joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465c2c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x499074], ebx
push esi
push edi
jne 0x465cac
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x465ce7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x499074], eax
je 0x465ce7
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x499078], eax
call esi
cmp dword [0x498df0], 2
mov dword [0x49907c], eax
jne 0x465cac
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x499084], eax
je 0x465cac
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x499080], eax
mov eax, dword [0x499080]
test eax, eax
je 0x465cf1
call eax
test eax, eax
je 0x465cd8
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x499084]
test eax, eax
je 0x465cd8
test byte [ebp - 8], 1
jne 0x465cf1
cmp dword [0x498dfc], 4
jb 0x465ceb
or byte [ebp + 0x12], 0x20
jmp 0x465d10
xor eax, eax
jmp 0x465d20
or byte [ebp + 0x12], 4
jmp 0x465d10
mov eax, dword [0x499078]
test eax, eax
je 0x465d10
call eax
mov ebx, eax
test ebx, ebx
je 0x465d10
mov eax, dword [0x49907c]
test eax, eax
je 0x465d10
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x499074]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x466474
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x466648
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x49a220]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x466648
test cl, 0x48
je 0x4664df
cmp byte [eax + 5], 0xa
je 0x4664df
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x466531
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x466519
call fcn.00458150
mov dword [eax], 9
call fcn.00458159
mov dword [eax], esi
jmp 0x466529
cmp eax, 0x6d
je 0x466648
push eax
call fcn.00458162
pop ecx
or eax, 0xffffffff
jmp 0x46664a
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x466643
test eax, eax
je 0x466558
cmp byte [ebx], 0xa
jne 0x466558
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x466561
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x46663d
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x46662d
cmp al, 0xd
je 0x466593
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x46661f
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x4665ad
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x4665a8
add dword [ebp + 0x10], 2
jmp 0x466601
mov dword [ebp + 0x10], eax
jmp 0x46661b
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4665d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46661b
cmp dword [ebp - 0xc], 0
je 0x46661b
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x4665f6
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x466601
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x46661e
cmp ebx, dword [ebp + 0xc]
jne 0x466606
cmp byte [ebp - 1], 0xa
jne 0x466606
mov byte [ebx], 0xa
jmp 0x46661e
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0045d1db
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x46661f
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x466577
jmp 0x46663d
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x46663d
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x46664a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x468131
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x48e410
call fcn.00458104
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x499088], edi
jne 0x468175
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x468160
mov dword [0x499088], ebx
jmp 0x468175
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x468175
mov dword [0x499088], 2
mov eax, dword [0x499088]
cmp eax, ebx
jne 0x468195
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x468258
cmp eax, 2
je 0x46819e
cmp eax, edi
jne 0x4681c6
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x4681b1
mov eax, dword [0x498ff8]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x4681cd
xor eax, eax
jmp 0x468258
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.004548d0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x468200
cmp esi, edi
jne 0x468216
push dword [ebp - 0x20]
call fcn.0045450b
pop ecx
mov esi, eax
cmp esi, edi
je 0x4681c6
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x468249
cmp dword [ebp + 0x14], edi
jne 0x468233
push edi
push edi
jmp 0x468239
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x468255
push esi
call fcn.004543f3
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0045813f
ret
Function at 0x468261
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x48e420
call fcn.00458104
xor esi, esi
cmp dword [0x49908c], esi
jne 0x4682a5
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x468290
mov dword [0x49908c], edi
jmp 0x4682a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4682a5
mov dword [0x49908c], 2
mov eax, dword [0x49908c]
cmp eax, 2
je 0x468386
cmp eax, esi
je 0x468386
cmp eax, 1
jne 0x4682ea
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x4682d3
mov eax, dword [0x498ff8]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x4682f1
xor eax, eax
jmp 0x468398
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.004548d0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x468327
cmp edi, esi
jne 0x468342
lea eax, [ebx + ebx]
push eax
call fcn.0045450b
pop ecx
mov edi, eax
cmp edi, esi
je 0x4682ea
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x468375
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x46835f
push esi
push esi
jmp 0x468365
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x468381
push edi
call fcn.004543f3
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x468398
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0045813f
ret
Function at 0x469621
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004548d0
mov eax, dword [0x496f74]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0045d1db
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x469754
push 2
push esi
push dword [ebp + 8]
call fcn.0045d1db
add esp, 0xc
cmp eax, ebx
je 0x469754
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x4696f4
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00463d30
push 0x8000
push dword [ebp + 8]
call fcn.00469a1a
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x4696aa
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.0045cba5
add esp, 0xc
cmp eax, 0xffffffff
je 0x4696ca
sub edi, eax
test edi, edi
jg 0x4696a2
jmp 0x4696e2
call fcn.00458159
cmp dword [eax], 5
jne 0x4696df
call fcn.00458150
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.00469a1a
pop ecx
pop ecx
jmp 0x46973c
jge 0x46973c
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045d1db
push dword [ebp + 8]
call fcn.004661f5
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x46973c
call fcn.00458150
mov dword [eax], 0xd
call fcn.00458159
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0045d1db
add esp, 0xc
mov eax, esi
pop edi
jmp 0x469756
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.004543e5
leave
ret

Function at 0x8ccbca
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8cc92e
or ebx, edx
mov ebx, 0xa436205d
dec edx
call fcn.008ccc18
sub ebx, ebx
add edx, 0x14416b4d
xor dword [edi], eax
or ebx, ebx
add edx, 0x27814abc
sub esp, 4
mov dword [esp], 0x7f77e3b4
mov edx, dword [esp]
add esp, 4
inc edi
add edx, 0xf1ffbe3e
cmp edi, esi
jne fcn.008ccbca
add ebx, 0x64cdc2a6
or edx, edx
ret
Function at 0x4061a0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x100
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push esi
push edi
xor edi, edi
mov esi, 0x47fa78
push edi
lea eax, [esp + 0x14]
push str.SDX_MUTEX_02d
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x100000
call ebp
mov dword [esi], eax
add esi, 0x114
inc edi
cmp esi, 0x481cf8
jl 0x4061bd
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SETUPAPI.DLL
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x481c24], eax
test eax, eax
je 0x40624d
push 0x4748c8
push eax
call esi
mov edx, dword [0x481c24]
push 0x4748a4
push edx
mov dword [0x481c10], eax
call esi
mov dword [0x481c14], eax
mov eax, dword [0x481c24]
push 0x474888
push eax
call esi
mov ecx, dword [0x481c24]
push 0x474870
push ecx
mov dword [0x481c18], eax
call esi
mov dword [0x481c1c], eax
push str.HID.DLL
call edi
test eax, eax
mov dword [0x481c20], eax
je 0x406316
push str.HidD_FreePreparsedData
push eax
call esi
mov edx, dword [0x481c20]
push str.HidP_GetCaps
push edx
mov dword [0x481be8], eax
call esi
mov dword [0x481bec], eax
mov eax, dword [0x481c20]
push str.HidD_GetPreparsedData
push eax
call esi
mov ecx, dword [0x481c20]
push str.HidD_SetFeature
push ecx
mov dword [0x481bf0], eax
call esi
mov edx, dword [0x481c20]
push str.HidD_GetFeature
push edx
mov dword [0x481bf4], eax
call esi
mov dword [0x481bf8], eax
mov eax, dword [0x481c20]
push str.HidD_FlushQueue
push eax
call esi
mov ecx, dword [0x481c20]
push str.HidD_GetSerialNumberString
push ecx
mov dword [0x481bfc], eax
call esi
mov edx, dword [0x481c20]
push str.HidD_GetProductString
push edx
mov dword [0x481c00], eax
call esi
mov dword [0x481c04], eax
mov eax, dword [0x481c20]
push str.HidD_GetAttributes
push eax
call esi
mov ecx, dword [0x481c20]
push str.HidD_GetHidGuid
push ecx
mov dword [0x481c08], eax
call esi
mov dword [0x481c0c], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
Function at 0x40df10
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x4162c5
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
mov edx, dword [ebp + 0x38]
lea esi, [esi + 8]
mul dword [ebp + ebx]
mov dword [ebp + 0x30], eax
xchg esi, edi
xchg edi, esi
mov dword [ebp + 0x38], edx
mov bl, bl
ja 0x434a44
jbe 0x4162bd
nop
cpuid
ret 0x860f
jbe 0x434a44
and byte [eax - 0x73], 0x64
and al, 4
mov cl, byte [ebp + 0xc]
mov dx, word [ebp + 0x10]
push eax
ja 0x42a3ca
jbe 0x4162dc
cli
into
jbe 0x42a3ca
invalid
shr si, 0x40
call fcn.00440f43
jno 0x418496
jo 0x42875f
fmul st(6)
jo 0x418496
add eax, 0xff23d23e
xchg ecx, eax
sub ebp, eax
mov dword [edx], 0x48340002
mov bx, bx
push esi
mov esi, esi
mov byte [esi + 0xba], cl
shr edi, 0x40
shr esi, 0x40
mov bx, bx
mov byte [esi + 0xbb], 0
shr bp, 0x40
xchg bl, ah
mov bh, bh
xchg ah, bl
mov word [esi + 0xbc], dx
call fcn.004493f5
mov al, byte [ebp + 0xb]
shr cx, 0x40
mov cx, cx
jmp 0x42a407
push esi
xchg bp, ax
mov bx, bx
shl bp, 0x20
xchg bp, ax
mov byte [esi + 0xba], bl
jne 0x43bb70
mov cx, cx
je 0x42a429
sti
popfd
cmpsd dword [esi], dword es:[edi]
je 0x43bb70
je 0x43bb70
and eax, 0x9f796859
inc edx
add bl, al
or byte [ecx + edx*2 + 0x1e23e852], 2
add byte [ebx + 0xff0ff06], cl
sbb dword [eax + 0x70000070], 0x4eb65803
jmp dword [esi]
mov byte [esi + 0xbb], al
mov ecx, ecx
mov word [esi + 0xbc], di
jmp 0x428750
Function at 0x418e71
Capabilities:
Check os version
Encode data using base64

Disassembly:
pop dword [esp - 4]
mov eax, dword [0x475301]
test eax, eax
jb 0x448cd3
xchg dl, dh
xchg dh, dl
jne 0x44a01b
je 0x418e91
fadd st(0), st(0)
std
call fcn.00430fd7
test eax, eax
jb 0x42feb1
xchg bx, di
xchg di, bx
jne 0x44a01b
add eax, dword [eax]
je 0x418eaf
js 0x418ef3
adc eax, 0x89665e5f
rcr byte [ebx + 0x5d], 0xc3
ret 0xf1d
pop edi
pop esi
mov ax, ax
pop ebx
pop ebp
ret
jmp 0x418ea8
add eax, 0xff5e8d57
Function at 0x41e94f
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck

Disassembly:
js 0x423fd9
jns 0x41e95b
invalid
jns 0x423fd9
sub dl, 0xff
mov ebx, 0x66c98845
mov ax, ax
jno 0x42cf73
jo 0x423fe8
cpuid
ret
jo 0x42cf73
xor al, 0x77
call fcn.0041560c
add esp, 0x24
test ax, ax
jb 0x436803
je 0x42402e
add byte [eax], al
add byte [ebp + 2], dh
jne 0x42400e
mov edx, 0x1a3d663b
add byte [edi], cl
test byte [esi], dl
add byte [eax], al
add byte [ebp + 4], dh
cmp ax, 0x1a
je 0x42402e
jne 0x42401e
loope 0x42402b
mov byte [0xa3d66c3], al
add byte [edi], cl
test dword [ebp + 0x740000d6], ebp
add al, 0xb5
cmp ax, 0xa
jne 0x4316d5
lodsd eax, dword [esi]
salc
add byte [eax], al
je 0x42402e
mov ch, 0x10
jne 0x424007
adc byte [ebp - 0x27], dh
inc edi
cmp edi, 7
mov dword [ebp - 8], edi
jbe 0x453179
ja 0x424044
in al, dx
jb 0x424024
add cl, byte [ebx + 0x51006a0e]
mov ecx, dword [esi]
push 0
push ecx
shr al, 0x40
call fcn.00434935
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
jmp 0x42c3ed
pop ebp
ret
Function at 0x41f291
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
jne 0x440838
je 0x41f2a1
mov word [eax - 0x51], ds
ja 0x42e7ac
jbe 0x41f2ab
test ecx, 0x1000
jb 0x45383d
push ebx
pop ebx
jne 0x423cee
push eax
pop eax
je 0x4266cd
cpuid
nop
ret
popfd
mov ebx, ebx
jmp dword [esi - 4]
and eax, 0x1fffffff
jb 0x448e00
stc
or eax, 0xa0000000
jb 0x448e08
jne 0x425b6f
je 0x42d6b1
sub al, 0x98
mov ah, 0xdc
je 0x425b6f
fidiv dword [edx + 0xf]
mov word [eax + 0x7d000254], gs
add al, 0x90
invalid
invalid
mov ecx, dword [esi]
test ecx, 0x2000
jb 0x42166d
invalid
jne 0x41bbb8
je 0x4344a4
inc ebx
fdivr qword [edx + edi*8 + 0x20e5c166]
shl bp, 0x20
test ecx, 0x4000
jb 0x41596a
ja 0x44c5bb
jbe 0x4344be
lds esi, [edi + ecx + 0x180f786]
add byte [0x24448fc2], dh
invalid
inc esp
invalid
jbe 0x44c5bb
xor eax, 0x24448fc2
cld
shl word [ebx + edx], cl
jmp dword [esi]
jne 0x43448a
je 0x438259
or dword [edi - 0x66], esp
mov ecx, dword [esi]
add esi, 8
test ecx, 0x1000
jb 0x4344c4
jne 0x423cee
je 0x438279
nop
cpuid
ret 0x966
or ax, ax
popfd
jmp dword [esi - 4]
mov eax, dword [0x52850f5e]
aad 0xfe
push dword [edx + eax + 0x58]
pop eax
popfd
je 0x4257da
xor al, 0xb1
pop esi
pop ebx
mov esp, ebp
xchg cl, ah
xchg ah, cl
pop ebp
ret
add ch, 0
test ecx, 0x100
jb 0x438280
jne 0x43923e
je 0x43fc6c
pushfd
dec esp
cmc
test ecx, 0x200
jb 0x43828a
call fcn.0041f291
and eax, 0x43166df
adc ecx, dword [edi]
xor ch, 0x75
add byte [eax], al
shr si, 0x40
mov eax, dword [esi + 4]
movzx eax, byte [ebp + eax]
cmc
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x453832
jne 0x43448a
je 0x440867
nop
cpuid
ret
xchg ebx, edi
xchg edi, ebx
mov ecx, dword [esi]
sub cx, 0
add esi, 8
jne 0x4266b1
je 0x440884
cpuid
nop
ret
je 0x4266b1
mov ebx, dword [esi + 8]
mov dx, dx
lea esi, [esi + 0xc]
sub word [ebx], ax
jmp dword [esi]
invalid
xor eax, 0x3726ff10
xchg bp, cx
xchg cx, bp
jne 0x419503
je 0x448e20
test eax, 0xf8e11f1
test ch, bl
push es
std
invalid
je 0x419503
fdiv dword [edi]
jmp 0x448ddd
jne 0x43fc53
je 0x44c5c7
pushal
cpuid
ret
mov dh, dh
mov cl, cl
mov eax, dword [esi + 4]
add esi, 8
and ecx, ecx
add ebx, eax
push esi
pop esi
test ecx, 0x80000000
jb 0x4344bc
jne 0x43824e
je 0x44c5f2
nop
cpuid
ret
je 0x43824e
xor al, 0x5c
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
mov eax, dword [0x475309]
test eax, eax
jb 0x4314b2
je 0x42d6a5
jne 0x44c61b
nop
cpuid
ret
mov eax, dword [0x475305]
test eax, eax
jb 0x4314b9
je 0x4180d5
jne 0x44c634
clc
or esi, 0x53
mov eax, esi
pop esi
or esi, esi
jno 0x44c63f
nop
cpuid
ret 0x810f
jno 0x42d68b
xor ch, 0xf
test dword [edi + 0x60], esp
invalid
in al, dx
sub eax, dword [ebx]
pop ds
popfd
shl al, 0x20
jmp dword [esi - 4]
pushal
pop esp
shl esi, 0x20
movzx eax, byte [edi]
popfd
jmp dword [esi - 4]
Function at 0x41f594
Capabilities:
Check os version
Encode data using base64

Disassembly:
pop dword [esp - 4]
inc esp
and al, 0xfc
mov al, byte [ebp + 0xb]
add esp, 0x30
add eax, 0
cmp bl, 1
shr di, 0x40
mov cl, cl
mov byte [esi + 0xba], bl
js 0x4454c0
jns 0x41f5c1
cpuid
pop edi
ret
jns 0x4454c0
fnstenv [ebx - 0x3f5bea01]
inc esi
add byte [ebp - 0x7b7df040], al
cmp eax, dword [eax]
add byte [esi + 0xffa86d7], al
mov byte [ebp + 0x7900017a], cl
add al, 0xf
dec esi
jno 0x41f595

Function at 0x4236f5
Capabilities:
Check os version

Disassembly:
invalid
push ebp
mov cx, cx
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xff
jb 0x438771
add eax, 0xffffffd8
cmp eax, 0xc2
lea edi, [edi]
ja 0x42374b
jbe 0x423721
nop
cpuid
ret
xor ecx, ecx
jb 0x445288
shr ecx, 0x40
mov cl, byte [eax + 0x453ff4]
jmp dword [ecx*4 + 0x453fec]
xor eax, eax
jb 0x4452a1
pop ebp
jne 0x4253a7
mov dx, dx
je 0x423763
cpuid
ret
je 0x4253a7
add eax, 0x83df5f4
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
ret
mov byte [ebp + ebx], al
jmp dword [esi]
and dword [ebx - 0x75], ebx
pop ebp
inc esp
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
lea esi, [esi + 0xc]
test byte [ebx + edx], al
jb 0x41a699
jmp dword [esi]
mov byte [0x40eac073], al
mov ebx, dword [ebp + 0x44]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
jne 0x450b7c
je 0x4452ba
sub dword [ebx], ecx
inc ecx
je 0x450b7c
fld dword [esi]
imul byte [ebp + ebx]
lea esi, [esi + 0xc]
shr cl, 0x40
jne 0x43237a
je 0x4452d8
cpuid
ret
je 0x43237a
fidiv dword [edx - 0x15]
mov bl, 0x43
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
xor dword [ecx + eax*2 + 0x4149df00], ebx
add byte [edi + ebx*2], dl
inc edx
add byte [ebx + edx*2], dl
inc esp
add byte [eax + 0x14c3a20f], dl
pop edi
inc edx
add byte [esi - 0x25ffbad4], cl
xchg ecx, eax
pop esi
pop ebp
ret
Function at 0x430b5e
Capabilities:
Check os version
Encrypt data using speck

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x43303f
je 0x430b79
and al, 0xc5
je 0x43303f
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x433047
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.004234a2
shl eax, 0x20
call fcn.0044ae1d
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret

Function at 0x430ff7
Capabilities:
Check os version
Encode data using base64

Disassembly:
push ebp
ja 0x43cd06
jbe 0x41b1e2
dec edi
sbb dword [esi], edx
sbb dword [edi], ecx
xchg byte [esi], bl
sbb eax, dword [edx]
add byte [edx + 0x40eac150], al
jbe 0x43cd06
adc byte [eax - 0x3f], 0xea
inc eax
jno 0x41b1d5
jo 0x431002
dec edi
xor edi, ecx
jo 0x41b1d5
xor eax, 0xfbe1e8e0
invalid

Function at 0x43249f
Capabilities:
Check os version
Encode data using base64

Disassembly:
pop dword [esp - 4]
jmp fcn.0041dfc3

Function at 0x434a50
Capabilities:
Check os version
Encode data using base64

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [esi + 8]
shr ebx, 0x40
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
call fcn.00425fc0
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid
Function at 0x439737
Capabilities:
Encode data using xor

Disassembly:
pop esi
pop ebp
mov ecx, ecx
ret
mov eax, 0xfffffff4
js 0x4276fe
jns 0x43541f
xchg ecx, eax
sbb byte [edi], cl
mov ecx, ebx
and bh, bh
inc edi
aam 0x87
rol dword [edi + 0x758b56da], cl
or byte [edx + 0x10], ch
jns 0x4276fe
invalid
lea esp, [esp + 4]
ja 0x435410
mov ah, ah
jbe 0x439747
in eax, 0x3f
jne 0x44a553
shr cx, 0x40
je 0x439756
sbb byte [esi + ebp], 0xf
test bh, dh
or eax, 0x89d80001
test byte [edi + 0x42], cl
add byte [ebp + 0x24648d56], dh
lea esp, [esp - 0x68]
je 0x44a553
fmul dword [ecx + 0x424f84]
mov ch, 0x56
xor ecx, ecx