joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x592b24]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x461a70
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
nop
mov dword [esp], ecx
call fcn.004099c0
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x461a59
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call fcn.004314c0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
call fcn.00431ba0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
call fcn.00431ba0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x4619e0
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call fcn.00453ec0
mov eax, dword [0x592c10]
test eax, eax
jne 0x4619c7
mov eax, dword [esp + 0x20]
jmp 0x4619d5
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
call fcn.00464ef0
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x461a17
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call fcn.00453ec0
mov eax, dword [0x592c10]
test eax, eax
jne 0x461a02
mov eax, dword [esp + 0x20]
jmp 0x461a10
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x78]
call fcn.00464ef0
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409bc0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x461a3d
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00431980
mov eax, dword [esp + 0x10]
test eax, eax
je 0x461a55
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00431980
add esp, 0x1c
ret
lea eax, [0x4d0015]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00437190
nop
call fcn.00463af0
jmp fcn.00461910
Function at 0x464da0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x592d00]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46352b
je 0x46357e
cmp ebx, 0x20
jbe 0x463584
cmp ebx, 0x40
jbe 0x4635ca
jmp 0x46366b
test ebx, ebx
je 0x463574
add eax, 0x10
test ax, 0xff0
je 0x463560
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4ed300]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4ed400]
jmp 0x463548
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x463548
pxor xmm1, xmmword [0x592d10]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x592d10]
pxor xmm2, xmmword [0x592d20]
pxor xmm3, xmmword [0x592d30]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x592d10]
pxor xmm2, xmmword [0x592d20]
pxor xmm3, xmmword [0x592d30]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4636ca
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x592a06], 0
je 0x464dba
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4634f0
jmp fcn.004083a0
Function at 0x464dc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x592b24]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40331c
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004083a0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00463af0
jmp 0x4032e0
cmp byte [0x592a06], 0
je 0x464ddb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x4634f0
jmp 0x4032e0

Function at 0x465c40
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x465c5a
mov ecx, 0x14
jmp 0x465c63
shl ecx, 2
add ecx, 0xe10
mov dword [0x592b24], ecx
ret
Function at 0x48e360
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x592b24]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48e54a
sub esp, 0x48
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 0xa]
mov edx, dword [0x56a1d4]
movzx ebx, word [eax + 0xc]
movzx ebp, word [eax + 8]
movzx esi, word [eax + 2]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], edx
call fcn.0048b050
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.0046558e
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.0046558e
call fcn.00489df0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x93a80
call fcn.0045df30
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x48e437
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x48e451
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x48e4c8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x48e49e
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x48e49a
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x48e493
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x48e4a0
mov ebx, 0x1d
jmp 0x48e4be
mov ebp, eax
jmp 0x48e4a0
mov ebp, eax
cmp ebp, 0xd
jae 0x48e53d
lea eax, [ebp - 1]
lea edx, [0x563560]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x48e533
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x48e4c8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x48e4fa
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x48e502
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], eax
add esp, 0x48
ret
mov ecx, 0xd
call fcn.00464f50
mov eax, ebp
mov ecx, 0xd
call fcn.00464f50
nop
call fcn.00463af0
jmp fcn.0048e360
Function at 0x4a1f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x592b24]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a2031
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [esp + 0x24]
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x18], ecx
xor eax, eax
jmp 0x4a1f7c
mov ebx, dword [esp + 0xc]
inc ebx
mov ecx, dword [esp + 0x18]
mov eax, ebx
cmp eax, 4
jge 0x4a1fb5
mov dword [esp + 0xc], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.004693e0
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x28]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4a1f71
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x4a1fbf
inc eax
cmp eax, 4
jge 0x4a1fd4
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
xor esi, esi
jmp 0x4a202a
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00469420
mov byte [esp + 0x2c], 0
add esp, 0x1c
ret
mov edi, ebp
and edi, 0xff
xor edx, edi
shr ebp, 8
mov edi, ebx
shl edi, 0x18
mov dword [esp + 0x10], edi
mov eax, edx
mov edi, 0x1b3
mul edi
inc esi
mov edi, dword [esp + 0x10]
or ebp, edi
shr ebx, 8
mov edx, eax
mov eax, dword [esp + 0x14]
cmp esi, 8
jl 0x4a1ffb
jmp 0x4a1fbe
call fcn.00463af0
jmp fcn.004a1f40
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x58a873e8
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..pdata_1
mov ebx, 0x42e3d0
nop
mov ecx, 0x6b663631
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4a5a6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push pe_nt_image_headers32
call fcn.004c0adc
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x4e5a32
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push pe_nt_image_headers32
call fcn.004c0adc
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x4e5a32
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 4]
xor eax, 0x12476359
mov dword [ebp + 4], eax
push eax
mov eax, dword [ebp]
xor eax, 0x97815643
mov dword [ebp], eax
push eax
mov ebx, dword [ebp - 4]
call fcn.004a5a4d
mov eax, 0
cmp eax, ecx
jl 0x4a5b05
push 0x20b
push 0x4011022
push 1
call fcn.004c0af4
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
call fcn.004a5a4d
mov eax, 0
cmp eax, ecx
jl 0x4a5b38
push 0x234
push 0x4011022
push 1
call fcn.004c0af4
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x4a5b4e
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x4a5b76
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x4a5b70
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x4a5b8f
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x1bc
call fcn.004c19d0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4a5beb
push ebx
call fcn.004c0ad6
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x4a5c00
push eax
pushfd
mov eax, dword [esp + 8]
xor eax, 0x97815643
mov dword [ebp], eax
mov eax, dword [esp + 0xc]
xor eax, 0x12476359
mov dword [ebp + 4], eax
xchg dword [esp + 4], eax
popfd
pop eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.004c0ad6
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.004c0ad6
add esp, 4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c2450
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4c246e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4c2463
pop esi
ret

Function at 0x4c5b0a
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004c5b89
jae 0x4c5b16
xor ecx, ecx
call fcn.004c5b89
jae 0x4c5b40
xor eax, eax
call fcn.004c5b89
jae 0x4c5b51
mov al, 0x10
call fcn.004c5b89
adc al, al
jae 0x4c5b32
jne 0x4c5b7e
stosb byte es:[edi], al
jmp 0x4c5b17
call fcn.004c5b95
dec ecx
loop 0x4c5b5d
mov eax, ebp
call fcn.004c5b93
jmp 0x4c5b7f
lodsb al, byte [esi]
shr eax, 1
je 0x4c5ba5
adc ecx, 2
mov ebp, eax
jmp 0x4c5b7f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004c5b93
cmp eax, 0x7d00
jae 0x4c5b7d
cmp eax, 0x500
jae 0x4c5b7e
cmp eax, 0x7f
ja 0x4c5b7f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4c5b17
pop ebp
ret 8

Function at 0x503f49
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.006447ba

Function at 0x52c20f
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
mov eax, dword [eax + 4]
test edi, 0x66113c46
cmp eax, 0x42792bda
add eax, 8
push eax
call fcn.004c0adc
pop ecx
pop esi
mov bx, dx
xchg bx, di
mov edi, eax
movsx ebx, cx
bswap bx
mov bx, 0x331a
rep movsb byte es:[edi], byte [esi]
not bl
sete bl
bswap esi
pop edi
pop esi
movzx cx, ah
stosd dword es:[edi], eax
bswap cx
movsx ebx, bp
cbw
mov ecx, 3
movsx ebx, cx
rep movsd dword es:[edi], dword [esi]
pop eax
sbb edi, edi
pop edi
mov dword [edi], eax
rcl bh, cl
shr ebx, cl
cmp ebp, eax
mov ebx, dword [ebp - 0x70]
clc
push ebx
cmp edi, 0x29803894
jmp 0x52af80
add ebx, 4
stc
clc
push ebx
test sp, 0x440e
mov ebx, dword [ebx]
test ebx, ebx
je 0x52afa0
push ebx
call fcn.004c0ad6
add esp, 4
xchg bl, bl
pop ebx
call fcn.004c0ad6
add esp, 4
cwde
not ax
push dword [esp + 0x30]
popfd
lea esp, [esp + 0x40]
call fcn.00507963
stosd dword es:[edi], eax
movzx ax, cl
lodsd eax, dword [esi]
push esi
clc
cmc
push edi
clc
test sp, bx
test eax, 0x3e303414
test eax, eax
je 0x521482
push eax
jmp 0x52144e

Function at 0x57caac
Capabilities:
Authenticate hmac

Disassembly:
mov dword [ebp - 4], 0
jmp 0x60311b
stosd dword es:[edi], eax
lodsd eax, dword [esi]
jmp 0x5dc5fa
push ebp
mov ebp, esp
sub esp, 0x98
jmp 0x54aaf7
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x54924d
stosd dword es:[edi], eax
jmp 0x5de78d
mov dword [ebp - 0xc], 0
jmp 0x5922fb
push 8
call fcn.004c0adc
add esp, 4
xchg di, si
movsx edi, cx
mov dword [ebp - 8], eax
movsx esi, bp
mov edi, eax
cbw
mov esi, 0x4c523e
movsx ax, dh
lodsd eax, dword [esi]
jmp 0x57a869
Function at 0x6459aa
Capabilities:
Authenticate hmac

Disassembly:
push esi
pushfd
mov esi, 0x149741e
call fcn.005dc3ea
Function at 0x66e1b2
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
xor dword [esp + 0xc], 0x1b9e1148
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.005dca05
push esi
jne 0x580e59
cmc

Function at 0x678693
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x20]
call fcn.00548b0b

Function at 0x67a071
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp + 4], 0xfd091814
pushfd
call fcn.004a6bf7
Function at 0x40320a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 0x20019
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
push 0x80000002
mov byte [ebp - 1], bl
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403294
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0x10]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], ebx
push dword [ebp - 8]
mov dword [ebp + 0x10], ebx
call esi
test eax, eax
jne 0x40328a
cmp dword [ebp + 0x10], ebx
jbe 0x40328a
cmp dword [ebp + 8], 4
jne 0x40328a
cmp dword [ebp + 0x10], 4
jne 0x40328a
lea eax, [ebp + 0x10]
push eax
push edi
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x40328a
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret 0xc

Function at 0x4032a2
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
push 0x4011d0
rep stosd dword es:[edi], eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x4032ed
push 0x4011bc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4032e2
lea ecx, [ebp - 0x24]
push ecx
call eax
inc bl
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, bl
jne 0x4032f7
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
pop edi
pop esi
pop ebx
test eax, eax
je 0x403318
cmp eax, 6
je 0x403314
cmp eax, 9
je 0x403310
xor eax, eax
leave
ret
push 4
jmp 0x40331a
push 2
jmp 0x40331a
push 8
pop eax
leave
ret
Function at 0x403322
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x411090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push 0
push eax
mov dword [ebp - 0x110], edi
call fcn.00405a80
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec eax
lea ebx, [esi - 2]
cmp eax, ebx
ja 0x403404
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403379
sub eax, edx
lea edi, [eax + 0x105]
lea eax, [edi + 8]
cmp eax, 0x400
ja 0x4033a0
call fcn.00405a40
mov eax, esp
push 0xcccc
jmp 0x4033ac
push 0xdddd
push eax
call fcn.0040594e
pop ecx
push eax
call fcn.00403015
push dword [ebp - 0x110]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x108]
push eax
push 0x4011e0
push edi
push dword [ebp - 0x10c]
call fcn.004058d7
add esp, 0x14
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [ebp - 0x10c]
mov edi, eax
call fcn.00403032
pop ecx
test edi, edi
je 0x4033fe
mov eax, edi
jmp 0x40349f
mov edi, dword [ebp - 0x110]
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00405a80
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec eax
cmp eax, ebx
ja 0x403498
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40342e
sub eax, edx
lea esi, [eax + 0x105]
lea eax, [esi + 8]
cmp eax, 0x400
ja 0x403455
call fcn.00405a40
mov eax, esp
push 0xcccc
jmp 0x403461
push 0xdddd
push eax
call fcn.0040594e
pop ecx
push eax
call fcn.00403015
mov ebx, eax
push edi
lea eax, [ebp - 0x108]
push eax
push 0x4011e0
push esi
push ebx
call fcn.004058d7
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
mov esi, eax
call fcn.00403032
pop ecx
test esi, esi
je 0x403498
mov eax, esi
jmp 0x40349f
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea esp, [ebp - 0x11c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a1d
leave
ret 4

Function at 0x405a1d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411090]
jne 0x405a27
repz ret
jmp fcn.00409ede