joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ad60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x2b2a2d1c
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43adbe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x73f18862
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xb2
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43ad90
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
mov edi, dword [eax + 0x18]
mov ebx, dword [0x452bac]
jmp dword [0x448ae4]

Function at 0x43ae00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x448b04]

Function at 0x43b0c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 4]
test edx, edx
je 0x43b1b0
xor eax, eax
cmp dword [ecx], 0
jne 0x43b207
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x14131211
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43b179
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
lea esi, [eax + edx]
add eax, 0x21
and eax, edx
add eax, eax
sub esi, eax
add esi, 0x889ee021
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x2c]
add al, 0xcf
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43b140
mov eax, dword [esp + 0xc]
mov esi, dword [0x44ab8c]
test esi, esi
je 0x43b207
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x44ab90]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43b210
inc edi
cmp esi, edi
jne 0x43b1a0
jmp 0x43b207
mov dword [esp + 0x14], 0xff30313a
mov word [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x43b203
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0xbea98a85
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x49
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x43b1d0
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b207
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44ab94]
push esi
call fcn.0043cc20
add esp, 0x1c
jmp 0x43b207

Function at 0x43cb60
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x448c94]
Function at 0xd9bdb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x655000]
push edi
or ebp, 0xffffffff
jmp 0xd9bdd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xd9bdd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd9bdc8
mov eax, 1
add ebx, ebx
jne 0xd9bdeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xd9bdfc
jne 0xd9be1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd9be1b
dec eax
add ebx, ebx
jne 0xd9be08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xd9bde0
add ebx, ebx
jne 0xd9be17
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xd9be6d
xor ecx, ecx
sub eax, 3
jb 0xd9be33
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xd9bea2
sar eax, 1
mov ebp, eax
jmp 0xd9be3e
add ebx, ebx
jne 0xd9be3e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd9be0c
inc ecx
add ebx, ebx
jne 0xd9be4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd9be0c
add ebx, ebx
jne 0xd9be59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xd9be4e
jne 0xd9be6a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xd9be4e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xd9be8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xd9be7e
jmp 0xd9bdce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xd9be8c
add edi, ecx
jmp 0xd9bdce
pop esi
mov edi, esi
mov ecx, 0x37c15a
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xd9bec7
cmp byte [edi], 0x87
jne 0xd9beac
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xd9beaa
lea edi, [esi + 0x992000]
Function at 0x4109a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, ebx
stc
nop
pushal
stc
nop
jb 0x40dea3
add byte [ebp + 0x38003423], dl
jmp 0xbf416bbd

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x1001ab20
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001ab5f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001ab5f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001ab5f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001ab5f
cmp dword [ecx + 0x74], 0xe
jbe 0x1001ab5f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001d81d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001d8ba
push ebx
push esi
call fcn.1001d7e6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001d77a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001d867
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d8b9
push edi
push eax
call fcn.1001b85d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001d887
call fcn.1001c2c2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d8b8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001d77a
add esp, 0x20
test eax, eax
jne 0x1001d8a6
push edi
call fcn.1001c2c2
jmp 0x1001d8ae
push ebx
call fcn.1001c2c2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001db27
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025d10
push 0x10025d08
push str.FlsAlloc
push 0x1f
call fcn.1001da43
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001db5b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002414c]
call esi
jmp 0x1001db61
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001dba5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025d20
push 0x10025d18
push str.FlsGetValue
push 0x21
call fcn.1001da43
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001dbdc
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002414c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001dbe4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025d28
push 0x10025d20
push str.FlsSetValue
push 0x22
call fcn.1001da43
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001dc1e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002414c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100231c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100231ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100231ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x417610
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417636
mov eax, dword [0x4baa90]
test eax, eax
je 0x41762c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
invalid
mov eax, 1
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and al, 0xc
Function at 0x424e3c
Capabilities:
Encode data using xor

Disassembly:
invalid
cmc
imul edx, ebx, 0x9984ecee
cmp al, 0x19
std
push ebx
mov edi, dword [ecx]
mov ds, edi
push ss
sahf
nop
sbb ch, byte [0x680e8336]
jp 0x424dc3
stc
sbb esi, dword [ebx + 0x59]
mov edi, 0xb8d27f24
cdq
insb byte es:[edi], dx
imul esp, dword [edx + ecx*4 + 0x3da1eef7], 0x36a750a2
sub esp, dword [eax + 0x35]
adc al, 0x40
sbb byte [edi + 9], cl
popal
xor ecx, dword [eax - 0x1aefc409]
adc ch, ah
aas
nop
xor ch, byte [ebx - 0x38]
jno 0x424d57
in eax, 0xa8
jg 0x424db5
push ebp
test al, 0xdd
invalid
jbe 0x424e2b
xor dl, 1
pop edi
mov edx, 0xd1aded38
mov ebx, 0x562d3694
xchg edi, eax
mov edx, 0x4ae154b6
sub eax, 0xb6ba9756
push esp
loope 0x424e2b
dec ebx
lodsb al, byte [esi]
pop ds
jae 0x424d78
iretd
inc byte [eax - 0x464fc017]
fcomp dword [ebx - 0x68]
cwde
pop edi
dec ebx
jle 0x424e46
cli
sti
and al, 0xe1
loope 0x424dcb
invalid
xchg ecx, eax
inc ecx
jb 0x424dd9
loope 0x424dcb
cmp edx, dword [ecx + 0x1c967241]
pop esi
sbb al, 0x5e
loop 0x424e49
add cl, byte [ebx + 0x1f531f84]
mov eax, dword [edi + ebx - 0x79f3e0ad]
pop ds
push ebx
pop ds
or al, 0x86
scasd eax, dword es:[edi]
stosb byte es:[di], al
xor eax, 0x212e27ee
wait
fsubr qword [eax + 0x1e8a945f]
inc eax
and al, 0xfb
dec ebp
invalid
Function at 0x4537ac
Capabilities:
Encode data using xor

Disassembly:
push ds
in al, dx
out dx, eax
cmp ebx, dword [ebx - 0x26]
mov ebp, 0x475bb548
imul esi, edx, 0xa078cd38
aad 0x55
mov ecx, 0x4a4f7206
sub al, 0x40
push eax
in eax, 0xe1
mov ebp, dword [edi]
popfd
nop
jg 0x453794
in al, 0x51
fstp qword [ebp + 0x32]
adc dword [eax - 0x14], eax
pop es
jg 0x453744
or eax, 0xbf9e8c7e
pop eax
aam 0x48
jb 0x45377e
jb 0x4537af
iretd
cmpsb byte [esi], byte es:[edi]
inc edx
cmp bl, ch
shr dword [edx - 0x6c], cl
mov edx, 0x8b4da2ec
mov byte [ebx + 0x3ae5fbc9], cl
sti
in eax, 0x3a
lds ebp, [esi + 2]
fldenv [0xac2df2b2]
inc eax
out 0x61, eax
call 0xa589e026
pop ebx
inc ebp
pop ebx
cld
insd dword es:[edi], dx
sbb dh, bl
pop ecx
adc al, bl
bnd jecxz 0x453729
stosd dword es:[edi], eax
fadd dword [ebx + 0x52c5443a]
cmp ah, dh
mov byte [0x28c64579], al
sub ah, ch
jno 0x4537bc
or al, 0xb3
sub cl, byte ss:[ebx]
mov bl, 0x36
sub cl, byte [ebx]
sub al, 0x19
mov dword [0x3814c42a], eax
inc ecx
mov ebp, 0x2ffc4bdd
xchg dword [edx - 0x3b], ebx
jecxz 0x453802
ljmp 0x8f5c:0xa00f2b90
mov dword [ebp + 0x4c9b344b], esi
shr ah, cl
lodsb al, byte [esi]
pop es
sub ch, byte [0x457a11da]
or al, 0x9d
inc ebp
cmp cl, byte es:[edx + ebx*4 + 0x77]
cmp cl, byte [edx + ebx*4 + 0x77]
mov ah, 0xca
dec ecx
stc
or bh, bh
inc ebx
xor eax, 0x80d1285b
sbb ch, byte [ecx]
mov edi, 0x3873c5ad
movsb byte es:[edi], byte [esi]
xchg byte [edx - 0x7f], ah
sbb byte [ecx + 0x6a664e4b], ah
jle 0x4537ee
fnsave dword [esi]
invalid
Function at 0x4696a4
Capabilities:
Encode data using xor

Disassembly:
ljmp 0xaea1:0xef179628
xor al, 0x7b
clc
in al, 0x9c
and dl, byte [eax + 0x6de55e11]
jno 0x4696b2
sub al, 3
jo 0x4696ab
cmp byte [edx - 0x6f], ch
bound edx, qword [esi + 0x61f7fbc]
mov ah, 0x6a
jp 0x4696ef
in al, dx
pop edx
jno 0x46969f
ja 0x469707
sahf
pop dword [ecx + 0x21f86dc]
fisub dword [edx]
and dword [ecx + 0x7194b1f2], esp
je 0x46965e
jno 0x469728
test eax, 0xc3b66ea6
cmpsb byte [esi], byte es:[edi]
outsb dx, byte [esi]
mov dh, 0xc3
and eax, ebp
aas
cmp ebx, dword [edx - 0x54]
push edx
insd dword es:[edi], dx
pop es
push esp
jno 0x469736
xlatb
jg 0x4696a2
jo 0x469680
fld xword [ebx - 0x757cd093]
lahf
xchg esp, eax
adc ah, byte [ecx - 0x2d]
sti
pop esp
sub byte [ecx], al
pop edi
inc edx
fisub word [eax + ecx*2 + 0x5e]
adc ah, byte [ebp - 0x3b]
adc dword [0x90961e53], 0xffffff9c
into
wait
lea edx, [esi]
and byte [edx - 0x3aae3a6e], bh
enter 0xffffffffffffc1f9, 0xffffffffffffffb7
adc dword [0xd91fbb9f], esi
salc
retf
sub ch, byte [ecx + ecx*8 + 0x176e3af1]
sbb ebx, ecx
xor ch, byte [ebx - 0x7e]
ficomp word [ebx]
nop
cmpsb byte [esi], byte es:[edi]
std
fbld tbyte [edx + eax*8 - 0x4ffa6ea4]
loope 0x469789
sub ch, byte [0xb13f5ea9]
neg dword [edx - 0x2f]
pop esp
invalid
aas
mov cl, ch
jb 0x46972b
and esp, esp
ret 0xa91a
mov eax, dword [0xda049e07]
test dword [0x6aec08d1], esi
cmpsb byte [esi], byte es:[edi]
cld
in al, 0xde
push ebx
and esp, edx
jb 0x469784
fsub st(7)
sub ch, ch
push esp
bound esp, qword [eax + 0xf]
or bh, byte [esi + edi*2 + 0x75686ad5]
add bh, byte [esi - 0x790d5917]
xor esi, esp
lahf
imul edx, dword [ebx - 0x75], 0xe3297fbc
xchg edi, eax
pop ds
xor dword [ebp + 0x18], esi
jl 0x4697bf
invalid
aaa
aad 0x13
inc ebx
xchg ecx, eax
salc
lodsb al, byte [esi]
jo 0x4697f0
mov ah, pe_nt_image_headers32
iretd
insd dword es:[edi], dx
push ss
cmp bl, byte [eax]
mov cl, 0x7d
invalid
sbb byte [esi], dl
cmp bh, byte [ebp + edi*8 + 0x18]
sub bl, byte [ecx + 4]
pop ecx
sub bh, byte [eax + 0x72]
mov ah, 0xda
mov bl, 0x93
sub dword [eax + 0x2e1131f7], ebp
daa
sub ch, byte [ebp - 0x35286ffa]
mov ch, 0xb6
lodsb al, byte [esi]
mov bl, ch
inc edi
wait
mov dword [ecx + 0xf], ebp
inc edi
jno 0x46977e
jle 0x4697b1
sti
movsb byte es:[edi], byte [esi]
mov ecx, 0x3df0e7c7
test al, 0x6b
out 0x80, eax
adc eax, dword [ebx - 0x75]
sbb byte [ecx + 0x12], al
sbb al, 0x8c
sub dword [edx - 0x52], 9
invalid
in al, 0xde
mul byte [ebp + 0x50]
out 0xd8, eax
std
push 0xffffffffffffffcd
xor eax, 0xd97887f3
out dx, al
add al, 0x47
sub dword [edx + 0xf23cfb7], 0x53
call 0xf8689f16
salc
push ds
cmp dword [esi + 0x7a], 2
xchg ecx, eax
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
sal byte [ecx - 0x41], 0xba
jne 0x469804
aam 0xdb
stosb byte es:[edi], al
or al, 0xaa
invalid
Function at 0x495bc5
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
or bl, cl
jno 0x495ac4
mov eax, dword [0x581e6d70]
invalid
jb 0x495af4
cli
mov al, 0x99
jns 0x495bd5
invalid
salc
cmpsd dword [esi], dword es:[edi]
mov dword [edi - 0x740bc23f], ebx
sbb byte [eax - 0x76e1740f], ah
mov byte [0x6aaa1467], al
scasd eax, dword es:[edi]
invalid
pop ebx
lodsd eax, dword [esi]
adc esi, dword [edi + esi*8 + 0x4c89f384]
mov edx, 0xd14215ce
outsd dx, dword [esi]
aaa
inc esp
int 0x2d
jmp 0x495b6b
loope 0x495beb
xor ecx, 0x38f252a9
fst dword [edx - 0x3dec4c33]
and al, 0x9d
popfd
lodsd eax, dword [esi]
dec eax
in eax, dx
shl byte [eax - 0x27fb313f], 1
int 0x29
inc eax
daa
int 0x74
xlatb
pop edx
les eax, [ecx]
push es
jl 0x495b8f
mov dword [0x6b13edd9], eax
cmc
fldln2
adc ebp, dword [ebx - 0xb]
lodsd eax, dword [esi]
ja 0x495c46
bound edx, qword [edi]
js 0x495be6
and ecx, dword [ebx - 0x26]
mov ch, 0xb5
dec eax
fimul dword [eax + 0x39a0c43d]
retf 0x21c0
jle 0x495cb9
cmp cl, byte [ecx + 0x5efeb31d]
cmp dl, al
out dx, al
cwde
xor dword [esi + ebp*4 - 0x4a], ebx
pop esp
bound ebx, qword [ebx]
pop ecx
sbb word [ebx - 0x1d], bp
fdivr qword [edi - 0x64]
dec ebx
xor al, 0x9b
xchg ebp, eax
in eax, dx
fcom dword [ebx + 0xd]
loop 0x495c50
jbe 0x495ca6
lea esp, [ebp + 0x50]
invalid
invalid
Function at 0x4a9b6c
Capabilities:
Encode data using xor

Disassembly:
inc ecx
or dword [edx - 0x73], 0x6cb7a34e
mov byte [0x4b83c674], al
cmp dh, byte [ebx]
arpl bx, cx
invalid
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x4fd166cd
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x4c5750d2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x12f116f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x12f121c
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0x12f11c3
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0x12f120b
mov esi, dword [ebp - 4]
jns 0x12f11ea
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x12f11fa
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0x12f11cc
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0x12f11a3
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x12f1235
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov ebx, dword [eax + 0xc]
mov edi, dword [eax + 8]
add ebx, ecx
add ebx, dword [ebp + 8]
cmp dword [eax + 0x10], edi
cmovb edi, dword [eax + 0x10]
sub edi, dword [ebp + 8]
cmp edi, 1
jbe 0x12f1284
lea eax, [ebp + 8]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [0x12f1024]
mov edx, edi
mov ecx, ebx
call fcn.012f1048
pop ecx
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ebp
ret
Function at 0x12f1288
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
xor edx, edx
mov ecx, edi
mov ebx, dword [edi + 0x3c]
add ebx, edi
mov dword [ebp - 4], ebx
movzx esi, word [ebx + 0x14]
add esi, 0x18
add esi, ebx
sub eax, dword [0x12f101c]
mov dword [ebp - 0x10], eax
sbb edx, edx
mov dword [ebp - 0x14], esi
neg eax
mov dword [ebp - 0xc], edx
adc edx, 0
neg edx
push edx
mov edx, dword [ebx + 0xa0]
push eax
mov eax, dword [esi + 0xc]
add eax, dword [0x12f1028]
push eax
push dword [ebx + 0xa4]
call fcn.012f10ab
push esi
push dword [0x12f1028]
mov ecx, edi
call fcn.012f1235
mov eax, dword [0x12f1020]
add esp, 0x18
add esi, 0x28
cmp eax, 1
jbe 0x12f131b
push esi
push dword [0x12f102c]
mov ecx, edi
call fcn.012f1235
mov eax, dword [0x12f1020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 2
jbe 0x12f1338
push esi
push dword [0x12f1030]
mov ecx, edi
call fcn.012f1235
mov eax, dword [0x12f1020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 3
jbe 0x12f1355
push esi
push dword [0x12f1034]
mov ecx, edi
call fcn.012f1235
mov eax, dword [0x12f1020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 4
jbe 0x12f1372
push esi
push dword [0x12f1038]
mov ecx, edi
call fcn.012f1235
mov eax, dword [0x12f1020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 5
jbe 0x12f138f
push esi
push dword [0x12f103c]
mov ecx, edi
call fcn.012f1235
mov eax, dword [0x12f1020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 6
jbe 0x12f13ac
push esi
push dword [0x12f1040]
mov ecx, edi
call fcn.012f1235
mov eax, dword [0x12f1020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 7
jbe 0x12f13c1
push esi
push dword [0x12f1044]
mov ecx, edi
call fcn.012f1235
pop ecx
pop ecx
cmp dword [0x12f1014], 0
je 0x12f140a
add ebx, 0x88
cmp dword [ebx], 0
je 0x12f1407
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 4
push 8
push ebx
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [0x12f1014]
mov dword [ebx], eax
mov eax, dword [0x12f1018]
mov dword [ecx + 0x8c], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 8
push ebx
call esi
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, edi
push dword [ebp - 0xc]
mov edx, dword [ebx + 0xa0]
push dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [0x12f1028]
push eax
push dword [ebx + 0xa4]
call fcn.012f10ab
mov edx, dword [0x12f1004]
add esp, 0x10
push dword [0x12f1010]
push dword [0x12f100c]
push ecx
mov ecx, edi
call fcn.012f116f
mov eax, dword [section..text]
add esp, 0xc
add eax, edi
call eax
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]