joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7cf3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4e202e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4a7d4b
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4e204f
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4a7d41
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a7d4f
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4b6038
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4b6068
cmp dword [esp + 4], 6
jb 0x4b6068
call fcn.0043b6e0
call fcn.0043b7c0
test al, al
je 0x4b6068
mov al, 1
jmp 0x4b606a
xor eax, eax
add esp, 0x94
ret
Function at 0x4b6598
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbac
push ebx
xor edx, edx
mov dword [ebp - 0x448], edx
mov dword [ebp - 0x44c], edx
mov dword [ebp - 0x450], edx
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x444], edx
mov dword [ebp - 0x43c], edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x438], edx
mov dword [ebp - 0x434], edx
mov dword [ebp - 0x430], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b67e5
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402a18
test eax, eax
push 0xfa
lea eax, [ebp - 0x32b]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x430]
lea eax, [ebp - 0x32b]
call fcn.0040a17c
mov edx, dword [ebp - 0x430]
lea eax, [ebp - 0x42b]
mov ecx, 0xff
call fcn.004050a8
lea eax, [ebp - 0x42b]
mov edx, 0xff
call fcn.004b654c
lea eax, [ebp - 0x434]
lea edx, [ebp - 0x42b]
call fcn.00405070
lea eax, [ebp - 0x434]
mov edx, 0x4b67fc
call fcn.004050d4
mov edx, dword [ebp - 0x434]
lea eax, [ebp - 0x42b]
mov ecx, 0xff
call fcn.004050a8
lea eax, [ebp - 0x438]
lea edx, [ebp - 0x42b]
call fcn.00405070
lea eax, [ebp - 0x438]
mov edx, 0x4b6808
call fcn.004050d4
mov edx, dword [ebp - 0x438]
lea eax, [ebp - 0x1cc]
call fcn.00402f24
lea eax, [ebp - 0x1cc]
call fcn.00402cc0
call fcn.00402a18
test eax, eax
je 0x4b6739
lea edx, [ebp - 0x440]
xor eax, eax
call fcn.00402b64
mov eax, dword [ebp - 0x440]
lea edx, [ebp - 0x43c]
call fcn.00409e10
mov edx, dword [ebp - 0x43c]
lea eax, [ebp - 0x42b]
mov ecx, 0xff
call fcn.004050a8
lea eax, [ebp - 0x42b]
mov edx, 0xff
call fcn.004b654c
lea eax, [ebp - 0x444]
lea edx, [ebp - 0x42b]
call fcn.00405070
lea eax, [ebp - 0x444]
mov edx, 0x4b67fc
call fcn.004050d4
mov edx, dword [ebp - 0x444]
lea eax, [ebp - 0x42b]
mov ecx, 0xff
call fcn.004050a8
jmp 0x4b6756
mov byte [ebp - 0x42b], 0
lea eax, [ebp - 0x1cc]
call fcn.00402fec
lea eax, [ebp - 0x1cc]
call fcn.004031c8
lea eax, [ebp - 0x448]
lea edx, [ebp - 0x42b]
call fcn.00405070
lea eax, [ebp - 0x448]
push eax
lea edx, [ebp - 0x454]
xor eax, eax
call fcn.00402b64
mov eax, dword [ebp - 0x454]
lea edx, [ebp - 0x450]
call fcn.00409e44
mov eax, dword [ebp - 0x450]
lea ecx, [ebp - 0x44c]
mov edx, 0x4b6820
call fcn.00409d7c
mov edx, dword [ebp - 0x44c]
pop eax
call fcn.004050d4
mov edx, dword [ebp - 0x448]
mov eax, ebx
mov ecx, 0xff
call fcn.004050a8
call fcn.00402a18
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b67ec
lea eax, [ebp - 0x454]
mov edx, 0xa
call fcn.00404e30
ret
Function at 0x4b8430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b85b1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e22b8], 0
jne 0x4b858e
push 0x4e4030
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x4b8587
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e22b8], 0
jne 0x4b856f
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405458
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.004052cc
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0040931c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4b85c8
call fcn.0040a66c
mov eax, dword [ebp - 0xc]
call fcn.004052cc
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x4b84f0
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405458
jmp 0x4b8527
lea eax, [ebp - 8]
mov edx, 0x4b85e8
call fcn.00404ea4
xor eax, eax
push ebp
push 0x4b851d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00472af4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8527
mov eax, dword [ebp - 8]
call fcn.004052cc
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4e22b8], eax
cmp dword [0x4e22b8], 0
jne 0x4b855a
mov ecx, dword [0x4e2894]
mov dl, 1
mov eax, dword [0x4086a0]
call fcn.0040d67c
call fcn.004047c0
push 0x4b85f4
mov eax, dword [0x4e22b8]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x4e4048], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b858e
push 0x4e4030
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b85b8
lea eax, [ebp - 0x18]
call fcn.00404e0c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404e30
ret
Function at 0x4cf2a0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x87], 0
je 0x4cf2db
cmp dword [ebx + 0x5c], 0
je 0x4cf2db
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.004c7298
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x4cf426
cmp dword [ebx + 0x7c], 0
jne 0x4cf301
mov dl, 1
mov eax, dword [0x41ad30]
call fcn.00403f00
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x4cf3ff
mov eax, dword [ebx + 0xc]
push eax
mov al, byte [0x4cf42c]
push eax
mov al, byte [0x4cf430]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x4e28c4]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x4a0544]
call fcn.004a2804
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4cf3f8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004c7298
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.004c7298
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x4c4b54]
call fcn.004062b4
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1a
jge 0x4cf3cb
mov edx, dword [0x4e2b2c]
mov al, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x4cf3dc
cmp eax, 0x1007
jne 0x4cf3d8
mov byte [ebx + 0x74], 0x18
jmp 0x4cf3dc
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf426
mov eax, dword [ebp - 4]
call fcn.00403f30
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004c7298
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4dc92c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbac
push ebx
xor edx, edx
mov dword [ebp - 0x448], edx
mov dword [ebp - 0x44c], edx
mov dword [ebp - 0x450], edx
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x444], edx
mov dword [ebp - 0x43c], edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x438], edx
mov dword [ebp - 0x434], edx
mov dword [ebp - 0x430], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dcb79
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402a18
test eax, eax
push 0xfa
lea eax, [ebp - 0x32b]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x430]
lea eax, [ebp - 0x32b]
call fcn.0040a17c
mov edx, dword [ebp - 0x430]
lea eax, [ebp - 0x42b]
mov ecx, 0xff
call fcn.004050a8
lea eax, [ebp - 0x42b]
mov edx, 0xff
call fcn.004dc8e0
lea eax, [ebp - 0x434]
lea edx, [ebp - 0x42b]
call fcn.00405070
lea eax, [ebp - 0x434]
mov edx, 0x4dcb90
call fcn.004050d4
mov edx, dword [ebp - 0x434]
lea eax, [ebp - 0x42b]
mov ecx, 0xff
call fcn.004050a8
lea eax, [ebp - 0x438]
lea edx, [ebp - 0x42b]
call fcn.00405070
lea eax, [ebp - 0x438]
mov edx, 0x4dcb9c
call fcn.004050d4
mov edx, dword [ebp - 0x438]
lea eax, [ebp - 0x1cc]
call fcn.00402f24
lea eax, [ebp - 0x1cc]
call fcn.00402cc0
call fcn.00402a18
test eax, eax
je 0x4dcacd
lea edx, [ebp - 0x440]
xor eax, eax
call fcn.00402b64
mov eax, dword [ebp - 0x440]
lea edx, [ebp - 0x43c]
call fcn.00409e10
mov edx, dword [ebp - 0x43c]
lea eax, [ebp - 0x42b]
mov ecx, 0xff
call fcn.004050a8
lea eax, [ebp - 0x42b]
mov edx, 0xff
call fcn.004dc8e0
lea eax, [ebp - 0x444]
lea edx, [ebp - 0x42b]
call fcn.00405070
lea eax, [ebp - 0x444]
mov edx, 0x4dcb90
call fcn.004050d4
mov edx, dword [ebp - 0x444]
lea eax, [ebp - 0x42b]
mov ecx, 0xff
call fcn.004050a8
jmp 0x4dcaea
mov byte [ebp - 0x42b], 0
lea eax, [ebp - 0x1cc]
call fcn.00402fec
lea eax, [ebp - 0x1cc]
call fcn.004031c8
lea eax, [ebp - 0x448]
lea edx, [ebp - 0x42b]
call fcn.00405070
lea eax, [ebp - 0x448]
push eax
lea edx, [ebp - 0x454]
xor eax, eax
call fcn.00402b64
mov eax, dword [ebp - 0x454]
lea edx, [ebp - 0x450]
call fcn.00409e44
mov eax, dword [ebp - 0x450]
lea ecx, [ebp - 0x44c]
mov edx, 0x4dcbb4
call fcn.00409d7c
mov edx, dword [ebp - 0x44c]
pop eax
call fcn.004050d4
mov edx, dword [ebp - 0x448]
mov eax, ebx
mov ecx, 0xff
call fcn.004050a8
call fcn.00402a18
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcb80
lea eax, [ebp - 0x454]
mov edx, 0xa
call fcn.00404e30
ret
Function at 0x40367c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov edx, dword [eax]
mov dword [0x50f39c], edx
mov ecx, dword [eax]
test ecx, ecx
jb 0x40f52e
je 0x4036a5
jne 0x40369e
test ebx, ebp
lodsb al, byte [esi]
dec eax
mov dword [ebp - 8], 1
shl ah, 0x20
push eax
call edi
mov eax, dword [ebp - 8]
test eax, eax
jb 0x43ee94
mov di, di
jne 0x43b959
shl ebp, 0x20
je 0x4036c8
sbb esp, dword [eax - 0x3e990ab2]
out dx, eax
inc eax

Function at 0x40aa1e
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov byte [esi + 0xba], bl
shr cl, 0x40
mov byte [esi + 0xbb], dl
xchg ebp, edx
shr ebx, 0x40
xchg edx, ebp
mov word [esi + 0xbc], di
mov cx, cx
call fcn.0042575f
mov cl, byte [ebp + 0xc]
mov di, di
shl ch, 0x20
xchg bl, ch
mov bx, bx
xchg ch, bl
mov dx, word [ebp + 0x10]
jne 0x42bca5
je 0x40aa66
mov cl, 0xe8
jg 0x40aa76
je 0x42bca5
test byte [ecx], bh
adc al, byte [edx]
add byte [esp + esi*8], dh
xor al, 0xf4
adc cl, dh
inc edx
add byte [eax], al
inc eax
add byte [eax], al
sub byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], ah
cmp byte [eax + eax], 0
add byte [ecx], al
popal
add byte [eax + 0x2c], al
add byte [ecx], ah
add byte [eax], al
push cs
add byte [eax], al
add byte [esi], dh
sub al, 0x42
add byte [edx], bl
daa
inc edx
add byte [eax + eax], bh
add byte [eax], al
xchg edx, eax
stc
inc eax
add byte [esi + 0x69], dh
inc ebx
add al, bl
pop edi
push eax
mov eax, eax
jne 0x43cac8

Function at 0x40bc9a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dl, dl
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
xor eax, eax
jb 0x434328
cmp cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__n_r]
mov cl, cl
je 0x438714
shl ah, 0x20
jne 0x40bcc3
movsb byte es:[edi], byte [esi]
sbb al, 0x6b
invalid
inc eax
jne 0x4386f5
je 0x40bcd1
aas
cmp dword [esp + ebp*2], edx
iretd
je 0x4386f5
add eax, 0x113ae831
add eax, dword [eax]
lea ebp, [ebp]
mov eax, 1
jmp 0x41f6da
pop ebp
shr edx, 0x40
ret
cmp eax, 0x43
jb 0x40bcaa
jae 0x438708
scasd eax, dword es:[edi]
add ch, bl
mov eax, dword [0xc031c598]
xor eax, eax
jb 0x434330
pop ebp
ret
jne 0x4143be
je 0x438720
cpuid
mov edx, 0x98840fc3
mov esp, 0x2405fffd
je 0x4143be
add eax, 0x1c3f624

Function at 0x40c0c6
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
add esi, 0
jno 0x40a871
xchg ebp, esi
pop esp
lea esp, [esp + 4]
add dx, 0
cmp al, 2
jne 0x40a866
xchg ebp, edx
shr ecx, 0x40
xchg edx, ebp
je 0x40c0e5
ret 0xdf65
shl bh, 0x20
mov ebp, ebp
mov ax, dx
clc
add edx, 0
add ecx, 0x47
shr ax, 0xe
shr ah, 0x40
xchg edx, ebx
xchg ebx, edx
shl edx, 2
or eax, edx
jb 0x4334c3
stc
jb 0x40c118
popal
int3
jb 0x435006
sub byte [edx - 0x73], 0x64
and al, 4
push ds
call 0x1030be2f
lea ecx, [0x7c000000]
add al, 0xa0
add byte [ecx + 0x68], dl
lea esi, [esi + 8]
jmp dword [esi]
Function at 0x412cf5
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebx
pop ebx
push ebp
mov ebp, esp
sub esp, 0x12c

Function at 0x412ff5
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
jne 0x4400a2
je 0x413003
leave
salc
je 0x4400a2

Function at 0x4141e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [esi]
mov cl, byte [ebp + eax - 0x1c]
add cl, 0x1f
mov dl, byte [edi + 0xbc]
sub dl, 0x14
xor cl, dl
jb 0x414393
mov byte [edi + eax + 0x24], cl
inc eax
cmp eax, 8
jl 0x414254
jge 0x401980
xor al, 0xc4
int3
jmp 0x402e0a
test al, al
jb 0x4143bc
jne 0x4054de
je 0x40199a
mov al, byte ds:[0xe4458dd4]
lea eax, [ebp - 0x1c]
push 8
add ecx, 0x24
jmp 0x4019a6
push eax
push ecx
ja 0x4054cc
jbe 0x4019b6
test dword [eax], ecx
in eax, 9
jg 0x4019c6
jbe 0x4054cc
xchg byte [eax], dl
cmp eax, dword [eax]
add cl, bl
mov al, 0x8b
pop esi
add al, 0xf
fnstenv [eax + 0xf045e8b]
mov dh, bh
mov dh, 2
add byte [ecx + 5], bh
invalid
call int.00439c56
add esp, 0xc
jmp 0x402e0a
xor eax, eax
jb 0x43b52f
pop esi
mov ch, 0x2e
jns 0x42b104
and dh, 0x68
dec ebp
fadd dword [ebx]
ret
add esp, 0x18
jmp fcn.0040bafa
xor eax, 0x24648ddc
add al, 0xe9
push ecx
enter 1, 0xffffffffffffffd9
stosb byte es:[edi], al
call fcn.00434b3f
xor eax, eax
jb 0x42e0cd
mov ax, word [edi + 0x20]
push eax
push esi
push edi
pop edi
call fcn.00428fca
xor ecx, ecx
jb 0x4101e8
mov cx, word [edi + 0x24]
push ecx
xchg dl, bh
xchg bh, dl
push esi
call fcn.0042086e
sub edx, 0
jno 0x413d60
adc eax, 0xba810f1d
out dx, al
invalid
jno 0x412c20
invalid
lea esp, [esp + 4]
mov al, byte [ecx + 0xba]
cmp al, 1
jne 0x41423b
je 0x4141fa
mov byte [0xfb80211b], al
push edx
xor eax, eax
jb 0x42590f
cmp al, 2
mov bl, bl
jne 0x401987
je 0x41424c
jg 0x414269
jbe 0x41423b
in al, dx
xor eax, eax
jb 0x413d1a
jno 0x40194f
jo 0x41425e
daa
adc byte [edi], cl
sub bl, 0xd6
invalid
jo 0x40194f
add eax, 0x59ebe892
add al, byte [eax]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [0x50f370], ecx
shl bh, 0x20
mov eax, dword [0x50f370]
mov esp, ebp
shr bx, 0x40
pop ebp
ret
je 0x41437f
add byte [0x45e8b5a], ah
lea esi, [esi + 8]
xchg dh, cl
xchg cl, dh
shl word [ebp + ebx], cl
jmp dword [esi]
movsb byte es:[edi], byte [esi]
pop edx
mov si, si
mov al, al
mov cl, byte [ebp + 0x28]
mov ebx, dword [esi + 4]
mov cx, cx
lea esi, [esi + 8]
shl dword [ebp + ebx], cl
jne 0x43b52d
je 0x4143b6
loopne 0x41437d
dec ebp
mov esi, 0x7171840f
add al, byte [eax]
je 0x43b52d
invalid
xor eax, 0x24648dc8
add al, 0x8d
jbe 0x425924
cmp dh, dh
cmp dword [ebp + ebx], eax
jmp dword [esi]
mov bp, bp
lea edx, [edx]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov ebx, dword [ebp + ebx]
shr cx, 0x40
lea esi, [esi + 0xc]
or bh, bh
cmp byte [ebx], al
call fcn.0041dba0
fld dword [eax - 0x77bf1340]
shr ah, 0x40
mov bl, bl
jmp dword [esi]
invalid
jmp dword [esi]
pop edi
in al, dx
shl dh, 0x20
mov cl, byte [ebp + 0x28]
mov ebx, dword [esi + 4]
lea esi, [esi + 8]
shr byte [ebx], cl
jmp dword [esi]
Function at 0x433ca9
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + 0xc]
test word [ebp + ebx], ax
jb 0x4275cb
shr ah, 0x40
jmp dword [esi]
js 0x41ac42
jns 0x422848
adc byte [esi + 0xa], 0xe6
jns 0x41ac42
frstor dword [esi]
shr al, 0x40
ja 0x429411
jbe 0x4275dc
stosb byte es:[edi], al
pop es
xor eax, 0x2f860ff1
push ds
add byte [eax], al
jbe 0x429411
xchg bl, cl
xchg cl, bl
js 0x431b41
jns 0x429420
jns 0x431b41
pop dword [esp - 4]
mov ebx, dword [esi + 8]
js 0x42283c
jns 0x433cbc
cpuid
retf
jns 0x42283c

Function at 0x434031
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
test eax, eax
jb 0x428ed2
jle 0x407f01
jg 0x40190c
nop
cpuid
ret 0x5d8a
mov bl, byte [ebp + 8]
jmp 0x40925b
push ebx
jmp 0x40925e
push esi
push 0x51002a
xor esi, esi
jb 0x4417b0
call fcn.0041c857
jno 0x43c49e
jo 0x40927e
cpuid
ret
jo 0x43c49e
and byte [ecx], 0xf
or dword [ecx + 0x70000072], 0x1b65cf04
push ebp
cwde
movsb byte es:[edi], byte [esi]
mov edx, edx
jmp 0x435c15
push esi
pop esi
push ebp
mov ebp, esp
js 0x40925a
mov di, di
jns 0x434047
stosd dword es:[edi], eax
add eax, 0xf8b5d20
mov dword [0x25fffd52], ecx
in eax, 0x8b
inc esi
add al, 0x8b
pop esi
or byte [ebx + 0xf000544], cl
test dword [ecx], edx
bound eax, qword [eax]
add byte [ebp + eax - 0x7d], dh
cmp al, 0x22
out dx, eax
jns 0x40925a
and eax, 0x4468be5
mov ebx, dword [ebp + 0x38]
push eax
pop eax
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
lea esi, [esi + 0xc]
or word [ebx + edx], ax
jb 0x423f50
jmp dword [esi]
add esp, 4
ja 0x4018f8
jbe 0x43c4af
xor eax, 0x860f159c
inc ebx
push esp
cld
inc dword [0x565fe82b]
jbe 0x4018f8
add eax, 0x565fe82b
std
invalid

Function at 0x434089
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
js 0x441c5b
jns 0x434097
jns 0x441c5b
mov eax, dword [esi + 4]
mov eax, eax
mov eax, dword [ebp + eax]
shr di, 0x40
mov ebx, dword [esi + 8]
mov eax, dword [eax]
lea esi, [esi + 0xc]
mov dword [ebp + ebx], eax
jmp dword [esi]
Function at 0x438abf
Capabilities:
Get file size

Disassembly:
mov eax, eax
push ebp
shr edi, 0x40
mov ebp, esp
mov ecx, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xchg ecx, eax
xchg ecx, eax
mov ecx, dword [ebp + 8]
test eax, 0xb30c5415
test ecx, ecx
jb 0x42320d
je 0x438afd

Function at 0x43e767
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [ebp + 0xc]
push esi
jne 0x42d1e1
je 0x43e77c
nop
cpuid
ret 0x840f
je 0x42d1e1
xor ch, 0xf
test dword [edx], esi
xchg ebx, eax
std
dec dword [eax + 0x280474d2]
fisttp qword [ebx + 0x24]
mov ax, ax
jmp fcn.00433ac6

Function at 0x440a57
Capabilities:
Encode data using base64

Disassembly:
call 0x42d202
add eax, 0xfc085a3
add byte [esi + 0x36], 0
add byte [ebx + 0x50fdb3], ah
lea esp, [esp + 4]
jmp 0x41a6a4

Function at 0x444860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebp
xor ebp, ebp
test eax, eax
jle 0x4448ef
mov eax, dword [esp + 0x10]
push ebx
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
lea esp, [esp]
inc ecx
and ecx, 0x800000ff
jns 0x444891
dec ecx
or ecx, 0xffffff00
inc ecx
movzx ecx, cl
movzx edx, byte [ecx + eax]
add edx, esi
and edx, 0x800000ff
jns 0x4448aa
dec edx
or edx, 0xffffff00
inc edx
movzx esi, dl
mov bl, byte [esi + eax]
mov dl, byte [ecx + eax]
mov byte [ecx + eax], bl
mov byte [esi + eax], dl
movzx edx, byte [ecx + eax]
movzx ebx, byte [esi + eax]
add edx, ebx
and edx, 0x800000ff
jns 0x4448d3
dec edx
or edx, 0xffffff00
inc edx
movzx edx, dl
mov bl, byte [edx + eax]
mov edx, dword [esp + 0x14]
xor byte [edi + edx], bl
mov edx, dword [esp + 0x18]
inc ebp
movsx edi, bp
cmp edi, edx
jl 0x444880
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x444900
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
mov ecx, edi
lea esp, [esp]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x444910
xor dl, dl
xor ecx, ecx
mov esi, edi
mov ebp, 0x100
mov eax, dword [esp + 0x14]
movzx ebx, byte [esi]
movzx edx, dl
movzx eax, byte [edx + eax]
sub eax, ebx
add eax, ecx
and eax, 0x800000ff
jns 0x444945
dec eax
or eax, 0xffffff00
inc eax
movzx ecx, al
mov al, byte [esi]
mov bl, byte [ecx + edi]
mov byte [esi], bl
mov byte [ecx + edi], al
lea eax, [edx + 1]
cdq
idiv dword [esp + 0x18]
inc esi
dec ebp
jne 0x444925
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x445260
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
test edi, edi
jbe 0x4452b8
push ebx
push esi
mov esi, dword [esp + 0x10]
movzx edx, byte [esi]
mov ecx, eax
and ecx, 0xf
movzx ecx, word [ecx*4 + 0x5101f0]
shr ax, 4
mov ebx, edx
and ebx, 0xf
xor cx, word [ebx*4 + 0x5101f0]
shr edx, 4
xor ecx, eax
mov eax, ecx
and eax, 0xf
movzx eax, word [eax*4 + 0x5101f0]
xor ax, word [edx*4 + 0x5101f0]
shr cx, 4
xor eax, ecx
inc esi
dec edi
jne 0x445271
pop esi
pop ebx
pop edi
ret

Function at 0x4456a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jbe 0x4456cf
push ebx
lea ebx, [ebx]
xor edx, edx
mov dl, byte [ecx + edi]
xor edx, eax
and edx, 0xff
mov ebx, dword [edx*4 + 0x5102b0]
shr eax, 8
xor eax, ebx
inc ecx
cmp ecx, esi
jb 0x4456b0
pop ebx
not eax
ret

Function at 0x445cd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov ecx, 4
mov al, byte [esi + 2]
mov bl, byte [eax + str._.C]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jle 0x445d08
mov edx, ebx
inc ecx
and edx, 0xff
inc ebx
mov dl, byte [edx + str._.C]
xor byte [esi + ecx - 1], dl
cmp ecx, eax
jl 0x445cf0
pop esi
pop ebx
ret

Function at 0x445fd0
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x446053
pop esi
pop ebx
ret