joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2000eb10
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x234
push edi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0
mov byte [esp + 0x134], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x135]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push str.SeDebugPrivilege
stosb byte es:[edi], al
call fcn.200104e0
push 0
push 2
call fcn.2001965c
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 8], edi
jne 0x2000eb6e
xor eax, eax
pop edi
add esp, 0x234
ret
push ebx
push ebp
push esi
push 0x446
push 0x40
call dword [0x2001a198]
mov ebx, eax
lea eax, [esp + 0x18]
push eax
push edi
mov byte [ebx], 0x7d
mov ebp, 1
mov dword [esp + 0x20], 0x128
call fcn.20019656
test eax, eax
je 0x2000eccf
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x410
call dword [0x2001a19c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x2000ecb1
cmp ecx, 4
je 0x2000ecb1
cmp ecx, 8
je 0x2000ecb1
test eax, eax
mov byte [esp + 0x140], 0
je 0x2000ebf8
lea edx, [esp + 0x140]
push 0x104
push edx
push 0
push eax
call fcn.20019848
mov esi, dword [0x2001a13c]
lea eax, [esp + 0x3c]
push eax
call esi
mov edx, eax
lea edi, [esp + 0x140]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
lea eax, [edx + ecx + 6]
lea edi, [eax + ebp]
call dword [0x2001a194]
cmp eax, edi
jae 0x2000ec36
push 0x42
push edi
push ebx
call dword [0x2001a1a4]
mov ebx, eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x3c]
mov dword [ebx + ebp], eax
push ecx
add ebp, 4
call esi
mov ecx, eax
lea esi, [esp + 0x3c]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x140]
lea esi, [esp + 0x140]
lea ebp, [ecx + ebp + 1]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov eax, ecx
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x140]
push ecx
call dword [0x2001a13c]
mov edi, dword [esp + 0x14]
lea ebp, [eax + ebp + 1]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x2000ecbc
push eax
call dword [0x2001a30c]
lea edx, [esp + 0x18]
push edx
push edi
call fcn.20019650
test eax, eax
jne 0x2000eba3
push 0x42
push ebp
push ebx
call dword [0x2001a1a4]
push 0
push str.SeDebugPrivilege
mov esi, eax
call fcn.200104e0
push edi
call dword [0x2001a30c]
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x234
ret
Function at 0x2000ff50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.20001df0
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x2000ffa4
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x5f
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x46
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x2000ff73
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x20010d60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
pushal
mov eax, dword fs:[0x30]
mov edx, dword [eax + 0xc]
add edx, 0x14
mov edx, dword [edx]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x20010da1
mov esi, dword [edx + 0x28]
mov edi, dword [ebp + 8]
mov bx, word [esi]
mov bh, byte [edi]
cmp bl, 0x5a
jg 0x20010d95
cmp bl, 0x41
jl 0x20010d95
add bl, 0x20
cmp bl, bh
jne 0x20010d74
inc esi
inc esi
inc edi
test bx, bx
jne 0x20010d83
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x20014090
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x20019943
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call sym.drprov.dll_NPEnumResource
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x2001a760
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.200196d0
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x200140f7
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.2000d460
jmp 0x200140f9
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x200066c0
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.2000ab10
push 1
push ebx
push ebx
push esi
push 0x200025f0
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.2000ab10
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x100039d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x100039ee
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x100039e3
pop esi
ret

Function at 0x1002a560
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1002a66c
test eax, eax
je 0x1002a66c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10046008
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x1002a653
lea edi, [eax + 4]
jmp 0x1002a5b7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x1002a5cc
mov dword [ebp - 4], 2
jmp 0x1002a5ed
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x1002a5e3
mov dword [ebp - 4], 1
jmp 0x1002a5ed
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x1002a663
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x1002a626
mov byte [ecx], 0x3d
jmp 0x1002a632
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x1002a63d
mov byte [ecx], 0x3d
jmp 0x1002a643
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x1002a5b4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002dfb0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, eax
mov ebx, ecx
jne 0x1002dfd9
push esi
call fcn.1002d920
test al, al
jne 0x1002dfd9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x48]
push eax
push ecx
call fcn.10028150
mov edi, eax
call fcn.10028510
add esp, 4
push eax
mov eax, 0x40
call fcn.1002bfc0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc0]
push edx
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], 0x40
call fcn.1002a560
mov ecx, dword [ebp - 4]
add esp, 0x10
xor eax, eax
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x80], al
push 0x10
mov eax, esi
mov byte [ebp + ecx - 0xc0], 0
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
mov dword [ebp - 0x20], 0xc3d2e1f0
call fcn.1002a2d0
test al, al
je 0x1002e06b
mov edi, dword [ebp - 4]
jmp 0x1002e06e
or edi, 0xffffffff
push 4
lea eax, [ebp - 4]
push eax
push 0xc
mov eax, esi
call fcn.1002a2d0
test al, al
je 0x1002e086
mov eax, dword [ebp - 4]
jmp 0x1002e089
or eax, 0xffffffff
push edi
push eax
push esi
lea esi, [ebp - 0x80]
call fcn.1002a7e0
cmp byte [ebp - 0x80], 0
mov dword [ebp - 4], 0x40
jne 0x1002e0aa
call fcn.1002ad10
mov byte [ebp - 0x80], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x30]
bswap ecx
mov dword [ebp + eax*4 - 0x1c], ecx
inc eax
cmp eax, 5
jb 0x1002e0b0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x1c]
push 0x14
push ecx
call fcn.1002a560
mov edx, dword [ebp - 4]
add esp, 0x10
cmp byte [ebp + 0xc], 0
mov byte [ebp + edx - 0x100], 0
mov eax, 0x100463dc
jne 0x1002e0f4
mov eax, 0x100463f4
push 0
push eax
mov edi, ebx
call fcn.1002de30
mov eax, dword [ebp + 8]
push 1
push eax
call fcn.1002de30
push 0
push 0x1004640c
call fcn.1002de30
push 1
lea ecx, [ebp - 0xc0]
push ecx
call fcn.1002de30
push 0
push 0x10046414
call fcn.1002de30
push 1
lea edx, [ebp - 0x100]
push edx
call fcn.1002de30
cmp byte [ebp + 0xc], 0
je 0x1002e148
call fcn.1002df10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002e350
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
jne 0x1002e36f
mov ebx, dword [ebp + 8]
push eax
call fcn.1002d920
test al, al
je 0x1002e3a9
mov ebx, dword [ebp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002e377
sub eax, edx
mov esi, eax
push esi
mov dword [ebp + 0xc], esi
call fcn.10034d64
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edi
push esi
push ebx
call fcn.1002a680
add esp, 0x14
test al, al
jne 0x1002e3b4
push edi
call fcn.10035454
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
xor ebx, ebx
push edx
push edi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], 0x67452301
mov dword [ebp - 0x28], 0xefcdab89
mov dword [ebp - 0x24], 0x98badcfe
mov dword [ebp - 0x20], 0x10325476
mov dword [ebp - 0x1c], 0xc3d2e1f0
mov byte [ebp - 0x7c], bl
call fcn.1002a790
mov dword [ebp + 0xc], 0x40
cmp byte [ebp - 0x7c], bl
jne 0x1002e407
call fcn.1002ad10
mov byte [ebp - 0x7c], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x2c]
bswap ecx
mov dword [ebp + eax*4 - 0x18], ecx
inc eax
cmp eax, 5
jb 0x1002e410
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x18]
push 0x14
push ecx
call fcn.1002a560
mov edx, dword [ebp + 0xc]
push edi
mov byte [ebp + edx - 0xbc], bl
call fcn.10035454
mov bl, byte [ebp + 0x10]
add esp, 0x14
mov eax, 0x10046438
test bl, bl
jne 0x1002e45a
mov eax, 0x10046450
mov edi, dword [ebp + 8]
push 0
push eax
call fcn.1002de30
push 1
lea eax, [ebp - 0xbc]
push eax
call fcn.1002de30
test bl, bl
je 0x1002e47c
call fcn.1002df10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0xdd7df8
Capabilities:
Encode data using xor

Disassembly:
xor esp, dword [eax + 0x49]
mov bl, 0x1e
and byte [ecx - 0x69776973], al
das
mov bl, byte [edx + edx + 0x654c4f55]
lahf
cmp dword [eax], ebp
mov eax, dword [0xce1ad109]
aaa
sbb ch, byte [ecx + 0x21]
adc byte [ecx + 0x163fae9a], 0xd
xor dword [eax], esi
int1
fcmovu st(0), st(6)
aaa
add dl, byte [ecx + 0x69b54d9d]
in eax, dx
clc
invalid
mov ecx, dword [esp + 4]
mov edi, dword [esp + 8]
pop eax
mov eax, dword [esp + 8]
call fcn.00f6158b
cmpsb byte [esi], byte es:[edi]
mov ecx, 0xa1e80447
mov dh, 0xae
dec esi
jg 0xdd7da7
les edx, [edx]
push ebp
mov ch, 0xa4
wait
btc edx, ecx
out 0x89, eax
mov bh, 0xfc
or cl, ah
xchg esi, eax
xor dl, byte [esi - 0x55ef3d0d]
xor eax, 0xdb23249d
sbb ebx, dword [esi - 0x71]
outsd dx, dword [esi]
inc esp
shl dword [esi + edx*8], 0xc7
jle 0xdd7e18
add byte [eax], al
add byte [eax], al
add ah, dh
sub dl, cl
pop ebp
mov dl, 0xe7
aaa
salc
sub eax, 0x53941389
out 0x17, al
in al, 0
cmp bh, byte [ebp + 0x4e9fdf6a]
lodsd eax, dword [esi]
or dword [ebx - 0x2c], edx
ret

Function at 0xde02e1
Capabilities:
Encode data using xor

Disassembly:
push 0x331fb432
add ebp, 8
push 0xf5072898
mov dword [ecx], edx
lea esp, [esp + 8]
jmp fcn.0123078b
dec eax
add byte [edi], cl
jne 0xf8b706
mov ecx, 0x8b213581
mov ecx, dword [ebp]
mov edx, 0x83b1fb95
mov edx, dword [ebp + 4]
jmp 0xdda128
jns 0xf807e5
cmp byte [eax], bl
xor byte [eax + 0x646f63de], dh
and al, 0x45
adc dword [esp + 0x5c], ebp
jle 0xde02e9
cwde
and eax, dword [edi]
jno 0xde031a
mov edi, 0x3f40ea4b
inc ebp
push ds
je 0xde0336
jno 0xde029c
sbb dword [ebx + 0x35035b37], edx
pop edi
sbb al, 0x6a
lahf
daa
jnp 0xde0347
mov cl, 1
aad 0x71
jne 0xde0302
xchg esi, eax
push 0x8d0057e7
and al, 8
ja fcn.0125c298
jmp 0xf89928
sbb ebp, 0xc
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ecx
mov dword [ebp], edx
pop ebx
mov ebx, 0x3d248a82
pop ebx
push 0x4e803114
push 0xbb31fe25
lea esp, [esp + 8]
jmp fcn.00e3ae6b
mov eax, 0xf6be23a0
mov ecx, 0xa9943e18
mov eax, esp
mov ecx, 0x68
mov edi, 0xc1a32f2a
dec edi
lea edx, [ebp - 0x80]
lea edi, [edi + edi*4 - 0x4ccb77e1]
and edx, 0xfffffffc
jmp fcn.00e06034

Function at 0xdf1ed8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
add esi, 2
xor cx, bx
xor cx, 0xb326
not cx
rol cx, 1
inc cx
mov dword [esp], 0xe96058d
rol cx, 1
inc cx
not word [esp + 2]
rol cx, 1
sal word [esp + 2], 0xeb
xor bx, cx
jmp 0xe3b966
jmp 0x13509c7
sub ebp, 2
mov word [ebp], cx
call fcn.00f8bcd5
cmp esi, esp
Function at 0xdf9e52
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, 0x6a9e4624
call fcn.00e38916
sysenter
push edi
pushfd
mov edi, 0xeea910af
mov edi, dword [esp + edi*2 + 0x22addea6]
mov dword [esp + 4], 0x6d30c0bd
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00de3a94
jmp 0x125dd46
push eax
call fcn.00f74b4a
mov edx, 0x668c1c02
rdtsc
push 0xd1852216
shr dword [esp], 0x25
sub esi, 8
mov word [esp + 2], 0x6b21
mov dword [esi + 4], eax
mov dword [esi], edx
push 0x630dceb6
lea esp, [esp + 8]
jmp fcn.01352705
lea esp, [esp + 8]
jne 0x13558c8
mov eax, dword [ebp]
call eax
mov ebp, dword [ebp - 4]
jmp 0xdf9e22
mov eax, 0x5384c4b8
mov eax, dword [ebp + ebx*4]
jmp 0x1227b21

Function at 0xdfad0e
Capabilities:
Encode data using xor

Disassembly:
dec ebp
mov esi, gs
xor al, 0x97
je 0xf6d576
jl 0xf62d34
js 0xdfad83
cmp al, 0xa7
mov dword [eax + edx*8 + 0x211d88dd], edi
adc byte [eax + 0x45], dh
pop eax
sti
popfd
mov al, byte [0xc67eebd4]
cmp byte [eax - 0x696c8f98], bh
cmp esp, dword [si]
and bl, byte [eax - 0x13acf112]
fnstsw word [edx + 0x2793e7e0]
push cs
imul eax, eax, 0xfbd3d314
rcl byte [ebx + edx*8], 0xd3
sti
mov word [esp + ecx], fs
add eax, 0x3405e76d
cmp eax, 0x84e44b7a
pop ebx
std
shl byte [di + 5], cl
lds esi, [ebx - 4]
and eax, 0x56e3051a
mov esp, 0x8091923
adc eax, 0x637057e4
push esp
and eax, dword ds:[esi - 0x1f]
xchg ebx, eax
js 0xdfad03
mov al, byte [0x31a69ff2]
test byte [eax - 0x59], al
or byte [ebx - 0x1293f406], 0x7e
or ebp, dword [ebp + ebp*8 + 0x7e]
and ch, bh
xchg ecx, eax
or byte [edi - 0x3ead5188], dh
mov ebp, 0x8de13fd1
wait
adc al, 0xc7
cmpsb byte [esi], byte es:[edi]
add edi, 0x9c2fa6c6
loopne 0xdfad43
and byte [ebp + 0x50865939], 0x59
invalid
call 0xdf1f38
mov edx, 0x4590082f
mov eax, edx
mov eax, dword [esi + edx - 0x4590082f]
lea edx, [edx*4 + 0x4590f08e]
rol edx, 0xe3
rol dx, 0x4b
mov dx, word [esi + 4]
call fcn.012482a6
mov edi, edx
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x122a48b
mov edx, dword [ecx + esi + 4]
xor cl, byte [esi + ecx*4 + 8]
call fcn.00e8d99d
mov esi, eax
jp 0xf692fa
neg edi
jmp 0xe05f08
call fcn.00f8e02b
lea esp, [esp + 4]
jmp fcn.0123078b
mov esi, 0xcd1f2da5
popfd
lea esi, [esi + 0x731b6305]
push esi
mov esi, dword [esp + esi - 0x403a90a6]
jmp 0xf6db5f

Function at 0xe3adf6
Capabilities:
Encode data using xor

Disassembly:
push 0x3e20df10
push 0xce246ab2
push 0xd68a7f37
not esi
mov dword [ebp], esi
mov word [esp + 5], 0xf682
lea esp, [esp + 0xc]
jmp fcn.00e0999e
test eax, eax
jmp 0xf6aad3
lea esp, [esp + 8]
je 0xdd6de5
mov edx, 0xf8a8dcbc
movzx edx, byte [ecx]
push 0x13beda08
xor edx, esi
call fcn.0134fb86
push eax
mov ch, 0xe5
les ebx, [0xa59f0623]
xor byte [eax], ch
jno 0xf6aaea
pop edx
mov bl, 0xca
pushal
invalid
Function at 0xf7baf4
Capabilities:
Encode data using xor

Disassembly:
test edi, edi
lea esp, [esp + 8]
je 0xf7bb42
mov edx, 0x430a57af
neg edx
not dx
movzx edx, byte [eax]
push 0xada9321c
xor edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0xdf7414]
shr ecx, 8
xor ecx, edx
inc eax
xor ecx, 0x8791453a
neg word [esp + 1]
sar byte [esp + 2], 3
dec edi
lea esp, [esp + 4]
jne 0xf7bb00
push 0x1abbae34
mov byte [esp + 3], 0x2c
not ecx
mov dword [ebp], ecx
lea esp, [esp + 4]
jmp fcn.0125c298

Function at 0xf81272
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor edi, 0xff9f011a
dec eax
call fcn.00e18bf0
movzx ebx, byte [ecx]
xor ebx, edi
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x134270c]
shr edi, 8
xor edi, ebx
inc ecx
jmp 0xe177e3

Function at 0x1247936
Capabilities:
Encode data using xor

Disassembly:
call fcn.00f7ed3e
call fcn.00e23433
lcall 0x19f, 0x118c2dd9
push 0x53
xor byte [edi + 0x39e12e2f], al
cdq
jo 0x1247947
xor edx, ebp
loop 0x1247968
pop edi
inc esp
pop eax
mov ah, 0xed
cmp dl, ah
add byte [ebx], bl
fistp qword [esi]
push edx
jbe 0x12479e3
pop esp
cmp ah, bl
dec ebp
push ebx
xchg ebx, eax
cmp eax, 0x530718c8
invalid
popfd
mul byte [edx - 0x20]
xchg esi, eax
sub byte [ebp - 0x53], bh
dec esp
push edi
ret

Function at 0x126a4ed
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
rol dl, 1
call fcn.00df9124
pop eax
movzx edx, byte [ebp]
mov eax, 0x8ca79433
not eax
xor dl, bl
inc al
not dl
setp al
jl 0x1267bcb

Function at 0x12749a7
Capabilities:
Encode data using xor

Disassembly:
inc cx
mov dword [esp], edi
call fcn.00e1eea8
pop ebx
jns 0x12749cd
sub ecx, dword [ebp + 0x25d50bb]
retf
push eax
dec eax
daa
cwde
add eax, 0x7947e800
pop edx
invalid

Function at 0x127a5f6
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe1cf99
mov dword [edi + 8], ebx
pop ebx
call fcn.00dda56e
mov ecx, 0x67e52009
in eax, dx
invalid
sub edi, 0xc
mov dword [edi + 0xc], eax
jmp 0xdfa216

Function at 0x13390aa
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edi, dword [esi + 4]
jb 0xf37d41
call 0xe3a80c
mov edi, 0x2802b934
lea edi, [edi*4 - 0x2cc2e5cb]
mov dword [esp + 8], 0xf6066619
mov edi, dword [esp + edi - 0x7347ff01]
call fcn.00f8b1b8
mov eax, 0xcaba8d13
mov eax, dword [esi]
mov edi, 0x3ba8ed8c
rol edi, 0xf1
jb 0xf32dab
push dword [ecx + 0x1df47b4]
cmpsd dword [esi], dword es:[edi]
mov cl, 0xc0
adc edi, dword [ebx - 0x7fa27c1b]
xor ecx, ebx
cmc
ret

Function at 0x133a233
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x124ffa2
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x124ff9c
je 0x124ffa2
mov esi, dword [ebp + 0xc]
clc
test dx, sp
test esi, esi
jmp 0xddf998
je 0xf7ba2c
push ebp
cmp eax, ebp
xadd dl, dh
movsx edx, bx
mov ebp, esp
xadd dx, dx
jmp 0x135951a
mov edx, dword [ebp + 8]
test bx, ax
sub esp, 0x114
push esi
test edx, edx
jmp 0xf30d5e
Function at 0x133d7ab
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0x3d6409a2], ecx
movzx cx, byte [ecx + edx - 0x3d6409a2]
sub ebp, 2
mov word [ebp], cx
call fcn.01341a5d
mov dword [eax], ebp
fild dword ss:[edi + 0x50cd231e]
sbb dword [ebx - 0xdacdd9a], ebx
and al, 0x9d
or al, 0x3a
mov bh, 0xbb
dec edx
das
xor al, 0xfc
das
invalid
Function at 0x4018c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 1], al
add dword [ebp - 0xc], 1
cmp byte [ebp - 1], 0
jne 0x4018d5
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x1c], edx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004023b4
add esp, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.00405537
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edx + 0xc]
cmp ecx, dword [eax]
je 0x4019da
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov ax, word [edx]
mov word [ebp - 4], ax
mov ecx, dword [ebp - 0x18]
cmp ax, word [ecx]
jne 0x4019b1
cmp word [ebp - 4], 0
je 0x4019a8
mov edx, dword [ebp - 0x14]
mov ax, word [edx + 2]
mov word [ebp - 6], ax
mov ecx, dword [ebp - 0x18]
cmp ax, word [ecx + 2]
jne 0x4019b1
add dword [ebp - 0x14], 4
add dword [ebp - 0x18], 4
cmp word [ebp - 6], 0
jne 0x40196c
mov dword [ebp - 0x28], 0
jmp 0x4019b9
sbb edx, edx
or edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x4019cd
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x18]
jmp 0x4019dc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
jmp 0x401950
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4019f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x3c]
add edx, dword [ebp + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + edx + 0x78]
push ecx
call fcn.004019e0
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x20]
push ecx
call fcn.004019e0
add esp, 8
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
push ecx
call fcn.004019e0
add esp, 8
mov dword [ebp - 0x30], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.004019e0
add esp, 8
mov dword [ebp - 0x38], eax
mov dword [ebp - 8], 0
jmp 0x401a7b
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x18]
jae 0x401b26
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4]
push edx
call fcn.004019e0
add esp, 8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 0x14]
cmp al, byte [ecx]
jne 0x401aec
cmp byte [ebp - 1], 0
je 0x401ae3
mov edx, dword [ebp - 0x10]
mov al, byte [edx + 1]
mov byte [ebp - 2], al
mov ecx, dword [ebp - 0x14]
cmp al, byte [ecx + 1]
jne 0x401aec
add dword [ebp - 0x10], 2
add dword [ebp - 0x14], 2
cmp byte [ebp - 2], 0
jne 0x401aaf
mov dword [ebp - 0x18], 0
jmp 0x401af4
sbb edx, edx
or edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x401b21
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x30]
movzx eax, word [edx + ecx*2]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + ecx*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x401b28
jmp 0x401a72
xor eax, eax
mov esp, ebp
pop ebp
ret 8