joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4219d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d9378]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x421a00
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046537b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x421a3c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x421a3c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046537b
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x421b21
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x421a64
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x421a97
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0048a894
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046537b
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x421b21
cmp eax, 1
jle 0x421af4
cmp eax, 3
jne 0x421b21
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00419230
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046537b
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x421b11
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0048b20b
add esp, 0x10
cmp edi, eax
jne 0x421b21
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x421a27
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046537b
mov esp, ebp
pop ebp
ret 4
Function at 0x4358c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x4359f1
test al, 3
jne 0x4359f1
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x4359ac
cmp edi, 8
jb 0x435975
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x435924
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x4359b0
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x435992
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x4359b4
xor edi, edi
jmp 0x4359b4
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x4359c8
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x435ab4
cmp ecx, 0x20
jb 0x435a95
mov esi, ecx
add eax, 0x10
and esi, 0xffffffe0
xorps xmm3, xmm3
mov dword [esp + 0x1c], esi
xorps xmm2, xmm2
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edi + ebx]
add edi, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x435a30
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x435ab4
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x435aa4
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x44d660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5e90
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4d9378]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
cmp eax, ecx
mov edx, dword [esi + 0x38]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 0
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.004358b0
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x44d6b7
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x44d6c8
push 0x3c
push esi
call fcn.0046510e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x457ff0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ecx]
cmp esi, 0x10
je 0x458007
cmp esi, 0x20
jne 0x4581db
shr esi, 2
mov edx, 4
cmp esi, edx
mov dword [ebp - 0xc], esi
mov eax, esi
cmovb eax, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [eax*4 + 0x1c]
mov dword [ebp - 8], eax
test edi, edi
je 0x4581da
mov dword [edi], 0x10
push ebx
mov dword [edi + 4], eax
xor ebx, ebx
add edi, 8
test esi, esi
je 0x458072
lea edx, [ecx + 5]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, esi
jl 0x458045
mov eax, dword [ebp - 8]
mov ebx, dword [edi + ebx*4 - 4]
mov ecx, esi
cmp esi, eax
jge 0x45815a
mov dword [ebp + 8], 0
mov dword [ebp - 4], edi
lea ebx, [ebx]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x4580f0
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dl, byte [eax + 0x4b72f4]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + str.cw]
movzx eax, dl
xor esi, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx eax, bl
shl esi, 8
shr ebx, 0x18
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx ebx, byte [ebx + str.cw]
shl esi, 8
xor ebx, esi
mov esi, dword [ebp - 0xc]
jmp 0x45813d
cmp esi, 6
jbe 0x45813d
cmp edx, 4
jne 0x45813d
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
xor edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + str.cw]
xor ebx, edx
mov eax, dword [ebp - 4]
inc dword [ebp + 8]
xor ebx, dword [eax]
add eax, 4
mov dword [edi + ecx*4], ebx
inc ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x458090
xor esi, esi
sub ecx, 1
js 0x4581d9
lea eax, [edi + eax*4]
mov dword [ebp + 8], eax
mov ebx, dword [edi + ecx*4]
cmp esi, 4
jl 0x4581c9
cmp ecx, 4
jb 0x4581c9
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x4b8918]
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x4b8d18]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x4b8518]
movzx eax, bl
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x4b9118]
mov eax, dword [ebp + 8]
jmp 0x4581cb
mov edx, ebx
mov dword [eax], edx
inc esi
add eax, 4
sub ecx, 1
mov dword [ebp + 8], eax
jns 0x458167
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x458c90
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x458e68
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x458e68
test bl, 3
jne 0x458e68
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x458cda
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x458e68
cmp byte [eax], 0x3d
je 0x458cc7
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x458e5d
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x458d02
sub al, 0x41
jmp 0x458d31
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x458d0e
sub al, 0x47
jmp 0x458d31
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x458d1a
add al, 4
jmp 0x458d31
cmp al, 0x2b
jne 0x458d22
mov al, 0x3e
jmp 0x458d31
cmp al, 0x2f
jne 0x458d2a
mov al, 0x3f
jmp 0x458d31
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x458d41
sub dl, 0x41
jmp 0x458d75
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x458d4e
sub dl, 0x47
jmp 0x458d75
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x458d5b
add dl, 4
jmp 0x458d75
cmp dl, 0x2b
jne 0x458d64
mov dl, 0x3e
jmp 0x458d75
cmp dl, 0x2f
jne 0x458d6d
mov dl, 0x3f
jmp 0x458d75
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x458d84
sub bl, 0x41
jmp 0x458db8
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x458d91
sub bl, 0x47
jmp 0x458db8
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x458d9e
add bl, 4
jmp 0x458db8
cmp bl, 0x2b
jne 0x458da7
mov bl, 0x3e
jmp 0x458db8
cmp bl, 0x2f
jne 0x458db0
mov bl, 0x3f
jmp 0x458db8
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x458dca
sub ah, 0x41
jmp 0x458e02
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x458dd9
sub ah, 0x47
jmp 0x458e02
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x458de8
add ah, 4
jmp 0x458e02
cmp ah, 0x2b
jne 0x458df1
mov ah, 0x3e
jmp 0x458e02
cmp ah, 0x2f
jne 0x458dfa
mov ah, 0x3f
jmp 0x458e02
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x458e68
cmp dl, 0xff
je 0x458e68
cmp bl, 0xff
je 0x458e68
cmp ah, 0xff
je 0x458e68
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x458cf3
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459140
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push edi
je 0x4592b3
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4592b3
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
push ebx
mov ebx, edx
shr ebx, 1
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + ebx*2]
sub ecx, eax
mov eax, 0
mov dword [ebp - 4], ecx
setne al
add eax, ebx
shl eax, 2
mov dword [ebp - 8], eax
test esi, esi
je 0x4592ac
xor eax, eax
test ebx, ebx
je 0x459210
mov edi, dword [ebp + 8]
add edi, 2
lea ebx, [ebx]
movzx ecx, byte [edi - 2]
lea edi, [edi + 3]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [edi - 5]
movzx ecx, byte [edi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
movzx edx, byte [edi - 4]
movzx ecx, byte [edi - 3]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 3], cl
add eax, 4
sub ebx, 1
jne 0x4591a0
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
sub ecx, 1
je 0x459277
sub ecx, 1
jne 0x4592a9
mov ebx, dword [ebp + 8]
movzx ecx, byte [ebx + edi - 2]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [ebx + edi - 2]
movzx ecx, byte [ebx + edi - 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
lea ecx, [eax + 2]
movzx eax, byte [ebx + edi - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + esi + 1], 0x3d
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + edi - 1]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx ecx, byte [edx + edi - 1]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4595f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9d1c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4d9378]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4e2ca8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4e27d4]
cmp eax, dword [ecx + 4]
jg 0x459654
mov eax, 0x4e27bc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046537b
mov esp, ebp
pop ebp
ret
push 0x4e27d4
call fcn.004655f7
add esp, 4
cmp dword [0x4e27d4], 0xffffffff
jne 0x459635
mov byte [ebp - 0x34], 0x69
mov byte [ebp - 0x33], 0x6f
mov byte [ebp - 0x32], 0x4e
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0x2c
mov byte [ebp - 0x2f], 0x11
mov byte [ebp - 0x2e], 0x25
mov byte [ebp - 0x2d], 0x4e
mov byte [ebp - 0x2c], 0x7d
mov byte [ebp - 0x2b], 0x2c
mov byte [ebp - 0x2a], 0x11
mov byte [ebp - 0x29], 0x2c
mov byte [ebp - 0x28], 0x54
mov byte [ebp - 0x27], 0x26
mov byte [ebp - 0x26], 0x18
mov byte [ebp - 0x25], 0x68
mov byte [ebp - 0x24], 0x3a
mov byte [ebp - 0x23], 0x18
mov byte [ebp - 0x22], 4
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x25
mov byte [ebp - 0x1f], 0x4e
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x12
mov byte [ebp - 0x1b], 4
mov byte [ebp - 0x1a], 0x3a
mov byte [ebp - 0x19], 0x18
mov byte [ebp - 0x18], 0x7c
mov byte [ebp - 0x17], 4
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x25
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x34]
mov byte [ebp - 0x13], 0
cmp byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
jne 0x459732
xor ecx, ecx
mov byte [ebp - 0x13], 1
lea esi, [ecx + 0x7f]
jmp 0x459710
mov al, byte [ebp + ecx - 0x34]
movsx eax, al
sub eax, 0x6c
imul eax, eax, 0x13
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x34], dl
inc ecx
cmp ecx, 0x20
jb 0x459710
jmp 0x459732
lea eax, [ebp - 0x34]
mov dword [0x4e27cc], 0
push eax
mov ecx, 0x4e27bc
mov dword [0x4e27d0], 0xf
mov byte [0x4e27bc], 0
call fcn.00435770
push 0x4ac7c0
call fcn.00465366
push 0x4e27d4
call fcn.004655ad
add esp, 8
jmp 0x459635
Function at 0x45f970
Capabilities:
Decode data using base64 via dword translation table
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi - 1]
add eax, ecx
cmp byte [eax], 0x3d
jne 0x45f991
lea eax, [eax - 1]
dec esi
cmp byte [eax], 0x3d
je 0x45f985
mov dword [ebp + 0xc], esi
xor eax, eax
test esi, esi
je 0x45fa48
push ebx
mov edx, 1
mov dword [ebp + 8], 2
lea ebx, [esi - 1]
sub edx, ecx
shr ebx, 2
push edi
lea edi, [ecx + 2]
mov dword [ebp - 4], edx
inc ebx
jmp 0x45f9c0
movsx ecx, byte [edi - 1]
mov dh, byte [ecx + 0x4b9b10]
movsx ecx, byte [edi - 2]
mov dl, byte [ecx + 0x4b9b10]
mov cl, dh
sar cl, 4
and cl, 3
shl dl, 2
or dl, cl
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx], dl
inc eax
mov ecx, dword [ebp + 8]
cmp ecx, esi
jae 0x45fa34
movsx ecx, byte [edi]
mov esi, dword [ebp + 0x10]
shl dh, 4
mov dl, byte [ecx + 0x4b9b10]
mov cl, dl
sar cl, 2
and cl, 0xf
or cl, dh
mov byte [eax + esi], cl
inc eax
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
add ecx, edi
cmp ecx, esi
jae 0x45fa31
movsx ecx, byte [edi + 1]
shl dl, 6
mov cl, byte [ecx + 0x4b9b10]
and cl, 0x3f
or cl, dl
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], cl
inc eax
mov ecx, dword [ebp + 8]
add ecx, 4
add edi, 4
mov dword [ebp + 8], ecx
sub ebx, 1
jne 0x45f9c0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496006
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00495e7c
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00431219
Function at 0x7ed250
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2c8000]
push edi
jmp 0x7ed26a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7ed271
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7ed260
mov eax, 1
add ebx, ebx
jne 0x7ed283
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7ed294
jne 0x7ed2b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7ed2b3
dec eax
add ebx, ebx
jne 0x7ed2a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7ed278
add ebx, ebx
jne 0x7ed2af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7ed305
xor ecx, ecx
sub eax, 3
jb 0x7ed2cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7ed33a
sar eax, 1
mov ebp, eax
jmp 0x7ed2d6
add ebx, ebx
jne 0x7ed2d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7ed2a4
inc ecx
add ebx, ebx
jne 0x7ed2e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7ed2a4
add ebx, ebx
jne 0x7ed2f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7ed2e6
jne 0x7ed302
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7ed2e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7ed324
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7ed316
jmp 0x7ed266
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7ed324
add edi, ecx
jmp 0x7ed266
pop esi
mov edi, esi
mov ecx, 0x8b2d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7ed342
cmp byte [edi], 0x37
jne 0x7ed342
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7ed347
lea edi, [esi + 0x3e9000]
mov eax, dword [edi]
or eax, eax
je 0x7ed3bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3ff0b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3ff1e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7ed374
mov ecx, edi
jns 0x7ed3a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3ff1e8]
or eax, eax
je 0x7ed3b9
mov dword [ebx], eax
add ebx, 4
jmp 0x7ed391
call dword [esi + 0x3ff1f8]
mov ebp, dword [esi + 0x3ff1ec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7ed3f3
sub esp, 0xffffff80
jmp section.UPX0