joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5156
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], ebp
call fcn.004b3dee
out 0xcd, al
jno 0x4e51db
outsb dx, byte [esi]
bnd call 0x12eb0b18
sti
push ebx
cmp eax, 0xc76ca80f
shr dword [eax], 0x67
dec ebx
aad 0x88
adc cl, byte [ebx - 0x4a]
cmp al, 0x84
sar byte [edx], cl
invalid
insd dword es:[edi], dx
pop eax
dec ebx
add al, 0xac
inc esi
call 0x46018c4c
sub eax, 0x77d421cb
aam 0x77
mov byte [edx + 0x7d], ah
jno 0x4e51e9
aam 0x9a
mov esp, 0x14695397
call [eax]
push es
das
jnp 0x4e5221
pop ebp
push esi
jecxz 0x4e5246
xor al, 0x13
add ebp, dword [edi - 0xe]
call 0x7364802e
pushal
ret 0x466f
movsd dword es:[edi], dword [esi]
mov esp, 0xe22bd036
dec ecx
sub eax, 0x2f5bfad9
cli
pop ebx
das
arpl word [edx], bx
jp 0x4e5257
rep lodsb al, byte [esi]
inc esi
call 0x84fc6c33
mov bh, 7
pop ebp
inc esp
cmpsb byte [esi], byte es:[edi]
mov edi, edi
loopne 0x4e5218
aas
inc esi
cmp ah, byte [esi - 0x9084094]
push edi
xor byte [eax - 0x1b], dh
sub byte [ebx], dh
pop ds
xor ebx, dword [edi]
rcr edi, 1
xchg ecx, eax
retf
sub dword [esi + edi*4 + 0x23a9b4a3], esp
les ecx, [ebp - 0x2c]
dec ebp
invalid

Function at 0x4e61c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], ecx
lea edx, [ebx*8 + 0x4375363a]
mov dword [esp], eax
not dl
lea edx, [ebp - 0xd0]
pushfd
mov word [esp], 0xe5d0
lea esp, [esp + 4]
call fcn.00450ca0
lea edx, [edx + 0x1be19f23]
lea edx, [ebp - 0xd0]
pushal
pushfd
pushal
mov byte [esp], bh
lea esp, [esp + 0x44]
jmp fcn.004cef42

Function at 0x4e6825
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
pushal
add esp, 0x58
test ah, al
bt dx, si
cmp edi, 0x20
pushal
mov word [esp], 0xed3f
lea esp, [esp + 0x20]
jmp 0x4b9291
mov dword [esp], eax
push 0x71939633
pushfd
lea esp, [esp + 8]
call fcn.00459a35
pushal
inc edi
bt bp, 6
jmp 0x49c539

Function at 0x4e6fe6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
movzx ecx, byte [edi + ebx]
lea edx, [ebp - 0x77c1849d]
setb dh
pushfd
call fcn.004e61c2
lea esp, [esp + 0xc]
je 0x4b50e1
xchg edx, eax
pushfd
bswap ax
mov eax, 0x465fc4
jmp 0x4d809f

Function at 0x4ec5d3
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc edi
bt di, 0xa
bt cx, dx
add esp, 0x14
push ecx
cmp bx, bx
pushfd
push esp
cmp edi, 0x20
mov word [esp + 4], 0x616d
pushfd
lea esp, [esp + 0x10]
jl 0x4ed908
movzx cx, al
call fcn.004d54f5
lea esp, [esp + 0xc]
call fcn.00459a35
jmp 0x4b6ba2

Function at 0x4ed8e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x1daf63ce
call fcn.004b9e1a
lea esp, [esp + 0x2c]
jp 0x473ad7
pushfd
pushfd
mov dword [esp + 4], edx
pushal
mov word [esp + 8], sp
lea esp, [esp + 0x24]
call fcn.00459a35
lahf
add esp, 0x20

Function at 0x4eeec6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x4b50e1
setno dl
mov eax, 0x465fc4
mov cx, 0x29df
lea edx, [edx + 0x611b68b8]
pushfd
call fcn.004f3276

Function at 0x4f0093
Capabilities:
Execute anti-debugging instructions

Disassembly:
cdq
mov eax, 0x465fc4
call fcn.004f834d
mov byte [esp + 4], bh
mov byte [esp], 0x6f
push eax
lea esp, [esp + 0x30]
je 0x4b50e1
setg cl
jmp 0x4b3dcf
Function at 0x4f21b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x465fc4
mov dl, ah
xchg cl, dl
movzx ecx, byte [edi + ebx]
setne dh
call fcn.0048679d
and eax, 0xf
push dword [esp]
cmp al, 0xf
lahf
bswap ax
mov eax, 0x465fb8
mov byte [esp + 4], bl
push dword [esp + 4]
lea esp, [esp + 0xc]
je 0x4b50e1
xchg ah, dh
jmp 0x4dcba9

Function at 0x4f6172
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.004506e8
movzx bx, bl
movzx bx, cl
mov dword [esp], edi
movzx bx, cl
movzx bx, bl
movzx bx, al
mov ebx, eax
pushal
jmp 0x475633

Function at 0x4f76d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xc949b880
pushfd
lea ecx, [ecx + 0x3a06fe7c]
mov word [esp + 4], sp
call fcn.0049a524

Function at 0x4f834d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
movzx ecx, byte [edi + ebx]
pop edx
mov dh, al
bswap edx
mov dword [esp + 0x1c], ecx
push dword [esp]
mov byte [esp], 0x6d
movzx edx, al
mov dword [esp + 0x1c], eax
pushfd
lea edx, [ebp - 0xd0]
mov byte [esp + 4], ah
push edx
mov byte [esp], 5
pushfd
lea esp, [esp + 0x28]
call fcn.00450ca0
movzx dx, bl
mov dl, dh
pushal
lea edx, [ebp - 0xd0]
pushfd
pushal
mov byte [esp + 4], 0x44
pushfd
lea esp, [esp + 0x48]
jmp fcn.004cef42
Function at 0x422e50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
jmp 0x422e6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x422e71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x422e60
mov eax, 1
add ebx, ebx
jne 0x422e83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x422e78
jne 0x422e94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x422e78
xor ecx, ecx
sub eax, 3
jb 0x422ea8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x422f1a
mov ebp, eax
add ebx, ebx
jne 0x422eb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x422ec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x422ee4
inc ecx
add ebx, ebx
jne 0x422ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x422ec5
jne 0x422ee1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x422ec5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x422f04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x422ef5
jmp 0x422e66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x422f04
add edi, ecx
jmp 0x422e66
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x422f22
cmp byte [edi], 9
jne 0x422f22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x422f27
lea edi, [esi + 0x20000]
mov eax, dword [edi]
or eax, eax
je 0x422f9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x26fe8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x270c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x422f54
mov ecx, edi
jns 0x422f83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x270d0]
or eax, eax
je 0x422f99
mov dword [ebx], eax
add ebx, 4
jmp 0x422f71
call dword [esi + 0x270cc]
mov ebp, dword [esi + 0x270d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x422fd3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x401ae8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebx, section..text
push 0x67
push dword [0x4028f4]
call dword [sym.imp.USER32.dll_LoadBitmapA]
sub ebx, 0x1000
mov dword [0x4028f4], ebx
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401b11
push esp
mov eax, str.contents
mov dword [ebp - 4], eax
lea eax, [0x401187]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x4028f4]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x4028f4]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x4028f4]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x402904], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402904]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401bc9
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401bb0
pop ebp
ret 0x10

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x585692b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x2d3c5dd5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x7a8608
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a8612
pushal
call 0x7a8618
pop ebp
sub ebp, 0x10
sub ebp, 0x3a8608
jmp 0x7a862e
mov eax, 0x3a8608
add eax, ebp
add eax, 0x4c
mov ecx, 0x60d
mov edx, 0xaf3aa4f0
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a8645
jmp 0x7a8658
jnp 0x7a8697
jnp 0x7a86d5
int3
invalid
invalid

Function at 0x4b2b80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x70000]
push edi
jmp 0x4b2b9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b2ba1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2b90
mov eax, 1
add ebx, ebx
jne 0x4b2bb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b2bc4
jne 0x4b2be3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2be3
dec eax
add ebx, ebx
jne 0x4b2bd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b2ba8
add ebx, ebx
jne 0x4b2bdf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b2c35
xor ecx, ecx
sub eax, 3
jb 0x4b2bfb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b2c6a
sar eax, 1
mov ebp, eax
jmp 0x4b2c06
add ebx, ebx
jne 0x4b2c06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2bd4
inc ecx
add ebx, ebx
jne 0x4b2c14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2bd4
add ebx, ebx
jne 0x4b2c21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b2c16
jne 0x4b2c32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b2c16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b2c54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b2c46
jmp 0x4b2b96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b2c54
add edi, ecx
jmp 0x4b2b96
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b2c72
cmp byte [edi], 0x11
jne 0x4b2c72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b2c77
lea edi, [esi + 0xae000]
mov eax, dword [edi]
or eax, eax
je 0x4b2cef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb2f28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb307c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b2ca4
mov ecx, edi
jns 0x4b2cd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb3080]
or eax, eax
je 0x4b2ce9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b2cc1
call dword [esi + 0xb3090]
mov ebp, dword [esi + 0xb3084]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b2d23
sub esp, 0xffffff80
jmp 0x416310
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x378a09e2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x4a7c309b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0xdd8fc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push edi
push 0xb
mov dword [ebp - 0x10], ecx
xorps xmm1, xmm1
pop ecx
mov dword [ebp - 0x3c], 0x3c
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], 0x29
mov dword [ebp - 0x30], 0xffffff90
movups xmm0, xmmword [ebp - 0x3c]
push 0x34
mov dword [ebp - 0x1c], edx
psubd xmm1, xmm0
mov dword [ebp - 0x24], 0x3f
movaps xmm0, xmm1
mov dword [ebp - 0x20], 0xffffff91
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ebx, xmm1
pop edi
mov dword [ebp - 0x14], ebx
add edi, dword [ebp + eax*4 - 0x24]
inc eax
cmp eax, 2
jl 0xdd902e
movzx edx, bl
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], edx
cmp edx, edi
jge 0xdd91c6
push esi
mov esi, dword [0xe1a1a0]
mov dword [ebp - 0x38], 0x20
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0xffffff97
mov dword [ebp - 0x2c], 0x4e
mov dword [ebp - 0x28], 0xffffff60
push 0x3e
pop ecx
xor eax, eax
add ecx, dword [ebp + eax*4 - 0x38]
xor esi, 0xf825b8
inc eax
cmp eax, 3
jl 0xdd9074
push 0x56
mov dword [ebp - 8], ecx
xor eax, eax
pop ecx
add ecx, dword [ebp + eax*4 - 0x2c]
inc eax
cmp eax, 2
jl 0xdd908c
push 0x61
mov dword [ebp - 0xc], ecx
mov eax, 0xdd13e0
mov ecx, 0x26aa
pop edx
add ecx, edx
lea eax, [eax + 2]
cmp ecx, 0x5b6
ja 0xdd90bc
movzx edx, word [eax]
test edx, edx
jne 0xdd90a6
jmp 0xdd90c2
imul esi, esi, 0x7acbe21c
mov eax, dword [ebp - 8]
add esi, 0x3ce619d0
movzx eax, al
xor esi, 0xd5d876b7
mov dword [0xe1a1a0], esi
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0xc]
jge 0xdd91b2
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x4c], 0x59
mov dword [ebp - 0x48], 0x3e
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x40], 0xffffff41
movups xmm2, xmmword [ebp - 0x4c]
mov dword [ebp - 0x5c], 0x4c
mov dword [ebp - 0x58], 0x5d
mov dword [ebp - 0x54], 0x63
mov dword [ebp - 0x50], 0xfffffebf
movups xmm3, xmmword [ebp - 0x5c]
xorps xmm1, xmm1
mov eax, edi
psubd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd edx, xmm1
movups xmm1, xmm3
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
add edx, 0x1c
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ecx, xmm1
add ecx, 0x39
imul eax, ecx
mov ecx, dword [ebp - 0x10]
add eax, dword [ebp - 4]
movzx eax, byte [eax + ecx]
mov ecx, edi
imul ecx, edx
mov edx, dword [ebp - 0x1c]
add ecx, dword [ebp - 4]
inc bl
mov al, byte [eax + edx]
mov edx, dword [ebp - 0x10]
mov byte [ecx + edx], al
movzx eax, bl
mov dword [ebp - 4], eax
cmp eax, esi
jl 0xdd912f
mov esi, dword [0xe1a1a0]
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
inc bl
movzx eax, bl
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
cmp eax, edi
jl 0xdd906f
pop esi
pop edi
pop ebx
leave
ret
Function at 0xddb518
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x62
mov dword [ebp - 0xc], 0x2c
mov dword [ebp - 8], 0x31
mov dword [ebp - 4], 0xfffffef8
movups xmm1, xmmword [ebp - 0x10]
push esi
push edi
movaps xmm0, xmm1
mov edi, edx
mov edx, dword [ebp + 8]
mov esi, ecx
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
add eax, 0x49
cmp eax, edx
jae 0xddb57c
sub esi, edi
lea ecx, [eax + edi]
sub edx, eax
mov al, byte [esi + ecx]
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0xddb571
pop edi
pop esi
leave
ret
Function at 0xdee17f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
imul eax, dword [0xe1a550], 0x734fc97a
mov ecx, 0xdd2800
xor esi, esi
mov edx, esi
inc edx
lea ecx, [ecx + 2]
cmp edx, 0x177a
jg 0xdee1aa
cmp word [ecx], si
jne 0xdee197
jmp 0xdee1b0
imul eax, eax, 0xfbf2757f
push ebx
push 0x6f
mov edx, 0xdd2890
and eax, 0x55a225c4
pop ebx
mov esi, edx
mov cl, bl
sub cl, 0x30
cmp cl, 9
ja 0xdee1d3
inc esi
mov cl, byte [esi]
test cl, cl
jne 0xdee1c2
jmp 0xdee1d8
sub eax, 0x5e5e0a34
movzx esi, byte [0xe1a560]
push edi
imul ecx, eax, 0x77964069
mov edi, 0x23fa
mov dword [ebp - 4], 0xe1a560
jmp 0xdee207
inc dword [ebp - 4]
add edi, esi
cmp edi, 0x44e
ja 0xdee20d
mov esi, dword [ebp - 4]
movzx esi, byte [esi]
test esi, esi
jne 0xdee1f4
jmp 0xdee213
imul ecx, eax, 0x304d74d7
mov esi, edx
mov al, bl
pop edi
sub al, 0x30
cmp al, 9
ja 0xdee227
inc esi
mov al, byte [esi]
test al, al
jne 0xdee218
jmp 0xdee22d
add ecx, 0x4f86aa1d
mov eax, 0x1c6d
add eax, ebx
inc edx
cmp eax, 0xdf3
ja 0xdee245
movsx ebx, byte [edx]
test ebx, ebx
jne 0xdee232
jmp 0xdee24b
imul ecx, ecx, 0x1d7a9d85
mov eax, ecx
mov esi, 0xdd2878
xor eax, 0x7c874658
mov dl, 0x62
mov dword [0xe1a5b4], eax
pop ebx
sub dl, 0x30
cmp dl, 9
ja 0xdee270
inc esi
mov dl, byte [esi]
test dl, dl
jne 0xdee25f
jmp 0xdee27b
lea eax, [ecx + 0x57298163]
mov dword [0xe1a5b4], eax
movzx ecx, byte [0xe1a5a8]
mov edx, 0xa48
mov esi, 0xe1a5a8
jmp 0xdee29c
add edx, ecx
inc esi
cmp edx, 0x25e9
ja 0xdee2a2
movzx ecx, byte [esi]
test ecx, ecx
jne 0xdee28e
jmp 0xdee2ac
sub eax, 0x249fb532
mov dword [0xe1a5b4], eax
imul eax, eax, 0xe15ca415
pop esi
mov dword [0xe1a550], eax
leave
ret
Function at 0xdee8b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret
Function at 0xe0597f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [0xe1a980]
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x20], 0xb
mov edi, ecx
mov dword [ebp - 0x1c], 0x58
mov dword [ebp - 0x18], 7
mov ecx, 0x1dda
mov dword [ebp - 0x14], 0xffffff96
mov edx, 0xe1a980
jmp 0xe059cd
add ecx, eax
inc edx
cmp ecx, 0x199c
ja 0xe05b11
movzx eax, byte [edx]
test eax, eax
jne 0xe059bb
mov esi, dword [0xe1a938]
or esi, 0x3b22210b
add esi, 0x5725cd0a
mov dword [0xe1a938], esi
call fcn.00e04fb8
movups xmm0, xmmword [ebp - 0x20]
mov dword [ebp - 0x20], 0x2f
mov edx, edi
xorps xmm1, xmm1
mov dword [ebp - 0x1c], 0x2b
psubd xmm1, xmm0
mov dword [ebp - 0x18], 2
movaps xmm0, xmm1
mov dword [ebp - 0x14], 0xffffffa4
psrldq xmm0, 8
xorps xmm2, xmm2
paddd xmm1, xmm0
mov dword [ebp - 0x10], edx
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movups xmm0, xmmword [ebp - 0x20]
movd eax, xmm1
psubd xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
paddd xmm2, xmm0
movd ecx, xmm2
cmp eax, edi
je 0xe05b0a
cmp ecx, ebx
je 0xe05b0a
xor edx, edx
mov dword [ebp - 0x24], 0x2d
mov ecx, edx
mov dword [ebp - 0x20], 0x38
mov dword [ebp - 0x1c], 0x5e
mov eax, edx
mov dword [ebp - 0x18], 0x48
mov dword [ebp - 0x14], 0xfffffef5
sub ecx, dword [ebp + eax*4 - 0x24]
inc eax
cmp eax, 5
jl 0xe05a96
mov dword [ebp - 8], ecx
mov eax, edx
mov dword [ebp - 0x38], 0x45
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], 0x34
mov dword [ebp - 0x28], 0xffffff6a
sub edx, dword [ebp + eax*4 - 0x38]
inc eax
cmp eax, 5
jl 0xe05ac8
mov al, byte [ebx]
mov byte [ebp - 1], al
movsx eax, al
mov dword [ebp - 0xc], edx
cmp ecx, eax
je 0xe05b05
mov dl, byte [ebp - 1]
sub ebx, edi
mov eax, dword [ebp - 8]
xor esi, 0xc2edc27d
mov byte [edi], dl
inc edi
mov dl, byte [ebx + edi]
movsx ecx, dl
cmp eax, ecx
jne 0xe05ae9
mov edx, dword [ebp - 0xc]
mov dword [0xe1a938], esi
mov byte [edi], dl
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, edx
pop ebx
leave
ret
mov esi, dword [0xe1a938]
or esi, 0x6e1a8a30
jmp 0xe059d7
Function at 0xe10534
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xe1bdec]
mov dl, byte [0xe1be70]
xor eax, 0x6d8f6a5d
push esi
xor esi, esi
mov ecx, esi
test dl, dl
je 0xe1056f
inc ecx
cmp ecx, 0x1f5f
jl 0xe10565
cmp byte [ecx + 0xe1be70], 0
jne 0xe10551
jmp 0xe1056f
mov eax, dword [0xe1bea4]
add eax, 0x33a350f9
push ebx
push edi
lea edi, [eax + 0x4a6a3e43]
mov ecx, esi
sub eax, 0x68c3eeb0
cmp byte [0xe1bebc], cl
je 0xe105a0
inc ecx
cmp ecx, 0x12d8
jl 0xe1059a
cmp byte [ecx + 0xe1bebc], 0
jne 0xe10586
jmp 0xe105a0
lea eax, [edi - 0x5509172c]
imul edi, eax, 0x2edfff4
mov ecx, esi
test dl, dl
je 0xe105c8
inc ecx
cmp ecx, 0xe21
jg 0xe105c0
cmp byte [ecx + 0xe1be70], 0
jne 0xe105ac
jmp 0xe105c8
mov edi, eax
or edi, 0xaed7ef32
add eax, 0x8dc638da
imul eax, eax, 0x5fd626b
mov ecx, 0xa48c8563
mov edx, 0xf23
mov ebx, 0xe1bdd0
sub ecx, eax
movzx eax, byte [0xe1bdd0]
jmp 0xe105fb
add edx, eax
inc ebx
cmp edx, 0x2492
ja 0xe10601
movzx eax, byte [ebx]
test eax, eax
jne 0xe105ed
jmp 0xe10607
xor edi, 0x6a61e1e1
mov eax, esi
add ecx, 0x2c13d7b4
cmp byte [0xe1be94], al
je 0xe10630
inc eax
cmp eax, 0x2442
je 0xe1062a
cmp byte [eax + 0xe1be94], 0
jne 0xe10617
jmp 0xe10630
or ecx, 0x561cae22
movzx eax, byte [0xe1be70]
mov edx, ecx
and edx, 0x95120fc1
mov dword [ebp - 4], 0x640
mov ebx, 0xe1be70
jmp 0xe1065d
add dword [ebp - 4], eax
inc ebx
cmp dword [ebp - 4], 0x1c8a
ja 0xe10663
movzx eax, byte [ebx]
test eax, eax
jne 0xe1064d
jmp 0xe1066b
mov ecx, edi
and ecx, 0xe2bef30c
and ecx, 0x705d1326
mov dword [0xe1bdec], ecx
and edx, 0x38a935b4
cmp byte [0xe1be94], 0
pop edi
pop ebx
je 0xe106a2
inc esi
cmp esi, 0x1c77
jl 0xe1069c
cmp byte [esi + 0xe1be94], 0
jne 0xe10688
jmp 0xe106a2
lea edx, [ecx - 0x227c9106]
lea eax, [edx - 0x74447f09]
add edx, 0x620121e
mov dword [0xe1bea4], eax
mov dword [0xe1bdf4], edx
pop esi
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x15a328fc
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2a491906
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219