joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d1f20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
je 0x5d1fd7
mov eax, dword [esp + 0xc]
push esi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x5d1fcf
push ebx
push edi
push 0x5f5770
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x5d1fae
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x5f5770
push esi
call ebx
test eax, eax
je 0x5d1fae
mov ebp, 3
cmp dword [0x5f5774], ebp
jne 0x5d1faa
push 0x3e8
call edi
push 0x5f5770
push esi
call ebx
test eax, eax
jne 0x5d1f8f
mov ebp, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
test eax, eax
jne 0x5d1fc6
push 0x64
call edi
push esi
call ebx
test eax, eax
je 0x5d1fbb
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ecx
ret
Function at 0x5d5e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5eb8f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x5d5ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.005d27a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x5d5e61
mov edx, dword [eax]
jmp 0x5d5e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.005d4050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0x5d5ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x5d5ebf
cmp esi, edi
je 0x5d5ebf
mov ecx, esi
call fcn.005cda00
push esi
call fcn.005db1c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.005d2990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0x5d5ef5
mov eax, dword [eax]
jmp 0x5d5ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.005d1640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x5d5f25
mov eax, dword [eax]
jmp 0x5d5f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0x5d5f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x5d5f76
cmp esi, edi
je 0x5d5f76
mov eax, dword [esi]
cmp eax, edi
je 0x5d5f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x5d5f6d
push eax
call fcn.005db1c8
add esp, 4
push esi
call fcn.005db1c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5d5f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x5d5ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x5d6035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.005d5e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x5d5fc5
mov edi, 0x5f08b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x5d6035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.005d5e00
add edi, 4
add esp, 0xc
cmp edi, 0x5f08c0
jb 0x5d6000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x5d6070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.005dc082
mov esi, eax
add esp, 8
test esi, esi
je 0x5d6107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x5d6102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.005db946
add esp, 8
test eax, eax
je 0x5d60e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x5d60e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.005db946
add esp, 8
test eax, eax
jne 0x5d60c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x5d6102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x5d6f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5eb9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x5d7002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.005dadff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x5d7002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.005d26e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.005db20b
push 0x10
call fcn.005db1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x5d6fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.005c71c0
jmp 0x5d6fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.005d6b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x5d6ff0
mov ecx, edi
call fcn.005c72c0
push edi
call fcn.005db1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x5d7021
inc ebx
cmp ebx, 0x20
jb 0x5d6f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5d8250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ec808
push 0x5dc288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x5d8329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x5d8329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005db1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x5d8329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x5d8329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x5d832c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.005d8351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d8d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5d8d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x5d8d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5d8d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5d8d94
push eax
push esi
call fcn.005db20b
add esp, 8
pop esi
ret 0x10

Function at 0x5d8da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5d8e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x5d8e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x5f1320
push ecx
mov dword [esp + 0x1c], 4
call fcn.005dadff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x5d8dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x5d8e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5d8ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x5d8eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x5f1320
push ecx
mov dword [esp + 0x1c], 4
call fcn.005dadff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x5d8eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x5d8e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x5d9000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x5d9131
push esi
call fcn.005dc145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.005cb080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x5d9131
push 0
push ebp
call fcn.005cb3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.005cb260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x5d908b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.005cb2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x5d9121
push 0x5f1918
push edi
call fcn.005da3f0
push eax
push ebx
push esi
call fcn.005d8f60
push 0x5f18f8
push edi
call fcn.005da3f0
push eax
push ebx
push esi
call fcn.005d8f60
push 0x5f18d8
push edi
call fcn.005da3f0
push eax
push ebx
push esi
call fcn.005d8f60
push 0x5f18c0
push edi
call fcn.005da3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.005d8f60
push 0x5f18a0
push edi
call fcn.005da3f0
push eax
push ebx
push esi
call fcn.005d8f60
push 0x5f1888
push edi
call fcn.005da3f0
push eax
push ebx
push esi
call fcn.005d8f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5da1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005da140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005da140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005da140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005da140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x5dabfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5dac50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5ec87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5dac43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5dac52
xor eax, eax
pop esi
leave
ret 4
Function at 0x148cb62
Capabilities:
Encode data using base64

Disassembly:
jle 0x2237a36
xor ebx, ecx
jmp 0x220910a
add dx, dx
adc edi, ecx
not dx
sal ax, 0x6d
mov ecx, dword [edx + esi - 0x6696c9]
cdq
mov eax, dword [esi + edx + 4]
inc edx
jbe 0x2100769
mov ecx, 0xcc85ac3e
movsx eax, cx
movzx edx, cx
mov eax, dword [esi + edx*2 - 0x1587c]
not dx
mov ecx, dword ss:[eax + edx*4 - 0x14f04]
movzx eax, dx
btr edx, eax
mov dword [esi + edx*4 - 0x14f04], ecx
sar dx, 0xe1
lea ebp, [edx + ebp - 0x29e4]
mov edx, dword [ebp + edx - 0x29e0]
ror eax, 0xf4
lea ecx, [eax + eax*8 - 0x37604873]
sub ecx, eax
xor edx, ebx
ror eax, cl
call fcn.022411e9
neg ecx

Function at 0x14ac958
Capabilities:
Encode data using base64

Disassembly:
inc ecx
bt edx, 0x35
inc ecx
sbb al, 0x1a
inc sp
xchg ebx, ebx
inc ebp
xor ah, al
dec esp
mov dword [esp + ebx*8 - 0x46408], edx
dec ecx
shl ecx, 0x7b
dec esi
lea eax, [esp + eax + 0x10]
shl ecx, 0x4c
inc ebp
mov dl, byte [eax + ebx*2 - 0x11902]
dec esi
lea ebp, [ebx + ebp - 0x8c83]
dec dword [esp + ebx - 0x8c79]
inc esp
adc cl, al
inc byte [esp + ebx - 0x8c80]
inc bp
mov dword [ebp + ebx - 0x8c81], edx
inc esp
movsx eax, cl
dec edx
lea edi, [edi + ecx*4 - 0x11c]
div dword [esp + ebx - 0x8c76]
add byte [esp + eax - 0x281b24b], ch
cbw
inc esp
mov edx, dword [eax + edi - 0x2810054]
js 0x1503e2d
inc ebp
xor edx, esp
inc cx
not eax
sar word [esp + eax - 0x2810047], 0xe3
inc edi
lea edx, [edx + esi - 0x6ac78ce6]
dec eax
ror ebp, 0xef
dec eax
lea ebx, [ebx + ecx - 0x77d489f3]
dec eax
xadd edx, eax
inc ecx
rol edx, 2
dec esp
xchg ecx, edi
imul dword [esp + eax - 0x1e]
bts bp, 0x3f
inc esp
sbb edx, eax
cdq
shr byte [esp + eax + 0xf], 0x44
inc ecx
xor edx, 0x3f27d218
sub dword [esp + eax + 0xb], edx
inc esp
sbb eax, edx
neg bx
dec esp
mov dword [esp + eax + 8], esp
inc esp
xor dword [esp + eax + 8], edx
inc sp
xor dword [esp + eax + 5], ebx
dec esp
mov esp, dword [esp + eax*2 + 8]
dec eax
mov dword [esp + eax*4 + 8], 0xf6356f20
inc eax
idiv ch
not word [esp + eax*2 + 0xd]
dec ebp
arpl dx, dx
dec ecx
mul eax
dec eax
bts ebx, ebp
dec ecx
idiv edi
dec ecx
add esi, edx
inc ecx
pop ebx
pop eax
jmp fcn.014ea78c
Function at 0x14d138f
Capabilities:
Encode data using xor

Disassembly:
adc edx, dword [ebp + edx*2]
xor edx, ebx
add al, cl
mov dword [esp + ecx - 1], ecx
sbb edx, ecx
and word [esp + ecx*2], ax
jns 0x2260ffe
inc ebp
xor ebx, esp
inc ecx
not ebx
dec ebp
lea ecx, [eax + ecx*8 + 0x6d35899f]
inc esp
movzx edx, bx
inc ecx
bswap ebx
call fcn.014d741c
cli
xchg ecx, eax
ficom word [edi + 0x46]
rcl byte [ebp + eax*8 + 0x52]
mov byte [ecx + 0x44], cl
push 0x498852d1
movsb byte es:[edi], byte [esi]
cwde
fst dword [edx - 0x78]
dec ecx
add byte [eax - 3], dl
push edx
mov byte [ecx + 0x20], cl
xor eax, 0xe6daac5b
sub eax, 0x7232b7df
pop edx
sbb dh, cl
invalid
xor edx, 0x65222215
sar byte [esp + ecx - 1], cl
sub edx, ecx
xor edx, 0xae919b03
call fcn.014be6e8
Function at 0x14e6643
Capabilities:
Encode data using xor

Disassembly:
dec edx
imul ecx, dword [esp + eax - 0x160a2dd5]
dec eax
mov dword [esp + ebp - 0x1a09], edx
dec esp
mov dword [esp + ebp - 0x19f9], esp
call fcn.01496511

Function at 0x14fbdd1
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x135ede2a
call fcn.014ba244

Function at 0x14fe02b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0x3d21e7a9], ecx
mov ecx, dword [ebp + ecx*2 - 0x7a43cf52]
xor ecx, ebx
mov edx, 0xe05699a
push edx
lea eax, [edx - 0xbce68e9]
xchg edi, eax
xor esp, esi
neg ecx
xor dword [esp + edx - 0xe056996], edx
neg dword [esp + edx*2 - 0x1c0ad330]
shl word [esp + edx*2 - 0x1c0ad32e], 0xa2
lea ecx, [edx + ecx - 0x1494a5d1]
xor dword [esp + edx*2 - 0x1c0ad330], eax
cwde
bswap ecx
adc eax, dword [esp + edx - 0xe05699a]
sbb ecx, 0xefbce107
neg edx
rol eax, 0xd
rol dl, 0x41
bswap ecx
lea ecx, [edx + ecx - 0x415509bc]
xchg byte [esp], dl
ror ecx, 2
neg al
xchg byte [esp + 7], al
not edx
xor ebx, ecx
lea esi, [esi + edx*2 - 0x1c0ad2ce]
ror edx, 0x44
mov dword [edx + esi - 0x50e05696], ecx
call fcn.021cb36d
adc dl, byte [eax + 0x14]
leave
loope 0x14fe044
and al, 0x50
jmp [ebx - 0x28]
Function at 0x21ce63f
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
sal al, 0x66
jb 0x231db68
xor edx, 0x65222215
dec edx
btr eax, eax
xor edx, 0xae919b03
neg ecx
mov dword [esp + eax*2 - 0x102a54d0], 0x29a480af
sal al, 0xe7
lea edx, [edx + eax*8 - 0x5832ce9c]
add ax, 0xaf94
ja 0x21fb4e6
lcall 0x624a, 0xc497e8ff
iretd
shr word [esp + eax*8 - 0x40aecc9a], cl
xor ebx, edx
idiv byte [esp + eax - 0x815d989]
call fcn.021dd6a9
neg edx
add eax, eax
bswap ecx
shr cx, 0x86
not edx
sbb ecx, eax
xor ebx, edx
ror eax, 0x2f
adc edi, edx
xor cl, ch
movzx edx, al
jl 0x14b606f
add edx, edi
jmp edx
xor ebx, ecx
ror dword [esp + edx*2], 0xc6
cbw
mul dword [esp + edx*2]
add edi, ecx
jmp fcn.02316c70
Function at 0x21df4bf
Capabilities:
Encode data using base64

Disassembly:
inc ecx
movzx ecx, dl
inc ecx
pop esp
inc ecx
mov ecx, ebx
call fcn.021db663
bswap edx
lea ecx, [ecx + eax*8 - 0x7cc026e4]
xor edx, 0x18320399
not ax
sub eax, 0xbab2683
xor ebx, edx
div al
add edi, edx
neg eax
cmovle ecx, eax
shl ecx, cl
mov si, word [esi]
movzx edx, al
ja fcn.01499eee
or al, 0xa7
cmc
cmp edi, edi
jp 0x21df515
shld dword [ecx], esi, cl
mov dword [eax + 0x4666ee3c], esi
inc si
mov ebx, dword [ebx + ebp - 0x4880]
dec eax
mov dword [esp + ebx - 0x4880], ebx
movsx ebp, byte [esp + ebx*8 - 0x243fe]
dec ebp
lea ebp, [ebp + ebx*2 - 0x90fe]
ror eax, 0xed
jb 0x14f23cf
dec edx
lea ecx, [ebp + esi*4 - 0x41d3aa41]
dec eax
lea edi, [edi + ebx*2 - 0x9102]
add bp, word [edi + ebx - 0x4880]
dec eax
xor dword [esp + ebx - 0x4880], 0x3e9a7220
inc cx
xor ebp, esp
dec ebp
bt esi, edx
dec eax
add dword [esp + ebx*2 - 0x9100], 0x76074e83
dec edx
lea eax, [eax + esi - 0x1074f77b]
inc bp
pop ebx
dec eax
cwde
neg bp
inc esp
movzx edi, bl
add bp, 0xff26
ror bp, 1
dec ecx
xchg edi, eax
sub cx, ax
adc bp, 0xb293
dec eax
cdq
mul al
push ebx
inc sp
xor esp, ebp
inc ecx
pop edx
dec eax
add ebp, esp
inc cx
bt edx, 0x82
jae 0x21f2a3f
dec ecx
xchg edx, eax
inc si
mov dword [ebp + edx - 0x4c9], ebx
dec eax
add edx, esi
jmp edx
dec esi
lea ebx, [ebx + edi + 0x6a9e8296]
adc eax, ebp
dec esp
mov dword [esp + ebp*8], esp
xor dword [esp + ebp], eax
jmp 0x21df475
Function at 0x21dfcc8
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esi + edx*4 + 2]
add ecx, edx
rol ecx, 0x34
ror ecx, 0x8e
lea esi, [edx + esi + 6]
adc cl, dh
add cl, byte [ebp + edx*8 - 6]
bswap edx
lea ebp, [edx + ebp - 6]
xor cl, bl
push edx
sub byte [esp + edx + 2], 0xa4
adc cl, dl
not dl
xor cl, 0x3d
rol cl, 1
or edx, 0x4b30d923
xor cl, 0x9c
push edx
rol cl, 1
dec dl
not dx
sar edx, 0xa7
adc cl, 0x1c
shr dword [esp + edx*2 - 0x12cc095], 0x99
setns byte [esp + edx*8 - 0x4b3025c]
xor bl, cl
sal dword [esp + edx*2 - 0x12cc094], 0x39
sub word [esp + edx*4 - 0x259812d], dx
lea ecx, [esp + ecx + 8]
mov dword [ecx + edx*2 - 0x12cc098], eax
sub byte [esp + edx*2 - 0x12cc095], dh
and byte [esp + edx - 0x966049], dh
mov dword [esp + edx - 0x96604c], edi
ret 4
bswap ecx
bt edx, edx
dec eax
sal dx, 0x68
ror ecx, 1
xor ebx, ecx
div ax
shl dl, 0x43
adc edi, ecx
movsx ecx, dx
sub ax, 0xdab8
jne 0x1486624
ror ecx, 1
mov eax, edx
xor edx, dword [esp + 4]
inc ecx
bt eax, eax
sub ax, dx
shr al, 0x25
neg ecx
not ax
inc ecx
bswap edx
xadd dword [esp + edx*2 - 0x499019ce], eax
xor byte [esp + edx - 0x24c80ce8], dh
neg ecx
sub edx, 0x5190ac92
adc eax, edx
mul dword [esp + eax*2 - 0x1ec0652c]
xor ebx, ecx
cwd
add edi, ecx
xadd byte [esp + edx*2 - 0x1415fffc], dl
mov dword [esp + edx*2 - 0x141600d0], edi
ret 4
xor dl, bl
shl al, 0x46
adc ax, ax
sbb dl, 0xbd
and al, al
sar ax, 0x6c
ror dl, 1
shl ax, 0xc7
cbw
adc dl, al
ror dl, 1
ror eax, 0x44
xor bl, dl
shl eax, 0x9e
adc edx, esp
mov word [edx + eax*2], cx
mov ecx, dword [ebp + eax - 5]
push eax
xor ecx, ebx
mov edx, dword [esp + eax*2]
inc ecx
cdq
xor ecx, 0x3f3c1c32
jmp 0x225d0f8
inc ecx
rol ecx, 2
push edx
dec ecx
sub dl, dh
mov dword [esp + 4], 0x3a333c28
jne 0x21ca6f3
mov cx, word [esi]
movzx edx, byte [ebp - 1]
mov eax, 0xb93f4017
jmp 0x21db6a3
btr ax, ax
dec ecx
pop eax
shr ax, 0xe8
jp 0x14d7ceb

Function at 0x21ea823
Capabilities:
Encode data using xor

Disassembly:
push edi
pushfd
mov edi, 0x69230b84
push 0x4b387ab2
mov dword [esp + 0xc], 0xeac0aaa9
mov edi, dword [esp + edi - 0x69230b7c]
sub byte [esp], 0xaa
or byte [esp], 0x26
or dword [esp], 0x67350f00
sets byte [esp]
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.014ba244
sub ebp, 4
mov eax, 0x991fe51e
mov edx, 0x2302eb19
lea eax, [edx*2 + 0x401d4301]
mov edx, dword [ebp + edx - 0x2302eb19]
bts eax, 0x86
xor edx, ebx
jmp 0x21f59a6