joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x40c470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40c492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c488
mov eax, 1
add ebx, ebx
jne 0x40c4ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c4a0
jne 0x40c4bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4a0
xor ecx, ecx
sub eax, 3
jb 0x40c4d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c542
mov ebp, eax
add ebx, ebx
jne 0x40c4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c4e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c50c
inc ecx
add ebx, ebx
jne 0x40c4f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c4ed
jne 0x40c509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c52c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c51d
jmp 0x40c48e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c52c
add edi, ecx
jmp 0x40c48e
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c54a
cmp byte [edi], 1
jne 0x40c54a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40c54f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c5c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd70c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd748]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c57c
mov ecx, edi
jns 0x40c5ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd74c]
or eax, eax
je 0x40c5c1
mov dword [ebx], eax
add ebx, 4
jmp 0x40c599
call dword [esi + 0xd750]
popal
jmp 0x401128
Function at 0x10009652
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100096ef
push ebx
push esi
call fcn.1000961b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10009564
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000969c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100096ee
push edi
push eax
call fcn.10007fe7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100096bc
call fcn.10008035
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100096ed
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10009564
add esp, 0x20
test eax, eax
jne 0x100096db
push edi
call fcn.10008035
jmp 0x100096e3
push ebx
call fcn.10008035
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000995a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100119c8
push 0x100119c0
push str.FlsAlloc
push 0x1e
call fcn.10009878
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000998e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010134]
call esi
jmp 0x10009994
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100099d8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100119d8
push 0x100119d0
push str.FlsGetValue
push 0x20
call fcn.10009878
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009a0f
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000ef40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000ef6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000ef6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x441e3196
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x69b625a0
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4cf04f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x380], 0xffffffff
je 0x4cf087
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x4cf08c
jmp 0x4ce9df
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x4cf0d3
lea eax, [ebp - 0x714]
push eax
call fcn.004cd04d
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.004cd002
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x4cf0de
invalid
jmp 0x4cf0e3
jmp 0x4ce9df

Function at 0x4efc4f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4efc67
mov edi, dword [esi + 0xc]
jmp 0x4efca7
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4efc80
call fcn.0042387f
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4efc95
call fcn.0042387f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4efca7
call fcn.0042387f
call fcn.00420b06
cmp dword [eax + 0x3c], 0
je 0x4efcbc
push edi
mov ecx, ebx
call fcn.004eea81
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004efb69
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4efcda
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4efce6
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x50bbf7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5896f0]
jne 0x50bc01
repz ret
jmp fcn.00513ae3
Function at 0x416210
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x41622a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416231
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416220
mov eax, 1
add ebx, ebx
jne 0x416243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x416238
jne 0x416254
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416238
xor ecx, ecx
sub eax, 3
jb 0x416268
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4162da
mov ebp, eax
add ebx, ebx
jne 0x416273
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416280
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4162a4
inc ecx
add ebx, ebx
jne 0x416290
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x416285
jne 0x4162a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416285
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4162c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4162b5
jmp 0x416226
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4162c4
add edi, ecx
jmp 0x416226
pop esi
mov edi, esi
mov ecx, 0x421
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4162e2
cmp byte [edi], 1
jne 0x4162e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4162e7
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x41635f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x176a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17790]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416314
mov ecx, edi
jns 0x416343
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17794]
or eax, eax
je 0x416359
mov dword [ebx], eax
add ebx, 4
jmp 0x416331
call dword [esi + 0x177a4]
mov ebp, dword [esi + 0x17798]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416393
sub esp, 0xffffff80
jmp 0x40ad38

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x443de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
xor bl, bl
test edx, edx
je 0x443e07
push esi
mov esi, dword [ebp + 0xc]
sub esi, eax
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or bl, cl
sub edx, 1
jne 0x443df6
pop esi
mov al, bl
shr al, 4
or bl, al
movzx eax, bl
mov ecx, eax
shr ecx, 2
or ecx, eax
mov eax, ecx
shr eax, 1
or eax, ecx
and eax, 1
pop ebx
pop ebp
ret

Function at 0x463fa9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00463e1f

Function at 0x4acef1
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x40]
jno 0x4f279a
lea edx, [edx + 1]
jmp 0x4d39b9
push dword [esp]
push esi
mov dword [esp + 8], edx
mov edx, edi
mov byte [esp + 4], bl
movzx dx, bl
mov edx, dword [esp + 0xc]
mov byte [esp], bl
call fcn.004e6cfd
call fcn.00497ac5

Function at 0x4cd0f9
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 0x38], edi
push 0x318de84a
call fcn.00487b29
push cs
mov ecx, 0x42eb833d
test eax, 0x699d4c03
cmp dword [edx], edi
stosd dword es:[edi], eax
rdmsr
mov ch, 0x12
call 0x2e2b5057
xor bh, byte [eax]
sub dword [edi - 0x63e12602], ebx
pop ebp
pop es
mov byte gs:[0x4d8c02d5], al
pop ss
cmpsb byte [esi], byte es:[edi]
pop ecx
cmpsb byte [esi], byte es:[edi]
out dx, al
test eax, 0x62a243f8
sbb dword [esi], ecx
inc edi
push esi
out 0x75, al
cmp dh, byte [edx - 0x14]
jae 0x4cd102
add ah, ch
cmp ah, byte [esi + 0x1a97cd41]
invalid

Function at 0x4df3c3
Capabilities:
Packed with generic packer

Disassembly:
or al, 0xb3
les ecx, [edi - 0x38]
xchg eax, eax
jg 0x4df421
dec esp
sti
dec dword [ebx + 0xb318389]
mov ecx, dword [ecx + 0xb3183]
pop ebx
lea ecx, [ecx - 0x28c8c768]
movzx ebx, bl
mov ecx, dword [ecx + 0xb3183]
pop ebx
lea ecx, [ecx - 0x28c8c768]
movzx ebx, bl
movsx ebx, dl
call fcn.00499e9d
jg 0x4df3a0
inc esi
mov dword es:[esp + 0x20], 0xbb2f9c07
xchg ebp, eax
sbb byte [ecx - 0x69ee694c], cl
pop ebp
push edx
dec ecx
mov cl, 0x7d
push edi
sub byte [eax], 0x16
jg 0x4df3c1
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
cdq
jno 0x4df4a0
mov dl, 0x39
and dword [edi - 0xc], esi
inc edi
dec esp
cli
add dl, byte [edi + esi*8 + 0x5a83804e]
fstp xword [ebx + 0x65]
dec dword [ebx + eax + 0x53f99b4a]
popal
popfd
not edx
ret
dec ebp
mov esp, 0x5445f3e2
aas
sub byte [eax + 0x41], dl
in eax, 0xb2
sub dword [esi], ebx
sbb dl, ah
inc ebp
enter 0xfffffffffffff3b5, 0xffffffffffffffce
rcr byte [0x4f784312], 1
arpl word [edi + 0x6f3112a8], bp
xchg ebp, eax
and cl, byte [eax + 0x7223c572]
dec ecx
dec esi
loope 0x4df4d2
jno 0x4df4d4
lea ecx, [edx - 0x4822dd9b]
fnsave dword [edi + 0x4aadbe69]
cmp eax, 0x4186a1ca
push ss
imul edi, dword [esi - 0x35c2b553], 0x164186a1
dec edi
push eax
outsb dx, byte [esi]
imul ebp, dword [edi + 0x4c], 0xc3327dcb
inc eax
xchg eax, ebx
outsd dx, dword [esi]
fldenv [eax - 0x64]
Function at 0x4fadbd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bt bp, cx
push ebp
pushal
lea ebp, [esp + 0x20]
das
inc ah
clc
sub esp, 0xfffffff8
cwde
bts ax, 8
push esi
not eax
push edi
shld eax, eax, cl
clc
push ebx
xor ax, 0xb054
stc
push edx
rcl ah, cl
mov eax, dword [ebp + 8]
clc
pushal
mov byte [esp + 4], bh
test eax, eax
pushfd
jmp 0x509996
xor ch, ch
not ch
mov ecx, dword [esi + 0x7c]
stc
add ecx, edx
pushfd
pushfd
jmp 0x500bf1
lea esp, [esp + 0x24]
je 0x4fc2e5
sal esi, 0x1f
lea edx, [ebx*8 - 0x14d99d70]
stc
mov esi, dword [eax + 0x3c]
push esp
movsx dx, cl
add esi, eax
cmc
mov edx, dword [esi + 0x78]
pushal
push esi
test edx, edx
pushfd
pushfd
jmp 0x508205
lea esp, [esp + 0x30]
je 0x4fc2e5
bsr ecx, ecx
add edx, eax
test dh, 0xa8
jmp 0x500909
jmp 0x50731b
Function at 0x4ff415
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x44]
jne 0x4fb8fd
aaa
btr ax, cx
shl al, cl
inc al
xor edx, edx
shr ah, cl
mov eax, edx
not al
call fcn.00506aac
sub eax, 0x996ac48c
inc ecx
test eax, 0xc738b9d6
inc eax
push eax
jecxz 0x4fa425
mov esi, 0x479c2d5f
invalid
retf 0x5301
lea esp, [esp + 0x44]
ja 0x500966
call fcn.0050a138
sbb eax, 0xc9a52110
inc ecx
test eax, 0x89abea19
or byte [edx], al
add ebp, dword [ecx - 0x4ac8e968]
add al, 0x2a
mov ebx, 0x8905ff58
sub al, 0xb9
stosb byte es:[edi], al
sub eax, 0x1b0a504d
jo 0x4ff391
outsb dx, byte [esi]
mov esp, 0xee84097b
push edx
adc eax, 0x717699e6
out 0x99, al
jbe 0x4ff3f4
popal
mov al, byte [0x587d4a10]
outsd dx, dword [esi]
cli
aad 0x66
loope 0x4ff3e3
ficomp dword [ebp - 0x34f4b439]
add al, 0xf7
cld
lock sbb dword [ebx + 0x7ebdc42b], 0x14
pushal
out 0xd3, al
pop edi
xchg byte [ecx + ecx*2 + 0x4d], al
invalid
dec ecx
dec ebp
pop eax
out dx, eax
in al, dx
in al, dx
xchg dh, bl
bound ecx, qword [eax]
insb byte es:[edi], dx
loop 0x4ff3e9
in al, 0xd5
mov edx, 0x4617741b
fistp word [eax + 8]
lahf
jae 0x4ff3f0
inc esp
sbb byte [eax - 0x6ebf5707], bh
mov esi, 0x85560344
jp 0x4ff3a6
test byte [ecx - 0x4d], 0x94
lodsb al, byte [esi]
push ss
mov edx, 0x5ceb3f89
cli
cmc
xor al, 0x19
loop 0x4ff447
xlatb
mov byte [esi + 0x6a4f24f4], bl
invalid
sahf
hlt
jns 0x4ff37f
mov ecx, 0xf302b443
xor byte [edi - 0x20e70810], dl
sbb bh, bl
sub dl, 0x74
and edx, dword [eax - 0x1b149319]
inc ebx
mov bl, 0xe0
out 0x48, eax
dec edi
mov al, byte [0x81a5bac7]
sbb byte [ecx], 0x40
cli
or eax, 0x9d8a5166
cmp al, byte [eax + 0xf66b1c7]
mov edx, 0xc3890be7
test si, bp
pushfd
mov byte [esp], 0x6b
cmp byte [edi], 0x23
pushal
jmp 0x504bf9
pushal
push ecx
fisttp word [esi]
mov ebp, 0xe04f521a
out 0x60, eax
pop es
clc
das
push esp
inc ebx
call 0x6fca18b
mov ch, 0x14
mov edx, 0xc30be324
or eax, ebx
mov dl, 0x54
cmp al, 0x80
ja 0x4ff47c
pop ds
aam 0xa3
mov dword [0x2a51c01a], eax
mov edx, 0x79f374cf
jecxz 0x4ff48f
outsd dx, dword gs:[esi]
outsd dx, dword [esi]
mov cl, 0xe6
mov ebx, dword [ebp - 0x76]
pop ebx
mov al, byte [ebx + 0x4eb80b7b]
inc ebx
or ebx, dword [edi]
pushal
push ss
pop dword [edx]
push 0xc1a6cc30
mov gs, word [edi - 0x606feee6]
lahf
fmul qword [esi + 0x51d25d64]
pop ss
push es
sub eax, 0x806f1da
cmp byte [esi], dl
add al, 0x23
dec esp
sub eax, 0xe6e56379
xchg esp, eax
xchg ecx, eax
push ss
test dword [edx - 0x18], edx
and dh, dl
or eax, 0x8b158f16
inc esp
lea ebx, [ecx]
jae 0x4ff4dd
add ch, byte [eax + 0x30]
int3
invalid
mov bh, 0x10
psubb mm5, qword [esi + edx*4]
xchg esi, eax
loope 0x4ff463
jae 0x4ff4d8
stc
pop eax
cmp ah, ah
sub ecx, dword [edx]
sub eax, 0xf572b592
mov edx, 0xe67812bd
adc dword [esi], 0x1a1592c1
or eax, 0x792ee9ce
retf 0x76bd
pushal
jmp 0x4fa3b1
Function at 0x50b1f9
Capabilities:
Encode data using xor

Disassembly:
call fcn.00506ea3
cmp ch, cl
pushal
mov word [esp], si
add edi, eax
clc
pushal
jmp 0x50679d
int1
lcall 0xeabd, 0x47b1466d
movsd dword es:[edi], dword [esi]
pop es
sar byte [ecx + 0x75c14443], 1
mov ebp, 0xb1ca7d1a
jbe 0x50b214
invalid
mov edi, dword [edx + 0x1c]
lea esp, [esp + 4]
jnp 0x50af1c
add edi, eax
cmp bl, bh
stc
bt di, ax
mov edi, dword [edi + ecx*4]
cmp esi, 0x6ac68d60
test edi, edi
call fcn.0050ca23
xor cl, byte [0x5e88eb45]
test eax, 0xc56ff068
movsb byte es:[edi], byte [esi]
jbe 0x50b214
pushal
invalid
int1
loopne 0x50b1d3
test dh, bl
out dx, eax
popal
xor dl, 0x7e
mov byte [edi], ch
and bh, ah
nop
xchg ecx, ebx
push 0x983f04b3
or byte [esi + ebp - 0x14], dh
lds esp, [edi - 0x503d85e3]
pop esp
or edx, dword [edx - 0x57]
js 0x50b215
push ecx
sub eax, 0x6c117c3a
jge 0x50b287
aas
or bl, dl
xchg esp, eax
pushfd
fistp word [esi - 0x122c0a35]
push 0x65
sbb ebx, dword [edx]
or esi, 0x4f48491d
dec eax
dec edi
push 0x39
cmpsb byte ss:[esi], byte es:[edi]
or ax, 0x89be
fisub word [ebp + 0x27]
pop ds
and byte [edx], dl
jmp 0x434aa979
pop es
jne 0x50b26e
inc ecx
jg 0x50b28f
jle 0x50b2da
jl 0x50b2f2
shl edx, cl
arpl word [edx + ecx*2 - 0x30], dx
ja 0x50b259
lodsd eax, dword [esi]
loop 0x50b25f
out dx, al
jbe 0x50b268
adc ah, ch
invalid
mov byte [0x25d86523], al
push edx
in eax, 0x9e
cmp dword [esi - 0x47], ebx
mov gs, word [ecx + 0x5582596e]
push es
add dword [esi - 0x71afc547], ebp
jns 0x50b306
out dx, al
mov ecx, 0xbea7cd4a
ffreep st(1)
call [ebx - 0x1f]
xchg esi, eax
pop ebp
sbb ah, byte [ebp - 0x24055bee]
stosb byte es:[edi], al
cli
fld xword [esi]
stosb byte es:[edi], al
mov dword [esi - 0x57], ebx
sub ah, byte [ebp - 0x1c]
out dx, al
fist word [ecx + 0x50]
dec eax
into
mov dword [ebx - 0x358314c6], ebp
sbb ebx, dword [ebp + 0xc]
ljmp 0x52a8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4021a6
Capabilities:
Parse pe header

Disassembly:
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4021b3
xor eax, eax
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov eax, dword [ecx]
sub eax, 0x4550
neg eax
sbb eax, eax
not eax
and eax, ecx
ret

Function at 0x40243f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
call fcn.004021a6
and dword [ebp - 8], 0
mov esi, eax
movzx eax, word [esi + 0x14]
lea eax, [eax + esi + 0x18]
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [esi + 6]
jae 0x4024e5
push 0xffffffffffffffff
push ecx
lea eax, [ebp - 0x10]
push 0x31
push eax
call fcn.00403969
add esp, 0xc
call fcn.00407b82
push eax
push dword [ebp - 4]
call fcn.004048c6
mov ebx, eax
add esp, 0xc
neg ebx
lea edi, [ebp - 0x10]
sbb bl, bl
call fcn.00404d03
inc bl
je 0x4024d5
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xc]
add ebx, dword [ebp + 0xc]
mov edi, 0xdeadbeef
jmp 0x4024cb
push 4
lea eax, [ebx + 0xc]
push 0x408080
push eax
call fcn.004048c6
add esp, 0xc
test eax, eax
je 0x4024d1
mov eax, dword [ebx + 4]
lea ebx, [ebx + eax + 0x10]
cmp dword [ebx], edi
je 0x4024ad
jmp 0x4024d5
test ebx, ebx
jne 0x4024f3
add dword [ebp - 4], 0x28
movzx eax, word [esi + 6]
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jl 0x402469
mov esi, dword [ebp + 8]
xor edi, edi
call fcn.00405d98
mov eax, esi
jmp 0x402549
mov edi, dword [ebx + 8]
lea esi, [ebp - 0x18]
call fcn.00405d98
push 0
mov ecx, esi
call fcn.00405c6b
push eax
add ebx, 0x10
push ebx
call fcn.00407c60
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x18]
call fcn.00405e42
xor edx, edx
test esi, esi
jle 0x402534
push edx
lea ecx, [ebp - 0x18]
call fcn.00405c6b
xor byte [eax], 0xaa
inc edx
cmp edx, esi
jl 0x402523
mov edi, dword [ebp + 8]
lea ebx, [ebp - 0x18]
call fcn.00405db3
mov edi, ebx
call fcn.00405c51
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret