joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11010cf0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov dword [ecx + 0xc], 0x45f479d7
mov dword [ecx], 0
mov esi, ecx
mov dword [ecx + 0x18], 0xf3cb3e57
mov dword [esi + 0x1c], 0x40092ee0
mov dword [esi + 8], 0x75bbf938
mov dword [esi + 0x10], 0xfd3371b0
mov dword [esi + 0x20], 0x8a4406c7
mov dword [esi + 0x24], 0x2cc8e4f
mov dword [esi + 0x28], 0xd12c3bc9
mov dword [esi + 0x30], 0xebcc478b
mov dword [esi + 0x34], 0x489225be
mov dword [esi + 0x38], 0xafda13f8
mov dword [esi + 0x10], 0x3f4cdc6c
mov dword [esi + 0x28], 0xea71e659
mov dword [esi + 8], 0x1d6efe4e
mov dword [esi + 0x30], 0x5a92a305
mov dword [esi + 0x34], 0x412b44f5
xor eax, eax
mov ecx, eax
inc eax
xor ecx, 0x3c2d1e0f
cmp eax, 0x1e
not ecx
mov dword [esi + eax*4 + 0x38], ecx
jl 0x11010d6c
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x28]
mov edx, eax
or edx, edi
and eax, edi
and edx, dword [esi + 0x10]
or edx, eax
mov eax, ecx
shl eax, 5
shr ecx, 0x1b
or eax, ecx
add edx, eax
mov eax, edi
shr eax, 2
add edx, dword [esi + 0x24]
shl edi, 0x1e
add edx, 0x5a837999
or eax, edi
add dword [esi + 0x20], edx
mov dword [esi + 0x38], eax
call fcn.11010ae0
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 8]
xor ecx, dword [esi + 0x38]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x20]
xor ecx, edi
mov edx, eax
shl edx, 5
shr eax, 0x1b
or edx, eax
mov eax, edi
shr eax, 2
add ecx, edx
shl edi, 0x1e
add ecx, dword [esi + 0x24]
add ecx, 0x5a837999
or eax, edi
pop edi
add dword [esi + 0x10], ecx
mov dword [esi + 0x28], eax
mov eax, esi
pop esi
ret

Function at 0x11011450
Capabilities:
Resolve function by hash

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x1c]
push edi
push 0xec0e4e8e
call fcn.11011100
mov ecx, dword [esi + 0x14]
push edi
push 0xffd97fb
mov dword [ecx], eax
call fcn.11011100
mov ecx, dword [esi + 0x14]
push edi
push 0x7c0017a5
mov dword [ecx + 4], eax
call fcn.11011100
mov ecx, dword [esi + 0x14]
push edi
push 0x4dc9d5a0
mov dword [ecx + 8], eax
call fcn.11011100
mov ecx, dword [esi + 0x14]
push edi
push 0x753a4fc
mov dword [ecx + 0xc], eax
call fcn.11011100
mov edi, dword [0x11007640]
mov ecx, 0x1100763c
lea edx, [esp + 8]
mov dword [0x11007600], eax
mov eax, dword [ecx]
push edx
mov dword [edx], eax
mov eax, dword [ecx + 8]
mov cl, byte [ecx + 0xc]
mov dword [edx + 4], edi
mov dword [edx + 8], eax
mov byte [edx + 0xc], cl
mov ecx, esi
call fcn.11011360
mov ecx, dword [esi + 0x14]
lea eax, [esp + 8]
push eax
mov edx, dword [ecx]
mov dword [0x11007608], edx
call fcn.11011200
mov dword [esi], eax
test eax, eax
je 0x1101152a
push eax
push 0xa84aeb81
call fcn.11011100
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [esi]
push eax
push 0xfcba95ab
call fcn.11011100
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi]
push edx
push 0x35e273e6
call fcn.11011100
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x11011ee0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11008ff8
push 0x110121ac
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x3459fe
mov dword [ebp - 0x28], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.11012320
add esp, 4
test eax, eax
je 0x11011f31
mov ecx, eax
call fcn.11011e50
mov dword [ebp - 0x1c], eax
jmp 0x11011f38
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x20], eax
call fcn.11011db0
test eax, eax
je 0x11011f72
cmp dword [ebp - 0x1c], 0
je 0x11011f68
mov ecx, dword [ebp - 0x1c]
call fcn.11011ec0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.11012330
add esp, 4
mov eax, 0x2a
jmp 0x1101209e
wait
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.110113b0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x11011fa1
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.11011540
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x11011fe4
mov esi, eax
test esi, esi
je 0x11011fd2
mov ecx, esi
call fcn.11011ec0
push esi
call fcn.11012330
add esp, 4
mov eax, 0x926
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x1101209e
mov ecx, dword [ebp - 0x20]
call fcn.110117f0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x2c], 0
jne 0x1101202c
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x11012026
mov esi, eax
test esi, esi
je 0x11012017
mov ecx, esi
call fcn.11011ec0
push esi
call fcn.11012330
add esp, 4
mov eax, 0xc3
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x1101209e
mov eax, dword ds:[0]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.11010f50
mov ecx, dword [ebp - 0x20]
call fcn.11011950
xor dword [ebp - 0x24], eax
wait
jmp 0x1101206d
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x1101208e
mov ecx, dword [ebp - 0x1c]
call fcn.11011ec0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.11012330
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x1101209b
mov dword [ebp - 0x24], 0x4e6
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401c00
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
dec ebx
and edx, 0xc0
rol edx, 0x9b
and ebx, 0x41
sbb edi, 0x79
imul edi
imul esi
or eax, 0xc5
rcl edi, 0xbc
imul esi
neg edi
imul ebx
or ebx, 0xf0
not esi
or edx, 0x5c
add edi, 0xd5
rcr eax, 0x72
ror eax, 0xbc
ror ebx, 0xe2
ror eax, 0xb8
imul edx
imul esi
or edi, 0x33
and esi, 0x36
inc esi
rcl edi, 0xfd
and edx, 0x21
add edi, 0xf6
not eax
rcl eax, 0xbb
add eax, 0xd7
rcl edx, 0x72
mov edi, 0xee
dec edx
dec edi
or esi, 0x4e
rcr ebx, 0x2a
neg eax
dec edx
mov ebx, 0xea
and ebx, 0x29
sub edi, 0x65
inc edi
sub eax, 0x95
imul esi
imul edi
rcr edi, 0x1a
rcr ebx, 0xb0
bswap edi
add edi, 0x2a
xor ecx, ecx
xor edi, edi
ror ebx, 0xff
or eax, 0x89
sbb edi, 0xd7
dec edx
bswap edx
dec eax
inc esi
inc edi
ror ebx, 0x5d
add esi, 0x4c
neg edx
sub eax, 0xc8
and esi, 0x72
not ebx
and edx, 0xa2
rcr eax, 0x63
add ebx, 0xe1
sbb esi, 0xb1
bswap eax
rcr edx, 0xfc
neg edi
not eax
mov edi, 0x16
neg esi
imul edx
and edi, 0xdd
inc edi
rol edi, 0xd4
add esi, 0x32
imul eax
mov eax, 5
or edi, 0x64
or edi, 0x1d
not eax
add edi, 0xbd
not edx
mov eax, 2
not eax
not esi
bswap edi
rcl eax, 0x24
not esi
ror eax, 6
mov edx, 0xc2
neg edx
imul edx
sub edi, 0x92
imul esi
bswap eax
dec edi
mov ecx, dword [ebp + 0xc]
rcr edx, 0xac
rol edx, 0x9e
add edx, 0x97
or ebx, 0xc1
rcr ebx, 0x79
imul edx
imul edx
rcl esi, 0xd
sub ebx, 0x36
dec edx
sub ebx, 0x88
rol edx, 0x89
neg ebx
neg esi
rol edi, 0xce
bswap esi
mov edx, 0xe1
add edi, 0xf1
inc edx
not ebx
inc esi
not edi
neg eax
add edx, 0xf1
rcr esi, 0x74
rcr eax, 0x2a
rcr eax, 0xa1
inc esi
rcr edx, 0xc1
sub edx, 0x64
imul eax
bswap esi
bswap eax
dec edx
sbb edx, 0xab
rol esi, 0xf6
dec ebx
add edx, 0x5a
dec ebx
imul esi
dec ebx
ror ebx, 0x7a
inc edx
inc eax
and eax, 0x5f
mov ebx, 0x27
bswap esi
imul eax
rcr edx, 0xcf
imul edx
mov edi, dword [ebp + 8]
mov ebx, esi
mov esi, ebx
xor eax, eax
mov eax, esi
mov eax, ebx
mov ebx, esi
mov esi, esi
xor ebx, eax
mov eax, esi
mov ebx, esi
mov ebx, ebx
mov esi, eax
not byte [edi]
mov esi, eax
mov esi, esi
mov eax, esi
xor esi, eax
xor eax, ebx
xor esi, eax
xor ebx, esi
xor esi, ebx
mov ebx, esi
sub byte [edi], 0x38
xor eax, ebx
xor eax, eax
xor ebx, eax
xor eax, eax
mov eax, eax
xor esi, ebx
xor eax, eax
xor eax, esi
xor eax, eax
add byte [edi], 0x76
xor eax, eax
mov ebx, eax
mov eax, esi
mov ebx, esi
mov ebx, ebx
mov eax, ebx
mov esi, ebx
xor ebx, ebx
xor eax, ebx
imul byte [edi]
inc edi
loop 0x401dca
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43ebce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43ebc3
pop esi
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x62
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x414ddc
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], ecx
or edx, eax
or edx, eax
dec esi
add ebx, 4
dec esi
cmp ebx, edi
jne fcn.00414ddc
ret
Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.0700e370
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.0700e370
int3

Function at 0x700d4d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d534
cmp byte [esi + 0x10], 0
je 0x700d4f2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov eax, dword [esi + 0xc]
pop ecx
mov byte [esi + 0x10], 0
push edi
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d522
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
test eax, eax
je 0x700d53b
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d536
xor eax, eax
pop esi
pop ebp
ret 8
push str.stream_read_error
push 0
call fcn.0700e370
int3

Function at 0x700d7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
jne 0x700d833
cmp dword [esi + 0xc], 0
je 0x700d82e
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d821
push str.stream_write_error
jmp 0x700d838
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8
push str.Attempt_to_write_read_only_stream
push 0
call fcn.0700e370
int3
Function at 0x700e370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x700e37f
pop dword [ebp - 0x44]
mov eax, 0x2a06b532
add eax, 0xdcfa2e4d
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xd13695b1
add dword [ebp - 0x54], 0x7d1baf9a
mov dword [ebp - 0x50], 0xda9b4614
sub dword [ebp - 0x50], 0xa867f9cf
mov dword [ebp - 0x4c], 0x12fe4997
sub dword [ebp - 0x4c], 0xc6b20569
mov dword [ebp - 0x48], 0xaec90315
add dword [ebp - 0x48], 0x5136fceb
lea eax, [ebp - 0x54]
push eax
mov eax, 0x5c0bd31a
add eax, 0xaaf54d16
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x8b9b954b
add dword [ebp - 0x54], 0xe8d6d40b
mov dword [ebp - 0x50], 0x4314c9ec
sub dword [ebp - 0x50], 0x1a86877
mov dword [ebp - 0x4c], 0xa2a9cd0a
add dword [ebp - 0x4c], 0xc0c59f62
mov dword [ebp - 0x48], 0xcb829c1b
add dword [ebp - 0x48], 0x347d63e5
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3839d
push 0
call eax
mov ecx, 0x3e8d
mov edi, eax
mov ebx, 0x7445f8a
add ebx, 0xffbd8076
add ebx, dword [ebp - 0x44]
mov esi, 0xa1ceb59f
sub esi, 0xc7d834fc
xor dword [ebp - 0xc], eax
mov edx, dword [ebx]
xor edx, esi
sub dword [ebp - 0x2c], edi
mov dword [edi], edx
add edi, 0x256bd649
sub edi, 0x256bd645
add ebx, 0x81c07dcb
add ebx, 0x7e3f8239
loop 0x700e496
add eax, 0x49044e7
add eax, 0xfb70a820
mov ebx, eax
add eax, 0xf057afbf
add eax, 0xfa85046
mov ecx, 0x202c2f14
sub ecx, 0x192c2f14
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x66d97e29
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..text_1
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1d18358d
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x45309e
Capabilities:
Encode data using xor

Disassembly:
push 0x55892dfb
xchg esi, eax
xor byte [ecx - 0x40], cl
mov eax, 0x597dc6c5
fstp qword [ecx - 0x74a36ece]
pop esp
invalid
movsd dword es:[edi], dword [esi]
je 0x453092
pop esp
mov esp, dword [ebp - 0x52bb108c]
inc esp
lodsd eax, dword [esi]
mov bh, 0x7e
scasw ax, word es:[edi]
adc dword [eax + 0x76dbb00e], ecx
and dword [ebp - 0x1be62390], esi
adc al, 0xa8
cli
mov ch, 0x70
fcomp qword [ecx]
in al, 0x14
test al, 0xfa
xor byte [ebp + 0x26b63d39], cl
nop
lcall 0x85cc, 0xdeb5481d
or eax, 0x1c31513c
mov word [edi], ss
imul ebx, dword [esi - 0x57], 0xb8f701ec
inc edx
js 0x45308c
into
aam 0x2a
adc dword [eax - 0x46f6dcba], ecx
std
pop ss
mov edi, 0x7e018d45
and ebp, dword es:[eax + ebx*4 - 0x61]
dec ebp
fldcw word [ecx + 0x70b5f287]
adc eax, dword [edi + 0x2d]
pop ss
mov edx, 0xb4a95694
call 0x9555de55
pop edx
sbb al, 0xfd
nop
jl 0x453116
cmc
stc
or dword [eax], ebp
push eax
dec edi
mov al, byte [0x84dc09dd]
adc eax, ecx
lahf
fldz
out dx, al
or byte [edx - 0x40], dl
jae 0x4530b0
jge 0x453187
imul ecx, dword [ebp + ebp - 0x1c], 0xe20d793d
pop edx
stc
mov ebp, 0xb183e53
mov esp, 0x3d3bf1a9
xchg ecx, eax
push cs
fisub word [ebp - 0x7b52c874]
inc ebp
mov ah, 0xb
mov cl, 0x3c
jmp 0x453151
sbb eax, 0xa8451115
dec esp
invalid
cmovg ebp, dword [eax + 0x21]
wait
cmpsb byte [esi], byte es:[edi]
push 0xffffffffffffffed
pop eax
cdq
jmp 0x79a05ae5

Function at 0x46029c
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x1b
mov ecx, 0x42db49f9
mov byte [ebp + 0x5c], bl
scasd eax, dword es:[edi]
mov cl, 0x1f
jle 0x4602fe
add al, 0x47
cdq
mov es, word [esi + 0xb]
out 0xd8, al
cmpsd dword [esi], dword es:[edi]
cmp al, 0x3c
mov cs, word [esp + ebp*4 + 0x39f798c1]
or eax, 0x69118c88
mov eax, dword [0x3e69aa4f]
retf
mov ah, 0xce
pop edi
xchg dword [esi + 0x333c4da1], ecx
dec ecx
fcomp qword [ecx - 0x24]
fscale
inc ebp
and byte [ebp - 0x6e], al
sal dword [ecx - 0x3e], 1
mov dword [0xac0d025d], eax
inc ecx
call 0x65950fbc
imul edi, dword [0x934d225a], 0xe189cd1d
push edx
lds eax, [0x9b14b835]
repne outsb dx, byte [esi]
insb byte es:[edi], dx
mov ecx, 0x8da6fb7e
mov bl, 0x99
fst dword [edi - 0x73]
sti
cmpsb byte [esi], byte es:[edi]
lea esi, [ebx - 0x72a82667]
out 0x58, eax
sbb al, byte [ebp + eax*4 + 0x6ce71a54]
or eax, 0x8b49e0
jl 0x460335
stosd dword es:[edi], eax
mul dword [ebx]
out dx, al
jp 0x460391
fcom dword [edx]
mov ebx, 0x599b5342
adc bh, byte [ebx + 0x599b5342]
mov ch, byte [esi + edi*8 - 0x18]
mov eax, dword [0x1763b1dd]
push ebx
add al, 0x6d
das
dec ecx
loopne 0x460355
pop ebp
mov eax, 0xb5462334
push ss
xlatb
or dword [ebx], esp
leave
fst dword [edx + 0x3ee9928a]
rol dword [esi - 0x41ec1485], 0xcf
push ecx
lodsb al, byte [esi]
cwde
add edx, esp
invalid
invalid
Function at 0x494380
Capabilities:
Accept command line arguments

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x18
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x4943a9
mov edx, dword [0x650d54]
push 0x650a88
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push esi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea eax, [esp + 4]
push eax
push 0x28
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x494444
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x49442a
mov ecx, dword [esp + 4]
push 0
push 0
lea eax, [esp + 0x14]
push 0
push eax
push 0
push ecx
mov dword [esp + 0x30], 2
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
neg esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x18
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 4]
xor esi, esi
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x18
ret
xor eax, eax
pop esi
add esp, 0x18
ret

Function at 0x49dd95
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x5fcae982
wait
adc al, 0xd2
test byte [ebp - 0x2cdcec2e], bl
cwde
ror dword [eax + 0x1c], 0xed
sar dword [ebx - 4], 0xfb
mov ebx, 0x39da5b80
sbb byte [ebx - 0x26], 0x39
fidiv dword [esi + edx*2 - 0x70b01a20]
jecxz 0x49dded
mov byte [edx + 0x29], bh
pop es
pop ebp
xor dh, byte [ebx - 0x3a]
aas
mov eax, 0x99392001
dec esi
jne 0x49ddae
sbb cl, byte [esi + 2]
popal
shr dword [ebp + 0x2d867ab1], cl
push 0x56d5f2b
xor byte [ecx - 0x23], bl
sub ch, byte [edx + edx*8]
fmulp st(7)
dec ebp
retf 0x7a7d
sbb dl, bl
mov ebx, 0xaffaedba
mov ch, byte [edi - 0x1591ded1]
int3