joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70e90e7e
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0x4c], esi
push esp
pop esi
pushfd
call fcn.70fdbc79

Function at 0x70e90e8a
Capabilities:
Packed with generic packer

Disassembly:
push ebp
nop
mov word [esp], ax
pushal
pushfd
push edi
xchg dword [esp + 0x28], ebp
push 0x5d227209
bswap bp
pushfd
mov ebp, dword [esp + 0x34]
call fcn.70f4d912
lea ecx, [ecx - 0x45d70da2]
call fcn.70e08a23
sbb eax, 0x98238597
or al, 0xad
je 0x70e90f27
std
sub eax, 0x4a04903a
add byte [ecx - 0x3a], dh
push eax
sbb byte [ebx + edx], ah
adc esp, dword [eax]
cld
and ah, bh
in eax, 0x28
and eax, 0x5082ddb
jbe 0x70e90f1e
push edi
sub esp, dword [eax + 0x3942fed]
mov dword [0x83906633], eax
mov esp, 0xc4a561ac
push edi
jle 0x70e90ecb
popal
movsd dword es:[edi], dword [esi]
les edx, [edi + 0x7e]
loope 0x70e90f30
inc ebp
add dword [ebp + 0x4c], edi
sub eax, 0x2eeb028f
jb 0x70e90f45
and ecx, ebx
aad 0xb2
fimul dword [ecx + 0x10]
jl 0x70e90f36
popfd
sar dword [ebx + 0x1b0df2a3], cl
xchg esi, eax
cmp eax, 0xba688ba0
lcall 0xb77b, 0x6d820036
sbb al, 0xf6
rcl dword [eax], 0x3a
nop
jno 0x70e90f95
dec esi
shr byte [ebp + 0x4d], cl
insd dword es:[edi], dx
dec ebp
jg 0x70e90f9f
pop edi
loope 0x70e90ee4
out 0x94, eax
xchg esp, eax
or dword [ebx - 0x190956a1], esi
dec eax
imul eax, dword [ecx + ecx*8 - 0x2257cab6], 0x8f9e9274
xchg dword [ecx + 0x3805b866], ecx
out dx, al
test cl, cl
dec edx
xor eax, 0x9274dda8
je 0x70e90eca
sahf
pop dword [edi + 0x5b86689]
cmp dh, ch
mov bh, 0x16
cmp cl, byte [ebx - 0x58]
dec dword [ebx + edx*2 + 0x52]
test al, 0xff
dec esp
push ebx
push edx
dec esi
mov ecx, 0x44236e57
pop esp
pop edi
xor dword [edx - 0x6e], edi
subps xmm4, xmm1
out dx, eax
mov byte [0x9857e39f], al
sub ch, byte [ecx + 0x721b9167]
aaa
imul esp, dword [esi - 0x35], 0x34
into
popfd
push eax
les esi, [ebx]
fisttp dword [ecx]
leave
mov eax, 0xdc8f142b
sub al, 0x5b
mov eax, dword [0x94f5bb1]
mov dh, byte [ebp + 0x52]
invalid
mov cl, byte [ecx - 0x5e]
invalid
xor esp, ecx
mov eax, dword [0x5a123700]
stc
fld xword [esi + 0x761476d9]
mov edx, 0xf321002c
dec eax
invalid
Function at 0x70e9bb60
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0xc], esi
jmp 0x70fd8be4
inc esp
fdiv st(0)
mov dword [esp + 8], 0xee7efe6e
jmp 0x70edb56c
outsb dx, byte [esi]
invalid
lea esp, [esp + 0x14]
and al, 0x14
jbe 0x70f5d919
pushfd
pushfd
mov esi, dword [esi + 0xa5730]
call fcn.70f16536
leave
jne 0x70eb5ed2
xchg byte [ebp - 0x22], dl
push edx
stc
mov ecx, 0x8430ab98
dec eax
push ecx
fimul word [eax + ebx*8 + 0x4f]
imul ebx, dword [ebx - 0x630bb907], 0xe968f35d
jg 0x70eb5f95
stosb byte es:[edi], al
out dx, al
movnti dword [eax], esp
std
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
dec edi
fidiv word [ebx + 0x7a]
cmp dword [eax + edi*4 + 0x7454eaa2], esp
popfd
push ecx
rcr byte [edi + 0x4e562894], 1
xor ebp, dword [edi - 0x7eaef6d2]
or dword cs:[ecx - 0x7f], edx
ja 0x70eb5ed9
jo 0x70eb5ee3
shl eax, cl
mov esp, 0x4a37e1ad
adc al, 0x9f
push ebx
cmp al, 0xa0
fadd qword [ecx]
pop ebp
xchg ecx, eax
adc byte [edi + edx*2 + 0x6e724f34], dl
invalid
or esp, edi
out dx, al
xchg dword [eax - 0x43c10fa9], ebx
sbb ebx, esi
sbb dl, al
add ecx, dword [esi + esi*2 + 0x25fd43ec]
popal
mov esp, edi
xor dword [ebp + ecx*4 + 0x7a], esp
out 0x7b, al
cmp byte [edi + ebx*8], 0xbc
push cs
lahf
mov dl, 0xaf
jnp 0x70eb5f37
cmp al, 0xdf
mov esp, 0xafb29f0e
inc ebx
scasb al, byte es:[edi]
pop edx
pop ebp
and al, 0x53
pop esp
sub dword [edi], esi
jg 0x70eb5fb3
jb 0x70eb6037
add byte [ecx], 0xc6
les eax, [edx + edx*2 + 0x689557db]
out 0x4e, eax
mov dl, byte [ecx - 0x73]
mov ah, byte [ebp + 0x79]
xor dh, 0x78
and edi, esi
lodsd eax, dword [esi]
push ds
out dx, eax
sbb dh, cl
cmpsd dword [esi], dword es:[edi]
xchg esi, eax
pop ecx
pop ebx
invalid
ror dword [ebx + 0x23], 1
enter 0xffffffffffff9044, 0xffffffffffffff84
mov eax, 0x10031b51
clc
push esp
fcomp qword [edi + esi*4 - 0x3eb51a66]
retf 0x85aa
push 0x2bca3680
pushfd
mov dword [esp + 0xc], 0x81655b20
pushfd
mov byte [esp + 8], bl
pushal
lea esp, [esp + 0x30]
jmp fcn.70deed42
call 0x70fbbde8
call 0x70e87af7
pushfd
push esp
mov esi, 0x70e2fdfd
jmp 0x70eb5ee2

Function at 0x70ed620f
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], dh
mov byte [esp], bl
mov dword [esp + 4], esi
lea esi, [edx*4 - 0x1af08617]
movsx si, cl
movsx si, al
mov esi, dword [esp + 8]
je 0x70e9b051
add al, 0x8d
xor al, 0x95
jmp 0xd7cebfaf
pushal
pushfd
push dword [esp + 4]
push ecx
lea esi, [esi + 1]
call fcn.70facb2e
adc dword [eax], eax
jle 0x70e9b02b
and al, 0xe4
mov cl, 0x84
ja 0x70e9b041
stosb byte es:[edi], al
lahf
inc ecx
xchg edi, eax
lds esi, [edx - 0x3e]
cdq
push esi
test byte [0xa5dc7b2f], ch
cdq
or dh, ch
xlatb
mov ah, 6
mov al, byte [ebp + 0x707fbc2d]
scasb al, byte es:[edi]
xor eax, 0x9ac3a738
sbb bl, ah
not dword [edi]
cmp byte [edi - 0x38caee36], ch
cmpsb byte [esi], byte es:[edi]
or bh, byte [eax + 0x15]
invalid
pushfd
mov byte [esp], dh
nop
jmp 0x70e9b024
Function at 0x70edbf02
Capabilities:
Packed with generic packer

Disassembly:
inc esp
and al, 4
outsd dx, dword [esi]
push 0xfffffffffffffff7
xor eax, 0x9c686060
rcr dword [ecx + 0x24648d9c], 0x48
jmp fcn.70def2d0
call fcn.70fc5734
adc bl, dl
jo 0x70edbeec
ja 0x70edbee6
xchg esp, eax
jge 0x70edbf24
jecxz 0x70edbf68
sbb dword [eax - 0x5e], eax
pushfd
mov cl, 0x19
mov bh, 0x24
fld dword [ecx - 0x5d]
clc
xor dword [ebx + 0x114e3687], edi
out dx, eax
pushfd
cld
mov ebp, 0x21f84ca2
mov byte [0x85128fde], al
test al, 0xb4
scasd eax, dword es:[edi]
cdq
ret
push 0xffffffffffffffea
xor al, 0xee
jbe 0x70edbf81
mov dword [0x7906fb86], eax
mov bh, 0x7c
or byte [ebx - 0x39847036], dl
cmp dword [ebp + 0x7b], ebp
insb byte es:[edi], dx
jp 0x70edbfed
imul esp, dword [edi - 0x7f], 0xffffffbc
ret
cmp dword [si - 0x7a3d], 0xa013c8a7
mov bh, 0xb5
inc eax
jmp 0x70edbfcd
ror byte [edi], cl
push ss
xchg esp, eax
dec eax
xor dword [0x58cc67e5], eax
dec edx
mov eax, 0x1244be9e
and eax, 0xdcfe91ee
mov eax, dword [0x12e9b1dd]
mov word [0x2a460a57], gs
and eax, 0x7d2b4e83
sub ah, byte [0x7d2b4e83]
adc byte [ebp - 0x42], cl
fisttp dword [eax]
popal
inc ebp
push esp
mov ecx, 0xed2fd2cf
movsd dword es:[edi], dword [esi]
pop edx
dec ebx
cmpsd dword [esi], dword es:[edi]
inc eax
invalid
Function at 0x70edddf2
Capabilities:
Packed with generic packer

Disassembly:
mov bh, bh
xor al, 0x24
mov dword [esp + 4], 0xb970499f
mov byte [esp], bh
pushal
mov ecx, 0x60243c88
pushal
push 0x417b63fb
arpl word [ebx + 0x41], di
lea esp, [esp + 0x48]
jmp fcn.70def310
call fcn.70ebdb6c
popal
lea edi, [edx - 0x44d21b9c]
aad 0xe2
push 0xffffffffffffffc1
inc esi
adc ah, byte [eax - 0x63b98fc9]
pushfd
push ecx
xlatb
dec eax
fsub dword [ebx - 0x48]
jecxz 0x70ed3ca1
ror byte [edi + 0x5429a14f], 0x31
jo 0x70ed3cf7
not byte [ecx]
test al, 0x77
dec ebx
imul eax, esi, 0xffffffc3
mov byte [0xa049073a], al
mov dword [0x1e4a3417], eax
push ds
int1
dec edi
dec ebp
mov eax, dword [0xbf413415]
adc eax, dword [edi - 0x6c402906]
dec edi
loop 0x70ed3cd8
das
jge 0x70ed3ca9
dec ebp
jb 0x70ed3c96
cmpsd dword [esi], dword es:[edi]
jne 0x70ed3d87
jno 0x70ed3cfb
push eax
rcr dword [ebp + 0x35752f86], 0x87
xchg dword [ebx], ebx
mov esp, gs
jg 0x70ed3d4b
in al, dx
pop ecx
setge byte [ecx + 0x2c]
pop edx
pop ds
push ecx
jmp 0x70ed3cc7
adc byte [esi + 0x4d], 0x81
pushfd
test dword [esi + ecx*8], eax
test edi, esp
push esp
or dl, dl
sbb al, byte ss:[esi]
dec edi
jne 0x70ed3cec
leave
cmp al, 0x71
movsb byte es:[edi], byte [esi]
jno 0x70ed3cee
in al, dx
sar byte [ebp + 0x63486bc1], 0x7a
movsd dword es:[edi], dword [esi]
and dh, 0x66
cmpsd dword [esi], dword es:[edi]
out 0x57, eax
loope 0x70ed3da9
push eax
movsd dword es:[edi], dword [esi]
mov dword [0xa0cc43e9], eax
shr dword [edi], 0x20
inc esp
out 0x94, eax
aaa
xchg ecx, eax
test dword [edx + 0x6d], 0x3e33e55e
pushal
jbe 0x70ed3d48
pop ecx
mov ah, 0x8f
imul eax, dword [esi - 0x76], 0x76
push ebx
or dh, dh
out 0x5c, eax
fdivr st(0), st(0)
fstp dword [esi + 0x61]
or dh, byte [ecx]
ror dword [esi - 0x60fe5db2], 0x87
loope 0x70ed3d4b
xor ecx, eax
mov cs, word [esi - 0x5e]
add dword [edi - 0x76451e79], ebx
pop ebp
and dword [0x1f425f77], edi
mov dword [ebp + 0x21], ebx
cmp al, 0x25
ja 0x70ed3df7
inc edx
pop ds
sti
mov bh, 0xea
jae 0x70ed3da2
xor byte [esi + 0x1e3c38b6], al
cmp byte [esi + ebx], bh
push edx
int 0x60
stc
mov dl, 0x2f
jmp 0x70ed3d33
clc
or byte [eax], ch
scasb al, byte es:[edi]
mov dh, 0x34
adc ebp, dword [ecx + 0x371aa9c9]
invalid
lea esi, [esi - 0x486117fe]
pushfd
mov word [esp], 0x8fba
jmp 0x70ed3cc2
Function at 0x70ee1086
Capabilities:
Encode data using xor

Disassembly:
push ecx
pushal
call fcn.70ee1ddd
pop ebx
sbb al, 0xfd
jmp 0x70eac5ae
sbb dword [edx - 0x2a571904], esi
std
clc
cmp ebx, dword [eax + 0x4ce46673]
push esp
stosb byte es:[edi], al
call 0xa3e5f6d4
pushfd
xchg edi, eax
inc esi
pop esi
bound esi, qword [esi + 0x78ae159e]
or byte [ebx + 0x714cd08c], ah
adc al, 0x18
movsd dword es:[edi], dword [esi]
jecxz 0x70eac5f7
or byte [ebx], ah
pop edi
push edx
cmp eax, dword [ebx]
lodsd eax, dword [esi]
dec eax
sbb bl, dh
nop
push 0xffffffffffffffe1
cld
and al, 0x17
mov dl, 0xec
pop es
push cs
cmp eax, 0xddffded4
mov al, 0x10
sbb al, 0x8f
invalid
neg dword [ebx + 0x63]
cmp al, 0x63
pop ebx
arpl word [ebx], di
mov dh, 0xbe
adc al, 0x71
inc esi
out dx, eax
xor ah, byte [ebp + 0x60b80b9d]
xchg edx, eax
pop esp
or byte [ebx - 0x5d], ah
push dword [eax + 0x3e]
jns 0x70eac5f6
aad 0xb0
out dx, al
insb byte es:[edi], dx
invalid
pushfd
mov dword [esp + 0x14], esi
lea esp, [esp + 0x14]
jno 0x71041f80
not si
mov esi, 0x70e07b81
jmp 0x70eac578
pushal
push esp
jmp 0x71031edb
xchg dword [esp + 0x44], esi
mov byte [esp], 0x6e
push dword [esp + 0x44]
ret 0x48
push eax
mov esi, 0x70e07b81
push dword [esp]
push ebx
lea esp, [esp + 0xc]
jb 0x70f726be
mov esi, dword [esi + 0xb51f0]
pushfd
pushal
mov byte [esp], bl
lea esi, [esi + 0x1bab098e]
pushal
jmp 0x70fc5b66

Function at 0x70f1c2bc
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, 0x70e3e902
movsx si, dl
mov ecx, dword [ecx + 0xdb8a9]
movzx si, cl
lea ecx, [ecx + 0x6c316c02]
not si
lea esi, [edi*4 + 0x59dbd872]
mov esi, ecx
not ch
call fcn.70f817d6

Function at 0x70f3392f
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x34], eax
jmp 0x70fd9f4d
call fcn.70ee113e
and al, 0x24
cmp bh, bh
pop esi
mov ecx, 0x2444c760
inc eax
pushal
invalid
call fcn.70f2cb58
outsd dx, dword [esi]
adc dword [esi], eax
fcom qword [ecx]
inc edx
sbb byte [ecx - 0x2de1e235], al
mov dword [edi - 0x1b76c52], ecx
insb byte es:[edi], dx
popal
leave
jns 0x70f06280
push esp
fdiv dword [ebx + 0x3b]
lds ebp, [edx]
jbe 0x70f0629f
invalid
pushfd
jmp 0x70ec0073
pushfd
movzx ax, bl
push dword [esp + 4]
mov eax, 0x70e3a7f6
push ecx
mov eax, dword [eax + 0xb5321]
jmp 0x70f062b8

Function at 0x70f39e16
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 4], bx
lea edx, [edx + 0x59ac9e06]
call fcn.70e010e0

Function at 0x70f3a709
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 0xc], 0x13
mov esi, dword [esi + 0x926f4]
lea esp, [esp + 0x3c]
jg 0x70fcf3d2
lea esi, [esi - 0x5884dd99]
pushfd
pushal
xchg dword [esp + 0x24], esi
pushfd
pushfd
push dword [esp]
push dword [esp + 0x30]
ret 0x34
movzx esi, al
movsx si, bl
mov esi, 0x70e066b2
push dword [esp + 4]
jmp 0x70eff41d
mov dword [esp + 0x30], eax
setb al
mov ah, byte [esp]
cwde
push dword [esp]
mov eax, 0x70e28eb3
mov byte [esp + 8], 0x9d
mov eax, dword [eax + 0x1609ed]
call fcn.70f2ce04
pushfd
pushal
mov byte [esp], bh
call fcn.70fdcf50
mov byte [esp], 0xe5
mov dword [esp + 8], edx
movzx edx, dl
mov dh, 0xda
mov edx, 0x70def485
call fcn.710421a6
push dword [esp + 0xc]
jmp 0x70f80c2f
Function at 0x70f54ab9
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea edi, [edi + 0x761d1289]
call fcn.7102760f
jmp 0x70eb3353

Function at 0x70f95ffd
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0x4154e7a7
push 0x9337d01f
mov ecx, dword [ecx + 0x7e2d8]
jmp 0x70e90ea9

Function at 0x70f97fc3
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [esp + 0x50], ecx
movsx cx, dl
mov ecx, 0x70e2fdb0
pushfd
lea esp, [esp + 0x50]
jg 0x70f8e77a
mov ecx, dword [ecx + 0x6f801]
call fcn.70f4a2e8
jmp 0x70f71e51

Function at 0x71018b62
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov eax, dword [eax + 0x1312ae]
mov byte [esp + 4], 0x86
lea esp, [esp + 0x48]
jl 0x70f71b0a
lea eax, [eax - 0x855e035]
pushal
call fcn.70f09550
pushfd
push esp
mov dword [esp + 4], 0x40aefe6f
pushfd
pushfd
jmp 0x710189ee
pushfd
mov byte [esp], 0x81
push 0xb5b4fea2
pushal
xchg dword [esp + 0x24], eax
movzx eax, al
bswap ax
mov eax, 0x70e13cf5
pushal
jmp 0x70e7b8f0
call fcn.70fb53d9
add eax, 0xf2aaa912
loop 0x70f71b83
out 0x2f, al
mov ebp, 0xbb01ccbe
mov ecx, 0x735672e
xchg byte [ecx + ebp*2 - 0x216c69a5], dh
xor dword [edx + 0x69], 0xdf7504c9
xor ebx, edx
nop
invalid
ret
sub bl, cl
push esp
cld
lahf
push ebp
push ds
sbb al, byte [ebp + 0x6a]
out 0x56, al
fst qword [eax]
sbb byte [0x3b752ef], dh
mov esi, dword [esi + 0x51734a93]
cmp dh, dh
mov al, 0xa9
imul edi, dword [edx + 0x79a5912a], 0xffffff9a
imul esi, dword [ebp + 0x4e], 0xffffffdc
imul eax, ebp, 0xbff09712
jg 0x70f71b67
sbb byte [ebp + ebx*4 - 0x6a], dh
sub dword [ebx], 0x1a
in eax, 0x31
insd dword es:[edi], dx
pop ss
retf 0x5eb3
mov dword [esp + 8], 0x493a55e5
pushal
lea esp, [esp + 0x28]
jmp fcn.70dec8fa
lahf
nop
bswap ax
movzx ax, al
cwde
pushal
mov eax, dword [esp + 0x20]
pushfd
mov byte [esp + 4], dl
push dword [esp]
xchg dword [esp + 0x2c], eax
push dword [esp]
lea esp, [esp + 0x30]
jne 0x70f5fece
pushfd
push 0xa90f75d7
xchg dword [esp + 4], eax
push dword [esp]
push edx
mov eax, 0x70e13cf5
mov word [esp + 4], cx
pushal
push esi
mov eax, dword [eax + 0x1312ae]
call fcn.70e97489
pushfd
mov dword [esp + 0x38], ebp
call fcn.70f361a3

Function at 0x71025e18
Capabilities:
Packed with generic packer

Disassembly:
pushfd
xchg dword [esp + 0x2c], eax
push dword [esp]
jmp 0x70fcf3f4
Function at 0x710672c9
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7106bbfb
mov eax, 0x2724a98f
insd dword es:[edi], dx
in al, dx
and byte [edi], bh
xchg edx, eax
ror edi, cl
pop eax
and ebp, ecx
and al, 0x46
pop ebp
push cs
xchg ecx, eax
retf
lea esp, [esp + 0x18]
je 0x7105b3b1
shl ecx, 0xa
add edx, eax
bsf cx, bx
ror cl, 4
rcl cl, cl
mov ecx, dword [esi + 0x7c]
push 0x38189568
pushal
clc
test sp, cx
add ecx, edx
pushfd
mov word [esp + 4], 0x5b52
rcr dword [esi + 0x42444c7], 1
push edx
pop ebx
stc
call fcn.7104f685
outsb dx, byte [esi]
mov byte [ebx], dh
leave
sbb byte [edi + 0x72189cb3], 0x4b
xor dword [edi - 0x7d], edi
push ebp
mov ah, 0x47
pushfd
call 0xa96a061a
pop ebp
dec ebx
cmp byte [ebp + 0x4b], bl
cmc
je 0x7106bc21
xchg ebp, eax
jle 0x7106bbdb
inc ecx
test eax, 0xb7e1a8d3
std
fisttp word [ecx + 0x2915ebe4]
xor byte [ebp + 0x2c], al
xchg edi, eax
loop 0x7106bcb8
sbb al, 0xfd
xor edi, dword [0xcf7c38b0]
mov eax, dword [0xf1e27eab]
cdq
jecxz 0x7106bc46
pop edx
int1
les ebp, [ecx + 5]
and byte [eax], cl
lahf
out 0x93, eax
sub al, 0x93
popfd
add eax, 0x32735f92
add dword ds:[ecx - 0x1b], esp
and byte [esi], ch
shl dword [ecx - 0x7b], cl
push eax
mov eax, 0xe50dd86d
dec edx
clc
adc esp, edx
in eax, dx
xlatb
xchg ecx, eax
and edx, edi
xchg edx, eax
in eax, dx
clc
push ss
dec ebp
mov ebp, 0x52805f0
invalid
test eax, 0xfeff169b
in eax, dx
fldcw word [ecx + 0x28]
xchg esi, eax
cmp bh, 0xf1
sub al, 0x81
pop ebp
sbb ch, byte [si - 0x76b1]
in eax, 0x99
dec edx
invalid

Function at 0x7106e7f1
Capabilities:
Encode data using xor

Disassembly:
xor esp, dword [ebp + 0x71348a39]
inc esp
inc esp
iretd
leave
add byte [0x87719205], 0xb
movsb byte es:[edi], byte [esi]
out dx, al
movsd dword es:[edi], dword [esi]
pop esp
into
lodsd eax, dword [esi]
xchg edx, eax
jno 0x7106e720
or esp, dword [esi + ebp*8 - 0x5231a35b]
jae 0x7106e796
xor dword [ebp + 0x33], eax
dec ebp
mov word [eax], cs
popfd
and al, 0xa6
jnp 0x7106e792
lodsd eax, dword [esi]
pushal
popfd
jge 0x7106e7d9
sbb ch, dl
daa
push ecx
mov word [esp + ecx*8 + 0x6d1768aa], fs
push ebp
ret
push es
pop ecx
into
xchg esi, eax
iretd
lodsb al, byte [esi]
jns 0x7106e796
ret
push 0xe14fd2d7
mov dword [esp + 0x30], 0x7104f294
call fcn.7105aabe
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add dl, dh
or dword [ecx + 0x37], edx
test dword fs:[eax + 0x39], ecx
pop eax
loop 0x7106e7e4
mov edi, 0x4d8733c8
sbb bl, byte [esi]
rcr ebx, 0xa2
dec edx
mov eax, dword [0x8f3890bb]
xor al, 0xa2
out dx, eax
popfd
or eax, dword [eax - 0x75a88433]
mov esi, 0xd0943ef7
int3
Function at 0x40a24c
Capabilities:
Create or open mutex on windows

Disassembly:
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xchg ebx, eax
push ss
dec edi
inc edx
or byte [ebx + 0x57205605], cl
inc eax
add byte [eax - 0x80], ch
mov byte [0x8b560040], al
push es
push eax
call 0xb2395600
pop edi
salc
ror byte [esi + 0xcc25d], 0xb1
sub eax, 0x90909090
nop
nop
mov dh, 0x90
nop
nop
mov edi, 0x458bec8b
or byte [ebx - 0x367afbb8], cl
daa
and eax, 0x150440c7
salc
call [edx + 0x500c0a83]
sbb dword [0x6effc03c], edx
xor eax, eax
pop ebp
ret

Function at 0x40b870
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cmp cl, 0x40
jae 0x40b88a
cmp cl, 0x20
mov cl, 6
invalid
adc al, al
xor edx, edx
ret
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x410bd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x410bf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x410bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x410be8
mov eax, 1
add ebx, ebx
jne 0x410c0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x410c00
jne 0x410c1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410c00
xor ecx, ecx
sub eax, 3
jb 0x410c30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x410ca2
mov ebp, eax
add ebx, ebx
jne 0x410c3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x410c48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x410c6c
inc ecx
add ebx, ebx
jne 0x410c58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x410c4d
jne 0x410c69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410c4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x410c8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x410c7d
jmp 0x410bee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x410c8c
add edi, ecx
jmp 0x410bee
pop esi
mov edi, esi
mov ecx, 0x16f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x410caa
cmp byte [edi], 6
jne 0x410caa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x410caf
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x410d1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10e74]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10f08]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x410cdc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10f10]
or eax, eax
je 0x410d18
mov dword [ebx], eax
add ebx, 4
jmp 0x410cf9
call dword [esi + 0x10f0c]
mov ebp, dword [esi + 0x10f14]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x410d52
sub esp, 0xffffff80
jmp 0x407294
Function at 0x402b78
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x429250]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402c0c
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402bc9
cmp dword [ebp + 0x10], ebx
jne 0x402c00
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402b78
test eax, eax
jne 0x402bdb
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402bb0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.004060df
cmp eax, ebx
je 0x402c13
push ebx
push dword [0x429250]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402c0c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x429250], ebx
jne 0x402c09
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402c09
jmp 0x402c0c