joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4cb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.00519970
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
movzx ecx, byte [eax + 0xf]
mov esi, dword [esp + 0x28]
mov ebp, ecx
and ecx, 0xf
mov dword [esp + 0x24], 0
add ecx, ecx
and ebp, 0xfffffff0
push edi
mov ebx, dword [esi + ecx*8]
mov edi, dword [esi + ecx*8 + 4]
mov edx, dword [esi + ecx*8 + 8]
mov ecx, dword [esi + ecx*8 + 0xc]
mov esi, edx
shrd edx, ecx, 4
and esi, 0xf
mov dword [esp + 0x14], ebx
or dword [esp + 0x28], edx
shl dword [esp + 0x14], 0x1c
shrd ebx, edi, 4
mov edx, dword [esi*4 + 0x5a2ec8]
mov esi, dword [esp + 0x2c]
shr ecx, 4
or dword [esp + 0x14], ecx
xor ecx, ecx
shr edi, 4
xor ecx, ebx
xor ecx, dword [esi + ebp]
xor edx, edi
xor edx, dword [esi + ebp + 4]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
xor edi, dword [esi + ebp + 8]
xor ebx, dword [esi + ebp + 0xc]
mov dword [esp + 0x18], edx
mov edx, 0xe
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
nop dword [eax + eax]
movzx edx, byte [edx + eax]
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ecx, edx
shr ecx, 4
and edx, 0xf
mov dword [esp + 0x20], ecx
add edx, edx
mov ecx, edi
shl ebp, 0x1c
shrd edi, ebx, 4
and ecx, 0xf
mov dword [esp + 0x28], 0
shr ebx, 4
or esi, edi
or ebp, ebx
xor edi, edi
mov ebx, dword [ecx*4 + 0x5a2ec8]
mov ecx, dword [esp + 0x18]
shrd dword [esp + 0x10], ecx, 4
xor edi, dword [esp + 0x10]
shr ecx, 4
xor ebx, ecx
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx + edx*8 + 4]
xor ebp, dword [ecx + edx*8 + 0xc]
xor edi, dword [ecx + edx*8]
xor esi, dword [ecx + edx*8 + 8]
mov edx, edi
shrd edi, ebx, 4
mov ecx, esi
shl edx, 0x1c
shrd esi, ebp, 4
and ecx, 0xf
shr ebx, 4
or dword [esp + 0x28], esi
shr ebp, 4
or edx, ebp
xor ebp, ebp
mov ecx, dword [ecx*4 + 0x5a2ec8]
xor ebp, edi
xor ecx, ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov ebx, ebp
add edx, edx
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x2c]
xor ebx, dword [ebp + edx*8]
xor ecx, dword [ebp + edx*8 + 4]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x28]
xor ebx, dword [ebp + edx*8 + 8]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x14]
xor ebx, dword [ebp + edx*8 + 0xc]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
sub edx, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jns 0x4d4d50
mov edx, dword [esp + 0x18]
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov byte [eax + 3], dl
mov edx, dword [esp + 0x10]
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 5], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 6], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [eax + 8], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 9], cl
mov ecx, ebx
shr ecx, 8
mov byte [eax + 0xa], cl
mov byte [eax + 7], dl
mov edx, edi
mov ecx, edx
mov byte [eax + 0xb], bl
shr ecx, 0x18
mov byte [eax + 0xc], cl
mov ecx, edx
shr ecx, 0x10
pop edi
mov byte [eax + 0xd], cl
mov ecx, edx
pop esi
shr ecx, 8
pop ebp
mov byte [eax + 0xe], cl
mov byte [eax + 0xf], dl
pop ebx
add esp, 0x14
ret
Function at 0x4d7770
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x98
call fcn.00519970
mov eax, dword [0x5c6a7c]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xa0]
mov dword [esp + 4], edi
mov eax, dword [ecx]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x80], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x84], eax
mov dword [esp + 0x58], 0x61707865
mov dword [esp + 0x5c], 0x3320646e
mov eax, dword [ecx]
mov dword [esp + 0x88], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x8c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x90], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x60], 0x79622d32
mov dword [esp + 0x64], 0x6b206574
test eax, eax
je 0x4d796d
push ebx
mov ebx, dword [esp + 0xa8]
push ebp
push esi
nop
mov esi, 0x40
cmp eax, esi
cmovb esi, eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], esi
push eax
call fcn.004d7990
add esp, 8
xor eax, eax
test esi, esi
je 0x4d793c
cmp esi, 0x20
jb 0x4d7914
lea edx, [edi - 1]
lea ecx, [esp + esi + 0x23]
add edx, esi
cmp edi, ecx
ja 0x4d788c
lea ecx, [esp + 0x24]
cmp edx, ecx
jae 0x4d7914
lea ecx, [ebx - 1]
add ecx, esi
cmp edi, ecx
ja 0x4d7899
cmp edx, ebx
jae 0x4d7914
mov ebp, esi
lea edx, [edi + 0x10]
lea esi, [esp + 0x24]
mov ecx, ebx
sub ecx, esi
and ebp, 0xffffffe0
mov dword [esp + 0x14], ecx
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, ebx
mov ebx, dword [esp + 0x14]
sub ecx, edi
mov esi, dword [esp + 0x18]
mov edi, ecx
mov dword [esp + 0x1c], ecx
nop word [eax + eax]
movups xmm0, xmmword [esp + eax + 0x24]
lea ecx, [ebx + eax]
movups xmm1, xmmword [esp + ecx + 0x24]
lea ecx, [esi + eax]
lea edx, [edx + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x34]
add eax, 0x20
movups xmmword [esp + ecx + 0x24], xmm1
movups xmm1, xmmword [edi + edx - 0x20]
pxor xmm1, xmm0
movups xmmword [edx - 0x20], xmm1
cmp eax, ebp
jb 0x4d78d0
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0xb0]
cmp eax, esi
jae 0x4d793c
lea ecx, [esp + 0x24]
mov ebp, edi
sub ebx, ecx
sub ebp, ecx
lea edx, [esp + 0x24]
add edx, eax
inc eax
mov cl, byte [ebx + edx]
xor cl, byte [edx]
mov byte [edx + ebp], cl
cmp eax, esi
jb 0x4d7922
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
add edi, esi
inc dword [esp + 0x94]
sub eax, esi
add ebx, esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], eax
test eax, eax
jne 0x4d7840
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
pop edi
xor ecx, esp
call fcn.00519168
add esp, 0x98
ret
Function at 0x4daa70
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x4daa84
mov dword [esp + 0x18], fcn.004d9250
jmp fcn.004d2f10
mov dword [esp + 0x18], fcn.004d84f0
jmp fcn.004d2c50
Function at 0x5145f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.00519970
mov eax, dword [0x5c6a7c]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
sub eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jae 0x514650
push 0x4d4
push 0x5adc44
push str.assertion_failed:_rec__orig_len___md_size
call fcn.00465510
add esp, 0xc
cmp ebx, 0x40
jbe 0x51466c
push 0x4d5
push 0x5adc44
push str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.00465510
add esp, 0xc
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x34]
neg eax
mov dword [esp + 0x20], ecx
and eax, 0x3f
lea edi, [esp + 0x34]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [esp + 0x2c], edi
cmp ecx, eax
jbe 0x51469a
mov ebp, ecx
sub ebp, ebx
sub ebp, 0x100
push ebx
xor esi, esi
mov dword [esp + 0x18], 0
push esi
push edi
call fcn.0051cb90
add esp, 0xc
mov dword [esp + 0x18], esi
cmp ebp, dword [esp + 0x20]
jae 0x51474d
mov eax, dword [esp + 0xc0]
mov ecx, ebp
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
mov edx, ecx
xor eax, dword [esp + 0x24]
xor edx, dword [esp + 0x10]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, ebp
xor eax, dword [esp + 0x10]
neg edi
or edx, eax
mov eax, dword [esp + 0x28]
xor edx, ebp
shr edx, 0x1f
neg edx
mov cl, byte [eax + ebp]
mov eax, edi
or eax, dword [esp + 0x14]
inc ebp
and eax, edx
mov edx, dword [esp + 0x18]
and edi, edx
mov dword [esp + 0x14], eax
and al, cl
or esi, edi
mov edi, dword [esp + 0x2c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
cmp ebp, dword [esp + 0x20]
jb 0x5146d5
xor edx, edx
test ebx, ebx
je 0x514781
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x514757
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00519168
add esp, 0xa8
ret
Function at 0x5152c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.00519970
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x28]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x34], 1
je 0x51530d
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x5152fd
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x515312
cmp edi, dword [esi + 8]
ja 0x5152f4
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
push ebp
push dword [ebx + 0xb0]
mov al, byte [ecx + eax - 1]
movzx ebp, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebp
call fcn.00452340
push eax
call fcn.0044e870
add esp, 8
test eax, 0x200000
je 0x515358
or eax, 0xffffffff
sub eax, ebp
add dword [esi + 8], eax
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 8]
lea ecx, [edi + ebp]
mov ebx, edx
mov dword [esp + 0x10], edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x5153e4
mov eax, dword [esi + 0x14]
mov esi, dword [esp + 0x20]
mov edx, esi
mov ebp, dword [esp + 0x10]
shr edx, 0x1f
dec ebp
mov dword [esp + 0x18], edx
add ebp, eax
nop
mov ecx, esi
lea ebp, [ebp - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x2c]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x18]
cmp edi, dword [esp + 0x14]
jb 0x5153a0
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
not ebx
movzx eax, bl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebp + 1]
neg ecx
and eax, ecx
sub edx, eax
mov eax, ecx
pop ebp
pop edi
mov dword [esi + 8], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x53426d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005340e3

Function at 0x53eef3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x553870
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 5
je 0x55388b
push eax
push esi
call fcn.00553eb0
add esp, 8
test eax, eax
jle 0x5538d3
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.0044e620
add esp, 8
test edi, edi
jg 0x5538d0
push edi
call fcn.00496980
add esp, 4
test eax, eax
je 0x5538d0
push 0xa
push esi
call fcn.0044ed80
add esp, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x7cfcba
Capabilities:
Hash data using murmur3

Disassembly:
pushfd
mov word [ebp + 4], dx
mov byte [esp + 4], 0xc
mov word [ebp + 6], ax
lea esp, [esp + 0x30]
jl 0x7cfe2b
pushal
pushfd
pop dword [esp + 0x1c]
mov byte [esp + 4], 0xe9
call fcn.007d1c21
rol si, cl
push esi
mov esi, dword [ebp]
cmc
add esp, 4
js 0x7d087d
add ebp, 4
pushal
pushal
push 0x9f4baca6
lea esp, [esp + 0x44]
jmp 0x7cf755
mov dword [esp], ebp
push eax
call fcn.007d0a51
mov ch, 0x9c
mov dx, word [ebp]
pushal
rol cx, cl
mov ax, word [ebp + 2]
push edx
mov cx, word [ebp + 4]
pushfd
jmp 0x7d0c95
push ebp
pushfd
call fcn.007d103e
push ebx
movsx cx, dl
movzx ecx, bl
movzx cx, cl
mov ecx, dword [ebp - 4]
push dword [esp]
mov byte [esp], bh
call fcn.007d04a0
call fcn.007d01eb
div cx
jmp 0x7cf3d7
stc
call fcn.007cf8c1
pushfd
pop ebp
mov dword [esp + 0x38], edi
lea ebp, [esp - 0x728711fc]
pushfd
pop dword [esp + 0x34]
mov bp, word [esp + 0x14]
bsr ebp, esi
pushfd
xchg dword [esp + 0x34], esi
inc bp
clc
mov dword [esp + 0x30], eax
dec si
bswap si
lea ebp, [esi - 0x2a552c8]
push dword [0x7cf8fe]
pop dword [esp + 0x2c]
rcl bp, cl
rol esi, cl
rcl bp, cl
adc si, cx
mov dword [esp + 0x28], 0
dec bp
mov bp, ax
mov esi, dword [esp + 0x58]
movzx bp, bl
add esi, 0x3889d5dd
bswap bp
clc
call fcn.007d02c4
test dx, di
sub ebp, 2
pushfd
jmp 0x7d0072

Function at 0x7d0a51
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x7d0444
pushal
xchg dword [esp + 0x20], ebp
pop ebp
mov dword [esp + 0x18], ebx
movzx bp, al
mov dword [esp + 0x14], ecx
bswap ebp
movsx bp, al
mov dword [esp + 0x10], edi
lea ebp, [0x401b980c]
pushfd
pop dword [esp + 0xc]
bsf bp, ax
clc
neg bp
mov dword [esp + 8], esi
bt bx, cx
and bp, 0x8baa
lea ebp, [ebx + 0x84e18cf]
pushfd
mov dword [esp + 8], eax
btc si, cx
sub ebp, edx
bswap bp
jmp 0x7d1d3e
mov dword [esp + 4], edx
jmp 0x7d00c7
push dword [0x7cf8fe]
pop dword [esp + 4]
shrd si, bp, cl
mov dword [esp], 0
shrd si, dx, cl
pushfd
xor esi, ebx
mov esi, dword [esp + 0x34]
cmp dh, 0x9a
jmp 0x7d1e12
add esi, 0x3889d5dd
pop ebp
stc
pushal
rol esi, 0xd
call fcn.007cfc5d

Function at 0x7d1c74
Capabilities:
Hash data using murmur3

Disassembly:
pushal
mov ecx, dword [ebp - 4]
mov byte [esp], 0x72
lea ebp, [ebp + ecx*4]
pushfd
call fcn.007cf2cc
pushfd
bt dx, 1
cmc
sub ebp, 0xc
test bh, al
pushal
cmp dword [ebp + 0xc], 1
push dword [esp]
pushfd
mov dword [ebp + 0xc], eax
mov byte [esp + 4], ch
lea esp, [esp + 0x2c]
jnp 0x7d1c3e
mov dword [ebp + 8], ebx
call fcn.007d029b
Function at 0x7d1cb4
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x7d21ac
mov dword [esp + 4], ecx
jmp 0x7cf93a
pop ebp
jmp 0x7cf500
pushfd
dec bp
push esi
mov si, 0x7ac1
movsx si, al
inc si
push eax
jmp 0x7d18c9
movsx bp, dl
lea ebp, [esp + 8]
pushal
lea esp, [esp + 0x28]
jmp 0x7d1a51
inc esi
pushal
lea ebp, [esp + 0x20]
pushal
mov word [esp + 8], 0xffa9
lea esp, [esp + 0x40]
jmp 0x7d1a51
push 0xcfa4ccb
movzx bp, bl
mov dword [esp], ebx
not bp
push ecx
pushfd
not ebp
mov dword [esp], edi
pushfd
pushfd
pop dword [esp]
sbb bp, 0x6609
cmp dx, 0xee41
rol bp, 0xf
bsr ebp, edi
push esi
sub bp, 0x5892
shld ebp, esi, 0x14
push eax
shl bp, cl
push dword [0x7cf8fe]
movsx esi, al
and si, dx
dec esi
movsx bp, dl
push 0
lea ebp, [esi + 0x29611aa9]
mov esi, dword [esp + 0x30]
cmp bx, 0x926a
add esi, 0x3889d5dd
bts bp, 6
rcl bp, cl
rol esi, 0xd
inc ebp
inc bp
js 0x7d0ce2
pushfd
inc esi
movsx ebp, al
lea ebp, [esp + 4]
push ebx
pushal
push dword [esp]
mov byte [esp], 0xc4
lea esp, [esp + 0x2c]
jmp 0x7d1a51
jmp 0x7d057c
cmc
not si
xor ebp, 0x5649b7f3
push dword [0x7cf8fe]
adc si, 0x1eeb
push 0
mov ebp, 0xac544049
shl bp, 0xf
rol esi, 7
mov esi, dword [esp + 0x30]
dec ebp
push 0x773ed26d
add esi, 0x3889d5dd
push ecx
mov bp, word [esp]
not bp
rol esi, 0xd
movzx bp, al
movzx bp, bl
pop ebp
inc esi
mov dword [esp], ebp
pushfd
jmp 0x7d039b
jmp 0x7d1e23
pushfd
xchg dword [esp + 0x48], ebp
lea esp, [esp + 0x48]
jle 0x7d08f1
pushfd
pushfd
push dword [esp]
mov dword [esp + 8], ebx
movsx bp, dl
mov bp, word [esp + 4]
jmp 0x7cf8d7
push edi
lea ebp, [edx*8 + 0x18ca3f5d]
movzx bp, cl
jmp 0x7d0201

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x23ea37f9
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5833717
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x41771c
Capabilities:
Encode data using xor

Disassembly:
push ds
mov dl, 0x36
sbb eax, 0xd3788da7
jle 0x417747
rcl dword [edi + 0x45]
pop edx
nop
xor esi, dword [ecx + 0x35]
in al, dx
lds ebx, [ebp + eax*2 - 0x4e]
inc ecx
sal ah, 1
inc esp
add byte [ebx - 3], ah
fisttp qword [edx]
sbb al, byte [0x1c740589]
nop
mov ebx, 0x412ef028
inc edi
in eax, dx
cmp al, 0x6c
je 0x41772b
invalid
inc esp
mov byte [0xcdb84474], al
test byte [ebx + 0x77031f5d], 0x3d
je 0x417799
mov eax, 0x5d83f6cd
pop ds
add esi, dword [edi + 0x3d]
mov esp, 0xc1767856
dec esi
clc
in eax, dx
wait
movsb byte es:[edi], byte [esi]
sbb ah, byte [eax + edx + 4]
jl 0x417753
push ds
test dword [edi], eax
mov dh, 0x8c
jg 0x4177f0
mov ebx, 0x569eae6c
ret
ret
or eax, 0x7d1d9307
ljmp 0x97e6
sahf
push 0xffffffffffffff9e
cwde
dec ebp
jp 0x4177dd
stosd dword es:[edi], eax
daa
dec edx
add ebx, dword [ecx + esi + 0xc]
mov bh, 0x3b
ja 0x417855
sbb al, 0x33
inc esi
jbe 0x417876
popal
invalid
jmp 0x417869
add eax, 0x2457c370
out dx, al
lea ebx, [edx - 0x5e6c00ff]
adc ebx, dword [esi]
mov eax, dword [0xfbe01e13]
push ds
loopne 0x417874
mov ch, 0xc3
or byte [ebx], bl
arpl word [esi], sp
les ebp, [ebp - 0xde7c1a2]
mov al, byte [0x58a67622]
dec eax
lea esi, [edi + eax*8 + 0x76]
sub al, 0xc7
xchg esp, eax
xchg edi, eax
into
bound edx, qword [esi + edi*2]
fdivr st(2)
mov eax, dword [0xf1e7492e]
fnstenv [edx + 0x11]
mov dh, 0xe8
mov ebx, 0xac7ebf11
invalid

Function at 0x44da2c
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44da78
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44da5d
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44da6d
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44da88
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44dac7
test ebx, ebx
je 0x44da9c
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44da91
cmp ecx, 0xfff1
jb 0x44daaa
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44dbb2
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44daec
Function at 0x4643ec
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x1b
ret
pop esi
in eax, dx
dec ebx
fistp dword [bx]
std
xchg esi, eax
rol byte [edx], 1
sub ah, 0x14
or ch, ch
cmc
mov eax, dword [0xf34f0baa]
dec ebp
xchg ebx, eax
sbb byte es:[edx - 0x2d05a1ad], ah
daa
je 0x464460
in eax, dx
sub bh, bh
lock xor esi, dword [esi + 0x5137f5f3]
xor esi, dword [esi + 0x5137f5f3]
jae 0x4643cd
and cl, byte [bp + di]
cli
nop
sub eax, 0x76eb8221
cmp al, 0x26
loopne 0x464411
push edx
in eax, 0xa5
sub ch, byte [ebx - 0x224f8981]
pop esi
dec esi
invalid
call 0x536768db
int1
and dword [ebx - 0xf], edx
cmp byte [ebp + 0x2d58d877], 0xb9
cmpsd dword [esi], dword es:[edi]
inc edx
sub al, 0x12
enter 0xffffffffffff887d, 0xffffffffffffff82
dec ebx
salc
pop ecx
mov edx, 0xb02bfa6f
je 0x464489
mov byte [edx - 0x45a629b5], al
outsd dx, dword [esi]
cli
sub esi, dword [eax - 0x6db2e28c]
dec ebp
xchg edx, eax
pop ds
leave
fild word [edx + 0x1e]
lahf
pop edx
jge 0x46440d
jb 0x464496
les ebx, [edx + ebx*4]
into
dec ebx
loop 0x46444d
int1
mov edi, 0xb90e031e
xor esi, dword [edx + 0x102f0a3f]
sar al, 0x5b
or ch, byte [edi]
adc al, al
clc
pop ebx
cmp dl, byte [ebx]
retf 0x1079
inc ebx
mov al, byte [0xc703eb99]
xchg byte [esi - 0x76b65e74], bh
sbb edi, dword [ebx + 0x678b0655]
mov dl, 0xed
and al, 0x5c
add ah, dh
les ecx, [esi - 0x6be0582e]
bound ecx, qword [ebx - 0x7a]
jbe 0x464450
cmp edi, esi
and eax, dword [esi - 0x15]
mov ch, 0x73
push ebx
cdq
cmp al, byte [edi - 0x3e]
scasb al, byte es:[edi]
mov dword [0x58929fd3], eax
popfd
aam 0x5f
mov esi, 0xaade5f64
insd dword es:[edi], dx
in eax, 0xe0
insb byte es:[edi], dx
invalid

Function at 0x49821c
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x498268
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x49824d
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x49825d
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x498278
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4982b7
test ebx, ebx
je 0x49828c
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x498281
cmp ecx, 0xfff1
jb 0x49829a
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4983a2
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4982dc
Function at 0x4e2a7c
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e2ac8
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e2aad
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e2abd
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e2ad8
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e2b17
test ebx, ebx
je 0x4e2aec
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e2ae1
cmp ecx, 0xfff1
jb 0x4e2afa
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e2c02
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e2b3c