joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x463b32e2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x46e0665d
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x3c350c35
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x287e6da3
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x405e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
inc esi
mov ebx, dword [esp + ecx]
mov ebx, dword [ebp + 0x2f]
push esi
test ebx, ebx
add al, 0x7d
push ss
out 1, eax
mov dword [0x83660000], eax
mov eax, dword [eax]
jo 0x405eab
xor byte [ebx + 0x74060278], al
movsd dword es:[edi], dword [esi]
mov byte [ebx - 0x1214fd37], ch
sub eax, dword [ebp - 0x76]
add eax, 2
sar eax, 1
call 0x97cd6f65
popfd
add al, 0
add byte [eax], al
push eax
call dword [0x277b5c]
mov eax, dword [ebp - 0x75efba75]
salc
inc eax
add dword [esi - 0x77], edx
jne 0x405e9b
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.MSVCRT.dll_fclose]
cmp dword [eax], 8
lea ecx, [ebp - 4]
mov dword [edi], eax
lea edx, [ebp + 0x38]
mov dword [eax - 0x75], edx
inc ebp
rsqrtps xmm6, xmmword [ebp + 0x4d34e8]
add byte [ebx + 0x78bfc55], cl
push 0xfffffffffffffff2
push esi
push eax
call dword [0x6640c10f]
mov ecx, 0xa500d97e
add esp, 0xfffffff4
cmp ebx, ecx
mov dword [edi], eax
jle 0x405f02
outsd dx, dword [esi]
dec ebx
dec dword [ebp + 0x4d890447]
or al, 0x2e
mov edx, dword [eax - 4]
imul ecx, esp, 0x8bcf8902
xor byte [edx + 0xc844616], cl
mov dword [eax], esi
cmc
sbb edx, dword [ebp + 0xc]
add eax, 4
dec edx
mov dword [ebp + 0xc], edx
jne 0x405ee3
mov eax, dword [ebp + 8]
mov dword [edi + ecx*4], 0xa800d400
idiv byte [eax]
ror byte [ebx - 0x74a4a13d], 0xe5
pop ebp
ret

Function at 0x406290
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], edx
push ss
mov byte [eax - 0x74ffffd0], dl
scasb al, byte es:[edi]
or al, 0x8b
push edx
or al, 0x8d
xor al, 0xf
cmp eax, dword [esi]
or al, 0x75
add eax, 0x980448ff
sub cl, byte [ebp - 0x5c46f4c4]
add byte [eax], al
add bl, dh
rep movsd dword es:[edi], dword [esi]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
add ebx, 0x14
mov ecx, dword [ebp - 4]
sub dword [ebx - 0x32769dec], 8
mov dword [ebp - 4], ecx
jne 0x40626f
mov edi, dword [ebp + 0x47]
mov esi, eax
or al, 0x33
leave
test edx, edx
jbe 0x4062e1
lea edi, [esi + 0x72]
cmp dword [esi], edi
je 0x4062c8
inc ecx
add esi, 4
cmp ecx, edx
jb 0x40626c
jmp 0x4062e1
cdq
lea edx, [eax + ecx*4 + 0x10]
jmp 0x89816744
mov edx, dword [eax + 0x251010]
xor ecx, ecx
test edx, edx
jbe 0x406327
mov al, 0x14
adc byte [eax], al
add byte [ecx], bh
test dword [edx + ecx + 0x41], esi
fcmovnb st(0), st(6)
out dx, al
cmp ecx, edx
jb 0x4062f3
cmp dword [ebp - 0x24bef58c], eax
invalid
jmp 0x406327
mov edx, dword [eax + 0x2014]
cmpsd dword [esi], dword es:[edi]
leave
test edx, edx
xor al, 0x3a
lea esi, [eax + 0x2087]
cmp dword [0x83410a74], ebp
and al, 4
pop edi
retf 0xf46b
Function at 0x40a1e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
mov esi, dword [edx + 0x28]
jmp 0x409fbb
movzx ecx, word [edx + 0x26]
nop
xor eax, eax
nop
jmp 0x409fd0
lodsb al, byte [esi]
nop
jmp 0x409fe1
cmp al, 0x61
nop
jmp 0x409fee
jl 0x40a011
nop
jmp 0x40a000
nop
jmp 0x40a00f
sub al, 0x20
jmp 0x40a01c
ror edi, 0xd
nop
add edi, eax
nop
dec ecx
jne 0x409fc0
push edx
nop
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
nop
push edi
jmp 0x40a044
mov eax, dword [eax + 0x78]
jmp 0x40a058
test eax, eax
je 0x40a1d2
jmp 0x40a070
nop
add eax, edx
nop
jmp 0x40a082
push eax
jmp 0x40a08e
mov ebx, dword [eax + 0x20]
add ebx, edx
nop
jmp 0x40a0a0
mov ecx, dword [eax + 0x18]
nop
jmp 0x40a0b3
nop
jmp 0x40a0c1
test ecx, ecx
nop
je 0x40a1d1
nop
dec ecx
jmp 0x40a0dc
mov esi, dword [ebx + ecx*4]
xor edi, edi
nop
jmp 0x40a0ee
add esi, edx
jmp 0x40a0fe
jmp 0x40a108
xor eax, eax
jmp 0x40a117
ror edi, 0xd
nop
jmp 0x40a12b
lodsb al, byte [esi]
add edi, eax
cmp al, ah
jmp 0x40a13a
jne 0x40a0fe
jmp 0x40a14a
nop
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jmp 0x40a161
jne 0x40a0b3
nop
pop eax
nop
jmp 0x40a17d
mov ebx, dword [eax + 0x24]
add ebx, edx
jmp 0x40a18f
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
add ebx, edx
nop
mov eax, dword [ebx + ecx*4]
add eax, edx
nop
mov dword [esp + 0x24], eax
nop
pop ebx
pop ebx
nop
jmp 0x40a1bb
popal
pop ecx
nop
pop edx
push ecx
jmp 0x40a1cf
jmp eax
pop eax
jmp 0x40a1df
pop edi
nop
jmp 0x40a1f4
pop edx
mov edx, dword [edx]
nop
jmp 0x409fa5

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x533e1c
Capabilities:
Encode data using xor

Disassembly:
lea esi, [ebp - 0x20]
mov dword [ebp - 0x24], esi
xor si, si
mov di, si
mov word [ebp - 0x28], cx
mov word [ebp - 0x2c], dx
xor cx, si
xor dx, di
mov si, ax
mov di, bx
xor ah, al
xor bl, bh
xor cl, bl
add ah, cl
inc ah
rol ah, 1
rol ah, 1
xor ch, ah
add bl, ch
rol bl, 1
rol bl, 1
xor dl, ah
add al, dl
rol al, 1
rol al, 1
xor dh, bl
add bh, dh
inc bh
rol bh, 1
rol bh, 1
mov cx, ax
mov dx, bx
mov ebx, dword [ebp - 0x24]
mov word ss:[ebx], cx
mov word ss:[ebx + 2], dx
add ebx, 4
cmp ebx, ebp
mov dword [ebp - 0x24], ebx
mov ax, word [ebp - 0x28]
mov bx, word [ebp - 0x2c]
jne 0x533e28
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x4d535972
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x63a56151
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x2c5c6d20
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x610a1ecb
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x62
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x7ff25f41
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
mov ecx, 0x6b187e4f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x758ada
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc edi, 1
xor cl, bl
not cl
rol cl, 1
jmp 0x8a944d
ret
inc cx
movzx esi, byte [esp]
mov ebx, 0xf699791a
inc ecx
mov bl, byte [esp + 2]
dec ecx
add esp, 2
push 0x6daa001a
call fcn.007b2a86
mov edx, eax
btr si, 0x10
or si, bp
pop esi
test eax, ebx
and ecx, 0xe9a6c00c
movzx ecx, byte [edi + ecx - 0x49840000]
jg 0x69439a
jb 0x89fdb2
mov eax, 1
jmp 0x6a6321
mov dword [edi + 8], 0
cmp cl, 0x2d
jmp 0x8aafd1
inc cl
push 0xb1a8d7a4
neg cl
call fcn.0091466c
jmp 0x74e33d
jb 0x768f80
push esi
cbw
sub ah, 0x38
shld eax, esi, 0x8d
movzx esi, cl
rdtsc
mov eax, 0x6c16c16d
sar dx, cl
or dh, bh
mul esi
mov eax, esi
sub eax, edx
bswap esi
add si, bx
shr eax, 1
lea eax, [eax + edx]
inc dx
shr eax, 5
mov dx, 0x6ca3
stc
movzx eax, al
ror dx, cl
jmp 0x753426

Function at 0x79c00f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
and dword [eax], eax
call fcn.00758339
ror byte [esp + 5], 0xe3
neg cl
neg word [esp + 4]
not cl
sub cl, 0xa9
inc word [esp + 4]
rol dword [eax - 0x995617], 1
inc esp
and al, 4
call fcn.008e7ad2
adc dl, dh
xor ebp, esp
sbb dl, byte [ecx + 0x2e1a4228]
inc ebp
push ecx
push ds
push ebp
pop esp
daa
sub cl, dh
add dword [edx + edi*2 - 0x37bb5540], edx
nop
scasb al, byte es:[edi]
les esp, [eax - 0x2e]
js 0x699834
stc
xchg edi, eax
push es
push ebx
rcr byte [ebx - 0x80], 0x92
pop ebp
sti
sbb dword [edi - 0x46], ebx
mov ecx, 0xe13ae51f
jp 0x699820
invalid
inc cl
jmp 0x699827

Function at 0x7a634c
Capabilities:
Encode data using xor

Disassembly:
sub edi, 0xc
mov dword [edi + 0xc], eax
mov dword [edi + 8], ebx
call fcn.0076aaba
jecxz 0x7a63d4
and dh, ah
adc eax, 0xf4828532
and edx, dword [edi - 0x75baed10]
cmp al, 0x33
xchg ebp, eax
fcomp dword [edi + 0x4d]
cmp al, ch
adc byte [edx + esi*2 - 0x5b3dd7e1], 0xb2
add eax, 0x7f04c8b
dec ebp
pop edx
or ebx, dword [edi + edi*2 + 0x6679]
add byte [eax - 0x1a75a61a], al
add byte [eax], al
add byte [eax + 0x1cf3a3d1], al
mov dl, 0x24
rcl cl, 1
inc esp
pop ebp
xor ebx, dword [ebp + 0x28]
and eax, 0x63681f50
sbb al, 0xb2
and al, 0xd0
rol dword [ebp + ebx*2 + 0x33], 1
pop ebp
sub byte [0x63681f50], ah
and dh, ch
adc ah, byte [ebx + eax*8 + 0x1dfbb925]
stc
cmp dword [edi], ebx
loopne 0x7a636e
pushfd
inc ebx
popfd
and dword [ebp + 0x1c], 0xe766f014
cmp bh, dl
add al, 0x75
dec ebp
xchg ebx, eax
arpl word [ebp + 0xf395aa9], si
sub ebp, dword [ecx + 0x39ce683b]
add byte [eax], al
push 0x39ce
add byte [eax - 0x4f901e0c], al
xchg ecx, eax
xor ah, 0xe1
outsd dx, dword [esi]
mov al, 0x91
cli
or al, 0xc7
xor byte [eax - 0x64], al
dec edi
ror dword [esi - 0x68042682], cl
xor al, 0x50
jae 0x7a6403
invalid
mov esi, 0xb615b192
bound ecx, qword [ebx]
aaa
je 0x7a63ce
imul edx, dword [edi + 0x7df1b2ce], 0xffffff8e
fidiv dword [ebx - 0x24c78321]
xchg esi, ebx
adc dh, byte [ecx - 0x13]
jle 0x7a6397
push es
jmp 0x7a641a
or edi, edi
jno 0x7a63dd
add dh, byte [edi + 2]
idiv byte [eax - 0x4a]
invalid
Function at 0x8af9d3
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esi]
mov dword [esp], edx
mov dword [esp], ebx
lea edx, [edx + edx*8 + 0x3e12f38b]
push edx
not edx
cpuid
sub esi, 0xc
mov byte [0xcee81], al
add byte [eax], al
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
call fcn.00892b8a
loop 0x8afa3f
xor al, byte [0xa6700c4b]
pop ebp
fstp xword [0xcf9a0cba]
test eax, 0xd5227dca
and dl, ch
cmp ebp, dword [eax + edi]
sahf
sbb eax, 0x8402e58a
jecxz 0x8af9e6
sbb byte [edx - 0x5b], ah
mov byte [0x60144344], al
xchg byte [esi + 0x66861cbd], ch
add byte [eax], al
add byte [eax + 0x12e3c90], al
mov ebp, 0x3ff3c0e4
int3
loopne 0x8afa0a
movsd dword es:[edi], dword [esi]
push es
pop edx
mov dword [ebp + 0xc], edx
test al, 0x9b
xlatb
and al, 0xe0
sub ecx, ebp
ret 0xea43

Function at 0x8cf7a6
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x7927cd
mov esi, dword [ebp + 0xc]
test ax, sp
cmp edi, 0xa714262b
stc
test esi, esi
jmp 0x7927b9
je 0x7927cd
mov eax, 0x5a4d
cmp word [edx], ax
je 0x8e5ac1
push ebp
cdq
mov ebp, esp
sub dl, 0xa8
ror dh, 0xaf
cmc
mov edx, dword [ebp + 8]
sub esp, 0x114
push esi
test edx, edx
jmp 0x6b7737

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x5d842b2b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x761815f7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x408927
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
mov eax, dword [esp]
add esp, 4
add edi, edi
push 0xe7a6fcc4
mov edi, dword [esp]
add esp, 4
call fcn.0040895b
dec edi
and ebx, edi
xor dword [ecx], eax
sub edi, ebx
mov edi, 0x140379f9
inc ecx
cmp ecx, esi
jne fcn.00408927
mov edi, 0xaae3e116
ret