joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51cdc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x573710]
sub eax, dword [edx]
cmp eax, 0x32
jbe 0x51ceb9
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x573710]
mov dword [edx], eax
mov eax, dword [0x573908]
cmp dword [eax], 0x82
jge 0x51ce03
mov eax, dword [0x573908]
add dword [eax], 0x1e
jmp 0x51ce0a
mov eax, dword [0x573560]
inc dword [eax]
mov eax, dword [0x573908]
cmp dword [eax], 0x64
jle 0x51ce24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8b8]
mov byte [eax + 0x26c], 1
mov eax, dword [0x573560]
cmp dword [eax], 0x1e
jle 0x51ceb9
mov eax, dword [0x573ffc]
mov byte [eax], 0
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005208bc
mov eax, dword [0x5735f4]
cmp byte [eax], 1
jne 0x51ceb9
mov eax, dword [0x57425c]
mov eax, dword [eax]
cmp dword [eax + 8], 0
je 0x51ceb9
call fcn.00402f88
mov eax, dword [0x57425c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
call fcn.004035d8
mov dword [ebp - 8], eax
mov eax, dword [0x57425c]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.00419dc8
mov dword [ebp - 0xc], eax
mov eax, dword [0x57425c]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.00419ca4
mov al, byte [ebp - 0xc]
mov edx, dword [0x573de8]
mov byte [edx], al
mov eax, dword [0x574290]
mov byte [eax], 1
mov eax, dword [0x573900]
mov dword [eax], 0xffffffff
mov eax, dword [0x574394]
mov byte [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x52f398
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x52f3a0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52f557
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov byte [edx + 0x170], al
mov dl, 2
mov eax, dword [ebp - 4]
call fcn.0052f090
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
add edx, 0x56
call fcn.00404e50
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0043c900
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
add edx, 0x61
call fcn.00404e50
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0043c900
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
add edx, 0x6c
call fcn.00404e50
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
call fcn.0043c900
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
add edx, 0x81
call fcn.00404e50
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0043c900
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
add edx, 0x9f
call fcn.00404e50
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
call fcn.0043c900
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0xb4
call fcn.00404e50
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
call fcn.0043c900
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 4]
add edx, 0x90
call fcn.00404e50
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0043c900
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 4]
add edx, 0xc1
call fcn.00404e50
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.0043c900
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
add edx, 0xea
call fcn.00404e50
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0043c900
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 4]
add edx, 0xff
call fcn.00404e50
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0043c900
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 4]
add edx, 0x117
call fcn.00404e50
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.0043c900
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 4]
add edx, 0x10c
call fcn.00404e50
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
call fcn.0043c900
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f55e
lea eax, [ebp - 0x38]
mov edx, 0xc
call fcn.00404c10
ret
Function at 0x530880
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0x30], 1
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + eax*8 + 0x38], 0x1e
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + edx*8 + 0x40], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + edx*8 + 0x44], eax
cmp dword [ebp - 8], 0
jne 0x5308ee
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
jmp 0x5308f5
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 0
pop ecx
pop ecx
pop ebp
ret
Function at 0x532ce4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x532ebf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x57382c]
cmp dword [eax], 0
je 0x532ea4
mov eax, dword [0x573628]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x20]
jne 0x532ea4
push 1
mov eax, dword [ebp - 8]
call fcn.00471bd0
call fcn.0042513c
push eax
call sub.gdi32.dll_SetBkMode
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x532dd9
mov dword [ebp - 0x10], 0x1e
mov dword [ebp - 0x14], 0x28
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x532daf
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
push 0x8000
push 0
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004e7bbc
add dword [ebp - 0x14], 0x10
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x532d79
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
push eax
call sub.kernel32.dll_GetTickCount_1
pop edx
sub eax, edx
cmp eax, 0xbb8
jb 0x532dd9
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 8]
call fcn.00471bd0
call fcn.00470940
push 1
mov eax, dword [ebp - 8]
call fcn.00471bd0
call fcn.0042513c
push eax
call sub.gdi32.dll_SetBkMode
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x532e97
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0x182
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x532e6d
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
push 0xff
push 0
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004e7bbc
sub dword [ebp - 0x14], 0x10
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x532e37
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x18]
push eax
call sub.kernel32.dll_GetTickCount_1
pop edx
sub eax, edx
cmp eax, 0xbb8
jb 0x532e97
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 8]
call fcn.00471bd0
call fcn.00470940
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532ec6
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00404c10
ret
Function at 0x532fdc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x5736d8]
cmp byte [eax], 0
je 0x5330dc
mov eax, dword [0x573628]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x20]
jne 0x5330dc
mov eax, dword [ebp - 8]
call fcn.00471bd0
mov dword [ebp - 0x14], eax
push 1
mov eax, dword [ebp - 0x14]
call fcn.0042513c
push eax
call sub.gdi32.dll_SetBkMode
mov edx, 0x12
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
call fcn.00424374
mov eax, dword [ebp - 8]
call fcn.00471bd0
lea ecx, [ebp - 0x1c]
mov edx, dword [0x573f58]
mov edx, dword [edx]
call fcn.00424f58
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00471bd0
lea ecx, [ebp - 0x1c]
mov edx, dword [0x573f58]
mov edx, dword [edx]
call fcn.00424f58
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
call fcn.00470940
mov eax, dword [0x57418c]
mov al, byte [eax]
call fcn.00534248
push eax
mov eax, dword [0x5739b0]
mov al, byte [eax]
call fcn.00534248
push eax
mov eax, dword [0x573f58]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x10]
sar eax, 1
jns 0x5330a4
adc eax, 0
mov ecx, 0xc8
sub ecx, eax
mov eax, dword [ebp - 0xc]
sar eax, 1
jns 0x5330b5
adc eax, 0
mov edx, 0x190
sub edx, eax
mov eax, dword [ebp - 8]
call fcn.004e7bbc
mov edx, 9
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
call fcn.00424374
mov eax, dword [ebp - 0x14]
call fcn.00470940
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x573758]
sub eax, dword [edx]
xor edx, edx
push edx
push eax
mov eax, dword [0x573518]
imul eax, dword [eax], 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x533108
cmp eax, dword [esp]
pop edx
pop eax
jae 0x533121
jmp 0x53310c
pop edx
pop eax
jge 0x533121
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x573758]
mov dword [edx], eax
mov eax, dword [0x5736d8]
mov byte [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x534218
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x534237
mov eax, dword [0x573ed0]
mov eax, dword [eax]
call fcn.0045ce9c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jb 0x53422b
pop ecx
pop ecx
pop ebp
ret
Function at 0x53a1a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [0x57382c]
cmp dword [eax], 0
je 0x53a25e
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5741a4]
sub eax, dword [edx]
cmp eax, 0x1b58
jbe 0x53a25e
mov eax, dword [0x57382c]
mov eax, dword [eax]
cmp byte [eax + 0x17], 0
jne 0x53a25e
mov eax, dword [0x573940]
mov eax, dword [eax]
cmp dword [eax + 8], 0
jle 0x53a25e
mov eax, dword [0x573940]
mov eax, dword [eax]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x53a25e
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
mov eax, dword [0x573940]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.00419dc8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp word [eax + 8], 0x1a
jne 0x53a256
mov eax, dword [0x57382c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
push eax
push 0x1a
push 0
mov eax, dword [0x57382c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, 0xbc9
mov eax, dword [ebp - 4]
call fcn.0053e600
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5741a4]
mov dword [edx], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x53a207
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x53a268
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [0x57382c]
cmp dword [eax], 0
je 0x53a326
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x574440]
sub eax, dword [edx]
cmp eax, 0x2710
jbe 0x53a326
mov eax, dword [0x57382c]
mov eax, dword [eax]
cmp byte [eax + 0x17], 0
jne 0x53a326
mov eax, dword [0x573940]
mov eax, dword [eax]
cmp dword [eax + 8], 0
jle 0x53a326
mov eax, dword [0x573940]
mov eax, dword [eax]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x53a326
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
mov eax, dword [0x573940]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.00419dc8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp word [eax + 8], 0x4a
jne 0x53a31e
mov eax, dword [0x57382c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
push eax
push 0x4a
push 0
mov eax, dword [0x57382c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, 0xbc9
mov eax, dword [ebp - 4]
call fcn.0053e600
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x574440]
mov dword [edx], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x53a2cf
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x540b38
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [0x57382c]
mov eax, dword [eax]
movzx eax, word [eax + 0x3d]
imul edx, eax, 0xe
mov eax, 0x172
call fcn.0047933c
mov dword [ebp - 0x10], eax
mov eax, dword [0x57382c]
mov eax, dword [eax]
movsx edx, byte [eax + 0x91]
mov eax, dword [0x5737c0]
imul edx, dword [eax]
add edx, dword [ebp - 0x10]
mov eax, 0x320
call fcn.0047933c
mov dword [ebp - 0x10], eax
mov eax, dword [0x574110]
mov eax, dword [eax]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x540b9a
xor eax, eax
mov dword [ebp - 0xc], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x390]
cmp eax, dword [ebp - 0xc]
jbe 0x540bc1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x390], eax
mov byte [ebp - 5], 1
jmp 0x540bc5
mov byte [ebp - 5], 0
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x552da0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x552edc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jl 0x552dde
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
mov eax, dword [eax + 0x34]
call fcn.0041ac34
cmp eax, dword [ebp - 8]
jg 0x552deb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x552ef0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5735c4]
sub eax, dword [edx]
cmp eax, 0x2710
jbe 0x552e13
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x5735c4]
mov dword [edx], eax
push ebp
call fcn.00551a04
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 8]
call fcn.00478140
mov eax, dword [eax + 0x20]
cmp dword [eax + 0xc], 0
jne 0x552e94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
mov eax, dword [eax + 0x34]
call fcn.0041ac34
cmp eax, dword [ebp - 8]
jle 0x552ed2
push ebp
mov eax, dword [ebp - 8]
call fcn.00551b08
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 8]
call fcn.00478140
add eax, 0x48
push eax
call sub.kernel32.dll_GetTickCount_1
pop edx
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 8]
call fcn.00478140
xor edx, edx
call fcn.004779e8
mov dword [ebp - 0xc], eax
jmp 0x552ed2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 8]
call fcn.00478140
add eax, 0x48
push eax
call sub.kernel32.dll_GetTickCount_1
pop edx
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 8]
call fcn.00478140
xor edx, edx
call fcn.004779e8
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x552ef0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5fbb47
Capabilities:
Encode data using xor

Disassembly:
xor bh, ah
neg bh
shld ebx, edi, 0x14
mov ebx, eax
push 0x4784c515
cmp byte [edi], 0x23
push 0x87fc73cd
jmp 0x5ff4dd

Function at 0x618692
Capabilities:
Encode data using xor

Disassembly:
cmp cl, byte [edi - 0x67a2a41d]
xor byte [eax*8 + 0xc4b7adb], dl
inc edx
xlatb
dec ebp
xor byte [ebx], cl
movsb byte es:[edi], byte [esi]
push ecx
and dword [esi], edi
mov dword [0xa34ab31e], eax
mov cl, 0x5a
invalid
add ecx, edx
pushfd
bt bx, dx
clc
call fcn.00606303
pop ebx
xchg ah, ch
fsub dword [eax]
sahf
mov dl, 0xb9
pop eax
xor dword [edi + 0x62], 0x4c95679a
inc eax
popfd
pop ebx
mov byte [0xfcf507ee], al
cld
leave
das
loop 0x61866a
outsd dx, dword [esi]
lea ebp, [eax - 0x70]
jno 0x618729
mov edx, 0xe4db7f79
and eax, 0xa0738e67
cmp eax, 0xb253603d
imul bl
salc
xlatb
push ds
iretd
xchg dword [esi + 0x74], esp
wait
cwde
aam 0x6e
outsd dx, dword [esi]
cmp byte [edx], 0x70
add bl, byte [ebp - 0x74]
xor dword [edx], esi
mov ebx, 0xd1e21b32
push es
sti
invalid

Function at 0x7b6604
Capabilities:
Check for software breakpoints

Disassembly:
push 0x52c442ba
inc esi
call fcn.007b61f1
jmp 0x7b5d6c

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x5867d2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x773cf7be]
lcall 0xd803, 0x207ead32
ret 0x389b
fist dword [eax + 0x6c032516]
inc ecx
xchg esi, eax
das
inc eax
mov esp, 0x30303c25
nop
cmp dword [edx], edi
sbb eax, 0xb25142e8
cld
push esp
xchg edx, eax
arpl word [ebx - 0x6e], di
jnp 0x586766
jnp 0x586766
mov al, byte [0x3002f2cf]
sub al, 0xd
pop eax
pop esp
fld qword [ebx]
inc eax
push ds
inc ecx
and byte [ecx], 0x27
push ecx
pop ecx
cmp eax, 0x774c2ad4
out 0x2c, eax
mov al, byte [0x4afa864e]
sub cl, byte [edi + esi*2 - 0x19]
sub al, 0xa0
dec esi
xchg dl, bh
dec edx
bound ecx, qword [ebx + 0x10]
push eax
xor al, 0x1c
mov word [edx], fs
loope 0x5867b6
jle 0x5867e9
in eax, 0xb8
lcall 0xcf32, 0x85e2af4
mov al, byte [0xc966ca5c]
mov ah, 0x91
shl byte [ecx + 0x3c371324], 0x10
mov al, 0xbf
bound edx, qword [edx + 0x109e1b37]
dec ebx
adc eax, 0xf9d06451
pop edi
ja 0x586869
jecxz 0x5868a6
insb byte es:[edi], dx
aas
sbb dword [esi + 0x1a71be68], ecx
ret
inc ecx
aaa
iretd
mov bh, 0xd7
inc esi
cmp eax, 0x70c5c556
cmp ebx, dword [eax]
xchg ebx, eax
or eax, 0xaac0f554
cdq
inc eax
les ebx, [ebp - 0x69]
out dx, eax
and ebp, esi
sahf
shr byte [edx + ecx*8 - 4], cl
les edi, [edi + 0x50]
mov word [ebp + edi*4 + 0x14cf9ba5], ss
mov dword [ebx - 0x7f], eax
pop esi
cmp eax, 0x92a0b5c9
push ecx
pop edi
dec edx
ljmp 0x6e4e

Function at 0x58e4f6
Capabilities:
Encode data using xor

Disassembly:
aas
out 0xea, al
insd dword es:[edi], dx
mov esp, ebp
in al, dx
outsd dx, dword [esi]
xor dword [0x2315283c], esi
jne 0x58e4fb
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, 0x9eca2dbe
popal
inc ebx
clc
fidivr word [esi + 0x620d6396]
stc
aaa
fidiv word [edi]
cwde
ret 0x82be

Function at 0x5dadae
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x3b], dh
imul eax, dword [ecx], 0x9469d7ab
mov ebp, 0xd986c89a
and ecx, esi
jbe 0x5dae0f
dec edx
and edi, esi
pushal
lcall 0x61c0, 0x525d822b
mul dword [eax - 0x66]
sub eax, dword [edx + 0x61c0525d]
fnstenv [eax - 0x792daa94]
leave
xor eax, 0xc267d838
pop es
rol byte [eax + 0x7670861e], 0xe8
push edx
or al, 0xf0
loop 0x5dadc2
cmp al, 0xf1
and dword [ecx], ecx
test eax, 0xaaa513c9
mov al, byte [0x484fb1df]
push ecx
invalid
add bh, 0x11
xchg ebx, eax
and dword [eax], ecx
mov al, byte [0xde9947f2]
wait
and bh, 0xfb
cwde
loope 0x5dae74
push es
sbb al, 0xa3
and eax, 0x5e21e03d
fisub dword [eax - 0x14]
pop edi
mov ch, 0x67
imul eax, dword [eax], 0x84df06df
fstp dword [0x8f50b0b1]
sub dword [ebp - 0x7b13fa4b], edi
mov esp, 0xf9886b39
cmp dword gs:[ebx - 0x35], edx
adc dword [ecx], ecx
test al, 0x2f
mov bl, 0xcc
jmp eax
push esp
andnps xmm3, xmm2
or dword [edx + 0x7a600ea2], 0x957996be
invalid

Function at 0x623d42
Capabilities:
Encode data using xor

Disassembly:
pop es
inc ecx
out 0x31, eax
out 0xfc, al
cld
mov cs, word [edx + 0x1e]
inc eax
invalid
Function at 0x10abde0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10abdea
pushal
call 0x10abdf0
pop ebp
sub ebp, 0x10
sub ebp, 0xcabde0
jmp 0x10abe06
mov eax, 0xcabde0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0xad984639
xor byte [eax], dl
inc eax
dec ecx
jne 0x10abe1d
jmp 0x10abe30
mov dl, 0xf4
mov dl, 0xb0
add eax, 0xb8393939
clc
sar dword [ecx], 0x39
cmp dword [edx], edi
hlt
Function at 0x132d150
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe1e000]
push edi
or ebp, 0xffffffff
jmp 0x132d172
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x132d179
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x132d168
mov eax, 1
add ebx, ebx
jne 0x132d18b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x132d180
jne 0x132d19c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x132d180
xor ecx, ecx
sub eax, 3
jb 0x132d1b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x132d222
mov ebp, eax
add ebx, ebx
jne 0x132d1bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x132d1c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x132d1ec
inc ecx
add ebx, ebx
jne 0x132d1d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x132d1cd
jne 0x132d1e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x132d1cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x132d20c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x132d1fd
jmp 0x132d16e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x132d20c
add edi, ecx
jmp 0x132d16e
pop esi
mov edi, esi
mov ecx, 0xb8cc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x132d22a
cmp byte [edi], 0x19
jne 0x132d22a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x132d22f
lea edi, [esi + 0xf18000]
mov eax, dword [edi]
or eax, eax
je 0x132d2a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c0ee94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c0f07c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x132d25c
mov ecx, edi
jns 0x132d28b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c0f084]
or eax, eax
je 0x132d2a1
mov dword [ebx], eax
add ebx, 4
jmp 0x132d279
call dword [esi + 0x1c0f080]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x132d2d8
cmp al, 0xef
ja 0x132d2cb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x132d2ad
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x132d2ba
mov ebp, dword [esi + 0x1c0f088]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x132d30c
sub esp, 0xffffff80
jmp 0x55fd8a