joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a950
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x43a72f
call 0x43a73b
add byte [edx + 0x3e], al
cmp dword [ecx + 0x4f], ecx
dec ebx
add esp, 4
add ecx, 0x1198
pop ecx
cmp dword [ebp - 0x648], 0
jne 0x43a75d
mov dword [ebp - 0x148], 0
jmp 0x43a992
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x270], eax
push ebx
push ecx
add esp, 4
or ebx, 0x1075a
and ebx, 0x55d6
xor ebx, 0x11d4d
add ebx, 0x575a
pop ebx
push edx
xor edx, 0x9e00
pop edx
push edi
push esi
add esp, 4
xor edi, 0x160c7
pop edi
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0x644], ecx
mov edx, dword [ebp - 0x270]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x640], eax
xor ecx, ecx
mov word [ebp - 0xdc], cx
xor edx, edx
mov word [ebp - 0x64], dx
push edi
push edi
add esp, 4
jmp 0x43a7cf
jmp 0x43a7d7
xor edi, 0x11566
pop edi
push ebx
push edx
add esp, 4
add ebx, 0xd607
and ebx, 0x7e41
jmp 0x43a7f6
pop ebx
mov eax, dword [ebp - 0x640]
mov cx, word [eax]
mov word [ebp - 0x7f2], cx
mov edx, dword [ebp - 0x640]
add edx, 2
mov dword [ebp - 0x640], edx
mov ax, word [ebp - 0x7f2]
mov word [ebp - 0xdc], ax
mov ecx, dword [ebp - 0x644]
mov dx, word [ecx]
mov word [ebp - 0x7f4], dx
mov eax, dword [ebp - 0x644]
add eax, 2
mov dword [ebp - 0x644], eax
mov cx, word [ebp - 0x7f4]
mov word [ebp - 0x64], cx
push edx
sub edx, 0x12864
call 0x43a864
add byte [ecx + 0x45], cl
cmp al, 0x3a
cmp edi, dword [ecx]
cmp edi, dword [0x4c4833a]
xor edx, 0x169a
or edx, 0x7e6f
pop edx
push edi
push edx
add esp, 4
or edi, 0xbe73
pop edi
movzx edx, word [ebp - 0x64]
test edx, edx
jne 0x43a89d
movzx eax, word [ebp - 0xdc]
movzx ecx, word [ebp - 0x64]
sub eax, ecx
mov dword [ebp - 0xac0], eax
jmp 0x43a8e1
movzx edx, word [ebp - 0xdc]
movzx eax, word [ebp - 0x64]
cmp edx, eax
je 0x43a7c5
movzx ecx, word [ebp - 0xdc]
movzx edx, word [ebp - 0x64]
cmp ecx, edx
jge 0x43a8cb
mov dword [ebp - 0xabc], 0xffffffff
jmp 0x43a8d5
mov dword [ebp - 0xabc], 1
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 0
jne 0x43a92a
push edi
push edi
add esp, 4
xor edi, 0x3a94
and edi, 0x1303a
or edi, 0xd4b3
pop edi
push esi
push ebx
add esp, 4
or esi, 0xbce4
and esi, 0x165c6
pop esi
push ecx
add ecx, 0x15b1f
pop ecx
mov ecx, dword [ebp - 0x270]
mov dword [ebp - 0x148], ecx
jmp 0x43a992
push eax
push eax
add esp, 4
add eax, 0x480f
call 0x43a941
add byte [esi], bh
dec edx
inc eax
cmp eax, 0xc4833a4d
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
inc edi
xor eax, dword [ecx + 0x3c]
cmp byte [edi - 0x7d], al
les eax, [ebx + ebp*8]
push es
inc edi
push eax
dec eax
dec ebx
inc edi
pop eax
mov edx, dword [ebp - 0x270]
mov eax, dword [edx]
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x270]
cmp ecx, dword [ebp - 0x648]
je 0x43a988
mov edx, dword [ebp - 0x270]
cmp dword [edx + 0x30], 0
jne 0x43a769
mov dword [ebp - 0x148], 0
Function at 0x43b374
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
jmp 0x43b308
jmp 0x43b311
pop edx
push ebx
push ebx
add esp, 4
sub ebx, 0xee52
pop ebx
push edx
push edx
add esp, 4
xor edx, 0x10cbb
xor edx, 0x12f78
pop edx
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0x660], ecx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x65c], eax
xor ecx, ecx
mov word [ebp - 0xe4], cx
xor edx, edx
mov word [ebp - 0x6c], dx
push ecx
push esi
add esp, 4
add ecx, 0x1452b
call 0x43b374
add byte [esi + 0x37], cl
push eax
dec edx
aaa
cmp edi, dword [ebx]
cmp dword [ebx - 0x3e7efb3c], eax
mov al, 0xcf
add byte [eax], al
pop ecx
push esi
and esi, 0xa8a9
jmp 0x43b38b
pop esi
mov eax, dword [ebp - 0x65c]
mov cx, word [eax]
mov word [ebp - 0x7fa], cx
mov edx, dword [ebp - 0x65c]
add edx, 2
mov dword [ebp - 0x65c], edx
mov ax, word [ebp - 0x7fa]
mov word [ebp - 0xe4], ax
mov ecx, dword [ebp - 0x660]
mov dx, word [ecx]
mov word [ebp - 0x7fc], dx
mov eax, dword [ebp - 0x660]
add eax, 2
mov dword [ebp - 0x660], eax
mov cx, word [ebp - 0x7fc]
mov word [ebp - 0x6c], cx
push edx
push eax
add esp, 4
and edx, 0x9057
or edx, 0xffe9
and edx, 0xc65a
pop edx
push esi
jmp 0x43b402
add esi, 0x1389f
sub esi, 0x90a2
sub esi, 0xcfe0
pop esi
movzx edx, word [ebp - 0x6c]
test edx, edx
jne 0x43b432
movzx eax, word [ebp - 0xe4]
movzx ecx, word [ebp - 0x6c]
xchg esp, eax
sub eax, ecx
mov dword [ebp - 0x84c], eax
jmp 0x43b476
movzx edx, word [ebp - 0xe4]
movzx eax, word [ebp - 0x6c]
cmp edx, eax
je 0x43b35a
movzx ecx, word [ebp - 0xe4]
movzx edx, word [ebp - 0x6c]
cmp dword [ebp - 0x84c], 0
jne fcn.0043b4bf
push eax
sub eax, 0xb96d
or eax, 0x10d0d
or eax, 0x7535
pop eax
push eax
push esi
add esp, 4
xor eax, 0x14fc4
and eax, 0x14a2f
add eax, 0x9a06
add eax, 0x16e6f
pop eax
mov ecx, dword [ebp - 0x278]
mov dword [ebp - 0x148], ecx
jmp 0x43b527
push ebx
call 0x43b4cf
add byte [esp + eax*2 + 0x45], cl
inc edx
inc ebp
xor cl, byte [eax + 0x4d]
xor eax, 0xe804c483
or al, byte [eax]
add byte [eax], al
add byte [ecx + ecx*2 + 0x35], al
xor eax, 0x423d5045
add esp, 4
or ebx, 0xc5c5
add ebx, 0x5f93
pop ebx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x278]
cmp ecx, dword [ebp - 0x664]
je 0x43b51d
mov edx, dword [ebp - 0x278]
cmp dword [edx + 0x30], 0
jne 0x43b2fe
mov dword [ebp - 0x148], 0
push ebx
or ebx, 0xa95d
jmp 0x43b536
call fcn.0043b543
add byte [0x4943404b], bh
aas
aas

Function at 0x43b450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ecx, edx
jge 0x43b460
mov dword [ebp - 0x848], 0xffffffff
jmp 0x43b46a
mov dword [ebp - 0x848], 1
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x84c], eax
Function at 0x43b4bf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
jmp 0x43b308
jmp 0x43b311
pop edx
push ebx
push ebx
add esp, 4
sub ebx, 0xee52
pop ebx
push edx
push edx
add esp, 4
xor edx, 0x10cbb
xor edx, 0x12f78
pop edx
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0x660], ecx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x65c], eax
xor ecx, ecx
mov word [ebp - 0xe4], cx
xor edx, edx
mov word [ebp - 0x6c], dx
push ecx
push esi
add esp, 4
add ecx, 0x1452b
call 0x43b374
add byte [esi + 0x37], cl
push eax
dec edx
aaa
cmp edi, dword [ebx]
cmp dword [ebx - 0x3e7efb3c], eax
mov al, 0xcf
add byte [eax], al
pop ecx
push esi
and esi, 0xa8a9
jmp 0x43b38b
pop esi
mov eax, dword [ebp - 0x65c]
mov cx, word [eax]
mov word [ebp - 0x7fa], cx
mov edx, dword [ebp - 0x65c]
add edx, 2
mov dword [ebp - 0x65c], edx
mov ax, word [ebp - 0x7fa]
mov word [ebp - 0xe4], ax
mov ecx, dword [ebp - 0x660]
mov dx, word [ecx]
mov word [ebp - 0x7fc], dx
mov eax, dword [ebp - 0x660]
add eax, 2
mov dword [ebp - 0x660], eax
mov cx, word [ebp - 0x7fc]
mov word [ebp - 0x6c], cx
push edx
push eax
add esp, 4
and edx, 0x9057
or edx, 0xffe9
and edx, 0xc65a
pop edx
push esi
jmp 0x43b402
add esi, 0x1389f
sub esi, 0x90a2
sub esi, 0xcfe0
pop esi
movzx edx, word [ebp - 0x6c]
test edx, edx
jne 0x43b432
movzx eax, word [ebp - 0xe4]
movzx ecx, word [ebp - 0x6c]
xchg esp, eax
sub eax, ecx
mov dword [ebp - 0x84c], eax
jmp 0x43b476
movzx edx, word [ebp - 0xe4]
movzx eax, word [ebp - 0x6c]
cmp edx, eax
je 0x43b35a
movzx ecx, word [ebp - 0xe4]
movzx edx, word [ebp - 0x6c]
cmp dword [ebp - 0x84c], 0
jne fcn.0043b4bf
push eax
sub eax, 0xb96d
or eax, 0x10d0d
or eax, 0x7535
pop eax
push eax
push esi
add esp, 4
xor eax, 0x14fc4
and eax, 0x14a2f
add eax, 0x9a06
add eax, 0x16e6f
pop eax
mov ecx, dword [ebp - 0x278]
mov dword [ebp - 0x148], ecx
jmp 0x43b527
push ebx
call 0x43b4cf
add byte [esp + eax*2 + 0x45], cl
inc edx
inc ebp
xor cl, byte [eax + 0x4d]
xor eax, 0xe804c483
or al, byte [eax]
add byte [eax], al
add byte [ecx + ecx*2 + 0x35], al
xor eax, 0x423d5045
add esp, 4
or ebx, 0xc5c5
add ebx, 0x5f93
pop ebx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x278]
cmp ecx, dword [ebp - 0x664]
je 0x43b51d
mov edx, dword [ebp - 0x278]
cmp dword [edx + 0x30], 0
jne 0x43b2fe
mov dword [ebp - 0x148], 0
push ebx
or ebx, 0xa95d
jmp 0x43b536
call fcn.0043b543
add byte [0x4943404b], bh
aas
aas
Function at 0x43b4cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
jmp 0x43b308
jmp 0x43b311
pop edx
push ebx
push ebx
add esp, 4
sub ebx, 0xee52
pop ebx
push edx
push edx
add esp, 4
xor edx, 0x10cbb
xor edx, 0x12f78
pop edx
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0x660], ecx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x65c], eax
xor ecx, ecx
mov word [ebp - 0xe4], cx
xor edx, edx
mov word [ebp - 0x6c], dx
push ecx
push esi
add esp, 4
add ecx, 0x1452b
call 0x43b374
add byte [esi + 0x37], cl
push eax
dec edx
aaa
cmp edi, dword [ebx]
cmp dword [ebx - 0x3e7efb3c], eax
mov al, 0xcf
add byte [eax], al
pop ecx
push esi
and esi, 0xa8a9
jmp 0x43b38b
pop esi
mov eax, dword [ebp - 0x65c]
mov cx, word [eax]
mov word [ebp - 0x7fa], cx
mov edx, dword [ebp - 0x65c]
add edx, 2
mov dword [ebp - 0x65c], edx
mov ax, word [ebp - 0x7fa]
mov word [ebp - 0xe4], ax
mov ecx, dword [ebp - 0x660]
mov dx, word [ecx]
mov word [ebp - 0x7fc], dx
mov eax, dword [ebp - 0x660]
add eax, 2
mov dword [ebp - 0x660], eax
mov cx, word [ebp - 0x7fc]
mov word [ebp - 0x6c], cx
push edx
push eax
add esp, 4
and edx, 0x9057
or edx, 0xffe9
and edx, 0xc65a
pop edx
push esi
jmp 0x43b402
add esi, 0x1389f
sub esi, 0x90a2
sub esi, 0xcfe0
pop esi
movzx edx, word [ebp - 0x6c]
test edx, edx
jne 0x43b432
movzx eax, word [ebp - 0xe4]
movzx ecx, word [ebp - 0x6c]
xchg esp, eax
sub eax, ecx
mov dword [ebp - 0x84c], eax
jmp 0x43b476
movzx edx, word [ebp - 0xe4]
movzx eax, word [ebp - 0x6c]
cmp edx, eax
je 0x43b35a
movzx ecx, word [ebp - 0xe4]
movzx edx, word [ebp - 0x6c]
cmp dword [ebp - 0x84c], 0
jne fcn.0043b4bf
push eax
sub eax, 0xb96d
or eax, 0x10d0d
or eax, 0x7535
pop eax
push eax
push esi
add esp, 4
xor eax, 0x14fc4
and eax, 0x14a2f
add eax, 0x9a06
add eax, 0x16e6f
pop eax
mov ecx, dword [ebp - 0x278]
mov dword [ebp - 0x148], ecx
jmp 0x43b527
push ebx
call 0x43b4cf
add byte [esp + eax*2 + 0x45], cl
inc edx
inc ebp
xor cl, byte [eax + 0x4d]
xor eax, 0xe804c483
or al, byte [eax]
add byte [eax], al
add byte [ecx + ecx*2 + 0x35], al
xor eax, 0x423d5045
add esp, 4
or ebx, 0xc5c5
add ebx, 0x5f93
pop ebx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x278]
cmp ecx, dword [ebp - 0x664]
je 0x43b51d
mov edx, dword [ebp - 0x278]
cmp dword [edx + 0x30], 0
jne 0x43b2fe
mov dword [ebp - 0x148], 0
push ebx
or ebx, 0xa95d
jmp 0x43b536
call fcn.0043b543
add byte [0x4943404b], bh
aas
aas
Function at 0x43b4e1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
jmp 0x43b308
jmp 0x43b311
pop edx
push ebx
push ebx
add esp, 4
sub ebx, 0xee52
pop ebx
push edx
push edx
add esp, 4
xor edx, 0x10cbb
xor edx, 0x12f78
pop edx
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0x660], ecx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x65c], eax
xor ecx, ecx
mov word [ebp - 0xe4], cx
xor edx, edx
mov word [ebp - 0x6c], dx
push ecx
push esi
add esp, 4
add ecx, 0x1452b
call 0x43b374
add byte [esi + 0x37], cl
push eax
dec edx
aaa
cmp edi, dword [ebx]
cmp dword [ebx - 0x3e7efb3c], eax
mov al, 0xcf
add byte [eax], al
pop ecx
push esi
and esi, 0xa8a9
jmp 0x43b38b
pop esi
mov eax, dword [ebp - 0x65c]
mov cx, word [eax]
mov word [ebp - 0x7fa], cx
mov edx, dword [ebp - 0x65c]
add edx, 2
mov dword [ebp - 0x65c], edx
mov ax, word [ebp - 0x7fa]
mov word [ebp - 0xe4], ax
mov ecx, dword [ebp - 0x660]
mov dx, word [ecx]
mov word [ebp - 0x7fc], dx
mov eax, dword [ebp - 0x660]
add eax, 2
mov dword [ebp - 0x660], eax
mov cx, word [ebp - 0x7fc]
mov word [ebp - 0x6c], cx
push edx
push eax
add esp, 4
and edx, 0x9057
or edx, 0xffe9
and edx, 0xc65a
pop edx
push esi
jmp 0x43b402
add esi, 0x1389f
sub esi, 0x90a2
sub esi, 0xcfe0
pop esi
movzx edx, word [ebp - 0x6c]
test edx, edx
jne 0x43b432
movzx eax, word [ebp - 0xe4]
movzx ecx, word [ebp - 0x6c]
xchg esp, eax
sub eax, ecx
mov dword [ebp - 0x84c], eax
jmp 0x43b476
movzx edx, word [ebp - 0xe4]
movzx eax, word [ebp - 0x6c]
cmp edx, eax
je 0x43b35a
movzx ecx, word [ebp - 0xe4]
movzx edx, word [ebp - 0x6c]
cmp dword [ebp - 0x84c], 0
jne fcn.0043b4bf
push eax
sub eax, 0xb96d
or eax, 0x10d0d
or eax, 0x7535
pop eax
push eax
push esi
add esp, 4
xor eax, 0x14fc4
and eax, 0x14a2f
add eax, 0x9a06
add eax, 0x16e6f
pop eax
mov ecx, dword [ebp - 0x278]
mov dword [ebp - 0x148], ecx
jmp 0x43b527
push ebx
call 0x43b4cf
add byte [esp + eax*2 + 0x45], cl
inc edx
inc ebp
xor cl, byte [eax + 0x4d]
xor eax, 0xe804c483
or al, byte [eax]
add byte [eax], al
add byte [ecx + ecx*2 + 0x35], al
xor eax, 0x423d5045
add esp, 4
or ebx, 0xc5c5
add ebx, 0x5f93
pop ebx
mov edx, dword [ebp - 0x278]
mov eax, dword [edx]
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x278]
cmp ecx, dword [ebp - 0x664]
je 0x43b51d
mov edx, dword [ebp - 0x278]
cmp dword [edx + 0x30], 0
jne 0x43b2fe
mov dword [ebp - 0x148], 0
push ebx
or ebx, 0xa95d
jmp 0x43b536
call fcn.0043b543
add byte [0x4943404b], bh
aas
aas
Function at 0x43ea2b
Capabilities:
Encode data using xor

Disassembly:
leave
mov byte [0x7c0202fe], ch
leave
mov byte [esi], ch
inc byte [edx]
add bl, byte [edx - 0x37]
mov byte [edi], ch
inc byte [edx]
add al, byte [ebx]
movsb byte es:[di], byte [si]
sbb eax, dword [ebx]
add eax, dword [ebx]
mov word [eax + 0x202f66b], cs
mov ss, word [eax + 0x202f66b]
mov ss, word [ebx + esi - 0x74]
cwde
test byte [bp + si], 2
mov cs, word [eax + 0x202f667]
add al, byte [edx]
mov word [eax + 0x202fa17], cs
push esi
test dh, al
arpl word [ecx + 4], bp
add ebp, esi
pop es
dec eax
dec esp
aas
push ecx
test dh, dh
cld
add dword [ebx], eax
add eax, dword [esi + ebp*8 + 0x3046eb0]
pop esi
push ebp
push esp
xchg bh, al
pop es
test ch, dh
xchg edx, eax
xor byte [ebx], al
add eax, dword [ebp + ebp*8 + 0x3036ac9]
test ch, dh
jge 0x43e9f7
add eax, dword [ebx]
pop ebp
xchg al, al
pop ss
cli
add al, byte [edx]
add edi, dword [eax + 0x12]

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x6f706add
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x23394de2
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x17615f5b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x3f2a2744
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x55565d58
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x61907fc
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x1f6a1f30
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x3ca2478
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4061e0
Capabilities:
Terminate thread
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov eax, dword [0x445b0c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
je 0x406260
push esi
push edi
push edi
push 3
push edi
push edi
push 0x40000000
push edi
push 0x445a04
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0x1f40
mov dword [esp + 0x3c], edi
call fcn.00406450
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40624d
lea eax, [esp + 0xc]
push edi
push eax
lea ecx, [esp + 0x18]
push 0x10
push ecx
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
push 0x3e8
mov edx, dword [0x445b0c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov eax, dword [0x445b08]
cmp eax, edi
je 0x406281
mov eax, dword [0x445b08]
cmp eax, 0xffffffff
je 0x406281
mov eax, dword [0x445b08]
push eax
call ebx
mov dword [0x445b08], edi
mov eax, dword [0x445b0c]
cmp eax, edi
je 0x4062a9
mov eax, dword [0x445b0c]
cmp eax, 0xffffffff
je 0x4062a9
push 0xffffffffffffffff
mov ecx, dword [0x445b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x445b0c], edi
call fcn.004063b0
mov dword [0x445b14], edi
pop edi
pop ebx
add esp, 0x14
ret

Function at 0x40197d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401990
push esp
mov dword [ebp - 0x24], 0x4016f4
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a2f
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a10
pop ebp
ret 0x10
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x56675930
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4ac409a0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x616d039c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x62f05f7e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219