joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43be90
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43bec3
push esi
call fcn.0043ef80
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43bebc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43bf49
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43bf32
mov eax, dword [esi + 8]
test eax, eax
je 0x43bee7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43bf2e
cmp eax, 2
je 0x43bf32
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43beda
cmp eax, 3
je 0x43bf0d
cmp eax, 1
jne 0x43beda
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43beda
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43beda
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043bf70
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43bf58
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043bf70
add esp, 4
pop esi
ret

Function at 0x45a4aa
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45a4e2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045855e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00458536
jmp 0x45a4ee
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45bb98
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45bbda
call fcn.00461670
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45bbda
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45bbd1
xor eax, eax
jmp 0x45bbe2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045bbe8
pop edi
pop esi
pop ebx
ret 4

Function at 0x461ba0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x461bce
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x461bec
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00461b06
jmp 0x461bec
mov eax, dword [esi + 0x14]
test eax, eax
je 0x461bec
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00461b06
test edi, edi
mov eax, edi
jne 0x461bd6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x8db3d2
Capabilities:
Authenticate hmac

Disassembly:
jae 0x90763b
jb 0x90763b
aam 0xbd
inc ebx
sal dword [esi - 0x52d168bb], cl
cmp eax, 0xc466b744
inc edx
shr al, 1
enter 0x12b, 0
mov bl, 0xd6
and eax, 0xb929a9a4
fsubr dword [ebx]
stc
inc ebp
pushal
xchg si, dx
popal
push ax
lea esp, [esp]
mov word [esp], ax
pushal
pushfd
push cx
lea esp, [esp + 0x28]
lea esp, [esp + 4]
pushal
not al
popal
push edi
mov dword [esp], esp
push si
push word [esp]
push word [esp + 4]
mov byte [esp + 8], dh
pushfd
mov word [esp + 1], bx
push bx
pushal
lea esp, [esp + 0x30]
jmp 0x907439
Function at 0x8e4248
Capabilities:
Encode data using xor

Disassembly:
call 0x8e413a
jo 0x8e4264
jno 0x8e4264
dec eax
mov ebx, 0xc555d469
lodsb al, byte [esi]
pop edi
lahf
les eax, [edx + ebx*8 - 0x43]
dec esp
cwde
salc
push ebp
lds ebp, [edi + ebx*2 + 0x63f36b8e]
pushal
jo 0x8e4280
jno 0x8e4280
out dx, eax
mov bh, byte [ecx]
cmp al, 0xbe
sub al, 0x4b
invalid
setne ch
jno 0x8e429c
jo 0x8e429c
xor dword [eax - 0x5d], edx
jge 0x8e4287
push 0xeb7dfa0f
psubd mm7, qword [ebp - 0x15]
outsd dx, dword [esi]
call [edx + 0x5cdfa769]
xchg ebp, eax
mov eax, dword fs:[esp]
mov eax, dword [esp]
jb 0x8e42b8
jae 0x8e42b8
jnp 0x8e429f
push 0xae29fa0f
sub byte [esi - 0x5850d727], bh
and byte [esi + 0x45a720d1], dh
lds edx, [ebp + 0x66]
bswap ecx
bswap cx
jl 0x8e42d4
jge 0x8e42d4
push esi
xchg esp, eax
loopne 0x8e4323
not byte [ecx + 0xf88b460]
lahf
cli
or esp, eax
pop es
xchg dword [edi], edx
jb 0x8e4253
or byte [edi + 0x70197161], dh
pop ss
popal
jno 0x8e42f0
jo 0x8e42f0
setae byte [ebx]
xchg bp, ax
inc ebx
mov al, 0x31
mov eax, dword [0xccf333c0]
dec esp
ret 0x54a5
pushfd
je 0x980f58
jne 0x980f58
push es
test byte [edx], bl
jge 0x8e428e
pop esp
idiv byte [ebx - 0x15]
invalid
arpl word [esi], ax
push bx

Function at 0x8e4a39
Capabilities:
Parse pe header

Disassembly:
jl 0x98311d
jge 0x98311d
retf
pushal
mov edi, edx
mov al, byte [esp]
xchg cx, di
popal
pushfd
pushfd
mov byte [esp + 3], cl
mov word [esp], sp
pop dword [esp]
push edi
mov word [esp + 2], bx
lea esp, [esp + 8]
mov edi, edi
push ebp
mov ebp, esp
push edx
pushal
not edi
mov ah, dh
xchg esi, ebx
xchg bh, dl
bswap edi
lea edx, [edx + ebp]
bswap edx
xchg ah, bh
lea edx, [eax + 0x3506]
mov dword [esp + 0x14], ebp
push esi
push dword [esp + 3]
mov dword [esp + 3], esp
pop dword [esp]
lea esp, [esp + 4]
popal
lea edx, [edx + 8]
mov eax, dword [edx]
pop edx
push esi
pushal
mov cx, di
mov bl, 0x6b
lea edx, [eax + ecx]
xchg esi, edi
xchg di, bp
setge dh
mov dword [esp + 4], eax
push bp
pushal
push word [esp + 0x13]
lea esp, [esp + 0x24]
jp 0x983231
jnp 0x983231
insd dword es:[edi], dx
in al, dx
bound eax, qword [0xf2be27f4]
sbb eax, edx
sbb eax, 0xc8b600a
and al, 0x66
mov eax, ecx
pushal
mov ecx, dword [esp]
mov ax, cx
mov bp, 0x7625
popal
push sp
lea esp, [esp]
pushal
mov byte [esp + 1], ah
pop dword [esp + 0x11]
mov dword [esp + 0x12], esp
push word [esp + 0xc]
mov dword [esp + 0x1a], ecx
mov byte [esp + 2], bh
mov dword [esp + 0x13], edi
push dword [esp + 0xf]
mov byte [esp + 3], dl
mov byte [esp + 0xa], dl
lea esp, [esp + 0x24]
lea esp, [esp + 4]
pushal
mov bx, bp
mov dh, bl
mov ebp, eax
jl 0x9834a8
jmp 0x9834a8
popal
lea esi, [esi + 0x3c]
popal
push edi
push sp
push dword [esp + 5]
lea esp, [esp + 6]
mov dword [esp], ebx
mov byte [esp + 2], bh
lea esp, [esp + 2]
mov byte [esp], bl
push word [esp]
pop word [esp]
lea esp, [esp + 1]
push ebp
push ax
mov word [esp + 4], sp
lea esp, [esp + 3]
lea esp, [esp + 4]
jmp 0x983088
Function at 0x8e4a79
Capabilities:
Parse pe header

Disassembly:
jbe 0x8e4a95
ja 0x8e4a95
les esi, [edi]
imul dword [ebx - 0x17]
jns 0x8e4a9c
jmp 0x8e4ac3
pushal
jae 0x983485
jb 0x983485
aaa
imul dword [esi - 0x12]
jl 0x8e4ac3
mul byte [edx]
mov word [ebx], ss
and esi, 0x15
sal byte [edi + 0x31c2a737], 0xb8
mov word [edi - 0x34], ds
int3
int3
and al, 0x66
push ebp
pushal
lea esp, [esp + 0x20]
popal
push si
js 0x9834fb
jns 0x9834fb
cmc
jno 0x983475
xor byte [ebx - 0xa], 0x9b
sbb al, 0xb2
aad 0x24
mov dword [0x6f089a18], eax
lcall 0x2525, 0xdbeb5c4a
mov word [esp], dx
mov byte [esp], bl
push word [esp]
push word [esp + 2]
pop word [esp + 1]
mov dword [esp], esi
lea esp, [esp + 2]
lea esp, [esp + 2]
lea esp, [esp + 4]
jno 0x983c87
jmp 0x983c87
pushal
mov bp, sp
Function at 0x8ff2c6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
pushal
mov ecx, 0xdb12172
popal
push esp
mov dword [esp], esi
mov byte [esp + 2], bh
mov word [esp], ax
push edx
push dword [esp + 5]
mov byte [esp + 4], al
lea esp, [esp + 9]
push word [esp + 2]
lea esp, [esp + 2]
mov byte [esp + 1], bh
lea esp, [esp + 3]
pushal
lea eax, [eax + 0x326050b4]
popal
push edx
mov byte [esp], cl
mov dword [esp], ebx
push ebx
push dword [esp + 3]
pushfd
push sp
mov dword [esp + 7], ebp
push word [esp + 9]
push dword [esp + 2]
pop dword [esp + 5]
lea esp, [esp + 0x14]
jmp 0x8dac5d

Function at 0x8ff615
Capabilities:
Encode data using xor

Disassembly:
call fcn.008dad82
lea esp, [esp + 1]
lea esp, [esp + 4]
pushal
lea ebx, [eax + edx]
popal
push esp
mov dword [esp], esp
mov dword [esp], ecx
mov dword [esp], ecx
push dword [esp + 1]
jae 0x8ff687
jb 0x8ff687
rol byte [eax - 0x2a], 0xb1
inc eax
xchg esp, eax
invalid
push cx
push word [esp + 1]
jl 0x8ff562
jge 0x8ff562
dec esi
enter 0x395e, 0xffffffffffffffc8
dec edi
arpl sp, sp
jp 0x8ff5ca
in al, dx
imul edx, edi, 0x5b
retf
lea esp, [esp]
mov word [esp], si
mov word [esp], bx
mov byte [esp], ch
push word [esp]
pop word [esp]
and al, 0x66
pop dword [esp]
push word [esp + 1]
pop word [esp]
lea esp, [esp + 1]
jl 0x8ff598
jge 0x8ff598
mov edi, 0x44b5d23c
xchg ah, bh
jl 0x8ff5fb
jne 0x8ff56f
push eax
push es
test dword [0x4e5e8f7c], edx
adc eax, 0x4e5e8f7c
dec ebx
std
pop edx
pushal
popal
push dx
jne 0x8ff5b9
mov ebp, 0x1b93bb74
mov ebp, esi
sbb eax, 0xc650d79c
mov eax, dword [0xfb77d750]
imul ecx, dword [esi], 0xfffffffd
sub esi, esi
loope 0x8ff5ee
je 0x8ff5b9
xchg ebx, eax
sbb ecx, dword [ebx - 0x2863e212]
push eax
invalid
in eax, dx
sub byte [eax - 0x73], ah
pushal
lea ebx, [eax + 0x116d]
popal
push edx
pop word [esp]
push edx
mov byte [esp], bh
push word [esp + 4]
push word [esp + 4]
pop dword [esp]
push dword [esp + 1]
lea esp, [esp + 3]
lea esp, [esp + 4]
pushfd
mov word [esp + 4], dx
lea esp, [esp + 3]
lea esp, [esp + 4]
pushal
sete ah
popal
push edi
mov word [esp + 1], dx
push word [esp + 3]
push word [esp + 4]
pushal
mov byte [esp + 0x14], dh
push word [esp + 0x1c]
lea esp, [esp + 2]
lea esp, [esp + 0x28]
jmp 0x8dadad
push dword [esp + 7]
lea esp, [esp + 0xb]
pushfd
mov byte [esp + 1], dh
mov word [esp], di
lea esp, [esp + 1]
lea esp, [esp + 4]
jmp fcn.008dad6c

Function at 0x8ffc89
Capabilities:
Authenticate hmac
Hash data with md5

Disassembly:
pushal
mov edx, 0x983abd
jae 0x8ffe3a
jb 0x8ffe3a
invalid
push word [esp + 1]
mov byte [esp + 7], bl
pushal
mov byte [esp + 5], dl
mov dword [esp + 0x23], edi
mov word [esp + 0xb], sp
mov dword [esp + 1], ebx
lea esp, [esp + 2]
lea esp, [esp + 0x28]
jmp fcn.008db3cd
mov edx, 0x29fa3740
mov ebp, esi
popal
pushal
push si
push ebp
mov dword [esp + 2], esi
mov byte [esp + 0x22], ah
lea esp, [esp + 2]
lea esp, [esp + 0x24]
pushal
xchg dh, ah
push edx
pop bp
lea esp, [esp + 2]
popal
push eax
pop word [esp]
mov byte [esp], dh
mov byte [esp], dl
push ebp
push word [esp + 2]
jle 0x8ffd9b
jg 0x8ffd9b
dec esi
enter 0x395e, 0xffffffffffffffc8
dec edi
cmp ah, byte [edx]
invalid
cmc
push esi
invalid
Function at 0x9000a5
Capabilities:
Authenticate hmac

Disassembly:
pushal
mov ax, 0x4b31
popal
pushfd
pushfd
push dword [esp + 3]
jno 0x900114
jo 0x900114
inc eax
ret 0x3750
mov word [esp + 1], dx
lea esp, [esp + 2]
push di
jg 0x900234
jle 0x900234
or dword [ecx + 0x598b7819], ecx
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
imul eax, ecx, 0x24448f86
add edi, edi
je 0x90013f
pop dword [esp + 1]
push dword [esp + 7]
pop es
mov word [esp], dx
mov word [esp], sp
push dword [esp + 0xa]
push dword [esp + 9]
lea esp, [esp + 0x14]
pushal
setp cl
popal
push esi
mov word [esp + 1], bp
mov word [esp + 1], dx
mov dword [esp], eax
jle 0x9000ef
add dword [ecx - 0x5581dbfc], ecx
jg 0x9000ef
sub ebp, dword [ecx + 0x7dab5839]
pop ebx
fimul dword [eax + 0x2f]
fimul dword [ecx]
mov al, 0x36
movsb byte es:[edi], byte [esi]
ret
push dword [esp + 1]
lea esp, [esp + 8]
jmp fcn.008db3fe

Function at 0x90015c
Capabilities:
Authenticate hmac
Encrypt data using aes
Reference aes constants

Disassembly:
call fcn.008dbb9d
push dword [esp + 3]
lea esp, [esp + 8]
jmp fcn.008db3fe
pushal
mov di, ax
mov dh, 3
mov bx, word [esp]
popal
push bp
mov word [esp], sp
push word [esp]
xor al, 0x24
lea esp, [esp]
push dword [esp + 1]
pushfd
lea esp, [esp + 6]
mov byte [esp + 2], bh
push dword [esp]
push esp
mov word [esp + 6], dx
lea esp, [esp + 2]
pop dword [esp + 3]
lea esp, [esp + 8]
pushal
mov al, 0x30
xchg si, dx
mov ebx, dword [esp]
popal
push eax
push cx
push dword [esp]
mov dword [esp + 1], edx
pop word [esp + 1]
pop dword [esp]
mov word [esp], si
jge 0x9000cd
jl 0x9000cd
xchg esi, eax
pop ss
xchg edx, esp
adc dword [eax + 0x79f2a44c], ebx
jl 0x900170
pop word [esp]
mov word [esp], cx
lea esp, [esp + 2]
jmp 0x8dca86
Function at 0x900354
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc edx
call fcn.008dcc0b
jns 0x90a15b
js 0x90a15b
sbb byte [eax - 0x17], ch
jns 0x8dce1d
jmp 0x8dce32
pop ecx
loopne 0x8dcde1
sub ecx, dword [ebx - 0x18]
int 0xff
invalid
xchg bh, bh
je 0x8dce5a
add al, 0x83
rol dword [eax + edi*4], 0x88
or al, byte [eax]
add al, ch
into
xor eax, dword [edx]
add byte [ecx + 0x33], bl
rol bl, 0xe8
stc
xor al, 2
add al, ch
dec esi
rol byte [edx], cl
add al, ch
adc dword fs:[ecx], eax
add byte [edi], ch
lcall 0x22a2, 0x589a6f08
mov al, 0xd7
and dh, dh
aad 0x7d
call 0x90a2b7
pushal
setg al
not dx
mov bh, 0x33
popal
push di
mov byte [esp], dl
push bp
jp 0x9003b4
jnp 0x9003b4
or ecx, dword [ecx + 0x5d8b7819]
mov ch, 0x25
dec esp
mov edi, 0xde48ce6e
mov ecx, 0x42b0cf48
sub al, 0x3e
lea esp, [esp + 2]
push word [esp]
mov dword [esp], edi
lea esp, [esp + 4]
pushal
bswap esi
popal
pushfd
mov byte [esp + 1], cl
mov word [esp], si
push word [esp + 3]
lea esp, [esp]
push dword [esp + 4]
lea esp, [esp + 2]
lea esp, [esp + 8]
jmp 0x8dcdef
pushal
mov bp, di
mov bh, 0x31
xchg dh, dl
popal
push ax
mov byte [esp], dh
mov byte [esp], bh
mov word [esp], bp
mov word [esp], di
pushfd
lea esp, [esp + 2]
lea esp, [esp + 4]
mov dword [eax], 5
add eax, 4
call fcn.009000a5
xor eax, eax
ret
pushal
mov bp, sp
push cx
xchg dl, bl
lea esp, [esp + 2]
popal
pushfd
lea esp, [esp]
push word [esp + 3]
push edx
mov dword [esp], ebp
mov byte [esp], ch
mov byte [esp], al
push word [esp + 5]
lea esp, [esp + 0xc]
lea esp, [esp + 4]
pushal
bswap edi
mov bl, byte [esp]
popal
push si
mov word [esp], ax
mov word [esp], di
push word [esp]
mov dword [esp], eax
mov byte [esp + 2], cl
pushfd
mov dword [esp + 1], ebp
mov word [esp + 4], sp
mov byte [esp + 5], al
mov byte [esp + 5], al
lea esp, [esp + 3]
mov word [esp + 2], cx
lea esp, [esp + 1]
lea esp, [esp + 4]
jmp 0x90a0dc

Function at 0x900459
Capabilities:
Encrypt data using aes
Reference aes constants
Resolve function by parsing pe exports

Disassembly:
call fcn.008dbb0d
jmp 0x8dbb98

Function at 0x90046c
Capabilities:
Authenticate hmac

Disassembly:
pushal
xchg ebx, eax
popal
push edx
mov dword [esp], ebp
lea esp, [esp]
lea esp, [esp + 3]
jg 0x900507
jle 0x900507
or dword [ebx], 0xffffff9b
dec byte [0xe981f8c]
imul ebx, dword [eax - 0x7227f1e1], 0x8d012464
and al, 0x24
lea esp, [esp]
lea esp, [esp]
mov byte [esp], dl
lea esp, [esp]
lea esp, [esp]
mov byte [esp], bh
lea esp, [esp + 1]
jmp 0x8dbb08
mov byte [esp], cl
pushfd
mov dword [esp], esi
mov word [esp + 1], bp
push dword [esp + 3]
lea esp, [esp + 1]
lea esp, [esp + 8]
pushal
mov bx, word [esp]
popal
push si
mov word [esp], ax
push word [esp + 1]
push dword [esp + 3]
push word [esp + 5]
push sp
mov word [esp + 7], bp
push word [esp + 6]
pushfd
mov word [esp + 0xb], cx
lea esp, [esp + 2]
lea esp, [esp + 0x10]
jmp fcn.008db3fe
Function at 0x9004cd
Capabilities:
Authenticate hmac

Disassembly:
pushal
mov cx, di
bswap ecx
popal
pushfd
lea esp, [esp + 3]
mov byte [esp], bl
lea esp, [esp]
mov byte [esp], dh
mov byte [esp], cl
lea esp, [esp]
mov byte [esp], ch
mov byte [esp], ah
jg 0x900575
jle 0x900575
cmpsd dword [esi], dword es:[edi]
mov ah, 0xd3
std
in eax, dx
imul edi, ecx, 0xf0ee6b98
add al, 0x3c
out 0x88, eax
or al, 0x24
lea esp, [esp + 1]
jne 0x900b1c
je 0x900b1c
sbb al, 0x99
or dword [eax - 0x65], ebp
push ds
dec esp
into
pop esp
cmp edx, esi
push es
mov dword [ebp + 0x248d2424], ecx
and al, 0x8d
and al, 0x24
lea esp, [esp]
lea esp, [esp]
lea esp, [esp]
jnp 0x900558
jp 0x900558
ret 0xd747

Function at 0x900620
Capabilities:
Encrypt data using aes
Reference aes constants
Resolve function by parsing pe exports

Disassembly:
pushal
mov edx, dword [esp]
xchg dh, cl
popal
pushfd
mov dword [esp], esp
mov byte [esp + 2], dl
mov byte [esp], dh
mov byte [esp], dh
pop word [esp]
push word [esp + 1]
jae 0x9006c0
jb 0x9006c0
pop ss
xchg esi, eax
add al, 0x63
sahf
dec ebp
pop esi
fmul dword [esi + 0x29]
fcomp dword [edi - 0x1b]
lcall 0x5624, 0x2c8a602a
pushal
mov ch, byte [esp]
push esi
push dword [esp + 3]
lea esp, [esp + 8]
pushal
mov bx, 0x5ae8
popal
pushfd
push dword [esp + 1]
pop dword [esp]
mov byte [esp], ah
mov dword [esp], ebp
mov byte [esp + 2], dl
push dword [esp + 3]
lea esp, [esp + 8]
jmp fcn.008dd624

Function at 0x900655
Capabilities:
Encrypt data using aes
Reference aes constants
Resolve function by parsing pe exports

Disassembly:
pushal
mov ch, byte [esp]
push esi
mov dh, bh
lea esp, [esp + 4]
popal
push cx
push word [esp + 1]
push word [esp + 2]
pop word [esp + 1]
push dword [esp + 1]
mov dword [esp + 1], eax
lea esp, [esp + 8]
pushal
mov al, 0xc9
mov bl, 0x6e
mov ebx, dword [esp]
popal
push bp
mov byte [esp], dl
push esp
pop word [esp]
pushfd
lea esp, [esp + 8]
jmp 0x8dbb98

Function at 0x900710
Capabilities:
Hash data with md5

Disassembly:
call fcn.008db427
pop word [esp + 0x11]
mov byte [esp + 9], bl
je 0x900754
jmp 0x900754
pushal
mov cx, word [esp]
mov bx, 0x3936
popal
pushal
pop word [esp + 6]
mov word [esp], sp
mov byte [esp + 8], cl
mov dword [esp + 0x18], edx
push dword [esp + 0xe]
or byte [ecx - 0xe7dbac], cl
je 0x900754
push cs
ja 0x9006ee
jbe 0x9006ee
add byte [esi], 0x94
push cs
mov ebx, esi
je 0x900728
lea edi, [ebx + edi*8 + 0x5b]
fisttp word [edi + 0x2a]
fnstenv [edi]
invalid
invalid

Function at 0x901236
Capabilities:
Get number of processors

Disassembly:
mov edi, dword [esp]
not dx
popal
pushal
lea esp, [esp + 0x1b]
lea esp, [esp + 1]
push word [esp + 1]
push dword [esp]
pop dword [esp]
push word [esp + 2]
lea esp, [esp + 8]
jmp 0x8deddd
pushal
bswap ebp
setp dl
xchg esi, edi
xchg dx, di
popal
pushal
mov word [esp + 0x1b], dx
push word [esp + 8]
lea esp, [esp + 0x17]
lea esp, [esp + 5]
lea esp, [esp + 2]
lea esp, [esp + 4]
pushal
xchg ebp, esi
lea eax, [edx - 0x92b]
jne 0x901129
je 0x901129
in al, 0x64
cli
popfd
insb byte es:[edi], dx
mov eax, 0xddba24a5
sub al, 0xff
sub al, byte [0x8df88a60]
pushal
mov bh, al
lea eax, [ebx + ebp]
Function at 0x902821
Capabilities:
Parse pe header

Disassembly:
sub edi, edi
jno 0x8e4f24
push dword [ecx + 0x18]
push dword [ecx + 0x28]
call fcn.00902e09
add esp, 0xc
pop ebp
ret 4
call fcn.00983d6a
call 0x8e4f54
jg 0x985d84
jle 0x985d84
jb 0x8e4f04
xlatb
cld
mov dword [esp], esi
lea esp, [esp]
mov byte [esp], al
push dword [esp + 2]
pop dword [esp]
mov byte [esp + 1], ch
lea esp, [esp + 2]
lea esp, [esp]
push ax
pop word [esp]
lea esp, [esp + 2]
jmp 0x8e4f4a
pushal
xchg di, ax
popal
pushfd
pop word [esp]
mov byte [esp], al
lea esp, [esp + 1]
push eax
mov dword [esp], eax
push word [esp]
pop word [esp]
lea esp, [esp + 1]
lea esp, [esp + 4]
pushal
bswap bx
popal
push edi
mov byte [esp + 1], ch
jne 0x902794
je 0x902794
and byte [edx + 0x72a25730], ah
in al, 0x65
cmc
pushfd
outsd dx, dword [esi]
scasd eax, dword es:[edi]
test al, 0x60
pushal
neg dword [edi]
ret

Function at 0x902869
Capabilities:
Parse pe header

Disassembly:
pushal
push si
lea esp, [esp + 1]
lea esp, [esp + 1]
popal
pushal
pushal
push edi
push ebp
pop dword [esp + 0x29]
push dword [esp + 0x42]
pop word [esp + 0x41]
push dword [esp + 7]
pushfd
push word [esp + 0x2c]
pop dword [esp + 0x38]
mov dword [esp + 0x3d], ebp
lea esp, [esp + 0x4c]
pushal
bswap ebp
popal
push si
mov byte [esp], bh
lea esp, [esp]
push ax
mov word [esp + 1], di
mov byte [esp], al
push di
push dword [esp + 2]
mov dword [esp + 1], edx
push dword [esp + 1]
pop dword [esp]
pop word [esp + 1]
lea esp, [esp + 8]
jmp fcn.008e4ac4

Function at 0x9029eb
Capabilities:
Encode data using xor

Disassembly:
mov ebp, edx
mov esi, ecx
mov eax, ecx
push 1
call 0x902ebe
xor eax, eax
xor ebx, ebx
mov word [esp], cx
jb 0x902a98
jae 0x902a98
stosb byte es:[edi], al
sub dword [ecx + 0x70fa2bd8], edi
mul byte [ebx + eax - 2]
jns 0x902a04
mov byte [esp], ch
mov byte [esp], cl
push word [esp + 1]
jge 0x9029ab
jl 0x9029ab
and eax, 0xa25730a2
and eax, 0xc1a630b2
xor al, ah
jno 0x9029d7
pushal
pop es
xor byte [esi + 0x43], al
pushal
mov ebx, 0x5eb04b9e
mov ah, 0xba
popal
push sp
jmp 0x9029c8
nop
inc ebx
sub al, 0xaa
cmp byte [edi - 0x56], bl
sub eax, 0xd24f8e83
mov al, byte [0x48f9c21]
and al, 0x66
mov dword [esp], ebp
lea esp, [esp + 2]
jmp 0x8e4f31
mov dword [esp], eax
lea esp, [esp + 4]
pushal
mov cx, ax
not dl
popal
push di
push word [esp + 1]
push dword [esp + 3]
pushfd
pop word [esp + 7]
lea esp, [esp + 8]
mov word [esp], cx
mov byte [esp], ch
mov byte [esp], ch
mov word [esp], cx
jns 0x902a78
js 0x902a78
mov dl, 0x3b
stosd dword es:[edi], eax
into
cmp eax, 0xe171f1bc
xor byte [ebx - 0x5f], 0xc6
dec ebx
fstp xword [esi + 0x7a9894d]
push eax
Function at 0x902e09
Capabilities:
Parse pe header

Disassembly:
pushal
mov bx, word [esp]
mov di, word [esp]
lea ebp, [edx + esi]
popal
push esi
mov dword [esp], edx
push ebx
pushal
mov word [esp + 0x25], bp
pop word [esp + 0x1b]
mov word [esp + 0x23], bp
mov byte [esp + 0x13], dl
push word [esp + 0x18]
pushal
push dword [esp + 8]
mov byte [esp + 0x26], bh
push word [esp + 0x24]
lea esp, [esp + 2]
lea esp, [esp + 0x4c]
pushal
xchg bh, ch
mov ah, bh
xchg bp, si
popal
pushfd
push dword [esp + 2]
lea esp, [esp + 1]
mov word [esp + 3], cx
mov byte [esp], dl
pushal
pop word [esp + 0xa]
lea esp, [esp + 8]
mov dword [esp + 0xa], ecx
mov byte [esp], bl
pop dword [esp + 4]
lea esp, [esp + 1]
jmp 0x902ee0
lea esp, [esp + 0x18]
jmp 0x8e4e28

Function at 0x902ec3
Capabilities:
Parse pe header

Disassembly:
pushal
bswap cx
jmp 0x902f62
lea esp, [esp + 4]
popal
pushal
jns 0x9030a4
jmp 0x9030a4
pushfd
mov dword [esp], edx
pop word [esp + 1]
push dword [esp + 1]
pop dword [esp]
mov word [esp + 1], sp
mov byte [esp + 1], al
lea esp, [esp + 4]
pushal
not cl
pushfd
setae dl
js 0x902f03
jns 0x902f03
pop ebp
fdiv qword [edx + 0x15]
in al, 0x37
push ss
nop
push es
popal
nop
pop ss
dec esp
leave
pop ecx
cmp bl, cl
dec esi
invalid
mov bp, ax
not al
popal
push esi
pop word [esp]
mov word [esp], bp
jns 0x902f24
js 0x902f24
xor eax, 0xbf4c25b5
insd dword es:[edi], dx
les eax, [ebp - 0x2b]
mov esp, 0x9e1e8f4f
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
jb 0x902f7c
inc ebp
aad 0xbc
dec edi
invalid
add al, 0x7b
ror byte [ebp - 0x7899aca5], 1
invalid
pushfd
mov word [esp + 0x12], bx

Function at 0x90a98b
Capabilities:
Encode data using base64

Disassembly:
pushal
mov di, word [esp]
lea ecx, [esi - 0xaf]
popal
pushal
push word [esp + 0x1c]
push dword [esp + 9]
pop word [esp + 9]
pushfd
lea esp, [esp + 0x28]
lea esp, [esp + 4]
jb 0x90aa28
jae 0x90aa28
push 0xffffffffffffffe9
jns 0x90a9cf
jmp 0x90a9f3
and al, 0x12
inc edi
xchg ebp, eax
or dword [edx + 0x488a7f18], ecx
or al, 0x8c
add ah, byte [ebp - 0x6c]
inc eax
cmc
dec eax
push 0x25
pushal
push bp
push word [esp]
jns 0x90aa4e
js 0x90aa4e
insb byte es:[edi], dx
out dx, al
jl 0x90aa52
mul byte [esi]
jmp 0x90aab7
lea esp, [esp + 4]
popal
pushfd
pop word [esp]
mov byte [esp], dh
push word [esp]
mov byte [esp], dl
push edx
mov dword [esp + 1], edi
pop word [esp + 1]
pushal
push dword [esp + 0x12]
jp 0x90ab25
jnp 0x90ab25
sub al, 0xb3
and eax, dword [esi - 0x4b]
pushal
cmp bh, byte [edx + edx*2 - 0x42bc3bcb]
mov word [esp + 1], cx