joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4046d0
Capabilities:
Set registry value

Disassembly:
push 4
mov eax, 0x4060b1
call fcn.00405b08
push dword [ebp + 8]
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
call fcn.00404475
mov dword [ebp - 4], ebx
lea ecx, [ebp + 8]
push ebx
push ecx
push ebx
push 0x20206
push ebx
push ebx
push ebx
push dword [eax]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402b02
test esi, esi
jne 0x404740
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 3
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
neg eax
sbb al, al
lea ebx, [eax + 1]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.00405ae2
ret 0xc

Function at 0x40474a
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x407014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x40476c
xor al, al
jmp 0x404884
mov eax, dword [esi + 4]
push ebx
xor ebx, ebx
mov dword [ebp - 0xd0], 0xe0
mov dword [ebp - 0xcc], eax
cmp dword [eax + 0xc0], 0xb
jne 0x40483f
call fcn.004059fa
test al, al
je 0x40483f
mov ecx, dword [esi + 4]
push edi
push 0x27
mov al, byte [ecx + 0xdd]
mov byte [ebp - 0xc8], al
mov eax, dword [ecx]
mov dword [ebp - 8], eax
lea eax, [ecx + 0x34]
push eax
lea eax, [ebp - 0xc6]
push 0x28
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s
mov eax, dword [esi + 4]
push 0x17
add eax, 4
push eax
lea eax, [ebp - 0x76]
push 0x18
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s
mov eax, dword [esi + 4]
push 0x1d
add eax, 0x84
push eax
lea eax, [ebp - 0x46]
push 0x1e
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xd0], 0xc4
add esp, 0x30
mov dword [ebp - 0xcc], eax
mov edi, eax
push ebx
push dword [edi]
call fcn.00405ab4
mov dword [edi], eax
inc ebx
mov eax, dword [ebp - 0xd0]
lea edi, [edi + 4]
shr eax, 2
dec eax
cmp ebx, eax
jb 0x40480a
push dword [ebp - 0xcc]
mov eax, dword [esi + 4]
push dword [ebp - 0xd0]
push dword [eax]
call fcn.004046d0
pop edi
jmp 0x404883
lea eax, [ebp - 0xd8]
push eax
push 5
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x404881
push dword [ebp - 0xd4]
mov eax, dword [esi + 4]
push dword [ebp - 0xd8]
push dword [eax]
call fcn.004046d0
push dword [ebp - 0xd4]
mov bl, al
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00403078
leave
ret
Function at 0x40539d
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x407014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x405400
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
test eax, eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop ebx
call fcn.00403078
leave
ret

Function at 0x405410
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4063ea
call fcn.00405b08
lea ecx, [ebp - 0x14]
call fcn.00403b99
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push 0x401b78
push 0x401b2c
push eax
call fcn.0040402b
add esp, 0x10
lea eax, [ebp - 0x10]
push edi
push eax
push edi
push 0x20206
push edi
push edi
push edi
push dword [ebp - 0x14]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4054a4
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push edi
push 0x401bdc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push edi
push 0x401bf0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402b02
xor eax, eax
call fcn.00405ae2
ret 0xc

Function at 0x40582a
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x4064ce
call fcn.00405b08
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push 0xfffffffffffffffe
pop edi
push dword [ebp + 8]
mov dword [ebp - 0x10], edi
push eax
call fcn.004057e0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
push ecx
push 0x20019
push ebx
push dword [eax]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402b02
test esi, esi
jne 0x4058b1
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], 4
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4058b1
mov dword [ebp - 0x10], edi
jmp 0x4058b4
mov edi, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402b02
mov eax, edi
call fcn.00405ae2
ret 0xc
Function at 0x4058cd
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x406510
call fcn.00405b08
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 0xc]
cmp edi, 0xffffffff
jge 0x4058e9
or edi, 0xffffffff
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.004057e0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
push ebx
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [eax]
movzx eax, byte [ebp + 0x10]
sub eax, 0x7fffffff
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402b02
test esi, esi
jne 0x40594e
push 4
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push eax
push 4
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402b02
call fcn.00405ae2
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x4077e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp eax, ebx
je 0x407dee
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.004075f5
adc al, 0x6d
inc ecx
or dword [edi], ecx
mov bh, 0x47
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.004075f5
or byte [edx - 0x74998150], 0x47
push es
cmp ax, bx
jbe 0x40784f
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x407849
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40783a
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40828a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004075ba
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.004075f5
mov dword [0x68934dd8], eax
add al, 1
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x4082e9
cmp dword [ebp - 0x398], 0
je 0x4084b3
cmp dword [ebp + 0xc], 1
je 0x4084b3
cmp dword [ebp + 0xc], 8
jne 0x40847b
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
wait
call fcn.004075f5
dec bh
mov bh, 0xbb
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
inc eax

Function at 0x4084d2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004075d3
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
invalid
inc dword [esi]
Function at 0x408a92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec eax
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.004075f5
pop ss
invalid
Function at 0x100356b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push edi
lea eax, [ebp - 0x210]
push 0x1001220
xor edi, edi
push eax
inc edi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10035e4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10013ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10035db
cmp dword [ebp - 0xc], 4
jne 0x10035db
cmp dword [ebp - 8], eax
setne al
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret
Function at 0x100447a
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 0x10]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x10
push dword [ebp + 0x14]
push edi
call sub.DNSAPI.dll_DnsQuery_W
test eax, eax
je 0x10044fa
cmp eax, 0x251d
jne 0x10044cc
push dword [ebp + 0x14]
lea eax, [ebp - 0x2c]
push eax
call fcn.01005a4a
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x277a
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01004b92
add esp, 0x14
jmp 0x10044f6
cmp eax, 0x232b
jne 0x10044db
push edi
push 0x277b
jmp 0x10044e8
cmp eax, 0x25e5
je 0x10044f6
push edi
push 0x277c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01004b92
add esp, 0x10
xor eax, eax
jmp 0x100452f
cmp dword [ebp - 4], 0
je 0x100452c
push edi
push 0x277d
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01004b92
add esp, 0x10
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0100445b
push 1
push dword [ebp - 4]
call sub.DNSAPI.dll_DnsRecordListFree
xor eax, eax
inc eax
pop edi
leave
ret 0x10

Function at 0x100474a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
xor esi, esi
cmp ebx, dword [edi + 0x618]
jae 0x100478b
mov eax, dword [edi + 0x61c]
push dword [ebp + 0x14]
mov esi, dword [eax + ebx*4]
push esi
call fcn.01003def
test eax, eax
je 0x100477c
test esi, esi
jne 0x1004785
inc ebx
cmp ebx, dword [edi + 0x618]
jb 0x1004762
cmp ebx, dword [edi + 0x618]
jne 0x10047aa
push 0x275f
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01004b92
add esp, 0xc
mov eax, 0x490
jmp 0x1004856
lea eax, [ebp + 0x10]
push eax
push 2
xor ebx, ebx
inc ebx
push ebx
push esi
call fcn.01002921
mov edi, eax
test edi, edi
je 0x10047d3
push edi
push 0xe
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01004c3c
jmp 0x1004854
mov edi, dword [ebp + 0x18]
test edi, edi
jne 0x10047df
mov edi, 0x10014fc
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push ebx
push 0
push 0x1001424
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xb
pop ecx
xor eax, eax
push eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push esi
push ebx
push 0
mov dword [ebp - 0x1c], ebx
call sub.DHCPCSVC.DLL_DhcpHandlePnPEvent
push dword [esi + 0x30c]
mov edi, eax
test edi, edi
je 0x1004841
push edi
push 0x2766
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01004bd9
jmp 0x1004854
push 0x2767
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01004b92
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10054b0
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x1001580
call fcn.010056d0
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x10054eb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10054eb
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1005503
cmp eax, 0x20b
je 0x10054f0
mov dword [ebp - 0x1c], edi
jmp 0x1005517
cmp dword [ecx + 0x84], 0xe
jbe 0x10054eb
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1005511
cmp dword [ecx + 0x74], 0xe
jbe 0x10054eb
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1007ac8], 0xffffffff
or dword [0x1007acc], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1007aac]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1007aa8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1007ad0], eax
call fcn.010056cc
cmp dword [0x1007110], edi
jne 0x1005572
push fcn.010056cc
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010056ba
push 0x10011b4
push 0x10011b0
call sub.msvcrt.dll__initterm
mov eax, dword [0x1007aa4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1007aa0]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10011ac
push 0x10011a8
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100485d
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x10055e9
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100561e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01005709
ret
Function at 0x1005aa7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x1005abb
or dword [ebp + 0x18], 0xffffffff
push ebx
mov ebx, dword [sym.imp.ntdll.dll_sprintf]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x13e]
cmp edi, eax
mov dword [ebp - 0x10], eax
jae 0x1005b7f
mov cl, byte [esi]
mov al, cl
inc esi
and al, 0xc0
mov byte [ebp + 0xb], cl
jne 0x1005b2b
movzx eax, cl
push eax
push 0x1001ec0
push edi
mov dword [ebp - 0xc], eax
call ebx
add edi, eax
add esp, 0xc
cmp byte [ebp + 0xb], 0
mov dword [ebp - 8], edi
je 0x1005bd2
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + esi]
cmp eax, dword [ebp + 0x18]
jae 0x1005b8b
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
add dword [ebp - 8], ecx
mov edi, dword [ebp - 8]
jmp 0x1005b74
cmp al, 0xc0
jne 0x1005bbe
cmp esi, dword [ebp + 0x18]
jae 0x1005b9e
xor eax, eax
mov ah, cl
mov al, byte [esi]
inc esi
movzx eax, ax
push eax
push 0x1001eb8
push edi
mov dword [ebp + 8], eax
call ebx
add esp, 0xc
add edi, eax
cmp dword [ebp + 0x14], 0
je 0x1005bb8
cmp dword [ebp - 4], 0
jne 0x1005b62
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
xor eax, 0xc000
add eax, dword [ebp + 0x14]
lea ecx, [esi - 2]
cmp eax, ecx
jae 0x1005ba6
cmp edi, dword [ebp - 0x10]
mov esi, eax
jb 0x1005adb
push 0x1001e88
push edi
call ebx
pop ecx
pop ecx
jmp 0x1005bcd
movzx eax, byte [ebp + 0xb]
push esi
push eax
push 0x1001e4c
push edi
call ebx
add esp, 0x10
jmp 0x1005bcd
push esi
push 0x1001e18
jmp 0x1005bc7
push eax
lea eax, [esi - 2]
push eax
push 0x1001de4
push edi
call ebx
add esp, 0x10
jmp 0x1005bd0
and byte [edi], 0
inc edi
jmp 0x1005bd2
movzx eax, cl
push eax
push 0x1001dc8
push edi
call ebx
add esp, 0xc
mov esi, dword [ebp + 0x10]
add edi, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1005bdb
mov dword [eax], edi
cmp dword [ebp - 4], 0
je 0x1005be4
mov esi, dword [ebp - 4]
pop edi
mov eax, esi
sub eax, dword [ebp + 0x10]
pop esi
pop ebx
leave
ret 0x14
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
mov ecx, 0x1c8b65f4
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5495735d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4019b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov ecx, 0x51c00c
call fcn.004b1bc6
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
sub edx, ecx
push 4
pop edi
push 4
pop esi
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x4019cf
sub edi, 1
jne 0x4019cc
pop edi
pop esi
pop ebp
ret 8

Function at 0x401da5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 8], ecx
mov ecx, 0x51c00c
push edi
call fcn.004b1bc6
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], 0x8040201
mov dword [ebp - 0x1c], 0x80402010
mov word [ebp - 0x18], 0x361b
push 4
lea esi, [edx + ebx]
pop edi
mov al, byte [esi]
lea esi, [esi + 4]
mov byte [ecx], al
inc ecx
sub edi, 1
jne 0x401ddd
inc edx
cmp edx, 4
jl 0x401dd7
xor ebx, ebx
push 0x10
inc ebx
pop esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
xor edx, edx
add eax, 0xfffffff3
add eax, esi
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edi, eax
lea eax, [edi + 0xc]
add eax, edx
test edx, edx
cmove eax, edi
add edi, 4
mov al, byte [eax]
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x401e0d
test edx, edx
jne 0x401e7c
mov al, byte [ebp - 4]
xor edi, edi
mov esi, dword [ebp - 8]
inc edi
mov byte [ebp + 0xb], al
xor ebx, ebx
lea eax, [ebp - 4]
sub edi, eax
lea ecx, [ebp - 4]
add ecx, ebx
lea eax, [edi + ecx]
and eax, reloc.WS2_32.dll_closesocket
jns 0x401e51
dec eax
or eax, 0xfffffffc
inc eax
movzx eax, byte [ebp + eax - 4]
inc ebx
mov al, byte [eax + esi + 4]
mov byte [ecx], al
cmp ebx, 3
jl 0x401e3d
movzx eax, byte [ebp + 0xb]
mov ecx, esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov al, byte [eax + ecx + 4]
mov byte [ebp - 1], al
mov al, byte [ebp + ebx - 0x21]
xor byte [ebp - 4], al
lea ecx, [esi + edx]
xor edi, edi
add ecx, dword [ebp + 0xc]
mov al, byte [ebp + edi - 4]
xor al, byte [ecx - 0x10]
inc edi
mov byte [ecx], al
lea ecx, [ecx + 4]
cmp edi, 4
jl 0x401e84
mov eax, dword [ebp - 0x14]
inc edx
cmp edx, 4
jl 0x401e09
add esi, 0x10
inc ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esi
cmp esi, 0xa0
jle 0x401dfc
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x402b6c
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x4dfe72
call fcn.004b1eac
sub esp, 0x10
push ebx
xor ebx, ebx
mov ecx, 0x51c078
push esi
mov dword [ebp - 0x1c], ebx
call fcn.004b1bc6
mov ecx, dword [ebp + 8]
call fcn.00402315
mov eax, dword [ebp + 0x10]
mov esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x402cde
push edi
push 3
pop edi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + esi - 0x14], al
inc esi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp esi, edi
jne 0x402c36
mov al, cl
mov esi, ebx
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], ch
mov ecx, 0x51a568
call fcn.004028b0
mov ecx, eax
movzx eax, byte [ebp + esi - 0x18]
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp + 8]
push eax
call fcn.004024e9
inc esi
cmp esi, 4
jl 0x402c07
mov dl, byte [ebp - 0xd]
mov esi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x402bad
test esi, esi
je 0x402cdd
cmp esi, edi
jge 0x402c6a
mov eax, edi
sub eax, esi
push eax
lea eax, [ebp - 0x14]
add eax, esi
push ebx
push eax
call fcn.004b5210
mov ch, byte [ebp - 0x12]
add esp, 0xc
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [esi + 1]
mov byte [ebp - 0x16], dl
test eax, eax
jle 0x402cc8
lea edi, [esi + 1]
mov ecx, 0x51a568
call fcn.004028b0
mov ecx, eax
movzx eax, byte [ebp + ebx - 0x18]
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp + 8]
push eax
call fcn.004024e9
inc ebx
cmp ebx, edi
jl 0x402ca2
push 3
pop edi
cmp esi, edi
jge 0x402cdd
sub edi, esi
mov ecx, dword [ebp + 8]
push 0x3d
call fcn.00402da0
sub edi, 1
jne 0x402cce
pop edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret