joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404420
Capabilities:
Terminate process

Disassembly:
jmp 0x42333a
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x42334b
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00401d60
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x405fe0
Capabilities:
Parse pe header

Disassembly:
jmp 0x41706c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4170ac
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4170ac
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4170ac
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4170ac
cmp dword [ecx + 0x74], 0xe
jbe 0x4170ac
cmp dword [ecx + 0xe8], 0
je 0x4170ac
mov al, 1
ret
xor al, al
ret

Function at 0x4078a0
Capabilities:
Query environment variable

Disassembly:
jmp 0x447fb1
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x447fc5
xor edi, edi
jmp 0x447ffc
push ebx
push esi
call fcn.00447ebb
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00405040
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x447fec
push ebx
push esi
push edi
call fcn.00407b70
add esp, 0xc
push 0
call fcn.00401fb0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x401b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x51f620]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov cl, 0x64
mov al, 0x6c
push esi
mov byte [ebp - 0xe], cl
mov byte [ebp - 0xa], cl
mov byte [ebp - 0x23], cl
mov cl, 0x69
push edi
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc], al
mov byte [ebp - 9], al
mov byte [ebp - 8], al
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x24]
mov dl, 0x6e
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x1d], cl
mov byte [ebp - 0x1a], cl
push eax
lea ecx, [ebp - 0x10]
mov bl, 0x74
push ecx
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 7], 0
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x49
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1e], bl
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x19], 0x7a
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x6b
mov byte [ebp - 0x12], 0
call fcn.00486440
mov ebx, eax
xor esi, esi
lea edi, [esi + ebx]
push edi
lea edx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
call fcn.00407af0
mov edx, dword [ebp - 0x28]
mov cl, byte [edx]
cmp cl, 0xe8
je 0x401c31
cmp cl, 0xe9
je 0x401c31
add esi, eax
cmp esi, 0x1000
jb 0x401bf2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d9d8
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 1]
mov ecx, dword [ebp - 4]
lea eax, [eax + edi + 5]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d9d8
mov esp, ebp
pop ebp
ret

Function at 0x4030c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x51f620]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x529868], 0
jne 0x403184
cmp byte [0x529869], 0
mov al, 1
mov byte [0x529868], al
jne 0x4030fd
push 0x5294c0
mov byte [0x529869], al
push edx
call fcn.02338d62
call fcn.00402780
call fcn.004031a0
mov dword [0x529864], eax
mov al, 0x73
mov cl, 0x65
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x20]
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xc], cl
mov byte [ebp - 0x15], cl
mov dl, 0x6f
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1e], 0x57
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x1c], 0x77
mov byte [ebp - 0x1b], 0x36
mov byte [ebp - 0x1a], 0x34
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x12], 0
call fcn.02347ea1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d9d8
mov esp, ebp
pop ebp
ret
Function at 0x4031a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x51f620]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0xf], al
mov byte [ebp - 0xc], al
mov byte [ebp - 0x23], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x24]
mov byte [ebp - 0x22], cl
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x18], cl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x76
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0
call fcn.02251904
ret
Function at 0x42c750
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push esi
mov dword [edi], 0
call fcn.0042c6e0
mov ebx, eax
test ebx, ebx
jne 0x42c783
mov dword [edi], 6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 0x20]
mov edx, dword [esi + 0x78]
push 0
push ecx
push edx
call fcn.004708fd
mov eax, dword [esi + 0x78]
mov ecx, dword [ebx + 0x28]
mov edx, dword [0x529924]
push eax
push 1
push ecx
push edx
call fcn.00470e2d
mov ecx, dword [0x529b30]
push 0
lea eax, [esp + 0x2c]
push eax
mov eax, dword [0x529924]
mov dword [esp + 0x30], 0
mov edx, dword [ebx + 0x28]
push ecx
push edx
push eax
call fcn.004e2020
add esp, 0x30
test eax, eax
jne 0x42c8da
mov ecx, dword [esp + 0xc]
cmp ecx, dword [ebx + 0x24]
jne 0x42c8da
mov eax, dword [0x529b30]
movzx esi, word [eax]
movzx edi, word [eax + 2]
xor eax, eax
push 0x2c
push eax
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call fcn.004737c0
add esp, 0xc
push 0
push 0
lea edx, [esp + 0x18]
push edx
mov eax, 0x18
mov word [esp + 0x2e], ax
push 0
mov ecx, 1
lea eax, [esp + 0x4c]
mov word [esp + 0x30], cx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
push eax
mov ecx, 0xa
lea esi, [esp + 0x28]
lea edi, [esp + 0x50]
mov dword [esp + 0x28], 0x28
mov dword [esp + 0x38], 0
push 0
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x28], 0
push eax
call fcn.02058777
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x42c8a2
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 0x24]
mov edx, dword [0x529b30]
sub ecx, 4
add edx, 4
push eax
call fcn.00446a20
mov edi, dword [ebp + 8]
add esp, 4
mov ecx, edi
call fcn.0046582a
push esi
mov ecx, edi
call fcn.004657fe
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44fed0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x44ffbb
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44ff07
cmp dword [esi + 0x40], edi
jae 0x44ff07
push eax
call fcn.0045024c
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x44ff1f
lea eax, [edi + edi]
push eax
call fcn.00450241
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.00475820
add esp, 0xc
xor ebx, ebx
test edi, edi
jbe 0x44ffb8
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x50f670]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x50f670]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x44ff37
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x44fffa
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x44ffdf
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.00475820
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x45001c
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
push ebp
call 0x22be85a
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x536c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x536d8c
test eax, eax
je 0x536d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x551ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x536d73
lea edi, [eax + 4]
jmp 0x536cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x536cec
mov dword [ebp - 4], 2
jmp 0x536d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x536d03
mov dword [ebp - 4], 1
jmp 0x536d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x536d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x536d46
mov byte [ecx], 0x3d
jmp 0x536d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x536d5d
mov byte [ecx], 0x3d
jmp 0x536d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x536cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x204ef4d
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov dword [ebp - 0x10], eax
jmp 0x2253bff
push ebp
shl ebp, 0x14
bt eax, 0x6c
mov ebp, esp
push 0xffffffffffffffff
movzx eax, ax
push 0x4e38ab
lahf
test sp, di
mov eax, dword fs:[0]
cmp esp, edx
cmc
push eax
bswap ax
lea esp, [esp - 0x2c4]
neg ah
mov eax, dword [0x51f620]
xor eax, ebp
jmp 0x531efb
push esi
jmp 0x220c163
push edi
jmp loc.00433c23
push ebx
jmp 0x219e327
Function at 0x20edf87
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov byte [ebp - 0x12d], 0xc1
jmp 0x21db8df
mov byte [ebp - 0x113], 0xcf
jmp 0x229353c
mov byte [ebp - 0x11c], 0x7f
jmp 0x21d4c17
mov byte [ebp - 0x110], 0x79
mov byte [ebp - 0x10f], pe_nt_image_headers32
mov byte [ebp - 0x10e], 0x74
jmp 0x23ae92c
mov byte [ebp - 0x12f], 0x88
mov byte [ebp - 0x12e], 0x87
jmp 0x531a31
mov byte [ebp - 0x139], dl
jmp 0x23201b1
mov byte [ebp - 0x116], 8
jmp 0x2248f66
mov byte [ebp - 0x118], 0x7d
jmp 0x2246cb1
push 0x11345ac
call fcn.004295f3
mov byte [ebp - 0x13c], 0x9d
jmp 0x232027c
mov byte [ebp - 0x111], 0x21
jmp 0x538620
mov byte [ebp - 0x121], 0x68
jmp 0x22ba202
mov byte [ebp - 0x107], 4
mov byte [ebp - 0x106], 0xa0
jmp 0x220859b
mov byte [ebp - 0x11e], 0xdc
jmp 0x2296516
mov byte [ebp - 0x11a], 0xb6
jmp 0x229738c
mov byte [ebp - 0x103], 0xc6
mov byte [ebp - 0x102], 0xca
mov byte [ebp - 0x101], 0xfd
jmp 0x21fed80
mov byte [ebp - 0xff], 0xbc
jmp 0x22d3284
mov byte [ebp - 0x127], 0x9c
jmp 0x2202375
mov byte [ebp - 0x11b], 0x4b
jmp 0x217c59e
mov byte [ebp - 0x12c], 0x5e
jmp 0x2221bd6
mov byte [ebp - 0x128], 0xc6
jmp 0x21cc2b2
mov byte [ebp - 0x100], 0x6c
jmp 0x21c251c
mov byte [ebp - 0x126], 0x5c
jmp 0x22fc097
mov byte [ebp - 0x105], 0xca
jmp 0x236feca
mov byte [ebp - 0x10c], 0x78
jmp 0x2243a07
mov byte [ebp - 0x12b], 9
mov byte [ebp - 0x12a], 0x7c
jmp 0x231afc5
mov byte [ebp - 0x132], 0xa2
jmp 0x22fd142
mov byte [ebp - 0x11f], 0x89
jmp 0x213a9bc
mov byte [ebp - 0x134], 0x64
mov byte [ebp - 0x133], 0xc4
jmp 0x222cdd4
mov byte [ebp - 0x10b], dl
mov byte [ebp - 0x10a], 0x1e
jmp 0x224ed44
mov byte [ebp - 0x117], 0xd
jmp 0x2047c55
mov byte [ebp - 0x115], 0x16
mov byte [ebp - 0x114], 0x7c
jmp 0x535da3
mov byte [ebp - 0xfc], 0x6d
jmp loc.0043afa2
mov byte [ebp - 0x109], 0x93
jmp 0x23c489d
mov byte [ebp - 0xfd], 0xb0
jmp 0x224a290
mov byte [ebp - 0x112], 0x62
jmp 0x20f21f6
mov byte [ebp - 0x11d], 0x78
jmp 0x5368fd
mov byte [ebp - 0x119], 0x4f
jmp 0x20c134d
mov byte [ebp - 0x120], 0x7e
jmp 0x223c0e2
mov byte [ebp - 0xfe], 0x2e
jmp 0x225b75c
mov byte [ebp - 0x125], dl
jmp 0x2319983
mov byte [ebp - 0x131], 0xf4
mov byte [ebp - 0x130], 0x3b
jmp 0x203b60e
mov byte [ebp - 0x124], 0xe5
mov byte [ebp - 0x123], 0x88
mov byte [ebp - 0x122], 0x22
jmp 0x20fdd66
mov byte [ebp - 0x129], 0xff
jmp 0x21e21c0
mov byte [ebp - 0x137], 0x4a
mov byte [ebp - 0x136], 0x10
mov byte [ebp - 0x135], bl
jmp 0x2240964
mov byte [ebp - 0x13a], 0x7c
jmp 0x203bc96
mov byte [ebp - 0x104], 0x7b
jmp 0x21aa945
mov byte [ebp - 0x10d], 0xa4
jmp 0x220f02c
mov byte [ebp - 0x108], 0x7a
jmp 0x2125aef
Function at 0x2133eee
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc eax
jmp 0x2374705
push esi
cmove si, bx
mov dword [ebp - 0x110], edx
mov esi, 0x626800d6
mov dword [ebp - 0x10c], eax
jmp 0x20ec881
mov dword [ebp - 4], eax
xor eax, esp
ror ax, 0xd7
cmp dword [ebp + 0x10], 0
setnp ah
mov eax, dword [ebp + 0xc]
jmp 0x21a6c8c
mov esi, ecx
je 0x234e659
xor ecx, ecx
test edx, ecx
cmp dx, cx
xor eax, eax
cmp esp, ebp
push edi
cmp esp, ebp
test eax, ebp
stc
test ebx, ebx
jmp 0x224c073
push ebp
mov ebp, esp
cwde
lahf
sub esp, 0x11c
not al
cwde
mov eax, dword [0x51f620]
test ch, ch
xor eax, ebp
jmp 0x20a04ff
push ebx
cmovno ebx, ecx
mov ebx, esi
mov ebx, dword [ebp + 8]
jmp 0x209f456
jl 0x224c07f
mov eax, 0x837765f1
or dl, al
neg dl
xor dx, si
imul ecx
test esi, 0x397637a3
lea edx, [edx + ecx]
sar edx, 9
rcl eax, 0xc
rol eax, 0x16
mov eax, edx
shr eax, 0x1f
jmp 0x23aafea
jle 0x223984b
lea esp, [esp]
bswap edi
movzx edi, byte [edx + eax]
jmp 0x5422ff
mov ecx, dword [ebp - 4]
pop esi
jmp 0x42a65e
sub cl, 0x38
test sp, di
xor al, cl
mov byte [esi + 7], al
jmp 0x420917
lea ecx, [ecx + edi]
clc
cmp eax, ebx
jmp 0x2239845
add eax, edx
xadd dl, dl
mov dl, 0x1b
imul dl
add al, cl
mov cl, bl
clc
jmp 0x23548ca
Function at 0x21f489f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push eax
jmp 0x22a9cf4
ret
mov edx, dword [ecx]
jmp 0x538837
mov byte [ebp - 4], 1
jmp 0x22331c9
call fcn.00465dda
lea eax, [ebp - 0x34]
jmp 0x20794cc
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x5118b4
jmp 0x23313b0
mov byte [ebp - 4], 0
jmp 0x22894ee
sub ecx, ecx
mov edx, 4
mul edx
sete cl
seto cl
test si, 0x78e6
cmp esi, 0x78094ef5
jmp 0x22acdde
push eax
call fcn.004090f0
add eax, 0x10
mov dword [esi], eax
cmp ebp, ecx
add esp, 4
jmp 0x204cb55
pop ebp
jmp 0x54ae79
mov dword fs:[0], eax
not cx
bswap ecx
lea ecx, [ebp - 0x34]
jmp 0x224df56
push ebp
mov ebp, esp
dec ecx
adc eax, 0x1fd82d37
push 0xffffffffffffffff
push 0x4e5030
lahf
mov eax, dword fs:[0]
push eax
and ax, di
setge ah
lea esp, [esp - 0x28]
shld eax, edx, 0x3d
cwde
xadd al, ah
push ebx
clc
push esi
ror al, cl
push edi
cmc
not cx
setg ah
mov eax, dword [0x51f620]
shr ch, 0xe1
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
setnp ch
jmp 0x21ed1e2
jmp 0x226b6d9
mov dword [ebp - 0x1c], edi
jmp 0x23b452e
pop ecx
pop edi
pop esi
xchg bh, bl
cmovs bx, cx
jmp 0x2222b11
pop ebx
jmp 0x2388046
mov edi, eax
jmp 0x22129ec
call fcn.0044a530
mov eax, dword [ebp - 0x2c]
cmc
rcl edi, 0x3f
sbb edi, eax
add esp, 0xc
add edi, eax
cmp eax, 1
jmp 0x2227662
call fcn.00465d33
push 0xffffffffffffffff
not ecx
movsx ecx, ax
jmp 0x235d57f
mov dword [ebp - 4], 0
jmp 0x223925e
jg 0x2318928
mov ecx, dword [eax]
jmp 0x2041baa
call fcn.00465f10
mov dword [ebp - 4], 0xffffffff
mov eax, 0x19e50796
shl al, cl
xadd ah, al
mov eax, dword [ebp + 0x14]
rcr ecx, cl
cmp bp, ax
add eax, 0xfffffff0
mov cl, 0x93
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
cmp ebp, 0x4dda20f3
test edx, edx
jmp 0x21fd13d
mov eax, dword [edx + 4]
jmp 0x2318926
neg ecx
cmp esp, edx
cmp si, 0x27d5
test bp, ax
or ecx, eax
jmp 0x42c461
call eax
xor eax, eax
mov ecx, ebp
mov ecx, dword [ebp - 0xc]
mov si, 0x6c19
bswap ebx
mov dword fs:[0], ecx
xchg ecx, esi
not di
jmp 0x221eca5
call fcn.00446560
mov byte [ebp - 4], 2
rcl esi, 0x20
shld ax, sp, 0xcc
bsr esi, ebp
mov eax, dword [ebp + 0x14]
sal esi, 0x3e
push ecx
test ebx, 0x3d6c21b1
add eax, 0xfffffff0
not esi
mov dword [ebp - 0x1c], esp
not si
mov esi, esp
jmp 0x20f8c78
push 0
movzx cx, bl
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
jmp 0x206bd4b
mov esp, ebp
jmp 0x21dc0de
jge 0x208befb
lea ecx, [ebp - 0x34]
jmp 0x2084aa1
Function at 0x2208a45
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xb4], eax
jmp 0x2390d4f
mov dword [esp + 0xac], eax
jmp 0x235cd96
mov dword [esp + 0x88], eax
jmp 0x233400a
push 0x3975c6cc
call fcn.020526e6
call fcn.022cf509
mov ecx, dword [0x5298cc]
btc di, 7
mov edi, 0x58734386
cmovp edi, ebx
mov edi, eax
test sp, bp
xor eax, eax
jmp 0x2388029
mov dword [esp + 0x90], eax
jmp 0x215c15c
mov dword [esp + 0xbc], eax
jmp loc.0042c379
mov dword [esp + 0x80], eax
jmp 0x23819c5
mov dword [esp + 0x8c], eax
jmp 0x225a158
mov dword [esp + 0xb0], eax
jmp 0x20da01f
mov dword [esp + 0x84], eax
jmp 0x21f0499
mov dword [esp + 0x44], edi
jmp 0x22e917c
mov dword [esp + 0xb8], eax
jmp 0x22752bc

Function at 0x222d7b9
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x6a6], 0x5c
jmp 0x21e939a
mov byte [esp + 0x2d4], dl
mov byte [esp + 0x2d5], 0x64
jmp 0x22530c6
mov word [esp + 0xb08], si
mov byte [esp + 0x2d0], 0x63
mov byte [esp + 0x2d1], 0x64
mov byte [esp + 0x2d2], dl
mov byte [esp + 0x2d3], dl
jmp 0x204cb13
mov byte [esp + 0x6b4], al
stc
mov byte [esp + 0x6b6], al
clc
cmp edx, edi
mov byte [esp + 0x471], al
mov word [esp + 0xb02], si
movsx ax, dl
bswap eax
lea eax, [esp + 0x328]
test ax, sp
cmc
cmp sp, dx
xor esi, esi
jmp 0x20f605d
push eax
jmp 0x204ed29
mov byte [esp + 0x6a5], 0x3a
jmp 0x2045b7b
mov byte [esp + 0x6a7], 0x77
mov byte [esp + 0x6a8], 0x69
jmp loc.004253cd
push 0x3975c6cc
call fcn.020526e6
mov byte [esp + 0x6ab], al
mov byte [esp + 0x6b1], al
jmp 0x20a2eec
mov byte [esp + 0x2d6], bl
mov byte [esp + 0x6a4], 0x63
jmp 0x21afed0
Function at 0x228788c
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer
Parse pe header
Write file on windows

Disassembly:
push 0x4a141d5e
call fcn.022a71cc
jo 0x22878ec
and dl, ah
daa
outsb dx, byte [esi]
jae 0x2287849
mov al, byte [0x73c6b83b]
pushal
add eax, 0xe91f8c1f
add eax, 0x70e091c5
mov esi, 0x9b60561b
xchg edi, edi
out 0xdf, al
stc
mov cl, 0x37
dec edi
popal
cmp byte [eax + 0x70206839], 0xb6
sub bh, byte [ebp - 0x43153ba2]
push esi
pop ds
jns 0x22878cf
xor edx, ebp
fbstp tbyte [ecx + 0x12]
invalid
ljmp 0x5c57:0xc71271df
pop ds
pop ss
jne 0x2287875
ficomp word [edi]
inc ecx
pop es
jmp dword [eax]

Function at 0x229b9b1
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov si, bx
xchg esi, esi
mov esi, dword [ebp + 0xc]
jmp 0x23bc0b3
call fcn.02339d06
mov ebx, dword [ebp + 8]
jmp 0x2257a69
dec ebx
test bp, 0x3cef
lea esp, [esp + 4]
cmp ebp, 0x3b3e4588
clc
mov dword [ebp - 0x118], ebx
cmc
test ebx, ebx
jmp loc.0042855e
je 0x2291233
push ebx
cmp esp, 0x2fba1acd
test sp, ax
push 7
test esi, 0x48bc7137
sub eax, eax
jmp 0x21e6042
mov ecx, dword [ebp - 4]
bsr di, sp
pop edi
stc
xor ecx, ebp
pop esi
jmp 0x236be09
push ebp
not al
cbw
mov ebp, esp
test esp, edi
rcr eax, 0x4f
bsr ax, cx
lea esp, [esp - 0x11c]
bsr eax, ebx
mov eax, dword [0x51f620]
clc
test si, bx
xor eax, ebp
jmp 0x22a7187
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
jmp 0x20387df
mov dword [ebp - 0x110], edi
jmp 0x23a568b
call fcn.0046d9d8
mov esp, ebp
pop ebp
jmp fcn.0054eae7
mov dword [ebp - 0x10c], ecx
jmp 0x226380e
push edi
mov edi, edx
jmp 0x230d99a

Function at 0x22f0042
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0x11345ac
call fcn.004295f3