joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002032f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100203cc
push ebx
push esi
call fcn.100202f8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001f18d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10020379
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100203cb
push edi
push eax
call fcn.1001a7fb
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10020399
call fcn.1001a572
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100203ca
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001f18d
add esp, 0x20
test eax, eax
jne 0x100203b8
push edi
call fcn.1001a572
jmp 0x100203c0
push ebx
call fcn.1001a572
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100203cf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100203e0
pop esi
ret
push ebx
push edi
push esi
call fcn.100202f8
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1001a7fb
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10020408
push ebx
push esi
push edi
call fcn.1000cd20
add esp, 0xc
push 0
call fcn.1001a572
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100207d8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002041d

Function at 0x10022ced
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100170b7
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10022d5c
cmp esi, dword [ebp - 4]
je 0x10022d57
cmp dword [ebp + 0xc], 0
je 0x10022d57
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10022d34
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1002283f
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10022d5e
xor eax, eax
inc eax
jmp 0x10022d5e
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10022dc3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003a024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100170b7
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100170b7
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10022e3a
cmp word [ecx], dx
je 0x10022e3a
mov eax, dword [0x1002f5f4]
push edi
dec eax
push eax
push 0x1002f4e0
call fcn.10022d62
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10022ead
cmp word [eax], dx
je 0x10022ead
mov eax, dword [edi]
test eax, eax
je 0x10022e5e
cmp word [eax], dx
je 0x10022e5e
lea eax, [ebp - 0x10]
push eax
call fcn.10022745
jmp 0x10022e67
lea eax, [ebp - 0x10]
push eax
call fcn.100227e0
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10022ed7
mov eax, dword [0x1002f4dc]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1002f1d0
call fcn.10022d62
add esp, 0xc
test al, al
je 0x10022ed7
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10022ea2
cmp word [eax], di
je 0x10022ea2
lea eax, [ebp - 0x10]
push eax
call fcn.10022745
pop ecx
jmp 0x10022ed9
lea eax, [ebp - 0x10]
push eax
call fcn.100227e0
jmp 0x10022e9f
mov eax, dword [edi]
test eax, eax
je 0x10022ec4
cmp word [eax], dx
je 0x10022ec4
lea eax, [ebp - 0x10]
push eax
call fcn.100226fa
pop ecx
jmp 0x10022ed7
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10022fa2
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10022be7
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10022fa2
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10022fa2
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10022fa2
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10022f2f
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1001c009
test ebx, ebx
je 0x10022f9d
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1001c009
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10022fa2
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10022fa2
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10025f37
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10022fa4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000b724
leave
ret
Function at 0x10027c50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10027c7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10027c7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405c90
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x405cce
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x405cc6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x405cd0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x405cb6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x405da0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x405dd1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x405dd1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x405dd1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10008dd0
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions
Execute shellcode via indirect call
Hide graphical window
Parse credit card information
Parse pe header
Resume thread

Disassembly:
jmp 0x10012c21
push ebp
shr eax, cl
mov ebp, esp
xor al, ah
push ebx
sar al, 0xa3
push edi
shl ah, cl
and al, 0x32
adc eax, edi
push esi
bsr ax, dx
movzx eax, cx
lea esp, [esp - 0x1b4]
test ax, si
cmp si, cx
shl ah, cl
mov eax, dword [0x1007b400]
stc
xor eax, ebp
test dx, 0xee9b
mov dword [ebp - 0x10], eax
stc
sbb ah, ch
mov dword [ebp - 0x1b8], 0x64541d6c
sub eax, 0x50a0538a
rcl ax, 0x27

Function at 0x10019290
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100192cf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100192cf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100192cf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100192cf
cmp dword [ecx + 0x74], 0xe
jbe 0x100192cf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001bf8d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001c02a
push ebx
push esi
call fcn.1001bf56
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001beea
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001bfd7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001c029
push edi
push eax
call fcn.10019fcd
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001bff7
call fcn.1001aa32
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001c028
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001beea
add esp, 0x20
test eax, eax
jne 0x1001c016
push edi
call fcn.1001aa32
jmp 0x1001c01e
push ebx
call fcn.1001aa32
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001c297
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023d10
push 0x10023d08
push str.FlsAlloc
push 0x1f
call fcn.1001c1b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c2cb
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002214c]
call esi
jmp 0x1001c2d1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001c315
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023d20
push 0x10023d18
push str.FlsGetValue
push 0x21
call fcn.1001c1b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c34c
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002214c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001c354
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023d28
push 0x10023d20
push str.FlsSetValue
push 0x22
call fcn.1001c1b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c38e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002214c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10021930
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002195d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002195d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0xec7928
Capabilities:
Encode data using xor

Disassembly:
jmp 0xec7932
pushal
call 0xec7938
pop ebp
sub ebp, 0x10
sub ebp, 0xac7928
jmp 0xec794e
mov eax, 0xac7928
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b7
mov edx, 0xd4e9348d
xor byte [eax], dl
inc eax
dec ecx
jne 0xec7965
jmp 0xec7978
push es
inc eax
push es
add al, 0xb1
lea ecx, [ebp + 0x754c0c8d]
lea ecx, [ebp + 0x35408e8d]
mov byte [ebp - 0x5ac87273], cl
lea ecx, [ebp - 0x71908573]
inc ebp
push es
or al, 0x81
lea ecx, [ebp + 0x488e8d]
jmp 0x89f0eb4d
Function at 0x4068db
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068ff
xor eax, eax
test eax, eax
je 0x406912
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406912
xor ecx, ecx
jmp 0x406915
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a38
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a6f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a49
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a44
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406aa0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406a82
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x53266ded
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0xb8b3fc1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x43b200
Capabilities:
Encode data using xor

Disassembly:
ret

Function at 0x43b410
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x9dce0be3
imul ebp, dword [edx + eax*2], 0xa7c331e1
xor ebx, eax
cmpsd dword [esi], dword es:[edi]
test edi, eax
test dword [eax + 0x2f], eax
add ebx, dword [0x264fe214]
jg 0x43b480
js 0x43b419
or bh, bh
sbb dword [ebx], ecx
and eax, 0xe182c2db
add ebx, eax
daa
aam 0x6e
jbe 0x43b454
daa
insb byte es:[edi], dx
xchg edi, eax
int 0x83
std
loope 0x43b3f8
mov edx, 0xf930c1c
sbb eax, 0x202ab778
cli
or eax, 0xdf9646af
push cs
in eax, dx
dec eax
sar al, cl
test dword [eax], ebp
jg 0x43b4c5
imul edx, dword [ebp + 0x1b454493], 0xdcf9c35c
xchg byte [eax], dl
mov byte [edx - 0x6c], 0x3c
loope 0x43b4a0
xchg ebp, eax
xchg ebx, eax
inc esp
inc ebp
pop ss
aam 0xaa
jmp 0x4e373cd3
leave
hlt
imul edx, dword [ebx - 0x69], 0x25
mov ebx, ss
lcall 0xde46, 0xa5e1c703
shr dword [esi + 0x3b89ee3b], cl
out dx, al
pop edx
test dword [esi], edx
jg 0x43b4a4
fisub word [eax]
dec esi
jno 0x43b45b
and byte [esi + 0x71], cl
xchg ecx, eax
fsub qword [eax]
arpl word [edi - 0x47], bp
sub byte [eax], ch
lcall 0x2083, 0xfc4007d8
add bh, byte [0x8dad32f3]
out 0xd1, al
add ebx, dword [edi + ecx*2]
lds eax, [edi + 0x68]
cmpsb byte [esi], byte es:[edi]
dec eax
mov bh, 0x9b
lds esi, [esi + 0x250f9985]
fcmovb st(0), st(7)
jo 0x43b4ad
mov cl, 0xa4
out dx, al
mov bl, 0xc3
adc bl, byte [esi + 0x16acba1a]
Function at 0x4082b0
Capabilities:
Encode data using xor

Disassembly:
rcr byte [ecx - 0x44], cl
test dword [ecx - 0x3d99e45b], ebx
add dword [esi - 0x21], ebx
xor cl, ch
pushal
push 0x6b
dec edx
pop ss
xlatb
push ebx
xchg byte [edi + 0x7a], dl
sub byte [eax], cl
std
xor edx, edx
and dword [edi + edi*2], ebp
rol bl, 1
sub eax, 0xbc522714
enter 0x4fcc, 0x7c
lodsb al, byte [esi]
jmp 0x4082f8
mov eax, 0xcf880a81
outsb dx, byte [esi]
jecxz 0x408252
cdq
add al, 0x25
pop esp
sar dword [edi + eax*2 - 0x11c39716], cl
adc dword [edi], edi
invalid
mov ch, 0x42
inc esp
push ebp
call 0xf8dc5dc8
xchg ebx, eax
sub byte [ebx], dh
mov esp, dword [ebx + ebx*4]
sub byte [edx + 0xf], ah
adc dword [edi - 0xcd6be81], 0xffffff9a
loop 0x40838c
inc ecx
sub ebx, esi
lcall 0x9361, 0xc1d979e2
fld st(1)
popal
xchg ebx, eax
aad 0xc6
xchg edi, eax
inc eax
les edi, [ebp - 0x65a974dc]
add dword [eax + 0x5b], 0x6595b4db
cmp eax, 0x4954e904
push esp
dec ecx
fistp word [ebx + edi + 0x2c798692]
dec ebx
inc esp
mov eax, dword [0x42578d69]
jns 0x40830d
push ds
mov edi, 0xd57606a7
mov edi, 0x2dedc535
and esi, esp
enter 0x1459, 0x72
aad 0x6b
xchg ecx, eax
push eax
mov edi, 0xd9ed235d
dec ebp
movsb byte es:[edi], byte [esi]
imul ebp, dword [ebx - 0x101d19a8], 0x3a93f7e
arpl word [edi + 0x67], sp
xchg ebp, eax
sahf
inc ebp
jecxz 0x40832c
pop ds
fadd dword [esi + eax*8]
xor eax, 0xf15b24b7
shl ah, cl
pop edi
shr bl, 1
pop eax
xchg edx, eax
ja 0x4083bc
sub eax, 0xf837fd62
mov eax, ebx
inc ecx
pop edx
sbb byte [eax], cl
in al, 0xfb
imul ecx, dword [edx + 0x76535a9], 0xf
mov ch, byte [ecx + 0xf076535]
mov byte [0xe66e4596], al
dec ebp
add dword [edx + ecx], edi
sal ebx, cl
xchg dword [esi - 0x2a42ee44], esp
aas
sub eax, dword [ecx - 0x3c]
or dword [ebx], ecx
cdq
or eax, eax
mov byte [0xab3420f4], al
iretd
adc byte [esi + edi*2], dh
js 0x4083f5
das
push esi
sbb eax, 0x5c4a0791
loopne 0x40836c
aas
dec ebp
fadd st(0), st(0)
sar bh, 1
jmp 0x4083a7
inc esp
push edi
xlatb
push cs
dec edi
push edi
mov edi, 0x491f9f08
xchg ecx, eax
inc ebx
xor byte [ecx - 0x1a], bh
sub dword [ebp - 0x62b28003], ecx
cli
cmpsb byte [esi], byte es:[edi]
inc ebp
xchg ecx, eax
in al, dx
and al, 0x2a
invalid
Function at 0x45c0d0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x45c0fe
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45c11c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0045c03a
jmp 0x45c11c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x45c11c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0045c03a
test edi, edi
mov eax, edi
jne 0x45c106
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x49453c]
test ecx, ecx
je 0x45c1cf
jmp 0x45c0cf
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219