joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x42a6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x10
mov ebx, eax
call fcn.0040862d
push str.FirewallGUI.exe
mov edi, eax
push 0x10
push edi
call fcn.00409099
add esp, 0x10
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x407c97
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x407c97
mov ecx, edi
xor edx, edx
lea esi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407bd0
sub ecx, esi
je 0x407c03
jmp 0x407be0
mov al, byte [edx + edi]
cmp al, 0x41
jl 0x407bf0
cmp al, 0x5a
jg 0x407bf0
add al, 0x20
mov byte [edx + edi], al
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407bf6
sub eax, esi
cmp edx, eax
jb 0x407be0
lea ecx, [ebp - 0x10c]
xor edx, edx
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407c10
sub ecx, esi
je 0x407c4f
jmp 0x407c20
mov al, byte [ebp + edx - 0x10c]
cmp al, 0x41
jl 0x407c38
cmp al, 0x5a
jg 0x407c38
add al, 0x20
mov byte [ebp + edx - 0x10c], al
lea ecx, [ebp - 0x10c]
inc edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407c42
sub ecx, esi
cmp edx, ecx
jb 0x407c20
mov ecx, edi
lea eax, [ebp - 0x10c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407c77
test dl, dl
je 0x407c73
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407c77
add eax, 2
add ecx, 2
test dl, dl
jne 0x407c57
xor eax, eax
jmp 0x407c7c
sbb eax, eax
or eax, 1
test eax, eax
je 0x407cba
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x407bc3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00409151
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040903f
mov esp, ebp
pop ebp
ret
push edi
call fcn.00409151
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
mov al, 1
pop ebx
call fcn.0040903f
mov esp, ebp
pop ebp
ret

Function at 0x410e4b
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov esi, eax
push esi
call fcn.00410732
push esi
call fcn.00410699
push esi
call fcn.00410c67
push esi
jmp loc.004396ba
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40300d
Capabilities:
Terminate process

Disassembly:
mov dword [0x402020], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
call dword [sym.imp.kernel32.dll_GetVersion]
mov edx, eax
xor edi, edi
xor esi, esi
push dword [0x4035d8]
call dword [sym.imp.winmm.dll_waveInClose]
add eax, 6
test eax, 0xb
jne 0x403046
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
ret

Function at 0x415430
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x415452
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415459
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415448
mov eax, 1
add ebx, ebx
jne 0x41546b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415460
jne 0x41547c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415460
xor ecx, ecx
sub eax, 3
jb 0x415490
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415502
mov ebp, eax
add ebx, ebx
jne 0x41549b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4154a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4154cc
inc ecx
add ebx, ebx
jne 0x4154b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4154ad
jne 0x4154c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4154ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4154ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4154dd
jmp 0x41544e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4154ec
add edi, ecx
jmp 0x41544e
pop esi
mov edi, esi
mov ecx, 0x22b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41550a
cmp byte [edi], 5
jne 0x41550a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41550f
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x41557e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a20]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41553c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a28]
or eax, eax
je 0x415578
mov dword [ebx], eax
add ebx, 4
jmp 0x415559
call dword [esi + 0x19a24]
mov ebp, dword [esi + 0x19a2c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4155b2
sub esp, 0xffffff80
jmp 0x403008
Function at 0x40217c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40218b
pop dword [ebp - 0x50]
mov eax, 0xe5bf5070
add eax, 0x1a80d11b
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x3789c1d
sub dword [ebp - 0x60], 0xb52656d2
mov dword [ebp - 0x5c], 0xab9d536c
sub dword [ebp - 0x5c], 0x796a0727
mov dword [ebp - 0x58], 0x2cfc6238
sub dword [ebp - 0x58], 0xe0b01e0a
mov dword [ebp - 0x54], 0xc00a860f
sub dword [ebp - 0x54], 0xc00a860f
lea eax, [ebp - 0x60]
push eax
mov eax, 0xf91293c9
sub eax, 0xf8d06355
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe150395e
add dword [ebp - 0x60], 0x93222ff8
mov dword [ebp - 0x5c], 0x36fa5150
add dword [ebp - 0x5c], 0xa721025
mov dword [ebp - 0x58], 0xbca3be5c
sub dword [ebp - 0x58], 0x593451f0
mov dword [ebp - 0x54], 0x430aa4ce
sub dword [ebp - 0x54], 0x430aa4ce
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xd8630586
sub eax, 0xd820d462
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3c830
push 0
call eax
mov ecx, 0x8ccb54ef
add ecx, 0x7334ee54
xor edx, edx
add edx, eax
mov ebx, 0x86714b49
add ebx, 0x79d1f8b7
add ebx, dword [ebp - 0x50]
mov edi, 0x4afa683a
add edi, 0x58d8be54
xor dword [ebp - 0x28], esi
mov esi, dword [ebx]
add dword [ebp - 0x30], ecx
add esi, edi
add dword [ebp - 0x38], edx
mov dword [edx], esi
xor dword [ebp - 0x18], 0x9d3c4e1
add edx, 4
add ebx, 0x58c7ccc5
sub ebx, 0x58c7ccc1
loop 0x4022af
add eax, 0xb6fbf732
sub eax, 0xb6faf753
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x29723708
sub ecx, 0x29323708
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x39013abe
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
mov ecx, 0x41a44c64
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2c483f47
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1ff00522
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x402461
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
lea edx, [eax - 1]
mov ebx, eax
and edx, dword [0x404050]
mov eax, 0x404054
jmp loc.00462a00

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x6fd819c1
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1a3f248b
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x434080
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x434098
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x434176
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00434a50
add esp, 8
sar eax, 0xc
cmp eax, 3
jne 0x434171
mov dword [ebp - 0x10], 0xfff
mov dword [ebp - 0xc], 0x9922c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00434a50
add esp, 8
and eax, dword [ebp - 0x10]
add eax, 0x8702
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
cmp dword [ebp - 4], 0
jne 0x43414a
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x43414a
xor eax, eax
jmp 0x434176
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx - 0x8702]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx - 0x8702], eax
jmp 0x43408f
mov esp, ebp
pop ebp
ret

Function at 0x434a50
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x240be8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x240be8
push 0x15b9
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x434a85
xor eax, eax
jmp 0x434a8f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx eax, word [eax + edx*2]
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x10ed59b8
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x63c64778
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2462379b
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x12ce3c6f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x477b90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x72000]
push edi
jmp 0x477baa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x477bb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477ba0
mov eax, 1
add ebx, ebx
jne 0x477bc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x477bb8
jne 0x477bd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x477bb8
xor ecx, ecx
sub eax, 3
jb 0x477be8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x477c5a
mov ebp, eax
add ebx, ebx
jne 0x477bf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x477c00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x477c24
inc ecx
add ebx, ebx
jne 0x477c10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x477c05
jne 0x477c21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x477c05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x477c44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x477c35
jmp 0x477ba6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x477c44
add edi, ecx
jmp 0x477ba6
pop esi
mov edi, esi
mov ecx, 0x266
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x477c62
cmp byte [edi], 6
jne 0x477c62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x477c67
lea edi, [esi + 0x75000]
mov eax, dword [edi]
or eax, eax
je 0x477cdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x907b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9086c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x477c94
mov ecx, edi
jns 0x477cc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x90874]
or eax, eax
je 0x477cd9
mov dword [ebx], eax
add ebx, 4
jmp 0x477cb1
call dword [esi + 0x90870]
mov ebp, dword [esi + 0x90878]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x477d13
sub esp, 0xffffff80
jmp 0x4033b6
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x53a863b0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x17b7147c
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x93f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0093f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x93f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93f06a
add dl, dl
jne 0x93f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93f0dc
xor eax, eax
add dl, dl
jne 0x93f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93f17d
add dl, dl
jne 0x93f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x93f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x93f075
mov eax, 1
add dl, dl
jne 0x93f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x93f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x93f0e1
sub eax, ebx
mov ebx, 1
jne 0x93f128
mov ecx, 1
add dl, dl
jne 0x93f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x93f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x93f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x93f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x93f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x93f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x93f136
cmp eax, 0x7d00
jae 0x93f16d
cmp eax, 0x500
jb 0x93f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x93f075
cmp eax, 0x7f
ja 0x93f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x93f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x93f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x93f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..wixburn
nop
mov ebx, 0x40c7d0
mov ecx, 0x40664cf
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..pdata
nop
mov ebx, 0x42f314
mov ecx, 0x4fe40f1a
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219