joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10048a70
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10048c34
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3f000]
push edi
or ebp, 0xffffffff
jmp 0x10048a9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10048aa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10048a90
mov eax, 1
add ebx, ebx
jne 0x10048ab3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10048aa8
jne 0x10048ac4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10048aa8
xor ecx, ecx
sub eax, 3
jb 0x10048ad8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10048b4a
mov ebp, eax
add ebx, ebx
jne 0x10048ae3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10048af0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10048b14
inc ecx
add ebx, ebx
jne 0x10048b00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10048af5
jne 0x10048b11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10048af5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10048b34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10048b25
jmp 0x10048a96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10048b34
add edi, ecx
jmp 0x10048a96
pop esi
mov edi, esi
mov ecx, 0x1211
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10048b52
cmp byte [edi], 6
jne 0x10048b52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10048b57
lea edi, [esi + 0x46000]
mov eax, dword [edi]
or eax, eax
je 0x10048bc6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4829c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x48300]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10048b84
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x48304]
or eax, eax
je 0x10048bc0
mov dword [ebx], eax
add ebx, 4
jmp 0x10048ba1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10048bf7
cmp al, 0xef
ja 0x10048bea
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10048bcc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10048bd9
mov ebp, dword [esi + 0x48308]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10048c2b
sub esp, 0xffffff80
jmp 0x1002cd50
Function at 0x41168b
Capabilities:
Print debug messages

Disassembly:
jmp 0x41dff5
push esi
mov esi, ecx
call fcn.00411703
mov eax, 0x400000
mov dword [esi], 0x38
lea ecx, [esi + 0x14]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], 0xe00
mov dword [esi + 0x10], 0x427b48
call fcn.004112cb
test eax, eax
jns 0x41e044
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41e03d
push str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x42cb94], 1
mov eax, esi
pop esi
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..retplne
nop
nop
mov ebx, 0x40de38
mov ecx, 0x3ae628e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x536a32f2
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x6202030d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x15af59c9
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40551a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44ff3c]
jne 0x405524
repz ret
jmp fcn.00409312

Function at 0x40bdac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406f74
and dword [ebp - 4], 0
cmp dword [0x4518a0], 0
mov ebx, eax
jne 0x40be5d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bf0e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x416bb0
push edi
call esi
test eax, eax
je 0x40bf0e
push eax
call fcn.00406f02
mov dword [esp], 0x416ba0
push edi
mov dword [0x4518a0], eax
call esi
push eax
call fcn.00406f02
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4518a4], eax
call esi
push eax
call fcn.00406f02
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4518a8], eax
call esi
push eax
call fcn.00406f02
pop ecx
mov dword [0x4518b0], eax
test eax, eax
je 0x40be5d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406f02
pop ecx
mov dword [0x4518ac], eax
mov eax, dword [0x4518ac]
cmp eax, ebx
je 0x40beb5
cmp dword [0x4518b0], ebx
je 0x40beb5
push eax
call fcn.00406f7d
push dword [0x4518b0]
mov esi, eax
call fcn.00406f7d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40beb5
test edi, edi
je 0x40beb5
call esi
test eax, eax
je 0x40beac
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40beac
test byte [ebp - 0xc], 1
jne 0x40beb5
or dword [ebp + 0x10], 0x200000
jmp 0x40beee
mov eax, dword [0x4518a4]
cmp eax, ebx
je 0x40beee
push eax
call fcn.00406f7d
pop ecx
test eax, eax
je 0x40beee
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40beee
mov eax, dword [0x4518a8]
cmp eax, ebx
je 0x40beee
push eax
call fcn.00406f7d
pop ecx
test eax, eax
je 0x40beee
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4518a0]
call fcn.00406f7d
pop ecx
test eax, eax
je 0x40bf0e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bf10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410200
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
not eax
not edi
imul edi
rcl edx, 0xf3
inc esi
neg esi
rol eax, 0xee
rcr edx, 0x77
not ebx
not eax
ror edx, 0xec
rcl esi, 0x63
neg esi
and ebx, 0x2a
rol eax, 0x85
inc eax
sub esi, 0x35
rol ebx, 0x7d
imul ebx
ror eax, 0xb0
rcr esi, 0x21
mov edx, 0xc8
rcr ebx, 0x41
sbb edx, 0x30
bswap edi
imul esi
not edx
dec esi
sbb esi, 0x5d
sub edx, 0x59
dec esi
not esi
rcr eax, 5
sbb esi, 0x2d
or edx, 0x90
rol esi, 0xd2
imul esi
sub eax, 0x43
bswap edi
rol edi, 0x80
inc esi
rcl eax, 0xbc
dec ebx
neg edi
sub esi, 0x61
inc ebx
rcl eax, 0xf3
sbb edi, 0x89
sbb edx, 0xe0
rcl esi, 0xd1
xor ecx, ecx
xor edi, edi
rcr edi, 4
sub ebx, 0x9e
add eax, 1
and ebx, 0xe7
inc ebx
bswap ebx
rcr esi, 0xb5
neg edx
imul edi
sbb esi, 0x9b
add ebx, 0x87
sbb esi, 0xd6
and esi, 0x73
not edi
or edi, 0xb3
rcl esi, 0x3b
inc edx
and esi, 0x2e
inc esi
ror edi, 0x47
rcl edi, 0x2a
or eax, 0xf1
bswap ebx
sub edx, 0x7e
dec esi
ror edi, 0xba
rcl esi, 0x7c
sub edx, 0x33
add ebx, 0xc3
mov ebx, 0xbe
not eax
neg esi
inc edx
mov eax, 0x1e
neg edi
rcr edx, 0xa7
dec ebx
not edx
rcl esi, 0xad
sbb eax, 0x8b
sub eax, 0x54
rcr eax, 0xf9
add eax, 0xf4
rcr eax, 0x9e
rcr ebx, 0xc7
mov edi, 0x61
or edi, 0x80
sbb edx, 0x40
not ebx
bswap edi
mov ecx, dword [ebp + 0xc]
neg eax
or esi, 0xd5
sub esi, 0x55
inc eax
add eax, 0xe3
imul edi
and eax, 0xcc
inc edx
or eax, 0xbe
neg edi
bswap eax
not ebx
inc eax
neg eax
add eax, 0x3a
not edi
dec esi
bswap eax
mov edi, 0xa9
rcr edi, 0x5a
dec eax
rol eax, 0x26
inc edi
rcl esi, 0x47
sub eax, 0x45
dec eax
bswap esi
neg eax
neg edx
dec ebx
rcr esi, 0xb5
sbb edi, 0xbf
inc eax
neg edx
inc edi
rcr ebx, 0x5f
dec eax
inc esi
or edx, 0x7e
sbb eax, 0x49
sbb edx, 0x80
not edx
imul edx
dec ebx
ror esi, 0x3a
dec eax
bswap esi
dec eax
inc ebx
sub edx, 0x8d
mov edi, dword [ebp + 8]
xor ebx, esi
mov esi, esi
mov ebx, ebx
not byte [edi]
xor ebx, ebx
xor ebx, ebx
xor eax, ebx
mov esi, esi
xor eax, ebx
xor esi, ebx
mov eax, ebx
xor esi, esi
mov ebx, ebx
add byte [edi], 0x48
xor eax, eax
xor ebx, eax
mov eax, ebx
mov eax, esi
xor eax, eax
mov esi, ebx
mov esi, eax
mov esi, ebx
xor esi, esi
sub byte [edi], 0x97
mov ebx, ebx
xor esi, esi
mov eax, esi
mov eax, eax
mov eax, esi
xor ebx, eax
mov eax, eax
xor esi, esi
mov ebx, esi
imul byte [edi]
inc edi
loop 0x4103b8
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6a100e
Capabilities:
Encode data using xor

Disassembly:
movsx ebx, cx
pop ebx
cpuid
push 0x671f0a03
sub ebp, 0xc
jmp 0x7e8465
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
call fcn.007719e8
dec edi
inc esi
sub al, 9
jno 0x7e84b5
out dx, al
leave
adc dh, byte [ebp - 0x2b]
or byte [edx + 0x6884d7a7], ch
stosd dword es:[edi], eax
imul eax, dword [eax - 0x51], 0xe4f934a4
pop eax
add byte [edx + 0x5f], 0xf0
xor dl, byte [edx - 1]
rcr byte [edi], 1
pop ds
test eax, 0xd55b0ea0
cwde
xchg bl, ch
dec ebx
jae 0x7e8478
call 0x6d37c41e
cmpsb byte [esi], byte es:[edi]
jmp 0x7e8502
or cl, byte [ebp + ecx + 0x49]
adc ch, byte [eax - 0x57]
dec esi
cmp eax, 0xcfa2208d
and dl, al
pop ebp
fcomp qword [edi - 0xadcdde]
je 0x7e8475
push cs
xchg ebx, eax
jne 0x7e84d9
lock xor byte [esi + 0x7f], dh
rcr dword [esi + edx*2], 1
or ecx, dword [0x2280b830]
or eax, 0x2280b830
xor ebx, dword [ecx - 0x5152a92c]
in eax, 0x25
jb 0x7e8493
mov dl, 0x14
retf
dec ecx
push ebx
imul ebp, edi, 0xffffff81
dec dword [edi + 0x22a73e72]
cmp eax, 0x2e
push edx
in eax, dx
and edx, dword [edx - 0x43]
push 0x2e524597
jns 0x7e8568
cmp eax, dword [edx + 0x13]
fisttp word [ebx + ecx*2 - 0x543028a8]
fst qword [ecx + 0x4552f944]
cmp dword [esi + 0x30], ebp
mov al, 0x1c
rcr byte [edi*2 - 0x10fc3b62], 0xef
xor byte [eax + 0x7d1cc01c], dh
sahf
les eax, [ebx]
out dx, eax
out dx, eax
cmp dword [edi + 0x4f], 0x82bcf98e
stc
arpl word [ebp - 0x369ecf06], sp
mov eax, 0x69b21807
aam 0xab
mov esp, 0x60fa97c0
xchg edi, eax
cli
pushal
mov ah, 0xe5
das
jle 0x7e8530
cmpsd dword [esi], dword es:[edi]
dec eax
pop ecx
loope 0x7e8593
retf
xchg dword [ecx], ebx
ficom dword [eax]
and al, 0xd9
xor bh, ch
jo 0x7e8595
add edi, dword [ebx - 0x3cbb5544]
adc al, 0x26
in al, 0xd8
rcr al, 1
mov dword [edi + edi*8 + 0x45146fba], ecx
push eax
push ebp
cmp ebp, dword [esi + 0xb]
fisub word [ebp + 0x1ff466c0]
out 0xea, al
invalid
invalid
adc eax, 0x58666f30
pop es
leave
pop esp
and al, ch
xchg byte [esi - 0x80], bh
stosb byte es:[edi], al
jp 0x7e85b1
imul byte [ecx + 0x1dfe4a67]
jbe 0x7e8617
ret
test eax, 0x5491bac2
movsb byte es:[edi], byte [esi]
bound edx, qword [ebx]
cld
lodsd eax, dword [esi]
cmp byte ss:[bx], 0x79
push 0x13b805d0
add al, 0x78
das
inc edx
and byte [eax + 0x2c], 0x77
add eax, ebx
jns 0x7e8552
invalid
cli
invalid
Function at 0x6a4a81
Capabilities:
Encode data using xor

Disassembly:
pop edx
das
cmp eax, 0x6eb09e99
xor byte [ebp - 0x16f7db9c], cl
lea esp, [esp + 8]
jmp fcn.0073983c
mov dword [ebp], eax
lea esp, [esp + 4]
jmp fcn.0078dabc
mov word [0x1766e800], cs
adc byte [eax], al
call fcn.007a61ec
mov ecx, 0xf58197b2
call fcn.00988b2d
cmovnp ebp, dword [ecx + 0x32fedb2c]
xlatb
shr dword [ebx - 0x33e3993d], 0xf1
sbb eax, 0xda2b28cc
jns 0x6a4a59
sub ch, byte [esi - 0x4ae16b7e]
jmp 0x6a4b16
jge 0x6a4a7e
popal
div byte [esp + ebp*4 - 0x3d968168]
inc ebx
inc ebx
push edi
mov dword [esi + 0x60743c3d], ebx
sar edx, 0x7b
jae 0x6a4ac5
jns 0x6a4aee
jge 0x6a4ade
fsubr qword [eax + 0x6e]
mov ecx, 0xece3d332
xor dword [edx + eax*2 - 0x6627d4a4], ebp
sub ebx, eax
cdq
kxnorw k1, k1, k5
ljmp 0x5b23
inc esi
mov ch, 0x84
mov ecx, 0x541ce455
test byte [ecx + 0x541ce455], bh
xor eax, 0xa5fed6d7
xor edx, eax
jge 0x6a4adc
popal
xor ecx, dword [ebp + 0x43]
adc al, 0xd7
jbe 0x6a4b13
mov dl, 0x44
mov bl, 8
mov dword [ecx], ebp
popfd
adc eax, dword [edi + ebp*4]
dec esi
add al, byte ss:[ebx + edx + 0x50]
push ecx
cmp dword [0xcecf1c6b], ecx
mov dl, 0x2c
cmp ebx, eax
cmp ecx, ecx
std
xchg ebx, eax
xchg edi, eax
retf

Function at 0x7897ae
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + 4], 0xac96e683
lea eax, [esp + eax + 8]
mov dword [eax], ebp
lea esp, [esp + 8]
jle fcn.006980ed
add esi, dword [ebp + 0x4e]
dec esp
cmp byte [esi], cl
cmpsb byte [esi], byte es:[edi]
and eax, 0x663d44da
pop ecx
dec ecx
add ch, al
or byte fs:[ecx + 0x4b], al
pop ss
xor edx, dword [ebx - 0x5673d4a6]
xchg ebx, eax
and ebx, dword [eax + 0x2e]
jno 0x7897d6
cmp byte [ebx + ecx*8 - 0x6c], dl
or ch, dl
int3

Function at 0x7ba784
Capabilities:
Encode data using xor

Disassembly:
sub edi, 1
call fcn.008e1146
aas
lodsd eax, dword [esi]
leave
je 0x7ba7a8
das
stosb byte es:[edi], al
sub dl, byte [esi - 0x6d6e14da]
add ebp, esi
retf 0xcc61
push ss
or eax, 0x36ae9f9e
sub esi, esp
stc
xor ch, byte [0xcd9d8562]
add dword [ecx], ecx
jp 0x7ba7a9
out 0xae, eax
invalid

Function at 0x7da282
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor bl, ah
inc ecx
neg bl
inc ecx
sub bl, 0x15
inc ecx
rol bl, 1
inc ecx
sub bl, 0x1f
call fcn.007a4508
outsb dx, byte [esi]
xor bh, byte [edi + 0x16]
push edx
leave
cwde
push ebx
stc
scasb al, byte es:[edi]
dec esp
xchg esi, eax
invalid

Function at 0x7e0167
Capabilities:
Encode data using xor

Disassembly:
test esi, esi
lea esp, [esp + 8]
je 0x7e01a8
push edi
movzx edi, byte [eax]
push 0x8523a980
xor edi, edx
and edi, 0xff
mov edi, dword [edi*4 + 0x6a96a4]
shr edx, 8
shr byte [esp + 1], 0xc5
xor edx, edi
inc eax
xor edx, 0xa0815236
dec esi
lea esp, [esp + 4]
jne 0x7e0174
pop edi
push 0xe91a5c1e
push 0xf532ffa3
not edx
mov dword [ebp], edx
lea esp, [esp + 8]
jmp fcn.0077c7fa

Function at 0x7e5f11
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
rcr dl, 0x3f
mov edx, dword [ebp + 8]
sub esp, 0x114
clc
cmp edx, esi
push esi
test edx, edx
jmp 0x7547ad
Function at 0x9052b0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor al, bl
add al, 0x2e
neg edx
not al
js 0x6a8a0a
add byte [eax], al
push edx
insb byte es:[edi], dx
popal
jae 0x90532c
inc esp
inc ebx
add byte [eax], al
add ah, ah
push ebx
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x5ac5], ah
and byte [eax], ch
add byte [esi + edx*2 + 0x50], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x7fffc8f8], dl
and ch, byte [eax]
add byte [esi + edx*2 + 0x50], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
pushfd
loope 0x90532d
add byte [eax - 0x5bffd7de], ch
push esi
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], ah
jnp 0x905354
add al, al
and ch, byte [eax]
add al, bl
push esi
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, ch
loope 0x905368
add ah, dh
hlt
and ch, byte [eax]
add ah, ah
push esi
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], bh
push ebp
aas
add byte [eax], al
and ebp, dword [eax]
add al, bh
push esi
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, bh
xor al, 0
adc al, 0x23
sub byte [eax], al
sub al, 0x57
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi + edx], bl
xor eax, 0x28234800
dec eax
and ebp, dword [eax]
add byte [edi + edx*2], dh
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x55], bh
dec esi
add byte [eax + 0x23], dl
sub byte [eax], al
cmp al, 0x57
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], bl
cmp al, byte [eax]
pop eax
and ebp, dword [eax]
add byte [eax + 0x57], ch
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], dh
xor edi, dword [edi]
add byte [ebx + 0x577c0028], al
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, ch
sub dword [esi], edi
add byte [eax - 0x7bffd7dd], bl
push edi
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx - 0x5fffa53b], ah
and ebp, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esp + ebp*4 + 0x35], bh
add byte [edx], ah
xchg esp, eax
cmp al, 0
cmpsb byte [esi], byte es:[edi]
loope 0x905424
add byte [eax], dl
jb 0x90541d
add byte [esi], cl
sub ebp, dword [ecx]
add byte [eax], bl
dec ebp
sub byte [eax], al
and cl, 0x3d
add byte [eax + ebp*2 - 0x7407ffa8], cl
aaa
add byte [eax], bl
and dh, byte [0x4f701600]
add byte [esi - 0x15ffc8b3], bl
invalid
mov eax, dword [0x4bce0028]
add byte ds:[edx], ch
invalid
sub bl, bl
xor eax, 0x35619800
add byte [eax - 0x6c], cl
cmp dword [eax], eax
retf 0x3632
Function at 0x9b2117
Capabilities:
Encode data using xor

Disassembly:
push 0xdc8a86b9
push 0x7a276296
lea esp, [esp + 0x10]
jmp fcn.007e77ab

Function at 0x9b21b0
Capabilities:
Encode data using xor

Disassembly:
pop edx
pop ecx
pop ebp
jne 0x739825
add byte [eax], al
add byte [edx + 0x69], al
je 0x9b2202
insb byte es:[edi], dx
je int.009b21c3
push edx
add eax, 0xd1f02ae9
sbb cl, byte [0x837560b5]
push cs
lahf
xchg esi, eax
js 0x9b2236
wait
add bl, bl
daa
shr dword [edx + ebx*4 - 0x59], 1
aas
invalid
mov edi, 0x83eff260
movsb byte es:[edi], byte [esi]
clc
stosd dword es:[edi], eax
push edi
adc al, 0xd7
mov eax, 0x1e1ba10e
dec ecx
invalid

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x59b114b3
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x66c274c7
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x430004
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x7b6f50be
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x5f77b85
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x414ded
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], edi
add ecx, 4
add esi, eax
sub eax, eax
cmp ecx, ebx
jne fcn.00414ded
ret
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40915c
nop
nop
mov ecx, 0x5da27664
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x30016669
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x694e2cce
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x68a04487
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40915c
nop
nop
mov ecx, 0x58fb01f7
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..reloc_1
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x77227468
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219