joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cc99
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x38
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x56f542
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45cd3a
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x56f542
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x56921d
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45cde0
cmp edi, dword [esi + 0x7c]
jge 0x45cde0
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00471684
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00471684
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56f542
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56f542
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45cd32
jmp 0x45cd02
call fcn.004758ab
int3

Function at 0x46b711
Capabilities:
Encode data using xor

Disassembly:
sti
push es
out 0xff, eax
enter 0xffffffffffffaee3, 0x5b
add eax, 0x9ea981f1
cld
pop ecx
cdq
mul byte [edi + 0x14]
pop ss
cli
enter 0x193, 0x5f
loopne 0x46b70c
and ebx, dword [ecx]
cmp cl, ah
hlt
mov al, 0x9b
push ss
sub esi, eax
or bl, byte [ebp + esi*8 + 0x1e]
mov bh, bh
cwde
loop 0x46b788
inc esp
mov fs, esi
pop ebp
sar byte [ecx + 0x46b08794], 0x12
aad 0x69
mov edi, 0xb807ea03
pushfd
mov word [esi + esi*8], es
sub ebp, dword [eax + 0x2fd69edc]
leave
pop ds
add eax, 0xa6212e28
adc al, 6
mov cs, word [edx - 0x67]
pop ebp
jg 0x46b6c6
test al, 0xa3
movsd dword es:[edi], dword [esi]
jmp 0xf9e76dd5
xlatb
xor byte [0x30db7f2], ah
invalid
Function at 0x472d10
Capabilities:
Encode data using xor

Disassembly:
push es
xor al, 0x9d
add eax, 0x7a426276
in al, 0x76
xchg edi, eax
pop eax
pop ds
aaa
xor eax, 0x99f9d012
invalid
jb 0x472cff
or byte [0x78307ae6], dl
call 0xf35abeac
jge 0x472c89
in al, dx
hlt
mov ah, 0xed
and cl, cl
push cs
mov dh, 0x65
std
and ebx, dword [ebx + 0x66681044]
cmp cl, bl
xor byte [eax], ah
add dword [esi + 0x58], ebp
inc ebp
leave
sbb dh, byte [esi - 0x63]
test al, 0x72
dec esp
pop esi
enter 0x551c, 0x3e
push cs
lds ebx, [ebx]
sal dword [ebp], cl
mov bh, byte [edi + 0x5c0712bb]
push eax
jl 0x472ce9
mov bl, 0xa6
mov esp, 0x2000b549
inc ebx
xor dword [esi - 0x32], edi
fucomp st(4)
cmc
cld
xlatb
push 0xffffffffffffffe9
adc dword cs:[ebx], esi
salc
sbb eax, 0x2136710e
pop eax
add eax, 0x7ab520f5
sub byte [edx - 0x52], 0xb3
invalid

Function at 0x4735d3
Capabilities:
Packed with generic packer

Disassembly:
mov edi, eax
test edi, edi
je 0x473639
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x60]
push eax
push 0x3c
push ecx
call dword [0x5361c4]
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x50], 0x190
xor eax, eax
mov cl, byte [eax + 0x55ec5c]
mov byte [esp + ecx*8 - 0x34], cl
int3
inc ebp
clc
add byte [edi], cl
xchg byte [ebx + eax], cl
add byte [eax], al
Function at 0x473c72
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00586542
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473d3a
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00586542
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0058021d
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x473de0
cmp edi, dword [esi + 0x7c]
jge 0x473de0
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00488684
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00488684
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586542
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586542
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473d32
jmp 0x473d02
call fcn.0048c8ab
int3
Function at 0x47ea58
Capabilities:
Encode data using xor

Disassembly:
out 0xb8, al
out 0x62, eax
and eax, eax
cmp al, byte ds:[ebp + 0x32]
aas
invalid
enter 0x4174, 0xffffffffffffff82
xchg ebx, eax
and eax, 0x7c3369b8
xor edi, dword [ebx - 0x51]
mov bh, 0x96
rcr byte [edx - 0x65344b44], 0x84
xor edi, dword [ebx - 0x51]
mov bh, 0x96
rcr byte [edx - 0x65344b44], 0x84
xlatb
mov ch, dh
inc edx
sub byte [esi + 1], ch
xchg dword [esp + ecx*8 + 0x72343a9b], eax
xor eax, 0x14985bc8
rcr dword [ecx - 0x49164b4d], 1
jb 0x47ea50
inc ebx
mov byte [0x2e0b16d], al
inc edx
popfd
salc
push ss
jl 0x47ea25
in al, 0xc1
arpl word [ebx + 0x651cc397], ax
mov ecx, 0x2edebea8
fst qword [0xd2c3b717]
inc edx
pop ebp
jp 0x47eaf3
inc esp
cwde
js 0x47eac9
cmp ebx, dword [eax + 0x49]
movsd dword es:[edi], dword [esi]
outsd dx, dword [esi]
and ebp, eax
ret
fld dword [0x9f949361]
imul esp, ebp, 0xffffff91
mov bl, 0x1a
fcomp dword [edi - 0x7a8fa554]
daa
je 0x47eb07
dec ebx
inc ecx
aam 0x87
xor dword [eax + 0x785acd35], ebp
dec eax
dec ebx
or dword [edi + 0x6e], 0xc7c3018c
or dword [esi + edi*4 + 0x2b], 0x883babc6
dec eax
sti
cmp byte [ebx + eax*4 + 0x73], 0xc1
invalid
sub eax, esi
stosd dword es:[edi], eax
cmp ecx, dword [eax + 0x7c80fb48]
xor dword [ebx - 0x3f], 0xffffffc4
hlt
cli
xchg edx, eax
mov esp, edi
loope 0x47eb27
mov eax, dword [0xa63b46e]
out 0xcf, eax
pop ss
clc
inc eax
push edx
sbb byte [ebp + edx*4 - 0x4d], 0xd5
mov dword [0xc69a057c], eax
aam 0xd3
mov bh, 0x47
ljmp 0xf1a0:0x6cc4b5c0

Function at 0x488684
Capabilities:
Encode data using xor

Disassembly:
retf
lahf
mov ebx, 0xc60a1d4d
test dword [eax], 0xb30d472
sbb eax, 0xf7c60a
jb 0x488662
xor byte [ebx], cl
neg byte [ebx - 0x4f6569a0]
jnp 0x488687
push edx
dec esp
test dword [ebx], esp
or dword [edx + ecx*4 - 0x49344deb], ecx
mov cl, 0x5f
mov bh, al
invalid

Function at 0x48a749
Capabilities:
Encode data using xor

Disassembly:
pushal
bound ebp, qword [edi]
rcl byte [edi + 0x3bddefed], 0x25
xchg edx, eax
jae 0x48a725
push 0x49
dec ecx
push edi
lodsd eax, dword [esi]
push esp
imul edi, dword [edi], 0x80bde612
invalid
mov bl, 0x9d
mov al, byte [0x3d7cfdd5]
outsd dx, dword [esi]
or eax, 0x12e6a0d8
in eax, dx
add al, 0xba
adc al, 0xea
in eax, 0x34
sal byte [edi - 0xf3eced5], 1
and eax, 0xf3229041
mov dl, 0xaf
jecxz 0x48a6fd
or cl, dl
aas
in al, dx
push ebx
push ds
out 0x94, al
bound esi, qword [edi + 0x36]
fcomi st(5)
fiadd dword [edi + esi*4]
push 0xf7d3f056
nop
mov eax, 0x16721d36
lea esp, [esi - 0x13]
arpl word [eax + 0x4db4489c], dx
xor bl, byte [esi]
sub eax, 0x6120a5e
jnp 0x48a7d4
mov bl, 0x29
pop esp
xlatb
mov eax, dword [0x74d3091d]
iretd
cmp ebp, 0xe

Function at 0x4a0a74
Capabilities:
Encode data using xor

Disassembly:
popfd
sub byte [eax], bh
pop ebp
dec esi
mov eax, dword [0xf5a5892d]
sbb ecx, edx
pop ebp
or byte [ecx - 0x7a], 0x49
jecxz 0x4a0a55
push cs
Function at 0x4a20d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b49a2
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a219a
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b49a2
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005ae67d
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js fcn.004a2240
cmp edi, dword [esi + 0x7c]
jge fcn.004a2240
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b6ae4
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b6ae4
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b49a2
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b49a2
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a2192
jmp 0x4a2162

Function at 0x4ac0e2
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x740cc858]
and eax, 0xab909d5
pop esi
cmp eax, eax
pop eax
enter 0x740c, 0x25
aad 9
mov ecx, 0xc0395e0a
sub eax, 0x48aa8c06
push edi
rcr dword [edi + 0x54], 1
cmp eax, 0xf97cb51
lodsd eax, dword [esi]
call 0xab120b8b
mov ebx, eax
dec ebx
cmp dh, al
xor eax, 0x46300b0a
sbb eax, 0x98143fb5
dec edx
aas
mov dword [0x39f4a391], eax
cmpsb byte [esi], byte es:[edi]
inc ebx
xor byte [ebx - 0x16], bl
inc ebx
or al, byte cs:[eax - 0x2248d168]
popfd
push eax
dec edi
leave
lea ebp, [edx + 0x4a]
cdq
push ebx
wait
xchg dword [eax], edi
insd dword es:[edi], dx
test byte [ebp + ebp*8 + 0x748ddc65], cl
lahf
pop ebp
sbb ebx, dword [ebx + 0xeec2fa9]
push ds
loope 0x4ac0e3
inc esp
dec ecx
imul eax, dword [0x2ffe7f68], 0xaf064015
and al, 0x6b
sub al, 0xa9
xchg esi, eax
ljmp 0x7e19
Function at 0x4ba06d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1410
cmp edx, dword [eax]
je 0x4ba08f
add eax, 8
inc ecx
cmp eax, 0x4c14a0
jl 0x4ba080
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1410]
jne 0x4ba1bd
mov eax, dword [0x4c5db0]
cmp eax, 1
je 0x4ba197
test eax, eax
jne 0x4ba0c0
cmp dword [0x4c1338], 1
je 0x4ba197
cmp edx, 0xfc
je 0x4ba1bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba0f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baa50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004baee0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba13a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004baee0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf724
push edi
call fcn.004bcdb0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baa50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baa60
lea eax, [ebp - 0xa0]
push 0x4bf704
push eax
call fcn.004baa60
push dword [esi + 0x4c1414]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baa60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bcd24
add esp, 0x2c
pop edi
jmp 0x4ba1bd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c1414]
push 0
push eax
push dword [esi]
call fcn.004baee0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40cb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40cb4f
pop dword [ebp - 0x14]
mov eax, 0xc93f4888
add eax, 0x370182c7
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x37055
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3ec0
xor edi, edi
add edi, eax
mov edx, 0xa1a97e71
add edx, 0x5e97f98f
add edx, dword [ebp - 0x14]
mov esi, 0x4dcdfb78
sub esi, 0xf9b286f9
xor dword [ebp - 0x10], ecx
mov ebx, dword [edx]
sub dword [ebp - 8], 0xaba20791
add ebx, esi
xor dword [ebp - 4], esi
mov dword [edi], ebx
add dword [ebp - 0xc], 0xf15b0171
add edi, 4
add edx, 0x44f81c8f
sub edx, 0x44f81c8b
loop 0x40cba5
add eax, 0x91aaecfb
sub eax, 0x91a9ff28
xor ebx, ebx
add ebx, eax
add eax, 0x8a71870
sub eax, 0x8a7186b
mov ecx, 0xcbb51abf
sub ecx, 0xcb751abf
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x699b2d21
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x65471140
nop
nop
nop
nop
nop
test eax, eax
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x407920
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f1033
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x92806c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x80]
mov dword [esi + 4], 0x83ff9c
call fcn.00404170
sub esp, 0x14
xorps xmm0, xmm0
mov eax, esp
push ecx
mov ecx, esi
movups xmmword [eax], xmm0
call fcn.00404330
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
mov dword [esi], 0x875554
mov dword [esi + 0xc], 0x83ffa8
mov dword [esi + 0x10], 0x83fef0
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], 0x83fed4
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x7c]
mov dword [ecx + esi], eax
lea ecx, [esi + 0x18]
call fcn.0040b080
mov byte [ebp - 4], 1
lea ecx, [esi + 0x34]
push 0x83f8ec
mov byte [esi + 0x30], 0
call fcn.00404660
lea ecx, [esi + 0x4c]
call fcn.0040b080
lea ecx, [esi + 0x64]
call fcn.0040b080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40a0b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
call fcn.0040b4d0
xor esi, esi
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0040ae70
test eax, eax
je 0x40a12d
nop dword [eax]
mov ecx, 0x94def0
call fcn.0040ae70
mov ecx, eax
xor edx, edx
mov eax, esi
div ecx
mov ecx, 0x94def0
push edx
call fcn.0040b180
mov ecx, dword [ebp - 8]
mov edi, eax
push esi
call fcn.0040b180
push dword [ebp - 4]
mov ecx, ebx
mov esi, eax
call fcn.0040b180
mov cl, byte [edi]
xor cl, byte [esi]
mov esi, dword [ebp - 4]
mov byte [eax], cl
inc esi
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], esi
call fcn.0040ae70
cmp esi, eax
jb 0x40a0e0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x92806c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40e34d
cmp byte [edi + 0x3e], 0
je 0x40e34d
push esi
call fcn.0040e0c0
mov edx, dword [edi]
mov ecx, edi
movzx esi, ax
push esi
call dword [edx + 0xc]
movzx ecx, ax
mov eax, esi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
push eax
call fcn.0040e100
add esp, 8
test al, al
jne 0x40e33b
mov ecx, dword [edi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 0x40]
push eax
call fcn.004061f0
sub eax, 0
je 0x40e303
sub eax, 1
je 0x40e307
sub eax, 2
jne 0x40e33b
mov byte [edi + 0x3e], al
mov al, 1
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0079802e
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x3e], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x40e324
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0079f6b4
add esp, 0x10
cmp esi, eax
jne 0x40e33b
cmp byte [edi + 0x3e], 0
pop esi
sete al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0079802e
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0079802e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.0079802e
mov esp, ebp
pop ebp
ret

Function at 0x40e5b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x92806c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40e687
cmp byte [edi + 0x3d], 0
je 0x40e687
push esi
call fcn.0040e010
mov edx, dword [edi]
mov esi, eax
push esi
mov ecx, edi
call dword [edx + 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], esi
push eax
call fcn.0040e040
add esp, 8
test al, al
jne 0x40e675
mov ecx, dword [edi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 0x40]
push eax
call fcn.004061f0
sub eax, 0
je 0x40e63d
sub eax, 1
je 0x40e641
sub eax, 2
jne 0x40e675
mov byte [edi + 0x3d], al
mov al, 1
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0079802e
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x40e65e
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0079f6b4
add esp, 0x10
cmp esi, eax
jne 0x40e675
cmp byte [edi + 0x3d], 0
pop esi
sete al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0079802e
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0079802e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.0079802e
mov esp, ebp
pop ebp
ret