joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45908c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459237
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x459218
mov dl, 1
mov eax, dword [0x415514]
call fcn.00403198
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403f18
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x459207
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00446bc4
test al, al
je 0x4591fa
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x459248
lea eax, [ebp - 0x254]
call fcn.00408ef0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4591fa
xor eax, eax
push ebp
push 0x4591f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x459280
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4591dc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404188
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4591dc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404188
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4591fa
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4590fd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00419008
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45923e
lea eax, [ebp - 0x260]
call fcn.00403f18
ret

Function at 0x459b6c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x463be8]
cmp byte [eax + 0xa5], 0
jne 0x459bdd
cmp dword [0x463c00], 0
jne 0x459b9e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x459b28
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x463c00], eax
cmp dword [0x463bfc], 0
jne 0x459bb9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x463bfc], eax
cmp dword [0x463c04], 0
jne 0x459bdd
push esp
push 0
push 0
push 0x459acc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x463c04], eax
pop edx
ret
Function at 0x459cd4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x459ceb
add esp, 0xfffffff0
call fcn.004034ec
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041ce18
mov eax, dword [0x4620d0]
cmp word [eax + 2], 0
jne 0x459d13
mov eax, dword [0x4620d0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b43c
mov eax, dword [0x462180]
cmp word [eax + 2], 0
jne 0x459d2d
mov eax, dword [0x462180]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b634
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4150f8]
call fcn.00403198
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4150f8]
call fcn.00403198
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f37c]
call fcn.004267a4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x459eb4
mov eax, dword [0x461fe4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00426b74
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45bbd4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x461fe4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c6c4
test eax, eax
je 0x459e22
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004088e4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c6ec
test eax, eax
je 0x459e36
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404188
mov eax, dword [0x461eb8]
cmp byte [eax], 0
jne 0x459e6a
mov eax, ebx
call fcn.00459fdc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045bdb0
mov eax, ebx
call fcn.0045c774
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459eaa
call fcn.00403544
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a25c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x463be8]
cmp dword [eax + 0x30], 0
je 0x45a306
cmp dword [ebx + 0x94], 0
jne 0x45a300
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45a1ec
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45a300
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45a2c6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45a300
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417460
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45a2d5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45ae68
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45ae9d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404008
jmp 0x45aeaa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403f6c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45bf8c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45bfcd
mov eax, esi
call fcn.0044218c
test al, al
je 0x45bfcd
mov eax, dword [ebx + 0x84]
call fcn.00441e88
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45bfcd
push 0
mov eax, dword [ebx + 0x84]
call fcn.00441e88
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45f3ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x45f3f4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004043c8
xor eax, eax
push ebp
push 0x45f5ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x314]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x45f5d4
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
mov ecx, 0x45f618
mov edx, dword [ebp - 4]
call fcn.00404224
mov eax, dword [ebp - 0x18]
call fcn.004085d0
test al, al
je 0x45f5c8
mov dl, 1
mov eax, dword [0x415514]
call fcn.00403198
mov esi, eax
lea eax, [ebp - 0x1c]
mov ecx, 0x45f618
mov edx, dword [ebp - 4]
call fcn.00404224
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov edx, 0x45f634
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x45f532
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [edi + 0x314]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
mov ecx, 5
mov edx, 1
call fcn.00404438
push dword [ebp - 0x24]
push 0x45f64c
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0xc]
mov eax, dword [edi + 0x314]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x34]
call fcn.004041d8
sub eax, 5
push eax
lea ecx, [ebp - 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [edi + 0x314]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x38]
mov edx, 6
pop ecx
call fcn.00404438
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00407fc8
push dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404298
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
inc edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea eax, [ebp - 0x3c]
mov ecx, 0x45f618
mov edx, dword [ebp - 4]
call fcn.00404224
mov edx, dword [ebp - 0x3c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [edi + 0x30c]
call fcn.0042f430
cmp eax, 0x64
jge 0x45f581
mov ebx, dword [edi + 0x30c]
mov eax, ebx
call fcn.0042f430
push eax
fld qword [edi + 0x320]
call fcn.004029d4
pop edx
add edx, eax
mov eax, ebx
call fcn.0042f5e0
jmp 0x45f58e
xor edx, edx
mov eax, dword [edi + 0x30c]
call fcn.0042f5e0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
mov dl, 1
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 4]
lea eax, [ebp - 0x10]
mov ecx, 0x45f658
mov edx, dword [ebp - 4]
call fcn.00404224
push 1
mov eax, dword [ebp - 0x10]
call fcn.004043d8
push eax
call sub.kernel32.dll_WinExec
push 0x1f4
call sub.kernel32.dll_Sleep_1
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x45f439
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f606
lea eax, [ebp - 0x3c]
mov edx, 0xa
call fcn.00403f3c
lea eax, [ebp - 0x10]
call fcn.00403f18
lea eax, [ebp - 4]
call fcn.00403f18
ret
Function at 0x4efadf
Capabilities:
Inspect section memory permissions

Disassembly:
or edx, 0x10
jmp 0x519c35
je 0x5769df
test eax, 0x80000000
je 0x42a8a7
or edx, 4
jmp 0x468842
or edx, 2
jmp 0x555e76
pop ebp
ret 4
jmp 0x519c35
jmp 0x519c35
je 0x423357
or edx, 0x80
jmp 0x4a27bd
jmp 0x519c35
or edx, 0x20
jmp 0x4e5530
test eax, 0x40000000
jmp 0x4279da
jmp 0x519c35
jmp 0x519c35
push ebp
dec ebp
shl ah, cl
bsf ebp, ebp
mov ebp, esp
shl ah, cl
mov eax, dword [ebp + 8]
xor edx, edx
cmp di, 0x53e2
test eax, 0x4000000
je 0x4efb05
or edx, 0x200
test eax, 0x20000000
je 0x4d65f6
test eax, 0x40000000
jmp 0x543c92
je 0x519c32
or edx, 8
jmp 0x4e7670
or edx, 1
mov eax, edx
xchg ebp, ebp
jmp 0x433d01
je 0x59378d
test eax, 0x80000000
je 0x4d0b2c
or edx, 0x40
jmp 0x4b90b9
jmp 0x519c35
test eax, 0x80000000
jmp 0x505d8f
test eax, 0x80000000
jmp 0x4ad12d

Function at 0x51e25d
Capabilities:
Parse pe header

Disassembly:
call fcn.00413a8c
mov edx, eax
bswap cx
xchg cx, cx
lea eax, [ebp - 0x14c]
bswap cx
mov ecx, 0xf8
jmp loc.00414ada
lea eax, [ebp - 0x54]
mov ecx, 0x40
movsx dx, ch
jmp 0x444617
mov dword fs:[eax], edx
jmp 0x4947b9
mov edx, edi
call fcn.0040676c
cmp word [ebp - 0x54], 0x5a4d
jmp 0x52ce06
push edx
jmp 0x555648
jmp fcn.004143ea
push ebp
xor ebp, 0x5ea81f69
stc
rol bp, 0xe0
mov ebp, esp
lea esp, [esp - 0x14c]
push ebx
mov bx, 0x6984
push esi
sub bx, bp
ror bh, cl
push edi
mov ebx, ecx
cmovb cx, dx
movzx cx, ah
mov esi, edx
mov edi, eax
cmovp ecx, edi
cmc
sub eax, eax
inc cx
mov dword [ebp - 8], eax
shrd ecx, edi, 0x15
sub eax, eax
mov ch, 0x86
mov dword [esi], eax
rol cl, 0x6a
sub eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov al, 0x9e
push ebp
cbw
movzx eax, di
push 0x47c2eb
not ah
xchg al, cl
lahf
push dword fs:[edx]
mov ax, cx
cmova eax, edx
setg al
mov dword fs:[edx], esp
xchg cl, dh
lahf
jmp 0x42d265
je 0x5891b9
mov eax, 0x418884
jmp 0x571f52
push eax
bswap eax
mov eax, edi
jmp 0x41da32
call fcn.004043cc
xor eax, eax
bswap dx
movzx cx, ch
pop edx
pop ecx
xchg cl, cl
pop ecx
jmp 0x436852
mov eax, dword [ebp - 0x18]
sete dh
cdq
jmp 0x48b543

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x6f750f73
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x627d757a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40c5be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40c602
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40c5d1
jmp 0x40c602
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40c5f2
pop esi
pop ebp
ret

Function at 0x40d35a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40d38f
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40d3b9
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40d3b9
test edi, edi
je 0x40d386
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40d386
test edi, edi
je 0x40d3c1
mov eax, edi
jmp 0x40d388
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40d388
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040fed7
add esp, 0xc
int3
Function at 0x40ff0b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestEnumSet.exe_gMozillaPoisonSize], eax
call fcn.0040d35a
pop ecx
mov ecx, dword [sym.TestEnumSet.exe_gMozillaPoisonSize]
mov dword [sym.TestEnumSet.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40ff43
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestEnumSet.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x4b6b80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x74000]
push edi
jmp 0x4b6b9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b6ba1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b6b90
mov eax, 1
add ebx, ebx
jne 0x4b6bb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b6bc4
jne 0x4b6be3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b6be3
dec eax
add ebx, ebx
jne 0x4b6bd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b6ba8
add ebx, ebx
jne 0x4b6bdf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b6c35
xor ecx, ecx
sub eax, 3
jb 0x4b6bfb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b6c6a
sar eax, 1
mov ebp, eax
jmp 0x4b6c06
add ebx, ebx
jne 0x4b6c06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b6bd4
inc ecx
add ebx, ebx
jne 0x4b6c14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b6bd4
add ebx, ebx
jne 0x4b6c21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b6c16
jne 0x4b6c32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b6c16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b6c54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b6c46
jmp 0x4b6b96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b6c54
add edi, ecx
jmp 0x4b6b96
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b6c72
cmp byte [edi], 0x11
jne 0x4b6c72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b6c77
lea edi, [esi + 0xb2000]
mov eax, dword [edi]
or eax, eax
je 0x4b6cef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbb148]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbb29c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b6ca4
mov ecx, edi
jns 0x4b6cd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbb2a0]
or eax, eax
je 0x4b6ce9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b6cc1
call dword [esi + 0xbb2b0]
mov ebp, dword [esi + 0xbb2a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b6d23
sub esp, 0xffffff80
jmp 0x416310
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1e227281
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x37af7dee
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4c7573
Capabilities:
Encode data using xor

Disassembly:
inc ecx
ret 0x6a48
lcall 0x16b2, 0xfc7ae4f4
lodsd eax, dword [esi]
test esp, ebx
add dword [edi - 0x5f], edx
fisubr word [ecx - 0x4d]
dec edi
loope 0x4c7525
mov eax, dword [0x1243c2f6]
or ebp, dword [eax + edi - 0x736cdb08]
insb byte es:[edi], dx
clc
xor eax, 0x732798f4
cwde
cmp dword [esi - 0x4939bf87], 0x32cb562f
salc
in eax, dx
and edi, eax
adc dl, byte [eax + 0x73]
stc
loope 0x4c758b
mov byte [0x29b71505], al
invalid

Function at 0x4cc49f
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
fcmovnu st(0), st(0)
or dword [edi + 0x7eb0e11], esp
pop edi
mov ah, 0x4f
add bh, 0x49
or byte [edx], ah
push ebx
push ebx
invalid

Function at 0x4db79a
Capabilities:
Encode data using xor

Disassembly:
push ebx
out 0xc8, al
sar ch, 0xa4
inc ebp
push ds
push eax
invalid

Function at 0x5135c5
Capabilities:
Encode data using xor

Disassembly:
cwde
mov eax, dword [0x99ba0204]
sub dword [eax + 0x7a], edi
invalid
les ecx, [ebx + ebp*8 - 0x4e]
sbb ah, byte [ebx - 0x22475767]
inc ebp
inc eax
jmp 0x13a23f97
dec esp
jmp 0x513511
push ebp
pop esp
in eax, 0x5d
inc edx
mov eax, 0xb53ff33f
aas
aas
mov ch, 0x84
adc dword [ebx - 0xeb544ec], edx
sub ecx, eax
inc esp
ja 0x51355b
scasd eax, dword es:[edi]
in al, 0x97
mov edx, 0x2534d5fa
xchg edx, eax
sub dword [edx + ecx + 0x1c57ab89], esi
loop 0x51355c
xchg dword [eax - 0x35da3d6a], ecx
salc
xor al, 0xda
hlt
jb 0x513588
pop ebp
dec edx
mov bl, byte [esp + esi*4]
adc eax, 0xa126e7fa
add edx, dword [0x6e142825]
bound ebp, qword [edx - 0x41]
mov esi, 0x9f353317
div byte [edi]
mov dl, 0x6d
xchg esp, eax
pop ecx
and ebp, dword [esi - 0x5a7544e0]
xor al, 8
mov esp, 0xe59efdf5
mov word [0x5d99818b], cs
or byte [edi - 0x35], dl
xor eax, 0x771bf81b
and cl, byte [ebp - 0x66657585]
mov dword [0x1bf05ff6], eax
or ebx, dword [0xa6a44d95]
fiadd word [eax]
dec esi
mov eax, dword [0xbd7188a1]
insd dword es:[edi], dx
mov edi, gs
lgs eax, [ebx - 0x89a34d8]
imul esp, edi, 0x65
and ebp, edx
leave
loop 0x5135fa
push edi
retf
mov ebx, 0xaeeacc79
aad 0x7d
push ebp
or eax, 0xf9adf48a
mov cl, 0x5c
mov dh, 0x3e
mov dword [ebp - 0x5a], 0xbbd15d58
pop ds
out 0x8e, al
mov al, 0xd1
pop eax
rcr dword [ecx], 0x6f
inc ebx
mov ebx, 0xd6858da4
cmpsd dword [esi], dword es:[edi]
mov edx, 0x67c02f1c
invalid

Function at 0x55650e
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor dword [edi - 0x330a4a39], ecx
mov dword [edi - 0x3a], esi
mov al, byte [0xad8bc2b6]
adc dh, byte [ecx]

Function at 0x55651e
Capabilities:
Encode data using add xor sub operations

Disassembly:
push eax
adc dword [ebp - 0x184258e4], esi
dec edi
add edi, dword [edx + edx]
sahf
add al, 0x52
and dword [edx + 0x32], edx
xor bh, byte [ebx - 0x55a00aac]

Function at 0x55652e
Capabilities:
Encode data using add xor sub operations

Disassembly:
push eax
adc dword [ebp - 0x184258e4], esi
dec edi
add edi, dword [edx + edx]
sahf
add al, 0x52
and dword [edx + 0x32], edx
xor bh, byte [ebx - 0x55a00aac]