joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5ccb2fe2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
mov ecx, 0x5a0f2271
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x47f676eb
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x20092081
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x100014e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x10028740]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
push ebx
push esi
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001505
push 0
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, eax
mov eax, esi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001528
push edx
sub eax, ebx
lea ecx, [ebp - 0x20c]
push ecx
inc eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x238], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x248]
mov dword [ebp - 0x244], 0
push eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
movdqu xmmword [ebp - 0x234], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp + 0x1c], 0x10
pop esi
pop ebx
jb 0x100015a5
push dword [ebp + 8]
call fcn.100071a6
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007197
mov esp, ebp
pop ebp
ret
Function at 0x10002b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e44a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10028740]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.1000698f
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10002bb6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.10007a82
push 0x1002753c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.100098bb
push edi
push esi
call fcn.10006c25
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007197
mov esp, ebp
pop ebp
ret 4
Function at 0x10005e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001e958
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10028740]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x10028740]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x10005f54
cmp byte [ebx + 0x45], 0
je 0x10005f54
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10005e60
xor al, al
jmp 0x10005f56
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], ecx
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 8
cmovae eax, dword [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x10005ea0
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
cmovae edi, dword [esp + 0x18]
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10005ee1
dec eax
je 0x10005ee5
sub eax, 2
je 0x10005f3b
xor bl, bl
jmp 0x10005f3d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x10005f1c
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1000882f
add esp, 0x10
cmp esi, eax
jne 0x10005edd
cmp byte [ebx + 0x45], 0
je 0x10005f3b
test esi, esi
jne 0x10005ea0
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.10003ef0
jmp 0x10005ea0
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x10005f50
push dword [esp + 0x18]
call fcn.100071a6
add esp, 4
mov al, bl
jmp 0x10005f56
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10007197
mov esp, ebp
pop ebp
ret
Function at 0x10006300
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e9d0
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x10028740]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
mov dword [ebp - 4], 0
mov eax, dword [esi]
push 0x1002573f
push dword [ebp + 0x18]
mov dword [esi + 4], eax
push ecx
lea ecx, [ebp + 8]
call fcn.10005ac0
test eax, eax
je 0x100064a7
lea edx, [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.10003510
push 0
push 2
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x288], 0x22c
lea eax, [ebp - 0x288]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1000647d
lea edx, [ebp - 0x264]
lea ecx, [ebp - 0x58]
call fcn.10003460
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.10003510
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x40]
call fcn.10005ac0
test eax, eax
jne 0x1000642d
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x280]
cmp ecx, eax
jae 0x1000640d
mov ecx, dword [esi]
lea edx, [ebp - 0x280]
cmp ecx, edx
ja 0x1000640d
mov edi, edx
sub edi, ecx
sar edi, 2
cmp eax, dword [esi + 8]
jne 0x100063ff
push ecx
mov ecx, esi
call fcn.100065e0
mov ecx, dword [esi + 4]
mov eax, dword [esi]
test ecx, ecx
je 0x10006429
mov eax, dword [eax + edi*4]
jmp 0x10006427
cmp eax, dword [esi + 8]
jne 0x1000641a
push ecx
mov ecx, esi
call fcn.100065e0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10006429
mov eax, dword [ebp - 0x280]
mov dword [ecx], eax
add dword [esi + 4], 4
lea eax, [ebp - 0x288]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp dword [ebp - 0x2c], 0x10
mov edi, eax
jb 0x1000644e
push dword [ebp - 0x40]
call fcn.100071a6
add esp, 4
mov byte [ebp - 4], 1
cmp dword [ebp - 0x44], 0x10
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jb 0x10006475
push dword [ebp - 0x58]
call fcn.100071a6
add esp, 4
test edi, edi
jne 0x10006392
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0x10
jb 0x10006495
push dword [ebp - 0x28]
call fcn.100071a6
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp dword [ebp + 0x1c], 0x10
jb 0x100064b8
push dword [ebp + 8]
call fcn.100071a6
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007197
mov esp, ebp
pop ebp
ret
Function at 0x100064e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ea10
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10028740]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
lea eax, [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.10002220
lea ecx, [ebp - 0x1c]
call fcn.10006300
mov eax, dword [ebp - 0x18]
add esp, 0x18
mov ebx, dword [ebp - 0x1c]
xor edi, edi
sub eax, ebx
sar eax, 2
mov dword [ebp - 0x20], eax
test eax, eax
je 0x100065a5
lea esp, [esp]
push dword [ebx + edi*4]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebp - 0x20]
jb 0x10006580
test ebx, ebx
je 0x100065b2
push ebx
call fcn.100071a6
add esp, 4
cmp dword [ebp + 0x1c], 0x10
jb 0x100065c3
push dword [ebp + 8]
call fcn.100071a6
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007197
mov esp, ebp
pop ebp
ret
Function at 0x4013f5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esp
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ax, word [esp + 2]
mov dword [0x404590], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, dword [ebp + 8]
call fcn.004013ed
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x401306
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Jungo
mov dword [ebp - 0x20], eax
call fcn.004013ea
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x4014d5
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.180000
push str.Jungo
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x404588], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x404588]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x4014d5
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x4014ba
mov esp, ebp
pop ebp
ret

Function at 0x401f98
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401fc1
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401fb9
cmp al, 0x22
jne 0x401fad
cmp byte [esi], 0x22
jne 0x401fcb
inc esi
jmp 0x401fcb
cmp al, 0x20
jle 0x401fcb
inc esi
cmp byte [esi], 0x20
jg 0x401fc5
mov al, byte [esi]
test al, al
je 0x401fd5
cmp al, 0x20
jle 0x401fbe
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00402045
push 0x404004
push section..data
call fcn.0040202b
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x402005
movzx eax, word [ebp - 0x14]
jmp 0x402008
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.0040205d
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret
Function at 0x406b81
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c3dc]
jne 0x406b8b
repz ret
jmp fcn.0040b47c

Function at 0x4115dc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c3dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409b27
and dword [ebp - 0x14], 0
cmp dword [0x41eb08], 0
mov dword [ebp - 0x18], eax
jne 0x41168f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411737
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x411737
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41eb08], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41eb0c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41eb10], eax
call edi
push eax
call esi
mov dword [0x41eb18], eax
test eax, eax
je 0x41168f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41eb14], eax
mov eax, dword [0x41eb14]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4116e8
cmp dword [0x41eb18], ecx
je 0x4116e8
push eax
call esi
push dword [0x41eb18]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4116e8
test ebx, ebx
je 0x4116e8
call edi
test eax, eax
je 0x4116df
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4116df
test byte [ebp - 8], 1
jne 0x4116e8
or dword [ebp + 0x10], 0x200000
jmp 0x41171b
mov eax, dword [0x41eb0c]
cmp eax, dword [ebp - 0x18]
je 0x41171b
push eax
call esi
test eax, eax
je 0x41171b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41171b
mov eax, dword [0x41eb10]
cmp eax, dword [ebp - 0x18]
je 0x41171b
push eax
call esi
test eax, eax
je 0x41171b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41eb08]
call esi
test eax, eax
je 0x411737
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411739
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406b81
leave
ret

Function at 0x9157f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x9157fa
pushal
call 0x915800
pop ebp
sub ebp, 0x10
sub ebp, 0x5157f0
jmp 0x915816
mov eax, 0x5157f0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f4
mov edx, 0x80ef366
xor byte [eax], dl
inc eax
dec ecx
jne 0x91582d
jmp 0x915840
in eax, dx
stosd dword es:[edi], eax
in eax, dx
out dx, eax
pop edx
out 0xa7, ax
sahf
stosw word es:[edi], ax
fisub word [eax + 0x66]
fmul qword [esi + 0x66]
xchg cx, ax
test byte [ebp - 0x52], ah
in eax, dx
out 0x6a, eax
mov word gs:[0x9a4202eb], ax
out dx, eax
bound eax, qword [edx + 0x36]
push cs
sub ah, byte [eax + ebp*2 - 0xc38f19a]
and al, 0x66
dec edx
inc edx
push cs
mov al, 0x32
pop edx
adc al, 0x8e
arpl word [esi + 0x66], sp
invalid
Function at 0x41358d
Capabilities:
Encode data using xor

Disassembly:
xor ah, cl
cmp eax, 0xfde43ae9
aaa
pop edx
sub eax, 0x741249d0
add ch, byte [edx + 0xf]
je 0x41359f
push 0xf
movsb byte es:[edi], byte [esi]
pop esp
mov cl, bh
pushfd
pop esi
sti
out dx, al
push ss
mov dl, 0xeb
dec ecx
in eax, 0x13
test al, 0xc7
add dword [edi + 0x26ec194c], eax
xor eax, 0xb6cc1b86
dec ebx
dec ecx
xchg byte [ebp + 0x58], dh
xlatb
jl 0x41359b
or al, 0xb2
jp 0x41363e
cmp al, byte [ecx + 0x628ed07a]
invalid
push ds
invalid

Function at 0x45e654
Capabilities:
Encode data using xor

Disassembly:
retf
inc esp
dec esp
add dword [ebx + edi*8 + 0x38], esi
call 0xf630ee3a
jmp 0x45e64b
jbe 0x45e612
jmp 0x45e64b
sub byte [eax + 0x4b], 0xe3
dec edx
js 0x45e6c2
stosd dword es:[edi], eax
jnp 0x45e686
jmp 0x45e6b8
sti
sti
test al, 0xc4
xor ebx, dword [ecx + 0x46]
mov word [ecx + 0x33], ds
xor al, 0xea
adc cl, byte [edx]
sub ah, byte [esp + eax*2 - 0x38]
mov esp, esp
jno 0x45e6f7
sub cl, byte [ebx - 0x4a]
mov ebp, 0xa4c4405b
cmp bl, byte [ebx - 6]
iretd
div dword [ebp - 0x121cce11]
push dword [esi]
mov bh, 0xaf
push eax
inc edi
invalid
pop ebp
mov ecx, 0x1158567b
inc esi
lahf
or bh, byte [edi - 0x680fbd0]
pop esi
xor edx, dword [ebp + eax*8 + 0x5b]
shl ch, 0xb7
fucomi st(2)
or bh, byte [edi]
xor ch, al
stosd dword es:[edi], eax
xor eax, 0x1be169c4
invalid
Function at 0x4a06dd
Capabilities:
Encode data using base64

Disassembly:
or dl, byte [eax]
jecxz 0x4a06f3
invalid
sti
neg eax
xchg esp, eax
mov ebx, 0x674e7354
inc ebx
inc esi
pop ebp
mov ch, 0xed
inc edi
jno 0x4a074a
inc ecx
dec esi
cmp eax, dword [ebx - 0x5322551e]
push 0x1886d8fd
cmpsb byte [esi], byte es:[edi]
out dx, eax
xor al, 0x81
mov esp, 0x64438140
xchg esp, eax
inc esi
adc byte [esi + 0x63737117], cl
dec ecx
add al, 0x45
adc byte [esi + 0x27], ch
or bl, bh
cmc
inc ebp
and bh, byte [esi - 0x2e0f897b]
ljmp 0x19a7
test dl, 0xfe
rcr byte [esi - 0x4ffe495d], 1
mov bh, 0x26
xchg edi, eax
in al, dx
mov ebx, 0xe104463d
or edx, dword [ebp + 0x61650818]
xchg ebp, eax
sbb byte [eax], cl
popal
add cl, ah
xlatb
jns 0x4a077e
inc ebx
daa
mov dl, 0x95
xor dl, bl
fsub st(0), st(0)
xor dword [esi - 0x51], 0x3f
pop ecx
xchg esp, eax
shr dword [ebx], cl
retf
dec ebp
adc al, 0x51
mov dl, 0xf1
call 0x6d277a0
inc esi
and eax, 0x26ffd7bc
les esi, [esi - 0x4b29447c]
adc dword [ebx], esp
jnp 0x4a0808
shl byte [esi + 0x411a4c02], 1
nop
or bl, bh
ror dh, cl
add al, 0xb5
aaa
xor eax, 0x2dd7a093
test al, 0x1b
test byte [ebx], 0x12
stc
add cl, 0x58
xchg ebx, eax
sub al, 0x12
jg 0x4a081c
or byte [bp + di + 6], bh
stosd dword es:[edi], eax
jb 0x4a07e8
out dx, al
aaa
fcom dword [edx + edx - 0x32087486]
movsd dword es:[edi], dword [esi]
fisub dword ds:[eax + 0x213ec0d6]
xchg esp, eax
adc bh, byte [edx - 0x75]
test ebp, 0xa0da3ea5
salc
sar byte [esi], 0x21
aam 0x5d
xchg edi, eax
xchg esi, eax
sub byte [eax], 0xb6
jo 0x4a07f7
sbb esi, dword [ecx + 0x5a]
jno 0x4a0838
call 0x8712616f
mov edx, dword [edi + 0x614e73fd]
popal
xor esi, dword [eax - 0x35]
mov byte [0x6377c059], al
push es
int1
imul ebx, dword [eax - 9], 0xffffffc2
jo 0x4a07c5
ljmp 0x14a8:0x77f2e398
push 0xb5f690c4
dec esi
add dword [ebx - 0x3e758f2c], ebx
xchg esi, eax
push edi
popfd
sal dword [ebp - 0x3bb47e58], 1
inc edx
invalid
or dword [ebx - 0x3c], 0x68c8c742
pop ebx
or eax, 0x6e22b21d
mov ah, 0x3d
mov al, byte [edi]
enter 0xffffffffffffac0d, 0xffffffffffffff81
fbld tbyte [0x2797135d]
mov ah, 0x63
jo 0x4a07db
arpl word [edi + 0x70], sp
lahf
fstp dword [eax - 0x48]
pop ebx
invalid

Function at 0x4a2c4a
Capabilities:
Encode data using xor

Disassembly:
into
bnd ret 0x874f
xchg dword [edi + 0x7567081e], ebx
lodsb al, byte [esi]
jns 0x4a2c7a
pop ecx
js 0x4a2c09
sar byte [edi], 1
inc ecx
sal byte [ecx - 0x28], 1
pop ecx
mov al, byte [0x3cc2bb56]
sub byte [eax], dh
push ds
arpl word [esi + 0x5cc6c6d2], bp
nop
add al, 0x8c
mov edi, 0xb2d0b7f4
xor byte [esi - 0x620a6281], ah
cmp edx, dword [edi]
jo 0x4a2c36
setl byte [0xe3b7b766]
sbb ch, cl
std
or eax, 0xde959cc6
salc
xchg byte [0x5434a6d4], dh
cli
adc ah, byte [ecx - 0x62]
and eax, 0xf930b276
div byte [ecx + 0x16]
jae 0x4a2c6d
and edx, dword [ebp + ebx + 0x24]
add dl, dh
imul ebx, dword [ebp - 0x5f], 0x17
pop ss
jl 0x4a2c56
enter 0x1e96, 0xffffffffffffffff
in al, 0xc0
jecxz 0x4a2c0d
rcl edi, 0x81
invalid
add esi, 0xe0bc361c
clc
dec esi
add dh, bl
nop
sub al, 0x36
sub ax, 0xcb34
pop ebp
xchg al, cl
invalid
Function at 0x4a8508
Capabilities:
Encode data using xor

Disassembly:
jo 0x4a84c4
insd dword es:[edi], dx
adc ecx, dword [0x300adcd3]
pop es
push eax
xchg esp, eax
inc ecx
out 0xd0, al
pop es
xor dword [ebx], 0xb713f6cf
imul esp, dword [edx + 0x6400b5ad], 0x69
mov esi, dword [ecx - 0x10]
xchg ecx, eax
test byte [eax], 0xe6
jo 0x4a84c4
sbb bl, byte gs:[edi - 0x1ece81f9]
salc
insd dword es:[di], dx
push ebx
cmpsd dword [esi], dword es:[edi]
push cs
mov al, byte [0x5f401864]
inc eax
add dword [ebx + 0x6e], 0xffffffc1
iretd
js 0x4a851a
pop eax
das
inc edx
push ebx
rol ch, 1
cmpsd dword [esi], dword es:[edi]
pop edi
in eax, 0x75
xor ebp, dword [eax - 0x1c]
xor dword [edx], 0xaabfa6d8
xor byte [eax], ah
js 0x4a8534
push 0xd83281e4
cmpsb byte [esi], byte es:[edi]
mov edi, 0x782030aa
push esi
adc ebp, dword [edi]
ja 0x4a84c8
nop
out dx, eax
adc edi, eax
add esi, dword [esi - 0x30]
jge 0x4a847e
cmc
jbe 0x4a8531
xchg ebp, eax
push edx
into
retf
mul dword [esi]
mov dword [0x658b261f], eax
nop dword [esi + edi*2 + 0x16c46d8f]
pop esi
pop esi
jo 0x4a8540
das
push ds
and al, 0x96
shr dword [esp + eax*4 - 0x4a54c892], 1
loop 0x4a84f7
mov ah, 0x49
inc dword [ecx + 0x45]
inc ecx
inc ebp
mov al, byte [0x6d1c99]
jbe 0x4a8546
or eax, 0x26547260
pop esp
ja 0x4a8590
dec esp
das
fdivr qword [edx - 0x69]
adc edi, dword [ecx + 0x1d10ed8e]
mov ecx, 0x1d10ed8e
adc byte [0xb3849a7c], bl
adc dword [ebx + 0x59], eax
pop ss
jl 0x4a84d2
test byte [ebx + 0x17594311], dh
xor dword [ecx + eax], edx
out 0x70, al
or byte [ebp - 0x80], ah
add esi, esp
jo 0x4a854c
or byte gs:[eax - 0x4f29ea76], 0x82
mov byte [edx - 0x7d4f29eb], cl
mov edi, 0xcbd84860
push 0x596c4878
cli
push ds
call 0x26cfc52
in eax, 0x11
scasd eax, dword es:[edi]
mov cl, 0x47
jno 0x4a85a6
add edx, dword [edi]
in eax, 0xe7
invalid
invalid
cmp dword [eax], esp
xor ecx, dword [eax]
add bh, bh
cld
fld qword [eax - 0x5ec53a91]
xchg byte [ebx + esi*4 + 7], bh
lodsb al, byte [esi]
jae 0x4a85f6
stosd dword es:[edi], eax
xor al, 7
aam 0x23
ret 0xc4cf
inc esi
je 0x4a8603
stosb byte es:[edi], al
cwde
mov dl, 0x33
shl al, cl
les ebp, [esi]
sar byte [edi], 0x60
pushal