joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec670
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8f000]
mov dword [edi + 0xcf740], 0xb204d659
push edi
jmp 0x4ec69a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ec6a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec690
mov eax, 1
add ebx, ebx
jne 0x4ec6b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ec6c4
jne 0x4ec6e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec6e3
dec eax
add ebx, ebx
jne 0x4ec6d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ec6a8
add ebx, ebx
jne 0x4ec6df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ec735
xor ecx, ecx
sub eax, 3
jb 0x4ec6fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ec76a
sar eax, 1
mov ebp, eax
jmp 0x4ec706
add ebx, ebx
jne 0x4ec706
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec6d4
inc ecx
add ebx, ebx
jne 0x4ec714
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec6d4
add ebx, ebx
jne 0x4ec721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ec716
jne 0x4ec732
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ec716
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ec754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ec746
jmp 0x4ec696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ec754
add edi, ecx
jmp 0x4ec696
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ec772
cmp byte [edi], 0x11
jne 0x4ec772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ec777
lea edi, [esi + 0xe5000]
mov eax, dword [edi]
or eax, eax
je 0x4ec7ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf2d48]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf2ec4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ec7a4
mov ecx, edi
jns 0x4ec7d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf2ec8]
or eax, eax
je 0x4ec7e9
mov dword [ebx], eax
add ebx, 4
jmp 0x4ec7c1
call dword [esi + 0xf2ed8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4ec820
cmp al, 0xef
ja 0x4ec813
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4ec7f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4ec802
mov ebp, dword [esi + 0xf2ecc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ec854
sub esp, 0xffffff80
jmp 0x420577
Function at 0x412590
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x4125aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4125b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4125a0
mov eax, 1
add ebx, ebx
jne 0x4125c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4125b8
jne 0x4125d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4125b8
xor ecx, ecx
sub eax, 3
jb 0x4125e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41265a
mov ebp, eax
add ebx, ebx
jne 0x4125f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412600
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x412624
inc ecx
add ebx, ebx
jne 0x412610
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x412605
jne 0x412621
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412605
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x412644
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x412635
jmp 0x4125a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x412644
add edi, ecx
jmp 0x4125a6
pop esi
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x4126ac
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12708]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x127c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x412661
mov ecx, edi
jns 0x412690
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x127cc]
or eax, eax
je 0x4126a6
mov dword [ebx], eax
add ebx, 4
jmp 0x41267e
call dword [esi + 0x127c8]
mov ebp, dword [esi + 0x127d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4126e0
sub esp, 0xffffff80
jmp 0x403ac6

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x7c5058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7c51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7c507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c506a
add dl, dl
jne 0x7c5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c50dc
xor eax, eax
add dl, dl
jne 0x7c5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c517d
add dl, dl
jne 0x7c50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7c50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7c5075
mov eax, 1
add dl, dl
jne 0x7c50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c50e1
sub eax, ebx
mov ebx, 1
jne 0x7c5128
mov ecx, 1
add dl, dl
jne 0x7c510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7c513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c5136
cmp eax, 0x7d00
jae 0x7c516d
cmp eax, 0x500
jb 0x7c5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
cmp eax, 0x7f
ja 0x7c5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7c519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7c5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4e6620
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x86000]
push edi
jmp 0x4e663a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e6641
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e6630
mov eax, 1
add ebx, ebx
jne 0x4e6653
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e6664
jne 0x4e6683
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e6683
dec eax
add ebx, ebx
jne 0x4e6670
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e6648
add ebx, ebx
jne 0x4e667f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e66d5
xor ecx, ecx
sub eax, 3
jb 0x4e669b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e670a
sar eax, 1
mov ebp, eax
jmp 0x4e66a6
add ebx, ebx
jne 0x4e66a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e6674
inc ecx
add ebx, ebx
jne 0x4e66b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e6674
add ebx, ebx
jne 0x4e66c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e66b6
jne 0x4e66d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e66b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e66f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e66e6
jmp 0x4e6636
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e66f4
add edi, ecx
jmp 0x4e6636
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e6712
cmp byte [edi], 0x11
jne 0x4e6712
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e6717
lea edi, [esi + 0xdf000]
mov eax, dword [edi]
or eax, eax
je 0x4e678f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeae6c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb010]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e6744
mov ecx, edi
jns 0x4e6773
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb018]
or eax, eax
je 0x4e6789
mov dword [ebx], eax
add ebx, 4
jmp 0x4e6761
call dword [esi + 0xeb014]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e67c0
cmp al, 0xef
ja 0x4e67b3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e6795
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e67a2
mov ebp, dword [esi + 0xeb01c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e67f4
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x6d4d3533
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x6d4d3542
pop dword [ebp - 0x44]
mov eax, 0x9951072e
add eax, 0xd3fc2e14
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xb37b2d5d
sub dword [ebp - 0x54], 0x6528e812
mov dword [ebp - 0x50], 0xf893fe56
sub dword [ebp - 0x50], 0xc660b211
mov dword [ebp - 0x4c], 0x4c029c0d
add dword [ebp - 0x4c], 0x49a821
mov dword [ebp - 0x48], 0x9db3256e
sub dword [ebp - 0x48], 0x9db3256e
lea eax, [ebp - 0x54]
push eax
mov eax, 0x768a6ccf
add eax, 0xf6c47379
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xe4ee5b37
add dword [ebp - 0x54], 0x8f840e1f
mov dword [ebp - 0x50], 0xd9409a27
add dword [ebp - 0x50], 0x682bc74e
mov dword [ebp - 0x4c], 0xb5caebc0
add dword [ebp - 0x4c], 0xada480ac
mov dword [ebp - 0x48], 0xec5a04c8
add dword [ebp - 0x48], 0x13a5fb38
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x3195dc9b
sub eax, 0xc446fc47
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x40d1e
push 0
call eax
mov ecx, 0x5198
mov edi, eax
mov esi, 0x1239f124
add esi, 0x5b15aadc
add esi, dword [ebp - 0x44]
mov ebx, 0xc3deec91
sub ebx, 0x8dcb0f1b
sub dword [ebp - 0x14], ecx
mov edx, dword [esi]
sub edx, ebx
xor dword [ebp - 0x18], ebx
mov dword [edi], edx
sub dword [ebp - 0x3c], 0xcad9fcf6
add edi, 0xea6132ee
add edi, 0x159ecd16
add esi, 4
loop 0x6d4d365e
add eax, 0xf1aabf1d
sub eax, 0xf1a985ea
mov ebx, eax
add eax, 5
mov ecx, 0x6d4d0000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1df42270
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7a1103be
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x41492f
Capabilities:
Encode data using xor

Disassembly:
loop 0x41497f
and al, byte [eax + 0x24]
sbb esi, dword [edi + 0xf8aa4f1]
mov edi, dword [edx]
push ebp
jecxz 0x414965
test byte [eax + 0x30f9e2c7], bh
hlt
sar byte [ebp + 0x5f], 0x8f
shl dword [esp + eax*8], 0xbd
scasd eax, dword es:[edi]
and bl, byte [edi]
invalid
dec ebx
xor byte [edx + ebp*4 - 0x1a8517f9], 0xcf
popfd
push ebx
fisttp word [eax + 0x727ded3a]
pop eax
inc eax
das
rcl byte [ebx + 0x6a635d38]
add dword [ecx + 0x7b130dc4], ebx
mov dl, 0x10
imul dword [esi + 0x5f]
mul byte [ebp - 0x5120c160]
xor ecx, dword [edi + 0x18297fde]
jns 0x414965
pop esi
xchg ebx, eax
or eax, 0x619af7cc
shr dword [ebx], cl
sar byte [edi + ebx*4 - 0x1a], 1
jle 0x4149fe
mov esi, 0xfbbd740e
xchg byte [ebx], ch
sbb al, 0x48
iretd
mov bh, 0x69
push edi
neg dword [ebp + 0x27a43aa3]
imul edx, dword [edi - 9], 0xa43aa39d
daa
push 0xfffffffffffffff3
adc bl, byte [edx + 0x4a]
mov bh, 0xd5
scasd eax, dword es:[edi]
mov bl, bl
push eax
adc cl, bh
sub eax, 0x4662722f
sbb edx, dword [eax - 0x5f]
std
jge 0x414a7b
jecxz 0x414a23
xchg edx, eax
add eax, 0xddbcacb5
cli
aaa
arpl word [eax], di
movsb byte es:[edi], byte [esi]
or byte [ecx - 0x2cfbcb08], dh
push es
mov ch, 0xac
mov esp, 0x6337fadd
cmp byte [eax + ecx + 0x434f8b1], ah
rol dword [esi], cl
cmpsb byte [esi], byte es:[edi]
call 0xfe933bae
fild dword [edx]
pop ebx
add al, 0xe0
into
adc bh, byte [ebp + 0x1089531d]
wait
mov byte [0x493d9cf0], al
adc ah, ch
int1
or ch, byte [ebx + 0x23]
faddp st(6)
mov ebp, 0xa04e4df7
jbe 0x4149ff
xchg esp, eax
push ebp
add dh, bh
jp 0x414a6e
popfd
dec esp
dec ecx
sub al, byte [eax + 0x1a2ba17b]
mov cs, word [edx - 0x1e]
or dword [eax + 0x1e], ebx
pop eax
push ds
add eax, 0xb9f25475
xor dl, byte [edx]
into
push esp
mov ecx, 0xce3e1232
invalid
insd dword es:[edi], dx
fcomi st(1)
int1
dec ebp
jbe 0x414ac5
rcr byte [0x7048305d], cl
popfd
ja 0x414a96
in eax, 0x23
inc dl
mov al, 0x64
test al, 0x45
imul esp, dword [esi + 0x2a], 0xdfd3f406
insb byte es:[edi], dx
sub edi, 0x6adb5786
adc al, 0x3a
out dx, al
jmp 0x414aa5
push es
hlt
invalid
cmp al, 0xd8
xor dh, byte [ebp - 0x3f]
movsd dword es:[edi], dword [esi]
out dx, al
or al, al
mov al, 0x7e
xchg bh, al
out 0x46, al
int 0x8d
ja 0x414a72
enter 0xffffffffffffc7af, 0xffffffffffffffdf
in al, 0x10
xchg ebp, eax
inc ebp
mov al, byte [0x6b0ed09f]
or cl, ch
jp 0x414a93
iretd
Function at 0x4047d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426410
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x432080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0040e20e
mov edi, eax
add esp, 4
test edi, edi
je 0x40487d
push 1
mov dword [ebp - 4], 0
call fcn.0040d3ca
add esp, 4
mov dword [edi + 4], eax
jmp 0x40487f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.004090b0
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x433198]
mov ecx, dword [0x43319c]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x40a9c1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40a9b0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x40b4e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426bbd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x432080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0040e20e
mov edi, eax
add esp, 4
test edi, edi
je 0x40b57d
push 1
mov dword [ebp - 4], 0
call fcn.0040d3ca
add esp, 4
mov dword [edi + 4], eax
jmp 0x40b57f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.00404510
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x40b5da
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x40b5da
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x40b5f6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40b619
cmp byte [ebp + 0xc], 0
je 0x40b605
push esi
call fcn.0040d9be
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40b625
mov esi, str.ios_base::badbit_set
jmp 0x40b635
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.0040b660
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.00405020
push 0x430e9c
lea eax, [ebp - 0x28]
push eax
call fcn.0040f2ed
int3

Function at 0x40eb24
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40eb63
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40eb63
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40eb63
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40eb63
cmp dword [ecx + 0x74], 0xe
jbe 0x40eb63
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x419225
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42b218
push 0x42b210
push str.FlsAlloc
push 0x1f
call fcn.00419090
mov esi, eax
add esp, 0x10
test esi, esi
je 0x419259
push dword [ebp + 8]
mov ecx, esi
call dword [0x427138]
call esi
jmp 0x41925f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4192a3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42b228
push 0x42b220
push str.FlsGetValue
push 0x21
call fcn.00419090
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4192da
push dword [ebp + 8]
mov ecx, esi
call dword [0x427138]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4192e2
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42b230
push 0x42b228
push str.FlsSetValue
push 0x22
call fcn.00419090
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41931c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x427138]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]