joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2f60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4a2f7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4a308f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4a2fb0
je 0x4a2ffc
sub ecx, 0x2b
je 0x4a2ff2
sub ecx, 4
je 0x4a2ff7
dec ecx
sub ecx, 0xa
jb 0x4a2fe1
jmp 0x4a2fff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4a2fc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4a2fd0
jmp 0x4a2fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4a2fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4a2fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4a2fff
mov byte [eax], 0x3e
jmp 0x4a2fff
mov byte [eax], 0x3f
jmp 0x4a2fff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4a2f8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x4a304f
cmp byte [esp + 3], 0xff
jne 0x4a304f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4a3087
cmp dl, 0xff
je 0x4a3087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4a2f88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x4a311c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x5627a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x4a3138
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a313a
shr eax, 1
dec edx
jne 0x4a312b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4a3124
pop ebx
ret
Function at 0x4a3150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4a3159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0049aa38
xor eax, eax
push ebp
push 0x4a3239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004a311c
mov eax, dword [0x561e0c]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.00498e7c
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.00499218
call fcn.00498ba8
test eax, eax
jne 0x4a3216
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.00498fcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x4a3210
lea eax, [ebp - 0x10145]
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x5627a0]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x4a31ec
cmp dword [ebp - 8], 0
jne 0x4a31c3
lea eax, [ebp - 0x154]
call fcn.00498fec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3240
lea eax, [ebp - 4]
call fcn.0049a588
ret

Function at 0x4ae718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4ae738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4ae726
pop edi
pop esi
pop ebx
ret
Function at 0x4b6fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x562cb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + 0x557670]
mov eax, dword [esi*4 + 0x5576b0]
xor eax, dword [esp]
call fcn.004b6f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.004b6fac
mov dword [ebx], eax
mov edx, dword [esi*4 + 0x557680]
mov eax, dword [esi*4 + 0x5576c0]
xor eax, dword [esp]
call fcn.004b6f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.004b6fac
mov dword [ebx + 0x1000], eax
mov edx, dword [esi*4 + 0x557690]
mov eax, dword [esi*4 + 0x5576d0]
xor eax, dword [esp]
call fcn.004b6f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.004b6fac
mov dword [ebx + 0x2000], eax
mov edx, dword [esi*4 + 0x5576a0]
mov eax, dword [esi*4 + 0x5576e0]
xor eax, dword [esp]
call fcn.004b6f70
mov edi, eax
mov eax, edi
call fcn.004b6fac
mov dword [ebx + 0x3000], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x4b6fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b7138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x4b716d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x4b7193
inc ebx
cmp ebx, 0xf
jne 0x4b717d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x4b714f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c0ee0
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], 0x100
mov esi, 0x55c0f4
mov ebx, 0x566ce4
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.004bfe30
mov dword [esp + 8], eax
mov eax, edi
call fcn.004bfe40
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.004bfe30
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.004bfe40
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x4c0ef9
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5bb432
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
bt esi, edi
add eax, 2
pushal
test cx, cx
jmp 0x63b36d
lea esp, [esp + 0x24]
jne 0x7b71c4
btc di, sp
add di, bx
sub eax, edx
add dx, di
cmc
xor edi, 0xce1116aa
ror di, cl
sar eax, 1
jmp 0x73bc64

Function at 0x5c65cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x64df18
pushfd
dec eax
cmc
stc
add ecx, 0xc
sub esp, 0xffffffbc
jge 0x65988a
stc
clc
test sp, si
cmp edx, eax
pushal
push dword [esp + 4]
push 0x6bf59c32
jmp 0x6ec15f
clc
jmp 0x6ca293

Function at 0x60a37a
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea ebp, [ebp + 1]
lea esp, [esp + 0x2c]
jp 0x74c1a2
pushfd
mov dword [esp + 8], ebp
jmp 0x66766d
mov dword [esp + 8], ebp
mov word [esp], 0xcce2
pushal
mov ebp, 0x478440
pushal
pushfd
mov byte [esp], bh
mov ebp, dword [ebp + 0x32a7cf]
pushfd
mov byte [esp], dl
pushfd
lea ebp, [ebp + 0xf0321a9]
jmp 0x784dbf
push esi
mov ebp, 0x478440
pushfd
lea esp, [esp + 0xc]
jl 0x74cb7f
pushfd
mov ebp, dword [ebp + 0x32a7cf]
mov byte [esp], 9
lea ebp, [ebp + 0xf0321a9]
push dword [esp]
lea esp, [esp + 8]
jl 0x699c0e
xchg dword [esp], ebp
pushal
push dword [esp + 0x20]
ret 0x24
jmp 0x6cd365
pushal
mov word [esp], bx
xchg dword [esp + 0x20], ebp
push 0xccd7483d
pushal
pushfd
mov byte [esp + 8], bh
push dword [esp + 0x48]
ret 0x4c
mov byte [esp], 0xf1
xchg dword [esp + 0x50], ebp
mov dword [esp + 4], 0xfc15141f
mov byte [esp], dh
push dword [esp + 0x50]
ret 0x54
pushfd
jmp 0x6313d7
xor al, 0xe9
cmp dword [ecx + 0x4c6ffe3], esi
and al, 0x8f
pushal
mov byte [esp], bh
push dword [esp]
mov ebp, dword [ebp + 0x32a7cf]
pushal
mov byte [esp + 0x1c], bh
call fcn.006c9417
mov ah, 0xd8
nop
cmp edx, dword [ebp + ebp*8 + 0x79c6bfce]
nop
imul edi, dword [edi - 0x6f], 0x71
in al, dx
or al, 0xb1
nop
test bh, 0x13
xor eax, ebx
popal
jne 0x74cb44
inc esi
jmp 0x57aaaf3e
jmp 0x742571

Function at 0x60cf34
Capabilities:
Encode data using xor

Disassembly:
lea eax, [eax - 0x6b6d36f7]
call fcn.0073d7e9
stosb byte es:[edi], al
dec edx
xor dword [ebx + 0x4a], eax
mov esp, 0xc9638678
mov byte [ebp + 0x27b3d664], bl
push es
test al, 0x22
outsb dx, byte [esi]
dec edi
lds edx, [edi + 0x1d]
jo 0x60cf7b
mov eax, 0x38c4fb21
sbb eax, dword [edx + 0x29]
push edx
aad 0x39
xor dl, byte [ebx + 0x5a]
dec ebx
push ebx
dec edi
test dword [edi], 0xdbc109e5
mov word [ecx - 0x3b], es
xor ecx, dword [ecx - 0x365e49a]
into
das
arpl word [edx - 0x52658f6e], ax
dec ecx
pop ecx
pop ds
or esi, dword [ecx - 0x74be3b29]
in al, 0x60
outsb dx, byte [esi]
push cs
ja 0x60d00f
jg 0x60cf3f
nop
ret
nop
or byte [edx - 0x6e1b9478], dl
or eax, 0x26203874
fidiv dword [esi + 0x7c]
invalid

Function at 0x635b8a
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp + 8], bh
lea edx, [edx - 0x5a1f7af4]
call fcn.00744f02
pushfd
mov dword [esp + 0x18], edx
setp dh
mov edx, 0x49638a
mov byte [esp + 8], bh
mov edx, dword [edx + 0x106a21]
jmp 0x5c1ab8
Function at 0x66a126
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edx + 0x37181e]
call fcn.0066b8f3
insd dword es:[edi], dx
mov ah, 0x6f
xor byte [edx + 0x226a9b76], dh
inc edi
mov ah, 0x7b
mov ecx, dword [eax]
sal byte [0x6f36a666], cl
jbe 0x66a128
push ds
sbb byte [edi], dh
add al, ch
ret 0x17
add edx, esp
inc eax
mov ch, 0xef
pop edi
inc esi
adc dword [edx], ecx
mov dh, 0x67
cmp eax, 0x83ceb32f
mov eax, 0xac6514dd
dec edi
dec ebp
fsubr qword [ecx - 0x1b]
or esp, dword [ecx]
ret 0x8d66

Function at 0x685b8f
Capabilities:
Packed with generic packer

Disassembly:
push dword [esp]
pushal
mov byte [esp], bh
mov dword [esp + 0x24], ecx
seto ch
pushal
mov ecx, 0x4805d4
mov byte [esp], dh
call fcn.006a898c
xchg dword [esp + 4], ecx
jmp 0x60a35e

Function at 0x692a65
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [esp + 8]
not di
jmp 0x772e97
lea edi, [eax*4 + 0x8fffd05]
xchg di, bp
jmp 0x688e2b

Function at 0x6a531c
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov byte [esp], al
jmp fcn.006734e2
not ax
mov eax, dword [esp + 4]
push edi
push ecx
push dword [esp + 4]
push esi
xchg dword [esp + 0x18], eax
lea esp, [esp + 0x18]
je 0x6308e8
pushfd
push 0xb5a2f8d9
mov dword [esp + 4], eax
pop eax
bswap ax
cwde
setae al
mov eax, 0x42fec8
push 0x39646ea2
mov eax, dword [eax + 0x1c9035]
pushal
push ebx
lea eax, [eax - 0x3a44358f]
call fcn.007419e8

Function at 0x6d9d64
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jae 0x6ec169
shrd ax, ax, 0xe
cwde
bsr ax, di
lea ecx, [edi + edi*2]
inc ah
movsx eax, al
add ecx, ecx
mov di, ax
add ecx, ecx

Function at 0x7013b2
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [ebp + 8], ebx
push esi
push edx
call fcn.006c6256
mov edx, 0xc3daa198
cmp ebx, dword [ebx + 0x77b6e03e]
push edi
mov dword [0x6a9bb7f6], eax
inc esp
or edi, ebp
inc ecx
lodsb al, byte [esi]
test dword [ebp + 7], ebx
ja 0x61b433
movsd dword es:[edi], dword [esi]
jl 0x61b459
lodsb al, byte [esi]
add eax, 0x28c814f4
int 0xbd
xchg byte [ecx], ch
into
stc
invalid
and esi, ebp
sub al, 0xce
mov bh, 0x7f
cmpsb byte [esi], byte es:[edi]
mov byte [eax + esi*2 - 0x7f], dh
cmp ebp, dword [eax + 0x5a72051d]
loope 0x61b45a
dec ax
push 0xf7b74452
dec eax
mov dh, 0x91
jg 0x61b444
fmul qword [ebx + 0x35]
mov esi, 0x89ede60a
mov dword [esi], edx
push ss
add byte [ebx - 0x1562eab3], 0x6a
xor eax, 0xcfc0e6c
dec eax
mov eax, dword [0x30eaf202]
push cs
mov al, 0x20
cmp eax, 0xbf673f23
xor al, 0xd9
push ebx
clc
inc ebx
invalid
jmp 0x61b3d2

Function at 0x742279
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 4], bp
insb byte es:[edi], dx
and al, 4
call fcn.007b6cd9
xor ebx, dword [ebp - 0x70abb043]
add byte [eax], al
in eax, dx
test byte [ebx + 0x6f31fa97], 0xf3
mov ebp, 0x7b069b67
test al, 0x80
jecxz 0x74227b
xchg byte [ecx - 0x64f79b02], al
stosd dword es:[edi], eax
idiv esi
invalid
Function at 0x761185
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
pop esi
push eax
push ecx
call fcn.006a26fb
bswap esi
not si
mov eax, dword [eax + 0x1e1957]
bswap si
lea eax, [eax + 0x33768468]
call fcn.005d3d03
push esi
nop
push ebp
mov word [esp + 4], 0xe58e
xchg dword [esp + 8], esi
pushfd
mov word [esp], cx
mov dword [esp + 8], esi
movsx si, bl
lea esp, [esp + 8]
js 0x64c751
movsx si, cl
push eax
jo 0x7d8523
mov eax, 0x41e80c
jge 0x65da7f
bswap si
movzx si, bl
mov eax, dword [eax + 0x1e1957]
mov si, 0x92e5
movzx si, dl
mov si, si
mov si, si
movzx si, al
lea eax, [eax + 0x33768468]
call fcn.00608c51
lcall 0xc58d, 0x18044c90
lds ebx, [ebx + 0x7d008fc0]
add edx, ebx
ror dword [edx], 1
mov dh, 0xde
push es
cld
and al, 0xfd
std
fld st(4)
rcl byte [edx + edi*4]
invalid
adc al, 0xba
loopne 0x7611ff
sub al, 0xb3
jo 0x76124b
and edx, esi
adc edi, ebp
adc eax, 0x5bb85a6c
dec ebp
into
cwde
lcall 0x90f5, 0xf4a23dba
jnp 0x7611d4
int1
sbb eax, 0x24c06969
jg 0x761201
push eax
or esp, dword [eax]
inc edx
nop
xor esp, dword [esi]
cmp bl, byte [edi]
stc
loop 0x761229
jp 0x7611d5
pop ecx
mov bh, 0xb1
in al, 0x3a
fimul dword [edi]
jb 0x761203
adc dword [ebx], ecx
mov dword [ebx], ebx
inc ecx
sbb dword [eax + 0x26170922], esi
fnsave dword [edx + 0x51]
pop ss
fnsave dword es:[edx + 0x51]
sahf
inc ebp
outsd dx, dword [esi]
add dword [edi + 0x3bd6918c], ecx
dec eax
invalid
mov si, di
mov eax, 0x41e80c
movzx esi, bl
mov eax, dword [eax + 0x1e1957]
movsx esi, cl
lea eax, [eax + 0x33768468]
bswap si
pushal
not si
pop esi
mov esi, eax
setl al
push dword [esp]
mov eax, dword [esp + 0x20]
pushal
mov byte [esp + 8], 0x90
push dword [esp + 0x44]
ret 0x48

Function at 0x76d68f
Capabilities:
Encode data using xor

Disassembly:
sets dh
mov dh, byte [esp]
not dh
nop
call fcn.006816fe

Function at 0x77efc5
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
cmp edi, eax
pushfd
mov byte [esp], ah
pushal
lea esp, [esp + 0x24]
jae 0x6ec172
movzx dx, bl
pushfd
dec eax
movzx dx, bl
mov edx, edi
bt dx, 8
clc
cmp edi, eax
mov dword [esp], 0xe34b2e9b
pushal
lea esp, [esp + 0x24]
jae 0x6ec169
movsx ax, cl
bswap eax
aad 0x71
and ah, cl
lea ecx, [edi + edi*2]
bswap eax
add di, 0xc947
cmc
add ecx, ecx
bts eax, edi
daa
shl ah, cl
add ecx, ecx
cmp esp, eax
add di, di
mov eax, dword [esi + 0x20]
cmc
movsx di, al
clc
call fcn.00668cdb
pushal
mov dword [esp + 0x40], 0x92577f00
mov byte [esp], 0x73
pushfd
mov byte [esp + 0x14], 0x68
lea esp, [esp + 0x44]
jmp fcn.00587c83
call fcn.0060cefb
bswap ax
mov eax, dword [esi + 0x28]
jmp 0x76a9a7
Function at 0x78eb22
Capabilities:
Encode data using xor

Disassembly:
call fcn.007cfe95
imul ebp, esi, 0x75
push 0x31
mov eax, 0x796cd4da
jne 0x5e25dd
xor dword [eax + 0x796cd4da], edi
sbb dl, byte [ecx - 0x458d9d54]
push 0xc7531bc0
adc dword [ebx], edx
adc eax, 0x67c35a07
sti
cli
imul esp, dword [ebx - 2], 0x19
ror dword [edi + 0x77eafe15], 0xd8
das
mov ch, 0x5b
dec byte [ebx + ecx*4 + 0x60]
mov dh, 0x8e
outsd dx, dword [esi]
mov ah, 0xeb
jl 0x5e2571
out 0x6c, al
frstor dword [ebp - 0x1e]
push es
or ch, byte [ebp + 0x4c98d410]
and byte [ebx], dl
push ds
je 0x5e25ce
mov esp, 0xbb55d610
mov ch, 0x6f
adc eax, 0x57d7b77b
add cl, byte [edx - 0x81096c6]
das
mov dl, 0xc3
inc edi
or al, byte [esi + 0x75466324]
je 0x5e25fb
outsb dx, byte [esi]
adc dword [ebp - 0x256a45b8], ebp
sub al, 0x56
xchg ebp, eax
fisubr dword [esi + edx*2]
dec esi
lea eax, [edi]
invalid
invalid
lea edx, [edx + 0x425e06cc]
pushfd
push ecx
lea esp, [esp + 0x50]
ja 0x5e256a
pushal
xchg dword [esp + 0x20], edx
pushfd
push dword [esp + 0x24]
ret 0x28

Function at 0x7bc1e0
Capabilities:
Encode data using xor

Disassembly:
pushal
mov dword [esp], edx
mov dword [esp + 0x3c], eax
pop eax
movsx eax, al
mov al, 0xee
call fcn.0064c8ab
pushfd
lea eax, [eax + 1]
jmp 0x73cff4

Function at 0x7d2e15
Capabilities:
Packed with generic packer

Disassembly:
pushfd
call fcn.0066a3c8
mov word [esp], 0xf502
lea eax, [eax - 0x57ba1e89]
jmp 0x60a358

Function at 0x7da18c
Capabilities:
Encode data using xor

Disassembly:
pushfd
call fcn.0073aa4f
sbb dword [ecx], 0x15
enter 0x106b, 0x2f
fcmovnbe st(0), st(2)
js 0x779248
mov ch, 0xd1
sbb byte [esi - 0x27], 0xb5
pushal
cmp eax, esp
mov byte [0x10f3e66a], al
scasb al, byte es:[edi]
dec esi
xlatb
je 0x779234
stosb byte es:[edi], al
int3
rcl dword [esi - 0x3f], cl
add eax, 0x223a90b
and eax, 0x6ef80147
inc esi
sbb eax, 0x315446ff
test al, 0x67
inc esi
inc esi
lahf
xor byte [ebp + 0x5cefb536], 0x38
or byte [ecx - 0x67a0d590], ch
mov ch, 0x36
mov ch, 0xef
pop esp
cmp byte [eax], cl
test eax, 0x985f2a70
xor al, 0x31
xor ch, byte [ebx + ebp + 0x788891d7]
push esp
or eax, dword [ecx - 0x73]
inc ebp
loope 0x77924c
push edx
lodsb al, byte [esi]
jmp fcn.007791f5
push dword [esp + 4]
lea esp, [esp + 0x50]
jge 0x779203
lea ebp, [ebp + 0x687b0769]
pushal
mov byte [esp], 0xd6

Function at 0x7dd32d
Capabilities:
Encode data using xor

Disassembly:
push ecx
call fcn.005a12f3
bswap ax
btc ax, 5
bswap ax
push ebp
btc ax, 1
mov bp, 0xebd4
clc
mov ebp, esp
pushfd
cwde
call fcn.005d522d
not bp
mov ebp, 0x41b619
mov byte [esp + 8], bl
mov dword [esp + 4], 0xe219a28e
lea esp, [esp + 0x34]
jp 0x68d1ed
mov ebp, dword [ebp + 0x2be03d]
call fcn.00705807
mov dword [0x6ea75f0], eax
mov esp, 0xfb8ec9cb
invalid
Function at 0x100113e
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ax, word [esi]
cmp ax, 0x22
push 2
pop ecx
jne 0x1001171
add esi, ecx
mov ax, word [esi]
test ax, ax
je 0x1001169
cmp ax, 0x22
jne 0x1001159
cmp word [esi], 0x22
jne 0x1001189
jmp 0x1001187
cmp ax, 0x20
jbe 0x1001189
add esi, ecx
cmp word [esi], 0x20
ja 0x1001177
jmp 0x1001189
cmp ax, 0x20
ja 0x1001191
add esi, ecx
mov ax, word [esi]
test ax, ax
jne 0x1001181
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
je 0x10011ab
movzx eax, word [ebp - 0x14]
jmp 0x10011ae
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1cae708e
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x58466813
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0xf792915
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x732b231f
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x32423ffd
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x20944d73
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219