joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d5900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
movzx esi, word [edx]
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, esi
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov dword [ebp - 8], ebx
mov ecx, dword [edi + esi*4]
mov eax, dword [edi + eax*4]
mov dword [ebp - 4], eax
movzx eax, word [edx + 0x10]
mov esi, dword [ebp - 4]
shr eax, 4
mov dword [ebp - 0x18], ecx
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4d598c
mov esi, edx
mov dword [ebp - 0xc], eax
add ebx, 4
push edi
push ebx
push ecx
push esi
call fcn.004d9670
push edi
lea eax, [ebx + 0x20]
push eax
push dword [ebp - 0x14]
lea eax, [esi + 0x10]
push eax
call fcn.004d9670
mov ecx, dword [ebp - 0x18]
add esp, 0x20
add ebx, 0x440
add esi, 0x20
sub dword [ebp - 0xc], 1
jne 0x4d5954
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
cmp ebx, 0x10
jbe 0x4d5a69
mov eax, dword [ebp - 8]
add ebx, 0xfffffff1
add eax, 0x44
shr ebx, 1
mov dword [ebp - 0x14], eax
movzx eax, word [edx + 0x10]
xor eax, 0x7f0
shr eax, 4
add esi, dword [edi + eax*4]
lea eax, [ebx + 0x180]
mov dword [ebp - 4], esi
lea eax, [edx + eax*2]
dec ebx
sub eax, 2
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x80]
mov ebx, dword [ebp + 8]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x4d59d3
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
movzx ecx, word [eax]
mov eax, ecx
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
add eax, esi
mov esi, dword [ebp - 4]
mov dword [edx + ebx*8 + 4], eax
mov eax, dword [ebp - 0xc]
test ebx, ebx
jne 0x4d59c0
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
lea ebx, [eax*4 - 0x40]
mov eax, dword [ebp - 0x10]
cmp eax, 1
jbe 0x4d5a69
lea esi, [ecx + 0x484]
lea edi, [eax - 1]
nop dword [eax]
push ebx
push edx
push esi
call fcn.004a6310
mov edx, dword [ebp - 0x14]
add esp, 0xc
add esi, 0x440
sub edi, 1
jne 0x4d5a50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d7cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
or ecx, 0x100
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
shr ecx, 1
and esi, 1
neg esi
shr esi, 4
movzx edx, word [ebx + ecx*2]
and esi, 0x7f
shr edx, 4
xor edx, esi
add eax, dword [edi + edx*4]
cmp ecx, 2
jae 0x4d7cd7
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4d7d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, 0x100
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
or ecx, esi
add edi, edi
mov edx, esi
and edx, edi
mov eax, ecx
add edx, esi
shr eax, 8
add eax, edx
mov edx, dword [ebp + 8]
movzx edx, word [edx + eax*2]
mov eax, ecx
shr eax, 7
add ecx, ecx
and eax, 1
shr edx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor edx, eax
mov eax, dword [ebp + 0x14]
add ebx, dword [eax + edx*4]
mov edx, ecx
xor edx, edi
not edx
and esi, edx
cmp ecx, 0x10000
jb 0x4d7d15
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x4d8e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
movaps xmm0, xmmword [0x4ff090]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x400
push edi
mov edi, 0xc
mov eax, dword [esi + 0x78]
lea edx, [esi + 0x1e54]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x201c]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x44], 1
mov dword [esi + 0x40], 1
mov dword [esi + 0x3c], 1
mov dword [esi + 0x38], 1
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
movups xmmword [esi + 0x1e1c], xmm0
movups xmmword [esi + 0x1e2c], xmm0
nop word [eax + eax]
mov ecx, 0x10
nop word [eax + eax]
mov word [eax - 0x180], bx
mov word [eax], bx
add eax, 2
sub ecx, 1
jne 0x4d8ed0
mov word [edx - 0x18], bx
mov word [edx], bx
mov word [edx + 0x18], bx
mov word [edx + 0x30], bx
add edx, 2
sub edi, 1
jne 0x4d8ec0
mov eax, 0x4000400
lea edi, [esi + 0x219c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x239c]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x98]
mov eax, 0x300
add ecx, dword [esi + 0x94]
shl eax, cl
test eax, eax
je 0x4d8f42
mov edi, dword [esi + 0x50]
mov ecx, eax
shr ecx, 1
mov eax, 0x4000400
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, 0x4000400
lea edi, [esi + 0x249c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x269c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esi + 0x289c]
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2a9c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov dword [esi + 0x1c], 0
lea eax, [esi + 0xbca4]
mov dword [esi + 0x18], 0
mov ecx, 0x800
mov dword [eax], 0x40000000
lea eax, [eax + 0x20]
sub ecx, 1
jne 0x4d8f94
mov dword [esi + 0x34], ecx
mov eax, 1
mov ecx, dword [esi + 0x9c]
mov edx, 0x100
shl eax, cl
mov ecx, dword [esi + 0x98]
dec eax
mov dword [esi + 0x4c], eax
mov eax, edx
shl eax, cl
mov ecx, dword [esi + 0x94]
shr edx, cl
sub eax, edx
pop edi
mov dword [esi + 0x48], eax
pop esi
pop ebx
pop ebp
ret

Function at 0x4d9670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov edx, dword [ebp + 8]
mov edi, ebx
shr edi, 1
mov esi, ebx
shr esi, 2
mov eax, edi
and eax, 1
neg eax
shr eax, 4
movzx ecx, word [edx + esi*2 + 4]
and eax, 0x7f
shr ecx, 4
neg esi
xor ecx, eax
and esi, 0x7f0
movzx eax, word [edx + 2]
xor esi, eax
mov eax, dword [ebp + 0x14]
shr esi, 4
mov edx, dword [eax + ecx*4]
add edx, dword [eax + esi*4]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
add edx, dword [ebp + 0xc]
movzx ecx, word [eax + edi*2 + 8]
mov edi, dword [ebp + 0x10]
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [esi + eax*4]
add eax, edx
mov dword [edi + ebx*4], eax
mov eax, dword [esi + ecx*4]
add eax, edx
mov dword [edi + ebx*4 + 4], eax
add ebx, 2
cmp ebx, 8
jb 0x4d9678
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4da700
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
mov dword [eax + 0x34], 0
lea esi, [eax + 0x60]
mov word [eax + 0x1e], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x468], 0xffffffff
mov dword [eax + 0x46c], 0xffffffff
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov dword [eax + 0x48], 4
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x4da746
pop esi
pop ebp
ret

Function at 0x4dc540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.004b621c
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x4dc56b
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x4de1d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4de361
cmp dword [esi + 0x20], 0
je 0x4de361
cmp dword [esi + 0x24], 0
je 0x4de361
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x4de361
cmp dword [edi], esi
jne 0x4de361
mov eax, dword [edi + 4]
cmp eax, 0x2a
je 0x4de238
cmp eax, 0x39
je 0x4de238
cmp eax, 0x45
je 0x4de238
cmp eax, 0x49
je 0x4de238
cmp eax, 0x5b
je 0x4de238
cmp eax, 0x67
je 0x4de238
cmp eax, 0x71
je 0x4de238
cmp eax, 0x29a
jne 0x4de361
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov eax, dword [edi + 8]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 0x18]
mov dword [edi + 0x14], 0
test eax, eax
jns 0x4de26d
neg eax
mov dword [edi + 0x18], eax
cmp eax, 2
jne 0x4de277
lea ecx, [eax + 0x37]
jmp 0x4de286
test eax, eax
mov ecx, 0x71
mov edx, 0x2a
cmovne ecx, edx
mov dword [edi + 4], ecx
push 0
push 0
push 0
cmp eax, 2
jne 0x4de29b
call fcn.0049ef40
jmp 0x4de2a0
call fcn.0049ecb0
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0
push edi
call fcn.004df2a0
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.004a6890
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x4ff0d2]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x4ff0d0]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x4ff0d4]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x4ff0d6]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebp
ret
pop edi
mov eax, 0xfffffffe
pop esi
pop ebp
ret

Function at 0x4e0890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4e08bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4e08bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4050f5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
invalid
invalid
invalid

Function at 0x40693c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]

Function at 0x40694b
Capabilities:
Hash data using djb2

Disassembly:
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x406964
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x406956
pop edi
pop esi
pop ebp
ret 4
Function at 0x40ec40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword fs:[0x2c]
add byte [eax], al
add byte [ecx + 0x5318244c], cl
push esi
mov ecx, dword [eax]
mov eax, dword [0x4d2580]
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x8c], ecx
cmp eax, dword [ecx + 4]
jg 0x40fe3a
mov ebx, dword [ebp + 0x10]
xor esi, esi
xor al, al
mov word [esp + 0x54], 1
push 8
mov byte [esp + 0x1f], al
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], esi
cmp al, 0x89
je 0x40ecbd
invalid
mov dword [esp + 0x14], esi
mov dword [esp + 0x34], esi
mov word [esp + 0x38], 1
call fcn.0041fddb
mov ecx, dword [edi]
mov edx, eax
add esp, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x50], edx
mov dword [esp + 0x4c], 1
mov dword [edx], 0x14
mov dword [edx + 4], esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x14], 0x17
mov eax, dword [esi + 4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x49c470]
mov dword [esp + 0x70], ecx
movsx eax, word [eax + 0xa]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x14]
test dword [ebp + 6], ecx
add byte [eax], al

Function at 0x41b731
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x124], ecx
mov ecx, dword [ecx]
push esi
mov esi, dword [eax]
mov eax, ecx
and eax, 0x800
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x5c], eax
push edi
push ebx
pop eax
setne al
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x78], eax
mov eax, ecx
shr eax, 9
and eax, 1
mov dword [ebp - 0x13c], edx
mov edx, dword [edx]
mov dword [ebp - 0xf8], eax
xor eax, 1
and ecx, dword [ebp - 0xc]
mov dword [ebp - 0xfc], eax
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x58], eax
mov eax, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x98], 0xff
mov dword [ebp - 0x110], 0xfc00
mov dword [ebp - 0x114], 0xdc00
mov dword [ebp - 0x12c], 0x7b
mov dword [ebp - 0x120], 0x3a
mov dword [ebp - 0x140], 0x87
mov dword [ebp - 0x90], 0x30
mov dword [ebp - 0xb4], 0x39
mov dword [ebp - 0x128], 0x27
mov dword [ebp - 0x118], 0x1e
mov dword [ebp - 0x11c], 0x82
mov dword [ebp - 0x138], 0x5d
jmp 0x41b9de
Function at 0x41cc39
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp + 0x14]
push esi
push edi
xor edi, edi
mov eax, dword [ecx]
mov dword [ebp - 0x10], edi
test eax, eax
je 0x41ccc1
mov edx, dword [ebp + 0xc]
dec eax
mov dword [ecx], eax
mov dword [ebp - 0x1c], 0x83
mov dword [ebp - 0x24], 0x81
mov dword [ebp - 0x28], 0x82
mov dword [ebp - 0x20], 0x85
push 0x77
pop esi
movzx eax, word [ebx]
cmp eax, 0x76
je 0x41ccc8
cmp ax, si
je 0x45c60d
movzx esi, ax
mov eax, 0x83
cmp esi, eax
ja 0x45c66e
add eax, 0xfffffffe
cmp esi, eax
jae 0x45cdbe
test esi, esi
je 0x45c625
cmp esi, 0x78
jne 0x45c61c
cmp dword [edx + 4], 0
jne 0x45c632
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
add ebx, 8
jmp 0x41cc7a
add eax, 0x61f870f
lahf
mov ah, 0x83
ret
movzx eax, word [ebx + 2]
lea ebx, [ebx + eax*2]
movzx eax, word [ebx]
jmp 0xb4e4cc91
lodsb al, byte [esi]
add byte [ebx], dh
sar byte [ecx], 0x42
add al, 0xf
xchg ebp, eax
shr cl, 0x91
push es
cld
je 0x45c651
mov bh, 0x4b
add cl, byte [ebx + 0x2bc903c3]
ror dword [edi], 0xb7
inc ebp
cmp eax, 0x7d
jb 0x45c667
mov ecx, 0x458b0082
cmp ax, cx
ja 0x45c667
xor edi, 1
mov eax, edi
jmp 0xb4e4ccd2
add ebx, 4
jmp 0x45c675
clc
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
jmp 0xb4e4cc86
cmp dword [ebp - 0x44], 0x4c
je 0x84baca5f
jmp 0x7545c66f

Function at 0x43927b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004390fa

Function at 0x466444
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp edi, ebx
je 0x421cdb
push esi
call 0x556fdc
mov eax, dword [ebx + 8]
cmp dword [edi + 0xc], eax
jae 0x46649e
push 8
pop edx
cmp eax, edx
jb 0x46646d
mov edx, eax
mov dword [edi + 0xc], edx
xor ecx, ecx
mov eax, edx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call 0x7541fe1a
cmp dword [edi + 4], 0
mov esi, eax
pop ecx
je 0x466498
std
ja 0x466496
call fcn.0041fe23
pop ecx
call [ecx - 0x77]
ja 0x46649f
mov dword [edi + 4], esi
mov eax, dword [ebx + 8]
and dword [ebp + 8], 0xffffffff
or bh, bh
mov dword [edi + 8], eax
je 0x4664cb
je 0x4664da
push 0x10
call fcn.0041fdea
pop ecx
mov ecx, dword [ebx + 4]
sub eax, 0x8458b8d
mov ecx, dword [ecx + eax*4]
and dword [esi + 8], 0
mov esi, 0x27fcffde
pushfd
cli
test dword [ebx + 0x4f8b0845], ecx
add al, 0x89
xor al, 0x81
mov ecx, dword [edi + 4]
mov dword [ecx + eax*4], esi
inc eax
mov dword [ebp + 8], eax
or byte [ebx], bh
inc edi
or byte [edx - 0x31], dh

Function at 0x4696e2
Capabilities:
Encode data using xor

Disassembly:
xor word [edi + eax*2], cx
inc edi
inc eax
cmp eax, ecx
jl 0x4696df
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x472055
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d2ff0], 0
push esi
push edi
mov esi, 0x4d2630
jne 0x472078
push 0
call fcn.0042e4f7
pop ecx
mov ecx, eax
call 0x51472015
mov dword [0x4d06e0], 0x458b0270
mov edx, 0xe3
mov dword [0x4d2ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7f458bfe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0x458b0634]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x47208d
mov eax, dword [esi]
mov dword [ebp - 4], 0x18c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7f458bfe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x4720c7
mov eax, dword [0x4d2630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7f458bfe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret

Function at 0x47290d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
lea ecx, [ebp - 0xdc]
call 0x647275d
std
jne 0x472933
lea ecx, [ebp - 0xdc]
call fcn.004727a1
xor esi, esi
test ebx, ebx
je 0x472951
invalid
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call 0x45d328e1
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jb 0x47293c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47911b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp - 0x74fbff80]
call fcn.0040a970
mov ecx, dword [ebp + 0xc]
xor eax, eax
push 0x49cc08
mov dword [ebx + 0x32e82044], ecx
or edi, ecx
dec dword [ebx + 0x43bf085d]
add al, 0x8b
xor byte [ebx - 0x1c3a1732], cl
clc
dec dword [ebx + 0x18b084e]
mov dword [esp + 0x30], eax
mov dword [ebx + 0x418b7024], ecx
add al, 0x89
inc esp
and al, 0x74
mov eax, dword [ecx + 8]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x7c], eax
inc dword [eax]
mov eax, dword [ebx + 4]
mov esi, dword [eax + 4]
mov ecx, esi
call fcn.0040751f
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov dword [esp + 0x34], eax
mov dword [esp + 0x60], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x64], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 0xc]
invalid

Function at 0x47c081
Capabilities:
Encode data using xor

Disassembly:
mov esi, ebx
push es
xor cl, cl
dec ecx
add byte [ebp - 0x74f08b37], al
jno 0x47c0c7
mov esi, dword [ecx + 0x38]
push ecx
call 0xeada1a18
mov ecx, esi
test esi, esi
jne 0x47c08c
test byte [ebp + 8], 1
je 0x47c0ae
push 0x7b83085d
push edi
call 0x3bbfe02
mov ecx, dword [ecx - 0x75]
invalid
mov eax, edi
pop edi
pop esi
pop ebp
add byte [ebx + ecx*4], al
Function at 0x4b2470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6c000]
push edi
or ebp, 0xffffffff
jmp 0x4b2492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b2499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2488
mov eax, 1
add ebx, ebx
jne 0x4b24ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b24bc
jne 0x4b24db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b24db
dec eax
add ebx, ebx
jne 0x4b24c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b24a0
add ebx, ebx
jne 0x4b24d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b252d
xor ecx, ecx
sub eax, 3
jb 0x4b24f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b2562
sar eax, 1
mov ebp, eax
jmp 0x4b24fe
add ebx, ebx
jne 0x4b24fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b24cc
inc ecx
add ebx, ebx
jne 0x4b250c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b24cc
add ebx, ebx
jne 0x4b2519
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b250e
jne 0x4b252a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b250e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b254c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b253e
jmp 0x4b248e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b254c
add edi, ecx
jmp 0x4b248e
pop esi
mov edi, esi
mov ecx, 0x301e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b256a
cmp byte [edi], 0x11
jne 0x4b256a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b256f
lea edi, [esi + 0xb0000]
mov eax, dword [edi]
or eax, eax
je 0x4b25de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb3194]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb31bc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b259c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb31c0]
or eax, eax
je 0x4b25d8
mov dword [ebx], eax
add ebx, 4
jmp 0x4b25b9
call dword [esi + 0xb31c8]
mov ebp, dword [esi + 0xb31c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b2612
sub esp, 0xffffff80
jmp 0x40f51a
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x58f16258
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x77d54514
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
jmp 0x431219