joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00431543
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0043c098
xor ebx, ebx
cmp eax, ebx
jne 0x4314fe
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00431543
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00438d77
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.0048a66c
add esp, 0x10
test eax, eax
jne 0x431419
push esi
call fcn.0042ea02
mov esi, eax
cmp esi, ebx
pop ecx
je 0x431419
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x431404
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x431419
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x431412
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0043d5ab
cmp byte [esp + 0x13], bl
je 0x431449
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00431580
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4314b9
push 0x14
call fcn.004898d9
cmp eax, ebx
pop ecx
je 0x431473
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x431475
xor edi, edi
cmp edi, ebx
je 0x4314b9
push esi
push edi
call fcn.00430aa6
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00430b6e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00430c97
add esp, 0x18
call fcn.00431543
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0043b765
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4314d0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4314e2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x431525
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x431525
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00430b6e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00430c97
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452b85
Capabilities:
Encode data using xor

Disassembly:
fimul dword [ecx + edi*4 - 0x11]
fistp word [eax + 0x33738756]
scasb al, byte es:[edi]
out 0xd6, eax
xlatb
xor dword [ecx], ebp
wait
sal dword [esi + 0x7677f9aa], 0xc5
stosb byte es:[edi], al
stc
ja 0x452b52
lds esi, [eax - 0x6db999a2]
stosb byte es:[edi], al
stc
ja 0x452b52
lds esi, [eax - 0x6db999a2]
xchg esi, eax
and al, 0x98
add esi, edi
cmc
jns 0x452b4f
lds eax, [eax - 0x39883aee]
enter 0xffffffffffffdf45, 0x57
aas
lds edx, [0xec9d4046]
push edi
push ds
push ss
add eax, 0x1adbdafb
arpl word [ebx + 0x2d], dx
mov cl, 0x60
add edi, esi
or dword [esi - 0x33495222], edx
and ebx, eax
call 0x5926d3dc
js 0x452b66
push ecx
adc dword [edx + ebx*8], ecx
cld
shr dword [ecx - 0x222e5d5b], 1
aaa
add ecx, ebx
or byte [ecx], ah
jbe 0x452b64
das
mov cl, 0xf7
arpl word [eax], di
cmp byte [edx - 0x4b], ch
jb 0x452b9f
iretd
ja 0x452ac4
insb byte es:[edi], dx
add dh, dh
push eax
cmp byte [ecx + 0x4c], bl
test al, 0x8c
mov ah, 0xac
into
pop esp
je 0x452b42
out dx, eax
jmp 0x15515f8c
invalid
jecxz 0x452b7a
sbb edi, esi
nop
mov al, 0xfb
sub al, 0
adc eax, 0xd81d8e15
into
adc byte [ebx - 0x29], 0xbf
or ebx, esp
xchg esp, eax
xchg esp, eax
iretd
fcom qword [esp + edx*4 + 0x1f47cf]
jo 0x452bd7
adc dword [eax + 0x10], edi
sub al, 3
jge 0x452be7
or dword [esi - 0x19f344fa], ebp
xor byte [eax + 0x4c], al
add al, 0xbb
jno 0x452bbf
inc edi
dec esp
cmc
sbb byte [eax + eax*8], dh
invalid
ret
mov dh, 0x82
loopne 0x452be1
sbb dword [ebx + 0x52fdd9d5], edi
xor byte [ecx], bl
invalid
sub eax, 0x1c2a9e50
add byte [ebp - 2], 0x84
push 0xc111375
in eax, dx
sub dl, dl
pushal
dec eax
jne 0x452bf6
adc dword [ebp*8 + 0x4860d228], ecx
shl byte [eax + 0x48], cl
call 0x65272461
cdq
jae 0x452b99
insb byte es:[edi], dx
xor al, 0xe4
pop ecx
pop edi
add al, 0x20
wait
xchg edi, eax
ret
Function at 0x45b7cb
Capabilities:
Encode data using xor

Disassembly:
popfd
and byte [ecx + 0x584f5966], ah
fnstcw word [edi + 2]
fsubr dword [ebp - 0x2f]
pop edx
aad 0xe1
adc ah, cl
xchg edi, eax
pop ecx
pop ebp
pushal
mov dword [edi + 0x29444c47], ebp
wait
mov bh, 0x3e
stosb byte es:[edi], al
adc eax, dword [ecx]
jge 0x45b847
ljmp 0xef0d:0x47f6529c
or eax, 0xdb54eb63
pop ebp
or eax, 0xa055093a
loop 0x45b8bc
mov esi, 0x9876badb
das
in al, 0x2f
stosb byte es:[edi], al
iretd
scasd eax, dword es:[edi]
adc eax, 0x14143ae
invalid
xchg esi, ebx
sub dword [edx], 0x61
push esp
cmp ah, ah
jo 0x45b86a
out 2, al
arpl word [edi - 0x19], cx
invalid
dec edi
out 0x8f, eax
imul edx, dword [eax - 0x3db9111b], 0x52
aam 3
aaa
sub esp, dword [edi - 0x4cdaed9a]
jns 0x45b872
and eax, 0x83de79b3
sub byte [edx - 0x4c], al
or esp, dword [edx - 0x75c5bc7c]
sub dword [eax], 0x42
mov ah, 0xb
mov byte [0x8a3a4384], al
lahf
xchg esp, eax
mov ah, 0x6b
jns 0x45b87f
fadd dword [ecx - 0x6fc79c10]
push ss
mov eax, 0x4385d79c
xlatb
mov bh, 0x55
das
lodsd eax, dword [esi]
std
lahf
js 0x45b8e3
int 0xf5
std
jle 0x45b8ff
cmp eax, 0xfc7976bf
sub al, 0xbb
dec edx
jle 0x45b8a0
outsb dx, byte [esi]
pop esi
cmc
mov gs, word [ecx - 0x6e063f14]
invalid
cmp byte [ecx + 0x60cc82a4], bh
inc edx
cdq
leave
push edx
das
leave
xor bh, byte [ecx - 0x7a33d2a8]
ret 0x93fc
cmp ebp, 0x441c3adb
ja 0x45b890
push esi
or esp, dword [edx - 0x33]
std
sbb esi, dword [0xfdba5b1e]
rcl bl, 1
fisttp qword [ecx]
mov ah, 0x17
and dword [ebx + 0x3c], edi
std
and edx, dword [esi - 0x32]
insd dword es:[edi], dx
add eax, 0xc8de2374
fmulp st(0)
salc
jb 0x45b924
pop ebx
or al, 0xa8
fst dword [ebx - 0x6e]
push es
loop 0x45b999
call 0x2e224ad4
mov dl, 0x5b
mov dl, 0xb7
inc ebx
jb 0x45b95f
int1
and byte [edx + 0x71db4b16], 0x58
popfd
jmp 0x45b960
mov cl, bl
adc cl, byte [edi]
enter 0x52fb, 0xffffffffffffffa5
out dx, al
movsb byte es:[edi], byte [esi]
retf
fidiv dword [edx + edi*4 - 0x1cdc3be3]
push esi
mov dword [0x6d5cd078], eax
xchg esi, eax
sub eax, ecx
sub dl, byte [edx + 5]
pop ebx
leave
xor esp, edi
push eax
xchg esp, eax
jo 0x45b969
xor cl, ch
pop esi
movsd dword es:[edi], dword [esi]
loop 0x45b98d
pop edx
invalid
fdiv st(1), st(0)
mov dword [0x72f93d85], eax
mov eax, dword [0xdadab690]
invalid
Function at 0x468ac3
Capabilities:
Encode data using xor

Disassembly:
loope 0x468b11
mov esp, 0xa2f4185f
pop ebx
iretd
loop 0x468b3a
mov word [ebp + 0x53], cs
imul ebx, dword [esp + edx*2 + 0x56b4f806], 0x2c
int3
test dword [eax], ebx
inc ebp
and cl, byte [edx]
inc esp
push es
sub al, 0x7d
and byte [edi], ch
loop 0x468b27
mov dl, byte [ebp - 0x159581b6]
out 0xf9, eax
enter 0xffffffffffffc272, 0xfffffffffffffff0
push es
or al, 0x52
rcl dword [eax], cl
pushfd
xchg al, dl
in eax, 0x64
or byte fs:[ecx - 0x31344e78], bl
into
xor ah, 0x76
push 0xfffffffffffffff1
jae 0x468b17
pop ebp
xor byte [edi + 0x56], 0xb9
push edx
test dword [edx + 0x39], 0xba8829a2
sahf
mov ecx, 0x3942f752
mov byte [0x9eba8829], al
cli
leave
and al, 0x68
arpl word [edi + 0x3d], sp
test al, 0xec
push cs
imul edx, dword [ebx], 0xa6a46aed
xor dword [ebx - 0x6f7f59d5], eax
xchg dword [eax], eax
jge 0x468b46
push ebx
inc eax
test al, 7
jecxz 0x468af8
test bl, cl
les ecx, [eax - 0x20]
int 0x68
imul edx, dword [edi], 0xfffffff0
pop ebp
in al, dx
out dx, al
add eax, 0x5efc2a89
lds edi, [edi + 0x70]
sbb dword [edi - 0x3f9876b4], edx
loop 0x468b60
call dword [ebp + 0x620dd0fc]
int3

Function at 0x46ac4c
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0xeff3b199
mov cl, 0xf3
out dx, eax
rcl edi, 6
mov ebx, 0x3e157efc
xchg ebp, eax
std
aas
wait
call 0x39452dcb
push ds
pop eax
das
or esp, dword [ebp - 0x49]
jl 0x46ac3b
insb byte es:[edi], dx
das
fimul word [edi]
test al, 0xb8
ror ch, cl
jp 0x46ac74
mul byte [ecx]
daa
jno 0x46ac3e
invalid
invalid
Function at 0x4755f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004757e3
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00480338
xor ebx, ebx
cmp eax, ebx
jne 0x47579e
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004757e3
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0047d017
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4ce90c
add esp, 0x10
test eax, eax
jne 0x4756b9
push esi
call fcn.00472ca2
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4756b9
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4756a4
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4756b9
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4756b2
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call int.0048184b
cmp byte [esp + 0x13], bl
je 0x4756e9
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00475820
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x475759
push 0x14
call 0x4cdb79
cmp eax, ebx
pop ecx
je 0x475713
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x475715
xor edi, edi
cmp edi, ebx
je 0x475759
push esi
push edi
call fcn.00474d46
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00474e0e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00474f37
add esp, 0x18
call fcn.004757e3
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0047fa05
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x475770
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x475782
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4757c5
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4757c5
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00474e0e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00474f37
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47fd82
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ecx - 0xd], edx
mov es, word [ebx - 0x22]
mov byte [0x76b040b0], al
jno 0x47fde9
sub byte [ecx], al
xor eax, 0x6bd132a7
sub edx, ecx
test ah, bl
cmp dword [ecx], ecx
bnd jle 0x47fe1e
jp 0x47fe1b
and dword [ecx - 0x5ef98b7f], edx
loope fcn.0047fd31
push es
mov eax, dword [0xf88a88e1]
mov bh, al
adc dword [edx + 0x76], 0x53f8b8f6
push 0x66f55199
das
jbe 0x47fda5
mov eax, 0x996853f8
push ecx
cmc
das
test dword [esi + 0x186bb266], ebp
and al, 0x12
push ebp
cwde
or eax, 0xf1abbf09
jae 0x47fd9c
push ebp
int1
xchg edi, eax
nop
ljmp 0xe2fe
and dl, byte [edi]
mov dword [ecx + 0x678e247c], esp
adc byte [esi + ebp - 0x1a], 0xce
aam 0xb5
jo 0x47fe0d
cwde
test byte [ecx - 0x72], dh
adc dword [edi - 9], 0xd
mov bh, ah
loopne 0x47fdcb
pop ds
int1
mov byte [0xaafea80c], al
ja 0x47fe6d
insb byte es:[edi], dx
mov byte [0x49f15370], al
pop esi
fdivr st(7)
add al, 0x74
push ds
mov byte [0xa140a0a9], al
div ecx
or bl, 0x10
loop 0x47fdad
inc eax
mov eax, dword [0xcb80f1f7]
adc dl, ah
xchg byte [esi - 0x127d987f], dl
cmp ah, byte [edi - 0x76]
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
in al, dx
and esi, dword [ebx + 0x2c306924]
mov edi, 0xedec6cb1
xchg esi, eax
and dword [edi - 0x7e], 0x673af3ed
mov dl, byte [edi - 0x4cdc135a]
and al, 0x69
xor byte [edi + edi*4], ch
mov cl, 0x6c
in al, dx
in eax, dx
ljmp 0x1c22:0x667102dc
fadd qword [esi + edx*8]
lds edx, [ebx]
and eax, 0xee7e0f14
call 0x8afb3f57
dec ebx
movsb byte es:[edi], byte [esi]
jno 0x47fe24
xchg esi, eax
invalid
Function at 0x49258a
Capabilities:
Encode data using xor

Disassembly:
add byte [ebp + 0x2c31300f], dl
xchg ebp, eax
wrmsr
xor dword [ebx + edx*4], ebp
xchg ebx, eax
shr byte [eax], 1
or dword [edi], 0x70
rcr byte [0x670311ef], 0xb5
jnp 0x492559
mov ch, 0x7b
in al, dx
cmpsd dword es:[esi], dword es:[edi]
and al, 0x3e
jmp 0x49256a
das
jo 0x4925ad
dec ebx
jno 0x492558
sbb al, 0xed
sub eax, esi
adc cl, al
sti
inc esp
je 0x4925a1
dec eax
sub byte [edi], dl
mov al, byte [0x21006dce]
and byte [edx], ch
invalid
invalid
Function at 0x10018780
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10018944
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x100187aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100187b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100187a0
mov eax, 1
add ebx, ebx
jne 0x100187c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100187b8
jne 0x100187d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100187b8
xor ecx, ecx
sub eax, 3
jb 0x100187e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1001885a
mov ebp, eax
add ebx, ebx
jne 0x100187f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10018800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10018824
inc ecx
add ebx, ebx
jne 0x10018810
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10018805
jne 0x10018821
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10018805
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10018844
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10018835
jmp 0x100187a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10018844
add edi, ecx
jmp 0x100187a6
pop esi
mov edi, esi
mov ecx, 0x490
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10018862
cmp byte [edi], 7
jne 0x10018862
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10018867
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x100188d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10018894
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1811c]
or eax, eax
je 0x100188d0
mov dword [ebx], eax
add ebx, 4
jmp 0x100188b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10018907
cmp al, 0xef
ja 0x100188fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100188dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100188e9
mov ebp, dword [esi + 0x18120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1001893b
sub esp, 0xffffff80
jmp 0x10001363
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408e84
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x483e568a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6cb23846
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x222c
call fcn.00401f40
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2228], eax
mov eax, dword [esp + 0x2238]
push ebx
mov ebx, dword [esp + 0x2234]
push ebp
mov ebp, dword [esp + 0x223c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x11c]
push 0x104
push eax
push 0
call dword [0x41b090]
push 0x41b288
push ebx
call 0x402d40
add esp, 8
test eax, eax
jne 0x40121b
lea eax, [esp + 0x11c]
push eax
push ebx
call 0x4054ff
add esp, 8
test eax, eax
je 0x40121b
push esi
push 0x41b290
push ebx
call 0x4060f1
mov esi, eax
add esp, 8
test esi, esi
je 0x40121a
push edi
push ebx
push 0x41b294
lea eax, [esp + 0x2c]
push 0x100
push eax
call fcn.00401ef0
lea eax, [esp + 0x34]
push 0x41b2a0
push eax
call 0x4060f1
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x4010cc
push esi
call 0x405fde
add esp, 4
jmp 0x401219
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [0x41b00c]
test eax, eax
je 0x401248
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x20]
call dword [0x41b028]
push 0
test eax, eax
je 0x40123e
push 0x20
push ebp
push dword [esp + 0x20]
call dword [0x41b02c]
test eax, eax
jne 0x40112c
push dword [esp + 0x14]
call dword [0x41b030]
jmp 0x40123c
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x1c]
push 0x6610
push dword [esp + 0x20]
call dword [0x41b014]
push dword [esp + 0x14]
test eax, eax
je 0x401121
call dword [0x41b030]
push 0
push dword [esp + 0x24]
push 1
push dword [esp + 0x24]
call dword [0x41b01c]
test eax, eax
je 0x401232
push esi
push 0x1000
lea eax, [esp + 0x230]
push 1
push eax
call 0x4062e1
add esp, 0x10
test eax, eax
je 0x4011ee
mov ebp, dword [0x41b024]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push 0x1010
push eax
lea eax, [esp + 0x1230]
push eax
push 0
push esi
call 0x40600e
add esp, 4
push eax
push 0
push dword [esp + 0x30]
call ebp
test eax, eax
je 0x401232
push edi
push dword [esp + 0x20]
lea eax, [esp + 0x1230]
push 1
push eax
call 0x4066e1
push esi
push 0x1000
lea eax, [esp + 0x240]
push 1
push eax
call 0x4062e1
add esp, 0x20
test eax, eax
jne 0x401190
push dword [esp + 0x18]
call dword [0x41b018]
push 0
push dword [esp + 0x14]
call dword [0x41b010]
push esi
call 0x405fde
push edi
call 0x405fde
push ebx
call 0x4068a1
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x2230]
pop ebp
pop ebx
xor ecx, esp
call fcn.00401f28
add esp, 0x222c
ret
push dword [esp + 0x18]
call dword [0x41b018]
push 0
push dword [esp + 0x14]
call dword [0x41b010]
push esi
call 0x405fde
push edi
call 0x405fde
add esp, 8
jmp 0x401219
Function at 0x10004d34
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10004de9
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10004ddf
mov dword [ebp - 8], 0
jmp 0x10004d6a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x10004d7d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x20], 0xad313dd3
jmp 0x10004d63
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x20], 0xffffffef
jmp 0x10004da2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x20]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x20], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20], 0x1d
jle 0x10004ddd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10004ddb
push 0
push 0x30cd
push 0x7da6
push 1
push 0x2833
push 0x5102
call fcn.10009f02
add esp, 0x18
jmp 0x10004d8d
jmp 0x10004de7
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10004e0f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push 0
push dword [ebp - 0x14]
push 0x608e
push 0x5326
call fcn.1000de83
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x1000664a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x100066cb
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000667e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100066c9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100066ac
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x100066c9
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000e4dd
mov dword [eax], 0x47e0fa1a
jmp 0x100066a1
jmp 0x1000672f
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call fcn.10006733
add esp, 0x2c
mov esp, ebp
pop ebp
ret