joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52fb75
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0052faf1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x52fce4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x52fce4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x52fc99
jg 0x52fbd1
test eax, eax
je 0x52fc8f
push 1
push 0x1000
call fcn.005207b4
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x52fbf4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x52fc86
push 0x8000
push ebx
call fcn.0051c33e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x52fc1d
jg 0x52fc18
cmp ecx, 0x1000
jb 0x52fc1d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00522980
add esp, 0x10
cmp eax, 0xffffffff
je 0x52fc62
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x52fc18
jl 0x52fc49
test ecx, ecx
jne 0x52fc0a
push dword [ebp - 0xc]
push ebx
call fcn.0051c33e
push esi
call fcn.007f6afd
add esp, 0xc
xor ebx, ebx
jmp 0x52fcf2
cmp byte [edi + 0x24], 0
je 0x52fc79
cmp dword [edi + 0x20], 5
jne 0x52fc79
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x52fc84
mov ebx, dword [edi + 0x18]
jmp 0x52fc86
xor ebx, ebx
push esi
call fcn.007f6afd
pop ecx
jmp 0x52fcf2
test ecx, ecx
jg 0x52fc5b
jl 0x52fc99
test eax, eax
jae 0x52fc5b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00523d9f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x52fcb9
cmp byte [edi + 0x1c], 0
je 0x52fc5b
jmp 0x52fcea
push ebx
call fcn.005202fe
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
jne 0x52fc5b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x52fcf2
cmp byte [edi + 0x1c], 0
je 0x52fcef
mov ebx, dword [edi + 0x18]
jmp 0x52fcf2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00523d9f
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x534730
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x53475d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x53475d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x53be11
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5ac640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
movzx ecx, byte [eax + 8]
push 3
pop ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
cmp ecx, ebx
je 0x53bf88
movzx edx, byte [eax + 9]
test cl, 2
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edx
je 0x53be6d
movzx eax, byte [edi]
sub ecx, eax
movzx eax, byte [edi + 1]
mov dword [ebp - 0x14], ecx
mov ecx, edx
sub ecx, eax
movzx eax, byte [edi + 2]
mov dword [ebp - 0x10], ecx
mov ecx, edx
sub ecx, eax
mov dword [ebp - 0xc], ecx
jmp 0x53be7c
movzx eax, byte [edi + 3]
xor ebx, ebx
sub ecx, eax
inc ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
test byte [ebp - 0x1c], 4
je 0x53be92
movzx eax, byte [edi + 4]
mov ecx, edx
sub ecx, eax
mov dword [ebp + ebx*4 - 0x14], ecx
inc ebx
mov dword [ebp - 0x18], ebx
xor edi, edi
mov ecx, edi
mov eax, edi
test ebx, ebx
je 0x53bf87
cmp dword [ebp + eax*4 - 0x14], edi
jle 0x53beb1
cmp dword [ebp + eax*4 - 0x14], edx
jge 0x53beb1
xor ecx, ecx
inc ecx
jmp 0x53beb5
mov dword [ebp + eax*4 - 0x14], edi
inc eax
cmp eax, ebx
jl 0x53bea0
test ecx, ecx
je 0x53bf87
dec edx
sub edx, 1
je 0x53bf70
dec edx
sub edx, 1
je 0x53bf45
sub edx, 4
je 0x53bf24
sub edx, 8
jne 0x53bf87
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
add eax, esi
mov dword [ebp - 0x1c], eax
cmp esi, eax
jae 0x53bf87
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
mov ecx, dword [ebp + edi*4 - 0x14]
shl ebx, 8
add ebx, eax
sar ebx, cl
lea ecx, [edi + 1]
mov eax, ebx
xor edi, edi
sar eax, 8
mov byte [esi], al
mov byte [esi + 1], bl
add esi, 2
cmp ecx, dword [ebp - 0x18]
cmovl edi, ecx
cmp esi, dword [ebp - 0x1c]
jb 0x53bef3
jmp 0x53bf87
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
add edx, esi
jmp 0x53bf3f
mov cl, byte [ebp + edi*4 - 0x14]
lea eax, [edi + 1]
shr byte [esi], cl
xor edi, edi
inc esi
cmp eax, ebx
cmovl edi, eax
cmp esi, edx
jb 0x53bf2e
jmp 0x53bf87
mov ecx, dword [ebp + 8]
push 0xf
pop edx
mov edi, dword [ecx + 4]
mov ecx, dword [ebp - 0x14]
add edi, esi
sar edx, cl
mov eax, edx
shl eax, 4
or edx, eax
jmp 0x53bf6a
mov al, byte [esi]
mov cl, byte [ebp - 0x14]
shr al, cl
and al, dl
mov byte [esi], al
inc esi
cmp esi, edi
jb 0x53bf5e
jmp 0x53bf87
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
add ecx, esi
jmp 0x53bf83
mov al, byte [esi]
shr al, 1
and al, 0x55
mov byte [esi], al
inc esi
cmp esi, ecx
jb 0x53bf7a
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.007dac04
leave
ret
Function at 0x5461cb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov edx, dword [edi + 0x74]
mov dword [ebp - 0xc], ebx
mov eax, dword [edi + 0x2c]
mov esi, dword [edi + 0x3c]
add eax, 0xfffffefa
sub esi, dword [edi + 0x6c]
add eax, ebx
sub esi, edx
mov dword [ebp - 8], esi
cmp dword [edi + 0x6c], eax
jb 0x546274
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004ffbc0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
mov esi, ecx
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], ecx
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
movzx ecx, bx
movzx eax, word [edi]
mov edx, eax
mov dword [ebp - 4], ecx
sub eax, ecx
xor ecx, ecx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x546222
mov edi, dword [ebp + 8]
mov esi, ebx
mov eax, dword [edi + 0x40]
lea edi, [eax + ebx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, dword [ebp - 4]
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x54624f
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
add esi, ebx
mov ebx, dword [edi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x546398
mov edx, dword [edi + 0x6c]
mov ecx, dword [edi + 0x74]
add edx, ecx
add edx, dword [edi + 0x38]
cmp eax, esi
mov dword [ebp - 4], edx
cmovbe esi, eax
test esi, esi
je 0x5462e2
sub eax, esi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x5462b5
push esi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0054987b
jmp 0x5462c5
cmp eax, 2
jne 0x5462ce
push esi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.00547d3b
mov edx, dword [ebp - 4]
add esp, 0xc
mov dword [ebx + 0x30], eax
push esi
push dword [ebx]
push edx
call fcn.004ffbc0
add dword [ebx], esi
add esp, 0xc
add dword [ebx + 8], esi
mov ecx, dword [edi + 0x74]
lea edx, [ecx + esi]
mov dword [ebp - 8], edx
mov dword [edi + 0x74], edx
cmp edx, 3
jb 0x546312
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
mov edx, dword [ebp - 8]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp edx, 0x106
jae 0x54632a
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x54632a
mov ebx, dword [ebp - 0xc]
jmp 0x5461e0
mov ecx, dword [edi + 0x16c0]
mov esi, dword [edi + 0x3c]
cmp ecx, esi
jae 0x546398
mov ebx, dword [edi + 0x6c]
add ebx, edx
cmp ecx, ebx
jae 0x546368
mov eax, 0x102
sub esi, ebx
cmp esi, eax
cmova esi, eax
mov eax, dword [edi + 0x38]
push esi
add eax, ebx
push 0
push eax
call fcn.004e9cb3
lea eax, [esi + ebx]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x546398
lea eax, [ebx + 0x102]
cmp ecx, eax
jae 0x546398
sub ebx, ecx
sub esi, ecx
lea eax, [ebx + 0x102]
cmp eax, esi
cmovbe esi, eax
mov eax, dword [edi + 0x38]
push esi
add eax, ecx
push 0
push eax
call fcn.004e9cb3
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x547d3b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x547d48
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00547d4e
Function at 0x6ee0f6
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x25
out dx, al
invalid
add ebp, dword [ebp]
in al, dx
insd dword es:[edi], dx
add ah, ch
push esp
mov esp, 0xe77596c5
lahf
add dl, byte [ecx]
out 0xe8, eax
lahf
xor al, 0x84
jl 0x6ee0a1
lahf
xchg esi, eax
jne 0x6ee0a0
lahf
movups xmm7, xmm4
call 0x76051f61
out 0x9f, eax
sbb al, 0x11
out 0xe8, eax
lahf
sub byte [ebx + 0x77], al
call 0x219cea70
arpl word [ebp - 0x2f267a5b], di
lahf
out 0xcb, al
add al, 0xaa
sbb ah, bl
shl byte [ebx + 0x21], 1
hlt
push 0x61217aec
push ecx
push edx
push ebx
push eax
push esi
call fcn.0072113f
invalid

Function at 0x7b079a
Capabilities:
Packed with generic packer

Disassembly:
push 0x2217e70
push ecx
jmp 0x7e5032
push edx
push ebx
push eax
push esi
pushfd
jmp 0x7dc23a
mov al, byte [ebx + 0x328307e2]
xor al, cl
movsd dword es:[edi], dword [esi]
cmp al, 0x21
sbb bl, byte [esi + 0x129ff0b0]
push ebx
out dx, eax
invalid
popal
rcl dword [edx], 0x3c
stc
add byte [eax], 0xe9
loope 0x7bfebf
adc ah, byte [edx]
push esi
in al, 0xe2
push ds
sbb al, 0x96
jecxz 0x7bfec9
xor ebx, dword [esi + edx*4]
jecxz 0x7bfece
pop es
sbb al, 0x96
jecxz 0x7bfed3
sbb al, 0x96
jecxz 0x7bfed8
das
and dl, byte [esi - 0x1c]
loop 0x7bff13
sbb al, 0x96
jecxz 0x7bfee2
cmp dh, byte [edi]
pushal
in al, 0xe2
or ch, al
add ebp, dword [ebp]
xor eax, 0x45c59687
sbb eax, 0x453a9fc0
inc ebp
sbb eax, 0x1e179fc0
jmp 0x459a9f0f
lahf
pop es
dec eax
add ebp, edi
lahf
xor ebx, edi
popfd
jo 0x7bfef7
and bl, bh
in al, 0xd0
arpl word [ecx], di
push ecx
adc byte [edi - 0x26], dh
in eax, 0xd0
and al, 3
div dword [ecx]
add byte [eax], al
add al, ah
push 0x3e217d14
push ecx
push edx
jmp 0x4e3805
push esi
pushfd
push ebp
push edi
call fcn.007afbde
jb 0x7bff2f
invalid
and al, 4
push ecx
jmp 0x7b6b39
push ebp
push edi
jmp fcn.007b2c2d
movsd dword es:[edi], dword [esi]
mov word [ebx - 0x3c], gs
ret 0x82f5
test al, 0x3d
loope 0x7e4f3a
aas
mov ebp, 0xcbc651ab
jg 0x7e4fdf
fsubr dword [edx - 0x1143a5c1]
lahf
aas
push esi
cmp ah, ah
sar byte [ebp + 0x20e33c77], 1
sti
in al, 0xd0
aad 0xb3
add al, 0xdd
mov al, byte [0xa1d0e75f]
ja 0x7e4ff3
inc dword [ecx + 0x72]
in al, 0xd0
nop
mov dl, 0x5c
sbb byte [eax - 0x46], bh
cdq
les ebx, [ecx - 0x6d39b0dd]
lcall 0xf660, 0x3fe2e1e7
mov edx, ebx
jg 0x7e4fdf
invalid
imul ebx, dword [ebp - 0x3b642159], 0xa950c8c4
push 0x4d
enter 0xffffffffffffa950, 0x6a
dec ebp
clc
xchg edi, eax
popfd
out dx, al
push eax
jge 0x7e4fa8
imul edi, ecx, 0x6ab36ac8
mov bl, 0x6a
mov cl, 0xd3
xchg edx, eax
or byte [eax], al
add byte [eax], al
add byte [eax], al
loopne 0x7e5066
call fcn.007b37b8
invalid

Function at 0x7b6349
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
aas
popfd
lcall 0x50ac, 0x983f92e4
invalid
lea esp, [esp + 4]
push edx
call fcn.004d028d
jno 0x7b62dc
xchg edx, eax
mul al
in al, 0xfe
sub ebx, dword [ecx - 0x1e]
loop 0x7b6366
sti
mov ah, 0x13
mov dword [0x9ff1e91e], eax
lahf
pop ds
mov dl, 0xc1
invalid
Function at 0x7bac8b
Capabilities:
Packed with generic packer

Disassembly:
or dword [eax], eax
jmp 0x228e8e93
sbb al, 0x96
jecxz 0x7babab
add al, byte [eax]
jmp 0x37878eb1
movsd dword es:[edi], dword [esi]
jno 0x7babc5
clc
inc esi
jae 0x7babc9
fldenv [ebx - 0x1e]
add ah, byte [ebx - 0x503c383f]
int1
lahf
add al, byte [eax]
jmp 0x1c8e8f01
adc bl, byte [esi + edx*4]
jecxz 0x7bac05
or ah, byte [edx]
push esi
in al, 0xe2
sub byte [edx], ah
push esi
in al, 0xe2
mov cr2, esi
in al, 0xe2
cmp byte [edx], ah
push esi
in al, 0xe2
add al, byte [eax]
and dl, byte [esi - 0x1c]
loop 0x7bac51
and dl, byte [esi - 0x1c]
loop 0x7bac3d
and dl, byte [esi - 0x1c]
loop 0x7bac6b
and dl, byte [esi - 0x1c]
loop 0x7bac3a
add cl, ch
jmp 0x37878f1f
loope 0x7bac1e
or esi, dword [edi]
aaa
pushal
in al, 0xe2
cmp ebp, eax
add edx, dword [eax]
push ebx
out dx, eax
popal
shr dword [edi + 0x22fa618e], 0x56
in al, 0xe2
loop 0x7bac65
adc al, byte [eax]
jmp 0x1c868f3a
add cl, ch
loope 0x7bac39
or bl, byte [esi + edx*4]
jecxz 0x7bac3e
sub byte [eax], al
jmp 0x1c8b8f44
loop 0x7bac9f
and dl, byte [esi - 0x1c]
loop 0x7bac6e
add bl, byte [esi + edx*4]
sbb al, 0x96
jecxz 0x7bac52
or esi, dword [edi]
pushal
in al, 0xe2
cmp eax, dword [eax]
add byte [eax], al
add bl, ah
push 0x76217d63
call fcn.007d21cb
jo 0x7bac24
and al, 4
push ebx
push eax
jmp 0x7e0824
add al, byte [eax]
jb 0x7bac2c
adc al, 0x24
push esi
pushfd
push ebp
jmp loc.004effd9
mov eax, dword [0x53525121]
push eax
jmp 0x7bffb8
push esi
pushfd
push ebp
push edi
call fcn.007c4088
jno 0x7e0882
push ebx
push eax
push esi
pushfd
call fcn.007dab02
invalid
Function at 0x7c02d6
Capabilities:
Encode data using xor

Disassembly:
push 0xc4217d41
push ecx
call fcn.007d0f14
jno 0x7c034b
adc byte [esi + 0x21], bh
test al, 0x51
push edx
push ebx
push eax
jmp loc.004ccece
mov al, byte [ebx + 0x32833de2]
xor al, cl
xor al, 0x38
inc ecx
lahf
cmp byte [ecx - 0x61], al
sti
mov ah, 0xc1
lahf
push cs
push ebx
out dx, eax
popal
shl dword [edx + 0x1cf49937], 0x96
jecxz 0x7c0341
push cs
and dl, byte [esi - 0x1c]
loop 0x7c03a5
inc eax
sbb al, 0x96
jecxz 0x7c034b
xor byte [edx], ah
push esi
in al, 0xe2
cmp eax, 0xe2e1e900
or byte [edx], ah
push esi
in al, 0xe2
sbb byte [edx], ah
push esi
in al, 0xe2
and dl, byte [esi - 0x1c]
loop 0x7c03ba
cmp al, 0
jmp 0x3799e665
add cl, ch
loope 0x7c0364
sbb eax, 0xe2e46037
push ds
call 0x9b7c7090
cld
xchg esp, eax
lds ebx, [esi]
jmp 0x4599a387
out dx, eax
lahf
inc eax
inc ebp
sbb eax, 0x45189fc0
sbb eax, 0x451e9fc0
sbb eax, 0xdf089fc0
or bh, bl
cmpsd dword [esi], dword es:[edi]
rcr dword [edi - 0x119d51c3], 0x9f
xor byte [edi + ebx], cl
pop ds
jae 0x7c0379
add byte [edx], ah
je 0x7c037d
mov byte [0x1eaad74d], al
push ds
add esi, edx
dec ebp
stosd dword es:[edi], eax
test eax, 0x1e9ff0a4
and dl, byte [esi - 0x1c]
loop 0x7c03f1
sub al, 0xa9
loop 0x7c03b9
push ds
jnp 0x7c040d
out dx, al
lahf
push cs
pushfd
sbb dword [ebp - 0x7bab443c], ebx
cmpsb byte [esi], byte es:[edi]
mov ah, dh
mov ecx, 0xe124eebd
loop 0x7c03fc
movsd dword es:[edi], dword [esi]
mov word [ebx - 0x3c], gs
invalid
ret 0x82f5
sahf
ja 0x7c0447
add ebp, edi
lahf
inc eax
jno 0x7c039c
jo 0x7c03c4
cdq
and ecx, dword [edi - 0x3a]
popal
cdq
xchg ecx, eax
loop 0x7c03f2
inc eax
xchg ebp, eax
push edx
jne 0x7c03ad
movsd dword es:[edi], dword [esi]
mov word [ebx - 0x3c], gs
push esp
fadd dword [ebx - 0x4801c45a]
mov ebp, 0xd0b5edbd
dec esp
ret
sti
in eax, dx
lahf
push cs
mov al, byte [0x21d0e75f]
ret
Function at 0x7c1d54
Capabilities:
Packed with generic packer

Disassembly:
push edx
push ebx
push eax
call fcn.007d625d
js 0x7b00c4
movd edx, mm3
push 0x43a17cbd
push ecx
jmp 0x7c58c0
xor dl, byte [ecx - 0x18]
sbb bh, byte [eax + eax - 0x68f01f00]
invalid
push ebx
push eax
push esi
pushfd
jmp 0x7c061c
push ebp
push edi
jmp fcn.007b2c2d
xor dword [edx], esp
push esi
in al, 0xe2
and eax, 0xe2e45622
or ah, byte [edx]
push esi
in al, 0xe2
xor esp, dword [edx]
push esi
in al, 0xe2
sbb al, 0x22
push esi
in al, 0xe2
or dword [esi + edx*4], ebx
and dl, byte [esi - 0x1c]
loop 0x7c1cdf
and dl, byte [esi - 0x1c]
loop 0x7c1cc9
and dl, byte [esi - 0x1c]
loop 0x7c1cf7
and dl, byte [esi - 0x1c]
loop 0x7c1ce5
and dl, byte [esi - 0x1c]
loop 0x7c1cd7
sbb al, 0x96
jecxz 0x7c1cb4
or eax, 0xe2e46037
cmp ebp, eax
add ecx, dword [edi]
push esi
cmp ah, ah
rol dl, 1
sbb eax, ecx
cld
lds ebp, [0xe59ad0e6]
sar esp, 0xc5
sub eax, 0xe59ad0e6
push cs
adc al, byte [eax]
add byte [eax], al
add byte [eax + 0x53], bh
push eax
push esi
pushfd
push ebp
push edi
call fcn.007defdd
jbe 0x7c1d66
lahf
jl 0x7c1d22
jle fcn.007c1d54
push edx
push ebx
call fcn.007ccbf4
jg 0x7c1d59
adc ah, ah
loop 0x7c1d23
and dword [ecx], 0xffffffb8
rol byte [edx + 0x5942611b], 1
loopne 0x7c1cb5
popfd
lahf
push 0xfb90a683
in eax, dx
lahf
orps xmm7, xmmword [edx]
in al, 0xd0
imul ebx, dword [ebx], 0xffffff89
sub eax, 0xd0e6eff8
out 0xd6, al
fadd qword [eax]
add byte [eax], al
add byte [ebx - 0x34], dh
push 0x38a17de5
push ecx
push edx
push ebx
push eax
jmp 0x7d8fbd
int3
js 0x7c1ce2
lea esp, [esp + 4]
and al, 4
push edx
push ebx
push eax
call fcn.007b4e82
jle 0x7c1ced
or al, 0x24
lea esp, [esp + 4]
push dword ss:[ecx]
and al, 4
add byte [eax], al
add byte [esi], dh
push dword [ecx]
mov edx, dword [esi]
lea esi, [esi + 4]
add edx, 0x55118aae
add edx, dword [edi]
push 0x38bb287a
call fcn.004f1745
jge 0x7c1dd4
adc ah, ah
loop 0x7c1d92
out dx, al
push ebx
in al, 0xd0
loop 0x7c1d3a
jbe 0x7c1d53
sal cl, 0x83
imul ebx, dword [ebp - 0x60104847], 0x2c
mov ecx, 0x209fefb7
fbld tbyte [edi - 0x72fc603f]
imul esi
lahf
int1
sub dword [ebx - 0x63], 0xffffffb9
mov bh, 0xef
lahf
sub al, 0xb9
mov bh, 0xef
lahf
and bh, bl
cmpsd dword [esi], dword es:[edi]
rcr dword [edi - 0x110872fd], 0x9f
pop es
sbb al, 0x96
jecxz 0x7c1d91
cmp esp, dword [edx]
push esi
in al, 0xe2
adc eax, dword [eax]
jmp 0x1c89009c
push esi
in al, 0xe2
verw cx
loope 0x7c1daf
pop es
aaa
pushal
in al, 0xe2
sub al, 0xe8
add edx, dword [eax]
push ebx
out dx, eax
popal
rcl dword [esi], 0x1d
pop ecx
sahf
sbb al, 0x96
jecxz 0x7c1dc5
cmp eax, dword [eax]
jmp 0x229000cb
push edx
jmp 0x7bfaf1
and al, 0x8d
movsb byte es:[edi], byte [esi]
and al, 4
add byte [eax], al
add bh, dh
sal bh, 1
adc al, 0x24
jmp 0x7df450
invalid
jecxz 0x7d8f76
or byte [ecx + 0x7c], ch
in al, 0xe2
cmp al, 7
inc esi
je 0x7d8f4d
push ds
jmp 0xda992f95
push esi
pushfd
call fcn.007b7c5c
jl 0x7d8f92
push 0x67a17d3b
push ecx
jmp 0x7b0054
and dword [esp], eax
lodsd eax, dword [esi]
add eax, 0x42c3a995
add eax, dword [edi]
jmp eax
Function at 0x7c466b
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push eax
call fcn.007b51f2
jbe 0x7b2756
invalid
jbe 0x7b276d
and esp, ebx
push ebx
push eax
push esi
pushfd
jmp loc.004efa32
popal
rcl dword [ecx], 0x14
push 0x45
sbb al, 0x96
jecxz 0x7b2727
cmp eax, dword [eax]
jmp 0x228f0a2d
xchg esi, eax
jecxz 0x7b273b
and byte [edx], ah
push esi
in al, 0xe2
verw cx
loope 0x7b2745
pop es
aaa
pushal
in al, 0xe2
sub al, 0xe8
add ebp, dword [ebp]
wait
cld
xchg esp, eax
lds ebx, [esi]
jmp 0x1e82c768
push 0x3da17cb0
push ecx
push edx
jmp 0x7b26e5

Function at 0x7c9be1
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 4]
mov dword [esp], edx
push ebx
mov ebx, dword [esp + 4]
pushfd
push edx
jmp 0x7df40d
lea esp, [esp - 2]
mov word [esp], ax
mov edx, dword [esi]
add edx, dword [edi]
add edx, 0x3afb8fdc
add esi, 4
jmp 0x7be32e
push 0x18a17dbb
push ecx
push edx
push ebx
push eax
push esi
pushfd
call fcn.007c1ab6
jbe 0x7c9c5b
sar dword [ebp + 0x21], cl
adc edx, dword [ecx - 0x17]
mov esi, dword [esi - 0x7286ffff]
lea esp, [esp + 4]
push edx
push ebx
push eax
call fcn.007ba0e5
jecxz 0x7c9b99
and al, 4
mov ebx, dword [esp + 4]
pushfd
pushfd
push 0x39ed5e14
push ebx
mov ebx, dword [esp + 0x10]
ret 0x14
loop 0x7c9c70
xchg ebx, eax
stosd dword es:[edi], eax
inc esp
scasd eax, dword es:[edi]
mov ecx, 0x2d9fefb7
pop esp
push edi
int1
lahf
adc esp, dword [edx]
iretd
xor ecx, dword [edi - 0x5af35558]
mov word [ebx - 0x3c], gs
push esp
fadd dword [ebx - 0x476dc55a]
mov ebp, 0xac07ca4d
wait
adc eax, 0xcb2d9fee
xor esi, dword [edi + 0x50d0b5b7]
invalid
push ebx
mov ebx, dword [esp + 0xc]
ret 0x10
Function at 0x7d041d
Capabilities:
Encode data using xor

Disassembly:
pushfd
push ebp
push edi
jmp fcn.007b2c2d
in al, 0xd0
xchg ebx, eax
lds esp, [0xe4fb2090]
sar byte [ecx - 0x5f22f9ff], 1
pop edi
out 0xd0, eax
mov ebp, eax
lodsd eax, dword gs:[esi]
inc esp
pop ds
out 0xd0, eax
xchg edx, eax
add byte [esi], cl
adc bh, ch
fstp dword [edx + 0x50d0b5c4]
invalid
pushfd
push ebp
push edi
call fcn.007d8bc1
jmp 0x7d01d6
invalid
stosd dword es:[edi], eax
loope 0x7d02c9
insd dword es:[edi], dx
ja 0x7d023f
sbb dword [ebp - 0x7d0a3d3c], ebx
cmpsb byte [esi], byte es:[edi]
cmp edi, esi
mov bh, 0xbd
mov ebp, 0xe4d0b5ed
xor eax, 0x396e0328
mov eax, 0xe3d1f1bd
loop 0x7d02da
popfd
leave
pushfd
les edx, [eax + ebx*8 - 0x7d]
cmpsb byte [esi], byte es:[edi]
mov ebx, 0x34bdba62
out 0xd0, al
mov edx, 0xe66634bd
shl byte [ebx - 0x3900323c], 1
xor al, 0x66
out 0xd0, al
mov dword [0xc6ffcdc4], eax
std
mov byte [ebp - 0x62947c0f], bh
popfd
fbld tbyte [edi - 0x72e4603f]
imul esi
lahf
or ebx, dword [esi + edx*4]
sbb ecx, dword [ebp + 0xb9feef7]
sbb al, 0x96
jecxz 0x7d02cb
or edi, dword [edx + 0xbe2e3f5]
add al, 0x9a
test dword [esi - 0x600f1f82], esp
pop ds
popfd
leave
pushfd
les edx, [eax + ebx*8 - 0x7d]
cmpsb byte [esi], byte es:[edi]
mov ah, dh
mov ecx, 0xe124eebd
loop 0x7d0328
pop ds
movsd dword es:[edi], dword [esi]
mov word [ebx - 0x3c], gs
mov ebx, 0x30a68454
jo 0x7d029d
cmpsb byte [esi], byte es:[edi]
xor byte [eax - 0x77], dh
mov ebp, 0x779efb92
dec eax
sti
sahf
ja 0x7d0362
add ebp, edi
lahf
sbb ebx, edi
popfd
jo 0x7d02df
and bl, bh
in al, 0xd0
dec ebx
les esi, [ebp + 0x3e]
jne 0x7d0368
lds ebp, [0x69d0e6]
salc
fadd qword [eax]
add byte [eax], al
add byte [ecx], dh
sbb byte [edi - 0x3f], 0xb4
aaa
pop eax
test dword [esi + edx*4], ebx
jecxz 0x7d0324
sbb eax, dword [eax]
jmp 0x7fe62a
pushal
in al, 0xe2
or eax, dword [eax]
add byte [eax], al
add byte [ecx + 0x68], bh
add byte [eax], al
jns 0x7d03d4
aad 0x7d
mov eax, dword [0x53525110]
jge 0x7d0310
adc byte [ecx + 0x52], dl
push ebx
push eax
call fcn.007aea26
jne 0x7d0308
invalid
and al, 4
push eax
push esi
pushfd
push ebp
jmp 0x4f17e9
sar bh, cl
ja 0x7d0316
invalid
and al, 4
push eax
call fcn.007bd8b8
jne 0x7d0330
push ebp
push edi
jmp fcn.007b2c2d
shr dl, 1
xor al, 0x88
inc edx
jecxz 0x7d036d
jecxz 0x7d0396
sub al, 7
inc esi
je 0x7d0368
mov ecx, 0x3b9fefb7
fisub dword [eax]
int1
lahf
sub al, 0x56
cmp ah, ah
shr byte [ebx + eax*8 - 0x2588aa13], 1
in eax, 0xd0
xchg ebp, eax
invalid
add byte [eax], al
add al, ch
push eax
mov eax, dword [esp + 4]
push 0x52ccfe7a
push 0x6616e104
lea esp, [esp - 4]
call fcn.007c16a6
loopne 0x7d0385
invalid
and al, 4
jl 0x7d03ab
lea esp, [esp + 4]
and al, 4
push ecx
push edx
call fcn.007c30c2
ja 0x7d047a
push esi
jmp 0x7bb024
and al, 4
add byte [eax], al
add byte [esp + ebx*4 - 0x6b74adaf], bl
and al, 0x10
add byte [eax], al
add dl, al
adc al, 0
invalid

Function at 0x7e52d6
Capabilities:
Packed with generic packer

Disassembly:
push eax
call fcn.007e3578
jg 0x7c2eb5
invalid
and al, 4
daa
jge 0x7e5296
dec eax
push ecx
push edx
push ebx
jmp 0x7c2f20
and al, 4
lea esp, [esp + 4]
push esi
pushfd
push ebp
push edi
call fcn.007b3c73
jb 0x7e5272
invalid
and al, 4
Function at 0x7e8d3e
Capabilities:
Packed with generic packer

Disassembly:
lahf
or bl, bh
cmpsd dword [esi], dword es:[edi]
rcr dword [edi - 0x104846f5], 0x9f
sub al, 0xae
invalid
push 0x5b217d31
push ecx
push edx
push ebx
call fcn.007e5016
jne 0x7e8db3
nop dword [eax + eax]
push 0xb6217e82
push ecx
push edx
push ebx
call fcn.004f19c5
sar bh, 1
invalid
Function at 0x401ed0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit