joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1447188
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0xe
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x188]
mov esi, 0x42abd0
push ebx
sub esp, 0x18c
mov eax, dword [0x428240]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x157]
mov esi, 0x42abde
mov ecx, 0x3f
rep movsb byte es:[edi], byte [esi]
add eax, 0x53a0e9fd
mov dword [0x4282b8], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x14471c9
xor esi, esi
xor ecx, ecx
mov edi, 0x3e
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x157]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x14471e1
mov edx, 0x42c800
mov ecx, 0x15a
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x1447256
add ecx, eax
cmp ecx, 0x18a0
jbe 0x1447228
call fcn.0144fb88
imul eax, dword [0x428240], 0xfdf97e9c
mov dword [0x428240], eax
call fcn.01451940
mov ebx, dword [0x428240]
xor edi, edi
xor esi, esi
xor ecx, ecx
inc ecx
movzx ecx, cl
mov dl, byte [ebp + ecx - 0x118]
lea eax, [edx + esi]
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
mov eax, ebx
mov byte [ebp + esi - 0x118], dl
add dl, byte [ebp + ecx - 0x118]
add eax, 0x693813fc
movzx edx, dl
imul ebx, eax, 0x3716d411
mov dl, byte [ebp + edx - 0x118]
xor dl, byte [ebp + edi - 0x188]
inc edi
mov byte [edi + ebp - 0x17b], dl
cmp edi, 0xe
jne 0x1447262
mov dword [0x4282b8], eax
imul eax, eax, 0x980b0019
lea edi, [ebp - 0x16c]
mov esi, 0x4140e0
mov byte [ebp - 0x16c], 0
mov ecx, 5
mov edx, 0x428ae0
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x7f5
mov dword [0x428240], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x1447313
add ecx, eax
cmp ecx, 0x90f
jbe 0x14472ed
call fcn.01451f80
imul eax, dword [0x428240], 0x672d258a
mov dword [0x428240], eax
imul eax, dword [0x428240], 0xf17e7fe3
xor esi, esi
mov edi, 0x70
mov dword [0x4282b8], eax
or eax, 0x4f10329
mov dword [0x428240], eax
mov dword [esp], eax
call dword [0x42e0d8]
push eax
call fcn.0144fbe0
mov eax, 0x428ae0
mov bl, byte [eax]
lea edx, [ebx - 0x30]
cmp dl, 9
ja 0x1447354
inc eax
jmp 0x1447347
mov eax, dword [0x4282b8]
or eax, 0xfcb52f28
mov dword [0x428240], eax
call fcn.0144fb88
sub edi, dword [ebp + esi*4 - 0x16c]
inc esi
cmp esi, 5
jne 0x1447342
lea eax, [ebp - 0x17a]
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1c8c
mov dword [esp], 0x41efc0
call fcn.0144a580
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x14473a0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x11
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x150]
mov esi, 0x42aa5c
push ebx
sub esp, 0x16c
mov eax, dword [0x428034]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x12e]
mov esi, 0x42aa6d
mov ecx, 0x16
rep movsb byte es:[edi], byte [esi]
and eax, 0x78af39ce
or eax, 0x58a02942
mov dword [ebp - 0x15c], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x14473e7
xor esi, esi
xor ecx, ecx
mov edi, 0x15
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x12e]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x14473ff
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
xor edx, edx
xor edi, edi
xor eax, 0xb131c937
sub eax, 0x5f4b94b8
mov dword [0x428034], eax
lea eax, [edi + 1]
mov dword [ebp - 0x160], ecx
movzx edi, al
mov bl, byte [ebp + edi - 0x118]
add edx, ebx
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
mov dword [ebp - 0x15c], edx
mov byte [ebp + edi - 0x118], al
mov eax, dword [0x428034]
or eax, 0x8bd02389
xor eax, 0xded44560
mov dword [0x428034], eax
mov dword [esp], 0x42aa3f
call dword [0x42e0b4]
push ecx
mov dword [esp], 0xd24
call dword [0x42e0ac]
push esi
mov edx, dword [ebp - 0x15c]
mov esi, eax
imul esi, esi, 0x93bc8d68
mov ecx, dword [ebp - 0x160]
mov byte [ebp + edx - 0x118], bl
mov al, byte [ebp + edi - 0x118]
add eax, ebx
add esi, 0x44205f20
lea ebx, [ebp - 0x13f]
movzx eax, al
xor esi, 0xe6d617ee
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + ecx - 0x150]
mov dword [0x428034], esi
mov byte [ebp + ecx - 0x13f], al
inc ecx
cmp ecx, 0x11
jne 0x1447457
mov byte [ebp - 0x12e], 0
xor eax, eax
cmp byte [eax + 0x42d400], 0
je 0x1447557
inc eax
cmp eax, 0x1f86
jne 0x144751a
mov dword [esp], esi
imul esi, esi, 0x32f01865
mov dword [esp + 0xc], 0x42d400
mov dword [esp + 8], 0x42c2c0
mov dword [esp + 4], 0x42dbe0
call fcn.01450208
mov dword [0x428034], esi
mov eax, dword [0x428034]
sub eax, 0x479fcfb0
and eax, 0x5964bd75
imul eax, eax, 0xa21cdade
or eax, 0x11cca0d3
imul eax, eax, 0xf817da99
mov dword [0x428034], eax
mov dword [esp], 0x247
call dword [0x42e0dc]
push edx
sub eax, 0x50a61700
mov dword [0x428034], eax
mov dword [esp], 0x42c2c0
call fcn.0144f47c
sub dword [0x428034], 0x15061cf1
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x11
mov dword [esp + 4], 0x2078
mov dword [esp], 0x420c60
call fcn.0144a580
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x144c1f8
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x200
mov ebx, dword [ebp + 0x10]
mov eax, ecx
mov byte [ebp + ecx - 0x10c], cl
cdq
idiv dword [ebp + 0x14]
mov al, byte [ebx + edx]
mov byte [ebp + ecx - 0x20c], al
inc ecx
cmp ecx, 0x100
jne 0x144c209
xor ebx, ebx
xor edx, edx
mov esi, 0x100
movzx eax, byte [ebp + ebx - 0x10c]
mov ecx, eax
add eax, edx
movzx edx, byte [ebp + ebx - 0x20c]
add eax, edx
cdq
idiv esi
mov al, byte [ebp + edx - 0x10c]
mov byte [ebp + edx - 0x10c], cl
mov byte [ebp + ebx - 0x10c], al
inc ebx
cmp ebx, 0x100
jne 0x144c232
xor esi, esi
xor ebx, ebx
xor ecx, ecx
mov edi, 0x100
cmp esi, dword [ebp + 0xc]
jge 0x144c2cc
lea eax, [ebx + 1]
cdq
idiv edi
movzx eax, byte [ebp + edx - 0x10c]
mov ebx, edx
add eax, ecx
cdq
idiv edi
mov al, byte [ebp + edx - 0x10c]
mov ecx, edx
mov dl, byte [ebp + ebx - 0x10c]
mov byte [ebp + ecx - 0x10c], dl
mov edx, dword [ebp + 8]
mov byte [ebp + ebx - 0x10c], al
add al, byte [ebp + ecx - 0x10c]
movzx eax, al
mov al, byte [ebp + eax - 0x10c]
xor al, byte [edx + esi]
mov edx, dword [ebp + 0x18]
mov byte [edx + esi], al
inc esi
jmp 0x144c274
add esp, 0x200
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1450264
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ecx, 0x688
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edx, esi
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x1450292
add ecx, eax
cmp ecx, 0x1ff4
jbe 0x145027d
lea eax, [ebx - 0x26564bf7]
mov dword [0x427f2c], eax
mov eax, ebx
and eax, 0x43fb9d84
mov dword [esp], eax
call dword [0x42e0b0]
push edx
mov edx, esi
mov ax, word [edx]
sub eax, 0x30
cmp ax, 9
ja 0x14502c1
add edx, 2
jmp 0x14502b0
mov eax, ebx
and eax, 0x8b1c86be
mov dword [0x427f2c], eax
mov dword [esp], 0x26eb
call dword [0x42e0dc]
mov edx, esi
push eax
mov ax, word [edx]
sub eax, 0x30
cmp ax, 9
ja 0x14502ee
add edx, 2
jmp 0x14502dd
mov edx, 0x2201
movzx eax, word [esi]
add esi, 2
test ax, ax
je 0x1450308
add edx, eax
cmp edx, 0x6e9
jbe 0x14502f3
mov edx, edi
mov ecx, 0x14df
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x1450324
add ecx, eax
cmp ecx, 0x63e
jbe 0x145030f
lea eax, [ebx + 0x6d1ae1d]
mov edx, 0x139e
mov dword [0x427f2c], eax
movzx eax, word [edi]
add edi, 2
test ax, ax
je 0x1450349
add edx, eax
cmp edx, 0x8c4
jbe 0x1450334
mov edx, dword [ebp + 0x14]
mov ecx, 0xbc2
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x1450366
add ecx, eax
cmp ecx, 0x1193
jbe 0x1450351
call dword [0x42e090]
mov eax, dword [ebp + 0x14]
cmp word [eax], 0
je 0x1450381
xor ebx, 0xd7747837
mov dword [0x427f2c], ebx
mov eax, dword [0x427f2c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40e3f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40e412
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40e419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x40e408
mov eax, 1
add ebx, ebx
jne 0x40e42d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40e422
jne 0x40e43e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e422
xor ecx, ecx
sub eax, 3
jb 0x40e452
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40e4c6
mov ebp, eax
add ebx, ebx
jne 0x40e45d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40e46a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40e48e
inc ecx
add ebx, ebx
jne 0x40e47a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40e46f
jne 0x40e48b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e46f
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x40e4b0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40e4a2
jmp 0x40e40e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40e4b0
add edi, ecx
jmp 0x40e40e
pop esi
mov edi, esi
mov ecx, 0x1a3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40e4ce
cmp byte [edi], 0
jne 0x40e4ce
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40e4d3
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x40e542
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40e500
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe118]
or eax, eax
je 0x40e53c
mov dword [ebx], eax
add ebx, 4
jmp 0x40e51d
call dword [esi + 0xe11c]
popal
jmp 0x4042ac
Function at 0x4010b3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push ebx
push eax
xor ebx, ebx
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4010d8
xor eax, eax
jmp 0x401135
push esi
lea eax, [ebp + 0xc]
push edi
push eax
lea eax, [ebp - 4]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
or edi, 0xffffffff
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x401123
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x18]
jge 0x401123
lea eax, [ebp + 0xc]
inc dword [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push dword [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, ebx
je 0x401123
mov eax, dword [ebp + 0x14]
mov byte [eax], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, ebx
pop edi
pop esi
sete al
pop ebx
leave
ret

Function at 0x401138
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
push 0x104
push eax
push 0x40304c
push str.CLSIDa968f32e_6cf6_49de_b2d0_ceb096f521a2InProcServer32
push 0x80000000
call fcn.004010b3
add esp, 0x14
test eax, eax
je 0x40119f
cmp byte [ebp - 0x104], 0
je 0x40119f
push 8
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x40119f
push 5
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401198
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x408a51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x408a60
pop dword [ebp - 0x4c]
mov eax, 0x408a60
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x14ac87d4
add dword [ebp - 0x5c], 0x39a5bd77
mov dword [ebp - 0x58], 0x127c7e16
add dword [ebp - 0x58], 0x1fb6ce2f
mov dword [ebp - 0x54], 0x1cba1b01
sub dword [ebp - 0x54], 0xd06dd6d3
mov dword [ebp - 0x50], 0x9f036e44
add dword [ebp - 0x50], 0x60fc91bc
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xd52f504b
sub eax, 0xd4ee7ff7
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x322fab3
add dword [ebp - 0x5c], 0x714f6ea3
mov dword [ebp - 0x58], 0xde945b22
add dword [ebp - 0x58], 0x62d80653
mov dword [ebp - 0x54], 0xbcc2cf3a
add dword [ebp - 0x54], 0xa6ac9d32
mov dword [ebp - 0x50], 0x13ee27e0
sub dword [ebp - 0x50], 0x13ee27e0
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x40436fb0
add eax, 0xbffd609c
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ed07
push 0
call eax
mov ecx, 0x5d33
mov ebx, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x4c]
mov edx, 0x80118ad6
xor dword [ebp - 0x40], 0xf29d1f7d
mov esi, dword [edi]
mov dword [ebp - 0x10], 0x1276cfe7
add esi, edx
xor dword [ebp - 0x40], eax
mov dword [ebx], esi
xor dword [ebp - 0x2c], edx
add ebx, 0xd84f5208
add ebx, 0x27b0adfc
add edi, 4
loop 0x408b6b
add eax, 0x8bfb004b
add eax, 0x74066754
xor ebx, ebx
add ebx, eax
add eax, 0xbb6cc9f
add eax, 0xf4493366
mov ecx, 0x8330fca9
add ecx, 0x7d0f0357
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x402000
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret 8

Function at 0x437410
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2d000]
push edi
or ebp, 0xffffffff
jmp 0x437432
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x437439
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x437428
mov eax, 1
add ebx, ebx
jne 0x43744b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x437440
jne 0x43745c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x437440
xor ecx, ecx
sub eax, 3
jb 0x437470
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4374e2
mov ebp, eax
add ebx, ebx
jne 0x43747b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x437488
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4374ac
inc ecx
add ebx, ebx
jne 0x437498
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43748d
jne 0x4374a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43748d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4374cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4374bd
jmp 0x43742e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4374cc
add edi, ecx
jmp 0x43742e
pop esi
mov edi, esi
mov ecx, 0x165
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4374ea
cmp byte [edi], 2
jne 0x4374ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4374ef
lea edi, [esi + 0x35000]
mov eax, dword [edi]
or eax, eax
je 0x437567
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3e5e0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3e61c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43751c
mov ecx, edi
jns 0x43754b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3e620]
or eax, eax
je 0x437561
mov dword [ebx], eax
add ebx, 4
jmp 0x437539
call dword [esi + 0x3e624]
popal
jmp 0x402bd4
Function at 0x49c888
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor edx, edx
push ebp
push 0x49ca50
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
call fcn.00404580
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, dword [ebp - 4]
call 0x40490c
mov eax, esi
call fcn.00404580
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x49c9d3
mov ebx, 1
mov eax, esi
call fcn.00404580
lea edx, [ebx + ebx*2]
cmp eax, edx
jge 0x49c916
mov eax, esi
call fcn.00404580
mov ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
sub ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [ebp - 7]
call fcn.004028d8
jmp 0x49c92c
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [ebp - 7]
mov ecx, 3
call fcn.004028d8
mov al, byte [ebp - 7]
mov edx, eax
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov ecx, 0x49ca74
mov dl, byte [ecx + edx]
mov byte [ebp - 0xb], dl
and al, 3
and eax, 0xff
shl eax, 4
mov dl, byte [ebp - 6]
and dl, 0xf0
and edx, 0xff
shr edx, 4
or eax, edx
mov edx, 0x49ca74
mov al, byte [edx + eax]
mov byte [ebp - 0xa], al
mov dl, byte [ebp - 6]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov al, byte [ebp - 5]
mov ecx, eax
and cl, 0xc0
and ecx, 0xff
shr ecx, 6
or edx, ecx
mov ecx, 0x49ca74
mov dl, byte [ecx + edx]
mov byte [ebp - 9], dl
and al, 0x3f
and eax, 0xff
mov edx, 0x49ca74
mov al, byte [edx + eax]
mov byte [ebp - 8], al
mov eax, dword [ebp - 4]
call 0x4047d8
mov edx, ebx
dec edx
shl edx, 2
lea edx, [eax + edx]
lea eax, [ebp - 0xb]
mov ecx, 4
call fcn.004028d8
inc ebx
dec edi
jne 0x49c8e4
mov eax, esi
call fcn.00404580
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x49ca19
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404580
mov ebx, eax
mov eax, dword [ebp - 4]
call 0x4047d8
mov byte [eax + ebx - 2], 0x3d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404580
mov ebx, eax
mov eax, dword [ebp - 4]
call 0x4047d8
mov byte [eax + ebx - 1], 0x3d
jmp 0x49ca46
mov eax, esi
call fcn.00404580
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x49ca46
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404580
mov ebx, eax
mov eax, dword [ebp - 4]
call 0x4047d8
mov byte [eax + ebx - 1], 0x3d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49ca62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d7f40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x84000]
mov dword [edi + 0xa30a4], 0x4c6c8f0f
push edi
or ebp, 0xffffffff
jmp 0x4d7f6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4d7f71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d7f60
mov eax, 1
add ebx, ebx
jne 0x4d7f83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4d7f94
jne 0x4d7fb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d7fb3
dec eax
add ebx, ebx
jne 0x4d7fa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4d7f78
add ebx, ebx
jne 0x4d7faf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4d8005
xor ecx, ecx
sub eax, 3
jb 0x4d7fcb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4d803a
sar eax, 1
mov ebp, eax
jmp 0x4d7fd6
add ebx, ebx
jne 0x4d7fd6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d7fa4
inc ecx
add ebx, ebx
jne 0x4d7fe4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d7fa4
add ebx, ebx
jne 0x4d7ff1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4d7fe6
jne 0x4d8002
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4d7fe6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4d8024
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4d8016
jmp 0x4d7f66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4d8024
add edi, ecx
jmp 0x4d7f66
pop esi
mov edi, esi
mov ecx, 0x5299
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4d8042
cmp byte [edi], 0x1b
jne 0x4d8042
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4d8047
lea edi, [esi + 0xd4000]
mov eax, dword [edi]
or eax, eax
je 0x4d80b6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xdd22c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xdd344]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4d8074
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xdd348]
or eax, eax
je 0x4d80b0
mov dword [ebx], eax
add ebx, 4
jmp 0x4d8091
call dword [esi + 0xdd358]
mov ebp, dword [esi + 0xdd34c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4d80ea
sub esp, 0xffffff80
jmp fcn.004a2f54

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx