joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414dc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x414ded
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414ded
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..pdata
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x41700e
Capabilities:
Encode data using xor

Disassembly:
out 0xd2, eax
popal
sbb ch, byte [edi + 0x63]
cmp al, byte [ebp - 0x6f]
scasb al, byte es:[edi]
add dword [ebx + 0x401cbe85], edx
invalid
sbb byte [ecx], ch
lds ebp, [edi - 0x2dc8acfb]
mov es, esi
pop ss
mov dh, 0xb5
mov byte [edi], ch
push ebp
fstp xword [eax - 0x222d7a07]
rcl byte [ebx + eax*2 + 6], cl
mov dl, 0xa7
pop ss
pop edx
lcall 0xa27f, 0x448ad9ae
inc esp
jg 0x416f34
xor bh, byte [esi + 0x19d7c0be]
fld dword [ebx + 0x70391359]
out 0xc0, eax
push cs
add bl, byte [edx]
dec edi
jae 0x416f6c
fdiv dword [edx - 0x16]
mov ah, 0x8a
cmp byte [ebx - 0x30], dl
and eax, 0x90a9e0db
fistp dword [ebx + 0x3187c3ee]
pop eax
ficom dword [esi]
dec ebx
mov ah, 0x27
aam 0x82
pushal
stosb byte es:[edi], al
adc dh, byte [0x333a9de4]
movsd dword es:[edi], dword [esi]
adc al, byte [ebp + ebp*4 - 0x7fb8474d]
mov cl, 0x49
mov ecx, 0x8d1654a9
int 0x16
test byte [ecx - 0x6f], cl
add eax, 0x18cb075e
mov eax, dword [0xa607c5f2]
ja 0x41705f
int3
aad 0xa1
jmp 0x416f8f
push cs
out 0xbf, eax
cmp edi, dword [ecx - 1]
sbb byte [ebp + eax*2 - 0x2e], 0x24
xchg ecx, eax
sbb dword es:[ecx], 0xffffff83
inc esp
mov bl, 0x9c
inc esp
xchg dword [edi + 0xc], esp
ror byte [edx + 0x2e5f7c41], cl
adc eax, 0x507676f
sar byte [esi + 0x5315072], cl
loopne 0x416ffb
cwde
xor esi, dword [edx]
movsd dword es:[edi], dword [esi]
mov dl, 4
mov ebp, 0xa2a6d7e5
salc
xchg edx, eax
rcl byte [esi + 0xbb09758], 0xc3
div byte [edi - 0x7c17173]
stosb byte es:[edi], al
jne 0x417014
daa
or al, 0x26
rcl eax, 0x89
xchg esp, eax
test eax, 0xd6814050
xor al, 0xb6
xor eax, 0xb5e6f566
inc eax
adc esi, 0x6635b634
cmc
out 0xb5, al
inc eax
movsb byte es:[edi], byte [esi]
pop eax
lds esp, [ecx + 0x2c3b2c02]
xchg esp, eax
xor bh, byte [ebx]
mov bl, 0x47
invalid

Function at 0x421661
Capabilities:
Packed with generic packer

Disassembly:
out dx, eax
aad 0x42
xor dword [esi + 0x7d], 0x10
test byte [ebp + eax*4 + 0x2d], 0x95
or eax, 0x22bc89df
cmp eax, 0x55536090
imul byte [edx + 0x22]
add al, 0x4c
popal
xchg ebp, eax
push edx
cmp bl, byte [esi]
xor dword [ebp + 0x72], 6
dec esp
mov bl, 0x61
imul ebp, edi, 0x9e90027a
mov al, 0x53
pop ebx
push ebx
pushal
wait
ror byte [eax + eax*2], 0xe3
mov edi, 0xe3449117
lds edi, [esi]
aad 0x8a
call 0x79dfe5
and dword [ebp + 0x633dba4], esp
sub byte [ebp - 0x7984f87], al
fdivr qword [edi]
adc ebx, 0x48827fd
cdq
inc edx
lodsd eax, dword [esi]
hlt
Function at 0x46463b
Capabilities:
Encode data using xor

Disassembly:
and ebx, ecx
stosb byte es:[edi], al
loop 0x4645b1
mov al, 0xfd
xchg edx, eax
xor ch, dh
push ebp
mov cl, 0xe9
arpl word [edi - 0x2b9eee19], cx
and eax, dword [ecx + 0x8d77c9e]
sbb dword [eax], 0xffffffdc
xor eax, ebp
ret
inc ecx
jmp 0x8c1ee8d2
test dword [edx + 0x300606c7], 0x59887a24
sub byte [0x790da936], dl
jns 0x46456b
mov dword [0xa80a29b1], ecx
ror ebx, cl
cmp dword [ecx], 0xd35d057e
inc eax
jns 0x4645ed
jle 0x4645dc
pop ebp
rol dword [eax + 0x79], cl
adc dword [esi + eax*2], esp
and al, 0x46
fidiv dword [ecx]
loope 0x4645b9
movsd dword es:[edi], dword [esi]
iretd
lahf
jecxz 0x464589
push ss
xchg ecx, eax
add eax, edi
add eax, edi
adc ebp, dword [edi + 0x80329b0]
mov ch, 0xf7
mov ecx, 0x487e9f1
invalid
add ebx, dword [ebx + 0x33]
sbb dword [ebx + 0x3886dbac], esi
wait
pop edx
stosd dword es:[edi], eax
in eax, dx
std
jg 0x4645d5
or byte [eax], ch
jns 0x4645e7
wait
mov ebp, 0xf9c747d2
mov ds, esp
sahf
xchg ebp, eax
and al, 0x89
sub byte [ebx - 0x2dd3a4f0], cl
mov edi, 0x4969d988
xchg edi, eax
int1
adc al, 0x6f
invalid

Function at 0x46d910
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0xe5
imul edx, dword [ecx + edx], 0x585f2f5d
add esi, edi
jb 0x46d98c
xchg edi, eax
dec eax
push es
in al, dx
xchg dword [ebx + 0x324f469d], edi
out 0x9d, al
invalid
imul esi, dword [eax], 5
mov esi, 0xa795306b
sbb dword [edx + 0x15487bd6], eax
and al, 0xdb
sbb dl, byte [ecx]
push ss
pop ebx
and ah, bh
cmp byte [ebx - 5], dh
add byte [edx - 0x20], bh
fnstsw word [ecx - 0x32]
xchg ebx, eax
or dl, byte [ecx - 0x65]
sub dword [ecx - 0x5fd80c5a], esp
in eax, dx
aaa
mov dh, byte [esi - 0x1f]
inc esp
adc ah, bh
push ecx
movsb byte es:[edi], byte [esi]
cmp bh, byte gs:[esi]
retf 0x63e3

Function at 0x514f01
Capabilities:
Encode data using xor

Disassembly:
in al, 0x7d
pushal
mov dword [esi], ebx
dec ebp
xor dl, bl
xchg edx, eax
outsb dx, byte [esi]
lds ecx, [ebx + 0x1f]
pop ds
pop eax
jbe 0x514ed2
das
leave
and al, byte [edi]
ret 0xf601
sahf
xchg cl, cl
out 0x45, al
pushfd
push ebx
dec ecx
push ecx
int 0x38
cdq
cmp ecx, edi
dec edi
salc
jge 0x514f4e
loop 0x514f28
mov bh, 0x30
jae 0x514f2c
mov bl, 9
clc
lcall 0x491e, 0xe5437bf3
jp 0x514ec5
aaa
test eax, 0x564dc229
inc ebx
leave
push ss
cmp eax, 0x942369c0
shr byte [ecx + 0x23], 0x94
shr byte [ecx + 0x23], 0x94
cmpsd dword [esi], dword es:[edi]
inc eax
bnd jg 0x514eb9
jg 0x514eb9
sub ch, cl
or dword [ebx], edx
xchg dl, ah
lodsd eax, dword [esi]
xchg dl, cl
xor bh, cl
invalid
test al, 0x24
mov eax, 0x2e44152d
lock adc dword [edx - 0x7c816808], esp
adc eax, 0x11f02e44
mov byte [0x837e97f8], al
mov ebp, 0x34403dec
wait
push ds
fnstenv [ebx + 0x59]
aas
call 0x96e57bf9
loope 0x514f08
xor edi, dword [edx + eax]
pop ebx
nop
cwde
push eax
in al, dx
or byte [edx - 0x36], dl
sub bl, bl
pushal
or dword [edx + 0x458962a7], edx
invalid
Function at 0x55ec7d
Capabilities:
Encode data using xor

Disassembly:
cld
outsd dx, dword [esi]
mov eax, 0x1a3db0fe
scasd eax, dword es:[edi]
jae 0x55ece5
cmp dl, byte [ebx + 0x4ed5df7c]
dec esi
and dword [esi + 0x71], ebp
out dx, al
xlatb
dec edi
stosb byte es:[edi], al
cli
pop edi
mov ebx, 0x7fae9f47
jecxz 0x55ec8c
dec esp
cld
fst qword [ecx - 0x13]
add al, 0x1f
retf
jmp dword [edi - 0x339932ef]
imul dword [edx + 0x6e]
push 0x6e
xor al, 0xbe
pop eax
pop ebp
add byte [eax + 0x27], bl
jae 0x55ecde
dec esp
call dword [edi]
dec edx
sbb al, 0x33
cmpsb byte [esi], byte es:[edi]
dec edi
popfd
pop edi
sbb edi, ebp
in eax, 0xfd
lcall 0x2cf4, 0xb94029ba
jle 0x55ed84
push ebx
pop ebp
movsb byte es:[edi], byte [esi]
mov ebp, 0x14190d99
adc ch, dh
inc ebp
clc
pop ebp
xor al, 0x90
sub eax, 0x2fdb04da
out dx, eax
neg dword [esi - 0x1156da2b]
push esi
sub eax, 0x4dbfeb06
outsd dx, dword [esi]
ja 0x55ed10
jne 0x55ed8e
or al, 0x59
mov cl, 0xa9
jg 0x55ece4
aas
sub al, 0x9f
adc ebx, ebx
invalid
sbb ebp, dword [ebx - 0x6b]
jp 0x55ed9c
mov byte [ebp - 0x28], ch
jl 0x55edd5
sub al, 0x49
ret
invalid
and ebx, dword [esi - 0x1e2efdab]
scasb al, byte es:[edi]
imul edx, dword [esp + esi*2 - 0x5c929bee], 0x7d
or dword [ebp + 0x483dd536], 0x4f
shr dword [ebx + 0x2d], 0x3d
invalid

Function at 0x5c28e1
Capabilities:
Encode data using xor

Disassembly:
mov word [esi + edi - 0x791171cf], ds
mov bh, cl
popal
or edi, dword [edi - 0x21d28ef9]
inc edi
sbb al, 0x99
add bl, byte [esi + 0x74e93b1c]
invalid
Function at 0x5db3ca
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xb4b7889f
xchg ebx, eax
cmp edi, dword [esi - 0x7a]
aas
dec eax
cdq
fcom qword [ebx + 0x7a]
loop 0x5db443
sbb eax, 0x3f186f09
test al, 0x92
sub cl, byte [edi - 0x67723f]
sbb al, 0xdf
out 0xb2, eax
pop ecx
call [edi + 0x10a1c849]
pop es
lds edi, [edi]
or byte [ecx + 0x68], dh
sysenter
xor esp, dword [esi*2 - 0x66726035]
pop eax
call 0xcf288daa
loopne 0x5db3e2
and dword [0xe9d2ad12], edx
or dword [edx + 0x2be85f6d], ecx
xor al, 0x2e
invalid
sbb al, 0x7e
inc esi
lodsb al, byte [esi]
mov al, byte [0x4ae5a9e3]
dec eax
mov byte [0x97bd5704], al
fcos
fld st(6)
iretd
jnp 0x5db4c3
pushal
fucompi st(3)
push cs
leave
jns 0x5db4a4
mov dr4, ebp
adc eax, 0x5671fa81
in eax, dx
jecxz 0x5db474
daa
insb byte es:[edi], dx
cmp eax, 0xe0d3e1d
push ss
adc dword [eax - 0x71], ebx
xchg edi, eax
invalid
mov ecx, dword [ebx]
test al, 4
sbb byte [edi + 0x62091f73], cl
scasb al, byte es:[edi]
and ah, byte [eax]
jne 0x5db41f
mov edi, 0x2ef9bd54
sub al, 0x89
cmp al, 0x47
cmpsb byte [esi], byte es:[edi]
imul ebp, dword [edx], 0xffffffeb
push 0x2f
jb 0x5db4af
insd dword es:[edi], dx
pop ebp
mov bh, 0xcd
inc esi
jg 0x5db500
or byte [ebx], al
jne 0x5db4b3
add eax, 0xb0b8ce9c
test al, 0x24
cmp dword [edi + eax*8 + 0x6b385e7c], esi
rcr dword [ebp + 0x6c], cl
mov al, 0xa8
and al, 0x39
mov ah, 0xc7
jl 0x5db50a
cmp byte [ebx - 0x2d], ch
pop ebp
insb byte es:[edi], dx
inc ebx
mov ebp, 0xdf421c43
push edi
mov al, 0xec
inc ebx
sbb al, 0x42
fbld tbyte [edi + edx*2 - 0x50]
in al, dx
pop ebp
pop edi
test byte [ebp + 0xcc6ac69], cl
inc esi
dec ebp
outsd dx, dword [esi]
mov dh, 0x9b
in al, dx
invalid
push es
dec esp
enter 0xfffffffffffff6ef, 0x7f
frstor dword [edi + 0x713ad7ad]
or dword [edi + 0x4af8a1a8], edi
cmp dh, byte [ecx + 9]
mov edi, 0x4af8a1a8
and byte [edx + 0x10], bl
out dx, eax
mov dh, 0xf8
pop eax
aas
inc esi
invalid

Function at 0x5db4e6
Capabilities:
Encode data using xor

Disassembly:
or al, 0x46
jg 0x5db4c2
out 0x1a, eax
std
sbb eax, edi
das
das
insd dword es:[edi], dx
pop ss
jge 0x5db4fb
mov byte [ecx - 0x2ee7502b], 0xa8
sbb dl, byte [eax + 0x2a]
inc eax
mov bl, 6
Function at 0x63abea
Capabilities:
Encode data using xor

Disassembly:
int1
dec ebx
invalid
insb byte es:[edi], dx
iretd
xor dword [ebx + 0x2b], 0x68
jae 0x63aaf8
sub ebp, dword [eax + 0x73]
cmpsd dword [esi], dword es:[edi]
fisub word [ebx + 0x455400dc]
mov ebx, 0x61c013d2
stosb byte es:[edi], al
and al, 0x22
adc bl, al
in eax, dx
divps xmm5, xmmword [esi]
je 0x63ab4d
mov word [esi], ss
out dx, eax
sub dword [0x2fc891c5], 0x30
add dword [esi], edx
sbb byte [edi], 0x91
cmp ebx, edi
cmpsd dword [esi], dword es:[edi]
invalid
mov byte [eax], ah
neg byte [bp + di - 0x10ef]
xlatb
jno 0x63ab3b
pushal
mov dh, 0xf0
push es
inc esi
mov al, 0xb3
mov esi, 0x48e5f457
cld
or byte [edx], ah
loope 0x63ab4b
invalid
xchg esp, eax
push ecx
inc edi
push 0xa5dfc149
add dword [eax + 0x5211b225], esi
xchg ebx, eax
jl 0x63abf8
ja 0x63ac0b
ja 0x63ab85
bound esi, qword [ebp + 0x37]
aam 7
xchg ebp, eax
insd dword es:[edi], dx
sti
jno 0x63abad
push ecx
mov word [ecx], es
shl byte [edx + 8], cl
inc eax
adc al, byte [edx - 0x74ce5edc]
adc esi, edx
or byte [edi], cl
and al, 0xa1
xor dword [ebx + 0xf08d611], ecx
and edx, eax
sbb byte [ecx - 0x3d], dl
add dl, ch
jno 0x63abd5
adc dword [edx - 0x42], edi
invalid
jno 0x63ac42
jle 0x63abd2
inc ecx
and byte [ecx], ah
jne 0x63ac1e
div esp
pop ss
xchg ebp, eax
js 0x63abca
rcl dword [ecx + ebx*4 + 6]
push esp
cdq
push es
jecxz 0x63ab90
add dword [edx - 0x6d], eax
push ebp
add edx, ebp
adc dword [eax], ebx
inc ecx
invalid
mov al, 0xc5
adc esi, edx
and dword [ecx + esi*4 + 0x15153165], edx
lcall 0x357c, 0xf3b0a0a3
aam 0x4e
add dword [ecx], eax
inc ebx
jbe 0x63acbe
cmc
push ecx
salc
ret 0x69c9
xchg ebx, eax
hlt
Function at 0x409764
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409818
jmp 0x40980d
cmp dword [esi + 0x10], 0x1000
jne 0x4097f9
test byte [esi + 0x15], 1
jne 0x4097f9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x4097b8
cmp eax, 2
je 0x4097b8
cmp eax, 0x10
je 0x4097b8
cmp eax, 0x20
jne 0x4097cd
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4097cd
mov bl, 1
xor ebp, ebp
jmp 0x4097de
mov eax, dword [esi]
add eax, ebp
call fcn.0040975c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x4097d1
test bl, bl
je 0x4097f9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409818
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409790
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x76d006a5
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x50a76d95
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x718f0b63
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x3da72304
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4181670e
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4dac3ad9
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42ffd9
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x430004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4b8ce40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x98
movzx eax, word [ecx + 0x11a58]
push esi
push eax
mov dword [esp + 0x10], ecx
call fcn.04c8e270
mov esi, eax
add esp, 4
test esi, esi
je 0x4b8d05a
cmp byte [esi + 0x685], 0
je 0x4b8d05a
mov ecx, dword [0x4e83f60]
push ebp
push edi
mov edi, dword [esi + 0x794]
mov eax, edi
cdq
sub eax, edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x6c]
sar eax, 1
mov dword [esp + 0x34], eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x3c]
push eax
call edx
fld dword [esp + 0x50]
fsub dword [esp + 0x38]
fstp dword [esp + 0x24]
fld dword [esp + 0x58]
fsub dword [esp + 0x40]
fstp dword [esp + 0x2c]
fld dword [esp + 0x24]
call fcn.04df7eb0
cdq
idiv edi
test edx, edx
mov ebp, eax
je 0x4b8cec9
add ebp, 1
fld dword [esp + 0x2c]
push ebx
call fcn.04df7eb0
cdq
idiv edi
test edx, edx
mov ebx, eax
mov dword [esp + 0x1c], eax
je 0x4b8cee7
add ebx, 1
mov dword [esp + 0x1c], ebx
mov edx, dword [esi + 0x794]
fld dword [esi + 0x788]
mov ecx, dword [esi + 0x790]
fstp dword [esp + 0x74]
fld dword [esi + 0x79c]
mov eax, dword [esi + 0x78c]
mov dword [esp + 0x80], edx
fstp dword [esp + 0x84]
fld dword [esi + 0x798]
lea edx, [esp + 0x9c]
push edx
fstp dword [esp + 0x8c]
mov edx, dword [esp + 0x1c]
fld dword [esi + 0x7a0]
mov edx, dword [edx + 8]
fstp dword [esp + 0x90]
mov dword [esp + 0x80], ecx
mov ecx, dword [0x4e83f60]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x98]
push edx
mov byte [esp + 0x78], 1
call eax
mov ecx, dword [0x4e83f60]
mov edx, dword [ecx]
mov edx, dword [edx + 0x68]
lea eax, [esp + 0x90]
push eax
call edx
test ebp, ebp
jle 0x4b8d057
fldz
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], ebp
test ebx, ebx
jle 0x4b8d046
fst dword [esp + 0x60]
lea ebp, [esi + 0x686]
fst dword [esp + 0x64]
mov dword [esp + 0x10], 0
fstp dword [esp + 0x68]
fld1
fstp dword [esp + 0x6c]
fild dword [esp + 0x14]
fstp dword [esp + 0x34]
fild dword [esp + 0x38]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fld st(0)
fadd dword [esp + 0x3c]
fadd dword [esp + 0x34]
fstp dword [esp + 0x48]
fadd dword [esp + 0x44]
fiadd dword [esp + 0x10]
fstp dword [esp + 0x50]
call fcn.04b776d0
mov ecx, dword [eax + 0x198]
fld dword [esp + 0x58]
mov edx, dword [eax + 0x19c]
mov eax, dword [eax + 0x1a0]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x70]
push ecx
mov ecx, dword [esp + 0x1c]
push 0x91
mov dword [esp + 0x34], edx
fsub dword [esp + 0x34]
lea edx, [esp + 0x68]
push edx
fadd dword [esi + 0x7a0]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x54]
push eax
push 0
fstp dword [esp + 0x60]
push ebp
call fcn.04b8a120
add dword [esp + 0x10], edi
sub ebx, 1
jne 0x4b8cfc4
fldz
mov ebx, dword [esp + 0x1c]
add dword [esp + 0x14], edi
sub dword [esp + 0x20], 1
jne 0x4b8cf8c
fstp st(0)
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x98
ret
Function at 0x4bacee0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4df9e32
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
mov eax, dword [0x4e7fde0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xa4]
xor edi, edi
cmp eax, edi
je 0x4bacf21
mov ecx, dword [0x4e83f60]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x70]
call eax
mov eax, dword [esi + 0x90]
cmp eax, edi
je 0x4bacf39
mov ecx, dword [0x4e83f60]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x70]
call eax
push 0x4e15c68
lea ecx, [esp + 0x10]
mov dword [esi + 0xa4], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0xc], 2
nop
call 0x508448c1
fld1
push ecx
fstp dword [esp]
mov ecx, dword [esi + 0x98]
push ecx
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov dword [esp + 0x58], edi
call fcn.04bac9d0
or edi, 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], edi
nop
call 0x50843195
push 0x4e15c68
lea ecx, [esp + 0x2c]
nop
call 0x508448c1
fld1
mov eax, dword [esi + 0x9c]
push ecx
fstp dword [esp]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
mov dword [esp + 0x58], 1
call fcn.04bac9d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x4c], edi
nop
call 0x50843195
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x44
ret