joyce8/EMBER2024-capa huggingface dataset:
Function at 0x534f70
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53518d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x535027
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x5350a0
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x535008
cmp ecx, 0xf
jne 0x535119
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x535008
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x535008
call fcn.0044d880
jmp fcn.00534f70
Function at 0x73ebbac8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x73ebbace
ret

Function at 0x73ec6bd8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x73ec6d89
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.73ea44fc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x73ec6da0
call fcn.73ea4158
mov eax, ebx
call fcn.73eb9a64
mov edi, eax
dec edi
test edi, edi
jl 0x73ec6c90
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.73eb9a38
mov edx, dword [0x73ecb8c8]
call fcn.73ea3288
test al, al
je 0x73ec6c8c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.73eb9a38
lea edx, [ebp - 0x14]
call fcn.73ed3f60
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.73ea44fc
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.73ea41cc
inc esi
dec edi
jne 0x73ec6c3e
mov al, byte [0x73ec6da4]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x73ec6db0
mov eax, dword [ebp - 0xc]
call fcn.73eac7e0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.73ea3ee4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.73ed3f60
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x73ec6da0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.73ed3f60
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x73ec6da0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x73ec6da0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x73ec6dbc
call fcn.73ea8b50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73ec6d90
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.73ea3e70
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.73ea3e70
lea eax, [ebp - 0x14]
call fcn.73ea3e4c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.73ea3e70
ret
Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret

Function at 0x53fdf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd7000]
push edi
or ebp, 0xffffffff
jmp 0x53fe12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53fe19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53fe08
mov eax, 1
add ebx, ebx
jne 0x53fe2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53fe3c
jne 0x53fe4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53fe4c
dec eax
add ebx, ebx
jne 0x53fe48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53fe20
xor ecx, ecx
sub eax, 3
jb 0x53fe64
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53fed6
sar eax, 1
mov ebp, eax
jmp 0x53fe6f
add ebx, ebx
jne 0x53fe6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x53fe7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x53fea0
inc ecx
add ebx, ebx
jne 0x53fe8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53fe81
jne 0x53fe9d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53fe81
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53fec0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53feb1
jmp 0x53fe0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53fec0
add edi, ecx
jmp 0x53fe0e
pop esi
mov edi, esi
mov ecx, 0x39e0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53fede
cmp byte [edi], 0x28
jne 0x53fede
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x53fee3
lea edi, [esi + 0x13c000]
mov eax, dword [edi]
or eax, eax
je 0x53ff5b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1410b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1411f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53ff10
mov ecx, edi
jns 0x53ff3f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1411f8]
or eax, eax
je 0x53ff55
mov dword [ebx], eax
add ebx, 4
jmp 0x53ff2d
call dword [esi + 0x1411fc]
popal
jmp 0x422c92
Function at 0x2ca5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.02ca51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x2ca507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2ca506a
add dl, dl
jne 0x2ca5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2ca50dc
xor eax, eax
add dl, dl
jne 0x2ca5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2ca517d
add dl, dl
jne 0x2ca50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2ca50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2ca50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2ca50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x2ca50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x2ca5075
mov eax, 1
add dl, dl
jne 0x2ca50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2ca50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2ca50e1
sub eax, ebx
mov ebx, 1
jne 0x2ca5128
mov ecx, 1
add dl, dl
jne 0x2ca510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2ca5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2ca5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2ca5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x2ca513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2ca514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2ca5136
cmp eax, 0x7d00
jae 0x2ca516d
cmp eax, 0x500
jb 0x2ca5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2ca5075
cmp eax, 0x7f
ja 0x2ca5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2ca5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x2ca519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x2ca5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x17c5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.017c51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x17c507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17c506a
add dl, dl
jne 0x17c5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17c50dc
xor eax, eax
add dl, dl
jne 0x17c5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17c517d
add dl, dl
jne 0x17c50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17c50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17c50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17c50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x17c50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x17c5075
mov eax, 1
add dl, dl
jne 0x17c50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17c50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17c50e1
sub eax, ebx
mov ebx, 1
jne 0x17c5128
mov ecx, 1
add dl, dl
jne 0x17c510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x17c5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17c5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17c5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x17c513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x17c514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17c5136
cmp eax, 0x7d00
jae 0x17c516d
cmp eax, 0x500
jb 0x17c5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17c5075
cmp eax, 0x7f
ja 0x17c5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17c5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x17c519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x17c5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x463910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x449015
lea edi, [esi - 0x48015]
push edi
or ebp, 0xffffffff
jmp 0x463932
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x463939
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x463928
mov eax, 1
add ebx, ebx
jne 0x46394b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x463940
jne 0x46395c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x463940
xor ecx, ecx
sub eax, 3
jb 0x463970
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4639e2
mov ebp, eax
add ebx, ebx
jne 0x46397b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x463988
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4639ac
inc ecx
add ebx, ebx
jne 0x463998
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46398d
jne 0x4639a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46398d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4639cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4639bd
jmp 0x46392e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4639cc
add edi, ecx
jmp 0x46392e
pop esi
mov edi, esi
mov ecx, 0x1fa6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4639ea
cmp byte [edi], 0x16
jne 0x4639ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4639ef
lea edi, [esi + 0x61000]
mov eax, dword [edi]
or eax, eax
je 0x463a5e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x742c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7432c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x463a1c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x74334]
or eax, eax
je 0x463a58
mov dword [ebx], eax
add ebx, 4
jmp 0x463a39
call dword [esi + 0x74330]
mov ebp, dword [esi + 0x74338]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x63ab9]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x463aaa
sub esp, 0xffffff80
jmp 0x4017a0
Function at 0xb4a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0xdb010]
push edi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x4e502ba
nop
push eax
call 0x77a95da0
nop
mov ebx, eax
push 0xe49e8
mov dword [ebp - 4], ebx
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
mov byte [ebx + edi], 0
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0xb4b7a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x773997f0
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0xe49e8
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0xb4b06
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
push 0xe49e8
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x4e502c0
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xb6ef0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0xb6f91
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x77398cf0
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0xb6fc0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0xb6fc0
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0xb6f91
mov ecx, dword [ebx]
push edi
push pe_nt_image_headers32
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
nop
call 0x77398cf0
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0xb6fc0
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0xb6fc0
movzx eax, word [esi + 0x46]
test ax, ax
je 0xb6fc0
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.002e90f4]
push eax
call dword [fcn.002e9088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0xb6f97
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.000b7590
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x5aeaf0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x2e90e0]
test esi, esi
jne 0x5aeb08
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x5aeb01
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x5aeb01
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x5aeb6a
jmp 0x5aeb50
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x2e8bf0]
add eax, esi
call fcn.005ac610
test eax, eax
je 0x5aeb73
inc edi
cmp edi, dword [ebp - 4]
jb 0x5aeb50
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40162c
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x401667
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40164e
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40165f
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x401669
inc edi
add eax, 0x28
cmp edi, esi
jb 0x401644
xor eax, eax
pop edi
pop esi
ret

Function at 0x401ca0
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp + 0xc], ebx
jmp 0x401cab
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x401cc3
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x401ce1
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x401d3f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x401d26
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x401d2f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x401d39
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x401d1b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x401ca5
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x401d8c
dec eax
je 0x401d83
sub eax, 3
je 0x401d7a
mov dword [ebp - 4], 0x40
jmp 0x401da9
mov dword [ebp - 4], 4
jmp 0x401d8f
mov dword [ebp - 4], 0x20
jmp 0x401d8f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x401ddb
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x401d5b
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004015ec
jns 0x401dbc
test dword [eax - 1], edi
invalid
dec eax
ljmp 0x5601

Function at 0x402570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov dword [0x27fffffc], eax