joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421e00
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea eax, [esi + 4]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov ax, word [edi + 0xa]
mov word [esi + 6], ax
mov ax, word [edi + 0x14]
mov word [esi + 0x16], ax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
lea eax, [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
call fcn.00421d00
or al, al
jne 0x421f8a
test byte [edi + 0x1c], 4
je 0x421e63
mov byte [esp + 0x13], 1
sub cx, cx
sub dx, dx
lea esp, [esp]
mov ebp, ecx
and ebp, 0xffff
lea eax, [ebp*8]
sub eax, ebp
shl eax, 2
lea eax, [eax + eax*4]
lea ebx, [esi + eax]
lea eax, [ebp*4]
mov word [ebx + 0x36], cx
lea eax, [eax + eax*8]
lea ebp, [edi + eax]
mov ax, word [ebp + 0xe]
mov word [ebx + 0x9c], ax
mov ax, word [ebp + 0x12]
mov word [ebx + 0x8e], ax
mov ax, word [ebp + 0x16]
mov word [ebx + 0x34], ax
mov ax, word [ebp + 0x18]
mov word [ebx + 0x32], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
cmp cx, 3
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x28], eax
lea eax, [esi + 4]
mov dword [ebx + 0xa4], eax
jne 0x421ef0
mov dword [ebx + 0xa8], 0
jmp 0x421efc
lea eax, [ebx + 0xb0]
mov dword [ebx + 0xa8], eax
or cx, cx
jne 0x421f10
mov dword [ebx + 0xac], 0
jmp 0x421f19
lea eax, [ebx - 0x68]
mov dword [ebx + 0xac], eax
cmp byte [esp + 0x13], 0
je 0x421f30
cmp word [ebp + 0xe], 0xffff
jne 0x421f30
or dword [ebx + 0x2c], 8
jmp 0x421f36
mov word [ebx + 0x36], dx
inc dx
inc cx
cmp cx, 4
jb 0x421e70
push esi
call fcn.00421d70
push esi
call fcn.00421cb0
push esi
call fcn.00421c70
mov eax, dword [esi + 0x10]
push eax
call fcn.00423130
mov word [esi + 0xc], ax
or ax, ax
je 0x421f80
lea eax, [esi + 4]
push eax
call fcn.00422f80
sub ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
push esi
call fcn.00421c40
mov ax, 9
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x424080
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.00421fa0
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.00423bb0
or al, al
jne 0x42410a
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004249a0
or al, al
jne 0x42410a
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.00424860
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004249f0
or di, di
je 0x42410a
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x4241b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x28]
push eax
mov esi, dword [esp + 0x28]
push edi
push esi
call fcn.00421fa0
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
call fcn.00421fa0
mov eax, dword [esp + 0x10]
push 0xe
mov ax, word [eax + 4]
push eax
call fcn.00423bb0
or al, al
jne 0x424293
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.004249a0
mov bx, ax
or bl, bl
jne 0x424262
mov eax, dword [esp + 0x10]
mov ax, word [eax + 0xe]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 0xc]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x1c]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x20]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x24]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.004248b0
mov bx, ax
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.004249f0
push esi
call fcn.004220b0
cmp ax, 0xd
jne 0x424272
mov bx, 0xd
cmp bl, 0xd
je 0x42427d
cmp bx, 3
jne 0x424290
mov ax, word [esp + 0xe]
dec word [esp + 0xe]
or ax, ax
jne 0x424202
mov ax, bx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x426040
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
push esi
mov byte [esp + 4], 0x52
mov byte [esp + 5], 0x4e
mov byte [esp + 6], 0x42
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x44
mov byte [esp + 9], 0x52
mov byte [esp + 0xa], 0x56
mov ax, word [esp + 0x18]
add al, 0x30
mov byte [esp + 0xb], al
mov esi, dword [esp + 0x14]
mov byte [esp + 0xc], 0
mov dword [esi], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x4260d6
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x4260b3
cmp eax, 3
jbe 0x4260cb
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4260c0
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x80b
pop esi
add esp, 0xc
ret 8
mov ax, 0x80c
pop esi
add esp, 0xc
ret 8
mov ax, 0x800
pop esi
add esp, 0xc
ret 8

Function at 0x4260f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, dword [esp + 0x18]
push esi
mov word [esi + 6], 0xffff
call fcn.00425fe0
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov edi, dword [esp + 0x20]
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
or ebx, ebx
je 0x426140
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
push esi
call fcn.00425fa0
or ebx, ebx
je 0x426152
cmp word [esi + 6], 0xffff
jne 0x426158
mov word [esi + 6], 0x83b
mov ax, word [esi + 6]
pop edi
pop esi
pop ebx
add esp, 4
ret 8
Function at 0x426280
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
push esi
mov al, byte [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.00426240
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4262f0
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x4262c9
cmp eax, 3
jbe 0x4262e1
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4262d6
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x426300
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov byte [esp + 4], 0x5c
mov byte [esp + 5], 0x5c
mov byte [esp + 6], 0x2e
mov byte [esp + 7], 0x5c
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xd], 0x55
mov byte [esp + 0xe], 0x73
mov byte [esp + 0xf], 0x62
mov byte [esp + 0x10], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4263a0
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x42637b
cmp eax, 3
jbe 0x426393
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x426388
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x4263c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x14]
push esi
mov word [esi + 6], 0xffff
call fcn.00425fe0
lea eax, [esp + 8]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov eax, dword [esp + 0x1c]
push esi
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_ReadFile
mov edi, eax
push esi
call fcn.00425fa0
cmp edi, 1
jne 0x426405
cmp word [esi + 6], 0xffff
jne 0x42640b
mov word [esi + 6], 0x23b
mov ax, word [esi + 6]
pop edi
pop esi
add esp, 4
ret 8
Function at 0x4265c0
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
add esp, 0x24
ret
Function at 0x42a900
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x18
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop edi
ret
Function at 0x42ce33
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
jno 0x4510d4
shl cl, 0x20
jo 0x42ce45
invalid
jo 0x4510d4
or byte [edi], 0x8d
inc ebp
cld
push 0
jmp 0x42ce53
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push 6
push ecx
lea edx, [ebp - 0xc]
push 0x45f075
ret
push esi
ja 0x436d07
xchg bl, ch
xchg ch, bl
jbe 0x4510e3
jecxz 0x45114a
xchg bx, di
xchg ebx, edi
xchg di, bx
mov esi, dword [ebp + 8]
shl dx, 0x20
mov ebp, ebp
jmp fcn.00445295
add byte [eax - 0x627df0fe], ch
retf 0
Function at 0x42faa1
Capabilities:
Check os version
Encode data using base64

Disassembly:
pop dword [esp - 4]
mov eax, dword [0x5d20f1]
test eax, eax
jb 0x45f903
xchg dl, dh
xchg dh, dl
jne 0x460c4b
je 0x42fac1
fadd st(0), st(0)
std
call fcn.00447c07
test eax, eax
jb 0x446ae1
xchg bx, di
xchg di, bx
jne 0x460c4b
je 0x42fadf
js 0x42fb23
adc eax, 0x89665e5f
rcr byte [ebx + 0x5d], 0xc3
ret 0xf1d
pop edi
pop esi
mov ax, ax
pop ebx
pop ebp
ret
sbb esp, dword [eax]
inc ebp
add byte [eax], al
popal
add byte [eax + 0x38], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cwde
mov al, byte [0x3a660045]
inc ebp
add byte [eax], dh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
movsb byte es:[edi], byte [esi]
clc
inc ebx
add byte [eax], ah
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [eax + edi*8 + 0xc0043], ah
add byte [eax], al
xor al, 0
add byte [eax], al
inc byte [ebx + 0x45]
add byte [eax + eax], dh
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
inc byte [ebx + 0x45]
add byte [eax], bh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
mov cl, 0x6f
inc esp
add byte [eax + 0x42004425], bl
inc esi
add byte [ebp + 0x5c0042fb], dl
ret
add dh, byte [esi + 0x73]
jbe 0x44bafd
jmp dword [esi]
jmp dword [esi]
jmp dword [esi]
add eax, 0xff5e8d57
mov eax, dword [ebp + 0xc]
cmp eax, 0x9c40244c
je 0x436a95
jne 0x460c5e
push ss
test byte [ebx - 0x75], cl
dec ebp
and al, 0x8b
push ebp
and byte [edi], cl
xchg edx, edi
pop ebp
std
push dword [esi + 3]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
ja 0x436a64
jbe 0x460c6f
retf
jbe 0x436a64
and byte [ecx], 0x8d
jbe 0x460c82
js 0x453881
jns 0x460c84
rol byte [esi + 0xf], 1
mov edi, esi
sub edi, edi
push dword [0x448b66b1]
jns 0x453881
xor eax, 0x448b66b1
add eax, 0x3e850f00
mov edi, edi
jmp dword [esi - 0x3f]
Function at 0x431914
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step
Parse credit card information

Disassembly:
pop dword [esp - 4]
lea eax, [ebp - 0x100]
push 0x10c
shr cl, 0x40
xchg ah, bl
xchg bl, ah
push eax
call fcn.0044aa0f
call fcn.00454cd1
and eax, 0x43d66fb
add byte [edi], cl
test dword [edi - 0x6d6dffff], edx

Function at 0x43557f
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck
Parse credit card information

Disassembly:
js 0x43ac09
jns 0x43558b
invalid
jns 0x43ac09
sub dl, 0xff
mov ebx, 0x66c98845
xchg esi, edx
xchg dx, si
mov ecx, dword [esi + 4]
mov dh, dh
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
rol byte [ebx], cl
jmp dword [esi]
mov ax, ax
jno 0x443ba3
jo 0x43ac18
cpuid
ret
jo 0x443ba3
xor al, 0x77
call fcn.0042c23c
add esp, 0x24
test ax, ax
jb 0x44d433
je 0x43ac5e
jne 0x43ac3e
cmp ax, 0x1a
je 0x43ac5e
jne 0x43ac4e
cmp ax, 0xa
jne 0x448305
push ebp
mov ebp, esp
mov cx, cx
mov eax, dword [ebp + 0x10]
mov ecx, eax
dec eax
cmp edx, edx
test ecx, ecx
jb 0x454417
jmp 0x45e81f
fld dword [ecx - 0x75]
inc esi
add al, 0xf5
je 0x43d8e0
jne 0x45e829
dec ebp
retf
mov ebp, ebp
lea ecx, [eax + 1]
push 0x46209d
ret

Function at 0x435ec1
Capabilities:
Check os version

Disassembly:
mov ch, ch
mov eax, dword [esi + 4]
movzx eax, word [ebp + eax]
cmp dx, dx
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x44eec2
jne 0x44b0ba
je 0x42cf43
scasb al, byte es:[edi]
fisubr word [edi + 0xfdb881e]
mov byte [eax], ah
stosd dword es:[edi], eax
add eax, dword [eax]
mov bl, bl
js 0x467a6b
mov bp, bp
jns 0x42cf54
stc
insd dword es:[edi], dx
or ah, bl
jns 0x467a6b
lea esp, [esp + 4]
jne 0x457468
je 0x435ed1
mov word [eax - 0x51], ds
ja 0x4453dc
jbe 0x435edb
test ecx, 0x1000
jb 0x46a46d
push ebx
pop ebx
jne 0x43a91e
push eax
pop eax
je 0x43d2fd
cpuid
nop
ret
popfd
mov ebx, ebx
jmp dword [esi - 4]
jmp 0x42cf14
shr si, 0x40
mov eax, dword [esi + 4]
movzx eax, byte [ebp + eax]
cmc
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x46a462
jne 0x44b0ba
je 0x457497
nop
cpuid
ret
xchg ebx, edi
xchg edi, ebx
mov ecx, dword [esi]
sub cx, 0
add esi, 8
jne 0x43d2e1
je 0x4574b4
cpuid
nop
ret
je 0x43d2e1
in al, dx
sub eax, dword [ebx]
pop ds
popfd
shl al, 0x20
jmp dword [esi - 4]
pushal
pop esp
shl esi, 0x20
movzx eax, byte [edi]
popfd
jmp dword [esi - 4]
Function at 0x43a325
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
mov cx, cx
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xff
jb 0x44f3a1
add eax, 0xffffffd8
cmp eax, 0xc2
lea edi, [edi]
ja 0x43a37b
jbe 0x43a351
nop
cpuid
ret
xor ecx, ecx
jb 0x45beb8
shr ecx, 0x40
mov cl, byte [eax + 0x46ac24]
jmp dword [ecx*4 + 0x46ac1c]
xor eax, eax
jb 0x45bed1
pop ebp
jne 0x43bfd7
mov dx, dx
je 0x43a393
cpuid
ret
je 0x43bfd7
add eax, 0x83df5f4
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
ret
mov byte [ebp + ebx], al
jmp dword [esi]
and dword [ebx - 0x75], ebx
pop ebp
inc esp
mov byte [0x40eac073], al
mov ebx, dword [ebp + 0x44]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
jne 0x4677ac
je 0x45beea
sub dword [ebx], ecx
inc ecx
je 0x4677ac
fld dword [esi]
imul byte [ebp + ebx]
lea esi, [esi + 0xc]
shr cl, 0x40
jne 0x448faa
je 0x45bf08
cpuid
ret
je 0x448faa
fidiv dword [edx + 0x1b]
and byte [ebp], al
add byte [ecx], ah
xor byte [eax + eax], 0
add byte [eax], al
and dword [eax], eax
add byte [eax + eax + 0x10000000], bh
add byte [eax], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ecx + 8], ah
inc ebx
add byte [edi], cl
mov dh, 0x42
add byte [ebx + ecx*8 + 0x43], al
add byte [edi + edi*4 + 0x45], al
add byte [eax + 0x44c3a20f], dl
retf
Function at 0x440a4c
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
js 0x45cae7
xchg bl, ah
xchg ah, bl
jns 0x440a60
cpuid
ret
jns 0x45cae7
fadd st(7)
xchg ecx, edx
xchg si, dx

Function at 0x4415cc
Capabilities:
Check os version

Disassembly:
jmp dword [esi]
mov esi, dword [ebp - 0x14]
lea edx, [eax + ecx]
cmp edx, esi
jbe 0x4415ba
mov ah, ah
ja 0x43c833
sub bh, byte [ecx - 0xc0014eb]
jmp 0x43c834
push ebx
call fcn.00452bfe
jmp 0x44159f
mov ecx, dword [ebp + 0x20]
xchg cl, ah
xchg ah, cl
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
jmp 0x44114e
push ecx
mov cx, cx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
jmp 0x441161
add esp, 4
mov ax, 0xa
xchg dx, ax
xchg dx, ax
pop edi
pop esi
pop ebx
mov esp, ebp
xchg edi, edx
xchg edx, edi
pop ebp
ret
ja 0x45deb1
jbe 0x4415c4
inc esi
test byte [edi], 0x86
out 0xc8, eax
add dword [eax], eax
jbe 0x45deb1
xor eax, 0x24648d90
add al, 0x8b
inc esi
add al, 0xc0
in al, 0x20
mov ebx, dword [esi + 8]
mov dx, dx
lea esi, [esi + 0xc]
cmp esi, esi
and word [ebp + ebx], ax
jb 0x440a73
shr ebp, 0x40
jmp dword [esi]
iretd
push eax
xchg bh, ah
xchg ah, bh
call fcn.00467105
and eax, 0x8568b0b
mov ax, word [ebp + eax]
lea esi, [esi + 0xc]
and word [ebx + edx], ax
jb 0x4481f0
ja 0x43c455
jbe 0x45dedf
cpuid
aas
ret
jbe 0x43c455
fst dword [edx - 0x3dbbb71]
cmp eax, 2
je 0x441140
jne 0x45defc
jl 0x45df38
sub ah, 0
cmp eax, 5
je 0x44986b

Function at 0x44778e
Capabilities:
Check os version
Encrypt data using aes mixcolumns step
Encrypt data using speck

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x449c6f
je 0x4477a9
and al, 0xc5
je 0x449c6f
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x449c77
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.0043a0d2
shl eax, 0x20
call fcn.00461a4d
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret
Function at 0x447820
Capabilities:
Check os version

Disassembly:
mov al, byte [esi + edx]
push eax
call fcn.00448264
and bp, bp
add esp, 4
test eax, eax
jb 0x442c22
je 0x448250
jne 0x42b9af
sbb cl, byte [edi]
mov byte [0xed0946c3], al
inc esi
or ebp, ebp
shl dx, 0x20
jno 0x42b9bc
leave
sub dword [eax + 0xc810f14], esp
and eax, 0x99d90001
jno 0x43dece
fstp dword [ecx - 0x74bba275]
inc esi
add al, 0x88
in eax, dx
jmp 0x42ec8e
mov bl, 0xcb
jmp 0x454a3b
lea esp, [esp + 4]
mov edx, dword [ebp + 8]
jne 0x42b989
je 0x4477c2
bound ebx, qword [edi + ecx - 0x7c]
rol dword [ecx - 2], 0xff
je 0x42b989
mov ax, word [ecx + 8]
add ecx, 8
inc edx
cmp ax, 0xffff
jne 0x44e58e
je 0x4477e2
cmpsd dword [esi], dword es:[edi]
jne 0x43d8ca
jne 0x43d8ca
je 0x4477ed
rcr dword [esi + 0x36], 1
je 0x43d8ca
xor al, 0x42
mov edi, dword [ebp + 0x10]
shl cl, 0x20
mov eax, dword [edi]
ja 0x44a66b
shr ax, 0x40
jbe 0x44780b
push 0xffffffffffffffce
jbe 0x44a66b
and eax, 0xd289664c
mov edx, dword [ebp + 0x38]
call fcn.004506b6
and eax, 0x24448f81
pop dword [esp - 4]
js 0x45797b
xchg ecx, ebp
mov di, di
xchg ebp, ecx
jns 0x447837
cpuid
nop
ret
jns 0x45797b
invalid
push eax
ja 0x43abf5
jbe 0x44a677
or dword [edx], 0x78860fe6
add eax, 0x3835ffff
add al, 0xbd
inc ebx
jbe 0x43abf5
xor eax, 0x43bd0438
add byte [esi - 0xc], bh
inc ebx
add byte [edx], cl
int1
inc esp
add byte [edx - 0x44ffbb5a], dl
push esp
or dh, cl
inc esp
add byte [esi - 0xc], bh
inc ebx
add bh, al
jae 0x44a685
cmc
jne 0x44a6a1
add byte [ebx - 0x531617bb], cl
aaa
add byte [eax], al
cmp byte [eax], 0xc0
loopne 0x44a6ce
add byte [edi], cl
adc byte [edx + 0x38], 0
add byte [ebp + 0x40fd04], cl
add byte [eax], al
pop es
invalid
add ah, 0
cmp ax, word [ebp + 8]
je 0x42ec74
jne 0x44e5a1
nop
cpuid
ret
jno 0x4477c8
mov bh, bh
jo 0x44e5ae
js 0x44e583
test eax, 0x9214800f
invalid
jo 0x4477c8
ficom dword [edi - 0x75]
push esi
mov cl, byte [ebp + 0x34]
xchg di, ax
xchg di, ax
mov ebx, dword [esi + 4]
lea esi, [esi + 8]
rol word [ebx], cl
shl cl, 0x20
jmp dword [esi]
mov al, byte [ebp + 0xb]
mov bl, bl
shl cl, 0x20

Function at 0x447c27
Capabilities:
Check os version
Encode data using base64

Disassembly:
push ebp
ja 0x453936
jbe 0x431e12
dec edi
sbb dword [esi], edx
sbb dword [edi], ecx
xchg byte [esi], bl
sbb eax, dword [edx]
add byte [edx + 0x40eac150], al
jbe 0x453936
adc byte [eax - 0x3f], 0xea
inc eax
jno 0x431e05
jo 0x447c32
dec edi
xor edi, ecx
jo 0x431e05
xor eax, 0xfbe1e8e0
invalid
Function at 0x449045
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add esi, 0xc
popfd
push 0x45360c
ret
and eax, 0x43bd06c0
add ah, ah
lds eax, [edx]
retf 0x4347
iretd
lea esp, [esp + 4]
mov ax, ax
xchg cx, dx
xchg dx, cx
mov eax, dword [esi + 4]
mov eax, dword [ebp + eax]
stc
add esi, 8
mov ax, ax
shl eax, cl
test edx, 0x416e05a6
add edi, eax
test ecx, 0x80000000
jb 0x4469dc
shl esi, 0x20
jne 0x466277
je 0x449086
enter 0xffffffffffff81a1, 0xffffffffffffffc6
add al, 0
add byte [eax], al
add esi, 4
popfd
jmp dword [esi - 4]
ficom dword [ecx - 0x17090015]
test al, 0xa1
add byte [eax], al
test di, 0x5d16
test ecx, 0x4000
jb 0x442207
call fcn.0042fbd7
xor al, 0x1b
and byte [ebp], al
add byte [ecx], al
xor byte [eax], 0
add byte [eax], al
add byte [ecx], al
add byte [eax], al
inc ebx
invalid
and byte [esi - 0x73], 0x64
and al, 4
lea esi, [esi + 8]
cmp bx, bx
mul byte [ebp + ebx]
push eax
pop eax
mov dword [ebp + 0x30], eax
call fcn.0043771a
xor al, 0x86
mov byte [esi + 0xba], bl
mov ecx, ecx
jbe 0x466260
cpuid
nop
ret
mov eax, dword [ebp - 0xc]
test eax, eax
jb 0x45e300
push 0x45172b
ret
mov si, si
mov ecx, dword [esi]
sub ah, 0
test ecx, 0x2000
jb 0x44adc2
jne 0x457a0f
je 0x466297
cpuid
jae 0x46625a
lea ecx, [ecx]
shr si, 0x40
mov eax, dword [esi + 4]
or esp, esp
shr ah, 0x40
jno 0x4662a9
je 0x466311
jno 0x440955
mul dword [esi - 0x79]
dec byte [ebx - 0x3f7a07bb]
Function at 0x44b680
Capabilities:
Check os version
Encode data using base64

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [esi + 8]
shr ebx, 0x40
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
call fcn.0043cbf0
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid