joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416e75
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00416df1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x416fe4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x416fe4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x416f99
jg 0x416ed1
test eax, eax
je 0x416f8f
push 1
push 0x1000
call fcn.00410898
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x416ef4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x416f86
push 0x8000
push ebx
call fcn.0040ebcb
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x416f1d
jg 0x416f18
cmp ecx, 0x1000
jb 0x416f1d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004155ed
add esp, 0x10
cmp eax, 0xffffffff
je 0x416f62
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x416f18
jl 0x416f49
test ecx, ecx
jne 0x416f0a
push dword [ebp - 0xc]
push ebx
call fcn.0040ebcb
push esi
call fcn.004108f5
add esp, 0xc
xor ebx, ebx
jmp 0x416ff2
cmp byte [edi + 0x24], 0
je 0x416f79
cmp dword [edi + 0x20], 5
jne 0x416f79
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x416f84
mov ebx, dword [edi + 0x18]
jmp 0x416f86
xor ebx, ebx
push esi
call fcn.004108f5
pop ecx
jmp 0x416ff2
test ecx, ecx
jg 0x416f5b
jl 0x416f99
test eax, eax
jae 0x416f5b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0040f5ef
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x416fb9
cmp byte [edi + 0x1c], 0
je 0x416f5b
jmp 0x416fea
push ebx
call fcn.00413b17
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x416f5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x416ff2
cmp byte [edi + 0x1c], 0
je 0x416fef
mov ebx, dword [edi + 0x18]
jmp 0x416ff2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0040f5ef
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4194d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4194fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4194fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x152b23b
Capabilities:
Encode data using base64

Disassembly:
bswap edx
ror edx, 1
pop ecx
not edx
pop ecx
sar dword [esp + eax - 0x1aa570], 0x54
neg edx
neg al
xor ebx, edx
neg word [esp + eax - 0x1aa58a]
dec cx
or ax, word [esp + eax*2 - 0x354b14]
adc esi, edx
mov dx, word [edi + eax*2 - 0x354f5c]
jmp 0x1b8ea58
xor word [esp + eax*2 - 0x354f5c], ax
lea edi, [edi + eax*2 - 0x354f5a]
push ecx
lea eax, [ecx*8 + 0x24871fb2]
lea ebp, [ebp + ecx*2 - 0x354ae7]
bts eax, 0x8a
sar word [esp + eax*2 - 0x4ab89e8b], 1
movzx eax, byte [ebp + ecx*2 - 0x354ae6]
inc ecx
jns 0x1c1fc06
sets cl
xor al, bl
xchg dword [esp + ecx*4 - 0x6a93fb], ecx
neg al
and dword [esp + 1], ecx
shr word [esp + 8], 3
add ecx, dword [esp + 8]
rol al, 1
pop ecx
inc al
or ecx, ecx
sbb cl, cl
neg ecx
ror al, 1
add dword [esp], ecx
sub cl, cl
sete cl
xor al, 0xb7
not ecx
lea ecx, [ecx + ecx*2 + 0x5bbea20]
xor bl, al
lea eax, [esp + eax + 8]
sal dword [esp + ecx*2 - 0xbb6d430], cl
mov byte [eax + ecx*4 - 0x176da868], dl
movzx edx, byte [esp + ecx - 0x5db6a16]
add edx, 0x7e1e99bb
ror dx, 0x89
mov dword [esp + ecx*2 - 0xbb6d434], esi
ret 4

Function at 0x152c576
Capabilities:
Encode data using base64

Disassembly:
pop ecx
lea edi, [edi + edx - 0x650a28bf]
movzx edx, byte [edi + edx - 0x650a28be]
mov ecx, 0xd33dd2c
mov eax, ecx
xor dl, bl
sub dl, 0x98
cbw
not dl
sub dl, 0xc
xor dl, 0x2f
ror cx, cl
ror ax, cl
xor bl, dl
add ecx, 0x5cbc6332
bswap ecx
btr ecx, 0x31
lea esi, [esi + eax*2 - 0x1a6602c2]
mov word [esi + eax*4 - 0x34cc0580], dx
jae fcn.01b4cd91
mov edx, 0x8d1e070e
push edx
sub esi, 4
mov eax, dword [esi]
inc edx
add dword [esp], 0x1034b78c
movzx ecx, dx
xor eax, ebx
shr ecx, cl
not eax
seta dl
sar byte [esp + ecx*2 + 2], 0x65
jb 0x176eafa
ror eax, 2
pop ecx
bswap eax
or dx, cx
push ecx
ror eax, 2
shl word [esp + 2], 0x68
xor ebx, eax
shl dword [esp], 0x85
adc edi, eax
sub esi, 1
call fcn.017f3b63
dec edi
popal
inc edi
int1
je 0x176eb57
loop 0x176eb3c
xchg edx, eax
stosd dword es:[edi], eax
mov byte [edi], cl
mov esi, 0xb0e181c1
clc
sbb esp, dword [0xbe4fbc8d]
and eax, 0xbe4fbc8d
jg 0x176eb31
call [0xa60508bb]
ror dword [edi], 1
retf 0xac8d
Function at 0x152c5f4
Capabilities:
Encode data using base64

Disassembly:
inc cl
mov dword [ebp], eax
pop eax
mov esi, ebp
pop ebx
pop edi
jle 0x1b74629
dec ecx
sub ebx, 8
inc ecx
mov esi, 0x3e9394a0
dec ebx
mov edx, dword [esi + ebx - 0x3e9394a0]
dec esi
lea edx, [esi*8 - 0x5bd10780]
dec ecx
xor edx, ecx
inc ebp
movsx edi, dl
inc ecx
movzx eax, dh
dec eax
xor edx, 0x59263430
inc ecx
movzx ebx, si
dec ecx
lea edx, [esi + edx - 0x72e18f8a]
inc bp
btc esi, esi
mov ecx, 0xdf9b6109
inc esp
movzx esp, cl
dec eax
xor edx, 0x236c921
inc ecx
ror esp, cl
inc ebp
movsx eax, sp
dec eax
rol edx, 1
dec eax
inc edx
dec ebp
add eax, esp
inc ebp
or dl, dl
jnp 0x1b6288e
dec ecx
sub ebx, 2
inc ecx
mov ebp, 0x98337f21
inc ecx
movzx ebx, word [ebx]
inc cx
xor ebx, ecx
add bx, 0x19b0
ror bx, 1
sub bx, 0xef36
inc ecx
push ebp
jmp 0x1b358e7
rol bx, 1
dec ebx
lea ecx, [ebp + ebp*8 - 0x38e38e5f]
not bx
xor cx, word [esp]
inc ecx
push ebp
sbb bx, 0x5bb
dec eax
not dword [esp + 8]
call fcn.0289e3d5
dec eax
xor edx, 0xf1b08835
dec esp
xor ecx, edx
inc cx
shl esp, cl
dec ecx
lea esi, [esi + esi - 0x3e9394a9]
inc ecx
movsx ebp, si
inc eax
xor bl, ch
dec eax
mov dword [esi + eax - 0xa0], edx
shl eax, cl
dec ebp
lea ebx, [ebx + ebx*2 - 0x12806]
neg al
inc cx
ror esp, cl
inc ecx
rol eax, 0xe8
inc ebx
mov ecx, dword [ebx + esi*2 - 0x7d272942]
inc ecx
xor ecx, ecx
inc ecx
mov edx, esi
inc ecx
lea ecx, [esi + ecx + 0x3a19046f]
dec eax
dec ebx
inc sp
imul esi, ebp
rol ecx, 3
dec esp
or esi, eax
dec edi
lea esp, [esp + 0x35227b3e]
dec ecx
bswap ecx
inc esp
movsx ebp, bx
dec ecx
btc eax, edx
neg ecx
inc ecx
push ecx
bt bp, bx
inc cx
sbb esi, 0x314280b1
invalid
call fcn.01bf237f
mov edx, 0x492a4a8d
mov edx, dword [edi + edx - 0x492a4a8d]
mov ecx, 0x29070c1d
sal ecx, 0xaa
xor ecx, ecx
xor cl, byte ss:[edx + ecx]
mov eax, 0xd981d738
movsx edx, ax
btr ax, dx
adc edi, 1
mov word [edi], cx
imul ax
rol ax, 0xa2
not dx
mov eax, dword [ebp]
lea ecx, [edx*2 - 0x4dc13348]
adc ebp, 4
xor eax, ebx
ror edx, 0xab
jae 0x1bea380
Function at 0x15347d9
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [esp + 4], 0x74a5d28d
jmp 0x19388b0
pop edi
pop esi
and cx, 0x63a9
movsx eax, cl
lea edx, [eax + eax*4 - 0x1b4faa63]
mov eax, dword [esi + eax*2 - 0x10]
lea esi, [esi + ecx - 0x77880004]
inc cx
xor eax, ebx
lea eax, [edx + eax - 0x3c9805b4]
and ecx, edx
inc edx
bt ecx, 0xa6
rol eax, cl
sal dl, cl
jle 0x195bba3
inc ebp
xor edx, ecx
push 0x772ffb0a
mov eax, 0xec880a88
inc ecx
rol edx, 1
inc ecx
neg edx
inc esp
movzx esp, word [esp + 2]
inc ecx
bswap edx
inc ecx
xor edx, 0x41240d09
dec esi
mov dword [esp - 0x3b970], ecx
btr ax, 0x16
inc esi
xor dword [esp - 0x3b970], edx
dec esp
lea esi, [eax + eax*8 + 0x5cb06a36]
dec esi
mov ecx, dword [esp - 0x7727]
inc ecx
div ah
dec ebp
arpl dx, dx
pop ecx
dec edx
lea ebp, [eax - 0x28ed3f77]
dec eax
cdq
dec ecx
add edi, edx
dec edx
mov dword [esp - 0x772f], 0xc4381db2
inc edx
mov ebx, dword [esp - 0x3b976]
pop ebx
inc si
mov ebp, dword [esi - 0x772f]
inc ecx
mov eax, 0xcb28ff82
test ebx, ebx
lea esp, [esp + 8]
je 0x19388de
mov eax, 0x4eb3b523
neg ax
jnp 0x181462a
mov eax, dword [ebp + ebx*4]
push 0x89bbda33
mov dword [esp], eax
dec ebx
jne 0x19388bc
mov eax, 0x9a270d1d
cwde
mov eax, dword [ebp + eax - 0xd1d]
call eax
mov ebx, 0x44a56db7
mov ebp, dword [ebp + ebx - 0x44a56dbb]
movsx edi, bx
lea ecx, [ebx + ebx*2 - 0x566838c9]
mov dword [ebp + edi*2 - 0xdb6e], eax
shl di, 1
movsx esi, di
pop ebx
xadd edi, esi
adc esi, edi
jns 0x1927695
inc esi
jg 0x1938962
pop ds
out 0x47, al
invalid
add ecx, edx
neg eax
shr dl, 0x62
adc dx, cx
bswap eax
xor ebx, eax
imul dx, dx
not cl
shl ecx, 0x6f
adc edi, eax
and cl, 0x9e
dec dl
jmp edi
Function at 0x1706677
Capabilities:
Encode data using base64

Disassembly:
shr dword [esp + edx + 0x1000000c], 0xe8
xor ecx, ebx
call fcn.0196f4c9
mov edx, 0x29af3916
mov ecx, dword [edx + esi - 0x29af3916]
mov eax, edx
movzx dx, byte [edx + ecx - 0x29af3916]
lea ecx, [eax + eax + 0x36248289]
lea esi, [eax + esi - 0x29af3914]
sar cl, 0x85
mov word [esi + eax - 0x29af3916], dx
mov eax, dword [eax + ebp - 0x29af3916]
inc ecx
jne 0x197bc72
call fcn.01abf3e0

Function at 0x17067d1
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + ecx*8 - 0x7051a171]
rol dl, 1
dec dl
sar cx, cl
not dl
neg dl
xor dword [esp + 8], ecx
not dl
ror ecx, 0xfc
push ecx
inc ecx
xor bl, dl
xor cl, ch
mov dword [esp + 4], 0x1e06bf80
call fcn.01bafc5e

Function at 0x1706a03
Capabilities:
Encode data using xor

Disassembly:
call fcn.01a51b67
movzx edx, cx
xor eax, ebx
imul ecx, edx
neg edx
not eax
or cx, cx
adc dx, dx
lea ecx, [edx + edx*8 - 0x7ffb12c6]
dec eax
imul ecx, ecx
ret
or byte [eax + 0xf], 0xaf
leave
sar ecx, 0x5a
ror eax, 1
dec ecx
bt ecx, ecx
bt edx, 0x87
bswap eax
inc eax
btr edx, ecx
xor ebx, eax
shl ecx, 0x6d
sub dx, cx
setno cl
adc edi, eax
movzx dx, byte [ebp]
lea eax, [ecx*8 + 0x793519bf]
mov cl, byte [ebp + eax - 0x792c19c5]
not al
inc al
sete al
lea ebp, [ebp + eax - 0x792c18fe]
or eax, 0x9d82ce03
btr eax, eax
shr dl, cl
call fcn.0176141e
jbe 0x1706a20
add ebx, esi
xchg ecx, eax
pop ebp
push 0x1a
or cl, ch
lahf
jge 0x1706a0c
invalid

Function at 0x1707e37
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0xeae9b89
shl word [esp], 0x86
mov dword [esp], edi

Function at 0x1708542
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea edx, [edx + edx*8 - 0x56cf8af8]
dec eax
lea edx, [esp + 0x150]
dec eax
mov dword [esp], 0x2fb3af37
push 0xa22cfe06
push 0xb7a74bb4
dec eax
cmp esi, edx
jmp 0x1888103
call fcn.028a493f
jmp 0x17d5deb

Function at 0x170a274
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ebp]
xor ecx, ebx
mov eax, 0xee2359b5
ror eax, 0x72
not ecx
mov edx, eax
xchg dx, ax
mov dword [esp], eax
neg ecx
cwde
shr edx, 0x93
xor dword [esp + eax*4 - 0x1ee20], eax
dec ecx
neg edx
jle 0x1b1a1c3
not ax
ror ecx, 1
dec ecx
xor ebx, ecx
btc eax, edx
setb byte [esp + eax*4 - 0x2211dc]
adc edi, ecx
movzx ecx, dx
inc dword [esp + eax - 0x88477]
lea ebp, [ebp + eax*2 - 0x1108ef]
or cx, word [esp + eax - 0x88476]
setp cl
xor ecx, dword [esp + eax - 0x88477]
movzx eax, byte [ebp + eax - 0x88477]
push edx
xor al, bl
mov dword [esp + 3], ecx
rol edx, 0xb8
sub edx, 0xbba53f1b
xor al, 0x21
shl edx, 0x12
add dl, 0x25
ror dword [esp + edx*8 - 0x19400128], 0xb
rol al, 1
push ecx
dec dword [esp + edx*4 - 0xca00090]
btr ecx, ecx
neg al
lea ecx, [edx + edx*2 - 0xad775f0]
sub al, 0xb
call fcn.01aac290
Function at 0x171e21b
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
xor bl, dl
add byte [esp + ecx*4 - 0x7ffffff7], 0x16
mov dword [esp + ecx - 0x20000000], 0x7210968a
lea edx, [esp + edx + 0xc]
mov word [edx + ecx*2 - 0x40000000], ax
rol dword [esp + ecx*2 - 0x3ffffff8], 0x41
mov edx, dword [edi + ecx*4 - 0x80000000]
lea edi, [edi + ecx*4 - 0x7ffffffc]
xor edx, ebx
movzx eax, cl
dec cx
or ax, 0x7993
sbb edx, 0xa8b4fe92
sal cl, 4
cmovns ecx, dword [esp + eax - 0x798b]
xor byte [esp + eax*8 - 0x3cc97], 0x81
rol edx, 1
call fcn.027e1ad4
mov edx, dword [ebp]
mov eax, 0x91014b82
cwde
mov eax, dword [eax + ebp - 0x4b7e]
mov ecx, 0x180eda82
mov ecx, dword [ebp + ecx*2 - 0x301db4fc]
push 0x5e3c4d80
push 0xba86722a
add ebp, 4
inc word [esp + 3]
inc dword [esp + 3]
div ecx
mov dword [ebp], edx
mov dword [ebp + 4], eax
inc dword [esp + 4]
sub esi, 4
mov edx, 0xe99be72d
not edx
mov ecx, dword [esi + edx - 0x166418d2]
imul dx, dx
xor ecx, ebx
inc ecx
not ecx
pop eax
push edx
bswap edx
lea ecx, [ecx + edx - 0x5540893d]
not ecx
xor ebx, ecx
sar edx, 0x63
call fcn.01a1beaf
jmp 0x1955a03
bswap ecx
pop eax
not ecx
mul ax
sal eax, 0x2a
sar ax, 0xad
neg ecx
lea edx, [edx*2 - 0x1bc1565b]
neg eax
xor dx, dx
lea ecx, [ecx + eax - 0x213c4a19]
rol ecx, 2
xor ebx, ecx
add eax, edx
mul edx
add edi, ecx
push edx
movzx ecx, ax
xor dword [esp + ecx*8], 0x4399ee82
lea esi, [esi + eax - 1]
sets al
xadd byte [esp + eax + 2], dh
rol byte [esp + eax - 1], 0x83
movzx edx, byte [esi + eax*2 - 2]
xor dl, bl
and ecx, ecx
lea eax, [eax + ecx*8 + 0x67230388]
rol dl, 1
sar cx, 0xab
adc dl, 0x9d
sar ax, 0xce
xor eax, dword [esp + ecx*2]
shr cx, 0x48
ror dl, 1
add dl, 0x8a
jmp 0x1973a96
mov eax, 0xe48e959f
sub esi, 4
movzx edx, al
lea ecx, [edx + eax + 0x4d1351be]
cdq
mov ecx, dword [esi + ecx*2 - 0x6343cff8]
push edx
xor eax, dword [esp]
dec dl
xor ecx, ebx
dec dword [esp + eax - 0x1b716a60]
cmovl edx, dword [esp + eax*4 - 0x6dc5a980]
jl 0x18c4b02
not ecx
xor bl, dl
neg byte [esp + eax - 0x64b59933]
sub eax, ecx
inc cx
lea edx, [esp + edx + 4]
pop ecx
mov ecx, dword [ecx + edx - 0x3966734]
adc eax, eax
sub eax, eax
mov edx, eax
lea ebp, [eax + ebp - 4]
cbw
push edx
add dword [esp + eax*2], edx
mov dword [ebp + eax*2], ecx
neg al
pop eax
jns fcn.019c40f4
Function at 0x1728596
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0xc28483ac
push edx
call fcn.01c217f5
bswap edx
call fcn.01c25b30
sysenter
push esi
pushfd
mov esi, 0xd9b51588
mov esi, dword [esp + esi + 0x264aea7c]
mov dword [esp + 4], 0xd481368a
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.028b8ace
jmp 0x195db93
bt edx, edx
jb 0x16ec85c
mov edx, 0x5d197523
movzx eax, dx
lea ebp, [ebp + eax*2 - 0xea4a]
mov edx, dword [edx + ebp - 0x5d197523]
xor edx, ebx
btr eax, 0xa4
jae 0x17066d8
ror edx, 1
movzx ecx, ax
bswap edx
neg al
neg edx
neg ecx
lea edx, [ecx + edx - 0x28dcd24a]
xor edx, 0xb934b23c
add ecx, eax
btc ax, ax
jb 0x1b38d31
neg dl
add ebp, ecx
sal edx, 0x4a
pop eax
pop ecx
jae fcn.01b4cd91
pop edx
movzx cx, byte [edx + eax - 0x3e10ffe0]
dec edx
bts edx, 0xb3
sub dx, 0x6f9f
lea esi, [esi + edx*2 - 0x7c312082]
lea eax, [edx + edx*4 + 0x40806c28]
xadd eax, edx
shr eax, 0x2f
mov word [edx + esi - 0x76fb3d68], cx
dec al
setae al
lea ebp, [ebp + eax*2 - 0x2d404]
xor edx, 0x2f339a80
jle 0x286b418
mov eax, dword [ebp + edx - 0x59c8a7e8]
xor eax, ebx
jmp 0x16f20f4
rol edx, 1
bswap edx
lea eax, [ecx + eax*4 + 0x7dabe99b]
jmp 0x1c0bf9a
xor ebx, edx
cwde
and cx, ax
and ax, cx
adc edi, edx
movsx edx, al
mov edx, dword [esi + eax*2 - 0x110]
shr cl, 0xe5
or ecx, 0x5009ad36
mov eax, dword fs:[edx + eax - 0x88]
mov dword [ecx + esi - 0x5009ad36], eax
movsx edx, cl
shl ecx, 0x96
not ecx
jmp edi

Function at 0x17426a7
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jns 0x1a89f5d
mov edx, dword [edi]
mov ecx, 0x6487099a
lea edi, [ecx + edi - 0x64870996]
movzx eax, cx
xadd ecx, eax
xor edx, ebx
lea edx, [edx + eax - 0x5a7e42fe]
cwde
xor ax, ax
bswap edx
ror edx, 1
sub edx, 0xb70adc8b
shl cx, 0xa7
shl ecx, 0xd1
xor ebx, edx
btr cx, 0x11
mov dword [esp], eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
dec al
add esi, 4
add edx, ecx
shl dword [esp], 0xc4
mov dword [esi], edx
jns 0x173aa55
mov ecx, dword [edi]
mov word [esp + 2], ax
mov edx, eax
and edx, 0xe09acda1
adc edi, 4
bswap edx
push edx
xor ecx, ebx
not ecx
or dword [esp + edx*8 - 0x80cc6fc], edx
bswap ecx
ror ecx, 1
sub ecx, 0xb790321b
rol ecx, 1
sal edx, 0x86
sbb ecx, 0xc00c5e14
div eax
rol ecx, 1
bt ax, 0x23
sal eax, 0x4a
cdq
neg ecx
sub edx, 0x37175b9b
xor ebx, ecx
add ebp, ecx
pop ecx
mov dword [esp + eax - 0x115ce000], ebp
ret

Function at 0x1779b0b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 0x14]
je 0x1c44fed
push edi
movzx edi, byte [ecx]
xor edi, eax
push 0x2f0d5036
and edi, 0xff
jmp 0x17c90b1
push 0x950a242e
call fcn.01747d61
adc dl, cl
xor eax, eax
mov word [esi + eax], dx
mov dword [esp + eax], edi
ret
mov edx, 0xc7a2740e
ror dx, 0xa1
not eax
lea ecx, [edx + edx + 0x583babb4]
sbb dx, dx
mov dword [esi], eax
mov edx, dword [edi]
btr ecx, ecx
ror cl, cl
call fcn.019f1619
Function at 0x17846b3
Capabilities:
Encode data using xor

Disassembly:
inc edi
mov eax, dword [ebx - 0x7cb9c690]
mov edx, 0x8b0b55ae
inc edx
mov ebx, dword [esp + edi - 0x7cb9c684]
inc ebp
xor eax, ecx
movzx ebp, ax
inc ebp
movzx edx, di
inc ecx
dec eax
inc ecx
pop edx
mov ecx, ebx
dec ecx
bswap esp
inc ecx
bswap eax
inc esi
lea eax, [ebx + eax - 0x4611b126]
inc cx
shl edi, 0x61
cbw
inc ecx
not eax
btr dx, 0xa2
dec ecx
not esp
sar word [esp + ebx*4 + 6], 0xe1
dec esp
mov dword [esp + ebx*8], ecx
inc ebp
movsx esi, ah
inc ecx
and esp, 0xee304621
inc esp
xor dword [esp + ebx*4], eax
inc ecx
pop ecx
or ecx, ebp
add ebp, edx
dec eax
neg eax
dec ebp
arpl ax, ax
cwde
inc cx
imul edi
bswap ebp
dec ecx
add edi, eax
inc bp
xadd esp, edi
inc cx
xor esp, 0xc0419b35
lds eax, [edx - 0x20fcb8]
invalid

Function at 0x1789ac3
Capabilities:
Encode data using xor

Disassembly:
xchg cx, ax
mov dword [esp + ecx - 0x28ae], eax
not edx
sar eax, cl
lea edx, [eax + edx - 0x27ee8730]
bts eax, eax
lea ecx, [ecx*4 - 0x18e899d0]
bswap edx
dec ecx
lea edx, [edx + ecx - 0x6982b0d9]
xor ax, ax
not cx
not edx
shr ecx, 0x36
sal ecx, 0x86
xor ebx, edx
add esi, edx
cdq
and edx, 0x5c875a28
inc edx
or ax, word [edi + ecx*4 - 0x39c00]
neg cx
call fcn.01985e25
and eax, 0xdf525bf
add al, byte [esi]
scasb al, byte es:[edi]
xchg esp, eax
pop ebp
and ecx, edx
enter 0x5d1a, 0x10
xor byte [ecx], ch
inc ebp
in al, dx
sbb byte [ebp - 0x6b94d1a3], bh
xchg edx, eax
mov edi, 0x344093bb
rcr byte [esi + edx - 0x2b], 0x74
stosb byte es:[edi], al
mov ebx, 0x36a21c2c
sbb dword [ebx - 0x35], esi
xchg edx, eax
js 0x1789ae2
retf 0x8d49
and esi, dword [ebx - 0x50]
stosb byte es:[edi], al
int3

Function at 0x179ab40
Capabilities:
Encode data using base64

Disassembly:
inc dl
mov dword [esp + ecx - 0xb223], ecx
sar dword [esp + ecx - 0xb223], cl
rol dl, 1
sar word [esp + ecx*2 - 0x16444], cl
neg dword [esp + ecx - 0xb223]
neg dl
xor bl, dl
sub al, 0xa4
lea edx, [esp + edx + 4]
mov ecx, dword [edx + ecx - 0xb223]
sbb ebp, 4
lea edx, [eax + eax - 0x8ebe3e6]
lea edx, [edx*4 + 0x6c3be99d]
sub dword [esp], edx
mov dword [ebp], ecx
movzx ecx, al
pop ecx
jge fcn.016e6ba1

Function at 0x179d8ac
Capabilities:
Encode data using base64

Disassembly:
pop eax
lea eax, [ecx + ecx*8 - 0x170627e]
mov si, word [esi + edx - 1]
div ax
add al, 0xbf
cwde
jl fcn.01b4cd91

Function at 0x17a177e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, 0xe83cb196
lea ebp, [ebp*8 + 0x62aebc37]
push ebp
mov dword [esp], ecx
lea ebp, [ebp + 0xb96630e]
push ebx
push edi
jmp 0x1b6c87e
pushfd
mov ebx, 0
sar ebp, 0x25
lea edi, [ebp*2 + 0x520358a6]
push esi
lea ebp, [esp + edi - 0x4d060368]
lea edi, [ebp + edi - 0x4d060464]
mov esi, 0x3825263a
mov esi, dword [esp + esi - 0x3825261e]
mov ecx, 0x549fc0be
Function at 0x17ae064
Capabilities:
Encode data using base64

Disassembly:
rol eax, 2
not dx
inc eax
bswap eax
sub dword [esp + ecx*2 - 0x7a], edx
rol dl, 0x23
inc eax
xor ebx, eax
ror edx, 0xc1
or edx, dword [esp + ecx*8 - 0x1f4]
not ecx
adc edi, eax
shr ecx, 0x1b
mov eax, ecx
call fcn.01b37b6d
inc edi
enter 0x3278, 0x4c
add dh, al
fimul word [ebx]
aas
push ebp
sub al, 0xe5
lea eax, [esi + eax*2 - 0x27]
mov dword [0x30df8d8d], eax
and ebp, esi
lcall 0x32e4, 0xb4dd03ac
jg 0x17ae03b
fsubr st(4)
shl byte [ecx + 0x23], cl
ror dh, 1
cmp eax, 0xb29731dd
pop ebx
mov dl, byte [ebx + 0x61b91d77]
dec ebx
xor byte [ebx + 0x28], bh
into
sub byte [esi + 0x51], dl
mov edi, 0x56b182b7
jae 0x17ae08f
and al, 0xc6
add ah, dl
retf

Function at 0x17d31e6
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 4], eax
call fcn.01717329
Function at 0x17daf3f
Capabilities:
Encode data using xor

Disassembly:
neg eax
mov dword [esp], 0x4634b1bc
xor byte [esp + 2], 0x14
ror eax, 2
call fcn.017b9c7d
mov ecx, 0x741634a5
movsx edx, cx
movzx ecx, byte [ecx + edi - 0x741634a5]
movzx eax, dx
lea edi, [edi + edx*4 - 0xd293]
xor cl, bl
lea edx, [eax + edx*4 - 0x5045617c]
add eax, 0xc7b3ef02
inc cl
div eax
xor cl, 0x1d
rol cl, 1
add cl, 0x19
neg dl
cdq
setl dl
rol cl, 1
sub dl, 0xb5
call fcn.02875edb
mov ch, 0xe8
inc ecx
scasd eax, dword es:[edi]
or dword [ecx], eax
pop ebx
pop ebp
stosb byte es:[edi], al
imul ebp, dword [ebx + 0x6a5ece73], 0xffffffb5
pop edi
xor dword [edi + edi*8 - 0x7bc81cb3], edi
add byte [ebp + 0x65ee7756], 0xa3
cmpsd dword [esi], dword es:[edi]
or dword [0xe1d4ad5d], esi
jnp 0x17daf94
std
add byte [ebx - 0x511ded12], dh
cld
retf 0xadaa

Function at 0x17e21ed
Capabilities:
Encode data using base64

Disassembly:
neg ecx
pop edx
lea ecx, [ecx + eax - 0x64279b3b]
cdq
cbw
neg ecx
xor edx, 0x3e009a39
jae 0x181d6b3

Function at 0x17f8ce0
Capabilities:
Encode data using base64

Disassembly:
pop esi
pop ebx
pop esi
push eax
jmp 0x1b0a4be
cwde
mov edi, dword [esp + 4]
movsx edx, ax
call fcn.0180d3a5

Function at 0x18046e6
Capabilities:
Manually build aes constants

Disassembly:
xor edx, 0x69e2e88
sub cx, 0x18b3
xor ebx, edx
rol dword [esp + 4], 0x14
adc ebp, edx
movzx edx, word [edi]
rol cx, cl
mov dword [esp], 0xea3dbb80
and word [esp + 6], ax
adc edi, 2
inc cl
shr dword [esp], 0x43
xor dx, bx
sub dx, 0x498e
xor eax, 0xcb1fd61e
sar ecx, 0x63
not dx
xor dx, 0x2c90
xchg ecx, eax
dec dx
btr eax, ecx
rol dx, 1
sar eax, cl
and eax, ecx
bts ecx, eax
xor bx, dx
lea esi, [esi + eax - 0x7e9ad620]
mov word [esi + eax - 0x7e9ad61e], dx
add byte [esp + eax - 0x7e9ad61b], 0x8f
mul cl
sar dword [esp + ecx - 0x7e9ad61a], 0x22
pop eax
pop eax
jns fcn.017d1626

Function at 0x1806798
Capabilities:
Encode data using xor

Disassembly:
mul eax
mov eax, dword [edx + ebp - 0x2eaaad98]
or edx, edx
sbb dx, dx
add edx, edx
xor eax, ebx
movzx ecx, dx
lea eax, [eax + ecx*2 - 0x5eb4891f]
mov dword [esp + edx - 0x5d540000], ecx
neg dx
rol eax, 1
sar dword [esp + ecx*2], 0x2f
sub cx, word [esp + edx - 0x5d540000]
or dword [esp + ecx], edx
neg eax
ror cx, 0x88
sar cl, 0x63
xchg dx, cx
inc eax
rol eax, 2
sal dword [esp + edx - 0x5d540000], 0x31
btr ecx, ecx
jae 0x1930209
mov ecx, dword [esp + 0x14]
jmp 0x1bb3eca
mov dword [esp + 0xc], 0x849138a1
lea esp, [esp + 0x18]
ret

Function at 0x1812037
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*2 - 0x57356a08], edx
sbb dword [esp + ecx - 0x2b9ab504], ecx
pop ecx
jnp 0x1743427
push ebx
imul ebp, dword fs:[edx], 0xffffffe4
jo 0x1812074
jmp 0x34d371bd
mov esp, 0x66a90e05
inc esi

Function at 0x1818bd4
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + ecx*4 - 0x215]
rol ecx, 0x83
sal dl, 1
movzx ecx, byte [ecx + esi - 0x428]
xor cl, bl
not cl
dec cl
and dl, 0x89
neg edx
ror cl, 1
mov dword [esp], edx
ror dword [esp], 0x1e
sbb dl, 3
sbb cl, 0xb4
btr edx, edx
not cl
neg dword [esp]
xor bl, cl
add dx, word [esp + 2]
bts edx, edx
xchg byte [esp + 2], dl
lea ecx, [esp + ecx + 4]
mov byte [esp], dh
call fcn.019de663