joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4303f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2b000]
push edi
or ebp, 0xffffffff
jmp 0x430412
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x430419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x430408
mov eax, 1
add ebx, ebx
jne 0x43042b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x430420
jne 0x43043c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430420
xor ecx, ecx
sub eax, 3
jb 0x430450
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4304c2
mov ebp, eax
add ebx, ebx
jne 0x43045b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x430468
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43048c
inc ecx
add ebx, ebx
jne 0x430478
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43046d
jne 0x430489
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43046d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4304ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43049d
jmp 0x43040e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4304ac
add edi, ecx
jmp 0x43040e
pop esi
mov edi, esi
mov ecx, 0x245
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4304ca
cmp byte [edi], 1
jne 0x4304ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4304cf
lea edi, [esi + 0x2e000]
mov eax, dword [edi]
or eax, eax
je 0x430547
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x308ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x30960]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4304fc
mov ecx, edi
jns 0x43052b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x30964]
or eax, eax
je 0x430541
mov dword [ebx], eax
add ebx, 4
jmp 0x430519
call dword [esi + 0x3096c]
mov ebp, dword [esi + 0x30968]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43057b
sub esp, 0xffffff80
jmp 0x4032d4
Function at 0x1000322b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x1000323e
xor eax, eax
jmp 0x100032e1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
jmp 0x1000327d
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x100032df
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.100031db
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100032dd
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x100032e1
jmp 0x10003274
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000b190
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10002900
mov ecx, eax
call fcn.1000b4b0
call fcn.10002900
mov dword [eax], 7
call fcn.10002900
mov esi, eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 0x10002af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x1000b211
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10002900
mov edx, eax
xor ecx, ecx
cmp dword [edx + 0x2c], ecx
jbe 0x1000b23b
nop
mov eax, dword [edx + 0x24]
mov esi, dword [edx + 0x20]
sub eax, esi
sar eax, 2
cmp eax, ecx
jbe 0x1000b254
mov al, byte [esi + ecx*4]
mov byte [ecx + edi], al
inc ecx
cmp ecx, dword [edx + 0x2c]
jb 0x1000b220
cmp dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop edi
pop esi
call fcn.1000c5be
mov esp, ebp
pop ebp
ret 0x10
push str.invalid_vector_T__subscript
call fcn.1000bd0f
int3

Function at 0x1000b260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10002900
mov ecx, eax
call fcn.1000b4b0
call fcn.10002900
mov dword [eax], 8
call fcn.10002900
mov esi, eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 0x10002af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x1000b2df
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 8], eax
pop esi
sete al
xor ecx, ebp
call fcn.1000c5be
mov esp, ebp
pop ebp
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x30a3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.030a378f
jae 0x30a370e
xor ecx, ecx
call fcn.030a378f
jae 0x30a373d
xor eax, eax
call fcn.030a378f
jae 0x30a374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.030a378f
adc al, al
jae 0x30a372f
jne 0x30a3779
stosb byte es:[edi], al
jmp 0x30a3711
call fcn.030a379b
sub ecx, ebx
jne 0x30a3756
call fcn.030a3799
jmp 0x30a3775
lodsb al, byte [esi]
shr eax, 1
je 0x30a3783
adc ecx, ecx
jmp 0x30a3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.030a3799
cmp eax, 0x7d00
jae 0x30a3772
cmp ah, 5
jae 0x30a3773
cmp eax, 0x7f
ja 0x30a3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x30a3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x10008fff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000900e
pop dword [ebp - 0x10]
mov eax, 0xb4407074
add eax, 0x5bc01f9a
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xc71b31b
add dword [ebp - 0x20], 0x41e09230
mov dword [ebp - 0x1c], 0xd032a93
add dword [ebp - 0x1c], 0x253021b2
mov dword [ebp - 0x18], 0xcd9d50fa
add dword [ebp - 0x18], 0x7eaef334
mov dword [ebp - 0x14], 0x131582a1
add dword [ebp - 0x14], 0xecea7d5f
lea eax, [ebp - 0x20]
push eax
mov eax, 0xa40dc977
sub eax, 0x940d2973
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x4d19d37a
sub dword [ebp - 0x20], 0xd8a76a24
mov dword [ebp - 0x1c], 0x9980aad5
add dword [ebp - 0x1c], 0xa7ebb6a0
mov dword [ebp - 0x18], 0xf10bab2e
sub dword [ebp - 0x18], 0x8d9c3ec2
mov dword [ebp - 0x14], 0x5b635992
add dword [ebp - 0x14], 0xa49ca66e
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xf1da685
sub eax, 0xff1d067d
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x32262
push 0
call eax
mov ecx, 0xcea73c41
sub ecx, 0xcea705cd
mov esi, eax
mov edi, 0xacbb8db8
sub edi, 0x9cba95b8
add edi, dword [ebp - 0x10]
mov ebx, 0x971c0221
xor dword [ebp - 0xc], 0x1f5ca012
mov edx, dword [edi]
sub dword [ebp - 4], ebx
add edx, ebx
xor dword [ebp - 8], ebx
mov dword [esi], edx
mov dword [ebp - 4], 0x5c5ce323
add esi, 4
add edi, 0x673b95e
add edi, 0xf98c46a6
loop 0x1000912a
add eax, 0x8ef0d2da
sub eax, 0x8ef00637
mov ebx, eax
add eax, 0x2158576
add eax, 0xfdea7a8f
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x100016d2
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
push esi
xor esi, esi
push esi
push 4
push esi
push 0x100015bf
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffff1
push eax
mov dword [0x100032a0], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x10001709
push dword [0x100032a0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1000171c
push esi
push dword [0x100032a0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x100032a0], esi
pop esi
ret

Function at 0x401037
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
call 0x401037
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push esi
push edi
push ebx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403030], eax
mov dword [ebp - 8], 0
push 0xa
push section..data
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
je 0x401089
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
je 0x401089
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4010c1
push 4
push 0x1000
push dword [ebp - 0xc]
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
call sub.kernel32.dll_RtlMoveMemory
mov dword [ebp - 8], edi
push 0xdeadbeef
push dword [ebp - 0xc]
push dword [ebp - 8]
call section..text
cmp dword [ebp - 8], 0
je 0x4010fb
lea eax, [ebp - 0x40c]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push str.dup2patcher.dll
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_lstrcatA
push dword [ebp - 0xc]
push dword [ebp - 8]
lea eax, [ebp - 0x40c]
push eax
call fcn.00401184
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x401130
mov ebx, eax
push str.load_patcher
push ebx
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x40111e
call eax
push ebx
call sub.kernel32.dll_FreeLibrary
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_DeleteFileA
pop ebx
pop edi
pop esi
leave
ret

Function at 0x401184
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4011af
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x40631f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42275c], 0
jne 0x40635d
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406333
mov dword [ecx*4 + 0x422758], eax
inc ecx
cmp ecx, 0x100
jl 0x40632e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40638a
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x422758]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40636b
not eax
pop ebp
ret 0xc

Function at 0xa8c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa8c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa8c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8c06a
add dl, dl
jne 0xa8c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8c0dc
xor eax, eax
add dl, dl
jne 0xa8c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8c17d
add dl, dl
jne 0xa8c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa8c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa8c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa8c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa8c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa8c075
mov eax, 1
add dl, dl
jne 0xa8c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa8c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa8c0e1
sub eax, ebx
mov ebx, 1
jne 0xa8c128
mov ecx, 1
add dl, dl
jne 0xa8c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa8c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa8c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa8c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa8c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa8c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa8c136
cmp eax, 0x7d00
jae 0xa8c16d
cmp eax, 0x500
jb 0xa8c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa8c075
cmp eax, 0x7f
ja 0xa8c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa8c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa8c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa8c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403203
pop dword [ebp - 0x3c]
mov eax, 0x403203
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xccca9c79
add dword [ebp - 0x4c], 0x8187a8d2
mov dword [ebp - 0x48], 0xba32cd76
add dword [ebp - 0x48], 0x78007ecf
mov dword [ebp - 0x44], 0xbd59e7ed
sub dword [ebp - 0x44], 0x710da3bf
mov dword [ebp - 0x40], 0xbcd7cfdb
sub dword [ebp - 0x40], 0xbcd7cfdb
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x92541cc6
add eax, 0x6dec63c6
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x38c7c080
add dword [ebp - 0x4c], 0x3baaa8d6
mov dword [ebp - 0x48], 0xeac885de
add dword [ebp - 0x48], 0x56a3db97
mov dword [ebp - 0x44], 0xc6a43f68
add dword [ebp - 0x44], 0x9ccb2d04
mov dword [ebp - 0x40], 0xe36571fe
sub dword [ebp - 0x40], 0xe36571fe
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3603d
push 0
call eax
mov ecx, 0x45af
mov edx, eax
mov ebx, 0xb5734502
sub ebx, 0xb5323502
add ebx, dword [ebp - 0x3c]
mov edi, 0x82f3c77e
sub dword [ebp - 0x24], 0x78fcaeca
mov esi, dword [ebx]
add dword [ebp - 0x30], 0xe6f319a
xor esi, edi
add dword [ebp - 0x30], ecx
mov dword [edx], esi
sub dword [ebp - 4], ecx
add edx, 0x3a0dc512
add edx, 0xc5f23af2
add ebx, 0x18bca6ad
add ebx, 0xe7435957
loop 0x40330f
add eax, 0x1098f
mov ebx, eax
add eax, 0x489db972
add eax, 0xb7624693
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10028dc0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10028f84
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
push edi
or ebp, 0xffffffff
jmp 0x10028dea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10028df1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10028de0
mov eax, 1
add ebx, ebx
jne 0x10028e03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10028df8
jne 0x10028e14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10028df8
xor ecx, ecx
sub eax, 3
jb 0x10028e28
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10028e9a
mov ebp, eax
add ebx, ebx
jne 0x10028e33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10028e40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10028e64
inc ecx
add ebx, ebx
jne 0x10028e50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10028e45
jne 0x10028e61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10028e45
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10028e84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10028e75
jmp 0x10028de6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10028e84
add edi, ecx
jmp 0x10028de6
pop esi
mov edi, esi
mov ecx, 0x79d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10028ea2
cmp byte [edi], 0x11
jne 0x10028ea2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10028ea7
lea edi, [esi + 0x25000]
mov eax, dword [edi]
or eax, eax
je 0x10028f16
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x290f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x29148]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10028ed4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2914c]
or eax, eax
je 0x10028f10
mov dword [ebx], eax
add ebx, 4
jmp 0x10028ef1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10028f47
cmp al, 0xef
ja 0x10028f3a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10028f1c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10028f29
mov ebp, dword [esi + 0x29150]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10028f7b
sub esp, 0xffffff80
jmp 0x100050db
Function at 0x4681ec
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468063

Function at 0x435540
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20000]
push edi
or ebp, 0xffffffff
jmp 0x435562
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x435569
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x435558
mov eax, 1
add ebx, ebx
jne 0x43557b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x435570
jne 0x43558c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x435570
xor ecx, ecx
sub eax, 3
jb 0x4355a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x435612
mov ebp, eax
add ebx, ebx
jne 0x4355ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4355b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4355dc
inc ecx
add ebx, ebx
jne 0x4355c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4355bd
jne 0x4355d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4355bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4355fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4355ed
jmp 0x43555e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4355fc
add edi, ecx
jmp 0x43555e
pop esi
lea edi, [esi + 0x33000]
mov eax, dword [edi]
or eax, eax
je 0x435664
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x35000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x35094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x435619
mov ecx, edi
jns 0x435648
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3509c]
or eax, eax
je 0x43565e
mov dword [ebx], eax
add ebx, 4
jmp 0x435636
call dword [esi + 0x35098]
mov ebp, dword [esi + 0x350a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x435698
sub esp, 0xffffff80
jmp 0x411fa7