joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4649a6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045895f
and dword [ebp - 4], 0
cmp dword [0x4cae34], 0
mov ebx, eax
jne 0x464a57
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x464b08
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49bc8c
push edi
call esi
test eax, eax
je 0x464b08
push eax
call fcn.004588ed
mov dword [esp], 0x49bc7c
push edi
mov dword [0x4cae34], eax
call esi
push eax
call fcn.004588ed
mov dword [esp], 0x49bc68
push edi
mov dword [0x4cae38], eax
call esi
push eax
call fcn.004588ed
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4cae3c], eax
call esi
push eax
call fcn.004588ed
pop ecx
mov dword [0x4cae44], eax
test eax, eax
je 0x464a57
push 0x49bc34
push edi
call esi
push eax
call fcn.004588ed
pop ecx
mov dword [0x4cae40], eax
mov eax, dword [0x4cae40]
cmp eax, ebx
je 0x464aaf
cmp dword [0x4cae44], ebx
je 0x464aaf
push eax
call fcn.00458968
push dword [0x4cae44]
mov esi, eax
call fcn.00458968
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x464aaf
test edi, edi
je 0x464aaf
call esi
test eax, eax
je 0x464aa6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x464aa6
test byte [ebp - 0xc], 1
jne 0x464aaf
or dword [ebp + 0x10], 0x200000
jmp 0x464ae8
mov eax, dword [0x4cae38]
cmp eax, ebx
je 0x464ae8
push eax
call fcn.00458968
pop ecx
test eax, eax
je 0x464ae8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x464ae8
mov eax, dword [0x4cae3c]
cmp eax, ebx
je 0x464ae8
push eax
call fcn.00458968
pop ecx
test eax, eax
je 0x464ae8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4cae34]
call fcn.00458968
pop ecx
test eax, eax
je 0x464b08
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x464b0a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x469da0
Capabilities:
Access the windows event log

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.00453840
mov eax, dword [0x4c3aa8]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x469e05
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x469e05
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.00452a9d
add eax, 0x40
push eax
call fcn.00452f13
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0044e1ea
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.0048b7c2
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x469e94
call fcn.00469c60
test eax, eax
jle 0x469e94
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0044e1ea
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0044e1ea
add esp, 0x108
ret

Function at 0x46c930
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x46c95f
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [ecx]
lea esi, [esi + edi - 0x61c88647]
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x46c940
pop edi
pop esi
ret

Function at 0x473790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48fe68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c3aa8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00413eb0
mov dword [esp + 0x18], 0
test edi, edi
je 0x4737d4
add edi, 0x28
jmp 0x4737d6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4737ee
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x474320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x490018
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c3aa8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00422630
mov dword [esp + 0x18], 0
test edi, edi
je 0x474364
add edi, 0x28
jmp 0x474366
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x47437e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x475eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4901f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c3aa8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00413eb0
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x475efa
add edi, 0x28
jmp 0x475efc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x475f14
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x47dd20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x490853
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4c3aa8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00478c70
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.00478c70
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.00478c70
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x48a260
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x490018
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c3aa8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00422630
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x48a2c5
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x48a360
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x491293
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c3aa8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0048a260
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_base.0
lea eax, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.1.0
mov dword [eax], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.0
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.2.0
cmp edi, ecx
je 0x48a3c2
lea ecx, [edi + 0x30]
push ecx
push eax
call fcn.00470c10
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x48af60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x4aefa4
mov dword [esp], eax
mov dword [esp + 4], 0x4b1888
mov dword [esp + 8], 0x4b1894
mov dword [esp + 0xc], 0x4ae0d0
mov dword [esp + 0x10], 0x49c150
mov dword [esp + 0x14], 0x4b1108
mov dword [esp + 0x18], 0x4b18a0
mov dword [esp + 0x1c], 0x49c170
mov dword [esp + 0x20], 0x4ae0cc
mov dword [esp + 0x24], 0x4b0cbc
mov dword [esp + 0x28], 0x4ae0c8
mov dword [esp + 0x2c], str._
mov dword [esp + 0x30], 0x4aec7c
mov dword [esp + 0x34], 0x4afeac
mov dword [esp + 0x38], 0x495930
mov dword [esp + 0x3c], 0x4ae0c4
mov dword [esp + 0x40], str.___
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x49d9a4
mov dword [esp + 0x4c], str.BDMS
mov dword [esp + 0x50], 0x4b2838
mov dword [esp + 0x54], 0x4b2778
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x4ae0b0
mov dword [esp + 0x64], 0x4ae0ac
mov dword [esp + 0x68], 0x4b1ea4
mov dword [esp + 0x6c], 0x4b056c
mov dword [esp + 0x70], 0x49d9ac
mov dword [esp + 0x74], 0x4addc4
mov dword [esp + 0x78], 0x4adda4
mov dword [esp + 0x7c], 0x4b0cb8
mov dword [esp + 0x80], 0x49d9a0
mov dword [esp + 0x84], 0x4add90
mov dword [esp + 0x88], 0x4add8c
mov dword [esp + 0x8c], 0x4addd0
mov dword [esp + 0x90], 0x4ae0a8
mov dword [esp + 0x94], 0x49a218
mov dword [esp + 0x98], 0x4addc8
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x4ade78
mov dword [esp + 0xc0], 0x4ade54
mov dword [esp + 0xc4], 0x4ade3c
mov dword [esp + 0xc8], 0x49a21c
mov dword [esp + 0xcc], str.ZYXWVUTRQPNKJIHGFEA
mov dword [esp + 0xd0], 0x4ade70
mov dword [esp + 0xd4], 0x49c198
mov dword [esp + 0xd8], 0x4970c0
mov dword [esp + 0xdc], 0x4ade58
mov dword [esp + 0xe0], 0x4ade5c
mov dword [esp + 0xe4], 0x4ae0a4
mov dword [esp + 0xe8], 0x4ade60
mov dword [esp + 0xec], 0x4ade50
cmp cl, 0x3c
jae 0x48b17d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x406cdf
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x67eae4df
mov esi, 0x410000
mov ebx, 0x97c2687b
sub esp, 0x11e4
mov edi, esp
cld
mov ecx, 0x479
ror edx, 7
sub edx, ebx
sub ebx, ecx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
dec ecx
jne 0x406cfc
push esp
ret
Function at 0x1001ec1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1001ec29
pop dword [ebp - 0x28]
mov eax, 0x1001ec29
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x66cdfea4
sub dword [ebp - 0x38], 0x187bb959
mov dword [ebp - 0x34], 0x12059048
sub dword [ebp - 0x34], 0xdfd24403
mov dword [ebp - 0x30], 0xc345625
sub dword [ebp - 0x30], 0xbfe811f7
mov dword [ebp - 0x2c], 0xfffbe8a9
sub dword [ebp - 0x2c], 0xfffbe8a9
lea eax, [ebp - 0x38]
push eax
mov eax, 0x85053cd6
add eax, 0x8afcc32e
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x5848d87c
add dword [ebp - 0x38], 0x1c2990da
mov dword [ebp - 0x34], 0x1a2bed3a
sub dword [ebp - 0x34], 0xd8bf8bc5
mov dword [ebp - 0x30], 0x4dde22a2
add dword [ebp - 0x30], 0x159149ca
mov dword [ebp - 0x2c], 0x3cfbae51
sub dword [ebp - 0x2c], 0x3cfbae51
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a336
push 0
call eax
mov ecx, 0xb41ea099
add ecx, 0x4be19dd8
mov edi, eax
mov ebx, 0xaeedd197
sub ebx, 0x9eeb1597
add ebx, dword [ebp - 0x28]
mov edx, 0xfc8c19b
add edx, 0x12d9a8c0
add dword [ebp - 4], 0xba9b3be1
mov esi, dword [ebx]
xor dword [ebp - 8], 0x43e94996
xor esi, edx
mov dword [ebp - 0x18], 0x61ec2452
mov dword [edi], esi
mov dword [ebp - 0x10], 0x2ae450f0
add edi, 0x2c456294
add edi, 0xd3ba9d70
add ebx, 0xba37a282
add ebx, 0x45c85d82
loop 0x1001ed41
add eax, 0xa0a5b175
sub eax, 0xa0a4c4de
mov ebx, eax
add eax, 0x8dcdac10
add eax, 0x723253f5
mov ecx, 0xa291fa48
add ecx, 0x6d6e05b8
add ecx, dword [ebp - 0x28]
invalid
Function at 0x1041f27
Capabilities:
Encode data using base64

Disassembly:
dec esi
lea esi, [ebp + esi - 0x27b1]
inc ebp
add dl, al
dec eax
mov dword [esp + ebp - 0x27b3], ebp
call fcn.01c25bb9

Function at 0x1041f3f
Capabilities:
Encode data using base64

Disassembly:
inc esp
mov edi, dword [ebx + edx - 0x33f219]
dec eax
mov dword [esp + edx*2 - 0x67e432], edi
inc cl
inc ebp
xor edi, ecx
dec ecx
sub edx, 0x6aba8fbb
inc ebp
lea edi, [edi + edx*4 + 0x22eef539]
inc si
add dword [esp + edx + 0x6aba8f2c], ebx
inc ecx
neg edi
inc ebp
xchg bl, dl
neg word [esp + edx*2 - 0x67e430]
jg 0x1ba73df
mov eax, 0x84129486
xor ax, ax
mov eax, dword [ebp]
push 0xb03da69b
adc ebp, 4
xor eax, ebx
inc eax
xor eax, 0x799f4502
sal dword [esp], 0xe9
not eax
js 0x1bc3015
bswap eax
dec eax
shl dword [esp], 0x3d
xor ebx, eax
add edi, eax
lea esp, [esp + 4]
jmp 0x1cb64f5
inc ecx
rol ebp, cl
inc sp
xadd eax, ebp
inc ecx
pop ecx
call fcn.01cf2733
call fcn.01b6de0f
dec ebp
mov esp, dword [esi]
inc ecx
movsx edx, bh
movsx ebp, dx
dec esi
lea eax, [edi*4 + 0x23980800]
inc ecx
mov ebp, dword [esi + edx - 0x35]
dec ebp
lea esi, [esi + edx - 0x31]
inc ecx
sar al, 6
inc ecx
mov dword [esp + edx*8 - 0x1e8], ebp
js 0x1cf2fb0
inc ecx
ror edi, 1
inc sp
and dword [esp + edx*2 - 0x67e42f], edx
inc ecx
inc edi
dec esp
lea eax, [edx + edx*2 + 0x5a8f1299]
inc ecx
pop ebx
inc ecx
movsx eax, ch
inc ecx
push ecx
inc esp
xor dword [esp + edx - 0x33f219], edi
jmp 0x1b6cc71
xadd dl, ch
not edx
xor eax, 0x792ff01e
dec edx
xor ebx, eax
add edi, eax
jmp edi
push edi
mov dword [esp], 0xb004c52d
call fcn.01d69749

Function at 0x104a6c6
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edx + ebp - 0x26a0007f]
lea ebp, [edx + ebp - 0x26a0007b]
lea ecx, [edx*2 + 0x390b2e82]
xadd dl, cl
rol ecx, 0x49
xor eax, ebx
rol eax, 2
inc eax
mov dword [esp + edx*2 - 0x4d4001fe], ecx
xor cx, word [esp + edx*2 - 0x4d4001fd]
call fcn.01053948
inc sp
xor ecx, ebp
jmp 0x105589d
dec ebp
lea esi, [esi + ecx*2 - 0x750286]
inc ebp
movzx edx, bh
inc bp
and esp, ebx
inc dx
mov dword [ecx + esi - 0x3a8142], ebp
dec eax
lea ebx, [ebx + ecx*2 - 0x750288]
dec eax
add dword [esp + edi - 0x3a81fe], 0xd506ed81
mov ecx, dword [ebx + ecx*2 - 0x750284]
dec ecx
adc ebp, 0x409893a9
inc ecx
xor ecx, ecx
inc cx
not ebx
lea ecx, [ecx + edi - 0x5363cc81]
jmp 0x1d153cd

Function at 0x1bb066d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esi + 4]
call fcn.01d4193c
salc
arpl word [edx + 0x42], si
aaa
in al, dx
sub eax, 0x829f0aad
mov ecx, 0x31d9823f
invalid
Function at 0x1bd2932
Capabilities:
Encode data using xor

Disassembly:
sub dh, byte [edi]
xor al, 0x57
pop ecx
cmp eax, 0xd87a42b1
lahf
test byte [edx + 0x456bfbd6], ah
and ebx, edi
inc esi
sub ebp, dword [esp + edx - 0x7395]
jae 0x1cf4958
call fcn.01066562
enter 0x73cf, 0xffffffffffffffd6
jae 0x1bd2911
pushfd
cmp dl, byte [edx + 0x51b06199]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
dec eax
mov esi, 0x2af69960
xor al, 0x7f
and dword [ecx - 0x11], eax
mov ds, esp
push ebx
sub al, 0x24
mov bl, 0x70
cmpsd dword [esi], dword es:[edi]
test dword [ecx + 0x2c1956c9], eax
in al, 0x6f
sal dword [esi + edx*2 - 0x7f], 1
je 0x1bd2939
push ebx
xlatb
imul ebx, dword [edx + 0x2a6e834a], 0x3f
mov dl, byte [edi - 0x55]
adc dword [ecx], ecx
in al, 0x1c
out dx, eax
mov eax, dword [0x6c1e8dd1]
jmp 0xd348aeb1
rol ecx, 3
dec edx
lea eax, [ebx*8 + 0x778ac227]
call fcn.01bff201
int3
dec edx
and dword [esp + edx - 0x7397], ebp
inc ecx
not ebx
inc esi
add byte [esp + edx*2 - 0xe72e], dl
inc esi
movzx edi, byte [esp + edx*4 - 0x1ce5b]
inc esp
movzx eax, ch
inc edi
mov dword [edx + esi - 0x7397], ebx
inc ecx
pop ebx
dec edx
lea ebx, [ebx + edx - 0x739b]
inc edx
mov ecx, dword [ebx + edx*4 - 0x1ce5c]
inc bp
or edx, eax
inc ecx
xor ecx, ecx
inc cx
ror ebp, 0x29
bswap ecx
inc ecx
rol bh, 0xa1
jae 0x1be0dda

Function at 0x1bef056
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.01cc8383
or dword [esp + edx - 0x7ffffffc], edx
sar edx, 0x3e
mov byte [eax], cl
mov dword [esp], edx
movsx eax, byte [esp + 3]
mov ecx, dword [ebp]
jne 0x1b9bbe1
Function at 0x1c04380
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov ecx, dword [esp + edi - 0x30a2d466]
inc dx
add dword [esp + edi - 0x30a27e71], 0xf7660e1a
pushfd
cmp al, 0x8b
sub ebx, dword [ebp - 0x31]
dec edx
mov dword [esp + edi*2 - 0x6144fcec], ebp
dec eax
arpl dx, dx
not di
dec esp
lea eax, [ecx + edi*2 + 0x44b3098c]
call fcn.01b98489
xchg esi, eax
test al, 0xc3
mov edi, 0x586de685
cmp al, 0xb
mov dword [0xbed30403], eax
sbb dword [ecx + ebp*2 - 0x79cd4857], eax
dec esi
sub byte [edx - 0x6e61e04c], dh
xchg byte [esi + 0x28], cl
mov dl, 0xb4
pop ds
sahf
xchg ecx, eax
fild dword [ecx]
sqrtps xmm3, xmmword [ecx]
call 0x9fdb1534
xor al, 0xcd
jle 0x103cc84
mov bh, 2
in al, 0x43
mov eax, 0xfb8f7fd5
movups xmm3, xmmword [esi]
aaa
cmp esp, esi
xchg ecx, ebp
rol esi, 1
sal dword [ecx], 0x32
lodsd eax, dword [esi]
jecxz 0x103ccbe
mov edi, 0xb399d99f
mov cl, 0xe3
push esi
push ebp
out 0x4f, al
dec edi
jp 0x103ccd9
inc edx
inc edi
jmp 0x93b91048
loop 0x103cd54
or al, 8
out 0x50, eax
xchg byte [edx], ch
inc ebx
cmp esi, dword [edx + 0x4a6da7a6]
mov ah, 0x4a
push cs
mov esp, 0xf42a1d3e
les esi, [edi + 0x45]
mov ah, 0xb3
test dword [edx - 0xd], edi
sal byte [edi], 0x6f
in al, 0x34
jl 0x103cd05
mov byte [0x3765606d], al
insb byte es:[edi], dx
invalid
stosd dword es:[edi], eax
dec eax
sbb al, 0xd1
retf
inc dx
inc dword [esp + edi - 0x30a2d47e]
dec edx
lea ebx, [ebx + edx - 0x89]
inc edx
mov edx, dword [ebx + edi - 0x30a2d484]
inc ebp
mov ebx, edx
dec ecx
shl ebx, 0x82
inc ecx
xor edx, ecx
dec edx
ror dword [esp + edi - 0x30a2d47d], 0xaf
dec esi
sub dword [esp + edi - 0x30a2d477], ebx
rol edx, 1
inc si
xchg dword [esp + edi - 0x30a2d479], edi
inc ecx
bswap edx
dec esi
lea ebp, [ebx*2 + 0x7701c78d]
dec edx
inc esp
or bh, cl
dec ecx
inc ebp
movsx esp, bh
rol edx, 1
inc edx
jmp 0x1d4e93e
dec esi
lea esp, [esp + 0x18]
dec esi
mov dword [esp + edi*2 - 0x6145a908], edi
dec ebx
mov dword [edi - 0x30a2d484], ebp
jmp 0x1b6d72c
inc cx
dec edi
inc ecx
ror bl, 1
neg edx
dec edx
inc edx
movzx ebp, word [esp + edi - 0x30a27e78]
rol edx, 2
dec edx
lea eax, [edx*8 - 0x22ec02dd]
inc edx
sub dword [esp + eax - 0x71dd200b], edi
dec esi
mov dword [esp + edi - 0x30a27e6e], ecx
xor dword [esp + edi - 0x30a2d466], edx
inc ecx
and ch, 1
jno 0x103cc39
dec ebp
mov dword [esi + edi*2], edi
jmp fcn.01bf2c54
Function at 0x1cca068
Capabilities:
Encode data using xor

Disassembly:
cli
fild qword [eax + esi - 0xf200]
lea edx, [eax + eax*2 + 0x4f1dd73e]
jmp edi
dec eax
arpl cx, cx
inc ebp
xadd dl, bh
inc ebp
movsx eax, bh
dec eax
adc esi, ecx
dec ebx
mov edi, dword [esi + eax*2 - 0x2a]
inc ecx
movsx edx, al
dec edx
lea ebp, [ebp*4 - 0x9d9fb79]
dec edi
lea esi, [edi + esi - 0x7704000d]
inc esi
and dl, byte [esp + eax*8 - 0xa8]
inc ecx
and edi, 0x18201db6
dec edx
lea ebx, [ebx + edi - 0x10000016]
dec edx
mov dword [esp + edi*4 - 0x40000048], ebp
inc esi
movzx edi, word [ebx + edi*2 - 0x20000028]
call fcn.01b67ff3
dec ebx
loope 0x1bc037b
push esi
sub ch, byte [0x502b73c4]
add ah, cl
popal
push eax
xor edx, dword [esi - 0x3be50eaa]
jecxz 0x1bc03ea
pop esp
invalid
dec esp
mov dword [esp + 8], ecx
dec esp
mov dword [esp], edx
inc ebp
mov edi, esp
dec eax
dec dword [esp]
xor dword [esp + 8], ecx
inc ecx
sal edi, 0x89
inc ecx
dec ah
dec esi
mov ecx, dword [esp + edi - 0x7703fff8]
dec edx
neg dword [esp + edi - 0x77040000]
inc ebp
add ah, bh
jae 0x1bc038c
inc eax
inc bh
dec eax
sar ebp, 0x11
inc ecx
pop ecx
dec ecx
sal eax, 0x6d
inc esp
movsx ebp, ch
dec ebp
arpl sp, sp
inc ecx
setnp bh
inc cx
add ebp, ebx
dec ecx
add esi, esp
neg al
dec ecx
sar ebp, 0x8b
dec eax
not ebp
jns fcn.01bf2c54

Function at 0x1cce6b4
Capabilities:
Encode data using base64

Disassembly:
ror ecx, 1
shr eax, 0x42
neg ecx
ror ecx, 3
pop eax
call fcn.01d557e5

Function at 0x1cd26f4
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi + 4], ecx
jmp 0x1be171f
movsx ebp, cx
and cx, bp
pop ebx
pop edx
mov edi, 0x8d29aeb7
ror ebp, cl
popfd
not edi
pop esi
bswap ebp
pop ecx
pop ebp
pop edi
push 0x6f047003
lea esp, [esp + 4]
ret
mov ebx, eax
mov dword [esi], edx
ror eax, 0x70
and bx, 0x5325
mov ebx, dword [esp + 8]
mov dword [esp + 8], eax
movzx edx, al
jb 0x1ba5ed2
pop edx
pop eax
pop ecx
jge fcn.01bf0394
mov dword [esp + 8], ebx
cpuid
sub esi, 0xc
mov dword [esi + 0xc], eax
mov eax, 0xe594d3ae
mov dword [esp], 0x4e8a612f
mov dword [esi + 8], ebx
jmp 0x104e7b5

Function at 0x1d1cc9f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebp]
jmp 0x1b7d73c
mov ebp, dword [esp + 0xc]
call fcn.0103c5c4
inc esp
xor cl, ch
inc esp
movsx esp, ax
dec eax
shl dword [esp + ecx + 4], 0x3c
dec eax
lea ebp, [esp + ebp + 0x10]
inc ecx
movzx edi, dx
inc sp
mov edi, dword [ebp + ecx*2]
dec esi
lea esi, [ecx + esi - 2]
inc esp
movzx eax, byte [esp + ecx + 8]
mov edx, 0x7f986b8a
ror dl, 0xe3
lea ebp, [ebp + edx - 0x7f986b4d]
xor ecx, ebx
call fcn.01bab866
pushfd
call fcn.01bb5f7b
cmpsd dword [esi], dword es:[edi]
or cl, byte [eax - 0x6a]
wait
dec ebp
loop 0x1b7d742
retf 0x8de3
invalid
mov esi, ebp
lea edx, [edi*8 + 0x3739612e]
neg edi
sbb byte [esp + edi - 0x51547084], dh
mov ebx, dword [esp + edi - 0x51547083]
mov edi, dword [esp + edi - 0x5154707f]
jne 0x1b771e9
jmp 0x103a016
lea esp, [esp + 4]
call eax
push 0xd737e039
mov ebx, dword [esp]
mov ebp, dword [ebp - 4]
lea edi, [ebx + ebx + 0x3bcf07]
movzx esi, byte [esp]
mov dword [ebp + esi*4 - 0xe4], eax
ror dword [esp + esi*2 - 0x72], 0x10
jb 0x1bc30a0
inc ecx
pop ecx
call fcn.01c200af
ret