joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55dbb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov dword [0x57eae4], 0xe1d
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x55dddf
jmp 0x55dc45
mov al, byte [ebp - 0x19]
mov ecx, 0x1c56
test al, 1
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
jne 0x55dc0f
jmp 0x55ddb2
mov eax, dword [ebp - 0x24]
mov dword [0x57eae8], 0x1e9d
mov dword [0x57eae4], 0x1cd
mov dword [ebp - 0x18], eax
jmp 0x55dddf
mov eax, dword [ebp - 0x2c]
mov dword [0x57eae4], eax
mov dword [0x57eae8], 0x1e9d
jmp 0x55ddd0
mov dword [0x57eae8], 0x9d8
mov dword [0x57eae4], 0x74a
mov ecx, dword fs:[0x18]
mov dword [0x57eae8], 0x1704
mov dword [0x57eae4], 0x1bee
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x30]
mov dword [0x57eae8], 0x13ab
mov ecx, dword [ecx + 0xc]
mov edx, ecx
add edx, 0x14
mov ecx, dword [ecx + 0x14]
mov dword [0x57eae4], 0xb65
cmp ecx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
je 0x55ddd0
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov byte [ebp - 0x39], cl
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
jmp 0x55dcc3
mov eax, dword [ebp - 0x40]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x39]
and bh, bl
test bh, 1
mov edi, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x50], edi
jne 0x55dcf9
jmp 0x55dd1d
mov eax, dword [ebp - 0x50]
mov dword [0x57eae4], 0x2594
mov dword [0x57eae8], 0x21f0
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x55dddf
mov eax, 0x1516
mov ecx, dword [ebp - 0x48]
mov dx, word [ecx]
shr dx, 1
movzx esi, dx
cmp dx, 0
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x28], eax
je 0x55ddb2
xor eax, eax
mov dword [ebp - 0x58], eax
jmp 0x55dd43
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x4c]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x5c], eax
mov word [ebp - 0x5e], dx
mov word [ebp - 0x60], di
jb 0x55dd77
mov ax, word [ebp - 0x5e]
mov word [ebp - 0x60], ax
mov ax, word [ebp - 0x60]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x5c]
cmp word [ecx + edx*2], ax
sete bl
add edx, 1
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov esi, dword [ebp - 0x54]
cmp edx, esi
setb bh
and al, bh
test al, 1
mov byte [ebp - 0x19], bl
mov dword [ebp - 0x58], edx
jne 0x55dd43
jmp 0x55dbf5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x34]
cmp edx, esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], edx
je 0x55dc2e
jmp 0x55dcc3
xor eax, eax
mov dword [0x57eae4], 0x1d37
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x55ddf0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [0x57eae4], 0x1b1e
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x57eae8], 0x26bb
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x55de6d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x16], dx
mov ax, word [ebp - 0x16]
cmp ax, 0x61
je 0x55dead
jmp 0x55df35
mov eax, dword [ebp - 0x1c]
add esp, 0x28
pop ebp
ret
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], eax
jge 0x55de83
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
jne 0x55de56
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x55df35
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x55de30
jmp 0x55df35
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
sete dl
mov byte [ebp - 0x25], dl
mov al, byte [ebp - 0x25]
test al, 1
jne 0x55dec9
jmp 0x55df35
mov dword [0x57eae8], 0xcb4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0x12]
mov word [ebp - 0x28], dx
mov ax, word [ebp - 0x28]
cmp ax, 0x64
jne 0x55df35
mov dword [0x57eae8], 0x1ac7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x55df35
mov dword [0x57eae4], 0xfffffca7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x55df35
mov eax, 1
mov dword [0x57eae4], 0xffffe8ea
mov dword [ebp - 0x1c], eax
jmp 0x55de4e
mov dword [0x57eae8], 0x888
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x55de4e
Function at 0x55dff0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x57eaf0], 0
mov byte [0x57eaf4], 0
mov dword [0x57eae4], 0xd7
mov dword [0x57eaec], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x55e048
xor eax, eax
mov dword [0x57eaec], 0
mov dword [ebp - 0x20], eax
jmp 0x55e07f
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x57eae8]
add eax, 0xfffff809
mov dword [0x57eae4], eax
mov eax, dword [0x57eaec]
add eax, 1
mov dword [0x57eaec], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x55e048
jmp 0x55e037
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x57eaf8], 0
mov dword [0x57eae8], 0x69c
mov edx, dword [0x57eaf0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x57eaf8], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x57eaf0], edx
mov dword [0x57eae4], 0x1aca
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x57eaf4], cl
mov dword [0x57eae4], 0x24a1
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x57eaf4]
mov edx, dword [0x57eaf0]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x57eae4], 0x17ba
mov edx, dword [0x57eaec]
add edx, 1
mov dword [0x57eaec], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x55e07f
mov dword [0x57eae4], 0x19d
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x55ec90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x57eaec], 0
mov dword [0x57eaf0], 0
mov dword [0x57eafc], 0
mov dword [0x57eae8], 0x1f51
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x55ee3d
jmp 0x55ecff
mov eax, dword [0x57eaec]
mov ecx, dword [0x57eaf0]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
jmp 0x55ed10
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], eax
jmp 0x55ed10
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x57eae4], 0xe18
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x57eaec], edx
mov dword [0x57eae8], 0x9fe
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x57eaf0], edx
mov dword [0x57eae4], 0xfffff931
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x57eaf4], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x57eae8], 0x26b8
mov cl, byte [0x57eaf4]
mov edx, dword [0x57eaf0]
mov byte [edi + edx], cl
mov edx, dword [0x57eae8]
mov ebx, edx
add ebx, 0x2ee
mov dword [0x57eae4], ebx
mov ebx, dword [0x57eaec]
movzx ebx, byte [edi + ebx]
mov ecx, dword [0x57eaf0]
movzx ecx, byte [edi + ecx]
add ecx, ebx
mov dword [0x57eae4], 0x1bba
and ecx, 0xff
mov dword [0x57eafc], ecx
mov cl, byte [edi + ecx]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
mov ch, byte [ebx + esi]
mov bl, cl
add bl, byte [0x57eb01]
mov byte [0x57eb00], bl
mov byte [0x57eb01], ch
mov byte [0x57eb02], cl
xor ch, cl
add edx, 0x1245
mov dword [0x57eae4], edx
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [0x57eae4]
add edx, 0xc87
mov dword [0x57eae4], edx
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x20], esi
jne 0x55ece6
jmp 0x55ee3d
mov dword [0x57eae8], 0x17fb
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x55f180
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov esi, dword [0x57eae8]
add esi, 0xd41
mov dword [0x57eae8], esi
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x63
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0xc2
mov dword [0x57eae4], 0x1613
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
call fcn.0055ee50
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.0055e1b0
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
jne 0x55f236
mov eax, dword [ebp - 0x38]
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x3c]
add eax, 0x13cc
mov dword [0x57eae4], 0x1f4e
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
jmp 0x55f210
mov eax, dword [ebp - 0x34]
mov dword [0x57eae4], 0x748
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.0055e600
mov eax, dword [ebp - 0x3c]
mov word [eax], 0x5a4d
mov dword [eax + 0x3c], 0xc0
mov dword [eax + 0xc0], 0x4550
add eax, 0xffc00000
mov dword [0x57eae4], 0x624
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 0x4c], eax
mov dword [0x57eae8], 0x2425
cmp eax, 0
sete dl
mov byte [ebp - 0x41], dl
xor eax, eax
mov cl, byte [ebp - 0x41]
test cl, 1
mov dword [ebp - 0x38], eax
jne 0x55f210
jmp 0x55f219
Function at 0x55f640
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [0x57eae8], 0xdcc
call fcn.00401080
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x34], ecx
je 0x55f684
jmp 0x55f7ef
mov eax, dword [esp + 0x30]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x2c], eax
jmp 0x55f744
lea eax, [esp + 0x48]
mov dword [0x57eae4], 0x8f5
mov ecx, dword [0x57eae8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
add eax, 0x14ca
mov dword [0x57eae8], eax
call fcn.0055ddf0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x20], ecx
jne 0x55f7e7
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.0055e890
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
lea eax, [0x55e7c0]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov dword [esp + 0x58], edx
mov dword [esp + 0x6c], 0x12ce00
mov dword [0x57eae4], 0xa58
mov edx, dword [0x57ead0]
mov dword [esp + 0x9c], edx
mov edx, dword [0x57ead4]
mov dword [esp + 0x74], edx
mov edx, dword [0x57ead8]
mov dword [esp + 0x80], edx
mov edx, dword [0x57eadc]
mov dword [esp + 0x68], edx
mov dword [0x57eae8], 0xfffff8f0
mov edx, dword [0x57eae0]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x30], eax
jne 0x55f66d
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x3c]
add eax, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp dword [eax], 0x4550
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
jne 0x55f66d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x48]
mov dword [esp + 0x88], eax
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x7c], eax
mov dword [0x57eae4], 0x22cb
mov dword [0x57eae8], 0xa7d
mov eax, dword [esp + 0x40]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0055f180
mov ecx, esp
lea edx, [esp + 0x48]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x57eae8], 0x10cf
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov esp, ebp
pop ebp
ret
Function at 0x55f8f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [0x57eae4], 0xffffff8f
mov dword [ebp - 0x10], eax
call fcn.0055f380
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x57eae8], 0x460
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x57eae4], 0x1e54
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x55fa5d
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
mov byte [ebp - 0x47], bl
je 0x55f9ea
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], ch
mov eax, dword [ebp - 0x4c]
cmp eax, 0x20
setb cl
mov dl, byte [ebp - 0x4d]
and dl, cl
test dl, 1
mov cl, byte [ebp - 0x46]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x47], cl
jne 0x55f982
mov al, byte [ebp - 0x47]
test al, 1
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x54], ecx
jne 0x55fa27
mov eax, dword [ebp - 0x38]
add eax, 2
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
jb 0x55f968
jmp 0x55fa56
mov eax, dword [ebp - 0x54]
movzx eax, word [eax]
mov dword [0x57eae4], 0x1812
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [0x57eae8], 0xaf2
mov dword [ebp - 0x28], esi
jmp 0x55fa5d
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x55fa5d
mov eax, dword [ebp - 0x28]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4aed37
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xd696b90d
shl byte [ebp - 0x402e7a2c], 1
xchg ecx, eax
or ebx, dword [ebp - 0x67]
invalid
or ecx, ebx
arpl si, ax
cmp byte [eax - 0x65], dh
aas
invalid
invalid
les esp, [edi]
popal
cmpsd dword [esi], dword es:[edi]
cld
and dl, ch
adc dword [edi + 0x5acd33f], 0x5ae25eea
mov bl, 0xbd
outsb dx, byte [esi]
cmp dword [edi - 0x2a], 0xacf55559
jg 0x4aec44
pop ecx
push ebp
cmc
lodsb al, byte [esi]
test byte [eax + 0x4df33f4e], bl
push ss
jecxz 0x4aecf2
les edi, [edi - 0x25]
mov bh, 0xd4
jg 0x4aecfe
shl byte [esi], cl
sti
mov al, 0x63
sub edx, dword [edi + 0x6450444f]
insb byte es:[edi], dx
jg 0x4aec2e
mov al, 0x62
add byte [ebx - 0x53976bca], 9
je 0x4aec41
add eax, 0xf4446925
aam 6
xor eax, dword [esi]
add al, 0x35
sub byte [ebx + edx], 0xfc
xchg edi, eax
push 0x33
pushal
aas
jo 0x4aec57
mov ch, 0x3b
pop esi
mov ebx, 0x10572806
sub byte [edi + 0x10], dl
sub byte [edi + 0x10], dl
daa
js 0x4aed03
pop ecx
mov ecx, 0xc045d9f1
adc al, 0x67
and al, 0xd7
mov bh, 0xe4
mov esp, 0x1c624a81
jne 0x4aec6c
push ebp
test eax, 0xa854cf34
xchg ebp, eax
lodsb al, byte [esi]
in al, 0x94
mov al, byte [0x1e3da5af]
mov esp, 0x4e7c6c1
rol esi, 0xe7
add al, 0xee
out 4, eax
out dx, al
or byte [esi], ch
inc esp
pop ds
push esi
test eax, 0x6074a0a4
push 0x432d9457
xor dl, byte [ebp + ebp*2 - 0xe7db85c]
fdiv st(3)
retf 0xe88e
sub eax, 0x6d943243
movsb byte es:[edi], byte [esi]
inc edi
xor cl, 0xd8
retf 0xe88e
mov gs, eax
push ss
inc esp
shr dword [ebx - 0x5218eb0c], 1
xlatb
jle 0x4aed62
stosd dword es:[edi], eax
hlt
add al, 0xe3
popal
pop ds
fldcw word [ebp - 0x6c]
ficomp word [esi]
cmc
cmp eax, 0x315efa5b
xor cl, byte [edx + 0x10]
jbe 0x4aece4
add eax, 0x5e230a16
push esi
aad 0xea
loope 0x4aece0
mov bh, 0x4d
dec ebp
cdq
mov dh, 0xbb
test eax, 0x844b618a
cwde
jne 0x4aed28
mov edx, 0x15324f0b
jne 0x4aed7d
xor al, 0xa5
aas
call 0x1530b15d
fcomp dword [ebx + 0x14335994]
arpl word [eax + 0x62dc0c92], bp
jnp 0x4aece2
xchg dword [ebx - 0x18], eax
cmc
cmc
in al, dx
xor cl, byte [edx - 0x4b476929]
pop ss
psubusb mm3, qword [edi - 0x38]
xchg ecx, eax
or al, 0x50
enter 0xffffffffffffc187, 0xc
push eax
or eax, 0x2335a46e
popal
jb 0x4aedc7
invalid
retf 0x3231
cld
nop
dec ebp
mov ch, dh
mov bh, 0xf4
rcr dword [ecx + 0x7c4e5668], cl
ja 0x4aede2
out 0x37, al
call [ebp - 0x30]
cmp byte [esi], dh
jno 0x4aee1e
xor eax, 0x14b96517
invalid
mov ecx, 0x87b1f014
pop ds
add al, 0x51
pop es
push edi
iretd
invalid
Function at 0x544087
Capabilities:
Encode data using xor

Disassembly:
adc byte [edi - 0x30], dh
out 0xe2, eax
mov esp, 0xe7f96549
push eax
inc esp
or dword [eax + 4], eax
das
xor al, 0xd3
invalid
out dx, al
add al, byte [ecx + 0x594a8092]
aad 0xf5
lodsd eax, dword [esi]
mov esi, 0xc3f520bf
xor al, 0x99
lahf
inc ebx
cdq
and byte [ecx - 0x52a39dbd], dl
push esi
jge 0x5440b8
inc ebp
loop 0x5440a4
xor al, 0x9f
lahf
mov ebx, 0xc72883d0
and eax, 0xaa662ca2
inc ecx
imul eax, dword [eax], 0x3f319802
cwde
xor dword [edi], edi
cwde
xor dword [edi], edi
sbb al, 0xe0
mov cl, 0xc
inc edx
loopne 0x54403e
or al, 0x42
xchg ebp, eax
lahf
loopne 0x54403b
xor cl, byte [edi + 8]
jg 0x544078
mov word [eax], gs
cmovl ecx, dword [ecx + 0x3b]
pop esp
add al, ch
inc esp
loopne 0x544057
std
or esp, edi
sub byte [edx], dh
retf
sbb al, 0x86
popfd
xor esi, 0xc2a2b5e0
and dword [ecx - 0x9a41248], edx
sbb eax, 0x1991561
cmpsd dword [esi], dword es:[edi]
inc ecx
jp 0x5440dc
add dword [edi - 0x5bf385bf], esp
movsb byte es:[edi], byte [esi]
jecxz 0x54408b
arpl word [edi], bx
jnp 0x54411e
jo 0xfe26dc6a
sar ch, cl
xor al, 0x2e
retf 0x3d56
cld
cmp dword [ecx + 0x12d03a79], 0x459e3989
mov al, 0
push 0xffffffffffffffc6
mov esp, 0x6f30b0f1
adc eax, 0x913d21dd
loope 0x5440cb
pop eax
fdivr dword [ebp + 0x65c2e12d]
stosd dword es:[edi], eax
add al, 0x79
test al, 0xff
xor ebx, ecx
mov bl, 0x90
imul esp
mov byte [0xc5b2e09c], al
push ecx
inc edx
sbb cl, byte [esi + 0x3e]
adc byte [edx + ebx*4 - 0x44], ch
popal
xchg esp, eax
xchg ebp, eax
mov bl, pe_nt_image_headers32
hlt
Function at 0x4d1ece
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4e44ff
call fcn.004aef44
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004cba8f
mov eax, dword [0x51f03c]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x5262f8
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.004d1d07
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.004c6033
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.004a72f2
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004c5fe3
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.004c5eaa
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x4d4820
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d484e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d486c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d4786
jmp 0x4d486c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d486c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d4786
test edi, edi
mov eax, edi
jne 0x4d4856
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x270925f3
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4b2b7165
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219