joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41452e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c88f
and dword [ebp - 0x14], 0
cmp dword [0x4245d8], 0
mov dword [ebp - 0x18], eax
jne 0x4145e1
push 0x41b318
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x414689
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41b30c
push ebx
call edi
test eax, eax
je 0x414689
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x41b2fc
push ebx
mov dword [0x4245d8], eax
call edi
push eax
call esi
push 0x41b2e8
push ebx
mov dword [0x4245dc], eax
call edi
push eax
call esi
push 0x41b2cc
push ebx
mov dword [0x4245e0], eax
call edi
push eax
call esi
mov dword [0x4245e8], eax
test eax, eax
je 0x4145e1
push 0x41b2b4
push ebx
call edi
push eax
call esi
mov dword [0x4245e4], eax
mov eax, dword [0x4245e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41463a
cmp dword [0x4245e8], ecx
je 0x41463a
push eax
call esi
push dword [0x4245e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41463a
test ebx, ebx
je 0x41463a
call edi
test eax, eax
je 0x414631
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x414631
test byte [ebp - 8], 1
jne 0x41463a
or dword [ebp + 0x10], 0x200000
jmp 0x41466d
mov eax, dword [0x4245dc]
cmp eax, dword [ebp - 0x18]
je 0x41466d
push eax
call esi
test eax, eax
je 0x41466d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41466d
mov eax, dword [0x4245e0]
cmp eax, dword [ebp - 0x18]
je 0x41466d
push eax
call esi
test eax, eax
je 0x41466d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4245d8]
call esi
test eax, eax
je 0x414689
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41468b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a82f
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x44b203b2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x33413ab9
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x411bc3
Capabilities:
Encode data using xor

Disassembly:
pop ecx
inc esp
xchg esi, eax
jp 0x411c2a
mov edx, 0x1f854625
lds esi, [ecx]
jecxz 0x411c32
add bl, cl
xor ebp, dword [ecx]
fidiv dword [ebp + 0x32ad25f9]
stc
and eax, 0x4f1932ad
invalid
iretd
mov dword [esi - 0x3d], eax
enter 0xffffffffffff92b5, 0xffffffffffffffa7
xlatb
dec edi
enter 0xffffffffffffdd83, 0xffffffffffffff93
stc
sbb dword [edi - 0x1ae5b013], edi
sub eax, dword [ebx]
mov esp, 0xdcae3ce4
push edi
sbb ch, byte [edi]
test dword [esi - 0x2d], 0xf9a6e810
push ss
lcall 0xf6f3, 0x2954bb6
sahf
test al, 0x36
adc eax, 0x252930d2
mov esi, 0xb645b107
pop ebx
mov dh, 0x5b
push esi
push edi
adc ah, bh
cmp al, 0xe
xor eax, 0xb2847cee
inc ebp
mov edx, 0x9eaeabf6
clc
jp 0x411c63
cwde
salc
inc edi
cli
and al, byte [ecx]
or bh, byte [edx + 8]
sbb dword [edi], ebp
outsd dx, dword [esi]
scasd eax, dword es:[edi]
retf 0xaf0b

Function at 0x45604e
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xbb4948d2
div dword [ecx]
fnstcw word [edi - 0x39]
jl 0x455fe8
out 0xb3, al
sub dword [edi - 0x1f], ebp
push esi
cmp byte [esi + 0x6c], bl
insb byte es:[edi], dx
xor dh, byte [esi - 0x23e83f5e]
dec esi
in eax, dx
sbb eax, 0xb3e18fb9
sbb eax, 0xf00092e8
xor ebp, dword [ebp + 0x33]
pop esp
jl 0x4560b3
cmpsd dword [esi], dword es:[edi]
jne 0x456063
test eax, 0xa78ac054
into
test al, 0xbf
invalid
leave
loopne 0x456062
sbb al, 0xb7
pop esi
mov dword [0xb11512e], eax
nop
adc ch, byte [eax + 0x24]
adc byte [edi + 0x1ea9e3e1], 0x5c
mov byte [0xd71cd324], al
inc esp
mov bl, byte [ebx]
hlt
Function at 0x485f32
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xa7893c25
aas
xchg edx, eax
push 0x5b510c80
xchg esp, eax
dec ebp
popal
rcr byte [edx], cl
mov byte [0xfe30f411], al
push ebx
mov edx, 0x5452dc0c
or eax, 0xe394cee2
dec ebx
mov word [esi], gs
and dword [esi + 0x579624c], 0xffffff97
jns 0x485ec7
xchg edi, eax
xchg esp, eax
scasb al, byte es:[edi]
or dword fs:[ebp + ecx*8 - 0x41], edi
int 0xc2
cmp al, 0x48
jl 0x485e96
mov edi, 0x483cc2cd
inc ecx
das
sbb ah, 0x8d
cmp al, 0x77
stosd dword es:[edi], eax
jecxz 0x485f15
fsub st(7)
dec edi
jmp 0x486281
adc eax, 0x88c8015d
das
movsb byte es:[edi], byte [esi]
pushal
or eax, 0x839f7006
jo 0x485ec0
sub dword [ebx - 0x4f], 0xffffff80
pop esi
cli
aas
jb 0x485f22
imul esi, dword [ecx + 0x3ffa5e80], 0x72
clc
enter 0x25a2, 0xffffffffffffff8e
or ebp, ebp
int 0xde
jl 0x485f1f
in eax, 0xf9
mov bl, 0xcf
mul byte [edx - 0x10936a5d]
cmpsd dword [esi], dword es:[edi]
sar edi, 0xf1
mov cl, 0x31
xor ah, byte [edx]
fstp qword [ecx]
mov ah, 0
lodsb al, byte [esi]
mov edx, 0x65f3afb9
sbb al, 0xca
invalid
mov ds, ecx
pop ebp
mov edx, ebp
out dx, al
fstp dword [ebp - 0x75]
aad 0xf3
out dx, al
jbe 0x486205
adc ah, byte [esp + ecx*8]
xor eax, 0x87f333ef
out dx, eax
sahf
jae 0x4861ef
lodsd eax, dword [esi]
in al, dx
bound ebp, qword [eax + 0x6d1a7516]
invalid
movsd dword es:[edi], dword [esi]
jl 0x4861ee
sbb al, 0xa1
aas
sbb eax, 0x4aad2cac
sbb byte [esi], ch
out dx, eax
clc
movsb byte es:[edi], byte [esi]
push 0x4d
mov ebx, 0x3e18c2cf
or byte [ebx*2 + 0x58c69feb], bh
bound ebp, qword [0xa3db2e70]
xchg byte [edi + 0x59], bl
inc edx
adc al, 0xdd
invalid
dec edx
mov ebp, 0x892db24a
pop edi
fld qword [edx + 0x4d]
popal
sbb eax, 0xe0e25f2d
pop ds
sbb al, 0xf5
add eax, 0xe10bf421
jns 0x486255
pushal
xchg ebp, eax
pop esi
sub dword [ecx - 0x2e40e094], ebp
ret

Function at 0x4a126d
Capabilities:
Encode data using xor

Disassembly:
and byte [edi - 0x5c], bh
insd dword es:[edi], dx
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
pushal
pushfd
push esp
imul edx, dword [0xa661e180], 0xffffffad
and cl, 0x61
cmpsb byte [esi], byte es:[edi]
lodsd eax, dword [esi]
and cl, 0x61
cmpsb byte [esi], byte es:[edi]
lodsd eax, dword [esi]
or byte [0x1d60a601], al
ja 0x4a1262
les eax, [edx + 0x14]
xor al, 0x54
add ch, dh
sbb al, 0x34
and byte [edx + eax + 0x695c7e9f], bh
add eax, 0x36a2aeb6
push cs
out dx, eax
pop ebx
pop edx
invalid
Function at 0x4a32af
Capabilities:
Encode data using xor

Disassembly:
inc edx
pop edx
ljmp 0x125e
mov dword [0xd602eb76], eax
rol byte [esi - 0x4d7bfc48], cl
ficom word [ebp + 0x62659c32]
clc
xor esp, dword [eax + 0x18]
dec edi
jbe 0x4a332d
jl 0x4a3285
push ebx
and al, 0xb0
int 0x13
add al, 0x29
xlatb
xor eax, dword [edx - 0x11]
and al, 0xf4
jb 0x4a3333
les esp, [edx + 0x2560ec91]
mov byte [0x2560ec91], al
push cs
or ecx, dword [esi + 0x64eca9aa]
mov dh, 0xb2
jge 0x4a3361
mov dl, 0xc1
and ebx, dword [ebx - 0x672d13a0]
adc al, 0xa9
and dword [0x693be193], eax
and al, 0x12
add ebx, esp
add dh, ah
xor byte [eax], 0xf2
mov ch, 0x90
adc dl, dh
mov ch, 0x30
add dword [edi + 0x5e], esp
pop ecx
rcl byte [eax - 0x61], cl
mov esi, 0xdf1fe094
test al, 0xe2
mov eax, dword [0xe825e320]
or dword [eax - 0x59d0add5], esi
inc eax
test byte [edx], bh
cmpsb byte [esi], byte es:[edi]
and eax, dword [edx - 0x1d881c74]
and bl, 0x29
outsd dx, dword fs:[esi]
and eax, esp
movsd dword es:[edi], dword [esi]
loopne 0x4a32da
rcl byte [ebp - 0x7e], 0x73
out 0x98, eax
xor byte [ebx - 0x19], 0x98
mov byte [0xddd21ed1], al
jne 0x4a3337
cdq
mov ecx, 0x63a7e994
and dword [ebp - 0x1d5f86ad], ecx
xchg ebx, eax
or cl, dh
test eax, 0xd4048308
xor eax, 0xc2b724ed
lds edx, [ecx + 0x3427a04b]
push eax
ja 0x4a32f2
leave
mov byte [0xc3d46089], al
xchg esp, eax
test dword [ebp + edx*2 + 0x4d771460], edx
salc
or al, 0xba
adc al, 0x6f
push 0xd2f7a27f
in al, 0x30
movsb byte es:[edi], byte [esi]
dec edx
push ecx
into
jae 0x4a334e
push ss
mov dh, 0xc2
rcl dword [eax - 0x5610b9bf], 0xd0
and dl, dh
mov eax, dword [0x5fb66e7c]
push ebp
inc edx
adc al, 0x9e
ret 0x3000

Function at 0x4a38db
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax + esi*8], ah
movsb byte es:[edi], byte [esi]
imul edi, dword [esp + eax*4], 0xd2c3506f
das
dec ebp
pop esi
invalid

Function at 0x4a6a0b
Capabilities:
Encode data using xor

Disassembly:
or al, 0x85
pop ebp
jbe 0x4a6a8c
or byte [0x8e91aa0c], ah
mov esi, 0xf2591478
in al, dx
push esi
xor dl, ah
insb byte es:[edi], dx
push eax
out dx, eax
retf 0x7964
push esi
cld
in eax, 0x53
div ebp
push ebx
jb 0x4a6b0a
test byte [esi], bh
sal dword [esi + eax*4], cl
les esp, [edx]
andnps xmm1, xmmword [ecx]
jae 0x4a6aa0
inc esi
in al, dx
push edx
mov ebp, 0x5ca1dbd3
sahf
pop esi
push ds
cmpsd dword [esi], dword es:[edi]
and ah, byte gs:[ebx]
xchg esi, eax
cmp al, byte [ecx]
adc byte [ecx], bl
dec ebp
enter 0x2e3f, 0xffffffffffffff89
and edx, eax
retf 0x7fdf
invalid
dec ebx
cmp dword [ebx + ebx - 0x7c], 8
salc
pushfd
add dword [ebx - 0x3ad99a63], 0x5c
sbb eax, 0x4c10402f
push esp
sahf
xor esi, 5
sub byte [ebx - 0x599e5683], ch
rcr dword [ebp + 0x59], 0x75
mov dl, 0xb5
test byte [ebx - 0x24], ah
nop
mov dh, 0x9e
sar byte [esi], 1
sbb esp, esp
push 0x379c240
sbb eax, 0xd595b484
add ecx, dword [edi - 0x24dd138]
stc
sar byte [ebp + 0x406593bd], 0x83
in al, 0x4b
not dword [esi + edx*8]
outsd dx, dword [esi]
adc al, 0xb6
sti
and al, 0x4b
xor eax, 0xead69a18
jle 0x4a6b11
or eax, 0xf833f02
out 0xf2, eax
leave
xchg byte [eax], al
mov esi, 0xa32d43ba
add eax, 0x38840e74
inc esp
pop ebx
shr dword [ecx], 1
xchg edx, eax
ja 0x4a6bbb
invalid
jmp 0x4a6b25
Function at 0x4a6edb
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
ljmp 0x50b2

Function at 0x4a9454
Capabilities:
Encode data using xor

Disassembly:
xor esp, dword [ebp + ebp*4 - 0x66]
add ecx, ebx
iretd
salc
jno 0x4a9411
xchg edx, eax
sub eax, 0x817d3c2c
pop esp
push 0x70c90b67
jo 0x4a9446
jo 0x4a9446
dec ebx
jecxz 0x4a947e
add al, byte [ebp + 3]
push 0x70c82b1b
outsb dx, byte [esi]
push esp
invalid
Function at 0x4ec2c8
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
rol byte [ecx + 0x28a34bb7], 0xf9
fsubr dword [ebp + 0x71755658]
stc
sub byte [ebx + 0x3d], dl
pop ds
clc
sbb eax, dword [ebp - 8]
lds esp, [ecx - 0x280f253a]
pushal
stosb byte es:[edi], al
iretd
dec eax
push ds
push edi
push esp
loope 0x4ec277
or byte [esi - 0x3514dbd2], cl
loop 0x4ec240
retf 0xc6e2
xchg ebx, eax
mov ecx, 0x9b9be3d8
or dl, bl
pushal
int 0x8e
in eax, dx
aad 0xe0
push 0x49036196
scasb al, byte es:[edi]
adc byte [ebx - 0x5b], al
mov ah, byte [0x51daed45]
cmp byte [eax + 0x1e], cl
retf
jg 0x4ec344
jle 0x4ec26b
scasb al, byte es:[edi]
and cx, ax
or byte [ecx - 0x80], 0x1e
pop eax
xchg eax, edx
std
xchg byte [eax], cl
push esi
les esp, [eax]
leave
pop esp
mov esi, 0x2d81c3e8
shl al, 1
adc ebp, eax
sbb al, 0x1f
enter 0x7f53, 0xffffffffffffffae
das
inc ecx
wait
xor byte [ecx], ah
and dl, bh
mov ch, 0xb6
ret 0x7a59
lodsb al, byte [esi]
lcall 0x6588, 0xa468b89a
pop edx
mov edi, 0x48697f27
jg 0x4ec3ba
dec eax
pop eax
pop edx
sbb eax, 0xdbe0a6a0
mov al, byte [0x20f61136]
mov dl, 0x81
test al, 0x85
das
push esi
sub byte [eax + 0x51297769], dl
jmp 0x4ec390
add esp, ebp
mov ebx, 0x9e2a170e
jno 0x4ec34f
fst dword [esi - 0xf11ef54]
xlatb
stc
rcl byte [ebx + 0x2db622f]
add al, 0x11
mov dword [0xdabbe8b8], eax
sub dword [ecx + 0x65f5516e], ecx
sub byte [esi - 0x2c], ch
mov dword [esi + 0x51], ebp
cmc
sub byte gs:[esi - 0x2c], ch
test al, 0xde
wait
mov esp, ss
jae 0x4ec3eb
inc esi
in eax, 0x33
lodsb al, byte [esi]
jae 0x4ec370
insb byte es:[edi], dx
popal
cmpsd dword [esi], dword es:[edi]
lcall 0x91, 0xdb2219b0
mov esi, 0x74c0f35c
mov byte [edi], dh
push 0xc9c5f6dc
leave
add byte [ecx + ecx], al
imul edx, dword [ecx + 0x5a088447], 0x596f2195
stosd dword es:[edi], eax
xor eax, 0x1122b5ca
out dx, eax
aas
add al, byte [esi + 0x17]
scasb al, byte es:[edi]
pop edx
salc
mov eax, 0xf8ad7a80
int1
push ebx
pushfd
xchg ebp, eax
int 0x8b
aad 0x31
clc
cdq
and byte [ebx - 0x27], dh
imul esi
push eax
sbb cl, al
mov esi, eax
mov esi, eax
mov ch, 1
push es
dec eax
push 0x73c39de9
and dword [edx + ecx*4 - 0x5857efb], 0x41028b87
or dword [esp + ebx*8 + 0x4cc067f0], 0xffffffea
arpl word [ecx + 0xb03308], di
mov ebp, 0x908c1ed7
mov eax, 0x68fbff8f
inc edi
test al, 0xab
pop esp
xor ecx, ebx
cmp ecx, dword [edi - 0xaefc95c]
jne 0x4ec3ef
push esp
ja 0x4ec4a5
cmp al, 0x9d
jo 0x4ec3e2
std
xor byte [esp], cl
stc
pop ds
mov eax, ebx
nop
mov dword [0x536f4143], eax
mov edx, 0xa860d7f
sub edi, ebp
dec esi
ret
mov ecx, esp
xor byte [ecx - 0x27], bl
sal byte [esi - 0x20fddf38], 1
mov ch, 0xb8
rcr byte [ecx], 0x5d
jns 0x4ec432
jmp 0x78bcf8d8
loopne 0x4ec519
push es
and byte [eax - 0x12], dh
int1
sbb byte [esi], bl
adc byte [ecx], dl
jle 0x4ec472
or dl, byte [ecx - 0x3c]
fild word [edi]
or al, 0xb6
sub byte [ecx + 0x18d0b4f1], 0x5a
mov eax, 0x90fa9e0f
push ecx
jmp 0xf9b2803d
lea esp, [edx + 0x7a5b8a17]
fsubr dword [edx]
push ds
cmp dword [ebx - 0x27d91811], esp
shr dword [esi + 0x2a], 0x3c
add dword [eax], ebp
mov eax, dword [0x60b9c055]
hlt
jno 0x4ec4e3
invalid
Function at 0x53d96c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov byte [0x1ed61fe2], al
sbb eax, 0x2e
fnstsw word [ecx + 0x26df41ca]
mov cl, 0x5d
sbb dh, byte [eax]
pop es
inc esp
mov dword [ebp*4 + 0x5fd97d96], esp
sahf
std
lcall 0xc8c3, 0xad32af3e
mov fs, eax
call 0x928b7fec
push esi
xor dword [ebp - 0x43], 0x28
pushfd
cmp al, 0x59
sahf
dec ecx
cdq
lea eax, [ebx - 0x432228b4]
and dword [ebx], esp
sub eax, 0x322118b9
pop esp
or al, 0x1f
add ebp, dword [esi]
dec byte [edi]
fstp st(5)
std
xchg ecx, eax
cwde
push 0xf996798f
jne 0x53d97c
lodsd eax, dword [esi]
pop ecx
mov esi, 0x1b899af6
cmp eax, 0xff17ad11
fldcw word [eax]
scasd eax, dword es:[edi]
lea esi, [edx - 0x3004c603]
sub dl, byte [0x6a685ebc]
out dx, eax
pop ebp
int 0x3d
cli
mov al, byte [0x8789906f]
wait
in eax, 0x97
das
in eax, dx
rcr byte [edx], 0xde
cmp al, 0xe3
lea esi, [ebp + 0x79cc569d]
pop ds
stosd dword es:[edi], eax
sbb eax, 0x92940488
jmp 0x53da43
stc
scasd eax, dword es:[edi]
test dword [ebp - 0x67], ebx

Function at 0x58e2b7
Capabilities:
Encode data using xor

Disassembly:
or bl, byte [0x99ca68fd]
lcall 0x730e, 0x7940f1
push ebp
cmp dword [edx - 0x37a7d5c9], edi
pop eax
invalid
sub bl, byte [eax - 0x38]
loop 0x58e29d
sysret
lahf
movsb byte es:[edi], byte [esi]
pop ebx
lodsb al, byte [esi]
sbb dword [ebx + 0x78], esp
loop 0x58e244
dec bl
xchg ecx, eax
jmp 0x58e256

Function at 0x58e38c
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x73
sub eax, dword [ecx]
and esi, dword [edi - 0x6e]
xchg edx, eax
adc cl, bh
cmp dword [ecx + 0x61], ecx
test eax, 0x31237493
cli
cld
inc edx
invalid
push 0x6b
pop esp
fcomp qword [ecx]
nop
pop eax
sbb ebp, edi
dec ebp
ja 0x58e2e7
shr byte [ecx], 0x9f
fsub qword [esi - 0x31]
rcl ebx, cl
add ecx, dword [ecx - 0x71]
dec ebp
loopne 0x58e2e1
cdq
cdq
sub eax, 0x75b4d38b
jle 0x58e336
out 0x36, eax
and ecx, dword [ecx + 0x27]
and ecx, dword ss:[ecx + 0x27]
call 0x959e5792
jb 0x58e32c
or dword [edx], ebx
cld
cmp al, 0x98
stc
js 0x58e3a9
inc edi
pop es
lea ecx, [edi - 0x22]
xlatb
pop ecx
imul ebp, ebx, 0xffffff87
pop edx
pop ebx
clc
xor eax, 0x24a0255f
pop ebx
xlatb
dec esp
jno 0x58e361
xchg ebx, eax
mov esp, 0x28566d6c
daa
sub dword [eax + ebp], ecx
pop ss
push edi
fsubp st(5)
mov bl, 0x29
dec dword [ecx - 0x7a4eff34]
mov cl, 0x85
aaa
xor dl, byte [ebx + 0x29]
adc eax, 0x277dea4
adc al, 0x53
cmp edi, esi
enter 0xffffffffffff96d4, 0xffffffffffffffa0
or eax, dword [esi]
and al, 0x4e
cmc
clc
out dx, eax
bound edx, qword [0x49fde6ee]
out 0xfd, al
dec ecx
ror byte [edi - 0x785a16cf], 1
lds esi, [edx + 0xb]
jb 0x58e3c0
outsd dx, dword [esi]
loop 0x58e3b3
jecxz 0x58e34e
enter 0xc30, 0x2b
imul bl
and al, 0xdb
cld
into
mov dword [0x2a2defef], eax
mov eax, 0xb58c7277
jb 0x58e3e3
push ebp
aad 0x76
out 0x19, eax
in eax, 0x70
invalid
add ch, ch
sbb ebx, dword [ecx]
imul edx, dword [ebx], 0x5e
cmp al, 0x7a
xor dword [edi - 0x46dd4ccb], 0x7d
pop ss
imul esp, dword [ebx + 8], 0x66
in al, 0x52
inc ebx
jne 0x58e3d8
inc eax
invalid
Function at 0x5c1363
Capabilities:
Access peb ldr_data

Disassembly:
in al, 0
add byte [eax], al
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005ca920
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5cc704
Capabilities:
Encode data using xor

Disassembly:
invalid
sbb al, 0xeb
mov cl, byte [edx]
pop edi
inc edx
or byte [eax], bh
leave
pop edi
mov eax, dword [0xd8499dbc]
jmp 0x5cc6a1
mov es, word [edx + 0x2f098afc]
out dx, eax
rol byte [ebx - 3], 0x18
dec ebx
jle 0x5cc70a
or bh, byte [ebx]
inc esi
jo 0x5cc73b
movsb byte es:[edi], byte [esi]
xor ch, byte [edi]
pop esi
sbb ax, 0x1bec
sub eax, 0x1ffbbb76
dec esp
cdq
push ds
mov dh, 0xff
mov dh, 0xa0
or eax, 0xb0ad0e7e
stosd dword es:[edi], eax
sbb edx, dword [ebx + 0x16]
or eax, 0x2b6d78e5
in eax, 0x78
insd dword es:[edi], dx
sub esp, dword [eax + ebp*8 - 8]
call 0x867a98c9
loopne 0x5cc695
jmp 0x5cc6a1
cmp eax, 0xd9affb9d
lodsd eax, dword [esi]
cmp bl, byte [esi]
push esi
pop ebx
clc
call 0x867a98c9
loopne 0x5cc695
jmp 0x5cc6a1
fldcw word [ebp + 0x5b561e3a]
adc ecx, dword [ebx + 0xb211a23]
out 0xea, al
aas
jnp 0x5cc7a4
pop esi
in al, dx
mov ebx, 0x4baba359
wait
outsb dx, byte [esi]
push ss
xchg dword [esi], ebx
clc
sbb bh, dl
jmp 0x26b723ae
pop esp
pop edx
sbb cl, byte es:[esi]
or dl, byte [eax + 0x75]
xor dword [ecx], edi
pop edi
aad 0x7a
loopne 0x5cc6dd
cld
cli
pop ds
dec edi
lahf
popfd
wait
in al, dx
mov eax, 0xffffbde9
cmp ch, byte [edi]
sub bl, byte [ebx + 0x2b2a0c2a]
and bl, byte [ebx]
sbb esp, dword [esi + 0x7d67df7b]
dec ebp
xor eax, 0x7848ac5e
xor al, 0x9a
mov fs, ecx
fidiv word [ebx]
sbb dh, byte [esi]
pop esi
xchg edx, eax
or eax, 0xbd2f9d77
ja 0x5cc718
lcall 0x213b, 0xee9b184f
pushal
dec edi
sbb byte [ebx + 0x60213bee], bl
push ebp
sbb ebx, ebx
outsb dx, byte [esi]
sub esi, edi
aas
salc
sahf
xchg byte [esi - 0x652b585], al
lodsd eax, dword [esi]
stc
pushfd
mov byte [edx + 0x5c], ch
sti
xor dword [0x7e1a868e], esi
xchg byte [edx - 0x57], dh
cmp edi, dword [edi]
aas
arpl word [ebx + 0x70], cx
cmp dword [edx - 0x7b], ebx
mov ebx, dword [esi + edx]
dec edi
insd dword es:[edi], dx
dec ebp
cdq
jbe 0x5cc77d
inc ecx
mov ecx, 0x1f0a26e0
push cs
sub al, 0xbc
pop esp
or eax, 0x3a433a1b
arpl word [0x47c47b82], bp
pop es
cld
cmp eax, 0xdced25b7
mov eax, 0xbb9da07a
cmp edx, dword [edx + 0x2f3beb4d]
sub edx, dword [esi + 0x3e]
jbe 0x5cc800
jno 0x5cc813
dec ebx
jne 0x5cc81b
jg 0x5cc792
js 0x5cc859
mov dword [edx + ecx*4], esp
invalid
dec dword [ebp + 0x27]
sub byte [edx + 0x172f711b], bl
invalid
invalid
invalid
invalid
Function at 0x660e9c
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x9c
mov ecx, dword [0xa6abac]
mov eax, dword [0xa6abb0]
mov edi, dword [esp + 0xac]
test eax, eax
jne 0x660f91
test ecx, ecx
jne 0x660f91
cmp dword [0x667260], 0
je 0x660fd3
lea esi, [esp + 0x18]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x80
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], 0x5c
call fcn.00660c30
test eax, eax
jne 0x660f1e
mov dword [esp], esi
mov dword [esp + 4], 0x3a
call fcn.00660c30
test eax, eax
je 0x660f21
inc eax
mov esi, eax
mov dword [esp + 0x98], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x660f71
call sub.KERNEL32.DLL_GetCurrentThreadId
lea ecx, [esp + 0x98]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x66109c
call sub.USER32.DLL_EnumThreadWindows
sub esp, 0xc
mov ecx, 0x12010
cmp dword [esp + 0x98], 0
jne 0x660f71
mov ecx, 0x11010
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.USER32.DLL_MessageBoxA
sub esp, 0x10
jmp 0x66105d
test ecx, ecx
je 0x660fa8
cmp ecx, 0xffffffff
je 0x66105d
mov dword [esp], edi
call ecx
mov eax, dword [0xa6abb0]
test eax, eax
je 0x66105d
cmp eax, 0xffffffff
je 0x66105d
cmp byte [eax], 0
je 0x66105d
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00660d68
jmp 0x66105d
mov dword [esp], 0xfffffff4
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov esi, eax
lea ebx, [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6670b0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], edi
call fcn.0065ba2c
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6670b0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
add esp, 0x9c
pop esi
pop edi
pop ebx
ret

Function at 0x6627d4
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsSetValue
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x4c134ae
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2ce3b32
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x30d73b46
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
mov ecx, 0x71403354
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219