joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7290
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x4a72bf
cmp ecx, eax
jne 0x4a72bf
mov ecx, ebx
call fcn.004a6240
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
cmp esi, ecx
je 0x4a739d
push edi
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a72d5
sub eax, edi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x4a7300
lea esp, [esp]
movsx edi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, edi
cmp edx, eax
jne 0x4a72f0
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.004e6e9c
imul edx, edx, 0x41a7
imul eax, eax, 0xb14
add esp, 8
sub edx, eax
jns 0x4a732a
add edx, 0x7fffffff
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, edx
cmp dword [ebx + 0x24], eax
ja 0x4a733f
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x4a7368
cmp dword [ecx], esi
jne 0x4a7360
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x4a7370
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x4a7370
cmp dword [ecx], esi
jne 0x4a7370
mov edx, dword [esi]
mov dword [ecx], edx
cmp esi, dword [ebx + 4]
je 0x4a7390
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
push esi
mov dword [edx + 4], eax
call fcn.00481974
add esp, 4
dec dword [ebx + 8]
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
jne 0x4a72c8
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4c32e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ebcc3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51e584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x38
call fcn.004819d0
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x4c3365
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.google::protobuf::SourceCodeInfo_Location.0
call fcn.004bdc40
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov eax, 0x51f6e0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c40d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9e28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51e584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::FileDescriptorProto.0
call fcn.004bdc40
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov eax, 0x51f6e0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x80], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x84], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c4550
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9e28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51e584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::DescriptorProto.0
call fcn.004bdc40
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 8], 0x51f6e0
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c6550
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9e28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51e584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.004bdc40
fldz
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
fstp qword [esi + 0x30]
mov eax, 0x51f6e0
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x44], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c66a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ebcc3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51e584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x48
call fcn.004819d0
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x4c6733
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.004bdc40
fldz
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
fstp qword [esi + 0x30]
mov eax, 0x51f6e0
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x44], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b594d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4b596d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b4a5a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4b5990
test byte [esp + 8], 2
je 0x4b5990
call fcn.004b4acd
mov dword [eax], 0xd
call fcn.004b4ad6
mov dword [eax], 5
jmp 0x4b5969
xor eax, eax
ret

Function at 0x4c6699
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c66d1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c4726
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c46fe
jmp 0x4c66dd
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c7d8b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c7dcd
call fcn.004cdb04
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c7dcd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c7dc4
xor eax, eax
jmp 0x4c7dd5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c7ddb
pop edi
pop esi
pop ebx
ret 4

Function at 0x4ce034
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4ce062
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ce080
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004cdf9a
jmp 0x4ce080
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ce080
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004cdf9a
test edi, edi
mov eax, edi
jne 0x4ce06a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x4e2a4735
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x674478a9
nop
nop
nop
nop
nop
test eax, eax
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0xa52260
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0xa5229a
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0xa522a1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0xa52280
jmp 0xa522a3
mov eax, 0x1505
jmp 0xa522a3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0xa58d70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0xa58dd2
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0xa58d90
mov eax, 0x270
jmp 0xa58de4
cmp eax, 0x4e0
jb 0xa58de4
mov esi, ecx
call fcn.00a58e30
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
mov ecx, eax
and ecx, edx
add ecx, ecx
sub eax, ecx
add eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
mov edx, ecx
and edx, eax
add edx, edx
sub ecx, edx
add ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret

Function at 0xa58e30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [ecx + 0x9c4]
mov eax, 0x3fe
jmp 0xa58e66
shr esi, 1
xor esi, dword [ecx + eax*4]
xor esi, edi
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
cmp eax, 0x4e1
je 0xa58e97
mov esi, edx
and esi, 0x80000000
mov edx, dword [ecx + eax*4 - 0x630]
lea edi, [edx - 0x80000000]
mov ebx, edx
or ebx, 0x7fffffff
and ebx, edi
or esi, ebx
mov edi, esi
xor edi, 0xfffffffe
and edi, ebx
je 0xa58e50
mov edi, 0x9908b0df
jmp 0xa58e50
mov edi, dword [ecx + 0xd50]
mov eax, 0xe4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [eax - 1]
and edi, 0x80000000
mov ebx, dword [ecx + eax*4 + 0x9c4]
mov esi, ebx
and esi, 0x7ffffffe
or esi, edi
shr esi, 1
mov edi, ebx
and ebx, 1
neg ebx
and ebx, 0x9908b0df
mov ebp, edx
or ebp, 0x3ffffd8f
and edx, 0x18f
add edx, ebp
xor ebx, dword [ecx + edx*4 + 0x63c]
xor ebx, esi
mov dword [ecx + eax*4], ebx
inc eax
cmp eax, 0x270
jne 0xa58eb0
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xa68840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], 0xe388e1cf
mov dword [esp + 0x14], 0xe789e597
mov dword [esp + 0x18], 0xebeae986
xor eax, eax
nop
movzx ecx, byte [esp + eax + 0x10]
xor cl, al
xor cl, 0xe0
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0xc
jne 0xa68870
mov dword [esp + 0x34], 0xe275e077
mov dword [esp + 0x38], 0xe675e477
mov dword [esp + 0x3c], 0xda86d8ad
mov dword [esp + 0x40], 0xde41dc84
mov dword [esp + 0x44], 0xd272d040
mov dword [esp + 0x48], 0xd649d472
mov dword [esp + 0x4c], 0xca56c84f
mov dword [esp + 0x50], 0xce59cc58
mov dword [esp + 0x54], 0xc2c1c085
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x57
xor cl, byte [esp + eax + 0x34]
add cl, 0x48
mov byte [esp + eax + 0x34], cl
mov ecx, eax
and ecx, 0x2d
xor eax, 0x97076d2d
lea eax, [eax + ecx*2]
add eax, 0x68f892d4
cmp eax, 0x24
jb 0xa688d0
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x14c]
test cx, cx
je 0xa68921
lea edx, [esp + 0x36]
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xa68910
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0xa68951
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xa68940
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0xa68981
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xa68970
mov word [eax], 0
mov edi, dword [esi]
mov dword [esp + 0x34], 0xd8dddfa3
mov byte [esp + 0x38], 0xbd
mov eax, 0x94aa6b31
mov esi, 0x6b5594ce
nop
movzx ebx, byte [esp + eax + 0x6b559503]
mov ecx, esi
and ecx, 0x4a41844e
mov edx, eax
and edx, 0x90086301
or edx, ecx
xor edx, ebx
mov ebx, edx
not ebx
xor edx, 0x81
and ebx, 1
add edx, 0x89
or edx, 1
sub ebx, edx
mov byte [esp + eax + 0x6b559503], bl
inc eax
dec esi
cmp eax, 0x94aa6b36
jne 0xa689a0
movzx eax, byte [esp + 0x34]
test al, al
je 0xa68a0b
lea ecx, [esp + 0x35]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0xa68a00
mov byte [edi], 0
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x140]
lea edx, [esp + 0x20]
lea esi, [esp + 0x14c]
push eax
push ecx
push edx
push esi
call fcn.00a5b220
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0xa8ea40]
mov ecx, 0xcf1d2b71
xor ecx, dword [0xa8ea48]
add eax, ecx
inc eax
jmp eax
Function at 0xa70c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x14c0
call fcn.00a581f0
push eax
sub esp, 0x10
mov dword [ebp - 0x48], esp
sub esp, 0x200
mov dword [ebp - 0x24], esp
sub esp, 0x14
mov eax, esp
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x18], eax
push eax
mov dword [ebp - 0x4c], esp
sub esp, 0x800
mov dword [ebp - 0x2c], esp
push eax
mov dword [ebp - 0x68], esp
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x400
mov dword [ebp - 0x28], esp
push eax
mov dword [ebp - 0x3c], esp
sub esp, 0x10
mov ebx, esp
sub esp, 0x14
mov dword [ebp - 0x1c], esp
sub esp, 0x24
mov dword [ebp - 0x70], esp
mov dword [ebp - 0x14cc], 0xef3ced30
mov dword [ebp - 0x14c8], 0xf335f135
mov dword [ebp - 0x14c4], 0xf725f53d
mov dword [ebp - 0x14c0], 0xfb28f92c
mov dword [ebp - 0x14bc], 0xff22fd25
mov dword [ebp - 0x14b8], 0xc311c115
mov dword [ebp - 0x14b4], 0xc714c501
mov word [ebp - 0x14b0], 0xc9c8
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ecx - 0x14cc]
mov esi, eax
and esi, 0x18
mov edi, ecx
xor edi, 0xc0de48c
add edi, esi
xor edi, edx
add edi, 0x9f90db9f
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [ebp + ecx - 0x14cc], dl
inc ecx
add eax, 2
cmp ecx, 0x1e
jne 0xa70cd0
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x14cc]
push 0
push 0
push 0x20019
push eax
mov dword [ebp - 0x20], ecx
push ecx
call fcn.00a89610
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0xa8f388]
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x5ccf60e2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, str._q.q
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x716c4cce
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x412089
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x412089
lcall 0x5de5, 0x8b10c483
jmp loc.007bbabc

Function at 0x84fd71
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dword [eax + eax], 0x5a520000
push esi
pop esi
push edi
push eax
push edx
rdtsc
pop edx
pop eax
pop edi
rdtsc
jb 0x84fca2
jl 0x84fc9c
jns 0x84fca2
jmp 0x84fcb3
pop edx
pop eax
pushfd
sub esp, 4
mov dword [esp], ebx
mov dword [esp], 0x7fcf863f
add dword [esp], 0x775c4790
push ebp
mov ebp, 0x3be76eeb
and dword [esp + 4], ebp
pop ebp
push ebx
mov ebx, 0x33234d37
xor dword [esp + 4], ebx
pop ebx
push ebp
mov dword [esp], ebx
mov dword [esp], 0x7fb7815b
and dword [esp], 0x7cf5cb80
shr dword [esp], 7
not dword [esp]
add dword [esp], 1
xor dword [esp], 0x7ffb6821
push ecx
mov ecx, 0x7f46efff
add dword [esp + 4], ecx
pop ecx
push esi
mov dword [esp], 0x3fe5566b
mov dword [esp], edi
mov dword [esp], 0x7dd4a45b
xor dword [esp], 0x6947d73b
not dword [esp]
sub dword [esp], 0xc167bbaf
mov dword [esp], eax
push 0x3a410880
mov dword [esp], edx
push esp
pop edx
add edx, 4
sub edx, 4
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
pop esp
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
push dword [esp]
pop eax
add esp, 4
add esp, 4
push dword [esp + 8]
push dword [esp]
pop ebx
push ebp
mov ebp, esp
push ecx
mov ecx, 4
add ebp, ecx
pop ecx
add ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push ebx
mov ebx, esp
add ebx, 4
push ecx
mov ecx, 4
add ebx, ecx
pop ecx
xchg dword [esp], ebx
pop esp
mov eax, dword [esp]
sub esp, 4
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
push eax
mov eax, 0x5ff78c1a
add eax, 0xa00873ea
add ebx, eax
mov eax, dword [esp]
add esp, 4
xchg dword [esp], ebx
pop esp
jmp 0x7b2950
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x45224b96
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x3b660463
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219