joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f78d92
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f78db4
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f78db4
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f78db4
ret
cmp word [ebx + 4], 0x14c
jne 0x4f78db4
test word [ebx + 0x16], 2
je 0x4f78db4
test word [ebx + 0x16], 0x100
je 0x4f78db4
cmp word [ebx + 0x18], 0x10b
jne 0x4f78db4
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f78db4
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f78e40
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f78dd4
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.04f5fd1f
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f78db4
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x4f78e40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f78db4
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f78db4
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f78db4
ret
cmp word [ebx + 4], 0x14c
jne 0x4f78db4
test word [ebx + 0x16], 2
je 0x4f78db4
test word [ebx + 0x16], 0x100
je 0x4f78db4
cmp word [ebx + 0x18], 0x10b
jne 0x4f78db4
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f78db4
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f78e40
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f78dd4
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.04f5fd1f
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f78db4
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x4f78ef7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f78f50
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f78ef7
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f78f06
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x537eba9
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f78f57
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.04f5fdcd
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f78ff6
add edi, 4
add eax, 2
dec ecx
jne 0x4f78f3c
call 0x4f78fa3
loope 0x4f78f99
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f78ff3
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f79004
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f78fb7
cmp eax, ecx
ja 0x4f78fb7
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f79041
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f79037
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.04f602ac
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4f78f06
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f78f50
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f78ef7
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f78f06
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x537eba9
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f78f57
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.04f5fdcd
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f78ff6
add edi, 4
add eax, 2
dec ecx
jne 0x4f78f3c
call 0x4f78fa3
loope 0x4f78f99
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f78ff3
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f79004
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f78fb7
cmp eax, ecx
ja 0x4f78fb7
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f79041
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f79037
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.04f602ac
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x19913219
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..rdata
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x37423793
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x93d4a2
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
lea esp, [esp + 0xc]
ja 0xe99e0a
mov edx, 0x332d7d36
mov eax, esp
movzx ecx, dl
sub ecx, 0x9ba072b8
lea ecx, [ecx - 0x645f8d2e]
push edx
add word [esp + edx*2 - 0x665afa6a], dx
or edx, 0xdf3794a4
lea edx, [esi - 0x80]
dec word [esp]
jns 0xc8d7d6
call fcn.0095de88
jmp ebp

Function at 0x93f464
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
mov dword [edi + ecx*2 - 0x9087e2e], edx
movzx eax, word [esp + ecx*2 - 0x9087e2a]
mov ebx, dword [esp + eax*4 - 0xfc54]
cmovbe cx, word [esp + ecx - 0x4843f12]
mov dword [esp + ecx - 0x4848437], 0xe13fcc2a
jp 0xcb97b3
push ecx
bswap edx
mov eax, ecx
sal dword [esp + ecx - 0x663f36b1], 0xa9
dec edx
shr dword [esp + eax - 0x663f36af], cl
not edx
sal cx, 0x22
jnp 0xcf964d
bswap ecx
xor ebx, edx
or dword [esp + eax - 0x663f36ac], ecx
call fcn.00f1961c

Function at 0x93ffdf
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions

Disassembly:
rol ecx, 2
push eax
xor ecx, 0x5f0ce48c
add ecx, edx
xor ebx, ecx
and dl, byte [esp + 2]
mov dword [esp + 4], eax
adc edi, ecx
mov ecx, dword [ebp]
rol ax, 0x64
adc ax, word [ebp + 4]
shr edx, 0x4e
push edx
not edx
adc ebp, 5
mov dword [esp + 8], edx
bt dx, dx
jae 0x9b9fc0
leave
fild dword [ebp - 7]
push 0xdf2caa99
imul ebp, dword [ecx], 0x3f5d6a99
imul ebp, dword [ecx], 0xff4d8a99
imul ebp, dword [ecx], 0xe7154a99
imul ebp, dword [ecx], 0x87155299
imul ebp, dword [ecx], 0xd7553299
imul ebp, dword [ecx], 0x77d66299
cmpsd dword [esi], dword es:[edi]
sub dword [ecx + 0x69871552], ebx
sub dword [ecx + 0x69d75532], ebx
sub dword [ecx - 0x5888299e], ebx
jno 0x94000a
inc esp
into
add eax, 0x7c4c3cbd
and dword [edx + 0x20daebf6], esi
inc ebp
sal dh, cl
jmp 0x94003a
mov word [ecx], ax
bt edx, 0xb9
jb 0xc5c79b
jb 0xec3571
pop eax
pop edx
pop eax
jmp edi

Function at 0x940534
Capabilities:
Encode data using base64

Disassembly:
not al
rol edx, 0x58
sbb al, 0xa
xchg byte [esp + 0xb], dl
mov dword [esp], 0x48b7ffa3
sar edx, 0xd0
not al
xor bl, al
not dx
push edx
lea eax, [esp + eax + 0x10]
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
movzx ecx, word [ebp + ecx - 0x28000bf7]
movsx eax, byte [esp + 0xc]
xchg byte [esp], dl
xor cx, bx
and edx, dword [esp + 4]
not cx
ror cx, 1
ror ax, 0xc9
inc al
sbb cx, 0xafa5
cwd
neg byte [esp + edx - 0x48b7fff1]
xor cx, dx
cbw
push eax
sub eax, eax
sbb cx, dx
xor bx, cx
rol ax, 0x4d
rol edx, 0x1d
jb 0xe855db
mov eax, 0xcd021029
mov edx, eax
movzx ecx, byte [edi]
sal dl, 0x81
neg ax
adc edi, 0
call fcn.0098b5be
Function at 0x9442fe
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
and edi, 0xff
rol dword [esp + 8], 0x71
mov dword [esp], 0x3f96b53e
mov edi, dword [edi*4 + 0xf1351c]
jae 0xc622e7
ror dword [esp], 0x57
jae 0xee334c
lea edi, [edi - 0x46c09471]
lea edx, [ecx*8 - 0x44c36ae6]
pop edx
call fcn.00c934b4
Function at 0x94c2bb
Capabilities:
Encode data using base64

Disassembly:
inc ecx
neg ebp
neg edx
inc edi
lea ebp, [ebp + eax*2 - 0x231ccabe]
neg ecx
mul ebp
inc ecx
not ebp
inc ecx
not bh
inc ecx
bswap ebp
inc eax
sar bh, 0x81
inc ecx
push edx
inc ecx
add bh, 0x1c
inc esp
xor dword [esp + eax - 0x636d04aa], ebp
inc esp
bt edx, edi
dec esp
lea esi, [ecx + edx*2 + 0x7737ef35]
inc ecx
pop edx
dec esp
xchg edi, eax
dec ebp
arpl bp, bp
setb bl
inc ecx
imul al
dec ecx
btr esi, ebp
dec ebp
adc ecx, ebp
inc eax
xor bh, al
dec ebp
add esi, edi
inc ecx
push ebx
dec esi
mov dword [esp + eax - 0x2ba1710c], ecx
ret
mov eax, dword [esi + 4]
dec esi
lea esi, [eax*2 - 0x3463ce61]
dec eax
add esi, 4
inc ecx
movsx ebx, al
inc esp
movzx ebx, bl
pop ebx
and edi, eax
inc ecx
mov eax, esi
inc ecx
movzx ebx, dh
not ax
not edi
inc ecx
mov dword [ebx + esi - 0x27], edi
mov ecx, eax
dec ebp
lea eax, [ebx + 0x4f943c94]
dec edi
lea esp, [eax - 0x4f943cbf]
inc ebp
movzx ebp, bl
rol ecx, cl
inc edi
mov ebp, dword [esp + eax - 0x4f943cbb]
dec ecx
add ebx, 0x3a11521f
inc ebp
xor ebp, edx
inc ecx
not ebp
inc ecx
movzx ebp, si
inc ecx
mov edx, esi
dec esp
lea ebx, [edx + ebx*2 - 0x3b76f6e2]
inc ecx
ror ebp, 3
sar dl, 0x26
dec esp
lea edi, [ebp*8 + 0x1336491a]
inc ecx
not ebp
dec ecx
lea edi, [eax + ebp*2 - 0x23f2e77d]
js 0x93519f
inc ecx
inc ebp
movsx ebx, al
inc ecx
bswap ebp
dec esp
lea ebx, [eax + 0x5114e680]
dec ebp
lea edi, [ebx - 0x5cc92fcb]
movzx ecx, bl
inc ecx
neg ebp
inc cx
sar edi, 0xc8
jb 0xcaf2a2
mov word [esi + 4], ax
mov edx, 0xb816193b
sbb esi, 0xfffffffc
movsx ecx, dl
mov dword [esp + ecx*8 - 0x1d8], edi
ret
dec eax
lea edx, [ecx - 0x7875dddc]
inc esi
xor dword [esp + esi*4 - 0x263a04d0], ebp
cwd
cwde
inc ecx
pop edx
cdq
dec ebp
arpl bp, bp
dec eax
sub ebx, edx
jno 0xeae273
inc edi
lea ebp, [ebp + esi*4 - 0x139d1931]
dec edx
lea ebp, [ebx*8 - 0x2478b24b]
dec eax
lea edi, [ebp*2 + 0x12907400]
inc ecx
mul bh
inc ecx
push edx
jb 0x9884bb
dec ebp
adc ecx, ebp
dec esp
lea eax, [edx*2 + 0x64291c38]
dec ecx
cmp byte [ecx + ebp], bl
dec ecx
or edx, dword [esi + esi - 0x98e8134]
inc edx
mov cl, byte [esi + esi - 0x98e812c]
inc esp
xadd eax, eax
dec eax
sal edx, cl
dec edx
mov dword [esi + esi*4 - 0x263a04ce], edx
shr al, 0x84
inc bx
mov ebx, dword [esp + esi*4 - 0x263a04d6]
inc sp
imul ebx, eax
ror ebp, 0xc7
setae al
inc cx
xor ebx, edx
dec esi
lea ebp, [esi*8 + 0x22a78089]
inc ecx
neg bl
mov ecx, 0xf3a6e816
inc bx
dec ecx
shl ebp, 0x83
call fcn.00cee58d
and byte [ebp + 0x759f0d36], dh
insb byte es:[edi], dx
inc ebp
mov dl, 0xa4
xchg edx, eax
jne 0xeae35d
insd dword es:[edi], dx
xchg byte [edx + edx*4 - 0x5ddaff8b], ah
movsb byte es:[edi], byte [esi]
xchg edx, eax
jne 0xeae329
inc ebp
out dx, al
movsb byte es:[edi], byte [esi]
xchg edx, eax
jne 0xeae27a
in eax, dx
pop ebx
adc edx, dword [eax + ebp*8]
jno 0xeae2a9
jnp 0xeae34c
jns 0xeae2fd
jnp 0xeae345
inc eax
push edx
cld
sub dword [eax + eax*4 - 0x64], edi
retf
dec edx
les ebp, [ebp + esi*2 + 0x13]
pop esi
ret 0xe86e
lahf
rcl cl, cl
clc
Function at 0x979977
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x44e2a300
call fcn.00ddb8db
mov edx, 0x8c28479b
movzx eax, dl
push eax
mov ecx, dword [ebp + eax*2 - 0x136]
lea ebp, [ebp + eax*8 - 0x4d4]
inc edx
not dl
xor ecx, ebx
dec eax
bswap ecx
sub ecx, 0xb3bf9494
not word [esp + eax*4 - 0x266]
shr eax, 0xec
jp 0xeeccf4
xor ecx, 0xe0b448a8
sar byte [esp + eax*4 + 3], 0x86
xadd edx, eax
inc dword [esp]
lea ecx, [ecx + edx - 0x6a1177c8]
ja 0x94af69
bswap esi
mov edx, edi
mov dword [ebp + esi*8 - 0x3096cdc], eax
mov ecx, dword [ebp + esi - 0x612d9f]
mov esi, ecx
lea ecx, [edi*4 + 0x69822f27]
mov edi, ebp
adc cl, 0x97
movzx eax, dx
jl 0xce58a4
mov ecx, dword [ebp]
call fcn.00e0c3b8
sysenter
push esi
pushfd
mov esi, 0x8b99f51b
mov esi, dword [esp + esi + 0x74660ae9]
mov dword [esp + 4], 0x660c4a88
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00c63a89
mov eax, 0x43bd6989
mov edx, 0x82042707
mov edx, dword [esi + eax - 0x43bd6989]
bswap eax
add esi, 4
movzx ecx, al
xor edx, ebx
btc cx, 0xa5
not edx
neg eax
call fcn.00ddb4c8
mov ebp, 0xaf954f23
dec eax
and ebp, ebp
inc esp
movzx edi, bp
inc esi
mov edi, dword [esi + edi - 0x4f23]
mov edi, 0x3f85110d
call fcn.00d98324

Function at 0x97f11d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add edi, eax
mov dword [esp + edx*8 - 0x7ff58], 0x5d8932b7
ror ecx, cl
Function at 0x998b39
Capabilities:
Encode data using xor

Disassembly:
or eax, edx
sar cl, 0x87
sal dword [esp + ecx - 0x128e30fb], cl
sar dword [esp + ecx - 0x128e30fb], 0xd9
not eax
sub ecx, dword [esp + ecx - 0x128e30fb]
movzx edx, byte [esp + ecx - 0x128e313b]
mov dword [esp + ecx*2 - 0x251c627e], edx
mov dword [ebp + ecx*2 - 0x251c627e], eax
mov ecx, dword [ecx + esi - 0x128e313f]
ror edx, 0x61
movsx eax, dl
lea esi, [esi + eax*2 - 0xbc]
ror eax, 0xbb
imul ax, dx
inc ecx
enter 0x66bb, 0xf
scasd eax, dword es:[edi]
ret 0xcb33
imul eax, edx
xor ecx, ebx
bts dx, dx
sub eax, dword [esp + edx - 0x5d]
xor al, 0xaf
xor ecx, 0xa3341113
push eax
imul eax
inc ecx
or dx, 0x10a3
bt eax, edx
imul al
bswap ecx
xadd dl, ah
mul dl
dec ecx
bswap ecx
rol edx, 0xd2
xor ebx, ecx
xor word [esp + edx - 0x429bfffe], 0x7584
and al, 0x24
call fcn.00df8153
jne 0x998b84
jne 0x998c31
cdq
push ebp
sub ecx, eax
in eax, 0x24
cdq
jge 0x998b7f
fsub st(5)
and al, 0x99
insd dword es:[edi], dx
bound edx, qword [eax + 0x259924e5]
mov edx, 0x9924e588
cmp eax, 0x24e5381b
cdq
lea edi, [edx - 0x66db1a58]
sbb eax, 0x7c2bc01d
mov esp, 0x317a142b
xor dword [edi + ebp*2 + 0x53], ecx
sub edi, dword [esp + edi*4 + 0x2b]
adc al, 0x7a
xor dword [ecx], esi
dec esp
outsd dx, dword [esi]
push ebx
or eax, 0x7bdae67a
push es
mov ebp, 0x7dae67a
outsb dx, byte [esi]
movsd dword es:[edi], dword [esi]
jp 0x998bf4
fimul dword [edi + 0x73]
xor eax, 0xb3dae67a
cmp byte [0xafdae67a], 0xb7
in eax, 0x7a
out 0xda, al
inc dword [edi - 0x25198523]
cmp esi, esi
push cs
lcall 0xcf2d, 0xb8178b01
pop ss
sbb esi, edi
rol byte [ecx + 0x4c7], 1
add byte [esi + 0xf], ah
stosd dword es:[edi], eax
ror byte [ebp + 0x1808c], 0x88
iretd

Function at 0x9a946d
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0x810f2117
test edx, edx
lea esp, [esp + 0xc]
je 0xc57887
push ebx

Function at 0x9ad9be
Capabilities:
Authenticate hmac

Disassembly:
ror word [esp + 6], 1
neg eax
add eax, 0xc4bfa2a4
mov dword [esp], 0x5d29aa37
sar word [esp + 2], 0x42
ja 0x957d65
mov edx, 0x221705bd
mov esp, ebp
push edx
not dword [esp + edx - 0x221705bd]
movsx edi, dx
push dword [esp + 4]
popfd
pop esi
lea ebp, [esi*4 + 0x5ca63737]
mov esi, dword [esp + edx*2 - 0x442e0b76]
mov ecx, dword [esp + edx - 0x221705b5]
mov edi, dword [esp + edx - 0x221705b1]
mov eax, dword [esp + edx - 0x221705ad]
mov ebx, dword [esp + edx - 0x221705a9]
call fcn.00eb4f3f
xadd ecx, edx
neg eax
xor ebx, eax
lea edx, [edx*8 - 0x3de050c7]
lea ecx, [edx + ecx*8 + 0x3abd030e]
add edi, eax
movsx eax, dl
mov ecx, dword [esi + ecx - 0x7716b34b]
push edx
xor dword [esp + edx - 0x25a7afb9], edx
not eax
mov edx, dword [esi + eax*4 - 0x118]
neg al
add ecx, edx
mov edx, 0xee1f5926
mov dword [esi + eax - 0xba], ecx
lea ecx, [eax + eax + 0x11b7df0b]
add dword [esp + ecx - 0x11b7e07f], edi
ret
Function at 0x9b7e02
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
lea ebp, [ebp + ecx*4 - 0x54f4995c]
ja 0xde6e4c
xadd ecx, eax
btr cx, 5
xor ebx, edx
shr ecx, cl
adc ecx, 0x153ce68b
ror word [esp + ecx*4 - 0x54f49a28], cl
adc edi, edx
xadd word [esp + ecx - 0x153d2685], ax
ror byte [esp + ecx*4 - 0x54f49a25], 0xc1
mov eax, dword [ebp + ecx - 0x153d268b]
sal cl, 0xa3
pop edx
ja 0x94fc72
inc esi
xor dword [esp + eax], edi
inc cx
add edx, eax
dec esp
lea edx, [edi*2 + 0x6db74030]
sets cl
inc ecx
pop edx
dec esp
imul eax, edi
xor bl, 0xa6
dec esp
bt ecx, ebx
dec ebp
arpl di, di
dec ebp
adc ecx, edi
inc esp
movsx ebp, di
dec ebp
add eax, ecx
inc ecx
jmp eax

Function at 0x9bcba9
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp], 0x4aa9d039
call fcn.00f2f912
mov ecx, 0xb322ed39
lea ecx, [ecx*4 + 0x9bf6fa0]
mov edx, dword [esi]
add esi, 4
movzx eax, cl
inc eax
xor edx, ebx
call fcn.00cab2ef
sar dx, 0xe2
neg eax
not ecx
sar ecx, cl
sbb cl, ch
add eax, ecx
call fcn.00cef771

Function at 0x9bea80
Capabilities:
Execute syscall

Disassembly:
add dword [esp + ecx + 4], edx
adc edi, eax
mov dword [esp + ecx], ecx
movzx eax, byte [esp + ecx + 3]
mov si, word [esi + ecx*2]
and ax, cx
pop edx
pop edx
jns fcn.00c796c8
movzx cx, byte [esi]
mov dl, byte [esi + 2]
mov eax, 0xa93a1603
rol al, 0x41
adc esi, 2
call fcn.00f2bd1c
syscall
call fcn.00cc0486
inc ecx
mov esi, 0x12171c94
dec ecx
lea ecx, [esi - 0x2168adc8]
inc ecx
movzx edx, si
dec edi
lea esp, [esp + esi*2 - 0x242e392a]
mov edi, 0x9d0667be
inc ebx
movzx ecx, word [esp + esi*2 - 0x242e3928]
call fcn.009b682b
sbb eax, 0xe981c808
xor word [esp + ecx - 0x1c3a25cc], 0x4982
ror dword [esp + edx - 0x309d7c01], 0x41
bswap eax
dec dword [esp + ecx*4 - 0x70e89730]
bts ecx, 0x1a
xor ebx, eax
call fcn.00cbfc5d
mov edx, dword [ebp - 4]
mov eax, 0xe23b8220
lea ecx, [eax - 0x39e09062]
xor edx, ebx
call fcn.00cd24d1

Function at 0x9c3f1c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x896ec968
call fcn.00ef68bf

Function at 0x9d2343
Capabilities:
Encode data using xor

Disassembly:
push 0x870331ab
call fcn.00c8524e
mov eax, 0x55950c8e
lea ebp, [ebp + eax - 0x55950c92]
mov ecx, dword [ebp + eax - 0x55950c8e]
xor ecx, ebx
ror ecx, 1
mov edx, eax
inc ecx
inc dl
rol ecx, 1
not ecx
xor ecx, 0xae1c9d18
xchg edx, eax
xor ebx, ecx
and dl, dh
adc edi, ecx
cbw
movzx cx, byte [edx + esi - 0x55950c0c]
bts eax, edx
lea edx, [edx*8 + 0x558eed85]
shl edx, 0x7a
mov al, byte [esi + eax - 0x5595ff8d]
sbb edx, edx
adc edx, 0x318b8db6
lea esi, [esi + edx*2 - 0x63171b6a]
bswap edx
not cl
inc edx
not al
sal dx, 0x2b
and cl, al
lea eax, [edx*4 - 0x71f6cd49]
mov word [esi + eax - 0x683f72b7], cx
call fcn.00cb881d
Function at 0xc55b11
Capabilities:
Encode data using base64

Disassembly:
dec edx
mov dword [esp + esi - 0x304ab2ff], 0x9422d03b
xor bl, 0x3f
dec eax
cwde
inc ecx
shl edi, 0x7d
dec edx
lea edi, [ebp*8 + 0x221bf339]
inc ecx
sbb bl, dh
dec ecx
ror esi, 0x3e
inc esp
xor dl, bl
push edx
mov word [ecx + esi - 0x3049a802], bx
dec eax
lea esi, [esi + eax*2 - 0x68f2c6e4]
dec eax
lea ebx, [ecx + edi*8 - 0x87e707d]
mul dl
inc ecx
mov eax, dword [esp + ecx - 0x3049a805]
sbb dword [esp + ecx - 0x3049a7f9], 0x7c1cc686
call fcn.00e00554
Function at 0xc5cc51
Capabilities:
Execute syscall

Disassembly:
xor ebx, eax
sal edx, cl
jnp 0xdd7f69
mov edi, 0x951ccc80
inc esp
mov esi, dword [esi]
dec eax
sar edi, 0xbd
movsx edx, di
dec eax
lea ebp, [edi + edi - 0x786d90e9]
dec eax
lea eax, [esp + edi + 0x38]
sub edx, ebp
dec eax
lea ebx, [edx - 0x637623da]
inc esp
movzx ebx, ch
inc esp
mov dword [eax + edi*2], esi
inc ebp
mov edi, ebx
inc edx
mov ebx, dword [edi - 4]
dec ecx
lea ecx, [ebx + edx*8 - 0x366293fe]
inc ecx
xor ebx, edx
inc ebp
movzx ebp, di
inc cx
sub edi, 0xdf130fba
bswap ebx
neg ebx
dec eax
dec ecx
dec eax
bswap ebp
inc esp
movzx esi, cx
bswap ebx
dec esp
lea ebp, [ebp*2 - 0xcd402ef]
xor ebx, ebp
inc esp
xadd edx, ebp
adc ebx, edi
neg ebx
jmp 0xdb22fe
inc ecx
push edx
dec esp
lea edx, [edi*8 + 0x7964aaa]
inc ecx
mov eax, edx
dec edi
lea eax, [edi + edi*2 + 0x44219618]
xor dword [esp + edi], ebx
or cl, 0x36
inc eax
not bh
sub ax, 0x4d07
inc ecx
pop edx
dec eax
arpl bx, bx
dec esp
add ecx, ebx
inc ecx
or al, bl
inc ecx
movsx ebx, bl
xchg edi, eax
inc ebp
mov esi, dword [esp + edi - 0x796fdbf]
jne 0xda91a7
setne bl
inc ecx
jmp ecx
mov eax, dword [edx + ebp - 0x13133f99]
lea ebp, [edx + ebp - 0x13133f95]
shr ecx, cl
sub cl, 0xe
sar dx, 0x4d
xor eax, ebx
dec dword [esp + edx - 0x1312fffd]
or ecx, dword [esp + edx - 0x1312fffd]
mov dword [esp + edx*4 - 0x4c4c0004], edx
neg eax
add cx, 0x891a
bswap eax
adc ecx, dword [esp + edx*4 - 0x4c4c0000]
lea eax, [edx + eax + 0x385c598]
lea ecx, [edx + ecx + 0x729d8f2c]
jne 0xd13030
mov edx, 0x4f3b9415
lea esi, [esi + edx - 0x4f3b9419]
mov ecx, dword [edx + esi - 0x4f3b9415]
xor ecx, ebx
movzx eax, dx
lea ecx, [ecx + edx*4 - 0x47edf93e]
neg edx
mul ax
btc edx, edx
not ecx
dec eax
dec ecx
inc dl
bswap ecx
or dx, ax
jae 0xece660
syscall
call fcn.00eae3b7
not cl
not eax
jae 0x9231a0
dec esi
lea esp, [edi - 0x796fdbf]
inc ebp
xor esi, edx
dec ebp
xor ebp, ebp
ror dl, 0x24
xadd bp, di
inc ecx
ror esi, 1
dec esp
xchg ecx, ebp
inc ecx
bswap esi
dec ecx
xor eax, 0xf9d9ea9
inc ecx
sal edi, 0x33
rol dl, 0xc4
inc ecx
ror esi, 1
cbw
dec eax
not ecx
inc ecx
sub esi, 0xa3b4aa35
inc esp
xor esi, ecx
inc ecx
push edx
ror dl, 0xc4
inc cx
shl ebx, 0x64
inc esp
xor dword [esp + edi - 0x796ffff], esi
dec eax
and edi, 0xdf840589
dec esp
xor eax, edx
inc ecx
pop edx
inc esp
mov dword [edi + esi - 0x7840589], esi
dec eax
and ebp, 0x45111431
jns 0x965cc5
push 0x360bbb2f
movzx ecx, byte [edi]
xor cl, bl
rol cl, 1
pop edx
bt edx, edx
shr dx, 0xa3
neg cl
sub cl, 0xa2
call fcn.00c97b81
jmp 0x953fb5
adc edi, eax
movzx eax, cx
add byte [esp + eax - 0x971f], al
xor byte [esp + eax - 0x971c], dh
mov dword [esp + eax - 0x9723], edi
ret 4
ror eax, 0x29
dec ecx
neg al
xor ebx, ecx
cwde
call fcn.00ca3bf3