joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bef0
Capabilities:
Encode data using xor

Disassembly:
fild qword [ebp + ecx - 0x503994a8]
add byte [0xf558c2d0], 0x52
loop 0x43be3c
pop esi
inc esi
int1
test byte [edx + 0x12], al
mov edi, 0x45b75630
inc ebp
out 0x7e, al
push ebx
cmp eax, 0xc65c87c2
inc esp
cmp byte [eax], ch
mov ch, 0xd3
invalid
inc ebp
jnp 0x43bef5
sub cl, byte [edx]
mov ss, esp
add byte [edi], ah
fcom st(4)
push es
aad 0xe
in eax, dx
push ebp
sar dword [0x7a70fcac], 1
jg 0x43be22
mov edx, 0x82f0cc8f
or al, 0x9c
leave
inc eax
bswap ebp
jmp 0xbed2c1de
vaddps ymm2, ymm3, ymmword [edx]
das
jae 0x43be7d
imul al
push ebx
jnp 0x43bf63
xchg edx, eax
or byte [ebx], dl
jge 0x43bf3f
jo 0x43bf69
sub ebx, dword [edi + edi*8 + 0x661c9f5b]
stosb byte es:[edi], al
lds ebp, [edx + 0x7eefaf18]
mov ebp, 0x185a8272
jb 0x43befe
sbb ecx, edi
push ebp
mov edx, 0xafd5f552
aaa
fsubp st(1)
aaa
push ss
dec ecx
nop
mov bh, 0xe2
or byte [ecx], ch
insd dword es:[edi], dx
mov esp, 0x8f9b2aef
call dword [ecx - 0x48]
and ebp, dword [ebp + ebp*2 + 0x32b2b4d4]
and al, 0xd6
imul edi, dword [ebx + 0x2f0b0e3f], 0x8eecc30a
xchg bl, ch
xor edi, dword [eax]
mov ebx, 0x2f0b0e3f
or al, bl
in al, dx
mov es, word [esi + 0x7833eb]
pushfd
cmp ch, byte [ebp + 0x59b73fd3]
mov esp, 0x7b866fd
sbb al, 0xca
pop ss
jmp [eax + 0x5ac14ebc]
rcr dword [edx - 0x6a], 0
lea eax, [esp + edi*4 + 0x50]
xchg esi, eax
add byte [ebp - 0xaf43bc], cl
not dword [eax + 0x3d01bc32]
xor eax, 0x46a0d072
xchg esi, eax
push edi
jl 0x43bf24
push edi
nop
xor bh, byte [ecx + eax - 0x2f8dcac3]
mov al, byte [0x7c579646]
stosd dword es:[edi], eax
add edi, dword [eax]
pop ebp
cmp eax, ebx
outsb dx, byte [esi]
dec ecx
test eax, 0xa7a44ace
out 0x59, al
jle 0x43bf46
or eax, 0x1809daba
js 0x43bfd5
xchg ecx, eax
mov ah, 0x23
xor ah, byte [ecx + 0x10]
aam 0x36
adc byte [ebp + 0x56], bl
mov al, byte [0xdf369b69]
test byte [edx - 0x19], 0x52
push 0x54caaf1b
dec edx
mov eax, 0xe6f8cb0c
push eax
jbe 0x43bf61
push ebx
lodsd eax, dword [esi]
cli
mov esp, 0x5a193ca7
push ecx
mov esp, 0x19b89d90
out 0x8c, eax
mov ch, 8
pop ecx
invalid
sbb al, 0x52
xor al, 0xe
xor cl, byte [ecx - 0x15f914f7]
bound edi, qword [esp + ebx*2 - 0x79]
adc eax, 0xe45e69b6
mov edx, 0xdcfc385a
push edi
invalid
Function at 0x464690
Capabilities:
Encode data using xor

Disassembly:
inc edi
xor edi, 0x25
in eax, 0xa0
pop ds
or cl, byte [ecx + 0x67]
sub eax, 0xc81dd463
xor dword [eax - 0x28], esi
xchg ecx, eax
sub esi, dword [ecx - 0x3c]
daa
sbb al, 0x89
sbb ebp, dword [ebp + ebx*4 - 0x30]
xchg dword [ebx + esi*2], edi
shr byte [esi - 0x301ed46c], cl
add cl, byte [ebx]
mov esp, 0xcc180424
add eax, 0x269cf6ad
fld st(6)
outsb dx, byte [esi]
les ebp, [eax + 6]
xor byte [eax], dl
cmpsb byte [esi], byte es:[edi]
push 0xffffffffffffff90
cmp ebx, dword [ebp + 0x4c65243b]
enter 0xffffffffffff835d, 0xe
js 0x464673
pop ebp
or dword [esi], 0x78
int 0xb8
insd dword es:[edi], dx
invalid
mov eax, 0xd28d666d
mov ecx, 0x1df69be6
mov esi, dword [ecx + 0x6a]
fild word [ecx]
sbb bh, cl
pushfd
xchg ebp, eax
shr byte ss:[ebp + 0x66], cl
dec edi
mov al, byte ss:[0x48be6356]
adc ecx, esi
call ecx
sbb al, 0x14
pop edx
insb byte es:[edi], dx
aad 0x78
jge 0x4646a1
mov es, ebx
jns 0x4646b5
cmp edx, esi
mov eax, 0x2d8b2e4b
xor dl, ch
lodsd eax, dword [esi]
sbb byte [ebx - 4], al
inc ebp
out dx, al
push esi
invalid
Function at 0x4662dd
Capabilities:
Encode data using xor

Disassembly:
sub ch, cl
dec ecx
adc edi, dword [eax]
adc cl, ch
mov dl, bl
ja 0x46630a
add al, 0x2c
mov byte [0x2370c651], al
jo 0x4662e9
scasb al, byte es:[edi]
and byte [ebx + edi*4 + 0x32], al
shr byte [ebp - 0x11], 0x42
xor al, al
insd dword es:[edi], dx
out dx, eax
inc edx
push ebx
xor al, 0x2e
jl 0x4662ca
mov eax, 0xf08247d4
cmp esp, eax
pop ebp
int3
outsd dx, dword [esi]
imul esp, esi, 0xffffff97
adc ebp, dword [ebx + 0x78]
pop ss
xchg edi, eax
sub dword [0x36198268], esi
sbb byte [ecx], 0x36
dec ebx
inc ebp
call dword [ecx]
jns 0x4662bd
retf
jmp 0x6681c5b1
cmp esp, dword [esi - 0x7a]
inc ecx
jne 0x466344
fdiv st(3), st(0)
in eax, dx
lodsb al, byte [esi]
cli
xchg esi, eax
stc
js 0x4662b7
dec eax
les ebp, [edx + edi - 0x5b]
jne 0x46638a
jg 0x4662c4
mov eax, 0x30e6734c
dec ebp
pop ss
dec esp
jae 0x4662f5
xor byte [ebp + 0x17], cl
mov dword [ebx], ebx
jnp 0x4662f1
mov dh, 0xbd
jb 0x4662b4
dec dword [ebx]
jle 0x46633b
sbb ebp, ebp
in eax, dx
xor byte [esi - 0x39], dh
inc ebp
add cl, byte [edi - 0x2e731195]
salc
xor ah, dh
xor dl, byte [0x9436e030]
push ecx
out 0xfd, al
cmp ecx, dword [ebx - 0x2f]
xor byte [ecx + ecx - 0x1c], ch
invalid
insb byte es:[edi], dx
or esp, esp
xor byte [eax], al
stc
inc ebp
push esi
mov dl, 0x59
pop ecx
sal bl, 0x1c
sub edi, eax
and byte [ebx + 0x42], cl
in eax, dx
jbe 0x466366
neg dword gs:[ecx + 0x1d]
js 0x4662fe
enter 0xfffffffffffff399, 0xffffffffffffff9b
jns 0x466320
pop ebx
cmp al, 0x34
pop ecx
movsb byte es:[edi], byte [esi]
mov cl, 0xf9
out 0x5c, al
cmp byte [esi - 0x7b], 0x89
jge 0x4663a9
jle 0x4662ed
mov dword [ebp + 0x3e], edi
mov edi, 0xffe5fa07
popal
out 0x5a, eax
aam 0x68
popfd
imul ecx, esi, 0x73
in eax, dx
inc esp
mov dl, 0x2b
out dx, eax
sub edi, dword [eax]
jnp 0x466326
out 0x5e, eax
sub edx, dword [esp + ebx*8 + 0x22e57a9b]
adc dword [eax], ecx
std
and dl, byte [ecx]
or ch, bh
fiadd dword [edi]
imul esi, dword [edi], 0xdde4ff4a
adc dword [edx - 0x177f84f7], eax
imul ebp, dword [ebx - 0x4a96f6b3], 0x69
jnp 0x466341
loop 0x4663c6
push ds
enter 0x2932, 0x39
pop esi
in eax, dx
test dword [eax - 0x27], ecx
pop edx
xlatb
mov bh, 0x29
add dl, bl
movsd dword es:[edi], dword [esi]
test dword [ebp - 0x203f268e], esp
cmp esi, ebp
pop ds
sbb eax, 0x5f864800
pop edi
int 0x35
invalid

Function at 0x46cf58
Capabilities:
Encode data using xor

Disassembly:
rcl byte [edi]
and dh, byte [ecx + 0x3f]
cdq
or bl, byte [esi*4 - 0x456542d4]
cwde
lahf
cmp byte [eax], bh
das
xchg ch, cl
fstp xword [edx + 0x52]
mov edx, 0x8eba8034
xchg esi, eax
dec ecx
mov dl, 0xd0
pop edx
mov al, 0x88
scasb al, byte es:[edi]
add ecx, esi
cmp al, bh
rcr byte [edx - 0x50], 1
mov byte [esi - 0x38c50eff], ch
and byte [eax - 0x5ca274d8], 0x36
and al, 0xe9
xor esp, ebx
pushfd
add eax, 0x12ef4506
mov dl, 0x34
mov edi, 0xf77d6383
lahf
xor byte [edi + 0x21], bl
jne 0x46cf78
mov dh, 0xc1
adc al, 0xc4
mov esp, 0x528e7cb4
ret
Function at 0x47c1f0
Capabilities:
Encode data using xor

Disassembly:
xchg bl, ah
pop ebx
mov dword [ebx + 0x17], edi
aam 0x66
invalid
jbe 0x47c186
sbb dword [edi], edi
clc
fstp st(1)
sbb ch, byte [esi + 0x42e53c74]
in eax, 0x42
test al, 0x4e
out dx, eax
or ch, al
sar byte [ecx - 0x1222128], 1
jbe 0x47c230
and al, 0x9f
dec ecx
stosb byte es:[edi], al
cmp byte [edi], bh
cld
outsb dx, byte [esi]
xor ebp, esi
inc esi
movaps xmm1, xmmword [esi - 0x36078b4a]
lcall 0x6ca3, 0x76badaa7
cmpsd dword cs:[esi], dword es:[edi]
bound edi, qword [ebp + 0x5bc36602]
arpl ax, ax
fmul st(2)
test dword [esp + ebp*2 + 0x34], esp
scasd eax, dword es:[edi]
insb byte es:[edi], dx
xor al, 0xaf
test byte [edx - 0x297396], cl
jnp 0x47c1fb
fbstp tbyte [ecx + 0x1ddd9a79]
push 0x39cc3bc5
popfd
cmp dh, cl
cdq
xlatb
dec eax
fnstsw word [eax]
xor dl, byte [eax - 0x50]
lcall 0x49d9, 0xb068beaf
mov edi, 0xa090ece7
mov eax, 0x6cc050ce
mov edx, 0x4fa88e59
xor edx, ecx
shr dword [ecx - 0x31765910], 1
invalid

Function at 0x4b835e
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x696c5a9e
cmpsb byte [esi], byte es:[edi]
jg 0x4b83b3
fsubr qword [edx + 0x70]
sbb esp, dword [edx - 0x4a8d1b7]
out 0x81, eax
stc
sbb dh, byte [esi + 0x44]
dec edx
inc ebx
test ah, cl
nop
cmp dword [ebx], esp
setnp byte [edi + 0x6b]
cmp edx, dword [ecx + 0x596a3b98]
invalid
insd dword es:[edi], dx
dec edx
mov word [ebx - 0x40], gs
mov cl, 0x95
pop ss
push 0xe69ccac2
fcmovnb st(0), st(7)
or al, 0x46
mov ebp, 0x755045f3
mov bl, 0xe8
pushfd
rol edx, 0xca
mov byte [0xca34f389], al
ficomp dword [edx - 0xd192809]
ja 0x4b843b
mov byte [0x6b0cfbbc], al
sbb byte [ebx + 0x48345596], 5
ljmp 0x8bd3
pop ds
insb byte es:[edi], dx
sal dword [eax], 0x95
jb 0x4b848b
ret
dec edx
pop eax
pop es
scasd eax, dword es:[edi]
push ecx
in al, 0xb4
push ss
daa
out dx, eax
inc ecx
mov edx, 0x290f3e19
ljmp 0xa79a
sub ebp, dword [edi]
orps xmm2, xmm6
mov dl, 0xe1
sahf
sub ebx, dword [esi + ecx + 0x2e7ca73e]
mov eax, 0xc2996855
cmp al, 0x3b
loopne 0x4b8461
sti
mov dl, 0x90
push esi
mov cl, 0xbf
adc dword [eax], esp
dec ecx
dec ebx
jg 0x4b8489
mov ebx, 0x80065d25
imul edi, dword [0x908574d6], 0x65
rcr byte [ecx - 0x2b705727], 0xc7
sal dword [edx + 0x75f5db12], 0x76
sbb al, 0xd5
sub al, 0xcd
push 0xcf418b17
pop edi
inc ecx
not dword [ebp - 0x90b0584]
invalid
Function at 0x4b8efe
Capabilities:
Encode data using xor

Disassembly:
adc ecx, esi
and eax, dword [eax]
pop ebx
jb 0x4b8d96
xor eax, 0x19aee4ea
sub al, 0x9a
dec ebp
or bh, bh
cmp ah, bh
mov ecx, 0x7fcb2842
ret 0x6b64
out 0xaf, al
inc edx
xor dword [ebx + 0x75], esi
stosd dword es:[edi], eax
jne 0x4b8df7
lodsb al, byte [esi]
loope 0x4b8e47
add eax, 0x8e195260
sbb dl, byte [eax - 0x1d10b23c]
insd dword es:[edi], dx
sbb dword [ebp - 0x772fbe07], ecx
fnsave dword [esi + eax*8 - 0x16]
lcall 0x558c, 0x6fb1b563
jne 0x4b8ea1
add eax, 0x41f2fc8c
sub bh, byte [edx - 0x5d]
jp 0x4b8e2d
push ebp
imul ebx, dword [ebx], 0x2b4efb22
or dl, byte [edx]
add esp, dword [edx - 0x3785fe48]
mov byte cs:[0x6a4bf845], al
das
mov edi, 0xe913cf16
jae 0x4b8e7f
or ch, byte [esi - 0x59]
inc eax
invalid
scasb al, byte es:[edi]
sub al, byte [ebx]
adc dword [edi - 5], edx
aas
add eax, 0x2269efaa
mov ebp, 0xdab24680
sahf
and ah, byte [edx]
or byte [edi + 0x70], bl
nop
and cl, byte [eax]
pop edi
jo 0x4b8e4a
mov al, byte gs:[0x6e30b3ae]
fdivr qword [esi]
int 0x80
xor edi, 0xa8acd181
out dx, eax
std
invalid
mov al, byte [ebx + esi]
mov byte [edi - 3], al
mov al, byte [ebx + esi + 1]
mov byte [edi - 2], al
mov al, byte [ebx + esi + 2]
mov byte [edi - 1], al
sub ecx, 1
jne 0x4b8eb5
emms
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x4ba541
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2378
cmp edx, dword [eax]
je 0x4ba563
add eax, 8
inc ecx
cmp eax, 0x4c2408
jl 0x4ba554
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2378]
jne 0x4ba691
mov eax, dword [0x4c6cfc]
cmp eax, 1
je 0x4ba66b
test eax, eax
jne 0x4ba594
cmp dword [0x4c22a4], 1
je 0x4ba66b
cmp edx, 0xfc
je 0x4ba691
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba5cb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baf20
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb3b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba60e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb3b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf99c
push edi
call fcn.004bd280
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baf20
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baf30
lea eax, [ebp - 0xa0]
push 0x4bf97c
push eax
call fcn.004baf30
push dword [esi + 0x4c237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baf30
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd1f4
add esp, 0x2c
pop edi
jmp 0x4ba691
lea eax, [ebp + 8]
lea esi, [esi + 0x4c237c]
push 0
push eax
push dword [esi]
call fcn.004bb3b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x224c7f3f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1e724e04
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x409e1d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [ecx]
or edx, 0xffffffff
test al, al
je 0x409e4a
push esi
movzx eax, al
push 7
xor edx, eax
pop esi
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
dec esi
jns 0x409e2f
inc ecx
mov al, byte [ecx]
test al, al
jne 0x409e27
pop esi
not edx
mov eax, edx
ret
Function at 0x41115c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
mov eax, ecx
mov word [ebp - 0x15], 0x3433
push edi
push 8
pop ecx
lea ebx, [eax + 0x4c]
mov dword [ebp - 0x10], 0x62613938
mov esi, ebx
mov dword [ebp - 0xb], 0x666564
lea edi, [ebp - 0x38]
mov word [ebp - 0x12], 0x3736
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov word [ebp - 0x18], 0x3130
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x13], 0x35
call fcn.0041127c
push 0xf
xor edx, edx
xor esi, esi
pop edi
mov ecx, dword [ebx]
lea edx, [edx + 8]
mov eax, ecx
shr eax, 0x1c
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x8c], al
mov eax, ecx
shr eax, 0x18
and eax, edi
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x8b], al
mov eax, ecx
shr eax, 0x14
and eax, edi
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x8a], al
mov eax, ecx
shr eax, 0x10
and eax, edi
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x89], al
mov eax, ecx
shr eax, 0xc
and eax, edi
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x88], al
mov eax, ecx
shr eax, 8
and eax, edi
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x87], al
mov eax, ecx
shr eax, 4
and ecx, edi
and eax, edi
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x86], al
mov al, byte [ebp + ecx - 0x18]
mov byte [ebp + edx - 0x85], al
mov eax, dword [ebp + esi*4 - 0x38]
inc esi
mov dword [ebx], eax
lea ebx, [ebx + 4]
cmp esi, 8
jl 0x4111b3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x84]
push eax
mov byte [ebp + edx - 0x84], 0
call fcn.00485c61
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41ce1a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov word [ebp - 6], 0x4579
xor ebx, ebx
mov dword [ebp - 0xf], 0x4c64616f
mov dword [ebp - 0xb], 0x61726269
mov word [ebp - 3], 0x57
mov byte [ebp - 7], 0x72
mov byte [ebp - 4], 0x78
mov byte [ebp - 0x10], 0x4c
call fcn.0065e966
mov ecx, eax
call fcn.0065e996
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.00423229
test eax, eax
je 0x41ce70
push 0x60
push ebx
push esi
call eax
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42175b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor ebx, ebx
call fcn.0065e966
mov ecx, eax
call fcn.0065eb4b
mov dword [ebp - 7], 0x676f6c61
mov word [ebp - 0xc], 0x6e45
mov byte [ebp - 3], bl
mov word [ebp - 9], 0x6944
mov byte [ebp - 0xa], 0x64
test eax, eax
je 0x4217aa
lea edx, [ebp - 0xc]
mov ecx, eax
call fcn.00423229
test eax, eax
je 0x4217aa
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x423229
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x72c558]
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov esi, edx
push edi
mov edi, ecx
test eax, eax
jne 0x423275
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 9], 0x72646441
mov dword [ebp - 5], 0x737365
mov dword [ebp - 0xe], 0x6f725074
mov byte [ebp - 0xa], 0x63
mov word [ebp - 0x10], 0x6547
call fcn.0065e213
mov dword [0x72c558], eax
pop ecx
test eax, eax
je 0x42327b
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x423289
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x72c554]
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
mov esi, ecx
test eax, eax
jne 0x4232df
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x13], 0x6f4d7465
mov word [ebp - 0xc], 0x4865
mov dword [ebp - 9], 0x656c646e
mov word [ebp - 0xf], 0x7564
mov word [ebp - 5], 0x57
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xd], 0x6c
call fcn.0065e213
mov dword [0x72c554], eax
pop ecx
test eax, eax
je 0x4232e4
push esi
call eax
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b64d
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], vtable.CMD5Checksum.0
push eax
call fcn.006290e0
and dword [esi + 0x48], 0
add esp, 0xc
and dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret
Function at 0x47986e
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
movsx eax, dl
mov edx, 0xff
mov esi, dword [edi]
xor eax, esi
and eax, edx
shr esi, 8
mov eax, dword [eax*4 + 0x6e3e30]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, edx
xor eax, dword [ecx*4 + 0x6e3e30]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x4798bf
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test edx, edx
jne 0x4798cc
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x479984
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x6e3e30]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x6e3e30]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x6e3e30]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x6e3e30]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x6e3e30]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x6e3e30]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x6e3e30]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x6e3e30]
dec edi
jne 0x4798e7
pop edi
test esi, esi
je 0x47999d
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x6e3e30]
inc edx
dec esi
jne 0x479988
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x47c469
Capabilities:
Check http status code

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
mov edx, 0x6e4690
lea ecx, [ebp - 8]
xor ebx, ebx
call fcn.00401367
sub esp, 0x18
mov ecx, esp
push dword [eax]
call fcn.00484ec6
xor eax, eax
mov ecx, edi
inc eax
push eax
push 0x1bb
call fcn.0047cd3a
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.004846da
cmp byte [edi], bl
je 0x47c583
mov edx, 0x6e46d0
lea ecx, [ebp - 0xc]
call fcn.00401367
xor edx, edx
lea ecx, [ebp - 0x2c]
mov esi, dword [eax]
call fcn.0047cc2a
cmp dword [eax + 0x14], 8
jb 0x47c4d5
mov eax, dword [eax]
push ecx
push 0x4883000
push ecx
push ecx
mov ecx, dword [edi + 8]
mov edx, eax
push esi
push 0x6d8b04
call fcn.0042016e
add esp, 0x18
lea ecx, [ebp - 0x2c]
mov esi, eax
xor eax, eax
inc eax
push ebx
push eax
call fcn.00484d07
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.004846da
test esi, esi
je 0x47c57c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.0042010d
or dword [ebp - 4], 0x180
lea eax, [ebp - 4]
add esp, 4
mov ecx, esi
push eax
push 0x1f
pop edx
call fcn.00423418
push ebx
push ebx
push ebx
xor edx, edx
mov ecx, esi
call fcn.004201db
add esp, 0x10
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
mov edx, 0x20000013
mov ecx, esi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00423a53
add esp, 0xc
movzx ebx, bl
cmp dword [ebp - 8], 0xc8
push 1
pop ecx
cmove ebx, ecx
mov ecx, esi
call fcn.004239fa
mov ecx, edi
call fcn.0047cd0f
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x484efc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x484f13
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x484f4c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x484f48
cmp esi, ecx
jae 0x484f4c
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x484f38
cmp esi, ecx
jb 0x484f50
xor eax, eax
jmp 0x484f5a
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x48809a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 4], 0
je 0x4880cc
push esi
xor esi, esi
cmp dword [edx + 0x3cc], esi
jle 0x4880cb
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, ecx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, dword [edx + 0x3cc]
jl 0x4880bb
pop edi
pop esi
pop ebp
ret 8