joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9c839e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
push eax
push esp
mov dword [esp], ebp
jmp 0x9c83a1
pushfd
jmp 0x9c8388
pop word [esp]
mov byte [esp], al
mov word [esp], si
lea esp, [esp + 2]
push ecx
pushal
jmp 0x9c846c
pop word [esp + 0xb]
mov word [esp + 0x13], si
lea esp, [esp + 2]
mov dword [esp + 0x18], edx
push dx
lea esp, [esp + 2]
call int.009c83d5
jmp 0x9c84d3
stc
jl 0x9c84bd
clc
rdtsc
jmp 0x9c84ef
clc
rdtsc
jmp 0x9c84ef
mov di, word [esp]
mov esi, 0xa83c579a
lea edi, [ecx*4]
mov esi, dword [esp + 0x2c]
lea ecx, reloc.MSVCRT.dll_strncpy
jmp 0x9c848b
lea edi, [esp]
mov bl, ah
lea eax, [esi + edi]
mov ecx, 0x5a69fca7
bsf cx, dx
jmp 0x9c852b
jnp 0x9c8541
jp 0x9c8541
outsd dx, dword [esi]
jmp [edi + 0xa]
sub esp, 0xc0
mov ebp, esp
mov cx, 0xcdf
jmp 0x9c8568
mov ecx, 0x4a13a9d1
bts edx, edx
jnp 0x9c89b3
jp 0x9c89b3
test al, 0xcb
mov dh, 0x44
mov dword [ecx + 0x21], esp
add cl, byte [edx - 0x7655df9f]
popal
lodsd eax, dword fs:[esi]
invalid
popal
and cl, ah
mov ah, byte [ecx - 5]
aam 0x89
popal
push ebx
mov edi, 0xb2df6190
lea esp, [ecx + 6]
pop ss
nop
popal
mov al, 0x1e
invalid
mov ah, byte [ecx + 0x68]
push esp
invalid
btc edx, ecx
sub esp, 8
dec edx
call fcn.009c8a04
jp 0x9c896c
jbe 0x9c899f
loopne 0x9c89e1
popfd
in al, dx
inc esi
jmp 0x9c897e
pop esp
and al, 1
neg ax
jne 0x9c8b11
je 0x9c8b11
jno 0x9c8a23
mov ecx, esi
inc edx
jl 0x9c8994
btc edx, ecx
sub esp, 8
dec edx
call fcn.009c8a29
jae 0x9c894d
xchg dword [esp], ebx
sbb al, 0x24
bswap ebx
stc
xchg ebx, eax
bt ax, bx
xchg bx, ax
jmp 0x9c89eb
or al, 0xf8
lea eax, [ecx + esi]
bsr edx, esp
jmp 0x9c89c5
push dword [esp]
ret 4
jl 0x9c8a74
salc
inc ecx
ret
or al, 0xd3
ret
bt ebx, edi
neg ax
mov bl, dl
jmp 0x9c8ab6
xchg dh, dl
jmp 0x9c8a9c
xchg bx, ax
mov bh, 0x84
not esi
lea ebx, [eax + ecx]
call fcn.009c8b29
mov bh, 0xdb
mov eax, 0xe774e743
cmp edx, edi
jg 0x9c8bba
jle 0x9c8b99
xchg edx, eax
lea esp, [esp + 8]
neg esi
bsr bx, di
jle 0x9c8ab2
xchg dh, dl
bt ebx, edi
neg ax
mov bl, dl
xchg bx, ax
jmp 0x9c8ab8
jmp 0x9c8ada
jmp 0x9c8b9d
not eax
jmp 0x9c8bbc
bswap edx
rcl eax, 8
xor esi, 0x1fc205fe
jmp 0x9c8bd1
not eax
sub esi, 0x1401625
xchg bx, ax
bsr ebx, ebx
jno 0x9c8b83
bswap edx
rcl eax, 8
jmp 0x9c8ba2
mov edx, 0xc75bc488
xchg ebx, eax
xor bx, 0x2e28
jg 0x9c8c4d
clc
mov al, byte [esp]
jmp 0x9c8c1a
jmp 0x9c8c2a
lea edx, [eax*4]
mov bx, 0x68a6
lea ebx, [esi + edi]
jmp 0x9c8c50
mov al, byte [esp]
not esi
neg ebx
jge 0x9c8bf7
jl 0x9c8bf9
push ecx
ret 0x3750
lea edx, [eax*4]
mov bx, 0x68a6
lea ebx, [esi + edi]
jmp 0x9c8c50
clc
jmp 0x9c8c17
add esi, dword [edi]
mov eax, 0x9fb223a6
lea eax, [edi + edi]
xchg ebx, eax
jmp 0x9c8c61

Function at 0x9e7eb4
Capabilities:
Encode data using base64

Disassembly:
jmp 0x9e7efd
lea esp, [esp + 4]
jb 0x9e79a9
stc
push bp
jmp 0x9e7f15
je 0x9e7951
pushfd
jmp 0x9e7f28
cmp bl, 0x2b
jmp 0x9e7ee7
lea esp, [esp + 2]
cmp bl, 0x39
jbe 0x9e7951
ja 0x9e79a9
lea esp, [esp + 4]
cmp bl, 0x2f
jmp 0x9e7f6d
jne 0x9b34ce
je 0x9e7951
Function at 0xafbd2f
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xb
xchg word [esp + 3], ax
xchg bp, di
mov al, ch
bswap eax
jmp 0xafbd89
mov ebx, dword [esp + 0x16]
xchg ch, al
cpuid
rcl edi, 0x19
mov cx, 0x3170
jmp 0xafbe2e
lea edi, [edi + edi]
mov bx, 0x630e
cpuid
inc edx
ror dh, cl
rdtsc
jmp 0xafbd73
lea ebp, [ebx*4]
mov dl, ah
mov dh, al
xchg dword [esp], esi
jmp 0xafbddd
rdtsc
mov byte [esp + 2], ch
mov byte [esp], ah
std
mov dl, 0x2f
neg eax
jmp 0xafbdb7
sub esp, 0x1f
not bp
pop word [esp + 0x15]
cld
mov byte [esp + 0x11], al
xchg edi, eax
jmp 0xafbe0a
rdtsc
mov bp, 0x3eb5
lea ebp, [ebp - 0xb5]
xchg ah, bl
mov ah, ch
xchg ecx, eax
jmp 0xafbdcd
popal
lea ebp, reloc.MSVCRT.dll_strncpy
mov ebp, edx
stc
bsf esi, esp
inc ah
jmp 0xafbe3f
cpuid
lea esp, [esp + 0xc]
mov cl, dh
add esp, 8
neg ah
neg edi
jmp 0xafbdf6
rdtsc
neg ecx
cpuid
mov ch, 0x93
bt bp, di
mov bp, word [esp]
jmp 0xafbed6
xchg byte [esp], ah
mov edx, dword [esp]
xchg di, si
call fcn.00afbeb2
cmpsb byte [esi], byte es:[edi]
and dword [ecx - reloc.MSVCRT.dll_strncpy], esi
and ecx, dword [edx + reloc.MSVCRT.dll_strncpy]
mov bl, byte [esp]
inc bx
cpuid
lea esp, [esp]
bt ebx, esi
mov dl, 0x51
jmp 0xafbe75
clc
xchg bp, ax
inc ah
xchg cl, dl
mov ax, 0xac9d
mov eax, dword [esp]
jmp 0xafbe8b

Function at 0xafc06c
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1a
popal
push dword [esp + 0xf]
push dword [esp + 9]
jmp 0xafc089
xchg word [esp + 4], si
jmp 0xafc056
sub esp, 0xd
lea esp, [esp + 0x14]
pop dword [esp]
push word [esp + 1]
jmp 0xafc0d3
lea eax, [esi + 0xa3]
dec di
pop word [esp]
add esp, 3
pop edx
cld
jmp 0xafc073
sub esp, 0x1b
rdtsc
mov di, si
call fcn.00afc100
lodsb al, byte [esi]
daa
mov bh, 0xd2
and esp, ecx
retf 0xce58
dec bl
mov cl, byte [esp]
lea esi, reloc.MSVCRT.dll_strncpy
mov bp, di
rdtsc
pop word [esp]
jmp 0xafc0b7
Function at 0xafc844
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], bp
xchg byte [esp + 3], cl
mov al, 0x9f
setae bl
jmp 0xafc84c
rdtsc
mov eax, dword [esp + 4]
jmp 0xafc82e
mov word [esp + 3], di
not al
bsr eax, esp
lea esi, reloc.MSVCRT.dll_strncpy
jmp 0xafc89e
pop word [esp + 1]
bt edi, esi
mov eax, dword [esp + 2]
mov si, bp
std
xchg di, bp
jmp 0xafc878

Function at 0xafc9ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, reloc.MSVCRT.dll_strncpy
mov byte [esp], bh
push word [esp + 1]
mov eax, edx
jmp 0xafc9ea
xchg ebx, ecx
and ax, bx
lea esp, [esp + 3]
jmp 0xafc995
rdtsc
xchg word [esp], ax
neg ebp
bsf ecx, esp
add cl, ch
cpuid
jmp 0xafc9d4

Function at 0xafcaba
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc dx, si
mov dword [esp + 2], ecx
mov di, dx
sbb ch, 0xc4
jmp 0xafcb4d
push word [esp + 3]
pop di
jmp 0xafcaa4
setl dh
sub esp, 0xb
bswap esi
mov byte [esp + 0xa], ah
xchg byte [esp + 9], dh
mov word [esp + 1], dx
xchg dx, ax
jmp 0xafcad9

Function at 0xafd7c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [esp + 4]
mov byte [esp + 2], dh
push word [esp + 1]
jmp 0xafd7d1
mov word [esp], si
lea ebx, [eax*4]
xchg al, bh
cmp bl, cl
jmp 0xafd7aa
pop word [esp + 1]
pop eax
xchg byte [esp + 1], bl
mov byte [esp + 1], dh
stc
xchg si, ax
jmp 0xafd824
rdtsc
sub cl, dl
btc edi, ebp
sub esp, 0x1a
push word [esp + 0x1e]
push esp
jmp 0xafd992
lea ebp, [esp + ebp]
mov dx, word [esp + 1]
push word [esp]
rcl ebx, 9
xchg word [esp], di
std
jmp 0xafd80e
pushfd
add esp, 0x27
bsr ebx, ebx
sub esp, 0x16
bt ecx, ecx
jmp 0xafd91e
pop dx
mov dword [esp + 0x19], ecx
not cx
sub esp, 9
not cx
mov word [esp + 4], di
jmp 0xafd869
mov byte [esp + 0x19], dl
setnp cl
mov dword [esp + 8], edi
cpuid
mov ax, word [esp + 0xe]
call fcn.00afd8cb
xchg si, ax
sets bl
lea ebx, [edx + ebx]
mov bh, 0x27
lea ebx, [esp + eax]
clc
jmp 0xafd96f
lea ebx, [ecx*4]
bsr dx, cx
xchg byte [esp], cl
bsr bx, di
xchg dx, si
sub esp, 0xa
jmp 0xafda3d
xchg cl, ch
std
xchg word [esp + 0x19], ax
mov dl, 0x1f
rdtsc
mov byte [esp + 0x21], bh
jmp 0xafd87f
or bh, 0xee
lea esp, [esp + 3]
xchg dword [esp + 0xb], edx
cmp dl, 0x79
xchg dword [esp + 4], esi
call fcn.00afda08
mov edx, 0x20d1b620
sahf
les ebx, [ebp - 0x33]
xchg esp, eax
int3
shr ecx, 5
push dword [esp + 0xb]
xchg dword [esp + 0xb], edx
xchg ebp, ecx
bsf di, sp
sets dh
jmp 0xafd9a7
mov bx, 0xe63d
add esp, 0
mov byte [esp + 6], dh
mov dh, 0x8c
push dword [esp]
inc bp
jmp 0xafd9d2
Function at 0xafda08
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, cl
lea ebp, [ebp + 0x8f]
mov si, word [esp + 0x10]
pop si
add esp, 6
not dx
jmp 0xafda25
xchg word [esp + 7], cx
jmp 0xafd9e8
pop edi
xchg word [esp], di
mov bp, word [esp]
mov si, word [esp + 1]
jmp 0xafda6a
pop dword [esp + 1]
dec edx
mov bx, word [esp + 7]
bsr edi, esi
pop esi
push esi
jmp 0xafda0f
mov ax, bp
mov eax, dword [esp]
mov cx, sp
mov ecx, 0xaf241c38
rdtsc
mov al, byte [esp]
jmp 0xafda7b
xchg word [esp], si
add si, 0x1c81
rdtsc
std
pop ebx
mov dl, 0xba
jmp 0xafda51
xchg ebp, edx
lea ebp, reloc.MSVCRT.dll_strncpy
setbe ah
setb cl
push ax
xchg word [esp], si
jmp 0xafdd06
xchg si, bp
push word [esp + 0x12]
btr esi, eax
mov bx, word [esp + 0x21]
mov cx, 0x4f07
push sp
jmp 0xafdb1a
setae dh
rdtsc
mov ecx, dword [esp + 0x14]
mov al, 0xbc
rcl ebx, cl
cpuid
jmp 0xafdab7
mov word [esp + 8], sp
xchg cx, bx
pop bx
neg cx
setae dl
jmp 0xafdb50
xchg cl, ah
bsr edx, esi
mov dx, 0x4c3d
mov dword [esp + 5], esp
jmp 0xafdaed
and ch, dh
bswap edi
lea edi, [ebp*4]
std
mov ebp, ebx
pop cx
jmp 0xafdb03
lea ebp, [ebp*4]
lea ecx, [ebx + edi]
mov byte [esp + 0x19], bh
call fcn.00afdb2c
mov bl, 0xf7
lea esp, [esp]
mov bx, ax
lea ebx, [edi + ebp]
jmp 0xafdba3
setge bl
cld
xchg ebx, edi
mov ebp, dword [esp]
lea edi, [edi*4]
jmp 0xafdbd2
lea ebx, [edi*4]
rdtsc
mov byte [esp], dl
mov ebp, 0x86cf7a2a
mov edi, dword [esp]
mov bp, ax
jmp 0xafdb8d
rdtsc
mov ebp, 0x894a4c93
cpuid
lea edi, [eax + 0x61]
jmp 0xafdc20
mov ax, 0xf989
neg di
mov si, 0xca38
dec dh
cld
xchg dl, ch
jmp 0xafdbbc
xchg bp, si
rcl ax, cl
mov bx, bp
neg dh
xchg dword [esp + 0x1c], edx
mov dword [esp + 7], edx
jmp 0xafdadc
lea eax, [edx*4]
lea esi, [edx + esi]
mov dh, byte [esp]
call fcn.00afdc0a
bt si, bp
neg cx
dec bh
stc
mov dh, ch
cpuid
jmp 0xafdc6e
sbb al, 0xc7
neg di
mov bx, word [esp]
bsf bp, sp
call fcn.00afdcd7
int1
ljmp 0x60a2
clc
inc ax
cpuid
pushal
popal
and dx, sp
jmp 0xafdc58
mov word [esp], di
lea edx, reloc.MSVCRT.dll_strncpy
xchg al, dl
rdtsc
add esp, 0
pushal
jmp 0xafdbf2
rcl eax, 0x14
mov eax, edi
lea edi, reloc.MSVCRT.dll_strncpy
bsf ebp, ebp
mov eax, dword [esp]
shl bp, 0
jmp 0xafdc86

Function at 0xafdb2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x24
lea edi, reloc.MSVCRT.dll_strncpy
mov ch, byte [esp + 1]
jmp 0xafdb79
add esp, 1
mov bh, 0xc2
rcr dx, 0xc
mov esi, 0x3f92549f
mov ebx, edx
mov cl, dh
jmp 0xafdb63

Function at 0xafdc9d
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ch
rcl cl, 4
mov byte [esp + 4], ch
mov edi, dword [esp + 5]
mov al, 0xa1
jmp 0xafdcbb
Function at 0xafe39b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
mov edx, dword [esp]
shl dh, cl
mov edi, esp
mov esi, dword [esp]
mov si, cx
jmp 0xafe360
setge bl
xchg ebx, ebp
mov dh, ah
cld
rol al, cl
bt ax, bx
jmp 0xafe319
mov byte [esp + 4], ah
mov byte [esp + 6], bh
sub esp, 0x11
pop word [esp + 4]
mov word [esp], ax
push dword [esp + 8]
jmp 0xafe376
bsf si, di
push sp
sub esp, 4
lea ecx, [ebp - 0x5f]
xchg word [esp + 3], cx
xchg bx, cx
jmp 0xafe33f
mov ebx, 0x33d23573
push word [esp + 0xa]
std
mov ecx, edi
lea esp, [esp + 4]
lea ecx, [esi + ebp]
jmp 0xafe3bd
mov ax, bx
btc ebp, ecx
pop bp
xchg cl, dh
jmp 0xafe32f
mov ch, 0x80
mov cx, word [esp + 2]
cld
rdtsc
mov bh, byte [esp + 1]
jmp 0xafe4cb
pop eax
xchg dx, di
add esp, 0x10
mov edx, dword [esp + 2]
neg cl
inc eax
jmp 0xafe3a7
mov byte [esp], dh
btr ax, si
std
xchg bx, cx
cmc
mov dl, 0xde
call fcn.00afe3e2
btr edx, edi
shr ah, cl
mov edx, 0x246f5d96
pop cx
lea esp, [esp]
mov ebp, dword [esp]
jmp 0xafe40b
mov dh, byte [esp + 2]
pop bx
xchg byte [esp], al
btc ecx, ebx
lea edi, [ebx*4]
rdtsc
jmp 0xafe443

Function at 0xafe620
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xafe685
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0xafe661
mov eax, dword [eax + 8]
push eax
jmp 0xafe08c
pop word [esp]
lea esp, [esp + 3]
mov dword [esp], edi
mov eax, dword fs:[0x30]
jmp 0xafe622

Function at 0xafe648
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr al, cl
bswap ebx
add esp, 0x19
mov dword [esp + 4], ebx
xchg al, cl
push ecx
jmp 0xafe599
not dl
inc ebx
mov edi, dword [esp + 8]
bswap ebx
mov cx, sp
mov bh, 0xe1
jmp 0xafe0c6
mov edi, dword [esp + 0xf]
bswap ecx
std
pushfd
mov esi, ebp
xchg al, bl
jmp 0xafe0dc
mov ecx, ebx
dec bx
lea edx, reloc.MSVCRT.dll_strncpy
std
bts dx, cx
jmp 0xafe12a
clc
rdtsc
lea esp, [esp]
neg dl
lea esi, reloc.MSVCRT.dll_strncpy
xchg ah, dl
jmp 0xafe102
rdtsc
add esp, 0
bt cx, bx
mov bh, byte [esp]
lea esi, [ebx*4]
pushal
jmp 0xafe179
stc
lea esp, [esp + 1]
ror di, 0
dec ax
lea ebp, reloc.MSVCRT.dll_strncpy
lea edi, reloc.MSVCRT.dll_strncpy
jmp 0xafe118
stc
push word [esp + 6]
pop bp
call fcn.00afe18f
adc ebx, dword [edx + reloc.MSVCRT.dll_strncpy]
ja 0xafe172
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
jmp 0x8816aecd
xchg word [esp + 0xd], ax
rdtsc
not bx
rdtsc
btc ebx, ebp
push word [esp + 0x10]
jmp 0xafe15e
push word [esp + 9]
lea esp, [esp + 0xd]
stc
xchg bp, ax
neg bh
lea ebp, reloc.MSVCRT.dll_strncpy
jmp 0xafe145
cmc
cpuid
bsf eax, esp
mov ebp, 0xc01f2086
mov esi, dword [esp + 7]
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0xafe1b2
sub esp, 2
mov dword [esp + 0xa], eax
pop word [esp + 6]
mov ebp, ebx
mov edx, ecx
mov dh, byte [esp + 3]
jmp 0xafe2ff
lea edi, [edi*4]
neg cl
xchg dword [esp + 0x13], ebp
xchg dword [esp + 0xa], edx
sete bl
jmp 0xafe0f4
Function at 0x1001224e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001225d
pop dword [ebp - 0x24]
mov eax, 0xa97496f
sub eax, 0xfa962712
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xefe86a13
sub dword [ebp - 0x34], 0xa19624c8
mov dword [ebp - 0x30], 0x93f02463
add dword [ebp - 0x30], 0x9e4327e2
mov dword [ebp - 0x2c], 0x5c643f79
add dword [ebp - 0x2c], 0xefe804b5
mov dword [ebp - 0x28], 0xc2767dcc
sub dword [ebp - 0x28], 0xc2767dcc
lea eax, [ebp - 0x34]
push eax
mov eax, 0xfdb96bf3
add eax, 0x1247e4a5
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xcddf59bd
sub dword [ebp - 0x34], 0x596cf067
mov dword [ebp - 0x30], 0x4f810b1f
sub dword [ebp - 0x30], 0xe14a9aa
mov dword [ebp - 0x2c], 0x61e713ec
sub dword [ebp - 0x2c], 0xfe77a780
mov dword [ebp - 0x28], 0x71f56910
sub dword [ebp - 0x28], 0x71f56910
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3a166
push 0
call eax
mov ecx, 0xa0bb221
add ecx, 0xf5f49bea
mov edi, eax
mov ebx, 0x513a269
add ebx, 0xaf07997
add ebx, dword [ebp - 0x24]
mov esi, 0xaf5e0fc1
add esi, 0x4fd5741c
mov dword [ebp - 4], 0xb7bd7dc0
mov edx, dword [ebx]
xor dword [ebp - 0x1c], 0x32a6f491
sub edx, esi
add dword [ebp - 0x18], esi
mov dword [edi], edx
add edi, 4
add ebx, 4
loop 0x1001237a
add eax, 0x12aff
mov ebx, eax
add eax, 5
mov ecx, 0xf564317b
add ecx, 0x1a9bce85
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x418f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420de0], ecx
add edx, 1
cmp edx, 0x100
jb 0x418f42
cmp edx, 0x800
jae 0x41902b
mov edi, edi
mov eax, dword [edx*4 + 0x4209e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420de0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x420ddc], eax
jb 0x419000
mov dword [0x420dbc], 0x4196e0
call fcn.00419170
test eax, eax
jne 0x419048
mov dword [0x420dbc], 0x419600
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x32c9141b
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x6a5371fe
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x408314
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ebp
cmp edi, dword [0x3a4f3d36]
aaa
add esp, 4
jmp 0x40831d
xor eax, 0xa361
pop eax
push edx
jmp 0x40832a
xor edx, 0x12ef2
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x19cc], eax
mov ecx, dword [ebp - 0x19cc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19d0], edx

Function at 0x40834c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x19d0]
mov dword [ebp - 0x15fc], eax
push edi
push ebx
add esp, 4
sub edi, 0x53fb
pop edi
push ebx
sub ebx, 0xbe20
add ebx, 0x57ce
pop ebx
push eax
push edi
add esp, 4
and eax, 0x856f
and eax, 0x9ea
sub eax, 0x6276
add byte [eax - 0x7d], bl
mov ebp, 0xffffea04
add byte [ebp + 0xf], dh
mov dword [ebp - 0x31c], 0
jmp 0x408649
mov ecx, dword [ebp - 0x15fc]

Function at 0x4083a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcb4], eax
push ebx
push esi
add esp, 4
sub ebx, 0xd072
rol byte [eax], 1
add byte [ecx + 0x17ecec3], al
add byte [ebx + 0x57], bl
jmp 0x4083ce
jmp 0x4083d6
jmp 0x4083df
xor edi, 0x1204c
pop edi
cmp dword [ebp - 0xcb4], 0
jne 0x4083fe
mov dword [ebp - 0x31c], 0
jmp 0x408649
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx
push edi
push ebx
add esp, 4
sub edi, 0xd3aa
add edi, 0x14287
pop edi
push eax
xor eax, 0xaaf9
pop eax
push esi
push edi
add esp, 4
xor esi, 0x10c56
and esi, 0xa572
xor esi, 0x10cc2
pop esi
invalid
xchg ebp, eax
invalid
invalid

Function at 0x4085c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
add esp, 4
xor edi, 0x7242
pop edi
mov ecx, dword [ebp - 0x50c]
invalid
invalid
invalid

Function at 0x4085c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
add esp, 4
xor edi, 0x7242
pop edi
mov ecx, dword [ebp - 0x50c]
invalid
invalid
invalid

Function at 0x408601
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, 0x15a4d
call 0x408601
add byte [ecx + 0x4a], cl
cmp al, 0x47
inc esp
push eax
inc esi
inc edi
inc eax
add esp, 4
add edx, 0x12ead
pop edx
push ebx
add ebx, 0x6d11
pop ebx
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x40863f
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x40840a
mov dword [ebp - 0x31c], 0

Function at 0x408b37
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
pop edx
push esi
push ebx
add esp, 4
or esi, 0x12c64
add esi, 0xa8aa
pop esi
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
Function at 0x409006
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov word [ebp - 0x176c], dx
mov eax, 0x6e
mov word [ebp - 0x176a], ax
mov ecx, 0x65
mov word [ebp - 0x1768], cx
mov edx, 0x6c
mov word [ebp - 0x1766], dx
mov eax, 0x33
mov word [ebp - 0x1764], ax
mov ecx, 0x32
mov word [ebp - 0x1762], cx
mov edx, 0x2e
mov word [ebp - 0x1760], dx
mov eax, 0x64
mov word [ebp - 0x175e], ax
mov ecx, 0x6c
mov word [ebp - 0x175c], cx
mov edx, 0x6c
mov word [ebp - 0x175a], dx
xor eax, eax
mov word [ebp - 0x1758], ax
push esi
push edx
add esp, 4
xor esi, 0x90a1
jmp 0x408fe9
and esi, 0xa0ae
pop esi
push edx
and edx, 0x18114
pop edx
push ecx
call 0x409006
add byte [ebx + 0x39], cl
inc ebp
dec ebx
inc edx
dec eax
xor al, byte [ebx - 0x39a6fb3c]
test dword [edi + esi*8 - 1], ebx
dec dword [esi + eax*8 - 0x7b]
pop ebp
idiv edi
jmp [edi - 0x3a]
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call fcn.004025e0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [fcn.00401094]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [fcn.00401068]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [fcn.00401068]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [fcn.00401068]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [fcn.004011cc]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [fcn.00401068]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [fcn.00401210]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [0x4010d4]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [0x401058]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [0x4010d4]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [fcn.00401068]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219