joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6cf0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x1180458]
push ebx
push esi
mov edx, dword [ecx + 0xc4]
mov ecx, dword [esp + 0x10]
lea eax, [eax + eax*2]
xor esi, esi
mov dword [ecx + 8], esi
mov dword [ecx + 4], esi
lea ebx, [edx + eax*8]
mov dword [ecx], esi
cmp dword [ebx + 8], esi
jle 0x4a6de6
push edi
mov edi, dword [0x1180458]
mov eax, dword [ebx + 0xc]
add eax, esi
mov edx, dword [edi + 0xbc]
mov eax, dword [edx + eax*4]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [edi + 0xb4]
mov edi, dword [edi + 0xa4]
inc esi
lea eax, [edx + eax*8]
mov edx, dword [eax]
lea edx, [edx + edx*2]
fld dword [edi + edx*4]
fadd dword [ecx]
fstp dword [ecx]
mov edx, dword [eax]
mov edi, dword [0x1180458]
mov edi, dword [edi + 0xa4]
lea edx, [edx + edx*2]
fld dword [edi + edx*4 + 4]
fadd dword [ecx + 4]
fstp dword [ecx + 4]
mov edx, dword [eax]
mov edi, dword [0x1180458]
mov edi, dword [edi + 0xa4]
lea edx, [edx + edx*2]
fld dword [edi + edx*4 + 8]
fadd dword [ecx + 8]
fstp dword [ecx + 8]
mov edx, dword [eax + 4]
mov edi, dword [0x1180458]
mov edi, dword [edi + 0xa4]
lea edx, [edx + edx*2]
fld dword [edi + edx*4]
fadd dword [ecx]
fstp dword [ecx]
mov edx, dword [eax + 4]
mov edi, dword [0x1180458]
mov edi, dword [edi + 0xa4]
lea edx, [edx + edx*2]
fld dword [edi + edx*4 + 4]
fadd dword [ecx + 4]
fstp dword [ecx + 4]
mov eax, dword [eax + 4]
mov edx, dword [0x1180458]
mov edx, dword [edx + 0xa4]
lea eax, [eax + eax*2]
fld dword [edx + eax*4 + 8]
fadd dword [ecx + 8]
fstp dword [ecx + 8]
cmp esi, dword [ebx + 8]
jl 0x4a6d20
pop edi
fild dword [ebx + 8]
pop esi
pop ebx
fdivr qword [0x4d73c0]
fld st(0)
fmul dword [ecx]
fstp dword [ecx]
fld st(0)
fmul dword [ecx + 4]
fstp dword [ecx + 4]
fmul dword [ecx + 8]
fstp dword [ecx + 8]
ret
Function at 0x4b2200
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor ecx, ecx
test edi, edi
jle 0x4b2224
push esi
mov esi, dword [esp + 0xc]
mov al, cl
mov dl, 0x77
imul dl
mov dl, byte [ecx + esi]
xor dl, al
mov byte [ecx + esi], dl
inc ecx
cmp ecx, edi
jl 0x4b2210
pop esi
pop edi
ret

Function at 0x4bb450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d5fe9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor ebx, ebx
push 1
push 1
mov dword [esp + 0x1c], esi
mov dword [esi], ebx
call fcn.004c0bd0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov byte [ecx], bl
lea edi, [esi + 4]
mov eax, 0x10
mov dword [esp + 0x20], ebx
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
lea ebp, [esi + 0x14]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ebx
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov eax, dword [edi]
mov byte [esp + 0x20], 3
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x4bb4e9
mov edx, dword [esi + 0x10]
mov eax, dword [esp + 0x10]
mov ecx, dword [edx + eax*4]
push ecx
call fcn.004c4efc
mov eax, dword [esp + 0x14]
mov ecx, dword [edi]
add esp, 4
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x4bb4c7
mov ecx, edi
call fcn.004bfdf0
mov eax, dword [ebp]
xor edi, edi
cmp eax, ebx
jle 0x4bb510
mov edx, dword [esi + 0x20]
mov eax, dword [edx + edi*4]
push eax
call fcn.004c4efc
mov eax, dword [ebp]
add esp, 4
inc edi
cmp edi, eax
jl 0x4bb4f9
mov ecx, ebp
call fcn.004bfdf0
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x4bb527
push eax
call fcn.004c4efc
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov eax, 0x3f800000
mov dword [esi + 0x34], ebx
mov byte [esi + 0x6d], 1
mov dword [esi + 0x70], ebx
mov dword [esi + 0x68], 0x3ccccccd
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0x3f000000
mov dword [esi + 0x40], ebx
mov dword [esi + 0x50], 0x3f333333
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4cc8b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4fe478
cmp edx, dword [eax]
je 0x4cc8d3
add eax, 8
inc ecx
cmp eax, 0x4fe508
jl 0x4cc8c4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4fe478]
jne 0x4cca01
mov eax, dword [0xb86884]
cmp eax, 1
je 0x4cc9db
test eax, eax
jne 0x4cc904
cmp dword [0x4fb904], 1
je 0x4cc9db
cmp edx, 0xfc
je 0x4cca01
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4cc93b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004cc180
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c8e30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4cc97e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c8e30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4ebb64
push edi
call fcn.004c2630
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004cc180
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004cc190
lea eax, [ebp - 0xa0]
push 0x4d8bd4
push eax
call fcn.004cc190
push dword [esi + 0x4fe47c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004cc190
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004d177f
add esp, 0x2c
pop edi
jmp 0x4cca01
lea eax, [ebp + 8]
lea esi, [esi + 0x4fe47c]
push 0
push eax
push dword [esi]
call fcn.004c8e30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x405a73
Capabilities:
Encode data using xor

Disassembly:
adc ecx, dword [ebx]
sub ebx, dword [ebx]
adc dword [edx], ecx
adc dword [ebx], ecx
lcall 8, 0x7b020513
add byte [ecx + edx], al
add al, 0x11
add eax, 0x306f
or ah, byte [esi]
adc dword [ebx], ecx
pop ss
pop eax
adc ecx, dword [ebx]
adc dword [ebx], ecx
adc dword [edx], ecx
mov gs, word [ecx + 0x32]
fnstsw word [eax]
mov eax, dword [0x8000000]
jb 0x405a83
push es
add byte [eax + 0x17], dh
outsd dx, dword [esi]
and eax, 0x390a0000
nop
add byte [eax], al
add byte [eax], cl
or byte [edi], bl
cmp ch, byte [edi + 0x26]
add byte [eax], al
or dl, byte [edi]
pop eax
outsd dx, dword [esi]
and al, 0
add byte [edx], cl
adc eax, dword [esi]
adc dword [esi], eax
jb 0x405aa3
push es
add byte [eax + 0x6f], dh
add byte cs:[eax], al
or dl, byte [edi]
outsd dx, dword [esi]
das
add byte [eax], al
or dl, byte [ebx]
pop es
adc dword [edi], eax
adc ecx, dword [esi + edx]
adc ecx, dword [0xc11202b]
adc dword [0x208139a], ecx
jnp 0x405af2
add byte [eax], al
add al, 0x11
or byte [edi + 0x31], ch
add byte [eax], al
or ch, byte [edi + 0x30]
add byte [eax], al
or ah, byte [esi]
adc dword [0xd135817], ecx
adc dword [0x698e0c11], ecx
xor bl, al
sub esi, dword [edi]
pop es
adc dword [esi + ecx*4], ecx
imul esi, dword [edx], 0x7372bd8
jb 0x405b01
push es
add byte [eax + 0x6f], dh
jo 0x405b7f
xor al, byte [eax]
add byte [edx], cl
sub al, 0x28
pop es
jb 0x405b0e
push es
add byte [eax + 0x6f], dh
add byte cs:[eax], al
or bl, byte [eax]
outsd dx, dword [esi]
xor eax, dword [eax]
add byte [edx], cl
adc ecx, dword [ecx]
add bh, byte [ebx + 0xa]
add byte [eax], al
add al, 0x11
or dword [esi], edx
lcall 0x346f, 0x9a170911
add byte [eax], al
or ch, byte [ebx]
add dl, byte [esi]
sub al, byte [esi]
pop ss
pop eax
or al, byte [esi]
add ecx, dword [esi - 0x29ac097]
invalid
add byte [eax + 0x28], dh
sbb byte [eax], al
add byte [edx], cl
jge 0x405b95
or ch, byte [0xd7b020c]

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, reloc.shlwapi.dll_PathCombineA
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x410a52
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x438ccd
call fcn.0042412a
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x410a77
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x410abd
lea ecx, [ebp - 0x10]
call fcn.00403180
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409c98
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401a30
mov eax, esi
call fcn.00424202
ret 8

Function at 0x422396
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4495f8]
jne 0x4223a0
repz ret
jmp fcn.00428c3c
Function at 0x489789
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esi + 0x51a99c5b], ebx
pushfd
pop es
pop es
jmp dword [ebp + 0x7a27b580]
and dh, al
or eax, 0xc627bed5
and dword [edx], 0x6e77e09d
sub al, 0xe2
mov ebx, esp
popfd
loope 0x4896de
repne stosd dword es:[edi], eax
rol byte [edi + 0x78f785f3], 0x14
retf 0x4848
xor edx, ebx
inc edi
adc byte [edx - 0x51a1d0b], dh
salc
mov eax, dword ds:[0x3002832d]
inc ebx
or dword [ecx + 0x3d3d2fae], edi
jne 0x489715
bound edx, qword [ebx + 0x319f4ceb]
xchg edi, eax
movsd dword es:[edi], dword [esi]
pop es
lodsd eax, dword [esi]
cmp bl, ah
insd dword es:[edi], dx
arpl word [ebp + 0x5b01e5ef], sp
xor al, 0xa7
xor al, 0x9a
jo 0x4897d7
xchg ebx, eax
jmp 0x4897e2
stosb byte es:[edi], al
popfd
add al, 0x2c
stosb byte es:[edi], al
aaa
jae 0x4897e8
or ebx, dword [ebx - 0x7c]
dec edx
and al, 0xb0
xlatb
ja 0x489814
test esi, esi
dec esp
mov dl, 0x9b
enter 0x54fd, 0x23
pop es
wait
in eax, 0x50
daa
jg 0x489793
daa
dec esi
xor al, dl
out 0x77, al
cmp eax, 0xfc545a12
cld
mov bl, 0x3a
scasb al, byte es:[edi]
rcr al, 0xf1
push eax
push es
jle 0x489779
in al, 0x85
arpl word [edi - 0xb2b048e], dx
sti
aam 0xf4
dec esp
or eax, 0x730bd953
jp 0x4897d7
in eax, 0x8d
cmpsb byte [esi], byte es:[edi]
dec dx
daa
in eax, 0x83
in al, 0xf4
xchg ebx, eax
mov ecx, 0x21adc426
xchg dword [edi - 0x1a], esp
enter 0x2173, 0x62
cmc
pop edx
pop ds
add eax, 0xffd81465
push esp
into
push ebx
pop edx
xor al, 0xa0
lds esp, [edx - 0x59]
inc edx
in al, 0x7d
jecxz 0x489815
mov dl, 0xa5
xchg eax, eax
mov byte [0xac877e8d], al
inc dword [ebx]
xlatb
sbb al, 0x95
jo 0x489821
test al, 0x70
mov ebx, 0x7347f1ba
daa
jecxz 0x4898a0
inc ecx
jo 0x4897eb
add eax, esi
out 0x98, eax
shl dword [edx - 0x5a2b251a], 1
out 0xda, al
aam 0xa5
mov dh, 0x15
add al, dh
mov dl, 0x3a
adc eax, 0x746255b6
xor al, 0x95
adc dl, byte [ebx - 0x10cf9d5d]
leave
je 0x489833
adc eax, 0x4bb3dfc9
and edi, dword [ebp + 0x35950f0f]
ficom dword [edx]
pop ds
out 0x84, eax
jne 0x4898c1
xchg ecx, eax
jl 0x489844
pop ecx
lcall 0xec65, 0x77629234
jg 0x4898f5
or bl, ch
sbb al, byte fs:[ebx + 0x22]
cmp eax, 0x556a4c22
imul dword [ebx + 0x359a9287]
or cl, byte [edi + 0x7f36416]
salc
add eax, 0x4fa03b32
sal byte [0x551f0b8e], 0x50
push ebp
push eax
sub edx, 0x7c858a6
out dx, eax
pop eax
and byte [edx + 0x30], bh
add eax, 0xe644226c
ret 0xda26
enter 0x7625, 0x63
sbb al, 0x47
xchg dword [esi], edi
pop esp
and dword [esi - 0x39], ebx
popfd
jp 0x489917
xchg ebp, eax
or al, 0x2d
retf 0x48d3
xchg ebx, eax
out 0x66, eax
mov ch, 0x6a
invalid
or eax, 0xcd349aac
mov byte [0xa55164e4], al
lcall 0x5164, 0xe4a2cd34
movsd dword es:[edi], dword [esi]
loopne 0x489915
xchg esp, eax
mov ah, 0x68
int 0xcc
hlt
Function at 0x4a2d32
Capabilities:
Encode data using xor

Disassembly:
dec esp
daa
fmul qword [ebx - 0x57cc981f]
rcr dword [esi + esi], 1
imul edi, dword [esi + 0x676c21e9], 0xfffffff5
loope 0x4a2d9f
xor ebp, dword [eax + 0x6b361cd1]
mov esi, 0x676c21e9
cmc
dec esi
xchg ebx, eax
movsb byte es:[edi], byte [esi]
mov eax, 0xff1e3b90
fimul word [edx]
mov dl, 0xf2
jbe 0x4a2d36
fstp dword [ebx + 0x76]
xchg ebx, eax
pushfd
enter 0x1b93, 0xffffffffffffff8e
mul esp
sbb dword [ebx + 0x12f7132f], esi
cmp dword [edi + eax*4 - 0x73c678e], ebx
push edx
and al, 0x6c
push edi
xor ebx, ebx
sbb al, bl
or dword [edx], eax
sti
fld xword [esi + 0x6b]
scasb al, byte es:[edi]
outsb dx, byte [esi]
imul ebp, dword [esi], 0xffffffae
out dx, eax
stosb byte es:[edi], al
xchg edx, eax
cmp bh, byte [ebx]
cld
mov edx, gs
aaa
pop ebx
cdq
mov esp, 0x497a3d76
or edx, esi
rcr dword [esi], 1
add dword [edi + 0x17], esp
fstp xword [ecx - 0x2b002d46]
and dword [edi - 0x4b], eax
mov esi, 0xd9ba2b38
mov ebx, 0x1d4c396b
jo 0x4a2e0f
add eax, 0x174a0d1a
jp 0x4a2deb
or eax, 0x3e7a174a
int 0x94
lcall 0xfacc, 0xdbfcf354
xlatb
cmpsd dword [esi], dword es:[edi]
and dh, bh
cmpsd dword [esi], dword es:[edi]
cwde
les ecx, [edx]
jp 0x4a2da8
inc edx
lodsb al, byte [esi]
cmpsd dword [esi], dword es:[edi]
in eax, 0xd9
mov bl, byte [ebp - 0x5a3cc834]
movsd dword es:[edi], dword [esi]
mov ah, 0x3c
dec ecx
sbb al, 0x7a
outsd dx, dword [esi]
mov esi, 0xf56f262f
push ds
or al, 0xea
je 0x4a2d76
ja 0x4a2ddf
out 0x8e, al
inc ebx
shr dword fs:[esi - 0x4e], 0x61
mov es, word [ebx + 0x64]
shr dword [esi - 0x4e], 0x61
movsd dword es:[edi], dword [esi]
mov eax, 0xfb057e3a
sti
stosd dword es:[edi], eax
push eax
cmp edx, dword [edx + ebx*8]
and edi, ecx
push 0x7eb4dccd
jg 0x4a2dca
push es
invalid
or dh, dl
jmp 0x4a2e4c
mov dl, 0x23
out 0x5f, eax
mov dl, 0x4f
or dl, ch
salc
mov edi, 0x723e71b2
sbb eax, dword [edx]
stosb byte es:[edi], al
clc
xor edx, dword [0x1a5a25eb]
add byte [ebp + 0x43d8f38d], bl
xchg esp, eax
invalid
and eax, 0x9d001a5a
invalid
jne 0x4a2e86
mov ecx, dword [edi - 0x2a]
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
xor dword [edi + edi*2], eax
stosb byte es:[edi], al
jb 0x4a2e62
bound ebx, qword [ecx + 0x74]
xchg ecx, eax
xlatb
ficom dword [edi - 0x5b3c53da]
xchg edi, eax
sub ah, byte [ebx]
imul ecx, dword [0x9ed67a98], 0xf66789ff
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
jnp 0x4a2e19
ret
or ch, bh
jp 0x4a2e2e
xchg ebp, eax
invalid
push ss
or dh, byte [edi - 0x48]
jg 0x4a2ef7
shl dword [ecx], cl
jge 0x4a2eba
pop esp
call 0x265ee5d6
mov byte [edx + 0x26], ah
test al, 0x37
invalid
push esp
mov edx, 0x7c8968b6
and al, 0x7a
cmp byte [edx - 0x3c], 0x2e
xor byte [ebp - 4], bh
popal
aaa
in al, dx
jmp 0x4a2eff
retf
xchg ecx, eax
in al, 0x4a
invalid
Function at 0x577d9e
Capabilities:
Encode data using xor

Disassembly:
test eax, eax
je 0x577dac
call dword [0x10070]
test eax, eax
jne 0x577dae
push ebx
add byte [eax + 0x129e902], dh
add byte [eax], al
add byte [ecx], al
or byte [ebp + 0xf3274c9], al
add byte [eax + ebx + 0x50], dh
mov eax, ecx
call dword [0x870100]
pop ecx
or eax, eax
mov edx, 0xc3018900
mov al, 2
jmp 0x587dde
mov al, 2
jmp fcn.00577ede
jb 0x587d6e
jbe 0x587e19
mov al, 0x60
invalid
push ebx
or al, 0xc5
sub byte [ebx - 0x33e31cc3], 0xd2
and al, 0x62
mov ebp, 0x203d77c3
adc dl, ch
sub eax, 0x22733e2d
arpl word [edi + 0x215ea290], si
mov bl, 0x5f
int1
in al, dx
mov gs, word [esi + 0x42c375b3]
loopne 0x587dd2
mov bl, 0x75
ret
rcl ch, 1
jae 0x587d9a
movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
stosd dword es:[edi], eax
pop ss
xchg ebx, eax
jmp 0x15ee82dd
xchg esi, eax
adc eax, 0xa0549f72
pop ebp
add dword [esi + ebx*8 + 0x2e], edx
pushfd
lodsd eax, dword [esi]
mov dword [0xf0b21c88], eax
jg 0x587dc6
jnp 0x587e11
mov cl, byte [ebx]
das
or ebp, dword [edi]
xchg ecx, eax
push edx
sbb dword [edx + 0x6d830e93], 0x735066fb
mov dword [0x6d9dc374], eax
sti
push ax
jae 0x587da1
je 0x587dc3
ret
popfd
insd dword es:[edi], dx
ror byte [edx*4 + 0x137d855c], cl
add bh, byte [edx - 0xe]
les edi, [edx]
aam 0x91
adc esi, dword [edx + 0x2198b3ef]
jae 0x587dd0
mov dl, 0xef
mov bl, 0x98
and dword [ebx - 0x48], esi
test dword [esi], eax
push es
xor eax, dword [edi - 0x72]
xchg edi, eax
mov bl, 0x72
inc ecx
push ecx
mov bl, 0x65
dec edx
sub eax, 0x2238a2a
inc ebx
ffree st(3)
and byte [edx], dl
insb byte es:[edi], dx
scasd eax, dword es:[edi]
add eax, dword [edx]
inc edx
jecxz 0x587e3e
and ebp, dword [ebx]
invalid
jae 0x587def
xchg esi, eax
jb 0x587e01
cmpsd dword [esi], dword es:[edi]
push esi
jg 0x587dd8
xor cl, al
xor dh, bl
sub ebp, ecx
push esi
and eax, 0x1c6213cc
mov ebx, 0xb87f8229
mov byte [0x691e49a8], al
loop 0x587ed2
scasb al, byte es:[edi]
jbe 0x587dff
inc edi
in al, 0x7c
mov bh, byte [ecx + 0x27b4d321]
rcr byte [esi], cl
push ds
out dx, eax
je 0x587df9
mov byte [0xc2e15346], al
add edi, 0xaf51dcb2
sbb al, 0x2f
push edx
mov dword [0x60a14091], eax
mov esp, 0x1c00cc9f
invalid
mov al, 0x46
push edi
xor dword [0xd201cc18], esp
add edx, edx
cwde
pop eax
and esp, dword [ecx - 0x3c]
jo 0x587ecb
lcall 0x4a72, 0xb3b2ef66
xchg edx, eax
push ecx
das
push 0xffffffffffffff86
jno 0x587ee4
and byte [esi - 0x20], bh
dec ebp
mov edi, 0xc23f9cd3
lodsb al, byte [esi]
ret
Function at 0x5c38ee
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
test eax, eax
je 0x5c38fc
call dword [0x10070]
test eax, eax
jne 0x5c38fe
push ebx
add byte [eax + 0x129e902], dh
add byte [eax], al
add byte [ecx], al
or byte [ebp + 0xf3274c9], al
add byte [eax + ebx + 0x50], dh
mov eax, ecx
call dword [0x870100]
pop ecx
or eax, eax
mov edx, 0xc3018900
mov al, 2
jmp 0x5d392e
mov al, 2
jmp fcn.005c3a2e
add bh, bl
test bl, al
movsd dword es:[edi], dword [esi]
out dx, eax
dec eax
cmp eax, 0x2353fd61
dec esp
out dx, al
stosb byte es:[edi], al
xor dword [ebp + ebx*4 - 0x5b], eax
mov ss, word [ecx + 0x2b]
popfd
retf 0x3954
jb 0x5d3826
salc
or byte [0x23c2a5c5], 1
mov esi, 0x1cfde4d1
and ecx, 0xaea29d9a
movsd dword es:[edi], dword [esi]
jg 0x5d38d6
into
fnstcw word [esi]
dec esp
aam 0x26
sub al, 0x34
mov byte [0xf084e057], al
test dword [eax + 0x5d], eax
ret
movsd dword es:[edi], dword [esi]
inc dword [esi - 0x51f70e0c]
int 0xae
mov word [ecx + 0x56], ss
or byte [esi + 0x518caecd], ch
push esi
add ebp, dword [ebx - 0x2f30bfde]
adc byte [ebx], cl
sbb byte [ecx], ch
loop 0x5d387a
pop ss
call 0xeb4d252f
out 0x4f, al
xchg ecx, eax
iretd
wait
inc esi
jb 0x5d38d1
lodsb al, byte [esi]
lock add byte [esi], cl
popal
jno 0x5d3930
insb byte es:[edi], dx
dec edi
cwde
ror byte [ebp - 0x5843f0d3], cl
out dx, al
adc byte [ebp - 3], bl
cmp edi, dword [edi - 0x59d065be]
mov esi, 0x1d8fed9f
mov ebx, 0x6fc62b98
and al, 0x73
dec ebp
sub al, 0x8d
out dx, eax
jp 0x5d39af
and dword [ebp + edi*4 + 0x4ac002c7], ebp
mov al, 0xda
mov ah, 0xaf
sar dword [edx], 0x99
add dword [edi + 0x1a], ebx
cmp al, 0x45
outsd dx, dword [esi]
or eax, 0x8e543246
xor bl, byte [eax]
in al, 5
insd dword es:[edi], dx
jne 0x5d3993
insb byte es:[edi], dx
sbb eax, 0xce92509c
ja 0x5d39a3
cmp edi, ebp
inc ebx
test al, 0xa4
cmpsd dword [esi], dword es:[edi]
js 0x5d398d
xchg ecx, eax
pop es
ret 0xad48
lodsd eax, dword [esi]
popal
mov ah, ah
jmp 0xdd8f1d6f
sbb dword [esp + eax*8 - 0x2b3ee097], ecx
mov edi, 0xe294f0c1
jp 0x5d39c1
rcl dword [edi + ebp*4 - 0x537fab8f], cl
imul edx, dword [0x148e3079], 0x30d16e21
aad 0xdd
pop ds
xor ch, dl
fstp qword [edi]
invalid
Function at 0x5d58b6
Capabilities:
Encode data using xor

Disassembly:
push 0xc025ddcc
std
add byte [ecx + 0x38], bl
pop ebp
dec ebx
mov al, byte [0x4e61ec84]
add byte [ebx - 0x6f], 0x2e
stc
jle 0x5d58e6
shr byte [esi], 1
dec ebp
cmpsd dword [esi], dword es:[edi]
imul esp, dword [0x4ed0d878], 0x706d6032
popal
adc al, 0xe9
pop eax
ret 0x95d9
cmp eax, 0x5d088f75
adc dword [eax], edi
aaa
push 0x5b
xchg ch, bl
mov ecx, 0xf3d128de
jle 0x5d58de
sub cl, dl
jle 0x5d58de
sbb dword [edx], eax
mov ebp, 0xd73bdbd
popfd
jge 0x5d5900
push ecx
loop 0x5d5951
push es
add dword [ebx + 0x21], ebx
mov esp, 0x99a17d26
pop ebx
and dword [esi - 0x5e665e83], edi
cmp eax, ebx
das
pop eax
jge 0x5d5881
cdq
mov eax, dword [0x582fd839]
insb byte es:[edi], dx
xor byte [ebx + 0x3b], 0xa0
in eax, 0x2d
mov eax, dword [0xd53d5a88]
or dword [ecx - 3], edx
add al, 0x3a
adc byte [0x98afc384], dl
jno 0x5d58da
cmp al, 0x8f
push esp
pop edx
das
cmc
cli
lodsd eax, dword [esi]
jae 0x5d58c6
invalid
ror al, 0x1b
stc
invalid
xchg esp, eax
and al, 0x8b
cmp al, 0x11
mov dword [0x63a615c3], eax
push eax
aaa
xor dword [edi + 0x5c], edi
lea edx, [eax]
invalid

Function at 0x659d3d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x663398
cmp edx, dword [eax]
je 0x659d5f
add eax, 8
inc ecx
cmp eax, 0x663428
jl 0x659d50
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x663398]
jne 0x659e8d
mov eax, dword [0xa600f4]
cmp eax, 1
je 0x659e67
test eax, eax
jne 0x659d90
cmp dword [0x6632c4], 1
je 0x659e67
cmp edx, 0xfc
je 0x659e8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659dc7
lea eax, [ebp - 0x1a4]
push 0x65fc18
push eax
call fcn.0065a720
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065abb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659e0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065abb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65fc14
push edi
call fcn.0065ca80
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65fbf8
push eax
call fcn.0065a720
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a730
lea eax, [ebp - 0xa0]
push 0x65fbf4
push eax
call fcn.0065a730
push dword [esi + 0x66339c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a730
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65fbcc
push eax
call fcn.0065c9f4
add esp, 0x2c
pop edi
jmp 0x659e8d
lea eax, [ebp + 8]
lea esi, [esi + 0x66339c]
push 0
push eax
push dword [esi]
call fcn.0065abb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40295e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov ebx, ecx
lea esi, [ebx + edi - 0x20]
mov eax, dword [esi]
lea ecx, [esi + 4]
push 7
mov dword [ebp - 4], ecx
pop edx
xor dword [ecx], eax
add eax, 0xb16b00b0
dec edx
add ecx, 4
xor eax, 0xc0c0c0c0
test edx, edx
ja 0x40297a
mov edx, dword [ebp - 4]
push 0x1c
call fcn.00406f49
pop ecx
mov ecx, dword [esi]
xor eax, ecx
je 0x4029c2
mov eax, dword [ebp - 4]
push 7
pop edx
xor dword [eax], ecx
add ecx, 0xb16b00b0
dec edx
add eax, 4
xor ecx, 0xc0c0c0c0
test edx, edx
ja 0x4029a5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 0xc]
sub edi, eax
add ebx, edi
add eax, 0xffffffe0
mov edx, ecx
shr eax, 2
mov ecx, ebx
jmp 0x4029e7
xor dword [ecx], edx
add edx, 0xb16b00b0
dec eax
add ecx, 4
xor edx, 0xc0c0c0c0
test eax, eax
ja 0x4029d5
mov eax, dword [esi + 8]
mov ecx, eax
and ecx, 0xfffffff0
cmp ecx, 0xb16b00b0
jne 0x4029bb
test al, 1
jne 0x402a15
mov eax, dword [esi + 0xc]
sub eax, 0x20
push eax
mov edx, ebx
call fcn.00406f49
pop ecx
mov ecx, dword [ebp - 4]
xor eax, dword [ecx]
jne 0x4029bb
mov eax, dword [esi + 0x10]
test eax, eax
je 0x402a21
add eax, ebx
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
test eax, eax
je 0x402a2d
add eax, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x10]
jmp 0x402a65
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x402a3e
add ecx, ebx
mov dword [eax + 0xc], ecx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x402a4a
add ecx, ebx
mov dword [eax + 0x14], ecx
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x402a56
add ecx, ebx
mov dword [eax + 0x1c], ecx
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x402a62
add ecx, ebx
mov dword [eax + 0x24], ecx
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x402a32
push 8
call fcn.0040b095
pop ecx
test eax, eax
je 0x4029bb
mov ecx, dword [esi + 0x10]
mov dword [eax], esi
mov dword [eax + 4], ecx
jmp 0x4029bd