joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403392
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x406a24]
test eax, eax
je 0x4033ab
call eax
test eax, eax
jne 0x4033ab
push 0xfffffffffffffffe
jmp 0x4033c5
push 1
push 0x406010
push 0x406008
call fcn.00402cf0
add esp, 0xc
test eax, eax
je 0x4033cb
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x406004
push section..data
call fcn.00402cf0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x4033f1
mov esi, 0x404c59
mov cl, 0x20
jmp 0x4033fa
cmp al, 0x20
ja 0x403404
inc esi
mov al, byte [esi]
test al, al
jne 0x4033f5
cmp al, 0x20
jbe 0x40341b
mov al, byte [esi]
cmp al, 0x22
jne 0x40340d
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x403406
jmp 0x40341b
cmp al, cl
ja 0x403421
inc esi
mov al, byte [esi]
test al, al
jne 0x403416
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x40344a
movzx eax, word [ebp - 0x14]
jmp 0x40344d
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0040273a
pop ecx
pop esi
leave
ret

Function at 0x403488
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x406365], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0xfffffc18
push 0xfffffc18
push 0xcf0000
push 0x406880
push 0x4068e8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4034d2
xor eax, eax
jmp 0x4034e9
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]

Function at 0x408943
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
or ebx, edx
call fcn.00408965
sub ebx, 0x1b290d81
xor dword [esi], ecx
sub ebx, ebx
sub ebx, 0x6e57ab6a
inc esi
cmp esi, eax
jne fcn.00408943
ret
Function at 0x48f9e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
push edi
jmp 0x48f9fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48fa01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48f9f0
mov eax, 1
add ebx, ebx
jne 0x48fa13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48fa24
jne 0x48fa43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa43
dec eax
add ebx, ebx
jne 0x48fa30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48fa08
add ebx, ebx
jne 0x48fa3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48fa95
xor ecx, ecx
sub eax, 3
jb 0x48fa5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48faca
sar eax, 1
mov ebp, eax
jmp 0x48fa66
add ebx, ebx
jne 0x48fa66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
inc ecx
add ebx, ebx
jne 0x48fa74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
add ebx, ebx
jne 0x48fa81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48fa76
jne 0x48fa92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48fa76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48fab4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48faa6
jmp 0x48f9f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48fab4
add edi, ecx
jmp 0x48f9f6
pop esi
mov edi, esi
mov ecx, 0x1a9e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48fad2
cmp byte [edi], 6
jne 0x48fad2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48fad7
lea edi, [esi + 0x8d000]
mov eax, dword [edi]
or eax, eax
je 0x48fb4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8f104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48fb04
mov ecx, edi
jns 0x48fb33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8f108]
or eax, eax
je 0x48fb49
mov dword [ebx], eax
add ebx, 4
jmp 0x48fb21
call dword [esi + 0x8f118]
mov ebp, dword [esi + 0x8f10c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48fb83
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x40893f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x4085d8
add eax, 0xcbcd7912
call fcn.0040895f
inc eax
xor dword [ecx], esi
or eax, edx
inc ecx
sub edx, edx
cmp ecx, ebx
jne fcn.0040893f
mov edx, edx
ret
Function at 0x4016e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
and dword [esi + 0x30], 0
push edi
call fcn.004015ad
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov ebx, dword [edi]
jmp 0x40172c
push 0xa
push 0xa
push 0x10af204
push 0x3114b604
call fcn.00401dd2
add esp, 0xc
push eax
push dword [ebx + 0x30]
call fcn.0040161c
add esp, 0xc
test eax, eax
je 0x401735
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x401704
jmp 0x4017c7
mov ebx, dword [ebx + 0x18]
test ebx, ebx
je 0x4017c7
mov eax, dword [ebx + 0x3c]
mov edi, dword [eax + ebx + 0x78]
and dword [esp + 0xc], 0
add edi, ebx
mov eax, dword [edi + 0x1c]
add eax, ebx
push ebp
mov ebp, dword [edi + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x24]
add eax, ebx
add ebp, ebx
cmp dword [edi + 0x18], 0
mov dword [esp + 0x18], eax
jbe 0x4017c3
mov eax, dword [esp + 0x10]
mov eax, dword [ebp + eax*4]
push 0x16
add eax, ebx
push 0x10af1ec
push 0x40704011
mov dword [esp + 0x20], eax
call fcn.00401d84
push eax
push dword [esp + 0x24]
call fcn.00401648
add esp, 0x14
test eax, eax
je 0x4017ab
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [edi + 0x18]
jb 0x40176c
jmp 0x4017c3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4]
add eax, ebx
mov dword [esi + 4], eax
mov dword [esi + 0x30], ebx
pop ebp
cmp dword [esi + 0x30], 0
je 0x40192e
push 0xa
push 0x10af1e0
push 0x29a1a909
call fcn.00401d84
add esp, 0xc
push eax
push esi
mov ecx, esi
call fcn.004016be
push 0xc
push 0x10af1d0
push 0x13cbcee9
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 8]
push eax
mov ecx, esi
call fcn.004016be
push 0x18
push 0x10af1b4
push 0x17ce53be
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0xc]
push eax
mov ecx, esi
call fcn.004016be
push 0xf
push 0x10af1a4
push 0x26b30b69
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x10]
push eax
mov ecx, esi
call fcn.004016be
push 0x12
push 0x10af190
push 0x3d924530
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x14]
push eax
mov ecx, esi
call fcn.004016be
push 7
push 0x10af188
push 0x2236409a
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x18]
push eax
mov ecx, esi
call fcn.004016be
push 0x14
push 0x10af170
push 0x149ccd04
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x1c]
push eax
mov ecx, esi
call fcn.004016be
push 0x11
push 0x10af15c
push 0x673ebfe9
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x20]
push eax
mov ecx, esi
call fcn.004016be
push 0x11
push 0x10af148
push 0x68d29b96
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x24]
push eax
mov ecx, esi
call fcn.004016be
push 0x16
push 0x10af130
push 0x7db65c79
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x28]
push eax
mov ecx, esi
call fcn.004016be
push 0x13
push 0x10af11c
push 0x65fa79df
call fcn.00401d84
add esp, 0xc
push eax
lea eax, [esi + 0x2c]
push eax
mov ecx, esi
call fcn.004016be
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x401937
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, section..data
mov ecx, 0x2aa6
mov esi, 0x3cd693
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov edx, ecx
shr edx, 0xc
xor byte [eax], dl
inc eax
dec esi
jne 0x401947
pop esi
ret

Function at 0x401aa3
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, eax
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
xor eax, eax
cmp ax, word [esi + 6]
jae 0x401aea
push 7
push str..custom
push edi
call fcn.0040161c
add esp, 0xc
test eax, eax
je 0x401af1
movzx eax, word [esi + 6]
inc dword [ebp - 4]
add edi, 0x28
cmp dword [ebp - 4], eax
jl 0x401ac7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0xc]
mov esi, dword [eax + ebx]
lea edi, [eax + ebx + 8]
mov ebx, dword [eax + ebx + 4]
push esi
call fcn.00401e30
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push 1
push 5
push edi
lea ecx, [ebp - 0xc]
push ecx
add edi, 5
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], 0x401960
mov dword [ebp - 0x14], 0x40196b
call fcn.0040379c
add esp, 0x28
test eax, eax
je 0x401b51
push dword [ebp - 4]
call fcn.00401e47
pop ecx
jmp 0x401aea
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 4]
jmp 0x401aec

Function at 0x401d84
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
je 0x401dc3
push edi
mov edi, dword [esp + 0x14]
sub edi, 0x147d6a0
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov eax, edx
shr eax, 0xc
xor al, byte [edi + esi + 0x147d6a0]
inc esi
mov byte [esi + 0x147d69f], al
cmp esi, ebx
jb 0x401d9f
pop edi
pop esi
mov byte [ebx + 0x147d6a0], 0
mov eax, 0x147d6a0
pop ebx
ret

Function at 0x401dd2
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x401e10
mov eax, dword [esp + 0x10]
sub eax, 0x147d6a0
push ebx
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov ebx, edx
shr ebx, 0xc
xor bl, byte [eax + esi + 0x147d6a0]
inc esi
mov byte [esi + 0x147d69f], bl
cmp esi, edi
jb 0x401dec
pop ebx
mov byte [edi + 0x147d6a0], 0
mov byte [edi + 0x147d6a1], 0
pop edi
mov eax, 0x147d6a0
pop esi
ret
Function at 0x401eec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x401f05
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x401f28
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x401f2d
inc edi
cmp edi, dword [ebp - 4]
jb 0x401f1f
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x402025
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x401f84
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x401f58
cmp cl, 0xff
jne 0x401faf
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x401fbd
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x401fc4
dec ecx
shl edx, cl
and edx, 7
je 0x401f49
movzx ecx, byte [edx + 0x10af294]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x10af28c], 0
mov cl, byte [ebx + 4]
je 0x401fac
test cl, cl
je 0x401fac
cmp cl, 0xff
jne 0x401f49
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x401f1a
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x401ff8
movzx esi, byte [edx + 0x10af294]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x401fe3
cmp al, 0xff
jne 0x401ff5
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x401f76
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x401f1a
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0xee3a39
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ebx
push word [esp + 0xa]
lea esp, [esp + 3]
jmp 0xee3a1a
xchg word [esp + 9], bx
inc ebx
push word [esp + 0xa]
lea esp, [esp + 3]
jmp 0xee3a1a
popal
sub esp, 0xd
jo 0xee39f5
xchg word [esp + 9], bx
jmp 0xee39df
shl ecx, 2
lea ebx, [eax*4]
mov bh, ch
mov bx, word [esp]
lea ebx, [esp - 0xdd]
jmp 0xee3ddd
lea esp, [esp + 4]
jmp 0xee3a0d
mov ecx, dword [ecx + reloc.user32.dll_GetMessageA]
adc bh, 0xd7
jno 0xee3a5f
jo 0xee3a75
push ax
lea esp, [esp + 2]
jmp 0xee3a3f
jmp 0xee3a75
add ecx, 0x6db9e8e6
jmp 0xee3b63
sub ebx, ebx
je 0xee3a57
push ax
lea esp, [esp + 2]
jmp 0xee3a3f
pushfd
push ecx
ret
mov ebx, dword [esp]
mov esp, edi
mov ebx, dword [esp]
mov bx, sp
mov bx, 0xdd17
jmp 0xee3ae7
pushfd
mov bx, word [esp]
jmp 0xee3b18
jmp 0xee3a89
add ecx, 0xa54a6453
jmp 0xee3bb1
Function at 0xee4cc1
Capabilities:
Execute anti-debugging instructions

Disassembly:
and ebx, 0x3c
lea edx, reloc.user32.dll_GetMessageA
bt ax, cx
jmp 0xee4d3b
jbe 0xee4cde
ja 0xee4cde
mov edx, edi
lea edx, [edx + ebx]
mov eax, dword [edx]
jmp 0xee4d4c
not dx
mov dx, bp
dec dl
jnp 0xee4da7
lea edx, [ebx*4]
jmp 0xee4ded
lea edx, [ebx*4]
jmp 0xee4ded
mov dword [esp + 0x14], esi
not ebx
lea ebx, reloc.user32.dll_GetMessageA
mov ebx, dword [esp]
or bl, 0xa2
jmp 0xee4e5f
pushal
rol cl, 3
js 0xee4dd5
jns 0xee4e13
mov ebx, dword [esp]
or bl, 0xa2
jmp 0xee4e5f
lea eax, [esi*4]
jmp 0xee4e3e
mov dword [esp + 0x14], esi
not ebx
lea ebx, reloc.user32.dll_GetMessageA
jmp 0xee4df5
bt bx, si
jg 0xee4e6f
mov bx, word [esp]
jmp 0xee4e73
popal
mov dword [edx], eax
mov al, ah
mov edx, dword [esp]
rdtsc
jmp 0xee4dfd
mov bx, word [esp]
lea eax, [edi + 0x50]
jmp 0xee4eb1
mov edx, eax
neg bx
jmp 0xee4e98
bswap edx
cmp esi, eax
ja 0xee4f1d
setnp bl
jmp 0xee4f29
bsf dx, sp
jne 0xee4e78
mov edx, eax
neg bx
bswap edx
call fcn.00ee4f0e
xchg byte [esi - 0x75], ah
adc al, 0x24
mov dx, di
mov dh, 0x8f
setge dh
xchg dword [esp + 4], ebx
jmp 0xee4eef
lea edx, [esi + edi]
lea edx, [eax*4]
lea edx, [edi*4]
mov dx, bp
mov bx, cx
jmp 0xee4f16
push dword [esp + 4]
ret 8
setnp bl
lea ebx, [ebp - 5]
jmp 0xee4f6c
lea ebx, [ebp - 5]
pushfd
lea ebx, reloc.user32.dll_GetMessageA
lea esp, [esp + 4]
jmp 0xee56c2
pushfd
lea ebx, reloc.user32.dll_GetMessageA
lea esp, [esp + 4]
jmp 0xee56c2
ja 0xee4f4f
mov eax, ebx
bswap edx
mov dx, 0x8149
xchg dl, dh
jmp 0xee585b
mov edx, dword [esp]
mov edx, 0x432f0058
jmp 0xee5706
mov edx, dword [esp]
mov edx, 0x432f0058
sub eax, ebx
mov dh, byte [esp]
jmp 0xee5739
mov edx, esp
jmp 0xee578d
lea edx, [esi*4]
jmp 0xee5765
not dx
btc dx, si
jbe 0xee5720
lea edx, [esi*4]
jmp 0xee5765
add esp, 0xa
lea esp, [esp + 2]
jmp 0xee576e
lea edx, [esi - 0x80]
pushal
clc
js 0xee574b
jns 0xee57de
and dl, 0xfc
pushfd
sub esp, 0x13
jb 0xee57b3
jae 0xee579d
and byte [esi + 0xbbe4324], dh
xor ch, byte [ebx + 0x1cad5e3b]
dec esi
fnstcw word [eax]
sbb esi, dword [edx + 0x6d]
mov edx, esp
lea eax, [edi + 0x40]
stc
jle 0xee56fe
jg 0xee56e8
lea esp, [esp + 0x11]
lea esp, [esp + 2]
jmp 0xee57bb
lea esp, [esp + 0x11]
lea esp, [esp + 2]
sub edx, eax
call fcn.00ee57c3
invalid
add esp, 0xa
lea esp, [esp + 2]
jmp 0xee576e
mov ebx, edi
lea eax, [esp + eax]
rcl ax, cl
jno 0xee578b
jo 0xee571c
mov esi, dword [esp]
push ebx
lea esp, [esp + 8]
jmp 0xee5895
jmp 0xee58f3
popfd
jmp 0xee5077
Function at 0xefe1ff
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x2873b2e8
jmp 0xefe312
add edx, 0x3055b9ec
jmp 0xefe2d5
lea ebx, [ecx + esi]
jmp 0xefe237
lea ebx, [ebx*4]
jmp 0xefe434
mov ebx, dword [esp]
shl edx, 2
jle 0xefe221
lea ebx, [ebx*4]
bsf ebx, edx
jmp 0xefdab0
mov edx, dword [edx - reloc.user32.dll_GetMessageA]
pushfd
pop ebx
stc
je 0xefe29a
jne 0xefdaf2
aas
push es
mov cl, 0xb0
mov bl, 0x8a
sti
mov bh, bl
lea esp, [esp + 5]
lea esp, [esp + 2]
jmp 0xefe2bd
jmp 0xefdaf2
mov bh, bl
lea esp, [esp + 5]
lea esp, [esp + 2]
jmp 0xefe278
mov bx, word [esp]
mov ebx, ecx
bswap ebx
jmp 0xefe2fc
inc ebx
jmp 0xefe2f2
bswap ebx
jmp 0xefe2fc
clc
mov bx, word [esp]
jmp 0xefe37c
jle 0xefe2bf
mov bx, word [esp]
mov ebx, ecx
jmp 0xefe2d8
mov esp, ebp
mov bx, 0xd5e5
dec ebx
jp 0xefe2dc
jnp 0xefe405
mov cl, 0x38
scasb al, byte es:[edi]
leave
cmp dl, bh
xchg ebp, eax
mov bh, 0x84
sub esp, 7
ja 0xefe2b3
jbe 0xefe28e
mov ebx, dword [esp + 1]
setbe bh
xchg ecx, eax
jmp 0xefe350
lea ebx, [ebx*4]
jmp 0xefe362
mov ecx, esi
clc
jns 0xefe33a
lea ebx, [ebx*4]
jmp 0xefe3be
bswap eax
sub esi, 4
mov bh, byte [esp]
shl ah, cl
ja 0xefe394
bts bx, cx
jmp 0xefe396
push edx
ret
bts bx, cx
jmp 0xefe396
jmp 0xefe37e
mov dword [esi], ecx
mov bh, 0x61
bswap ebx
lea ebx, [ebx + ebp]
cmc
jmp 0xefe3d8
jmp fcn.00ef7cae
bswap eax
jmp 0xefe364
jb 0xefe3a6
jae fcn.00ef7cae
sub esi, 4
mov bh, byte [esp]
mov bh, dh
mov eax, ebx
sub ebx, ebx
jmp 0xefe537
clc
mov bx, word [esp]
jmp 0xefe37c
movzx ebx, byte [edi - 1]
sub esp, 0x1a
jmp 0xefe462
mov eax, dword [esp + 0x16]
xchg ah, dh
pop word [esp + 7]
bsf edx, esi
jmp 0xefe44a
bsf ebx, edx
jmp 0xefdab0
pop word [esp + 7]
bsf edx, esi
jmp 0xefe496
mov edx, 0x74fca3e4
lea edx, [eax + edi]
bswap edx
pushfd
sub esp, 6
jmp 0xefe4b3
jp 0xefe41c
mov eax, dword [esp + 0x16]
xchg ah, dh
jmp 0xefe43c
pop word [esp]
sub bl, cl
mov ax, 0x1581
jmp 0xefe47d
mov edx, 0x74019418
lea eax, [eax + 0x5a]
rdtsc
call fcn.00efe4e6
invalid

Function at 0xf08795
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
sub esi, 0x41
jmp 0xf08041
Function at 0xfcde11
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 9], ax
lea ecx, [ebx*4]
push dword [esp + 6]
jmp 0xfcddf4
mov esi, 0xe93f70ea
cpuid
mov ah, 0x84
sbb ebp, ebp
sub esp, 0x12
mov bx, sp
jmp 0xfcdd8d
mov di, word [esp + 5]
mov edi, esp
neg dh
bt dx, sp
setg dl
call fcn.00fcde11
shl dword [esi - 0x79], cl
cli
xchg dx, di
mov word [esp + 0x11], bx
clc
mov si, word [esp + 4]
pop word [esp]
neg ax
jmp 0xfcddb6
mov bp, word [esp + 4]
mov ebp, 0xf53af53d
lea ebx, [ebx*4]
add dh, ch
push edi
lea edi, [edi*4]
jmp 0xfcddcc
mov dl, 0xbd
jmp 0xfcde1a
pop ax
bswap ebx
xchg ecx, edi
push dword [esp + 0x14]
cld
bsf edi, ebx
jmp 0xfcde61
lea ebx, [ecx*4]
lea esp, [esp + 1]
clc
lea ebp, [esp + ebx]
mov di, bp
lea ebp, [edx + ebx]
jmp 0xfcdda3
cpuid
lea eax, [esp + edx]
cpuid
xchg bh, dl
mov dword [esp + 0x13], esp
jmp 0xfcdeac
mov ebx, dword [esp + 8]
rdtsc
cld
bswap ebx
pop dword [esp + 2]
bswap edi
jmp 0xfcde4b
mov bx, di
pop dx
bswap ecx
stc
mov word [esp], bx
mov di, ax
jmp 0xfcde31
pop si
pop eax
lea eax, [esp + edx]
rdtsc
mov dl, 0x64
lea edx, reloc.user32.dll_GetMessageA
jmp 0xfcdff5
mov dword [esp + 0x12], ecx
xchg dword [esp + 0xa], ebx
xchg byte [esp + 0xd], ch
lea ebp, [ecx*4]
jmp 0xfcde96
pop ax
xchg byte [esp + 2], ch
mov dh, 0xc7
mov dword [esp], esi
xchg ebx, edi
neg ebx
jmp 0xfcde85
xchg dword [esp + 6], edi
sub ecx, 0xa1e3a8a
pop ebx
xchg word [esp + 1], cx
jmp 0xfcdf19
mov ax, 0xb42e
std
xchg word [esp + 9], bx
mov dh, byte [esp + 2]
std
dec esi
jmp 0xfcded6
mov byte [esp + 1], bh
xchg byte [esp + 6], ch
cpuid
lea ebx, [edi + 0xb0]
jmp 0xfcdfc0
lea ebx, [ebx - 0x81]
xchg word [esp + 1], ax
lea esi, reloc.user32.dll_GetMessageA
setle dh
xchg esi, ebp
neg dl
jmp 0xfcdf03
pop word [esp]
cmc
xchg dword [esp + 7], ebx
add esp, 0xc
sub esp, 0xd
mov byte [esp + 6], cl
jmp 0xfcdef1
xchg word [esp], bp
push word [esp + 3]
lea ebx, [ecx + edi]
jmp 0xfcdfa5
pop word [esp + 1]
mov di, ax
xchg ecx, ebp
lea edx, [edi + ebp]
mov dx, 0xe974
lea ecx, reloc.user32.dll_GetMessageA
jmp 0xfcdf4d
pop word [esp + 2]
mov word [esp + 3], dx
xchg ebx, eax
lea eax, reloc.user32.dll_GetMessageA
not ax
bswap ecx
jmp 0xfcdf63
mov bx, word [esp + 5]
sub esp, 2
pop word [esp + 2]
bswap esi
mov ch, 0x4e
jmp 0xfcdfd9
xchg dword [esp + 1], edx
push dword [esp + 1]
add esp, 6
cmp di, 0xbad3
rol ax, cl
mov byte [esp + 6], al
jmp 0xfcdf8c
mov word [esp + 3], sp
not al
dec di
cpuid
lea ebp, [edx + edx]
xchg cx, si
jmp 0xfce022
mov esi, 0xa3b470b
pop ax
not bl
ror ebp, 0x11
pop dword [esp + 8]
mov ah, 0xae
jmp 0xfcdf38
neg ch
xchg edx, edi
xchg dword [esp + 0xa], esi
mov ax, 0x31f9
cld
pop edx
jmp 0xfce03b
mov byte [esp + 3], dl
bsr si, di
sub esp, 0x13
not eax
mov ecx, 0xcf6139ed
mov ax, word [esp + 0x16]
jmp 0xfce00c
xchg dword [esp + 4], ecx
mov dx, sp
add bh, cl
bswap ecx
call fcn.00fce075
cmp eax, 0x11e69f0c
nop
add esp, 3
pushfd
cpuid
btc ecx, eax
jmp 0xfcdec5
Function at 0xfce566
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
pop word [esp + 0x11]
cpuid
xor di, 0xa4fa
jmp 0xfce577
mov dword [esp + 3], esp
rdtsc
std
mov ah, byte [esp]
xchg word [esp + 0xf], dx
jmp 0xfce550
pop word [esp]
mov byte [esp + 0xe], bl
add esp, 0xf
mov al, byte [esp + 3]
mov ecx, dword [esp + 2]
bsf bx, si
jmp 0xfce5c4
rdtsc
neg ecx
lea edi, [ebx + 0x73]
xchg word [esp], bx
cpuid
mov dl, 0x30
jmp 0xfce614
mov byte [esp + 1], ah
pop word [esp]
add dword [esi - 0x71], esp
add al, 0x24
mov cl, byte [esp + 1]
mov ax, word [esp]
mov ah, byte [esp]
xchg word [esp], cx
jmp 0xfce5ae
or di, dx
sub esp, 0x19
xchg word [esp + 0xa], ax
push word [esp + 0x15]
call fcn.00fce5fe
lea esp, [esp + 1]
bsf ebx, ecx
std
xchg ch, bl
mov bx, word [esp + 0xc]
call fcn.00fce722
fld dword [edx - 0x30]
mov bh, 0x42
jmp 0xfce5c7
Function at 0xfcee03
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 3]
mov byte [esp], dh
lea esp, [esp + 1]
jmp 0xfcee43
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], esp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
push esi
mov word [esp], si
jmp 0xfcee2d
Function at 0x406723
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7de93c], 0
jne 0x406761
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406737
mov dword [ecx*4 + 0x7de938], eax
inc ecx
cmp ecx, 0x100
jl 0x406732
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40678e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x7de938]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40676f
not eax
pop ebp
ret 0xc

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0xa8e2b37
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1c8b1fc8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219