joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ec4b856
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6ec4b8a8
jmp 0x6ec4b8e9
jmp 0x6ec4b92a
jmp 0x6ec4b96b
jmp 0x6ec4b9ac
jmp 0x6ec4b9ed
jmp 0x6ec4ba2e
jmp 0x6ec4ba6f
jmp 0x6ec4bab0
jmp 0x6ec4baf1
jmp 0x6ec4bb32
jmp 0x6ec4bb73
jmp 0x6ec4bbb4
jmp 0x6ec4bbf5
jmp 0x6ec4bc36
jmp 0x6ec4bc77
jmp 0x6ec4bcb8
jmp 0x6ec4bcf9
jmp 0x6ec4bd3a
jmp 0x6ec4bd7b
jmp 0x6ec4bdbc
jmp 0x6ec4bdfd
jmp 0x6ec4be3e
jmp 0x6ec4be7f
jmp 0x6ec4bec0
jmp 0x6ec4bf01
jmp 0x6ec4bf42
jmp 0x6ec4bf83
jmp 0x6ec4bfc4
jmp 0x6ec4c005
jmp 0x6ec4c046
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6ec4c08d
jmp 0x6ec4c0ce
jmp 0x6ec4c10f
jmp 0x6ec4c150
jmp 0x6ec4c191
jmp 0x6ec4c1d2
jmp 0x6ec4c213
jmp 0x6ec4c254
jmp 0x6ec4c295
jmp 0x6ec4c2d6
jmp 0x6ec4c317
jmp 0x6ec4c358
jmp 0x6ec4c399
jmp 0x6ec4c3da
jmp 0x6ec4c41b
jmp 0x6ec4c45c
jmp 0x6ec4c49d
jmp 0x6ec4c4de
jmp 0x6ec4c51f
jmp 0x6ec4c560
jmp 0x6ec4c5a1
jmp 0x6ec4c5e2
jmp 0x6ec4c623
jmp 0x6ec4c664
jmp 0x6ec4c6a5
jmp 0x6ec4c6e6
jmp 0x6ec4c727
jmp 0x6ec4c768
jmp 0x6ec4c7a9
jmp 0x6ec4c7ea
jmp 0x6ec4c82b
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6ec4c886
jmp 0x6ec4c8c7
jmp 0x6ec4c908
jmp 0x6ec4c949
jmp 0x6ec4c98a
jmp 0x6ec4c9cb
jmp 0x6ec4ca0c
jmp 0x6ec4ca4d
jmp 0x6ec4ca8e
jmp 0x6ec4cacf
jmp 0x6ec4cb10
jmp 0x6ec4cb51
jmp 0x6ec4cb92
jmp 0x6ec4cbd3
jmp 0x6ec4cc14
jmp 0x6ec4cc55
jmp 0x6ec4cc96
jmp 0x6ec4ccd7
jmp 0x6ec4cd18
jmp 0x6ec4cd59
jmp 0x6ec4cd9a
jmp 0x6ec4cddb
jmp 0x6ec4ce1c
jmp 0x6ec4ce5d
jmp 0x6ec4ce9e
jmp 0x6ec4cedf
jmp 0x6ec4cf20
jmp 0x6ec4cf61
jmp 0x6ec4cfa2
jmp 0x6ec4cfe3
jmp 0x6ec4d024
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6ec4d06e
jmp 0x6ec4d0af
jmp 0x6ec4d0f0
jmp 0x6ec4d131
jmp 0x6ec4d172
jmp 0x6ec4d1b3
jmp 0x6ec4d1f4
jmp 0x6ec4d235
jmp 0x6ec4d276
jmp 0x6ec4d2b7
jmp 0x6ec4d2f8
jmp 0x6ec4d339
jmp 0x6ec4d37a
jmp 0x6ec4d3bb
jmp 0x6ec4d3fc
jmp 0x6ec4d43d
jmp 0x6ec4d47e
jmp 0x6ec4d4bf
jmp 0x6ec4d500
jmp 0x6ec4d541
jmp 0x6ec4d582
jmp 0x6ec4d5c3
jmp 0x6ec4d604
jmp 0x6ec4d645
jmp 0x6ec4d686
jmp 0x6ec4d6c7
jmp 0x6ec4d708
jmp 0x6ec4d749
jmp 0x6ec4d78a
jmp 0x6ec4d7cb
jmp 0x6ec4d80c
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6ec4d866
jmp 0x6ec4d8a7
jmp 0x6ec4d8e8
jmp 0x6ec4d929
jmp 0x6ec4d96a
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ds
sbb edx, dword [ecx]
adc dl, byte [ebx]
sbb edx, dword [edx + 0x19461703]
sbb dl, byte [eax - 0x6f6f6f70]
nop
nop
nop
nop
nop
nop
sbb dword [eax - 0x1374aa70], edx
push ebp
mov ebp, esp
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push eax
add ecx, 0xffffffea
movsd dword es:[edi], dword [esi]
je 0x401735
inc eax
add byte [ecx - 1], dl
adc eax, 0x22e79683
mov eax, dword [0x902ac]
add esp, 0xffffffbf
in al, 0xc0
and ecx, dword [edi]
push eax
push 0x40ca44
call dword [0xef40c164]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop

Function at 0x405d20
Capabilities:
Accept command line arguments

Disassembly:
dec esi
fcomp dword [edi - 0x48]
jl 0x405d1a
add dword [eax], eax
mov byte [edx], cl
pop esi
pop ebp
ret 0x1e10
mov ebp, 0x90909090
nop
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00407820
test eax, eax
jne 0x405e30
or byte [0x1e4108dc], bh
adc al, 0xf
mov esi, gs
add byte [eax], al
add byte [ecx + 0x410384], ah
test eax, eax
jne 0x405dce
invalid
add esp, 0xc
push dword fs:[ebp + ebp - 0x73]
xor al, 0xa0
add al, 0
add byte [eax], al
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [edi], eax
call dword [0x400524]
mov edi, dword [edi]
mov ecx, esi
mov esi, dword [eax]
add cl, dl
shr ecx, 0xff
rep movsd dword es:[edi], dword [esi]
retf 0x83ca
push 0x58
mov esp, ebp
pop ebp
ret 0xc

Function at 0x407d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sbb dword [esi], 0x58
push esi
lea eax, [ebp - 0x58]
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 4]
push ebp
mov eax, dword [ebp + 0xc]
lea ebx, [edi + 0xc]
push ecx
mov ecx, dword [ebp + 8]
and al, 0x57
push eax
push ecx
loop 0x407dbd
add dword [eax], eax
add byte [ebp + ecx*2 - 4], dh
pop ecx
push ebp
adc al, 0x83
les ebx, [eax]
mov dword [ebp - 8], eax
or cl, 0x8b
bnd je 0x407d78
mov byte [edx], 0x2d
sal byte [edx + 1], 1
out 0x4f, eax
mov bl, 0x53
test ecx, ecx
jle 0x407d74
xor dl, 1
xor byte [ebp + 6], dh
push es
dec ecx
test ecx, ecx
jg 0x407d65
mov dword [ebp + 0x10], edi
mov ebx, dword [ebp - 0x37]
test ebx, ebx
imul ecx, dword [esp + esi*4 + 0x23000099], 0x83cf2bcb
stc
add al, 0xf
invalid
fld xword [ecx - 0x74]
mov ah, 0x99
add byte [eax], al
and ecx, ebx
sub ecx, edi
cmp ecx, 4
jg 0x11c7e3c
invalid
ret 0x558b
Function at 0x7d82c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2de000]
push edi
or ebp, 0xffffffff
jmp 0x7d82e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7d82e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d82d8
mov eax, 1
add ebx, ebx
jne 0x7d82fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7d830c
jne 0x7d832b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d832b
dec eax
add ebx, ebx
jne 0x7d8318
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7d82f0
add ebx, ebx
jne 0x7d8327
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7d837d
xor ecx, ecx
sub eax, 3
jb 0x7d8343
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7d83b2
sar eax, 1
mov ebp, eax
jmp 0x7d834e
add ebx, ebx
jne 0x7d834e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d831c
inc ecx
add ebx, ebx
jne 0x7d835c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d831c
add ebx, ebx
jne 0x7d8369
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7d835e
jne 0x7d837a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7d835e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7d839c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7d838e
jmp 0x7d82de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7d839c
add edi, ecx
jmp 0x7d82de
pop esi
mov edi, esi
mov ecx, 0xe0d1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7d83ba
cmp byte [edi], 0xa0
jne 0x7d83ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7d83bf
lea edi, [esi + 0x3d4000]
mov eax, dword [edi]
or eax, eax
je 0x7d842e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41f978]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x41faa4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7d83ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x41faa8]
or eax, eax
je 0x7d8428
mov dword [ebx], eax
add ebx, 4
jmp 0x7d8409
call dword [esi + 0x41fab8]
mov ebp, dword [esi + 0x41faac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7d8462
sub esp, 0xffffff80
jmp 0x675374
Function at 0x425102
Capabilities:
Encode data using xor

Disassembly:
sbb cl, byte [edx]
pop edi
inc esi
invalid
mov ah, 0x50
or byte [ebx + edi*8 - 0x31], bh
bound eax, qword [edi - 0x21a878bc]
xchg dword [edi + eax*4 + 0x57], eax
fimul word [edx + 0x39]
mov ch, 0x82
jns 0x42516b
xchg dword [edi + eax*4 + 0x57], eax
fimul word [edx + 0x39]
mov ch, 0x82
jns 0x42516b
jnp 0x425187
jbe 0x425119
pop es
pop esi
add eax, 0xfbdd478c
jg 0x4250fb
loope 0x4250bc
mov eax, dword [0x2feb5b8b]
mov ebx, dword [ebx - 0x15]
das
lahf
dec ebp
std
movsb byte es:[edi], byte [esi]
jne 0x42519a
fstpnce st(7), st(0)
sub dh, byte [ecx - 0x76]
mov edi, eax
jg 0x425110
adc al, 0x48
inc ebp
mov dword [0x193e7228], eax
pop esi
sbb byte [ebp - 0x4dddce45], cl
sal bh, 0x64
adc dh, byte [edi - 0x4e]
adc dh, byte fs:[edi - 0x4e]
inc eax
xchg ecx, eax
enter 0x7f72, 0x66
ror dword [edx + 0x39364167], 0x90
sbb byte [edx + edx*2 - 0x60], bl
or ebx, dword [ebp - 8]
mov byte [0x31d76599], al
pop esi
cwde
jbe 0x4251aa
retf 0xed2f
adc ecx, dword [eax - 0x7e9441a0]
inc eax
mov bl, 0xbe
ja 0x425141
mov esi, 0x5bb6cb77
mov dh, 0x5b
dec edi
mov byte [eax + 0x68], dh
cmp byte [esi], 0xb2
push 0x340bacf
xchg dword [0xb995fac3], eax
mov byte [bx + 0x47], cl
ret 0xb70a
ret
stosb byte es:[edi], al
xor ebp, ebp
stosb byte es:[edi], al
mov cl, dl
sbb ebp, dword [ebx + 0x22]
invalid
adc bl, cl
mov byte [ebx - 0x4e], ch
nop
jl 0x425173
sub al, bl
outsd dx, dword [esi]
adc eax, 0x2b8893cd
stosb byte es:[edi], al
mov ebx, dword [eax + 0x1cdda6f4]
inc ebx
fstp qword [ebx + eax*2]
mov cl, 0x41
adc dh, byte [eax - 0x74]
pushal
inc byte [eax - 0x7b]
aas
pop ds
call dword [edi + 0x2e6cc37f]
xor ah, dh
mov edi, 0xf1132752
xchg esi, eax
out 0x18, al
xor dword [eax + ebp*4], ebx
xchg esp, eax
pop ebp
xchg esi, eax
inc eax
xchg esi, eax
popal
or al, ch
jg 0x4251bf
or eax, 0x9407ec34
xor cl, byte [ecx + 0x6d9c7723]
mov eax, dword [0x1dc896e4]
out dx, al
salc
ret 0x4c2f
Function at 0x426a02
Capabilities:
Encode data using xor

Disassembly:
pop ebx
mov dword [0x1a3216e2], eax
sub al, 0xb
sub dword [eax + 0x7c], esi
jo 0x4269bc
lodsb al, byte [esi]
mov esi, 0x47c033ad
jno 0x4269dd
cmp dword [edi - 0x338ac7], esp
std
int1
mov cl, 0x28
pop ebx
pop ecx
push cs
mov ebp, 0x4c260f1
cmp eax, 0xd0e5f005
out 0xb1, eax
add eax, 0x67304150
cmc
inc edx
popal
xor cl, byte [ecx - 0x50]
fadd st(7)
nop
popal
xchg ebp, eax
iretd
xor eax, 0xa51188bc
or dh, dl
jo 0x4269a7
stc
cdq
xchg ecx, eax
or dl, cl
mov al, byte [0x58a73d9e]
loope 0x426a17
call [ecx]
aam 0x2d
in al, dx
popal
out dx, al
jmp 0x58fb9d74
sbb esp, edx
sub eax, 0xe9ee61ec
push ecx
xor edi, dword [ecx - 0x5dcd1ca8]
adc esi, dword [eax + 0x21d9da5a]
push cs
xchg dword [esi - 0x72f798b7], eax
nop
push ds
push cx
mov ecx, 0x17f92a
imul ebp, esi, 0xd8cf4f5f
stosb byte es:[edi], al
xor eax, 0x849e9cc9
mov esp, 0x4c2cc5fa
cwde
jns 0x426aab
sbb edx, esi
cmp ecx, ecx
mov byte [ebx], cl
iretd
imul ebp, edx, 0x8e85f4b8
jge 0x426ab5
sbb edi, dword [eax]
clc
shr al, 0xfd
std
clc
inc ecx
sbb byte [eax - 0x3b47eef2], bh
js 0x426b2f
jge 0x426acf
xchg esp, eax
mov byte [ebx - 0x5f], 0x45
invalid
sub dl, byte [edx - 0x2c51a8f7]
pop ecx
out 0x33, eax
add eax, 0x23c58b7f
aam 0xf8
cwde
jo 0x426ab8
pop eax
mov ebx, 0x85f9ed58
invalid
and al, 6
jns 0x426b7c
adc bl, byte [edx + 0x2d]
iretd
inc eax
dec ecx
xchg edi, eax
mov ch, 0xfc
mov byte [0x3db01f4d], al
sub dword [edx + 8], edi
cmp dword [edi + 0x65], ebp
insd dword es:[edi], dx
neg esp
sbb dword [esi - 0x36], edi
loopne 0x426b2d
wait
leave
mov eax, 0x46a2c6e4
fstp qword [ebx - 0x42]
wait
inc edx
inc edi
xor ah, byte [esi + 0x3c8a2969]
invalid
Function at 0x43d31a
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [eax]
xchg esi, eax
cmp ah, byte [ecx + 0x57]
push esp
loopne 0x43d374
fnstsw word [edx + esi + 0x1f0976f0]
aam 0x77
insd dword es:[edi], dx
test eax, 0x940ee6f
fnstsw word [eax]
inc esp
wait
popal
popal
mov bl, 0xcc
movsd dword es:[edi], dword [esi]
mov ebp, es
sbb byte [ecx - 0x19], 0x6b
retf 0xa80c
invalid
sbb dword [esi - 0x48], edx
imul esi, dword [esi], 0xe14c1c30
jb 0x43d361
aad 0x25
insb byte es:[edi], dx
sub eax, 0xda683b30
jns 0x43d3e0
cli
dec ecx
jne 0x43d3f6
mov ebx, 0x11514194
mov bh, 0x9c
out dx, al
ficom dword [edi - 0x14]
imul edi, ebp, 0xffffffe8
loopne 0x43d3df
dec ebx
mov al, byte [0xcdefc775]
inc edi
cmp eax, 0x2f065201
aas
and eax, 0x77275fe6
test al, 0x10
mov eax, 0x6a4b4202
push ebp
cdq
add eax, 0x8dbc28a9
daa
fadd qword [ebx]
sub al, 0xd7
or al, byte [ecx - 0x67b96926]
aas
dec ecx
imul esi, dword [esi - 0x6cf5c565], 0xffffffcd
sbb dword [0xe0fb0fee], edx
test al, 0x5e
salc
sahf
xor eax, 0x317cfa1c
sbb al, 0xfa
cli
jl 0x43d414
daa
invalid
mov dl, 0x5f
aaa
sbb eax, 0x70c2b97b
adc esp, eax
bound eax, qword [ecx - 0x71]
pop dword [esi]
inc ecx
cdq
jnp 0x43d393
cwde
movsd dword es:[edi], dword [esi]
jb 0x43d462
loopne 0x43d3df
inc esi
pop ebp
mov dword [ecx - 0x433722d3], ebp
mov eax, 0x66ee540d
and eax, 0x94c8e91e
pop ds
nop
adc al, 0x33
imul eax, dword [ecx], 0x24bb94ec
mov dword [ebp - 0x3ef29fb6], ebp
test ebp, 0x6c7371a2
and ecx, eax
mov ebx, 0x29435462
sub eax, 0xb8bcc8dd
or eax, 0x2566ee54
push ds
jmp 0x906368ec
sar dword [esi], 0xbb
bound edx, qword [ebx + eax*2 + 0x29]
dec edx
cwde
ror dword [edi + 0x76], cl
jo 0x43d482
pop edx
test byte [esi], dl
push edx
test eax, 0xad230ead
aas
rcr byte [esi + 0xa], 0x5e
xor esi, dword [edx]
sahf
cld
push 0xd8b0f240
mov ds, edx
xchg edi, eax
invalid
xchg edi, eax
sbb ecx, dword [ebx + 0x7b6bd8c6]
int3
clc
leave
sub dh, byte [eax - 0x2a]
out dx, eax
loope 0x43d460
add bh, byte [eax + ebx]
test dword [ebx - 0x243ee48d], edi
mov al, byte [0xce802d94]
daa
xchg ebx, eax
fnsave dword [edx + 0x40]
lea edi, [eax]
pop edi
jb 0x43d439
inc eax
invalid

Function at 0x469b42
Capabilities:
Encode data using xor

Disassembly:
invalid
mov ecx, 0x79307930
jo 0x469b83
jno 0x469b84
xor dword [eax + 0x31], edi
js 0x469b42
mov eax, 0x7b32bbf2
xor bh, byte [ebx + 0x72]
xor bh, byte [ebx + 0x32]
jnp 0x469b89
jnp 0x469bcb
cmp esi, dword [ebx + 0x3a]
xor edi, dword [edx + 0x33]
jp 0x469b54
invalid
mov edi, 0x65374104
ja 0x469bd3
add al, 0x41
aaa
ja 0x469bd3
dec ecx
ja 0x469bf9
aaa
dec ebp
mov byte [esi + 0x6c], bh
mov esi, 0x7eecbe00
add al, 0x59
jo 0x469bd7
jno 0x469bf1
pop ecx
inc esp
add dword [esi + 0x5d], 0x4c474c4a
mov al, 0xd4
add byte [edx], ah
inc esp
invalid
push ecx
and byte [edi + 0x62], ch
jns 0x469b55
dec edi
mov byte [0x16cb17a9], al
test eax, 0x4216cb17
inc edx
mov cl, byte [edx + 0xc]
ret 0x5a8a
dec edx
iretd
push esp
sub eax, 0x8a0a89ce
outsd dx, dword [esi]
invalid
Function at 0x489f89
Capabilities:
Encode data using xor

Disassembly:
sbb edx, dword [edx - 0xe]
mov bh, 0xcf
adc esp, eax
outsd dx, dword [esi]
or eax, dword [esi - 0x68e0654f]
pop ds
pop esi
xor byte [ebx + 0x46], dh
mov ch, 0x8a
inc edx
adc byte [eax], cl
or dl, bh
mov cl, 0xa1
mov cl, 0xa6
push cs
outsb dx, byte [esi]
sub dh, dl
fdiv qword [eax - 0x26]
mov byte [esi + 0x2755b666], bh
xchg esi, eax
mov fs, word [ebp + 0x41]
test byte [esp + esi], cl
div al
fistp dword [ebx + eax*4 + 0x60]
or eax, 0x4f2f69e1
fdivr qword [eax + 0xd948dfd]
mov eax, 0xd948dfd
mov eax, 0xd948dfd
inc ecx
idiv dword [eax]
pop ebx
sub edi, 0xb440341
sub dword [esi + 0x5a], esp
pop edx
mov byte [ebx], cl
jg 0x489f4a
inc esi
invalid
Function at 0x627319
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x199e50ac
sub esp, dword [edx]
mov dl, 0x1e
cmp dword [ecx + 0x20fb706f], 0
dec ebp
inc edi
add dword [ecx], eax
or ebx, dword [ecx + eax]
add dword cs:[esi - 0x28], ebp
shl byte [ecx + eax + 0x32ad511], 0xe3
std
inc ebp
lds ecx, [eax + 0x21d43897]
rcl byte [ebp - 0x70], 0xf8
out dx, eax
xor eax, 0xf8d22c0f
clc
je 0x627356
xor eax, 0x9a87a615
stosd dword es:[edi], eax
sbb al, 0x20
cdq
pushal
dec edx
xchg ebp, eax
mov ebp, 0x38900738
jb 0x627330
jae 0x627332
in al, dx
ljmp 0x2ba8
adc bl, al
jge 0x627389
arpl bp, si
push ecx
loopne 0x6272d1
stosd dword es:[edi], eax
cmp al, 0x32
xchg edi, eax
int1
add ecx, dword [esi]
pop esp
cld
mov byte [ebp + 0x34], ah
sar ch, cl
jmp 0x627342
dec ecx
pop ebp
test al, 0x70
cdq
jnp 0x627342
sbb byte [eax], ch
mov byte [0x8e41a4de], al
mov ax, 0xb198
add al, 0xd3
add ebx, dword [eax]
std
mov fs, word [esi - 0x48]
cwde
mov cl, 4
rol dword [ebx], cl
sbb ch, bh
push ss
test ecx, 0x3625cd0f
xchg edi, eax
insb byte es:[edi], dx
lahf
mov bl, 0xe5
cmc
jno 0x627305
xchg edi, eax
push cs
jae 0x627381
cli
int3
lahf
cmp ebp, dword [ebx + 0x40]
lea ecx, [edx + 3]
rcr byte [esi - 0x1226fa86], 0x66
mov edi, 0x6be05479
in eax, dx
mov di, 0x5479
loopne 0x627407
sbb al, 0x4b
push es
sbb eax, 0x5fe34448
loop 0x627363
jne 0x627358
jecxz 0x627395
add eax, 0x598f61b3
adc ecx, dword [esi - 5]
test dword [ebp + 0x6d556c52], eax
mov al, byte [0x61bce86a]
xchg edi, eax
cmp eax, 0xa5e08c12
jns 0x62740a
lahf
enter 0x5e19, 0xffffffffffffffeb
jge 0x62742a
inc ebp
stosd dword es:[edi], eax
xor dh, bh
mov eax, dword [0x21a3f33c]
call 0x1082274c
and dword [edx], edx
sbb byte [ebx - 0x78], bl
sub ebp, dword [ecx*8 - 0x3030e24e]
sbb eax, 0x31043d50
sbb eax, 0x4537ad61
push esp
invalid
out dx, al
in al, dx
dec esp
test ah, cl
test ah, cl
mov esi, 0x9f85ab79
bound edi, qword [ebx - 0x60]
call 0xa583785a
and eax, eax
xor cl, byte [ecx + 0x33593ee5]
cwde
pop esp
xchg esp, eax
mov ah, 0x83
inc esi
xor ebx, dword [esi + 0x51]
push ecx
aas
outsb dx, byte [esi]
je 0x62740b
retf
Function at 0x405624
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x42c874]
or eax, eax
je 0x40562f
jmp eax
jmp 0x44ea07

Function at 0x405758
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x42c8a4]
or eax, eax
je 0x405763
jmp eax
jmp 0x445989

Function at 0x405bc8
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x42c94c]
or eax, eax
je 0x405bd3
jmp eax
push 0x405bb0
jmp 0x44c60d

Function at 0x405d3c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x42c988]
or eax, eax
je 0x405d47
jmp eax
jmp 0x44cd33

Function at 0x406e9c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x42cb1c]
or eax, eax
je 0x406ea7
jmp eax
jmp 0x446df0

Function at 0x4071a4
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x42cb7c]
or eax, eax
je 0x4071af
jmp eax
jmp 0x445948

Function at 0x4071ec
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x42cb88]
or eax, eax
je 0x4071f7
jmp eax
jmp 0x446b73

Function at 0x40738c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x42cbd0]
or eax, eax
je 0x407397
jmp eax
jmp 0x442ddc

Function at 0x40882c
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x42cc30]
or eax, eax
je 0x408837
jmp eax
jmp 0x44224a

Function at 0x409778
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x42cc40]
or eax, eax
je 0x409783
jmp eax
jmp 0x443cc3

Function at 0x411f00
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4032b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x214
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401c40
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
mov eax, dword [ebp + 8]
push eax
call fcn.00415830
mov edx, eax
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x40]
push ecx
call fcn.004115d0
mov edx, eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov dword [ebp - 4], 4
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
test eax, eax
jne 0x411fa6
jmp loc.00447a70
mov dword [ebp - 4], 7
push 0
push 0xffffffffffffffff
push 1
push 0x408114
push 0x40924c
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov edx, eax
lea ecx, [ebp - 0x30]
jmp loc.00447d75

Function at 0x4199f0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4032b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x2c
jmp loc.00445eaa

Function at 0x419a90
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4032b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x14
jmp loc.0044d00f
Function at 0x41a2b0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4032b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
jmp loc.0044263d

Function at 0x41a5a0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4032b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x4e0
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x402548
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x284]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
push 3
push 0x408078
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
push 0
push 0xf
call fcn.00405d3c
mov dword [ebp - 0x294], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x294]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0x280], 0x128
mov dword [ebp - 4], 5
lea edx, [ebp - 0x280]
push edx
lea eax, [ebp - 0x3c0]
push eax
push 0x405598
call dword [sym.imp.MSVBVM60.DLL___vbaRecUniToAnsi]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00405d84
mov dword [ebp - 0x294], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea edx, [ebp - 0x3c0]
push edx
lea eax, [ebp - 0x280]
push eax
push 0x405598
call dword [sym.imp.MSVBVM60.DLL___vbaRecAnsiToUni]
mov ecx, dword [ebp - 0x294]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 6
mov dword [ebp - 0x50], 0x1f4
mov dword [ebp - 4], 7
push 0x104
call dword [sym.imp.MSVBVM60.DLL_rtcSpaceBstr]
mov edx, eax
lea ecx, [ebp - 0x24]
jmp loc.0044f917

Function at 0x41e9d0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4032b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x24
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
jmp loc.0044625a