joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a550
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x585460]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x458d3b
je 0x458d8a
cmp ebx, 0x20
jbe 0x458d90
cmp ebx, 0x40
jbe 0x458dce
jmp 0x458e5f
test ebx, ebx
je 0x458d80
add eax, 0x10
test ax, 0xff0
je 0x458d6c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4fa2a0]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4fa3a0]
jmp 0x458d58
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x458d58
pxor xmm1, xmmword [0x585470]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x585470]
pxor xmm2, xmmword [0x585480]
pxor xmm3, xmmword [0x585490]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x585470]
pxor xmm2, xmmword [0x585480]
pxor xmm3, xmmword [0x585490]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x458ebe
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x5851b4], 0
je 0x45a56a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x458d00
jmp dbg.runtime.memhashFallback
Function at 0x45a570
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402e5e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call dbg.runtime.memhashFallback
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call dbg.runtime.morestack_noctxt
jmp 0x402e20
cmp byte [0x5851b4], 0
je 0x45a58b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x458d00
jmp 0x402e20

Function at 0x45b2d0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call dbg.runtime.stackcheck
call dbg.runtime.mstart
ret
Function at 0x47c9c0
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47c9f8
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x47c9ef
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ecx, ebx
jg 0x47c9e2
mov dword [esp + 0x14], edx
ret
call dbg.runtime.morestack_noctxt
jmp dbg.reflect.fnv1
Function at 0x4a09d0
Capabilities:
Get disk size

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov edx, eax
sub esp, 0x14
mov eax, 1
test edx, edx
je 0x4a0a7e
mov eax, dword [esp + 0x20]
mul dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
imul ecx, edx
mul dword [esp + 0x24]
mov edi, edx
mov esi, eax
mov eax, dword [esp + 0x44]
add edi, ecx
mov ecx, dword [esp + 0x50]
mov dword [eax], esi
mov edx, edi
mov dword [eax + 4], edi
mov eax, esi
mov ebx, dword [ecx + 4]
shr edx, 0x14
mov ecx, dword [ecx]
shrd eax, edi, 0x14
mov dword [esp + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sym.___udivdi3
mov ecx, eax
mov eax, dword [esp + 0x48]
mov ebx, edx
shld ebx, ecx, 0x14
mov dword [eax], ecx
shl ecx, 0x14
sub esi, ecx
mov dword [eax + 4], edx
mov eax, dword [esp + 0x4c]
sbb edi, ebx
mov dword [eax], esi
mov dword [eax + 4], edi
xor eax, eax
add esp, 0x30
pop ebx
pop esi
pop edi
ret

Function at 0x4a0ec0
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 0xc
mov ebx, dword [esp + 0x20]
call sym._malloc
test eax, eax
je 0x4a0ef5
mov edx, dword [ebx]
mov dword [eax], edx
mov edx, dword [ebx + 4]
mov dword [eax + 4], edx
mov edx, dword [ebx + 8]
mov dword [eax + 8], edx
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp dbg._cgo_sys_thread_start
mov dword [esp], 2
call dword [0x4bdf34]
mov dword [esp + 4], str.runtime_cgo:_out_of_memory_in_thread_start_n
mov dword [esp], eax
call sym._fprintf.constprop.0
call sym._abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4a6410
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4a6470
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x58ab54]
test esi, esi
jle 0x4a6590
mov eax, dword [0x58ab58]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4a64a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4a6527
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4a6490
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4a65b7
mov eax, dword [0x58ab58]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x58ab58]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4a6597
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4a6520
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4a6530
add dword [0x58ab54], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x58ab58]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4a6520
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4a64ae
mov eax, dword [0x58ab58]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x4a6a70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x58ab70
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x58ab68]
sub esp, 4
test ebx, ebx
je 0x4a6ac5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4a6abe
test esi, esi
je 0x4a6abe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4a6aa0
mov dword [esp], 0x58ab70
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4a6df0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4a6e15
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4a6e20
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4a6e15
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4a6e68
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4a6e5e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4a6e6a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4a6e50
xor eax, eax
pop ebx
pop esi
ret
Function at 0x17dfd8a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
push ebp
xor edi, edi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], edi
cmp ebp, edi
jne 0x17dfd8c8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov edx, dword [esp + 0x42c]
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x17e81f70
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ebx, dword [esp + 0x18]
shl eax, 2
lea ecx, [eax + eax*8]
mov eax, dword [ebx]
mov dword [esp + 0x1c], ecx
test byte [eax + ecx + 4], 0x20
je 0x17dfd909
push 2
push 0
push edx
call fcn.17dfde10
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x17dfd9a5
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x17dfd9de
lea esi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x17dfd96c
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x17dfd95a
mov byte [esi], 0xd
inc edi
inc esi
mov byte [esi], al
inc esi
mov eax, esi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x17dfd941
lea eax, [esp + 0x24]
push 0
sub esi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push esi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x17dfd9d4
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, esi
jge 0x17dfd92c
jmp 0x17dfd9de
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x17dfd9d4
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x17dfd9de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x17dfda8a
cmp dword [esp + 0x10], 0
je 0x17dfda3a
cmp dword [esp + 0x10], 5
jne 0x17dfda1d
call fcn.17dfdc60
mov dword [eax], 9
call fcn.17dfdc70
mov ecx, dword [esp + 0x10]
pop ebp
pop edi
mov dword [eax], ecx
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov ecx, dword [esp + 0x10]
push ecx
call fcn.17dfdbe0
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x17dfda64
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x17dfda64
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
call fcn.17dfdc60
mov dword [eax], 0x1c
call fcn.17dfdc70
pop ebp
mov dword [eax], 0
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, edi
pop edi
pop esi
pop ebx
add esp, 0x418
ret

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x431ddb
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x439a10
call fcn.0042e2e0
xor esi, esi
cmp dword [0x43e76c], esi
jne 0x431e1f
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x431e0a
mov dword [0x43e76c], edi
jmp 0x431e1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x431e1f
mov dword [0x43e76c], 2
mov eax, dword [0x43e76c]
cmp eax, 2
je 0x431f00
cmp eax, esi
je 0x431f00
cmp eax, 1
jne 0x431e64
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x431e4d
mov eax, dword [0x43e4d8]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x431e6b
xor eax, eax
jmp 0x431f12
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.00424ea0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x431ea1
cmp edi, esi
jne 0x431ebc
lea eax, [ebx + ebx]
push eax
call fcn.0042372d
pop ecx
mov edi, eax
cmp edi, esi
je 0x431e64
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x431eef
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x431ed9
push esi
push esi
jmp 0x431edf
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x431efb
push edi
call fcn.00423779
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x431f12
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0042e31b
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x430005
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x612f38f3
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6b8e1bad
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x46b970
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5b000]
push edi
jmp 0x46b98a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x46b991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46b980
mov eax, 1
add ebx, ebx
jne 0x46b9a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46b9b4
jne 0x46b9d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46b9d3
dec eax
add ebx, ebx
jne 0x46b9c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x46b998
add ebx, ebx
jne 0x46b9cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x46ba25
xor ecx, ecx
sub eax, 3
jb 0x46b9eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46ba5a
sar eax, 1
mov ebp, eax
jmp 0x46b9f6
add ebx, ebx
jne 0x46b9f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46b9c4
inc ecx
add ebx, ebx
jne 0x46ba04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46b9c4
add ebx, ebx
jne 0x46ba11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46ba06
jne 0x46ba22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46ba06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46ba44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46ba36
jmp 0x46b986
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46ba44
add edi, ecx
jmp 0x46b986
pop esi
mov edi, esi
mov ecx, 0xa57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46ba62
cmp byte [edi], 0x12
jne 0x46ba62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46ba67
lea edi, [esi + 0x69000]
mov eax, dword [edi]
or eax, eax
je 0x46badf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb1fec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb20cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46ba94
mov ecx, edi
jns 0x46bac3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb20d4]
or eax, eax
je 0x46bad9
mov dword [ebx], eax
add ebx, 4
jmp 0x46bab1
call dword [esi + 0xb20d0]
mov ebp, dword [esi + 0xb20d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x46bb13
sub esp, 0xffffff80
jmp 0x41942f
Function at 0x401a24
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ced85
jg 0x401a48
inc edi
cmp edi, 0x1f6502b1
jl 0x401a30
cmp dword [0x2c33a9c], 0x400
jne 0x401a9d
push str.Natipesun_subuguketevam_jutivotitag_roto_jam
push str.Ximoniwek
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push esi
push 0x4801a8
call fcn.004020b2
push esi
push esi
push esi
call fcn.00402098
push esi
push esi
call fcn.00401eb4
push esi
call fcn.004022a7
push esi
call fcn.004022b6
add esp, 0x24
xor edi, edi
cmp edi, 0xd0fe
jge 0x401aae
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
cmp edi, 0x3a37ee
jg 0x401ad5
inc edi
cmp edi, 0xe52f
jl 0x401a9f
mov eax, dword [0x4752d4]
mov dword [0x2c33a9c], eax
call fcn.00401763
mov edi, 0x3078f
cmp dword [0x2c33a9c], 0x51f
jne 0x401b01
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401ae9
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x40800d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474410]
jne 0x408017
repz ret
jmp fcn.0040aa50
Function at 0x9ed965
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov ecx, dword [edi + 8]
jl 0x101b453
das
pushfd
out dx, eax
mov esp, dword [ebx - 0x50]
shr dword [esi], cl
sbb esi, dword [eax - 0x47cc7431]
xchg edi, eax
bound eax, qword [ebx - 0x78]
invalid
dec ecx
add edi, 4
div ecx
inc ecx
mov dword [edi], edx
push 0xf006f930
inc ecx
mov dword [edi + 4], eax
dec eax
lea esp, [esp + 0x18]
jmp fcn.00a0ee38

Function at 0x9f855c
Capabilities:
Encode data using xor

Disassembly:
or dl, 0xa8
lea eax, [edx + edx*4 + 0x75092f9c]
mov esi, ecx
movsx ecx, ax
mov dword [esp + ecx*2 - 0x7084], eax
not word [esp + ebp - 0x4b9e7e14]
pop ebp
js 0xff196d
mov ebp, 0x96193e0a
mov ebp, dword [edi]
mov edx, 0x2b883d8b
lea edx, [edx + edx - 0x6cc3815f]
cmp al, 0x93
sar dx, 0x65
mov dl, byte [edi + 4]
jnp 0xe5f683
sar dword [esi - 0x71], cl
outsd dx, dword [esi]
xor byte [edi + edx*4 + 0xd], 0xf4
sbb al, 0xcb
and eax, ecx
dec esp
mov edi, 0xe33ac037
pmulhuw mm5, qword [edx - 0x61]
add eax, 0x858f5efc
jecxz 0x9f8592
idiv byte [ecx]
push 0x40435794
xchg esp, eax
push edi
inc ebx
inc eax
sub al, 0x19
and byte [ecx - 0x71], bh
into
int 0xf4
sub bl, byte [ebx - 0x30]
sbb dword [ebx], edi
loop 0x9f85c2
fsub qword [esi]
outsd dx, dword [esi]
sal byte [ecx], 0xb3
stosb byte es:[edi], al
mov cl, 0x98
mov ecx, 0xd70afc09
push ebx
mov al, byte [0x846f835a]
outsb dx, byte [esi]
xchg dword [ebx - 0x50], esp
push esi
mov ebx, 0xef34c839
popal
xchg esp, eax
outsb dx, byte [esi]
mov bh, 0xd
int3

Function at 0xa00832
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edx + 0x3c]
jmp 0xa0b27d
je 0xa28285
mov esi, dword [ebp + 0xc]
cmc
clc
test esi, esi
jmp 0xa28271
push ebp
bsr dx, dx
xchg dh, dl
ror dh, 0xbe
mov ebp, esp
mov edx, dword [ebp + 8]
test sp, ax
lea esp, [esp - 0x114]
push esi
cmp edi, ebx
cmp ax, 0x1088
test edx, edx
jmp 0x9f97db
add eax, edx
test di, cx
je 0xa28285
mov eax, 0x5a4d
cmp word [edx], ax
je 0x9f22a3

Function at 0xa1fd44
Capabilities:
Encode data using xor

Disassembly:
push 0x322789a7
add edi, 4
xor ecx, ecx
test eax, eax
lea esp, [esp + 8]
je 0xf53d2d
push 0x70bfa434
mov dword [esp], edi
push 0x193c900
movzx edi, byte [ebp]
inc byte [esp + 1]
xor edi, ecx
and edi, 0xff
mov edi, dword [edi*4 + 0xf58954]
sar dword [esp], 0x5c
not dword [esp]
shr ecx, 8
xor ecx, edi
inc ebp
xor ecx, 0xc091be04
dec eax
lea esp, [esp + 4]
jne 0xa1fd65
push 0x69a5f82b
call fcn.01014849
nop
or al, 0xb0
sub al, 0x1e
xor cl, al
hlt

Function at 0xe57f06
Capabilities:
Encode data using xor

Disassembly:
call fcn.00e8a9ae
mov dword [esp], edi
mov edi, 0xa3314d81
movzx edi, byte [ecx]
xor edi, ebp
push 0xba23d5a3
rol byte [esp + 1], 0xa4
and edi, 0xff
sal word [esp + 1], 0xe1
mov edi, dword [edi*4 + 0xa22028]
shr ebp, 8
shl dword [esp], 0xd2
xor ebp, edi
inc ecx
xor ebp, 0x23315f86
dec eax
lea esp, [esp + 4]
jne 0xe57f09
push 0x1b82d31e
mov edi, dword [esp]
pop edi
pop edi
jmp 0xf292bb
jmp 0xe52121