joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40594d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
xor esi, esi
lea edi, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x5c], esi
stosd dword es:[edi], eax
push 0x428a2e
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
stosd dword es:[edi], eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x2a], esi
stosd dword es:[edi], eax
mov word [ebp - 0x26], si
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x2c]
push eax
push eax
call fcn.004937d9
push 0x20
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x5c], 0x18
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x34]
push 1
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], esi
push eax
push 0x100020
lea eax, [ebp - 4]
mov dword [ebp - 0x50], 0x40
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
push ebp
call fcn.004c2e22
test eax, eax
js 0x4059d5
push dword [ebp - 4]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x54], esi
push 0x1000000
push 0x10
push esi
push eax
push 0xf001f
lea eax, [ebp - 8]
push eax
push ebp
call fcn.00483000
test eax, eax
js 0x4059d5
push 4
push 0x100000
push 1
lea eax, [ebp - 0x14]
push eax
push esi
push 0x3e8
push esi
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
call fcn.00497347
stc
test eax, eax
js 0x4059d5
mov ecx, dword [ebp - 0xc]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx + 0x3c]
mov ebx, dword [eax + ecx + 0x78]
add ebx, ecx
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x20]
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x24]
add eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
push ecx
call fcn.00465846
mov edi, esi
cmp dword [ebx + 0x14], esi
jbe 0x4059d4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + edi*4]
add eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
push ebp
call fcn.0046aadd
mov ecx, dword [ebp - 0x1c]
push 1
movzx eax, word [ecx + edi*2]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + eax*4 - 4]
add eax, dword [ebp - 0x10]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004af218
cmpsd dword [esi], dword es:[edi]
test eax, eax
je 0x4059ce
inc edi
cmp edi, dword [ebx + 0x14]
jb 0x405987
jmp 0x4059d4
mov esi, dword [ebp + 8]
mov esi, dword [esi + 1]
pop ebx
cmp dword [ebp - 4], 0
mov edi, dword [0x42d298]
je 0x4059e6
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], 0
je 0x4059f1
push dword [ebp - 8]
call edi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x405c66
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
movzx ebx, word [ecx + 6]
add edx, eax
push edi
test ebx, ebx
jle 0x405c9d
mov ecx, dword [ebp + 0xc]
mov edi, dword [edx + 0xc]
cmp edi, ecx
ja 0x405c95
mov eax, dword [edx + 8]
add eax, edi
cmp eax, ecx
ja 0x405ca7
add edx, 0x28
inc esi
cmp esi, ebx
jl 0x405c85
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [edx + 0x14]
sub eax, edi
add ecx, eax
cmp ecx, dword [ebp + 0x10]
jb 0x405cb6
or ecx, 0xffffffff
mov eax, ecx
jmp 0x405ca0

Function at 0x40da0e
Capabilities:
Reference google public dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x436838]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
pop esi
push esi
push esi
call fcn.0040e4da
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
je 0x40da85
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 0x35
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov word [ebp - 0x14], si
call fcn.004043d2
push 0x429acc
mov word [ebp - 0x12], ax
call fcn.00404312
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
sub esp, 0x10
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040ca76
test eax, eax
jle 0x40da7e
push dword [ebp + 0xc]
push ebx
call fcn.0040c8e6
push ebx
call fcn.0040e06a
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425d22
mov esp, ebp
pop ebp
ret 8

Function at 0x40df7a
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
call fcn.0040de40
mov edx, eax
mov eax, dword [ebp - 4]
test edx, edx
jle 0x40dfb0
mov cl, byte [esi + eax]
sub cl, 0x11
xor cl, 0x32
add cl, 0x21
xor cl, 0x12
mov byte [esi + eax], cl
inc esi
cmp esi, edx
jl 0x40df99
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41871a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [esi], ax
je 0x418731
xor al, al
jmp 0x418788
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41872d
movzx ecx, word [eax + 6]
add eax, 0xf8
push ebx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x418784
mov ebx, eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418762
sub ecx, dword [ebp + 8]
push ecx
push ebx
push edx
call fcn.00425cd2
add esp, 0xc
test eax, eax
je 0x41878f
inc edi
add ebx, 0x28
cmp edi, dword [ebp - 4]
jb 0x418757
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
imul ecx, edi, 0x28
mov edx, dword [ecx + eax + 0x14]
mov ecx, dword [ecx + eax + 0x10]
add edx, esi
mov eax, dword [ebp + 0xc]
push dword [eax + 0x90]
add eax, 0x10
push eax
push ecx
push edx
call fcn.00404296
cmp eax, 0xffffffff
setne al
jmp 0x418786

Function at 0x4187bc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [esi], ax
je 0x4187d3
xor al, al
jmp 0x41882a
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4187cf
movzx ecx, word [eax + 6]
add eax, 0x108
push ebx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x418826
mov ebx, eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418804
sub ecx, dword [ebp + 8]
push ecx
push ebx
push edx
call fcn.00425cd2
add esp, 0xc
test eax, eax
je 0x418831
inc edi
add ebx, 0x28
cmp edi, dword [ebp - 4]
jb 0x4187f9
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
imul ecx, edi, 0x28
mov edx, dword [ecx + eax + 0x14]
mov ecx, dword [ecx + eax + 0x10]
add edx, esi
mov eax, dword [ebp + 0xc]
push dword [eax + 0x90]
add eax, 0x10
push eax
push ecx
push edx
call fcn.00404296
cmp eax, 0xffffffff
setne al
jmp 0x418828
Function at 0x4187c1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [esi], ax
je 0x4187d3
xor al, al
jmp 0x41882a
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4187cf
movzx ecx, word [eax + 6]
add eax, 0x108
push ebx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x418826
mov ebx, eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418804
sub ecx, dword [ebp + 8]
push ecx
push ebx
push edx
call fcn.00425cd2
add esp, 0xc
test eax, eax
je 0x418831
inc edi
add ebx, 0x28
cmp edi, dword [ebp - 4]
jb 0x4187f9
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
imul ecx, edi, 0x28
mov edx, dword [ecx + eax + 0x14]
mov ecx, dword [ecx + eax + 0x10]
add edx, esi
mov eax, dword [ebp + 0xc]
push dword [eax + 0x90]
add eax, 0x10
push eax
push ecx
push edx
call fcn.00404296
cmp eax, 0xffffffff
setne al
jmp 0x418828

Function at 0x41885e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
mov eax, 0x5a4d
push edi
mov edi, dword [ebp + 8]
cmp word [edi], ax
je 0x41887c
xor eax, eax
jmp 0x418904
push esi
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
jne 0x41889a
push dword [esi + 0x80]
push esi
call fcn.0041a348
test eax, eax
jne 0x41889e
xor eax, eax
jmp 0x418903
push ebx
lea ebx, [eax + edi]
jmp 0x4188f0
mov eax, dword [ebx]
test eax, eax
jne 0x4188ad
mov eax, dword [ebx + 0x10]
push eax
push esi
call fcn.0041a348
add eax, edi
mov dword [ebp + 8], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x4188ed
mov ebx, dword [ebp - 4]
js 0x4188db
push ecx
push esi
call fcn.0041a348
add eax, 2
add eax, edi
push eax
call fcn.0041a2fc
add ebx, eax
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp + 8], eax
mov ecx, dword [eax]
test ecx, ecx
jne 0x4188c2
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
add ebx, 0x14
push 0x14
push ebx
mov dword [ebp - 8], ebx
call fcn.0041a324
test al, al
je 0x4188a4
mov eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x41890c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
mov eax, 0x5a4d
push edi
mov edi, dword [ebp + 8]
cmp word [edi], ax
je 0x41892a
xor eax, eax
jmp 0x4189bc
push esi
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
jne 0x418948
push dword [esi + 0x90]
push esi
call fcn.0041a39a
test eax, eax
jne 0x41894c
xor eax, eax
jmp 0x4189bb
push ebx
lea ebx, [eax + edi]
jmp 0x4189a8
mov eax, dword [ebx]
test eax, eax
jne 0x41895b
mov eax, dword [ebx + 0x10]
push eax
push esi
call fcn.0041a39a
lea ecx, [edi + eax]
mov eax, dword [ecx]
mov dword [ebp - 8], ecx
mov ecx, dword [ecx + 4]
or eax, ecx
je 0x4189a5
mov ebx, dword [ebp - 8]
and ecx, 0x80000000
xor eax, eax
or eax, ecx
jne 0x418996
push dword [ebx]
push esi
call fcn.0041a39a
add eax, 2
add eax, edi
push eax
call fcn.0041a2fc
add dword [ebp - 4], eax
mov ecx, dword [ebx + 0xc]
add ebx, 8
mov eax, dword [ebx]
or eax, ecx
jne 0x418974
mov ebx, dword [ebp + 8]
add ebx, 0x14
push 0x14
push ebx
mov dword [ebp + 8], ebx
call fcn.0041a324
test al, al
je 0x418952
mov eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x41f08c
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ebp + 0x10], al
jne 0x41f128
cmp byte [eax + ecx], 0x48
jne 0x41f0b1
cmp byte [eax + ecx + 1], 0x8b
jne 0x41f0b1
cmp byte [eax + ecx + 2], 5
je 0x41f0b9
inc eax
cmp eax, 0x40
jb 0x41f09d
jmp 0x41f0cc
mov dword [eax + ecx], 0x90909090
mov word [eax + ecx + 4], 0x9090
mov byte [eax + ecx + 6], 0x90
mov eax, dword [ebp + 0xc]
jmp 0x41f120
mov dl, byte [eax + ecx]
cmp dl, 0x48
jne 0x41f120
cmp byte [eax + ecx + 1], 0x81
jne 0x41f0ee
cmp byte [eax + ecx + 2], 0xc4
jne 0x41f0ee
cmp byte [eax + ecx - 5], 0xe8
je 0x41f16a
cmp dl, 0x48
jne 0x41f120
cmp byte [ecx + eax + 1], 0x33
jne 0x41f120
cmp byte [ecx + eax + 2], 0xcc
jne 0x41f120
cmp byte [ecx + eax + 3], 0xe8
jne 0x41f120
add eax, 3
mov word [ecx + eax + 1], 0x9090
mov byte [eax + ecx], 0x90
mov byte [ecx + eax + 3], 0x90
mov byte [eax + ecx + 4], 0x90
dec eax
cmp eax, 1
ja 0x41f0d1
jmp 0x41f177
cmp byte [eax + ecx], 0xa1
je 0x41f136
inc eax
cmp eax, 0x40
jb 0x41f128
jmp 0x41f142
mov dword [eax + ecx], 0x90909090
mov byte [eax + ecx + 4], 0x90
mov eax, dword [ebp + 0xc]
jmp 0x41f162
mov dl, byte [eax + ecx]
cmp dl, 0x8b
jne 0x41f156
cmp byte [eax + ecx + 1], 0xe5
je 0x41f15b
cmp dl, 0xc9
jne 0x41f162
cmp byte [eax + ecx - 5], 0xe8
je 0x41f16a
dec eax
cmp eax, 1
ja 0x41f147
jmp 0x41f177
mov byte [eax + ecx - 1], 0x90
mov dword [eax + ecx - 5], 0x90909090
pop ebp
ret 0xc

Function at 0x41f0f8
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ebp + 0x10], al
jne 0x41f128
cmp byte [eax + ecx], 0x48
jne 0x41f0b1
cmp byte [eax + ecx + 1], 0x8b
jne 0x41f0b1
cmp byte [eax + ecx + 2], 5
je 0x41f0b9
inc eax
cmp eax, 0x40
jb 0x41f09d
jmp 0x41f0cc
mov dword [eax + ecx], 0x90909090
mov word [eax + ecx + 4], 0x9090
mov byte [eax + ecx + 6], 0x90
mov eax, dword [ebp + 0xc]
jmp 0x41f120
mov dl, byte [eax + ecx]
cmp dl, 0x48
jne 0x41f120
cmp byte [eax + ecx + 1], 0x81
jne 0x41f0ee
cmp byte [eax + ecx + 2], 0xc4
jne 0x41f0ee
cmp byte [eax + ecx - 5], 0xe8
je 0x41f16a
cmp dl, 0x48
jne 0x41f120
cmp byte [ecx + eax + 1], 0x33
jne 0x41f120
cmp byte [ecx + eax + 2], 0xcc
jne 0x41f120
cmp byte [ecx + eax + 3], 0xe8
jne 0x41f120
add eax, 3
mov word [ecx + eax + 1], 0x9090
mov byte [eax + ecx], 0x90
mov byte [ecx + eax + 3], 0x90
mov byte [eax + ecx + 4], 0x90
dec eax
cmp eax, 1
ja 0x41f0d1
jmp 0x41f177
cmp byte [eax + ecx], 0xa1
je 0x41f136
inc eax
cmp eax, 0x40
jb 0x41f128
jmp 0x41f142
mov dword [eax + ecx], 0x90909090
mov byte [eax + ecx + 4], 0x90
mov eax, dword [ebp + 0xc]
jmp 0x41f162
mov dl, byte [eax + ecx]
cmp dl, 0x8b
jne 0x41f156
cmp byte [eax + ecx + 1], 0xe5
je 0x41f15b
cmp dl, 0xc9
jne 0x41f162
cmp byte [eax + ecx - 5], 0xe8
je 0x41f16a
dec eax
cmp eax, 1
ja 0x41f147
jmp 0x41f177
mov byte [eax + ecx - 1], 0x90
mov dword [eax + ecx - 5], 0x90909090
pop ebp
ret 0xc

Function at 0x46481c
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 4], 0x4f
push 0x7228975a
mov ebx, dword [ebx + 0x38f5b]
call fcn.00492bdb
Function at 0x464831
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebp
jmp 0x460594
mov dword [esp], 0x69e6ae92
pushfd
lea esp, [esp + 4]
jmp fcn.0045a5f0
movzx ax, dl
setle ah
bswap eax
nop
lea eax, [esi + 0x69720a09]
mov ax, ax
bswap ax
pop eax
pushal
lea esp, [esp + 0x20]
jl 0x4c7c32
pushfd
mov word [esp], bp
xchg dword [esp + 4], eax
mov byte [esp], 0x55
jmp 0x48b873
call fcn.00491629
cwde
cld
invalid
call fcn.004aa314
pushal
pushfd
mov dword [esp + 0x20], 0x3e61931c
lea esp, [esp + 0x20]
jnp 0x45dba7
pushal
mov byte [esp], al
pushfd
mov dword [esp + 0x20], 0x69e6ae92
pushal
pushfd
lea esp, [esp + 0x44]
jmp fcn.0045a5f0

Function at 0x464a5f
Capabilities:
Encode data using xor

Disassembly:
inc ecx
inc ecx
add byte [edi + edi*8 - 0x63f7db8c], bl
xchg dword [esp + 0x30], ebx
call fcn.0048e848
jnp 0x464a28
jb 0x464aa1
sub byte [eax - 5], ah
xor edi, ecx
sbb ebp, dword [esi + 0x4b4c54fa]
add al, 0x49
aas
sbb ch, byte [esi + 0x13]
jne 0x464a36
lock sub byte [edi - 0xa], bh
xchg edx, eax
jp 0x464ab3
invalid
cdq
rcl dword [ecx + ebx + 0x42]
mov dl, 0xf0
jo 0x464b25
nop
loope 0x464a6c
jne 0x464ab7
xchg ebp, eax
pop ss
pushfd
inc esp
shr dword gs:[edx], 1
mov dword [0xde608ed4], eax
test eax, 0x993ef8b9
aam 0x8e
pushal
fisubr word [ecx - 0x66c10747]
xor al, 0x4b
pop ss
push esp
push cs
xchg edi, eax
invalid
Function at 0x4656b8
Capabilities:
Encode data using xor

Disassembly:
ret 5
inc esi
scasb al, byte es:[edi]
cld
or byte [edi + edi*8 - 0x3dbbdb8c], al
dec eax
add byte [edi + eax*4 - 0x63cfdbbc], bl
pushfd
xchg dword [esp + 0x30], eax
pushfd
pushfd
xchg dword [esp + 0x30], eax
pushfd
call fcn.0047f15c
or ebp, dword [esi]
sbb ebp, dword [ebp]
mov byte [esi + 0x63], ch
leave
mov ah, 0xef
jns 0x4656f6
test ch, dh
js 0x4656ad
scasd eax, dword es:[edi]
popal
inc esi
out dx, al
mov ecx, 0x9f082483
test dword [edx], esp
push ss
xchg ecx, eax
ja 0x465713
in al, dx
mov ebx, 0xfd8bea9e
bound eax, qword [eax]
leave
movsb byte es:[edi], byte gs:[esi]
inc edi
dec esp
mov ebp, 0xbf6323c4
and esp, dword [ebx - 0x41]
cmc
cmc
js 0x465758
test eax, 0xfb444d18
jb 0x465692
xchg esi, eax
jae 0x465712
jp 0x46569b
out 0x5d, al
push ss
pop edi
sub dword [esi - 0xc], ebp
jg 0x4656f2
adc ecx, dword [edi + eax*4 - 0x46f5efc]
add al, 0xa1
nop
sti
mov eax, dword [0x5ea5fb90]
movsd dword es:[edi], dword [esi]
pop esi
sbb eax, 0xed40208d
and ah, byte [edi]
jne 0x465718
jae 0x46577e
in al, dx
xchg ebx, eax
iretd
fcomp qword [esi + 0x1f]
dec ebx
imul ebp, dword [ebp - 0x7a], 0xffffffe9
sbb byte [edi + 0x2c1fff4d], ch
xchg ecx, eax
movsd dword es:[edi], dword [esi]
invalid
cmp ebx, esp
pushfd
inc esi
jle 0x465785
loopne 0x4657b3
jnp 0x46578d
je 0x4657e1
out 0xb4, eax
je 0x46575b
adc al, 0x6b
fist dword [edi - 0xa]
cmc
push esp
xor al, 0x45
sbb byte [edi + 3], bl
jo 0x46578f
popfd
invalid
in eax, 0x1d
adc byte [esi - 0x40513021], al
sahf
ljmp 0xa7e1
adc dword [esi - 0x237beb7d], eax
pushfd
inc esi
movsd dword es:[edi], dword [esi]
xor al, 0x39
sub al, 0x5c
aaa
cmpsd dword [esi], dword es:[edi]
push esi
out 0xb4, eax
or eax, ebp
sbb edi, dword [eax - 0x18]
pushfd
pushfd
xlatb
push ecx
push esi
and eax, 0xadacfb3d
fstp xword [edx + 0xe]
push ss
or esi, esi
in al, dx
xchg esp, eax
jp 0x4657c9
mov edx, 0xad84e7a8
test al, 0x34
jo 0x465879
lea di, [bx - 0x2385]
sahf
in eax, 0x3f
push 0xf4e471b
mov bh, 0xee
loopne 0x46586d
movsd dword es:[edi], dword [esi]
sub byte [ebp - 0x16], dh
pop ds
mov ebx, 0x9821a74f
invalid
ret 0x9d7c
and al, 0x1d
sbb al, 0x8d
wait
adc al, 0xc1
push ebx
dec ebx
pushfd
lea esp, [esp + 0x50]
jne 0x4a926f
xchg dword [esp], ebx
push 0xb8c14349
push dword [esp + 4]
ret 8
Function at 0x473c46
Capabilities:
Encode data using xor

Disassembly:
call fcn.0048db60
aad 0x28
xor dword [edi - 0x33], edx
ficomp dword [ecx + 0x5013cbd1]
add esi, dword [ebx + 0x6d]
insd dword es:[edi], dx
add al, 0x84
mov ah, 0xf3
jp 0x473c6d
or bl, byte [ebp + 0x5b2d386f]
and ah, byte [esi - 0x56]
std
xchg byte [eax - 0x35], bh
aaa
xchg ecx, eax
push ecx
sbb byte [ecx - 0x139abd16], bl
pushfd
leave
mov edi, 0x89ff4e59
out 0x7c, al
xchg byte [ebx + 0x5faaa556], dh
test eax, 0xa3812db9
sub eax, dword [edx - 0x5b]
inc edx
movsd dword es:[edi], dword [esi]
stosb byte es:[edi], al
xchg ebp, eax
ficom dword [edx]
add dword [ebp + 0x28], 0x47
mov bh, 0x52
mov dh, 0xf1
push esp
xor al, 0x41
inc ebp
pop ds
push es
mov ch, 0x75
clc
jnp 0x473c8a
in al, dx
loope 0x473c58
mov al, 0xaf
mov bl, 0x30
popfd
bnd jo 0x473cad
jmp [edi - 0x66]
outsd dx, dword [esi]
lcall 0x42bc, 0xd1b059e9
push ds
or eax, 0xebe6014e
ret 0x7c55

Function at 0x478691
Capabilities:
Encode data using xor

Disassembly:
pushfd
bswap ebx
mov dword [esp + 0x4c], eax
cwde
xchg al, bl
movsx bx, dl
mov eax, 0x408e72
call fcn.0047297c

Function at 0x48b469
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x49b7bc
mov byte [esp], 0xe9
mov byte [esp], 0x6c
push esp
nop
pushal
xchg dword [esp + 0x24], eax
push ebp
push dword [esp + 4]
mov eax, dword [esp + 0x30]
pushfd
push eax
lea esp, [esp + 0x34]
jnp 0x489ae9
lea eax, [eax + 1]
pushal
pushal
lea esp, [esp + 0x40]
jno 0x4a7ae3
pushal
mov dword [esp + 0x24], eax
cwde
push 0x6f3b9c28
movzx ax, al
mov eax, 0x403c12
call fcn.00480ce4
push 0xccb1c77d
jmp 0x4a8d8b
pushal
mov dword [esp + 0x28], eax
push 0xfed17f54
pop eax
jmp 0x49b8c6

Function at 0x4d9861
Capabilities:
Encode data using xor

Disassembly:
sbb eax, dword [edx + 0x3d]
jne 0x4d98c7
ret
lea esp, [esp + 0x24]
jae 0x4cdbdc
shl cl, cl
bsr cx, sp
mov ebx, eax
shl ecx, 3
btr cx, bx
call fcn.004cf638
in al, dx
adc dword [eax + 0x28], esp
xor eax, 0x84501853
pushfd
xchg esi, eax
mov esp, 0xf3b454fb
jp 0x4d9880
into
lodsd eax, dword [esi]
dec edx
out 0x59, eax
scasd eax, dword es:[edi]
push cs
jae 0x4d98ed
mov edi, 0xa5d859bc
sub bh, al
xor dword [esp + esi*4 - 0x18085458], ecx
inc ecx
push edx
push eax
daa
inc edi
or dword [ecx + 0x18652e22], edi
sub ebx, esp
jle 0x4d9856
sbb byte [ecx], ch
jecxz 0x4d9934
lahf
xor eax, 0xd9fcf139
test byte gs:[edx], bh
xor eax, dword [esi + 0x42]
xor edx, dword [ebp - 0x15]
mov esp, 0x72163770
out 0xa1, eax
and dword [ecx + ecx*2], 0x3f
aaa
push ss
jb 0x4d98b2
mov eax, dword [0x3f492483]
cmp cl, byte [esi - 0x36]
invalid
pop ebp
fimul word [0x4905a8ff]
invalid
inc esp
push ds
cmp eax, 0x6c9d6025
ret
Function at 0x402594
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x4025a2
call dword [0x40b004]
or eax, eax
je 0x4025a3
ret
mov al, 1
jmp fcn.00402614

Function at 0x4025ac
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x4025ba
call dword [0x40b008]
or eax, eax
jne 0x4025bb
ret
mov al, 2
jmp fcn.00402614

Function at 0x403e41
Capabilities:
Encode data using xor

Disassembly:
dec edi
jl 0x403e8a
ror byte cs:[ebp + 0x6d], 0xb5
invalid
mov dh, 0x8a
fbld tbyte [0x8bb177ce]
fsubrp st(5)
shr dword [ebp + 0x38], 1
jae 0x403eaf
in eax, 0xd1
insd dword es:[edi], dx
cmp byte [ebx + 0x16], dh
sub byte [eax + esi*8], 0x33
fisttp dword [ebx + 0x64]
push es
outsd dx, dword [esi]
xor ebp, dword [ebp + 0x52ba4f1a]
and eax, 0x66
add eax, 0x4a96082f
dec edx
in al, 0x7e
mov ebp, 0x67b1847
loope 0x403e93
mov ecx, 0x680d14ef
mov dh, 0xd6
or dword [ebx + esi*8 - 0x80], eax
mov dword [0xbf43cd1a], eax
mov ecx, 0x963f457e
and byte [ebx - 0x40bc32e6], 0xb9
jle 0x403f12
inc ebx
mov edi, 0x3f457eb9
aas
xchg esi, eax
sbb esi, esp
xor eax, 0xc04a0ce6
add byte [esp + eax*2], bh
sub esp, esp
pushal
fisttp word [edx]
mov edx, 0x8acae581
jg 0x403ec3
dec edx
mov bl, 0x1c
in eax, dx
mov edx, ebx
je 0x403ec8
push cs
dec edx
ret
dec esi
sbb byte [ebx], al
dec ecx
adc byte [ecx + 0xd], dl
mov byte [ebp + 0x5e99d2e2], 0xfb
ja 0x403eaf
dec esp
int1
pop edx
adc dword [ebx], ecx
aaa
adc byte [ebx], dh
mov dh, 0xef
wait
outsb dx, byte [esi]
retf 0xc425

Function at 0x407890
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4078ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x4078ae
shr eax, 1
dec edx
jne 0x40789f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407898
pop esi
ret

Function at 0x4078c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078e7
call fcn.00407890
push 1
push 0x40c558
call fcn.004043fc
mov eax, edi
test esi, esi
je 0x407912
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078ed
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x40c087
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x14], edi
mov ebx, ecx
je 0x40c0c5
call fcn.004565a6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40c0c5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40c0dc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push 1
test edi, edi
pop eax
je 0x40c0dc
push dword [esp + 0x18]
mov eax, dword [ebx]
mov ecx, ebx
push edi
push dword [esp + 0x18]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
ret 0xc