joyce8/EMBER2024-capa huggingface dataset:
Function at 0x576880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x70
call fcn.00448bd0
mov eax, dword [0x61c554]
xor eax, esp
mov dword [esp + 0x6c], eax
cmp dword [esp + 0x88], 0x40000000
mov eax, dword [esp + 0x7c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x90]
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0
ja 0x576a57
mov esi, dword [esp + 0x80]
cmp esi, 0x40000000
ja 0x576a57
cmp dword [esp + 0x88], 0x40000000
ja 0x576a57
push ebx
push edi
push eax
call fcn.0050fe90
mov edi, eax
lea eax, [esp + 0x28]
push eax
call fcn.004f9920
push 0
push dword [esp + 0x20]
lea eax, [esp + 0x34]
mov ebx, 1
push eax
call fcn.004f9500
push dword [esp + 0xa4]
lea eax, [esp + 0x3c]
mov dword [esp + 0x28], 0x1000000
push dword [esp + 0x30]
push eax
call fcn.004f96b0
add esp, 0x20
test eax, eax
je 0x576a33
push 4
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004f96b0
add esp, 0xc
test eax, eax
je 0x576a33
push dword [esp + 0x98]
lea eax, [esp + 0x28]
push dword [esp + 0x24]
push eax
call fcn.004f96b0
add esp, 0xc
test eax, eax
je 0x576a33
push 0
cmp esi, edi
jb 0x5769fb
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.004f9430
add esp, 0xc
test eax, eax
je 0x576a33
sub esi, edi
je 0x576a2b
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x2c]
add ebp, edi
push eax
inc ebx
call fcn.004f9500
push dword [esp + 0x9c]
mov eax, ebx
mov byte [esp + 0x23], bl
push dword [esp + 0x28]
shr eax, 8
mov byte [esp + 0x26], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x25], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x24], al
lea eax, [esp + 0x38]
push eax
call fcn.004f96b0
add esp, 0x18
test eax, eax
jne 0x576947
jmp 0x576a33
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004f9430
add esp, 0xc
test eax, eax
je 0x576a33
push esi
lea eax, [esp + 0x40]
push eax
push ebp
call fcn.0045e000
lea eax, [esp + 0x48]
push edi
push eax
call fcn.0050ce80
add esp, 0x14
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x24]
push eax
call fcn.004f96c0
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.00448575
add esp, 0x70
ret
mov ecx, dword [esp + 0x74]
xor eax, eax
pop esi
pop ebp
xor ecx, esp
call fcn.00448575
add esp, 0x70
ret
Function at 0x5789e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ecx, dword [edx + 4]
mov ebp, edx
push edi
cmp ecx, dword [ebx + 4]
mov edi, dword [esp + 0x10]
cmovge ebp, ebx
cmovge ebx, edx
mov eax, dword [ebx + 4]
cmp eax, dword [edi + 8]
jg 0x578a09
mov eax, edi
jmp 0x578a13
push eax
push edi
call fcn.004f5da0
add esp, 8
test eax, eax
jne 0x578a1b
pop edi
pop ebp
pop ebx
ret
xor eax, eax
cmp dword [ebp + 4], eax
jle 0x578a3a
push esi
mov ecx, dword [ebx]
mov edx, dword [ebp]
mov esi, dword [ecx + eax*4]
mov ecx, dword [edi]
xor esi, dword [edx + eax*4]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, dword [ebp + 4]
jl 0x578a23
pop esi
cmp eax, dword [ebx + 4]
jge 0x578a50
nop
mov ecx, dword [ebx]
mov edx, dword [edi]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, dword [ebx + 4]
jl 0x578a40
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
test ecx, ecx
jle 0x578a73
mov edx, dword [edi]
add edx, 0xfffffffc
lea edx, [edx + ecx*4]
mov eax, dword [edx]
lea edx, [edx - 4]
test eax, eax
jne 0x578a70
dec ecx
test ecx, ecx
jg 0x578a62
mov dword [edi + 4], ecx
cmp dword [edi + 4], 0
jne 0x578a80
mov dword [edi + 0xc], 0
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x57d400
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.00448bd0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push 0x1048
push 0x5fe7a8
push esi
call fcn.0045e000
mov ebx, dword [esp + 0x30]
mov edi, 0x48
add esp, 0xc
mov eax, ebx
cmp dword [esp + 0x20], edi
cmovle edi, dword [esp + 0x20]
add edi, ebx
xor ebp, ebp
nop dword [eax]
movzx edx, byte [eax]
inc eax
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
xor dword [esi + ebp*4], edx
inc ebp
cmp ebp, 0x12
jl 0x57d440
mov dword [esp + 0x10], 0
xor edi, edi
mov dword [esp + 0x14], 0
nop
lea eax, [esp + 0x10]
push esi
push eax
call fcn.0057de60
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [esi + edi*4], eax
mov eax, dword [esp + 0x14]
mov dword [esi + edi*4 + 4], eax
add edi, 2
cmp edi, 0x12
jl 0x57d490
xor edi, edi
lea eax, [esp + 0x10]
push esi
push eax
call fcn.0057de60
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [esi + edi*4 + 0x48], eax
mov eax, dword [esp + 0x14]
mov dword [esi + edi*4 + 0x4c], eax
add edi, 2
cmp edi, 0x400
jl 0x57d4b7
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x57e450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.00448bd0
mov eax, dword [0x61c554]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x54]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x1c], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x24], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x14], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x14], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x57e615
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x40]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
nop dword [eax]
dec eax
mov dword [esp + 0x48], eax
test esi, esi
jne 0x57e5a5
push dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
call fcn.0057de60
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x57e540
test ebp, ebp
mov ebp, dword [esp + 0x24]
je 0x57e5fc
mov ecx, dword [esp + 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00448575
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00448575
add esp, 0x2c
ret
Function at 0x588b70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x18
call fcn.00448bd0
mov eax, dword [0x61c554]
xor eax, esp
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
mov dword [esp], eax
mov eax, dword [ecx]
push ebp
mov ebp, dword [esp + 0x30]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x588c79
push ebx
mov ebx, dword [esp + 0x2c]
push esi
push edi
lea esi, [edx + 2]
lea edi, [ebx + 3]
sub ebx, edx
nop dword [eax]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call fcn.00588f30
movzx ecx, byte [edi - 3]
lea edi, [edi + 8]
movzx eax, byte [esp + 0x28]
lea esi, [esi + 8]
xor ecx, eax
add esp, 0xc
movzx eax, byte [esp + 0x1d]
mov byte [esi - 0xa], cl
mov byte [esp + 0x14], cl
movzx ecx, byte [edi - 0xa]
xor ecx, eax
movzx eax, byte [esp + 0x1e]
mov byte [esi - 9], cl
mov byte [esp + 0x15], cl
movzx ecx, byte [esi + ebx - 8]
xor ecx, eax
movzx eax, byte [esp + 0x1f]
mov byte [esi - 8], cl
mov byte [esp + 0x16], cl
movzx ecx, byte [edi - 8]
xor ecx, eax
movzx eax, byte [esp + 0x20]
mov byte [esi - 7], cl
mov byte [esp + 0x17], cl
movzx ecx, byte [edi - 7]
xor ecx, eax
movzx eax, byte [esp + 0x21]
mov byte [esi - 6], cl
mov byte [esp + 0x18], cl
movzx ecx, byte [edi - 6]
xor ecx, eax
movzx eax, byte [esp + 0x22]
mov byte [esi - 5], cl
mov byte [esp + 0x19], cl
movzx ecx, byte [edi - 5]
xor ecx, eax
movzx eax, byte [esp + 0x23]
mov byte [esi - 4], cl
mov byte [esp + 0x1a], cl
movzx ecx, byte [edi - 4]
xor ecx, eax
mov byte [esi - 3], cl
mov byte [esp + 0x1b], cl
sub ebp, 1
jne 0x588bc0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
pop ebp
xor ecx, esp
call fcn.00448575
add esp, 0x18
ret
Function at 0x58af40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.00448bd0
mov edx, dword [esp + 0x20]
xor ecx, ecx
test edx, edx
je 0x58b035
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
cmp edx, 0x20
jb 0x58b00e
push ebp
lea eax, [ebx - 1]
lea ebp, [esi - 1]
add eax, edx
add ebp, edx
cmp esi, eax
ja 0x58af87
cmp ebp, ebx
jae 0x58b00d
lea eax, [edi - 1]
add eax, edx
cmp esi, eax
ja 0x58af94
cmp ebp, edi
jae 0x58b00d
mov eax, edx
lea ebp, [esi + 0x10]
mov edx, edi
and eax, 0xffffffe0
sub edx, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
mov eax, ebx
mov edx, esi
sub edx, ebx
mov dword [esp + 0x14], edx
mov edx, edi
mov edi, dword [esp + 0x14]
sub edx, esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x18]
nop word [eax + eax]
movups xmm0, xmmword [eax]
add ecx, 0x20
lea eax, [eax + 0x20]
lea ebp, [ebp + 0x20]
movups xmm1, xmmword [esi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [edi + eax - 0x20], xmm1
movups xmm1, xmmword [ebx + ebp - 0x20]
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [ebp - 0x20], xmm1
cmp ecx, dword [esp + 0x1c]
jb 0x58afd0
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
pop ebp
cmp ecx, edx
jae 0x58b032
sub edi, ebx
lea eax, [ecx + ebx]
sub esi, ebx
sub edx, ecx
nop dword [eax + eax]
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
sub edx, 1
jne 0x58b020
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x593e40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x634dc0], ecx
inc eax
cmp eax, 0x100
jb 0x593e42
cmp eax, 0x800
jae 0x593f13
nop
mov edx, dword [eax*4 + 0x6349c0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x634dc0]
mov dword [eax*4 + 0x634dc0], edx
inc eax
cmp eax, 0x800
jb 0x593ef0
mov dword [0x634d88], 0x594cb0
call fcn.00594ae0
mov ecx, dword [0x634d88]
test eax, eax
mov edx, 0x594d50
cmove ecx, edx
mov dword [0x634d88], ecx
ret
Function at 0x595030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x595050
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x595082
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x59507f
inc esi
cmp esi, edx
jb 0x595070
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x5951ac
cmp ecx, 3
jbe 0x5950c2
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x595100
cmp cl, 0xff
je 0x595100
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x595064
dec ecx
shl eax, cl
and eax, 7
je 0x59509a
movzx ecx, byte [eax + 0x604e08]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x604e00], 0
mov cl, byte [edx + 4]
je 0x5950ea
test cl, cl
je 0x5950ea
cmp cl, 0xff
jne 0x59509a
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x595064
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x59512e
lea edx, [edi + ebx]
add edx, esi
jmp 0x595134
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x595172
movzx edi, byte [eax + 0x604e08]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x59515e
cmp cl, 0xff
jne 0x595172
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x595121
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x595064
pop edi
pop esi
cmp ecx, 3
jbe 0x5951c1
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4324b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
jmp 0x4324ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4324d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4324c0
mov eax, 1
add ebx, ebx
jne 0x4324e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4324d8
jne 0x4324f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4324d8
xor ecx, ecx
sub eax, 3
jb 0x432508
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43257a
mov ebp, eax
add ebx, ebx
jne 0x432513
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x432520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x432544
inc ecx
add ebx, ebx
jne 0x432530
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x432525
jne 0x432541
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x432525
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x432564
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x432555
jmp 0x4324c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x432564
add edi, ecx
jmp 0x4324c6
pop esi
lea edi, [esi + 0x30000]
mov eax, dword [edi]
or eax, eax
je 0x4325cc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x32fcc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33008]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x432581
mov ecx, edi
jns 0x4325b0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x33010]
or eax, eax
je 0x4325c6
mov dword [ebx], eax
add ebx, 4
jmp 0x43259e
call dword [esi + 0x3300c]
mov ebp, dword [esi + 0x33014]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x432600
sub esp, 0xffffff80
jmp 0x403670

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x5d2028bb
nop
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x3e6324a7
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10a935a
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x820]
mov dword [esi], 0x1028420
call fcn.0106b5a4
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
and dword [esi + 0x1c], 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x20], eax
shl eax, 8
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], pe_nt_image_headers32
xor ecx, ecx
lea eax, [esi + 0x34]
and dword [eax], 0
inc ecx
add eax, 4
cmp ecx, dword [esi + 0x24]
jb 0x10a93a7
xor eax, eax
lea edi, [esi + 0x434]
mov ecx, 0xfb
rep stosd dword es:[edi], eax
and dword [esi + 0x30], eax
and dword [esi + 0x2c], eax
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100153d5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10021040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
movzx eax, word [esi + 4]
lea ecx, [edi + 0xc]
mov word [edi + 4], ax
movzx eax, word [esi + 6]
mov word [edi + 6], ax
movzx eax, word [esi + 8]
mov word [edi + 8], ax
movzx eax, word [esi + 0xa]
mov word [edi + 0xa], ax
lea eax, [esi + 0xc]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDateTime::constructor_class_QDateTime_const__]
mov eax, dword [esi + 0x10]
lea ecx, [edi + 0x30]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
movzx eax, word [esi + 0x28]
mov word [edi + 0x28], ax
movzx eax, word [esi + 0x2a]
mov word [edi + 0x2a], ax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
lea eax, [esi + 0x30]
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, dword [esi + 0x34]
mov eax, 1
mov dword [edi + 0x34], ecx
lock xadd dword [ecx], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10001260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100153f9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10021040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov esi, 1
mov dword [edi], eax
mov edx, eax
mov eax, esi
lock xadd dword [edx], eax
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDateTime::constructor_void_]
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov ecx, esi
mov dword [edi + 0x30], eax
lock xadd dword [eax], ecx
mov eax, dword [sym.imp.QtCore4.dll_struct_QByteArray::Data_QByteArray::shared_null]
mov dword [edi + 0x34], eax
lock xadd dword [eax], esi
inc esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100015a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10015fe1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10021040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x34]
mov dword [ebp - 4], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDateTime::destructor_void_]
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10005c80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10016a62
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10021040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov esi, 1
mov edi, dword [ebp + 8]
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov ecx, eax
mov dword [edi], eax
mov eax, esi
lock xadd dword [ecx], eax
lea ecx, [edi + 0xc]
mov dword [ebp - 4], esi
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QDateTime::constructor_void_]
mov eax, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov ecx, eax
mov dword [edi + 0x30], eax
mov eax, esi
lock xadd dword [ecx], eax
mov eax, dword [sym.imp.QtCore4.dll_struct_QByteArray::Data_QByteArray::shared_null]
mov dword [edi + 0x34], eax
lock xadd dword [eax], esi
inc esi
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call sym.quazip.dll_public:_bool___thiscall_QuaZip::getCurrentFileInfo_struct_QuaZipFileInfo64__const
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret