joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f6a6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039ea1
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.10034bc0
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2028], eax
mov dword [ebp - 0x202c], edi
call fcn.1001812f
lea eax, [ebp - 0x201c]
push eax
push 8
push edi
xor esi, esi
push str.Softwareprojonepodlp_rptcache_rptstore_
inc esi
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x202c], esi
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x201c], edi
je 0x1001f7d7
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2012]
push edi
push eax
mov dword [ebp - 0x2018], edi
call fcn.100258c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2014]
push eax
push edi
jmp 0x1001f7c1
inc dword [ebp - 0x2018]
lea eax, [ebp - 0x2014]
lea ecx, [ebp - 0x2048]
call fcn.10007530
lea eax, [ebp - 0x2048]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2028]
push eax
call fcn.1001f86e
lea esi, [ebp - 0x2048]
mov byte [ebp - 4], 1
call fcn.1000b0c0
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2014]
push eax
push dword [ebp - 0x2018]
push dword [ebp - 0x201c]
mov dword [ebp - 0x2024], 0x1000
call ebx
test eax, eax
je 0x1001f76d
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
cmp dword [ebp - 0x201c], edi
je 0x1001f7f5
push dword [ebp - 0x201c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002333a
leave
ret

Function at 0x1001f815
Capabilities:
Get common file path

Disassembly:
push 0
push 0x23
push dword [esp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
ret 4

Function at 0x100219d8
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.100258c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logsignored
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
mov ecx, esi
call fcn.10007530
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.1002333a
add ebp, 0x190
leave
ret
Function at 0x10021bc1
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1790]
mov eax, 0x1810
call fcn.10034bc0
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp + 0x178c], eax
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
mov esi, ecx
push esi
push str.Softwareprojonepodlp_smpcache_
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x80], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10021c19
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
call fcn.1001f3a8
jmp 0x10021c1b
xor eax, eax
test eax, eax
je 0x10021ca4
push edi
push 0x7fe
lea eax, [ebp + 0xf8e]
push 0
push eax
call fcn.100258c0
add esp, 0xc
push 0x5b
pop eax
mov edi, 0x400
push edi
mov word [ebp + 0xf8c], ax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrNCatW]
lea eax, [ebp + 0xf8c]
push eax
call esi
push 0x1004063c
lea eax, [ebp + 0xf8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
push dword [ebp + 0x1798]
lea eax, [ebp + 0xf8c]
push eax
call esi
lea eax, [ebp + 0x179c]
push eax
lea eax, [ebp + 0xf8c]
push eax
push 0x800
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
mov ecx, dword [ebp + 0x178c]
xor ecx, ebp
pop esi
call fcn.1002333a
add ebp, 0x1790
leave
ret

Function at 0x10021cba
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x10038910
call fcn.10024164
xor edi, edi
mov dword [ebp - 4], edi
push 0x18
mov byte [ebp - 4], 1
call fcn.100237c0
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x10021d04
mov ecx, dword [ebp + 0x18]
cmp ecx, edi
jne 0x10021cf0
mov dword [esi + 0x10], edi
jmp 0x10021d06
lea eax, [ebp + 8]
cmp ecx, eax
mov eax, dword [ecx]
jne 0x10021cfc
push esi
jmp 0x10021cfd
push edi
call dword [eax]
mov dword [esi + 0x10], eax
jmp 0x10021d06
xor esi, esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
push 0x10021d46
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
mov edi, eax
call fcn.10001820
mov eax, edi
jmp 0x10021d40
call fcn.10024209
ret
Function at 0x10021fec
Capabilities:
Delete registry value

Disassembly:
push 0x58
mov eax, 0x10039ce8
call fcn.1002419a
lea eax, [ebp - 0x48]
push eax
mov edi, ecx
mov esi, edx
call fcn.1001ef3e
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x34], ebx
je 0x100220ab
cmp esi, ebx
jne 0x1002201d
mov esi, 0x1003ea16
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x10022029
lea eax, [ebp - 0x44]
push edi
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x10040640
lea esi, [ebp - 0x2c]
call fcn.1001f2f3
add esp, 0x10
mov byte [ebp - 4], 1
cmp byte [ebp + 8], bl
je 0x10022086
lea eax, [ebp - 0x64]
push eax
call fcn.1001ee28
cmp dword [eax + 0x18], 8
pop ecx
jb 0x10022061
mov eax, dword [eax + 4]
jmp 0x10022064
add eax, 4
cmp dword [ebp - 0x14], 8
mov ebx, dword [ebp - 0x28]
jae 0x10022070
lea ebx, [ebp - 0x28]
mov esi, eax
mov edi, 0x1004a7e8
call fcn.1001f3ba
lea esi, [ebp - 0x64]
call fcn.1000b0c0
jmp 0x100220a3
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10022092
lea eax, [ebp - 0x28]
push eax
push 0x1004a7e8
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea esi, [ebp - 0x2c]
call fcn.1000b0c0
lea esi, [ebp - 0x48]
call fcn.1000b0c0
call fcn.1002421d
ret 4

Function at 0x10022308
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cmp eax, 0xc6
ja 0x100223a2
push ebx
mov esi, 0x1004a7e8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.100258c0
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push edi
push 0x100402f8
push esi
call ebx
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push esi
call ebx
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call fcn.10021e34
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002333a
leave
ret

Function at 0x10022a6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x10022a87
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x10022a83
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10022ba2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.10022d68
mov bl, al
mov al, dl
call fcn.10022d68
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.10022d68
mov bl, al
mov al, byte [esi - 4]
call fcn.10022d68
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.10022d68
mov bl, al
mov al, byte [esi]
call fcn.10022d68
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.10022d68
mov bl, al
mov al, byte [esi - 0xc]
call fcn.10022d68
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x10022bca
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002333a
leave
ret 4

Function at 0x10022c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10047330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.10022de4
push ebx
mov dl, al
call fcn.10022dbd
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.10022d78
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.10022d96
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.10022d78
push ebx
mov byte [ebp - 0x15], al
call fcn.10022d96
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.10022dbd
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.10022de4
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.10022dbd
mov bl, al
mov al, byte [edi + 4]
call fcn.10022de4
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.10022d96
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10022d78
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.10022d96
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.10022d78
xor bl, al
mov al, dl
call fcn.10022de4
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10022dbd
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x10022c83
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002333a
leave
ret 4
Function at 0x1002311a
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x10038d44
call fcn.1002419a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x30], ebx
xor esi, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10023138
sub eax, ecx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.10001c70
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], ebx
jbe 0x10023237
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x1003f8c8]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x10023174
cmp al, 0xff
je 0x10023160
cmp al, 0xff
je 0x10023237
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x1003f8c8]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x10023194
cmp cl, 0xff
je 0x1002317c
cmp cl, 0xff
je 0x10023237
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.10018cf0
mov al, byte [esi + edi]
inc esi
cmp al, 0x3d
je 0x10023237
movsx eax, al
mov al, byte [eax + 0x1003f8c8]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x100231d4
cmp al, 0xff
je 0x100231b7
cmp al, 0xff
je 0x10023237
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.10018cf0
mov al, byte [esi + edi]
inc esi
cmp al, 0x3d
je 0x10023237
movsx eax, al
mov cl, byte [eax + 0x1003f8c8]
cmp esi, dword [ebp - 0x30]
jae 0x10023212
cmp cl, 0xff
je 0x100231f7
cmp cl, 0xff
je 0x10023237
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.10018cf0
cmp esi, dword [ebp - 0x30]
jb 0x10023160
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.10001720
lea ecx, [ebp - 0x2c]
call fcn.10001750
mov eax, dword [ebp - 0x38]
call fcn.1002421d
ret

Function at 0x1002333a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047330]
jne 0x10023344
repz ret
jmp fcn.100256b3
Function at 0x1002e425
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100259ac
and dword [ebp - 4], 0
cmp dword [0x1004a20c], 0
mov ebx, eax
jne 0x1002e4d6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002e587
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1002e587
push eax
call fcn.1002593a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1004a20c], eax
call esi
push eax
call fcn.1002593a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1004a210], eax
call esi
push eax
call fcn.1002593a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1004a214], eax
call esi
push eax
call fcn.1002593a
pop ecx
mov dword [0x1004a21c], eax
test eax, eax
je 0x1002e4d6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1002593a
pop ecx
mov dword [0x1004a218], eax
mov eax, dword [0x1004a218]
cmp eax, ebx
je 0x1002e52e
cmp dword [0x1004a21c], ebx
je 0x1002e52e
push eax
call fcn.100259b5
push dword [0x1004a21c]
mov esi, eax
call fcn.100259b5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1002e52e
test edi, edi
je 0x1002e52e
call esi
test eax, eax
je 0x1002e525
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1002e525
test byte [ebp - 0xc], 1
jne 0x1002e52e
or dword [ebp + 0x10], 0x200000
jmp 0x1002e567
mov eax, dword [0x1004a210]
cmp eax, ebx
je 0x1002e567
push eax
call fcn.100259b5
pop ecx
test eax, eax
je 0x1002e567
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1002e567
mov eax, dword [0x1004a214]
cmp eax, ebx
je 0x1002e567
push eax
call fcn.100259b5
pop ecx
test eax, eax
je 0x1002e567
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1004a20c]
call fcn.100259b5
pop ecx
test eax, eax
je 0x1002e587
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1002e589
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x121c895
Capabilities:
Encode data using base64

Disassembly:
outsd dx, dword [esi]
inc edx
ffree st(5)
mov ecx, ebp
outsd dx, dword [esi]
inc edx
fstp qword [ebp - 0x683302b0]
ret
pop ecx
pop ecx
jb fcn.0171e965
fild qword [ebx + 0x2e230109]
push ecx
lds edx, ss:[ecx]
nop
cmpsb byte [esi], byte es:[edi]
popfd
jle 0x121c83e
cmp dh, al
sbb ecx, dword [ebx]
cmpsb byte [esi], byte es:[edi]
mov dword [0xc99baf86], eax
dec ebp
sub eax, 0xc99baf46
scasd eax, dword es:[edi]
imul edi, dword [esi], 0xf1c99baf
invalid

Function at 0x121fa53
Capabilities:
Encode data using base64

Disassembly:
dec esp
mov edx, dword [esp + edi*4 - 0x3fdc8]
pop edi
sar edx, cl
dec ebp
arpl ax, ax
dec ebp
add edi, eax
sub bl, ah
dec esi
lea ebp, [ebp*4 - 0x31f2c2fc]
pop ebp
inc ecx
pop eax
pop eax
pop edi
inc ecx
pop ebp
inc ecx
pop ebp
pop ebx
jae fcn.012669aa
pop ecx
bswap eax
mov edx, 0x3020e227
or cl, dh
inc eax
not ecx
bswap ecx
jmp 0x127943b

Function at 0x121fefb
Capabilities:
Encode data using base64

Disassembly:
pop eax
pop edx
pop eax
pop eax
jns fcn.0171e965

Function at 0x1225a45
Capabilities:
Encode data using base64

Disassembly:
push 0x9daa40b7
dec eax
mov dword [esp], ebx
push 0x84360d97
push 0x19a14902
dec eax
mov dword [esp + 8], ebx
mov byte [esp + 6], 0x26
push 0x36056f16
dec esp
mov dword [esp + 8], eax
mov ebx, 0x4aa11a17
dec esp
mov dword [esp + ebx - 0x4aa11a17], ebp
inc esp
movsx ebp, bl
push ebx
dec edx
mov dword [esp + ebp*2 - 0x2e], eax
dec esp
lea eax, [ebx + 0xf957aab]
inc ecx
xchg eax, ebx
pushfd
dec esi
lea eax, [ebx + ebp*4 + 0x668dde0c]
dec esp
lea ebp, [0xfedda563]
call int.012727fa
add al, dl
mov word [esi + 2], ax
mov edx, 0xa71bea38
mov ecx, edx
mov edx, dword [edi]
add edi, 4
movzx eax, cx
sal eax, 0x3d
xadd ecx, eax
xor edx, ebx
sal ecx, cl
add al, cl
rol edx, 1
lea eax, [eax + ecx*8 - 0x1a4dbb6e]
ror cx, 0x6c
neg edx
ror ecx, 0xb2
lea edx, [edx + eax*4 - 0x5ea97223]
bswap ecx
sbb eax, 0xec351a8a
sar ecx, 0x2e
xor edx, 0xa408c731
xor ebx, edx
add ebp, edx
push ecx
add cl, byte [esp + ecx*8 - 0x1bf]
lea eax, [esi + ecx - 0x36]
mov dword [esi + ecx*4 - 0xe2], eax
lea esi, [ecx + esi - 0x3a]
add dword [esp + ecx*2 - 0x70], ecx
pop eax
inc ecx
jno fcn.0171e965

Function at 0x1229cff
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec esp
mov dword [esp + edi - 0xc302baa], esp
inc edi
mov esp, dword [ecx + ebp*2 - 0x154]
mov esi, 0xd39a3522
dec ebp
lea ecx, [ecx + edi*4 - 0x30c0aea4]
inc esp
sub byte [esp + edi - 0xc302ba6], al
inc ebp
xor esp, edx
inc esp
xchg bh, ch
dec edx
lea edi, [edi + eax*4 - 0x5e601046]
pop edx
inc ecx
xor esp, 0x1be2328
dec eax
shl edi, 0xa3
inc eax
add dh, dh
sar si, 0xa9
inc ecx
dec esp
movsx ebp, si
dec esi
lea ebx, [ebp + eax*8 + 0x2ea33eba]
mov ebx, edx
inc ecx
neg esp
sal di, 0x23
call fcn.01228fd3
Function at 0x1229d61
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
add edx, edi
add dl, 0x14
sub ebp, ebx
mov ebp, esp
movsx edx, ax
rcl dx, 0x3c
mov edx, dword [ebp + 8]
test bx, bx
lea esp, [esp - 0x114]
push esi
test edx, edx
jmp 0x1234476
je 0x179288e
mov esi, dword [ebp + 0xc]
stc
test bp, 0x9e11
clc
test esi, esi
jmp 0x179c795
dec edi
clc
cmp di, bp
add eax, edx
jmp 0x17067f7
ja 0x171ba8e
mov eax, esi
test esp, ebp
stc
sub eax, dword [ecx + edx + 0x10]
jmp 0x1751c1c
sub ebx, ebx
test ecx, ebp
clc
test dx, 0x5822
mov dword [ebp - 0xc], eax
jmp 0x1318991
mov eax, dword [edx + 0x3c]
cmc
test esi, edi
add eax, edx
cmp dword [eax], 0x4550
jne 0x179288e
mov ecx, dword [eax + 0x78]
cmp ecx, esi
mov dword [ebp - 4], ecx
cmp edx, 0xf1a73905
test ecx, ecx
je 0x179288e
mov eax, dword [eax + 0x7c]
clc
test ecx, esi
push ebx
push edi
mov dword [ebp - 0x10], eax
stc
test bh, 0x11
mov dword [ebp - 8], 0xffffffff
clc
test bp, 0xee36
cmp esi, 0xffff
jmp 0x1276a90
je 0x16eaf2b
mov eax, dword [ecx + edx + 0x20]
jmp 0x1263f04
mov edi, dword [ecx + edx + 0x18]
clc
cmp bx, ax
test edi, edi
jmp 0x170e4c1
jmp 0x16eaf25
mov esp, ebp
pop ebp
ret
cmp word [edx], ax
je 0x170e305
xor eax, eax
movzx esi, cx
xchg esi, esi
pop esi
jmp 0x1778b6f
je 0x179288e
mov eax, 0x5a4d
jmp 0x1792885

Function at 0x122a28d
Capabilities:
Encode data using base64

Disassembly:
add cl, 0xba
mov ecx, dword [eax + edx - 0x76000000]
movzx eax, word [esp + edx - 0x75fffff8]
sar edx, 0xd6
rol dword [esp + edx - 0x1cd], 0xe1
lea esi, [edx + esi - 0x1dc]
xor dl, byte [esp + edx - 0x1d2]
mov dword [esi + edx - 0x110], ecx
jno 0x124a230

Function at 0x122c330
Capabilities:
Encrypt data using chaskey

Disassembly:
sub dl, 0x21
mov dword [esp + eax - 0x7fc0f1a5], 0x11a0b49e
jmp 0x17111d0

Function at 0x122fb56
Capabilities:
Encode data using base64

Disassembly:
dec ecx
neg edx
mov dword [esp], edx
sar dword [esp], 0x75
ror ecx, 1
sar edx, 0xbf
sal byte [esp + 2], 0xa5
adc dx, dx
xor ebx, ecx
or dword [esp], eax
jl 0x1772d1b
adc ebp, ecx
mov ecx, 0x1724193e
mov dword [esp + ecx*4 - 0x5c9064f8], ebp
ret

Function at 0x122fb97
Capabilities:
Encode data using base64

Disassembly:
pop edx
inc cl
ror cl, 1
mov eax, dword [esp]
lea edx, [eax + eax*4 + 0x22273ab]
sub edx, 0x372cf911
adc cl, 0xbf
xadd word [esp + edx*2 - 0x4bd207a0], dx
jne 0x17a3d57
mov ecx, 0xf6a5f63f
movzx edx, cl
mov edx, dword [edx + edi - 0x3f]
xor edx, ebx
call fcn.01327bb9
adc ax, 0x1511
neg cl
xor eax, 0x9d2bbd8c
sar dword [esp + edx - 0x25e9e83e], 0x53
or eax, dword [esp + edx - 0x25e9e83e]

Function at 0x1235342
Capabilities:
Encode data using base64

Disassembly:
add eax, 0x3129810
pop ecx
push edx
not edx
xor ebx, eax
not edx
jmp 0x171892a
Function at 0x123c1f9
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x249eb921
or ax, ax
sub ax, 0xafa5
mov eax, dword [edi + eax - 0x249e097c]
mov ecx, 0xfb3f878b
call fcn.01316d0c
dec ebp
lea esi, [esi + esi*2 - 0x16004]
ror dl, 0xa3
dec eax
ror ebp, cl
inc edi
inc ebp
mov dword [esi + esi*2 - 0x16000], eax
sar dl, 0x61
inc ecx
pop ebp
jge fcn.012669aa
inc ecx
mov esp, 0xe69f7f3e
push edx
xor dword [esp + edx*2 - 0x16b2], ebp
dec esp
mov edx, dword [esp + edx*2 - 0x16b2]
shr al, 0x43
dec esp
mov dword [esp + edx*2 - 0x16b2], esp
sbb bx, bx
dec eax
arpl bp, bp
shl byte [esp + edx - 0xb53], 0xe6
rol ebx, 0xe1
dec esp
add edi, ebp
pop esi
dec ecx
mov eax, dword [esi + edx*2 - 0x16ba]
pop edx
inc esp
mov ebx, dword [ebx + eax - 0x7c19ffff]
add esi, 0xb7a2d80d
jae 0x1327687
sal ecx, 0x2e
xor ebx, eax
mov dword [esi + edx*2 - 0x603cb912], eax
push edx
movzx eax, cx
lea esi, [ecx + esi - 0x7ffffffe]
add edx, edx
neg edx
add eax, dword [ecx + edi - 0x7ffffffc]
lea edi, [edi + ecx - 0x7ffffff8]
xor eax, ebx
inc eax
neg dword [esp + ecx - 0x80000000]
inc edx
jle 0x16ff947
fdivr dword [esi + 0x45]
enter 0x4379, 0x1f
sti
inc ecx
add edi, edx
push es
mov eax, 0x2a442df8
loopne 0x123c305
sal edi, 0x37
dec ebp
adc edi, ebx
dec edx
lea ebp, [ebp*4 + 0x4138b314]
dec ebx
mov eax, dword [esi + eax - 0x7304bb63]
call fcn.017b6a0e
mov edx, 0xedbf3281
lea eax, [edx*4 - 0x6ca5e68]
movzx eax, byte [edi]
mov ecx, edx
add ecx, ecx
add edi, 1
xor al, bl
dec ecx
sub dx, cx
push edx
sub al, 4
jmp 0x1269758
pop es
std
call dword [ecx + 0xf]
xchg byte [edi], bl
sub eax, 0xd933004e
xor ebx, ecx
xor al, 0xba
sar byte [esp + 2], cl
setnp dl
ror dx, 0x25
sbb al, cl
sub word [esp], 0xa406
not al
sar word [esp + 1], cl
ror edx, 0x31
add al, 0x29
xor bl, al
pop edx
add eax, esp
or dx, 0x1a82
jo 0x12352db
lea edx, [edx + edx*2 - 0x43565d68]
mov edx, dword [eax]
sbb esi, 4
shr ecx, 0xb
mov dword [esi + ecx*4 - 0x6dbf30], edx
jae 0x16ef3ae
mov edx, dword [edi + ecx*8 - 0xdb7e60]
mov eax, ecx
jae 0x1279ece
lea edi, [edi + ecx - 0x1b6fc8]
rol al, 0x84
sar eax, cl
xor edx, ebx
bswap eax
inc ax
not edx
sub ecx, ecx
rol edx, 1
or al, 0xb7
ror al, 0xe1
sub eax, eax
lea edx, [edx + ecx - 0xf32bca7]
bswap edx
not ecx
sbb ax, cx
neg edx
call fcn.0170c7bb
inc ecx
movzx ecx, ah
dec esi
lea esi, [ebx + esi - 0x7c19fffb]
inc ecx
movzx edi, ah
inc esi
mov dword [ebx + esi - 0x7c19ffff], ebx
inc ecx
jmp edi
xor eax, 0x58944705
jmp 0x17886f2
sub eax, 0x37b09621
shr byte [esp + ecx - 0x80000000], 0x81
rol eax, 3
call fcn.017784b8

Function at 0x123f9ed
Capabilities:
Encode data using base64

Disassembly:
not eax
neg edx
mov dword [esp], ecx
lea eax, [eax + edx - 0x355182fd]
xor ebx, eax
add ebp, eax
xchg cl, dl
pop eax
pop edx
jmp fcn.0171e965