joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405670
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov dword [esp + 8], 0
mov ebp, dword [esp + 0x44]
mov dword [esp + 4], 0x8000
mov dword [esp], edi
call sub.msvcrt.dll__open
mov dword [esp], 0x48
mov esi, eax
call fcn.00437c40
mov dword [eax], esi
lea ecx, [eax + 0x10]
mov ebx, eax
mov byte [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
call fcn.0040f550
xor eax, eax
test esi, esi
mov word [ebx + 0x38], ax
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebp], ebx
js 0x4056f0
add esp, 0x2c
mov edx, edi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00404920
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.Unable_to_open__s:__s
mov dword [esp + 4], 0
mov dword [esp], 5
mov dword [esp + 0x10], eax
call fcn.0040fb90
add esp, 0x2c
mov eax, 0xfffffff5
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4058f0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x2c], esi
movzx esi, word [eax + 4]
test si, si
je 0x4059bd
mov eax, dword [eax]
xor ebx, ebx
mov ecx, dword [esp + 0x28]
mov edx, eax
mov dword [esp + 0x20], eax
lea eax, [esi - 1]
mov edi, dword [ecx + 0x3c]
movzx eax, ax
mov ebp, dword [ecx + 0x40]
lea ecx, [edx + eax + 1]
mov eax, edx
mov edx, ebx
add eax, 1
shl edx, 5
sub edx, ebx
movzx ebx, byte [eax - 1]
add ebx, edx
cmp eax, ecx
jne 0x405938
sub edi, 1
and ebx, edi
lea eax, [ebp + ebx*8]
mov ecx, dword [eax]
test ecx, ecx
je 0x4059b0
movzx edx, si
mov dword [esp + 0x24], edx
jmp 0x405973
add ebx, 1
and ebx, edi
lea eax, [ebp + ebx*8]
mov ecx, dword [eax]
test ecx, ecx
je 0x4059b0
cmp si, word [eax + 4]
jne 0x405964
mov eax, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x405964
mov ecx, dword [esp + 0x2c]
mov edx, ebx
mov eax, dword [esp + 0x28]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004050a0
mov eax, 0xfffffff9
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Zip:_Invalid_filename__.s
mov dword [esp + 4], 0
mov dword [esp + 0x10], eax
mov dword [esp], 5
call fcn.0040fb90
mov eax, 0xfffffff6
jmp 0x4059b5
Function at 0x4093e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
sub esp, 0x3c
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ebx, dword [0x44d388]
movzx ecx, al
mov dword [esp + 0x2c], eax
lea eax, [ecx + 3]
sar eax, 2
lea eax, [eax*4 + 8]
movzx edx, ax
mov eax, dword [edi]
mov word [esp + 0x1e], dx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
lea eax, [eax + edx - 1]
xor edx, edx
div ebx
xor edx, edx
mov ebp, eax
mov eax, dword [esp + 0x18]
div ebx
cmp eax, ebp
je 0x4094b0
test esi, esi
je 0x4094b6
movzx eax, word [esi + 4]
imul ebx, ebp
sub ax, word [esp + 0x18]
add eax, ebx
mov word [esi + 4], ax
mov esi, dword [0x44d388]
imul esi, ebp
mov dword [edi], esi
mov eax, dword [esp + 0x50]
add esi, dword [esp + 0x24]
mov dword [esi], eax
movzx eax, word [esp + 0x1e]
mov word [esi + 4], ax
movzx eax, byte [esp + 0x2c]
mov byte [esi + 6], al
movzx eax, byte [esp + 0x28]
mov byte [esi + 7], al
lea eax, [esi + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x20]
add dword [edi], eax
add esp, 0x3c
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov esi, dword [esp + 0x18]
jmp 0x409466
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], str.add_dentry
mov dword [esp + 4], str.critical_error:__s:_no_prev_n
add eax, 0x40
mov dword [esp], eax
call fcn.004093b0
mov dword [esp + 4], 1
mov dword [esp], 0x44d3c0
call sub.msvcrt.dll_longjmp
lea esi, [esi]
Function at 0x40b220
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
ret

Function at 0x40cab0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
movzx eax, word [esp + 8]
test ebx, ebx
je 0x40cadf
add ebx, edx
add edx, 1
mov ecx, eax
xor cl, byte [edx - 1]
shr ax, 8
movzx ecx, cl
xor ax, word [ecx + ecx + 0x4434e0]
cmp edx, ebx
jne 0x40cac4
pop ebx
ret

Function at 0x40f0d0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x1c
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
test esi, esi
jne 0x40f0fa
jmp 0x40f124
je 0x40f130
add ebx, eax
add ebp, eax
cmp esi, ebx
jbe 0x40f124
mov eax, esi
sub eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], edi
call sub.msvcrt.dll__read
test eax, eax
jns 0x40f0f0
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
add esp, 0x1c
pop ebx
pop esi
pop edi
neg eax
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, 0xffffffea
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
test ebx, ebx
not eax
je 0x40f53e
add ebx, edx
add edx, 1
mov ecx, eax
xor cl, byte [edx - 1]
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x443a80]
cmp edx, ebx
jne 0x40f525
not eax
pop ebx
ret
Function at 0x4107e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x44c548]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
test eax, eax
je 0x410810
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp eax
mov dword [esp], str.ANDROID_WRAPSIM
call sub.msvcrt.dll_getenv
test eax, eax
je 0x410830
mov edi, 0x444154
mov ecx, 2
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x410855
mov dword [0x44c548], 0x40ff20
mov eax, 0x40ff20
mov dword [0x44c544], 0x40fe40
mov dword [0x44c540], 0x4106e0
jmp 0x4107f8
mov dword [0x44c548], sub.msvcrt.dll__open
mov eax, sub.msvcrt.dll__open
mov dword [0x44c544], 0x431910
mov dword [0x44c540], 0x40fec0
jmp 0x4107f8
Function at 0x429b10
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x429b48
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x429b3e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x429b4a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x429b30
xor eax, eax
pop ebx
pop esi
ret

Function at 0x42a950
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x42a984
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x44c944], eax
call fcn.00431b00
test eax, eax
sete al
movzx eax, al
mov dword [0x43b25c], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42a973

Function at 0x42aa90
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov edi, dword [esi + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx]
mov dword [ebp - 0x20], edi
jmp 0x42aabc
mov dword [0x44c948], ecx
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
test eax, eax
je 0x42ab78
mov edi, dword [eax + 0x18]
mov eax, dword [ebp - 0x20]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
mov eax, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
call eax
test eax, eax
jne 0x42abd0
test edi, edi
je 0x42ab3b
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call edi
cmp eax, 7
je 0x42abe0
cmp eax, 8
jne 0x42abd0
mov eax, dword [ebx]
mov ecx, dword [eax]
mov eax, dword [0x43b25c]
test eax, eax
js 0x42abb6
test eax, eax
je 0x42aab0
mov eax, dword [0x44c944]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x42aab6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42aab6
mov eax, dword [esi]
mov edi, dword [ebp - 0x20]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x1a
mov dword [esp], 1
call eax
test eax, eax
jne 0x42abd0
lea esp, [ebp - 0xc]
mov al, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x24], ecx
call fcn.0042a990
mov eax, dword [0x43b25c]
mov ecx, dword [ebp - 0x24]
jmp 0x42ab48
lea esp, [ebp - 0xc]
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 7
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42adf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x43b25c]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x42aed2
test eax, eax
mov edi, dword [0x44c948]
jne 0x42ae70
test edi, edi
mov dword [ebp - 0x1c], edi
je 0x42ae63
mov eax, edi
lea esi, [ebp - 0x1c]
nop
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x42ae57
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call ecx
cmp eax, 6
je 0x42aea0
cmp eax, 8
jne 0x42aec5
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 0x1c], eax
jne 0x42ae20
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [0x44c944]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x42ae13
mov eax, dword [ebp - 0x1c]
mov edx, esi
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x1c], edi
mov dword [ebx + 0x10], eax
mov eax, ebx
call fcn.0042a8a0
cmp eax, 7
jne 0x42ae68
mov eax, esi
call fcn.0042aa20
lea esp, [ebp - 0xc]
mov eax, 3
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0042a990
mov eax, dword [0x43b25c]
jmp 0x42ae09

Function at 0x42af80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [0x43b25c]
mov ebx, dword [ebp + 8]
test edx, edx
js 0x42aff6
test edx, edx
mov eax, dword [0x44c948]
jne 0x42afce
mov ecx, dword [ebx + 0xc]
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov edx, esi
mov eax, ebx
test ecx, ecx
jne 0x42afbf
call fcn.0042a8a0
cmp eax, 7
je 0x42afc7
call sub.msvcrt.dll_abort
nop
call fcn.0042aa90
jmp 0x42afb5
mov eax, esi
call fcn.0042aa20
mov esi, dword [0x44c944]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
push edi
jmp 0x42af9f
call fcn.0042a990
mov edx, dword [0x43b25c]
jmp 0x42af96
Function at 0x42b010
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x42b050
mov edx, dword [0x43b25c]
test edx, edx
js 0x42b094
test edx, edx
mov eax, dword [0x44c948]
jne 0x42b068
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0042aa90
cmp eax, 7
je 0x42b060
call sub.msvcrt.dll_abort
lea esi, [esi]
mov dword [esp], ebx
call fcn.0042adf0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
call fcn.0042aa20
mov esi, dword [0x44c944]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
sub esp, 4
jmp 0x42b036
call fcn.0042a990
mov edx, dword [0x43b25c]
jmp 0x42b02d

Function at 0x42b200
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x42b230
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp fcn.00431b00
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
pop ebx
pop esi
jmp eax

Function at 0x42c050
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 1
mov dword [esp + 8], ebx
pop ebx
jmp fcn.0042ba20
Function at 0x42d813
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0042d9c3
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x42d911
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x42d8b4
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x42d8f7
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x42d8cb
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x42d8e6
test al, 0x40
je 0x42d8dd
mov ecx, dword [edi + 0x20]
jmp 0x42d8e4
test al, 0x80
je 0x42d8f7
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x42d8f7
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x42d883
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x92c090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x776015
lea edi, [esi - 0x375015]
push edi
or ebp, 0xffffffff
jmp 0x92c0b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x92c0b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x92c0a8
mov eax, 1
add ebx, ebx
jne 0x92c0cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x92c0dc
jne 0x92c0fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x92c0fb
dec eax
add ebx, ebx
jne 0x92c0e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x92c0c0
add ebx, ebx
jne 0x92c0f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x92c14d
xor ecx, ecx
sub eax, 3
jb 0x92c113
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x92c182
sar eax, 1
mov ebp, eax
jmp 0x92c11e
add ebx, ebx
jne 0x92c11e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x92c0ec
inc ecx
add ebx, ebx
jne 0x92c12c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x92c0ec
add ebx, ebx
jne 0x92c139
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x92c12e
jne 0x92c14a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x92c12e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x92c16c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x92c15e
jmp 0x92c0ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x92c16c
add edi, ecx
jmp 0x92c0ae
pop esi
mov edi, esi
mov ecx, 0xc440
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x92c18a
cmp byte [edi], 0x28
jne 0x92c18a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x92c18f
lea edi, [esi + 0x51c000]
mov eax, dword [edi]
or eax, eax
je 0x92c1fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x53d500]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x53d528]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x92c1bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x53d530]
or eax, eax
je 0x92c1f8
mov dword [ebx], eax
add ebx, 4
jmp 0x92c1d9
call dword [esi + 0x53d52c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x92c238
cmp al, 0xef
ja 0x92c222
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x92c204
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
or eax, eax
jne 0x92c211
mov eax, dword [edi]
add edi, 4
jmp 0x92c211
mov ebp, dword [esi + 0x53d534]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x92c26c
sub esp, 0xffffff80
jmp 0x4692c0
Function at 0x51b9fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
pushal
mov byte [esp], 0x2b
lea esp, [esp + 0x40]
je 0x5bdc47
movzx si, bl
ror esi, cl
mov esi, dword [eax + 0x3c]
cmp ax, cx
shl dx, cl
add esi, eax
bsf dx, sp
movsx dx, bl
movsx dx, cl
bts dx, ax
mov edx, dword [esi + 0x78]
bt bp, bx
stc
test edx, edx
pushfd
lea esp, [esp + 4]
je 0x5bdc47
bt ax, 0xf
bt cx, 0xb
jmp 0x56d90f
das
mov dword [esp + 0x1c], edx
shld ax, bp, 1
mov dword [esp + 0x18], edx
cmp cx, 0xcc3b
xor ah, dl
lea ebp, [esp + 0x3c]
adc al, bl
aas
cmc
mov eax, dword [ebp]
test esp, esi
test eax, eax
jmp 0x5b9971
aas
jmp 0x51ffed
lea esp, [esp + 8]
je 0x5bdc47
rcl cx, 0xc
add edx, eax
mov ch, 0xdf
movzx cx, dl
bts cx, 6
mov ecx, dword [esi + 0x7c]
clc
call fcn.0052156b
push eax
cmpsd dword [esi], dword es:[edi]
invalid
mov dword [esp + 0x1c], ebx
cmp bl, ah
ror bp, cl
mov dword [esp + 0x18], edx
shr ah, cl
xchg ebp, eax
add esp, 0x18
jo 0x5ba186
shl ebp, cl
push edx
bt si, 8
neg al
shld ax, bp, cl
add edx, eax
lea ecx, [ebx*4 + 0x6f81f084]
movzx ecx, bl
add cl, 9
mov ecx, dword [esi + 0x7c]
call fcn.0056cb77
push 0x539f5f26
call fcn.005bf821
xlatb
sbb eax, 0x52455355
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x44], ah
jbe 0x56d95d
lcall 0xfdc1, 0xd9e9ae31
invalid
fucomp st(7)
inc ecx
push 0xffffffffffffffab
cli
daa
test eax, 0x976e2a4a
fsubr dword [ebx]
mov ecx, dword [esp + ecx*4]
pop ebx
push edi
cmp eax, 0xfd52ebdf
jno 0x56d96f
clc
lock inc byte [ebx + ecx*8 - 0x1e9031eb]
insd dword es:[edi], dx
jb 0x56d9ae
xchg edi, eax
xchg ebp, eax
cmp byte [ebx], ah
inc edx
jno 0x56d91e
inc ebx
ret
pop edi
mov esp, 0xdb41fc7b
les edx, [ebx + 0x70d281e0]
xchg bh, dh
pop ebx
aad 0xdf
pop edi
mov esp, 0x7029f27b
inc edi
adc eax, 0x79383294
loop 0x56d948
xor bh, byte [eax]
jns 0x56d994
xchg ebp, eax
ficomp dword [edi + 0x36]
ljmp 0x943a
lea esp, [esp + 0x18]
je 0x51a4e6
push 0x6083bae0
lea esp, [esp + 4]
je 0x5bdc47
dec dl
mov esi, dword [eax + 0x3c]
shld dx, cx, 4
bt ebx, 4
sal edx, cl
add esi, eax
dec dl
btr dx, 0xa
adc dh, bh
mov edx, dword [esi + 0x78]
jmp 0x5bc202
sar al, cl
bsr ax, sp
push edx
pushal
sar ah, 2
jmp 0x51a869
push edi
test edx, edx
mov byte [esp], ch
jmp 0x5be2f6
pushfd
jmp 0x51de33

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x30b4143d
nop
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x5a4347d8
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
jmp 0x431219