joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e046d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0051395d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0590
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffc8d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e05a7
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffb9d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4fc7ad
Capabilities:
Encode data using xor

Disassembly:
push ecx
pop ds
jno 0x4fc820
push ecx
shl dword [esi + 0x7ca6a53d], 1
test al, 0xe4
inc eax
sar byte [ebp - 0x3f], 1
push ss
shl dword [edx + 0x4eaf8567], 0xe0
pop esp
or dword [edx - 0x42], esp
push edx
sub byte [eax], 0xdf
adc dword [ebx - 0x13], eax
xchg eax, ebp
and dl, ch
invalid
jo 0x4fc853
iretd
sahf
cdq
and dword [ebx + eax + 0xc38413f], ebx
inc edi
cmp byte [edi + eax*2], cl
mov ecx, 0xfcb7f939
mov bh, 0xf6
lodsd eax, dword [esi]
mov bh, 0xa4
js 0x4fc89e
push esi
cmpsd dword [esi], dword es:[edi]
mov word [edx + 0x5ead6663], gs
push ecx
cmc
inc edx
or dword [edi - 0xf6298c3], esp
stc
adc ah, ch
shr byte [eax + 0x13], 1
inc edx
cmc
jmp 0x5f4bca44
pop ds
loopne 0x4fc85a
xlatb
push ebp
adc edx, dword [ecx - 0x11]
push eax
xchg byte [ecx], dh
test esp, ecx
popal
sbb eax, 0xbcf63c8d
or bl, byte [0x20e3c14e]
popal
scasb al, byte es:[edi]
les edx, [ebx - 0x41f18569]
hlt
Function at 0x50200d
Capabilities:
Encode data using xor

Disassembly:
ret 0xcd27
inc esi
pop esi
xor dh, cl
fdivrp st(4)
sbb eax, 0xb58db22
pop esp
in al, dx
mov eax, dword [0x64dcc65c]
loop 0x501fa6
add byte [esi], 0x40
xchg edi, eax
adc cl, dh
inc ebp
mov eax, dword [0x389e921e]
insb byte es:[edi], dx
mov ebx, 0x803db65f
bound edi, qword [ecx + 0x79]
rol dword [0x69f3d663], cl
jge 0x501f9c
pushal
fcom qword [eax]
xchg ebx, eax
inc edx
jl 0x501fc1
ret 0x5898
pop edx
pop esp
pop ebp
inc ebp
and al, 0x94
xchg edx, eax
loope 0x501fa6
inc ecx
xor dword [ebx - 0x75], ebp
into
ficom word [ebx + 0x2f50f9c9]
aad 0x6a
xor eax, ebp
outsd dx, dword [esi]
shr dword [ecx + 0x111381eb], 1
mov cl, 0xa0
and esp, eax
sub al, 6
test eax, 0xe7e21b42
aad 0x3d
push cs
mov byte [edi + edx*4 - 0x5d], al
fsubrp st(0)
jle 0x50200f
jl 0x502032
pop edi
mov dword [0xdd02617d], eax
jnp 0x5020c9
sub dword [ebx - 0x6d], eax
in al, 0x67
add edi, ebp
invalid
insb byte es:[edi], dx
iretd
imul ecx, dword [edx + 0x21334db0], 0x1b
mov dh, byte [eax + 0x1b21334d]
je 0x5020ca
mov dl, 0x92
xor dword [ebp + 0x33], edx
inc edi
jp 0x502137
or byte [ebp - 0x40], dl
xor al, 0x45
jge 0x5020e2
jmp 0x5020a0
mov ebp, 0xfcfc049d
dec edx
shl dword cs:[ebx + 0x52], 1
push cs
pop edi
ret
xchg edi, eax
jmp dword [eax]

Function at 0x51395d
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x94ad97dc
xchg edi, eax
lodsd eax, dword [esi]
xchg esp, eax
mov cs, word [ebp - 0x6c]
adc esp, esi
xor dword [eax], edi
pop edi
add eax, dword [ebx + 0x6de23192]
clc
jne 0x51395f
stosd dword es:[edi], eax
cmp ch, byte [eax + 0x2c]
jo 0x5139b0
xor al, 0x68
inc ebp
and dword [ecx - 0x36], ecx
and eax, 0x2b8cbc64
invalid
adc al, byte [edi]
mov ch, byte [ebp + eax*8 - 0x3109049a]
invalid
Function at 0x529b9d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055d08d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529cc0
push ecx
lea ecx, [esi + 0x18]
call fcn.005493bd
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529cd7
push ecx
lea ecx, [esi + 0x24]
call fcn.005492cd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x53203d
Capabilities:
Encode data using xor

Disassembly:
xor esi, dword [0xc14bcb22]
inc eax
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
pop esi
inc esi
imul esi, dword [esi], 0x15d0fbeb
cmpsd dword [esi], dword es:[edi]
mov eax, dword [edi]
dec eax
pop ds
jecxz 0x5320b9
loop 0x532080
invalid
mov esp, 0xb94b0a5f
leave
mov dh, 0xdb
push edi
jo 0x5320a9
arpl word [ebp - 0x245d0c0b], sp
push esi
ror ebp, 0xcf
loopne 0x53210d
sbb dh, bl
stosd dword es:[edi], eax
add dword fs:[edi], esp
xchg ecx, eax
insb byte es:[edi], dx
sub bh, byte [edx]
fiadd word [eax + 0x15]
ret
mov ah, 0xc0
add byte [edi + 0x3a], cl
in eax, 5
xlatb
sahf
dec edi
invalid
cli
ljmp 0xa0c1
push esp
aam 6
insd dword es:[edi], dx
out dx, al
sbb ecx, ebp
or eax, 0x1bb373ab
dec edx
add dh, dl
xor eax, 0x7641de0
invalid
Function at 0x548a9d
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test byte [edx + 0x2b458a7c], dl
mov ah, 0x93
fstp qword [ebp - 0x4e]
imul esi, dword [edi], 0x451bea63
sbb al, 0xf
push ss
inc edi
wait
ficomp dword [ecx]
push es
fist dword [esi - 0x51]
xor ch, ch
add eax, dword [ebx + esi*2 - 0x1c776345]
mov esi, 0x6715b577
fadd st(3), st(0)
sub dword [edi], 0xfffffff4
js 0x548a36
sbb dword [eax + ebp*4 + 0x7e], eax
push ecx
add eax, 0x59cd3f8d
std
inc ecx
xlatb
jno 0x548a83
out 0xdb, eax
cmp bl, byte [eax]
ret 0xc626
pop eax
cmp dword [ecx + 0x66], 0x6c30f538
cmp dword [edi + 0x22ff0c45], ebx
cmpsd dword [esi], dword es:[edi]
push esi
or ecx, dword [edi - 0x77]
jns 0x548aed
cmp ch, dh
xor byte [ecx + edi - 0x61], ch
inc ebp
or al, 0xff
and ah, byte [edi - 0x76b0f4aa]
jae 0x548a85
scasd eax, dword es:[edi]
cwde
mov byte [ebx - 0x77], cl
mov ebx, 0x3dd37a2a
daa
adc ebp, dword [esi - 4]
pushfd
pushfd
adc al, 0xa6
jns 0x548a37
dec edi
pop ss
mov esp, 0xba8e8b22
aaa
jbe 0x548a9a
das
or esp, esp
cdq
pop edi
dec edx
sub bl, byte [edx + 0x26]
cmp ah, byte [edx - 0x79d97aae]
pop ecx
cmc
xchg edi, eax
out 0x17, eax
test al, 0x4b
mov esp, 0xd733f535
or ch, dh
ljmp 0xff03
test eax, 0x4e126451
xlatb
bound eax, qword [ecx]
push esi
test al, 0x70
imul edx, dword [edi], 0x64aa2f59
invalid

Function at 0x5492cd
Capabilities:
Encode data using xor

Disassembly:
or ecx, ebx
mov esi, 0x570ce4b6
loop 0x54928f
mov ds, esp
retf 0xf255
jle 0x5492f1
pop esi
fisub dword [0xad5ffbec]
sar dword [ebp - 0x5f], 0x8b
xchg ecx, eax
mov dl, 0xe7
retf 0xcb21
pop es
popal
pop edi
or ecx, dword [0xd7725bc3]
xlatb
adc al, 0xef
aas
cmp eax, 0x61846b2c
movsd dword es:[edi], dword [esi]
out dx, al
lodsd eax, dword [esi]
mov ah, 0xb4
jnp 0x54927b
pop eax
mov bh, 0x2b
dec edx
push esp
sub ecx, dword [edx + 0x54]
jb 0x5492cf
fiadd word [0x8c87098d]
push 0xfffffffffffffffb
cmc
cdq
xor eax, 0x552accd3
ja 0x5492b5
imul eax, edx, 0x6b
mov edi, 0x89e9d3c7
sal dword [ecx - 0x7c21da84], 1
dec ecx
pop ebx
mov esi, 0x9be4e377
fiadd word [ebx + 0x77be5b49]
jecxz 0x5492dd
wait
lodsb al, byte [esi]
dec esp
mov byte [0x9ddfec49], al
cdq
xor eax, 0x1d5b1d1b
mov esi, esp
sbb bh, byte [ebp - 0x45]
or dword [ebx - 0x21ffe049], edi
or esp, ecx
dec eax
sar byte [eax - 0x65], 1
xor dword [esi], ebx
std
je 0x549311
fimul word [ecx]
int3
mov bl, 0x51
push es
push edx
lodsd eax, dword [esi]
retf

Function at 0x54ff8d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
fnstcw word [ebx]
test dword cs:[edi + 0x4d29c900], edi
leave
sub dword [ebp + 0x44], ecx
add cl, cl
leave
sub dword [ebp + 0x44], ecx
out dx, eax
sbb byte [ecx + 0x76], al
adc al, byte [ebp - 0x70]
test al, 0xf
test byte [esi - 0x55f23f60], cl
or ebx, 0xbbda65e4
lea edi, [ebx]
mov cl, 0x76
div byte [0xc759e2cc]
xor dword [edx + 0x3b], esi
mov word [ecx + 3], fs
xlatb
pop ebx
mov ds, word [ecx - 0x422277eb]
insb byte es:[edi], dx
lcall 0x718f, 0x51ad79f4
jne 0x54ff8c
sbb eax, 0x2182476b
sbb byte [esi + 0x22], bh
dec ebx
jp 0x54ff87
and dword [ebx], edi
dec edx
or byte [eax], al
add dword [edi], ecx
popfd
invalid
Function at 0x55c90d
Capabilities:
Encode data using xor

Disassembly:
jl 0x55c966
sub al, byte [ebx - 0x3e]
push ebx
sti
mov esi, 0x74fb18fb
stosb byte es:[edi], al
sub dword [edx + 0x55], edx
out dx, eax
xchg ecx, eax
popfd
ret
mov bl, 0xe4
imul esi, esp, 0x6d
xor eax, 0x8fed381f
fst dword [edi + 0x5beb457d]
dec ecx
les ecx, [eax - 0x756c75ac]
sbb al, 0xca
popal
and eax, 0x5297c5d8
scasd eax, dword es:[edi]
inc esi
rcl byte [esi - 0x6e], 0x1a
retf 0x990e
xchg edx, eax
sbb cl, dl
push cs
cdq
or al, 0x29
dec ebp
out 0xd2, eax
inc edi
salc
pop ebp
cli
xchg ecx, eax
mov byte [edi + 0x7a9b43f9], bh
popfd
or al, 0x2b
mov gs, edx
pop ebp
popal
rcl byte [ebx + esi*8 - 0x1967009c], 0xb8
sal byte [eax - 0x69], cl
out dx, eax
js 0x55c943
ret 0x7c69

Function at 0x5731ad
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a669d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5732d0
push ecx
lea ecx, [esi + 0x18]
call fcn.005929cd
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5732e7
push ecx
lea ecx, [esi + 0x24]
call fcn.005928dd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bca3d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.005eff2d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bcb60
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc25d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bcb77
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc16d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5efa7d
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
cdq
std
sbb ecx, dword [ecx]
cmp edx, 0x887e07a1
and dword [ebx], ebp
jb 0x5efb03
or dword [eax + 0x43], 0xd7f8714e
pop esp
pop ebx
sub al, al
aaa
test eax, 0xe0eed783
sbb dword [eax], edx
push 0x8c731531
xchg edi, eax
or al, 0
sbb byte [edx - 0x3f], ah
push ss
sub ecx, ecx
push ds
push esp
and al, cl
cmc
sub dword [edi - 0x78668fb5], 0xcd82d909
cld
call 0xb871778a
invalid
xchg ebx, eax
inc edi
adc cl, 0xb3
mov ecx, 0x1804336d
and eax, 0x7020212a
invalid
das
jle 0x5efad8
add al, 0xb1
cmp esp, ecx
xor ah, bl
mov ecx, 0x476e0ad8
aas
push ebx
jns 0x5efaf3
or dword [edi + edi + 0x70], ecx
jbe 0x5efb19
dec esp
in al, 0xf0
and ebp, edx
fadd st(0), st(0)
loop 0x5efaf2
call 0xb72adbd
jbe 0x5efb9b
or esi, dword [esi + 0x7f]
xor dword [ebx - 0x10], esi
int 0x95
scasd eax, dword es:[edi]
imul edx, dword [esi + edx*2 - 0x4f9981c6], 0x477b6349
das
push cs
int 0x97
aad 0x71
mov ah, byte [esi]
fisubr dword [eax + 0x1c]
lahf
into
mov ah, 0x9f
and dword [esi + 0x32a72fd], esi
cmp dword [ecx], esi
in al, 0xfb
hlt
sub ah, byte [esi - 0x5d]
clc
ficom word [ebx - 0x7e63d403]
sbb ah, dh
out dx, al
add al, ah
pop edi
std
sub ebx, dword [ecx + eax*4 + 0xeee61a]
loopne 0x5efbe3
pop edi
xor byte [edx], ch
pushfd
stosb byte es:[edi], al
inc edi
or eax, dword [esi - 0x6ea51401]
inc esp
mov ds, word [ebp + 0x1ec7cfb1]
pop eax
push 0x2367eb24
sti
loop 0x5efb95
std
inc ebp
sal byte [ebx], cl
and dh, byte [eax + ebp*2]
cld
or byte [ebp + 0x53], cl
mov ebx, dword [edi - 0x7b4ef992]
shl dword [esi + 0x3d], 0x56
push esi
sub eax, 0x3e3a59a6
pop ss
invalid
Function at 0x6060cd
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.006395bd
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x6061f0
push ecx
lea ecx, [esi + 0x18]
call fcn.006258ed
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606207
push ecx
lea ecx, [esi + 0x24]
call fcn.006257fd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40c302
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40c311
pop dword [ebp - 0x48]
mov eax, 0x3c569a2
sub eax, 0x384a691
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3c4f2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x93ea284d
add ecx, 0x6c162aba
mov ebx, eax
mov esi, 0xe9ff32e8
sub esi, 0xe9bdf724
add esi, dword [ebp - 0x48]
mov edi, 0xb773a141
xor dword [ebp - 0x3c], 0x9bb53ad3
mov edx, dword [esi]
mov dword [ebp - 0x40], 0xa8eccd85
add edx, edi
add dword [ebp - 4], ecx
mov dword [ebx], edx
add dword [ebp - 8], 0xe0c40391
add ebx, 0xe2d10f0b
add ebx, 0x1d2ef0f9
add esi, 0x2502f0c
sub esi, 0x2502f08
loop 0x40c365
add eax, 0xaed69efa
add eax, 0x512a9ff5
xor ebx, ebx
add ebx, eax
add eax, 0xf4c3782f
sub eax, 0xf4c3782a
mov ecx, 0xb654c100
add ecx, 0x49eb3f00
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x405700
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c6b0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x466014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x4670d0
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.0041cc40
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x466a88
push eax
call fcn.0041cc40
mov esi, dword [0x4670e0]
xor ebx, ebx
mov edi, dword [0x4670e4]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x46a3d0], bl
mov eax, ebx
mov ecx, 0x4670d0
cmovae ecx, dword [0x4670d0]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x46a4e0], al
inc ebx
cmp ebx, 0x100
jl 0x405780
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x46a3d0]
movzx eax, byte [esi + 0x46a4e0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x4057d4
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x46a3d0]
mov byte [esi + 0x46a3d0], al
inc esi
mov byte [edi + 0x46a3d0], dl
cmp esi, 0x100
jl 0x4057b0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00405350
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405829
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40581f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40587f
push edx
push ecx
call fcn.00421e18
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x40586b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405861
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40587f
push edx
push ecx
call fcn.00421e18
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043b3e7
int3
Function at 0x405890
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov ecx, dword [eax]
mov eax, 0xaaaaaaab
add ecx, 2
mov dword [ebp - 0xc], ebx
mul ecx
push esi
push edi
shr edx, 1
mov ecx, ebx
shl edx, 2
push 0x3d
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
push edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebx], 0
call fcn.0041cb00
cmp dword [ebx + 0x14], 0x10
mov edi, ebx
jb 0x4058e3
mov edi, dword [ebx]
mov ecx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], 3
xor esi, esi
mov ecx, dword [ecx]
mov eax, ecx
div dword [ebp - 4]
sub ecx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ecx
je 0x40598e
mov eax, dword [ebp - 8]
dec ecx
add eax, 2
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [ebp - 4]
shr eax, 1
inc eax
mov ebx, eax
movsx ecx, byte [edx - 2]
lea edx, [edx + 3]
movsx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movsx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
mov eax, ecx
sar eax, 0x12
movzx eax, byte [eax + 0x45cdd8]
mov byte [edi + esi], al
mov eax, ecx
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x45cdd8]
mov byte [edi + esi + 1], al
mov eax, ecx
sar eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + 0x45cdd8]
mov byte [edi + esi + 2], al
movzx eax, byte [ecx + 0x45cdd8]
mov byte [edi + esi + 3], al
add esi, 4
sub ebx, 1
jne 0x405921
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
test edx, edx
je 0x405a05
mov eax, dword [ebp - 8]
movsx eax, byte [ecx + eax]
sub edx, 1
je 0x4059b8
mov ebx, dword [ebp - 8]
shl eax, 8
movsx ecx, byte [ecx + ebx + 1]
mov ebx, dword [ebp - 0x10]
or ecx, eax
mov eax, ecx
sar eax, 0xa
and eax, 0x3f
jmp 0x4059bd
mov ecx, eax
sar eax, 2
mov al, byte [eax + 0x45cdd8]
mov byte [edi + esi], al
mov eax, ecx
test edx, edx
je 0x4059d4
sar eax, 4
and eax, 0x3f
jmp 0x4059da
and eax, 3
shl eax, 4
mov al, byte [eax + 0x45cdd8]
mov byte [edi + esi + 1], al
test edx, edx
je 0x4059ff
and ecx, 0xf
mov al, byte [ecx*4 + 0x45cdd8]
mov byte [edi + esi + 2], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 0x3d
mov byte [edi + esi + 2], al
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret