joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140bd9e
Capabilities:
Encode data using xor

Disassembly:
dec ebp
adc edi, ebp
inc cx
shl esp, 0x66
seta dl
inc ebp
movzx edx, dh
dec edi
mov ecx, dword [ebx + esi*2]
or cl, dh
add ax, 0x6905
inc ecx
or dl, dh
dec edi
mov esp, dword [esp + ebx - 0x2f38]
inc esp
cmovle edx, ebx
dec edi
lea ebx, [ebx + esi*4 + 0x10]
inc sp
cmovle esi, edx
jge 0x1213c45
mov edx, 0xa63a0a32
rol ecx, 1
neg ecx
mov eax, edx
lea ecx, [edx + ecx - 0x63039097]
xor ebx, ecx
sar al, 0xa5
add al, al
and eax, 0xe7a6749d
adc ebp, ecx
movzx edx, byte [edi]
call fcn.014d2cba
stosd dword es:[edi], eax
cmp byte [eax + eax], bh
ror byte [esi], cl
mov ebp, 0xf12e42c7
mov eax, dword [0xc39f858]
cmp eax, 0xa7a63855
lodsb al, byte [esi]
test edi, eax
leave
xlatb
push ebx
mov eax, 0x7349efc7
mov eax, 0xb9442559
ja 0x11fc534
mov ah, 0x61
lahf
invalid
dec edi
mov dword [esi + ecx], esp
shl al, 2
dec ebp
add esi, edi
inc ecx
jmp esi
xor ecx, ebx
call fcn.01312b44
ror bx, 0x25
inc ecx
rol ebp, 2
inc edx
movsx edx, word [esp - 0x10e]
dec edx
xor dword [esp - 0x44], edx
inc ecx
inc ebp
dec edx
mov dword [esp - 0x88], ebp
not bl
inc esi
xor dword [esp - 0x110], ebp
inc ecx
neg ah
inc ebp
xor esp, esi
pop ebp
dec edx
lea ecx, [0xfa37e929]
mov eax, 0x57b4dba6
dec ebp
arpl bp, bp
inc esp
or ah, cl
jl 0x11fc4f5
xor edx, ebx
lea edx, [edx + eax - 0x26dc5d85]
and al, ah
shr byte [esp + eax - 0x5f144704], 0xe3
bswap edx
lea ecx, [eax + eax*4 - 0x5cd35af2]
inc ecx
rol edx, 1
dec edx
pop ecx
not edx
call fcn.012564e2

Function at 0x140f6aa
Capabilities:
Encode data using xor

Disassembly:
pop edx
pop edx
pop edx
pop edx
pop eax
jp fcn.0110bf7a
call fcn.014017e9
Function at 0x142d70b
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
inc ecx
ror eax, 0x7c
push eax
sal word [esp + edx*2], 0xa7
xor ebx, ecx
add ebp, ecx
shl dword [esp + edx*2 + 0xc], 5
add ax, word [esi + edx*8]
not dword [esp + edx + 8]
mov dword [esp + edx*2 + 4], 0x462e983e
xor dx, word [esi + edx*8 + 2]
not word [esp]
call fcn.011c4c78
add byte [eax], al
push ebx
je 0x142d785
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
inc esp
popal
je 0x142d7af
add byte [ebx], bl
rol byte [eax - 0x7375d23e], cl
aad 0x9c
invalid
enter 0xffffffffffffca03, 0xb
ror byte [ebp + 0x6607c094], 0x2c
dec edx
mov dword [edi + eax*2 - 0x10], ecx
jg 0x1368edf
mov dl, 0x1c
xchg edi, eax
movsb byte es:[edi], byte [esi]
Function at 0x144593c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esi, 0xc
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
shr dword [esp], 0x4c
mov dword [esi + 4], ecx
mov dword [esi], edx
jnp 0x1368ef6
call fcn.014ecd5d
xor eax, ebx
neg edx
or dl, cl
bswap eax
sbb eax, 0xfc83d9a3
push edx
sub dword [esp + ecx - 0x3804908a], edx
call fcn.011b8f6c
push ebp
call fcn.0114ac63
xor ecx, 0x8825bd83
and dx, dx
movzx eax, byte [esp + 3]
push edx
lea ecx, [ecx + edx - 0xc05969e]
shl ax, 0xa8
xor edx, dword [esp + eax - 0x35fb]
xchg byte [esp + edx - 0x4a8a29dd], al
not ecx
and dword [esp + edx - 0x4a8a29df], 0x560b1396
jno 0x113f70a
sbb ecx, 0x901117a6
jmp 0x13b7897
call fcn.01412159
mov eax, dword [edx + edi - 0x19940000]
or cx, 0x35b3
je 0x12d611f
inc ecx
mov cx, word [edi + edx*2 - 0x3327fffc]
sub edx, edx
lea edi, [edi + edx*2 + 6]
ja 0x1120586
inc edx
adc dx, 0x39b0
mov word ss:[eax + edx - 0x39b1], cx
mov ecx, edx
jmp esi
jp 0x14d4906
lea ebp, [ecx + ebp - 0x4f8b73a1]
not ecx
mov dword fs:[eax], edx
movsx edx, cx
mov eax, 0x66b82bba
mov ecx, dword [eax + edi - 0x66b82bba]
lea edi, [edi + eax - 0x66b82bb6]
rol dx, 0xc3
xor ecx, ebx
sar ax, 0xea
neg ecx
inc edx
shr edx, 0xb8
bswap ecx
call fcn.014d9291
lea ebp, [ebp + eax - 0x693c7f24]
sub al, al
mov eax, dword [eax + ebp - 0x693c7f00]
jns 0x12dcbb2
xor eax, ebx
jmp 0x11bfa4e
dec eax
inc edx
rol eax, 3
not eax
and edx, ecx
sbb dx, dx
xor ebx, eax
add esi, eax
jmp 0x129961b
not eax
pop ecx
inc edx
jle 0x13c8800
mov ebp, dword [esp + edi*4 - 0xfc]
pop edx
jne 0x1493d31
mov edx, 0xa099e110
sar edx, 0x4b
dec dx
sbb ebp, 4
lea ecx, [edx + edx*2 - 0x2ae6ecee]
push ecx
movsx eax, word [esp]
mov eax, dword [ebp + eax*2 - 0x9986]
neg dx
xor eax, ebx
inc ecx
xor eax, 0xb43aea91
dec byte [esp + 1]
add dword [esp], 0xf814d787
xor dword [esp], ecx
sbb eax, 0xdc872eae
lea edx, [edx*4 - 0x3b687961]
xor edx, dword [esp]
jnp 0x143b7f2
mov ecx, 0x601e55aa
lea eax, [ecx*4 - 0x6ec0b8e7]
lea ebp, [ebp + ecx - 0x601e55ab]
movzx ecx, byte [ecx + ebp - 0x601e55aa]
movsx edx, al
sar edx, 0xc1
xor cl, bl
shr eax, 0x9f
add al, 0xb3
sbb cl, 0x3b
sar edx, 0xc7
ror cl, 1
neg cl
rol dl, 5
setb al
sub al, al
dec cl
xor bl, cl
neg edx
lea eax, [eax*4 - 0x6c763d73]
neg edx
add ecx, esp
sar dl, 0xa2
rol eax, 0xee
mov ax, word [ecx + eax - 0x70a364e2]
sbb edi, 2
mov word [edi], ax
movsx ecx, dx
ror edx, 0x50
sub ebp, 4
mov edx, dword [ebp]
xor edx, ebx
neg edx
call fcn.012f2003
mov edx, 0x27165983
lea eax, [edx + edx*2 + 0x6701b719]
dec eax
mov eax, dword [ebp + edx - 0x27165983]
lea ebp, [ebp + edx*2 - 0x4e2cb302]
dec dx
xor eax, ebx
call fcn.0118d6ed
adc esi, edx
jmp fcn.0137885d
mov edi, dword [esp + ecx*2 - 0x7c]
mov dword [esp + ecx*2 - 0x80], 0x341fd8be
xchg dword [esp + ecx*8 - 0x200], ecx
mov dword [esp + ecx - 0x341fd8be], ebp
ret 4
xor edx, ebx
rol ecx, 0xcb
inc edx
push ecx
ror dword [esp + ecx*2 - 0x17d], 0xef
call fcn.011a58c0
Function at 0x14520a0
Capabilities:
Encode data using xor

Disassembly:
xor dword [esp + eax - 0x516066ca], 0x993dee00
xor ecx, ebx
push eax
rol ecx, 1
neg eax
lea edx, [eax + eax*8 - 0x7ffefd4b]
inc ecx
call fcn.0101d7d9
shr dl, 0xe2
add esi, eax
push edx
shl word [esp], 0x2d
lea eax, [edx*8 + 0x330ed38]
mov eax, dword [edi + eax*8 - 0x324ef980]
adc dword [esp], edx
add byte [esp], dl
xor ebx, eax
or edx, edx
jae 0x13054f4
xor al, 0x81
mov dword [ebp + eax*4 - 0xcd94a2c], edx
lea esi, [esi + eax*8 - 0x19b2945c]
movsx ecx, ax
ror eax, cl
mov ecx, dword [eax + esi - 0x516066ca]
mov dword [esp + eax - 0x516066ca], 0x39aa1e1d
js 0x12ce5dd
call fcn.014bf897
mov eax, dword [ebp]
mov edx, 0xaa14bc9e
xor eax, ebx
lea edx, [edx*2 + 0x2c3a02a3]
or dx, dx
dec eax
xor eax, 0x26316bb8
bswap eax
sar dl, 0xe6
sar dx, 0xe2
sub eax, 0x6eb66d1d
rol eax, 3
jmp 0x13cf29a

Function at 0x145c804
Capabilities:
Encode data using xor

Disassembly:
not edx
mov dword [edi + eax*2 - 0x1057a756], edx
mov edx, 0x9631919f
sub ax, 0x3b16
lea ebp, [ebp + eax - 0x82b9899]
movzx ecx, al
mov edx, dword [eax + ebp - 0x82b9895]
sal eax, cl
xor edx, ebx
xor ax, 0xa9ab
setno cl
adc edx, ecx
jmp 0x14e39fc
dec edx
sal ecx, 0x41
call fcn.013ce1da
jmp 0x139aec9
mov edx, 0x5d11f4a7
inc ecx
bswap ebp
sar edx, cl
inc esp
movsx esi, bl
ror cl, cl
inc ecx
sbb ebp, 0xb918530b
inc ecx
not ebp
movzx edi, bx
dec eax
ror ecx, 0x13
push ecx
inc ebp
lea ebp, [ebp + ebx*4 - 0x1eb8ea9f]
inc ecx
bswap ebp
and ecx, 0xb68cf936
dec esp
lea ecx, [ebx + edi*8 - 0x624a8cd8]
inc sp
sbb dword [esp + ecx*4 - 0x2495], esi
dec eax
mov dword [esp + ecx*2 - 0x124c], ebp
inc ebp
movzx eax, cl
call fcn.010f821f
add edi, 4
mov dword [esp], 0x5ea29fb1
xor edx, edx
test ecx, ecx
lea esp, [esp + 8]
je 0x145c861
push edi
mov edi, 0x443e94ae
movzx edi, byte [edi + eax - 0x443e94ae]
push 0x6491afbe
not dword [esp]
xor edi, edx
and edi, 0xff
mov edi, dword [edi*4 + 0x1376110]
shr edx, 8
xor edx, edi
inc eax
xor edx, 0xf188b813
dec ecx
lea esp, [esp + 4]
jne 0x145c820
mov eax, 0x17311fa5
pop edi
mov eax, 0x82bd3ab
jmp 0x137e563
lea eax, [eax*4 + 0x602efe2d]
ror edx, cl
ror ax, 0xe3
shl ecx, 0xdd
jne 0x1386e93
mov cx, word [ebp + edx - 0x75c4ac6b]
lea ebp, [ebp + edx - 0x75c4ac6d]
neg dl
shr cx, 1
rcr eax, cl
call fcn.010f8343

Function at 0x145e399
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
dec ax
add ecx, edx
or eax, eax
lea edx, [eax + eax*8 + 0x4a2c6607]
ror edx, 2
sub edx, 0x56813ba9
push eax
not edx
movzx ecx, byte [esp]
dec edx
pop ecx
xor edx, 0xfb37513
xor ebx, edx
add esi, edx
movsx edx, cl
mov ecx, dword [edx + edi - 9]
sal al, 0xe2
mov dword [esp + edx - 9], edx
sar byte [esp + edx*4 - 0x23], 2
mov edx, dword [edi + edx*8 - 0x44]
shl word [esp + 1], 0x2d
adc edi, 4
jmp 0x142d782
Function at 0x1479d36
Capabilities:
Encrypt data using rc4 prga

Disassembly:
in eax, dx
add al, 0
add byte [eax], al
mov eax, 0x6a3e2f1a
mov ecx, dword [ebp + eax - 0x6a3e2f1a]
xor ecx, ebx
lea edx, [eax + eax*8 + 0x57b1b92c]
ror ecx, 1
xor al, al
call fcn.01499c12
mov ebx, dword [ebx*4 + 0x1442720]
shr eax, 8
mov dword [esp + 4], 0xe97f305
call fcn.0135a9d7
mov eax, 0xcdb263ad
call fcn.0124b98e
insd dword es:[edi], dx
jae 0x1417811
cmp dword [edi + 0x2e], 0xe5d6e3d
push ds
enter 0xffffffffffff97b7, 0xffffffffffffffab
or al, 0xf7
outsd dx, dword [esi]
loope 0x1417785
ljmp 0xeb4d:0x82274c1b
push esp
invalid
and ebx, 0xff
jmp 0x14177a8

Function at 0x149c3b7
Capabilities:
Encode data using xor

Disassembly:
add byte [edi], cl
enter 0xffffffffffffda80, 0xffffffffffffff93
xor edx, ebx
call fcn.011be99c
pushfd
mov cl, 0x23
xchg byte ds:[esi + 2], al
xor byte [esi + 0x635b063b], 0x8d
dec edi
fdivrp st(4)
enter 0x387a, 0x73
cmp bl, byte [edx + 0x6615f5b3]
jecxz 0x12f2054
enter 0xffffffffffffb461, 6
push ds
fisttp dword [edi]
sub eax, 0x7f9c4cb3
minps xmm7, xmmword [edx + ecx - 0x7b]
or dword [ebx], ebx
add al, 0x67
and byte [ebx + 0x64f2b3a6], cl
jge 0x12f2078
xor al, 0x8e
or dword [eax], ecx
invalid
shld edx, eax, cl
mov dword [esi], edx
mov edx, dword [ebp]
mov eax, 0xba19411a
shl eax, 0x36
mov dword [esp + eax - 0x46800000], eax
lea ebp, [ebp + eax - 0x467ffffc]
jae 0x12f20a0
mov dword [esp + ecx - 0x4008870], esi
ret
Function at 0x14a0abe
Capabilities:
Encode data using xor

Disassembly:
inc ebp
movsx esi, dl
dec esp
add edi, ecx
inc ecx
or edi, ebp
inc edx
movzx ebx, byte [esp + edx - 0x638f]
inc edx
xchg byte [esp + edx*4 - 0x18e4e], al
dec edi
mov ebp, dword [edx + ebx - 0x6394]
dec edx
mov dword [esp + edx*2 - 0xc718], edx
inc esi
add ah, byte [esp + edx*2 - 0xc718]
movsx ecx, dl
dec edi
mov esp, dword [ebp + edx*2 - 0xc728]
dec edx
sal dword [esp + edx*2 - 0xc719], 0x9b
push edx
dec edi
mov dword [edx + ebx - 0x6394], esp
inc edx
sal dword [esp + edx*2 - 0xc70f], 0xba
dec eax
neg ecx
and ecx, ebx
dec esi
mov dword [esp + edx - 0x6394], edi
ret 0x18
not eax
mov dword [edi], eax
jnp 0x12895b0
dec cx
add esi, edx
not al
mov edx, eax
ror dl, 5
jmp esi
push 0x959ade99
neg dword [esp]
jb 0x11ba70d
mov edx, 0x9937dc04
lea eax, [edx*8 - 0x72709b7a]
mov ecx, dword [edi + eax - 0x574e44a6]
lea edi, [eax + edi - 0x574e44a2]
sal eax, 0x99
xor ecx, ebx
neg ax
sbb ecx, 0xedb59bb6
not ecx
inc ecx
sar edx, 0xb1
jns 0x14bc1b8
dec edx
not dword [esp + edx - 0x638d]
inc ebp
mov ecx, edx
dec edx
mov dword [esp + edx - 0x6384], ebp
mov edx, 0x6997da36
dec eax
lea ebp, [edi + edx*4 + 0x608838ad]
inc ecx
ror ah, 0xa1
inc edx
xor dword [esp + edx - 0x6384], ecx
dec edx
mov ebp, dword [esp + edx*4 - 0x18e40]
dec ecx
neg esp
inc esi
movsx ebp, byte [esp + edx*2 - 0xc71c]
dec eax
arpl cx, cx
jb 0x10fbc4b
lea eax, [eax + edx*4 - 0x1df127ea]
adc cx, cx
push ecx
xor ebx, eax
sar edx, 0x2a
adc esi, eax
push ecx
add dword [esp + edx*2 - 0xfc100], esi
ret 4
push edi
mov edi, 0x1ea0c320
rol di, 0x8e
movzx edi, byte [edx + edi*2 - 0x3d406190]
call fcn.01348673
mov word [edi + ecx - 0x6d8c3594], dx
jb 0x14d1843
add edi, 4
xor eax, eax
mov dword [esp], 0xde80ae36
ror dword [esp], 0xad
test ecx, ecx
lea esp, [esp + 4]
je 0x123b686
jmp 0x12f82f9
mov eax, 0x74949c9a
lea ebp, [ebp + eax - 0x74949c9e]
mov edx, dword [eax + ebp - 0x74949c9a]
xor edx, ebx
movzx ecx, ax
dec edx
add al, ah
xor edx, 0x26316bb8
xor al, byte [esp + eax - 0x74949c33]
adc ecx, eax
bswap edx
adc dword [esp + ecx - 0x749538f6], ecx
add eax, ecx
je 0x10e0e2b
sbb edx, 0x6eb66d1d
not dword [esp + ecx - 0x749538f6]
pop ecx
rol edx, 3
xchg ecx, eax
neg ax
add ecx, eax
xor ebx, edx
jmp 0x122911b
movzx eax, cx
jae 0x127c7f0
mov dword [esp + eax*2 - 0x6b28], esi
ret 4

Function at 0x14a987d
Capabilities:
Encode data using xor

Disassembly:
and eax, eax
xor ecx, ebx
call fcn.011bac6b
rol eax, 3
xor cl, 0x24
inc dl
not eax
xor eax, 0xbe163eb1
xor ebx, eax
shl cx, 0xb
and ecx, ecx
call fcn.0138caa3
mov eax, 0x9d237690
lea ecx, [eax*4 - 0x5eb2675]
and cx, cx
lea esi, [esi + ecx - 0x6ea2b3cf]
mov ecx, dword [esi + ecx - 0x6ea2b3cb]
ja 0x1459df3

Function at 0x14b8fa9
Capabilities:
Execute syscall

Disassembly:
inc dword [esp + eax - 0x380c1b88]
rol ecx, 2
mov edx, eax
lea ecx, [ecx + eax - 0x5faefeba]
not dword [esp + eax - 0x380c1b88]
add edx, eax
xor ecx, 0x34b9062b
call fcn.012a9948
mov eax, 0x380c1b88
xor ecx, ebx
mov dword [esp + eax - 0x380c1b88], eax
mov word [esp + eax*2 - 0x7018370f], ax
dec ecx
xor ecx, 0xadac4190
jmp 0x13d91c0
Function at 0x14c231b
Capabilities:
Encode data using xor

Disassembly:
inc esp
xor dword [esp + edx - 0x24cc], ebp
pop ebp
dec ebp
arpl bp, bp
call fcn.011494ff
call fcn.0117d1e8
dec ecx
ror esi, cl
dec eax
mov dword [esp + eax - 0xcc], ebp
sete dl
bswap edx
jae 0x11a556a
fild dword [ecx - 0x2767429a]
outsb dx, byte [esi]
push ecx
mov edi, 0x5b1e90c2
mov ebp, 0x5cc794f8
jbe 0x1282ec4
mov ah, 0xe3
mov dword [edx - 0x7b1667b5], esp
and bh, byte [ebx + 0x44baf47f]
std
xchg esi, eax
sub bh, dh
retf
pop esp
imul edi, edi, 0x9fefffff
jge 0x1282f3b
mov al, 0xf0
stosd dword es:[edi], eax
mov esp, dword [edi]
outsd dx, dword [esi]
lahf
aaa
push esp
cmp edi, dword [eax + 0x31]
cli
cdq
mov dword [0x9c288947], eax
inc ebx
add al, 0xfa
inc edx
jmp 0xeb994f4b
mov esi, 0x7c608283
invalid
dec esi
lea esp, [esp + 0x10]
dec ebp
mov dword [esp], ecx
jp 0x150ee8a
inc ecx
mov esp, 0x65162f07
inc edi
mov esp, dword [ebx - 0x65162f07]
inc ecx
mov edx, 0x113c9eaa
dec edi
lea ebx, [ebx + edx - 0x113c9ea6]
inc ebp
movsx ecx, dl
dec edx
lea esi, [esi + edx*4 - 0x44f27aaa]
inc ebp
movzx ecx, word [edx + esi - 0x113c9eaa]
inc ebp
movsx eax, dl
inc ecx
mov esi, 0x8e1b0893
inc sp
xor ecx, ebp
call fcn.012bac4e
xor ebx, eax
dec byte [esp + 0x10]
add esi, eax
call fcn.014b9a2e
dec eax
sbb esi, 4
inc esp
mov byte [esp + 8], ch
movzx eax, word [esp + 0xb]
inc esp
mov ebp, dword [esi + eax*2 - 0x198]
inc esp
xor ebp, ebp
inc ecx
pop edx
dec eax
rol dword [esp + eax*2 - 0x198], 0x53
dec eax
lea ecx, [eax*2 - 0x2fc037da]
inc ebp
lea ebp, [ebp + eax*2 - 0x18248099]
sar dword [esp + eax - 0xca], 0x55
inc ecx
setbe al
inc ecx
ror ebp, 2
dec eax
lea ebx, [ebx + ecx*2 - 0xc7022cc]
inc ecx
dec ebp
sal byte [esp + ebx - 0x5657fbda], 0x87
dec esp
lea edx, [edi + 0x390bf594]
inc ecx
bswap ebp
js 0x1282e3d

Function at 0x14cfb62
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx - 0x51000001], edx
mov ecx, dword [edx + esi - 0x51000001]
push edx
xor ecx, ebx
sar edx, 0x36
ror ecx, 1
not edx
add dx, 0xb34
inc ecx
ror ecx, 1
neg edx
inc ecx
invalid
mov eax, edx
call fcn.0144975e
call fcn.013be279
mov edx, 0x6d1c5099
call fcn.0145d71d
in eax, 0xf8
fstp qword cs:[ebp - 0x10]
add ebx, ebp
push es
or al, 0x27
xor dword [edx], esp
mov ebx, 0xf0eb7d2e
lahf
or dword [ebp + 0x7b], ebx
mov ebp, 0x3890a2f8
cmp dl, byte [edx]
jge 0x14cfb85
add byte [ebx - 0x1c], 0xa2
fnstenv [ebx - 0x2569fd28]
insb byte es:[edi], dx
inc byte [ecx]
fisubr dword [esi + edi*8 + 1]
cmp eax, 0x42e5b192
loop 0x14cfbd2
call dword [ecx + 0x743f44a4]
xchg esp, eax
inc esp
aas
je 0x14cfb6a
cli
jge 0x14cfbc4
int 0xdf
mov byte [0xd2c7fe21], al
and al, ch
sbb edx, esp
xchg esp, eax
adc bh, ch
std
pop edi
or al, 0x67
sub byte [ebp + 0x27], bl
pop eax
inc ebp
fldenv [edx + 0x33c23484]
jge 0x14cfbd2
push es
mov ebx, 0x4b5da2c5
stc
add al, byte [edx]
outsb dx, byte [esi]
mov fs, word [edx - 0x77]
jecxz 0x14cfbef
aam 0xea
add byte [edx + edx*2 + 0x37], al
imul edi, edi, 0x5aefffff
ja 0x14cfbe7
sahf
insd dword es:[edi], dx
in eax, 0x7e
jmp 0x14cfc07
Function at 0x14d4279
Capabilities:
Encode data using base64

Disassembly:
sar ecx, 0xc3
rol al, 1
xor bl, al
mov dword [esp + edx*2 - 0x4cd40cbc], edx
add edx, 0xa20ff623
jae 0x141d6b0
shl ax, 0x45
adc edi, edx
pop ecx
shl dword [esp], 0x1b
jns 0x1507313
mov edx, dword [ebp]
call fcn.013c43cb
sbb edi, 2
push edx
mov word [edi], ax
not dword [esp + 0x10]
pop ecx
movzx ecx, dx
add ecx, esi
jmp ecx
mov dword [esp + edx - 0x266a0662], ecx
not al
sub dword [esp + edx*2 - 0x4cd40cb8], ecx
jns 0x116a1d3
mov edx, 0x20b6fe86
and cx, ax
add edx, edx
mov word [edx + edi - 0x416dfd0c], cx
sal edx, 0x4f
jne 0x142d291
xor edx, ebx
sub edx, 0xf86e91d
not eax
not edx
inc ax
sar ax, 0x48
lea ecx, [eax + eax*2 - 0x42dcb277]
bswap edx
push ecx
shl eax, cl
push ecx
sub edx, 0xa335f719
add dword [esp + 3], eax
xor ebx, edx
jmp 0x11baa4e

Function at 0x14d435a
Capabilities:
Encode data using xor

Disassembly:
or word [esp + 0x11], dx
adc ebp, 4
mov dword [esp], edx
ror dword [esp + 0xe], 0x17
call fcn.012eea00
jle 0x14d4393
ljmp 0xfd07:0x5e3e21
sbb esi, eax
cmpsb byte [esi], byte es:[edi]
je 0x14d43c3
cmp esi, dword [edi]
pop ecx
xchg edx, eax
pop edi
aam 0xe3
aaa
sbb ebp, dword [esi]
mov cl, 0xda
invalid
mov bl, 0x4b
sar dword [ecx - 0x9d0392f], 1
xor eax, 0xb8ab27b9
mov ah, 0x18
pop ecx
push edx
shl byte cs:[edx + 0x19], cl
add ch, byte [esi + 0x25]
mov ah, 0x73
sub dword [ebp + 0x19], edx
mov al, 0x75
ret
sbb dword [edx], eax
outsb dx, byte [esi]
and eax, 0x552973b4
sbb dword [eax + 0x3655c375], esi
out 1, eax
in eax, dx
pop edx
adc al, 0xbf
jg 0x14d43af
sbb ecx, dword [edi - 0x1c3504d8]
popfd
xchg esi, eax
invalid
Function at 0x14d4991
Capabilities:
Encode data using xor

Disassembly:
invalid
add edi, ecx
call fcn.0116310d
cmp al, 0x4d
dec ecx
xor edx, 0x5d620337
pop ss
and ah, al
mov bh, 0x8e
dec esp
and ecx, ecx
arpl cx, sp
test esp, edx
pop ss
dec esp
sbb al, 0xcb
jae 0x14d499a
scasb al, byte es:[edi]
pop edi
movsb byte es:[edi], byte gs:[esi]
mov ch, 0x2b
test dword [esi + 0x68a056cf], ebx
dec edx
lea esp, [ebx + edx*8 - 0x65]
sal dword [ebx - 0x270bff1d], cl
add byte [ebp + 0x58], bh
pop ds
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
popfd
mov dh, 0xca
pop esp
jecxz 0x14d49e4
iretd
mov ebx, 0xfd787d83
cmp dword [ebp + 0x78], 0xfffffffd
pop ecx
adc cl, byte [edi]
pushfd
push ss
arpl word [eax + 0x32], bx
and dh, dl
lahf
inc ebp
cmpsb byte es:[esi], byte es:[edi]
aad 0x5e
inc ebx
out 0x3d, eax
xchg ecx, eax
push ss
dec esi
je 0x14d49e5
jp 0x14d498b
lahf
call 0x69b1a03e
pop es
sbb al, 0xa8
xchg ebp, eax
rcl dword [ecx + 0x4f4172ff], cl
adc edi, dword [ecx + 0x19]
dec ebp
js 0x14d4a91
sbb dword [ebp + 0x78], ecx
ja 0x14d4a61
inc esi
cli
inc edi
fdiv dword [ebx + ebp*8 - 0x11]
xchg esp, eax
push esp
mov eax, dword [esi]
pop eax
std
inc edx
push ebx
adc al, 0x4e
mov byte [0xebbda7b], al
aad 0xce
cmpsd dword [esi], dword es:[edi]
jp 0x14d4a16
cli
pop edx
lds ecx, [eax - 1]
push edi
sar dword [edx - 0x24], 1
in al, dx
mov al, 0x64
xor eax, 0x411d5700
out dx, eax
add dword [bx + di - 0x779], ebp
mov al, 0x94
sub dword [ebp + 0x4c], 0xffffffc1
test al, 0x85
add dl, byte [edi + 0x21a28031]
shr ebp, 2
and dl, cl
xchg dword [ecx + 5], ebx
ljmp 0x778d
add eax, 0xad5b0ea
or byte [ebp + 0x67e9f377], cl
pop eax
pop edx
ljmp 0x7ccb
wait
push edi
xchg ecx, eax
cmp eax, eax
invalid
js 0x14d4a84
inc ecx
mov bl, 0x46
cmp eax, 0xe123abd1
push esp
push cs
mov eax, 0xed4feaba
xchg ecx, eax
push edi
retf 0x8a87

Function at 0x150462b
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + ebx*4 - 0x3131c66]
inc esp
movzx ecx, bx
call fcn.012e3a74
bswap eax
sal cl, 0xe3
not eax
movsx edx, cx
call fcn.013ca623
dec eax
sub esi, 4
dec esp
lea ebp, [edx*2 - 0x33fe37e3]
mov edi, dword [esi]
inc ecx
push ebp
inc ecx
pop esp
xor edi, ebp
add edi, 0x24a66685
inc ecx
movsx ebx, ch
mov ecx, ebx
dec ebp
lea edx, [ebp + ebx*8 + 0x88ffb2c]
not edi
inc ecx
and ebp, 0xaa984533
dec esp
xor esp, edx
jne 0x13d5ca9
mov edx, dword [ebp]
xor edx, ebx
shr word [esp + 5], 8
jae 0x14acbd6
bswap edx
neg edx
pop eax
add eax, 0xffdcc369
jmp eax
Function at 0x41f310
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f316
ret
Function at 0x401240
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str._0x0____PPID_SPOOFER_by_k3rnel_dev_https:__github.com_k3rnel_dev
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push str._._______________________________________________________________________._n_________________________________________________________________________n____________________________________________________________n_________________________________________________________n________________________________________________________n_________________________________________________________________________n
call fcn.00401010
add esp, 4
cmp dword [ebp + 8], 3
je 0x40127f
mov eax, dword [ebp + 0xc]
push dword [eax]
push str.Usage:__s__ParentPID___ProcessPath__n
call fcn.00401010
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
push edi
push dword [esi + 4]
call fcn.004062e0
mov esi, dword [esi + 8]
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4012c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____OpenProcess_Failed_With_Error:__d_n
call fcn.00401010
add esp, 8
lea eax, [edi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov edx, esi
push eax
lea eax, [ebp - 4]
mov ecx, edi
push eax
lea eax, [ebp + 8]
push eax
call fcn.00401050
add esp, 0xc
test eax, eax
je 0x4012f1
push dword [ebp + 8]
push str.___Process_created_successfully__PID:__d_n
call fcn.00401010
add esp, 8
jmp 0x4012fe
push str.____Failed_to_create_process_n
call fcn.00401010
add esp, 4
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40130e
push eax
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x401318
push eax
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401b28
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b67
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b67
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b67
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b67
cmp dword [ecx + 0x74], 0xe
jbe 0x401b67
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407cf4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155b0
push 0x4155a8
push str.FlsAlloc
push 0x1e
call fcn.00407bb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407d28
push dword [ebp + 8]
mov ecx, esi
call dword [0x414128]
call esi
jmp 0x407d2e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407d72
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155c0
push 0x4155b8
push str.FlsGetValue
push 0x20
call fcn.00407bb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407da9
push dword [ebp + 8]
mov ecx, esi
call dword [0x414128]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40b39b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b438
push ebx
push esi
call fcn.0040b364
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b2ad
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b3e5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b437
push edi
push eax
call fcn.004084a7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b405
call fcn.00407a48
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b436
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b2ad
add esp, 0x20
test eax, eax
jne 0x40b424
push edi
call fcn.00407a48
jmp 0x40b42c
push ebx
call fcn.00407a48
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret