joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10a184bf
Capabilities:
Encode data using base64

Disassembly:
jae 0x10a5f1a5
shl ecx, 0x51
ror dx, 1
rol ax, 0x8d
xor dx, 0x4631
not ecx
rol dx, 1
rol cl, 0x45
neg dx
xor dx, 0xc829
and eax, 0xe62e152e
xor bx, dx
lea eax, [eax + eax*4 - 0x1ec2c5f1]
lea esi, [ecx + esi - 0x1200001]
sar word [esp + ecx*2 - 0x23ffffd], 0xc5
je 0x10ae6a4b
mov word [ecx + esi - 0x11fffff], dx
ja 0x10a1ad1a
shr word [esp + ecx - 0x11ffffd], 8
pop edx
pop ecx
jns fcn.10979c8a
mov edx, dword [edi + edx - 0x5fe1c000]
lea edi, [edi + ecx*4 - 0x2fffc]
xor edx, ebx
not edx
jmp 0x10ae082f
xor ebx, edx
add dword [esp + ecx - 0x412bdb90], ecx
setg al
rol cl, 0x27
adc ebp, edx
mov dword [esp + ecx - 0x412bdb48], ebp
ret 4
dec al
adc ebp, ecx
pop ecx
ror edx, 0x5c
movzx edx, word [ecx + edi - 0x8f]
jae 0x104a72dd
pop edx
mov edx, dword [esp + 4]
add edx, 0xd489b
jmp edx
mov dword [esp + edx - 0x3b056e42], edx
rol edx, 0x5d
ror ecx, 3
push eax
sub eax, dword [esp + edx - 0x4760adc6]
xor ebx, ecx
or ax, dx
jl 0x109faa48
movzx ecx, dx
mov word [esi + ecx*8 - 0x60000], ax
jmp 0x105ecb07
lea eax, [ecx*2 + 0x252e5925]
shr cl, 0xc3
movsx edx, al
mov dword [esp + ecx], edi
ret 4
lea edi, [edi + ecx*2 - 0x11c]
not ecx
xor dx, bx
bswap eax
push eax
xor dx, 0xfb93
jmp 0x10568ef1
or ecx, 0x412b9b90
jae 0x109e63e1
lea eax, [ecx*4 - 0x43466661]
neg dword [esp + ecx*4 - 0x30000]
neg edx
bswap edx
rol dword [esp + ecx*2 - 0x18000], 0xc6
lea edx, [ecx + edx - 0x7112361e]
sar dword [esp + ecx*4 - 0x30000], 0x93
rol edx, 3
push ecx
lea edx, [edx + ecx*2 + 0x59133ca9]
jmp 0x10a83402

Function at 0x10a2d6f2
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edi + eax*2 - 0x57eabb0]
lea ecx, [eax + eax*8 - 0x3ae88e69]
call 0x1058bfa5
ror edx, 1
dec edx
shr eax, 0x7f
mov dword [esp + eax - 1], 0x8b319a3f
not edx
sbb edx, eax
call fcn.10979e55
mov ecx, 0x3e2fba24
movzx edx, cl
movsx eax, cl
mov eax, dword [ebp + edx*2 - 0x48]
add cl, 0x19
shr cx, 0x21
mov dx, word [eax + ecx - 0x3e2f5d1e]
dec cx
mov eax, ecx
lea ebp, [ebp + ecx*2 - 0x7c5eba38]
bswap eax
call fcn.104ea231
or cl, dl
movsx edx, al
not cl
neg ax
mov word [ebp + eax*8 - 0x15faaebe], cx
jge 0x105a951e

Function at 0x10a30b2d
Capabilities:
Authenticate hmac

Disassembly:
shl dl, 0x61
sub edx, ecx
inc eax
push ecx
call fcn.10a09c32
mov dword [esp + edx - 0x20b7e482], 0x1ca16a36
not word [esp + edx*2 - 0x416fc903]
add edi, eax
shl cx, 0x2e
mov eax, dword [esi + edx - 0x20b7e482]
and ecx, 0x520e624
mov dword [esp + edx - 0x20b7e482], ebx
ja 0x10a632cb
add esi, 4
xor eax, ebx
lea edx, [ecx*4 + 0x27a733ae]
sal edx, cl
lea eax, [edx + eax - 0x4ec6cfdd]
push ecx
neg eax
jmp 0x109e5b7f
Function at 0x10a4ca4f
Capabilities:
Execute syscall

Disassembly:
mov dword [esp], ecx
movzx edx, cl
mov edx, dword [ebp + edx*2 - 0x100]
xor edx, ebx
ror edx, 1
movsx eax, cx
call fcn.1095fcf7
mov eax, dword [esi]
push 0xe9317603
mov ecx, 0x861a6739
add esi, 4
movzx edx, cl
sar ecx, cl
lea edi, [edi + edx - 0x3a]
neg cx
mov dl, byte [edi + edx*2 - 0x72]
xor dl, bl
sub ecx, ecx
call fcn.10a14f6d

Function at 0x10a6329c
Capabilities:
Authenticate hmac

Disassembly:
neg dl
not al
sal edx, 0x99
mov dword [esp + edx - 0x8000000], edx
rol dword [esp + edx*4 - 0x20000000], 0x3a
rol al, 1
neg al
not dl
ror edx, 0x63
jb 0x104c802a

Function at 0x10a632e4
Capabilities:
Authenticate hmac

Disassembly:
or dword [esp + edx*2 - 0x4004fe4d], edx
xor cl, bl
movzx eax, dl
dec cl
call fcn.10a6f137
sar al, 0x47
ja 0x10a8644a
imul dl
movzx edx, cl
xor byte [esp + edx*4 - 0x3f5], 0x92
sbb ecx, 0xcd21fe9e
mov word [esi + edx - 0xfe], ax
jg 0x1053c05c
movzx eax, byte [esp + edx - 0xfc]
je 0x10a62d14
mov dword [esp + edx*8 - 0x7f0], ebp
ret 4
xor cx, bx
push eax
lea edx, [eax - 0x77e6dbd6]
inc cx
sar edx, 0x1c
rol eax, 0xdd
pop edx
rol cx, 1
push eax
lea edx, [eax*2 + 0x57945aa6]
neg cx
inc cx
and edx, eax
xor eax, 0x6da8d124
call fcn.10a716cd

Function at 0x10a69590
Capabilities:
Execute syscall

Disassembly:
call fcn.10abba04
shr ecx, 0x88
mov cx, word [ebp + ecx*2 - 0xad8e16]
mov dx, word [ebp + 2]
call fcn.109fe00c
syscall
call fcn.10af166c
adc dword [esi + 0x52ab9172], esp
push ds
pop ss
ret
Function at 0x10a85560
Capabilities:
Manually build aes constants

Disassembly:
rol ax, 0xee
xor ecx, 0xe439210c
xor ebx, ecx
add edi, ecx
neg dx
mov ecx, dword [ebp + edx - 0x6d3f5168]
mov dword [esp + edx - 0x6d3f5168], eax
call fcn.10ad5007
lea esi, [esi + edx + 4]
call fcn.10ac8b15
neg edx
sub eax, 0xc32f080b
ror eax, 1
and ecx, ecx
seta cl
sbb eax, 0x2406ef98
xor edx, ecx
shl edx, 4
jns 0x10a9e29e
mov edx, dword [eax + ebp - 0x4985f7a8]
or eax, 0xcd03323f
ror al, 0xa6
sal eax, 0x45
xor edx, ebx
lea eax, [eax + eax*2 + 0x6c81498d]
movsx ecx, ax
xor eax, 0x218c070a
ror edx, 1
sar eax, 0x76
shr ecx, cl
inc edx
not edx
sub edx, 0xebaf5da2
neg cx
add al, ah
or eax, ecx
not edx
not eax
push eax
dec edx
ror edx, 1
neg cl
sbb byte [esp + ecx*4 - 0x3fc08], ch
jns 0x10aa5dbf
jmp edi
or eax, dword [esi + edx]
xor byte [esp + edx + 5], dl
sal edx, 0xb1
xor ecx, dword [esi + edx + 4]
mov dword [esp + edx*8], edx
not eax
not ecx
push edx
push edx
xor dl, 0xba
or eax, ecx
mov dword [edx + esi - 0xb6], eax
and edx, dword [esp + edx*2 - 0x169]
jp 0x105c87f6
lea edx, [eax + edx - 0x27e91041]
or cl, 0xbb
xor ebx, edx
xchg ecx, eax
add ebp, edx
inc al
xor cx, ax
mov edx, dword [esi + ecx - 0x7896ff14]
jg 0x10a48224
mov ecx, dword [ecx + esi - 0x7896ff10]
lea eax, [eax*8 - 0x3cce1bd8]
adc esi, 8
mov dword fs:[edx], ecx
neg al
jmp ebp
bswap eax
xor ebx, eax
ror dl, 6
adc ebp, eax
mov eax, dword [edx + edi - 0x75fa543]
shl ecx, cl
xor cx, cx
xor cl, 0xa3
lea edi, [edx + edi - 0x75fa53f]
jnp 0x105432c3
sal ecx, 0x8f
xor eax, ebx
call fcn.10a1a479
bswap edx
xor ebx, edx
rol eax, cl
add esi, edx
lea edx, [ecx + eax*2 - 0x5b6ef16d]
mov di, word [edi + ecx*2 - 0x1fe04]
inc dword [esp + ecx - 0xff02]
pop eax
jle fcn.105e1085
Function at 0x10a873ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [eax + edi - 0x4f9fefb4]
shr ax, 0x46
xor cl, bl
xor cl, 0xf
neg cl
not word [esp + eax - 0x4f9f03be]
sar dword [esp + eax - 0x4f9f03be], 0x88
xor cl, 0x81
lea edx, [eax + eax + 0x2139133e]
ror edx, 0x15
add cl, 9
xor bl, cl
sub dword [esp + eax - 0x4f9f03be], 0xc144ca3
not dword [esp + eax - 0x4f9f03be]
and edx, edx
lea ecx, [esp + ecx + 4]
shl ax, 0xe5
jne 0x10a1b3f5
not edx
mov edx, dword [ecx + edx - 0x472a29fc]
mov eax, edx
pop ecx
mov edx, ecx
mov ecx, dword [esi + edx*4 - 0x2f46d618]
setnp dl
and eax, ecx
not eax
mov dword [edx + esi - 0xbd1b500], eax
jmp ebp
rol eax, 1
or word [esp + edx*2 - 0x40001d42], dx
ror edx, cl
bswap edx
xor ebx, eax
mov dword [esp + edx*2 - 0x74010118], ecx
add esi, eax
dec byte [esp + edx*2 - 0x74010117]
sar dword [esp + edx - 0x3a008089], cl
ja 0x10a487fa
mov edx, 0x2197caf
lea eax, [edx*4 + 0x4125fb1f]
lea ebp, [ebp + edx - 0x2197cb3]
dec edx
jns 0x10929c67
mov edx, dword [edi]
xor edx, ebx
push 0x8b2b1bb9
ror edx, 2
inc edx
not edx
neg edx
not edx
mov ecx, dword [esp]
shr cl, 0x62
sbb edx, 0x7d1ca020
movzx eax, cl
ror edx, 1
sub edx, 0xd6ba46b8
lea eax, [ecx*8 - 0xa404bc7]
mov dword [esp + eax - 0x4f188da9], 0x4297e330
rol cl, 0x62
xor ebx, edx
xor cx, 0xef35
adc ebp, edx
movzx ecx, byte [edi + eax - 0x4f188da5]
or eax, dword [esp + eax - 0x4f188da9]
jns 0x10a0b8db
push 0x11b0aa1
push ebp
mov dword [esp + 4], 0x3e6e22fb
lea esp, [esp + 4]
call fcn.108be642
call fcn.108a70c0

Function at 0x10aa047b
Capabilities:
Encode data using xor

Disassembly:
movzx ax, al
mov cl, byte [esi + 4]
add al, cl
mov word [esi + 4], ax
add esi, 4
call fcn.10a096e4

Function at 0x10aaf03b
Capabilities:
Encode data using xor

Disassembly:
movsx edx, cl
dec esp
add edx, eax
call fcn.1095df20
inc ecx
movzx ecx, word [esi]
inc ecx
mov ebp, 0xd21f8d8f
inc cx
xor ecx, esp
inc ecx
mov edx, ebp
inc esp
movzx eax, dl
dec eax
lea ebx, [edx*8 + 0x38b1cd0a]
dec cx
movzx ebp, bx
rol cx, 1
dec eax
lea ebp, [edx*2 + 0x6622d7a0]
inc ecx
xchg ebp, ebx
movzx edi, bp
xor cx, 0x3512
sub cx, 0x8b35
dec ebp
lea ebx, [ebp + edx*2 - 0x47258cf]
xor cx, 0xa535
dec eax
lea ebx, [edi + edi*8 + 0x773bd80d]
jmp 0x105928ed
dec eax
arpl ax, ax
jmp 0x108c4b50
pop ecx
call fcn.10ad19ba
inc ecx
mov eax, dword [esi]
mov ecx, 0x80a5b988
inc esp
movsx edi, cx
dec ecx
add esi, 4
inc ecx
xor eax, esp
inc esp
movzx eax, cx
neg eax
inc esp
movzx ebx, cx
not eax
dec eax
bswap eax
xor eax, 0xaa3b9ba2
inc ebp
movsx ebp, al
movzx ebp, cl
inc eax
inc ecx
push esp
inc ecx
inc bh
inc ebp
movzx esp, di
inc edx
xor dword [esp + eax*2 - 0x17310], eax
inc ecx
pop esp
jmp 0x108e9f57

Function at 0x10ab9670
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + edx - 0x453481fc]
xchg dword [esp + edx - 0x453481fc], eax
mov dword [esp + edx - 0x45348200], eax
xor ecx, ebx
bswap ecx
shr al, 0x62
not ecx
je 0x10a05913
jmp 0x10a3a9ef
Function at 0x10abbf1b
Capabilities:
Encode data using xor

Disassembly:
not cx
mov eax, dword [ebp + ecx - 0xe1de160]
lea edx, [ecx*2 + 0x28b8af94]
mov cl, byte [ebp + ecx - 0xe1de15c]
shl edx, 0xb8
sal dl, 0x81
adc dx, dx
lea ebp, [ebp + edx - 0x53fffffe]
push edx
sub dword [esp + edx - 0x54000000], 0x1e28afba
push edx
shl eax, cl
lea edx, [edx + edx*2 - 0xc7371e4]
mov dword [esp + 4], edx
movzx ecx, dl
mov dword [ebp + ecx*4 - 0x70], eax
sub dl, 0x1f
or dword [esp + ecx*2 - 0x34], ecx
mov edx, dword [edi + ecx*2 - 0x38]
adc ecx, ecx
inc ecx
lea edi, [edi + ecx*8 - 0x1c4]
xor edx, ebx
push ecx
sar dword [esp + ecx - 0x31], 0x3e
shl word [esp + ecx - 0x39], 0x2d
neg edx
inc edx
xadd dword [esp + ecx - 0x31], ecx
lea eax, [ecx*8 + 0x63c7285]
neg edx
and al, byte [esp + eax - 0x63c727c]
add byte [esp + eax*2 - 0xc78e43d], cl
inc edx
call fcn.10a96bc3
mov word [esi], dx
mov edx, 0xadac3316
mov edx, dword [edi]
or dword [esp], 0x38b88d86
mov ecx, 0x6b35cb1b
lea edi, [edi + ecx - 0x6b35cb17]
xor edx, ebx
sal ecx, cl
sal dword [esp], 0xbb
sbb edx, 0x918a2024
sub dword [esp], ecx
movzx eax, byte [esp]
ror edx, 2
inc eax
and dword [esp + eax - 1], eax
xchg word [esp + eax + 1], cx
neg edx
add al, cl
sub cl, cl
ror edx, 1
call fcn.10a31a3f
mov edx, dword [ecx + ebp - 0x30b8d122]
jmp 0x10adbcd2
push eax
pop ecx
pop eax
jbe 0x105f9069
mov ecx, 0xe1d1e9f
jmp 0x104cbf5e
xor al, 0x24
mov edi, eax
mov esi, ebp
mov eax, 0x3216ad9d
jbe 0x109f4fba
lea esp, [esp + 8]
call eax
mov edi, 0x379a7d3e
movsx ecx, di
mov ebp, dword [edi + ebp - 0x379a7d42]
mov dword [ebp + ecx - 0x7d3e], eax
rol cl, 0x83
movsx esi, cx
mov edi, ebp
push esi
movsx eax, cx
mov ebx, dword [esp + ecx - 0x7ded]
mov esi, dword [esp + ecx - 0x7de9]
movsx edx, ax
lea ebp, [eax*8 - 0x4dfb2c45]
xor ax, bp
mov ebp, dword [esp + ecx - 0x7de5]
mov dword [esp + ecx*2 - 0xfbd6], 0x6d0c09ac
call fcn.1051c912
aam 0x8c
jg 0x10abbf0a
sub eax, 0x21650c25
outsd dx, dword [esi]
mov ecx, edi
push es
pushfd
ror byte [ecx - 0xe], 1
dec eax
aad 0xc2
xor dword [edi - 0x25], ebp
mov ebx, 0x6f31c28d
popal
push 0x4d
ret 0x6f31

Function at 0x10ad4bba
Capabilities:
Encode data using base64

Disassembly:
movsx ecx, dx
mov dword [edx + edi - 0xa0936bd], eax
mov edx, dword [edx + ebp - 0xa0936b8]
not cx
mov dword [esp + ecx*8 - 0x64a30], ecx
xor edx, ebx
dec byte [esp + ecx*4 - 0x32515]
pop ecx
lea edx, [ecx + edx - 0x6be0e38f]
dec ecx
jle 0x109451f0
Function at 0x10ad8004
Capabilities:
Encode data using xor

Disassembly:
pop ecx
lea ecx, [edx + edx + 0x27bfc580]
ror ax, 1
push edx
bswap ecx
dec cl
dec ax
not cx
xor bx, ax
or cl, byte [esp + edx - 0x6d040d06]
inc edx
neg dword [esp + edx - 0x6d040d0a]
mov word [ebp + edx - 0x6d040d0c], ax
movzx ecx, byte [edx + edi - 0x6d040d0d]
movzx eax, dl
adc byte [esp + eax - 8], al
xor cl, bl
not dx
inc cl
dec dword [esp + eax*2 - 0x14]
cmovno ax, dx
not cl
pop edx
sal edx, 0xe2
dec ax
inc cl
lea eax, [eax + edx*2 + 0x4398e6a3]
call fcn.10905f84
add byte [esp + ecx*2 - 0x19966], 0x88
lea ebp, [ebp + ecx*2 - 0x1996a]
ror ecx, cl
mov dword [ecx + ebp - 0x19966000], edx
ror ax, 0xea
lea edx, [eax - 0x9547ed0]
lea esi, [ecx + esi - 0x19966004]
mov ecx, dword [esi + ecx*2 - 0x332cc000]

Function at 0x10add736
Capabilities:
Encode data using xor

Disassembly:
movsx ecx, al
add cl, 0x8d
sub esi, 1
not ax
shr al, 0x81
movzx ecx, byte [esi]
mov dword [esp + eax*2 - 2], eax
sub dl, al
lea ecx, [eax + 0x2130f4b8]
rol dl, 1
ror cx, 0x44
sub eax, dword [esp + ecx*2 - 0x42613e96]
sbb dl, 0x2f
dec dword [esp + eax*4]
sal ecx, cl
xchg dword [esp + eax*2], ecx
xor dl, 0x24
push ecx
not cl
lea ecx, [ecx*4 + 0x1ca7f738]
neg dl
xor bl, dl
sal eax, 0x48
lea edx, [esp + edx + 8]
jnp 0x10a3ac4d
ror ecx, 0xc1
call fcn.1092e153
push 0x3165181
add ebp, 4
call fcn.10957776
mov edx, 0x4031751e
call fcn.10a22cb4

Function at 0x10ade7b2
Capabilities:
Encode data using base64

Disassembly:
not ax
xchg dword [esp + edx + 2], edx
not dx
shl edx, 0xf2
and cx, ax
call fcn.10a97737
not cx
mov dword [esp + edx*8], edx
rol edx, 0x6d
jnp 0x1057b7be
add ebp, 4
jmp 0x104b5862

Function at 0x10ae2456
Capabilities:
Encode data using xor

Disassembly:
or byte [ecx + 0xb89ebc2], al
add bh, bh
loop 0x10ae2428
invalid
rol edx, 1
dec edx
pop eax
sub byte [esp + 1], 0xa6
xor ebx, edx
inc cx
dec byte [esp + 0xa]
mov dword [esi - 6], edx
sar dword [esp + 5], 0xa2
adc dword [esp], 0x66ab239d
pop eax
lea ecx, [esp + eax - 0x66aa7cdb]
mov edx, dword [ecx + eax - 0x66aa7d27]
lea eax, [eax + eax*8 - 0x3264c2fe]
lea ecx, [eax + eax + 0x263b7b0f]
mov dword [esi + eax - 0x6999a36b], edx
mov eax, dword [edi + eax - 0x6999a35b]
sub edi, 0xfffffff6
xor eax, ebx
ror eax, 2
push ecx
inc eax
xor word [esp + 0xa], cx
not eax
call fcn.10a5bfff
sbb dword [edi], edx
jp 0x10ae244d
ret 0x584a
and edi, dword [ebx + 0x76]
cmpsb byte [esi], byte es:[edi]
retf
Function at 0x10af25a2
Capabilities:
Encode data using xor

Disassembly:
pop edx
pop eax
pop edx
jae fcn.105e1085
dec eax
neg edi
dec eax
bswap edi
bswap eax
dec edx
lea edi, [edi + eax*2 + 0x6426e201]
inc ecx
ror ch, 0xe6
dec edx
xchg dword [esp + eax - 0x168f], ebp
jb 0x104e74c6
dec eax
rol edi, 6
dec eax
sar edx, 0x20
dec ebp
lea edi, [ebp + edx*4 + 0x498008b3]
dec esp
xor esp, edi
dec eax
sal edx, 0xb5
dec eax
bswap eax
dec edx
mov dword [esi + eax*4 - 0x5a6a], edi
dec ecx
shr eax, 0x33
dec edx
lea esi, [esi + eax - 0xe]
pop ecx
inc ecx
pop ebx
pop ecx
jns fcn.10ad0c3e
movzx edx, al
not ecx
inc eax
lea edx, [edx + eax + 0x17bbcaa5]
sub ecx, 0xe88d5695
sar ax, 0x63
or dl, dh
xor ecx, 0xe523dbb9
rol ecx, 2
add edx, eax
dec ecx
xor ecx, 0xac20f880
sub ecx, 0xde8fa5bd
xor ebx, ecx
shl al, 1
jbe 0x108bd6ff
push edx
mov dword [edi + edx*2 - 0x793110ac], ecx
xchg dword [esp + edx - 0x3c988856], edx
mov ecx, dword [esi]
lea edx, [edx + edx*2 + 0xf1e292e]
lea edx, [edx + edx*2 + 0x31bdfda1]
lea eax, [edx + edx*8 + 0x1eae9837]
xor ecx, ebx
sar word [esp + edx - 0x2a329a7f], 0x8f
adc edx, eax
add dword [esp + 2], edx
inc ecx
neg ecx
neg dword [esp + 2]
ror ecx, 3
inc ecx
jmp 0x10a4ae12
sar ax, 0x89
adc ebp, ecx
lea ecx, [eax*4 + 0x3438eb1c]
mov eax, dword [esi + eax - 0x26cf0007]
push edx
mov byte [esp + edx - 0x655a5092], dh
mov edx, dword [esi + edx - 0x655a5091]
ror byte [esp], 0x45
inc word [esp + 2]
add esi, 8
sar dword [esp], 0xea
pop ecx
mov dword fs:[eax + ecx - 0x1416d4], edx
xadd cl, ch
mov edx, 0xa508ba9c
sub edx, edx
adc edx, ebp
jmp edx
xor ebx, eax
sal dword [esp + edx + 8], 0x99
sub dword [esp + ecx - 0x118dc7b7], edx
adc esi, eax
dec byte [esp + ecx - 0x118dc7ba]
jno 0x10a2247f
jmp 0x10a0d4f7
shl cl, 0xe1
cmovbe ecx, edx
xor ebx, eax
not dl
shl ecx, 0x4f
add esi, eax
jmp 0x10a471be
call fcn.10ae7fc0
push 0xb503f992
mov dword [esp], edi
movzx edi, byte [eax]
jmp fcn.10a27c69
lea esp, [esp + 8]
je 0x10a565d8
jmp 0x109ec75c
inc dword [esp + ecx - 0x118dc7bb]
mov di, word [edi + ecx*4 - 0x46371efc]
shl edx, cl
jae 0x104e60a8
neg dx
lea ecx, [edx + edx - 0x55d81d54]
jmp esi
shl dword [esp + 4], 0x29
rol ecx, 2
xor ebx, ecx
add ebp, ecx
mov edx, dword [edi + 4]
call fcn.109faa26
movzx edx, cl
not eax
jmp 0x109e1f38
mov eax, 0x68097e94
ror eax, 0x7d
not ecx
movsx edx, al
mov dword [esi + eax - 0x404bf4a3], ecx
jae 0x109e9ea8
mov word [edi], dx
movzx edx, al
jnp 0x10ae9632
or ecx, dword [esp + ecx*2 - 0x1da]
lea edi, [edi + ecx - 0x2fbfe]
push ecx
movsx eax, word [esp + ecx - 0x2fbfa]
pop edx
pop ecx
pop edx
pop ecx
pop eax
pop eax
pop eax
pop ecx
pop eax
jne fcn.10a098d6
mov dword [esp + edx - 0x9b], ebp
ret
sar edx, cl
ror eax, 1
bswap eax
mov dword [esp + ecx*2 - 0x231b8f7e], edx
jmp 0x108e6917
Function at 0x10af9953
Capabilities:
Encode data using xor

Disassembly:
inc cx
dec edi
dec esp
mov dword [esp + ebx*8 - 0x49490], ebx
inc cx
rol edi, 1
inc cx
xor edi, 0x8d483512
or al, 0x7d
xchg esp, eax
dec esi
sbb dword [edx - 0x1640f0bb], edi
mov edx, 0xe9bf0f45
inc cx
sub edi, 0x8d488b35
sub al, 0x9d
xor eax, 0x66668c48
inc ecx
lea ebp, [ebx*4 + 0x668c4835]
inc cx
xor edi, 0x4166a535
dec edi
inc sp
sub dword [esp + ebx - 0x928c], ecx
inc bp
xor esp, edi
inc ecx
xadd ecx, ebp
inc eax
ror ch, 0x22
inc byte [esp + ebx - 0x9292]
inc sp
mov dword [esi + ebx*8 - 0x49492], edi
call fcn.105a8fc5
sal byte [eax], 1
ror esp, 1
shl dword ss:[ecx + 0x26a9e027], 1
cmp bl, cl
daa
loopne 0x10af9970
test eax, 0xe0279172
test eax, 0x27f50606
loopne 0x10af997c
jp 0x10af9a2f
jmp 0x7e7544fa
stosd dword es:[edi], eax
lds ebp, [ebp - 0x76]
invalid
jge 0x10af99d7
inc esp
js 0x10af9aa8
push es
invalid
add al, 0xc3
lahf
sbb edx, dword [edi + 0x74]
and bh, bl
mov ch, 0xf1
out 0x15, al
rcl dword [eax + 0x6b], cl
dec ebp
call 0x909fcafd
xchg ecx, eax
dec ebx
mov bl, 0xc5
ja 0x10af9ae7
rcl dword [ecx - 0x42]
mov ecx, 0xef13f2b4
sahf
mov ch, 0x70
inc edi
test dword [eax], ebx
push edx
fst dword [edi]
mov ah, 0x98
lcall 0x7f6f, 0x10df6c4e
dec esp
les esp, [ecx]
invalid
cmp byte [ebp + edi*8 + 0x6c68149b], bh
sbb edi, dword [esi - 0x42]
xor eax, 0x99fd982a
and eax, 0xe510fafb
ljmp 0x3c5e

Function at 0x10afc1fb
Capabilities:
Encode data using xor

Disassembly:
shr dword [esp + 0xb], 0x82
xor bl, dl
mov dword [esp], 0x603a9134
lea edx, [esp + edx + 0x10]
mov dword [esp + 4], 0xec0f5116
sar ax, 0x67
mov byte [edx], cl
not dword [esp + 0xc]
movsx edx, ax
and word [esp + 0xe], dx
mov ax, word [edi + 4]
cmova dx, word [esp]
setno byte [esp + 0xa]
sbb edi, 0xfffffffa
xor dl, 0x39
movzx edx, byte [esi + 5]
mov ecx, 0xbc996017
shl cl, 1
sbb esi, 0xfffffffa
Function at 0x64c073e2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x653b3014]
mov dword [ebp - 0xc], eax
jmp 0x64c074ad
jmp 0x64c0756a
jmp 0x64c07627
jmp 0x64c076e4
jmp 0x64c077a1
jmp 0x64c0785e
jmp 0x64c0791b
jmp 0x64c079d8
jmp 0x64c07a95
jmp 0x64c07b52
jmp 0x64c07c0f
jmp 0x64c07ccc
jmp 0x64c07d89
jmp 0x64c07e46
jmp 0x64c07f03
jmp 0x64c07fc0
cmp dword [ebp - 0xc], 0
je 0x64c0af5c
mov eax, dword [0x653b3014]
mov dword [0x653b300c], eax
jmp 0x64c08091
jmp 0x64c0814e
jmp 0x64c0820b
jmp 0x64c082c8
jmp 0x64c08385
jmp 0x64c08442
jmp 0x64c084ff
jmp 0x64c085bc
jmp 0x64c08679
jmp 0x64c08736
jmp 0x64c087f3
jmp 0x64c088b0
jmp 0x64c0896d
jmp 0x64c08a2a
jmp 0x64c08ae7
jmp 0x64c08ba4
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x653b3008], eax
jmp 0x64c08c71
jmp 0x64c08d2e
jmp 0x64c08deb
jmp 0x64c08ea8
jmp 0x64c08f65
jmp 0x64c09022
jmp 0x64c090df
jmp 0x64c0919c
jmp 0x64c09259
jmp 0x64c09316
jmp 0x64c093d3
jmp 0x64c09490
jmp 0x64c0954d
jmp 0x64c0960a
jmp 0x64c096c7
jmp 0x64c09784
mov eax, dword [0x653b3008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x64c0984c
jmp 0x64c09909
jmp 0x64c099c6
jmp 0x64c09a83
jmp 0x64c09b40
jmp 0x64c09bfd
jmp 0x64c09cba
jmp 0x64c09d77
jmp 0x64c09e34
jmp 0x64c09ef1
jmp 0x64c09fae
jmp 0x64c0a06b
jmp 0x64c0a128
jmp 0x64c0a1e5
jmp 0x64c0a2a2
jmp 0x64c0a35f
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x653b3004], eax
jmp 0x64c0a449
jmp 0x64c0a506
jmp 0x64c0a5c3
jmp 0x64c0a680
jmp 0x64c0a73d
jmp 0x64c0a7fa
jmp 0x64c0a8b7
jmp 0x64c0a974
jmp 0x64c0aa31
jmp 0x64c0aaee
jmp 0x64c0abab
jmp 0x64c0ac68
jmp 0x64c0ad25
jmp 0x64c0ade2
jmp 0x64c0ae9f
jmp 0x64c0af5c
nop
leave
ret
Function at 0x64c0c743
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x653b3008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x653b3008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x64c0c820
jmp 0x64c0c8dd
jmp 0x64c0c99a
jmp 0x64c0ca57
jmp 0x64c0cb14
jmp 0x64c0cbd1
jmp 0x64c0cc8e
jmp 0x64c0cd4b
jmp 0x64c0ce08
jmp 0x64c0cec5
jmp 0x64c0cf82
jmp 0x64c0d03f
jmp 0x64c0d0fc
jmp 0x64c0d1b9
jmp 0x64c0d276
jmp 0x64c0d333
mov dword [ebp - 0x14], 0
jmp 0x64c0d3f7
jmp 0x64c0d4b4
jmp 0x64c0d571
jmp 0x64c0d62e
jmp 0x64c0d6eb
jmp 0x64c0d7a8
jmp 0x64c0d865
jmp 0x64c0d922
jmp 0x64c0d9df
jmp 0x64c0da9c
jmp 0x64c0db59
jmp 0x64c0dc16
jmp 0x64c0dcd3
jmp 0x64c0dd90
jmp 0x64c0de4d
jmp 0x64c0df0a
mov dword [ebp - 0x18], 0
jmp 0x64c0dfce
jmp 0x64c0e08b
jmp 0x64c0e148
jmp 0x64c0e205
jmp 0x64c0e2c2
jmp 0x64c0e37f
jmp 0x64c0e43c
jmp 0x64c0e4f9
jmp 0x64c0e5b6
jmp 0x64c0e673
jmp 0x64c0e730
jmp 0x64c0e7ed
jmp 0x64c0e8aa
jmp 0x64c0e967
jmp 0x64c0ea24
jmp 0x64c0eae1
mov dword [ebp - 0x10], 0
jmp 0x64c0eba5
jmp 0x64c0ec62
jmp 0x64c0ed1f
jmp 0x64c0eddc
jmp 0x64c0ee99
jmp 0x64c0ef56
jmp 0x64c0f013
jmp 0x64c0f0d0
jmp 0x64c0f18d
jmp 0x64c0f24a
jmp 0x64c0f307
jmp 0x64c0f3c4
jmp 0x64c0f481
jmp 0x64c0f53e
jmp 0x64c0f5fb
jmp 0x64c0f6b8
mov dword [ebp - 0x10], 0
jmp 0x64c1321a
jmp 0x64c0f781
jmp 0x64c0f83e
jmp 0x64c0f8fb
jmp 0x64c0f9b8
jmp 0x64c0fa75
jmp 0x64c0fb32
jmp 0x64c0fbef
jmp 0x64c0fcac
jmp 0x64c0fd69
jmp 0x64c0fe26
jmp 0x64c0fee3
jmp 0x64c0ffa0
jmp 0x64c1005d
jmp 0x64c1011a
jmp 0x64c101d7
jmp 0x64c10294
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x653b3004]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x64c10362
jmp 0x64c1041f
jmp 0x64c104dc
jmp 0x64c10599
jmp 0x64c10656
jmp 0x64c10713
jmp 0x64c107d0
jmp 0x64c1088d
jmp 0x64c1094a
jmp 0x64c10a07
jmp 0x64c10ac4
jmp 0x64c10b81
jmp 0x64c10c3e
jmp 0x64c10cfb
jmp 0x64c10db8
jmp 0x64c10e75
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x653b300c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x64c10f43
jmp 0x64c11000
jmp 0x64c110bd
jmp 0x64c1117a
jmp 0x64c11237
jmp 0x64c112f4
jmp 0x64c113b1
jmp 0x64c1146e
jmp 0x64c1152b
jmp 0x64c115e8
jmp 0x64c116a5
jmp 0x64c11762
jmp 0x64c1181f
jmp 0x64c118dc
jmp 0x64c11999
jmp 0x64c11a56
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x64c11b2f
jmp 0x64c11bec
jmp 0x64c11ca9
jmp 0x64c11d66
jmp 0x64c11e23
jmp 0x64c11ee0
jmp 0x64c11f9d
jmp 0x64c1205a
jmp 0x64c12117
jmp 0x64c121d4
jmp 0x64c12291
jmp 0x64c1234e
jmp 0x64c1240b
jmp 0x64c124c8
jmp fcn.64c12585
mov eax, dword [0x653b3008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x64c0f6c4
nop
leave
ret