joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d7fd
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
mov ebp, dword [edx + 0x1058]
push edi
mov edi, dword [edx + 0x1064]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x20]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x46d941
push ebx
push esi
mov esi, 0xff1c
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1060]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x46d91b
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xe3
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 0x42]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x208]
shr eax, 2
and edx, 0xffff00e3
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x46d866
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1058]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1058]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x46d83d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x46da6a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
mov ebp, dword [edx + 0x1058]
push edi
mov edi, dword [edx + 0x1064]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x20]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x46dbae
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1060]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x46db88
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x46dad3
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1058]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1058]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x46daaa
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x46dbb6
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x20]
mov eax, dword [edx + 0x20]
push esi
mov esi, dword [edx + 0x1064]
push edi
mov edi, dword [edx + 0x1058]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x46dcec
push ebx
mov edx, dword [edx + 0x1060]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x46dcc7
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x46dc15
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1058]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1058]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x46dbf1
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x478295
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x4782b6
mov eax, 0x8876086c
jmp 0x4783a9
cmp dword [ebp + 0x7c], esi
je 0x478338
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x478318
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push 0xfde9
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.004b17a0
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push 0xfde9
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x478338
push esi
push 0x10000000
push 3
push esi
push 1
push SysReAllocString
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x478351
push esi
push 0x10000000
push 3
push esi
push 1
push SysReAllocString
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x478397
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x478397
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
je 0x478397
cmp eax, esi
je 0x4783a4
push esi
push esi
push esi
push 4
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
jne 0x4783a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x4783a9
mov dword [edi + 8], esi
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8

Function at 0x478f30
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x478f53
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x478f79
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x478f60
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret
Function at 0x479030
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x479062
push esi
call fcn.0048b480
mov eax, dword [esi + 0x40]
test eax, eax
je 0x47905b
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x4790e5
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4790d0
lea ebx, [ebx]
mov eax, dword [esi + 8]
test eax, eax
je 0x47908a
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x4790ca
cmp eax, 2
je 0x4790d0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x479080
cmp eax, 3
je 0x4790ad
cmp eax, 1
jne 0x479080
mov eax, dword [ecx + 4]
inc eax
mov edx, eax
mov dword [ecx + 4], eax
mov eax, dword [ecx + 8]
cmp edx, eax
jl 0x479080
mov edx, dword [esi + 0x144]
add edx, eax
mov dword [ecx + 8], edx
jmp 0x479080
xor eax, eax
pop esi
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.00478f30
pop esi
ret 4
cmp ecx, 0xcc
je 0x4790fc
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.00478f30
pop esi
ret 4
Function at 0x48df62
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x48df71
xor eax, eax
jmp 0x48e054
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x48e034
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4c6170]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4c6170]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4c6170]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4c6170]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4c6170]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4c6170]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4c6170]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4c6170]
inc edx
dec edi
jne 0x48df91
pop edi
test eax, eax
je 0x48e04e
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4c6170]
inc edx
dec eax
jne 0x48e038
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x4bd640
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x4bd6e0
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x4bd692
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4f879c]
xor eax, edx
inc esi
cmp esi, edi
jl 0x4bd673
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x4bd6bb
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4f879c]
xor eax, edx
inc esi
cmp esi, edi
jl 0x4bd69e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x406243
pop dword [ebp - 0x48]
mov eax, 0x406243
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xf9220185
sub dword [ebp - 0x58], 0xaacfbc3a
mov dword [ebp - 0x54], 0xae1e3356
add dword [ebp - 0x54], 0x841518ef
mov dword [ebp - 0x50], 0xa0c37777
add dword [ebp - 0x50], 0xab88ccb7
mov dword [ebp - 0x4c], 0x34356d31
add dword [ebp - 0x4c], 0xcbca92cf
lea eax, [ebp - 0x58]
push eax
mov eax, 0x69c88a5a
sub eax, 0x69880956
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x7cd3725d
add dword [ebp - 0x58], 0xf79ef6f9
mov dword [ebp - 0x54], 0x379389fa
add dword [ebp - 0x54], 0x9d8d77b
mov dword [ebp - 0x50], 0xc498fedc
add dword [ebp - 0x50], 0x9ed66d90
mov dword [ebp - 0x4c], 0x35f2d1ed
add dword [ebp - 0x4c], 0xca0d2e13
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x35bdb
push 0
call eax
mov ecx, 0x42df
mov edi, eax
mov edx, 0x46e400
add edx, dword [ebp - 0x48]
mov esi, 0xf3d9b576
xor dword [ebp - 0x18], 0xed3c9a55
mov ebx, dword [edx]
mov dword [ebp - 0x10], 0x7d20d2f3
xor ebx, esi
sub dword [ebp - 0xc], 0xbf372435
mov dword [edi], ebx
add dword [ebp - 0x14], 0xfcf76ec6
add edi, 0xe8aeb6b3
add edi, 0x17514951
add edx, 0x721a22b5
sub edx, 0x721a22b1
loop 0x406349
add eax, 0xfe4f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..reloc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6e025e29
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x291c7ec0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4a6d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4a6d5b
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push esi
not eax
cmp edx, 8
jb 0x4a6e39
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4df070]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4df070]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4df070]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4df070]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4df070]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4df070]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4df070]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4df070]
inc ecx
sub edx, 8
sub esi, 1
jne 0x4a6d75
pop edi
test edx, edx
je 0x4a6e5b
lea ecx, [ecx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4df070]
inc ecx
sub edx, 1
jne 0x4a6e40
not eax
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x23932f99
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4d941774
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1006d8fd
Capabilities:
Authenticate hmac

Disassembly:
mov al, byte [ecx + 0x2d]
cmp al, 0x46
jne 0x1006d91b
mov eax, dword [ecx]
and eax, 8
or eax, 0
jne 0x1006da58
mov byte [ecx + 0x18], 7
jmp fcn.1006dd77
xor edx, edx
cmp al, 0x4e
jne 0x1006d955
mov eax, dword [ecx]
and eax, 8
or eax, edx
jne 0x1006da58
mov byte [ecx + 0x18], 8
mov eax, dword [ecx + 8]
add eax, 0x18
mov byte [eax + 4], 1
mov dword [eax], 0x16
push dword [ecx + 8]
push edx
push edx
push edx
push edx
push edx
call fcn.1006dd77
add esp, 0x18
xor al, al
ret
cmp dword [ecx + 0x28], edx
jne 0x1006d932
cmp al, 0x6a
jg 0x1006da17
je 0x1006da0e
cmp al, 0x49
je 0x1006d9af
cmp al, 0x4c
je 0x1006d9a3
cmp al, 0x54
je 0x1006d997
cmp al, 0x68
jne 0x1006da58
mov eax, dword [ecx + 0xc]
cmp byte [eax], 0x68
jne 0x1006d990
inc eax
mov dword [ecx + 0xc], eax
xor eax, eax
inc eax
jmp 0x1006da55
push 2
jmp 0x1006da54
mov dword [ecx + 0x28], 0xd
jmp 0x1006da58
mov dword [ecx + 0x28], 8
jmp 0x1006da58
mov edx, dword [ecx + 0xc]
mov al, byte [edx]
cmp al, 0x33
jne 0x1006d9d4
cmp byte [edx + 1], 0x32
jne 0x1006da58
lea eax, [edx + 2]
mov dword [ecx + 0x28], 0xa
mov dword [ecx + 0xc], eax
jmp 0x1006da58
cmp al, 0x36
jne 0x1006d9ed
cmp byte [edx + 1], 0x34
jne 0x1006da58
lea eax, [edx + 2]
mov dword [ecx + 0x28], 0xb
mov dword [ecx + 0xc], eax
jmp 0x1006da58
cmp al, 0x64
je 0x1006da05
cmp al, 0x69
je 0x1006da05
cmp al, 0x6f
je 0x1006da05
cmp al, 0x75
je 0x1006da05
cmp al, 0x78
je 0x1006da05
cmp al, 0x58
jne 0x1006da58
mov dword [ecx + 0x28], 9
jmp 0x1006da58
mov dword [ecx + 0x28], 5
jmp 0x1006da58
cmp al, 0x6c
je 0x1006da42
cmp al, 0x74
je 0x1006da39
cmp al, 0x77
je 0x1006da30
cmp al, 0x7a
jne 0x1006da58
mov dword [ecx + 0x28], 6
jmp 0x1006da58
mov dword [ecx + 0x28], 0xc
jmp 0x1006da58
mov dword [ecx + 0x28], 7
jmp 0x1006da58
mov eax, dword [ecx + 0xc]
cmp byte [eax], 0x6c
jne 0x1006da52
inc eax
mov dword [ecx + 0xc], eax
push 4
jmp 0x1006da54
push 3
pop eax
mov dword [ecx + 0x28], eax
mov al, 1
ret
Function at 0x1006dd77
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1006dd86
pop dword [ebp - 0x4c]
mov eax, 0x1006dd86
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x8cc12d6
add dword [ebp - 0x5c], 0x45863275
mov dword [ebp - 0x58], 0xed13c263
add dword [ebp - 0x58], 0x451f89e2
mov dword [ebp - 0x54], 0x7e0eb5f8
add dword [ebp - 0x54], 0xce3d8e36
mov dword [ebp - 0x50], 0xb5745eeb
add dword [ebp - 0x50], 0x4a8ba115
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x15cca634
sub eax, 0x5c34534
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x1ff286fe
add dword [ebp - 0x5c], 0x547fe258
mov dword [ebp - 0x58], 0x3e124ffe
sub dword [ebp - 0x58], 0xfca5ee89
mov dword [ebp - 0x54], 0x602b0289
sub dword [ebp - 0x54], 0xfcbb961d
mov dword [ebp - 0x50], 0xd0915b49
sub dword [ebp - 0x50], 0xd0915b49
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x28a8a496
sub eax, 0x189f4386
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x58abd
push 0
call eax
mov ecx, 0x7edb1bcb
sub ecx, 0x7edadaf8
mov edi, eax
mov ebx, 0x100ce000
add ebx, dword [ebp - 0x4c]
mov esi, 0x8efe535c
xor dword [ebp - 0x38], ebx
mov edx, dword [ebx]
mov dword [ebp - 0x3c], 0x628aa792
xor edx, esi
sub dword [ebp - 0x30], 0xde542d26
mov dword [edi], edx
add dword [ebp - 0x14], ecx
add edi, 0x3555e2ff
add edi, 0xcaaa1d05
add ebx, 4
loop 0x1006de97
add eax, 0xf61f
xor ebx, ebx
add ebx, eax
add eax, 0x39545ac3
add eax, 0xc6aba542
mov ecx, 0xd0cf2d8e
add ecx, 0x3f30d272
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x100858d9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100858ea
pop esi
ret
push ebx
push edi
push esi
call fcn.1006dd77
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1006dd77
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10085912
push ebx
push esi
push edi
call fcn.10067180
add esp, 0xc
push 0
call fcn.1006dd77
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40611c
pop dword [ebp - 0x10]
mov eax, 0x67afa6df
sub eax, 0x676f45c3
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x253d6e7f
add dword [ebp - 0x20], 0x2914d6cc
mov dword [ebp - 0x1c], 0x2496f147
add dword [ebp - 0x1c], 0xd9c5afe
mov dword [ebp - 0x18], 0x70b67e52
add dword [ebp - 0x18], 0xdb95c5dc
mov dword [ebp - 0x14], 0xf96c50f2
sub dword [ebp - 0x14], 0xf96c50f2
lea eax, [ebp - 0x20]
push eax
mov eax, 0x32c9c076
sub eax, 0x32895016
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x9e16eb59
sub dword [ebp - 0x20], 0x29a48203
mov dword [ebp - 0x1c], 0xff02fdd7
sub dword [ebp - 0x1c], 0xbd969c62
mov dword [ebp - 0x18], 0xef6c0f9d
add dword [ebp - 0x18], 0x74035ccf
mov dword [ebp - 0x14], 0xba75e241
sub dword [ebp - 0x14], 0xba75e241
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x572a4c26
add eax, 0xa91624da
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3be0f
push 0
call eax
mov ecx, 0x5d15
xor edx, edx
add edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x10]
mov esi, 0x42b6fe8b
sub esi, 0x593b5f6c
add dword [ebp - 0xc], esi
mov edi, dword [ebx]
xor dword [ebp - 8], eax
sub edi, esi
xor dword [ebp - 0xc], 0x98bd1c0c
mov dword [edx], edi
mov dword [ebp - 4], 0xa42ba841
add edx, 0xfe468b8d
add edx, 0x1b97477
add ebx, 0xe1a3b9f8
sub ebx, 0xe1a3b9f4
loop 0x406234
add eax, 0x5998c1bd
add eax, 0xa668a56a
mov ebx, eax
add eax, 0x9a341884
add eax, 0x65cbe781
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941