joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ce80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x46ced3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x46ceba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a9aae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004741a0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4df2b4
call fcn.0049918b
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x473913
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0049918b
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x47390c
push 0
mov ecx, eax
call fcn.0046a980
mov dword [esi + 0xc], eax
jmp 0x473915
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x473915
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x49b867
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49b89f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004998f1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004998c9
jmp 0x49b8ab
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49cf55
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49cf97
call fcn.004a2c7e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49cf97
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49cf8e
xor eax, eax
jmp 0x49cf9f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049cfa5
pop edi
pop esi
pop ebx
ret 4
Function at 0x4a31ae
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a31dc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a31fa
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a3114
jmp 0x4a31fa
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a31fa
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a3114
test edi, edi
mov eax, edi
jne 0x4a31e4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4221d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4eaa68]
xor edx, edx
cmp eax, edx
jne 0x4221f6
xor eax, eax
mov byte [eax + 0x4ea968], al
inc eax
cmp eax, 0x100
jl 0x4221de
mov dword [0x4eaa68], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4ea968
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x422287
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x42225a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x422228
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x422300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x422353
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42233a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424aa0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4766f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x44]
mov edx, dword [edi]
add edx, 0x18
mov eax, edx
mov dword [edi], edx
push eax
call fcn.00451e60
mov ebx, dword [edi]
add ebx, eax
mov eax, ebx
mov dword [edi], ebx
push eax
call fcn.00451e60
mov ecx, dword [edi]
add ecx, eax
mov eax, ecx
mov dword [edi], ecx
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
lea esi, [eax + 0xc]
mov eax, dword [0x4eaab0]
push esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], eax
mov dword [edi], esi
call fcn.00451e60
mov edx, dword [edi]
mov ebp, dword [esp + 0x58]
add eax, 4
add esp, 0xc
add edx, eax
mov eax, edx
mov dword [edi], edx
test ebp, ebp
mov dword [esp + 0x18], eax
jne 0x424b3a
mov ecx, dword [esp + 0x40]
test ecx, ecx
jne 0x424b34
add eax, 4
mov dword [esp + 0x18], eax
mov dword [eax], 0
mov ebx, dword [edi]
add ebx, 0x14
mov dword [edi], ebx
mov ebx, dword [esp + 0x48]
mov edx, dword [ebx]
dec edx
mov dword [ebx], edx
mov ecx, dword [0x4eaab0]
inc ecx
mov dword [0x4eaab0], ecx
mov ecx, dword [0x4da280]
mov dword [esp + 0x44], ecx
test ebp, ebp
mov dword [esp + 0x38], 0
jne 0x424c03
mov eax, dword [esp + 0x40]
test eax, eax
je 0x424c03
test byte [esp + 0x14], 1
je 0x424c03
cmp dword [ebx], 0
jle 0x424bdd
mov esi, dword [edi]
add esi, 0x18
push esi
call fcn.00451e60
add esi, eax
push esi
call fcn.00451e60
mov edx, dword [esp + 0x24]
add esi, eax
add esp, 8
cmp dword [esi + 4], edx
jle 0x424bdd
add esi, 0xc
push esi
call fcn.00451e60
lea eax, [esi + eax + 4]
add esp, 4
mov dword [eax], 0
add eax, 0x14
mov dword [edi], eax
mov edx, dword [ebx]
dec edx
mov dword [ebx], edx
mov ecx, dword [0x4eaab0]
inc ecx
mov dword [0x4eaab0], ecx
mov eax, dword [ebx]
test eax, eax
jg 0x424b89
lea ecx, [esp + 0x44]
mov dword [esp + 0x38], 0xffffffff
call fcn.004699dc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
test ebp, ebp
mov dword [esp + 0x10], 0x10
jne 0x424c1e
test byte [esp + 0x14], 2
je 0x424c1e
mov dword [esp + 0x10], 0x11
call fcn.0061c949
retf 0xed85
Function at 0x436e40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x477758
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x436e79
inc eax
mov dword [esi + 0x10], eax
jmp 0x436f8c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x436e8d
mov eax, 0xffffffc7
jmp 0x436f8e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x436e9e
cmp dword [esi + 8], eax
jne 0x436e8d
cmp dword [esi + 8], eax
jne 0x436eb7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x436eb7
mov eax, 0xffffffc7
jmp 0x436f8e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x436ecb
push eax
mov ecx, ebx
call fcn.00436670
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00405990
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x436efc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004059b0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00435de0
test eax, eax
mov dword [esp + 0x38], eax
je 0x436f2f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4b9540
call fcn.00405b90
mov eax, dword [esp + 0x38]
jmp 0x436f8e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00436ca0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x436f73
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00436cc0
mov esi, eax
test esi, esi
jne 0x436fa3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00436ca0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x436f45
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4b9540
call fcn.00405b90
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4b9540
call fcn.00405b90
mov eax, esi
jmp 0x436f8e
Function at 0x4536f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4786a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004532a0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00453320
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00453320
lea ecx, [esi + 0xc]
call fcn.00469967
lea ecx, [esi + 0x10]
call fcn.00469967
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004548b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004548b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004548b0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004699dc
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004699dc
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x5e3ea9
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov ch, byte [esp]
jmp 0x5e3eeb
mov eax, 0x5070c80e
sub esp, 0x1a
mov word [esp + 2], dx
lea esp, [esp + 2]
jmp 0x5e3ed5
lea edx, [edx - 0x20]
setp cl
setae ch
neg ax
call fcn.005e3f8d
sub eax, 0x1960f3c
rdtsc
add al, dh
clc
xchg dword [esp], edx
mov ax, bp
xchg ah, ch
jmp 0x5e3eb0
Function at 0x5e6495
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], eax
jmp 0x5e6124
call 0x5e415f
jmp 0x5e60e1
call 0x5e41ce
jmp 0x5e66b5
call fcn.005e603b
call fcn.005dac16
jmp 0x5e415a
pop ecx
sub ecx, 0x1000ea33
mov dword [ecx + 0x10010879], eax
jmp 0x5e6191
popal
call 0x5e610c
add ebx, 0xd28be762
cmp ebx, 0xd28be82e
je 0x5e61d4
jne 0x5e4146
inc edx
fisttp qword [ebp + 0x14]
out 0x24, eax
mov word [esi], gs
mov esp, 0xbfb136db
inc ebx
sal dword [esi + 0xf86fc45], cl
mov dh, 0x18
movzx ebx, byte [eax]
jmp 0x5e616a
mov dword [esp], edx
push edx
mov esi, dword [esp + 3]
mov dword [esp + 8], esi
jmp 0x5e620f
jmp 0x5e64c3
lea esp, [esp + 3]
mov esi, dword [esp + 0x1b]
lea esp, [esp + 0x20]
push 0
jmp 0x5e6261
push dword [esp]
pop dword [esp]
call fcn.005e622f
push esp
jecxz 0x5e62c7
push ss
in eax, 0x20
stosb byte es:[edi], al
and al, 0xba
invalid
pushfd
push esp
mov dword [esp], eax
mov word [esp], bx
mov word [esp], di
jmp 0x5e6246
setne bl
mov bx, 0xd4d
push dword [esp + 2]
lea esp, [esp + 7]
xchg byte [esp], bl
lea ebx, [eax - 0x69]
jmp 0x5e6343
xor eax, 0x893fcca5
movsb byte es:[edi], byte [esi]
push esp
push dword [esp]
pop dword [esp]
xchg bl, bh
mov bx, 0x4b8f
mov dword [esp], ebp
jmp 0x5e62a6
lea esp, [esp + 1]
push ebp
call fcn.005e6324
pop bp
push edx
mov ebx, esi
lea esp, [esp + 3]
mov dword [esp + 7], esi
jmp 0x5e63c5
lea ebp, [eax + ebx]
lea ebp, [ebx + esi]
mov bl, bh
lea esp, [esp + 1]
mov ebp, dword [esp + 0x2c]
mov bl, 0x9e
jmp 0x5e63a4
lea esp, [esp + 2]
mov esi, dword [esp + 7]
mov bp, bx
pushal
lea esp, [esp + 0xf]
xchg byte [esp + 0xa], bl
jmp 0x5e6372
mov bl, byte [esp]
lea ebx, [eax*4]
xchg bl, bh
mov bx, word [esp]
lea ebx, [ebp*4]
xchg bl, bh
jmp 0x5e6404
lea ebp, [ebp*4]
push esp
xchg byte [esp + 2], bl
pop si
mov si, word [esp]
mov bp, dx
jmp 0x5e638e
mov ebx, dword [esp + 0x31]
lea esp, [esp + 0x38]
cmp dword [esp + 4], 0
jne 0x5e61f1
je 0x5e6773
insb byte es:[edi], dx
sti
imul ecx, dword [esi], 0xfffffffd
inc ebp
inc edx
fdiv qword [edx + 0x15]
in al, 0x5a
test eax, 0x96b36bc8
mov bl, 0x96
mov bl, bh
xchg bh, bl
mov bx, word [esp]
xchg bl, bh
mov ebx, 0xe177e492
jmp 0x5e63dc
call 0x5e6495
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
invalid
inc dword [esp + 8]
popfd
ret 4
pop eax
sub eax, 0x73ebad7
jmp 0x5e6485
pushal
jmp 0x5e41c9
Function at 0x5e6549
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5e6527
mov dword [esp + 0x28], eax
jmp 0x5e61f6
call 0x5e432b
jmp 0x5e6550
popal
pushal
lea esp, [esp + 0x20]
jmp fcn.005e64a9
add ebx, 0xff4c54ba
cmp ebx, 0xff4c5586
je 0x5e6568
jne 0x5e425f
insd dword es:[edi], dx
jmp 0x5e6590
pop ecx
sub ecx, 0x1000eaf6
mov dword [ecx + 0x10010af0], eax
movzx ebx, byte [eax]
jmp 0x5e64fe
call 0x5e6549
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
or eax, 0x168fbcad
sbb dword [eax + 0x2d], 0x45e552ff
pop eax
sub eax, 0x45e552ff
jmp 0x5e6539
or eax, 0x81721787
dec esp
mov edx, 0x83b70495
jl 0x5e6599
add al, 0
jne 0x5e65d2
pushal
jmp 0x5e4326
cmp dword [ebx + 0x24648dc2], ebp
add al, 0xeb
invalid
jmp 0x5e65e8
inc dword [esp + 8]
jmp 0x5e6641
popfd
ret 4

Function at 0x5e6a67
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, byte [esp + 3]
mov ch, 0x30
mov dword [esp + 0xd], edx
lea ecx, [esi + 0x15]
lea edx, [ecx*4]
lea edx, [edi + ebp]
jmp 0x5e6a0c
lea ecx, [esi - 0xbd]
jmp 0x5e6a2e

Function at 0x5e78b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x5e4aef
push 0
jmp 0x5e4bae
call fcn.005e4af4
jmp 0x5e77a5
mov dword [esp + 0x28], eax
jmp 0x5e77cf
call 0x5e4b85
jmp 0x5e7854
call 0x5e4bb3
jmp 0x5e788e
call 0x5e4d63
jae 0x5e4dd1
jb 0x5e4dcd
arpl word [ecx + 0x74], sp
add cl, ch
out 0x2b, al
add byte [eax], al
push ebp
les esi, [edi + 0x72]
xor ah, byte [esi + 0xf]
mov ebp, 0x12ec83cd
call 0x5e7761
aas
aas
xor al, byte [eax + 0x59]
inc ecx
push eax
inc ecx
pop eax
dec ecx
inc eax
pop edx
add byte [eax - 0x18], dl
scasd eax, dword es:[edi]
xor al, 0xff
invalid
je 0x5e48dd
jne 0x5e774f
pop ecx
sub ecx, 0x1000f3ec
mov dword [ecx + 0x10011fb2], eax
jmp 0x5e780d
pop eax
sub eax, 0x85b9316f
call dword [eax - 0x7a4831c8]
jmp 0x5e784d
lea esp, [esp + 4]
ret
popal
popfd
jmp 0x5e77b6
je 0x5e787a
jne 0x5e4b1d
xchg dword [edx], edx
and bh, 0x12
cmpsd dword [esi], dword es:[edi]
adc ecx, dword [edx + 0x6ec75425]
movzx ebx, byte [eax]
add ebx, 0xbd953fe1
cmp ebx, 0xbd9540ad
jmp 0x5e77f5
test eax, eax
jmp 0x5e777c
pop eax
sub eax, 0x69e2aeae
jmp 0x5e78a6
jne 0x5e78dc
pushal
jmp 0x5e4b80
arpl sp, di
xchg edx, eax
cmc
add al, 0xb7
dec ecx
call 0x2d3c1a91
pushfd
cmp dword [esp + 4], 0
jmp 0x5e786c
mov eax, dword [esp]
pushal
lea esp, [esp + 0x24]
sub eax, 0xd42a7387
jmp 0x5e78c4
call 0x5e78b6
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
out 0x4a, al
loope 0x5e7925
test eax, eax
jmp 0x5e79c3
call dword [eax - 0x2bd6f06f]
jmp 0x5e78bc
jmp 0x5e790c
popfd
ret 4
inc dword [esp + 8]
jmp 0x5e78f4
jmp 0x105f6dc7
je 0x5e499b
jne 0x5e4d56

Function at 0x5ef056
Capabilities:
Encode data using xor

Disassembly:
jmp 0x5d89e6
xor ecx, ecx
lea esp, [esp + 4]
pushal
lea esp, [esp + 0x20]
jmp 0x5d89db
Function at 0x60c2ce
Capabilities:
Encode data using xor

Disassembly:
test bl, ah
push ds
fcomp dword [ebx + ecx*4]
sbb edi, dword [esi - 0x73]
xor eax, 0xc5a22cb2
xor al, 0x8a
movsb byte es:[edi], byte [esi]
cmp dword [ecx - 0x7975c438], ebp
sbb cl, byte [eax - 0x1b5be511]
jg 0x60c2dc
mov bh, byte [ecx + 0x46]
push eax
invalid

Function at 0x620737
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
jmp 0x620881
mov eax, 0x148bb721
and al, 0x66
bsf edx, esi
mov edx, dword [esp]
bsf dx, si
call fcn.0062082c
jp 0x620794
jg 0x6207c1
jmp 0x966297f0
add al, 0xdc
inc edx
jp 0x620797
mov edx, dword [esp]
jmp 0x6207d9
and esi, dword [ebx - 0xc69da2a]
cli
popfd
insb byte es:[edi], dx
fist dword [ecx]
nop
adc eax, dword [esi - 0x7229752a]
and al, 1
xchg dh, dl
mov dl, dh
lea esp, [esp + 1]
jmp 0x620801
bsf dx, si
jmp 0x62079e
xchg dh, dl
mov dl, dh
lea esp, [esp + 1]
jmp 0x6207b6
lea esp, [esp + 3]
setge dh
mov byte [esp], bh
shr dx, cl
jno 0x6207f9
jo 0x6207cf

Function at 0x62082c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
jmp 0x620803
lea esp, [esp + 8]
rol al, 0
mov dx, 0x195f
mov dh, bh
mov dh, byte [esp + 3]
rcr edx, 0x17
jg 0x6207df
push dword [esp + 2]
jmp 0x620803

Function at 0x633b21
Capabilities:
Encode data using xor

Disassembly:
arpl ax, ax
inc ecx
sal dword [eax + 0x282f743], 1
nop
test dword [edx], 0x57c740c6
mov al, 0x43
test dword [edx + 0x2f79002], 0x57c740c6
xor al, cl
or edi, esi
js 0x633ad4
mov dword [eax - 0x35], edi
rcl byte [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
out dx, al
inc edx
invalid
imul esi, dword [esi + ecx - 0x7f8ee980], 0xad3db03e
mov ah, 0x47
or byte [esi], 0x9c
pushfd
pushfd
sti
push ss
aad 0x10
mov dword [0x16a55633], eax
jbe 0x633b11
jp 0x633b4c
in al, dx
sub al, byte [eax + 0x13e08111]
mov byte [0x67009202], al
xchg edx, eax
adc byte es:[edi], 0x87
loop 0x633b53
lodsb al, byte [esi]
push ds
mov byte [esi], bl
jns 0x633ad0
cmp eax, 0xdcb525b0
das
fsubr qword [edi]
lcall 0x985e, 0xa3c456c2
pop esi
cwde
push eax
retf

Function at 0x63c1ac
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x86
xor byte [ebp + 0x47d7451e], bl
and dl, cl
sbb ebp, ebx
dec eax
fidivr word [ecx - 0x1a8202b8]
jne 0x63c1dd
out dx, eax
push edx
lea edx, [esi]
test bl, ah
push ds
mov eax, dword [0x7e1b8b1d]
lea ecx, [ebp - 0x4b]
sub al, 0xa2
lds esi, [edx + ecx*4]
xor al, 0x8a
movsd dword es:[edi], dword [esi]
cmp dword [ecx - 0x7a78c438], ebp
sbb cl, byte [eax - 0x1a56e511]
jg 0x63c1d3
mov bh, ch
sbb ch, byte [ecx - 0x7510801b]
jns 0x63c220
mov bh, byte [ecx + 0x39]
int 0x50
invalid
dec esp
mov edi, 0x34a62c79
push ebx
scasb al, byte es:[edi]
pop ds
pop esi
fisttp dword [ebx + 0x2e]
fstp qword [ecx]
mov ah, 0x3c
sal byte [ebp + 0x982fa44], cl
cdq
clc
or ecx, edx
and al, 0xaa
cmp byte [edi - 0x56], bl
adc al, 0x46
iretd
Function at 0x63d6e4
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x75
sbb al, 0xef
pop esi
xchg edx, eax
push ss
test bl, ah
push ds
stosd dword es:[edi], eax
add byte [ebx + 0x4f8d7e1b], cl
cmpsb byte [esi], byte es:[edi]
sub al, 0xa2
lds esi, [eax*4 - 0x3756c650]
cmp edi, ebx
xchg edx, eax
xor al, 0x85
mov al, 0x39
test eax, 0x92fb3bc8
sbb cl, byte [eax - 0xf5be511]
jg 0x63d6f9
mov bh, byte [ecx + 0x44]
ficom word [eax - 0x3a]
mov eax, dword [0xcd40ee50]
pop ebp
and al, 0xd7
arpl dx, dx
pop esi
int3

Function at 0x648580
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xce
mov ebp, dword [esi + 0x1e]
in eax, dx
mov bh, 0xe4
dec esi
invalid
invalid
outsd dx, dword [esi]
call [edx - 0x7ff43997]
push ss
jno 0x64850a
inc edx
mov bh, 0x3d
lodsd eax, dword [esi]
mov ah, 0x47
sti
xchg dword [esi], ecx
pushfd
sti
push ss
aad 0x13
mov dword [0x1da55633], eax
imul esp, esp, 0x7a
sbb eax, 0x119f5aec
and eax, 0x921fd213
add byte [edi - 0x6e], ah
daa
adc dword [edi], 0xffffff87
loop 0x6485c5
fstp dword [ebx]
mov byte [esi], bl
jns 0x648542
cmp esi, dword [edi + 0x2fdcb525]
cdq
invalid
pop esi
in eax, dx
push ebx
retf

Function at 0x648c46
Capabilities:
Encode data using xor

Disassembly:
invalid
in al, 0x7a
sbb eax, 0x119f5aec
and eax, 0x921fd213
add byte [edi - 0x6e], ah
daa
adc dword [edi], 0xffffff87
loop 0x648c6d
fstp dword [ebx]
mov byte [esi], bl
jns 0x648bea
cmp esi, dword [edi + 0x2fdcb525]
cdq
invalid
pop esi
in eax, dx
push ebx
retf
Function at 0x40fff0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x410012
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x410019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x410008
mov eax, 1
add ebx, ebx
jne 0x41002b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x410020
jne 0x41003c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410020
xor ecx, ecx
sub eax, 3
jb 0x410050
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4100c2
mov ebp, eax
add ebx, ebx
jne 0x41005b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x410068
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41008c
inc ecx
add ebx, ebx
jne 0x410078
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41006d
jne 0x410089
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41006d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4100ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41009d
jmp 0x41000e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4100ac
add edi, ecx
jmp 0x41000e
pop esi
mov edi, esi
mov ecx, 0xc3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4100ca
cmp byte [edi], 1
jne 0x4100ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4100cf
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x410147
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10fe4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11098]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4100fc
mov ecx, edi
jns 0x41012b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1109c]
or eax, eax
je 0x410141
mov dword [ebx], eax
add ebx, 4
jmp 0x410119
call dword [esi + 0x110a0]
popal
jmp 0x40670a