joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9d9352
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ecx
mov ecx, 0x1c27899a
call int.007ed8b7

Function at 0x9e2040
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, 0x7198671d
pushfd
shl cl, 0x8f
sub ecx, 0xfe28f729
not cl
push ecx
xchg dword [esp + ecx - 0x736f6f18], eax
or word [esp + ecx - 0x736f6f28], 0xbe90
or cl, 0x25
or al, 0xe8
nop
nop
mov word [esi - 0x7f], fs
mov word [eax + ebx*8], cs
nop
nop
mov word [eax + 0x25c980be], ss
cmp ecx, 0xfa04cb00
call fcn.006d5653
dec esp
cmc
and ecx, dword [0x3fc3170c]
fsub dword [ebx + 0x5334d757]
mov dword [0x10d986f], eax
call edi
adc dword [eax + 0x218a6455], ecx
sbb dl, cl
sbb ch, byte [ecx + 0x22f554d9]
movsd dword es:[edi], dword [esi]
mov byte [ebx - 0x4ebe3ce1], cl
pop edi
jns 0x9e2113
sbb byte [esi - 0x51], cl
mov bl, 0xd8
nop
in al, 0x3b
or esp, dword [edi]
mov ebp, 0x41a882ce
or esi, dword [ebp + 0x36838011]
xchg ebp, eax
or byte [edx - 0x70], ah
sub edx, dword [eax]
mov cl, 0xa8
mov ch, 0x11
loopne 0x9e20e1
or edx, dword [eax + 0xd]
dec edi
mov al, byte [0xd3c7450a]
clc
cvtps2pi mm3, qword [edx + 0x77]
movsb byte es:[edi], byte [esi]
inc eax
jns 0x9e2055
mov ebx, 0xb2c200f
int3
invalid
push ebp
enter 0x4d77, 0xffffffffffffffd5
std
ja 0x9e2162
aad 0xfd
sbb al, 0x8b
sar edx, cl
pop edi
mov cl, 0xe1
call 0x350c7472
sbb dword [edx], eax
xor al, 0x19
add al, 0xe2
int 6
call ecx
pop edi
push ebx
invalid
pop ss
sbb esp, esp
cmp dword [esi - 0x48], edx
clc
cmp dh, ah
sal dword [edi - 0x57], cl
mov eax, dword [0x476d877f]
fstp qword [esi - 0x2d]
push ds
cmc
jne 0x9e2111
wait
cmp dh, bh
add al, 0x84
and ch, byte [esi]
xchg edi, eax
pop edx
fstp qword [ebp - 0x4d]
mov edi, 0xe530834e
push ds
jns 0x9e2117
jne 0x9e2122
scasd eax, dword es:[edi]
inc ecx
lea edi, [edx + 0x4b]
mov eax, dword [0x414dde07]
mov ecx, 0xa6816f52
aas
push ebx
push ebx
mov dh, byte [ebp + 0x44]
clc
xor al, 0xfa
adc esi, eax
xchg edi, eax
xchg esp, eax
sahf
push cs
mov byte [edi], bh
cmp al, 0x31
sbb dword [edi - 0x4f], esp
stc
inc edi
clc
adc al, 0x76
jp 0x9e21a5
xchg esi, eax
add dword fs:[eax - 0x49], 0x2038e523
test byte [ebx + 0xdba069b], 0x44
aas
out dx, eax
sub al, 0x10
mov edx, 0x2bb226d1
inc edi
invalid

Function at 0x9eee42
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
pop eax
push ebp
mov ebp, 0xe81cfc30
pushfd
shr ebp, 0xa1
and ebp, 0xf71dd3af
neg ebp
xchg dword [esp + ebp + 0x740c5210], eax
call fcn.00a2de3e

Function at 0x9efc3b
Capabilities:
Packed with generic packer

Disassembly:
invalid
jns fcn.0079e601
call fcn.007ee213
jl 0x9efc8c
dec edx
add al, 0x68
cmc
push 0x1e
and al, 0x1e
push ds
pushal
pop esp
pushal
bound ecx, qword [eax]
cmp byte [edx + 0x72], cl
cmp ah, byte [ebp + esi*8 - 0x5f]
test dword [0x1851f561], edx
nop
mov dl, 0x84
loop 0x9efc1a
seto byte [edx]
push esp
sub ebx, ebp
test eax, 0x4f72f167
pushal
sub al, 0xba
cmp dword [ecx], 0x60ce52a9
add al, 0xb3
out dx, eax
add dword [esp + ecx + 0x47], eax
fstp xword [ecx + 0x438ddb57]
push ds
xlatb
loopne 0x9efc95
or ch, dl
pop esi
aad 0x5e
sub dl, byte [ebp + 0x4d]
invalid
inc ecx
and ch, byte [ecx + esi*2 + 0x63db008e]
invalid
Function at 0x9fc234
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [esp + ecx*2 - 0x1b2a6d16]
mov esi, dword [esi + ecx*8 - 0x6ca9b4d8]
call fcn.009cef1c
clc
invalid
mov esi, 0xc48a1b21
jg 0x7fc1d9
pop eax
shr byte [ebx - 0x36], 1
inc ecx
xor byte [ebx - 0x47f4ab55], al
push ss
leave
dec eax
test dword [esi - 0x7629a6ef], 0xaa6b907e
jne 0x9fc263
pop edi
shl dword [ebx + 0x7cb5bb50], 0x65
bnd jl 0x9fc232
into
sub ch, cl
and al, dl
test al, 0xc3
mov dword [0xbf39bc96], eax
add dl, byte [eax]
in eax, dx
cmpsb byte [esi], byte es:[edi]
adc edx, ecx
pushfd
sbb eax, 0x693866cf
sub ebp, esi
push ebp
sub byte [edx], ah
mov edi, ebx
add esi, eax
or byte [edi + 0x1be0912e], ch
adc esi, dword [eax + 0x65a26c8f]
les ecx, [ebx + 0x3a]
leave
shr dword [esi], 0x71
invalid
Function at 0x9fed41
Capabilities:
Encode data using base64

Disassembly:
call fcn.0099dd86
test eax, eax
jne 0x5a6867
call fcn.0097f024
xchg byte [edx + 1], ch
call esi
push 0
mov edi, eax
call esi
push 0
mov esi, eax
push edx
call fcn.00749fba
mov dword [esp + 0x14], eax
test eax, eax
je 0x5a685d
push eax
push eax
call fcn.009d78e4
mov dword [esp + 0x10], eax
test eax, eax
je 0x5a6851
push edi
push esi
push dword [esp + 0x1c]
call fcn.00a1a05e
das
mov dword [esp + 0x20], eax
test eax, eax
je 0x5a6847
push eax
push dword [esp + 0x14]
call fcn.007d86e0
shr dword [eax + 0x20], cl
add ah, cl
add byte [edx], ch
push 0
push dword [esp + 0x20]
push edi
push esi
push 0
push 0
push dword [esp + 0x30]
call fcn.0086b543
mov edx, 0x1c24448d
mov dword [esp + 0x1c], 0
push eax
push 0
push dword [esp + 0x28]
push ecx
call fcn.00806924
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
push ebx
call fcn.00a42ff9
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5a67f1
push eax
call fcn.00684e1c
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
test edi, edi
je 0x5a67f1
push edi
push dword [esp + 0x10]
push dword [esp + 0x10]
push edx
call fcn.009c3b9b
xor esi, esi
cmp dword [esp + 8], esi
jbe 0x5a67e8
add edi, 0x30
nop dword [eax]
mov eax, dword [edi]
mov ecx, 0x1ffd58
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x5a67cd
test dx, dx
je 0x5a67c9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x5a67cd
add eax, 4
add ecx, 4
test dx, dx
jne 0x5a67a7
xor eax, eax
jmp 0x5a67d2
sbb eax, eax
or eax, 1
test eax, eax
je 0x5a686f
inc esi
add edi, 0x4c
cmp esi, dword [esp + 8]
jb 0x5a67a0
mov edi, dword [esp + 0x18]
push edi
call fcn.006846c6
add esp, 4
movups xmm0, xmmword [0x1ecab8]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x24]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x54], 1
push eax
push dword [esp + 0x30]
movups xmmword [esp + 0x60], xmm0
push esi
mov dword [esp + 0x78], 4
mov dword [esp + 0x74], 1
push eax
call fcn.00a36621
push dword [esp + 0x20]
call fcn.006d39b1
jge 0x5a6897
call fcn.007d0b89
sti
push dword [esp + 0x10]
push eax
call fcn.0096a3b5
push dword [esp + 0x14]
push 0
push edx
call fcn.008ea9e7
push dword [esp + 0x2c]
call fcn.009a4f13
popfd
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18]
imul eax, esi, 0x4c
push ecx
movups xmm0, xmmword [eax + ecx]
movups xmmword [esp + 0x44], xmm0
jmp 0x5a67e9
mov dword [ebp - 4], 0
push eax
push 0xec490
push 4
call fcn.009aedc1
adc dword [ebx - 0x1a7403bb], ecx
pop ebp
ret
xchg dword [esp + ebx - 0x4ffffff4], edx
or ebx, 0xb99a26bb
push ebx
test bl, bl
call fcn.00853d7d
js 0x5a66a4
jbe 0x81e6c4
Function at 0xa0a2a3
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [edi + 0x7c22bb60]
cwde
pop ebx
push esi
dec esi
outsd dx, dword [esi]
mov ecx, 0xc9dce045
sub bl, al
mov dword [ecx], esi
in al, 0x18
retf
and bh, byte [ebx]
mov ebp, 0x8e7cae92
mov cl, 0xb1
cmpsd dword [esi], dword es:[edi]
in eax, dx
jl 0xa0a213
sub bl, bl
popal
aam 0x6c
jns 0xa0a190
invalid
xchg byte [esi + ebp*4 - 5], dh
sar byte [edi], 1
xor eax, 0x687d41d0
inc ecx
jge 0xa0a27e
add al, 0x98
jae 0xa0a23f
aaa
push es
dec eax
mov edi, cs
inc ecx
pop es
mov ebp, 0x5da5b008
dec esp
dec edx
xchg esi, eax
and ebp, dword [eax + 0x61]
jecxz 0xa0a1cb
push ebp
stosd dword es:[edi], eax
dec edi
cdq
std
mov esi, 0x16bd1387
xor ebp, edx
ret
push edx
arpl word [edx], dx
iretd
inc eax
jecxz 0xa0a20a
sub word [esp + 8], 0x45a6
add dword [esp + 4], 0xff8d94ff
call fcn.008eeeaa
movzx edx, dl
jno 0x970a5a
xchg esi, eax
push ds
sub al, 0x50
pop eax
and ah, dl
cmp al, 0x74
inc esp
bound ecx, qword [esi]
sub al, byte [edx - 0x62]
jbe 0xa0a33b
pop esi
pushal
in al, dx
cmp byte [eax - 0x7c], al
sbb al, 0x7c
sahf
outsb dx, byte [esi]
sti
xor eax, 0x3554821f
pop eax
je 0xa0a2d8
jo 0xa0a27d
push eax
mov ecx, ss
mov esp, 0xd5195028
sbb ebp, edx
adc al, 0xe0
rol eax, 0x14
adc eax, 0x7e38694d
inc edi
push 0x47fdf434
invalid
aad 0x98
stosd dword es:[edi], eax
retf

Function at 0xa0b7d1
Capabilities:
Encode data using xor

Disassembly:
test dword [esi + 0x34001ad6], eax
mov al, byte [0x42444c7]
sahf
push 0xffffffffffffff97
aaa
call fcn.0088279b
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x18]
call fcn.0092ae5b
adc cl, byte [ebx + 0x79]
lahf
popal
xor ecx, dword [edi]
add byte [edx], dl
dec ebx
jns 0x837a9d
jg 0x837af6
add edi, edi
push ecx
ret
mov ecx, 0xaa0191a1
rol ecx, cl
mov cl, byte [ecx + esi - 0x5403233f]
jb 0x837ae7
sub edi, 0xf120102a
call fcn.00a3bed6
mov ecx, 0x8786ed2f
lea eax, [ecx + ecx*8 - 0x22fbf8fa]
mov ecx, dword [ebp]
inc eax
lea eax, [eax*8 + 0x1c329431]
mov al, byte [ebp + eax*2 - 0x448b033e]
call fcn.0074eb59
int 0x2e
call fcn.0082ade6
cmp dword [esp + 0x18], edi
movzx ebp, byte [esp + 0x18]
seta cl
cmovl ecx, dword [esp + ebp - 7]
jo 0x9695d9
jns 0x9d8364
mov dx, word [esi + 2]
jmp 0x960a93
and byte [ebp - 0x14de2d6c], cl
sub dword [esi + 0x64], 0xeee9168b
mov al, 0xde
inc edi
mov dword [esp + 8], 0x9293fd37
lea esp, [esp + 0x10]
jmp fcn.0099822c
lea edx, [edx + 0x429c4637]
jns 0x99d01d
dec eax
insd dword es:[edi], dx
pushal
sub eax, 0x725c6de8
push esp
sub al, dh
jb 0xa0b781
mov edx, 0x669f02ed
mov eax, dword [esi]
mov edx, 0xde038da2
jmp 0x9ad7c3
Function at 0xa1aa65
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
jbe 0x970a60
and byte [esp + 0x28], 0x31

Function at 0xa264ee
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
adc bl, byte [eax - 0xc]
fild qword [0xf5f9e67c]
jno 0x8c33d1
inc edx
mov byte [edi - 0x2c], 0x3d
sub bl, ch
jne 0x762bee70
jne 0x8c33db
jnp 0x8c335e
std
push ds
out dx, eax
sti
sbb eax, 0x9329bd43
sbb byte [0xf33ae9f4], al
jne 0x8f2b39
inc edi
jecxz 0x8c33e5
out 0x83, eax
jl 0x8c33a2
int1
push 0xffffffffffffff82
int 0x77
or dword [eax], 0x2a
push ds
mov ecx, 0x379dc7d3
and bl, ah
out 0xd1, al
arpl word [edi - 0x2e7c751f], si
jmp 0x8c33ba
pop esp
arpl word [eax + 5], dx
enter 0xffffffffffffcafd, 0xfffffffffffffff8
add eax, 0xf8cafdc8
sbb eax, 0x165feb53
or cl, al
fdivr qword [edx + 4]
test dword [eax - 0x65], esi
pushal
jg 0x8c3420
jp 0x8c33e0
fbld tbyte [ecx]
scasd eax, dword es:[edi]
leave
jne 0x8c3347
std
in eax, 0x8b
mov al, byte [0x12ca30bf]
pop ebp
mov al, byte [0x404dd433]
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
dec esi
mov ecx, dword [eax + edi*4 - 0x40]
pushal
xchg ebx, eax
and al, 0x70
enter 0xffffffffffff948c, 0xfffffffffffffff1
jo 0x8c33a5
mov word [ecx + esi*8 - 0x2358696a], ss
das
xchg esi, eax
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
fsubr qword [edi]
shl dword [eax], cl
or al, 0xfc
invalid
adc bh, byte [edx - 0x20]
pushal
jae 0x8c3428
mov byte [ecx + 0xc], ah
cmp eax, 0x57acaf11
add ebp, ebx
or al, 0x3d
adc dword [edi - 0x14fca854], ebp
xchg dword [esp + ebx*2 + 0x7a0393ef], edx
test dword [ebx + ecx*8 + 0x12ca30bf], edi
invalid
setg bl
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ebp
add bl, 0x3a
mov edi, 0xa5baaf88
or edi, edi
call fcn.008d918c
movzx edi, si
sub esi, 0xe3352592
shr si, 0xa8
mov edi, dword [esp + 0x20]
mov esi, 0x118cb0bb
js 0xa3b2dd
call fcn.007959c0
not ecx
xchg dword [esp + 0xc], ebp
push ebx
mov ebx, ecx
push edi
js 0x8c336f
Function at 0xa2a4a8
Capabilities:
Encode data using xor

Disassembly:
shl dword [esp + 0x14], 0x5e
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x20]
ret
sbb dword [ebx + 0x244481], edx
out dx, al
jle 0xa2a525
add dword [esp], 0xff767eee
xor dword [esp + 0x14], 0x9037889b
inc dword [ecx - 0x64ebdb8c]
mov byte [edi], dh
nop
jge 0x776372
xor byte [ecx + 0x2b], ch
daa
loope 0xa2a4a6
fcomi st(2)
je 0xa2a517
jns 0xa2a50f
mov bh, 0x44
movsd dword es:[edi], dword [esi]
in eax, dx
xchg sp, ax
invalid
dec eax
add eax, dword [ebp + 0x586dbc18]
push eax
outsb dx, byte [esi]
dec edx
pop eax
xchg esi, eax
add dword [esi], esp
add eax, ecx
mov ecx, ebx
push ecx
je 0xa2a56c
sbb eax, 0xa8f7e770
sbb ecx, ecx
add cl, byte [esp + ecx*8 - 0x7d]
mov byte [ebx - 0x507f130b], bl
xchg ecx, eax
mov ch, 0x28
out 0x9e, al
jo 0xa2a500
imul dword [eax + 0x4c02c91b]
int3
sub byte [edi - 0x19d74a6f], 0x9e
stc
sbb al, 0xc0
and eax, 0x2fb591af
adc esi, 0xf537fed9
mov ebx, 0x3c26d41c
sar byte [ecx - 0x8e7701e], 1
invalid
sbb eax, 0xdc4ef27a
sbb ah, bh
mov byte [edx - 5], cl
mov dh, byte [edx]
rcl dword [ebx + esi - 0x68], cl
sub esp, edx
or eax, ebx
sbb ebx, ebx
pop esi
sub ebx, dword [ebx]
xchg esp, eax
inc dword [edi - 0x55]
inc esi
in eax, 0x89
mov edx, 0xb5079903
jmp fcn.00a2a609
Function at 0xa34718
Capabilities:
Encode data using base64

Disassembly:
cmp bp, word [esp + ebp - 0x5ad80ed1]
call fcn.00a31c8d
shl cx, 0xb4
test ecx, ebp
mov dword [esp + ecx - 0x38fffff8], ecx
not ebp
mov dword [esp + ebp - 0x5ad80ebf], esi
inc ecx
int1
daa
movsd dword es:[edi], dword [esi]
jae 0x8d074e
shr cl, 0xff
sbb dword [edi], ebx
and al, 0xc1
jb 0xa34773
pop ds
popfd
jns 0xa3477d
mov cl, 0xca
inc eax
inc edi
movsd dword es:[edi], dword [esi]
int1
cmpsb byte [esi], byte es:[edi]
nop
mov edx, 0x39354790
dec esi
fmul st(1), st(0)
mov esi, 0xb59eaf25
jecxz 0xa34727
jge 0xa34793
test edi, ebp
scasd eax, dword es:[edi]
jns 0xa34731
in al, 0x23
dec eax
push 0x9ad35d5b
sbb esp, dword [ebx]
sbb esi, ebp
frstor dword [esi]
or byte [ebx + 0xe97a1f7], dh
jno 0xa3472a
mov dh, 0xf3
aam 0x2d
aam 0x2d
inc edx
aas
push 3
call 0xbab5d666
in eax, 0x56
dec ebx
pop ebp
mov ss, word [edx]
mov edx, 0x5d4b56e5
call 0xd3d406a7
salc
mov bl, 0xe5
shr dword [edi + 0x1a], cl
mov ebp, dword [ebx - 0x20ef9ced]
adc bh, bl
stosb byte es:[edi], al
mov dh, 0x37
push edi
mov dl, 0xbf
xor bl, dl
salc
fisttp word [esi + 0x281264cc]
adc ch, byte [eax]
mov dword [ebp + 0x4ce87823], eax
dec ecx
xor esi, dword [ebp - 0x64]
pop edx
jns 0xa347ed
mov ebx, 0xbf131c2a
xor bl, dl
salc
push ebp
add esi, dword [0x1eef4c88]
xchg ebp, eax
dec esi
invalid
in eax, 0xa0
mov dh, 0x76
sbb al, 0x26
insd dword es:[edi], dx
popal
scasd eax, dword es:[edi]
sbb eax, 0xd4deb172
sti
aam 0xfb
mov eax, dword [0x373db5f7]
mov ch, 0x3d
aaa
mov ebp, ds
lahf
inc edi
rcl dword [esi - 0x38]
adc eax, 0x4b5628eb
adc dl, dh
sbb byte [ebp + 0x54], ah
adc byte [esi], ch
popfd
jecxz 0xa347fa
cmp al, 0xa5
loope 0xa347a2
cli
or ebx, dword [eax - 0x4a]
jl 0xa34879
leave
xor byte [edx + esi*2 - 0x42b214f], dl
adc eax, 0xc2747543
push 0xac2079c9
add dh, dh
and byte [ebx], al
ja 0xa3489b
invalid
popal
int1
stosb byte es:[edi], al
test byte [ebp - 0x6a], ch
push 0x14
and dh, byte [esi + esi + 0x5c]
ror dword [eax + 0x75fadb5e], cl
jg 0xa348c9
mov byte [esi - 0x25], bl
cli
jne 0xa34883
jg 0xa348c9
inc esi
sub cl, byte [esi - 0x5d]
test byte [ebp - 0x6a], ch
push 0x14
in al, 0xb5
div eax
xchg ebx, eax
sub byte [esi - 0x18bb0dbd], bl
sbb dword [edi*8 + 0x7cca799a], eax
mov eax, dword [0x2309358]
mov ah, 0x69
fsubr dword [eax - 0x2d]
jne 0xa347fe
sub dword [ebx - 0x13b26fda], esi
nop
dec ebp
in al, dx
shr byte [esi], cl
mov ebp, ss
sub byte [ebx], 0x3f
aas
xchg ebp, eax
jb 0xa348a1
or eax, 0x46aaea7c
ja 0xa34826
jbe 0xa34853
imul esi, dword [eax - 0x31b6eaf0], 0x4837ae98
sbb edx, ebp
invalid
ljmp 0xd1b3:0x9feed58d
sar dword [edi + 0x4aa4aa41], 1
imul esi, dword [eax + 0x69491510], 0xdbfa7a38
and ebp, dword [0xdaa5ee52]
jae 0xa3485c
clc
loope 0xa34847
or byte [eax], dl
add ebx, esp
lodsb al, byte [esi]
rcl esi, 0xd6
xor byte [esi - 0x1bba80f6], 0xb2
in al, 0xb2
nop
cmpsb byte ss:[esi], byte es:[edi]
cmp esi, dword [esp + eax*8 - 2]
dec ebp
push ebp
insb byte es:[edi], dx
mov ecx, eax
mov esp, 0x675fd67a
dec ecx
ror dword [edx + 0x22], cl
retf 0xd99b
Function at 0xa3570d
Capabilities:
Encode data using base64

Disassembly:
xor edi, edx
and edi, 0xff
mov dword [esp], 0xde99918c
mov edi, dword [edi*4 + 0x549014]
shr edx, 8
xor edx, edi
inc eax
dec byte [esp + 3]
xor edx, 0x11128020
dec ebp
jmp 0x965528

Function at 0xa3919d
Capabilities:
Encode data using base64

Disassembly:
call fcn.009d1f92
push 0x100
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.006783e0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x218]
push eax
push ebp
call fcn.00a0cc8d
mov dword [ebp - 9], 0x7c797f45
xor ecx, ecx
mov dword [ebp - 5], 0x707b57
mov byte [ebp - 1], 1
nop dword [eax]
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 7
jb 0x5aeb70
lea eax, [ebp - 9]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00677a50
add esp, 8
test eax, eax
jne 0x5aebd6
mov dword [ebp - 8], 0x2b5d5147
xor ecx, ecx
mov dword [ebp - 4], 0x1005c47
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 6
jb 0x5aeba8
lea eax, [ebp - 8]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00677a50
add esp, 8
test eax, eax
jne 0x5aebd6
xor al, al
mov esp, ebp
pop ebp
ret
push 0
call fcn.00783327
lds edx, [eax + 0x51]
call fcn.007b0cc3
mov al, 1
mov esp, ebp
pop ebp
ret
ja 0x5aeb29
jge 0x804967
lea esp, [esp + 4]
jmp fcn.007cb203
lea ecx, [ecx + ecx*4 + 0x159dc710]
mov ecx, dword [esp + 0xc]
sub byte [esp + 8], 0x99
call fcn.007ef817
xor dword [esp + 4], 0xa9353bd
sub ebp, dword [esp]
mov dword [esp + 0x18], ebp
jns 0x787926
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x14]
call fcn.00874755
Function at 0xa3d6bb
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x18], edi
or byte [esp + 4], 0xa7
je 0x883438
not byte [esp + 4]
xor dword [esp + 4], 0xcfb38417
not byte [esp + 4]
add dword [esp], 0xffe16a21
shl dword [esp + 4], 0xe
mov dword [esp + 0xc], 0x2f1cfb01
add dword [esp + 0x10], 0x175832
call fcn.00747d9a
mov eax, 0x9c001635
xchg ebp, eax
mov dl, 0x90
jno 0x7fafa2
invalid
mov ah, 0x5d
pop edi
mov byte [esi + 0x358f42f1], dh
pop esi
imul edx, dword [edx - 0x7495985a], 0x513c6091
push 0xffffffffffffff8b
xchg ecx, eax
pushal
cmp al, 0x51
hlt
mov edi, dword [esp + edi + 0x67d4700c]
lea edi, [edi + 1]
jne 0x9f4513
shr word [esp + 4], 0x3f
jns 0x7d5a2a
and dword [edi], 0x13
jnp 0x7fafc9
imul edx, dword [ebx], 0x23
add dword [ebp + 0x15], edi
jge 0x7fafef
dec ecx
xor eax, 0x7f6b6705
pop es
out 0xf, eax
ja 0x7fb0c0
push ebp
jmp 0x7faffc
dec ecx
popal
int1
mov ah, 0x3c
dec ecx
movsb byte es:[edi], byte [esi]
fdivr qword [esi + 0x5e]
loop 0x7fb0d7
add ah, byte [edx]
sub byte [esp + 0x4c], al
lock or byte [eax + 0x58], bh
invalid
test byte [esp + ebx*2 - 0x7c107d2c], ch
not byte [esp + ebx*2 - 0x7c107d2c]
lea edx, [edx + ecx - 0x7375ad7f]
call fcn.007b9d1c
mov dword [esp + edx + 0x78], edx
lea ecx, [ecx + edx + 0x592c266f]
shr dword [esp + edx*8 + 0x334], 0x1c
not dword [esp + edx*2 + 0xdc]
and word [esp + edx + 0x78], 0xd32c
mov dword [esp + edx + 0x6c], edx
push ebx
xchg dword [esp + edx*8 + 0x340], ecx
mov edx, dword [esp + edx*2 + 0xdc]
mov ebx, 0x281766a8
je fcn.009d374a
and dword [esp + ebx*2 - 0x502ecd38], 0xe3346720
neg word [esp + ebx - 0x28176698]
call fcn.00841517
call fcn.0080af1f
or dword [esp + 0x10], 0xa98fc424
mov dword [esp + 0x10], edi
neg di
bswap edi
jg 0x98a204
js 0xa3b064
mov edx, 0x73906726
movzx edx, word [edx + ebp - 0x73906726]
call fcn.00a35334
movsd dword es:[edi], dword [esi]
lodsd eax, dword cs:[esi]
mov ch, 0xfe
fsubr dword [ebx + 0x7c]
out dx, al
lodsb al, byte [esi]
and eax, dword [esi + ecx*8 - 0x35]
or byte [ebx], ah
jne 0x9f458a
xchg ebp, eax
sahf
dec edx
mov al, 0xfa
pop ebp
rcpps xmm0, xmm5
ret
pop esi
cld
sub dword [ebp - 0x1740626f], 0xc117799d
pop eax
daa
in eax, 0x22
dec esi
add al, 0xe5
mov dword [esi], eax
jno 0x9f45b2
popfd
mov edi, 0x2e479de8
clc
jle 0x9f45c7
test al, 0xb8
mov al, 0xe0
loope 0x9f458a
and eax, 0xe8bf9d11
popfd
sub al, byte [esi + 0x66]
popfd
mov edi, 0x442a9de8
out 0x66, al
inc edi
lahf
inc ebp
aam 8
pop dword [edx + edi*4]
cmpsb byte ds:[esi], byte es:[edi]
ficomp word [ebp - 0x7d621741]
jmp 0x9f4609
call 0x3e8ac869
popfd
sub bl, 0x3d
les ebp, [ebp - 0xe769453]
mov dl, 0x9d
cmpsd dword [esi], dword es:[edi]
sbb al, 0x67
daa
mov ah, 0xfb
rol dword [edi - 0x6cb8e8bd], cl
or ecx, dword [ebx + 0x39499a9b]
mov dword [0x6fe53873], eax
jb 0x9f45c8
cmp dl, byte [ebp + 0x1299bbc1]
ret
cmc
xchg ecx, eax
pop ss
push 0x2dd3a794
cmp eax, 0x2d1af73f
sub dword [ecx], edx
invalid
mov edi, dword [esp + 0x28]
test word [esp + 0x30], 0x2b26
call fcn.009bcd1d
jge 0x7fb025
not byte [esp + ebp + 0x60866b82]
neg dword [esp + ebp + 0x60866b82]
mov edi, dword [esp + 0x20]
jge 0x9a63b3
jmp 0x97db3a
Function at 0xa3ecd5
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov eax, 0x58a87398
call fcn.0082d636
or eax, eax
shl edx, 2
ror word [esp + eax - 0x6a64e3fe], 0xc3
inc ax
and al, 4
mov eax, ebp
inc dword [esp]
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x7b8601
mov eax, 0x399d8db9
shr eax, 0xf0
mov eax, dword [ebp + ebx*4]
call fcn.007b85ee
movzx ebp, word [ebx]
jmp 0x9debc8
add cx, cx
test byte [esp + ecx*2 + 0x21c87978], cl
lea edi, [edi + ecx*2 + 0x2e61ba1e]
call fcn.006d5db0
dec cl
lea ebp, [eax*2 - 0x5570f8f5]
not bp
neg cl
bswap ebp
xor dl, byte [esp + ebp*2 - 0x61e905e1]
ror cl, 1
or ax, word [esp + eax*2 - 0x47f304c3]
neg edx
xchg dword [esp + eax - 0x23f99bf3], eax
dec cl
add edx, eax
shl ax, 0x84
jbe 0x983e1b
neg cl
shl ebp, 0xa3
inc edx
not eax
xor bl, cl
neg edx
dec ax
je 0x85f1b7
mov dword [esp + eax - 0x6a64e4ce], esi
push ebx
shl edx, 0xb8
movzx ebx, ax
mov ebp, edi
push ebx
and al, byte [esp + edx - 0x71ffffff]
shr edx, 0xe8
mov ebx, ecx
xchg byte [esp + edx - 0x71fffd], al
mov edx, ebx
jns 0x821314
mov esi, 0x94b4b7b3
dec eax
add ebx, 2
push esi
inc cx
xor ebp, edi
call fcn.008ff4b3
jno 0x928298

Function at 0x1000a240
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000a26d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000a26d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10015e50
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10015e8e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10015e86
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10015e90
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10015e76
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10015f60
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10015f91
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10015f91
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x10015f91
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10040d5e
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10040d99
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10040d80
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10040d91
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10040d9b
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10040d76
xor eax, eax
pop edi
pop esi
ret