joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53796c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x59e068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0052c7f2
mov dword [ebp - 0x14], eax
cmp dword [0x5a96d4], esi
jne 0x537a5f
push 0x800
push esi
push 0x57b600
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5379ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x537b3f
push esi
push esi
push 0x57b600
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x537b3f
push 0x57b618
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x537b3f
push eax
call ebx
push 0x57b624
push edi
mov dword [0x5a96d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x57b634
push edi
mov dword [0x5a96d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5a96dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5a96e4], eax
test eax, eax
je 0x537a5c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5a96e0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x537a84
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x537a77
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x537a99
push 4
pop eax
jmp 0x537b41
cmp dword [ebp - 0x14], esi
je 0x537a99
push dword [0x5a96d4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x537a7e
mov eax, dword [0x5a96e0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x537af7
cmp dword [0x5a96e4], edi
je 0x537af7
push eax
call ebx
push dword [0x5a96e4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x537af7
test eax, eax
je 0x537af7
call ecx
test eax, eax
je 0x537aec
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x537aec
test byte [ebp - 8], 1
jne 0x537af7
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x537b27
mov eax, dword [0x5a96d8]
cmp eax, edi
je 0x537b24
push eax
call ebx
test eax, eax
je 0x537b24
call eax
mov esi, eax
test esi, esi
je 0x537b24
mov eax, dword [0x5a96dc]
cmp eax, edi
je 0x537b24
push eax
call ebx
test eax, eax
je 0x537b24
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5a96d4]
call ebx
test eax, eax
je 0x537b3f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x537b41
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00527afb
mov esp, ebp
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x579b0a9b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5fb944c4
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x40b590
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
out 0x60, eax
in al, 0x31
shl byte [ebx + ecx*4 + 0x52], cl
xor byte [ebx - 0x146ff3ae], cl
push cs
std
enter 0x34c4, 0xffffffffffffff89
and eax, 0xf9f43cf3
jl 0x40b572
pushal

Function at 0x40b750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsd dword es:[edi], dword [esi]
ret
jo 0x40b746
xchg ebx, eax
movsb byte es:[edi], byte [esi]
inc eax
adc byte [eax - 0x388ef615], 0xd7
cmp byte [ebp + ebp + 0x31366086], dl
call dword [eax + 0x701e0eeb]
inc edx
in eax, dx
jae 0x40b6b8
push dword [0x5f176a89]
bnd jnp 0x40b753
cli
out 0xec, al
lea esp, [eax - 0x2e7d7a25]
mov cl, 0x8a
invalid
mov bh, byte [eax]
loopne 0x40b6e4
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rdata
mov ebx, 0x40de38
nop
mov ecx, 0x678666e4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x652732
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1006386
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x1008230], 0
push esi
jne 0x10062f4
call fcn.010061eb
test eax, eax
je 0x1006337
mov eax, dword [0x1008230]
cmp eax, 1
jne 0x1006315
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1006337
pop esi
ret
push eax
call dword [0x1008238]
test eax, eax
jne 0x100637f
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100633b
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x1008230]
call dword [0x1008238]
mov edi, eax
test edi, edi
je 0x1006360
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100637c
mov edi, esi
add esi, 0xff0
push edi
push dword [0x1008230]
call dword [0x1008234]
add edi, 0x10
cmp edi, esi
jb 0x1006368
mov eax, edi
pop edi
pop esi
ret
jmp 0x10062e1
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x33c463c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x3b4404d1
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x408959
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
sub edi, 0xc0ac7a1e
sub esi, 0xa2dc5f6e
call fcn.00408994
and edi, edi
add edi, esi
xor dword [ebx], edx
or esi, esi
sub esi, 0x803c3b52
inc ebx
mov esi, esi
dec esi
cmp ebx, ecx
jne main
sub esi, 0xe6dc727b
sub edi, edi
ret
Function at 0x44015a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x440168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x44014a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x440145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x440145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x40225f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021cb
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
sub esp, 0xfffffff4
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
sub esp, 0xfffffff4
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
sub edx, 0xffffffff
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add edx, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp + 8]
mov dl, byte [ecx]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
and eax, 0xff
mov dl, byte [ecx]
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret
Function at 0x402ae6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x402b40
push eax
push 0x40164a
call fcn.00402b7e
push 7
push 0x54f0bc
push dword [eax + 0x30]
call fcn.00402ed7
cmp eax, 0
jne 0x402b1a
inc eax
jmp 0x402b42
push 0x401662
call fcn.00402b7e
push 7
push 0x54f0bc
push dword [eax + 0x30]
call fcn.00402ed7
cmp eax, 0
jne 0x402b3b
inc eax
jmp 0x402b42
pop eax
mov eax, dword [eax]
jmp 0x402af4
xor eax, eax
ret

Function at 0x402b58
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x402b6c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x402b7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x54f0bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xc1
stosw word es:[edi], ax
cmp ax, 0
jne 0x402b8c
pop edi
pop esi
leave
ret 4

Function at 0x402ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x54f0bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xc1
stosb byte es:[edi], al
cmp al, 0
jne 0x402bae
pop edi
pop esi
leave
ret 4

Function at 0x402de2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x402e33
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x402e33
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x402e3a
add edx, 4
loop 0x402dfa
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x402e41
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x402e8d
cmp dx, 0x41
jb 0x402e72
cmp dx, 0x5a
jbe 0x402e78
cmp dx, 0x61
jb 0x402e84
cmp dx, 0x7a
ja 0x402e84
xor dx, 0x20
jmp 0x402e86
jmp 0x402ea0
cmp dx, word [edi]
je 0x402e8d
jmp 0x402ea0
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x402e5e
mov eax, dword [eax + 0x18]
jmp 0x402ea8
mov eax, dword [eax]
cmp ebp, eax
jne 0x402e53
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x409a1f
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [esi]
cmp ecx, dword [edx - 4]
jne 0x409a2f
mov bl, byte [edx + ecx - 1]
xor bl, byte [esi + ecx]
push dword [edx]
sbb al, 0xe
test bl, 0xdf
jne 0x409a2d
dec ecx
jne 0x409a1c
jmp 0x409a3b
mov cl, byte [esi]
inc eax
lea esi, [esi + ecx + 1]
cmp eax, edi
jle 0x409a15
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x419abc
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
inc ecx
add byte [eax], al
add byte [eax], cl
inc edi
jb 0x419b26
jo 0x419b2f
imul esp, dword [ebx + 0x73], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov al, byte [0x419a]
add byte [eax], al
add bl, dh
lcall 0, 0xc0041
les edx, [eax]
inc eax
add byte [esp + ebp], ch
inc eax
add al, ah
sub al, byte [eax]
or byte [ebx], ch
inc eax
add byte [ebx + ebp + 0x40], cl
add byte [eax + eax], al
adc al, 0
pop esp
wait
inc ecx
add byte [0x6f6c6c41], cl
arpl word [edx + 0x65], dx
jae 0x419b81
jne 0x419b86
arpl word [ebp + 0x13], sp
add al, bl
wait
inc ecx
add byte [esi + eax*2], cl
jb 0x419b85
push edx
jae 0x419b94
jne 0x419b99
jb 0x419b8b
arpl word [ebp + 0x15], sp
add byte [eax], ch
pushfd
inc ecx
adc eax, 0x419c2800
add byte [esi], cl
push cs
inc ebx
push 0x65676e61
push edx
jae 0x419ba9
jne 0x419bae
arpl word [ebp + 0x15], sp
add byte [esp + ebx*4 + 0x41], ah
add byte [esi], cl
inc ecx
jae 0x419bbb
imul esp, dword [edi + 0x6e], 0x6f736552
jne 0x419bc3
arpl word [ebp + 0x10], sp
push esp
push edx
jae 0x419bc8
jne 0x419bcd
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x419aee
ror dword [ecx + 0x66c031c2], 1
rol eax, 5
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x419b6a
ret
jl 0x419b8f
inc ecx
mov bl, byte [eax]
sbb byte [edx], bh
sbb dh, byte [ebp + 9]
cmp bl, byte [edx]
jne 0x419b93
inc edx
inc eax
dec ecx
jne 0x419b84
mov byte [esp], 1
mov al, byte [esp]
add al, 0x24
pop edx
pop ebx
ret
lea eax, [eax]
test dl, dl
je 0x419ba8
add esp, 0xfffffff0
call fcn.0041bcd8
xor byte [ecx], ah
add byte [eax], al
mov dword [eax + 8], ecx
nop
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
movzx edx, word [esi + 8]
push esi
invalid
invalid
mov eax, edi
call fcn.00432ad3

Function at 0x430fd1
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [eax]
mov edi, esi
shl edi, 0x18
mov ebp, esi
and ebp, 0xff00
shl ebp, 8
in eax, 8
in eax, 8
or edi, ebp
mov ebp, esi
and ebp, 0xff0000
add byte [eax], al
inc dword [eax]
shr ebp, 8
or edi, ebp
shr esi, 0x18
or edi, esi
mov dword [ebx], edi
add ebx, 4
add eax, 4
dec ecx
jne 0x430fc1
mov ecx, 0x40
mov edx, dword [esp + 4]
add edx, 0x34
Function at 0x431091
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov edi, edx
shl edi, 0x1e
shr edx, 2
or edi, edx
mov dword [esp + 8], edi
mov edx, ebx
mov ebx, esi
add dword [esp + 0x10], 4
and al, 0x10
add al, 0x49
jne 0x43104d
mov ecx, 0x14
mov esi, dword [esp + 4]
add esi, 0x50
mov dword [esp + 0x14], esi
mov esi, ebx
shl esi, 5
mov edi, ebx
shr edi, 0x1b
or esi, edi
mov edi, dword [esp + 8]
xor edi, edx
xor edi, eax
add esi, edi
add esi, dword [esp + 0xc]
mov edi, dword [esp + 0x14]

Function at 0x4386d9
Capabilities:
Packed with generic packer

Disassembly:
add eax, dword [eax]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor edx, edx
mov dl, byte [esi]
cmp eax, edx
setg byte [ebp - 0xa]
imul cl
jmp 0x438709
add eax, dword [eax]
sbb bh, bl
loopne 0x43867b
setb byte [ebp - 0xa]
jmp 0x4701d1
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x470237
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x470258
jb 0x47024d
outsb dx, byte [esi]
je 0x470241
add byte [edx + 2], ch
les ecx, [ecx]

Function at 0x448163
Capabilities:
Access peb ldr_data

Disassembly:
inc ebp
cld
xor eax, eax
push ebp
push 0x44817c
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.00479333
mov dword [ebp - 0x20], eax
invalid
Function at 0x45822e
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
jb 0x458297
invalid
jae 0x4582ab
and byte [edx + 0x65], dl
push ebx
jbe 0x458310
xor esi, dword [edx]
cmp ah, byte [eax]
add byte [eax], al
add byte [ebx + 0x72], al
into
mov edx, ebx
mov al, byte [ebp - 1]
call 0x4af62f
xor eax, eax
pop edx

Function at 0x45c741
Capabilities:
Enumerate pe sections

Disassembly:
rcl byte [ebp + 0x68], 0x81
mov dword [ebp], 0x6430ff64
mov dword [eax], esp
xor eax, eax
invalid
invalid

Function at 0x45c7cb
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x11cc]
call 0x4b5570
cmp dword [ebp - 0x1084], 0x30
jle 0x45c7a8
daa
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 4]
mov al, 0xc2
call 0x4acfe9
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, 0x406400
call fcn.004647af
call fcn.0045ecc4
lea eax, [ebp - 0x11ec]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
call fcn.0045f11a
mov edx, dword [ebp - 0x11ec]
lea ecx, [ebp - 0x11e8]
mov eax, dword [edi]
pop es
mov eax, dword [eax]
call 0x4b7b77
mov edx, dword [ebp - 0x11e8]
mov eax, dword [edi]
add eax, 0x14
call fcn.0045f033
lea eax, [ebp - 0x11ec]
lea edx, [ebp - 0x1104]

Function at 0x45dfe8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x24
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x18], edx
mov ecx, dword [esp]
mov eax, dword [ecx + 0x40]
mov dword [esp + 0x1c], eax
mov edx, dword [esp]
mov ecx, dword [edx + 0x44]
mov edx, 1
mov dword [esp + 0x20], ecx
mov eax, dword [esp]
mov ecx, dword [eax + 8]
shl edx, cl
dec edx
mov dword [esp + 0x24], edx
mov edx, 1
mov eax, dword [esp]
mov ecx, dword [eax + 4]
shl edx, cl
dec edx
mov dword [esp + 0x28], edx
mov eax, dword [esp]
mov edx, dword [eax]
mov dword [esp + 0x2c], edx
mov ecx, dword [esp]
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x30], eax
mov edx, dword [esp]
mov ecx, dword [edx + 0x28]
mov dword [esp + 0x34], ecx
mov eax, dword [esp]
and al, 0x8b
push eax
and al, 0x89
push esp
and al, 0x38

Function at 0x45e048
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x8b
push eax
and al, 0x89
push esp
and al, 0x38
mov ecx, dword [esp]
mov eax, dword [ecx + 0x2c]
mov dword [esp + 0x3c], eax
xor eax, eax
mov edx, dword [esp]
mov ecx, dword [edx + 0x30]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
mov edx, dword [esp]
mov ecx, dword [edx + 0x18]
mov dword [esp + 0x48], ecx
mov eax, dword [esp]
mov esi, dword [eax + 0x1c]
mov eax, dword [esp]
mov eax, dword [eax + 0x20]
mov edx, dword [esp + 0x3c]

Function at 0x45e500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jae 0x45e515
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
invalid