joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41244f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004122ce

Function at 0x41682b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416199

Function at 0x416836
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004163d4

Function at 0x401e10
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x4042d8
call fcn.00401f7c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x405478
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x401bd1
cmp eax, esi
jne 0x401bc4
xor esi, esi
inc esi
mov ebx, esi
jmp 0x401bd4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401bab
xor esi, esi
inc esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401be7
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401c16
mov eax, dword [0x405474]
test eax, eax
jne 0x401c10
mov dword [0x405474], esi
push 0x4030e4
push 0x4030d8
call fcn.00401b1a
pop ecx
pop ecx
test eax, eax
je 0x401c16
jmp 0x401d3e
mov dword [0x40513c], esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401c3a
push 0x4030d4
push 0x4030cc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x405474], 2
test ebx, ebx
jne 0x401c46
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40547c], 0
je 0x401c6a
push 0x40547c
call fcn.00401f04
pop ecx
test eax, eax
je 0x401c6a
push 0
push 2
push 0
call dword [0x40547c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401cc6
test al, al
je 0x401c84
cmp dword [ebp - 0x1c], 0
jne 0x401cc6
mov al, byte [esi]
test al, al
je 0x401c94
cmp al, 0x20
ja 0x401c94
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401c84
test byte [ebp - 0x3c], 1
je 0x401ca0
movzx eax, word [ebp - 0x38]
jmp 0x401ca3
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x405138], eax
cmp dword [0x40512c], 0
jne 0x401d1a
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x401cd5
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x401ce8
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x401c71
cmp dword [0x40513c], 0
jne 0x401d29
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x405138]
jmp 0x401d4a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00401fc1
ret
call fcn.004020ab
jmp 0x401b71
Function at 0x406fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xffffffc3
push ebx
xchg esp, eax
mov esi, dword [ebp - 0x6f]
xchg esi, eax
fstp xword [ebx]
push edi
mov dword [ebp - 0xf], esi
jne 0x406fa6
mov esi, 0x5bf47f
mov al, byte [esi]
cdq
xor byte [edi], cl
invalid

Function at 0x40a940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x40a94e
mov ebp, esp
jmp 0x40a95b
xor edx, edx
nop
mov edx, dword fs:[edx + 0x30]
jmp 0x40a96d
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
push edx
adc al, 0xeb
invalid
nop
jmp 0x40a993
movzx ecx, word [edx + 0x26]
xor edi, edi
mov esi, dword [edx + 0x28]
nop
nop
xor eax, eax
nop
jmp 0x40a9af
lodsb al, byte [esi]
nop
jmp 0x40a9bd
cmp al, 0x61
jmp 0x40a9cf
jl 0x40a9f0
nop
jmp 0x40a9e3
jmp 0x40a9ed
sub al, 0x20
nop
jmp 0x40a9fc
ror edi, 0xd
nop
jmp 0x40aa0f
add edi, eax
nop
jmp 0x40aa1d
dec ecx
nop
jmp 0x40aa2a
jne 0x40a99d
jmp 0x40aa3a
nop
push edx
mov edx, dword [edx + 0x10]
nop
mov eax, dword [edx + 0x3c]
nop
jmp 0x40aa55
add eax, edx
nop
push edi
jmp 0x40aa68
mov eax, dword [eax + 0x78]
jmp 0x40aa78
test eax, eax
nop
jmp 0x40aa8a
je 0x40ac91
nop
jmp 0x40aa9e
nop
add eax, edx
mov ebx, dword [eax + 0x20]
push eax
jmp 0x40aab0
add ebx, edx
nop
jmp 0x40aac3
mov ecx, dword [eax + 0x18]
jmp 0x40aad3
nop
jmp 0x40aade
test ecx, ecx
jmp 0x40aaf0
je 0x40ac8f
jmp 0x40ab07
jmp 0x40ab13
dec ecx
nop
mov esi, dword [ebx + ecx*4]
nop
jmp 0x40ab25
add esi, edx
jmp 0x40ab37
xor edi, edi
nop
jmp 0x40ab48
nop
xor eax, eax
nop
jmp 0x40ab57
ror edi, 0xd
jmp 0x40ab6c
lodsb al, byte [esi]
nop
add edi, eax
nop
jmp 0x40ab7e
cmp al, ah
nop
jmp 0x40ab91
jne 0x40ab48
jmp 0x40aba4
jmp 0x40abb7
add edi, dword [ebp - 8]
nop
jmp 0x40abcd
cmp edi, dword [ebp + 0x24]
jne 0x40aad3
nop
jmp 0x40abe4
jmp 0x40abf7
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
nop
jmp 0x40ac0f
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
nop
add ebx, edx
nop
jmp 0x40ac29
mov eax, dword [ebx + ecx*4]
add eax, edx
jmp 0x40ac40
mov dword [esp + 0x24], eax
pop ebx
nop
jmp 0x40ac56
pop ebx
nop
jmp 0x40ac66
popal
nop
jmp 0x40ac7b
pop ecx
pop edx
push ecx
jmp eax
pop eax
nop
pop edi
nop
jmp 0x40aca6
pop edx
mov edx, dword [edx]
nop
jmp 0x40acbe
jmp 0x40a981
Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
ror byte [esi], cl
or byte [edx - 0x3f7b37ba], cl
movaps xmm7, xmmword [esi - 0x2a000000]
and dword [ebx - 0x7cac3f5f], eax
stc
dec eax
push edi
mov dword [ebp - 4], eax
mov dword [ebp + 8], eax
jne 0x416695
mov edi, dword [esi + 0x3c]
cmp ecx, dword [edi + ecx + 0x65]
xchg ecx, eax
sahf
add byte [eax], al
jg 0x40b364
cmp byte [ebx + 0x556ffff], al
and dword [esi], 0xffffffd0
mov byte [edx], 0x8b
ror byte [ebx - 0x4b72fbaa], cl
cld
push 0
dec ebp
invalid
cmp edi, 0xffffffff
push esi
add eax, 0xc6d02683
add cl, byte [ebx + 0x4568bd2]
lea esi, [esp + edi*8 - 0xfb2ff96]
daa
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b358
fld qword [ebp - 4]
mov edx, dword [esi + 0x50]
mov ecx, dword [eax]
push esp
add edx, eax
adc ecx, 0x55
sub edi, eax
arpl ax, bx
mov dword [esi + 0x50], edx
test dword [esi - 0x2c], esi
dec esi
push esp
ja 0x40b307
sub ch, byte [eax + 0x46fd5f08]
cmp al, 0
xor al, byte [eax]
mov word [ebx + 0x5e], ds
cdq
in eax, 0x5d
jae 0x40b35b
add byte [ebx + 0x40c0983d], cl
add bh, bh
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
rol byte [eax], 0xff
xlatb
test eax, eax
jne 0x40b369
mov dword [ebp - 0x75], eax
cmpsb byte [esi], byte es:[edi]
sar edi, cl
xlatb
call edi
add eax, 0xafc80
mov dword [ebp + 8], eax
mov esp, dword [ebx + edi*2 - 0x75]
push esi
push eax
mov ecx, dword [esi + 0x54]
add edx, eax
cmpsb byte [esi], byte es:[edi]
inc ebp
jae 0x40b30b
push esi
push eax
and dword [eax + eax], 0xffffff85
ror byte [ecx + 0x775544e], 0x27
Function at 0x4017b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Best_Application
push str.Clariot
push 0
mov dword [0x403186], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x4017f7
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret

Function at 0x40180f
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402540
push 0x401dbc
push eax
mov eax, dword [0x403e84]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x403e80]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.00401db0
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x403e7c]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4020b8
push 0x4020b4
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x4018aa
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x4018a2
cmp al, 0x22
jne 0x401897
cmp byte [esi], 0x22
jne 0x4018b4
inc esi
jmp 0x4018b4
cmp al, 0x20
jbe 0x4018b4
inc esi
cmp byte [esi], 0x20
ja 0x4018ae
cmp byte [esi], 0
je 0x4018c4
cmp byte [esi], 0x20
ja 0x4018c4
inc esi
cmp byte [esi], 0
jne 0x4018b9
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x4018e4
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x401920
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4738c8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4735cc
or edi, edi
inc edx
call fcn.00473902
sub edx, 0x80a95d0e
mov edx, edx
xor dword [esi], eax
dec edx
add esi, 2
add edx, edi
add edx, edx
and edx, edx
cmp esi, ecx
jl fcn.004738c8
add edx, 0x7d68610
add edi, edx
ret
Function at 0x401c64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov ebp, edx
mov ebx, eax
xor esi, esi
mov edi, ebx
mov ecx, 0xa
mov eax, ebx
xor edx, dword [ebx - 0x3cff0e09]
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
sub edi, eax
inc esi
mov edx, edi
add dl, 0x30
mov eax, 0x14
sub eax, esi
mov byte [esp + eax], dl
test ebx, ebx
jne 0x401c71
mov edx, ebp
lea eax, [esp + eax]
mov ecx, esi
call fcn.004029cc
lea eax, [esi + ebp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40954c
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
adc cl, byte [eax + ebx*8]
retf
jp 0x409524
cmp byte [esi], dl
xchg esp, eax
inc byte [ebp - 0x2b]
invalid
Function at 0x449f8b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov ebp, edx
mov ebx, eax
xor esi, esi
mov edi, ebx
mov ecx, 0xa
mov eax, ebx
xor edx, dword [ebx - 0x3cff0e09]
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
sub edi, eax
inc esi
mov edx, edi
add dl, 0x30
mov eax, 0x14
sub eax, esi
mov byte [esp + eax], dl
test ebx, ebx
jne 0x449f98
mov edx, ebp
lea eax, [esp + eax]
mov ecx, esi
call fcn.0044acf3
lea eax, [esi + ebp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x492897
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov ebp, edx
mov ebx, eax
xor esi, esi
mov edi, ebx
mov ecx, 0xa
mov eax, ebx
xor edx, dword [ebx - 0x3cff0e09]
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
sub edi, eax
inc esi
mov edx, edi
add dl, 0x30
mov eax, 0x14
sub eax, esi
mov byte [esp + eax], dl
test ebx, ebx
jne 0x4928a4
mov edx, ebp
lea eax, [esp + eax]
mov ecx, esi
call fcn.004935ff
lea eax, [esi + ebp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49bad7
Capabilities:
Encode data using xor

Disassembly:
js 0x49bb36
in al, 6
xchg ebp, eax
cld
lds esp, [esi + 0x4a]
inc ebp
sal ebp, cl
mov cl, 0xaf
sub byte [eax - 0x11], dl
adc dword [esi - 0x50c24349], 0xa
nop
bound edx, qword [ebx + ecx - 0x2b]
in eax, dx
jae 0x49bb73
adc ah, byte fs:[ecx + 0x6b]
or byte [ecx], ah
add bl, byte [esi + 0x3b]
push ebp
nop
push ebp
xor edx, ebp
xchg edi, eax
pushfd
cld
pop esi
aaa
mov dh, 0x37
invalid
stc
clc
hlt
xor dword [ebp - 0x4da88f88], ebx
xchg esp, eax
push ecx
sub al, byte [esi + 0x37689081]
push edi
sbb eax, 0xc0a2769e
inc ebp
push esp
test al, 0xe4
sbb dh, 0xe6
fabs
mov edi, 0x52544297
invalid
Function at 0x4ddd66
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov ebp, edx
mov ebx, eax
xor esi, esi
mov edi, ebx
mov ecx, 0xa
mov eax, ebx
xor edx, dword [ebx - 0x3cff0e09]
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
sub edi, eax
inc esi
mov edx, edi
add dl, 0x30
mov eax, 0x14
sub eax, esi
mov byte [esp + eax], dl
test ebx, ebx
jne 0x4ddd73
mov edx, ebp
lea eax, [esp + eax]
mov ecx, esi
call fcn.004deace
lea eax, [esi + ebp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x524e8a
Capabilities:
Check for vm using instruction vpcext

Disassembly:
shl edx, cl
pop ds
pushfd
or bl, byte [esi]
pop ecx
insb byte es:[edi], dx
dec eax
salc
sbb al, 0x65
lea edx, [ebp + 0x7f]
Function at 0x525c5e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov ebp, edx
mov ebx, eax
xor esi, esi
mov edi, ebx
mov ecx, 0xa
mov eax, ebx
xor edx, dword [ebx - 0x3cff0e09]
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
sub edi, eax
inc esi
mov edx, edi
add dl, 0x30
mov eax, 0x14
sub eax, esi
mov byte [esp + eax], dl
test ebx, ebx
jne 0x525c6b
mov edx, ebp
lea eax, [esp + eax]
mov ecx, esi
call fcn.005269c6
lea eax, [esi + ebp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x56e095
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov ebp, edx
mov ebx, eax
xor esi, esi
mov edi, ebx
mov ecx, 0xa
mov eax, ebx
xor edx, dword [ebx - 0x3cff0e09]
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
sub edi, eax
inc esi
mov edx, edi
add dl, 0x30
mov eax, 0x14
sub eax, esi
mov byte [esp + eax], dl
test ebx, ebx
jne 0x56e0a2
mov edx, ebp
lea eax, [esp + eax]
mov ecx, esi
call fcn.0056edfd
lea eax, [esi + ebp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5b5ea0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov ebp, edx
mov ebx, eax
xor esi, esi
mov edi, ebx
mov ecx, 0xa
mov eax, ebx
xor edx, dword [ebx - 0x3cff0e09]
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
sub edi, eax
inc esi
mov edx, edi
add dl, 0x30
mov eax, 0x14
sub eax, esi
mov byte [esp + eax], dl
test ebx, ebx
jne 0x5b5ead
mov edx, ebp
lea eax, [esp + eax]
mov ecx, esi
call fcn.005b6c08
lea eax, [esi + ebp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5ee22d
Capabilities:
Encode data using xor

Disassembly:
test dword [ebp - 0x30fc7bf6], edi
jmp 0xb9aa91a4
add eax, dword [edi - 0x23]
int1
inc ebp
sti
popal
jne 0x5ee11c
add eax, 0x3dbeea9e
leave
sub byte [edx - 0x34c13cfe], 0x30
cld
wait
in eax, dx
retf 0x34a
inc eax
jg 0x5ee18f
xchg byte [ebx], dl
and dword [ecx], 0x47d9c5fa
sahf
and ch, bh
sub edi, dword [edx]
pop esi
dec eax
mov dword [0x85a159b4], eax
dec esp
xchg ebx, eax
ret 0x5912
mov dword [edi - 0xe246773], esp
in eax, 0x16
push 0xc620ca4
ror ecx, 1
jp 0x5ee1f8
add dword [esi - 0x14890096], eax
mov ecx, 0x92a2bd
fxtract
imul edi, dword [ebx + 0x48], 0x1a414105
push cs
adc eax, 0xc4254033
std
pushal
pushfd
and eax, 0x9c60fdc4
wait
mov esp, 0x4fc10d54
test byte [ecx - 0x4f], 0x61
mov byte [eax + 0x312941ea], 0xc9
bound eax, qword [ebx]
or al, 0xc3
mov ebp, 0x60e7c299
mov bh, 0x22
mov ebp, 0xc7473bfc
mov al, byte gs:[0x63056b30]
call 0x78624628
xor eax, 0xf6d8c64e
salc
ja 0x5ee256
fdivp st(7)
sbb al, 0x17
sub dword [edi], ebp
and bh, cl
fadd st(6)
cmp dh, byte [ecx - 0x58]
and byte [ebp - 0x27ad51e0], bh
invalid
Function at 0x5fdca9
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov ebp, edx
mov ebx, eax
xor esi, esi
mov edi, ebx
mov ecx, 0xa
mov eax, ebx
xor edx, dword [ebx - 0x3cff0e09]
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
sub edi, eax
inc esi
mov edx, edi
add dl, 0x30
mov eax, 0x14
sub eax, esi
mov byte [esp + eax], dl
test ebx, ebx
jne 0x5fdcb6
mov edx, ebp
lea eax, [esp + eax]
mov ecx, esi
call fcn.005fea11
lea eax, [esi + ebp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x606d7d
Capabilities:
Encode data using xor

Disassembly:
bound eax, qword [ebp + 0x6d3650c]
cmc
dec esi
pop esp
cmp bh, byte [eax]
inc edi
pop edx
xchg ecx, eax
insb byte es:[edi], dx
outsb dx, byte [esi]
in al, dx
aaa
xor al, 0xb2
sbb al, 0xfb
xchg edi, eax
pop es
pop es
xor byte [eax + 0x77], cl
pop edi
jg 0x606d95
imul eax, edi, 0xffffffda
ljmp 0x122b
Function at 0x4e2e80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x88000]
push edi
jmp 0x4e2e9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e2ea1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e2e90
mov eax, 1
add ebx, ebx
jne 0x4e2eb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e2ec4
jne 0x4e2ee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e2ee3
dec eax
add ebx, ebx
jne 0x4e2ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e2ea8
add ebx, ebx
jne 0x4e2edf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e2f35
xor ecx, ecx
sub eax, 3
jb 0x4e2efb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e2f6a
sar eax, 1
mov ebp, eax
jmp 0x4e2f06
add ebx, ebx
jne 0x4e2f06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e2ed4
inc ecx
add ebx, ebx
jne 0x4e2f14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e2ed4
add ebx, ebx
jne 0x4e2f21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e2f16
jne 0x4e2f32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e2f16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e2f54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e2f46
jmp 0x4e2e96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e2f54
add edi, ecx
jmp 0x4e2e96
pop esi
mov edi, esi
mov ecx, 0x3ede
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e2f72
cmp byte [edi], 0x11
jne 0x4e2f72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e2f77
lea edi, [esi + 0xdb000]
mov eax, dword [edi]
or eax, eax
je 0x4e2fef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe7784]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe7900]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e2fa4
mov ecx, edi
jns 0x4e2fd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe7904]
or eax, eax
je 0x4e2fe9
mov dword [ebx], eax
add ebx, 4
jmp 0x4e2fc1
call dword [esi + 0xe7914]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e3020
cmp al, 0xef
ja 0x4e3013
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e2ff5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e3002
mov ebp, dword [esi + 0xe7908]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e3054
sub esp, 0xffffff80
jmp 0x4276e7
Function at 0x960370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x96038e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x989074
push ecx
mov edi, eax
call fcn.00974198
mov esi, eax
add esp, 8
test esi, esi
jne 0x9603cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0097402e
push esi
call fcn.00973fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x963850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x9638ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x98e720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x9638ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.009741e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x9638ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x98e720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x96392a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00975082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x963957
mov word [eax], si
add eax, 2
push eax
call fcn.00975030
add esp, 4
jmp 0x963959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x9638ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x9638b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x963ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret