joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030e4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x412008], 0x8088405
inc edx
mov dword [ebx + 0x412008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403714
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41201c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4037ac
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40378c
xor eax, eax
push ebp
push 0x403785
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4037e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40378c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x41201c]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41201c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41304c], 0
je 0x404551
cmp word [0x413328], 0xd7b2
jne 0x404519
cmp dword [0x413330], 0
jbe 0x404519
mov eax, 0x413324
call dword [0x413340]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40457c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x412028], 0
jne 0x40456d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4045bb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x415ae4
mov edi, 0x413048
cmp dword [0x412004], 0
je 0x4045a8
call fcn.00404458
call fcn.004044f0
xor eax, eax
mov dword [0x412004], eax
cmp dword [0x415b18], 0
je 0x4045d2
call sub.kernel32.dll_GetCurrentThreadId
cmp eax, dword [0x58415b40]
mov edx, dword [esp]
sub esp, 0xfffffffc
mov ebx, 0xfebd5137
xor edx, ebx
xor edx, 0x71f9219a
mov esi, dword [esp]
add esp, 4
mov ecx, esi
push ecx
sub esp, 4
mov edi, esp
mov dword [edi], eax
mov eax, 0x78abf181
shr eax, 2
mov edi, 0x1e6ae38a
xor edi, eax
mov ebx, edi
dec ebx
mov eax, dword [ebx + 1]
xor eax, edx
mov dword [esi], eax
mov eax, 4
add edi, eax
add esi, 4
mov ebx, 0x4ea6e44d
shr ebx, 3
mov eax, 0x994fae3
xor eax, ebx
xor eax, edi
sub eax, 0
jne 0x4045f0
lea esp, [esp + 4]
jmp dword [esp - 4]
Function at 0x408dd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e09
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00404dd4
jmp 0x408e12
mov eax, ebx
mov edx, esi
call fcn.00404c98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408e1c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e3e
movzx eax, word [esp]
jmp 0x408e40
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4095c8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4096ed
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004093dc
mov esi, eax
mov eax, dword [0x412c2c]
cmp byte [eax], 0
je 0x409695
mov eax, dword [0x412b68]
call fcn.0040317c
call fcn.00402f6c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4095a4]
call fcn.00405ad8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x409708
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4096d1
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x412b48]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x415b48]
call fcn.00405b90
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4096f4
lea eax, [ebp - 4]
mov edx, dword [0x4095a4]
call fcn.00405ae4
ret

Function at 0x40b5b4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b5fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b548
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b601
lea eax, [ebp - 4]
call fcn.00404c88
ret
Function at 0x40b818
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b8af
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40b863
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00404dd4
jmp 0x40b899
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x40b87c
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404cec
jmp 0x40b88f
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b6d8
mov ebx, eax
test esi, esi
je 0x40b88f
dec esi
jmp 0x40b86a
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b8b6
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40b8c0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00408134
add esp, 0x208
pop ebx
ret

Function at 0x40ba24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40bb5c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40bb46
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40ba81
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bb46
cmp dword [ebp - 0x14], 0
jne 0x40ba98
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404c98
mov bl, 1
jmp 0x40bb46
cmp dword [ebp - 0x14], 0x70000000
jb 0x40baa6
call fcn.00409734
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00404dd4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004054ac
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x40ba4a
test eax, eax
jne 0x40bb46
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40baf4
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bb46
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x40bafc
dec esi
test esi, esi
je 0x40bb0b
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x40bafb
cmp dword [ebp - 0x10], 7
jne 0x40bb16
test esi, esi
je 0x40bb16
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404f00
cmp dword [ebp - 0x10], 7
jne 0x40bb39
test esi, esi
je 0x40bb39
lea eax, [ebp - 4]
call fcn.004054ac
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404c98
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb63
lea eax, [ebp - 4]
call fcn.00404c88
ret
Function at 0x40c5a0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x417d98
mov eax, esi
mov edx, 8
test al, 1
je 0x40c5bc
shr eax, 1
xor eax, 0xedb88320
jmp 0x40c5be
shr eax, 1
dec edx
jne 0x40c5af
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40c5a8
pop esi
ret

Function at 0x40c5d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x417d94], 0
jne 0x40c5f7
call fcn.0040c5a0
push 1
push 0x417d94
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40c622
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x417d98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40c5fd
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40e2fc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40e304
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40e3f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040b8ec
mov edx, dword [ebp - 8]
mov ecx, 0x40e40c
xor eax, eax
call fcn.0040e1e0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x40e3bf
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x40e31e
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.0040de08
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00407e04
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040be74
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x68
call fcn.0040ddd8
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x406c78]
call fcn.00409740
call fcn.00403f88
jmp 0x40e31e
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e3f8
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c90
ret
Function at 0x414479
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b548]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004102a8
mov dword [ebp - 0x14], eax
cmp dword [0x41cde4], edi
jne 0x41456a
push 0x800
push edi
push 0x4174cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4144f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41464a
push 0x4174cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41464a
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41464a
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x41cde4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x41cde8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x41cdec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41cdf4], eax
test eax, eax
je 0x414567
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41cdf0], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41458f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x414582
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4145a4
push 4
pop eax
jmp 0x41464c
cmp dword [ebp - 0x14], edi
je 0x4145a4
push dword [0x41cde4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x414589
mov eax, dword [0x41cdf0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x414602
cmp dword [0x41cdf4], esi
je 0x414602
push eax
call ebx
push dword [0x41cdf4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x414602
test eax, eax
je 0x414602
call ecx
test eax, eax
je 0x4145f7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4145f7
test byte [ebp - 8], 1
jne 0x414602
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x414632
mov eax, dword [0x41cde8]
cmp eax, esi
je 0x41462f
push eax
call ebx
test eax, eax
je 0x41462f
call eax
mov edi, eax
test edi, edi
je 0x41462f
mov eax, dword [0x41cdec]
cmp eax, esi
je 0x41462f
push eax
call ebx
test eax, eax
je 0x41462f
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x41cde4]
call ebx
test eax, eax
je 0x41464a
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41464c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040da7c
leave
ret
Function at 0x991f00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3ac000]
push edi
or ebp, 0xffffffff
jmp 0x991f22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x991f29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x991f18
mov eax, 1
add ebx, ebx
jne 0x991f3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x991f4c
jne 0x991f6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x991f6b
dec eax
add ebx, ebx
jne 0x991f58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x991f30
add ebx, ebx
jne 0x991f67
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x991fbd
xor ecx, ecx
sub eax, 3
jb 0x991f83
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x991ff2
sar eax, 1
mov ebp, eax
jmp 0x991f8e
add ebx, ebx
jne 0x991f8e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x991f5c
inc ecx
add ebx, ebx
jne 0x991f9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x991f5c
add ebx, ebx
jne 0x991fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x991f9e
jne 0x991fba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x991f9e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x991fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x991fce
jmp 0x991f1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x991fdc
add edi, ecx
jmp 0x991f1e
pop esi
mov edi, esi
mov ecx, 0x2620d9
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x992017
cmp byte [edi], 0x82
jne 0x991ffc
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x991ffa
lea edi, [esi + 0x58d000]
mov eax, dword [edi]
or eax, eax
je 0x99205f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x596564]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x596640]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x99201d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x596644]
or eax, eax
je 0x992059
mov dword [ebx], eax
add ebx, 4
jmp 0x99203a
call dword [esi + 0x596654]
mov ebp, dword [esi + 0x596648]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x992093
sub esp, 0xffffff80
jmp 0x6ab0f8
Function at 0x4568ac
Capabilities:
Encode data using xor

Disassembly:
sbb ah, ch
mov dh, 0xd5
jbe 0x456884
in eax, 0xb6
aad 0x76
add al, 0xf7
movsb byte es:[edi], byte [esi]
push ecx
and eax, 0x693105be
add eax, 0xfebe4b0c
lahf
pop ecx
mul dword [ecx + edx*2 + 0x3105be25]
imul eax, dword [0xfebe4b0c], 0x1459369f
push ebp
mov esi, 0x5693105
or al, 0x4b
mov esi, 0x59369ffe
adc al, 0x55
sar byte [0x87eac1f2], 0xae
xor eax, 0xf59abb8f
mov edx, 0x4ad72042
and al, 0x8b
sbb eax, 0x410893ca
mov edx, 0xcb75f385
jne 0x45687a
jne 0x45687a
test eax, 0xc33c31d4
je 0x45687b
dec ebx
je 0x4568d7
and al, 0x9a
loopne 0x45692d
jne 0x456939
in eax, 0x92
xor eax, 0x45aa2763
salc
adc dword [ecx + esi + 0x43], edi
sub al, 0xf6
adc al, 0xaa
push esp
ficom dword [ebp + 0x35]
adc eax, 0x2cdc63dd
int3
sub al, 0xcc
invalid
mov esp, 0x5dab4cb4
or byte [ebx - 0x6355cbe0], ah
cmpsd dword [esi], dword es:[edi]
and esp, edi
invalid

Function at 0x4a427d
Capabilities:
Encode data using xor

Disassembly:
xor al, 3
lodsb al, byte [esi]
jecxz 0x4a42e1
ror byte [edi - 0x5130c73e], 1
pop edx
cmp bh, cl
scasb al, byte es:[edi]
outsd dx, dword [esi]
xor byte [ebx - 0x1052ef7], bh
mov bl, 0x4c
salc
mov al, byte [0xa394e8c]
jge 0x4a4283
sbb dword [ebx], esp
mov ah, 0x2f
sti
xlatb
mov cl, 0x42
lcall 0x18ce, 0x47ca808d
cwde
sar byte [0xd83ddeb4], 0x5a
xchg ebx, eax
jo 0x4a4329
dec edx
add dword [ecx + 0xf], esi
outsb dx, byte [esi]
cdq
or al, 0x20
sbb eax, 0xde77100d
loopne 0x4a42f4
std
cld
fist word [ebx + esi*4 - 0x41377531]
les ecx, [eax - 0x6550bf20]
jb 0x4a4288
or al, 0x5a
or al, 0x66
cdq
sahf
push es
and byte [esi], cl
cmpsb byte [esi], byte es:[edi]
invalid
add al, 0xa0
salc
in al, dx
jmp 0x4a4282
leave
sbb dword [esi + 0x6e], esi
jnp 0x4a4303
inc eax
add bl, cl

Function at 0x4d9b19
Capabilities:
Encode data using xor

Disassembly:
sar dword [edx], 0x8d
adc esi, dword [eax + ebx*2]
scasd eax, dword es:[edi]
xor edi, dword [edx - 0x49ad89b9]
adc dword [esi], edi
mov dword [0x9f6f5efb], eax
lahf
imul ebp, dword [edi], 0x6f5cde22
jne 0x4d9b1f
push es
inc ecx
mov dword [edx], ecx
aaa
nop
inc esi
and eax, 0x6f9652ca
test al, 0x19
daa
inc ebp
push ecx
Function at 0x4da92b
Capabilities:
Packed with generic packer

Disassembly:
sub ecx, dword [ecx]
jbe 0x4da972
cdq
out dx, eax
pop esi
cmc
mov cs, word [0x8e63eb9c]
test al, 0x1c
test eax, 0xbbf0109e
jno 0x4da96f
push cs
or byte [ebp - 0x1a07f64d], ch
sbb al, 0xab
xchg esp, eax
jl 0x4da9c6
mov ebx, 0x3738b29
ror ebp, cl
push 0x733a47c5
cmc
mov ebp, edx
pop edi
push esp
rcl dword [edx + 0x514f15af], cl
inc edx
adc eax, 0x73651e33
add dword [0xda291bd5], 0xc
neg byte [edi + edi*8]
aad 0x1b
sub edx, ebx
or al, 0xf6
fimul dword [esi + esi*8]
sbb al, 0xff
push ds
iretd
mov ebx, 0xe011aec0
shl byte [edx], 1
ret
and al, bl
dec ecx
daa
xchg byte [eax + ecx*2 - 0x1d13ef6b], cl
sbb byte [0x7ad8f89d], al
insb byte es:[edi], dx
sbb bh, al
push 0x99a58354
jno 0x4daa2c
mov al, byte [0xbd22b0ae]
or al, byte [edi + 0x2d634dfb]
int 0xb8
add bh, byte fs:[edx + 0x48]
arpl word [0x264b8cd], bp
jp 0x4daa16
iretd
cmp bl, byte [esi - 0x2c]
mov ebx, 0x8eea05dd
pop eax
dec ebx
inc ebp
push edi
mov dword [eax + 0x5b3044b8], esp
cwde
leave
salc
jo 0x4da9a2
das
and byte [esi], ch
mov al, 0xbc
je 0x4da99c
mov edi, 0xfbeace75
sti
popal
pushal
outsd dx, dword [esi]
push ds
dec edx
jne 0x4daa94
pop esp
call 0x26132f3
jl 0x4daa6c
inc esi
fistp qword [edi]
cmp ah, byte [edi - 0x7a5e19d9]
cmp eax, 0xb0312fc9
js 0x4da9f3
mov eax, dword [0x2fc93d85]
xor dword [eax - 0x4344188], esi
psrlw mm6, qword cs:[esi - 0x66]
cmp al, 0xd5
dec byte [edx + 9]
fadd qword [eax + edi*2 - 0x78c96c58]
push ss
insb byte es:[edi], dx
mov esp, 0xb8daf140
cwde
dec ebp
test al, 0xae
mov byte [0x986323a1], al
xlatb
dec ecx
and ebx, ebx
xchg byte [eax + 0x64], ch
cwde
cmpsb byte [esi], byte es:[edi]
inc ebx
or al, 0x84
sub al, 0x85
loop 0x4daaa9
retf
das
cmp dword [edi + 0x6c], edi
push edi
mov bh, 0x28
leave
inc eax
xchg ebp, eax
mov bh, 0xe3
mov ebx, 0x53d8a52e
inc esi
out dx, al
mov ecx, 0xf60eeffd
fcmovbe st(0), st(6)
pop esp
push 0xdc18de47
add eax, 0x63231a18
sbb byte [eax + 0xd], ch
dec esp
jmp 0x4daa25
jecxz 0x4daa72
salc
enter 0xffffffffffffbb49, 0x1b
js 0x4daac6
xchg esi, eax
clc
ror byte [esi + 5], 1
sub eax, 0x591b5e3e
pop ecx
movq qword [edx + 0x58], mm4
jg 0x4dab0d
pop eax
sub al, 0xb3
add eax, 0xf7dfbcd8
fcompi st(7)
in eax, 0x83
mov edx, 0x58d40eb8
sahf
mov ebx, 0x1880fb8
jae 0x4daaf5
cmp byte [eax + 0x3d], cl
cdq
push esi
in eax, 0x21
das
jnp 0x4dab0a
dec ebp
add cl, byte cs:[ebp - 0x7516bba5]
mov edx, 0xff57d0ef
dec esi
sbb ah, byte [ebx]
push eax
cmpsd dword [esi], dword es:[edi]
inc esp
inc esi
sbb al, 0x9c
pushfd
adc bh, byte [edx + 0x7f]
invalid
cwde
loop 0x4daae2
sahf
insd dword es:[edi], dx
and eax, dword [0x5d61985f]
pop edi
cwde
popal
pop ebp
dec ebp
in eax, 0x71
inc esp
cmpsd dword [esi], dword es:[edi]
and al, 2
xchg ebx, eax
jge 0x4daab2
ljmp 0x8e52:0x74e9d7c
dec esi
pop es
push edx
mov ds, word [ecx]
dec esi
jmp 0x291c6a28
Function at 0x5250a1
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xeaaa31ef
scasb al, byte es:[edi]
adc edx, dword [esi]
rol byte [ebx + 0x28bcf1fd], 0x71
idiv dword [edi + eax + 0x15]
invalid

Function at 0x55c7bc
Capabilities:
Check for software breakpoints

Disassembly:
jecxz 0x55c740
lea eax, [esi + 0x59101a7b]
cmp al, 0xcc
imul eax, dword [edi], 0x5b4d8d2e
das
mov ebp, 0x170ae228
or dl, byte [edi]
arpl cx, si
push 0xe4679d9c
in al, 0x76
cmc
in al, 0x76
cmc
imul ecx, ecx, 0xffffff9c
push ebx
or al, 0x1e
sbb al, 0x2e
mov edi, dword [eax*4 + 0x3703ce79]
add al, 0x60
dec ebx
arpl bx, si
add al, 0x8d
mov dh, 0xba
xor eax, 0x19e2514b
dec ecx
jp 0x55c7a0
xor esp, esp
lea eax, [edx]
xchg byte [ebx + 0x712f0b3d], ah
mov dl, 0x17
push ss
lds eax, [esi]
mov eax, dword [0x63cbaeb0]
salc
xor eax, 0x377df3c6
scasd eax, dword es:[edi]
invalid