joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x193e0bdf
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x69cb1e80
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x24175a52
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2e2675ae
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40195e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40199d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40199d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40199d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40199d
cmp dword [ecx + 0x74], 0xe
jbe 0x40199d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x408409
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x417040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x408454
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00408626
test al, al
jne 0x40844e
sub edx, 2
cmp edx, edi
jne 0x408434
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x408476
lea eax, [edi + 2]
cmp edx, eax
je 0x408476
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00408355
add esp, 0x10
jmp 0x408570
push esi
lea ecx, [ebp - 0x255]
call fcn.00408626
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4084b9
push dword [ebp - 0x25c]
jmp 0x408466
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4084f6
cmp word [ebp - 0x226], 0
je 0x408517
cmp word [ebp - 0x226], ax
jne 0x4084f6
cmp word [ebp - 0x224], 0
je 0x408517
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00408355
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x408563
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4084d0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40854b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x408570
push 0x4080b6
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040ca50
add esp, 0x10
jmp 0x408540
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401c95
leave
ret

Function at 0x40a33b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412000
push 0x411ff8
push str.FlsAlloc
push 0x1f
call fcn.0040a257
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40a36f
push dword [ebp + 8]
mov ecx, esi
call dword [0x410124]
call esi
jmp 0x40a375
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40a3b9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412010
push 0x412008
push str.FlsGetValue
push 0x21
call fcn.0040a257
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40a3f0
push dword [ebp + 8]
mov ecx, esi
call dword [0x410124]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40a3f8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412018
push 0x412010
push str.FlsSetValue
push 0x22
call fcn.0040a257
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40a432
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x410124]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x40c186
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x6469d8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40c1c6
cmp byte [ebx], 0xa
jne 0x40c1c6
or byte [edi + eax + 0x28], 4
jmp 0x40c1cb
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x40c2ca
mov dl, byte [eax]
cmp dl, 0x1a
je 0x40c2ad
inc eax
cmp dl, 0xd
je 0x40c1f7
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x40c21d
cmp eax, ecx
jae 0x40c22b
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x40c1df
jmp 0x40c2ca
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c2a8
cmp dword [ebp - 0x10], 0
je 0x40c2a8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x6469d8]
test byte [eax + edi + 0x28], 0x48
je 0x40c282
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x40c26d
mov byte [esi], dl
jmp 0x40c27e
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x6469d8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x40c2ca
cmp byte [ebp - 1], 0xa
jne 0x40c291
cmp esi, ebx
jne 0x40c291
mov byte [esi], 0xa
jmp 0x40c2c9
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040bf7f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x40c2ca
mov byte [esi], 0xd
jmp 0x40c2c9
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x6469d8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x40c2c7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x40c2ca
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40c2d3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x6469d8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40c319
cmp word [ebx], dx
jne 0x40c319
or byte [eax + edi + 0x28], 4
jmp 0x40c31e
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x40c481
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x40c461
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x40c35f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x40c395
cmp eax, edx
jae 0x40c3a3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x40c33a
jmp 0x40c481
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c45c
cmp dword [ebp - 0x18], 0
je 0x40c45c
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x6469d8]
test byte [eax + edi + 0x28], 0x48
je 0x40c432
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x40c3f6
mov word [esi], cx
jmp 0x40c42d
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x6469d8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x6469d8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x6469d8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x40c481
pop eax
cmp word [ebp - 4], ax
jne 0x40c442
cmp esi, ebx
jne 0x40c442
mov word [esi], ax
jmp 0x40c47e
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040bf7f
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x40c481
push 0xd
pop eax
jmp 0x40c43d
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x6469d8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x40c47b
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x40c481
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40d4f5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0040d471
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x40d664
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x40d664
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x40d619
jg 0x40d551
test eax, eax
je 0x40d60f
push 1
push 0x1000
call fcn.00408059
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40d574
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x40d606
push 0x8000
push ebx
call fcn.00405278
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x40d59d
jg 0x40d598
cmp ecx, 0x1000
jb 0x40d59d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00407981
add esp, 0x10
cmp eax, 0xffffffff
je 0x40d5e2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x40d598
jl 0x40d5c9
test ecx, ecx
jne 0x40d58a
push dword [ebp - 0xc]
push ebx
call fcn.00405278
push esi
call fcn.00406519
add esp, 0xc
xor ebx, ebx
jmp 0x40d672
cmp byte [edi + 0x24], 0
je 0x40d5f9
cmp dword [edi + 0x20], 5
jne 0x40d5f9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x40d604
mov ebx, dword [edi + 0x18]
jmp 0x40d606
xor ebx, ebx
push esi
call fcn.00406519
pop ecx
jmp 0x40d672
test ecx, ecx
jg 0x40d5db
jl 0x40d619
test eax, eax
jae 0x40d5db
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0040bf7f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40d639
cmp byte [edi + 0x1c], 0
je 0x40d5db
jmp 0x40d66a
push ebx
call fcn.00409705
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40d5db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x40d672
cmp byte [edi + 0x1c], 0
je 0x40d66f
mov ebx, dword [edi + 0x18]
jmp 0x40d672
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0040bf7f
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40f660
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f68d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f68d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x49a40ff5
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x61bc01ee
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x414de9
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [esi], ecx
add esi, 4
sub edi, edi
cmp esi, eax
jne fcn.00414de9
add edx, 0x4bb0c82
and ebx, edi
ret
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x1ae61c1a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x36c07cbb
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x774376
Capabilities:
Encode data using base64

Disassembly:
jmp 0x7a81b8
jmp 0x7a8249
call 0x7a84ee
call 0x7a827f
mov esp, 0x87f7cc2d
fdiv dword [edx]
sub eax, 0xaf5f6f38
push cs
rol dword [eax + reloc.IPHLPAPI.DLL_GetInterfaceInfo], 0xff
je 0x77431a
pushfd
push word [esp + 2]
lea esp, [esp + 2]
jmp 0x7a8229
add cl, byte [ebp - 0x16fddb9c]
sub dword [edi], edi
add eax, dword [eax]
sar byte [ebx], 1
salc
adc ebx, edi
push ecx
cmp dl, 0x61
jmp 0x7a835e
xor ebp, edi
arpl word [ecx + 0x20], bp
aad 0x44
neg esi
jmp 0x7a85ee
cmp dl, 0x30
jmp 0x7a8376
mov cl, byte [ecx + 3]
jmp 0x7a83ce
cmp dl, 0x2b
call 0x774376
insd dword es:[edi], dx
jmp 0x7a83eb
pushfd
jmp 0x7a8194
cmp al, 0x2f
pushfd
mov byte [esp + 2], ch
lea esp, [esp + 4]
jne 0x7742a0
je 0x774245
xchg edi, eax
adc byte [esi + 0xdae10e1], al
lea esp, [esp + 8]
cmp al, 0x2b
je 0x774245
jmp 0x7a8176
mov bl, byte [ecx + 1]
mov byte [ebp - 1], bl
cmp bl, 0x41
call 0x7a81a2
push word [esp + 3]
mov word [esp + 1], sp
mov word [esp + 2], si
lea esp, [esp + 2]
jmp 0x7a81e9
lea esp, [esp + 4]
jb 0x77428a
pushal
push dword [esp + 9]
pop word [esp + 0x19]
jmp 0x7a829d
jbe 0x774323
ja 0x7742f1
cld
dec dword [ebp - reloc.IPHLPAPI.DLL_GetInterfaceInfo]
sti
xor byte [edi], cl
and byte [ebp - 0x17000340], 0x35
add byte [eax], al
add byte [ebp - 0x37], al
lea esp, [esp + 4]
cmp bl, 0x30
jb 0x7742db
call fcn.007a8270
inc ebp
leave
pop ecx
cmp bl, cl
ja 0x7a8227
in eax, 0x6a
clc
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffaf
or esp, dword [edx + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
sbb byte [edi - 0x7f000340], 0xfb
jp 0x7a8241
cmp bl, 0x61
jb 0x7742f1
cmp bl, 0x7a
jmp 0x7a821d
invalid
lea esp, [esp + 2]
lea esp, [esp + 0x20]
cmp bl, 0x5a
jbe 0x774323
ja 0x77428a
lea esp, [esp + 0x14]
cmp bl, 0x2f
call fcn.007a82f4
or bl, byte [ecx + 0x269b6809]
js 0x7a8323
mov dl, 0xad
je 0x774323
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x7a82b4
std
insd dword es:[edi], dx
hlt
lea esp, [esp + 4]
cmp dl, 0x5a
call fcn.007a832c
lea esp, [esp + 4]
jbe 0x774357
ja 0x774307
jb 0x774339
jae 0x7a8390
sbb al, 0x8b
sbb edi, dword [esi - 0x73]
dec esi
mov dl, 0x2c
mov byte [0xb98134c5], al
cwde
jmp 0x7a8342
jb 0x77436d
jae 0x7a84a8
out 0x7f, al
out dx, eax
mov bh, byte [ecx + 0x46]
int3
cmp dl, 0x7a
jbe 0x774357
ja 0x774339
cmp dl, 0x3d
jmp 0x7a83c2
clc
stc
cmp dl, 0x2f
je 0x774357
jne 0x7a839f
jne 0x7742a0
je 0x774357
cmp cl, 0x41
call fcn.007a8459
and al, 0xa6
xor al, 0x53
scasb al, byte es:[edi]
insb byte es:[edi], dx
push esi
fisttp dword [ebx + 0x2e]
invalid
mov word [esp], bx
push word [esp + 3]
lea esp, [esp + 2]
lea esp, [esp + 4]
je 0x774357
jne 0x7a83b5
cmp dl, 0x39
jbe 0x774357
ja 0x77436d
je 0x7a7d0c
jne 0x7742a0
mov dword [edx], eax
nop
test dword [edx], reloc.IPHLPAPI.DLL_GetInterfaceInfo
inc esp
stc
cmp cl, 0x3d
pushal
lea esp, [esp + 0x20]
jmp 0x7a84b7
mov dl, byte [ecx + 2]
cmp dl, 0x41
jb 0x774307
call 0x7a8374
Function at 0x784553
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0773488
jmp 0x7845e3
pushfd
jmp 0x78414b
mov byte [esp + 2], ah
mov word [esp + 1], dx
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x78453d
jo 0x7845a7
jno 0x7845a7
mov cl, byte [esp]
jmp 0x7845c8
mov cl, byte [esp]
add cl, cl
mov edx, dword [esp]
jmp 0x7845cd
mov esi, dword [esp + 0x30]
neg cx
jo 0x784586
jno 0x78458f
cpuid
lea ecx, [esi + ebp]
mov ax, 0x4020
bsf ebp, edx
jmp 0x7845f1
add cl, cl
mov edx, dword [esp]
lea edi, [esp + 4]
jmp 0x7845b2
mov bp, word [esp]
push ebx
mov byte [esp + 1], dh
rol dl, 7
jmp 0x784582
jo 0x784607
jno 0x784607
jl 0x7845f6
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
mov bl, 0x5a
rol byte [esi + 0x21], 1
shl byte [edx - 0x33], 1
pop esp
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x784589
sub esp, 0xbc
mov ebp, esp
in al, dx
mov esp, 0x8b000000
in al, dx
not ah
jmp 0x78462d
jmp 0x78468d
mov al, 0xfe
sete ch
lea ecx, [ebp*4]
push bp
jmp 0x784671
not edx
mov cl, 0xc9
xchg dx, cx
mov ebx, esi
bts dx, bx
jo 0x784613
mov dx, 0x8b32
rdtsc
mov ax, word [esp]
mov al, 0xfe
sete ch
jmp 0x78461a
mov ecx, ebp
lea esp, [esp + 2]
neg esi
mov ch, byte [esp]
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x7846b2
mov dx, 0x8b32
rdtsc
mov ax, word [esp]
jmp 0x784615
setnp dh
bswap eax
call fcn.0078469c
js 0x7846d8
stc
call fcn.007846ef
enter 0xffffffffffffda44, 0xffffffffffffffbd
dec esp
invalid
stc
ror esi, 0
mov cl, byte [esp]
mov ecx, ebx
mov ecx, 0xae45fffb
neg cx
jmp 0x784791
jmp 0x78476f
mov dl, 0xc1
jmp 0x7847d8
mov ax, 0xc321
mov ecx, dword [esp]
jmp 0x784779
setne ch
lea ecx, [esp + eax]
mov ecx, eax
jmp 0x784759
add esi, 0x2c26f206
bts ecx, edx
jns 0x7847ae
pushal
mov ax, cx
jmp 0x7847b1
jo 0x7847d3
inc ecx
mov ch, cl
jmp 0x784755
mov ax, cx
mov ax, 0x8ce2
jmp 0x78486c
pushal
jmp 0x784798
mov ax, 0x8ce2
jmp 0x78486c
inc ecx
mov ch, cl
mov dl, 0xc1
lea esp, [esp + 4]
sub esi, 0x57a97abc
and edx, 0xaa62ae6
ja 0x78473f
setne ch
lea ecx, [esp + eax]
mov ecx, eax
mov ax, 0xc321
mov ecx, dword [esp]
jmp 0x784779
add esi, dword [edi]
rcr dx, 0

Function at 0x7862e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0773488
jmp 0x786287
mov cl, 0x16
mov ax, 0x3da5
mov bh, byte [esp]
jmp 0x7862ca
neg si
jmp 0x786304
lea esp, [esp + 0x50]
pushfd
jmp 0x785f70
neg si
jmp 0x786304
mov ebp, dword [esp + 0x2c]
xchg si, cx
btc ecx, ebp
jne 0x786292
je 0x7862b4
cwde
add dl, byte [eax + 0x43b002f7]
cli
aad 0x44
push bp
lea esp, [esp + 2]
mov dword [esp + 0x50], edi
jmp 0x7862aa
bswap eax
jmp 0x786314
lea esi, [esp]
rcl di, cl
jnp 0x7862ee
bswap eax
jmp 0x78633e
clc
sub esp, 0xc0
mov edi, esp
mov dx, _onexit
jmp 0x786341
clc
jmp 0x786315
neg ecx
je 0x7863bf
cpuid
neg eax
jmp 0x78634f
cpuid
neg eax
jmp 0x78634f