joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c87
Capabilities:
Authenticate hmac

Disassembly:
inc edx
dec ebp
arpl cx, cx
setg cl
dec ebp
add esp, ecx
inc ecx
bt ebp, eax
dec eax
lea esi, [esi + eax*4 + 0x7919923c]
dec eax
rol ebx, 0xe1
pop eax
jb fcn.00d45932
mov ax, word [ebp + eax*2 - 0x1312c]
or cl, ch
btc cx, cx
mov dx, word [ecx + ebp - 0x5a2972f4]
jb 0xe3a46f
mov cl, byte [ebp + ecx - 0x5a2972f2]
push 0x482735a4
jae 0xc5aa37
movsx edx, byte [esp + ecx - 0x51df9bc8]
or dx, 0x750e
xor eax, ebx
inc eax
xor eax, 0x3e3ea69e
ror eax, 1
btc ecx, 0x39
lea eax, [ecx + eax + 0x1b5a3071]
rol eax, 2
ror byte [esp + ecx - 0x53df9bc4], 0xe1
shl ecx, cl
ror byte [esp + 3], 0xc1
inc eax
call fcn.00ee12ef
mov eax, 0x7e016b9e
movsx ebp, al
jmp 0x107d2f5
mov esp, edi
sar bp, 0x28
jne 0xce3abc

Function at 0x100507c
Capabilities:
Encode data using base64

Disassembly:
test ecx, ecx
call fcn.00cfe698
mov eax, 0xa1d980a
mov ecx, dword [esi + eax - 0xa1d980a]
call fcn.00d8fdd3

Function at 0x1005094
Capabilities:
Encode data using base64

Disassembly:
cwde
sub ecx, 0xbcb57887
not ecx
inc ecx
xchg edx, eax
rol al, 0x24
and ax, 0x130
xor ebx, ecx
push edx
call fcn.00fee705

Function at 0x1025fdf
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov edi, 0x25b864b5
push edi
pushfd
pop esi
mov dword [esp + edi - 0x25b864b5], esi
jmp 0xf23c52
shl word [esp + 1], 0x44
cld
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp]
bt di, di
mov esi, eax
btr edi, edi
dec edi
mov edi, edx
push 0xd539dd82
jns 0xef0f25
cwde
xor edx, 0x6e03a59a
or cx, cx
mov dword [esp], edi
push esi
jmp 0xdb2a96
Function at 0x103e59f
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
lea ebp, [ecx + ebp - 0x22fcf67e]
sub cx, cx
add cx, cx
mov dword [ebp + ecx*2 - 0x45f7fffc], eax
or cx, cx
mov dword [ecx + ebp - 0x22fc0000], edx
lea eax, [ecx*8 - 0x4acb5d66]
cdq
jns fcn.00cf9758
mov ecx, dword [esi]
add esi, 4
mov eax, 0x703e722e
lea eax, [eax*2 - 0x6ef35d72]
xor ecx, ebx
bswap eax
rol ax, 0x2b
lea edx, [eax*4 - 0x64e16557]
inc ecx
or ax, ax
sar edx, 0x7b
not ecx
ror ecx, 3
sar eax, 0x92
neg ecx
btc eax, edx
rol ecx, 2
xadd al, dl
cwde
xor ebx, ecx
cdq
add edi, ecx
bt dx, 0x2e
xor eax, eax
movzx ecx, dl
mov edx, dword [ebp + eax]
lea eax, [ecx*4 + 0x6a18a317]
mov eax, dword [ebp + eax - 0x6a18a70f]
dec ecx
shl cl, 0x62
or cx, 0x97ab
lea ebp, [ecx + ebp - 0x97f7]
not edx
and ecx, ecx
ror cx, 0xce
not eax
xor ecx, 0xab8aab86
and edx, eax
push ecx
mov dword [ebp], edx
movzx eax, word [esp]
shr ax, 0x68
cdq
mov dword [esp + eax - 0xf4], edi
ret
mov eax, dword [esi + 4]
mov dword [esp], edx
or edx, 0x999bf496
adc esi, 8
pop edx
call fcn.0102d914
sub edi, 4
mov eax, dword [edi]
xor eax, ebx
mov edx, 0x93159b1
dec dl
mov ecx, edx
lea eax, [eax + edx*8 + 0x72f6c0ac]
sar cx, 0x61
neg eax
bts edx, 0xaf
xor dl, 0xbb
dec eax
ror ecx, 4
shl edx, cl
rol ecx, 0xf6
rol eax, 1
xadd ecx, edx
inc cx
xor ebx, eax
add dx, dx
adc esi, eax
add ecx, ecx
rdtsc
neg ecx
jbe 0xfc5b21
push 0x41
add dword [ecx], eax
inc ebp
jge 0x103e620
mov ss, word [0x213cdb9]
mov ecx, 0x100e9783
invalid
lcall 0x276e, 0x9e915b91
pop es
xchg esi, eax
xchg ebp, eax
sub dword [ebp + ebx - 0x4c], 0x3f
jg 0x8f87535e
cmp eax, 0xbc9183d3
shl ch, 1
mov ch, 0xa4
jno 0x103e6ad
mov dword [esp + ecx], eax
outsd dx, dword [esi]
mov ecx, 0xaf916c21
invalid
std
adc eax, 0xfc331fd9
and al, 0x75
test ch, dh
xor byte [ebx], dl
ret 0xc76c

Function at 0x10409cb
Capabilities:
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
shl edx, 2
sub ax, ax
mov eax, ebp
adc eax, edx
push 0x5316f96
sal byte [esp + 2], 0x44
mov dword [ebp - 4], eax
neg dword [esp]
push 0xa91c7f14
test ebx, ebx
push 0x8a07e919
push 0xd827b8bf
jmp 0xbe8715
mov dword [esp + edx*2 - 0x5e5f7c5e], ebp
mov dword [esp + edx - 0x2f2fbe31], ebx
mov ebp, edi
bts dx, 0x1f
movsx ebx, dx
mov ebx, eax
mov edx, ebx
mov eax, 0xbe192b82
jb 0xef9653
inc ebp
mov ebx, ebp
inc edx
mov ebx, dword [esp + eax - 0x43a7ef8a]
inc esi
xor dword [esp + eax - 0x43a7ef86], ecx
dec esi
mov edx, dword [esp + eax - 0x43a7ef86]
dec eax
cdq
inc ecx
movsx ecx, bp
dec ebp
arpl cx, cx
dec edx
mov dword [esp + eax - 0x43a7ef86], eax
dec esi
lea ebp, [ebx*2 - 0x25645e6a]
dec ebp
add esp, ecx
dec eax
mov eax, edi
call fcn.00dd5f35

Function at 0x1057565
Capabilities:
Encode data using base64

Disassembly:
add esi, edx
sal byte [esp + eax - 0x425495d4], 4
pop eax
pop edx
pop eax
pop edx
jae fcn.00cf9758
Function at 0x106d404
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
shl edx, 2
mov eax, ebp
jmp fcn.010667e3
rol ax, 5
lea esi, [esi + eax - 0x5f09005d]
and ax, ax
adc ecx, edx
movsx edx, al
btc ax, dx
btr eax, edx
mov dword [esi + eax - 0x5f090061], ecx
and edx, 0xc9071384
lea edi, [eax + edi - 0x5f090065]
adc dx, ax
dec eax
mov edx, dword [eax + edi - 0x5f090060]
movzx ecx, ax
seta cl
xor edx, ebx
rol ecx, cl
xchg ecx, eax
sbb edx, 0x881194aa
neg edx
call fcn.00e3022b
or ax, word [edi + eax*2 + 2]
ror dx, 1
shl edx, 0x1a
lea edi, [edi + edx - 0x73fffffe]
xor edx, 0xb22bb926
or cx, ax
lea eax, [edx + edx*2 + 0x5ea52100]
not cx
jmp 0xfe2f79
btc dx, 0x8f
sbb eax, 0x3488c90f
mov word [edi + eax - 0x7c9f8362], cx
call fcn.00e1866d
mov dword [esp + edx*2 - 0x32b046], ebx
mov ebx, eax
movzx eax, dx
adc eax, eax
add ax, dx
mov edx, ebx
jb 0xba1648
mov eax, 0x5f09862e
mov ecx, dword [esi + eax - 0x5f09862e]
lea edx, [eax - 0x615a47e4]
shl ax, 0x24
sar ax, 0xd
mov edx, dword [esi + eax - 0x5f08ffff]
btc eax, 0x2b
jae 0xd2b09a

Function at 0x108bb96
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
lea esp, [esp + 8]
je 0xc69662

Function at 0x10926c0
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jne 0xfc6455
jmp 0xcdcb08

Function at 0x10950a2
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov word [ebp + eax*2 - 0xfff90], dx
and ecx, eax
mov dword [esp + eax*8 - 0x3ffe40], eax
mov ecx, dword [edi + eax - 0x7ffc8]
jp 0xf106f2
dec dword [esp + eax - 0x7ffc8]
lea edi, [edi + eax*4 - 0x1fff1c]
movsx edx, word [esp + eax*8 - 0x3ffe40]
cwde
xor ecx, ebx
push eax
cdq
rol ecx, 2
and edx, 0x392951e
pop eax
sal edx, 0x89
bswap ecx
cdq
push edx
add ecx, edx
push edx
cwd
lea eax, [eax + edx*8 - 0x21f90de5]
xor ecx, edx
add edx, edx
bswap ecx
sets byte [esp + 0xb]
shl eax, 0x47
call fcn.00cdcdee
jae 0xca4df2
add esi, ecx
call fcn.00f77662

Function at 0x109a32c
Capabilities:
Encode data using xor

Disassembly:
push 0x36bff408
call fcn.00b90397

Function at 0x109e7a5
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
mov ecx, 0xc5bc0636
bswap eax
inc cl
mov dword [esp + edx - 0x6fbeef33], ecx
jle 0xb817f6
rol eax, 2
neg dx
neg eax
dec eax
neg cx
sar ecx, cl
xadd byte [esp + edx - 0x6fbe10cb], dh
xor ebx, eax
inc cx

Function at 0x10a7604
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
neg eax
sub eax, 0x29a7b8b6
call fcn.00be1730
add byte [eax], al
aas
insb byte es:[edi], dx
jne 0x10a768a
push 0x62243f40
popal
jae 0x10a7688
arpl word [edi + 0x6f], bx
jae 0x10a7698
jb 0x10a768b
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x10a7696
imul esi, dword [ebx + esi*2 + 0x40], 0x74734044
inc eax
inc eax
inc eax
jae 0x10a76b7
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc ecx
inc ecx
push esi
xor dword [edx], esi
inc eax
pop eax
pop edx
add byte [ebx + 0x5b870fd3], cl
sahf
mov dh, 0xff
invalid
add eax, 0x8dffbccc
mov esp, 0xf650fb07
in eax, dx
int3
mov bl, 0xc1
Function at 0x10aa748
Capabilities:
Encode data using base64

Disassembly:
call fcn.00c93db5
or edx, 0x390a699
pop ecx
pop ecx
jns fcn.010cab6a
inc ecx
mov eax, 0xaa311535
inc ebp
movsx edi, al
inc ecx
mov eax, edi
inc esi
mov ebx, dword [ebp + edi*2 - 0x6a]
dec edx
lea ebp, [ebp + edi*2 - 0x66]
inc ecx
mov esi, edi
inc ebp
btr edi, edi
inc ebp
xor ebx, edx
dec esp
lea ecx, [esi - 0xbc888fd]
inc sp
xadd eax, edi
inc ecx
bswap ebx
inc ebp
xchg edi, eax
inc ecx
push eax
inc esi
mov ebp, dword [esp + eax*8 - 0x1a4]
inc ecx
dec ebx
inc ecx
add ecx, 0x75a64a11
dec edx
xchg dword [esp + eax - 0x35], esi
inc esi
xchg dword [esp + eax*2 - 0x68], edi
inc ecx
not ebx
inc edx
shl byte [esp + eax - 0x30], 0x47
inc ecx
xor ebx, 0x2d9907b8
inc ecx
bswap ebx
inc dx
xchg dword [esp + eax - 0x2f], eax
dec esi
mov dword [esp + eax - 0x35], edx
inc esi
xor dword [esp + eax*4 - 0xd4], ebx
inc ecx
pop edx
inc ecx
not ebp
dec ebp
arpl bx, bx
dec ecx
sal ecx, 0xf9
dec ebp
adc esp, ebx
dec ecx
rol edi, 0x2f
mov edx, esi
inc ebp
mov ebp, dword [eax + edi - 0x35]
inc esi
mov eax, dword [edi + eax - 0x31]
jae 0xf5b7a7

Function at 0x10b1c2e
Capabilities:
Encode data using base64

Disassembly:
setns byte [esp + ecx - 0x32000000]
xchg word [esp + ecx*2 - 0x63ffffff], ax
rol dx, 1
neg dword [esp + ecx*2 - 0x64000000]
sar eax, 0x45
adc ecx, ecx
sbb dx, cx
shl cl, cl
xor eax, 0x462df0b4
not dx
cbw
xor dx, 0xe096
add dx, 0x3a26
sal ecx, cl
xor dword [esp], ecx
adc dword [esp], ecx
xor bx, dx
pop eax
shl ecx, 0x37
push ecx
lea esi, [ecx + esi - 0x4000002]
sbb cl, al
rol dword [esp + ecx - 0x4000001], 0xbd
adc cx, word [esp + ecx - 0x4000001]
mov word [ecx + esi - 0x4000001], dx
sal dword [esp + ecx - 0x4000001], cl
pop ecx
jg fcn.00e4ff8e
push eax
jmp 0x10ce8bc
lea esp, [esp + 0xc]
je 0x10ce8c3
mov eax, 0xf885afa2
mov eax, dword [ebp + ebx*4]
jmp 0xc59498
dec ebx
jne 0x10b1c38
push 0xfa32dc2b
push 0x10bf261d
mov eax, dword [esp]
mov eax, dword [ebp + eax*2 - 0x217e4c3a]
call fcn.010df014
mov edx, 0x683a6192
movzx ebx, dl
or ebx, 0xcb8cb69e
mov esp, edi
lea ebx, [edx + edx + 0x6b820528]
lea esi, [edx + edx*8 + 0x700309a9]
lea ebp, [esi*2 - 0x564f57c2]
pop edi
cmovs si, bx
and edx, ebp
shr edx, 0x81
pop edx
pop esi
lea eax, [ebp*2 + 0x55a339b7]
pop eax
bt ebp, ebp
pop ebp
jae 0xc1deac
mov ecx, ebx
shl ebx, cl
popfd
not bl
pop ebx
pop ecx
call fcn.00fb7bcb
mov edx, 0x26072289
movzx edx, byte [esi + edx*2 - 0x4c0e4512]
add esi, 1
mov eax, 0x35133222
rol al, 0xc1
neg eax
xor dl, bl
rol dl, 1
and ax, 0x8ca5
lea eax, [eax*4 - 0x7247335d]
dec dl
cwde
bts ax, ax
neg dl
call fcn.00ba8b9b

Function at 0x10b2a82
Capabilities:
Encode data using xor

Disassembly:
inc dword [esp]
test ebx, ebx
lea esp, [esp + 4]
je 0xe34c17
mov dword [esp], 0x1d9b6508
xor edx, 0x7a42a91
call fcn.00f92f30
mov eax, ebp
add eax, edx
sal dword [esp], 0x65
mov dword [ebp - 4], eax
jns 0xf7e209
Function at 0x10be795
Capabilities:
Encode data using xor

Disassembly:
call 0xd96d56
inc cx
neg edi
inc eax
neg dh
dec eax
lea esi, [ecx*2 + 0x45bfcdb4]
inc cx
ror edi, 1
inc cx
sub edi, 0xc74ae795
test byte [eax + 0x4ffdcdb], cl
mov al, byte [0x45665426]
xor edx, edi
shr ecx, 0xae
ja 0xc037cb
dec edx
lea edi, [edi + ecx - 0x8c92a]
inc edx
sar byte [esp + ecx*2 - 0x11924b], 0xc4
pop esi
dec esp
lea ebp, [edx + ecx*2 - 0x1f50fbd9]
inc bp
mov dword [ecx + edi - 0x8c928], edi
inc ecx
bswap ebp
push esi
inc ecx
mov esi, dword [ecx + ebp - 0x8c928]
dec esp
lea eax, [ecx*2 + 0x60bf7b28]
dec edx
lea ebp, [ebp + ecx - 0x8c924]
inc ecx
xor esi, edx
xor esi, 0xae10a1bf
call fcn.0106fb8e

Function at 0x10c142e
Capabilities:
Authenticate hmac

Disassembly:
xor edx, ebx
mov dword [esp + ecx - 0xc000], ecx
lea edx, [edx + ecx*2 - 0x19899833]
rol edx, 1
shr cl, 0x64
sbb edx, 0xc18e9287
rol edx, 1
dec edx
sal ecx, 0x3a
and eax, ecx
jns 0xc866a9

Function at 0x10c9b29
Capabilities:
Encode data using xor

Disassembly:
or cl, 0x1f
not al
bswap ecx
or cl, ch
pop ecx
xor al, 0x84
mov ecx, dword [esp + 8]
inc byte [esp + ecx - 0x7901bfdf]
not ecx
add al, 0x89
call fcn.00bcbfb7

Function at 0x10cabad
Capabilities:
Execute syscall

Disassembly:
xor ebx, ecx
shr word [esp + eax - 0x11f7], 0xe6
add ebp, ecx
call fcn.00e43dd3
mov eax, 0x6031d980
movsx edx, ax
movzx ecx, al
mov edx, dword [eax + ebp - 0x6031d980]
sal eax, 0x5c
xor al, byte [edx + eax]
ror ecx, 0x4d
lea ebp, [ebp + ecx*8 - 0x1ffffffe]
adc cl, ch
movsx edx, cl
mov word [ebp + ecx*2 - 0x8000000], ax
ror cx, 0x48
setbe cl
mov eax, 0x8412d3ad
mov ecx, dword [esi + edx*8]
not dx
btc edx, 0xb
cwd
lea esi, [esi + edx - 0xfffb]
ror edx, 0x1e
xor ecx, ebx
or dl, 0x38
not ecx
and eax, 0xe7964f3c
xor ecx, 0x8139329e
bt ax, ax
btr edx, edx
sub edx, eax
not ecx
btc edx, edx
xor ecx, 0xc3a335a1
sal edx, 0x63
xor ebx, ecx
call fcn.010d6f2e
syscall
call fcn.00e37c12
push 0xb39c2a05
mov ecx, dword [esi]
mov eax, 0x6110a9b1
mov edx, dword ss:[ecx + eax - 0x6110a9b1]
movsx ecx, word [esp + eax - 0x6110a9b1]
xchg word [esp + ecx - 0x2a04], cx
dec cx
mov dword [eax + esi - 0x6110a9b1], edx
dec word [esp + ecx - 0x9c28]
mov ecx, dword [eax + ebp - 0x6110a9b1]
bt ax, ax
lea ebp, [ebp + eax - 0x6110a9ad]
xor ecx, ebx
sub al, 0xb4
inc ecx
add al, ah
movzx edx, al
add al, 0x9b
neg ecx
bts ax, dx
dec word [esp + eax - 0x6110a940]
inc ecx
push edx
shr dl, 5
not ecx
ror al, 0x47
not eax
xor ebx, ecx
cwde
add edi, ecx
btc edx, eax
movsx ecx, ax
mov dword [esp + ecx - 0x567d], edi
ret 4
dec al
mov dword [esp + eax - 0x1200], 0x8f354099
xor ecx, 0x2f32c52a
mov dword [esp + eax - 0x11fc], 0x180f9fa7
neg ecx
lea edx, [eax*4 + 0x7c23bf17]
jmp 0xc5c7f3
Function at 0x10cd80a
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
sar esp, 0xd6
invalid
sbb eax, 0x14bd5e85
sbb al, 0xc8
lea edx, [ebx]
imul ebp, dword [ebx + 0x18], 0x77
cmc
std
sub byte [eax - 0x7e], dh
inc edi
jns 0xe9d064
sbb edx, ecx
dec ecx
jle 0xe9d05c
in al, dx
sbb dl, bl
jp 0xe9d04a
pop ds
lodsd eax, dword [esi]
rol byte [0x35563416], 0x11
inc ebx
cmc
mov al, byte [0x9063dd75]
jb 0xe9cfb2
fld st(1)
jnp 0xe9d03f
dec edi
int1
jl 0xe9d054
fsubp st(4)
ret
les esp, [ebx + 0x3acd8df2]
mov ebp, 0x28c74dca
scasb al, byte es:[edi]
rcl dword [ecx + 0x18], cl
test eax, 0xa049eba4
cmp eax, 0x4aa7797d
jns 0xe9cfd6
dec edx
mov byte [edi + ebp*4 - 0x39], dh
push ds
inc esp
test al, 0xb0
movsb byte es:[edi], byte [esi]
adc eax, 0x253229a1
cmpsb byte [esi], byte es:[edi]
pop esi
xchg ecx, eax
mov al, 0xc2
rol byte [edi], 0x80
lds esi, [edi + 0x2eccd1bd]
sub esp, ecx
retf
int3
sub al, 0xcc
jae 0xe9d016
xchg esi, eax
popfd
jp 0xe9d083
add byte [ebp + 0x38a3507d], ch
sbb esi, ecx
xor eax, 0x8fb91e08
pop ecx
pop ss
and byte [ecx], bl
imul edx, dword [eax], 0x3a21ba57
xor ecx, ecx
mov edx, 0xc9333a21
rol dl, 0x61
mov edx, dword [edi]
xor edx, ebx
call fcn.00edfa54
test edx, edx
call fcn.00ecd731
shr al, cl
test al, 6
add eax, dword [eax]
push ds
aas
cmp bh, bh
std
xor al, 0x53
pop ecx
or bh, byte [ecx + eax*2 + 0x7f]
add dword [ebp + 0x517dede], ecx
jg 0xe9d02d
xchg edx, eax
pop es
jnp 0xe9d110
and bh, byte [esi]
xchg edi, eax
add esp, dword [esi + 0x6d]
inc esp
add eax, 0x988eeaa9
sti
invalid
invalid
shr al, 0xe2
inc ecx
add edx, 0x97a43411
btc dx, ax
jae 0x10853c8
syscall
pushfd
dec eax
mov dword [esp], 0x38100362
call fcn.00dd142f
bswap ecx
not ecx
pop eax
btr eax, eax
xchg dword [esp], edx
neg ecx
lea edx, [eax*2 + 0x7826b5bf]
xor ebx, ecx
cwd
add esi, ecx
movzx ecx, dl
pop edx
neg cl
mov dx, word [ebp + ecx*4]
mov ax, word [ebp + ecx + 2]
adc ecx, ecx
shr ecx, 0x22
ror cl, 0x27
or cl, byte [ecx + ebp + 4]
call fcn.010ddd07
sub edi, 4
mov eax, 0xd435a79c
movzx edx, ax
cwde
mov ecx, dword [edi + edx - 0xa79c]
cwde
cwde
btr dx, 0x27
xor ecx, ebx
sal al, 0xc4
inc ecx
cdq
rol dl, 6
xadd al, ah
bswap ecx
ror ecx, 1
sub eax, edx
sal ax, 0x45
js 0x10e2a96
lea ecx, [ecx + eax - 0x3a61adc4]
cdq
ror ecx, 1
xor ebx, ecx
sar ax, 0x24
sbb ebp, 4
bt eax, 0x88
dec edx
cbw
mov dword [ebp], ecx
sbb edi, 4
btr ax, 0x3c
not eax
mov eax, dword [edi + eax*8 - 0x8178]
xor eax, ebx
rol eax, 1
movzx ecx, dx
inc ecx
xor eax, 0x8c3a99a2
inc edx
bswap edx
rol eax, 3
sal dx, 0x63
neg edx
push ecx
inc eax
sar dx, 0x8f
xor ebx, eax
add esi, eax
push ecx
or edx, edx
pop eax
pop edx
jp fcn.00cf9758
salc
dec esi
out 0xfe, al
adc eax, 0x71c3997c
mov ebp, 0x6f6b2880
mov al, 0xd
or edx, dword [ecx + 0xa4bfea6]
mov eax, 0xd3f3256f
mov word [edx + 0x36], fs
cmp ecx, dword [ecx - 0x74416e53]
test eax, 0xb342c26e
invalid
add word [esp + 5], dx
cwd
not ecx
mov dword [esp], eax
jle 0xf51de4
sub edi, 4
jmp 0xe9d070
Function at 0x10ce968
Capabilities:
Encode data using base64

Disassembly:
inc edx
add edi, eax
mov dword [esp + edx*2 - 0xafd0046], 0x6f928da3
mov edx, dword [ebp + ecx*2]
add ecx, dword [ebp + ecx + 4]
mov eax, 0x52a32ab1
lea ebp, [ebp + eax - 0x52a32aad]
and edx, ecx
not edx
shl al, 0xc6
push eax
movsx ecx, byte [esp + eax - 0x52a32a3c]
mov dword [eax + ebp - 0x52a32a40], edx
call fcn.00e81c7a

Function at 0x10ce9a6
Capabilities:
Encode data using base64

Disassembly:
push 0x4942e27
call fcn.00e2f76a
syscall
inc ecx
push ecx
dec eax
mov dword [esp], 0x38ecd674
call fcn.00dd142f

Function at 0x10dcdd9
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], esi
jmp 0xf01430
push 0x2e3e2880
mov dword [esp + 4], edi
push 0xf0b4af12
jmp 0xfc2935
Function at 0x76e353
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x75484b
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x754865
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x754854
pop esi
jmp 0x754870
ret 4
lea esp, [esp + 4]
jmp 0x75483e

Function at 0x83f883
Capabilities:
Packed with generic packer

Disassembly:
call fcn.0083f08e
push dword [esp + 3]
mov byte [esp + 2], ah
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x83f8d9
mov eax, dword [eax + 0xc]
jmp 0x83f8c3
mov eax, dword [eax + 0x1c]
jmp 0x83f999
mov eax, dword fs:[0x30]
jmp 0x83f895
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x83f089
Function at 0x4015f0
Capabilities:
Extract resource via kernel32 functions
Get hostname

Disassembly:
push ecx
push 0x42a2f8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
ret
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4233b8
push eax
mov dword fs:[0], esp
sub esp, 0xd84
cmp dword [0x848528], 0x5b1
push ebx
push esi
push edi
jne 0x4016b9
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push 0
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea esi, [ebp - 0x34]
call fcn.00401c40
push 0
mov dword [ebp - 4], 0
call fcn.00403afc
push 0
push 0
call fcn.00403950
add esp, 0xc
call fcn.0040370a
jmp 0x4015e0
mov eax, dword [0x429370]
mov dword [0x84852c], eax
mov eax, dword [0x848528]
add eax, 0x1134b
push eax
push 0
mov dword [0x848528], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x847478], eax
call fcn.00401520
mov edi, dword [sym.imp.GDI32.dll_GetDeviceGammaRamp]
xor esi, esi
lea ecx, [ecx]
cmp esi, 0x2710
jge 0x401703
lea ecx, [ebp - 0x590]
push ecx
push 0
call edi
inc esi
cmp esi, 0x18ea14c
jl 0x4016f0
xor esi, esi
cmp dword [0x848528], esi
jbe 0x401768
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [0x84852c]
mov al, byte [edx + esi + 0x1134b]
mov ecx, dword [0x847478]
mov byte [ecx + esi], al
cmp dword [0x848528], 0xa8
jne 0x40175f
push 0
lea edx, [ebp - 0x10]
push edx
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x190]
push eax
call ebx
inc esi
cmp esi, dword [0x848528]
jb 0x401722
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
jmp 0x401780
mov ecx, dword [0x848528]
add ecx, esi
cmp ecx, 0xe
jne 0x4017ac
push 0
push 0
push str.juxaxisofun
call edi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
inc esi
cmp esi, 0x39621
jl 0x401780
call fcn.00401460
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
call edi
cmp esi, 0x26
jne 0x4017ce
call fcn.00401500
inc esi
cmp esi, 0x6753f
jl 0x4017c2
mov esi, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov ebx, dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [ebp - 0x10], 0x7b
cmp dword [0x848528], 0x86
jne 0x40182c
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xd90]
push eax
push str.zofirajohukaseviheza
call esi
push 0
push str.zajivazegecolojokateweyehenesa
push str.wedihofipepowexohogokozazotahejojeberaxipemobu
call edi
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
sub dword [ebp - 0x10], 1
jne 0x4017f0
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x364a92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x364b67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x364b31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x364b5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00364b71
test eax, eax
je 0x364b67
add ebx, 0x14
jmp 0x364b3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8