joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1719cc3
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 8], 0xff14b200
lea esp, [esp + 8]
call fcn.01638cae
rol dword [eax + edi*8 - 0x5408b8e1], 0x41
add ebx, 0x6f29b1f1
mov edx, 0xd2a250e4
insd dword es:[edi], dx
add dh, dh
sub dword [edi - 0x46], ebp
in al, 0x50
mov byte [0xf6026dd2], al
dec esp
jp 0x1719ce1
jb 0x1719d27
mov esp, 0x2e8f944d
aad 0x5a
sbb dword [eax + 0x2e9bac0f], edx
xor dword [edx], 0x5487b403
xchg dword [esp + 0x1c], edx
mov ecx, dword [esp + 0xc]
jbe 0x1759063
shr dword [esp + 0x18], 0x13
push dword [esp + 8]
popfd
lea esp, [esp + 0x1c]
ret
push cs
inc esp
not edi
mov edi, dword [esp + 0xc]
mov edi, dword [edi]
call fcn.01625789

Function at 0x1729b3d
Capabilities:
Encode data using base64

Disassembly:
pop eax
push ebx
pushfd
mov ebx, 0x41857b84
add bl, bl
call fcn.01623e38
push esi
pushfd
mov esi, 0xc494740e
not esi
cmp esi, 0xae2e25be
call fcn.0177feaa

Function at 0x172cca6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shld ax, si, cl
jmp 0x1798605
jmp 0x178b592
add al, ch
mov byte [ebp - 0x1c], bl
inc dword [ecx + 0x4c7]
add edi, 4
invalid
je 0x172ccd3
add edi, 4
sal byte [esp + 7], 1
pop es
setle byte [esp + 6]
jbe 0x16b6606
mov ah, 0xdb
lcall 0x2889, 0x26825965
idiv ebx
mov bh, 0x4c
xor ebp, dword [edx + 5]
mov word [ecx + 0x5e], es
xlatb
cmp al, 0xa5
pushal
pop edi
sahf
or eax, 0xbce89300
je 0x172cd1e
pop ebp
mov cl, 0x8d
jns 0x172cd4e
shr cl, 1
push edx
dec esi
mov ch, cl
sbb byte [esi], 0x3e
cmpsd dword [esi], dword es:[edi]
inc ebx
sbb ch, byte [ebx]
inc edx
pop ebx
inc edx
mov esi, 0xa68d5e5a
mov dh, byte [edi + 0x2e]
aad 0x39
cmp eax, 0xb4098da6
fld qword [ecx + 0x34a03fde]
fucomp st(6)
dec ebp
out dx, al
cmpsb byte [esi], byte es:[edi]
mov word [esp + eax], cs
push es
jb 0x172cca0
cmc
push edi
js 0x172cd14
jmp ebx
jecxz 0x172cd09
mov cl, 0x30
imul ecx, ebx, 0xffffff8c
add bl, byte [eax + 0xf]
cdq
mov dword [0x28e6ac59], eax
setns byte [ebx + 0x28e6ac59]
xchg ebp, eax
not byte [ecx + 0x1d]
test al, ah
in al, 0x98
adc al, 0x3d
movsd dword es:[edi], dword [esi]
cmp al, 0x83
das
ret
hlt
jmp 0x1719a37

Function at 0x172d2c6
Capabilities:
Encode data using base64

Disassembly:
pop ebp
push edx
pushfd
mov edx, 0x663150af
not edx
lea edx, [edx + edx - 0x5ac8634a]
xor dl, 0x11
xchg dword [esp + 8], ebp
Function at 0x17352ea
Capabilities:
Encode data using xor

Disassembly:
movzx esi, word [esp + 4]
je 0x16c9456
xor dword [esp], 0xf113b287
shl dword [esp + 4], cl
xchg dword [esp + 0x34], edx
mov ebp, dword [esp + 0x28]
call fcn.0176f011
mov esi, 0x9f069f84
lea edx, [ebp + esi + 0x28210f84]
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
shr esi, 0x64
bswap ecx
mov dword [esp + 0x1c], ecx
push esi
neg ecx
not dword [esp + 0x20]
lea edx, [edx + 0x2a073116]
mov bp, 0x5507
push esi
jno 0x170d042
mov edx, dword [ebp]
jmp 0x16e2ca6

Function at 0x173c44b
Capabilities:
Authenticate hmac

Disassembly:
push eax
push ebp
pushfd
mov ebp, 0x821e802b
not ebp
or ebp, 0xa737caa1
call fcn.016690b5

Function at 0x175014a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bl, cl
push edx
je 0x17305e1
jno 0x16690f0
dec ecx
sbb ecx, 3
push 0xf582f63b
jmp 0x16d7a79
inc ecx
mov dword [ecx], ebx
dec eax
lea esp, [esp + 0x20]
jmp fcn.0177ca2c
not byte [esp + 2]
push 0x1c972e12
inc cl
xor word [esp + 5], 0x4e16
sar dword [esp + 1], 0x7b
jbe 0x171acd9
add dword [esp + 0x28], 0x10dd9
shr cl, 0x1b
mov ebp, edi
jne 0x16d7979
xor di, 0x6406
mov ebx, ebp
mov ebx, dword [esp + 0x28]
mov ebx, dword [ebx]
call fcn.016fdfc6
neg cl
push 0x9e069817
push 0x6f29710e
xor cl, 0x8b
push 0x7935d14
shr dword [esp + 0x10], 0x7e
not dword [esp + 3]
neg cl
push 0xe58903ba
sal dword [esp + 5], 0x27
sbb cl, 0xba
jmp dword [ecx + ecx*4 + 0x11]
mov ecx, dword [esp + ecx + 0x18]
call fcn.0171b3ab
xchg esp, esp
jbe 0x17305bd
sub esp, dword [eax - 0x5b6feb4b]
invalid
mov dword [esp], 0x5da68bac
adc dword [esp], 0x8984e688
xor cl, bl
jmp 0x16f5b91

Function at 0x1753b73
Capabilities:
Packed with generic packer

Disassembly:
not dword [esp]
jl 0x1648e9d
push 0x2f842c9b
mov ebp, 0xca83e62a
lea ecx, [ebp + ebp + 0x23aa801e]
xor word [esp + ebp + 0x357c19d6], 0x8b0
mov ebp, dword [esp + 0x18]
mov ebp, dword [ebp]
not dword [esp]
not word [esp]
mov dword [esp + 0x18], ecx
ja 0x167ae65
sbb dword [eax + esi*2 + 0x216877db], 0xffffff99
add bl, byte [ecx + 0x3d]
xchg edx, eax
xor ebp, dword [ebx + 0x20]
cld
fbld tbyte [eax - 0x27]
mov cl, 0xd2
cmp dword [ebp + 0x15eb232d], esi
ror cl, 1
push esi
dec edx
mov ecx, esi
das
push edi
in al, dx
rcr byte [ebp + 0x2d090012], 0x42
xchg ecx, eax
aad 0xd6
sbb edi, dword [eax + eax + 9]
sub eax, 0x58a19142
ficom dword [esi]
mov al, byte [0x8d42891f]
lcall 0x1efe, 0x58c1216f
and al, 0x52
xchg ebp, eax
aad 0x18
into
or dword [ebp - 0x1b1e4a1c], eax
mov bl, 0x6a
sbb edi, dword [eax + eax - 0x18]
cmp byte [edx - 0x77], cl
mov esi, 0xc83c53eb
aaa
shr byte [esp + esi*8 - 0x2239fd38], 0x52
call [ebx]
sbb esp, eax
aas
or al, 0x43
sbb edi, dword [eax + eax + 9]
sub eax, 0xeee79042
int1
and ch, byte [edx]
cld
rcl dword [edi], cl
invalid
Function at 0x1759526
Capabilities:
Execute syscall

Disassembly:
not word [esp + 0xc]
mov dword [edi + 4], eax
call fcn.016abf23
mov ebx, dword [esp + edi + 0x584e0025]
cmp dword [esp + edi + 0x584e0019], 0x9c9f77aa
call fcn.017634bd
sbb edi, 1
push 0x1205d183
mov word [edi], cx
jmp 0x173aa16
push 0x4a3fd598
push 0x379def3a
push 0x28138980
mov dword [edi], edx
jmp 0x1681b85
call fcn.016fdaea
mov word [ebp], ax
push 0x7839540d
jmp 0x1749538
lea esp, [esp + 8]
jmp fcn.01750c92
xor bl, al
bt cx, cx
mov dword [esp + ecx*4 - 0x66a31924], 0xe7861926
push ecx
lea eax, [esp + eax + 0xc]
movzx cx, byte [eax + ecx - 0x19a8c649]
jae 0x16f2aef
jb 0x16be2dc
jne 0x16a3ab0

Function at 0x1769a6b
Capabilities:
Inspect section memory permissions

Disassembly:
xor dl, 0xb5
neg byte [esp + 6]
not word [esp + 9]
call fcn.017755d0
push 0x37140d13
neg dl
mov dword [esp + 4], 0x7c0101a8
push 0x62b68510
add dl, 0x1b
sub dword [esp + 6], 0x49b5ee82
js 0x169b632
xor dl, bl
jmp 0x16aaff0

Function at 0x17705cd
Capabilities:
Encode data using base64

Disassembly:
not dx
mov ebx, dword [esp + 0x1c]
add dword [esp + 0xc], 0xff9b43cf
add dword [esp + 4], 0xff9bee25
lea edx, [edx + edx*4 - 0x3cef7f4b]
test dx, 0x7219
seto dl
mov edx, dword [esp + 0x10]
call fcn.0176d46c
int3
jns 0x1567af0
fdiv qword [edx + edx*2 - 0x46]
sbb dword [edx], edx
pop ebx
cmpsb byte [esi], byte es:[edi]
xchg dword [eax + 0x60], ebp
mov dh, 0xc9
xor eax, 0x4c62ba89
mov bl, 0x8f
jae 0x1770649
or dh, cl
int1
sub eax, 0x6c82dae1
arpl word [edi - 0x239867d4], dx
xor ch, cl
push esp
das
mov ebx, 0xa3476c7f
pop esi
mov bh, 0xc
rcl byte [edi + ebp*8]
test al, bh
add eax, 0x8f8b671c
in al, 0x67
lodsd eax, dword [esi]
wait
int3
in al, dx
call dword [edx + 0x57]
push edx
push edi

Function at 0x177064b
Capabilities:
Encode data using base64

Disassembly:
not dx
mov ebx, dword [esp + 0x1c]
add dword [esp + 0xc], 0xff9b43cf
add dword [esp + 4], 0xff9bee25
lea edx, [edx + edx*4 - 0x3cef7f4b]
test dx, 0x7219
seto dl
mov edx, dword [esp + 0x10]
call fcn.0176d46c
int3
jns 0x1567af0
fdiv qword [edx + edx*2 - 0x46]
sbb dword [edx], edx
pop ebx
cmpsb byte [esi], byte es:[edi]
xchg dword [eax + 0x60], ebp
mov dh, 0xc9
xor eax, 0x4c62ba89
mov bl, 0x8f
jae 0x1770649
or dh, cl
int1
sub eax, 0x6c82dae1
arpl word [edi - 0x239867d4], dx
xor ch, cl
push esp
das
mov ebx, 0xa3476c7f
pop esi
mov bh, 0xc
rcl byte [edi + ebp*8]
test al, bh
add eax, 0x8f8b671c
in al, 0x67
lodsd eax, dword [esi]
wait
int3
in al, dx
call dword [edx + 0x57]
push edx
push edi
Function at 0x1772b7f
Capabilities:
Encode data using xor

Disassembly:
call fcn.01790589
push 0
jmp 0x1738720
push esi
jmp 0x176a79d
push 0
jmp fcn.0174ca3d
mov dword [ebp + 0x20], esi
jmp 0x1686517
xor ecx, dword [ebx - 0x35ca46d2]
sbb dh, bl
mov cl, byte [esi + 4]
push 0x52238520
call fcn.01639ede
ja 0x162766b
neg edi
xchg dword [esp + edi + 0x6ac10008], eax
mov edi, dword [esp + edi + 0x6ac10004]
call fcn.01760b20
mov esi, dword [edi + 8]
jmp 0x16f5164
push ecx
pushfd
push 0x443a5c35
call fcn.016818d7
push esi
push es
call dword [esi + 6]
aaa
jg 0x1772b46
adc al, byte [ecx + 1]
add byte [esi - 0x53], bl
xor dword [edx], ebp
pop esp
pop es
jnp 0x1772b8a
push eax
dec ecx
stosb byte es:[edi], al
mov bl, 0x74
fcomp dword [edx + 0x74b3c159]
fdiv st(6)
sub dword [edi - 0x2cad634e], edi
invalid

Function at 0x177b808
Capabilities:
Execute syscall

Disassembly:
jg 0x16a52a9
shr edx, 0xae
mov dword [esp + edx - 0xb237], edx
neg dword [esp + edx*2 - 0x16472]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + edx - 0xb227]
call fcn.01642aa7
jge 0x16a1716

Function at 0x177c409
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + ebp + 0x458ee130]
mov eax, dword [eax]
add dword [esp + ebp + 0x458ee118], 0x25c07
sub word [esp + ebp + 0x458ee124], di
shr ebx, 0x3d
call fcn.01651535
in eax, dx
push eax
mov dl, 0xa0
inc ecx
add dword [ecx], ebx
jno 0x177c43d
outsb dx, byte [esi]
mov word [eax], fs
invalid
adc byte [eax], cl
cmp byte [ecx + 0x2f1e6c85], 0xb5
imul ebp, dword [ecx - 0x6b], 0xffffffe4
invalid

Function at 0x177ea9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x1790e3b
jmp 0x175d870
push 0xc809daa8
mov eax, 0xb728cb9b
mov eax, dword [ebp]
not dword [esp]
jmp 0x16c9d98
mov edx, edi
xor dx, 0xfa22
shr edi, 0x75
jns 0x16ca674
mov dword [esp], eax
dec ebx
jmp 0x156655f
mov eax, 0xeeb06bbd
sub eax, eax
ror al, 0xc1
add eax, dword [ebp + ebx*4]
call 0x177eaab

Function at 0x17820fe
Capabilities:
Encode data using xor

Disassembly:
mov ecx, ebp
add byte [esp], ch
add word [esp + 0x1c], cx
mov cl, 0xbc
push ecx
shr ecx, 0xe7
mov word [esp + 4], bp
add dword [esp + 0x10], 0xfffd1739
mov eax, 0xc6a1b018
xor cx, word [esp + eax + 0x395e500a]
neg byte [esp]
je 0x1739d15
add al, 0xae
call fcn.01704c05
xor eax, 0xe8a496f1
sbb edi, dword [edx]
add al, byte [eax]
lea ebp, [ebp + ebp - 0x1eb62d6e]
js 0x16f8964
call fcn.0175db33
Function at 0x178343e
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esp
inc ecx
pop ecx
dec esp
lea ebp, [ebx*2 + 0x3d221405]
pop ecx
jmp 0x1673979
popfd
call fcn.01758d58
mov ebx, 0x735cba0
pop ebx
mov ebx, dword [esp + ebx - 0x675c2f17]
lea esp, [esp + 0x20]
ret
call 0x155ed00
jg 0x178758a
mov dword [esp + esi - 0x5a10a2a8], esi
lea edx, [edx + esi - 0xed7e498]
je 0x17080f5
or esi, dword [esp + esi - 0x5a10a2a8]
push edi
mov edi, dword [esp + esi - 0x5a10a298]
not di
neg dword [esp + edi - 0x36c3c503]
neg edi
neg word [esp + 0x24]
xchg dword [esp + 0x3c], edx
mov edi, dword [esp + esi - 0x5a10a2bc]
add dword [esp + esi - 0x5a10a2b4], 0xff9c4d33
shl esi, 0xbe
mov esi, dword [esp + esi*2 + 0x28]
call fcn.0165d4ab
xor dword [esp + 0x30], 0xe41b61be
mov esi, dword [esp + ebx + 0x4116b0d6]
sub dword [esp + ebx + 0x4116b0a6], 0xe5108ba4
jno 0x1692e3b
dec ecx
mov esp, ecx
mov ebx, 0x2cbc8a91
inc ecx
pop edi
jmp 0x165d25d

Function at 0x178569b
Capabilities:
Encode data using xor

Disassembly:
sub dword [esp + ebp + 0x428f5ebf], 0x51b1c78c
shl word [esp + ebp + 0x428f5edb], cl
lea ecx, [ebp*2 - 0x56ca91e2]
lea ebp, [ebp*2 - 0x784980d6]
movsx bp, byte [esp + 4]
mov ebp, dword [esp + 0x24]
call fcn.01753abe
mov esp, 0x151ba327
call 0xd7768aa9
xor eax, 0xf1d20ebd
jle 0x17856cb
adc byte [edi + edx], ch
arpl word [ebp + 0x2d], bx
pop esi
xchg edx, eax
test eax, 0x34a76f91
dec edi
sbb eax, dword [ebp + ecx - 0x4e3a82ab]
pop es
add byte [ecx], cl
sub eax, 0xe8249142
xchg ebp, eax
imul eax, dword [eax], 9
sub eax, 0xe849142
adc ebp, dword [edx - 0x78]
mov ebp, dword [edx - 0x12]
mov byte [ebp - 0x6be8ff95], dl
push esp
add dword [edi], edi
mov bh, 0x96
or al, 0x3b
xchg edx, eax
or byte [si - 0x30], 0xd3
sub eax, 0x96ecd088
jmp gs:[edi]

Function at 0x17887c2
Capabilities:
Authenticate hmac

Disassembly:
setl bl
add ebx, dword [esp + ebx - 0x71ccc300]
not cl
jne 0x178af53
mov edx, 0x3890e7a8
inc ecx
movzx esi, byte [eax + edx*2 - 0x7121cf50]
dec eax
and edx, edx
sal edx, 0xf8
dec ecx
adc eax, 0
and dl, dl
dec eax
bts edx, edx
sbb edx, 0x7b8f86a5
mov ebx, 0xb0019c26
shr ebx, 0xe
or ebx, 0xea8d75a2
push ebx
mov edi, dword [esp + ebx*2 + 0x2ae014c4]
mov byte [esp + ebx*2 + 0x2ae014b4], 0x8e
movzx ebx, word [esp + ebx*4 + 0x55c02968]
call fcn.0166600a
movzx edx, byte [ebp + edx*2 - 0x3aca8cf6]
jmp 0x1769b91
add ebp, 1
call fcn.0177a599
shr dword [esp + 0x14], 0x78
not cl
jbe 0x169d35d
setne cl
mov edx, dword [esp + 8]
mov edx, dword [edx]
jae 0x16c3ef1
or dword [esp + 0x14], ecx
mov dword [esp + 0x28], ecx
movzx ecx, cx
lea edx, [edx + 0x7227f8be]
add dword [esp + 0x20], 0xff926c95
mov byte [esp + 0x28], 0x1d
add word [esp + 0x14], 0xe209
jge 0x17689bf
bswap ecx
call fcn.01680af5
setne byte [esp + ebx - 0x71ccc34b]
test ebx, 0x48a2eeba
lea eax, [eax + ebx - 0x682f4992]
jne 0x1645af7

Function at 0x178c0a2
Capabilities:
Encode data using base64

Disassembly:
shl word [esp + ecx*2 + 0x7dc20010], 0x71
call fcn.01729a45
lea edx, [edx + ecx - 0xc831144]
je 0x1717eca
Function at 0x178e8a3
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 0xc], eax
call fcn.01673546
lcall 0xf7c9, 0xfffee4c
pop esp
and al, 8
bswap ecx
neg dword [esp + 8]
xor ebx, ecx
shl word [esp + 2], 0xb
sbb esi, 3
call fcn.017116a3
mov esi, dword [edi + ebp + 0x182f9108]
adc eax, 0xfec021ce
dec ecx
mov bl, 5
jle 0x178e8a8
mov edx, 0x7e83c5ee
adc byte [edi + 0x78], al
retf 0x33c6

Function at 0x178f181
Capabilities:
Parse pe header

Disassembly:
push 0x5c8d068f
call fcn.016a36b7
push edx
rol cl, 1
xchg dword [esp + edx*8], edx
xor bl, cl
lea edx, [edx + edx*2 + 0x26ab2617]
lea ecx, [esp + ecx + 8]
mov edx, dword [edx + ecx - 0x26ab2617]
or byte [esp], 0x15
mov dword [esp + 4], 0x852c7b15
sbb esi, 4
push 0x1f03e53a
mov dword [esi], edx
jmp 0x1566200

Function at 0x1790822
Capabilities:
Encode data using xor

Disassembly:
push edi
mov byte [esp + 0x10], 0x17
push esi
push ebp
call fcn.016b3722

Function at 0x17912d7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, dword [esp + edi - 0x3a33fe98]
mov edi, dword [edi]
lea edi, [edi - 0x7e5e57d5]
mov dword [esp + 0x10], 0x4e81073a
call fcn.0156eae5

Function at 0x17912f3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov esi, dword [esp + ecx*2 + 0x35e3af6a]
mov esi, dword [esi + ecx + 0x1af1d7af]
mov dword [esp + ecx + 0x1af1d7bb], ecx
shl dx, 0x9e
sets dl
cwde
setg al
adc cl, 0x90
neg al
sete al
btc ax, 0x15
rol cl, 1
xor bl, cl
sub eax, 0xb4ba8f0d
inc eax
add ax, 0x4b2
adc ecx, esp
movzx ax, byte [ecx + eax - 0x4b4574c7]
sub edi, 2
mov word [edi], ax
call fcn.01623d1c
adc esi, 2
call fcn.01709bba
jae 0x1691b86
jmp 0x1791294

Function at 0x1797110
Capabilities:
Encode data using xor

Disassembly:
xor dword [esp + ecx + 0x5124cc01], 0x14a325ab
jg 0x166601c
call fcn.01667694
dec eax
lea esp, [esp + 0x40]
jmp fcn.0177ca2c
mov edx, dword [esp + edx + 0x6f768881]
cmp dword [esp + ecx + 0x5124cc09], 0x3b3bd20d
not ebx
jne 0x1677969

Function at 0x1799ba5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 0x18]
add dword [esp], 0xffa07651
test dword [esp + 0x20], 0x3a2a790f
call fcn.01763d90
mov ecx, dword [esp + ecx + 0x364f3678]
neg dl
mov dword [esp + edx + 0x7450e514], 0x36b8af10
xor edx, edx
not byte [esp + 0xc]
or dword [esp + 0x14], edx
jae 0x178c0af
Function at 0x1815294
Capabilities:
Encode data using xor

Disassembly:
or al, cl
jmp 0x18ca5e7
call fcn.01892d97
xchg ecx, eax
imul esi, dword [edi + 0x58], 0x5b13209c
lodsd eax, dword [esi]
inc edx
cmp ax, 0xe159
fist word [edi + 0x1bde7fc4]
cmp dh, al
or eax, 0x9dccc33b
add ch, byte [esi]
add ch, cl
inc esi
out 0xff, eax
xchg esp, eax
js 0x17da92b
popfd
xor edi, esi
add byte [ecx], cl
sub eax, 0xe97e9142
xor byte [ebx], bh
or dword [0x5afe9142], ebp
pushfd
mov byte [0x9007b30], al
sub eax, 0x29119142
not byte [edx]
or al, 0xf
jge 0x17da8d3
xchg ecx, eax
invalid
cmp esp, dword [ecx]
mov eax, 0x8ecff5b6
js 0x17da922
jnp 0x17da8f3
ljmp 0x4331:0x9871fb2c
or dword [0x15879142], ebp
pushal
in al, dx
outsb dx, byte [esi]
sub dh, bl
and dword [eax - 0x43], esi
les ebp, [ebx]
daa
imul eax, dword [edi - 0x3d], 8
cmp al, 0x9b
push esp
invalid
jns 0x18e0f3f
mov ecx, 0x4b06f601
add esi, esi
push es
dec ebx
movzx ax, byte [ecx + ebp - 0x4b06f601]
btr ecx, ecx
jae 0x1834765
wait
push esp
inc eax
pushfd
mov edi, 0xfa9189e0
push 0x3b
test byte [eax - 0x6e0e8dc], bl
xor al, 0xd0
push dword [edi - 0x338c971c]
jne 0x181529b
push esi
mov ebp, 0x678f7931
sub esi, edi
mov eax, 0x76803e53
fstp xword [esi]
cwde
xlatb
stc
lds edx, [ebx + 0x9007edb]
sub eax, 0x889c9142
xchg ebx, eax
fstp xword [esi]
or dword [0x889c9142], ebp
xor eax, 0xdb551ddc
jle 0x18152f4
or dword [0x74819042], ebp
stosd dword es:[edi], eax
nop
mov al, 0xdd
sar esi, 1
and al, 0x81
call dword [eax]
pop edi
push cs
mov dl, 0x36
insd dword es:[edi], dx
inc esi
bound esp, qword [ecx + ebp*2 - 0x9007edc]
sar byte [ebp + 0x71bd266f], cl
push edx
fstp xword [esi]
or dword [0xb6459042], ebp
add byte [ecx], cl
sub eax, 0xb6459042
scasb al, byte es:[edi]
lfs edi, [eax]
andnps xmm4, xmmword [ecx + eax*4]
push esi
sar byte [ebp + 0x5e8b6c6e], cl
pop ebp
and al, 0x81
push esi
sar byte [ebp - 0x2e7db891], cl
xchg esp, eax
out 0x8c, eax
mov eax, 0x43cf7445
xchg dword [edi + ebx*2 - 0x4340516d], esi
jb 0x181531b
xchg edi, eax
push ebx
xchg edi, eax
cmp al, 0xd7
jae 0x18152e3
xlatb
sub al, 0x40
inc esp
dec edi
fsub dword fs:[0x6f03378c]
xor byte [ecx], 0xe4
ror dword [edi], 1
retf 0x11d0
sbb cl, ch
mov cl, byte [ebp + ecx - 0x4b06f609]
push 0xf2173707
neg byte [esp + 1]
adc ebp, 1
not al
push 0x7d365806
push 0x1196043a
not cl
and dword [esp + 8], 0x929400be
jno 0x17b0dc5
mov eax, 0x2818c12b
mov eax, dword [eax + edi - 0x2818c12b]
mov esi, 0x4baa4608
not esi
mov esi, dword [edi + 4]
mov cl, byte [edi + 8]
add edi, 6
jmp 0x17da899
mov word [ebp], ax
lea esp, [esp + 0xc]
jmp fcn.01817c3e
call 0x1874698
Function at 0x403427
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x406720
call fcn.00403db0
push 1
call fcn.0040387d
pop ecx
test al, al
je 0x403411
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040384b
mov byte [ebp - 0x24], al
mov eax, dword [0x4083fc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x403411
test eax, eax
jne 0x40332f
mov dword [0x4083fc], ecx
push 0x4051bc
push 0x4051b0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x403312
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x403401
push 0x4051ac
push 0x4051a4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4083fc], 2
jmp 0x403334
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004039ef
pop ecx
call fcn.00403b89
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x403365
push esi
call fcn.0040395b
pop ecx
test al, al
je 0x403365
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x4051a0]
call esi
call fcn.00403b8f
mov esi, eax
cmp dword [esi], edi
je 0x403383
push esi
call fcn.0040395b
pop ecx
test al, al
je 0x403383
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov edi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
push eax
push edi
push dword [esi]
call main
add esp, 0xc
mov esi, eax
call fcn.00403cb4
test al, al
je 0x403418
test bl, bl
jne 0x4033b6
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.00403a0c
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x403401
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00403b95
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.0052e000
jmp 0x4032a5
Function at 0x4121b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x412200
cmp esi, edi
ja 0x412268
cmp edi, dword [esp + 0x1c]
ja 0x412276
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x412202
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x4121f0
jmp 0x41225f
ja 0x412208
cmp eax, edx
mov esi, edi
jne 0x4121c3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x412240
mov ebp, esi
sub ecx, edx
jns 0x412257
jmp 0x412261
cmp esi, edi
je 0x412286
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x412261
xor al, 1
cmp ebp, edi
jne 0x412220
jmp 0x412261
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x44c4f0
call fcn.004489c0
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x44c4f0
call fcn.004487d0
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_srcio_borrowed_buf.rs_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0x44c4e0
call fcn.00448830
int3
Function at 0x4137ee
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
not ebx
cmp edx, 0x40
jb 0x413915
push 4
pop edi
sub edi, 1
jb 0x4137fd
cmp edx, 0xf
jbe 0x413925
movzx ebp, byte [eax + 0xe]
movzx esi, byte [eax + 0xf]
mov ecx, ebx
mov dword [esp], edx
mov edx, 0xff
shr ecx, 0x18
mov ebp, dword [ebp*4 + 0x44d2e4]
xor ebp, dword [esi*4 + 0x44cee4]
movzx esi, byte [eax + 0xd]
xor ebp, dword [esi*4 + 0x44d6e4]
movzx esi, byte [eax + 0xc]
xor ebp, dword [esi*4 + 0x44dae4]
movzx esi, byte [eax + 0xb]
xor ebp, dword [esi*4 + 0x44dee4]
movzx esi, byte [eax + 0xa]
xor ebp, dword [esi*4 + 0x44e2e4]
movzx esi, byte [eax + 9]
xor ebp, dword [esi*4 + 0x44e6e4]
movzx esi, byte [eax + 8]
xor ebp, dword [esi*4 + 0x44eae4]
movzx esi, byte [eax + 7]
xor ebp, dword [esi*4 + 0x44eee4]
movzx esi, byte [eax + 6]
xor ebp, dword [esi*4 + 0x44f2e4]
movzx esi, byte [eax + 5]
xor ebp, dword [esi*4 + 0x44f6e4]
movzx esi, byte [eax + 4]
xor ebp, dword [esi*4 + 0x44fae4]
movzx esi, byte [eax + 3]
xor ecx, esi
mov esi, ebx
xor ebp, dword [ecx*4 + 0x44fee4]
movzx ecx, byte [eax + 2]
shr esi, 0x10
and esi, edx
xor esi, ecx
movzx ecx, byte [eax + 1]
xor ebp, dword [esi*4 + 0x4502e4]
mov esi, ebx
and ebx, edx
shr esi, 8
and esi, edx
mov edx, dword [esp]
xor esi, ecx
movzx ecx, byte [eax]
xor ebp, dword [esi*4 + 0x4506e4]
xor ebx, ecx
mov ecx, eax
xor ebp, dword [ebx*4 + 0x450ae4]
push 0x44ced4
call fcn.00413d79
pop ecx
mov ebx, ebp
jmp 0x413809
mov cl, byte [eax]
inc eax
dec edx
xor cl, bl
shr ebx, 8
movzx esi, cl
xor ebx, dword [esi*4 + 0x44cee4]
test edx, edx
jne 0x413902
not ebx
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop ecx
push 0x44cec4
call fcn.00448770
Function at 0x420070
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45f08c]
test eax, eax
je 0x420128
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x42009c
cmp dword [eax + 4], 0
mov edi, eax
je 0x42009c
add edi, 8
jmp 0x420123
mov eax, dword [0x45f08c]
test eax, eax
je 0x420137
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x420121
mov esi, eax
test eax, eax
jne 0x4200f7
movzx eax, byte [0x45fae8]
mov ecx, 0xc
mov edx, 4
call fcn.00439610
test eax, eax
je 0x420152
mov dword [eax], 0x45f08c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45f08c]
test eax, eax
je 0x420146
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x420123
test ecx, ecx
je 0x420123
lock dec dword [ecx]
jne 0x420123
call fcn.0041fd70
jmp 0x420123
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45f08c
call fcn.00449360
jmp 0x420080
mov ecx, 0x45f08c
call fcn.00449360
jmp 0x4200aa
mov ecx, 0x45f08c
call fcn.00449360
jmp 0x4200ef
mov ecx, 4
mov edx, 0xc
call fcn.004485d0
int3