joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f0b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421de8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x1c]
push 0x42b468
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004097b0
add esp, 8
lea ecx, [ebp - 0x18]
push 0x42b4cc
push ecx
mov byte [ebp - 4], 1
call fcn.004097b0
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [section..data_1]
mov eax, dword [edx + 0xc]
mov ecx, section..data_1
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push 0x6a
mov byte [ebp - 4], 3
call fcn.00406ea0
add esp, 4
cmp eax, ebx
je 0x40f141
push eax
lea eax, [ebx + 0x6a]
lea edi, [ebp - 0x14]
call fcn.004069f0
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx - 0xc], ebx
je 0x40f1cd
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], ebx
je 0x40f1cd
cmp dword [esi - 0xc], ebx
je 0x40f1cd
xor eax, eax
mov dword [ebp - 0x14], eax
nop
cmp eax, 2
jge 0x40f1cd
xor ecx, ecx
cmp eax, ebx
setne cl
push 2
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
add ecx, 0x80000001
mov dword [ebp - 0x20], ebx
call fcn.0040eff0
test eax, eax
jne 0x40f1b1
mov edi, dword [ebp - 0x18]
cmp esi, ebx
je 0x40f1b1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push ebx
push edi
mov edi, dword [ebp - 0x28]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40f1b4
mov edi, dword [ebp - 0x28]
cmp edi, ebx
je 0x40f1c2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
jmp 0x40f160
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40f1ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f210
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f232
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4013dd
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edx, ax
mov ecx, 0x40e00c
xor eax, eax
movzx edi, dx
mov esi, ecx
cmp edi, dword [esi]
je 0x401401
inc eax
add esi, 0x10
cmp eax, 0x11
jb 0x4013f4
cmp eax, 0x11
jne 0x401427
mov esi, 0x3ff
xor eax, eax
and edx, esi
push ebx
mov di, word [ecx]
mov ebx, esi
and di, bx
cmp dx, di
je 0x401426
inc eax
add ecx, 0x10
cmp eax, 0x10
jb 0x401410
pop ebx
pop edi
pop esi
ret
Function at 0x40145c
Capabilities:
Accept command line arguments
Check os version
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push edi
push str.SetDllDirectoryA
mov edi, str.kernel32.dll
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x40148f
push 0x40a1cc
call eax
cmp byte [ebp + 0x10], 0
je 0x4015c0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 4], 3
mov dword [ebp + 0x10], eax
jl 0x4015ad
push dword [eax + 4]
push str._stdio
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4015ad
push eax
push eax
push 4
push eax
push eax
mov eax, dword [ebp + 0x10]
push 0xc0000000
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4014f8
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x11c
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.00401f60
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 0xa
sbb al, al
inc al
mov byte [ebp + 0x13], al
je 0x40155c
push str.AllocConsole
push edi
call ebx
push eax
call esi
test eax, eax
je 0x40155c
call eax
push 0
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0xfffffffffffffff6
call esi
test eax, eax
je 0x4014f0
push dword [ebp - 8]
push 0xfffffffffffffff5
call esi
test eax, eax
je 0x4014f0
cmp byte [ebp + 0x13], 0
je 0x4015c0
push 0
push dword [ebp - 8]
call fcn.00401e44
push 0x40bf74
push eax
call fcn.004018df
add esp, 0x10
push 1
push eax
call fcn.004018ad
pop ecx
push eax
call fcn.004017a0
pop ecx
pop ecx
jmp 0x4015c0
push str.AttachConsole
push edi
call ebx
push eax
call esi
test eax, eax
je 0x4015c0
push 0xffffffffffffffff
call eax
and dword [ebp - 4], 0
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040107e
mov edi, eax
xor esi, esi
add esp, 0x10
cmp edi, esi
je 0x401608
call fcn.004013dd
push esi
push 0x30
push str.Adobe_AIR
push esi
push eax
call fcn.0040142a
pop ecx
pop ecx
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxExW]
mov eax, edi
jmp 0x401612
push dword [ebp + 0x10]
push esi
call ebx
push eax
call dword [ebp - 4]
push eax
jmp 0x4014f2

Function at 0x4047d3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e754]
jne 0x4047dd
repz ret
jmp fcn.00406e81
Function at 0x4050cf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403cfa
and dword [ebp - 4], 0
cmp dword [0x40f62c], 0
mov ebx, eax
jne 0x405180
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405231
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405231
push eax
call fcn.00403c88
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40f62c], eax
call esi
push eax
call fcn.00403c88
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40f630], eax
call esi
push eax
call fcn.00403c88
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40f634], eax
call esi
push eax
call fcn.00403c88
pop ecx
mov dword [0x40f63c], eax
test eax, eax
je 0x405180
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403c88
pop ecx
mov dword [0x40f638], eax
mov eax, dword [0x40f638]
cmp eax, ebx
je 0x4051d8
cmp dword [0x40f63c], ebx
je 0x4051d8
push eax
call fcn.00403d03
push dword [0x40f63c]
mov esi, eax
call fcn.00403d03
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4051d8
test edi, edi
je 0x4051d8
call esi
test eax, eax
je 0x4051cf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4051cf
test byte [ebp - 0xc], 1
jne 0x4051d8
or dword [ebp + 0x10], 0x200000
jmp 0x405211
mov eax, dword [0x40f630]
cmp eax, ebx
je 0x405211
push eax
call fcn.00403d03
pop ecx
test eax, eax
je 0x405211
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405211
mov eax, dword [0x40f634]
cmp eax, ebx
je 0x405211
push eax
call fcn.00403d03
pop ecx
test eax, eax
je 0x405211
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f62c]
call fcn.00403d03
pop ecx
test eax, eax
je 0x405231
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405233
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40338f
Capabilities:
Check os version

Disassembly:
sub esp, 0x2d4
push ebx
push esi
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xbfffffff
cmp ax, 6
mov dword [0x47aeec], eax
je 0x4033df
push ebx
call fcn.00406694
cmp eax, ebx
je 0x4033df
push 0xc00
call eax
jmp 0x40a622
Function at 0x414ea9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d1e3
xor ebx, ebx
cmp dword [0x4244a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x414f7e
push 0x41cb84
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414ee9
xor eax, eax
jmp 0x415042
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41cb78
push edi
call esi
cmp eax, ebx
je 0x414ee2
push eax
call fcn.0040d180
mov dword [esp], 0x41cb68
push edi
mov dword [0x4244a8], eax
call esi
push eax
call fcn.0040d180
mov dword [esp], 0x41cb54
push edi
mov dword [0x4244ac], eax
call esi
push eax
call fcn.0040d180
mov dword [0x4244b0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040f271
test eax, eax
pop ecx
pop ecx
je 0x414f4c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040cfe1
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x414f7e
push 0x41cb38
push edi
call esi
push eax
call fcn.0040d180
cmp eax, ebx
pop ecx
mov dword [0x4244b8], eax
je 0x414f7e
push 0x41cb20
push edi
call esi
push eax
call fcn.0040d180
pop ecx
mov dword [0x4244b4], eax
mov eax, dword [0x4244b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x414ff7
cmp dword [0x4244b8], esi
je 0x414ff7
push eax
call fcn.0040d1ec
pop ecx
call eax
cmp eax, ebx
je 0x414fc4
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4244b8]
call fcn.0040d1ec
pop ecx
call eax
test eax, eax
je 0x414fc4
test byte [ebp - 0x18], 1
jne 0x414ff7
lea eax, [ebp - 0xc]
push eax
call fcn.0040f2a8
test eax, eax
pop ecx
je 0x414fdf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040cfe1
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x414fee
or dword [ebp + 0x10], 0x200000
jmp 0x415028
or dword [ebp + 0x10], 0x40000
jmp 0x415028
mov eax, dword [0x4244ac]
cmp eax, esi
je 0x415028
push eax
call fcn.0040d1ec
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x415028
mov eax, dword [0x4244b0]
cmp eax, esi
je 0x415028
push dword [ebp - 4]
push eax
call fcn.0040d1ec
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4244a8]
call fcn.0040d1ec
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ed76
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x40eae0
sub ebx, 1
sub eax, 0xf5e8e6f2
call fcn.0040edb2
inc eax
mov eax, eax
xor dword [esi], edi
sub ebx, 0x3bb08a7e
dec eax
add esi, 1
dec eax
or eax, ebx
cmp esi, ecx
jne fcn.0040ed76
sub eax, 0x30a51b35
add ebx, 0x54f52ab6
ret
Function at 0x165d108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0165d258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x165d12e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x165d11a
add dl, dl
jne 0x165d139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x165d18c
xor eax, eax
add dl, dl
jne 0x165d146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x165d22d
add dl, dl
jne 0x165d155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x165d160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x165d16b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x165d176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x165d182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x165d125
mov eax, 1
add dl, dl
jne 0x165d19a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x165d1a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x165d191
sub eax, ebx
mov ebx, 1
jne 0x165d1d8
mov ecx, 1
add dl, dl
jne 0x165d1be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x165d1c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x165d1b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x165d125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x165d1ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x165d1fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x165d1e6
cmp eax, 0x7d00
jae 0x165d21d
cmp eax, 0x500
jb 0x165d218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x165d125
cmp eax, 0x7f
ja 0x165d220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x165d125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x165d24e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x165d125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xc2e000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xc2e00a
jmp 0xc3000f
jmp fcn.00936058
Function at 0x402060
Capabilities:
Encode data using xor

Disassembly:
push ebp
lodsd eax, dword [esi]
in al, dx
sub esp, 0xbc
mov eax, dword [ebp + 8]
test dword [edi - 0x74a6ede9], ebp
dec ecx
jge 0x402075
mov dword [0x8fb8a0], eax
mov dword [0x4441e1d6], edx
jmp 0x40208d
push ebx
mov ebx, dword [0x82a30bc0]
push esi
push edi
mov edi, dword [0x410bac]
sub eax, ebx
sbb ebx, esp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebp
cmp dh, byte [sym.imp.MSVCRT.dll_printf]
inc esi
insd dword es:[edi], dx
push 0x68
mov ah, 0x17
inc eax
add ah, bl
lodsd eax, dword [esi]
cmp dl, al
jecxz 0x4020ba
fstp qword [ebp - 0x30]
call esi
push 0x4113e0
pop esp
cwde
fild word [eax]
call esi
in al, dx
add byte [eax], bl
inc ecx
add byte [eax + 0x68], dl
mov byte [0x460040df], al
salc
xor eax, dword [ebx]
mov sp, word [ecx + 0x41d9f4]
push ecx
push str.Server_Port:_____________hu_n
call esi
push 0x40d431
xchg ecx, eax
salc
pop ebx
adc eax, 0x4104e4
push edx
test eax, str.Document_Path:___________s_n
call esi
cmc
mov edx, 0x50004102
sbb al, 0xa9
inc eax
add bh, bh
salc
daa
xor byte [edi], 0x40
add bh, bh
salc
mov ecx, dword [0x4d40d018]
push ecx
push str.Concurrency_Level:_______d_n
sti
wait
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
push edx
push eax
push 0x7408e0d
pop ss
salc
mov edx, edi
xlatb
lodsb al, byte [esi]
add al, byte [ecx - 0x42]
add esp, 0x48
push ecx
std
mov esp, 0x8e0040de
salc
mov ecx, dword [ebp + 0xa4cb2b]
push edx
push 0x414f42a0
call esi
mov eax, dword [0x41ac8f]
add esp, 0x10
test eax, eax
je 0x40217e
mov eax, dword [0x410244]
mov ecx, dword [0x415ac0]
adc eax, 0x4102c8
stosd dword es:[edi], eax
mov esp, es
add al, byte [ecx + 0x26]
aam 0x52
push eax
push 0x7bb9de37
dec ecx
salc
jmp 0x402130
mov ecx, dword [0x3b4102bc]
push ecx
push 0x401e48
call esi
add bh, bh
salc
mov eax, dword [0x6e4102d6]
add esp, 8
test eax, eax
je 0x4021a3
xor ebp, dword [ecx]
sub al, 0xde
inc eax
add bh, bh
salc
mov ah, 0xd2
jae 0x40220d
add al, byte [ecx]
test edi, ecx
scasd eax, dword es:[edi]
adc dword [ebp + 0x15], ecx
mov al, 0x42
inc ecx
add byte [edx + 0x68], dl
fiadd word [eax]
push dword [edi + 7]
imul ecx, dword [eax], 0x419294a1
add al, 0x8b
adc dword [eax + 0x50de4137], 0x51
push str.Total_PUT:_______________I64d_n
call esi
jo 0x402189
add ah, byte [ecx - 0x7cf33b7d]
clc
add dword [ebp + 0x17], esi
mov edi, dword [esp]
pop ebx
jb 0x4021e4
shl byte [eax + 0x52004102], 0x31
mov al, byte [0x40a1a0]
salc
add esp, 0xc
cmp dword [0x410260], 2
jne 0x402216
mov ecx, dword [0x4102a4]
mov edx, 0x411f06e6
add byte [ecx + 0x52], dl
jo 0x40225c
dec esi
fld qword [eax]
call esi
cmp edi, 0x71
mov eax, dword [0x41029c]
mov ecx, dword [0x17410298]
push eax
push ecx
push 0x402480
call esi
fld qword [ebp - 0x30]
fsub qword [eax]
xor dl, al
inc eax
dec ebx
dec edx
les ecx, [edi + ebx*8]
loopne 0x40222f
invalid
add byte [eax + 0x41fc2b05], 0
fmul qword [ebp - 0x30]
fstp qword [esp]
push 0x406b50
call esi
fist dword [esi]
sbb al, dl
inc eax
add byte [ebx + 0x4df44151], al
rcr ah, 1
or eax, 0x6597c220
invalid
Function at 0x413200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.EYZtqSKO
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x413222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413218
mov eax, 1
add ebx, ebx
jne 0x41323b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413230
jne 0x41324c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413230
xor ecx, ecx
sub eax, 3
jb 0x413260
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4132d2
mov ebp, eax
add ebx, ebx
jne 0x41326b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41329c
inc ecx
add ebx, ebx
jne 0x413288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41327d
jne 0x413299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41327d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4132bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4132ad
jmp 0x41321e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4132bc
add edi, ecx
jmp 0x41321e
pop esi
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x41331b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x130b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1311c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4132d9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13124]
or eax, eax
je 0x413315
mov dword [ebx], eax
add ebx, 4
jmp 0x4132f6
call dword [esi + 0x13120]
mov ebp, dword [esi + 0x13128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41334f
sub esp, 0xffffff80
jmp section.WZqkObwJ

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x5d6b6977
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x6a734755
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40ba10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x791078
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x30], 0
mov ebx, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, ebx
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x40ba96
cmp ebp, ebx
jbe 0x40ba6b
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push ebx
push eax
lea eax, [esp + 0x40]
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push edi
push esi
call fcn.00405fc0
jmp 0x40bae5
jae 0x40bae5
cmp ebp, ebx
jbe 0x40baa1
call fcn.006441b7
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x40bab4
call fcn.006441b7
mov eax, dword [esi]
mov dword [esp + 0x18], eax
mov eax, edi
lea edi, [esp + 0x18]
mov dword [esp + 0x1c], ebp
call fcn.0040fee0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
mov edi, esi
call fcn.0040bb30
mov eax, dword [esp + 0x44]
xor esi, esi
cmp eax, esi
je 0x40baf8
push eax
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x38]
push ecx
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x18
Function at 0x40c470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x790018
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x30], 0
mov ebx, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, ebx
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x40c4f6
cmp ebp, ebx
jbe 0x40c4cb
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push ebx
push eax
lea eax, [esp + 0x40]
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push edi
push esi
call fcn.0040e160
jmp 0x40c543
jae 0x40c543
cmp ebp, ebx
jbe 0x40c501
call fcn.006441b7
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x40c514
call fcn.006441b7
mov eax, dword [esi]
mov dword [esp + 0x18], eax
mov eax, edi
lea edi, [esp + 0x18]
mov dword [esp + 0x1c], ebp
call fcn.0040fee0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
call fcn.0040e0b0
mov eax, dword [esp + 0x44]
xor esi, esi
cmp eax, esi
je 0x40c556
push eax
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x38]
push ecx
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x18