joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c530ef6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x5c530f40
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x5c530ee7
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x5c530ef6
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x5c936b99
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x5c530f47
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.5c517dbd
cmp eax, dword [ebp + 0xc]
pop eax
je 0x5c530fe6
add edi, 4
add eax, 2
dec ecx
jne 0x5c530f2c
call 0x5c530f93
loope 0x5c530f89
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x5c530fe3
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x5c530ff4
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x5c530fa7
cmp eax, ecx
ja 0x5c530fa7
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x5c531031
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x5c531027
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.5c51829c
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0xd78f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6a8000]
push edi
or ebp, 0xffffffff
jmp 0xd78f32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xd78f39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd78f28
mov eax, 1
add ebx, ebx
jne 0xd78f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xd78f5c
jne 0xd78f7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd78f7b
dec eax
add ebx, ebx
jne 0xd78f68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xd78f40
add ebx, ebx
jne 0xd78f77
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xd78fcd
xor ecx, ecx
sub eax, 3
jb 0xd78f93
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xd79002
sar eax, 1
mov ebp, eax
jmp 0xd78f9e
add ebx, ebx
jne 0xd78f9e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd78f6c
inc ecx
add ebx, ebx
jne 0xd78fac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd78f6c
add ebx, ebx
jne 0xd78fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xd78fae
jne 0xd78fca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xd78fae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xd78fec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xd78fde
jmp 0xd78f2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xd78fec
add edi, ecx
jmp 0xd78f2e
pop esi
mov edi, esi
mov ecx, 0x1b68c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xd7900a
cmp byte [edi], 0x86
jne 0xd7900a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xd7900f
lea edi, [esi + 0x973000]
mov eax, dword [edi]
or eax, eax
je 0xd79087
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x97de78]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x97e098]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xd7903c
mov ecx, edi
jns 0xd7906b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x97e0a0]
or eax, eax
je 0xd79081
mov dword [ebx], eax
add ebx, 4
jmp 0xd79059
call dword [esi + 0x97e09c]
mov ebp, dword [esi + 0x97e0a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xd790bb
sub esp, 0xffffff80
jmp 0x817c57

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x417a16
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x620
mov al, cl
push ebx
mov bl, byte [0x4c1045]
and al, bl
push ebp
mov ebp, dword [0x4c1034]
xor al, 0x89
mov byte [0x4c1045], al
mov eax, dword [0x4c1030]
mov edx, eax
invalid
invalid

Function at 0x417a3e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or cl, al
ljmp 0x8ad2

Function at 0x420936
Capabilities:
Encode data using xor

Disassembly:
ror byte [ecx - 3], 5
out 0x25, al
and al, 0x18
dec ecx
std
add eax, 0x182425e6
fdivr st(5), st(0)
arpl sp, di
add al, 0xa2
sar dword [ecx + 0x7c6fec45], 1
loopne 0x4209b4
clc
pushfd
sbb bl, cl
sbb al, 0x64
pop esi
add eax, 0xed407143
cmpsb byte [esi], byte es:[edi]
rcl dword [0x9d918734]
loope 0x420937
mov bl, 0x3a
in al, 0xa4
ret
add ch, cl
invalid

Function at 0x420cda
Capabilities:
Encode data using xor

Disassembly:
pop ds
insb byte es:[edi], dx
adc esi, ebx
push eax
jae 0x420d5e
push es
lea edx, [eax + eax*8 - 0x79]
sub al, 0x27
xchg esp, eax
scasd eax, dword es:[edi]
mov word [ecx - 0x3bec5023], ds
in eax, dx
and eax, 0xbadc9ccd
enter 0x73ba, 0xffffffffffffff86
xchg esi, eax
js 0x420d66
movsd dword es:[edi], dword [esi]
push ebx
clc
aam 0xc8
rcr ch, 0xc8
sub al, 2
invalid
mov edx, 0xf1af88cf
das
push cs
stosb byte es:[edi], al
sal dword [ecx + 0x4a], cl
out 0xe8, eax
dec eax
jg 0x420d7f
or byte [ecx + 0x5ee3fbcf], dh
and al, 0x87
int1
cmp al, 0x25
clc
xchg edx, eax
dec edi
fild dword [eax + 0xee4b6dc]
fdiv qword [esi + 0x58e50ee4]
push cs
in eax, 0x58
sar ah, 1
pop es
cwde
mov dl, 0xf1
arpl word [ebp - 0x51], bx
lodsd eax, dword [esi]
cmp dword [eax + 0x111c4858], edx
salc
nop
cmpsd dword [esi], dword es:[edi]
fadd dword [ecx]
sbb esp, edx
shr dword [edi - 0x19], 1
xor al, 0xd9
aaa
out 0x34, eax
fnstenv [edi]
sub byte [ebx - 0x498507ba], ah
jp 0x420d1e
mov ebx, 0x39dbee2b
aas
jecxz 0x420d42
add eax, 0xe3783c78
jo 0x420d2b
pop es
inc ebp
ljmp 0x587f
jg 0x420dd9
xchg ebx, eax
cdq
or cl, byte [edi + 0x18]
mov byte [0xe56cf74e], al
mov esp, dword [edx - 0xe]
and byte [edi + eax], cl
mov byte [edi - 0x5f1980e3], ah
or byte [edi], al
pop eax
xlatb
dec edx
push esp
add esp, dword [edx - 0x322ae79e]
inc eax
daa
add edx, dword ss:[ebp + 0x3d]
dec ecx
fsub dword [esi]
inc ebp
dec eax
loop 0x420e09
or eax, ebx
push ds
jne 0x420d3f
adc eax, ebx
add esp, dword [esi + 0x613b055b]
or esp, ecx
push edx
dec esi
enter 0xaa8, 0xffffffffffffffcb
invalid
lodsb al, byte [esi]
jns 0x420e16
pop eax
xchg dword [edi + edx - 0x1f5571b6], edx
leave
push edi
and ch, byte [edi]
dec edx
mov gs, word [edx + 0x2257c9e0]
das
jo 0x420de0
or al, 0x76
push esi
daa
sub ecx, ebx
mov eax, ebx
mov esp, dword [edx]
cmp byte [edi + 0x40d8117a], ah
test byte [ebx], 0xb0
invalid
Function at 0x45bdc6
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x82
mov dword [0x73b7e0b9], eax
aad 0x76
idiv byte [ebp - 0x2b]
push es
cmpsd dword [esi], dword es:[edi]
add ebp, dword [0xbbe2ef94]
xchg esp, eax
out dx, eax
loop 0x45bd75
out 0x9e, al
pmulhuw mm1, mm5
int 0xa8
scasd eax, dword es:[edi]
sbb edx, edx
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
test dword [ecx + 0x1ebf2b16], esp
mov eax, dword [0x1ebf2b16]
adc eax, 0x8a6321a8
outsd dx, dword [esi]
imul eax, dword [edx], 0x15080a73
push ebp
add bh, bh
cmp al, 0x1f
or cl, byte [eax]
adc eax, 0x3cff0255
pop ds
mov bh, 0x9b
sub ebp, dword [ebx - 0x69b2aac0]
xor eax, 0x4c0dbfa1
mov ecx, 0x2bb5cc0
test ch, dh
jle 0x45bdd4
mov al, 0x8c
invalid

Function at 0x4b95d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c13d8
cmp edx, dword [eax]
je 0x4b95f3
add eax, 8
inc ecx
cmp eax, 0x4c1468
jl 0x4b95e4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c13d8]
jne 0x4b9721
mov eax, dword [0x4c5d5c]
cmp eax, 1
je 0x4b96fb
test eax, eax
jne 0x4b9624
cmp dword [0x4c1300], 1
je 0x4b96fb
cmp edx, 0xfc
je 0x4b9721
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b965b
lea eax, [ebp - 0x1a4]
push 0x4be960
push eax
call fcn.004b9fb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba440
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b969e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba440
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be95c
push edi
call fcn.004bc310
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4be940
push eax
call fcn.004b9fb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9fc0
lea eax, [ebp - 0xa0]
push 0x4be93c
push eax
call fcn.004b9fc0
push dword [esi + 0x4c13dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9fc0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4be914
push eax
call fcn.004bc284
add esp, 0x2c
pop edi
jmp 0x4b9721
lea eax, [ebp + 8]
lea esi, [esi + 0x4c13dc]
push 0
push eax
push dword [esi]
call fcn.004ba440
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10013171
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x10023230]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x24]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.10012137
push 0x1000ad88
lea ecx, [esp + 0x1c]
call fcn.1001209e
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x100131f5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x1001322b
mov ecx, dword [ebp + 4]
mov edx, 0xc8
push 0x1000ad40
call fcn.1000ddd9
mov edi, eax
jmp 0x1001322b
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.10013056
mov ebx, eax
test ebx, ebx
jns 0x1001321d
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xce
call fcn.10012ee1
mov edi, ebx
jmp 0x1001322b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x10013235
push esi
call fcn.10012f5c
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001fd10
mov esp, ebp
pop ebp
ret 8
Function at 0x403d65
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403e08
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.004063f4
pop ecx
pop ecx
test eax, eax
je 0x403df1
test ebx, ebx
je 0x403de5
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.004062bb
pop ecx
pop ecx
test eax, eax
jle 0x403df1
push ebx
call fcn.0040394e
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.0040392d
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403db2
xor edi, edi
cmp ebx, edi
jne 0x403e0c
xor eax, eax
jmp 0x403e78
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403e3b
call fcn.0040394e
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403e08
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403e08
call fcn.0040394e
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403e2b
cmp dword [ebp - 0x70], edi
je 0x403e6e
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040392d
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004096b8
add ebp, 0x9c
leave
ret
Function at 0x41620f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov ch, 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00415f31
dec esi
sbb eax, 0x458d623a
test al, 0x50
call fcn.00415f41
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00415ef6
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
dec dword [ebx - 0xe0807bb]
test edx, edx
je 0x41621f
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00415f31
push edx
salc
fsub qword [ebp + ecx*4 - 0x17af3fbb]
invalid
Function at 0x41661a
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
dec dword [ebx + 0x3b660c45]
inc edi
push es
jne 0x416608
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x416626
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x416684
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x41666b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x416674
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x41667e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x416660
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4165ea
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4166d1
dec eax
je 0x4166c8
sub eax, 3
je 0x4166bf
mov dword [ebp - 4], 0x40
jmp 0x4166ee
mov dword [ebp - 4], 4
jmp 0x4166d4
mov dword [ebp - 4], 0x20
jmp 0x4166d4
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x416720
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4166a0
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00415f31
and dword [edi], edx
lea esp, [ebx - 1]
jne 0x41672b
push 1
push esi
call edi
mov eax, esi
jmp 0x41672c
rcr byte [edi + 0x5e], 0x5b
Function at 0x4180dd
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cli
invalid
jl 0x41808a
invalid
jb 0x41808f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x4180f5
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00415f31
leave
pop esi
rol dword [eax - 0x75], 1
clc
mov eax, dword [edi + 0x3c]
invalid
push esp
pop es
Function at 0x923f00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x68200d
lea edi, [esi - 0x28100d]
push edi
or ebp, 0xffffffff
jmp 0x923f22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x923f29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x923f18
mov eax, 1
add ebx, ebx
jne 0x923f3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x923f30
jne 0x923f4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x923f30
xor ecx, ecx
sub eax, 3
jb 0x923f60
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x923fd2
mov ebp, eax
add ebx, ebx
jne 0x923f6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x923f78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x923f9c
inc ecx
add ebx, ebx
jne 0x923f88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x923f7d
jne 0x923f99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x923f7d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x923fbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x923fad
jmp 0x923f1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x923fbc
add edi, ecx
jmp 0x923f1e
pop esi
mov edi, esi
mov ecx, 0x1684
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x923fda
cmp byte [edi], 0x11
jne 0x923fda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x923fdf
lea edi, [esi + 0x51f000]
mov eax, dword [edi]
or eax, eax
je 0x92404e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x52c164]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x52c1bc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x92400c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x52c1c4]
or eax, eax
je 0x924048
mov dword [ebx], eax
add ebx, 4
jmp 0x924029
call dword [esi + 0x52c1c0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x92407f
cmp al, 0xef
ja 0x924072
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x924054
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x924061
mov ebp, dword [esi + 0x52c1c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9240b3
sub esp, 0xffffff80
jmp 0x40d74c
Function at 0x427e1e
Capabilities:
Encode data using xor

Disassembly:
invalid
add byte [edx], al
push edx
add byte [ecx], bl
add al, 1
add byte [edx + eax*2], al
add byte [eax], al
js 0x427de5
add byte [eax], al
jo 0x427e71
add dword [eax], eax
push 0x13dc1
jns 0x427e7a
add dword [eax], eax
add byte [eax], al
add byte [ecx], al
invalid
add dword [eax], eax
in al, dx
inc ecx
add dword [eax], eax
or al, 8
push cs
test byte [eax], al
add dword [eax], eax
sub al, 0x14
pop esp
add byte [eax], al
sal byte [esi], 0xb9
add byte [ecx], al
add byte [edx + 0x785c], cl
rol al, 2
add byte [eax], cl
or dl, dh
inc ecx
add dword [eax], eax
add al, 0x17
adc dh, byte [eax + 0x60000170]
leave
add byte [ecx], al
add ch, ch
add edx, dword [ecx]
sub bh, 0
add dword [eax], eax
sbb eax, 0x2050804
add al, byte [esi + eax + 0x1a]
or byte [edx], ch
or al, byte [eax]
add byte [ecx], al
push es
add al, byte [eax]
push es
xor al, byte [edx]
push eax
sbb dword [eax], edx
push es
add byte [eax], dl
je 0x427ed4
add byte [eax], dl
or byte fs:[eax], al
adc byte [edx + 0xc], dl
loopne 0x427f4b
mov ecx, 0x42180000
add dword [eax], eax
cmp byte [0x3d000142], ah
add byte [eax], al
sbb byte [edx + 1], al
add byte [eax], bh
and eax, 0x3d000142
inc edx
add dword [eax], eax
pop ebx
inc edx
add dword [eax], eax
or al, 8
push cs
adc al, 1
add dword [eax], eax
sub al, 0xcc
jp 0x427ef2
add byte [eax + 0x1013d36], dl
add byte [esi], ch
dec ebp
add dword [ecx], eax
add byte [eax + 0xa080002], bh
inc ebp
inc edx
add dword [eax], eax
add al, 0x17
adc dh, byte [eax + 0x40000170]
pop ebp
add dword [ecx], eax
add ch, cl
add dl, byte [ecx]
add byte [ebx - 0x2fffeff], 2
push es
xor byte [edx], al
insb byte es:[edi], dx
push es
or byte [edx], 0
add byte [ecx], dl
sbb al, 0xa
add byte [esp + esi], bl
adc eax, 0x15b21c00
invalid
mov eax, dword [0x6000142]
or al, byte [eax + edi*2]
add cl, ah
add bh, byte [edx]
shl byte [edx], 1
add byte [eax], al
xor byte [edx], 0xd0
and al, byte [eax]
add byte [eax + 2], ah
or dword [edi], eax
pop es
push es
add byte [eax], al
add byte [ecx], bl
pop ss
or byte [eax], al
pop ss
xor al, 0x10
add byte [edi], dl
jb 0x427f85
invalid
add byte [eax - 0x37], ah
inc edx
add dword [eax], eax
add ch, byte [eax + eax + 0x11]
pop ds
or al, 0
pop ds
je 0x427faa
add byte [edi], bl
adc al, 0
pop ds
xor al, 0x13
add byte [edi], bl
mov dl, 0x18
invalid
js 0x427f65
add byte [eax], al
invalid
Function at 0x9301a8
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9301ae
pop ebp
sub ebp, 6
sub ebp, 0x5301a8
jmp 0x93020c
jmp 0x930215
mov eax, 0x5301a8
add eax, ebp
add eax, 0x93
mov ecx, 0x615
mov edx, 0x3e411a4c
xor byte [eax], dl
inc eax
dec ecx
jne 0x93022c
jmp 0x93023f
or al, 0x24
dec esp
pop esp
dec esp
dec esp
and al, 0x4c
and byte [eax + 0x4c], 0x7f
mov word [ebx + esi*4], ds
fnstenv [ecx - 0x38e3b3fb]
add edi, 0x4c4c70c5
dec esp
int 0x8d
mov ah, 0x4c
dec esp
dec esp
dec edi
xor esp, 0x4c4c4c4a
mul byte [esp + ecx*2 + 0x4c]
dec esp
mov ebx, 0xc7844fae
int 0x40
dec esp
dec esp
dec esp
dec edi
mov dword [esp], ebx
lodsd eax, dword [esi]
jp 0x9302c5
dec esp
and al, 0x8b
xchg byte [0x68604d4c], al
and al, 0x4c
dec esp
dec esp
dec esp
movsb byte es:[edi], byte [esi]
dec ecx
dec esp
dec esp
dec esp
movsd dword es:[edi], dword [esi]
dec sp
dec esp
dec esp
sbb ecx, eax
and byte [eax + 0x4c], ch
invalid
dec eax
dec esp
dec esp
dec esp
and al, 0xad
jp 0x930312
dec esp
and al, 0x8b
xchg byte [0x68604d4c], al
sbb eax, 0x4c4c49a4
dec esp
movsd dword es:[edi], dword [esi]
jns 0x93032d
dec esp
dec esp
sbb ecx, eax
and byte [eax + 0x4c], ch
mov bl, 0x39
inc eax
mov bl, 0x39
inc esp
movsb byte es:[edi], byte [esi]
sub cl, byte [esp + ecx*2 + 0x4c]
invalid
inc ebx
enter 0x4c56, 0x4c
dec esp
int3
movsd dword es:[edi], dword [esi]
xor byte [ebx + 0x65b3b3], 0x75
dec ebp
iretd