joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40367c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov edx, dword [eax]
mov dword [0x50b38c], edx
mov ecx, dword [eax]
test ecx, ecx
jb 0x40f52e
je 0x4036a5
jne 0x40369e
test ebx, ebp
lodsb al, byte [esi]
dec eax
mov dword [ebp - 8], 1
shl ah, 0x20
push eax
call edi
mov eax, dword [ebp - 8]
test eax, eax
jb 0x43ee94
mov di, di
jne 0x43b959
shl ebp, 0x20
je 0x4036c8
sbb esp, dword [eax - 0x3e990ab2]
out dx, eax
inc eax

Function at 0x40aa1e
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov byte [esi + 0xba], bl
shr cl, 0x40
mov byte [esi + 0xbb], dl
xchg ebp, edx
shr ebx, 0x40
xchg edx, ebp
mov word [esi + 0xbc], di
mov cx, cx
call fcn.0042575f
mov cl, byte [ebp + 0xc]
mov di, di
shl ch, 0x20
xchg bl, ch
mov bx, bx
xchg ch, bl
mov dx, word [ebp + 0x10]
jne 0x42bca5
je 0x40aa66
mov cl, 0xe8
jg 0x40aa76
je 0x42bca5
test byte [ecx], bh
adc al, byte [edx]
add byte [esp + esi*8], dh
xor al, 0xf4
adc cl, dh
inc edx
add byte [eax], al
inc eax
add byte [eax], al
sub byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], ah
cmp byte [eax + eax], 0
add byte [ecx], al
popal
add byte [eax + 0x2c], al
add byte [ecx], ah
add byte [eax], al
push cs
add byte [eax], al
add byte [esi], dh
sub al, 0x42
add byte [edx], bl
daa
inc edx
add byte [eax + eax], bh
add byte [eax], al
xchg edx, eax
stc
inc eax
add byte [esi + 0x69], dh
inc ebx
add al, bl
pop edi
push eax
mov eax, eax
jne 0x43cac8

Function at 0x40bc9a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dl, dl
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
xor eax, eax
jb 0x434328
cmp cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__n_r]
mov cl, cl
je 0x438714
shl ah, 0x20
jne 0x40bcc3
movsb byte es:[edi], byte [esi]
sbb al, 0x6b
invalid
inc eax
jne 0x4386f5
je 0x40bcd1
aas
cmp dword [esp + ebp*2], edx
iretd
je 0x4386f5
add eax, 0x113ae831
add eax, dword [eax]
lea ebp, [ebp]
mov eax, 1
jmp 0x41f6da
pop ebp
shr edx, 0x40
ret
cmp eax, 0x43
jb 0x40bcaa
jae 0x438708
scasd eax, dword es:[edi]
add ch, bl
mov eax, dword [0xc031c598]
xor eax, eax
jb 0x434330
pop ebp
ret
jne 0x4143be
je 0x438720
cpuid
mov edx, 0x98840fc3
mov esp, 0x2405fffd
je 0x4143be
add eax, 0x1c3f624

Function at 0x40c0c6
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
add esi, 0
jno 0x40a871
xchg ebp, esi
pop esp
lea esp, [esp + 4]
add dx, 0
cmp al, 2
jne 0x40a866
xchg ebp, edx
shr ecx, 0x40
xchg edx, ebp
je 0x40c0e5
ret 0xdf65
shl bh, 0x20
mov ebp, ebp
mov ax, dx
clc
add edx, 0
add ecx, 0x47
shr ax, 0xe
shr ah, 0x40
xchg edx, ebx
xchg ebx, edx
shl edx, 2
or eax, edx
jb 0x4334c3
stc
jb 0x40c118
popal
int3
jb 0x435006
sub byte [edx - 0x73], 0x64
and al, 4
push ds
call 0x1030be2f
lea ecx, [0x7c000000]
add al, 0xa0
add byte [ecx + 0x68], dl
lea esi, [esi + 8]
jmp dword [esi]
Function at 0x40d9a7
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
cmp ecx, eax
mov byte [ebp - 8], 0
mov dword [ebp + 0xc], eax
ja 0x432e71

Function at 0x40ed61
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x410f95
shr di, 0x40
lea esi, [esi + 0xc]
mov al, al
shl dword [ebx], cl
call fcn.0043e543
xor eax, 0x24448f51
pop dword [esp - 4]
mov eax, dword [esi]
add eax, 0x74
push eax
call fcn.0042e8b3
add esp, 8
jne 0x438221
je 0x40ed86
inc esp
clc
or dword [ebx + 0xf], ebp
test byte [ebp - 0x25fffd6c], dl
mov al, byte [0xd366d988]
je 0x438221
fisub dword [eax - 0x2c992678]
pop ds
mov ebx, dword [ebp + ebx]
jno 0x40ed4f
jo 0x410fa5
bound esi, qword [ebx]
mov word [edi], gs
jo 0x40ed4f
xor al, 0x35

Function at 0x40f48f
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
push edi
shl bx, 0x20
mov eax, dword [esi]
push eax
call fcn.0042684e
jno 0x42e4d0
jo 0x40f4ae
nop
cpuid
ret
jo 0x42e4d0
xor byte [esi - 0x73], 0x76
or dh, dh
sub al, 0x3b
mov dword [ebp + 0x24], eax
jmp dword [esi]
Function at 0x412cf5
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebx
pop ebx
push ebp
mov ebp, esp
sub esp, 0x12c

Function at 0x412ff5
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
jne 0x4400a2
je 0x413003
leave
salc
je 0x4400a2

Function at 0x4141e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [esi]
mov cl, byte [ebp + eax - 0x1c]
add cl, 0x1f
mov dl, byte [edi + 0xbc]
sub dl, 0x14
xor cl, dl
jb 0x414393
mov byte [edi + eax + 0x24], cl
inc eax
cmp eax, 8
jl 0x414254
jge 0x401980
xor al, 0xc4
int3
jmp 0x402e0a
test al, al
jb 0x4143bc
jne 0x4054de
je 0x40199a
mov al, byte ds:[0xe4458dd4]
lea eax, [ebp - 0x1c]
push 8
add ecx, 0x24
jmp 0x4019a6
push eax
push ecx
ja 0x4054cc
jbe 0x4019b6
test dword [eax], ecx
in eax, 9
jg 0x4019c6
jbe 0x4054cc
xchg byte [eax], dl
cmp eax, dword [eax]
add cl, bl
mov al, 0x8b
pop esi
add al, 0xf
fnstenv [eax + 0xf045e8b]
mov dh, bh
mov dh, 2
add byte [ecx + 5], bh
invalid
call int.00439c56
add esp, 0xc
jmp 0x402e0a
xor eax, eax
jb 0x43b52f
pop esi
mov ch, 0x2e
jns 0x42b104
and dh, 0x68
dec ebp
fadd dword [ebx]
ret
add esp, 0x18
jmp fcn.0040bafa
xor eax, 0x24648ddc
add al, 0xe9
push ecx
enter 1, 0xffffffffffffffd9
stosb byte es:[edi], al
call fcn.00434b3f
xor eax, eax
jb 0x42e0cd
mov ax, word [edi + 0x20]
push eax
push esi
push edi
pop edi
call fcn.00428fca
xor ecx, ecx
jb 0x4101e8
mov cx, word [edi + 0x24]
push ecx
xchg dl, bh
xchg bh, dl
push esi
call fcn.0042086e
sub edx, 0
jno 0x413d60
adc eax, 0xba810f1d
out dx, al
invalid
jno 0x412c20
invalid
lea esp, [esp + 4]
mov al, byte [ecx + 0xba]
cmp al, 1
jne 0x41423b
je 0x4141fa
mov byte [0xfb80211b], al
push edx
xor eax, eax
jb 0x42590f
cmp al, 2
mov bl, bl
jne 0x401987
je 0x41424c
jg 0x414269
jbe 0x41423b
in al, dx
xor eax, eax
jb 0x413d1a
jno 0x40194f
jo 0x41425e
daa
adc byte [edi], cl
sub bl, 0xd6
invalid
jo 0x40194f
add eax, 0x59ebe892
add al, byte [eax]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [0x50b360], ecx
shl bh, 0x20
mov eax, dword [0x50b360]
mov esp, ebp
shr bx, 0x40
pop ebp
ret
je 0x41437f
add byte [0x45e8b5a], ah
lea esi, [esi + 8]
xchg dh, cl
xchg cl, dh
shl word [ebp + ebx], cl
jmp dword [esi]
movsb byte es:[edi], byte [esi]
pop edx
mov si, si
mov al, al
mov cl, byte [ebp + 0x28]
mov ebx, dword [esi + 4]
mov cx, cx
lea esi, [esi + 8]
shl dword [ebp + ebx], cl
jne 0x43b52d
je 0x4143b6
loopne 0x41437d
dec ebp
mov esi, 0x7171840f
add al, byte [eax]
je 0x43b52d
invalid
xor eax, 0x24648dc8
add al, 0x8d
jbe 0x425924
cmp dh, dh
cmp dword [ebp + ebx], eax
jmp dword [esi]
mov bp, bp
lea edx, [edx]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov ebx, dword [ebp + ebx]
shr cx, 0x40
lea esi, [esi + 0xc]
or bh, bh
cmp byte [ebx], al
call fcn.0041dba0
fld dword [eax - 0x77bf1340]
shr ah, 0x40
mov bl, bl
jmp dword [esi]
invalid
jmp dword [esi]
pop edi
in al, dx
shl dh, 0x20
mov cl, byte [ebp + 0x28]
mov ebx, dword [esi + 4]
lea esi, [esi + 8]
shr byte [ebx], cl
jmp dword [esi]
Function at 0x415a6a
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
call fcn.0043d0f4
xchg bh, cl
xchg cl, bh
mov cl, byte [ebp + 0xc]
xchg ch, bl
xchg bl, ch
xchg dh, bl
xchg bl, al
push eax
mov ax, dx
nop
pop eax
xchg di, ax
xchg di, ax
mov cx, cx
xchg al, bl
xchg bl, dh
mov dx, word [ebp + 0x10]
call fcn.0043e579
Function at 0x41853c
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
invalid
jne 0x436afa
shr edx, 0x40
je 0x41854a
jle 0x4184ec
or byte [edi], cl
test byte [edx - 0x38fffe1b], ch
cmpsd dword [esi], dword es:[edi]
inc ebx
sbb eax, 0xd0043
add byte [eax], al
sub byte [eax], al
add byte [eax], al
push edx
cmpsd dword [esi], dword es:[edi]
inc edx
add bh, bh
inc dword [eax]
add byte [eax], ch
add byte [eax], al
add byte [eax - 0x1effbd06], dl
popfd
inc ebx
add byte [esi + ecx + 0x30044], ch
add byte [eax], al
and al, 0
add byte [eax], al
lea edi, [edi + 0x300041]
add byte [eax], al
xor byte [eax], al
add byte [eax], al
invalid
je 0x436afa
invalid
push ebp
mov ebp, esp
mov edi, edi
push ecx
shr si, 0x40
Function at 0x41c175
Capabilities:
Authenticate hmac
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov eax, edi
shr bl, 0x40
mov ecx, dword [ebp + 8]
mov eax, 4
cmp ecx, eax
je 0x423005
jne 0x40d3a0
lcall 0xc166, 0x10458b92
out 0x20, eax
mov eax, dword [ebp + 0x10]
shl di, 0x20
mov ecx, dword [ebp + 0x14]
push 0x426e8a
ret
cmp dword [ebp + ebx], eax
jmp dword [esi]
mov edx, dword [esi + 4]
div dword [ebp + ecx*2 - 0x7cf083be]
mov byte [edi + 0xb82ffff], dh
jae 0x40e677
pop dword [esp - 4]
mov ecx, dword [esi]
push 0
push ecx
ja 0x42af58
jbe 0x41c188
invalid
jbe 0x42af58
fidivr dword [esi + 0x66]
sbb dword [ebx], eax
xchg dl, al
xchg al, dl
mov di, word [edi + 8]
cmp dword [ebp + 0x10], eax
je 0x42a854
jne 0x423012
fsub st(0)
push ebx
js 0x42a83c
jns 0x42301f
push ss
cli
add ecx, edx
jns 0x42a83c
add eax, 0xeec16641
inc eax
pop edi
pop esi
mov ax, 0xa
mov bp, bp
pop ebx
mov esp, ebp
pop ebp
ret
in al, dx
cld
call fcn.0043f663
mov edx, edx
mov edx, dword [ebp + 0xc]
push 0x412a19
ret
inc eax
mov eax, dword [ebp + 0x38]
jno 0x412ed3
xchg cx, dx
xchg dx, cx
jo 0x42af3f
jo 0x412ed3
shl si, 0x20
call fcn.00414860
ja 0x420ac8
jbe 0x42af6e
jae 0x42af2b
cmpsb byte [esi], byte es:[edi]
and dh, ah
jbe 0x420ac8
add eax, 0x20e4c074
adc ah, byte [edi - 0x40]
jecxz 0x42da44
call fcn.0042bc77
xor edi, edi
jb 0x428228
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
je 0x409586
jne 0x42da5f
inc edi
int 0x50
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov bh, bh
mov esi, eax
cmp esi, edi
je 0x409586
shr bx, 0x40
jne 0x42da80
inc edx
add dl, byte [edx + 0x66]
mov edi, edi
mov di, di
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push 0x41ba97
ret
jno 0x43a17d
jo 0x43fcc3
daa
ror byte [edi], 0x80
mov ah, 0xa4
invalid
jo 0x43a17d
fdiv st(0)
jmp 0x43fccc
push esi
jmp 0x43fccf
push eax
push ebx
call fcn.00451400
jmp 0x43fcd8
push esi
shr al, 0x40
mov edi, eax
call fcn.00427c96
mov ecx, dword [ebp + 0x1c]
jmp 0x43fce8
push ecx
call fcn.00427c96
cmp cx, cx
add esp, 0x18
push edx
pop edx
test edi, edi
jb 0x42da1f
je 0x40d389
jne 0x43fd0f
sbb dword [eax - 0x66], ecx
invalid
jne 0x441ff0
je 0x43fd1d
pmaddwd mm1, qword [eax + 0xf9f5c76]
test ch, cl
and al, byte [eax]
add byte [0xfff3157], dh
je 0x441ff0
xor eax, 0xfff3157
add byte [eax - 0x2e], 0xfc
dec dword [edx + 0xbc88]
add byte [edx - 0x7fdbc7ac], cl
jmp 0xed2ee651
mov dword [esi + 0x30], 0xfffffff4
shl eax, 0x20
jno 0x42e9d9
jo 0x441fb4
leave
fstp qword [esi - 0x7ff0c7de]
pop ds
retf 0xfffe
jo 0x42e9d9
add eax, 0x385d8bc9
mov edx, dword [esi + 8]
mov dl, dl
mov ecx, dword [esi + 4]
ja 0x422e2b
jbe 0x441fd4
jb 0x441fd1
jge 0x441f9d
add al, 0xf
xchg byte [ecx + 0xe], dl
invalid
jbe 0x422e2b
lea esi, [esi + 8]
sar dword [ebx], cl
shl edi, 0x20
jmp dword [esi]
jmp 0x441ff1
push ebx
call fcn.00427c96
add esp, 4
js 0x40d376
jns 0x442009
jb 0x441fad
jns 0x40d376
xor al, 0x5b
Function at 0x41c857
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
jb 0x42a293
stc
cmp byte [ecx], 0
je 0x40270b
jne 0x41c874
dec ebp
das
cli
shl ebp, 0x20
xor al, 0x5a
Function at 0x4201b5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, 2
js 0x43c478
mov bp, bp
mov word [esi + 0xbc], cx
jmp 0x43588a
sub edi, 0
shl dh, 0x20
jno 0x4163db
dec edx
sbb al, 0x20
inc eax
pop ds
fisttp dword [edi]
cmp dword [edx + 0x76], 0x1a05ffff
jno 0x40da5b
add eax, 0xbb86881a
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
pop dword [esp - 4]
mov byte [esi + 0xba], al
shr bh, 0x40
mov byte [esi + 0xbb], 0
jmp 0x413899
jne 0x4163cd
mov edi, edi
mov al, al
je 0x43589c
xor eax, eax
jb 0x436d16
Function at 0x425381
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
call edi
mov edi, eax
test edi, edi
jb 0x4383cb
je 0x42c755
jne 0x42539d
cpuid
cwde
ret
lea eax, [ebp - 4]
push eax
push str.SoftwareAladdinwinehasp
push SysStringLen
call ebx
and di, di
test eax, eax
jb 0x4383d5
jne 0x42c755
je 0x4253c5
ret 0xe727
jne 0x41262b
je 0x4253d1
nop
cpuid
ret 0x840f
je 0x41262b
fnstenv [ecx]
fbstp tbyte [eax + eax*8 - 0x14]

Function at 0x428e5b
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xchg ah, al
xchg al, ah
push ebp
shl ah, 0x20
mov ax, ax
mov ebp, esp
add eax, 0
jae 0x428e71
cpuid
nop
ret
jae 0x43999c
mov eax, dword [esi + 4]
push 0x41a707
ret

Function at 0x42a723
Capabilities:
Check for software breakpoints
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
in al, dx
stosb byte es:[edi], al
jmp 0x424cda
ja 0x42f10d
jbe 0x424ce4
dec esi
invalid
jbe 0x42f10d
mov edi, edi
xchg bh, bl
xchg bl, bh
push ebp
mov ebp, esp
sub esp, 0x130
jmp 0x424cfb
push ebx
push esi
ja 0x42ed2a
jbe 0x424d0c
shl byte [ebx + esi*4], 0x73
sahf
jbe 0x42ed2a
fcom dword [ebp - 0x75]
inc esi
add al, 0x8b
pop esi
or al, al
in eax, 0x20
ja 0x4399b1
jbe 0x42a730
sub esi, 0xfc88a27
xchg byte [ebx - 0xe], bh
add byte [eax], al
jbe 0x4399b1
ficom dword [ecx + 0xf]
or dword [ecx - 0x34], 0x270ffff
cwde
jg 0x42a752
cmp byte [edi], 0xcc
invalid
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
and dword [ebp + ebx], eax
jb 0x414550
jmp dword [esi]
mov esi, dword [ebp + 8]
push 0x43d3a8
ret
mov si, si
pushfd
test ecx, 0x6cc2a814
and esi, esi
jno 0x42f11f
cdq
mov edx, 0x810f4021
sub al, 0xb7
invalid
jno 0x41a851
fldcw word [edi + 0x424648d]
push ebp
mov bl, bl

Function at 0x42a7ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or ax, 0x5d8b
cmp byte [ebx + 0x4e8b0856], cl
add al, 0xf
mov byte [ecx + 0x79fffe71], bh
add bh, byte [0xaf890f5e]
jno 0x42a7aa
invalid
pop dword [esp - 4]
push esi
shl dh, 0x20
mov byte [esi + 0xba], cl
mov ecx, ecx
mov byte [esi + 0xbb], 0
shr di, 0x40
mov word [esi + 0xbc], dx
call fcn.0040536e
fidiv dword [ecx + ecx*4 - 0x8b6b]
dec dword [ecx - 0x7af0f7b3]
jbe 0x42a791
std
push dword [ebp + eax - 0x7c]
cmp dword [edi], ebp
mov esp, 0xe47d8b39
Function at 0x42dfea
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
or byte [edi + 0x419b48], 0x71
jbe 0x41e02b
add byte [ebp - 0x9ffbbdd], bl
fild word [ecx]
in eax, 0x48
fsubr qword [esi - 0x18]
popfd
and eax, dword [eax + eax + 0x71]
jbe 0x41e040
add byte [ecx + edi*2], dh
cmp al, 0
add byte [eax], al
add byte [eax], al
add byte [edi], cl
mov ch, cl
or dword [edx], eax
add byte [ecx + 2], bh
adc al, 0xc9
shl bl, 0x20
mov eax, dword [esi + 4]
xchg ah, dl
xchg dl, ah
mov ebx, dword [esi + 8]
movzx eax, word [ebp + eax]
lea esi, [esi + 0xc]
mov dword [ebp + ebx], eax
jmp dword [esi]
mov cx, cx
call fcn.00451330
test eax, eax
jb 0x41dfdf
jne 0x43a241
je 0x42e006
mov ds, word [ebp + esi*4 + 0x1c]
jmp 0x43b8d7
jne 0x43a241
call 0x43a251
call 0x4513a0
test eax, eax
jb 0x42820b
mov ch, ch
ja 0x43a228
jbe 0x43b8f2
imul ecx, dword [edi], 0x860fc3a2
xor cl, ch
invalid
jbe 0x43a228
fdivr dword [esi - 0x75]
je 0x43b932
add byte [esi - 0x79], ah
aad 0x66
xchg edx, ebp
mov edx, edx
mov esi, dword [esi]
jmp dword [esi]
inc eax
jmp dword [esi]

Function at 0x42e94b
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
xchg esp, eax
rcl dword [edi + 0x5f], 0x96
xchg esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
ja 0x41bf70
jbe 0x402a41
wait
stosd dword es:[edi], eax
jbe 0x41bf70
and eax, 0x202ba22
add al, byte [edx]
mov dword [ebp - 0x10], edx
push ebx
mov bh, 0xb8
pop ebx
mov dword [ebp - 0xc], edx
mov ebp, ebp
jmp 0x415c9d
push esi
xchg ecx, eax
xchg ecx, eax
lea eax, [ebp - 4]
push edi
lea ebx, [ebx]
lea ecx, [ebp - 0x214]
push eax
push ecx
push edx
call fcn.004081d1
xchg dl, cl
xchg cl, dl
mov esi, eax
add esp, 0xc
test esi, esi
jb 0x427da8
je 0x424fd2
jne 0x415cd8
cpuid
fadd st(3), st(0)
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov ax, word [ebp + eax]
lea esi, [esi + 0xc]
or word [ebp + ebx], ax
jb 0x435190
mov dx, dx
jmp dword [esi]
mov ah, 0xb5
js 0x401e43
jns 0x427db5
mov word [eax + 0x28], dx
mov ebx, dword [ebp + 0x10]
mov word [eax + 0x2a], cx
jno 0x43e6a2
jo 0x42c6b0
fimul word [ebx + 0x1e]
jo 0x43e6a2
invalid
push ebp
mov edi, edi
mov ebp, esp
add bp, 0x44e2
sub bp, 0x44e2
sub esp, 0x214
mov edx, dword [ebp + 0xc]
jmp 0x42e934
push ebx
ja 0x415c9c
jbe 0x42e943
cmp ch, byte [edx + 0xf934ac2]
xchg byte [ebx + 0x73], dl
invalid
jbe 0x415c9c
add byte [ecx], 0x8f
inc esp
and al, 0xfc
inc cl
mov dl, cl
lea ebx, [ebx]
shr dl, 7
shl cl, 1
or dl, cl
jb 0x42a29d
mov cl, dl
shr cl, 7
shl dl, 1
or cl, dl
jb 0x42a2a6
mov byte [esi + 3], cl
lea esi, [esi]
mov dx, word [eax + 0x28]
xor word [eax + 0x2c], dx
jb 0x42f24e
mov cx, word [eax + 0x2a]
mov dx, word [eax + 0x20]
xor word [eax + 0x2e], cx
jb 0x402a2b
mov cx, word [eax + 0x22]
js 0x42c69a
jns 0x42e9a7
mov dl, 0x65
xchg dword [ebx - 0x1276f020], ecx
fdiv st(7), st(0)
inc edi
outsd dx, dword [esi]
jns 0x42c69a
invalid
mov ecx, dword [ebp + 0xc]
Function at 0x433ca9
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + 0xc]
test word [ebp + ebx], ax
jb 0x4275cb
shr ah, 0x40
jmp dword [esi]
js 0x41ac42
jns 0x422848
adc byte [esi + 0xa], 0xe6
jns 0x41ac42
frstor dword [esi]
shr al, 0x40
ja 0x429411
jbe 0x4275dc
stosb byte es:[edi], al
pop es
xor eax, 0x2f860ff1
push ds
add byte [eax], al
jbe 0x429411
xchg bl, cl
xchg cl, bl
js 0x431b41
jns 0x429420
jns 0x431b41
pop dword [esp - 4]
mov ebx, dword [esi + 8]
js 0x42283c
jns 0x433cbc
cpuid
retf
jns 0x42283c

Function at 0x434089
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
js 0x441c5b
jns 0x434097
jns 0x441c5b
mov eax, dword [esi + 4]
mov eax, eax
mov eax, dword [ebp + eax]
shr di, 0x40
mov ebx, dword [esi + 8]
mov eax, dword [eax]
lea esi, [esi + 0xc]
mov dword [ebp + ebx], eax
jmp dword [esi]
Function at 0x4341df
Capabilities:
Authenticate hmac

Disassembly:
add esi, 4
xor ebx, ebx
jb 0x434015
xor edi, edi
jb 0x43407c
jmp 0x41febe
push ebp
mov ebp, esp
sub esp, 0x11c
lea eax, [ebp - 0x1c]
mov bx, bx
push esi
lea ecx, [ebp - 0x10]
push eax
lea edx, [ebp + 0xa]
jmp 0x41fed8
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edx
jmp 0x41fee3
push eax
push ecx
call fcn.0042b492
add esp, 0x14
test eax, eax
jb 0x433113
jne 0x40e0bd
je 0x41ff03
sal byte [edi - 0x77], 0xed
mov ebp, ebp
pop esi
mov esp, ebp
pop ebp
ret
in eax, 0xb0
jne 0x43404f
je 0x433123
adc dword [esi - 0x55], ecx
js 0x4330f4
lahf
je 0x43404f
xor dword [ecx + 0xe8bdb88], ebx
or di, di
add esi, 4
test ecx, 0x1000
jb 0x43422a
jne 0x417abc
je 0x433ac3
mov ax, ax
fld dword [ebp + 0x412850f]
invalid
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [ebp + eax]
jne 0x43a270
je 0x434066
cmp dword [edx], 0xffffffef
sbb ecx, dword [edi]
test byte [edx], al
add byte [eax], al
je 0x43a270
pushfd
test edi, esp
jno 0x434076
jmp fcn.004340df
jno 0x404366
fcomp dword [esi + 0x3cf5c939]
add ch, al
adc ebp, dword [ebx]
add byte [eax], al
pop dword [esp - 4]
fidiv dword [ebx + 0x438c05]
adc al, 0x8c
cdq
mov ch, 0x43
add byte [edx], al
add byte [eax], al
add byte [eax + eax], ah
add byte [eax], al
jns 0x4341df
inc ebx
add byte [edx + 0x1b0043da], bh
adc al, 0x43
add byte [ebx + 0x42], dl
inc ebx
add byte [ecx], dl
lodsd eax, dword [esi]
stosd dword es:[edi], eax
outsd dx, dword [esi]
adc cl, dh
inc edx
add byte [eax], al
popal
add byte [eax + 0x28], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
sub al, 0
add byte [eax], al
sub al, 0x42
add byte [eax], dl
int1
inc edx
add byte [eax], al
popal
add byte [eax + 0x28], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc al, byte [eax]
add byte [eax], al
inc edx
add byte [eax], al
and al, 0
add byte [eax], al
mov esi, 0x24004083
mov byte [ebx], 0x3c
add byte [eax], al
add byte [eax], ch
add byte [eax], al
add byte [esi + eax*8], ah
inc ebx
add byte [eax], ch
add byte [eax], al
add byte [eax + eax], bh
add byte [eax], al
fsub qword [eax + 0x43]
add byte [ecx], cl
add byte [eax], al
add byte [eax + eax], ch
add byte [eax], al
test dword [0x70042], 0x240000
add byte [eax], al
inc eax
insd dword es:[edi], dx
inc edx
add byte [eax], al
add byte [eax], al
add byte [0xf7000000], ah
push edx
inc ecx
add byte [eax + eax], ah
add byte [eax], al
sub al, 0
add byte [eax], al
nop
cli
inc edx
add byte [0x8c004314], ch
std
inc ebx
add byte [edx], al
adc al, 0x40
add byte [ebp + edx*4 + 0x41], bl
add ch, bh
inc edx
inc ebx
add bl, cl
outsd dx, dword [esi]
pop esp
xchg ebp, eax
inc ecx
add byte [edx], al
adc al, 0x40
add byte [ebp - 0x3b09f38a], cl
push esi
xchg bh, cl
xchg cl, bh
lea esi, [esi + 0xc]
sub ebx, 0
shl al, 0x20
jae 0x43a282
jae 0x43f48f
test dword [ebx], eax
jb 0x433a9e
call fcn.0042f921

Function at 0x435a3a
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
add dh, 0xba
sub dh, 0xba
cmp al, 0x53
jmp 0x407aae
Function at 0x438abf
Capabilities:
Get file size

Disassembly:
mov eax, eax
push ebp
shr edi, 0x40
mov ebp, esp
mov ecx, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xchg ecx, eax
xchg ecx, eax
mov ecx, dword [ebp + 8]
test eax, 0xb30c5415
test ecx, ecx
jb 0x42320d
je 0x438afd

Function at 0x43e767
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [ebp + 0xc]
push esi
jne 0x42d1e1
je 0x43e77c
nop
cpuid
ret 0x840f
je 0x42d1e1
xor ch, 0xf
test dword [edx], esi
xchg ebx, eax
std
dec dword [eax + 0x280474d2]
fisttp qword [ebx + 0x24]
mov ax, ax
jmp fcn.00433ac6

Function at 0x440a57
Capabilities:
Encode data using base64

Disassembly:
call 0x42d202
add eax, 0xfc085a3
add byte [esi + 0x36], 0
add byte [ebx + 0x50bda3], ah
lea esp, [esp + 4]
jmp 0x41a6a4

Function at 0x444860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebp
xor ebp, ebp
test eax, eax
jle 0x4448ef
mov eax, dword [esp + 0x10]
push ebx
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
lea esp, [esp]
inc ecx
and ecx, 0x800000ff
jns 0x444891
dec ecx
or ecx, 0xffffff00
inc ecx
movzx ecx, cl
movzx edx, byte [ecx + eax]
add edx, esi
and edx, 0x800000ff
jns 0x4448aa
dec edx
or edx, 0xffffff00
inc edx
movzx esi, dl
mov bl, byte [esi + eax]
mov dl, byte [ecx + eax]
mov byte [ecx + eax], bl
mov byte [esi + eax], dl
movzx edx, byte [ecx + eax]
movzx ebx, byte [esi + eax]
add edx, ebx
and edx, 0x800000ff
jns 0x4448d3
dec edx
or edx, 0xffffff00
inc edx
movzx edx, dl
mov bl, byte [edx + eax]
mov edx, dword [esp + 0x14]
xor byte [edi + edx], bl
mov edx, dword [esp + 0x18]
inc ebp
movsx edi, bp
cmp edi, edx
jl 0x444880
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x444900
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
mov ecx, edi
lea esp, [esp]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x444910
xor dl, dl
xor ecx, ecx
mov esi, edi
mov ebp, 0x100
mov eax, dword [esp + 0x14]
movzx ebx, byte [esi]
movzx edx, dl
movzx eax, byte [edx + eax]
sub eax, ebx
add eax, ecx
and eax, 0x800000ff
jns 0x444945
dec eax
or eax, 0xffffff00
inc eax
movzx ecx, al
mov al, byte [esi]
mov bl, byte [ecx + edi]
mov byte [esi], bl
mov byte [ecx + edi], al
lea eax, [edx + 1]
cdq
idiv dword [esp + 0x18]
inc esi
dec ebp
jne 0x444925
pop edi
pop esi
pop ebp
pop ebx
ret