joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b9d0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00408218
add esp, 0x208
pop ebx
ret

Function at 0x40bb34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40bc6c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40bc56
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40bb91
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bc56
cmp dword [ebp - 0x14], 0
jne 0x40bba8
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404c98
mov bl, 1
jmp 0x40bc56
cmp dword [ebp - 0x14], 0x70000000
jb 0x40bbb6
call fcn.00409818
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00404dd4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004054ac
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x40bb5a
test eax, eax
jne 0x40bc56
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40bc04
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bc56
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x40bc0c
dec esi
test esi, esi
je 0x40bc1b
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x40bc0b
cmp dword [ebp - 0x10], 7
jne 0x40bc26
test esi, esi
je 0x40bc26
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404f00
cmp dword [ebp - 0x10], 7
jne 0x40bc49
test esi, esi
je 0x40bc49
lea eax, [ebp - 4]
call fcn.004054ac
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404c98
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bc73
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40c6b0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x417d9c
mov eax, esi
mov edx, 8
test al, 1
je 0x40c6cc
shr eax, 1
xor eax, 0xedb88320
jmp 0x40c6ce
shr eax, 1
dec edx
jne 0x40c6bf
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40c6b8
pop esi
ret

Function at 0x40c6e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
jmp loc.0042b9d0
Function at 0x40e5dc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40e636
inc esi
xor edi, edi
cmp edi, 1
jne 0x40e602
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x40e610
cmp edi, 1
jle 0x40e610
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040e168
test eax, eax
jne 0x40e636
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x40e636
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x40e636
inc edi
dec esi
jne 0x40e5f2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x40e640
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e664
jmp loc.0042b5e8
or eax, 0xffffffff

Function at 0x40e66c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x40e6b9
xor ebx, ebx
jmp 0x40e6ae
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00407bdc
test eax, eax
jne 0x40e6ad
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x40e763
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e68f
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x40e6c5
je 0x40e6ce
jmp 0x40e6d7
call fcn.0040bcb4
mov esi, eax
jmp 0x40e6d9
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x40e6d9
xor esi, esi
test si, si
je 0x40e763
xor ebx, ebx
jmp 0x40e6ff
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x40e6fe
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40e763
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e6e6
xor ebx, ebx
jmp 0x40e758
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40e757
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x40e74c
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.0040e640
push eax
mov eax, esi
call fcn.0040e640
pop edx
cmp edx, eax
jne 0x40e757
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40e763
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e70e
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x402718
Capabilities:
Encode data using xor

Disassembly:
or esi, dword [edx - 0x5a5a5a68]
call 0x5ab1082a
pop edx
pop edx
mov dl, 0x1c
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x2ec16595], cl
pop edx
int1
loop 0x40263a
pop edx
pop edx
pop edx
mov dl, 0x6e
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x5a49944e], cl
movsd dword es:[edi], dword [esi]
or dh, cl
loop 0x402664
pop edx
pop edx
pop edx
mov dl, 0x7b
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp + 0x91e5f02], cl
push ds
pop edx
rcr dword [edx - 0xf], 1
loop 0x402683
pop edx
pop edx
pop edx
mov dl, 0x56
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x4df56595], cl
in al, 0xb6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
int1
call 0xe2d9f97b
push edx
pop edx
pop edx
pop edx
mov dl, 0xa9
mov al, 0xa5
movsd dword es:[edi], dword [esi]
shl dword [edx - 0x21], 1
movsd dword es:[edi], dword [esi]
das
pop eax
rol dword [edx - 0x53], cl
pop esi
jle 0x402690
pop edx
pop edx
pop edx
das
dec eax
loop 0x402690
pop edx
pop edx
pop edx
mov dl, 0x82
mov al, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x5a5d004e], cl
movsd dword es:[edi], dword [esi]
int1
mov dl, 0x29
mov dword [0x4cb2a5a5], eax
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dl, 7
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dl, 0x46
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add ebx, edi
xchg ebx, eax
push edi
push edi
imul ebx, dword [edx + 0x5a5a4ab2], 0x5a
aad 0x5a
fstp dword [esi - 0x58804d8a]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov bl, 0xda
mov byte [0x901a5a5], al
invalid
pop edx
fistp dword [ecx + 0x5a1e329d]
or dword [esi], edi
movsd dword es:[edi], dword [esi]
push 0x3e
sar dword [edx - 0x23], cl
jp 0x40266f
pop edx
psrlq mm7, qword [edi + 0xd0c0b09]
rol dword [edi], 1
push esi
shr dword [edi], 1
dec edx
rcr dword [ecx], 1
push edx
rcr esp, cl
loop 0x402701
pop edx
pop edx
rol esp, cl
sahf
pop edx
pop edx
pop edx
xlatb
sub dword [esi - 0x18], edx
pop ebx
loop 0x4026f8
pop edx
pop edx
pop edx
mov dl, 4
mov al, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp + 0x5a5a53e3], cl
pop edx
cmpsb byte [esi], byte es:[edi]
test eax, 0x59a6bff
add al, 3
add dword [edi], eax
cdq
cdq
xlatb
sbb bl, byte [edx - 0x3d]
lea eax, [eax]
mov edx, eax
call 0x4026df
pop eax
sub eax, 0x446913
mov esi, 0x44534c
mov ecx, 0x446908
sub ecx, esi
add esi, eax
mov edi, esi
cld
lodsb al, byte [esi]
xor al, 0x5a
pop edx
stosb byte es:[edi], al
dec ecx
jne 0x4026f6
test edx, edx
je 0x402712
mov eax, 8
call fcn.0040111c
mov edx, dword [esp + 0x28]
mov dword [eax], edx
inc ecx
jmp 0x4025c4
xor eax, eax
jmp 0x4026d8
Function at 0x6d05cd
Capabilities:
Encode data using xor

Disassembly:
push edi
xor esi, esi
push dword [ebp + 8]
call fcn.006d0493
mov edi, eax
pop ecx
test edi, edi
jne 0x6d05e9
cmp dword [0x1004a43c], eax
jbe 0x6d05e9
push esi
call dword [0x1003e09c]
pushfd
loopne 0x6d05d3
adc byte [ebp + 0x13e10e86], cl
add byte [ebx], bh
or dword [0xc8830328], edx
pushfd
loopne 0x6d05d3
adc byte [ebp + 0x13e10e86], cl
push cs
loope 0x6d05e9
add byte [ebx], bh
or dword [0xc8830328], edx
dec dword [ebx - 0x77c10]
jne 0x6d05b0
clc
push dword [ebp - 0x36]
add edi, ebx
or eax, 0x44501b9
push 0
sbb cl, byte [eax - 0x432fbf5]
mov ecx, 0x6a044501
add byte [edx], bl
mov byte [ebx], cl
add al, 0xcd
sti
add dword [edx + 0xe], ecx
mov byte [ebx], cl
mov byte [0xc300004c], al
cmp cl, byte [eax + eax + 0xd]
dec edx
sbb byte [ecx + 0x1a], dh
add byte [eax], al
mov edi, eax
pop ecx
add dword [ebp + 0x45392c10], edx
xchg ebp, eax
adc byte [ecx + edi], ch
inc ebp
or al, 0x74
lcall 0x4e1d, 0xc100009a
popal
pop es
adc byte [ebp + 0x15], dh
call 0xaaef0119
add byte [esi], dl
and edx, esp
and byte [esi], al
adc al, 0
add byte [ebx - 0x3ca20038], al
xor dh, byte [ebp + 0xc]
or byte [eax - 0x79cefc20], bl
or byte [eax - 0x50], ch
loop 0x6d05e2
cmpsb byte [esi], byte es:[edi]
add byte [eax + 0x7414b185], dl
adc eax, 0x3e2a068
push cs
mov eax, 0x9940016
adc byte [eax - 0xf78a01], dl
ror byte [0x43921f8], 1
enter 0xffffffffffff81ff, 0x5d
xor al, 0x75
or bh, bh
adc eax, 0x1003e08c
int3

Function at 0x6fcac5
Capabilities:
Encode data using xor

Disassembly:
add byte [edi + 0x16], bl
push ebp
inc esp
adc byte [ebp - 0x75], dl
in al, dx
sub esp, 0xe
stosd dword es:[edi], eax
push esi
add al, 0x15
pop eax
or dword [0xf633d814], 0xe75de3b
fdiv dword [ebx]
idiv byte [ebx]
fidiv word [ebp + 0xe]
mov dl, 0x1f
xor al, 0x77
cmp word [ebx], si
je 0x6fcaf3
add eax, 2
cmp word [eax], si
jne 0x6fcae3
or eax, 0x57f06408
mov edi, dword [0x10036010]
pushal
add edx, dword [eax]
push esi
push esi
push esi
sub eax, ebx
push esi
sar eax, 1
inc eax
push eax
push ebx
push esi
push esi
mov dword [ebp - 0xc], eax
call edi
push cs
pushfd
push ds
jl 0x6fcad3
je 0x6fcb47
push eax
call fcn.006fc1e0
pop ecx
mov dword [ebp - 4], eax
cmp eax, esi
je 0x6fcb47
push esi
push esi
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push ebx
push esi
push esi
call edi
test dword [esi], ecx
ret
adc cl, byte [ebx]
and esp, dword [ecx]
push edx
sbb byte [esi - 0x48], dl
inc esp
mov edi, 0x1be1005
add eax, 0x77525700
sub dword [edx], edx
fst qword [ebx]
or byte [esi - 0x48], dl
dec esp
add dword [esi], esp
add dword [0x8002662], eax
Function at 0x773123
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
add byte [eax], al
movsb byte es:[edi], byte [esi]
or eax, 0x11180053
push ebx
add byte [edx], dl
add dword [ebx + 0x2e], edx
dec esp
add dword [eax], eax
or dword [esi], esi
cmpsb byte [esi], byte es:[edi]
add byte [eax + eax], al
add eax, 0x2f185309
add eax, 0xf5e80000
outsb dx, byte [esi]
or eax, 0xa62ef9
add byte [ecx + 0xd], dl
push ebx
add byte [eax], dh
adc dword [ebx + 4], edx
mov edi, 0x1f23a4a
add byte [edx], cl
dec esp
add dword [eax], eax
xor byte [0x18f0053], cl
push ebx
add byte [edx - 0x59d1acef], ah
add byte [esi + edi*8], al
mov esi, 0x3c00f909
adc dword [ebx], edx
insb byte es:[edi], dx
add dword [ebx + 0x2e], edx
cmpsb byte [esi], byte es:[edi]
add byte [eax], al
or esi, dword [esi]
cmpsb byte [esi], byte es:[edi]
add byte [eax], al
nop
or eax, 0x1ff0053
push ebx
add byte [edi + 0x11], cl
push ebx
cmpsb byte cs:[esi], byte es:[edi]
add byte [eax], al
stosd dword es:[edi], eax
or eax, 0x11480053
push ebx
add byte [ecx], bl
add dword [ebx + 0x2e], edx
dec esp
add dword [eax], eax
or al, 0x36
cmpsb byte [esi], byte es:[edi]
add byte [eax + eax], al

Function at 0x7c5888
Capabilities:
Encode data using xor

Disassembly:
call fcn.0075528c
mov esi, dword [esi]
mov edx, 0x978212ef
add al, 0x56
adc byte [ecx + 0x43000e90], ah
add al, 0x89
inc ecx
inc ebp
sub dword [ebx + edx*2], ebx
mov bl, byte [esp + 8]
push esi
mov esi, ecx
push cs
lcall 0xfc46, 0x8b2b5451
push edi
push 0x670cd500
lea edi, [esi - 4]
push eax
push 8
push esi
call fcn.00844594
push cs
xchg edx, eax
push ecx
adc byte [ecx], cl
push edi
call 0xe74245f7
push cs
cmp edi, dword [eax + 0x4c25b1c]
add al, ch
mov dword [0x1b090002], eax
or al, 0x56
call 0x1b864525
add dh, al
add eax, 0xd39cd1a
add dword [edx], edx
mov edi, 0xc7561418
add byte [eax - 0x1e], bl
pop ds
push cs
insd dword es:[edi], dx
mov dh, 0xe
lea esp, [ecx]
add byte [ecx - 0x2ed88cf2], cl
inc ebp
and al, 0x32
mov dword [eax], 0x671ffc30
mov dword [eax + 0x10], ecx
adc eax, 0x48890812
adc al, 0x1e
invalid

Function at 0x7f2fb6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov ebx, eax
test ecx, ecx
je 0x7f3088
cmp ebx, 0x10
jl 0x7f3088
mov eax, 0x67187b80
mov esi, ecx
mov edx, 0x10
invalid
Function at 0x8c5b90
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x8b
inc ebp
sbb byte [ebp + 0x6891877], cl
add eax, 8
or eax, 0x841620b1
pop edx
sbb al, 0x75
add eax, 0x902c7e8
pop eax
add al, 0x8b
insd dword es:[edi], dx
sbb al, 0x8d
ja 0x8c5bce
mov dword [esi], ebp
add ebp, 8
mov eax, ebx
lock xadd dword [ebp], eax
mov ecx, dword [esi]
test byte [ecx + 1], bl
and ebx, dword [esp]
add al, byte [eax]
add byte [ebx + 0x464c8bc7], cl
mov ah, 1
sub bh, ch
or byte [esi], dl
nop
or al, byte [esp]
clc
and dl, byte [eax + 0x5651040a]
dec byte cs:[eax]
add byte [eax], dl
dec ebp
pop edi
and al, 0x7c

Function at 0x8cc179
Capabilities:
Encode data using xor

Disassembly:
sbb byte [ecx], cl
adc byte [edi + eax*8], cl
push es
xor byte [eax], dl
adc ch, byte [esi + 9]
add eax, 0x1c704a8
add dword [esi], ecx
jo 0x8cc197
add byte [esi], bh
adc dword [eax], esi
or bh, al
push es
in al, dx
or dword [edx + 0x2e], edx
loopne 0x8cc19e
push edx
loopne 0x8cc19e
add al, 0xc7
add dword [ecx], eax
adc eax, 0x213019
add dword [0x213019], edx
adc byte ds:[ebx], dl
add byte [eax], bh
add dword [eax + 0x26], esp
mov dword [0x905120a], eax
mov dword ss:[0x995260a], eax
add al, 0xc7
add dword [ecx], eax
sbb dword cs:[eax - 0x62], edx
or byte [ebx], 4
push 0x70
and cl, byte [esi + 0xca02208]
adc ch, byte [ebp + 0x4006088b]
adc byte [esi], bl
xor eax, 0x5474a12
fild dword cs:[ecx]
add eax, 0x709e01
Function at 0x8f7675
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
adc dword [ecx], eax
sub al, 0x55
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x71533dc0
push esi
sbb byte [ebx + 0x55533cec], al
push esi
push edi
jne 0x8f76d5
or byte [esp + 0x50], al
and al, 0x50
imul eax, dword [ebp + 0x2c], 0x75d62ca1
mov esi, dword gs:[eax]
mov ebx, 1
mov eax, dword [0xce8b4812]
mov edx, ebx
lock xadd dword [ecx], edx
mov ebp, dword [eax + 4]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x58], 0x8b08e401
cmp eax, 0x3c6c61a0
add al, 0xff
xlatb
movzx ecx, al
mov edx, eax
shr edx, 8
movzx edx, dl
or ecx, 0xc1286f21
call 0xc14585e8
movzx eax, al
shl ecx, 8
or ecx, edx
add dword [0xc18bc818], eax
shr eax, 0x10
and eax, 0x8aa900a1
movsd dword es:[edi], dword [esi]
jns 0x8f768f
jae 0x8f76f8
inc eax
mov edx, ecx
mov eax, dword [0x542006b]
cmp eax, 0xe281c108
sbb dword [ebx], esp
add al, 0x69
shl byte [ecx - 0x36cce359], cl
push 7
mov dword [esp + 0x40], ebx
add dword [eax + eax], ebp
dec eax
add dword [edx], ebp
add byte [edx - 0x5f], cl
lahf
add byte [edx + esi + 0x73], cl
add byte [eax], cl
shr eax, 0x10
or dword [esi], esi
setb byte [ebx]
adc al, 0x30
mov edx, ecx
shr edx, 8
add dword [eax + eax + 0x32], ecx
or dword [eax + 8], esi
movzx eax, cl
or dword [ebp + 9], ebp
pushfd
add al, 0x33
leave
add dword [ebp + 0x18], ebp
xor al, 0x8b
adc eax, 0x6555e8d0
add dword [edi], esp
sub byte [esi], dh
mov dword [esp + 0x18], ecx
mov eax, dword [edx]
mov dword [esp + 0x2c], ebx
add dword [ebp + 0x28], edi
cmp byte [ebx + 0x167c30f8], al
test al, 0xf0
je 0x8f7776
push ecx
test dword [edi], edx
sbb al, 0x51
push 0x1022
call dword [0x890c7981]
je 0x8f779a
sbb al, 0x31
or al, 0x89
insb byte es:[edi], dx
and al, 0x20
popal
mov ah, 0x3c
push eax
push ebx
push 0
lea ecx, [esp + 0x28]
mov byte [esp + 0x64], bl
call 0xc28c7366
sbb dword [esp + ebp], ecx
push ecx
push 6
or dword [esi], edx
add al, 0xe8
ret 0x1201
Function at 0x8ff093
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sbb eax, 0x114229aa
mov al, 0xc
cmp edi, edx
je 0x8ff022
inc ecx
int1
adc dl, byte [edi + 0x26a0c50]
mov dword [esi + edx - 0x3b], edx
cmp edi, dword [edx + 0x4c]
add byte [eax], bl
mov byte [esp + 0x68], 0
mov esi, dword [0x850c45c1]
leave
je 0x8ff024
test eax, 0x751108e4
or al, 0x21
jecxz 0x8ff020
push 4
push eax
adc dh, byte [ebp + 0x44c70c40]
inc esp
and al, 0x68
mov eax, dword [0xe29415f]
push 0x29415fa1
push cs
pop edi
inc ecx
sub dword [esi], ecx
test al, 0x5f
sar dword [esi + ecx], 1
outsb dx, byte [esi]
and ecx, dword [esp + ebx]
push 4
push edx
add eax, 0x4c8b0c25
and al, 0x60
push ds
sti
or byte [esi], cl
fcomp qword [edx]
imul esi, edx, 0x109aa45
cmp byte [edi - 0x75], dl
clc
mov eax, dword [edi]
mov ecx, dword [eax + 4]
cmp esi, ecx
jg 0x8ff072
test byte [eax + 0xc], 0xe
in al, 0xb
add byte [eax + 0xe], dh
in al, 0xb
pop eax
rcl ecx, 0xf8
cmp esi, eax
jl 0x8ff072
mov eax, ecx
push eax
push esi
call fcn.008e8068
pop edi
ret
push 0
push 0x10
push esi
jmp 0x8ff085
or cl, ch
push cs
jbe 0x8ff0a4
or eax, 0x53ccb00f
mov bl, byte [esp + 8]
push esi
mov esi, ecx
test bl, 2
je 0x8ff0c6
mov eax, dword [esi - 4]
push edi
push 0x6507b4b0
lea edi, [esi - 4]
push eax
push 0x14
push esi
call 0xd76697
test bl, 1
je 0x8ff0be
push edi
call 0xed766fa
xchg ebp, eax
adc dword [ebx + ecx*4], ecx
invalid
mov eax, edi
pop edi
pop esi
push cs
cld
sub dh, byte [edx]
loopne 0x8ff0cd
adc al, ch
mul byte [ecx - 3]
inc dword [0xe8560c28]
dec ebx
jne 0x8ff0bb
push cs
add al, 0x8b
mov byte [0xb8cc0427], 0xe
xchg edi, eax
adc al, 0xf0
push esp
push esi
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x8ff106
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x8ff0e5
xor eax, eax
xor edx, edx
test eax, eax
sete dl
pop esi
mov eax, edx
ret
movzx eax, byte [edx]
movzx esi, byte [ecx]
sub eax, esi
jne 0x8ff132
movzx eax, byte [edx + 1]
movzx esi, byte [ecx + 1]
sub eax, esi
jne 0x8ff132
invalid
invalid

Function at 0x912ae5
Capabilities:
Encode data using xor

Disassembly:
or ecx, dword [ebx + 0xd371a17]
add byte [0xe73007a], ch
aaa
or eax, 0x3e41bd0e
fst dword [eax]
imul ecx, dword [eax + 0xeec8104], 0xa2262e74
or dword [esi], ecx
pop esp
or al, 0x53
push ebp
mov ebp, dword [edx + edx + 0x564c65b1]
mov esi, ecx
push edi
mov dword [esp + 0x34], esi
xor al, 0x83
invalid
adc al, 0x56
mov dword [esp + 0x40], ebp
call 0xeccb788
push 0x15
or byte [ebx + ecx*4], bl
invalid
Function at 0x940eb9
Capabilities:
Encode data using xor

Disassembly:
cmp ebp, eax
je 0x940e8d
movzx ecx, byte [ebx + 1]
mov byte [ebx], al
xor cl, byte [eax + 7]
add byte [edi - 0x8a3b71b], bh
sub cl, dl
add cl, 0x1f
mov byte [ebx + 1], cl
mov eax, dword [esp + 0x14]
push ebx
push 0x49444154
mov ecx, esi
into
call 0x53a2ff81
aas
push cs
ror dword [ecx], cl
leave
mov cl, byte [ebx + eax*4]
dec esi
insb byte es:[edi], dx
add al, 0xe
push cs
pop ebx
or al, 0
pop ebp
push ss
mov esi, 0xb501608
adc byte [ebx - 0x3d], bl
mov edi, 0x82a59b2c
add al, 0xef
sbb al, 0x42
push ecx
add dword [ecx + edx*2], ecx
push esi
mov esi, ecx
xor dword [ecx + 0x2910f512], edi
mov dl, 0x1e
in al, dx
adc byte [esi], cl
add edx, dword [ecx]
xor al, 0x85
div byte [edx + edi + 0x6a]
add al, 0x68
inc ecx
dec ebp
inc ecx
call 0x5625fd97
or al, 0x85
sal byte [edi + 0x25], 0xc2
add byte [eax], cl
and edx, eax
add byte [ebp + 0x4804a0e], cl
push esi
mov eax, 0x1017c70e
call fcn.00930e9f
loope 0x940e9e
sbb dh, al
call fcn.0093feee
pop esi
push ds
retf

Function at 0x9e2608
Capabilities:
Encode data using base64

Disassembly:
add byte [eax], al
test dx, cx
jne 0x9e261b
adc eax, 0x17f0112
adc cl, byte [eax + 0x5d]
mov cl, byte [eax + edi*2]
xor cl, byte [eax + esi*2]
test cl, 0x7f
je 0x9e25ec
mov byte [esp + 0x14], 0x2e
mov edx, dword [esi + ecx - 0x2a]
push ds
push cs
mov dh, 0x37
adc al, byte [eax + 0xa]
xor byte [ebx - 0x72a9ffb3], cl
inc esp
and al, 0x16
push eax
call dword [0x4f0eeffc]
or bh, byte [eax + eax]
cmp ax, word [esp + 0x3c]
jne 0x9e260e
mov ecx, dword [ebp + 4]
mov dx, word [ecx + esi*2]
mov eax, 0x235c4905
sar byte [ecx + 0xa000], 1
cmp dx, cx
jae 0x9e260c
mov edx, esi
sub edx, edi
cmp edx, 0x1000
add byte [eax], al
jl 0x9e2646
or eax, 0x458b1084
adc byte [ebx - 0x2dccf7bb], cl
push cs
push ds
push cs
sahf
pop ds
invalid
Function at 0xae5ad4
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0xe013832
jbe 0xae5b1c
adc al, 0x54
push ecx
push esi
call 0x94c06f1f
or al, 0
pop eax
add dword [edx - 0x75eafb00], ecx
add byte [ecx + eax + 0xf], dl
add esp, eax
adc bh, ah
push ebp
mov edx, dword gs:[esi]
add dword [eax + 0x41], ecx
arpl word [eax], cx
setg al
rcr dword [edi + 4], 0x88
inc esp
adc al, dl
sbb eax, dword [ebp - 0x67]
sub byte [ecx + 0x5220244c], cl
jmp 0xae5b33
push cs
add esi, edx
add byte [eax], dl
popal
insb byte es:[edi], dx
add byte [ecx + eax*4], dl
das
and dword [ecx + 0x16a5108], eax
or dword [ebx - 0x7c2800e0], esi
les edx, [eax]
push 0
push 2
sbb eax, 0xa9f0e0f
add dword [edi + 0x1a], ebp
add dl, byte [ecx + eax]
or eax, dword [eax]
add byte [edx], ah
bound ecx, qword [eax]
add byte [edx + edx], ah
push edi
or byte [eax], al
inc eax
and ebp, esp
push cs
sub al, byte [edi + 0x15]
mov eax, dword [0xd6084659]
mov ecx, dword [edx + ecx*2 + 0x42]
add ah, byte [ecx + 0x7c]
add dword [ecx], eax
push ebp
loopne 0xae5b6c
xor bl, ch
salc
push cs
out 0xe, al
fld dword cs:[esi]
add byte [eax + 0x55], ch
loope 0xae5b7b
jae 0xae5b7d
push ss
test al, 0x1a
adc byte [ebx - 0x5172f7c0], cl
inc ecx
jnp 0xae5b93
sbb dl, byte [eax]
mov eax, dword [eax + 8]
lea ebp, [esi - 0x3ff184bf]
jno 0xae5b98
sal byte [ecx + 0x10], 0x83
clc
add dword [edi], ecx
mov cs, word [esi]
jle 0xae5bcc
cmp eax, 1
jle 0x12ead99f
adc ah, byte [eax]
or dword [ebx + ecx*4], ebx
and byte [ecx], cl
sbb al, 0x8b
into
call fcn.00ae52e1
lea esp, [0x1a20126c]
push ss
idiv edi
dec dword [ebp + 0x20126c25]
sbb dl, byte [esi]
mov edi, 0x2131000e
add bl, byte [eax]
dec esp
and al, 0x38
mov dword [esp + 0x70], 0xac092f81
add al, 0x83
iretd
add byte [eax + 0x41], dh
ror dword [ecx], 0x30
push cs
mov bl, 0xa
sub byte [ecx - 0x8fdb84], cl
jo 0xae5bda
call esi
salc
mov eax, dword [ebp]
mov eax, dword [eax]
push cs
fsubr dword [ecx]
add byte [ecx], dl
add dword [edx], ecx
xor byte [eax + 4], cl
mov edx, dword [eax + 8]
push ecx
push edx
push ebp
call int.00ae7010
add dword [ecx], edx
dec edx
sbb eax, dword [eax]
push 0x13ff
mov esi, dword [ebp]
mov eax, dword [esi + 8]
sub esp, 0x18
lea eax, [eax + eax*2]
mov edi, esp
lea esi, [esi + eax*8 - 8]
mov dword [esp + 0x38], esp
push esi
mov dl, 0
cmp al, 0x8d
pop ecx
xor byte [esi + 4], cl
push ecx
lea ecx, [edi + 4]
mov dword [esp + 0x8c], 0xe0c1616
and bl, byte [eax]
push eax
mov edx, dword [esi + 8]
mov dword [edi + 8], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov ecx, dword [esi + 0x10]
mov dword [edi + 0x10], ecx
mov edx, dword [esi + 0x14]
loope 0xae5bd9
or byte [ecx + 0x51a1457], cl
push ebp
popal
mov eax, 0xe1d8e804
invalid