joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60b290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63b4e5
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x6cf520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x40], 0x43414853
mov dword [ebp - 0x3c], 0x322d4c41
mov word [ebp - 0x38], 0x2f
movups xmm0, xmmword [ebp - 0x40]
mov dword [ebp - 0x30], 9
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x30]
movq qword [ebp - 0x18], xmm0
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov byte [ebp - 4], 1
push 3
push 0x64b108
cmp eax, 3
jb 0x60b352
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 3]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.005d2ea0
add esp, 0xc
mov byte [esi + 3], 0
lea eax, [ebp - 0x28]
jmp 0x60b35f
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
push 3
call fcn.0043f260
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x60b3c4
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x60b3ba
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x60b423
push ecx
push edx
call fcn.00597369
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x60b406
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x60b3fc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x60b423
push ecx
push edx
call fcn.00597369
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00597338
mov esp, ebp
pop ebp
ret
call fcn.005dd260
int3
Function at 0x60de20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x644242
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6cf520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004ff300
mov dword [edi], vtable.CSkyObject.0
xorps xmm0, xmm0
movups xmmword [edi + 4], xmm0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea esi, [edi + 0x134]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00597385
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1bc], 0
xorps xmm0, xmm0
mov dword [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0
mov dword [edi + 0x1c8], 0x3f800000
mov dword [edi + 0x1cc], 0x3f800000
mov dword [edi + 0x1d0], 0x3f800000
movups xmmword [edi + 0x1d8], xmm0
mov dword [edi + 0x1e8], 0
mov dword [edi + 0x1ec], 0xf
mov byte [edi + 0x1d8], 0
lea ecx, [edi + 0x1f4]
mov byte [ebp - 4], 3
call fcn.0050f490
mov dword [edi + 0x174], 0
mov dword [edi + 0x170], 0
mov dword [edi + 0x16c], 0
mov dword [edi + 0x168], 0
mov dword [edi + 0x160], 0
mov dword [edi + 0x15c], 0
mov dword [edi + 0x158], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x148], 0
mov dword [edi + 0x144], 0
mov dword [edi + 0x140], 0
mov dword [edi + 0x178], 0x3f800000
mov dword [edi + 0x164], 0x3f800000
mov dword [edi + 0x150], 0x3f800000
mov dword [edi + 0x13c], 0x3f800000
mov dword [edi + 0x1b4], 0
mov dword [edi + 0x1b0], 0
mov dword [edi + 0x1ac], 0
mov dword [edi + 0x1a8], 0
mov dword [edi + 0x1a0], 0
mov dword [edi + 0x19c], 0
mov dword [edi + 0x198], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x18c], 0
mov dword [edi + 0x188], 0
mov dword [edi + 0x184], 0
mov dword [edi + 0x180], 0
mov dword [edi + 0x1b8], 0x3f800000
mov dword [edi + 0x1a4], 0x3f800000
mov dword [edi + 0x190], 0x3f800000
mov dword [edi + 0x17c], 0x3f800000
mov byte [ebp - 4], 4
mov dword [edi + 0xf8], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf0], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xfc], 0x3f800000
mov dword [edi + 0xe8], 0x3f800000
mov dword [edi + 0xd4], 0x3f800000
mov dword [edi + 0xc0], 0x3f800000
mov ecx, dword [0x759480]
call fcn.004e8f30
mov dword [edi + 0x130], eax
mov eax, edi
mov dword [edi + 0x128], 0
mov dword [edi + 0x12c], 0
mov word [edi + 0x1f0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x613bd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x613bfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x613bfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x6152f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0x18]
test eax, eax
je 0x615300
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
xor ebx, ebx
add eax, 4
je 0x615309
mov ebx, dword [eax]
lea ecx, [eax + 4]
xor eax, eax
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x61531c
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
xor edx, edx
add ecx, 4
je 0x615325
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [ebp]
add edi, ebx
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 4]
add ebp, 8
add ebx, edx
test ecx, ecx
je 0x615392
nop
lea edx, [edi*2 + 1]
imul edx, edi
lea eax, [ebx*2 + 1]
imul eax, ebx
rol edx, 5
rol eax, 5
mov esi, edx
xor esi, dword [esp + 0x10]
movzx ecx, al
and ecx, 0x1f
mov dword [esp + 0x10], edi
rol esi, cl
mov edi, eax
xor edi, dword [esp + 0x1c]
mov eax, ebx
mov ebx, dword [ebp]
movzx ecx, dl
add ebx, esi
and ecx, 0x1f
mov dword [esp + 0x1c], eax
rol edi, cl
add edi, dword [ebp + 4]
add ebp, 8
sub dword [esp + 0x14], 1
jne 0x615340
add eax, dword [ebp + 4]
mov ecx, dword [ebp]
add ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6153b0
mov eax, dword [eax]
xor ecx, eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test edx, edx
je 0x6153ba
mov dword [edx], ecx
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x6153cb
xor edi, dword [edx]
test esi, esi
je 0x6153d1
mov dword [esi], edi
add esi, 4
lea ecx, [edx + 4]
test edx, edx
pop edi
cmove ecx, edx
mov edx, dword [esp + 0x18]
test ecx, ecx
je 0x6153e7
xor edx, dword [ecx]
test esi, esi
je 0x6153ed
mov dword [esi], edx
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x615400
mov eax, dword [eax]
xor ebx, eax
test esi, esi
je 0x615406
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x401724
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
mov esi, ebx
mov ecx, ebx
cmp dword [ebp + 0xc], ebx
jle 0x401754
lea esi, [esi]
mov eax, ecx
and eax, 0xffff
inc eax
mov edi, dword [ebp + 8]
movzx edx, byte [ecx + edi]
imul eax, edx
add esi, eax
xor ebx, edx
inc ecx
cmp dword [ebp + 0xc], ecx
jg 0x401738
mov edx, dword [ebp + 0xc]
xor edx, esi
mov eax, ebx
shl eax, 0x18
xor eax, edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4023d0
Capabilities:
Terminate process

Disassembly:
call fcn.00402400
ja 0x40244a
jo 0x40244b
imul ebp, dword [esi + 0x74], 0x90004166
inc esi

Function at 0x4023e0
Capabilities:
Terminate process

Disassembly:
call fcn.00402400
dec ebp
jae 0x40245c
popal
inc edx
outsd dx, dword [esi]
js 0x402431
add byte [ebp + 0x76], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
outsb dx, byte [esi]
inc ecx
add byte [ebp + 0x76], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x402400
Capabilities:
Terminate process

Disassembly:
mov edx, 0x40240a
jmp 0x4011fc

Function at 0x402420
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
inc edi
je 0x40246c
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
dec esp
imul ebp, dword [esi + 0x65], 0x768d0041
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.00402560
inc ebx
jb 0x4024ad
popal
je 0x4024b0
inc esi
imul ebp, dword [ebp + 0x41], 0x768d00
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte gs:[ecx + 0xebe8f6], cl
add byte [eax], al
push edi
jb 0x4024e1
je 0x4024df
inc esi
imul ebp, dword [ebp], 0xdbe890
call fcn.00402560
jb 0x402514
arpl word [edi + ebp*2 + 0x72], si
je 0x402521
jb 0x40252d
inc ecx
cmp eax, dword [eax]
add byte [eax], al
lea esi, [esi]

Function at 0x402440
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
inc edi
je 0x40246c
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
dec esp
imul ebp, dword [esi + 0x65], 0x768d0041
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.00402560
inc ebx
jb 0x4024ad
popal
je 0x4024b0
inc esi
imul ebp, dword [ebp + 0x41], 0x768d00
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte gs:[ecx + 0xebe8f6], cl
add byte [eax], al
push edi
jb 0x4024e1
je 0x4024df
inc esi
imul ebp, dword [ebp], 0xdbe890
call fcn.00402560
jb 0x402514
arpl word [edi + ebp*2 + 0x72], si
je 0x402521
jb 0x40252d
inc ecx
cmp eax, dword [eax]
add byte [eax], al
lea esi, [esi]

Function at 0x402460
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
push edx
popal
inc esi
imul ebp, dword [ebp], 0xebe8f689
call fcn.00402560
push edi
jb 0x4024e1
je 0x4024df
inc esi
invalid
insb byte es:[edi], dx
invalid
invalid
nop
Function at 0x402470
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
inc edi
je 0x40246c
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
dec esp
imul ebp, dword [esi + 0x65], 0x768d0041
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.00402560
inc ebx
jb 0x4024ad
popal
je 0x4024b0
inc esi
imul ebp, dword [ebp + 0x41], 0x768d00
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte gs:[ecx + 0xebe8f6], cl
add byte [eax], al
push edi
jb 0x4024e1
je 0x4024df
inc esi
imul ebp, dword [ebp], 0xdbe890
call fcn.00402560
jb 0x402514
arpl word [edi + ebp*2 + 0x72], si
je 0x402521
jb 0x40252d
inc ecx
cmp eax, dword [eax]
add byte [eax], al
lea esi, [esi]

Function at 0x402480
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
inc edi
je 0x40246c
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
dec esp
imul ebp, dword [esi + 0x65], 0x768d0041
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.00402560
inc ebx
jb 0x4024ad
popal
je 0x4024b0
inc esi
imul ebp, dword [ebp + 0x41], 0x768d00
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte gs:[ecx + 0xebe8f6], cl
add byte [eax], al
push edi
jb 0x4024e1
je 0x4024df
inc esi
imul ebp, dword [ebp], 0xdbe890
call fcn.00402560
jb 0x402514
arpl word [edi + ebp*2 + 0x72], si
je 0x402521
jb 0x40252d
inc ecx
cmp eax, dword [eax]
add byte [eax], al
lea esi, [esi]

Function at 0x4024a0
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
inc ebx
jb 0x40250d
popal
je 0x402510
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x4024f6
add byte [ecx + 0xf6], cl
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.00402560
push ebx
je 0x40250c
jne 0x40253d
jb 0x402532
outsb dx, byte [esi]
je 0x402514
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x40251a
add byte [ecx + 0xf6], cl
add al, ch
jnp 0x4024e3
add byte [eax], al
inc ebp
js 0x402551
je 0x40253a
jb 0x40255b
arpl word [ebp + 0x73], sp
jae 0x4024f1
lea esi, [esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push ebx
imul edi, dword [edx + 0x65], 0x768d00
add byte [ebp + 0x76], cl
insb byte es:[edi], dx
inc ecx
je 0x4025b3
jb 0x4025aa
insb byte es:[edi], dx
inc ecx
add byte [eax + 0x40256aba], dl
mov edx, 0x40256a
invalid
xchg edx, eax
jb 0x402626
Function at 0x4024c0
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
inc ebx
jb 0x40250d
popal
je 0x402510
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x4024f6
add byte [ecx + 0xf6], cl
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.00402560
push ebx
je 0x40250c
jne 0x40253d
jb 0x402532
outsb dx, byte [esi]
je 0x402514
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x40251a
add byte [ecx + 0xf6], cl
add al, ch
jnp 0x4024e3
add byte [eax], al
inc ebp
js 0x402551
je 0x40253a
jb 0x40255b
arpl word [ebp + 0x73], sp
jae 0x4024f1
lea esi, [esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push ebx
imul edi, dword [edx + 0x65], 0x768d00
add byte [ebp + 0x76], cl
insb byte es:[edi], dx
inc ecx
je 0x4025b3
jb 0x4025aa
insb byte es:[edi], dx
inc ecx
add byte [eax + 0x40256aba], dl
mov edx, 0x40256a
invalid
xchg edx, eax
jb 0x402626

Function at 0x4024e0
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
inc ebx
jb 0x40250d
popal
je 0x402510
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x4024f6
add byte [ecx + 0xf6], cl
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.00402560
push ebx
je 0x40250c
jne 0x40253d
jb 0x402532
outsb dx, byte [esi]
je 0x402514
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x40251a
add byte [ecx + 0xf6], cl
add al, ch
jnp 0x4024e3
add byte [eax], al
inc ebp
js 0x402551
je 0x40253a
jb 0x40255b
arpl word [ebp + 0x73], sp
jae 0x4024f1
lea esi, [esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push ebx
imul edi, dword [edx + 0x65], 0x768d00
add byte [ebp + 0x76], cl
insb byte es:[edi], dx
inc ecx
je 0x4025b3
jb 0x4025aa
insb byte es:[edi], dx
inc ecx
add byte [eax + 0x40256aba], dl
mov edx, 0x40256a
invalid
xchg edx, eax
jb 0x402626

Function at 0x402500
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
inc edi
je 0x40254f
imul ebp, dword [ebp + 0x53], 0x657a69
lea esi, [esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x402520
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
pop edi
insb byte es:[edi], dx
arpl word [edi + ebp*2 + 0x73], bp
add byte gs:[ebp + 0x2be80076], cl
invalid
invalid
add byte [eax], al
add byte [edi + 0x65], al
je 0x40257f

Function at 0x402530
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
pop edi
insb byte es:[edi], dx
arpl word [edi + ebp*2 + 0x73], bp
add byte gs:[ebp + 0x2be80076], cl
invalid
invalid
add byte [eax], al
add byte [edi + 0x65], al
je 0x40257f
Function at 0x402550
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
inc edi
je 0x40257f
imul ebp, dword [ebp + 0x41], 0x69727474
bound esi, qword [ebp + 0x74]
jae 0x402588
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ch
or eax, dword [eax]
add byte [eax], al
dec ebp
outsd dx, dword [esi]
jbe 0x4025be
inc esi
imul ebp, dword [ebp + 0x41], 0x6aba9000
mov edx, 0x40256a
invalid
xchg edx, eax
in al, dx
invalid
add al, ch
pop ebx
add byte [eax], al
add byte [edx + 0x65], dl
dec edi
dec edi
jo 0x4025f0
outsb dx, byte [esi]
dec ebx
jns 0x4025d1
add byte [ebp + 0x76], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
lea esi, [esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jbe 0x402653
jo 0x40265d
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], dl
jb 0x402698
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.00402680
insb byte es:[edi], dx
add byte [ecx + 0xf6], cl
add byte [ecx + 0x402770], ah
mov eax, dword [0x402770]
or eax, eax
jne 0x4026b7
call fcn.004026e0
mov dword [0x402770], eax
or eax, eax
je 0x4026c4
push dword [esp + 4]
push 8
push eax
call fcn.00402700
ret
xor eax, eax
ret

Function at 0x402560
Capabilities:
Terminate process

Disassembly:
mov edx, 0x40256a
jmp 0x4011fc

Function at 0x402580
Capabilities:
Terminate process

Disassembly:
call fcn.004025e0
push edx
dec edi

Function at 0x4025a0
Capabilities:
Terminate process

Disassembly:
call fcn.004025e0
push edx
push ecx
jne 0x402610
jb 0x402626
push esi
popal
insb byte es:[edi], dx
jne 0x402617
inc ebp
js 0x4025f6
add byte [ecx + 0xf6], cl
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.004025e0
dec esp

Function at 0x4025c0
Capabilities:
Terminate process

Disassembly:
call fcn.004025e0
push edx
push ecx
jne 0x402610
jb 0x402626
push esi
popal
insb byte es:[edi], dx
jne 0x402617
inc ebp
js 0x4025f6
add byte [ecx + 0xf6], cl
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.004025e0
dec esp

Function at 0x4025e0
Capabilities:
Terminate process

Disassembly:
mov edx, 0x4025ea
jmp 0x4011fc

Function at 0x402600
Capabilities:
Terminate process

Disassembly:
call fcn.00402680
push ebx
dec eax
inc edi
je 0x40265e
jo 0x402672
arpl word [ecx + 0x61], bp
insb byte es:[edi], dx
inc esi
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x402664
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
imul ebp, dword [edi + 0x6e], 0x5be800
call fcn.00402680
push ebx
dec eax
inc edi
je 0x40267b
popal
je 0x402696
inc esi
jb fcn.004026a0
insd dword es:[edi], dx
dec ecx
inc esp
dec esp
imul esi, dword [ebx + 0x74], 0xf6890041
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x68], dl
insb byte es:[edi], dx
insb byte es:[edi], dx
inc ebp
add byte [eax], al
add byte [eax], al
add byte [edx + 0x40268a], bh
mov edx, 0x40268a
insb byte es:[edi], dx
Function at 0x402620
Capabilities:
Terminate process

Disassembly:
call fcn.00402680
push ebx
dec eax
inc edi
je 0x40265e
jo 0x402672
arpl word [ecx + 0x61], bp
insb byte es:[edi], dx
inc esi
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x402664
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
imul ebp, dword [edi + 0x6e], 0x5be800
call fcn.00402680
push ebx
dec eax
inc edi
je 0x40267b
popal
je 0x402696
inc esi
jb fcn.004026a0
insd dword es:[edi], dx
dec ecx
inc esp
dec esp
imul esi, dword [ebx + 0x74], 0xf6890041
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x68], dl
insb byte es:[edi], dx
insb byte es:[edi], dx
inc ebp
add byte [eax], al
add byte [eax], al
add byte [edx + 0x40268a], bh
mov edx, 0x40268a
insb byte es:[edi], dx

Function at 0x402640
Capabilities:
Terminate process

Disassembly:
call fcn.00402680
push ebx
dec eax
inc edx
jb 0x4026b9
ja 0x4026bf
inc esi
outsd dx, dword [esi]
jb 0x402697
outsd dx, dword [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
and al, 4
cmp eax, 0xc3000000

Function at 0x402660
Capabilities:
Terminate process

Disassembly:
call fcn.00402560
inc edi
je 0x40257f
imul ebp, dword [ebp + 0x41], 0x69727474
bound esi, qword [ebp + 0x74]
jae 0x402588
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ch
or eax, dword [eax]
add byte [eax], al
dec ebp
outsd dx, dword [esi]
jbe 0x4025be
inc esi
imul ebp, dword [ebp + 0x41], 0x6aba9000
mov edx, 0x40256a
invalid
xchg edx, eax
in al, dx
invalid
add al, ch
pop ebx
add byte [eax], al
add byte [edx + 0x65], dl
dec edi
dec edi
jo 0x4025f0
outsb dx, byte [esi]
dec ebx
jns 0x4025d1
add byte [ebp + 0x76], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
lea esi, [esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jbe 0x402653
jo 0x40265d
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], dl
jb 0x402698
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ch
call fcn.00402680
insb byte es:[edi], dx
add byte [ecx + 0xf6], cl
add byte [ecx + 0x402770], ah
mov eax, dword [0x402770]
or eax, eax
jne 0x4026b7
call fcn.004026e0
mov dword [0x402770], eax
or eax, eax
je 0x4026c4
push dword [esp + 4]
push 8
push eax
call fcn.00402700
ret
xor eax, eax
ret

Function at 0x402680
Capabilities:
Terminate process

Disassembly:
call fcn.00402680
push ebx
dec eax
inc edi
je 0x40265e
jo 0x402672
arpl word [ecx + 0x61], bp
insb byte es:[edi], dx
inc esi
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x402664
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
imul ebp, dword [edi + 0x6e], 0x5be800
call fcn.00402680
push ebx
dec eax
inc edi
je 0x40267b
popal
je 0x402696
inc esi
jb fcn.004026a0
insd dword es:[edi], dx
dec ecx
inc esp
dec esp
imul esi, dword [ebx + 0x74], 0xf6890041
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x68], dl
insb byte es:[edi], dx
insb byte es:[edi], dx
inc ebp
add byte [eax], al
add byte [eax], al
add byte [edx + 0x40268a], bh
mov edx, 0x40268a
insb byte es:[edi], dx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x70aa294e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x336d5433
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219