joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp 0x40589d
mov eax, dword [eax + 0x78]
jmp 0x4058ab
test eax, eax
nop
jmp 0x4058ba
je 0x405a5c
nop
jmp 0x4058cd
add eax, edx
mov ecx, dword [eax + 0x18]
nop
jmp 0x4058de
mov ebx, dword [eax + 0x20]
nop
add ebx, edx
nop
jmp 0x4058f5
push eax
nop
nop
test ecx, ecx
je 0x405a34
nop
dec ecx
nop
jmp 0x405912
mov esi, dword [ebx + ecx*4]
nop
add esi, edx
jmp 0x405927
xor edi, edi
nop
jmp 0x405935
nop
jmp 0x405947
xor eax, eax
nop
jmp 0x405958
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
nop
jmp 0x40596c
cmp al, ah
jmp 0x40597b
jne 0x405935
nop
nop
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jmp 0x405999
jne 0x4058f7
nop
nop
jmp 0x4059b1
pop eax
mov ebx, dword [eax + 0x24]
nop
add ebx, edx
jmp 0x4059c9
mov cx, word [ebx + ecx*2]
nop
jmp 0x4059dc
mov ebx, dword [eax + 0x1c]
nop
add ebx, edx
mov eax, dword [ebx + ecx*4]
nop
jmp 0x4059fa
add eax, edx
jmp 0x405a06
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
nop
jmp 0x405a1f
pop ecx
nop
pop edx
nop
push ecx
jmp 0x405a32
jmp eax
jmp 0x405a48
pop eax
jmp 0x405a5c
jmp 0x405a6c
pop edi
pop edx
nop
jmp 0x405a83
mov edx, dword [edx]
nop
jmp 0x4057f9

Function at 0x405c86
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x405c88
ret

Function at 0x40a000
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi - 0x2e], eax
mov dword [esi + 0x3c], edx
cli
dec ebx
or al, 0x8b
ror byte [ebx - 0xcc07ba], 1
mov ecx, edx
or eax, edi
mov dword [esi + 0x38], edx
mov esi, ecx
cmp al, 0x8b
dec ebx
or byte [ecx - 0x3eb6b7b2], cl
mov edx, dword [esi + 0x20b9]
add byte [edx], ah
jle 0x409f4f
call fcn.0040b82c
mov dword [esi - 0x29], eax
mov dword [edi], esi
dec esp
int1
push ebx
add al, 0x5a
dec esi
dec esp
adc al, 0xc2
or edx, dword [ecx - 0x7659b977]
wait
bound edx, qword [edi - 0x75]
ror dword [ebx + 0xa6a484e], 0x50
push ecx
dec ecx
mov edi, 0x89000015
inc esi
dec eax
add eax, 0x8279c000
mov dword [esi + 0x4c], edx
mov dword [esi + 0x48], eax
or al, 0xd2
insd dword es:[edi], dx
mov eax, dword [0xcbb9ffd6]
add byte [eax], al
mov cs, word [ecx + 0x53bf4c56]
sbb byte [ecx - 0x3d58bfaa], cl
add esp, dword [ecx - 0x1b]
jle fcn.0040a03e
inc ebx
jno 0x40a015
add byte [edx - 0x74bfb971], al
inc ebp
inc eax
inc esi
inc eax
mov eax, dword [ebp + 0x40]
mov dword [eax], ecx
jb 0x409f94
inc ebx
adc al, 0xb
enter 0xffffffffffff9553, 0xffffffffffffff89
dec esi
inc eax
inc edx
push esi
inc eax
or eax, edi
push edi
mov eax, dword [edi]
push 0xa
Function at 0x40a340
Capabilities:
Encode data using xor
Terminate process

Disassembly:
lodsd eax, dword [esi]
mov ebp, ebp
mov ecx, dword [ebp + 8]
push esi
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40a35f
add ecx, 0xc
push ecx
scasb al, byte es:[edi]
leave
sub al, 0xc0
inc eax
add byte [ebx], dh
rcr byte [esi + 0x5d], 0xc2
add al, 0
xor eax, eax
pop esi
pop ebp
ret 4
cmp eax, 1
adc dword [ebx + ecx*4], ecx
inc ecx
or byte [ecx - 0x49cfea01], ah
push esi
add bl, ch
sbb eax, 0x7502f883
jecxz 0x40a38f
jmp 0x40a38d
dec ecx
out 0x51, al
call dword [ecx]
xor al, 0xc0
inc eax
loop 0x40a36e
into
jne 0x40a358
dec esp
xor eax, 0x3340c098
inc esp
salc
xchg edx, eax
inc ebp
pop edx
leave
call esi
add eax, 0x1182fc80
xor eax, 0x4c25d
nop
nop
push ecx
nop
nop
Function at 0x401a10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
not edx
sub edx, 0x228f
cmp edx, 0xad
jne 0x401a81
not ecx
add ecx, 0x290a
not eax
add eax, 0xa1c
not edx
xor edx, 0x27e
not eax
sub eax, 0x2ab
test edx, edx
jne 0x401a75
test eax, eax
jne 0x401a61
xor edx, 0x2bd4
and edx, 0x13b0
sub ecx, 0x3561
not edx
or edx, 0xd3e
not eax
and eax, 0x1d16
sub eax, 0x2160
sub eax, 0xf7d
not edx
xor edx, 0xfed
add edx, dword [ebp - 0x15c]
xor edx, 0x2157
test eax, eax
jne 0x401aae
sub ecx, 0x38ff
sub dword [ebp - 0x18], eax
not eax
xor eax, 0x3c3b
sub ecx, dword [ebp - 0x68]
or dword [ebp - 0x28], ecx
or edx, dword [ebp - 0xd4]
not edx
xor edx, 0x320c
or edx, dword [ebp - 0xe0]
add dword [ebp - 0x244], eax
not edx
and edx, 0xf2d
cmp edx, dword [ebp - 4]
je 0x401aef
or ecx, 0x1f05
xor ecx, 0x13d2
not edx
add edx, 0x111c
and dword [ebp - 0x144], edx
sub eax, 0x1fed
sub dword [ebp - 0x18], edx
not edx
xor edx, 0x193d
xor dword [ebp - 0xe4], edx
add dword [ebp - 0x1d0], eax
or dword [ebp - 0x144], eax
not eax
sub eax, 0x3fb2
sub dword [ebp - 0x90], eax
not eax
or eax, 0x228b
lea eax, [ebp - 0xdc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor dword [ebp - 0x23c], eax
cmp dword [ebp - 0x248], edx
je 0x401be4
xor dword [ebp - 0x110], eax
xor eax, dword [ebp - 0x12c]
not ecx
xor ecx, 0x3340
and edx, 0x11dc
sub eax, 0x11dc
not eax
sub eax, 0x1de3
xor dword [ebp - 0x1a8], eax
cmp edx, eax
je 0x401bd8
add dword [ebp - 0x160], edx
not eax
or eax, 0x3117
not ecx
and ecx, 0xe5
test ecx, ecx
je 0x401bef
xor dword [ebp - 0x208], eax
sub ecx, 0x2692
test eax, eax
jne 0x401bc2
xor eax, dword [ebp - 0x1ec]
or eax, 0x3cce
sub edx, 0x1624
add dword [ebp - 0x14], edx
and ecx, 0x3e47
or dword [ebp - 0xf8], ecx
not eax
add eax, 0x3bc7
add dword [ebp - 0x28], eax
sub ecx, dword [ebp - 0x20]
or ecx, 0x3171
and eax, 0x247d
or dword [ebp - 0x1c4], eax
sub edx, 0x37ec
not ecx
sub ecx, 0x74f
or ecx, 0x1ef
not eax
sub eax, 0x4c
and eax, 0x1c
push eax
call dword [sym.imp.USER32.dll_GetDC]
sub dword [ebp - 0x1cc], edx
xor edx, 0xc3a
cmp ecx, dword [ebp - 0x1c]
je 0x401ca9
sub ecx, dword [ebp - 0x1bc]
add eax, dword [ebp - 0x2c]
cmp ecx, edx
jne 0x401cc6
and ecx, dword [ebp - 0xac]
add edx, 0x18da
add dword [ebp - 0x124], edx
xor ecx, 0x275e
cmp edx, eax
je 0x401cb6
and ecx, 0x35ab
add eax, dword [ebp - 0x11c]
or dword [ebp - 0x1b8], ecx
xor eax, 0x1f91
test edx, edx
jne 0x401cea
xor edx, 0x137f
and edx, 0x89b
add ecx, 0x89b
cmp eax, ecx
je 0x401c97
or dword [ebp - 0x204], eax
add eax, 0x2d9c
not edx
sub edx, 0x3b9a
add eax, 0x3b1
add edx, 0x30d7
not eax
xor eax, 0x38af
not edx
and edx, 0xe89
not edx
xor edx, 0x3ea6
xor dword [ebp - 0x204], ecx
sub ecx, dword [ebp - 0x1fc]
and ecx, dword [ebp - 0xf4]
and dword [ebp - 0x164], ecx
xor ecx, dword [ebp - 0x228]
sub ecx, 0x3c82
add edx, 0x3dfb
leave
ret
Function at 0x66d7a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
push edi
lea edi, [esi + eax]
cmp esi, edi
jae 0x66d7d6
mov al, byte [esi]
push eax
call fcn.0067c570
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x66d7b8
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x67d5e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x67d608
cmp dword [esi + 0x78], 0
je 0x67d608
push 2
push 3
push esi
call fcn.0067cbc0
push dword [ebp + 0xc]
call fcn.0067d040
add esp, 0x10
jmp 0x67d617
push dword [ebp + 0xc]
call fcn.0067d040
add esp, 4
test esi, esi
je 0x67d628
cmp dword [esi + 0x78], 0
je 0x67d628
push 3
push esi
call fcn.0067cc00
add esp, 8
pop esi
pop ebp
ret
Function at 0x6a4180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
xor bl, bl
test edx, edx
je 0x6a41a7
push esi
mov esi, dword [ebp + 0xc]
sub esi, eax
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or bl, cl
sub edx, 1
jne 0x6a4196
pop esi
mov al, bl
shr al, 4
or bl, al
movzx eax, bl
mov ecx, eax
shr ecx, 2
or ecx, eax
mov eax, ecx
shr eax, 1
or eax, ecx
and eax, 1
pop ebx
pop ebp
ret

Function at 0x6d04a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6d04cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6d04cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x7173d9
Capabilities:
Encode data using xor

Disassembly:
not bp
mov ebp, dword [esp + 0x2c]
pushfd
push 0x2ba779ac
mov byte [esp + 8], al
lea ebp, [ebp + 1]
pushfd
push esp
mov dword [esp + 0x3c], ebp
lea ebp, [edx + 0x1dd9444a]
movsx ebp, dl
call fcn.0073ff73
Function at 0x7178dc
Capabilities:
Check for software breakpoints

Disassembly:
lea edi, [edi - 0x3de67492]
lea esp, [esp + 0x50]
jae 0x74fe69
pushal
pushfd
push dword [esp + 8]
xchg dword [esp + 0x28], edi
mov byte [esp + 8], 0xc9
mov byte [esp], 0x7d
mov byte [esp + 8], 0x35
push dword [esp + 0x28]
ret 0x2c
jmp 0x7378c1
push dword [esp]
xchg dword [esp + 0x38], edi
push dword [esp]
mov edi, 0x666586
push edx
pushfd
pushfd
mov edi, dword [edi + 0xa8b9f]
pushfd
push ebp
jmp 0x6f8cdf
sbb al, 0x2f
je 0x74febb
sbb al, 0x9c
call fcn.00715657
mov bh, 0xf9
adc al, 0x67
imul dword [edx - 0x28f7d3f1]
movsb byte es:[edi], byte [esi]
push edi
in eax, 0x25
dec edx
or eax, 0xdd39a3b6
pop eax
jle 0x74fe4a
invalid
mov ebx, 0x442e6b5d
sbb al, 0xe8
imul ebx, dword [eax - 0x22], 0x29736166
js 0x74febb
xchg edx, esi
dec ecx
jno 0x74ff39
invalid
mov byte [0x1dc066da], al
add byte [ebx + 0x6b], al
pop edx
pop eax
jne 0x74ff1c
or cl, ch
add bh, byte [edx + 0xd]
nop
and dword [ecx], ebx
shl dword [ebx], cl
iretd
std
add al, 0x97
lcall 0x77dd, 0x151296fd
dec ebp
pop ecx
in al, 0x7d
or byte [esi - 0x68], bh
jg 0x74ff37
dec ebx
or esi, eax
in eax, 0x37
sub eax, 0xa36507b4
inc eax
pop es
mov esp, fs
mov ah, 7
mov dword gs:[0xe48c0740], eax
fldenv [edi]
push ebx
mov eax, eax
push ds
add dword [ecx - 0x15], 0x75
loope 0x74fed4
xchg edx, eax
xor eax, 0x61a7f137
scasb al, byte es:[edi]
jl 0x74ff2e
movsx ebx, byte [edx*8 + 0x67174ab4]
test byte [edx - 0x1f], dl
aas
mov dl, 0x92
test eax, 0xcabb0b39
js 0x74ffb6
arpl sp, si
fld dword [ebx + 0x1f]
sbb ch, byte [esp + ebp*4]
out dx, eax
or dword [ecx - 0xc2a05aa], esi
mov ecx, esp
sal esi, 1
dec esp
cli
xchg edx, eax
push edi
push eax
cmc
invalid
or eax, 0xd20fd346
js 0x74ffe3
ret
xor byte [edx - 0x2ac0d30], bh
aaa
insb byte es:[edi], dx
in al, 0xf2
push ecx
dec ecx
clc
push ebx
push esp
jne 0x75003f
mov ebp, 0x31c7c9cf
mov edi, 0xf5b2eff3
loope 0x75001a
invalid
inc esi
je 0x74fff7
dec esp
les edi, [ecx + 0x19299d29]
sub eax, 0xfd642123
adc esi, 0xf14bf0d5
salc
aad 0xf0
dec ebx
int1
lodsb al, byte [esi]
sbb esi, dword [ecx - 0x11]
leave
hlt
or eax, 0x448b3178
and al, 0x50
call fcn.0074f7c4
inc ebx
mov bl, 0xd6
das
jbe 0x75009d
inc esp
sbb dword [eax + 0x10], eax
inc edx
dec edx
jg 0x75009b
pushal
loopne 0x750010
add edx, dword [edx + 0x6ae7f84c]
xchg ecx, eax
push 0xffffffffffffff91
sub byte [edi], dh
nop
mov edi, edi
or ebp, dword [ecx + 4]
inc edx
cld
daa
push esp
jl 0x7500f0
and byte [0xc0757651], cl
int1
imul edi, dword [eax - 0x7dbad43e], 2
inc ebp
mov al, 0xbd
mov esp, 0x9dd567d
clc
scasd eax, dword es:[edi]
push ecx
jl 0x750062
out 4, eax
xchg esi, eax
xor ch, byte [0x380ead5d]
dec edi
out dx, eax
daa
lahf
fdivrp st(0)
pop edi
js 0x75006f
sbb eax, dword [ebx + 3]
mov ch, 0x13
and al, 0x57
xchg esp, eax
nop
sahf
sub bl, byte es:[edx]
and dword [esi], esp
cli
psrld mm6, qword [edi - 0xd]
or al, 0xfb
xchg edx, ebx
aad 0xc2
shr dword [ebx], cl
push ss
xchg byte [ebx + 0x57], ah
Function at 0x724960
Capabilities:
Packed with generic packer

Disassembly:
call 0x539618f6
mul dword [eax + 0x6a291b69]
mov ebp, dword ds:[esi + 0x1cbeec1d]
cmp edi, dword [ecx]
jp 0x7135c0
sbb al, 0x3b
cmp dword [edx + 0x54], edi
xor byte [ebx + 0x10], al
jle 0x713556
add dl, dh
in al, 0x26
adc ah, byte [ebp + 0x348afec2]
std
inc edi
jo 0x7135e3
in eax, dx
inc ebp
jg 0x7135c5
pop esi
add byte [edx - 0x75], dl
mov dword [0x47e2a9e], eax
rol byte [ebx - 0x5eae2e5d], 0x29
rol byte [edi - 0x6ab34532], 1
cmp byte [ebp - 0x626275ce], cl
pop es
mov edi, 0x736f93cd
adc al, byte [edx + ebp*8 - 0x1d]
mov ebp, 0x84be2f89
ret 0x1ed7
jecxz 0x713567
mov dword [edi], ebp
mov esi, 0x1ed7c284
inc eax
adc eax, 0xb7be69de
arpl di, sp
jecxz 0x7135d0
mov bl, 0xbb
and al, 4
sal byte [eax + ecx*8], 0x61
popal
je 0x7135f6
add al, 0x9c
add cl, ch
mov edi, 0x51fffdcf
push ecx
call fcn.00722a39
or al, cl
clc
push ebx
call eax
clc
mov ebx, 0xa1f8855a
push 0x77
pop ebp
out 0xf5, eax
sbb dh, byte [ecx + 0x11]
dec esp
and dword [edx + 0x3e63de68], 2
push es
xchg dh, ch
jno 0x7135a8
sub al, 0x60
jecxz 0x71364f
call dword [edi - 0x76c27aaa]
mov ch, 0xc2
fimul dword [eax]
rol byte [ecx - 0xc], 0xe9
or al, 0xce
pushfd
ret
in eax, dx
sbb al, 0xc5
lodsd eax, dword ss:[esi]
and byte [edi], ch
push esp
call 0x199eaa54
pop esi
add eax, 0xc2f8e180
xlatb
sbb eax, 0x1c4654c0
mov word [esp], bp
mov byte [esp + 8], 0x1a
pushfd
mov eax, dword [eax + 0x90266]
jmp 0x7413e5
lea esp, [esp + 0x4c]
ja 0x7135e9
lea eax, [eax + 0x18b5b4a8]
pushfd
call fcn.0074b235
sbb al, 0x85
fidiv dword [0x2ba4908d]
lea ebx, [esi + 0x56]
ret

Function at 0x73e395
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov byte [esp], 0xe4
mov byte [esp + 4], 0xbc
lea edi, [edi + 0x4d364f1d]
pushfd
xchg dword [esp + 0x14], edi
pushal
push dword [esp + 0x34]
ret 0x38
push 0x6b0919fd
lea edi, [edi + 1]
push dword [esp]
lea esp, [esp + 0x30]
jae 0x71543d
push ebx
mov dword [esp + 8], edi
pushfd
movsx edi, cl
mov word [esp + 4], 0x5a87
mov edi, 0x67c05a
pushfd
mov edi, dword [edi + 0xd018f]
jmp 0x6f987d
jmp 0x735f99
pushfd
mov dword [esp + 8], edi
push 0xf95f0d70
call fcn.0073400f
dec ebx
lodsb al, byte [esi]
rcr edi, 4
movsb byte es:[edi], byte [esi]
mov edx, 0xb5563d9f
xchg ecx, eax
mov al, 0xdc
xor byte [0x543afa23], bl
push esp
stosb byte es:[edi], al
cmpsd dword [esi], dword es:[edi]
out dx, al
invalid
pushal
mov dword [esp + 0x28], edi
not di
not di
pop edi
bswap di
mov edi, dword [esp + 0x28]
push esp
jmp 0x6ff0ed
Function at 0x740bcc
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
mov ebp, 0x601a0cd1
mov bp, word [esp]
mov ebp, dword [esp + 0x24]
pushfd
pushfd
xchg dword [esp + 0x30], ebp
push dword [esp]
xchg dword [esp + 0x30], ebp
lea ebp, [esi + 0x1de8cc67]
call fcn.00750c3c
xor al, 0x6d
invalid
in al, 0x53
lodsd eax, dword [esi]
stc
jnp 0x740bd7
sal dword [ebx + ecx*2 + 6], cl
add esi, eax
jbe 0x740b78
insb byte es:[edi], dx
push eax
and dword [ecx - 0x6d], 0x6c
fimul dword [ebx - 0x69950701]
push ds
cmc
test al, 0x2a
popal
cmp dword [ecx], ebp
push ebp
invalid
inc ebx
xchg ebx, eax
js 0x740b69
shl byte [eax], cl
push esp
or dword [edi + 0x61], esp
and al, 0x34
mov bp, 0x317d
pushal
nop
lea esp, [esp + 0x20]
jle 0x6fa45c
mov es, word [eax - 0x72000468]
sub al, 0x95
lahf
outsb dx, byte cs:[esi]
neg dword [ebp - 0x18]
mov dl, 0x25
invalid
lea ebp, [edx*4 - 0x891d161]
pop ebp
call fcn.0073319b
mov byte [esi + ebp*4], dl
outsd dx, dword [esi]
sbb ch, byte [esi + edi*4]
fsubr st(3)
test al, 0xbb
loope 0x740bc5
xor cl, byte [edi - 0x2cc508ee]
test al, 0x2a
imul edi, dword [ecx + ecx*8], 0xffffffdc
and bh, byte [ebx + 0x4d84520d]
nop
jge 0x740c6b
inc edx
jb 0x740bf6
test byte [ebp + 0x6c], cl
mov ch, 0xae
fcmovu st(0), st(5)
jp 0x740ba3
sub ecx, dword [0x2d19a26a]
pop ecx
adc eax, 0xf9a85b91
invalid
inc edx
pushfd
xchg byte [ecx], al
add eax, 0x6ff7e001
push ebp
or dword [edi + 0x75], 0x892a0370
loop 0x740ca3
ljmp 0x8cfa:0x5edc991d
xchg ecx, eax
les esp, [ebx]
dec eax
invalid

Function at 0x7413ac
Capabilities:
Packed with generic packer

Disassembly:
pushal
push dword [esp + 4]
push esi
mov eax, dword [eax + 0x32b17]
pushfd
call fcn.007382be
mov eax, 0x6be800
lea esp, [esp + 0x54]
jge 0x6f0499
push eax
mov eax, dword [eax + 0x32b17]
jmp 0x742e8a
pushfd
pushal
lea eax, [eax - 0x2f8be065]
push dword [esp]
xchg dword [esp + 0x2c], eax
push dword [esp]
push dword [esp + 4]
pushfd
push dword [esp + 0x38]
ret 0x3c

Function at 0x746f01
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x30
jae 0x746f3d
inc ebp
xchg esi, eax
sub ebx, dword [edi]
shl ebx, 1
stc
xchg ecx, eax
sar byte [eax + 0x5d91247a], cl
xchg ecx, eax
pop ebp
call 0xe949386e
jnp 0x746eec
hlt
mov dh, 0xa6
mov cl, 0x6f
outsd dx, dword [esi]
int3
call 0x73d965
inc edi
and eax, 0xc8b3d691
xchg esi, eax
xchg dword [ecx], edi
sbb dword [eax], edi
call 0xfebb6aff
loope 0x746ed8
adc byte [ebx], 0x2f
loopne 0x746ec8
push ebx
mov bh, byte [esi]
movsd dword es:[edi], dword [esi]
mov al, byte [0x13596fd5]
mov ah, 0x96
mov esp, 0xb27b9f9d
fisub word [ebx - 0x58]
popfd
pushal
sub byte [eax + esi - 0x13c03792], 0x84
mov al, 0xb0
mov ebx, dword [eax + 0x6fcd588]
outsd dx, dword [esi]
pop ecx
adc esi, dword [esi + edx*4 + 0x7b9f9dbc]
mov dl, 0xde
arpl word [eax - 0x537f9f63], bp
xor byte [esi - 0x38], ch
aas
in al, dx
test byte [eax - 0x77677450], dh
aad 0xfc
cwde
mov ch, dl
cld
push es
inc eax
xchg ah, dl
xchg byte [edx], ah
arpl word [ecx], bp
sub eax, 0x8a32b117
xlatb
std
push esp
xor edx, edi
jle 0x746f23
jp 0x746eef
mov bl, 0xe9
mov ebp, 0xa86ed680
ret 0x3412
Function at 0x74b58a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x75b546
pop esi
clc
out dx, eax
mov ch, 0xc2
rcr dword [esi - 0xf8d3bef], cl
stc
adc al, 0x74
sahf
pushfd
mov ebp, dword [ebp + 0xc7d17]
call fcn.006ec1e3
or esp, esp
sub byte [edx + 0x5a427327], bl
dec esp
movsb byte es:[edi], byte [esi]
cmp ecx, ebp
test byte [edi - 0x41b83dd7], 0x1e
inc ecx
mov bl, byte [0xce2001e8]
xchg edx, eax
push ebp
lds esi, [ecx + 0x11a4439]
fst qword [eax + 0x32]
or dword [edi + 0x31], edx
das
inc edx
jg 0x75b530
call 0xe4742292
cli
aaa
mov bh, 0xfa
in eax, 0x9a
out 0x9a, eax
out 0xd3, eax
cdq
outsb dx, byte [esi]
pop ecx
cmpsb byte [esi], byte es:[edi]
or byte [ebp + 0x3c], 0x36
cmpsb byte [esi], byte es:[edi]
imul edx, edx, 0x8b63301b
mov ah, 0x4c
cli
call 0xddcae1a4
movsd dword es:[edi], dword [esi]
shr dword [ecx - 0x3a], cl
jecxz 0x75b5a1
jmp [ebx]
push 0x760124b
mov al, byte [0x74d27bfd]
mov al, byte [0x6b5cac1b]
leave
js 0x75b615
and byte [ebp - 0x25], 0xe
mov eax, 0xbd8f3c9
xchg edx, ecx
jns 0x75b5e8
test ch, 0x8e
xchg edx, eax
mov ebp, 0xce90c11b
popfd
jns 0x75b607
xchg esp, eax
retf 0xa81f
sbb ecx, esi
fisub dword [edi + 0x7a]
scasb al, byte es:[edi]
jo 0x75b64c
or al, 0x5b
ret
xchg ebp, eax
and ah, al
div byte [esp + ebp*8 - 0x2d]
hlt
jnp 0x75b655
xor byte [ecx], cl
add al, ch
mov eax, 0xb99c9fe7
aam 0x3a
ret 0x2d99
cdq
sub eax, 0x54bcd398
rol bl, 0x5e
jmp 0x75b5dd
insd dword es:[edi], dx
invalid
xchg edi, eax
sti
mov al, byte [0x9a3528fd]
dec eax
adc ebp, dword [edx - 0x603f324a]
sti
push ds
cld
xchg byte [ebp - 0x6b6910a1], dh
stosb byte es:[edi], al
mov dh, 0xcd
rcr byte [edi - 0x7903e105], 0xb5
pop edi
out dx, eax
xchg esi, eax
xchg esp, eax
outsb dx, byte [esi]
out dx, eax
jae 0x75b636
xor ah, bl
mov dword [esi], ecx
inc edx
invalid

Function at 0x759448
Capabilities:
Packed with generic packer

Disassembly:
mov dword [0x17e8fff6], eax
invalid
movzx dx, dl
mov edx, 0x66abc7
mov byte [esp], 0xa4
mov word [esp], ax
mov edx, dword [edx + 0x83bde]
push eax
call fcn.00727d20
mov cl, 0xf
and eax, 0x3d077e42
movsd dword es:[edi], dword fs:[esi]
fisttp qword [ecx - 3]
or eax, 0x93491032
mov edi, 0xe52d261e
out dx, al
test byte [ebx - 0x7c], 0x5e
pop ecx
mov ah, 0xc
add byte [edi - 9], 2
mov ebx, edi
sub byte [ebx + 0x61f52cfd], ah
clc
xchg esp, eax
and byte [eax + 5], al
inc esp
add edx, edi
jb 0x6f8891
cmc
outsb dx, byte [esi]
sbb byte [ecx - 0x11], dh
xlatb
inc ebx
outsd dx, dword [esi]
jnp 0x6f87c3
push esi
jle 0x6f8881
jb 0x6f88b8
les ecx, [ebx]
and dl, cl
in al, 0xc2
aad 0xa3
in al, dx
rol dword [edi - 3], 0xc6
add al, 0x24
std
mov byte [esp], 0x8e
mov dword [esp], 0x34c837d7
jmp 0x6edb7f
enter 0xffffffffffffe934, 0x22
push ebx
invalid
enter 0xf1f, 0xffffffffffffff8e
test ebp, edi
add al, byte [eax]
pushal
mov dword [esp + 0x1c], 0x5cb847e
pushal
lea esp, [esp + 0x3c]
jmp fcn.006617b4
add eax, 0x24648d60
cmp al, 0xe9
sbb byte [edi - 0x6363000a], cl
jp 0x6f8856
out dx, al
add dl, byte [ecx + 0x52]
invalid
mov dword [esp + 8], edx
sete dl
jmp 0x6f87dd
Function at 0x76a892
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x30]
je 0x76b845
test bl, 0x6c
call fcn.007738d5
add byte [eax], al
stc
call 0xbf539015
pop es
add dl, byte [edx - 0x1b]
salc
or bh, byte ss:[edi + edi*2 + 0x407d49ee]
jg 0x76a8a2
dec ecx
jge 0x76a8f7
insd dword es:[edi], dx
cmc
add al, 0xa3
aaa
cmp al, 0x9b
xor byte [ecx - 0x652037cf], 0x94
xor edx, dword [edx + ebx]
jo 0x76a8b2
retf
push es
pop es
das
scasd eax, dword es:[edi]
test eax, 0x26921239
sub esp, dword [ebp + 0x48]
cwde
xor cl, cl
adc eax, 0x27873917
movsb byte es:[edi], byte [esi]
xchg edi, eax
inc esp
push 0xffffffffffffff9e
and dh, ah
int 0x85
and dword [ebx + 0xc], edx
or byte [esi + esi*8 + 0x78ea867], 0xd7
retf 0xb9ea
jo 0x76a8cb
jb 0x76a968
xlatb
mov word [eax], es
push ebp
mov dword [0xee29426], eax
mov word [esp + ebp - 0x5a], ds
retf 0xdf7a
loop 0x76a9cd
ret 0x82cc
dec esp
mov esp, 0xbc429120
or edx, 0xf1ddc7a2
push ds
and byte [ebx + 0x26], dl
wait
inc esi
jb 0x76aa0b
mov dh, 0x77
push cs
leave
invalid
adc dword [edx], ebp
adc dh, bh
xor ebx, dword [0x3201041]
mov word [ecx + 0x463fa33d], ds
movsd dword es:[edi], dword [esi]
sbb bh, byte [esi]
je 0x76aa6c
push 0x428b3be9
js 0x76aa07
jae 0x76aa1c
mov gs, word [esi]
cdq
test eax, 0x90cdfac2
ret 0x81cc
invalid

Function at 0x7706cc
Capabilities:
Encode data using xor

Disassembly:
call int.007637f8
or dword [ebx], eax
mov byte [0xf66d2196], al
cmc
stosb byte es:[edi], al
cmp eax, 0x2d2bd43
mov dh, 0xaa
pop ss
mov eax, 0x6f5969a6
invalid
ror al, 7
mov byte [esp + 0x10], dl
pushfd
push dword [esp + 8]
not al
stc
rol al, 6
clc
mov byte [ecx], al
bt sp, 0xe
clc
cmp cx, cx
cmc
add ecx, 1
mov word [esp], bp
bt ebp, edi
test ah, ah
jmp 0x76f352

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
mov ebx, 0x40915c
nop
nop
mov ecx, 0x42966a26
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x66059c8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10002de8
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x10002e2a
cmp dword [esp + 8], 0
je 0x10002e2a
cmp word [ecx], 0x5a4d
jne 0x10002e2a
mov eax, dword [ecx + 0x3c]
lea edx, [eax + 0xf8]
cmp edx, dword [esp + 8]
ja 0x10002e2a
add eax, ecx
cmp dword [eax], 0x4550
je 0x10002e26
mov ax, word [eax]
cmp ax, 0x454e
je 0x10002e26
cmp ax, 0x454c
jne 0x10002e2a
push 1
pop eax
ret
xor eax, eax
ret