joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029083
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e2f7
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x100290b0
cmp byte [0x1003ce0a], 0
je 0x100290ff
call fcn.10021234
test al, al
mov edx, 0x1002fbdc
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e608
call fcn.10021234
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100290eb
push 0x1003e608
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100290ff
push 0x1003e608
call fcn.10005ee0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10021234
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10003172
test ebx, ebx
jne 0x1002917d
cmp byte [0x1003ce0b], bl
jne 0x10029149
cmp byte [0x1003ce0a], bl
je 0x100291f1
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e608
push ebx
call fcn.10021234
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002916b
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100291f1
push ebx
call fcn.10005ee0
pop ecx
jmp 0x100291f1
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x100291ac
cmp byte [0x1003ce0b], al
jne 0x100291a5
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002914e
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x100291e1
cmp byte [0x1003ce0b], al
jne 0x100291d7
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002914e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b235
ret
Function at 0x67b1a6
Capabilities:
Encode data using base64

Disassembly:
inc cl
neg cl
dec esi
mov dword [esp + esi - 0x20c82fff], 0xf516d820
xor bl, cl
call fcn.00838443

Function at 0x67fd2e
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [esi + 4]
add esi, 2
sal edx, cl
push 0xdd0960b1
push 0xb69804a5
mov dword [esi], edx
push 0xf6a1a008
lea esp, [esp + 0x10]
jmp fcn.00802444
Function at 0x689209
Capabilities:
Encode data using base64

Disassembly:
movsx ecx, dx
mov dx, word [esi + edx - 0x58840c9a]
sal cl, 0x86
sal cx, 0x26
add cl, byte [esi + ecx - 0x1ffe]
add esi, 2
call fcn.0067ef75
lea esp, [esp + 8]
jmp fcn.00662031
rol al, 1
call fcn.007095b5
push 0xa6a561a0
not ax
call fcn.006aac11
mov edi, 0xd82be181
sub edi, edi
movzx edx, byte [edi + ebp]
rol edi, 0x4e
xor edi, edi
jns 0x6d123a
mov edx, 0x58840c9a
jmp 0x66ad85
lea ebp, [ebp + edi*4 + 1]
inc di
ja 0x6ec34c
xor dl, bl
sub di, di
xor dl, 0x37
sub dl, 0xa7
jmp 0x824738
mov ecx, 0x88100cb5
xor al, bl
sub al, 0x3b
mov dword [esp], 0xe687d61a
and cx, cx
jge 0x6891f5
xor byte [esi - 0x30c2be3a], dl
or esi, dword [ecx]
pop edx
jbe 0x716966
sub dword [ebp - 0x3c], ecx
mov byte [0x81eef822], al
fist word [esp + edi*8 + 0x2b]
arpl word [ecx + 0x659e125e], bp
push esi
inc dword [ebx - 0x3e7e844a]
mov dh, 0xf7
jae 0x716a03
and eax, 0x439b04f8
wait
inc ebx
pop ecx
jnp 0x716a10
push 0x44
ficom dword [esp + edi*4]
add dword [edx + edx], esi
cmp al, 0x9c
popfd
pushfd
into
sahf
lodsd eax, dword [esi]
add eax, 0x78cd33ef
mov dh, 0x81
jb 0x7169fb
popal
push edx
jno 0x7169a3
shl byte [esi - 0x18], 1
invalid
sbb al, 0xce
fsubr qword [edx]
out dx, al
and dword [ecx], 0xa3bbbeac
mov word [edx + 0x23], gs
fsub dword [ebp + 0x44]
mov esi, 0x6a8ca3bb
and ebx, eax
inc esp
push eax
or eax, 0x6e718ef3
jno 0x716a80
sub byte [edx - 0x56], ch
cmp eax, 0x38f6b184
or eax, 0x24e31c0b
nop
nop
jae 0x716a20
mov ecx, 0x75200d17
stosd dword es:[edi], eax
js 0x7169b3
aas
ret 0xb14e
mov edx, 0x5a88a2c9
lock not dword [edx + 0x71]
mov al, byte [0xe72b3a9e]
xor dword [ecx - 3], edi
les eax, [esp + edx]
inc edx
xchg esp, eax
add al, 0xad
sbb byte [esi + 0x34], ah
pop es
in al, 0x97
in eax, dx
iretd
not dword [edx + 0x75]
xchg ebx, eax
jae 0x716a7a
lcall 0x45c1, 0xb5273a85
jl 0x716a37
mov esp, 0x8313c5d2
sub dl, byte [edx - 0x24c7f493]
rol ch, cl
adc eax, dword [ebx + 0xb6d922a]
cmp bl, bl
xchg edx, eax
insd dword es:[edi], dx
or edi, dword [eax]
fld xword [eax - 0x27a34570]
loope 0x716aad
test al, 0x90
mov edx, 0x21e1d85c
inc edx
fcom dword [esi]
into
jg 0x716ab2
aaa
mov dh, 0x85
or ax, 0x6327
inc ecx
loope 0x716b16
test dword [esi + 0xd], esp
daa
arpl word [ecx - 0x1f], ax
jp 0x716ab3
push ss
ror esp, cl
not dword [edx - 0xf]
retf 0x3e56
lodsb al, byte [esi]
or bh, dh
push edx
jno 0x716a94
loope 0x716a6c
mov eax, 0x2e51b91c
lodsd eax, dword [esi]
sbb al, 0xb9
push ecx
lodsd eax, dword cs:[esi]
mov esp, 0xceeb2b75
sbb al, 0x7a
invalid
and dword [ecx + 0x63], esi
nop
push 0xf0e2e30a
mov edx, 0x4edebbc0
pop ebx
out 0xb6, eax
push esi
mov word [edi], es
sbb eax, 0x9fd8ad1e
add eax, 0x7dbbb66e
fstp qword [eax + edi*2 + 0x61]
xchg dword [0xf9664403], ecx
push ebp
and ebp, dword [esi - 0x36db93c]
wait
lodsd eax, dword [esi]
push ds
invalid
push 0xb0255515
mov word [esi], di
lea esp, [esp + 8]
jmp fcn.0070a2b0
xor dl, 0x3f
add dl, 0x23
ror edi, 0x38
xor bl, dl
shr di, 0x2d
shr edi, 0x3d
adc edx, esp
shr di, 0x2d
movzx di, byte [edx + edi*2]
push 0x6a379838
sbb esi, 2
jmp 0x7dd819
Function at 0x6965bf
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jmp fcn.00802444
sbb edi, 2
call fcn.006eb38f
call fcn.00738ac2
mov ecx, dword [esi]
mov eax, 0xe9551b2
xadd al, ah
mov eax, dword [esi + eax*4 - 0x3a56c808]
push 0x5d2715a6
inc byte [esp + 1]
mul ecx
not dword [esp]
mov dword [esi], edx
mov dword [esi + 4], eax
jmp 0x66dfdd

Function at 0x69796c
Capabilities:
Encode data using base64

Disassembly:
shl edx, 0x8c
and edx, 0xe81090b7
mov dword [esp + eax - 0x135800], ebx
movsx ebx, dx
mov ebx, ecx
mov edx, ebx
adc eax, eax
jne 0x6a69a0
inc al
sal edx, 2
neg al
jp 0x6e7cfb
lea eax, [eax*2 + 0x2d14d426]
mov eax, ebp
push 0xb69c0fbf
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x738176
mov eax, dword [ebp + ebx*4]
call fcn.00851906
push 0xc63dc393
mov edi, dword [esp]
mov edi, dword [esi]
mov dx, word ss:[edi]
add esi, 2
push 0xe0b78b38
mov word [esi], dx
lea esp, [esp + 8]
jmp fcn.0083a132
mov eax, dword [ebp]
call eax
push 0xb9bbcc2d
call fcn.00853cc1

Function at 0x697e7b
Capabilities:
Encode data using base64

Disassembly:
mov word [ebx], bp
call fcn.0066ea12

Function at 0x6988dd
Capabilities:
Encode data using base64

Disassembly:
mov byte es:[ecx], dl
jmp fcn.00802444
lea esi, [eax + esi - 0x2b347300]
inc eax
adc eax, 0x42b84b0a
movzx eax, byte [ebp + eax - 0x6decbe10]
jno 0x7dab1b
dec eax
add ebx, 2
inc cx
shr edx, cl
inc sp
mov dword [ebx], edx
jmp 0x7cc69a
mov dword [esp], 0xb30e3581
call fcn.006ea115
mov edx, 0x95aa9c
mov edx, dword [esi + edx - 0x95aa9c]
mov eax, 0x2b347382
sal al, 0x61
jb 0x680c93
call fcn.0066da8c
mov edx, 0x3aacc231
mov ecx, dword [esi + edx*2 - 0x75598462]
mov dl, byte [esi + edx*2 - 0x7559845e]
add esi, 6
jmp 0x6b2f93
jmp 0x679592
dec eax
lea esp, [esp + 8]
jmp fcn.006c8ded

Function at 0x69fcb1
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xbc8b250e
xor dl, bl
neg dl
add dl, 0x39
push 0x45231621
rol dl, 1
dec dl
call fcn.006f6315

Function at 0x6a59c7
Capabilities:
Encode data using base64

Disassembly:
and edi, 0xff
mov edi, dword [edi*4 + 0x83389c]
shr ebp, 8
xor ebp, edi
inc ecx
xor ebp, 0x153a0628
dec edx
push 0x3c0138b0
lea esp, [esp + 0xc]
jne 0x6f123f
mov edi, 0x10b82482
pop edi
not ebp
jmp 0x805343
push 0xf921b989
mov dword [esi], ebp
lea esp, [esp + 4]
jmp fcn.00802444

Function at 0x6b314b
Capabilities:
Encode data using base64

Disassembly:
mov esi, ebp
not bx
mov dword [esp], 0x74371d3a
mov ebx, dword [esp + 4]
mov edi, 0x17a0592c
jmp 0x71dcbe
Function at 0x6f3ac2
Capabilities:
Encode data using base64

Disassembly:
add edi, 6
not dword [esp]
call fcn.0084720a
mov ebp, 0x9835cdb9
and ebp, 0x93046117
adc bp, 0x8e25
sbb edi, 4
add ebp, ebp
mov ebp, dword [edi + ebp*2 - 0x40133cd8]
xor ebp, ebx
bswap ebp
jmp 0x6f3aaf
push 0x40957980
shld edi, eax, cl
push 0x3a17e337
mov dword [esi], edi
push 0x529b1b9f
lea esp, [esp + 0xc]
jmp fcn.006854c2
push 0xb59f9f89
add ebp, 0x8020f13c
neg byte [esp]
call fcn.006c3567
mov dx, word [esi]
mov ebp, 0xd19b4f3e
mov bp, word [esi + 2]
push 0x79917c87
add esi, 2
jmp 0x81d52d
and dx, bp
push 0x98a2a58a
not dx
mov word [esi], dx
push 0x7e015c3f
lea esp, [esp + 0xc]
jmp fcn.00802444
mov dword [esp], 0xdb798cce
call fcn.0067ada2
mov ax, word [ebp]
mov cx, word [ebp + 2]
call fcn.006b0284
mov ecx, 0x939bc4a1
mov eax, 0xb6a20908
mov edi, dword [esi]
ror al, cl
mov eax, dword [esi + 4]
jo 0x66fee2
mov cl, byte [esi + 8]
adc esi, 6
jmp 0x6ad7ae

Function at 0x705100
Capabilities:
Encode data using base64

Disassembly:
call fcn.00805c12
movzx ecx, byte [esi]
mov ebp, 0x2ea8a4b5
lea esi, [esi + ebp*2 - 0x5d514969]
lea eax, [ebp + ebp + 0x27a4e227]
call fcn.00813cab

Function at 0x7095f3
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xb94cc5c9
call fcn.0069e52a
push 0x891f581d
inc esp
mov ecx, dword [ebx]
rol word [esp + 3], 0xc6
inc esp
mov edx, dword [ebx + 4]
mov cl, byte [ebx + 8]
jb 0x73115f
not dl
and al, dl
mov word [esi], ax
jmp 0x93d37a
dec eax
ror dword [esp], 0x5c
call fcn.007418f9
lea esp, [esp + 4]
jmp fcn.00802444

Function at 0x714856
Capabilities:
Encode data using base64

Disassembly:
add edi, 1
xor cl, bl
inc cl
ror cl, 1
xor cl, 0x9d
neg cl
call fcn.00726d20
mov eax, 0xcc33628d
mov cl, byte [esi]
dec eax
or al, 0x8a
xor ax, ax
xor al, byte [esi + 2]
jmp 0x7c68a2
push 0x37a5df99
add esi, 2
push 0xdeac7297
imul cl
mov word [esi], ax
lea esp, [esp + 8]
jmp fcn.00802444

Function at 0x7374b6
Capabilities:
Encode data using base64

Disassembly:
jmp 0x6fffe2
add esi, 6
push 0x912ade96
jmp 0x839344
call fcn.00699b65
mov ebp, 0xad06dc0a
and bp, bp
mov ebp, dword [esi]
mov edx, 0x54b8baa0
sar dl, 0xc1
xor dx, dx
or dl, byte [esi + edx - 0x54b7fffc]
jmp 0x6b40fb

Function at 0x74033c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
neg eax
ror eax, 1
call fcn.007db6ce

Function at 0x7bc064
Capabilities:
Encode data using base64

Disassembly:
dec eax
sbb ebx, 2
push 0x94315484
inc sp
mov dword [ebx], edx
jmp 0x7c570d
inc ecx
xor bh, al
dec esi
mov dword [esp + edx - 0x1a61d700], edx
jmp 0x7ced0f
dec eax
lea esp, [esp + 0x18]
jmp fcn.006fcf6a
inc ebp
add dl, dl
inc eax
adc bh, 0x90
inc eax
neg bh
inc eax
sub bh, 0xa0
inc ecx
push edx
inc edx
shl byte [esp + edx*2 - 0x34c3adf1], 0xe4
inc esi
sub dword [esp + edx - 0x1a61d6f6], edx
inc eax
rol bh, 1
inc esp
xor al, bh
dec eax
lea edi, [esp + edi + 0x10]
inc cx
neg edx
inc esi
xor dword [esp + edx*4 - 0x6984a3ff], edx
inc ecx
inc dl
inc si
movzx edx, byte [edi + edx*4 - 0x6984a404]
jne 0x6a1361
Function at 0x7bd4f1
Capabilities:
Encode data using base64

Disassembly:
adc esi, 2
and bp, dx
jmp fcn.00847129
lea ecx, [esi - 0x67a7a094]
lea edx, [ebp + esi - 0x67a7a190]
and edx, 0xfffffffc
mov dword [esp + esi - 0x67a7a110], 0x40c211a
mov word [esp + esi - 0x67a7a10e], si
sub edx, ecx
mov esp, edx
call fcn.0068da6c
mov ebp, 0x4688671a
mov bp, word [esi + ebp - 0x4688671a]
mov edx, 0xa400381b
shr edx, 0x90
mov dx, word [esi + edx - 0xa3fe]
jns 0x814952
invalid
jne 0x6f9c20
or eax, 0x952826c9
mov esi, 0xe4079083
neg dword [esp + ebx*2 - 0x6e1d1f7d]
add eax, 0x5c7dc2da
xor byte [esi], cl
mov fs, word [esi - 0x312a8f72]
xchg dword [esi - 0x24], ebp
add dword [ecx], 5
xor dword [eax - 0x7f8f5632], 0x25
mov dword [0xec7165f3], eax
pop edi
mov edx, 0x66010297
push esi
arpl cx, cx
retf

Function at 0x7c9360
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.00802444

Function at 0x7d4f17
Capabilities:
Encode data using base64

Disassembly:
movzx ebx, byte [ecx]
jmp 0x80a00c
mov dword [esp + 4], 0x2eb3c99f
xor edi, ebx
inc ecx
xor edi, 0x602e4a2a
dec eax
mov byte [esp + 4], 0x20
lea esp, [esp + 8]
jne 0x67bd94
mov ebx, 0x212cbbb
pop ebx
jmp 0x7d4eeb
jmp fcn.00814368
mov dword [edi], eax
jmp 0x6bbb06
mov ebx, dword [ebx*4 + 0x687164]
shr edi, 8
jmp 0x69714a
call fcn.006b0feb
stc
stosb byte es:[edi], al
add dh, byte [eax]
cwde
out dx, al
adc byte [eax + 0x70], bh
mov byte [0xde4eb8ca], al
pushf
les eax, [ebp - 0x48]
jb 0x7d4f5b
test ch, bh
enter 0xffffffffffffe020, 0x1f
and cl, byte [edi]
and dword [ebp - 0x6068cdfd], edi
mov dword [0xb9f0f5f4], eax
mov edx, 0x665f1e6b
ror ecx, 0x22
movzx ecx, byte [ebp + ecx - 0x5f1e9aee]
add ebp, 1
mov edx, 0x4500c419
xor cl, bl
call fcn.008204c2
push 0x80286602
call fcn.0071304e
mov eax, dword [ecx + edi - 0xc26953d]
rol ecx, cl
add ecx, 0x150f8409
mov cl, byte [edi + 4]
adc edi, 2
shr eax, cl
jmp 0x6f0208
call fcn.006881a0
lea esp, [esp + 0x10]
jmp fcn.00844165

Function at 0x7d766f
Capabilities:
Encode data using base64

Disassembly:
add esi, 2
shr byte [esp], 0x24
imul dl
push 0x6d02ebbf
mov word [esi], ax
not dword [esp + 4]
lea esp, [esp + 8]
jmp fcn.00802444
int3
mov dx, word [ebp + 4]
add ebp, 6
call fcn.0071253c
jecxz 0x7d75f9
cmc
add ch, byte [esi - 0xa9e443]
clc
sbb byte [ecx], ch
cwde
imul ebp, dword [ebp + eax*2 - 0xc], 0xc25b8271
and dword [eax], esp
stc
mov ch, 0x7a
adc cl, 0xa4
pop ss
mov edx, 0xc23f9c47
mov ebx, 0x8682ba4a
or al, 0x9d
and dl, dl
movsx eax, dl
mov dl, byte [esi]
sal eax, 0x7c
sub eax, eax
or al, byte [esi + eax*8 + 2]
push 0x25a4728f
jmp 0x669cf6

Function at 0x7d9cca
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
pop edi
mov esp, edx
push 0x983c6237
mov dword [esp], esi
pushfd
mov edi, 0x29a5bd32
mov esi, eax
mov edi, edx
push 0x8caa2b8f
or word [esp + 1], 0x9f87
cld
shr dword [esp], 0xb7
rep movsb byte es:[edi], byte [esi]
push dword [esp + 4]
popfd
mov esi, 0x3b2c5a3e
mov esi, dword [esp + esi*2 - 0x7658b474]
call fcn.006f733b
xor eax, 0xeed6032e
fild word [esi + 0x455d58e5]
pop esp
jne 0x7d9d8c
mov ebp, edi
invalid
scasb al, byte es:[edi]
dec ebx
xlatb
inc edx
or al, ah
daa
push edx
dec edx
sahf
Function at 0x7fdf9b
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x9ff090a9
call fcn.0066d12d

Function at 0x802457
Capabilities:
Encode data using base64

Disassembly:
jp 0x80aafc
dec eax
add ebx, 0xa
dec eax
mov dword [esp], 0x6c2ff613
inc ecx
mov byte [esi], al
push 0xd113a482
dec eax
lea esp, [esp + 0x10]
jmp fcn.006c8ded

Function at 0x80d347
Capabilities:
Encode data using base64

Disassembly:
mov ax, word [ebp]
call fcn.0070db78
mov edx, 0x6ab9373d
movzx cx, byte [ebp + edx - 0x6ab9373d]
mov dl, byte [ebp + edx - 0x6ab9373b]
push 0xac344229
add ebp, 2
not cl
add dword [esp], 0x6ab6bc19
not dl
jns 0x6e8a21
mov word [ebp], dx
jmp fcn.00802444

Function at 0x81262e
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [ecx + edx + 0x18]
test edi, edi
jmp 0x6ace88
dec edi
jmp 0x822d25
test edi, edi
jmp 0x832373
je 0x83e681
mov eax, dword [ecx + edx + 0x20]
jmp 0x6a5226
je 0x6ec688
xor eax, eax
pop esi
jmp 0x7428d2
mov eax, dword [edx + 0x3c]
cmc
test bp, cx
lea eax, [eax + edx]
test edi, 0xe707d925
cmp ebx, edx
cmp dword [eax], 0x4550
jne 0x6cc64b
mov ecx, dword [eax + 0x78]
cmc
mov dword [ebp - 4], ecx
test ecx, ecx
jmp 0x8046cc
jmp 0x83e67e
je 0x6cc64b
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x7433fe
je 0x6cc64b
mov eax, 0x5a4d
cmc
test al, 0x94
cmp word [edx], ax
jmp 0x6cc645
je 0x6cc64b
mov eax, dword [eax + 0x7c]
cmc
test ah, 0x99
push ebx
push edi
cmp bh, 0x8e
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
ja 0x689c04
mov eax, esi
test ebp, 0x5424029c
sub eax, dword [ecx + edx + 0x10]
jmp 0x6fd2c3
push ebp
shr dh, cl
bsf bp, sp
not ebp
mov ebp, esp
rcr dx, 0x2b
mov edx, dword [ebp + 8]
clc
lea esp, [esp - 0x114]
cmc
clc
stc
push esi
test edx, edx
jmp 0x740345
add eax, edx
cmp ecx, 0x98affaac
sub ebx, ebx
cmp dx, si
mov dword [ebp - 0xc], eax
jmp 0x6a7ac5
jl 0x83e681
jmp 0x81462d

Function at 0x8129ff
Capabilities:
Encode data using base64

Disassembly:
call fcn.0070eb99
mov ecx, 0xfc802827
mov dx, word [esi]
mov cl, byte [esi + 2]
push 0x4e9f4fbe
add esi, 2
shr dx, cl
mov word [esi], dx
lea esp, [esp + 4]
jmp fcn.00802444

Function at 0x83dc7f
Capabilities:
Encode data using base64

Disassembly:
call fcn.0084ca4b
jns 0x6ba3db
and edi, 0xff
mov edi, dword [edi*4 + 0x696018]
shr ecx, 8
xor ecx, edi
inc esi
xor ecx, 0x9e0e36b6
dec edx
call fcn.0083c4e5
mov edx, 0xfa205a90
sal edx, 0xc3
lea esi, [edx + edx*4 - 0xcf86ae3]
mov esi, dword [esi + edi - 0x815bb9d]
inc edx
sbb dx, 0x66ba
adc dl, dh
movzx dx, byte [esi]
jbe 0x740b41

Function at 0x845a82
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
pushfd
xchg ebp, eax
pushfd
pop ecx
pop eax
ja 0x665579
jo 0x845a97
rcr byte [ecx - 0x74e672c], cl
int1
retf 0x3ae7
jae 0x845a63
jo 0x845af7
pushal
sub ecx, edx
cmp dword [edx - 0x11], eax
add ch, dl
retf
jle 0x845abc
mov edi, dword [edx - 0x463ab61d]
jo 0x845b52
sub byte [edx + 0x7b8b025e], dh
mov dword [0xf8903d01], eax
mov al, byte [0x91065b08]
push eax
int3
popal
add byte [eax], al
invalid
Function at 0x84686a
Capabilities:
Encode data using base64

Disassembly:
jmp 0x7ddf7d
dec ebx
call fcn.006c554e
mov eax, dword [edi]
mov edx, 0xfcb19eb4
push ebx
mov ebx, edx
jmp 0x6cd9b0
cpuid
push 0xd414b48b
jmp 0x846854
add esi, 6
mov word [eax], cx
push 0x5e17413a
not dword [esp]
lea esp, [esp + 4]
jmp fcn.00802444
sub edi, 0xc
mov dword [edi + 0xc], eax
mov dword [edi + 8], ebx
mov dword [edi + 4], ecx
mov dword [edi], edx
call fcn.00693bbc
mov eax, 0x46a83db0
lea ecx, [eax - 0x10609d5e]
lea ecx, [ecx + ecx*2 + 0x6ca3e696]
mov eax, dword [esi + ecx*8 - 0x7bd63c60]
mov cx, word [esi + ecx*4 - 0x3deb1e2c]
jmp 0x81c856
Function at 0x411812
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419364]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b9d2
and dword [ebp - 0x14], 0
cmp dword [0x430188], 0
mov dword [ebp - 0x18], eax
jne 0x4118c5
push 0x403e58
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41196d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e4c
push ebx
call edi
test eax, eax
je 0x41196d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e3c
push ebx
mov dword [0x430188], eax
call edi
push eax
call esi
push 0x403e28
push ebx
mov dword [0x43018c], eax
call edi
push eax
call esi
push 0x403e0c
push ebx
mov dword [0x430190], eax
call edi
push eax
call esi
mov dword [0x430198], eax
test eax, eax
je 0x4118c5
push 0x403df4
push ebx
call edi
push eax
call esi
mov dword [0x430194], eax
mov eax, dword [0x430194]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41191e
cmp dword [0x430198], ecx
je 0x41191e
push eax
call esi
push dword [0x430198]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41191e
test ebx, ebx
je 0x41191e
call edi
test eax, eax
je 0x411915
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411915
test byte [ebp - 8], 1
jne 0x41191e
or dword [ebp + 0x10], 0x200000
jmp 0x411951
mov eax, dword [0x43018c]
cmp eax, dword [ebp - 0x18]
je 0x411951
push eax
call esi
test eax, eax
je 0x411951
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411951
mov eax, dword [0x430190]
cmp eax, dword [ebp - 0x18]
je 0x411951
push eax
call esi
test eax, eax
je 0x411951
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x430188]
call esi
test eax, eax
je 0x41196d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41196f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004092fb
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x7dc977
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bh
lea esp, [esp + 1]
jmp 0x7dc9d0
mov dword [esp + 5], ecx
lea esp, [esp + 2]
mov dword [esp + 4], ebx
push di
jmp 0x7dca13
mov word [esp], cx
lea esp, [esp + 3]
push edx
call fcn.007dc9b1
jg 0x7dc99b
mov dword [esp + 5], ecx
lea esp, [esp + 2]
jmp 0x7dca07
mov dword [esp + 4], ebx
push di
jmp 0x7dca95
push word [esp]
mov dword [esp + 4], esp
push ebx
mov byte [esp + 2], bh
push dword [esp + 1]
jmp 0x7dca38
jo 0x7dca60
push dword [esp + 6]
jmp 0x7dca64
push dword [esp + 6]
call fcn.007dca44
push word [esp]
jmp 0x7dca17

Function at 0x7dc98d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
push ax
mov dword [esp], ecx
call fcn.007dc977

Function at 0x7dc9b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
push ecx
push dword [esp + 1]
jmp 0x7dc9de

Function at 0x7dca44
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x10], ebp
call fcn.007dca69
mov esi, 0x39caaf3f
stc
xchg esp, eax
adc byte [esi + 0xad210e1], al
lea ebx, reloc.MSVCRT.dll_strncpy

Function at 0x7dca69
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07cb600
jmp 0x7dca9e
mov dword [esp], ebx
mov dword [esp + 0x10], esi
jmp 0x7dca76
pushfd
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x7dcab4
mov eax, esp
mov al, dl
jmp 0x7dcad0
pushfd
jmp 0x7dc14c
xchg ebx, eax
jmp 0x7dcae2
mov edi, dword [esp + 0x2c]
bt bp, dx
jle 0x7dcaba
xchg ebx, eax
call fcn.007dcb42
mov es, word [ebx + 0x648d1aec]
and al, 2
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x7dcb52

Function at 0x80c6fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.0080c721
add byte [ecx + 0x68], al
jl 0x80c661
pop edx
and dword [ebx + reloc.MSVCRT.dll_strncpy], eax
adc dword [eax + 0x73], esi
push 0xffffffffffffff85
insd dword es:[edi], dx
jl 0x80c6b3
salc
jmp 0x80c737
lea esp, [esp + 1]
lea esp, [esp + 3]
jge 0x80c617
or eax, reloc.MSVCRT.dll_strncpy
ret