joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402462
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov byte [ebp - 0x18], al
mov byte [ebp - 5], 0
jmp 0x4024dc
mov byte [ebp - 6], 0
jmp 0x4024d2
movzx eax, byte [ebp - 5]
movzx edx, byte [ebp - 6]
mov ecx, dword [ebp + 0xc]
shl eax, 2
add eax, ecx
add eax, edx
movzx ebx, byte [eax]
movzx eax, byte [ebp - 0x18]
lea edx, [eax*4]
movzx eax, byte [ebp - 5]
add eax, edx
lea edx, [eax*4]
movzx eax, byte [ebp - 6]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 0x10]
add eax, edx
movzx edx, byte [eax]
movzx eax, byte [ebp - 5]
movzx ecx, byte [ebp - 6]
xor edx, ebx
mov ebx, dword [ebp + 0xc]
shl eax, 2
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 6], 1
cmp byte [ebp - 6], 3
jbe 0x40247b
add byte [ebp - 5], 1
cmp byte [ebp - 5], 3
jbe 0x402475
nop
nop
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4024e9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x402542
mov byte [ebp - 0xa], 0
jmp 0x402538
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ecx, dword [ebp + 8]
shl eax, 2
add eax, ecx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx edx, byte [eax + str.cw]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x4024fd
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x4024f7
nop
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x403002
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x40305b
mov byte [ebp - 0xa], 0
jmp 0x403051
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ecx, dword [ebp + 8]
shl eax, 2
add eax, ecx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx edx, byte [eax + 0x4071c0]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x403016
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x403010
nop
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x403261
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov byte [ebp - 5], 0
jmp 0x403299
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
movzx ebx, byte [eax]
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx ecx, byte [eax]
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
xor ebx, ecx
mov edx, ebx
mov byte [eax], dl
add byte [ebp - 5], 1
cmp byte [ebp - 5], 0xf
jbe 0x40326e
nop
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4036f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00404870
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x4042c8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4042e7
mov eax, 0
jmp 0x40432b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40430a
mov eax, 0
jmp 0x40432b
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x404326
mov eax, 0
jmp 0x40432b
mov eax, 1
leave
ret

Function at 0x40432d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40438c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x404384
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x404384
mov eax, dword [ebp - 4]
jmp 0x4043a0
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x404361
mov eax, 0
leave
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401031
Capabilities:
Create process on windows

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403220], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403224], eax
push 0xa
push dword [0x403224]
push 0
push dword [0x403220]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, dword [ebp + 0x10]
inc eax
mov dl, byte [eax]
cmp dl, 0x20
jne 0x401044
jmp 0x401046
jmp 0x40103a
inc eax
push eax
push 0x403123
call fcn.00401110
push 0xfa
push 0x403029
push 0xffffffffffffffff
push 0x403123
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar
mov dword [0x403228], 0x44
mov dword [0x403254], 1
mov word [0x403258], 0
push 0x40326c
push 0x403228
push 0
push 0
push 0
push 0x403029
push 0
push 0
push 0x403025
push 0
push str.mima1
call sub.advapi32.dll_CreateProcessWithLogonW
push 0xffffffffffffffff
push dword [0x40326c]
call sub.kernel32.dll_WaitForSingleObject
push dword [0x40326c]
call sub.kernel32.dll_CloseHandle
push dword [0x403270]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp - 0x44]
leave
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x3e877e7e
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x1f822d41
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4810b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4d000]
push edi
jmp 0x4810ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4810d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4810c0
mov eax, 1
add ebx, ebx
jne 0x4810e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4810f4
jne 0x481113
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x481113
dec eax
add ebx, ebx
jne 0x481100
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4810d8
add ebx, ebx
jne 0x48110f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x481165
xor ecx, ecx
sub eax, 3
jb 0x48112b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48119a
sar eax, 1
mov ebp, eax
jmp 0x481136
add ebx, ebx
jne 0x481136
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x481104
inc ecx
add ebx, ebx
jne 0x481144
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x481104
add ebx, ebx
jne 0x481151
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x481146
jne 0x481162
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x481146
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x481184
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x481176
jmp 0x4810c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x481184
add edi, ecx
jmp 0x4810c6
pop esi
mov edi, esi
mov ecx, 0x33dc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4811a2
cmp byte [edi], 0x14
jne 0x4811a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4811a7
lea edi, [esi + 0x7e000]
mov eax, dword [edi]
or eax, eax
je 0x48121f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x85b44]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x85c0c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4811d4
mov ecx, edi
jns 0x481203
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x85c10]
or eax, eax
je 0x481219
mov dword [ebx], eax
add ebx, 4
jmp 0x4811f1
call dword [esi + 0x85c20]
mov ebp, dword [esi + 0x85c14]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x481253
sub esp, 0xffffff80
jmp 0x440f6b
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x407467
pop dword [ebp - 0x10]
mov eax, 0x37df965d
add eax, 0xc860de0a
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xe938e93e
add dword [ebp - 0x20], 0x65195c0d
mov dword [ebp - 0x1c], 0xddd3702a
sub dword [ebp - 0x1c], 0xaba023e5
mov dword [ebp - 0x18], 0x4d78cec8
add dword [ebp - 0x18], 0xfed37566
mov dword [ebp - 0x14], 0xcae1f7b4
sub dword [ebp - 0x14], 0xcae1f7b4
lea eax, [ebp - 0x20]
push eax
mov eax, 0x191552f3
add eax, 0xe72b2d85
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xbcbb4d68
sub dword [ebp - 0x20], 0x4848e412
mov dword [ebp - 0x1c], 0x69d913b5
add dword [ebp - 0x1c], 0xd7934dc0
mov dword [ebp - 0x18], 0x6e3c5a75
sub dword [ebp - 0x18], 0xaccee09
mov dword [ebp - 0x14], 0xc84001ad
add dword [ebp - 0x14], 0x37bffe53
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x40ab920a
sub eax, 0x406b118e
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3ab64
push 0
call eax
mov ecx, 0x825116a1
add ecx, 0x7daf3fd0
xor esi, esi
add esi, eax
mov edi, 0x33e15671
sub edi, 0x339bc471
add edi, dword [ebp - 0x10]
mov edx, 0xf0425aeb
sub edx, 0xb28a3c2
mov ebx, dword [edi]
sub dword [ebp - 0xc], 0xedad0fe2
xor ebx, edx
mov dword [ebp - 8], 0xdffce097
mov dword [esi], ebx
add esi, 0x11a71f05
sub esi, 0x11a71f01
add edi, 0xbfb2b2c4
sub edi, 0xbfb2b2c0
loop 0x40758b
add eax, 0xf88f4172
sub eax, 0xf88df4db
xor ebx, ebx
add ebx, eax
add eax, 0xb87e5447
sub eax, 0xb87e5442
mov ecx, 0xe97e708a
add ecx, 0x16c18f76
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x6746237e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xb5b22b1
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x6666eb
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ecx + 0x8d4], 0
jne 0x66674a
mov eax, dword [ecx + 0x874]
mov edx, dword [esp + 4]
sub edx, eax
push ebx
push esi
mov esi, dword [esp + 0x14]
shl edx, 4
push edi
lea edi, [edx + ecx + 4]
mov edx, dword [esp + 0x14]
sub edx, eax
sub esi, eax
shl esi, 4
shl edx, 4
lea edx, [edx + ecx + 4]
lea ebx, [esi + ecx + 4]
mov esi, dword [ecx + 0x850]
mov ecx, dword [ecx + 0x854]
sub ebx, edx
lea eax, [edx + esi*4]
sub edi, edx
mov edx, dword [ebx + eax]
xor edx, dword [eax]
inc esi
mov dword [edi + eax], edx
add eax, 4
cmp esi, ecx
jl 0x666737
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x688101
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x6882d8
mov ecx, dword [ebp + 0xc]
push 0x10305084
call fcn.005afa39
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x688126
sub eax, ecx
inc eax
push 0x10474e78
push eax
call fcn.00865ace
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x6882d8
mov edx, ebx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x68814d
push 0x1030d44c
push ebx
call fcn.00865410
pop ecx
pop ecx
test eax, eax
je 0x68816b
mov byte [eax], 0
push 0x1030d448
push ebx
call fcn.00865410
pop ecx
pop ecx
test eax, eax
je 0x68817f
mov byte [eax], 0
movzx eax, byte [ebx]
push edi
mov esi, ebx
test al, al
je 0x6881ad
cmp byte [ebx + 1], 0
je 0x6881ad
push eax
call fcn.0058f0e1
pop ecx
test al, al
je 0x6881ad
mov al, byte [ebx + 1]
cmp al, 0x3a
je 0x688281
cmp al, 0x7c
je 0x688281
push 0x103074bc
push ebx
call fcn.005af58c
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x688281
cmp byte [ebx], al
je 0x6881d8
mov eax, ebx
cmp byte [eax], 0x5c
jne 0x6881d2
mov byte [eax], 0x2f
inc eax
cmp byte [eax], 0
jne 0x6881ca
and dword [ebp + 8], 0
mov dword [ebp - 0x10], 0x1030d43c
mov dword [ebp - 0xc], 0x1030ad24
mov dword [ebp - 8], 0x1030ad58
mov eax, dword [ebp + 8]
mov edi, dword [ebp + eax*4 - 0x10]
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6881fd
sub eax, esi
mov dword [ebp - 4], eax
cmp byte [ebx], cl
je 0x688232
mov esi, ebx
mov al, byte [edi]
test al, al
je 0x688232
movzx ecx, byte [esi]
movzx edx, byte [ecx + 0x10307e10]
movsx eax, al
xor edx, ecx
cmp edx, eax
jne 0x68822b
dec dword [ebp - 4]
inc edi
inc esi
cmp byte [esi], 0
jne 0x68820f
cmp dword [ebp - 4], 0
je 0x688267
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x6881f1
mov edi, 0x1030a360
push edi
push ebx
call 0x5af74a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x68827f
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x68825a
sub eax, edx
add esi, eax
jmp 0x688281
mov eax, dword [ebp + 8]
mov eax, dword [ebp + eax*4 - 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x688271
sub eax, edx
lea esi, [eax + ebx]
jmp 0x688281
mov esi, ebx
cmp ebx, esi
jae 0x6882a5
mov edi, ebx
mov al, byte [edi]
movzx ecx, al
mov cl, byte [ecx + 0x10307e10]
xor cl, al
movzx eax, cl
mov ecx, dword [ebp + 0xc]
push eax
call 0x5af88a
inc edi
cmp edi, esi
jb 0x688287
xor edi, edi
jmp 0x6882c7
mov al, byte [esi]
cmp al, 0x2f
je 0x6882b7
cmp al, 0x5c
je 0x6882b7
xor edi, edi
jmp 0x6882bd
inc edi
cmp edi, 1
jg 0x6882c6
mov ecx, dword [ebp + 0xc]
push eax
call 0x5af88a
inc esi
cmp byte [esi], 0
jne 0x6882a9
push ebx
call fcn.00864d2b
pop ecx
mov al, 1
pop edi
jmp 0x6882da
xor al, al
pop esi
pop ebx
leave
ret