joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402688
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x402684
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x402675
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
inc ebp
mov eax, 0xb945c6c8
cmpsd dword [esi], dword es:[edi]
call fcn.00402430
mov fs, word [ebx]
inc esp
mov eax, dword [0x50a8458d]
call fcn.00402440
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004023f5
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40271e
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
inc ebp
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
jg 0x402720
inc ebp
int 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00402430
jl 0x4027a7
aaa
push 0xffffffffffffff8d
lea eax, [ebp - 0x40]
push eax
call fcn.00402440
push eax
push esi
push dword [ebp + 8]
call fcn.004023f5
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00402430
or ebp, ecx
add eax, 0x88e8458d
pop ebp
call 0xe99daff1
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00402440
push eax
push esi
push dword [ebp + 8]
call fcn.004023f5
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
invalid
jmp 0x40276f
Function at 0x402a50
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x4029d5
cmp dword [eax + 0xc], ebx
je 0x402a78
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00402430
hlt
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x402a66
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x402a41
and eax, 0xffff
push eax
jmp 0x402a45
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004023f5
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x402c1f
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x402a26
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x4029c7
call fcn.00402430
loopne 0x402adb
sub cl, bl
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x402ae4
invalid

Function at 0x4033a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esi + 0x21fffffc], ebx
mov byte [ebp - 0x361], 0x30
xor dh, al
test dword [eax + 0x38fffffc], esp
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
cmpsd dword [esi], dword es:[edi]
cld
invalid
invalid
cmp al, dh
test dword [eax + 0x27fffffc], ebp
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00402440
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004023f5
add esp, 0xc
invalid
invalid
invalid

Function at 0x4038d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00402430
xor eax, ebp
int3

Function at 0x4045e4
Capabilities:
Shutdown system

Disassembly:
std
fsubrp st(3)
mov eax, dword fs:[0x30]
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad

Function at 0x4045f4
Capabilities:
Shutdown system

Disassembly:
mov eax, dword [eax + 8]
push eax
call fcn.00402430
push dword [esi + edx*2 - 0x7747fa8]
mov eax, dword [edi + 0x3c]
inc edi
cmp al, 0x8b
push esp
pop es
js 0x40460e
xlatb
sbb byte [ebx - 0x20fcdfa6], cl

Function at 0x4045fc
Capabilities:
Shutdown system

Disassembly:
push dword [esi + edx*2 - 0x7747fa8]
mov eax, dword [edi + 0x3c]
inc edi
cmp al, 0x8b
push esp
pop es
js 0x40460e
xlatb

Function at 0x404644
Capabilities:
Shutdown system

Disassembly:
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
fisttp word [ebx - 0x38fc74fc]
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
pushfd
cli
call 0xe93be6e8
mov ecx, 0xb9e8fa5f
pushfd
cli
call 0xe93be6f4
mov ecx, 0xb9e8fa9c
pop edi
cli
call 0xe93be700
mov ecx, 0xb9e8fa9c
pushfd
cli
call 0xb8cb870c
clc
pushfd
pop eax
enter 0xffffffffffffddd9, 0xfffffffffffffffa
sub edi, dword [ecx - 0x46170564]
leave
jae 0x414a70
call 0xdb5141c
xor bl, cl
arpl sp, di
nop
jno 0x414a28
test eax, 0xe828c71c
invalid
inc esi
arpl word [ecx], dx
int 0x51
cwde
cwde
pop ss
inc esi
and al, 0xfa
call 0xc253e85c
out 0x63, al
add eax, 0xcf63ad03
mov eax, 0xfadde0
test byte [ebx + 4], bl
pop ss
cmp al, 0x5c
mov gs, ebp
push ecx
push 0x554617a5
cmp ah, ah
mov ecx, 0x7f0d73c9
leave
jae 0x414ad0
jg 0x414a5e
leave
jae 0x414ad0
jg 0x414a5e
sub bh, byte [ecx - 0x7f046308]
imul ebx, dword [esi - 0x48], 0x126ad3e8
push 0x12
xchg edx, eax
jl 0x414b37
add eax, 0x3c3851b8
push ss
inc esi
and eax, 0x9cfb08fa
inc eax
in al, dx
pop ecx
fdivp st(2)
push eax
mov esp, edi
mov ebx, 0x5cc51e8
pop ss
inc esi
je 0x414a93
pop ss
inc esi
arpl word [edx - 8], ax
fstpnce st(5), st(0)
cli
add byte [eax + 0x1a], ch
add eax, 0xfa5f7017
call 0xe93be7c0
mov ecx, 0xb9e8fa9c
pushfd
cli
call 0x1746aecc
inc esi
pushfd
cli
call 0x1746aed4
inc esi
pushfd
cli
call 0xe93be7dc
mov ecx, 0xb9e8fa9c
pushfd
cli
imul edx, dword [ebp - 0x68], 0x3d
in al, dx
popfd
jo 0x414b84
stosb byte es:[edi], al
mov ecx, 0xd1a70195
pushfd
mov ch, byte [ecx + 0x50bdd2b9]
rcr dword [edx + ecx*4 - 0x422d4657], 1
push eax
popal
push ds
shr byte [esi + 2], 0x53
stosd dword es:[edi], eax
mov ah, bh
mov ch, 5
scasb al, byte es:[edi]
add byte [edx + ebp*8 + 0x3d1db9a8], bl
jmp 0x6a3be810
sbb al, 0xca
invalid
Function at 0x402217
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x414fc5
call fcn.00411bb0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00402fe9
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.00403967
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x40225f
call fcn.00402c55
mov dword [ebx], eax
call fcn.00402a83
mov ecx, eax
call fcn.004011e9
mov eax, ebx
jmp 0x402261
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x404254
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b3e0]
jne 0x40425e
repz ret
jmp fcn.0040ac0c
Function at 0x4101c4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040840c
and dword [ebp - 4], 0
cmp dword [0x41d5a4], 0
mov ebx, eax
jne 0x410275
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410326
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x410326
push eax
call fcn.0040839a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41d5a4], eax
call esi
push eax
call fcn.0040839a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d5a8], eax
call esi
push eax
call fcn.0040839a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41d5ac], eax
call esi
push eax
call fcn.0040839a
pop ecx
mov dword [0x41d5b4], eax
test eax, eax
je 0x410275
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040839a
pop ecx
mov dword [0x41d5b0], eax
mov eax, dword [0x41d5b0]
cmp eax, ebx
je 0x4102cd
cmp dword [0x41d5b4], ebx
je 0x4102cd
push eax
call fcn.00408415
push dword [0x41d5b4]
mov esi, eax
call fcn.00408415
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4102cd
test edi, edi
je 0x4102cd
call esi
test eax, eax
je 0x4102c4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4102c4
test byte [ebp - 0xc], 1
jne 0x4102cd
or dword [ebp + 0x10], 0x200000
jmp 0x410306
mov eax, dword [0x41d5a8]
cmp eax, ebx
je 0x410306
push eax
call fcn.00408415
pop ecx
test eax, eax
je 0x410306
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410306
mov eax, dword [0x41d5ac]
cmp eax, ebx
je 0x410306
push eax
call fcn.00408415
pop ecx
test eax, eax
je 0x410306
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d5a4]
call fcn.00408415
pop ecx
test eax, eax
je 0x410326
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410328
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411570
Capabilities:
Create mailslot
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x912964]
sub esp, 0xc18
push ebx
push esi
push edi
inc eax
mov edi, 0xff
and eax, edi
movzx ecx, byte [eax + 0x4356a0]
add ecx, dword [0x91295c]
xor ebx, ebx
and ecx, edi
mov dword [0x912964], eax
mov dword [0x91295c], ecx
cmp eax, 0xb5b
jae 0x4115e7
push ebx
push ebx
push ebx
push str.Zeherixo
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push ebx
lea eax, [ebp - 0x418]
push eax
push str.Bade_juleni
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
push ebx
lea eax, [ebp - 0xc18]
push eax
push ebx
call dword [sym.imp.USER32.dll_RealGetWindowClassW]
mov eax, dword [0x912964]
mov ecx, dword [0x91295c]
lea esi, [ecx + 0x4356a0]
mov dl, byte [esi]
mov byte [ebp - 1], dl
mov dl, byte [eax + 0x4356a0]
mov byte [esi], dl
cmp eax, 0x1e8
jae 0x41161e
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ole32.dll_CoGetMarshalSizeMax]
mov eax, dword [0x912964]
mov ecx, dword [0x91295c]
mov dl, byte [ebp - 1]
mov byte [eax + 0x4356a0], dl
movzx esi, byte [ecx + 0x4356a0]
movzx ecx, dl
add esi, ecx
cmp eax, 0x6bf
jae 0x41164c
push ebx
call sub.USER32.dll_DdeFreeDataHandle
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
and esi, edi
mov al, byte [esi + 0x4356a0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10038782
Capabilities:
Encode data using base64

Disassembly:
lea edx, [eax*8 - 0x5940804a]
mov edx, dword [edi + edx - 0x76cc77ce]
movsx ecx, al
xor cx, cx
and ax, ax
lea edi, [edi + ecx + 4]
sal cx, 0xa9
mov dword [esp + ecx*8], eax
setae al
xor edx, ebx
sal ecx, 0xd
inc word [esp + ecx*2 + 1]
lea edx, [edx + ecx + 0x572b540b]
xor ax, word [esp + ecx + 2]
sal byte [esp + ecx*8], 0xc1
ror edx, 3
neg edx
sar word [esp + ecx*2 + 2], 0xaa
jbe 0x10097915

Function at 0x1004afff
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Parse pe header

Disassembly:
xor eax, ebx
sar ecx, cl
sbb cl, 0xa3
not eax
cmovns ecx, edx
rol eax, 2
mov dword [esp + edx*2 - 0x33c0], edx
neg eax
and word [esp + edx - 0x19dd], cx
add edx, 0xd1308d8c
xor eax, 0x5f104d93
not byte [esp + 2]
shl cx, 0x49
xor ebx, eax
add edi, eax
shl cx, 0xec
lea eax, [edx + edx*4 + 0x7ba74326]
jne 0x100561ad
xor cl, byte [esi - 2]
shr al, 0xa5
not al
mov dl, byte [esi]
bt eax, eax
add eax, eax
not cl
not dl
sbb eax, 0xf71dbd11
dec eax
or cl, dl
sal al, 5
movsx edx, al
sal dx, 0x2c
mov word [esi + eax*2 - 0x582ea9c0], cx
je 0x1007de5a
mov edx, 0xdb0020ba
movzx ecx, dx
movzx ax, byte [ecx + ebp - 0x20ba]
mov cl, byte [ebp + ecx - 0x20b8]
and al, cl
lea ecx, [edx - 0x64eb67ff]
not al
sub edx, edx
adc ecx, edx
shr ecx, 0xe4
mov word [ebp + edx + 2], ax
lea ecx, [ecx + edx*4 - 0x4d6fdcdb]
xor edx, dword [edi + edx*2]
movzx eax, cl
lea edi, [edi + eax*2 - 0x15c]
xor edx, ebx
xor cx, cx
not edx
ror cx, 0x29
xor al, ah
ror edx, 1
shr al, 0x64
cwde
lea edx, [eax + edx + 0x17116aae]
jns 0x100739b3
mov dword [esp + eax*2 - 0x582ea9c0], edi
ret 8
Function at 0x10054285
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x21aa5f17
push edx
lea ebp, [ebp + edx*2 - 0x202]
xor ecx, ebx
dec eax
sub edx, eax
not ecx
lea eax, [edx*2 - 0x5cd90cd8]
push edx
ror ecx, 1
neg ecx
neg byte [esp + eax - 0x5fd236f5]
shr eax, 0x1f
lea ecx, [ecx + edx - 0x1dc197e0]
not dl
xor ebx, ecx
or word [esp + eax*8 + 6], dx
ror eax, 0x25
adc edi, ecx
push edx
pop edx
lea ecx, [esi + eax*2 + 4]
not dword [esp + eax*2 + 4]
mov dword [esi + eax], ecx
mov dword [esp + eax], edi
ret 4
call fcn.10098bc5
mov ecx, 0x238dc50e
movzx edx, byte [ecx + ebp - 0x238dc50f]
jmp 0x10069810
xor cl, ch
xor dl, bl
movsx eax, cx
xor ecx, ecx
adc dl, 0x2a
push ecx
neg dl
sar ecx, 0x70
shl ecx, 0xce
adc word [esp + ecx*2 + 1], ax
rol dl, 1
sub dl, 0x14
sar dword [esp + ecx], 0x65
xor bl, dl
lea edx, [esp + edx + 4]
movzx ax, byte [edx + ecx*8]
push ecx
inc cx
mov word [esi + ecx*2 - 4], ax
lea eax, [ecx - 0x30f737c8]
xchg dword [esp + ecx + 3], eax
mov eax, dword [ebp + ecx*2 - 7]
xor eax, ebx
movzx edx, cx
rol eax, 3
bswap eax
xor word [esp + ecx - 1], dx
bswap edx
not eax
pop ecx
ror word [esp + ecx + 1], cl
sbb eax, ecx
shr dword [esp + ecx*2 - 2], 0xf6
ror cl, cl
rol eax, 1
shl edx, 0x22
lea eax, [edx + eax - 0x77ba8025]
jae 0x100f66da
xor ebx, eax
sar dword [esp + ecx - 0x80], 0xa2
sal edx, 0xaf
rol edx, 0x97
adc edi, eax
movzx ax, byte [esi + ecx*2 - 0x102]
sar cl, 0xe4
btr cx, cx
sar word [esp + ecx - 0xf7], 0x8c
add dl, byte [esi + ecx*2 - 0x1f0]
or cl, 0x80
or al, dl
pop ecx
add ecx, 0xf5adc508
mov edx, ecx
not al
sar ecx, 9
btc ecx, ecx
btc edx, edx
mov word [esi], ax
call fcn.100a331d
adc ax, dx
movsx edx, cl
not dl
mov word [edx + esi - 0xfb], ax
or ecx, edx
mov ecx, dword [ebp + ecx*2 - 0x702b7202]
jp 0x1003768a
lea edx, [eax + eax*4 + 0x149e5289]
xor ecx, ebx
or dl, ah
sub eax, 0x62be68b1
sbb ecx, 0xaf1c2daf
sal dx, 0xea
cdq
and dl, 0x1d
bswap ecx
bt edx, 0x3b
and dl, al
xor dl, dl
sbb ecx, 0xbdbe598f
push edx
bswap eax
xor ecx, 0xb298a99f
add ecx, 0x2e148f2c
neg ecx
xadd edx, eax
xor ebx, ecx
bts ax, 0x96
adc ebp, ecx
shl dword [esp], 0x8f
mov ecx, dword [esp]
pop eax
jmp ebp
jne 0x10095429
mov edi, 0xcd1a0e0e
call fcn.100a6643
mov eax, 0xe9312e24
movzx edx, al
mov ecx, eax
mov dx, word [esi + edx - 0x24]
bts eax, eax
sal ecx, cl
mov cl, byte [esi + 2]
rol ax, 0xe4
add eax, 0x7592258a
shr eax, 0x48
sal dx, cl
mov word [esi + eax*4 - 0x17b101e], dx
mov ax, word [esi + eax*2 - 0xbd880e]
mov ecx, 0x3815b836
ror cl, 0x42
mov dx, word [ecx + esi - 0x3815b889]
xor cl, cl
js 0x100c6ea8
jbe 0x100b673e

Function at 0x10060914
Capabilities:
Parse pe header

Disassembly:
mov word [ecx + esi], dx
and eax, 0x4b98cea7
rol al, 0xa1
pop edx
pop ecx
pop eax
jp fcn.10010bce

Function at 0x100609af
Capabilities:
Parse pe header

Disassembly:
rol dx, 0xe1
and eax, ecx
sub edx, 0x151c211a
xor dl, byte [esp + edx - 0x784101d0]
mov dword [esp + edx - 0x78410170], 0xc685d5b5
not eax
push edx
lea ecx, [edx + edx - 0x16d33c6f]
push ecx
mov dword [esi + edx - 0x78410170], eax
jp 0x100919a0
mov dword [esp + edx - 0x78410170], ebp
ret 0x18
Function at 0x10061bdd
Capabilities:
Authenticate hmac

Disassembly:
mov byte [edx + ecx*2 - 0x68], al
ror ecx, 0x30
btr ecx, 0x35
dec cx
mov dword [esp + ecx - 0x14ffff], esi
ret 8
lea edx, [esp + edx + 0xc]
xor cl, 0x2d
jne 0x1000de43

Function at 0x1006f918
Capabilities:
Link many functions at runtime

Disassembly:
movzx edx, byte [ebp + edx*2 - 0x4a3e0000]
mov dword [esp + ecx - 0xee5c], eax
call fcn.10054d99

Function at 0x100743c2
Capabilities:
Parse pe header

Disassembly:
or ax, ax
neg ecx
dec al
xadd dword [esp + eax - 0xb5d7], edx
inc ecx
pop edx
bts ax, dx
bswap ecx
shl ax, 0xc5
sar eax, 0x37
push edx
xor ebx, ecx
rol dword [esp + eax*2], 0x67
sbb edx, dword [esp + eax]
lea edi, [edi + edx*2 - 0x48f6108e]
shl dword [esp + eax*4], 0x43
push edx
not edx
mov dword [edi + eax*4], ecx
pop ecx
pop eax
jnp fcn.1001eea5
adc esi, ecx
mov dword [esp + eax - 0xb5d8], eax
mov ecx, dword [eax + ebp - 0xb5d8]
rol word [esp + eax - 0xb5d7], 0xe4
xor edx, 0x5f9a428e
shr dword [esp + eax*4 - 0x2d760], 0xec
lea ebp, [eax + ebp - 0xb5d4]
xor ecx, ebx
or dword [esp + eax - 0xb5d8], 0x4b296b0d
not ecx
sbb dword [esp + eax*4 - 0x2d760], eax
jae 0x1000a4b2
movzx eax, byte [edi]
add edi, 1
mov edx, 0xb3bfa0ba
xor al, bl
bt edx, edx
sbb al, 0xb1
neg al
call fcn.10040e54

Function at 0x100793cd
Capabilities:
Parse pe header

Disassembly:
adc esi, 6
mov dword [esp], 0x919d1403
jmp 0x101042d0

Function at 0x1007bbbd
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Parse pe header

Disassembly:
add ecx, 0x373730bd
adc esi, 4
add eax, ecx
ror cl, 0x26
ror ecx, 0x6f
xor edx, ebx
bswap edx
mov dword [esp + eax - 0x3737306c], ecx
shl cx, cl
lea edx, [edx + eax*2 - 0x2968b1d3]
sbb dword [esp + eax*2 - 0x6e6e60d8], eax
bswap edx
inc eax
jae 0x100d23fe
call fcn.10044848
lea edx, [eax*2 + 0x4da8fe3c]
not cx
call fcn.10107498

Function at 0x1007cbc3
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push ecx
mov dword [esi + edx*4 - 0xe3c0], eax
rol cl, 0x47
sar ecx, cl
and ecx, ecx
lea esi, [esi + edx*2 - 0x71e4]
mov eax, dword [esp + edx - 0x38d6]
pop ecx
pop eax
pop edx
pop edx
pop eax
pop eax
pop eax
jne fcn.100359ab
and dx, 0x7822
sub ax, ax
ror ecx, 3
xor ebx, ecx
mov dword [esp + eax], 0x4aa5ceac
add dx, ax
sal eax, 0xbc
adc ebp, ecx
movzx edx, byte [edi + eax*4 - 9]
sar dword [esp + eax + 2], 0x3f
lea edi, [eax + edi - 9]
push eax
xor dl, bl
movzx ecx, al
sub dword [esp + eax + 9], eax
push eax
inc dl
sub dword [esp + eax*4 + 0xa], ecx
neg dl
neg ecx
not dl
bt eax, 0x93
sal byte [esp + eax*2], 0x21
lea eax, [eax + eax + 0x21173b9d]
xor dl, 0xa0
not ecx
sal cx, 0xe1
adc word [esp + eax*2 - 0x422e7736], ax
ror dl, 1
push ecx
inc dl
shl eax, cl
add word [esp + eax*2 - 0x7ffffff0], 0x9a33
xor bl, dl
and byte [esp + eax - 0x3ffffff1], 0x93
sal cl, 0x64
lea edx, [esp + edx + 0x18]
btc ax, cx
bts eax, 0x2c
mov eax, dword [edx + eax - 0x40001001]
movzx edx, word [esp + 0x14]
jae 0x1001e428
Function at 0x1009a792
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add esi, 2
not edx
shl ax, cl
mov ecx, 0x34a4722b
mov word [esi + edx - 0x15dff4ca], ax
lea edi, [edi + edx - 0x15dff4ce]
mov edx, dword [edi + edx*2 - 0x2bbfe994]
xor edx, ebx
mov eax, ecx
not edx
inc edx
add cx, cx
call fcn.100562a4
xor eax, 0x48554a5
neg eax
xor ebx, eax
bts edx, 0xa7
add ebp, eax
mov ax, word [esi + ecx - 0x617a]
xor ecx, ecx
add cl, byte [esi + ecx + 2]
neg edx
call fcn.100fbf6a
push eax
xor bl, dl
lea edx, [esp + edx + 4]
inc al
call fcn.100c7c52
xadd dl, dh
neg ecx
sal eax, 0x9d
lea ecx, [ecx + edx + 0x1fc15a1e]
shr ax, 0xe2
not ecx
push eax
cwd
ror edx, 0x74
xor ebx, ecx
cdq
jmp 0x1007cbb5
jmp esi
mov si, word [esi + edx]
adc ecx, 0xc20f11a6
btr dx, dx
pop eax
jae fcn.1000b25f
mov edx, 0xea200b35
mov ax, word [esi]
mov cl, byte [esi + 2]
jmp 0x10014ce6
add edi, ecx
movzx ecx, byte [esp + edx*4]
sub eax, edx
jno 0x1007c0b5
mov dword [esp], 0x7d8c5198
push 0x2200dc1f
lea esp, [esp + 0x10]
ja 0x10076a54
mov edx, 0xf4234703
mov ecx, edx
mov edx, esp
mov eax, ecx
shr ax, cl
mov ecx, 0x40
bts ax, ax
xor ax, ax
add al, 0x83
lea eax, [edi - 0x80]
call fcn.1008e644
mov eax, 0x23a56d1b
mov eax, dword [edi + eax*2 - 0x474ada36]
mov ecx, 0xc99ef62e
movzx edx, cl
sub dx, 0x9eb4
lea edi, [edi + edx*4 - 0x185e4]
xor eax, ebx
dec cl
push edx
push edx
dec eax
xadd dword [esp + edx - 0x6176], ecx
lea edx, [edx*4 + 0x2607a593]
xor eax, 0x9414140f
add dx, 0xe30e
neg edx
xor dword [esp + ecx - 0x6176], ecx
ror eax, 2
sub word [esp + ecx - 0x6179], dx
dec eax
bswap edx
sub byte [esp + ecx - 0x617a], 0xb2
jo 0x10061b50
mov edx, 0x498cedb2
mov edx, dword [ebp + edx - 0x498cedb2]
mov eax, 0x42a8fab2
sal ax, 0x6c
lea ebp, [ebp + eax - 0x42a81ffc]
xor edx, ebx
cbw
mov ecx, eax
cwde
lea edx, [edx + eax*2 - 0x6ae0804]
inc cx
inc cl
not edx
neg edx
sub cx, 0xc02f
sub eax, 0x17215e23
ror edx, 3
btr eax, ecx
shl ecx, cl
ror eax, 0x6c
xor ebx, edx
lea ecx, [ecx + eax*2 + 0x1a05e79c]
bts eax, eax
lea ecx, [ecx + ecx*8 + 0x27267c0c]
add esi, edx
xor ecx, eax
btr ax, ax
lea edx, [ecx + eax + 0x7a925f0d]
movzx cx, byte [eax + edi - 0x1dde896a]
ror eax, 0x78
not edx
mov dl, byte [edi + edx - 0x6407faf0]
sal al, 0xc1
adc edi, 2
sal eax, 0xf7
or cl, dl
movzx edx, ax
btc edx, eax
not cl
mov word [edi + eax*2 - 0x3a000000], cx
jmp esi