joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4059d6
Capabilities:
Access peb ldr_data
Delete file
Get kernel32 base address
Get number of processors

Disassembly:
sub esp, 0xd0
mov eax, dword [0x51b640]
xor eax, esp
mov dword [esp + 0xcc], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x24
mov dword [esp + 0x14], ebx
call fcn.00406b09
pop ecx
mov esi, eax
push 0x64
pop ebp
test esi, esi
je 0x405a3c
push str.Window1
lea ecx, [esp + 0xc8]
call fcn.004022bb
lea eax, [esp + 0xc4]
push eax
push ebp
push ecx
push ecx
mov dword [esp + 4], 0x40000000
mov ecx, esi
mov dword [esp], 0x40400000
call fcn.00402314
mov esi, eax
inc ebx
jmp 0x405a3e
xor esi, esi
test bl, 1
je 0x405a4f
lea ecx, [esp + 0xc4]
call fcn.00403eb0
test esi, esi
je 0x405a70
mov ecx, esi
call fcn.004031f4
test esi, esi
je 0x405a70
lea ecx, [esi + 0xc]
call fcn.00403eb0
push 0x24
push esi
call fcn.00406b39
pop ecx
pop ecx
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x51c5d8], eax
push 0x27
push 0x51b030
push 0x547
mov edi, 0x51b058
push edi
call fcn.00402f88
push 1
push 0x424478
call fcn.00405be2
push 0x8aafdc01
push dword [0x51c5d8]
call fcn.00402ee9
add esp, 0x20
lea ecx, [esp + 0x14]
mov ebx, str.static.lib
mov esi, eax
push 1
push 0x40
push 2
push ebx
call fcn.00402107
lea eax, [esp + 0x14]
push 0x424488
push eax
call fcn.004010ef
push eax
call fcn.00401ea3
add esp, 0xc
sub ebp, 1
jne 0x405ad6
lea ecx, [esp + 0x14]
call fcn.004040ed
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x4e4
push edi
call esi
test eax, eax
je 0x405b65
call fcn.0040511c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x400
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405b65
push 0x42448c
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
xor ebx, ebx
push ebx
push ebx
push eax
push esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [esp + 0x14]
call fcn.00402c98
mov ecx, dword [esp + 0xdc]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406b4c
add esp, 0xd0
ret 0x10

Function at 0x4078ca
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407909
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407909
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407909
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407909
cmp dword [ecx + 0x74], 0xe
jbe 0x407909
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4158c7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4283d0
push 0x4283c8
push str.FlsAlloc
push 0x1e
call fcn.00415791
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4158fb
push dword [ebp + 8]
mov ecx, esi
call dword [0x424148]
call esi
jmp 0x415901
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x68a15974
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xde90ab1
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x11219058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.112191a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1121907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1121906a
add dl, dl
jne 0x11219089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x112190dc
xor eax, eax
add dl, dl
jne 0x11219096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1121917d
add dl, dl
jne 0x112190a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x112190b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x112190bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x112190c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x112190d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11219075
mov eax, 1
add dl, dl
jne 0x112190ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x112190f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x112190e1
sub eax, ebx
mov ebx, 1
jne 0x11219128
mov ecx, 1
add dl, dl
jne 0x1121910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11219119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11219105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11219075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1121913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1121914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11219136
cmp eax, 0x7d00
jae 0x1121916d
cmp eax, 0x500
jb 0x11219168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11219075
cmp eax, 0x7f
ja 0x11219170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11219075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1121919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11219075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0xd68b7c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xd68886
and edi, ebx
call fcn.00d68bb0
add ebx, 0xe5734f31
xor dword [edx], ecx
dec edi
add edx, 2
inc edi
dec ebx
sub edi, ebx
cmp edx, esi
jl fcn.00d68b7c
add edi, 0xd362393c
ret
Function at 0x5adf07
Capabilities:
Encode data using xor

Disassembly:
add edx, dword [edx + edx*2 - 0x2bf5ee26]
or dl, ah
sar dword [ecx - 0x40], 1
pop ecx
movsb byte es:[edi], byte [esi]
enter 0x6c4c, 0x47
mov esp, esp
xor bl, byte [edx]
or edx, 0x7282676d
jo 0x5adf01
mov dl, 0xc1
dec byte [bx + si + 0x57f3]
sahf
cmp dl, byte [edx]
xor eax, 0x14eab08b
pop ecx
jae 0x5adf34
jae 0x5adefc
neg dh
mov dword [0xb370402d], eax
and byte [edi], al
pop es
mov esi, 0x83ef611e
salc
rcr dword [edi + 0x30fae8a3], 0x5e
xor bx, word [esi]
xor bl, bh
dec esp
cmp al, 0xdf
mov esi, dword [esi - 0x76edeabb]
push edi
mov byte [0x8450f7e8], al
ljmp 0x81a6

Function at 0x5f8bb7
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x95839867], eax
jp 0x5f8b76
pushfd
sahf
je 0x5f8bc1
mov byte [0xe6610e63], al
fucom st(5)
invalid
je 0x5f8bd4
dec edx
out 0xe1, al
daa
dec edx
xchg ebp, eax
add byte [esi], 9
xchg bx, ax
xchg ebx, eax
push esp
xchg esp, esp
xchg ebx, eax
xor al, 0xe1
push es
push esp
jb 0x5f8bb6
and edx, dword [eax - 0x7d]
pop ecx
jns 0x5f8b76
mov esi, 0xe4162308
std
or byte [ebx], ah
push ss
in al, 0xfd
in eax, 0x71
salc
or ah, byte [eax + 0x2b75159c]
mov al, byte [0x2b75159c]
and edi, dword [ecx]
dec ecx
wait
cmp edx, eax
mov dword [0xd87d01ec], eax
push ss
jge 0x5f8bdd
push ebx
jbe 0x5f8b9a
inc ecx
loop 0x5f8b88
xchg edi, eax
xchg ebp, eax
in al, 0x45
inc ebp
add eax, 0xa586b41b
in eax, 0x9b
sti
xlatb
xor ah, byte [ebx]
out 0xfd, al
test byte [edi - 0x2a], bh
and eax, dword [eax - 0x16cfeece]
insd dword es:[edi], dx
insd dword es:[edi], dx
in eax, 0x4b
jae 0x5f8be3
mov bl, 0x19
pop esp
jno 0x5f8ba6
jae 0x5f8c3f
xchg edi, eax
ficomp word fs:[esi - 0xb]
dec edi
dec ebp
dec esi
pop ss
inc ebp
pop es
sbb ebx, ecx
sahf
cmp dword [edx - 0x3f], edx
xchg ebx, eax
add eax, 0xfef227f3
invalid
imul esp, dword [esi + 0x38de03c6], 0x13a31096
jmp 0x5f8cac
adc byte [edx], cl
fcomi st(2)
loopne 0x5f8d30
retf
hlt
Function at 0x643467
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0xe62ac195
fstp xword [esi + 0x2c]
ror byte [edi - 0x28483db0], cl
lds ebp, [ecx]
test al, cl
ret 0xd6eb
sbb al, 0xa6
mov cl, byte [edx + ebx*4 + 0x22]
dec edx
outsb dx, byte [esi]
cli
test ch, al
mov dword [0x5a3cfea2], eax
jae 0x643433
popfd
fiadd word [edi]
loop 0x643468
in al, 0x64
dec ebx
or edx, dword [edx + ecx*8 - 0x35]
invalid
mov ah, byte [edx + 0x53bc10fb]
mov byte [0x53bc10fb], al
xchg edi, eax
push edi
lcall 0x4a80, 0x4a83ff56
jbe 0x64347c
jmp 0x643404
nop
xor ecx, edx
dec eax
inc edx
push 0x37082a69
pop ds
outsb dx, byte [esi]
pop eax
imul esi, dword [edx], 0xffffffe4
push edi
mov word [ebp - 0x9d5beb9], es
sub al, byte [ebx - 0x1011ae21]
jbe 0x643423
jo 0x6434e4
sar dword [ebp + 0xd], cl
or edx, dword [ebx + 0x33333d9a]
jmp 0x643488
dec ebp
inc edx
scasb al, byte es:[edi]
or eax, 0xf5132273
jae 0x6434ee
adc esi, ebp
xor ah, byte [edx]
mov esi, ebx
xchg edi, eax
xor dl, byte [esi]
sbb bl, byte [esi - 0x4dcdc25]
sti
jae 0x643528
jb 0x6434ca
punpckhdq mm0, qword [ebp + 0x3e]
mov ecx, 0x3d65fd9f
shr dword [ebx], cl
xchg ebp, eax
insd dword es:[edi], dx
test eax, 0x28ebf85a
test eax, 0x28ebf85a
dec eax
mov al, 0xb1
xchg ebx, eax
xchg edi, eax
jp 0x6434c6
push ecx
push edi
mov byte [ecx + 0xc], bh
std
mov ebx, 0x98a3de31
pop es
wait
pushal
xchg edi, eax
xor al, 0x1f
ja 0x64350a
mov edx, 0x503988ca
ljmp 0x6af5
mov ebx, 0x33c577fe
sahf
jg 0x6434da
test al, 0x27
add eax, dword [eax + 0x37]
mov esp, dword [ebx - 0x28ac5858]
imul eax, esi, 0xffffffed
out 0x24, al
invalid

Function at 0x6d98f7
Capabilities:
Encode data using xor

Disassembly:
push ecx
dec edi
invalid
jns 0x6d9969
jo 0x6d98f2
clc
test al, 0x89
inc esp
push ds
add byte [esi], cl
mov dword [0xb3ee25f0], eax
call edx
lodsb al, byte [esi]
rcr dword [0xbd9bc297], 0xb2
mov edx, 0x6d531e14
xor dword [ebp + 0x26], ebp
cmpsb byte [esi], byte es:[edi]
popal
jp 0x6d98f8
push ds
xor eax, 0xc5ec4153
mov al, byte [0x9d26e9e2]
lcall 0xcbf, 0x56bff19b
push edi
pushfd
inc eax
mov ah, bh
pop edx
dec esp
rcl dword [ebp + ebp - 0x7b], 0xb6
in eax, dx
fcmovne st(0), st(3)
xor dword [edx + 0x787831b4], 0x1f
js 0x6d99ba
pop ds
sbb al, bl
aad 0
jge 0x6d9939
invalid
mov ebp, 0xfd5dad90
push esi
or eax, 0x6c076c7d
pop es
insb byte es:[edi], dx
jbe 0x6d9940
mov ebx, 0xfffd6f42
fisttp word [esi + eax]
js 0x6d99ad
add byte [ebx], ch
adc dword [esi], edx
nop
sub eax, 0xf6263d9e
ja 0x6d9974
not byte [edi + 0x26]
sub edx, esp
xchg esp, eax
cld
jg 0x6d99cf
invalid
dec esi
mov cs, word [ebx]
mov dl, 0xe9
xor dword [edx + 0x65], ebp
xor dword [ecx + 0x7063762b], edx
pop es
jo 0x6d99c3
imul ecx, esp, 0x3477e4d1
test al, 0xb7
rol dl, 1
scasb al, byte es:[edi]
fisttp qword [edx + 0x4c7c3991]
mov byte [ecx*8 + 0x78f28eac], dl
cmp eax, 0x8b49244f
inc ecx
jo 0x6d9a08
mov bh, 0xd0
ret 0xddae
int 0xac
invalid
dec ecx
mov eax, dword [ecx + 0x70]
sub al, 0x6c
insb byte es:[edi], dx
lahf
in al, 0x86
into
dec esi
jg 0x6d99d7
pushal
ret
invalid
Function at 0x725997
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xd8
xchg ecx, eax
lodsb al, byte [esi]
lea esi, [eax - 0x360b7b47]
add byte [0x1528211c], bh
jmp [esi]
xchg ebx, eax
inc edx
out 0x36, eax
or ebx, edx
pmaxub mm4, qword [ebx]
push edi
xchg byte [ebx - 0xc71a096], bh
and al, byte [edi + 0x6fba6b56]
mov esi, 0xe6379243
fisttp dword [edx]
jg 0x725876
rol dword [edx], cl
cmpsd dword [esi], dword es:[edi]
jbe 0x725918
lcall 0x1534, 0x1f2dc84f
push ds
sub al, 7
dec ebp
push es
xor al, 0x1f
xor eax, 0xe02b2c07
sar cl, cl
fcom st(3)
loope 0x7258b1
sbb dl, byte [ecx + 0x63]
dec eax
imul esp, dword [edx + 0x50], 0x85b77c7b
scasb al, byte es:[edi]
pop dword [esi + esi*4 - 0x51632863]
push ecx
arpl word [eax + 0x69], cx
bound edx, qword [eax + 0x7b]
jl 0x7258a8
test dword [esi - 0x62497b71], ebp
xlatb
pushfd
scasb al, byte es:[edi]
test dword [edi + ebp*4 + 0x7ab1b69d], esp
dec eax
arpl word [edx + 0x49], ax
jnp 0x725957
retf
inc eax
xchg esp, eax
xor bh, byte [ecx - 0x41]
jns 0x7258d8
mov edi, 0x2badcd6b
call [ecx + 0x20]
mov dl, 0x14
je 0x725917
imul ecx, ebp, 0xffffffad
sub edi, edi
pop ecx
and byte [esi - 0x4e], ah
adc al, 0x74
sbb bh, 0x19
sbb bh, 0x19
sbb bh, 0x19
int 0x6b
or ecx, dword [ebp - 0x3f7900a7]
adc al, 0xb2
rcl byte [eax + eax*4 + 0x26], cl
insd dword es:[edi], dx
stosd dword es:[edi], eax
jg 0x725914
mov ecx, 0x344deb3f
jb 0x7258e8
add byte [eax - 0x1a], ah
xor dl, byte [edx + edx*4 + 0x46268054]
rcl byte [edx + esi*4], 0xcb
lea ebx, [ecx - 1]
lahf
sbb ebp, ecx
imul esp, dword [eax], 0xffffffe6
and dh, ah
xor dl, byte [esp + esi*8 + 0x7900a672]
aas
jmp 0x7259b0
jg 0x725926
mov eax, dword [ebp - 0x19]
dec ecx
out 0x49, eax
push ebx
popfd
psraw mm7, mm3
xor eax, 0x4d8399b7
fbstp tbyte [ecx]
sub esp, ebp
push es
test al, 0xb2
jl 0x72599a
add byte [edx], bl
aam 0x56
js 0x725a14
lodsb al, byte [esi]
ror dl, 1
add al, 0xa6
or byte [edx], dl
fmul qword [esi - 0x60]
mov edx, 0xc2d8f674
or al, 0x9e
jo 0x725a30
movsb byte es:[edi], byte [esi]
les ebp, [edx + 0x70]
mov esi, 0x16d8c22c
xchg esp, eax
mov edx, 0x12fc6ea0
or dh, al
retf 0x1ed0
xchg edx, eax
ja 0x725993
arpl si, di
fbld tbyte [edx - 0x75]
push ss
jge 0x725a11
jmp 0x25aaf8a
call 0x9fd4f61a
jbe 0x725a06
retf 0x9e77
lock sbb dword [ebp - 0x6d930ee8], eax
outsd dx, dword [esi]
xchg byte [ebx], bl
cmp al, byte [edi - 0x1a670c92]
or al, 0x91
mov al, 0xd
in al, 0x79
dec esp
mov cl, 0x58
vmulps ymm6, ymm3, ymmword [eax - 0x2dc4b9d3]
dec edi
outsb dx, byte [esi]
sar dword [edx], cl
cmpsd dword [esi], dword es:[edi]
pop ecx
movsb byte es:[edi], byte [esi]
dec ebp
sal cl, 1
dec esp
movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x2e], dl
invalid
Function at 0x770b87
Capabilities:
Encode data using xor

Disassembly:
xor al, 0xc0
leave
xchg esi, eax
xor ebp, dword [eax + 0x57073880]
aas
dec ecx
mov dl, 0x21
push ebx
cmp al, 0x19
lodsb al, byte [esi]
and dword [ebx + edx - 0x75], ecx
add bh, byte [esp + esi - 0x67]
salc
sub eax, 0x92c2d5d7
daa
add esi, dword [ebx - 0xe1f4de3]
cld
push edx
sar dword [edi - 0x7513ed3e], 1
mov cl, 0x85
jnp 0x770bdc
dec edi
out dx, al
mov eax, 0x8372a886
ficom word [eax + 0x68076af8]
mov bh, 0xc1
dec dword [eax]
invalid
xchg edi, eax
mov ch, byte [edi]
fmul dword [ecx + 0x61]
sub byte [edi - 1], al
push esi
fcom dword [esi + 0x41]
invalid

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x6d982e
Capabilities:
Encode data using xor

Disassembly:
sub bh, dl
in eax, 0xc7
mov dh, 0xd7
mov al, byte [0x86d616bf]
mov edi, 0x13edb773
xchg ecx, eax
sti
push es
inc esi
cmp dword [ebx + 0x1356ac94], ecx
sar dword [ebx], 0x76
add dh, byte [esi + 0x12]
rol byte [ebp - 0x76c9ac7d], 0x44
xor dword [ebp + 0x5c87a5c1], esi
invalid
mov esp, 0xa0b290a2
test dword [ebp + 0xe], esi
jne 0x6d983e
jne 0x6d983e
loopne 0x6d9828
add al, 0x4b
xor dword [esi + 0x45], ebp
pop edi
push es
or eax, dword [edi + ebp - 0xe]
cmp dword [eax], esp
and byte [edi + edi*8], bh
and byte [eax], ah
cmp al, 0xff
xlatb
xor eax, 0x3375c4c6
xchg edi, eax
je 0x6d97e0
mov byte [0x7f0a30ae], al
push 0x48
push edi
bound eax, qword [edi]
and eax, 0xe07a723a
cmp byte [edx], cl
or byte [edx + 0x3e79b63b], dh
sub eax, 0x2504c8f0
jecxz 0x6d9832
adc al, byte [edi - 0x20]
mov dh, 0x9f
pop edx
invalid

Function at 0x6d9bde
Capabilities:
Encode data using xor

Disassembly:
sbb bl, bh
lahf
std
cmp dword [edi], 0x90a6bf37
lahf
pop ebp
insd dword es:[edi], dx
push esi
stosd dword es:[edi], eax
add byte [ecx + 0x6f6f7bd3], 0xd3
jbe 0x6d9c6b
push 0xffffffffffffffba
in eax, 0xfa
das
and byte [esi], 0xc1
in eax, 0x23
invalid
mov bl, 0x35
add dl, byte [eax + 0x7a]
jmp 0x72cfa13e
rcl byte [ecx], 0x1e
aam 0x36
ret
into
mov bl, 0xd5
shl edi, cl
push esp
mov esi, 0x78704232
mov word [edi], ss
popal
jne 0x6d9c05
jae 0x6d9c9b
popfd
pop esp
repne lodsd eax, dword [esi]
insb byte es:[edi], dx
jmp 0x6d9c40
and eax, 0xb0107056
rol byte [eax + 0x77], 1
sbb ebp, 0x3a
add eax, 0x5de95721
mov byte [edx + edi + 0x793bb6a5], dh
adc al, 0x1f
sub byte [edx], cl
jne 0x6d9ccb
ret 0x11b3
ret
Function at 0x4063bf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4063e3
xor eax, eax
test eax, eax
je 0x4063f6
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4063f6
xor ecx, ecx
jmp 0x4063f9
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
leave
ret 4

Function at 0x4064dc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406513
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4064ed
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4064e8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406544
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406526
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x749d338c
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x78f94c8f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x492e726e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x30834a6
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x411019
Capabilities:
Terminate process

Disassembly:
jmp 0x412330
jmp fcn.00413220
cmp ecx, dword [section..data]
jne 0x41233a
repz ret
jmp 0x4110af
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219

Function at 0x8ccba9
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x8cc92e
mov edx, eax
call fcn.008ccbe5
push 0x98a57cd2
pop edx
dec edx
xor dword [ebx], esi
mov eax, 0x8de29073
or edx, eax
or eax, eax
inc ebx
add eax, 0x566953fc
dec eax
dec eax
cmp ebx, edi
jne fcn.008ccba9
sub edx, 0x362c0486
ret
Function at 0x44305f
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0x2bd46
push section.packerBY
push 0x4434e3
call fcn.004434a8
cld
mov esi, 0x414000
mov ecx, 4
sub ecx, esi
cmp esi, 0x440290
ja 0x4430a7
lodsb al, byte [esi]
add al, 0x18
sub al, 2
jb 0x44309d
cmp al, 0x25
jne 0x443081
mov al, byte [esi]
and al, 0xf0
cmp al, 0x80
jne 0x443081
inc esi
lea edi, [esi + ecx]
sub dword [esi], edi
add esi, 4
jmp 0x443081
mov edx, 0x400000
lea esi, [edx + 0x4120c]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x44310a
add eax, edx
mov edi, dword [esi + 0x10]
mov ebx, dword [esi]
test ebx, ebx
jne 0x4430c6
mov ebx, edi
add ebx, edx
add edi, edx
push edx
push edi
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
pop edi
pop edx
test eax, eax
je 0x443108
mov ecx, eax
mov eax, dword [ebx]
test eax, eax
je 0x443103
btr eax, 0x1f
jb 0x4430eb
lea eax, [eax + edx + 2]
push ecx
push edx
push edi
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
pop edi
pop edx
pop ecx
test eax, eax
je 0x443108
stosd dword es:[edi], eax
add ebx, 4
jmp 0x4430db
add esi, 0x14
jmp 0x4430b2
popal
ret
popal
jmp 0x440130

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219