joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007d70
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x1001a1f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10020040]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x100212ec]
mov edx, dword [eax + 0xc]
mov ecx, 0x100212ec
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 0
movzx edx, word [ecx + 0x14]
push eax
push edx
push str._c:_s
lea edi, [esp + 0x1c]
call fcn.10003c80
mov esi, dword [esp + 0x1c]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebx, 0xffffffff
push 0
push esi
cmp eax, ebx
jne 0x10007df8
push 0x2005
push 0x800
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x10007e27
mov edi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x1005
test al, 0x10
je 0x10007e17
push 4
call edi
push 0
push esi
push 0x1005
push 8
jmp 0x10007e25
push 0x10
call edi
push 0
push esi
push 0x1005
push 2
call edi
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
mov dword [esp + 0x1c], ebx
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x10007e44
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8

Function at 0x10008c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10008c57
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10008c88
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10008c84
cmp esi, eax
jae 0x10008c88
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10008c74
cmp esi, eax
jb 0x10008c8e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x10008df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10008e5e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x10008e2f
cmp eax, 2
jne 0x10008e4a
mov eax, dword [esp]
test esi, esi
je 0x10008e58
test eax, eax
je 0x10008e53
test al, 1
jne 0x10008e4a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x10008e58
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x10008ff0
Capabilities:
Get disk information

Disassembly:
sub esp, 0xd4
mov eax, dword [0x10020040]
xor eax, esp
mov dword [esp + 0xd0], eax
mov eax, dword [0x1001cdac]
mov cx, word [0x1001cdb0]
mov dx, word [esp + 0xdc]
mov dword [esp], eax
push 0x64
lea eax, [esp + 0xc]
mov word [esp + 8], cx
push eax
lea ecx, [esp + 8]
push ecx
mov word [esp + 0xc], dx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x10009057
call fcn.10003e30
mov ecx, dword [esp + 0xd0]
xor ecx, esp
call fcn.1000e9b7
add esp, 0xd4
ret 8
push str.DeviceKZipVirtualDisk
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea edx, [esp + 0xc]
push edx
push str.DeviceKZipVirtualDisk
call fcn.1000f24c
mov ecx, dword [esp + 0xdc]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, esp
neg eax
call fcn.1000e9b7
add esp, 0xd4
ret 8
Function at 0x1e7a1316
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1e7a1351
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1e7a1338
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1e7a1349
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1e7a1353
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1e7a132e
invalid
xor eax, eax
pop edi
pop esi
ret

Function at 0x1e7a1530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
faddp st(6)
inc ebp
mov cl, 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1e7a12d6
mov esi, 0x8d1bb795
inc ebp
test al, 0x50
call fcn.1e7a12e6
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a129b
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
test dword [edi + edi*8 - 1], esi
dec dword [ebx - 0xe0807bb]
test edx, edx
je 0x1e7a15c4
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
invalid
Function at 0x1e7a1fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp + 0xc], 1
je 0x1e7a2194
cmp dword [ebp + 0xc], 8
jne 0x1e7a215c
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.1e7a12e6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a129b
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.1e7a12d6
loope 0x1e7a212f
in al, dx
invalid
fcmovu st(0), st(3)
test byte [esi - 0x6974a01], cl
invalid
call fcn.1e7a12d6
pop ss
and dword cs:[esi], eax
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.1e7a12d6
sub ch, byte [ecx + esi*8 + 0x31]
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
lodsd eax, dword [esi]
stc
invalid
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1e7a12b4
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
invalid
invalid
Function at 0x1e7a32c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x1e7a32c7
jmp 0x1e7a337c
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x1e7a3320
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x1e7a3325
jmp 0x1e7a2c78
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1e7a336c
lea eax, [ebp - 0x714]
push eax
call fcn.1e7a12e6
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1e7a129b
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0

Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a9c90
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], 0
push ebx
mov ebx, dword [sym.imp.python27.dll_Py_FatalError]
push esi
push edi
mov edi, dword [sym.imp.python27.dll_PyThreadState_Swap]
jne 0x1e7a9ccd
push 0
call edi
mov esi, eax
add esp, 4
test esi, esi
jne 0x1e7a9cbf
push str.pywintypes:_can_not_setup_interpreter_state__as_current_state_is_invalid
call ebx
add esp, 4
mov eax, dword [esi + 4]
push esi
mov dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], eax
call edi
add esp, 4
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1e7a9ce7
push 0x1e7b10fc
call ebx
add esp, 4
mov ecx, dword [0x1e7ba8b8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
call edi
push eax
mov dword [esi], eax
call edi
add esp, 8
pop edi
mov dword [esi + 4], 0
pop esi
pop ebx
ret
Function at 0x406155
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x4065c8
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x40609d
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
mov byte [ebp - 0x74e], 0x8d
mov byte [ebp - 0x74d], 0xd5
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
lea eax, [ebp - 0x77c]
push eax
call fcn.00404532
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.00404532
pop ecx
push eax
lea eax, [ebp - 0x504]
cli
invalid
call dword [eax - 0x18]
or ah, ah
invalid
inc dword [ebx - 0x7a72f33c]
cld
cli
invalid
dec dword [ecx - 0x39f7b]
invalid
jmp 0x40649a
cmp dword [ebp - 0x6fc], 1
jne 0x40614e
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00404532
call [ecx + 0x50]
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00404493
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x40649a
cmp dword [ebp - 0x6fc], 2
jne 0x40620b
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
mov byte [ebp - 0x798], 0xb3
mov byte [ebp - 0x797], 0x8c
invalid
invalid
invalid
Function at 0x4066d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
imul esp, dword [ecx + 0x30], 0x8b000000
inc eax
or al, 0x8b
jo 0x4066f9
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x4066e6
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00404522
enter 0x771a, 0x4d
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
push esp
pop es
js 0x406700
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
and byte [ebx], al
invalid
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.00404522
sbb edx, ecx
sar esp, cl
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x40670f
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x40670f
call fcn.00404522
pop es
test eax, 0x5a8b9d4c
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
Function at 0x4612a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4612cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4612cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x416ef0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x416f12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416f19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416f08
mov eax, 1
add ebx, ebx
jne 0x416f2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x416f20
jne 0x416f3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416f20
xor ecx, ecx
sub eax, 3
jb 0x416f50
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x416fc2
mov ebp, eax
add ebx, ebx
jne 0x416f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416f68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x416f8c
inc ecx
add ebx, ebx
jne 0x416f78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x416f6d
jne 0x416f89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416f6d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x416fac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x416f9d
jmp 0x416f0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x416fac
add edi, ecx
jmp 0x416f0e
pop esi
mov edi, esi
mov ecx, 0x70a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x416fca
cmp byte [edi], 0x12
jne 0x416fca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x416fcf
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x41703e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416ffc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1707c]
or eax, eax
je 0x417038
mov dword [ebx], eax
add ebx, 4
jmp 0x417019
call dword [esi + 0x17084]
mov ebp, dword [esi + 0x17080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417072
sub esp, 0xffffff80
jmp 0x407c42
Function at 0x406e3b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4278a4], 0
jne 0x406e79
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406e4f
mov dword [ecx*4 + 0x4278a0], eax
inc ecx
cmp ecx, 0x100
jl 0x406e4a
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406ea6
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4278a0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406e87
not eax
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x610c4e00
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, str.mXo
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x582d10df
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x156f16f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], bl
mov dword [esp + 0x40], 0x6b6fdb03
mov word [esp + 4], sp
mov byte [esp + 0xc], 0x29
push 0x81ffd8f8
push dword [esp]
lea esp, [esp + 0x48]
jmp 0x285fc0a
push 0x70b1327c
lea esp, [esp + 4]
jl 0x286146e
push edi
pushfd
mov dword [esp], eax
pushfd
movsx edi, bl
xchg dword [esp], ebp
movzx edi, bl
jmp 0x286134f
jmp 0x28617ba
push ecx
pushfd
push 0x5d4aa07d
mov dword [esp + 8], edi
call fcn.0286176f

Function at 0x15708b6
Capabilities:
Encode data using xor

Disassembly:
cmp byte [edi], 0x23
mov byte [esp], bl
push dword [esp]
lea esp, [esp + 8]
jne 0x25c64fb
bsf eax, eax
jmp 0x25c875b
mov eax, 0xa3dad391
and al, 0xbf
sub edx, edx
rcr eax, cl
mov eax, edx
bt ecx, ebx
bt bx, 8
push esp
sbb al, 0x2c
add edi, 1
inc al
mov al, byte [edi]
stc
test al, al
push esp
push esi
pushfd
lea esp, [esp + 0x10]
je 0x25c64f4
push 0x5183bc31
call fcn.025c6ddd
dec eax
mov bl, 0x1c
add al, dh
in eax, dx
push ss
add dword [eax + 0x61], esp
sbb al, 2
add byte [eax], al
add byte [eax], al
test al, 0xae
inc ebp
add al, byte [eax]
add byte [eax], al
add byte [ecx], dh
jmp 0x25c88c8
pop ecx
add dl, byte [edx + esi*4 + 0x30]
xor eax, 0xe3308730
xor byte [0xe3308730], dh
dec edx
xchg esp, eax
pop esp
pop esp
xor al, 0xba
arpl bp, dx
xor esi, dword [ecx - 0x60ba92f1]
ja 0x25c88a8
mov ebp, 0x49710b33
cmpsd dword [esi], dword es:[edi]
jg 0x25c88ac
mov ecx, 0x8e7cfa47
stosb byte es:[edi], al
and al, 0x36
jnp 0x25c88b6
les edx, [esi - 0x290163b3]
out 0x62, al
mov ebp, 0x88942816
add al, byte [edi]
outsd dx, dword [esi]
jae 0x25c8951
retf
enter 0xdf2, 0xffffffffffffff86
clc
mov eax, dword [0xed188613]
sbb ah, byte [si - 0x32a9]
or byte [esi], 0xcc
dec esi
add dword [edi - 0x238947c6], eax
invalid
Function at 0x25b19a7
Capabilities:
Encode data using xor

Disassembly:
cmp eax, dword [ebp - 0x10]
lea esp, [esp + 4]
jge 0x285e571
push ebx
mov word [esp], 0xc838
mov byte [esp], dh
lea esp, [esp + 4]
jae 0x25c961d
dec bl
jmp 0x25cbf83
push 0xf633a934
test dh, 0xc
clc
repne scasb al, byte es:[edi]
mov dword [esp], 0x512a0883
push 0xc2bf2be5
pushfd
mov byte [esp + 4], dl
lea esp, [esp + 0xc]
jne fcn.025c960d
bsr si, ax
mov ecx, edi
push ebx
or si, di
sub ecx, ebx
cmp bl, 0x4b
call fcn.025b112b
pop esi
out 0x44, al
inc esp
in eax, dx
inc edi
movsd dword es:[edi], dword [esi]
idiv esp
adc edx, dword [ebp - 0x75ae726b]
int1
fild qword [ebp + 0x16]
movsb byte es:[edi], byte [esi]
add bl, byte [eax + 0x30]
mov dh, 0x8e
clc
push esi
mov esp, 0x54e20a94
sub al, 0x9a
jb 0x25c74d0
mov dword [ebx], ecx
jecxz 0x25c7535
call [ebp + 0x62]
js 0x25c74cf
invalid
mov dl, 0xa0
push ds
mov eax, 0x4ae02a04
salc
pop ebx
mov ah, 0xf4
or dword [edi - 0x1a], ecx
cmp al, 0xa6
fimul word [eax + esi*4 - 0x146a25b3]
test eax, 0xa3144333
js 0x25c7553
fsub dword [edx - 0x6856fffd]
or eax, 0xa3195be5
test al, 0xbf
adc eax, 0xcf3cf466
arpl word [ecx - 0x51], dx
invalid
bts cx, di
mov ebx, eax
bsr edi, edx
cmp bl, 0x26
mov edi, eax
rcl ch, 7
mov ecx, 0x104
bt dx, 0xb
xor al, al
jmp 0x25c7493
sub al, 0x12
test byte [ebp - 0x2d], 0xab
xor eax, 0x2e7bbd3a
add eax, 0x3b36b844
inc edi
aad 0x7e
or al, 0xb5
inc ebx
mov eax, ds
xor dl, bh
cmp al, 0x55
cmp ch, byte [ebx + 0x31]
ror dh, cl
cmp al, 0xfc
jp 0x25cc405
or dword [edi - 0x16], ebx
jns 0x25cc3a0
cwde
int 0xc1
les esi, [edx - 0x1b4b9dfc]
push esi
push 0xfa61be5
pop es
sti
jge fcn.025cc3c4
cwde
push esi
aam 0x87
adc eax, 0xdf6939d3
popfd
mov bl, 0x2d
jmp 0x25cc41e
call fcn.025b3542
loopne 0x25cc360
jno 0x25cc3cd
jmp eax
xchg ecx, eax
dec edi
out dx, al
mov cl, byte [eax + 0x33]
xor byte [ebx + 0x6883b436], al
dec edi
pushfd
scasb al, byte es:[edi]
ja 0x25cc3cd
add byte [esi + 5], 0
and al, 3
invalid
mov al, byte [0x972c42ea]
invalid
out dx, al
lahf
insb byte es:[edi], dx
aad 0xb6
sub esi, esi
and al, 0x50
mov cl, byte [esi + 0x7e]
lea edi, [esi]
iretd
push 0x7f82b3bf
lea esp, [esp + 4]
jae 0x25c961d
bts ebx, eax
bsr di, di
btr di, 3
shr bx, cl
mov ebx, eax
stc
shr edi, cl
setnp cl
sal di, 6
mov edi, eax
setl cl
bswap cx
dec ch
mov ecx, 0x104
cmp sp, 0xdb66
jmp 0x25cc3cb
jmp 0x2859d10

Function at 0x25c9495
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x20], eax
call fcn.01570624
lea eax, [ebp - 8]
jmp 0x1570765