joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f22ef
Capabilities:
Encode data using xor

Disassembly:
mul dword [ebx - 0x6c93702c]
dec esp
pop ds
push ebp
and dword [ecx + 0x2772688e], ebx
in eax, 0x7f
cmpsd dword [esi], dword es:[edi]
stosb byte es:[edi], al
shr ah, 1
add ebx, esi
xor dword [ebx + 0x1e], eax
mov dword [0x7320a72a], eax
mov bl, 2
frstor dword [ebx + 0x5745de50]
jo 0x4f22e0

Function at 0x4f40fb
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebp - 0x639b36e6], ebp
pushfd
inc esp
ror byte [ecx - 0x13], 1
xchg esp, eax
xor byte [edi - 0x231a3ac3], dl
push ds
mov ch, 0x8d
push edx
cmp esi, dword [0x295ca54c]
fdiv st(0), st(0)
mov esi, 0xe4169474
ja 0x4f40f6
sub al, 0x4d
aam 0xc3
mov al, 0xfa
and ecx, dword [edx]
xor eax, 0x690e954a
int 0xc4
xchg byte [edi + 0x6859740d], dl
mov esp, 0xc737042
test dword ds:[edi - 0x65], 0xc307d4ff
xor ch, bl
xchg esi, eax
jno 0x4f40f6
adc byte [0x4c2891fe], al
adc eax, 0xd6b9c35
cmpsd dword [esi], dword es:[edi]
fadd dword [0xe3ccd9af]
mov eax, dword [0x8f729d56]
jp 0x4f4178
call 0xb82b87ce
mov esi, 0x752edbbd
stosd dword es:[edi], eax
in eax, 0x93
pop ss
xchg ecx, eax
sub al, 0x73
shr cl, 1
cli
aam 0xbc
hlt
aad 0xdd
sar esi, 0xaa
or bh, byte [eax + 0x63d22e1a]
loope 0x4f41c3
lea edi, [edx]
lea ebx, [edi + esi]
inc esp
push edx
int 0xd1
add al, 0x2f
sbb ch, ah
sub eax, 0x70914d
mov al, 0x38
out 0x8d, eax
xor dword [eax + edi], edx
test eax, 0xc91f7efd
xor ebx, esp
inc edi
xor eax, 0xf224ef39
jl 0x4f416d
invalid
aad 0x90
mov ah, 0x98
jns 0x4f41e8
xor al, 0xe0
movsb byte es:[edi], byte [esi]
lea ecx, [ecx + 0x16]
dec ecx
push ss
xchg esp, eax
xor byte [esp + ecx*2], dh
dec esp
sbb al, ah
cli
sbb ah, ah
jp 0x4f41b4
jno 0x4f4161
sub dl, byte [esi + 0x31]
fld xword [ebx - 0x75f09c0a]
cmovl esp, dword [edi + ebp*8 + 0x19]
rol dword [ebp - 0x2e], cl
pop eax
adc al, 0x79
and dword [ebp + 0x3c], edi
stosd dword es:[edi], eax
mul byte [ebx + 0xf]
mov cl, byte [edi]
dec esp
out dx, eax
sbb ebx, edx
inc ebp
rcr byte [eax + 0x14], cl
jns 0x4f4203
jge 0x4f4220
out 0x70, eax
jne 0x4f417a
jne 0x4f41be
aad 0x61
mov esi, dword [eax - 0x29]
fdiv qword [ecx - 0x64fca95]
mov ebp, 0x20a970da
push cs
or eax, 0xbaf55d0a
scasb al, byte es:[edi]
xor dword cs:[ebx - 0x398f59c], 0xfffffff6
pop ebp
pushfd
mov bl, 0x64
or ah, byte [edi - 4]
neg byte [ebp - 0x64]
jno 0x4f41d1
dec ebp
and ebx, esp
xchg ebp, eax
in al, dx
push cs
daa
push cs
fadd qword [edi]
mov cs, esp
out dx, eax
pop ecx
jae 0x4f4282
adc dword [ebp - 0x2fc5fa9e], esi
aam 0x9d
add eax, 0x9dd4d03a
mov esp, 0x9cb19dc0
std
test esp, 0x64986d76
sub bh, byte [ecx + 0x410f34bb]
mov byte [esp + edi*2], ah
int3
rep insd dword es:[edi], dx
invalid
Function at 0x53dc4d
Capabilities:
Authenticate hmac

Disassembly:
cld
mov ecx, dword [ebx - 0x6f]
invalid
xchg edi, eax
inc esp
lodsb al, byte [esi]
fcomp qword [ebp + 8]
sub eax, 0x94db35ff
xchg byte [ebx], dh
nop
outsd dx, dword [esi]
inc esi
fist dword [esi + eax*4 + 0x466f9033]
jecxz 0x53dc0a
lds ebp, [ecx]
inc ecx
sbb al, 0xe
mov ah, 0x36
pop esp
xchg edx, eax
jns 0x53dc6e
mov ebx, 0xc3531474
fsub dword [0xb425eb57]
out dx, eax
dec ecx
outsd dx, dword [esi]
test dword [ebx - 0x14f525d0], 0xf1f4c021
mov ebp, 0xc7437576
pushal
pop esp
mov dh, 0x68
jle 0x53dbd3
jne 0x53dc4f
invalid
or byte [edx + edi*8 - 0x3d5670c4], dh
jno 0x53dbc3
dec ecx
push 0x13
ficom word [ebp + edi + 0x3b]
test cl, dl
xchg esi, eax
popfd
sti
repz ret 0xc3b4
stosb byte es:[edi], al
push esp
xlatb
imul ebp, dword [edi + 0x63], 0xfd7631f9
scasb al, byte es:[edi]
jo 0x53dbdc
push cs
sub dword [ebp + 0x180eed58], ecx
push esp
dec esi
xchg ecx, eax
or al, 0x81
invalid
sbb esp, ebx
daa
sbb dword [ecx], 0x80d427dc
fsub qword [edi]
aam 0x80
movsb byte es:[edi], byte [esi]
pop edx
test eax, 0x8a635b86
jmp 0x53dc8d
mov eax, dword [0xfccdb77]
in al, 0xbb
retf 0xf49b
cwde
jp 0x53dcd9
test dword [ecx + 0x63], ecx
jae 0x53dc32
sub byte [ebp + 0x45], bl
stosd dword es:[edi], eax
in eax, 0xdf
inc eax
dec ecx
loopne 0x53dcbf
pop ds
aaa
test eax, 0x6a4609db
and cl, ah
jg 0x53dc9f
sub ebx, dword [eax - 0xb]
push esp
xor eax, 0xe47e94ee
dec eax
mov dh, 0x28
push edi
imul ecx, dword [edx - 0x49], 0xffffffcb
cdq
shl ecx, 1
jecxz 0x53dd36
mov bl, 0xc9
push esp
or edx, ecx
pop es
enter 0xffffffffffffcf16, 8
aad 0x45
jl 0x53dd23
jbe 0x53dcd7
mov bl, 0x65
xor al, 0x80
mov edx, 0x3435cbe3
jo 0x53dcc4
retf
xor al, 0x70
call 0xc81593e5
sti
add eax, 0xfbc7c1b7
sub byte [ebx + 0xe], dh
mov ecx, 0xe3bad0b7
dec esp
test eax, 0x7325b8ef
hlt
scasd eax, dword es:[edi]
into
ror dh, 1
insb byte es:[edi], dx
push ebx
imul eax, dword [edi], 0xb2099c54
in al, 0x37
mov al, 0xca
mov ecx, 0x8cacc7b0
cdq
add ecx, ebx
adc ebx, dword [ecx]
mov al, 0xc7
lodsb al, byte [esi]
mov word [ecx + 0x1913d901], ds
lodsb al, byte gs:[esi]
push 0x29
hlt
Function at 0x57f4bb
Capabilities:
Check for software breakpoints

Disassembly:
test dword cs:[ebx], esi
mov bh, 0xfd
lodsd eax, dword [esi]
sub eax, 0xdccb6be0
cmp al, 0xcc
les edi, [ecx]
paddd mm0, qword [edi + 0x1e46f41]
push edi
sbb al, 0x11
ficomp dword [ecx + 3]
invalid
adc edx, ebx
pop ecx
add esi, eax
shr byte [ebx + 0x6fcca1f4], 0x50
insb byte es:[edi], dx
pop ds
sti
rol ecx, cl
fcom st(7)
jecxz 0x57f462
pop ebx
xor ebx, esp
push ecx
mov esp, 0xecc2d29f
cmpsd dword [esi], dword es:[edi]
and ecx, dword [esi + 0x23757f5e]
pushfd
stosb byte es:[edi], al
popfd
mov esp, 0x41abb183
imul edx, dword [ecx], 0xe1f750d3
jnp 0x57f4c7
jmp dword [ecx]
pop edx
push 0xffffffffffffffaf
loope 0x57f505
bound ebx, qword [edi + ebp*4 + 0x2f]
scasb al, byte es:[edi]
sub eax, 0x506f8102
push edi
mov al, 0x8d
jge 0x57f47b
sub dword [edi + 0x50], 0x7d8db057
lodsb al, byte [esi]
mov dl, 0xef
rcl dword [ebp + 0x61], 0xfe
pushal
in al, 0x5c
push esi
insb byte es:[edi], dx
mov al, byte [0x2e4a9760]
mov al, 0x7e
jg 0x57f53d
push esp
and dword [edx + edx*2], esi
nop
enter 0xffffffffffff93f6, 0xfffffffffffffff1
in eax, dx
adc bh, dh
dec eax
sub esp, ecx
mov dl, 0xe8
daa
insb byte es:[edi], dx
stc
sbb eax, 0x8f5aee59
mov word [ebp - 0x4c], ss
das
aaa
imul ebx, dword [ebp - 0x202f8c53], 0xc662291
rcr bh, 1
xchg ecx, eax
and ah, byte [esi + 0xc]
xchg esp, eax
xchg esi, eax
invalid
cmp dh, byte [edx + 0x2d]
sub dword [esi + esi*2], 0xfffffff9
jecxz 0x57f555
mov dl, 0x89
push ss
in eax, 0x13
lahf
inc ecx
inc eax
in al, dx
shl byte [ebp - 0x63af2221], 1
retf 0x92d4

Function at 0x588521
Capabilities:
Encode data using xor

Disassembly:
cwde
mov byte [edi + ecx + 0x25df300b], bh
leave
or byte [ebx + 0x30], bl
sidt [edx + 0x10]
scasb al, byte es:[edi]
inc edi
pop ebx
cmp byte [edi - 0x5faafa71], ah
or eax, 0x2d924a1e
aaa
mov ebp, 0xfcfaa0f8
inc ecx
sal bl, 1
adc byte [edi], bl
adc byte [eax - 0x1b0ec7d8], al
popfd
loop 0x588560
mov al, byte [0x8463ed2d]
les ebx, [edx + edx*4 + 0x2f]
pop esp
xchg edx, eax
das
xor bh, 4
shl byte [edx], 1
add bl, dl
add edx, edx
rcr dword [ebx], cl
scasd eax, dword es:[edi]
pop ss
sbb eax, eax
das
and dh, byte [ebp + 0x655fdd35]
push ebx
jnp 0x58855b
rol dword [ebx - 0x7a7f4c27], 0x3a
inc edi
pop es
jae 0x5884e8
xchg edi, eax
add byte [ebx - 0x69ee459d], ah
pop es
xor dh, al
ja 0x58854f
jno 0x588572
call dword [ecx - 0x17]
scasb al, byte es:[edi]
adc ch, byte [edi + edi*2 - 0x3e]
insb byte es:[edi], dx
jg 0x588520
adc cl, byte fs:[edx + esi*2 - 0x7fb64f33]
ljmp 0xeff7
invalid
imul ebp, dword [ecx - 0x2e], 0x477c3e15
push edi
mov al, 0x6e
sub bh, 0x59
iretd

Function at 0x5c6eec
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
add byte [ebp - 0x24ded4d3], al
mov dl, 0x52
push es
test dword [ebx + 0x3c10d67f], ebp
sysret
Function at 0x5da5d6
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [ebx + 0xad85a9b]
cmpsb byte [esi], byte es:[edi]
pop ds
into
aam 0xc1
push esp
xor bh, dh
jb 0x5da56b
mov ecx, 0xaadac245
invalid
xor byte [ebx - 7], 0xc1
jl 0x5da53c
stc
sar dword [ebp + ecx*8 + 0x64], 0x56
push esi
mov edx, 0xdb2785ef
arpl word [ecx + 0x5a], bp
jecxz 0x5da5e9
aaa
int1
vdivps ymm6, ymm7, ymmword [ebp + esi*2 + 0x47de5cfe]
mov byte [edi], 0x7f
out 0xfb, al
leave
pop edi
or eax, 0xb3f8b0a3
adc al, 0xf6
cli
push ds
adc byte [eax - 0x24b5305a], ch
mov esi, 0xeca2462b
loope 0x5da5ae
in al, 0xe0
lahf
jge 0x5da60e
push edx
push ds
popal
xchg dword [ebx + 0x76], edx
in al, 0x12
mov bh, 0x63
out dx, eax
ficom word [edi - 0x2bb9583c]
int 0xe6
push ebx
jbe 0x5da594
adc dh, byte [edi - 0x6821109d]
les esp, [edi - 0x19322bba]
lodsd eax, dword [esi]
xlatb
inc edi
movsd dword es:[edi], dword [esi]
lds eax, [ebx - 0x51642a3]
jmp 0x5da568
xor esp, dword [ecx - 0xf5bef9f]
popal
adc byte [eax + esi*8 - 0x23088dc7], ah
cmp dword [edx - 9], esi
fdivr st(2), st(0)
or al, 0xfb
cmp dword [edx - 9], esi
fdivr st(2), st(0)
or al, 0xfb
pop ebp
test dword gs:[ebx + 0x56], esi
cmp dword [edi + 0x1c], eax
out 0x12, eax
add dword [ebx + 0x43254473], ebx
jno 0x5da5d1
wait
jae 0x5da630
and eax, 0x33e17143
mov ch, 0xb7
xchg esi, eax
pop es
xor esi, dword [ebp + 0x76496b7]
insb byte es:[edi], dx
rcl dl, 0xec
test ch, ah
arpl cx, bp
push ss
dec edx
dec ebp
xor al, 0x56
mov dword [0x248430cb], eax
mov edx, 0x20f695af
jbe 0x5da5d3
les eax, [ebx + 0x27d56f32]
xor dword [edx], 0x6f
aad 0x27
jne 0x5da5ad
dec ecx
xchg dword [ecx], ebp
pop esi
cmpsd dword [esi], dword es:[edi]
wait
movsd dword es:[edi], dword [esi]
fstp dword [edi - 0x2c]
movsb byte es:[edi], byte [esi]
mov edi, 0x335934f6
test dl, bl
xchg dword [eax], esi
sti
arpl word [edx + 0x2472997], sp
test dword [eax - 0x5a66bdc9], 0x3df0e326
bound edx, qword [0x1a61f6d4]
cmp byte [esi], 0xb4
nop
xlatb
add dh, bh
mov byte [edi], dh
inc edx
cdq
movsd dword es:[edi], dword [esi]
jecxz 0x5da62a
cmp eax, 0xf6d41562
popal
sbb al, byte [eax - 0x286f4bc2]
out dx, eax
or al, 0x43
push eax
call 0x2830ea1
invalid

Function at 0x617ae6
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0xaac57f8
aaa
js 0x617b37
invalid
xchg ecx, eax
inc eax
xchg ebp, eax
add byte [edx + 0x317416d4], 0xae
scasb al, byte es:[edi]
cld
fistp dword [eax + ebx*2 - 0x69]
mov al, byte [0x836616ba]
test dword [esi + 0x5e0b44b1], edi
inc esi
lahf
unpckhps xmm6, xmmword [eax]
bound ecx, qword [edx]
mov eax, 0xaee26639
cwde
sub byte [edi], al
imul byte [eax + 0x6d6b874a]
inc ebp
fild dword [edi + 0x3c01f895]
xor dh, bl
pop ecx
dec esi
inc ebx
and ecx, edi
imul dword [eax]
jge 0x617b58
out 0xe3, eax
mov ebx, 0xf9d4e2d7
jecxz 0x617b2e
xlatb
loop 0x617b4a
stc
jns 0x617b70
invalid
Function at 0x624f69
Capabilities:
Encode data using xor

Disassembly:
push ss
adc dh, byte [edx + ebp*2 + 0x44]
aam 0xaf
insb byte es:[edi], dx
inc esi
or eax, esi
adc dh, byte [ecx - 0x32e8e0ac]
leave
in al, dx
add al, byte [ecx + 0x46ca36d4]
sbb edx, dword [eax + 0x31]
xchg dh, bh
je 0x625001
retf 0x1b46
pop ebx
sbb al, 0x12
mov dword [0x393c23b8], eax
cmp al, byte [ebx]
ror byte [eax + ecx*4 + 0x22f299eb], 1
sal dword [ecx], 1
sbb dh, byte [edi - 0x2a3b94f2]
xor al, 0xdf
mov edx, 0xf003b066
jbe 0x624fd1
and ecx, dword [ecx + 0x359a27eb]
xchg ecx, eax
shr dl, 1
dec ecx
invalid
xor al, 0x86
mov dl, 0x3d
nop
mov eax, 0xf692fac6
rol dword [esi], cl
jg 0x62501b
pop edx
and edx, esp
jl 0x624f6e
loop 0x62505f
mov dl, ch
jbe 0x62501b
aad 0x76
xor al, 0x77
xchg esi, eax
ja 0x624f7f
inc ebx
stosb byte es:[edi], al
xor bl, byte [edx - 0x2bded16f]
xchg byte [edx - 0xb], bl
jle 0x624fe1
sub dl, ch
salc
push ss
enter 0xffffffffffffe698, 0xffffffffffffffa7
sbb al, 0x5b
call 0x281b76a0
dec ebx
wait
mov dl, 0x1a
out 0xa2, al
and byte [edx + 0x178a24bb], cl
wait
mov ecx, 0xb29b4b27
sbb ah, dh
mov byte [0xbb228c20], al
and al, 0x8a
pop ss
dec ebx
aad 0xba
sbb edi, dword [ebx - 0x312aa50e]
jle 0x62505f
cmc
adc al, 0xbd
mov ah, 0x45
mov edx, 0x2b678650
jle 0x625084
push edi
dec edx
fcomp dword [esi]
push ds
adc eax, 0x24f39629
mov ecx, dword [ecx + 0x591ff771]
jno 0x62502d
pop ds
pop ecx
jne 0x62509d
mov esi, ecx
stosb byte es:[edi], al
xor ch, ah
xor dh, al
adc cl, byte [edi - 0x56]
lock adc cl, byte [edi - 0x56]
out 0x4c, al
dec edi
sti
mov dh, 0xee
pop ebx
rol byte [esi], cl
insd dword es:[edi], dx
add ebp, dword [ebx - 0x6469633b]
jbe 0x625040
loop 0x625034
xchg byte [edx], cl
push ecx
in eax, 0xa0
sti
lcall 0x1dc5, 0x96123e38
stosb byte es:[edi], al
add edx, dword [esi + 0x44]
das
push es
shl bh, 1
and byte [edi - 0x66], cl
pop ebp
or ebx, ebx
or al, 0x6d
test al, 0xb8
clc
out dx, eax
pop edx
iretd
xor ebx, esi
or eax, 0xe9e16a85
jo 0x6250e2
dec edx
jp 0x62502c
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
mov ah, byte [ecx - 0x40]
dec edx
cmpsb byte [esi], byte es:[edi]
retf
mov al, 0x2c
push ss
mov esp, 0x38140944
jge 0x62511e
sti
add al, 0x6e
sbb byte [ebx + 0xac82986], cl
xchg esp, eax
cmp dl, byte [eax + 0x30]
aaa
lcall 0xa054, 0xe44a1ee2
inc esp
sti
lodsb al, byte [esi]
mov edx, 0xf28c153
push ds
pop ds
or dword [esi - 0x3a], ebx
dec edx
dec edx
sbb dl, byte [esi + ebp*2 - 0x747ec6c8]
out dx, eax
iretd
invalid
invalid
Function at 0x64eab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64f240
push 0x64eaa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
cld
add bh, bh
adc eax, sym.imp.MSVCRT.dll___set_app_type
pop ecx
or dword [0xa50f7c], 0xffffffff
or dword [0xa50f80], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0xa50f78]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0xa50f74]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0xa50f84], eax
call fcn.0064ec2f
cmp dword [0x650270], ebx
jne 0x64eb33
push 0x64ec2c
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0064ec1a
push 0x65000c
push 0x650008
call sub.MSVCRT.dll__initterm
mov eax, dword [0xa50f70]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0xa50f6c]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x650004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x64ebc6
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64eb9a
cmp al, 0x22
jne 0x64eb8c
cmp byte [esi], 0x22
jne 0x64eba3
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64ebad
cmp al, 0x20
jbe 0x64eb9f
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x64ebd1
movzx eax, word [ebp - 0x2c]
jmp 0x64ebd4
cmp byte [esi], 0x20
jbe 0x64eba3
inc esi
mov dword [ebp - 0x74], esi
jmp 0x64ebc6
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4d5080
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x555f80
call fcn.004d5d30
push 1
call fcn.004d542b
pop ecx
test al, al
jne 0x4d4f32
push 7
call fcn.004d5acb
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004d53f6
mov byte [ebp - 0x24], al
mov eax, dword [0x55c534]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4d4f2b
test eax, eax
jne 0x4d4f9c
mov dword [0x55c534], ecx
push 0x50d54c
push 0x50d528
call fcn.004eb28e
pop ecx
pop ecx
test eax, eax
je 0x4d4f7f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4d5075
push 0x50d524
push 0x50d4c0
call fcn.004eb232
pop ecx
pop ecx
mov dword [0x55c534], 2
jmp 0x4d4fa1
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004d5598
pop ecx
call fcn.004d5abf
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4d4fd1
push esi
call fcn.004d550e
pop ecx
test al, al
je 0x4d4fd1
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004d5d1b
call esi
call fcn.004d5ac5
mov esi, eax
cmp dword [esi], edi
je 0x4d4fef
push esi
call fcn.004d550e
pop ecx
test al, al
je 0x4d4fef
push dword [esi]
call fcn.004e8533
pop ecx
call fcn.004d5be7
movzx eax, ax
push eax
call fcn.004eb1ec
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.004d5c1a
test al, al
jne 0x4d501a
push esi
call fcn.004e856b
test bl, bl
jne 0x4d5023
call fcn.004e850e
push edi
push 1
call fcn.004d55b5
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4d5075
call fcn.004d5d76
ret
call fcn.004d59fc
jmp 0x4d4f13

Function at 0x4ef2cc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ef149

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3b3d1ad7
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x51a6472d
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402ce4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x448008], 0x8088405
inc edx
mov dword [ebx + 0x448008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x43cb08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43cb82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x43cb6c
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404328
inc dword [ebp - 8]
dec esi
jne 0x43cb45
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43cb89
lea eax, [ebp - 0xc]
call fcn.00404060
ret
Function at 0x43e534
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x43e786
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.00404520
push eax
call fcn.004062f4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x43e58f
mov byte [ebp - 2], 1
jmp 0x43e76a
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406514
cmp eax, 0xffffffff
je 0x43e5be
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004064ec
test eax, eax
je 0x43e5be
mov bl, 1
test bl, bl
jne 0x43e5cb
mov byte [ebp - 2], 1
jmp 0x43e76a
xor ebx, ebx
cmp word [ebp - 0x54], 0x5a4d
je 0x43e5db
cmp dword [ebp - 8], 0x40
jne 0x43e629
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406514
cmp eax, 0xffffffff
je 0x43e629
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004064ec
test eax, eax
je 0x43e629
cmp dword [ebp - 0x14c], 0x4550
jne 0x43e629
cmp word [ebp - 0x134], 0x10b
jne 0x43e629
mov bl, 1
test bl, bl
je 0x43e761
xor eax, eax
push ebp
push 0x43e757
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043e468
mov dword [ebp - 0x144], eax
call fcn.00402ab0
mov eax, 9
call fcn.00402ce4
mov word [ebp - 0x108], ax
mov eax, 9
call fcn.00402ce4
mov word [ebp - 0x106], ax
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406514
cmp eax, 0xffffffff
je 0x43e6ab
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406534
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
cmp word [ebp - 0x54], 0x5a4d
je 0x43e6eb
mov word [ebp - 0xe], 0x5a4d
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406514
cmp eax, 0xffffffff
je 0x43e6eb
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 0xe]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406534
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
cmp byte [ebp - 1], 0
je 0x43e74d
mov eax, 0x200
call fcn.00402ce4
mov ebx, eax
shl ebx, 4
test ebx, ebx
jle 0x43e74d
push 2
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406514
cmp eax, 0xffffffff
je 0x43e74d
push ebx
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x43e510]
call fcn.004053e8
add esp, 4
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.004065c8
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406534
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e761
mov eax, dword [ebp - 0xc]
push eax
call fcn.004062cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e78d
lea eax, [ebp - 0x14]
mov edx, dword [0x43e510]
call fcn.004053f4
ret