joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415550
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x493150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x415610
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edx
mov eax, dword [0x493150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 8]
mov dword [ebp - 4], ecx
pop edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x415720
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x493150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x415850
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x493150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x41588e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x41588e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x415890
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4158a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x493150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x4158d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x493150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4158f4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
add ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
sub eax, 4
cmp dword [ebp - 8], eax
jl 0x415941
mov ecx, dword [ebp - 8]
add ecx, 0x4000
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x4a4384]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x42ec40
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x42ece1
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
cmp esi, edx
push edi
jle 0x42ec8f
mov edi, dword [ecx]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x449598]
add edx, 1
cmp edx, esi
jl 0x42ec71
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x42ecbc
mov edi, dword [ecx + 8]
lea esp, [esp]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x449598]
add edx, 1
cmp edx, esi
jl 0x42eca0
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
pop edi
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop esi
shr eax, 0x18
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x43ec4d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4a3f58], ebx
mov esi, eax
mov dword [ebp - 0xc], esi
jne 0x43ec83
push 0x4a3f3c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4a3f58], 1
push 0x4a3f3c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4a3f54]
cmp eax, ebx
mov edi, eax
je 0x43ece7
cmp dword [ebp - 4], ebx
jne 0x43ee27
xor eax, eax
inc eax
lea ecx, [edi + 0x114]
cmp esi, dword [ecx]
je 0x43ecba
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x43ecab
jmp 0x43ecd8
push dword [ebp + 0xc]
lea esi, [edi + eax*4 + 0x210]
push dword [ebp + 8]
call fcn.0043ea9f
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
mov dword [ebp - 4], 1
mov edi, dword [edi]
cmp edi, ebx
jne 0x43ec99
cmp dword [ebp - 4], ebx
jne 0x43ee27
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push ebx
push 0x100000
lea eax, [ebp - 8]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43ee27
mov edi, dword [0x4a3f54]
jmp 0x43ed27
cmp dword [edi + 0xc], 0x3f
jl 0x43edc1
mov edi, dword [edi]
cmp edi, ebx
jne 0x43ed1b
push 0x310
push 8
push dword [0x4a351c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
je 0x43ee1e
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
cmp eax, ebx
mov dword [edi + 8], eax
je 0x43ee10
push ebx
push ebx
push edi
push 0x43eaf0
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0x114], esi
push 0x1000
lea esi, [edi + 0x214]
push ebx
mov dword [edi + 0x14], eax
mov dword [esi], ebx
mov dword [edi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x43ee07
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043ea9f
mov eax, dword [0x4a3f54]
cmp eax, ebx
pop ecx
pop ecx
mov dword [edi + 4], ebx
mov dword [edi], eax
je 0x43edb9
mov dword [eax + 4], edi
mov dword [0x4a3f54], edi
jmp 0x43ee27
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 8]
push dword [ebp + 0xc]
mov dword [edi + eax*4 + 0x10], ecx
mov eax, dword [edi + 0xc]
push dword [ebp + 8]
mov dword [edi + eax*4 + 0x110], esi
mov eax, dword [edi + 0xc]
mov dword [edi + eax*4 + 0x210], ebx
mov eax, dword [edi + 0xc]
lea esi, [edi + eax*4 + 0x210]
call fcn.0043ea9f
inc dword [edi + 0xc]
pop ecx
pop ecx
push ebx
push 1
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x43ee27
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push dword [0x4a351c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4a3f3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44014c
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x154
push 8
push dword [0x4a351c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x4a42fc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x4a4300], esi
and dword [esi + 0x88], 0
or dword [esi + 0x8c], 0xffffffff
or dword [esi + 0x90], 0xffffffff
push esi
mov dword [esi + 0x84], 0xffffff
mov dword [esi + 0x6c], 2
mov dword [esi + 0x70], 0x3f
call fcn.00445501
mov dword [esi + 0x58], 0x4400cb
mov dword [esi + 0x5c], 0x44010a
mov dword [esi + 0x10], fcn.0043f299
mov dword [esi + 0x30], 0x43f418
mov dword [esi + 0x64], 0x43f521
mov dword [esi + 0x60], 0x43f56c
mov dword [esi + 0x34], 0x43fc6a
mov dword [esi + 0x24], 0x43fb09
mov dword [esi + 0x28], 0x43fb32
mov dword [esi + 0x2c], 0x43fb5d
mov dword [esi + 0x44], 0x43ff5b
mov eax, esi
pop esi
ret 4

Function at 0x440e3b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x20], 0
push esi
mov esi, dword [ecx + 0xb4]
mov dword [ebp - 4], esi
je 0x440eae
mov eax, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
imul eax, dword [ebp + 0x18]
add eax, dword [ebp + 8]
push ebx
lea edx, [eax + edx*4]
push edi
mov eax, dword [ecx + 0xac]
imul eax, dword [ebp + 0x14]
add eax, dword [ecx + 0xa8]
mov edi, edx
add eax, esi
cmp dword [ebp + 0x1c], 0
jle 0x440e9d
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x10], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add eax, dword [ebp - 4]
add edi, 4
dec dword [ebp + 0x10]
jne 0x440e82
dec dword [ebp + 0x20]
inc dword [ebp + 0x14]
add edx, dword [ebp + 0xc]
cmp dword [ebp + 0x20], 0
jne 0x440e62
pop edi
pop ebx
pop esi
leave
ret 0x1c

Function at 0x441c3a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x20], 0
mov edx, dword [ecx + 0xb4]
je 0x441cb6
push ebx
imul eax, eax, 3
push esi
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x18]
add edi, dword [ebp + 8]
mov esi, edx
imul esi, dword [ebp + 0x10]
add eax, edi
mov edi, eax
mov dword [ebp + 0x18], eax
mov eax, dword [ecx + 0xac]
imul eax, dword [ebp + 0x14]
add eax, dword [ecx + 0xa8]
add eax, esi
cmp dword [ebp + 0x1c], 0
jle 0x441c9e
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x10], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add edi, 3
add eax, edx
dec dword [ebp + 0x10]
jne 0x441c84
mov edi, dword [ebp + 0x18]
dec dword [ebp + 0x20]
add edi, dword [ebp + 0xc]
inc dword [ebp + 0x14]
cmp dword [ebp + 0x20], 0
mov dword [ebp + 0x18], edi
jne 0x441c66
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x441d12
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
imul eax, eax, 3
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 4], eax
je 0x441da2
mov eax, dword [ebp + 0x10]
imul ecx, ecx, 3
imul eax, dword [ebp + 0x18]
add eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, edx
imul esi, esi, 3
add ecx, eax
push edi
mov edi, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xac]
imul ecx, dword [ebp + 0x14]
add ecx, dword [eax + 0xa8]
mov edx, dword [ebp - 4]
add ecx, esi
test edx, edx
jle 0x441d8a
mov eax, 0xff
sub eax, dword [ebp + 0x20]
mov dword [ebp + 0x18], edx
mov dword [ebp - 8], eax
movzx eax, byte [ecx]
movzx edx, byte [edi]
imul eax, dword [ebp - 8]
imul edx, dword [ebp + 0x20]
add eax, edx
cdq
mov ebx, 0xff
idiv ebx
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x18]
jne 0x441d69
mov edi, dword [ebp + 0xc]
dec dword [ebp + 0x1c]
add edi, dword [ebp + 0x10]
inc dword [ebp + 0x14]
cmp dword [ebp + 0x1c], 0
mov dword [ebp + 0xc], edi
jne 0x441d3f
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x403203
pop dword [ebp - 0x24]
mov eax, 0xed9a24b9
add eax, 0x12a60d4a
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xe3c93f26
add dword [ebp - 0x34], 0x6a890625
mov dword [ebp - 0x30], 0xecb0f6a5
add dword [ebp - 0x30], 0x458255a0
mov dword [ebp - 0x2c], 0x26e79b73
add dword [ebp - 0x2c], 0x2564a8bb
mov dword [ebp - 0x28], 0xf25220e7
add dword [ebp - 0x28], 0xdaddf19
lea eax, [ebp - 0x34]
push eax
mov eax, 0xb5b500d9
add eax, 0x4a8b7fb3
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x43efd52
sub dword [ebp - 0x34], 0x8fcc93fc
mov dword [ebp - 0x30], 0x31dc06cc
add dword [ebp - 0x30], 0xf905aa9
mov dword [ebp - 0x2c], 0xc1db2514
add dword [ebp - 0x2c], 0xa1944758
mov dword [ebp - 0x28], 0x172f72c7
sub dword [ebp - 0x28], 0x172f72c7
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x347ed
push 0
call eax
mov ecx, 0x508b03ff
add ecx, 0xaf753b9c
mov ebx, eax
mov edi, 0x411000
add edi, dword [ebp - 0x24]
mov edx, 0x4b6cc310
sub dword [ebp - 8], 0x8580c38f
mov esi, dword [edi]
xor dword [ebp - 0x20], 0xa35b7ee3
add esi, edx
xor dword [ebp - 0xc], esi
mov dword [ebx], esi
mov dword [ebp - 0x20], 0xf430ba49
add ebx, 0xb570c43a
sub ebx, 0xb570c436
add edi, 0x84823111
sub edi, 0x8482310d
loop 0x403314
add eax, 0x4014c0ba
add eax, 0xbfec3085
mov ebx, eax
add eax, 0x33f7628f
sub eax, 0x33f7628a
mov ecx, 0x71d1e8ef
sub ecx, 0x7191e8ef
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx - 0x5ec727f3], ah
or eax, 0xda138d8
fdivr dword [eax]
mov eax, dword [0xa138d80d]
or eax, 0xda138d8
fdivr dword [eax]
mov eax, dword [0xa138d80d]
or eax, 0xda138d8
fdivr dword [eax]
mov eax, dword [0x37a4d80d]
pop eax
fdivr dword [eax]
mov eax, dword [0xa138d80d]
or eax, 0xda138d8
fdivr dword [eax]
mov eax, dword [0xa138d80d]
or eax, 0xda138d8
fdivr dword [eax]
mov eax, dword [0xa138d80d]
or eax, 0x5837a4d8
lea ebp, [ebp - 0xc]
pop eax
lea eax, [ebp - 0x6d8d5901]
aaa
pop eax
lea ebp, [ebp - 0xc]
pop eax
lea ebp, [ebp - 0xc]
pop eax
lea edi, [eax]
jge 0x4152d0
push cs
push eax
in al, 0x28
int3
test dword [edi], edi
cmpsd dword [esi], dword es:[edi]
jb 0x4152d7
aaa
pop eax
lea ebp, [ebp - 0xc]
pop eax
lea ebp, [ebp - 0xc]
pop eax
lea ebp, [esi + 0x6d8d58f4]
hlt
hlt
jge 0x415340
push es
sub ah, bh
ror eax, cl
popal
jg 0x415398
popfd
in eax, dx
leave
mov ah, ch
sub al, 0xf4
pop eax
clc
sub dh, byte [edi - 0x60]
mov word [edi], ds
pop ds
mov dh, 0xdb
insb byte es:[edi], dx
adc byte [esi + ecx - 0x7b], 0xf5
test ebp, esi
sub al, 0x9e
out dx, al
sbb al, 0x59
stc
jb 0x4153c9
imul esp, dword [ebp - 0x53], 0x8572a7a0
pop ds
add eax, 0x7d1f9272
dec ecx
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
jb 0x415392
hlt
sar dword [eax], 0xe4
sub al, 0xf4
mov al, 0x90
ror dword [edx], cl
cmpsd dword [esi], dword es:[edi]
or byte [ebp + 0x79655d80], ch
mov dword [0x36a472a7], eax
push esp
or ah, byte [edi + 0x5d80ad08]
jns 0x41537d
cmpsd dword [esi], dword es:[edi]
jb 0x415381
push esp
lea edi, [eax]
jge 0x4153a0
cmp byte [ebp - 0x43], bh
dec ebx
push 0x6dcc3914
cmc
xor byte [ebp + 0x7f], bl
mov bh, 0x58
out 0x9b, eax
sbb al, 2
xor dword [ebx - 0x169af7f5], edx
dec ecx
cmpsb byte [esi], byte es:[edi]
jb 0x4153d1
hlt
Function at 0xacce0e
Capabilities:
Encode data using base64

Disassembly:
and dl, dh
inc ecx
adc ah, 9
or dl, dh
inc ebp
xor cl, ah
sal edx, 0x50
or edx, 0x1dbfa386
dec esp
adc esp, esp
call fcn.00d4e9a9
sysenter
push ebx
push ebp
mov dword [esp + 4], 0x5744e74
lea esp, [esp + 4]
call int.00ad4d0c
call 0xd49f79
push 0x99b90d5e
sbb byte [edx - 0x41bec22e], ch
aaa
out dx, eax
cdq
mov ch, 0x49
bswap esi
inc ebp
mov ebx, dword [edi]
inc ecx
sar esi, 0x2a
inc edi
adc esi, dword [edi + esi + 4]
call fcn.010c010e
inc ecx
mov esp, 0xbd3cc9be
inc ecx
movsx edx, ah
inc ebp
movzx esp, byte [edx]
dec ecx
add edx, 1
dec eax
lea edx, [edx*4 + 0xfb40988]
inc ebp
xor ah, cl
inc ecx
not ah
sal edx, 0x46
sal dx, 0xa5
inc ecx
ror ah, 1
dec eax
bswap edx
inc ecx
dec ah
xor edx, 0x73b5482c
jnp 0xd4441d
stc
clc
inc ecx
neg ah
shr dx, 0xeb
jne 0xac5afa
push 0x6232318d
inc bp
mov ebp, dword [edi]
mov esi, 0x730d66a6
dec ebp

Function at 0xc9ca0f
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0xc7b045
mov esi, dword [ebp + 0xc]
stc
test ah, 0x10
test esi, esi
jmp 0xadd9ac
call fcn.00ae61ae
push ebp
movzx edx, si
mov ebp, esp
mov dx, 0xc513
mov edx, dword [ebp + 8]
test ch, 0x3f
lea esp, [esp - 0x114]
clc
cmc
push esi
cmp cl, 0x19
jmp 0xd41497
test edx, edx
jmp 0xad5159

Function at 0x10be9d4
Capabilities:
Encode data using base64

Disassembly:
or edx, 0xce143b96
shr dx, 0xd0
add edx, 0x5396a038
jne 0x10cd6a6
pop esp
push edx
sbb bl, byte [edi - 0x3842dd19]
push edx
je 0x10bea5b
invalid
inc esi
leave
dec dword [ebx + 0x800bac2]
add byte [eax], al
mov edx, dword [esp + edx - 0x5333a030]
mov dword [esp + 8], 0x57307d0
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call int.00ad4d0c
mov bh, 0x61
xchg ebx, eax
insb byte es:[edi], dx
sub bl, byte [edx + 0x18]
salc
fdivr dword [edi]
adc eax, 0x7887d917
jle 0x10cd753
adc al, 0x92
mov al, 0x4f
adc dword [ecx + 0x3f], ebp
mov ebx, dword [edx + 0x5bac1d37]
sar bh, cl
aad 0x2c
invalid
xor byte [esi + ecx*4 + 0xb], 0x2a
mov eax, dword [0x2b1399e8]
invalid
pop es
imul esp, edi, 0x8404fed9
fsin
add al, 0x84
loopne 0x10cd73e
sal dword [ebx], 0x4b
inc ebp
stc
push cs
sbb al, 0x39
push ds
out dx, al
das
xchg ebp, eax
inc ebp
mov ss, word [edi + 0x66]
pushfd
push edi
pushf
jg 0x10cd719
mov eax, dword [0x8005ee97]
out 0x2e, eax
fsubr qword [esi]
jbe 0x10cd757
daa
jg 0x10cd741
invalid
Function at 0x10cb2ea
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.00abacaa
mov ch, ah
out 0x19, al
push edi
ja 0xc9d9a2
add edi, ebp
or cl, byte [eax - 0x38]
bound esi, qword [esi + ebp*4 + 0x115f2711]
ffreep st(1)
inc esi
insb byte es:[edi], dx
adc al, 0x52
rol dword [esi + 0x6c], 0x14
push edx
jmp 0x6664e89a
dec esp
mov esp, dword [esp + ebx - 0x5882fff0]
dec ebp
lea ebx, [edx - 0x76d73753]
dec eax
mov dword [esp + ebx - 0x58830000], ecx
push ebp
dec esp
mov ebx, dword [esp + ebx - 0x5882ffe0]
dec word [esp + ecx - 0x58afa773]
dec esp
mov dword [esp + ebx - 0x5882ffe8], edx
dec esp
mov eax, dword [esp + ecx - 0x58afa755]
call fcn.00c78a61
mov ecx, 0x5a399492
mov eax, dword [ecx + edi - 0x5a399492]
movzx edx, cl
push ebx
neg edx
movzx ebx, cx
cpuid
jbe 0xc9d989
push edx
pop edx
add ecx, dword [esi - 0x3f49f82e]
dec esi
adc dword [ebx + 0xac90ad8], esp
stosb byte es:[edi], al
loop 0x10cb374
movsx ebx, dx
pop edx
pop ecx
popfd
movzx ebp, bx
pop ebx
lea ebp, [ebp + ebp*2 - 0x2fe6459]
pop ebp
push 0x981580aa
lea esp, [esp + 4]
ret
xor dh, byte [ebx + 0x558bffba]
or cl, bh
Function at 0x45ede0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3d000]
push edi
jmp 0x45edfa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45ee01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45edf0
mov eax, 1
add ebx, ebx
jne 0x45ee13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45ee08
jne 0x45ee24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45ee08
xor ecx, ecx
sub eax, 3
jb 0x45ee38
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45eeaa
mov ebp, eax
add ebx, ebx
jne 0x45ee43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45ee50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45ee74
inc ecx
add ebx, ebx
jne 0x45ee60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45ee55
jne 0x45ee71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45ee55
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45ee94
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45ee85
jmp 0x45edf6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45ee94
add edi, ecx
jmp 0x45edf6
pop esi
lea edi, [esi + 0x5c000]
mov eax, dword [edi]
or eax, eax
je 0x45eef3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x64bac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x64c18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45eeb1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x64c20]
or eax, eax
je 0x45eeed
mov dword [ebx], eax
add ebx, 4
jmp 0x45eece
call dword [esi + 0x64c1c]
mov ebp, dword [esi + 0x64c24]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45ef27
sub esp, 0xffffff80
jmp 0x401a50
Function at 0x401010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], edx
lea eax, [edx - 1]
mov dword [ebp - 8], eax
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
test edx, edx
je 0x401084
lea ecx, [eax + edi]
mov eax, 1
sub eax, edi
mov dword [ebp - 4], ecx
mov edi, dword [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
push esi
nop
add eax, ecx
xor edx, edx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, edi
mov bl, byte [edx + eax]
mov eax, edi
xor edx, edx
xor bl, byte [ecx]
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, edi
and ecx, 7
not bl
rol bl, cl
dec edi
mov ecx, dword [ebp - 4]
mov byte [ecx], bl
mov al, byte [edx + eax]
xor al, bl
mov byte [ecx], al
dec ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
test esi, esi
jne 0x401040
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
pop esi
pop ebx
shr edx, 1
mov eax, 0
je 0x4010a2
nop dword [eax]
mov cl, byte [edi + eax*2]
shl cl, 4
or cl, byte [edi + eax*2 + 1]
mov byte [eax + edi], cl
inc eax
cmp eax, edx
jb 0x401090
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret