joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d88b
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x436064]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x41d8d6
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0041da26
test al, al
jne 0x41d8d0
sub edx, 2
cmp edx, edi
jne 0x41d8b6
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x41d8f8
lea eax, [edi + 2]
cmp edx, eax
je 0x41d8f8
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0041d7d7
add esp, 0x10
jmp 0x41d9f2
push esi
lea ecx, [ebp - 0x255]
call fcn.0041da26
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41d93b
push dword [ebp - 0x25c]
jmp 0x41d8e8
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x41d978
cmp word [ebp - 0x226], 0
je 0x41d999
cmp word [ebp - 0x226], ax
jne 0x41d978
cmp word [ebp - 0x224], 0
je 0x41d999
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0041d7d7
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x41d9e5
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x41d952
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x41d9cd
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41d9f2
push 0x41d607
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00424210
add esp, 0x10
jmp 0x41d9c2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408c80
leave
ret

Function at 0x42094b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00415d20
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4209ba
cmp esi, dword [ebp - 4]
je 0x4209b5
cmp dword [ebp + 0xc], 0
je 0x4209b5
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x420992
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0042049d
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x4209bc
xor eax, eax
inc eax
jmp 0x4209bc
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x420a21
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x436064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00415d20
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00415d20
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x420a98
cmp word [ecx], dx
je 0x420a98
mov eax, dword [0x42bff4]
push edi
dec eax
push eax
push 0x42bee0
call fcn.004209c0
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x420b0b
cmp word [eax], dx
je 0x420b0b
mov eax, dword [edi]
test eax, eax
je 0x420abc
cmp word [eax], dx
je 0x420abc
lea eax, [ebp - 0x10]
push eax
call fcn.004203a3
jmp 0x420ac5
lea eax, [ebp - 0x10]
push eax
call fcn.0042043e
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x420b35
mov eax, dword [0x42bedc]
push dword [ebp - 0x14]
dec eax
push eax
push 0x42bbd0
call fcn.004209c0
add esp, 0xc
test al, al
je 0x420b35
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x420b00
cmp word [eax], di
je 0x420b00
lea eax, [ebp - 0x10]
push eax
call fcn.004203a3
pop ecx
jmp 0x420b37
lea eax, [ebp - 0x10]
push eax
call fcn.0042043e
jmp 0x420afd
mov eax, dword [edi]
test eax, eax
je 0x420b22
cmp word [eax], dx
je 0x420b22
lea eax, [ebp - 0x10]
push eax
call fcn.00420358
pop ecx
jmp 0x420b35
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x420c00
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00420845
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x420c00
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x420c00
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x420c00
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x420b8d
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004177e4
test ebx, ebx
je 0x420bfb
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004177e4
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x420c00
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x420c00
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0042487d
add esp, 0x10
xor eax, eax
inc eax
jmp 0x420c02
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408c80
leave
ret
Function at 0x424fc5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00424f41
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x425134
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x425134
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4250e9
jg 0x425021
test eax, eax
je 0x4250df
push 1
push 0x1000
call fcn.0041600b
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x425044
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4250d6
push 0x8000
push ebx
call fcn.004139bb
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x42506d
jg 0x425068
cmp ecx, 0x1000
jb 0x42506d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041879b
add esp, 0x10
cmp eax, 0xffffffff
je 0x4250b2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x425068
jl 0x425099
test ecx, ecx
jne 0x42505a
push dword [ebp - 0xc]
push ebx
call fcn.004139bb
push esi
call fcn.00416068
add esp, 0xc
xor ebx, ebx
jmp 0x425142
cmp byte [edi + 0x24], 0
je 0x4250c9
cmp dword [edi + 0x20], 5
jne 0x4250c9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4250d4
mov ebx, dword [edi + 0x18]
jmp 0x4250d6
xor ebx, ebx
push esi
call fcn.00416068
pop ecx
jmp 0x425142
test ecx, ecx
jg 0x4250ab
jl 0x4250e9
test eax, eax
jae 0x4250ab
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00419f67
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x425109
cmp byte [edi + 0x1c], 0
je 0x4250ab
jmp 0x42513a
push ebx
call fcn.0041e91c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4250ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x425142
cmp byte [edi + 0x1c], 0
je 0x42513f
mov ebx, dword [edi + 0x18]
jmp 0x425142
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00419f67
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401443
pop dword [ebp - 0x44]
mov eax, 0x401443
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x125681e6
sub dword [ebp - 0x54], 0xc4043c9b
mov dword [ebp - 0x50], 0x8330e26
sub dword [ebp - 0x50], 0xd5ffc1e1
mov dword [ebp - 0x4c], 0x554614ab
sub dword [ebp - 0x4c], 0x8f9d07d
mov dword [ebp - 0x48], 0xb0733de6
sub dword [ebp - 0x48], 0xb0733de6
lea eax, [ebp - 0x54]
push eax
mov eax, 0x4189bcd9
sub eax, 0x41493bd5
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x78339428
sub dword [ebp - 0x54], 0x3c12ad2
mov dword [ebp - 0x50], 0x608a9849
sub dword [ebp - 0x50], 0x1f1e36d4
mov dword [ebp - 0x4c], 0xd9f0012b
add dword [ebp - 0x4c], 0x897f6b41
mov dword [ebp - 0x48], 0x8712468c
sub dword [ebp - 0x48], 0x8712468c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x38486
push 0
call eax
mov ecx, 0x850f64a2
add ecx, 0x7af0e365
mov esi, eax
mov edx, 0x7967c65a
add edx, 0x86dd3da6
add edx, dword [ebp - 0x44]
mov ebx, 0xd529a9e0
add ebx, 0x25ec85f5
mov edi, dword [edx]
add dword [ebp - 0x28], 0x60686c81
xor edi, ebx
mov dword [esi], edi
add dword [ebp - 0x28], 0xc3cd8ab6
add esi, 0x7d6b196e
add esi, 0x8294e696
add edx, 0x88b1f9bb
sub edx, 0x88b1f9b7
loop 0x40155b
add eax, 0x112ef
mov ebx, eax
add eax, 0x53bb328a
add eax, 0xac44cd7b
mov ecx, 0x9bc445dd
sub ecx, 0x9b8445dd
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x434f90]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004064be
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x434f90]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x434f90], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x401ec9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0040dcc0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401f0e
push ebx
call fcn.0040ce91
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x100
push dword [ebp - 4]
push 0x20
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
nop
nop
mov eax, dword [ebp - 4]
test eax, eax
je 0x401f4a
push eax
mov ebx, eax
call fcn.00401e5e
inc eax
push eax
call fcn.0040ce8b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x401f4f
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401f60
push ebx
call fcn.0040ce91
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x40896d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x4089b4
cmp ebx, 0x20
je 0x4089b4
cmp ebx, 0xffffffe0
je 0x4089b4
jne 0x4089bd
add eax, 1
cmp esi, eax
je 0x4089ca
jne 0x408999
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x4089ce
jne 0x408995
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x4089e2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x408aa3
test ecx, ecx
je 0x408aa3
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x408aa3
test ebx, ebx
je 0x408aa3
mov ebx, eax
add ebx, edx
je 0x408aa3
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x408aa3
cmp dword [edx + eax + 0x14], 0
je 0x408aa3
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x408aa3
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x408a93
test dl, dl
je 0x408a8f
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x408a93
add edi, 2
add esi, 2
test dl, dl
jne 0x408a73
xor eax, eax
jmp 0x408a98
sbb eax, eax
or eax, 1
test eax, eax
je 0x408aaf
inc ebp
cmp ebp, dword [esp + 4]
jb 0x408a60
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x4099a5
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4099d3
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4099ca
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4099c2
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4099f4
mov esp, ebp
pop ebp
ret

Function at 0x4099f8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x409a64
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x409a91
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x409a80
xor ecx, eax
xor edx, ebx
dec edi
jne 0x409a71
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x409ab7
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x409a58
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x409ae3
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40e9d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x40e9ee
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x40e9e3
pop esi
ret
Function at 0xd16900
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6c6000]
mov dword [edi + 0x737120], 0xbc768390
push edi
jmp 0xd1692a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xd16931
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd16920
mov eax, 1
add ebx, ebx
jne 0xd16943
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xd16954
jne 0xd16973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd16973
dec eax
add ebx, ebx
jne 0xd16960
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xd16938
add ebx, ebx
jne 0xd1696f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xd169c5
xor ecx, ecx
sub eax, 3
jb 0xd1698b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xd169fa
sar eax, 1
mov ebp, eax
jmp 0xd16996
add ebx, ebx
jne 0xd16996
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd16964
inc ecx
add ebx, ebx
jne 0xd169a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd16964
add ebx, ebx
jne 0xd169b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xd169a6
jne 0xd169c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xd169a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xd169e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xd169d6
jmp 0xd16926
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xd169e4
add edi, ecx
jmp 0xd16926
pop esi
mov edi, esi
mov ecx, 0x2b74c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xd16a02
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xd16a07
lea edi, [esi + 0x912000]
mov eax, dword [edi]
or eax, eax
je 0xd16a78
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x91aec4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x91b054]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xd16a2d
mov ecx, edi
jns 0xd16a5c
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x91b058]
or eax, eax
je 0xd16a72
mov dword [ebx], eax
add ebx, 4
jmp 0xd16a4a
call dword [esi + 0x91b068]
mov ebp, dword [esi + 0x91b05c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xd16aac
sub esp, 0xffffff80
jmp 0x4040c8
Function at 0x4f891514
Capabilities:
Encode data using xor

Disassembly:
call 0x4f89148d
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x4f8914bd
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x4f8914d9
xor edx, 0
jmp 0x4f8914e4
xor edx, edx
jmp 0x4f8914fb
jmp 0x4f891507
xor eax, eax
push 0x8427d7c0
call 0x4f891514
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x4f891550
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x4f891529
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x4f891567
add eax, 0
jno 0x4f89156c
add esi, 0
ret 0x10

Function at 0x4f8922d5
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x4f8922f7
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x4f892499
cmp edi, dword [ebp + 0x10]
jb 0x4f892499
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.4f891dc1
inc edi
jmp 0x4f892380
jmp 0x4f89238d
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.4f891dc1
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.4f891dc1
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x4f8923e1
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x4f8923c5
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.4f89240f
add dword [eax], 0x39
jle 0x4f8923eb
sub al, 0xf5
mov ch, al
call fcn.4f892424
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10