joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d70
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x408a1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
xor ebx, ebx
mov dword [esp + 0x24], ebx
call sub.MFC42.DLL_CString::CString_2
lea edi, [esi + 4]
mov byte [esp + 0x24], 1
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
lea ebp, [esi + 8]
mov byte [esp + 0x24], 2
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call sub.MFC42.DLL_CString::CString_2
push 0x40c520
mov ecx, esi
mov byte [esp + 0x28], 4
call sub.MFC42.DLL_CString::operator
push 0x40c520
mov ecx, ebp
call sub.MFC42.DLL_CString::operator
push 0x40c520
mov ecx, edi
call sub.MFC42.DLL_CString::operator
mov dword [esi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [esp + 0x14], eax
mov ebp, 1
mov edi, 0x41
mov eax, dword [esp + 0x14]
test eax, ebp
je 0x406e55
push edi
lea ecx, [esp + 0x14]
push str._c:_
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call ebx
push eax
push edi
push edi
lea eax, [esp + 0x1c]
push str.::0:_c:_c:_u_n
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004076e2
inc dword [esi + 0xc]
shl ebp, 1
inc edi
cmp edi, 0x5a
jle 0x406e0f
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.004078ec
mov ecx, esi
call fcn.00406eb0
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 4
Function at 0x406eb0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x408a59
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
push esi
push edi
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x15c], 0
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x15c], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 8]
mov byte [esp + 0x15c], 2
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x164]
lea ecx, [esp + 0xc]
push eax
push str._s.
push ecx
mov byte [esp + 0x168], 3
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x18]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x406f8b
lea ecx, [esp + 8]
mov byte [esp + 0x15c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x15c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x15c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x164]
mov dword [esp + 0x15c], edi
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4070b4
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0x18], 0x10
je 0x40700f
cmp byte [esp + 0x44], 0x2e
je 0x406fd4
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
sub ecx, eax
lea edx, [esp + 0x148]
push ecx
lea eax, [esp + 0x48]
push edx
push eax
lea ecx, [esp + 0x18]
push str.::1:_s:_s:_ld_n
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea edx, [esp + 0xc]
lea ecx, [esi + 4]
push edx
jmp 0x407041
cmp byte [esp + 0x45], 0x2e
jne 0x407046
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sub eax, edx
lea ecx, [esp + 0x148]
push eax
lea edx, [esp + 0x48]
push ecx
push edx
lea eax, [esp + 0x18]
push str.::1:_s:_s:_ld_n
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esi + 4]
jmp 0x407041
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
sub edx, ecx
lea eax, [esp + 0x148]
push edx
lea ecx, [esp + 0x48]
push eax
push ecx
lea edx, [esp + 0x18]
push str.::2:_s:_s:_ld_n
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea eax, [esp + 0xc]
lea ecx, [esi + 8]
push eax
call fcn.004076e2
mov ecx, dword [esi + 0xc]
inc ecx
mov dword [esi + 0xc], ecx
lea ecx, [esp + 0x18]
push ecx
push edi
call ebp
test eax, eax
jne 0x406f92
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esi + 0xc]
lea ecx, [esp + 0xc]
mov byte [esp + 0x160], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x160], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x160], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x168]
mov dword [esp + 0x160], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop ebp
mov ecx, dword [esp + 0x154]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x158
ret 4
Function at 0x407400
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [esp + 0x18]
push 0
test eax, eax
je 0x407469
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret 4
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret 4
Function at 0x408080
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x408b60
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [esp + 0x34]
xor ebx, ebx
cmp edi, ebx
jge 0x4080b9
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x2c], ebx
push eax
push 0x40a218
push 1
push ebx
push 0x40a278
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
je 0x408108
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x408152
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 0x34]
push ebx
push ecx
mov edx, dword [eax]
push 0x40a268
push eax
mov byte [esp + 0x3c], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x408167
mov eax, dword [esp + 0x34]
mov byte [esp + 0x2c], bl
cmp eax, ebx
je 0x40813c
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x408152
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov eax, dword [esp + 0x34]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
xor esi, esi
call dword [ecx + 0xc]
cmp edi, ebx
jl 0x408226
push ebp
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
push 0x40a298
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x4081fc
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x1c]
push ebx
mov word [esp + 0x20], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x4081f2
cmp esi, edi
jne 0x4081e7
mov eax, dword [esp + 0x14]
push ebp
push 0x40a208
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x20]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
inc esi
call dword [ecx + 0xc]
cmp esi, edi
jle 0x408197
pop ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], bl
cmp eax, ebx
pop esi
je 0x408239
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x40824f
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x408270
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x408b78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x10], edi
mov eax, dword [ebx + 0x14]
lea edx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], edi
mov ecx, dword [eax]
push edx
push eax
mov dword [esp + 0x3c], edi
call dword [ecx + 0x30]
test eax, eax
jl 0x408328
mov eax, dword [esp + 0x18]
push ebp
lea edx, [esp + 0x18]
push edi
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40831d
mov ebp, dword [esp + 0x44]
mov eax, dword [esp + 0x18]
mov ecx, 4
mov edi, 0x40a258
xor edx, edx
lea esi, [eax + 0x2c]
repe cmpsd dword [esi], dword es:[edi]
jne 0x4082fe
mov ecx, dword [eax + 0x44]
cmp dword [ecx + 0x34], ebp
jne 0x4082f6
mov edx, dword [esp + 0x48]
mov esi, dword [ecx + 0x38]
cmp esi, edx
je 0x408317
push eax
mov ecx, ebx
call fcn.00408470
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push 0
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x4082cc
jmp 0x40831b
mov dword [esp + 0x10], eax
xor edi, edi
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop ebp
mov eax, dword [ebx + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x40a1e8
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jl 0x40838e
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x40835d
mov eax, dword [esp + 0x10]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, ebx
push eax
call fcn.00408470
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
jl 0x40838e
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax + 0x44]
mov edx, dword [ecx + 0x34]
mov dword [ebx + 0x20], edx
mov ecx, dword [eax + 0x44]
mov edx, dword [ecx + 0x38]
mov ecx, ebx
mov dword [ebx + 0x24], edx
call fcn.00408470
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebx + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edi
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, edi
mov dword [esp + 0x34], 0xffffffff
je 0x4083c5
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x10132a48
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc edi
mov edi, 0x1197770b
retf
movzx ebx, byte [edx]
push 0x5f3aed3f
xor ebx, eax
neg word [esp]
jbe 0x1014c0e3
sub dword [ebx], ecx
xchg edi, eax
cwde
sal esi, 1
outsb dx, byte [esi]
pop ecx
sub al, 0x73
cmpsd dword [esi], dword es:[edi]
call 0xd2f4e6
inc ch
or dword cs:[ebx + 0x2bd3a4db], 0x5c
or dword [ebx + 0x2bd3a4db], 0x5c
push 0x62
sti
cmp al, 0x3a
sub byte [ebp + eax*8 + 0x29], dh
cdq
jns 0x10132adf
xchg ebp, eax
pop ebx
lodsb al, byte [esi]
add byte [ebp - 0x52], dh
js 0x10132a2e
cli
lodsd eax, dword [esi]
xchg ecx, eax
dec dword [esi - 0x6f]
mov ecx, 0x3e298196
adc cl, bl
inc ebx
pop ecx
sahf
loope 0x10132abe
dec ax
invalid
js 0x10132af7
or dl, byte fs:[ebx + 0x5d]
push ebx
pop ebp
jle 0x10132a86
adc dword [esi + 0x66], 0xfffffff8
fcomp qword [ebp + ecx*4 - 0x4d7d98a9]
adc al, 0x3b
or byte [bp + di], bh
popal
cmpsb byte [esi], byte es:[edi]
cli
dec esi
scasb al, byte es:[edi]
sahf
or edi, dword [ebx]
sbb al, 0x67
mov eax, 0xbb448aaa
jno 0x10132b37
mov al, byte [ebx + edi*4 + 0x71]
push ebx
sub dword [ecx], ebx
je 0x10132a70
and dword [esi], esi
mov eax, dword [0xac085443]
salc
imul edi, dword [ebp - 0x6d033b62], 0x3584943c
loop 0x10132aba
xchg esp, eax
test byte [0xd6acbee2], dh
lodsb al, byte [esi]
salc
out 0xb3, al
xchg esi, eax
pop edi
invalid
fdiv dword [ecx + 0x66]
push ecx
int1
xlatb
iretd
and ebx, 0xff
call fcn.1032d4e8
mov dword [esi], edi
push 0xa03d5030
mov dword [esp + 8], 0xbc036e18
lea esp, [esp + 0x14]
jmp fcn.1029519f

Function at 0x101499e4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ss
mov eax, 0x9694d982
neg ebp
enter 0xffffffffffff9c06, 0xffffffffffffff87
or al, byte [ecx + edx + 0x6aec1607]
xor eax, 0x4957c654
inc eax
mov bl, byte [esp + edx]
adc al, 0x92
adc al, 0x92
rol al, 1
mov dword [esp + ecx - 0x42c18700], ecx
sal word [esp + ecx - 0x42c18700], 0x2a
xor bl, al
sub cx, cx
jge 0x1032d629
aam 0x4c
nop
fadd st(1), st(0)
mov ecx, 0x98a44250
popfd
cmc
cmp byte [edx], dl
in al, dx
ror cl, 0xa9
push 0xa988844a
stc
push ecx
pop eax
add byte [ebx + 0x2302e1f9], bh
xchg edx, eax
sti
push ds
mov bh, 0x87
jg 0x101499c9
pop ss
imul bh
invalid
sub ebp, 2
mov word [ebp], cx
lea esp, [esp + 8]
jmp fcn.102add1e
lea eax, [esp + eax + 8]
adc ecx, ecx
dec dword [esp + 4]
add cx, word [eax]
jmp 0x10295247
Function at 0x1014deba
Capabilities:
Encode data using xor

Disassembly:
test esi, esi
lea esp, [esp + 8]
je 0x1014df04
mov ecx, 0xa493b697
or cl, ch
movzx ecx, byte [edx]
xor ecx, eax
push 0xad184389
neg word [esp]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x10264bf8]
shr eax, 8
xor eax, ecx
inc edx
sal word [esp + 2], 0x64
xor eax, 0x436c71e
dec esi
lea esp, [esp + 4]
jne 0x1014dec6
jmp 0x1030d721
not eax
call fcn.10343a2e
sysenter
call fcn.10113aea
cli
and al, 0x38
sub eax, 0xc7d841b1
mov edi, 0xe7123ee0
xchg esp, eax
jo 0x1030d776
xchg ecx, eax
push ecx
mov eax, 0xa6065f47
insb byte es:[edi], dx
xchg dword [eax + esi*8 - 0x7e016af], ecx
shl dword [edi + 0x2fbe66c8], 1
adc ah, byte [eax + 0x2b]
int1
and ebx, dword [esi + 0xe]
xchg esi, eax
jmp 0x1030d776
shl byte [ebx + eax*4], 1
adc esi, dword gs:[eax - 0x775dec59]
add al, 0xef
xchg bh, ch
aad 0x27
mov bl, 0x4e
sbb byte [eax + 0x1029], cl
add byte [eax + 0x1eb0bd10], al
push ds
and al, 0x6f
adc dl, byte [eax]
jno 0x1030d811
push esi
push eax
adc dword [esi + eax - 0x2d0f0e69], edx
jl 0x1030d7b1
jb 0x1030d800
pop eax
and dword [ebx], edi
adc al, 0xa2
jno 0x1030d793
push es
inc edi
sub eax, esi
lcall 0xf511, 0x59b223ec
and byte [ebx + 0x79], ch
mov ecx, 0x9b204d59
test dword [ebp - 0x77], ebx
mov ch, 0x54
pop ss
sbb eax, 0xc80145cd
mov ebx, 0x57ba7da5
dec ebp
fstp dword [ebp + 0x15f46caa]
xor byte [0xac56189], cl
jecxz 0x1030d80e
test al, 0x68
les esp, [eax]
invalid
lahf
arpl word [edi + 0x5a], bp
rcr edi, 1
daa
cmpsd dword [esi], dword es:[edi]
dec ebx
fsub st(1), st(0)
sbb dl, byte [ecx + 0x35a65302]
mov dword [0x74da008e], eax
invalid
add dl, byte [ebx - 0x5a]
xor eax, 0xda008ea3
je 0x1030d7a7
bound ebp, qword [ecx + ebp + 0x6b8341ee]
mov ecx, 0xa554fe30
dec edx
xchg ebp, eax
sbb eax, 0xe1a95df8
sbb dword [ecx + 0x7d6be0d5], edx
mov ch, 0x61
pop ebp
invalid

Function at 0x102ab2ec
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x10297410
mov esi, dword [ebp + 0xc]
test dx, 0x239c
test esi, esi
jmp 0x102973f9
mov eax, dword [edx + 0x3c]
add eax, edx
cmp al, dl
clc
cmp dword [eax], 0x4550
jmp 0x10316c64
je 0x10297410
mov eax, 0x5a4d
clc
cmp esp, edi
cmp word [edx], ax
je 0x1026b2b3
sub eax, eax
pop esi
jmp 0x102bfd17
mov edx, dword [ebp + 8]
clc
cmp esi, edx
cmc
lea esp, [esp - 0x114]
clc
stc
jmp 0x1033f8cc
push ebp
mov dh, 0x8d
mov ebp, esp
or edx, eax
jmp 0x102a76f0
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x10297410
mov eax, dword [eax + 0x7c]
push ebx
jmp 0x1027d7a0
jne 0x10297410
mov ecx, dword [eax + 0x78]
stc
jmp 0x102cd14a
push esi
test edx, edx
jmp 0x1013be72
Function at 0x102f910f
Capabilities:
Encode data using xor

Disassembly:
add esi, 4
call fcn.1030a0a8
mov ecx, 0x26296fa2
movzx esi, cl
mov ecx, dword [edi + esi*4 - 0x288]
lea edi, [esi + edi - 0x9e]
movzx eax, si
movzx edx, al
mov ebp, ecx
movsx ecx, dx
call fcn.102e3d6f
jmp 0x102f9103
mov eax, dword [0x21ff1c7f]
rol dword [ebx - 0x6d44568c], 1
inc ebx
test eax, 0xc518aaf3
vxorps ymm3, ymm2, ymm7
int3
xor byte [ebx + 0x16], dh
loopne 0x102871f0
stosd dword es:[edi], eax
mov edx, 0xd8b9e670
push esi
ret
not ecx
xor al, bl
add al, 0x87
sub ecx, ecx
not al
sbb al, 0x2e
dec cl
bswap ecx
jne 0x102ec275
ficom dword [eax]
or byte [ebx - 0x67], al
mov ch, 0x40
arpl word [edi], dx
xchg esp, eax
js 0x102872b7
rcl al, 0xb3
popal
jno 0x1028722e
inc ecx
push edi
add al, 0xa6
xchg esp, eax
xchg byte [bx + si + 0x79df], bl
wait
js 0x10287302
aas
cmp byte [esi], 0xf4
pop ds
clc
cwde
sti
sub ebx, esi
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
invalid
push 0x74
std
dec ebp
xchg ebp, eax
add al, 0xf
jae 0x10287371
cli
or al, 0xeb
adc al, 0xc
jno 0x102872b7
mov eax, dword [0xcb0f035c]
out dx, al
invalid
sbb ebp, eax
invalid
not al
sub ecx, 0x6fa1109d
ror ecx, 0x26
ror al, 1
lea ecx, [ecx*2 + 0x781ef5ad]
sar cl, 0xa7
dec al
neg ecx
neg cl
rol al, 1
xor bl, al
xadd cl, ch
or ecx, ecx
shl cl, 0xa4
add eax, esp
sub ecx, 0x31b653a5
sar ecx, cl
setb cl
movzx cx, byte [ecx + eax - 0x73501]
call fcn.1030ca17
mov eax, 0x9cb19f9e
mov dx, word [ebp]
push eax
mov ax, word [ebp + 2]
and byte [esp + 2], 0x84
adc ebp, 2
add dx, ax
mov word [ebp], dx
lea esp, [esp + 4]
jmp fcn.102e997a
movzx ax, byte [esi]
mov cl, byte [esi + 2]
call fcn.1027a1b2
mov ecx, 0x7e221012
movsx eax, cx
shr ecx, cl
movzx eax, byte [edi + ecx*4 - 0x7e20]
lea edi, [edi + ecx - 0x1f87]
jae fcn.102e3213
jbe 0x1028727d
Function at 0x1033a290
Capabilities:
Encode data using xor

Disassembly:
add edi, 6
push 0xa3271d8b
push 0x2d35878d
mov byte ss:[ecx], dl
lea esp, [esp + 8]
jmp fcn.1012f77c
rol al, 1
dec al
mov dword [esp + edx - 0x1c10212a], edx
xor bl, al
xor edx, dword [esp + edx - 0x1c10212d]
lea eax, [esp + eax + 8]
shl edx, 0xc9
setp dl
call fcn.102d355d
add esi, 2
sub ebp, 1
call fcn.102b1f86
mov edx, 0xb981c82a
mov dl, byte [edi + 4]
jmp 0x10133875
and eax, 0xa9327e2a
xchg byte [esi - 0x73], ah
invalid
dec dx
add al, 5
add dx, dx
xor al, 0x3a
inc al
and edx, 0x5e10612e
jae 0x1014914a
popal
adc byte [esi + 0xf], bl
adc dword [esi + 0x7b], 0xffffffe6
call [edx - 0x72]
pop eax
jle 0x102e1582
pop edx
mov ds, word [eax + 0x7e]
mov dword [esi + 0x25df6dee], edx
mov esi, 0x68f4e197
and byte [ecx - 0x76], 0x96
xchg esi, eax
out dx, al
insd dword es:[edi], dx
fbld tbyte [0xf4e197be]
push 0x968a6180
jae 0x102e1668
mov dword [0x56097b46], eax
mov byte [eax - 0x1f], bh
salc
cmpsb byte [esi], byte es:[edi]
xor dword [edi + 0x11719671], eax
jle 0x102e15eb
retf 0xda31
sbb eax, dword [edx - 0x1e]
inc eax
sub eax, 0x5f498071
ljmp 0xfde8
neg dl
setl dl
not al
jg 0x102e15dc
lea esp, [esp + 8]
ja fcn.1026db0e
mov ecx, 0x2cbae3a5
mov eax, esp
shr cx, 0x23
jbe 0x1033f9a1
shl byte [0x97b4122a], 0xa2
pop edx
push ds
jle 0x1033a24b
sbb al, 0x53
inc ebx
in eax, 0xd6
ret
lea ecx, [ecx - 0x2cba1c30]
lea edx, [ebp - 0x80]
mov esi, 0x1dbda334
and edx, 0xfffffffc
add esi, 0xc104dcab
bswap esi
sbb esi, esi
sbb edx, ecx
push esi
push esi
call fcn.102b7ddb
mov ecx, 0x66bbf997
mov esi, dword [edi + ecx - 0x66bbf997]
sal cl, 1
movzx edx, cx
mov edx, dword [edi + ecx - 0x66bbf92a]
mov cl, byte [edi + ecx - 0x66bbf926]
add edi, 6
shrd esi, edx, cl
push 0x6a51a28
mov dword [edi], esi
lea esp, [esp + 4]
jmp fcn.1012f77c

Function at 0x1033a3ea
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi], edx
call fcn.1031f475
xchg edx, eax
cmp bh, byte [edx + 0x6c5823ee]
out 0x82, al
xor eax, 0xa4511f62
shl esi, 1
xor byte [0xe60b1f15], 0x82
xor eax, 0xa2119fb2
or esi, ebp
pslld mm6, qword [eax - 0x55]
or al, dl
cmp ch, ah
push ecx
xchg esi, eax
cmp dword [eax - 0x62b336f9], edx
cmp al, 0x68
adc byte [ecx + edx*4 + 0x51ee87a], 0x1b
add al, bh
push 0x7a919482
call fcn.102f7270
clc
mov es, esp
mov bh, 0x5a
lea ebp, [ecx - 0x1962ab91]
xlatb
inc byte [eax - 0x58]
das
ficom dword [esi + ebp*8 - 0x61]
jl 0x10146d19
xchg ebx, eax
mov ebx, dword [edx + 0x28]
and byte es:[ebx + 0x12], dh
sub edi, dword [ebp + 0x41dc8610]
add al, 0xa8
imul edi, dword [edx], 0x5b
invalid
mov dword [esp + edi - 0x6f8ee736], 0x2d36f41a
mov edi, dword [esi + edi - 0x6f8ee732]
call fcn.10258f9d
mov ecx, 0x931523b3
shr ecx, cl
mov ecx, dword [ebp + ecx*2 - 0x24c4]
mov eax, dword [ebp + 4]
jnp 0x10146d48
mov edx, 0x8415088d
mov eax, dword [edi]
mov edx, dword fs:[eax]
jmp 0x1012865d
Function at 0x9b5710
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x66000d
lea edi, [esi - 0x25f00d]
push edi
or ebp, 0xffffffff
jmp 0x9b5732
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9b5739
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b5728
mov eax, 1
add ebx, ebx
jne 0x9b574b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9b5740
jne 0x9b575c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b5740
xor ecx, ecx
sub eax, 3
jb 0x9b5770
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9b57e2
mov ebp, eax
add ebx, ebx
jne 0x9b577b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x9b5788
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x9b57ac
inc ecx
add ebx, ebx
jne 0x9b5798
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9b578d
jne 0x9b57a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b578d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9b57cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9b57bd
jmp 0x9b572e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9b57cc
add edi, ecx
jmp 0x9b572e
pop esi
mov edi, esi
mov ecx, 0x184b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9b57ea
cmp byte [edi], 0x11
jne 0x9b57ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9b57ef
lea edi, [esi + 0x5b1000]
mov eax, dword [edi]
or eax, eax
je 0x9b585e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5b7fa4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5b7ffc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9b581c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5b8004]
or eax, eax
je 0x9b5858
mov dword [ebx], eax
add ebx, 4
jmp 0x9b5839
call dword [esi + 0x5b8000]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9b588f
cmp al, 0xef
ja 0x9b5882
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9b5864
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9b5871
mov ebp, dword [esi + 0x5b8008]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9b58c3
sub esp, 0xffffff80
jmp 0x40f16c
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x77b95a84
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data_1
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x63f465fe
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219