joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003358c
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x10033862
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x72d024c2
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x72cf9488
push 0xffffffffffffffff
call fcn.1002a78c
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x100335f6
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.1003360e
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x10033856
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x1003382a
Function at 0x1004305c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1004307e
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1004307e
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1004307e
ret
cmp word [ebx + 4], 0x14c
jne 0x1004307e
test word [ebx + 0x16], 2
je 0x1004307e
test word [ebx + 0x16], 0x100
je 0x1004307e
cmp word [ebx + 0x18], 0x10b
jne 0x1004307e
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1004307e
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1004310a
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1004309e
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.10029fe9
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1004307e
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x1004310a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1004307e
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1004307e
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1004307e
ret
cmp word [ebx + 4], 0x14c
jne 0x1004307e
test word [ebx + 0x16], 2
je 0x1004307e
test word [ebx + 0x16], 0x100
je 0x1004307e
cmp word [ebx + 0x18], 0x10b
jne 0x1004307e
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1004307e
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1004310a
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1004309e
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.10029fe9
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1004307e
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x100431c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1004321a
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100431c1
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100431d0
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10448e73
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10043221
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1002a097
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100432c0
add edi, 4
add eax, 2
dec ecx
jne 0x10043206
call 0x1004326d
loope 0x10043263
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100432bd
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100432ce
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10043281
cmp eax, ecx
ja 0x10043281
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1004330b
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10043301
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1002a576
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x100431d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1004321a
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100431c1
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100431d0
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10448e73
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10043221
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1002a097
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100432c0
add edi, 4
add eax, 2
dec ecx
jne 0x10043206
call 0x1004326d
loope 0x10043263
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100432bd
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100432ce
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10043281
cmp eax, ecx
ja 0x10043281
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1004330b
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10043301
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1002a576
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x40cbc7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41a2f8
call fcn.00413724
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41b69c
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41b754
push 4
mov ebx, 0x41b68c
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00403291
mov dword [esi + 0x3c], 0x41b804
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00403291
mov dword [edi], 0x41b80c
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c1be
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c1be
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c1be
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c1be
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c1be
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x412ff0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.0041468e
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413018
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413027
mov eax, 1
ret 4

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x646b566b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x115a2e45
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x74c046
Capabilities:
Encode data using xor

Disassembly:
jae 0xd64b20
mov eax, 0xd23089ad
add esi, 4
movsx ecx, al
xadd eax, ecx
adc al, ah
xor edx, ebx
ror edx, 1
and eax, ecx
not edx
add eax, eax
sal eax, cl
bts ecx, 3
ror edx, 1
cbw
rol ecx, 0x6e
neg edx
xor ebx, edx
add cl, al
adc edi, edx
dec cx
js 0xda938d
mov bp, word [ebp + eax*2 - 0x44d20000]
jg fcn.0081f8e9
call fcn.0097e2db
pop edx
pop edx
jne fcn.00828bba
jae 0x8d2357
movzx edx, cx
xor eax, ebx
shr edx, 0xeb
neg eax
bswap ecx
sub cx, dx
xor dx, dx
dec eax
neg edx
adc ecx, edx
neg eax
lea eax, [eax + edx + 0x2cb54f23]
xchg ecx, edx
and cx, 0x3403
dec cx
ror eax, 2
dec cx
add edx, ecx
push ecx
xor ebx, eax
not byte [esp + ecx - 0xfffe]
add ebp, eax
movsx eax, word [esp + ecx - 0xfffe]
sal ax, 9
lea esi, [esi + ecx*8 - 0x7fff4]
setae dl
neg al
btc edx, eax
mov ecx, dword [esi + ecx - 0xfffe]
xor ecx, ebx
or eax, 0x95a89a2c
neg ecx
lea ecx, [eax + ecx - 0x43c911a6]
bswap ecx
rol ecx, 1
push edx
not ax
btr eax, 6
xor ebx, ecx
sal dword [esp + 1], 0xb5
sar dword [esp + 4], 2
sbb edi, 3
add edx, 0xd257612
mov dword [edi], ecx
movsx ecx, byte [esp + 4]
xadd dword [esp + 4], eax
js 0x9046bf
mov edx, dword [ebp]
movzx ax, byte ss:[edx]
push 0xef9b2c18
rol word [esp + 1], 0xa2
mov ecx, 0xcba766b1
adc ebp, 2
lea edx, [ecx + ecx*2 + 0x302148bf]
inc dword [esp]
inc edx
mov word [ebp], ax
sub cx, 0xa188
or cl, cl
mov eax, dword [esi]
neg byte [esp]
adc esi, 3
add cl, ch
mov dword [esp], 0x81889bad
xor eax, ebx
call fcn.007a9196
call fcn.0094fddc
xchg esi, eax
in eax, dx
aaa
aaa
cmpsb byte [esi], byte es:[edi]
aas
xor dword [0x87e923f3], 0xedd955e6
cmp eax, 0xf45c1a9a
push ecx
dec ecx
adc cl, ch
fst dword [ebx]
inc ecx
loop 0x914d38
add dword [edx - 0x58994e47], esp
retf
and eax, dword [esi + edx]
invalid
mov dword [esp], 0x860add1e
mov dword [esp], eax
jae 0x914c79
lea ecx, [ecx + edx*2 + 0x548a2a95]
neg ecx
dec eax
rol edx, 0xa7
inc ecx
rol ecx, 1
sar edx, 6
lea ecx, [edx + ecx - 0x5fac3084]
bt eax, 0xb9
ror ecx, 1
neg ax
push edx
bswap ecx
neg dword [esp + edx*2 - 0x800]
xor edx, edx
xor ebx, ecx
shr al, 0x83
sal dword [esp + edx*4], 0xf7
mov dword [esp + edx*4], edx
adc edi, ecx
movsx ecx, dx
add dword [esp + edx*4], edi
ret
Function at 0x75b05d
Capabilities:
Authenticate hmac

Disassembly:
xor eax, ebx
mov dword [esp], ecx
sal cx, cl
sub cx, word [esp + 1]
bswap eax
add word [esp], cx
xor eax, 0x55215e8a
dec eax
rol eax, 3
xor ebx, eax
rol ecx, 0xc1
sar dword [esp], cl
js 0xd545e3
add edi, eax
mov eax, dword [esp]
xor al, 0xa3
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
not dword [esp]
call fcn.0095000e

Function at 0x75b08a
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
pop ecx
mov ecx, 0xf9b04f93
add esi, 6
sal cx, 0x83
jne 0x8a31b4
mov byte es:[eax], dl
and cx, 0x6133
mov eax, ecx
seto cl
sbb ebp, 4
movzx edx, cx
sal dx, 0x28
mov ecx, dword [ebp + edx*2]
xor ecx, ebx
and al, 0x91
neg ecx
xor ecx, 0x299e7215
btc edx, edx
neg ecx
bswap edx
or eax, 0xe107d428
bswap ecx
xchg edx, eax
rol eax, 0xac
xor ebx, ecx
sar dx, 0xc9
jbe 0xa087ea
dec dx
adc edi, ecx
mov ecx, edx
jmp edi
mov dx, word [esi + ecx - 0x5c46697e]
sar ecx, 0x22
mov ax, word [ecx + esi - 0x17119a5d]
or cx, cx
adc cl, 0x95
mov cl, byte [ecx + esi - 0x17119af0]
call fcn.0093ceea
sysenter
call fcn.0096d869
and ecx, 0xd69e8b39
mov eax, ecx
movzx edx, byte [esi + ecx - 0x40218]
xor dl, bl
call fcn.008f4848

Function at 0x76362e
Capabilities:
Encode data using base64

Disassembly:
add ecx, ecx
mov dword [esp], ecx
ror edx, 3
inc al
sar al, 0x21
not word [esp + 1]
xor edx, 0xe72377b1
not eax
sar cx, 0xa1
add ecx, dword [esp + eax - 0x51cb6322]
dec edx
and ecx, ecx
or ecx, ecx
setp cl
ror edx, cl
dec ax
not ecx
xor ebx, edx
mov dword [esp + ecx - 0xd0037fe], eax
add edi, edx
pop edx
bt cx, 0xbc
setae dl
lea ebp, [ebp + ecx*4 - 0x3400dffa]
btr ecx, edx
sar ax, 0x67
sar edx, cl
movzx eax, word [ebp + ecx*2 - 0x1a006ffc]
neg cx
xor ax, bx
sar ecx, cl
shr dl, 1
xor ax, 0x2f02
not cl
neg dl
adc ax, 0xac3a
jmp 0x7f18b3
add ax, 0x8be
bswap edx
xor bx, ax
bt ecx, ecx
sub edx, 0x161ff13d
lea esi, [ecx + esi - 0x3403303]
sub ecx, edx
mov dword [ecx + esi - 0x1961243c], eax
shl edx, 0x3b
ja fcn.00d58d5d
mov ecx, 0xeb910cb6
movzx edx, cl
lea ebp, [ebp + edx*2 - 0x170]
shr cx, 0x21
mov edx, dword [edx + ebp - 0xb6]
mov eax, ecx
xor edx, ebx
btc eax, 0xe
xadd ecx, eax
inc edx
shr cx, 0xcc
bt eax, ecx
not edx
xor ax, ax
call fcn.00810b09
not dx
rol ax, 1
jmp 0x7a3509

Function at 0x779d74
Capabilities:
Execute syscall

Disassembly:
not byte [esp + 5]
push 0x1a87453f
test edx, edx
push 0x6c254303
lea esp, [esp + 0x10]
je 0x941a2b
push 0x81afef96
not word [esp + 2]
rol dword [esp], 0xea
mov dword [esp], ebx
mov ebx, 0x3120443f
push ebx
movzx ebx, byte [eax + ebx*2 - 0x6240887e]
sub dword [esp], 0xf6998a99
xor ebx, ecx
call fcn.0075e23d
adc dl, 0xb8
push eax
sub al, byte [esp + 2]
shl dword [esp], 0xe7
xor dl, 0x26
xchg dword [esp], eax
dec al
btr eax, 0xa5
xor bl, dl
xor word [esp + eax - 0xde], 0x1e3f
lea edx, [esp + edx + 4]
lea eax, [eax + eax*4 - 0x3c4c7de7]
shr eax, 0xd7
mov word [edx + eax*8 - 0xc38], cx
cdq
lea ebp, [ebp + eax - 0x18b]
neg dword [esp + edx*2]
mov ecx, dword [esp + eax*8 - 0xc38]
or edx, dword [ebp + eax - 0x187]
neg ecx
pop ecx
xor edx, ebx
call fcn.00d04bb4
push 0x3b27ce2f
not ecx
call fcn.007382f0
Function at 0x78008c
Capabilities:
Encode data using base64

Disassembly:
inc cl
neg byte [esp + eax*2 + 5]
mov dword [esp + eax*2], eax
not cl
inc ax
and eax, 0x6336038a
rol cl, 1
xor dword [esp + eax + 4], eax
adc cl, 0xe
not cl

Function at 0x796644
Capabilities:
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
push 0x16becbaf
call fcn.00d68c0b

Function at 0x7ad7cf
Capabilities:
Encode data using base64

Disassembly:
mov ebp, 0x80051187
mov ebx, dword [esp + 4]
mov ecx, ebp
mov edx, ebp
call fcn.00a0c508
clc
Function at 0x7cddc0
Capabilities:
Parse pe header

Disassembly:
js 0x92d084
adc ebp, 4
jmp 0x777754

Function at 0x7cfc76
Capabilities:
Encode data using base64

Disassembly:
sal edx, 2
neg eax
bt ax, ax
bts ax, 0x3f
mov eax, ebp
mov dword [esp], 0xbf1db403
rol word [esp], 0x85
call fcn.00794f16

Function at 0x7d3cac
Capabilities:
Encode data using base64

Disassembly:
inc esp
mov edx, edx
sub dword [esp + 1], edx
inc bp
shld esp, eax, cl
sal word [esp + 4], 4
movsx ecx, word [esp + 1]
inc sp
mov dword [edi], esp
dec eax
sbb esi, 4
mov eax, dword [esi]
inc ecx
xor eax, esi
dec eax
rol dword [esp], 0x5c
shr word [esp + 1], 0x4e
bswap eax
call fcn.007b3063
mov edx, 0x8bb7099e
dec eax
mov dword [esp], edx
inc sp
mov esp, dword [edi]
mov ecx, dword [esp + 4]
inc sp
mov eax, dword [edi + ecx*4 + 2]
add cl, byte [edi + ecx + 4]
shl word [esp + 4], 0x63
dec eax
adc edi, 4
jmp 0x7c937b

Function at 0x7d9338
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sbb esi, 4
movzx eax, cx
sal word [esp + eax*2 - 0x1e3a8], 0x6c
mov ecx, dword [esi + eax*2 - 0x1e3b0]
xor ecx, ebx
cwde
and dword [esp + 4], 0x9f98c436
push eax
bswap ecx
bswap eax
call fcn.00751085
movzx eax, si
ror ecx, 0xcf
lea ebp, [ebp + eax - 0x681d]
neg cl
mov esi, edx
lea eax, [eax + eax*8 + 0x7ab33400]
inc eax
add ecx, eax
jb 0x8bdbe8

Function at 0x7d9387
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
or edx, dword [esp + edx - 0xb9e4b90]
or word [esp + edx*2 - 0x173c9722], dx
ror al, 1
neg al
xor bl, al
rol dx, 0x8f
neg dx
setno byte [esp + edx*8 - 0x5cf6d1ac]
lea eax, [esp + eax + 8]
btr edx, edx
mov dword [eax + edx - 0xb9eda36], ecx
push edx
movzx eax, byte [esp + edx - 0xb9eda36]
mov dword [esp + edx - 0xb9eda32], eax
lea ebp, [ebp + edx*2 - 0x173db470]
mov ecx, dword [edx + ebp - 0xb9eda36]
bt dx, 0x3c
call fcn.00905139
syscall
inc ecx
push eax
inc ecx
push edx
dec eax
mov dword [esp + 8], 0x2a1822cb
dec eax
lea esp, [esp + 8]
call fcn.00d3443d
Function at 0x7ed625
Capabilities:
Encode data using base64

Disassembly:
jns 0xd5e6fe
neg edx
not edx
xchg dword [esp + 4], eax
add eax, 0xfff80738
jmp eax

Function at 0x7f18be
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
add ecx, edx
sub ax, ax
ror dx, 0xca
or edx, eax
neg ecx
mov dword [esp + edx - 0x40], edx
lea ecx, [edx + ecx + 0x5b322bf7]
sar al, 0xc6
sal eax, 0x28
xor ebx, ecx
bts dx, ax
add edx, dword [esp + edx - 0x41]
adc edi, ecx
xadd ax, dx
pop eax
jne fcn.00969791
mov dword [esp], edx
dec eax
sal dword [esp], 0x8e
dec ecx
jae 0x89fd90
neg eax
lea eax, [eax + edx - 0x266a4e95]
xor word [esp + 1], dx
add dl, byte [esp + 1]
xor ebx, eax
push edx
xadd dword [esp + 3], ecx
xchg cx, dx
add edi, eax
mov ecx, esi
mov eax, edx
sub esi, 2
rol byte [esp + 6], 0x25
mov word [esi], cx
pop edx
pop edx
jb fcn.00969791
Function at 0x7f41a9
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esi + 4]
mov ecx, 0xe9067707
shl cl, 0xe2
adc esi, 4
or ecx, ecx
adc eax, edx
jmp 0xd358ad
mov word [ebp], ax
btc ecx, ecx
mov dword [esp], ecx
sar edx, 0x71
pop edx
pop edx
pop eax
jbe fcn.00dad269
mov edx, 0x9088878a
xadd dl, dh
mov eax, dword [esi]
jg 0x9930c0
jb 0x7c3700
mov eax, 0x6397661e
lea eax, [eax + eax + 0x1a16d62b]
sub esi, 4
cwde
mov ecx, dword [esi]
lea edx, [eax + eax - 0x44d876f2]
xor ecx, ebx
jmp 0x9c542b
not ecx
xor ecx, 0xc7345713
bts ax, 0x91
push edx
ror ecx, 1
push eax
xadd al, dh
sbb ecx, 0xa61bf07f
jmp 0x9c8dcf
bswap ecx
xor dx, word [esp + 2]
jl 0x73c11b
movsx edx, cx
mov dword [esi + edx - 0x771c], eax
push ecx
not cx
or dl, 0x1a
lea ebp, [ebp + edx - 0x7722]
lea eax, [edx + ecx*8 - 0x1467e4f9]
cwde
call fcn.00976bea

Function at 0x7f4245
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x67b9c119
mov edx, dword [esi]
add esi, 4
mov eax, dword [esp]
lea ebp, [ebp + eax - 0x67b9c11a]
movzx eax, byte [eax + ebp - 0x67b9c119]
mov ecx, 0xc81900bc
jmp 0xd37c95

Function at 0x7f99ff
Capabilities:
Execute syscall

Disassembly:
push edx
not cx
and ax, cx
mov word [esi + edx*2 - 0x52600000], ax
movsx eax, byte [esp + edx - 0x29300000]
lea ebp, [ebp + edx*2 - 0x52600004]
mov edx, dword [ebp + edx*2 - 0x52600000]
pop eax
xor edx, ebx
xor edx, 0x2822138c
rol edx, 1
mov dword [esp + eax*2 - 0x52600000], eax
inc eax
jg 0x984bb9
syscall
push 0xdb49a0f
pushfd
xor dword [esp + 8], 0xf989a017
dec eax
mov dword [esp + 8], 0x2b1999d3
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.00d3443d
lea edx, [eax + edx + 0x500cdb86]
rol edx, 2
lea ecx, [eax + eax + 0x76ab3ca4]
neg edx
btr cx, 0x88
inc dword [esp + eax*2 - 0x52600001]
pop ecx
xor edx, 0xf1240231
xadd dword [esp + eax*2 - 0x52600002], eax
push eax
inc cx
lea edx, [edx + eax - 0x6b7f5766]
or ecx, ecx
sar dword [esp + eax - 0x52601040], cl
xor ebx, edx
shr dword [esp + eax - 0x52601040], 0xa2
shl al, 0x61
adc edi, edx
mov dword [esp + eax - 0x52601088], edi
ret 4

Function at 0x8143d1
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax*2 - 0xd07881a], eax
mov eax, dword [ebp + eax*2 - 0xd07881a]
mov word [esp], 0x8f91
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
mov edx, 0xd898c7b9
push edx
movsx esi, dx
mov dword [ebp], eax
mov edi, dword [esp]
mov ebx, dword [esp + 4]
mov dword [esp + 4], 0x2fa0e1bd
shl edx, 0x39
xor dx, di
mov edi, dword [esp + edx - 0x7200c7b1]
call fcn.00794d97
mov eax, 0xd319daa7
mov ecx, eax
movzx cx, byte [ebp]
cwde
push eax
add eax, eax
mov dl, byte [ebp + 2]
adc ebp, 1
not cl
not al
xchg ah, al
not dl
and cl, dl
movzx edx, word [esp]
mov word [edx + ebp - 0xdaa7], cx
mov ecx, edx
call fcn.00d45799
xchg ebx, eax
popal
invalid

Function at 0x82811b
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x1c]
jmp 0xd75805
push 0x5da7d0af
push 0xf3a06b35
xor ebx, ecx
xor dword [esp + 1], 0x19097890
setl byte [esp + 0xd]
jg 0x9f264f
adc edi, ecx
push 0x48919126
jmp 0x82c401
jmp 0x7e4e52
push ecx
mov dword [esp], 0x95342ff5
call fcn.00cfa122