joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c46d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c46d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x57660e
Capabilities:
Encode data using xor

Disassembly:
adc al, al
pop eax
xor dh, ch
invalid
invalid
rol byte [ebx - 0x2b], 0x67
push edx
dec edx
test ch, ch
dec esi
and eax, 0xf6a11ce0
dec ebp
xlatb
fadd qword [edx]
adc eax, 0x91d1a78e
jb 0x576486
adc byte [esi - 0xfbe4cc5], 0xc3
popfd
xchg esi, eax
cmp esi, dword [ebx - 0x623c0fbf]
dec esi
cmpsb byte [esi], byte es:[edi]
dec esi
or al, 0x22
xor byte [edi + eax*8 + 0x1d], dl
jp 0x5764d6
popal
jo 0x5764f2
xor al, 0xd9
pop ecx
cld
cmc
push eax
frstor dword [ecx + ecx*4]
sal byte cs:[edx - 0x31], 1
jo 0x57651c
rol dword [eax - 0x193e913a], 0xe
xor ebx, dword [eax - 0xa]
mov cs, word [eax + 0x49705a83]
nop
dec edx
mov al, byte [0xa293a3e4]
push ebp
xchg esp, eax
xchg byte [eax - 0x34290a2a], dl
mov eax, 0xbcdbb184
pushal
jb 0x5765c1
mov esp, 0x723e2e60
insb byte es:[edi], dx
loope 0x5765d4
loop 0x5764eb
scasb al, byte es:[edi]
sahf
add edx, dword [ebx + 0x4a]
dec edx
outsb dx, byte [esi]
dec eax
mov edx, 0xe9959251
salc
jg 0x576505
fdiv dword [eax]
sbb eax, eax
adc bl, bl
push eax
cdq
loopne 0x57655e
ror edi, 0xf1
js 0x576599
and dword [eax + 0x35], esi
jo 0x5765af
cwde
xchg esi, eax
xor dword [ebx + 0x38], 0xffffff89
fadd dword [esp + ebx*2 + 6]
lcall 0xfc1, 0x140f044a
jg 0x57654f
pcmpeqd mm0, mm6
movhps xmm2, qword [esp]
movlhps xmm6, xmm7
cmpltps xmm2, xmm6
paddd mm0, mm2
salc
add dword [edi], ecx
inc dl
add edx, 4
add ebp, 4
cvtpi2ps xmm1, mm0
movd esi, mm0
psrlq mm0, 0x20
add edi, 0x10
movd eax, mm0
movmskps ebx, xmm2
cvttps2pi mm0, xmm0
cmp ebx, 0
jne 0x576616
invalid
subps xmm7, xmm1
stc
imul eax, dword [esp + 0x20]
movaps xmm4, xmm7
shufps xmm7, xmm7, 0
shufps xmm4, xmm4, 0x55
shl esi, 4
add esi, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x20]
add eax, esi
movups xmm1, xmmword [esi]
movups xmm2, xmmword [eax]
movups xmm3, xmmword [esi + 0x10]
movups xmm5, xmmword [eax + 0x10]
subps xmm3, xmm1
subps xmm5, xmm2
mulps xmm3, xmm7
mulps xmm5, xmm7
addps xmm3, xmm1
addps xmm5, xmm2
subps xmm5, xmm3
mulps xmm5, xmm4
addps xmm5, xmm3
movlps qword [edi - 0x10], xmm5
add al, 3
je 0x5765fc
sbb al, 3
invalid
pop eax
invalid
movhlps xmm5, xmm5
movss dword [edi - 8], xmm5
sub ecx, 1
jne 0x576577
movaps xmm2, xmm0
movaps xmm7, xmm0
movq mm2, mm0
pcmpeqd mm0, mm6
movhps xmm2, qword [esp]
movlhps xmm6, xmm7
cmpltps xmm2, xmm6
paddd mm0, mm2
cvtpi2ps xmm1, mm0
movd esi, mm0
psrlq mm0, 0x20
movd eax, mm0
movmskps ebx, xmm2
cmp ebx, 0
jne 0x5766a4
subps xmm7, xmm1
movaps xmm4, xmm7
shufps xmm7, xmm7, 0
shufps xmm4, xmm4, 0x55
imul eax, dword [esp + 0x20]
shl esi, 4
add esi, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x20]
add eax, esi
movups xmm1, xmmword [esi]
movups xmm2, xmmword [eax]
movups xmm3, xmmword [esi + 0x10]
movups xmm5, xmmword [eax + 0x10]
subps xmm3, xmm1
subps xmm5, xmm2
mulps xmm3, xmm7
mulps xmm5, xmm7
addps xmm3, xmm1
addps xmm5, xmm2
subps xmm5, xmm3
mulps xmm5, xmm4
addps xmm5, xmm3
movlps qword [edi], xmm5
movhlps xmm5, xmm5
movss dword [edi + 8], xmm5
emms
add esp, 8
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x659a1d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662168
cmp edx, dword [eax]
je 0x659a3f
add eax, 8
inc ecx
cmp eax, 0x6621f8
jl 0x659a30
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662168]
jne 0x659b6d
mov eax, dword [0xa67ab0]
cmp eax, 1
je 0x659b47
test eax, eax
jne 0x659a70
cmp dword [0x662094], 1
je 0x659b47
cmp edx, 0xfc
je 0x659b6d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659aa7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a400
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a890
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659aea
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a890
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65ee6c
push edi
call fcn.0065c760
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a400
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a410
lea eax, [ebp - 0xa0]
push 0x65ee4c
push eax
call fcn.0065a410
push dword [esi + 0x66216c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a410
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065c6d4
add esp, 0x2c
pop edi
jmp 0x659b6d
lea eax, [ebp + 8]
lea esi, [esi + 0x66216c]
push 0
push eax
push dword [esi]
call fcn.0065a890
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x6d11b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006d1140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006d1140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006d1140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006d1140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6d1bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d1c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6e387c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d1c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6d1c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x408926
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x4085d8
add edx, 0x9e55e5bb
inc edx
call fcn.0040894f
xor dword [edi], eax
inc edi
sub ebx, edx
mov ebx, 0x3ad04d1c
cmp edi, esi
jne fcn.00408926
add ebx, 0x3d90eee5
add ebx, edx
ret
Function at 0x4056d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x43c150]
mov eax, dword [0x43594c]
xor ecx, 0x3440e27
push ebx
or ecx, 0x74297100
imul eax, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [0x43594c], eax
xor dword [0x435fa0], 0x372145e3
mov edx, dword [edi + 4]
dec edx
js 0x40571b
mov eax, dword [edi + 8]
lea eax, [eax + edx*4]
mov edi, edi
cmp dword [eax], 0
jne 0x40571b
sub eax, 4
dec edx
jns 0x405710
imul eax, dword [0x43ba08], 0x2fcf4319
mov ebx, dword [ebp + 0xc]
mov dword [0x43ba08], eax
mov esi, dword [ebx + 4]
dec esi
js 0x40574b
mov eax, dword [ebx + 8]
lea eax, [eax + esi*4]
lea esp, [esp]
cmp dword [eax], 0
jne 0x40574b
sub eax, 4
dec esi
jns 0x405740
or dword [0x43761c], 0xc23800c5
test edx, edx
jns 0x405761
test esi, esi
js 0x4058b9
mov ecx, dword [0x43a7a0]
shl ecx, 6
add dword [0x43b200], ecx
cmp edx, esi
jle 0x40577b
mov eax, dword [edi]
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [0x43ae9c]
mov ecx, dword [0x435b98]
add eax, 0xef10d5ac
inc dword [0x435b98]
or ecx, eax
cmp ecx, 0x83f51eda
jle 0x4057aa
imul eax, dword [0x43be5c], 0xfa1cd889
mov dword [0x43be5c], eax
cmp esi, edx
jle 0x4057b7
mov eax, dword [edi]
pop edi
pop esi
neg eax
pop ebx
pop ebp
ret
mov ecx, dword [0x435d68]
movzx eax, word [0x440b84]
and ecx, 0xdb7befd2
or ecx, 0x9b53efd0
add eax, ecx
mov word [0x440b84], ax
cmp dword [edi], 0
jle 0x4057ec
cmp dword [ebx], 0
jge 0x4057ec
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
or dword [0x4373f0], 0x5cb3848
cmp dword [ebx], 0
jle 0x405808
cmp dword [edi], 0
jge 0x405808
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
mov ecx, dword [0x438288]
mov eax, dword [0x435134]
xor ecx, 0x340e532c
imul eax, ecx
mov dword [0x435134], eax
dec dword [0x438288]
test edx, edx
js 0x4058a6
jmp 0x405830
and dword [0x4368a8], 0xbfbb59ff
mov eax, dword [edi + 8]
mov ecx, dword [ebx + 8]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
ja 0x405774
dec dword [0x43d470]
mov ecx, dword [0x43d470]
dec word [0x43da4c]
movzx eax, word [0x43da4c]
add ecx, eax
movzx eax, word [0x4424a6]
or ecx, 0x66ea5a6d
add ecx, eax
mov word [0x4424a6], cx
mov eax, dword [edi + 8]
mov ecx, dword [ebx + 8]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
jb 0x4057ae
mov eax, dword [0x435f40]
sar eax, 5
or eax, 0x158410ed
and dword [0x437be8], eax
dec edx
jns 0x405830
movzx eax, word [0x4423f4]
imul eax, eax, 0x1438481b
mov word [0x4423f4], ax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x405950
Capabilities:
Hash data with md5

Disassembly:
inc dword [0x43c19c]
mov edx, ecx
mov eax, dword [0x43c19c]
and eax, 0xc325ff5e
or eax, 0x3211d1a
xor eax, dword [0x43b2f8]
mov dword [0x43b2f8], eax
mov dword [edx], 0
movzx eax, word [0x43e0ce]
mov ecx, dword [0x43c9f4]
cwde
or ecx, eax
mov word [0x43e0ce], cx
mov ecx, 0xbb147777
dec dword [0x43c9f4]
mov dword [edx + 4], 0
add dword [0x4399e4], 0x340c0ad5
mov dword [edx + 8], 0x67452301
movsx eax, word [0x43ec26]
imul eax, eax, 0x27f13812
sub ecx, eax
add dword [0x439dc8], ecx
mov dword [edx + 0xc], 0xefcdab89
mov eax, dword [0x43959c]
sar eax, 6
mov dword [0x435ac0], eax
mov dword [edx + 0x10], 0x98badcfe
inc word [0x43f318]
movzx eax, word [0x43f318]
cwde
imul eax, eax, 0x8d0ac29d
and eax, 0xdec845d8
cmp eax, 0x3d2bc301
jle 0x405a14
imul eax, dword [0x43a070], 0xefa0c699
mov dword [0x43a070], eax
jmp 0x405a35
mov eax, dword [0x43c6c0]
inc dword [0x43c6c0]
or eax, 0xec0d1147
cmp eax, 0xebfdffff
jge 0x405a35
mov dword [0x4389e0], 0x7138063a
mov dword [edx + 0x14], 0x10325476
mov ecx, 0x7f12200f
mov eax, dword [0x4372b0]
sub ecx, eax
xor ecx, 0xcbe7599
cmp ecx, 0xc94405bd
je 0x405a74
imul eax, dword [0x43b560], 0x204432ad
mov ecx, 0xafc47b79
sub ecx, eax
add dword [0x437cf8], ecx
dec dword [0x43b560]
ret
cmp dword [0x435238], 0xafff9bb7
jl 0x405a8a
xor dword [0x436a84], 0xb7fffdff
ret
Function at 0x4103e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x435da4]
mov eax, dword [0x437d30]
shl eax, 2
sar ecx, 7
sub eax, ecx
add eax, 0x173782e9
cmp eax, 0xf8af4fff
jl 0x410418
mov eax, dword [0x43d660]
add eax, 0xd087522b
xor dword [0x43cdb8], eax
inc dword [0x43d660]
mov eax, dword [0x434198]
mov ecx, dword [0x43abe4]
add eax, 0xcfa15734
add ecx, eax
mov dword [0x434198], ecx
dec dword [0x43abe4]
add dword [0x4370f8], 0x50a308cb
cmp dword [ebp + 8], 0
je 0x4105ab
push esi
push edi
lea edi, [ebp + 8]
nop
inc dword [0x438008]
mov eax, dword [0x438008]
imul ecx, eax, 0xc6aa290b
movzx eax, word [0x440d94]
mov esi, dword [ebp + 8]
and ecx, 0x4457a3d4
add ecx, eax
mov word [0x440d94], cx
cmp dword [esi + 8], 0
je 0x4104d5
and dword [0x43d3c4], 0x27470f8d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
shl eax, 2
push eax
push 0
push dword [esi + 8]
call fcn.00410f40
movzx eax, word [0x4414da]
and eax, 0xc500288
mov word [0x4414da], ax
push dword [esi + 8]
call fcn.00409180
movsx eax, word [0x441d3c]
add esp, 0x10
imul eax, eax, 0x1043fcc7
or dword [0x435628], eax
inc word [0x441d3c]
inc dword [0x438e38]
mov eax, dword [0x438e38]
and eax, 0xacec8cb
imul eax, dword [0x435124]
mov dword [0x435124], eax
mov eax, dword [ebp + 8]
mov dword [eax], 1
add dword [0x43a144], 0x7adb9b5a
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [0x437e98]
shl eax, 0xa
sub eax, 0x3fba5a21
or eax, 0xa2cfd35d
sub dword [0x436c00], eax
mov dword [esi + 8], 0
mov eax, dword [0x43559c]
sar eax, 3
or eax, 0x95c8de38
cmp eax, 0xf2ab9fff
jl 0x41057e
cmp dword [0x43ad64], 0x3dffd2be
je 0x410560
inc dword [0x439070]
mov eax, dword [0x439070]
mov word [0x43e7fe], ax
jmp 0x41057e
dec dword [0x437518]
mov ecx, 0xc5492a1
mov eax, dword [0x437518]
sub ecx, eax
add ecx, dword [0x43b600]
mov dword [0x43b600], ecx
mov eax, dword [edi + 4]
add edi, 4
mov dword [ebp + 8], eax
mov eax, dword [0x439164]
mov ecx, dword [0x438124]
add eax, 0x28db5681
or ecx, eax
cmp dword [ebp + 8], 0
mov dword [0x434abc], ecx
jne 0x410450
pop edi
pop esi
movzx eax, word [0x43ef9e]
mov ecx, 0x40af2a19
imul eax, eax, 0x2d21b2d2
mov word [0x43ef9e], ax
mov eax, dword [0x43c9b4]
sub ecx, eax
inc dword [0x43c9b4]
cmp ecx, 0xba974d70
je 0x41060f
mov ecx, dword [0x439be0]
mov eax, dword [0x43ce58]
not ecx
and eax, ecx
cmp eax, 0xf85722f3
jl 0x41060f
mov ecx, dword [0x43d8b4]
movzx eax, word [0x44110e]
sub ecx, 0x2eaa9f5d
and ecx, 0xe61fda4d
sub eax, ecx
mov word [0x44110e], ax
pop ebp
ret
Function at 0x412990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x439dfc]
sub esp, 8
movsx ecx, word [0x442270]
add eax, 0xa1bf06d5
not ecx
xor ecx, eax
cmp ecx, 0xd05ac36
je 0x4129c0
mov eax, dword [0x43d728]
shl eax, 5
mov dword [0x436864], eax
mov eax, dword [0x4387a8]
push esi
sub eax, 0x44549620
push edi
or eax, 0x67fcb61e
sub dword [0x43a32c], eax
push 0
call fcn.0040c940
add dword [0x434d04], 0xa5810
add esp, 4
cmp dword [0x442720], 0
mov esi, eax
mov edi, edx
jne 0x412ac8
cmp dword [0x442f38], 0
jne 0x412ac8
mov ecx, dword [0x438dc0]
mov eax, dword [0x437318]
add eax, 0x2fe189b3
add eax, ecx
push 0
mov dword [0x437318], eax
call fcn.0040c940
add esp, 4
sub eax, esi
sbb edx, edi
test edx, edx
jg 0x412aa2
jl 0x412a40
test eax, eax
jae 0x412aa2
jmp 0x412a40
movsx eax, word [0x440338]
movsx ecx, word [0x4402b2]
and eax, 0x5a2e3879
xor ecx, eax
mov eax, dword [0x43a2e8]
xor eax, ecx
mov word [0x4402b2], ax
inc dword [0x43a2e8]
push 0x3e8
call dword [0x443140]
mov eax, dword [0x437bf8]
or eax, 0xcef7f7fa
mov word [0x44120c], ax
inc dword [0x437bf8]
push 0
call fcn.0040c940
add esp, 4
sub eax, esi
sbb edx, edi
mov dword [ebp - 4], edx
js 0x412a40
jg 0x412aa2
test eax, eax
jb 0x412a40
mov ecx, dword [0x435ed0]
mov eax, dword [0x43bae8]
not ecx
or ecx, 0xf3ffcff9
add eax, 0x24f0e57
cmp eax, ecx
jne 0x412ac8
mov dword [0x438e50], 0xb6d2fffa
add dword [0x434f68], 0x5111da9c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4213b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x434f6c]
movzx eax, word [0x4417cc]
shl ecx, 0xa
imul eax, ecx
push ebx
push esi
push edi
xor edi, edi
mov word [0x4417cc], ax
inc dword [0x435b90]
mov ecx, dword [0x435b90]
mov eax, dword [0x434a58]
and ecx, 0xb4f8501d
or ecx, eax
and dword [0x43ca4c], ecx
cmp dword [0x43d82c], 0x1500400
jg 0x421406
or dword [0x43a308], 0x180223a3
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
test ebx, ebx
jle 0x4215ab
add dword [0x43c9e0], 0x1fe795ff
and dword [0x436474], 0x5d8bc4ac
movzx eax, word [0x4403ea]
imul eax, eax, 0xcd6d6fdd
push 0
push dword [ebp + 0x14]
push 0
mov word [0x4403ea], ax
mov ecx, dword [0x435d7c]
mov eax, dword [0x438210]
sub ecx, 0x66d8dcd4
or ecx, 0x53c6f846
imul eax, ecx
mov dword [0x438210], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.0040f680
add dword [0x43a4b4], 0x49588829
or dword [0x435de0], 0xe79db328
xor dword [0x435268], 0x54ff32f0
add dword [0x4382b8], 0xf4d69800
lea ecx, [eax + edi]
add dword [ebp + 0xc], 4
cmp ecx, edi
sbb edi, edi
or dword [0x4353c4], 0xf3d689bf
add ecx, dword [esi]
neg edi
mov eax, dword [0x4392a8]
add edi, edx
inc dword [0x4392a8]
mov dword [ebp + 0x10], ecx
cmp eax, 0x48a0248
jle 0x4214d3
mov eax, dword [0x43ba70]
sar eax, 3
or dword [0x437764], eax
jmp 0x4214e9
mov eax, dword [0x43b654]
and eax, dword [0x43b608]
mov dword [0x43b608], eax
dec dword [0x43b654]
cmp ecx, dword [esi]
mov ecx, dword [0x436000]
sbb eax, eax
not ecx
neg eax
add edi, eax
mov eax, dword [0x43d52c]
not eax
add eax, ecx
or eax, 0x20c95af
cmp eax, 0x873870
jg 0x421557
movsx eax, word [0x44211c]
dec word [0x44211c]
cmp eax, 0x9a904183
jne 0x421547
mov ax, word [0x4414bc]
mov ecx, dword [0x4346c0]
cwde
imul ecx, eax
imul eax, ecx, 0x558b226d
mov dword [0x4346c0], eax
dec word [0x4414bc]
jmp 0x421557
movsx eax, word [0x44172e]
sar eax, 3
add dword [0x438cb8], eax
mov eax, dword [0x437964]
mov ecx, 0xc7919248
sub ecx, eax
cmp ecx, 0x4c127444
jg 0x42157e
inc word [0x43e2ba]
mov ax, word [0x43e2ba]
cwde
mov dword [0x43caa0], eax
mov eax, dword [ebp + 0x10]
dec ebx
mov dword [esi], eax
add esi, 4
and dword [0x43c534], 0x715c4e94
movzx eax, word [0x44082c]
add eax, 0x58100241
mov word [0x44082c], ax
test ebx, ebx
jg 0x421414
movzx eax, word [0x440854]
or eax, 0xedaadbda
mov word [0x440854], ax
or dword [0x4388d0], 0xb2cc3a5e
jmp 0x4215d0
inc dword [0x4394f4]
lea esi, [esi + 4]
mov eax, dword [0x4394f4]
movzx ecx, word [0x43de34]
and ecx, eax
mov word [0x43de34], cx
add dword [esi - 4], edi
movzx eax, word [0x4421d8]
or eax, 0xfbffffdf
mov word [0x4421d8], ax
cmp dword [esi - 4], edi
sbb edi, edi
xor dword [0x4356a8], 0x854523e2
mov ecx, dword [0x4358e0]
mov eax, dword [0x43a694]
shl ecx, 6
imul eax, ecx
neg edi
mov dword [0x43a694], eax
jne 0x4215d0
pop edi
pop esi
mov dword [0x43b37c], 0xe6f08c88
pop ebx
pop ebp
ret
Function at 0x4277a0
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [0x441734]
movsx edx, ax
mov eax, dword [0x439550]
sub edx, eax
sub edx, 0x67ce8585
push esi
mov word [0x441734], dx
mov esi, ecx
call fcn.0040cbd0
movsx eax, word [0x442090]
and eax, 0x5ee03cbc
xor eax, 0xef4e06d5
cmp eax, 0x5e1155df
jl 0x4277fe
mov eax, dword [0x43d914]
dec dword [0x43d914]
cmp eax, 0xeffcf5ef
jle 0x4277fe
imul eax, dword [0x43d97c], 0x6ebba8c1
mov dword [0x43d97c], eax
cmp dword [esi + 0x18], 0
jne 0x427836
movzx eax, word [0x43ff72]
xor eax, 0x902c0002
mov word [0x43ff72], ax
call fcn.00408520
mov dword [esi + 0x18], eax
movzx eax, word [0x43ee42]
xor eax, 0x46c5cbaf
mov word [0x43ee42], ax
cmp dword [esi + 0x18], 0
je 0x427804
mov eax, dword [0x43d864]
shl eax, 6
sub dword [0x438ca8], eax
pop esi
ret
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x534262c7
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x52ab7567
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
mov ecx, 0x376835f6
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x31f404d5
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219