joyce8/EMBER2024-capa huggingface dataset:
Function at 0x533ce4
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x533e2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00533328
xor eax, eax
push ebp
push 0x533e11
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x533d49
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x533d49
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x533dfb
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x533d5c
call fcn.004041f8
jmp 0x533e18
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x533dfb
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x533dfb
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403ab8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x533dfb
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d0b0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x533e48
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x5bf970]
mov dl, 1
mov eax, dword [0x532c00]
call fcn.0040d9d4
call fcn.0040414c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533e18
mov eax, dword [ebp - 4]
call fcn.00533334
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533e35
lea eax, [ebp - 0x28]
call fcn.004047d0
ret

Function at 0x534558
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004047d0
push 0
push 0
push 0x5345ac
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x5345a5
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.00404e1c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404c90
push eax
push 0x5345ac
call sub.kernel32.dll_GetEnvironmentVariableA
pop ecx
pop ecx
pop ebp
ret
Function at 0x5345b4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c80
xor eax, eax
push ebp
push 0x53474e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004047d0
mov word [0x5c2dc0], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c90
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4f71a8]
call fcn.00405da8
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c90
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x53471d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x53475c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5346c5
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, 4
call fcn.00402a5c
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x20]
mov eax, 8
call fcn.00409944
lea eax, [ebp - 0x24]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.00404cf0
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, 4
mov edx, 5
mov eax, dword [ebp - 0x20]
call fcn.00404cf0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
pop ecx
call fcn.00404adc
jmp 0x5346d2
lea eax, [ebp - 0x20]
mov edx, 0x534780
call fcn.00404868
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x534794
push dword [ebp - 0x20]
push 0x5347b0
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404b50
mov eax, dword [ebp - 0x2c]
call fcn.00404c90
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x53471d
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4f722c]
call fcn.004f75ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534755
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.004047f4
lea eax, [ebp - 0xc]
mov edx, dword [0x4f71a8]
call fcn.00405ec8
lea eax, [ebp - 4]
call fcn.004047d0
ret
Function at 0x534950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
xor edx, edx
mov dword [ebp - 0x184], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c80
xor eax, eax
push ebp
push 0x534ad9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5c2de4], 0xa
jge 0x534ab8
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x184]
mov ecx, dword [ebp - 4]
mov edx, 0x534aec
call fcn.00404adc
mov eax, dword [ebp - 0x184]
call fcn.00404c90
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x534ab8
mov dword [ebp - 0xc], 0x64
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x7d]
push eax
push 0
push 0
push 0x534b00
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x534aaf
mov dword [ebp - 0xc], 0xff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x17d]
push eax
push 0
push 0
push 0x534b14
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x534aaf
mov byte [ebp - 0x11], 0
mov eax, dword [0x5c2de4]
dec eax
test eax, eax
jl 0x534a5a
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x5c2e3c]
call fcn.00404c90
lea edx, [ebp - 0x7d]
call fcn.004091e8
test eax, eax
jne 0x534a52
mov byte [ebp - 0x11], 1
jmp 0x534a5a
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x534a31
cmp byte [ebp - 0x11], 0
jne 0x534aaf
inc dword [0x5c2de4]
mov eax, dword [0x5c2de4]
lea eax, [eax*4 + 0x5c2de8]
lea edx, [ebp - 0x17d]
mov ecx, pe_nt_image_headers32
call fcn.00404a40
mov eax, dword [0x5c2de4]
lea eax, [eax*4 + 0x5c2e10]
mov edx, dword [ebp - 4]
call fcn.00404824
mov eax, dword [0x5c2de4]
lea eax, [eax*4 + 0x5c2e38]
lea edx, [ebp - 0x7d]
mov ecx, 0x65
call fcn.00404a40
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534ae0
lea eax, [ebp - 0x184]
call fcn.004047d0
lea eax, [ebp - 4]
call fcn.004047d0
ret
Function at 0x537dcc
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x537f66
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00538608
mov eax, dword [0x5bf0ac]
cmp byte [eax], 0
jne 0x537dfa
call fcn.00538270
mov byte [0x5c2dcc], 0
cmp dword [0x5c2de4], 1
jle 0x537ebf
cmp dword [0x5c2ddc], 0
je 0x537ebf
lea eax, [ebp - 4]
call fcn.00534558
lea edx, [ebp - 0x10]
mov eax, dword [0x5c2db4]
call fcn.00409fd0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x537f7c
call fcn.00404adc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00404dd4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x537ebf
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a90
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00404a90
sub ebx, eax
sub ebx, dword [ebp - 0xc]
inc ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.00404a90
mov edx, eax
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
pop ecx
call fcn.00404cf0
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404cf0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
pop ecx
call fcn.00404adc
mov eax, dword [ebp - 4]
call fcn.00404c90
push eax
push 0x537f80
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [0x5c2e74], 0
jbe 0x537eda
mov eax, dword [0x5c2e74]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x5c2e74], eax
cmp dword [0x5c2e78], 0
jbe 0x537ef5
mov eax, dword [0x5c2e78]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x5c2e78], eax
mov byte [0x5c2e70], 0
mov eax, 0x5c2db4
call fcn.004047d0
mov eax, 0x5c2db8
call fcn.004047d0
mov eax, 0x5c2dbc
call fcn.004047d0
mov word [0x5c2dc0], 0
mov byte [0x5c2dc2], 0
mov al, byte [0x537f88]
mov byte [0x5c2dc3], al
mov eax, 0x5c2ddc
call fcn.004047d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537f6d
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004047f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047f4
ret
Function at 0x539718
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f2c
xor eax, eax
push ebp
push 0x53983a
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x4f71a8]
call fcn.00405da8
add esp, 4
mov eax, dword [ebp - 4]
call fcn.00405bec
push eax
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x4f71a8]
call fcn.00405da8
add esp, 4
mov eax, dword [ebp - 4]
call fcn.00405bec
mov esi, eax
test esi, esi
jns 0x53978f
add esi, 7
sar esi, 3
dec esi
test esi, esi
jl 0x5397e1
inc esi
xor ebx, ebx
xor eax, eax
mov edx, ebx
shl edx, 3
add edx, eax
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx]
mov ecx, dword [ebp - 0x10]
xor byte [ecx + eax], dl
inc eax
cmp eax, 8
jne 0x53979c
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00539848
cmp byte [ebp - 5], 0
jne 0x5397dd
mov eax, ebx
shl eax, 3
push eax
push 8
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00539658
inc ebx
dec esi
jne 0x53979a
cmp byte [ebp - 5], 0
je 0x5397fa
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [0x4f71a8]
call fcn.00405f04
jmp 0x53980b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov ecx, dword [0x4f71a8]
call fcn.00405f04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539841
lea eax, [ebp - 0x14]
mov edx, dword [0x4f71a8]
mov ecx, 2
call fcn.004053d4
lea eax, [ebp - 4]
mov edx, dword [0x4f71a8]
call fcn.00405ec8
ret
Function at 0x544f3c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404a40
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55cb80
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x55cb88
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55cd8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5bf99c]
cmp byte [eax], 0
jne 0x55cd54
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
jne 0x55cd44
xor edx, edx
push ebp
push 0x55cd20
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x54], 1
je 0x55cbe7
mov eax, dword [0x5bf9fc]
test byte [eax], 2
jne 0x55cc6c
mov eax, dword [ebp - 4]
call fcn.0055c9cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
mov edx, 0x55cda4
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x10]
xor edx, edx
call fcn.0051bd8c
mov ebx, eax
mov dx, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
mov dl, 2
mov eax, ebx
call fcn.0051bb84
mov edx, 0x41
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
mov edx, 1
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x10]
xor edx, edx
call fcn.0051bd8c
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0xc]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, 0x68
call fcn.00414a70
jmp 0x55cd16
mov edx, 0xff
mov eax, dword [0x4f722c]
call fcn.004f74d0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x55ccf3
push dword fs:[eax]
mov dword fs:[eax], esp
push 3
push 0xff
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xe8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
push eax
mov eax, dword [0x5bf240]
mov eax, dword [eax]
call eax
add esp, 0x14
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4f722c]
call fcn.004f75ac
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 0x68
call fcn.00404824
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ccfa
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4f722c]
call fcn.004f74ec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55cd44
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x68]
call fcn.00404824
jmp 0x55cd69
mov edx, dword [0x5bf3b8]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
mov ecx, 0x55ce1c
call fcn.00404adc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cd93
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004047f4
lea eax, [ebp - 0x1c]
call fcn.004113f0
ret
Function at 0x57b788
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57b806
push dword fs:[eax]
mov dword fs:[eax], esp
test cl, cl
je 0x57b7b6
lea eax, [ebp - 4]
mov edx, 0x57b81c
call fcn.00404868
jmp 0x57b7df
push 0x57b8a0
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0057c9cc
push dword [ebp - 8]
push 0x57b918
push 0x57b924
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404b50
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, ebx
call fcn.0057c044
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57b80d
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047f4
ret
Function at 0xbca233
Capabilities:
Encode data using base64

Disassembly:
movzx dx, byte [edi + edx*2 - 0x1508]
neg ax
je 0xbfc079
mov dword [esp], eax
mov cl, byte [edi + 2]
ror eax, 0x3a
jae 0x14a11ae
jmp ebp
jmp 0x145d834
shr dx, 0x8f
xor dl, dh
adc ebp, ecx
movzx ecx, al
mov ecx, dword [edi + ecx - 0x9e]
shl al, 0xc1
and edx, edx
mov dx, word [eax + ecx - 0x68dc913c]
movzx ecx, ax
xadd cx, ax
lea edi, [edi + ecx - 0x2276]
mov word [edi + eax - 0x68dc913c], dx
sbb ecx, 0xce2bf3ba
sal cx, 0x61
jge 0xbec509
rol al, 0xe1
jb fcn.00c10a5d
inc si
xor edx, dword [esp + edx - 0x8c]
neg si
inc sp
xor esi, esi
dec eax
lea esi, [esp + esi + 0x10]
inc si
xchg dword [esp + edx - 0x89], ecx
inc si
mov edi, dword [esi + edx*2 - 0x12c]
inc ecx
sal bl, 0x82
dec edx
lea edi, [edi + edx*2 - 0x12e]
inc ecx
sal ebx, cl
neg ebp
inc edx
inc byte [esp + edx*2 - 0x11e]
inc si
mov dword [edi + edx*4 - 0x258], edi
dec ecx
cmovp eax, ebx
pop ebx
inc ecx
pop ebx
jbe fcn.01400bb8
lea edi, [edi + eax*2 - 0xea740d4]
mov eax, dword [esp + 4]
adc eax, 0xff729d97
jmp eax

Function at 0xbdad5e
Capabilities:
Encode data using base64

Disassembly:
mov edx, ebx
dec ax
shl edx, 2
mov eax, ebp
add eax, edx
mov dword [esp], 0xbe3ab201
mov dword [ebp - 4], eax
test ebx, ebx
call fcn.00c3ab20
dec eax
and esi, edx
dec esi
mov esi, dword [esp + edi - 0xc877]
inc ecx
inc bh
dec ebx
lea ebp, [ebx + ecx*4 - 0x75d83455]
dec eax
arpl cx, cx
inc edx
setge byte [esp + edi - 0xc87b]
dec esp
adc ebp, ecx
dec edx
mov edi, dword [edi + edi*2 - 0x19100]
inc ecx
pop esp
inc ecx
shl ah, 0xa5
pop esi
js fcn.01400bb8
mov eax, dword [esi]
mov ecx, 0x85aab229
jmp 0x14b65ff
setb dl
not eax
sal ecx, cl
sal ecx, 0x7c
sub cx, cx
sbb eax, 0xad80eca5
sal dx, 0x26
xor ebx, eax
sar dl, 0x21
adc ebp, eax
jmp 0x14cb5a0
dec eax
mov dword [esi + edi - 0x6f14], ebx
jns fcn.01400bb8
push es
jnp 0x149add8
je 0x149ae35
jnp 0x149ae51
stosb byte es:[edi], al
das
scasb al, byte es:[edi]
ret
wait
je 0x149ae25
out dx, al
add esi, 4
movzx edx, cl
shr cl, 0xa5
xor eax, ebx
rol eax, cl
rol ecx, 0x89
sbb edx, ecx
dec ecx
neg eax
sub edx, 0xbcb3829f
jp 0x147e5f7
and cx, 0xebb2
mov edx, dword [edi + ecx*4]
ja 0x14e7737
mov eax, dword [ecx + edi + 4]
call fcn.00c22139
inc ecx
shl bl, 0x42
inc ecx
dec edi
inc cx
not edx
and bp, si
inc cx
sbb edx, 0xfdd3fdab
inc bp
xor esi, edx
dec ecx
neg ebx
dec esp
add edx, esp
inc esp
add bh, cl
dec ebx
mov ebx, dword [edx - 0x45174499]
inc ecx
setg bl
inc ecx
mov ecx, 0x3145536
dec eax
lea edi, [edi + esi - 0x6f1c]
jno 0x149ade4
call fcn.01517aa1
Function at 0xbdcfc9
Capabilities:
Encode data using base64

Disassembly:
ror eax, 1
xor eax, 0x46800804
mov dword [esp + ecx*2 - 0x4c7c9a38], ecx
bswap eax
sal cx, 0xa6
inc cl
inc eax
ror edx, cl
xor ebx, eax
add ebp, eax
movzx eax, dl
shl word [esp + ecx - 0x263e4700], cl
add dword [esp + edx - 0x131f269c], 0x54a9328a
mov al, byte [edi + edx*2 - 0x263e4d38]
not dl
mov dl, byte [ecx + edi - 0x263e46ff]
add cx, cx
jge 0x1439077
push ecx
lea edi, [ecx + edi - 0x263e8e00]
shr cl, 0xc1
dec word [esp + ecx*2 - 0x4c7d1bfd]
or al, dl
pop ecx
shr cx, 0xea
shr dword [esp + ecx - 0x263e0023], cl
not al
pop edx
sal edx, 0x45
sal cl, 0x46
mov word [edi + ecx*2 - 0x4c7c0180], ax
movzx eax, dx
jmp ebp

Function at 0xbde798
Capabilities:
Encode data using base64

Disassembly:
inc eax
xadd dh, dl
dec esp
adc ebp, ebp
inc bp
and edi, edi
inc ecx
jmp ebp
inc bp
or ecx, ecx
dec esi
mov dword [esp + edi], esp
dec ebp
adc ebp, ebx
pop ebx
neg dl
inc esp
movsx ebx, cl
dec ecx
mov ebp, dword [edi + edi]
sal cl, 0x62
inc sp
xchg ebx, edx
xadd eax, edx
dec edx
lea edi, [edi + edi + 8]
setge dl
inc esp
xchg cl, bh
dec edi
lea eax, [eax + edi - 0x6a]
inc cx
inc ebx
jbe 0xc06fb8
neg ebp
dec eax
shl edx, 0xa6
mov ecx, edx
bswap ebp
inc cx
ror edx, 0xad
dec eax
lea esi, [ecx + edx*2 - 0x38cac9ee]
xor ebp, 0xbd0d7f00
dec eax
lea edx, [edx*8 + 0x7315305]
dec esp
lea edi, [esi + esi*8 - 0x404966cb]
inc ebp
mov ebx, edx
not ebp
dec ecx
sal edx, 0xe2
sbb ecx, 0x6b309cad
inc esp
xadd edx, edx
inc ecx
push esi
xor dword [esp + edx*2 - 0xe62a60a], ebp
inc ebp
xadd edx, edi
inc esp
and bl, dl
sar si, 0xea
inc ecx
pop esi
dec ecx
not edi
dec esp
sub ebx, edx
inc ecx
movzx ebx, bl
dec eax
arpl bp, bp
jno 0xbc9508
inc edx
movzx ecx, word [ecx + eax - 0x5300b300]
inc cx
neg ecx
ror bl, 0x45
js 0x1462f34
inc cx
xor ecx, esi
inc ebp
xadd edx, esp
xor cx, 0x9c13
inc ecx
mov esi, edi
sub ax, si
inc dl
not cx
sbb cx, 0x7bbd
shl dx, 0x4f
ror cx, 1
inc sp
xor esi, ecx
xor edx, 0xbd14e282
dec eax
adc ecx, esp
dec eax
mov dword [ecx + edx - 0x5a3a6282], ebp
movsx ecx, dx
inc eax
movzx ebp, dh
dec eax
sar ebp, 6
inc ecx
jmp ebp

Function at 0xbde83b
Capabilities:
Encode data using base64

Disassembly:
inc esp
xor dword [esp + ebp + 0xf], ebx
inc esp
movzx esi, ch
movsx eax, dx
dec esp
mov esi, dword [esp + ebp + 0xf]
dec esp
mov dword [esp + ebp - 1], edi
movzx ecx, dx
dec ebp
arpl bx, bx
dec ebp
add ebp, ebx
shl cx, cl
inc esp
xadd dword [esp + ebp + 0xa], edi
push esi
dec edi
lea eax, [eax + edi - 8]
dec edi
mov esp, dword [edi + eax]
dec ebp
xor esp, esi
dec esp
lea ecx, [ecx + esi*4 + 0x483f84bb]
dec edi
lea esp, [esp + edi*8 + 0x43e062ec]
push esi
dec ecx
ror esp, 6
call fcn.00c49f47
inc cx
shl ecx, 0xeb
dec eax
lea edi, [eax + edi - 0xd2da9c5]
inc esp
and esp, dword [esp + esi*2 + 0xc]
inc eax
neg dh
inc cx
ror ebx, 0x4c
dec esp
mov dword [edi + eax*2 - 0x1a5b537a], edx
jp 0xc1a941
inc ecx
neg bl
pop ebp
inc ecx
pop esp
jp fcn.01400bb8

Function at 0xbe1a5e
Capabilities:
Encode data using base64

Disassembly:
inc eax
and dh, dh
inc bp
or edi, ecx
dec edx
lea ebx, [edx*4 - 0x70ef6fc9]
dec eax
mov dword [esp + ecx*8 + 0x571bab90], esi
inc cx
not edi
jmp 0x1442339
Function at 0xbf1238
Capabilities:
Encode data using base64

Disassembly:
dec ebp
arpl bx, bx
dec ebp
add ebp, ebx
inc edx
mov edi, dword [edi - 0x6455a77a]
push eax
inc ecx
sal ecx, cl
dec esi
sbb dword [esp - 0x6455a77a], ecx
inc ecx
pop ecx
pop edx
jb fcn.01400bb8
pop ecx
pop eax
call fcn.0143b869
dec ecx
sub eax, 4
mov esi, 0xaac1aa8
dec eax
shr esi, 0x5b
mov ecx, esi
inc ebp
mov edi, dword [eax + esi*2 - 2]
inc ebp
xor edi, esi
movsx ebp, si
inc esp
mov edx, ebp
inc ecx
add edi, 0xd82b8336
inc ecx
not edi
inc esp
movsx esp, si
inc ecx
movsx edx, dx
inc ecx
xor edi, 0xcab685b2
jmp 0x14eed54
call fcn.014271b8
jmp 0x13f88c3

Function at 0xbf353d
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov dword [esp + ecx - 0x64886ea9], esp
dec edx
lea edi, [edi + edx*4 - 0x302]
inc edx
movzx eax, byte [esp + edx*2 - 0x17e]
inc ecx
dec dl
inc cx
mov dword [ecx + edi - 0x64886ea9], ebp
inc ecx
pop esp
pop ebx
pop ebp
pop edx
inc ecx
pop edx
jne fcn.01400bb8
inc ecx
mov ecx, 0xb5b9c40d
dec ecx
sub eax, 4
inc ecx
mov esi, ecx
inc esp
movzx ebx, si
inc esp
movzx edx, dh
inc edi
mov edx, dword [eax + ebx - 0xc40d]
dec ecx
lea esi, [ebx - 0x45ea5f4c]
inc ebp
xor edx, esi
inc ecx
dec edx
dec eax
lea ebx, [esi*2 + 0x323c1d9f]
inc ecx
rol ebx, 0x25
inc ecx
rol edx, 1
call fcn.00c48d0c

Function at 0xc000c6
Capabilities:
Encode data using base64

Disassembly:
shl cl, 0x63
inc ecx
sbb eax, 0x99b86a27
inc ecx
dec bh

Function at 0xc01628
Capabilities:
Encode data using base64

Disassembly:
dec esp
adc ebp, eax
sub bx, word [esp + ebp - 0x73358f94]
inc cx
or edx, 0x5c41a820
pop esi
pop ecx
jle fcn.01400bb8

Function at 0xc0307a
Capabilities:
Encode data using base64

Disassembly:
lea edi, [edi + ecx*2 - 0x7b65a712]
add dl, 0xb1
jae 0x1490d8b
mov dword [edi + edx*8 - 0x1c0], eax
lea eax, [edx + edx*4 + 0x4bbae18e]
mov ecx, dword [esi + ecx - 0x3db2d387]
xadd dl, ah
jl 0x1467bbd
lea esi, [edx + esi - 0x16]
xor ecx, ebx
add edx, eax
mov dword [esp + edx - 0x4bba38c0], eax
dec ecx
or ax, ax
cmovp eax, dword [esp + eax - 0x4bba38a6]
ror ecx, 2
not ecx
call fcn.01479625
dec esp
mov dword [esp + eax - 0x21], esi
call fcn.01459b89

Function at 0xc06fab
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xdad74757
call fcn.01442334