joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403680
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d9a78
push eax
mov dword fs:[0], esp
sub esp, 0x448
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_SetDeviceGammaRamp]
xor esi, esi
cmp esi, 0x2710
jge 0x4036bb
lea eax, [ebp - 0x454]
push eax
push 0
call edi
inc esi
cmp esi, 0x1ff49ccc
jl 0x4036a8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov ebx, dword [ebp - 0x10]
xor esi, esi
call edi
cmp esi, 0x2b259d
jle 0x4036e2
cmp ebx, 0x785074d5
jne 0x4036eb
inc esi
cmp esi, 0x1c1b
jl 0x4036d0
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
lea esp, [esp]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, 0x206d47
jg 0x40371d
inc esi
cmp esi, 0x4f6a4
jl 0x403700
cmp dword [0x8fb080], 0x400
jne 0x403757
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
lea eax, [ebp - 0x30]
call fcn.004037f0
push 0
mov dword [ebp - 4], 0
call fcn.00403b24
add esp, 4
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00403810
mov ecx, dword [0x4dc13c]
mov edx, dword [0x4dc110]
mov dword [0x8fb080], ecx
mov dword [0x8fb084], edx
call fcn.004033b0
mov ebx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
nop
push 0
call edi
cmp esi, 0x2b259d
jle 0x403794
cmp ebx, 0x785074d5
jne 0x40379d
inc esi
cmp esi, 0x11915
jl 0x403780
mov esi, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, 0x3078f
pop ebx
lea esp, [esp]
cmp dword [0x8fb080], 0x51f
jne 0x4037c2
lea eax, [ebp - 0x54]
push eax
call esi
sub edi, 1
jne 0x4037b0
mov eax, dword [0x8f9fd4]
mov dword [0x8fa614], eax
call eax
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404490
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4db0c8]
jne 0x40449a
repz ret
jmp fcn.00406bfe
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4016f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Best_Application
push str.Clariot
push 0
mov dword [0x405101], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x401737
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret

Function at 0x401f47
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x405364]
test eax, eax
je 0x401f60
call eax
test eax, eax
jne 0x401f60
push 0xfffffffffffffffe
jmp 0x401f7a
push 1
push 0x405010
push 0x405008
call fcn.00401b41
add esp, 0xc
test eax, eax
je 0x401f80
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x405004
push section..data
call fcn.00401b41
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x401fa6
mov esi, 0x404c1e
mov cl, 0x20
jmp 0x401faf
cmp al, 0x20
ja 0x401fb9
inc esi
mov al, byte [esi]
test al, al
jne 0x401faa
cmp al, 0x20
jbe 0x401fd0
mov al, byte [esi]
cmp al, 0x22
jne 0x401fc2
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x401fbb
jmp 0x401fd0
cmp al, cl
ja 0x401fd6
inc esi
mov al, byte [esi]
test al, al
jne 0x401fcb
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x401fff
movzx eax, word [ebp - 0x14]
jmp 0x402002
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00402037
pop ecx
pop esi
leave
ret

Function at 0x402037
Capabilities:
Terminate process

Disassembly:
call fcn.00402081
push 0
push 0x405018
push 0x405014
call fcn.00401b41
push 0
push 0x405020
push 0x40501c
call fcn.00401b41
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40cbc7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41a2f8
call fcn.00413724
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41b69c
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41b754
push 4
mov ebx, 0x41b68c
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00403291
mov dword [esi + 0x3c], 0x41b804
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00403291
mov dword [edi], 0x41b80c
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c1be
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c1be
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c1be
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c1be
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c1be
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x412ff0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.0041468e
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413018
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413027
mov eax, 1
ret 4

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1e4574d7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x353d36ca
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2ccb0183
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x79766bd7
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x439bec
Capabilities:
Encode data using add xor sub operations

Disassembly:
adc esp, ebx
mov ebx, 0x93727cf
or al, 0xe5
dec ecx
push 0x6c
salc
ror ch, 1
or eax, 0xcebca7ac
mov dh, 0x73
inc ebp
invalid

Function at 0x439c1c
Capabilities:
Encode data using xor

Disassembly:
add dword [edx], edi
pushfd
mov word [ebp - 0x7b], ds
dec ebp
sar dword [ecx - 0x52d6320c], 0xf5
inc esi
lds eax, [edi]
inc esp
xlatb
xor dl, byte [edx]
dec ebp
xchg esp, eax
sub bl, bl
add byte [edi + 0x73], dl
adc edx, esp
lcall 0x326d, 0xd1d4ea0
lodsd eax, dword [esi]
inc esi
jae 0x439c00
pop ecx
xor ah, dl
mov bl, 0x50
mov dh, 0xc3
iretd

Function at 0x440537
Capabilities:
Encode data using xor

Disassembly:
les esi, [esi + edx - 0xede8f41]
test byte [0x9353f79e], cl
test byte [edi - 0x79], al
mov ecx, dword [edi + 0x4a]
invalid

Function at 0x4497d8
Capabilities:
Encode data using xor

Disassembly:
add edi, dword [0x272ca61d]
popal
cmc
movsd dword es:[edi], dword [esi]
mov ah, 0xa
dec ebx
test byte [ebx], 0xa1
mov eax, 0x65dec744
adc dword [ebp - 0x36429309], ebx
unpckhps xmm6, xmmword [edx]
mov dh, 0xc5
add byte [ecx], bl
jle 0x449851
pop esp
jp 0x4497f4
dec esi
jmp 0x449817
xchg ecx, eax
out 0x67, eax
call 0x7fcdad9d
stosb byte es:[edi], al
dec eax
mov byte [0x6acd99b6], ah
jg 0x4497d9
jns 0x4497bc
dec ecx
mov eax, dword [ebp + ecx*4 + 0xf]
or eax, 0x913ae554
push cs
sub dl, al
mov ebp, 0xfb090863
nop
and bl, ch
int1
cmp eax, 0xb5d0e91b
push 0xffffffffffffffc5
mov word [ecx], cs
sbb byte [ecx + 0x3b], dl
jmp 0x4edcb8d9
dec esi
dec ecx
jno 0x4498b5
invalid
xor ah, 0x64
aaa
js 0x449816
adc al, 0x60
cld
ljmp 0x9b7c
adc al, 0x67
pop es
xor eax, 0x209a58fe
scasb al, byte es:[edi]
push 0x35
das
jbe 0x4498b8
sub edx, dword [esi]
or eax, 0x11fcf141
mov esi, 0xc6284e4f
push ds
lahf
cmpsd dword [esi], dword es:[edi]
jge 0x44988c
xchg esi, esi
ljmp 0x1698

Function at 0x4587a7
Capabilities:
Encode data using xor

Disassembly:
invalid
adc cl, bh
jns 0x458748
scasb al, byte es:[edi]
invalid
loopne 0x458750
cdq
inc eax
mov cl, 0xd7
test al, 0xcc
cmp eax, 0xfa25c2ea
xchg ebx, eax
push ds
mov ebp, ss
push ebx
scasb al, byte es:[edi]
cmp dl, dl
adc byte [edi - 0x12890f03], al
enter 0x16d9, 0xffffffffffffff97
aam 0x99
loope 0x45875f
int3
pushfd
sbb al, 0x4a
fxch st(4)
les ebp, [ebp - 0x36]
sub dword [eax], eax
dec edi
push ds
xchg dword [edx], ecx
and al, 0x4e
invalid
js 0x458757
sbb dword [edx + 0x15], ebp
xchg edi, eax
inc esi
cmpsb byte [esi], byte es:[edi]
jnp 0x458808
out dx, eax
wait
daa
test eax, 0x11c4524c
pushfd
pop ebp
inc ebx
aad 0x55
inc ecx
inc esi
out 0xb6, eax
sti
hlt
mov ecx, 0x800a1381
and cl, byte [ebx + 0x328c24d8]
sbb dh, byte [ebx]
sbb eax, 0x6fb16c92
mov ebx, 0x8fd7e942
sbb ah, ch
insd dword es:[edi], dx
invalid
Function at 0x477e75
Capabilities:
Encode data using xor

Disassembly:
xlatb
pushal
out 2, eax
test al, 0xa0
insd dword es:[edi], dx
mov esp, ebp
pop edi
lea ebx, [ecx + esi*8 + 9]
cmpsb byte [esi], byte es:[edi]
bound edi, qword [ebx - 0x4f]
inc esi
stosd dword es:[edi], eax
loope 0x477eb4
and bh, byte [edx + 0x51ccb556]
js 0x477e99
dec eax
add dword ds:[esi + 0xb], 0x5288fde3
mov eax, dword [0x93378603]
adc al, 0xbd
insd dword es:[edi], dx
add eax, 0x1218dfe1
arpl word [ecx - 0x59d6b42c], di
push ss
pop ss
pop ecx
pop ds
hlt
jg int.00477e75
add al, 0xc7
lahf
mov bh, 0x7f
pop ebp
jge 0x477ed9
in eax, 0xeb
or al, 0x49
scasb al, byte es:[edi]
and edx, 0x73
push ss
aas
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
lea esi, [edx + eax*8 - 0x20d5b2b9]
popfd
lea ebp, fs:[eax + ebp*2 - 0x77]
mov eax, 0x9ebcc717
out dx, al
jle 0x477e20
jmp 0x477e69
movsb byte es:[edi], byte [esi]
inc ebx
invalid
mov ds, word [esi - 0x27aa4cc]
insb byte es:[edi], dx
insb byte es:[edi], dx
mov esi, 0xd4cbab0a
retf 0xde11
fincstp
adc ebp, dword [edx]
sbb eax, 0x8b0618bf
adc eax, 0x3d332442
sbb byte [ecx - 0x5c], bh
aas
cmpsd dword [esi], dword es:[edi]
adc dword [eax], ecx
fsubr dword [esi + ecx*2]
sub al, 0x4e
cmc
dec eax
invalid
sub ch, byte [edi + ebx*2 + 0xb]
push esp
cmpsd dword [esi], dword es:[edi]
cwde
arpl word [ebx - 0x72ca2992], di
shl dword fs:[ecx - 0x15], 1
mov dh, 0xdf
test bh, 0x94
stc
jl 0x477f1d
ret 0x9f4c
iretd
sti
ret
pop es
jne 0x477f7a
xor eax, 0x99db5bf
stosd dword es:[edi], eax
jns 0x477ecb
jnp 0x477f5c
mov ebx, 0x362222b0
std
cmp byte [edx], dh
jno 0x477f00
lodsb al, byte [esi]
dec eax
jns 0x477f08
fidivr word [0xb83d1cfa]
and eax, 0xd6e9fdbc
inc esp
sti
idiv byte [ebp + 0x685cbccc]
fidivr word [bp + di]
invalid
jl 0x477fa0
shl byte [edx + edx*8 + 0x33], 1
mov bh, 0xcd
pushal
inc ebx
push ebp
fcomp qword [ebp + 0x7d323457]
sub dword [edx], edi
xchg edx, eax
or dh, byte [edx]
mov eax, dword [0x849e7c51]
jns 0x477fea
invalid
dec edi
or edi, dword [ecx]
pop ss
pushal
fild dword [edi - 0x3e]
or dword [esi - 0x79], ebp
push eax
aad 0xf4
mov esi, 0xb6a8f56c
clc
xor al, 0x6e
lcall 0x4508, 0xecf5301c
inc esi
invalid
mov cl, 0x13
or byte [eax + 0x1d4cdda1], dl
test byte [esi + 0x67], bh
adc al, 0x7e
mov dword [ebp - 0x67], eax
daa
adc dword es:[esi + ecx*4 - 0xf254ccb], 0xb54ad25e
in eax, dx
sti
ljmp 0x9588
jb 0x478052
fcom dword [esi + 0x71]
cld
invalid
pop es
scasb al, byte es:[edi]
invalid
Function at 0x481ce6
Capabilities:
Encode data using xor

Disassembly:
xor ch, ch
vpsrlq ymm7, ymm7, xmmword [ebp - 0x460f6172]
aam 0x4c
push ss
sub eax, 0x40834325
aad 0x30
inc ebx
add dword [eax - 0x2b], 0x30
fucom st(6)
jae 0x481cf5
mov edx, 0xea67f930
ja 0x481cf2
arpl di, dx
mov ecx, 0x2a752732
cld
inc esi
cdq
mov al, byte [0x17fc61bc]
insd dword es:[edi], dx
arpl word [eax], bx
aaa
outsd dx, dword [esi]
mov ch, byte [esi - 0x12]
mov al, byte [0xfeb85e2d]
inc ebp
mov esi, 0x8dc3e4b2
pop es
lea edx, [ebx + 0x30]
lahf
jae 0x481d8c
sub edi, eax
xor dword [edi + 0x4b], esp
mov dword [0x83a1fdcc], eax
clc
mov ch, 0xb
jmp 0xc11076d0
pushfd
invalid
adc ch, byte [edx + 0x47]
lcall 0x9894, 0xa6c299b2
dec esi
push cs
jb 0x481d71
mov bl, 0x30
fisub dword [ebp - 0x1d]
clc
clc
enter 0x375f, 0xffffffffffffffc1
mov word [edi], ss
dec esi
lodsd eax, dword [esi]
fld qword [di - 0x7f]
push ebx
mov dh, 0x96
mov edi, 0xd9f65982
dec eax
mul esi
js 0x481df5
or eax, 0x2906c2e9
add ch, byte [0x6c0ad5c2]
into
insd dword es:[edi], dx
mov byte [0x6439719f], al
mov esp, 0x46a42981
enter 0xffffffffffffc590, 0xfffffffffffffffb
cmp dword [ebp + 0x34], edx
dec edx
not dword [edi]
stc
cmc
outsd dx, dword [esi]
cld
xor dword [ebp + edi*4 - 0x73], edx
xor al, 0x14
xor byte [edi + edi*4 - 0x1e52ce6a], bh
call dword [ebp + 0x550b172d]
pop edi
or edx, dword [ebp + 0x5f]
invalid

Function at 0x4895d7
Capabilities:
Authenticate hmac

Disassembly:
ljmp 0xed0e:0x90bcacb
loopne 0x4895b9
add byte [eax], dh
mov ch, 0x5c
jnp 0x48953d
mov bh, 0xa5
test eax, 0xb8d6d8d8
xchg esi, eax
wait
xor al, 0x48
and dl, byte [edi]
in eax, dx
or cl, dl
and ecx, dword [edi - 0x18c01286]
pop eax
test dword [ebx - 0x5c], edx
jl 0x489628
invalid
invalid
inc ebp
wait
jge 0x4895d8
ror byte [esi + 7], cl
jno 0x48963b
cmp dword [esi - 0x5d], edx
push eax
and cl, byte [edx - 0x14]
mov bl, 0xc9
enter 0x5849, 0xffffffffffffffa4
inc ebp
xchg edi, eax
add dh, byte [ebx + 0x44]
inc esp
inc esp
xor al, 0x9f
jnp 0x4895b9
adc eax, 0xd1031a3e
xchg esi, eax
xor edx, esi
jbe 0x489633
ror byte [ebx], 1
and al, 0xf0
mov bh, 0x36
mov eax, 0xea6fcdc8
push es
mov eax, 0x576ee0f2
call 0x3912e1b7
jecxz 0x489589
mov ebx, 0xab89ec02
imul ebp, dword [ebp + 0x7dd52384], 0xffffffc4
ja 0x489622
adc bl, byte [ebp - 0x5b703e04]
sbb edi, dword [edi - 0xee3a3c]
shl dword [edx + 0x46963a59], cl
mov esi, 0x3bf61ebd
idiv byte [ebx]
pop edi
push ebp
wait
push esp
pop edi
popfd
mov esp, edi
test al, 0xf1
sal byte [ebx - 0xfa72faa], 0xe9
jg 0x4895bd
pop eax
invalid
cmp byte [esi - 0x695e5b1a], cl
mov ah, 0x82
sar byte [ebx], 1
sbb bl, al
and al, 0x8b
movsb byte es:[edi], byte [esi]
mov eax, dword [0xd082b496]
cmp ebx, dword [edx]
fsub dword [ebx + ecx*4]
test dword [edx], ebp
xlatb
ret

Function at 0x4aaf88
Capabilities:
Encode data using xor

Disassembly:
push ebp
cmp byte [esi + 0x43], 0x5b
jno 0x4aaff9
sub al, 0xa0
shr dword [esp + edi*4 + 0x2f], cl
in eax, dx
xor ch, byte [esi + 0x7e58135]
xor eax, 0x6407e581
dec edi
and ebp, 0x704f6407
clc
in eax, 7
dec edi
jo 0x4aaf98
jle 0x4aaf9a
ljmp 0x5e4d:0x9fab7fec
jmp 0x4aaf99
Function at 0x4053e0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ecx
push esi
push edi
sub esp, 8
mov esi, eax
mov edi, edx
xor edx, edx
mov ecx, eax
inc eax
cmp byte [ecx], 0
je 0x4053f7
inc edx
jmp 0x4053ec
push 0
lea eax, [esp + 4]
push eax
push edx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [esp + 4]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffff4
mov word [esp + 0x18], 0xa0d
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, edi
jmp 0x402390

Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
push edi
pop ecx
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW
Function at 0x10006308
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x1004d25e], ebp
mov dword [0x1004d262], esi
mov dword [0x1004d266], edi
xor edx, edx
mov ebp, esp
mov edi, dword [ebp + 4]
mov dword [0x1004d25a], edi
mov esi, 0x1004d26a
xor ebx, ebx
mov edx, 0x17ffc
mov dword [edx + edi], edx
sub edx, 4
jne 0x10006333
mov dl, byte [esi]
movsx eax, byte [esi + edx*2 - 1]
add ah, byte [esi + edx*2]
xor ah, 0x80
shl eax, 0x10
mov dword [edi + edx*4 - 4], eax
mov dword [edi + edx*4 + 0x3fc], eax
movsx eax, byte [esi + edx*2]
mov ebp, eax
shl ebp, 8
add ebp, eax
shl ebp, 8
movsx eax, byte [esi + edx*2 - 1]
add ebp, eax
shl ebp, 8
add ebp, eax
mov dword [edi + edx*4 + 0xbffc], ebp
xor ebp, 0x80000000
mov dword [edi + edx*4 + 0xc3fc], ebp
dec edx
jne 0x1000633d
mov dl, byte [esi]
lea esi, [esi + edx*2 + 2]
lea ebp, [edi + edx*4]
cmp byte [esi - 1], 0
jl 0x100063e9
xor ebx, ebx
xor ecx, ecx
mov eax, dword [edi + ebx*4]
xor eax, 0x80000000
sar eax, 0x10
mov dword [ebp], eax
mov eax, dword [edi + ecx*4]
xor eax, 0x80000000
add eax, dword [ebp]
mov dword [ebp], eax
mov dword [ebp + 0x400], eax
mov eax, dword [edi + ebx*4 + 0xc000]
mov dword [ebp + 0xc000], eax
mov eax, dword [edi + ecx*4 + 0xc000]
mov dword [ebp + 0xc400], eax
add ebp, 4
inc cl
cmp cl, byte [esi - 1]
jl 0x1000639a
inc bl
cmp bl, byte [esi - 1]
jl 0x10006398
jmp 0x10006440
neg byte [esi - 1]
xor ecx, ecx
xor ebx, ebx
mov eax, dword [edi + ebx*4]
xor eax, 0x80000000
sar eax, 0x10
mov dword [ebp], eax
mov eax, dword [edi + ecx*4]
xor eax, 0x80000000
add eax, dword [ebp]
mov dword [ebp], eax
mov dword [ebp + 0x400], eax
mov eax, dword [edi + ebx*4 + 0xc000]
mov dword [ebp + 0xc000], eax
mov eax, dword [edi + ecx*4 + 0xc400]
mov dword [ebp + 0xc400], eax
add ebp, 4
inc bl
cmp bl, byte [esi - 1]
jl 0x100063f0
inc cl
cmp cl, byte [esi - 1]
jl 0x100063ee
neg byte [esi - 1]
add ebp, 0x400
add edi, 0x800
cmp byte [esi], 0
jne 0x1000633b
mov ebp, dword [0x1004d25e]
mov esi, dword [0x1004d262]
mov edi, dword [0x1004d266]
ret 4