joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d5f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x43d609
cmp dword [esi + 8], 0
jne 0x43d610
xor eax, eax
jmp 0x43d703
mov edx, dword [esi + 4]
and edx, 0x100
mov dword [ebp - 8], edx
mov eax, dword [esi]
test eax, eax
jne 0x43d62b
mov dword [ebp - 4], 1
jmp 0x43d688
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [esi + 8]
cmp dword [ebp - 8], 0
mov al, byte [edx]
jne 0x43d649
cmp eax, 0x7f
jle 0x43d649
mov ebx, 1
xor ecx, ecx
jmp 0x43d685
cmp dword [ebp - 8], 0
je 0x43d685
cmp eax, 0x80
jle 0x43d65f
mov ebx, 1
mov cl, 0xff
jmp 0x43d685
cmp eax, 0x80
jne 0x43d685
mov eax, 1
mov edx, dword [esi + 8]
inc edx
jmp 0x43d681
cmp byte [edx], 0
je 0x43d67f
mov ebx, 1
mov cl, 0xff
jmp 0x43d685
inc eax
inc edx
cmp eax, dword [esi]
jl 0x43d671
add dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0x43d693
mov eax, dword [ebp - 4]
jmp 0x43d703
mov edx, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [edx]
je 0x43d69f
mov byte [edx], cl
inc edx
cmp dword [esi], 0
jne 0x43d6a9
mov byte [edx], 0
jmp 0x43d6f8
cmp dword [ebp - 8], 0
jne 0x43d6c1
mov eax, dword [esi]
push eax
mov ecx, dword [esi + 8]
push ecx
push edx
call fcn.00405f08
add esp, 0xc
jmp 0x43d6f8
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add ecx, eax
mov ebx, eax
dec ebx
dec ecx
add edx, ebx
jmp 0x43d6d6
mov byte [edx], 0
dec edx
dec ecx
dec eax
cmp byte [ecx], 0
je 0x43d6d0
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
inc ebx
mov byte [edx], bl
dec edx
test eax, eax
jle 0x43d6f8
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
mov byte [edx], bl
dec edx
test eax, eax
jg 0x43d6ea
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add dword [eax], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x43d70c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
cmp dword [ebp + 8], 0
je 0x43d722
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x43d740
push 2
call fcn.00441a3c
pop ecx
mov esi, eax
test eax, eax
jne 0x43d737
xor eax, eax
jmp 0x43d88a
mov dword [esi + 4], 2
jmp 0x43d745
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
push 0xc7
push 0x4b4a0c
mov edx, dword [ebp + 0x10]
inc edx
push edx
call fcn.00410e58
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43d77c
mov eax, 0x41
jmp 0x43d856
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 8]
jne 0x43d791
mov dword [esi + 4], 2
jmp 0x43d826
test byte [ebx], 0x80
je 0x43d7ff
mov dword [esi + 4], 0x102
cmp byte [ebx], 0xff
jne 0x43d7ac
cmp dword [ebp + 0x10], 1
je 0x43d7ac
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add ebx, ecx
add edx, ecx
jmp 0x43d7be
mov byte [edx], 0
dec edx
dec eax
dec ebx
cmp byte [ebx], 0
jne 0x43d7c7
test eax, eax
jne 0x43d7b8
test eax, eax
jne 0x43d7e0
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], 0
inc dword [ebp + 0x10]
jmp 0x43d826
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
inc ecx
mov byte [edx], cl
dec edx
test eax, eax
jle 0x43d826
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
mov byte [edx], cl
dec edx
test eax, eax
jg 0x43d7ef
jmp 0x43d826
mov dword [esi + 4], 2
cmp byte [ebx], 0
jne 0x43d815
cmp dword [ebp + 0x10], 1
je 0x43d815
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov edx, dword [ebp - 8]
push edx
call fcn.00405f08
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x43d834
push eax
call fcn.00411018
pop ecx
mov edx, dword [ebp - 8]
mov dword [esi + 8], edx
mov ecx, dword [ebp + 0x10]
mov dword [esi], ecx
cmp dword [ebp + 8], 0
je 0x43d84a
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, esi
jmp 0x43d88a
push 0x103
push 0x4b4a22
push eax
push 0xc2
push 0xd
call fcn.0043ab0c
add esp, 0x14
test esi, esi
je 0x43d888
cmp dword [ebp + 8], 0
je 0x43d881
mov edx, dword [ebp + 8]
cmp esi, dword [edx]
je 0x43d888
push esi
call fcn.00441a8c
pop ecx
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4c0ef2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x3c], edi
mov byte [esp], ah
mov byte [esp], 0x48
jmp 0x4c0a38

Function at 0x4c87dc
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
xchg dword [esp + 0x24], ebx
pushfd
mov word [esp], 0xbb0c
call fcn.004c981a
and ah, byte [edi]
fldcw word [eax - 0x1f]
mov ebx, 0x1f983b58
scasb al, byte es:[edi]
xlatb
sahf
popfd
bound ecx, qword [eax - 0x4da5c6d2]
mov byte [esi], ch
cmp dword [edx - 0x4e], ebx
adc eax, dword [edx - 0x60]
inc esi
xor eax, 0xbbe1696d
stosd dword es:[edi], eax
pushal
scasb al, byte es:[edi]
insd dword es:[edi], dx
sbb dword [eax - 0x31], ebp
dec eax
mov dword [0xf5a44bee], eax
dec esp
pop ds
outsd dx, dword [esi]
wait
dec ebp
and dh, byte [edx + 0x2d]
imul ebx, dword [edx], 0xffffffda
mov ebp, 0xb506c80d
imul eax, esi, 0xdcfc42c1
in eax, 2
jns 0x4c87fb
pop esi
mov ebp, ecx
sub dword [edx - 0x3c], ecx
and esp, dword [ebx]
popal
mov eax, ebx
imul esp, dword [edx], 0x2b
inc ecx
aaa
jbe 0x4c8838
fnstsw word [esi + 0x5ffb142f]
lds eax, [ecx - 0x57]
stc
push ebp
mov ebx, 0x28f7871b
lea esp, [esp + 0x2c]
ja 0x4db717
bswap edi
pushfd
mov edi, 0x4230a3
pushal
mov dword [esp + 0x18], 0x6095aa21
call fcn.004c8b20
pushfd
pushfd
pushfd
mov dword [esp + 8], 0x2871c909
pushal
push 0x8136bca6
lea esp, [esp + 0x2c]
jmp loc.004c0a33
jmp 0x4d0d60
movsx di, bl
mov edi, 0x4230a3
pushal
pushal
call fcn.004d749e
xor eax, 0x8d372f18
lea esp, [esp + 4]
jb 0x4da867
pushfd
pushfd
mov dword [esp + 4], 0x2871c909

Function at 0x4ca807
Capabilities:
Packed with generic packer

Disassembly:
pushal
nop
bswap ecx
sete cl
mov ecx, dword [esp + 0x24]
jmp 0x4cfdf3

Function at 0x4d3cca
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x24], 0x6f7fd9b4
mov byte [esp], 0x69
mov word [esp], cx
pushfd
lea esp, [esp + 0x28]
jmp loc.00401514
jle 0x4d3c54
invalid
jmp dword [eax - 0x73]
add byte [ebp + 0x411f3280], cl
wait
call fcn.004d9858
pushfd
push 0xcaa587ca
pushal
mov dword [esp + 0x24], 0xceefb5c
pushfd
jmp 0x4d125f
or eax, dword [eax]
pushfd
pushfd
push 0x3393fd09
pushal
lea ecx, [ecx + 0x785d330c]
pushfd
or ebp, edi
xchg ebx, eax
xor esp, dword [eax - 0x73]
mov dword [ebx + esi], ecx
pop ebp
js 0x4d3c53
xchg dword [esp + 0x38], ecx
pushfd
pushfd
pushfd
push dword [esp + 0x44]
ret 0x4c
push 0x424dc527
call fcn.004ce2f6
mul bh
sbb dword [eax + 0x54f518bb], esi
jecxz 0x4d3d4f
loope 0x4d3cab
push 0x31
pop ds
popal
jp 0x4d3ca6
jmp 0x4d3c6d
xchg esi, eax
arpl word [eax], si
retf
Function at 0x4d8828
Capabilities:
Packed with generic packer

Disassembly:
push dword [esp]
jmp 0x4d91b3
push edi
mov byte [esp], 0x6d
xchg dword [esp + 0x2c], ecx
push dword [esp + 8]
pushfd
push dword [esp + 0xc]
push dword [esp + 4]
mov dword [esp + 0x38], ecx
jmp 0x4d2edb
pushfd
mov word [esp], 0x1d67
mov ecx, dword [ecx + 0xa6935]
pushfd
call fcn.004dc022
pushal
pushfd
mov dword [esp + 0x20], 0xc57cfc5c
pushal
call fcn.004c2ba3
call fcn.004d5da2
jmp 0x4cf5a6
setnp ch
mov ecx, 0x423e40
lea esp, [esp + 0x38]
jge 0x4d92ad
pushfd
mov ecx, dword [ecx + 0xa6935]
jmp 0x4c7285
pushal
pushfd
jmp 0x4cfdee
call fcn.004ca12e
fsub st(3)
add dword [edi - 0x20], ebx
mov ebx, 0xf7821b30
sub ecx, edi
add ch, dl
add ebx, ecx
adc al, 0x15
push cs
je 0x4d9176
in eax, 0x91
invalid
jmp 0x4cfd4a

Function at 0x4d9dd3
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov dword [esp], 0x2ce24600
mov dword [esp], 0xff2918f5
pushal
push ebx
mov byte [esp], ch
pushal
lea esp, [esp + 0x44]
jmp fcn.00401c7d
push cs
sub byte [eax], al
add byte [eax - 0x39], ah
pushal
mov dword [esp + 0x1c], 0x1529fc5c
pushal
mov dword [esp + 0x38], 0xcc932a4c
mov dword [esp], eax
xchg dword [esp + 0x3c], ebp
mov byte [esp], al
pushfd
pushfd
mov byte [esp + 0xc], dl
push dword [esp + 0x44]
ret 0x4c
call fcn.004d1617
or cl, byte [ebx]
cmc
push edx
loopne 0x4d9d99
cmp al, 0x25
xchg edx, eax
pop es
je 0x4d9dbf
cmp byte [edi + 0x2e5bdbfa], bl
push 0x7d
push 0x92e70304
push edx
pop ds
insd dword es:[edi], dx
push edx
loopne 0x4d9db2
leave
or eax, 0xb8571fcf
sbb eax, 0x8522b96a
xchg esp, eax
xchg edx, eax
xchg edx, eax
and byte [esi + ecx*8 - 0x3e2e36b7], bh
xchg byte [edi], ah
pop ecx
ror dword [ebx - 0x381b260], 1
inc esi
test byte [ebx], 0x19
inc ecx
cmpsd dword [esi], dword es:[edi]
psrlw mm0, mm0
sbb bh, 0xfe
xchg dword [eax], eax
mov dword [ebp - 0x61], eax
inc esp
add eax, 0xdafbea4a
or bl, byte [ebp + ecx*2 - 0x78]
dec ebp
mov ebp, 0xad1ecae7
pop ds
cmc
inc eax
das
cwde
jne 0x4d9e79
cwde
add byte [edx - 0x44], bl
sub cl, byte [edx - 0x361c524]
and byte [ebp + 0xf202464], cl
lea edx, [esi]
push ss
mov esi, 0x5c68ffff
std
add ebx, eax
pushfd
pushal
lea esp, [esp + 0x24]
je 0x4cfecf
push 0xff2918f5
push 0x3f636045
pushfd
lea esp, [esp + 8]
jmp fcn.00401c7d
push edx
loopne 0x4d9e38
neg esp
xor eax, 0xb7b6e58e
fld xword [ebx]
in eax, dx
mov esp, 0xe1c0a4c9
xor ebp, ebp
push ss
push edx
loopne 0x4d9e4e
or bl, al
adc eax, edx
mov dh, ch
invalid

Function at 0x4e0009
Capabilities:
Encode data using xor

Disassembly:
call fcn.004e35df
inc esi
dec ebp
mov bl, 0xf0
fistp qword [ebx + 0x13c66f7e]
mov ebx, 0x13c66f7e
nop
xchg ecx, eax
or esp, dword [ecx - 0x357d4c0f]
dec ecx
push ss
xor dword [eax], esi
fidiv word [edi - 0x200e7b07]
mov ebx, 0x92e63d05
fistp qword [eax]
wait
add byte [ecx - 0x2c], dh
sub dword [edx - 0x25], edi
aam 0x29
jp 0x4e0013
push eax
movsb byte es:[edi], byte [esi]
lock add edi, dword [si - 0x12]
fistp qword [ebx - 0x2383e94e]
xor byte [esi - 0x1d63b71e], al
fist word [edx]
sub eax, 0x3239fb2a
and byte [edx + edx*4 + 0x37], bh
fimul dword [edx - 0x1037e48d]
fistp qword [ebx + 0x4191e232]
sub al, 0xba
xchg esi, eax
lcall 0xa7b1, 0xa89b067a
jbe 0x4e0034
invalid
Function at 0x4e0b27
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
rcr byte [eax + ebp*8 + 0x8f4b], 1
clc
cmc
pushfd
call fcn.004e738e
dec ebp
pop edx
mov bh, ah
fistp qword [ebx + 0x62fb98a7]
nop
push ecx
inc ebp
adc bh, byte [edx]
in eax, dx
jne 0x4df3c9
push esp
mov ebp, 0xf9164785
sti
fistp qword [ebx + 0x6c24dc23]
movsb byte es:[edi], byte [esi]
cmc
pop esi
shr dword [edi*2 + 0x6dfa8bfe], cl
shl cl, cl
mov edi, 0x71bbdffc
out 0x4d, eax
cmpsd dword [esi], dword es:[edi]
pop ss
mov ebp, esi
pop ebp
shr dword [edi], 0x93
or eax, 0x67aa743
out dx, al
jmp 0x7bd3873b
btc esi, ecx
mov esi, dword [eax + 0x3c]
setae dh
bswap dx
ror dh, cl
add dh, 0x9a
add esi, eax
jmp 0x4e5349
clc
mov cl, cl
stc
add cx, bp
mov ecx, dword [esi + 0x7c]
stc
bt dx, 5
add ecx, edx
cmc
mov dword [ebp - 0x10], ecx
adc cl, ch
jmp 0x4eae0c
lea esp, [esp + 8]
je 0x4ea7c8
bt edx, 0xd
neg cl
add edx, eax
btc cx, bx
sbb cl, bh
jae 0x4e3b1b
mov ecx, dword [esi + 0x7c]
clc
add ecx, edx
cmp esp, 0x1e806c81
cmp dh, al
pushal
bt si, ax
mov dword [ebp - 0x10], ecx
and cl, cl
mov ecx, dword [ebp + 0xc]
pushfd
mov word [esp], ax
mov byte [esp + 4], cl
cmp ecx, 0xffff
call fcn.004e594a
mov edx, dword [esi + 0x78]
pushfd
test edx, edx
jmp 0x4e3ec0
bsr cx, bp
mov ecx, dword [ebp + 0xc]
bt cx, 0xe
jle 0x4df423
pushal
cmp ecx, 0xffff
call fcn.004e7fc1

Function at 0x4e1043
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4e2444
movzx ecx, word [edi + ecx*2]
clc
rol di, 0xd
not di
bsf di, cx
mov edi, dword [edx + 0x1c]
bt cx, 6
add edi, eax
test dh, 0x27
call fcn.004e635c
mov al, byte [0xdfcc1fc5]
mov ebx, 0xb752f512
adc al, 0x7f
loopne 0x4e249f
invalid
js 0x4e244b
add edx, eax
mov al, 0x91
stosb byte es:[edi], al
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
sbb ecx, dword [esi + 0xb]
push ebp
or eax, 0xcceb8e00
fistp qword [ebx + 0x5c16da9e]
mov ebx, 0x534eab20
xor dword [esi], eax
out 0x1e, al
shl dword [edx + 0x71], 0x6e
int 0xdf
mov ebx, 0xb654f6ac
nop
push esp
mov dh, 0x90
insd dword es:[edi], dx
leave
sti
mov edi, 0x8fa712e8
sub eax, 0xcc5eddbe
fstp qword [esi - 0x34]
fistp qword [ebx - 0x3f14783a]
test byte [edi - 0x43], ah
and eax, 0xb125db87
xor dword [esi + 0x7a], 6
cmpsd dword [esi], dword es:[edi]
push ss
adc dword [edx], ecx
add al, 0x2d
mov bh, 0xcc
fistp qword [ebx + 0x7dee737a]
or bh, byte [ebx - 0x26]
cmp edx, dword [esi - 0x5c84935b]
jae 0x4e24ad
js 0x4e2508
daa
cmpsd dword [esi], dword es:[edi]
pop dword [ecx - 0x647b862d]
int3
xchg esi, eax
cmp dword [ebp + ebp*4 - 0x70], edx
loope 0x4e24dd
xor ebx, eax
xchg edx, eax
push es
xor al, 0xde
jnp 0x4e252d
jnp 0x4e24df
mov dword [0xf373f90a], eax
pushal
invalid
popal
or esp, dword [ecx + edx*2 - 0x39]
sub dword [ebp - 0x2d], edi
sbb eax, 0x9d2fd375
pop es
jae 0x4e24fe
retf

Function at 0x4e1892
Capabilities:
Encode data using base64

Disassembly:
push edx
push dword [esp]
pushal
lea esp, [esp + 0x28]
jb 0x4eaa97
call fcn.004e6c5a
lea esp, [esp + 0x48]
ja 0x4e6497
jmp 0x4e11bd
Function at 0x4e2161
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], dx
mov edi, dword [edx + 0x1c]
pushfd
test ah, 0xea
push 0x9ef7761a
cmp ch, cl
add edi, eax
pushal
mov word [esp], 0x448b
mov edi, dword [edi + ecx*4]
push edi
test bh, 0xb8
push dword [esp + 8]
cmc
test edi, edi
pushfd
lea esp, [esp + 0x38]
je 0x4ea7c8
push 0x7e005f35
pushfd
test esp, 0xf9107e2c
add eax, edi
push 0xe48d8404
stc
mov byte [esp], bh
cmp eax, edx
pushfd
lea esp, [esp + 0x10]
jb 0x4ea7dc
stc
jmp 0x4e9710
cmp eax, dword [ebp - 0x10]
call fcn.004e5fd2

Function at 0x4e36ec
Capabilities:
Encode data using base64

Disassembly:
pushfd
mov word [esp], ax
xor al, 0xc1
sub esp, 0xffffffb0
jae 0x4e9228
jmp 0x4e8755
pushal
cmp al, byte [edi]
lahf
not ah
pop eax
lea edi, [edi + 1]
bswap ax
mov eax, dword [esp + 0x1c]
jmp 0x4ea89e
mov byte [esp], 0xc0
lea esp, [esp + 0x20]
ja 0x4e6497
push ebp
lea esp, [esp + 4]
jb 0x4eaa97
push esp
clc
cmp byte [edi - 1], 0
call fcn.004e675c
invalid

Function at 0x4e3fc5
Capabilities:
Encode data using base64

Disassembly:
mov esp, ebp
call fcn.004e15f2
pushfd
pushfd
jmp 0x4e3643

Function at 0x4e675c
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jne 0x4eab2f
lea edi, [ebp*8 + 0x17d7a007]
xor di, ax
rcr di, 7
mov edi, dword [edx + 0x24]
clc
add edi, eax
push edi
call fcn.004e5c3f
mov al, byte [0xdf8939ab]
mov ebx, 0x7621b459
fstp qword [edx - 0x43]
push ds
invalid

Function at 0x4e831b
Capabilities:
Encode data using base64

Disassembly:
push eax
lea esp, [esp + 0xc]
jb 0x4ea7dc
bt di, cx
push 0xf78591
pushfd
cmp eax, dword [ebp - 0x10]
call fcn.004e6c8b
Function at 0x4e8338
Capabilities:
Encode data using base64

Disassembly:
jmp 0x4e5da8
jmp 0x4e9773
push edx
mov word [esp], 0xf809
pushal
lea esp, [esp + 0x24]
ja 0x4e6497
pushal
push ebp
push dword [esp + 4]
lea esp, [esp + 0x28]
jb 0x4eaa97
bt si, 0xa
stc
cmp byte [edi - 1], 0
jmp 0x4e3d49
cmc
call fcn.004e03f4
shr al, cl
sar al, cl
sub ebx, edi
bsr edi, esp
btr di, cx
inc di
neg di
add ebx, esp
bsr di, cx
bt esp, 0xb
mov edi, ebx
stc
pushfd
not al
sal al, 1
mov al, 0x2e
mov byte [esp], 0xfd
push ecx
call fcn.004df899
mov edi, dword [edi + ecx*4]
push ebp
clc
test edi, edi
mov byte [esp + 4], 0x81
lea esp, [esp + 0x28]
je 0x4ea7c8
push 0x6c14136d
add eax, edi
bt bx, bp
cmp edi, 0x6c3417ee
pushal
cmp eax, edx
push 0x59046f09
push dword [esp]
push esi
lea esp, [esp + 0x30]
jb 0x4ea7dc
push edx
pushfd
test ch, 0xae
cmp eax, dword [ebp - 0x10]
pushfd
lea esp, [esp + 0xc]
jae 0x4ea7dc
shl di, cl
pushfd
sub bl, 0xaf
mov ebx, eax
call fcn.004e3612
aas
dec esp
mov ah, 0x85
fistp qword [ebx + 0x31aa37de]
mov ebx, 0x31aa37de
movsb byte es:[edi], byte [esi]
test dword [0xf3c710d8], eax
adc al, 0x54
mov ebp, 0x1bb8bb07
xchg bh, bl
mov ebx, 0xe330ee1b
lahf
or dh, byte [ebp - 0x2c]
sub dword [edx + 0x1acb6afd], edx
imul edi, dword [edx + 0x2e], 0x60
xchg ecx, eax
mov ebx, 0x819d206
jo 0x4e6b06
sub bh, byte [eax - 0x2a]
dec esp
lodsb al, byte [esi]
add ah, byte [edx + eax*8 - 0x17]
mov byte [esp + 8], 0x8e
mov dword [esp + 8], eax
mov al, dl
push edi
lodsb al, byte [esi]
cmc
mov dword [esp + 8], 0xaa63d04d
neg al
call fcn.004e8257
bt edx, ecx
movzx ecx, word [edi + ecx*2]
bswap di
mov edi, dword [edx + 0x1c]
bt dx, sp
clc
stc
push 0x5633ace
add edi, eax
pushal
stc
jmp 0x4e6aa3
mov byte [esp + 4], 0x15
push dword [esp]
not eax
lea edi, [edi + 1]
pushal
mov byte [esp + 8], 0x6f
pop eax
mov eax, dword [esp + 0x3c]
lea esp, [esp + 0x40]
jne 0x4e364a
push 0x6c4b50d7
pushal
lea esp, [esp + 0x24]
ja 0x4e6497
call fcn.004e0009
movsd dword es:[edi], dword [esi]
stosb byte es:[edi], al
push esi
insd dword es:[edi], dx
fistp qword [ebx - 0x69dc4125]
call dword [ebp + esi*4 + 0x22]
mov edx, ebp
dec ebp
mov dl, 0xb
push 0x2b
retf 0x5717
jne 0x4eab2f
bsf di, bx
bswap di
mov edi, dword [edx + 0x24]
clc
add edi, eax
jmp 0x4e811e

Function at 0x4e8cb3
Capabilities:
Encode data using base64

Disassembly:
mov byte [esp], 0x10
lea esp, [esp + 0x58]
ja 0x4e6497
jmp 0x4df3d5

Function at 0x4e9223
Capabilities:
Encode data using base64

Disassembly:
movzx eax, al
jmp 0x4ea701
mov eax, dword [esp + 0x24]
push 0xde596a57
lea esp, [esp + 0x2c]
ja 0x4e6497
pushfd
pushfd
call fcn.004e8432
add byte [eax], al
add byte [eax], al
mov al, byte [0xa0a4004b]
dec ebx
add byte [ebx - 0x6fffbb70], cl
push eax
dec esi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi], ch
dec esi
add byte [eax], al
add byte [eax], al
add bh, bh
and eax, sym.imp.KERNEL32.DLL_LoadLibraryA
int3
call fcn.004e30d1
pushal
mov byte [esp + 0x14], 0xbe
cmp dl, 0x84
test dh, 0x1a
cmp al, byte [edi]
movzx ax, dl
jmp 0x4e4a20
lea edi, [edi + 1]
push dword [esp]
jmp 0x4e505b
Function at 0x4e974c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
mov byte [esp], 0x37
pushal
mov byte [esp], bl
mov dword [esp + 0x3c], 0x7755fb5c
pushfd
pushfd
mov dword [esp + 0x40], 0x518c5546
mov byte [esp], cl
lea esp, [esp + 0x40]
jmp 0x4ec336

Function at 0x4ea0b2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0xb08ca85e
pushal
mov byte [esp], dh
pushfd
pushal
lea esp, [esp + 0x44]
jmp 0x4ec31c
pushal
mov dword [esp + 0x1c], ecx
pushal
pushfd
call fcn.004eb4b4

Function at 0x4ec328
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esp
push ebx
mov dword [esp + 4], ecx
pushal
mov dword [esp + 0x20], edx
push 0xa41c6b13
mov dword [esp + 0x20], ebx
push 0xe8843388
push esp
mov dword [esp + 0x24], edx
push dword [esp + 4]
call fcn.004ed19a
mov dword [esp + 0x20], edx
pushal
mov dword [esp + 0x3c], ebx
call fcn.004eb856
jmp 0x4ebaff

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4029f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402a09
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402a44
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402a40
lea ebx, [ebx]
cmp esi, eax
jae 0x402a44
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402a30
cmp esi, eax
jb 0x402a4a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4035e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4035e6
push 0
sub eax, esi
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
pop esi
ret 4
Function at 0x4062d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x446650]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x406314
push 0x437940
push 4
push eax
call fcn.004232a6
push eax
call fcn.00402cc0
add esp, 0x10
jmp 0x406326
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x406394
push edi
call fcn.00423411
mov edi, dword [eax]
call fcn.00423411
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.004233b7
add esp, 0x18
mov ebx, eax
call fcn.00423411
cmp dword [eax], 0
je 0x406374
call fcn.00423411
push dword [eax]
call fcn.00406262
pop ecx
jmp 0x40637b
call fcn.00423411
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x406394
cmp ebx, esi
jae 0x406394
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x406396
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00420cad
leave
ret
Function at 0x407e16
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x407e5c
call fcn.00410e84
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x407e5c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x407e9f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x407e88
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x407e88
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x407e9c
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc