joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7b009b
Capabilities:
Encode data using xor

Disassembly:
jmp 0x94b8cb
push 0xe82f52bd
shr ecx, 8
jmp 0x69eed2
xor ecx, ebx
jmp 0x78128f
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x79dbf0]
jmp 0x6959f6
xor eax, edi
mov dword [esp + 4], 0xb089ee11
inc ecx
shr byte [esp + 4], 0xe6
push 0xeb2b6781
dec dword [esp + 2]
xor eax, 0xd7967b15
dec ebp
push 0x830e6c97
push 0xdaa84c0d
lea esp, [esp + 0x14]
jne 0x7b0088
jmp 0x679876
push 0x8d0af0b7
adc esi, 6
shld ebp, eax, cl
not dword [esp]
mov dword [esi], ebp
lea esp, [esp + 4]
jmp fcn.0077ad80
xor ecx, ecx
sal word [esp], 0x4a
test edi, edi
lea esp, [esp + 4]
je 0x7812ae
jmp 0x76f481
push ebx
mov ebx, 0x94130da2
jmp 0x79f0e1
inc eax
push 0xca93d708
xor ecx, 0x9092ea1c
dec edi
lea esp, [esp + 8]
jne 0x76f482
mov ebx, 0x9c95aa84
not ebx
pop ebx
jmp 0x8ebd6b
mov eax, dword [esi + eax - 0xa0dde66]
mov ecx, 0x8b28b35
jl fcn.007b3b31
mov cl, byte [esi + ecx*2 - 0x11651662]
jne 0x6d0dc0
jmp 0x940e6d
movzx ebx, byte [eax]
jmp 0x6a415a
das
invalid
mov edi, 0x32a972a9
inc edi
movzx edi, byte [ecx + edi - 0x32a972aa]
call fcn.007bf245
mov eax, 0xa0dde35
mov ebp, dword [esi + eax*2 - 0x141bbc6a]
shl al, 0xe1
jae 0x7983f5
adc al, 0xdb
cmpsd dword [esi], dword es:[edi]
test cl, ch
jno 0x7b00a0
xchg edx, eax
jb 0x7b011b
sbb al, 0x92
jo 0x7b007b
invalid
mov eax, dword [0xe40aaab4]
aam 0xf6
cmp edi, dword [ecx + 0x6b52a7fd]
bound esi, qword [ebx - 0x2abb3add]
imul edi, ecx, 0xeb79b4aa
cmpsd dword [esi], dword es:[edi]
shr dword [ecx], 1
add bl, byte [esi + 5]
dec ebp
invalid
jmp 0x90f065
not ecx
mov dword [esi], ecx
jmp fcn.0079c77c
shr eax, 8
jmp 0x6c2c8e
mov edi, 0xa9340914
mov eax, dword [esi]
mov edi, dword [esi + 4]
add esi, 4
push 0xfcb28ab8
jmp 0x76d8dd
pop edi
call fcn.0069a666
Function at 0x7c0c28
Capabilities:
Encode data using xor

Disassembly:
add byte [edx - 0x64], dl
mov edx, 0xe63ce380
add dx, 0x7e95
call fcn.0090990f
mov dword [esp], edi
mov edi, 0xb00db2a
lea edi, [edi*4 - 0x2fe15de4]
not edi
push esi
lea edi, [edi + edi*2 + 0xc9c6d08]
push edi
pushfd
pop esi
mov dword [esp + edi*2 - 0x306c8172], esi
call fcn.0075e829
xchg edi, eax
fadd qword [ebx]
push esp
rcr byte ss:[edx + 0x752afc76], 1
loop 0x7c0c16
push 0xc295d23e
and byte [esi + 0x77], dl
enter 0xfffffffffffff84e, 0x54
clc
push esp
mov ebx, 0x3876a62c
jb 0x7c0ce7
sbb edi, dword [edi + 0x45d51780]
adc byte [edi], 0xd5
inc ebp
imul eax, dword [edi - 0x337aa840], 0xffffff98
not byte [edx + ecx]
leave
mov gs, word [edx + 0x3d]
add byte [eax], al
add byte [eax], al
inc eax
xchg edx, eax
stosb byte es:[edi], al
loope 0x7c0c73
xchg esi, eax
cli
mov ch, 0xcd
inc esi
add al, byte [edx + 0x1f63a20e]
jl 0x7c0cfb
sar edi, cl
pop eax
js 0x7c0c68
paddw mm1, qword [esp + eax*2]
sub esi, dword [ebx]
adc al, 0x8f
mov ebx, 0xe5cd4c0
jl 0x7c0d2a
jb 0x7c0ce7
xor eax, 0x3ceb9c97
push ss
xchg byte [eax], bh
jb 0x7c0d33
adc al, 0xc2
or eax, 0xf650c09a
mov esp, 0x33f43276
add dh, byte [edi + 0x63]
pop es
push ebp
invalid
cmp eax, 0
jg 0x7c0cc3
leave
dec esi
push cs
jge 0x7c0d04
pop esi
lodsd eax, dword es:[esi]
jmp 0xe2556365
pop edx
push cs
add dword gs:[esi - 0x16f3215a], edx
mov si, 0x6f0e
ret 0x71ea
mov dl, 0x2c
rol bh, 0xf6
dec eax
push 0xcacc1c6e
out 0xc1, al
xchg esi, eax
in al, dx
cld
adc cl, byte [edi + 0x1990ad83]
adc al, 4
pop ebx
inc edi
push 0xffffffc2
cmpsd dword [esi], dword es:[edi]
mov eax, 0x3a0f203f
sub byte [edx - 0x75], dh
idiv ah
mov ds, word [esi + 0x60]
int3
pushal
inc ebp
out dx, al
fld qword [edi - 0x28cdd882]
add eax, 0xebd4936
stosb byte es:[edi], al
inc eax
xchg esi, eax
adc bl, byte [ecx - 0x44]
xor ch, byte [eax + 0x678dc236]
mov ch, 0x5a
jg 0x7c0d56
dec esp
mov eax, 0xa7719b01
and edx, ebx
invalid
Function at 0x8c356f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6d970f3a
popal
jl 0x674003
lahf
cmpsd dword [esi], dword es:[edi]
fild word [ecx + 0x1f]
rol dword [ecx + 0x21216636], 0x92
mov esi, 0xe2699e9
push cs
movsd dword es:[edi], dword [esi]
and edx, 0x6a3175fe
push ds
movsd dword es:[edi], dword [esi]
int1
xchg byte [esi - 0x3e990675], dl
loop 0x673fa0
mov edi, ecx
shl dx, 0x8a
jae 0x798db2
xor cl, byte [esi + esi + 0x59]
jle 0x67409d
jnp 0x673ff4
sar edi, 1
cmp eax, 0x45521d0b
js 0x674021
invalid
loopne 0x674033
push eax
push ss
popal
push edx
aas
outsb dx, byte [esi]
jecxz 0x673ff0
stosb byte es:[edi], al
adc dword es:[edi + 0x1fa6cdfa], esi
pop ds
hlt
sal byte [ecx - 0x3b76a894], 0x6d
mov cl, 0x6c
push edi
mov esp, eax
insd dword es:[edi], dx
jl 0x6740cb
dec edi
enter 0xffffffffffff9b61, 0x3b
movsb byte es:[edi], byte [esi]
push eax
movsd dword es:[edi], dword [esi]
fsub qword [esi + 0x67]
pushfd
mov eax, dword [0xbe8db366]
pop esi
movsb byte es:[edi], byte [esi]
and ebx, dword [ecx + 0x1a805398]
inc esi
push ebx
sbb byte [edx], 0x46
xor dl, byte fs:[edi]
mov esp, 0x2b75b4b
scasd eax, dword es:[edi]
jae 0x67409a
cdq
fadd dword [edi - 0x42]
sbb eax, 0xada41e49
push es
jo 0x674049
sar dh, 0xb9
adc bh, ah
adc eax, 0x9984ed98
push edx
in al, 0x71
in al, 0x8b
or eax, 0x175e3d90
insd dword es:[edi], dx
das
mov bl, 0x15
cwde
adc eax, 0xf06d8066
stosd dword es:[edi], eax
adc eax, 0x80661598
insd dword es:[edi], dx
invalid
sub byte [ebp - 0x10], 0xab
jne 0x674048
jns 0x67403c
push eax
xchg byte [ebx], ah
idiv byte [eax*4 - 0x75a071b0]
mov ah, 0x51
stc
outsd dx, dword [esi]
jl 0x674068
mov dl, 0xb
invalid
or eax, esi
jecxz 0x6740f4
add al, 0x45
js 0x6740c5
std
sub dh, ah
pop edi
bound ecx, qword [ecx]
dec edi
out dx, al
sbb eax, 0xa2d89923
mov al, byte [ebx]
push edi
cli
xor eax, 0xea1ad15b
jmp 0x674120
or ch, byte [ecx + 0x3cffb0c5]
int 0xcd
or al, 0x7f
push es
popfd
mov ebp, 0xf8cde645
invalid
sysenter
loop 0x6740b5
test byte [eax + 0x3688566d], dh
cmp byte [0xc4d90ae], al
cmp ch, ah
fsubrp st(0)
invalid
dec eax
mov dword [esp], 0x208311a0
call int.007b673e
mov edx, 0x5d3deb2d
mov edi, edx
mov ecx, dword [edi + esi - 0x5d3deb2d]
lea esi, [esi + edx - 0x5d3deb29]
xchg ecx, esi
jmp 0x674010

Function at 0x8f63f7
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x93b8ef02
retf
mov eax, 0x3aa3cb93
lea ebp, [ebp + eax*2 - 0x75479725]
shl ax, 0x21
mov dword [esp + eax*2 - 0x75472e4c], eax
sal eax, 0x38
xor dl, bl
dec al
not ax
dec dl
xor dword [esp + eax*2 - 0x4c01fe00], 0xde9f6c2e
bswap eax
ror dl, 1
call fcn.006a3ec4
frstor dword [edx + edx*2]
jle 0x8f63f4
push esi
xchg esp, eax
inc esp
sub byte [esi + 0x71], 0x40
inc edi
salc
adc byte [edx + 0x57f0dc42], dl
xor byte [edx], 0x22
int3
Function at 0x914027
Capabilities:
Encode data using xor

Disassembly:
movzx ebp, dx
pop edx
js 0x91148c
and al, 0xc9
or esi, dword [eax - 0x1731a12c]
inc esp
stosd dword es:[edi], eax
cld
sahf
call 0xe6eb0626
or cl, ch
lcall 0x6afd, 0xf21e7060
clc
call 0xca8822c9
jo 0x6a7033
or edx, dword [eax - 0x6c2bc7ea]
cmp ah, dl
xchg ebx, eax
les edi, [esi]
scasb al, byte es:[edi]
mov dh, dh
jae 0x6a7030
out dx, al
add eax, 0xf33f740b
jl 0x6a707f
add byte [eax], al
add byte [eax], al
aam 0x67
arpl sp, bp
aam 0xbb
mov dword [0x7334bcd0], eax
xor dword [eax + edx*2], esi
add ecx, dword [edi]
mov al, cl
mov edi, 0x390ecaf
dec edi
les eax, [eax - 0x5f1788d1]
and byte [edx + 0x10], dh
push ss
push ds
lodsd eax, dword [esi]
cmp esi, 0x38e9f596
xor edx, esp
inc ebx
cdq
or dword [edi], ebp
cmp dword [ebx + ebp*8 + 0x71], 0xffffffa1
aaa
fisttp dword [ebp + edi*4 + 0x37cddb0a]
or bl, bl
int 0x37
out 0x79, eax
xchg ebp, eax
lcall 0x8a7d, 0xd15f8f0d
pop ebp
out 0x77, eax
pop ecx
mov ch, 0xa2
xor eax, 0xc5e9a777
cli
invalid
add esi, 4
movzx edx, di
mov dword [esp + edx - 0xbf0a], 0xa21c7e07
mov edi, eax
neg edx
jp 0x6a7001
xchg esp, eax
fistp word [eax]
invalid
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40301c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
invalid
invalid
Function at 0x10001000
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], ecx
xor edi, edi
mov dword [ebp - 4], edx
xor ecx, ecx
nop dword [eax]
mov eax, ecx
mov byte [ebp + ecx - 0x108], cl
cdq
idiv esi
mov al, byte [edx + ebx]
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x10001020
xor esi, esi
xor ebx, ebx
nop dword [eax]
nop word [eax + eax]
mov dl, byte [ebp + esi - 0x108]
movzx eax, byte [ebp + esi - 0x208]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x10001076
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + edi - 0x108], dl
mov byte [ebp + esi - 0x108], al
inc esi
cmp esi, 0x100
jl 0x10001050
xor esi, esi
xor edi, edi
cmp dword [ebp - 4], ebx
jle 0x10001115
nop dword [eax]
inc ebx
and ebx, 0x800000ff
jns 0x100010b1
dec ebx
or ebx, 0xffffff00
inc ebx
movzx eax, byte [ebp + ebx - 0x108]
add esi, eax
and esi, 0x800000ff
jns 0x100010cb
dec esi
or esi, 0xffffff00
inc esi
movzx eax, byte [ebp + ebx - 0x108]
mov dl, byte [ebp + esi - 0x108]
mov byte [ebp + esi - 0x108], al
mov byte [ebp + ebx - 0x108], dl
movzx ecx, byte [ebp + esi - 0x108]
movzx eax, dl
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
xor byte [edi + ecx], al
inc edi
cmp edi, dword [ebp - 4]
jl 0x100010a0
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40333a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409450]
jne 0x403344
repz ret
jmp fcn.00403760

Function at 0x10030e90
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10031054
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
or ebp, 0xffffffff
jmp 0x10030eba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10030ec1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10030eb0
mov eax, 1
add ebx, ebx
jne 0x10030ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10030ec8
jne 0x10030ee4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10030ec8
xor ecx, ecx
sub eax, 3
jb 0x10030ef8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10030f6a
mov ebp, eax
add ebx, ebx
jne 0x10030f03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10030f10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10030f34
inc ecx
add ebx, ebx
jne 0x10030f20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10030f15
jne 0x10030f31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10030f15
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10030f54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10030f45
jmp 0x10030eb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10030f54
add edi, ecx
jmp 0x10030eb6
pop esi
mov edi, esi
mov ecx, 0xcd5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10030f72
cmp byte [edi], 0x11
jne 0x10030f72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10030f77
lea edi, [esi + 0x2d000]
mov eax, dword [edi]
or eax, eax
je 0x10030fe6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3144c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3149c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10030fa4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x314a0]
or eax, eax
je 0x10030fe0
mov dword [ebx], eax
add ebx, 4
jmp 0x10030fc1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10031017
cmp al, 0xef
ja 0x1003100a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10030fec
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10030ff9
mov ebp, dword [esi + 0x314a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1003104b
sub esp, 0xffffff80
jmp 0x100149d4
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x2e5485b
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42cd70
nop
mov ecx, 0x267a6c72
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x409fd8
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [ecx + 0x546e5c6b], 0x6744ac57
lodsb al, byte [esi]
pop edx
mov ch, 2
add ah, byte [edx]
or al, 0x94
add ah, byte [edx]
or al, 0x94
add ecx, ebx
lcall 0xe4ab, 0xbd481d46
adc ebp, eax
xor byte [ebx + edi*8 - 0x6f], bl
push edx
adc al, 0x41
and ebx, dword [ebx + edx*2 + 0x561194be]
mov bh, 0x14
mov esi, 0x59894629
and byte [ecx + 0x9de4d3e], dh
fcmovb st(0), st(2)
push esp
jecxz 0x409fcb
wait
mov esi, 0xeda8c862
test eax, 0xde0f7776
sbb edi, esi
mov ecx, 0x418bbc08
and cl, cl
idiv ch
hlt

Function at 0x427400
Capabilities:
Check for software breakpoints

Disassembly:
call 0x400c2afd
dec ebp
cmp esp, dword [0x24617798]
mov al, byte [eax + 0x647d392b]
in eax, 0x15
cli
aam 0xc9
mov fs, word [edi]
insd dword es:[edi], dx
invalid
imul esp, dword [esi], 0xffffff8b
and esp, dword [edx + 0xd]
invalid
pop ds
outsb dx, byte [esi]
imul esp, dword [eax - 0x20], 0x57
cmp ebx, dword [esi - 0x8f03516]
fidiv dword [eax + 0x6dabe60d]
neg edx
mov al, 0xd
out 0xab, al
stosd dword es:[edi], eax
insd dword es:[edi], dx
popfd
add al, 0xb3
mov eax, dword [0x743af45b]
aad 0x38
jae 0x42746f
jo 0x4273a1
lahf
in eax, dx
jnp 0x4273dd
sal byte [ebp - 0x158f088f], 0x10
imul esp, dword [edx + eax*2 - 0x51], 0x4a
jo 0x427462
aaa
rcl al, cl
push ecx
cmp al, 0x2a
mov ch, 0x42
adc eax, 0xd19ebd9e
mov bh, 0xf2
int1
clc
xchg edx, eax
or eax, 0xee3289b5
or al, 0x76
loope 0x427416
sub al, 0xba
push esi
sbb cl, byte [ebx + 0x62dac56e]
add dh, byte [esi + eax + 0x715dff86]
les edi, [edi]
loope 0x427444
or eax, 0x10ca4c48
loope 0x4273fb
jecxz 0x4273f5
push es
jo 0x427405
cmp eax, 0x79f26fb
retf 0x53c2
sbb eax, 0xa2ea04f3
wait
out dx, al
push esp
mov eax, dword [0x58ae04cd]
into
add byte [ebx], ch
adc al, 0xaa
out 0xc4, al
inc ebp
or eax, 0xc6f5b0fd
sub bl, byte [esp + eax*8]
invalid

Function at 0x4280b0
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
ljmp 0xdb0b
adc al, 0x6b
rcl bl, 0xb7
sub byte [ebx - 0x4f35b90d], bh
std
pop es
lodsd eax, dword [esi]
loop 0x428032
or eax, 0x4a82ebe
xor byte ss:[edx], ah
cmpsb byte [esi], byte es:[edi]
add dword [edx - 0x580a0f8c], esi
inc esp
xchg esp, eax
push edx
and al, 0x90
push 0x2eb39a4d
invalid
insb byte es:[edi], dx
loopne 0x428048
xor byte [esi + 4], ch
dec ebp
sbb al, 0xcf
xchg ebp, eax
inc ecx
and edx, esi
mov ah, 0xc5
mov dword [0x87ef6c6e], eax
cmp edi, esp
mov ah, 0x27
out dx, eax
xchg dword [ecx], edi
out 0xb4, eax
daa
pop esp
xchg edx, eax
aad 0xa4
push ss
mov cl, 0xb0
push ebp
adc byte [esi], dl
mov dword [0x7583df65], eax
xchg ebp, eax
xchg esp, eax
xor byte [esi], 0xe8
lodsd eax, dword [esi]
xchg ebx, eax
cmp esi, eax
rcr dword [edx], cl
jno 0x4280c3
jnp 0x428166
test byte [edx - 0x6a69d7df], ch
xor dword [esi], ebp
and ecx, dword [ecx + 0x5f13890b]
sub edi, edi
movsb byte es:[edi], byte [esi]
mov eax, 0xf4262ca1
in al, 0xa0
xor dword [ebx + 0x5732d90e], ecx
mov bl, bl
mov edx, ecx
invalid
mov esi, 0x8c2a283b
xlatb
sbb cl, byte [ebx + 0x62dadb7c]
cmp ch, byte gs:[ecx + 0x3d456bb0]
inc esp
in al, 0xfa
invalid
Function at 0x43ffc3
Capabilities:
Encode data using xor

Disassembly:
sub dl, bh
psrld mm3, qword [eax]
movsd dword es:[edi], dword [esi]
popal
mov esp, 0xc61b8b76
or al, 0x31
cmc
sub dl, ah
pop ds
invalid

Function at 0x4e5430
Capabilities:
Encode data using xor

Disassembly:
push ds
dec edx
out 0x26, eax
test al, 0x6a
aas
invalid

Function at 0x53dd61
Capabilities:
Encode data using xor

Disassembly:
jb 0x53dd9b
loopne 0x53dd85
lodsb al, byte [esi]
and al, 0x4d
mov ch, 0xd0
add byte [eax - 0x48], 0xf4
jno 0x53dd29
add byte [eax], dh
and ebx, esp
movsd dword es:[edi], dword [esi]
scasd eax, dword es:[edi]
loopne 0x53dd1c
add ch, byte [esi + edx]
vpsubusb ymm2, ymm2, ymmword [ebp + 0x6f]
invalid
push edx
int 0xe7
add eax, 0x5f6fae8
add esi, dword [edi + ebp]
xchg byte [ebx], bl
cwde
jo 0x53ddd0
dec ebx
movsb byte es:[edi], byte [esi]
sal byte [edx], 0xe5
in al, 0xbf
inc eax
mov edx, 0xf72c8f44
mov cl, 0xc
adc al, 0xe1
movsb byte es:[edi], byte [esi]
adc esi, esp
in al, 0x7d
nop
adc al, 0xbf
pop esi
out 0x16, al
arpl word [eax - 0x1fd59be5], di
mov eax, 0xe02a641b
cmpsb byte [esi], byte es:[edi]
js 0x53dd1a
aam 0xb4
sub dword [esi - 0x4b], 0xea402557
jo 0x53ddc6
mov ch, 0x57
and eax, 0x3a70ea40
invalid
pushal
adc dh, byte [eax + esi*2]
outsb dx, byte [esi]
test eax, 0x386b5a21
xchg esp, eax
or dword [ebp + 0x71], ecx
jmp 0x53dd4b
jns 0x53ddef
arpl word [ebx - 0x60], cx
invalid
and bh, ch
rcl byte [esi + esi*4], 0x64
and dword [ebx], edi
push eax
adc eax, 0xf28d34fd
dec ebp
cmp edx, dword [eax - 0x77]
loop 0x53dd79
xchg byte [ecx + edx*4 + 0x203a53fc], al
mov byte fs:[ecx + edx*8], 0x11
xor byte [esi], al
adc dword [eax], esi
push es
xor al, 0x94
jecxz 0x53ddeb
imul ebp, dword [ebp + edi + 0x65], 0xa0cb4460
push edx
jg 0x53de26
mov byte [ebp + 0x22d7e546], ah
test eax, 0x92ac18f3
jl 0x53de6e
aam 0x51
test ebx, esi
and eax, 0xe3d3b752
and byte [edi - 0x6b77ac9a], cl
mov dword [0x23dc5c79], eax
int 0x15
invalid
ficomp word [ebx - 0x2dccf543]
adc ebp, 0x59
aaa
adc al, 0xf2
cmp esi, dword [ebx + 1]
fmul st(4), st(0)
or al, dh
in eax, dx
pop ecx
rcl dword [esp + ebx*2 + 0x77], 0xe5
int 0x9e
popal
test eax, 0xf2f5dc9d
jno 0x53ddf6
xlatb
jmp 0x53de73
cmp eax, 0x3d0d3771
sal byte [edx], 1
or bl, ch
cdq
std
or esi, dword [ecx]
sbb byte [edx], ah
mov dl, byte [ecx]
daa
push ebp
invalid

Function at 0x5b5470
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
lea esp, [ebx + 0x5d]
xchg esi, eax
sub eax, 0xf31e2ef1
adc eax, 0x1fcec03e
scasd eax, dword es:[edi]
add dh, al
shl dword [ecx - 0x63], 1
nop
in al, dx
dec bl
mov ebx, 0xb7a3cdd5
xor eax, 0x6499a5f0
out 0x63, eax
popfd
jb 0x5b54a6
sbb dword [edi + 0x73302df2], 0xffffff98
lea edx, [ecx + 0x4554248e]
or byte [esi + 0x4e], bl
invalid

Function at 0x5babcc
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx + 0x72], eax
add dword [edx], esi
test eax, 0x8782fcd1
sbb al, 0x92
dec esp
lea esp, [0x40d23b7c]
arpl word [0xc1e8754d], bx
jnp fcn.005babcc
pop ebx
call dword [ebp - 0x2285e07d]
push edx
sub eax, 0x5c6e51a1
pop ebp

Function at 0x648bd0
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xa0
dec ebp
enter 0xffffffffffffd966, 0x14
call 0xe09670fd
Function at 0x7cdd90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3a9000]
push edi
jmp 0x7cddaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7cddb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7cdda0
mov eax, 1
add ebx, ebx
jne 0x7cddc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7cddd4
jne 0x7cddf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7cddf3
dec eax
add ebx, ebx
jne 0x7cdde0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7cddb8
add ebx, ebx
jne 0x7cddef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7cde45
xor ecx, ecx
sub eax, 3
jb 0x7cde0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7cde7a
sar eax, 1
mov ebp, eax
jmp 0x7cde16
add ebx, ebx
jne 0x7cde16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7cdde4
inc ecx
add ebx, ebx
jne 0x7cde24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7cdde4
add ebx, ebx
jne 0x7cde31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7cde26
jne 0x7cde42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7cde26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7cde64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7cde56
jmp 0x7cdda6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7cde64
add edi, ecx
jmp 0x7cdda6
pop esi
mov edi, esi
mov ecx, 0x23b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7cde82
cmp byte [edi], 5
jne 0x7cde82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7cde87
lea edi, [esi + 0x3cb000]
mov eax, dword [edi]
or eax, eax
je 0x7cdef6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3d17d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3d1864]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7cdeb4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3d186c]
or eax, eax
je 0x7cdef0
mov dword [ebx], eax
add ebx, 4
jmp 0x7cded1
call dword [esi + 0x3d1868]
mov ebp, dword [esi + 0x3d1870]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7cdf2a
sub esp, 0xffffff80
jmp 0x403340