joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417960
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4e81bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4179bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
push 8
lea ecx, [ebp - 0xc]
call fcn.00402220
call fcn.00416890
push eax
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
call fcn.00416750
push 0x4d193c
lea ecx, [ebp - 0xc]
push ecx
call fcn.00417930
add esp, 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482147
mov esp, ebp
pop ebp
ret
Function at 0x428490
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb828
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4e81bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x14], 0
je 0x4284d9
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
jmp 0x4285d3
cmp dword [0x4eef44], 0
je 0x4285bc
lea ecx, [ebp - 0x28]
call fcn.00425470
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x60]
call fcn.00425180
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x48]
call fcn.00425180
mov byte [ebp - 4], 2
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, 0x4ef1bc
call fcn.00428c20
mov ecx, eax
call fcn.00428e90
push eax
lea ecx, [ebp - 0x28]
call fcn.0041c1d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.004251c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.004251c0
push 0x4cd5db
lea edx, [ebp - 0x28]
push edx
call fcn.0042f000
add esp, 8
movzx eax, al
test eax, eax
je 0x428583
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004251c0
mov eax, dword [ebp - 0x2c]
jmp 0x4285d3
lea ecx, [ebp - 0x28]
call fcn.00421c00
push eax
call fcn.004a11f1
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004251c0
mov eax, dword [ebp - 0x30]
jmp 0x4285d3
push 0x4eee40
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482147
mov esp, ebp
pop ebp
ret
Function at 0x430530
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4e81bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x430599
lea ecx, [ebp - 0x194]
push ecx
movzx edx, byte [ebp + 0xc]
and edx, 0xff
movzx eax, dl
movzx ecx, byte [ebp + 0x10]
and ecx, 0xff
movzx edx, cl
shl edx, 8
or eax, edx
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482147
mov esp, ebp
pop ebp
ret
Function at 0x466ff0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x10325476
pop ebp
ret

Function at 0x4735b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e81bc]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00476ba0
mov eax, dword [ebp + 0x14]
push eax
push 1
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSASocketW]
push eax
call fcn.00473580
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4735f8
mov eax, dword [ebp - 0xc]
jmp 0x473631
cmp dword [ebp + 8], 0x17
jne 0x473619
mov dword [ebp - 8], 0
push 4
lea ecx, [ebp - 8]
push ecx
push 0x1b
push 0x29
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
lea ecx, [ebp - 0x14]
call fcn.00417cb0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482147
mov esp, ebp
pop ebp
ret

Function at 0x475890
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4e81bc]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00476ba0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x18]
push edx
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
push eax
call fcn.00473580
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x18]
call fcn.00407fb0
cmp eax, 0x40
jne 0x475902
push 0x2746
mov ecx, dword [ebp + 0x18]
call fcn.004167a0
jmp 0x47591e
mov ecx, dword [ebp + 0x18]
call fcn.00407fb0
cmp eax, 0x4d2
jne 0x47591e
push 0x274d
mov ecx, dword [ebp + 0x18]
call fcn.004167a0
cmp dword [ebp - 0x14], 0
je 0x475929
or eax, 0xffffffff
jmp 0x475941
lea ecx, [ebp - 0x1c]
call fcn.00417cb0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482147
mov esp, ebp
pop ebp
ret
Function at 0x475c90
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4e81bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0xffffffff
je 0x475dc2
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x475d06
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
and edx, 8
je 0x475d06
xor eax, eax
mov word [ebp - 8], ax
xor ecx, ecx
mov word [ebp - 6], cx
push 8
lea ecx, [ebp - 0x14]
call fcn.00402220
lea ecx, [ebp - 0x14]
call fcn.00417cb0
lea edx, [ebp - 0x14]
push edx
push 4
lea eax, [ebp - 8]
push eax
push 0x80
push 0xffff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00475b60
add esp, 0x1c
call fcn.00476ba0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
call fcn.00473580
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x475dc2
push 0
push 0x2733
lea ecx, [ebp - 0x20]
call fcn.00476290
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042fe70
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x475d7b
push 0
push 0x4d5
lea ecx, [ebp - 0x28]
call fcn.00476290
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042fe70
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x475dc2
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
push 0x8004667e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
and edx, 0xfffffffc
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
call fcn.00476ba0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
call fcn.00473580
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x475ddd
lea ecx, [ebp - 0x30]
call fcn.00417cb0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482147
mov esp, ebp
pop ebp
ret
Function at 0x478920
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4e81bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0xc]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004788e0
movzx ecx, al
test ecx, ecx
je 0x47897f
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4789a2
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
push 0x478910
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482147
mov esp, ebp
pop ebp
ret

Function at 0x479e30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [0x4eef49]
test eax, eax
je 0x479e46
jmp 0x479edb
push 0x4ef198
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4ef180
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [0x4ef1b0]
cmp ecx, dword [ebp + 0xc]
jl 0x479e69
jmp 0x479edb
mov edx, dword [ebp + 8]
push edx
mov ecx, 0x4ef594
call fcn.0041c1d0
push str.TSLOG
push 0x4ef594
lea eax, [ebp - 0x1c]
push eax
call fcn.0047acc0
add esp, 0xc
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, 0x4ef594
call fcn.004344e0
lea ecx, [ebp - 0x1c]
call fcn.004251c0
push 0x4ef594
call fcn.00479ee0
add esp, 4
mov ecx, 0x4ef594
call fcn.00421c00
push eax
call fcn.004a27ef
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [0x4ef1b0], edx
call fcn.0047a160
mov byte [0x4eef49], 1
mov esp, ebp
pop ebp
ret
Function at 0x479ee0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x598
mov eax, dword [0x4e81bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov byte [ebp - 0x20c], 0
push 0x103
push 0
lea eax, [ebp - 0x20b]
push eax
call fcn.0049b140
add esp, 0xc
mov dword [ebp - 0x56c], 0xffffffff
mov byte [ebp - 0x414], 0
push 0x103
push 0
lea ecx, [ebp - 0x413]
push ecx
call fcn.0049b140
add esp, 0xc
lea edx, [ebp - 0x41c]
push edx
call fcn.0041aee0
add esp, 4
lea eax, [ebp - 0x41c]
push eax
call fcn.0047afa0
add esp, 4
mov ecx, 9
mov esi, eax
lea edi, [ebp - 0x598]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
call fcn.00421c00
push eax
push str._s.log
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00427fd0
add esp, 0xc
lea edx, [ebp - 0x55c]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 0xffffffff
jne 0x479fab
jmp 0x47a141
mov ecx, 1
test ecx, ecx
je 0x47a134
mov edx, dword [ebp - 0x55c]
and edx, 0x10
je 0x479fc8
jmp 0x47a115
mov byte [ebp - 0x310], 0
push 0x103
push 0
lea eax, [ebp - 0x30f]
push eax
call fcn.0049b140
add esp, 0xc
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.0049b140
add esp, 0xc
lea edx, [ebp - 0x530]
push edx
push 0x4d1254
lea eax, [ebp - 0x108]
push eax
call fcn.00427fd0
add esp, 0xc
mov ecx, dword [ebp - 0x58c]
push ecx
mov edx, dword [ebp - 0x588]
add edx, 1
push edx
mov eax, dword [ebp - 0x584]
add eax, 0x76c
push eax
push str.TSLog__04d_02d_02d.log
lea ecx, [ebp - 0x310]
push ecx
call fcn.0042fc60
add esp, 0x14
lea edx, [ebp - 0x108]
mov dword [ebp - 0x568], edx
lea eax, [ebp - 0x310]
mov dword [ebp - 0x564], eax
mov ecx, dword [ebp - 0x564]
mov dl, byte [ecx]
mov byte [ebp - 0x55d], dl
mov eax, dword [ebp - 0x568]
cmp dl, byte [eax]
jne 0x47a0c4
cmp byte [ebp - 0x55d], 0
je 0x47a0b8
mov ecx, dword [ebp - 0x564]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x55e], dl
mov eax, dword [ebp - 0x568]
cmp dl, byte [eax + 1]
jne 0x47a0c4
add dword [ebp - 0x564], 2
add dword [ebp - 0x568], 2
cmp byte [ebp - 0x55e], 0
jne 0x47a066
mov dword [ebp - 0x570], 0
jmp 0x47a0cf
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x570], ecx
mov edx, dword [ebp - 0x570]
mov dword [ebp - 0x574], edx
cmp dword [ebp - 0x574], 0
je 0x47a115
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
call fcn.00421c00
push eax
push str._s_s
lea ecx, [ebp - 0x414]
push ecx
call fcn.00427fd0
add esp, 0x10
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x55c]
push eax
mov ecx, dword [ebp - 0x56c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47a12f
jmp 0x47a134
jmp 0x479fab
mov edx, dword [ebp - 0x56c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482147
mov esp, ebp
pop ebp
ret
Function at 0x484ec7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4ae472
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ae2f1

Function at 0x4afc4f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004af90f
Function at 0x4f71e0
Capabilities:
Encode data using xor

Disassembly:
push edx
push ecx
push esp
dec eax
sar dword [edi + 0x22], cl
pop ebp
adc dl, byte [ecx + 0x56]
jno 0x4f7185
inc ecx
ljmp 0x70e
Function at 0x602843
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x1b
invalid
pop eax
cmp al, 0x55
hlt
inc esp
xchg ebp, eax
pop edx
dec eax
cmpsb byte [esi], byte es:[edi]
in al, 0xb4
add eax, 0xd7773bf5
test eax, 0x9a4b51a0
push ebx
dec ebx
push esp
inc esp
jnp 0x602865
mov ch, 0x5c
sub dh, byte [esi + 0x51]
add edx, dword [ebp + eax + 0x48]
jae 0x602813
shl dword [ebx - 0x25], cl
pop ds
jae 0x60282d
mov edx, 0xa3108ac1
and eax, 0x3a0565f5
lds edx, [ecx]
inc ecx
xchg ebp, eax
adc byte [ebx + 0x565f525], ah
cmp al, ch
adc dword [ecx - 0x6b], eax
fiadd dword [ebp + 0x55115404]
jecxz 0x60286e
sal byte [edi - 0x6476667b], cl
lcall 0xb1c5, 0x84c6f4c4
sal dword [esi + 0x1f], 0xfb
xor dword [eax], ecx
add eax, 0x10597a97
xor dword [ebp + 0x48], edx
and bh, byte [esi + ebx*4]
mov bh, 0xaa
lcall 0xb2cb, 0x331520eb
mov edi, 0xcaf7fa89
xchg ecx, eax
xchg byte [esp + edi*8], ah
insd dword es:[edi], dx
push ebx
dec esp
or dl, byte [ecx + 0x7a]
test dword [ebp + 0x51d657df], edx
lcall 0x11b3, 0xf1982265
mov dl, 0x95
scasd eax, dword es:[edi]
mov esi, 0x3555f1d6
fiadd dword [ebp + 0x463a3b78]
add dword [bx], esp
cli
inc ecx
xchg ebp, eax
popal
test dword [ebx + 0x74], esi
adc dword [eax - 0x68], edx
in eax, 0x60
cli
fldenv [eax - 0x1e235a26]
fbstp tbyte [ebp - 0xc04d55f]
jne 0x602883
test dword [ecx - 0x3b656477], ebx
hlt
cmp ah, byte [edx]
nop
outsd dx, dword es:[esi]
inc edi
mov ah, 0xd4
push edx
dec edx
inc edi
cmp eax, 0xfa0105a5
inc ebp
ljmp 0xc7b5

Function at 0x64d6d9
Capabilities:
Encode data using xor

Disassembly:
mov dl, 1
aad 0x27
or eax, dword [edx + eax - 0x51]
invalid
aaa
popfd
xor dword [esi - 0x3a], ebx
xchg edx, eax
mov bl, 0x2f
wait
insd dword es:[edi], dx
clc
call [ebx + 0x60c30c5a]
mov bh, 0x26
mov ah, 0x72
pop es
mov dh, 0xd0
wait
jecxz 0x64d6d2
pop ebx
push edi
pop eax
das
push ebx
push es
loop 0x64d6da
add ebp, dword [eax]
or ecx, 0xd38cf2b3
leave
mov bl, 0xf2
mov ebx, ss
leave
mov bl, 0xf2
mov ebx, ss
or eax, 0xffffffd0
jbe 0x64d66e
xchg ebx, ecx
sub al, 0x52
xchg esp, eax
shl byte [edi], cl
or eax, dword [esi + 0x5713159b]
xor cl, ah
inc ebx
and byte [edx], dl
test eax, 0xc84d2866
mov ecx, 0x409088bc
jae 0x64d6be
sahf
ja 0x64d6b3
adc esp, dword [esi - 0x70a2da7]
aam 0xb
clc
mov dh, 0x12
invalid
Function at 0x64f05f
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
enter 0xffffffffffffa806, 0xffffffffffffff9f
push ebp
xchg edi, eax
xchg edx, eax
iretd
sbb byte [ebx + 0x69], cl
test dword [0x20cbcb23], eax
jns 0x64f037
dec ebx
call 0xddff19a6
rcr dword [edx + 0x52], 1
sahf
xor bl, ah
in al, dx
idiv dword [eax + 0x4e]
salc
jo 0x64f0fa
int3
imul eax, eax, 0xfffffff2
pushfd
mov byte [eax + 0x7071124d], dh
jno 0x64f164
fst dword [edi + 0x54]
imul esi, esi, 0x42b23198
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
fistp dword [eax - 0x47221085]
jmp 0x64f0ea
xor dword [edx - 0x245051be], esi
cwde
jnp 0x64f0f2
fnstsw word [eax - 0x4f1d14ca]
dec esp
loope 0x64f177
inc ebx
invalid
xchg edx, eax
nop
sar byte [edx], cl
sti
mov eax, 0x15a34ea9
mov eax, 0xc0ebe633
test eax, 0xa653b81c
cmpsb byte [esi], byte es:[edi]
cmp dword [esi], ebp
jge 0x64f1ab
jge 0x64f19b
sbb dword [esi], 0xef889270
pop esi
pop eax
movaps xmm1, xmmword [edx + 0x3ea3e1e8]
wait
test dword [esi + edi*8 - 0x20ccf40e], 0x4abaa040
xor eax, 0x1e62820f
jb 0x64f20b
jb 0x6ad71003
insb byte es:[edi], dx
jne 0x64f1e4
push edi
imul ecx, dword [edx], 0x71
in al, 0x2e
mov eax, dword [0x3b6f0457]
popfd
mov ch, 0xc1
mov al, byte [0xb4038a1b]
sbb dl, byte [ebp + 0x2d]
adc al, dh
xor al, 0xb2
ficom word [bx + di]
mov byte [ecx - 0x710e719a], ch
sub dword [edi + 0x3f], edi
mov dword [0xc8b1c5c5], eax
or eax, 0x47fbb785
inc edi
cmp edi, dword [edx + 0x41]
push esp
inc esp
pop esp
xchg edi, eax
adc al, byte [esp + esi*4]
loope 0x64f1b3
xor edx, edi
sub dh, ah
xor ecx, edx
stosb byte es:[edi], al
push cs
retf 0x55ba
mov cl, 0xc6
salc
fdiv qword [eax + 0x656da6c]
and al, 0x6f
test eax, 0x1f7f69b1
int 0xaf
cld
dec eax
mov ebx, 0x6864de6e
test dword [esi + 0x39090a71], esp
dec ecx
xlatb
xchg esi, eax
invalid
Function at 0x656bf4
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
mov esp, 0x88d5fc2c
dec edx
jne 0x656c7c
push es
xchg ebp, eax
jbe 0x656c71
aad 0xb5
and byte [ecx - 0x3ccc20a6], 0x4f
cmp edx, dword [esi - 0x7b]
push 0xd15b1ff1
pop ebp
sub eax, 0xe230af63
insb byte es:[edi], dx
pop ecx
outsd dx, dword [esi]
mov eax, 0xd573868e
mov byte [0x353641c5], al
or cl, byte [edi - 0x12b78a9b]
daa
inc ebp
cmpsb byte [esi], byte es:[edi]
invalid
arpl word [ebp + 4], bp
pop esp
ret
cdq
cwde
cdq
pushal
mov cl, 0xcb
js 0x656ce8
imul edi, dword [esi], 0x186b6d70
and ebp, dword [edi - 0xf]
retf 0x4bf
rcr dl, cl
repe cmpsb byte [esi], byte es:[edi]
jne 0x656d22
add al, 0x73
cmp bh, cl
and dword [ebx - 0xb31da02], 0x4003333b
fisub dword [ebp + 0x7f]
or cl, byte [ecx - 0x5111ec6a]
push ebx
aam 0x41
inc ecx
adc al, 2
push ebx
aaa
movsd dword es:[edi], dword [esi]
jbe 0x656d71
mov byte [0x7ae613d8], al
and esi, dword [esi]
in eax, 0xe1
salc
inc esi
pop ebp
sbb esp, 0xffffff9f
or byte [edx + 0x4e7332f3], al
xor byte [edi - 0x59dd3281], dh
xchg ebp, eax
scasb al, byte es:[edi]
cli
xor dword [eax + 0x731094d], esp
push ss
adc ebx, ebp
push 0x411b0bc
mov ebx, 0x692ad37c
xchg byte [eax + 0x21], al
test dword [ebx], 0x1745073e
push ss
pop ebp
invalid
fnstsw ax
clc
jns 0x656d09
dec ecx
or dword [edx + 0x75], eax
sub esp, dword [esi]
inc ecx
inc ecx
xor eax, dword [ebx - 0x762c6c4a]
push es
xchg byte [eax - 0xa], dl
push esi
push es
sbb eax, 0xe0395127
xchg esi, eax
jo 0x656d7b
sub esp, edi
aaa
movsd dword es:[edi], dword [esi]
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x41135e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x10
pop ecx
xor eax, eax
push 0x100
push eax
mov byte [ebp - 0x44], 0
lea edi, [ebp - 0x43]
push ebx
rep stosd dword es:[edi], eax
call fcn.00421540
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call fcn.0041a1a2
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.00416e03
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.00421200
add esp, 0x28
push 0x40
lea edi, [ebx + 0x60]
lea esi, [ebx + 0x5a]
pop ecx
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [eax + ebx + 0x9f]
xor cl, byte [eax + ebx]
inc eax
cmp eax, 0x20
mov byte [eax + ebx + 0x9f], cl
jl 0x4113b9
push dword [ebp + 8]
call dword [0x42a210]
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x4113f7
mov al, byte [ecx + ebx + 0xbd]
xor al, byte [ecx + ebx]
inc ecx
cmp ecx, esi
mov byte [ecx + ebx + 0xbf], al
jl 0x4113e1
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x413332
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push 0x458d98
inc esi
call dword [0x42a210]
movzx eax, al
xor ecx, ecx
test eax, eax
jbe 0x413361
push edi
movzx edx, byte [ecx + 0x458d98]
mov edi, edx
imul edi, esi
xor edi, edx
inc ecx
cmp ecx, eax
mov esi, edi
jb 0x41334b
pop edi
mov eax, esi
pop esi
ret

Function at 0x419b4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
and dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, 0x10000
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + edx*4]
mov edx, ecx
and ecx, 0xffff
shr edx, 0x10
mov esi, ecx
mov dword [ebp - 8], ecx
mov ecx, edx
imul ecx, edx
mov dword [eax + 4], ecx
mov ecx, esi
imul ecx, esi
mov dword [eax], ecx
mov ebx, edx
sub ebx, esi
sub esi, edx
mov ecx, esi
imul ecx, ebx
xor esi, ebx
mov ebx, dword [eax + 4]
and esi, edi
neg esi
mov dword [ebp - 4], edx
mov edx, ecx
neg edx
sbb edx, edx
and edx, esi
add ecx, ebx
cmp ecx, ebx
sbb esi, esi
and esi, edi
add edx, esi
mov esi, dword [eax]
add ecx, esi
cmp ecx, esi
sbb esi, esi
and esi, edi
add edx, esi
mov esi, ecx
shl esi, 0x10
add dword [eax], esi
cmp dword [eax], esi
sbb esi, esi
neg esi
shr ecx, 0x10
add esi, ebx
add ecx, esi
add ecx, edx
mov dword [eax + 4], ecx
add eax, 8
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0x10]
jl 0x419b5e
pop edi
pop esi
pop ebx
leave
ret