joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51343c
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
push 0x7fc
mov ebx, dword [eax]
call dword [sym.imp.MSVCR80.dll_malloc]
pop ecx
add eax, 0x3fc
mov dword [ebx + 0x28], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
mov dword [eax + ebx], ecx
mov esi, ecx
neg esi
mov edi, eax
sub edi, ebx
mov dword [edi], esi
add ebx, 4
add edx, 1
add ecx, 1
cmp edx, 0x10
jl 0x51345b
cmp edx, 0x30
jge 0x5134a2
mov ebx, edx
shl ebx, 2
mov dword [eax + ebx], ecx
mov esi, ecx
neg esi
mov edi, eax
sub edi, ebx
mov dword [edi], esi
add ebx, 4
add edx, 1
mov esi, edx
and esi, 1
xor esi, 1
add ecx, esi
cmp edx, 0x30
jl 0x513480
cmp edx, 0xff
jg 0x5134ca
mov esi, ecx
neg esi
mov ebx, edx
shl ebx, 2
mov dword [eax + ebx], ecx
mov edi, eax
sub edi, ebx
mov dword [edi], esi
add ebx, 4
add edx, 1
cmp edx, 0xff
jle 0x5134b3
pop ebx
pop esi
pop edi
ret

Function at 0x5149e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
push esi
push esi
rdtsc
mov esi, dword [esp + 0x10]
mov ecx, eax
rdtsc
mov esi, dword [esi]
mov edi, eax
rdtsc
sub eax, edi
sub edi, ecx
mov edx, eax
lea esi, [edi*4]
shr edi, 2
add edi, esi
xor eax, eax
sub edi, edx
setge al
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop esi
pop edi
ret
Function at 0x609b6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x609b61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x609b607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x609b606a
add dl, dl
jne 0x609b6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x609b60dc
xor eax, eax
add dl, dl
jne 0x609b6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x609b617d
add dl, dl
jne 0x609b60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x609b60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x609b60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x609b60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x609b60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x609b6075
mov eax, 1
add dl, dl
jne 0x609b60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x609b60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x609b60e1
sub eax, ebx
mov ebx, 1
jne 0x609b6128
mov ecx, 1
add dl, dl
jne 0x609b610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x609b6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x609b6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x609b6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x609b613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x609b614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x609b6136
cmp eax, 0x7d00
jae 0x609b616d
cmp eax, 0x500
jb 0x609b6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x609b6075
cmp eax, 0x7f
ja 0x609b6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x609b6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x609b619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x609b6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x409b0e
Capabilities:
Encode data using xor

Disassembly:
or byte [esi + 0x1d], al
fisttp word [eax]
int1
add esp, dword [ebx - 0x50eae5f8]
Function at 0x1001d349
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x1006a1fc]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.10020dd0
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.1002a609
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.1002a609
push 0x1005af1c
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.1002a609
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.10020dd0
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d3ee
sub ecx, edx
cmp ecx, 6
jbe 0x1001d415
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.1002a609
pop ecx
pop ecx
test eax, eax
jne 0x1001d415
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1001d41c
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x1005af13
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.1002a609
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.10020850
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1001d496
mov ax, word [0x1005af48]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001df6b
add esp, 0x824
ret

Function at 0x1002a609
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1002a618
pop dword [ebp - 0x24]
mov eax, 0x1002a618
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x43ac3
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x52e0467a
sub ecx, 0x52dff97c
mov edx, eax
mov ebx, 0x10098e00
add ebx, dword [ebp - 0x24]
mov esi, 0xdc92ca01
add esi, 0x2e13ab38
mov dword [ebp - 0x20], 0x2b255fed
mov edi, dword [ebx]
sub dword [ebp - 0x1c], eax
sub edi, esi
mov dword [ebp - 8], 0x74b3eb63
mov dword [edx], edi
xor dword [ebp - 8], 0xb7804e9f
add edx, 4
add ebx, 0xb1d5d290
add ebx, 0x4e2a2d74
loop 0x1002a667
add eax, 0xc0cc2689
add eax, 0x3f350042
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x52a13c61
add ecx, 0xbd5ec39f
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10466058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104661a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1046607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1046606a
add dl, dl
jne 0x10466089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104660dc
xor eax, eax
add dl, dl
jne 0x10466096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1046617d
add dl, dl
jne 0x104660a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104660b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104660bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104660c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104660d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10466075
mov eax, 1
add dl, dl
jne 0x104660ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104660f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104660e1
sub eax, ebx
mov ebx, 1
jne 0x10466128
mov ecx, 1
add dl, dl
jne 0x1046610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10466119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10466105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10466075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1046613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1046614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10466136
cmp eax, 0x7d00
jae 0x1046616d
cmp eax, 0x500
jb 0x10466168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10466075
cmp eax, 0x7f
ja 0x10466170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10466075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1046619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10466075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404eb9
Capabilities:
Enumerate files on windows

Disassembly:
push 0x270
mov eax, 0x41ef37
call fcn.0040dc60
mov dword [ebp - 0x278], ecx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x113]
push ebx
mov dword [ebp - 0x27c], ebx
push eax
mov byte [ebp - 0x114], bl
call fcn.0040f99c
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x114]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404f10
xor eax, eax
jmp 0x40501d
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0xffffffffffffffff
push 0x401328
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.004115e3
add esp, 0x10
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404f09
xor esi, esi
test byte [ebp - 0x270], 0x10
je 0x404fbb
and dword [ebp - 0x120], 0
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404f7b
sub ecx, edx
push ecx
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x130]
call fcn.004115e3
and dword [ebp - 4], 0
lea eax, [ebp - 0x130]
or ebx, 1
push eax
mov dword [ebp - 0x27c], ebx
call fcn.004115e3
mov byte [ebp - 0x271], 1
test al, al
jne 0x404fc2
mov byte [ebp - 0x271], 0
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x404fdd
push 0
push 1
lea ecx, [ebp - 0x130]
and ebx, 0xfffffffe
call fcn.004115e3
cmp byte [ebp - 0x271], 0
je 0x404ffe
mov ecx, dword [ebp - 0x278]
lea eax, [ebp - 0x244]
push eax
call fcn.004115e3
mov esi, eax
test esi, esi
jne 0x405014
lea eax, [ebp - 0x270]
push eax
push edi
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x404f51
push edi
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, esi
call fcn.0040dce3
ret
Function at 0x40db9d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42326c]
jne 0x4148e1
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x424d00], eax
mov dword [0x424cfc], ecx
mov dword [0x424cf8], edx
mov dword [0x424cf4], ebx
mov dword [0x424cf0], esi
mov dword [0x424cec], edi
mov word [0x424d18], ss
mov word [0x424d0c], cs
mov word [0x424ce8], ds
mov word [0x424ce4], es
mov word [0x424ce0], fs
mov word [0x424cdc], gs
pushfd
pop dword [0x424d10]
mov eax, dword [ebp]
mov dword [0x424d04], eax
mov eax, dword [ebp + 4]
mov dword [0x424d08], eax
lea eax, [ebp + 8]
mov dword [0x424d14], eax
mov eax, dword [ebp - 0x320]
mov dword [0x424c50], 0x10001
mov eax, dword [0x424d08]
mov dword [0x424c04], eax
mov dword [0x424bf8], 0xc0000409
mov dword [0x424bfc], 1
mov eax, dword [0x42326c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x423270]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x424c48], eax
push 1
call fcn.00419129
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x40279c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x424c48], 0
jne 0x4149cd
push 1
call fcn.00419129
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x4115e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4115f2
pop dword [ebp - 0x10]
mov eax, 0xd20d4546
add eax, 0x2e33d0ac
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x8330f682
sub dword [ebp - 0x20], 0x34deb137
mov dword [ebp - 0x1c], 0x3b13f67b
sub dword [ebp - 0x1c], 0x8e0aa36
mov dword [ebp - 0x18], 0x8ea85623
add dword [ebp - 0x18], 0xbda3ee0b
mov dword [ebp - 0x14], 0xb16a86ad
add dword [ebp - 0x14], 0x4e957953
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x3025cabe
add dword [ebp - 0x20], 0x444c9e98
mov dword [ebp - 0x1c], 0x442813a5
add dword [ebp - 0x1c], 0xfd444dd0
mov dword [ebp - 0x18], 0x19ca0531
add dword [ebp - 0x18], 0x49a5673b
mov dword [ebp - 0x14], 0xc85c5e9d
sub dword [ebp - 0x14], 0xc85c5e9d
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x658f3c37
add eax, 0x9ab0d3f1
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3c7ba
push 0
call eax
mov ecx, 0x9a92618b
add ecx, 0x656ddeff
mov edx, eax
mov edi, 0x42a600
add edi, dword [ebp - 0x10]
mov esi, 0x83c732ef
sub esi, 0xb994aa93
sub dword [ebp - 0xc], 0x95c78597
mov ebx, dword [edi]
xor dword [ebp - 0xc], eax
xor ebx, esi
mov dword [edx], ebx
xor dword [ebp - 8], eax
add edx, 4
add edi, 0x4be54d4a
sub edi, 0x4be54d46
loop 0x411709
add eax, 0x2b8a8ba8
sub eax, 0x2b8996ad
mov ebx, eax
add eax, 5
mov ecx, 0x979076d2
sub ecx, 0x975076d2
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x313cf4f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x313cf4fa
pushal
call 0x313cf500
pop ebp
sub ebp, 0x10
sub ebp, 0x3cf4f0
mov al, byte [esp + 0x28]
add byte [eax], al
cmp al, 1
je 0x313cf524
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x313cf52d
mov eax, 0x3cf4f0
add eax, ebp
add eax, 0x63
mov ecx, 0x5e9
mov edx, 0x7a93ff1
xor byte [eax], dl
inc eax
dec ecx
jne 0x313cf544
jmp 0x313cf557
jp 0x313cf595
jp 0x313cf5d3
int 0xf1
int1
int1
jo 0x313cf591
or ecx, esi
int1
int1
cmp al, 0x49
div ecx
int1
int1
dec ebx
fyl2x
int1
int1
push es
adc esi, edx
cmp dword [edx + 0x70], edi
std
int1
int1
int1
xor al, 0x7c
xchg ebp, eax
aad 0xd
js 0x313cf578
aad 0xa1
cdq
jge 0x313cf512
push ecx
cdq
xchg ebx, eax
mov bh, bl
int1
invalid
aad 0x99
push eax
mov byte [ecx + 0x71], ah
sbb esp, esi
int1
int1
int1
sbb bh, bl
int1
int1
popal
jno 0x313cf5b1
hlt
int1
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
lodsb al, byte [esi]
jp 0x313cf61a
je 0x313cf5a0
stc
int1
int1
int1
jp 0x313cf610
std
int1
int1
int1
jp 0x313cf62e
jl 0x313cf594
loope 0x313cf5a5
int1
int1
int1
xor byte [eax], bl
sal bl, 0x72
xor esi, ebp
mov eax, 0xe0574fe
push cs
push cs
jp 0x313cf5a4
aad 0x7c
xchg ebp, eax
aad 0xf5
xor edi, ebp
int1
jp 0x313cf64e
aad 0xf5
int1
int1
int1
cdq
jge 0x313cf563
push ecx
cdq
xchg ebx, eax
mov bh, bl
int1
invalid
inc ebp
sal dword [eax + 3], cl
popal
inc ebp
inc ebp
rol edx, cl
and esi, dword [edx + 0x19]
jb 0x313cf635
hlt
mov ecx, 0xf1bf75fe
jne 0x313cf5e0
int1
int1
int1
invalid
in eax, dx
enter 0xa71, 0x19
invalid
jno 0x313cf63a
sbb esi, edi
jne 0x313cf61f
int1
int1
int1
jno 0x313cf643
sbb dh, bh
jne 0x313cf61d
invalid
int1
int1
int1
xchg edi, eax
jo 0x313cf64d
push cs
aam 0xfe
jne 0x313cf62c
int1
int1
int1
mov al, 0x18
cmp eax, 0xd80e0e0e
mov ebp, 0x3072f0c8
push cs
push cs
push cs
fdivr dword [ebp + 0x3072f0c8]
hlt
Function at 0x54aee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.Security
lea edi, [esi - 0xf0000]
push edi
or ebp, 0xffffffff
jmp 0x54af02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x54af09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54aef8
mov eax, 1
add ebx, ebx
jne 0x54af1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54af2c
jne 0x54af4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54af4b
dec eax
add ebx, ebx
jne 0x54af38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x54af10
add ebx, ebx
jne 0x54af47
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x54af9d
xor ecx, ecx
sub eax, 3
jb 0x54af63
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54afd2
sar eax, 1
mov ebp, eax
jmp 0x54af6e
add ebx, ebx
jne 0x54af6e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54af3c
inc ecx
add ebx, ebx
jne 0x54af7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54af3c
add ebx, ebx
jne 0x54af89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54af7e
jne 0x54af9a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54af7e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54afbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54afae
jmp 0x54aefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54afbc
add edi, ecx
jmp 0x54aefe
pop esi
mov edi, esi
mov ecx, 0x3eef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x54afda
cmp byte [edi], 0x11
jne 0x54afda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x54afdf
lea edi, [esi + 0x143000]
mov eax, dword [edi]
or eax, eax
je 0x54b057
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1bcfd0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1bd174]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x54b00c
mov ecx, edi
jns 0x54b03b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1bd17c]
or eax, eax
je 0x54b051
mov dword [ebx], eax
add ebx, 4
jmp 0x54b029
call dword [esi + 0x1bd178]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x54b088
cmp al, 0xef
ja 0x54b07b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x54b05d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x54b06a
mov ebp, dword [esi + 0x1bd180]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x54b0bc
sub esp, 0xffffff80
jmp 0x426bf7
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7ac64a29
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xd241070
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4f6072
Capabilities:
Packed with generic packer

Disassembly:
add esp, 4
test ebx, ebp
mov edi, 0x62765f13
call 0x4f6050
ja 0x4f5fd4
les eax, [ecx + ebp*8]
add eax, dword [eax]
add byte [eax], al
and ebp, ebx
dec ebp
mov ecx, 0x6ba3c8dd
mov ebx, 0xa9483411
xor ecx, 0x6ba3c8e0
push eax
call 0x4f6072
jmp 0x585424f9

Function at 0x410200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40e015
lea edi, [esi - 0xd015]
push edi
or ebp, 0xffffffff
jmp 0x410222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x410229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x410218
mov eax, 1
add ebx, ebx
jne 0x41023b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x410230
jne 0x41024c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410230
xor ecx, ecx
sub eax, 3
jb 0x410260
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4102d2
mov ebp, eax
add ebx, ebx
jne 0x41026b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x410278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41029c
inc ecx
add ebx, ebx
jne 0x410288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41027d
jne 0x410299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41027d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4102bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4102ad
jmp 0x41021e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4102bc
add edi, ecx
jmp 0x41021e
pop esi
lea edi, [esi + 0x4000]
mov ecx, 0x5d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4102de
cmp byte [edi], 0
jne 0x4102de
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4102e3
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x410352
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x142c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x143c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x410310
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x143d0]
or eax, eax
je 0x41034c
mov dword [ebx], eax
add ebx, 4
jmp 0x41032d
call dword [esi + 0x143cc]
mov ebp, dword [esi + 0x143d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x410386
sub esp, 0xffffff80
jmp 0x405000
Function at 0x10002b24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov byte [0xa345c635], al
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.10002740
push eax
push esi
push dword [ebp + 8]
call fcn.100026f5
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10002740
push eax
push esi
push dword [ebp + 8]
call fcn.100026f5
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10002730
push 0x888abea0
popfd
jl 0x10002bb5
invalid
invalid