joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41452e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x41455c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x414563
cmp ebx, dword [eax + 4]
jae 0x414563
xor eax, eax
jmp 0x414753
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x414574
xor eax, eax
inc eax
jmp 0x414752
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x41458a
cmp ecx, edx
jae 0x4146cf
cmp dword [eax + 4], 0
je 0x414593
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x41457b
cmp dword [ebp + 8], 0
je 0x4145b5
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4146cf
cmp eax, esi
jae 0x4146cf
mov eax, dword [0x41f328]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4145da
cmp dword [esi*4 + 0x41f330], edi
je 0x4146d3
inc esi
cmp esi, eax
jl 0x4145c8
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41474f
cmp dword [ebp - 8], 0x1000000
jne 0x41474f
test byte [ebp - 0xc], 0xcc
je 0x414658
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x41474f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41474f
cmp word [eax + 0x18], 0x10b
jne 0x41474f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x41474f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x414658
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x414658
test byte [ecx + 0x27], 0x80
jne 0x4146cf
push 1
push 0x41f370
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x41456c
mov ecx, dword [0x41f328]
test ecx, ecx
mov edx, ecx
jle 0x41468c
lea eax, [ecx*4 + 0x41f32c]
cmp dword [eax], edi
je 0x41468c
dec edx
sub eax, 4
test edx, edx
jg 0x414680
test edx, edx
jne 0x4146bd
push 0xf
pop ebx
cmp ecx, ebx
jg 0x414699
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4146b1
lea eax, [edx*4 + 0x41f330]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x41469f
cmp ecx, 0x10
jge 0x4146bd
inc ecx
mov dword [0x41f328], ecx
push 0
push 0x41f370
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x41456c
xor eax, eax
jmp 0x414752
test esi, esi
jle 0x41456c
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x41f370
call ebx
test eax, eax
jne 0x41456c
cmp dword [esi*4 + 0x41f330], edi
je 0x414729
mov eax, dword [0x41f328]
lea esi, [eax - 1]
test esi, esi
jl 0x414717
cmp dword [esi*4 + 0x41f330], edi
je 0x414713
dec esi
jns 0x414707
test esi, esi
jge 0x414727
cmp eax, 0x10
jge 0x414722
inc eax
mov dword [0x41f328], eax
lea esi, [eax - 1]
jmp 0x414729
je 0x414741
xor ecx, ecx
test esi, esi
jl 0x414741
lea eax, [ecx*4 + 0x41f330]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x41472f
push 0
push 0x41f370
call ebx
jmp 0x41456c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414a18
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x41f470]
push edi
jae 0x414bed
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x41f480]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x414bed
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x414ac3
test dl, 2
jne 0x414ac3
test dl, 0x48
je 0x414a8d
cmp byte [eax + 5], 0xa
je 0x414a8d
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414ad6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x414abe
mov dword [0x41f0dc], ecx
jmp 0x414bf4
cmp eax, 0x6d
jne 0x414aca
xor eax, eax
jmp 0x414c01
push eax
call fcn.00411652
pop ecx
jmp 0x414bfe
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x414be8
test eax, eax
je 0x414afd
cmp byte [ebx], 0xa
jne 0x414afd
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x414b06
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x414be2
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x414bd2
cmp al, 0xd
je 0x414b38
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x414bc4
dec ecx
cmp dword [ebp - 8], ecx
jae 0x414b52
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x414b4d
add dword [ebp - 8], 2
jmp 0x414ba6
mov dword [ebp - 8], eax
jmp 0x414bc0
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414b7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x414bc0
cmp dword [ebp - 0x10], 0
je 0x414bc0
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x414b9b
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x414ba6
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x414bc3
cmp ebx, dword [ebp + 0xc]
jne 0x414bab
cmp byte [ebp - 1], 0xa
jne 0x414bab
mov byte [ebx], 0xa
jmp 0x414bc3
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00410ecc
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x414bc4
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x414b1c
jmp 0x414be2
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x414be2
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x414c01
and dword [0x41f0dc], 0
mov dword [0x41f0d8], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4154b6
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x41bdb8
call fcn.004104f4
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x41f3a0], edi
jne 0x4154fa
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4154e5
mov dword [0x41f3a0], ebx
jmp 0x4154fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4154fa
mov dword [0x41f3a0], 2
mov eax, dword [0x41f3a0]
cmp eax, ebx
jne 0x41551a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x4155dd
cmp eax, 2
je 0x415523
cmp eax, edi
jne 0x41554b
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x415536
mov eax, dword [0x41f29c]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x415552
xor eax, eax
jmp 0x4155dd
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.0040cde0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x415585
cmp esi, edi
jne 0x41559b
push dword [ebp - 0x20]
call fcn.0040cba7
pop ecx
mov esi, eax
cmp esi, edi
je 0x41554b
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4155ce
cmp dword [ebp + 0x14], edi
jne 0x4155b8
push edi
push edi
jmp 0x4155be
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x4155da
push esi
call fcn.0040bd37
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0041052f
ret
Function at 0x4155e6
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x41bdc8
call fcn.004104f4
xor esi, esi
cmp dword [0x41f3a4], esi
jne 0x41562a
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x415615
mov dword [0x41f3a4], edi
jmp 0x41562a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x41562a
mov dword [0x41f3a4], 2
mov eax, dword [0x41f3a4]
cmp eax, 2
je 0x41570b
cmp eax, esi
je 0x41570b
cmp eax, 1
jne 0x41566f
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x415658
mov eax, dword [0x41f29c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x415676
xor eax, eax
jmp 0x41571d
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.0040cde0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x4156ac
cmp edi, esi
jne 0x4156c7
lea eax, [ebx + ebx]
push eax
call fcn.0040cba7
pop ecx
mov edi, eax
cmp edi, esi
je 0x41566f
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4156fa
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x4156e4
push esi
push esi
jmp 0x4156ea
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x415706
push edi
call fcn.0040bd37
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x41571d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0041052f
ret
Function at 0x416551
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0040cde0
mov eax, dword [0x41e260]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x41f470]
mov dword [ebp - 4], eax
jae 0x416694
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x41f480]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x416694
push 1
push esi
push ebx
call fcn.00410ecc
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x41669e
push 2
push esi
push ebx
call fcn.00410ecc
add esp, 0xc
cmp eax, 0xffffffff
je 0x41669e
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x41663e
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00411b30
push 0x8000
push ebx
call fcn.00416965
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x4165fd
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.004109db
add esp, 0xc
cmp eax, 0xffffffff
je 0x41661b
sub edi, eax
test edi, edi
jg 0x4165f2
jmp 0x416631
cmp dword [0x41f0dc], 5
jne 0x41662e
mov dword [0x41f0d8], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.00416965
pop ecx
pop ecx
jmp 0x41667e
jge 0x41667e
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00410ecc
push ebx
call fcn.004149dc
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x41667e
mov dword [0x41f0d8], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x41f0dc], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.00410ecc
add esp, 0xc
mov eax, esi
pop edi
jmp 0x4166a1
mov dword [0x41f0d8], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0040bdf8
leave
ret
Function at 0x4169ee
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x128
push 0x41bf60
call fcn.004104f4
mov eax, dword [0x41e260]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
xor ebx, ebx
mov dword [ebp - 0x130], ebx
or dword [ebp - 0x12c], 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x416afb
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x134], esi
cmp esi, 0x104
jle 0x416aac
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.0040cde0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x138], edi
jmp 0x416a99
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x416afb
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, ebx
je 0x416afb
mov al, byte [edi]
cmp al, 0x5c
je 0x416aba
cmp al, 0x2f
jne 0x416abf
cmp al, byte [edi + 1]
je 0x416af5
mov byte [ebp - 0x128], 0x3d
movzx eax, byte [edi]
push eax
call fcn.00416b31
pop ecx
mov byte [ebp - 0x127], al
mov byte [ebp - 0x126], 0x3a
mov byte [ebp - 0x125], bl
push edi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x416afb
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411652
pop ecx
cmp dword [ebp - 0x130], ebx
je 0x416b17
push edi
call fcn.0040bd37
pop ecx
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x1c]
call fcn.0040bdf8
call fcn.0041052f
ret
Function at 0x10018ee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
or ebp, 0xffffffff
jmp 0x10018f02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10018f09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10018ef8
mov eax, 1
add ebx, ebx
jne 0x10018f1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10018f10
jne 0x10018f2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10018f10
xor ecx, ecx
sub eax, 3
jb 0x10018f40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10018fb2
mov ebp, eax
add ebx, ebx
jne 0x10018f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10018f58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10018f7c
inc ecx
add ebx, ebx
jne 0x10018f68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10018f5d
jne 0x10018f79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10018f5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10018f9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10018f8d
jmp 0x10018efe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10018f9c
add edi, ecx
jmp 0x10018efe
pop esi
mov edi, esi
mov ecx, 0xa8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10018fba
cmp byte [edi], 5
jne 0x10018fba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10018fbf
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x1001902e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x191dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x192a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10018fec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x192b0]
or eax, eax
je 0x10019028
mov dword [ebx], eax
add ebx, 4
jmp 0x10019009
call dword [esi + 0x192ac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1001905f
cmp al, 0xef
ja 0x10019052
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10019034
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10019041
mov ebp, dword [esi + 0x192b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10019093
sub esp, 0xffffff80
jmp 0x10004bf0
Function at 0x8470dc
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x847114
jmp 0x8470f8
lea esp, [esp + 4]
jmp 0x8470bf
jmp 0x847130
jmp 0x84714c
push ebx
jmp 0x847168
jmp 0x847184
push ebp
jmp 0x8471a0
jmp 0x8471bc
push esi
jmp 0x8471d8
jmp 0x87bc82
push edi
movzx edx, byte [eax]
shl edx, 8
movzx esi, byte [eax + 1]
xor edx, esi
movzx esi, byte [eax + 2]
jmp 0x87bd45
shl edx, 8
jmp 0x87bdd1
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
jmp 0x87be70
xor edx, esi
movzx esi, byte [eax + 3]
jmp 0x87bd81
xor edx, esi
movzx esi, byte [eax + 0xe]
jmp 0x87c2bd
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
jmp 0x87bdff
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
jmp 0x87be1f
movzx esi, byte [eax + 0xa]
jmp 0x87be4d
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x850a5c]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x850a5c]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x850a5c]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x850a5c]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.00868e93
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x850a5c]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x850a5c]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x850a5c]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x850a5c]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x852284
jne 0x87c349
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x8483df
Capabilities:
Encode data using base64

Disassembly:
jmp 0x8483fb
lea esp, [esp + 4]
jmp 0x8485bb
jmp 0x848433
jmp 0x84844f
push ebp
jmp 0x84846b
jmp 0x848487
mov ebp, esp
jmp 0x8484a3
jmp 0x8484bf
movzx eax, byte [ecx]
jmp 0x8484db
jmp 0x8484f7
shl eax, 0x10
jmp 0x848513
jmp 0x84852f
mov byte [0x4aa25730], al
inc esp
aad 0x45
sub al, 0xdf
sub ch, al
pop ebx
retf
cmp dword [ebp + 0xc], 2
or al, 2
jmp 0x848567
jmp 0x87cd42
jmp 0x848583
jb 0x84854b
jae 0x84859f
push ecx
add dword [edx - 0x74138104], edx
xchg byte [edx - 0x74], dl
or eax, 0xf317e49d
in al, dx
insb byte es:[edi], dx
loop 0x84851f
je 0x848531
xchg byte [0x3f8be995], al
add eax, dword [eax]
lodsd eax, dword [esi]
jmp 0x87c52f
mov ah, 0x47
lodsb al, byte [esi]
or byte [ebx], 0x9b
dec byte [0x9b0b81eb]
dec byte [0x70e267e5]
pop ss
loop 0x8485c5
jge 0x8485a5
jmp 0x848417
push edi
invalid
ljmp 0x21ed:0x740582d9
movzx edx, byte [ecx + 1]
jmp 0x87cd38
shl edx, 8
or eax, edx
jmp 0x84854b
cmp dword [ebp + 0xc], 3
jmp 0x87ce0a
push ebx
push esi
jmp 0x87cdb0
push edi
mov ecx, eax
push 0x3f
mov esi, eax
shr ecx, 0x12
pop edx
shr esi, 0xc
and ecx, edx
and esi, edx
cmp dword [ebp + 0xc], 2
jb 0x87cde8
mov edi, eax
shr edi, 6
jmp 0x87ce2c
mov edi, dword [ebp + 0xc]
jmp 0x87ce67
mov ebx, dword [ebp + 0xc]
jmp 0x87cf64
jne 0x87cd7e
movzx ecx, byte [ecx + 2]
or eax, ecx
jmp 0x87cd7e
and edi, edx
jmp 0x87ce67
cmp dword [ebp + 0xc], 3
jne 0x87cded
and eax, edx
mov ebx, eax
jmp 0x87cf64
mov ecx, dword [ebp + 8]
mov byte [ecx], dl
cmp esi, 0x1a
jae 0x87cf79
lea ecx, [esi + 0x41]
jmp 0x87cfb8
cmp ecx, 0x34
jmp 0x87cf44
cmp ecx, eax
jae 0x87cfa3
lea edx, [ecx - 4]
jmp 0x87ceb4
jae 0x87cefe
lea edx, [ecx + 0x47]
jmp 0x87ceb4
push 0x3e
pop eax
cmp ecx, 0x1a
jae 0x87cee2
lea edx, [ecx + 0x41]
jmp 0x87ceb4
cmp esi, 0x34
jae 0x87dadf
lea ecx, [esi + 0x47]
jmp 0x87cfb8
xor edx, edx
cmp ecx, eax
setne dl
lea edx, [edx*4 + 0x2b]
jmp 0x87ceb4
cmp dword [ebp + 0xc], 2
jmp 0x87d16e
mov byte [edx + 2], cl
jmp 0x87d08d
cmp edi, 0x34
jae 0x87d0ab
lea ecx, [edi + 0x47]
jmp 0x87cff5
xor ecx, ecx
cmp edi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x87cff5
cmp dword [ebp + 0xc], 3
jmp 0x87d13d
cmp edi, eax
jae 0x87d079
lea ecx, [edi - 4]
jmp 0x87cff5
mov byte [edx + 3], 0x3d
jmp 0x87d40c
mov byte [edx + 2], 0x3d
jmp 0x87d08d
cmp ebx, 0x34
jae 0x87d1cb
lea ecx, [ebx + 0x47]
jmp 0x87d205
jne 0x87d0b7
cmp ebx, 0x1a
jae 0x87d10b
lea ecx, [ebx + 0x41]
jmp 0x87d205
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
jb 0x87d104
cmp edi, 0x1a
jae 0x87d014
lea ecx, [edi + 0x41]
jmp 0x87cff5
xor ecx, ecx
jmp 0x87d1df
cmp ebx, eax
jae 0x87d1ae
lea ecx, [ebx - 4]
jmp 0x87d205
cmp ebx, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x87d205
mov byte [edx + 3], cl
jmp 0x87d40c
pop edi
pop esi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp esi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x87cfb8
cmp esi, eax
jae 0x87d4b4
lea ecx, [esi - 4]
jmp 0x87cfb8

Function at 0x849220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x87e51b
lea esp, [esp + 4]
jmp fcn.0087e3a6
Function at 0x864ed2
Capabilities:
Encode data using xor

Disassembly:
cmp ebp, dword [ebx + 0x6f8c3dce]
int1
popal
add bl, dh
pop eax
pop edi
push 0x46604d
call fcn.0085cdcf
scasb al, byte es:[edi]
xor dword [ecx + 0x3a8633c0], esp
cwde
push cs
imul ebx, dword [eax - 0x59cf6ce1], 0xa2b730c1
inc ebx
test dword [ebx + 0x68], eax
push 0x465d05
invalid
inc esi
add al, ch
mov dword [0xefffff7e], eax
outsb dx, byte [esi]
cld
wait
jbe 0x864ec6
bnd je 0x864f1f
lea edi, [ebp + edx*4 - 0x41]
cmp byte [esi - 0x527c737], ch
add al, 0x39
nop
invalid
invalid
push 0x465a36
call fcn.0085cdcf
pop esp
aad 0x45
sub al, 0xdf
jp 0x864f25
mov ah, 0xd3
in eax, 0x8f

Function at 0x86b5d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call 0x84a5a3
jmp 0x84a6ef

Function at 0x876921
Capabilities:
Parse pe header

Disassembly:
and al, 4
jmp 0x8769c4
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x876983
jne 0x8769a4
inc dword [ebx + 0x57857613]
or ecx, dword [eax + 0x6e88791e]
adc eax, 0x9d6e0b9b
jp 0x8768de
adc al, 0x8a
in eax, dx
sbb al, 0xfe
xchg ebx, eax
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jmp 0x876a09
xor eax, eax
pop ebp
ret
mov edi, edi
push esi
push edi
xor edi, edi
lea esi, [edi + 0x85419c]
push dword [esi]
call fcn.0086a11f
add edi, 4
pop ecx
mov dword [esi], eax
cmp edi, 0x28
jb 0x8769ca
pop edi
pop esi
ret
jne 0x8769a4
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret

Function at 0x8769ea
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
jmp 0x876ab3
xor eax, eax
jmp 0x876b2c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x876a8d
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x876b06
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x876b2c
jmp 0x876b06
inc edx
add eax, 0x28
cmp edx, esi
jb 0x876ad3
jmp 0x876a8d
pop edi
pop esi
pop ebx
pop ebp
ret