joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10086450
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [ebp + 0x10]
call fcn.1004f2d0
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x100dcbac]
mov esi, eax
add esp, 8
test esi, esi
je 0x100865b2
lea ecx, [esi + 0xc]
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
push edi
lea edi, [ebx + 4]
cmp eax, dword [ebx + 0x10]
jbe 0x100864d0
mov eax, dword [ebx]
push ecx
call eax
push dword [ebp - 8]
mov eax, dword [ebp + 0xc]
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebx + 0xc]
push dword [esi + 4]
mov dword [ebp + 0xc], eax
push eax
mov eax, dword [ebx + 8]
call eax
mov eax, dword [ebx + 0x14]
add esp, 0x18
mov dword [ebp - 8], eax
push dword [esi + 4]
mov eax, dword [ebx]
call eax
push dword [esi + 8]
mov eax, dword [ebx]
call eax
mov eax, dword [ebp - 8]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10086529
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub dword [ebp - 8], 1
jne 0x100864f0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp ebx, dword [eax + 0x10]
jae 0x10086559
mov eax, dword [edi]
push 1
push 0x100c3a48
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x100c3a49
push dword [esi + 8]
call eax
mov eax, dword [ebp + 8]
inc ebx
add esp, 0x18
cmp ebx, dword [eax + 0x10]
jb 0x10086531
push dword [ebp + 0x18]
call fcn.1004f2d0
mov ecx, dword [esi]
push eax
push dword [ebp + 0x14]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [ebp + 0x1c]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x10086581
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x100dcbb0]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0x1b
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40611c
pop dword [ebp - 0x50]
mov eax, 0x40611c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x1bc0ecc5
sub dword [ebp - 0x60], 0xcd6ea77a
mov dword [ebp - 0x5c], 0xeaa755fc
sub dword [ebp - 0x5c], 0xb87409b7
mov dword [ebp - 0x58], 0x325bff6f
sub dword [ebp - 0x58], 0xe60fbb41
mov dword [ebp - 0x54], 0x8d7508a5
sub dword [ebp - 0x54], 0x8d7508a5
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x32dd4644
sub dword [ebp - 0x60], 0xbe6adcee
mov dword [ebp - 0x5c], 0x55a707a5
sub dword [ebp - 0x5c], 0x143aa630
mov dword [ebp - 0x58], 0x4a0e9c95
add dword [ebp - 0x58], 0x1960cfd7
mov dword [ebp - 0x54], 0x290c51fc
sub dword [ebp - 0x54], 0x290c51fc
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xee9cd99e
add eax, 0x11a39762
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a47f
push 0
call eax
mov ecx, 0x1ee60544
add ecx, 0xe11a516d
mov edx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x50]
mov esi, 0x2c5dd244
add esi, 0xf4d07cab
xor dword [ebp - 0x3c], edi
mov ebx, dword [edi]
sub dword [ebp - 0x24], edx
sub ebx, esi
mov dword [ebp - 0x40], 0x5859b025
mov dword [edx], ebx
add dword [ebp - 0x2c], ecx
add edx, 0x8b108a70
add edx, 0x74ef7594
add edi, 0x9b2cd51d
sub edi, 0x9b2cd519
loop 0x40622e
add eax, 0x14d97
xor ebx, ebx
add ebx, eax
add eax, 0xb93cd91a
sub eax, 0xb93cd915
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x60
push 0
push 0x411ab8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x411abc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x411ab8], eax
call section..text
mov eax, 0x41078c
mov dword [0x411ae0], eax
call fcn.00404373
call fcn.0040ccb0
call fcn.0040c380
call fcn.0040bda0
call fcn.0040b7bb
call fcn.0040b3e0
call fcn.0040b3d4
call fcn.0040a750
call fcn.0040888c
call fcn.00408130
call fcn.00407646
call fcn.00406b31
call fcn.00406a78
call fcn.0040684b
call fcn.0040547c
call fcn.00404e2c
call fcn.00404be3
call fcn.004043bc
mov edx, 0x40f028
lea ecx, [0x411ae4]
call fcn.00404068
push dword [0x411cec]
push dword [0x411cec]
call fcn.0040b575
mov edx, str.Recovery.ini
push edx
call fcn.0040cd30
lea eax, [0x411b00]
push eax
call fcn.0040cd90
push dword [0x411cec]
push dword [0x411cec]
call fcn.0040b575
mov edx, str.imageres.dll
push edx
call fcn.0040cd30
lea eax, [0x411b0c]
push eax
call fcn.0040cd90
push dword [0x411cec]
push dword [0x411cec]
call fcn.0040b575
mov edx, str.FileR.tag
push edx
call fcn.0040cd30
lea eax, [0x411ac4]
push eax
call fcn.0040cd90
mov edx, str.Backup.tbi
lea ecx, [0x411af8]
call fcn.00404068
call fcn.00402588
and eax, eax
je 0x401183
mov edx, str.imagew64.exe
lea ecx, [0x411ae8]
call fcn.00404068
push dword [0x411cec]
push dword [0x411cec]
call fcn.0040b575
mov edx, str.Fileimagew64.exe
push edx
call fcn.0040cd30
lea eax, [0x411ac8]
push eax
call fcn.0040cd90
jmp 0x4011bb
mov edx, str.imagew.exe
lea ecx, [0x411ae8]
call fcn.00404068
push dword [0x411cec]
push dword [0x411cec]
call fcn.0040b575
mov edx, str.Fileimagew.exe
push edx
call fcn.0040cd30
lea eax, [0x411ac8]
push eax
call fcn.0040cd90
call fcn.004026c5
push 0
jmp 0x4011cc
call 0x4011e6
call fcn.0040cd00
push dword [0x411ab8]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00404bd7
call fcn.00404dd6
call fcn.00405459
call fcn.0040684a
call fcn.00406a77
call fcn.00406b25
call fcn.0040a770
call fcn.0040b46e
call fcn.0040b5ba
call fcn.0040b79d
call fcn.0040c4fd
call fcn.0040c370
ret
Function at 0x4015bf
Capabilities:
Get disk information

Disassembly:
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x18]
mov dword [0x411cec], eax
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.00404060
push dword [0x411cec]
push dword [0x411cec]
push 0xe
call fcn.0040ab30
lea eax, [esp + 8]
push eax
call fcn.0040cd90
push dword [0x411cec]
push dword [0x411cec]
push 0x20
call fcn.0040ab30
lea eax, [esp + 0xc]
push eax
call fcn.0040cd90
mov edx, dword [esp]
push dword [0x411cec]
push edx
call fcn.0040cd30
mov edx, 0x4101a4
push edx
call fcn.0040cd30
lea eax, [esp + 0x10]
push eax
call fcn.0040cd90
push dword [esp + 8]
call fcn.0040aa70
push eax
mov eax, dword [esp + 0xc]
push eax
push 0
push 0
push 0
push dword [esp + 0x18]
call fcn.0040aa70
push eax
mov eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x28]
call sub.KERNEL32.dll_GetVolumeInformationW
mov edx, dword [esp + 4]
push dword [0x411cec]
push edx
call fcn.0040cd30
pop eax
add eax, dword [0x4107ac]
jmp 0x40169d
push dword [esp + 0xc]
call fcn.0040ce10
push dword [esp]
call fcn.0040ce10
push dword [esp + 8]
call fcn.0040ce10
push dword [esp + 4]
call fcn.0040ce10
add esp, 0x10
ret 4

Function at 0x401b76
Capabilities:
Shutdown system

Disassembly:
push 2
mov eax, str.SeShutdownPrivilege
push eax
call fcn.00401c44
movsx eax, byte [esp + 4]
push eax
push 0
push 1
mov eax, str.Exit
push eax
push 0
call sub.ADVAPI32.dll_InitiateSystemShutdownW
xor eax, eax
ret 4

Function at 0x4025fb
Capabilities:
Read .ini file

Disassembly:
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x20]
mov dword [0x411cec], eax
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.00404060
mov edx, dword [esp + 0x18]
lea ecx, [esp + 4]
call fcn.00404060
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 8]
call fcn.00404060
push dword [0x411cec]
push dword [0x411cec]
push 0x200
call fcn.0040ab30
lea eax, [esp + 0x10]
push eax
call fcn.0040cd90
mov eax, dword [esp]
push eax
push 0x200
mov eax, dword [esp + 0x14]
push eax
mov eax, 0x40f028
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringW
mov edx, dword [esp + 0xc]
push dword [0x411cec]
push edx
call fcn.0040cd30
pop eax
add eax, dword [0x4107ac]
jmp 0x40269c
push dword [esp + 4]
call fcn.0040ce10
push dword [esp]
call fcn.0040ce10
push dword [esp + 8]
call fcn.0040ce10
push dword [esp + 0xc]
call fcn.0040ce10
add esp, 0x10
ret 0xc
Function at 0x404a24
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x411cf8]
call fcn.0040c4fe
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x404b24
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x404a7a
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x404a72
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x404aba
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x404afc
push 0x22
pop edx
cmp cx, dx
je 0x404aac
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x404a9c
xor ecx, ecx
cmp word [eax], cx
je 0x404afc
mov ecx, eax
add eax, 2
jmp 0x404afe
test dx, dx
je 0x404b04
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x404aac
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x404af2
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x404afc
cmp cx, dx
je 0x404aef
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x404adf
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x404ac4
jmp 0x404aac
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x404b06
xor edx, edx
cmp dword [ebp], ebx
jne 0x404b0f
test edi, edi
jne 0x404b2c
test edx, edx
je 0x404b14
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x404a68
test edi, edi
jne 0x404b3d
mov eax, ebx
jmp 0x404b41
test esi, esi
je 0x404b3d
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x404b41
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x405b30
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x405bc8
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x405bc5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x405bc5
lea eax, [esi - 1]
push eax
push dword [0x411d48]
call fcn.0040c567
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x405bc7
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x405bbc
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x405caf
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x405ba2
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x405c6e
push eax
call esi
test al, al
jns 0x405c6e
push 0x11
call esi
test al, al
js 0x405c6e
push 0x10
call esi
test al, al
js 0x405c6e
push 0x12
call esi
test al, al
js 0x405c6e
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x405c6e
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x405c42
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x405c59
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x405cb9
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x405cb9
test ebp, ebp
je 0x405c92
push 0x11
call esi
test al, al
js 0x405c8a
push 0x10
call esi
test al, al
js 0x405c8a
push 0x12
call esi
test al, al
jns 0x405c92
push 1
push ebp
call fcn.00405cc5
test ebx, ebx
je 0x405ca6
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x405cb9
test edi, edi
je 0x405cb9
mov eax, dword [edi + 8]
jmp 0x405cbb
and dword [esp + 0x14], 0
jmp 0x405bc7
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x408820
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x408852
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40884d
cmp dword [esp + 0xc], esi
je 0x408869
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x40b5ca
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x40b712
xor ecx, ecx
cmp word [eax], cx
je 0x40b712
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x40b623
cmp eax, 3
jne 0x40b65d
cmp word [esp + 0xa], 0x3a
jne 0x40b65d
cmp eax, 2
jne 0x40b641
lea eax, [esp + 8]
push 0x40e2d8
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40b712
push 0xfffffffffffffffe
pop edi
jmp 0x40b712
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x40b672
cmp ax, bx
jne 0x40b67c
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x40b665
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x40b6bb
test byte [esp + 0x21c], 0x10
je 0x40b6a2
push 0xfffffffffffffffe
pop edi
jmp 0x40b6b2
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40b710
cmp word [esp + 0x10], bp
jne 0x40b6c9
cmp word [esp + 0x12], bp
je 0x40b6e8
cmp word [esp + 0x10], bx
jne 0x40b6d7
cmp word [esp + 0x12], bx
je 0x40b6e8
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x40b710
cmp word [esp + 0x12], ax
jne 0x40b710
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x40b6fd
test al, 0x10
je 0x40b710
jmp 0x40b70d
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40b710
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x40b721
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x40b741
cmp dword [esp + 8], 0
je 0x40b741
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x40b743
xor eax, eax
ret 8

Function at 0x40b746
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x40b76f
test byte [esp + 8], 2
je 0x40b763
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40b771
xor eax, eax
ret 8
Function at 0x102c6a94
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], esi
inc si
mov esi, edi
ja 0x10336ea9
pushal
cmc
sub esi, eax
pushfd
rep movsb byte es:[edi], byte [esi]
not si
mov esi, dword [esp + 0x24]
pushfd
lea esp, [esp + 0x2c]
jmp 0x103656ff
cmc
cmc
sub esi, eax
jae 0x10368c39
push 0x52d66550
mov byte [esp], 0xa8
pushal
rep movsb byte es:[edi], byte [esi]
lea esi, [esi + 0x26aa2677]
movsx esi, bl
mov esi, dword [esp + 0x24]
mov byte [esp + 4], ah
pushfd
mov dword [esp], esp
mov word [esp], 0x35c2
lea esp, [esp + 0x2c]
jmp 0x103656ff

Function at 0x102c76c7
Capabilities:
Encode data using xor

Disassembly:
neg al
call fcn.10273e55
mov ebp, 0x968b3462
jecxz 0x102c76e1
xchg esi, eax
and al, 0x24
and ch, byte [esi + 0x79fe667e]
sbb dword [ebx + 0xb], eax
or dword [esi - 0x77], ebx
xchg esi, eax
test ch, ah
jl 0x102c76d3
or ecx, dword [ecx]
pop esi
mov dword [esi - 0x16831a7c], edx
jge 0x102c76c0
invalid
Function at 0x4aaa20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x63000]
push edi
or ebp, 0xffffffff
jmp 0x4aaa42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4aaa49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aaa38
mov eax, 1
add ebx, ebx
jne 0x4aaa5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4aaa50
jne 0x4aaa6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4aaa50
xor ecx, ecx
sub eax, 3
jb 0x4aaa80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4aaaf2
mov ebp, eax
add ebx, ebx
jne 0x4aaa8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4aaa98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4aaabc
inc ecx
add ebx, ebx
jne 0x4aaaa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4aaa9d
jne 0x4aaab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4aaa9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4aaadc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4aaacd
jmp 0x4aaa3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4aaadc
add edi, ecx
jmp 0x4aaa3e
pop esi
mov edi, esi
mov ecx, 0x532
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4aaafa
cmp byte [edi], 0x1e
jne 0x4aaafa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4aaaff
lea edi, [esi + 0xa4000]
mov eax, dword [edi]
or eax, eax
je 0x4aab6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xaa4e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xaa584]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4aab2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xaa58c]
or eax, eax
je 0x4aab68
mov dword [ebx], eax
add ebx, 4
jmp 0x4aab49
call dword [esi + 0xaa588]
mov ebp, dword [esi + 0xaa590]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4aaba2
sub esp, 0xffffff80
jmp 0x40cfe4
Function at 0x48e984
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4b9668]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0048e919
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043cd70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x48e9d3
cmp dword [ebp - 0x1c], 5
jb 0x48e9eb
jmp 0x48e9e7
cmp dword [ebp - 0x10], 1
jne 0x48e9eb
cmp dword [ebp - 0x1c], 4
ja 0x48e9e7
jne 0x48e9eb
cmp dword [ebp - 0x18], 0
jbe 0x48e9eb
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4a676c
call fcn.0048e80a
test eax, eax
jge 0x48ea0c
mov byte [0x4d8048], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043a54e
add ebp, 0x78
leave
ret
Function at 0x44b050
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2c000]
push edi
or ebp, 0xffffffff
jmp 0x44b072
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44b079
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44b068
mov eax, 1
add ebx, ebx
jne 0x44b08b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44b09c
jne 0x44b0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44b0bb
dec eax
add ebx, ebx
jne 0x44b0a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x44b080
add ebx, ebx
jne 0x44b0b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x44b10d
xor ecx, ecx
sub eax, 3
jb 0x44b0d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44b142
sar eax, 1
mov ebp, eax
jmp 0x44b0de
add ebx, ebx
jne 0x44b0de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44b0ac
inc ecx
add ebx, ebx
jne 0x44b0ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44b0ac
add ebx, ebx
jne 0x44b0f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44b0ee
jne 0x44b10a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44b0ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44b12c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44b11e
jmp 0x44b06e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44b12c
add edi, ecx
jmp 0x44b06e
pop esi
mov edi, esi
mov ecx, 0xe38
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44b14a
cmp byte [edi], 0xa
jne 0x44b14a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44b14f
lea edi, [esi + 0x48000]
mov eax, dword [edi]
or eax, eax
je 0x44b1be
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4b1dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4b218]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44b17c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4b220]
or eax, eax
je 0x44b1b8
mov dword [ebx], eax
add ebx, 4
jmp 0x44b199
call dword [esi + 0x4b21c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x44b1ef
cmp al, 0xef
ja 0x44b1e2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x44b1c4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x44b1d1
mov ebp, dword [esi + 0x4b224]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44b223
sub esp, 0xffffff80
jmp 0x411c66