joyce8/EMBER2024-capa huggingface dataset:
Function at 0x200316e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ecx], al
add byte [eax], al
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.02002484
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.02002439
add esp, 0xc
mov dword [ebp - 0x690], eax
inc esi
test dword [eax - 7], esp
invalid
dec dword [ebx - 0x69e7280]
invalid
invalid
inc esi
test dword [edx - 7], esp
invalid
call dword [ebp - 0x3a]
test dword [ebx - 7], esp
invalid
dec dword [ebx - 0x69b7a3a]
invalid
invalid
in al, dx
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.02002474
pushal
lodsb al, byte [esi]
pop edi
cmp edi, edi
mov ch, 0x68
stc
invalid

Function at 0x200333a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.02002452
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12

Function at 0x20033c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
Function at 0x20033e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.02002484
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.02002439
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.02002474
add byte [ebp - 0x79], bl
in al, 0x68
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.02002474
adc al, 0xde
scasd eax, dword es:[edi]
inc eax
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.02002484
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.02002439
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x2003520
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
invalid
invalid

Function at 0x2005569
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x2005587
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x2005587
xor eax, eax
jmp 0x200558a
xor eax, eax
inc eax
ret 4
Function at 0x20055b6
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
je 0x2005600
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x2005600
push 0xd
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, esi
mov dword [ebp - 4], eax
jbe 0x20055fa
push eax
call fcn.02006322
mov ebx, eax
cmp ebx, esi
pop ecx
jne 0x2005609
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
push ebx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x2005653
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push 0x2002190
push ebx
mov dword [ebp + 8], esi
mov dword [ebp - 0xc], esi
call sub.VERSION.dll_VerQueryValueA
cmp eax, esi
mov dword [ebp - 8], eax
je 0x2005653
cmp dword [ebp + 8], esi
je 0x2005653
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 1
jmp 0x2005659
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call fcn.02006278
mov eax, dword [ebp - 8]
pop ecx
jmp 0x2005602
Function at 0x2005fcf
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push esi
jne 0x20060a4
mov eax, 0x94
call fcn.02006cd0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x200606d
mov ecx, dword [esi + 0x10]
mov dword [0x200a20c], ecx
mov eax, dword [esi + 4]
mov dword [0x200a218], eax
mov edx, dword [esi + 8]
mov dword [0x200a21c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x200a210], esi
je 0x2006034
or esi, 0x8000
mov dword [0x200a210], esi
shl eax, 8
add eax, edx
push 0
mov dword [0x200a214], eax
call fcn.02006acd
test eax, eax
pop ecx
je 0x200606d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x200a734], eax
call fcn.02006b9d
mov dword [0x200a1f0], eax
call fcn.020065f7
test eax, eax
jge 0x2006071
call fcn.02006b1e
xor eax, eax
jmp 0x2006095
call fcn.02006a11
test eax, eax
jl 0x200609d
call fcn.020067c5
test eax, eax
jl 0x200609d
call fcn.020064c8
test eax, eax
jne 0x200609d
inc dword [0x200a1ec]
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
call fcn.020067a2
jmp 0x2006068
xor eax, eax
cmp dword [ebp + 0xc], eax
jne 0x2006092
cmp dword [0x200a1ec], eax
jle 0x200606d
dec dword [0x200a1ec]
cmp dword [0x200a248], eax
jne 0x20060c6
call fcn.020065e8
call fcn.020067a2
call fcn.02006b1e
jmp 0x2006092

Function at 0x2007769
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.02006cd0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x20077fe
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x200a20c]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x20077fe
cmp eax, 1
je 0x2007816
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x20077fe
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x20077d3
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x20077fa
xor eax, eax
inc eax
jmp 0x2007832
cmp esi, ebx
jae 0x2007802
xor eax, eax
jmp 0x2007832
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x200a20c]
jmp 0x2007818
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x440690
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004413d0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004413d0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4406f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x445070]
test esi, esi
jle 0x440810
mov eax, dword [0x445074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x440724
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4407a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x440710
mov dword [esp], ebx
call fcn.004410e0
mov edi, eax
test eax, eax
je 0x440837
mov eax, dword [0x445074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00441220
mov edx, dword [0x445074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x440817
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4407a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4407b0
add dword [0x445070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x445074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4407a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00440690
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x44072e
mov eax, dword [0x445074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00440690
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00440690
lea esi, [esi]
nop
Function at 0x440d50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x44508c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x445084]
sub esp, 4
test ebx, ebx
je 0x440da5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x440d9e
test esi, esi
je 0x440d9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x440d80
mov dword [esp], 0x44508c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4410e0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x441105
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x441110
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x441105
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x441158
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x44114e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x44115a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x441140
xor eax, eax
pop ebx
pop esi
ret
Function at 0x46425a
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x5d
ret
pop ebp
ret 0x5c22
or byte [edx - 0x76ed71e8], al
clc
pop ecx
ficom word [ecx - 0x42]
push eax
enter 0x3c0a, 0xffffffffffffffc4
leave
or byte [edi + edi - 0x17b7789c], ch
call 0x44429aa7
mov edx, 0x18cfefff
mov bl, 0x83
mov dword [0xbd6308c8], eax
insb byte es:[edi], dx
jg 0x4642a5
in al, 0x1c
rcl dword [esi], 0xc1
inc eax
lahf
push edi
pop edi
ja 0x464239
imul edi, edi, 0x52
xchg ecx, eax
dec ebx
push eax
std
cmp dl, cl
adc dword [ebx - 0x57], ebp
mov ebp, 0xccef8871
in al, 0xee
out dx, al
test dword [ecx + edi*4 + 0xe], ebx
mov byte [esi - 0x6c64d1c0], al
cmp al, 0x1e
cmp eax, 0x7a00ddfc
push edx
adc byte [edx], al
xor byte [edx], 0x82
popfd
call 0xbe9bb22f
in al, 0x7d
xchg edx, eax
pushal
jl 0x46424e
and al, 0x25
enter 0xffffffffffff84df, 0x5f
inc ebp
aam 0xf6
test byte [edx + 0x5b], 0xa1
inc esi
iretd
test byte [esi - 0x4531592e], bl
invalid
insb byte es:[edi], dx
jno 0x464345
mul byte [ecx + 0x50e8687c]
clc
jg 0x4642a4
sbb al, ch
lea esi, [edi + 0x385bf9ff]
lcall 0x90b8, 0xf877a3d8
outsd dx, dword [esi]
pop ds
hlt
movsb byte es:[edi], byte [esi]
sti
dec edx
xlatb
les eax, [edi + ebx*4]
lahf
rcr dword [ebx - 0x5a82b38], 0x8b
mov edx, 0xb188679d
movsd dword es:[edi], dword [esi]
dec edi
cmp dword [edi], esp
jns 0x4642e9
dec eax
jg 0x464383
push ds
nop
mov byte [0x4e489f88], al
lahf
dec eax
dec esi
fmul dword [esi - 0x43]
jl 0x46433f
outsd dx, dword [esi]
xor dword [esi], ebp
fdiv dword [edx + 0x2b76ee68]
inc ebp
push 0x67
fbstp tbyte [eax - 0x10]
mov edx, 0x2c953579
pop edi
jbe 0x46435f
sub al, 0xf6
lodsb al, byte [esi]
fsub st(0), st(0)
xor eax, ebx
cmp al, 0x4b
xchg edi, eax
pop ecx
pop ds
stosb byte es:[edi], al
dec esi
mov byte [esi + ebx*8], cl
retf 0x9390
Function at 0x604ba9
Capabilities:
Check for software breakpoints

Disassembly:
dec ebx
sti
stc
popal
mov al, byte [0x9c17a7b0]
scasd eax, dword es:[edi]
or byte [edx - 9], al
cmp ch, byte [ebx]
sbb ebp, ebx
xchg edi, eax
movsb byte es:[edi], byte [esi]
push ss
push es
mov eax, 0x2f68c517
mov eax, 0x9a7a6b73
wait
test eax, 0x88e744b1
adc al, 0x11
mov bl, byte [ebx - 0x1daebda4]
dec esp
sbb al, 0x56
mov ch, 0x87
mov byte [ebx + 0x62c2649], 0x1b
mov esp, 0xc0b7a8
xchg edx, eax
dec esp
sahf
loope 0x604c13
daa
mov ch, 5
sbb dword [esi + 0xfaa1f6f], eax
mov ecx, 0x29087ca8
test al, 0x7c
or byte [ecx], ch
test al, 0x7c
or byte [ecx], ch
cmp al, 0xcc
sbb al, 0x6e
wait
call 0xc8a632dd
sub dl, ch
not byte [edi]
aad 0xf6
pop ss
vcvtps2dq xmm0, xmmword [eax + 0x43]
js 0x604b7b
jne 0x604b5b
shr byte [esi - 0x79475d1], 1
lcall 0xcf15, 0xad67c14
mov cl, 0x62
nop
salc
or dl, byte [0x9062b1cf]
invalid
daa
mov ch, byte ss:[ebp - 0x43567082]
mov ch, 0xdc
and al, 0x9d
adc eax, 0x936b5c19
fstpnce st(3), st(0)
fst dword [ebp + 0x2a]
dec esp
jg 0x604bb8
pop ss
sal byte [eax - 0x587fd394], cl
cli
xchg ebp, eax
les esp, [edx]
cwde
push ebx
xor dl, byte [esi]
mov ebx, 0x93250ef9
xor al, 0xa6
jl 0x604bcd
invalid

Function at 0x627d31
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313d0
cmp edx, dword [eax]
je 0x627d53
add eax, 8
inc ecx
cmp eax, 0x631460
jl 0x627d44
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6313d0]
jne 0x627e81
mov eax, dword [0x639d78]
cmp eax, 1
je 0x627e5b
test eax, eax
jne 0x627d84
cmp dword [0x6312f8], 1
je 0x627e5b
cmp edx, 0xfc
je 0x627e81
lea eax, [ebp - 0x1a4]
push 0x104
add al, 1
add byte [eax], al
lea eax, [ebp + 8]
lea esi, [esi + 0x6313d4]
push 0
push eax
push dword [esi]
call fcn.00628ba0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40b9a0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40bb6e
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b9cb
mov eax, 0x7000000
jmp 0x40b9d3
test eax, eax
je 0x40bb49
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.00462d10
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0xb91740]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40bb61
cmp ecx, 0x21
jae 0x40bb55
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045d5d0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.0045d6a0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0xa558a0]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0xa55968]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40bb24
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0xa559c0]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00462df0
mov eax, ecx
mov ecx, 0x21
call fcn.00462ed0
nop
call fcn.00461950
jmp fcn.0040b9a0
Function at 0x415500
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x415714
sub esp, 0x18
mov eax, dword [0xbe835c]
test eax, eax
jne 0x4156fd
nop
lea eax, [0xbe8344]
mov dword [esp], eax
call fcn.004097f0
mov eax, dword [0xbe8348]
test eax, eax
je 0x415549
cmp dword [eax + 8], 0xcc
jne 0x4155bf
mov edx, dword [0xbe833c]
test edx, edx
jne 0x4155a1
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0xbed5b0]
mov dword [esp + 8], eax
call fcn.0040bb80
mov eax, dword [esp + 0xc]
mov dword [0xbe833c], eax
mov ecx, dword [0xbe8300]
mov dword [eax], ecx
mov eax, dword [0xbe833c]
mov dword [0xbe8300], eax
movzx eax, byte [0xbe89a0]
test al, al
jne 0x4155a1
xor eax, eax
jmp 0x4156a9
mov edx, dword [0xbe833c]
mov ebx, dword [edx + 4]
mov dword [0xbe833c], ebx
mov ebx, dword [0xbe8348]
mov dword [edx + 4], ebx
mov dword [0xbe8348], edx
mov edx, dword [0xbe8348]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x415691
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402110
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0xbe8670]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x41561d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x41562a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00462d60
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0xbe8670]
test edx, edx
jne 0x415656
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x415677
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00462d60
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00462d60
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00462d60
mov byte [0xbe82b3], 1
nop
lea eax, [0xbe8344]
mov dword [esp], eax
call fcn.004099f0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00462df0
lea esi, [0xbe89a0]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x4155a1
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x4156f3
lea edx, [0xb8b21c]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x41569b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00462de0
mov ecx, 5
call fcn.00462de0
lea eax, [0x68f290]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00437810
nop
call fcn.00461950
jmp fcn.00415500
Function at 0x429510
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42962c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x4295a5
cmp cl, 2
je 0x42954d
cmp cl, 3
jne 0x429615
mov byte [eax + 8], 1
jmp 0x429611
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042eca0
nop
lea eax, [0xbcc904]
mov dword [esp], eax
call fcn.004097f0
nop
mov eax, dword [0xbcc8d0]
sub eax, dword [0xbcc8b4]
mov dword [0xbcc8d0], eax
mov eax, dword [0xbcc8c0]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xbcc8c0], ecx
nop
lea eax, [0xbcc904]
mov dword [esp], eax
call fcn.004099f0
jmp 0x429611
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00415500
nop
lea eax, [0xbcc904]
mov dword [esp], eax
call fcn.004097f0
nop
mov eax, dword [0xbcc8a8]
sub eax, dword [0xbcc88c]
mov dword [0xbcc8a8], eax
mov eax, dword [0xbcc898]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xbcc898], ecx
nop
nop
lea eax, [0xbcc904]
mov dword [esp], eax
call fcn.004099f0
add esp, 0x14
ret
lea eax, [0x68b813]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00437810
nop
call fcn.00461950
jmp fcn.00429510