joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58de00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5a38f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x58ded2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.0058a7a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x58de61
mov edx, dword [eax]
jmp 0x58de63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.0058c050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0x58debf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x58debf
cmp esi, edi
je 0x58debf
mov ecx, esi
call fcn.00585a00
push esi
call fcn.005931c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.0058a990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0x58def5
mov eax, dword [eax]
jmp 0x58def7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.00589640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x58df25
mov eax, dword [eax]
jmp 0x58df27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0x58df76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x58df76
cmp esi, edi
je 0x58df76
mov eax, dword [esi]
cmp eax, edi
je 0x58df5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x58df6d
push eax
call fcn.005931c8
add esp, 4
push esi
call fcn.005931c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x58df90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x58dffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x58e035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.0058de00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x58dfc5
mov edi, 0x5a88b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x58e035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0058de00
add edi, 4
add esp, 0xc
cmp edi, 0x5a88c0
jb 0x58e000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x58e070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00594082
mov esi, eax
add esp, 8
test esi, esi
je 0x58e107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x58e102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00593946
add esp, 8
test eax, eax
je 0x58e0e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x58e0e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00593946
add esp, 8
test eax, eax
jne 0x58e0c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x58e102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x58ef10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5a39fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x58f002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00592dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x58f002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.0058a6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0059320b
push 0x10
call fcn.005931d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x58efc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.0057f1c0
jmp 0x58efc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.0058eb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x58eff0
mov ecx, edi
call fcn.0057f2c0
push edi
call fcn.005931c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x58f021
inc ebx
cmp ebx, 0x20
jb 0x58ef3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x590250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a4808
push 0x594288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x590329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x590329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005931d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x590329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x590329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x59032c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00590351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x590d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x590d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x590d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x590d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x590d94
push eax
push esi
call fcn.0059320b
add esp, 8
pop esi
ret 0x10

Function at 0x590da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x590e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x590e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x5a9320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00592dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x590dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x590e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x590ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x590eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x5a9320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00592dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x590eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x590e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x591000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x591131
push esi
call fcn.00594145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00583080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x591131
push 0
push ebp
call fcn.005833a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00583260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x59108b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.005832f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x591121
push 0x5a9918
push edi
call fcn.005923f0
push eax
push ebx
push esi
call fcn.00590f60
push 0x5a98f8
push edi
call fcn.005923f0
push eax
push ebx
push esi
call fcn.00590f60
push 0x5a98d8
push edi
call fcn.005923f0
push eax
push ebx
push esi
call fcn.00590f60
push 0x5a98c0
push edi
call fcn.005923f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00590f60
push 0x5a98a0
push edi
call fcn.005923f0
push eax
push ebx
push esi
call fcn.00590f60
push 0x5a9888
push edi
call fcn.005923f0
push eax
push ebx
push esi
call fcn.00590f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5921b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00592140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00592140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00592140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00592140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x592bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x592c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5a487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x592c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x592c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, reloc.advapi32.dll_RegisterServiceCtrlHandlerA
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x43cf62
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x43ccda
mov esi, 0x62c6f608
call fcn.0043cf88
xor dword [edi], edx
add edi, 1
sub esi, 0x47b49da2
cmp edi, ecx
jne fcn.0043cf62
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x346e3f20
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x677e2534
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x403250
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x48d2a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp + 0xc]
push eax
lea esi, [ebp - 0x60]
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
call fcn.00403000
add esp, 4
mov ecx, esi
call fcn.00403120
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044a38c
mov esp, ebp
pop ebp
ret
Function at 0x615bf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x615d52
cmp edi, esi
je 0x615d52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x615d42
add edi, 4
jmp 0x615ca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x615cb8
mov dword [ebp - 4], 2
jmp 0x615cd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x615ccf
mov dword [ebp - 4], 1
jmp 0x615cd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x615d52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x615d10
mov byte [ecx + 2], 0x3d
jmp 0x615d1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x615d2c
mov byte [ecx], 0x3d
jmp 0x615d32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x615ca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x674ff1
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x434d1a5f
lea ebp, [ebp + esi - 0x434d1a5e]
xor eax, 0xbcb2e5a2
call fcn.0097f9e2
dec ebp
mov eax, 0x62e8ed7d
cmpsb byte [esi], byte es:[edi]
jo 0x674ff8
stosd dword es:[edi], eax
jmp 0xeb54b7fd

Function at 0x73fe21
Capabilities:
Encode data using xor

Disassembly:
push edi
call fcn.008ef19a
dec ebx
idiv dword [ecx]
loope 0x73fe84
popal
or esi, esp
das
fistp dword [eax - 0x11]
mov dh, 0x4d
push 0xfdeec1e8
mov word [edi + 0x78], ds
int 0x8b
sub dl, al
pushfd
xor byte [ecx - 0x397a53ac], 0xc5
mov cl, 0x3a
push esi
push ebx
cmp dword [0x34d0e921], 0x33e07fb8
iretd
xor byte [edx + esi - 0x725e5e25], bh
dec ebx
aaa
xchg ecx, eax
mov bh, byte [ecx*4 + 0x1ba583c0]
invalid
Function at 0x743ed0
Capabilities:
Encode data using xor

Disassembly:
invalid
lea edx, [edx + edx*2 + 0x2fd66093]
add dword [esp + 0x10], 0xfff8d5a8
mov ecx, 0x44d51edf
add edx, edx
push ebx
bswap ecx
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + edx - 0x5fad5726]
mov ebx, 0x76500a54
xor bl, 0x61
add edx, 0x16867e17
cmp bl, 0xa3
call fcn.0097495b
cmp al, byte [ebx]
jl 0x743f5c
into
jl 0x743f5a
xor dword [ecx - 0x6c763eff], 0xffffffb1
daa
jne 0x743ea4
pushfd
mov cl, 0x8e
hlt
pop ds
xor eax, 0xf24e54e9
nop
sub eax, 0x4f6d4e58
scasd eax, dword es:[edi]
mov ah, 0xb1
xchg byte [ebp - 0x5d], bl
mov cl, 0x5f
out 0x46, eax
pop edx
dec esi
pop ecx
adc esp, dword [ecx]
mov esi, 0xf78416b1
inc edx
dec esi
stc
sub dword [edi], esi
push edx
dec esi
iretd
mov ch, 0x32
xchg ecx, eax
mov cl, 0xd7
jge 0x743fb8
xchg ebp, eax
mov cl, 0xba
rcl byte [ebx - 0x78d24e67]
adc dword [ebp + 0x4e], esi
dec esi
sbb eax, 0xe0a16557
and al, byte [eax]
mov bh, 0xc4
mov cs, word [ebx]
salc
out 0xa, al
and al, 0xe0
pushfd
mov cl, 0x15
pushal
push cs
dec edi
pushfd
ja 0x743f27
sahf
adc dl, ah
sub ah, byte [0x67d2ac40]
sahf
invalid
sbb dl, bh
xlatb
or cl, 0xd0
mov esp, dword [esi + 0x2e]
mov ecx, 0x9961d06e
xor esi, dword [ebp - 0x7bbbf57a]
adc al, 0x91
xor cl, byte [ebx]
and ecx, dword [edi - 0x55]
salc
js 0x743fba
salc
pop ecx
add edx, dword [ebx]
and dl, byte [esi - 0x75b3e3da]
mov cl, byte [eax - 0x7fb67bbc]
sbb al, dl
aas
fimul dword [ebx + 0xad70a30]
loopne 0x744024
jl 0x743ff9
das
jae 0x743f88
sal byte [esi - 0x6f], cl
and bl, byte [ebp - 0x25b5039b]
jbe 0x743fb9
dec ebx
jmp 0x744041
push esi
jmp dword [ebp - 0x61a9c990]
push ds
push esi
salc
inc esp
sbb al, 9
push esi
pop es
lahf
mov edi, 0x5361a9f0
fcom dword [esi + edx*2]
xchg esi, eax
in al, 0xe
call 0xce85da03
clc
test eax, 0xf7ceb5f7
test eax, 0x29fa64ce
push esi
jne 0x744085
retf
out dx, al
jmp 0xc643f804
Function at 0x7dc834
Capabilities:
Encode data using xor

Disassembly:
mov bp, word [esp + 0xe]
add dword [esp + 0x1c], 0x1f571c
lea ebp, [ebp*4 + 0x21727805]
push ebp
test byte [esp], 0x5f
js 0x7dc8b9
and dword [ebp - 0xa], edx
inc esp
and al, 0
pop edi
bswap ebp
call fcn.0089cbb1
dec esi
jae 0x7dc845
adc dl, byte [eax + 0x57ec6099]
and eax, 0x58ec6c5d
cmp bl, bh
adc byte [ebx], 0xf3
xor dword [ebp - 0x558dec69], edx
xor dword [ebp - 0x558dec69], edx
outsb dx, byte ss:[esi]
in al, dx
push esp
outsb dx, byte [esi]
push ecx
mov dl, byte [ebx]
imul esp, ecx, 0xffffff87
jbe 0x7dc868
fsub qword [edi + eax*2 + 0x66]
in al, dx
ret 0x4760
push 0x76
lea ecx, [edi + 0x6a3969f3]
pop es
fisub word [ebx - 0x732aad1b]
aad 0x8c
stosd dword es:[edi], eax
test eax, 0xebffa913
bound ebp, qword [ebx - 0x4e8863a4]
jo 0x7dc8e2
or esp, ebx
sbb eax, 0xad9564c2
and al, 0x6d
movsd dword es:[edi], dword [esi]
inc esi
adc eax, dword [eax - 0x73]
push edi
in al, dx
jecxz 0x7dc8f6
ret 0x9564
inc eax
lea edx, [edi - 0x14]
mov byte [0x12c63d4b], al
mov esp, 0x8871177f
or dl, dl
dec ebx
xchg edx, eax
mov bh, 0xed
in eax, dx
lodsd eax, dword [esi]
test dl, 0x15
xchg dword [eax + 0x4d546420], ebp
test byte [edx + 0x50020bc1], dl
jne 0x7dc8c6
imul ecx, edx, 0xffffff93
jg 0x7dc92f
std
jno 0x7dc911
je 0x7dc8d6
add eax, 0x41d1d099
mov ah, 0x32
invalid
dec edi
int3

Function at 0x7f47ad
Capabilities:
Execute syscall

Disassembly:
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x20]
call fcn.009fc93c
syscall
call fcn.0065c038

Function at 0x81c74d
Capabilities:
Encode data using xor

Disassembly:
sbb edx, dword [edi]
pushfd
inc ebp
lcall 0xcfe6, 0x25adbad4
lea edi, [ebx]
or eax, 0x5cce4b17
or dword [ecx - 0x11ebdb64], edi
dec ebx
jns 0x81c707
invalid
mov dword [ebx], ecx
mov ecx, 0x431145eb
stc
push esp
sbb eax, 0x527be6b8
push es
xlatb
out 0x50, eax
adc eax, 0xe9b73cb5
jns 0x81c759
mov ebp, 0x91c32345
cdq
push ebx
arpl di, dx
push 0x58fe7031
jmp fcn.0081c746
jo fcn.008cce26
js 0x65b0d7
call fcn.009c80c3
pop edi
xor al, 0xf3
jnp 0x81c6e3
and byte [0x60123a52], 0x88
mov ecx, 0x49c06dde
and eax, 0x60123a52
mov byte [ecx + 0x49c06dde], bh
cmp al, 0x22
jle 0x81c70e
pop ds
cmp byte [edx + 0x20], ah
cmp esi, dword [esi + 0x2e]
sal byte [eax + 0x4f], cl
dec esi
lds ebx, [ebp - 0x1ae53ecf]
in eax, dx
stosb byte es:[edi], al
sub byte [eax + 0x158cd21f], ch
or eax, 0xfcc79dc2
loop 0x81c762
fisttp qword [ebp + eax*8 - 0x62]
aam 0xdd
mov ebx, 0xedc5addf
xchg ebp, eax
pop esi
inc esi
and dword [edx - 0x3cf37ce3], edx
fnsave dword [ecx + edx*2 - 0x14623820]
xchg esi, eax
sar ch, 0x1d
invalid