joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x4cd214
cmp byte [edx], 0
je 0x4cd207
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.004cd0a0
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.004cd0a0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.004cd010
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x4cd1d1
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.004cd050
fmul qword [0x7654a0]
push ecx
fstp qword [esp]
call fcn.004ecbc8
fadd qword [0x765498]
add esp, 8
call fcn.004ecc98
mov byte [ebx], al
inc ebx
dec edi
jne 0x4cd1a4
lea ecx, [esp + 0x20]
push ecx
call fcn.004cd050
fmul qword [0x7654a0]
push ecx
fstp qword [esp]
call fcn.004ecbc8
add esp, 8
call fcn.004ecc98
cmp esi, ebx
je 0x4cd1fd
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x4cd1f6
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cd5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x4cd610
mov byte [edi + esi], 2
jmp 0x4cd647
test al, 4
je 0x4cd61a
mov byte [edi + esi], 0xd
jmp 0x4cd647
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x4cd633
mov byte [edi + esi], 2
jmp 0x4cd647
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x4cd643
mov byte [edi + esi], 0x19
jmp 0x4cd647
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x4cd5f7
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x4cd6bb
cmp dl, 0xd
je 0x4cd6bb
xor edx, edx
jmp 0x4cd6c0
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x4cd6ab
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x4cd6e0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.004cbfa0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4cd701
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.004ced40
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x4cd726
push esi
call fcn.004cc030
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.004f19ac
push ebx
push edi
mov ebp, eax
call fcn.004cedb0
push 0x4cd760
push ebp
push esi
call fcn.004d00e0
push esi
call fcn.004cc030
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x4cea70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x9438c0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x9437e0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4ceaeb
push 0x4c
push 1
call fcn.004ef1a5
mov esi, eax
add esp, 8
test esi, esi
jne 0x4ceab3
push 0x9438c0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x9437e0]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x935130]
inc eax
lea edx, [esi + 0xc]
mov dword [0x935130], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.004d2610
add esp, 8
mov byte [esi + 0x3c], 1
push 0x9438c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x4cef70
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.004eed7d
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.004f19ac
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4cf06a
call fcn.004eed7d
cmp dword [eax], 0
je 0x4cefb7
call fcn.004eed7d
mov ebp, dword [eax]
jmp 0x4cefba
or ebp, 0xffffffff
call fcn.004ceb00
test esi, esi
mov dword [eax], ebp
jne 0x4cefcf
call fcn.004eed7d
cmp dword [eax], 4
je 0x4cf01f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x4cf002
cmp esi, 0xffffffff
je 0x4cf044
test al, 6
je 0x4cf002
call fcn.004ceb00
mov ecx, dword [eax]
push ecx
push ebx
call fcn.004d2640
add esp, 4
push eax
push 0x24
push 9
call fcn.004cf350
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x4cf062
test al, 6
je 0x4cf010
test ah, 2
je 0x4cf062
test esi, esi
jbe 0x4cf06e
test ah, 2
je 0x4cf06e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.004eed7d
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.004f19ac
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4cf06a
jmp 0x4cefa4
call fcn.004ceb00
mov eax, dword [eax]
push eax
push ebx
call fcn.004d2640
add esp, 4
push eax
push 0x24
push 2
call fcn.004cf350
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x4cf07b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x4cf084
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x4f14c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4f14e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004eed0a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4f1507
test byte [esp + 8], 2
je 0x4f1507
call fcn.004eed7d
mov dword [eax], 0xd
call fcn.004eed86
mov dword [eax], 5
jmp 0x4f14e0
xor eax, eax
ret
Function at 0x50356f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5035a7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00501626
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005015fe
jmp 0x5035b3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x504c61
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x504ca3
call fcn.0050a719
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x504ca3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x504c9a
xor eax, eax
jmp 0x504cab
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00504cb1
pop edi
pop esi
pop ebx
ret 4

Function at 0x50ac49
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x50ac77
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x50ac95
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0050abaf
jmp 0x50ac95
mov eax, dword [esi + 0x14]
test eax, eax
je 0x50ac95
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0050abaf
test edi, edi
mov eax, edi
jne 0x50ac7f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x946498
Capabilities:
Packed with generic packer

Disassembly:
sub dl, 0x2e
rol ecx, 0x84
ror cx, 0x62
not dl
bswap ecx
push ecx
mov dword [esp + eax*2 - 0x7b04003e], 0xbd32c1a1
sbb dl, 0x95
sub al, cl
ja 0x9d28aa
mov edx, 0xb81846ad
mov dx, word [edi]
mov eax, 0xf48b6daa
neg al
mov ecx, eax
mov cx, word [edi + 2]
push eax
not dx
call fcn.009baf14

Function at 0x952e85
Capabilities:
Parse pe header

Disassembly:
dec ecx
mov dword [esp + eax*2 + 8], edx
mov dword [esp + eax], eax
push eax
xor ebx, ecx
inc edx
jp 0x984d19
mov dword [esp + ecx*4 - 0x62e4acd4], edx
mov edi, dword [esp + ecx*2 - 0x31725660]
jmp 0xa12ddd
add edi, ecx
movzx ecx, dx
cwd
shl edx, 0x37
xor al, byte [esi + edx*8]
rol ecx, 0xf9
bts ecx, 0x23
mov cl, byte [esi + edx + 2]
call fcn.009bc655
mov eax, 0xe9804c8a
movsx edx, al
mov eax, dword [esi - 4]
movsx ecx, dl
btc cx, cx
bts cx, 0x8f
xor eax, ebx
shl cx, 0x86
imul dx, dx
call fcn.009f43bf
push eax
xor ecx, 0xa3b2f8a3
sub word [esp + edx*2 + 5], ax
shl byte [esp + edx], 0xa1
bswap ecx
shl word [esp + edx*2 + 1], 0xa8
pop eax
lea ecx, [ecx + edx - 0x7931d98c]
xor ebx, ecx
xadd ax, dx
adc edi, ecx
inc dword [esp + edx*4]
movzx ecx, byte [esp + eax*2 - 0x4c000000]
mov dword [esp + edx], edi
ret
push ecx
mov ebp, dword [esp + ecx - 0x18b92b20]
call fcn.00ab26fe
Function at 0x9612f4
Capabilities:
Parse pe header

Disassembly:
mov esi, dword [esp + esi + 0x3e73e0f5]
mov dword [esp + 8], 0xb2339770
lea esp, [esp + 8]
call fcn.00a15f85
mov ecx, 0xabb1142b
sub ebp, 4
mov ecx, dword [ebp]
mov edx, 0x7da2ccbe
push edx
inc dl
xor ecx, ebx
movsx eax, dx
inc word [esp + edx - 0x7da2ccbe]
bswap ecx
and al, dh
sal eax, 0xc7
rol ecx, 1
pop edx
imul eax
lea ecx, [ecx + edx*2 - 0x2892f0c6]
xadd dl, al
not al
cmovne eax, edx
rol ecx, 2
inc dx
xor ebx, ecx
add esi, ecx
jmp 0xac824f
movsx ecx, dx
mov ax, word [edi + edx*2 - 0x52c]
not cl
push edx
or cl, cl
mov cx, word [edi + edx*8 - 0x14ae]
add edx, edx
jns 0xa3db5d
jmp 0xa1ead2

Function at 0x9730e9
Capabilities:
Authenticate hmac

Disassembly:
jnp 0xacb1a0
mov eax, dword [edi]
push edx
or dx, word [esp]
call fcn.00969c3f
call fcn.009b3c1c
not eax
mov eax, dword [ebp + ecx - 0x6c5c68e6]
xor eax, ebx
lea edx, [ecx + ecx*4 - 0xcc8ce42]
push edx
lea ecx, [ecx + edx*8 - 0x7c4ba468]
ror eax, 1
push edx
lea ecx, [edx*2 - 0x63f2f152]
bswap eax
call fcn.00a478f7
or edx, 0xb7b613b5
or byte [esp + 3], cl
bts dx, 3
mov ecx, dword [eax]
sbb ebp, 4
jmp 0x98a3b8

Function at 0x98279a
Capabilities:
Encode data using xor

Disassembly:
neg eax
rol dl, 0xc5
lea eax, [edx + eax + 0x3b9cae60]
mov dword [esp + edx*2 - 0x80], edx
sbb word [esp + edx - 0x40], 0x1da2
sub ecx, edx
xor ebx, eax
xor dword [esp + edx*4 - 0x100], ecx
dec byte [esp + edx*4 - 0xfd]
adc esi, eax
mov ecx, dword [edi + edx*2 - 0x7c]
neg word [esp + edx - 0x3f]
sal dx, 0x62
mov edx, dword [edx + edi - 0xf8]
jp 0xa08d39
bound ecx, qword [ebx - 0xf7c56c]
invalid
stosb byte es:[edi], al
pop edi
xor dword [esi], esp
fstp dword [ebp + 0x7ca9ee6e]
and esp, dword [ecx + 0x44a9ee6e]
cmp eax, 0xa9ee6e95
push 0xeebb7ee1
mov dword [ebx - 0x52], edx
jge 0x9827e0
stosd dword es:[edi], eax
adc dword [ecx], eax
pop ebx
mov eax, dword [0x49015103]
into
pop eax
insb byte es:[edi], dx
pop ds
cmpsd dword [esi], dword es:[edi]
jnp 0x982854
jne 0x982843
adc eax, 0x8258670
insd dword es:[edi], dx
xchg byte [edx + 0x3cff18f3], cl
and eax, 0xbd530772
adc eax, 0xec529b8b
jmp 0x982842
int 0x53
push ebx
jno 0x9827d0
add eax, 0xbb53d8d8
fild word [ebp - 0x74115b59]
rol byte [edx], 0xf7
ror byte [edi], 1
scasd eax, dword es:[edi]
leave
mov dword ss:[ecx], edx
pop eax
jmp esi
adc edi, 0xc
jmp 0x9c0bdf

Function at 0x991a64
Capabilities:
Manually build aes constants

Disassembly:
pop edx
pop ecx
pop ecx
pop eax
pop ecx
pop eax
jne fcn.009f8528
add word [esp + eax - 0x621bf8e7], ax
lea edx, [eax + edx - 0x77504b20]
ror eax, 0x3d
call fcn.009db665
mov cl, byte [edx + esi - 0x8e74b47]
neg edx
call fcn.00ac8a8c
Function at 0x9a2b85
Capabilities:
Encode data using base64

Disassembly:
neg eax
inc eax
sub edx, ecx
ror dx, 0xc9
xor ebx, eax
add esi, eax
mov ecx, dword [edi]
movsx eax, dl
and eax, eax
mov al, byte [edi + eax*4 - 0x170]
sal edx, 0x3a
adc dx, dx
lea edi, [edi + edx - 0x73fffffb]
neg edx
xor edx, edx
sar edx, 0x7b
mov byte es:[edx + ecx], al
btc edx, edx
jmp esi
neg ecx
xor ebx, edx
not cx
ror eax, 0x74
adc edi, edx
pop ecx
jmp fcn.00a0b620
not edx
shl cl, 0x27
sub al, 0x8a
mov dword [esp + eax - 0x726a6ca0], eax
lea edx, [edx + ecx*8 + 0x7c68999b]
rol edx, 1
shr word [esp + ecx - 0xb6a0b7f], 4
dec edx
shl ecx, 0xe1
xor ebx, edx
dec eax
mov dword [ebp + ecx - 0x16d41706], edx
or dword [esp + eax - 0x726a6c9f], ecx
adc al, ah
setae al
lea ebp, [ecx + ebp - 0x16d41706]
imul eax
push ecx
inc cx
mov edx, dword [esi + ecx - 0x16d416fb]
inc cx
sub dword [esp + ecx - 0x16d416ff], eax
sub eax, ecx
lea esi, [esi + ecx - 0x16d416f8]
ror cl, cl
pop ecx
xchg dword [esp], ecx
xor edx, ebx
and cx, cx
neg edx
sub eax, 0x540bec02
push ecx
inc edx
cbw
pop ecx
sal eax, 0x52
xor edx, 0xf6af81bf
add edx, 0x5815ba3d
or ax, ax
jns 0x99b7d3
rol eax, 3
not cx
not eax
xadd cl, ch
sets dl
jbe 0x95140c
Function at 0x9b7ee6
Capabilities:
Encode data using base64

Disassembly:
call fcn.00967ef6
call fcn.0041e24c

Function at 0x9b996c
Capabilities:
Encode data using xor

Disassembly:
xor eax, ebx
sar ecx, cl
rol eax, 2
dec eax
dec dx
neg byte [esp]
bswap eax
add dword [esp], 0x6995ad91
ror eax, 1
sub cl, dh
xor ebx, eax
add edi, eax
sal ecx, cl
inc dl
mov edx, dword [esi]
shl ecx, 0x89
setbe cl
mov eax, dword [ecx + esi - 0x7ffffffc]
add cl, byte [ecx + esi - 0x7ffffff8]
not byte [esp + 2]
push esp
and al, 2
not dword [esp]
and al, 0
sal byte [esp + 3], 0xe4
adc esi, 5
call fcn.009d9f41
pop ss
mov bh, 0xf0
xor eax, 0xcc7f65f5
pop ecx
aas
mov ecx, 0xce697cd5
aad 0x22
mov dh, 0xbc
inc dword [edx - 0x753a408]
xlatb
jne 0x41fc7b
clc
fdivr qword [eax]
das
in al, dx
insb byte es:[edi], dx
test eax, 0x53881713
push cs
add byte [esi + 0x7b7a83a6], bl
sbb al, 0x18
jne 0x41fc76
cmp byte [eax], cl
mov edi, 0xe60ae495
inc edi
push ds
retf
sbb al, 0x80
xor dword [esp + edx + 4], ecx
sar edx, 0xf4
sal edx, 0x70
not al
lea ecx, [edx + edx*2 + 0x67a5d11d]
push edx
adc al, 0xd
mov dword [esp + edx*2 + 4], 0xf082b9b8
and dx, word [esp + edx*2 + 4]
setp cl
xor al, 0x26
pop ecx
add byte [esp + edx + 7], dh
setp dl
adc al, 0x12
xor al, 0xd
xor bl, al
lea eax, [esp + eax + 8]
sal dword [esp + edx], 0x5e
or ecx, dword [esp + edx*2 + 2]
bswap edx
mov edx, dword [eax + edx*8 - 0x8000000]
or cx, cx
sbb edi, 4
xor ecx, ecx
mov eax, 0x820ec5a2
and cx, ax
mov dword [edi + ecx*2], edx
cwde
sal dword [esp + ecx + 4], 0x46
lea ebp, [ebp + ecx*4 - 4]
rol dword [esp + ecx*2], 0x28
cmovnp ecx, eax
movzx edx, cl
adc edx, dword [ebp + ecx*8]
xor edx, ebx
call fcn.009f0c97
jae 0x41fc39
adc al, 0x6b
sbb edi, eax
mov ecx, 0x74008dc4
clc
popal
lcall 0x9d34, 0x8ff6a10
xchg esi, eax
adc byte [edx - 1], ch
int 0xd7
push ds
test eax, 0x3e53f5bf
jo 0x9b9a0c
cmp byte [ecx + 0x4e6c045d], ch
out dx, eax
mov fs, word [edi - 0x4c8d4ac1]
fisub word [edi - 0xcc54ac1]
mov byte [0x30b53fa7], al
mov ebx, 0xad4a3e09
cmc
cmp dword [esi - 0x195d38], esp
mov byte [ecx*4 - 0xd6382], bl
shr ah, 1
jae 0x9b9abd
pushfd
bnd jmp [ecx + 3]
insd dword es:[edi], dx
sub dword [eax + ebp*4 - 0x27], 0xfffffff3
popfd
insb byte es:[edi], dx
nop
mov byte [esi + 0x4f], ah
aas
invalid

Function at 0x9ba2e2
Capabilities:
Encode data using base64

Disassembly:
btr eax, 0x21
and ax, ax
adc ebp, 4
neg ax
sbb al, byte [esp + 1]
or edx, ecx
call fcn.00a0a284
mov dword [esp], eax
inc word [esp + 2]
mov edx, dword [ebp]
mov ecx, dword [ebp + 4]
jle 0x419dc2
Function at 0x9c02f4
Capabilities:
Manually build aes constants
Packed with generic packer

Disassembly:
and ecx, ecx
or dl, al
and ecx, 0x210b3c8b
mov word [ecx + edi - 0x20030086], dx
lea eax, [ecx + ecx*8 - 0x62654dfe]
pop eax
movzx eax, word [ebp + ecx - 0x2003008c]
xor ax, bx
or cx, cx
dec ax
lea edx, [ecx*2 - 0x5fe3ec67]
not dl
ror ax, 1
bts cx, cx
bt cx, 0x3c
sar dx, cl
sbb ax, 0xda3d
jmp 0xa2f141
shr cl, 0x82
rol ax, 1
shr dl, 0xa7
shr ecx, cl
xor bx, ax
not cx
and ecx, ecx
add dl, 0x94
mov word [ecx + edi - 0x8003ef5], ax
movsx eax, cx
lea edi, [edi + eax*2 - 0x7dec]
lea eax, [edx*2 - 0x64443400]
mov ecx, dword [ebp + ecx*4 - 0x2000fbe2]
mul eax
call fcn.009bdf97
mov ecx, dword [eax + edx - 0x20003253]
call fcn.009f9791

Function at 0x9ccd8c
Capabilities:
Encode data using base64

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x10]
call fcn.00962d65
sub eax, ecx
call fcn.00aa10c7
sub esi, 4
mov eax, 0x211edca4
mov ecx, dword [esi + eax - 0x211edca4]
xor ecx, ebx
cdq
bt ax, dx
idiv al
dec ecx
rol ecx, 1
sub ecx, 0xd99b0ca0
jmp 0xadb06e
Function at 0x9e87ac
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], eax
neg ecx
xor al, dh
jno 0xa463cb
push ebp
mov esp, fs
pushal
jp 0x9e87d3
cwde
rcr ebx, 1
mov al, 0x1a
out 0xe8, eax
rcr ebx, 1
mov al, 0x6e
cmpsd dword [esi], dword es:[edi]
mov ecx, ss
invalid
std
sal dword [eax - 0x63ac9002], cl
sahf
mov dl, 0xea
add ecx, dword [ecx]
std
mov eax, 0xf497f395
add edx, dword [esi]
movsb byte es:[edi], byte [esi]
push es
xchg ebx, eax
or al, 0xd3
rcr byte [edx], cl
retf 0xefdb
shl dword [esp], 0x41
dec ecx
sal dx, 0xee
sub ax, ax
bswap ecx
rol al, 0x41
call fcn.00a2a428
mov dx, word [ecx]
add esi, 2
call fcn.00ab3f69
push esi
push ebp
ja 0xae37a4
jne 0xae379d
setae dl
mov byte [eax], cl
mov ecx, dword [ebp - 5]
xor ecx, ebx
add dx, dx
push edx
mov eax, edx
xor ecx, 0xb92f1b32
jmp fcn.00988626
mov ebp, dword [esp + ebp + 0x58b26096]
mov dword [esp + 0xc], 0x512edb60
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.009d55f3
Function at 0x9f0369
Capabilities:
Encode data using xor

Disassembly:
ror edx, 1
lea edx, [ecx + edx + 0x6657f7f2]
xor cx, word [esp + eax - 0xbfa6]
not edx
sbb ax, cx
jo 0xa8860b
lea edx, [edx + ecx*2 - 0x3ca0da17]
push eax
bswap edx
sbb ax, 0xe123
inc ecx
xor ebx, edx
add esi, edx
not dword [esp + eax - 0x41ab]
movzx edx, word [esp + eax - 0x41ab]
mov dword [esp + ecx - 0x7bac9cd4], esi
ret 8
lea edx, [edx + eax*2 - 0x289b50fa]
jle 0x975462
daa
xor eax, ebx
sub dword [esp], 0x923fd124
mov ecx, 0x3f9acc8f
bswap eax
inc eax
lea edx, [ecx + ecx*2 - 0x6a5b0b78]
rol eax, 1
jmp 0xaa9fe8
not al
inc ecx
sar ecx, 0xe5
neg cx
xor bl, al
lea eax, [esp + eax + 4]
call fcn.00aaa553
pop ebp
xchg esi, eax
jecxz 0x999e16
push edx
jae 0x999d7d
retf
enter 0xffffffffffffb0dc, 0xffffffffffffffb1
dec eax
xor ecx, eax
fdiv qword [eax + 0x22445087]
sal dword [eax + 0x296da29b], 0xb1
cmp eax, 0x10bed04b
mov dword [esi + 0x2c3a8451], 0x1132b5f2
sub dword [esi + 0x4f], 0x24
lea esp, [ebx - 0x24a5f5c5]
xor dh, dh
mov ebp, 0x8128c0f6
mov edi, ebp
sbb dword [ecx - 6], 0xc40a0ab0
xor edx, esp
push dword [ebp - 0xa71d173]
mov ch, 0xf7
fmul st(2), st(0)
xor byte [ebp - 0xd2b135c], bl
xchg byte [ebx - 0x46], dl
inc eax
insb byte es:[edi], dx
or ecx, dword [edx - 0x655fc56f]
test dword [ebx], edx
lodsd eax, dword [esi]
cmc
add edx, ebp
push edx
fidiv dword [ebx - 0x56]
push esi
mov ecx, 0x867d5e2e
mov ecx, ebx
mov byte [0x923f2959], al
xchg byte [esi + 0x7c1fd074], dh
add dword [esi + 0x35], edi
and eax, 0xc8cb8f58
push esi
invalid
mov edx, dword [ebp + ecx - 0x7bacbfa8]
mov dword [esp + ecx - 0x7bacbfa8], 0x7c9fdc23
push ecx
dec dword [esp + ecx - 0x7bacbfa5]
xor edx, ebx
inc cl
movzx eax, cx
jne 0x98bc1c
sar dx, cl
xor bl, al
sar cl, 0xa4
ror edx, cl
adc eax, esp
sar cx, 0xd
mov edx, dword [eax + edx*4 - 0x80]
mov eax, ecx
mov dword [edi - 4], edx
mov eax, dword [ebp - 5]
sbb ecx, ecx
jb 0xabf69d
and word [esp + edx - 0x54755a34], dx
call fcn.00a5ea5f
lea edx, [ecx + ecx*2 + 0xa2012a2]
xor eax, ebx
shr edx, 0xbf
sbb eax, ecx
xor eax, ecx
shl edx, cl
sar cl, 3
rol eax, 1
shl ecx, cl
shr dx, 0xc6
add ecx, edx
xor eax, 0x2c184ba9
shl ecx, 0x91
sbb ecx, edx
add edx, 0x11370c21
lea eax, [ecx + eax - 0x3daf7c03]
xor ebx, eax
xadd edx, ecx
adc esi, eax
xchg ecx, edx
call fcn.00946dd1
mov ecx, dword [edi]
add edi, 4
mov eax, 0x1b3952b0
or eax, 0xdf375ab7
btc eax, eax
xor ecx, ebx
bt eax, eax
movsx edx, ax
call fcn.00ad5bcb
sub al, 0x11
neg ecx
shl ecx, cl
js 0x999d9e
Function at 0x9f7ac0
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x56ceef7c], eax
inc al
add ecx, edx
cdq
mov dword [esi + eax - 0x56ceef75], ecx
inc dx
lea esi, [esi + edx*4 + 4]
neg edx
mov eax, dword [ebp + eax - 0x56ceef81]
imul edx, edx
lea ebp, [edx + ebp - 5]
rol dx, 0x85
setb dl
movsx ecx, dx
xor eax, ebx
not edx
rol eax, 1
xor eax, 0x48958e80
add word [esp + ecx*8 + 2], 0xbf89
js 0x95a3a1
ror eax, 1
or edx, dword [esp + ecx*8]
rol ecx, 0x9b
adc eax, edx
dec edx
ror byte [esp + ecx], 4
xor ebx, eax
pop edx
add edi, eax
btr edx, edx
jb 0xa4e05b
xor edx, dword [esp + ecx - 0x2f135d10]
xor eax, ebx
and cx, dx
ror edx, 0x6f
inc eax
not eax
rol eax, 1
push edx
xor cl, ch
xor eax, 0x2c184ba9
lea eax, [eax + ecx - 0x6cc27c03]
xor ebx, eax
add esi, eax
inc dword [esp + ecx - 0x2f12fffc]
pop edx
setnp byte [esp + ecx*2 - 0x5e260000]
lea eax, [esp + ecx*2 - 0x5e25ffb0]
or cl, cl
add cl, cl
sbb cx, cx
xor edx, dword [edx + eax]
rol cl, 0xc1
btr ecx, ecx
mov eax, ecx
mov dword [ecx + edi - 0x2f130004], edx
lea edi, [ecx + edi - 0x2f130004]
cbw
bt ecx, 0xa4
bts eax, 0x27
pop eax
jae fcn.00a46bed
mov edx, dword [edi]
call fcn.00957fed
call fcn.00a3d285
add ecx, edi
jmp ecx

Function at 0x9f9835
Capabilities:
Encode data using xor

Disassembly:
loopne 0x951106
mov ebp, dword [ebp]
imul edx, edx
rol eax, 0xd0
pop edx
jb fcn.00a92e3c
mov bl, byte [edx + 0x24]
xor eax, 0x97a46d
in eax, dx
scasd eax, dword es:[edi]
or dword [edi + edx*4 + 0x7dad2400], esp
movsb byte es:[edi], byte [esi]
xchg edi, eax
add byte [ebp - 0x74], cl
jns 0x9510cc
pop ss
push eax
jle 0x951195
hlt
pop edi
inc esp
jge 0x9511f4
dec edi
and eax, dword [eax]
das
int3
aaa
push eax
xor edi, dword [edi]
ror eax, 0x3d
lea ebp, [ebp + eax - 0xc]
pop ecx
pop ecx
pop edx
pop eax
pop ecx
pop ecx
jae fcn.00a0b620
sbb ecx, 0x9e27069a
mul eax
mov dword [esp], edx
mul word [esp + 1]
rol ecx, 2
bswap ecx
rol ecx, 1
shr dword [esp], 0x92
xor ebx, ecx
bt ax, ax
add esi, ecx
sar word [esp], 0x61
sbb al, dh
jg 0x9510ff