joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7bc713
Capabilities:
Encode data using base64

Disassembly:
adc esi, 2
mov dword [esp + 4], 0xa7a7f0bb
dec dword [esp + 4]
sar word [esp + 6], 0xce
add bp, ax
mov word [esi], bp
push 0x460819be
call fcn.008d21b4

Function at 0x7c4f91
Capabilities:
Encode data using base64

Disassembly:
call fcn.00829627
mov edi, 0xdc3ed7a9
mov esp, ebp
mov edx, edi
pop esi
popfd
mov ebx, edx
call fcn.007fdd42
xor dword [esp + 6], edx
xor bl, cl
mov dword [esp], edx
imul edx, edx
pop edx
lea ecx, [esp + ecx + 8]
movzx dx, byte [ecx]
inc byte [esp + 3]
sbb esi, 1
call fcn.00849c59
jmp 0x7c4f8c

Function at 0x82649f
Capabilities:
Encode data using base64

Disassembly:
jmp 0x95cc12
sub esi, 4
call fcn.009274ac

Function at 0x832b00
Capabilities:
Encode data using base64

Disassembly:
adc esi, 6
mov word ss:[ecx], ax
call fcn.008d0768
push ebx
push esi
shr si, 0xa7
xchg si, si
test dl, 0xa5
push edi
mov edi, 1
adc esi, esi
mov esi, edi
shl esi, cl
not cx
inc ch
sbb ecx, 0xafad9c06
mov ecx, dword [eax + 4]
cmp edi, esp
test sp, 0x1ad
sub ebx, ebx
test si, sp
cmp cl, 2
mov dword [ebp - 0x20], edx
sub esi, edi
jmp 0x8d3360
mov dword [ebp - 0x44], esi
btr esi, eax
mov esi, edi
cmp esp, ecx
stc
clc
shl esi, cl
mov ecx, dword [ebp + 0xc]
stc
clc
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], bl
test di, 0xaa01
test esi, esi
sub esi, edi
cmp ebp, 0xf591fdaf
mov dword [ebp - 0x48], esi
btc si, 6
mov esi, 0xe0be9e37
mov esi, dword [eax]
mov dword [ecx], ebx
xor ch, cl
bswap cx
mov ecx, dword [ebp + 0x14]
jmp 0x90a3ca
mov dword [ecx], ebx
sal cx, 0x1b
bsf cx, dx
mov ecx, dword [eax + 4]
and al, cl
rol ax, cl
shr al, 0x31
lea ecx, [ecx + esi]
shrd ax, dx, 0x8d
mov eax, 0x300
stc
cmp esi, 0xcd19d815
shl eax, cl
mov dword [ebp - 0x3c], esi
test ecx, ebx
mov dword [ebp - 0x14], ebx
cmp cx, 0x5d02
clc
mov dword [ebp - 0x10], edi
add eax, 0x736
jmp 0x9411ed
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edi
jmp 0x89520f

Function at 0x858e34
Capabilities:
Encode data using base64

Disassembly:
xor cx, 0xcc30
push 0xbd0c7f8d
ror word [esp + 0x10], 0x61
xor bx, cx
jmp 0x9d54da
mov dword [ebp - 4], eax
push 0x520e5e18
jbe 0x876ff6
test ebx, ebx
lea esp, [esp + 0xc]
je 0x87e094
mov eax, dword [ebp + ebx*4]
jmp 0x9a8cd7
mov eax, 0x72b21924
lea eax, [eax + eax - 0x446ec76f]
push eax
mov eax, dword [ebp]
call fcn.00941e5f
push 0x48afc235
call fcn.00863d82
sar word [esp], 0x61
inc eax
not dh
inc esp
and cl, dh
not byte [esp + 0xe]
call fcn.008c0993
jmp 0x7ec1da
push 0xb3206b84
mov dword [esp], eax
dec ebx
push 0x993feb0e
call fcn.0087e085
jmp 0x9ca9ba
mov dword [esi], ecx
push 0x5eb45e90
call fcn.009c5f69
ret 0xcd7c
mov edx, 0xad3de2a5
mov edx, dword [esi]
mov ecx, dword [edx]
jmp 0x9b453a
sub ebp, 2
call fcn.00872282
xchg esp, eax
inc esi
invalid
Function at 0x8762f3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [ecx], al
call 0xceede8
movzx dx, byte [ebp]
mov ecx, 0x9488d587
sub ecx, 0xde819caf
mov cl, byte [ebp + 2]
js 0x8b0e5d
jb 0x8c2b01
push esi
xor eax, ebp
btc esi, 0x8c
movzx esi, cl
bsf ax, si
cmp esp, edx
mov eax, 0x6c16c16d
add dl, 0x38
mul esi
bt eax, edx
rcl ah, cl
mov eax, esi
mov esi, edx
shld esi, edx, 0x99
sub eax, edx
shr eax, 1
sub si, bp
adc esi, edx
rcr esi, 0xb5
add eax, edx
shld si, si, 0xa4
cmova esi, edi
shr eax, 5
movzx eax, al
or edx, eax
bswap si
mov edx, eax
pop esi
adc ebp, 1
call fcn.009317e8

Function at 0x87e9a6
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x2d3d52b9
add esi, 2
jmp 0xceee9c
mov word [esi], cx
jmp 0x8f4483

Function at 0x87eaec
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not edi
push 0x84b1eb02
mov dword [esp + 2], 0x1e0d1a0a
mov dword [ebp], edi
pop esi
push 0xc787c887
jmp 0x7e4783
mov esi, dword [esi*4 + 0x95703c]
push 0x4993f789
jno 0x925493
mov dword [esp + 4], 0xb8a0a438
shr edi, 8
xor edi, esi
rol dword [esp + 1], 0x2b
setb byte [esp + 5]
inc eax
ror word [esp + 8], 1
xor edi, 0x94b7ecbd
dec edx
lea esp, [esp + 0xc]
jne 0x8d3ec3
mov esi, 0xe60e71b0
jmp 0x801bda
mov esi, 0xc3d122e
not esi
movzx esi, byte [eax]
call fcn.00941847
mov eax, dword [ebp]
jmp 0x9c7dca
pop esi
pop esi
push 0x9800193f
push 0x6b4c72f
lea esp, [esp + 8]
jmp fcn.0085bc24
rol cl, 1
add al, dh
or eax, 0x38ba64a6
neg cl
imul eax, edx
sbb cl, 0x80
and edx, eax
xor cl, 0x98
jmp 0xce7eac
test ebx, ebx
lea esp, [esp + 4]
je 0x8d7776
mov eax, 0x14a2a88a
mov eax, dword [ebp + ebx*4]
push 0x2eb83123
mov dword [esp], eax
call fcn.008d7761
sub byte [ebx - 0xd], ch
jl 0x933b20
ret 0x46b3
retf 0xee2b
mov ebp, dword [ebp - 4]
push esi
mov dword [ebp], eax
pop ebx
bswap ebx
pop ebx
push esi
jmp 0x9058ab
call eax
mov esi, 0xfc326e9b
jmp 0x95661c
lea edx, [edx - 0x5e5e0bfc]
btc eax, eax
neg cl
xor bl, cl
rol edx, 0x5c
shl eax, 0x12
sar al, 0xa4
push esi
lea eax, [edx*2 + 0x896c9d]
btr ax, ax
push ebx
push edx
lea ebx, [edx + edx*8 - 0x22d438ce]
and bl, dh
mov ebx, ecx
shl eax, 0xfb
lea eax, [edx + eax*4 + 0x4c2eec10]
rol al, 0x81
mov edx, ebx
pop eax
shl edx, 2
inc ax
rol eax, 0x36
rol al, 0x46
mov eax, ebp
push 0x51cb2a7
add eax, edx
rol byte [esp + 1], 0xa1
mov dword [ebp - 4], eax
inc word [esp + 2]
jbe 0x933aad
clc
stc

Function at 0x8992bd
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x18]
je 0x9725eb

Function at 0x8a34f1
Capabilities:
Encode data using base64

Disassembly:
shr dword [esp + 4], 0xea
jae 0x8bd0e3
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
jmp fcn.009c25d7
Function at 0x8a6338
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4d383a37
mov eax, dword [ebp + ecx - 0x4d383a37]
lea ebp, [ebp + ecx - 0x4d383a33]
xchg ebp, eax
mov esi, eax
movzx edi, cx
dec cx
add ecx, 0x5482dca4
pop edx
jnp 0x834022
mov ecx, 0xb617c40a
imul ecx, ecx
mov eax, dword [esi + ecx*4 - 0x1fad4190]
or ecx, 0x7108412e
imul cx, cx
add ecx, ecx
mov cl, byte [esi + 4]
adc esi, 2
push 0x40a326a3
rol dword [esp], 0xd2
shr eax, cl
push 0x75b89f23
call fcn.009c44e6
and eax, 0x63bfe237
cwde
sbb dword [esi], 0x63
cmp byte [esi + edx*4 + 7], 0x7e
mov esi, 0x5e27b6d9
invalid

Function at 0x8afa97
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x9e80f311
ja 0x9619be
adc esi, 6
push 0x6f0a4125
push 0x6e191488
push 0x16114981
mov word [ebp], cx
jmp 0x90527c

Function at 0x8bbf8e
Capabilities:
Encode data using base64

Disassembly:
add edi, 1
dec word [esp + 4]
xor cl, bl
ror dword [esp + 4], 0x2d
inc cl
mov dword [esp], 0x198294a8
shl dword [esp + 1], 0xf7
ror cl, 1
not cl
add dword [esp + 3], 0xbb8c001d
js 0x8bbf81
add byte [edx], ch
xchg esp, eax
invalid
mov edx, dword [edi + 4]
btc cx, 0xbd
bt ecx, ecx
sal ecx, 0xf3
xor cl, byte [edi + ecx*2 - 0x26affff8]
call fcn.00888d41
mov edx, dword [edi]
push 0x1612412c
not byte [esp + 3]
add edi, 4
xor edx, ebx
rol dword [esp], 0x65
jb 0x98e22a
invalid
dec cl
neg dword [esp + 4]
xor bl, cl
call fcn.008e1988
mov eax, 0x9d8d4205
lea ecx, [eax + eax*8 + 0x4296703e]
mov eax, dword [edi]
lea edx, [ecx + ecx - 0x5f887cb]
add edx, 0x5992d1ad
jl 0x84b8c0
jmp 0x80b980

Function at 0x8c272a
Capabilities:
Encode data using base64

Disassembly:
inc cl
dec al
xchg dword [esp + eax - 0x8cff], eax
and dword [esp + eax - 0x8c00], eax
xor cl, 0xbe
xor bl, cl
cbw
and byte [esp + eax + 3], ah
rol ax, 0xc8
lea ecx, [esp + ecx + 4]
cbw
xor ax, word [ecx + eax*2]
not word [esp]
sar word [esp], 0xeb
call fcn.00ce6763
call 0x9b676f
ror byte [esp + 1], 2
setb byte [esp + 4]
not si
push 0x30208299
neg dword [esp + 8]
inc si
call fcn.0083ad87
mov ecx, 0xda8d518d
movsx eax, cl
add cx, ax
movzx ecx, byte [esi]
dec eax
shl eax, 0xa2
sal eax, 0x55
adc esi, 0
ror al, 0x25
xor cl, bl
push eax
or byte [esp + 1], 0x90
inc cl
btc ax, 0x3a
sub dword [esp], eax
rol cl, 1
cwde
or eax, dword [esp + eax - 0x400]
jne 0x8c1bf9
mov dword [esp], 0x339a0897
dec dx
push 0x4014c23e
not word [esp + 2]
mov dword [esp + 8], 0xd9a5c912
ror dx, 1
push 0x5802533e
dec dword [esp + 0xd]
push 0xa7bc151f
xor bx, dx
sal byte [esp + 4], 0x47
sbb ebp, 1
not dword [esp + 5]
mov word [ebp], dx
jmp 0x8c2707

Function at 0x910e58
Capabilities:
Encode data using base64

Disassembly:
dec dword [esp + 0xc]
xor bl, cl
call fcn.0091628b
jmp 0x8f1f0e
Function at 0x925460
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
ror al, 1
call 0x8aa0dc
dec ebp
mov ebp, dword [edx]
jmp 0x94390d
push 0xee8d2011
add edi, 8
mov dword [esi], edx
lea esp, [esp + 4]
jmp fcn.0089e9d6
not al
call fcn.007fed79
mov eax, 0x5e21d7af
movzx ecx, byte [esi + eax - 0x5e21d7af]
sal al, 0x26
lea esi, [esi + eax - 0x5e21d7bf]
lea eax, [eax + eax*2 - 0x35dd9cda]
lea edx, [eax + 0x1fabd081]
shr ax, 0xef
xor cl, bl
dec edx
btc ax, ax
xor al, 0x9f
not cl
inc ecx
mov edi, 0xec867db7
inc ebp
bt edi, edi
dec ebp
mov edi, dword [edx + 8]
jb 0x966b2d
call fcn.009438ea
shl dword [esi - 9], 0xd9
rol cx, 1
push 0x269aef82
add cx, 0x5a80
neg cx
call fcn.0083bc33
jmp 0x925459
add al, byte [eax]
add byte [eax], al
not ax
call fcn.00968f19
fadd dword [edx + 0x37]
ret 0x8630
xchg byte [ebx], ah
push esi
xchg edx, eax
test eax, 0x3b325ff2
popfd
xchg ebx, eax
pop esi
aas
imul eax
scasd eax, dword es:[edi]
into
out 0xc6, eax
js 0x966a78
jae 0x966a4a
or cl, byte [ecx + 0x3f0a5fba]
lea esp, [edi - 0xa]
push eax
into
aaa
mov bh, 9
sub ebp, dword [eax + 0x6c1aa71b]
ja 0x966a89
mov byte [0xc41921bd], al
insd dword es:[edi], dx
pop es
xchg esi, eax
cdq
adc byte [ecx + ebx*8], ch
out 0x3b, al
xchg edx, eax
clc
cmp al, 0x95
fsub qword [ebx]
loope 0x966b27
and ebx, dword [ecx + eax*4 + 0x27]
or dword [edx + 0x6daa76ff], 0x2f0c27b9
fnstenv [esi]
dec esi
dec esi
push ss
xchg dword [esi - 0x15c86b4d], ebp
aaa
fnstcw word [edi + 0x27b96daa]
mov edi, 0x9bd55333
scasb al, byte es:[edi]
invalid
add dword [edx - 0x4dd84693], ebp
ja 0x966b0f
imul eax, dword [ecx - 0x27b96dab], 0xc1cf7b02
loope 0x966a9a
inc esi
fadd dword [edx]
jnp 0x966adc
shl ecx, 0x8a
mov al, byte [eax + 0x14]
sal dword es:[edi - 0x5b], 1
inc eax
adc al, 0x26
sal dword [edi - 0x5b], 1
test eax, 0xeeda903c
jno 0x966afc
iretd
fdivr dword [eax + 0x6e]
outsb dx, byte [esi]
jbe 0x966b29
push edi
jb 0x955d0e
mov esi, 0x47b60e83
inc esi
mov esi, dword [edi + esi - 0x47b60e84]
mov edx, dword [edi + 4]
jne 0x9078fa
sbb ecx, ecx
add dword [edx], ecx
inc ecx
xchg esp, eax
rcl esp, 1
jbe 0x966b8f
int 0x14
mov ah, 0x37
add al, 0x11
adc al, 0x2d
wait
imul esi, eax, 0xd1bad15d
jl 0x966b75
cmp al, 0x86
cmp al, 0x9d
cmp al, 0xb4
jecxz 0x966b08
mov ch, 0xa4
out dx, al
pop esp
jns 0x966b8c
cld
sub ebx, dword [edx + 0x72]
imul dword [edx + 0x33]
jb 0x966b6e
push 0x33
in eax, 0xaf
inc edi
aad 0xa2
or esp, dword [eax - 0x3c]
inc ecx
push esi
cmp byte [edi - 0x600ba2d6], bh
mov edi, 0x9ff45d2a
fcomp qword [0x64c6421f]
inc edx
invalid
pop eax
sub dword [ecx - 0x39bbf8ff], esi
cwde
test al, 0x31
mov eax, dword [0x9638a7bd]
and byte [eax], bl
sti
pop ecx
lahf
xchg edi, eax
jle 0x966b84
bound ebx, qword [eax + 0x7f]
leave
invalid

Function at 0x931351
Capabilities:
Encode data using base64

Disassembly:
mov byte [edx], cl
lea esp, [esp + 0x1c]
jnp fcn.007c3b59
cmp bp, si
Function at 0x932cd2
Capabilities:
Encode data using base64

Disassembly:
call fcn.008be19c
je 0x932cbb
jl 0x9b42ab
jmp 0x9a511b
push 0x46805980
sal dword [esp], 0xea
adc ebp, 2
jmp 0x930c6c
inc ecx
rol cl, 1
inc ecx
mov esp, 0xdf823417
inc cx
neg esp
dec esi
lea esp, [0x53b48393]
inc ecx
inc cl
inc ecx
push esp
inc ecx
neg cl
inc esp
mov dword [esp + 0x12], esp
dec ebp
bts esp, esp
inc ecx
inc cl
inc bp
btc esp, esp
inc ecx
xor cl, 0x39
dec esp
mov dword [esp + 8], esp
neg byte [esp + 0x14]
inc ecx
xor bh, cl
inc ecx
ror ah, 0xc5
jae 0x7cafa5
inc eax
xor dl, bh
sar ebp, 0xfd
ror ebp, 0x27
dec eax
rol ebp, 0xef
rol dl, 1
inc eax
sub dl, ch
inc eax
dec ch
neg dl
or bp, bp
inc dl
btr ebp, ebp
inc eax
add ch, ch
xor dl, 0x39
inc eax
xor bh, dl
xor bp, 0x3c13
dec eax
adc edx, esp
not bp
inc eax
add ch, ch
dec eax
mov ebp, dword [edx + ebp*8 - 0x5f900]
dec ecx
sbb edx, 8
push 0xb0b7373f
dec ecx
mov dword [edx], ebp
push 0x66242cb2
call fcn.0083ef81
xor al, bl
jmp 0x8585a2
neg byte [esp + 4]
push 0xf272021
adc al, 0xff
ror byte [esp + 8], 0x47
neg word [esp + 9]
shr dword [esp + 6], 0xc7
not al
dec al
shl dword [esp + 2], 0xd1
jb 0x7ea2e6
rol al, 1
neg al
mov word [eax], cx
jmp 0x9d8a79
mov word [ebp], cx
lea esp, [esp + 4]
jmp fcn.0084f821
mov edx, dword [esi + edx*2 - 0x7edc3ace]
adc esi, 3
push 0xbd05e00c
call fcn.008a925e
mov eax, 0x1b09809f
movzx ecx, ax
rol ecx, 0xc2
mov eax, dword [eax + ebp - 0x1b09809f]
adc ecx, 0x2495fc30
mov cx, word ss:[ecx + eax - 0x2497feac]
ja 0x8024c3
shl dword [esp], 0x15
adc esi, 3
call fcn.009c82c0
mov eax, 0x97939abe
mov edi, dword [ebp]
mov ax, word ss:[edi]
call fcn.009accc7
lea esp, [esp + 0xc]
jl fcn.00834040
jmp 0x8df2c9
lea esp, [esp + 8]
jmp fcn.0094679c

Function at 0x937107
Capabilities:
Encode data using base64

Disassembly:
rol dword [esp + 0xc], 5
lea ecx, [esp + ecx + 0x10]
mov dword [ecx], edx
push 0xbb164bbc
lea esp, [esp + 0x14]
jb fcn.0094679c

Function at 0x96e65e
Capabilities:
Encode data using base64

Disassembly:
call fcn.00865c85
jnp 0x8b66d9
shl dl, cl
call fcn.007e174b
adc esi, 1
jmp 0x88573a
dec ecx
sbb edx, 4
push 0xefafddae
call fcn.0091a80f
push esi
pushfd
mov esi, 0xf7bfc31b
or si, 0x7617
mov esi, dword [esp + esi*8 + 0x4200470c]
mov dword [esp + 4], 0x3cf48ae3
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00ce9919
xor dl, bl
mov dword [esp], 0xfc18c297
push 0x7ab3dd01
neg dl
rol word [esp], 0x23
jae 0x7fca98
inc ecx
mov esp, 0xdcacff1a
inc ecx
ror ah, 0x67
inc ecx
sub esp, 0xb392c424
dec ebp
mov esp, edx
jg 0x8dc72e
Function at 0x98a21e
Capabilities:
Encode data using base64

Disassembly:
adc esi, 2
mov dword [esp], 0x7b39e2bb
jmp 0x9b8b7a

Function at 0x998daa
Capabilities:
Encode data using base64

Disassembly:
push 0x1a8edfb3
mov edi, dword [esp + 6]
inc esp
xor dword [esp + edi - 0x7c0dffe8], ebp
mov dword [esp + edi - 0x7c0dfff1], edi
dec eax
mov edi, dword [esp + edi - 0x7c0dffe8]
ror word [esp + 8], 0xa8
call fcn.009aef58
inc ecx
xor ebp, 0x9e85f39e
inc ecx
rol ebp, 3
dec eax
mov dword [esp], 0x90337c0e
inc ecx
sub ebp, 0xea3485a8
shr word [esp + 0x12], 0x2a
ror byte [esp + 3], 0x82
inc ecx
bswap ebp
ja 0xcf03d9
dec eax
mov dword [esp + 0x10], edi
jne 0x8627ad

Function at 0x99c118
Capabilities:
Encode data using base64

Disassembly:
xor dl, bl
sub edi, edi
rol dl, 1
push edi
bt di, 0xb1
inc dl
xor dl, 8
add word [esp + edi + 1], 0xaf08
not dl
btc edi, 0x23
inc edi
inc word [esp + edi*8 - 0x46]
neg dl
not word [esp + edi - 9]
shr edi, 0x59
lea edi, [edi*2 - 0x79d1fac1]
sbb dl, 0x38
shr dword [esp], 0xd7
xor bl, dl
lea edx, [esp + edx + 4]
mov di, word [edx]
inc dword [esp]
call fcn.007b39c6
jns 0x980119
mov edi, 0x5834771b
and di, 0x51a
bswap edi
lea ebp, [ebp + edi*4 - 0x6814d161]
movzx edx, di
movzx edx, byte [edi + ebp - 0x1a053458]
adc edi, edi
jns 0x7e13e9
adc ebp, 3
call fcn.009cf040
lea esp, [esp + 0x18]
jmp fcn.008719b6
mov eax, dword [ebp + eax - 0x5b1b3772]
mov esi, dword [ebp + esi - 0x5b1b376e]
jns 0x90f155

Function at 0x9ab570
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0xc040fba9
lea esp, [esp + 4]
call fcn.0095b761

Function at 0x9afe2f
Capabilities:
Encode data using base64

Disassembly:
not al
push 0xe0b7d1b6
call fcn.00ce7477
Function at 0x10011349
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10011358
pop dword [ebp - 0x50]
mov eax, 0x10011358
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x447d2
push 0
mov eax, 0xd62dd7c1
add eax, 0x39d5199b
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x58cd
xor edx, edx
add edx, eax
mov ebx, 0x9b32df25
add ebx, 0x74d1ccdb
add ebx, dword [ebp - 0x50]
mov edi, 0xdfd89ca5
mov dword [ebp - 0xc], 0x872ab7b2
mov esi, dword [ebx]
sub dword [ebp - 0x40], ebx
xor esi, edi
add dword [ebp - 0x24], esi
mov dword [edx], esi
sub dword [ebp - 0x24], eax
add edx, 4
add ebx, 4
loop 0x100113a8
add eax, 0x15607
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10004810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000481f
pop dword [ebp - 0x1c]
mov eax, 0x1000481f
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3a0ff
push 0
mov eax, 0xaf7a3a
sub eax, 0xf0ace92e
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x2b4ac887
add ecx, 0xd4b57ce4
mov edx, eax
mov ebx, 0x49573026
add ebx, 0xc6ad3bda
add ebx, dword [ebp - 0x1c]
mov esi, 0x897ae241
sub esi, 0x2cd70eee
sub dword [ebp - 0xc], 0x1a173c04
mov edi, dword [ebx]
xor edi, esi
xor dword [ebp - 0xc], 0xe480a474
mov dword [edx], edi
xor dword [ebp - 8], edi
add edx, 0x5f35d4ec
add edx, 0xa0ca2b18
add ebx, 4
loop 0x10004879
add eax, 0x1087f
xor ebx, ebx
add ebx, eax
add eax, 0xe06d28ce
sub eax, 0xe06d28c9
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x10004c30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
xor ecx, ecx
xor edx, edx
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov cl, byte [esi + 0x100]
mov dl, byte [esi + 0x101]
test ebp, ebp
je 0x10004c7f
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x10004c54
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x10004c91
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov eax, 0x3020100
push esi
mov ecx, 0x40
mov esi, dword [esp + 0xc]
push edi
mov edx, esi
push ebp
mov dword [edx], eax
add edx, 4
add eax, 0x4040404
dec ecx
jne 0x10004ca5
xor ecx, ecx
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov byte [esi + 0x100], cl
mov byte [esi + 0x101], cl
xor ebx, ebx
xor edx, edx
xor eax, eax
mov dl, byte [edi + esi]
mov al, byte [ebp + ecx]
add bl, al
inc ecx
add bl, dl
inc edi
mov al, byte [ebx + esi]
mov byte [edi + esi - 1], al
cmp dword [esp + 0x18], ecx
mov byte [ebx + esi], dl
jne 0x10004ceb
xor ecx, ecx
cmp edi, 0x100
jb 0x10004cc8
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x100055ec
jle 0x100055e7
cmp eax, 3
jg 0x100055e7
push esi
mov esi, dword [ecx]
test esi, esi
je 0x100055de
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
sub ecx, eax
push edi
sub edx, eax
mov edi, dword [ecx + eax]
mov ebx, dword [eax]
xor edi, ebx
mov dword [edx + eax], edi
add eax, 4
dec esi
jne 0x100055cc
pop edi
pop ebx
mov eax, 1
pop esi
ret 0x10
xor eax, eax
ret 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call fcn.10004810
mov eax, 1
ret 0x10
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40596d
pop dword [ebp - 0x1c]
mov eax, 0x12c45671
add eax, 0xed7c02fc
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xcf733f74
add dword [ebp - 0x2c], 0x7edf05d7
mov dword [ebp - 0x28], 0x32e269da
add dword [ebp - 0x28], 0xff50e26b
mov dword [ebp - 0x24], 0xf4552fd1
sub dword [ebp - 0x24], 0xa808eba3
mov dword [ebp - 0x20], 0x150825af
add dword [ebp - 0x20], 0xeaf7da51
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x44732e2d
add dword [ebp - 0x2c], 0x2fff3b29
mov dword [ebp - 0x28], 0x9fb51ac8
sub dword [ebp - 0x28], 0x5e48b953
mov dword [ebp - 0x24], 0xaa0f247d
add dword [ebp - 0x24], 0xb96047ef
mov dword [ebp - 0x20], 0x949bf249
add dword [ebp - 0x20], 0x6b640db7
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xc7132b38
sub eax, 0xc6d2ba38
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3740b
push 0
call eax
mov ecx, 0x477a22b2
add ecx, 0xb8862773
mov ebx, eax
mov edx, 0x1c02413a
sub edx, 0x1bc1413a
add edx, dword [ebp - 0x1c]
mov edi, 0x7592e15b
add edi, 0x790698bc
mov dword [ebp - 8], 0x5c6591e1
mov esi, dword [edx]
xor dword [ebp - 0x18], 0x9495a87d
add esi, edi
xor dword [ebp - 0x14], 0xac069fcb
mov dword [ebx], esi
xor dword [ebp - 0x18], esi
add ebx, 0x97973ab7
add ebx, 0x6868c54d
add edx, 4
loop 0x405a8a
add eax, 0x6cfd3f6b
add eax, 0x9303dbfc
xor ebx, ebx
add ebx, eax
add eax, 0x705a2ec1
add eax, 0x8fa5d144
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40560d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40561c
pop dword [ebp - 0xc]
mov eax, 0x3bb0b652
sub eax, 0x3b706036
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x24cfc6f6
sub dword [ebp - 0x1c], 0xd67d81ab
mov dword [ebp - 0x18], 0xf52bd6a6
sub dword [ebp - 0x18], 0xc2f88a61
mov dword [ebp - 0x14], 0x1711c053
add dword [ebp - 0x14], 0x353a83db
mov dword [ebp - 0x10], 0x5ce0db16
add dword [ebp - 0x10], 0xa31f24ea
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x9e0c953
sub dword [ebp - 0x1c], 0x956e5ffd
mov dword [ebp - 0x18], 0x20f8a961
sub dword [ebp - 0x18], 0xdf8c47ec
mov dword [ebp - 0x14], 0xfd695c31
add dword [ebp - 0x14], 0x6606103b
mov dword [ebp - 0x10], 0x691ffb55
add dword [ebp - 0x10], 0x96e004ab
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xde9b1b4c
sub eax, 0xde5a4b00
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3c533
push 0
call eax
mov ecx, 0x5339
mov edi, eax
mov ebx, 0x7acf61a2
add ebx, 0x85724e5e
add ebx, dword [ebp - 0xc]
mov esi, 0x32bde72f
sub esi, 0xc2795b02
sub dword [ebp - 8], eax
mov edx, dword [ebx]
sub dword [ebp - 4], 0xca8ea41e
xor edx, esi
sub dword [ebp - 8], 0xfff21df2
mov dword [edi], edx
add dword [ebp - 8], 0xe71134bb
add edi, 0x1539613f
sub edi, 0x1539613b
add ebx, 0xed273963
add ebx, 0x12d8c6a1
loop 0x405733
add eax, 0x9534e98a
add eax, 0x6acc562d
mov ebx, eax
add eax, 0x59577105
sub eax, 0x59577100
mov ecx, 0x5a5b758f
add ecx, 0xa5e48a71
invalid
invalid
hlt
invalid
invalid