joyce8/EMBER2024-capa huggingface dataset:
Function at 0x560d8a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x40
mov dword [0x65bf70], 0x149c
mov dword [ebp - 8], 0
mov dword [0x65bf74], 0xd70
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [0x65bf70], 0x1029
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov edx, dword [0x65bf74]
add edx, 0xffffef39
mov dword [0x65bf74], edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
jmp 0x560e5f
mov eax, 0x1e90
mov dword [0x65bf74], 0x1e90
mov ecx, dword [ebp - 0x20]
add ecx, 1
cmp ecx, 0x104
mov edx, eax
mov esi, ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ecx
jl 0x560e5f
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [0x65bf70], 0x2389
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
je 0x560e80
jmp 0x560f3e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x560eeb
jmp 0x560f3e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], esi
je 0x560e20
jmp 0x560df0
mov eax, dword [ebp - 0x30]
add eax, 0xffffea0e
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [0x65bf70], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
cmp word [ecx + edx*2 - 0x18], 0x6f
jne 0x560f3e
mov dword [0x65bf70], 0xb97
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x16], 0x61
sete dl
mov byte [ebp - 0x35], dl
mov al, byte [ebp - 0x35]
test al, 1
jne 0x560ecc
jmp 0x560f3e
mov dword [0x65bf70], 0x6fe
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x560e47
jmp 0x560f3e
mov dword [0x65bf70], 0x1582
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x10], 0x6c
sete dl
mov byte [ebp - 0x36], dl
mov al, byte [ebp - 0x36]
test al, 1
jne 0x560f11
jmp 0x560f3e
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff9
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, 0x423
mov ecx, 1
mov edx, dword [ebp - 0x3c]
cmp word [edx], 0x6c
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
je 0x560f4d
mov eax, 0x250b
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
jmp 0x560f4d
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov dword [0x65bf70], ecx
add esp, 0x40
pop esi
pop ebp
ret
Function at 0x5614e6
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x65bf7c], 0
mov byte [0x65bf80], 0
mov dword [0x65bf70], 0x154f
mov dword [0x65bf74], 0x2f
mov dword [0x65bf78], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x65bf70], 0x198
mov eax, dword [0x65bf78]
add eax, 1
mov dword [0x65bf78], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x561535
xor eax, eax
mov dword [0x65bf74], 0x2124
mov dword [0x65bf78], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x65bf84], 0
mov edx, dword [0x65bf7c]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x65bf84], edi
mov dword [0x65bf74], 0xfa3
mov eax, edi
cdq
idiv ecx
mov dword [0x65bf7c], edx
mov dword [0x65bf70], 0x1fab
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x65bf80], cl
mov dword [0x65bf70], 0x291
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x65bf80]
mov edx, dword [0x65bf7c]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x65bf70], 0x2472
mov edx, dword [0x65bf78]
add edx, 1
mov dword [0x65bf78], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x56157e
mov dword [0x65bf70], 0xdd5
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x561798
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x65bf70], 0x8fa
mov dword [0x65bf74], 0xd98
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x56188c
mov eax, dword [ebp - 0x30]
add eax, 0x10aa
mov dword [0x65bf70], 0x36b
mov dword [ebp - 0x34], eax
jmp 0x561907
mov eax, dword [ebp - 0x38]
mov dword [0x65bf74], 0x4f9
mov dword [0x65bf70], 0xecb
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x65bf70], 0x23d8
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x30], eax
call fcn.005613c3
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov word [ecx], 0x5a4d
mov dword [0x65bf74], 0xfffffa52
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x54], ecx
mov ecx, dword [ebp - 0x30]
mov dword [edx + 4], ecx
mov dword [0x65bf70], 0x3483
cmp ecx, 0
mov dword [ebp - 0x34], eax
je 0x561907
jmp 0x5617c8
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x60fc24]
mov dl, byte [eax + 0x60fbf5]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
jne 0x56188c
lea eax, [ebp - 0x20]
mov dword [0x65bf74], 0x238
mov dword [0x65bf70], 0xfffffc53
mov dword [ebp - 0x3c], eax
call fcn.00561941
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
call fcn.00561a14
xor ecx, ecx
mov dword [0x65bf70], 0x269b
mov dword [0x65bf74], 0x189f
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
jne 0x5617e2
mov eax, dword [ebp - 0x34]
add esp, 0x4c
pop ebp
ret
Function at 0x562093
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [0x65bf70]
add ecx, 0x23ec
mov dword [0x65bf74], ecx
cmp eax, 0
mov dword [ebp - 4], eax
je 0x5620c9
jmp 0x562121
mov eax, dword [ebp - 8]
cmp word [eax], 0x5a4d
mov dword [ebp - 0xc], eax
je 0x5620e8
jmp 0x5620f7
lea eax, [0x56172f]
mov dword [0x65bf70], 0xe8e
mov dword [0x65bf74], 0xfffff37e
mov dword [ebp - 8], eax
jmp 0x5620ba
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x56210f
mov eax, dword [ebp - 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x5620ba
mov dword [0x65bf70], 0xe4a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
jmp 0x56213c
xor eax, eax
mov ecx, dword [ebp - 4]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0x18], eax
call fcn.0056116c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add esp, 0x20
pop ebp
ret
Function at 0x5622d1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x25f6
xor ebx, ebx
mov dword [0x65bf78], 0
mov dword [0x65bf7c], 0
mov dword [0x65bf88], 0
mov dword [0x65bf74], 0x25f6
mov dword [0x65bf70], 0x1ee4
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
je 0x562485
jmp 0x562365
mov eax, dword [0x65bf78]
mov ecx, dword [0x65bf7c]
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
add ecx, 1
mov dword [ebp - 0x38], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
idiv edi
mov dword [0x65bf78], edx
mov dword [0x65bf70], 0x3b
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x3c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x65bf7c], edx
add esi, 0xfffff363
mov dword [0x65bf74], esi
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x40]
mov cl, byte [ecx + esi]
mov byte [0x65bf80], cl
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x65bf70]
add edx, 0xffffdf8e
mov dword [0x65bf70], edx
mov cl, byte [0x65bf80]
mov edx, dword [0x65bf7c]
mov byte [edi + edx], cl
mov edx, dword [0x65bf78]
movzx edx, byte [edi + edx]
mov ebx, dword [0x65bf7c]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x65bf88], ebx
mov dword [0x65bf70], 0x1954
mov dword [0x65bf74], 0xfffff92f
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x38]
mov ch, byte [edx + ebx]
mov byte [0x65bf8d], ch
mov byte [0x65bf8e], cl
xor ch, cl
mov byte [0x65bf8c], ch
mov dword [0x65bf70], 0xffffeeab
mov edx, dword [ebp - 0x20]
mov byte [edx + ebx], ch
mov edx, dword [0x65bf70]
add edx, 0xffffff5b
mov dword [0x65bf74], edx
add ebx, 1
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], edx
jne 0x562348
mov dword [0x65bf74], 0x559
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405df0
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov ebx, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov esi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call 0x405e60
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x405ee6
cmp ax, 9
je 0x405ed4
cmp ax, 0x20
je 0x405ed4
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x405f32
cmp ax, 0x22
je 0x405f40
mov dword [ebp - 0x54], 0
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x405ee6
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x405e90
test edi, 1
jne 0x405e90
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x405ed4
cmp ax, 0x20
je 0x405ed4
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x405f52
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403f70
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x405eab
and dword [ebp - 0x54], 1
jne 0x405ea4
xor edi, 1
jmp 0x405eab
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x405eff
Function at 0x405e60
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov ebx, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov esi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call 0x405e60
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x405ee6
cmp ax, 9
je 0x405ed4
cmp ax, 0x20
je 0x405ed4
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x405f32
cmp ax, 0x22
je 0x405f40
mov dword [ebp - 0x54], 0
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x405ee6
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x405e90
test edi, 1
jne 0x405e90
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x405ed4
cmp ax, 0x20
je 0x405ed4
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x405f52
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403f70
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x405eab
and dword [ebp - 0x54], 1
jne 0x405ea4
xor edi, 1
jmp 0x405eab
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x405eff
Function at 0x4030f0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41b008], 0x8088405
inc edx
mov dword [ebx + 0x41b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4075f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x407646
test eax, edx
je 0x407649
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x407609
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40762f
add ecx, 4
js 0x40761f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40762c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x407655
test edx, edx
jne 0x4075fc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x452971
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [eax]
pushfd
call fcn.00465630
int3
bt bx, si
mov byte [eax + 0x40], 1
mov al, cl
mov eax, dword [0x41c3dc]
cmc
bt bp, sp
pushal
cmp dword [eax], 0
push eax
lea esp, [esp + 0x28]
je 0x45085d
setle ah
movzx ax, dl
lahf
lahf
mov eax, dword [0x41c3dc]
jmp 0x46b1aa
pushfd
pushal
jmp 0x42e399

Function at 0x454756
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x4bbc2d
push ebx
call fcn.004300e7
movzx si, al
pop esi
push edi
lea edi, [esi - 0x28e109c2]
mov ebx, dword [esp + 4]
movzx di, bl
movzx di, bl
call fcn.0044fdeb

Function at 0x462e45
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x2c]
call fcn.004063c4
jmp 0x49b92b

Function at 0x47461a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 4]
call fcn.0040765c
push ecx
cmc
test eax, eax
push 0x6ec34299
push dword [esp + 4]
jmp 0x47a3be
mov eax, dword [eax + 0x2c]
mov byte [esp], 0xac
push dword [esp + 4]
lea esp, [esp + 0x38]
jl 0x44f172
pushfd
lea esp, [esp + 4]
call fcn.0040765c
push edi
test eax, eax
pushfd
push 0x1758e179
push dword [esp + 4]
call fcn.00478a68
call fcn.0049515c
lea esp, [esp + 0xc]
je 0x493dec
not al
pushfd
mov eax, dword [0x41c4dc]
call fcn.004b1436
Function at 0x10536000
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x10536006
pop ebp
sub ebp, 6
sub ebp, 0x536000
jmp 0x10536064
mov al, byte [esp + 0x28]
cmp al, 1
je 0x1053607b
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10536084
mov eax, 0x536000
add eax, ebp
add eax, 0xaa
mov ecx, 0x584
mov edx, 0x7c6a4ab3
xor byte [eax], dl
inc eax
dec ecx
jne 0x1053609b
jmp 0x105360ae
cmp byte [esi + 0x38], bh
cmp cl, byte [edi + 0x32b3b3b3]
jb 0x10536104
invalid
dec ebx
mov bl, 0xb3
mov bl, 0xb0
jle 0x105360ca
mov ch, 0xb3
mov bl, 0xb3
or dword [ebx + 0x44b3b3b3], ebx
mov bl, 0xb3
inc esp
push ecx
mov al, 0x7b
cmp byte [edx], dh
mov edi, 0xb0b3b3b3
jbe 0x105360b8
jecxz 0x105360b2
or esi, dword [ebp - 0x9244c5d]
ljmp 0xdb97
mov ch, 0xa3
mov bl, 0xdb
imul dl
invalid
mov bl, 0xb3
mov bl, 0x72
pop edx
mov cl, 0x82
mov cl, 0x30
jno 0x105360c6
cli
mov esp, 0x4c4c4736
dec esp
out dx, al
jno 0x105360d8
mov bl, 0x38
aas
xchg edi, eax
mov bh, 0xb3
mov bl, 0xb3
fisttp dword [ebx]
mov ch, 0xa3
mov bl, 0xdb
imul dl
invalid

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x24883b18
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xbdb4084
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x9d6380
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9d6386
pop ebp
sub ebp, 6
sub ebp, 0x5d6380
jmp 0x9d63e4
jmp 0x9d63ed
mov eax, 0x5d6380
add eax, ebp
add eax, 0x93
mov ecx, 0x60d
mov edx, 0xab86ee04
xor byte [eax], dl
inc eax
dec ecx
jne 0x9d6404
jmp 0x9d6417
outsb dx, byte [esi]
inc esp
insb byte es:[edi], dx
add al, 0x14
add al, 4
insb byte es:[edi], dx
add al, 0xc8
sub byte [edi + esi], al
les edx, [ebx + edi*8 - 0x6f]
rol byte [eax + edx*2], 4
push esp
invalid
Function at 0x100029c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10013538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc0
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [esp + 0xc], edi
mov dword [esp + 0xd0], 0
xor eax, eax
mov dword [esp + 8], 0
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
mov dword [esp + 0xd0], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
sub esp, 8
mov dword [esp + 0x10], 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], eax
call fcn.10004590
mov dword [esp + 0xd0], 2
movzx ecx, word [esi]
mov edx, dword [esp + 0x28]
call fcn.10003040
mov esi, eax
mov dword [esp + 0x24], esi
mov edx, dword [edi + 0x14]
cmp edx, 8
jb 0x10002a5f
mov ecx, dword [edi]
jmp 0x10002a61
mov ecx, edi
mov eax, dword [edi + 0x10]
lea eax, [ecx + eax*2]
cmp edx, 8
jb 0x10002a70
mov ecx, dword [edi]
jmp 0x10002a72
mov ecx, edi
push dword [esp + 0x28]
push esi
push eax
push ecx
mov ecx, edi
call fcn.100037b0
mov byte [esp + 0xd0], 0
lea ecx, [esp + 0x24]
call fcn.10002fc0
mov ecx, dword [esp + 0xc8]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xcc
ret

Function at 0x1009f302
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0x100a5c99
pushfd
nop
mov ah, 0x28
mov eax, dword [esp + 4]
jmp 0x10064588
xchg dword [esp + 0x28], eax
pushfd
call fcn.100c0e62

Function at 0x100cbd14
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + 0x1f49f8ce]
call fcn.100651bb
adc dword [edi], ebp
invalid

Function at 0x100dbb41
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [ebp + 0x5aab1]
jmp 0x1006e46e
pushfd
lea ebp, [ebp - 0x474739f8]
pushfd
call fcn.10086899
pushfd
jmp 0x10064df0
lea ebp, [ebp + 1]
pushal
mov byte [esp + 0x18], 0x2d
push edi
mov dword [esp + 0x2c], ebp
movzx bp, cl
movsx bp, cl
mov ebp, 0x1000d173
jmp 0x100a5ca3