x60af
dec edx
neg al
cmovae eax, ecx
cwde
rol edx, 1
neg eax
jle 0xc7a6bc
Function at 0xe3124d
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions

Disassembly:
sub ecx, 0xc20f3680
lea eax, [eax + ecx*2 + 0x7a4cfda4]
dec ecx
not eax
lea eax, [ecx + eax + 0x12b580b9]
mov edx, dword [esp + ecx*2 - 0x7be192f8]
sar dword [esp + ecx*2 - 0x7be192f9], cl
shr dl, 0x26
bswap eax
xchg edx, ecx
xadd dword [esp + ecx*4 - 0x4bfff4], ecx
jbe 0xee237c
xor eax, 0x2f8284ab
inc edx
inc eax
btr ecx, edx
call fcn.00e85318
mov edx, 0x5292863f
movzx eax, dl
not eax
mov ecx, dword [esi + edx - 0x5292863f]
movzx edx, byte [edx + ebp - 0x52928640]
shl al, 7
neg al
xor dl, bl
sal ax, 0x28
lea eax, [eax + eax - 0x7b7d3c41]
not dl
adc dl, 0xaa
inc eax
lea eax, [eax*8 - 0x545291c8]
ror ax, 0x81
not dl
add ax, ax
xchg ah, al
inc dl
jmp 0xea986a
btc eax, eax
btr ax, ax
xor bl, dl
idiv al
push eax
lea edx, [esp + edx + 4]
xchg dword [esp], eax
mov dword [edx], ecx
mov edx, eax
jmp 0xdbe7ec

Function at 0xe32837
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], edi
jmp 0xc779df

Function at 0xe36de6
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov word [esi + eax*8 + 2], cx
call fcn.00c988b1
neg al
add al, 0x98
xor al, 4
mov edx, 0x5facc324
add al, 0x21
xor bl, al
lea ecx, [edx + edx*8 + 0x20343105]
xchg edx, ecx
add eax, esp
sub cl, dl
dec edx
jb 0xf31252
mov dword [esp + 4], edx
xor dword [esp + 4], edx
not cx
pop edx
mov edx, dword [esp]
or ax, cx
movsx ecx, dx
not dword [esp + edx]
xor ecx, ecx
mov word [esi + edx + 2], ax
movzx eax, dx
not edx
mov edx, dword [ecx + esi + 2]
jge 0xe96e8c
inc edx
neg cx
xor ebx, edx
inc byte [esp + ecx - 0x10bffe]
and al, ch
adc ebp, edx
add byte [esp + ecx - 0x10bffd], 0x2e
mov dword [esp + ecx*2 - 0x218000], ebp
ret
mov edx, 0xd6bb9910
btc dx, dx
not ax
jae 0xdbc093
push 0x759f7a12
lea esp, [esp + 4]
call eax
mov edx, 0xa1bae93d
mov ebp, dword [ebp - 4]
ror dl, 0x87
movzx ecx, dl
mov dword [ecx + ebp - 0x7a], eax
mov esi, ebp
push ecx
shl byte [esp + ecx - 0x79], 0xe3
mov ebx, dword [esp + ecx - 0x76]
movsx ebp, dl
mov ebp, dword [esp + ecx - 0x72]
jnp 0x9593e9
lea eax, [edx + 0x7008929c]
xor byte [esp + ecx*4 - 0x1e8], al
mov edi, dword [esp + ecx*2 - 0xe8]
mov dword [esp + ecx*2 - 0xe8], 0xe3308113
or dword [esp + ecx - 0x7a], ecx
inc edx
mov dword [esp + ecx - 0x7a], ebp
ret 0xc
pop ecx
mov cl, byte [eax + esi + 6]
sal edx, cl
or eax, eax
movzx ecx, al
mov dword [eax + esi + 4], edx
lea edx, [eax + eax*2 + 0x422a579b]
shl dl, 0x42
shl ecx, 0xa1
or cx, word [ebp + eax*2 - 2]
shr eax, 0x13
xor cx, bx
imul dl
xor cx, 0x7eb6
xor al, 0x20
ror edx, 0x2f
dec cx
sar dl, 0xe4
and dx, dx
sub dx, ax
neg cx
add eax, eax
seto al
and ax, dx
not cx
inc cx
sal edx, 0xa6
inc dx
not dx
xor bx, cx
jmp 0xdb0c6b
Function at 0xe3e784
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [edx]
mov edx, dword [esp + 4]
mov dword [esi - 4], ecx
setae dl
mov edx, dword [edi + 1]
xor dword [esp + 4], 0x5a0c3798
mov dword [esp], 0x2dbf8eb0
xor edx, ebx
inc edx
dec al
neg edx
or dword [esp + 4], 0x1736e891
sbb edx, 0x88920a33
rol eax, 0x31
neg edx
cwde
cbw
inc edx
inc byte [esp + eax - 0x1d]
lea ecx, [eax*2 - 0x40dd7076]
xor ebx, edx
and dword [esp + eax - 0x1c], 0x90b536a9
adc ebp, edx
movzx ecx, word [eax + edi - 0x1b]
shl ax, 6
or dword [esp + eax - 0x7fe], eax
dec dword [esp + eax*2 - 0xffe]
lea edi, [edi + eax*8 - 0x3ff9]
cwde
xor word [esp + eax*2 - 0xffa], 0x4298
ror al, 0xa7
xor cx, bx
or eax, 0xbd32d710
adc cx, 0x3114
ror cx, 1
add al, byte [esp + 6]
not cx
inc cx
xor bx, cx
btr ax, 0x96
mov word [esi - 6], cx
movzx edx, al
sar eax, 0x29
lea esi, [esi + edx*2 - 0x180]
or dl, 0x90
jbe 0xeae346
pop eax
pop eax
js fcn.00ec5123
bswap edx
xor ecx, ebx
idiv ax
call fcn.009a2c2b

Function at 0xe4c66f
Capabilities:
Encode data using xor

Disassembly:
call fcn.00e48680
dec ecx
shl esi, 0xbb
dec ecx
add ebx, edi
neg ax
jmp 0xea1d1d
inc sp
xor edx, eax
dec ecx
bts esi, edi
dec ecx
xor ebp, ebx
inc dx
mov dword [esi + edi - 0x30], eax
inc esp
mov ebp, ebx
shr bp, 0xce
adc ecx, edx
dec edx
lea esi, [esi + edi*2 - 0x62]
inc ebx
mov ebp, dword [esp + edi*4 - 0xce]
dec edi
lea esp, [esp + edi*8 - 0x196]
dec ecx
adc ebx, 0xce0d4d33
inc ecx
movzx eax, si
inc eax
setae bh
inc ecx
xor ebp, edx
inc ecx
xor edx, ebx
div bl
inc cx
and eax, 0xf581772d
scasb al, byte es:[edi]
mov ah, 0x27
jae 0xea1d30
jmp 0xea1d98
retf
inc esi
cdq
dec ebp
inc ecx
bt ebp, ecx
jae 0x9b5622

Function at 0xe7692b
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x14]
jne 0xc8cd8a
Function at 0xe7caef
Capabilities:
Encode data using xor

Disassembly:
not dl
add edi, eax
imul dx, cx
lea edx, [edx + ecx - 0x44e38d61]
movzx eax, cl
jmp edi
inc ecx
inc esi
dec eax
arpl ax, ax
dec esp
adc ecx, eax
inc ecx
ror bl, 0x24
dec esp
lea edi, [ebx + ecx*4 + 0x350db89b]
dec esp
mov dword [esp + edx], ecx
ret 0x18
mov dword [esp + ecx - 0x1f37f790], edx
mov dword [esp + ecx - 0x1f37f794], ecx
mov eax, dword [esp + ecx - 0x1f37f794]
push dword [esp + 4]
popfd
cdq
dec eax
push eax
lea esi, [ecx + esi - 0x1f37f798]
imul byte [esp + ecx*2 - 0x3e6fef27]
sub ax, word [esp + ecx*2 - 0x3e6fef24]
add edx, dword [esi + ecx*4 - 0x7cdfde50]
ror dword [esp + ecx*4 - 0x7cdfde4e], 0xe5
ror cl, 0xc1
neg byte [esp + ecx - 0x1f37f747]
xor edx, ebx
not word [esp + ecx - 0x1f37f746]
lea edx, [edx + eax*2 + 0x6dc50f2d]
xchg byte [esp + ecx - 0x1f37f749], ah
sal eax, 0x4c
js 0x97e159
dec esp
fst dword [eax]
nop
shl dword [esi + 0x2b], 0x84
dec esp
fcom qword [eax]
nop
rol dword [ebx], 0x94
invalid
shl dword [esi - 9], cl
xchg esp, eax
or al, 0xba
or al, cl
loopne 0xe7cad3
xchg esp, eax
inc edx
sub eax, 0x866dc50f
movsb byte es:[edi], byte [esi]
or al, 0xb7
or al, cl
loopne 0xe7cb15
invalid
xor edx, 0x5d23ef0d
xor word [esp + ecx - 0x1f37f744], ax
neg edx
dec eax
lea edx, [edx + ecx*4 + 0x2dcadf4]
call fcn.009a31c5
add eax, 0xcd1b0612
xchg edi, ebx
lea ebx, [edx - 0x850fea0]
lea ebx, [edx - 0x5008cea0]
lea ebx, [edx - 0x3c20baa0]
dec ebx
scasd eax, dword es:[edi]
lcall 0xaf4b, 0xc3df4560
pushal
dec edx
std
mov ebp, 0x1fed581d
mov dword [0x90622c00], eax
pop edi
ror dword [eax], cl
add byte [edi], cl
pushal
jno 0xe7cb3c
outsd dx, dword [esi]
nop
lds eax, [ebx - 0x23a2c960]
lds eax, [ebx - 0x33b27d60]
lds eax, [ebx - 0x739e3d60]
pop ss
mov edx, 0xe807e8a0
jnp 0xe7cb8d
cld
inc dword [ecx + 0x1b]
invalid

Function at 0xe9051d
Capabilities:
Encrypt data using chaskey
Manually build aes constants

Disassembly:
and ecx, edx
dec dword [esp + 1]
idiv byte [esp + 6]
xchg dword [esp + 4], eax
mov edx, ecx
bts eax, eax
sub al, ah
mov eax, dword [esi + 8]
setne byte [esp + 1]
inc word [esp]
pop ecx
adc edx, eax
neg cx
jnp 0xe1edb1
sal dx, cl
lea ecx, [eax*4 - 0x72dd38f8]
mov word [esi + eax*2], dx
mov ecx, dword [eax + ebp]
imul eax
shl ax, 0x65
lea ebp, [ebp + eax*2 + 4]
sal edx, 0x6e
sal dl, 0xe4
xor ecx, ebx
ror ecx, 3
cbw
sal dx, 0xf
add ax, 0x6988
adc ecx, 0xd391f397
add edx, eax
neg ecx
bswap edx
lea ecx, [ecx + edx + 0x73c04389]
xchg al, dl
neg ax
ror ecx, 1
lea edx, [edx*8 - 0x6ed17a5c]
lea ecx, [ecx + edx - 0x3eba2435]
dec eax
xor ebx, ecx
or edx, 0xdb853932
sar dx, 0xca
adc edi, ecx
movzx ecx, ax
jmp edi
not edx
mov dword [esp], 0x972ff131
jp 0xe6e3f9

Function at 0xeaa6e4
Capabilities:
Encode data using xor

Disassembly:
push 0x292c1907
mov dword [esp + 4], 0x402b9a20
add edi, edx
call fcn.00cca5fc

Function at 0xeae339
Capabilities:
Encode data using base64

Disassembly:
rol dl, 1
bswap ecx
bswap eax
xchg byte [esp + ecx - 0x60c5b367], al
inc dl
rol ecx, 0x31
not dl
sar eax, 1
mov dword [esp + ecx - 0x66dcc18b], ecx
neg dl
btr eax, eax
xor bl, dl
ror eax, 0xe9
shl al, 0x22
xchg byte [esp + ecx - 0x66dcc184], ah
lea edx, [esp + edx + 8]
shl eax, 7
Function at 0xeae3b7
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x3af47239
call fcn.00f2f912

Function at 0xec04e5
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions

Disassembly:
xor word [esp + 7], cx
adc ebp, edx
movzx eax, byte [edi + 4]
pop edx
sub edi, 0xfffffffb
rol dl, 0xe2
xadd dx, cx
jnp 0xdb25bf
xor al, bl
inc al
xor al, 0xb
add al, 0x20
mov word [esp + 1], cx
rol al, 1
sal cl, 0x43
xor bl, al
mov word [esi - 6], ax
movzx eax, byte [esp + 2]
and eax, 0x6a04fc3c
neg cx
lea esi, [esi + eax*8 - 0x1e6]
pop eax
pop edx
jne fcn.00c575b7
mov ecx, 0x3217b430
add ecx, ecx
mov ecx, dword [ebp + ecx - 0x642f685c]
jne 0x926a62
sub edx, 0x9b303d89
or dword [esp + 4], ecx
rol cx, 0x81
push ecx
xor ebx, edx
jmp 0xe169e4

Function at 0xed9cea
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions
Parse pe header

Disassembly:
xor edx, edx
test ecx, ecx
jmp 0xe04a0b
sub al, 0x21
sar cx, 0x2d
xor al, 1
imul cx, word [esp + ecx*4]
xor dword [esp + ecx*2], 0xf26738e
xor bl, al
call fcn.00e08f0d
mov ax, word [edi]
mov ecx, 0xd5015504
mov cl, byte [edi + 2]
mov edx, 0x60a68688
lea edi, [edx + edi - 0x60a68686]
shr ax, cl
jmp 0xd08d40
mov eax, 0x7f06b629
lea ecx, [eax + eax + 0x6a908dba]
lea eax, [ecx + ecx*2 + 0x5b0f9e93]
not edx
mov dword [esi + ecx - 0x689dfa0c], edx
movsx edx, cl
mov eax, dword [edx + edi - 0xc]
dec edx
xadd edx, ecx
jns 0xe1f3cd
mov dx, word [esi]
add esi, 2
push 0x1786f115
movzx eax, byte [edi]
mov ecx, 0xe617088e
shr cl, 0xe3
lea ecx, [ecx - 0x2c7f2854]
adc edi, 0
xor al, bl
rol al, 1
inc al
or cx, word [esp]
xor ecx, ecx
not al
mov dword [esp + ecx*2], ecx
sbb al, 0xd
ror dword [esp + ecx*2], 0x4d
neg ecx
xor al, 0x99
jmp 0x9aed42
jmp 0xe21cc3
lea esp, [esp + 4]
je 0xcd5135
push 0xd68a321d
push 0xf53cb33c
mov dword [esp + 4], esi
lea esp, [esp + 4]
mov esi, 0xa9b31721
movzx esi, byte [eax]
xor esi, edx
push 0x1117220c
call fcn.00f14df3
mov ecx, 0x67393414
mov eax, ecx
mov eax, dword [ecx + esi - 0x67393414]
mov cl, byte [esi + ecx - 0x67393410]
add esi, 2
mov edx, 0xc1a3b1a4
shr eax, cl
call fcn.00f08ef9
dec ebp
arpl bx, bx
dec ebp
add ecx, ebx
inc ecx
mul eax
dec edx
mov ebx, dword [esi + ebp - 6]
dec eax
rol edi, cl
inc edx
mov edx, dword [esi + ebp*2 - 4]
neg ax
dec edx
lea esi, [esi + ebp*8 - 0x24]
inc ecx
not dh
inc edx
mov dword [ebx + ebp*2 - 0xc], edx
dec esi
lea eax, [ebp*4 - 0x16f5f3c9]
inc ecx
jmp ecx
jmp 0xd0fcc3
lea edi, [edi + ecx*2 - 0x12]
xchg cx, dx
xor eax, ebx
xor cx, cx
not eax
or edx, ecx
rol eax, 1
shl dl, 0x82
add ecx, ecx
ror cl, 0xc6
lea eax, [eax + edx*2 - 0x4938c455]
adc cx, 0xfa94
bts cx, 0xa6
bswap eax
dec edx
rol dx, 0x2e
xor cl, dh
xor eax, 0x1bae3e28
dec edx
shl edx, cl
xor ebx, eax
not dx
add ebp, eax
imul cx, dx
movsx eax, cx
cwde
jmp ebp
mov word [edi + edx - 0x60a68688], ax
lea eax, [edx*4 - 0x37d6fd48]
or dx, 0x735
lea esi, [esi + edx - 0x60a687c1]
movzx ecx, dx
not eax
xchg cx, dx
mov ecx, dword [esi + edx - 0x60a687bd]
xor ecx, ebx
ror ecx, 1
call fcn.00c5ce02
jmp 0x965b9f
Function at 0xedda2b
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor

Disassembly:
xor bl, al
rol ecx, 0xc1
lea edx, [ecx + ecx*4 + 0x181cdb8a]
ror dword [esp + 4], 0x8b
sbb esi, 2
bts ecx, 0x39
rol cl, 0x86
imul edx, dword [esp + 4]
mov word [edx + esi - 0x53d14412], ax
call fcn.00e4202a

Function at 0xee382a
Capabilities:
Encode data using xor

Disassembly:
movsx edx, di
mov ecx, 0
sub ebx, ecx
lea esp, [esp + 4]
mov edx, 0xa60dfcab
movzx ecx, dx
movzx edi, cx
lea edi, [0xee3838]
lea ebp, [ebp + ecx*8 - 0x7e55c]
xadd ecx, edx
mov edx, dword [ebp + edx*8 - 0x7e558]
movsx eax, cl
dec ecx
or al, ah
dec dword [edi]
mov esi, 0xc40a49c1
xor edx, ebx
btr eax, eax
sub eax, ecx
sbb eax, 0xe52ac4ac
sbb edx, 0xdb07a024
or al, cl
call fcn.00c56f69
inc edx
imul esp, dword [ebx], 0xd566dbde
add al, byte [eax + 0x3566ecae]
mov dword [0x66ecaeb0], eax
add eax, 0xecae388a
xlatb
inc dword [edx + 0x69]
and ebx, esi
invalid
in al, dx
add ax, 0x388a
scasb al, byte es:[edi]
in al, dx
lea di, [edx + 0x66ecae18]
lodsd eax, dword [esi]
sti
enter 0xffffffffffffecae, 0x66
jge 0xee3859
call 0x5e552552
inc edx
and byte [esi - 0x106a9914], ch
cmp byte [eax - 0x4c], ah
inc ebx
stosd dword es:[edi], eax
mov ebp, 0x997e8362
push 0x3f51737
ror dword [ebx], 0xfe
xor byte [bp - 0xa4d], dh
jge 0xee3876
stc
jp 0xee3913
int1
loope 0xee3889
into
xchg ecx, eax
ficomp dword [0x91ce9f38]
invalid
clc
mov edi, 0x66ecaf2d
cwde
scasd eax, dword es:[edi]
mov ebp, 0x866ecaf
daa
inc ebp
scasd eax, dword es:[edi]
in al, dx
invalid

Function at 0xf02a20
Capabilities:
Execute syscall

Disassembly:
inc ebx
mov edi, dword [esi - 0xc0]
inc ecx
xor edi, edx
mov ebx, 0xf10e9400
bswap edi
dec edi
neg ebx
inc esi
movzx ebp, word [esp + esi - 0xb0]
ror edi, 1
not edi
dec esi
mov dword [esp + esi - 0xb4], edx
inc esp
mov edi, ebx
inc cx
sar eax, 0xc5
dec esi
mov dword [esp + esi - 0xbc], ebp
inc edx
xor dword [esp + esi*4 - 0x2e8], edi
dec esi
mov edx, dword [esp + esi*2 - 0x170]
dec eax
arpl di, di
jmp 0xf06c6e

Function at 0xf09abe
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
add dword [esp + eax - 0x60df3c6e], 0x3cbde828
pop eax
sbb edx, 0xa39831ad
add ax, ax
imul ecx, ecx
and ecx, eax
rol edx, 1
not ecx
call fcn.00cba2b0
mov eax, 0xc8a7331e
shr eax, 0x58
or al, al
mov edx, dword [eax + esi - 0xc8]
lea ecx, [eax + eax*4 - 0x2453f3f4]
lea esi, [eax + esi - 0xc4]
lea ecx, [eax*8 + 0x42b478ae]
ror ecx, cl
bts cx, cx
xor edx, ebx
rol ax, 0xc
jae 0xce9515
movzx eax, cl
lea ecx, [edi + ecx - 0x51b0c0b5]
imul al
xchg edx, eax
mov dword [esp + edx - 0x14d1], edx
mov edx, ecx
movsx ecx, al
dec eax
mov cx, word ss:[edx + ecx*4 - 0x1bc]
mov word [eax + edi - 0x60df3c6e], cx
lea edx, [eax*2 + 0x22baf126]
rol dword [esp + eax - 0x60df3c6e], 0x9a
lea ecx, [eax + edx*8 + 0x1b030e88]
mov edx, dword [eax + esi - 0x60df3c6e]
ror byte [esp + eax - 0x60df3c6c], cl
lea esi, [eax + esi - 0x60df3c6a]
btc cx, cx
setb byte [esp + eax - 0x60df3c6c]
jae 0xcae4da
Function at 0xf14dc5
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions
Parse pe header

Disassembly:
inc edx
mov ecx, dword [edi + ecx - 0x7002e222]
mov dword [esp], ebx
movzx ebx, dl
lea ebx, [edx + ebx*8 + 0x43292924]
push ebx
cpuid
rol byte [esp + 1], 0x64
sbb edi, 7
neg byte [esp + 1]
jp 0xc7d279

Function at 0xf14df3
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Encrypt data using rc4 ksa
Execute anti-debugging instructions
Parse pe header

Disassembly:
inc eax
xor edx, 0x7a19c8b0
shl dword [esp], 0x68
sal byte [esp + 2], 0xa6
dec ecx
lea esp, [esp + 0xc]
jne 0xd0fcdf
mov esi, 0x6c060893
bswap esi
sal esi, 0x1d
pop esi
mov eax, dword [esp + eax*4 - 0x1d58c]
lea esp, [esp + 0x28]
ret
and esi, 0xff
mov esi, dword [esi*4 + 0x99cea4]
shl byte [esp + 6], 0x24
je 0xe5509c
sar dword [esp + 4], 0x31
shr edx, 8
xor edx, esi
push 0x212686
ror byte [esp + 1], 6
jb 0xcd510e
mov ecx, 0x956408
dec esp
lea ebx, [ecx + ecx*4 - 0x57edf4e2]
dec eax
mov edx, dword [esi + ecx - 0x956408]
mov edi, 0xbb385739
inc esp
sub bl, bh
inc ebp
movsx esi, bl
inc ebp
mov dh, byte [esp + ecx*4 - 0x2559021]
inc ebp
xor dh, dl
inc ebp
movzx ebp, bl
inc ecx
dec dh
dec esp
lea eax, [edi*2 - 0x675b5ec5]
inc ecx
not dh
inc ebp
imul ebx, ebp
dec ebp
lea edi, [ebp - 0x39d8e579]
inc ebp
xor dh, al
mov eax, 0x24b95d1f
inc ecx
btr eax, 0x87
or cl, 3
inc ecx
ror dh, 1
call fcn.00d9d0c4

Function at 0xf28330
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x18]
jne 0xca9915
pop ebx

Function at 0xf29f0d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
xchg edx, eax
mov ecx, 0x3b122c8d
lea eax, [esp + edx - 0xa8dfec]
ror ecx, cl
movzx cx, byte [eax + edx*4 - 0x2a38000]
lea eax, [edx + edx*4 - 0x3dd504e1]
sar ax, 0x42
mov word [edi + edx*4 - 0x2a38008], cx
and dword [esp + edx*4 - 0x2a37ffa], 0x9bb4dbd
cwde
lea edi, [edx + edi - 0xa8e008]
pop eax
pop ecx
pop ecx
pop edx
pop ecx
jae fcn.00db3d8b

Function at 0xf29fad
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
add ebp, ecx
and byte [esp + edx*4 - 0x401647f1], 5
neg ax
pop eax
pop edx
pop eax
pop ecx
jnp fcn.00ec5123
cwde
adc edi, 3
mov dword [esp], eax
bts edx, eax
cwde
xor ecx, ebx
shr edx, 0x73
neg ecx
or edx, 0x9037a506
rol ecx, 1
ror dx, 0x46
sbb dx, 0x382c
add dword [esp + 8], edx
inc ecx
sal dl, 0x86
rol ecx, 2
not eax
sar dword [esp + eax*2 - 0x73fe], 0xa3
xor ecx, 0xce26998a
sal eax, 0xaa
add ax, word [esp + eax - 0xe7fbff]
sar dword [esp + eax - 0xe7fbf5], 0x48
neg ecx
and edx, 0x3a05d1a0
xor ebx, ecx
xadd word [esp + edx - 0x1005bffe], dx
jo 0xc5cde6
mov word [esp + 4], ax
mov edx, dword [esp + 0x14]
bswap ecx
sbb ecx, 0xecbcd839
not ecx
dec dx
sar dword [esp + edx*4 - 0x3ffec], 0xfe
call fcn.00dc98cf
mov ecx, 0x28f2c97
mov eax, ecx
xchg ah, al
mov edx, dword [esi + ecx*2 - 0x51e592e]
dec al
call fcn.009b7e7c
Function at 0xf2ad08
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
xor edx, 0x1e1ad595
call fcn.00e572ad
test byte [eax + 0x51], cl
push esp
mov edi, 0xc8c1101
adc ah, byte [edi]
sub dword [ebx + 0x120cb4c1], 0x27
sub dword [ebx - 0x7300993e], 0xc
adc al, 0x27
sub dword [ebx - 0x9927cd], 0xffffffca
add esi, eax
or cl, 0x2c
adc byte [esp + ecx - 0x547cd8ee], 0x1a
mov word [esp + ecx - 0x547cd8ed], dx
mov dword [esp + ecx - 0x547cd8ee], esi
ret
inc edx
not eax
jge 0xdd8fe0
push esp
jg 0xf21433
invalid
mov dword [esp + ecx*4 - 0xe000000], edx
xchg dx, cx
lea eax, [eax + ecx*8 - 0x569d75e1]
inc dl
jge 0xf21472
sub eax, 0x319ca38c
js 0x974a15
rol ecx, 1
lea eax, [eax + eax*8 - 0x7eedc95f]
cwd
jmp 0x969cc1

Function at 0xf2f912
Capabilities:
Encode data using base64
Encode data using xor
Execute syscall

Disassembly:
xadd al, ah
bswap edx
sar al, 0x21
dec edx
sal cx, 0x2a
shl ax, 0x2b
not edx
xor eax, ecx
cwde
xor ebx, edx
lea ecx, [ecx + ecx*8 - 0x3b6e00d1]
sar ecx, cl
add esi, edx
bswap ecx
movsx edx, al
xor eax, edx
mov eax, dword [edi + eax*4 - 0xa000]
or edx, dword [edi + ecx - 0x35ffffc]
rol ecx, 0x73
or cl, byte [edi + ecx*4 - 0x6bf8]
add edi, 6
call fcn.00968a53
je 0xced2c1
pop edx
jno fcn.00c796c8
xchg esi, eax
sub al, 0x15
push ebp
mov bl, byte [ecx + eax*8 - 0x4e]
test dword ss:[edx + 0x36de7974], ecx
test dword [edx + 0x36da5d18], ecx
test dword [edx + 0x5cf1f095], ecx
or al, 0x79
mov al, 0xe3
pop ebx
or ecx, dword [ebx + 0x78e2c5ac]
and al, 0xd4
mov edx, 0xc55348f7
mov dword [ebp + 0x1343cc23], esp
test dword [ebp - 0x5d], ebp
and ecx, esp
inc ebx
adc edx, dword [ecx - 0x2e]
invalid
push ecx
mov ecx, 0x6a004284
not cl
not cx
inc ecx
push esp
inc ecx
mov esp, 0x4ab38c20
push ecx
dec esi
mov dword [esp - 0x4ab38c20], ebx
dec esp
lea esp, [ecx*8 + 0x71e0298]
inc ecx
push ebp
pushfd
inc ecx
mov ebp, 0xc6b0a9bc
inc ecx
shl ah, cl
dec ecx
or ecx, ebp
push edx
inc cx
sal esp, 0xa8
inc ecx
push edx
dec ecx
imul ecx, ebp
inc esp
mov edx, ecx
inc ecx
push ecx
inc ecx
push ecx
inc cx
not edx
inc ecx
push esi
inc ecx
inc edx
inc ecx
and ecx, edx
inc ebp
movsx esi, sp
push esi
push edi
dec eax
lea esi, [esp - 0x18]
jnp 0xd16657
movsx ecx, dl
mov cl, byte [esi + edx*2 - 0x70510f46]
shr eax, cl
movsx ecx, dl
mov dword [esi + edx - 0x382887a3], eax
not edx
mov eax, dword [ebp]
bswap edx
dec dx
xor eax, ebx
inc eax
xchg edx, ecx
xor ecx, 0xb61d9b04
bswap eax
sar edx, cl
inc ecx
rol cl, 0xa7
sbb eax, 0x2980a00c
lea edx, [edx*8 - 0x2ddbedf7]
not eax
ror eax, 2
rol dx, cl
bswap edx
sub cx, cx
xor ebx, eax
shr edx, 0xf9
dec ecx
bts dx, cx
adc edi, eax
not edx
lea eax, [edx + ecx + 0x2432e29a]
shr eax, 0x57
mov eax, dword [ebp + eax*8 - 0x104]
ror edx, 0x7b
lea edx, [ecx + edx*8 - 0x53ea3453]
adc ebp, 7
xor eax, ebx
push edx
not cl
ror eax, 1
shl ecx, 0x48
dec eax
sal cl, 0xc1
shr byte [esp + ecx - 0x64ff0000], 0x41
mov word [esp + ecx - 0x64ff0000], cx
bswap eax
rol eax, 3
btc cx, 0x3d
and dword [esp + ecx - 0x64ff2000], 0x4c3800ac
push ecx
xor ebx, eax
xchg edx, ecx
mov dword [esi + edx - 0x64ff2002], eax
pop eax
inc ecx
lea esi, [esi + eax - 0x64ff2002]
jp 0xdc43a4
xor eax, ebx
call fcn.00988f35
Function at 0xf364cd
Capabilities:
Encode data using base64

Disassembly:
dec edx
not edx
sal ecx, 0x6b
call fcn.00eb03d9
dec esp
mov edi, dword [esi]
dec eax
mov ebp, dword [esi + 8]
mov ecx, 0xc7abe484
inc esp
movsx esi, cx
call fcn.00e8be87
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x46f31f13
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1ca939ab
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219