joyce8/EMBER2024-capa huggingface dataset:
Function at 0x121162e
Capabilities:
Encode data using xor

Disassembly:
inc edi
mov esp, dword [esi + ecx*2 - 0x1c3c2200]
inc ecx
movzx esi, dx
dec edi
lea esi, [esi + ecx*4 - 0x387843fc]
dec edx
mov dword [esp + ecx*2 - 0x1c3c2200], esi
inc ebp
xor esp, ebp
sal ecx, 0x58
call fcn.01229d5f
movzx eax, byte [esi]
mov edx, 0x8712c1bc
add esi, 1
xor al, bl
sub al, 0x29
call int.01774267
inc ebx
ror bl, cl
repe scasb al, byte es:[edi]
xchg esp, eax
inc esi
mov gs, word [ecx + 0x1e]
das
add al, 0x46
mov gs, word [ecx - 0x22]
push esi
pop esp
inc esi
mov gs, word [ecx + 0x76]
invalid

Function at 0x122a032
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 0x132ac6b8
mov edx, dword [ebp + eax - 0x132ac6b8]
call fcn.01300e02
mov eax, 0xd5a1b28e
lea edx, [eax - 0x5d6b6273]
not eax
mov ecx, dword [eax + ebp - 0x2a5e4d71]
dec dl
mov edx, dword [ebp + eax - 0x2a5e4d6d]
shl al, 0xa6
lea ebp, [ebp + eax*2 - 0x54bc9a78]
inc eax
setp al
xor ax, ax
mov dword ss:[ecx + eax*2 - 0x54bc0000], edx
movzx edx, ax
lea eax, [edx + eax + 0x6fa55705]
add dx, ax
mov edx, dword [edx + esi - 0x5705]
or al, 7
jne 0x17aac24
push 0xbebe56aa
mov esi, 0xfb78ffeb
pushal
xchg esp, eax
invalid

Function at 0x122ca95
Capabilities:
Encode data using xor

Disassembly:
inc esp
mov ecx, ecx
mov dword [ebx + esi - 0x9ffc], eax
call fcn.01775d63
or dl, 9
sbb dx, 0xfc90
xor ecx, 0x6b8eaa0a
sub dword [esp + edx*2 - 0x6be3cc9e], 0x70361420
jne 0x128d73e
neg ecx
movzx eax, dl
sub eax, 0x2a2ba439
not dword [esp + edx - 0x35f1e64f]
xor ebx, ecx
add edi, ecx
dec dword [esp + edx - 0x35f1e64f]
sar word [esp + edx*2 - 0x6be3cc9c], 0xef
mov bp, word [ebp + edx - 0x35f1e64f]
jae 0x129409e
pop edx
jae fcn.0128b129

Function at 0x124bd9c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x12750d5
dec eax
lea esp, [esp + 0x18]
je 0x126e699
mov edi, 0xd922d125
push edi
dec eax
and dword [esp], edi
dec esp
mov dword [esp], ebp
dec esp
lea ebp, [0x8a823]
mov edi, 0x4187adaa
xor di, 0x6703
movzx edi, byte [ecx + edi - 0x4187caa9]
push 0x15a1d205
inc ecx
xor edi, ebx
and edi, 0xff
inc ecx
mov edi, dword [ebp + edi*4]
inc ecx
shr ebx, 8
inc esp
xor ebx, edi
dec eax
inc ecx
inc ecx
xor ebx, 0x438e0196
dec eax
dec edx
dec eax
lea esp, [esp + 8]
jne 0x12750f5
mov ebp, 0x200f6425
jmp 0x126e697
Function at 0x12560a5
Capabilities:
Encode data using base64

Disassembly:
dec ecx
ror esp, 0xb7
inc edx
mov edi, dword [edi + esi - 0x118ca300]
dec edi
lea esi, [edx + esi + 4]
dec ecx
add esi, edx
inc eax
sal ch, 0x21
inc ecx
xor edi, ebp
inc ecx
push edx
inc esi
mov dword [esp + edx*2 + 1], ebx
inc edi
inc edx
ror byte [esp + edx*4 + 3], 7
dec ecx
lea edx, [esp + esi*4 - 0x4856d3e7]
inc dx
sbb dword [esp + edx + 5], ebp
not edi
inc eax
xor ch, ch
jle 0x17911ab
inc cx
sub edi, 0x894e4411
push esp
and al, 0xf2
inc cx
ror edi, 1
dec ecx
not edx
inc cx
dec edi
inc cx
rol edi, 1
inc ecx
sub esp, 0x82bf3280
inc cx
dec edi
inc eax
xor ch, 0x82
inc sp
xchg dword [esp + edi - 0x7093bf38], ebx
inc ecx
movzx edx, sp
inc cx
not edi
call fcn.0129bf64
mov edx, dword [esi]
mov ecx, 0x63190394
jmp 0x12b627e
dec esp
mov dword [esp + ecx*2 - 0x1fa6e], ebp
pop eax
inc edx
xor dword [esp + 0x416f4c62], ebp
dec ecx
and edi, 0xe0ad2f94
ja 0x12db103
inc di
dec eax
arpl bp, bp
ror dl, 0xe1
inc esp
mov edx, edi
dec esp
adc eax, ebp
jmp 0x12d7a6a
lea esi, [esi + ecx - 0x63190390]
movsx eax, cl
and cl, ah
xor edx, ebx
not ecx
sub ecx, ecx
jp 0x12d26a9
dec edx
ror cl, 0xe2
neg eax
rol edx, 1
jmp 0x177b7d2
dec ebx
lea eax, [edi + ecx - 0x4ccce669]
dec ecx
not edi
inc ecx
jmp eax
inc ecx
pop ebp
jb 0x179eb2a
jg 0x12948f1
dec eax
shl eax, cl
inc esp
movsx ebx, bp
dec eax
lea esi, [ebp*8 - 0x42f8d8d9]
dec ebx
lea ecx, [edx + ebx*4 - 0x38650bf6]
dec eax
mov dword [edi + ebx - 0x118ca300], eax
jmp 0x124a138
not dl
call fcn.0128d610
Function at 0x125da08
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x86c64d93
jg 0x125d9b1
xchg ebx, eax
dec ebp
mov byte [esi - 0x6c5a0481], 0xd2
xchg byte [edi - 5], bh
movsd dword es:[edi], dword [esi]
xchg ebx, eax
rol byte [esi - 0x5a5e0481], cl
ljmp 0xc2a7
mov eax, dword [0x7f86eaa5]
sti
xchg dword [edi - 0x480793e], esp
mov ebp, 0x638790a7
sti
add eax, 0x4435c5c
enter 0xffffffffffffcefa, 0xffffffffffffffe6
idiv byte [ecx]
mov ebx, 0x7e7ac7ce
into
out 0xf6, al
cmp dword [ebx + 0x7e7ac7ce], edi
mov eax, ss
fld xword [esi + 0x4eaeca8b]
jg 0x125d9b0
inc eax
adc ebp, dword [ebx + 0x6e]
jg 0x125d9b6
inc eax
jnp 0x125da28
inc esi
jg 0x125d9bc
inc eax
jnp 0x125da5a
jle 0x125da78
enter 0x5b40, 0x17
push 0x7f
enter 0xffffffffffff8640, 0x3f
salc
jl 0x125d9d5
xlatb
aad 0x45
inc ebp
inc ebp
xor bh, cl
dec eax
mov dword [esp + eax - 0x5ea720e9], eax
inc ecx
add bh, 0x2f
call fcn.01279dc4
loope 0x125d9ee
invalid
push ecx
mov esi, 0x856ae131
jg 0x125da21
loope 0x125da8d
test dword [edi - 5], edi
sbb dword [0xfb7f8572], ecx
or eax, 0xfb7f8572
jb 0x125d9af
jg 0x125da27
sti
adc eax, 0x7f854e27
sti
sub ecx, dword [ebx]
inc esi
test dword [edi - 5], edi
cmp dword [ecx], esi
mov ebx, 0x30fb6ac6
pop ds
mov ss, word [eax]
dec ecx
xor edx, ebp
jo 0x125da2b
jnp 0x125da15
mov esi, 0x54dab1c7
invalid
cmp eax, 0x5e790e13
inc ebx
test al, 0x38
das
lcall 0x7383, 0xf1ecc227
or edx, dword [ecx + 9]
inc ebx
jb 0x125da48
push ss
rcr ebp, 0xfe
arpl word [edx], cx
xchg dword [esi + esi*8 + 0x414420e5], ebx
jno 0x125da6a
mul ch
and byte [ecx + eax*2 + 0x71], al
jmp 0x125dad7
push edi
int 0xbd
cli
mov ebp, 0xe8aa98cf
fstp qword [esp + eax*2]
cld
and esi, dword [ecx - 0x41279432]
mov cl, 0xce
imul ebx, eax, 0xffffffbe
and dword [edx], eax
cmovo edx, dword [ebp - 0x18a0b134]
sbb eax, 0xc99ecb92
jmp 0x125db15
dec byte [edi + 0x31]
stosb byte es:[edi], al
clc
jecxz 0x125dad2
mov edi, 0xbd8c0637
mov edi, 0xcc3b372
cmp al, 0x43
or al, 0x3c
inc ebx
add dword [esi + 0x48], esp
popal
cmpsb byte [esi], byte es:[edi]
add edi, ebx
xchg ebx, eax
dec ebp
sbb esp, dword [edx + 0x45d76587]
xor eax, 0x83473d74
idiv dword [edi + 0x55]
push ecx
stosb byte es:[edi], al
sar ebp, 0xe7
xchg ebp, eax
out dx, eax
xor dl, byte [ebx - 0x7c]
add eax, 0x40973830
and dh, bh
adc bh, ch
xor dword [esi], ebx
cdq
xor eax, 0x62ce97a8
add edi, edx
into
bound eax, qword [ebx]
cli
int 0x77
bound edi, qword [esi - 0x70a0e637]
push esp
pop edi
mov al, byte [0x3368f832]
xchg ecx, eax
or eax, 0x89bff2de
jmp 0x125dae2
Function at 0x125fda8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
je 0x12a334f
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x12a3349
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test ecx, esp
lea esp, [esp - 0x114]
clc
test ax, di
push esi
test edx, edx
je 0x12a334f
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x124a1d6
jne 0x12a334f
mov ecx, dword [eax + 0x78]
cmp dh, 0x27
clc
mov dword [ebp - 4], ecx
test ecx, ecx
jmp 0x12e52d9
mov eax, dword [edx + 0x3c]
stc
lea eax, [eax + edx]
cmp dword [eax], 0x4550
jmp 0x1266219
je 0x128bfce
xor eax, eax
pop esi
mov esp, ebp
pop ebp
jmp 0x123eabf
je 0x12a334f
mov eax, dword [eax + 0x7c]
push ebx
stc
cmp si, ax
jmp 0x12eb83c

Function at 0x1275c13
Capabilities:
Encode data using xor

Disassembly:
inc ecx
push esp
inc ebp
movzx esp, bl
inc ecx
push edi
inc ecx
sal edx, 0x19
call fcn.01303f56
sbb dl, dl
sub dh, bh
jle 0x123d2dd
or al, byte [edi - 0x7c647909]
out 0x3b, eax
fisub word [0x7797cf5]
mov ebp, 0xfcb2171b
inc sp
mov esp, dword [ebx]
mov eax, ebp
sal al, 0xc4
dec eax
add ebx, 2
dec esp
lea ecx, [eax + eax*4 + 0x238bf790]
inc ecx
movzx ecx, byte [esi]
dec eax
lea esi, [ebp*8 + 0xf1bf52f]
dec ecx
add esi, 1
call fcn.0124011c
inc ecx
push esp
dec esi
adc dword [esp], ebp
inc ecx
shr ecx, 0x4f
dec esp
lea ebx, [ecx*4 + 0x7836ca83]
jns 0x128869c
js 0x123d2ef
mov dword [edi - 0x74fffb4d], esi
push cs
mov ecx, dword [esi]
call fcn.012ff362
pop es
dec ecx
sar edx, 0x96
movzx ebp, dx
dec eax
mov dword [esp + edx - 0x41], esi
dec esi
lea ebx, [edx*2 - 0x1b455654]
push ecx
inc ecx
movsx ecx, bl
inc ecx
xor edx, eax
jnp 0x123d271
inc dx
neg dx
jmp 0x1303494
inc edx
xor dword [esp + ecx*2], edi
dec ecx
rol esp, cl
inc ecx
pop ebp
dec eax
arpl di, di
dec esp
adc eax, edi
jmp 0x12d1eb6
jmp fcn.016c2840
sal dword [esp + ecx - 0xfc30], cl
rol dx, 1
shl dword [esp + ecx - 0xfc30], 0xee
movsx eax, cl
jae 0x16cfd19
adc dx, 0x8f8f
and byte [esp + eax - 0x2e], ch
and cx, cx
adc word [esp + ecx - 0xfc30], ax
xor bx, dx
shr cl, 0xe1
jae 0x1789090
lea ebp, [ebp + ecx - 0xfc1a]
mov word [ebp + ecx*4 - 0x3f060], dx
pop edx
jae fcn.0128b129

Function at 0x127e0fd
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + edi - 0x23380694], eax
rol dword [esp + edi - 0x23380685], 0x11
dec esp
mov dword [esp + eax*2 - 0x46700d10], ebp
movsx esi, ax
inc eax
mov byte [esp + edi - 0x23380684], bh
inc esp
xor dword [esp + edi - 0x2338067c], esp
inc eax
xadd byte [esp + eax - 0x23380692], bh
dec esp
lea edx, [esi*8 + 0x11aabb99]
dec esp
mov ebp, dword [esp + eax - 0x2338067c]
sub dword [esp + edi - 0x23380626], esi
movzx ecx, di
dec ebp
arpl sp, sp
dec ebp
lea ecx, [edx + ecx*4 - 0x585941e5]
cmpsd dword [esi], dword es:[edi]
inc ecx
mov ebx, 0x54271e3e
rol cx, 0xcb
dec ebp
add eax, esp
shr byte [esp + edi*2 - 0x46700c5c], 0xa6
dec esp
xchg esi, ebx
xor word [esp + edi - 0x23380630], cx
mov si, word [ebx + esi - 0x54271e3e]
xor eax, edx
loope 0x127e155
stosd dword es:[edi], eax
jle 0x1242047
inc ebp
xor edx, ebp
call fcn.012e93dc
jno 0x127e179
push ebx
mov esi, 0xbec28fb7
jge 0x127e191
pop edx
mov esi, 0xb9b3fb7d
mov bl, 0xb9
invalid
Function at 0x127fbbc
Capabilities:
Encode data using base64

Disassembly:
ror edx, 0xdd
not ecx
dec ecx
shl eax, 0x14
sbb dl, 0x1a
add eax, 0xa60baea9
xor ebx, ecx
not eax
dec dl
add edi, ecx
sal eax, 0xa3
shr al, 0xc4
mov ebp, dword [ebp]
call fcn.0128cd41
mov dword [esp + edx - 0x1e98f424], edx
mov dword [esp + edx - 0x1e98f420], edx
neg eax
or dword [esp + edx - 0x1e98f420], ecx
sub cl, 0x83
xor ebx, eax
xadd dword [esp + edx*4 - 0x7a63d08d], edx
adc edi, eax
or dword [esp + 4], 0xe2953132
mov eax, dword [ebp]
sal word [esp + 1], 0xa9
ror ecx, cl
jae 0x12d528f
call fcn.012f43d6
dec ecx
shr edi, 0x6e
xadd ebp, edx
inc bp
mov edx, dword [edi + ebx]
dec esp
xor edi, eax
inc esp
and ecx, eax
inc dx
mov ebp, dword [ebx + ecx + 2]
dec eax
adc eax, edx
dec edx
lea ebx, [ebx + ecx*8 + 2]
inc ecx
push ecx
inc cx
ror ecx, 5
inc sp
adc edx, ebp
inc si
mov dword [ebx + ecx], edx
inc dx
mov dword [esp + ecx + 6], 0x894ee723
add al, 0xc
ret
mov cl, byte [ebp + ecx - 0x47e9ad28]
adc dx, dx
sbb edx, 0x8e1d94b5
mov byte [eax + edx - 0xadfe386], cl
lea ecx, [edx*8 + 0x5031d711]
rdtsc
xor dword [esp + 4], 0xa3316713
mov dword [ebp + 2], eax
pop ecx
mov dword [ebp - 2], edx
movsx eax, cl
shr cl, cl
movzx edx, byte [esp + eax - 0x24]
lea ebp, [ebp + eax - 0x26]
call fcn.012373ca
mov ecx, dword [esi]
mov edx, 0xf538d830
sal dl, 0x23
add esi, 4
movzx eax, dx
and dl, al
rol eax, 5
xor ecx, ebx
or edx, eax
dec ecx
sub eax, eax
or eax, eax
neg dl
ror ecx, 1
jmp 0x1225460

Function at 0x1286b9a
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov dword [esp + ebp + 8], ecx
lea esi, [esi + ebp*2 + 0x44a63ca2]
push edx
ror esi, 1
sal al, 0xa4
sar ax, 0xc3
pop ecx
lea esi, [esi + ebp - 0xa9df3bb]
xor edx, 0xecb744b3
jge 0x1314013
mov eax, 0xdd1073be
inc esp
mov esp, dword [esp + 3]
dec ecx
and esi, ecx
inc cx
shl esp, 0xc7
not byte [esp + 7]
dec eax
not esi
shr word [esp + 6], 0xa6
dec ebp
lea edi, [esp + eax*2 + 0x68fd3a6]
dec eax
mov dword [ebx + 8], esi
inc ecx
mov ebp, esp
inc eax
sets ch
inc ebp
movsx edx, bh
dec ebx
mov edx, dword [esi + edx - 0x22]
dec ecx
xor edx, ebp
dec eax
dec edx
inc esi
xchg dword [esp + edx*2 - 0x42], edi
inc esi
xadd byte [esp + edx*2 - 0x3e], dl
dec eax
not edx
dec eax
inc edx
call fcn.0125d389
dec esi
dec eax
and ebp, 0x2439f524
inc ecx
dec ebx
neg esi
dec esp
mov dword [esp + ebp], ecx
jmp 0x126f4b5
dec esp
adc dword [esp + ebp + 8], ebp
xor dword [esp + ebp*4 + 8], esi
dec edi
lea edi, [edx + edx*2 + 0x208769f]
call fcn.012e1f53
aam 0x4a
inc ebp
mov esi, 0x1f5f2018
imul edi, ebx, 0x26
push edi
pop ds
imul edi, ebx, 0x28
cmp cl, byte [ebx + 0x1f]
imul edi, ebx, 0x38
sub dl, byte [edi + 0x1f]
imul edi, ebx, 0xffffffdc
xor al, 0xba
pop esp
jle 0x1314046
sub dword [esi], ebx
xchg edi, eax
invalid
Function at 0x129fad6
Capabilities:
Encode data using base64

Disassembly:
lea edx, [esp + edx + 4]
mov dword [edx], eax
neg cl
jno 0x12c976e
mov eax, 0xb906a0bc
mov ecx, 0x7a0f6c38
dec eax
mov edx, dword [ebx + ecx - 0x7a0f6c38]
jmp 0x17a74bb
neg ecx
xor bl, dl
mov dword [esp], ecx
shl dword [esp], 0x5b
jae 0x1281e82
inc ecx
movzx ecx, byte [esi]
mov eax, 0x72a8e122
dec ecx
shr esp, 0xab
dec edi
lea esi, [esp + esi + 1]
dec ecx
lea edi, [ecx - 0x4ad16ae3]
inc ecx
neg esp
dec ecx
cmove esi, ecx
inc ecx
xor cl, ch
neg cl
dec esp
mov ebx, dword [esp + 8]
dec ecx
add ebx, 0xc69aa
inc ecx
jmp ebx
inc esp
mov esp, eax
dec esp
mov edx, dword [ebx + ecx - 0x7a0f6c30]
inc esp
movzx edi, cx
dec ecx
add edx, edx
inc ebp
mov edx, edi
inc ecx
dec esp
inc esp
movzx ecx, cx
dec ecx
mov dword [edi + ebx - 0x6c30], edx
inc ebp
movzx ebx, cx
dec ebx
lea edi, [edi + edi*2 + 0x58c879d]
inc ecx
sets bh
inc ebp
mov esp, dword [esi + ecx - 0x7a0f6c38]
inc ecx
movzx ebp, dx
inc eax
setp ch
inc ecx
mov esi, edx
dec esi
lea esi, [ecx + esi - 0x7a0f6c34]
mov edx, 0xed95be19
inc ebp
xor esp, ebp
inc edi
lea esp, [esp + edi + 0x1d350788]
neg esi
inc cx
sar edx, 0x8e
shl edi, 0xde
inc ecx
rol esp, 1
sar cx, 0xaa
shr si, 0x4a
inc ecx
neg esp
inc eax
and cl, ch
dec bp
dec ebp
sub ebx, edx
inc ecx
rol esp, cl
inc ebp
sub esp, edx
sar dx, cl
ror edi, cl
inc ecx
not esp
inc ecx
adc edi, 0x6410e01b
inc eax
sal bh, cl
inc ebp
adc esp, edx
inc ecx
not esp
dec esp
and ebx, edx
inc ebp
sbb esp, edx
dec ecx
shr ebx, 0xee
inc ecx
rol edx, 0x34
inc ecx
push ebp
inc esi
xor dword [esp + edx*2 - 0x200000], esp
inc ecx
pop ebp
inc cx
and ecx, edx
inc esp
sub bl, ch
dec ebp
arpl sp, sp
dec ebp
adc eax, esp
inc cx
sar ebx, 0xc2
dec edx
mov esi, dword [ebx + edi - 0x64114c14]
call fcn.012dc652
Function at 0x12dc6b9
Capabilities:
Encode data using xor

Disassembly:
push esp
inc ebp
add al, cl
or al, 0x44
push edx
xor ax, ax
sal ax, 0xa3
lea ecx, [ebp + eax*2 + 2]
or word [esp + eax + 1], ax
jns 0x12fcf92
inc ecx
mov ebx, 0x7024d36
inc ebp
mov edi, ebx
inc ecx
xor ecx, ebp
inc ecx
movsx eax, bl
dec edx
lea esi, [edi*4 + 0x283218be]
dec esi
inc edx
lea ecx, [ecx + ebx*2 - 0x7631c7ed]
jp 0x16d0cb4
jecxz 0x121cfa2
out 0x60, eax
xor ecx, edi
imul esi, dword [ebp + 9], 0x87afe1a2
invalid
loope 0x121cf2f
xchg dword [edi + 0x23dc3bd6], ecx
nop
mov bp, word [ebx + edi - 0x28]
and ecx, 0xd5063f26
jae 0x16cb7b4
test al, 0x7f
les esp, [ebx - 0x2bab7b39]
aas
loop 0x121cf7e
pop es
iretd
inc eax
adc bh, 0x84
jle 0x128d869
inc ecx
push ebx
push ebp
ror edi, 1
not edi
xor edi, 0x40a62aa4
or byte [esp + ebp - 0x11], 0x2c
inc ecx
and ebp, ebx
movsx edx, bp
dec esp
mov dword [esp + ebp*2 + 0x18], ebp
xor dword [esp + ebp*4 + 0x18], edi
dec esp
mov ebp, dword [esp + ebp*4 + 0x18]
dec eax
mov dword [esp + ebp*2 + 0x18], edx
dec eax
arpl di, di
dec esp
add eax, edi
dec eax
mov eax, ebx
dec eax
lea ebx, [ebp + ebx - 4]
inc esp
movzx edx, ch
mov dword [ebp + ebx], eax
inc ecx
pop ecx
pop ebp
pop eax
inc ecx
pop ebx
jmp fcn.016c2840
mov ecx, edx
bswap edi
lea edi, [edi + eax - 0x20031fec]
setl cl
bswap edx
neg edi
inc ecx
push ebp
inc esp
xchg dl, dl
dec eax
rol eax, 0x27
jb 0x127f058
xor dword [esp + ebp - 0x4700], edi
call fcn.0124a57c
mov edi, 0x1d166d2d
inc esp
movsx ebx, di
inc ebx
mov edi, dword [esi + ebx*8 - 0x36968]
inc ecx
push ebx
inc ecx
push ebx
dec edi
lea esi, [esi + ebx*2 - 0xda56]
inc esi
and dword [esp + ebx*2 - 0xda53], ebx
inc edx
movzx ebp, byte [esp + ebx - 0x6d25]
inc ecx
xor edi, ebp
dec ecx
rol ebx, 0x9d
dec eax
shr dword [esp + ebp - 0x25], 0xca
dec edi
xor edi, 0x2a935896
jmp 0x125ab08
inc ecx
pop ebx
pop edi
inc ecx
pop ecx
jno fcn.016c2840
in al, dx
sub al, 0xf2
push ebp
psrad mm7, qword [eax + 0x53]
inc cx
mov ecx, dword [esi]
dec ecx
add esi, 4
jmp 0x121cf4c
mov dword [eax + ebp - 2], ecx
lea ebp, [ebp + eax*4 - 2]
push eax
pop eax
pop ecx
jge fcn.0128b129
dec edi
lea edi, [esp + 0x6129e421]
adc si, bp
mov word [ebx + edi - 0x28], si
inc ebp
mov ecx, dword [esi + edi*8 - 0x150]
dec ebp
lea esi, [esi + edi - 0x26]
inc ebp
movsx ebx, dl
dec ebp
and edx, edi
inc ebp
xor ecx, ebp
dec esp
lea esp, [eax + edi*2 - 0x404ec500]
inc ecx
inc ecx
inc ecx
bswap ecx
inc ebp
sub edx, esp
neg eax
dec ecx
rol esp, 0xb3
inc ecx
not ecx
dec ecx
not esp
inc ecx
rol ecx, 1
dec ecx
xchg esp, eax
inc ecx
push ebp
mov esi, 0x1f0ec209
inc ecx
xadd edx, edi
inc esp
xor dword [esp + esi*4 - 0x7c3b0824], ecx
inc ecx
pop ebp
dec ebp
arpl cx, cx
dec edx
lea ebp, [ebx*8 - 0x60d59960]
dec eax
not eax
inc eax
movzx edx, dh
dec ebp
add eax, ecx
bswap edi
inc dx
mov edx, dword [ebx - 0x6a5fb5d4]
inc eax
add cl, dh
je 0x1233f44
inc bp
mov ecx, dword [esp + ebx - 0x6a5fb5d2]
inc ecx
xor ch, bh
neg cl
inc cx
and edx, ecx
dec eax
or eax, 0x5fa8c4ba
inc ecx
xadd dl, cl
inc sp
cmovo ebx, eax
not dx
jp 0x1224893
inc ecx
mov edx, edx
not edi
dec edi
inc ecx
xor ebp, edx
jge 0x12ce7d1
Function at 0x12f3357
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx*8 - 0x60fe20c2]
sub dl, dh
xor al, bl
mov dword [esp + edx - 0x4d66c34b], 0x642e3618
ror al, 1
not al
call fcn.012d2652

Function at 0x1311103
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov edx, dword [esi]
dec ecx
add esi, 4
inc ecx
xor edx, ebp
inc ecx
mov ebx, 0x173f199c
dec esi
mov dword [esp + ebx*2 - 0x2e7e3338], ebx
sub edx, 0xb1be1131
rol edx, 2
inc ecx
lea edx, [ebx + edx + 0x63455ef9]
inc ecx
push ebx
inc si
and dword [esp + ebx*2 - 0x2e7e332b], ebx
ror edx, 2
inc ebp
mov edi, ebx
sub edx, 0xf70e4ab8
inc ebp
and bh, bh
dec esi
mov dword [esp + ebx*4 - 0x5cfc6668], ebp
inc ecx
movsx esi, bx
inc edx
ror byte [esp + ebx - 0x173f1995], 0xa1
inc edx
xor dword [esp + edi - 0x173f1994], edx
inc eax
movzx ecx, dh
movzx edi, cx
dec esi
mov ebp, dword [esp + ebx*2 - 0x2e7e3330]
pop edi
dec eax
arpl dx, dx
call fcn.0128c13f
inc ecx
mov edi, 0x2b341e3f
inc ecx
mov esp, 0xa1b4f796
inc ecx
mov esi, edi
inc ecx
mov esi, dword [edi + ebx - 0x2b341e3f]
inc edx
mov edx, dword [ebx + edi*2 - 0x56683c7a]
jmp 0x179cbcd
inc cx
add eax, esp
not edi
sbb edi, 0xc2117126
shr dl, 0x26
dec edx
lea ecx, [ebp + edi*2 + 0xd93daa3]
inc esp
movsx ecx, ax
ror edi, 1
inc esp
sub cl, al
rol cx, 0xc6
inc edi
dec ecx
shr esp, cl
rol edi, 3
inc ecx
rol bl, 0x61
dec eax
sar ecx, 0xa5
inc ecx
push ebp
mov esi, 0xea3f062b
call fcn.017acdb6
add esi, edx
dec edi
lea esp, [edi + edi - 0x546c8271]
inc ecx
mov edx, esp
inc ecx
sal ah, 5
inc ecx
mov dword [edi + ebx - 0x2b341e3b], esi
inc ebx
mov edi, dword [esi + edi - 0x2b341e3f]
dec ebx
lea eax, [edi + 0xb44bb8]
movsx ebp, ax
inc ecx
xor edi, ebp
xor edi, 0x7d2dfea2
rol edi, 2
dec edx
inc ecx
lea edi, [edi + edi + 0x3559c6e1]
inc esp
movsx ebx, al
jp 0x16c6463
Function at 0x1774f90
Capabilities:
Encode data using base64

Disassembly:
inc ecx
inc edx
dec eax
mov dword [esp], 0x3f1f893b

Function at 0x1796c81
Capabilities:
Execute syscall

Disassembly:
mov edi, dword [esp + edi*2 + 0x64b562d8]
mov dword [esp + 8], 0x403a37e7
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.0126319e
call fcn.017ab413
push edi
pushfd
mov edi, 0xcda54e98
push edi
cmp word [esp + edi + 0x325ab168], 0xcb8c
jbe 0x1288d6d
Function at 0x179c714
Capabilities:
Encode data using xor

Disassembly:
inc edi
lea edi, [edi + ecx - 0x7cadb21b]
jno 0x1789e87
dec esp
adc eax, esi
inc ecx
pop edi
inc edx
inc dword [esp + ecx - 0x7ffffffd]
call fcn.0128ca09
dec edx
lea ebx, [ebx + ecx - 0xf805]
inc si
mov dword [ebx + ecx*4 - 0x3e02c], esp
inc ebp
movzx esp, cx
inc edi
mov edi, dword [esi + edx - 0x3a2af80b]
inc ecx
movsx eax, dl
dec edi
lea esi, [esi + ecx*8 - 0x7c054]
jle 0x129e994
movzx ebp, al
inc ebp
xor edi, ebp
inc ecx
movsx ecx, ah
dec esi
lea ebx, [ecx*4 + 0x5fbd2226]
inc edi
lea edi, [edx + edi + 0xa912ff5]
inc ecx
neg edi
inc ecx
not edi
inc eax
or ch, 0xbc
jnp 0x128cd33
inc dx
neg dword [esp + edx - 0x13c]
dec edx
lea ebx, [ebx + edx*8 - 0xa88]
dec esi
mov dword [esp + edx - 0x152], eax
ret 0x10
add di, bp
dec esi
mov dword [esp + ecx - 0x1785a80e], ebp
dec edi
dec esi
mov dword [esp + ecx - 0x1785a816], edi
inc edx
xor dword [esp + ecx*2 - 0x2f0b502c], esi
mov ecx, 0x94324102
inc esp
mov ebx, edi
inc ecx
xor bh, dl
dec esi
mov ebp, dword [esp + ecx*2 - 0x2f0b502c]
dec eax
mov dword [esp + ebp - 0xa8c0], 0xa8ae5996
dec eax
arpl si, si
inc ecx
sal ecx, 0x5e
shr edi, 0xa
jae 0x1791b18
popfd
int 0xd
mov esi, 0x98264f43
and edi, ebx
lodsd eax, dword [esi]
inc ecx
push cs
cwde
and edi, ebx
jns 0x179c7ef
cwde
and edi, ebx
push ebp
pop ecx
push cs
cwde
and edi, ebx
pop edi
pop eax
cdq
aas
sti
aad 0xa4
inc edx
pop ds
add al, 7
xor al, byte [ebp - 0x1277aea6]
mov dh, 0x38
mov al, 0x35
jo 0x179c7ed
and dword [ecx - 0x40ce3eb8], ecx
sub dh, bl
add dl, al
mov ah, byte [ebx + 0x6088195c]
push esi
sub ebx, dword [edx + 0x643a6d73]
mov ecx, esp
or eax, 0x2dc16776
ficom dword [eax]
enter 0x2c78, 0x6f
xchg esi, eax
mov cl, 0x2e
mov es, ebp
xchg esi, eax
cmp al, 0x20
sti
pop ebx
mov ecx, 0x1e06122
inc ebx
aas
sub dword [ebx], eax
jb 0x179c81a
push es
adc dword [0x4fd49a7], ebx
in al, 0x8d
stc
push cs
adc byte [eax - 0x5785a6b2], bl
in eax, 0x49
jge 0x179c776
sbb al, bh
sbb eax, 0x5f39fc07
or edi, eax
std
bound edx, qword [esi]
push ss
hlt
invalid
push 0xfffffffffffffff9
nop
div byte [ecx]
test eax, 0x566ed774
or eax, dword [ebp - 0x2d]
ljmp 0x8601
Function at 0x401050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x429008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.FLAGS
push 0x84
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.00402255
push str.net451
lea ecx, [ebp - 8]
call fcn.00401e44
test eax, eax
jne 0x40109e
inc esi
jmp 0x401130
push str.net452
lea ecx, [ebp - 8]
call fcn.00401e44
test eax, eax
jne 0x4010b3
push 2
jmp 0x40112f
push str.net46
lea ecx, [ebp - 8]
call fcn.00401e44
test eax, eax
jne 0x4010c8
push 3
jmp 0x40112f
push str.net461
lea ecx, [ebp - 8]
call fcn.00401e44
test eax, eax
jne 0x4010dd
push 4
jmp 0x40112f
push str.net462
lea ecx, [ebp - 8]
call fcn.00401e44
test eax, eax
jne 0x4010f2
push 5
jmp 0x40112f
push str.net47
lea ecx, [ebp - 8]
call fcn.00401e44
test eax, eax
jne 0x401107
push 6
jmp 0x40112f
push str.net471
lea ecx, [ebp - 8]
call fcn.00401e44
test eax, eax
jne 0x40111c
push 7
jmp 0x40112f
push str.net472
lea ecx, [ebp - 8]
call fcn.00401e44
test eax, eax
jne 0x401130
push 8
pop esi
lea ecx, [ebp - 8]
call fcn.00401e7b
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040a35c
leave
ret