joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
mov byte [ebp - 0xc], cl
mov edx, dword [ebp + 0x10]
sar edx, 8
and edx, 0xff
mov byte [ebp - 0xb], dl
mov eax, dword [ebp + 0x10]
sar eax, 0x10
and eax, 0xff
mov byte [ebp - 0xa], al
mov ecx, dword [ebp + 0x10]
sar ecx, 0x18
and ecx, 0xff
mov byte [ebp - 9], cl
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
test edx, edx
je 0x470ced
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov al, byte [ecx]
xor al, byte [ebp + edx - 0xc]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jle 0x470ce2
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x470cab
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4717bf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov byte [ebp - 0x40], 0xc
mov byte [ebp - 0x3f], 0x52
mov byte [ebp - 0x3e], 0xe3
mov byte [ebp - 0x3d], 0xa8
mov byte [ebp - 0x3c], 0xf6
mov byte [ebp - 0x3b], 0xd4
mov byte [ebp - 0x3a], 0xc7
mov byte [ebp - 0x39], 0x68
mov byte [ebp - 0x38], 0xf2
mov byte [ebp - 0x37], 0x36
mov byte [ebp - 0x36], 0x1c
mov byte [ebp - 0x35], 0x88
mov byte [ebp - 0x34], 0x15
mov byte [ebp - 0x33], 0x36
mov byte [ebp - 0x32], 0x97
mov byte [ebp - 0x31], 0xde
mov byte [ebp - 0x30], 0x55
mov byte [ebp - 0x2f], 0x9a
mov byte [ebp - 0x2e], 0x9e
mov byte [ebp - 0x2d], 0xdf
mov byte [ebp - 0x2c], 5
mov byte [ebp - 0x2b], 0xd5
mov byte [ebp - 0x2a], 0xf3
mov byte [ebp - 0x29], 0x52
mov byte [ebp - 0x28], 0xe1
mov byte [ebp - 0x27], 0xe1
mov byte [ebp - 0x26], 0xcb
mov byte [ebp - 0x25], 0xfb
mov byte [ebp - 0x24], 0xb4
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0xca
mov byte [ebp - 0x20], 0x29
mov byte [ebp - 0x1f], 0xed
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x62
mov byte [ebp - 0x1c], 0x6a
mov byte [ebp - 0x1b], 0xba
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0xa1
mov byte [ebp - 0x18], 0xb0
mov byte [ebp - 0x17], 0x2b
mov byte [ebp - 0x16], 0x27
mov byte [ebp - 0x15], 0x60
mov byte [ebp - 0x14], 0x87
mov byte [ebp - 0x13], 0x81
mov byte [ebp - 0x12], 0xd1
mov byte [ebp - 0x11], 0xa4
mov byte [ebp - 0x10], 0x10
mov byte [ebp - 0xf], 0xf7
mov byte [ebp - 0xe], 0xd2
mov byte [ebp - 0xd], 0x6b
mov byte [ebp - 0xc], 0xce
mov byte [ebp - 0xb], 0xb5
mov byte [ebp - 0xa], 0x12
mov byte [ebp - 9], 0xc5
mov dword [ebp - 8], 0x38
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
ja 0x4718d6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp + edx - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00518610
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x476480
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x11c]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkCards
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4765e9
mov dword [ebp - 0x120], 0x104
mov dword [ebp - 0x10], 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4765da
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4765c1
mov dword [ebp - 0x120], 0
lea ecx, [ebp - 0x120]
push ecx
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0x551d08
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x120]
add ecx, 1
push ecx
call fcn.00519bee
add esp, 4
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push str.ServiceName
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0
je 0x4765b5
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00519640
add esp, 8
mov edx, dword [ebp - 0x14]
push edx
call fcn.00517411
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x120], 0x104
jmp 0x4764cc
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4765f0
mov eax, 0xffffff01
jmp 0x4765f2
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x478770
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea eax, [esi + 4]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov ax, word [edi + 0xa]
mov word [esi + 6], ax
mov ax, word [edi + 0x14]
mov word [esi + 0x16], ax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
lea eax, [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
call fcn.00478670
or al, al
jne 0x4788fa
test byte [edi + 0x1c], 4
je 0x4787d3
mov byte [esp + 0x13], 1
sub cx, cx
sub dx, dx
lea esp, [esp]
mov ebp, ecx
and ebp, 0xffff
lea eax, [ebp*8]
sub eax, ebp
shl eax, 2
lea eax, [eax + eax*4]
lea ebx, [esi + eax]
lea eax, [ebp*4]
mov word [ebx + 0x36], cx
lea eax, [eax + eax*8]
lea ebp, [edi + eax]
mov ax, word [ebp + 0xe]
mov word [ebx + 0x9c], ax
mov ax, word [ebp + 0x12]
mov word [ebx + 0x8e], ax
mov ax, word [ebp + 0x16]
mov word [ebx + 0x34], ax
mov ax, word [ebp + 0x18]
mov word [ebx + 0x32], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
cmp cx, 3
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x28], eax
lea eax, [esi + 4]
mov dword [ebx + 0xa4], eax
jne 0x478860
mov dword [ebx + 0xa8], 0
jmp 0x47886c
lea eax, [ebx + 0xb0]
mov dword [ebx + 0xa8], eax
or cx, cx
jne 0x478880
mov dword [ebx + 0xac], 0
jmp 0x478889
lea eax, [ebx - 0x68]
mov dword [ebx + 0xac], eax
cmp byte [esp + 0x13], 0
je 0x4788a0
cmp word [ebp + 0xe], 0xffff
jne 0x4788a0
or dword [ebx + 0x2c], 8
jmp 0x4788a6
mov word [ebx + 0x36], dx
inc dx
inc cx
cmp cx, 4
jb 0x4787e0
push esi
call fcn.004786e0
push esi
call fcn.00478620
push esi
call fcn.004785e0
mov eax, dword [esi + 0x10]
push eax
call fcn.00479aa0
mov word [esi + 0xc], ax
or ax, ax
je 0x4788f0
lea eax, [esi + 4]
push eax
call fcn.004798f0
sub ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
push esi
call fcn.004785b0
mov ax, 9
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x47a9f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.00478910
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.0047a520
or al, al
jne 0x47aa7a
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.0047b310
or al, al
jne 0x47aa7a
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.0047b1d0
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.0047b360
or di, di
je 0x47aa7a
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x47ab20
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x28]
push eax
mov esi, dword [esp + 0x28]
push edi
push esi
call fcn.00478910
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
call fcn.00478910
mov eax, dword [esp + 0x10]
push 0xe
mov ax, word [eax + 4]
push eax
call fcn.0047a520
or al, al
jne 0x47ac03
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0047b310
mov bx, ax
or bl, bl
jne 0x47abd2
mov eax, dword [esp + 0x10]
mov ax, word [eax + 0xe]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 0xc]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x1c]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x20]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x24]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.0047b220
mov bx, ax
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0047b360
push esi
call fcn.00478a20
cmp ax, 0xd
jne 0x47abe2
mov bx, 0xd
cmp bl, 0xd
je 0x47abed
cmp bx, 3
jne 0x47ac00
mov ax, word [esp + 0xe]
dec word [esp + 0xe]
or ax, ax
jne 0x47ab72
mov ax, bx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x47cc70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov byte [esp + 4], 0x5c
mov byte [esp + 5], 0x5c
mov byte [esp + 6], 0x2e
mov byte [esp + 7], 0x5c
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xd], 0x55
mov byte [esp + 0xe], 0x73
mov byte [esp + 0xf], 0x62
mov byte [esp + 0x10], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call fcn.00501194
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x47cd10
call fcn.00501182
cmp eax, 2
jb 0x47cceb
cmp eax, 3
jbe 0x47cd03
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x47ccf8
push eax
call fcn.00501170
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8
Function at 0x47cf30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0050118e
add esp, 0x24
ret
Function at 0x48eb1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov byte [ebp - 0x40], 0x6c
mov byte [ebp - 0x3f], 0xb0
mov byte [ebp - 0x3e], 0x4b
mov byte [ebp - 0x3d], 0xa0
mov byte [ebp - 0x3c], 0xad
mov byte [ebp - 0x3b], 0xef
mov byte [ebp - 0x3a], 0x73
mov byte [ebp - 0x39], 0x4e
mov byte [ebp - 0x38], 0xa3
mov byte [ebp - 0x37], 0x2f
mov byte [ebp - 0x36], 0x90
mov byte [ebp - 0x35], 0xd2
mov byte [ebp - 0x34], 0xb0
mov byte [ebp - 0x33], 0x45
mov byte [ebp - 0x32], 0xa2
mov byte [ebp - 0x31], 0x75
mov byte [ebp - 0x30], 0x85
mov byte [ebp - 0x2f], 0xe8
mov byte [ebp - 0x2e], 0xa3
mov byte [ebp - 0x2d], 0xfb
mov byte [ebp - 0x2c], 0x7b
mov byte [ebp - 0x2b], 0xd4
mov byte [ebp - 0x2a], 0x81
mov byte [ebp - 0x29], 0x38
mov byte [ebp - 0x28], 0xd6
mov byte [ebp - 0x27], 0xf5
mov byte [ebp - 0x26], 0xdc
mov byte [ebp - 0x25], 0xa4
mov byte [ebp - 0x24], 0xba
mov byte [ebp - 0x23], 0x4c
mov byte [ebp - 0x22], 0xf8
mov byte [ebp - 0x21], 0xb9
mov byte [ebp - 0x20], 0xe9
mov byte [ebp - 0x1f], 0x83
mov byte [ebp - 0x1e], 0x8a
mov byte [ebp - 0x1d], 0x7f
mov byte [ebp - 0x1c], 0xa6
mov byte [ebp - 0x1b], 0x18
mov byte [ebp - 0x1a], 0xac
mov byte [ebp - 0x19], 0x17
mov byte [ebp - 0x18], 0xb9
mov byte [ebp - 0x17], 0x88
mov byte [ebp - 0x16], 0x11
mov byte [ebp - 0x15], 0xaa
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x13], 0x47
mov byte [ebp - 0x12], 0xf3
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0x10], 0x37
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 2
mov byte [ebp - 0xd], 0xa
mov byte [ebp - 0xc], 0x1d
mov byte [ebp - 0xb], 0x3a
mov byte [ebp - 0xa], 0x9c
mov byte [ebp - 9], 0x69
mov dword [ebp - 8], 0x38
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
ja 0x48ec33
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp + edx - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00518610
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x490563
Capabilities:
Encode data using base64

Disassembly:
pop dword [esp - 4]
jno 0x4b4804
shl cl, 0x20
jo 0x490575
invalid
jo 0x4b4804
or byte [edi], 0x8d
inc ebp
cld
push 0
jmp 0x490583
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push 6
push ecx
lea edx, [ebp - 0xc]
push 0x4c27a5
ret
pop esi
jne 0x4bd6a9
je 0x49a443
push edi
aam 0xb
je 0x4bd6a9
xor eax, 0x56f0ff05
mov ch, ch
shl cl, 0x20
pop ebp
shr dx, 0x40
call fcn.004a417c
xor al, 0xc
push esi
ja 0x49a437
xchg bl, ch
xchg ch, bl
jbe 0x4b4813
jecxz 0x4b487a
xchg bx, di
xchg ebx, edi
xchg di, bx
mov esi, dword [ebp + 8]
shl dx, 0x20
mov ebp, ebp
jmp fcn.004a89c5
add byte [eax - 0x627df0fe], ch
retf 0
ja 0x4b0f1b
mov cl, cl
shl bx, 0x20
jbe 0x4bc465
nop
cpuid
ret 0x860f
jbe 0x4b0f1b
sub byte [edi], 0x66
shr esi, 0x40
mov ax, 0xa
pop ebx
mov di, di
mov esp, ebp
jmp 0x4bc453
Function at 0x490625
Capabilities:
Encode data using base64

Disassembly:
pop dword [esp - 4]
mov edx, dword [ebp + 0x38]
lea esi, [esi + 8]
mul dword [ebp + ebx]
mov dword [ebp + 0x30], eax
xchg esi, edi
xchg edi, esi
mov dword [ebp + 0x38], edx
mov bl, bl
ja 0x4aeda4
jbe 0x49061d
nop
cpuid
ret 0x860f
jbe 0x4aeda4
and byte [eax - 0x73], 0x64
and al, 4
mov cl, byte [ebp + 0xc]
mov dx, word [ebp + 0x10]
push eax
ja 0x4a472a
jbe 0x49063c
cli
into
jbe 0x4a472a
invalid
mov bx, bx
push esi
mov esi, esi
mov byte [esi + 0xba], cl
shr edi, 0x40
shr esi, 0x40
mov bx, bx
mov byte [esi + 0xbb], 0
shr bp, 0x40
xchg bl, ah
mov bh, bh
xchg ah, bl
mov word [esi + 0xbc], dx
call fcn.004c3755
mov al, byte [ebp + 0xb]
shr cx, 0x40
mov cx, cx
jmp 0x4a4767
push esi
xchg bp, ax
mov bx, bx
shl bp, 0x20
xchg bp, ax
mov byte [esi + 0xba], bl
jne 0x4b5ed0
mov cx, cx
je 0x4a4789
sti
popfd
cmpsd dword [esi], dword es:[edi]
je 0x4b5ed0
je 0x4b5ed0
and eax, 0x42d96859
dec edx
add bl, al
or byte [ecx + edx*2 + 0x1e23e852], 2
add byte [ebx + 0xff0ff06], cl
sbb dword [eax + 0x70000070], 0x4eb65803
jmp dword [esi]

Function at 0x4931d1
Capabilities:
Encode data using base64

Disassembly:
pop dword [esp - 4]
mov eax, dword [0x552801]
test eax, eax
jb 0x4c3033
xchg dl, dh
xchg dh, dl
jne 0x4c437b
je 0x4931f1
fadd st(0), st(0)
std
call fcn.004ab337
test eax, eax
jb 0x4aa211
xchg bx, di
xchg di, bx
jne 0x4c437b
je 0x49320f
js 0x493253
adc eax, 0x89665e5f
rcr byte [ebx + 0x5d], 0xc3
ret 0xf1d
pop edi
pop esi
mov ax, ax
pop ebx
pop ebp
ret
dec ebx
push edi
dec ebx
add byte [eax], al
popal
add byte [eax + 0x38], al
cmp byte [eax], al
add byte [eax], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
enter 0x4bd7, 0
xchg esi, eax
jno 0x4932c5
add byte [eax], dh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
aam 0x2f
dec edx
add byte [eax], ah
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add ah, dl
das
dec edx
add byte [eax + eax], cl
add byte [eax], al
xor al, 0
add byte [eax], al
jnp 0x4932e9
add byte [eax + eax], dh
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
jnp 0x4932f5
add byte [eax], bh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
loope 0x49325b
dec edx
add al, cl
pop esp
dec edx
add byte [edx + 0x65], dh
dec esp
add ch, al
xor cl, byte [ecx]
pop esp
ret
jb 0x49332c
dec esp
add al, cl
pop esp
dec edx
add byte [0x24648d29], al
lea esp, [esp + 4]
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x34]
mov ax, ax
mov edi, dword [ebp + 0x4c]
rep stosw word es:[edi], ax
jge 0x493337
add dword [eax], eax
or byte [eax], al
add byte [eax], al
add eax, 0xff5e8d57
Function at 0x494fb5
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
js 0x4ab0ca
jns 0x494fc3
inc edx
fimul dword [ebp - 0xf17f78a]
pushal
add dword [eax], eax
lea esi, [esi + 8]
call 0x4ab0bb
fisubr dword [ebx]
jbe 0x4b7926
ja 0x494fd9
sub ch, ah
sahf
test dword [ebp - 0x9ce0188], 0xf77b820f
add dword [eax], eax
lea edi, [eax - 2]
xor esi, esi
jb 0x4b475f
cmp edi, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
jbe 0x4b7926
ja 0x494ff8
mov dword [0xe9301479], eax
or al, 0
add byte [eax], al
push ss
wait
jmp 0x495009
call fcn.004bb420
xor al, 0x5f
push 0x4b6cc7
ret

Function at 0x49699b
Capabilities:
Packed with generic packer

Disassembly:
ja 0x4982b8
jbe 0x4969a7
cpuid
pop eax
ret
jbe 0x4982b8
fcmovu st(0), st(4)
call fcn.004c0033
add eax, 0xfa26ff15
jmp 0x4982b9
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
ja 0x49f37c
jbe 0x4982cb
push cs
dec esi
xor al, 0xf
xchg byte [ebx + 0x34000070], ch
int3
jbe 0x49f37c
xor al, 0xcc
test byte [eax + 0x1c], 1
jb 0x4c314b
cmp edi, dword [edx]
lea ebx, [ebx]
jmp 0x4ca0c5
call fcn.004b1685
add eax, 0x49af8d33
add byte [eax + eax], al
add ah, ah
dec ecx
add byte [edi], bh
in eax, 0x74
xor dword [eax + eax + 0x38], ecx
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [ecx + 0x43004a1b], ah
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ecx + esi + 0x4c], dh
add byte [eax], cl
add byte [eax], al
dec eax
add byte [eax], al
add byte [ebp + 0x440049af], cl
add byte [eax], al
add byte [esi + 0x34004b71], dl
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
in al, 0xf2
dec ecx
add byte [eax], bh
arpl word [esi - 0x3f76991a], ax
xchg ah, dh
js 0x4aca02
mov si, si
mov cl, cl
jns 0x4ca130
cpuid
nop
ret
jns 0x4aca02
invalid
invalid

Function at 0x498caf
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse pe header

Disassembly:
js 0x49e339
jns 0x498cbb
invalid
jns 0x49e339
sub dl, 0xff
mov ebx, 0x66c98845
mov ax, ax
jno 0x4a72d3
jo 0x49e348
cpuid
ret
jo 0x4a72d3
xor al, 0x77
call fcn.0048f96c
add esp, 0x24
test ax, ax
jb 0x4b0b63
je 0x49e38e
add byte [eax], al
add byte [ebp + 2], dh
jne 0x49e36e
mov edx, 0x1a3d663b
add byte [edi], cl
test byte [esi], dl
add byte [eax], al
add byte [ebp + 4], dh
cmp ax, 0x1a
je 0x49e38e
jne 0x49e37e
loope 0x49e38b
mov byte [0xa3d66c3], al
add byte [edi], cl
test dword [ebp + 0x740000d6], ebp
add al, 0xb5
cmp ax, 0xa
jne 0x4aba35
lodsd eax, dword [esi]
salc
add byte [eax], al
je 0x49e38e
mov ch, 0x10
jne 0x49e367
adc byte [ebp - 0x27], dh
inc edi
cmp edi, 7
mov dword [ebp - 8], edi
jbe 0x4cd4d9
ja 0x49e3a4
in al, dx
jb 0x49e384
add cl, byte [ebx + 0x51006a0e]
mov ecx, dword [esi]
push 0
push ecx
shr al, 0x40
call fcn.004aec95
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
jmp 0x4a674d
pop ebp
ret
push ebp

Function at 0x49a276
Capabilities:
Encode data using base64

Disassembly:
pop dword [esp - 4]
jae 0x4c3154
jb 0x49a285
jmp dword [esi]
Function at 0x4a417c
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
js 0x4c0217
xchg bl, ah
xchg ah, bl
jns 0x4a4190
jns 0x4c0217
fadd st(7)
xchg ecx, edx
xchg si, dx
xchg dx, si
mov ecx, ecx
xchg cx, bx
xchg bx, cx
mov di, di
mov cx, cx
xchg edx, ecx
ret

Function at 0x4a7952
Capabilities:
Packed with generic packer

Disassembly:
pop edx
je 0x4c8731
shr si, 0x40
pop edi
xor eax, eax
jb 0x4a1c50
push edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4aaebe
Capabilities:
Encrypt data using speck

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x4ad39f
je 0x4aaed9
and al, 0xc5
je 0x4ad39f
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x4ad3a7
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.0049d802
shl eax, 0x20
call fcn.004c517d
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret
Function at 0x4ac7ff
Capabilities:
Encode data using base64

Disassembly:
pop dword [esp - 4]
jmp 0x498323

Function at 0x4ae716
Capabilities:
Packed with generic packer

Disassembly:
call int.004ae716
fisubr dword [ecx + 0xf]
test dword [edi], eax
inc ebp
add eax, dword [eax]
mov bp, bp
je 0x490d5a
add al, 0xc1
popfd
cmp al, al
jmp 0x49ebc6
xchg ebp, ecx
xchg ecx, ebp
cli
push edx
shr bx, 0x40
mov ebx, dword [esi + 8]
jno 0x4b8e59
jo 0x4969cd
or byte [eax - 0x3d], dh
pop es
jo 0x4b8e59
pop ebx
xchg esi, eax
shr al, 0x40
jno 0x4bf1cc
jo 0x499e70
jo 0x4bf1cc
xor eax, eax
jb 0x499e60
xchg ebp, eax
xchg ebp, eax
shl eax, 0x20
jmp 0x49653f
lea esp, [esp + 4]
mov cl, byte [ebp + eax - 8]
mov dl, byte [ebp - 0x60]
sub cl, 0x58
sub dl, 0x34
xor cl, dl
jb 0x4969b8
mov byte [ebp + eax - 0xf0], cl
jne 0x4b8528
je 0x4ae741
aam 0xa7
and al, 0xf
test cl, ah
popfd
add byte [eax], al
je 0x4b8528
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
mov ah, ah
shr byte [ebx], cl
jmp dword [esi]
inc eax
cmp eax, 8
jl 0x490d45
jge 0x4b853a
nop
cpuid
ret 0x1ae9
jmp fcn.004a1159
jno 0x4b7989
shl ch, 0x20
jo 0x4b8e66
jo 0x4b7989
lea esi, [esi]
mov bh, bh
lea esi, [esi + 4]
shl si, 0x20
cli
jmp dword [esi]

Function at 0x4aedb0
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [esi + 8]
shr ebx, 0x40
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
call fcn.004a0320
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid