joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e28bc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x170]
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.004e2b98
mov edx, dword [ebp - 4]
mov dword [edx + 0x170], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 0x174], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0x174], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x174], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x174]
shr edx, 0x18
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x178]
mov eax, dword [ebp - 4]
call fcn.004e2b98
mov edx, dword [ebp - 4]
mov dword [edx + 0x178], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x4e2978
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4e29bf
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.004e2940
mov edx, dword [ebp - 8]
xor byte [edx], al
mov eax, dword [ebp - 8]
mov dl, byte [eax]
mov eax, dword [ebp - 4]
call fcn.004e28bc
inc dword [ebp - 8]
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4e299a
mov esp, ebp
pop ebp
ret

Function at 0x4e2a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405248
xor eax, eax
push ebp
push 0x4e2af8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e29c4
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.004e2940
mov edx, dword [ebp - 0x10]
xor al, byte [ebp + edx - 0x1d]
mov byte [ebp - 0x11], al
mov dl, byte [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.004e28bc
mov eax, dword [ebp - 0x10]
mov dl, byte [ebp - 0x11]
mov byte [ebp + eax - 0x1d], dl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x4e2aac
mov al, byte [ebp - 0x12]
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2aff
lea eax, [ebp - 8]
call fcn.00404dc8
ret
Function at 0x4e3a5c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e3c56
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0xffffffff
jle 0x4e3c0f
mov eax, dword [ebp - 4]
call fcn.004e5704
cmp eax, dword [ebp - 8]
jle 0x4e3c0f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, dword [ebp - 8]
call fcn.004d868c
mov edx, dword [0x4da694]
call fcn.00404054
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.004db914
test al, al
je 0x4e3c05
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x44], 0
jne 0x4e3bf5
xor eax, eax
push ebp
push 0x4e3bee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004e4110
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041d858
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
push dword [eax + 0x34]
push dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x4e]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, word [ebp - 0x32]
movzx edx, word [ebp - 0x30]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx eax, word [ebp - 0x2e]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.004054e8
mov eax, dword [ebp - 0xc]
call fcn.004052b8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 0x15], al
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e3e30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 0x15]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3c40
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4e3bed
mov eax, dword [ebp - 4]
call fcn.004e41bc
ret
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x44]
call fcn.0040ad28
jmp 0x4e3c40
mov eax, dword [ebp - 0xc]
call fcn.00404dc8
jmp 0x4e3c40
mov eax, dword [ebp - 8]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
lea eax, [ebp - 0x58]
push eax
push 0
lea edx, [ebp - 0x5c]
mov eax, 0xb3
call fcn.0040a108
mov ecx, dword [ebp - 0x5c]
mov dl, 1
mov eax, dword [0x41821c]
call fcn.0040e4f0
call fcn.00404718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3c5d
lea eax, [ebp - 0x5c]
call fcn.00404dc8
ret
Function at 0x4f2268
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x4f229c
add eax, 3
sar eax, 2
test eax, eax
jle 0x4f23fa
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
movzx eax, byte [eax + edx]
cmp eax, 0x3d
jg 0x4f22d9
je 0x4f233f
sub eax, 0x2b
je 0x4f232b
sub eax, 4
je 0x4f2335
dec eax
sub eax, 0xa
jb 0x4f2315
jmp 0x4f2347
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x4f22eb
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x4f22ff
jmp 0x4f2347
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x41
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4f2347
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x61
add al, 0x1a
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4f2347
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x30
add al, 0x34
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4f2347
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3e
jmp 0x4f2347
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3f
jmp 0x4f2347
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0xff
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x4f22b6
mov al, byte [ebp - 0x24]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x23]
shr edx, 4
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x22], 0xff
je 0x4f23ab
cmp byte [ebp - 0x21], 0xff
jne 0x4f23ab
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x20]
jmp 0x4f23eb
cmp byte [ebp - 0x22], 0xff
je 0x4f23eb
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov cl, byte [ebp - 0x22]
shl ecx, 6
or cl, byte [ebp - 0x21]
mov byte [eax + edx + 2], cl
mov eax, dword [ebp - 0x20]
add eax, 3
mov dword [ebp - 0x10], eax
add dword [ebp - 0x20], 2
inc dword [ebp - 0x20]
inc dword [ebp - 0x14]
dec dword [ebp - 0x30]
jne 0x4f22b1
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4f5460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f5502
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4f4248]
mov eax, 0x14
call fcn.00405da0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call dword [eax + 0x34]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004094c4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, 4
call fcn.00404e1c
mov eax, dword [ebp - 4]
call dword [eax + 0x30]
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov eax, dword [0x514ee4]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 0xc]
mov byte [edx + 0x10], al
mov eax, dword [ebp - 0xc]
mov dword [0x514ee4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5509
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404dec
ret

Function at 0x4f5510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f55a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4f4270]
mov eax, 0x10
call fcn.00405da0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call dword [eax + 0x34]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004094c4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00404e1c
mov eax, dword [ebp - 4]
call dword [eax + 0x30]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [0x514ee8]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov dword [0x514ee8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f55ad
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404dec
ret

Function at 0x4f5628
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x4f5662
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
add byte [eax], al
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
dec eax
mov al, byte [eax]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
dec edx
xor byte [edx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4f5648
mov esp, ebp
pop ebp
ret
Function at 0x4fb0e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x4fb0ff
cmp dword [ebp - 4], 0
jne 0x4fb109
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4fb210
mov dword [ebp - 0x14], 2
mov byte [ebp - 0x1a], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x1c], 0xac
mov byte [ebp - 0x1d], 0x3c
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4fb1e7
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov al, byte [eax]
xor al, byte [ebp - 0x1c]
mov byte [ebp - 0x1b], al
inc dword [ebp - 4]
cmp dword [ebp - 0x14], 6
jne 0x4fb18d
mov al, byte [ebp - 0x1b]
and al, 0x3f
and eax, 0xff
xor edx, edx
mov dl, byte [ebp - 0x1d]
add eax, edx
mov edx, dword [ebp - 0xc]
mov byte [edx], al
inc dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x1b]
shr eax, 2
and al, 0x30
or byte [ebp - 0x1a], al
xor eax, eax
mov al, byte [ebp - 0x1a]
xor edx, edx
mov dl, byte [ebp - 0x1d]
add eax, edx
mov edx, dword [ebp - 0xc]
mov byte [edx], al
inc dword [ebp - 0xc]
mov byte [ebp - 0x1a], 0
jmp 0x4fb1ca
xor eax, eax
mov al, byte [ebp - 0x1b]
shr eax, 2
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x19]
and al, 0x3c
mov dl, byte [ebp - 0x1b]
and dl, 3
or al, dl
and eax, 0xff
xor edx, edx
mov dl, byte [ebp - 0x1d]
add eax, edx
mov edx, dword [ebp - 0xc]
mov byte [edx], al
inc dword [ebp - 0xc]
mov al, byte [ebp - 0x1a]
shl eax, 2
mov dl, byte [ebp - 0x19]
and dl, 3
or al, dl
mov byte [ebp - 0x1a], al
mov eax, dword [ebp - 0x14]
mov ecx, 6
cdq
idiv ecx
add edx, 2
mov dword [ebp - 0x14], edx
inc dword [ebp - 0x18]
dec dword [ebp - 0x28]
jne 0x4fb139
cmp dword [ebp - 0x14], 2
je 0x4fb201
xor eax, eax
mov al, byte [ebp - 0x1a]
xor edx, edx
mov dl, byte [ebp - 0x1d]
add eax, edx
mov edx, dword [ebp - 0xc]
mov byte [edx], al
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x53f54c
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x2c]
jne 0x5b4d7f
and dl, 0x7e
cmp cx, 0xa816
movzx cx, bl
mov byte [ebp - 0xd], 0
test dx, bp
bts cx, 0xe
shl dh, 6
xor eax, eax
pushfd
mov edx, dword [esp + 4]
not ecx
mov byte [esp + 4], 0x3e
mov ecx, dword [esp + 8]
mov cl, byte [esp]
sete ch
jmp 0x544b7b
mov ecx, dword [esp + 0xc]
call fcn.00592dd9

Function at 0x551438
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
je 0x53dd9c
mov eax, 0xf0f3f7e2
not ah
movsx ax, bl
mov eax, dword [ebp - 0x10]
je 0x5a8cbf
push esp
pushal
lea esp, [esp + 0x24]
call fcn.00405258
call fcn.00551eee
mov al, byte [0x277a56e1]
inc esi
arpl word [esi + 0x2637d2db], sp
stosd dword es:[edi], eax
pop ebp
sbb ah, byte [ecx + 0xddb469e]
mov dh, byte [0x42fa9d9a]
xchg ebx, eax
push 0xaa55e47a
cmp eax, 0x2ed36bf6
push esi
sbb byte [ecx + 0x107749c9], 0x42
push eax
invalid
push esi
jmp 0x575704

Function at 0x55e381
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov word [esp], 0xa643
lea esp, [esp + 0x3c]
jb 0x4fecc5

Function at 0x578e4c
Capabilities:
Packed with generic packer

Disassembly:
movsx bx, bl
movzx dx, bl
mov ecx, dword [eax + 0x3c]
cwde
lea eax, [0x5b99d015]
mov eax, dword [ebp - 4]
bswap ebx
pushal
mov edx, dword [eax + 0x3c]
call fcn.005ca92c
pushfd
bt di, 5
idiv ecx
pushfd
test edx, edx
push dword [esp + 4]
pushal
lea esp, [esp + 0x2c]
je 0x5c004a
cwde
lea eax, [ebx - 0x6a5cfb83]
mov eax, dword [ebp - 4]
jne 0x551417
mov ecx, dword [eax + 0x3c]
pushal
cdq
mov eax, dword [ebp - 4]
not bh
mov edx, dword [eax + 0x3c]
lea eax, [edx + 0x2682e15d]
jmp 0x57a067
mov eax, dword [ebp + 8]
push dword [esp]
mov edx, dword [ebp - 4]
push 0xa7c799c3
setb ch
lea ecx, [esi + 0x7c6164b3]
mov ecx, dword [edx + 0x44]
mov byte [esp], 0x5c
mov dx, word [esp + 4]
cdq
pushal
push dword [esp]
pushfd
pushfd
lea esp, [esp + 0x38]
jmp 0x5590ba
mov eax, dword [ebp - 4]
movsx bx, cl
mov ebx, dword [eax]
pushfd
jmp 0x5894e9
push dword [esp + 8]
mov dword [esp + 0x24], 0x567a43
jmp 0x56ea3c
Function at 0x580359
Capabilities:
Packed with generic packer

Disassembly:
push eax
push eax
mov byte [esp], 2
jmp 0x578d72
call fcn.005b5dbd
pushal
pushal
mov dword [esp + 0x3c], eax
pushfd
jmp 0x582912
pushfd
call fcn.005c717c
lea esp, [esp + 4]
call fcn.00405258
jmp 0x51f5b5
lea esp, [esp + 4]
call fcn.004073d4
pushfd
pushal
mov byte [esp], 0xb0
mov dword [0x50d8ec], eax
cmc
test bl, bh
jmp 0x5ce70d
mov eax, dword [eax]
push 0x37ff8727
jmp 0x573353
lea esp, [esp + 0x40]
call fcn.00528895
jmp 0x5756fe
fld st(0)
out 0x3f, al
lea esp, [esp - 0xb]
jb 0x5ce76e
pushfd
and al, 0x1c
test dword [eax + ebp*8], ecx
sbb dword [edi - 0x1d], esp
and al, 0xe8
mov al, byte [0xe8ffe7fb]
xchg esp, eax
xchg ecx, eax
cli
invalid
inc esp
xchg edi, eax
pop esp
test byte [ecx + 0x7016c2b], bh
add cl, al
cmpsb byte [esi], byte es:[edi]
mov edi, 0xa6b97b44
cld
movsb byte es:[edi], byte [esi]
aad 0xf9
xchg ebp, eax
mov ch, ch
and byte [0x63201d32], ah
mov al, 0xd7
inc esp
stc
push esi
cmp byte [edx + esi + 0x47], dh
aam 0x39
cmp dword [ecx + 0x16], ecx
and ebx, dword [eax + 0x46f182b5]
in eax, 0x2a
inc ecx
neg byte [edi + 0x38aa959c]
daa
push esi
cmp al, 0x73
push ebp
loope 0x5ce7cd
push ds
jmp 0x99623840
pop es
add byte [esi - 9], ah
fimul dword [ebp + 0x88bc9be]
mov dh, 0x89
inc esp
and al, 8
push ecx
loopne 0x5ce808
jne 0x5ce810
push ebp
add al, ch
mov edx, 0x8dfff8f7
lahf
invalid
add al, ch
and eax, 0xe9fff507
pop ebp
das
cli
add ah, bh
inc esp
cld
invalid

Function at 0x58b403
Capabilities:
Packed with generic packer

Disassembly:
pushal
add esp, 0x24
jmp 0x58d223
pushal
call fcn.005c99e7
in al, 0x4d
mov byte [0xa265f6f9], al
aad 0xda
mov esi, eax
invalid
call fcn.00557ee6
lea esp, [esp + 0x54]
jle 0x564d7e
call fcn.0052875d
add di, 0x7379
mov edi, eax
jmp 0x541f34
cmc
call fcn.00527d93
or eax, edx
rol dx, cl
add dl, 0x80
ror dx, cl
dec dh
mov dword [ebp - 0xc], eax
bts ax, ax
bts dx, 8
sbb dl, bl
mov eax, dword [ebp - 0x18]
rol dl, 4
shl eax, 5
clc
bsr dx, bx
movsx dx, cl
sub dh, dl
mov edx, dword [ebp - 0x18]
mov byte [esp], 0xc3
pushfd
shr edx, 0x1b
cmc
clc
cmp edi, ebx
test bx, di
or eax, edx
mov byte [esp + 4], cl
push 0x82d5cae9
lea esp, [esp + 0x3c]
jmp 0x579d87

Function at 0x594383
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp + 8]
mov dx, word [esp]
rcl dh, 7
clc
movzx dx, dl
lea edx, [ebx + eax]
cmc
jmp 0x546255

Function at 0x5c2a22
Capabilities:
Execute anti-debugging instructions

Disassembly:
add cl, cl
push esp
rdtsc
lea ecx, [ebp - 0x389fc870]
add byte [ecx + ebp*8 + 0x802eac1], al
push 0x3fd4d4f4
Function at 0x4010a8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov dword [esp + 0x10], ecx
mov esi, 0x21
xor edi, edi
lea eax, [esi + 0x7b5]
xor edx, edx
mov ecx, 0x34
div ecx
mov ebx, edx
xor edx, edx
lea eax, [ebx + 0x7b5]
div ecx
mov eax, dword [esp + 0x10]
mov esi, edx
xor edx, edx
mov dl, byte [eax + edi]
mov cl, byte [edx + 0x408030]
mov byte [esp + 0x14], cl
mov ecx, 5
mov eax, dword [esp + 0x14]
and eax, 0xff
cdq
idiv ecx
inc edi
cmp edi, 0x1a
mov byte [ebp + ebx], al
mov byte [ebp + esi], dl
jb 0x4010bc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x401152
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebp, 0x1d
push edi
mov edi, ecx
mov dword [esp + 0x14], ebp
mov eax, 0x1d0
mov esi, ebp
mov ecx, ebp
and esi, 7
mov edx, 3
shr ecx, 3
shl esi, 2
mov dword [esp + 0x18], ecx
sub edx, ecx
mov ebx, 0xf
mov ecx, esi
mov edx, dword [edi + edx*4]
shl ebx, cl
and edx, ebx
shr edx, cl
cmp eax, 0x1d0
mov byte [esp + 0x10], dl
mov edx, 0x1d
jge 0x4011f3
mov ebx, edx
mov ecx, edx
shr ebx, 3
mov ebp, 3
and ecx, 7
sub ebp, ebx
mov ebx, 0xf
shl ecx, 2
mov ebp, dword [edi + ebp*4]
shl ebx, cl
and ebp, ebx
xor ebx, ebx
shr ebp, cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov bl, byte [eax + ecx + 0x4080e7]
and ebp, 0xff
xor ebp, ebx
dec edx
mov cl, byte ds:[ebp + eax + 0x4080e7]
mov ebp, dword [esp + 0x14]
cmp edx, ebp
mov byte [esp + 0x10], cl
jg 0x4011a1
lea edx, [ebp - 1]
test edx, edx
mov dword [esp + 0x14], edx
jl 0x40124e
mov ebx, edx
mov ecx, edx
shr ebx, 3
mov ebp, 3
and ecx, 7
sub ebp, ebx
mov ebx, 0xf
shl ecx, 2
mov ebp, dword [edi + ebp*4]
shl ebx, cl
and ebp, ebx
xor ebx, ebx
shr ebp, cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov bl, byte [eax + ecx + 0x4080e7]
and ebp, 0xff
xor ebp, ebx
dec edx
mov cl, byte ds:[ebp + eax + 0x4080e7]
mov byte [esp + 0x10], cl
jns 0x4011fe
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebp, 3
sub ebp, ecx
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov bl, byte [eax + ecx + 0x4080e7]
mov ecx, esi
and ebx, 0xf
shl ebx, cl
mov ecx, 0xf
mov dword [esp + 0x18], ecx
mov ecx, esi
mov esi, dword [esp + 0x18]
shl esi, cl
mov ecx, dword [edi + ebp*4]
not esi
and esi, ecx
or ebx, esi
sub eax, 0x10
mov dword [edi + ebp*4], ebx
mov ebp, edx
mov dword [esp + 0x14], ebp
jns 0x401169
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4018a0
Capabilities:
Hide graphical window
Terminate process

Disassembly:
sub esp, 0x3c
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [esp + 0x44]
push 0
push 0x4016f0
push 0
push 0x40624c
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
test esi, esi
jne 0x4018d0
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0xc]
push ecx
push eax
call edi
lea edx, [esp + 0x1c]
push edx
push esi
call edi
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
sub eax, ebx
mov ebx, dword [esp + 0x24]
cdq
push 1
sub eax, edx
push 0
sar eax, 1
push 0
push eax
mov eax, dword [esp + 0x24]
sub eax, ebx
cdq
sub eax, edx
sar eax, 1
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x38]
push eax
call edi
test eax, eax
je 0x401981
mov ebx, dword [sym.imp.USER32.dll_IsDialogMessageA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x30]
push ecx
push esi
call ebx
test eax, eax
jne 0x40196f
lea edx, [esp + 0x30]
push edx
call ebp
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea ecx, [esp + 0x3c]
push ecx
call edi
test eax, eax
jne 0x401951
pop ebp
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x3c
ret 0x10