joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e05e8b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
cmp dword [eax + 0x64], 0
push ebx
push esi
push edi
lea esi, [eax + 0x24]
mov ecx, 0x10
lea edi, [ebp - 0x150]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x150]
je 0x1e05e906
mov esi, 0x10
lea ecx, [ecx]
mov ecx, dword [edx]
mov edi, ecx
shr edi, 8
mov ebx, ecx
shl ebx, 8
xor edi, ebx
and edi, 0xff00ff
shl ecx, 8
xor edi, ecx
dec esi
rol edi, 0x10
mov dword [edx], edi
add edx, 4
test esi, esi
jne 0x1e05e8e0
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x10], 0x10
mov edx, dword [ecx - 0x20]
xor edx, dword [ecx + 0x14]
mov ebx, dword [ecx - 0x1c]
xor ebx, dword [ecx + 0x18]
xor edx, dword [ecx]
xor ebx, dword [ecx + 4]
mov esi, dword [ecx - 0x18]
mov edi, dword [ecx - 0x14]
xor edx, esi
xor ebx, edi
rol edx, 1
rol ebx, 1
mov dword [ecx + 0x24], ebx
mov ebx, dword [ecx + 0x1c]
xor ebx, dword [ecx - 0x10]
mov dword [ecx + 0x20], edx
xor ebx, dword [ecx + 8]
add ecx, 0x10
xor ebx, esi
mov esi, dword [ecx - 0x1c]
xor esi, dword [ecx - 4]
rol ebx, 1
xor esi, edx
xor esi, edi
rol esi, 1
sub dword [ebp - 0x10], 1
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x1c], esi
jne 0x1e05e913
mov edx, dword [eax + 8]
mov edi, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
xor esi, edi
mov ecx, dword [eax + 0xc]
and esi, ecx
xor esi, dword [eax + 0x14]
mov ecx, dword [ebp - 0x150]
mov ebx, edx
Function at 0x1e069370
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [ebp + 0x10], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, eax
jg 0x1e069394
jl 0x1e069473
test edi, edi
jbe 0x1e069473
mov ecx, 1
mov dword [ebp - 0x80], 0xedb88320
mov eax, ecx
mov dword [ebp + eax*4 - 0x80], ecx
inc eax
add ecx, ecx
cmp eax, 0x20
jl 0x1e0693a2
push ebx
lea ebx, [ebp - 0x80]
lea eax, [ebp - 0x100]
call fcn.1e069330
lea ebx, [ebp - 0x100]
lea eax, [ebp - 0x80]
call fcn.1e069330
jmp 0x1e0693d0
lea ebx, [ebp - 0x80]
lea eax, [ebp - 0x100]
call fcn.1e069330
mov eax, edi
and eax, 1
xor ecx, ecx
or eax, ecx
je 0x1e069408
xor edx, edx
mov eax, esi
lea ecx, [ebp - 0x100]
test esi, esi
je 0x1e069406
test al, 1
je 0x1e0693fd
xor edx, dword [ecx]
shr eax, 1
add ecx, 4
test eax, eax
jne 0x1e0693f7
mov esi, edx
mov edx, dword [ebp + 0x10]
mov eax, edi
mov cl, 1
call fcn.1e145b90
mov edi, eax
or eax, edx
mov dword [ebp + 0x10], edx
je 0x1e06946d
lea ebx, [ebp - 0x100]
lea eax, [ebp - 0x80]
call fcn.1e069330
mov eax, edi
and eax, 1
xor ecx, ecx
or eax, ecx
je 0x1e069452
xor edx, edx
mov eax, esi
lea ecx, [ebp - 0x80]
test esi, esi
je 0x1e069450
test al, 1
je 0x1e069447
xor edx, dword [ecx]
shr eax, 1
add ecx, 4
test eax, eax
jne 0x1e069441
mov esi, edx
mov edx, dword [ebp + 0x10]
mov eax, edi
mov cl, 1
call fcn.1e145b90
mov edi, eax
mov ecx, edi
or ecx, edx
mov dword [ebp + 0x10], edx
jne 0x1e0693d0
mov eax, esi
xor eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1e082d10
Capabilities:
Encode data using xor

Disassembly:
call [bp + di - 0x7117]
sbb edi, dword [esi]
salc
adc al, 0x4b
clc
pop ecx
mov bh, 0xfa
jne 0x1e082ca0
adc edi, dword ds:[ecx - 0x1ac3bd70]
movsd dword es:[edi], dword [esi]
dec edi
cdq
test al, 0xb2
pop es
jle 0x1e082cd4
sub byte [eax + 0x42c71694], ah
jo 0x1e082d72
dec ebp
fmul dword [edi + 0x2181c58b]
pushal
jns 0x1e082d8c
pop esp
or eax, 0x5f2bc8e9
push eax
and al, 0xca
mov eax, dword [0x61c7f88d]
xor eax, 0x7f9f65a8
xchg ecx, eax
je 0x1e082cd3
jmp 0x6e675909
invalid
inc esi
pop esp
stosd dword es:[edi], eax
or byte [eax + 0x6a], 0x86
pop eax
lodsb al, byte [esi]
in al, 0x21
frstor dword [ecx + edi*8 - 0x31]
jg 0x1e082df6
jae 0x1e082d3c
mov eax, 0x6076a9d3
push ebp
push ecx
shr dword [ecx + 0x51556076], cl
pop ebx
mov cl, 0x99
cdq
cdq
xchg edx, eax
sub ebp, dword [edx - 0x445dfc3b]
jmp 0x1e082dee
movsd dword es:[edi], dword [esi]
pop esi
popal
xchg esp, eax
loopne 0x1e082dd5
clc
out dx, eax
sub bl, byte [esi + 0x3b]
sub dh, 0xf7
push eax
mov ah, 0x32
cmc
xor dh, ch
pop esi
jge 0x1e082dbc
imul byte [edi + edx + 0x3aac529d]
jae 0x1e082d82
sub byte [eax + 0x12], dl
scasd eax, dword es:[edi]
sahf
shr byte [edi - 0x18], 0xac
arpl word [eax - 0x6829baf0], bp
adc byte [ebp - 0x2a], al
xchg edi, eax
mov dword [eax], ecx
lodsb al, byte [esi]
add eax, 0x9f7145f6
cmp cl, byte [esp + ebp*4]
jne 0x1e082e3b
push es
dec esp
popfd
pop ecx
outsd dx, dword [esi]
wait
retf
mov byte [0x3e035d21], al
out dx, eax
out 0xc7, al
ja 0x1e082d7b
pop ss
xor eax, 0x92c832d9
adc byte [esi], bh
push ebx
push cs
mov ebx, esi
jle 0x1e082e1a
xchg byte [0xeb7155cf], ch
sub ebp, ecx
jae 0x1e082e36
jbe 0x1e082daa
invalid
stosd dword es:[edi], eax
iretd
sub cl, al
push esi
movsd dword es:[edi], dword [esi]
salc
invalid
Function at 0x1e0a8670
Capabilities:
Encode data using xor

Disassembly:
jge 0x1e0a8611
adc byte [edx], ch
mov al, byte [0xeb29a136]
cmpsd dword [esi], dword es:[edi]
jne 0x1e0a8644
pop edi
pushal
and edx, dword [ebp - 0x23fbf947]
mov ds, word [esi - 0x7c]
cmp dword [esi + 0x79], edx
call 0xd7c008e0
mov word [esi], gs
xchg ecx, eax
rcl ebp, cl
mov cl, 0xe5
dec ecx
invalid
xchg edi, eax
sbb eax, 0xbaed6a8c
out dx, al
or byte [eax], bh
stosd dword es:[edi], eax
mov word [edx - 0x13], gs
mov edx, 0xab3808ee
or al, 1
inc ebp
sub al, byte [ebx]
cld
test ebx, ebp
jno 0x1e0a860d
and eax, 0xfd20382e
cmpsb byte [esi], byte es:[edi]
test eax, 0x9015a4ad
xor dword [edi + ebp], ebx
out 0xa3, eax
xor byte [edx - 0x643d18e9], cl
inc edi
and dword [ecx - 0x26], 0xffffffbe
fidivr dword [esi - 0x7d7f33f1]
je 0x1e0a8642
push ds
dec esi
mov dword [0x4aa3a4d5], eax
in eax, dx
out dx, eax
mov dh, 0x15
add cl, byte [eax + 0x409c375d]
fidivr dword [esi - 0x7d7f33f1]
je 0x1e0a8642
push ds
dec esi
mov dword [0x4aa3a4d5], eax
in eax, dx
out dx, eax
mov dh, 0x15
add cl, byte [eax + 0x409c375d]
push 0x57
xor ah, byte [esi - 0x39]
mov edi, 0x2e7cc71b
daa
daa
cmp eax, 0xce29b928
fdiv dword [eax + ebp*2 - 0x27]
stosd dword es:[edi], eax
rcr dword [ecx - 0xf7fbfd0], 0x94
aas
adc dword [0x69d1733b], esi
test eax, 0x8ee50c59
salc
or al, 0xe5
mov ss, esi
dec ecx
dec ebx
mov bl, 0x67
sub byte [ebp - 0x6aefb71], dl
pop ecx
xor al, 0x3b
pop ss
mov ebp, dword [edx - 0x37]
add ecx, eax
loopne 0x1e0a86af
mov dword [edi - 0x1b33440a], ebp
js 0x1e0a8692
outsd dx, dword [esi]
xchg dword [ecx - 0x93b6a7], ebx
jae 0x1e0a86f7
push edi
fdiv dword [ecx]
pop edx
jbe 0x1e0a8752
xor dword [eax + 0x5ec2f9d3], eax
jae 0x1e0a8714
ret 0x735e
inc ebx
rol dword [eax + ebx], cl
xchg dword cs:[esi - 0x66], esi
mov ebx, 0x7693212d
aas
mov dh, 0xe1
pop ss
loope 0x1e0a8710
inc esp
test al, 0xad
mov word [ecx], cs
aad 0xde
sub eax, 0x3405d60d
call 0x9aa35e30
fnstsw word [edi + 0x7c]
loope 0x1e0a86d0
sbb esi, dword [ebx - 0x33]
jae 0x1e0a86df
aas
out 0xd7, eax
xlatb
add eax, 0x6f2a44e2
xor al, 0xe2
or eax, edi
jns 0x1e0a8778
jecxz 0x1e0a86e3
insd dword es:[edi], dx
cdq
std
adc al, 0x9d
mov ch, 0xfa
enter 0xffffffffffffa55e, 0xffffffffffffffad
sub al, 0x21
salc
les ebp, [ecx]
out dx, eax
lodsd eax, dword [esi]
xchg edx, eax
jle 0x1e0a86dd
add edi, dword [edx + ebp]
or dword [edx], ebp
xor eax, eax
lodsb al, byte [esi]
xchg esi, eax
xlatb
sub al, 0xe6
mov ch, 0x1e
retf
pop esi
lahf
dec ebp
int 0xca
inc edx
sbb byte [ebx], ah
mov eax, dword [0x688491d4]
push cs
loopne 0x1e0a8780
xchg ebp, eax
jbe 0x1e0a8758
call 0x84938a5e
or eax, 0xc76d40ec
mov bh, 0x3e
out dx, al
int3
push ebx
cld
dec edx
fsub qword [ebp - 0x7c]
fldenv [edi + 0x6f6bee27]
mov dword [0x675dccf5], eax
adc byte [ebp - 0x5c], dl
dec edi
jg 0x1e0a877b
cmpsd dword [esi], dword es:[edi]
daa
out dx, al
imul ebp, dword [edi - 0x5d], 0xfffffff5
int3
cmp dword [edx], ecx
das
enter 0x70da, 0x6f
push ebp
lcall 0x10b1, 0x13be7969
jnp 0x1e0a8737
test eax, 0xf3a7562
push esp
fcom dword [edi + 0x1a]
mov ch, 0x40
invalid
Function at 0x1e0bb880
Capabilities:
Encode data using xor

Disassembly:
sal byte [eax + 0x6559998c], 0x1e
dec esi
idiv dword [edi - 0x48685ec0]
inc ebp
push esp
mov esi, 0x1c5c6337
dec esi
adc ebp, edx
and edx, dword [ecx]
rcl eax, 1
and dword [esi + 0x61], edx
push edi
xchg ebx, eax
mov ah, 0x5f
das
cmp eax, 0x3d3ea116
dec esp
scasb al, byte es:[edi]
cwde
imul dword [esp + 0x5ae41d73]
pop edx
push es
aad 0x80
push esi
push cs
dec ebx
insd dword es:[edi], dx
out dx, eax
xor dl, byte [edi + 0x1ecae4be]
loopne 0x1e0bb8b2
cmpsd dword [esi], dword es:[edi]
jne 0x1e0bb931
mov esp, 0x3a008479
daa
ret 0x9348
das
scasd eax, dword es:[edi]
salc
add byte [edx + esi*8 + 0x30f2e80a], ah
enter 0xfffffffffffff733, 0x17
das
dec esp
pop ebp
invalid

Function at 0x1e0bb9f0
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], edx
add esi, dword [edi - 0x1a74af02]
push ebp
dec ebx
pushal
fistp word [edx + 0x6a]
test byte [ebp - 0x6e58dd06], dh
nop
mov esp, 0x594bd671
mov ch, 0xfa
and ah, byte [edi + 0x71bc9091]
salc
dec ebx
pop ecx
xor al, 0x1b
sar dword [esi], 0xc6
sub dword [ecx], esi
out dx, eax
and cl, byte ss:[eax + 0xdfeaf50]
or al, 0xa6
sbb dh, bl
sahf
js 0x1e0bb9b4
stosb byte es:[edi], al
in eax, 0x7a
cmpsd dword [esi], dword es:[edi]
invalid
les esp, [esi + 0x406957d9]
jns 0x1e0bb9c3
sub eax, 0x7a35e5e9
mov ecx, dword [ebx + 0x5d1a0aae]
sbb dl, byte [ebx + 0x23]
dec esi
mov edx, 0x7d5272b2
sbb al, byte [esi - 0x13cba117]
push edi
inc ecx
pop esi
fisttp qword [eax + 0x4430d395]
pop esp
pop esp
inc ebp
adc esi, eax
invalid

Function at 0x1e0c2710
Capabilities:
Encode data using xor

Disassembly:
pop ebx
cmpsb byte [esi], byte es:[edi]
call 0x7b486ca0
cwde
ror byte [ebx + 0x67], 0x5e
cli
test eax, 0xb2c599a4
movsb byte es:[edi], byte [esi]
cdq
lds esi, [edx - 0x640f8ec]
add al, 0x27
cmp al, dh
movsb byte es:[edi], byte [esi]
cdq
lds esi, [edx - 0x640f8ec]
add al, 0x27
cmp al, dh
xchg esi, eax
in al, dx
scasd eax, dword es:[edi]
shl dword [esi - 0x51d3cf78], cl
xor ch, bh
add dword [eax], edi
push eax
cld
xor ah, 0x6a
mov ebp, 0xa96a5b6e
add al, 0xa
xchg ebx, eax
push esp
mov ah, 0xea
xor ecx, dword [edi]
out dx, eax
and eax, 0x8b54dab7
out dx, eax
mov edi, 0x1865f422
inc esi
mov ebx, 0xc5d47f4
cld
aad 0x17
pop es
sub ch, byte [ecx]
je 0x1e0c2702
add al, 0xbd
aad 0x97
jb 0x1e0c2712
out dx, al
push es
pop edi
fldcw word [esi - 0x2e]
adc ebp, ebx
xchg cl, dh
mov ch, 0x1c
cmp byte [ebx + 4], 0x16
das
adc esp, edi
fist word [edi]
ja 0x1e0c27c9
adc dh, ch
dec ebx
push eax
and al, 0x67
pop ds
dec esi
std
sbb dh, cl
std
movsd dword es:[edi], dword [esi]
xchg ebp, eax
adc dword [esi + ebx*8], ebx
and dword [edi - 0x1f9de445], 0xd759a4dd
ret
retf
Function at 0x1e0e2f30
Capabilities:
Encode data using xor

Disassembly:
rol al, 1
cmpsb byte [esi], byte es:[edi]
sar ch, 1
loop 0x1e0e2eba
push esi
dec edx
fiadd word [eax + 0x5a]
xor dh, dl
dec ecx
wait
ja 0x1e0e2eae
dec edx
fidiv dword ds:[ebx]
invalid
aaa
int1
sub byte [ebx + 0x4dad4b42], cl
test byte [ebp - 0x4a], ch
sal byte [edi + 0x1a832328], cl
imul dword [eax - 0x22]
mov dword [ecx + 0x546c43b5], edi
dec edx
invalid
in al, 0xb8
rol byte [ebp + 0x4021b51], cl
and al, 5
nop
pop ds
sahf
cmp al, 0xfc
mov eax, 0x1b5185d2
add al, byte [esp]
add eax, 0x3c9e1f90
cld
aaa
js 0x1e0e2f0d
add al, 0xa4
jp 0x1e0e2f64
pop ebp
adc dword [eax - 0x5d], edi
cmp byte [esi], bh
adc eax, 0xdd509a06
fucom st(3)
fnsave dword [ebx]
inc edx
popal
jecxz 0x1e0e2eec
xor eax, dword [edx + 0x61]
aaa
jp 0x1e0e2e9c
mov ds, edi
push esp
lcall 0x99f0, 0x33c88914
mov eax, ecx
xor esi, eax
cdq
in al, 0x6c
nop
cld
wait
inc ebx
jmp 0x1e0e2f60
xchg ebx, eax
push cs
dec edx
pop ebp
mov byte [0x9e7aaf21], al
mov bl, 0xe8
cmpsb byte [esi], byte es:[edi]
and dword [ecx + 0x26], edx
and al, 0x6f
and al, 0x6f
sbb bl, bh
inc eax
xor byte [edi - 3], 0xef
scasb al, byte es:[edi]
or eax, 0x76675e3e
out dx, al
add byte [eax - 0x61ddc8f6], 0x43
adc word [esp + edx*4], 0xffe8
adc byte [eax], 0x77
sbb bl, byte [esi + 0x753fd726]
xlatb
aas
jne 0x1e0e2eeb
xchg byte [0xc86cbed5], bl
sbb eax, 0xc86cbed5
mov fs, word [esi]
sub dl, byte [ecx + edi*8]
cmpsd dword [esi], dword es:[edi]
cmp al, 0xbd
jo 0x1e0e2f3c
fadd qword [ecx]
push edx
imul dword [ecx + 0x45]
inc ebx
cli
dec edi
dec ecx
scasb al, byte es:[edi]
outsb dx, byte [esi]
jp 0x1e0e2f97
lds edx, [edx]
loop 0x1e0e2f1a
test eax, 0x6450b736
aas
int 0x33
std
aam 0x69
push eax
out dx, eax
jno 0x1e0e2f3e
pop edi
inc esp
or edx, dword [ebp + edx + 0x24]
fdiv st(4), st(0)
invalid
Function at 0x1e0e97a0
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
push 0xffffffffffffff98
sal dh, 1
xchg ah, al
retf
inc eax
ret
sub dword [ebp + edx*4 + 0x73], 0x5b5a8bd2
insb byte es:[edi], dx
pop es
and dl, bl
mov byte [0x90b1d471], al
adc dword [0x8b8009d5], esp
and dword [eax - 0x5bb6e713], ecx
dec ecx
movsb byte es:[edi], byte [esi]
adc al, 0x49
jle 0x1e0e9772
pop ecx
pop ds
xchg byte [ebp + 0x62ce3e5], bh
sub ch, ah
adc edi, dword [eax]
mov bh, 0x90
mov eax, 0x64a0039e
js 0x1e0e9828
sub bh, byte [esi - 0x48dec57a]
in eax, 0xc
movsb byte es:[edi], byte [esi]
or eax, dword [edx + edx*8 + 0x37]
aaa
sub ecx, edi
repne cmpsd dword [esi], dword es:[edi]
add eax, 0x5ad7dcd
outsd dx, dword [esi]
jge 0x1e0e979d
lodsb al, byte [esi]
cmp dh, bl
sbb dword [edx + 0x28], ebx
xor ebx, dword [edi]
rcr byte [ecx], cl
jb 0x1e0e97f0
jl 0x1e0e9869
int1
mov eax, dword [0x6e962e5a]
pop edx
xchg esi, eax
outsb dx, byte [esi]
bound esi, qword ss:[ebx + 0x111d41dd]
ror edi, 0x74
sbb eax, 0x74cfc111
or eax, 0x1d5998bd
dec ebx
mov ch, 0xed
jne 0x1e0e97bb
aaa
sub dword [ebp + 0x2a], edi
in eax, 0x58
pop eax
stosb byte es:[edi], al
fiadd word [esi + 0x50d7ac61]
call 0x2847f0f2
arpl si, bp
mov ecx, 0x909c9b95
dec edi
cld
push ds
push esi
inc ecx
imul ebx, ebp, 0x5fdf3055
leave
and byte [esi], cl
add al, 0xf7
in al, 0xf3
mov edx, 0x2d7c3201
fistp dword [ecx]
stosd dword es:[edi], eax
loopne 0x1e0e97e3
cmp ecx, dword [edx]
dec ecx
loope 0x1e0e9802
sbb edi, dword [edx]
sbb byte [edi + edi + 0x31], dh
mov edi, 0xc3e519e0
pop edx
add byte [edi], bh
and dword [ebp + 0x24], edi
jne 0x1e0e9818
push esp
call 0x2df4338
js 0x1e0e980b
test byte [eax], ah
add eax, 0xe81e379c
invalid
Function at 0x1e10b2e0
Capabilities:
Encode data using xor

Disassembly:
hlt
sbb ah, al
jnp 0x1e10b1dd
sub ecx, edx
mov ebx, 0x7f409dd1
xchg dword [edx - 0x70], ebx
fiadd dword [eax - 0x3382d797]
inc ecx
xor esp, dword [edx + 0x70]
sbb al, 0xbb
je 0x1e10b253
cmp edx, dword [ecx + 0x3c]
mov ebx, 0x8f54f1e1
sub dword [ebx + 0xc59877f], 0x10
mov esp, 0xe3fe62d
adc al, 0xe7
mov edx, 0xfeaa3ff3
dec ecx
out 0xba, eax
aas
stosb byte es:[edi], al
dec byte [ecx + 0x5e]
pop esi
mov ch, 0x68
arpl word [eax + 0x6b], si
neg dword [ebx + 0x5c03c8db]
add byte [edi], 0xf1
mov edi, 0x87c30a0a
imul edi, dword [ecx - 0x5bb8688e], 0xffffffd7
cwde
test dl, dh
lea eax, [edi]
mov word [edi + 0x7b], fs
stc
in eax, dx
loope 0x1e10b30f
or al, 0xab
stosd dword es:[edi], eax
push 0xb854f7df
std
je 0x1e10b279
mov eax, 0x10c774fd
push cs
adc byte [esi], cl
sbb dword [ebp - 0x6ab2d809], eax
js 0x1e10b248
fbstp tbyte [ecx]
js 0x1e10b2a9
out dx, al
and eax, 0xee0db659
mov dh, 0xd
out dx, al
xchg esp, eax
dec ecx
and byte [ebx - 0x2fc9217e], 0x8f
std
sub byte [esi - 0x6a], ah
sub al, 0x93
rol ebp, cl
sub ebx, ecx
aad 0xcb
cmc
sti
jns 0x1e10b33a
lahf
cli
sub eax, 0x14ba5614
test eax, 0xb9d4fbc9
or eax, dword [edx - 0x3e478639]
inc esp
imul byte [eax]
xchg ecx, eax
sal byte [ecx + 0x1245bfcf], cl
jl 0x1e10b2c3
lodsb al, byte [esi]
xchg esi, eax
sbb eax, 0x2238a838
clc
lodsd eax, dword [esi]
js 0x1e10b2ae
xor ah, byte [ebp + 0x346150ae]
daa
popal
xor al, 0x27
xor dword [edi], 0x9fbccfe
or al, 0xdf
aas
push ss
shl dword [esi - 0x59], 0xf
cmc
jp 0x1e10b312
retf 0xe651
xchg eax, ebp
fsub qword [edi + 0x4db1dca8]
mov dl, 0xa3
fimul word [eax]
sub ebp, edx
lodsd eax, dword [esi]
sahf
cmp bh, 0xe3
and dword [esi + 0x7f188430], ebx
mov ecx, dword [ebx*2 + 0x645f6fea]
pop esi
dec ecx
salc
inc eax
cmp dword [ebp + 0x2b], esi
mov dl, ch
push eax
sar byte [esi], 1
mov byte [ebx + 0x4b], bh
or al, 0xe0
sbb esi, edi
mov bh, 0xa5
add dword [ecx + ebx*2], esp
xchg edi, eax
arpl word [0x5df98183], sp
pop ecx
pop es
sbb eax, 0xc80a99da
or ecx, dword [edx + esi - 0x4f]
pushal
xchg byte [edi - 0x7d], al
insb byte es:[edi], dx
mov eax, 0x7a93bdfc
cmp al, 0xa0
clc
sbb al, byte [0xbe2a76e9]
invalid
test eax, 0xa689ff6b
rcl ebp, 1

Function at 0x1e11d720
Capabilities:
Encode data using xor

Disassembly:
xlatb
mov al, 6
int3
inc esi
mov esp, 0x88174f56
stc
sbb al, 0xd8
pop eax
sbb eax, dword [ecx]
inc ebx
cmc
pop edi
add esi, dword [edx + 0x6e242a90]
push 0xe74c1b2f
ja 0x1e11d71c
dec esp
out 0x77, eax
loopne 0x1e11d7ab
outsb dx, byte [esi]
xor al, 0xc4
jo 0x1e11d738
mov cl, 0xb1
in al, 0x9e
jl 0x1e11d712
int3
sbb ah, byte [ecx]
mov eax, 0x79e0a6e4
sub eax, 0xdaaa3491
into
call 0xf2398c1b
mov ebp, fs
push es
fcmovne st(0), st(3)
outsd dx, dword [esi]
pop ss
lds ecx, [eax - 0x7b877acc]
cmpsd dword [esi], dword es:[edi]
ret 0xa7ed
Function at 0x1e13e2b0
Capabilities:
Encode data using xor

Disassembly:
adc byte [ebx - 0x7b1cb8b3], 0x90
push es
push ecx
fisttp word [ebx + 0xc]
and dword [edx + 0x62], ebx
sub eax, 0x177a5cd2
in eax, 7
invalid
push ss
enter 0x639e, 0x1a
or al, 0x38
loop 0x1e13e27d
inc edi
outsb dx, byte [esi]
test dword [eax], ebx
dec esi
sbb dl, al
xor cl, byte [edi + 0x73e0d94f]
into
jp 0x1e13e30c
mov al, byte [0x659dc636]
pushal
pop ss
insb byte es:[edi], dx
jae 0x1e13e2dd
popfd
aad 0x1b
pop eax
xor dword [eax + 0x4424f358], ebp
lodsb al, byte [esi]
invalid

Function at 0x1e1458b0
Capabilities:
Encode data using xor

Disassembly:
fild qword [edx - 0x651da066]
fstp xword [ebp + 0x1428e220]
mov eax, dword [0xa6bc54f1]
cmpsb byte [esi], byte es:[edi]
xor al, 0xe2
pop ss
cmp dl, byte [edi]
rcr dword [edx + 0x54], 1
add ecx, edx
stc
sbb edi, esp
and eax, 0x660e7644
adc ecx, ebp
jns 0x1e1458c0
pushfd
xchg esp, eax
xchg esp, eax
int1
mov al, 0xbb
xchg byte [ebp + 0x4e], ch
invalid
invalid
invalid

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x5032e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa6000]
push edi
jmp 0x5032fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x503301
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5032f0
mov eax, 1
add ebx, ebx
jne 0x503313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x503324
jne 0x503343
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x503343
dec eax
add ebx, ebx
jne 0x503330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x503308
add ebx, ebx
jne 0x50333f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x503395
xor ecx, ecx
sub eax, 3
jb 0x50335b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5033ca
sar eax, 1
mov ebp, eax
jmp 0x503366
add ebx, ebx
jne 0x503366
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x503334
inc ecx
add ebx, ebx
jne 0x503374
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x503334
add ebx, ebx
jne 0x503381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x503376
jne 0x503392
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x503376
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5033b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5033a6
jmp 0x5032f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5033b4
add edi, ecx
jmp 0x5032f6
pop esi
mov edi, esi
mov ecx, 0x3b6c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5033d2
cmp byte [edi], 0x17
jne 0x5033d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5033d7
lea edi, [esi + 0xfd000]
mov eax, dword [edi]
or eax, eax
je 0x503446
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x123234]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1232c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x503404
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1232d0]
or eax, eax
je 0x503440
mov dword [ebx], eax
add ebx, 4
jmp 0x503421
call dword [esi + 0x1232cc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x503477
cmp al, 0xef
ja 0x50346a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x50344c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x503459
mov ebp, dword [esi + 0x1232d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5034ab
sub esp, 0xffffff80
jmp 0x435126
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x351745a6
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x15423c59
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219