joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401c66
pop dword [ebp - 0x30]
mov eax, 0xa3df71ab
add eax, 0x5c60aabb
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xad8cc56c
add dword [ebp - 0x40], 0xa0c57fdf
mov dword [ebp - 0x3c], 0x430e1793
add dword [ebp - 0x3c], 0xef2534b2
mov dword [ebp - 0x38], 0x49131871
add dword [ebp - 0x38], 0x3392bbd
mov dword [ebp - 0x34], 0x34a2b3bb
add dword [ebp - 0x34], 0xcb5d4c45
lea eax, [ebp - 0x40]
push eax
mov eax, 0xae74de6d
sub eax, 0xae34ae19
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x85468832
add dword [ebp - 0x40], 0xef2be124
mov dword [ebp - 0x3c], 0x48b1053f
sub dword [ebp - 0x3c], 0x744a3ca
mov dword [ebp - 0x38], 0xf8d7f79b
sub dword [ebp - 0x38], 0x95688b2f
mov dword [ebp - 0x34], 0x1d5a06f1
sub dword [ebp - 0x34], 0x1d5a06f1
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x2fba5645
add eax, 0xd085d9e7
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x35702
push 0
call eax
mov ecx, 0x43d4
xor esi, esi
add esi, eax
mov edi, 0xf71cf58d
sub edi, 0xf6dc858d
add edi, dword [ebp - 0x30]
mov edx, 0x208b0675
add edx, 0x83373659
xor dword [ebp - 0x20], 0x82838274
mov ebx, dword [edi]
xor dword [ebp - 0xc], 0xb33799e9
add ebx, edx
add dword [ebp - 0x10], 0xd6a17b4
mov dword [esi], ebx
mov dword [ebp - 0x10], 0x1061bb7e
add esi, 0x82fca130
add esi, 0x7d035ed4
add edi, 4
loop 0x401d84
add eax, 0x473d908b
add eax, 0xb8c37198
xor ebx, ebx
add ebx, eax
add eax, 0x669a82a5
sub eax, 0x669a82a0
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1004b012
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1004b021
pop dword [ebp - 0x34]
mov eax, 0x19e77a00
sub eax, 0x9e2c9df
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x43734
push 0
mov eax, 0x629af264
add eax, 0xad6c0e88
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x4d95
xor edx, edx
add edx, eax
mov ebx, 0x10185c00
add ebx, dword [ebp - 0x34]
mov edi, 0xbdc373f2
xor dword [ebp - 0x2c], 0x651c9edc
mov esi, dword [ebx]
sub dword [ebp - 0x28], edx
xor esi, edi
mov dword [ebp - 0x1c], 0xf8f0c968
mov dword [edx], esi
xor dword [ebp - 0x18], 0x5de833ae
add edx, 0x2615ed18
add edx, 0xd9ea12ec
add ebx, 4
loop 0x1004b070
add eax, 0x15bafb78
sub eax, 0x15b9d251
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x100696fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x10069780
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1006974a
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1006974a
cmp edi, ebx
jge 0x1006974a
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1006977a
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1006977a
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x10069792
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x10069a28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x1016c088], al
je 0x10069a5f
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10069ac3
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1004b012
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1004b012
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.1004b012
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e864
leave
ret 0x10
Function at 0x10069ad4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10069b00
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10069b31
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10069b2f
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1004b012
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10069b31
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006e864
leave
ret 8

Function at 0x10069bcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
mov eax, dword [ebp + 8]
je 0x10069bf4
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10069c0e
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1004b012
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1006e864
leave
ret 4

Function at 0x1006e864
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100b1980]
jne 0x1006e86e
repz ret
jmp fcn.1006ef63
Function at 0x5e945c
Capabilities:
Packed with generic packer

Disassembly:
push 0xf99a0d97
mov dword [esp + 8], 0xec86335e
mov word [esp + 4], sp
pushal
lea esp, [esp + 0x28]
jmp loc.0041c59c

Function at 0x6f1d91
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec bx
movzx bx, dl
dec dword [esi + 0x28]
rdtsc
mov byte [ebp - 1], 1
setne ch
rdtsc
movsx bx, cl
mov ebx, dword [esp + 4]
lea eax, [edi*4 - 0x6d0509da]
jmp 0x852a4a
pushal
mov dword [esp + 0x40], 0xecaec58e
push ebp
push dword [esp + 0x10]
lea esp, [esp + 0x48]
jmp loc.0041d0a0
pop edx
mov edx, dword [esi]
bswap eax
mov eax, dword [edx + 8]
bswap cx
not ch
pop ecx
push 0xaec1e905
mov ecx, esi
call fcn.0076b6fc
pushal
mov dword [esp], 0x16b342a0
mov dword [esp + 0x1c], 0xbf625ba6
pushfd
pushfd
jmp 0x791da2
Function at 0x6f506f
Capabilities:
Packed with generic packer

Disassembly:
stc
cmp dx, bx
mov word [esp], 0x315d
jmp 0x71765c
push ebx
stc
mov dword [esp], esi
lea esi, [esp - 0x2c86e4b7]
sbb esi, 0x9b347b81
sub si, 0xa4b9
and si, 0x66fc
lea esi, [eax + ecx - 1]
push 0x4a9f9a1f
cmp ecx, esi
pushal
jmp 0x6efd15
pushal
lea esp, [esp + 0x44]
jg 0x8e15a9
shr eax, 1
daa
rdtsc
lea eax, [esi + ecx]
not edx
not edx
clc
clc
cdq
clc
clc
bt bx, sp
push 0x8541fec2
sub eax, edx
jmp 0x8b3feb
mov si, 0xef8d
call fcn.006fa396
xchg al, cl
neg ch
push ebp
aam 0x70
btr ax, sp
btr ax, 9
daa
mov ebp, esp
das
aad 3
das
movzx ecx, word [edi]
inc ah
movzx eax, word [edi + 2]
test bh, 0x15
pushfd
lea esp, [esp + 4]
je 0x5e85b2
push esi
sbb si, cx
not si
test ah, ch
lea esi, [eax + ecx - 1]
test al, 0xfb
pushfd
cmc
cmp ecx, esi
pushfd
jmp 0x85c3ef
pushfd
pushfd
lea esp, [esp + 0xc]
je 0x8f53bb
pushal
mov word [esp], ax
call fcn.0077839c
jmp 0x87142d
sar eax, 1
ror dl, cl
movzx edx, word [edi + eax*8 + 4]
bt di, 2
jmp 0x5e790d
push esi
pushfd
lea esp, [esp + 0x28]
je 0x8f53bb
pushfd
push dword [esp]
lea esp, [esp + 8]
jbe 0x786d8a
pushfd
lea esp, [esp + 4]
jge 0x6f01a7
pushfd
bswap si
lea esi, [eax - 1]
pushal
pushfd
mov byte [esp], ah
lea esp, [esp + 0x28]
jmp 0x8e1595
clc
shr ch, cl
pushal
call fcn.008e158f
sub eax, eax
pushfd
mov esi, dword [esp + 4]
lea ebp, [0x5de9f6dd]
mov ebp, dword [esp + 8]
push dword [esp + 8]
push dword [esp + 0x10]
ret 0x1c
lea esp, [esp + 8]
jg 0x8e15a9
bsr ax, dx
aas
sub ax, cx
clc
lea eax, [esi + ecx]
add dh, 0x29
btc dx, 6
cdq
clc
test dl, 0x1a
cmc
sub eax, edx
movsx dx, al
shl dh, 4
sar eax, 1
mov dx, bx
bsf dx, cx
movzx dx, bl
lea edx, [edi - 0x442e273e]
movzx edx, word [edi + eax*8 + 4]
stc
pushal
mov byte [esp], bl
cmp dx, bx
jmp 0x723ad0
pushfd
mov byte [esp + 0x10], 0x5d
mov dword [esp + 0x2c], 0x7d90ab
call fcn.0078dbd6
cmc
jmp 0x717b48
clc
pushal
pushfd
cmp ecx, esi
pushfd
mov word [esp], bp
lea esp, [esp + 0x28]
jle 0x85c3f9
jmp 0x7bf628
bts ecx, 5
jmp 0x917c45
fcmovnu st(0), st(2)
invalid
dec cl
movsx cx, bl
mov eax, dword [edi + eax*8 + 8]
lea ecx, [esi + 0x149f5b1]
mov ecx, eax
call fcn.008c796f
clc
and ebx, dword [ebp - 0x6e587178]
rol byte [ebx], 0x8f
mov cl, 0x99
push esp
call 0xf43d1f49
aad 0x9b
mov dh, 8
add dl, byte [ecx - 0x1c]
dec edx
or ah, bl
stc
and esi, esi
mov edi, 0xbf60ccbc
cdq
mov bh, 0x58
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
out dx, eax
sbb dword [ebx - 0x6dd054a8], esi
das
xchg edx, eax
pop ecx
fisttp dword [edi + edx*8 + 0x3c228a5f]
xor edi, esp
ror byte [bp + si + 0x5c], cl
jle 0x917cc0
xor byte [0xef661585], bl
loop 0x917c8c
pop edi
mov esp, 0xd40cfbd1
lds ecx, [edx + 0x1a9ade16]
jns 0x917c41
movsb byte es:[edi], byte [esi]
mov dword [ecx + 0x78c49f14], ebp
aam 0x9a
add dword [ebx - 0x50e605e3], 0xbafacefd
cli
sbb dword [edi - 0x45053103], ebp
in eax, 0x21
rcr byte [edx - 0x1b6f9a2b], 0x4f
jb 0x917ce2
invalid
pop ss
shr byte [edi + 0x3a], cl
adc ch, 4
hlt
Function at 0x721eb7
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0x8b76ee3c
mov word [esp], 0xd012
mov dword [esp + 0x20], 0xbf94517e
mov byte [esp], ah
push 0xf9d3d32e
mov dword [esp + 0x20], 0x18392fc1
mov word [esp], 0xa83f
lea esp, [esp + 0x20]
jmp loc.0041c59c

Function at 0x733d36
Capabilities:
Packed with generic packer

Disassembly:
lea edx, [ebx + eax]
test dx, ax
clc
call fcn.00864922
mov dword [esi], eax
jmp 0x74593a
mov byte [esp], 0xa8
push dword [esp + 4]
lea esp, [esp + 0x3c]
call fcn.005f2746
sbb dx, ax
shrd dx, si, cl
btc dx, 0xd
rcl dx, cl
mov dword [esi + 8], eax
dec dx
inc ax
setne ah
sub dh, 0xc0
mov eax, dword [ebp + 8]
jmp 0x6f5063

Function at 0x742501
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x1c], 0xbf25c756
push dword [esp]
push dword [esp + 0x10]
push dword [esp]
pushfd
mov dword [esp + 0x28], 0x16405e60
push ebp
push dword [esp + 0xc]
push ebp
push esp
lea esp, [esp + 0x38]
jmp fcn.0041c4eb
test edi, edi
push dword [esp]
call fcn.007c6478
bswap dx
mov ecx, dword [ebp + 0xc]
jg 0x91baa4
mov edx, dword [ebp + 8]
jle 0x74692c
mov eax, dword [edx + 0x3c]
pushfd
call fcn.00866382
not eax
pushfd
mov eax, dword [edx + 0x3c]
call int.008db378
pushal
jmp 0x72e593
seta dh
rdtsc
mov edx, dword [ebp + 8]
mov al, 0xdc
mov eax, dword [edx + 0x3c]
call fcn.0077ae77
sal byte [ebx], cl
dec ebx
jg 0x91bb05
mov fs, word [edi + 0x2fd0deaf]
mov dh, 0xf9
test eax, esi
push 0xe65e1362
adc dword [edx + eax*4 - 0x7e2a209b], edi
dec esi
add al, 0xa6
leave
jp 0x91bb47
bound edx, qword [ebx]
pop esi
out 0x11, al
mov esp, 0xd5df6582
or dword [esi + 4], 0x6f7ac9a6
mov ch, 0x52
adc dl, 0x25
sub eax, 0xc74f4765
pop eax
wait
sub dl, byte [ebx]
mov ebp, 0xd9557add
sub al, 0xb0
jmp 0x91bac7
pop ebx
invalid
cli
invalid

Function at 0x774efa
Capabilities:
Encode data using xor

Disassembly:
clc
popfd
adc dword es:[edx - 0x3c], ecx
pop dword [ecx]
mov bl, 0x65
sbb al, dh
mov edi, 0x6e3fea6e
rcl ecx, 1
push esp
in eax, 0xbb
add eax, 0xc531e91e
mov ecx, 0x8a9f02f3
jmp 0xf42c7bbe
mov cl, ch
push ebp
int 0x55
outsd dx, dword [esi]
mov edi, 0x34778cd6
xor dword [0x5c6c276], ecx
cli
dec esp
dec esi
fstp qword [esi + 0x520b2028]
jb 0x72b688
dec edi
or byte [0xe5a7060], cl
jnp 0x72b691
les ecx, [eax + 0x75b960ed]
push ebp
ror dl, cl
push edi
xor edi, dword fs:[edi]
movsd dword es:[edi], dword [esi]
popal
add eax, 0xf6a645aa
jb 0x72b690
jp 0x72b74a
call fcn.00882fbc
pop es
jo 0x72b670
dec edi
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
push esp
out dx, eax
mov byte [eax], al
pop ebx
invalid
inc ebp
jmp 0xd4dc8479
test bl, ah
test edi, edi
jmp 0x72b6e6

Function at 0x7892bd
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x7abcd0
mov dword [esp + 0x20], edi
call fcn.007d919b
in al, dx
lcall 0x6a7, 0xa54928a2
sbb byte [edx], 0xbf
loope 0x7abd64
sal edi, 0xde
outsb dx, byte [esi]
cdq
xor dword [edx + edi*4 - 0x8c0d267], edx
rcl byte [esi + ebx + 0x5c0ada87], 0x66
lodsd eax, dword [esi]
mov bh, 0xaa
xor eax, 0xac0a6d8e
or dword [ebp + ecx*4 + 0x70], ebx
inc ecx
jae 0x7abd20
das
aad 0xd8
pop esp
stosb byte es:[edi], al
invalid
shr bh, 1
invalid
xor dh, ah
leave
int3
Function at 0x7a41ac
Capabilities:
Packed with generic packer

Disassembly:
jecxz 0x7a40cc
enter 0xffffffffffff89ff, 0x44
and al, 0x30
ror byte [eax - 0x7cfbdba4], 1
out 0xf, eax
les ecx, [edx - 0xfe728b3]
out 0x5f, al
sub byte [0x63382e4f], ch
adc byte [esi - 0x27], ch
invalid
cmp byte [ebx + 0x10], ah
outsb dx, byte [esi]
fld st(7)
dec edx
out 0xb2, eax
jg 0x7a409b
mov cs, edx
mov ebp, 0x2fb9982d
bound ecx, qword [esi]
int 0x3a
cmp al, 0x7c
jne 0x7a4129
jmp 0x7a4178
setnp byte [ebp + 0x23f868a5]
push es
loope 0x7a4100
into
inc edx
bound eax, qword [edi - 0x686e7dd7]
xor eax, 0x50cd75c7
jne 0x7a410c
push eax
sbb dword [ebx + 0x1391175d], esp
in eax, 0x6e
dec ecx
sbb byte [ebx], 0x38
cmp al, dh
fild word [ecx + 0x59983d09]
outsb dx, byte [esi]
add dword [eax + 0x11], esp
int3
inc edi
or cl, byte [edi + 0x6165318b]
cmp al, dl
sbb ebx, dword [edi - 0x36]
lodsb al, byte [esi]
mov ecx, 0x61ad3cf9
lodsd eax, dword [esi]
popal
test al, 0x19
sar byte [edi + 0x3bfaa30f], cl
xchg edx, edi
push ebx
cmpsb byte [esi], byte es:[edi]
xchg esp, eax
pop eax
test dword [ecx + 0x3489c88f], edx
ja 0x7a41dc
fbld tbyte [ebp + 0x65]
jbe 0x7a4167
outsd dx, dword [esi]
aas
call fcn.0070207c
jo 0x7a413d
lodsd eax, dword [esi]
adc eax, esp
movsd dword es:[edi], dword [esi]
cmpsd dword [esi], dword es:[edi]
jg 0x7a4177
invalid
add esi, dword [ebx - 0x3b66d149]
not ch
and byte [eax - 0x6d59840d], ch
fucompi st(0)
jbe 0x7a41f8
sub al, 0x26
jbe 0x7a426f
sbb dword [esi - 0x2fbb75b4], ecx
mov cs, word [edx + ecx*4 + 0x44]
rcl byte [ecx - 0x6e]
push ecx
xchg edx, eax
shl ebx, 0x56
mov cl, byte [edx]
mov ecx, 0x65509765
and edx, dword es:[edi]
or byte [ebp + 0x21], dh
loop 0x7a41f3
xlatb
sal byte [ecx], 0xb5
adc al, 0x45
cdq
push ebp
mov dword [0xad68d93d], edi
inc edi
jno 0x7a425a
add edx, dword [ebp + 0x2c402f43]
mov dh, 1
dec ebx
ret
cmp ebx, edi
pop ds
bound ebx, qword [eax + 0x45]
xchg ebp, eax
adc edx, ebp
mov esi, 0xad90d71b
push 0x2e
xchg ebx, eax
out 0xd4, al
stc
or dword [eax - 0x17], esp
ja 0x7a429e
sbb byte [eax], al
pushal
push ecx
mov dword [esp + 0x2c], 0x8f0662
call fcn.007a4c46
Function at 0x7b2bc0
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jns 0x88340d
neg bl
and eax, 0x7fffffff
cmc
add eax, dword [esi + 0x2c]
movsx bx, dl
lea ebx, [ebp + 0x447ab514]
lea ebx, [eax*8 + 0x585e39a1]
mov ebx, eax
call fcn.006fa473
test dword [ecx - 0x5b25f34c], 0xefc486a7
fisttp dword [ecx - 0x4e50dca8]
pop esi
sar dword [0xb30efc5f], 0x1e
xchg esi, eax
loope 0x7b2c71
pop ebx
adc byte [ebx + 0x22], al
in eax, 0xc9
stosb byte es:[edi], al
adc ebx, dword [edx + 0x62]
mov dword [0x8b4dff74], eax
out 0xdb, al
invalid
pop edi
xchg ecx, eax
pushal
mov word [esp + 4], 0xba9e
push ebp
lea esp, [esp + 0x34]
jmp loc.0041bffb
pushfd
movzx ecx, word [edi + ebx*8 + 4]
push 0xacb7298c
lea edx, [edi + 0x49aaa0e2]
mov edx, dword [ebp + 0x10]
pushfd
call fcn.0070aa84
push esi
test eax, 0xa434487d
call dword [esi - 0x57]
jge 0x7bd1e3
xor al, 0xa4
cmpsd dword [esi], dword es:[edi]
out 0x15, al
js 0x7bd196
aaa
pop ss
lodsd eax, dword [esi]
cmp eax, 0x7ac974a8
pushfd
cmp dword [esp + edx + 0x40f5db47], edx
imul dl
mov ebp, 0x5c9e4745
invalid
mov dl, 0x71
das
in al, dx
mov eax, 0xa00baee1
in eax, dx
shl byte [edx], 1
lea ecx, [eax - 0x6f7edd7c]
enter 0xffffffffffffa45c, 0xfffffffffffffff7
in eax, 0xea
mov bl, 0x98
jno 0x7bd224
xchg edx, eax
in eax, dx
push edx
movsd dword es:[edi], dword [esi]
sbb eax, 0x66099e45
dec ebp
scasb al, byte es:[edi]
mov dl, 0x64
xchg edx, eax
in eax, dx
popal
cmc
mov eax, 0x9151446b
inc ebp
invalid

Function at 0x7c7673
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp], 0xccae
add ecx, 0xc
clc
cmp esi, eax
pushal
lea esp, [esp + 0x2c]
js 0x8afeb1
pushfd
lea esp, [esp + 4]
jb 0x7bdcbd
pushal
mov byte [esp], 0x4b
mov byte [esp + 8], 0x54
mov dword [esp + 0x1c], ebx
pushal
mov word [esp], 0x6119
call fcn.008e42c1
push dword [esp]
pushal
mov dword [esp + 0x24], 0xbfc0b486
pushfd
jmp 0x855011
pushal
mov word [esp + 4], bp
mov byte [esp + 4], dh
lea esp, [esp + 0x20]
jb 0x7bdcbd
jmp 0x5ec9b4
call fcn.0079e00c
sbb eax, 0xcccccccc
int3
inc esi
jmp 0x5e6d39
mov dword [esp + 0x24], 0x38e58247
pushfd
push 0xb571243e
lea esp, [esp + 0x2c]
jmp loc.0041bffb
jmp 0x5e819f

Function at 0x7d0b2c
Capabilities:
Packed with generic packer

Disassembly:
call fcn.007cb6b2
pushal
pushfd
inc ecx
call int.00895510
mov dword [esp + 4], 0x81a29003
pushfd
pushfd
lea esp, [esp + 0xc]
jmp fcn.0041c4eb

Function at 0x7d6e66
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stc
cmp dword [esi + 0x28], edi
mov byte [esp + 4], al
pushfd
lea esp, [esp + 0x10]
jbe 0x8556d5
pushal
mov eax, dword [esi + 0x20]
neg dh
mov dword [esp + 0x1c], ebx
lea ebx, [ebp + 0x5fa7cd7c]
setl bl
sbb dl, ch
lea ecx, [ecx]
add esp, 0x1c

Function at 0x7db59c
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x40], edi
push 0xeffba85

Function at 0x7dbd4d
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 4], 0x9f750f3a
mov byte [esp], 0x74
pushal
lea esp, [esp + 0x24]
jmp fcn.0041c4eb
Function at 0x855794
Capabilities:
Packed with generic packer

Disassembly:
inc eax
bt edi, 0x19
cmc
call fcn.007bf3ef
pushfd
pushal
mov dword [esp + 0x3c], 0x383cc4da
mov word [esp], bp
mov byte [esp + 8], 0xdc
lea esp, [esp + 0x3c]
jmp fcn.0041c4eb

Function at 0x85a6b0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [esp + 0x24], esi
mov dword [esp], ebp
push edi
mov dword [esp + 0x24], 0x91bd50
push 0xfca81323
push 0xaf3748c
push dword [fcn.005fd018]
pop dword [esp + 0x28]
pushfd
push ebp
mov word [esp + 4], dx
mov byte [esp + 4], ah
push dword [esp + 0x30]
ret 0x34
xchg dx, cx
mov ecx, dword [ebp + 0x10]
movsx dx, cl
mov edx, dword [ebp + 0xc]
call fcn.0090e06c
ljmp 0xa7a8
jmp 0x8f11c5
mov dword [esp + 0x20], ebx
mov dword [esp + 8], esi
mov dword [esp + 0x1c], esi
pushal
mov word [esp], si
mov dword [esp + 0x38], edi
bsr di, bp
shrd edi, eax, 0x12
rol di, 0xb
mov edi, eax
jmp 0x85dab7
xor esi, esi
stc
push eax
cmp edi, esi
pushfd
lea esp, [esp + 0x40]
jne 0x91bd55
pushal
push dword [esp + 0x10]
push eax
jmp 0x740a9e
push dword [esp]
lea esp, [esp + 8]
jne 0x90573d
pushal
mov eax, dword [ebp + 0xc]
pop ebx
push ebp
movzx ebx, al
lea ebx, [ebp - 8]
pushfd
mov dword [ebp - 8], esi
pushfd
call int.00868ebd
sti
pushal
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
pause
cmpsd dword [esi], dword es:[edi]
mov dword [ebx], eax
mov esi, 0x65182ca6
and bh, bh
cdq
mov dword [esp + 0x1f], ebx
cli
test byte [edi + ebx*2 - 0x21], bh
and al, byte [edx]
ja 0x8f121f
adc cl, byte [esi]
stc
xor dword [ebp + 0x7c4f8aeb], edi
leave
pop edx
cwde
jmp 0x8f1284
loope 0x8f1264
ja 0x8f1226
dec edi
jecxz 0x8f1292
invalid
outsd dx, dword [esi]
xor ebx, dword [esi + 0x58]
lock xor ebx, dword [ebx + 0x505e6426]
and al, 0x90
fldenv [esi + 0x26387cbb]
sbb esp, dword [edi + 3]
inc edi
stosb byte es:[edi], al
add eax, dword [edi - 0x56]
or ecx, dword [edi + 0x2da93df]
loopne 0x8f1279
add cl, byte [edi]
int 0x5d
mov dword [0x2434ffee], eax
clc
cmp edi, dword [eax]
jmp 0x77b9e5
bswap dx
cwde
mov eax, dword [ebp + 0x14]
lea edx, [ebp*4 + 0x1a822c1e]
jmp 0x7727c5
btc ax, 0xe
bts ax, bx
sar ax, cl
mov eax, dword [ebp + 8]
pushfd
jmp 0x8f8b9f

Function at 0x86df96
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x855ae9
push 0x726154
push 0x5c5193f9
push ebp
mov byte [esp + 4], 3
push dword [ebp + 0x14]
pop dword [esp + 4]
pushal
push dword [esp + 0x24]
ret 0x28
call fcn.008c819f
pushal
mov dword [esp + 0x20], 0xbfe469e6
push 0xa750c5f8
pushal
call fcn.0079881a
lea esp, [esp + 0x2c]
jge 0x86b9dc
pushal
mov dword [esp + 0x1c], edx
lea esp, [esp + 0x1c]
jge 0x7c216e
pushfd
push dword [esp]
mov dword [esp + 4], 0x726154
push 0x77950a7
call fcn.008aa37e

Function at 0x879d47
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 8], ebx
call fcn.00856d55
jmp 0x893ab1
pushal
mov dword [esp + 0x1c], 0xbf9f7b26
push esi
jmp 0x88e360
jmp 0x70834f
mov byte [esp + 0x10], ch
push 0x10c0ad4a
mov dword [esp + 0x20], 0x52eea5b5
mov word [esp + 0xc], 0x6c67
mov byte [esp], cl
lea esp, [esp + 0x20]
jmp fcn.0041c4eb
jmp 0x86639b