joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbf83bcb2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
fild dword [ecx]
lea edx, [ecx + 4]
push esi
lea esi, [ecx + 8]
fstp dword [eax]
push edi
fild dword [edx]
lea edi, [ecx + 0xc]
push 6
fstp dword [eax + 4]
fldz
fst dword [eax + 0x18]
fst dword [eax + 0x1c]
fild dword [esi]
fstp dword [eax + 0x20]
fild dword [edx]
fstp dword [eax + 0x24]
fld1
fst dword [eax + 0x38]
fxch st(1)
fst dword [eax + 0x3c]
fild dword [ecx]
fstp dword [eax + 0x40]
fild dword [edi]
fstp dword [eax + 0x44]
fst dword [eax + 0x58]
fxch st(1)
fst dword [eax + 0x5c]
fild dword [esi]
fstp dword [eax + 0x60]
fild dword [edi]
fstp dword [eax + 0x64]
fst dword [eax + 0x78]
fst dword [eax + 0x7c]
fild dword [ecx]
fstp dword [eax + 0x80]
fild dword [edi]
fstp dword [eax + 0x84]
fxch st(1)
fst dword [eax + 0x98]
fxch st(1)
fst dword [eax + 0x9c]
fild dword [esi]
pop esi
fstp dword [eax + 0xa0]
fild dword [edx]
mov edx, eax
fstp dword [eax + 0xa4]
fst dword [eax + 0xb8]
fxch st(1)
fstp dword [eax + 0xbc]
jmp 0xbf83bd56
fld1
push dword [ebp + 0x10]
fst dword [edx + 8]
fstp dword [edx + 0xc]
push edx
push edx
call fcn.bf83bbed
add edx, 0x20
dec esi
jne 0xbf83bd54
pop edi
pop esi
pop ebp
ret 0xc

Function at 0xbf8bb3cd
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
xor byte [eax], al
add byte [eax], al
js 0xbf8bb3ae
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, dword [eax]
pop edx
add byte [eax], al
add byte [eax], bl
add byte [ecx], al
add byte [edi + 0x1e], bl
add byte [edx], al
add al, ah
push ecx
add dword [eax], eax
lahf
push ds
add byte [eax], al
add byte [eax], al
add al, byte [eax]
loopne 0xbf8bb41b
push ebp
xchg ch, ah
js 0xbf8bb3a6
add eax, esp
push ecx
push ebp
xchg ch, ah
js 0xbf8bb3ae
add eax, esp
push ecx
push ebp
xchg ch, ah
js 0xbf8bb3b6
add eax, esp
push ecx
push ebp
xchg ch, ah
js 0xbf8bb3be
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ah
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + eax], cl
dec esp
add byte [ecx], cl
inc ebx
add byte [ebp], al
dec esi
add byte [ebx], dl
jle 0xbf8bb410
xor dword [eax], eax
add byte cs:[edi], dl
dec esi
add byte [ebx], al
push edi
add byte [esi], cl
Function at 0xbf8cfbcd
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push esp
cmp al, 0x4e
push ebx
lahf
ficom word [eax + 0x3f03661b]
lea edx, [esi]
pop eax
loopne 0xbf8cfbbe
lodsb al, byte [esi]
cmp byte [esi + 3], ah
mov bl, 0x8f
rcl dword [eax - 0x47424dc5]
push ebp
jbe 0xbf8cfc78
loopne 0xbf8cfc67
add al, 0x2a
mov cl, cl
sahf
out 0xb1, eax
arpl word [esi - 0x1c], ax
and ecx, dword [ecx + 0x16fe93fb]
scasb al, byte es:[edi]
iretd
rep stosb byte es:[edi], al
mov eax, dword [ebp - 4]
push 0x14
xor esi, esi
pop ebx
mov eax, esi
shr eax, 2
mov edx, eax
mov eax, dword [ebp - 4]
shl edx, 2
add eax, edx
mov ecx, esi
sub ecx, edx
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
shl ecx, 3
shl edx, cl
or dword [eax], edx
inc esi
cmp esi, ebx
jb 0xbf8cfc71
and dword [ebp - 0x24], 0
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x4c], 0x123174bb
mov dword [ebp - 0x48], 0x86521ff8
mov dword [ebp - 0x44], 0x98d2438b
mov dword [ebp - 0x40], 0x7966ce12
mov dword [ebp - 0x3c], 0xc5d92014
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov esi, 0x228e53a4
mov ecx, dword [ebp - 8]
mov eax, edi
cld
or ecx, ecx
je 0xbf8cfce4
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
xor edx, edx
push 5
mov eax, ecx
pop esi
div esi
mov eax, dword [ebp + edx*4 - 0x4c]
xor dword [ebp + ecx*4 - 0x24], eax
inc ecx
cmp ecx, esi
jb 0xbf8cfce6
lea eax, [ebp - 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
cld
or ecx, ecx
je 0xbf8cfd1d
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0x10]
lea eax, [ebp - 0x38]
push dword [ebp + 0xc]
push 0
push 0x228e5e34
push dword [0x228e53b8]
push eax
push ebx
push dword [ebp - 4]
call fcn.bf8fb4e2
lea eax, [ebp - 0x38]
mov byte [eax], 0
inc eax
dec ebx
jne 0xbf8cfd40
mov eax, dword [ebp - 4]
push 0x50
pop ecx
pop edi
pop esi
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0xbf8cfd50
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.bf8ce64c
xor eax, eax
inc eax
leave
ret

Function at 0xbf8d4150
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x24]
mov eax, dword [eax + 0xa0]
sub ecx, dword [eax + 0xc]
neg ecx
sbb ecx, ecx
inc ecx
mov eax, ecx
ret
Function at 0xbf8dbcb7
Capabilities:
Encode data using xor

Disassembly:
jb 0xbf8dbcb9
popal
add byte [eax + eax + 0x2c], ch
add byte [eax], ah
add byte [eax], dl
jne 0xbf8dbcc5
bound eax, qword [eax]
insb byte es:[edi], dx
add byte [ecx], ch
add byte [ebx], ah

Function at 0xbf90b3a5
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx], dh
je 0xbf90b3aa
jb 0xbf90b3ac
imul eax, dword [eax], 0x750062
je 0xbf90b3b4
imul eax, dword [eax], 0x6e006f
pop esp
add byte [eax + eax + 0x6f], al
add byte [edi], dh
outsb dx, byte [esi]
add byte [eax + eax + 0x6f], ch
add byte [ecx], ah
add byte fs:[eax + eax + 0x38], bl
add byte [ebx], dh
add byte [ebx], dh
add byte [ebp], ah
arpl word [eax], ax
add byte ss:[ebp], ah
add byte gs:[ecx], dh
add byte [edx], ah
arpl word [eax], ax
xor dword [eax], eax
xor dword [eax], eax
xor al, byte [eax]
xor al, 0
cmp byte [eax], al
xor al, 0
xor eax, 0x65003600
add byte [eax], bh
add byte [eax + eax + 0x39], ah
add byte [esi], dh
add byte [ebp], ah
cmp byte [eax], al
add byte fs:[ecx], bh
add byte [ecx], bh
add byte [0x63003400], dh
add byte [ecx], dh
add byte [eax + eax], dh
xor al, byte [eax]
add byte ss:[0x5c00], dh
add byte [eax], al
jne 0xbf90b415
je 0xbf90b417
jb 0xbf90b3f1
invalid

Function at 0xbf90c910
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
add eax, dword [ebx]
sub esp, 0x20077
add al, byte [eax]
add dword [eax], eax
add dword [eax], eax
jne 0xbf90c901
out dx, eax
add eax, dword [ebx]
sub esi, 0x20077
add al, byte [eax]
add dword [eax], eax
add dword [eax], eax
jne 0xbf90c911
out dx, eax
add eax, dword [ebx]
xor eax, 0x20077
add al, byte [eax]
add dword [eax], eax
add dword [eax], eax
jne 0xbf90c921
out dx, eax
add eax, dword [ebx]
xor edx, 0x20077
add al, byte [eax]
add dword [eax], eax
add dword [eax], eax
jne 0xbf90c931
out dx, eax
add eax, dword [ebx]
xor esp, 0x20077
add al, byte [eax]
add dword [eax], eax
add dword [eax], eax
jne 0xbf90c941
out dx, eax
add eax, dword [ebx]
xor esi, 0x20077
add al, byte [eax]
add dword [eax], eax
add dword [eax], eax
jne 0xbf90c951
out dx, eax
add eax, dword [ebx]
cmp eax, 0x20077
add al, byte [eax]
add dword [eax], eax
add dword [eax], eax
jne 0xbf90c961
out dx, eax
add eax, dword [ebx]
cmp edx, 0x20077
add al, byte [eax]
add dword [eax], eax
add dword [eax], eax
jne 0xbf90c971
out dx, eax
add eax, dword [ebx]
cmp esp, 0x20077
add al, byte [eax]
add dword [eax], eax
add dword [eax], eax
jne 0xbf90c981
out dx, eax
add eax, dword [ebx]
cmp esi, 0x20077
add al, byte [eax]
add dword [eax], eax
add dword [eax], eax
jne 0xbf90c991
out dx, eax
add eax, dword [ebx]
cmp dword [esi + 0x20079], 0x10002
add dword [eax], eax
jne 0xbf90c9a1
out dx, eax
add eax, dword [ebx]
cmp dword [edx + 0x20079], 0x10002
add dword [eax], eax
jne 0xbf90c9b1
out dx, eax
add eax, dword [ebx]
cmp dword [eax + 0x20079], 0x10002
add dword [eax], eax
jne 0xbf90c9c1
out dx, eax
add eax, dword [ebx]
and dword [eax + 0x20079], 0x10002
add dword [eax], eax
jne 0xbf90c9d1
out dx, eax
add eax, dword [ebx]
xor dword [eax + 0x20079], 0x10002
add dword [eax], eax
jne 0xbf90c9e1
Function at 0xbf9a7e14
Capabilities:
Encode data using xor

Disassembly:
dec ebx
inc edx
xor al, 0x34
cmp byte [ecx], bh
cmp byte [edi], dh
cmp byte [edi + 0x53], bl
push eax
xor dword [esi + 0x33], edi
xor dword [edx + 0x66], esp
xor edi, dword [eax]
xor eax, 0x33646136
xor al, 0x65
xor esi, dword [0x3638787e]
jle 0xbf9a7eb6
xor dword cs:[esi], ebp
xor dword [esi], ebp
cmp dword [edx - 0x50], esp
invalid
xor al, 0x34
cmp byte [ecx], bh
cmp byte [edi], dh
cmp byte [edi + 0x53], bl
push eax
xor dword [esi + 0x33], edi
xor dword [edx + 0x66], esp
xor edi, dword [eax]
xor eax, 0x33646136
xor al, 0x65
xor esi, dword [0x3638787e]
jle 0xbf9a7f56
xor dword cs:[esi], ebp
xor dword [esi], ebp
cmp dword [esi], ebp
mov al, 0xff
invalid
xor al, 0x34
cmp byte [ecx], bh
cmp byte [edi], dh
cmp byte [edi + 0x53], bl
push eax
xor dword [esi + 0x33], edi
xor dword [edx + 0x66], esp
xor edi, dword [eax]
xor eax, 0x33646136
xor al, 0x65
xor esi, dword [0x3638787e]
jle 0xbf9a7ff6
xor dword cs:[esi], ebp
xor dword [esi], ebp
cmp dword [ecx], esi
mov al, 0xff
invalid
xor al, 0x34
cmp byte [ecx], bh
cmp byte [edi], dh
cmp byte [edi + 0x53], bl
push eax
xor dword [esi + 0x33], edi
xor dword [edx + 0x66], esp
xor edi, dword [eax]
xor eax, 0x33646136
xor al, 0x65
xor esi, dword [0x3638787e]
jle 0xbf9a8096
xor dword cs:[esi], ebp
xor dword [esi], ebp
cmp dword [edi - 0x50], ebp
invalid
xor al, 0x34
cmp byte [ecx], bh
cmp byte [edi], dh
cmp byte [edi + 0x53], bl
push eax
xor dword [esi + 0x33], edi
xor dword [edx + 0x66], esp
xor edi, dword [eax]
xor eax, 0x33646136
xor al, 0x65
xor esi, dword [0x3638787e]
jle 0xbf9a8136
xor dword cs:[esi], ebp
xor dword [esi], ebp
cmp dword [eax + esi*4 - 1], esi
invalid
xor al, 0x34
cmp byte [ecx], bh
cmp byte [edi], dh
cmp byte [edi + 0x53], bl
push eax
xor dword [esi + 0x33], edi
Function at 0xbf9e10f3
Capabilities:
Encode data using xor

Disassembly:
jns 0xbf9e114b
pop ss
pop ds
cmpsb byte [esi], byte es:[edi]
outsb dx, byte [esi]
xchg edx, eax
in al, 0xcd
mov edi, 0x2800d6c6
add byte [eax], ch
std
invalid
add eax, dword [eax - 0x70]
dec ebx
add ebx, dword [eax]
nop
dec ebx
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], ah
loope 0xbf9e10d7
push eax
movsd dword es:[edi], dword [esi]
add byte [eax + 0x37ee620], cl
pop ss
sbb edi, dword [ebx + 0x52]
cmp edi, ebp
pushal
adc al, byte [eax]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
cmp eax, 0x1f62
add byte [eax], al
add byte [eax + 0x77035c13], dl
add dword [eax], eax
add cl, bh
add esi, dword [edi + 1]
add byte [eax], al
stc
xchg edi, eax
ja 0xbf9e10e3
mov dword [0x9b8d5682], eax
lahf
and al, byte [esp + esi*8 + 0x48]
fcom dword [edi]
rcl dl, 0x20
out 0x5e, al
adc eax, 0x73830bae
stc
cmp edx, esp
aas
clc
aaa
xor dword [ebx], eax
invalid
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x5d6d5f5b
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x63e7110a
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x41b140
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x426138], 0
jne 0x41b1c1
cmp dword [0x426158], 0
jne 0x41b170
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x426158], eax
test eax, eax
jne 0x41b170
push str.GetEnvironmentStrings_failed
call fcn.0041a95c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x426158]
jmp 0x41b184
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004154e4
pop ecx
mov edi, eax
test eax, eax
jne 0x41b17c
lea edi, [ebp + 1]
push edi
call fcn.00414de8
pop ecx
mov ebx, eax
mov dword [0x42613c], ebx
test ebx, ebx
jne 0x41b1ae
xor eax, eax
jmp 0x41b284
push edi
mov edx, dword [0x426158]
push edx
push ebx
call fcn.00415394
add esp, 0xc
jmp 0x41b1e1
xor esi, esi
mov ebx, dword [0x426138]
jmp 0x41b1db
push eax
call fcn.004154e4
pop ecx
test eax, eax
jne 0x41b1d7
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41b1cb
lea ebx, [esi + 4]
push 4
mov dword [0x426140], ebx
inc ebx
push ebx
call fcn.004148c0
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41b204
xor eax, eax
jmp 0x41b284
cmp dword [0x426138], 0
jne 0x41b235
xor esi, esi
mov ebx, dword [0x42613c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41b226
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004154e4
pop ecx
mov edi, eax
test eax, eax
jne 0x41b21c
jmp 0x41b266
xor esi, esi
mov ebx, dword [0x426138]
mov eax, dword [esp]
mov edi, eax
jmp 0x41b260
push eax
call fcn.004154e4
pop ecx
test eax, eax
je 0x41b255
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41b259
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41b244
mov eax, dword [0x426138]
test eax, eax
je 0x41b276
push eax
call fcn.00414df8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x426138], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x438cbb
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x438a14
pop edx
or ebx, ebx
and ebx, ebx
inc esi
call fcn.00438cfd
mov esi, 0xe3bd3450
add ebx, 0x18b7ab6c
dec esi
xor dword [ecx], edx
and esi, esi
sub esi, esi
add esi, ebx
inc ecx
dec esi
and esi, esi
inc esi
cmp ecx, edi
jne fcn.00438cbb
push 0x6668f9b3
mov esi, dword [esp]
add esp, 4
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7ded7a09
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1a5e0b39
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x43ae50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x55848b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x586220]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x41f350
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea ecx, [edi + 0x18]
mov dword [esp + 0x18], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.004a02c0
mov dword [edi + 0x18], eax
mov eax, edi
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov word [edi + 0x30], 0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x43b830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x556318
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x586220]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x41f37c
xor eax, eax
mov dword [edi + 4], 0
mov word [edi + 8], ax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x2c], 0xf
mov dword [edi + 0x28], eax
mov byte [edi + 0x18], al
mov dword [edi + 0x14], 0x41f328
mov dword [edi + 0x48], 0xf
mov dword [edi + 0x44], eax
mov byte [edi + 0x34], al
mov dword [edi + 0x30], 0x41f328
mov dword [edi + 0x64], 0xf
mov dword [edi + 0x60], eax
mov byte [edi + 0x50], al
mov dword [edi + 0x4c], 0x41f328
mov byte [edi + 0x68], al
mov dword [edi + 0x6c], eax
mov dword [edi + 0x80], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
mov byte [edi + 0x8c], 1
mov dword [edi + 0x90], 1
mov dword [edi + 0x94], eax
mov dword [edi + 0x98], eax
mov dword [edi + 0x9c], eax
mov dword [edi + 0x7c], 0x41f374
mov dword [esp + 0x18], eax
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], eax
push 0x128
push eax
lea esi, [edi + 0x190]
mov byte [esp + 0x20], 1
push esi
mov byte [edi + 0x18c], al
call fcn.00535f30
xor eax, eax
cmp byte [edi + 0x18c], al
setne al
push eax
push esi
call fcn.00490060
add esp, 0x14
mov dword [edi + 0x2b8], 0
mov dword [edi + 0x2c4], 0
mov dword [edi + 0x2c8], 0
mov dword [edi + 0x2cc], 0
lea ecx, [edi + 0x2d0]
mov byte [esp + 0x18], 3
mov dword [edi + 0x2d0], 0
mov dword [edi + 0x2d4], 0
call fcn.004402c0
mov dword [edi + 0x2d0], eax
mov dword [edi + 0x2d8], 0
mov dword [edi + 0x2dc], 0
mov dword [edi + 0x2e0], 0
mov dword [edi + 0x2ec], 0
mov dword [edi + 0x2f0], 0
mov dword [edi + 0x2f4], 0
mov eax, dword [0x58c860]
test al, 1
jne 0x43b9e7
or eax, 1
mov dword [0x58c860], eax
push 0x58c710
mov byte [esp + 0x1c], 7
call fcn.004910f0
push 0x567870
call fcn.00534ac5
add esp, 8
mov dword [edi + 0x2f8], 0x58c710
mov dword [edi + 0x310], 0
mov dword [edi + 0x314], 0
mov dword [edi + 0x318], 0
mov byte [edi + 0x31c], 1
mov dword [edi + 0x320], 1
mov dword [edi + 0x324], 0
mov dword [edi + 0x328], 0
mov dword [edi + 0x32c], 0
mov dword [edi + 0x30c], 0x41f374
mov ecx, edi
mov byte [esp + 0x18], 8
call fcn.0043e9c0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x43bff0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5564fa
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x586220]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov eax, dword [0x586220]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x34]
push 0
mov dword [esp + 0x10], esi
call fcn.00530958
mov dword [esp + 0x2c], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esp + 0x2c], 6
test edi, edi
jne 0x43c0a5
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x41f144
push eax
lea ecx, [esp + 0x14]
call fcn.0053525a
push 0x568d50
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x41f13c
push eax
call fcn.00535491
push edi
push esi
call fcn.00530fc0
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00535482
add esp, 0x24
ret 4