joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d6e4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001d701
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1001d804
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffee
jmp 0x1001d723
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xe
je 0x1001d804
mov dword [ebp - 0x14], 0x7008b15e
mov dword [ebp - 0x20], 0x6d21cd43
mov dword [ebp - 8], 0
jmp 0x1001d74d
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x1001d760
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x2c], 0x4615
jmp 0x1001d746
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2c], 0
je 0x1001d772
jmp 0x1001d804
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov dword [ebp - 0x24], eax
or eax, 0xffffffff
je 0x1001d7e3
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x1001d797
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2c], 0xffffffff
je 0x1001d7ad
mov dword [ebp - 0xc], 1
jmp 0x1001d7b1
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul eax, dword [ebp - 0xc]
cmp eax, 0x69bd697e
jg 0x1001d7ca
mov dword [ebp - 0x10], 1
jmp 0x1001d7ce
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1001d7e3
mov dword [ebp - 0x18], 1
jmp 0x1001d7e7
and dword [ebp - 0x18], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
add ecx, dword [ebp - 0x18]
imul eax, ecx
mov dword [ebp - 0x20], eax
jmp 0x1001d718
mov esp, ebp
pop ebp
ret

Function at 0x1001dc8d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001dcbf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1001dce2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001dce2
push 0x1306
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x1002afd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002afee
push 0x1306
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1002b001
push 0
push 0x1d5f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
pop ebp
ret
Function at 0x100317c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100317e8
xor eax, eax
jmp 0x10031918
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10031806
xor eax, eax
jmp 0x10031918
push dword [ebp - 8]
push 0x5ecc
lea eax, [ebp - 0xc]
push eax
push 1
push 0x495e
call fcn.1002feb9
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x1003182e
xor eax, eax
jmp 0x10031918
push 0x5155
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10031669
add esp, 0x1c
push 0x2c06
push dword [ebp + 8]
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.10030275
add esp, 0x14
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 4]
push eax
push 0x4c0f
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.1003175a
add esp, 0x10
push dword [ebp - 4]
call fcn.1002fd9c
pop ecx
test eax, eax
jne 0x1003189d
xor eax, eax
jmp 0x10031918
lea eax, [ebp - 4]
push eax
push 1
push 0x1463
call fcn.100316fc
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10031900
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x100318cf
xor eax, eax
jmp 0x10031918
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100318e8
xor eax, eax
jmp 0x10031918
push 0x6110
lea eax, [ebp - 4]
push eax
push 1
push 0x100c
call fcn.1003175a
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10031911
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x10031915
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x1004581f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10045839
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
jmp 0x10045852
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10045852
push 0x1306
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x100772ef
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008a610]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100720d3
mov dword [ebp - 0x14], eax
cmp dword [0x10677278], esi
jne 0x100773e2
push 0x800
push esi
push 0x10005ea8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007736f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100774c2
push esi
push esi
push 0x10005ea8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100774c2
push 0x10005ec0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100774c2
push eax
call ebx
push 0x10005ecc
push edi
mov dword [0x10677278], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10005edc
push edi
mov dword [0x1067727c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10005ef0
push edi
mov dword [0x10677280], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10677288], eax
test eax, eax
je 0x100773df
push 0x10005f0c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10677284], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10077407
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100773fa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007741c
push 4
pop eax
jmp 0x100774c4
cmp dword [ebp - 0x14], esi
je 0x1007741c
push dword [0x10677278]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10077401
mov eax, dword [0x10677284]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007747a
cmp dword [0x10677288], edi
je 0x1007747a
push eax
call ebx
push dword [0x10677288]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007747a
test eax, eax
je 0x1007747a
call ecx
test eax, eax
je 0x1007746f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007746f
test byte [ebp - 8], 1
jne 0x1007747a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100774aa
mov eax, dword [0x1067727c]
cmp eax, edi
je 0x100774a7
push eax
call ebx
test eax, eax
je 0x100774a7
call eax
mov esi, eax
test esi, esi
je 0x100774a7
mov eax, dword [0x10677280]
cmp eax, edi
je 0x100774a7
push eax
call ebx
test eax, eax
je 0x100774a7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10677278]
call ebx
test eax, eax
je 0x100774c2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100774c4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e58e
mov esp, ebp
pop ebp
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x147b2c14
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x431060
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1f1b1b92
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x44a5f6
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xa
cli
call 0x58c0b6a4
adc eax, 0x73e5f5a0
mov al, byte [0x491c94cf]
and byte [esi + 0xb8a6e43], dh
xchg edi, eax
push 0x6411b5e
popfd
sbb byte [ecx], dl
sahf
xor eax, 0x5cc30069
inc esi
push edi
cmp dword [ebx], edx
and dh, byte [esi + 0x1e]
insb byte es:[edi], dx
or dh, byte [ebx - 0x12]
sub dword [edi + 0x5f], eax
lodsd eax, dword [esi]
js 0x44a694
sbb dword [ebx + 0x1ef0fd72], esp
sub ah, byte [ebx + 0x302c938]
cmp cl, cl
add al, byte [ebx]
test dword [ebx], ebx
out dx, al
xor ebx, dword [eax]
cmp al, 0x5c
js 0x44a62c
xor byte [eax - 0x392b6628], 0xb9
xchg ebx, eax
sal bl, 0x27
not dword [esi]
mov dword [eax + 0x59], ecx
into
sbb eax, 0xc36e143e
push eax
adc ebp, eax
jne 0x44a5e9
pop esi
outsb dx, byte [esi]
add ebx, esi
fldl2t
mov dword [0xad68e536], eax
mov esp, dword [esi - 0x1ef79cba]
out dx, al
xchg ebx, eax
add byte [eax], dh
mov cs, ebp
pushal
dec ebx
inc ebp
fidiv dword [edi - 0x3bccd3e3]
dec esi
fnstenv [ebx - 0x62]
jecxz 0x44a6ab
popfd
dec eax
cmp byte [ebp - 0x54], ah
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
wait
sbb ebp, dword [eax]
iretd

Function at 0x587e1e
Capabilities:
Encode data using xor

Disassembly:
and edx, dword [eax + 0x13576035]
dec edi
invalid
movsd dword es:[edi], dword [esi]
push ss
call 0xc78edb4f
inc edx
jns 0x587df0
pop esp
mov dh, 0xbb
inc ebx
push ds
dec esp
inc ecx
push edi
mov word [ecx], gs
add eax, 0xbcb77119
sar dword [ecx + 0x50], cl
std
invalid

Function at 0x65a87c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6634a0
cmp edx, dword [eax]
je 0x65a89e
add eax, 8
inc ecx
cmp eax, 0x663530
jl 0x65a88f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6634a0]
jne 0x65a9cc
mov eax, dword [0xa5bd14]
cmp eax, 1
je 0x65a9a6
test eax, eax
jne 0x65a8cf
cmp dword [0x6612e4], 1
je 0x65a9a6
cmp edx, 0xfc
je 0x65a9cc
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x65a906
lea eax, [ebp - 0x1a4]
push 0x65e9a0
push eax
call fcn.0065b9e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065bad0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65a949
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065bad0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e99c
push edi
call fcn.0065c490
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e980
push eax
call fcn.0065b9e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065b9f0
lea eax, [ebp - 0xa0]
push 0x65e97c
push eax
call fcn.0065b9f0
push dword [esi + 0x6634a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065b9f0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e954
push eax
call fcn.0065c402
add esp, 0x2c
pop edi
jmp 0x65a9cc
lea eax, [ebp + 8]
lea esi, [esi + 0x6634a4]
push 0
push eax
push dword [esi]
call fcn.0065bad0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x404c10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x404c42
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00404a80
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004053f0
pop ecx
mov esi, eax
test esi, esi
jne 0x404c75
push 1
call fcn.00404440
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00404a80
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x407288], eax
mov dword [0x40728c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404cb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x404ccb
mov ebx, dword [0x407358]
mov esi, ebx
xor ecx, ecx
jmp 0x404cee
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404cd6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404ce9
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404cd1
lea eax, [ecx + 1]
push eax
call fcn.004053f0
pop ecx
mov edi, eax
mov dword [0x407294], eax
cmp dword [0x407294], 0
jne 0x404d15
push 1
call fcn.00404440
pop ecx
mov esi, ebx
jmp 0x404d4a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404d1e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404d45
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x404d35
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404d19
mov byte [edi], 0
cmp ebx, dword [0x407358]
je 0x404d61
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11fb4318
Capabilities:
Encode data using xor

Disassembly:
jmp 0x11fb4322
pushal
call 0x11fb4328
pop ebp
sub ebp, 0x10
sub ebp, 0xfb4318
jmp 0x11fb433e
mov eax, 0xfb4318
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c7
mov edx, 0x392fc4c4
xor byte [eax], dl
inc eax
dec ecx
jne 0x11fb4355
jmp 0x11fb4368
dec edi
or dword [edi + 0x4d], ecx
clc
invalid
Function at 0x41265e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004124dd

Function at 0x416882
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004161f0

Function at 0x41688d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041642b

Function at 0x5dc345
Capabilities:
Encode data using xor

Disassembly:
leave
mov al, 0x75
sti
jo 0x5dc2e5
xor byte [bx + si + 0x52], dl
xor byte [eax + 0x52], dl
sal byte [eax], 0xe7
popal
jp 0x5dc32d
cmp al, 0xb9
invalid
cmp al, 0x84
rcr al, cl
loopne 0x5dc3b3
mov eax, 0xbc5b6ce5
stc
insb byte es:[edi], dx
mov edx, 0x7ab74938
in eax, 0x6c
pop ebx
mov esp, 0x38ba6cf9
dec ecx
mov bh, 0x7a
inc ecx
sub al, 0x6a
mov ecx, 0x722fc938
je 0x5dc34d
arpl sp, dx
push ecx
leave
insd dword es:[edi], dx
and ah, bh
jo 0x5dc325
xor byte [bx + si + 0x40], dl
test al, 0x70
mov ecx, 0x9ff03438
dec edx
leave
insd dword es:[edi], dx
call 0xf3655ef6
in al, 0xa4
insd dword es:[edi], dx
mov edx, 0x5172eabb
push edx
sbb ecx, dword [ecx + 0x66b1c76a]
inc esp
inc edi
leave
adc eax, 0xfaef2c9e
dec edx
mov eax, 0x853dfd63
leave
insd dword es:[edi], dx
mov edx, 0x6fdfa269
push ecx
sbb eax, dword [0x6d9fc76b]
adc dh, dl
sti
inc edx
outsb dx, byte [esi]
jno 0x5dc3de
sub eax, 0x6cd9bc69
mov edx, 0xc1dfa238
pushal
sub al, 0x66
mov edx, 0x75dfc951
pushal
imul edi, dword [ecx + ebx*8 - 0x5dc74594], 0x2c60c1df
mov dx, 0xc951
fbstp tbyte [ebp + 0x60]
and al, 0x66
mov edx, 0x44664151
dec ebx
leave
ffreep st(1)
push ecx
adc edx, 0xc5f77a62
neg dword [eax - 0x36c79f0f]
insd dword es:[edi], dx
mov eax, edi
into
outsd dx, dword [esi]
mov ecx, 0xbf35c938
cmp cl, cl
insd dword es:[edi], dx
mov eax, dword [0x2d6db412]
mov esp, 0xa8bbebca
test eax, 0x2abfba6d
invalid
Function at 0x73e9ec
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x73e9f2
pop ebp
sub ebp, 6
sub ebp, 0x33e9ec
jmp 0x73ea50
jmp 0x73ea59
mov eax, 0x33e9ec
add eax, ebp
add eax, 0x93
mov ecx, 0x623
mov edx, 0xd018f6fb
xor byte [eax], dl
inc eax
dec ecx
jne 0x73ea70
jmp 0x73ea83
sti
xchg ecx, eax
mov ebx, 0xfbebfb93
sti
xchg ebx, eax
sti
out 0xde, eax
sti
jp 0x73ea9c
push edx
push ebx
inc ebx
sti
jp 0x73eaa2
push edx
push ebx
inc ebx
sti
enter 0xffffffffffffab3b, 4
outsb dx, byte [esi]
or edi, ebx
cmp ebp, dword [ebx - 0x4f491fc]
xlatb
sti
stosd dword es:[edi], eax
jo 0x73eadd
jo 0x73eb1b
invalid
sti
adc edi, esi
sti
sti
sti
adc dl, cl
sti
sti
sti
scasb al, byte es:[edi]
jbe 0x73ea82
invalid
sbb bh, ah
sti
xchg ebx, eax
movsb byte es:[edi], byte [esi]
xlatb
sti
cli
xlatb
fild qword [edx - 0x40401ed]
sti
adc cl, al
stc
sti
sti
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
cmpsb byte [esi], byte es:[edi]
add al, 0x8e
test dword [esi + ecx*4], 0xfb9d13f3
popfd
sti
sti
sti
jo 0x73eb87
sti
sti
sti
enter 0xffffffffffffc832, 0x29
js 0x73eb5e
invalid
add byte [ebx], dl
hlt
js 0x73eb9c
call dword [edx]
inc esi
add al, 4
add al, 0xd2
scasd eax, dword es:[edi]
ret 0x78f9
adc dl, byte [eax + 4]
add al, 4
cmpsb byte [esi], byte es:[edi]
cmp edi, esi
sti
scasb al, byte es:[edi]
jo 0x73ebbf
lodsd eax, dword [esi]
lodsb al, byte [esi]
scasb al, byte es:[edi]
jo 0x73eb3b
div dword [eax - 0x7a]
pop es
dec ecx
jnp 0x73ec26
std
jp 0x73ebf5
cli
sti
sti
sti
jae 0x73ebba
jp 0x73ebfc
cmp al, 0xfa
cli
sti
sti
sti
inc eax
stc
sti
sti
sti
stc
sub esp, esi
jle 0x73ebcc
sti
sti
sti
jno 0x73ebc0
mov ebp, 0x78f429e9
and eax, dword [esp + eax]
add al, 0xf9
sub esp, esi
jle 0x73ebdf
sti
sti
sti
jno 0x73ebd3
mov ebp, 0x78f429e9
xchg ecx, eax
sti
sti
sti
enter 0xfffffffffffff93b, 0x29
hlt
invalid
jmp 0xd1ece02a
invalid
Function at 0x4bc93d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c5390
cmp edx, dword [eax]
je 0x4bc95f
add eax, 8
inc ecx
cmp eax, 0x4c5420
jl 0x4bc950
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c5390]
jne 0x4bca8d
mov eax, dword [0x4cad20]
cmp eax, 1
je 0x4bca67
test eax, eax
jne 0x4bc990
cmp dword [0x4c52bc], 1
je 0x4bca67
cmp edx, 0xfc
je 0x4bca8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc9c7
lea eax, [ebp - 0x1a4]
push 0x4c1ae8
push eax
call fcn.004bd320
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd7b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bca0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd7b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1ae4
push edi
call fcn.004bf680
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c1ac8
push eax
call fcn.004bd320
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd330
lea eax, [ebp - 0xa0]
push 0x4c1ac4
push eax
call fcn.004bd330
push dword [esi + 0x4c5394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd330
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c1a9c
push eax
call fcn.004bf5f4
add esp, 0x2c
pop edi
jmp 0x4bca8d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c5394]
push 0
push eax
push dword [esi]
call fcn.004bd7b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x68cc5e
Capabilities:
Encode data using xor

Disassembly:
xor ecx, 0x76f53ffd
sub ecx, 0xe7c47d65
add edx, ecx
pop ecx
add edx, eax
sub edx, 0x7ffb2576
jmp 0x68d367
add ebx, 4
push ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
jmp 0x68cd5b
dec ecx
jp 0x68ce17
jmp 0x68c6b6
pop esp
push 0x16f9a48f
mov dword [esp], eax
push 0x3ffd27d4
pop eax
shl eax, 6
jp 0x68d0e5
jmp 0x68d33f
xor ecx, 0x6ef5fb19
jp 0x68ce17
jmp 0x68ca6a
not eax
add eax, 0xff49f502
push ecx
mov ecx, 0x7fbf6640
jmp 0x68cc86
Function at 0x6a4a37
Capabilities:
Encode data using xor

Disassembly:
jl 0x6a4aa8
jo 0x6a4a8e
push ebp
out 0xd2, al
dec eax
jle 0x6a4a6e
call 0x55c56fa5
test eax, 0x7f23629a
dec ebx
sbb byte [ecx], bl
sub bl, al
sub edx, dword [ebp - 0x73f47394]
adc edx, eax
mov eax, dword [0xafe12ed7]
xchg ebp, eax
insb byte es:[edi], dx
mov word [ebx], cs
mov word [ebx], ss
shl byte [ecx - 0x501ed129], 1
adc byte [edi - 0x3d5972c7], 0xf0
div byte [eax]
inc ebp
cmp esp, dword [eax - 0x1a589b3b]
salc
ja 0x6a4a4f
pop edi
popfd
pop eax
test byte [edi + 0x15], bl
arpl ax, di
ret
dec esp
cmp al, 0x5d
mov al, 0xf9
xchg ebx, eax
jno 0x6a4ad7
inc ecx
sbb al, 0xab
js 0x6a4ad1
sal dword [edx + 0xdd336c6], cl
sub ch, byte [ebx]
jnp 0x6a4a36
insb byte es:[edi], dx
mov esp, 0xbd4f57a1
mul dword [edx]
movsd dword es:[edi], dword [esi]
xor dword [edx + 0x17585afb], edx
dec edi
mov ebp, 0x31a522f7
xchg edx, eax
sti
pop edx
pop eax
pop ss
sub eax, 0x7c0a8580
pop edx
movsb byte es:[edi], byte [esi]
lahf
adc esi, ecx
invalid
sub al, 0x35
out dx, al
jmp 0x6a4a95
insd dword es:[edi], dx
dec esi
int3
adc al, 0x22
and eax, 0x2a45371b
jno 0x6a4ac9
fnstsw word [edi + 0x44]
cwde
movsb byte es:[edi], byte [esi]
sahf
fidiv word [eax - 0x66]
xor al, 0x1d
add al, 0xd5
sal dword [esi + esi*4], 0xfa
push edx
fadd qword [edx - 0x3e90daea]
imul ebp, dword [ecx], 0x24
mov ah, 0xca
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
pushal
pop edx
lcall 0x26a1, 0x82b3f159
xchg edi, eax
add dword [ecx], ebp
invalid
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219