joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4312f8
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcb8
xor eax, eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4314df
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x338]
call fcn.00431040
mov edx, dword [ebp - 0x338]
lea eax, [ebp - 4]
mov ecx, 0x4314f8
call fcn.004061c0
xor ecx, ecx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2e0]
call fcn.004043d0
call fcn.00403d30
lea eax, [ebp - 0x2e0]
call fcn.00404090
call fcn.00403d30
mov edx, 0x431520
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
push 0x431538
lea edx, [ebp - 0x340]
xor eax, eax
call fcn.00403f9c
push dword [ebp - 0x340]
push 0x431550
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00406248
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
push 0x431560
lea edx, [ebp - 0x348]
xor eax, eax
call fcn.00403f9c
push dword [ebp - 0x348]
push 0x431550
push 0x431584
lea eax, [ebp - 0x344]
mov edx, 4
call fcn.00406248
mov edx, dword [ebp - 0x344]
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
mov edx, 0x4315a4
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
lea eax, [ebp - 0x2e0]
call fcn.004044d0
call fcn.00403d30
lea eax, [ebp - 0x334]
xor ecx, ecx
mov edx, 0x44
call fcn.00404528
mov dword [ebp - 0x308], 1
mov word [ebp - 0x304], 0
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x334]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405ffc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4314b9
mov eax, dword [ebp - 0x2ec]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x2f0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4314e6
lea eax, [ebp - 0x348]
mov edx, 5
call fcn.00405b14
lea eax, [ebp - 4]
call fcn.00405ab4
ret
Function at 0x431754
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x431844
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x43eee8]
call fcn.00405ffc
mov edx, eax
lea eax, [ebp - 8]
call fcn.00406054
mov eax, dword [ebp - 8]
mov edx, 0x40
call fcn.00414e50
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x431822
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
mov eax, ecx
sub eax, 0x13f
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00414f64
mov edx, 0x43ef00
mov ecx, 0x13f
mov eax, dword [ebp - 4]
call fcn.00414f0c
cmp byte [0x43f03c], 0
je 0x4317fb
lea edx, [ebp - 0xc]
mov eax, dword [0x43eee8]
call fcn.004152c0
mov edx, dword [ebp - 0xc]
mov eax, 0x43eef4
mov ecx, 0x43185c
call fcn.004061c0
jmp 0x43180b
mov eax, 0x43eef4
mov edx, dword [0x43eee8]
call fcn.00405d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431829
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0xefa9d4
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0xc], ecx
movzx ecx, byte [ebp + 1]
mov edx, 0xdf9c7581
imul edx, edx
call 0x103ac1f
mov eax, 0xef0e8bb7
movsx ecx, al
mov eax, dword [edi]
lea edx, [ecx + ecx - 0x644f9c6f]
movzx dx, byte [eax]
add edi, 2
jmp 0x101952f
Function at 0xf6575b
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop ebp
inc ecx
pop esp
inc ecx
pop esi
jp fcn.01099451

Function at 0xf71447
Capabilities:
Check http status code
Encode data using xor

Disassembly:
shl dx, 0x22
xor eax, ebx
btr edx, ecx
dec eax
sal ecx, 0x8a
xchg byte [esp + ecx + 2], cl
neg eax
sal dx, 0x4f
inc dword [esp + ecx + 1]
or edx, edx
rol eax, 2
bswap ecx
add edx, edx
sbb byte [esp + ecx + 7], 0x13
bswap eax
call fcn.010b4f00
inc ecx
mov ebp, 0xed219f12
inc ebp
movzx edx, bp
inc edx
mov eax, dword [edi + edx*2 - 0x13e24]
inc ebp
movsx esp, dl
inc ebp
xchg ch, ah
dec edx
lea edi, [edi + edx - 0x9f0e]
dec edi
lea ecx, [esp + ebp + 0x361a1784]
inc ecx
sal ch, 0xa7
xor eax, esi
inc edx
lea eax, [eax + edx + 0x342d7ea0]
inc cx
sal ebp, 0xa1
rol eax, 3
dec ecx
bswap esp
neg eax
inc ebp
xadd edx, esp
dec eax
inc ecx
mov eax, 0x7112dda4
inc ecx
push eax
bswap eax
pop ecx
inc ecx
ror ah, cl
dec edx
lea edx, [ecx*8 + 0x4118578f]
push esi
inc ecx
inc ecx
movzx ebx, dl
dec ecx
lea ebp, [esp - 0x33477449]
inc edx
xor dword [esp + edx - 0x9f12], eax
sar bp, cl
setbe cl
inc cx
and esp, 0x485ea6b0
arpl ax, ax
dec esp
adc edi, eax
shr cx, cl
inc di
mov esp, dword [ebx + edx*2 - 0x13e24]
inc ebp
sub ecx, edx
inc ecx
setge dl
inc ecx
neg cl
dec edi
lea ebx, [ebx + ecx*2 - 0x46762ed2]
js 0x1009750
dec eax
bswap ebx
inc esi
movzx edx, byte [edi + edx - 0x9f01]
dec edx
lea edi, [edi + ecx*2 - 0x46762ed3]
dec esp
lea esi, [ecx*8 + 0x369502b4]
inc ecx
neg eax
add dl, byte [ebp - 0x2708beca]
inc esp
xor dl, dh
inc cx
imul ebp, ebp
inc eax
sub bl, ch
inc ecx
rol dl, 1
inc ecx
xor dl, 0x27
inc ecx
ror dl, 1
call fcn.010464be
dec esp
or dword [eax - 0x2c9dd4c4], eax
fld xword [edi + ebp*2 - 0x242cd9f1]
lodsb al, byte [esi]
cmp edx, dword [ebx]
dec edx
rcr ebx, cl
lodsb al, byte [esi]
inc ecx
movsx ebx, word [edx + 0x3d]
push ebx
scasb al, byte es:[edi]
and ebx, esi
or dword [ecx], esp
pop ecx
jns 0xf5fd07
dec ebx
invalid
movsx ecx, dx
mov dword [edi + ecx*8], eax
mov dword [esp + ecx], 0x9f94d3bb
inc dword [esp + ecx]
push ecx
mov eax, dword [ebp + ecx*4]
lea ebp, [ecx + ebp + 4]
js 0xf5fc10
je 0xf7147f
sub dword [esi + 0xa5d6adc], ebp
sbb ebx, dword [esi - 0x32]
mov byte [0x368de4f5], al
mov byte [0xa6ede4f5], al
inc esi
mov byte [0xa64de4f5], al
in al, 0x4d
cmpsb byte [esi], byte es:[edi]
push esi
mov byte [0x3fe5e4f5], al
std
sub byte [eax], cl
sbb esp, dword [edx]
inc esi
enter 0xffffffffffffe2bd, 0xffffffffffffff9d
and dword [edi + 0xa5ce851], ebx
sbb ebp, dword [ebx - 0x10]
cmp al, 1
sbb ebx, dword [ebp - 0x4a948c81]
sub eax, 0x12ed470c
pop edi
stosd dword es:[edi], eax
cmp dword [eax + 0x4a780a6e], esp
sub eax, 0xfc20400c
push ss
jnp 0xf714c5
cld
imul ecx, dword [edi - 0xcf54aa9], 0x32
invalid
clc
mov ebp, 0xd8fa830c
dec edx
sub dword [ebx + 0x6785f925], ebx
xor esp, dword [ecx - 0x2daba719]
mov esp, dword [esi - 0x4b]
jns 0xf7152f
push ebx
ljmp 0xe37b
daa
invalid
inc esi
xor dword [esp - 0xe8], ebp
inc esp
mov esi, ebx
mov esi, ebx
dec edx
lea ecx, [esi + esi*8 - 0x78f3725c]
pop esi
inc ecx
bts ecx, 0xac
dec ebp
arpl bp, bp
jb 0x10c0db6
Function at 0xf7921b
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebx
mov dword [esp + edx - 0x6688ef9b], edx
movzx ecx, dx
sub eax, 0xf717e130
not word [esp + ecx - 0xef96]
xadd dword [esp + edx - 0x6688ef9b], edx
neg edx
xor eax, 0x76a2960c
sub eax, 0x9ba69924
xor dword [esp + ecx - 0xef97], ecx
ror eax, 3
push ecx
xor ebx, eax
not word [esp + ecx - 0xef96]
imul edx, dword [esp + ecx - 0xef97]
add esi, eax
shr byte [esp + edx - 0x6010154c], 6
push ecx
add edx, 0xfaa99b33
mov dx, word [edx + edi - 0x5ab9b07b]
lea eax, [ecx + ecx + 0x7ab91bbf]
lea edi, [edi + ecx - 0xef93]
movzx eax, byte [ebp + ecx*4 - 0x3be68]
inc cl
push ecx
sbb dword [esp + ecx*2 - 0x1df36], ecx
lea ebp, [ecx + ebp - 0xef97]
imul cx, cx
and ecx, ecx
sar ecx, cl
xor al, bl
inc cl
and ecx, ecx
xchg word [esp + ecx + 0xb], cx
rol al, 1
sar cx, 0x6a
jb 0xefeea7
add cx, cx
adc al, 0x30
imul ecx, ecx
pop ecx
not cl
xor al, 0x91
and cx, 0x10ad
sal dword [esp + 2], 0x15
neg al
push ecx
ror ecx, 0xea
shr byte [esp + 0xf], 0x81
rol al, 1
xor cl, 0xd
call fcn.00f45ca9
mov ecx, 0x998a933c
movsx eax, cx
mov edx, dword [ebp]
shl eax, cl
adc cl, cl
bt ax, ax
xor edx, ebx
sar cx, 0x4d
not edx
or cl, ch
dec edx
bswap edx
jmp 0x19ef451
rol dx, 0x6b
rol ax, 1
or ecx, ecx
adc ax, 0x9e12
neg edx
not edx
not ecx
xor bx, ax
sub ecx, ecx
xor cx, 0x3d82
or edx, 0xc7acee85
mov word [edi + ecx*2 - 0x7b06], ax
movsx eax, cl
shl eax, cl
imul ecx, edx
movzx ecx, word [ebp + 6]
sbb dx, 0x358d
div eax
sar eax, 0x28
lea ebp, [ebp + edx - 0x1c121038]
xor cx, bx
shr al, 0xa2
shr edx, 0x4b
neg cx
dec dx
sar dl, 0x24
and dx, 0xdea1
adc cx, 0x6c23
or edx, 0xdf3a4092
adc ax, dx
mul dx
rol cx, 1
add cx, 0xc5b2
xor bx, cx
shl edx, 0x10
mov word [edi + edx - 0x542c0004], cx
lea edi, [edi + edx - 0x542c0004]
div eax
dec edx
jnp fcn.00f4a431
push 0x2c
fmul qword [0xebaa87ba]
inc eax
jnp 0x101952d
mov word [edi], dx
push ecx
mov edx, dword [ebp]
inc word [esp]
add ebp, 4
rol byte [esp + 2], 0xa1
lea eax, [ecx*2 + 0x1d20a796]
xor edx, ebx
xor dword [esp + eax*4 - 0x74829c10], eax
jns 0x1073aa4
rol ecx, 0x3d
rol edx, 1
xor edx, 0xaa29bc06
not eax
sal al, 1
bswap edx
btr eax, 0xad
jae 0xf45c68
cbw
xor ebx, edx
add esi, edx
cwde
btr ecx, 0x39
movzx eax, word [ebp + 4]
xor ax, bx
rol ax, 1
movzx edx, cx
sub dl, 0x23
neg ecx
sub ax, cx
neg ax
dec cl
je 0x101948d
Function at 0xfe3130
Capabilities:
Encode data using xor

Disassembly:
inc cx
btc esi, ecx
not ebx
dec esp
lea eax, [edx*4 + 0x3f1af732]
call fcn.00f20a44
inc bp
movzx esp, byte [ebx]
inc ecx
mov ebp, 0xeeb823ba
inc ebp
movzx eax, ch
inc ecx
neg ch
inc edi
mov cl, byte [eax + ebx - 0xb8]
inc ecx
movsx ebp, ax
inc ecx
push eax
dec edi
lea ebx, [ebx + eax - 0xb8]
jge 0x1087a6a
mov eax, 0x3c950019
lea edx, [eax*2 + 0x400e918f]
mov ecx, dword [ebp + eax*2 - 0x792a0032]
call fcn.0109f9d7
and dl, 2
dec ebp
adc edi, ecx
dec eax
xor ebp, 0x600f1e05
dec ebp
lea eax, [edx + ecx*2 + 0x7c018886]
dec esi
mov ecx, dword [ecx + ebx - 0x5e932e59]
inc ebp
mov dl, byte [ebx + ecx - 0x5e932e51]
jg 0x1087b40
faddp st(5)
mov edi, dword [0xacd01ff4]
popfd
leave
nop
pop ds
shr byte [ebp + edx*4 - 0x2fe0336b], 1
lodsb al, byte [esi]
aad 0x89
inc ecx
xchg esi, eax
push ebx
xor byte [eax + 0x592ac549], bl
outsd dx, dword [esi]
sbb bl, bl
and cl, byte [eax + 0x49f390cc]
inc ebp
sbb dword [ecx - 0x4a6452d6], eax
xor ecx, ebp
invalid
Function at 0x1016e52
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push eax
lea edx, [eax*4 - 0x2ad703ec]
bswap ecx
xor ebx, ecx
add edx, edx
call fcn.00f46154

Function at 0x1022b66
Capabilities:
Encode data using xor

Disassembly:
lea edi, [eax + edi - 0x718d4c05]
setae dl
mov dword [esp + edx - 0x718d4c01], edx
and ax, word [esp + edx - 0x718d4bff]
mov dword [edx + edi - 0x718d4c01], ecx
mov ecx, dword [ebp + edx - 0x718d4c01]
or ax, word [esp + edx - 0x718d4c00]
lea ebp, [eax + ebp - 0x718dcd49]
xor ecx, ebx
call fcn.00efeb24
enter 0x77df, 0x3d
jg 0x1022b7f
add eax, 0x8bcbad2c
ret 0x2c05

Function at 0x1032cf5
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push 0x4c8b3d31
dec ebx
push 0x84ae3012
lea esp, [esp + 8]
jne 0x1069699
mov eax, 0x3a4388f
jmp 0xf2c027
and byte [esp + 3], 0xaa
adc eax, edx
push 0x602a1505
not word [esp + 1]
jmp 0x1069680
movzx ebp, al
mov dword [esp + eax], esi
bts ebp, eax
call fcn.0101a4a5
sal bx, 0xaf
mov ebx, edx
mov edx, ebx
shl edx, 2
sal eax, 0xba
mov eax, ebp
push 0x3cabf637
jns 0x1011593
mov dword [ebp - 4], eax
neg dword [esp + 4]
test ebx, ebx
push 0x4b6e832
lea esp, [esp + 0xc]
je 0xf29d65
mov eax, 0x3e310494
cwde
or eax, eax
mov eax, dword [ebp + ebx*4]
push 0x4a067a0f
mov dword [esp], eax
jnp 0xf29d50
Function at 0x106c979
Capabilities:
Check http status code
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x18a], ecx
xor al, 0x3a
add dword [esp + ecx*8 - 0xc50], ecx
xor bl, al
and cl, cl
shr dword [esp + ecx - 0x18a], cl
lea eax, [esp + eax + 4]
neg byte [esp + ecx*2 - 0x313]
inc cx
not ecx
mov word [eax], dx
add dword [esp], ecx
mov edx, dword [esp]
mov edx, dword [edi + 2]
lea eax, [ecx + ecx*8 - 0x6a6bd2d2]
mov ecx, dword [edi + 6]
ja 0x10a0984
call 0x10a6c84
inc ecx
mov ecx, 0xd8ac298
call fcn.01018852
inc ecx
mov esp, 0x4c95e62a
dec esi
lea ecx, [0x5e8ce82c]
inc ecx
movsx ebp, ah
dec ebx
mov ecx, dword [esp + ebx - 0x4c95e62a]
inc edi
mov ch, byte [ebx - 0x4c95e622]
inc ecx
neg ah
inc eax
sete ch
call fcn.00f6890e

Function at 0x1073995
Capabilities:
Encode data using base64

Disassembly:
neg word [esp + ecx - 0x41a696f0]
mov ecx, dword [edi + ecx - 0x41a696e8]
push 0xd1359e8e
adc edi, 3
sar byte [esp + 3], 0x62
ja 0x106966e
mov ecx, 0x243d4084
lea edx, [ecx*4 + 0x52135b8b]
mov eax, dword [ebp + ecx*2 - 0x487a8108]
bts edx, edx
lea ebp, [ecx + ebp - 0x243d4080]
push edx
xor eax, ebx
xor word [esp + ecx - 0x243d4082], cx
xor dword [esp + ecx*2 - 0x487a8108], 0xf10ae68b
adc byte [esp + ecx*2 - 0x487a8108], dl
rol eax, 1
pop edx
sub eax, 0xc2aefea1
and ecx, ecx
sbb cl, ch
bswap eax
lea eax, [eax + ecx - 0x695e0171]
shl edx, cl
setbe cl
bswap eax
btr edx, ecx
neg eax
rol dx, 0x8c
xor ebx, eax
sar edx, 0xf2
jne 0xf0e2ed
not dx
jmp 0xf26e3d
push 0x3d9f31b2
div ecx
mov ecx, 0xb8819137
push ecx
call fcn.00f245bc
mov dword [esp], 0x9bb75686
mov ecx, dword [esp]
add ebp, 4
pop edx
xor eax, ebx
neg eax
xor edx, 0x5d2099a6
not eax
lea edx, [ecx*8 - 0x14675c80]
dec eax
ror cx, 0xad
bswap ecx
imul ecx, ecx
xor eax, 0x589a4b90
dec ecx
xor ebx, eax
add esi, eax
movsx eax, dl
sub cx, 0x61ba
shl cl, 0x23
mov edx, dword [edi + ecx - 0x41a696f0]
push ecx
xchg dword [esp + ecx - 0x41a696f0], ecx
mov eax, dword [edi + ecx - 0x41a696ec]
jne 0xf4a382

Function at 0x1077bb0
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [eax + eax - 0x6a580266]
mov word [eax + edi - 0x2902bf1], dx
lea edi, [edi + eax*4 - 0xa40afb2]
btr ecx, eax
pop edx
pop ecx
jae fcn.00f4a431
Function at 0x107c999
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push 0x7d8b839b
call fcn.01097551
imul esp, dword [esi], 0xffffffc9
xchg esi, eax
pushfd
mov cl, 0xca
jo 0x103f223
mov edi, 0x55050ff3
dec eax
mov ebp, 0x9aade05
mov edi, 0x8b483a98
insb byte es:[edi], dx
and al, 0
dec eax
mov dword [esp], 0xee77c43b
call fcn.00f30bb3
syscall
push 0x9085bd3c
mov byte [esp], 0x18
dec eax
mov dword [esp], 0x15be323a
call fcn.00f30bb3
xor al, 0x95
dec eax
lea esp, [esp + 0x28]
jne 0x109e0c0
inc ecx
pop ebx
inc ecx
not ecx
inc ecx
mov eax, 0xab961488
inc ebp
mov dword [ebx], ecx
inc esp
mov esp, dword [edi]
dec eax
add edi, 4
inc ebp
movzx ebp, al
inc ebp
mov esi, ebp
inc esp
xor esp, esi
inc ecx
neg esp
inc ecx
not esp
inc ecx
sub esp, 0xfd3fd5a6
call fcn.00f2bec1
movzx ecx, word [edi]
inc ecx
mov eax, 0xd91cc30a
inc ecx
push eax
dec ecx
sal eax, 0xfa
dec eax
adc edi, 2
inc ebp
movsx esp, ax
xor cx, si
xor cx, 0x1413
inc ecx
mov ebx, 0x1d13ad3d
inc bp
btc ebx, ebx
inc ecx
setb bl
inc esi
movzx ebx, byte [eax + ebx - 0x1d138d01]
jb 0x103f198
mov eax, 0x10125630
mul eax
mov eax, dword [eax + edi - 0x3bc44900]
xor dl, 0x1b
adc edx, edx
mov cl, byte [edi + edx*2 - 0x4093030]
rol edx, 8
shr eax, cl
mov dword [edx + edi - 0x4981a00], eax
mov eax, dword [ebp + edx - 0x4981a02]
xor eax, ebx
call fcn.00f79f92
jns 0x109e129
jl 0x109e153
xor ah, byte [ebx - 0x31]
daa
lodsd eax, dword [esi]
or cl, byte [esi + 0x17]
iretd
or ecx, edi
daa
lodsd eax, dword [esi]
pushal
loop 0x109e1ab
popfd
mov ebx, 0x558f7fad
push ss
jbe 0x109e1b7
aas
mov bl, 0x87
fcmove st(0), st(6)
xor ebp, dword ds:[esi - 0x72443e67]
and edi, ebp
aaa
add esi, esp
pop es
xor eax, 0x6bcbcd34
dec edx
sub eax, 0xa6fa4e86
xchg byte [esi - 6], cl
cmpsb byte [esi], byte es:[edi]
lodsd eax, dword [esi]
retf 0xb330
invalid
adc eax, 0xcdf1e064
pop es
sbb esi, esi
mov esp, dword [ecx - 0x216e0882]
or byte [edi + 0x497827bf], 0x31
or dh, byte [edi - 2]
add eax, 0x779d9a6b
inc byte [0x779d966f]
invalid

Function at 0x108014d
Capabilities:
Encode data using xor

Disassembly:
and esi, 0xff
call 0x102667d
movsx eax, cx
movzx edx, word [ebp + eax - 0x18a2]
or ecx, ecx
inc ecx
xor dx, bx
push eax
sal ax, 0x81
xadd ecx, eax
adc dx, 0xf1c
sbb al, 0xf
neg dword [esp]
add byte [esp + 2], ah
not dword [esp]
xor dx, 0xe6bf
cbw
ror dx, 1
imul eax, dword [esp]
or dword [esp + eax - 0x631c6ea3], eax
sbb dx, 0x742e
rol dx, 1
push ecx
rol eax, 0x26
xor dx, 0x14a2
xor bx, dx
mov word [edi - 2], dx
call fcn.00f0d0e9
imul byte [ebp - 0x7f]
cmp al, 0xb9
loopne 0xf4995b
fisubr dword [edi - 0x25483b6b]
lodsb al, byte [esi]
fucomi st(5)
mov ah, 0xb7
fisubr dword [edi + ebx*8 + 0x3c3b25bd]
push ebx
or esi, dword [ebx]
add dl, byte [ebx - 0x700363b9]
dec ebp
dec ebp
adc al, 0x40
out dx, al
push ds
dec ecx
invalid
mov dword [esp + 4], esi
lea esp, [esp + 4]
mov esi, 0xe29d813
sar esi, 0x18
shr esi, 0x25
movzx esi, byte [ecx + esi]
jbe 0x1087d47
xor esi, edx
jmp 0x19eaed8
jmp 0xf49934
Function at 0x10a09c2
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec edx
inc dword [esp + 6]
dec esi
mov dword [esp], edi
ret 8
dec edi
lea ebx, [ebx + esi - 0x6e89368b]
inc esp
mov ebp, ebp
jb 0x1048ec7
inc ebx
mov dword [edx + esi - 0x6e893697], ebx
inc esi
mov esi, dword [edi + esi - 0x6e893697]
inc esp
movsx edx, ch
dec eax
adc edi, 4
mov edx, ebp
dec eax
lea edx, [ebp + edx*8 + 0x2814d989]
inc esp
xor esi, esi
dec ecx
sar esp, 0x2a
dec esi
mov dword [esp], ebp
inc ecx
xor esi, 0xbf9ac536
inc ecx
inc esi
inc ecx
push esp
inc ecx
xor esi, 0x59083734
inc esi
add ebp, dword [esp + 6]
dec edx
not dword [esp + 8]
inc ebp
sbb esi, esp
inc ebp
movsx ecx, ah
inc esi
movsx eax, byte [esp + 4]
dec edx
mov dword [esp + 8], esi
inc edx
movsx esi, word [esp + 1]
dec edx
rol dword [esp], 0x2a
inc ecx
bt eax, edx
inc esi
xor dword [esp + ecx*4 + 8], esi
dec edx
mov esi, dword [esp + 8]
dec ebp
arpl si, si
inc ecx
mov ebx, eax
dec esi
mov dword [esp + 8], eax
dec ebp
add edi, esi
jmp 0xfe5e1a
dec eax
lea edi, [edx + edi - 0x5e8cd332]
inc ecx
mov ecx, 0x18a8b435
dec edx
lea ecx, [ebx + eax*4 - 0x1240294c]
inc esp
movzx esp, dl
inc esp
xor esi, esi
dec eax
lea eax, [ecx*8 - 0x5c73fbdd]
dec eax
lea edx, [eax + eax*4 - 0x727f82f6]
jmp 0xf3ef85
jg 0xfea786

Function at 0x10a0ce7
Capabilities:
Encode data using base64

Disassembly:
adc edi, 4
div ecx
mov ecx, 0x96a8c636
mov dword [edi], edx
mov edx, 0x5b1da8b9
neg cl
mov dword [edi + edx - 0x5b1da8b5], eax
lea eax, [edx + 0x151c0b9e]
jmp esi
ja 0x19ed3a0
in eax, dx
lcall 0x2740, 0xfba23d7c
lodsd eax, dword [esi]
ljmp 0x82ad
xor eax, 0xf53d8995
imul edx, dword [esp + 4]
setae byte [esp + edx - 0x480c5bf9]
xor ebx, eax
sal dword [esp + edx - 0x480c5bf6], 0x54
jnp 0x10b89c6
imul cx, cx
adc esi, eax
mov dword [esp + edx - 0x480c5c00], esi
ret 0xc
mov edx, dword [edi + eax - 0x3ff734a9]
mov eax, dword [eax + edi - 0x3ff734a5]
mov ecx, 0xaadbb
not cl
sar ecx, 0x28
mov ecx, dword [edi + ecx*2 - 0x1552]
jns 0x1096e80
jne 0xf471e2

Function at 0x10b0440
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
call 0x109862f
mov edx, 0x8421ab9e
dec esp
lea eax, [edx + edx*8 + 0x74b8fc2d]
inc esp
mov ebp, dword [edi]
dec eax
add edi, 4
inc ecx
movzx ebp, al
inc esp
xor ebp, esi
jmp 0xf13cbe
Function at 0x10b4aea
Capabilities:
Encode data using xor

Disassembly:
inc ebp
mov dword [ecx + ecx - 0x1e], eax
dec esi
mov dword [esp + ecx*2 - 0x3c], edi
ret 8
cwd
dec edi
lea ebp, [eax - 0x50eafccd]
inc edi
mov eax, dword [edx + ebx - 0x30]
dec esp
or edx, edx
movsx ebp, dl
dec edi
lea ebx, [ebx + ecx*2 - 0x30]
jnp 0x106aa98
pop esp
dec ebx
ror byte [edi], 1
mov esp, dword [edx - 0x1800045f]
mov ecx, 0x33914767
push ebx
adc al, 0xe5
fadd qword [eax]
mov es, esi
movsb byte es:[edi], byte [esi]
out 0x3d, al
out 0xb9, eax
inc edi
xchg ecx, eax
xor edx, dword [ebx + 0x14]
in eax, 0xdc
add byte [esi + 0x3de6a4c6], cl
popal
jbe 0x10b0947
daa
push ss
in eax, 0x35
outsb dx, byte [esi]
xchg esi, eax
daa
push ss
in eax, 0x1d
xchg ebp, ebp
lodsd eax, dword [esi]
jmp 0x10b0932
dec ebx
xchg edx, eax
rol dword [ebp - 5], cl
stosd dword es:[edi], eax
add dword [edi - 0x4ee25017], eax
scasb al, byte es:[edi]
pop esi
add byte [edi + edx*4], al
arpl word [eax], cx
mov al, 0x33
mov ch, 0xce
pop dword [edi]
adc al, 0x1e
add eax, 0xdce9bf24
adc eax, esp
add ch, bh
das
shl word ss:[ecx + 0x2c8c1184], 0x32
dec edx
and dword [ebx], ebx
pushal
salc
jo 0x10b08ed
rcr edx, cl
xor eax, 0xce7efbdb
xlatb
jae 0x10b0969
sub dword [edi + 0x42], edx
pop ecx
push 0x79fbdbab
aad 0xbf
aam 0xeb
push ds
lodsb al, byte [esi]
adc al, 0x6f
out dx, al
pop eax
fsubr dword [eax - 0x73003710]
mov edi, 0x4f4082b1
aaa
stosd dword es:[edi], eax
fild qword [esp + edx*4 + 0x75]
rcr ah, cl
pop ds
int3
inc ecx
push esp
inc ebp
movsx ecx, al
xor ebx, 0xbf9ac536
dec edx
mov dword [esp + edx - 0x30], eax
mul byte [esp + edx - 0x3b0133b7]
dec ebp
lea ebp, [edx + 0x6b073da1]
inc ebx
dec esp
mov dword [esp + edx - 0x3b0133ae], ecx
dec ebp
bts ebp, edx
cdq
xor ebx, 0x59083734
dec edx
inc dword [esp + edx*2 - 0x60]
add ebx, edx
dec edx
mov dword [esp + edx - 0x28], esi
movzx ecx, dl
inc cx
add edx, esp
inc edx
xor dword [esp + edx*4 - 0xd0], ebx
dec edx
mov esi, dword [esp + edx*2 - 0x60]
inc dx
inc dword [esp + edx - 0x30]
dec eax
arpl bx, bx
shl edx, 0xdc
inc ecx
pop ebp
dec esp
add edi, ebx
shl dx, 0xea
cdq
dec ebx
mov ecx, dword [edx + ebx - 0x38]
jae 0x10b08d6
mov edx, 0xd5b8bd8e
jmp 0x10bcb40

Function at 0x10b89eb
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x30]
jne 0xf62fd3
Function at 0x100138c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call sub.msvcr100.dll_memset
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call dword [sym.imp.msvcr100.dll_sprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001395d
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x100139a0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10023c4a
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10013987
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100139a0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call dword [sym.imp.msvcr100.dll__mbscmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ba56
add ebp, 0x78c
leave
ret

Function at 0x10013b9c
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10013bbd
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10013bbd
inc esi
mov eax, esi
pop esi
ret

Function at 0x1001460e
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x1001eac9
call fcn.1001bb3b
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10014668
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.100178de
pop ecx
pop ecx
push ebx
push edi
call fcn.1000ec37
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10006d43
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10014685
call fcn.100060e0
jmp 0x10014687
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100146d3
call fcn.10007f79
jmp 0x100146d3
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1001ba56
add ebp, 0x20c
leave
ret