joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001dd83
Capabilities:
Create thread

Disassembly:
xor eax, eax
mov byte [0x1005c7cc], 1
push eax
push eax
push eax
push 0x1001d5ff
push eax
push eax
mov byte [0x1005c7cd], al
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x1001ddba
push str.Failed_to_create_thread_n
push 0x1005c9e8
call fcn.10017875
pop ecx
xor eax, eax
pop ecx
inc eax
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret

Function at 0x1001f279
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1001f255
pop esi
leave
ret 8

Function at 0x10030e80
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1005b0d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x1004eeb8
push esi
call fcn.1003af0e
pop ecx
pop ecx
test eax, eax
jne 0x10030eae
xor al, al
jmp 0x10030f2b
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.10030bc1
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x10030ee8
push dword [ebp - 0x210]
call fcn.1002a33b
xor al, al
jmp 0x10030f29
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10030eee
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x10030f0e
push edx
call fcn.10030db7
pop ecx
test al, al
je 0x10030ed9
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x10030f1c
mov bl, 1
push dword [ebp - 0x210]
call fcn.1002a33b
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10020631
leave
ret

Function at 0x100322da
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10032319
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10032319
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10032319
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10032319
cmp dword [ecx + 0x74], 0xe
jbe 0x10032319
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10037327
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100372a9

Function at 0x10037b29
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100507f8
push 0x100507f0
push str.FlsAlloc
push 0x1f
call fcn.10037914
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10037b5d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10049214]
call esi
jmp 0x10037b63
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x10037ba7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10050808
push 0x10050800
push str.FlsGetValue
push 0x21
call fcn.10037914
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10037bde
push dword [ebp + 8]
mov ecx, esi
call dword [0x10049214]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10037be6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10050810
push 0x10050808
push str.FlsSetValue
push 0x22
call fcn.10037914
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10037c20
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10049214]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x62c89b
Capabilities:
Encode data using base64

Disassembly:
inc cl
ror cl, 1
call fcn.006701ea
syscall
inc ecx
push ebx
dec ecx
mov ebx, 0x860c71b2
add dword [ebx + 0x3c], edx
in al, dx
pushfd
dec ebp
or ebx, ebx
dec esp
mov ebx, dword [esp + 8]
dec eax
mov dword [esp + 8], 0x928d6300
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.00729688
call fcn.00697189

Function at 0x636e57
Capabilities:
Encode data using base64

Disassembly:
shr cx, 1
rcr ebp, cl
call fcn.00669f13
mov edx, 0x969a3c2f
mov edx, dword [esi]
mov ecx, 0xdb2fdd12
mov eax, ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
call fcn.006d11f9
mov dx, word [edi]
mov ecx, 0xf488093a
call fcn.00928990
xor cx, cx
mov dword [esp + ecx*2 - 0x6f740000], ecx
xor cx, word [ecx + esi - 0x37b9fffc]
add esi, 2
jmp 0x636e34

Function at 0x63a4b8
Capabilities:
Encode data using base64

Disassembly:
jl 0x686bbf
mov edx, 0xdf24f412
movzx dx, byte [edi]
mov eax, 0xb98c0d88
inc eax
sar eax, 0x28
mov al, byte [edi + 2]
jne 0x8beb6a
mov ecx, 0x32954cb3
ror cl, 0x24
adc cl, ch
mov ebp, dword [edi + ecx*2 - 0x652a990e]
neg ecx
sar cx, 0x8c
movzx cx, byte [ebp]
push 0x28bfd510
adc edi, 2
push 0x3a8b3fbe
mov word [edi], cx
jmp 0x8f653a
dec cl
neg cl
xor bl, cl
lea ecx, [esp + ecx + 4]
mov dword [ecx], edx
push 0xc20cf48d
lea esp, [esp + 8]
jmp fcn.00631d8f
adc esi, 1
xor cl, bl
add cl, 0xad
not cl
jmp 0x6701c4
lea esp, [esp + 8]

Function at 0x63c922
Capabilities:
Encode data using xor

Disassembly:
push 0x1b3f9585
push 0xd100a4a7
not al
and cl, al
mov word [edi], cx
jmp 0x7099a4
lea esp, [esp + 4]
je 0x91ec78
push edi
mov edi, 0x5f887a9a
movzx edi, byte [ecx + edi - 0x5f887a9a]
push 0x6ba7199e
inc word [esp + 2]
xor edi, edx
and edi, 0xff
xor word [esp], 0x30af
mov edi, dword [edi*4 + 0x6c9b30]
ror dword [esp], 0xd4
push 0x9ab7909e
shr edx, 8
xor edx, edi
inc ecx
xor edx, 0xe4baac39
or dword [esp + 4], 0x3a30b593
dec eax
push 0x3937cd3c
lea esp, [esp + 0xc]
jne 0x63c92d
call fcn.0091ec70
dec cx
mov ecx, dword [edi + ecx*2 - 0x4e0c7a44]
push 0x6b8341a7
jns 0x69f9fb
mov eax, 0x739919a0
movsx ecx, al
dec eax
movzx cx, byte [eax + edi - 0x7399199f]
mov al, byte [eax + edi - 0x7399199d]
add edi, 2
jmp 0x8efee5
add edi, 8
mov word [esp + 1], 0x92c
jmp fcn.006b9bed
lea esp, [esp + 8]
jmp fcn.006f09ff
not cl
jmp 0x630e77

Function at 0x644caa
Capabilities:
Encode data using base64

Disassembly:
jae 0x64860f
dec eax
adc ebx, 6
push 0x66b9d816
inc sp
mov dword [ebx], esp
call fcn.008b8d02
Function at 0x64a233
Capabilities:
Encode data using xor

Disassembly:
je 0x64a23b
shl ecx, 1
scasb al, byte es:[edi]
sbb eax, dword [ecx + 0x4c7]
add byte [ebx], al
shr eax, 0x8e
loope 0x64a23c
add al, dl
sal esi, 0xd1
rol cl, 1
not cl
rol cl, 1
call fcn.0072886d
dec ebp
push cs
shr eax, 0x2f
out 0xd, al
add byte [ebp + 0xe], cl
or eax, 0xa0e4d00
cmp edx, 0x6bd71650
cwde
sub edx, dword [edi + 0x7906cd5b]
jmp 0xdab40f46
or al, byte [ecx - 0x28e9af06]
push ss
xlatb
imul ebx, dword [eax - 0x32a468d5], 6
jns 0x64a238
rep insb byte es:[edi], dx
dec edi
ficomp dword [esp + edi + 0x5c6abf4a]
fiadd dword [edi + 0x64a0320e]
out 0xb2, eax
jle 0x64a244
cmp dword [edx - 0xd], eax
mov ebx, 0xfb6ba524
and al, 0xa5
imul edi, ebx, 0xffffffba
push esi
sub edx, 0x2b9df32f
lahf
sti
mov edx, 0x2fea8156
popfd
sub esp, dword [esi]
lahf
adc eax, 0xf7c9e3f1
pop esi
mov edx, 0x919c3e70
sbb eax, 0x944ec130
aas
inc edi
jle 0x64a220
jne 0x64a26a
loop 0x64a2bc
enter 0xffffffffffffeaad, 0x29
fisub word [esi + 0x358f4578]
or al, 0x7c
in al, 0x23
lahf
outsb dx, byte [esi]
sbb eax, 0xbe488a3d
sahf
mov al, byte [0x13585659]
jl 0x64a28f
ljmp 0x8f45:0x78a6de29
invalid
into
sti
jp 0x64a267
enter 0x62ae, 4
cmp dl, al
dec ecx
invalid

Function at 0x64d7f4
Capabilities:
Encode data using xor

Disassembly:
call fcn.007115c0
cmpsd dword [esi], dword es:[edi]
sub eax, dword [edx + 0x49]
cdq
xor eax, 0x7f9f7f5c
push ds
dec ebp
lea eax, [0x57ab7364]
add eax, 0x594265d5
fcmovnu st(0), st(0)
xor eax, 0x48b2b85f
xchg esi, eax
dec edx
cli
neg ch
fidiv dword [eax - 0x706d65af]
insb byte es:[edi], dx
sub al, 0x1d
mov ch, 0xee
mov dl, 0xa0
jae 0x64d811
stosb byte es:[edi], al
push 0xffffffffffffffd3
sar dword [eax - 0x38abcfd3], 0xcb
add dword [ebx - 0x2e1a774b], ecx
push edx
outsb dx, byte [esi]
invalid

Function at 0x64e844
Capabilities:
Encode data using xor

Disassembly:
jbe 0x72f161
xchg ebx, eax
fist word [esi + edx*8 - 0x4e]
dec dword [0x4398677f]
mov dl, 0xff
or eax, 0x4398677f
add ebp, 0x68b84a69
mov bh, 0xb4
push esi
sub ah, byte [esi + 0x1d]
das
pop ss
enter 0xffffffffffffc90b, 0xd
mov eax, dword [0xcff0d0c2]
xor al, 0xf6
jb 0x64dd91
aad 0xa7
aas
xchg ecx, eax
dec edx
sub al, 0x5a
cdq
mov bh, byte [edx + 0x5225]
add byte [eax], al
fcmovnb st(0), st(7)
lea ebx, [ebx + 0x51b2]
add byte [eax], al
hlt
xor cl, bl
inc cl
rol cl, 1
mov dword [esp], 0xd30d3038
add byte [esp], 0xba
adc dword [esp + 3], 0x611e5115
dec cl
ror cl, 1
call fcn.0072dac2
mov ecx, 0xd3a0d19d
not ecx
movzx cx, byte [ebp + ecx*2 - 0x58be5cc4]
mov eax, 0xa61bd1b5
inc ax
shr al, 0x23
mov al, byte [ebp + 2]
jb 0x64dd87
dec esi
mov esi, dword [esp + edi - 0x7f960c9f]
dec edx
mov dword [esp + edi - 0x7f960c9f], 0xe83cfaa2
dec esi
mov ecx, dword [esp + edi - 0x7f960c97]
pop ecx
dec eax
add ecx, 0x8f099
jmp ecx
add ebp, 2
jmp 0x672668
Function at 0x65b5c3
Capabilities:
Encode data using base64

Disassembly:
add edi, 2
push 0x8b0db2a5
add dl, al
mov word [edi], dx
call fcn.0064d049
mov eax, 0x4c83ddec
cld
std
fisttp dword [eax]
mov al, byte [0xe040abfd]
leave
lahf
push esp
sahf
and dh, byte [edi + 0x49]
test eax, 0x6549c65
cdq
inc ebp
push ecx
pushal
ret 0x7766
adc esi, 2
add cx, ax
mov word [esi], cx
call fcn.0071483a
add ebp, 6
call fcn.006925d9
mov edx, 0x8820a987
movzx dx, byte [edi]
mov eax, 0x92ba79f
jmp 0x6dd690
dec eax
mov al, byte [edi + eax*2 - 0x12574f3a]
jge 0x642982
imul eax, dword [ebp - 0xa], 0x472c8014
push ebp
aad 0x2a
stc
jnp 0x6dd6ca
mov bl, 0x98
push 0x3a
in eax, 0xe
in al, dx
mov eax, 0x4dd5a734
xchg edx, eax
sbb ebx, ebx
lahf
xor edx, dword [eax]
bound edi, qword [edx - 0x3c]
mov edx, 0x5d3766c1
jecxz 0x6dd6c6
push eax
sbb al, 0xfb
invalid
imul ebx, dword [ebp - 0x1d], 0x3e1d90ff
cld
jo 0x6dd710
invalid
movsb byte es:[edi], byte [esi]
salc
sub al, 0x5f
sub ecx, esi
or cl, byte [eax - 0x46]
leave
pop edi

Function at 0x673d62
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi], edx
jmp 0x6881a7
mov dword [esp], edi
mov edi, 0x2a8d8b06
movzx edi, byte [ebp + edi*2 - 0x551b160c]
push 0xa90d2cae
xor edi, edx
push 0xff91b98e
and edi, 0xff
mov edi, dword [edi*4 + 0x6c7dc0]
shr edx, 8
xor edx, edi
dec word [esp + 5]
inc ebp
neg dword [esp + 4]
xor edx, 0xd39952f
dec ecx
push 0x31a0662c
lea esp, [esp + 0xc]
jne 0x673d65
mov edi, 0x32f5da6
pop edi
jmp 0x71ef6e
lea esp, [esp + 4]
jmp fcn.0072be9c
jmp 0x91579c
not edx
push 0x899cec22
jmp 0x6306fa
Function at 0x6904da
Capabilities:
Encode data using base64

Disassembly:
push ecx
mov eax, dword [edi]
sal cx, 0xef
call fcn.006624eb

Function at 0x697d9f
Capabilities:
Encode data using base64

Disassembly:
push 0xcf0a0783
je 0x70a650
sub ebp, 2
call fcn.00691af0
sub ebp, 0xc
mov dword [ebp + 0xc], eax
push 0x9e35cd84
mov dword [ebp + 8], ebx
call fcn.008beb9b
int 0x1e
iretd

Function at 0x6d955f
Capabilities:
Encode data using base64

Disassembly:
adc esi, 2
push 0x5f2d5533
mov word [esi], ax
call fcn.0067ff1d
adc ah, byte gs:[esi]
jg 0x6d9586
cmc
jae 0x6d95ac
sal dh, 1
push esp
rol dword [eax - 0x613b2c81], 1
jl 0x6d9557
and edx, dword [ecx]
pop ds
adc dword [edi], ebx
int 0xf9
invalid
cmc
lds ebx, [edx + 0x504707e7]
cmp eax, 0xbbceb585
arpl word [ecx - 0x12], bp
mov cl, 0xcc
out dx, al
stosd dword es:[edi], eax
call dword [ebx]
cmpsd dword [esi], dword es:[edi]
push esp
js 0x6d9637
aam 0x55
sbb ch, bh
ja 0x6d95d3
or al, byte [esi + 0x12]
shr dword [ebp + 0x34], 0x13
xor eax, 0x50a77922
and bh, byte [ecx - 0x59]
push eax
invalid
invalid

Function at 0x6e2d0e
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x20e59bd
jmp 0x670ee2
mov ecx, dword [ebp + ecx*2 - 0x41cb37a]
mov edx, 0x83f8b34
or edx, edx
and dl, 0x17
mov edx, dword [ebp + edx*2 - 0x107f1624]
jg 0x70ee46
mov word [esi], cx
mov byte [esp + 2], 0x89
lea esp, [esp + 4]
jmp fcn.0070d8d6
adc ebp, 8
mov dword fs:[ecx], edx
lea esp, [esp + 4]
jmp fcn.00631d8f
mov edx, dword [ecx + ebp - 0x2751ef5e]
push ecx
call fcn.00676aa2
jmp 0x638a85
push 0xcea55e99
ja 0x6cfeae
inc ecx
mov eax, 0xde8d440a
inc sp
mov eax, dword [ebx]
mov ecx, 0x611200b3
xor ecx, 0x7da0709e
dec eax
lea ebp, [ecx + ecx*4 - 0x63f64e7a]
mov bp, word [ecx + ebx - 0x1cb2702b]
ror ecx, 0x56
and cl, ch
mov cl, byte [ebx + 4]
dec eax
adc ebx, 4
call fcn.00671a77
test eax, 0xd694d00d
test cx, di
Function at 0x6fd374
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add eax, esp
and dx, dx
movzx dx, byte [eax + edx - 0x6b34382a]
sbb edi, 2
jmp 0x8c0f8a
not edi
shr eax, 0x98
shl cl, 0x84
adc edi, ebx
mov ebx, ecx
call fcn.0066750e
sub esi, 1
movzx eax, byte [esi]
xor al, bl
mov edx, 0x2984df37
jmp 0x92a5a7
inc edx
movzx dx, byte [ebp]
call fcn.0090be42
mov word [edi], dx
jmp fcn.008c0809
jmp 0x70bf3b
ror edi, 2
shl cx, cl
jbe 0x91cd9a
add byte es:[ebp - 0x5b], ch
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
sbb ecx, edi
mov cl, 0x65
sbb byte [eax + 0x25], ch
rsqrtps xmm0, xmmword [eax + ecx*4]
jle 0x6af43a
retf 0x7cc3
jp 0x6af45c
rcl byte [eax + 0x3d266d87], 0xe8
not ebx
pushal
push es
jle 0x6af3ed
fld st(7)
jb 0x6af467
xor dword [eax + 0x1b], edi
imul edi, ecx, 0x633fdd06
scasd eax, dword es:[edi]
xchg esp, eax
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
dec ecx
ret 0x8400
add byte [eax + ecx + 0x6eb1e91b], al
lds esp, [edi]
mov ebx, 0x5ed6c477
and dword [edx - 0x80], 0xa8eab974
retf 0x87a9
invalid
add byte [ebp + 0x76], cl
add byte fs:[ebp + 0x78], bl
arpl word [eax], ax
push ecx
ljmp 0x67
pop ecx
je 0x6bf29e
add ah, bl
jb 0x6bf386
add bh, cl
push ebx
pop dword [eax]
adc eax, 0x650063da
nop
nop
add byte [bp - 0x68], cl
add byte fs:[ebp + edi*2 + 0x6bc60063], ah
nop
add byte [ecx], dh
fidiv word [eax]
mov ecx, 0x7e006f6e
mov word [esi], fs
call fcn.00679057
cmc
push ebp
mov ecx, 0xefed66b9
inc ebx
pcmpeqb mm4, qword [esi - 0x3a]
sbb dword [edx], esi
mov al, 0xd4
js 0x6bf38c
and dword [ecx], ebp
salc
inc ebp
xchg ebx, eax
bsf ecx, dword [esi + 0xe2e936]
aam 0x78
cmp ebp, dword [ecx]
popal
mov esi, 0x3f935f9d
xchg esp, eax
out 0xc9, eax
mov bl, 0x21
add dword [edi + 0x1e], eax
shr dword [ebp - 1], 1
jle 0x6bf310
xor esi, dword [ecx + 0x23]
inc eax
fiadd word [esi]
mov ebp, 0xd85e0dff
add byte [ebx + 0x49], bh
jnp 0x6bf3d7
xchg ebx, eax
loopne 0x6bf347
jle 0x6bf320
fbstp tbyte [0xe3905856]
push ecx
dec ebx
cmp byte [esi], cl
invalid
invalid
shr dx, 0x86
rol al, 1
lea edx, [edx*8 + 0x23a1fc1c]
not al
inc edx
xor bl, al
add edx, edx
jbe 0x643f2f
jmp 0x6d8905
mov ebp, 0xff9373a0
mov cx, word [edi]
mov bp, word [edi + 2]
jmp 0x6bf343
mov dword [esp + ecx - 0xd8f1881], ebx
movzx edi, cl
push esi
movzx eax, cx
push edx
sar ebp, 0x4e
sub ebp, edi
mov edi, dword [esp + ecx*2 - 0x1b1e30da]
setp al
shl ax, cl
bswap edi
add cx, bp
jnp 0x69cd18
jae 0x6af3e3
mov ebp, dword [esi]
mov edx, 0xe9adaa32
jmp 0x66d9cc
rcr eax, cl
jmp 0x8f68e5
jmp 0x68909b
push 0x5fadcf07
jmp 0x903643
mov dword [edi], eax
lea esp, [esp + 8]
jmp fcn.00708c47
dec edi
bswap ecx
jmp 0x660505
neg al
rol al, 1
shl edx, 0x36
or dl, 0x28
not al
add dx, dx
sar dl, 0x25
add al, 0x14
neg edx
jne 0x6d4dec
push edi
pushfd
mov edi, 0x5f972a0e
sub edi, edi
mov edi, dword [esp + edi*2 + 4]
mov dword [esp + 4], 0x3f3053fe
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00664568
call int.006ca609
lea ecx, [edx + 0x7907d332]
pushfd
mov esi, dword [esp + edx - 0x7f]
call fcn.0070f3ec
Function at 0x7064cf
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0x5ca0ab13
push 0x1d120839
mov dword [esi + 0xc], eax
call fcn.006815b1
call fcn.006f83ed

Function at 0x70b538
Capabilities:
Encode data using base64

Disassembly:
movzx eax, byte [esi]
add esi, 1
xor al, bl
inc al
not al
mov dword [esp], 0x5112cc0c
sub al, 0x21
xor dword [esp], 0x5c108d91
rol al, 1
push 0xdf215222
xor bl, al
lea eax, [esp + eax + 8]
mov byte [eax], cl
call fcn.0067904e
call fcn.008b8170

Function at 0x70b5bd
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jne 0x6cb2be

Function at 0x70ee51
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 0x20e59bd
jmp 0x670ee2
mov ecx, dword [ebp + ecx*2 - 0x41cb37a]
mov edx, 0x83f8b34
or edx, edx
and dl, 0x17
mov edx, dword [ebp + edx*2 - 0x107f1624]
jg 0x70ee46
mov word [esi], cx
mov byte [esp + 2], 0x89
lea esp, [esp + 4]
jmp fcn.0070d8d6
adc ebp, 8
mov dword fs:[ecx], edx
lea esp, [esp + 4]
jmp fcn.00631d8f
mov edx, dword [ecx + ebp - 0x2751ef5e]
push ecx
call fcn.00676aa2
jmp 0x638a85
push 0xcea55e99
ja 0x6cfeae
inc ecx
mov eax, 0xde8d440a
inc sp
mov eax, dword [ebx]
mov ecx, 0x611200b3
xor ecx, 0x7da0709e
dec eax
lea ebp, [ecx + ecx*4 - 0x63f64e7a]
mov bp, word [ecx + ebx - 0x1cb2702b]
ror ecx, 0x56
and cl, ch
mov cl, byte [ebx + 4]
dec eax
adc ebx, 4
call fcn.00671a77
test eax, 0xd694d00d
test cx, di

Function at 0x72465f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6ffb38
xor ecx, ecx
test ebp, ebp
push 0xc01174b2
lea esp, [esp + 0xc]
je 0x6ffb45
jmp 0x91717f
mov ebp, dword [edi + 4]
add edi, 4
jmp 0x64cc54
push ebx
movzx ebx, byte [eax]
push 0x7a1918b0
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x8f3244]
shr ecx, 8
xor ecx, ebx
inc eax
xor ecx, 0xc6a262b3
inc dword [esp]
dec ebp
lea esp, [esp + 4]
jne 0x917180
jmp 0x62ff60
Function at 0x72f7a3
Capabilities:
Encode data using base64

Disassembly:
inc ecx
not ah
inc ecx
or dh, ah
call fcn.0072958b

Function at 0x8b098d
Capabilities:
Encode data using xor

Disassembly:
push 0x3b82f4b9
mov dword [esi], edx
call fcn.009125da
jne 0x8b09ac
jl 0x8b09c3
invalid
test al, 0xdd
test dword [ecx], 0xc0160461
shl byte [ebp + 0x54592df3], 0x5e
pop esi
test al, 0x88
bound ebx, qword [0xa8e5a489]
fild qword [ebp + 0x6a]
push esp
pop ss
inc esp
jle 0x8b099e
dec ebx
aam 0x7e
cmp eax, 0x710eb427
sbb ebp, dword [eax]
push edx
and eax, 0x793e145f
arpl word [esi + 0x4d], cx
push cs
jno 0x8b09e1
sub byte [edx + 0x25], dl
pop edi
adc al, 0x3e
jns 0x8b0a31
dec esp
dec ebp
fstp dword es:[ebp + 0x5940e07b]
pop ds
fdiv qword [ecx + edx*2 + 0x77]
movsb byte es:[edi], byte [esi]
or al, 0x59
pop es
mov eax, 0xe42b7510
dec esp
jns 0x8b0a19
xchg esp, eax
out 0xaa, al
jae 0x8b09ba
mov edx, 0x21c589f4
mov cs, word [eax + 0x2b16021e]
imul eax, ebp, 0xffffff82
sahf
or ch, byte [edi - 0x6f8a76cf]
inc eax
cli
mov ch, 0xad
xor dword [eax + 0x36fdbc6e], ebp
out 0xd7, al
xchg ecx, eax
push edx
cli
out 0xb1, eax
dec edx
loop 0x8b09ef
xchg ecx, eax
adc bh, byte [edx - 0x49e17e21]
mov edx, 0xb61e81df
sti
movsd dword es:[edi], dword [esi]
add dl, dl
jecxz 0x8b0a24
push dword [ebx]
pushfd
mov cl, 0x26
scasb al, byte es:[edi]
inc esp
loopne 0x8b0a4e
xor ebx, dword [ecx + esi*4 - 0x1fbb51da]
and dword [edi], ebx
pop ds
invalid
lcall 0x39ed, 0x11df4276
enter 0x4e10, 0xffffffffffffffa9
jno 0x8b0aab
adc byte [esi], bl
imul byte [edx]
mov esi, dword [ebx + 0xe]
divps xmm0, xmmword [eax]
mov bh, 0x51
jbe 0x8b0a1a
xor esi, dword [ecx + ebx*8 - 0x51080390]
fidiv word [ebx + eax + 0x1e]
fnstenv [eax - 4]
imul dword [esi + 0x1e0374de]
xchg esp, eax
xchg edi, eax
lodsb al, byte [esi]
adc eax, 0x15c1febe
sub dword [edx - 0x2d10fb00], edi
xor al, 0x13
dec esp
salc
sbb esi, dword [edi + esi + 0x249ae196]
out 0x64, eax
cwde
mov dl, 0xc
add ah, byte [edi + 0x210a10e5]
add byte [esi - 0x23bc7a51], 0x14
invalid
int3

Function at 0x8beb58
Capabilities:
Encode data using base64

Disassembly:
adc esi, 2
shr cx, 1
rcr ebp, cl
mov dword [esi], ebp
call fcn.006e67a9
call fcn.0091a7e6

Function at 0x8efdfb
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx - 0x60452372], esi
sal bp, 0x6b
push ebx
sal ebp, 0xa8
mov ebp, edi
mov ebx, ecx
jne 0x713c03
mov eax, dword [edi]
mov ebp, 0x369e929b
neg bp
movzx bp, byte ss:[eax + ebp*2 - 0x6d3cdaca]
push 0xc4af5d25
add edi, 2
mov word [edi], bp
call fcn.00691b4a
syscall
call fcn.0063e958
lea esp, [esp + 0x14]
jmp fcn.0070d8d6
xor cl, 0x1a
mov dword [esp + edx - 0x60452372], 0x632a4f88
xor bl, cl
rol word [esp + edx - 0x60452371], 6
jae 0x70514b

Function at 0x9055d8
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], 0x964e3a6a
lea esp, [esp + 8]
call fcn.00706ff9

Function at 0x917644
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
push 0xaea23520
jmp 0x8b9dc5

Function at 0x920221
Capabilities:
Encode data using base64

Disassembly:
mov ebp, dword [ebp + esi - 0x3ea8e6ba]
mov cx, word [esi + 4]
call fcn.0063ce97
Function at 0x92060d
Capabilities:
Parse pe header

Disassembly:
test edx, edx
jmp 0x7064f1
push ebp
mov ebp, esp
bts edx, eax
stc
mov edx, dword [ebp + 8]
cmp ebx, ebp
sub esp, 0x114
cmp ecx, ebp
stc
clc
push esi
cmc
cmp si, dx
jmp 0x7301c5

Function at 0x92419a
Capabilities:
Encode data using base64

Disassembly:
xor bx, cx
sub edi, 2
call fcn.0063a18a

Function at 0x42b9c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40d015
lea edi, [esi - 0xc015]
push edi
or ebp, 0xffffffff
jmp 0x42b9e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42b9e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42b9d8
mov eax, 1
add ebx, ebx
jne 0x42b9fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42b9f0
jne 0x42ba0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42b9f0
xor ecx, ecx
sub eax, 3
jb 0x42ba20
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42ba92
mov ebp, eax
add ebx, ebx
jne 0x42ba2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42ba38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ba5c
inc ecx
add ebx, ebx
jne 0x42ba48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42ba3d
jne 0x42ba59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ba3d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42ba7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42ba6d
jmp 0x42b9de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42ba7c
add edi, ecx
jmp 0x42b9de
pop esi
mov edi, esi
mov ecx, 0x2a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42ba9a
cmp byte [edi], 2
jne 0x42ba9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ba9f
lea edi, [esi + 0x29000]
mov eax, dword [edi]
or eax, eax
je 0x42bb0e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2b0e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2b178]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42bacc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2b180]
or eax, eax
je 0x42bb08
mov dword [ebx], eax
add ebx, 4
jmp 0x42bae9
call dword [esi + 0x2b17c]
mov ebp, dword [esi + 0x2b184]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42bb42
sub esp, 0xffffff80
jmp 0x401219