joyce8/EMBER2024-capa huggingface dataset:
Function at 0x589ee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6451c4
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6cd498]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
sub esi, dword [ebp + 0xc]
lea ecx, [edi + 1]
lea ebx, [esi + 1]
test ecx, ecx
je 0x589fbb
test ebx, ebx
je 0x589fbb
push 0x40
call fcn.0059c8fd
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x589f50
mov ecx, eax
call fcn.0058e170
mov ecx, eax
jmp 0x589f52
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
lea eax, [edi + 1]
cmp ebx, eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x10]
cmovle esi, edi
inc esi
mov dword [ecx + 0x24], esi
movzx eax, word [eax + 0x8c]
imul eax, dword [ebp + 0xc]
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
add eax, edx
mov dword [ecx + 0x28], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x58e2d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64533d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6cd498]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x759e48], edi
lea esi, [edi + 0x6c]
mov dword [edi], vtable.CSoundManager.0
push 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0059c8fd
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x43480000
mov dword [edi + 0x1c], 0x447a0000
mov dword [edi + 0x20], 0x3f800000
mov dword [edi + 0x24], 0x3f800000
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x68], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5a0a20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x5a0b51
test al, 3
jne 0x5a0b51
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x5a0b0c
cmp edi, 8
jb 0x5a0ad5
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x5a0a84
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x5a0b10
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x5a0af2
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x5a0b14
xor edi, edi
jmp 0x5a0b14
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x5a0b28
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x5a0c10
cmp ecx, 0x20
jb 0x5a0bea
mov esi, ecx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x1c], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x5a0b85
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x5a0c10
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x5a0c00
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x5cb710
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x646938
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x6cd498]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x5cb786
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x5cb786
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x5cb7a4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059c8be
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.0043f8b0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.005cb870
push 0x6b6990
lea eax, [ebp - 0x50]
push eax
call fcn.005d82e7
int3

Function at 0x5fadc8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005faa79

Function at 0x5fadd3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005fac03

Function at 0x605209
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00604d5c

Function at 0x60553d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006054bf
Function at 0x6128b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64a2c2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6cd498]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00506e50
mov dword [edi], vtable.CSkyObject.0
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea esi, [edi + 0x134]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0059c8fd
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1bc], 0
mov dword [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0
mov dword [edi + 0x1c8], 0x3f800000
mov dword [edi + 0x1cc], 0x3f800000
mov dword [edi + 0x1d0], 0x3f800000
mov dword [edi + 0x1d8], 0
mov dword [edi + 0x1e8], 0
mov dword [edi + 0x1ec], 0xf
mov byte [edi + 0x1d8], 0
lea ecx, [edi + 0x1f4]
mov byte [ebp - 4], 3
call fcn.00514ee0
mov dword [edi + 0x174], 0
mov dword [edi + 0x170], 0
mov dword [edi + 0x16c], 0
mov dword [edi + 0x168], 0
mov dword [edi + 0x160], 0
mov dword [edi + 0x15c], 0
mov dword [edi + 0x158], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x148], 0
mov dword [edi + 0x144], 0
mov dword [edi + 0x140], 0
mov dword [edi + 0x178], 0x3f800000
mov dword [edi + 0x164], 0x3f800000
mov dword [edi + 0x150], 0x3f800000
mov dword [edi + 0x13c], 0x3f800000
mov dword [edi + 0x1b4], 0
mov dword [edi + 0x1b0], 0
mov dword [edi + 0x1ac], 0
mov dword [edi + 0x1a8], 0
mov dword [edi + 0x1a0], 0
mov dword [edi + 0x19c], 0
mov dword [edi + 0x198], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x18c], 0
mov dword [edi + 0x188], 0
mov dword [edi + 0x184], 0
mov dword [edi + 0x180], 0
mov dword [edi + 0x1b8], 0x3f800000
mov dword [edi + 0x1a4], 0x3f800000
mov dword [edi + 0x190], 0x3f800000
mov dword [edi + 0x17c], 0x3f800000
mov byte [ebp - 4], 4
mov dword [edi + 0xf8], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf0], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xfc], 0x3f800000
mov dword [edi + 0xe8], 0x3f800000
mov dword [edi + 0xd4], 0x3f800000
mov dword [edi + 0xc0], 0x3f800000
mov ecx, dword [0x759dd8]
call fcn.004f0f40
mov dword [edi + 0x130], eax
mov eax, edi
mov dword [edi + 0x128], 0
mov dword [edi + 0x12c], 0
mov word [edi + 0x1f0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
fcomp qword [ebx]
push 0x2abacb3f
aas
add dword [ecx], esi
push edi
xor dword [ecx + edi*4], 0xaeca7e23
mov ebx, 0xd6544000
aam 0x63
scasb al, byte es:[edi]
ror dword [ecx], 0xf6
pop ebp
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
mov ebp, 0xd4c5f8b4
xor byte [edi - 0x40], bh
xor eax, 0x77d2ee39
push ecx
push esp
fmul qword ss:[ebx]
cmp byte [esi], 0xcb
add esi, edx
inc esp
mov dword [edi + 0x613479c1], ebp
jge 0x4153c1
mov ss, word [ebp + 0xe]
xor dword [ecx + ebp*8], 0x7e
mov al, 0x75
push ecx
salc
nop
retf
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x79e359d0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x40eb1748
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4843a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4e000]
mov dword [edi + 0x70d18], 0x2eeb9eeb
push edi
jmp 0x4843ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4843d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4843c0
mov eax, 1
add ebx, ebx
jne 0x4843e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4843f4
jne 0x484413
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484413
dec eax
add ebx, ebx
jne 0x484400
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4843d8
add ebx, ebx
jne 0x48440f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x484465
xor ecx, ecx
sub eax, 3
jb 0x48442b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48449a
sar eax, 1
mov ebp, eax
jmp 0x484436
add ebx, ebx
jne 0x484436
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484404
inc ecx
add ebx, ebx
jne 0x484444
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484404
add ebx, ebx
jne 0x484451
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x484446
jne 0x484462
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x484446
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x484484
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x484476
jmp 0x4843c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x484484
add edi, ecx
jmp 0x4843c6
pop esi
mov edi, esi
mov ecx, 0x321f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4844a2
cmp byte [edi], 0x16
jne 0x4844a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4844a7
lea edi, [esi + 0x81000]
mov eax, dword [edi]
or eax, eax
je 0x48451f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x88620]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8873c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4844d4
mov ecx, edi
jns 0x484503
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x88744]
or eax, eax
je 0x484519
mov dword [ebx], eax
add ebx, 4
jmp 0x4844f1
call dword [esi + 0x88740]
mov ebp, dword [esi + 0x88748]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x484553
sub esp, 0xffffff80
jmp 0x4349ef
Function at 0x806150
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x806156
pop ebp
sub ebp, 6
sub ebp, 0x406150
jmp 0x8061b4
fcom dword [esi + 0x6a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
test byte [esi + edx*8 + 0x6150b839], 0x40
add byte [ebx], al
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x633], bh
jmp 0x8061bd
mov eax, 0x406150
add eax, ebp
add eax, 0x93
mov ecx, 0x633
mov edx, 0x34351824
xor byte [eax], dl
inc eax
dec ecx
jne 0x8061d4
jmp 0x8061e7
add bh, dh
rcl byte [ebx - 0x47]
dec esi
dec esp
and al, 0x34
and al, 0x24
dec esp
and al, 0xe8
or byte [0x7ef9e5d4], ah
jecxz 0x80619f
aam 0xe5
stc
jle 0x8061e2
pop ss
in al, 0x74
invalid
Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
sub ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
push esi
pop edi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
push edi
pop ecx
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x805e78
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805e7e
pop ebp
sub ebp, 6
sub ebp, 0x405e78
jmp 0x805edc
jmp 0x805ee5
mov eax, 0x405e78
add eax, ebp
add eax, 0x93
mov ecx, 0x621
mov edx, 0xaf70f685
xor byte [eax], dl
inc eax
dec ecx
jne 0x805efc
jmp 0x805f0f
out dx, eax
invalid
Function at 0x416153
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416192
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416192
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416192
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x416192
cmp dword [ecx + 0x74], 0xe
jbe 0x416192
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42858d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42858d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x98c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0098c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x98c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x98c06a
add dl, dl
jne 0x98c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x98c0dc
xor eax, eax
add dl, dl
jne 0x98c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x98c17d
add dl, dl
jne 0x98c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x98c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x98c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x98c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x98c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x98c075
mov eax, 1
add dl, dl
jne 0x98c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x98c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x98c0e1
sub eax, ebx
mov ebx, 1
jne 0x98c128
mov ecx, 1
add dl, dl
jne 0x98c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x98c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x98c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x98c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x98c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x98c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x98c136
cmp eax, 0x7d00
jae 0x98c16d
cmp eax, 0x500
jb 0x98c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x98c075
cmp eax, 0x7f
ja 0x98c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x98c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x98c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x98c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x8e1068
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e106e
pop ebp
sub ebp, 6
sub ebp, 0x4e1068
jmp 0x8e10cc
jmp 0x8e10d5
mov eax, 0x4e1068
add eax, ebp
add eax, 0x93
mov ecx, 0x618
mov edx, 0x45e2bb8c
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e10ec
jmp 0x8e10ff
out 0xcc, al
in al, 0x8c
pushfd
mov word [esp - 0x735fbf74], cs
or eax, 0x12027e7c
leave
or eax, 0x12027e7c
leave
mov edi, 0x1973dc4c
mov al, 0xdd
enter 0xffffffffffffdc8c, 7
inc ecx
pop es
add eax, 0x8c8c8cb0
or eax, 0x8c8c744d
mov word [edi - 0x7375cbbf], cs
mov word [esi + esi - 0x7373735c], cs
jnp 0x8e11ab
pop dword [edi + eax + 0xd]
or byte [esp + ecx*4 - 0x23b67074], 0xe4
push 0xe48c85b9
push cs
push esi
enter 0xffffffffffff8d8c, 0xffffffffffffffa0
test al, 0xe4
mov word [esp + ecx*4 - 0x73769b74], cs
mov word [ebp - 0x7373735c], cs
fld dword [edi]
pushal
pop es
or dword [esp + ecx*4 + 0x19078c8c], eax
or byte [esp + ecx*4 - 0x63fef874], 0x8c
mov dword fs:[esp + ecx*4 - 0x735b9a74], ecx
mov word [ecx + ebx*8 + 0x9076007], cs
test byte [esp + ecx*4 - 0x7fe6f874], cl
mov word [esp + ecx*4 - 0x7363fef9], cs
mov word [ebp + ecx*2 - 0x7142719b], cs
cmovle ecx, dword [eax + 0x780983c5]
jae 0x8e11fa
jae 0x8e115a
dec esi
or byte [edi + eax - 0x73775800], 0x8c
mov esp, fs
push 0xe48c85b9
push cs
push esi
enter 0xffffffffffff8d8c, 0xffffffffffffffa0
test al, 0xdd
mov dword fs:[esp + ecx*4 - 0x71409a74], ecx
mov word [ecx + ebx*8 - 0x68c2e28], cs
frstor dword [ecx + ecx*4 - 0x74]
mov word [ebp - 0x73737141], cs
fstpnce st(0), st(0)
sal dword [ebx - 7], 1
stc
xor byte [ebx - 7], 0x84
ljmp 0x8431
test eax, 0x8c990883
mov word [ebp + ecx*8 + 0x73734065], cs
jae 0x8e11a0
movsd dword es:[edi], dword [esi]
sal byte [ebp - 0x76b2f073], 0xf
mov byte fs:[ebp + 0x31], ah
jae 0x8e127b
jae 0x8e11af
fdiv dword [ebp - 0x75b2f072]
pcmpgtd mm1, qword [eax + 0x6589640f]
daa
jae 0x8e128d
jae 0x8e11ed
dec esi
or byte [ecx + ebx*8 - 0x24259ff9], 0xd9
pop es
stc
add byte [edi], 0xf1
test byte [eax + 0x3e], dh
or al, 6
mov cl, byte [0x8c8c8d4a]
mov word [ebx + ecx*4], es
or eax, 0x8c8c8d4b
invalid
lea ecx, [esp + ecx*4 + 0x9835e8e]
mov dword [esp + ecx*4 - 0x3565f974], ecx
sahf
pop esi
lahf
dec esp
mov ds, word [esi - 0x7d]
or dword [ecx + 0x68c8c8c], ecx
lcall 0x8e4c, 0x9f5e9eca
pop esi
or dword [ecx], 0xffffff89
mov word [esp + ecx*4 - 0x613565fa], cs
pop esi
lahf
dec esp
mov ds, word [esi - 0x7d]
or dword [ecx + 0x68c8c8c], ecx
lcall 0x834c, 0x9f5e9eca
or byte [edx + 0x78c8c8c], cl
push ebx
cmpsd dword [esi], dword es:[edi]
push esp
push es
pop dword [ebx + ecx*4]
retf
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219