joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4d68f4]
cmp byte [eax + 0x19], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], 0
jne 0x46536f
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call fcn.00476af2
imul esi, edi
add esp, 0x10
add dword [0x4d6902], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4d6a34]
cmp byte [eax], 1
jne 0x4653a0
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
imul ecx, edi
push edx
push eax
push ecx
call fcn.00465100
add esp, 0x10
test eax, eax
je 0x4653c7
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
mov edx, esi
imul edx, edi
push eax
push ecx
push edx
call fcn.00464f60
add esp, 0x10
test eax, eax
je 0x4653c7
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
imul esi, edi
add dword [0x4d6902], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4653e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
push 1
push ebx
call fcn.0047697e
mov esi, dword [ebp + 0x14]
add esp, 0x10
mov dword [esi], eax
cmp eax, edi
je 0x4654ed
sub edi, eax
mov eax, dword [0x4d6a34]
cmp edi, dword [eax + 9]
jle 0x46548f
mov edx, dword [eax + 1]
mov eax, dword [0x4d68f4]
push 0
lea ecx, [ebp + 0x10]
push ecx
push edx
add eax, 0x127
push eax
call fcn.00464dd0
add esp, 0x10
cmp eax, 1
je 0x4654f4
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x4d6a34]
mov eax, dword [edx + 9]
push ecx
mov ecx, dword [esi]
push eax
add ecx, ebx
push 1
push ecx
call fcn.0047697e
add dword [esi], eax
mov eax, dword [0x4d6a34]
mov edx, dword [0x4d68f4]
sub edi, dword [eax + 9]
mov eax, dword [eax + 1]
add edx, 0x127
push edx
push eax
push 0xc03
call fcn.00463910
mov eax, dword [0x4d6a34]
inc dword [eax + 1]
mov eax, dword [0x4d6a34]
add esp, 0x1c
cmp edi, dword [eax + 9]
jg 0x465415
mov edx, dword [eax + 1]
mov eax, dword [0x4d68f4]
push 0
lea ecx, [ebp + 0x10]
push ecx
push edx
add eax, 0x127
push eax
call fcn.00464dd0
add esp, 0x10
test eax, eax
jne 0x4654f4
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi]
push ecx
push edi
add edx, ebx
push 1
push edx
call fcn.0047697e
add dword [esi], eax
mov eax, dword [0x4d68f4]
mov ecx, dword [0x4d6a34]
mov edx, dword [ecx + 1]
add eax, 0x127
push eax
push edx
push 0xc03
call fcn.00463910
mov eax, dword [0x4d6a34]
add esp, 0x1c
inc dword [eax + 1]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
mov dword [esi], 0
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x465510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
cmp esi, 0x200
jle 0x465673
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push 0x200
lea ebx, [edi + ecx]
push 1
push ebx
mov dword [ebp + 8], eax
call fcn.0047697e
mov esi, eax
add esp, 0x10
cmp esi, 0x200
je 0x465656
mov eax, dword [0x4d6a34]
mov edi, 0x200
sub edi, esi
cmp edi, dword [eax + 9]
jle 0x4655ea
mov eax, dword [eax + 1]
mov ecx, dword [0x4d68f4]
push 0
lea edx, [ebp + 8]
push edx
push eax
add ecx, 0x127
push ecx
call fcn.00464dd0
add esp, 0x10
cmp eax, 1
je 0x4656ad
mov edx, dword [ebp + 8]
mov eax, dword [0x4d6a34]
mov ecx, dword [eax + 9]
push edx
push ecx
lea edx, [ebx + esi]
push 1
push edx
call fcn.0047697e
mov ecx, dword [0x4d68f4]
add esi, eax
mov eax, dword [0x4d6a34]
mov edx, dword [eax + 1]
sub edi, dword [eax + 9]
add ecx, 0x127
push ecx
push edx
push 0xc03
call fcn.00463910
mov eax, dword [0x4d6a34]
inc dword [eax + 1]
mov eax, dword [0x4d6a34]
add esp, 0x1c
cmp edi, dword [eax + 9]
jg 0x465570
mov edx, dword [eax + 1]
mov eax, dword [0x4d68f4]
push 0
lea ecx, [ebp + 8]
push ecx
push edx
add eax, 0x127
push eax
call fcn.00464dd0
add esp, 0x10
test eax, eax
jne 0x4656ad
mov ecx, dword [ebp + 8]
push ecx
push edi
push 1
add ebx, esi
push ebx
call fcn.0047697e
mov edx, dword [0x4d68f4]
add esi, eax
mov eax, dword [0x4d6a34]
mov ecx, dword [eax + 1]
add edx, 0x127
push edx
push ecx
push 0xc03
call fcn.00463910
mov eax, dword [0x4d6a34]
inc dword [eax + 1]
add esp, 0x1c
cmp esi, 0x200
jne 0x4656ad
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
sub eax, 0x200
add edi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
cmp eax, 0x200
jg 0x465530
mov esi, eax
test esi, esi
je 0x46569f
mov edx, dword [ebp + 0xc]
lea eax, [edi + edx]
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 8]
push ecx
push edx
push eax
push esi
mov dword [ebp + 8], 0
call fcn.004653e0
mov eax, dword [ebp + 8]
add esp, 0x10
cmp eax, esi
jne 0x4656ad
add edi, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4656c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4d68f4]
cmp byte [eax + 0x17], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], 0
jne 0x4656ff
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call fcn.0047697e
imul esi, edi
add esp, 0x10
sub dword [0x4d6902], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4d6a34]
cmp byte [eax], 1
jne 0x465730
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
imul ecx, edi
push edx
push eax
push ecx
call fcn.00465510
add esp, 0x10
test eax, eax
je 0x465757
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
mov edx, esi
imul edx, edi
push eax
push ecx
push edx
call fcn.004653e0
add esp, 0x10
test eax, eax
je 0x465757
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
imul esi, edi
sub dword [0x4d6902], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4669a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
push edi
mov edi, dword [0x4d68f4]
je 0x4669b9
cmp byte [edi + 0x331], 0
jmp 0x4669c0
cmp byte [edi + 0x332], 0
je 0x466a1c
mov ecx, dword [ebp + 8]
mov eax, ecx
push esi
lea esi, [eax + 1]
jmp 0x4669d0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4669d0
sub eax, esi
cmp byte [edi + 0x332], 0
lea edx, [eax - 1]
je 0x466a1b
test edx, edx
jle 0x466a1b
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x466a1b
mov edi, dword [ebp + 0xc]
push ebx
xor eax, eax
test edx, edx
jle 0x466a14
lea ebx, [ebx]
movzx ebx, byte [eax + ecx]
xor byte [esi + edi], bl
movzx ebx, byte [eax + ecx + 1]
xor byte [eax + ecx], bl
inc eax
cmp eax, edx
jl 0x466a00
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x4669f4
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x466d30
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x4c1c50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
push eax
call fcn.0047a822
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.0047ab5e
add esp, 0x28
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470483
mov esp, ebp
pop ebp
ret
Function at 0x4681a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c1c50]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00470280
push 0x104
lea ecx, [ebp - 0x108]
push 0
push ecx
call fcn.00470280
mov al, 0x3a
add esp, 0x18
cmp byte [ebx + 1], al
je 0x468264
cmp byte [esi + 1], al
je 0x468269
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0047a822
add esp, 0x14
cmp byte [ebp - 0x108], 0
je 0x4682c2
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x468235
sub eax, edx
cmp byte [ebp + eax - 0x109], 0x5c
je 0x4682c2
lea edi, [ebp - 0x108]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x468250
mov dx, word [0x4a0930]
mov word [edi], dx
jmp 0x4682c2
cmp byte [esi + 1], al
jne 0x4682c2
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.0047a822
add esp, 0x14
cmp byte [ebp - 0x108], 0
je 0x4682c2
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x468291
sub eax, edx
cmp byte [ebp + eax - 0x109], 0x5c
je 0x4682c2
lea edi, [ebp - 0x108]
dec edi
jmp 0x4682b0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4682b0
mov cx, word [0x4a0930]
mov word [edi], cx
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4682c6
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4682d6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push 0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.00487e8a
add esp, 8
xor ecx, ecx
cmp eax, 0xffffffff
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00470483
mov esp, ebp
pop ebp
ret

Function at 0x46a3a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test ecx, ecx
je 0x46a3ce
mov edx, dword [ebp + 8]
push edi
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4c1428]
inc edx
dec ecx
jne 0x46a3b4
pop edi
not eax
mov dword [esi], eax
pop esi
pop ebp
ret

Function at 0x46a3e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
test edx, edx
je 0x46a429
push ebx
push esi
mov esi, dword [ebp + 8]
movzx ecx, word [esi]
mov ebx, ecx
xor ebx, eax
shr eax, 8
and ebx, 0xff
xor eax, dword [ebx*4 + 0x4c1428]
shr ecx, 8
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4c1428]
add esi, 2
dec edx
jne 0x46a3f5
pop esi
pop ebx
not eax
mov dword [edi], eax
pop edi
pop ebp
ret
Function at 0x46a430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
or eax, 0xffffffff
test ecx, ecx
je 0x46a45b
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4c1428]
inc edx
dec ecx
jne 0x46a441
pop esi
mov ecx, dword [ebp + 0x10]
not eax
mov word [ecx], ax
pop ebp
ret

Function at 0x46a470
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
or eax, 0xffffffff
test ecx, ecx
je 0x46a49b
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4c1428]
inc edx
dec ecx
jne 0x46a481
pop esi
mov ecx, dword [ebp + 0x10]
not eax
mov dword [ecx], eax
pop ebp
ret
Function at 0x470483
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c1c50]
jne 0x47048d
repz ret
jmp fcn.0047ffa5

Function at 0x470c74
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x470c9c
call fcn.00479344
and dword [eax], 0
call fcn.00479331
mov dword [eax], 0x16
call fcn.0047d350
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x470cb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00479357
pop ecx
jmp 0x470c97
test byte [ebp + 0xc], 0x80
je 0x470cc4
and eax, 0xfffffffe
jmp 0x470cc7
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x470caa
xor eax, eax
pop ebp
ret

Function at 0x487e0b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x487e32
call fcn.00479344
mov dword [eax], esi
call fcn.00479331
push 0x16
pop esi
mov dword [eax], esi
call fcn.0047d350
mov eax, esi
jmp 0x487e87
test dword [ebp + 0xc], 0xfffffff9
jne 0x487e18
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x487e5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00479357
pop ecx
call fcn.00479331
mov eax, dword [eax]
jmp 0x487e87
test al, 0x10
jne 0x487e85
test al, 1
je 0x487e85
test byte [ebp + 0xc], 2
je 0x487e85
call fcn.00479344
mov dword [eax], 5
call fcn.00479331
mov dword [eax], 0xd
jmp 0x487e56
xor eax, eax
pop esi
pop ebp
ret
Function at 0x48ae3d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c1c50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0047df19
and dword [ebp - 0x14], 0
cmp dword [0x4da40c], 0
mov dword [ebp - 0x18], eax
jne 0x48aef0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48af98
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48af98
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4da40c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4da410], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4da414], eax
call edi
push eax
call esi
mov dword [0x4da41c], eax
test eax, eax
je 0x48aef0
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4da418], eax
mov eax, dword [0x4da418]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x48af49
cmp dword [0x4da41c], ecx
je 0x48af49
push eax
call esi
push dword [0x4da41c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x48af49
test ebx, ebx
je 0x48af49
call edi
test eax, eax
je 0x48af40
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48af40
test byte [ebp - 8], 1
jne 0x48af49
or dword [ebp + 0x10], 0x200000
jmp 0x48af7c
mov eax, dword [0x4da410]
cmp eax, dword [ebp - 0x18]
je 0x48af7c
push eax
call esi
test eax, eax
je 0x48af7c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48af7c
mov eax, dword [0x4da414]
cmp eax, dword [ebp - 0x18]
je 0x48af7c
push eax
call esi
test eax, eax
je 0x48af7c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4da40c]
call esi
test eax, eax
je 0x48af98
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x48af9a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00470483
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x175a0203
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7e9b3f6e
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x8a28bd
Capabilities:
Encode data using xor

Disassembly:
sub ebp, 1
mov dword [esp], 0x50939a37
mov edx, 0x35ae7823
movzx eax, dx
movzx eax, byte [edx + ebp - 0x35ae7823]
xor al, bl
mov word [esp + edx*2 - 0x6b5cf03d], 0x1707
add edx, dword [esp + edx - 0x35ae7823]
xor dword [esp], edx
dec al
sar dl, 4
shr byte [esp + 2], 0x61
not al
sbb edx, 0x74ae939c
sar dl, 0xa3
shl dx, 0x88
neg al
rol word [esp + edx - 0x11930cf7], 0xae
inc al
mov dword [esp + edx*2 - 0x232619f8], 0xd5b60f07
dec word [esp + edx - 0x11930cf6]
out dx, al
xor bl, al
neg byte [esp + edx - 0x11930cf6]
mov dword [esp + edx - 0x11930cf8], 0xe19fed09
mov dword [esp + edx*4 - 0x464c3400], edx
mov dword [esp + edx - 0x11930cf8], ebp
mov dword [esp + edx*2 - 0x232619fc], ebx
pop edx
jns 0xa8a713
int3
clc
cmpsb byte [esi], byte es:[edi]
push ebp
pop ecx
sbb eax, 0x4c7f1a58
add byte [ecx + ebx*8 + 0x1dc5c6b3], 5
dec eax
push edx
aas
xor al, 0x24
popal
jecxz 0x8a2941
add eax, 0xd5009d71
loopne 0x8a2928
adc al, 0x15
ljmp 0x4b98
mov ebp, edi
not edx
mov ebx, eax
push edx
add dx, dx
mov edx, ebx
sal edx, 2
mov eax, 0x3e99f999
mov eax, ebp
add eax, edx
push 0xbe277fa1
mov dword [ebp - 4], eax
test ebx, ebx
not dword [esp + 4]
lea esp, [esp + 8]
je 0xa8aaee

Function at 0x8bbd60
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
lea esp, [esp + 4]
jmp fcn.00b0ba5a
call fcn.008bfd2c
mov esi, 0xa3256ba9
sar si, 0x66
mov esi, dword [edi]
jb 0xb0dea1
aaa
je 0x8bbd08
and ch, cl
inc ecx
adc al, 0x97
adc al, 0xec
in al, dx
adc cl, byte [esi - 0x23]
add eax, 0xcc3cbb08
xchg ebp, eax
push cs
xor bh, byte [0x9a2897db]
out dx, eax
lea esi, [0x4e2e1b4f]
xlatb
push es
out dx, al
out dx, eax
xor eax, 0x9f211c0a
cmp cl, dl
std
jne 0x8bbd7b
cmp al, 3
mov bl, 0x62
invalid
mov dword [esp], esi
popfd
jmp 0xa901ef
push 0xf3b6e526
lea esp, [esp + 4]
jmp fcn.00a76698
jmp 0xa583a3
push 0x338342c
add edi, 4
jmp 0x8e94d5

Function at 0x8d9c8c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
push ebp
mov ebp, esp
inc dl
bts edx, esi
mov edx, dword [ebp + 8]
lea esp, [esp - 0x114]
stc
cmc
push esi
test edx, edx
jmp 0x8f01a0
je 0xa77049
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0xa77035
je 0xa77049
mov eax, 0x5a4d
cmp word [edx], ax
je 0xa7a6a1
sub eax, eax
movzx esi, bx
mov esi, 0x1307c23e
pop esi
jmp 0xdc9c12
mov eax, dword [edx + 0x3c]
test esp, 0x7925c396
cmc
add eax, edx
test dh, 0x20
test esp, esi
cmc
cmp dword [eax], 0x4550
jne 0xa77049
mov ecx, dword [eax + 0x78]
test ecx, ebp
test al, 0xb0
mov dword [ebp - 4], ecx
cmp sp, 0xe60c
test al, 0x82
test ecx, ecx
jmp 0xcc5a42
jmp 0x8bc191
ja 0xafa6f5
mov eax, esi
stc
sub eax, dword [ecx + edx + 0x10]
jmp 0xa80958
je 0xa77049
mov eax, dword [eax + 0x7c]
push ebx
push edi
cmc
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0xaea3a3
mov esp, ebp
pop ebp
jmp 0x8b5683
Function at 0x8dc5c1
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xd18aac32
inc al
ror al, 1
push 0xb1bcdcb9
push 0x61824499
xor bl, al
push 0xdc17d904
shr byte [esp + 4], 0xa1
lea eax, [esp + eax + 0x14]
push 0x20b8161d
setle byte [esp + 0x10]
mov word [eax], dx
lea esp, [esp + 0x18]
jb fcn.008abb21

Function at 0x9011fd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not edx
push 0x6080839c
inc dword [esp + 0xc]
not ecx
call fcn.00a5fbac
pop edx
sbb byte [edx + 0x23], ch
invalid
inc word [esp + 8]
jg 0x8bf43e

Function at 0xa5ecb4
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x4826697
mov dword [esp + 8], 0xec1e5dad
lea esp, [esp + 8]
call fcn.008edc82
mov eax, dword [0x731b1c0d]
scasd eax, dword es:[edi]
scasb al, byte es:[edi]
fldenv [ecx + 0x777787f]
test eax, 0x1ba9c5be
sub byte [0x67fc9553], ah
push 0xffffffffffffff8e
or bh, bh
and dword [esi + 0x76c72926], ebp
pushfd
and al, 0xa4
fld dword [ecx]
xchg esp, eax
stc
inc ebx
leave
mov dword [ebx - 0x25], esp
in al, 0x80
and ecx, esp
sub dword [ecx], esp
cmp eax, 0x4c586cf
invalid

Function at 0xa8272d
Capabilities:
Encode data using xor

Disassembly:
call fcn.00ddbf65
mov ebp, 0x7eeb8f72
or dword [eax], 0xffffffda
movsb byte es:[edi], byte [esi]
sbb byte [0xe7da3b30], ch
rcl byte [esi + 0x69], 0x38
stosd dword es:[edi], eax
dec esi
sbb dword [ebx - 0x36b2188a], esi
inc esi
or al, 0x78
sub byte [ebx + 0x66], ah
jo 0xa82730
xor ebx, dword [eax + 0x72bd0035]
invalid
xor eax, 0x8f72bd00
jmp 0xa827b5
daa
xlatb
loope 0xa8272e
dec dword [ebp - 0x5a6592c4]
invalid

Function at 0xaf7460
Capabilities:
Encode data using base64

Disassembly:
call fcn.00b1f705
pushfd
shl edx, 0x64
mov dword [esp + 0x10], 0xb30cc195
mov edx, dword [esp + 8]
call fcn.00ae159e
mov eax, 0x3a824307
lea ecx, [eax*2 + 0x71146b3e]
mov ebp, dword [edi + eax*2 - 0x7504860e]
lea ecx, [eax + ecx*4 + 0x2b99cea7]
not ax
mov eax, dword [edi + eax*2 - 0x750579ec]
ror cx, 0xc4
mov cl, byte [edi + 8]
jb 0xde0092
dec ebp
or esp, dword [edi]
pop esi
clc
sub esi, esp
ret 0xd7de
mov dword [edi], ebp
lea esp, [esp + 4]
jmp fcn.00aecbb4
push 0x189dbb91
ror word [esp], 0xa4
adc edi, 6
rol dword [esp], 0xf7
jae 0x8a310f
shrd ebp, eax, cl
jmp 0xb16943