joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404860
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x4048d0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x404937
xor ecx, ecx
xor edx, edx
jmp 0x404919
cmp ax, 0x5c
jne 0x4049a8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x404937
cmp ax, 9
je 0x404925
cmp ax, 0x20
jne 0x404900
test ecx, ecx
je 0x404993
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x404919
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x4049c8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403ba0
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x404990
cmp ax, 0x20
je 0x404990
jmp 0x404937
cmp ax, 0x22
jne 0x404929
and edx, 1
jne 0x404929
xor ecx, 1
jmp 0x40490d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x404950
Function at 0x4048d0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x4048d0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x404937
xor ecx, ecx
xor edx, edx
jmp 0x404919
cmp ax, 0x5c
jne 0x4049a8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x404937
cmp ax, 9
je 0x404925
cmp ax, 0x20
jne 0x404900
test ecx, ecx
je 0x404993
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x404919
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x4049c8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403ba0
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x404990
cmp ax, 0x20
je 0x404990
jmp 0x404937
cmp ax, 0x22
jne 0x404929
and edx, 1
jne 0x404929
xor ecx, 1
jmp 0x40490d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x404950

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0xb590421
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x702f1079
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6e9d310c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x76fc580f
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x590545d6
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x19072c06
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406054], 1
mov dword [0x406050], 1
mov dword [0x40604c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40600c], eax
mov eax, dword [0x406060]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40605c]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x403018], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4013f0
Capabilities:
Terminate process

Disassembly:
mov dword [0x406060], 0
jmp sym.___tmainCRTStartup

Function at 0x401780
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x4017e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406068]
test esi, esi
jle 0x401900
mov eax, dword [0x40606c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401814
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401897
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401800
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401927
mov eax, dword [0x40606c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x40606c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401907
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401890
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4018a0
add dword [0x406068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40606c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401890
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40181e
mov eax, dword [0x40606c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop

Function at 0x401e40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40607c]
sub esp, 4
test ebx, ebx
je 0x401e95
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401e8e
test esi, esi
je 0x401e8e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e70
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4021d0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4021f5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402200
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4021f5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402248
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40223e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40224a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402230
xor eax, eax
pop ebx
pop esi
ret
Function at 0x44a880
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.HKEY_CLASSES_ROOTCLSIDD2073C44_AB4F_11D0_A732_00A0C9082637
mov edi, eax
call fcn.0044a810
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
add esp, 4
mov ebx, eax
push 0
call esi
cmp eax, 7
je 0x44a8f5
push 1
call esi
mov esi, eax
mov eax, dword [esp + 0xc]
and esi, 0xff00
test eax, eax
je 0x44a8cf
mov eax, dword [0x652dd4]
push 0x652b08
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0xc]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, 0xd00
je 0x44a8eb
cmp esi, 0x400
jne 0x44a8f5
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret

Function at 0x45192a
Capabilities:
Encode data using xor

Disassembly:
adc al, byte [eax]
add byte [ebp + 0x6a4f74c0], al
add byte [eax], al
add byte [ebx], al
add byte [eax], al
push 0x1211
push dword [eax + 4]
call dword [0x30]
jmp 0x451980
pop ds
mov edx, 0xdb208f71
cdq
or eax, 0x960cbca2
nop
mov edi, 0xcfcb0690
xor dword [esp + eax - 0x4e], eax
inc ebx
sbb al, 2
or byte [edx], bh
invalid

Function at 0x460817
Capabilities:
Encode data using xor

Disassembly:
push ebx
add byte [ecx], 0x89
adc byte [eax - 0x69], 0xd5
scasb al, byte es:[edi]
cmp al, 0xbe
invalid

Function at 0x4f385c
Capabilities:
Encode data using xor

Disassembly:
enter 0xffffffffffff8957, 0xffffffffffffff87
mov bh, 0x65
xchg ecx, eax
mov byte [ebx + ebp*8 + 0x62], cl
inc edx
mov ecx, 0xc4756725
jnp 0x4f3868
rcl dword [esi]
ljmp 0x33ba
mov dh, 0x68
pop ss
stosd dword es:[edi], eax
xchg dword [ebp + 0x1b], esp
ja 0x4f380c
wait
add byte [edi - 0x47a8cdc2], cl
xor dl, byte ds:[edi - 0x48]
and eax, 0x9dc9fe81
sub dword [esi - 0x28], esp
test eax, 0xa748df36
les ebp, [edi]
cmp cl, byte [eax - 0x67]
xor ecx, dword [ebx]
xor eax, 0xa1ab3a6d
wait
adc ecx, dword [eax - 0xd]
invalid
Function at 0x4f4425
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0xb9
shl dword [eax], 0x1d
mov bl, 0x77
invalid
jns 0x4f43a8
sahf
or bh, byte [eax + 0x7a9fabf7]
pushfd
pop ecx
lahf
pop eax
in al, 0xe9
stc
stosb byte es:[edi], al
inc esi
dec ecx
test byte [ebp + 0x67], 0x24
inc edx
fiadd word [ecx]
imul edi, ecx, 0xecde5ee5
rcl ch, cl
dec ebx
mov ebx, 0x8b9a42c6
inc edx
cmp eax, 0x6ff4860e
pop ebp
push edi
push ebp
add al, byte [ecx + 0x45bb03dd]
imul edx, dword [ebp + edi*4 - 0x11b070a], 0xffffffb3
cwde
idiv al
in al, 0xfe
mov bl, 0x98
out dx, eax
fdiv qword [ecx]
jo 0x4f4460
mov word [eax - 0x47], gs
cmpsd dword [esi], dword es:[edi]
fsub dword [esi]
and al, 0x3a
imul edx, dword [ebp + 0x4b], 0x55
pushfd
loop 0x4f4496
arpl word [ecx + 5], sp
pop ebx
dec ecx
jns 0x4f44a4
xchg ecx, eax
invalid
sahf
inc edx
call dword [edi - 0x7dbc9c67]
pop ebx
test ebp, edx
ror ch, 0x17
pop ss
enter 0xffffffffffffc326, 0xffffffffffffffe7
pop ds
pop es
test eax, 0xdbf99b
push edx
sbb byte [edx + 0x37], dh
and edi, dword [ebp - 0x19]
loop 0x4f44ac
inc dword [edx + 0x1a0d9ea3]
adc cl, byte [ebx + esi*4]
rol edi, 1
mov byte [0xd3c42d82], al
push ebx
aad 0xf5
salc
lds ecx, [esi - 9]
scasb al, byte es:[edi]
push ebx
pop ds
sub bl, cl
add ebx, ecx
jbe 0x4f4505
and byte [ebx + 0x121a0d9e], 0xc
mov bl, 0xd1
invalid
pop ss
mov ecx, 0x501bd839
push ebx
ja 0x4f44db
jae 0x4f449d
push es
push cs
popal
cmp edi, edi
cmp edi, edi
mov edx, 0x3af2c905
jno 0x4f454e
cmp dh, byte [ecx + 0x6a]
ror dword ds:[esi], 0xe3
lodsd eax, dword [esi]
daa
cmp al, bl
cli
jb 0x4f4498
invalid
loopne 0x4f448b
movsb byte es:[edi], byte [esi]
invalid
jns 0x4f44e1
jge 0x4f4594
or esp, dword [ecx]
mov eax, 0xc79b7d41
out 0x61, eax
sub dl, byte [edx]
les eax, [ecx]
xchg ebp, eax
mov dl, 0x14
mov bl, 0x3f
inc esp
push ebx
test eax, 0x78b898d0
pop ds
sahf
add al, byte [edi - 0x2b]
pop edi
add ebx, edi
cdq
and edx, ebx
mov eax, dword [0x3b730484]
or dl, byte [esi - 0x44]
inc esp
iretd
out dx, eax
inc esi
mov ebp, 0x213f274f
sub byte [eax + 0x69550647], bh
jb 0x4f45c0
sbb dword [eax - 0x4e48d71f], ecx
dec ebx
test edi, eax
mov ch, 0x9e
mov fs, esi
xchg dword [esi + 0x4955c0ff], esp
mov bh, 0xd9
inc edi
leave
push dword [0x82c80758]
out 0xbe, eax
loope 0x4f45b0
invalid
Function at 0x5986bc
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
wait
inc ecx
sub eax, 0x7032afcb
sub ebp, edi
mov ebx, edx
cmc
sahf
xchg edi, eax
mov ah, 0x45
pop esi
test eax, 0xcb005e51
and bl, byte [edx + 0xaeb29c1]
out dx, eax
or ch, bh
pop ebx
xor dword [ebx], eax
bound ebx, qword [ebx - 0x2683d812]
wait
out dx, al
daa
jl 0x598652
xor ch, byte [edx]
cmp ebx, dword [esi - 0x9c1004a]
xchg ebx, eax
cwde
or eax, 0xd0e458a
cli
or esi, dword [esi + ebx*2 - 0x71ac0cdc]
outsd dx, dword [esi]
dec ebx
sbb dword [esi - 0x278fd4a0], 0x66
pushal
adc bh, byte [edx - 0x7f66445f]
xchg esp, eax
test byte [edx], bh
jns 0x598674
sbb eax, 0x753ba559
mov esp, gs
jae 0x5986e9
cwde
jp 0x5986d7
hlt
sub eax, 0x7042b69c
or ebx, dword [edi + 0x4e]
jecxz 0x59866e
sub bh, byte [esi + ebp*8]
or ch, dh
xor ah, byte [ebp - 0x4c]
scasb al, byte es:[edi]
invalid
shr dword [esi + 0x5c], 0x9f
ret 0xe6f4
adc al, 0xbb
mov ebp, 0x6c7b929b
clc
mov eax, dword [0xe54bbae8]
cli
cmp esp, esp
push ebx
cmp esi, dword [edi + 0x34c32b83]
clc
pop edx
cli
pop ecx
sbb edx, eax
retf

Function at 0x614f4c
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
adc al, 0xda
sub edi, edi
pop ebx
adc al, 0x37
popfd
cmpsd dword [esi], dword es:[edi]
and dword [ebx - 0x3da90b9e], ecx
in eax, 0
popal
push ss
inc ecx
out 0xbe, al
call 0x7b023fee
cwde
xor eax, 0xace6e454
daa
stosd dword es:[edi], eax
adc ebp, edi
fadd qword [esp + ebp*4]
inc ecx
imul esi, dword [ecx], 0xfdd1fd8c
pop ds
inc ecx
sub ch, cl
wait
aam 0x43
lahf
std
cmp bl, bh
je 0x614f58
invalid
stc
out dx, al
fldcw word [ebp + 0x3dbf05b8]
popfd
into
add al, 0x2f
invalid
Function at 0xac0446
Capabilities:
Encode data using xor

Disassembly:
invalid
or eax, 0x546de1d
add byte [eax + eax - 0x254ff64], bl
jmp 0xac042c
add byte [eax], al
clc
inc ecx
adc dword [esi + 0x76e98b46], esi
add cl, ah
add cl, ch
dec ebp
test edi, ebx
in al, 0xfe
mov ebp, 0x793eb28d
jg 0xac04bf
jbe 0xac0462
inc esp
push cs
or eax, 0x60f100
mov edx, dword [edx + 0x66c7a54d]
adc edi, dword [ebx - 0x173cd707]
cmp eax, 0x8cac0324
pop edi
or al, 0x9b
add dword [edi], esp
outsd dx, dword [esi]
push ss
or dword [esi], ecx
outsd dx, dword [esi]
loop 0xac042e
lds eax, [edi - 0x65]
sbb byte [ecx + 0x34], dl
test dword [edx - 0xb], ebx
invalid
sbb byte [eax], dh
outsb dx, byte [esi]
dec ecx
fsubr st(5)
out dx, eax
scasb al, byte es:[edi]
and al, 0x36
xor byte [ebp - 0x79], ah
mov ebx, 0xb17c10ee
xchg dword gs:[ebx - 0x4e83ef12], edi
push esi
sar byte [ecx + esi - 0x74], 1
jle 0xac0502
pop ebp
cmp dword [ebx], esi
aas
fmul st(2), st(0)
outsb dx, byte [esi]
lahf
mov ah, 0x1e
mov edx, 0x91116feb
add bh, byte [esi]
xor edx, dword [esi - 0x216fab91]
xor edx, dword ds:[esi - 0x216fab91]
adc eax, ecx
jmp 0xac0549
mov esp, 0x22ee3bef
adc al, byte [edi + 0x359416fe]
cdq
in al, dx
mov edi, 0x6a5e9d62
lodsd eax, dword [esi]
cmp ebp, esi
and dl, byte [edx]
xchg esi, edi
push ss
xchg esp, eax
xor eax, 0x62bfec99
popfd
pop esi
push 0xffffffffffffffad
jp 0xac0509
into
shr ebx, 0xfd
xchg dword [esi], esi
popfd
cmp al, 0xc5
adc ah, cl
adc ch, byte [eax + 0x10]
xchg edi, eax
lodsd eax, dword [esi]
and eax, 0x8d2357cf
mul byte [ecx + 0x14]
arpl bp, bx
xchg ebp, eax
jecxz 0xac04b4
add cl, byte [edx + 0x3d]
fiadd dword [ecx - 0x8cfd944]
xor esi, dword [ebx + 0x68]
ja 0xac053d
push 0xf1b4fd77
mov ah, 0xf1
js 0xac0500
xor al, 0x13
push 0xffffffffffffffa3
adc ebp, dword [edx - 0x5d]
inc ecx
push esp
mov dword [0xa5769c31], eax
pop eax
pushfd
xor al, 0x32
jp 0xac04de
mov dword [0x907cf371], eax
sbb dword [ecx + 0x6880f4c], 0x5c
dec ebp
mov ah, 0x84
leave
pop ss
stosd dword es:[edi], eax
push ebp
out 9, al
mov ds, word [ebx + 0x35]
insb byte es:[edi], dx
pop ebx
jbe 0xac0545
invalid
Function at 0x401ae0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45fb0e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4780bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
test ebx, ebx
je 0x401cae
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx]
dec ebx
mov byte [ebp + esi - 0x14], al
inc ecx
mov ah, byte [ebp - 0x12]
inc esi
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0xe], ah
mov byte [ebp + 0x13], dl
mov byte [ebp - 0xd], dh
cmp esi, 3
jne 0x401be5
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, dl
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop dword [eax]
cmp dword [0x478014], 0x10
mov ecx, section..data
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [section..data]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00401cd0
inc esi
cmp esi, 4
jl 0x401bb0
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov dl, byte [ebp + 0x13]
mov dh, byte [ebp - 0xd]
test ebx, ebx
jne 0x401b55
mov dword [ebp + 0x10], esi
test esi, esi
je 0x401cae
mov eax, esi
cmp esi, 3
jge 0x401c1e
cmp eax, 3
jae 0x401cc2
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x401c02
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
jmp 0x401c21
mov cl, byte [ebp - 0xe]
mov al, dh
shr cl, 6
shr al, 2
and dh, 3
mov byte [ebp - 0x18], al
xor ebx, ebx
mov al, dl
shl dh, 4
shr al, 4
and dl, 0xf
add dh, al
shl dl, 2
lea eax, [esi + 1]
mov byte [ebp - 0x17], dh
add dl, cl
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x16], dl
test eax, eax
jle 0x401c8c
mov esi, eax
nop word [eax + eax]
cmp dword [0x478014], 0x10
mov ecx, section..data
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [section..data]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00401cd0
inc ebx
cmp ebx, esi
jl 0x401c60
mov esi, dword [ebp + 0x10]
cmp esi, 3
jge 0x401cae
mov ebx, 3
sub ebx, esi
nop dword [eax + eax]
push 0x3d
mov ecx, edi
call fcn.00401cd0
sub ebx, 1
jne 0x401ca0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0045e7d2
int3