joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c635
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a420]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407027
mov dword [ebp - 0x14], eax
cmp dword [0x43562c], esi
jne 0x40c728
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c6b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c808
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c808
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c808
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43562c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x435630], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x435634], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43563c], eax
test eax, eax
je 0x40c725
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x435638], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c74d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c740
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c762
push 4
pop eax
jmp 0x40c80a
cmp dword [ebp - 0x14], esi
je 0x40c762
push dword [0x43562c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c747
mov eax, dword [0x435638]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c7c0
cmp dword [0x43563c], edi
je 0x40c7c0
push eax
call ebx
push dword [0x43563c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c7c0
test eax, eax
je 0x40c7c0
call ecx
test eax, eax
je 0x40c7b5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c7b5
test byte [ebp - 8], 1
jne 0x40c7c0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c7f0
mov eax, dword [0x435630]
cmp eax, edi
je 0x40c7ed
push eax
call ebx
test eax, eax
je 0x40c7ed
call eax
mov esi, eax
test esi, esi
je 0x40c7ed
mov eax, dword [0x435634]
cmp eax, edi
je 0x40c7ed
push eax
call ebx
test eax, eax
je 0x40c7ed
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43562c]
call ebx
test eax, eax
je 0x40c808
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c80a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403dfb
mov esp, ebp
pop ebp
ret
Function at 0x405a66
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x5a4d
push ebx
mov ebx, dword [ebp + 8]
cmp word [ebx], ax
je 0x405a82
or eax, 0xffffffff
jmp 0x405bdb
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
cmp dword [esi], 0x4550
je 0x405a98
or eax, 0xffffffff
jmp 0x405bda
mov eax, 0x20b
cmp word [esi + 0x18], ax
lea eax, [esi + 0x88]
je 0x405aac
lea eax, [esi + 0x78]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
push ecx
push esi
mov dword [ebp - 0x1c], eax
call fcn.004060e2
or edi, 0xffffffff
mov dword [ebp - 8], eax
cmp eax, edi
je 0x405bd7
push dword [ebp + 0xc]
mov ecx, dword [eax + ebx + 0x18]
push dword [eax + ebx + 0x1c]
mov dword [ebp - 0xc], ecx
push esi
call fcn.004060e2
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push dword [eax + ebx + 0x24]
push esi
call fcn.004060e2
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
push dword [eax + ebx + 0x20]
push esi
call fcn.004060e2
mov edx, dword [ebp - 0x10]
mov ecx, eax
cmp edx, edi
je 0x405bd7
mov eax, dword [ebp - 0x14]
cmp eax, edi
je 0x405bd7
cmp ecx, edi
je 0x405bd7
add eax, ebx
add edx, ebx
mov dword [ebp - 0x14], eax
add ecx, ebx
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], eax
jbe 0x405bd7
push dword [ebp + 0xc]
push dword [ecx + eax*4]
push esi
call fcn.004060e2
cmp eax, edi
je 0x405bb7
mov edx, dword [ebp - 0x14]
lea ecx, [eax + ebx]
mov eax, dword [ebp - 8]
movzx eax, word [edx + eax*2]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + eax*4]
mov eax, dword [ebp - 0x18]
cmp edx, eax
jb 0x405b7b
add eax, dword [ebp - 0x1c]
mov ebx, dword [ebp + 8]
cmp edx, eax
jb 0x405bb7
mov eax, dword [ebp + 0x10]
mov bl, byte [ecx]
cmp bl, byte [eax]
mov byte [ebp - 1], bl
mov ebx, dword [ebp + 8]
jne 0x405bae
cmp byte [ebp - 1], 0
je 0x405baa
mov bl, byte [ecx + 1]
cmp bl, byte [eax + 1]
mov byte [ebp - 1], bl
mov ebx, dword [ebp + 8]
jne 0x405bae
add ecx, 2
add eax, 2
cmp byte [ebp - 1], 0
jne 0x405b7e
xor eax, eax
jmp 0x405bb3
sbb eax, eax
or eax, 1
test eax, eax
je 0x405bcb
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0xc]
jae 0x405bd7
mov ecx, dword [ebp - 0x20]
jmp 0x405b47
push dword [ebp + 0xc]
push edx
push esi
call fcn.004060e2
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4060e2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
movzx ebx, word [ecx + 6]
add edx, eax
push edi
test ebx, ebx
jle 0x406119
mov ecx, dword [ebp + 0xc]
mov edi, dword [edx + 0xc]
cmp edi, ecx
ja 0x406111
mov eax, dword [edx + 8]
add eax, edi
cmp eax, ecx
ja 0x406123
add edx, 0x28
inc esi
cmp esi, ebx
jl 0x406101
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [edx + 0x14]
sub eax, edi
add ecx, eax
cmp ecx, dword [ebp + 0x10]
jb 0x406132
or ecx, 0xffffffff
mov eax, ecx
jmp 0x40611c
Function at 0x40e1ea
Capabilities:
Reference google public dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4395b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
pop esi
push esi
push esi
call fcn.0040edb0
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
je 0x40e261
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 0x35
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov word [ebp - 0x14], si
call fcn.004047c4
push 0x42a620
mov word [ebp - 0x12], ax
call fcn.00404704
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
sub esp, 0x10
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040d252
test eax, eax
jle 0x40e25a
push dword [ebp + 0xc]
push ebx
call fcn.0040d0c2
push ebx
call fcn.0040e940
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004267f0
mov esp, ebp
pop ebp
ret 8

Function at 0x41a560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [esi], ax
je 0x41a577
xor al, al
jmp 0x41a5ce
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41a573
movzx ecx, word [eax + 6]
add eax, 0xf8
push ebx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x41a5ca
mov ebx, eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a5a8
sub ecx, dword [ebp + 8]
push ecx
push ebx
push edx
call fcn.004267a0
add esp, 0xc
test eax, eax
je 0x41a5d5
inc edi
add ebx, 0x28
cmp edi, dword [ebp - 4]
jb 0x41a59d
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
imul ecx, edi, 0x28
mov edx, dword [ecx + eax + 0x14]
mov ecx, dword [ecx + eax + 0x10]
add edx, esi
mov eax, dword [ebp + 0xc]
push dword [eax + 0x90]
add eax, 0x10
push eax
push ecx
push edx
call fcn.00404688
cmp eax, 0xffffffff
setne al
jmp 0x41a5cc
Function at 0x41a602
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [esi], ax
je 0x41a619
xor al, al
jmp 0x41a670
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41a615
movzx ecx, word [eax + 6]
add eax, 0x108
push ebx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x41a66c
mov ebx, eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a64a
sub ecx, dword [ebp + 8]
push ecx
push ebx
push edx
call fcn.004267a0
add esp, 0xc
test eax, eax
je 0x41a677
inc edi
add ebx, 0x28
cmp edi, dword [ebp - 4]
jb 0x41a63f
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
imul ecx, edi, 0x28
mov edx, dword [ecx + eax + 0x14]
mov ecx, dword [ecx + eax + 0x10]
add edx, esi
mov eax, dword [ebp + 0xc]
push dword [eax + 0x90]
add eax, 0x10
push eax
push ecx
push edx
call fcn.00404688
cmp eax, 0xffffffff
setne al
jmp 0x41a66e

Function at 0x41a6a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
mov eax, 0x5a4d
push edi
mov edi, dword [ebp + 8]
cmp word [edi], ax
je 0x41a6c2
xor eax, eax
jmp 0x41a74a
push esi
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
jne 0x41a6e0
push dword [esi + 0x80]
push esi
call fcn.0041bfd0
test eax, eax
jne 0x41a6e4
xor eax, eax
jmp 0x41a749
push ebx
lea ebx, [eax + edi]
jmp 0x41a736
mov eax, dword [ebx]
test eax, eax
jne 0x41a6f3
mov eax, dword [ebx + 0x10]
push eax
push esi
call fcn.0041bfd0
add eax, edi
mov dword [ebp + 8], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x41a733
mov ebx, dword [ebp - 4]
js 0x41a721
push ecx
push esi
call fcn.0041bfd0
add eax, 2
add eax, edi
push eax
call fcn.0041bf84
add ebx, eax
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp + 8], eax
mov ecx, dword [eax]
test ecx, ecx
jne 0x41a708
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
add ebx, 0x14
push 0x14
push ebx
mov dword [ebp - 8], ebx
call fcn.0041bfac
test al, al
je 0x41a6ea
mov eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x41a752
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
mov eax, 0x5a4d
push edi
mov edi, dword [ebp + 8]
cmp word [edi], ax
je 0x41a770
xor eax, eax
jmp 0x41a802
push esi
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
jne 0x41a78e
push dword [esi + 0x90]
push esi
call fcn.0041c022
test eax, eax
jne 0x41a792
xor eax, eax
jmp 0x41a801
push ebx
lea ebx, [eax + edi]
jmp 0x41a7ee
mov eax, dword [ebx]
test eax, eax
jne 0x41a7a1
mov eax, dword [ebx + 0x10]
push eax
push esi
call fcn.0041c022
lea ecx, [edi + eax]
mov eax, dword [ecx]
mov dword [ebp - 8], ecx
mov ecx, dword [ecx + 4]
or eax, ecx
je 0x41a7eb
mov ebx, dword [ebp - 8]
and ecx, 0x80000000
xor eax, eax
or eax, ecx
jne 0x41a7dc
push dword [ebx]
push esi
call fcn.0041c022
add eax, 2
add eax, edi
push eax
call fcn.0041bf84
add dword [ebp - 4], eax
mov ecx, dword [ebx + 0xc]
add ebx, 8
mov eax, dword [ebx]
or eax, ecx
jne 0x41a7ba
mov ebx, dword [ebp + 8]
add ebx, 0x14
push 0x14
push ebx
mov dword [ebp + 8], ebx
call fcn.0041bfac
test al, al
je 0x41a798
mov eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x41c776
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x41c7ae
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
sub esi, ebx
mov eax, edi
mov dword [ebp + 8], 7
cdq
lea ecx, [edi + ebx]
idiv dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov al, byte [eax + edx*4]
xor al, byte [esi + ecx]
inc edi
mov byte [ecx], al
cmp edi, dword [ebp + 0xc]
jl 0x41c78b
pop esi
pop ebx
pop edi
pop ebp
ret 0x10
Function at 0x41fd84
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ebp + 0x10], al
jne 0x41fe20
cmp byte [eax + ecx], 0x48
jne 0x41fda9
cmp byte [eax + ecx + 1], 0x8b
jne 0x41fda9
cmp byte [eax + ecx + 2], 5
je 0x41fdb1
inc eax
cmp eax, 0x40
jb 0x41fd95
jmp 0x41fdc4
mov dword [eax + ecx], 0x90909090
mov word [eax + ecx + 4], 0x9090
mov byte [eax + ecx + 6], 0x90
mov eax, dword [ebp + 0xc]
jmp 0x41fe18
mov dl, byte [eax + ecx]
cmp dl, 0x48
jne 0x41fe18
cmp byte [eax + ecx + 1], 0x81
jne 0x41fde6
cmp byte [eax + ecx + 2], 0xc4
jne 0x41fde6
cmp byte [eax + ecx - 5], 0xe8
je 0x41fe62
cmp dl, 0x48
jne 0x41fe18
cmp byte [ecx + eax + 1], 0x33
jne 0x41fe18
cmp byte [ecx + eax + 2], 0xcc
jne 0x41fe18
cmp byte [ecx + eax + 3], 0xe8
jne 0x41fe18
add eax, 3
mov word [ecx + eax + 1], 0x9090
mov byte [eax + ecx], 0x90
mov byte [ecx + eax + 3], 0x90
mov byte [eax + ecx + 4], 0x90
dec eax
cmp eax, 1
ja 0x41fdc9
jmp 0x41fe6f
cmp byte [eax + ecx], 0xa1
je 0x41fe2e
inc eax
cmp eax, 0x40
jb 0x41fe20
jmp 0x41fe3a
mov dword [eax + ecx], 0x90909090
mov byte [eax + ecx + 4], 0x90
mov eax, dword [ebp + 0xc]
jmp 0x41fe5a
mov dl, byte [eax + ecx]
cmp dl, 0x8b
jne 0x41fe4e
cmp byte [eax + ecx + 1], 0xe5
je 0x41fe53
cmp dl, 0xc9
jne 0x41fe5a
cmp byte [eax + ecx - 5], 0xe8
je 0x41fe62
dec eax
cmp eax, 1
ja 0x41fe3f
jmp 0x41fe6f
mov byte [eax + ecx - 1], 0x90
mov dword [eax + ecx - 5], 0x90909090
pop ebp
ret 0xc

Function at 0x41fd8b
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ebp + 0x10], al
jne 0x41fe20
cmp byte [eax + ecx], 0x48
jne 0x41fda9
cmp byte [eax + ecx + 1], 0x8b
jne 0x41fda9
cmp byte [eax + ecx + 2], 5
je 0x41fdb1
inc eax
cmp eax, 0x40
jb 0x41fd95
jmp 0x41fdc4
mov dword [eax + ecx], 0x90909090
mov word [eax + ecx + 4], 0x9090
mov byte [eax + ecx + 6], 0x90
mov eax, dword [ebp + 0xc]
jmp 0x41fe18
mov dl, byte [eax + ecx]
cmp dl, 0x48
jne 0x41fe18
cmp byte [eax + ecx + 1], 0x81
jne 0x41fde6
cmp byte [eax + ecx + 2], 0xc4
jne 0x41fde6
cmp byte [eax + ecx - 5], 0xe8
je 0x41fe62
cmp dl, 0x48
jne 0x41fe18
cmp byte [ecx + eax + 1], 0x33
jne 0x41fe18
cmp byte [ecx + eax + 2], 0xcc
jne 0x41fe18
cmp byte [ecx + eax + 3], 0xe8
jne 0x41fe18
add eax, 3
mov word [ecx + eax + 1], 0x9090
mov byte [eax + ecx], 0x90
mov byte [ecx + eax + 3], 0x90
mov byte [eax + ecx + 4], 0x90
dec eax
cmp eax, 1
ja 0x41fdc9
jmp 0x41fe6f
cmp byte [eax + ecx], 0xa1
je 0x41fe2e
inc eax
cmp eax, 0x40
jb 0x41fe20
jmp 0x41fe3a
mov dword [eax + ecx], 0x90909090
mov byte [eax + ecx + 4], 0x90
mov eax, dword [ebp + 0xc]
jmp 0x41fe5a
mov dl, byte [eax + ecx]
cmp dl, 0x8b
jne 0x41fe4e
cmp byte [eax + ecx + 1], 0xe5
je 0x41fe53
cmp dl, 0xc9
jne 0x41fe5a
cmp byte [eax + ecx - 5], 0xe8
je 0x41fe62
dec eax
cmp eax, 1
ja 0x41fe3f
jmp 0x41fe6f
mov byte [eax + ecx - 1], 0x90
mov dword [eax + ecx - 5], 0x90909090
pop ebp
ret 0xc
Function at 0x466537
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
dec ecx
push esi
mov dword [esp + 0x14], edx
pushfd
mov word [esp], si
pop edx
movsx dx, bl
mov edx, 0x40d702
mov byte [esp + 0xc], 0x76
call fcn.004b595e
daa
hlt
push 0xc46e09a
lea ebp, [ebp + 0x4a8e4c63]
mov byte [esp + 4], dl
call fcn.004a10af
xor bl, byte [edx + ebx*8 - 0x38960638]
jge 0x466551
invalid
jg 0x466517
inc edi
inc ebp
lahf
cmp bl, byte [ecx + eax + 0x6f]
fisttp qword [edi]
jge 0x466533
inc eax
jecxz 0x46658c
int3
push ds
sbb al, 0x9a
sub al, 0x96
sub byte [edx - 0x54c651c4], cl
mov eax, 0x87211d87
add eax, 0x681e9ea5
scasb al, byte es:[edi]
cmp dword [ebx + 0x211d87b8], ebp
xchg ebx, esi
add eax, 0x681e9ea5
mov edx, 0x30081b99
xchg byte [ecx], cl
jnp 0x4665a6
cdq
sbb ecx, dword [eax]
xor byte [esi - 0x1d0484f7], al
test byte [ecx], 0x8d
mov cl, 0xff
in al, 0x97
loop 0x4665a3
add dword [ebp - 0x681b004f], ecx
xchg esp, eax
cld
pushfd
rcr dword [ecx - 0x31], 1
loopne 0x466594
and al, byte [ecx]
call 0x34e6c029
sbb edi, dword [ecx + 0x2c]
pop ds
sar bh, 1
sub eax, 0x1739de4
pop esi
xor dword [ecx], ecx
push ebx
sub ch, byte [edx + 0x55f8b20c]
iretd

Function at 0x46a8f5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4bbb27
jmp 0x48a2f3
lea ecx, [ecx + 1]
lea esp, [esp + 8]
jp 0x46a514
push 0x784c8340
mov dword [esp + 8], ecx
mov byte [esp], 0xfd
mov byte [esp], dh
setle ch
not cl
mov ecx, 0x40a539
mov byte [esp], bl
mov ecx, dword [ecx + 0xad5d0]
mov word [esp], 0xc9a3
and al, 0xa3
leave
lea ecx, [ecx + 0x21d6be8f]
push 0xaaf97a4a
call fcn.0046de6a
adc al, 0
loopne 0x48a329
cmpsb byte [esi], byte es:[edi]
mov al, byte [0xc3041f38]
jae 0x48a33c
push es
add byte [eax + 0x38be66cc], bl
pop ds
xlatb
imul esp, dword [ecx], 0x10004d36
and dword [esi - 0x23e0c70d], 0xc82bdcd
add byte [eax + 0x2d], ch
xchg ecx, eax
cmp byte [edi], bl
cli
scasd eax, dword es:[edi]
xchg dword [eax - 0x7ef7fff3], ebp
lcall 0x802, 0x6e5d1f38
add eax, 0x26e5f800
mov esi, 0x4fc1f38
popfd
inc ebp
cmp eax, dword [eax]
clc
and eax, 0x1f38dc26
imul si, word [ebx + 0x48005d41], 0x2606
and eax, 0xd4271f38
in eax, dx
adc al, byte [edx]
add byte [eax], cl
bound esp, qword [esi - 0x42]
cmp byte [edi], bl
xchg esp, eax
adc eax, 0xbf296
pop eax
lea esp, [esi]
mov esi, 0xdf271f38
ficomp dword [esp + edi]
add al, dl
and al, 0x26
adc bh, byte [eax]
pop ds
sbb byte [ebx + 0x13142e], ch
cwde
inc ebx
out 0xbe, al
cmp byte [edi], bl
add eax, ebx
pushal
aas
add byte [eax + 0x4c], dl
lea edi, es:[eax]
pop ds
pop ds
add cl, dh
mov byte [eax + eax], cl
xor cl, ah
out 0xa4, al
cmp byte [edi], bl
stosb byte es:[edi], al
cli
jne 0x48a3c4
dec edi
add byte [eax + 0x3b], ch
in eax, dx
cmp byte [edi], bl
mov bh, 0x8d
adc dword es:[edx], 0
inc eax
je 0x48a39b
mov ebp, 0x95051f38
arpl dx, bx
or eax, 0x26c15800
mov dword [0x4edc1f38], eax
sbb eax, dword [ebx + 0x4f90000d]
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
cmp byte [edi], bl
sub eax, 0x1088d08e
add al, ch
cmpsb byte [esi], byte es:[edi]
scasw ax, word es:[edi]
cmp byte [edi], bl
push edi
lodsd eax, dword [esi]
retf 0x1139
Function at 0x4b12af
Capabilities:
Authenticate hmac

Disassembly:
nop
pushal
push 0x712122ca
xchg dword [esp + 0x20], esi
lea esi, [ecx - 0x7e6105d0]
mov esi, dword [esp + 0x24]
call fcn.0047031a
loop 0x4a4ff5
jmp dword [ebx - 0x7138921d]
mov esp, 0x28961822
jle 0x4a4fcf
invalid
jecxz 0x4a4ff4
and ecx, dword [ebp - 0x40c6bc23]
add dword [ebx - 0x1b], esp
xor ebp, dword [ecx]
jnp 0x4a4fa5
cmp dword [edi + 0x33e56301], edi
sub dword [ebx - 0x33], edi
aas
xor ebx, 0x86052f64
or byte [edi - 0x72], ah
das
add eax, 0x8e670886
adc ah, ch
pop esi
jno 0x4a4fdc
or esp, dword [bp + di - 0x13]
rol dword [edi - 7], 1
push edi
sal byte [edx], 0xbd
das
daa
sbb esp, dword [ecx + 0x2d]
je 0x4a5071
popal
sub eax, 0xa9557874
sub ebx, ebx
push ecx
ficom word [eax + 0x40]
push ebp
test eax, 0xde51db2b
push eax
inc eax
jl 0x4a4fc9
mov dl, 0x34
jo 0x4a502c
idiv dword [ecx]
enter 0x5e14, 0x5c
fidiv word [ecx + 0x77]
xchg esi, eax
in al, dx
invalid
adc al, 0x16
test byte [ecx], ah
jae 0x4a5068
add eax, 0xcd739339
aad 0x55
invalid
cmp al, 0x36
aas
inc esi
mov dl, 0x14
cmp ebp, ebp
inc edi
ror byte [edx - 0x19], 1
and eax, eax
pushfd
nop
pushal
pushfd
pushfd
xchg dword [esp + 0x28], ebx
pop ebx
mov ebx, dword [esp + 0x28]
jmp 0x4b981b
jmp 0x4a4f81
call fcn.0049a9ee
in eax, 0x4b
mov dl, byte [ebp + 0x49c9c76f]
iretd

Function at 0x4b72f0
Capabilities:
Encode data using xor

Disassembly:
invalid
call fcn.00479fff
ficomp word [eax - 1]
mov dword [0x8ec76f06], eax
or dl, byte [edx + ebp*8 + 0x5c]
or al, 0x6e
insb byte es:[edi], dx
out 0x58, al
salc
push 0xd86608b6
jle 0x4b72e7
outsb dx, byte [esi]
mov esp, 0x904a14be
idiv byte [eax - 0x2b]
imul ecx, esp, 0x31
xchg edi, eax
rcr byte [ebx + eax + 0x3b], 1
test eax, 0x6a288d1f
cmc
jl 0x4b736c
invalid
add al, 0x93
jmp 0x8d7b33e9

Function at 0x4c63ae
Capabilities:
Encode data using xor

Disassembly:
call fcn.0046eda9
jbe 0x4c6381
arpl word [edi], di
clc
outsd dx, dword [esi]
invalid

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x289c468e
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x4b006751
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x4819473b
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2fc602be
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219