joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409764
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409818
jmp 0x40980d
cmp dword [esi + 0x10], 0x1000
jne 0x4097f9
test byte [esi + 0x15], 1
jne 0x4097f9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x4097b8
cmp eax, 2
je 0x4097b8
cmp eax, 0x10
je 0x4097b8
cmp eax, 0x20
jne 0x4097cd
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4097cd
mov bl, 1
xor ebp, ebp
jmp 0x4097de
mov eax, dword [esi]
add eax, ebp
call fcn.0040975c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x4097d1
test bl, bl
je 0x4097f9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409818
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409790
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x47e692
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47e6c0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47e6de
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047e5f8
jmp 0x47e6de
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47e6de
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047e5f8
test edi, edi
mov eax, edi
jne 0x47e6c8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x50c620
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
jmp 0x50c63a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50c641
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50c630
mov eax, 1
add ebx, ebx
jne 0x50c653
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50c648
jne 0x50c664
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50c648
xor ecx, ecx
sub eax, 3
jb 0x50c678
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50c6ea
mov ebp, eax
add ebx, ebx
jne 0x50c683
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50c690
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50c6b4
inc ecx
add ebx, ebx
jne 0x50c6a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50c695
jne 0x50c6b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50c695
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50c6d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50c6c5
jmp 0x50c636
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50c6d4
add edi, ecx
jmp 0x50c636
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50c733
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50c6f1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50c72d
mov dword [ebx], eax
add ebx, 4
jmp 0x50c70e
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50c767
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x71c590
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x76101c]
add eax, 0xe9a
mov dword [0x76101c], eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x71c5f7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x71c688
jmp 0x71c697
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x71c639
jmp 0x71c697
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x71c670
jmp 0x71c659
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x71c69e
jmp 0x71c697
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x71c5e3
jmp 0x71c697
mov eax, dword [0x761020]
add eax, 0x26b1
mov dword [0x761020], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x71c60f
jmp 0x71c697
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
jl 0x71c5f7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x71c5cb
jmp 0x71c697
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x71c628
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x71c69e
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x71c740
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x761028], 0
mov byte [0x76102c], 0
mov dword [0x76101c], 0xcd2
mov dword [0x761024], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x71c864
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x761030], 0
mov edi, dword [0x76101c]
mov ebx, edi
add ebx, 0xfffff4ea
mov dword [0x76101c], ebx
mov ebx, dword [0x761028]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [esi + ecx]
add ecx, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add ecx, edx
mov dword [0x761030], ecx
add edi, 0xfffff1c3
mov dword [0x76101c], edi
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x28]
idiv ecx
mov dword [0x761028], edx
mov edi, dword [ebp - 0x24]
mov cl, byte [esi + edi]
mov byte [0x76102c], cl
mov dword [0x761020], 0x17dd
mov cl, byte [esi + edx]
mov byte [esi + edi], cl
mov dword [0x76101c], 0x742
mov cl, byte [0x76102c]
mov edx, dword [0x761028]
mov byte [esi + edx], cl
mov edx, dword [0x761024]
add edx, 1
mov dword [0x761024], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x71c78a
jmp 0x71c896
xor eax, eax
mov dword [0x761024], 0
mov dword [ebp - 0x20], eax
jmp 0x71c78a
mov eax, dword [ebp - 0x1c]
mov dword [0x76101c], 0x11d2
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x761024]
add eax, 1
mov dword [0x761024], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x71c864
jmp 0x71c850
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x71d2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x76101c], 0x26fd
mov dword [0x761024], 0
mov dword [0x761028], 0
mov dword [0x761034], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x71d443
jmp 0x71d328
mov eax, dword [0x76101c]
mov ecx, dword [0x761024]
mov edx, dword [0x761028]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
jmp 0x71d341
mov eax, 0x26fd
xor ecx, ecx
mov edx, ecx
mov esi, ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
jmp 0x71d341
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x24]
mov edi, 0x100
mov ebx, ecx
add ebx, 1
add eax, 1
add esi, 0x78a
mov dword [0x76101c], esi
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x761024], edx
mov esi, dword [ebp - 0x1c]
movzx esi, byte [esi + edx]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x34]
add esi, ecx
mov eax, esi
mov dword [ebp - 0x3c], edx
cdq
idiv edi
mov dword [0x761028], edx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x76102c], cl
mov dword [0x76101c], 0xb52
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x76102c]
mov edx, dword [0x761028]
mov byte [edi + edx], cl
mov edx, dword [0x761024]
movzx edx, byte [edi + edx]
mov ecx, dword [0x761028]
movzx ecx, byte [edi + ecx]
add ecx, edx
mov dword [0x76101c], 0x1ac5
and ecx, 0xff
mov dword [0x761034], ecx
mov dword [0x761020], 0xe6b
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x38]
mov ch, byte [edx + esi]
mov dl, cl
add dl, byte [0x761039]
mov byte [0x761038], dl
mov byte [0x761039], ch
mov byte [0x76103a], cl
mov dword [0x76101c], 0x120f
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x20], ebx
jne 0x71d306
jmp 0x71d443
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x71d450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov al, 0x6b
xor ecx, ecx
lea edx, [ebp - 0x6c]
mov dword [0x76101c], 0x150f
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0xd
mov dword [0x761020], 0xdc
mov dword [ebp - 0x70], edx
mov byte [ebp - 0x71], al
mov dword [ebp - 0x78], ecx
jmp 0x71d4d3
xor eax, eax
mov ecx, dword [0x761020]
add ecx, 0xffffdfb5
mov dword [0x76101c], ecx
mov dword [ebp - 0x7c], eax
jmp 0x71d53b
mov eax, dword [ebp - 0x78]
mov cl, byte [ebp - 0x71]
movsx edx, cl
mov si, dx
mov edx, eax
add edx, 1
mov word [ebp + eax*2 - 0x6c], si
mov cl, byte [ebp + eax - 0x2b]
cmp cl, 0
mov byte [ebp - 0x71], cl
mov dword [ebp - 0x78], edx
jne 0x71d4d3
mov dword [0x761020], 0x2c48
mov dword [0x76101c], 0x1a69
mov ecx, dword fs:[0x18]
cmp ecx, 0x1000
mov dword [ebp - 0x80], ecx
jb 0x71d4ba
mov dword [0x76101c], 0x15ed
mov dword [0x761020], 0x2566
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
mov dword [0x76101c], 0x1aad
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov edx, eax
add edx, 0x14
mov eax, dword [eax + 0x14]
cmp eax, edx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x8c], ecx
je 0x71d6b7
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x90], eax
jmp 0x71d583
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x28]
mov dx, word [eax + 0x24]
shr dx, 1
movzx esi, dx
cmp dx, 0
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x9c], esi
je 0x71d5ba
xor eax, eax
mov dword [ebp - 0xa0], eax
jmp 0x71d5d8
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x88]
cmp ecx, edx
mov dword [ebp - 0x90], ecx
je 0x71d6ad
jmp 0x71d583
mov eax, dword [ebp - 0xa0]
mov ecx, eax
add ecx, 1
mov edx, dword [ebp - 0x98]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], ecx
mov word [ebp - 0xaa], si
mov word [ebp - 0xac], bx
jb 0x71d62f
mov ax, word [ebp - 0xaa]
mov word [ebp - 0xac], ax
mov ax, word [ebp - 0xac]
mov ecx, dword [ebp - 0xa4]
cmp word [ebp + ecx*2 - 0x6c], ax
sete dl
cmp ax, 0
setne dh
mov bl, dl
and bl, dh
mov esi, dword [ebp - 0xa8]
mov edi, dword [ebp - 0x9c]
cmp esi, edi
setb dh
and dh, bl
test dh, 1
mov dword [ebp - 0xa0], esi
mov byte [ebp - 0xad], dl
jne 0x71d5d8
mov al, byte [ebp - 0xad]
mov dword [0x76101c], 0x252f
test al, 1
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0xb4], ecx
jne 0x71d69c
jmp 0x71d5ba
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x8c], eax
jmp 0x71d6b7
xor eax, eax
mov dword [ebp - 0x8c], eax
jmp 0x71d6b7
mov eax, dword [ebp - 0x8c]
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x71dd00
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
call fcn.00401080
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
je 0x71de3d
jmp 0x71de8a
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x40]
mov dword [esp + 0x84], eax
mov dword [0x76101c], 0x1606
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0071d770
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x20], eax
jmp 0x71ddb8
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
je 0x71dd27
mov eax, dword [esp + 0x1c]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x18], eax
mov dword [0x76101c], 0x7ac
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
jmp 0x71de72
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
jmp 0x71de8a
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0071cec0
lea ecx, [0x71cde0]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x88], edx
mov dword [esp + 0x70], 0x159000
mov edx, dword [0x761008]
mov dword [esp + 0x78], edx
mov edx, dword [0x76100c]
mov dword [esp + 0x90], edx
mov edx, dword [0x761010]
mov dword [esp + 0x60], edx
mov edx, dword [0x761014]
mov dword [esp + 0x74], edx
mov edx, dword [0x761018]
mov dword [esp + 0x68], edx
mov dword [0x76101c], 0x260
mov dword [0x761020], 0xfffff7c0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
jmp 0x71de72
lea eax, [esp + 0x40]
mov ecx, dword [0x76101c]
add ecx, 0xfffffa3e
mov dword [0x761020], ecx
mov dword [esp + 0xc], eax
call fcn.0071c590
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x20], ecx
je 0x71ddc5
jmp 0x71ddb8
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
je 0x71dd77
jmp 0x71dd8f
mov eax, dword [esp + 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x71df90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.0071da30
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x76101c], 0x239b
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
jne 0x71e037
mov eax, dword [ebp - 0x24]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
add eax, 1
mov cl, byte [ebp - 0x29]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x2a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dl, byte [ebp - 0x2a]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], dl
jne 0x71e051
jmp 0x71e083
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x30], edx
jmp 0x71e051
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x71dfd9
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [eax + ecx + 0x24]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
jmp 0x71e014
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x29], bh
mov byte [ebp - 0x2a], cl
mov byte [ebp - 0x31], bl
jne 0x71dfe4
mov al, byte [ebp - 0x31]
test al, 1
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x50], ecx
jne 0x71e0b7
mov eax, dword [ebp - 0x40]
add eax, 2
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov edx, dword [ebp - 0x18]
cmp ecx, edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
jb 0x71e014
jmp 0x71e030
mov eax, dword [ebp - 0x50]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [0x76101c], 0xbb6
mov dword [ebp - 0x24], esi
jmp 0x71dfd9
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x731b4ab5
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x22986a87
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x102c278
Capabilities:
Encode data using xor

Disassembly:
jmp 0x102c282
pushal
call 0x102c288
pop ebp
sub ebp, 0x10
sub ebp, 0xc2c278
jmp 0x102c29e
mov eax, 0xc2c278
add eax, ebp
add eax, 0x4c
mov ecx, 0x580
mov edx, 0x8a862bbe
xor byte [eax], dl
inc eax
dec ecx
jne 0x102c2b5
jmp 0x102c2c8
xor eax, 0x82373573
mov esi, 0x7f3fbebe
inc esi
mov esi, 0x73bdbebe
push es
mov ebx, 0x4bebebe
xchg esi, eax
mov esi, 0x5c49bebe
mov ebp, 0xb23f3576
mov esi, 0x7bbdbebe
out dx, al
out dx, al
salc
inc edx
mov eax, dword [0xc5d6bea1]
sbb al, 0x1d
mov esi, 0xd69a92bf
nop
int1
fild qword [edx + 0x56]
mov ebx, 0x57bebebe
xchg esi, eax
mov esi, 0x35ebbebe
push edx
xor eax, 0xbebeb63b
mov esi, 0xbeb22b35
mov esi, 0xae3335be
mov esi, 0x577fbebe
mov esp, 0x7c3dbc8f
mov edx, 0x4a3bb1f7
inc ecx
inc ecx
inc ecx
jecxz 0x102c3ae
mov dl, 0xbe
xor eax, 0xbeba9a32
mov esi, 0xa142d6be
mov eax, dword [0x1cc5d6be]
sbb eax, 0x9a92bfbe
out dx, eax
push esi
mov ebx, 0x57bebebe
cmp dword [esi + edi*4 - 0x1c151442], 0x41b2cb41
retf
xchg edi, eax
xacquire xchg dword [edi + 0x3dbb7f3d], edi
push esi
mov edx, 0x41410357
inc ecx
xchg edi, eax
ljmp 0x3db8
Function at 0x4031e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x404651
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4083a4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
mov dword [esi + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x14], ecx
mov cl, byte [esp + 0x48]
cmp cl, bl
mov dword [esi + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x44]
mov byte [esp + 0x20], 1
mov dword [esi + 0xc], ebp
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], cl
mov dword [esi + 0x30], ebx
jne 0x4032c4
xor edi, edi
cmp eax, ebx
mov dword [esp + 0x48], edi
jbe 0x403291
lea ecx, [edx + 0xc]
mov edx, eax
mov eax, dword [ecx]
cmp eax, edi
jbe 0x403278
mov edi, eax
add ecx, 0x10
sub edx, 1
jne 0x403270
cmp edi, 0x100000
mov dword [esp + 0x48], edi
mov eax, 0x406620
ja 0x403295
lea eax, [esp + 0x48]
mov eax, dword [eax]
mov dword [esi + 0x28], eax
add eax, 0xa
push eax
call fcn.0040397b
mov edi, eax
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, edi
je 0x4032bb
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0x24], edi
push ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
xor ecx, ecx
mov eax, ebp
mov edx, 0x44
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.0040397b
add esp, 4
mov dword [esp + 0x48], eax
cmp eax, ebx
mov byte [esp + 0x20], 2
je 0x403312
push 0x402410
push 0x4023d0
push ebp
lea edi, [eax + 4]
push 0x44
push edi
mov dword [eax], ebp
call fcn.00403ac3
jmp 0x403314
xor edi, edi
mov eax, dword [esi + 0x2c]
cmp eax, edi
mov byte [esp + 0x20], 1
je 0x403344
cmp eax, ebx
je 0x403341
mov ecx, dword [eax - 4]
lea ebx, [eax - 4]
push 0x402410
push ecx
push 0x44
push eax
call fcn.00403a60
push ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0x2c], edi
mov ecx, esi
call fcn.00402e70
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x24

Function at 0x40398c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4083a4]
jne 0x403996
repz ret
jmp fcn.00403e3e