joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e49a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x728e10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x742014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x7430ec
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.006f80c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x742a8c
push eax
call fcn.006f80c0
mov esi, dword [0x7430fc]
xor ebx, ebx
mov edi, dword [0x743100]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x746390], bl
mov eax, ebx
mov ecx, 0x7430ec
cmovae ecx, dword [0x7430ec]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x7464a0], al
inc ebx
cmp ebx, 0x100
jl 0x6e4a20
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x746390]
movzx eax, byte [esi + 0x7464a0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x6e4a74
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x746390]
mov byte [esi + 0x746390], al
inc esi
mov byte [edi + 0x746390], dl
cmp esi, 0x100
jl 0x6e4a50
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.006e4690
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x6e4ac9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x6e4abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6e4b1f
push edx
push ecx
call fcn.006fd663
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x6e4b0b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x6e4b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6e4b1f
push edx
push ecx
call fcn.006fd663
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00716c6a
int3
Function at 0x6e70a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x742014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x4de026b
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x6e7289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x6e7289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.007140f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x4de0387
nop
test eax, eax
je 0x6e7289
push 4
push 0x1000
push 4
push 0
call 0x4dd0eb5
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x4dc0006
nop
test eax, eax
je 0x6e7289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x738df8
push dword [esp + 0x30]
call 0x4dc0315
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x6e71ac
push 0x738dfc
push 0x738e14
call 0x4dd0b02
nop
push eax
call 0x4dc00bf
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x4dc020b
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x6e7289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x4de0107
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x6e7243
mov dword [esp + 0xc], eax
call fcn.006e6ef0
push eax
call 0x4dd0a3b
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x4de0107
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x6e71f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x4de0107
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x4dc0387
nop
push dword [esp + 0x24]
call 0x4dd0c14
nop
push 0x8000
push 0
push esi
call 0x4de0000
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.006fcff1
mov esp, ebp
pop ebp
ret
Function at 0x6eaf20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x729726
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x742014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x414], ebx
push 0
mov dword [ebp - 0x414], ebx
call fcn.00718b63
push eax
call fcn.00716660
add esp, 8
call fcn.0071663f
cdq
mov ecx, 0x3313
idiv ecx
mov edi, edx
call fcn.0071663f
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
imul esi, edi
call fcn.0071663f
imul edx, eax, 0x4d
lea ecx, [ebp - 0x444]
add edx, 0x64
add edx, esi
call fcn.006e45b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x444]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x6eafd0
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x6eafe6
push 0x40
push 0
push 0x748560
sub esi, ecx
call fcn.007140f0
add esp, 0xc
mov dword [0x748554], 0
mov edx, esi
mov dword [0x748550], 0
lea ecx, [ebp - 0x410]
mov dword [0x748540], 0x67452301
mov dword [0x748544], 0xefcdab89
mov dword [0x748548], 0x98badcfe
mov dword [0x74854c], 0x10325476
call fcn.006e5530
call fcn.006e55f0
mov ecx, 0x7465a0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x6eb071
sub ecx, edx
push ecx
push 0x7465a0
lea ecx, [ebp - 0x42c]
call fcn.006f80c0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x6eb0cc
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x6eb0c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6eb18c
push edx
push ecx
call fcn.006fd663
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
cmp eax, 1
jb 0x6eb187
dec eax
mov ecx, 0xa
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push ecx
inc eax
mov ecx, ebx
push eax
call fcn.006f80c0
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0x6eb169
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x6eb15f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6eb18c
push edx
push ecx
call fcn.006fd663
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006fcff1
mov esp, ebp
pop ebp
ret
call fcn.006f8200
call fcn.00716c6a
int3
Function at 0x6fdcc7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0x4e00000
nop
test eax, eax
je 0x6fdd07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6fdd07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6fdd07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x6fdd07
cmp dword [ecx + 0x74], 0xe
jbe 0x6fdd07
cmp dword [ecx + 0xe8], 0
je 0x6fdd07
mov al, 1
ret
xor al, al
ret

Function at 0x9bf211
Capabilities:
Encode data using xor

Disassembly:
mov edx, ebx
pop edi
add edx, 0xea4a189
sti
add edi, 0xe83a
movsx edx, cx
xor esi, esi
mov bx, 0xb524
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x406fa0
Capabilities:
Set socket configuration

Disassembly:
and eax, 0xec83dd8b
and al, 0x70
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
aaa
mov dword [ebp - 0xc], esi
jne 0x406fba
mov esi, str.0.0.0.0
mov al, byte [esi]
xor byte [eax], 0xf
invalid

Function at 0x4080f0
Capabilities:
Encode data using xor

Disassembly:
invalid
and byte [esi*8 + 0x3b47f888], al
invalid
jbe 0x408053
fnstsw word [ecx + 0x3b50538d]
jb 0x4080a0
pop edi
mov byte [ebx - 0x3f], 0x60
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dl, byte [esi]
cmp byte [ebp - 0x80], ch
ret 0x205
push ebp
mov ebp, esp
je 0x40813a
or al, 0x8b
dec ebp
or byte [ebx + 0x56], dl
jecxz 0x408088
jge 0x408080
test eax, eax
mov esi, edi
je 0x408110
mov eax, dword [ebp + 0x10]
jo 0x40810a
add byte [eax], al
add byte [eax], al
jmp 0x408181
mov edx, dword [ebp - 0x22]
xor eax, eax
test ecx, ecx
pcmpeqd mm0, mm0
test eax, eax
out dx, eax
add dh, byte [edx + eax - 9]
fnstcw word [eax - 0x33333333]
mov eax, 0xcccccccd
mov bl, 0xa
not ecx
shr edx, 3
mov al, dl
dec esi
fsubp st(3)
sub cl, al
add cl, 0x30
stc
push cs
mov ecx, edx
test edx, edx
jne 0x408122
mov eax, dword [ebp + 0x18]
sub ebp, dword [ebx - 0x24]
cmp bh, cl
invalid
sti
invalid
push es
and eax, 0xfb81087f
add byte [eax], al
add dh, bh
jb 0x4081a8
test ecx, ecx
cmc
sbb ecx, dword [ebx + 0x558b1c45]
sbb al, 0x8b
push ebp
adc al, 0x50
push edi
fcom qword [ecx - 7]
call int.004011f0
and dword [eax + 0x5d5b5f17], 0xffffffc3
test ecx, ecx
je 0x4081e8
mov esi, dword [edx]
jb 0x408177
jbe 0x408193
add byte [eax], al
add bl, ch
and eax, dword [ebp + 0x310d7fc0]
add al, 0x85
mov eax, 0x1b90773
add byte [eax], al
add bl, ch
add bh, byte [esi + 0x145542c9]
test dword [eax + 0x9748989], edi
neg ebx
add dword [eax + eax], 0xfffffff7
fcom dword [esi + 0x6a]
add byte [edx + 0xa], ch
push 0
push 0xa
invalid
mov esi, edx
mov al, cl
mov dl, 0xae
imul dl
sub bl, al
dec edi
add bl, 0x30
mov eax, esi
scasb al, byte es:[edi]
pop ds
mov ebx, ecx
or ecx, esi
jne 0x4081db
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
sub eax, edi
inc ebp
mov bh, 1
mov eax, edi
pop edi
pop ebx
pop ebp
ret

Function at 0x4086f9
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add esp, 0xc
cmp al, 0xc2
or al, 0
cmp eax, 0x158b8
jge 0x408724
push eax
call fcn.004087a0
mov ecx, dword [ebp + 0xc]
push eax
movsd dword es:[edi], dword [esi]
inc ebp
adc byte [eax + 0x51], dl
call 0x908780
add dword [ecx], 0x10
add dword [eax], edx
pop ebp
invalid
cmp eax, 0xa3930
jle 0x40871e
mov edx, dword [ebp - 0x28]
mov eax, dword [ecx + 0xc]
push 0x40a954
push edx
push eax
call fcn.00408824
add esp, 0xfffffffd
pop ebp
ret 0x32
Function at 0x3f2e02
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x3f10d8
call fcn.003f2fa0
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x3f2e3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x3f2e3d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x3f2e55
cmp eax, 0x20b
je 0x3f2e42
mov dword [ebp - 0x1c], edi
jmp 0x3f2e69
cmp dword [ecx + 0x84], 0xe
jbe 0x3f2e3d
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x3f2e63
cmp dword [ecx + 0x74], 0xe
jbe 0x3f2e3d
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x3f4058], 0xffffffff
or dword [0x3f405c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x3f4054]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x3f4050]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x3f4060], eax
call fcn.003f2f9a
cmp dword [0x3f4024], edi
jne 0x3f2ec4
push fcn.003f2f9a
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.003f2f88
push 0x3f10d0
push 0x3f10cc
call sub.msvcrt.dll__initterm
mov eax, dword [0x3f404c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x3f4048]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x3f10c8
push 0x3f10b8
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.003f1aa5
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x3f2f3b
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x3f2f70
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.003f2fd9
ret
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x42e000
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x1fba3253
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x659b02d1
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4bbad0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6f000]
push edi
jmp 0x4bbaea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4bbaf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bbae0
mov eax, 1
add ebx, ebx
jne 0x4bbb03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4bbb14
jne 0x4bbb33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bbb33
dec eax
add ebx, ebx
jne 0x4bbb20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4bbaf8
add ebx, ebx
jne 0x4bbb2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4bbb85
xor ecx, ecx
sub eax, 3
jb 0x4bbb4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4bbbba
sar eax, 1
mov ebp, eax
jmp 0x4bbb56
add ebx, ebx
jne 0x4bbb56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bbb24
inc ecx
add ebx, ebx
jne 0x4bbb64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bbb24
add ebx, ebx
jne 0x4bbb71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4bbb66
jne 0x4bbb82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4bbb66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4bbba4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4bbb96
jmp 0x4bbae6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4bbba4
add edi, ecx
jmp 0x4bbae6
pop esi
mov edi, esi
mov ecx, 0x1882
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4bbbc2
cmp byte [edi], 0x13
jne 0x4bbbc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4bbbc7
lea edi, [esi + 0xb8000]
mov eax, dword [edi]
or eax, eax
je 0x4bbc3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbd37c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbd4a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4bbbf4
mov ecx, edi
jns 0x4bbc23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbd4ac]
or eax, eax
je 0x4bbc39
mov dword [ebx], eax
add ebx, 4
jmp 0x4bbc11
call dword [esi + 0xbd4bc]
mov ebp, dword [esi + 0xbd4b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4bbc73
sub esp, 0xffffff80
jmp 0x409ebc
Function at 0x405ab6
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x405af1
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x405ad8
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x405ae9
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x405af3
inc edi
add eax, 0x28
cmp edi, esi
jb 0x405ace
xor eax, eax
pop edi
pop esi
ret

Function at 0x405c87
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc dword [edi - 0x46], 0x47b70fbb
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.00405a76
push 0x66938213
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x405cd0
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x405cca
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x405cbb
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00405a76
add dl, ah
xor eax, 0xa8458d36
push eax
call fcn.00405a86
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00405a3b
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x405d64
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00405a76
push cs
int1
dec ecx
adc al, 0x8d
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x407410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx - 0x6fb5b]
inc dword [eax]
push 1
pop eax
test eax, eax
je 0x407b1c
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x4075f1
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
invalid
invalid
invalid
clc
invalid
invalid