joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403637
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4036a9
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x403682
cmp dword [ebp + 0x10], ebx
jne 0x4036b0
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00403637
test eax, eax
jne 0x403694
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x403669
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x4036a9

Function at 0x403ac1
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x403aee
mov ecx, dword [0x424398]
push edi
add eax, ecx
push edi
push eax
mov dword [0x417504], eax
push dword [0x409020]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403bec
cmp eax, edi
jl 0x403be5
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409020]
call ebx
test eax, eax
je 0x403be2
cmp dword [ebp - 4], esi
jne 0x403be2
push dword [ebp + 8]
add dword [0x417504], esi
call fcn.00403bec
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403be5
cmp dword [ebp + 0x10], edi
jne 0x403bb1
cmp dword [ebp + 8], edi
jle 0x403bdd
mov esi, 0x4134c0
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x403b61
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409020]
call ebx
test eax, eax
je 0x403be2
cmp edi, dword [ebp - 4]
jne 0x403be2
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403bad
cmp dword [ebp + 0x14], edi
jne 0x403bad
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x417504], eax
cmp dword [ebp + 8], 0
jg 0x403b54
jmp 0x403bdd
push 0xfffffffffffffffe
jmp 0x403be4
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403bbc
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409020]
call ebx
test eax, eax
je 0x403be2
mov eax, dword [ebp - 4]
add dword [0x417504], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403be5
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x430a8c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043090b

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403bf6
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403c0e
push dword [esp + 4]
push 0x403b8f
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x403c4b
push esi
mov esi, dword [0x45e500]
test esi, esi
je 0x403c4a
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403c42
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x45e500
call fcn.00404dda
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403c1b
pop edi
pop ebx
pop esi
ret 4
Function at 0x4043b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4043e5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x404670
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x45e564]
push ebx
push esi
push edi
push eax
or edi, 0xffffffff
push ecx
or ebx, edi
call fcn.00404c1e
mov esi, eax
test esi, esi
je 0x4046ca
mov eax, dword [esi]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov eax, dword [esp + 0x10]
xor edi, edi
xor edx, edx
or ecx, edx
or edi, eax
cmp dword [esi + 4], edx
je 0x4046c0
cmp dword [esi + 0x14], edx
jne 0x4046c0
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
cdq
add ecx, eax
adc edi, edx
mov edx, edi
pop edi
pop esi
mov eax, ecx
pop ebx
ret 4
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
ret 4

Function at 0x4046e0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x45e564]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.00404c1e
test eax, eax
je 0x40472a
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x404717
push 1
push edx
push eax
call fcn.004049a0
movzx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, byte [esp + 3]
pop ecx
ret 4

Function at 0x404740
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x45e564]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00404c1e
test eax, eax
je 0x40478a
cmp dword [eax + 4], 0
lea edx, [esp]
je 0x404777
push 4
push edx
push eax
call fcn.004049a0
mov eax, dword [esp]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4

Function at 0x4047a0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x45e564]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.00404c1e
test eax, eax
je 0x4047ea
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x4047d7
push 1
push edx
push eax
call fcn.004049a0
movsx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, byte [esp + 3]
pop ecx
ret 4
Function at 0x404800
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x404859
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x404858
mov eax, dword [esp + 0x10]
mov ecx, dword [0x45e564]
push eax
push ecx
call fcn.00404c1e
test eax, eax
je 0x404854
cmp dword [eax + 4], 0
je 0x404842
push esi
push edi
push eax
call fcn.00404ad0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x404860
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push edi
push eax
push 0x1000
mov dword [esp + 0x1c], 0x1000
call fcn.004050b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x45e564]
push ecx
mov edi, eax
push edx
mov ebp, edi
call fcn.00404c1e
mov ebx, eax
test ebx, ebx
je 0x40497e
push esi
lea ecx, [ecx]
mov byte [esp + 0x13], 0
cmp dword [ebx + 4], 0
je 0x4048be
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004049a0
mov dword [esp + 0x14], eax
jmp 0x4048d5
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x13]
test al, al
je 0x4048e7
mov byte [ebp], al
mov al, byte [esp + 0x13]
add ebp, 1
mov ecx, dword [esp + 0x18]
mov esi, ebp
sub esi, edi
cmp esi, ecx
jl 0x404911
mov edx, dword [esp + 0x24]
add ecx, 0x1000
push edx
push ecx
mov dword [esp + 0x20], ecx
call fcn.004050b0
mov edi, eax
mov al, byte [esp + 0x13]
lea ebp, [esi + edi]
test al, al
je 0x40497d
cmp dword [esp + 0x14], 0
je 0x404928
cmp al, 0xd
je 0x404928
cmp al, 0xa
jne 0x4048a0
sub ebp, 1
cmp al, 0xd
jne 0x40497d
cmp dword [ebx + 4], 0
je 0x404944
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004049a0
jmp 0x40495b
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x40497d
cmp dword [ebx + 4], 0
je 0x40496e
add dword [ebx + 0xc], 1
jmp 0x40497d
mov ecx, dword [ebx]
push 1
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
sub edi, ebp
add edi, dword [esp + 0x14]
mov byte [ebp], 0
push edi
call fcn.00405130
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x7482c5
Capabilities:
Encode data using base64

Disassembly:
call fcn.00a56662
call fcn.00b69e12
mov esi, 0xf91cbaa5
movzx edx, si
mov edx, dword [ebp + edx*2 - 0x1754a]
bt esi, 0x21
btr si, 0x3e
sbb esi, 0x1aa5a706
mov esi, dword [ebp + 4]
push 0xa1b29400
jns 0xa7a607
add dword [esp], 0xb0221e13
adc ebp, 3
or cl, dl
push 0xd15bc8d
call fcn.007843d1
mov edx, 0x5d95fdb2
push edx
lea ecx, [edx + edx*8 + 0x6509182b]
lea ebp, [ebp + edx - 0x5d95fdb3]
jmp 0xb63c52
mov edx, 0xd0a58614
movzx cx, byte [edi]
adc al, 0x86
movsd dword es:[edi], dword [esi]
shl byte [esi + 0xf], 1
mov dh, 0xc
daa
mov dl, byte [edi + 2]
add edi, 2
push 0xb8a9dabd
push 0x8b0b6820
neg word [esp + 2]
not cl
and byte [esp + 3], 0x1d
jns 0xb61342
movsb byte es:[edi], byte [esi]
adc al, 0x96
mov ebx, 0x27b2963d
insb byte es:[edi], dx
mov dl, byte [ecx - 0x33f628b9]
adc dl, byte [edi - 0x7b]
xor byte [eax - 0x2c], 0x36
mov dword [0x71aa84d], eax
mov bl, 0x3f
jecxz 0xa7a608
std
mov byte [0xaf12ac1c], al
pop ecx
sub dh, ah
aas
jmp 0xa7a610
adc ebp, 3
sar word [esp + 4], 0x8a
push 0xdfbaac25
shrd dx, ax, cl
push 0x4283b03a
jmp 0x7482bb
not dl
jo 0xbabc72
jnp fcn.00731f61
ja 0x7846a0
mov bh, 7
int 0x5d
cmp esi, 0x48
popfd
aas
clc
dec edx
ret 0x8b34
shr cl, 0x27
movzx edx, byte [ebp + edx - 0x5d95fdb2]
xor dl, bl
push ecx
jmp 0xba5e71
jmp fcn.00b4d0df

Function at 0x75bcf1
Capabilities:
Encode data using base64

Disassembly:
or dx, dx
mov edx, dword [ebp + 4]
ja 0xb61529
inc bp
xor ecx, ebx
neg word [esp + 0x17]
sal dword [esp + 0x17], 0x7d
dec eax
mov dword [esp], 0x680cc68c
dec esi
lea ebx, [esp + ebx + 0x20]
push 0xd318c28b
jne 0x75c3f5
call fcn.00791c45
call fcn.00a872aa
sbb dword [ebp - 0xe], 0xb5830fff
mov ebx, 0x1d9dfffe
mov ebx, 0x88368618
xchg ebp, eax
add esi, dword [esi - 0x4c]
jae 0xb4d0e4
popfd
sbb eax, 0x368618bb
mov byte [ebp + 0x5bb47603], dl
pop ebx
int1
sbb eax, 0xc1dc02c7
cmp esp, dword [esi]
sar byte [eax], 0x8b
popal
out 0xca, eax
dec esp
cmp eax, 0x5006f4f3
rol dword [edx - 0x4f], 0x3f
sbb al, 0x93
xor ebp, esi
xchg ebp, eax
fist word [ebx + 0xe]
jp 0xb6155a
int 0x90
test byte [ebp + edx*2 + 0x39], ch
jle 0xb6153a
or dl, byte [esi + 0x963ea16]
jnp 0xb61599
sbb al, 0x68
sysenter
inc esp
mov al, byte [0x857904ae]
mov ah, 0xe1
loopne 0xb615d3
pop ds
ja 0xb61524
jae 0xb61525
push 0x43125305
cmpsd dword [esi], dword es:[edi]
or al, 0x35
add byte [ecx - 0x7f], dl
in al, dx
fisttp qword [eax + 0x4f369302]
iretd
int 0x5f
dec esi
mov al, byte [0x6b15e54f]
push ss
mov al, byte [0xaa781fd1]
cli
sar dword fs:[edi], 0x7e
mov al, byte [0x2e5305df]
add al, 0x3e
das
mov edi, 0x2e61de78
pop ecx
jno 0x7015c3e8
mov dl, 0x6d
xchg edi, eax
push eax
push edi
xor dword [esi], edx
or dword [ebx + 0x40], ebp
xor al, 0x37
nop
mov ah, 0x37
or al, 0x30
xchg esp, eax
mov dword [0xe4f719c6], eax
popal
loopne 0xb615ba
aam 0xd
clc
test byte [0x1802c353], 4
enter 0x55e, 0x3c
sbb dword [ecx - 0x2591e904], edi
jb 0xb615c4
mov dword [edi - 0x1e], 0xfc9401c8
fstp qword [eax - 0x47]
fdiv qword [esi + 0x77]
jb 0xb61588
enter 0x1f5e, 0xffffffffffffffc1
fdiv qword [eax - 0x28bc323e]
and eax, 0x29832ef8
dec esi
pushfd
retf 0xd8b1
Function at 0x75df4e
Capabilities:
Encode data using base64

Disassembly:
pop edi
pushfd
pop edi
mov dword [esp], edi
bt si, si
ror si, 0xa5
mov esi, eax
jb 0xb386bf
mov edi, 0x6f890fbe
mov edi, edx
jb 0xbc89cb

Function at 0x7abc5d
Capabilities:
Encode data using xor

Disassembly:
dec dl
push 0x9fa662b9
push 0x3c35073a
jmp 0xbe2174
jmp 0xbb81df
xor bl, dl
jmp 0xa68510

Function at 0xa7a607
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
call fcn.00a56662
call fcn.00b69e12
mov esi, 0xf91cbaa5
movzx edx, si
mov edx, dword [ebp + edx*2 - 0x1754a]
bt esi, 0x21
btr si, 0x3e
sbb esi, 0x1aa5a706
mov esi, dword [ebp + 4]
push 0xa1b29400
jns 0xa7a607
add dword [esp], 0xb0221e13
adc ebp, 3
or cl, dl
push 0xd15bc8d
call fcn.007843d1
mov edx, 0x5d95fdb2
push edx
lea ecx, [edx + edx*8 + 0x6509182b]
lea ebp, [ebp + edx - 0x5d95fdb3]
jmp 0xb63c52
mov edx, 0xd0a58614
movzx cx, byte [edi]
adc al, 0x86
movsd dword es:[edi], dword [esi]
shl byte [esi + 0xf], 1
mov dh, 0xc
daa
mov dl, byte [edi + 2]
add edi, 2
push 0xb8a9dabd
push 0x8b0b6820
neg word [esp + 2]
not cl
and byte [esp + 3], 0x1d
jns 0xb61342
movsb byte es:[edi], byte [esi]
adc al, 0x96
mov ebx, 0x27b2963d
insb byte es:[edi], dx
mov dl, byte [ecx - 0x33f628b9]
adc dl, byte [edi - 0x7b]
xor byte [eax - 0x2c], 0x36
mov dword [0x71aa84d], eax
mov bl, 0x3f
jecxz 0xa7a608
std
mov byte [0xaf12ac1c], al
pop ecx
sub dh, ah
aas
jmp 0xa7a610
adc ebp, 3
sar word [esp + 4], 0x8a
push 0xdfbaac25
shrd dx, ax, cl
push 0x4283b03a
jmp 0x7482bb
not dl
jo 0xbabc72
jnp fcn.00731f61
ja 0x7846a0
mov bh, 7
int 0x5d
cmp esi, 0x48
popfd
aas
clc
dec edx
ret 0x8b34
shr cl, 0x27
movzx edx, byte [ebp + edx - 0x5d95fdb2]
xor dl, bl
push ecx
jmp 0xba5e71
jmp fcn.00b4d0df

Function at 0xa9b99f
Capabilities:
Encode data using base64

Disassembly:
mov ebp, dword [esp + 4]
jmp 0xafa24c
jmp 0xa555bf
jae 0xbc0a10
adc ebp, 4
mov dword [esp], 0x41bfb81e
jmp 0xaf8250
call fcn.00b811f4
jae 0xae3174
mov ebx, 0xba09b72d
mov esp, ebp
popfd
not bx
push ebx
movsx esi, byte [esp]
mov eax, dword [esp + 4]
pop ebx
jmp 0xa85570

Function at 0xab02df
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x9c83fabe
sub al, 0xbc
push 0x1e3f7c12
rol al, 1
not al
ror word [esp + 4], 0xb
jae 0xb39ef1

Function at 0xabde00
Capabilities:
Encode data using base64

Disassembly:
adc edi, 2
jmp 0xb69df5
mov dword [esp], 0xf8b2502a
shr cx, 1
rcr edx, cl
call fcn.00acabe0
stc

Function at 0xacc97e
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x20]
jmp fcn.00b6ab0c
mov al, byte [ebp + eax - 0x7f8c8f1c]
jae 0xb315cd
mov dword [esp], 0x2a29a6af
neg word [esp + 1]
adc ebp, 1
call fcn.00aa2c95
mov word [ebp], ax
push 0xc61ca101
jmp 0xa99f85

Function at 0xb432f1
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x43be1ab3
shl dword [esp], 0x16
adc ebp, 2
not dl
or word [esp], 0xb3bd
not al
jle 0xaec480
Function at 0xb5aff5
Capabilities:
Encode data using base64

Disassembly:
jmp 0xb0d56a
dec esp
mov esi, dword [edi + 8]
push 0x6f29a406
dec eax
rol dword [esp], 0xc3
dec eax
adc edi, 8
rol byte [esp + 4], 0xa7
dec ecx
add esi, esi
dec eax
mov dword [edi], esi
push 0xe301860b
push 0x33003bbd
dec eax
lea esp, [esp + 0x20]
jmp fcn.00b56ed4
shr dword [esp], 0xc6
dec dl
push 0xb1da809
sar dword [esp + 8], 0x21
xor bl, dl
lea edx, [esp + edx + 0xc]
mov word [edx], si
lea esp, [esp + 0xc]
jmp fcn.0079551e
xor dl, 0xbb
dec dl
jmp 0xb4ec96
not dl
jmp 0x788e9b
inc cx
sal esi, 0x45
dec eax
mov esi, dword [edi]
ja 0xb083f1
ror dl, 1
add word [esp + 2], 0x9d02
push 0x9f0d8bad
js 0xb1fefe
test bp, 0xedaa
stc

Function at 0xb7752e
Capabilities:
Encode data using xor

Disassembly:
not word [esp + 6]
add ebp, 4
shr word [esp + 5], 2
not dword [esp + 4]
xor ecx, ecx
test esi, esi
lea esp, [esp + 8]
je 0xa4c219
mov eax, 0xb70a4
push eax
movzx eax, byte [edx + eax*4 - 0x2dc290]
xor eax, ecx
and eax, 0xff
dec word [esp + 1]
mov eax, dword [eax*4 + 0xa5fca4]
shr ecx, 8
xor ecx, eax
inc edx
neg dword [esp]
xor ecx, 0x710fc132
dec esi
lea esp, [esp + 4]
jne 0xa4c1dd
call fcn.007ab76c
jmp 0xa4c1ba

Function at 0xba6380
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], dx
call fcn.007a3063
cmp bp, 0x8010

Function at 0xbb2008
Capabilities:
Encode data using xor

Disassembly:
inc edi
and al, byte [ebx]
fild word [esp + ebp*8 - 0x48]
mov eax, 0x58354589
mov byte [0xcf6ec683], al
mov edx, 0x540c36fb
mov al, byte [0x667930ae]
xor di, 0xd087
not dword [esp + 4]
invalid
xor di, 0xd087
not dword [esp + 4]
shr word [esp + 6], 0x6a
neg di
neg dword [esp + 4]
mov dword [esp], 0xa915c0e
ror word [esp + 6], 1
rol di, 1
push 0xc81939b1
mov dword [esp + 5], 0xe331361b
dec byte [esp + 5]
inc di
push 0x6609eca8
xor di, 0xa224
xor bx, di
sub ebp, 2
push 0x6272a07
mov word [ebp], di
call fcn.0072ebfd
cld
salc
leave
jbe 0xbb1fee
jb 0xbb20e8
inc esi
dec ebp
mov dl, 0x2d
jp 0xbb20ca
jbe 0xbb1ffc
lcall 0x14b1, 0x9ac9a6a1
rcl dword [ebx], 0x24
push ds
and byte [edi - 0x3e], cl
rcr dword [eax], 0xbd
and byte [ecx], 0x3c
lea ebp, [edi + 0x40]
add ax, ax
inc ecx
mov ebp, fs
invalid
xor byte [esi - 0x6e], bl
lcall 0xe24d, 0x6b964788
dec esi
or al, 0x67
mov byte [0xa4b859d9], al
inc ecx
salc
push ecx
cmpsb byte [esi], byte es:[edi]
popfd
mov ebx, 0x94090bee
mov esi, 0x25f0f564
xor ebx, dword [eax + 0x2c]
jl 0xbb20f5
cmc
invalid
cmp eax, 0xa4063a26
xor ebx, dword [eax + 0x2c]
xchg esi, eax
cwde
jge 0xbb20e0
dec edi
aas
xor al, 0xf3
cmp al, 0x52
enter 0x1738, 0x5a
pushfd
pop edx
and dword [bp + si + 0x4b2e], edx
dec ebp
je 0xbb216a
popal
push ecx
ret 0x6d34
or dword [esi], esp
stosd dword es:[edi], eax
pop esp
retf 0xa4df

Function at 0xbcbb77
Capabilities:
Encode data using base64

Disassembly:
add ebp, 4
push 0xc9bdcba2
shr dword [esp], 0xa9
push 0x99931fa4
not ecx
not eax
jns 0xac1d1f
mov dword [ebp], ecx
or ecx, eax
push 0x6b1444ba
jmp 0x77feef
jp 0x727184
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x448574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x448570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x448570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x40229a
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push edi
push dword [0x403716]
call dword [sym.imp.pdh.dll_PdhCloseLog]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x4022c9
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x40164f], eax
ret
Function at 0x4082e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x44d1fc], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408329
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x408306
mov dword [edx*4 + 0x44d1f8], eax
inc edx
cmp edx, 0x100
jne 0x4082ff
mov eax, dword [ebp + 8]
not eax
jmp 0x408343
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x44d1f8]
test ebx, ebx
jne 0x408330
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x5985c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x119000]
push edi
or ebp, 0xffffffff
jmp 0x5985e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5985e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5985d8
mov eax, 1
add ebx, ebx
jne 0x5985fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x59860c
jne 0x59862b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x59862b
dec eax
add ebx, ebx
jne 0x598618
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5985f0
add ebx, ebx
jne 0x598627
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x59867d
xor ecx, ecx
sub eax, 3
jb 0x598643
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5986b2
sar eax, 1
mov ebp, eax
jmp 0x59864e
add ebx, ebx
jne 0x59864e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x59861c
inc ecx
add ebx, ebx
jne 0x59865c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x59861c
add ebx, ebx
jne 0x598669
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x59865e
jne 0x59867a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x59865e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x59869c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x59868e
jmp 0x5985de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x59869c
add edi, ecx
jmp 0x5985de
pop esi
mov edi, esi
mov ecx, 0x3681
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5986ba
cmp byte [edi], 0x13
jne 0x5986ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5986bf
lea edi, [esi + 0x195000]
mov eax, dword [edi]
or eax, eax
je 0x598737
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a97e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a9910]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5986ec
mov ecx, edi
jns 0x59871b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a9914]
or eax, eax
je 0x598731
mov dword [ebx], eax
add ebx, 4
jmp 0x598709
call dword [esi + 0x1a9924]
mov ebp, dword [esi + 0x1a9918]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x59876b
sub esp, 0xffffff80
jmp 0x468757
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x34269e5
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x59658a0
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219