joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418ad7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52b3a7
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x418b9f

Function at 0x418c22
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52b3a7
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x525082
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x418c45
cmp edi, dword [esi + 0x7c]
jge 0x418c45
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042d4e9
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042d4e9
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52b3a7
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
or eax, 0x560e70
call 0x52b3a7
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x418b97
jmp 0x418b67
call fcn.00431710
int3
Function at 0x41fb97
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532d0b
mov eax, dword fs:[0]
push eax
sub esp, 0x320
mov eax, dword [0x581a60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edi
lea ecx, [ebp - 0x324]
call fcn.004196a7
lea ecx, [ebp - 0x324]
mov dword [ebp - 4], 0
call fcn.0041fe47
lea ecx, [ebp - 0x324]
call fcn.0041e0e7
push 6
lea eax, [ebp - 0x328]
push eax
lea ecx, [ebp - 0x324]
call fcn.004190e7
mov eax, dword [eax]
push 0x55fc94
push eax
call 0x525330
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x328]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fc38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 5
test bl, bl
je 0x41fc75
push edi
call dword [0x536430]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x324]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fc6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x41fe1f
push 0
push 0
push edi
push 0x55ec64
push 0
call dword [0x5364f4]
mov dword [ebp - 0x328], eax
cmp eax, 0x20
ja 0x41fdf0
lea ecx, [ebp - 0x320]
push ecx
push 1
push 0
push 0x55fc9c
push 0x80000000
call dword [0x536020]
test eax, eax
jne 0x41fdf0
mov ecx, dword [ebp - 0x320]
mov esi, dword [0x536000]
lea edx, [ebp - 0x32c]
push edx
lea eax, [ebp - 0x31c]
push eax
push 0
push ecx
mov dword [ebp - 0x32c], 0x104
call esi
mov ebx, dword [0x536458]
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x218]
push eax
call ebx
mov ecx, dword [ebp - 0x320]
push ecx
call dword [0x536004]
push 0x55fca4
lea edx, [ebp - 0x218]
movsb byte es:[edi], byte [esi]
ret
xchg ebx, eax
fnsave dword [ebp - 0x6c]
pushal
sbb al, 0x7c
test eax, 0x5b5287be
pop ebx
aam 0x54
loopne 0x41fe5b
in eax, dx
jl 0x41fde5
add al, 0x3d
adc dl, byte [ecx - 0x1a]
stosb byte es:[edi], al
and eax, 0x3b69d4b3
das
xlatb
insd dword es:[edi], dx
sal eax, 0xe5
sbb ebx, dword [edx + ebx*2 - 0x5a]
pop edi
call 0xb064055
stosb byte es:[edi], al
dec esi
arpl dx, bp
push ds
adc ecx, ecx
ret
invalid
std
xchg ecx, eax
pop esp
enter 0xffffffffffffe954, 0xffffffffffffffdc
dec ebx
cmp byte [ebp - 0x2f], ch
and eax, 0xaa090b53
xchg edi, eax
xor esp, dword [edi]
mov byte [0xb28f430], al
xchg edx, eax
insb byte es:[edi], dx
pop eax
in eax, 0xdd
sahf
nop
and byte fs:[ecx + eax*2 + 0x22], al
cmp ch, cl
rol dword [eax - 0x4e], cl
out 0xfc, eax
invalid
Function at 0x42fb67
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x542437
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42fc2f
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x542437
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x53c112
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42fcd5
cmp edi, dword [esi + 0x7c]
jge 0x42fcd5
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.00444579
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.00444579
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x542437
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x542437
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42fc27
jmp 0x42fbf7
call fcn.004487a0
int3

Function at 0x436fb7
Capabilities:
Encode data using xor

Disassembly:
bound ecx, qword [esi - 0x1c]
mov bh, 0x90
adc edx, esp
inc edi
push ss
jbe 0x437012
test byte [edx], 0x43
mov eax, dword [0x7bbf8158]
scasd eax, dword es:[edi]
cld
pop ds
pop edx
inc edi
xchg edx, eax
out dx, al
xlatb
neg edx
xchg edx, eax
or dword [ebp + 0x12], ebx
sub dh, byte [ebx]
mov al, 0x94
sbb esp, dword [ecx + ebp*2 - 0x18fd992f]
invalid
inc ecx
mov bh, 0xa3
daa
cmpsb byte [esi], byte es:[edi]
push ss
sub ah, cl
emms
add eax, 0x94474594
xchg ebx, eax
push edx
xor al, byte [ebx + 0x123e4622]
loope 0x43705d
js 0x437064
dec ebp
test eax, 0x4a39bbe2
pop dword [edi - 0x487d3923]
xor esp, edi
cmp dword [ebx + 0x1b], ebp
mov eax, 0x71bbebe8
invalid
mov cl, 0x2f
xchg ebp, eax
or byte [esi], ah
mov al, 0x31
push edx
adc dword [esi - 0x2d], 0xffffff9b
pushal
invalid
Function at 0x43a853
Capabilities:
Encode data using xor

Disassembly:
std
xor byte [esi + 0x54], dh
xchg ebp, eax
pop ecx
push eax
sub byte [esp + edx*2 + 0x3acb6ba6], dl
adc al, 0xf6
mov dl, 0xc5
xor eax, 0xacc20c66
aad 0xd3
mov esi, gs
sbb eax, eax
aam 0x18
push es
jae 0x43a87b
insd dword es:[edi], dx
pop eax
sbb al, 0x76
pop eax
int3
aam 0x7e
adc al, 0xbc
adc eax, 0xc58e015c
mov cl, byte [esi + 0x2b]
mov ebx, 0xeecdd435

Function at 0x43faab
Capabilities:
Encode data using xor

Disassembly:
sti
sub eax, 0x85b33c96
ror dword [eax - 0x54], cl
push esp
fild qword [edx]
wait
push 0xffffffffffffff96
sub al, 0x9f
in eax, 3
dec ebx
mov dword [eax + edx], ebx
and ebp, ebp
pushal
pop ecx
xchg ebp, eax
sub dword [eax], 0xffffffb2
aam 8
xor eax, 0x519d7075
push ecx
and ah, 0xe2
test dword [edx + 0x6f420b52], ebx
push edx
or eax, dword [edx + 0x6f]
dec esi
xor al, 0xe3
clc
cmc
lcall 0xc359, 0x61d56373
inc ecx
dec ebx
fcomp dword [ecx - 0x4586eae1]
or dh, al
pop edx
sar byte [ecx], 0xc5
adc bl, 0xe3
fidivr word [edx + 0x248184d7]
jno 0x43fad6
cld
xchg ecx, eax
pop esp
in eax, dx
ja 0x43fad0
aad 0xee
retf

Function at 0x4467a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
Function at 0x4467ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x559077
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x44686f
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x559077
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x552d52
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x446915
cmp edi, dword [esi + 0x7c]
jge 0x446915
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045b1b9
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045b1b9
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x559077
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x559077
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x446867
jmp 0x446837
call fcn.0045f3e0
int3

Function at 0x45b1b9
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
cld
insd dword es:[edi], dx
push eax
push esp
or esp, eax
pop ebx
push esp
mov bl, 0xa3
fdivr qword [ebx]
pop esp
mov ecx, 0x80e255bc
invalid

Function at 0x45c514
Capabilities:
Encode data using xor

Disassembly:
sbb bh, byte [esi - 0x3d]
mov dword [eax], edx
mov bh, 0x17
sbb byte [edx - 0x1748e437], ch
sub al, 1
invalid

Function at 0x45d407
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38

Function at 0x48bc87
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
and al, 0x2c
Function at 0x48bca2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x2c
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059e557
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48bd4f
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059e557
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00598232
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48bdf5
cmp edi, dword [esi + 0x7c]
jge 0x48bdf5
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004a0699
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004a0699
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059e557
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059e557
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48bd47
jmp 0x48bd17
call fcn.004a48c0
int3

Function at 0x493884
Capabilities:
Encode data using xor

Disassembly:
dec dword [esi]
push cs
and al, 0x5b
xor esi, esi
xor dword [ecx - 0x7fa6b458], ebp
pushal
push esp
loope 0x493885
out dx, eax
invalid

Function at 0x497167
Capabilities:
Encode data using xor

Disassembly:
iretd
fcom qword [edx - 0x70]
mov byte [0xee6b3fa6], al
je 0x497100
push ds
xchg ebp, eax
stc
scasd eax, dword es:[edi]
pop edi
ficom word [edx]
mov ebx, 0xc4bb979a
cdq
adc dword [ecx + 0x5fb73bb3], 0x23
and eax, dword [edx + 0x7674621a]
xchg ecx, eax
mov bl, 0x3b
mov bh, 0x5f
and esp, dword [ebx]
sbb byte [edx], 0x62
je 0x497201
stc
mov esi, 0x60d8b259
fidivr word [eax + 0x1af5cecf]
pop ecx
out 0x8b, eax
xor ebx, dword [ecx - 0x52]
mov es, word [edx]
stosb byte es:[edi], al
mov bl, 0xeb
and al, 0x38
jns 0x49717f
stc
or byte [edi - 0x46], bl
mov esp, 0x6994ca66
cli
inc esi
iretd
dec edx
mov ah, byte [ecx - 0x7a]
fidivr word [eax]
adc ebp, dword [edx + 0x7bb403a2]
sub dl, 2
pop ecx
mov ecx, 0xf2f850b8
push 0xba2cac1
xlatb
cli
insb byte es:[edi], dx
lds esi, [ebx + 0x58]
pop esi
pop edi
imul edx, dword [ebx + 0x42], 0xa
jmp 0x4971ec
Function at 0x49e5a4
Capabilities:
Encode data using xor

Disassembly:
or ebx, dword [eax]
out 0x23, al
push dword [esi]
mov ah, byte [ebx]
out 0xf5, al
push ds
dec edi
sar dword ds:[edx + 0xde60cb1], 0xda
adc byte [esi + 0x70fab91f], al
movsb byte es:[edi], byte [esi]
inc edx
inc esi
add dword [ebp - 0x1482d996], edi
popfd
jb 0x49e62f
in al, 0x7c
jo 0x49e64c
dec edi
aad 0x23
xor ch, dl
mov eax, dword [0x2b6f2192]
out 0x3f, eax
and dword [ecx - 0x11], 0x6dfd109b
invalid
mov dword [esi + 0x1b99fe6e], ecx
setb byte [edx + 0x3632b6d3]
invalid
sal dword [esi - 0x4b70c9ce], cl
ficom word [esi - 0x37]
push edi
fild qword [ebx]
mov ah, 0x69
cmpsd dword fs:[esi], dword es:[edi]
adc byte [0x135bf844], cl
cld
mov bl, 0xd8
insd dword es:[edi], dx
jmp dword [0x548fd92]
cli
or byte [ebx + 0x24272d34], 0x9c
sub byte [ecx], cl
pop dword [esi + 0x28b3526c]
mov bl, 0x28
daa
mul dword [ebp + 0x2a54f5e3]
ja 0x49e6c6
push esi
cdq
push es
dec edx
mov ds, word [edx - 0x3e]
mov dword [0xbdae7e78], eax
xchg edi, eax
adc dword [esi], edx
push esp
js 0x49e5f4
add dword [ebx - 0x194aef58], edx
inc eax
push ds
or byte [esi + 0x4cb5fa0a], ch
in ax, dx
stosb byte es:[edi], al
pop edx
sti
jnp 0x49e63d
jbe 0x49e5fd
cwde
rcr dword [esi - 0x55a8497], cl
lodsb al, byte [esi]
lea eax, [esi]
ror byte [ecx + 0x7365144b], cl
pop edi
stosb byte es:[edi], al
or ch, byte [eax + 0x52fd4661]
invalid
cmp cl, dh
div byte [ecx + 0x3ba92201]
nop
jnp 0x49e6d1
mov ebp, eax
imul esi, dword [edi], 4
ficom dword [edi + 0x76]
add byte [esi - 0x1974f518], cl
pop esi
sbb byte [ecx], dl
or cl, byte [ebx + 0x11185ee6]
mov eax, 0x31139b7e
adc byte [ecx + 0x66ea9669], 0x8d
mov bl, 0x97
xor ah, byte [edi - 0x66ac051c]
xor al, 0xd3
push esi
jns 0x49e6dc
ror byte [edx - 5], 0xa6
mov edi, 0x39561f3c
xor al, 0x39
das
and eax, 0xbca32ea
mov eax, dword [0x94823187]
xchg edx, eax
xchg ebp, eax
mov eax, 0xd5f58add
imul esi, dword [ecx], 0xf3fe71bd
push esi
cmp byte [ecx + ebx*4], bl
jno 0x49e77e
xchg esp, eax
push 0x18
cmp eax, 0x35d433a3
invalid
shr byte [edx - 0x45], 1
xor eax, 0x96a0ae2e
sub eax, 0xc2546e13
add dword [edi - 0x38a44b0d], 0x7e43160
ret

Function at 0x4ba5f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2410
dec esp
invalid
Function at 0x4ba602
Capabilities:
Write file on windows

Disassembly:
dec esp
add byte [ebx], bh
adc byte [ebx + ecx - 0x7d], dh
ror byte [eax], 0x41
cmp edx, dword [eax]
je 0x4ba613
add eax, 8
inc ecx
cmp eax, 0x4c24a0
jl 0x4ba604
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2410]
jne 0x4ba741
mov eax, dword [0x4c6d9c]
cmp eax, 1
je 0x4ba71b
test eax, eax
jne 0x4ba644
cmp dword [0x4c2338], 1
je 0x4ba71b
cmp edx, 0xfc
je 0x4ba741
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba67b
lea eax, [ebp - 0x1a4]
push 0x4bf960
push eax
call fcn.004bafd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb460
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba6be
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb460
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf95c
push edi
call fcn.004bd330
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf940
push eax
call fcn.004bafd0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bafe0
lea eax, [ebp - 0xa0]
push 0x4bf93c
push eax
call fcn.004bafe0
push dword [esi + 0x4c2414]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bafe0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf914
push eax
call fcn.004bd2a4
add esp, 0x2c
pop edi
jmp 0x4ba741
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2414]
push 0
push eax
push dword [esi]
call fcn.004bb460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x905a30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x79f015
lea edi, [esi - 0x39e015]
push edi
or ebp, 0xffffffff
jmp 0x905a52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x905a59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x905a48
mov eax, 1
add ebx, ebx
jne 0x905a6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x905a7c
jne 0x905a9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x905a9b
dec eax
add ebx, ebx
jne 0x905a88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x905a60
add ebx, ebx
jne 0x905a97
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x905aed
xor ecx, ecx
sub eax, 3
jb 0x905ab3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x905b22
sar eax, 1
mov ebp, eax
jmp 0x905abe
add ebx, ebx
jne 0x905abe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x905a8c
inc ecx
add ebx, ebx
jne 0x905acc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x905a8c
add ebx, ebx
jne 0x905ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x905ace
jne 0x905aea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x905ace
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x905b0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x905afe
jmp 0x905a4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x905b0c
add edi, ecx
jmp 0x905a4e
pop esi
mov edi, esi
mov ecx, 0x90d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x905b2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x905b2f
lea edi, [esi + 0x503000]
mov eax, dword [edi]
or eax, eax
je 0x905b97
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x505000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x505078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x905b55
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x50507c]
or eax, eax
je 0x905b91
mov dword [ebx], eax
add ebx, 4
jmp 0x905b72
call dword [esi + 0x50508c]
mov ebp, dword [esi + 0x505080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x905bcb
sub esp, 0xffffff80
jmp 0x42c620

Function at 0x4076fa
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x4076fa
lcall 0x5de5, 0x8b10c483
jmp loc.00c68be8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x63d13f30
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x140a6020
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219