joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x429703
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not edx
not edx
mov eax, 0
cld
clc
nop
cld
not ebp
not ebp
cld
dec esp
inc esp
cld
push eax
nop
sahf
wait
mov ch, ch
not dh
not dh
imul eax, eax, 0x10
stc
xchg dword [esp], eax
jmp 0x4295b6
add al, dl
lea edx, [edx + ebx]
sub cl, 0x31
push dword [edx + 0x20]
pop esi
lea esi, [ebx + esi]
jmp 0x42972c
cmp dh, 0x94
add esi, ebx
clc
ret 4
sahf
cmc
sub dword [esp], eax
cld
movzx eax, byte [edi]
sub edi, 0xffffffff
jmp 0x4297b3
mov edi, dword [edx + 0x1c]
cmp eax, 0xffffffa2
not eax
adc eax, 0xe68ae329
mov eax, 0x334a8761
cmp ah, 2
mov esi, dword [edx + 0x24]
dec dh
cld
add esi, ebx
xchg edx, edx
movzx eax, word [esi + ecx*2]
jmp 0x429671
mov dl, dh
add edi, ebx
mov esi, dword [edi + eax*4]
jmp 0x4295ad
lea ecx, [ecx]
not esi
not esi
not bl
not bl
jne 0x4250d3
xchg edx, edx
xchg edx, edx
lea ecx, [ecx]
xor eax, 0x69521502
jmp 0x4298e8
ret
push dword [ebx + 0x3c]
mov edx, ecx
cmp cl, 0xb8
xchg ecx, edi
xchg ecx, esi
nop
lahf
cld
sbb al, bl
pop eax
mov edi, ecx
mov edx, dword [eax + ebx + 0x78]
jmp 0x4294cc
add ecx, 1
cmp edi, 0xffffffa9
lodsd eax, dword [esi]
jmp 0x42979e
push 0xffffffffffffffff
xchg ah, al
cmp ah, dl
xchg edi, edi
not al
mov edi, esi
and al, dh
pop ecx
jmp 0x429720
lea edi, [eax + ebx]
xchg edx, ebp
xchg edx, ebp
cmp ecx, dword [edx + 0x18]
je 0x429700
jmp 0x4250be
sub dword [esp], eax
pop eax
test byte [edi], 0xff
jmp 0x429697
nop
sub eax, dword [esp + 4]
jne 0x429720
jmp 0x429617
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, reloc.user32.dll_GetWindowDC
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4056c3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43be50]
jne 0x4056cd
repz ret
jmp fcn.0040921b

Function at 0x40b56f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004057e6
and dword [ebp - 4], 0
cmp dword [0x43de28], 0
mov ebx, eax
jne 0x40b620
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b6d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b6d1
push eax
call fcn.00405774
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43de28], eax
call esi
push eax
call fcn.00405774
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43de2c], eax
call esi
push eax
call fcn.00405774
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43de30], eax
call esi
push eax
call fcn.00405774
pop ecx
mov dword [0x43de38], eax
test eax, eax
je 0x40b620
push 0x419434
push edi
call esi
push eax
call fcn.00405774
pop ecx
mov dword [0x43de34], eax
mov eax, dword [0x43de34]
cmp eax, ebx
je 0x40b678
cmp dword [0x43de38], ebx
je 0x40b678
push eax
call fcn.004057ef
push dword [0x43de38]
mov esi, eax
call fcn.004057ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b678
test edi, edi
je 0x40b678
call esi
test eax, eax
je 0x40b66f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b66f
test byte [ebp - 0xc], 1
jne 0x40b678
or dword [ebp + 0x10], 0x200000
jmp 0x40b6b1
mov eax, dword [0x43de2c]
cmp eax, ebx
je 0x40b6b1
push eax
call fcn.004057ef
pop ecx
test eax, eax
je 0x40b6b1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b6b1
mov eax, dword [0x43de30]
cmp eax, ebx
je 0x40b6b1
push eax
call fcn.004057ef
pop ecx
test eax, eax
je 0x40b6b1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43de28]
call fcn.004057ef
pop ecx
test eax, eax
je 0x40b6d1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b6d3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415e3c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x43b8e4], 0
mov byte [0x43b8e8], 0
mov dword [0x43b8e0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x415f25
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x43b8ec], 0
mov edx, dword [0x43b8e4]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x43b8ec], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x43b8e4], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x43b8e8], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x43b8e8]
mov edx, dword [0x43b8e4]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x43b8e0]
add edx, 1
mov dword [0x43b8e0], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x415e7c
jmp 0x415f4d
xor eax, eax
mov dword [0x43b8e0], 0
mov dword [ebp - 0x20], eax
jmp 0x415e7c
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x43b8e0]
add eax, 1
mov dword [0x43b8e0], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x415f25
jmp 0x415f11
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x416188
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [0x43b8dc], 0x262f
mov dword [0x43b8d8], 0x1063
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x4161b6
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x418b90]
mov dh, byte [eax + 0x418b61]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x4161b6
lea eax, [ebp - 0x24]
mov dword [0x43b8dc], 0xe2
mov dword [ebp - 0x34], eax
call fcn.00416f79
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.00416d82
mov dword [0x43b8d8], 0x14e9
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x4162c4
mov eax, dword [ebp - 0x38]
mov dword [0x43b8d8], 0x58d
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.00415c77
xor eax, eax
mov dword [0x43b8dc], 0x158b
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x43b8d8], 0x177f
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x28], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x10], ecx
add ecx, 0x1000
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x4162bb
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x4162cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov ecx, dword [0x43b8d8]
add ecx, 0xfffff274
mov dword [0x43b8d8], ecx
mov dword [ebp - 0x10], eax
call fcn.004165a2
xor ecx, ecx
mov edx, eax
mov dword [0x43b8dc], 0x184
mov esi, dword [eax + 0x3c]
mov dword [0x43b8d8], 0xffffc88c
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x43b8d8], 0xb
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x41643b
jmp 0x416372
mov eax, dword [ebp - 0x2c]
add eax, 1
mov cl, byte [ebp - 0x2d]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x2e]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x34], eax
jne 0x4163bc
jmp 0x4163e9
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x38], eax
xor eax, eax
mov ecx, 0xb
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
xor esi, esi
add ecx, 0xfffff274
mov edi, dword [ebp - 0x24]
mov ebx, dword [edi + edx*4]
mov dword [0x43b8d8], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x34]
mov ecx, eax
mov edx, dword [ebp - 0x4c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], bh
mov byte [ebp - 0x2e], cl
jne 0x416348
mov al, byte [ebp - 0x2e]
test al, 1
jne 0x416422
jmp 0x4163f2
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 2
mov edx, dword [ebp - 0x50]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov edi, dword [ebp - 0x54]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x28], eax
jb 0x416390
jmp 0x41643b
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x416446
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x43b8e0], 0
mov dword [0x43b8e4], 0
mov dword [0x43b8f0], 0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x41659a
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add eax, 1
mov edi, edx
add edi, 1
mov dword [ebp - 0x2c], edx
cdq
idiv esi
mov dword [0x43b8e0], edx
mov ebx, dword [0x43b8d8]
add ebx, 0xfffff3fd
mov dword [0x43b8d8], ebx
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x43b8e4], edx
mov dword [0x43b8d8], 0x1051
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x30]
mov cl, byte [ecx + esi]
mov byte [0x43b8e8], cl
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x43b8e8]
mov edx, dword [0x43b8e4]
mov byte [ebx + edx], cl
mov dword [0x43b8d8], 0x60d
mov edx, dword [0x43b8e0]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x43b8e4]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x43b8d8], 0x1495
and ecx, 0xff
mov dword [0x43b8f0], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
mov ch, byte [edx + esi]
mov dword [0x43b8d8], 0x97a
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x34], edi
je 0x41659a
mov eax, dword [0x43b8e4]
mov ecx, dword [0x43b8e0]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], ecx
jmp 0x41649f
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4169b8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x80]
lea ecx, [esp + 0x28]
mov dword [0x43b8d8], 0x1517
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.004159ba
lea ecx, [0x41696d]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x44], edx
mov edx, dword [0x43b8dc]
mov dword [esp + 0x68], 0x12d200
mov esi, dword [0x43b8c4]
mov dword [esp + 0x34], esi
mov esi, dword [0x43b8c8]
mov dword [esp + 0x60], esi
add edx, 0xfffffc43
mov dword [0x43b8d8], edx
mov edx, dword [0x43b8cc]
mov dword [esp + 0x2c], edx
mov edx, dword [0x43b8d0]
mov dword [esp + 0x48], edx
mov edx, dword [0x43b8d4]
mov dword [esp + 0x54], edx
mov dword [0x43b8dc], 0xffffe615
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x416a89
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00416188
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0x18], eax
jmp 0x416b16
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x416abc
mov eax, dword [esp + 0x14]
add eax, 0x3c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
cmp dword [edx + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x416ad8
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x416a89
mov eax, dword [esp + 0x14]
mov dword [esp + 0x64], eax
mov dword [0x43b8dc], 0x184
mov dword [0x43b8d8], 0xffffc88c
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x40], edx
call fcn.00416c62
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
je 0x416a57
mov eax, dword [esp + 0x18]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x416c62
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x43b8dc], 0x2149
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x43b8d8], 0x817
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x416ce3
mov eax, 1
mov dword [0x43b8d8], 0x1d5c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
jne 0x416d78
mov eax, dword [ebp - 0x18]
add esp, 0x20
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x416d24
jmp 0x416d78
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x416d10
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x416ce3
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x416ccf
jmp 0x416d78
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x416d78
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x416d78
mov dword [0x43b8d8], 0x24e4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x416d78
mov dword [0x43b8d8], 0x4cc
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x416ca2
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x416cc7
Function at 0x4195ec
Capabilities:
Terminate process

Disassembly:
call fcn.004195f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x50cbb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.MIZwSMcb
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x50cbd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50cbd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50cbc8
mov eax, 1
add ebx, ebx
jne 0x50cbeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50cbe0
jne 0x50cbfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50cbe0
xor ecx, ecx
sub eax, 3
jb 0x50cc10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50cc82
mov ebp, eax
add ebx, ebx
jne 0x50cc1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50cc28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50cc4c
inc ecx
add ebx, ebx
jne 0x50cc38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50cc2d
jne 0x50cc49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50cc2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50cc6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50cc5d
jmp 0x50cbce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50cc6c
add edi, ecx
jmp 0x50cbce
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50cccb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50cc89
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50ccc5
mov dword [ebx], eax
add ebx, 4
jmp 0x50cca6
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50ccff
sub esp, 0xffffff80
jmp section.ukiwGhLB
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.hhe7koex]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.hhe7koex]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.hhe7koex]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.hhe7koex]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.hhe7koex]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.hhe7koex]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0
mov dword [esp], 0
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 4], 0x40e000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x401c23
jmp 0x401bc1
mov eax, 0
jmp 0x401c23
test byte [edi + 0xc], 0x10
jne 0x401c00
inc ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x401bba
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [eax + ebx - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test byte [edi + 0xc], 0x10
je 0x401bc7
lea eax, [ebx - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401b44
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret