joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f500
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41f510
cmp eax, 0xffffffed
jge 0x41f527
mov eax, 0xffffffff
jmp 0x41f52a
add eax, 0x12
push eax
call fcn.00408000
add esp, 4
mov esi, eax
mov dword [esp], 0x5dc45dd2
mov dword [esp + 4], 0x5dc85df5
mov dword [esp + 8], 0x5dbd5d86
mov dword [esp + 0xc], 0x5df75df0
mov word [esp + 0x10], 0x5c56
mov eax, 0x989e
mov ecx, 0x6761
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2 - 0x1313c]
mov ebx, eax
xor ebx, ecx
and ebx, edx
xor ebx, ecx
mov edx, 0x3b0f
sub edx, ebx
mov word [esp + eax*2 - 0x1313c], dx
inc eax
dec ecx
cmp eax, 0x98a7
jne 0x41f570
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41f5c1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41f5b0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41f5f1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41f5e0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00439430
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x43fbdc]
Function at 0x421390
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov dword [esp], 0x340534ed
mov dword [esp + 4], 0x34283425
mov dword [esp + 8], 0x3421342d
mov dword [esp + 0xc], 0x343f340f
mov dword [esp + 0x10], 0x34153420
mov dword [esp + 0x14], 0x34273433
mov dword [esp + 0x18], 0x34f03435
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0x34d6
xor ecx, ecx
xor edx, edx
mov esi, ecx
and esi, 0xfffffff0
add esi, edx
movzx edi, word [esp + ecx]
xor esi, 0xc720b088
mov ebx, esi
or ebx, edi
and esi, edi
sub ebx, esi
add ebx, 0xd998a435
mov esi, ebx
and esi, 0x7bbf
xor ebx, 0x7bbf
lea esi, [ebx + esi*2]
add esi, 0x5bcc
mov word [esp + ecx], si
inc edx
add ecx, 2
cmp ecx, 0x1e
jne 0x4213e0
lea ebx, [esp + 0x72]
mov edx, esp
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x44531c]
mov dword [esp], 0x7bfc3bd8
xor edx, edx
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + edx*2]
mov ebp, 0x231c
sub ebp, edx
lea edi, [edx - 0x2fca231d]
or edi, esi
not esi
or esi, ebp
and esi, edi
mov edi, esi
and edi, 0x18e7
or esi, 0x18e7
add esi, edi
inc esi
mov word [esp + edx*2], si
mov edx, 1
test cl, 1
mov ecx, 0
jne 0x421470
xor ecx, ecx
cmp eax, dword [esp]
setne cl
jmp dword [ecx*4 + 0x440104]
Function at 0x423930
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x834
xor esi, esi
mov eax, 0x20219
mov ecx, 1
xor edi, edi
mov dword [esp], 0
jmp 0x423930
jmp dword [ecx*4 + 0x4407f8]
Function at 0x4280c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x428202
mov edx, dword [esp + 0x10]
not eax
xor esi, esi
nop
nop
nop
nop
nop
movzx edi, byte [edx + esi]
xor edi, eax
mov eax, edi
shr eax, 1
mov ebx, edi
xor ebx, 0xfffffffe
or edi, 1
and edi, ebx
neg edi
mov ebx, edi
xor ebx, 0x12477cdf
or edi, 0xedb88320
and edi, ebx
xor edi, eax
mov eax, edi
shr eax, 1
mov ebx, edi
xor ebx, 0xfffffffe
or edi, 1
and edi, ebx
neg edi
mov ebx, edi
xor ebx, 0x12477cdf
or edi, 0xedb88320
and edi, ebx
xor edi, eax
mov eax, edi
shr eax, 1
mov ebx, edi
xor ebx, 0xfffffffe
or edi, 1
and edi, ebx
neg edi
mov ebx, edi
xor ebx, 0x12477cdf
or edi, 0xedb88320
and edi, ebx
xor edi, eax
mov eax, edi
shr eax, 1
mov ebx, edi
xor ebx, 0xfffffffe
or edi, 1
and edi, ebx
neg edi
mov ebx, edi
xor ebx, 0x12477cdf
or edi, 0xedb88320
and edi, ebx
xor edi, eax
mov eax, edi
shr eax, 1
mov ebx, edi
xor ebx, 0xfffffffe
or edi, 1
and edi, ebx
neg edi
mov ebx, edi
xor ebx, 0x12477cdf
or edi, 0xedb88320
and edi, ebx
xor edi, eax
mov eax, edi
shr eax, 1
mov ebx, edi
xor ebx, 0xfffffffe
or edi, 1
and edi, ebx
neg edi
mov ebx, edi
xor ebx, 0x12477cdf
or edi, 0xedb88320
and edi, ebx
xor edi, eax
mov eax, edi
shr eax, 1
mov ebx, edi
xor ebx, 0xfffffffe
or edi, 1
and edi, ebx
neg edi
mov ebx, edi
xor ebx, 0x12477cdf
or edi, 0xedb88320
and edi, ebx
xor edi, eax
mov ebx, edi
shr ebx, 1
mov eax, edi
xor eax, 0xfffffffe
or edi, 1
and edi, eax
neg edi
mov eax, edi
xor eax, 0x12477cdf
or edi, 0xedb88320
and edi, eax
mov eax, edi
xor eax, ebx
inc esi
cmp ecx, esi
jne 0x4280e0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x42e3b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00413820
sub esp, 0x10
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42e3da
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42e3eb
jmp 0x42e532
mov dword [ebp - 0x20], edi
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42e42b
jmp 0x42e52a
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], eax
call fcn.00423550
add esp, 4
cmp eax, 0
setne cl
jmp 0x42e450
xor ebx, ebx
test cl, 1
jne 0x42e45c
jmp 0x42e51e
mov ecx, eax
and ecx, 1
shl ecx, 1
mov dword [ebp - 0x1c], eax
mov ebx, eax
xor ebx, 1
add ebx, ecx
sub esp, 4
mov dword [esp], ebx
call fcn.00408000
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
call fcn.00408dc0
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov word [esi], 0xd718
mov word [esi + 2], 0xdbc5
mov word [esi + 4], 0xd83f
mov word [esi + 6], 0xdd3f
mov word [esi + 8], 0x993b
mov word [esi + 0xa], 0x23c4
mov word [esi + 0xc], 0xabc5
xor eax, eax
cmp eax, 7
jae 0x42e4e9
mov cx, word [esi + eax*2]
mov dx, ax
add dx, 0xa143
xor dx, cx
add dx, 0xf5e8
mov word [esi + eax*2], dx
add eax, 1
jmp 0x42e4c7
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov esi, dword [ebp - 0x18]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.00408f40
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.00408010
add esp, 4
jmp 0x42e51a
jmp 0x42e51c
jmp 0x42e51e
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42e532
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435780
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0x12d612d7
xor eax, eax
mov cl, 1
movzx edx, word [esp + eax*2]
mov esi, eax
or esi, 0x56c8fde8
mov edi, edx
not edi
lea edi, [edx + edi*2]
inc edi
and edi, esi
mov esi, eax
xor esi, 0x217
and esi, edx
lea edx, [edi + esi]
add edx, 0x10bf
or edi, esi
mov esi, 0x6f40
sub esi, edi
and esi, 0x4972
and edx, 0xb68d
sub edx, esi
add edx, 0x4973
mov word [esp + eax*2], dx
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x4357a0
mov edi, dword [esp]
mov eax, dword [0x445320]
test eax, eax
je 0x435846
xor ecx, ecx
mov edx, dword [0x445324]
nop
nop
nop
cmp dword [edx + ecx*8], 0x67f3d776
je 0x435820
inc ecx
cmp eax, ecx
jne 0x435810
jmp 0x435846
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x435846
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x445328]
call fcn.004371a0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x4359d4
mov dword [esp + 0xc], ebp
push dword [esp + 8]
call fcn.00435730
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp + 4], ecx
mov dword [esp], 0x12d612d7
xor edx, edx
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [esp + edx*2]
mov edi, edx
or edi, 0x56c8fde8
mov esi, ebp
not esi
lea esi, [esi*2 + 1]
add esi, ebp
and esi, edi
mov edi, edx
xor edi, 0x217
and edi, ebp
lea ebp, [esi + edi]
add ebp, 0x10bf
or esi, edi
mov edi, 0x6f40
sub edi, esi
and edi, 0x4972
and ebp, 0xb68d
sub ebp, edi
add ebp, 0x4973
mov word [esp + edx*2], bp
mov edx, 1
test cl, 1
mov ecx, 0
jne 0x435880
mov edi, dword [esp]
mov ecx, dword [0x445320]
test ecx, ecx
je 0x435938
xor edx, edx
mov esi, dword [0x445324]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x67f3d776
je 0x435910
inc edx
cmp ecx, edx
jne 0x435900
jmp 0x435938
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, edi
je 0x435938
push 0
push dword [esp + 8]
push eax
push 5
push 0x10
push ecx
push dword [0x445328]
mov esi, eax
call fcn.004371a0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x4359cb
mov dword [esp], 0x7bfc35de
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx - 0x231d]
xor dx, word [esp + ecx*2]
add edx, 0x18e8
mov word [esp + ecx*2], dx
lea ecx, [ecx + ecx*2]
xor ecx, 1
cmp ecx, 2
jb 0x435950
mov ecx, dword [esp]
mov dword [esp + 4], ecx
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebp]
movzx edi, word [ebx + ebp]
test si, si
je 0x4359a5
add ebp, 2
cmp si, di
je 0x435990
cmp si, di
je 0x4359b6
mov esi, dword [ecx]
test esi, esi
jne 0x435980
mov edi, dword [esp + 4]
jmp 0x4359cb
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00435750
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x435a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x435af0
xor eax, eax
cmp dword [ecx], 0
jne 0x435b49
mov edx, dword [esp + 0x38]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x12d612d7
xor eax, eax
mov bl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + eax*2]
mov edi, eax
or edi, 0x56c8fde8
mov ebp, esi
not ebp
lea ebp, [esi + ebp*2]
inc ebp
and ebp, edi
mov edi, eax
xor edi, 0x217
and edi, esi
lea esi, [edi + ebp]
add esi, 0x10bf
or ebp, edi
mov edi, 0x6f40
sub edi, ebp
and edi, 0x4972
and esi, 0xb68d
sub esi, edi
add esi, 0x4973
mov word [esp + eax*2], si
mov eax, 1
test bl, 1
mov ebx, 0
jne 0x435a70
mov eax, dword [esp]
mov esi, dword [0x445320]
test esi, esi
je 0x435b49
xor edi, edi
mov ebx, dword [0x445324]
nop
nop
cmp dword [ebx + edi*8], 0xf62c6d34
je 0x435b53
inc edi
cmp esi, edi
jne 0x435ae0
jmp 0x435b49
mov dword [esp + 4], 0xd55d1554
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2 + 4]
mov ecx, eax
or ecx, 0x91f990bc
xor ecx, edx
mov edx, 0x3dcfd
sub edx, ecx
add ecx, 0x3c2302
and edx, 0x8a8e3
and ecx, 0x237571c
sub ecx, edx
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov word [esp + eax*2 + 4], cx
lea eax, [eax + eax*2]
xor eax, 1
cmp eax, 2
jb 0x435b00
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x435b49
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x445328]
call fcn.004371a0
add esp, 0x1c
jmp 0x435b49

Function at 0x435b80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x435c4b
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], 0x12d612d7
xor edx, edx
mov bl, 1
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + edx*2]
mov edi, edx
or edi, 0x56c8fde8
mov ebp, esi
not ebp
lea ebp, [esi + ebp*2]
inc ebp
and ebp, edi
mov edi, edx
xor edi, 0x217
and edi, esi
lea esi, [edi + ebp]
add esi, 0x10bf
or ebp, edi
mov edi, 0x6f40
sub edi, ebp
and edi, 0x4972
and esi, 0xb68d
sub esi, edi
add esi, 0x4973
mov word [esp + edx*2], si
mov edx, 1
test bl, 1
mov ebx, 0
jne 0x435ba0
mov edx, dword [0x445320]
test edx, edx
je 0x435c3e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x445324]
nop
nop
cmp dword [ebx + edi*8], 0xb430e561
je 0x435c20
inc edi
cmp edx, edi
jne 0x435c10
jmp 0x435c3e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x435c3e
push eax
push 4
push edx
push dword [0x445328]
mov esi, ecx
call fcn.004371a0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov dword [esp], 0x12d612d7
xor eax, eax
mov dl, 1
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [esp + eax*2]
mov ebp, eax
or ebp, 0x56c8fde8
mov esi, edi
not esi
lea esi, [edi + esi*2]
inc esi
and esi, ebp
mov ebp, eax
xor ebp, 0x217
and ebp, edi
lea edi, [esi + ebp]
add edi, 0x10bf
or esi, ebp
mov ebp, 0x6f40
sub ebp, esi
and ebp, 0x4972
and edi, 0xb68d
sub edi, ebp
add edi, 0x4973
mov word [esp + eax*2], di
mov eax, 1
test dl, 1
mov edx, 0
jne 0x435f50
test ebx, ebx
jne 0x435fb1
lea ebx, [esp + 4]
mov eax, dword [esp]
mov edx, dword [0x445320]
test edx, edx
je 0x436007
xor ebp, ebp
mov esi, dword [0x445324]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0xa99f3325
je 0x435fe0
inc ebp
cmp edx, ebp
jne 0x435fd0
jmp 0x436007
mov edx, dword [esi + ebp*8 + 4]
cmp edx, eax
je 0x436007
push ebx
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ecx
push 0x14
push edx
push dword [0x445328]
call fcn.004371a0
add esp, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x436d20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 2], 0x4a2c4a59
mov dword [esp + 6], 0x4a264a1d
mov dword [esp + 0xa], 0x4a624a27
mov dword [esp + 0xe], 0x4a224a19
mov dword [esp + 0x12], 0x49b04a23
mov eax, 0xe767083f
mov ecx, 0x1898f7c0
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2 + 0x3131ef84]
mov esi, eax
and esi, edx
add esi, esi
sub esi, edx
add esi, ecx
and esi, eax
mov edi, esi
and edi, 2
mov ebx, esi
or esi, 2
imul esi, edi
xor edi, 2
and ebx, 0xe767087d
imul ebx, edi
add esi, ebx
lea edi, [ecx - 0x18980000]
and edi, esi
not esi
and esi, eax
sub esi, edi
add edx, esi
add edx, 0xffffbe08
mov word [esp + eax*2 + 0x3131ef84], dx
inc eax
dec ecx
cmp eax, 0xe7670849
jne 0x436d60
lea esi, [esp + 2]
push esi
call fcn.00438700
add esp, 4
mov dword [0x44d33c], eax
mov ecx, dword [0x442178]
mov edx, 0x714e2573
xor edx, dword [0x44217c]
add ecx, edx
inc ecx
jmp ecx

Function at 0x437c90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov ebx, dword [esp + 0x54]
movzx eax, word [ebx]
mov dword [esp + 0x1c], 0x46ebeb27
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + ecx*2 + 0x1c]
mov esi, edx
not esi
mov edi, 0x40c5
sub edi, ecx
or edi, esi
or edx, ecx
or edx, 0xbf3a
and edx, edi
add edx, 0x630
mov word [esp + ecx*2 + 0x1c], dx
lea ecx, [ecx + ecx*2]
xor ecx, 1
cmp ecx, 2
jb 0x437cb0
xor ecx, ecx
cmp dword [esp + 0x1c], eax
setne cl
mov eax, dword [ecx*4 + 0x4425ec]
mov ecx, 0x330e84e4
xor ecx, dword [0x4425f4]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x487a60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x48000]
lea eax, [edi + 0x78660]
push dword [eax]
mov dword [eax], 0x610d86c0
push eax
push edi
or ebp, 0xffffffff
jmp 0x487a92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x487a99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x487a88
mov eax, 1
add ebx, ebx
jne 0x487aab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x487aa0
jne 0x487abc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x487aa0
xor ecx, ecx
sub eax, 3
jb 0x487ad0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x487b42
mov ebp, eax
add ebx, ebx
jne 0x487adb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x487ae8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x487b0c
inc ecx
add ebx, ebx
jne 0x487af8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x487aed
jne 0x487b09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x487aed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x487b2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x487b1d
jmp 0x487a8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x487b2c
add edi, ecx
jmp 0x487a8e
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x1c9f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x487b4e
cmp byte [edi], 0x11
jne 0x487b4e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x487b53
lea edi, [esi + 0x82000]
mov eax, dword [edi]
or eax, eax
je 0x487bc2
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x88824]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x88874]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x487b80
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8887c]
or eax, eax
je 0x487bbc
mov dword [ebx], eax
add ebx, 4
jmp 0x487b9d
call dword [esi + 0x88878]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x487bf3
cmp al, 0xef
ja 0x487be6
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x487bc8
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x487bd5
mov ebp, dword [esi + 0x88880]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x487c27
sub esp, 0xffffff80
jmp 0x431829
Function at 0x42ee28
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp + 0xc], ebx
jne 0x42e43d
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x14]
mov edx, dword [edx]
and edx, 0xffff
shl edx, 2
add edx, dword [ebp - 0x3c]
mov edx, dword [edx]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x44], 1
add dword [ebp - 0x40], 4
add dword [ebp - 0x14], 2
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0
jne 0x42ee6c
mov eax, dword [ebp - 0x38]
leave
ret 8
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x34], edx
add edx, dword [edx + 0x3c]
mov edx, dword [edx + 0x78]
add edx, dword [ebp - 0x34]
mov ecx, dword [edx + 0x20]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x40], ecx
mov ecx, dword [edx + 0x24]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [edx + 0x1c]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [edx + 0x18]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x40]
mov edx, dword [edx]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], edx
xor ebx, ebx
mov edx, dword [ebp - 0x28]
mov edx, dword [edx]
inc dword [ebp - 0x28]
and edx, 0xff
cmp edx, 0
je 0x42e413
rol ebx, 7
add ebx, edx
xor ebx, 1
jmp 0x42ee7a

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret