joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ddf34
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.004e6f43
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4ddf7a
xor eax, eax
jmp 0x4ddf7d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.004e7578
lea eax, [edi + 0x7c]
test eax, eax
je 0x4ddf98
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.004e78dd
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x4ddfd6
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.004e78dd
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.004e6c5d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004e75f9
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x527c64
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.00530c73
mov dword [esp + 0x28], 0
test esi, esi
jne 0x527caa
xor eax, eax
jmp 0x527cad
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.005312a8
lea eax, [edi + 0x7c]
test eax, eax
je 0x527cc8
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0053160d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x527d06
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0053160d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0053098d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00531329
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x571874
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0057a883
mov dword [esp + 0x28], 0
test esi, esi
jne 0x5718ba
xor eax, eax
jmp 0x5718bd
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0057aeb8
lea eax, [edi + 0x7c]
test eax, eax
je 0x5718d8
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0057b21d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x571916
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0057b21d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call int.0057a59d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0057af39
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57d6e1
Capabilities:
Encode data using xor

Disassembly:
shl edi, cl
pop es
jmp 0x57d6e9
xchg edi, eax
dec esp
pop edi
pop ebp
leave
mov dword [0xd0285a84], eax
inc ebx
rol byte [ebx + 0x37], 1
aaa
mov byte [0x22b7d18d], al
sti
xor al, ah
test al, 0x2c
sbb dword [eax - 8], edx
jb 0x57d6eb
sbb al, 0x81
jns 0x57d6b0
add eax, 0xdc7004ba
mov dh, ch
dec ebx
aam 0xfa
ja 0x57d6e0
mov ebx, 0x37c8e1f9
out 0x67, eax
invalid

Function at 0x57e104
Capabilities:
Encode data using xor

Disassembly:
inc esp
pop esp
shr dword [esi - 0x582f443b], cl
cmp dword [esi], edx
lds edi, [ebx + 0x1639a7d0]
xor ecx, dword [edi]
loop 0x57e109
cld
cmp dword [esi + edx*8 + 0x21b108ff], esi
jbe 0x57e177
mov ebx, 0x76cb41f7
retf
push ss
push ebx
sbb ch, byte [edx]
push ebp
scasb al, byte es:[edi]
pop edx
pop esi
rol byte [ebx - 0x6b9c961f], cl
lcall 0x7869, 0xba4e4d39
cmp eax, esi
cmp edx, dword [esi]
sbb byte [edx - 3], ah
push esi
add ebp, dword [eax]
call 0x99194e2
dec ecx
xchg byte [eax + ebp*4 - 0x17], bh
inc edi
jg 0x57e1de
mov edx, 0x7c736620
dec ecx
invalid
invalid
Function at 0x583706
Capabilities:
Encode data using xor

Disassembly:
pop es
pop edi
xchg al, ch
cmpsb byte ds:[esi], byte es:[edi]
mov dh, 6
scasd eax, dword es:[edi]
adc edx, dword [edx]
loopne 0x583745
push esi
shr dword [edx - 0x31306134], 1
jae 0x583798
push esi
xor byte [edi + 0x307d879a], bl
in al, dx
and dword [edx], 0xf5ca2663
mov ebp, 0xa9eefa80
xor ebp, ecx
invalid
dec eax
test dword [ecx - 0x2bc9326b], ebp
int 0xb8
mov byte [ebx], cl
sub eax, edx
or esp, ebp
mov dword [eax - 0x39], ecx
fsubr dword [edi]
mov ebp, esp
dec ecx
jae fcn.00583706
mov esp, 0xc5caf4ea
pop esp
invalid
inc esi
sub al, 0x43
cmp dword [esi - 8], eax
push edi
xchg esi, eax
add esi, esi
pop es
pop edx
push esi
push ecx
adc eax, 0x70e8a662
neg byte [edx + 0x4343ed32]
jbe 0x5837c5
scasd eax, dword es:[edi]
pop es
dec ecx
sub al, 0x97
mov bh, 0x1c
cwde
sub dl, ah
inc edx
jl 0x583808
push ebx
inc esi
ror eax, cl
cmpsd dword [esi], dword es:[edi]
or dword [edi], esi
cld
mov al, byte [0xc6292c16]
and dword [edx + 0x6bffbecd], 0xab5f709b
xchg edx, eax
xchg esp, eax
or byte [ebx - 0x31ba6f57], cl
inc ebp
into
adc eax, 0x97f21fc6
xchg edi, eax
loope 0x583768
xor al, 0x10
add byte [esi - 0x3a984df0], ch
mov al, byte ss:[0xaa6ce813]
cdq
lodsb al, byte [esi]
das
mov esi, gs
jl 0x5837ca
scasb al, byte es:[edi]
invalid
test dword [edi + edx*4 - 0x20], ebp
xabort 0xffffffffffffffb3
dec edi
invalid

Function at 0x5c4e26
Capabilities:
Encode data using xor

Disassembly:
adc eax, ebp
cwde
fsub dword [ebx + 0x18302968]
cmpsb byte [esi], byte es:[edi]
adc dword [eax], edi
push ds
sub ebp, edx
jns 0x5c4e98
or esi, esp
add dword [ebx], 0x418c86c7
jmp 0x5c4e02
ror dword [esi - 0x75d0ae29], 1
daa

Function at 0x5d49e2
Capabilities:
Encode data using xor

Disassembly:
and cl, byte [ecx]
mov dword [0xba5f3d76], eax
or dword [0x37d9cff5], edi
sbb ch, byte [ecx + 0x6a]
in eax, dx
cdq
push ecx
in al, dx
mov edi, dword [edx + eax*8]
clc
test dl, bh
add byte [esi - 0x1b], dl
mov ebx, 0xbaa4031a
mov ebp, 0x9c7b3c89
dec esi
xchg edx, eax
insd dword es:[edi], dx
and eax, 0x3a48d2da
mov esi, 0xdd71a59f
call 0x7e270150
add ah, 0x6d
invalid
Function at 0x605144
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0060e153
mov dword [esp + 0x28], 0
test esi, esi
jne 0x60518a
xor eax, eax
jmp 0x60518d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0060e788
lea eax, [edi + 0x7c]
test eax, eax
je 0x6051a8
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0060eaed
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x6051e6
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0060eaed
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0060de6d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0060e809
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60de6d
Capabilities:
Encode data using xor

Disassembly:
das
popfd
sbb al, 0xe4
outsb dx, byte [esi]
test byte [edx - 0x51f01f84], bh
dec eax
div byte [edx]
pop ds
movsd dword es:[edi], dword [esi]
dec edi
arpl word [ebx + 0x4c4a3f20], bx
lea ecx, [eax - 0x2b9cf8b]
rcr dword [esi + 8], cl
pop edi
cmp al, 0x33
sub dword [edi], eax
pop esi
or byte [edi + 0x3c], bl
xor ebp, dword [ecx]
pop es
mov al, byte [0x8077eab9]
xchg ecx, eax
popal
sbb eax, 0x8cb63a2d
scasb al, byte es:[edi]
insd dword es:[edi], dx
cmpsd dword [esi], dword es:[edi]
mov ch, 0x42
jo 0x60dee4
mov ah, 0x67
xor esi, dword [ebp - 0x4b]
popfd
insb byte es:[edi], dx
jne 0x60df2e
sub byte [edi], dl
aad 0x91
hlt
jne 0x60de8b
in al, 0xcb
or eax, 0x2a0a53af
or byte [0xb65ecac7], 0x58
in eax, 0xff
nop
sti
push ss
outsd dx, dword [esi]
scasb al, byte es:[edi]
call dword [eax - 0x5190e905]
lahf
sbb eax, 0x59a7951c
xlatb
into
jg 0x60df5e
xlatb
add dword [edx + 0x1d], esp
xchg edx, eax
iretd
xor eax, 0xd22f3380
jl 0x60def5
scasb al, byte es:[edi]
sub byte [edi + 0x6dc89e20], al
js 0x60df8b
invalid
fldcw word [ebx]
sub edx, edi
inc edi
jecxz 0x60df16
jge 0x60df8d
and ah, byte [0xfb3f94e7]
sbb byte [esi + ebp], dh
pop ecx
push ebx
clc
mov dword [0x4c457075], eax
ljmp 0x3a34
mov ch, 0x47
push esi
dec ebp
jns 0x60dfb2
xchg esp, eax
inc ebx
xor eax, 0x338008f
invalid
insd dword es:[edi], dx
in eax, 0x7a
mov byte [ebx + 0x71], 0x52
push ss
push esp
mov dword [edi + 0x2ae29fa1], ebp
sub ecx, edx
add dh, 0x8e
mov edi, 0x473b46c3
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
mov eax, 0xed2035e3
jecxz 0x60dfc4
and ch, ch
and cl, al
invalid
mov al, byte [0x77019773]
mov ebp, 0xdb555200
mov dword [0xe69dd427], eax
mov al, 0x6b
mov edi, 0x55b977d6
ja 0x60df71
add byte [edx + 0x55], dl
invalid
popfd
out 0xb0, al
imul edi, dword [edi + 0x55b977d6], 0
jg 0x60e038
add byte [edi + 0x71], bh
push ebx
push ss
xor byte [edx + 0x2b93431b], al
dec edi
xor ebx, ebx
loopne 0x60dfbb
lds edi, [esi]
dec ebp
pop ss
adc al, 0xaf
jno 0x60dfae
mov ecx, 0xac2339d4
dec ebp
or eax, 0x2b812bb7
jg 0x60e067
aas
das
into
invalid
sbb al, 0x4b
xor eax, 0x698004dc
xchg edi, eax
xlatb
inc byte [ecx]
into
fnstsw word [esi + 0x4e]
invalid
jno 0x60e008
int1
add al, 0x35
mov edi, 0x57d6aef7
and bh, dl
imul byte [eax - 3]
movsd dword es:[edi], dword [esi]
sbb dword [edi + 0x11], edx
and byte [edi], 0x92
sbb al, 0x2b
mov byte [ecx + 0x30], 0x67
pop ebp
invalid
xor bl, bl
fnstsw word [edx]
xor dword [0x34952fe4], ecx
dec esp
stc
mov edi, dword [ecx]
xchg esi, eax
and bh, byte [esi + eax*4 - 0x656a606a]
aam 0xbd
aad 0x51
xchg esi, eax
outsd dx, dword [esi]
adc eax, 0x437a2554
pop ds
das
xor esp, dword [esi + ecx*4 - 0x642a40db]
in eax, 0xbd
jmp 0x60e03b
Function at 0x615fa0
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0xd1
xchg ebx, eax
wait
sub esp, edx
out dx, eax
xchg ebx, eax
popfd
movsb byte es:[edi], byte [esi]
xchg edi, eax
cmp esi, dword [esi]
mov eax, dword [0x4498da76]
ficomp dword [eax - 0x20cfb0bc]
ficomp dword [eax - 0x20cfb0bc]
inc ecx
push ss
push ds
in al, dx
dec eax
shr dword [edi], cl
in al, 0x6e
sbb byte [edi], 0x93
cmp al, 0xbb
cmp dl, byte [edi]
test dword [0x29dc65b], edx
sal byte [edi - 0x48], 4
sbb eax, 0xff6d60d5
sar byte [edi], 0x25
cmc
lock or dword [ebx - 0x429e5acb], esi
push ds
mov ecx, 0xe903353d
and dl, byte [ebp - 0x75a46851]
mov esp, 0x2f47e84a
inc ebp
pop ecx
lcall 0x3822, 0xccf195fe
pop ebx
and ebx, esi
jnp 0x615f91
in al, dx
pop esi
int3

Function at 0x61710a
Capabilities:
Encode data using xor

Disassembly:
add dword [ebp - 0xd807f11], 0x4bb992c
xchg ebx, eax
mov ch, 0x2c
in al, 0xce
adc dword [eax + 0x7c], ebp
inc edi
mov bl, 0x76
outsb dx, byte es:[esi]
jbe 0x61712d
outsb dx, byte [esi]
pushfd
inc esp
xlatb
and dword [ebx], edx
xchg edi, eax
xor ah, dl
pop ss
mov ebx, 0xa1d1bb85
or eax, ebx
xchg esi, eax
jl 0x617105
scasd eax, dword es:[edi]
popal
lahf
pop esp
xor eax, 0x1d74e2f5
jnp 0x6170f1
test ebp, esp
fild word [edx - 0x3e]
pop es
js 0x617121
pop edi
dec eax
scasd eax, dword es:[edi]
mov al, 0xfb
ret

Function at 0x6174c1
Capabilities:
Encode data using xor

Disassembly:
pushal
mov esi, 0x57a3b4bb
dec edx
inc byte [ecx + 0x54]
hlt
xchg edi, eax
out 0xc4, al
int3
jle 0x61743b
add dl, dh
or dl, byte [ebx]
cli
push es
invalid
cmc
xchg edi, eax
xchg esi, eax
out dx, eax
mov eax, dword [0x368ac78d]
jbe 0x617489
xor dl, byte [ecx + 0x1a]
les eax, [esi]
inc ah
dec edi
out 0xf7, eax
int1
sub al, 0x73
adc eax, 0xb7772d9e
sbb ah, ah
jno 0x61744a
sahf
into
jne 0x617494
ja 0x6174bc
les eax, [ebx + 0x5586acc9]
or ecx, 0xffffffac
xchg byte [ebp - 0x12], dl
out dx, al

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4a635f73
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1d7c2705
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x77206756
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x77208004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
test edi, edi
je 0x772067b9
push ecx
push ecx
push ecx
mov edx, 0x400
lea ecx, [ebp - 0x404]
call fcn.772064bf
push 0x772015c4
mov edx, 0x400
lea ecx, [ebp - 0x404]
call fcn.77206431
push edi
mov edx, 0x400
lea ecx, [ebp - 0x404]
call fcn.77206431
lea ecx, [ebp - 0x404]
xor edi, edi
lea eax, [ebp - 0x40c]
push edi
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push ecx
push 0x80000000
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExA]
test eax, eax
jne 0x77206833
mov eax, edi
mov dword [ebp - 0x408], eax
test esi, esi
je 0x77206805
lea eax, [ebp - 0x408]
mov edx, 0x7fffffff
push eax
mov ecx, esi
call fcn.7720647f
mov ecx, eax
mov eax, dword [ebp - 0x408]
jmp 0x7720680a
mov ecx, 0x80070057
test ecx, ecx
jns 0x77206810
mov eax, edi
inc eax
push eax
push esi
push 1
push edi
push ebx
push dword [ebp - 0x40c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
push dword [ebp - 0x40c]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77207240
leave
ret 8

Function at 0x77206844
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x77208004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x108]
mov edi, edx
push eax
push 0xf003f
push 0
mov esi, ecx
push edi
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x772068be
jmp 0x7720688c
mov ecx, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
call fcn.77206844
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0
push dword [ebp - 0x108]
call dword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegEnumKeyA]
test eax, eax
je 0x7720687b
push dword [ebp - 0x108]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push edi
push esi
call dword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.77207240
leave
ret

Function at 0x772073a0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x772073de
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x772073d6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x772073e0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x772073c6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x772074b0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x772074e1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x772074e1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x772074e1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x7720c272
Capabilities:
Encode data using xor

Disassembly:
call 0x7720c1eb
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x7720c21b
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x7720c237
xor edx, 0
jmp 0x7720c242
xor edx, edx
jmp 0x7720c259
jmp 0x7720c265
xor eax, eax
push 0x8427d7c0
call 0x7720c272
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x7720c2ae
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x7720c287
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x7720c2c5
add eax, 0
jno 0x7720c2ca
add esi, 0
ret 0x10
Function at 0x7720d033
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x7720d055
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x7720d1f7
cmp edi, dword [ebp + 0x10]
jb 0x7720d1f7
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.7720cb1f
inc edi
jmp 0x7720d0de
jmp 0x7720d0eb
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.7720cb1f
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.7720cb1f
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x7720d13f
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x7720d123
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.7720d16d
add dword [eax], 0x39
jle 0x7720d149
sub al, 0xf5
mov ch, al
call fcn.7720d182
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0x7720ee5a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x7720ee70
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x7720ee81
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.7720eec2
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx