joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41276d
Capabilities:
Check if file exists
Query service status

Disassembly:
push 0x30
mov eax, 0x4516bd
call fcn.00421b9a
mov edi, ecx
mov eax, dword [edi + 0x18]
lea ebx, [edi + 0x10]
push ebx
push ecx
sub eax, 0x10
mov esi, esp
push eax
call fcn.0040f748
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.0041287f
pop ecx
xor esi, esi
pop ecx
test eax, eax
je 0x4127b1
lea eax, [edi + 0x14]
mov ecx, ebx
push eax
call fcn.0040dd87
mov dword [edi + 8], esi
jmp 0x4127b8
mov dword [edi + 8], 1
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4127e7
lea eax, [edi + 0x1c]
push eax
mov eax, dword [ebx]
push ecx
sub eax, 0x10
mov esi, esp
push eax
call fcn.0040f748
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.0041322d
pop ecx
pop ecx
xor esi, esi
jmp 0x412816
lea eax, [ebp - 0x3c]
push str.eQ
push eax
call fcn.0040fd75
pop ecx
pop ecx
push esi
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.00404efd
push eax
lea ecx, [edi + 0x1c]
call fcn.00402c4e
lea ecx, [ebp - 0x3c]
call fcn.00404a45
mov dword [edi + 8], esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x412879
push 0xf01ff
push dword [edi + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x412848
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x412879
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x412865
push dword [ebp - 0x30]
call ebx
push esi
call ebx
push dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x28], 1
sete al
mov dword [edi + 0xc], eax
call ebx
push esi
call ebx
call fcn.00421b49
ret
Function at 0x41322d
Capabilities:
Check if file exists
Get file version info

Disassembly:
push 0x1c
mov eax, 0x4518b1
call fcn.00421b9a
mov ebx, dword [ebp + 0xc]
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x413327
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x413327
push esi
call fcn.0041d90c
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x413310
lea eax, [ebp - 0x28]
push str.FRU6PSwhIxMkOjMZLTAnHmp5dX52fjdzBgc7JCMzKjIYKjc8LToj
push eax
call fcn.0040fe8d
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push 0
mov ecx, eax
call fcn.00404f20
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.00404a45
test esi, esi
jne 0x413303
and dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
push str.FRU6PSwhIxMkOjMZLTAnHmp9dXd2emUhBgc7JCMzKjIYKjc8LToj
push eax
call fcn.0040fe8d
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push esi
mov ecx, eax
call fcn.00404f20
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.00404a45
test esi, esi
je 0x413310
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.00403d9b
cmp dword [ebp - 0x18], 0
je 0x413320
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0041ee26
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00403c62
call fcn.00421b49
ret
Function at 0x413fba
Capabilities:
Enumerate processes

Disassembly:
push 0x244
mov eax, 0x4519b8
call fcn.00421b9a
push dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x244], ebx
call fcn.0040221f
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.004183f1
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x24c], esi
cmp esi, 0xffffffff
je 0x41414c
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x414123
lea eax, [ebp - 0x218]
mov dword [ebp - 0x248], ebx
push eax
lea ecx, [ebp - 0x248]
call fcn.0040221f
push dword [ebp - 0x244]
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.0040f82d
test eax, eax
jne 0x414104
push dword [ebp - 0x234]
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x250], edi
test edi, edi
je 0x414104
mov dword [ebp - 0x240], ebx
call fcn.004037a4
push eax
lea ecx, [ebp - 0x240]
call fcn.0040216e
mov esi, dword [ebp - 0x240]
mov byte [ebp - 4], 3
cmp dword [esi - 4], 1
jle 0x4140b8
push dword [esi - 0xc]
lea ecx, [ebp - 0x240]
call fcn.004036e1
mov esi, dword [ebp - 0x240]
push 0x104
push esi
push ebx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
push 0xffffffffffffffff
lea ecx, [ebp - 0x240]
mov edi, eax
call fcn.00416863
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4140f6
push dword [ebp + 8]
lea ecx, [ebp - 0x240]
call fcn.0040f82d
test eax, eax
jne 0x41412d
lea ecx, [esi - 0x10]
call fcn.00403c62
mov esi, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x248]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.00403c62
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x414026
jmp 0x41414c
xor ebx, ebx
lea ecx, [esi - 0x10]
inc ebx
call fcn.00403c62
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.00403c62
mov esi, dword [ebp - 0x24c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.00403c62
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00403c62
mov eax, ebx
call fcn.00421b49
ret

Function at 0x414174
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x220
mov eax, 0x4519f6
call fcn.00421b9a
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x22c]
push str.FQUvPScgKhchNzU7
push eax
call fcn.0040fe8d
pop ecx
pop ecx
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040221f
mov esi, eax
push 0
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00404f20
push eax
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0040e07a
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x220]
test eax, eax
setne bl
add ecx, 0xfffffff0
call fcn.00403c62
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00403c62
lea ecx, [ebp - 0x22c]
call fcn.00404a45
mov al, bl
call fcn.00421b49
ret
Function at 0x4184ef
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x38
mov eax, 0x4521f7
call fcn.00421b9a
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
push eax
push 0
push 0x40000001
push dword [edi]
push esi
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov ecx, ebx
test eax, eax
jne 0x41852e
call fcn.0040360d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4186b8
push dword [ebp - 0x14]
call fcn.00410a28
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0x40000001
push dword [edi]
push esi
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov ecx, ebx
test eax, eax
jne 0x41855a
push 0xffffffffffffffff
call fcn.00416837
mov ecx, ebx
jmp 0x41851e
push dword [ebp - 0x14]
call fcn.00403c7e
lea eax, [ebp - 0x20]
push 0x456dbc
push eax
call fcn.0040fd75
pop ecx
pop ecx
push dword [0x46fae4]
and dword [ebp - 4], 0
mov ecx, eax
push 0
call fcn.00404efd
push eax
mov ecx, ebx
call fcn.00416b10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00404a45
cmp dword [ebp + 0x14], 0
je 0x4186b6
lea eax, [ebp - 0x2c]
push str.bHUK
push eax
call fcn.0040fd75
mov edi, eax
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 1
push 0x456dcc
push eax
call fcn.0040fd75
add esp, 0x10
mov esi, eax
push 0
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00404efd
push eax
push 0
mov ecx, esi
call fcn.00404efd
push eax
mov ecx, ebx
call fcn.00416b10
lea ecx, [ebp - 0x20]
call fcn.00404a45
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404a45
lea eax, [ebp - 0x20]
push str.bHQI
push eax
call fcn.0040fd75
mov edi, eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 3
push 0x456ddc
push eax
call fcn.0040fd75
add esp, 0x10
mov esi, eax
push 0
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00404efd
push eax
push 0
mov ecx, esi
call fcn.00404efd
push eax
mov ecx, ebx
call fcn.00416b10
lea ecx, [ebp - 0x2c]
call fcn.00404a45
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00404a45
lea eax, [ebp - 0x44]
push str.bHQM
push eax
call fcn.0040fd75
mov edi, eax
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 5
push str.Yg
push eax
call fcn.0040fd75
add esp, 0x10
mov esi, eax
push 0
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.00404efd
push eax
push 0
mov ecx, esi
call fcn.00404efd
push eax
mov ecx, ebx
call fcn.00416b10
lea ecx, [ebp - 0x38]
call fcn.00404a45
lea ecx, [ebp - 0x44]
call fcn.00404a45
xor eax, eax
call fcn.00421b49
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4f8008], 0x8088405
inc edx
mov dword [ebx + 0x4f8008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e156f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e161
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e14a
test esi, esi
jbe 0x41e161
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ac
test eax, eax
jne 0x41e13c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e161
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e119
jmp 0x41e161
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e161
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1576
ret
Function at 0x41e9a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x4e1f53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e9df
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e9f8
lea eax, [ebp - 0x10]
mov edx, dword [0x4fa248]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ea0b
lea eax, [ebp - 0x10]
mov edx, dword [0x4fa248]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ea17
adc edx, 0
mov edx, dword [edx*4 + 0x4f90d8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb25
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41eb18
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d9c
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41eb18
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41eb18
cmp dx, 0x150
ja 0x41eb18
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41eb18
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eb3d
inc ebx
cmp ebx, 0x19
jne 0x41e9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1f5a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0xa3bd00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5e7000]
push edi
or ebp, 0xffffffff
jmp 0xa3bd22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa3bd29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa3bd18
mov eax, 1
add ebx, ebx
jne 0xa3bd3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa3bd4c
jne 0xa3bd6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa3bd6b
dec eax
add ebx, ebx
jne 0xa3bd58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa3bd30
add ebx, ebx
jne 0xa3bd67
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa3bdbd
xor ecx, ecx
sub eax, 3
jb 0xa3bd83
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa3bdf2
sar eax, 1
mov ebp, eax
jmp 0xa3bd8e
add ebx, ebx
jne 0xa3bd8e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa3bd5c
inc ecx
add ebx, ebx
jne 0xa3bd9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa3bd5c
add ebx, ebx
jne 0xa3bda9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa3bd9e
jne 0xa3bdba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa3bd9e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa3bddc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa3bdce
jmp 0xa3bd1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa3bddc
add edi, ecx
jmp 0xa3bd1e
pop esi
mov edi, esi
mov ecx, 0x4617
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa3bdfa
cmp byte [edi], 0x1f
jne 0xa3bdfa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa3bdff
lea edi, [esi + 0x638000]
mov eax, dword [edi]
or eax, eax
je 0xa3be6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x63c280]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x63c35c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa3be2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x63c360]
or eax, eax
je 0xa3be68
mov dword [ebx], eax
add ebx, 4
jmp 0xa3be49
call dword [esi + 0x63c368]
mov ebp, dword [esi + 0x63c364]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa3bea2
sub esp, 0xffffff80
jmp 0x4bd7a4
Function at 0x40e860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40e882
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40e889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40e878
mov eax, 1
add ebx, ebx
jne 0x40e89b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40e890
jne 0x40e8ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e890
xor ecx, ecx
sub eax, 3
jb 0x40e8c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40e932
mov ebp, eax
add ebx, ebx
jne 0x40e8cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40e8d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40e8fc
inc ecx
add ebx, ebx
jne 0x40e8e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40e8dd
jne 0x40e8f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e8dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40e91c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40e90d
jmp 0x40e87e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40e91c
add edi, ecx
jmp 0x40e87e
pop esi
mov edi, esi
mov ecx, 0x48
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40e93a
cmp byte [edi], 1
jne 0x40e93a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40e93f
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x40e9ae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xee7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeef4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40e96c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeef8]
or eax, eax
je 0x40e9a8
mov dword [ebx], eax
add ebx, 4
jmp 0x40e989
call dword [esi + 0xeefc]
popal
jmp 0x40297b
Function at 0xc9d324
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax + edx - 0x54dd5608]
mov dword [esp + ecx - 0x71369ab5], ecx
sal edx, 0xe2
xor ebx, eax
jmp 0xcf2f10

Function at 0xc9d896
Capabilities:
Encode data using base64

Disassembly:
dec esp
or esi, eax
dec edi
lea ecx, [edx + ecx - 0x4802000c]
jb 0xcd6f8d
inc ecx
pop esp
inc ecx
pop ebp
inc ecx
pop edx
js fcn.00cf78e6

Function at 0xca45f1
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x72217dba
add edi, 4
sal byte [esp], 0x63
sar word [esp + 2], 0xef
xor ecx, ecx
neg dword [esp]
push 0x31036cae
setp byte [esp + 3]
test eax, eax
lea esp, [esp + 8]
je 0xcea099
push 0x47bd0d07
dec word [esp + 2]
jnp 0x151630f
not ecx
push 0x7f93f10f
mov edx, 0x488cc93d
mov dword [edx + edi - 0x488cc93d], ecx
mov ecx, dword [edx + ebp - 0x488cc93d]
movsx eax, dx
sal dword [esp + edx - 0x488cc93d], 0xe8
call fcn.00ccc62b
mov ecx, 0x9daf073e
mov edx, dword [ebp]
add ebp, 4
call fcn.00c9d466
bswap eax
add ecx, edx
and dx, dx
ror ecx, 0xf0
rol eax, 1
shr ecx, 0xe7
call fcn.015140fa
mov dword [esp], esi
mov esi, 0xba15b1c
shl si, 0xc9
inc si
movzx esi, byte [edx + esi - 0xba13801]
push 0xf6bede94
jns 0x15366a9

Function at 0xcabfd5
Capabilities:
Encode data using base64

Disassembly:
dec ecx
shr ebx, 0x87
dec cx
rol bl, 1
inc ecx
shr esi, 0x5a
inc ecx
push ebx
inc esp
xor al, bl
inc dl
inc dx
and dword [esp + ebx*2 - 0x202], eax
dec eax
lea ebx, [esp + ebx + 0x18]
inc esp
xor esp, ecx
inc eax
sbb dh, cl
dec esp
mov dword [esp + esi - 0x65cddf92], esi
inc dx
mov dword [ebx + ebx*2 - 0x216], edi
dec eax
rol dword [esp + esi - 0x65cddf96], cl
call fcn.01534a98
lea edx, [eax*2 - 0x696f4ff2]
add esi, ecx
xadd al, ah
call fcn.014f1ded
push 0xcf159fbd
mov eax, dword [ebp]
mov edx, 0x969580ac
mov ecx, 0x372531b0
bts ecx, ecx
lea ebp, [ecx + ebp - 0x372531ac]
ror cx, 0xc
xor cl, ch
and cx, 0x8a1e
xor eax, ebx
add dl, ch
dec eax
push ecx
add dl, dl
bt cx, 0xab
not eax
setae byte [esp + ecx*2 - 0x6e4a142c]
not dword [esp + ecx*2 - 0x6e4a142c]
ror eax, 1
neg ecx
add ecx, dword [esp + 3]
inc eax
xor ebx, eax
jmp 0xce4bfd

Function at 0xcac295
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ebx - 0x1950857], edx
call fcn.0154849d
neg dl
not eax
ror dl, 1
xor dl, 0x81
push ecx
neg dl
cwde
rol dl, 1
xadd al, ah
neg eax
xor bl, dl
sar cl, 0xa4
lea edx, [esp + edx + 4]
mov ecx, dword [edx + ecx - 0xecbf8]
sbb word [esp + eax - 0x316], ax
mov dword [edi + eax*8 - 0x18bc], ecx
mov ecx, eax
shl dword [esp + eax - 0x317], cl
lea edi, [eax + edi - 0x31b]
push ecx
adc word [esp + eax - 0x311], ax
pop edx
pop eax
jae fcn.00cbc794