joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416dbb
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42535c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004088e5
mov dword [ebp - 0x14], eax
cmp dword [0x825118], esi
jne 0x416eae
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x416e3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x416f8e
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x416f8e
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416f8e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x825118], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x82511c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x825120], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x825128], eax
test eax, eax
je 0x416eab
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x825124], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x416ed3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x416ec6
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x416ee8
push 4
pop eax
jmp 0x416f90
cmp dword [ebp - 0x14], esi
je 0x416ee8
push dword [0x825118]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x416ecd
mov eax, dword [0x825124]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x416f46
cmp dword [0x825128], edi
je 0x416f46
push eax
call ebx
push dword [0x825128]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x416f46
test eax, eax
je 0x416f46
call ecx
test eax, eax
je 0x416f3b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x416f3b
test byte [ebp - 8], 1
jne 0x416f46
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x416f76
mov eax, dword [0x82511c]
cmp eax, edi
je 0x416f73
push eax
call ebx
test eax, eax
je 0x416f73
call eax
mov esi, eax
test esi, esi
je 0x416f73
mov eax, dword [0x825120]
cmp eax, edi
je 0x416f73
push eax
call ebx
test eax, eax
je 0x416f73
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x825118]
call ebx
test eax, eax
je 0x416f8e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x416f90
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004065fc
mov esp, ebp
pop ebp
ret
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x81c030]
jne 0x40107a
repz ret
jmp fcn.00401e51

Function at 0x408b0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d5a
and dword [ebp - 4], 0
cmp dword [0x81eb68], 0
mov ebx, eax
jne 0x408bbc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c6d
push eax
call fcn.00404ce8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81eb68], eax
call esi
push eax
call fcn.00404ce8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81eb6c], eax
call esi
push eax
call fcn.00404ce8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81eb70], eax
call esi
push eax
call fcn.00404ce8
pop ecx
mov dword [0x81eb78], eax
test eax, eax
je 0x408bbc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ce8
pop ecx
mov dword [0x81eb74], eax
mov eax, dword [0x81eb74]
cmp eax, ebx
je 0x408c14
cmp dword [0x81eb78], ebx
je 0x408c14
push eax
call fcn.00404d63
push dword [0x81eb78]
mov esi, eax
call fcn.00404d63
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408c14
test edi, edi
je 0x408c14
call esi
test eax, eax
je 0x408c0b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408c0b
test byte [ebp - 0xc], 1
jne 0x408c14
or dword [ebp + 0x10], 0x200000
jmp 0x408c4d
mov eax, dword [0x81eb6c]
cmp eax, ebx
je 0x408c4d
push eax
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c4d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c4d
mov eax, dword [0x81eb70]
cmp eax, ebx
je 0x408c4d
push eax
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81eb68]
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c6d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c6f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af70
Capabilities:
Set console window title

Disassembly:
sub esp, 0x420
mov eax, dword [0x81c030]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [0x2ffc55c]
push ebx
mov ebx, dword [0x2ffc280]
push esi
mov esi, dword [0x81cf60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40afb1
push str.zolihetujejijitewi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2ffc55c]
mov dword [0x81ed0c], esi
cmp eax, 0x114e
jne 0x40afdb
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x2ffc55c]
cmp eax, 0x2f
jne 0x40affb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
call fcn.0040ae60
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401070
add esp, 0x420
ret
Function at 0x432298
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x8b69c2ec
pop esp
invalid
in eax, dx
stosb byte es:[edi], al
fisub word [eax + 0x34]
push ss
mov eax, 0x9bb961b5
pop eax
push ebx
wait
leave
pop ebp
fcmovnbe st(0), st(0)
or ch, al
mov esp, esi
cdq
ret
fdiv qword [edi + ebx*4 + 0x62883e67]
pushfd
mov byte [edx - 0x64], ah
bound ebx, qword [esi + ecx*4 - 0x38a72147]
xor eax, dword [0xa2a6aa72]
das
mov al, 6
xchg esp, eax
xor eax, 0xe32458ee
loopne 0x4321a3
invalid
bound ebp, qword [eax + 0x76]
shr byte [esi + 0x3ebe2eda], cl
push 0xffffffffffffff8b
in al, 0x52
cmp al, byte [ebx + 0x3630d29e]
dec esp
fmul qword [ebp - 0x78]
js 0x4321b6
movzx ecx, word [eax + 0xe7fd169]
pushfd
loopne 0x4321e8
imul edx, ecx, 0xe09c0e7f
mov edi, 0xc26e8eb9
ja 0x4321ee
mov ecx, 0x77c26e8e
mov edi, 0xf136c248
push edi
out 0x7d, eax
jl 0x4321ed
dec eax
ret 0xf136
jmp 0x21fcb796
std
inc eax
out dx, eax
movsd dword es:[edi], dword [esi]
jae 0x432222
out 0xe3, eax
pushfd
invalid
add byte [edi - 0x2c6e3755], ah
inc ebp
cwde
pop ebp
jb 0x432299
pop esp
push edi
mov dword [0xe5d7fde], eax
jle 0x4322b8
sal dword [ecx], 1
inc ebp
mov ebp, 0x202cd919
xor dword [ebp - 0x43], eax
sbb ecx, ebx
sub al, 0x20
mov eax, dword [0x3c7d4560]
xor al, 0xad
sbb dh, byte [eax]
clc
jae 0x432261
sbb eax, 0x629c66ff
int 0x78
retf 0xb9ea
push ebp
jo 0x43224b
movsb byte es:[edi], byte [esi]
sub ch, byte [si + 0x5be9]
or byte [edx], cl
dec ebp
test byte [ebx + 0x7e4dc319], ch
jl 0x43223f
cmp dword gs:[edi + 0x44fe48d5], esi
mov dh, 0x25
jnp 0x4322ce
mov edx, 0xde3d8182
add ecx, dword [esi]
lcall 0xeb19, 0x27f86b3c
or al, 0x15
imul ebp, dword [ecx - 0x2c5d9595], 0x59
pop ecx
and dword [eax], 0x28b45fe4
out dx, eax
aam 0x7a
push edx
sbb byte [eax], bl
lodsd eax, dword [esi]
invalid

Function at 0x436c48
Capabilities:
Encode data using xor

Disassembly:
or cl, byte [esi]
aaa
popfd
adc ebp, dword [eax]
adc al, 0xfe
pop eax
add eax, 0x4e0f5bcb
cld
xor ebx, dword [ecx - 0x65169148]
sub byte [eax + 0x6e], cl
mov ebp, 0x210eeba1
invalid
Function at 0x48bb18
Capabilities:
Encode data using xor

Disassembly:
sub byte [eax], 0xbd
jecxz 0x48bb5e
mov edx, 0x904af6f8
sbb al, byte [eax]
outsd dx, dword [esi]
jb 0x48bb57
pop ebp
xchg ebx, eax
cdq
or bh, byte [eax + 0x41dee544]
jns 0x48bb54
jae 0x48bb62
or al, 0x78
adc ecx, eax
mov edx, 0x96b365e7
xor ch, byte [edx - 0x3d]
sub dl, byte [edi]
adc eax, dword [ebx]
invalid
xchg esi, eax
js 0x48bafb
les eax, [esi - 0x1e8d6f26]
les esi, [edi + 0x14a87477]
add byte [0xb5258fca], ah
mov esp, 0x3ad2c970
inc ebx
and eax, 0xd3d00fca
adc byte [edx + 0x263b9669], al
sbb dword [ecx], ebp
mov ecx, 0x9c86e949
jne 0x48baf9
adc ah, ch
push 0x26
cmp dword [ebx + 0x4ad0dffd], esi
sahf
mov al, byte [0x52a4d5c]
adc byte [esi], cl
or bl, cl
sub al, byte [0xd90a0e10]
mov edi, 0x565bc620
and dh, al
pop ebx
push esi
insd dword es:[edi], dx
sbb eax, 0x2acf9ffc
js 0x48baeb
xchg ecx, ebp
sub eax, 0x93880cbe
cmp eax, 0x3625b66a
mov eax, 0x583f809d
xchg dl, bl
push ebp
or dword [esi], edi
mov ecx, 0xfe7fbd28
cmpsd dword [esi], dword es:[edi]
wait
cld
sub dword [edx], ecx
fild word [ebx]
pop edx
xlatb
adc eax, 0x96b0642
sub eax, 0x78068a9e
lodsd eax, dword [esi]
jnp 0x48bb53
cmp cl, al
adc al, 0xf8
push 0xffffffffffffffb6
or eax, 0x12627276
sbb al, byte [ebx - 0x7322318d]
inc esp
dec edi
xchg dword [ecx + 0xe75480], ebp
popfd
add eax, 0xf2769d6c
sar ebx, 0x74
jl 0x48bbf5
cmp al, 0x44
or al, byte [edi - 0x77]
test byte ss:[esi + 0x64], ah
inc eax
stc
push ss
jl 0x48bc15
inc ebp
cmc
shl byte [ebx + 0x162900cf], cl
mov dword [0x162900cf], eax
stosb byte es:[edi], al
test eax, 0x2609ec41
xor ch, byte [edx + eax*8 - 0x5193d7ae]
ret 0x2852
scasb al, byte es:[edi]
ja 0x48bbd2
jae 0x48bc0e
xlatb
lodsb al, byte [esi]
enter 0x318b, 0xffffffffffffffca
int3
jp 0x48bbdf
ljmp 0xab5b:0x619e8a50
mov word [edx - 0x66d4b2f5], ds
into
test eax, 0x29a59bde
loope 0x48bbe3
inc eax
push edi
mov dword [0x44b34772], eax
xor dword [edi - 0x36], 0xf82184e6
push ebp
lodsd eax, dword [esi]
jbe 0x48bca8
mov eax, 0xda0aa839
dec edx
mov ch, 0x2a
imul ecx, dword [ebp - 0x1741af88], 0xffffff9c
push ebp
invalid
jbe 0x48bcc4
adc dword [edi - 0x55e9431d], ebp
mov al, byte [0x5861c432]
pmaddwd mm3, qword [esi - 0x3b6b5100]
mov esp, 0x4acf7d9
xchg esp, eax
jne 0x48bd0f
ja 0x48bce5
pop ds
push esp
mov dl, byte [ecx]
jns 0x48bd17
dec esp
in al, dx
call 0x9d191cf1
mov edx, 0x18c3c9e9
into
cmp eax, 0x20d92fc
mov ah, 0x5a
movsb byte es:[edi], byte [esi]
fucomp st(0)
push edi
inc eax
pop edx
invalid
xor eax, 0xb358f561
in al, 0x42
je 0x48bcca
dec esp
salc
pop ebp
invalid
imul edi, ebx, 0x7b
shl byte [eax], 0xa
in al, 0x86
or al, 0xb5
nop
in al, 0xa8
jbe 0x48bcc5
invalid
in al, dx
cmp ch, byte [ebp + 0x5a]
cmp dh, byte [eax + 0x73]
clc
mov dh, 0xfa
mov al, byte [edi]
mov esp, 0x22a3dc85
aam 0x6e
and al, 0x81
fbld tbyte es:[ecx + 0xf1e0c2d]
xchg byte [eax - 0x26], ch
mov edx, 0x34570a69
push esp
enter 0x141a, 0xffffffffffffffda
inc ebx
mov edi, 0x3d8dd4b3
jecxz 0x48bcf7
adc eax, 0xf4ab41c4
mov byte [0x41052d23], al
mov ch, 0x54
xlatb
fsub dword [0x64d9d02a]
xchg ecx, eax
out dx, al
loope 0x48bd82
jns 0x48bd20
hlt
inc esp
invalid
Function at 0x4b5b4d
Capabilities:
Encode data using xor

Disassembly:
pop es
out dx, eax
push 0xb949c7d2
mov ebp, 0x87191211
sbb dword [ebp + 0x77], ebp
ja 0x4b5b3f
ja 0x4b5b3f
mov cl, 0xcc
invalid

Function at 0x4bcaf8
Capabilities:
Encode data using xor

Disassembly:
imul edi, edx, 0xed4c6069
mov ah, 7
salc
insd dword es:[edi], dx
inc esi
aaa
and eax, 0xd9a1d9e7
cmpsb byte [esi], byte es:[edi]
retf 0xc9db
and eax, 0x90f78edb
lodsd eax, dword [esi]
or ch, byte [eax]
mov dword [esi + 0x6c], ebx
and dword [ecx + 0x7e70ed4a], ecx
jb 0x4bca84
pop ebp
add eax, 0x1afc8170
dec ecx
xor edx, dword [eax + 0x45]
invalid
dec ebp
jo 0x4bcad6
mov esi, 0xa4fd7d77
enter 0x31cb, 0xffffffffffffffcf
xor edi, ecx
add al, 0xba
sti
jno 0x4bcb02
das
sbb dword [ecx], edx
adc edi, dword [eax + 0x78c2589]
invalid

Function at 0x4e6f78
Capabilities:
Encode data using xor

Disassembly:
repne stosb byte es:[edi], al
aam 0x9f
rcr byte [edi + 0x4a], 0x2c
and ebx, dword [eax]
mov al, byte [0xd9d47906]
into
adc dword [esi + eax*2 - 0x4dfbec46], esp
mov gs, word [edi - 0xf3f34a1]
lahf
adc al, byte [0x82c6739b]
salc
outsb dx, byte [esi]
xor byte [ecx + 0x74], dh
sbb esp, dword [eax - 0x13e35cec]
out dx, eax
cmp eax, 0x122fc132
hlt
pop esp
daa
shr byte [edx + 0x55fe3816], cl
xor dword [eax - 0x155fee14], eax
and al, 0x2f
ficomp dword [edi - 0x67]
clc
fdivr dword [ecx - 0x2b622ebe]
shr byte [ecx - 0x33], cl
test dword [ebx - 0x77], esi
dec esi
imul edx, dword [edx - 0x61], 0xffffffa7
lahf
cmpsd dword [esi], dword es:[edi]
lahf
cmpsd dword [esi], dword es:[edi]
and al, 0xa7
push ss
out 0x5e, eax
jns 0x4e6f13
in eax, 0x42
idiv byte [eax + 0x5ae096e5]
mov eax, 0xe1e6f87d
xchg esi, eax
jne 0x4e6f55
xchg ebp, eax
inc esp
out 0x68, eax
cmp eax, 0x32669bac
mov ch, 0x48
sub byte [ebx - 0x61], dl
xor dh, byte [ebp - 0x60acd7b8]
cmp al, 0xe8
aad 0xca
sbb ebp, esp
jne 0x4e6f9b
clc
xlatb
les eax, [ebp - 0x55a9184f]
test byte [edi + 0x1f], bl
sub ebx, dword [esp + eax*8]
xchg esp, eax
aam 0x32
mov eax, 0xe5018390
push ebx
cmp eax, 0x8adc9cfa
ret

Function at 0x50b618
Capabilities:
Encode data using xor

Disassembly:
fnstsw word [esi + 0x70148c0]
xor al, 0xef
invalid
Function at 0x555cd8
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
sub eax, 0x42f1a2ca
loope 0x555bf9
rcr byte [ecx], 0x93
xchg ecx, eax
add eax, 0x604d2175
xchg ecx, eax
push edi
mov al, 0x41
adc eax, 0xc4d4c839
fcomp qword [0x2a3dbea2]
lea ebx, [edx - 0x53]
sbb eax, 0x7d971f1
fld dword [edi]
add dword [edx + ebp*8 - 0x61], ecx
mov al, 0xb6
inc eax
mov ebx, 0x292fe1fc
pop ecx
test al, 0x99
cmp cl, byte [esi - 7]
mov ebp, 0x6113c348
push ebx
pop es
push 0xffffffffffffff99
or eax, 0x98bf079c
pop edi
adc dword [ecx], esi
jbe 0x555c3a
sbb dword [eax], esi
sbb ecx, edi
adc dword [ecx - 0xec7e165], esp
fnstenv [ebx - 0x3883b3f7]
mov bl, 9
dec esp
jl 0x555bae
pop ebx
push ecx
loopne 0x555bf6
test word [edx + 0x61], cx
mov ecx, 0x3d578a05
inc eax
scasd eax, dword es:[edi]
and edx, edi
pop ss
inc ebx
sbb ecx, eax
sal dl, 0x7a
scasb al, byte es:[edi]
daa
mov bl, 0xc
cdq
int1
jg 0x555bd8
pop eax
lodsd eax, dword [esi]
sbb dword [ebp - 0xee74fbb], 0x76
wait
in eax, dx
salc
sar cl, 0x11
and byte [eax], dh
cwde
and eax, 0xf3a942b9
sub dword [ecx - 0x5ef05f78], esi
xchg esi, eax
shl ebx, 0x27
mov dword [eax], eax
dec ebx
js 0x555be7
call 0x8cd7fe2e
mov eax, 0x3435e80
dec edi
shl byte [edx], cl
sub eax, edx
test al, 0x9c
cmp dh, ah
sbb dword [ebx - 0x3a], ebx
jo 0x555cc5
and ch, byte [ecx]
shr byte [eax + 0x19f43a9c], 1
pop ebx
invalid
jg 0x555be2
wait
cmc
shr ebx, 0x33
retf
dec edx
push esi
adc dword [eax], esp
je 0x555cab
adc byte es:[ebx - 0x17], ah
das
fmul st(1)
int 0x1b
mov ebp, 0x956388c8
xchg ebp, eax
mov bl, 0x4b
lodsd eax, dword [esi]
imul ebp, dword [edi - 0x47d71886], 0x841adaee
jl 0x555c69
test byte [esp + ebx*8 + 0x2d], bh
in eax, 0xcb
jg 0x555c45
sub eax, 0xb37fcbe5
and ah, byte [ecx + 0x3f]
xchg dword [ebx - 0x67], edx
ror dh, 1
push es
sbb byte [ebp + 9], bh
jne 0x555c77
xor edi, dword [0xbc6964a1]
add dword [ecx], ebx
dec eax
adc cl, byte [esi]
jg 0x555cbe
pop esp
jno 0x555cc8
or bl, byte [esi]
invalid
add byte [ebx + edx*4 - 0xc6434], al
lahf
in eax, 0xf
xor ebx, dword [eax - 0x74c0e67f]
mov ch, 0x59
sbb dword [ecx], 0x59b58b3f
mov esi, dword [ebp + 0x21ed0359]
not bh
add ebp, ebp
and esi, esi
xlatb
in al, 0x25
jns 0x555d2c
push ebx
mov dword [edi + 0x71], eax
loopne 0x555c8a
sbb byte [ecx - 0x39632f6], bl
add byte [esi + ecx*8 - 0x46], ch
mov dword [edi - 0x36], esi
mov dl, 0x85
jg 0x555d44
jl 0x555c7d
salc
loope 0x555ccd
and eax, 0x57a451e3
fstp qword [edi - 0x64]
sbb bl, bl
cmp dword [edx + 0x71a0cb95], 0x72a251b5
pop ss
inc ebp
jns 0x555cca
push 0x2f
inc ebp
mov esp, 0xf5392c5b
mov ch, byte [edx + ebp - 0x70]
stosb byte es:[edi], al
mov bl, 0x5f
lahf
jg 0x555d34
movsd dword es:[edi], dword [esi]
mov al, byte [ecx]
inc edx
add byte [eax], cl
xchg esp, eax
cmp eax, 0x1150cc97
int3
inc edx
mov ebp, 0xebf778f8
retf 0x76de
xlatb
xchg edi, eax
invalid
Function at 0x562a58
Capabilities:
Encode data using xor

Disassembly:
jmp 0xca3bc9c4
jp 0x562a77
sbb eax, 0xad7450b1
mov cl, 0x50
je 0x562a0b
cmp dl, dh
popal
add eax, 0x20415623
mov byte [0xcea83b7b], al
pop ebx
loopne 0x562a99
jecxz 0x562a85
out 0xe3, eax
add eax, 0xd8eb1af8
sahf
push ecx
in al, dx
inc ebx
ftst
lodsd eax, dword [esi]
jne 0x562a59
mov byte ds:[ecx - 0x5cb349a9], dl
mov ecx, 0xe931d1b1
rcr dword [edx + 0x1dcdaa4a], 0xe1
sub esi, esp
shr dword [ebp + 0x6a95de73], cl
sub al, 0xa4
jle 0x562a59
dec esp
mov dword [0x31d1b1b9], eax
jmp 0x4a6b4751
ficom word [ebp + 0x7ea42c6a]
mov ecx, 0x856b25af
inc ecx
dec ebp
scasd eax, dword es:[edi]
and eax, 0x4d41856b
pop eax
jnp 0x562aff
sub ebp, esi
lds edi, [esi]
daa
scasd eax, dword es:[edi]
cmp ebx, dword [0xa49f0336]
sbb edi, ecx
or dword [esi - 0xc], ebx
jnp 0x562b23
mov al, byte [0x619307ad]
ret
movsd dword es:[edi], dword [esi]
fnstcw word [edx - 0x38]
xor al, 0xc9
and ah, byte [edx]
add dword [ebp + 0x66c10891], eax
mov esi, 0x91b6ab69
mov dh, 0x91
push ebp
inc ecx
or al, 0xf1
push 0xce2e59bd
rol byte [0x25e027f1], 0xa
aam 0xfe
adc bl, byte [ecx - 0x5cc6c268]
xchg ecx, eax
add dword [ecx - 0x72], ebp
arpl word [ebp + 0x36], di
lds eax, [ecx - 0x6368a67f]
pop ecx
xchg edi, eax
pushfd
xor al, 0xb9
popal
add byte [ebx + 0x6e6aedda], 0x39
push eax
or al, 0x3d
inc eax
mov esi, 0xc514b319
jbe 0x562aee
lds ecx, [esi + 0x6ebb5d66]
sbb byte [ebp - 0x4b99b1a8], 0x8f
int1
xchg byte [ebx - 0x5e2a0ffb], bl
cmp dword [0x34490c1b], ecx
call 0xd3af2edb
pop ebp
fcomp dword [esi]
mov ch, 0xe1
fist word [eax + 0x11d7f0f9]
popal
shl byte [eax + 0x2e], 1
scasb al, byte es:[edi]
or dword [ecx + 0x346f2aaf], edi
mov dword [ebx - 6], 0xb529cc29
xor dl, byte [ecx]
outsd dx, dword [esi]
inc edx
sbb bl, dh
test al, 0x41
fst dword [ecx + 0x71a984a9]
mov eax, dword [0xc9d025bd]
invalid

Function at 0x5a95e4
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xd0
imul ecx, ecx, 0xffffffde
mov ah, 0x9f
cld
invalid

Function at 0x5e82d8
Capabilities:
Encode data using base64

Disassembly:
and al, 0x3d
and eax, 0x95774832
mov dl, 0x97
mov al, 0x9b
test al, ch
mov al, 0xca
cmc
mov esi, 0xc3b28395
invalid
Function at 0x5f1d88
Capabilities:
Encode data using xor

Disassembly:
inc ebx
scasb al, byte es:[edi]
test byte [edx], ah
in al, dx
push ecx
div dword [esi + eax*2 + 0x30967da0]
std
xor al, 0x46
out 1, eax
popal
or byte [ecx + edi*2], al
cmp bh, cl
mov bh, 0x33
call 0xf6dd4c48
adc dword [edx], 0x55
out 0x6f, eax
pop ss
push es
or dword [eax + 0x3242e032], esi
jp 0x5f1dc0
jmp 0xb2a952be
mov edi, 0xa68e95b6
jns 0x5f1e08
xor al, byte [edi + 0x6b]
xor cl, al
and byte [edx], bh
and al, 0xe0
sbb eax, dword [eax + esi]
cmp dword [esi], ebx
push ecx
jg 0x5f1dd5
xchg ecx, eax
adc ch, byte [ecx + ecx*4 + 0x6717dd64]
xlatb
nop
scasb al, byte es:[edi]
cwde
mov bh, 0x20
mov al, 0xd0
xor eax, dword [esi]
mov eax, 0x537331a9
movsb byte es:[edi], byte [esi]
jp 0x5f1de8
ja 0x5f1e36
aaa
nop
push es
fbld tbyte [edi - 0x79]
pop ebx
fstp qword [ebx]
adc dword [ebx], ecx
test byte [edi - 0x280a0f3f], dl
sub byte [edx + 0x5a2165a0], ah
pop esi
and dword gs:[edx - 0x10], ebx
pop esi
push ds
mov dh, 0xdf
adc dword [edi - 0x70], esi
xchg ecx, eax
cmp byte [edi + 0x4c919cb8], ah
mov byte [0x34d6ad03], al
shl byte [eax + 0x5a153487], cl
mov dh, 0xdd
push edi
and ecx, dword [ebx]
mov esi, 0xa3fb594f
push esi
inc ebp
xchg dword [ebx - 0x3ee2c818], ebx
sbb edx, eax
aas
aaa
sbb eax, 0x3fc219c1
daa
mov ch, cl
pushal
xchg ebx, eax
invalid
Function at 0x413190
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x4131b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4131b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4131a8
mov eax, 1
add ebx, ebx
jne 0x4131cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4131c0
jne 0x4131dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4131c0
xor ecx, ecx
sub eax, 3
jb 0x4131f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x413262
mov ebp, eax
add ebx, ebx
jne 0x4131fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41322c
inc ecx
add ebx, ebx
jne 0x413218
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41320d
jne 0x413229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41320d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41324c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41323d
jmp 0x4131ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41324c
add edi, ecx
jmp 0x4131ae
pop esi
mov edi, esi
mov ecx, 0x347
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41326a
cmp byte [edi], 2
jne 0x41326a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41326f
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x4132e7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13f18]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13fcc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41329c
mov ecx, edi
jns 0x4132cb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13fd0]
or eax, eax
je 0x4132e1
mov dword [ebx], eax
add ebx, 4
jmp 0x4132b9
call dword [esi + 0x13fe0]
mov ebp, dword [esi + 0x13fd4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41331b
sub esp, 0xffffff80
jmp 0x409246