joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465350
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x465388
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00463404
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004633dc
jmp 0x465394
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x466a3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x466a80
call fcn.0046c682
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x466a80
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x466a77
xor eax, eax
jmp 0x466a88
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00466a8e
pop edi
pop esi
pop ebx
ret 4

Function at 0x46cbb2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46cbe0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46cbfe
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046cb18
jmp 0x46cbfe
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46cbfe
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046cb18
test edi, edi
mov eax, edi
jne 0x46cbe8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
inc ecx
cwde
dec ecx
jae 0x400fef
ja 0x401050
jae 0x40104d
push ss
Function at 0x40aff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ror esi, 0x14
bsf di, dx
shl bp, 2
movzx di, al
xor esi, 0x1d9709a8
stc
clc
lea ebp, [esp + 0x10]
push 0x8ac206ee
cmp esp, 0x98e1bea3
bswap di
clc
sub esp, 0xac
mov di, 0xc2ef
push 0x3e1786bc
lea edi, [esp + 4]
pushfd
push dword [esp]
lea esp, [esp + 0xc]
jmp 0x402e4b
movsx bp, cl
not esi
jmp 0x40ac7f
Function at 0x4aa6e7
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x52dfb1
call fcn.0050e890
xor edi, edi
cmp dword [0x57cf6c], edi
je 0x4aa7b0
cmp dword [0x57dbc8], 0xfffffffe
jne 0x4aa79d
cmp dword [ebp + 8], 0xffffffff
je 0x4aa7b0
test byte [0x584d48], 1
mov esi, 0x584d28
jne 0x4aa746
or dword [0x584d48], 1
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.00441fb6
push 0x535685
call fcn.0050d55b
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, esi
call fcn.0044200d
cmp dword [0x584d24], edi
je 0x4aa75a
call fcn.0040fd30
push edi
push edi
push 0x4a9a8f
call fcn.005123ce
add esp, 0xc
mov dword [0x584d24], eax
cmp eax, edi
jbe 0x4aa78a
cmp eax, 0xffffffff
je 0x4aa78a
push 0xffffffffffffffff
push eax
call fcn.005cfa1a
mov ebx, 0xa308458b
enter 0x57db, 0
jmp 0x4aa790
mov dword [0x584d24], edi
push 0x584d30
call fcn.00655f5f
invalid
mov eax, dword [ebp + 8]
mov dword [0x57dbc8], eax
cmp eax, 0xffffffff
jne 0x4aa7b0
mov dword [0x584d24], edi
call fcn.0050e968
ret

Function at 0x5b9809
Capabilities:
Encode data using xor

Disassembly:
aad 0x24
and al, 0xf9
shr byte [esi], cl
xor byte [esi - 0x6f3cf595], bl
imul ecx, dword [edx], 0xffffffc3
nop
imul ecx, dword [edx], 0xffffffc3
nop
dec esp
and eax, 0xe65d4b1d
push edx
jno 0x5b9801
retf

Function at 0x5bd4cb
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jae 0x65df67
push 0xedfe204d
push 0xa002b715
mov dword [esp], 0xadc6c5c8
pushal
push esp
pushal
pushfd
lea esp, [esp + 0x48]
jmp loc.0041263a
pushal
pushal
jmp loc.007834d8

Function at 0x5d41e8
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
test esi, ecx
and eax, ebp
lcall 0xc1f9, 0x95cd5f70
adc ah, byte [eax]
push edx
aas
inc edi
lodsd eax, dword [esi]
adc dword [0xbe6315f2], ebp
jb 0x5d4217
bound ecx, qword [edx - 0x5e]
aaa
out 0xe9, eax
sub eax, 0xffffff9b
jne 0x5d4251
lahf
pushal
xchg dword [esi - 0x151ae4c6], eax
lea ebp, [esi - 0x46]
test eax, 0xbae4e017
adc ch, byte [ecx]
add dl, cl
outsb dx, byte [esi]
mov edx, 0xe4e017a9
mov edx, 0xca002912
fdivr qword [eax]
sub al, 0x56
xor byte [edi], dh
lds ebp, [ecx + 0x46]
xchg byte [ebx + 0x5a], al
lodsd eax, dword [esi]
mov bl, 0x6b
xor al, 0xc5
pop ds
jns 0x5d4273
outsd dx, dword [esi]
shl byte [0x165d65a3], cl
loopne 0x5d427d
xor al, 0x86
jbe 0x5d428e
sahf
insb byte es:[edi], dx
sub byte [edi], 5
push eax
imul ecx, dword [edx - 0x67], 0xdd14f1a6
add al, 0xe5
xor al, 0xe
out dx, eax
jno 0x5d4293
fld qword [0x71ef0e34]
cmp dl, dl
shr dword [edx + 0x38], cl
rcl bl, cl
push 0x38
mov esi, 0x5c5d492c
jg 0x5d422f
inc edx
in eax, 0xc6
invalid
push edi
dec edx
or byte [ebp + 0xb], bl
insd dword es:[edi], dx
inc esi
sbb al, 0xa4
ja 0x5d4243
lds ebp, [ebp + 0x765f8389]
rcl dword [eax], 0xcb
cld
adc dword fs:[ebp - 0x55], esp
inc dword [edi + 0x7dc369e1]
sub bh, byte [ebp - 0x30]
lodsd eax, dword [esi]
mov dword [ebx + 0x10c1765f], eax
retf
imul eax, ebx, 0xd07d2a7d
shr byte [edx], 1
and eax, dword [ebx + 0x59]
sub ah, byte [ebx]
inc ebx
pop ecx
ror ecx, 1
mov dword [ecx + 0x20], ecx
stosb byte es:[edi], al
test byte [esi], ah
sti
ror dword [eax + 0xe], 1
xor dword [eax - 0x1e9c16f], eax
pop eax
je 0x5d429e
invalid
Function at 0x5daddf
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [eax + 1]
pushfd
mov dword [esp + 0x34], eax
movzx eax, al
mov ax, dx
push dword [esp]
movsx eax, bl
mov eax, 0x4a4abb
push esp
mov eax, dword [eax + 0x1c4eda]
push dword [esp + 0x14]
lea eax, [eax + 0x16b6c4c7]
call fcn.00631540

Function at 0x5ee31d
Capabilities:
Encode data using xor

Disassembly:
jae 0x5ee2e0
pop es
add byte [edi - 0x39], bh
cmp eax, ebx
sar dword [edi + 0x5905c578], 1
add al, byte [0xc38345ed]
jl 0x5ee2b8
hlt
imul edi, dword [edi + 0x335efc75], 0x68
adc eax, 0x5149669
mov edi, 0x6ec0ef27
nop
jne 0x5ee31b
pop esi
xor ebp, dword [eax + 0x15]
imul edx, dword [esi + 0x27bf0514], 0x906ec0ef
adc dword [ebp - 0x57], esi
je 0x5ee2b9
cmc
mov edi, 0x265c3939
mov dh, 0x82
bound edx, qword [eax]
sbb byte [edx + 0xc], 0xa2
test al, 0x98
scasb al, byte es:[edi]
test dword [esi - 0x4d], esp
in eax, dx
test eax, 0xb8e0578d
lea ebp, [edi]
inc ebx
lcall 0x3c2a, 0xd615bf76
sbb eax, 0xfb74a86e
xor byte [esi], bh
or esp, ebx
xchg edi, eax
insb byte es:[edi], dx
inc edx
xor edi, dword [ebx - 0x6bc5a47e]
aam 0xa4
or al, 0xb9
nop
inc ebx
dec esi
in al, 0x50
mov bh, 0xbd
sub esp, dword [edi]
xchg esi, ecx
jo 0x5ee33d
ja 0x5ee3d4
movsd dword es:[edi], dword [esi]
mov ah, al
xor al, byte [ecx + 0x589a4b92]
or eax, 0x358cb3e0
or dword [ebp - 0x6b], 0xd334eb0a
or ch, bl
xor al, 0xd3
arpl word [edi + edx*8 + 0x53], di
invalid
invalid

Function at 0x5f9419
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 4], sp
bswap si
mov word [esp], sp
mov esi, 0x412841
mov byte [esp], dl
jmp 0x5ff535
mov byte [esp], 0x7b
push 0x1bcde373
mov esi, dword [esi + 0x1e34d3]
pushfd
jmp fcn.00785945

Function at 0x6069ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.006dc668
setae bh
nop
bswap ebx
movzx di, dl
pop ebx
movsx di, dl
lea edi, [ebx + 0x36a886be]
xchg dword [esp], ebx
mov di, 0xfbb3
push ebx
call fcn.00627756
lea edx, [edx - 0x3de8ea5e]
jmp 0x68c2c9
lea esp, [esp + 0x2c]
je 0x5d7ec1
rdtsc
xchg dl, cl
rdtsc
mov eax, 0x5a1fe4
bswap ecx
not cx
jmp 0x5fa5e3
call fcn.00685890
pushal
jmp 0x5bf531

Function at 0x608da3
Capabilities:
Encode data using xor

Disassembly:
lcall 0x3cfb, 0xa1644c43
pop edi
sub eax, 0xa54eb804
invalid
cld
std
pop edi
mov dh, 0xad
xchg dword [ebx - 4], edi
rcr dword [ebx], 1
std
add cl, byte [esi - 0x38057383]
imul ebx, dword [ebx + 0x500cbb6e], 0x25
loopne 0x608d18
lea edx, [ecx - 0x1fa89aac]
mov ch, 0x42
loope 0x608da5
add dword [ebx - 0x1882b27d], esi
inc ecx
mov esi, 0xf971772c
int3
jne 0x608d66
or al, 0x7d
rcl dword [esi - 0x3306ad13], 0x99
iretd
Function at 0x61153d
Capabilities:
Encode data using xor

Disassembly:
push cs
adc ebp, dword ds:[eax - 0x57]
or al, 0x45
xchg edx, eax
add ch, dh
lodsb al, byte [esi]
push es
jbe 0x61156c
xor eax, 0x774976b5
add eax, 0xd73d288f
lodsb al, byte [esi]
std
cmpsb byte [esi], byte es:[edi]
pop esp
cmp al, 0xe
in eax, dx
int3
mov dword [0xf29908af], eax
mov ch, 0x62
mov ch, 0x62
mov bl, 0x88
xor eax, 0xecbe6409
rol byte [ebx + 0x55a8093c], 0x27
paddusb mm2, qword [ebx]
ficomp word [ebp - 0x46]
add esi, dword [edi + edx*4 + 0x40f6ade2]
dec esp
and al, 0x2f
jno 0x611568
xchg edx, eax
pop ecx
nop
and byte [esi - 0x78], ah
enter 0x7bef, 0x3c
invalid

Function at 0x62396a
Capabilities:
Encode data using xor

Disassembly:
xor dl, byte [ebx + 0x3497ed69]
shr ebx, 1
xchg ebx, eax
imul ebp, ebp, 0xebd13497
sbb cl, byte [esi]
dec esi
push cs
xchg edx, eax
mov ah, 0x95
pop esp
cmp ah, bh
scasb al, byte es:[edi]
add eax, dword [edx - 0x130ddfa5]
inc edi
xchg esi, eax
xor ecx, dword [ebx]
inc edx
lcall 0x9a95, 0x65ac5b44
or byte [ebx - 0x3de2c1d1], dl
xchg ecx, eax
sub dh, 0xb5
push ss
imul eax, dword [eax], 0xffffffce
xchg ebp, eax
sub eax, dword [ecx]
sbb bl, byte [ebx + 0x3be0a529]
jb 0x62396b
push ecx
mov al, 0x50
aad 0x4c
clc
pushfd
and byte [edx + 0x5e], 0xea
mov dl, 0x80
fld qword [ebx]
sbb dh, al
imul edx, edi, 0x98690d25
mov ebx, 0xe48c0809
adc bl, bl
xor bh, byte [edx + eax*2 - 0x25]
mov al, 0x69
mov bh, 0x9a
push ds
dec ecx
push es
cdq
pop edi
adc esp, dword [esi]
aaa
fldl2e
cmp ah, byte [eax + 0x77]
retf

Function at 0x627043
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6259b3
mov esi, dword [esi + 0x140cc2]
jmp 0x5f8d7b
jmp 0x615372

Function at 0x64bc14
Capabilities:
Packed with generic packer

Disassembly:
rcl dword ss:[edi - 0x7449fd46]
pop edi
xchg edi, eax
mov edx, 0x5f8bb602
imul ecx, eax, 0xffffffee
add eax, 0x84aee1d9
xchg edi, eax
lds ebp, [eax - 0x13]
sub dword [eax], esp
clc
pushal
xchg ch, dl
int 0xff
popal
js 0x64bc64
inc edx
jle 0x64bbfa
mov ch, 0x71
xchg esp, eax
fsub st(4), st(0)
sub byte [esi + 0x8335e64], dl
or esp, dword [edx + 0x54]
test al, 0x83
push ebp
mov dh, 0xbd
push edi
mov dl, 0x31
mov bl, byte [ebx]
jne 0x64bbf7
xchg esp, eax
retf
and al, 0x3c
mov bp, word [esp]
push dword [esp]
mov ebp, 0x41e0d8
pushfd

Function at 0x64d726
Capabilities:
Packed with generic packer

Disassembly:
pop edi
mov edx, 0x4ff0f9
movzx di, al
pushal
mov edx, dword [edx + 0x12a50e]
pop edi
mov edi, dword [esp + 8]
call fcn.006869b7

Function at 0x6681b8
Capabilities:
Encode data using xor

Disassembly:
and al, 0x30
add al, 0x24
jo 0x668182
add al, 0x24
enter 0x5c89, 0x24
sub byte [edi], cl
xchg ebx, eax
invalid

Function at 0x673e70
Capabilities:
Encode data using xor

Disassembly:
jae 0x673ed6
inc ecx
push ebx
pmulhw mm2, qword [edi - 0x32ff481f]
sbb eax, 0xce1bce15
xor cl, bl
pop esp
invalid
fcmovnu st(0), st(0)
in eax, 0x32
push eax
and al, bh
fsub st(5)
xor dl, byte [eax + 0x20]
clc
mov byte [ebx], dl
sbb eax, 0x71721e69
jno 0x673f24
fsub qword [ebp - 0x4d9b201]
pop ss
mov edi, 0xc7a39960
fidiv word [ecx - 0x3b0ee30c]
xchg edx, eax
mov ch, 0xfd
aas
mov al, 0x68
aas
jg 0x673ed8
retf
Function at 0x67792c
Capabilities:
Packed with generic packer

Disassembly:
sub dword [edx - 0x1e], ebx
add dword [ebp - 0x3f59300a], esi
adc esp, dword [edx - 0xfe6fdb7]
pop esi
add edx, esp
stosb byte es:[edi], al
fidivr dword [ebx - 0x6e7348f8]
or eax, 0xa98bf520
popal
dec ecx
fldcw word [0xef06b9d8]
inc esi
push ebx
and eax, 0x1a4c8366
pushal
sub dh, bl
dec esi
xchg esi, eax
mov ah, 0x8c
stosb byte es:[edi], al
adc dl, 0x7f
rcr byte [esi - 0x23], cl
cmp esi, ecx
mov esp, esp
invalid

Function at 0x6a9c9b
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0x60
lea esp, [esp + 0x48]
jne 0x64d746
call fcn.00646dbe
xor ecx, ecx
pushal
cmp eax, ebx
push 0xcbcaee04
lea esp, [esp + 0x24]
jp 0x658aa2
pushfd
setne cl
test ah, bh
jmp 0x63035e
pushal
not cl
setne cl
pushfd
pushal
cmp ecx, ebx
push 0x15fb2c8b
jmp 0x5bb3fa
jmp 0x6b4e5f
jmp 0x5ce937

Function at 0x6aa06a
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp], eax
setle ah
mov eax, dword [esp + 4]
push esi
lea eax, [eax + 1]
mov byte [esp], 0x35
mov dword [esp + 8], eax
bswap eax
pushfd
call fcn.0059d0b4

Function at 0x6ad509
Capabilities:
Encode data using xor

Disassembly:
cmp byte [eax - 0x20ff8462], al
dec eax
cmp byte [ebp + 0x357c2c5a], ch

Function at 0x6b590e
Capabilities:
Encode data using xor

Disassembly:
loope 0x6b58b8
cld
pop ecx
jecxz 0x6b5946
wait
imul ah
iretd
cdq

Function at 0x6cdc56
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x605d5e91
pop esp
mov ecx, 0x55517d1b
cld
iretd
jnp 0x6cdca1
pop ds
jmp 0x6cdc47
fsubr dword [eax + ecx*2]
xor edi, esp
and bl, byte [ecx - 0x4898c7a0]
xchg ebp, eax
jnp 0x6cdcb4
pop ebx
mov ebp, 0x3d688b11
adc dword [edx], edx
or dl, 0xa0
in eax, dx
push 0xeb9b0cc4
in al, dx
rcr byte [ebx + 0x3b], cl
xor dword [eax], edx
daa
jl 0x6cdc90
les ecx, [ebx + ebx*4]
jmp 0x6cdc81
dec edx
arpl word [ebp + 0x1d404f7f], bp
xor byte [ebx], cl
fbld tbyte [ebx + 0x2cd82bed]
insb byte es:[edi], dx
dec edi
inc eax
sbb eax, 0xa3df0b30
in eax, dx
sub ebx, eax
sub al, 0x6c
cmp al, 0x3c
or byte [ebx + 0x2d], ch
and eax, 0x516827d2
out 0x2a, al
fld dword [esi + 0x44]
daa
push 0xd92ae651
inc esi
inc esp
jae 0x6cdc75
push ds
mov dword [0x25db6d31], eax
pop edi
out 0x54, al
push ds
fadd dword [ebp - 0x404aa626]
xchg ebx, eax
stosd dword es:[edi], eax
aam 0x37
or dl, al
xor dword [ecx + 0x30], ebp
jns 0x6cdcaf
fldcw word [esi + 0x12a46885]
fcom qword [esi + 0xa519743]
aam 0xf0
ret

Function at 0x6cf667
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x44]
call fcn.00410740
stc
add esp, 0x14
pushal
cmp cx, 0xd07b
pushal
mov dword [esp], eax
mov dword [esp + 0x58], eax
pushfd
cmp si, cx
test eax, eax
mov byte [esp], 0xa4
jmp fcn.00786779
jmp 0x60bac3
Function at 0x780216
Capabilities:
Encode data using xor

Disassembly:
push 0xbe0dd702
push dword [esp]
pushfd
nop
pushal
jmp 0x6b939a
mov byte [esp], ch
push dword [esp]
xchg dword [esp + 8], esi
pushal
mov byte [esp + 4], dh
xchg dword [esp + 0x24], esi
bswap si
mov esi, 0x4963c9
pushal
mov esi, dword [esi + 0x1b65c9]
push dword [esp]
mov byte [esp + 4], 0x78
lea esi, [esi - 0x3b1a9a49]
push dword [esp + 4]
call fcn.00782e58
lea esp, [esp + 0x24]
jl 0x678dd8
pop esi
push 0x74607700
pushal
je 0x639217
xchg dword [esp + 8], esi
pushfd
mov dword [esp + 8], esi
mov dword [esp + 4], 0xf097b008
mov esi, 0x4963c9
lea esp, [esp + 8]
js 0x6d4a57
pushfd
push dword [esp]
mov esi, dword [esi + 0x1b65c9]
call 0x783515
mov si, 0xce7b
pop esi
push edx
jmp 0x6174c5
mov dword [esp + 0x28], eax
push 0x3f5e17e4
mov eax, dword [esp + 0x30]
call fcn.005b5854
pushfd
pushfd
call fcn.0064145a
call fcn.005df27e
mov byte [esp + 0x10], ch
lea esp, [esp + 0x50]
je 0x7801c3
push eax
mov ecx, dword [ecx + 0x20535f]
mov byte [esp], bl
call fcn.00621a00
jmp 0x5e8f5d
loop 0x7801f0
or dl, byte [esi + ebx + 0x6f]
pushfd
invalid
int 0x8e
fbstp tbyte [ecx + edi*2 + 0x51]
cmp dword [ebx + 0x84f2ddd], edx
jno 0x780245
test eax, 0xdb08807d
daa
and edi, edi
xchg edi, eax
mov eax, dword [0xf072a16e]
lds ebx, [ecx + 0xcaabb6f]
in al, 0xc4
imul edi, dword [esi], 0xffffff88
invalid
xchg esp, eax
jo 0x780234
sbb ah, ch
clc
sub al, 0xac
and dword [edx], eax
invalid

Function at 0x785909
Capabilities:
Packed with generic packer

Disassembly:
in eax, 0x85
adc ebp, edi
retf
dec ebp
pop ebx
push edi
sbb eax, 0x4cff3da1
or al, ah
push ebp
sub al, 0x4b
jae 0x7858da
push esp
mov eax, dword [0xa04571c4]
test byte [ebp + 0xdfdb15f], 0x5e
mov cl, 0x63
arpl word [edx + 0x2e0b41de], bx
js 0x78584e
std
and byte [edx - 0x58], ch
push ebp
test eax, 0x8ce31063
xchg ebx, eax
jo 0x7858c8
outsb dx, byte [esi]
jbe 0x785875
jnp 0x785901
rcr dword [esi + eax*4], 4
in eax, 0x32
mov al, byte [0x75d38966]
dec edx
sahf
invalid
dec edi
cdq
sbb eax, 0x72e3df0
out dx, al
xor byte [esi + 0x2e], ah
jnp 0x78590c
sbb bl, 0x30
hlt
les ebp, [0x3a1b052e]
add ch, byte [ebx + 0x54]
cmpsd dword [esi], dword es:[edi]
rcl byte [edi + eax*2 - 0x69cbea57], 0x69
lodsb al, byte [esi]
xor esp, dword [ecx - 0x5e31de14]
xor al, 0x96
imul ebp, dword [ebx + esi - 0x31de135f], 0x3090b6a1
mov dh, 0x90
xor byte [ebx - 0x74], dh
dec ebp
int 0xa1
inc ecx
stosb byte es:[edi], al
xor eax, 0x2a769e22
invalid
sahf
jbe 0x78592d
jbe 0x78592d
call esp
add eax, 0x8c1ee8c
mov ch, 0x8a
mov edi, 0xdd90c378
rcr byte [esi], 1
mov al, 0xd4
daa
pop es
dec ebx
sub dh, ch
and dword [ecx + 0x70], ebx
inc esp
xor al, 0x14
inc edx
mov ah, 0x21
movsb byte es:[edi], byte [esi]
push es
fcmovnbe st(0), st(6)

Function at 0x78591e
Capabilities:
Packed with generic packer

Disassembly:
sbb edi, dword [edi - 0x62b0e934]
add ebx, edx
xchg ecx, eax
cmp byte [esi + edx + 0x345cb9a1], cl
adc al, 0x42
mov dword [ecx - 0x2924f95c], esi
jge 0x785989
invalid

Function at 0x786ed3
Capabilities:
Packed with generic packer

Disassembly:
jne 0x786f23
test dword [ebx + esi*8 + 0x44], 0x7d33fca5
inc edi
Function at 0x407570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
mov dword [ebp - 0x38], 0xa03
mov dword [ebp - 0x34], 0x6976
mov dword [ebp - 0x30], 0x11a6
mov dword [ebp - 0x2c], 0x1df7
mov dword [ebp - 0x24], 0x2d66
mov dword [ebp - 0x1c], 0x7f27
mov dword [ebp - 0x14], 0x1588
mov dword [ebp - 4], 0x32d2
mov dword [ebp - 0x10], 0x5bf0
mov dword [ebp - 0xc], 0x5c47
mov dword [ebp - 8], 0x6b7e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
imul eax, ecx
mov ecx, dword [ebp - 0x24]
and eax, edx
sub eax, ecx
add eax, 0x41fda75b
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
add edx, 0x1e80
and edx, eax
mov eax, dword [ebp - 4]
xor edx, 0x711a
or edx, ecx
imul edx, edx, 0x39fc
xor edx, 0x5de89929
cmp eax, edx
jbe 0x4076dd
mov dword [ebp - 0x40], 0xfe5
mov dword [ebp - 0x3c], 0x792d
mov dword [ebp - 0x18], 0x5d90
mov dword [ebp - 0x14], 0xf79
mov dword [ebp - 0x20], 0xd0f24f09
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x28], 0x4c9b
mov dword [ebp - 0x24], 0x48e1
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
push ebx
push eax
or edx, 0x7998
or ecx, 0x1c0e
push edx
push ecx
call fcn.004065ae
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
xor eax, ecx
mov ecx, dword [ebp - 0x40]
xor edx, ebx
mov ebx, dword [ebp - 0x3c]
sub eax, ecx
sbb edx, ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
imul edx, eax
mov eax, dword [ebp - 0x38]
or edx, ecx
lea ecx, [edx + eax - 0x2d83]
and ecx, 0x745f
mov eax, 0x32f7509b
mul ecx
shr edx, 0xc
sub dword [ebp - 4], edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
add edx, 0x1e80
and edx, eax
mov eax, dword [ebp - 4]
xor edx, 0x711a
or edx, ecx
imul edx, edx, 0x39fc
xor edx, 0x5de89929
cmp eax, edx
ja 0x40760f
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4078c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov eax, 0xd62
mov word [ebp - 0x20], ax
mov ecx, 1
mov word [ebp - 0x1c], cx
mov edx, 0x27a2
mov word [ebp - 0x18], dx
mov eax, 0x5e2a
mov word [ebp - 8], ax
mov ecx, 0x3dd4
mov word [ebp - 0x14], cx
mov edx, 0x1730
mov word [ebp - 0x10], dx
mov eax, 0x48b2
mov word [ebp - 0xc], ax
mov ecx, 0x30da
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
movzx ecx, word [ebp - 0xc]
mov eax, 0x2678
and dx, ax
movzx eax, word [ebp - 0x10]
imul dx, cx
movzx ecx, word [ebp - 0x14]
or dx, ax
imul dx, cx
mov eax, 0x6fac
mov ecx, 0x35af
xor edx, 0xa5c1
mov word [ebp - 4], dx
movzx edx, word [ebp - 8]
xor dx, ax
movzx eax, word [ebp - 4]
add dx, cx
cmp ax, dx
je 0x407a1e
mov dword [ebp - 0x38], 0x2da7
mov dword [ebp - 0x34], 0x556b
mov dword [ebp - 0x28], 0x166
mov dword [ebp - 0x24], 0x5ad4
mov dword [ebp - 0x30], 0x2bb0
mov dword [ebp - 0x2c], 0x198
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, 0x30a3
sub eax, ecx
mov ecx, 0xffffc544
sbb ecx, edx
mov edx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
add eax, edx
push 0x5c56
adc ecx, ebx
push 0x519
and ecx, 0x7f0d
and eax, 0x50bd
push ecx
push eax
call fcn.004065b4
mov ecx, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x34]
and eax, ecx
mov dword [ebp - 0x40], eax
and edx, ebx
mov dword [ebp - 0x3c], edx
movzx edx, word [ebp - 0x18]
movzx ecx, word [ebp - 0x1c]
mov eax, 0xdc4
add dx, ax
movzx eax, dx
cdq
idiv ecx
movzx edx, word [ebp - 0x20]
movzx ecx, word [ebp - 4]
sub eax, 0x42c7
add ax, dx
add eax, ecx
mov word [ebp - 4], ax
movzx edx, word [ebp - 8]
mov eax, 0x6fac
xor dx, ax
mov ax, word [ebp - 4]
mov ecx, 0x35af
add dx, cx
cmp ax, dx
jne 0x40795d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x48], 0x2c13
mov dword [ebp - 0x44], 0x39ac
mov dword [ebp - 0x40], 0x1536
mov dword [ebp - 0x3c], 0x196
mov dword [ebp - 0x20], 0x21cf
mov dword [ebp - 0x1c], 0x7c47
mov dword [ebp - 0x18], 0x5b76
mov dword [ebp - 0x14], 0x3aa7
mov dword [ebp - 0x10], 0x8be5e96b
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x30], 0x56330fb1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x3dfb
mov dword [ebp - 0x24], 0xb1a
mov dword [ebp - 8], 0x2771
mov dword [ebp - 4], 0x1d8c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
push ebx
push esi
mov esi, dword [ebp - 0x24]
or eax, edx
mov edx, dword [ebp - 0x30]
or ecx, esi
mov esi, dword [ebp - 0x2c]
xor eax, 0x52cf
xor ecx, 0x48bf
push esi
add eax, 0xffffad40
push edx
adc ecx, 0xffffcd48
push ecx
push eax
call fcn.004065ae
push 0x2f95
push 0x76f8
push edx
push eax
call fcn.004065b4
add eax, 0xf80d91aa
mov dword [ebp - 8], eax
adc edx, 0xfd40463b
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
push ecx
push eax
push esi
push edx
call fcn.004065ae
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
add eax, 0xffffe656
adc edx, 0xffffae17
xor eax, ecx
mov ecx, dword [ebp - 8]
xor edx, esi
add eax, 0x2a4ef420
adc edx, 0x115a3066
cmp dword [ebp - 4], edx
ja 0x407fd2
jb 0x407ec4
cmp ecx, eax
jae 0x407fd2
mov esi, 0xb1
mov dword [ebp - 0x38], 0x734b
mov dword [ebp - 0x34], 0x25d1
mov dword [ebp - 0x28], 0x36e6
mov dword [ebp - 0x24], 0xc0c
mov dword [ebp - 0x30], 0x321
push 0x5b31
mov dword [ebp - 0x2c], esi
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
push 0x38db
push eax
push edx
call fcn.004065b4
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
and eax, ecx
mov ecx, dword [ebp - 0x38]
and edx, ebx
mov ebx, dword [ebp - 0x34]
push ebx
push ecx
push edx
push eax
call fcn.004065b4
push 0x5058
push 0x8d62efe4
or edx, 0x46b0
or eax, 0x7239
push edx
push eax
call fcn.004065ae
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x44]
push ebx
push ecx
or eax, 0xffffd402
or edx, 0x4b06
push eax
push edx
call fcn.004065b4
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 4]
and edx, 0x6403
and eax, 0x180
add eax, ecx
adc edx, ebx
add eax, 0xffffff01
mov dword [ebp - 8], eax
adc edx, 0xffffdffd
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
push eax
push edx
push ebx
push ecx
call fcn.004065ae
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
add eax, 0xffffe656
adc edx, 0xffffae17
xor eax, ecx
mov ecx, dword [ebp - 8]
xor edx, ebx
add eax, 0x2a4ef420
adc edx, 0x115a3066
cmp dword [ebp - 4], edx
jb 0x407ec9
ja 0x407fd2
cmp ecx, eax
jb 0x407ec9
pop esi
pop ebx
mov esp, ebp
pop ebp
ret