joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fc80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
jae 0x45fce0
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045f080
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x45fdd5
cmp esi, edi
jne 0x45fcee
mov eax, 0x1001
jmp 0x45fdd5
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 0x10]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0045f080
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
add edi, eax
add esp, 0xc
sub dword [ebp - 4], edx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00461510
mov ecx, dword [ebx + 0x28]
xor dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x2c]
xor dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x30]
xor dword [ebx + 0x20], edx
mov ecx, dword [ebx + 0x34]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
add esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jb 0x45fdab
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00461510
mov ecx, dword [edi]
xor dword [ebx + 0x18], ecx
mov eax, dword [edi + 4]
xor dword [ebx + 0x1c], eax
mov edx, dword [edi + 8]
xor dword [ebx + 0x20], edx
mov ecx, dword [edi + 0xc]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
jae 0x45fd5d
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.0045f080
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45ff30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, dword [esp + 4]
mov esi, dword [ebx + 0x38]
mov edx, 0x10
lea eax, [ebx + 0x3c]
mov dword [ecx], edx
lea edx, [ebx + 0x18]
call fcn.00461510
xor ecx, ecx
mov eax, dword [esp]
mov edx, eax
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x45ff73
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x45ff65
mov eax, dword [esp + 4]
mov dword [eax], esi
xor eax, eax
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x46035c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
ja 0x4603bc
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045f080
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x46049e
cmp edi, esi
jne 0x4603ca
mov eax, 0x1001
jmp 0x46049e
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045f080
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
add edi, edx
add esp, 0xc
sub dword [ebp - 4], ecx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00461510
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x460474
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00461510
mov edx, dword [edi]
xor edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [edi + 4]
xor ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [edi + 8]
xor eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
xor edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
ja 0x460432
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.0045f080
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4604a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov esi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
ja 0x460508
mov ecx, dword [ebp - 4]
push ecx
push esi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045f080
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x460619
cmp esi, edi
jne 0x460516
mov eax, 0x1001
jmp 0x460619
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push ecx
push esi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045f080
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
add esi, edx
add esp, 0xc
sub dword [ebp - 4], ecx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00461510
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [edi + 0xc], ecx
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
mov dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
mov dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x24], eax
add edi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jbe 0x4605ef
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00461510
mov ecx, dword [ebx + 0x18]
xor ecx, dword [esi]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [esi + 4]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [esi + 8]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [esi + 0xc]
mov dword [edi + 0xc], ecx
mov eax, dword [esi]
mov dword [ebx + 0x18], eax
mov edx, dword [esi + 4]
mov dword [ebx + 0x1c], edx
mov ecx, dword [esi + 8]
mov dword [ebx + 0x20], ecx
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add esi, eax
mov ecx, dword [ebp - 4]
add edi, eax
cmp ecx, dword [ebp - 0xc]
ja 0x460596
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push esi
push edx
call fcn.0045f080
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4607c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov dword [esp], ecx
mov edi, edx
mov edx, dword [esp]
mov esi, dword [ebx + 0x38]
lea eax, [ebx + 0x3c]
mov dword [edx], esi
lea edx, [ebx + 0x18]
call fcn.00461510
xor ecx, ecx
mov edx, edi
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x4607f7
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x4607e9
mov eax, dword [esp]
mov dword [eax], esi
xor eax, eax
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x46a604
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00404c6c
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call fcn.00403640
push 0
push edi
lea eax, [ebp - 0x105]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.00409e80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x53794468
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x54667a5a
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x21416c2c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x326d0f43
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10005071
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push 0x50
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10005161
xor ecx, ecx
mov dword [esi + 8], 0x100151b0
mov dword [esi + 0xc], ecx
xor eax, eax
mov dword [esi + 0x10], ecx
inc eax
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 4], eax
mov dword [esi], 0x400
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x24], 7
mov dword [esi + 0x28], 0x100151b8
mov dword [esi + 0x20], 0x2000
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov ecx, 0x10003324
call 0x10020e4a
test eax, eax
jne 0x1000514d
mov ecx, 0x1000333c
call 0x10020e4a
test eax, eax
jne 0x1000514d
mov ecx, 0x10003354
call fcn.10004f40
test eax, eax
jne 0x1000514d
mov ecx, 0x1000336c
call fcn.10004f40
test eax, eax
jne 0x1000514d
mov ecx, 0x1000337c
call fcn.10004f40
test eax, eax
jne 0x1000514d
mov ecx, 0x10003394
call fcn.10004f40
test eax, eax
je 0x10005136
or dword [esi + 0x44], 0x1000000
jmp 0x10005154
mov ecx, 0x100033b0
call fcn.10004f40
test eax, eax
je 0x10005154
or dword [esi + 0x44], 0x10000
jmp 0x10005154
or dword [esi + 0x44], 0x100000
push esi
push dword [0x100151dc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
lea eax, [esi - 0x7ff8fff2]
pop esi
ret

Function at 0x10005310
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100151d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [0x100151dc]
mov dword [ebp - 0x18], esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10005352
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x100053e2
push ebx
push dword [0x100151dc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 0x40]
mov eax, dword [ebp + 0xc]
sub eax, edi
je 0x1000538b
sub eax, 1
je 0x1000537f
sub eax, 1
jne 0x100053df
push dword [ebp + 8]
mov ecx, ebx
call fcn.100063c3
jmp 0x10005387
push dword [ebp + 8]
call fcn.10006348
mov edi, eax
jmp 0x100053df
push 1
push 0x10
push esi
mov esi, dword [0x100156d0]
mov ecx, esi
call dword [0x10016308]
call esi
mov esi, eax
lea edi, [ebp - 0x14]
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100061d5
push eax
call sym.OLETHK32.dll_TransformHRESULT_3216
mov esi, dword [0x100156d0]
mov edi, eax
push 1
push 0x10
push dword [ebp - 0x18]
mov ecx, esi
call dword [0x10016308]
call esi
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100132f0
leave
ret 0xc
Function at 0x1001231b
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x100151d4]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x24]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.100116bb
push 0x10004bb4
lea ecx, [esp + 0x1c]
call fcn.10011617
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x1001239b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x100123d1
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xc0
call fcn.1001204a
mov edi, eax
jmp 0x100123d1
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call 0x10020e4a
mov ebx, eax
test ebx, ebx
jns 0x100123c3
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xc6
call fcn.1001202b
mov edi, ebx
jmp 0x100123d1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x100123db
push esi
call fcn.100120a4
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100132f0
mov esp, ebp
pop ebp
ret 8

Function at 0x10013500
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1001353e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10013536
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10013540
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10013526
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10013610
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10013641
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10013641
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x10013641
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x42efa0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42efa6
ret

Function at 0x43ada8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43af59
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404884
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x43af70
call fcn.004044e0
mov eax, ebx
call fcn.0041fd80
mov edi, eax
dec edi
test edi, edi
jl 0x43ae60
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041fd54
mov edx, dword [0x43e934]
call fcn.00403554
test al, al
je 0x43ae5c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041fd54
lea edx, [ebp - 0x14]
call fcn.0045d6d0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404884
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404554
inc esi
dec edi
jne 0x43ae0e
mov al, byte [0x43af74]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43af80
mov eax, dword [ebp - 0xc]
call fcn.0040dc40
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404250
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0045d6d0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43af70
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0045d6d0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43af70
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43af70
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x43af8c
call fcn.00409c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43af60
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004041dc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004041dc
lea eax, [ebp - 0x14]
call fcn.004041b8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004041dc
ret
Function at 0x483960
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4839fe
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x4aaef4]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x4aaef4]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x4aaef4]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4aaef4]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x48397f
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x483a14
dec edx
je 0x483a49
jmp 0x483a9a
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4aaef4]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x4aaef4]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x483a9a
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4aaef4]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x4aaef4]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x4aaef4]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4848ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4848cc
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4848ba
pop edi
pop esi
pop ebx
ret
Function at 0x485c50
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor edx, edx
push ebp
push 0x485e18
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
call fcn.00404494
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, dword [ebp - 4]
call fcn.00404820
mov eax, esi
call fcn.00404494
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x485d9b
mov ebx, 1
mov eax, esi
call fcn.00404494
lea edx, [ebx + ebx*2]
cmp eax, edx
jge 0x485cde
mov eax, esi
call fcn.00404494
mov ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
sub ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [ebp - 7]
call fcn.004028d8
jmp 0x485cf4
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [ebp - 7]
mov ecx, 3
call fcn.004028d8
mov al, byte [ebp - 7]
mov edx, eax
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov ecx, 0x485e3c
mov dl, byte [ecx + edx]
mov byte [ebp - 0xb], dl
and al, 3
and eax, 0xff
shl eax, 4
mov dl, byte [ebp - 6]
and dl, 0xf0
and edx, 0xff
shr edx, 4
or eax, edx
mov edx, 0x485e3c
mov al, byte [edx + eax]
mov byte [ebp - 0xa], al
mov dl, byte [ebp - 6]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov al, byte [ebp - 5]
mov ecx, eax
and cl, 0xc0
and ecx, 0xff
shr ecx, 6
or edx, ecx
mov ecx, 0x485e3c
mov dl, byte [ecx + edx]
mov byte [ebp - 9], dl
and al, 0x3f
and eax, 0xff
mov edx, 0x485e3c
mov al, byte [edx + eax]
mov byte [ebp - 8], al
mov eax, dword [ebp - 4]
call fcn.004046ec
mov edx, ebx
dec edx
shl edx, 2
lea edx, [eax + edx]
lea eax, [ebp - 0xb]
mov ecx, 4
call fcn.004028d8
inc ebx
dec edi
jne 0x485cac
mov eax, esi
call fcn.00404494
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x485de1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404494
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004046ec
mov byte [eax + ebx - 2], 0x3d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404494
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004046ec
mov byte [eax + ebx - 1], 0x3d
jmp 0x485e0e
mov eax, esi
call fcn.00404494
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x485e0e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404494
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004046ec
mov byte [eax + ebx - 1], 0x3d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x485e2a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret