joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a30a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101001c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
push 0x208
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
mov dword [ebp - 0x218], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov ecx, eax
shl ecx, 2
add esp, 0xc
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x21c], ecx
cmp edi, ebx
je 0x100a404
cmp eax, ebx
je 0x100a404
cmp esi, ebx
je 0x100a404
push edi
push 0x1001fc0
push 0x1001fb0
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.01009e55
add esp, 0x14
test eax, eax
jl 0x100a3e8
lea eax, [ebp - 0x214]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp eax, ebx
jne 0x100a3e8
lea eax, [ebp - 0x21c]
push eax
push dword [esi]
push ebx
push ebx
push 0x1001f90
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x214], ebx
je 0x100a3fc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x218]
jmp 0x100a407
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100c0d0
leave
ret 0xc

Function at 0x100af80
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101001c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 5
lea eax, [ebp - 0x10]
push eax
push 0x10030d4
xor edi, edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x100afd8
cmp eax, 5
ja 0x100afd8
push 0x10030c8
lea eax, [ebp - 0x10]
push eax
push 0x1001fb0
push dword [ebp + 0xc]
push esi
call fcn.01009e55
add esp, 0x14
test eax, eax
jge 0x100afe0
mov edi, 0x10a
jmp 0x100afe0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0100c0d0
leave
ret 8
Function at 0x100aff7
Capabilities:
Get common file path
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x101001c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x840], ecx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x838], 0x101
cmp eax, ebx
jne 0x100b07c
cmp ecx, ebx
jne 0x100b07c
push 0x57
pop edi
push 0x1003490
push 0
call fcn.0100e7e5
pop ecx
pop ecx
lea ecx, [ebp - 0x834]
call fcn.01009ef0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100c0d0
leave
ret 8
push 0x1003418
push ebx
call fcn.0100e7e5
pop ecx
pop ecx
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebx
je 0x100b234
cmp eax, esi
ja 0x100b234
lea eax, [ebp - 0x20c]
push eax
call fcn.0100af1e
mov edi, eax
cmp edi, ebx
je 0x100b0c8
push 0x1003388
jmp 0x100b241
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x100b0f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1003330
jmp 0x100b23f
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100af80
mov edi, eax
cmp edi, ebx
je 0x100b10d
push 0x10032f4
jmp 0x100b241
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0100e006
mov edi, eax
cmp edi, ebx
je 0x100b130
push 0x10032b0
jmp 0x100b241
xor esi, esi
cmp dword [ebp - 0x834], ebx
jbe 0x100b254
mov ebx, 0x80000003
push esi
lea ecx, [ebp - 0x834]
call fcn.010097bd
test eax, eax
je 0x100b24a
lea ecx, [ebp - 0x618]
push ecx
push dword [eax]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x100b21b
push esi
lea ecx, [ebp - 0x834]
call fcn.010097bd
push dword [eax]
lea eax, [ebp - 0x414]
push eax
push 0x1003288
lea eax, [ebp - 0x824]
push 0x105
push eax
call fcn.01009e55
add esp, 0x14
test eax, eax
jl 0x100b22a
lea eax, [ebp - 0x824]
push eax
push esi
lea ecx, [ebp - 0x834]
call fcn.010097bd
push dword [eax]
push ebx
call fcn.0100e224
push esi
lea ecx, [ebp - 0x834]
test eax, eax
je 0x100b1e6
call fcn.010097bd
push dword [eax]
push 0x10031b0
push 2
call fcn.0100e7e5
add esp, 0xc
xor edi, edi
jmp 0x100b21b
call fcn.010097bd
push dword [eax]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x840]
push dword [ebp - 0x83c]
push eax
call fcn.01009ca0
push esi
lea ecx, [ebp - 0x834]
mov edi, eax
call fcn.010097bd
push dword [eax]
push ebx
call fcn.0100e2b5
inc esi
cmp esi, dword [ebp - 0x834]
jb 0x100b143
jmp 0x100b24a
mov edi, 0x10a
jmp 0x100b050
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1003168
mov edi, eax
push 2
call fcn.0100e7e5
pop ecx
pop ecx
xor ebx, ebx
cmp edi, ebx
jne 0x100b050
push 0x10030f0
push ebx
jmp 0x100b057
Function at 0x100b872
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x101001c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x210], edi
cmp esi, edi
je 0x100b9f3
cmp ebx, edi
je 0x100b9f3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
test eax, eax
je 0x100b8ed
inc dword [esi + 4]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x5e
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
cmp eax, 1
jl 0x100b979
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0100bbc1
jmp 0x100b9f6
push edi
push ebx
call sub.Input.dll_Ordinal_111
test eax, eax
je 0x100b8ff
inc dword [esi]
jmp 0x100b9eb
cmp dword [esi + 0xc], edi
jbe 0x100b921
mov eax, dword [esi + 0x10]
push ebx
push dword [eax + edi*4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x100b9eb
inc edi
cmp edi, dword [esi + 0xc]
jb 0x100b904
mov eax, dword [esi + 8]
cmp eax, 1
jae 0x100b950
push 0x20
push 8
pop edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x10], eax
test eax, eax
je 0x100b9df
and dword [esi + 0xc], 0
mov dword [esi + 8], edi
jmp 0x100b9c4
cmp dword [esi + 0xc], eax
jb 0x100b9c1
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edi, [eax + 4]
mov eax, edi
shl eax, 2
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x100b985
mov dword [ebp - 0x210], 8
jmp 0x100b9eb
mov eax, edi
shl eax, 2
push eax
push dword [esi + 0x10]
push dword [ebp - 0x214]
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x10]
add esp, 0xc
test eax, eax
je 0x100b9af
push eax
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x214]
mov ebx, dword [ebp - 0x218]
mov dword [esi + 0x10], eax
mov dword [esi + 8], edi
push 8
pop edi
push ebx
call fcn.0100b7df
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov dword [edx + ecx*4], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
cmp dword [ecx + eax*4], 0
jne 0x100b9e7
mov dword [ebp - 0x210], edi
jmp 0x100b9eb
inc eax
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x210]
jmp 0x100b9f6
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100c0d0
leave
ret 8
Function at 0x100c020
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x100f478
call fcn.0100c048
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x101064c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100be34
cmp eax, esi
jne 0x100be27
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100be37
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100be0e
xor esi, esi
inc esi
mov eax, dword [0x1010648]
cmp eax, esi
jne 0x100be4a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100be85
mov eax, dword [0x1010648]
test eax, eax
jne 0x100be7f
mov dword [0x1010648], esi
push 0x10011b8
push 0x10011ac
call fcn.0100bd8b
pop ecx
pop ecx
test eax, eax
je 0x100be85
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100bf4f
mov dword [0x1010080], esi
mov eax, dword [0x1010648]
cmp eax, esi
jne 0x100bea9
push 0x10011a8
push 0x100119c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1010648], 2
cmp dword [ebp - 0x1c], ebx
jne 0x100beb6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1010650], ebx
je 0x100bed7
push 0x1010650
call fcn.0100c1f9
pop ecx
test eax, eax
je 0x100bed7
push ebx
push 2
push ebx
call dword [0x1010650]
push dword [0x1010068]
push dword [0x101006c]
push dword [0x1010064]
call fcn.0100b264
add esp, 0xc
mov dword [0x101007c], eax
cmp dword [0x1010070], ebx
jne 0x100bf35
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1010080], ebx
jne 0x100bf43
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x101007c]
call fcn.0100c08d
ret
call fcn.0100c3ec
jmp 0x100bdec

Function at 0x100c71e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100c729
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100c756
inc eax
jmp 0x100c75f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebp
ret 0xc

Function at 0x100c768
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push 2
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x100c7a5
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
jne 0x100c7a7
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi], 0xffffffff
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x100e006
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x101001c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
je 0x100e101
cmp esi, edi
je 0x100e101
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call sub.msvcrt.dll_memset
push 0x24c
lea eax, [ebp - 0x45c]
push edi
push eax
mov dword [ebp - 0x464], edi
mov dword [ebp - 0x460], edi
call sub.msvcrt.dll_memset
push esi
push 0x10086e8
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.01009e55
add esp, 0x28
test eax, eax
jge 0x100e099
mov dword [ebp - 0x464], 0x54f
jmp 0x100e0f2
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100e0c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x464], eax
jmp 0x100e0f9
lea eax, [ebp - 0x460]
push eax
call fcn.0100ddea
test eax, eax
je 0x100e0e0
push ebx
lea eax, [ebp - 0x434]
push eax
push esi
call fcn.0100def4
lea eax, [ebp - 0x460]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100e0c2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x464]
jmp 0x100e104
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100c0d0
leave
ret 8
Function at 0x100ecc6
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101001c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
cmp esi, ebx
je 0x100ee5a
xor eax, eax
cmp ax, word [esi]
je 0x100ee5a
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.0100eac4
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x100ee43
push edi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
call fcn.0100eaa6
cmp eax, ebx
jl 0x100edd7
cmp dword [ebp - 0x1c], 1
jne 0x100eda2
mov eax, dword [ebp - 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x100ed3c
mov ecx, dword [ebp - 0x14]
sub eax, edx
sar eax, 1
lea esi, [ecx + eax*2]
cmp dword [ebp - 0xc], ebx
je 0x100ed66
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov esi, eax
pop ecx
push dword [ebp - 8]
cmp esi, ebx
je 0x100ee17
xor eax, eax
mov word [esi], ax
call fcn.0100f253
test eax, eax
jne 0x100ed98
push ebx
push dword [ebp - 8]
call edi
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
jmp 0x100ed6c
mov esi, dword [ebp - 0x14]
movzx eax, word [esi]
cmp ax, 0x61
jb 0x100edb4
cmp ax, 0x7a
jbe 0x100edc0
cmp ax, 0x41
jb 0x100ed66
cmp ax, 0x5a
ja 0x100ed66
push 0x3a
pop eax
cmp ax, word [esi + 2]
jne 0x100ed66
push 0x5c
pop eax
cmp ax, word [esi + 4]
jne 0x100ed66
add esi, 8
jmp 0x100ed66
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1008fa0
push 0x3000000
push 0x1010638
mov dword [ebp - 0x10], eax
call fcn.0100e800
add esp, 0x14
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
jmp 0x100ee4c
call fcn.0100f253
xor esi, esi
inc esi
cmp eax, esi
je 0x100ee3e
push ebx
push dword [ebp - 8]
call edi
cmp eax, esi
je 0x100ee3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x20]
push 0x1008f40
jmp 0x100edee
mov dword [ebp - 0x18], esi
jmp 0x100ee03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x18]
jmp 0x100ee64
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100c0d0
leave
ret 4
Function at 0x100f253
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp eax, esi
je 0x100f2c4
xor ecx, ecx
cmp cx, word [eax]
je 0x100f2c4
push edi
push esi
push eax
call fcn.0100eac4
mov edi, eax
cmp edi, esi
je 0x100f2bf
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100f28d
test al, 0x10
je 0x100f28d
inc ebx
jmp 0x100f2a8
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x100f2a0
mov esi, 0x10b
cmp esi, 2
jne 0x100f2a8
push 3
pop esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
pop edi
jmp 0x100f2ce
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100f315
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push 0x10096c4
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f369
push esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push 0x10096b4
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100f360
cmp dword [ebp - 8], 4
jne 0x100f360
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x2e6e76c9
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0xf972f53
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4bb5f8
Capabilities:
Encode data using xor

Disassembly:
dec edx
pop edx
pushal
or byte [ecx - 0x2c], dh
int3
jp 0x4bb586
sub ch, bh
push edi
sub al, 2
movups xmm7, xmmword [edi + 0x76532ac9]
mov edi, 0x76532ac9
xor ch, al
inc esi
push eax
push 0xffffffffffffff82
in al, dx
or eax, dword [ebp - 0x74]
loopne 0x4bb5a3
inc edi
inc byte ss:[esp + ebp*2 - 4]
mov dword [edi + 2], esi
mov dword [edi + 6], edx
push ebp
in al, dx
inc edi
add byte [esi - 0x13], al
jns 0x4bb565
iretd
retf 0x3db8
push es
outsd dx, dword [esi]
frstor dword [ebx]
enter 0xffffffffffffe281, 0x4b
jbe 0x4bb59a
jns 0x4bb65e
and eax, 0x6cc5209
rcl edx, 1
out 0x79, eax
sahf
out 0xd3, eax
aam 0xd5
salc
xlatb
mov ebx, eax
jl 0x4bb5b6
fcomp st(1)
invalid
jmp 0x4bb5f4

Function at 0x4be682
Capabilities:
Encode data using base64

Disassembly:
adc dl, byte [ebx]
adc al, 0x15
push ss
pop ss
sbb byte [ecx], bl
sbb bl, byte [ebx]
sbb al, 0x1d
push ds
pop ds
and byte [ecx], ah
and ah, byte [ebx]
and al, 0x25
and dword [edx], esp
and esp, dword [0x29282726]
daa
sub byte [ecx], ch
sub ch, byte [ebx]
sub al, 0x2d
das
jle 0x4be639
aas
push cs
pop ecx
cmp bh, byte [ebx]
cmp al, 0x3d
aas
inc eax
xchg dword [edi + 0x22], eax
shr dword [edi + 0x404a889a], cl
dec esi
dec edi
push eax
push ecx
adc byte [eax], 0xcd
cmp dh, 0x56
push edi
pop eax
pop ecx
pop edx
pop ebx
pop esp
hlt
pop esi
jno 0x4be648
mov edi, 0x6867663c
imul ebp, dword [edx + 0x6b], 0x70d26d6c
jno 0x4be705
sal byte [eax + 0x71], cl
jb 0x4be6d0
cmp al, 0x75
jbe 0x4be70e
jne 0x4be70c
ja 0x4be710
js 0x4be68f
div byte [ecx + 0x7bb42be3]
jl 0x4be71d
mov cl, 0xe3
sub esi, dword [ebx + edi*2 + 0x7f7e7d7c]
jle 0x4be721
dec esi
add byte [esi - 5], ch
add dh, byte [edi + ecx*2 - 0x10]
sub dword [ecx], 0x1f
sub byte [esi + 0x75], ch
cmp al, 0x14
push es
add eax, 0xcdf69501
add dword [ebp - 0x15cb320a], edx
xchg edi, eax
cmp eax, 0xc2b24e13
test dword [eax], eax
clc
add al, bh
mov byte [0x5b34dbb], al
dec ebp
mov bl, 5
cmp al, 0x80
mov byte [edx - 0x3a], bl
daa
push edi
cmp byte [esi - 0x38], 0x7b
imul ah
jnp 0x4be786
imul ah
push eax
push eax
and cl, dl
sub byte [eax], dh
jb 0x4be739
int3
inc edi
Function at 0x4bfc34
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x6d148677
aas
mov dword [esi + 8], ebx
jmp 0x4bfcbd
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
test byte [edi], 0x10
je 0x4bfd16
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004c00d9
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 8]
test eax, eax
je 0x4be7eb
mov ecx, dword [eax]
test cl, 0x10
je 0x577262
test cl, 0x20
jne 0x4be7eb
mov ebx, dword [eax + 0xc]
mov ecx, dword [esp + 0x1c]
push edi
push esi
call fcn.004bfddb
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4f51c6
and dword [eax], 0xffffffdf
mov dword [eax + 0xc], esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4bfc27
mov dword [esi + 8], eax
mov edx, dword [eax]
or edx, 0x10
test ebx, ebx
mov dword [eax], edx
mov ecx, edx
je 0x4be7f2
and ecx, 0xffffffdf
mov dword [eax], ecx
mov dword [eax + 0xc], ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
and eax, 0xffffffef
or eax, 0x20
mov dword [esi], eax
mov dword [esi + 0xc], edi
mov edx, dword [edi]
shr edx, 9
shl edx, 9
sub eax, edx
mov dword [esi], eax
mov eax, dword [edi + 4]
sub ebx, eax
mov dword [esi + 4], ebx
mov ecx, dword [edi]
test cl, 3
mov eax, ebx
je 0x4ec497
test cl, 0x40
je 0x4bfdcd
dec eax
mov dword [esi + 4], eax
test byte [edi], 1
je 0x4bfdcd
mov eax, dword [esi]
add eax, 0xfffffe00
pop edi
mov dword [esi], eax
pop esi
pop ebx
add esp, 8
ret 8
mov esi, dword [esp + 0x18]
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x4f51ce
test byte [ebx], 0x10
je 0x4f51ce
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.004c00d9
mov ecx, dword [esp + 0x1c]
push edi
push esi
call fcn.004bfddb
mov ecx, dword [esp + 0x18]
mov dword [edi + 8], esi
mov eax, dword [esi]
or eax, 0x10
test ecx, ecx
mov dword [esi], eax
je 0x4f51d5
and eax, 0xffffffdf
mov dword [esi + 0xc], ecx
test ebx, ebx
mov dword [esi], eax
mov eax, dword [esp + 0xc]
je 0x4f51e0
test eax, eax
je 0x4ec4b7
and dword [ebx], 0xffffffdf
mov dword [ebx + 0xc], eax
test eax, eax
je 0x4bfd97
mov edx, dword [eax]
and edx, 0xffffffef
mov ecx, edx
mov dword [eax], edx
or ecx, 0x20
mov dword [eax], ecx
mov dword [eax + 0xc], esi
mov ecx, dword [esi]
mov eax, dword [edi]
mov ebx, dword [edi + 4]
shr ecx, 9
shl ecx, 9
add eax, ecx
mov dword [edi], eax
mov edx, dword [esi + 4]
add ebx, edx
mov dword [edi + 4], ebx
mov eax, dword [esi]
test al, 3
mov ecx, ebx
je 0x4f51e8
test al, 0x40
je 0x4bfdcd
inc ecx
mov dword [edi + 4], ecx
test byte [esi], 1
jne 0x4ec4c2
pop edi
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x4c1fcf
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push esi
lea esi, [ecx + 0x54]
xor edx, edx
cmp ecx, esi
mov eax, ecx
jae 0x4c1fe6
xor edx, dword [eax]
add eax, 4
cmp eax, esi
jb 0x4c1fdd
mov eax, edx
shr eax, 0x10
xor eax, edx
pop esi
ret

Function at 0x4c21a7
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
xor eax, eax
nop
nop
nop
nop
nop
xor edx, dword [ecx + eax*4]
inc eax
cmp eax, 0x2f
jb 0x4c21b0
mov eax, dword [ecx + 0xbc]
test eax, eax
jne 0x58120a
mov eax, edx
shr eax, 0x10
xor eax, edx
ret