joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1300c270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x13043610]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1300c2a0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.130133df
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1300c2dc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1300c2dc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.130133df
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1300c3c2
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1300c304
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1300c337
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1301953d
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.130133df
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x1300c395
sub eax, 1
je 0x1300c395
sub eax, 2
jne 0x1300c3c2
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1300e2e0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.130133df
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1300c3b2
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.13019eb4
add esp, 0x10
cmp edi, eax
jne 0x1300c3c2
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x1300c2c7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.130133df
mov esp, ebp
pop ebp
ret 4
Function at 0x1300d9b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x13043610]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0
mov byte [ebp - 0x24], 0x3f
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x70
mov byte [ebp - 0x21], 0x70
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x1b], 0x40
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0x19], 0x59
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x58
mov byte [ebp - 0x16], 0x4d
mov byte [ebp - 0x15], 0x40
mov byte [ebp - 0x14], 0x5a
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x61
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], 0x46
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0
push 5
push 0x1300da80
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.1300bd40
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.130133df
mov esp, ebp
pop ebp
ret
Function at 0x1300dc80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x13043610]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x25c], xmm0
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0xffffffff
je 0x1300dd37
xor edx, edx
mov dword [ebp - 0x25c], 0xffffffff
mov dword [ebp - 0x258], edx
mov eax, dword [ebp - 0x25c]
add eax, 1
mov ecx, dword [ebp - 0x258]
adc ecx, 0
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], ecx
mov edx, dword [ebp - 0x238]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x25c]
push edx
call fcn.130137f0
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], edx
mov eax, dword [ebp - 0x234]
xor ecx, ecx
add eax, dword [ebp - 0x25c]
adc ecx, dword [ebp - 0x258]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], ecx
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x258], 0
ja 0x1300dd5a
cmp dword [ebp - 0x25c], 0
jbe 0x1300de1e
mov dword [ebp - 0x264], 0
push 0
push 0x80
push 4
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0xffffffff
je 0x1300de16
mov ecx, dword [ebp - 0x25c]
add ecx, 2
push ecx
call fcn.130137d8
add esp, 4
mov dword [ebp - 0x268], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x268]
mov dword [edx], eax
mov ecx, dword [ebp - 0x25c]
add ecx, 2
push ecx
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.13014d90
add esp, 0xc
push 0
lea ecx, [ebp - 0x264]
push ecx
mov edx, dword [ebp - 0x25c]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1300de09
push 0x1388
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x264]
jmp 0x1300de20
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.130133df
mov esp, ebp
pop ebp
ret
Function at 0x1300f910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x13043610]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1300f9ca
cmp byte [esi + 0x3d], 0
je 0x1300f9ca
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1300f9b8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1300f980
sub eax, 1
je 0x1300f984
sub eax, 2
jne 0x1300f9b8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.130133df
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1300f9a1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.13019eb4
add esp, 0x10
cmp edi, eax
jne 0x1300f9b8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.130133df
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.130133df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.130133df
mov esp, ebp
pop ebp
ret

Function at 0x13011930
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x13043610]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx], 0
jne 0x13011a07
push esi
lea eax, [ebp - 0x204]
mov dword [ecx], 1
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.Client.ini
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x204]
push eax
push 0
push str.LowestId
push str.AutoType
call esi
mov dword [0x13044fcc], eax
lea eax, [ebp - 0x204]
push eax
push 0
push str.HighestId
push str.AutoType
call esi
cmp dword [0x13044fcc], 0
mov dword [0x13044fd0], eax
jbe 0x13011a06
test eax, eax
je 0x13011a06
push str.NWindow.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x13011a06
lea ecx, [eax + 0x205c50]
lea esi, [eax + 0x20835f]
lea eax, [ecx + 5]
push 0
mov dword [0x13044fc4], eax
lea eax, [esi + 5]
push 0x13011a20
push ecx
mov dword [0x13044fc8], eax
call fcn.1300bb10
push 0
push 0x13011a50
push esi
call fcn.1300bb10
add esp, 0x18
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.130133df
mov esp, ebp
pop ebp
ret

Function at 0x13022312
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.13022188
Function at 0x430290
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
jmp 0x4302aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4302b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4302a0
mov eax, 1
add ebx, ebx
jne 0x4302c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4302b8
jne 0x4302d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4302b8
xor ecx, ecx
sub eax, 3
jb 0x4302e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43035a
mov ebp, eax
add ebx, ebx
jne 0x4302f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x430300
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x430324
inc ecx
add ebx, ebx
jne 0x430310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x430305
jne 0x430321
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430305
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x430344
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x430335
jmp 0x4302a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x430344
add edi, ecx
jmp 0x4302a6
pop esi
mov edi, esi
mov ecx, 0x74
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x430362
cmp byte [edi], 1
jne 0x430362
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x430367
lea edi, [esi + 0x2e000]
mov eax, dword [edi]
or eax, eax
je 0x4303d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x35a88]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x35b64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x430394
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x35b6c]
or eax, eax
je 0x4303d0
mov dword [ebx], eax
add ebx, 4
jmp 0x4303b1
call dword [esi + 0x35b68]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x430407
cmp al, 0xef
ja 0x4303fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4303dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4303e9
mov ebp, dword [esi + 0x35b70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43043b
sub esp, 0xffffff80
jmp 0x401b0d
Function at 0x4285bc
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor al, bl
dec al
add cx, cx
xor al, 0x1b
bt cx, cx
dec al
sub edx, 0x17348612
setle dl
xor al, 0x1f
sub cl, cl
xor cx, cx
lea edx, [ecx + ecx*8 - 0x55d35d63]
xor bl, al
bt edx, edx
lea edi, [edi + edx - 0x76b3a29f]
sbb cl, 0x30
mov word [ecx + edi - 0x6c0f00cf], ax
ror ecx, cl
dec edx
shl edx, 0x93
mov eax, dword [esi + ecx*8 - 0xcf6c0f0]
neg cl
jb 0x48e537
mov edx, 0x9ca519a0
mov ax, word [edi]
bt edx, 0x8f
mov ecx, edx
bts cx, dx
mov cl, byte [edi + 2]
push edx
adc edi, 2
or edx, edx
adc byte [esp + 2], dh
shl ax, cl
jmp 0x411a25
xor bl, dl
cwde
lea esi, [esi + eax*2 - 0x800]
mov word [esi + eax - 0x3ff], dx
mov dword [esp + eax*2 - 0x7fe], ecx
sub ecx, ecx
xadd word [esp + eax - 0x3fe], cx
pop ecx
jns fcn.0045e78b
mov edx, 0x9a8c5bab
mov eax, edx
lea ecx, [eax + edx*2 + 0x3805eeb5]
movzx eax, byte [ecx + esi - 0x7ab01b6]
ror ecx, 0xe7
lea esi, [esi + ecx - 0x6c0f5602]
ror cx, cl
ror dl, 0xc7
jae 0x41e34d
and ecx, edx
lea esi, [edx + esi - 0x14dffffc]
push edx
bt ecx, ecx
sbb edx, ecx
xor eax, ebx
btc dx, 4
jb 0x479858
bswap eax
xor byte [esp + edx - 0x1460000d], 0x8c
neg dword [esp + edx*4 - 0x51800040]
inc eax
rol byte [esp + edx - 0x1460000e], 0xe7
sub edx, 0x569a411c
sub dx, 0x3a3a
not eax
jle 0x417291
mov eax, 0xf211837
lea edx, [eax + eax*2 + 0x3897d19f]
mov ecx, dword [edi + eax*8 - 0x7908c1b8]
or ax, ax
lea edi, [edi + eax*2 - 0x1e42306a]
imul eax, edx
dec edx
or eax, 0x719d1933
movzx eax, byte [esi + edx - 0x65fb1a43]
call fcn.0040d21c
mov edx, 0xfe8f050c
movsx eax, dx
mov dx, word [eax + esi - 0x50c]
mov ax, word [esi + eax - 0x50a]
mov ecx, 0x3939271c
lea esi, [ecx + esi - 0x3939271a]
xor ecx, 0xd10bfc2d
rol cl, 7
not dx
add cx, cx
and cx, cx
not ax
or dx, ax
mov word [esi], dx
bts ecx, ecx
lea edx, [ecx + ecx*4 - 0x4c45cc5e]
not cl
lea ebp, [edx + ebp - 0x3cbcc796]
bt ecx, 0xa5
setae dl
mov edx, dword [edx + ebp - 0x3cbcc701]
xor edx, ebx
movzx eax, cl
xor eax, eax
lea edx, [edx + ecx - 0x56f9c6ab]
cwde
cmovne cx, ax
xor edx, 0xe9029836
div cl
shl ax, 0xeb
lea edx, [edx + eax - 0x2b8d4c11]
sbb ax, ax
dec ecx
not edx
not ecx
xor ebx, edx
add edi, edx
bswap ecx
xor eax, edi
jmp eax
Function at 0x460f3b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
neg eax
neg edx
sbb cl, dh
not eax
inc dword [esp]
xor ebx, eax
shr ecx, cl
ror cl, 0x61
adc esi, eax
mov ecx, dword [edi + ecx*8 - 0x30]
movsx eax, dx
cdq
and byte [esp], al
adc edi, 4
call fcn.00421310
add esi, 2
pop ecx
neg cx
bts ecx, 0x2d
and ax, dx
bt ecx, 0x21
jae 0x4c5f0b
xor ecx, 0x1f1b5e08
xor ebx, ecx
not eax
cdq
add edi, ecx
pop eax
mov eax, dword [esi + edx*2]
call fcn.004bfab4
bswap esi
xchg edi, eax
call fcn.00468dd0
xor dx, dx
dec cl
mul ax
adc word [esp + edx - 0xf55417], 0x2f1b
ror cl, 1
bt edx, 0x81
neg cl
idiv eax
sal eax, 0xdb
not cl
sbb cl, al
not cl
dec dword [esp + edx*2 - 0x4dff3508]
call fcn.00474ada
xor eax, ebx
neg eax
sal edx, 0x54
jae 0x410f0f
ror ecx, 0x3c
inc eax
not eax
xadd cl, dl
sbb eax, 0x723e6d34
dec edx
shr edx, 0xe2
jbe 0x4556f9
bswap eax
add ecx, edx
xchg dh, cl
xor ebx, eax
sub edx, 0x138a020a
neg edx
add edi, eax
lea eax, [edx + ecx - 0x2946a1d5]
neg al
mov edx, dword [esi + ecx - 0x42f8aa00]
xor cl, cl
sbb eax, 0x9d2fa0b8
mov ax, word [esi + eax - 0x5e136e41]
sar ecx, 0x9e
and cx, cx
lea esi, [ecx + esi + 5]
sub cx, cx
mov word ss:[edx + ecx], ax
jae 0x496b26
sbb edx, 0xfab0ae38
shr ax, 0x84
btr ecx, ecx
not edx
btr eax, ecx
shr cl, 6
xor ebx, edx
add esi, edx
mov edx, ecx
sar eax, 0xab
mov eax, dword [edi]
xor cl, byte [edi + 4]
sal dl, 0xe6
call fcn.00454f77
sub cx, 0x3f87
inc edx
sub eax, ecx
ror ecx, 0x5c
lea eax, [eax + ecx*8 - 0x71681044]
neg edx
shr eax, 0x47
bts ecx, 0
ror edx, 2
neg eax
adc ecx, ecx
lea edx, [eax + edx - 0x7bedcbed]
shr al, cl
lea ecx, [ecx*8 - 0xcdce8d4]
xor ebx, edx
shl ecx, cl
bswap ecx
lea edi, [ecx + edi - 0x40063942]
inc ax
mov dword [edi + ecx - 0x4006393e], edx
add eax, ecx
lea esi, [eax + esi - 0x3fb3c844]
imul eax
or eax, 0x4438c09e
imul edx, ecx
mov ecx, dword [eax + esi - 0x663cd09e]
cwd
xor ecx, ebx
neg ecx
push edx
or dword [esp + eax - 0x663cd09e], eax
not ecx
sar edx, 0xde
je 0x4a683a
bswap eax
sbb ecx, 0xbda66fb1
push eax
xor eax, 0x18b36691
bswap ecx
sal word [esp + 5], 0x83
ror ecx, 3
xor ebx, ecx
dec edx
mov dword [esp + edx - 0x743b0792], 0x20158003
xor eax, ebx
imul ecx, ecx
ror dl, 0x82
rol eax, 2
xor eax, 0xa9a6502e
ror cx, 0xe9
jb 0x40a4f7
xadd dword [esp + ecx - 0x15a67c01], eax
xor dl, cl
lea eax, [eax*4 - 0x124846c4]
rol word [esp + eax - 0x230ed02b], 0xa1
shl cl, cl
not dl
add dword [esp + ecx - 0x15a67c02], eax
sal dword [esp + ecx*2 - 0x2b4cf804], 0xf0
btc cx, ax
xor bl, dl
lea edx, [esp + edx + 4]
sal dword [esp + eax - 0x230ed02c], 0x15
and ecx, 0x2a258009
lea ecx, [eax + eax*4 - 0x7bdab7cd]
mov ecx, dword [eax + edx - 0x230ed02c]
lea esi, [eax + esi - 0x230ed030]
mov dword [eax + esi - 0x230ed02c], ecx
lea ecx, [eax*2 - 0x6be2fe7a]
call fcn.00484407
adc ecx, ecx
mov cl, byte [ebp + 8]
call fcn.0040e5d0
shl eax, 0x16
adc esi, ecx
mov dword [esp + eax - 0x67000000], esi
ret
inc cx
mov eax, ecx
jmp edi
rol edx, 3
sal cx, 0x4f
jp 0x417dc1
lea edx, [ecx*8 + 0x4eab1a94]
not ax
sar edx, cl
jbe 0x4b85cd
mov word [esi], ax
jmp ebp
Function at 0x482dbe
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jb 0x422442
sub ebp, 4
mov eax, 0x9695cd95
bts eax, eax
jae 0x48eb19
mov dword [esp], 0xa5b5a481
lea ecx, [esp + 0xb0]
sar dword [esp], 0xab
sub word [esp], 0x9ea9
call fcn.00486af0
mov edx, dword [ebp]
mov eax, 0xb114203b
lea ecx, [eax + eax*2 - 0x2547fef1]
jmp 0x49e074
mov eax, dword [ebp]
mov edx, 0xeb317a96
lea edx, [edx + edx*2 - 0x1edf9100]
movzx ecx, dl
xor eax, ebx
ror eax, 1
push ecx
sub dl, byte [esp + ecx - 0xc0]
shl edx, 0x30
inc eax
shl cl, cl
shr cx, 0x25
ror eax, 3
sub ecx, 0xe0079d91
pop edx
lea eax, [edx + eax - 0x761b46d0]
sub cl, dl
ror dx, 0x62
bt ecx, 0xa9
xor ebx, eax
btc edx, ecx
adc edi, eax
movzx eax, cx
mov dx, word [edx + esi - 0xa030]
shr ecx, cl
sal ax, 2
mov cl, byte [esi + ecx*8 - 0x7fe16]
lea esi, [esi + eax - 0x8ab2]
shr dx, cl
shl eax, 0x28
movzx ecx, al
mov word [esi + eax - 0x8ab400], dx
lea edx, [ecx*8 - 0x18c2b050]
cmovb dx, ax
imul dx, dx
or ecx, edi
jmp ecx
add ebp, 4
xor edx, ebx
xor edx, 0x2b94c22
sub ax, ax
lea eax, [eax*8 + 0x23be20b1]
neg edx
xor al, cl
bts eax, eax
lea edx, [ecx + edx + 0x227e852]
btr ecx, eax
dec cl
ror edx, 2
lea eax, [eax*8 - 0x37c36870]
shl eax, 0x10
or ax, 0xc94
sbb edx, 0xeda57799
btc ecx, ecx
add al, cl
neg edx
btr ecx, ecx
xchg ch, al
bswap edx
sar eax, 0x32
sal ecx, 0xcd
add ecx, eax
xor ebx, edx
bt ecx, ecx
rol eax, cl
adc eax, ecx
add esi, edx
not cx
or ecx, ecx
mov edx, dword [edi]
mov ecx, dword [edi + 4]
call fcn.004116d7
mov eax, 0x9b8f6ea2
mov ecx, dword [ebp]
movzx edx, ax
div eax
lea ebp, [eax + ebp - 0xb60d]
xor ecx, ebx
cwde
inc edx
and al, al
ror ecx, 1
inc eax
not ecx
rol eax, 0x94
setne al
sar edx, 0xcb
inc ecx
bswap ecx
cwd
ror al, 0xc5
xor ebx, ecx
btc edx, eax
adc dx, ax
cwde
add esi, ecx
idiv dl
mov ecx, eax
mul cl
mov di, word [edx + edi - 0x9fe08]
mul cx
or eax, edx
jne fcn.0048f31b
imul ecx, esi
xchg edi, eax
mov esi, eax
jo 0x459609
rol eax, 1
or dl, 0x14
or edx, 0x3c126e02
dec eax
inc edx
bt ecx, ecx
xor ebx, eax
xadd ecx, edx
rol cl, 0x81
ror ecx, cl
add esi, eax
movsx eax, dx
jmp esi

Function at 0x49437c
Capabilities:
Parse pe header

Disassembly:
bswap edx
call fcn.0043ee2c
xor edx, ebx
mov ecx, 0xd8a2dc32
rol edx, 1
xor edx, 0xa4913d35
xadd word [esp + 1], cx
adc edx, 0x2dbbdd21
btr ecx, 0x1d
rol edx, cl
call fcn.0046e03b
Function at 0x4d6b81
Capabilities:
Encode data using base64

Disassembly:
sal ecx, cl
dec eax
sal ecx, cl
not eax
call fcn.004065e3
shr byte [esp + ecx*4 - 2], 0x61
pop eax
bswap edx
cwde
sub word [esp + ecx*2 - 1], 0x3880
inc eax
ror edx, cl
xor ebx, edx
sal dword [esp + ecx*2 - 2], 0x9d
xchg ch, cl
shl eax, 0xdd
adc edi, edx
mov edx, eax
sal dword [esp + ecx*2 - 0x200], 0xeb
pop ecx
jp fcn.004145ec
mov al, byte [edi + eax - 0x451c822d]
mov ecx, 0x9637ce91
sub ecx, ecx
lea edi, [ecx + edi + 6]
bt ecx, ecx
lea ecx, [ecx - 0x1dd508df]
inc ecx
mov byte [edx], al
mov edx, 0x8c22833e
sbb esi, 4
movsx eax, cl
imul eax
mov eax, dword [esi + edx*4]
or cx, 0xd500
bt cx, cx
xor dx, cx
xor eax, ebx
sar ecx, 0x17
jbe 0x494f2d
dec ecx
xor eax, 0x6c26653d
xchg ecx, edx
ror eax, 1
shl dl, 0x41
jl 0x457cd6
xor edx, ebx
mov dword [esp], 0x8f9a5515
inc ecx
ror edx, 1
inc cx
lea edx, [ecx + edx - 0x4d86902d]
jne 0x499fa5
Function at 0x40cc77
Capabilities:
Encode data using xor

Disassembly:
nop
xor byte [0x768e81e0], bh
add byte [edx - 0x33], cl
mov eax, dword [0xb89d8239]
mov bh, 0x35
adc byte [eax + eax*2 + 0x66332da], 0x60
inc eax
fidiv dword [edx]
arpl word [esi], ax
pushal
xor eax, 0xda409480
xor ah, byte [ebx + 6]
inc eax
fidiv dword [edx]
arpl word [esi], ax
pushal
mov edi, 0xcd924766
xor eax, 0x8bb0a727
and ah, byte [edi - 0x2b]
pop es
aad 7
outsd dx, dword [esi]
push ecx
and byte [edi + ecx + 0x5671908a], bh
jo 0x40cc63
mov dl, byte [ecx]
or ah, byte [ebx - 0x2a]
sbb al, 0x3c
jge 0x40cd0d
jl 0x40cc88
sahf
in al, 0xe3
mov esp, dword [ebp + 0x107f0522]
rcl byte [ecx], cl
outsd dx, dword [esi]
jbe 0x40cc74
jmp 0x84282d0a
out 0x17, al
adc eax, dword [ebx - 1]
cmpsb byte [esi], byte es:[edi]
lcall 0x6de3, 0x10738338
iretd

Function at 0x420607
Capabilities:
Encode data using xor

Disassembly:
inc esi
pushfd
sbb dl, bl
fsubr st(4)
invalid
scasd eax, dword es:[edi]
idiv byte [edi + edi*8 + 0x3b0e262b]
pop es
mov edx, 0xe6018956
cld
xchg edi, eax
jns 0x4205f1
cmp ch, byte [ebx - 0x5a]
test byte [esi], cl
or al, 0x76
inc ebp
sub bl, byte [eax]
xor byte [edi - 0x3e], ch
or eax, dword [ecx + 0x24b18daf]
mov edi, 0xf06f9994
jno 0x42061b
invalid
Function at 0x423f7f
Capabilities:
Encode data using xor

Disassembly:
push cs
arpl ax, si
in al, 0x56
cmpsd dword [esi], dword es:[edi]
jle 0x423fb2
lahf
idiv byte [edi + 0x4edf46e]
and word [eax], si
xchg byte [edx], bh
push 0xffffffffffffffd6
out 0x16, al
lahf
mov edx, 0x195ff0a9
invalid
xor byte [edx], ah
sub bl, byte [ebx - 0x7244814e]
cmpsd dword [esi], dword es:[edi]
mov edi, 0x9e3afebb
daa
scasb al, byte es:[edi]
daa
and edi, dword [esi - 0x46018461]
and esi, 0x3a9bbabf
mov edx, 0x3d253a9b
sahf
cmp bh, ah
mov edx, 0x3d253a9b
sahf
cmp bh, ah
out 0x65, al
test ax, 0x5e63
jae 0x423fb6
inc edx
xor esi, eax
cmp ah, byte [edx]
bound esp, qword [edx]
aas
jg 0x423f44
mov byte [0xab965042], al
mov edx, 0x2e3ff25c
sbb dl, byte [esi - 0x5aa7d8c7]
push esi
lcall 0x818, 0x45fa704
stc
rcr byte [eax - 0x50], 1
mov edi, 0xd44642c7
cmpsd dword [esi], dword es:[edi]
jecxz 0x423f65
add esi, dword [edx]
pop edi
and dh, ch
outsb dx, byte [esi]
cmp edi, dword [esi]
inc edx
in al, dx
jge 0x42403a
mov edx, 0x67bf2749
inc edx
sub dh, bl
ljmp 0xaed0
cmpsd dword [esi], dword es:[edi]
inc esi
sbb esp, dword [edi]
in eax, 0xeb
inc esi
cmove edx, dword [eax - 0x49e049b2]
jp 0x424085
pop ds
mov dh, 0x7a
inc edi
fiadd dword [edi + 0x5e]
test al, 0x70
or dword [ecx], esi
std
mov ebx, 0xa95209b0
lahf
xchg edx, eax
pop edx
cmpsb byte [esi], byte es:[edi]
pop esi
xor dword [edx + 0x36], esp
mov ebx, 0x4e7650b8
jno 0x42402e
wait
ror dword [ebx + 0x702bac5e], cl
out dx, eax
neg dword [esp + ebx*8]
jmp 0x4240e3
xor dword [ecx - 0x6422cce], esi
retf 0xee78
or dword [0xf6af1db0], esi
add ah, byte [ecx + edi*8 - 0x6d]
test byte [edx], 0x64
stc
xchg ebx, eax
mov al, 0xf3
xchg ecx, eax
jle 0x42415d
mov byte [esi - 0x1e], ah
stosb byte es:[edi], al
mov dl, 0xea
popal
imul edi, dword [ebp - 0x19], 0x8a7e62b3
jge 0x4240de
mov bl, 0x62
jle 0x424085
fldcw word [ecx + 0x13]
scasd eax, dword es:[edi]
xor esi, dword [esi + 0x215e990f]
mov cl, 0xce
xchg ebp, eax
push ebp
sahf
mov dh, 0xd5
loopne 0x42412b
jae 0x424186
mov esp, 0xb776a63
or al, 0xc8
and dword [ecx - 0x21], 0xf
adc byte [ebx + edx*8], dh
jns 0x4240f5
adc al, 0x25
jmp 0xec62f5ff
cmp dword [eax + edx], ebx
jl 0x42410c
pushfd
pop esp
xor al, 0xfa
push ss
loopne 0x424173
cwde
invalid
add dword [edi - 0x60], ebx
mov esi, 0xe05c4cfd
push eax
adc dword [esp + eax*4 - 0x50], edi
insb byte es:[edi], dx
nop
outsd dx, dword [esi]
mov byte [0x879d8235], al
cmc
je 0x424191
cwde
pushal
stc
dec ecx
jl 0x42416c
inc esi
xchg byte [ecx - 0x6fc1bf35], bl
ret
and dword [ecx - 2], eax
call 0xf29aa7ee
sub edx, dword [esi - 0x68]
hlt

Function at 0x42e7e7
Capabilities:
Encode data using xor

Disassembly:
push 0x2c8ffb73
pop ss
sbb byte [ebx + ebp], 0x73
invalid
invalid

Function at 0x439447
Capabilities:
Encode data using xor

Disassembly:
aad 0x99
pop edx
mov edx, 0xa6ce13ef
jnp 0x439414
out dx, al
jae 0x4394b1
xchg byte [ebx + 0x12], cl
adc byte [edi], al
sbb ebx, ebx
push ds
adc eax, 0xc5dc25c
mov esi, 0x4c033a26
invalid