joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428318
Capabilities:
Encode data using base64

Disassembly:
cmp bh, 0xe9
invalid
ja 0x42b08b
mov ah, ah
mov dword [ebx - 0x3dbbb71], 0xff04768b
mov al, byte es:[0xed880f49]
pop ss
add byte [eax], al
jns 0x409a93
push edx
inc eax
jns 0x40b27c
invalid
shl bh, 0x20
jno 0x420c17
mov bx, bx
jo 0x40b20c
mov ah, 0x9a
lea esi, [esi + 8]
jmp dword [esi]
mov dl, 0x5c
inc edi
jbe 0x4126b2
ficom dword [eax + ecx*4 + 0x663fd2d9]
shr eax, 0x40
mov di, di
jmp dword [esi]
js 0x40b1fc
jns 0x40b288
cpuid
je 0x40b24b
jns 0x40b1fc
xor eax, 0x20e3c0e4
mov ebx, dword [ebp + 0x40]
mov eax, dword [esi + 4]
push edx
pop edx
mov edx, dword [esi + 8]
mov bh, bh
mov al, byte [ebp + eax]
lea esi, [esi + 0xc]
clc
add bp, 0
and byte [ebx + edx], al
jb 0x407670
shr al, 0x40
jmp dword [esi]
shr edx, 0x40
lea esi, [esi + 0xc]
test word [ebp + ebx], ax
jb 0x42752f
jmp dword [esi]
push ebp
pop ebp
xchg esi, edx
jmp dword [esi]
mov esi, dword [esi + 4]
jmp dword [esi]
push esp
xchg ebx, eax
aaa
jb 0x419d38
xor al, 0xf4
pop dword [esp - 4]
mov edi, dword [ebp + 0x48]
shr ebp, 0x40
ja 0x40829b
jbe 0x42832e
cpuid
ret
jbe 0x40829b
xor eax, 0x85e8bd0
mov ax, word [ebp + eax]
jno 0x40da49
jo 0x42834a
in eax, 0xd4
loop 0x428328
jo 0x40da49
add eax, 0x1d5c8ba1
add byte [eax + 0xc768df6], cl
xor word [ebx], ax
jb 0x409a7c
shr edi, 0x40
jmp dword [esi]
call dword [ebp + 0x4c]
shr di, 0x40
mov dword [ebp + 0x3c], esp
mov dword [ebp + 0x44], esi
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x38], ebx
mov esi, dword [ebp + 0x50]
mov si, si
mov dword [ebp + 0x48], edi
jmp dword [esi]

Function at 0x429cb0
Capabilities:
Encode data using base64

Disassembly:
shr ax, 0x40
mov eax, dword [esi + 4]
lea esi, [esi + 8]
setns byte [ebp + eax]
xchg cl, bl
xchg bl, cl
ja 0x419e93
jbe 0x4099f3
jno 0x409a22
out dx, al
int 0xf
xchg byte [edx - 0x27fffefc], bl
popal
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
cmp ebx, ebx
jbe 0x419e93
xchg edx, ecx
xchg cx, dx
shr si, 0x40
mov eax, dword [esi + 4]
xchg ch, ah
xchg ah, ch
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
cmp dword [ebx], eax
shr dx, 0x40
xchg dl, al
xchg al, dl
jmp dword [esi]
test ax, ax
aad 0x54
mov ecx, ecx
jne 0x42c3aa
shr ebp, 0x40
je 0x40d634
mov byte [0xf9a3760], al
test byte [eax - 0x13], dh
add dword [eax], eax
je 0x42c3aa
jmp dword [esi]
add esp, 4
test al, al
jb 0x40d621
je 0x429cf7
jne 0x429cc8
or eax, 0x100685c
add byte [eax], al
push pe_nt_image_headers32
push 0
push 0x489a3c
mov byte [0x47f534], 0
call fcn.00421f17
push 8
push 0
shr ah, 0x40
push 0x489b3c
call fcn.00421f17
add esp, 0x18
push 0x489b3c
push 0x489a3c
jmp 0x429d02
push esi
call 0x42669e
sub dl, 0
add esp, 0xc
and eax, eax
jae 0x429d1a
nop
cpuid
ret 0x830f
jae 0x40c1c2
invalid
js 0x4099d4
xchg ebx, eax
xchg ebx, eax
jns 0x42c3b8
cpuid
nop
ret
jns 0x4099d4
cmp byte [edi - 0x7224769a], 0x76
or al, 0x29
inc esp
sbb eax, 0xe9c08900
mov esi, 0x34ffffb3
jmp 0x8d4b2262
Function at 0x42f480
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x42f503
pop esi
pop ebx
ret

Function at 0x430ec0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x430eea
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x430ed9
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x430f2c
mov al, byte [esi]
mov ebp, esi
inc esi
mov bl, cl
shl bl, 7
mov cl, al
shr al, 1
and cl, 1
or al, bl
mov byte [ebp], al
mov bp, di
dec di
test bp, bp
jne 0x430f0b
test cl, cl
je 0x430f33
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x430ef8
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x431290
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor dl, dl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x4312e1
mov bl, byte [edi]
mov eax, edi
dec edi
mov cl, dl
mov dl, bl
add bl, bl
shr dl, 7
or bl, cl
mov byte [eax], bl
mov ax, si
dec si
test ax, ax
jne 0x4312c5
test dl, dl
je 0x4312ec
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4312b7
xor si, si
test ebp, ebp
je 0x431319
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x431302
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x434e80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x434eb0
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x434fa2
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x434f72
cmp dword [esp + 0x1c], 2
push 0
jbe 0x434f53
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00435050
add esp, 0xc
cmp dword [0x47fa44], 0
jne 0x43503d
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x434f24
jmp 0x434f80
push 0
push esi
call fcn.00435050
add esp, 0xc
cmp dword [0x47fa44], 0
je 0x434f80
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.00435390
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x434ed7
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x434fb8
mov cl, byte [esi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, dword [esp + 0x18]
jb 0x434faa
cmp dword [esp + 0x1c], 2
jbe 0x434fd3
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00435390
add esp, 8
jmp 0x434ff8
cmp dword [esp + 0x1c], 1
jne 0x434fe7
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.00435050
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x435030
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x435017
mov dl, byte [esi + eax - 8]
lea ecx, [esi + eax]
inc eax
mov byte [ecx], dl
cmp eax, dword [esp + 0x18]
jb 0x435007
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x435390
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
push edi
mov eax, dword [edx]
push ebp
mov esi, dword [esp + 0x14]
add edx, 8
mov ebp, 0xc
add dword [esi + 4], eax
mov ecx, dword [edx - 4]
add dword [esi], ecx
mov ebx, dword [esi]
mov edi, dword [esi + 4]
xor edi, ebx
mov cl, 0x20
shr ebx, 4
mov eax, edi
and bl, 0x1f
add edx, 8
sub cl, bl
shr eax, cl
mov cl, bl
shl edi, cl
or eax, edi
mov cl, 0x20
sub eax, dword [edx - 8]
mov dword [esi + 4], eax
mov edi, dword [esi]
xor edi, eax
shr eax, 7
mov ebx, edi
and al, 0x1f
sub cl, al
shr ebx, cl
mov cl, al
shl edi, cl
or ebx, edi
add ebx, dword [edx - 4]
dec ebp
mov dword [esi], ebx
jne 0x4353ae
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x435400
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x90
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov ebx, dword [esp + 0xa0]
push ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jne 0x435430
mov dword [esp + 0x10], 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
cmp dword [esp + 0x14], 1
jbe 0x435525
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
sub eax, 2
mov dword [esp + 0x2c], eax
je 0x435525
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x28], 0
jne 0x4354e5
lea eax, [esp + 0x30]
push 0
push eax
push ebx
call fcn.00435050
add esp, 0xc
cmp dword [0x47fa44], 0
jne 0x435622
mov eax, dword [esp + 0x30]
lea edi, [esp + 0x38]
mov esi, 0x19
mov dword [esp + 0x38], eax
mov eax, dword [edi]
mov cl, 0x20
add eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [edi + 4], eax
add edi, 4
mov eax, dword [esp + 0x30]
mov edx, dword [edi - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x3c], eax
dec esi
jne 0x4354b6
jmp 0x4354f3
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.00435630
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor dword [ebx], eax
mov edx, dword [esp + 0x20]
xor dword [ebx + 4], ecx
mov eax, dword [esp + 0x24]
add ebx, 8
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x2c]
jb 0x435474
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x10], eax
je 0x43554e
mov eax, dword [esp + 0x10]
lea esi, [ebx + 8]
lea edi, [esp + 0x18]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x14], 1
jne 0x435576
push 0
push 0
push ebx
call fcn.00435050
add esp, 0xc
cmp dword [0x47fa44], 0
je 0x4355ac
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
cmp dword [esp + 0x14], 2
jne 0x43559e
push 0
push 0
push ebx
call fcn.00435050
add esp, 0xc
cmp dword [0x47fa44], 0
je 0x4355ac
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.00435630
add esp, 8
cmp dword [esp + 0x14], 1
jbe 0x435615
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
xor dword [esp + 0x18], eax
xor dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0x4355df
mov dl, byte [ebx + ecx + 8]
lea eax, [ebx + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x10]
mov dl, byte [esp + ecx + 0x17]
mov byte [eax + 8], dl
jb 0x4355c8
cmp dword [esp + 0x14], 2
jne 0x435607
push 0
push 0
push ebx
call fcn.00435050
add esp, 0xc
cmp dword [0x47fa44], 0
je 0x435615
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.00435630
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor dword [ebx], eax
xor dword [ebx + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
Function at 0x435630
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0xc
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push ebp
add edi, 0x64
mov ebp, dword [esi]
mov eax, dword [esi + 4]
sub ebp, dword [edi]
mov edx, eax
shr edx, 7
mov ebx, ebp
and dl, 0x1f
mov cl, 0x20
sub cl, dl
sub edi, 8
shl ebx, cl
mov cl, dl
shr ebp, cl
or ebx, ebp
mov cl, 0x20
xor ebx, eax
mov eax, ebx
mov dword [esi], ebx
shr eax, 4
mov edx, dword [edi + 4]
add edx, dword [esi + 4]
and al, 0x1f
mov ebp, edx
sub cl, al
shl ebp, cl
mov cl, al
shr edx, cl
or ebp, edx
xor ebp, ebx
dec dword [esp + 0x10]
mov dword [esi + 4], ebp
jne 0x43564a
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
mov ecx, dword [eax + 4]
sub dword [esi], ecx
mov edx, dword [eax]
sub dword [esi + 4], edx
pop esi
pop ebx
add esp, 4
ret

Function at 0x436310
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push 0
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x436339
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
inc esi
push esi
call fcn.004311a0
mov dword [esp + 0x10], eax
add esp, 4
test eax, eax
jne 0x436354
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0xc]
push esi
push eax
push ebx
call edi
test eax, eax
jne 0x43636a
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x448e69
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
js 0x45bb90
jns 0x448e78
jns 0x45bb90
jmp dword [esi]
Function at 0x44c1c5
Capabilities:
Get file size

Disassembly:
mov cx, cx
jmp 0x45ad3f
push edx
pop edx
push ebp
mov ecx, dword [esp + 8]
shr dl, 0x40
mov ebp, esp
sub esp, 4
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 4], 0
mov ecx, 0xffffffff
xchg di, ax
xchg di, ax
jne 0x45ad7f
xchg dx, ax
xchg dx, ax
je 0x45ad7d
int 0xed
outsd dx, dword [esi]
mov ecx, eax
mov eax, ecx
mov esp, ebp
xchg bp, di
xchg di, bp
pop ebp
ret

Function at 0x45147a
Capabilities:
Encrypt data using speck

Disassembly:
add esp, 4
add esp, 4
call fcn.00441852
fidivr dword [ebx + 0x424648d]
lea esp, [esp + 4]
or ebx, eax
jb 0x45eaeb
shr ch, 0x40
je 0x467eb0
jne 0x4514a8
jae 0x4514c6
sahf
lea eax, es:[ebx - 1]
lea eax, [ebx - 1]
cmp dword [edi + 4], eax
ja 0x467eb0
jbe 0x4514ba
pop ds
outsb dx, byte [esi]
cmc
and byte [edi], cl
xchg dword [eax + 0x7600013d], esp
add esi, ebp
ja 0x465260
jbe 0x4514c5
cmc
sal edx, 0xf
jbe 0x465260
xchg byte [ebp - 0x7dfffec3], dl
pop ebp
xor bl, 0x5d
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
push eax
call fcn.00447636
add esp, 4
shl edi, 0x20
mov eax, dword [esi]
push 0x1b
jno 0x467e90
jo 0x465282
mul dword [esi]
sal ebp, 0xf
or byte [eax], 0x2c
add byte [eax], al
jo 0x467e90
shr ebx, 0x40
jmp 0x467e94
push eax
call fcn.0043b4a9
add esp, 8
mov cx, cx
pop edi
pop esi
shr eax, 0x40
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [ebx]
lea eax, [ebp - 0x1c]
shr si, 0x40
lea ecx, [ebp - 0x28]
push eax
lea ebp, [ebp]
lea edx, [ebp - 0x24]
push ecx
push edx
call fcn.0044357f
add esp, 0xc
cmp dword [ebp - 0x1c], 0x7cf
xchg cl, dh
xchg dh, cl
jge 0x467ef4
jl 0x467ee6
invalid
mov dword [ebp - 0x10], 0
jmp 0x462b6b
mov eax, dword [ebp - 0x1c]
jmp 0x452270

Function at 0x45198c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esp, eax
mov ch, cl
mov bl, 0xea
add byte [eax], al
add eax, 0x7913689a
inc esi
add bl, al
invalid
lea esp, [esp + 4]
jne 0x465c55
mov di, di
je 0x45199e
out 0x91, al
xor ah, byte [esi - 9]
invalid
test di, 0x5f0
xor eax, eax
jb 0x445510
mov dx, word [ebp - 0x64]
mov cl, byte [ebp + eax - 0x10]
sub cl, 0x58
sub dl, 0x34
test bl, 0xa1
xor cl, dl
jb 0x445517
inc eax
cmp cx, cx
cmp eax, 8
mov byte [ebp + eax - 0xf5], cl
jl 0x4519ab
jge 0x4519e0
sub al, 0x90
mov al, 0xe8
jbe 0x451a0b
call fcn.0046425b
add dword [eax], eax
and byte [esi - 1], 0xf5
mov ebp, esp
push 0
push 0x80
push 3
push 0
shr ch, 0x40
mov eax, dword [ebp + 8]
push 1
push 0x80000000
jmp 0x451a04
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ch, ch
mov ecx, dword [ebp + 0xc]
add byte [eax + 0xc4d8bed], cl
pop ebp
call fcn.00455adf
and eax, 0x810f563d
add al, 0xef
invalid
rol esi, cl
inc ebp
stc
Function at 0x45cf1a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebx, dword [esi + 8]
push ebp
pop ebp
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
jmp dword [esi]
push edi
mov eax, dword [esi]
jmp 0x45cf04
push eax
jno 0x443048
jo 0x45cf12
nop
cpuid
ret
jo 0x443048
add eax, 0x24448f68
cld
jne 0x440100
je 0x45cf29
xlatb
adc esp, dword [bx + di]
div byte [ecx]
ror byte [edi], 0x82
iretd
and esi, esi
xor eax, eax
jb 0x464502
pop edi
pop esi
pop ebx
pop ebp
ret
add dword [edi], ebx
mov eax, eax
mov eax, eax
mov eax, dword [esi + 4]
jno 0x4509ae
invalid
jo 0x464515
jns 0x46450e
jo 0x4509ae
fidiv dword [0xfc24448f]
jmp dword [esi]
Function at 0x45f2bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
invalid
pop dword [esp - 4]
shl dh, 0x20
mov ebx, dword [esi + 8]
mov esi, esi
jne 0x4657f1
je 0x45f2d4
sub dword [ebx], ebp
mov cl, 0xf
test byte [edi], dl
add byte gs:[eax], al
je 0x4657f1
fldenv [eax]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov al, byte [eax]
js 0x454bd6
shr dx, 0x40
jns 0x45f2f4
cpuid
push cs
ret
jns 0x454bd6
add eax, 0x24648dde
add al, 0x8b
inc esi
add al, 0x80
jmp 0x45f306
add esi, 8
add ebx, eax
and ah, ah
test ecx, 0x80000000
jb 0x448ad4
xchg al, dh
xchg dh, al
jne 0x4513e1
lea ebp, [ebp]
je 0x45f32d
fprem
mov ecx, ecx
push edx
pop edx
mov ecx, dword [esi]
add esi, 4
test ecx, 0x1000
jb 0x45d508
je fcn.0045814c
jne 0x45f351
aas
cpuid
ret
jno 0x46724e
jo 0x45f35b
and dl, ch
jo 0x46724e
ficom dword [ecx]
mov eax, dword [ebp + eax]
lea esi, [esi + 0xc]
mov dword [ebp + ebx], eax
call 0x449f84
fcmove st(0), st(1)
push 0x44ab89
ret
Function at 0x468d24
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + 0x14]
mov ebp, esp
and edx, edx
sub esp, 0x40
jno 0x43d4aa
jo 0x4594c2
mov dl, 0xbb
sub dword [edi], ecx
and dl, 0x3f
invalid
jo 0x43d4aa
add eax, 0x24648d36
add al, 0xff
invalid
push ebp
jno 0x4594a9
shr bh, 0x40
jo 0x468d34
cld
and dword [ecx + 0xf], esp
sub byte [edi + 7], 0xff
push dword [esi + esi*8]
jo 0x4594a9
xor al, 0xf6
Function at 0x46b590
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x46b5b4
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x46b5ce
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.0046ccd0
add esp, 0xc
cmp si, 0xfc
jbe 0x46b619
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.0046d640
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x46b6c7
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x46b649
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [edx + ebx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x46b665
jmp 0x46b78a
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.0046ccd0
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.0046ccd0
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x46b701
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x46b720
lea eax, [esp + 0x18]
push 0
push pe_nt_image_headers32
push eax
call fcn.0046ccb0
add esp, 0xc
mov edx, dword [esp + 0x14]
push pe_nt_image_headers32
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.0046d690
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x46b8f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x46b91c
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.0046b590
add esp, 0xc
test ax, ax
jne 0x46ba68
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x46b964
cmp eax, 1
je 0x46b9de
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x46b985
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0046d690
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.0046d7f0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x46b99b
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x46b9c6
mov eax, dword [esp + 8]
jmp 0x46ba4f
mov eax, dword [esp + 0x188]
test eax, eax
je 0x46b9ff
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0046d690
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.0046d7f0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x46ba15
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x46ba3d
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.0046ccb0
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret