joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f6e4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4dec90]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x49f727
cmp word [esi], dx
jne 0x49f727
or byte [edi + eax + 0x28], 4
jmp 0x49f72c
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x49f87f
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x49f85f
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x49f76e
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x49f7a4
cmp eax, edx
jae 0x49f7b0
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x49f746
jmp 0x49f87f
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49f85b
cmp dword [ebp - 0x14], 0
je 0x49f85b
mov eax, dword [ebx*4 + 0x4dec90]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x49f833
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x49f7fc
mov word [esi], cx
jmp 0x49f82f
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4dec90]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4dec90]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4dec90]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x49f87f
pop ebx
cmp word [ebp - 4], bx
jne 0x49f844
cmp esi, dword [ebp + 0xc]
jne 0x49f844
mov word [esi], bx
jmp 0x49f87c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004019c4
add esp, 0x10
cmp word [ebp - 4], bx
je 0x49f87f
push 0xd
jmp 0x49f878
mov ecx, dword [ebx*4 + 0x4dec90]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x49f876
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x49f87f
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a6991
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4db034]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4a69dc
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004a6e53
test al, al
jne 0x4a69d6
sub edx, 2
cmp edx, edi
jne 0x4a69bc
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4a69fe
lea eax, [edi + 2]
cmp edx, eax
je 0x4a69fe
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004a658a
add esp, 0x10
jmp 0x4a6af8
push esi
lea ecx, [ebp - 0x255]
call fcn.004a6e53
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a6a41
push dword [ebp - 0x25c]
jmp 0x4a69ee
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4a6a7e
cmp word [ebp - 0x226], 0
je 0x4a6a9f
cmp word [ebp - 0x226], ax
jne 0x4a6a7e
cmp word [ebp - 0x224], 0
je 0x4a6a9f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004a658a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4a6aeb
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4a6a58
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4a6ad3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4a6af8
push 0x4a5f72
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405a1f
add esp, 0x10
jmp 0x4a6ac8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403288
leave
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 9
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x48
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xea
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xaf
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x48
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe2
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x5e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x74
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x92
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6a
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3c
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x70
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x74
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x35
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x16a7c48
Capabilities:
Encode data using xor

Disassembly:
jmp 0x16a7c52
pushal
call 0x16a7c58
pop ebp
sub ebp, 0x10
sub ebp, 0x12a7c48
jmp 0x16a7c6e
mov eax, 0x12a7c48
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d7
mov edx, 0xc18c7cbd
xor byte [eax], dl
inc eax
dec ecx
jne 0x16a7c85
jmp 0x16a7c98
jo 0x16a7cd1
xor al, 0x81
mov ebp, 0x7c3cbdbd
inc ebp
mov ebp, 0x70bebdbd
add eax, 0xbdbdbdb4
pop es
xchg ebp, eax
mov ebp, 0x5f4abdbd
mov esi, 0xb13c3675
mov ebp, 0x78bebdbd
in eax, dx
in eax, dx
aad 0xd
lodsb al, byte [esi]
lahf
mov ebp, 0xb5d72bd5
mov esp, 0xd59991bc
sal byte [edx - 0x47aaf7d8], 1
or byte [ebp - 0x48], dl
mov ebp, 0x8954bdbd
mov ebp, 0xd930bdbd
cdq
inc ecx
xor al, 0x91
cdq
push ecx
cmp byte ss:[ebp + 0x36bdbdbd], dh
sub byte [ecx + 0x36bdbdbd], dh
xor byte [ebp + 0x7cbdbdbd], ch
push esp
mov edi, 0x7f3ebf8c
mov ecx, 0x4938b2f4
inc edx
inc edx
inc edx
xchg ecx, eax
cdq
xor cl, bl
cdq
mov ecx, 0x36bdb17f
xor dword [ecx - 0x42424247], ebx
aad 0xd
lodsb al, byte [esi]
lahf
mov ebp, 0xb5d72bd5
mov esp, 0x309991bc
fstp dword [ecx - 0x664ecbbf]
push ebp
mov eax, 0x54bdbdbd
cld
mov edi, 0x30e8bdbd
rcr dword [ecx - 0x4e37bd43], 1
inc edx
enter 0x55b5, 0xffffffffffffffcf
mov ebp, 0x36bdbd
mov ch, 0xbd
mov ebp, 0x64c3cbd
jg 0x16a7d4a
mov ebp, 0x7f064c3c
cli
wait
cmp al, 0x4c
push es
jg 0x16a7d50
wait
invalid
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x3f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xef
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x43
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x5f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xae
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x49
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x45
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xee
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6c
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb8
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xa7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x82
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 2
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412eaa
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x3b
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8c
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xee
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc8
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd1
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xce
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x96
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3e
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x57
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xce
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x93
add esp, 0x40
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9a
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xe5
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc7
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1a
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451ba9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bba
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b052
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b063
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af39
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b08b
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..00cfg
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x65592162
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x64a90f8a
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4738c7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4735cc
pop eax
and ebx, ebx
dec ebx
inc ebx
call fcn.0047390a
add esi, esi
push esi
pop esi
or ebx, esi
xor dword [edx], eax
sub esi, ebx
add esi, 0xd8f529b3
add edx, 2
add esi, 0x21e333fc
inc esi
sub ebx, esi
cmp edx, edi
jl fcn.004738c7
add ebx, 1
sub esi, ebx
ret
Function at 0xe2365e
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov byte [esi], al
jmp 0xf8a615
push eax
add cl, 0x87
lea eax, [eax*8 + 0x33388b0c]
push edx
push edx
rol cl, 1
mov dword [esp + 0xc], eax
xor cl, 0xa
sub word [esp + 9], dx
not cl
jle 0xf7dd63
mov eax, 0x303f763e
btc si, sp
mov cl, dl
rol eax, cl
lea esi, [ebp + edx - 0x10c]
add al, dl
clc
xor al, byte [edi + esi]
jmp 0xb81c47
sal edx, 0x6a
shr al, 0xe2
xor bl, cl
call fcn.00fa8603
je 0xf8a628
inc edx
cmp edx, 0x104
add dword [eax], eax
add byte [edi], cl
sbb byte [ecx - 0x70], 0xe9
invalid
mov eax, dword fs:[0x30]
btc bx, sp
mov eax, dword [eax + 0xc]
neg ecx
rol ebx, cl
mov cx, 0x2a0f
mov ecx, dword [eax + 0xc]
xadd bh, bh
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
btc ebx, 0x19
ror bx, 0x3c
mov ebx, ecx
cmp ecx, eax
jmp 0xf8bc5f
je 0xb88f0b
lea ebx, [ebx]
test ax, ax
btc di, di
Function at 0xe605fd
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jge 0x10291cb
lea edi, [esi - 1]
jmp 0xf8a1f1
ret
pop esi
jmp 0xfc7ca1
dec edi
cmp bx, di
test sp, 0xd921
lea eax, [eax + edx]
xor ebx, ebx
mov dword [ebp - 0xc], eax
test edi, edi
jl 0xf97f93
jmp 0xfbe575
je 0x102655c
cmp eax, ecx
jmp 0x1004536
sub eax, dword [ecx + edx + 0x10]
jmp 0xe466d9
je 0xfa7e59
mov eax, dword [eax + 0x7c]
stc
test edi, edx
push ebx
push edi
cmp ch, 0xb6
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
test dx, di
cmp esi, 0xffff
ja 0xfa8847
mov eax, esi
test ecx, edi
jmp 0xe2c3cb
jmp 0xf97f8c
je 0xfa7e59
mov esi, dword [ebp + 0xc]
test esi, esi
je 0xfa7e59
mov eax, 0x5a4d
test cx, si
cmp bp, 0x4cb7
cmp word [edx], ax
jmp 0xfa7e53
jmp 0xf97f93
push ebp
not dx
inc dh
mov ebp, esp
btc edx, 0x97
mov edx, dword [ebp + 8]
test esi, 0x66284589
lea esp, [esp - 0x114]
clc
cmc
push esi
cmc
test edx, edx
jmp 0xe48e25
call fcn.00e3c2ca
lea esp, [esp + 4]
clc
test eax, eax
jmp 0xb7e1eb
jmp 0x10291d7
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
sal cl, 0x28
clc
mov ecx, dword [edx + eax + 0x24]
add dl, bh
lea edx, [ecx + esi*2]
movzx eax, word [edx + eax]
btr edx, ebx
mov ecx, dword [ebp - 4]
bsf edx, esi
mov edx, dword [ebp + 8]
test bh, 0x10
test ebx, esi
mov dword [ebp - 8], eax
sub al, 0x1e
rcl al, cl
mov eax, dword [ebp - 8]
clc
cmp eax, dword [ecx + edx + 0x14]
jae 0x102655c
mov esi, dword [ecx + edx + 0x1c]
lea eax, [esi + eax*4]
cmp sp, bp
clc
test bx, 0x821d
mov eax, dword [eax + edx]
cmc
cmp dl, 0x39
test eax, eax
jmp 0xe2460a
je 0xfebf15
xor eax, eax
mov si, bp
xchg esi, esi
jmp 0xbaeb3f
mov edi, dword [ecx + edx + 0x18]
test eax, 0x55172d3a
clc
test dx, si
test edi, edi
je 0xf97f93
mov eax, dword [ecx + edx + 0x20]
jmp 0xbb0eb5
mov eax, dword [ebp - 0xc]
rcl esi, 0xa0
mov ecx, dword [ebp + 0x10]
shld si, ax, 0x25
bt si, 0x32
add si, bp
lea esi, [edi + ebx]
sar esi, 1
mov eax, dword [eax + esi*4]
cmp bx, 0x2a8a
test ecx, 0xdbbdbd02
push ecx
mov cl, ah
rcr cx, 0x13
mov ecx, dword [ebp + 0xc]
cmc
test ah, 0x86
add eax, edx
jmp 0xf7b5fb
mov esp, ebp
not bp
pop ebp
jmp 0xb83487
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0xfa7e59
mov ecx, dword [eax + 0x78]
test esi, esi
mov dword [ebp - 4], ecx
test dh, ah
test ecx, ecx
jmp 0xe420fb
jb 0xe3c3d1
mov esi, dword [ebp - 0x10]
add esi, ecx
jmp 0x102ac28
jle 0xf97f64
lea ebx, [esi + 1]
not dx
cmp ebx, edi
mov dl, ah
not dl
mov edx, dword [ebp + 8]
jle 0xfbe56f
mov ecx, dword [ebp - 4]
jmp 0xe5bfbf
cmp eax, esi
jmp 0xf7ac78

Function at 0xf7be14
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
jne 0x100c842
jmp 0xb86715
not ecx
push 0x8136718a
mov dword [ebp], ecx
lea esp, [esp + 4]
jmp fcn.00f61f54
dec edx
jmp 0xb8556e
jmp 0x10221dc
rcr byte [0xfccdad71], 0xd8
test al, dh
cwde
mov eax, 0xc3bbdda7
shl ax, 0x68
movzx eax, byte [edi]
jbe 0xb8d44d
call 0x8b20dff2
dec esi
adc byte [ecx], al
test eax, 0x8ba9df77
mov edi, 0xa8386738
push cs
loopne 0x10221d2
xchg edi, eax
mov al, 0x9f
mov al, byte [0x718a660]
test dword [eax + 0x37], 0x1057c018
jg 0x10221dc
or byte [esp - 0x2bcdac7a], 0xfe
invalid