joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bff00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x610d97
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.005fd9c6
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.005fd9c6
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.005c0a20
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x5c0a70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x610e70
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.006096ff
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x5c0aa3
xor al, al
jmp 0x5c0bcf
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x5c0ac5
xor al, al
jmp 0x5c0bcf
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x5c0ad8
xor al, al
jmp 0x5c0bcf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x5c0aec
xor al, al
jmp 0x5c0bcf
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.005fda8b
test eax, eax
jne 0x5c0b20
xor al, al
jmp 0x5c0bcf
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x16f3a0c
mov dword [esp + 0x20], ebp
call fcn.006096ff
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.006065aa
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.00606601
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x5c0bb4
mov ax, word [ebx]
test ax, ax
je 0x5c0ba6
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.005c0bf0
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x5c0b8a
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.00606601
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x5c10f0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.00607c5a
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x5c1136
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.005ede64
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x17db308
push ecx
call fcn.005efcef
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x5c57f0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5c583a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x5c5869
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x5c58ab
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x5cd1b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x1823bbc]
xor edx, edx
cmp eax, edx
jne 0x5cd1d6
xor eax, eax
mov byte [eax + 0x1823abc], al
inc eax
cmp eax, 0x100
jl 0x5cd1be
mov dword [0x1823bbc], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x1823abc
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x5cd267
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x5cd23a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x5cd208
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5cd270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x5cd2c3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x5cd2aa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5d3c50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61111e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.005d4570
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x16f4964
call fcn.005ff4d1
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x5d3ce3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005ff4d1
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x5d3cdc
push 0
mov ecx, eax
call fcn.005cadf0
mov dword [esi + 0xc], eax
jmp 0x5d3ce5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x5d3ce5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x601b70
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x601ba8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005ffbeb
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005ffbc3
jmp 0x601bb4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x60336e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x6033b0
call fcn.006096ff
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x6033b0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x6033a7
xor eax, eax
jmp 0x6033b8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.006033be
pop edi
pop esi
pop ebx
ret 4

Function at 0x609c2f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x609c5d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x609c7b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00609b95
jmp 0x609c7b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x609c7b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00609b95
test edi, edi
mov eax, edi
jne 0x609c65
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x484e26
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stc
add ah, 0x20
pushal
pushfd
or al, al
pushfd
mov byte [esp], 0x8a
mov byte [esp], 0x2f
lea esp, [esp + 0x2c]
je 0x4c6bf4
bt ax, cx
stc
pushfd
cmp al, ah
jmp 0x4871fe
mov dword [esp], edi
lea esp, [esp + 4]
jne 0x48985f
call fcn.00485c40
add byte [eax], al
inc edi
je 0x48725c
outsd dx, dword [esi]
arpl word [ebp + 0x73], si
add byte [eax - 0x27], ch
jae 0x487238
call 0x46cd6b1
add al, 0x78
push cs
daa
cmp edi, esp
arpl word [ebp - 0x5d], cx
sbb edx, eax
lea ebx, ds:[ebx + 0x9a49901]
mov dh, 0x78
lcall 0x816b, 0xf1dacfce
test eax, ecx
shr dword [ebp*2 + 0x51ab5ddb], 0x49
scasd eax, dword es:[edi]
mov ebx, 0xaf2a2ef0
retf

Function at 0x485320
Capabilities:
Encode data using base64

Disassembly:
xchg dword [ebp - 0x28], edx
call fcn.004c55cd
lea esp, [esp + 0x28]
js 0x486063
jb 0x486d67
call fcn.004c8086
add byte [eax], al
inc edi
je 0x485386
jns 0x4853a0
outsd dx, dword [esi]
popal
jb 0x4853a6
dec esp
popal
jns 0x4853b5
jne 0x4853bc
add byte [eax], al
add byte [edi + 0x65], al
je 0x48539c
outsd dx, dword [esi]
jne 0x4853bf
inc esi
push es
add dword [eax], eax
mov byte [esp], ah
and al, 0x24
mov word [esp], dx
pushal
lea esp, [esp + 0x40]
ja 0x4d59ec
pushfd
lea esp, [esp + 4]
jo 0x4c6ab8
add al, 0xf
cmp ah, 0x16
add al, 0
jb 0x4958bf
add al, 1
add al, bh
clc
bt dx, 0xa
cmp byte [edi - 1], 0
push 0x64d9ffe8
lea esp, [esp + 4]
jne 0x486ddf
btr edi, 0xe
pushfd
bswap di
push ebp
mov edi, dword [edx + 0x24]
bt sp, bx
add edi, eax
mov byte [esp + 4], 0x97
jmp 0x48587e
bt cx, di
jmp 0x4c67a9
pushal
push dword [esp]
call fcn.004857f5
stosb byte es:[edi], al
jecxz 0x4860b7
add bl, bl
invalid
sub bl, byte [eax]
cmpsb byte [esi], byte es:[edi]
pop esi
adc edx, dword [ebp - 0x76]
enter 0xffffffffffff8176, 0xffffffffffffff87
invalid
push 0x8672e26d
lea esp, [esp + 4]
jb 0x4958bf
test cx, 0x2ee
pushal
stc
cmp byte [edi - 1], 0
pushfd
mov byte [esp], 0x93
push ebp
pushfd
lea esp, [esp + 0x2c]
jne 0x486ddf
pushfd
stc
mov edi, dword [edx + 0x24]
stc
add edi, eax
cmp dh, 0x91
mov word [esp], 0xa5c0
mov byte [esp], 0xaf
movzx ecx, word [edi + ecx*2]
stc
sal di, 8
test bh, dh
mov edi, dword [edx + 0x1c]
pushfd
call fcn.004c7027
add byte [eax], al
inc esp
jb 0x4c6b72
ja fcn.004c6b5c
arpl word [edi + 0x6e], bp
inc ebp
js 0x4c6b19
pushfd
jmp 0x488e24
call fcn.00495e31
jg 0x4c6b57
pop eax
and eax, 0x43b04063
int3

Function at 0x48557a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
js 0x4d350f
test bl, ah
test bp, 0xd1e9
repne scasb al, byte es:[edi]
pushfd
push edi
pushfd
push 0x9d84191c
lea esp, [esp + 0x10]
jne 0x4847c0
lea ecx, [edx + 0x63d743f2]
bsr si, bp
xchg esi, ecx
and si, 0x4327
mov ecx, edi
shr si, cl
sub si, cx
dec si
sub ecx, ebx
ror esi, 0x16
mov esi, esp
stc
stc
cmp edi, 0xeee7836f
stc
sub edi, 4
push esp
jmp 0x489cd0

Function at 0x485ac8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
je 0x4d6a5f
push 0xefa38339
push 0x7989633a
lea esp, [esp + 8]
call fcn.00486604
pushfd
jmp 0x4c8381
Function at 0x485c40
Capabilities:
Encode data using base64

Disassembly:
mov word [esp], 0x3b93
mov byte [esp], 0xbc
mov byte [esp], 0x92
inc esi
mov word [esp], 0x37b8
inc edi
push 0x41311410
lea esp, [esp + 8]
jmp fcn.004c542c

Function at 0x487ef7
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0x1c], 0x52940ecf
pushal
push 0xdc5240ee
jmp 0x49747e
lea esp, [esp + 0x24]
jb 0x48538a
cmc
clc
cmc
call fcn.00484bff
add byte [eax], al
push esi
imul esi, dword [edx + 0x74], 0x466c6175
jb 0x487f7a
add bl, dh
pushfd
jmp 0x488ca3
dec esp
and al, 4
pushfd
push esi
push dword [esp + 0x4c]
ret 0x50
jmp 0x485d0e
pushal
jmp 0x488040
mov dword [esp + 0x3c], 0xcfa006a2
mov byte [esp + 4], ah
push ecx
pushfd
lea esp, [esp + 0x44]
jmp 0x4d8fbc
pushal
pushal
jmp 0x4d9758
call fcn.004d8401
call fcn.004d9d9f

Function at 0x488624
Capabilities:
Encode data using base64

Disassembly:
cmp dword [ebp - 0x20], 0xffffffff
push 0xed48f428
push ebp
jmp 0x4d39fc
lea esp, [esp + 0x30]
jne 0x49357c
call fcn.00492d95
jmp 0x495a03

Function at 0x4891a4
Capabilities:
Encode data using base64

Disassembly:
add ecx, 1
cmc
test ah, ah
mov byte [esp], 0x27
lea esp, [esp + 0x34]
jne 0x4d377e
push 0xd1a50f52
call fcn.004d3762
Function at 0x489378
Capabilities:
Encode data using base64

Disassembly:
jmp 0x485b6d
push ebp
mov word [esp], cx
mov byte [esp], 0x57
lea esp, [esp + 4]
call fcn.0048a19b
jmp 0x4838e4
lea esp, [esp + 0x48]
jp 0x48448d
call fcn.0048a19b
jmp 0x48491c

Function at 0x48941a
Capabilities:
Encode data using base64

Disassembly:
or ebx, ebx
push eax
push dword [esp + 4]
lea esp, [esp + 0xc]
je 0x4852d7
call fcn.00483daf
popal
xchg byte [0xa6278a23], al
xlatb
out 0x53, al
jmp 0x82561918

Function at 0x492d95
Capabilities:
Encode data using base64

Disassembly:
cwde
pushal
cwde
mov dword [esp + 0x28], ebx
call fcn.004c756b
lahf
movsx ax, bl
mov ecx, dword [esp + 4]
not ah
seta ah
mov eax, dword [esp + 8]
jmp 0x487eeb

Function at 0x49599e
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x48]
jb 0x483a70
call fcn.00487fa4
add byte [eax], al
insb byte es:[edi], dx
jae 0x48924a
jb 0x489244
outsb dx, byte gs:[esi]
inc ecx
add byte [eax - 0x73], ah
pushal
lea esp, [esp + 0x28]
jb 0x4c5f6a
movzx ax, bl
btc dx, 8
das
movzx eax, byte [ebp - 2]
sar dl, 5
sar dl, cl
shr eax, 5
ror edx, cl
bt bx, di
cmc
btc dx, 2
imul eax, eax, 0x300
cmc
lea eax, [ebx + eax*4 + 0x94d8]
shr dx, cl
dec dh
push ecx
btr dx, dx
push eax
xchg dword [esp], ebx
xor dl, bh
shld bx, cx, cl
xadd dl, bh
shrd dx, sp, 8
mov ebx, eax
sub dl, dl
adc dh, 0x76
mov edx, 1
push ebp
pushal
cmc
bt edi, esp
cmp ecx, 7
out 0x83, eax
stc
pop es
push ebp
call fcn.0048890f
sal esi, 0xff
call dword [edi - 0x64]
jmp 0x4891c2
Function at 0x4c542c
Capabilities:
Encode data using base64

Disassembly:
pushal
call fcn.00487ef7
xor al, 0xa6
mov al, 0x2e
clc
repne scasb al, byte es:[edi]
call fcn.004c802d
add byte [eax], al
push ebx
je 0x48814c
imul ebp, dword [esi + 0x64], 0x6c50776f
popal
arpl word [ebp + 0x6d], sp
outsb dx, byte gs:[esi]
je 0x488104
add byte [eax], al
inc edi
je 0x488150
imul ebp, dword [ebp + 0x56], 0x69737265
outsd dx, dword [esi]
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
push ebx
imul edi, dword [edx + 0x65], 0x41
inc edi
je 0x488167
insb byte es:[edi], dx
popal
jae 0x48819b
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [ecx - 0x63f7dba4], cl
not al
lea eax, [ebp - 4]
pushfd
pushal
mov dword [esp + 0x2c], eax
call fcn.00487f86
stc
clc
sub al, 0x30
test dl, 0x33
cmc
cmp al, 9
jmp 0x4c57e6
or ecx, ebp
xchg esp, eax
salc
add eax, dword [eax]
push ebp
mov eax, dword [ebp - 0x20]
jmp 0x4d6a65
sbb edx, ebx
invalid
rcl byte [ecx + ebx*4 - 0x40]
fisubr word [esi - 0x59dc1521]
and eax, 0xfd0fc6d7
mov ch, 0xdb
pop es
test byte [ebx + 0x77], 0x3d
cmc
mov dword [edi - 0x2b], esi
daa
push ebp
sbb esp, esp
mov eax, dword [0xfac811ed]
sal byte [edx], 0x20
mov byte [ecx - 0x31d7ad78], dl
push edx
push cs
sahf
inc eax
out dx, al
ljmp 0xb71
not al
shl al, 2
clc
not al
mov al, byte [edi]
pushfd
clc
cmp al, 0x41
lea esp, [esp + 4]
js 0x4880dd
pushal
push edx
pushfd
lea esp, [esp + 0x28]
jb 0x48538a
test dx, 0xd3db
call fcn.0048535e
add byte [eax], al
inc ebx
jb 0x4c54c5
popal
je 0x4c54c8
inc ebp
jbe 0x4c54cb
outsb dx, byte [esi]
je 0x4c54aa
add byte [eax], al
add byte [edx + 0x65], dl
insd dword es:[edi], dx
outsd dx, dword [esi]
jbe 0x4c54d7
dec ebp
outsb dx, byte gs:[esi]
jne 0x4c5477
push 0x24648d00
sub al, 0xf
xchg dword [edi + 0x66fffbe5], ebx
test edx, 0x4be832e0
and al, 0x2c
dec ebx
stc
sti
inc edi
inc esp
and al, 0x40
mov eax, 0x88529400
add al, 0x24
Function at 0x4c54fb
Capabilities:
Encode data using base64

Disassembly:
pushal
mov byte [esp + 8], 0x46
push dword [esp + 0x20]
ret 0x24
cmc
cmp al, ah
pushal
pushfd
push 0xaf9d26f1
lea esp, [esp + 0x2c]
jo 0x4c7ee0
jne 0x48985f
push 0x2cd94661
pushfd
pushal
push dword [esp + 0x14]
pushal
lea esp, [esp + 0x20]
jne 0x48985f
call fcn.00485973
add byte [eax], al
push esp
jb 0x4c7f63
imul ebp, dword [esi + 0x61], 0x72506574
outsd dx, dword [esi]
arpl word [ebp + 0x73], sp
jae 0x4c7f03
add byte [eax], al
inc edi
je 0x4c7f5d
imul ebp, dword [ebp + 0x65], 0x656e6f5a
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
jb 0x4c7f83
popal
je 0x4c7f82
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [ecx - 0x2e], ch
imul edx, edx, 0xa
jmp 0x4c7f5d
pushal
push 0xb099113c
pushfd
add edx, eax
mov word [esp + 4], cx
push esi
mov word [esp], sp
push esi
lea esp, [esp + 0x34]
jmp fcn.004859ac
popal
jb 0x4c7fd9
outsd dx, dword [esi]
dec ebp
jne 0x4c7ff5
je 0x4c7ff4
inc edx
jns 0x4c8002
add byte gs:[ebp + 0xf042464], cl
xor byte [ebx - 0x600003ed], 0x37
jb 0x4c7fdb
add byte [eax], al
inc edi
je 0x4c8024
jne 0x4c8055
jae 0x4c8054
jb 0x4c8037
outsd dx, dword [esi]
jae fcn.004c7fea
add eax, dword [eax]
add byte [eax], al
add byte [esi + 0x69], dl
jb 0x4c8071
add byte [eax], al
add byte [eax], al
push esi
imul esi, dword [edx + 0x74], 0x516c6175
jne 0x4c8060
insb byte es:[edi], dx
push ecx
jne 0x4c8068
jb 0x4c807e
jb 0x4c807e
inc ebp
js 0x4c8008
add byte [eax], al
push ebx
popal
inc cx
jb 0x4c8083
popal
jns 0x4c805b
je 0x4c806c
inc edx
outsd dx, dword [esi]
jne 0x4c8089
add byte fs:[eax], al
add byte [ebp + 0x73], al
je 0x4c8096
outsd dx, dword [esi]
jns 0x4c806a
jne 0x4c809b
jae 0x4c809a
jb fcn.004c802d
outsb dx, byte [esi]
jne 0x4c80aa
je 0x4c80ba
je 0x4c80c0
add byte [ebp + 0xf0c2464], cl
xchg dword [ebp + edx*8 - 5], ebx
invalid
add ah, bh
jmp [eax - 0x77]
invalid
invalid
clc
int1
shrd eax, edx, cl
neg ah
mov eax, dword [ebp - 0x20]
setno dh
sub cl, bh
or cl, bh
shr cl, cl
not eax
shl cl, 4
shr cl, cl
sets cl
sar cl, 4
mov cl, byte [eax + edi]
jmp 0xe20d5197
or al, 0x38
lea eax, [esi + 0x1ae832ba]
sub ax, dx
btr ax, di
setg dh
add cl, cl
lahf
mov byte [eax], 0xc9
push ebp
pop eax
setl al
setb dh
movsx ax, al
jmp 0x4d36ba
les ebx, [edx]
push ss
call fcn.004c763e
pop es
cmp dl, byte [ebx]
dec esi
sub al, 0x94
sbb al, 0x60
salc
jbe 0x4d369d
hlt

Function at 0x4c703d
Capabilities:
Encode data using xor

Disassembly:
call fcn.004c7677
imul esp, dword [ebp + 0x72], 0x6e
insb byte es:[edi], dx
insb byte es:[edi], dx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edx + 0x73bad497], dh
push cs
in al, 0xf
or eax, 0x8362af30
fisttp word ss:[0xfd3fb0b2]
nop
xor dword [ecx + ebp*4 + 0x755dfbe7], edi
mov ebx, 0x43c111eb
outsd dx, dword [esi]
mov ds, word [ebx + 0x5a2a8792]
enter 0x5389, 0xffffffffffffffef
dec esi
stosb byte es:[edi], al
je 0x4c7047
insd dword es:[edi], dx
fdisi8087_nop
fsubrp st(4)
cmp al, 0x9d
cmp al, 0x41
aam 0x8a
pop ebx
sal dword [edi], 0x32
sub al, 0x7c
mov esi, 0x2b2220c2
push ds
hlt
Function at 0x4c7534
Capabilities:
Encode data using base64

Disassembly:
stc
add esi, 8
cmc
sub bh, 0xfd
cmc
bswap bx
mov bx, word [esi]
pushfd
shr ebx, 0xc
push 0xc1f5d5a0
cmc
cmp ebx, 1
call fcn.00486d0f
lea esp, [esp + 4]
ja 0x48538a
sub ah, 0x41
shl ah, cl
inc ah
pushal
add al, 0x20
rcl ah, 7
shl ah, cl
pushal
mov ah, byte [esi]
test dl, dh
bt edx, esi
push 0x458a565b
cmp ah, 0x41
call fcn.0049599e
add byte [eax], al
inc esi
imul ebp, dword [esi + 0x64], 0x73726946
je 0x483cd2
imul ebp, dword [ebp + 0x41], 0x9ceb3800
pushal
call fcn.004c752d
add byte [eax], al
push ebx
je 0x483ce5
jb 0x483d14
outsd dx, dword [esi]
jb 0x483cf2
outsd dx, dword [esi]
add byte gs:[eax], bh
cmp dh, bl
aaa
add byte [ebx + 0x6c], al
imul esp, dword [ebp + 0x6e], 0x536f5474
arpl word [edx + 0x65], si
outsb dx, byte gs:[esi]
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x483d5a
dec edi
push eax
xor al, byte [eax]
leave
xchg esi, eax
les ecx, [edi]
lcall 0x9384, 0x8d989cc0
mov esp, 0xe800000a
wait
inc ebp
add al, 0
add edi, dword [ebp + 0x10]
clc
jmp 0x483c31

Function at 0x4d34f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
push 0xba01654e
lea esp, [esp + 0x2c]
call fcn.00495ca5
pushal
setbe dh
setne dl
call fcn.004c7f27

Function at 0x4d6914
Capabilities:
Encode data using xor

Disassembly:
stc
bt esp, esi
test ecx, ebp
push ecx
stc
push 0x45cd875e
call fcn.00487a58
push 0xdb076713
mov dword [esp], eax
jmp 0x4824b4
cmp eax, ebp
jmp 0x495e99
lea esp, [esp + 0x28]
call fcn.00489ffa
jle 0x4c82f3
push 0xe44be92b
bt ebp, ebx
mov dword [esp], eax
test al, dh
pushal
stc
push dword [esp]
mov dword [esp + 0x20], ecx
call fcn.004c58d5