joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e7a9920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1e7a95bf
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9574
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a95bf
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9574
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a95bf
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9574
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a95af
sar dword [edx - 0x627703b5], 1
jl 0x1e7a9a34
invalid
invalid

Function at 0x1e7a9c10
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1e7a9c63
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1e7a9c5e
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1e7a9c48
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp sym.pywintypes27.dll_void___cdecl_PyWin_MakePendingCalls_void_
cmp edx, ebx
jne 0x1e7a9d9e
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1e7a9c1f
add eax, dword [eax + 4]
jmp 0x1e7a9c0c
mov dword [ebp + 0xc], ebx
jmp 0x1e7a9c6e
Function at 0x1e7a9c50
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1e7a9c63
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1e7a9c5e
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1e7a9c48
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp sym.pywintypes27.dll_void___cdecl_PyWin_MakePendingCalls_void_
cmp edx, ebx
jne 0x1e7a9d9e
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1e7a9c1f
add eax, dword [eax + 4]
jmp 0x1e7a9c0c
mov dword [ebp + 0xc], ebx
jmp 0x1e7a9c6e

Function at 0x1e7a9dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
test dword [edi + 0x40fffffc], esi

Function at 0x1e7a9e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + 0x40fffffc], esi
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
invalid
invalid
invalid
cld
invalid

Function at 0x1e7a9e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax - 0x3a]
test dword [esp + edi*8 - 0x39bb0001], edi
test dword [ebp + 0x55fffffc], edi
lcall 0xfffa, 0xcca5804b
inc dword [eax]
and byte [ebp - 0x533], 0
inc dword [eax]
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
invalid
invalid
sti

Function at 0x1e7aa4b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1e7a958d
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
invalid
invalid
Function at 0x401a22
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b70d0]
jne 0x401a2c
repz ret
jmp fcn.004028c6

Function at 0x40f8a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040344a
and dword [ebp - 4], 0
cmp dword [0x4c0100], 0
mov ebx, eax
jne 0x40f959
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40fa0a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40fa0a
push eax
call fcn.004033d8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4c0100], eax
call esi
push eax
call fcn.004033d8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4c0104], eax
call esi
push eax
call fcn.004033d8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4c0108], eax
call esi
push eax
call fcn.004033d8
pop ecx
mov dword [0x4c0110], eax
test eax, eax
je 0x40f959
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004033d8
pop ecx
mov dword [0x4c010c], eax
mov eax, dword [0x4c010c]
cmp eax, ebx
je 0x40f9b1
cmp dword [0x4c0110], ebx
je 0x40f9b1
push eax
call fcn.00403453
push dword [0x4c0110]
mov esi, eax
call fcn.00403453
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f9b1
test edi, edi
je 0x40f9b1
call esi
test eax, eax
je 0x40f9a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f9a8
test byte [ebp - 0xc], 1
jne 0x40f9b1
or dword [ebp + 0x10], 0x200000
jmp 0x40f9ea
mov eax, dword [0x4c0104]
cmp eax, ebx
je 0x40f9ea
push eax
call fcn.00403453
pop ecx
test eax, eax
je 0x40f9ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f9ea
mov eax, dword [0x4c0108]
cmp eax, ebx
je 0x40f9ea
push eax
call fcn.00403453
pop ecx
test eax, eax
je 0x40f9ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c0100]
call fcn.00403453
pop ecx
test eax, eax
je 0x40fa0a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40fa0c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b2501
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [0x4c05ac]
push esi
push dword [eax]
mov esi, dword [0x4c04f4]
call fcn.004b2438
cmp dword [0x4c05ac], 0x2f
pop ecx
jne 0x4b2560
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 8], edi
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
pop edi
push esi
call fcn.004b247a
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x4b2892
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, 0x13ba1f
xor esi, esi
cmp dword [0x4c05ac], 0xbf9
jne 0x4b28ad
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
cmp dword [0x4c05ac], 0x3dc
mov dword [0x4c05a0], 0x8e55ceaa
jne 0x4b28dc
push esi
push 0x4b5878
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.xafecelocixupapedahesofunezodicexegenogexepumawojuyagon
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
dec edi
jne 0x4b289b
cmp esi, 0x8465cb
jne 0x4b28f6
mov eax, dword [0x4bf564]
add eax, 0xa231
mov dword [0x4c05ac], eax
cmp dword [0x4c05ac], 0x141
jne 0x4b2913
or dword [0x4c0274], 0xffffffff
mov dword [0x4c0270], 0xec58acac
inc esi
cmp esi, 0x123c19c
jl 0x4b28df
call fcn.004b256b
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x80039fd
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043a0], 0x30
mov dword [0x80043a8], 0x80032e8
mov dword [0x80043a4], 2
mov dword [0x80043ac], 0
mov dword [0x80043b0], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003a40
mov dword [0x80043b4], eax
mov dword [0x80043c8], 0x80041d4
mov dword [0x80043c0], 0xf
mov dword [0x80040f6], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043b8], eax
mov dword [0x80043cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040fe], ebp
mov dword [0x80043bc], eax
push 0x80043a0
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004420], eax
push 0
push dword [0x80040f6]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004418], eax
push 1
push dword [0x8004418]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004418]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003afe
xor edi, edi
lea ebx, [0x80043d0]
jmp 0x8003b16
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003b08
jmp 0x8003b2a
mov eax, dword [0x80043d8]
call 0x80029cd
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x871eb4
Capabilities:
Encode data using xor

Disassembly:
xor edi, edi
test eax, eax
lea esp, [esp + 8]
je 0x871f08
push esi
movzx esi, byte [edx]
push 0xa92eeb8c
xor esi, edi
and esi, 0xff
mov esi, dword [esi*4 + 0xcf3f50]
shr edi, 8
xor edi, esi
inc edx
xor edi, 0x583b5905
sal dword [esp], 0x98
dec eax
lea esp, [esp + 4]
jne 0x871ec3
mov esi, 0x73158d0a
push esi
bswap esi
mov esi, dword [esp + esi - 0xa8d156f]
lea esp, [esp + 8]
jmp 0xbc202a
jmp 0xcabb3c
not edi
mov dword [ebp], edi
call fcn.00c4b4f6
pop eax
arpl word [ebp + 0x20], cx
loopne 0xcabbc8
jg 0xcabb76
adc dword [esi], ecx
sbb eax, 0x8a83b390
xchg ebp, eax
adc bh, dl
add dword [esi + 0x18a7cd5f], esi
mov esi, 0x664c6b92
sbb byte [esi + 0x664c6b92], bh
imul ecx, dword [esi - 0x11], 0x7a
dec edi
out dx, eax
jp 0xcabbb6
cmpsd dword [esi], dword es:[edi]
mov esi, 0x6aa1e871
and eax, dword [ecx - 0x75]
lahf
push 0xfffffffffffffff5
jg 0xcabb5e
xchg esi, eax
out dx, eax
and eax, 0x9ede27bf
or byte [ecx + 0x6a], al
aas
dec edx
scasd eax, dword es:[edi]
or dword [edx + 0x1b82d6d6], eax
dec esp
jg 0xcabb61
cmp ah, dl
xor byte [ecx - 0x19e61485], 0x64
sub al, 9
sub eax, ebp
sub dword [ebx + 0x2f6e5ebe], esi
aas
int1
or esp, esi
dec edi
enter 0x56e2, 0xffffffffffffffa6
jge 0xcabc01
rcr byte [edx - 0x40f34952], 1
pop es
je 0xcabbaf
mov edi, 0xaffc7407
scasd eax, dword es:[edi]
popfd
leave
add dword [ebp + 0x74ebe16a], 0x42c4dea2
sal esp, 0xd
salc
mov ah, 0x32
xchg ecx, eax
movsd dword es:[edi], dword [esi]
frstor dword [edi - 0x64]
nop
sub eax, 0xbda1e808
cmpsb byte [esi], byte es:[edi]
das
adc eax, 0xa3c44e8c
mov ch, 0xe5
shr dword [ecx - 0x925a32d], cl
cmpsd dword [esi], dword es:[edi]
je 0xcabc2f
fistp word [edx - 0x4569c0f1]
cmpsb byte [esi], byte es:[edi]
fsub st(6), st(0)
mov bh, 0xac
fcom st(3)
imul edi, dword [eax], 0x9d8b80e0
aaa
push esi
mov esi, 0xde3e044b
clc
test dword [ecx], esi
ret

Function at 0x8b14ae
Capabilities:
Encode data using xor

Disassembly:
mov dword [ecx], eax
push 0x78366927
lea esp, [esp + 0x10]
jp fcn.00de12e0
sbb edx, dword [eax]
push eax
mov ch, dh
pushfd
stc
sub al, 0xa3
and eax, 0x9349a3d5
push ebx
pop edx
jbe 0x8b1522
cwde
leave
push ecx
mov ebx, 0xb5e066
invalid
lds ecx, [ebx + 0x19]
retf 0x3f2d

Function at 0x8b6c89
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x5a061f39
add esi, 1
pop edx
xor edx, edx
xor al, bl
or dx, 0xe484
not edx
sbb al, 0xba
neg al
xchg dh, dl
add al, 0xb1
rol al, 1
rol dl, 0x84
shr dx, 6
not al
xor edx, edx
inc al
jmp 0xba97ec
push 0x1d802997
mov eax, dword [ebp]
lea esp, [esp + 4]
call eax
push 0xb7282834
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov ebx, dword [esp]
call fcn.00cd7480
or dl, dl
xor al, dl
inc al
jmp 0xc7ebab
jmp 0xba4331
mov eax, ebp
push 0xa19e78af
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0xc00198
mov eax, dword [ebp + ebx*4]
push eax
jmp 0xc8f2a1
bswap edx
rol edx, 0xd9
xor bl, al
inc edx
add edx, edx
push esi
sbb edx, edx
push ebx
mov ebx, eax
mov eax, edx
add edx, eax
or edx, ebx
and al, al
dec ax
jb fcn.00be5067
shl edx, 2
shl ax, 0x61
jno 0xc73ad9
dec ebx
jmp 0xcd7cef
call 0xc0018e
Function at 0xbbeab6
Capabilities:
Encode data using base64

Disassembly:
ror dl, 1
sal eax, 0xa1
mov dword [esp + ebp], eax
jo 0xde46b0
mov edx, edi
push 0x2e9778ad
push 0x50225c89
sub edi, 4
mov dword [edi], edx
lea esp, [esp + 8]
jmp fcn.00cd17fe
inc ax
adc eax, eax
mov ebx, edx
lea eax, [eax + eax*4 - 0x6d6d96f1]
mov edx, eax
mov edx, ebx
sal edx, 2
not al
sub ax, ax
sal ax, 1
mov eax, ebp
push 0xcabda311
rol word [esp + 1], 0x47
adc eax, edx
mov dword [ebp - 4], eax
jmp 0xcb9bca
rol byte [esp], 0xe3
test ebx, ebx
call fcn.00cd2dd2
xor bl, dl
sar ebp, 0xb4
mov dword [esp + ebp], esi
xor bp, ax
push ebx
lea ebx, [ebp - 0x32d685d3]
mov ebp, edi
jge 0xc634fc

Function at 0xbc004b
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [esp + ebx*2 - 0x44a6a4a0]
lea eax, [eax*2 - 0x7c6374e1]
movsx edi, ax
push edi
mov eax, dword [esp + eax - 0x52f7106b]
mov edx, dword [esp + edi*2 - 0x20ea]
pop edi
call fcn.00c17554
Function at 0xbebc92
Capabilities:
Encode data using base64

Disassembly:
shl edi, 0x2f
lea eax, [ebp + edi - 0x7edc0080]
and eax, 0xfffffffc
sar di, 0xb
sbb eax, ecx
mov esp, eax
jmp 0xcca5b8
dec ecx
sub eax, 2
and dx, dx
dec eax
lea edx, [edx + edx*2 - 0x44b87e9]
inc ecx
movzx edx, word [eax]
xor dx, si
jmp 0xcb0f4e
push 0xe31ac827
lea esp, [esp + 0xc]
ja fcn.00bb0d33
mov edx, 0x2eadb427
or dx, 0xcd90
movzx edi, dx
mov bh, 0xfa
mov edx, esp
inc edi
lea ecx, [edi - 0xfd64]
jne 0xd33b59
mov edx, 0xd43ef798
dec eax
not edx
dec ebp
mov esp, dword [edi]
dec eax
rol edx, 0xa9
dec ecx
add edi, 8
ror dx, 0x4b
ror dx, 0x8f
jb 0xba7fef
mov eax, dword [0x17ecaa91]
shr dword [eax - 0x55358932], 0x5e
mov ebx, ebp
cmpsd dword [esi], dword es:[edi]
arpl ax, bp
push edx
jns 0xbebd68
ljmp 0x61ba:0xca262a84
inc byte [eax + 0x4e]
push ds
invalid
sub al, 0xe6
enter 0x6fd8, 0xffffffffffffffce
jo 0xbebcac
jo 0xbebd02
int1
mov bl, 0x54
pop es
add dword [ebp + ecx*4 + 0x7fee868e], 0xffffff8c
cmp al, 0xca
xchg esi, eax
das
dec ebx
clc
inc edi
xor eax, 0x6e0ccc1c
push ecx
push esp
leave
jns 0xbebda9
call 0x793585b9
sub byte [edx - 0x64], ah
jns 0xbebd71
jmp 0x6260f529
test al, 0x71
out 0xf, eax
jge 0xbebd24
xor edx, ebp
retf
or dl, ch
mov ebp, 0xcab5c362
invalid
imul esp, dword [ebp + 6], 0x4c
invalid
sub eax, 0x3b358b3c
imul ebp, dword [edi], 0x27
xchg edx, eax
out dx, al
mov fs, edi
push ebp
mov edi, 0x33e8c97
sahf
out 0x47, al
inc edi
xor dword [edx + ecx*2 + 0x2c9b2695], esi
cmp bl, byte [ecx + 0x7be220a3]
mov eax, 0x91c1260d
fsubr dword [eax - 0x12d22d86]
pop esp
loop 0xbebd7b
out 0x52, al
lodsd eax, dword [esi]
jno 0xbebd94
out 0xd0, eax
mov dword [0xfd5e93f0], eax
pop esp
scasd eax, dword es:[edi]
out 0x6e, al
dec ebp
sal byte [esi + 0x2a0371c8], cl
xchg edi, eax
inc eax
invalid
dec ecx
sub eax, 1
dec esp
lea ebp, [ebp + ebp*2 - 0x23cd41e2]
inc ebp
movzx ebp, byte [eax]
inc eax
not ch
push ebp
inc eax
not ch
inc esp
xor ch, dh
jmp 0xc18166
pop ebp
inc ecx
inc ch
and ebp, ebp
sbb ebp, ebp
inc ecx
rol ch, 1
jmp 0xc8168b
call fcn.00c5f63b
rol dx, 1
jmp 0xd3fb80
push esi
lea edi, [edi + edi - 0x3b7c4b69]
pushfd
sub di, di
movzx esi, di
xor esi, edx
sub di, di
mov edi, eax
call fcn.00c19120
mov ebp, 0xd6a00486
jmp 0xc01d5d
ja 0x8bbefa
add dx, 0xe79b
push 0x4bbc7da9
xor dx, 0x85ba
ror dx, 1
push 0xf13fb78f
xor si, dx
dec eax
lea edx, [esp + edx + 0x10]
jmp fcn.00c8a3ff

Function at 0xc7067e
Capabilities:
Encode data using base64

Disassembly:
mov dword [eax], edx
ja 0xd35a4c
setb byte [esp + 0xc]
lea esp, [esp + 0x10]
jnp fcn.00cd1d73
pop eax
lea edx, [ebx*8 + 0x690187ac]
pop esi
pop ecx
lea edi, [ebx*4 - 0x33fb5558]
xchg edi, edx
not edi
pop ebx
bswap edx
pop eax
pop edx
pop edi
jmp 0xcc3663

Function at 0xca46e0
Capabilities:
Encode data using xor

Disassembly:
test eax, eax
lea esp, [esp + 8]
je 0xca4724
mov esi, 0xcf1a2d94
movzx esi, byte [ecx]
xor esi, edx
and esi, 0xff
push 0x88a4062b
mov esi, dword [esi*4 + 0xd4e208]
shr edx, 8
xor edx, esi
inc ecx
xor edx, 0x4faaf802
push 0x8203d4b5
dec eax
lea esp, [esp + 8]
jne 0xca46ec
call fcn.00c2b7fa
Function at 0xd38764
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, 0xf60a043e
add esi, 2
sub byte [esp + 5], ch
jo 0x88566a
pop ecx
movzx ecx, byte [ebp]
adc ebp, 1
neg byte [esp]
jne 0xd38750
mov eax, 0x21105aa4
mov ecx, dword [eax + ebp - 0x21105aa4]
shl eax, 0xae
adc al, byte [eax + ecx - 0x16a90000]
call fcn.00873e3f
add al, 0xbb
xor al, 0x3a
neg al
sar dword [esp], 0x90
xor bl, al
lea eax, [esp + eax + 4]
not word [esp]
mov word [eax], bp
lea esp, [esp + 4]
jmp fcn.00cd1d73
jmp 0xdf3474
xor cl, bl
ror cl, 1
add cl, 0xd
neg cl
shl dword [esp], 0xdf
inc cl
call fcn.00c96ab5
mov ecx, 0x7300dda6
mov ecx, dword [edi + ecx - 0x7300dda6]
mov eax, 0x503b56a2
lea edi, [edi + eax - 0x503b569e]
jmp 0xc84881
movsx esi, al
mov ebp, ecx
movzx edx, al
sub ax, dx
jno 0xd491ca
vpsrld xmm4, xmm0, xmmword [eax + 0x6b]
in al, dx
xchg byte [esi], ch
xchg edx, eax
and al, bh
mov ebx, edx
pop ss
pushfd
push ds
push ebp
jae 0xdf3494
inc eax
pop esi
pop ds
cwde
aaa
pop ds
invalid

Function at 0xd5a5f8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
jne 0xc8e457
mov ecx, dword [eax + 0x78]
jmp 0xc269f2
pop esi
jmp 0xc8f8d9
je 0xc8e457
mov esi, dword [ebp + 0xc]
cmc
test esi, esi
jmp 0xc8e43e
mov dword [ebp - 4], ecx
test di, cx
test ecx, ecx
jmp 0xca062a
je 0xc8e457
mov eax, 0x5a4d
cmp si, 0x1688
cmp word [edx], ax
je 0xc9514d
xor eax, eax
xchg si, si
jmp 0xbf303f
mov esp, ebp
bswap ebp
pop ebp
jmp 0xbbfb07
mov eax, dword [edx + 0x3c]
stc
cmp ebp, ebp
test dl, bh
add eax, edx
clc
stc
cmp dword [eax], 0x4550
jmp 0xbe3b6f
je 0xc8e457
mov eax, dword [eax + 0x7c]
cmp ebp, 0xd50cad11
cmp ax, si
push ebx
test esi, 0xc70c7884
push edi
clc
cmc
mov dword [ebp - 0x10], eax
test dx, di
test bp, 0x27af
mov dword [ebp - 8], 0xffffffff
cmp dx, ax
cmp esi, 0xffff
jmp 0xbe13ce
push ebp
ror bp, 0x21
cdq
mov ebp, esp
rol dh, cl
mov edx, dword [ebp + 8]
stc
clc
test di, 0x68a9
lea esp, [esp - 0x114]
cmp ebx, esp
cmc
push esi
clc
test dl, 6
test edx, edx
jmp 0xc1d9ef

Function at 0xddfe9f
Capabilities:
Encode data using base64

Disassembly:
not al
mov eax, dword [edi]
call fcn.00ddd2c8
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x100040d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0x42280dce
lea eax, [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
sub eax, 0x254a6792
je 0x1000413b
jmp 0x10004102
mov eax, dword [ebp - 0x14]
sub eax, 0x29651017
je 0x1000417b
jmp 0x10004115
mov eax, dword [ebp - 0x14]
sub eax, 0x42280dce
je 0x1000412d
jmp 0x10004128
jmp 0x1000418c
mov eax, dword [ebp - 0xc]
mov dword [eax], 0x254a6792
jmp 0x1000418c
mov eax, dword [0x100a0694]
mov ecx, dword [0x100a0698]
or eax, ecx
xor eax, 0x3fd0b893
mov ecx, 0x66cf5de5
mul ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
shr eax, 0x1e
or eax, 0x3167d0ee
push eax
mov ecx, esp
mov dword [ecx], edx
mov ecx, dword [ecx]
mov dword [ebp - 0x18], ecx
cmp eax, 0x38d27a8e
jae 0x1000413b
jmp 0x10004191
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push eax
mov ecx, esp
mov dword [ecx], edx
mov dword [eax], 0x254a6792
jmp 0x100040ec
mov ecx, dword [ebp - 0x18]
call fcn.1003ec30
mov ecx, dword [ebp - 0x18]
call fcn.1003eda0
mov esp, ebp
pop ebp
ret
Function at 0x1002fdd0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret
Function at 0x1003a150
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret