joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4acb50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5351e8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x4acb89
inc eax
mov dword [esi + 0x10], eax
jmp 0x4acc9c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x4acb9d
mov eax, 0xffffffc7
jmp 0x4acc9e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x4acbae
cmp dword [esi + 8], eax
jne 0x4acb9d
cmp dword [esi + 8], eax
jne 0x4acbc7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x4acbc7
mov eax, 0xffffffc7
jmp 0x4acc9e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x4acbdb
push eax
mov ecx, ebx
call fcn.004ac380
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.004769e0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x4acc0c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00476a00
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.004abaf0
test eax, eax
mov dword [esp + 0x38], eax
je 0x4acc3f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x11343f8
call fcn.00476be0
mov eax, dword [esp + 0x38]
jmp 0x4acc9e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.004ac9b0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x4acc83
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.004ac9d0
mov esi, eax
test esi, esi
jne 0x4accb3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.004ac9b0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x4acc55
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x11343f8
call fcn.00476be0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x11343f8
call fcn.00476be0
mov eax, esi
jmp 0x4acc9e
Function at 0x4bc480
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x535b48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x538674]
push 0
lea ecx, [esp + 0x20]
call fcn.0052db76
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.004bbdd0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0052daa4
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0052a368
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0052a368
push 1
push 0
push 0
mov ecx, esi
call fcn.0052a310
push 1
push 0
push 1
mov ecx, esi
call fcn.0052a310
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0052dbe8
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4bc600
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x535b68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0052db76
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.004bbdd0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0052daa4
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x538674]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x4bc6c4
cmp dword [esp + 0x40], 1
jne 0x4bc6c2
cmp ecx, eax
jge 0x4bc6c4
mov eax, ecx
cmp eax, 0xc8
jge 0x4bc6d0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.004bc480
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x538670]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0052dbe8
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x4bcec0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x535c13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00528788
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x5380d8]
push eax
mov ecx, edi
call fcn.0052de1e
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0052f33a
test eax, eax
je 0x4bcfdc
mov ecx, dword [esp + 0x3c]
call fcn.0052de4b
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x538694]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4bcfa0
push edi
mov ecx, esi
call fcn.0052b4b3
mov ecx, esi
call fcn.004bd180
cmp dword [esp + 0x38], 1
jne 0x4bcfd5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0052b5ee
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x4bf1c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4bf1f3
push esi
call fcn.004cd450
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4bf1ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4bf279
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4bf262
mov eax, dword [esi + 8]
test eax, eax
je 0x4bf217
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4bf25e
cmp eax, 2
je 0x4bf262
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4bf20a
cmp eax, 3
je 0x4bf23d
cmp eax, 1
jne 0x4bf20a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4bf20a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4bf20a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004bf2a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4bf288
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004bf2a0
add esp, 4
pop esi
ret
Function at 0x4e0ba0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x1162994]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4e0bb3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4e0bf4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x1162a3c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4e0c26
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4e0c2a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4e0c1b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4e0c48
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4e0c4c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4e0c3d
xor ecx, ecx
mov eax, 0x11629a4
xor ebx, ebx
mov bl, byte [ecx + 0x1162a4c]
cmp byte [esp + ebx + 0x14], 0
je 0x4e0c77
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x1162a64]
cmp byte [esp + ebx + 0x14], 0
je 0x4e0c8e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4e0c5e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4e0be7
lea edx, [esp + 0x84]
push edx
call fcn.004e0cd0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4eedf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x11b8abc]
xor edx, edx
cmp eax, edx
jne 0x4eee16
xor eax, eax
mov byte [eax + 0x11b89bc], al
inc eax
cmp eax, 0x100
jl 0x4eedfe
mov dword [0x11b8abc], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x11b89bc
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4eeea7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4eee7a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4eee48
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4eef20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4eef73
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4eef5a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f58f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5368fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004f6210
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x113a644
call fcn.00526eee
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4f5983
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00526eee
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4f597c
push 0
mov ecx, eax
call fcn.004eca20
mov dword [esi + 0xc], eax
jmp 0x4f5985
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4f5985
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x505fdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x5060fd
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x5060e1
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x506033
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x506011
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x11d54c0
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x152f255
je 0x12412c7
push ebx
call fcn.00470ff1
add esp, 4
cwde
pop eax
jmp 0x14151fc
mov dword [ebp - 0x10], eax
cwde
mov eax, eax
lea eax, [ebp - 0x10]
jmp 0x133d443
call fcn.00470ff1
lea esp, [esp + 4]
not ebx
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x12772ba
push ebx
call fcn.00470ff1
add esp, 4
sub ax, dx
mov eax, dword [ebp - 0x14]
adc bx, 0x167d
push eax
sbb ebx, 0x1ba70bff
mov ebx, dword [0x117e29c]
test ebx, ebx
jmp 0x12412b7
call fcn.0042f9fb
mov dword [ebp - 0x14], eax
ror ebx, 0x30
mov ebx, dword [ebp - 0x10]
test esi, edi
test ebx, ebx
jmp 0x1454db6
call fcn.00470ff1
lea esp, [esp + 4]
mov eax, dword [ebp - 0x14]
sar bh, 0x5e
ror bx, 0xe2
not bh
push eax
mov ebx, dword [0x117e2a0]
test ebp, 0x44d5443c
cmp di, cx
test ebx, ebx
jmp 0x1482a4d
je 0x1512268
push ebx
jmp 0x151225c
push eax
jmp 0x153136a
push eax
mov eax, 0xf4313f
jmp 0x126b135
push eax
push 0x117e2dc
jmp 0x15c884f
push eax
cwde
lahf
lea eax, [ebp - 0x14]
jmp 0x13d5d39
mov ebx, dword [ebp - 0xc]
test ah, 0xfc
cmp dl, dh
test ebx, ebx
je 0x12a0429
push ebx
jmp 0x12a0420
mov dword [ebp - 0x18], eax
lahf
lea eax, [ebp - 0x18]
jmp 0x13a4b6a
push eax
jmp 0x43afc1
call fcn.00470ff1
add esp, 4
movzx ax, dl
movsx ax, ah
movsx eax, bp
pop eax
jmp 0x15aac0a
mov dword [ebp - 0x10], eax
jmp 0x14d2997
mov dword [0x117e29c], eax
movsx ax, cl
mov ah, bl
setg ah
mov dword [ebp - 4], 0
movsx ax, bl
cbw
push 0
lahf
cwde
movsx eax, bx
push dword [ebp - 4]
cwde
mov dword [ebp - 8], 0
push 0
movzx ax, cl
cwde
mov ax, 0x7311
push dword [ebp - 8]
cmovo eax, ebp
movsx eax, ax
mov eax, 0xf43147
mov dword [ebp - 0xc], eax
jmp 0x15ba97a
mov dword [ebp - 0x10], eax
xchg al, ah
lea eax, [ebp - 0x10]
jmp 0x137967a
test ebx, ebx
jmp 0x12a2216
je 0x13b44bd
push ebx
jmp 0x1487c4b
je 0x12772a3
push ebx
jmp 0x1277298
je 0x13de228
push ebx
jmp 0x13de215
call fcn.00470ff1
lea esp, [esp + 4]
and bh, 0xc
movsx bx, bh
jmp 0x13b44bd
call fcn.0042f9fb
mov dword [ebp - 0x14], eax
shr ebx, cl
neg bl
mov ebx, dword [ebp - 0x10]
test ebp, ecx
jmp 0x159514e
push eax
movsx eax, dx
xchg al, ah
movzx eax, di
mov eax, 0xf4314f
jmp 0x143376d
push eax
movzx eax, bp
mov eax, 0xf4312f
jmp 0x13e2205
lea eax, [ebp - 0x10]
push eax
push 0x117e2dc
jmp 0x1291d38
call fcn.00470ff1
add esp, 4
mov ebx, dword [ebp - 0xc]
jmp 0x1446776
call fcn.00470ff1
add esp, 4
movsx eax, dx
lahf
mov eax, 0x53fe10
jmp 0x13be289
push 0x81a303a5
call fcn.0158a536
mov dword [ebp - 0xc], eax
jmp 0x1552dcd
push 0x117e2dc
jmp 0x14b9a6c
lea eax, [ebp - 0xc]
jmp 0x14bf688
test ebx, ebx
jmp 0x145b15c
mov dword [0x117e2a0], eax
setle al
movsx ax, dl
mov dword [ebp - 4], 0
push 0
movsx ax, bh
push dword [ebp - 4]
mov eax, edi
movsx eax, ax
mov dword [ebp - 8], 0
lahf
movsx ax, bh
not eax
push 0
push dword [ebp - 8]
bswap ax
cwde
mov eax, 0xf43137
jmp 0x15b35ea
mov dword [ebp - 0xc], eax
mov eax, edi
cmovns eax, ebx
lea eax, [ebp - 0xc]
jmp 0x1347496
je 0x1509876
push ebx
jmp 0x150986e
lea eax, [ebp - 0xc]
jmp 0x14bb2d9
call fcn.0042f9fb
mov dword [ebp - 0x14], eax
clc
or bl, cl
neg bh
mov ebx, dword [ebp - 0x10]
test ebx, ebx
jmp 0x15b3ea7
Function at 0x11d8c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x11d8d1c
test eax, eax
je 0x11d8d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x11f3fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x11d8d03
lea edi, [eax + 4]
jmp 0x11d8c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x11d8c7c
mov dword [ebp - 4], 2
jmp 0x11d8c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x11d8c93
mov dword [ebp - 4], 1
jmp 0x11d8c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x11d8d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x11d8cd6
mov byte [ecx], 0x3d
jmp 0x11d8ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x11d8ced
mov byte [ecx], 0x3d
jmp 0x11d8cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x11d8c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x121c37b
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0x150568b
nop
jmp 0x415b70
push ebp
movzx ebp, si
mov ebp, esp
cmc
clc
sub esp, 4
jmp 0x14ff161
nop
jmp 0x156484d
nop
jmp 0x1598289
nop
jmp 0x1240598
nop
jmp 0x1392379
nop
jmp 0x123dc51
nop
nop
nop
jmp 0x1217f7d
nop
jmp 0x11d7812
Function at 0x13736fd
Capabilities:
Packed with generic packer

Disassembly:
mov edx, 5
setae dl
bswap dx
xchg dx, dx
mov edx, 5
movsx dx, dl
cmovg edx, eax
pop edx
jmp 0x146e7a0
call fcn.00470feb
add esp, 4
btr edi, 0x10
mov dword [ebp - 4], eax
mov ebx, eax
xchg cx, di
mov edi, eax
bsf ecx, esp
movsx ecx, bp
sub eax, eax
mov ecx, 0x1e25553d
mov ecx, 0x18
jmp 0x12efba5
mov ecx, 9
jmp 0x154818c
jmp 0x1505c55
call fcn.00470ffd
cmp dword [ebp - 0x14], esp
je 0x1491522
push 0x6a
push 0x40676d6
jmp 0x127776c
push 6
jmp 0x149151a
rep stosd dword es:[edi], eax
test edx, 0x29c7150d
clc
cmc
add ebx, 0x1c
push ebx
jmp 0x148e4d1
push ebp
bt bp, 0x25
mov ebp, esp
cmc
sub esp, 0x1c
jmp 0x14035fb
nop
nop
jmp 0x139d5e4
nop
jmp 0x1464831
nop
jmp 0x1506ab1
push 0x60
jmp 0x12130fb
mov eax, 1
movsx edx, di
mov esi, 0x7b60077f
mov eax, 2
mov eax, 4
cwd
mov eax, 2
movzx dx, ch
cwd
mov eax, 5
mov eax, 4
movsx ebp, cx
not esi
lahf
mov eax, 2
mov eax, 5
movzx ax, bh
rdtsc
mov eax, 6
cwd
movzx ecx, dx
movzx dx, ch
popal
jmp 0x1573f7f
nop
jmp 0x14e07e4
fninit
mov dword [ebp - 0x14], esp
nop
movsx eax, sp
push 0
not eax
cmovne eax, esi
push 0xffffffff
mov eax, 0x1a
jmp 0x1264bfd
push ebx
jmp 0x14c82f8
push 0x24
jmp 0x1558649
call fcn.00470ff7
add esp, 0xc
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
setno ah
cbw
mov dword [ebx], 0x10007
mov ah, bh
mov dword [ebp - 0x14], esp
movsx ax, cl
movzx eax, ax
mov eax, 0x27164912
mov eax, dword [ebp - 4]
jmp 0x14e5f1d
call fcn.00470feb
add esp, 4
xchg ebx, edi
pop ebx
mov ecx, 0x13ab6d27
cmovb esi, esp
mov dword [ebx], eax
mov edi, eax
mov esi, esi
mov esi, 0x53ec9b
lodsd eax, dword [esi]
stosd dword es:[edi], eax
bswap eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
shl cx, 0x1a
sub eax, eax
mov ecx, 0x14
cmovb bx, cx
setp bh
rep stosd dword es:[edi], eax
not bx
jmp 0x15433ba
push 0x58
jmp 0x14bf61b
pushal
jmp 0x1429543
push eax
jmp 0x40a7d8
nop
nop
nop
jmp 0x1382dfa
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
jmp 0x1250d0f
nop
jmp 0x1542423
nop
jmp 0x15ddcf8
mov dword [ebp - 8], 0
jmp 0x14f9e80
nop
jmp 0x13cb684
pop ebx
jmp 0x1517cd3
rep stosd dword es:[edi], eax
add ebx, 0x1c
jmp 0x1488818
call fcn.00470feb
add esp, 4
add cl, ah
pop ebx
sbb di, ax
push ebx
setae ch
sar cx, 0xf0
mov dword [ebx], eax
test esi, 0x2d0c0433
bt di, 0xa8
rol ebx, cl
mov ebx, eax
mov edi, eax
sub eax, eax
jmp 0x122eaee
push edx
cdq
mov edx, 1
movsx edx, dx
movzx edx, di
mov edx, 2
mov edx, 4
mov dx, bx
mov edx, 2
movsx edx, bx
mov edx, 5
cwd
cdq
not dl
mov edx, 4
mov edx, 2
jmp 0x11d39f6
nop
jmp 0x14f034b