joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a6f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a72f
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegDeleteValueA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0xc

Function at 0x1000a740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push dword [ebp + 0x14]
pop dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a78f
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x10

Function at 0x1000a7a0
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x1000a7e5
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x1000a7de
cmp dword [ebp - 0x98], 1
jb 0x1000a7de
mov ecx, 0x101
jmp 0x1000a7ea
mov ecx, 1
jmp 0x1000a7ea
mov ecx, 0xf003f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push ecx
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a834
push dword [ebp + 0x14]
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14

Function at 0x403a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
outsb dx, byte [esi]
in al, dx
or eax, 0x8b5614ec
jne 0x403aa2
push edi
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x403ac4
mov ecx, dword [esi + 0x8424]
test eax, eax
je 0x403ac4
xor ah, dl
ret
cmp dword [0x410286], 1
jne 0x403ad7
mov eax, dword [esi + 0x10]
mov dword [0x41028c], eax
jmp 0x403afb
mov ecx, dword [esi + 0x10]
mov eax, dword [0xb7410264]
cmp ebx, dword [ebx]
pop esi
sbb byte [ebx - 0x44fd47f3], cl
add byte [edx - 0x40], bh
add al, byte [ecx]
inc ecx
inc eax
mov ecx, 0x4102b80d
add byte [ebx + 0xe20242], ah
mov eax, dword [0x36414eac]
mov al, byte [0x82d010be]
add byte [eax - 0x1a], cl
cmovne edx, dword [edi]
add dword [eax], eax
add byte [ebx + 0x410bc815], cl
add byte [ebx + 0x5e7c1f8], cl
aad 0xd9
inc eax
mov dword [0x11370269], eax
call 0x47406a00
mov dword [0x410ba0], eax
mov esi, eax
movsb byte es:[edi], byte [esi]
or eax, dword [ecx]
mov dword [esi - 0x51ff76b0], eax
mov edx, dword [0x2c0ba4]
mov eax, dword [esi + 0x830]
dec edi
xchg esi, eax
push esp
or byte [ebp - 0x74615100], bh
invalid
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfffffff8
push esi
mov esi, dword [ebp - 0x1d]
push esi
lea eax, [ebp - 0x78]
push 0x78
push eax
push esi
call fcn.004086e0
inc esi
dec ebp
or byte [ebx + 0x23c0c815], cl
add byte [edi + 0x77c23351], ah
sbb ch, byte [esp + edx*8 + 0x36520040]
adc eax, 0xfe40c180
mov eax, dword [0x4102ac]
add esp, 0x14
test eax, eax
je 0x401e8c
push eax
push 0xec4654
dec dword [edx]
rol dword fs:[eax - 0x24], 0xe7
les ecx, [eax]
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
int1
nop
nop
nop
nop
invalid

Function at 0x40576f
Capabilities:
Encode data using xor

Disassembly:
push edx
inc esi
add al, 0x85
sal byte [edx + edx - 0x5a], 0xe
mov edi, 0x97
push 9
pop esi
mov dword [esi + 4], edi
call 0xcf70a3d0
mov esi, dword [esi + 8]
test esi, esi
jne 0x40576d
test dword [ebp + 0x1b7975a9], edi
mov bh, 0
add byte [ebx + 0x53], dh
mov ebx, edi
and eax, 0xd115c094
add byte [ebx - 0xccf7e2], cl
mov ebx, dword [esi]
or byte [ebx], dh
inc dword [ebx + 0x7502047e]
and ecx, dword [ebx + 0x6a9c6a16]
add byte [edx], ch
cmp dword [esi + 4], 2
jne 0x4057ce
mov edx, dword [esi]
push 0xffffffffffffff9c
push 0
push 0
push edx
call 0x7b42a4b0
cmp eax, 0xf51176
jne 0x4057c7
mov edi, 0xde9201
jmp 0x4057ce
mov dword [esi + 4], 0xc8
mov esi, dword [esi + 8]
test esi, esi
jne 0x4057a5
test esp, edx
je 0x405803
mov esi, dword [ebp - 4]
das
idiv byte [edi + 0x23]
jl 0x40577b
cmp ebx, 0xc6c6c0
jae 0x405803
mov word [ebx - 0x18], ss
outsd dx, dword [esi]
adc eax, 0x6a0000
add cl, byte ss:[ebp + 0x53]
call fcn.0040b540
mov ebx, eax
mov dword [ebp - 4], edx
jmp 0x4057a0
mov ebx, dword [ebp + 8]
mov esi, ebx
sbb dword [ebx - 0x62], 2
jne 0x405818
mov eax, dword [esi]
push 9
push eax
call fcn.0040a3d0
mov ebx, dword [eax + ecx - 0x6c]
div byte [ebp - 0x7d]
mov ebp, ecx
mov eax, dword [esi - 0x2c]
test eax, eax
xor cl, byte [esi]
mov ecx, dword [esi]
push 0
push 0
push 0
push ecx
call fcn.0040a4b0
mov ebp, dword [edi - 0x11]
test esi, esi
jne 0x405821
pop esi
pop edi
call 0xc39e3dca
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x406200
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xffffff90
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi

Function at 0x4063a0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
aas
and byte [eax], dh
add byte [eax], al
dec ebx
xchg ebx, eax
push esp
add byte [eax], al
push ebx
pop esi
or byte [esi - 0x23], dl
and dword [ebx + 4], eax
test eax, eax
jne 0x4063c2
mov eax, dword [ebp + 0x14]
pop edi
add byte [eax], al
add byte [eax], al
xor eax, eax
inc edi
in eax, 0xbb
Function at 0x401b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x51f620]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov cl, 0x64
mov al, 0x6c
push esi
mov byte [ebp - 0xe], cl
mov byte [ebp - 0xa], cl
mov byte [ebp - 0x23], cl
mov cl, 0x69
push edi
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc], al
mov byte [ebp - 9], al
mov byte [ebp - 8], al
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x24]
mov dl, 0x6e
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x1d], cl
mov byte [ebp - 0x1a], cl
push eax
lea ecx, [ebp - 0x10]
mov bl, 0x74
push ecx
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 7], 0
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x49
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1e], bl
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x19], 0x7a
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x6b
mov byte [ebp - 0x12], 0
call fcn.004869f0
mov ebx, eax
xor esi, esi
lea edi, [esi + ebx]
push edi
lea edx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
call fcn.00407ac0
mov edx, dword [ebp - 0x28]
mov cl, byte [edx]
cmp cl, 0xe8
je 0x401c41
cmp cl, 0xe9
je 0x401c41
add esi, eax
cmp esi, 0x1000
jb 0x401c02
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046df75
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 1]
mov ecx, dword [ebp - 4]
lea eax, [eax + edi + 5]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046df75
mov esp, ebp
pop ebp
ret

Function at 0x4030d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x51f620]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x529868], 0
jne 0x403194
cmp byte [0x529869], 0
mov al, 1
mov byte [0x529868], al
jne 0x40310d
push 0x5294c0
mov byte [0x529869], al
call fcn.017c835b
call fcn.00402790
call fcn.004031b0
mov dword [0x529864], eax
mov al, 0x73
mov cl, 0x65
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x20]
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xc], cl
mov byte [ebp - 0x15], cl
mov dl, 0x6f
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1e], 0x57
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x1c], 0x77
mov byte [ebp - 0x1b], 0x36
mov byte [ebp - 0x1a], 0x34
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x12], 0
push edx
call fcn.00699144
push eax
push esi
call fcn.0056efea
mov dword [0x529860], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046df75
mov esp, ebp
pop ebp
ret
Function at 0x4031b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x51f620]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0xf], al
mov byte [ebp - 0xc], al
mov byte [ebp - 0x23], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x24]
mov byte [ebp - 0x22], cl
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x18], cl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x76
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0
call fcn.005edfed
ret

Function at 0x42565b
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
xor ah, 0xdf
shl al, cl
setge ah
sub esp, 0xa8
mov eax, dword [0x51f620]
xor eax, ebp
jmp loc.006d8353

Function at 0x42abdc
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.00474a30
mov eax, dword [0x51f620]
ror cl, cl
shr cl, 0xeb
xor eax, esp
mov dword [esp + 0x1420], eax
seta dl
cmc
sal dl, 0x54
push ebx
and ax, sp
push esi
push edi
sal eax, cl
mov eax, dword [0x51f620]
xor eax, esp
push eax
cbw
lea eax, [esp + 0x1438]
rol dl, cl
mov dword fs:[0], eax
xor ebx, ebx
mov cl, 0x6f
mov al, 0x6a
mov byte [esp + 0x38f], al
mov byte [esp + 0x4d6], al
xor dl, cl
bt si, 0x42
mov byte [esp + 0x496], al
ror dl, 0x98
clc
mov al, 0x65
jmp loc.00533771
Function at 0x42ca60
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push esi
mov dword [edi], 0
call fcn.0042c9f0
mov ebx, eax
test ebx, ebx
jne 0x42ca93
mov dword [edi], 6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 0x20]
mov edx, dword [esi + 0x78]
push 0
push ecx
push edx
call fcn.00470fad
mov eax, dword [esi + 0x78]
mov ecx, dword [ebx + 0x28]
mov edx, dword [0x529924]
push eax
push 1
push ecx
push edx
call fcn.004714dd
mov ecx, dword [0x529b30]
push 0
lea eax, [esp + 0x2c]
push eax
mov eax, dword [0x529924]
mov dword [esp + 0x30], 0
mov edx, dword [ebx + 0x28]
push ecx
push edx
push eax
call fcn.004e25e0
add esp, 0x30
test eax, eax
jne 0x42cbea
mov ecx, dword [esp + 0xc]
cmp ecx, dword [ebx + 0x24]
jne 0x42cbea
mov eax, dword [0x529b30]
movzx esi, word [eax]
movzx edi, word [eax + 2]
xor eax, eax
push 0x2c
push eax
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call fcn.00473d70
add esp, 0xc
push 0
push 0
lea edx, [esp + 0x18]
push edx
mov eax, 0x18
mov word [esp + 0x2e], ax
push 0
mov ecx, 1
lea eax, [esp + 0x4c]
mov word [esp + 0x30], cx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
push eax
mov ecx, 0xa
lea esi, [esp + 0x28]
lea edi, [esp + 0x50]
mov dword [esp + 0x28], 0x28
mov dword [esp + 0x38], 0
push 0
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x28], 0
call fcn.017a1a6a
ret
mov dword [edi], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x439350
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Write file on windows

Disassembly:
jmp 0x43beaa
push ebp
bts bp, di
mov ebp, esp
push 0xfffffffffffffffe
rol al, 0x45
adc ax, 0x20b7
cwde
push 0x18c8720
shr eax, 0x4a
movsx eax, bx
push 0x474040
dec ax
mov eax, dword fs:[0]
cmc
cmp edx, esp
cmp ch, 0x9f
push eax
shl eax, 0xec
sub esp, 8
not ah
mov eax, 0x1e50
call fcn.00474a30
mov eax, dword [0x51f620]
clc
cmc
test cx, bx
xor dword [ebp - 8], eax
xor eax, ebp
jmp loc.018e4b8d

Function at 0x43beaa
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Write file on windows

Disassembly:
jmp 0x43beaa
push ebp
bts bp, di
mov ebp, esp
push 0xfffffffffffffffe
rol al, 0x45
adc ax, 0x20b7
cwde
push 0x18c8720
shr eax, 0x4a
movsx eax, bx
push 0x474040
dec ax
mov eax, dword fs:[0]
cmc
cmp edx, esp
cmp ch, 0x9f
push eax
shl eax, 0xec
sub esp, 8
not ah
mov eax, 0x1e50
call fcn.00474a30
mov eax, dword [0x51f620]
clc
cmc
test cx, bx
xor dword [ebp - 8], eax
xor eax, ebp
jmp loc.018e4b8d
Function at 0x450470
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x45055b
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4504a7
cmp dword [esi + 0x40], edi
jae 0x4504a7
push eax
call fcn.004507e1
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x4504bf
lea eax, [edi + edi]
push eax
call fcn.004507ec
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.00475dd0
add esp, 0xc
xor ebx, ebx
test edi, edi
jbe 0x450558
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x50f670]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x50f670]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x4504d7
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x45059a
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x45057f
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.00475dd0
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4505bc
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
push eax
call 0x6de9a4
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4dac60
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x4dac80
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x4dd1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x4dd3ad
call fcn.004dd206
Function at 0x534900
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Write file on windows

Disassembly:
jmp 0x60f89c
push 0x2827dcab
call fcn.005be457

Function at 0x536c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x536d8c
test eax, eax
je 0x536d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x551ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x536d73
lea edi, [eax + 4]
jmp 0x536cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x536cec
mov dword [ebp - 4], 2
jmp 0x536d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x536d03
mov dword [ebp - 4], 1
jmp 0x536d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x536d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x536d46
mov byte [ecx], 0x3d
jmp 0x536d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x536d5d
mov byte [ecx], 0x3d
jmp 0x536d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x536cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x61bfb0
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
stc
cmp esp, edi
sub eax, 0x445f5044
xor ebx, eax
add edi, eax
jmp 0x70cf83
push eax
push ebx
push ecx
cwde
lahf
push edi
push esi
movzx bx, al
mov eax, esi
push ebp
xchg ebp, ebx
sets ch
push edx
pushfd
inc al
shl ah, cl
mov ecx, 0
push ecx
mov esi, dword [esp + 0x28]
clc
xchg bh, bh
not esi
bswap esi
cwde
bts edx, esp
and dh, ah
sub esi, 0x26ad5ce4
rcr bp, 0x70
rol esi, 2
rdtsc
test eax, 0x5a77428a
xadd edx, ebp
lea esi, [esi + 0x4ea82fde]
movsx eax, bp
add esi, ecx
shl edx, 0x7e
btr ebp, 0x44
mov ebp, esp
cmovp ebx, edx
sar bx, 0xb4
lea esp, [esp - 0xc0]
clc
movsx edx, cx
mov di, bx
mov ebx, esi
rdtsc
mov edx, 0
adc eax, 0x110a2543
rcl al, cl
sub ebx, edx
movzx eax, sp
shr ah, cl
sal edi, 0x85
lea edi, [0x61c03a]
bt eax, 0x18
mov eax, dword [esi]
jmp 0x18b2c36
jmp edi
add esi, 4
xor eax, ebx
clc
sub eax, 0x20143054
rol eax, 2
test edx, 0x5677738a
cmc
clc
not eax
jmp 0x5c98a2
Function at 0x6c52c6
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dl, 0xc2
bsr eax, ebp
and esp, 0xfffffff8
push 0xffffffffffffffff
lahf
jmp 0x179ef60
push 0x4e5798
movsx eax, bx
movsx ax, al
mov eax, dword fs:[0]
jmp 0x18e8825
push eax
push ecx
mov ax, 0x735c
cmovg ax, ax
lahf
mov eax, 0x1424
jmp loc.0042abdc

Function at 0x71d6d9
Capabilities:
Execute anti-debugging instructions
Read file on windows
Write file on windows

Disassembly:
push ebx
push esi
push edi
test di, di
push eax
btr ax, 0x6b
movzx ax, bl
lea eax, [ebp - 0xc]
jmp 0x76a970
push ebp
mov ebp, esp
setge al
push 0xffffffffffffffff
push 0x4e54d2
mov eax, dword fs:[0]
push eax
mov eax, 0x1054
call fcn.00474a30
mov eax, dword [0x51f620]
test eax, 0x58fd53ca
xor eax, ebp
cmp bx, 0xa4
clc
mov dword [ebp - 0x10], eax
cmc
jmp 0x60d38c
push ebx
jmp 0x77ace9
call fcn.0064ba57
test eax, eax
jmp 0x1788b66
mov dword fs:[0], eax
bts ax, cx
mov ah, 0x61
mov eax, dword [0x52af98]
test ax, bp
stc
sub ebx, ebx
jmp 0x7494ae
push eax
jmp 0x75f89c
je 0x185793f
mov ecx, dword [0x529d70]
cmp ecx, ebx
jmp loc.0043fca4
call fcn.0046df75
mov esp, ebp
xchg bp, bp
pop ebp
jmp 0x183ba02
ret
mov ecx, dword [ebp - 0xc]
not esi
test dh, ah
mov dword fs:[0], ecx
sbb ebx, ebp
xchg di, di
xor cl, 0x78
pop ecx
adc edi, eax
rcr bh, 0x23
pop edi
pop esi
clc
test dx, sp
bswap cx
pop ebx
mov ecx, dword [ebp - 0x10]
test di, 0x763e
xor ecx, ebp
jmp 0x178e153

Function at 0x746c8d
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
jmp 0x189a7e1
mov eax, dword [0x51f620]
xor eax, ebp
clc
test esi, ecx
mov dword [ebp - 4], eax
clc
cmc
cmp dword [ebp + 0x10], 0
jmp loc.0040b74d
lea esp, [esp - 0x11c]
or ax, bp
setl al
jmp 0x1773fcf