joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f9e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4ca008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4cce10
xor edx, edx
push esi
mov ecx, eax
push edi
mov edi, dword [ebp + 8]
cmp ecx, fcn.0045f9e0
je 0x45fa1b
cmp dword [eax], 0x2f2a2a2f
je 0x45fa18
dec eax
cmp eax, fcn.0045f9e0
jne 0x45fa06
jmp 0x45fa1b
lea edx, [eax + 4]
mov ecx, dword [edx]
movq xmm0, qword [edx + 4]
xor ecx, 0xfefefdfc
mov eax, dword [edx + 0xc]
mov esi, ecx
shr esi, 0x10
mov word [ebp - 0x18], si
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], eax
cmp si, cx
je 0x45fa53
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467358
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x18]
xor edx, edx
mov byte [ebp - 0x11], al
shr esi, 8
push ebx
mov ebx, 0xc
mov eax, esi
div ebx
lea eax, [esi + 1]
movzx ecx, byte [ebp + edx - 0x10]
xor edx, edx
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
xor edx, edx
or ecx, eax
lea eax, [esi + 2]
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
xor edx, edx
or ecx, eax
lea eax, [esi + 3]
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
or ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ebx, 0x19810419
mov cl, byte [ebp - 0x11]
rol eax, cl
mov ecx, 4
xor al, bl
ror eax, 8
ror ebx, 8
loop 0x45fab5
mov bl, al
rol eax, 8
mov bh, al
mov al, bl
ror eax, 8
mov al, bh
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
pop ebx
mov dword [edi], eax
xor ecx, ebp
pop edi
mov eax, 1
pop esi
call fcn.00467358
mov esp, ebp
pop ebp
ret

Function at 0x460e20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4ca008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x460ee9
push dword [esi + 0x34]
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push dword [esi + 0x30]
lea eax, [ebp - 0x30]
push eax
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.PAL.dll_PalWindowGetPosCenter]
mov eax, dword [ebp - 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 0x30]
mov dword [esi + 0x2c], eax
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x60]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x54]
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
push 0x24
lea eax, [ebp - 0x28]
mov dword [esi + 0x28], ecx
push eax
push edi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467358
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00467358
mov esp, ebp
pop ebp
ret
Function at 0x4611d0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4ca008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x110]
push 0x4cd228
push str._s.
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp eax, 0xffffffff
jne 0x461234
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467358
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
nop dword [eax]
mov ecx, 0x4bb374
lea eax, [ebp - 0x224]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x461270
test dl, dl
je 0x46126c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x461270
add eax, 2
add ecx, 2
test dl, dl
jne 0x461250
xor eax, eax
jmp 0x461275
sbb eax, eax
or eax, 1
test eax, eax
je 0x46133a
mov eax, 0x4bb388
lea ecx, [ebp - 0x224]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4612a8
test dl, dl
je 0x4612a4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4612a8
add ecx, 2
add eax, 2
test dl, dl
jne 0x461288
xor eax, eax
jmp 0x4612ad
sbb eax, eax
or eax, 1
test eax, eax
je 0x46133a
test byte [ebp - 0x250], 0x10
jne 0x46133a
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
lea esi, [ebp - 0x224]
add esi, eax
mov eax, dword [esi]
cmp eax, 0x7461642e
jne 0x461307
lea eax, [ebp - 0x224]
push eax
push 0x4cd228
lea eax, [ebp - 0x110]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call ebx
mov eax, dword [esi]
cmp eax, 0x67706a2e
jne 0x461334
lea eax, [ebp - 0x224]
push eax
push 0x4cd228
lea eax, [ebp - 0x110]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call ebx
mov esi, dword [ebp - 0x254]
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x461240
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00467358
mov esp, ebp
pop ebp
ret
Function at 0x4618d0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4ca008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x877d18], 0
je 0x461a67
push str.access.dat
push 0x4cd228
lea eax, [ebp - 0x108]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x114], eax
cmp eax, 0xffffffff
je 0x461a67
push 0
push dword [edi + 0x877d18]
call dword [sym.imp.PAL.dll_PalListGetDataCount]
add esp, 8
test eax, eax
je 0x461a44
mov esi, eax
shl esi, 5
add esi, eax
push 0
push esi
call dword [sym.imp.PAL.dll_PalMemoryAlloc]
mov ebx, eax
add esp, 8
mov dword [ebp - 0x10c], ebx
test ebx, ebx
je 0x461a67
push 0
push dword [edi + 0x877d18]
call dword [sym.imp.PAL.dll_PalListFind]
mov edi, eax
add esp, 8
test edi, edi
je 0x4619c2
push 0
push 0
push edi
call dword [sym.imp.PAL.dll_PalListGetData]
push 0x21
push eax
push ebx
call fcn.004714c0
push edi
add ebx, 0x21
call dword [sym.imp.PAL.dll_PalListFindNext]
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x461995
mov ebx, dword [ebp - 0x10c]
mov ecx, esi
mov dword [ebp - 0x110], esi
and ecx, 3
je 0x4619d9
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x110], eax
mov edi, dword [ebp - 0x10c]
mov cl, 4
mov edx, dword [ebp - 0x110]
mov eax, 0xff987dee
xor dword [edi], eax
mov eax, 0x84df873
xor dword [edi], eax
ror byte [edi], cl
add edi, 4
add cl, 1
and cl, 0xff
sub edx, 4
jne 0x4619e7
push 0
lea eax, [ebp - 0x118]
push eax
push esi
mov esi, dword [ebp - 0x114]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.PAL.dll_PalMemoryFree]
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467358
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x114]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467358
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00467358
mov esp, ebp
pop ebp
ret
Function at 0x461d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4ca008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.system.dat
push 0x4cd228
lea eax, [ebp - 0x108]
mov esi, ecx
push str._s_s
push eax
mov dword [ebp - 0x114], esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x461e12
push 0x4bb538
call dword [sym.imp.PAL.dll_PalErrorLogPrintf]
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467358
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.PAL.dll_PalCheckWindowMode]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov dword [esi + 8], eax
lea eax, [ebp - 0x110]
push eax
push 2
push 0x4b424c
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
push 0x330
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264c8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264cc]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264d4]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264d0]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x264d8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264e4]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264e8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264f0]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264ec]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x264f4]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x26660]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xb34
lea eax, [esi + 0x2666c]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 8
lea eax, [esi + 0x271a0]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x1000
lea eax, [esi + 0x447a8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
add esi, 0x877d28
push eax
push 4
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
push dword [esi]
mov esi, dword [ebp - 0x114]
push dword [esi + 0x877d20]
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
add esi, 0x877d24
push eax
push 4
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x114]
push dword [esi]
push dword [eax + 0x877d1c]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00467358
mov esp, ebp
pop ebp
ret
Function at 0x4659c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], 0x84df873
mov dword [ebp - 0x14], 0xff987dee
and eax, 3
je 0x4659ea
sub edx, eax
mov dword [ebp - 8], edx
push edi
mov edi, dword [ebp - 0xc]
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
rol byte [edi], cl
add cl, 1
and cl, 0xff
mov eax, dword [ebp - 0x10]
xor dword [edi], eax
mov eax, dword [ebp - 0x14]
xor dword [edi], eax
add edi, 4
sub edx, 4
jne 0x4659f4
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x49407f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00493859

Function at 0x49408a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00493a94

Function at 0x494d2f
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00494ab6
Function at 0x1009da2f
Capabilities:
Encode data using xor

Disassembly:
dec ecx
bswap ebx
inc ebp
movzx esi, word [ecx]
inc ecx
ror ebx, 0x46
inc ecx
rol bl, 0x87
dec ecx
dec ebx
inc sp
xor esi, edi
inc ebp
btr ebx, ebx
inc bp
add esi, ebx
dec ecx
ror ebx, 0xe7
inc cx
ror esi, 1
inc cx
xor esi, 0xf4de180
mov ebx, 0x3d830fdb
inc eax
add al, 0
mov dword [esp], 0xa6250bd5
call fcn.1015a716
push 0x9a2c094a
adc dword [ecx + edx*2 + 0x24], edi
sub esp, dword [ebx + 0x5486d34]
push ds
stosb byte es:[edi], al
xor eax, 0xbd004f74
xchg ebp, eax
rcr dword es:[edi - 0x59], 1
jno 0x1009d9e1
xor byte [ebp - 0x58], bl
wait
xor esi, dword [ebp - 0xb6c051f]
jno 0x1009da59
push eax
je 0x1009dac5
inc ebp
inc edx
pushal
dec edi
push ebp
push esp
je 0x1009dabf
jns 0x1009dac0
jl 0x1009dab5
jne 0x1009dab6
insb byte es:[edi], dx
xchg ecx, eax
xchg ebx, eax
ret 0x69d3
cmpsb byte [esi], byte es:[edi]
sbb al, byte [ebx - 0x766b2828]
aaa
cmpsb byte [esi], byte es:[edi]
in eax, 0xda
fimul dword [ecx - 0x36ee554]
mov dword [edx + ebx + 0x5763fc91], ebp
xor dword [ecx + 0x10], ecx
jbe 0x1009da52
arpl word [edi + 0x31], dx
dec ecx
adc byte [esi - 0x7a], dh
arpl word [edx], bp
shl dword [ebx - 0x4c], 0xbe
iretd

Function at 0x100a209d
Capabilities:
Encode data using xor

Disassembly:
inc esi
mov ecx, dword [esp + ecx + 0x55]
inc ecx
inc ecx
movzx edx, di
inc ecx
ror ecx, 1
inc ecx
neg ecx
btc ebp, edx
and edi, esi
inc esp
xadd esi, edi
inc ecx
inc ecx
shl edx, 0xbf
inc ecx
bswap ecx
cmove si, dx
inc ecx
dec ecx
inc cx
and ebp, edi
inc esp
movzx edx, ch
inc eax
rol dh, 0xc6
dec ebp
adc ecx, esi
dec esp
mov dword [esp + edi*2 - 0x188], esp
dec eax
lea edx, [edi + ebp + 0x2a9b9c92]
inc ecx
inc edx
dec eax
mov dword [esp + edi*2 - 0x180], ecx
dec eax
bswap edx
dec esp
mov edi, esp
imul esi, edx
dec ebp
lea edx, [edi + edi - 0x330]
dec bp
inc ecx
and dl, 0xf0
dec eax
btr esi, esi
bts ebp, esi
neg di
dec ecx
mov esp, edx
add di, si
dec esi
mov dword [esp + ecx - 0x2b], esi
dec eax
btc ebp, edi
jae 0x100e38a6
dec esp
lea esi, [0xeff1c753]
push esi
dec edx
mov dword [esp + ecx - 0x2b], edx
inc eax
xchg bh, dh
dec esi
mov dword [esp + ecx + 5], esi
inc si
inc esp
movzx edi, di
jg 0x100a0b30
syscall
pushfd
call fcn.10126139
mov edx, 0x7cc4db98
fisttp qword [esi + 0x55ddd2a9]
shr byte [edi + 0x6cd6c78a], 0xcf
lcall 0x33c8, 0x7b53eea1
mov ecx, 0xda6e9741
mov bl, 0xde
scasd eax, dword es:[edi]
and byte [eax + edx*4 - 0x6647c79a], dh
scasb al, byte es:[edi]
cld
out dx, eax
xchg esp, eax
mov dword [0x8e04c455], eax
push edi
lahf
invalid
Function at 0x10105b3d
Capabilities:
Encode data using xor

Disassembly:
jb fcn.100d596d
dec ebp
mov dword [edx], ebx
call fcn.100d0c8b
mov cl, byte [ebp + ecx - 0x745321f4]
jg 0x1015f2f0
mov esi, 0xff0a488b
inc cx
dec ebx
btr esi, esi
btc si, si
inc cx
ror ebx, 1
inc si
inc eax
setnp dh
inc cx
sub ebx, 0xf66ae20
scasd eax, dword es:[edi]
test cl, 0xf6
jbe 0x10105be7
inc ecx
ror ebx, 1
push esi
dec eax
shr esi, 0xb3
inc cx
xor edi, ebx
btr esi, 0x35
dec eax
mov dword [esp + esi], esi
dec esi
lea ebx, [esp + ebx + 8]
pop esi
inc dx
add esi, dword [esi + ebx]
push 0xec846e8a
dec ecx
sub edi, 2
inc cx
mov dword [edi], esi
call fcn.1012bfae
salc
jmp 0x10105c2c
movsd dword es:[edi], dword [esi]
mov eax, dword [0xf4a07457]
mov bl, 0xa1
invalid
jnp 0x1003639a
and al, 0x10
mov al, byte [0xef37bf91]
sbb eax, 0x43cd6456
cli
xor al, 0x5f
mov al, 0x6e
adc dword [ebp + ecx*4 + 0x6d92a82f], edi
pop ss
pop ds
pop eax
mov edx, 0x2ddceb54
daa
pushal
fst st(6)
retf

Function at 0x10131e28
Capabilities:
Encode data using xor

Disassembly:
call fcn.1011afef
ror word [esp + 2], 0x69
ror dl, 1
rol dword [esp], 0xd
push 0x13839420
xor dl, 0xa0
jmp 0x1013b44b
mov dword [esp], 0x8fa7b790
sbb ebp, 3
push 0x3214cb9c
mov dword [ebp], edx
jmp 0x100f4979

Function at 0x1014b602
Capabilities:
Encode data using xor

Disassembly:
push ecx
stc
adc edi, dword [esi + 0x7f7951e8]
je 0x1014b5d4
out dx, al
leave
int 0x68
jbe 0x1014b574
adc byte [edx + 0x3e84ddf8], dh
fxch st(3)
pop ecx
invalid
loope 0x1014b574
lahf
imul esi, dword ss:[ebp + 0x24ada03b], 0x6d
aaa
lodsb al, byte [esi]
dec esp
cmp ecx, dword [esi - 0x35]
push ebp
shl byte [eax - 0x7716ce64], 1
pushfd
dec edx
dec edx
push cs
dec edi
xor byte [ecx + 0x5465cb79], cl
inc edx
sbb dword [ecx - 0x794746bd], ecx
std
jge 0x1014b5de
jns 0x1014b669
outsb dx, byte [esi]
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.1015a716
and dword [edx + eax - 0x57063761], esi
mov cl, 0x13
cwde
cmc
rcr byte [ebp - 0x3b68c974], 1
aad 0x51
xchg dword [esi - 0x39], edi
fld dword [ecx]
out 0xa9, al
or byte [0x4265e001], 0xc8
loop 0x1014b63a
and byte [esi + 0x785bfc2c], 0xd0
lea esp, [edi - 0x6629ce3f]
mov esp, 0x49b29849
sbb eax, 0xe96c775d
jnp 0x1014b5d3
pop ds
and eax, 0x6d59d712
sbb dword [ebp + 0x3902e768], edi
mov ebp, 0x3902e768
stc
popal
and eax, 0x80d5d712
loope 0x1014b673
out 0x40, al
pop ebx
pop ebx
into
dec edi
add al, 0x4f
mov ch, 0x25
xor dword [edi], 0x21cf080
inc eax
jb 0x1014b6dc
push 0xdb78c4e2
loop 0x1014b63a
js 0x1014b653
invalid
retf 0x9f3f

Function at 0x1014c189
Capabilities:
Execute syscall

Disassembly:
dec eax
lea esp, [esp + 0x38]
jb fcn.100a0bc7
push edi
pushfd
mov edi, 0x7ca6a982
shl edi, 0x7e
cmp di, 0x1f9e
not edi
mov edi, dword [esp + edi - 0x7ffffffb]
mov dword [esp + 4], 0xdad4a744
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.10039854
pushfd
mov dword [esp], 0xaa5e1d55
call fcn.1015a716
jb 0x1015a3f1
syscall
inc ecx
push ecx
dec ecx
mov ecx, 0x6a135bb3
mov esi, 0x68e6b5e5
xchg ebp, eax
ret 0x6139
jb 0x100277d4
neg ebp
push 0x17b375a0
xor ebx, ebp
rol word [esp + 1], 0x42
sbb edi, 4
Function at 0x101660be
Capabilities:
Encode data using base64

Disassembly:
push 0x87082e9b
lea esp, [esp + 0x1c]
jmp fcn.10188d08

Function at 0x10166273
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], edx
lea esp, [esp + 0x14]
jmp fcn.101e22c9

Function at 0x101668b4
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1023a5b1
inc ecx
add ch, 0x95
dec eax
mov dword [esp], 0x333cd587
inc ecx
not ch
jmp 0x101edc5e
call fcn.10196392
jmp 0x101ba5d4

Function at 0x1016b286
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101e22c9

Function at 0x1016cd45
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], dx
jmp 0x1021cb11
lea esp, [esp + 8]
jmp fcn.101e22c9

Function at 0x1016db82
Capabilities:
Encode data using base64

Disassembly:
inc eax
xor dl, bh
xor dl, 0x16
call fcn.101c0261

Function at 0x1016db92
Capabilities:
Encode data using base64

Disassembly:
push 0x89156eb3
lea esp, [esp + 0x10]
jmp fcn.101e22c9

Function at 0x1016de28
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], edi
push 0x42374e8b
lea esp, [esp + 0x18]
jmp fcn.10188d08

Function at 0x1016f462
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jmp fcn.101e22c9

Function at 0x1016f46b
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101e22c9

Function at 0x1016f80f
Capabilities:
Encode data using base64

Disassembly:
js 0x101e66a6
mov eax, dword [edi]
mov edx, 0x91345523
shl dx, 0x62
js 0x101730b2
mov dx, word ss:[eax]
call int.101819c0
adc eax, dword [ecx]
pushal
xor ebx, dword [ecx - 0x63]
lds ebx, [esi]
inc ebp
push ebx
xchg byte [ecx + 0x561f254d], ch
and edi, dword [esi + 0x51]
mov ebp, 0x7acee1ac
imul esp, esi, 0xffffffc9
test dword [ecx + edi*4 - 0x13c2d6a], edx
rol dword [0x92a68914], 1
mov al, 0x5d
out 0x59, al
invalid
xor ax, bx
not ax
dec ax
neg dword [esp]
jb 0x10212e71
call fcn.101cd081
mov dword [esp], 0x2b1a3515
adc edi, 6
call fcn.101d102d
inc ecx
mov eax, 0xba9adc20
dec ecx
sub ecx, 4
inc ebp
mov eax, dword [ecx]
push 0x91ae4990
not byte [esp + 5]
call fcn.102222cf
add eax, edx
push 0x44a4d7bc
dec dword [esp]
push 0xbdb8e3b7
mov dword [ebp - 4], eax
push 0x5f20e029
test ebx, ebx
jmp 0x10181685
xor ax, 0x3d96
mov byte [esp + 1], 0x20
call fcn.1018168f

Function at 0x10170306
Capabilities:
Encode data using base64

Disassembly:
push 0x963cb806
call fcn.101ffb74

Function at 0x10170310
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], dx
push 0x136deaa
mov dword [esp + 8], 0xbd942e93
lea esp, [esp + 0x10]
jmp fcn.101e22c9

Function at 0x10170f37
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x650e5cbb
mov word [edi], ax
jmp 0x101a8221

Function at 0x1017169e
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], eax
jmp 0x1022d781
push 0x7390ab84
lea esp, [esp + 0x10]
jmp fcn.101e22c9

Function at 0x101719ee
Capabilities:
Encode data using base64

Disassembly:
push 0x889643bd
lea esp, [esp + 0x14]
jmp fcn.101e22c9

Function at 0x1017216f
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x20]
jmp fcn.101e22c9
Function at 0x10173014
Capabilities:
Encode data using base64

Disassembly:
not edx
sal dword [esp + 4], 0x22
mov dword [esp], 0x990768b2
xor word [esp + 5], 0x1a0a
and eax, edx
push 0x2180b396
jmp 0x1018b01b
push 0xe6badc15
mov dword [edi], eax
push 0xb23b2db2
lea esp, [esp + 0x14]
jmp fcn.101e22c9

Function at 0x10173155
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x30]
jmp fcn.101e22c9

Function at 0x10173166
Capabilities:
Encode data using base64

Disassembly:
push 0x932c0e3d
mov ebp, dword [ebp]
lea esp, [esp + 8]
jmp fcn.10188d08

Function at 0x10173464
Capabilities:
Encode data using base64

Disassembly:
jmp 0x10183a14
dec edx
lea esp, [esp + 0x10]
jne 0x10207703
mov esi, 0x78a3a0a4
pop esi

Function at 0x101734d5
Capabilities:
Encode data using base64

Disassembly:
mov byte es:[edx], cl
lea esp, [esp + 8]
jmp fcn.101e22c9

Function at 0x10173edf
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101e22c9

Function at 0x10174e4a
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x20]
jmp fcn.10188d08

Function at 0x10174e53
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101e22c9

Function at 0x10175020
Capabilities:
Encode data using base64

Disassembly:
mov byte [eax], cl
jmp 0x10200868
not byte [esp + 0xd]
mov dword [esp], 0x29b4fcbe
xor al, 0xb4
xor bl, al
lea eax, [esp + eax + 0x10]
jmp 0x1016e299
lea esp, [esp + 0x10]
jmp fcn.101e22c9

Function at 0x101755b5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x4c19fd24
call fcn.10194e25

Function at 0x10176d7c
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1018870a
lea esp, [esp + 0xc]
jmp fcn.101e22c9

Function at 0x10177278
Capabilities:
Encode data using base64

Disassembly:
dec di
xor bl, cl
shl edi, 0xe1
sub edi, 0xc9999a86
add ecx, esp
btr di, di
mov di, word [ecx]
sbb ebp, 1
call fcn.101ab264
lea esp, [esp + 4]
jmp 0x101e94b9
adc edi, 4
jmp 0x10208df4
push ebp
mov dword [esp], 0xc5f74444
call fcn.101e6f82
call fcn.101a263b
mov edi, 0xb130f39
neg edi
sbb esi, 0
movzx ecx, byte [esi]
btr edi, 0x27
neg di
xor cl, bl
inc edi
sub cl, 0x89
ror cl, 1
btc edi, 0x20
or edi, 0xd83be382
xor cl, 0x26
shl edi, 0x26
and di, di
not cl
neg cl
bswap edi
jmp 0x10177255

Function at 0x10177a3b
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], ax
lea esp, [esp + 4]
jmp fcn.101e22c9

Function at 0x101780d4
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], bp
lea esp, [esp + 0xc]
jmp fcn.101e22c9

Function at 0x1017907d
Capabilities:
Encode data using base64

Disassembly:
push 0xe19d5407
mov dword ss:[edx], eax
lea esp, [esp + 8]
jmp fcn.101e22c9
call fcn.1022e09c
mov edx, dword [edi]
mov eax, 0x90bc078a
ror eax, 0x95
mov eax, dword [edi + 4]
adc edi, 7
push 0x8ba62306
jmp 0x1016de17